Fix use-before-initialized bug in pxa25x_udc driver.
Function usb_gadget_register_driver calls udc_disable,
and udc_disable calls pullup_off that uses dev->mach->udc_command.
But dev->mach is initialized in usb_gadget_register_driver after
calling udc_disable. This patch fixes the order of initialization.
Signed-off-by: Alex Sadovsky <Nable.MainInbox@googlemail.com>
Without this function the USB compliance test (USB 2.0 Command Verifier) will
fail in the "Interface Descriptor Test" with this error message:
FAIL
(1.2.51) A successful GetInterface request must return the alternate setting
set by a prior call to SetInterface.
Lets add this function to read back the value so that the DFU device fully
passes the USB compliance test.
Signed-off-by: Stefan Roese <sr@denx.de>
Cc: Roger Meier <r.meier@siemens.com>
Cc: Samuel Egli <samuel.egli@siemens.com>
Cc: Enrico Leto <enrico.leto@siemens.com>
Acked-by: Heiko Schocher <hs@denx.de>
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
On the DXR2 board (AM335x using MUSB) the USB compliance test suite
(USB 2.0 Command Verifier) will cause the board to crash and reset
upon the "BOS Descriptor Test - Addressed state". Here the output
from the DRX2 while running this test:
GADGET DRIVER: usb_dnl_dfu
musb-hdrc: peripheral reset irq lost!
composite_setup (776)
data abort
pc : [<87f693ac>] lr : [<87f6911c>]
sp : 86f33a58 ip : 00000000 fp : 86f3bbac
r10: 00000f00 r9 : 86f33ef4 r8 : 86f37da8
r7 : 00000005 r6 : 86f33a90 r5 : 00000000 r4 : 86f37e30
r3 : 00000000 r2 : 00000000 r1 : 87f9c888 r0 : 00000016
Flags: Nzcv IRQs off FIQs on Mode SVC_32
Resetting CPU ...
resetting ...
By adding the case statement for USB_DT_BOS and therefore not running
into the default case (jump to unkown label) this crash is fixed.
Signed-off-by: Stefan Roese <sr@denx.de>
Cc: Roger Meier <r.meier@siemens.com>
Cc: Samuel Egli <samuel.egli@siemens.com>
Cc: Enrico Leto <enrico.leto@siemens.com>
Acked-by: Heiko Schocher <hs@denx.de>
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Some pointers in function download_tail() were not checked
before the use. This could possibly cause the data abort.
To avoid this, check if the pointers are not null is added.
Signed-off-by: Przemyslaw Marczak <p.marczak@samsung.com>
Tested-by: Lukasz Majewski <l.majewski@samsung.com>
[TestHW: Exynos4412-Trats2]
The fastboot continue command is defined to exit fastboot and continue
autoboot. This commit implements the continue command and the exiting of
fastboot only. Subsequent u-boot commands can be processed after exiting
fastboot. Autoboot should implement a boot script such as "fastboot; mmc
read <...>; bootm" to fully implement the fastboot continue function.
Signed-off-by: Rob Herring <robh@kernel.org>
Tested-by: Lukasz Majewski <l.majewski@samsung.com>
[TestHW: Exynos4412-Trats2]
In order to add detach functions for fastboot, make the DFU detach related
functions common so they can be shared.
Signed-off-by: Rob Herring <robh@kernel.org>
Tested-by: Lukasz Majewski <l.majewski@samsung.com>
[TestHW: Exynos4412-Trats2]
When receive data, the RXRDY in status register set by hardware
after a new packet has been stored in the endpoint FIFO. After,
we copy from FIFO, we clear it, make the FIFO can be accessed
again.
In the receive_data() function, this bit RXRDY has been cleared.
So, after the receive_data() function return, this bit should
not be cleared again, or else it will cause the accessing FIFO
corrupt, which will make the data loss.
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Move strlcpy() definition from drivers/usb/gadget/ether.c to
lib/string.c because it is a very useful function.
Let's add the prototype to include/linux/string.h too.
Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
Acked-by: Simon Glass <sjg@chromium.org>
U-Boot has never cared about the type when we get max/min of two
values, but Linux Kernel does. This commit gets min, max, min3, max3
macros synced with the kernel introducing type checks.
Many of references of those macros must be fixed to suppress warnings.
We have two options:
- Use min, max, min3, max3 only when the arguments have the same type
(or add casts to the arguments)
- Use min_t/max_t instead with the appropriate type for the first
argument
Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
Acked-by: Pavel Machek <pavel@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Tested-by: Lukasz Majewski <l.majewski@samsung.com>
[trini: Fixup arch/blackfin/lib/string.c]
Signed-off-by: Tom Rini <trini@ti.com>
Split the Samsung specific PHY control into a separate file
and compile this into the S3C OTG driver only if used on a
Samsung system.
