USB: net2280: don't send unwanted zero-length packets

The net2280 driver is too eager to send zero-length packets when
IN tokens are received on ep0.  No such packet should be sent (the
driver should NAK) before the gadget driver has queued the proper
response.  Otherwise deferred responses are impossible.

This patch (as823) makes net2280 avoid sending ZLPs for IN transfers
on ep0 until a response has been submitted, and avoids stalling when an
OUT packet is received before a request has been submitted for an OUT
transfer on ep0.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2 files changed, 8 insertions, 3 deletions

diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index 3acc896a5d4c..0b590831582c 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -1040,6 +1040,7 @@ net2280_queue (struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
 
         } /* else the irq handler advances the queue. */
 
+        ep->responded = 1;
         if (req)
                 list_add_tail (&req->queue, &ep->queue);
 done:
@@ -2188,7 +2189,8 @@ static void handle_ep_small (struct net2280_ep *ep)
                                         ep->stopped = 1;
                                         set_halt (ep);
                                         mode = 2;
-                                } else if (!req && !ep->stopped)
+                                } else if (ep->responded &&
+                                                !req && !ep->stopped)
                                         write_fifo (ep, NULL);
                         }
                 } else {
@@ -2203,7 +2205,7 @@ static void handle_ep_small (struct net2280_ep *ep)
                         } else if (((t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT))
                                         && req
                                         && req->req.actual == req->req.length)
-                                        || !req) {
+                                        || (ep->responded && !req)) {
                                 ep->dev->protocol_stall = 1;
                                 set_halt (ep);
                                 ep->stopped = 1;
@@ -2469,6 +2471,7 @@ static void handle_stat0_irqs (struct net2280 *dev, u32 stat)
                 /* we made the hardware handle most lowlevel requests;
                  * everything else goes uplevel to the gadget code.
                  */
+                ep->responded = 1;
                 switch (u.r.bRequest) {
                 case USB_REQ_GET_STATUS: {
                         struct net2280_ep       *e;
@@ -2537,6 +2540,7 @@ delegate:
                                 u.r.bRequestType, u.r.bRequest,
                                 w_value, w_index, w_length,
                                 readl (&ep->regs->ep_cfg));
+                        ep->responded = 0;
                         spin_unlock (&dev->lock);
                         tmp = dev->driver->setup (&dev->gadget, &u.r);
                         spin_lock (&dev->lock);
diff --git a/drivers/usb/gadget/net2280.h b/drivers/usb/gadget/net2280.h
index 957d6df34015..44ca139983d8 100644
--- a/drivers/usb/gadget/net2280.h
+++ b/drivers/usb/gadget/net2280.h
@@ -110,7 +110,8 @@ struct net2280_ep {
                                                 out_overflow : 1,
                                                 stopped : 1,
                                                 is_in : 1,
-                                                is_iso : 1;
+                                                is_iso : 1,
+                                                responded : 1;
 };
 
 static inline void allow_status (struct net2280_ep *ep)