drivers/usb/gadget/f_sdp.c

   1 /*
   2  * f_sdp.c -- USB HID Serial Download Protocol
   3  *
   4  * Copyright (C) 2017 Toradex
   5  * Author: Stefan Agner <stefan.agner@toradex.com>
   6  *
   7  * This file implements the Serial Download Protocol (SDP) as specified in
   8  * the i.MX 6 Reference Manual. The SDP is a USB HID based protocol and
   9  * allows to download images directly to memory. The implementation
  10  * works with the imx_loader (imx_usb) USB client software on host side.
  11  *
  12  * Not all commands are implemented, e.g. WRITE_REGISTER, DCD_WRITE and
  13  * SKIP_DCD_HEADER are only stubs.
  14  *
  15  * Parts of the implementation are based on f_dfu and f_thor.
  16  *
  17  * SPDX-License-Identifier:     GPL-2.0+
  18  */
  19
  20 #include <errno.h>
  21 #include <common.h>
  22 #include <console.h>
  23 #include <malloc.h>
  24
  25 #include <linux/usb/ch9.h>
  26 #include <linux/usb/gadget.h>
  27 #include <linux/usb/composite.h>
  28
  29 #include <asm/io.h>
  30 #include <g_dnl.h>
  31 #include <sdp.h>
  32 #include <spl.h>
  33 #include <image.h>
  34 #include <imximage.h>
  35 #include <watchdog.h>
  36
  37 #define HID_REPORT_ID_MASK      0x000000ff
  38
  39 /*
  40  * HID class requests
  41  */
  42 #define HID_REQ_GET_REPORT              0x01
  43 #define HID_REQ_GET_IDLE                0x02
  44 #define HID_REQ_GET_PROTOCOL            0x03
  45 #define HID_REQ_SET_REPORT              0x09
  46 #define HID_REQ_SET_IDLE                0x0A
  47 #define HID_REQ_SET_PROTOCOL            0x0B
  48
  49 #define HID_USAGE_PAGE_LEN              76
  50
  51 struct hid_report {
  52         u8 usage_page[HID_USAGE_PAGE_LEN];
  53 } __packed;
  54
  55 #define SDP_READ_REGISTER       0x0101
  56 #define SDP_WRITE_REGISTER      0x0202
  57 #define SDP_WRITE_FILE          0x0404
  58 #define SDP_ERROR_STATUS        0x0505
  59 #define SDP_DCD_WRITE           0x0a0a
  60 #define SDP_JUMP_ADDRESS        0x0b0b
  61 #define SDP_SKIP_DCD_HEADER     0x0c0c
  62
  63 #define SDP_SECURITY_CLOSED             0x12343412
  64 #define SDP_SECURITY_OPEN               0x56787856
  65
  66 #define SDP_WRITE_FILE_COMPLETE         0x88888888
  67 #define SDP_WRITE_REGISTER_COMPLETE     0x128A8A12
  68 #define SDP_SKIP_DCD_HEADER_COMPLETE    0x900DD009
  69 #define SDP_ERROR_IMXHEADER             0x000a0533
  70
  71 #define SDP_COMMAND_LEN         16
  72
  73 struct sdp_command {
  74         u16 cmd;
  75         u32 addr;
  76         u8 format;
  77         u32 cnt;
  78         u32 data;
  79         u8 rsvd;
  80 } __packed;
  81
  82 enum sdp_state {
  83         SDP_STATE_IDLE,
  84         SDP_STATE_RX_DCD_DATA,
  85         SDP_STATE_RX_FILE_DATA,
  86         SDP_STATE_TX_SEC_CONF,
  87         SDP_STATE_TX_SEC_CONF_BUSY,
  88         SDP_STATE_TX_REGISTER,
  89         SDP_STATE_TX_REGISTER_BUSY,
  90         SDP_STATE_TX_STATUS,
  91         SDP_STATE_TX_STATUS_BUSY,
  92         SDP_STATE_JUMP,
  93 };
  94
  95 struct f_sdp {
  96         struct usb_function             usb_function;
  97
  98         struct usb_descriptor_header    **function;
  99
 100         u8                              altsetting;
 101         enum sdp_state                  state;
 102         enum sdp_state                  next_state;
 103         u32                             dnl_address;
 104         u32                             dnl_bytes_remaining;
 105         u32                             jmp_address;
 106         bool                            always_send_status;
 107         u32                             error_status;
 108
 109         /* EP0 request */
 110         struct usb_request              *req;
 111
 112         /* EP1 IN */
 113         struct usb_ep                   *in_ep;
 114         struct usb_request              *in_req;
 115