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Chin Liang See <clsee@altera.com>
Cc: Dinh Nguyen <dinguyen@opensource.altera.com>
Cc: Vince Bridgers <vbridger@altera.com>
Acked-by: Pavel Machek <pavel@denx.de>
Cc: Stefan Roese <sr@denx.de>
Reviewed-by: Lukasz Majewski <l.majewski@samsung.com>
Tested-by: Lukasz Majewski <l.majewski@samsung.com>
Encapsulate the Samsung PHY control and its register accesses
into the otg_phy_init() and otg_phy_off() functions.
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Chin Liang See <clsee@altera.com>
Cc: Dinh Nguyen <dinguyen@opensource.altera.com>
Cc: Vince Bridgers <vbridger@altera.com>
Cc: Stefan Roese <sr@denx.de>
Acked-by: Pavel Machek <pavel@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Tested-by: Lukasz Majewski <l.majewski@samsung.com>
Remove the useless inclusion of arch/arm/gpio.h , which is completely
bogus in this driver.
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Chin Liang See <clsee@altera.com>
Cc: Dinh Nguyen <dinguyen@opensource.altera.com>
Cc: Vince Bridgers <vbridger@altera.com>
Cc: Stefan Roese <sr@denx.de>
Acked-by: Pavel Machek <pavel@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Without NULL termination, various commands will read past the
end of input. In particular, this was noticed with error()
calls in cb_getvar and simple_strtoul() in cb_download.
Since the download callback happens elsewhere, the 4k buffer
should always be sufficient to handle command arguments.
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
The processing of the max-download-size variable requires a
radix specifier, or the fastboot host tool will interpret
it as an octal number.
See function get_target_sparse_limit() in file fastboot/fastboot.c
in the AOSP:
https://android.googlesource.com/platform/system/core/+/master
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
Current Android Fastboot seems to use 'max-download-size' instead
of 'downloadsize' variable to indicate the maximum size of sparse
segments.
See function get_target_sparse_limit() in file fastboot/fastboot.c
in the AOSP:
https://android.googlesource.com/platform/system/core/+/master
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
Force full-speed (12 Mbit/s) operation if CONFIG_USB_GADGET_DUALSPEED
is not defined.
The controller is capable of high-speed (480 Mbit/s) operation,
but some designs may require the use of lower-speed operation.
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
When download is ongoing, if the actual size of one transfer
is not the same as BYTES_PER_DOT, which will cause the dot
won't print anymore. Then it will let the user thinking it
is stuck, actually it is transfering without dot printed.
So, improve the method to show the progress bar (print dot).
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Acked-by: Marek Vasut <marex@denx.de>
Without this flag, tools like Alex Page's USB Image Tool
won't see drives exposed over USB Gadget as removable,
and won't allow access to them.
http://www.alexpage.de/usb-image-tool/
The code was pulled from the main-line kernel:
drivers/usb/gadget/function/f_mass_storage.c
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
DFU now can use also fullspeed.
Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: Tom Rini <trini@ti.com>
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Liu Bin <b-liu@ti.com>
Cc: Lukas Stockmann <lukas.stockmann@siemens.com>
- update static function
- additional debugging statements
- update "fastboot command" information
- add missing include file
- update spelling
Signed-off-by: Steve Rae <srae@broadcom.com>
- implement 'fastboot flash' for eMMC devices
Signed-off-by: Steve Rae <srae@broadcom.com>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Reviewed-by: Marek Vasut <marex@denx.de>
When enable debug option to compile, it will give the following
warning, this patch is used to get rid of it.
--->8---
warning: 'flags' is used uninitialized in this function [-Wuninitialized]
---8<---
Signed-off-by: Bo Shen <voice.shen@atmel.com>
When enable debug option to compile, it will give the following
warning, this patch is used to get rid of it.
--->8---
warning: 'flags' is used uninitialized in this function [-Wuninitialized]
---8<---
Signed-off-by: Bo Shen <voice.shen@atmel.com>
This allows the USB code to determine whether a USB bus reset was issued,
which in turn allows the code to differentiate between a detach (return
to shell prompt) and a board reset/reboot request.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
New dfu_usb_get_reset() method is necessary to distinct two different
use cases of dfu-util program.
This method checks if the USB bus reset has been really performed after
DFU DETACH.
Without this function the previous DFU behavior is preserved.
Signed-off-by: Lukasz Majewski <l.majewski@samsung.com>
This commit provides distinction between DFU device detach and reset.
