2 * u_ether.c -- Ethernet-over-USB link layer utilities for Gadget stack
4 * Copyright (C) 2003-2005,2008 David Brownell
5 * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
6 * Copyright (C) 2008 Nokia Corporation
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23 /* #define VERBOSE_DEBUG */
25 #include <linux/kernel.h>
26 #include <linux/utsname.h>
27 #include <linux/device.h>
28 #include <linux/ctype.h>
29 #include <linux/etherdevice.h>
30 #include <linux/ethtool.h>
36 * This component encapsulates the Ethernet link glue needed to provide
37 * one (!) network link through the USB gadget stack, normally "usb0".
39 * The control and data models are handled by the function driver which
40 * connects to this code; such as CDC Ethernet, "CDC Subset", or RNDIS.
41 * That includes all descriptor and endpoint management.
43 * Link level addressing is handled by this component using module
44 * parameters; if no such parameters are provided, random link level
45 * addresses are used. Each end of the link uses one address. The
46 * host end address is exported in various ways, and is often recorded
47 * in configuration databases.
49 * The driver which assembles each configuration using such a link is
50 * responsible for ensuring that each configuration includes at most one
51 * instance of is network link. (The network layer provides ways for
52 * this single "physical" link to be used by multiple virtual links.)
55 #define UETH__VERSION "29-May-2008"
58 /* lock is held while accessing port_usb
59 * or updating its backlink port_usb->ioport
62 struct gether *port_usb;
64 struct net_device *net;
65 struct usb_gadget *gadget;
67 spinlock_t req_lock; /* guard {rx,tx}_reqs */
68 struct list_head tx_reqs, rx_reqs;
72 struct sk_buff *(*wrap)(struct sk_buff *skb);
73 int (*unwrap)(struct sk_buff *skb);
75 struct work_struct work;
78 #define WORK_RX_MEMORY 0
81 u8 host_mac[ETH_ALEN];
84 /*-------------------------------------------------------------------------*/
86 #define RX_EXTRA 20 /* bytes guarding against rx overflows */
88 #define DEFAULT_QLEN 2 /* double buffering by default */
91 #ifdef CONFIG_USB_GADGET_DUALSPEED
93 static unsigned qmult = 5;
94 module_param(qmult, uint, S_IRUGO|S_IWUSR);
95 MODULE_PARM_DESC(qmult, "queue length multiplier at high speed");
97 #else /* full speed (low speed doesn't do bulk) */
101 /* for dual-speed hardware, use deeper queues at highspeed */
102 static inline int qlen(struct usb_gadget *gadget)
104 if (gadget_is_dualspeed(gadget) && gadget->speed == USB_SPEED_HIGH)
105 return qmult * DEFAULT_QLEN;
110 /*-------------------------------------------------------------------------*/
112 /* REVISIT there must be a better way than having two sets
121 #define xprintk(d, level, fmt, args...) \
122 printk(level "%s: " fmt , (d)->net->name , ## args)
126 #define DBG(dev, fmt, args...) \
127 xprintk(dev , KERN_DEBUG , fmt , ## args)
129 #define DBG(dev, fmt, args...) \
136 #define VDBG(dev, fmt, args...) \
140 #define ERROR(dev, fmt, args...) \
141 xprintk(dev , KERN_ERR , fmt , ## args)
142 #define INFO(dev, fmt, args...) \
143 xprintk(dev , KERN_INFO , fmt , ## args)
145 /*-------------------------------------------------------------------------*/
147 /* NETWORK DRIVER HOOKUP (to the layer above this driver) */
149 static int ueth_change_mtu(struct net_device *net, int new_mtu)
151 struct eth_dev *dev = netdev_priv(net);
155 /* don't change MTU on "live" link (peer won't know) */
156 spin_lock_irqsave(&dev->lock, flags);
159 else if (new_mtu <= ETH_HLEN || new_mtu > ETH_FRAME_LEN)
163 spin_unlock_irqrestore(&dev->lock, flags);
168 static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
170 struct eth_dev *dev = netdev_priv(net);
