2 * u_ether.c -- Ethernet-over-USB link layer utilities for Gadget stack
4 * Copyright (C) 2003-2005,2008 David Brownell
5 * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
6 * Copyright (C) 2008 Nokia Corporation
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23 /* #define VERBOSE_DEBUG */
25 #include <linux/kernel.h>
26 #include <linux/utsname.h>
27 #include <linux/device.h>
28 #include <linux/ctype.h>
29 #include <linux/etherdevice.h>
30 #include <linux/ethtool.h>
36 * This component encapsulates the Ethernet link glue needed to provide
37 * one (!) network link through the USB gadget stack, normally "usb0".
39 * The control and data models are handled by the function driver which
40 * connects to this code; such as CDC Ethernet, "CDC Subset", or RNDIS.
41 * That includes all descriptor and endpoint management.
43 * Link level addressing is handled by this component using module
44 * parameters; if no such parameters are provided, random link level
45 * addresses are used. Each end of the link uses one address. The
46 * host end address is exported in various ways, and is often recorded
47 * in configuration databases.
49 * The driver which assembles each configuration using such a link is
50 * responsible for ensuring that each configuration includes at most one
51 * instance of is network link. (The network layer provides ways for
52 * this single "physical" link to be used by multiple virtual links.)
55 #define UETH__VERSION "29-May-2008"
58 /* lock is held while accessing port_usb
59 * or updating its backlink port_usb->ioport
62 struct gether *port_usb;
64 struct net_device *net;
65 struct usb_gadget *gadget;
67 spinlock_t req_lock; /* guard {rx,tx}_reqs */
68 struct list_head tx_reqs, rx_reqs;
72 struct sk_buff *(*wrap)(struct sk_buff *skb);
73 int (*unwrap)(struct sk_buff *skb);
75 struct work_struct work;
78 #define WORK_RX_MEMORY 0
81 u8 host_mac[ETH_ALEN];
84 /*-------------------------------------------------------------------------*/
86 #define RX_EXTRA 20 /* bytes guarding against rx overflows */
88 #define DEFAULT_QLEN 2 /* double buffering by default */
91 #ifdef CONFIG_USB_GADGET_DUALSPEED
93 static unsigned qmult = 5;
94 module_param(qmult, uint, S_IRUGO|S_IWUSR);
95 MODULE_PARM_DESC(qmult, "queue length multiplier at high speed");
97 #else /* full speed (low speed doesn't do bulk) */
101 /* for dual-speed hardware, use deeper queues at highspeed */
102 static inline int qlen(struct usb_gadget *gadget)
104 if (gadget_is_dualspeed(gadget) && gadget->speed == USB_SPEED_HIGH)
105 return qmult * DEFAULT_QLEN;
110 /*-------------------------------------------------------------------------*/
112 /* REVISIT there must be a better way than having two sets
121 #define xprintk(d, level, fmt, args...) \
122 printk(level "%s: " fmt , (d)->net->name , ## args)
126 #define DBG(dev, fmt, args...) \
127 xprintk(dev , KERN_DEBUG , fmt , ## args)
129 #define DBG(dev, fmt, args...) \
136 #define VDBG(dev, fmt, args...) \
140 #define ERROR(dev, fmt, args...) \
141 xprintk(dev , KERN_ERR , fmt , ## args)
142 #define INFO(dev, fmt, args...) \
143 xprintk(dev , KERN_INFO , fmt , ## args)
145 /*-------------------------------------------------------------------------*/
147 /* NETWORK DRIVER HOOKUP (to the layer above this driver) */
149 static int ueth_change_mtu(struct net_device *net, int new_mtu)
151 struct eth_dev *dev = netdev_priv(net);
155 /* don't change MTU on "live" link (peer won't know) */
156 spin_lock_irqsave(&dev->lock, flags);
159 else if (new_mtu <= ETH_HLEN || new_mtu > ETH_FRAME_LEN)
163 spin_unlock_irqrestore(&dev->lock, flags);
168 static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
170 struct eth_dev *dev = netdev_priv(net);
