1 /*
2 * Copyright 2017 Rockchip Electronics Co., Ltd
3 * Frank Wang <frank.wang@rock-chips.com>
4 *
5 * SPDX-License-Identifier: GPL-2.0+
6 */
7
8 #include <asm/io.h>
9 #include <android_avb/avb_ops_user.h>
10 #include <android_avb/rk_avb_ops_user.h>
11 #include <asm/arch/boot_mode.h>
12 #include <asm/arch/chip_info.h>
13 #include <asm/arch/rk_atags.h>
14 #include <write_keybox.h>
15 #include <linux/mtd/mtd.h>
16 #include <optee_include/OpteeClientInterface.h>
17 #include <dm.h>
18 #include <misc.h>
19 #include <mmc.h>
20 #include <scsi.h>
21 #include <stdlib.h>
22 #include <usbplug.h>
23 #include <asm/arch/vendor.h>
24 #include <rockusb.h>
25
26 #define ROCKUSB_INTERFACE_CLASS 0xff
27 #define ROCKUSB_INTERFACE_SUB_CLASS 0x06
28 #define ROCKUSB_INTERFACE_PROTOCOL 0x05
29
30 #define ROCKCHIP_FLASH_BLOCK_SIZE 1024
31 #define ROCKCHIP_FLASH_PAGE_SIZE 4
32
33 static struct usb_interface_descriptor rkusb_intf_desc = {
34 .bLength = USB_DT_INTERFACE_SIZE,
35 .bDescriptorType = USB_DT_INTERFACE,
36 .bInterfaceNumber = 0x00,
37 .bAlternateSetting = 0x00,
38 .bNumEndpoints = 0x02,
39 .bInterfaceClass = ROCKUSB_INTERFACE_CLASS,
40 .bInterfaceSubClass = ROCKUSB_INTERFACE_SUB_CLASS,
41 .bInterfaceProtocol = ROCKUSB_INTERFACE_PROTOCOL,
42 };
43
44 static struct usb_descriptor_header *rkusb_fs_function[] = {
45 (struct usb_descriptor_header *)&rkusb_intf_desc,
46 (struct usb_descriptor_header *)&fsg_fs_bulk_in_desc,
47 (struct usb_descriptor_header *)&fsg_fs_bulk_out_desc,
48 NULL,
49 };
50
51 static struct usb_descriptor_header *rkusb_hs_function[] = {
52 (struct usb_descriptor_header *)&rkusb_intf_desc,
53 (struct usb_descriptor_header *)&fsg_hs_bulk_in_desc,
54 (struct usb_descriptor_header *)&fsg_hs_bulk_out_desc,
55 NULL,
56 };
57
58 static struct usb_descriptor_header *rkusb_ss_function[] = {
59 (struct usb_descriptor_header *)&rkusb_intf_desc,
60 (struct usb_descriptor_header *)&fsg_ss_bulk_in_desc,
61 (struct usb_descriptor_header *)&fsg_ss_bulk_in_comp_desc,
62 (struct usb_descriptor_header *)&fsg_ss_bulk_out_desc,
63 (struct usb_descriptor_header *)&fsg_ss_bulk_out_comp_desc,
64 NULL,
65 };
66
67 struct rk_flash_info {
68 u32 flash_size;
69 u16 block_size;
70 u8 page_size;
71 u8 ecc_bits;
72 u8 access_time;
73 u8 manufacturer;
74 u8 flash_mask;
75 } __packed;
76
77 static int rkusb_rst_code; /* The subcode in reset command (0xFF) */
78
g_dnl_bind_fixup(struct usb_device_descriptor * dev,const char * name)79 int g_dnl_bind_fixup(struct usb_device_descriptor *dev, const char *name)
80 {
81 if (IS_RKUSB_UMS_DNL(name)) {
82 /* Fix to Rockchip's VID and PID */
83 dev->idVendor = __constant_cpu_to_le16(0x2207);
84 dev->idProduct = __constant_cpu_to_le16(CONFIG_ROCKUSB_G_DNL_PID);
85
86 /* Enumerate as a loader device */
87 #if defined(CONFIG_SUPPORT_USBPLUG)
88 dev->bcdUSB = cpu_to_le16(0x0200);
89 #else
90 dev->bcdUSB = cpu_to_le16(0x0201);
91 #endif
92 } else if (!strncmp(name, "usb_dnl_fastboot", 16)) {
93 /* Fix to Google's VID and PID */
94 dev->idVendor = __constant_cpu_to_le16(0x18d1);
95 dev->idProduct = __constant_cpu_to_le16(0x4d00);
96 } else if (!strncmp(name, "usb_dnl_dfu", 11)) {
97 /* Fix to Rockchip's VID and PID for DFU */
98 dev->idVendor = cpu_to_le16(0x2207);
99 dev->idProduct = cpu_to_le16(0x0107);
100 } else if (!strncmp(name, "usb_dnl_ums", 11)) {
101 dev->idVendor = cpu_to_le16(0x2207);
102 dev->idProduct = cpu_to_le16(0x0010);
103 }
104
105 return 0;
106 }
107
108 __maybe_unused
dump_cbw(struct fsg_bulk_cb_wrap * cbw)109 static inline void dump_cbw(struct fsg_bulk_cb_wrap *cbw)
110 {
111 assert(!cbw);
112
113 debug("%s:\n", __func__);
114 debug("Signature %x\n", cbw->Signature);
115 debug("Tag %x\n", cbw->Tag);
116 debug("DataTransferLength %x\n", cbw->DataTransferLength);
117 debug("Flags %x\n", cbw->Flags);
118 debug("LUN %x\n", cbw->Lun);
119 debug("Length %x\n", cbw->Length);
120 debug("OptionCode %x\n", cbw->CDB[0]);
121 debug("SubCode %x\n", cbw->CDB[1]);
122 debug("SectorAddr %x\n", get_unaligned_be32(&cbw->CDB[2]));
123 debug("BlkSectors %x\n\n", get_unaligned_be16(&cbw->CDB[7]));
124 }
125
rkusb_check_lun(struct fsg_common * common)126 static int rkusb_check_lun(struct fsg_common *common)
127 {
128 struct fsg_lun *curlun;
129
130 /* Check the LUN */
131 if (common->lun >= 0 && common->lun < common->nluns) {
132 curlun = &common->luns[common->lun];
133 if (common->cmnd[0] != SC_REQUEST_SENSE) {
134 curlun->sense_data = SS_NO_SENSE;
135 curlun->info_valid = 0;
136 }
137 } else {
138 curlun = NULL;
139 common->bad_lun_okay = 0;
140
141 /*
142 * INQUIRY and REQUEST SENSE commands are explicitly allowed
143 * to use unsupported LUNs; all others may not.