172 strlcpy(p->driver, "g_ether", sizeof p->driver);
173 strlcpy(p->version, UETH__VERSION, sizeof p->version);
174 strlcpy(p->fw_version, dev->gadget->name, sizeof p->fw_version);
175 strlcpy(p->bus_info, dev_name(&dev->gadget->dev), sizeof p->bus_info);
178 /* REVISIT can also support:
179 * - WOL (by tracking suspends and issuing remote wakeup)
180 * - msglevel (implies updated messaging)
181 * - ... probably more ethtool ops
184 static const struct ethtool_ops ops = {
185 .get_drvinfo = eth_get_drvinfo,
186 .get_link = ethtool_op_get_link,
189 static void defer_kevent(struct eth_dev *dev, int flag)
191 if (test_and_set_bit(flag, &dev->todo))
193 if (!schedule_work(&dev->work))
194 ERROR(dev, "kevent %d may have been dropped\n", flag);
196 DBG(dev, "kevent %d scheduled\n", flag);
199 static void rx_complete(struct usb_ep *ep, struct usb_request *req);
202 rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
205 int retval = -ENOMEM;
210 spin_lock_irqsave(&dev->lock, flags);
212 out = dev->port_usb->out_ep;
215 spin_unlock_irqrestore(&dev->lock, flags);
221 /* Padding up to RX_EXTRA handles minor disagreements with host.
222 * Normally we use the USB "terminate on short read" convention;
223 * so allow up to (N*maxpacket), since that memory is normally
224 * already allocated. Some hardware doesn't deal well with short
225 * reads (e.g. DMA must be N*maxpacket), so for now don't trim a
226 * byte off the end (to force hardware errors on overflow).
228 * RNDIS uses internal framing, and explicitly allows senders to
229 * pad to end-of-packet. That's potentially nice for speed, but
230 * means receivers can't recover lost synch on their own (because
231 * new packets don't only start after a short RX).
233 size += sizeof(struct ethhdr) + dev->net->mtu + RX_EXTRA;
234 size += dev->port_usb->header_len;
235 size += out->maxpacket - 1;
236 size -= size % out->maxpacket;
238 skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
240 DBG(dev, "no rx skb\n");
244 /* Some platforms perform better when IP packets are aligned,
245 * but on at least one, checksumming fails otherwise. Note:
246 * RNDIS headers involve variable numbers of LE32 values.
248 skb_reserve(skb, NET_IP_ALIGN);
250 req->buf = skb->data;
252 req->complete = rx_complete;
255 retval = usb_ep_queue(out, req, gfp_flags);
256 if (retval == -ENOMEM)
258 defer_kevent(dev, WORK_RX_MEMORY);
260 DBG(dev, "rx submit --> %d\n", retval);
262 dev_kfree_skb_any(skb);
263 spin_lock_irqsave(&dev->req_lock, flags);
264 list_add(&req->list, &dev->rx_reqs);
265 spin_unlock_irqrestore(&dev->req_lock, flags);
270 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
272 struct sk_buff *skb = req->context;
273 struct eth_dev *dev = ep->driver_data;
274 int status = req->status;
278 /* normal completion */
280 skb_put(skb, req->actual);
282 status = dev->unwrap(skb);
284 || ETH_HLEN > skb->len
285 || skb->len > ETH_FRAME_LEN) {
286 dev->net->stats.rx_errors++;
287 dev->net->stats.rx_length_errors++;
288 DBG(dev, "rx length %d\n", skb->len);
292 skb->protocol = eth_type_trans(skb, dev->net);
293 dev->net->stats.rx_packets++;
294 dev->net->stats.rx_bytes += skb->len;
296 /* no buffer copies needed, unless hardware can't
299 status = netif_rx(skb);
303 /* software-driven interface shutdown */
304 case -ECONNRESET: /* unlink */
305 case -ESHUTDOWN: /* disconnect etc */
306 VDBG(dev, "rx shutdown, code %d\n", status);
309 /* for hardware automagic (such as pxa) */
310 case -ECONNABORTED: /* endpoint reset */
311 DBG(dev, "rx %s reset\n", ep->name);
312 defer_kevent(dev, WORK_RX_MEMORY);
314 dev_kfree_skb_any(skb);
319 dev->net->stats.rx_over_errors++;
323 dev->net->stats.rx_errors++;
324 DBG(dev, "rx status %d\n", status);