172 strlcpy(p->driver, "g_ether", sizeof p->driver);
173 strlcpy(p->version, UETH__VERSION, sizeof p->version);
174 strlcpy(p->fw_version, dev->gadget->name, sizeof p->fw_version);
175 strlcpy(p->bus_info, dev_name(&dev->gadget->dev), sizeof p->bus_info);
178 /* REVISIT can also support:
179 * - WOL (by tracking suspends and issuing remote wakeup)
180 * - msglevel (implies updated messaging)
181 * - ... probably more ethtool ops
184 static struct ethtool_ops ops = {
185 .get_drvinfo = eth_get_drvinfo,
186 .get_link = ethtool_op_get_link,
189 static void defer_kevent(struct eth_dev *dev, int flag)
191 if (test_and_set_bit(flag, &dev->todo))
193 if (!schedule_work(&dev->work))
194 ERROR(dev, "kevent %d may have been dropped\n", flag);
196 DBG(dev, "kevent %d scheduled\n", flag);
199 static void rx_complete(struct usb_ep *ep, struct usb_request *req);
202 rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
205 int retval = -ENOMEM;
210 spin_lock_irqsave(&dev->lock, flags);
212 out = dev->port_usb->out_ep;
215 spin_unlock_irqrestore(&dev->lock, flags);
221 /* Padding up to RX_EXTRA handles minor disagreements with host.
222 * Normally we use the USB "terminate on short read" convention;
223 * so allow up to (N*maxpacket), since that memory is normally
224 * already allocated. Some hardware doesn't deal well with short
225 * reads (e.g. DMA must be N*maxpacket), so for now don't trim a
226 * byte off the end (to force hardware errors on overflow).
228 * RNDIS uses internal framing, and explicitly allows senders to
229 * pad to end-of-packet. That's potentially nice for speed, but
230 * means receivers can't recover lost synch on their own (because
231 * new packets don't only start after a short RX).
233 size += sizeof(struct ethhdr) + dev->net->mtu + RX_EXTRA;
234 size += dev->port_usb->header_len;
235 size += out->maxpacket - 1;
236 size -= size % out->maxpacket;
238 skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
240 DBG(dev, "no rx skb\n");
244 /* Some platforms perform better when IP packets are aligned,
245 * but on at least one, checksumming fails otherwise. Note:
246 * RNDIS headers involve variable numbers of LE32 values.
248 skb_reserve(skb, NET_IP_ALIGN);
250 req->buf = skb->data;
252 req->complete = rx_complete;
255 retval = usb_ep_queue(out, req, gfp_flags);
256 if (retval == -ENOMEM)
258 defer_kevent(dev, WORK_RX_MEMORY);
260 DBG(dev, "rx submit --> %d\n", retval);
262 dev_kfree_skb_any(skb);
263 spin_lock_irqsave(&dev->req_lock, flags);
264 list_add(&req->list, &dev->rx_reqs);
265 spin_unlock_irqrestore(&dev->req_lock, flags);
270 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
272 struct sk_buff *skb = req->context;
273 struct eth_dev *dev = ep->driver_data;
274 int status = req->status;
278 /* normal completion */
280 skb_put(skb, req->actual);
282 status = dev->unwrap(skb);
284 || ETH_HLEN > skb->len
285 || skb->len > ETH_FRAME_LEN) {
286 dev->net->stats.rx_errors++;
287 dev->net->stats.rx_length_errors++;
288 DBG(dev, "rx length %d\n", skb->len);
292 skb->protocol = eth_type_trans(skb, dev->net);
293 dev->net->stats.rx_packets++;
294 dev->net->stats.rx_bytes += skb->len;
296 /* no buffer copies needed, unless hardware can't
299 status = netif_rx(skb);
303 /* software-driven interface shutdown */
304 case -ECONNRESET: /* unlink */
305 case -ESHUTDOWN: /* disconnect etc */
306 VDBG(dev, "rx shutdown, code %d\n", status);
309 /* for hardware automagic (such as pxa) */
310 case -ECONNABORTED: /* endpoint reset */
311 DBG(dev, "rx %s reset\n", ep->name);
312 defer_kevent(dev, WORK_RX_MEMORY);
314 dev_kfree_skb_any(skb);
319 dev->net->stats.rx_over_errors++;
323 dev->net->stats.rx_errors++;
324 DBG(dev, "rx status %d\n", status);
