xref: /openbmc/u-boot/drivers/usb/gadget/f_sdp.c (revision a3b36c84)
1 /*
2  * f_sdp.c -- USB HID Serial Download Protocol
3  *
4  * Copyright (C) 2017 Toradex
5  * Author: Stefan Agner <stefan.agner@toradex.com>
6  *
7  * This file implements the Serial Download Protocol (SDP) as specified in
8  * the i.MX 6 Reference Manual. The SDP is a USB HID based protocol and
9  * allows to download images directly to memory. The implementation
10  * works with the imx_loader (imx_usb) USB client software on host side.
11  *
12  * Not all commands are implemented, e.g. WRITE_REGISTER, DCD_WRITE and
13  * SKIP_DCD_HEADER are only stubs.
14  *
15  * Parts of the implementation are based on f_dfu and f_thor.
16  *
17  * SPDX-License-Identifier:	GPL-2.0+
18  */
19 
20 #include <errno.h>
21 #include <common.h>
22 #include <console.h>
23 #include <malloc.h>
24 
25 #include <linux/usb/ch9.h>
26 #include <linux/usb/gadget.h>
27 #include <linux/usb/composite.h>
28 
29 #include <asm/io.h>
30 #include <g_dnl.h>
31 #include <sdp.h>
32 #include <spl.h>
33 #include <image.h>
34 #include <imximage.h>
35 
36 #define HID_REPORT_ID_MASK	0x000000ff
37 
38 /*
39  * HID class requests
40  */
41 #define HID_REQ_GET_REPORT		0x01
42 #define HID_REQ_GET_IDLE		0x02
43 #define HID_REQ_GET_PROTOCOL		0x03
44 #define HID_REQ_SET_REPORT		0x09
45 #define HID_REQ_SET_IDLE		0x0A
46 #define HID_REQ_SET_PROTOCOL		0x0B
47 
48 #define HID_USAGE_PAGE_LEN		76
49 
50 struct hid_report {
51 	u8 usage_page[HID_USAGE_PAGE_LEN];
52 } __packed;
53 
54 #define SDP_READ_REGISTER	0x0101
55 #define SDP_WRITE_REGISTER	0x0202
56 #define SDP_WRITE_FILE		0x0404
57 #define SDP_ERROR_STATUS	0x0505
58 #define SDP_DCD_WRITE		0x0a0a
59 #define SDP_JUMP_ADDRESS	0x0b0b
60 #define SDP_SKIP_DCD_HEADER	0x0c0c
61 
62 #define SDP_SECURITY_CLOSED		0x12343412
63 #define SDP_SECURITY_OPEN		0x56787856
64 
65 #define SDP_WRITE_FILE_COMPLETE		0x88888888
66 #define SDP_WRITE_REGISTER_COMPLETE	0x128A8A12
67 #define SDP_SKIP_DCD_HEADER_COMPLETE	0x900DD009
68 #define SDP_ERROR_IMXHEADER		0x000a0533
69 
70 #define SDP_COMMAND_LEN		16
71 
72 struct sdp_command {
73 	u16 cmd;
74 	u32 addr;
75 	u8 format;
76 	u32 cnt;
77 	u32 data;
78 	u8 rsvd;
79 } __packed;
80 
81 enum sdp_state {
82 	SDP_STATE_IDLE,
83 	SDP_STATE_RX_DCD_DATA,
84 	SDP_STATE_RX_FILE_DATA,
85 	SDP_STATE_TX_SEC_CONF,
86 	SDP_STATE_TX_SEC_CONF_BUSY,
87 	SDP_STATE_TX_REGISTER,
88 	SDP_STATE_TX_REGISTER_BUSY,
89 	SDP_STATE_TX_STATUS,
90 	SDP_STATE_TX_STATUS_BUSY,
91 	SDP_STATE_JUMP,
92 };
93 
94 struct f_sdp {
95 	struct usb_function		usb_function;
96 
97 	struct usb_descriptor_header	**function;
98 
99 	u8				altsetting;
100 	enum sdp_state			state;
101 	enum sdp_state			next_state;
102 	u32				dnl_address;
103 	u32				dnl_bytes_remaining;
104 	u32				jmp_address;
105 	bool				always_send_status;
106 	u32				error_status;
107 
108 	/* EP0 request */
109 	struct usb_request		*req;
110 
111 	/* EP1 IN */
112 	struct usb_ep			*in_ep;
113 	struct usb_request		*in_req;
114 
115 	bool				configuration_done;
116 };
117 
118 static struct f_sdp *sdp_func;
119 
120 static inline struct f_sdp *func_to_sdp(struct usb_function *f)
121 {
122 	return container_of(f, struct f_sdp, usb_function);
123 }
124 
125 static struct usb_interface_descriptor sdp_intf_runtime = {
126 	.bLength =		sizeof(sdp_intf_runtime),
127 	.bDescriptorType =	USB_DT_INTERFACE,
128 	.bAlternateSetting =	0,
129 	.bNumEndpoints =	1,
130 	.bInterfaceClass =	USB_CLASS_HID,
131 	.bInterfaceSubClass =	0,
132 	.bInterfaceProtocol =	0,
133 	/* .iInterface = DYNAMIC */
134 };
135 
136 /* HID configuration */
137 static struct usb_class_hid_descriptor sdp_hid_desc = {
138 	.bLength =		sizeof(sdp_hid_desc),
139 	.bDescriptorType =	USB_DT_CS_DEVICE,
140 
141 	.bcdCDC =		__constant_cpu_to_le16(0x0110),
142 	.bCountryCode =		0,
143 	.bNumDescriptors =	1,
144 
145 	.bDescriptorType0	= USB_DT_HID_REPORT,
146 	.wDescriptorLength0	= HID_USAGE_PAGE_LEN,
147 };
148 
149 static struct usb_endpoint_descriptor in_desc = {
150 	.bLength =		USB_DT_ENDPOINT_SIZE,
151 	.bDescriptorType =	USB_DT_ENDPOINT, /*USB_DT_CS_ENDPOINT*/
152 
153 	.bEndpointAddress =	1 | USB_DIR_IN,
154 	.bmAttributes =	USB_ENDPOINT_XFER_INT,
155 	.wMaxPacketSize =	64,
156 	.bInterval =		1,
157 };
158 
159 static struct usb_descriptor_header *sdp_runtime_descs[] = {
160 	(struct usb_descriptor_header *)&sdp_intf_runtime,
161 	(struct usb_descriptor_header *)&sdp_hid_desc,
162 	(struct usb_descriptor_header *)&in_desc,
163 	NULL,
164 };
165 
166 /* This is synchronized with what the SoC implementation reports */
167 static struct hid_report sdp_hid_report = {
168 	.usage_page = {
169 		0x06, 0x00, 0xff, /* Usage Page */
170 		0x09, 0x01, /* Usage (Pointer?) */
171 		0xa1, 0x01, /* Collection */
172 
173 		0x85, 0x01, /* Report ID */
174 		0x19, 0x01, /* Usage Minimum */
175 		0x29, 0x01, /* Usage Maximum */
176 		0x15, 0x00, /* Local Minimum */
177 		0x26, 0xFF, 0x00, /* Local Maximum? */
178 		0x75, 0x08, /* Report Size */
179 		0x95, 0x10, /* Report Count */
180 		0x91, 0x02, /* Output Data */
181 
182 		0x85, 0x02, /* Report ID */
183 		0x19, 0x01, /* Usage Minimum */
184 		0x29, 0x01, /* Usage Maximum */
185 		0x15, 0x00, /* Local Minimum */
186 		0x26, 0xFF, 0x00, /* Local Maximum? */
187 		0x75, 0x80, /* Report Size 128 */
188 		0x95, 0x40, /* Report Count */
189 		0x91, 0x02, /* Output Data */
190 
191 		0x85, 0x03, /* Report ID */
192 		0x19, 0x01, /* Usage Minimum */
193 		0x29, 0x01, /* Usage Maximum */
194 		0x15, 0x00, /* Local Minimum */
195 		0x26, 0xFF, 0x00, /* Local Maximum? */
196 		0x75, 0x08, /* Report Size 8 */
197 		0x95, 0x04, /* Report Count */
198 		0x81, 0x02, /* Input Data */
199 
200 		0x85, 0x04, /* Report ID */
201 		0x19, 0x01, /* Usage Minimum */
202 		0x29, 0x01, /* Usage Maximum */
203 		0x15, 0x00, /* Local Minimum */
204 		0x26, 0xFF, 0x00, /* Local Maximum? */
205 		0x75, 0x08, /* Report Size 8 */
206 		0x95, 0x40, /* Report Count */
207 		0x81, 0x02, /* Input Data */
208 		0xc0
209 	},
210 };
211 
212 static const char sdp_name[] = "Serial Downloader Protocol";
213 
214 /*
215  * static strings, in UTF-8
216  */
217 static struct usb_string strings_sdp_generic[] = {
218 	[0].s = sdp_name,
219 	{  }			/* end of list */
220 };
221 
222 static struct usb_gadget_strings stringtab_sdp_generic = {
223 	.language	= 0x0409,	/* en-us */
224 	.strings	= strings_sdp_generic,
225 };
226 
227 static struct usb_gadget_strings *sdp_generic_strings[] = {
228 	&stringtab_sdp_generic,
229 	NULL,
230 };
231 
232 static void sdp_rx_command_complete(struct usb_ep *ep, struct usb_request *req)
233 {
234 	struct f_sdp *sdp = req->context;
235 	int status = req->status;
236 	u8 *data = req->buf;
237 	u8 report = data[0];
238 
239 	if (status != 0) {
240 		pr_err("Status: %d", status);
241 		return;
242 	}
243 
244 	if (report != 1) {
245 		pr_err("Unexpected report %d", report);
246 		return;
247 	}
248 
249 	struct sdp_command *cmd = req->buf + 1;
250 
251 	debug("%s: command: %04x, addr: %08x, cnt: %u\n",
252 	      __func__, be16_to_cpu(cmd->cmd),
253 	      be32_to_cpu(cmd->addr), be32_to_cpu(cmd->cnt));
254 
255 	switch (be16_to_cpu(cmd->cmd)) {
256 	case SDP_READ_REGISTER:
257 		sdp->always_send_status = false;
258 		sdp->error_status = 0x0;
259 
260 		sdp->state = SDP_STATE_TX_SEC_CONF;
261 		sdp->dnl_address = be32_to_cpu(cmd->addr);
262 		sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
263 		sdp->next_state = SDP_STATE_TX_REGISTER;
264 		printf("Reading %d registers at 0x%08x... ",
265 		       sdp->dnl_bytes_remaining, sdp->dnl_address);
266 		break;
267 	case SDP_WRITE_FILE:
268 		sdp->always_send_status = true;
269 		sdp->error_status = SDP_WRITE_FILE_COMPLETE;
270 
271 		sdp->state = SDP_STATE_RX_FILE_DATA;
272 		sdp->dnl_address = be32_to_cpu(cmd->addr);
273 		sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
274 		sdp->next_state = SDP_STATE_IDLE;
275 
276 		printf("Downloading file of size %d to 0x%08x... ",
277 		       sdp->dnl_bytes_remaining, sdp->dnl_address);
278 
279 		break;
280 	case SDP_ERROR_STATUS:
281 		sdp->always_send_status = true;
282 		sdp->error_status = 0;
283 
284 		sdp->state = SDP_STATE_TX_SEC_CONF;
285 		sdp->next_state = SDP_STATE_IDLE;
286 		break;
287 	case SDP_DCD_WRITE:
288 		sdp->always_send_status = true;
289 		sdp->error_status = SDP_WRITE_REGISTER_COMPLETE;
290 
291 		sdp->state = SDP_STATE_RX_DCD_DATA;
292 		sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
293 		sdp->next_state = SDP_STATE_IDLE;
294 		break;
295 	case SDP_JUMP_ADDRESS:
296 		sdp->always_send_status = false;
297 		sdp->error_status = 0;
298 
299 		sdp->jmp_address = be32_to_cpu(cmd->addr);
300 		sdp->state = SDP_STATE_TX_SEC_CONF;
301 		sdp->next_state = SDP_STATE_JUMP;
302 		break;
303 	case SDP_SKIP_DCD_HEADER:
304 		sdp->always_send_status = true;
305 		sdp->error_status = SDP_SKIP_DCD_HEADER_COMPLETE;
306 
307 		/* Ignore command, DCD not supported anyway */
308 		sdp->state = SDP_STATE_TX_SEC_CONF;
309 		sdp->next_state = SDP_STATE_IDLE;
310 		break;
311 	default:
312 		pr_err("Unknown command: %04x\n", be16_to_cpu(cmd->cmd));
313 	}
314 }
315 
316 static void sdp_rx_data_complete(struct usb_ep *ep, struct usb_request *req)
317 {
318 	struct f_sdp *sdp = req->context;
319 	int status = req->status;
320 	u8 *data = req->buf;
321 	u8 report = data[0];
322 	int datalen = req->length - 1;
323 
324 	if (status != 0) {
325 		pr_err("Status: %d", status);
326 		return;
327 	}
328 
329 	if (report != 2) {
330 		pr_err("Unexpected report %d", report);
331 		return;
332 	}
333 
334 	if (sdp->dnl_bytes_remaining < datalen) {
335 		/*
336 		 * Some USB stacks require to send a complete buffer as
337 		 * specified in the HID descriptor. This leads to longer
338 		 * transfers than the file length, no problem for us.
339 		 */
340 		sdp->dnl_bytes_remaining = 0;
341 	} else {
342 		sdp->dnl_bytes_remaining -= datalen;
343 	}
344 
345 	if (sdp->state == SDP_STATE_RX_FILE_DATA) {
346 		memcpy((void *)sdp->dnl_address, req->buf + 1, datalen);
347 		sdp->dnl_address += datalen;
348 	}
349 
350 	if (sdp->dnl_bytes_remaining)
351 		return;
352 
353 	printf("done\n");
354 
355 	switch (sdp->state) {
356 	case SDP_STATE_RX_FILE_DATA:
357 		sdp->state = SDP_STATE_TX_SEC_CONF;
358 		break;
359 	case SDP_STATE_RX_DCD_DATA:
360 		sdp->state = SDP_STATE_TX_SEC_CONF;
361 		break;
362 	default:
363 		pr_err("Invalid state: %d", sdp->state);
364 	}
365 }
366 
367 static void sdp_tx_complete(struct usb_ep *ep, struct usb_request *req)
368 {
369 	struct f_sdp *sdp = req->context;
370 	int status = req->status;
371 
372 	if (status != 0) {
373 		pr_err("Status: %d", status);
374 		return;
375 	}
376 
377 	switch (sdp->state) {
378 	case SDP_STATE_TX_SEC_CONF_BUSY:
379 		/* Not all commands require status report */
380 		if (sdp->always_send_status || sdp->error_status)
381 			sdp->state = SDP_STATE_TX_STATUS;
382 		else
383 			sdp->state = sdp->next_state;
384 
385 		break;
386 	case SDP_STATE_TX_STATUS_BUSY:
387 		sdp->state = sdp->next_state;
388 		break;
389 	case SDP_STATE_TX_REGISTER_BUSY:
390 		if (sdp->dnl_bytes_remaining)
391 			sdp->state = SDP_STATE_TX_REGISTER;
392 		else
393 			sdp->state = SDP_STATE_IDLE;
394 		break;
395 	default:
396 		pr_err("Wrong State: %d", sdp->state);
397 		sdp->state = SDP_STATE_IDLE;
398 		break;
399 	}
400 	debug("%s complete --> %d, %d/%d\n", ep->name,
401 	      status, req->actual, req->length);
402 }
403 
404 static int sdp_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
405 {
406 	struct usb_gadget *gadget = f->config->cdev->gadget;
407 	struct usb_request *req = f->config->cdev->req;
408 	struct f_sdp *sdp = f->config->cdev->req->context;
409 	u16 len = le16_to_cpu(ctrl->wLength);
410 	u16 w_value = le16_to_cpu(ctrl->wValue);
411 	int value = 0;
412 	u8 req_type = ctrl->bRequestType & USB_TYPE_MASK;
413 
414 	debug("w_value: 0x%04x len: 0x%04x\n", w_value, len);
415 	debug("req_type: 0x%02x ctrl->bRequest: 0x%02x sdp->state: %d\n",
416 	      req_type, ctrl->bRequest, sdp->state);
417 
418 	if (req_type == USB_TYPE_STANDARD) {
419 		if (ctrl->bRequest == USB_REQ_GET_DESCRIPTOR) {
420 			/* Send HID report descriptor */
421 			value = min(len, (u16) sizeof(sdp_hid_report));
422 			memcpy(req->buf, &sdp_hid_report, value);
423 			sdp->configuration_done = true;
424 		}
425 	}
426 
427 	if (req_type == USB_TYPE_CLASS) {
428 		int report = w_value & HID_REPORT_ID_MASK;
429 
430 		/* HID (SDP) request */
431 		switch (ctrl->bRequest) {
432 		case HID_REQ_SET_REPORT:
433 			switch (report) {
434 			case 1:
435 				value = SDP_COMMAND_LEN + 1;
436 				req->complete = sdp_rx_command_complete;
437 				break;
438 			case 2:
439 				value = len;
440 				req->complete = sdp_rx_data_complete;
441 				break;
442 			}
443 		}
444 	}
445 
446 	if (value >= 0) {
447 		req->length = value;
448 		req->zero = value < len;
449 		value = usb_ep_queue(gadget->ep0, req, 0);
450 		if (value < 0) {
451 			debug("ep_queue --> %d\n", value);
452 			req->status = 0;
453 		}
454 	}
455 
456 	return value;
457 }
458 
459 static int sdp_bind(struct usb_configuration *c, struct usb_function *f)
460 {
461 	struct usb_gadget *gadget = c->cdev->gadget;
462 	struct usb_composite_dev *cdev = c->cdev;
463 	struct f_sdp *sdp = func_to_sdp(f);
464 	int rv = 0, id;
465 
466 	id = usb_interface_id(c, f);
467 	if (id < 0)
468 		return id;
469 	sdp_intf_runtime.bInterfaceNumber = id;
470 
471 	struct usb_ep *ep;
472 
473 	/* allocate instance-specific endpoints */
474 	ep = usb_ep_autoconfig(gadget, &in_desc);
475 	if (!ep) {
476 		rv = -ENODEV;
477 		goto error;
478 	}
479 
480 	sdp->in_ep = ep; /* Store IN EP for enabling @ setup */
481 
482 	cdev->req->context = sdp;
483 
484 error:
485 	return rv;
486 }
487 
488 static void sdp_unbind(struct usb_configuration *c, struct usb_function *f)
489 {
490 	free(sdp_func);
491 	sdp_func = NULL;
492 }
493 
494 static struct usb_request *alloc_ep_req(struct usb_ep *ep, unsigned length)
495 {
496 	struct usb_request *req;
497 
498 	req = usb_ep_alloc_request(ep, 0);
499 	if (!req)
500 		return req;
501 
502 	req->length = length;
503 	req->buf = memalign(CONFIG_SYS_CACHELINE_SIZE, length);
504 	if (!req->buf) {
505 		usb_ep_free_request(ep, req);
506 		req = NULL;
507 	}
508 
509 	return req;
510 }
511 
512 
513 static struct usb_request *sdp_start_ep(struct usb_ep *ep)
514 {
515 	struct usb_request *req;
516 
517 	req = alloc_ep_req(ep, 64);
518 	debug("%s: ep:%p req:%p\n", __func__, ep, req);
519 
520 	if (!req)
521 		return NULL;
522 
523 	memset(req->buf, 0, req->length);
524 	req->complete = sdp_tx_complete;
525 
526 	return req;
527 }
528 static int sdp_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
529 {
530 	struct f_sdp *sdp = func_to_sdp(f);
531 	struct usb_composite_dev *cdev = f->config->cdev;
532 	int result;
533 
534 	debug("%s: intf: %d alt: %d\n", __func__, intf, alt);
535 
536 	result = usb_ep_enable(sdp->in_ep, &in_desc);
537 	if (result)
538 		return result;
539 	sdp->in_req = sdp_start_ep(sdp->in_ep);
540 	sdp->in_req->context = sdp;
541 
542 	sdp->in_ep->driver_data = cdev; /* claim */
543 
544 	sdp->altsetting = alt;
545 	sdp->state = SDP_STATE_IDLE;
546 
547 	return 0;
548 }
549 
550 static int sdp_get_alt(struct usb_function *f, unsigned intf)
551 {
552 	struct f_sdp *sdp = func_to_sdp(f);
553 
554 	return sdp->altsetting;
555 }
556 
557 static void sdp_disable(struct usb_function *f)
558 {
559 	struct f_sdp *sdp = func_to_sdp(f);
560 
561 	usb_ep_disable(sdp->in_ep);
562 
563 	if (sdp->in_req) {
564 		free(sdp->in_req);
565 		sdp->in_req = NULL;
566 	}
567 }
568 
569 static int sdp_bind_config(struct usb_configuration *c)
570 {
571 	int status;
572 
573 	if (!sdp_func) {
574 		sdp_func = memalign(CONFIG_SYS_CACHELINE_SIZE, sizeof(*sdp_func));
575 		if (!sdp_func)
576 			return -ENOMEM;
577 	}
578 
579 	memset(sdp_func, 0, sizeof(*sdp_func));
580 
581 	sdp_func->usb_function.name = "sdp";
582 	sdp_func->usb_function.hs_descriptors = sdp_runtime_descs;
583 	sdp_func->usb_function.descriptors = sdp_runtime_descs;
584 	sdp_func->usb_function.bind = sdp_bind;
585 	sdp_func->usb_function.unbind = sdp_unbind;
586 	sdp_func->usb_function.set_alt = sdp_set_alt;
587 	sdp_func->usb_function.get_alt = sdp_get_alt;
588 	sdp_func->usb_function.disable = sdp_disable;
589 	sdp_func->usb_function.strings = sdp_generic_strings;
590 	sdp_func->usb_function.setup = sdp_setup;
591 
592 	status = usb_add_function(c, &sdp_func->usb_function);
593 
594 	return status;
595 }
596 
597 int sdp_init(int controller_index)
598 {
599 	printf("SDP: initialize...\n");
600 	while (!sdp_func->configuration_done) {
601 		if (ctrlc()) {
602 			puts("\rCTRL+C - Operation aborted.\n");
603 			return 1;
604 		}
605 		usb_gadget_handle_interrupts(controller_index);
606 	}
607 
608 	return 0;
609 }
610 
611 static u32 sdp_jump_imxheader(void *address)
612 {
613 	flash_header_v2_t *headerv2 = address;
614 	ulong (*entry)(void);
615 
616 	if (headerv2->header.tag != IVT_HEADER_TAG) {
617 		printf("Header Tag is not an IMX image\n");
618 		return SDP_ERROR_IMXHEADER;
619 	}
620 
621 	printf("Jumping to 0x%08x\n", headerv2->entry);
622 	entry = (void *)headerv2->entry;
623 	entry();
624 
625 	/* The image probably never returns hence we won't reach that point */
626 	return 0;
627 }
628 
629 static void sdp_handle_in_ep(void)
630 {
631 	u8 *data = sdp_func->in_req->buf;
632 	u32 status;
633 	int datalen;
634 
635 	switch (sdp_func->state) {
636 	case SDP_STATE_TX_SEC_CONF:
637 		debug("Report 3: HAB security\n");
638 		data[0] = 3;
639 
640 		status = SDP_SECURITY_OPEN;
641 		memcpy(&data[1], &status, 4);
642 		sdp_func->in_req->length = 5;
643 		usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
644 		sdp_func->state = SDP_STATE_TX_SEC_CONF_BUSY;
645 		break;
646 
647 	case SDP_STATE_TX_STATUS:
648 		debug("Report 4: Status\n");
649 		data[0] = 4;
650 
651 		memcpy(&data[1], &sdp_func->error_status, 4);
652 		sdp_func->in_req->length = 65;
653 		usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
654 		sdp_func->state = SDP_STATE_TX_STATUS_BUSY;
655 		break;
656 	case SDP_STATE_TX_REGISTER:
657 		debug("Report 4: Register Values\n");
658 		data[0] = 4;
659 
660 		datalen = sdp_func->dnl_bytes_remaining;
661 
662 		if (datalen > 64)
663 			datalen = 64;
664 
665 		memcpy(&data[1], (void *)sdp_func->dnl_address, datalen);
666 		sdp_func->in_req->length = 65;
667 
668 		sdp_func->dnl_bytes_remaining -= datalen;
669 		sdp_func->dnl_address += datalen;
670 
671 		usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
672 		sdp_func->state = SDP_STATE_TX_REGISTER_BUSY;
673 		break;
674 	case SDP_STATE_JUMP:
675 		printf("Jumping to header at 0x%08x\n", sdp_func->jmp_address);
676 		status = sdp_jump_imxheader((void *)sdp_func->jmp_address);
677 
678 		/* If imx header fails, try some U-Boot specific headers */
679 		if (status) {
680 #ifdef CONFIG_SPL_BUILD
681 			/* In SPL, allow jumps to U-Boot images */
682 			struct spl_image_info spl_image = {};
683 			spl_parse_image_header(&spl_image,
684 				(struct image_header *)sdp_func->jmp_address);
685 			jump_to_image_no_args(&spl_image);
686 #else
687 			/* In U-Boot, allow jumps to scripts */
688 			source(sdp_func->jmp_address, "script@1");
689 #endif
690 		}
691 
692 		sdp_func->next_state = SDP_STATE_IDLE;
693 		sdp_func->error_status = status;
694 
695 		/* Only send Report 4 if there was an error */
696 		if (status)
697 			sdp_func->state = SDP_STATE_TX_STATUS;
698 		else
699 			sdp_func->state = SDP_STATE_IDLE;
700 		break;
701 	default:
702 		break;
703 	};
704 }
705 
706 void sdp_handle(int controller_index)
707 {
708 	printf("SDP: handle requests...\n");
709 	while (1) {
710 		if (ctrlc()) {
711 			puts("\rCTRL+C - Operation aborted.\n");
712 			return;
713 		}
714 
715 		usb_gadget_handle_interrupts(controller_index);
716 
717 		sdp_handle_in_ep();
718 	}
719 }
720 
721 int sdp_add(struct usb_configuration *c)
722 {
723 	int id;
724 
725 	id = usb_string_id(c->cdev);
726 	if (id < 0)
727 		return id;
728 	strings_sdp_generic[0].id = id;
729 	sdp_intf_runtime.iInterface = id;
730 
731 	debug("%s: cdev: %p gadget: %p gadget->ep0: %p\n", __func__,
732 	      c->cdev, c->cdev->gadget, c->cdev->gadget->ep0);
733 
734 	return sdp_bind_config(c);
735 }
736 
737 DECLARE_GADGET_BIND_CALLBACK(usb_dnl_sdp, sdp_add);
738