2 * u_ether.c -- Ethernet-over-USB link layer utilities for Gadget stack
4 * Copyright (C) 2003-2005,2008 David Brownell
5 * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
6 * Copyright (C) 2008 Nokia Corporation
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23 /* #define VERBOSE_DEBUG */
25 #include <linux/kernel.h>
26 #include <linux/utsname.h>
27 #include <linux/device.h>
28 #include <linux/ctype.h>
29 #include <linux/etherdevice.h>
30 #include <linux/ethtool.h>
36 * This component encapsulates the Ethernet link glue needed to provide
37 * one (!) network link through the USB gadget stack, normally "usb0".
39 * The control and data models are handled by the function driver which
40 * connects to this code; such as CDC Ethernet, "CDC Subset", or RNDIS.
41 * That includes all descriptor and endpoint management.
43 * Link level addressing is handled by this component using module
44 * parameters; if no such parameters are provided, random link level
45 * addresses are used. Each end of the link uses one address. The
46 * host end address is exported in various ways, and is often recorded
47 * in configuration databases.
49 * The driver which assembles each configuration using such a link is
50 * responsible for ensuring that each configuration includes at most one
51 * instance of is network link. (The network layer provides ways for
52 * this single "physical" link to be used by multiple virtual links.)
55 #define UETH__VERSION "29-May-2008"
58 /* lock is held while accessing port_usb
59 * or updating its backlink port_usb->ioport
62 struct gether *port_usb;
64 struct net_device *net;
65 struct usb_gadget *gadget;
67 spinlock_t req_lock; /* guard {rx,tx}_reqs */
68 struct list_head tx_reqs, rx_reqs;
72 struct sk_buff *(*wrap)(struct sk_buff *skb);
73 int (*unwrap)(struct sk_buff *skb);
75 struct work_struct work;
78 #define WORK_RX_MEMORY 0
81 u8 host_mac[ETH_ALEN];
84 /*-------------------------------------------------------------------------*/
86 #define RX_EXTRA 20 /* bytes guarding against rx overflows */
88 #define DEFAULT_QLEN 2 /* double buffering by default */
91 #ifdef CONFIG_USB_GADGET_DUALSPEED
93 static unsigned qmult = 5;
94 module_param(qmult, uint, S_IRUGO|S_IWUSR);
95 MODULE_PARM_DESC(qmult, "queue length multiplier at high speed");
97 #else /* full speed (low speed doesn't do bulk) */
101 /* for dual-speed hardware, use deeper queues at highspeed */
102 static inline int qlen(struct usb_gadget *gadget)
104 if (gadget_is_dualspeed(gadget) && gadget->speed == USB_SPEED_HIGH)
105 return qmult * DEFAULT_QLEN;
110 /*-------------------------------------------------------------------------*/
112 /* REVISIT there must be a better way than having two sets
121 #define xprintk(d, level, fmt, args...) \
122 printk(level "%s: " fmt , (d)->net->name , ## args)
126 #define DBG(dev, fmt, args...) \
127 xprintk(dev , KERN_DEBUG , fmt , ## args)
129 #define DBG(dev, fmt, args...) \
136 #define VDBG(dev, fmt, args...) \
140 #define ERROR(dev, fmt, args...) \
141 xprintk(dev , KERN_ERR , fmt , ## args)
142 #define INFO(dev, fmt, args...) \
143 xprintk(dev , KERN_INFO , fmt , ## args)
145 /*-------------------------------------------------------------------------*/
147 /* NETWORK DRIVER HOOKUP (to the layer above this driver) */
149 static int eth_change_mtu(struct net_device *net, int new_mtu)
151 struct eth_dev *dev = netdev_priv(net);
155 /* don't change MTU on "live" link (peer won't know) */
156 spin_lock_irqsave(&dev->lock, flags);
159 else if (new_mtu <= ETH_HLEN || new_mtu > ETH_FRAME_LEN)
163 spin_unlock_irqrestore(&dev->lock, flags);
168 static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
170 struct eth_dev *dev = netdev_priv(net);
172 strlcpy(p->driver, "g_ether", sizeof p->driver);