329 dev_kfree_skb_any(skb);
330 if (!netif_running(dev->net)) {
332 spin_lock(&dev->req_lock);
333 list_add(&req->list, &dev->rx_reqs);
334 spin_unlock(&dev->req_lock);
338 rx_submit(dev, req, GFP_ATOMIC);
341 static int prealloc(struct list_head *list, struct usb_ep *ep, unsigned n)
344 struct usb_request *req;
349 /* queue/recycle up to N requests */
351 list_for_each_entry(req, list, list) {
356 req = usb_ep_alloc_request(ep, GFP_ATOMIC);
358 return list_empty(list) ? -ENOMEM : 0;
359 list_add(&req->list, list);
366 struct list_head *next;
368 next = req->list.next;
369 list_del(&req->list);
370 usb_ep_free_request(ep, req);
375 req = container_of(next, struct usb_request, list);
380 static int alloc_requests(struct eth_dev *dev, struct gether *link, unsigned n)
384 spin_lock(&dev->req_lock);
385 status = prealloc(&dev->tx_reqs, link->in_ep, n);
388 status = prealloc(&dev->rx_reqs, link->out_ep, n);
393 DBG(dev, "can't alloc requests\n");
395 spin_unlock(&dev->req_lock);
399 static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
401 struct usb_request *req;
404 /* fill unused rxq slots with some skb */
405 spin_lock_irqsave(&dev->req_lock, flags);
406 while (!list_empty(&dev->rx_reqs)) {
407 req = container_of(dev->rx_reqs.next,
408 struct usb_request, list);
409 list_del_init(&req->list);
410 spin_unlock_irqrestore(&dev->req_lock, flags);
412 if (rx_submit(dev, req, gfp_flags) < 0) {
413 defer_kevent(dev, WORK_RX_MEMORY);
417 spin_lock_irqsave(&dev->req_lock, flags);
419 spin_unlock_irqrestore(&dev->req_lock, flags);
422 static void eth_work(struct work_struct *work)
424 struct eth_dev *dev = container_of(work, struct eth_dev, work);
426 if (test_and_clear_bit(WORK_RX_MEMORY, &dev->todo)) {
427 if (netif_running(dev->net))
428 rx_fill(dev, GFP_KERNEL);
432 DBG(dev, "work done, flags = 0x%lx\n", dev->todo);
435 static void tx_complete(struct usb_ep *ep, struct usb_request *req)
437 struct sk_buff *skb = req->context;
438 struct eth_dev *dev = ep->driver_data;
440 switch (req->status) {
442 dev->net->stats.tx_errors++;
443 VDBG(dev, "tx err %d\n", req->status);
445 case -ECONNRESET: /* unlink */
446 case -ESHUTDOWN: /* disconnect etc */
449 dev->net->stats.tx_bytes += skb->len;
451 dev->net->stats.tx_packets++;
453 spin_lock(&dev->req_lock);
454 list_add(&req->list, &dev->tx_reqs);
455 spin_unlock(&dev->req_lock);
456 dev_kfree_skb_any(skb);
458 atomic_dec(&dev->tx_qlen);
459 if (netif_carrier_ok(dev->net))
460 netif_wake_queue(dev->net);
463 static inline int is_promisc(u16 cdc_filter)
465 return cdc_filter & USB_CDC_PACKET_TYPE_PROMISCUOUS;
468 static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
469 struct net_device *net)
471 struct eth_dev *dev = netdev_priv(net);
472 int length = skb->len;
474 struct usb_request *req = NULL;
479 spin_lock_irqsave(&dev->lock, flags);
481 in = dev->port_usb->in_ep;
482 cdc_filter = dev->port_usb->cdc_filter;
487 spin_unlock_irqrestore(&dev->lock, flags);
490 dev_kfree_skb_any(skb);
494 /* apply outgoing CDC or RNDIS filters */
495 if (!is_promisc(cdc_filter)) {
496 u8 *dest = skb->data;
498 if (is_multicast_ether_addr(dest)) {
501 /* ignores USB_CDC_PACKET_TYPE_MULTICAST and host
502 * SET_ETHERNET_MULTICAST_FILTERS requests
504 if (is_broadcast_ether_addr(dest))
505 type = USB_CDC_PACKET_TYPE_BROADCAST;
507 type = USB_CDC_PACKET_TYPE_ALL_MULTICAST;
508 if (!(cdc_filter & type)) {
509 dev_kfree_skb_any(skb);
513 /* ignores USB_CDC_PACKET_TYPE_DIRECTED */
516 spin_lock_irqsave(&dev->req_lock, flags);
518 * this freelist can be empty if an interrupt triggered disconnect()
519 * and reconfigured the gadget (shutting down this queue) after the
520 * network stack decided to xmit but before we got the spinlock.