 116         bool                            configuration_done;
 117 };
 118
 119 static struct f_sdp *sdp_func;
 120
 121 static inline struct f_sdp *func_to_sdp(struct usb_function *f)
 122 {
 123         return container_of(f, struct f_sdp, usb_function);
 124 }
 125
 126 static struct usb_interface_descriptor sdp_intf_runtime = {
 127         .bLength =              sizeof(sdp_intf_runtime),
 128         .bDescriptorType =      USB_DT_INTERFACE,
 129         .bAlternateSetting =    0,
 130         .bNumEndpoints =        1,
 131         .bInterfaceClass =      USB_CLASS_HID,
 132         .bInterfaceSubClass =   0,
 133         .bInterfaceProtocol =   0,
 134         /* .iInterface = DYNAMIC */
 135 };
 136
 137 /* HID configuration */
 138 static struct usb_class_hid_descriptor sdp_hid_desc = {
 139         .bLength =              sizeof(sdp_hid_desc),
 140         .bDescriptorType =      USB_DT_CS_DEVICE,
 141
 142         .bcdCDC =               __constant_cpu_to_le16(0x0110),
 143         .bCountryCode =         0,
 144         .bNumDescriptors =      1,
 145
 146         .bDescriptorType0       = USB_DT_HID_REPORT,
 147         .wDescriptorLength0     = HID_USAGE_PAGE_LEN,
 148 };
 149
 150 static struct usb_endpoint_descriptor in_desc = {
 151         .bLength =              USB_DT_ENDPOINT_SIZE,
 152         .bDescriptorType =      USB_DT_ENDPOINT, /*USB_DT_CS_ENDPOINT*/
 153
 154         .bEndpointAddress =     1 | USB_DIR_IN,
 155         .bmAttributes = USB_ENDPOINT_XFER_INT,
 156         .wMaxPacketSize =       64,
 157         .bInterval =            1,
 158 };
 159
 160 static struct usb_descriptor_header *sdp_runtime_descs[] = {
 161         (struct usb_descriptor_header *)&sdp_intf_runtime,
 162         (struct usb_descriptor_header *)&sdp_hid_desc,
 163         (struct usb_descriptor_header *)&in_desc,
 164         NULL,
 165 };
 166
 167 /* This is synchronized with what the SoC implementation reports */
 168 static struct hid_report sdp_hid_report = {
 169         .usage_page = {
 170                 0x06, 0x00, 0xff, /* Usage Page */
 171                 0x09, 0x01, /* Usage (Pointer?) */
 172                 0xa1, 0x01, /* Collection */
 173
 174                 0x85, 0x01, /* Report ID */
 175                 0x19, 0x01, /* Usage Minimum */
 176                 0x29, 0x01, /* Usage Maximum */
 177                 0x15, 0x00, /* Local Minimum */
 178                 0x26, 0xFF, 0x00, /* Local Maximum? */
 179                 0x75, 0x08, /* Report Size */
 180                 0x95, 0x10, /* Report Count */
 181                 0x91, 0x02, /* Output Data */
 182
 183                 0x85, 0x02, /* Report ID */
 184                 0x19, 0x01, /* Usage Minimum */
 185                 0x29, 0x01, /* Usage Maximum */
 186                 0x15, 0x00, /* Local Minimum */
 187                 0x26, 0xFF, 0x00, /* Local Maximum? */
 188                 0x75, 0x80, /* Report Size 128 */
 189                 0x95, 0x40, /* Report Count */
 190                 0x91, 0x02, /* Output Data */
 191
 192                 0x85, 0x03, /* Report ID */
 193                 0x19, 0x01, /* Usage Minimum */
 194                 0x29, 0x01, /* Usage Maximum */
 195                 0x15, 0x00, /* Local Minimum */
 196                 0x26, 0xFF, 0x00, /* Local Maximum? */
 197                 0x75, 0x08, /* Report Size 8 */
 198                 0x95, 0x04, /* Report Count */
 199                 0x81, 0x02, /* Input Data */
 200
 201                 0x85, 0x04, /* Report ID */
 202                 0x19, 0x01, /* Usage Minimum */
 203                 0x29, 0x01, /* Usage Maximum */
 204                 0x15, 0x00, /* Local Minimum */
 205                 0x26, 0xFF, 0x00, /* Local Maximum? */
 206                 0x75, 0x08, /* Report Size 8 */
 207                 0x95, 0x40, /* Report Count */
