neh.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620
  1. /*
  2. * WUSB Wire Adapter: Radio Control Interface (WUSB[8])
  3. * Notification and Event Handling
  4. *
  5. * Copyright (C) 2005-2006 Intel Corporation
  6. * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
  7. *
  8. * This program is free software; you can redistribute it and/or
  9. * modify it under the terms of the GNU General Public License version
  10. * 2 as published by the Free Software Foundation.
  11. *
  12. * This program is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  20. * 02110-1301, USA.
  21. *
  22. *
  23. * The RC interface of the Host Wire Adapter (USB dongle) or WHCI PCI
  24. * card delivers a stream of notifications and events to the
  25. * notification end event endpoint or area. This code takes care of
  26. * getting a buffer with that data, breaking it up in separate
  27. * notifications and events and then deliver those.
  28. *
  29. * Events are answers to commands and they carry a context ID that
  30. * associates them to the command. Notifications are that,
  31. * notifications, they come out of the blue and have a context ID of
  32. * zero. Think of the context ID kind of like a handler. The
  33. * uwb_rc_neh_* code deals with managing context IDs.
  34. *
  35. * This is why you require a handle to operate on a UWB host. When you
  36. * open a handle a context ID is assigned to you.
  37. *
  38. * So, as it is done is:
  39. *
  40. * 1. Add an event handler [uwb_rc_neh_add()] (assigns a ctx id)
  41. * 2. Issue command [rc->cmd(rc, ...)]
  42. * 3. Arm the timeout timer [uwb_rc_neh_arm()]
  43. * 4, Release the reference to the neh [uwb_rc_neh_put()]
  44. * 5. Wait for the callback
  45. * 6. Command result (RCEB) is passed to the callback
  46. *
  47. * If (2) fails, you should remove the handle [uwb_rc_neh_rm()]
  48. * instead of arming the timer.
  49. *
  50. * Handles are for using in *serialized* code, single thread.
  51. *
  52. * When the notification/event comes, the IRQ handler/endpoint
  53. * callback passes the data read to uwb_rc_neh_grok() which will break
  54. * it up in a discrete series of events, look up who is listening for
  55. * them and execute the pertinent callbacks.
  56. *
  57. * If the reader detects an error while reading the data stream, call
  58. * uwb_rc_neh_error().
  59. *
  60. * CONSTRAINTS/ASSUMPTIONS:
  61. *
  62. * - Most notifications/events are small (less thank .5k), copying
  63. * around is ok.
  64. *
  65. * - Notifications/events are ALWAYS smaller than PAGE_SIZE
  66. *
  67. * - Notifications/events always come in a single piece (ie: a buffer
  68. * will always contain entire notifications/events).
  69. *
  70. * - we cannot know in advance how long each event is (because they
  71. * lack a length field in their header--smart move by the standards
  72. * body, btw). So we need a facility to get the event size given the
  73. * header. This is what the EST code does (notif/Event Size
  74. * Tables), check nest.c--as well, you can associate the size to
  75. * the handle [w/ neh->extra_size()].
  76. *
  77. * - Most notifications/events are fixed size; only a few are variable
  78. * size (NEST takes care of that).
  79. *
  80. * - Listeners of events expect them, so they usually provide a
  81. * buffer, as they know the size. Listeners to notifications don't,
  82. * so we allocate their buffers dynamically.
  83. */
  84. #include <linux/kernel.h>
  85. #include <linux/timer.h>
  86. #include <linux/slab.h>
  87. #include <linux/err.h>
  88. #include <linux/export.h>
  89. #include "uwb-internal.h"
  90. /*
  91. * UWB Radio Controller Notification/Event Handle
  92. *
  93. * Represents an entity waiting for an event coming from the UWB Radio
  94. * Controller with a given context id (context) and type (evt_type and
  95. * evt). On reception of the notification/event, the callback (cb) is
  96. * called with the event.
  97. *
  98. * If the timer expires before the event is received, the callback is
  99. * called with -ETIMEDOUT as the event size.
