u-boot.git/drivers/usb/gadget/f_dfu.c, branch main

Restore patch series "arm: dts: am62-beagleplay: Fix Beagleplay Ethernet"

2024-05-20T19:35:03Z

As part of bringing the master branch back in to next, we need to allow for all of these changes to exist here. Reported-by: Jonas Karlman Signed-off-by: Tom Rini

Revert "Merge patch series "arm: dts: am62-beagleplay: Fix Beagleplay Ethernet""

2024-05-19T14:16:36Z

When bringing in the series 'arm: dts: am62-beagleplay: Fix Beagleplay Ethernet"' I failed to notice that b4 noticed it was based on next and so took that as the base commit and merged that part of next to master. This reverts commit c8ffd1356d42223cbb8c86280a083cc3c93e6426, reversing changes made to 2ee6f3a5f7550de3599faef9704e166e5dcace35. Reported-by: Jonas Karlman Signed-off-by: Tom Rini

usb: Remove and add needed includes

2024-05-07T14:00:56Z

Remove from this driver directory and when needed add missing include files directly. Reviewed-by: Mattijs Korpershoek Signed-off-by: Tom Rini

usb: gadget: dfu: Fix check of transfer direction

2022-12-08T13:30:39Z

Commit fbce985e28eaca3af82afecc11961aadaf971a7e to fix CVE-2022-2347 blocks DFU usb requests. The verification of the transfer direction was done by an equality but it is a bit mask. Signed-off-by: Hugo SIMELIERE Reviewed-by: Fabio Estevam Reviewed-by: Sultan Qasim Khan Reviewed-by: Marek Vasut Tested-by: Marek Vasut

usb: gadget: dfu: Fix the unchecked length field

2022-11-21T14:23:00Z

DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction. Fixing the length and transfer direction. CVE-2022-2347 Signed-off-by: Venkatesh Yadav Abbarapu Reviewed-by: Marek Vasut

dfu: handle short frame result of UPLOAD in state_dfu_idle

2022-01-28T15:21:51Z

In DFU v1.1 specification [1] the DFU_UPLOAD (Short Frame) is handled only in dfuUPLOADIDLE state: - Figure A.1 Interface state transition diagram - the state description in chapter A.2 A.2.3 State 2 dfuIDLE on Receipt of the DFU_UPLOAD request,and bitCanUpload = 1 the Next State is dfuUPLOADIDLE A.2.10 State 9 dfuUPLOAD-IDLE When the length of the data transferred by the device in response to a DFU_UPLOAD request is less than wLength. (Short frame) the Next State is dfuIDLE In current code, when an UPLOAD is completely performed after the first request (for example with wLength=200 and data read = 9), the DFU state stay at dfuUPLOADIDLE until receiving a DFU_UPLOAD or a DFU_ABORT request even it is unnecessary as the previous DFU_UPLOAD request already reached the EOF. This patch proposes to finish the DFU uploading (don't go to dfuUPLOADIDLE) and completes the control-read operation (go to DFU_STATE_dfuIDLE) when the first UPLOAD response has a short frame as an end of file (EOF) indicator even if it is not explicitly allowed in the DFU specification but this seems logical. [1] https://www.usb.org/sites/default/files/DFU_1.1.pdf Signed-off-by: Patrick Delaunay

common: Drop log.h from common header

2020-05-19T01:19:18Z

Move this header out of the common header. Signed-off-by: Simon Glass

dfu: Reset timeout in case of DFU request

2020-03-01T20:58:54Z

In case dfu command is being executed with timeout option, the timer may expire in the middle of DFU operation. If there is DFU request coming, we may simple reset timeout value to prevent aborting of ongoing DFU operation. Signed-off-by: Andy Shevchenko Tested-by: Ferry Toth

env: Move env_get() to env.h

2019-08-11T20:43:41Z

Move env_get() over to the new header file. Acked-by: Joe Hershberger Signed-off-by: Simon Glass

usb: gadget: f_dfu.c: fix memory leak

2019-08-08T09:35:02Z

dfu_prepare_function() allocates N+1 descriptor header structures, the last one being the "DFU Functional Descriptor". dfu_unbind() handles de-allocation, but fails to free the final one (eg. "DFU Functional Descriptor"), leading to memory leak. Fixed by incrementing counter, as in dfu_prepare_function(). Signed-off-by: Ralph Siemsen