329 dev_kfree_skb_any(skb);
330 if (!netif_running(dev->net)) {
332 spin_lock(&dev->req_lock);
333 list_add(&req->list, &dev->rx_reqs);
334 spin_unlock(&dev->req_lock);
338 rx_submit(dev, req, GFP_ATOMIC);
341 static int prealloc(struct list_head *list, struct usb_ep *ep, unsigned n)
344 struct usb_request *req;
349 /* queue/recycle up to N requests */
351 list_for_each_entry(req, list, list) {
356 req = usb_ep_alloc_request(ep, GFP_ATOMIC);
358 return list_empty(list) ? -ENOMEM : 0;
359 list_add(&req->list, list);
366 struct list_head *next;
368 next = req->list.next;
369 list_del(&req->list);
370 usb_ep_free_request(ep, req);
375 req = container_of(next, struct usb_request, list);
380 static int alloc_requests(struct eth_dev *dev, struct gether *link, unsigned n)
384 spin_lock(&dev->req_lock);
385 status = prealloc(&dev->tx_reqs, link->in_ep, n);
388 status = prealloc(&dev->rx_reqs, link->out_ep, n);
393 DBG(dev, "can't alloc requests\n");
395 spin_unlock(&dev->req_lock);
399 static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
401 struct usb_request *req;
404 /* fill unused rxq slots with some skb */
405 spin_lock_irqsave(&dev->req_lock, flags);
406 while (!list_empty(&dev->rx_reqs)) {
407 req = container_of(dev->rx_reqs.next,
408 struct usb_request, list);
409 list_del_init(&req->list);
410 spin_unlock_irqrestore(&dev->req_lock, flags);
412 if (rx_submit(dev, req, gfp_flags) < 0) {
413 defer_kevent(dev, WORK_RX_MEMORY);
417 spin_lock_irqsave(&dev->req_lock, flags);
419 spin_unlock_irqrestore(&dev->req_lock, flags);
422 static void eth_work(struct work_struct *work)
424 struct eth_dev *dev = container_of(work, struct eth_dev, work);
426 if (test_and_clear_bit(WORK_RX_MEMORY, &dev->todo)) {
427 if (netif_running(dev->net))
428 rx_fill(dev, GFP_KERNEL);
432 DBG(dev, "work done, flags = 0x%lx\n", dev->todo);
435 static void tx_complete(struct usb_ep *ep, struct usb_request *req)
437 struct sk_buff *skb = req->context;
438 struct eth_dev *dev = ep->driver_data;
440 switch (req->status) {
442 dev->net->stats.tx_errors++;
443 VDBG(dev, "tx err %d\n", req->status);
445 case -ECONNRESET: /* unlink */
446 case -ESHUTDOWN: /* disconnect etc */
449 dev->net->stats.tx_bytes += skb->len;
451 dev->net->stats.tx_packets++;
453 spin_lock(&dev->req_lock);
454 list_add(&req->list, &dev->tx_reqs);
455 spin_unlock(&dev->req_lock);
456 dev_kfree_skb_any(skb);
458 atomic_dec(&dev->tx_qlen);
459 if (netif_carrier_ok(dev->net))
460 netif_wake_queue(dev->net);
463 static inline int is_promisc(u16 cdc_filter)
465 return cdc_filter & USB_CDC_PACKET_TYPE_PROMISCUOUS;
468 static int eth_start_xmit(struct sk_buff *skb, struct net_device *net)
470 struct eth_dev *dev = netdev_priv(net);
471 int length = skb->len;
473 struct usb_request *req = NULL;
478 spin_lock_irqsave(&dev->lock, flags);
480 in = dev->port_usb->in_ep;
481 cdc_filter = dev->port_usb->cdc_filter;
486 spin_unlock_irqrestore(&dev->lock, flags);
489 dev_kfree_skb_any(skb);
493 /* apply outgoing CDC or RNDIS filters */
494 if (!is_promisc(cdc_filter)) {
495 u8 *dest = skb->data;
497 if (is_multicast_ether_addr(dest)) {
500 /* ignores USB_CDC_PACKET_TYPE_MULTICAST and host
501 * SET_ETHERNET_MULTICAST_FILTERS requests
503 if (is_broadcast_ether_addr(dest))
504 type = USB_CDC_PACKET_TYPE_BROADCAST;
506 type = USB_CDC_PACKET_TYPE_ALL_MULTICAST;
507 if (!(cdc_filter & type)) {
508 dev_kfree_skb_any(skb);
512 /* ignores USB_CDC_PACKET_TYPE_DIRECTED */
515 spin_lock_irqsave(&dev->req_lock, flags);
517 * this freelist can be empty if an interrupt triggered disconnect()
518 * and reconfigured the gadget (shutting down this queue) after the
519 * network stack decided to xmit but before we got the spinlock.
