static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
{
unsigned long flags;
struct sk_buff *skb;
int count = 0;
spin_lock_irqsave (&q->lock, flags);
while (!skb_queue_empty(q)) {
struct skb_data *entry;
struct urb *urb;
int retval;
skb_queue_walk(q, skb) {
entry = (struct skb_data *) skb->cb;
if (entry->state != unlink_start)
goto found;
}
break;
found:
entry->state = unlink_start;
urb = entry->urb;
usb_get_urb(urb);
spin_unlock_irqrestore(&q->lock, flags);
retval = usb_unlink_urb (urb);
if (retval != -EINPROGRESS && retval != 0)
netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
else
count++;
usb_put_urb(urb);
spin_lock_irqsave(&q->lock, flags);
}
/*
* Can not be called in atomic context.
*/
static void message_cancel(struct gb_message *message)
{
struct gb_host_device *hd = message->operation->connection->hd;
struct es2_ap_dev *es2 = hd_to_es2(hd);
struct urb *urb;
int i;
might_sleep();
spin_lock_irq(&es2->cport_out_urb_lock);
urb = message->hcpriv;
/* Prevent dynamically allocated urb from being deallocated. */
usb_get_urb(urb);
/* Prevent pre-allocated urb from being reused. */
for (i = 0; i < NUM_CPORT_OUT_URB; ++i) {
if (urb == es2->cport_out_urb[i]) {
es2->cport_out_urb_cancelled[i] = true;
break;
}
}
spin_unlock_irq(&es2->cport_out_urb_lock);
usb_kill_urb(urb);
if (i < NUM_CPORT_OUT_URB) {
spin_lock_irq(&es2->cport_out_urb_lock);
es2->cport_out_urb_cancelled[i] = false;
spin_unlock_irq(&es2->cport_out_urb_lock);
}
usb_free_urb(urb);
}
static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
{
unsigned long flags;
struct sk_buff *skb, *skbnext;
int count = 0;
spin_lock_irqsave (&q->lock, flags);
skb_queue_walk_safe(q, skb, skbnext) {
struct skb_data *entry;
struct urb *urb;
int retval;
entry = (struct skb_data *) skb->cb;
urb = entry->urb;
/*
* Get reference count of the URB to avoid it to be
* freed during usb_unlink_urb, which may trigger
* use-after-free problem inside usb_unlink_urb since
* usb_unlink_urb is always racing with .complete
* handler(include defer_bh).
*/
usb_get_urb(urb);
// during some PM-driven resume scenarios,
// these (async) unlinks complete immediately
retval = usb_unlink_urb (urb);
if (retval != -EINPROGRESS && retval != 0)
netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
else
count++;
usb_put_urb(urb);
}
spin_unlock_irqrestore (&q->lock, flags);
return count;
}
/**
* usb_anchor_urb - anchors an URB while it is processed
* @urb: pointer to the urb to anchor
* @anchor: pointer to the anchor
*
* This can be called to have access to URBs which are to be executed
* without bothering to track them
*/
void usb_anchor_urb(struct urb *urb, struct usb_anchor *anchor)
{
unsigned long flags;
spin_lock_irqsave(&anchor->lock, flags);
usb_get_urb(urb);
list_add_tail(&urb->anchor_list, &anchor->urb_list);
urb->anchor = anchor;
spin_unlock_irqrestore(&anchor->lock, flags);
}
/**
* usb_anchor_urb - anchors an URB while it is processed
* @urb: pointer to the urb to anchor
* @anchor: pointer to the anchor
*
* This can be called to have access to URBs which are to be executed
* without bothering to track them
*/
void usb_anchor_urb(struct urb *urb, struct usb_anchor *anchor)
{
unsigned long flags;
spin_lock_irqsave(&anchor->lock, flags);
usb_get_urb(urb);
list_add_tail(&urb->anchor_list, &anchor->urb_list);
urb->anchor = anchor;
if (unlikely(anchor->poisoned))
atomic_inc(&urb->reject);
spin_unlock_irqrestore(&anchor->lock, flags);
}
/**
* usb_poison_anchored_urbs - cease all traffic from an anchor
* @anchor: anchor the requests are bound to
*
* this allows all outstanding URBs to be poisoned starting
* from the back of the queue. Newly added URBs will also be
* poisoned
*
* This routine should not be called by a driver after its disconnect
* method has returned.
