From 68ae882596524a2dde9da73283241b01d56375d5 Mon Sep 17 00:00:00 2001 From: Bo Shen Date: Mon, 15 Dec 2014 18:12:47 +0800 Subject: USB: gadget: atmel_usba_udc: fix transfer hang issue When receive data, the RXRDY in status register set by hardware after a new packet has been stored in the endpoint FIFO. After, we copy from FIFO, we clear it, make the FIFO can be accessed again. In the receive_data() function, this bit RXRDY has been cleared. So, after the receive_data() function return, this bit should not be cleared again, or else it will cause the accessing FIFO corrupt, which will make the data loss. Signed-off-by: Bo Shen --- drivers/usb/gadget/atmel_usba_udc.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers') diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c index 12628effe8b..fbc74f3bed8 100644 --- a/drivers/usb/gadget/atmel_usba_udc.c +++ b/drivers/usb/gadget/atmel_usba_udc.c @@ -1062,7 +1062,6 @@ static void usba_ep_irq(struct usba_udc *udc, struct usba_ep *ep) if ((epstatus & epctrl) & USBA_RX_BK_RDY) { DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name); receive_data(ep); - usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY); } } -- cgit v1.3.1 From fe1b28c9f0954047f20b20253596b5ca9aef4a32 Mon Sep 17 00:00:00 2001 From: Rob Herring Date: Wed, 10 Dec 2014 14:43:03 -0600 Subject: usb, g_dnl: generalize DFU detach functions In order to add detach functions for fastboot, make the DFU detach related functions common so they can be shared. Signed-off-by: Rob Herring Tested-by: Lukasz Majewski [TestHW: Exynos4412-Trats2] --- common/cmd_dfu.c | 6 +++--- drivers/dfu/dfu.c | 16 ---------------- drivers/usb/gadget/f_dfu.c | 2 +- drivers/usb/gadget/g_dnl.c | 17 +++++++++++++++++ include/dfu.h | 3 --- include/g_dnl.h | 4 ++++ 6 files changed, 25 insertions(+), 23 deletions(-) (limited to 'drivers') diff --git a/common/cmd_dfu.c b/common/cmd_dfu.c index 9e020b40be8..e975abebc9a 100644 --- a/common/cmd_dfu.c +++ b/common/cmd_dfu.c @@ -38,10 +38,10 @@ static int do_dfu(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) int controller_index = simple_strtoul(usb_controller, NULL, 0); board_usb_init(controller_index, USB_INIT_DEVICE); - dfu_clear_detach(); + g_dnl_clear_detach(); g_dnl_register("usb_dnl_dfu"); while (1) { - if (dfu_detach()) { + if (g_dnl_detach()) { /* * Check if USB bus reset is performed after detach, * which indicates that -R switch has been passed to @@ -74,7 +74,7 @@ done: if (dfu_reset) run_command("reset", 0); - dfu_clear_detach(); + g_dnl_clear_detach(); return ret; } diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index 14cb366b014..648f26105da 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -17,7 +17,6 @@ #include #include -static bool dfu_detach_request; static LIST_HEAD(dfu_list); static int dfu_alt_num; static int alt_num_cnt; @@ -39,21 +38,6 @@ __weak bool dfu_usb_get_reset(void) return true; } -bool dfu_detach(void) -{ - return dfu_detach_request; -} - -void dfu_trigger_detach(void) -{ - dfu_detach_request = true; -} - -void dfu_clear_detach(void) -{ - dfu_detach_request = false; -} - static int dfu_find_alt_num(const char *s) { int i = 0; diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c index 16fc9ddf82b..ead71eba6b1 100644 --- a/drivers/usb/gadget/f_dfu.c +++ b/drivers/usb/gadget/f_dfu.c @@ -366,7 +366,7 @@ static int state_dfu_idle(struct f_dfu *f_dfu, to_runtime_mode(f_dfu); f_dfu->dfu_state = DFU_STATE_appIDLE; - dfu_trigger_detach(); + g_dnl_trigger_detach(); break; default: f_dfu->dfu_state = DFU_STATE_dfuERROR; diff --git a/drivers/usb/gadget/g_dnl.c b/drivers/usb/gadget/g_dnl.c index 25611acd607..ee52a294679 100644 --- a/drivers/usb/gadget/g_dnl.c +++ b/drivers/usb/gadget/g_dnl.c @@ -163,6 +163,23 @@ __weak int g_dnl_board_usb_cable_connected(void) return -EOPNOTSUPP; } +static