summaryrefslogtreecommitdiff
path: root/common
diff options
context:
space:
mode:
Diffstat (limited to 'common')
-rw-r--r--common/cmd_bootm.c12
-rw-r--r--common/cmd_i2c.c2
-rw-r--r--common/cmd_ximg.c5
-rw-r--r--common/image.c1
-rw-r--r--common/usb.c87
-rw-r--r--common/usb_hub.c26
-rw-r--r--common/usb_kbd.c15
7 files changed, 115 insertions, 33 deletions
diff --git a/common/cmd_bootm.c b/common/cmd_bootm.c
index 1685c14a5..b07b0f48b 100644
--- a/common/cmd_bootm.c
+++ b/common/cmd_bootm.c
@@ -368,7 +368,7 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end,
const char *type_name = genimg_get_type_name(os.type);
- load_buf = map_sysmem(load, image_len);
+ load_buf = map_sysmem(load, unc_len);
image_buf = map_sysmem(image_start, image_len);
switch (comp) {
case IH_COMP_NONE:
@@ -436,11 +436,12 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end,
}
#endif /* CONFIG_LZMA */
#ifdef CONFIG_LZO
- case IH_COMP_LZO:
+ case IH_COMP_LZO: {
+ size_t size;
+
printf(" Uncompressing %s ... ", type_name);
- ret = lzop_decompress(image_buf, image_len, load_buf,
- &unc_len);
+ ret = lzop_decompress(image_buf, image_len, load_buf, &size);
if (ret != LZO_E_OK) {
printf("LZO: uncompress or overwrite error %d "
"- must RESET board to recover\n", ret);
@@ -449,8 +450,9 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end,
return BOOTM_ERR_RESET;
}
- *load_end = load + unc_len;
+ *load_end = load + size;
break;
+ }
#endif /* CONFIG_LZO */
default:
printf("Unimplemented compression type %d\n", comp);
diff --git a/common/cmd_i2c.c b/common/cmd_i2c.c
index 29f5181ba..ebce7d4c3 100644
--- a/common/cmd_i2c.c
+++ b/common/cmd_i2c.c
@@ -1438,10 +1438,12 @@ int do_i2c_bus_num(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
printf("Current bus is %d\n", i2c_get_bus_num());
else {
bus_no = simple_strtoul(argv[1], NULL, 10);
+#if defined(CONFIG_SYS_I2C)
if (bus_no >= CONFIG_SYS_NUM_I2C_BUSES) {
printf("Invalid bus %d\n", bus_no);
return -1;
}
+#endif
printf("Setting bus to %d\n", bus_no);
ret = i2c_set_bus_num(bus_no);
if (ret)
diff --git a/common/cmd_ximg.c b/common/cmd_ximg.c
index b439be3d0..65a831966 100644
--- a/common/cmd_ximg.c
+++ b/common/cmd_ximg.c
@@ -20,6 +20,7 @@
#include <bzlib.h>
#endif
#include <asm/byteorder.h>
+#include <asm/io.h>
#ifndef CONFIG_SYS_XIMG_LEN
/* use 8MByte as default max gunzip size */
@@ -34,7 +35,7 @@ do_imgextract(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
ulong data, len, count;
int verify;
int part = 0;
- image_header_t *hdr;
+ image_header_t *hdr = NULL;
#if defined(CONFIG_FIT)
const char *uname = NULL;
const void* fit_hdr;
@@ -222,7 +223,7 @@ do_imgextract(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
* which requires at most 2300 KB of memory.
*/
i = BZ2_bzBuffToBuffDecompress(
- (char *)ntohl(hdr->ih_load),
+ map_sysmem(ntohl(hdr->ih_load), 0),
&unc_len, (char *)data, len,
CONFIG_SYS_MALLOC_LEN < (4096 * 1024),
0);
diff --git a/common/image.c b/common/image.c
index 56a5a626e..2c88091e6 100644
--- a/common/image.c
+++ b/common/image.c
@@ -135,6 +135,7 @@ static const table_entry_t uimage_type[] = {
{ IH_TYPE_SCRIPT, "script", "Script", },
{ IH_TYPE_STANDALONE, "standalone", "Standalone Program", },
{ IH_TYPE_UBLIMAGE, "ublimage", "Davinci UBL image",},
+ { IH_TYPE_MXSIMAGE, "mxsimage", "Freescale MXS Boot Image",},
{ -1, "", "", },
};
diff --git a/common/usb.c b/common/usb.c
index f740e5ec2..c97f522be 100644
--- a/common/usb.c
+++ b/common/usb.c
@@ -323,6 +323,7 @@ static int usb_set_maxpacket(struct usb_device *dev)
/*******************************************************************************
* Parse the config, located in buffer, and fills the dev->config structure.
* Note that all little/big endian swapping are done automatically.
+ * (wTotalLength has already been swapped and sanitized when it was read.)