173 strlcpy(p->version, UETH__VERSION, sizeof p->version);
174 strlcpy(p->fw_version, dev->gadget->name, sizeof p->fw_version);
175 strlcpy(p->bus_info, dev_name(&dev->gadget->dev), sizeof p->bus_info);
178 static u32 eth_get_link(struct net_device *net)
180 struct eth_dev *dev = netdev_priv(net);
181 return dev->gadget->speed != USB_SPEED_UNKNOWN;
184 /* REVISIT can also support:
185 * - WOL (by tracking suspends and issuing remote wakeup)
186 * - msglevel (implies updated messaging)
187 * - ... probably more ethtool ops
190 static struct ethtool_ops ops = {
191 .get_drvinfo = eth_get_drvinfo,
192 .get_link = eth_get_link
195 static void defer_kevent(struct eth_dev *dev, int flag)
197 if (test_and_set_bit(flag, &dev->todo))
199 if (!schedule_work(&dev->work))
200 ERROR(dev, "kevent %d may have been dropped\n", flag);
202 DBG(dev, "kevent %d scheduled\n", flag);
205 static void rx_complete(struct usb_ep *ep, struct usb_request *req);
208 rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
211 int retval = -ENOMEM;
216 spin_lock_irqsave(&dev->lock, flags);
218 out = dev->port_usb->out_ep;
221 spin_unlock_irqrestore(&dev->lock, flags);
227 /* Padding up to RX_EXTRA handles minor disagreements with host.
228 * Normally we use the USB "terminate on short read" convention;
229 * so allow up to (N*maxpacket), since that memory is normally
230 * already allocated. Some hardware doesn't deal well with short
231 * reads (e.g. DMA must be N*maxpacket), so for now don't trim a
232 * byte off the end (to force hardware errors on overflow).
234 * RNDIS uses internal framing, and explicitly allows senders to
235 * pad to end-of-packet. That's potentially nice for speed, but
236 * means receivers can't recover lost synch on their own (because
237 * new packets don't only start after a short RX).
239 size += sizeof(struct ethhdr) + dev->net->mtu + RX_EXTRA;
240 size += dev->port_usb->header_len;
241 size += out->maxpacket - 1;
242 size -= size % out->maxpacket;
244 skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
246 DBG(dev, "no rx skb\n");
250 /* Some platforms perform better when IP packets are aligned,
251 * but on at least one, checksumming fails otherwise. Note:
252 * RNDIS headers involve variable numbers of LE32 values.
254 skb_reserve(skb, NET_IP_ALIGN);
256 req->buf = skb->data;
258 req->complete = rx_complete;
261 retval = usb_ep_queue(out, req, gfp_flags);
262 if (retval == -ENOMEM)
264 defer_kevent(dev, WORK_RX_MEMORY);
266 DBG(dev, "rx submit --> %d\n", retval);
268 dev_kfree_skb_any(skb);
269 spin_lock_irqsave(&dev->req_lock, flags);
270 list_add(&req->list, &dev->rx_reqs);
271 spin_unlock_irqrestore(&dev->req_lock, flags);
276 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
278 struct sk_buff *skb = req->context;
279 struct eth_dev *dev = ep->driver_data;
280 int status = req->status;
284 /* normal completion */
286 skb_put(skb, req->actual);
288 status = dev->unwrap(skb);
290 || ETH_HLEN > skb->len
291 || skb->len > ETH_FRAME_LEN) {
292 dev->net->stats.rx_errors++;
293 dev->net->stats.rx_length_errors++;
294 DBG(dev, "rx length %d\n", skb->len);
298 skb->protocol = eth_type_trans(skb, dev->net);
299 dev->net->stats.rx_packets++;
300 dev->net->stats.rx_bytes += skb->len;
302 /* no buffer copies needed, unless hardware can't
305 status = netif_rx(skb);
309 /* software-driven interface shutdown */
310 case -ECONNRESET: /* unlink */
311 case -ESHUTDOWN: /* disconnect etc */
312 VDBG(dev, "rx shutdown, code %d\n", status);
315 /* for hardware automagic (such as pxa) */
316 case -ECONNABORTED: /* endpoint reset */
317 DBG(dev, "rx %s reset\n", ep->name);
318 defer_kevent(dev, WORK_RX_MEMORY);
320 dev_kfree_skb_any(skb);
325 dev->net->stats.rx_over_errors++;