bool g_dnl_detach_request; + +bool g_dnl_detach(void) +{ + return g_dnl_detach_request; +} + +void g_dnl_trigger_detach(void) +{ + g_dnl_detach_request = true; +} + +void g_dnl_clear_detach(void) +{ + g_dnl_detach_request = false; +} + static int g_dnl_get_bcd_device_number(struct usb_composite_dev *cdev) { struct usb_gadget *gadget = cdev->gadget; diff --git a/include/dfu.h b/include/dfu.h index f1a71c79023..c27856cb729 100644 --- a/include/dfu.h +++ b/include/dfu.h @@ -150,9 +150,6 @@ struct dfu_entity *dfu_get_entity(int alt); char *dfu_extract_token(char** e, int *n); void dfu_trigger_reset(void); int dfu_get_alt(char *name); -bool dfu_detach(void); -void dfu_trigger_detach(void); -void dfu_clear_detach(void); int dfu_init_env_entities(char *interface, char *devstr); unsigned char *dfu_get_buf(struct dfu_entity *dfu); unsigned char *dfu_free_buf(void); diff --git a/include/g_dnl.h b/include/g_dnl.h index 1b1b35e0e1c..4eeb5e40702 100644 --- a/include/g_dnl.h +++ b/include/g_dnl.h @@ -39,4 +39,8 @@ int g_dnl_register(const char *s); void g_dnl_unregister(void); void g_dnl_set_serialnumber(char *); +bool g_dnl_detach(void); +void g_dnl_trigger_detach(void); +void g_dnl_clear_detach(void); + #endif /* __G_DOWNLOAD_H_ */ -- cgit v1.3.1 From 267abc626da609560aecab83e06b187954974ba6 Mon Sep 17 00:00:00 2001 From: Rob Herring Date: Wed, 10 Dec 2014 14:43:04 -0600 Subject: fastboot: add support for continue command The fastboot continue command is defined to exit fastboot and continue autoboot. This commit implements the continue command and the exiting of fastboot only. Subsequent u-boot commands can be processed after exiting fastboot. Autoboot should implement a boot script such as "fastboot; mmc read <...>; bootm" to fully implement the fastboot continue function. Signed-off-by: Rob Herring Tested-by: Lukasz Majewski [TestHW: Exynos4412-Trats2] --- common/cmd_fastboot.c | 4 ++++ drivers/usb/gadget/f_fastboot.c | 14 ++++++++++++++ 2 files changed, 18 insertions(+) (limited to 'drivers') diff --git a/common/cmd_fastboot.c b/common/cmd_fastboot.c index 909616dcb7f..b72f4f310d8 100644 --- a/common/cmd_fastboot.c +++ b/common/cmd_fastboot.c @@ -15,17 +15,21 @@ static int do_fastboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[]) { int ret; + g_dnl_clear_detach(); ret = g_dnl_register("usb_dnl_fastboot"); if (ret) return ret; while (1) { + if (g_dnl_detach()) + break; if (ctrlc()) break; usb_gadget_handle_interrupts(); } g_dnl_unregister(); + g_dnl_clear_detach(); return CMD_RET_SUCCESS; } diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c index 71b62e5005a..310175acfed 100644 --- a/drivers/usb/gadget/f_fastboot.c +++ b/drivers/usb/gadget/f_fastboot.c @@ -480,6 +480,17 @@ static void cb_boot(struct usb_ep *ep, struct usb_request *req) fastboot_tx_write_str("OKAY"); } +static void do_exit_on_complete(struct usb_ep *ep, struct usb_request *req) +{ + g_dnl_trigger_detach(); +} + +static void cb_continue(struct usb_ep *ep, struct usb_request *req) +{ + fastboot_func->in_req->complete = do_exit_on_complete; + fastboot_tx_write_str("OKAY"); +} + #ifdef CONFIG_FASTBOOT_FLASH static void cb_flash(struct usb_ep *ep, struct usb_request *req) { @@ -520,6 +531,9 @@ static const struct cmd_dispatch_info cmd_dispatch_info[] = { }, { .cmd = "boot", .cb = cb_boot, + }, { + .cmd = "continue", + .cb = cb_continue, }, #ifdef CONFIG_FASTBOOT_FLASH { -- cgit v1.3.1 From 7da6fa27168c468e58814d54fe3f66109036ec2e Mon Sep 17 00:00:00 2001 From: Przemyslaw Marczak Date: Mon, 15 Dec 2014 10:34:09 +0100 Subject: dfu: mmc: check if mmc device exists in mmc_block_op() The function mmc_block_op() is the last function before the physicall data write, but the mmc device pointer is not checked. If mmc device not exists, then data abort will occur. To avoid this, first the mmc