 208                 0x81, 0x02, /* Input Data */
 209                 0xc0
 210         },
 211 };
 212
 213 static const char sdp_name[] = "Serial Downloader Protocol";
 214
 215 /*
 216  * static strings, in UTF-8
 217  */
 218 static struct usb_string strings_sdp_generic[] = {
 219         [0].s = sdp_name,
 220         {  }                    /* end of list */
 221 };
 222
 223 static struct usb_gadget_strings stringtab_sdp_generic = {
 224         .language       = 0x0409,       /* en-us */
 225         .strings        = strings_sdp_generic,
 226 };
 227
 228 static struct usb_gadget_strings *sdp_generic_strings[] = {
 229         &stringtab_sdp_generic,
 230         NULL,
 231 };
 232
 233 static inline void *sdp_ptr(u32 val)
 234 {
 235         return (void *)(uintptr_t)val;
 236 }
 237
 238 static void sdp_rx_command_complete(struct usb_ep *ep, struct usb_request *req)
 239 {
 240         struct f_sdp *sdp = req->context;
 241         int status = req->status;
 242         u8 *data = req->buf;
 243         u8 report = data[0];
 244
 245         if (status != 0) {
 246                 pr_err("Status: %d\n", status);
 247                 return;
 248         }
 249
 250         if (report != 1) {
 251                 pr_err("Unexpected report %d\n", report);
 252                 return;
 253         }
 254
 255         struct sdp_command *cmd = req->buf + 1;
 256
 257         debug("%s: command: %04x, addr: %08x, cnt: %u\n",
 258               __func__, be16_to_cpu(cmd->cmd),
 259               be32_to_cpu(cmd->addr), be32_to_cpu(cmd->cnt));
 260
 261         switch (be16_to_cpu(cmd->cmd)) {
 262         case SDP_READ_REGISTER:
 263                 sdp->always_send_status = false;
 264                 sdp->error_status = 0x0;
 265
 266                 sdp->state = SDP_STATE_TX_SEC_CONF;
 267                 sdp->dnl_address = be32_to_cpu(cmd->addr);
 268                 sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
 269                 sdp->next_state = SDP_STATE_TX_REGISTER;
 270                 printf("Reading %d registers at 0x%08x... ",
 271                        sdp->dnl_bytes_remaining, sdp->dnl_address);
 272                 break;
 273         case SDP_WRITE_FILE:
 274                 sdp->always_send_status = true;
 275                 sdp->error_status = SDP_WRITE_FILE_COMPLETE;
 276
 277                 sdp->state = SDP_STATE_RX_FILE_DATA;
 278                 sdp->dnl_address = be32_to_cpu(cmd->addr);
 279                 sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
 280                 sdp->next_state = SDP_STATE_IDLE;
 281
 282                 printf("Downloading file of size %d to 0x%08x... ",
 283                        sdp->dnl_bytes_remaining, sdp->dnl_address);
 284
 285                 break;
 286         case SDP_ERROR_STATUS:
 287                 sdp->always_send_status = true;
 288                 sdp->error_status = 0;
 289
 290                 sdp->state = SDP_STATE_TX_SEC_CONF;
 291                 sdp->next_state = SDP_STATE_IDLE;
 292                 break;
 293         case SDP_DCD_WRITE:
 294                 sdp->always_send_status = true;
 295                 sdp->error_status = SDP_WRITE_REGISTER_COMPLETE;
 296
 297                 sdp->state = SDP_STATE_RX_DCD_DATA;
 298                 sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
 299                 sdp->next_state = SDP_STATE_IDLE;
 300                 break;
 301         case SDP_JUMP_ADDRESS:
 302                 sdp->always_send_status = false;
 303                 sdp->error_status = 0;
 304
 305                 sdp->jmp_address = be32_to_cpu(cmd->addr);
 306                 sdp->state = SDP_STATE_TX_SEC_CONF;
 307                 sdp->next_state = SDP_STATE_JUMP;
 308                 break;
 309         case SDP_SKIP_DCD_HEADER:
 310                 sdp->always_send_status = true;
