Without NULL termination, various commands will read past the
end of input. In particular, this was noticed with error()
calls in cb_getvar and simple_strtoul() in cb_download.
Since the download callback happens elsewhere, the 4k buffer
should always be sufficient to handle command arguments.
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
The processing of the max-download-size variable requires a
radix specifier, or the fastboot host tool will interpret
it as an octal number.
See function get_target_sparse_limit() in file fastboot/fastboot.c
in the AOSP:
https://android.googlesource.com/platform/system/core/+/master
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
Current Android Fastboot seems to use 'max-download-size' instead
of 'downloadsize' variable to indicate the maximum size of sparse
segments.
See function get_target_sparse_limit() in file fastboot/fastboot.c
in the AOSP:
https://android.googlesource.com/platform/system/core/+/master
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
Force full-speed (12 Mbit/s) operation if CONFIG_USB_GADGET_DUALSPEED
is not defined.
The controller is capable of high-speed (480 Mbit/s) operation,
but some designs may require the use of lower-speed operation.
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
When download is ongoing, if the actual size of one transfer
is not the same as BYTES_PER_DOT, which will cause the dot
won't print anymore. Then it will let the user thinking it
is stuck, actually it is transfering without dot printed.
So, improve the method to show the progress bar (print dot).
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Acked-by: Marek Vasut <marex@denx.de>
Without this flag, tools like Alex Page's USB Image Tool
won't see drives exposed over USB Gadget as removable,
and won't allow access to them.
http://www.alexpage.de/usb-image-tool/
The code was pulled from the main-line kernel:
drivers/usb/gadget/function/f_mass_storage.c
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
DFU now can use also fullspeed.
Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: Tom Rini <trini@ti.com>
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Liu Bin <b-liu@ti.com>
Cc: Lukas Stockmann <lukas.stockmann@siemens.com>
- update static function
- additional debugging statements
- update "fastboot command" information
- add missing include file
- update spelling
Signed-off-by: Steve Rae <srae@broadcom.com>
- implement 'fastboot flash' for eMMC devices
Signed-off-by: Steve Rae <srae@broadcom.com>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Reviewed-by: Marek Vasut <marex@denx.de>
When enable debug option to compile, it will give the following
warning, this patch is used to get rid of it.
--->8---
warning: 'flags' is used uninitialized in this function [-Wuninitialized]
---8<---
Signed-off-by: Bo Shen <voice.shen@atmel.com>
When enable debug option to compile, it will give the following
warning, this patch is used to get rid of it.
--->8---
warning: 'flags' is used uninitialized in this function [-Wuninitialized]
---8<---
Signed-off-by: Bo Shen <voice.shen@atmel.com>
This allows the USB code to determine whether a USB bus reset was issued,
which in turn allows the code to differentiate between a detach (return
to shell prompt) and a board reset/reboot request.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
New dfu_usb_get_reset() method is necessary to distinct two different
use cases of dfu-util program.
This method checks if the USB bus reset has been really performed after
DFU DETACH.
Without this function the previous DFU behavior is preserved.
Signed-off-by: Lukasz Majewski <l.majewski@samsung.com>
This commit provides distinction between DFU device detach and reset.
The -R behavior is preserved with proper handling of the dfu-util's -e
switch, which detach the DFU device.
By running dfu-util -e; one can force device to finish the execution of
dfu command on target and execute some other scripted commands.
Moreover, some naming has been changed - the dfu_reset() method now is known
as dfu_detach(). New name better reflects the purpose of the code.
It was also necessary to increase the number of usb_gadget_handle_interrupts()
calls since we also must wait for detection of the USB reset event.
Example usage:
1. -e (detach) switch
dfu-util -a0 -D file1.bin;dfu-util -a3 -D uImage;dfu-util -e
access to u-boot prompt.
2. -R (reset) switch
dfu-util -a0 -D file1.bin;dfu-util -R -a3 -D uImage
target board reset
Signed-off-by: Lukasz Majewski <l.majewski@samsung.com>
Reviewed-by: Stephen Warren <swarren@nvidia.com>
Tested-by: Stephen Warren <swarren@nvidia.com>
- move linux specific defines from usb and video code
into linux/compat.h
- move common linux specific defines from include/ubi_uboot.h
to linux/compat.h
- add for new mtd/ubi/ubifs sync new needed linux specific
defines to linux/compat.h
Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: Marek Vasut <marex@denx.de>
Cc: Anatolij Gustschin <agust@denx.de>
[trini: Add spin_lock_irqsave/spin_unlock_irqrestore dummies from
usb/lin_gadet_compat.h]
Signed-off-by: Tom Rini <trini@ti.com>
Emails to the board maintainer
"Rishi Bhattacharya <rishi@ti.com>"
have been bouncing.
Tom suggested to remove this board.
