3 * Data transfer and URB enqueing
5 * Copyright (C) 2005-2006 Intel Corporation
6 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License version
10 * 2 as published by the Free Software Foundation.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
23 * How transfers work: get a buffer, break it up in segments (segment
24 * size is a multiple of the maxpacket size). For each segment issue a
25 * segment request (struct wa_xfer_*), then send the data buffer if
26 * out or nothing if in (all over the DTO endpoint).
28 * For each submitted segment request, a notification will come over
29 * the NEP endpoint and a transfer result (struct xfer_result) will
30 * arrive in the DTI URB. Read it, get the xfer ID, see if there is
31 * data coming (inbound transfer), schedule a read and handle it.
33 * Sounds simple, it is a pain to implement.
40 * LIFE CYCLE / STATE DIAGRAM
44 * THIS CODE IS DISGUSTING
46 * Warned you are; it's my second try and still not happy with it.
52 * - Supports DMA xfers, control, bulk and maybe interrupt
54 * - Does not recycle unused rpipes
56 * An rpipe is assigned to an endpoint the first time it is used,
57 * and then it's there, assigned, until the endpoint is disabled
58 * (destroyed [{h,d}wahc_op_ep_disable()]. The assignment of the
59 * rpipe to the endpoint is done under the wa->rpipe_sem semaphore
60 * (should be a mutex).
62 * Two methods it could be done:
64 * (a) set up a timer every time an rpipe's use count drops to 1
65 * (which means unused) or when a transfer ends. Reset the
66 * timer when a xfer is queued. If the timer expires, release
67 * the rpipe [see rpipe_ep_disable()].
69 * (b) when looking for free rpipes to attach [rpipe_get_by_ep()],
70 * when none are found go over the list, check their endpoint
71 * and their activity record (if no last-xfer-done-ts in the
72 * last x seconds) take it
74 * However, due to the fact that we have a set of limited
75 * resources (max-segments-at-the-same-time per xfer,
76 * xfers-per-ripe, blocks-per-rpipe, rpipes-per-host), at the end
77 * we are going to have to rebuild all this based on an scheduler,
78 * to where we have a list of transactions to do and based on the
79 * availability of the different required components (blocks,
80 * rpipes, segment slots, etc), we go scheduling them. Painful.
82 #include <linux/init.h>
83 #include <linux/spinlock.h>
84 #include <linux/slab.h>
85 #include <linux/hash.h>
86 #include <linux/ratelimit.h>
87 #include <linux/export.h>
88 #include <linux/scatterlist.h>
109 static void wa_xfer_delayed_run(struct wa_rpipe *);
112 * Life cycle governed by 'struct urb' (the refcount of the struct is
113 * that of the 'struct urb' and usb_free_urb() would free the whole
118 struct urb *dto_urb; /* for data output? */
119 struct list_head list_node; /* for rpipe->req_list */
120 struct wa_xfer *xfer; /* out xfer */
121 u8 index; /* which segment we are */
122 enum wa_seg_status status;
123 ssize_t result; /* bytes xfered or error */
124 struct wa_xfer_hdr xfer_hdr;
125 u8 xfer_extra[]; /* xtra space for xfer_hdr_ctl */
128 static void wa_seg_init(struct wa_seg *seg)
130 /* usb_init_urb() repeats a lot of work, so we do it here */
131 kref_init(&seg->urb.kref);
135 * Protected by xfer->lock
140 struct list_head list_node;
144 struct wahc *wa; /* Wire adapter we are plugged to */
145 struct usb_host_endpoint *ep;
146 struct urb *urb; /* URB we are transferring for */
147 struct wa_seg **seg; /* transfer segments */
148 u8 segs, segs_submitted, segs_done;
149 unsigned is_inbound:1;
154 gfp_t gfp; /* allocation mask */
156 struct wusb_dev *wusb_dev; /* for activity timestamps */
159 static inline void wa_xfer_init(struct wa_xfer *xfer)
161 kref_init(&xfer->refcnt);
162 INIT_LIST_HEAD(&xfer->list_node);
163 spin_lock_init(&xfer->lock);
167 * Destroy a transfer structure
169 * Note that the xfer->seg[index] thingies follow the URB life cycle,
170 * so we need to put them, not free them.
172 static void wa_xfer_destroy(struct kref *_xfer)
174 struct wa_xfer *xfer = container_of(_xfer, struct wa_xfer, refcnt);
177 for (cnt = 0; cnt < xfer->segs; cnt++) {
178 if (xfer->is_inbound)
179 usb_put_urb(xfer->seg[cnt]->dto_urb);
180 usb_put_urb(&xfer->seg[cnt]->urb);
186 static void wa_xfer_get(struct wa_xfer *xfer)
188 kref_get(&xfer->refcnt);
191 static void wa_xfer_put(struct wa_xfer *xfer)
193 kref_put(&xfer->refcnt, wa_xfer_destroy);
199 * xfer->lock has to be unlocked
201 * We take xfer->lock for setting the result; this is a barrier
202 * against drivers/usb/core/hcd.c:unlink1() being called after we call
203 * usb_hcd_giveback_urb() and wa_urb_dequeue() trying to get a
204 * reference to the transfer.
206 static void wa_xfer_giveback(struct wa_xfer *xfer)
210 spin_lock_irqsave(&xfer->wa->xfer_list_lock, flags);
211 list_del_init(&xfer->list_node);
212 spin_unlock_irqrestore(&xfer->wa->xfer_list_lock, flags);
213 /* FIXME: segmentation broken -- kills DWA */
214 wusbhc_giveback_urb(xfer->wa->wusb, xfer->urb, xfer->result);
222 * xfer->lock has to be unlocked
224 static void wa_xfer_completion(struct wa_xfer *xfer)
227 wusb_dev_put(xfer->wusb_dev);
228 rpipe_put(xfer->ep->hcpriv);
229 wa_xfer_giveback(xfer);
233 * If transfer is done, wrap it up and return true
235 * xfer->lock has to be locked
237 static unsigned __wa_xfer_is_done(struct wa_xfer *xfer)
239 struct device *dev = &xfer->wa->usb_iface->dev;
240 unsigned result, cnt;
242 struct urb *urb = xfer->urb;
243 unsigned found_short = 0;
245 result = xfer->segs_done == xfer->segs_submitted;
248 urb->actual_length = 0;
249 for (cnt = 0; cnt < xfer->segs; cnt++) {
250 seg = xfer->seg[cnt];
251 switch (seg->status) {
253 if (found_short && seg->result > 0) {
254 dev_dbg(dev, "xfer %p#%u: bad short segments (%zu)\n",
255 xfer, cnt, seg->result);
256 urb->status = -EINVAL;
259 urb->actual_length += seg->result;
260 if (seg->result < xfer->seg_size
261 && cnt != xfer->segs-1)
263 dev_dbg(dev, "xfer %p#%u: DONE short %d "
264 "result %zu urb->actual_length %d\n",
265 xfer, seg->index, found_short, seg->result,
269 xfer->result = seg->result;
270 dev_dbg(dev, "xfer %p#%u: ERROR result %zu\n",
271 xfer, seg->index, seg->result);
274 dev_dbg(dev, "xfer %p#%u ABORTED: result %d\n",
275 xfer, seg->index, urb->status);
276 xfer->result = urb->status;
279 dev_warn(dev, "xfer %p#%u: is_done bad state %d\n",
280 xfer, cnt, seg->status);
281 xfer->result = -EINVAL;
291 * Initialize a transfer's ID
293 * We need to use a sequential number; if we use the pointer or the
294 * hash of the pointer, it can repeat over sequential transfers and
295 * then it will confuse the HWA....wonder why in hell they put a 32
296 * bit handle in there then.
