[RFC PATCH v2 11/11] rust: usb: let drivers choose the transfer allocation flags

[Mike Lothian <mike@fireburn.co.uk>]

Oliver Neukum review of the synchronous transfer bindings: a USB driver must be able to
specify GFP_KERNEL vs GFP_NOIO/GFP_NOFS (USB shares error handling and power management
across a device's interfaces, so allocations on reset/resume/error paths must not recurse
into I/O). Thread a `gfp: Flags` parameter through bulk_send/bulk_recv/interrupt_recv/
control_send/control_recv (both the Interface wrappers and the Device impls) instead of
hardcoding GFP_KERNEL.

Signed-off-by: Mike Lothian <mike@fireburn.co.uk>
Assisted-by: Claude:claude-opus-4-8 [Claude-Code]
---
 rust/kernel/usb.rs | 59 +++++++++++++++++++++++++++++++++-------------
 1 file changed, 42 insertions(+), 17 deletions(-)

diff --git a/rust/kernel/usb.rs b/rust/kernel/usb.rs
index 1fcaf34433cc..d39ba6246090 100644
--- a/rust/kernel/usb.rs
+++ b/rust/kernel/usb.rs
@@ -17,6 +17,7 @@
         from_result,
         to_result, //
     },
+    alloc::Flags,
     prelude::*,
     sync::aref::AlwaysRefCounted,
     time::Delta,
@@ -418,24 +419,40 @@ pub fn clear_halt(&self, endpoint: u8) -> Result {
 
     /// Issues a synchronous bulk OUT transfer of `data` to `endpoint`, returning
     /// the number of bytes transferred. `data` must be DMA-capable. Sleeps.
-    pub fn bulk_send(&self, endpoint: u8, data: &[u8], timeout: Delta) -> Result<usize> {
-        self.device().bulk_send(endpoint, data, timeout)
+    ///
+    /// `gfp` selects the allocation flags for this transfer's buffers: pass `GFP_KERNEL`
+    /// normally, or `GFP_NOIO`/`GFP_NOFS` when called from a reset/resume or error-handling
+    /// path (USB shares error handling and PM across a device's interfaces).
+    pub fn bulk_send(&self, endpoint: u8, data: &[u8], timeout: Delta, gfp: Flags) -> Result<usize> {
+        self.device().bulk_send(endpoint, data, timeout, gfp)
     }
 
     /// Issues a synchronous bulk IN transfer into `data`, returning the number of
     /// bytes received. `data` must be DMA-capable. Sleeps.
-    pub fn bulk_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta) -> Result<usize> {
-        self.device().bulk_recv(endpoint, data, timeout)
+    ///
+    /// `gfp` selects the allocation flags for this transfer's buffers: pass `GFP_KERNEL`
+    /// normally, or `GFP_NOIO`/`GFP_NOFS` when called from a reset/resume or error-handling
+    /// path (USB shares error handling and PM across a device's interfaces).
+    pub fn bulk_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta, gfp: Flags) -> Result<usize> {
+        self.device().bulk_recv(endpoint, data, timeout, gfp)
     }
 
     /// Issues a synchronous interrupt IN transfer into `data`, returning the number
     /// of bytes received. `data` must be DMA-capable. Sleeps.
-    pub fn interrupt_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta) -> Result<usize> {
-        self.device().interrupt_recv(endpoint, data, timeout)
+    ///
+    /// `gfp` selects the allocation flags for this transfer's buffers: pass `GFP_KERNEL`
+    /// normally, or `GFP_NOIO`/`GFP_NOFS` when called from a reset/resume or error-handling
+    /// path (USB shares error handling and PM across a device's interfaces).
+    pub fn interrupt_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta, gfp: Flags) -> Result<usize> {
+        self.device().interrupt_recv(endpoint, data, timeout, gfp)
     }
 
     /// Issues a synchronous control OUT transfer on the default control endpoint.
     /// The buffer is copied internally, so `data` need not be DMA-capable. Sleeps.
+    ///
+    /// `gfp` selects the allocation flags for this transfer's buffers: pass `GFP_KERNEL`
+    /// normally, or `GFP_NOIO`/`GFP_NOFS` when called from a reset/resume or error-handling
+    /// path (USB shares error handling and PM across a device's interfaces).
     pub fn control_send(
         &self,
         request: u8,
@@ -444,13 +461,18 @@ pub fn control_send(
         index: u16,
         data: &[u8],
         timeout: Delta,
+        gfp: Flags,
     ) -> Result {
         self.device()
-            .control_send(request, request_type, value, index, data, timeout)
+            .control_send(request, request_type, value, index, data, timeout, gfp)
     }
 
     /// Issues a synchronous control IN transfer on the default control endpoint,
     /// filling `data` with exactly `data.len()` bytes. Sleeps.
+    ///
+    /// `gfp` selects the allocation flags for this transfer's buffers: pass `GFP_KERNEL`
+    /// normally, or `GFP_NOIO`/`GFP_NOFS` when called from a reset/resume or error-handling
+    /// path (USB shares error handling and PM across a device's interfaces).
     pub fn control_recv(
         &self,
         request: u8,
@@ -459,9 +481,10 @@ pub fn control_recv(
         index: u16,
         data: &mut [u8],
         timeout: Delta,
+        gfp: Flags,
     ) -> Result {
         self.device()
-            .control_recv(request, request_type, value, index, data, timeout)
+            .control_recv(request, request_type, value, index, data, timeout, gfp)
     }
 