*/
void usb_poison_anchored_urbs(struct usb_anchor *anchor)
{
struct urb *victim;
spin_lock_irq(&anchor->lock);
// anchor->poisoned = 1; /* XXX: Cannot backport */
while (!list_empty(&anchor->urb_list)) {
victim = list_entry(anchor->urb_list.prev, struct urb,
anchor_list);
/* we must make sure the URB isn't freed before we kill it*/
usb_get_urb(victim);
spin_unlock_irq(&anchor->lock);
/* this will unanchor the URB */
usb_poison_urb(victim);
usb_put_urb(victim);
spin_lock_irq(&anchor->lock);
}
spin_unlock_irq(&anchor->lock);
}
/*
* Allocate a URB and initialize the various fields of it.
* This API is used by the single_step_set_feature test of
* EHSET where IN packet of the GetDescriptor request is
* sent 15secs after the SETUP packet.
* Return NULL if failed.
*/
static struct urb *xhci_request_single_step_set_feature_urb(
struct usb_device *udev,
void *dr,
void *buf,
struct completion *done)
{
struct urb *urb;
struct usb_hcd *hcd = bus_to_hcd(udev->bus);
struct usb_host_endpoint *ep;
urb = usb_alloc_urb(0, GFP_KERNEL);
if (!urb)
return NULL;
urb->pipe = usb_rcvctrlpipe(udev, 0);
ep = udev->ep_in[usb_pipeendpoint(urb->pipe)];
if (!ep) {
usb_free_urb(urb);
return NULL;
}
/*
* Initialize the various URB fields as these are used by the HCD
* driver to queue it and as well as when completion happens.
*/
urb->ep = ep;
urb->dev = udev;
urb->setup_packet = dr;
urb->transfer_buffer = buf;
urb->transfer_buffer_length = USB_DT_DEVICE_SIZE;
urb->complete = xhci_single_step_completion;
urb->status = -EINPROGRESS;
urb->actual_length = 0;
urb->transfer_flags = URB_DIR_IN;
usb_get_urb(urb);
atomic_inc(&urb->use_count);
atomic_inc(&urb->dev->urbnum);
usb_hcd_map_urb_for_dma(hcd, urb, GFP_KERNEL);
urb->context = done;
return urb;
}
static int vhcd_urb_enqueue(struct usb_hcd *hcd,
struct usb_host_endpoint *ep,
struct urb *urb,
gfp_t mem_flags)
{
int ret = 0;
unsigned int transfer_flags = 0 ;
struct usb_device * udev = urb->dev;
/* FIXME Check for non existent device */
if (!HC_IS_RUNNING(hcd->state)) {
LOG("HC is not running\n");
return -ENODEV;
}
/* we have to trap some control messages, i.e. USB_REQ_SET_ADDRESS... */
/* TODO we don't have to do it here, but in the server */
if (usb_pipedevice(urb->pipe) == 0) {
__u8 type = usb_pipetype(urb->pipe);
struct usb_ctrlrequest *ctrlreq = (struct usb_ctrlrequest *) urb->setup_packet;
if (type != PIPE_CONTROL || !ctrlreq ) {
LOG("invalid request to devnum 0\n");
ret = -EINVAL;
goto no_need_xmit;
}
switch (ctrlreq->bRequest) {
case USB_REQ_SET_ADDRESS:
LOG("SetAddress Request (%d) to port %d\n",
ctrlreq->wValue, urb->dev->portnum);
spin_lock (&urb->lock);
if (urb->status == -EINPROGRESS) {
/* This request is successfully completed. */
/* If not -EINPROGRESS, possibly unlinked. */
urb->status = 0;
}
spin_unlock (&urb->lock);
goto no_need_xmit;
case USB_REQ_GET_DESCRIPTOR:
if (ctrlreq->wValue == (USB_DT_DEVICE << 8))
LOG("Get_Descriptor to device 0 (get max pipe size)\n");