 311                 sdp->error_status = SDP_SKIP_DCD_HEADER_COMPLETE;
 312
 313                 /* Ignore command, DCD not supported anyway */
 314                 sdp->state = SDP_STATE_TX_SEC_CONF;
 315                 sdp->next_state = SDP_STATE_IDLE;
 316                 break;
 317         default:
 318                 pr_err("Unknown command: %04x\n", be16_to_cpu(cmd->cmd));
 319         }
 320 }
 321
 322 static void sdp_rx_data_complete(struct usb_ep *ep, struct usb_request *req)
 323 {
 324         struct f_sdp *sdp = req->context;
 325         int status = req->status;
 326         u8 *data = req->buf;
 327         u8 report = data[0];
 328         int datalen = req->length - 1;
 329
 330         if (status != 0) {
 331                 pr_err("Status: %d\n", status);
 332                 return;
 333         }
 334
 335         if (report != 2) {
 336                 pr_err("Unexpected report %d\n", report);
 337                 return;
 338         }
 339
 340         if (sdp->dnl_bytes_remaining < datalen) {
 341                 /*
 342                  * Some USB stacks require to send a complete buffer as
 343                  * specified in the HID descriptor. This leads to longer
 344                  * transfers than the file length, no problem for us.
 345                  */
 346                 sdp->dnl_bytes_remaining = 0;
 347         } else {
 348                 sdp->dnl_bytes_remaining -= datalen;
 349         }
 350
 351         if (sdp->state == SDP_STATE_RX_FILE_DATA) {
 352                 memcpy(sdp_ptr(sdp->dnl_address), req->buf + 1, datalen);
 353                 sdp->dnl_address += datalen;
 354         }
 355
 356         if (sdp->dnl_bytes_remaining)
 357                 return;
 358
 359         printf("done\n");
 360
 361         switch (sdp->state) {
 362         case SDP_STATE_RX_FILE_DATA:
 363                 sdp->state = SDP_STATE_TX_SEC_CONF;
 364                 break;
 365         case SDP_STATE_RX_DCD_DATA:
 366                 sdp->state = SDP_STATE_TX_SEC_CONF;
 367                 break;
 368         default:
 369                 pr_err("Invalid state: %d\n", sdp->state);
 370         }
 371 }
 372
 373 static void sdp_tx_complete(struct usb_ep *ep, struct usb_request *req)
 374 {
 375         struct f_sdp *sdp = req->context;
 376         int status = req->status;
 377
 378         if (status != 0) {
 379                 pr_err("Status: %d\n", status);
 380                 return;
 381         }
 382
 383         switch (sdp->state) {
 384         case SDP_STATE_TX_SEC_CONF_BUSY:
 385                 /* Not all commands require status report */
 386                 if (sdp->always_send_status || sdp->error_status)
 387                         sdp->state = SDP_STATE_TX_STATUS;
 388                 else
 389                         sdp->state = sdp->next_state;
 390
 391                 break;
 392         case SDP_STATE_TX_STATUS_BUSY:
 393                 sdp->state = sdp->next_state;
 394                 break;
 395         case SDP_STATE_TX_REGISTER_BUSY:
 396                 if (sdp->dnl_bytes_remaining)
 397                         sdp->state = SDP_STATE_TX_REGISTER;
 398                 else
 399                         sdp->state = SDP_STATE_IDLE;
 400                 break;
 401         default:
 402                 pr_err("Wrong State: %d\n", sdp->state);
 403                 sdp->state = SDP_STATE_IDLE;
 404                 break;
 405         }
 406         debug("%s complete --> %d, %d/%d\n", ep->name,
 407               status, req->actual, req->length);
 408 }
 409
 410 static int sdp_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 411 {
 412         struct usb_gadget *gadget = f->config->cdev->gadget;
 413         struct usb_request *req = f->config->cdev->req;
 414         struct f_sdp *sdp = f->config->cdev->req->context;