Remove also omap1510_udc.c because this is the last board
to enable it.
Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
Suggested-by: Tom Rini <trini@ti.com>
The following configs are not defined at all.
- CONFIG_OMAP1510
- CONFIG_OMAP_1510P1
- CONFIG_OMAP_SX1
- CONFIG_OMAP3_DMA
- CONFIG_OMAP3_ZOOM2
- CONFIG_OMAP_INNOVATOR
Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
Cc: Tom Rini <trini@ti.com>
CONFIG_SYS_DFU_DATA_BUF_SIZE may be large to allow for FAT/ext layouts
to transfer large files. However, this means that individual write
operations will take a long time. Allow backends to specify a maximum
buffer size, so that each write operation is limited to a smaller data
block. This prevents the DFU protocol from timing out when e.g. writing
to SPI flash. I would guess that NAND might benefit from setting this
value too, but I can't test that.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Fix calls to dfu_write() and dfu_flush() to detect errors in the I/O
itself. This could happen due to problems with the storage medium, or
simply when trying to write a FAT/ext file that is larger than the buffer
dfu_mmc.c maintains for this purpose.
Signal the error by switching the DFU state/status. This will be picked
up by the DFU client when it sends the next DFU request. Note that errors
can't simply be returned from e.g. dnload_request_complete(), since that
function has no way to pass errors back to the DFU client; a call to
dnload_request_complete() simply means that a USB OUT completed.
This error state/status needs to be cleared when the next DFU client
connects. While there is a DFU_CLRSTATUS request, no DFU client seems to
send this. Hence, clear this when selecting the USB alternate setting on
the USB interface.
Finally, dfu.c relies on a call to dfu_flush() to clear up the internal
state of the write transaction. Now that errors in dfu_write() are
detected, dfu_flush() may no longer be called for every transaction.
Separate out the cleanup code into a new function, and call it whenever
dfu_write() fails, as well as from any call to dfu_flush().
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Almost all of ci_udc.c uses variable name "ep" for a struct usb_ep and
"ci_ep" for a struct ci_ep. This is nice and consistent, and helps people
know what type a variable is without searching for the declaration.
handle_ep_complete() doesn't do this, so fix it to be consistent.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
A UDC's alloc_request method should zero out the newly allocated request.
Ensure the Atmel driver does so. This issue was found by code inspection,
following the investigation of an intermittent issue with ci_udc, which
was tracked down to failing to zero out allocated requests following some
of my changes. All other UDC drivers already zero out requests in one
way or another.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
struct ci_req is a purely software structure, and needs no specific
memory alignment. Hence, allocate it with calloc() rather than
memalign(). The use of memalign() was left-over from when struct ci_req
was going to hold the aligned bounce buffer, but this is now dynamically
allocated.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
There's no need to store an array of QTD pointers in the controller.
Since the calculation is so simple, just have ci_get_qtd() perform it
at run-time, rather than pre-calculating everything.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
2 QTDs are allocated for each EP. The current allocation scheme aligns
the first QTD in each pair, but simply adds the struct size to calculate
the second QTD's address. This will result in a non-cache-aligned
addresss IF the system's ARCH_DMA_MINALIGN is not 32 bytes (i.e. the
size of struct ept_queue_item).
Similarly, the original ilist_ent_sz calculation aligned the value to
ARCH_DMA_MINALIGN but didn't take the USB HW's 32-byte alignment
requirement into account. This doesn't cause a practical issue unless
ARCH_DMA_MINALIGN < 32 (which I suspect is quite unlikely), but we may
as well fix the code to be explicit, so it's obviously completely
correct.
The new value of ILIST_ENT_SZ takes all alignment requirements into
account, so we can simplify ci_{flush,invalidate}_qtd() by simply using
that macro rather than calling roundup().
Similarly, the calculation of controller.items[i] can be simplified,
since each QTD is evenly spaced at its individual alignment requirement,
rather than each pair being aligned, and entries within the pair being
spaced apart only by structure size.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
This will allow functions other than ci_udc_probe() to make use of the
constants in a future change.
This in turn requires converting the const int variables to #defines,
since the initialization of one global const int can't depend on the
value of another const int; the compiler thinks it's non-constant if
that dependency exists.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Fix ci_ep_submit_next_request()'s ZLP transmission code to explicitly
call ci_get_qtd() to find the address of the other QTD to use. This
will allow us to correctly align each QTD individually in the future,
which may involve leaving a gap between the QTDs.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_udc_probe() initializes a pair of QHs and QTDs for each EP. After
each pair has been initialized, the pair is cache-flushed. The
conversion from QH/QTD index [0..2*NUM_END_POINTS) to EP index
[0..NUM_ENDPOINTS] is incorrect; it simply subtracts 1 (which yields
the QH/QTD index of the first entry in the pair) rather than dividing
by two (which scales the range). Fix this.