298 static void wa_xfer_id_init(struct wa_xfer *xfer)
300 xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
304 * Return the xfer's ID associated with xfer
308 static u32 wa_xfer_id(struct wa_xfer *xfer)
314 * Search for a transfer list ID on the HCD's URB list
316 * For 32 bit architectures, we use the pointer itself; for 64 bits, a
317 * 32-bit hash of the pointer.
319 * @returns NULL if not found.
321 static struct wa_xfer *wa_xfer_get_by_id(struct wahc *wa, u32 id)
324 struct wa_xfer *xfer_itr;
325 spin_lock_irqsave(&wa->xfer_list_lock, flags);
326 list_for_each_entry(xfer_itr, &wa->xfer_list, list_node) {
327 if (id == xfer_itr->id) {
328 wa_xfer_get(xfer_itr);
334 spin_unlock_irqrestore(&wa->xfer_list_lock, flags);
338 struct wa_xfer_abort_buffer {
340 struct wa_xfer_abort cmd;
343 static void __wa_xfer_abort_cb(struct urb *urb)
345 struct wa_xfer_abort_buffer *b = urb->context;
346 usb_put_urb(&b->urb);
350 * Aborts an ongoing transaction
352 * Assumes the transfer is referenced and locked and in a submitted
353 * state (mainly that there is an endpoint/rpipe assigned).
355 * The callback (see above) does nothing but freeing up the data by
356 * putting the URB. Because the URB is allocated at the head of the
357 * struct, the whole space we allocated is kfreed.
359 * We'll get an 'aborted transaction' xfer result on DTI, that'll
360 * politely ignore because at this point the transaction has been
361 * marked as aborted already.
363 static void __wa_xfer_abort(struct wa_xfer *xfer)
366 struct device *dev = &xfer->wa->usb_iface->dev;
367 struct wa_xfer_abort_buffer *b;
368 struct wa_rpipe *rpipe = xfer->ep->hcpriv;
370 b = kmalloc(sizeof(*b), GFP_ATOMIC);
373 b->cmd.bLength = sizeof(b->cmd);
374 b->cmd.bRequestType = WA_XFER_ABORT;
375 b->cmd.wRPipe = rpipe->descr.wRPipeIndex;
376 b->cmd.dwTransferID = wa_xfer_id(xfer);
378 usb_init_urb(&b->urb);
379 usb_fill_bulk_urb(&b->urb, xfer->wa->usb_dev,
380 usb_sndbulkpipe(xfer->wa->usb_dev,
381 xfer->wa->dto_epd->bEndpointAddress),
382 &b->cmd, sizeof(b->cmd), __wa_xfer_abort_cb, b);
383 result = usb_submit_urb(&b->urb, GFP_ATOMIC);
386 return; /* callback frees! */
390 if (printk_ratelimit())
391 dev_err(dev, "xfer %p: Can't submit abort request: %d\n",
401 * @returns < 0 on error, transfer segment request size if ok
403 static ssize_t __wa_xfer_setup_sizes(struct wa_xfer *xfer,
404 enum wa_xfer_type *pxfer_type)
407 struct device *dev = &xfer->wa->usb_iface->dev;
409 struct urb *urb = xfer->urb;
410 struct wa_rpipe *rpipe = xfer->ep->hcpriv;
412 switch (rpipe->descr.bmAttribute & 0x3) {
413 case USB_ENDPOINT_XFER_CONTROL:
414 *pxfer_type = WA_XFER_TYPE_CTL;
415 result = sizeof(struct wa_xfer_ctl);
417 case USB_ENDPOINT_XFER_INT:
418 case USB_ENDPOINT_XFER_BULK:
419 *pxfer_type = WA_XFER_TYPE_BI;
420 result = sizeof(struct wa_xfer_bi);
422 case USB_ENDPOINT_XFER_ISOC:
423 dev_err(dev, "FIXME: ISOC not implemented\n");
429 result = -EINVAL; /* shut gcc up */
431 xfer->is_inbound = urb->pipe & USB_DIR_IN ? 1 : 0;
432 xfer->is_dma = urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP ? 1 : 0;
433 xfer->seg_size = le16_to_cpu(rpipe->descr.wBlocks)
434 * 1 << (xfer->wa->wa_descr->bRPipeBlockSize - 1);
435 /* Compute the segment size and make sure it is a multiple of
436 * the maxpktsize (WUSB1.0[8.3.3.1])...not really too much of
438 maxpktsize = le16_to_cpu(rpipe->descr.wMaxPacketSize);
439 if (xfer->seg_size < maxpktsize) {
440 dev_err(dev, "HW BUG? seg_size %zu smaller than maxpktsize "
441 "%zu\n", xfer->seg_size, maxpktsize);
445 xfer->seg_size = (xfer->seg_size / maxpktsize) * maxpktsize;
446 xfer->segs = DIV_ROUND_UP(urb->transfer_buffer_length, xfer->seg_size);
447 if (xfer->segs >= WA_SEGS_MAX) {
448 dev_err(dev, "BUG? ops, number of segments %d bigger than %d\n",
449 (int)(urb->transfer_buffer_length / xfer->seg_size),
454 if (xfer->segs == 0 && *pxfer_type == WA_XFER_TYPE_CTL)
460 /* Fill in the common request header and xfer-type specific data. */
461 static void __wa_xfer_setup_hdr0(struct wa_xfer *xfer,
462 struct wa_xfer_hdr *xfer_hdr0,
463 enum wa_xfer_type xfer_type,
464 size_t xfer_hdr_size)
466 struct wa_rpipe *rpipe = xfer->ep->hcpriv;
468 xfer_hdr0 = &xfer->seg[0]->xfer_hdr;
469 xfer_hdr0->bLength = xfer_hdr_size;
470 xfer_hdr0->bRequestType = xfer_type;
471 xfer_hdr0->wRPipe = rpipe->descr.wRPipeIndex;
472 xfer_hdr0->dwTransferID = wa_xfer_id(xfer);
473 xfer_hdr0->bTransferSegment = 0;
475 case WA_XFER_TYPE_CTL: {
476 struct wa_xfer_ctl *xfer_ctl =
477 container_of(xfer_hdr0, struct wa_xfer_ctl, hdr);
478 xfer_ctl->bmAttribute = xfer->is_inbound ? 1 : 0;
479 memcpy(&xfer_ctl->baSetupData, xfer->urb->setup_packet,
480 sizeof(xfer_ctl->baSetupData));
483 case WA_XFER_TYPE_BI:
485 case WA_XFER_TYPE_ISO:
486 printk(KERN_ERR "FIXME: ISOC not implemented\n");
493 * Callback for the OUT data phase of the segment request
495 * Check wa_seg_cb(); most comments also apply here because this
496 * function does almost the same thing and they work closely
499 * If the seg request has failed but this DTO phase has succeeded,
500 * wa_seg_cb() has already failed the segment and moved the
501 * status to WA_SEG_ERROR, so this will go through 'case 0' and
502 * effectively do nothing.