 415         u16 len = le16_to_cpu(ctrl->wLength);
 416         u16 w_value = le16_to_cpu(ctrl->wValue);
 417         int value = 0;
 418         u8 req_type = ctrl->bRequestType & USB_TYPE_MASK;
 419
 420         debug("w_value: 0x%04x len: 0x%04x\n", w_value, len);
 421         debug("req_type: 0x%02x ctrl->bRequest: 0x%02x sdp->state: %d\n",
 422               req_type, ctrl->bRequest, sdp->state);
 423
 424         if (req_type == USB_TYPE_STANDARD) {
 425                 if (ctrl->bRequest == USB_REQ_GET_DESCRIPTOR) {
 426                         /* Send HID report descriptor */
 427                         value = min(len, (u16) sizeof(sdp_hid_report));
 428                         memcpy(req->buf, &sdp_hid_report, value);
 429                         sdp->configuration_done = true;
 430                 }
 431         }
 432
 433         if (req_type == USB_TYPE_CLASS) {
 434                 int report = w_value & HID_REPORT_ID_MASK;
 435
 436                 /* HID (SDP) request */
 437                 switch (ctrl->bRequest) {
 438                 case HID_REQ_SET_REPORT:
 439                         switch (report) {
 440                         case 1:
 441                                 value = SDP_COMMAND_LEN + 1;
 442                                 req->complete = sdp_rx_command_complete;
 443                                 break;
 444                         case 2:
 445                                 value = len;
 446                                 req->complete = sdp_rx_data_complete;
 447                                 break;
 448                         }
 449                 }
 450         }
 451
 452         if (value >= 0) {
 453                 req->length = value;
 454                 req->zero = value < len;
 455                 value = usb_ep_queue(gadget->ep0, req, 0);
 456                 if (value < 0) {
 457                         debug("ep_queue --> %d\n", value);
 458                         req->status = 0;
 459                 }
 460         }
 461
 462         return value;
 463 }
 464
 465 static int sdp_bind(struct usb_configuration *c, struct usb_function *f)
 466 {
 467         struct usb_gadget *gadget = c->cdev->gadget;
 468         struct usb_composite_dev *cdev = c->cdev;
 469         struct f_sdp *sdp = func_to_sdp(f);
 470         int rv = 0, id;
 471
 472         id = usb_interface_id(c, f);
 473         if (id < 0)
 474                 return id;
 475         sdp_intf_runtime.bInterfaceNumber = id;
 476
 477         struct usb_ep *ep;
 478
 479         /* allocate instance-specific endpoints */
 480         ep = usb_ep_autoconfig(gadget, &in_desc);
 481         if (!ep) {
 482                 rv = -ENODEV;
 483                 goto error;
 484         }
 485
 486         sdp->in_ep = ep; /* Store IN EP for enabling @ setup */
 487
 488         cdev->req->context = sdp;
 489
 490 error:
 491         return rv;
 492 }
 493
 494 static void sdp_unbind(struct usb_configuration *c, struct usb_function *f)
 495 {
 496         free(sdp_func);
 497         sdp_func = NULL;
 498 }
 499
 500 static struct usb_request *alloc_ep_req(struct usb_ep *ep, unsigned length)
 501 {
 502         struct usb_request *req;
 503
 504         req = usb_ep_alloc_request(ep, 0);
 505         if (!req)
 506                 return req;
 507
 508         req->length = length;
 509         req->buf = memalign(CONFIG_SYS_CACHELINE_SIZE, length);
 510         if (!req->buf) {
 511                 usb_ep_free_request(ep, req);
 512                 req = NULL;
 513         }
 514
 515         return req;
 516 }
 517
 518
 519 static struct usb_request *sdp_start_ep(struct usb_ep *ep)
 520 {
 521         struct usb_request *req;
 522
 523         req = alloc_ep_req(ep, 64);
 524         debug("%s: ep:%p req:%p\n", __func__, ep, req);
 525