On my system, this avoids cache debug prints due to requests to flush
unaligned ranges. This is caused because the flush calls happen before
the items[] array entries are initialized for all but EP0.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
cb_getvar tries to prevent overflowing the response buffer
by using strncat. But strncat takes the number of data bytes
copied as a limit not the total buffer length so it can still
overflow. Pass the correct value instead.
cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
cc: Rob Herring <robh@kernel.org>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
since ALLOC_CACHE_ALIGN_BUFFER defines a pointer and not a
buffer, the memset with sizeof(rqt) likely does something else
then intended. Since there is a memcpy directly after it with
the full size, drop the memset completely.
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Since the struct fsg_common is calloced, reset it completely
with zero's when reused. While at it, make checkpatch happy.
cc: Lukasz Majewski <l.majewski@samsung.com>
cc: Piotr Wilczek <p.wilczek@samsung.com>
cc: Kyungmin Park <kyungmin.park@samsung.com>
cc: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
Acked-by: Marek Vasut <marex@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
ci_udc.c's usb_gadget_unregister_driver() doesn't call driver->unbind()
unlike other USB gadget drivers. Fix it to do this.
Without this, when ether.c's CDC Ethernet device is torn down,
eth_unbind() is never called, so dev->gadget is never set to NULL.
For some reason, usb_eth_halt() is called both at the end of the first
use of the Ethernet device, and prior to any subsequent use. Since
dev->gadget is never cleared, all calls to usb_eth_halt() attempt to
stop, disconnect, and clean up the device, resulting in double cleanup,
which hangs U-Boot on my Tegra device at least.
ci_udc allocates its own singleton EP0 request object, and cleans it up
during usb_gadget_unregister_driver(). This appears necessary when using
the USB gadget framework in U-Boot, since that does not allocate/free
the EP0 request. However, the CDC Ethernet driver *does* allocate and
free its own EP0 requests. Consequently, we must protect
ci_ep_free_request() against double-freeing the request.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Sometimes, a zero-length packet is required at the end of an IN
transaction so that the host knows the device is done sending data.
Enhance ci_udc to send a zlp when necessary. See the comments for
more details.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
usb_gadget_unregister_driver() is called to tear down the USB device mode
stack. Fix the driver to stop the USB HW (which causes any attached host
to notice the disappearance of the device), and free all allocations
(which obviously prevents memory leaks).
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_ep_alloc_request() avoids allocating multiple request objects for ep0
by keeping a record of the first req allocated for ep0, and always
returning that instead of allocating a new req. However, if this req is
ever freed, the record of the previous allocation is not cleared, so
ci_ep_alloc_request() will keep returning this stale pointer. Fix
ci_ep_free_request() to clear the record of the previous allocation.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_pullup()'s !is_on path contains a cut/paste copy of udc_disconnect().
Remove the duplication by simply calling udc_disconnect() instead.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
handle_setup() currently assumes that the response to a Setup transaction
will be an OUT transaction, and any subsequent packet (if any) will be an
IN transaction. This appears to be valid in many cases; both USB
enumeration and Mass Storage work OK with this restriction. However, DFU
uses ep0 to transfer data in both directions. This renders the assumption
invalid; when sending data from device to host, the Data Stage is an IN
transaction, and the Status Stage is an OUT transaction. Enhance
handle_setup() to deduce the correct direction for the USB transactions
based on Setup transaction data.
ep0's request object only needs to be automatically re-queued when the
Data Stage completes, in order to implement the Status Stage. Once the
Status Stage transaction is complete, there is no need to re-queue the
USB request, so don't do that.
Don't sent USB request completion callbacks for Status Stage transactions.
These were queued by ci_udc itself, and only serve to confuse the USB
function code. For example, f_dfu attempts to interpret the 0-length data
buffers for Status Stage transactions as DFU packets. These buffers
contain stale data from the previous transaction. This causes f_dfu to
complain about a sequence number mismatch.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Allocate ep0's USB request object when the UDC driver is probed. This
solves a couple of issues in the current code:
a) A request object always exists for ep0. Prior to this patch, if setup
transactions arrived in an unexpected order, handle_setup() would need
to reply to a setup transaction before any ep0 usb_req was created.
This issue was introduced in commit 2813006fec "usb: ci_udc: allow
multiple buffer allocs per ep."
b) handle_ep_complete no longer /has/ to queue the ep0 request again
after every single request completion. This is currently required, since
handle_setup() assumes it can find some request object in ep0's request
queue. This patch doesn't actually stop handle_ep_complete() from always
requeueing the request, but the next patch will.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_udc currently points ep->desc at separate descriptors for IN and OUT.