  100. */
  101. struct uwb_rc_neh {
  102. struct kref kref;
  103. struct uwb_rc *rc;
  104. u8 evt_type;
  105. __le16 evt;
  106. u8 context;
  107. u8 completed;
  108. uwb_rc_cmd_cb_f cb;
  109. void *arg;
  110. struct timer_list timer;
  111. struct list_head list_node;
  112. };
  113. static void uwb_rc_neh_timer(unsigned long arg);
  114. static void uwb_rc_neh_release(struct kref *kref)
  115. {
  116. struct uwb_rc_neh *neh = container_of(kref, struct uwb_rc_neh, kref);
  117. kfree(neh);
  118. }
  119. static void uwb_rc_neh_get(struct uwb_rc_neh *neh)
  120. {
  121. kref_get(&neh->kref);
  122. }
  123. /**
  124. * uwb_rc_neh_put - release reference to a neh
  125. * @neh: the neh
  126. */
  127. void uwb_rc_neh_put(struct uwb_rc_neh *neh)
  128. {
  129. kref_put(&neh->kref, uwb_rc_neh_release);
  130. }
  131. /**
  132. * Assigns @neh a context id from @rc's pool
  133. *
  134. * @rc: UWB Radio Controller descriptor; @rc->neh_lock taken
  135. * @neh: Notification/Event Handle
  136. * @returns 0 if context id was assigned ok; < 0 errno on error (if
  137. * all the context IDs are taken).
  138. *
  139. * (assumes @wa is locked).
  140. *
  141. * NOTE: WUSB spec reserves context ids 0x00 for notifications and
  142. * 0xff is invalid, so they must not be used. Initialization
  143. * fills up those two in the bitmap so they are not allocated.
  144. *
  145. * We spread the allocation around to reduce the possibility of two
  146. * consecutive opened @neh's getting the same context ID assigned (to
  147. * avoid surprises with late events that timed out long time ago). So
  148. * first we search from where @rc->ctx_roll is, if not found, we
  149. * search from zero.
  150. */
  151. static
  152. int __uwb_rc_ctx_get(struct uwb_rc *rc, struct uwb_rc_neh *neh)
  153. {
  154. int result;
  155. result = find_next_zero_bit(rc->ctx_bm, UWB_RC_CTX_MAX,
  156. rc->ctx_roll++);
  157. if (result < UWB_RC_CTX_MAX)
  158. goto found;
  159. result = find_first_zero_bit(rc->ctx_bm, UWB_RC_CTX_MAX);
  160. if (result < UWB_RC_CTX_MAX)
  161. goto found;
  162. return -ENFILE;
  163. found:
  164. set_bit(result, rc->ctx_bm);
  165. neh->context = result;
  166. return 0;
  167. }
  168. /** Releases @neh's context ID back to @rc (@rc->neh_lock is locked). */
  169. static
  170. void __uwb_rc_ctx_put(struct uwb_rc *rc, struct uwb_rc_neh *neh)
  171. {
  172. struct device *dev = &rc->uwb_dev.dev;
  173. if (neh->context == 0)
  174. return;
  175. if (test_bit(neh->context, rc->ctx_bm) == 0) {
  176. dev_err(dev, "context %u not set in bitmap\n",
  177. neh->context);
  178. WARN_ON(1);
  179. }
  180. clear_bit(neh->context, rc->ctx_bm);
  181. neh->context = 0;
  182. }
  183. /**
  184. * uwb_rc_neh_add - add a neh for a radio controller command
  185. * @rc: the radio controller
  186. * @cmd: the radio controller command
  187. * @expected_type: the type of the expected response event
  188. * @expected_event: the expected event ID
  189. * @cb: callback for when the event is received
  190. * @arg: argument for the callback
  191. *
  192. * Creates a neh and adds it to the list of those waiting for an
  193. * event. A context ID will be assigned to the command.