The -R behavior is preserved with proper handling of the dfu-util's -e
switch, which detach the DFU device.
By running dfu-util -e; one can force device to finish the execution of
dfu command on target and execute some other scripted commands.
Moreover, some naming has been changed - the dfu_reset() method now is known
as dfu_detach(). New name better reflects the purpose of the code.
It was also necessary to increase the number of usb_gadget_handle_interrupts()
calls since we also must wait for detection of the USB reset event.
Example usage:
1. -e (detach) switch
dfu-util -a0 -D file1.bin;dfu-util -a3 -D uImage;dfu-util -e
access to u-boot prompt.
2. -R (reset) switch
dfu-util -a0 -D file1.bin;dfu-util -R -a3 -D uImage
target board reset
Signed-off-by: Lukasz Majewski <l.majewski@samsung.com>
Reviewed-by: Stephen Warren <swarren@nvidia.com>
Tested-by: Stephen Warren <swarren@nvidia.com>
- move linux specific defines from usb and video code
into linux/compat.h
- move common linux specific defines from include/ubi_uboot.h
to linux/compat.h
- add for new mtd/ubi/ubifs sync new needed linux specific
defines to linux/compat.h
Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: Marek Vasut <marex@denx.de>
Cc: Anatolij Gustschin <agust@denx.de>
[trini: Add spin_lock_irqsave/spin_unlock_irqrestore dummies from
usb/lin_gadet_compat.h]
Signed-off-by: Tom Rini <trini@ti.com>
Emails to the board maintainer
"Rishi Bhattacharya <rishi@ti.com>"
have been bouncing.
Tom suggested to remove this board.
Remove also omap1510_udc.c because this is the last board
to enable it.
Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
Suggested-by: Tom Rini <trini@ti.com>
The following configs are not defined at all.
- CONFIG_OMAP1510
- CONFIG_OMAP_1510P1
- CONFIG_OMAP_SX1
- CONFIG_OMAP3_DMA
- CONFIG_OMAP3_ZOOM2
- CONFIG_OMAP_INNOVATOR
Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
Cc: Tom Rini <trini@ti.com>
CONFIG_SYS_DFU_DATA_BUF_SIZE may be large to allow for FAT/ext layouts
to transfer large files. However, this means that individual write
operations will take a long time. Allow backends to specify a maximum
buffer size, so that each write operation is limited to a smaller data
block. This prevents the DFU protocol from timing out when e.g. writing
to SPI flash. I would guess that NAND might benefit from setting this
value too, but I can't test that.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Fix calls to dfu_write() and dfu_flush() to detect errors in the I/O
itself. This could happen due to problems with the storage medium, or
simply when trying to write a FAT/ext file that is larger than the buffer
dfu_mmc.c maintains for this purpose.
Signal the error by switching the DFU state/status. This will be picked
up by the DFU client when it sends the next DFU request. Note that errors
can't simply be returned from e.g. dnload_request_complete(), since that
function has no way to pass errors back to the DFU client; a call to
dnload_request_complete() simply means that a USB OUT completed.
This error state/status needs to be cleared when the next DFU client
connects. While there is a DFU_CLRSTATUS request, no DFU client seems to
send this. Hence, clear this when selecting the USB alternate setting on
the USB interface.
Finally, dfu.c relies on a call to dfu_flush() to clear up the internal
state of the write transaction. Now that errors in dfu_write() are
detected, dfu_flush() may no longer be called for every transaction.
Separate out the cleanup code into a new function, and call it whenever
dfu_write() fails, as well as from any call to dfu_flush().
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Almost all of ci_udc.c uses variable name "ep" for a struct usb_ep and
"ci_ep" for a struct ci_ep. This is nice and consistent, and helps people
know what type a variable is without searching for the declaration.
handle_ep_complete() doesn't do this, so fix it to be consistent.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
A UDC's alloc_request method should zero out the newly allocated request.
Ensure the Atmel driver does so. This issue was found by code inspection,
following the investigation of an intermittent issue with ci_udc, which
was tracked down to failing to zero out allocated requests following some
of my changes. All other UDC drivers already zero out requests in one
way or another.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
struct ci_req is a purely software structure, and needs no specific
memory alignment. Hence, allocate it with calloc() rather than
memalign(). The use of memalign() was left-over from when struct ci_req
was going to hold the aligned bounce buffer, but this is now dynamically
allocated.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
There's no need to store an array of QTD pointers in the controller.