522 if (list_empty(&dev->tx_reqs)) {
523 spin_unlock_irqrestore(&dev->req_lock, flags);
524 return NETDEV_TX_BUSY;
527 req = container_of(dev->tx_reqs.next, struct usb_request, list);
528 list_del(&req->list);
530 /* temporarily stop TX queue when the freelist empties */
531 if (list_empty(&dev->tx_reqs))
532 netif_stop_queue(net);
533 spin_unlock_irqrestore(&dev->req_lock, flags);
535 /* no buffer copies needed, unless the network stack did it
536 * or the hardware can't use skb buffers.
537 * or there's not enough space for extra headers we need
540 struct sk_buff *skb_new;
542 skb_new = dev->wrap(skb);
546 dev_kfree_skb_any(skb);
550 req->buf = skb->data;
552 req->complete = tx_complete;
554 /* use zlp framing on tx for strict CDC-Ether conformance,
555 * though any robust network rx path ignores extra padding.
556 * and some hardware doesn't like to write zlps.
559 if (!dev->zlp && (length % in->maxpacket) == 0)
562 req->length = length;
564 /* throttle highspeed IRQ rate back slightly */
565 if (gadget_is_dualspeed(dev->gadget))
566 req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH)
567 ? ((atomic_read(&dev->tx_qlen) % qmult) != 0)
570 retval = usb_ep_queue(in, req, GFP_ATOMIC);
573 DBG(dev, "tx queue err %d\n", retval);
576 net->trans_start = jiffies;
577 atomic_inc(&dev->tx_qlen);
582 dev->net->stats.tx_dropped++;
583 dev_kfree_skb_any(skb);
584 spin_lock_irqsave(&dev->req_lock, flags);
585 if (list_empty(&dev->tx_reqs))
586 netif_start_queue(net);
587 list_add(&req->list, &dev->tx_reqs);
588 spin_unlock_irqrestore(&dev->req_lock, flags);
593 /*-------------------------------------------------------------------------*/
595 static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
597 DBG(dev, "%s\n", __func__);
599 /* fill the rx queue */
600 rx_fill(dev, gfp_flags);
602 /* and open the tx floodgates */
603 atomic_set(&dev->tx_qlen, 0);
604 netif_wake_queue(dev->net);
607 static int eth_open(struct net_device *net)
609 struct eth_dev *dev = netdev_priv(net);
612 DBG(dev, "%s\n", __func__);
613 if (netif_carrier_ok(dev->net))
614 eth_start(dev, GFP_KERNEL);
616 spin_lock_irq(&dev->lock);
617 link = dev->port_usb;
618 if (link && link->open)
620 spin_unlock_irq(&dev->lock);
625 static int eth_stop(struct net_device *net)
627 struct eth_dev *dev = netdev_priv(net);
630 VDBG(dev, "%s\n", __func__);
631 netif_stop_queue(net);
633 DBG(dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
634 dev->net->stats.rx_packets, dev->net->stats.tx_packets,
635 dev->net->stats.rx_errors, dev->net->stats.tx_errors
638 /* ensure there are no more active requests */
639 spin_lock_irqsave(&dev->lock, flags);
641 struct gether *link = dev->port_usb;
646 /* NOTE: we have no abort-queue primitive we could use
647 * to cancel all pending I/O. Instead, we disable then
648 * reenable the endpoints ... this idiom may leave toggle
649 * wrong, but that's a self-correcting error.
