The hard-coded 4096-byte EP_BUFFER_SIZE limits the maximum length of a
fastboot command received over USB. Long "oem run" commands, such as
a multi-partition "gpt write", can exceed that and get rejected with
"buffer overflow".

Make the buffer size configurable via CONFIG_FASTBOOT_EP_BUFFER_SIZE,
defaulting to 4096. The value must stay a multiple of the endpoint's
maxpacket size.

Signed-off-by: Sumit Singh Dhami <[email protected]>
---
 drivers/fastboot/Kconfig        | 14 ++++++++++++++
 drivers/usb/gadget/f_fastboot.c |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/fastboot/Kconfig b/drivers/fastboot/Kconfig
index a4539844d89..32609fddecb 100644
--- a/drivers/fastboot/Kconfig
+++ b/drivers/fastboot/Kconfig
@@ -49,6 +49,20 @@ config TCP_FUNCTION_FASTBOOT
 
 if FASTBOOT
 
+config FASTBOOT_EP_BUFFER_SIZE
+       hex "Fastboot bulk endpoint buffer size"
+       default 0x1000
+       help
+         Size of the buffer used for fastboot bulk endpoint transfers.
+         This bounds both the maximum length of a fastboot command received
+         over USB and the chunk size used during the download data phase.
+         A larger value is needed to accept long commands, for example
+         "oem run" with a large command string.
+
+         Must be an integral multiple of the endpoint maxpacket size (64,
+         512 or 1024 bytes), otherwise transfers break on controllers such
+         as DWC3.
+
 config FASTBOOT_BUF_ADDR
        hex "Define FASTBOOT buffer address"
        default 0x82000000 if MX6SX || MX6SL || MX6UL || MX6SLL
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c
index 8df0e3f331d..d65ed1c70a4 100644
--- a/drivers/usb/gadget/f_fastboot.c
+++ b/drivers/usb/gadget/f_fastboot.c
@@ -31,7 +31,7 @@
 #define RX_ENDPOINT_MAXIMUM_PACKET_SIZE_1_1  (0x0040)
 #define TX_ENDPOINT_MAXIMUM_PACKET_SIZE      (0x0040)
 
-#define EP_BUFFER_SIZE                 4096
+#define EP_BUFFER_SIZE         CONFIG_FASTBOOT_EP_BUFFER_SIZE
 /*
  * EP_BUFFER_SIZE must always be an integral multiple of maxpacket size
  * (64 or 512 or 1024), else we break on certain controllers like DWC3
-- 
2.55.0

Reply via email to