 526         if (!req)
 527                 return NULL;
 528
 529         memset(req->buf, 0, req->length);
 530         req->complete = sdp_tx_complete;
 531
 532         return req;
 533 }
 534 static int sdp_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 535 {
 536         struct f_sdp *sdp = func_to_sdp(f);
 537         struct usb_composite_dev *cdev = f->config->cdev;
 538         int result;
 539
 540         debug("%s: intf: %d alt: %d\n", __func__, intf, alt);
 541
 542         result = usb_ep_enable(sdp->in_ep, &in_desc);
 543         if (result)
 544                 return result;
 545         sdp->in_req = sdp_start_ep(sdp->in_ep);
 546         sdp->in_req->context = sdp;
 547
 548         sdp->in_ep->driver_data = cdev; /* claim */
 549
 550         sdp->altsetting = alt;
 551         sdp->state = SDP_STATE_IDLE;
 552
 553         return 0;
 554 }
 555
 556 static int sdp_get_alt(struct usb_function *f, unsigned intf)
 557 {
 558         struct f_sdp *sdp = func_to_sdp(f);
 559
 560         return sdp->altsetting;
 561 }
 562
 563 static void sdp_disable(struct usb_function *f)
 564 {
 565         struct f_sdp *sdp = func_to_sdp(f);
 566
 567         usb_ep_disable(sdp->in_ep);
 568
 569         if (sdp->in_req) {
 570                 free(sdp->in_req);
 571                 sdp->in_req = NULL;
 572         }
 573 }
 574
 575 static int sdp_bind_config(struct usb_configuration *c)
 576 {
 577         int status;
 578
 579         if (!sdp_func) {
 580                 sdp_func = memalign(CONFIG_SYS_CACHELINE_SIZE, sizeof(*sdp_func));
 581                 if (!sdp_func)
 582                         return -ENOMEM;
 583         }
 584
 585         memset(sdp_func, 0, sizeof(*sdp_func));
 586
 587         sdp_func->usb_function.name = "sdp";
 588         sdp_func->usb_function.hs_descriptors = sdp_runtime_descs;
 589         sdp_func->usb_function.descriptors = sdp_runtime_descs;
 590         sdp_func->usb_function.bind = sdp_bind;
 591         sdp_func->usb_function.unbind = sdp_unbind;
 592         sdp_func->usb_function.set_alt = sdp_set_alt;
 593         sdp_func->usb_function.get_alt = sdp_get_alt;
 594         sdp_func->usb_function.disable = sdp_disable;
 595         sdp_func->usb_function.strings = sdp_generic_strings;
 596         sdp_func->usb_function.setup = sdp_setup;
 597
 598         status = usb_add_function(c, &sdp_func->usb_function);
 599
 600         return status;
 601 }
 602
 603 int sdp_init(int controller_index)
 604 {
 605         printf("SDP: initialize...\n");
 606         while (!sdp_func->configuration_done) {
 607                 if (ctrlc()) {
 608                         puts("\rCTRL+C - Operation aborted.\n");
 609                         return 1;
 610                 }
 611
 612                 WATCHDOG_RESET();
 613                 usb_gadget_handle_interrupts(controller_index);
 614         }
 615
 616         return 0;
 617 }
 618
 619 static u32 sdp_jump_imxheader(void *address)
 620 {
 621         flash_header_v2_t *headerv2 = address;
 622         ulong (*entry)(void);
 623
 624         if (headerv2->header.tag != IVT_HEADER_TAG) {
 625                 printf("Header Tag is not an IMX image\n");
 626                 return SDP_ERROR_IMXHEADER;
 627         }
 628
 629         printf("Jumping to 0x%08x\n", headerv2->entry);
 630         entry = sdp_ptr(headerv2->entry);
 631         entry();
 632
 633         /* The image probably never returns hence we won't reach that point */
 634         return 0;
 635 }
 636
 637 static void sdp_handle_in_ep(void)
 638 {
 639         u8 *data = sdp_func->in_req->buf;
 640         u32 status;
 641         int datalen;
 642
 643         switch (sdp_func->state) {
 644         case SDP_STATE_TX_SEC_CONF:
 645                 debug("Report 3: HAB security\n");
 646                 data[0] = 3;
 647