504 static void wa_seg_dto_cb(struct urb *urb)
506 struct wa_seg *seg = urb->context;
507 struct wa_xfer *xfer = seg->xfer;
510 struct wa_rpipe *rpipe;
512 unsigned rpipe_ready = 0;
515 switch (urb->status) {
517 spin_lock_irqsave(&xfer->lock, flags);
519 dev = &wa->usb_iface->dev;
520 dev_dbg(dev, "xfer %p#%u: data out done (%d bytes)\n",
521 xfer, seg->index, urb->actual_length);
522 if (seg->status < WA_SEG_PENDING)
523 seg->status = WA_SEG_PENDING;
524 seg->result = urb->actual_length;
525 spin_unlock_irqrestore(&xfer->lock, flags);
527 case -ECONNRESET: /* URB unlinked; no need to do anything */
528 case -ENOENT: /* as it was done by the who unlinked us */
530 default: /* Other errors ... */
531 spin_lock_irqsave(&xfer->lock, flags);
533 dev = &wa->usb_iface->dev;
534 rpipe = xfer->ep->hcpriv;
535 dev_dbg(dev, "xfer %p#%u: data out error %d\n",
536 xfer, seg->index, urb->status);
537 if (edc_inc(&wa->nep_edc, EDC_MAX_ERRORS,
538 EDC_ERROR_TIMEFRAME)){
539 dev_err(dev, "DTO: URB max acceptable errors "
540 "exceeded, resetting device\n");
543 if (seg->status != WA_SEG_ERROR) {
544 seg->status = WA_SEG_ERROR;
545 seg->result = urb->status;
547 __wa_xfer_abort(xfer);
548 rpipe_ready = rpipe_avail_inc(rpipe);
549 done = __wa_xfer_is_done(xfer);
551 spin_unlock_irqrestore(&xfer->lock, flags);
553 wa_xfer_completion(xfer);
555 wa_xfer_delayed_run(rpipe);
560 * Callback for the segment request
562 * If successful transition state (unless already transitioned or
563 * outbound transfer); otherwise, take a note of the error, mark this
564 * segment done and try completion.
566 * Note we don't access until we are sure that the transfer hasn't
567 * been cancelled (ECONNRESET, ENOENT), which could mean that
568 * seg->xfer could be already gone.
570 * We have to check before setting the status to WA_SEG_PENDING
571 * because sometimes the xfer result callback arrives before this
572 * callback (geeeeeeze), so it might happen that we are already in
573 * another state. As well, we don't set it if the transfer is inbound,
574 * as in that case, wa_seg_dto_cb will do it when the OUT data phase
577 static void wa_seg_cb(struct urb *urb)
579 struct wa_seg *seg = urb->context;
580 struct wa_xfer *xfer = seg->xfer;
583 struct wa_rpipe *rpipe;
585 unsigned rpipe_ready;
588 switch (urb->status) {
590 spin_lock_irqsave(&xfer->lock, flags);
592 dev = &wa->usb_iface->dev;
593 dev_dbg(dev, "xfer %p#%u: request done\n", xfer, seg->index);
594 if (xfer->is_inbound && seg->status < WA_SEG_PENDING)
595 seg->status = WA_SEG_PENDING;
596 spin_unlock_irqrestore(&xfer->lock, flags);
598 case -ECONNRESET: /* URB unlinked; no need to do anything */
599 case -ENOENT: /* as it was done by the who unlinked us */
601 default: /* Other errors ... */
602 spin_lock_irqsave(&xfer->lock, flags);
604 dev = &wa->usb_iface->dev;
605 rpipe = xfer->ep->hcpriv;
606 if (printk_ratelimit())
607 dev_err(dev, "xfer %p#%u: request error %d\n",
608 xfer, seg->index, urb->status);
609 if (edc_inc(&wa->nep_edc, EDC_MAX_ERRORS,
610 EDC_ERROR_TIMEFRAME)){
611 dev_err(dev, "DTO: URB max acceptable errors "
612 "exceeded, resetting device\n");
615 usb_unlink_urb(seg->dto_urb);
616 seg->status = WA_SEG_ERROR;
617 seg->result = urb->status;
619 __wa_xfer_abort(xfer);
620 rpipe_ready = rpipe_avail_inc(rpipe);
621 done = __wa_xfer_is_done(xfer);
622 spin_unlock_irqrestore(&xfer->lock, flags);
624 wa_xfer_completion(xfer);
626 wa_xfer_delayed_run(rpipe);
630 /* allocate an SG list to store bytes_to_transfer bytes and copy the
631 * subset of the in_sg that matches the buffer subset
632 * we are about to transfer. */
633 static struct scatterlist *wa_xfer_create_subset_sg(struct scatterlist *in_sg,
634 const unsigned int bytes_transferred,
635 const unsigned int bytes_to_transfer, unsigned int *out_num_sgs)
637 struct scatterlist *out_sg;
638 unsigned int bytes_processed = 0, offset_into_current_page_data = 0,
640 struct scatterlist *current_xfer_sg = in_sg;
641 struct scatterlist *current_seg_sg, *last_seg_sg;
643 /* skip previously transferred pages. */
644 while ((current_xfer_sg) &&
645 (bytes_processed < bytes_transferred)) {
646 bytes_processed += current_xfer_sg->length;
648 /* advance the sg if current segment starts on or past the
650 if (bytes_processed <= bytes_transferred)
651 current_xfer_sg = sg_next(current_xfer_sg);
654 /* the data for the current segment starts in current_xfer_sg.
655 calculate the offset. */
656 if (bytes_processed > bytes_transferred) {
657 offset_into_current_page_data = current_xfer_sg->length -
658 (bytes_processed - bytes_transferred);
661 /* calculate the number of pages needed by this segment. */
662 nents = DIV_ROUND_UP((bytes_to_transfer +
663 offset_into_current_page_data +
664 current_xfer_sg->offset),
667 out_sg = kmalloc((sizeof(struct scatterlist) * nents), GFP_ATOMIC);
669 sg_init_table(out_sg, nents);
671 /* copy the portion of the incoming SG that correlates to the
672 * data to be transferred by this segment to the segment SG. */
673 last_seg_sg = current_seg_sg = out_sg;
676 /* reset nents and calculate the actual number of sg entries
679 while ((bytes_processed < bytes_to_transfer) &&
680 current_seg_sg && current_xfer_sg) {
681 unsigned int page_len = min((current_xfer_sg->length -
682 offset_into_current_page_data),
683 (bytes_to_transfer - bytes_processed));
685 sg_set_page(current_seg_sg, sg_page(current_xfer_sg),
687 current_xfer_sg->offset +
688 offset_into_current_page_data);
690 bytes_processed += page_len;
692 last_seg_sg = current_seg_sg;
693 current_seg_sg = sg_next(current_seg_sg);
694 current_xfer_sg = sg_next(current_xfer_sg);
696 /* only the first page may require additional offset. */
697 offset_into_current_page_data = 0;
701 /* update num_sgs and terminate the list since we may have
702 * concatenated pages. */
703 sg_mark_end(last_seg_sg);
704 *out_num_sgs = nents;
711 * Allocate the segs array and initialize each of them
713 * The segments are freed by wa_xfer_destroy() when the xfer use count
714 * drops to zero; however, because each segment is given the same life
715 * cycle as the USB URB it contains, it is actually freed by
716 * usb_put_urb() on the contained USB URB (twisted, eh?).