goto out;
default:
/* NOT REACHED */
LOG("invalid request to devnum 0 bRequest %u, wValue %u\n",
ctrlreq->bRequest, ctrlreq->wValue);
ret = -EINVAL;
goto no_need_xmit;
}
}
out:
if (urb->status != -EINPROGRESS) {
LOG("URB already unlinked!, status %d\n", urb->status);
return urb->status;
}
if (usb_pipeisoc(urb->pipe)) {
LOG("ISO URBs not supported");
ret = -EINVAL;
goto no_need_xmit;
}
urb->hcpriv = (void *) hcd_to_vhcd(hcd);
LOG("hcpriv %p", urb->hcpriv);
transfer_flags = urb->transfer_flags;
usb_get_urb(urb);
#if 0
d_urb->type = usb_pipetype(urb->pipe);
d_urb->dev_id = data->gadget[urb->dev->portnum-1].id;
d_urb->endpoint = usb_pipeendpoint(urb->pipe);
d_urb->direction = 0 || usb_pipein(urb->pipe);
d_urb->interval = urb->interval;
d_urb->transfer_flags = urb->transfer_flags;
d_urb->number_of_packets = urb->number_of_packets;
d_urb->priv = priv;
d_urb->size = urb->transfer_buffer_length;
d_urb->data = urb->transfer_buffer;
d_urb->phys_addr = d_urb->data?virt_to_phys(d_urb->data):0;
if (urb->setup_packet) {
memcpy(d_urb->setup_packet, urb->setup_packet, 8);
}
/* XXX ISO ? */
// if (urb->number_of_packets)
// memcpy(d_urb->iso_desc, urb->iso_frame_desc, urb->number_of_packets*sizeof(struct usb_iso_packet_descriptor));
ret = libddeusb_submit_d_urb(d_urb);
#else
unsigned port_num = urb->dev->portnum;
switch (usb_pipetype(urb->pipe)) {
case PIPE_CONTROL:
{
struct usb_ctrlrequest *req = (struct usb_ctrlrequest *)
urb->setup_packet;
dde_linux26_usb_vhcd_submit_control_urb_cb(port_num,
usb_pipeendpoint(urb->pipe),
usb_pipein(urb->pipe),
urb, /* handle */
sizeof(*req), req);
}
break;
case PIPE_INTERRUPT:
printk(" int\n");
// dde_linux26_usb_vhcd_submit_urb(urb->transfer_buffer,
// urb->transfer_buffer_length);
return -EINVAL;
break;
/* unsupported transfer types */
case PIPE_BULK:
printk(" bulk\n");
return -EINVAL;
case PIPE_ISOCHRONOUS:
printk(" isoc\n");
return -EINVAL;
}
#endif
// if (ret) {
// LOG("URB SUBMIT FAILED (%d).",ret);
// /* s.t. went wrong. */
// spin_lock_irqsave(&data->lock, flags);
// data->rcv_buf[i]=NULL;
// spin_unlock_irqrestore(&data->lock, flags);
// down(&data->rcv_buf_free);
// kmem_cache_free(priv_cache, urb->hcpriv);
// usb_put_urb(urb);
// urb->status = ret;
// urb->hcpriv = NULL;
// libddeusb_free_d_urb(d_urb);
// return ret;
// }
LOG("URB %p submitted", urb);
return 0;
no_need_xmit:
usb_hcd_giveback_urb(hcd, urb);
return 0;
}
/*
* This function implements the USB_PORT_FEAT_TEST handling of the
* SINGLE_STEP_SET_FEATURE test mode as defined in the Embedded
* High-Speed Electrical Test (EHSET) specification. This simply
* issues a GetDescriptor control transfer, with an inserted 15-second
* delay after the end of the SETUP stage and before the IN token of
* the DATA stage is set. The idea is that this gives the test operator
* enough time to configure the oscilloscope to perform a measurement
* of the response time between the DATA and ACK packets that follow.