device pointer is checked. Signed-off-by: Przemyslaw Marczak Tested-by: Lukasz Majewski [TestHW: Exynos4412-Trats2] --- drivers/dfu/dfu_mmc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/dfu/dfu_mmc.c b/drivers/dfu/dfu_mmc.c index 72fa03eedae..62d72fe4c69 100644 --- a/drivers/dfu/dfu_mmc.c +++ b/drivers/dfu/dfu_mmc.c @@ -40,10 +40,16 @@ static int mmc_access_part(struct dfu_entity *dfu, struct mmc *mmc, int part) static int mmc_block_op(enum dfu_op op, struct dfu_entity *dfu, u64 offset, void *buf, long *len) { - struct mmc *mmc = find_mmc_device(dfu->data.mmc.dev_num); + struct mmc *mmc; u32 blk_start, blk_count, n = 0; int ret, part_num_bkp = 0; + mmc = find_mmc_device(dfu->data.mmc.dev_num); + if (!mmc) { + error("Device MMC %d - not found!", dfu->data.mmc.dev_num); + return -ENODEV; + } + /* * We must ensure that we work in lba_blk_size chunks, so ALIGN * this value. -- cgit v1.3.1 From 62a96d805f6f212250f5590d6afadf3645837f36 Mon Sep 17 00:00:00 2001 From: Przemyslaw Marczak Date: Mon, 15 Dec 2014 10:34:10 +0100 Subject: gadget: f_thor: check pointers before use in download_tail() Some pointers in function download_tail() were not checked before the use. This could possibly cause the data abort. To avoid this, check if the pointers are not null is added. Signed-off-by: Przemyslaw Marczak Tested-by: Lukasz Majewski [TestHW: Exynos4412-Trats2] --- drivers/usb/gadget/f_thor.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/usb/gadget/f_thor.c b/drivers/usb/gadget/f_thor.c index 78519fa41ff..2d0410d7956 100644 --- a/drivers/usb/gadget/f_thor.c +++ b/drivers/usb/gadget/f_thor.c @@ -205,12 +205,24 @@ static long long int download_head(unsigned long long total, static int download_tail(long long int left, int cnt) { - struct dfu_entity *dfu_entity = dfu_get_entity(alt_setting_num); - void *transfer_buffer = dfu_get_buf(dfu_entity); + struct dfu_entity *dfu_entity; + void *transfer_buffer; int ret; debug("%s: left: %llu cnt: %d\n", __func__, left, cnt); + dfu_entity = dfu_get_entity(alt_setting_num); + if (!dfu_entity) { + error("Alt setting: %d entity not found!\n", alt_setting_num); + return -ENOENT; + } + + transfer_buffer = dfu_get_buf(dfu_entity); + if (!transfer_buffer) { + error("Transfer buffer not allocated!"); + return -ENXIO; + } + if (left) { ret = dfu_write(dfu_entity, transfer_buffer, left, cnt++); if (ret) { -- cgit v1.3.1 From f597fc3d4c4f73d45670649d6f3e678934139c25 Mon Sep 17 00:00:00 2001 From: Przemyslaw Marczak Date: Mon, 15 Dec 2014 10:34:11 +0100 Subject: dfu: dfu_get_buf: check the value of env dfu_bufsiz before use In function dfu_get_buf(), the size of allocated buffer could be defined by the env variable. The size from this variable was passed for memalign() without checking its value. And the the memalign will return non null pointer for size 0. This could possibly cause data abort, so now the value of var is checked before use. And if this variable is set to 0 then the default size will be used. This commit also changes the base passed to simple_strtoul() to 0. Now decimal and hex values can be used for the variable dfu_bufsiz. Signed-off-by: Przemyslaw Marczak Tested-by: Lukasz Majewski [TestHW: Exynos4412-Trats2] --- drivers/dfu/dfu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index 648f26105da..ad0a7e7c25f 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -95,8 +95,12 @@ unsigned char *dfu_get_buf(struct dfu_entity *dfu) return dfu_buf; s = getenv("dfu_bufsiz"); - dfu_buf_size = s ? (unsigned long)simple_strtol(s, NULL, 16) : - CONFIG_SYS_DFU_DATA_BUF_SIZE; + if (s) + dfu_buf_size = (unsigned long)simple_strtol(s, NULL, 0); + + if (!s || !dfu_buf_size) + dfu_buf_size = CONFIG_SYS_DFU_DATA_BUF_SIZE; + if (dfu->max_buf_size && dfu_buf_size > dfu->max_buf_size) dfu_buf_size = dfu->max_buf_size; -- cgit v1.3.1