718 static int __wa_xfer_setup_segs(struct wa_xfer *xfer, size_t xfer_hdr_size)
721 size_t alloc_size = sizeof(*xfer->seg[0])
722 - sizeof(xfer->seg[0]->xfer_hdr) + xfer_hdr_size;
723 struct usb_device *usb_dev = xfer->wa->usb_dev;
724 const struct usb_endpoint_descriptor *dto_epd = xfer->wa->dto_epd;
726 size_t buf_itr, buf_size, buf_itr_size;
729 xfer->seg = kcalloc(xfer->segs, sizeof(xfer->seg[0]), GFP_ATOMIC);
730 if (xfer->seg == NULL)
731 goto error_segs_kzalloc;
733 buf_size = xfer->urb->transfer_buffer_length;
734 for (cnt = 0; cnt < xfer->segs; cnt++) {
735 seg = xfer->seg[cnt] = kzalloc(alloc_size, GFP_ATOMIC);
737 goto error_seg_kzalloc;
741 usb_fill_bulk_urb(&seg->urb, usb_dev,
742 usb_sndbulkpipe(usb_dev,
743 dto_epd->bEndpointAddress),
744 &seg->xfer_hdr, xfer_hdr_size,
746 buf_itr_size = min(buf_size, xfer->seg_size);
747 if (xfer->is_inbound == 0 && buf_size > 0) {
749 seg->dto_urb = usb_alloc_urb(0, GFP_ATOMIC);
750 if (seg->dto_urb == NULL)
751 goto error_dto_alloc;
753 seg->dto_urb, usb_dev,
754 usb_sndbulkpipe(usb_dev,
755 dto_epd->bEndpointAddress),
756 NULL, 0, wa_seg_dto_cb, seg);
758 seg->dto_urb->transfer_dma =
759 xfer->urb->transfer_dma + buf_itr;
760 seg->dto_urb->transfer_flags |=
761 URB_NO_TRANSFER_DMA_MAP;
762 seg->dto_urb->transfer_buffer = NULL;
763 seg->dto_urb->sg = NULL;
764 seg->dto_urb->num_sgs = 0;
766 /* do buffer or SG processing. */
767 seg->dto_urb->transfer_flags &=
768 ~URB_NO_TRANSFER_DMA_MAP;
769 /* this should always be 0 before a resubmit. */
770 seg->dto_urb->num_mapped_sgs = 0;
772 if (xfer->urb->transfer_buffer) {
773 seg->dto_urb->transfer_buffer =
774 xfer->urb->transfer_buffer +
776 seg->dto_urb->sg = NULL;
777 seg->dto_urb->num_sgs = 0;
779 /* allocate an SG list to store seg_size
780 bytes and copy the subset of the
781 xfer->urb->sg that matches the
782 buffer subset we are about to read.
785 wa_xfer_create_subset_sg(
787 buf_itr, buf_itr_size,
788 &(seg->dto_urb->num_sgs));
790 if (!(seg->dto_urb->sg)) {
791 seg->dto_urb->num_sgs = 0;
795 seg->dto_urb->transfer_buffer = NULL;
798 seg->dto_urb->transfer_buffer_length = buf_itr_size;
800 seg->status = WA_SEG_READY;
801 buf_itr += buf_itr_size;
802 buf_size -= buf_itr_size;
809 kfree(xfer->seg[cnt]);
812 /* use the fact that cnt is left at were it failed */
813 for (; cnt >= 0; cnt--) {
814 if (xfer->seg[cnt] && xfer->is_inbound == 0)
815 usb_free_urb(xfer->seg[cnt]->dto_urb);
816 kfree(xfer->seg[cnt]);
823 * Allocates all the stuff needed to submit a transfer
825 * Breaks the whole data buffer in a list of segments, each one has a
826 * structure allocated to it and linked in xfer->seg[index]
828 * FIXME: merge setup_segs() and the last part of this function, no
829 * need to do two for loops when we could run everything in a
832 static int __wa_xfer_setup(struct wa_xfer *xfer, struct urb *urb)
835 struct device *dev = &xfer->wa->usb_iface->dev;
836 enum wa_xfer_type xfer_type = 0; /* shut up GCC */
837 size_t xfer_hdr_size, cnt, transfer_size;
838 struct wa_xfer_hdr *xfer_hdr0, *xfer_hdr;
840 result = __wa_xfer_setup_sizes(xfer, &xfer_type);
842 goto error_setup_sizes;
843 xfer_hdr_size = result;
844 result = __wa_xfer_setup_segs(xfer, xfer_hdr_size);
846 dev_err(dev, "xfer %p: Failed to allocate %d segments: %d\n",
847 xfer, xfer->segs, result);
848 goto error_setup_segs;
850 /* Fill the first header */
851 xfer_hdr0 = &xfer->seg[0]->xfer_hdr;
852 wa_xfer_id_init(xfer);
853 __wa_xfer_setup_hdr0(xfer, xfer_hdr0, xfer_type, xfer_hdr_size);
855 /* Fill remainig headers */
856 xfer_hdr = xfer_hdr0;
857 transfer_size = urb->transfer_buffer_length;
858 xfer_hdr0->dwTransferLength = transfer_size > xfer->seg_size ?
859 xfer->seg_size : transfer_size;
860 transfer_size -= xfer->seg_size;
861 for (cnt = 1; cnt < xfer->segs; cnt++) {
862 xfer_hdr = &xfer->seg[cnt]->xfer_hdr;
863 memcpy(xfer_hdr, xfer_hdr0, xfer_hdr_size);
864 xfer_hdr->bTransferSegment = cnt;
865 xfer_hdr->dwTransferLength = transfer_size > xfer->seg_size ?
866 cpu_to_le32(xfer->seg_size)
867 : cpu_to_le32(transfer_size);
868 xfer->seg[cnt]->status = WA_SEG_READY;
869 transfer_size -= xfer->seg_size;
871 xfer_hdr->bTransferSegment |= 0x80; /* this is the last segment */
881 * rpipe->seg_lock is held!
883 static int __wa_seg_submit(struct wa_rpipe *rpipe, struct wa_xfer *xfer,
887 result = usb_submit_urb(&seg->urb, GFP_ATOMIC);
889 printk(KERN_ERR "xfer %p#%u: REQ submit failed: %d\n",
890 xfer, seg->index, result);
891 goto error_seg_submit;
894 result = usb_submit_urb(seg->dto_urb, GFP_ATOMIC);
896 printk(KERN_ERR "xfer %p#%u: DTO submit failed: %d\n",
897 xfer, seg->index, result);
898 goto error_dto_submit;
901 seg->status = WA_SEG_SUBMITTED;
902 rpipe_avail_dec(rpipe);
906 usb_unlink_urb(&seg->urb);
908 seg->status = WA_SEG_ERROR;
909 seg->result = result;
914 * Execute more queued request segments until the maximum concurrent allowed
916 * The ugly unlock/lock sequence on the error path is needed as the
917 * xfer->lock normally nests the seg_lock and not viceversa.