These descriptors only differ in the ep address IN/OUT field. Modify the
code to use a single descriptor, and change that descriptor's ep address
to indicate IN/OUT as required. This removes some data duplication.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
The flipping of ep0 between IN and OUT relies on ci_ep_queue() consuming
the current IN/OUT setting immediately. If this is deferred to a later
point when the req is pulled out of ci_req->queue, then the IN/OUT
setting may have been changed since the req was queued, and state will
get out of sync. This condition doesn't occur today, but could if bugs
were introduced later, and this error-check will save a lot of debugging
time.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Since dfu_flush() can write raw data, dfu_write() with zero size
can be removed from download_tail() in thor gadget.
Signed-off-by: Przemyslaw Marczak <p.marczak@samsung.com>
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Heiko Schocher <hs@denx.de>
Cc: Marek Vasut <marex@denx.de>
ci_udc only allocates a single QTD structure per EP. All data needs to be
extracted from the DTD prior to calling ci_ep_submit_next_request(), since
that fills the QTD with next transaction's parameters. Fix
handle_ep_complete() to extract the transaction (remaining) length before
kicking off the next transaction.
In practice, this only causes writes to UMS devices to fail for me. I may
have tested the final versions of my previous ci_udc patch only with
reads. More recently, I had patches applied locally that allocated a QTD
per USB request rather than per USB EP, although since that doesn't give
any performance benefit, I'm dropping those.
Fixes: 2813006fec ("usb: ci_udc: allow multiple buffer allocs per ep")
Signed-off-by: Stephen Warren <swarren@nvidia.com>
add a possibility to add a medium specific polltimeout
function. So it is possible to define different
poll timeouts.
Used on nand medium, for setting the DFU_MANIFEST_POLL_TIMEOUT
only on nand ubi partitions, which is currently the only
usecase.
Change-Id: If1db5f49b32d93fefa7481e8dfe5b7ccc0e65af4
Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Pantelis Antoniou <panto@antoniou-consulting.com>
Reviewed-by: Marek Vasut <marex@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
This patch contains an implementation of the fastboot protocol on the
device side and documentation. This is based on USB download gadget
infrastructure. The fastboot function implements the getvar, reboot,
download and reboot commands. What is missing is the flash handling i.e.
writting the image to media.
v3 (Rob Herring):
This is based on http://patchwork.ozlabs.org/patch/126798/ with the
following changes:
- Rebase to current mainline and updates for current gadget API
- Use SPDX identifiers for licenses
- Traced the history and added missing copyright to cmd_fastboot.c
- Use load_addr/load_size for transfer buffer
- Allow vendor strings to be optional
- Set vendor/product ID from config defines
- Allow Ctrl-C to exit fastboot mode
v4:
- Major re-write to use the USB download gadget. Consolidated function
code to a single file.
- Moved globals into single struct.
- Use puts and putc as appropriate.
- Added CONFIG_USB_FASTBOOT_BUF_ADDR and CONFIG_USB_FASTBOOT_BUF_SIZE to
set the fastboot transfer buffer.
v5:
- Add CONFIG option documentation to README
- Rebase using new downloader registration
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Rob Herring <robh@kernel.org>
Now that the ci_udc driver supports allocating multiple requests per
endpoint, we can revert the special-case added by a022c1e13c "usb:
ums: use only 1 buffer for CI_UDC".
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Modify ci_ep_alloc_request() to return a dynamically allocated request
object, rather than a singleton that's part of the endpoint. This
requires moving various state from the endpoint structure to the request
structure, since we need one copy per request.
The "fast bounce buffer" b_fast is removed by this change rather than
moved to the request object. Instead, we enhance the bounce buffer logic
in ci_bounce()/ci_debounce() to keep the bounce buffer around between
request submissions. This avoids the need to allocate an arbitrarily-
sized bounce buffer up-front, yet avoids incurring the allocation
overhead each time a request is submitted.
A future enhancement would be to actually submit multiple requests to HW
at once. The Linux driver shows that this is possible. That might improve
throughput (depending on the USB protocol in use), since USB could be
performing a transfer to one HW buffer in parallel with whatever SW
actions U-Boot performs on another buffer. However, I have not made this
change as part of this patch, in order to keep SW changes related to
buffer management separate from any change in the way the HW is
programmed.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
g_dnl_register() currently first attempts to register a composite
driver by name, and then saves the driver name once it's registered.
Internally to the registration code, g_dnl_do_config() is called and
attempts to compare the composite device's name with the list of known
device names. This fails since the composite device's name has not yet
been stored. This means that the first time "ums 0 0" is run, it fails,
but subsequent attempts succeed.
Re-order the name-saving and registration code to solve this.
Fixes: e5b834e07f51 ("USB: gadget: added a saner gadget downloader registration API")
Signed-off-by: Stephen Warren <swarren@nvidia.com>
