cb_getvar tries to prevent overflowing the response buffer
by using strncat. But strncat takes the number of data bytes
copied as a limit not the total buffer length so it can still
overflow. Pass the correct value instead.
cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
cc: Rob Herring <robh@kernel.org>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
Because of the brackets the & and && is evaluated before
the comparison. This is likely not the intention. Change
it to test the first and second condition to both be true.
cc: Marek Vasut <marex@denx.de>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
since ALLOC_CACHE_ALIGN_BUFFER defines a pointer and not a
buffer, the memset with sizeof(rqt) likely does something else
then intended. Since there is a memcpy directly after it with
the full size, drop the memset completely.
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Since the struct fsg_common is calloced, reset it completely
with zero's when reused. While at it, make checkpatch happy.
cc: Lukasz Majewski <l.majewski@samsung.com>
cc: Piotr Wilczek <p.wilczek@samsung.com>
cc: Kyungmin Park <kyungmin.park@samsung.com>
cc: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
Acked-by: Marek Vasut <marex@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Initialization of r8a66597 info structure is not enough.
Because initilization was used size of pointer.
This fixes that use size of r8a6659 info structure.
Signed-off-by: Yasuhisa Umano <yasuhisa.umano.zc@renesas.com>
This driver is processed as two USB hub despite one.
The number of root hub is defined in R8A66597_MAX_ROOT_HUB.
This fixes that register is accessed by using the definition
of R8A66597_MAX_ROOT_HUB.
Signed-off-by: Yasuhisa Umano <yasuhisa.umano.zc@renesas.com>
For plain array const can be either before or after
the type definition. Adding both is simply redundand.
Remove the later one.
cc: marex@denx.de
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
ci_udc.c's usb_gadget_unregister_driver() doesn't call driver->unbind()
unlike other USB gadget drivers. Fix it to do this.
Without this, when ether.c's CDC Ethernet device is torn down,
eth_unbind() is never called, so dev->gadget is never set to NULL.
For some reason, usb_eth_halt() is called both at the end of the first
use of the Ethernet device, and prior to any subsequent use. Since
dev->gadget is never cleared, all calls to usb_eth_halt() attempt to
stop, disconnect, and clean up the device, resulting in double cleanup,
which hangs U-Boot on my Tegra device at least.
ci_udc allocates its own singleton EP0 request object, and cleans it up
during usb_gadget_unregister_driver(). This appears necessary when using
the USB gadget framework in U-Boot, since that does not allocate/free
the EP0 request. However, the CDC Ethernet driver *does* allocate and
free its own EP0 requests. Consequently, we must protect
ci_ep_free_request() against double-freeing the request.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Sometimes, a zero-length packet is required at the end of an IN
transaction so that the host knows the device is done sending data.
Enhance ci_udc to send a zlp when necessary. See the comments for
more details.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
usb_gadget_unregister_driver() is called to tear down the USB device mode
stack. Fix the driver to stop the USB HW (which causes any attached host
to notice the disappearance of the device), and free all allocations
(which obviously prevents memory leaks).
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_ep_alloc_request() avoids allocating multiple request objects for ep0
by keeping a record of the first req allocated for ep0, and always
returning that instead of allocating a new req. However, if this req is
ever freed, the record of the previous allocation is not cleared, so
ci_ep_alloc_request() will keep returning this stale pointer. Fix
ci_ep_free_request() to clear the record of the previous allocation.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_pullup()'s !is_on path contains a cut/paste copy of udc_disconnect().
Remove the duplication by simply calling udc_disconnect() instead.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
handle_setup() currently assumes that the response to a Setup transaction
will be an OUT transaction, and any subsequent packet (if any) will be an
IN transaction. This appears to be valid in many cases; both USB
enumeration and Mass Storage work OK with this restriction. However, DFU
uses ep0 to transfer data in both directions. This renders the assumption
invalid; when sending data from device to host, the Data Stage is an IN
transaction, and the Status Stage is an OUT transaction. Enhance
handle_setup() to deduce the correct direction for the USB transactions
based on Setup transaction data.
ep0's request object only needs to be automatically re-queued when the
Data Stage completes, in order to implement the Status Stage. Once the
Status Stage transaction is complete, there is no need to re-queue the
USB request, so don't do that.