  194. */
  195. struct uwb_rc_neh *uwb_rc_neh_add(struct uwb_rc *rc, struct uwb_rccb *cmd,
  196. u8 expected_type, u16 expected_event,
  197. uwb_rc_cmd_cb_f cb, void *arg)
  198. {
  199. int result;
  200. unsigned long flags;
  201. struct device *dev = &rc->uwb_dev.dev;
  202. struct uwb_rc_neh *neh;
  203. neh = kzalloc(sizeof(*neh), GFP_KERNEL);
  204. if (neh == NULL) {
  205. result = -ENOMEM;
  206. goto error_kzalloc;
  207. }
  208. kref_init(&neh->kref);
  209. INIT_LIST_HEAD(&neh->list_node);
  210. setup_timer(&neh->timer, uwb_rc_neh_timer, (unsigned long)neh);
  211. neh->rc = rc;
  212. neh->evt_type = expected_type;
  213. neh->evt = cpu_to_le16(expected_event);
  214. neh->cb = cb;
  215. neh->arg = arg;
  216. spin_lock_irqsave(&rc->neh_lock, flags);
  217. result = __uwb_rc_ctx_get(rc, neh);
  218. if (result >= 0) {
  219. cmd->bCommandContext = neh->context;
  220. list_add_tail(&neh->list_node, &rc->neh_list);
  221. uwb_rc_neh_get(neh);
  222. }
  223. spin_unlock_irqrestore(&rc->neh_lock, flags);
  224. if (result < 0)
  225. goto error_ctx_get;
  226. return neh;
  227. error_ctx_get:
  228. kfree(neh);
  229. error_kzalloc:
  230. dev_err(dev, "cannot open handle to radio controller: %d\n", result);
  231. return ERR_PTR(result);
  232. }
  233. static void __uwb_rc_neh_rm(struct uwb_rc *rc, struct uwb_rc_neh *neh)
  234. {
  235. __uwb_rc_ctx_put(rc, neh);
  236. list_del(&neh->list_node);
  237. }
  238. /**
  239. * uwb_rc_neh_rm - remove a neh.
  240. * @rc: the radio controller
  241. * @neh: the neh to remove
  242. *
  243. * Remove an active neh immediately instead of waiting for the event
  244. * (or a time out).
  245. */
  246. void uwb_rc_neh_rm(struct uwb_rc *rc, struct uwb_rc_neh *neh)
  247. {
  248. unsigned long flags;
  249. spin_lock_irqsave(&rc->neh_lock, flags);
  250. __uwb_rc_neh_rm(rc, neh);
  251. spin_unlock_irqrestore(&rc->neh_lock, flags);
  252. del_timer_sync(&neh->timer);
  253. uwb_rc_neh_put(neh);
  254. }
  255. /**
  256. * uwb_rc_neh_arm - arm an event handler timeout timer
  257. *
  258. * @rc: UWB Radio Controller
  259. * @neh: Notification/event handler for @rc
  260. *
  261. * The timer is only armed if the neh is active.
  262. */
  263. void uwb_rc_neh_arm(struct uwb_rc *rc, struct uwb_rc_neh *neh)
  264. {
  265. unsigned long flags;
  266. spin_lock_irqsave(&rc->neh_lock, flags);
  267. if (neh->context)
  268. mod_timer(&neh->timer,
  269. jiffies + msecs_to_jiffies(UWB_RC_CMD_TIMEOUT_MS));
  270. spin_unlock_irqrestore(&rc->neh_lock, flags);
  271. }
  272. static void uwb_rc_neh_cb(struct uwb_rc_neh *neh, struct uwb_rceb *rceb, size_t size)
  273. {
  274. (*neh->cb)(neh->rc, neh->arg, rceb, size);
  275. uwb_rc_neh_put(neh);
  276. }
  277. static bool uwb_rc_neh_match(struct uwb_rc_neh *neh, const struct uwb_rceb *rceb)
  278. {
  279. return neh->evt_type == rceb->bEventType
  280. && neh->evt == rceb->wEvent
  281. && neh->context == rceb->bEventContext;
  282. }
  283. /**
  284. * Find the handle waiting for a RC Radio Control Event
  285. *
  286. * @rc: UWB Radio Controller
  287. * @rceb: Pointer to the RCEB buffer
  288. * @event_size: Pointer to the size of the RCEB buffer. Might be
  289. * adjusted to take into account the @neh->extra_size
  290. * settings.