Since the calculation is so simple, just have ci_get_qtd() perform it
at run-time, rather than pre-calculating everything.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
2 QTDs are allocated for each EP. The current allocation scheme aligns
the first QTD in each pair, but simply adds the struct size to calculate
the second QTD's address. This will result in a non-cache-aligned
addresss IF the system's ARCH_DMA_MINALIGN is not 32 bytes (i.e. the
size of struct ept_queue_item).
Similarly, the original ilist_ent_sz calculation aligned the value to
ARCH_DMA_MINALIGN but didn't take the USB HW's 32-byte alignment
requirement into account. This doesn't cause a practical issue unless
ARCH_DMA_MINALIGN < 32 (which I suspect is quite unlikely), but we may
as well fix the code to be explicit, so it's obviously completely
correct.
The new value of ILIST_ENT_SZ takes all alignment requirements into
account, so we can simplify ci_{flush,invalidate}_qtd() by simply using
that macro rather than calling roundup().
Similarly, the calculation of controller.items[i] can be simplified,
since each QTD is evenly spaced at its individual alignment requirement,
rather than each pair being aligned, and entries within the pair being
spaced apart only by structure size.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
This will allow functions other than ci_udc_probe() to make use of the
constants in a future change.
This in turn requires converting the const int variables to #defines,
since the initialization of one global const int can't depend on the
value of another const int; the compiler thinks it's non-constant if
that dependency exists.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Fix ci_ep_submit_next_request()'s ZLP transmission code to explicitly
call ci_get_qtd() to find the address of the other QTD to use. This
will allow us to correctly align each QTD individually in the future,
which may involve leaving a gap between the QTDs.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
ci_udc_probe() initializes a pair of QHs and QTDs for each EP. After
each pair has been initialized, the pair is cache-flushed. The
conversion from QH/QTD index [0..2*NUM_END_POINTS) to EP index
[0..NUM_ENDPOINTS] is incorrect; it simply subtracts 1 (which yields
the QH/QTD index of the first entry in the pair) rather than dividing
by two (which scales the range). Fix this.
On my system, this avoids cache debug prints due to requests to flush
unaligned ranges. This is caused because the flush calls happen before
the items[] array entries are initialized for all but EP0.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
cb_getvar tries to prevent overflowing the response buffer
by using strncat. But strncat takes the number of data bytes
copied as a limit not the total buffer length so it can still
overflow. Pass the correct value instead.
cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
cc: Rob Herring <robh@kernel.org>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
since ALLOC_CACHE_ALIGN_BUFFER defines a pointer and not a
buffer, the memset with sizeof(rqt) likely does something else
then intended. Since there is a memcpy directly after it with
the full size, drop the memset completely.
Cc: Lukasz Majewski <l.majewski@samsung.com>
Cc: Marek Vasut <marex@denx.de>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Since the struct fsg_common is calloced, reset it completely
with zero's when reused. While at it, make checkpatch happy.
cc: Lukasz Majewski <l.majewski@samsung.com>
cc: Piotr Wilczek <p.wilczek@samsung.com>
cc: Kyungmin Park <kyungmin.park@samsung.com>
cc: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
Acked-by: Marek Vasut <marex@denx.de>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
ci_udc.c's usb_gadget_unregister_driver() doesn't call driver->unbind()
unlike other USB gadget drivers. Fix it to do this.
Without this, when ether.c's CDC Ethernet device is torn down,
eth_unbind() is never called, so dev->gadget is never set to NULL.
For some reason, usb_eth_halt() is called both at the end of the first
use of the Ethernet device, and prior to any subsequent use. Since
dev->gadget is never cleared, all calls to usb_eth_halt() attempt to
stop, disconnect, and clean up the device, resulting in double cleanup,
which hangs U-Boot on my Tegra device at least.
ci_udc allocates its own singleton EP0 request object, and cleans it up
during usb_gadget_unregister_driver(). This appears necessary when using
the USB gadget framework in U-Boot, since that does not allocate/free
the EP0 request. However, the CDC Ethernet driver *does* allocate and
free its own EP0 requests. Consequently, we must protect
ci_ep_free_request() against double-freeing the request.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Sometimes, a zero-length packet is required at the end of an IN
transaction so that the host knows the device is done sending data.
Enhance ci_udc to send a zlp when necessary. See the comments for
more details.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
usb_gadget_unregister_driver() is called to tear down the USB device mode
stack. Fix the driver to stop the USB HW (which causes any attached host
to notice the disappearance of the device), and free all allocations
(which obviously prevents memory leaks).
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Alex Sadovsky
Stefan Roese
Przemyslaw Marczak
Rob Herring
Bo Shen
Masahiro Yamada
Marek Vasut
Eric Nelson
Heiko Schocher
Lukasz Majewski
Steve Rae
Stephen Warren
Jeroen Hofstee