144 */
145 if (common->cmnd[0] != SC_INQUIRY &&
146 common->cmnd[0] != SC_REQUEST_SENSE) {
147 debug("unsupported LUN %d\n", common->lun);
148 return -EINVAL;
149 }
150 }
151
152 return 0;
153 }
154
__do_reset(struct usb_ep * ep,struct usb_request * req)155 static void __do_reset(struct usb_ep *ep, struct usb_request *req)
156 {
157 u32 boot_flag = BOOT_NORMAL;
158
159 if (rkusb_rst_code == 0x03)
160 boot_flag = BOOT_BROM_DOWNLOAD;
161 else if (rkusb_rst_code == 0x06)
162 boot_flag = BOOT_LOADER;
163
164 rkusb_rst_code = 0; /* restore to default */
165 writel(boot_flag, (void *)CONFIG_ROCKCHIP_BOOT_MODE_REG);
166
167 do_reset(NULL, 0, 0, NULL);
168 }
169
rkusb_do_reset(struct fsg_common * common,struct fsg_buffhd * bh)170 static int rkusb_do_reset(struct fsg_common *common,
171 struct fsg_buffhd *bh)
172 {
173 common->data_size_from_cmnd = common->cmnd[4];
174 common->residue = 0;
175 bh->inreq->complete = __do_reset;
176 bh->state = BUF_STATE_EMPTY;
177
178 rkusb_rst_code = !common->cmnd[1] ? 0xff : common->cmnd[1];
179 return 0;
180 }
181
rkusb_usb3_capable(void)182 __weak bool rkusb_usb3_capable(void)
183 {
184 return false;
185 }
186
rkusb_do_switch_to_usb3(struct fsg_common * common,struct fsg_buffhd * bh)187 static int rkusb_do_switch_to_usb3(struct fsg_common *common,
188 struct fsg_buffhd *bh)
189 {
190 g_dnl_set_serialnumber((char *)&common->cmnd[1]);
191 rkusb_switch_to_usb3_enable(true);
192 bh->state = BUF_STATE_EMPTY;
193
194 return 0;
195 }
196
rkusb_do_test_unit_ready(struct fsg_common * common,struct fsg_buffhd * bh)197 static int rkusb_do_test_unit_ready(struct fsg_common *common,
198 struct fsg_buffhd *bh)
199 {
200 struct blk_desc *desc = &ums[common->lun].block_dev;
201 u32 usb_trb_size;
202 u16 residue;
203
204 if ((desc->if_type == IF_TYPE_MTD && desc->devnum == BLK_MTD_SPI_NOR) ||
205 desc->if_type == IF_TYPE_SPINOR)
206 residue = 0x03; /* 128KB Max block xfer for SPI Nor */
207 else if (common->cmnd[1] == 0xf7 && FSG_BUFLEN >= 0x400000)
208 residue = 0x0a; /* Max block xfer for USB DWC3 */
209 else
210 residue = 0x06; /* Max block xfer support from host */
211
212 usb_trb_size = (1 << residue) * 4096;
213 common->usb_trb_size = min(usb_trb_size, FSG_BUFLEN);
214 common->residue = residue << 24;
215 common->data_dir = DATA_DIR_NONE;
216 bh->state = BUF_STATE_EMPTY;
217
218 return 0;
219 }
220
rkusb_do_read_flash_id(struct fsg_common * common,struct fsg_buffhd * bh)221 static int rkusb_do_read_flash_id(struct fsg_common *common,
222 struct fsg_buffhd *bh)
223 {
224 u8 *buf = (u8 *)bh->buf;
225 u32 len = 5;
226 enum if_type type = ums[common->lun].block_dev.if_type;
227 u32 devnum = ums[common->lun].block_dev.devnum;
228 const char *str;
229
230 switch (type) {
231 case IF_TYPE_MMC:
232 str = "EMMC ";
233 break;
234 case IF_TYPE_RKNAND:
235 str = "NAND ";
236 break;
237 case IF_TYPE_MTD:
238 if (devnum == BLK_MTD_SPI_NAND)
239 str ="SNAND";
240 else if (devnum == BLK_MTD_NAND)
241 str = "NAND ";
242 else
243 str = "NOR ";
244 break;
245 case IF_TYPE_SCSI:
246 str = "SATA ";
247 break;
248 case IF_TYPE_NVME:
249 str = "PCIE ";
250 break;
251 default:
252 str = "UNKN "; /* unknown */
253 break;
254 }
255
256 memcpy((void *)&buf[0], str, len);
257
258 /* Set data xfer size */
259 common->residue = common->data_size_from_cmnd = len;
260 common->data_size = len;
261
262 return len;
263 }
264
rkusb_do_test_bad_block(struct fsg_common * common,struct fsg_buffhd * bh)265 static int rkusb_do_test_bad_block(struct fsg_common *common,
266 struct fsg_buffhd *bh)
267 {
268 u8 *buf = (u8 *)bh->buf;
269 u32 len = 64;
270
271 memset((void *)&buf[0], 0, len);
272
273 /* Set data xfer size */
274 common->residue = common->data_size_from_cmnd = len;
275 common->data_size = len;
276
277 return len;
278 }
279
rkusb_do_read_flash_info(struct fsg_common * common,struct fsg_buffhd * bh)280 static int rkusb_do_read_flash_info(struct fsg_common *common,
281 struct fsg_buffhd *bh)
282 {
283 struct blk_desc *desc = &ums[common->lun].block_dev;
284 u8 *buf = (u8 *)bh->buf;
285 u32 len = sizeof(struct rk_flash_info);
286 struct rk_flash_info finfo = {
287 .block_size = ROCKCHIP_FLASH_BLOCK_SIZE,
288 .ecc_bits = 0,