651 * REVISIT: we *COULD* just let the transfers complete at
652 * their own pace; the network stack can handle old packets.
653 * For the moment we leave this here, since it works.
655 usb_ep_disable(link->in_ep);
656 usb_ep_disable(link->out_ep);
657 if (netif_carrier_ok(net)) {
658 DBG(dev, "host still using in/out endpoints\n");
659 usb_ep_enable(link->in_ep, link->in);
660 usb_ep_enable(link->out_ep, link->out);
663 spin_unlock_irqrestore(&dev->lock, flags);
668 /*-------------------------------------------------------------------------*/
670 /* initial value, changed by "ifconfig usb0 hw ether xx:xx:xx:xx:xx:xx" */
671 static char *dev_addr;
672 module_param(dev_addr, charp, S_IRUGO);
673 MODULE_PARM_DESC(dev_addr, "Device Ethernet Address");
675 /* this address is invisible to ifconfig */
676 static char *host_addr;
677 module_param(host_addr, charp, S_IRUGO);
678 MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
681 static u8 __init nibble(unsigned char c)
691 static int __init get_ether_addr(const char *str, u8 *dev_addr)
696 for (i = 0; i < 6; i++) {
699 if ((*str == '.') || (*str == ':'))
701 num = nibble(*str++) << 4;
702 num |= (nibble(*str++));
705 if (is_valid_ether_addr(dev_addr))
708 random_ether_addr(dev_addr);
712 static struct eth_dev *the_dev;
714 static const struct net_device_ops eth_netdev_ops = {
715 .ndo_open = eth_open,
716 .ndo_stop = eth_stop,
717 .ndo_start_xmit = eth_start_xmit,
718 .ndo_change_mtu = ueth_change_mtu,
719 .ndo_set_mac_address = eth_mac_addr,
720 .ndo_validate_addr = eth_validate_addr,
724 * gether_setup - initialize one ethernet-over-usb link
725 * @g: gadget to associated with these links
726 * @ethaddr: NULL, or a buffer in which the ethernet address of the
727 * host side of the link is recorded
730 * This sets up the single network link that may be exported by a
731 * gadget driver using this framework. The link layer addresses are
732 * set up using module parameters.
734 * Returns negative errno, or zero on success
736 int __init gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN])
739 struct net_device *net;
745 net = alloc_etherdev(sizeof *dev);
749 dev = netdev_priv(net);
750 spin_lock_init(&dev->lock);
751 spin_lock_init(&dev->req_lock);
752 INIT_WORK(&dev->work, eth_work);
753 INIT_LIST_HEAD(&dev->tx_reqs);
754 INIT_LIST_HEAD(&dev->rx_reqs);
756 /* network device setup */
758 strcpy(net->name, "usb%d");
760 if (get_ether_addr(dev_addr, net->dev_addr))
762 "using random %s ethernet address\n", "self");
763 if (get_ether_addr(host_addr, dev->host_mac))
765 "using random %s ethernet address\n", "host");
768 memcpy(ethaddr, dev->host_mac, ETH_ALEN);
770 net->netdev_ops = ð_netdev_ops;
772 SET_ETHTOOL_OPS(net, &ops);
774 /* two kinds of host-initiated state changes:
775 * - iff DATA transfer is active, carrier is "on"
776 * - tx queueing enabled if open *and* carrier is "on"
778 netif_stop_queue(net);
779 netif_carrier_off(net);
782 SET_NETDEV_DEV(net, &g->dev);
784 status = register_netdev(net);
786 dev_dbg(&g->dev, "register_netdev failed, %d\n", status);
789 INFO(dev, "MAC %pM\n", net->dev_addr);
790 INFO(dev, "HOST MAC %pM\n", dev->host_mac);
799 * gether_cleanup - remove Ethernet-over-USB device
802 * This is called to free all resources allocated by @gether_setup().