Don't sent USB request completion callbacks for Status Stage transactions.
These were queued by ci_udc itself, and only serve to confuse the USB
function code. For example, f_dfu attempts to interpret the 0-length data
buffers for Status Stage transactions as DFU packets. These buffers
contain stale data from the previous transaction. This causes f_dfu to
complain about a sequence number mismatch.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Allocate ep0's USB request object when the UDC driver is probed. This
solves a couple of issues in the current code:
a) A request object always exists for ep0. Prior to this patch, if setup
transactions arrived in an unexpected order, handle_setup() would need
to reply to a setup transaction before any ep0 usb_req was created.
This issue was introduced in commit 2813006fec "usb: ci_udc: allow
multiple buffer allocs per ep."
b) handle_ep_complete no longer /has/ to queue the ep0 request again
after every single request completion. This is currently required, since
handle_setup() assumes it can find some request object in ep0's request
queue. This patch doesn't actually stop handle_ep_complete() from always
requeueing the request, but the next patch will.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_udc currently points ep->desc at separate descriptors for IN and OUT.
These descriptors only differ in the ep address IN/OUT field. Modify the
code to use a single descriptor, and change that descriptor's ep address
to indicate IN/OUT as required. This removes some data duplication.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
The flipping of ep0 between IN and OUT relies on ci_ep_queue() consuming
the current IN/OUT setting immediately. If this is deferred to a later
point when the req is pulled out of ci_req->queue, then the IN/OUT
setting may have been changed since the req was queued, and state will
get out of sync. This condition doesn't occur today, but could if bugs
were introduced later, and this error-check will save a lot of debugging
time.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Define and use CONTROL_REGISTER_W1C_MASK to make sure that
w1c bits of usb control register do not get reset while
writing any other bit
Signed-off-by: Nikhil Badola <nikhil.badola@freescale.com>
Signed-off-by: Ramneek Mehresh <ramneek.mehresh@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
Since dfu_flush() can write raw data, dfu_write() with zero size
can be removed from download_tail() in thor gadget.
Signed-off-by: Przemyslaw Marczak <p.marczak@samsung.com>
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Heiko Schocher <hs@denx.de>
Cc: Marek Vasut <marex@denx.de>
ci_udc only allocates a single QTD structure per EP. All data needs to be
extracted from the DTD prior to calling ci_ep_submit_next_request(), since
that fills the QTD with next transaction's parameters. Fix
handle_ep_complete() to extract the transaction (remaining) length before
kicking off the next transaction.
In practice, this only causes writes to UMS devices to fail for me. I may
have tested the final versions of my previous ci_udc patch only with
reads. More recently, I had patches applied locally that allocated a QTD
per USB request rather than per USB EP, although since that doesn't give
any performance benefit, I'm dropping those.
Fixes: 2813006fec ("usb: ci_udc: allow multiple buffer allocs per ep")
Signed-off-by: Stephen Warren <swarren@nvidia.com>
A few changes are made to the Tegra EHCI driver so that it can set
everything up for device-mode operation on the first USB controller.
This can be used in conjunction with ci_udc.c to operate as a USB
device.
Detailed changes are:
* Rename set_host_mode() to set_up_vbus() since that's really what it
does.
* Modify set_up_vbus() to know whether it's initializing in host or
device mode, and:
- Skip the external VBUS check in device mode, since external VBUS is
expected in this case.
- Disable VBUS output in device mode.
* Modify init_phy_mux() to know whether it's initializing in host or
device mode, and hence skip setting USBMODE_CM_HC (which enables host
mode) in device mode. See the comments in that function for why this
is safe w.r.t. the ordering requirements of PHY selection.
* Modify init_utmi_usb_controller() to force "b session valid" in device
mode, since the HW requires this. This is done in UTMI-specific code,
since we only support device mode on the first USB controller, and that
controller can only talk to a UTMI PHY.
* Enhance ehci_hcd_init() to error-check the requested host-/device-mode
vs. the dr_mode (dual-role mode) value present in device tree, and the
HW configurations which support device mode.