289 .page_size = ROCKCHIP_FLASH_PAGE_SIZE,
290 .access_time = 40,
291 .manufacturer = 0,
292 .flash_mask = 0
293 };
294
295 /* Set the raw block size for tools to creat GPT with 4K block size */
296 if (desc->rawblksz == 0x1000)
297 finfo.manufacturer = 208;
298
299 finfo.flash_size = (u32)desc->lba;
300
301 if (desc->if_type == IF_TYPE_MTD &&
302 (desc->devnum == BLK_MTD_NAND ||
303 desc->devnum == BLK_MTD_SPI_NAND)) {
304 struct mtd_info *mtd = (struct mtd_info *)desc->bdev->priv;
305
306 if (mtd) {
307 finfo.block_size = mtd->erasesize >> 9;
308 finfo.page_size = mtd->writesize >> 9;
309 #ifdef CONFIG_SUPPORT_USBPLUG
310 /* Using 4KB pagesize as 2KB for idblock */
311 if (finfo.page_size == 8 && desc->devnum == BLK_MTD_SPI_NAND)
312 finfo.page_size |= (4 << 4);
313 #endif
314 }
315 }
316
317 if (desc->if_type == IF_TYPE_MTD && desc->devnum == BLK_MTD_SPI_NOR) {
318 /* RV1126 mtd spinor keep the former upgrade mode */
319 #if !defined(CONFIG_ROCKCHIP_RV1126)
320 finfo.block_size = 0x80; /* Aligned to 64KB */
321 #else
322 finfo.block_size = ROCKCHIP_FLASH_BLOCK_SIZE;
323 #endif
324 #if defined(CONFIG_ROCKCHIP_RK3308)
325 } else if (desc->if_type == IF_TYPE_SPINOR) {
326 finfo.block_size = 0x80; /* Aligned to 64KB */
327 #endif
328 }
329
330 debug("Flash info: block_size= %x page_size= %x\n", finfo.block_size,
331 finfo.page_size);
332
333 if (finfo.flash_size)
334 finfo.flash_mask = 1;
335
336 memset((void *)&buf[0], 0, len);
337 memcpy((void *)&buf[0], (void *)&finfo, len);
338
339 /* Set data xfer size */
340 common->residue = common->data_size_from_cmnd = len;
341 /* legacy upgrade_tool does not set correct transfer size */
342 common->data_size = len;
343
344 return len;
345 }
346
rkusb_do_get_chip_info(struct fsg_common * common,struct fsg_buffhd * bh)347 static int rkusb_do_get_chip_info(struct fsg_common *common,
348 struct fsg_buffhd *bh)
349 {
350 u8 *buf = (u8 *)bh->buf;
351 u32 len = common->data_size;
352 u32 chip_info[4];
353
354 memset((void *)chip_info, 0, sizeof(chip_info));
355 rockchip_rockusb_get_chip_info(chip_info);
356
357 memset((void *)&buf[0], 0, len);
358 memcpy((void *)&buf[0], (void *)chip_info, len);
359
360 /* Set data xfer size */
361 common->residue = common->data_size_from_cmnd = len;
362
363 return len;
364 }
365
rkusb_do_lba_erase(struct fsg_common * common,struct fsg_buffhd * bh)366 static int rkusb_do_lba_erase(struct fsg_common *common,
367 struct fsg_buffhd *bh)
368 {
369 struct fsg_lun *curlun = &common->luns[common->lun];
370 u32 lba, amount;
371 loff_t file_offset;
372 int rc;
373
374 lba = get_unaligned_be32(&common->cmnd[2]);
375 if (lba >= curlun->num_sectors) {
376 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
377 rc = -EINVAL;
378 goto out;
379 }
380
381 file_offset = ((loff_t) lba) << 9;
382 amount = get_unaligned_be16(&common->cmnd[7]) << 9;
383 if (unlikely(amount == 0)) {
384 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
385 rc = -EIO;
386 goto out;
387 }
388
389 /* Perform the erase */
390 rc = ums[common->lun].erase_sector(&ums[common->lun],
391 file_offset / SECTOR_SIZE,
392 amount / SECTOR_SIZE);
393 if (!rc) {
394 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
395 rc = -EIO;
396 }
397
398 out:
399 common->data_dir = DATA_DIR_NONE;
400 bh->state = BUF_STATE_EMPTY;
401
402 return rc;
403 }
404
rkusb_do_erase_force(struct fsg_common * common,struct fsg_buffhd * bh)405 static int rkusb_do_erase_force(struct fsg_common *common,
406 struct fsg_buffhd *bh)
407 {
408 struct blk_desc *desc = &ums[common->lun].block_dev;
409 struct fsg_lun *curlun = &common->luns[common->lun];
410 u16 block_size = ROCKCHIP_FLASH_BLOCK_SIZE;
411 u32 lba, amount;
412 loff_t file_offset;
413 int rc;
414
415 lba = get_unaligned_be32(&common->cmnd[2]);
416 if (lba >= curlun->num_sectors) {
417 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
418 rc = -EINVAL;
419 goto out;
420 }
421
422 if (desc->if_type == IF_TYPE_MTD &&
423 (desc->devnum == BLK_MTD_NAND ||
424 desc->devnum == BLK_MTD_SPI_NAND)) {
425 struct mtd_info *mtd = (struct mtd_info *)desc->bdev->priv;
426
427 if (mtd)
428 block_size = mtd->erasesize >> 9;
429 }
430
431 file_offset = ((loff_t)lba) * block_size;