  291. *
  292. * If the listener has no buffer (NULL buffer), one is allocated for
  293. * the right size (the amount of data received). @neh->ptr will point
  294. * to the event payload, which always starts with a 'struct
  295. * uwb_rceb'. kfree() it when done.
  296. */
  297. static
  298. struct uwb_rc_neh *uwb_rc_neh_lookup(struct uwb_rc *rc,
  299. const struct uwb_rceb *rceb)
  300. {
  301. struct uwb_rc_neh *neh = NULL, *h;
  302. unsigned long flags;
  303. spin_lock_irqsave(&rc->neh_lock, flags);
  304. list_for_each_entry(h, &rc->neh_list, list_node) {
  305. if (uwb_rc_neh_match(h, rceb)) {
  306. neh = h;
  307. break;
  308. }
  309. }
  310. if (neh)
  311. __uwb_rc_neh_rm(rc, neh);
  312. spin_unlock_irqrestore(&rc->neh_lock, flags);
  313. return neh;
  314. }
  315. /*
  316. * Process notifications coming from the radio control interface
  317. *
  318. * @rc: UWB Radio Control Interface descriptor
  319. * @neh: Notification/Event Handler @neh->ptr points to
  320. * @uwb_evt->buffer.
  321. *
  322. * This function is called by the event/notif handling subsystem when
  323. * notifications arrive (hwarc_probe() arms a notification/event handle
  324. * that calls back this function for every received notification; this
  325. * function then will rearm itself).
  326. *
  327. * Notification data buffers are dynamically allocated by the NEH
  328. * handling code in neh.c [uwb_rc_neh_lookup()]. What is actually
  329. * allocated is space to contain the notification data.
  330. *
  331. * Buffers are prefixed with a Radio Control Event Block (RCEB) as
  332. * defined by the WUSB Wired-Adapter Radio Control interface. We
  333. * just use it for the notification code.
  334. *
  335. * On each case statement we just transcode endianess of the different
  336. * fields. We declare a pointer to a RCI definition of an event, and
  337. * then to a UWB definition of the same event (which are the same,
  338. * remember). Event if we use different pointers
  339. */
  340. static
  341. void uwb_rc_notif(struct uwb_rc *rc, struct uwb_rceb *rceb, ssize_t size)
  342. {
  343. struct device *dev = &rc->uwb_dev.dev;
  344. struct uwb_event *uwb_evt;
  345. if (size == -ESHUTDOWN)
  346. return;
  347. if (size < 0) {
  348. dev_err(dev, "ignoring event with error code %zu\n",
  349. size);
  350. return;
  351. }
  352. uwb_evt = kzalloc(sizeof(*uwb_evt), GFP_ATOMIC);
  353. if (unlikely(uwb_evt == NULL)) {
  354. dev_err(dev, "no memory to queue event 0x%02x/%04x/%02x\n",
  355. rceb->bEventType, le16_to_cpu(rceb->wEvent),
  356. rceb->bEventContext);
  357. return;
  358. }
  359. uwb_evt->rc = __uwb_rc_get(rc); /* will be put by uwbd's uwbd_event_handle() */
  360. uwb_evt->ts_jiffies = jiffies;
  361. uwb_evt->type = UWB_EVT_TYPE_NOTIF;
  362. uwb_evt->notif.size = size;
  363. uwb_evt->notif.rceb = rceb;
  364. uwbd_event_queue(uwb_evt);
  365. }
  366. static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size_t size)
  367. {
  368. struct device *dev = &rc->uwb_dev.dev;
  369. struct uwb_rc_neh *neh;
  370. struct uwb_rceb *notif;
  371. unsigned long flags;
  372. if (rceb->bEventContext == 0) {
  373. notif = kmalloc(size, GFP_ATOMIC);
  374. if (notif) {
  375. memcpy(notif, rceb, size);
  376. uwb_rc_notif(rc, notif, size);
  377. } else
  378. dev_err(dev, "event 0x%02x/%04x/%02x (%zu bytes): no memory\n",
  379. rceb->bEventType, le16_to_cpu(rceb->wEvent),
  380. rceb->bEventContext, size);
  381. } else {
  382. neh = uwb_rc_neh_lookup(rc, rceb);
  383. if (neh) {
  384. spin_lock_irqsave(&rc->neh_lock, flags);
  385. /* to guard against a timeout */
  386. neh->completed = 1;
  387. del_timer(&neh->timer);
  388. spin_unlock_irqrestore(&rc->neh_lock, flags);
  389. uwb_rc_neh_cb(neh, rceb, size);
  390. } else
  391. dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n",
  392. rceb->bEventType, le16_to_cpu(rceb->wEvent),
  393. rceb->bEventContext, size);
  394. }
  395. }
  396. /**
  397. * Given a buffer with one or more UWB RC events/notifications, break
  398. * them up and dispatch them.