* Enhance ehci_hcd_init() not to skip HW initialization when switching
between host and device mode on a controller. This requires remembering
which mode the last initialization used.
Cc: Jim Lin <jilin@nvidia.com>
Cc: Stefan Agner <stefan@agner.ch>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Both init_{utmi,ulpi}_usb_controller() have nearly identical code for
PHY type selection. Pull this out into a common function to remove the
duplication.
Cc: Jim Lin <jilin@nvidia.com>
Cc: Stefan Agner <stefan@agner.ch>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
The TRM for Tegra30 and later all state that USBMODE_CM_HC must be set
before writing to hostpc1_devlc to select which PHY to use for a USB
controller. However, neither init_{utmi,ulpi}_usb_controller() do this
today, so the register writes they perform for PHY selection do not
work.
For the UTMI case, this was hacked around in commit 7e44d9320e "ARM:
Tegra: USB: EHCI: Add support for Tegra30/Tegra114" by adding code to
ehci_hcd_init() which sets USBMODE_CM_HC and duplicates the PHY
selection register write. This code doesn't cover the ULPI case, so I
wouldn't be surprised if ULPI doesn't work with the current code, unless
the ordering requirement only ends up being an issue in HW for UTMI not
ULPI.
This patch fixes init_{utmi,ulpi}_usb_controller() to correctly set
USBMODE_CM_HC before selecting the PHY. Now that this works, we can
remove the duplicate UTMI-specific code in ehci_hcd_init(), thus
simplifying that function.
Cc: Jim Lin <jilin@nvidia.com>
Cc: Stefan Agner <stefan@agner.ch>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
add a possibility to add a medium specific polltimeout
function. So it is possible to define different
poll timeouts.
Used on nand medium, for setting the DFU_MANIFEST_POLL_TIMEOUT
only on nand ubi partitions, which is currently the only
usecase.
Change-Id: If1db5f49b32d93fefa7481e8dfe5b7ccc0e65af4
Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Pantelis Antoniou <panto@antoniou-consulting.com>
Reviewed-by: Marek Vasut <marex@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
comment in ep0_txstate() states:
"report completions as soon as the fifo's loaded; there's no win
in waiting till this last packet gets acked".
This is wrong for using dfu. In the dfu usecase we must send
a PollTimeout to the host, so the host can wait until the
U-Boot Code is ready for answering new usb requests. So the
answer which contains the PollTimeout must send *before*
U-Boot calls req->complete.
The req->complete is used in the dfu case for flushing the
medium, when entering DFU_STATE_dfuMANIFEST_SYNC state.
Change-Id: Ib2941119c72761e48e15fedbdad1ecce07ae0b3d
Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Pantelis Antoniou <panto@antoniou-consulting.com>
Acked-by: Marek Vasut <marex@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
This patch contains an implementation of the fastboot protocol on the
device side and documentation. This is based on USB download gadget
infrastructure. The fastboot function implements the getvar, reboot,
download and reboot commands. What is missing is the flash handling i.e.
writting the image to media.
v3 (Rob Herring):
This is based on http://patchwork.ozlabs.org/patch/126798/ with the
following changes:
- Rebase to current mainline and updates for current gadget API
- Use SPDX identifiers for licenses
- Traced the history and added missing copyright to cmd_fastboot.c
- Use load_addr/load_size for transfer buffer
- Allow vendor strings to be optional
- Set vendor/product ID from config defines
- Allow Ctrl-C to exit fastboot mode
v4:
- Major re-write to use the USB download gadget. Consolidated function
code to a single file.
- Moved globals into single struct.
- Use puts and putc as appropriate.
- Added CONFIG_USB_FASTBOOT_BUF_ADDR and CONFIG_USB_FASTBOOT_BUF_SIZE to
set the fastboot transfer buffer.
v5:
- Add CONFIG option documentation to README
- Rebase using new downloader registration
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Rob Herring <robh@kernel.org>
Now that the ci_udc driver supports allocating multiple requests per
endpoint, we can revert the special-case added by a022c1e13c "usb:
ums: use only 1 buffer for CI_UDC".