432 amount = get_unaligned_be16(&common->cmnd[7]) * block_size;
433
434 debug("%s lba= %x, nsec= %x\n", __func__, lba,
435 (u32)get_unaligned_be16(&common->cmnd[7]));
436
437 if (unlikely(amount == 0)) {
438 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
439 rc = -EIO;
440 goto out;
441 }
442
443 /* Perform the erase */
444 rc = ums[common->lun].erase_sector(&ums[common->lun],
445 file_offset,
446 amount);
447 if (!rc) {
448 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
449 rc = -EIO;
450 }
451
452 out:
453 common->data_dir = DATA_DIR_NONE;
454 bh->state = BUF_STATE_EMPTY;
455
456 return rc;
457 }
458
rkusb_do_vs_write(struct fsg_common * common)459 static int rkusb_do_vs_write(struct fsg_common *common)
460 {
461 struct fsg_lun *curlun = &common->luns[common->lun];
462 u16 type = get_unaligned_be16(&common->cmnd[4]);
463 struct vendor_item *vhead;
464 struct fsg_buffhd *bh;
465 void *data;
466 int rc;
467
468 if (common->data_size >= (u32)65536) {
469 /* _MUST_ small than 64K */
470 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
471 return -EINVAL;
472 }
473
474 common->residue = common->data_size;
475 common->usb_amount_left = common->data_size;
476
477 /* Carry out the file writes */
478 if (unlikely(common->data_size == 0))
479 return -EIO; /* No data to write */
480
481 for (;;) {
482 if (common->usb_amount_left > 0) {
483 /* Wait for the next buffer to become available */
484 bh = common->next_buffhd_to_fill;
485 if (bh->state != BUF_STATE_EMPTY)
486 goto wait;
487
488 /* Request the next buffer */
489 common->usb_amount_left -= common->data_size;
490 bh->outreq->length = common->data_size;
491 bh->bulk_out_intended_length = common->data_size;
492 bh->outreq->short_not_ok = 1;
493
494 START_TRANSFER_OR(common, bulk_out, bh->outreq,
495 &bh->outreq_busy, &bh->state)
496 /*
497 * Don't know what to do if
498 * common->fsg is NULL
499 */
500 return -EIO;
501 common->next_buffhd_to_fill = bh->next;
502 } else {
503 /* Then, wait for the data to become available */
504 bh = common->next_buffhd_to_drain;
505 if (bh->state != BUF_STATE_FULL)
506 goto wait;
507
508 common->next_buffhd_to_drain = bh->next;
509 bh->state = BUF_STATE_EMPTY;
510
511 /* Did something go wrong with the transfer? */
512 if (bh->outreq->status != 0) {
513 curlun->sense_data = SS_COMMUNICATION_FAILURE;
514 curlun->info_valid = 1;
515 break;
516 }
517
518 /* Perform the write */
519 vhead = (struct vendor_item *)bh->buf;
520 data = bh->buf + sizeof(struct vendor_item);
521 if (CONFIG_IS_ENABLED(ROCKCHIP_VENDOR_PARTITION) && !type) {
522 #ifndef CONFIG_SUPPORT_USBPLUG
523 if (vhead->id == HDCP_14_HDMI_ID ||
524 vhead->id == HDCP_14_HDMIRX_ID ||
525 vhead->id == HDCP_14_DP_ID) {
526 rc = vendor_handle_hdcp(vhead);
527 if (rc < 0) {
528 curlun->sense_data = SS_WRITE_ERROR;
529 return -EIO;
530 }
531 }
532 #endif
533
534 /* Vendor storage */
535 rc = vendor_storage_write(vhead->id,
536 (char __user *)data,
537 vhead->size);
538 if (rc < 0) {
539 curlun->sense_data = SS_WRITE_ERROR;
540 return -EIO;
541 }
542 } else if (type == 1) {
543 /* RPMB */
544 rc =
545 write_keybox_to_secure_storage((u8 *)data,
546 vhead->size);
547 if (rc < 0) {
548 curlun->sense_data = SS_WRITE_ERROR;
549 return -EIO;
550 }
551 } else if (type == 2) {
552 /* security storage */
553 #ifdef CONFIG_RK_AVB_LIBAVB_USER
554 debug("%s call rk_avb_write_perm_attr %d, %d\n",
555 __func__, vhead->id, vhead->size);
556 rc = rk_avb_write_perm_attr(vhead->id,
557 (char __user *)data,
558 vhead->size);
559 if (rc < 0) {
560 curlun->sense_data = SS_WRITE_ERROR;
561 return -EIO;
562 }
563 #else
564 printf("Please enable CONFIG_RK_AVB_LIBAVB_USER\n");
565 #endif
566 } else if (type == 3) {
567 /* efuse or otp*/
568 #ifdef CONFIG_OPTEE_CLIENT
569 if (memcmp(data, "TAEK", 4) == 0) {
570 if (vhead->size - 8 != 32) {
571 printf("check ta encryption key size fail!\n");
572 curlun->sense_data = SS_WRITE_ERROR;
573 return -EIO;
574 }
575 if (trusty_write_ta_encryption_key((uint32_t *)(data + 8), 8) != 0) {
576 printf("trusty_write_ta_encryption_key error!");
577 curlun->sense_data = SS_WRITE_ERROR;
578 return -EIO;
579 }
580 } else if (memcmp(data, "EHUK", 4) == 0) {