329 dev->net->stats.rx_errors++;
330 DBG(dev, "rx status %d\n", status);
335 dev_kfree_skb_any(skb);
336 if (!netif_running(dev->net)) {
338 spin_lock(&dev->req_lock);
339 list_add(&req->list, &dev->rx_reqs);
340 spin_unlock(&dev->req_lock);
344 rx_submit(dev, req, GFP_ATOMIC);
347 static int prealloc(struct list_head *list, struct usb_ep *ep, unsigned n)
350 struct usb_request *req;
355 /* queue/recycle up to N requests */
357 list_for_each_entry(req, list, list) {
362 req = usb_ep_alloc_request(ep, GFP_ATOMIC);
364 return list_empty(list) ? -ENOMEM : 0;
365 list_add(&req->list, list);
372 struct list_head *next;
374 next = req->list.next;
375 list_del(&req->list);
376 usb_ep_free_request(ep, req);
381 req = container_of(next, struct usb_request, list);
386 static int alloc_requests(struct eth_dev *dev, struct gether *link, unsigned n)
390 spin_lock(&dev->req_lock);
391 status = prealloc(&dev->tx_reqs, link->in_ep, n);
394 status = prealloc(&dev->rx_reqs, link->out_ep, n);
399 DBG(dev, "can't alloc requests\n");
401 spin_unlock(&dev->req_lock);
405 static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
407 struct usb_request *req;
410 /* fill unused rxq slots with some skb */
411 spin_lock_irqsave(&dev->req_lock, flags);
412 while (!list_empty(&dev->rx_reqs)) {
413 req = container_of(dev->rx_reqs.next,
414 struct usb_request, list);
415 list_del_init(&req->list);
416 spin_unlock_irqrestore(&dev->req_lock, flags);
418 if (rx_submit(dev, req, gfp_flags) < 0) {
419 defer_kevent(dev, WORK_RX_MEMORY);
423 spin_lock_irqsave(&dev->req_lock, flags);
425 spin_unlock_irqrestore(&dev->req_lock, flags);
428 static void eth_work(struct work_struct *work)
430 struct eth_dev *dev = container_of(work, struct eth_dev, work);
432 if (test_and_clear_bit(WORK_RX_MEMORY, &dev->todo)) {
433 if (netif_running(dev->net))
434 rx_fill(dev, GFP_KERNEL);
438 DBG(dev, "work done, flags = 0x%lx\n", dev->todo);
441 static void tx_complete(struct usb_ep *ep, struct usb_request *req)
443 struct sk_buff *skb = req->context;
444 struct eth_dev *dev = ep->driver_data;
446 switch (req->status) {
448 dev->net->stats.tx_errors++;
449 VDBG(dev, "tx err %d\n", req->status);
451 case -ECONNRESET: /* unlink */
452 case -ESHUTDOWN: /* disconnect etc */
455 dev->net->stats.tx_bytes += skb->len;
457 dev->net->stats.tx_packets++;
459 spin_lock(&dev->req_lock);
460 list_add(&req->list, &dev->tx_reqs);
461 spin_unlock(&dev->req_lock);
462 dev_kfree_skb_any(skb);
464 atomic_dec(&dev->tx_qlen);
465 if (netif_carrier_ok(dev->net))
466 netif_wake_queue(dev->net);
469 static inline int is_promisc(u16 cdc_filter)
471 return cdc_filter & USB_CDC_PACKET_TYPE_PROMISCUOUS;
474 static int eth_start_xmit(struct sk_buff *skb, struct net_device *net)
476 struct eth_dev *dev = netdev_priv(net);
477 int length = skb->len;
479 struct usb_request *req = NULL;
484 spin_lock_irqsave(&dev->lock, flags);
486 in = dev->port_usb->in_ep;
487 cdc_filter = dev->port_usb->cdc_filter;
492 spin_unlock_irqrestore(&dev->lock, flags);
495 dev_kfree_skb_any(skb);
499 /* apply outgoing CDC or RNDIS filters */
500 if (!is_promisc(cdc_filter)) {
501 u8 *dest = skb->data;
503 if (is_multicast_ether_addr(dest)) {
506 /* ignores USB_CDC_PACKET_TYPE_MULTICAST and host
507 * SET_ETHERNET_MULTICAST_FILTERS requests
509 if (is_broadcast_ether_addr(dest))
510 type = USB_CDC_PACKET_TYPE_BROADCAST;
512 type = USB_CDC_PACKET_TYPE_ALL_MULTICAST;
513 if (!(cdc_filter & type)) {
514 dev_kfree_skb_any(skb);
518 /* ignores USB_CDC_PACKET_TYPE_DIRECTED */
521 spin_lock_irqsave(&dev->req_lock, flags);
523 * this freelist can be empty if an interrupt triggered disconnect()
524 * and reconfigured the gadget (shutting down this queue) after the
525 * network stack decided to xmit but before we got the spinlock.
