From: Stephen Warren <[email protected]>

ci_udc.c's usb_gadget_unregister_driver() doesn't call driver->unbind()
unlike other USB gadget drivers. Fix it to do this.

Without this, when ether.c's CDC Ethernet device is torn down,
eth_unbind() is never called, so dev->gadget is never set to NULL.
For some reason, usb_eth_halt() is called both at the end of the first
use of the Ethernet device, and prior to any subsequent use. Since
dev->gadget is never cleared, all calls to usb_eth_halt() attempt to
stop, disconnect, and clean up the device, resulting in double cleanup,
which hangs U-Boot on my Tegra device at least.

ci_udc allocates its own singleton EP0 request object, and cleans it up
during usb_gadget_unregister_driver(). This appears necessary when using
the USB gadget framework in U-Boot, since that does not allocate/free
the EP0 request. However, the CDC Ethernet driver *does* allocate and
free its own EP0 requests. Consequently, we must protect
ci_ep_free_request() against double-freeing the request.

Signed-off-by: Stephen Warren <[email protected]>
---
 drivers/usb/gadget/ci_udc.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/ci_udc.c b/drivers/usb/gadget/ci_udc.c
index b18bee43ad89..c3f6467b7db4 100644
--- a/drivers/usb/gadget/ci_udc.c
+++ b/drivers/usb/gadget/ci_udc.c
@@ -226,8 +226,11 @@ static void ci_ep_free_request(struct usb_ep *ep, struct 
usb_request *req)
        int num;
 
        num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
-       if (num == 0)
+       if (num == 0) {
+               if (!controller.ep0_req)
+                       return;
                controller.ep0_req = 0;
+       }
 
        if (ci_req->b_buf)
                free(ci_req->b_buf);
@@ -909,6 +912,9 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver 
*driver)
 {
        udc_disconnect();
 
+       driver->unbind(&controller.gadget);
+       controller.driver = NULL;
+
        ci_ep_free_request(&controller.ep[0].ep, &controller.ep0_req->req);
        free(controller.items_mem);
        free(controller.epts);
-- 
1.8.1.5

_______________________________________________
U-Boot mailing list
[email protected]
http://lists.denx.de/mailman/listinfo/u-boot

Reply via email to