920 static void wa_xfer_delayed_run(struct wa_rpipe *rpipe)
923 struct device *dev = &rpipe->wa->usb_iface->dev;
925 struct wa_xfer *xfer;
928 spin_lock_irqsave(&rpipe->seg_lock, flags);
929 while (atomic_read(&rpipe->segs_available) > 0
930 && !list_empty(&rpipe->seg_list)) {
931 seg = list_first_entry(&(rpipe->seg_list), struct wa_seg,
933 list_del(&seg->list_node);
935 result = __wa_seg_submit(rpipe, xfer, seg);
936 dev_dbg(dev, "xfer %p#%u submitted from delayed [%d segments available] %d\n",
937 xfer, seg->index, atomic_read(&rpipe->segs_available), result);
938 if (unlikely(result < 0)) {
939 spin_unlock_irqrestore(&rpipe->seg_lock, flags);
940 spin_lock_irqsave(&xfer->lock, flags);
941 __wa_xfer_abort(xfer);
943 spin_unlock_irqrestore(&xfer->lock, flags);
944 spin_lock_irqsave(&rpipe->seg_lock, flags);
947 spin_unlock_irqrestore(&rpipe->seg_lock, flags);
952 * xfer->lock is taken
954 * On failure submitting we just stop submitting and return error;
955 * wa_urb_enqueue_b() will execute the completion path
957 static int __wa_xfer_submit(struct wa_xfer *xfer)
960 struct wahc *wa = xfer->wa;
961 struct device *dev = &wa->usb_iface->dev;
965 struct wa_rpipe *rpipe = xfer->ep->hcpriv;
966 size_t maxrequests = le16_to_cpu(rpipe->descr.wRequests);
970 spin_lock_irqsave(&wa->xfer_list_lock, flags);
971 list_add_tail(&xfer->list_node, &wa->xfer_list);
972 spin_unlock_irqrestore(&wa->xfer_list_lock, flags);
974 BUG_ON(atomic_read(&rpipe->segs_available) > maxrequests);
976 spin_lock_irqsave(&rpipe->seg_lock, flags);
977 for (cnt = 0; cnt < xfer->segs; cnt++) {
978 available = atomic_read(&rpipe->segs_available);
979 empty = list_empty(&rpipe->seg_list);
980 seg = xfer->seg[cnt];
981 dev_dbg(dev, "xfer %p#%u: available %u empty %u (%s)\n",
982 xfer, cnt, available, empty,
983 available == 0 || !empty ? "delayed" : "submitted");
984 if (available == 0 || !empty) {
985 dev_dbg(dev, "xfer %p#%u: delayed\n", xfer, cnt);
986 seg->status = WA_SEG_DELAYED;
987 list_add_tail(&seg->list_node, &rpipe->seg_list);
989 result = __wa_seg_submit(rpipe, xfer, seg);
991 __wa_xfer_abort(xfer);
992 goto error_seg_submit;
995 xfer->segs_submitted++;
998 spin_unlock_irqrestore(&rpipe->seg_lock, flags);
1003 * Second part of a URB/transfer enqueuement
1005 * Assumes this comes from wa_urb_enqueue() [maybe through
1006 * wa_urb_enqueue_run()]. At this point:
1008 * xfer->wa filled and refcounted
1009 * xfer->ep filled with rpipe refcounted if
1011 * xfer->urb filled and refcounted (this is the case when called
1012 * from wa_urb_enqueue() as we come from usb_submit_urb()
1013 * and when called by wa_urb_enqueue_run(), as we took an
1014 * extra ref dropped by _run() after we return).
1017 * If we fail at __wa_xfer_submit(), then we just check if we are done
1018 * and if so, we run the completion procedure. However, if we are not
1019 * yet done, we do nothing and wait for the completion handlers from
1020 * the submitted URBs or from the xfer-result path to kick in. If xfer
1021 * result never kicks in, the xfer will timeout from the USB code and
1022 * dequeue() will be called.
1024 static void wa_urb_enqueue_b(struct wa_xfer *xfer)
1027 unsigned long flags;
1028 struct urb *urb = xfer->urb;
1029 struct wahc *wa = xfer->wa;
1030 struct wusbhc *wusbhc = wa->wusb;
1031 struct wusb_dev *wusb_dev;
1034 result = rpipe_get_by_ep(wa, xfer->ep, urb, xfer->gfp);
1036 goto error_rpipe_get;
1038 /* FIXME: segmentation broken -- kills DWA */
1039 mutex_lock(&wusbhc->mutex); /* get a WUSB dev */
1040 if (urb->dev == NULL) {
1041 mutex_unlock(&wusbhc->mutex);
1042 goto error_dev_gone;
1044 wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, urb->dev);
1045 if (wusb_dev == NULL) {
1046 mutex_unlock(&wusbhc->mutex);
1047 goto error_dev_gone;
1049 mutex_unlock(&wusbhc->mutex);
1051 spin_lock_irqsave(&xfer->lock, flags);
1052 xfer->wusb_dev = wusb_dev;
1053 result = urb->status;
1054 if (urb->status != -EINPROGRESS)
1055 goto error_dequeued;
1057 result = __wa_xfer_setup(xfer, urb);
1059 goto error_xfer_setup;
1060 result = __wa_xfer_submit(xfer);
1062 goto error_xfer_submit;
1063 spin_unlock_irqrestore(&xfer->lock, flags);
1066 /* this is basically wa_xfer_completion() broken up wa_xfer_giveback()
1067 * does a wa_xfer_put() that will call wa_xfer_destroy() and clean
1072 spin_unlock_irqrestore(&xfer->lock, flags);
1073 /* FIXME: segmentation broken, kills DWA */
1075 wusb_dev_put(wusb_dev);
1077 rpipe_put(xfer->ep->hcpriv);
1079 xfer->result = result;
1080 wa_xfer_giveback(xfer);
1084 done = __wa_xfer_is_done(xfer);
1085 xfer->result = result;
1086 spin_unlock_irqrestore(&xfer->lock, flags);
1088 wa_xfer_completion(xfer);
1092 * Execute the delayed transfers in the Wire Adapter @wa
1094 * We need to be careful here, as dequeue() could be called in the
1095 * middle. That's why we do the whole thing under the
1096 * wa->xfer_list_lock. If dequeue() jumps in, it first locks xfer->lock
1097 * and then checks the list -- so as we would be acquiring in inverse
1098 * order, we move the delayed list to a separate list while locked and then
1099 * submit them without the list lock held.
1101 void wa_urb_enqueue_run(struct work_struct *ws)
1103 struct wahc *wa = container_of(ws, struct wahc, xfer_work);
1104 struct wa_xfer *xfer, *next;
1106 LIST_HEAD(tmp_list);
1108 /* Create a copy of the wa->xfer_delayed_list while holding the lock */
1109 spin_lock_irq(&wa->xfer_list_lock);
1110 list_cut_position(&tmp_list, &wa->xfer_delayed_list,
1111 wa->xfer_delayed_list.prev);
1112 spin_unlock_irq(&wa->xfer_list_lock);
1115 * enqueue from temp list without list lock held since wa_urb_enqueue_b
1116 * can take xfer->lock as well as lock mutexes.
1118 list_for_each_entry_safe(xfer, next, &tmp_list, list_node) {
1119 list_del_init(&xfer->list_node);
1122 wa_urb_enqueue_b(xfer);
1123 usb_put_urb(urb); /* taken when queuing */
1126 EXPORT_SYMBOL_GPL(wa_urb_enqueue_run);
1129 * Submit a transfer to the Wire Adapter in a delayed way
1131 * The process of enqueuing involves possible sleeps() [see
1132 * enqueue_b(), for the rpipe_get() and the mutex_lock()]. If we are
1133 * in an atomic section, we defer the enqueue_b() call--else we call direct.
1135 * @urb: We own a reference to it done by the HCI Linux USB stack that
1136 * will be given up by calling usb_hcd_giveback_urb() or by
1137 * returning error from this function -> ergo we don't have to
1140 int wa_urb_enqueue(struct wahc *wa, struct usb_host_endpoint *ep,
1141 struct urb *urb, gfp_t gfp)
1144 struct device *dev = &wa->usb_iface->dev;
1145 struct wa_xfer *xfer;
1146 unsigned long my_flags;
1147 unsigned cant_sleep = irqs_disabled() | in_atomic();
1149 if ((urb->transfer_buffer == NULL)
1150 && (urb->sg == NULL)
1151 && !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
1152 && urb->transfer_buffer_length != 0) {
1153 dev_err(dev, "BUG? urb %p: NULL xfer buffer & NODMA\n", urb);
1158 xfer = kzalloc(sizeof(*xfer), gfp);
1163 if (urb->status != -EINPROGRESS) /* cancelled */
1164 goto error_dequeued; /* before starting? */
1166 xfer->wa = wa_get(wa);
1172 dev_dbg(dev, "xfer %p urb %p pipe 0x%02x [%d bytes] %s %s %s\n",
1173 xfer, urb, urb->pipe, urb->transfer_buffer_length,
1174 urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP ? "dma" : "nodma",
1175 urb->pipe & USB_DIR_IN ? "inbound" : "outbound",
1176 cant_sleep ? "deferred" : "inline");
1180 spin_lock_irqsave(&wa->xfer_list_lock, my_flags);
1181 list_add_tail(&xfer->list_node, &wa->xfer_delayed_list);
1182 spin_unlock_irqrestore(&wa->xfer_list_lock, my_flags);
1183 queue_work(wusbd, &wa->xfer_work);
1185 wa_urb_enqueue_b(xfer);
1194 EXPORT_SYMBOL_GPL(wa_urb_enqueue);
1197 * Dequeue a URB and make sure uwb_hcd_giveback_urb() [completion
1198 * handler] is called.