521 if (list_empty(&dev->tx_reqs)) {
522 spin_unlock_irqrestore(&dev->req_lock, flags);
526 req = container_of(dev->tx_reqs.next, struct usb_request, list);
527 list_del(&req->list);
529 /* temporarily stop TX queue when the freelist empties */
530 if (list_empty(&dev->tx_reqs))
531 netif_stop_queue(net);
532 spin_unlock_irqrestore(&dev->req_lock, flags);
534 /* no buffer copies needed, unless the network stack did it
535 * or the hardware can't use skb buffers.
536 * or there's not enough space for extra headers we need
539 struct sk_buff *skb_new;
541 skb_new = dev->wrap(skb);
545 dev_kfree_skb_any(skb);
549 req->buf = skb->data;
551 req->complete = tx_complete;
553 /* use zlp framing on tx for strict CDC-Ether conformance,
554 * though any robust network rx path ignores extra padding.
555 * and some hardware doesn't like to write zlps.
558 if (!dev->zlp && (length % in->maxpacket) == 0)
561 req->length = length;
563 /* throttle highspeed IRQ rate back slightly */
564 if (gadget_is_dualspeed(dev->gadget))
565 req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH)
566 ? ((atomic_read(&dev->tx_qlen) % qmult) != 0)
569 retval = usb_ep_queue(in, req, GFP_ATOMIC);
572 DBG(dev, "tx queue err %d\n", retval);
575 net->trans_start = jiffies;
576 atomic_inc(&dev->tx_qlen);
581 dev->net->stats.tx_dropped++;
582 dev_kfree_skb_any(skb);
583 spin_lock_irqsave(&dev->req_lock, flags);
584 if (list_empty(&dev->tx_reqs))
585 netif_start_queue(net);
586 list_add(&req->list, &dev->tx_reqs);
587 spin_unlock_irqrestore(&dev->req_lock, flags);
592 /*-------------------------------------------------------------------------*/
594 static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
596 DBG(dev, "%s\n", __func__);
598 /* fill the rx queue */
599 rx_fill(dev, gfp_flags);
601 /* and open the tx floodgates */
602 atomic_set(&dev->tx_qlen, 0);
603 netif_wake_queue(dev->net);
606 static int eth_open(struct net_device *net)
608 struct eth_dev *dev = netdev_priv(net);
611 DBG(dev, "%s\n", __func__);
612 if (netif_carrier_ok(dev->net))
613 eth_start(dev, GFP_KERNEL);
615 spin_lock_irq(&dev->lock);
616 link = dev->port_usb;
617 if (link && link->open)
619 spin_unlock_irq(&dev->lock);
624 static int eth_stop(struct net_device *net)
626 struct eth_dev *dev = netdev_priv(net);
629 VDBG(dev, "%s\n", __func__);
630 netif_stop_queue(net);
632 DBG(dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
633 dev->net->stats.rx_packets, dev->net->stats.tx_packets,
634 dev->net->stats.rx_errors, dev->net->stats.tx_errors
637 /* ensure there are no more active requests */
638 spin_lock_irqsave(&dev->lock, flags);
640 struct gether *link = dev->port_usb;
645 /* NOTE: we have no abort-queue primitive we could use
646 * to cancel all pending I/O. Instead, we disable then
647 * reenable the endpoints ... this idiom may leave toggle
648 * wrong, but that's a self-correcting error.