581 if (vhead->size - 8 != 32) {
582 printf("check oem huk size fail!\n");
583 curlun->sense_data = SS_WRITE_ERROR;
584 return -EIO;
585 }
586 if (trusty_write_oem_huk((uint32_t *)(data + 8), 8) != 0) {
587 printf("trusty_write_oem_huk error!");
588 curlun->sense_data = SS_WRITE_ERROR;
589 return -EIO;
590 }
591 } else if (memcmp(data, "ENDA", 4) == 0) {
592 if (vhead->size - 8 != 16) {
593 printf("check oem encrypt data size fail!\n");
594 curlun->sense_data = SS_WRITE_ERROR;
595 return -EIO;
596 }
597 if (trusty_write_oem_encrypt_data((uint32_t *)(data + 8), 4) != 0) {
598 printf("trusty_write_oem_encrypt_data error!");
599 curlun->sense_data = SS_WRITE_ERROR;
600 return -EIO;
601 }
602 } else if (memcmp(data, "OTPK", 4) == 0) {
603 uint32_t key_len = vhead->size - 9;
604 uint8_t key_id = *((uint8_t *)data + 8);
605 if (key_len == 4 && memcmp(data + 9, "lock", 4) == 0) {
606 if (trusty_set_oem_hr_otp_read_lock(key_id) != 0) {
607 printf("trusty_set_oem_hr_otp_read_lock error!");
608 curlun->sense_data = SS_WRITE_ERROR;
609 return -EIO;
610 }
611 } else {
612 if (key_len != 16 && key_len != 24 && key_len != 32) {
613 printf("check oem otp key size fail!\n");
614 curlun->sense_data = SS_WRITE_ERROR;
615 return -EIO;
616 }
617 if (trusty_write_oem_otp_key(key_id, (uint8_t *)(data + 9), key_len) != 0) {
618 printf("trusty_write_oem_otp_key error!");
619 curlun->sense_data = SS_WRITE_ERROR;
620 return -EIO;
621 }
622 }
623 } else if (memcmp(data, "FWEK", 4) == 0) {
624 uint32_t key_len = vhead->size - 9;
625 uint8_t key_id = *((uint8_t *)data + 8);
626 if (key_len == 4 && memcmp(data + 9, "lock", 4) == 0) {
627 if (trusty_set_fw_encrypt_key_mask(key_id) != 0) {
628 printf("trusty_set_fw_encrypt_key_mask error!");
629 curlun->sense_data = SS_WRITE_ERROR;
630 return -EIO;
631 }
632 } else {
633 if (key_len != 16 && key_len != 32) {
634 printf("check FW encrypt key size fail!\n");
635 curlun->sense_data = SS_WRITE_ERROR;
636 return -EIO;
637 }
638 if (trusty_write_fw_encrypt_key(key_id, (uint8_t *)(data + 9), key_len) != 0) {
639 printf("trusty_write_fw_encrypt_key error!");
640 curlun->sense_data = SS_WRITE_ERROR;
641 return -EIO;
642 }
643 }
644 } else {
645 printf("Unknown tag\n");
646 curlun->sense_data = SS_WRITE_ERROR;
647 return -EIO;
648 }
649 #else
650 printf("Please enable CONFIG_OPTEE_CLIENT\n");
651 #endif
652 } else {
653 return -EINVAL;
654 }
655
656 common->residue -= common->data_size;
657
658 /* Did the host decide to stop early? */
659 if (bh->outreq->actual != bh->outreq->length)
660 common->short_packet_received = 1;
661 break; /* Command done */
662 }
663 wait:
664 /* Wait for something to happen */
665 rc = sleep_thread(common);
666 if (rc)
667 return rc;
668 }
669
670 return -EIO; /* No default reply */
671 }
672
rkusb_do_vs_read(struct fsg_common * common)673 static int rkusb_do_vs_read(struct fsg_common *common)
674 {
675 struct fsg_lun *curlun = &common->luns[common->lun];
676 u16 type = get_unaligned_be16(&common->cmnd[4]);
677 struct vendor_item *vhead;
678 struct fsg_buffhd *bh;
679 void *data;
680 int rc;
681
682 if (common->data_size >= (u32)65536) {
683 /* _MUST_ small than 64K */
684 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
685 return -EINVAL;
686 }
687
688 common->residue = common->data_size;
689 common->usb_amount_left = common->data_size;
690
691 /* Carry out the file reads */
692 if (unlikely(common->data_size == 0))
693 return -EIO; /* No default reply */
694
695 for (;;) {
696 /* Wait for the next buffer to become available */
697 bh = common->next_buffhd_to_fill;
698 while (bh->state != BUF_STATE_EMPTY) {
699 rc = sleep_thread(common);
700 if (rc)
701 return rc;
702 }
703
704 memset(bh->buf, 0, FSG_BUFLEN);
705 vhead = (struct vendor_item *)bh->buf;
706 data = bh->buf + sizeof(struct vendor_item);
707 vhead->id = get_unaligned_be16(&common->cmnd[2]);
708 if (CONFIG_IS_ENABLED(ROCKCHIP_VENDOR_PARTITION) && !type) {
709 /* Vendor storage */
710 rc = vendor_storage_read(vhead->id,
711 (char __user *)data,
712 common->data_size);
713 if (!rc) {
714 curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
715 return -EIO;
716 }
717 vhead->size = rc;
718 } else if (type == 1) {