1200 * Until a transfer goes successfully through wa_urb_enqueue() it
1201 * needs to be dequeued with completion calling; when stuck in delayed
1202 * or before wa_xfer_setup() is called, we need to do completion.
1204 * not setup If there is no hcpriv yet, that means that that enqueue
1205 * still had no time to set the xfer up. Because
1206 * urb->status should be other than -EINPROGRESS,
1207 * enqueue() will catch that and bail out.
1209 * If the transfer has gone through setup, we just need to clean it
1210 * up. If it has gone through submit(), we have to abort it [with an
1211 * asynch request] and then make sure we cancel each segment.
1214 int wa_urb_dequeue(struct wahc *wa, struct urb *urb)
1216 unsigned long flags, flags2;
1217 struct wa_xfer *xfer;
1219 struct wa_rpipe *rpipe;
1221 unsigned rpipe_ready = 0;
1225 /* NOthing setup yet enqueue will see urb->status !=
1226 * -EINPROGRESS (by hcd layer) and bail out with
1227 * error, no need to do completion
1229 BUG_ON(urb->status == -EINPROGRESS);
1232 spin_lock_irqsave(&xfer->lock, flags);
1233 rpipe = xfer->ep->hcpriv;
1234 /* Check the delayed list -> if there, release and complete */
1235 spin_lock_irqsave(&wa->xfer_list_lock, flags2);
1236 if (!list_empty(&xfer->list_node) && xfer->seg == NULL)
1237 goto dequeue_delayed;
1238 spin_unlock_irqrestore(&wa->xfer_list_lock, flags2);
1239 if (xfer->seg == NULL) /* still hasn't reached */
1240 goto out_unlock; /* setup(), enqueue_b() completes */
1241 /* Ok, the xfer is in flight already, it's been setup and submitted.*/
1242 __wa_xfer_abort(xfer);
1243 for (cnt = 0; cnt < xfer->segs; cnt++) {
1244 seg = xfer->seg[cnt];
1245 switch (seg->status) {
1246 case WA_SEG_NOTREADY:
1248 printk(KERN_ERR "xfer %p#%u: dequeue bad state %u\n",
1249 xfer, cnt, seg->status);
1252 case WA_SEG_DELAYED:
1253 seg->status = WA_SEG_ABORTED;
1254 spin_lock_irqsave(&rpipe->seg_lock, flags2);
1255 list_del(&seg->list_node);
1257 rpipe_ready = rpipe_avail_inc(rpipe);
1258 spin_unlock_irqrestore(&rpipe->seg_lock, flags2);
1260 case WA_SEG_SUBMITTED:
1261 seg->status = WA_SEG_ABORTED;
1262 usb_unlink_urb(&seg->urb);
1263 if (xfer->is_inbound == 0)
1264 usb_unlink_urb(seg->dto_urb);
1266 rpipe_ready = rpipe_avail_inc(rpipe);
1268 case WA_SEG_PENDING:
1269 seg->status = WA_SEG_ABORTED;
1271 rpipe_ready = rpipe_avail_inc(rpipe);
1273 case WA_SEG_DTI_PENDING:
1274 usb_unlink_urb(wa->dti_urb);
1275 seg->status = WA_SEG_ABORTED;
1277 rpipe_ready = rpipe_avail_inc(rpipe);
1281 case WA_SEG_ABORTED:
1285 xfer->result = urb->status; /* -ENOENT or -ECONNRESET */
1286 __wa_xfer_is_done(xfer);
1287 spin_unlock_irqrestore(&xfer->lock, flags);
1288 wa_xfer_completion(xfer);
1290 wa_xfer_delayed_run(rpipe);
1294 spin_unlock_irqrestore(&xfer->lock, flags);
1299 list_del_init(&xfer->list_node);
1300 spin_unlock_irqrestore(&wa->xfer_list_lock, flags2);
1301 xfer->result = urb->status;
1302 spin_unlock_irqrestore(&xfer->lock, flags);
1303 wa_xfer_giveback(xfer);
1304 usb_put_urb(urb); /* we got a ref in enqueue() */
1307 EXPORT_SYMBOL_GPL(wa_urb_dequeue);
1310 * Translation from WA status codes (WUSB1.0 Table 8.15) to errno
1313 * Positive errno values are internal inconsistencies and should be
1314 * flagged louder. Negative are to be passed up to the user in the
1317 * @status: USB WA status code -- high two bits are stripped.
1319 static int wa_xfer_status_to_errno(u8 status)
1322 u8 real_status = status;
1323 static int xlat[] = {
1324 [WA_XFER_STATUS_SUCCESS] = 0,
1325 [WA_XFER_STATUS_HALTED] = -EPIPE,
1326 [WA_XFER_STATUS_DATA_BUFFER_ERROR] = -ENOBUFS,
1327 [WA_XFER_STATUS_BABBLE] = -EOVERFLOW,
1328 [WA_XFER_RESERVED] = EINVAL,
1329 [WA_XFER_STATUS_NOT_FOUND] = 0,
1330 [WA_XFER_STATUS_INSUFFICIENT_RESOURCE] = -ENOMEM,
1331 [WA_XFER_STATUS_TRANSACTION_ERROR] = -EILSEQ,
1332 [WA_XFER_STATUS_ABORTED] = -EINTR,
1333 [WA_XFER_STATUS_RPIPE_NOT_READY] = EINVAL,
1334 [WA_XFER_INVALID_FORMAT] = EINVAL,
1335 [WA_XFER_UNEXPECTED_SEGMENT_NUMBER] = EINVAL,
1336 [WA_XFER_STATUS_RPIPE_TYPE_MISMATCH] = EINVAL,
1342 if (status >= ARRAY_SIZE(xlat)) {
1343 printk_ratelimited(KERN_ERR "%s(): BUG? "
1344 "Unknown WA transfer status 0x%02x\n",
1345 __func__, real_status);
1348 errno = xlat[status];
1349 if (unlikely(errno > 0)) {
1350 printk_ratelimited(KERN_ERR "%s(): BUG? "
1351 "Inconsistent WA status: 0x%02x\n",
1352 __func__, real_status);
1359 * Process a xfer result completion message
1361 * inbound transfers: need to schedule a DTI read
1363 * FIXME: this functio needs to be broken up in parts
1365 static void wa_xfer_result_chew(struct wahc *wa, struct wa_xfer *xfer)
1368 struct device *dev = &wa->usb_iface->dev;
1369 unsigned long flags;
1372 struct wa_rpipe *rpipe;
1373 struct wa_xfer_result *xfer_result = wa->xfer_result;
1376 unsigned rpipe_ready = 0;
1378 spin_lock_irqsave(&xfer->lock, flags);
1379 seg_idx = xfer_result->bTransferSegment & 0x7f;
1380 if (unlikely(seg_idx >= xfer->segs))
1382 seg = xfer->seg[seg_idx];
1383 rpipe = xfer->ep->hcpriv;
1384 usb_status = xfer_result->bTransferStatus;
1385 dev_dbg(dev, "xfer %p#%u: bTransferStatus 0x%02x (seg status %u)\n",
1386 xfer, seg_idx, usb_status, seg->status);
1387 if (seg->status == WA_SEG_ABORTED
1388 || seg->status == WA_SEG_ERROR) /* already handled */
1389 goto segment_aborted;
1390 if (seg->status == WA_SEG_SUBMITTED) /* ops, got here */
1391 seg->status = WA_SEG_PENDING; /* before wa_seg{_dto}_cb() */
1392 if (seg->status != WA_SEG_PENDING) {
1393 if (printk_ratelimit())
1394 dev_err(dev, "xfer %p#%u: Bad segment state %u\n",