650 * REVISIT: we *COULD* just let the transfers complete at
651 * their own pace; the network stack can handle old packets.
652 * For the moment we leave this here, since it works.
654 usb_ep_disable(link->in_ep);
655 usb_ep_disable(link->out_ep);
656 if (netif_carrier_ok(net)) {
657 DBG(dev, "host still using in/out endpoints\n");
658 usb_ep_enable(link->in_ep, link->in);
659 usb_ep_enable(link->out_ep, link->out);
662 spin_unlock_irqrestore(&dev->lock, flags);
667 /*-------------------------------------------------------------------------*/
669 /* initial value, changed by "ifconfig usb0 hw ether xx:xx:xx:xx:xx:xx" */
670 static char *dev_addr;
671 module_param(dev_addr, charp, S_IRUGO);
672 MODULE_PARM_DESC(dev_addr, "Device Ethernet Address");
674 /* this address is invisible to ifconfig */
675 static char *host_addr;
676 module_param(host_addr, charp, S_IRUGO);
677 MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
680 static u8 __init nibble(unsigned char c)
690 static int __init get_ether_addr(const char *str, u8 *dev_addr)
695 for (i = 0; i < 6; i++) {
698 if ((*str == '.') || (*str == ':'))
700 num = nibble(*str++) << 4;
701 num |= (nibble(*str++));
704 if (is_valid_ether_addr(dev_addr))
707 random_ether_addr(dev_addr);
711 static struct eth_dev *the_dev;
713 static const struct net_device_ops eth_netdev_ops = {
714 .ndo_open = eth_open,
715 .ndo_stop = eth_stop,
716 .ndo_start_xmit = eth_start_xmit,
717 .ndo_change_mtu = ueth_change_mtu,
718 .ndo_set_mac_address = eth_mac_addr,
719 .ndo_validate_addr = eth_validate_addr,
723 * gether_setup - initialize one ethernet-over-usb link
724 * @g: gadget to associated with these links
725 * @ethaddr: NULL, or a buffer in which the ethernet address of the
726 * host side of the link is recorded
729 * This sets up the single network link that may be exported by a
730 * gadget driver using this framework. The link layer addresses are
731 * set up using module parameters.
733 * Returns negative errno, or zero on success
735 int __init gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN])
738 struct net_device *net;
744 net = alloc_etherdev(sizeof *dev);
748 dev = netdev_priv(net);
749 spin_lock_init(&dev->lock);
750 spin_lock_init(&dev->req_lock);
751 INIT_WORK(&dev->work, eth_work);
752 INIT_LIST_HEAD(&dev->tx_reqs);
753 INIT_LIST_HEAD(&dev->rx_reqs);
755 /* network device setup */
757 strcpy(net->name, "usb%d");
759 if (get_ether_addr(dev_addr, net->dev_addr))
761 "using random %s ethernet address\n", "self");
762 if (get_ether_addr(host_addr, dev->host_mac))
764 "using random %s ethernet address\n", "host");
767 memcpy(ethaddr, dev->host_mac, ETH_ALEN);
769 net->netdev_ops = ð_netdev_ops;
771 SET_ETHTOOL_OPS(net, &ops);
773 /* two kinds of host-initiated state changes:
774 * - iff DATA transfer is active, carrier is "on"
775 * - tx queueing enabled if open *and* carrier is "on"
777 netif_stop_queue(net);
778 netif_carrier_off(net);
781 SET_NETDEV_DEV(net, &g->dev);
783 status = register_netdev(net);
785 dev_dbg(&g->dev, "register_netdev failed, %d\n", status);
788 INFO(dev, "MAC %pM\n", net->dev_addr);
789 INFO(dev, "HOST MAC %pM\n", dev->host_mac);
798 * gether_cleanup - remove Ethernet-over-USB device
801 * This is called to free all resources allocated by @gether_setup().