*/
static int xhci_ehset_single_step_set_feature(struct usb_hcd *hcd, int port)
{
int retval = -ENOMEM;
struct usb_ctrlrequest *dr;
struct urb *urb;
struct usb_device *udev;
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
struct usb_device_descriptor *buf;
unsigned long flags;
DECLARE_COMPLETION_ONSTACK(done);
/* Obtain udev of the rhub's child port */
udev = usb_hub_find_child(hcd->self.root_hub, port);
if (!udev) {
xhci_err(xhci, "No device attached to the RootHub\n");
return -ENODEV;
}
buf = kmalloc(USB_DT_DEVICE_SIZE, GFP_KERNEL);
if (!buf)
return -ENOMEM;
dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
if (!dr) {
kfree(buf);
return -ENOMEM;
}
/* Fill Setup packet for GetDescriptor */
dr->bRequestType = USB_DIR_IN;
dr->bRequest = USB_REQ_GET_DESCRIPTOR;
dr->wValue = cpu_to_le16(USB_DT_DEVICE << 8);
dr->wIndex = 0;
dr->wLength = cpu_to_le16(USB_DT_DEVICE_SIZE);
urb = xhci_request_single_step_set_feature_urb(udev, dr, buf, &done);
if (!urb)
goto cleanup;
/* Now complete just the SETUP stage */
spin_lock_irqsave(&xhci->lock, flags);
retval = xhci_submit_single_step_set_feature(hcd, urb, 1);
spin_unlock_irqrestore(&xhci->lock, flags);
if (retval)
goto out1;
if (!wait_for_completion_timeout(&done, msecs_to_jiffies(2000))) {
usb_kill_urb(urb);
retval = -ETIMEDOUT;
xhci_err(xhci, "%s SETUP stage timed out on ep0\n", __func__);
goto out1;
}
/* Sleep for 15 seconds; HC will send SOFs during this period */
msleep(15 * 1000);
/* Complete remaining DATA and status stages. Re-use same URB */
urb->status = -EINPROGRESS;
usb_get_urb(urb);
atomic_inc(&urb->use_count);
atomic_inc(&urb->dev->urbnum);
spin_lock_irqsave(&xhci->lock, flags);
retval = xhci_submit_single_step_set_feature(hcd, urb, 0);
spin_unlock_irqrestore(&xhci->lock, flags);
if (!retval && !wait_for_completion_timeout(&done,
msecs_to_jiffies(2000))) {
usb_kill_urb(urb);
retval = -ETIMEDOUT;
xhci_err(xhci, "%s IN stage timed out on ep0\n", __func__);
}
out1:
usb_free_urb(urb);
cleanup:
kfree(dr);
kfree(buf);
return retval;
}
/*
* Read an ack from the notification endpoint
*
* @i2400m:
* @_ack: pointer to where to store the read data
* @ack_size: how many bytes we should read
*
* Returns: < 0 errno code on error; otherwise, amount of received bytes.
*
* Submits a notification read, appends the read data to the given ack
* buffer and then repeats (until @ack_size bytes have been
* received).
*/
ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
struct i2400m_bootrom_header *_ack,
size_t ack_size)
{
ssize_t result = -ENOMEM;
struct device *dev = i2400m_dev(i2400m);
struct i2400mu *i2400mu = container_of(i2400m, struct i2400mu, i2400m);
struct urb notif_urb;
void *ack = _ack;
size_t offset, len;
long val;
int do_autopm = 1;
DECLARE_COMPLETION_ONSTACK(notif_completion);
d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
i2400m, ack, ack_size);
BUG_ON(_ack == i2400m->bm_ack_buf);
result = usb_autopm_get_interface(i2400mu->usb_iface);
if (result < 0) {
dev_err(dev, "BM-ACK: can't get autopm: %d\n", (int) result);
do_autopm = 0;
}
usb_init_urb(¬if_urb); /* ready notifications */
usb_get_urb(¬if_urb);
offset = 0;
while (offset < ack_size) {
init_completion(¬if_completion);
result = i2400mu_notif_submit(i2400mu, ¬if_urb,
¬if_completion);
if (result < 0)
goto error_notif_urb_submit;
val = wait_for_completion_interruptible_timeout(
¬if_completion, HZ);
if (val == 0) {
result = -ETIMEDOUT;
usb_kill_urb(¬if_urb); /* Timedout */
goto error_notif_wait;
}
if (val == -ERESTARTSYS) {
result = -EINTR; /* Interrupted */
usb_kill_urb(¬if_urb);
goto error_notif_wait;
}
result = notif_urb.status; /* How was the ack? */
switch (result) {
case 0:
break;
case -EINVAL: /* while removing driver */
case -ENODEV: /* dev disconnect ... */
case -ENOENT: /* just ignore it */
case -ESHUTDOWN: /* and exit */
case -ECONNRESET:
result = -ESHUTDOWN;
goto error_dev_gone;