1395 xfer, seg_idx, seg->status);
1396 seg->status = WA_SEG_PENDING; /* workaround/"fix" it */
1398 if (usb_status & 0x80) {
1399 seg->result = wa_xfer_status_to_errno(usb_status);
1400 dev_err(dev, "DTI: xfer %p#:%08X:%u failed (0x%02x)\n",
1401 xfer, xfer->id, seg->index, usb_status);
1402 goto error_complete;
1404 /* FIXME: we ignore warnings, tally them for stats */
1405 if (usb_status & 0x40) /* Warning?... */
1406 usb_status = 0; /* ... pass */
1407 if (xfer->is_inbound) { /* IN data phase: read to buffer */
1408 seg->status = WA_SEG_DTI_PENDING;
1409 BUG_ON(wa->buf_in_urb->status == -EINPROGRESS);
1410 /* this should always be 0 before a resubmit. */
1411 wa->buf_in_urb->num_mapped_sgs = 0;
1414 wa->buf_in_urb->transfer_dma =
1415 xfer->urb->transfer_dma
1416 + (seg_idx * xfer->seg_size);
1417 wa->buf_in_urb->transfer_flags
1418 |= URB_NO_TRANSFER_DMA_MAP;
1419 wa->buf_in_urb->transfer_buffer = NULL;
1420 wa->buf_in_urb->sg = NULL;
1421 wa->buf_in_urb->num_sgs = 0;
1423 /* do buffer or SG processing. */
1424 wa->buf_in_urb->transfer_flags
1425 &= ~URB_NO_TRANSFER_DMA_MAP;
1427 if (xfer->urb->transfer_buffer) {
1428 wa->buf_in_urb->transfer_buffer =
1429 xfer->urb->transfer_buffer
1430 + (seg_idx * xfer->seg_size);
1431 wa->buf_in_urb->sg = NULL;
1432 wa->buf_in_urb->num_sgs = 0;
1434 /* allocate an SG list to store seg_size bytes
1435 and copy the subset of the xfer->urb->sg
1436 that matches the buffer subset we are
1438 wa->buf_in_urb->sg = wa_xfer_create_subset_sg(
1440 seg_idx * xfer->seg_size,
1442 xfer_result->dwTransferLength),
1443 &(wa->buf_in_urb->num_sgs));
1445 if (!(wa->buf_in_urb->sg)) {
1446 wa->buf_in_urb->num_sgs = 0;
1447 goto error_sg_alloc;
1449 wa->buf_in_urb->transfer_buffer = NULL;
1452 wa->buf_in_urb->transfer_buffer_length =
1453 le32_to_cpu(xfer_result->dwTransferLength);
1454 wa->buf_in_urb->context = seg;
1455 result = usb_submit_urb(wa->buf_in_urb, GFP_ATOMIC);
1457 goto error_submit_buf_in;
1459 /* OUT data phase, complete it -- */
1460 seg->status = WA_SEG_DONE;
1461 seg->result = le32_to_cpu(xfer_result->dwTransferLength);
1463 rpipe_ready = rpipe_avail_inc(rpipe);
1464 done = __wa_xfer_is_done(xfer);
1466 spin_unlock_irqrestore(&xfer->lock, flags);
1468 wa_xfer_completion(xfer);
1470 wa_xfer_delayed_run(rpipe);
1473 error_submit_buf_in:
1474 if (edc_inc(&wa->dti_edc, EDC_MAX_ERRORS, EDC_ERROR_TIMEFRAME)) {
1475 dev_err(dev, "DTI: URB max acceptable errors "
1476 "exceeded, resetting device\n");
1479 if (printk_ratelimit())
1480 dev_err(dev, "xfer %p#%u: can't submit DTI data phase: %d\n",
1481 xfer, seg_idx, result);
1482 seg->result = result;
1483 kfree(wa->buf_in_urb->sg);
1486 seg->status = WA_SEG_ERROR;
1488 rpipe_ready = rpipe_avail_inc(rpipe);
1489 __wa_xfer_abort(xfer);
1490 done = __wa_xfer_is_done(xfer);
1491 spin_unlock_irqrestore(&xfer->lock, flags);
1493 wa_xfer_completion(xfer);
1495 wa_xfer_delayed_run(rpipe);
1499 spin_unlock_irqrestore(&xfer->lock, flags);
1500 wa_urb_dequeue(wa, xfer->urb);
1501 if (printk_ratelimit())
1502 dev_err(dev, "xfer %p#%u: bad segment\n", xfer, seg_idx);
1503 if (edc_inc(&wa->dti_edc, EDC_MAX_ERRORS, EDC_ERROR_TIMEFRAME)) {
1504 dev_err(dev, "DTI: URB max acceptable errors "
1505 "exceeded, resetting device\n");
1511 /* nothing to do, as the aborter did the completion */
1512 spin_unlock_irqrestore(&xfer->lock, flags);
1516 * Callback for the IN data phase
1518 * If successful transition state; otherwise, take a note of the
1519 * error, mark this segment done and try completion.
1521 * Note we don't access until we are sure that the transfer hasn't
1522 * been cancelled (ECONNRESET, ENOENT), which could mean that
1523 * seg->xfer could be already gone.
1525 static void wa_buf_in_cb(struct urb *urb)
1527 struct wa_seg *seg = urb->context;
1528 struct wa_xfer *xfer = seg->xfer;
1531 struct wa_rpipe *rpipe;
1532 unsigned rpipe_ready;
1533 unsigned long flags;
1536 /* free the sg if it was used. */
1540 switch (urb->status) {
1542 spin_lock_irqsave(&xfer->lock, flags);
1544 dev = &wa->usb_iface->dev;
1545 rpipe = xfer->ep->hcpriv;
1546 dev_dbg(dev, "xfer %p#%u: data in done (%zu bytes)\n",
1547 xfer, seg->index, (size_t)urb->actual_length);
1548 seg->status = WA_SEG_DONE;
1549 seg->result = urb->actual_length;
1551 rpipe_ready = rpipe_avail_inc(rpipe);
1552 done = __wa_xfer_is_done(xfer);
1553 spin_unlock_irqrestore(&xfer->lock, flags);
1555 wa_xfer_completion(xfer);
1557 wa_xfer_delayed_run(rpipe);
1559 case -ECONNRESET: /* URB unlinked; no need to do anything */
1560 case -ENOENT: /* as it was done by the who unlinked us */
1562 default: /* Other errors ... */
1563 spin_lock_irqsave(&xfer->lock, flags);
1565 dev = &wa->usb_iface->dev;
1566 rpipe = xfer->ep->hcpriv;
1567 if (printk_ratelimit())
1568 dev_err(dev, "xfer %p#%u: data in error %d\n",
1569 xfer, seg->index, urb->status);
1570 if (edc_inc(&wa->nep_edc, EDC_MAX_ERRORS,
1571 EDC_ERROR_TIMEFRAME)){
1572 dev_err(dev, "DTO: URB max acceptable errors "
1573 "exceeded, resetting device\n");
1576 seg->status = WA_SEG_ERROR;
1577 seg->result = urb->status;
1579 rpipe_ready = rpipe_avail_inc(rpipe);
1580 __wa_xfer_abort(xfer);
1581 done = __wa_xfer_is_done(xfer);
1582 spin_unlock_irqrestore(&xfer->lock, flags);
1584 wa_xfer_completion(xfer);
1586 wa_xfer_delayed_run(rpipe);
1591 * Handle an incoming transfer result buffer
1593 * Given a transfer result buffer, it completes the transfer (possibly
1594 * scheduling and buffer in read) and then resubmits the DTI URB for a
1595 * new transfer result read.