*/
static int usb_parse_config(struct usb_device *dev,
unsigned char *buffer, int cfgno)
@@ -343,24 +344,43 @@ static int usb_parse_config(struct usb_device *dev,
head->bDescriptorType);
return -1;
}
- memcpy(&dev->config, buffer, buffer[0]);
- le16_to_cpus(&(dev->config.desc.wTotalLength));
+ if (head->bLength != USB_DT_CONFIG_SIZE) {
+ printf("ERROR: Invalid USB CFG length (%d)\n", head->bLength);
+ return -1;
+ }
+ memcpy(&dev->config, head, USB_DT_CONFIG_SIZE);
dev->config.no_of_if = 0;
index = dev->config.desc.bLength;
/* Ok the first entry must be a configuration entry,
* now process the others */
head = (struct usb_descriptor_header *) &buffer[index];
- while (index + 1 < dev->config.desc.wTotalLength) {
+ while (index + 1 < dev->config.desc.wTotalLength && head->bLength) {
switch (head->bDescriptorType) {
case USB_DT_INTERFACE:
+ if (head->bLength != USB_DT_INTERFACE_SIZE) {
+ printf("ERROR: Invalid USB IF length (%d)\n",
+ head->bLength);
+ break;
+ }
+ if (index + USB_DT_INTERFACE_SIZE >
+ dev->config.desc.wTotalLength) {
+ puts("USB IF descriptor overflowed buffer!\n");
+ break;
+ }
if (((struct usb_interface_descriptor *) \
- &buffer[index])->bInterfaceNumber != curr_if_num) {
+ head)->bInterfaceNumber != curr_if_num) {
/* this is a new interface, copy new desc */
ifno = dev->config.no_of_if;
+ if (ifno >= USB_MAXINTERFACES) {
+ puts("Too many USB interfaces!\n");
+ /* try to go on with what we have */
+ return 1;
+ }
if_desc = &dev->config.if_desc[ifno];
dev->config.no_of_if++;
- memcpy(if_desc, &buffer[index], buffer[index]);
+ memcpy(if_desc, head,
+ USB_DT_INTERFACE_SIZE);
if_desc->no_of_ep = 0;
if_desc->num_altsetting = 1;
curr_if_num =
@@ -374,12 +394,31 @@ static int usb_parse_config(struct usb_device *dev,
}
break;
case USB_DT_ENDPOINT:
+ if (head->bLength != USB_DT_ENDPOINT_SIZE) {
+ printf("ERROR: Invalid USB EP length (%d)\n",
+ head->bLength);
+ break;
+ }
+ if (index + USB_DT_ENDPOINT_SIZE >
+ dev->config.desc.wTotalLength) {
+ puts("USB EP descriptor overflowed buffer!\n");
+ break;
+ }
+ if (ifno < 0) {
+ puts("Endpoint descriptor out of order!\n");
+ break;
+ }
epno = dev->config.if_desc[ifno].no_of_ep;
if_desc = &dev->config.if_desc[ifno];
+ if (epno > USB_MAXENDPOINTS) {
+ printf("Interface %d has too many endpoints!\n",
+ if_desc->desc.bInterfaceNumber);
+ return 1;
+ }
/* found an endpoint */
if_desc->no_of_ep++;
- memcpy(&if_desc->ep_desc[epno],
- &buffer[index], buffer[index]);
+ memcpy(&if_desc->ep_desc[epno], head,
+ USB_DT_ENDPOINT_SIZE);
ep_wMaxPacketSize = get_unaligned(&dev->config.\
if_desc[ifno].\
ep_desc[epno].\
@@ -392,9 +431,23 @@ static int usb_parse_config(struct usb_device *dev,
debug("if %d, ep %d\n", ifno, epno);
break;
case USB_DT_SS_ENDPOINT_COMP:
+ if (head->bLength != USB_DT_SS_EP_COMP_SIZE) {
+ printf("ERROR: Invalid USB EPC length (%d)\n",
+ head->bLength);
+ break;
+ }
+ if (index + USB_DT_SS_EP_COMP_SIZE >
+ dev->config.desc.wTotalLength) {
+ puts("USB EPC descriptor overflowed buffer!\n");
+ break;
+ }
+ if (ifno < 0 || epno < 0) {
+ puts("EPC descriptor out of order!\n");
+ break;
+ }
if_desc = &dev->config.if_desc[ifno];
- memcpy(&if_desc->ss_ep_comp_desc[epno],
- &buffer[index], buffer[index]);
+ memcpy(&if_desc->ss_ep_comp_desc[epno], head,
+ USB_DT_SS_EP_COMP_SIZE);
break;
default:
if (head->bLength == 0)
@@ -473,7 +526,7 @@ int usb_get_configuration_no(struct usb_device *dev,
unsigned char *buffer, int cfgno)
{
int result;
- unsigned int tmp;
+ unsigned int length;
struct usb_config_descriptor *config;
config = (struct usb_config_descriptor *)&buffer[0];
@@ -487,16 +540,18 @@ int usb_get_configuration_no(struct usb_device *dev,
"(expected %i, got %i)\n", 9, result);
return -1;
}
- tmp = le16_to_cpu(config->wTotalLength);
+ length = le16_to_cpu(config->wTotalLength);
- if (tmp > USB_BUFSIZ) {
- printf("usb_get_configuration_no: failed to get " \
- "descriptor - too long: %d\n", tmp);
+ if (length > USB_BUFSIZ) {
+ printf("%s: failed to get descriptor - too long: %d\n",
+ __func__, length);
return -1;
}
- result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, buffer, tmp);
- debug("get_conf_no %d Result %d, wLength %d\n", cfgno, result, tmp);
+ result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, buffer, length);
+ debug("get_conf_no %d Result %d, wLength %d\n", cfgno, result, length);
+ config->wTotalLength = length; /* validated, with CPU byte order */
+
return result;
}
diff --git a/common/usb_hub.c b/common/usb_hub.c
index a11b401e6..ffac0e743 100644
--- a/common/usb_hub.c
+++ b/common/usb_hub.c
@@ -44,6 +44,10 @@
static struct usb_hub_device hub_dev[USB_MAX_HUB];
static int usb_hub_index;
+__weak void usb_hub_reset_devices(int port)
+{
+ return;
+}
static int usb_get_hub_descriptor(struct usb_device *dev, void *data, int size)
{
@@ -302,7 +306,7 @@ void usb_hub_port_connect_change(struct usb_device *dev, int port)
static int usb_hub_configure(struct usb_device *dev)
{
- int i;
+ int i, length;
ALLOC_CACHE_ALIGN_BUFFER(unsigned char, buffer, USB_BUFSIZ);
unsigned char *bitmap;
short hubCharacteristics;
@@ -323,20 +327,14 @@ static int usb_hub_configure(struct usb_device *dev)
}
descriptor = (struct usb_hub_descriptor *)buffer;
- /* silence compiler warning if USB_BUFSIZ is > 256 [= sizeof(char)] */
- i = descriptor->bLength;
- if (i > USB_BUFSIZ) {
- debug("usb_hub_configure: failed to get hub " \
- "descriptor - too long: %d\n", descriptor->bLength);
- return -1;
- }
+ length = min(descriptor->bLength, sizeof(struct usb_hub_descriptor));
- if (usb_get_hub_descriptor(dev, buffer, descriptor->bLength) < 0) {
+ if (usb_get_hub_descriptor(dev, buffer, length) < 0) {
debug("usb_hub_configure: failed to get hub " \
"descriptor 2nd giving up %lX\n", dev->status);
return -1;
}
- memcpy((unsigned char *)&hub->desc, buffer, descriptor->bLength);
+ memcpy((unsigned char *)&hub->desc, buffer, length);
/* adjust 16bit values */
put_unaligned(le16_to_cpu(get_unaligned(
&descriptor->wHubCharacteristics)),
@@ -426,6 +424,14 @@ static int usb_hub_configure(struct usb_device *dev)
"" : "no ");
usb_hub_power_on(hub);
+ /*
+ * Reset any devices that may be in a bad state when applying
+ * the power. This is a __weak function. Resetting of the devices
+ * should occur in the board file of the device.
+ */
+ for (i = 0; i < dev->maxchild; i++)
+ usb_hub_reset_devices(i + 1);
+
for (i = 0; i < dev->maxchild; i++) {
ALLOC_CACHE_ALIGN_BUFFER(struct usb_port_status, portsts, 1);
unsigned short portstatus, portchange;
diff --git a/common/usb_kbd.c b/common/usb_kbd.c
index 2ca3767ec..1ad67caf1 100644
--- a/common/usb_kbd.c
+++ b/common/usb_kbd.c
@@ -104,6 +104,11 @@ struct usb_kbd_pdata {
uint8_t flags;
};
+extern int __maybe_unused net_busy_flag;
+
+/* The period of time between two calls of usb_kbd_testc(). */
+static unsigned long __maybe_unused kbd_testc_tms;
+
/* Generic keyboard event polling. */
void usb_kbd_generic_poll(void)
{
@@ -349,6 +354,16 @@ static int usb_kbd_testc(void)
struct usb_device *usb_kbd_dev;
struct usb_kbd_pdata *data;
+#ifdef CONFIG_CMD_NET
+ /*
+ * If net_busy_flag is 1, NET transfer is running,
+ * then we check key-pressed every second (first check may be
+ * less than 1 second) to improve TFTP booting performance.
+ */
+ if (net_busy_flag && (get_timer(kbd_testc_tms) < CONFIG_SYS_HZ))
+ return 0;
+ kbd_testc_tms = get_timer(0);
+#endif
dev = stdio_get_by_name(DEVNAME);
usb_kbd_dev = (struct usb_device *)dev->priv;
data = usb_kbd_dev->privptr;
generated by cgit v1.2.3-70-g09d2 (git 2.51.2) at 2025-11-04 09:08:48 +0000