default: /* any other? */
usb_kill_urb(¬if_urb); /* Timedout */
if (edc_inc(&i2400mu->urb_edc,
EDC_MAX_ERRORS, EDC_ERROR_TIMEFRAME))
goto error_exceeded;
dev_err(dev, "BM-ACK: URB error %d, "
"retrying\n", notif_urb.status);
continue; /* retry */
}
if (notif_urb.actual_length == 0) {
d_printf(6, dev, "ZLP received, retrying\n");
continue;
}
/* Got data, append it to the buffer */
len = min(ack_size - offset, (size_t) notif_urb.actual_length);
memcpy(ack + offset, i2400m->bm_ack_buf, len);
offset += len;
}
result = offset;
error_notif_urb_submit:
error_notif_wait:
error_dev_gone:
out:
if (do_autopm)
usb_autopm_put_interface(i2400mu->usb_iface);
d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
i2400m, ack, ack_size, (long) result);
return result;
error_exceeded:
dev_err(dev, "bm: maximum errors in notification URB exceeded; "
"resetting device\n");
usb_queue_reset_device(i2400mu->usb_iface);
goto out;
}
static void rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
{
struct sk_buff *skb;
struct skb_data *entry;
int retval = 0;
unsigned long lockflags;
size_t size = dev->rx_urb_size;
#if defined(CONFIG_RA_HW_NAT_PCI) && (defined(CONFIG_RA_HW_NAT) || defined(CONFIG_RA_HW_NAT_MODULE))
if ((skb = alloc_skb (size + NET_IP_ALIGN + FOE_INFO_LEN, flags)) == NULL) {
#else
if ((skb = alloc_skb (size + NET_IP_ALIGN, flags)) == NULL) {
#endif
if (netif_msg_rx_err (dev))
devdbg (dev, "no rx skb");
usbnet_defer_kevent (dev, EVENT_RX_MEMORY);
usb_free_urb (urb);
return;
}
#if defined(CONFIG_RA_HW_NAT_PCI) && (defined(CONFIG_RA_HW_NAT) || defined(CONFIG_RA_HW_NAT_MODULE))
skb_reserve (skb, NET_IP_ALIGN + FOE_INFO_LEN);
#else
skb_reserve (skb, NET_IP_ALIGN);
#endif
entry = (struct skb_data *) skb->cb;
entry->urb = urb;
entry->dev = dev;
entry->length = 0;
usb_fill_bulk_urb (urb, dev->udev, dev->in,
skb->data, size, rx_complete, skb);
spin_lock_irqsave (&dev->rxq.lock, lockflags);
if (netif_running (dev->net)
&& netif_device_present (dev->net)
&& !test_bit (EVENT_RX_HALT, &dev->flags)) {
switch (retval = usb_submit_urb (urb, GFP_ATOMIC)){
case -EPIPE:
usbnet_defer_kevent (dev, EVENT_RX_HALT);
break;
case -ENOMEM:
usbnet_defer_kevent (dev, EVENT_RX_MEMORY);
break;
case -ENODEV:
if (netif_msg_ifdown (dev))
devdbg (dev, "device gone");
netif_device_detach (dev->net);
break;
default:
if (netif_msg_rx_err (dev))
devdbg (dev, "rx submit, %d", retval);
tasklet_schedule (&dev->bh);
break;
case 0:
__usbnet_queue_skb(&dev->rxq, skb, rx_start);
}
} else {
if (netif_msg_ifdown (dev))
devdbg (dev, "rx: stopped");
retval = -ENOLINK;
}
spin_unlock_irqrestore (&dev->rxq.lock, lockflags);
if (retval) {
dev_kfree_skb_any (skb);
usb_free_urb (urb);
}
}
/*-------------------------------------------------------------------------*/
static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
{
if (dev->driver_info->rx_fixup
&& !dev->driver_info->rx_fixup (dev, skb))
goto error;
// else network stack removes extra byte if we forced a short packet
if (skb->len)
usbnet_skb_return (dev, skb);
else {
if (netif_msg_rx_err (dev))
devdbg (dev, "drop");
error:
dev->stats.rx_errors++;
skb_queue_tail (&dev->done, skb);
}
}
/*-------------------------------------------------------------------------*/
static void rx_complete (struct urb *urb)
{
struct sk_buff *skb = (struct sk_buff *) urb->context;
struct skb_data *entry = (struct skb_data *) skb->cb;
struct usbnet *dev = entry->dev;
int urb_status = urb->status;
enum skb_state state;
skb_put (skb, urb->actual_length);
state = rx_done;
entry->urb = NULL;
switch (urb_status) {
// success
case 0:
if (skb->len < dev->net->hard_header_len) {
state = rx_cleanup;
dev->stats.rx_errors++;
dev->stats.rx_length_errors++;
if (netif_msg_rx_err (dev))
devdbg (dev, "rx length %d", skb->len);
}
break;
// stalls need manual reset. this is rare ... except that
// when going through USB 2.0 TTs, unplug appears this way.