1598 * The xfer_result DTI URB state machine
1600 * States: OFF | RXR (Read-Xfer-Result) | RBI (Read-Buffer-In)
1602 * We start in OFF mode, the first xfer_result notification [through
1603 * wa_handle_notif_xfer()] moves us to RXR by posting the DTI-URB to
1606 * We receive a buffer -- if it is not a xfer_result, we complain and
1607 * repost the DTI-URB. If it is a xfer_result then do the xfer seg
1608 * request accounting. If it is an IN segment, we move to RBI and post
1609 * a BUF-IN-URB to the right buffer. The BUF-IN-URB callback will
1610 * repost the DTI-URB and move to RXR state. if there was no IN
1611 * segment, it will repost the DTI-URB.
1613 * We go back to OFF when we detect a ENOENT or ESHUTDOWN (or too many
1614 * errors) in the URBs.
1616 static void wa_xfer_result_cb(struct urb *urb)
1619 struct wahc *wa = urb->context;
1620 struct device *dev = &wa->usb_iface->dev;
1621 struct wa_xfer_result *xfer_result;
1623 struct wa_xfer *xfer;
1626 BUG_ON(wa->dti_urb != urb);
1627 switch (wa->dti_urb->status) {
1629 /* We have a xfer result buffer; check it */
1630 dev_dbg(dev, "DTI: xfer result %d bytes at %p\n",
1631 urb->actual_length, urb->transfer_buffer);
1632 if (wa->dti_urb->actual_length != sizeof(*xfer_result)) {
1633 dev_err(dev, "DTI Error: xfer result--bad size "
1634 "xfer result (%d bytes vs %zu needed)\n",
1635 urb->actual_length, sizeof(*xfer_result));
1638 xfer_result = wa->xfer_result;
1639 if (xfer_result->hdr.bLength != sizeof(*xfer_result)) {
1640 dev_err(dev, "DTI Error: xfer result--"
1641 "bad header length %u\n",
1642 xfer_result->hdr.bLength);
1645 if (xfer_result->hdr.bNotifyType != WA_XFER_RESULT) {
1646 dev_err(dev, "DTI Error: xfer result--"
1647 "bad header type 0x%02x\n",
1648 xfer_result->hdr.bNotifyType);
1651 usb_status = xfer_result->bTransferStatus & 0x3f;
1652 if (usb_status == WA_XFER_STATUS_ABORTED
1653 || usb_status == WA_XFER_STATUS_NOT_FOUND)
1654 /* taken care of already */
1656 xfer_id = xfer_result->dwTransferID;
1657 xfer = wa_xfer_get_by_id(wa, xfer_id);
1659 /* FIXME: transaction might have been cancelled */
1660 dev_err(dev, "DTI Error: xfer result--"
1661 "unknown xfer 0x%08x (status 0x%02x)\n",
1662 xfer_id, usb_status);
1665 wa_xfer_result_chew(wa, xfer);
1668 case -ENOENT: /* (we killed the URB)...so, no broadcast */
1669 case -ESHUTDOWN: /* going away! */
1670 dev_dbg(dev, "DTI: going down! %d\n", urb->status);
1674 if (edc_inc(&wa->dti_edc, EDC_MAX_ERRORS,
1675 EDC_ERROR_TIMEFRAME)) {
1676 dev_err(dev, "DTI: URB max acceptable errors "
1677 "exceeded, resetting device\n");
1681 if (printk_ratelimit())
1682 dev_err(dev, "DTI: URB error %d\n", urb->status);
1685 /* Resubmit the DTI URB */
1686 result = usb_submit_urb(wa->dti_urb, GFP_ATOMIC);
1688 dev_err(dev, "DTI Error: Could not submit DTI URB (%d), "
1689 "resetting\n", result);
1697 * Transfer complete notification
1699 * Called from the notif.c code. We get a notification on EP2 saying
1700 * that some endpoint has some transfer result data available. We are
1703 * To speed up things, we always have a URB reading the DTI URB; we
1704 * don't really set it up and start it until the first xfer complete
1705 * notification arrives, which is what we do here.
1707 * Follow up in wa_xfer_result_cb(), as that's where the whole state
1710 * So here we just initialize the DTI URB for reading transfer result
1711 * notifications and also the buffer-in URB, for reading buffers. Then
1712 * we just submit the DTI URB.
1714 * @wa shall be referenced
1716 void wa_handle_notif_xfer(struct wahc *wa, struct wa_notif_hdr *notif_hdr)
1719 struct device *dev = &wa->usb_iface->dev;
1720 struct wa_notif_xfer *notif_xfer;
1721 const struct usb_endpoint_descriptor *dti_epd = wa->dti_epd;
1723 notif_xfer = container_of(notif_hdr, struct wa_notif_xfer, hdr);
1724 BUG_ON(notif_hdr->bNotifyType != WA_NOTIF_TRANSFER);
1726 if ((0x80 | notif_xfer->bEndpoint) != dti_epd->bEndpointAddress) {
1727 /* FIXME: hardcoded limitation, adapt */
1728 dev_err(dev, "BUG: DTI ep is %u, not %u (hack me)\n",
1729 notif_xfer->bEndpoint, dti_epd->bEndpointAddress);
1732 if (wa->dti_urb != NULL) /* DTI URB already started */
1735 wa->dti_urb = usb_alloc_urb(0, GFP_KERNEL);
1736 if (wa->dti_urb == NULL) {
1737 dev_err(dev, "Can't allocate DTI URB\n");
1738 goto error_dti_urb_alloc;
1741 wa->dti_urb, wa->usb_dev,
1742 usb_rcvbulkpipe(wa->usb_dev, 0x80 | notif_xfer->bEndpoint),
1743 wa->xfer_result, wa->xfer_result_size,
1744 wa_xfer_result_cb, wa);
1746 wa->buf_in_urb = usb_alloc_urb(0, GFP_KERNEL);
1747 if (wa->buf_in_urb == NULL) {
1748 dev_err(dev, "Can't allocate BUF-IN URB\n");
1749 goto error_buf_in_urb_alloc;
1752 wa->buf_in_urb, wa->usb_dev,
1753 usb_rcvbulkpipe(wa->usb_dev, 0x80 | notif_xfer->bEndpoint),
1754 NULL, 0, wa_buf_in_cb, wa);
1755 result = usb_submit_urb(wa->dti_urb, GFP_KERNEL);
1757 dev_err(dev, "DTI Error: Could not submit DTI URB (%d), "
1758 "resetting\n", result);
1759 goto error_dti_urb_submit;
1764 error_dti_urb_submit:
1765 usb_put_urb(wa->buf_in_urb);
1766 error_buf_in_urb_alloc:
1767 usb_put_urb(wa->dti_urb);
1769 error_dti_urb_alloc: