xref: /openbmc/u-boot/drivers/usb/gadget/f_sdp.c (revision 9c0e2f6e)
1 /*
2  * f_sdp.c -- USB HID Serial Download Protocol
3  *
4  * Copyright (C) 2017 Toradex
5  * Author: Stefan Agner <stefan.agner@toradex.com>
6  *
7  * This file implements the Serial Download Protocol (SDP) as specified in
8  * the i.MX 6 Reference Manual. The SDP is a USB HID based protocol and
9  * allows to download images directly to memory. The implementation
10  * works with the imx_loader (imx_usb) USB client software on host side.
11  *
12  * Not all commands are implemented, e.g. WRITE_REGISTER, DCD_WRITE and
13  * SKIP_DCD_HEADER are only stubs.
14  *
15  * Parts of the implementation are based on f_dfu and f_thor.
16  *
17  * SPDX-License-Identifier:	GPL-2.0+
18  */
19 
20 #include <errno.h>
21 #include <common.h>
22 #include <console.h>
23 #include <malloc.h>
24 
25 #include <linux/usb/ch9.h>
26 #include <linux/usb/gadget.h>
27 #include <linux/usb/composite.h>
28 
29 #include <asm/io.h>
30 #include <g_dnl.h>
31 #include <sdp.h>
32 #include <spl.h>
33 #include <image.h>
34 #include <imximage.h>
35 #include <watchdog.h>
36 
37 #define HID_REPORT_ID_MASK	0x000000ff
38 
39 /*
40  * HID class requests
41  */
42 #define HID_REQ_GET_REPORT		0x01
43 #define HID_REQ_GET_IDLE		0x02
44 #define HID_REQ_GET_PROTOCOL		0x03
45 #define HID_REQ_SET_REPORT		0x09
46 #define HID_REQ_SET_IDLE		0x0A
47 #define HID_REQ_SET_PROTOCOL		0x0B
48 
49 #define HID_USAGE_PAGE_LEN		76
50 
51 struct hid_report {
52 	u8 usage_page[HID_USAGE_PAGE_LEN];
53 } __packed;
54 
55 #define SDP_READ_REGISTER	0x0101
56 #define SDP_WRITE_REGISTER	0x0202
57 #define SDP_WRITE_FILE		0x0404
58 #define SDP_ERROR_STATUS	0x0505
59 #define SDP_DCD_WRITE		0x0a0a
60 #define SDP_JUMP_ADDRESS	0x0b0b
61 #define SDP_SKIP_DCD_HEADER	0x0c0c
62 
63 #define SDP_SECURITY_CLOSED		0x12343412
64 #define SDP_SECURITY_OPEN		0x56787856
65 
66 #define SDP_WRITE_FILE_COMPLETE		0x88888888
67 #define SDP_WRITE_REGISTER_COMPLETE	0x128A8A12
68 #define SDP_SKIP_DCD_HEADER_COMPLETE	0x900DD009
69 #define SDP_ERROR_IMXHEADER		0x000a0533
70 
71 #define SDP_COMMAND_LEN		16
72 
73 struct sdp_command {
74 	u16 cmd;
75 	u32 addr;
76 	u8 format;
77 	u32 cnt;
78 	u32 data;
79 	u8 rsvd;
80 } __packed;
81 
82 enum sdp_state {
83 	SDP_STATE_IDLE,
84 	SDP_STATE_RX_DCD_DATA,
85 	SDP_STATE_RX_FILE_DATA,
86 	SDP_STATE_TX_SEC_CONF,
87 	SDP_STATE_TX_SEC_CONF_BUSY,
88 	SDP_STATE_TX_REGISTER,
89 	SDP_STATE_TX_REGISTER_BUSY,
90 	SDP_STATE_TX_STATUS,
91 	SDP_STATE_TX_STATUS_BUSY,
92 	SDP_STATE_JUMP,
93 };
94 
95 struct f_sdp {
96 	struct usb_function		usb_function;
97 
98 	struct usb_descriptor_header	**function;
99 
100 	u8				altsetting;
101 	enum sdp_state			state;
102 	enum sdp_state			next_state;
103 	u32				dnl_address;
104 	u32				dnl_bytes_remaining;
105 	u32				jmp_address;
106 	bool				always_send_status;
107 	u32				error_status;
108 
109 	/* EP0 request */
110 	struct usb_request		*req;
111 
112 	/* EP1 IN */
113 	struct usb_ep			*in_ep;
114 	struct usb_request		*in_req;
115 
116 	bool				configuration_done;
117 };
118 
119 static struct f_sdp *sdp_func;
120 
121 static inline struct f_sdp *func_to_sdp(struct usb_function *f)
122 {
123 	return container_of(f, struct f_sdp, usb_function);
124 }
125 
126 static struct usb_interface_descriptor sdp_intf_runtime = {
127 	.bLength =		sizeof(sdp_intf_runtime),
128 	.bDescriptorType =	USB_DT_INTERFACE,
129 	.bAlternateSetting =	0,
130 	.bNumEndpoints =	1,
131 	.bInterfaceClass =	USB_CLASS_HID,
132 	.bInterfaceSubClass =	0,
133 	.bInterfaceProtocol =	0,
134 	/* .iInterface = DYNAMIC */
135 };
136 
137 /* HID configuration */
138 static struct usb_class_hid_descriptor sdp_hid_desc = {
139 	.bLength =		sizeof(sdp_hid_desc),
140 	.bDescriptorType =	USB_DT_CS_DEVICE,
141 
142 	.bcdCDC =		__constant_cpu_to_le16(0x0110),
143 	.bCountryCode =		0,
144 	.bNumDescriptors =	1,
145 
146 	.bDescriptorType0	= USB_DT_HID_REPORT,
147 	.wDescriptorLength0	= HID_USAGE_PAGE_LEN,
148 };
149 
150 static struct usb_endpoint_descriptor in_desc = {
151 	.bLength =		USB_DT_ENDPOINT_SIZE,
152 	.bDescriptorType =	USB_DT_ENDPOINT, /*USB_DT_CS_ENDPOINT*/
153 
154 	.bEndpointAddress =	1 | USB_DIR_IN,
155 	.bmAttributes =	USB_ENDPOINT_XFER_INT,
156 	.wMaxPacketSize =	64,
157 	.bInterval =		1,
158 };
159 
160 static struct usb_descriptor_header *sdp_runtime_descs[] = {
161 	(struct usb_descriptor_header *)&sdp_intf_runtime,
162 	(struct usb_descriptor_header *)&sdp_hid_desc,
163 	(struct usb_descriptor_header *)&in_desc,
164 	NULL,
165 };
166 
167 /* This is synchronized with what the SoC implementation reports */
168 static struct hid_report sdp_hid_report = {
169 	.usage_page = {
170 		0x06, 0x00, 0xff, /* Usage Page */
171 		0x09, 0x01, /* Usage (Pointer?) */
172 		0xa1, 0x01, /* Collection */
173 
174 		0x85, 0x01, /* Report ID */
175 		0x19, 0x01, /* Usage Minimum */
176 		0x29, 0x01, /* Usage Maximum */
177 		0x15, 0x00, /* Local Minimum */
178 		0x26, 0xFF, 0x00, /* Local Maximum? */
179 		0x75, 0x08, /* Report Size */
180 		0x95, 0x10, /* Report Count */
181 		0x91, 0x02, /* Output Data */
182 
183 		0x85, 0x02, /* Report ID */
184 		0x19, 0x01, /* Usage Minimum */
185 		0x29, 0x01, /* Usage Maximum */
186 		0x15, 0x00, /* Local Minimum */
187 		0x26, 0xFF, 0x00, /* Local Maximum? */
188 		0x75, 0x80, /* Report Size 128 */
189 		0x95, 0x40, /* Report Count */
190 		0x91, 0x02, /* Output Data */
191 
192 		0x85, 0x03, /* Report ID */
193 		0x19, 0x01, /* Usage Minimum */
194 		0x29, 0x01, /* Usage Maximum */
195 		0x15, 0x00, /* Local Minimum */
196 		0x26, 0xFF, 0x00, /* Local Maximum? */
197 		0x75, 0x08, /* Report Size 8 */
198 		0x95, 0x04, /* Report Count */
199 		0x81, 0x02, /* Input Data */
200 
201 		0x85, 0x04, /* Report ID */
202 		0x19, 0x01, /* Usage Minimum */
203 		0x29, 0x01, /* Usage Maximum */
204 		0x15, 0x00, /* Local Minimum */
205 		0x26, 0xFF, 0x00, /* Local Maximum? */
206 		0x75, 0x08, /* Report Size 8 */
207 		0x95, 0x40, /* Report Count */
208 		0x81, 0x02, /* Input Data */
209 		0xc0
210 	},
211 };
212 
213 static const char sdp_name[] = "Serial Downloader Protocol";
214 
215 /*
216  * static strings, in UTF-8
217  */
218 static struct usb_string strings_sdp_generic[] = {
219 	[0].s = sdp_name,
220 	{  }			/* end of list */
221 };
222 
223 static struct usb_gadget_strings stringtab_sdp_generic = {
224 	.language	= 0x0409,	/* en-us */
225 	.strings	= strings_sdp_generic,
226 };
227 
228 static struct usb_gadget_strings *sdp_generic_strings[] = {
229 	&stringtab_sdp_generic,
230 	NULL,
231 };
232 
233 static inline void *sdp_ptr(u32 val)
234 {
235 	return (void *)(uintptr_t)val;
236 }
237 
238 static void sdp_rx_command_complete(struct usb_ep *ep, struct usb_request *req)
239 {
240 	struct f_sdp *sdp = req->context;
241 	int status = req->status;
242 	u8 *data = req->buf;
243 	u8 report = data[0];
244 
245 	if (status != 0) {
246 		pr_err("Status: %d\n", status);
247 		return;
248 	}
249 
250 	if (report != 1) {
251 		pr_err("Unexpected report %d\n", report);
252 		return;
253 	}
254 
255 	struct sdp_command *cmd = req->buf + 1;
256 
257 	debug("%s: command: %04x, addr: %08x, cnt: %u\n",
258 	      __func__, be16_to_cpu(cmd->cmd),
259 	      be32_to_cpu(cmd->addr), be32_to_cpu(cmd->cnt));
260 
261 	switch (be16_to_cpu(cmd->cmd)) {
262 	case SDP_READ_REGISTER:
263 		sdp->always_send_status = false;
264 		sdp->error_status = 0x0;
265 
266 		sdp->state = SDP_STATE_TX_SEC_CONF;
267 		sdp->dnl_address = be32_to_cpu(cmd->addr);
268 		sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
269 		sdp->next_state = SDP_STATE_TX_REGISTER;
270 		printf("Reading %d registers at 0x%08x... ",
271 		       sdp->dnl_bytes_remaining, sdp->dnl_address);
272 		break;
273 	case SDP_WRITE_FILE:
274 		sdp->always_send_status = true;
275 		sdp->error_status = SDP_WRITE_FILE_COMPLETE;
276 
277 		sdp->state = SDP_STATE_RX_FILE_DATA;
278 		sdp->dnl_address = be32_to_cpu(cmd->addr);
279 		sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
280 		sdp->next_state = SDP_STATE_IDLE;
281 
282 		printf("Downloading file of size %d to 0x%08x... ",
283 		       sdp->dnl_bytes_remaining, sdp->dnl_address);
284 
285 		break;
286 	case SDP_ERROR_STATUS:
287 		sdp->always_send_status = true;
288 		sdp->error_status = 0;
289 
290 		sdp->state = SDP_STATE_TX_SEC_CONF;
291 		sdp->next_state = SDP_STATE_IDLE;
292 		break;
293 	case SDP_DCD_WRITE:
294 		sdp->always_send_status = true;
295 		sdp->error_status = SDP_WRITE_REGISTER_COMPLETE;
296 
297 		sdp->state = SDP_STATE_RX_DCD_DATA;
298 		sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
299 		sdp->next_state = SDP_STATE_IDLE;
300 		break;
301 	case SDP_JUMP_ADDRESS:
302 		sdp->always_send_status = false;
303 		sdp->error_status = 0;
304 
305 		sdp->jmp_address = be32_to_cpu(cmd->addr);
306 		sdp->state = SDP_STATE_TX_SEC_CONF;
307 		sdp->next_state = SDP_STATE_JUMP;
308 		break;
309 	case SDP_SKIP_DCD_HEADER:
310 		sdp->always_send_status = true;
311 		sdp->error_status = SDP_SKIP_DCD_HEADER_COMPLETE;
312 
313 		/* Ignore command, DCD not supported anyway */
314 		sdp->state = SDP_STATE_TX_SEC_CONF;
315 		sdp->next_state = SDP_STATE_IDLE;
316 		break;
317 	default:
318 		pr_err("Unknown command: %04x\n", be16_to_cpu(cmd->cmd));
319 	}
320 }
321 
322 static void sdp_rx_data_complete(struct usb_ep *ep, struct usb_request *req)
323 {
324 	struct f_sdp *sdp = req->context;
325 	int status = req->status;
326 	u8 *data = req->buf;
327 	u8 report = data[0];
328 	int datalen = req->length - 1;
329 
330 	if (status != 0) {
331 		pr_err("Status: %d\n", status);
332 		return;
333 	}
334 
335 	if (report != 2) {
336 		pr_err("Unexpected report %d\n", report);
337 		return;
338 	}
339 
340 	if (sdp->dnl_bytes_remaining < datalen) {
341 		/*
342 		 * Some USB stacks require to send a complete buffer as
343 		 * specified in the HID descriptor. This leads to longer
344 		 * transfers than the file length, no problem for us.
345 		 */
346 		sdp->dnl_bytes_remaining = 0;
347 	} else {
348 		sdp->dnl_bytes_remaining -= datalen;
349 	}
350 
351 	if (sdp->state == SDP_STATE_RX_FILE_DATA) {
352 		memcpy(sdp_ptr(sdp->dnl_address), req->buf + 1, datalen);
353 		sdp->dnl_address += datalen;
354 	}
355 
356 	if (sdp->dnl_bytes_remaining)
357 		return;
358 
359 	printf("done\n");
360 
361 	switch (sdp->state) {
362 	case SDP_STATE_RX_FILE_DATA:
363 		sdp->state = SDP_STATE_TX_SEC_CONF;
364 		break;
365 	case SDP_STATE_RX_DCD_DATA:
366 		sdp->state = SDP_STATE_TX_SEC_CONF;
367 		break;
368 	default:
369 		pr_err("Invalid state: %d\n", sdp->state);
370 	}
371 }
372 
373 static void sdp_tx_complete(struct usb_ep *ep, struct usb_request *req)
374 {
375 	struct f_sdp *sdp = req->context;
376 	int status = req->status;
377 
378 	if (status != 0) {
379 		pr_err("Status: %d\n", status);
380 		return;
381 	}
382 
383 	switch (sdp->state) {
384 	case SDP_STATE_TX_SEC_CONF_BUSY:
385 		/* Not all commands require status report */
386 		if (sdp->always_send_status || sdp->error_status)
387 			sdp->state = SDP_STATE_TX_STATUS;
388 		else
389 			sdp->state = sdp->next_state;
390 
391 		break;
392 	case SDP_STATE_TX_STATUS_BUSY:
393 		sdp->state = sdp->next_state;
394 		break;
395 	case SDP_STATE_TX_REGISTER_BUSY:
396 		if (sdp->dnl_bytes_remaining)
397 			sdp->state = SDP_STATE_TX_REGISTER;
398 		else
399 			sdp->state = SDP_STATE_IDLE;
400 		break;
401 	default:
402 		pr_err("Wrong State: %d\n", sdp->state);
403 		sdp->state = SDP_STATE_IDLE;
404 		break;
405 	}
406 	debug("%s complete --> %d, %d/%d\n", ep->name,
407 	      status, req->actual, req->length);
408 }
409 
410 static int sdp_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
411 {
412 	struct usb_gadget *gadget = f->config->cdev->gadget;
413 	struct usb_request *req = f->config->cdev->req;
414 	struct f_sdp *sdp = f->config->cdev->req->context;
415 	u16 len = le16_to_cpu(ctrl->wLength);
416 	u16 w_value = le16_to_cpu(ctrl->wValue);
417 	int value = 0;
418 	u8 req_type = ctrl->bRequestType & USB_TYPE_MASK;
419 
420 	debug("w_value: 0x%04x len: 0x%04x\n", w_value, len);
421 	debug("req_type: 0x%02x ctrl->bRequest: 0x%02x sdp->state: %d\n",
422 	      req_type, ctrl->bRequest, sdp->state);
423 
424 	if (req_type == USB_TYPE_STANDARD) {
425 		if (ctrl->bRequest == USB_REQ_GET_DESCRIPTOR) {
426 			/* Send HID report descriptor */
427 			value = min(len, (u16) sizeof(sdp_hid_report));
428 			memcpy(req->buf, &sdp_hid_report, value);
429 			sdp->configuration_done = true;
430 		}
431 	}
432 
433 	if (req_type == USB_TYPE_CLASS) {
434 		int report = w_value & HID_REPORT_ID_MASK;
435 
436 		/* HID (SDP) request */
437 		switch (ctrl->bRequest) {
438 		case HID_REQ_SET_REPORT:
439 			switch (report) {
440 			case 1:
441 				value = SDP_COMMAND_LEN + 1;
442 				req->complete = sdp_rx_command_complete;
443 				break;
444 			case 2:
445 				value = len;
446 				req->complete = sdp_rx_data_complete;
447 				break;
448 			}
449 		}
450 	}
451 
452 	if (value >= 0) {
453 		req->length = value;
454 		req->zero = value < len;
455 		value = usb_ep_queue(gadget->ep0, req, 0);
456 		if (value < 0) {
457 			debug("ep_queue --> %d\n", value);
458 			req->status = 0;
459 		}
460 	}
461 
462 	return value;
463 }
464 
465 static int sdp_bind(struct usb_configuration *c, struct usb_function *f)
466 {
467 	struct usb_gadget *gadget = c->cdev->gadget;
468 	struct usb_composite_dev *cdev = c->cdev;
469 	struct f_sdp *sdp = func_to_sdp(f);
470 	int rv = 0, id;
471 
472 	id = usb_interface_id(c, f);
473 	if (id < 0)
474 		return id;
475 	sdp_intf_runtime.bInterfaceNumber = id;
476 
477 	struct usb_ep *ep;
478 
479 	/* allocate instance-specific endpoints */
480 	ep = usb_ep_autoconfig(gadget, &in_desc);
481 	if (!ep) {
482 		rv = -ENODEV;
483 		goto error;
484 	}
485 
486 	sdp->in_ep = ep; /* Store IN EP for enabling @ setup */
487 
488 	cdev->req->context = sdp;
489 
490 error:
491 	return rv;
492 }
493 
494 static void sdp_unbind(struct usb_configuration *c, struct usb_function *f)
495 {
496 	free(sdp_func);
497 	sdp_func = NULL;
498 }
499 
500 static struct usb_request *alloc_ep_req(struct usb_ep *ep, unsigned length)
501 {
502 	struct usb_request *req;
503 
504 	req = usb_ep_alloc_request(ep, 0);
505 	if (!req)
506 		return req;
507 
508 	req->length = length;
509 	req->buf = memalign(CONFIG_SYS_CACHELINE_SIZE, length);
510 	if (!req->buf) {
511 		usb_ep_free_request(ep, req);
512 		req = NULL;
513 	}
514 
515 	return req;
516 }
517 
518 
519 static struct usb_request *sdp_start_ep(struct usb_ep *ep)
520 {
521 	struct usb_request *req;
522 
523 	req = alloc_ep_req(ep, 64);
524 	debug("%s: ep:%p req:%p\n", __func__, ep, req);
525 
526 	if (!req)
527 		return NULL;
528 
529 	memset(req->buf, 0, req->length);
530 	req->complete = sdp_tx_complete;
531 
532 	return req;
533 }
534 static int sdp_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
535 {
536 	struct f_sdp *sdp = func_to_sdp(f);
537 	struct usb_composite_dev *cdev = f->config->cdev;
538 	int result;
539 
540 	debug("%s: intf: %d alt: %d\n", __func__, intf, alt);
541 
542 	result = usb_ep_enable(sdp->in_ep, &in_desc);
543 	if (result)
544 		return result;
545 	sdp->in_req = sdp_start_ep(sdp->in_ep);
546 	sdp->in_req->context = sdp;
547 
548 	sdp->in_ep->driver_data = cdev; /* claim */
549 
550 	sdp->altsetting = alt;
551 	sdp->state = SDP_STATE_IDLE;
552 
553 	return 0;
554 }
555 
556 static int sdp_get_alt(struct usb_function *f, unsigned intf)
557 {
558 	struct f_sdp *sdp = func_to_sdp(f);
559 
560 	return sdp->altsetting;
561 }
562 
563 static void sdp_disable(struct usb_function *f)
564 {
565 	struct f_sdp *sdp = func_to_sdp(f);
566 
567 	usb_ep_disable(sdp->in_ep);
568 
569 	if (sdp->in_req) {
570 		free(sdp->in_req);
571 		sdp->in_req = NULL;
572 	}
573 }
574 
575 static int sdp_bind_config(struct usb_configuration *c)
576 {
577 	int status;
578 
579 	if (!sdp_func) {
580 		sdp_func = memalign(CONFIG_SYS_CACHELINE_SIZE, sizeof(*sdp_func));
581 		if (!sdp_func)
582 			return -ENOMEM;
583 	}
584 
585 	memset(sdp_func, 0, sizeof(*sdp_func));
586 
587 	sdp_func->usb_function.name = "sdp";
588 	sdp_func->usb_function.hs_descriptors = sdp_runtime_descs;
589 	sdp_func->usb_function.descriptors = sdp_runtime_descs;
590 	sdp_func->usb_function.bind = sdp_bind;
591 	sdp_func->usb_function.unbind = sdp_unbind;
592 	sdp_func->usb_function.set_alt = sdp_set_alt;
593 	sdp_func->usb_function.get_alt = sdp_get_alt;
594 	sdp_func->usb_function.disable = sdp_disable;
595 	sdp_func->usb_function.strings = sdp_generic_strings;
596 	sdp_func->usb_function.setup = sdp_setup;
597 
598 	status = usb_add_function(c, &sdp_func->usb_function);
599 
600 	return status;
601 }
602 
603 int sdp_init(int controller_index)
604 {
605 	printf("SDP: initialize...\n");
606 	while (!sdp_func->configuration_done) {
607 		if (ctrlc()) {
608 			puts("\rCTRL+C - Operation aborted.\n");
609 			return 1;
610 		}
611 
612 		WATCHDOG_RESET();
613 		usb_gadget_handle_interrupts(controller_index);
614 	}
615 
616 	return 0;
617 }
618 
619 static u32 sdp_jump_imxheader(void *address)
620 {
621 	flash_header_v2_t *headerv2 = address;
622 	ulong (*entry)(void);
623 
624 	if (headerv2->header.tag != IVT_HEADER_TAG) {
625 		printf("Header Tag is not an IMX image\n");
626 		return SDP_ERROR_IMXHEADER;
627 	}
628 
629 	printf("Jumping to 0x%08x\n", headerv2->entry);
630 	entry = sdp_ptr(headerv2->entry);
631 	entry();
632 
633 	/* The image probably never returns hence we won't reach that point */
634 	return 0;
635 }
636 
637 static void sdp_handle_in_ep(void)
638 {
639 	u8 *data = sdp_func->in_req->buf;
640 	u32 status;
641 	int datalen;
642 