// we avoid the highspeed version of the ETIMEOUT/EILSEQ
// storm, recovering as needed.
case -EPIPE:
dev->stats.rx_errors++;
usbnet_defer_kevent (dev, EVENT_RX_HALT);
// FALLTHROUGH
// software-driven interface shutdown
case -ECONNRESET: // async unlink
case -ESHUTDOWN: // hardware gone
if (netif_msg_ifdown (dev))
devdbg (dev, "rx shutdown, code %d", urb_status);
goto block;
// we get controller i/o faults during khubd disconnect() delays.
// throttle down resubmits, to avoid log floods; just temporarily,
// so we still recover when the fault isn't a khubd delay.
case -EPROTO:
case -ETIME:
case -EILSEQ:
dev->stats.rx_errors++;
if (!timer_pending (&dev->delay)) {
mod_timer (&dev->delay, jiffies + THROTTLE_JIFFIES);
if (netif_msg_link (dev))
devdbg (dev, "rx throttle %d", urb_status);
}
block:
state = rx_cleanup;
entry->urb = urb;
urb = NULL;
break;
// data overrun ... flush fifo?
case -EOVERFLOW:
dev->stats.rx_over_errors++;
// FALLTHROUGH
default:
state = rx_cleanup;
dev->stats.rx_errors++;
if (netif_msg_rx_err (dev))
devdbg (dev, "rx status %d", urb_status);
break;
}
state = defer_bh(dev, skb, &dev->rxq, state);
if (urb) {
if (netif_running (dev->net)
&& !test_bit (EVENT_RX_HALT, &dev->flags) &&
state != unlink_start) {
rx_submit (dev, urb, GFP_ATOMIC);
return;
}
usb_free_urb (urb);
}
if (netif_msg_rx_err (dev))
devdbg (dev, "no read resubmitted");
}
static void intr_complete (struct urb *urb)
{
struct usbnet *dev = urb->context;
int status = urb->status;
switch (status) {
/* success */
case 0:
dev->driver_info->status(dev, urb);
break;
/* software-driven interface shutdown */
case -ENOENT: // urb killed
case -ESHUTDOWN: // hardware gone
if (netif_msg_ifdown (dev))
devdbg (dev, "intr shutdown, code %d", status);
return;
/* NOTE: not throttling like RX/TX, since this endpoint
* already polls infrequently
*/
default:
devdbg (dev, "intr status %d", status);
break;
}
memset(urb->transfer_buffer, 0, urb->transfer_buffer_length);
status = usb_submit_urb (urb, GFP_ATOMIC);
if (status != 0 && netif_msg_timer (dev))
deverr(dev, "intr resubmit --> %d", status);
}
/*-------------------------------------------------------------------------*/
// unlink pending rx/tx; completion handlers do all other cleanup
static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
{
unsigned long flags;
struct sk_buff *skb;
int count = 0;
spin_lock_irqsave (&q->lock, flags);
while (!skb_queue_empty(q)) {
struct skb_data *entry;
struct urb *urb;
int retval;
skb_queue_walk(q, skb) {
entry = (struct skb_data *) skb->cb;
if (entry->state != unlink_start)
goto found;
}
break;
found:
entry->state = unlink_start;
urb = entry->urb;
/*
* Get reference count of the URB to avoid it to be
* freed during usb_unlink_urb, which may trigger
* use-after-free problem inside usb_unlink_urb since
* usb_unlink_urb is always racing with .complete
* handler(include defer_bh).
*/
usb_get_urb(urb);
spin_unlock_irqrestore(&q->lock, flags);
// during some PM-driven resume scenarios,
// these (async) unlinks complete immediately
retval = usb_unlink_urb (urb);
if (retval != -EINPROGRESS && retval != 0)
devdbg (dev, "unlink urb err, %d", retval);
else
count++;
usb_put_urb(urb);
spin_lock_irqsave(&q->lock, flags);
}
pUrb SysUsbGetUrb(pUrb urb) { return (pUrb) usb_get_urb((struct urb *)urb); }