719 /* RPMB */
720 rc =
721 read_raw_data_from_secure_storage((u8 *)data,
722 common->data_size);
723 if (!rc) {
724 curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
725 return -EIO;
726 }
727 vhead->size = rc;
728 } else if (type == 2) {
729 /* security storage */
730 #ifdef CONFIG_RK_AVB_LIBAVB_USER
731 rc = rk_avb_read_perm_attr(vhead->id,
732 (char __user *)data,
733 vhead->size);
734 if (rc < 0)
735 return -EIO;
736 vhead->size = rc;
737 #else
738 printf("Please enable CONFIG_RK_AVB_LIBAVB_USER!\n");
739 #endif
740 } else if (type == 3) {
741 /* efuse or otp*/
742 #ifdef CONFIG_OPTEE_CLIENT
743 if (vhead->id == 120) {
744 u8 value;
745 char *written_str = "key is written!";
746 char *not_written_str = "key is not written!";
747 if (trusty_ta_encryption_key_is_written(&value) != 0) {
748 printf("trusty_ta_encryption_key_is_written error!");
749 return -EIO;
750 }
751 if (value) {
752 memcpy(data, written_str, strlen(written_str));
753 vhead->size = strlen(written_str);
754 } else {
755 memcpy(data, not_written_str, strlen(not_written_str));
756 vhead->size = strlen(not_written_str);
757 }
758 } else {
759 printf("Unknown tag\n");
760 return -EIO;
761 }
762 #else
763 printf("Please enable CONFIG_OPTEE_CLIENT\n");
764 #endif
765 } else {
766 return -EINVAL;
767 }
768
769 common->residue -= common->data_size;
770 bh->inreq->length = common->data_size;
771 bh->state = BUF_STATE_FULL;
772
773 break; /* No more left to read */
774 }
775
776 return -EIO; /* No default reply */
777 }
778
779 #if CONFIG_PSTORE
rkusb_do_uart_debug_read(struct fsg_common * common)780 static int rkusb_do_uart_debug_read(struct fsg_common *common)
781 {
782 struct fsg_buffhd *bh;
783 int *debug_head;
784 int debug_data_size;
785 int rc;
786
787 if (common->data_size >= (u32)FSG_BUFLEN)
788 return -EINVAL;
789
790 common->residue = common->data_size;
791 common->usb_amount_left = common->data_size;
792
793 /* Carry out the file reads */
794 if (unlikely(common->data_size == 0) || unlikely(!gd->pstore_addr))
795 return -EIO; /* No default reply */
796
797 /* Wait for the next buffer to become available */
798 bh = common->next_buffhd_to_fill;
799 while (bh->state != BUF_STATE_EMPTY) {
800 rc = sleep_thread(common);
801 if (rc)
802 return rc;
803 }
804
805 debug_head = (int *)gd->pstore_addr;
806 debug_data_size = debug_head[2];
807 if (debug_data_size > FSG_BUFLEN - 8)
808 debug_data_size = FSG_BUFLEN - 8;
809 if (debug_data_size > common->data_size - 8)
810 debug_data_size = common->data_size - 8;
811
812 debug_head = (int *)bh->buf;
813 debug_head[0] = 0x55424544;
814 debug_head[1] = debug_data_size + 8;
815
816 memcpy((void *)(bh->buf + 8), (void *)(gd->pstore_addr + 12), debug_data_size);
817
818 common->residue -= common->data_size;
819 bh->inreq->length = common->data_size;
820 bh->state = BUF_STATE_FULL;
821
822 return -EIO; /* No default reply */
823 }
824 #endif
825
rkusb_do_switch_storage(struct fsg_common * common)826 static int rkusb_do_switch_storage(struct fsg_common *common)
827 {
828 enum if_type type, cur_type = ums[common->lun].block_dev.if_type;
829 int devnum, cur_devnum = ums[common->lun].block_dev.devnum;
830 struct blk_desc *block_dev;
831 u32 media = BOOT_TYPE_UNKNOWN;
832
833 media = 1 << common->cmnd[1];
834
835 switch (media) {
836 #ifdef CONFIG_MMC
837 case BOOT_TYPE_EMMC:
838 type = IF_TYPE_MMC;
839 devnum = 0;
840 mmc_initialize(gd->bd);
841 break;
842 #endif
843 case BOOT_TYPE_MTD_BLK_NAND:
844 type = IF_TYPE_MTD;
845 devnum = 0;
846 break;
847 case BOOT_TYPE_MTD_BLK_SPI_NAND:
848 type = IF_TYPE_MTD;
849 devnum = 1;
850 break;
851 case BOOT_TYPE_MTD_BLK_SPI_NOR:
852 type = IF_TYPE_MTD;
853 devnum = 2;
854 break;
855 #if defined(CONFIG_SCSI) && defined(CONFIG_CMD_SCSI) && (defined(CONFIG_AHCI) || defined(CONFIG_UFS))
856 case BOOT_TYPE_SATA:
857 type = IF_TYPE_SCSI;
858 devnum = 0;
859 scsi_scan(true);
860 break;
861 #endif
862 case BOOT_TYPE_PCIE:
863 type = IF_TYPE_NVME;
864 devnum = 0;
865 break;
866 default:
867 printf("Bootdev 0x%x is not support\n", media);
868 return -ENODEV;
869 }
870
871 if (cur_type == type && cur_devnum == devnum)
872 return 0;
873
874 #if CONFIG_IS_ENABLED(SUPPORT_USBPLUG)
