From: Stephen Warren swarren@nvidia.com

ci_udc only allocates a single QTD structure per EP. All data needs to be extracted from the DTD prior to calling handle_ep_complete(), since that fills the QTD with next transaction's parameters. Fix handle_ep_complete() to extract the transaction (remaining) length before kicking off the next transaction.

In practice, this only causes writes to UMS devices to fail for me. I may have tested the final versions of my previous ci_udc patch only with reads. More recently, I had patches applied locally that allocated a QTD per USB request rather than per USB EP, although since that doesn't give any performance benefit, I'm dropping those.

Fixes: 2813006fecda ("usb: ci_udc: allow multiple buffer allocs per ep") Signed-off-by: Stephen Warren swarren@nvidia.com --- drivers/usb/gadget/ci_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/ci_udc.c b/drivers/usb/gadget/ci_udc.c index 290863d61fc9..9cd003636a44 100644 --- a/drivers/usb/gadget/ci_udc.c +++ b/drivers/usb/gadget/ci_udc.c @@ -424,6 +424,7 @@ static void handle_ep_complete(struct ci_ep *ep) item = ci_get_qtd(num, in); ci_invalidate_qtd(num);

+ len = (item->info >> 16) & 0x7fff; if (item->info & 0xff) printf("EP%d/%s FAIL info=%x pg0=%x\n", num, in ? "in" : "out", item->info, item->page0); @@ -435,7 +436,6 @@ static void handle_ep_complete(struct ci_ep *ep) if (!list_empty(&ep->queue)) ci_ep_submit_next_request(ep);

- len = (item->info >> 16) & 0x7fff; ci_req->req.actual = ci_req->req.length - len; ci_debounce(ci_req, in);