527 if (list_empty(&dev->tx_reqs)) {
528 spin_unlock_irqrestore(&dev->req_lock, flags);
532 req = container_of(dev->tx_reqs.next, struct usb_request, list);
533 list_del(&req->list);
535 /* temporarily stop TX queue when the freelist empties */
536 if (list_empty(&dev->tx_reqs))
537 netif_stop_queue(net);
538 spin_unlock_irqrestore(&dev->req_lock, flags);
540 /* no buffer copies needed, unless the network stack did it
541 * or the hardware can't use skb buffers.
542 * or there's not enough space for extra headers we need
545 struct sk_buff *skb_new;
547 skb_new = dev->wrap(skb);
551 dev_kfree_skb_any(skb);
555 req->buf = skb->data;
557 req->complete = tx_complete;
559 /* use zlp framing on tx for strict CDC-Ether conformance,
560 * though any robust network rx path ignores extra padding.
561 * and some hardware doesn't like to write zlps.
564 if (!dev->zlp && (length % in->maxpacket) == 0)
567 req->length = length;
569 /* throttle highspeed IRQ rate back slightly */
570 if (gadget_is_dualspeed(dev->gadget))
571 req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH)
572 ? ((atomic_read(&dev->tx_qlen) % qmult) != 0)
575 retval = usb_ep_queue(in, req, GFP_ATOMIC);
578 DBG(dev, "tx queue err %d\n", retval);
581 net->trans_start = jiffies;
582 atomic_inc(&dev->tx_qlen);
587 dev->net->stats.tx_dropped++;
588 dev_kfree_skb_any(skb);
589 spin_lock_irqsave(&dev->req_lock, flags);
590 if (list_empty(&dev->tx_reqs))
591 netif_start_queue(net);
592 list_add(&req->list, &dev->tx_reqs);
593 spin_unlock_irqrestore(&dev->req_lock, flags);
598 /*-------------------------------------------------------------------------*/
600 static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
602 DBG(dev, "%s\n", __func__);
604 /* fill the rx queue */
605 rx_fill(dev, gfp_flags);
607 /* and open the tx floodgates */
608 atomic_set(&dev->tx_qlen, 0);
609 netif_wake_queue(dev->net);
612 static int eth_open(struct net_device *net)
614 struct eth_dev *dev = netdev_priv(net);
617 DBG(dev, "%s\n", __func__);
618 if (netif_carrier_ok(dev->net))
619 eth_start(dev, GFP_KERNEL);
621 spin_lock_irq(&dev->lock);
622 link = dev->port_usb;
623 if (link && link->open)
625 spin_unlock_irq(&dev->lock);
630 static int eth_stop(struct net_device *net)
632 struct eth_dev *dev = netdev_priv(net);
635 VDBG(dev, "%s\n", __func__);
636 netif_stop_queue(net);
638 DBG(dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
639 dev->net->stats.rx_packets, dev->net->stats.tx_packets,
640 dev->net->stats.rx_errors, dev->net->stats.tx_errors
643 /* ensure there are no more active requests */
644 spin_lock_irqsave(&dev->lock, flags);
646 struct gether *link = dev->port_usb;
651 /* NOTE: we have no abort-queue primitive we could use
652 * to cancel all pending I/O. Instead, we disable then
653 * reenable the endpoints ... this idiom may leave toggle
654 * wrong, but that's a self-correcting error.