875 block_dev = usbplug_blk_get_devnum_by_type(type, devnum);
876 #else
877 block_dev = blk_get_devnum_by_type(type, devnum);
878 #endif
879 if (!block_dev) {
880 printf("Bootdev if_type=%d num=%d toggle fail\n", type, devnum);
881 return -ENODEV;
882 }
883
884 common->luns[common->lun].num_sectors = block_dev->lba;
885 ums[common->lun].num_sectors = block_dev->lba;
886 ums[common->lun].block_dev = *block_dev;
887
888 printf("RKUSB: LUN %d, dev %d, hwpart %d, sector %#x, count %#x\n",
889 0,
890 ums[common->lun].block_dev.devnum,
891 ums[common->lun].block_dev.hwpart,
892 ums[common->lun].start_sector,
893 ums[common->lun].num_sectors);
894
895 return 0;
896 }
897
rkusb_do_get_storage_info(struct fsg_common * common,struct fsg_buffhd * bh)898 static int rkusb_do_get_storage_info(struct fsg_common *common,
899 struct fsg_buffhd *bh)
900 {
901 enum if_type type = ums[common->lun].block_dev.if_type;
902 int devnum = ums[common->lun].block_dev.devnum;
903 u32 media = BOOT_TYPE_UNKNOWN;
904 u32 len = common->data_size;
905 u8 *buf = (u8 *)bh->buf;
906
907 if (len > 4)
908 len = 4;
909
910 switch (type) {
911 case IF_TYPE_MMC:
912 media = BOOT_TYPE_EMMC;
913 break;
914
915 case IF_TYPE_SD:
916 media = BOOT_TYPE_SD0;
917 break;
918
919 case IF_TYPE_MTD:
920 if (devnum == BLK_MTD_SPI_NAND)
921 media = BOOT_TYPE_MTD_BLK_SPI_NAND;
922 else if (devnum == BLK_MTD_NAND)
923 media = BOOT_TYPE_NAND;
924 else
925 media = BOOT_TYPE_MTD_BLK_SPI_NOR;
926 break;
927
928 case IF_TYPE_SCSI:
929 media = BOOT_TYPE_SATA;
930 break;
931
932 case IF_TYPE_RKNAND:
933 media = BOOT_TYPE_NAND;
934 break;
935
936 case IF_TYPE_NVME:
937 media = BOOT_TYPE_PCIE;
938 break;
939
940 default:
941 break;
942 }
943
944 memcpy((void *)&buf[0], (void *)&media, len);
945 common->residue = len;
946 common->data_size_from_cmnd = len;
947
948 return len;
949 }
950
rkusb_do_read_capacity(struct fsg_common * common,struct fsg_buffhd * bh)951 static int rkusb_do_read_capacity(struct fsg_common *common,
952 struct fsg_buffhd *bh)
953 {
954 u8 *buf = (u8 *)bh->buf;
955 u32 len = common->data_size;
956 enum if_type type = ums[common->lun].block_dev.if_type;
957 int devnum = ums[common->lun].block_dev.devnum;
958
959 /*
960 * bit[0]: Direct LBA, 0: Disabled;
961 * bit[1]: Vendor Storage API, 0: Disabed (default);
962 * bit[2]: First 4M Access, 0: Disabled;
963 * bit[3]: Read LBA On, 0: Disabed (default);
964 * bit[4]: New Vendor Storage API, 0: Disabed;
965 * bit[5]: Read uart data from ram
966 * bit[6]: Read IDB config
967 * bit[7]: Read SecureMode
968 * bit[8]: New IDB feature
969 * bit[9]: Get storage media info
970 * bit[10]: LBAwrite Parity
971 * bit[11]: Read Otp Data
972 * bit[12]: usb3 download
973 * bit[13]: Write OTP proof
974 * bit[14]: Write Cipher Key
975 * bit[15:63}: Reserved.
976 */
977 memset((void *)&buf[0], 0, len);
978 if (type == IF_TYPE_MMC || type == IF_TYPE_SD || type == IF_TYPE_NVME)
979 buf[0] = BIT(0) | BIT(2) | BIT(4);
980 else
981 buf[0] = BIT(0) | BIT(4);
982
983 if (type == IF_TYPE_MTD &&
984 (devnum == BLK_MTD_NAND ||
985 devnum == BLK_MTD_SPI_NAND))
986 buf[0] |= (1 << 6);
987
988 #ifdef CONFIG_PSTORE
989 buf[0] |= (1 << 5);
990 #endif
991
992 #if !defined(CONFIG_ROCKCHIP_RV1126)
993 if (type == IF_TYPE_MTD && devnum == BLK_MTD_SPI_NOR)
994 buf[0] |= (1 << 6);
995 #if defined(CONFIG_ROCKCHIP_RK3308)
996 else if (type == IF_TYPE_SPINOR)
997 buf[0] |= (1 << 6);
998 #endif
999 #endif
1000
1001 #if defined(CONFIG_ROCKCHIP_NEW_IDB)
1002 buf[1] = BIT(0);
1003 #endif
1004 buf[1] |= BIT(1); /* Switch Storage */
1005 buf[1] |= BIT(2); /* LBAwrite Parity */
1006
1007 if (rkusb_usb3_capable() && !rkusb_force_usb2_enabled())
1008 buf[1] |= BIT(4);
1009 else
1010 buf[1] &= ~BIT(4);
1011
1012 #ifdef CONFIG_ROCKCHIP_OTP
1013 buf[1] |= BIT(3); /* Read Otp Data */
1014 buf[1] |= BIT(5); /* Write OTP proof */
1015 buf[1] |= BIT(6); /* Write Cipher Key */
1016 #endif
1017
1018 /* Set data xfer size */
1019 common->residue = len;
1020 common->data_size_from_cmnd = len;
1021
1022 return len;
1023 }
1024
1025 #ifdef CONFIG_ROCKCHIP_OTP
rkusb_do_read_otp(struct fsg_common * common,struct fsg_buffhd * bh)1026 static int rkusb_do_read_otp(struct fsg_common *common,