643 	switch (sdp_func->state) {
644 	case SDP_STATE_TX_SEC_CONF:
645 		debug("Report 3: HAB security\n");
646 		data[0] = 3;
647 
648 		status = SDP_SECURITY_OPEN;
649 		memcpy(&data[1], &status, 4);
650 		sdp_func->in_req->length = 5;
651 		usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
652 		sdp_func->state = SDP_STATE_TX_SEC_CONF_BUSY;
653 		break;
654 
655 	case SDP_STATE_TX_STATUS:
656 		debug("Report 4: Status\n");
657 		data[0] = 4;
658 
659 		memcpy(&data[1], &sdp_func->error_status, 4);
660 		sdp_func->in_req->length = 65;
661 		usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
662 		sdp_func->state = SDP_STATE_TX_STATUS_BUSY;
663 		break;
664 	case SDP_STATE_TX_REGISTER:
665 		debug("Report 4: Register Values\n");
666 		data[0] = 4;
667 
668 		datalen = sdp_func->dnl_bytes_remaining;
669 
670 		if (datalen > 64)
671 			datalen = 64;
672 
673 		memcpy(&data[1], sdp_ptr(sdp_func->dnl_address), datalen);
674 		sdp_func->in_req->length = 65;
675 
676 		sdp_func->dnl_bytes_remaining -= datalen;
677 		sdp_func->dnl_address += datalen;
678 
679 		usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
680 		sdp_func->state = SDP_STATE_TX_REGISTER_BUSY;
681 		break;
682 	case SDP_STATE_JUMP:
683 		printf("Jumping to header at 0x%08x\n", sdp_func->jmp_address);
684 		status = sdp_jump_imxheader(sdp_ptr(sdp_func->jmp_address));
685 
686 		/* If imx header fails, try some U-Boot specific headers */
687 		if (status) {
688 #ifdef CONFIG_SPL_BUILD
689 			/* In SPL, allow jumps to U-Boot images */
690 			struct spl_image_info spl_image = {};
691 			spl_parse_image_header(&spl_image,
692 				(struct image_header *)sdp_func->jmp_address);
693 			jump_to_image_no_args(&spl_image);
694 #else
695 			/* In U-Boot, allow jumps to scripts */
696 			source(sdp_func->jmp_address, "script@1");
697 #endif
698 		}
699 
700 		sdp_func->next_state = SDP_STATE_IDLE;
701 		sdp_func->error_status = status;
702 
703 		/* Only send Report 4 if there was an error */
704 		if (status)
705 			sdp_func->state = SDP_STATE_TX_STATUS;
706 		else
707 			sdp_func->state = SDP_STATE_IDLE;
708 		break;
709 	default:
710 		break;
711 	};
712 }
713 
714 void sdp_handle(int controller_index)
715 {
716 	printf("SDP: handle requests...\n");
717 	while (1) {
718 		if (ctrlc()) {
719 			puts("\rCTRL+C - Operation aborted.\n");
720 			return;
721 		}
722 
723 		WATCHDOG_RESET();
724 		usb_gadget_handle_interrupts(controller_index);
725 
726 		sdp_handle_in_ep();
727 	}
728 }
729 
730 int sdp_add(struct usb_configuration *c)
731 {
732 	int id;
733 
734 	id = usb_string_id(c->cdev);
735 	if (id < 0)
736 		return id;
737 	strings_sdp_generic[0].id = id;
738 	sdp_intf_runtime.iInterface = id;
739 
740 	debug("%s: cdev: %p gadget: %p gadget->ep0: %p\n", __func__,
741 	      c->cdev, c->cdev->gadget, c->cdev->gadget->ep0);
742 
743 	return sdp_bind_config(c);
744 }
745 
746 DECLARE_GADGET_BIND_CALLBACK(usb_dnl_sdp, sdp_add);
747