u-boot: Fix DFU upload in u-boot

u-boot: Fix DFU upload in u-boot

Fix DFU upload in u-boot

The existing USB DFU upload (read firmware from device to USB host) code
was a big mess and probably only ever worked by accident.

specifically, there were three bugs described in
http://docs.openmoko.org/trac/ticket/1843 :

* when it copies a new blockful of data, it copies it into the same buffer that
  urb->buffer was already pointing to, thus overwriting the beginning of the
  last buffer before it is sent back to the requestor

* it then calls memcpy() to copy the beginning of the newly-read block to after
  the end of the buffer that urb->buffer is pointing to. If ds->nand->erasesize
  is the same as the _buf[] array, then this will write past the end of the
  _buf[] array and smash some other item in RAM.

* if a requested buffer exactly reaches the end of the block that's been
  buffered in ds->buf, then handle_upload() will read a new NAND block into the
  buffer even though it is not needed. (The test for (len > remain) should
  probably go before the test for ds->ptr, not after?)

So instead of fixing those issues individually, I rewored the logic
for how to deal with DFU upload. Much simpler, and without those bugs.

Signed-off-by: Harald Welte <laforge@openmoko.org>