 648                 status = SDP_SECURITY_OPEN;
 649                 memcpy(&data[1], &status, 4);
 650                 sdp_func->in_req->length = 5;
 651                 usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
 652                 sdp_func->state = SDP_STATE_TX_SEC_CONF_BUSY;
 653                 break;
 654
 655         case SDP_STATE_TX_STATUS:
 656                 debug("Report 4: Status\n");
 657                 data[0] = 4;
 658
 659                 memcpy(&data[1], &sdp_func->error_status, 4);
 660                 sdp_func->in_req->length = 65;
 661                 usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
 662                 sdp_func->state = SDP_STATE_TX_STATUS_BUSY;
 663                 break;
 664         case SDP_STATE_TX_REGISTER:
 665                 debug("Report 4: Register Values\n");
 666                 data[0] = 4;
 667
 668                 datalen = sdp_func->dnl_bytes_remaining;
 669
 670                 if (datalen > 64)
 671                         datalen = 64;
 672
 673                 memcpy(&data[1], sdp_ptr(sdp_func->dnl_address), datalen);
 674                 sdp_func->in_req->length = 65;
 675
 676                 sdp_func->dnl_bytes_remaining -= datalen;
 677                 sdp_func->dnl_address += datalen;
 678
 679                 usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
 680                 sdp_func->state = SDP_STATE_TX_REGISTER_BUSY;
 681                 break;
 682         case SDP_STATE_JUMP:
 683                 printf("Jumping to header at 0x%08x\n", sdp_func->jmp_address);
 684                 status = sdp_jump_imxheader(sdp_ptr(sdp_func->jmp_address));
 685
 686                 /* If imx header fails, try some U-Boot specific headers */
 687                 if (status) {
 688 #ifdef CONFIG_SPL_BUILD
 689                         /* In SPL, allow jumps to U-Boot images */
 690                         struct spl_image_info spl_image = {};
 691                         spl_parse_image_header(&spl_image,
 692                                 (struct image_header *)sdp_func->jmp_address);
 693                         jump_to_image_no_args(&spl_image);
 694 #else
 695                         /* In U-Boot, allow jumps to scripts */
 696                         source(sdp_func->jmp_address, "script@1");
 697 #endif
 698                 }
 699
 700                 sdp_func->next_state = SDP_STATE_IDLE;
 701                 sdp_func->error_status = status;
 702
 703                 /* Only send Report 4 if there was an error */
 704                 if (status)
 705                         sdp_func->state = SDP_STATE_TX_STATUS;
 706                 else
 707                         sdp_func->state = SDP_STATE_IDLE;
 708                 break;
 709         default:
 710                 break;
 711         };
 712 }
 713
 714 void sdp_handle(int controller_index)
 715 {
 716         printf("SDP: handle requests...\n");
 717         while (1) {
 718                 if (ctrlc()) {
 719                         puts("\rCTRL+C - Operation aborted.\n");
 720                         return;
 721                 }
 722
 723                 WATCHDOG_RESET();
 724                 usb_gadget_handle_interrupts(controller_index);
 725
 726                 sdp_handle_in_ep();
 727         }
 728 }
 729
 730 int sdp_add(struct usb_configuration *c)
 731 {
 732         int id;
 733
 734         id = usb_string_id(c->cdev);
 735         if (id < 0)
 736                 return id;
 737         strings_sdp_generic[0].id = id;
 738         sdp_intf_runtime.iInterface = id;
 739
 740         debug("%s: cdev: %p gadget: %p gadget->ep0: %p\n", __func__,
 741               c->cdev, c->cdev->gadget, c->cdev->gadget->ep0);
 742
 743         return sdp_bind_config(c);
 744 }
 745
 746 DECLARE_GADGET_BIND_CALLBACK(usb_dnl_sdp, sdp_add);