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Modify ci_ep_alloc_request() to return a dynamically allocated request
object, rather than a singleton that's part of the endpoint. This
requires moving various state from the endpoint structure to the request
structure, since we need one copy per request.
The "fast bounce buffer" b_fast is removed by this change rather than
moved to the request object. Instead, we enhance the bounce buffer logic
in ci_bounce()/ci_debounce() to keep the bounce buffer around between
request submissions. This avoids the need to allocate an arbitrarily-
sized bounce buffer up-front, yet avoids incurring the allocation
overhead each time a request is submitted.
A future enhancement would be to actually submit multiple requests to HW
at once. The Linux driver shows that this is possible. That might improve
throughput (depending on the USB protocol in use), since USB could be
performing a transfer to one HW buffer in parallel with whatever SW
actions U-Boot performs on another buffer. However, I have not made this
change as part of this patch, in order to keep SW changes related to
buffer management separate from any change in the way the HW is
programmed.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
g_dnl_register() currently first attempts to register a composite
driver by name, and then saves the driver name once it's registered.
Internally to the registration code, g_dnl_do_config() is called and
attempts to compare the composite device's name with the list of known
device names. This fails since the composite device's name has not yet
been stored. This means that the first time "ums 0 0" is run, it fails,
but subsequent attempts succeed.
Re-order the name-saving and registration code to solve this.
Fixes: e5b834e07f51 ("USB: gadget: added a saner gadget downloader registration API")
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Preprocessor definitions and hardcoded implementation selection in
g_dnl core were replaced by a linker list made of (usb_function_name,
bind_callback) pairs.
Signed-off-by: Mateusz Zalega <m.zalega@samsung.com>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Acked-by: Marek Vasut <marex@denx.de>
Former usb_cable_connected() patch broke compilation of boards which do
not support this feature.
I've renamed usb_cable_connected() to g_dnl_usb_cable_connected() and added
its default implementation to gadget downloader driver code. There's
only one driver of this kind and it's unlikely there'll be another, so
there's no point in keeping it in /common.
Previously this function was declared in usb.h. I've moved it, since
it's more appropriate to keep it in g_dnl.h - usb.h seems to be intended
for USB host implementation.
Existing code, confronted with default -EOPNOTSUPP return value,
continues as if the cable was connected.
CONFIG_USB_CABLE_CHECK was removed.
Change-Id: Ib9198621adee2811b391c64512f14646cefd0369
Signed-off-by: Mateusz Zalega <m.zalega@samsung.com>
Acked-by: Marek Vasut <marex@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Allow ci_udc.o to be built when using the new(?) USB gadget framework,
as enabled by CONFIG_USB_GADGET.
Note that this duplicates the Makefile entry for ci_udc.o, since it's
also included inside #ifdef CONFIG_USB_ETHER. I'm not sure what that
define means; perhaps an old style of Ethernet-specific USB gadget
implementation?
I wonder if the line that this patch adds shouldn't be outside all of
the ifdefs, so it stands on its own, similar to how e.g. epautoconf.o
is shared between the two?
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_udc.c allocates only a single buffer for each endpoint, which
ci_ep_alloc_request() returns as a hard-coded value rather than
dynamically allocating. Consequently, storage_common.c must limit
itself to using a single buffer at a time. Add a special case
to the definition of FSG_NUM_BUFFERS for this.
Another option would be to fix ci_ep_alloc_request() to dynamically
allocate the buffers like some/all(?) other device mode drivers do.
However, I don't think that ci_ep_queue() supports queueing up
multiple buffers either yet, and I'm not familiar enough with the
controller yet to implement that. As such, any attempt to use multiple
buffers simply results in data corruption and other errors.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Tegra's USB controller appears to be a variant of the ChipIdea
controller; perhaps derived from it, or simply a different version of
the IP core to what U-Boot supports today.
In this variant, at least the following difference are present:
- Some registers are moved about.
- Setup transaction completion is reported in a separate 'epsetupstat'
register, rather than in 'epstat' (which still exists, perhaps for
other transaction types).
- USB connection speed is reported in a separate 'hostpc1_devlc'
register, rather than 'portsc'.