656 * REVISIT: we *COULD* just let the transfers complete at
657 * their own pace; the network stack can handle old packets.
658 * For the moment we leave this here, since it works.
660 usb_ep_disable(link->in_ep);
661 usb_ep_disable(link->out_ep);
662 if (netif_carrier_ok(net)) {
663 DBG(dev, "host still using in/out endpoints\n");
664 usb_ep_enable(link->in_ep, link->in);
665 usb_ep_enable(link->out_ep, link->out);
668 spin_unlock_irqrestore(&dev->lock, flags);
673 /*-------------------------------------------------------------------------*/
675 /* initial value, changed by "ifconfig usb0 hw ether xx:xx:xx:xx:xx:xx" */
676 static char *dev_addr;
677 module_param(dev_addr, charp, S_IRUGO);
678 MODULE_PARM_DESC(dev_addr, "Device Ethernet Address");
680 /* this address is invisible to ifconfig */
681 static char *host_addr;
682 module_param(host_addr, charp, S_IRUGO);
683 MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
686 static u8 __init nibble(unsigned char c)
696 static int __init get_ether_addr(const char *str, u8 *dev_addr)
701 for (i = 0; i < 6; i++) {
704 if ((*str == '.') || (*str == ':'))
706 num = nibble(*str++) << 4;
707 num |= (nibble(*str++));
710 if (is_valid_ether_addr(dev_addr))
713 random_ether_addr(dev_addr);
717 static struct eth_dev *the_dev;
721 * gether_setup - initialize one ethernet-over-usb link
722 * @g: gadget to associated with these links
723 * @ethaddr: NULL, or a buffer in which the ethernet address of the
724 * host side of the link is recorded
727 * This sets up the single network link that may be exported by a
728 * gadget driver using this framework. The link layer addresses are
729 * set up using module parameters.
731 * Returns negative errno, or zero on success
733 int __init gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN])
736 struct net_device *net;
742 net = alloc_etherdev(sizeof *dev);
746 dev = netdev_priv(net);
747 spin_lock_init(&dev->lock);
748 spin_lock_init(&dev->req_lock);
749 INIT_WORK(&dev->work, eth_work);
750 INIT_LIST_HEAD(&dev->tx_reqs);
751 INIT_LIST_HEAD(&dev->rx_reqs);
753 /* network device setup */
755 strcpy(net->name, "usb%d");
757 if (get_ether_addr(dev_addr, net->dev_addr))
759 "using random %s ethernet address\n", "self");
760 if (get_ether_addr(host_addr, dev->host_mac))
762 "using random %s ethernet address\n", "host");
765 memcpy(ethaddr, dev->host_mac, ETH_ALEN);
767 net->change_mtu = eth_change_mtu;
768 net->hard_start_xmit = eth_start_xmit;
769 net->open = eth_open;
770 net->stop = eth_stop;
771 /* watchdog_timeo, tx_timeout ... */
772 /* set_multicast_list */
773 SET_ETHTOOL_OPS(net, &ops);
775 /* two kinds of host-initiated state changes:
776 * - iff DATA transfer is active, carrier is "on"
777 * - tx queueing enabled if open *and* carrier is "on"
779 netif_stop_queue(net);
780 netif_carrier_off(net);
783 SET_NETDEV_DEV(net, &g->dev);
785 status = register_netdev(net);
787 dev_dbg(&g->dev, "register_netdev failed, %d\n", status);
790 INFO(dev, "MAC %pM\n", net->dev_addr);
791 INFO(dev, "HOST MAC %pM\n", dev->host_mac);
800 * gether_cleanup - remove Ethernet-over-USB device
803 * This is called to free all resources allocated by @gether_setup().