803 void gether_cleanup(void)
808 unregister_netdev(the_dev->net);
809 free_netdev(the_dev->net);
811 /* assuming we used keventd, it must quiesce too */
812 flush_scheduled_work();
819 * gether_connect - notify network layer that USB link is active
820 * @link: the USB link, set up with endpoints, descriptors matching
821 * current device speed, and any framing wrapper(s) set up.
822 * Context: irqs blocked
824 * This is called to activate endpoints and let the network layer know
825 * the connection is active ("carrier detect"). It may cause the I/O
826 * queues to open and start letting network packets flow, but will in
827 * any case activate the endpoints so that they respond properly to the
830 * Verify net_device pointer returned using IS_ERR(). If it doesn't
831 * indicate some error code (negative errno), ep->driver_data values
832 * have been overwritten.
834 struct net_device *gether_connect(struct gether *link)
836 struct eth_dev *dev = the_dev;
840 return ERR_PTR(-EINVAL);
842 link->in_ep->driver_data = dev;
843 result = usb_ep_enable(link->in_ep, link->in);
845 DBG(dev, "enable %s --> %d\n",
846 link->in_ep->name, result);
850 link->out_ep->driver_data = dev;
851 result = usb_ep_enable(link->out_ep, link->out);
853 DBG(dev, "enable %s --> %d\n",
854 link->out_ep->name, result);
859 result = alloc_requests(dev, link, qlen(dev->gadget));
862 dev->zlp = link->is_zlp_ok;
863 DBG(dev, "qlen %d\n", qlen(dev->gadget));
865 dev->header_len = link->header_len;
866 dev->unwrap = link->unwrap;
867 dev->wrap = link->wrap;
869 spin_lock(&dev->lock);
870 dev->port_usb = link;
872 if (netif_running(dev->net)) {
879 spin_unlock(&dev->lock);
881 netif_carrier_on(dev->net);
882 if (netif_running(dev->net))
883 eth_start(dev, GFP_ATOMIC);
885 /* on error, disable any endpoints */
887 (void) usb_ep_disable(link->out_ep);
889 (void) usb_ep_disable(link->in_ep);
892 /* caller is responsible for cleanup on error */
894 return ERR_PTR(result);
899 * gether_disconnect - notify network layer that USB link is inactive
900 * @link: the USB link, on which gether_connect() was called
901 * Context: irqs blocked
903 * This is called to deactivate endpoints and let the network layer know
904 * the connection went inactive ("no carrier").
906 * On return, the state is as if gether_connect() had never been called.
907 * The endpoints are inactive, and accordingly without active USB I/O.
908 * Pointers to endpoint descriptors and endpoint private data are nulled.
910 void gether_disconnect(struct gether *link)
912 struct eth_dev *dev = link->ioport;
913 struct usb_request *req;
919 DBG(dev, "%s\n", __func__);
921 netif_stop_queue(dev->net);
922 netif_carrier_off(dev->net);
924 /* disable endpoints, forcing (synchronous) completion
925 * of all pending i/o. then free the request objects
926 * and forget about the endpoints.
928 usb_ep_disable(link->in_ep);
929 spin_lock(&dev->req_lock);
930 while (!list_empty(&dev->tx_reqs)) {
931 req = container_of(dev->tx_reqs.next,
932 struct usb_request, list);
933 list_del(&req->list);
935 spin_unlock(&dev->req_lock);
936 usb_ep_free_request(link->in_ep, req);
937 spin_lock(&dev->req_lock);
939 spin_unlock(&dev->req_lock);
940 link->in_ep->driver_data = NULL;
943 usb_ep_disable(link->out_ep);
944 spin_lock(&dev->req_lock);
945 while (!list_empty(&dev->rx_reqs)) {
946 req = container_of(dev->rx_reqs.next,
947 struct usb_request, list);
948 list_del(&req->list);
950 spin_unlock(&dev->req_lock);
951 usb_ep_free_request(link->out_ep, req);
952 spin_lock(&dev->req_lock);
954 spin_unlock(&dev->req_lock);
955 link->out_ep->driver_data = NULL;
958 /* finish forgetting about this USB link episode */
963 spin_lock(&dev->lock);
964 dev->port_usb = NULL;
966 spin_unlock(&dev->lock);