- The registers used by ci_udc.c begin at offset 0x130 from the USB
register base, rather than offset 0x140. However, this is handled
by the associated EHCI controller driver, since the register address
is stored in controller.ctrl->hcor.
Introduce define CONFIG_CI_UDC_HAS_HOSTPC to indicate which variant of
the controller should be supported. The "HAS_HOSTPC" part of this name
mirrors the similar "has_hostpc" field used by the Linux EHCI controller
core to represent the presence/absence of the hostpc1_devlc register.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
usb_gadget_register_driver() currently unconditionally programs PORTSC
to select a ULPI PHY. This is incorrect on at least the Tegra boards I
am testing with, which use a UTMI PHY for the OTG ports. Make the PHY
selection code conditional upon the specific EHCI controller that is in
use.
Ideally, I believe that the PHY initialization code should be part of
ehci_hcd_init() in the relevant EHCI controller driver, or some board-
specific function that ehci_hcd_init() calls.
For MX6, I'm not sure this PHY initialization code is correct even before
this patch, since ehci-mx6's ehci_hcd_init() already configures PORTSC to
a board-specific value, and it seems likely that the code in ci_udc.c is
incorrectly undoing this. Perhaps this is not an issue if the PHY
selection register bits aren't implemented on this instance of the MX6
USB controller?
ehci-mxs.c doens't appear to touch PORTSC, so this code is likely still
required there.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
At least drivers/usb/gadget/storage_common.c expects that ep->req.actual
contain the number of bytes actually transferred. (At least in practice,
I observed it failing to work correctly unless this was the case).
However, ci_udc.c modifies ep->req.length instead. I assume that .length
is supposed to represent the allocated buffer size, whereas .actual is
supposed to represent the actual number of bytes transferred. In the OUT
transaction case, this may happen simply because the host sends a smaller
packet than the max possible size, which is quite legal. In the IN case,
transferring fewer bytes than requested could presumably happen as an
error.
Modify handle_ep_complete() to write to .actual rather than modifying
.length.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_ep_queue() currently only fills in the page0/page1 fields in the
queue item. If the buffer is larger than 4KiB (unaligned) or 8KiB
(page-aligned), then this prevents the HW from knowing where to write
the balance of the data.
Fix this by initializing all 5 pageN pointers, which allows up to
16KiB (potentially non-page-aligned) buffers.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Commit 4a271cb1b4 doesn't take into account that fdtdec_setup_gpio()
returns success when the gpio passed to it is FDT_GPIO_NONE (no
gpio node found in the fdtdec_decode_gpio() call). This results in
calling gpio_direction_output() on invalid gpio. For this reason
executing "usb start" command on Arndale causes data abort in the
ehci-exynos driver.
Add the fdt_gpio_isvalid() check to fix that problem.
Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org>
Cc: Julius Werner <jwerner@chromium.org>
Cc: Simon Glass <sjg@chromium.org>
Cc: Minkyu Kang <mk7.kang@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Add missing missing disconnect and unbind calls to the musb gadget driver's
usb_gadget_unregister_driver function. Otherwise, any gadget drivers fail
to uninitialize and run a 2nd time.
Signed-off-by: Rob Herring <robh@kernel.org>
Allow a NULL table to be passed to usb_gadget_get_string for cases
when a string table may not be populated.
Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Tom Rini <trini@ti.com>
Acked-by: Marek Vasut <marex@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Since dfu read/write operations needs to be flushed manually,
writing to filesystem on MMC by thor was broken. MMC raw write
actually is working fine because current dfu_flush() function
writes filesystem only. This commit adds dfu_flush() to f_thor
and now filesystem write is working.
This change was tested on Trats2 board.
Signed-off-by: Przemyslaw Marczak <p.marczak@samsung.com>
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Heiko Schocher <hs@denx.de>
Cc: Tom Rini <trini@ti.com>
In thor's download_tail() function, dfu_get_entity() is called
before each dfu_write() call and the returned entity pointers
are the same. So dfu_get_entity() can be called just once and
this patch changes this.
Signed-off-by: Przemyslaw Marczak <p.marczak@samsung.com>
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Heiko Schocher <hs@denx.de>
Cc: Tom Rini <trini@ti.com>