805 void gether_cleanup(void)
810 unregister_netdev(the_dev->net);
811 free_netdev(the_dev->net);
813 /* assuming we used keventd, it must quiesce too */
814 flush_scheduled_work();
821 * gether_connect - notify network layer that USB link is active
822 * @link: the USB link, set up with endpoints, descriptors matching
823 * current device speed, and any framing wrapper(s) set up.
824 * Context: irqs blocked
826 * This is called to activate endpoints and let the network layer know
827 * the connection is active ("carrier detect"). It may cause the I/O
828 * queues to open and start letting network packets flow, but will in
829 * any case activate the endpoints so that they respond properly to the
832 * Verify net_device pointer returned using IS_ERR(). If it doesn't
833 * indicate some error code (negative errno), ep->driver_data values
834 * have been overwritten.
836 struct net_device *gether_connect(struct gether *link)
838 struct eth_dev *dev = the_dev;
842 return ERR_PTR(-EINVAL);
844 link->in_ep->driver_data = dev;
845 result = usb_ep_enable(link->in_ep, link->in);
847 DBG(dev, "enable %s --> %d\n",
848 link->in_ep->name, result);
852 link->out_ep->driver_data = dev;
853 result = usb_ep_enable(link->out_ep, link->out);
855 DBG(dev, "enable %s --> %d\n",
856 link->out_ep->name, result);
861 result = alloc_requests(dev, link, qlen(dev->gadget));
864 dev->zlp = link->is_zlp_ok;
865 DBG(dev, "qlen %d\n", qlen(dev->gadget));
867 dev->header_len = link->header_len;
868 dev->unwrap = link->unwrap;
869 dev->wrap = link->wrap;
871 spin_lock(&dev->lock);
872 dev->port_usb = link;
874 if (netif_running(dev->net)) {
881 spin_unlock(&dev->lock);
883 netif_carrier_on(dev->net);
884 if (netif_running(dev->net))
885 eth_start(dev, GFP_ATOMIC);
887 /* on error, disable any endpoints */
889 (void) usb_ep_disable(link->out_ep);
891 (void) usb_ep_disable(link->in_ep);
894 /* caller is responsible for cleanup on error */
896 return ERR_PTR(result);
901 * gether_disconnect - notify network layer that USB link is inactive
902 * @link: the USB link, on which gether_connect() was called
903 * Context: irqs blocked
905 * This is called to deactivate endpoints and let the network layer know
906 * the connection went inactive ("no carrier").
908 * On return, the state is as if gether_connect() had never been called.
909 * The endpoints are inactive, and accordingly without active USB I/O.
910 * Pointers to endpoint descriptors and endpoint private data are nulled.
912 void gether_disconnect(struct gether *link)
914 struct eth_dev *dev = link->ioport;
915 struct usb_request *req;
921 DBG(dev, "%s\n", __func__);
923 netif_stop_queue(dev->net);
924 netif_carrier_off(dev->net);
926 /* disable endpoints, forcing (synchronous) completion
927 * of all pending i/o. then free the request objects
928 * and forget about the endpoints.
930 usb_ep_disable(link->in_ep);
931 spin_lock(&dev->req_lock);
932 while (!list_empty(&dev->tx_reqs)) {
933 req = container_of(dev->tx_reqs.next,
934 struct usb_request, list);
935 list_del(&req->list);
937 spin_unlock(&dev->req_lock);
938 usb_ep_free_request(link->in_ep, req);
939 spin_lock(&dev->req_lock);
941 spin_unlock(&dev->req_lock);
942 link->in_ep->driver_data = NULL;
945 usb_ep_disable(link->out_ep);
946 spin_lock(&dev->req_lock);
947 while (!list_empty(&dev->rx_reqs)) {
948 req = container_of(dev->rx_reqs.next,
949 struct usb_request, list);
950 list_del(&req->list);
952 spin_unlock(&dev->req_lock);
953 usb_ep_free_request(link->out_ep, req);
954 spin_lock(&dev->req_lock);
956 spin_unlock(&dev->req_lock);
957 link->out_ep->driver_data = NULL;
960 /* finish forgetting about this USB link episode */
965 spin_lock(&dev->lock);
966 dev->port_usb = NULL;
968 spin_unlock(&dev->lock);