  399. *
  400. * @rc: UWB Radio Controller
  401. * @buf: Buffer with the stream of notifications/events
  402. * @buf_size: Amount of data in the buffer
  403. *
  404. * Note each notification/event starts always with a 'struct
  405. * uwb_rceb', so the minimum size if 4 bytes.
  406. *
  407. * The device may pass us events formatted differently than expected.
  408. * These are first filtered, potentially creating a new event in a new
  409. * memory location. If a new event is created by the filter it is also
  410. * freed here.
  411. *
  412. * For each notif/event, tries to guess the size looking at the EST
  413. * tables, then looks for a neh that is waiting for that event and if
  414. * found, copies the payload to the neh's buffer and calls it back. If
  415. * not, the data is ignored.
  416. *
  417. * Note that if we can't find a size description in the EST tables, we
  418. * still might find a size in the 'neh' handle in uwb_rc_neh_lookup().
  419. *
  420. * Assumptions:
  421. *
  422. * @rc->neh_lock is NOT taken
  423. *
  424. * We keep track of various sizes here:
  425. * size: contains the size of the buffer that is processed for the
  426. * incoming event. this buffer may contain events that are not
  427. * formatted as WHCI.
  428. * real_size: the actual space taken by this event in the buffer.
  429. * We need to keep track of the real size of an event to be able to
  430. * advance the buffer correctly.
  431. * event_size: the size of the event as expected by the core layer
  432. * [OR] the size of the event after filtering. if the filtering
  433. * created a new event in a new memory location then this is
  434. * effectively the size of a new event buffer
  435. */
  436. void uwb_rc_neh_grok(struct uwb_rc *rc, void *buf, size_t buf_size)
  437. {
  438. struct device *dev = &rc->uwb_dev.dev;
  439. void *itr;
  440. struct uwb_rceb *rceb;
  441. size_t size, real_size, event_size;
  442. int needtofree;
  443. itr = buf;
  444. size = buf_size;
  445. while (size > 0) {
  446. if (size < sizeof(*rceb)) {
  447. dev_err(dev, "not enough data in event buffer to "
  448. "process incoming events (%zu left, minimum is "
  449. "%zu)\n", size, sizeof(*rceb));
  450. break;
  451. }
  452. rceb = itr;
  453. if (rc->filter_event) {
  454. needtofree = rc->filter_event(rc, &rceb, size,
  455. &real_size, &event_size);
  456. if (needtofree < 0 && needtofree != -ENOANO) {
  457. dev_err(dev, "BUG: Unable to filter event "
  458. "(0x%02x/%04x/%02x) from "
  459. "device. \n", rceb->bEventType,
  460. le16_to_cpu(rceb->wEvent),
  461. rceb->bEventContext);
  462. break;
  463. }
  464. } else
  465. needtofree = -ENOANO;
  466. /* do real processing if there was no filtering or the
  467. * filtering didn't act */
  468. if (needtofree == -ENOANO) {
  469. ssize_t ret = uwb_est_find_size(rc, rceb, size);
  470. if (ret < 0)
  471. break;
  472. if (ret > size) {
  473. dev_err(dev, "BUG: hw sent incomplete event "
  474. "0x%02x/%04x/%02x (%zd bytes), only got "
  475. "%zu bytes. We don't handle that.\n",
  476. rceb->bEventType, le16_to_cpu(rceb->wEvent),
  477. rceb->bEventContext, ret, size);
  478. break;
  479. }
  480. real_size = event_size = ret;
  481. }
  482. uwb_rc_neh_grok_event(rc, rceb, event_size);
  483. if (needtofree == 1)
  484. kfree(rceb);
  485. itr += real_size;
  486. size -= real_size;
  487. }
  488. }
  489. EXPORT_SYMBOL_GPL(uwb_rc_neh_grok);
  490. /**
  491. * The entity that reads from the device notification/event channel has
  492. * detected an error.