     /// Selects alternate setting `alternate` of interface `interface`
@@ -609,13 +632,13 @@ pub(crate) fn clear_halt(&self, endpoint: u8) -> Result {
     /// not arrange DMA-capable storage themselves.
     ///
     /// [`usb_bulk_msg()`]: https://docs.kernel.org/driver-api/usb/usb.html#c.usb_bulk_msg
-    pub(crate) fn bulk_send(&self, endpoint: u8, data: &[u8], timeout: Delta) -> Result<usize> {
+    pub(crate) fn bulk_send(&self, endpoint: u8, data: &[u8], timeout: Delta, gfp: Flags) -> Result<usize> {
         let mut actual: kernel::ffi::c_int = 0;
 
         // `usb_bulk_msg()` requires a DMA-capable buffer; `data` may live on the
         // stack or in `.rodata`, so copy it into a kmalloc'd bounce buffer.
-        let mut buf = KVec::with_capacity(data.len(), GFP_KERNEL)?;
-        buf.extend_from_slice(data, GFP_KERNEL)?;
+        let mut buf = KVec::with_capacity(data.len(), gfp)?;
+        buf.extend_from_slice(data, gfp)?;
 
         // SAFETY: `self.as_raw()` is a valid `struct usb_device` by the type invariant.
         let pipe = unsafe { bindings::usb_sndbulkpipe(self.as_raw(), endpoint.into()) };
@@ -655,12 +678,12 @@ pub(crate) fn bulk_send(&self, endpoint: u8, data: &[u8], timeout: Delta) -> Res
     /// `data` may be any slice.
     ///
     /// [`usb_bulk_msg()`]: https://docs.kernel.org/driver-api/usb/usb.html#c.usb_bulk_msg
-    pub(crate) fn bulk_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta) -> Result<usize> {
+    pub(crate) fn bulk_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta, gfp: Flags) -> Result<usize> {
         let mut actual: kernel::ffi::c_int = 0;
 
         // `usb_bulk_msg()` requires a DMA-capable buffer; receive into a kmalloc'd
         // bounce buffer and copy out, so `data` need not be DMA-capable itself.
-        let mut buf = KVec::from_elem(0u8, data.len(), GFP_KERNEL)?;
+        let mut buf = KVec::from_elem(0u8, data.len(), gfp)?;
 
         // SAFETY: `self.as_raw()` is a valid `struct usb_device` by the type invariant.
         let pipe = unsafe { bindings::usb_rcvbulkpipe(self.as_raw(), endpoint.into()) };
@@ -697,12 +720,12 @@ pub(crate) fn bulk_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta) ->
     /// milliseconds; a [`Delta`] of zero, or any non-zero value below 1 ms, waits indefinitely.
     ///
     /// [`bulk_recv`]: Self::bulk_recv
-    pub(crate) fn interrupt_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta) -> Result<usize> {
+    pub(crate) fn interrupt_recv(&self, endpoint: u8, data: &mut [u8], timeout: Delta, gfp: Flags) -> Result<usize> {
         let mut actual: kernel::ffi::c_int = 0;
 
         // `usb_interrupt_msg()` requires a DMA-capable buffer; receive into a kmalloc'd
         // bounce buffer and copy out, so `data` need not be DMA-capable itself.
-        let mut buf = KVec::from_elem(0u8, data.len(), GFP_KERNEL)?;
+        let mut buf = KVec::from_elem(0u8, data.len(), gfp)?;
 
         // SAFETY: `self.as_raw()` is a valid `struct usb_device` by the type invariant.
         let pipe = unsafe { bindings::usb_rcvintpipe(self.as_raw(), endpoint.into()) };
@@ -749,6 +772,7 @@ pub(crate) fn control_send(
         index: u16,
         data: &[u8],
         timeout: Delta,
+        gfp: Flags,
     ) -> Result {
         // SAFETY: `self.as_raw()` is valid by the type invariant; `data` is valid for
         // reads of `data.len()` bytes; `usb_control_msg_send()` copies the buffer.
@@ -763,7 +787,7 @@ pub(crate) fn control_send(
                 data.as_ptr().cast::<kernel::ffi::c_void>(),
                 data.len().try_into()?,
                 timeout.as_millis().try_into()?,
-                bindings::GFP_KERNEL,
+                gfp.as_raw(),
             )
         })
     }
@@ -784,6 +808,7 @@ pub(crate) fn control_recv(
         index: u16,
         data: &mut [u8],
         timeout: Delta,
+        gfp: Flags,
     ) -> Result {
         // SAFETY: `self.as_raw()` is valid by the type invariant; `data` is valid for
         // writes of `data.len()` bytes; `usb_control_msg_recv()` copies into the buffer.
@@ -798,7 +823,7 @@ pub(crate) fn control_recv(
                 data.as_mut_ptr().cast::<kernel::ffi::c_void>(),
                 data.len().try_into()?,
                 timeout.as_millis().try_into()?,
-                bindings::GFP_KERNEL,
+                gfp.as_raw(),
             )
         })
     }
-- 
2.55.0