804 void gether_cleanup(void)
809 unregister_netdev(the_dev->net);
810 free_netdev(the_dev->net);
812 /* assuming we used keventd, it must quiesce too */
813 flush_scheduled_work();
820 * gether_connect - notify network layer that USB link is active
821 * @link: the USB link, set up with endpoints, descriptors matching
822 * current device speed, and any framing wrapper(s) set up.
823 * Context: irqs blocked
825 * This is called to activate endpoints and let the network layer know
826 * the connection is active ("carrier detect"). It may cause the I/O
827 * queues to open and start letting network packets flow, but will in
828 * any case activate the endpoints so that they respond properly to the
831 * Verify net_device pointer returned using IS_ERR(). If it doesn't
832 * indicate some error code (negative errno), ep->driver_data values
833 * have been overwritten.
835 struct net_device *gether_connect(struct gether *link)
837 struct eth_dev *dev = the_dev;
841 return ERR_PTR(-EINVAL);
843 link->in_ep->driver_data = dev;
844 result = usb_ep_enable(link->in_ep, link->in);
846 DBG(dev, "enable %s --> %d\n",
847 link->in_ep->name, result);
851 link->out_ep->driver_data = dev;
852 result = usb_ep_enable(link->out_ep, link->out);
854 DBG(dev, "enable %s --> %d\n",
855 link->out_ep->name, result);
860 result = alloc_requests(dev, link, qlen(dev->gadget));
863 dev->zlp = link->is_zlp_ok;
864 DBG(dev, "qlen %d\n", qlen(dev->gadget));
866 dev->header_len = link->header_len;
867 dev->unwrap = link->unwrap;
868 dev->wrap = link->wrap;
870 spin_lock(&dev->lock);
871 dev->port_usb = link;
873 if (netif_running(dev->net)) {
880 spin_unlock(&dev->lock);
882 netif_carrier_on(dev->net);
883 if (netif_running(dev->net))
884 eth_start(dev, GFP_ATOMIC);
886 /* on error, disable any endpoints */
888 (void) usb_ep_disable(link->out_ep);
890 (void) usb_ep_disable(link->in_ep);
893 /* caller is responsible for cleanup on error */
895 return ERR_PTR(result);
900 * gether_disconnect - notify network layer that USB link is inactive
901 * @link: the USB link, on which gether_connect() was called
902 * Context: irqs blocked
904 * This is called to deactivate endpoints and let the network layer know
905 * the connection went inactive ("no carrier").
907 * On return, the state is as if gether_connect() had never been called.
908 * The endpoints are inactive, and accordingly without active USB I/O.
909 * Pointers to endpoint descriptors and endpoint private data are nulled.
911 void gether_disconnect(struct gether *link)
913 struct eth_dev *dev = link->ioport;
914 struct usb_request *req;
920 DBG(dev, "%s\n", __func__);
922 netif_stop_queue(dev->net);
923 netif_carrier_off(dev->net);
925 /* disable endpoints, forcing (synchronous) completion
926 * of all pending i/o. then free the request objects
927 * and forget about the endpoints.
929 usb_ep_disable(link->in_ep);
930 spin_lock(&dev->req_lock);
931 while (!list_empty(&dev->tx_reqs)) {
932 req = container_of(dev->tx_reqs.next,
933 struct usb_request, list);
934 list_del(&req->list);
936 spin_unlock(&dev->req_lock);
937 usb_ep_free_request(link->in_ep, req);
938 spin_lock(&dev->req_lock);
940 spin_unlock(&dev->req_lock);
941 link->in_ep->driver_data = NULL;
944 usb_ep_disable(link->out_ep);
945 spin_lock(&dev->req_lock);
946 while (!list_empty(&dev->rx_reqs)) {
947 req = container_of(dev->rx_reqs.next,
948 struct usb_request, list);
949 list_del(&req->list);
951 spin_unlock(&dev->req_lock);
952 usb_ep_free_request(link->out_ep, req);
953 spin_lock(&dev->req_lock);
955 spin_unlock(&dev->req_lock);
956 link->out_ep->driver_data = NULL;
959 /* finish forgetting about this USB link episode */
964 spin_lock(&dev->lock);
965 dev->port_usb = NULL;
967 spin_unlock(&dev->lock);