  493. *
  494. * @rc: UWB Radio Controller
  495. * @error: Errno error code
  496. *
  497. */
  498. void uwb_rc_neh_error(struct uwb_rc *rc, int error)
  499. {
  500. struct uwb_rc_neh *neh;
  501. unsigned long flags;
  502. for (;;) {
  503. spin_lock_irqsave(&rc->neh_lock, flags);
  504. if (list_empty(&rc->neh_list)) {
  505. spin_unlock_irqrestore(&rc->neh_lock, flags);
  506. break;
  507. }
  508. neh = list_first_entry(&rc->neh_list, struct uwb_rc_neh, list_node);
  509. __uwb_rc_neh_rm(rc, neh);
  510. spin_unlock_irqrestore(&rc->neh_lock, flags);
  511. del_timer_sync(&neh->timer);
  512. uwb_rc_neh_cb(neh, NULL, error);
  513. }
  514. }
  515. EXPORT_SYMBOL_GPL(uwb_rc_neh_error);
  516. static void uwb_rc_neh_timer(unsigned long arg)
  517. {
  518. struct uwb_rc_neh *neh = (struct uwb_rc_neh *)arg;
  519. struct uwb_rc *rc = neh->rc;
  520. unsigned long flags;
  521. spin_lock_irqsave(&rc->neh_lock, flags);
  522. if (neh->completed) {
  523. spin_unlock_irqrestore(&rc->neh_lock, flags);
  524. return;
  525. }
  526. if (neh->context)
  527. __uwb_rc_neh_rm(rc, neh);
  528. else
  529. neh = NULL;
  530. spin_unlock_irqrestore(&rc->neh_lock, flags);
  531. if (neh)
  532. uwb_rc_neh_cb(neh, NULL, -ETIMEDOUT);
  533. }
  534. /** Initializes the @rc's neh subsystem
  535. */
  536. void uwb_rc_neh_create(struct uwb_rc *rc)
  537. {
  538. spin_lock_init(&rc->neh_lock);
  539. INIT_LIST_HEAD(&rc->neh_list);
  540. set_bit(0, rc->ctx_bm); /* 0 is reserved (see [WUSB] table 8-65) */
  541. set_bit(0xff, rc->ctx_bm); /* and 0xff is invalid */
  542. rc->ctx_roll = 1;
  543. }
  544. /** Release's the @rc's neh subsystem */
  545. void uwb_rc_neh_destroy(struct uwb_rc *rc)
  546. {
  547. unsigned long flags;
  548. struct uwb_rc_neh *neh;
  549. for (;;) {
  550. spin_lock_irqsave(&rc->neh_lock, flags);
  551. if (list_empty(&rc->neh_list)) {
  552. spin_unlock_irqrestore(&rc->neh_lock, flags);
  553. break;
  554. }
  555. neh = list_first_entry(&rc->neh_list, struct uwb_rc_neh, list_node);
  556. __uwb_rc_neh_rm(rc, neh);
  557. spin_unlock_irqrestore(&rc->neh_lock, flags);
  558. del_timer_sync(&neh->timer);
  559. uwb_rc_neh_put(neh);
  560. }
  561. }