1027 struct fsg_buffhd *bh)
1028 {
1029 u32 len = common->data_size;
1030 u32 type = common->cmnd[1];
1031 u8 *buf = (u8 *)bh->buf;
1032 struct udevice *dev;
1033
1034 buf[0] = 0;
1035 if (type == 0) { /* soc uuid */
1036 if (!uclass_get_device_by_driver(UCLASS_MISC, DM_GET_DRIVER(rockchip_otp), &dev)) {
1037 if (!misc_read(dev, CFG_CPUID_OFFSET, (void *)&buf[1], len))
1038 buf[0] = len;
1039 }
1040 }
1041
1042 common->residue = len;
1043 common->data_size_from_cmnd = len;
1044
1045 return len;
1046 }
1047 #endif
1048
rkusb_fixup_cbwcb(struct fsg_common * common,struct fsg_buffhd * bh)1049 static void rkusb_fixup_cbwcb(struct fsg_common *common,
1050 struct fsg_buffhd *bh)
1051 {
1052 struct usb_request *req = bh->outreq;
1053 struct fsg_bulk_cb_wrap *cbw = req->buf;
1054
1055 /* FIXME cbw.DataTransferLength was not set by Upgrade Tool */
1056 common->data_size = le32_to_cpu(cbw->DataTransferLength);
1057 if (common->data_size == 0) {
1058 common->data_size =
1059 get_unaligned_be16(&common->cmnd[7]) << 9;
1060 printf("Trasfer Length NOT set, please use new version tool\n");
1061 debug("%s %d, cmnd1 %x\n", __func__,
1062 get_unaligned_be16(&common->cmnd[7]),
1063 get_unaligned_be16(&common->cmnd[1]));
1064 }
1065 if (cbw->Flags & USB_BULK_IN_FLAG)
1066 common->data_dir = DATA_DIR_TO_HOST;
1067 else
1068 common->data_dir = DATA_DIR_FROM_HOST;
1069
1070 /* Not support */
1071 common->cmnd[1] = 0;
1072 }
1073
rkusb_cmd_process(struct fsg_common * common,struct fsg_buffhd * bh,int * reply)1074 static int rkusb_cmd_process(struct fsg_common *common,
1075 struct fsg_buffhd *bh, int *reply)
1076 {
1077 struct usb_request *req = bh->outreq;
1078 struct fsg_bulk_cb_wrap *cbw = req->buf;
1079 int rc;
1080
1081 dump_cbw(cbw);
1082
1083 if (rkusb_check_lun(common)) {
1084 *reply = -EINVAL;
1085 return RKUSB_RC_ERROR;
1086 }
1087
1088 switch (common->cmnd[0]) {
1089 case RKUSB_TEST_UNIT_READY:
1090 *reply = rkusb_do_test_unit_ready(common, bh);
1091 rc = RKUSB_RC_FINISHED;
1092 break;
1093
1094 case RKUSB_READ_FLASH_ID:
1095 *reply = rkusb_do_read_flash_id(common, bh);
1096 rc = RKUSB_RC_FINISHED;
1097 break;
1098
1099 case RKUSB_TEST_BAD_BLOCK:
1100 *reply = rkusb_do_test_bad_block(common, bh);
1101 rc = RKUSB_RC_FINISHED;
1102 break;
1103
1104 case RKUSB_ERASE_10_FORCE:
1105 *reply = rkusb_do_erase_force(common, bh);
1106 rc = RKUSB_RC_FINISHED;
1107 break;
1108
1109 case RKUSB_LBA_READ_10:
1110 rkusb_fixup_cbwcb(common, bh);
1111 common->cmnd[0] = SC_READ_10;
1112 common->cmnd[1] = 0; /* Not support */
1113 rc = RKUSB_RC_CONTINUE;
1114 break;
1115
1116 case RKUSB_LBA_WRITE_10:
1117 rkusb_fixup_cbwcb(common, bh);
1118 common->cmnd[0] = SC_WRITE_10;
1119 common->cmnd[1] = 0; /* Not support */
1120 rc = RKUSB_RC_CONTINUE;
1121 break;
1122
1123 case RKUSB_READ_FLASH_INFO:
1124 *reply = rkusb_do_read_flash_info(common, bh);
1125 rc = RKUSB_RC_FINISHED;
1126 break;
1127
1128 case RKUSB_GET_CHIP_VER:
1129 *reply = rkusb_do_get_chip_info(common, bh);
1130 rc = RKUSB_RC_FINISHED;
1131 break;
1132
1133 case RKUSB_LBA_ERASE:
1134 *reply = rkusb_do_lba_erase(common, bh);
1135 rc = RKUSB_RC_FINISHED;
1136 break;
1137
1138 case RKUSB_VS_WRITE:
1139 *reply = rkusb_do_vs_write(common);
1140 rc = RKUSB_RC_FINISHED;
1141 break;
1142
1143 case RKUSB_VS_READ:
1144 *reply = rkusb_do_vs_read(common);
1145 rc = RKUSB_RC_FINISHED;
1146 break;
1147
1148 #ifdef CONFIG_PSTORE
1149 case RKUSB_UART_READ:
1150 rkusb_fixup_cbwcb(common, bh);
1151 *reply = rkusb_do_uart_debug_read(common);
1152 rc = RKUSB_RC_FINISHED;
1153 break;
1154 #endif
1155
1156 case RKUSB_SWITCH_STORAGE:
1157 *reply = rkusb_do_switch_storage(common);
1158 rc = RKUSB_RC_FINISHED;
1159 break;
1160
1161 case RKUSB_GET_STORAGE_MEDIA:
1162 *reply = rkusb_do_get_storage_info(common, bh);
1163 rc = RKUSB_RC_FINISHED;
1164 break;
1165
1166 case RKUSB_READ_CAPACITY:
1167 *reply = rkusb_do_read_capacity(common, bh);
1168 rc = RKUSB_RC_FINISHED;
1169 break;
1170
1171 case RKUSB_SWITCH_USB3:
1172 *reply = rkusb_do_switch_to_usb3(common, bh);
1173 rc = RKUSB_RC_FINISHED;
1174 break;
1175
1176 case RKUSB_RESET:
1177 *reply = rkusb_do_reset(common, bh);
1178 rc = RKUSB_RC_FINISHED;
1179 break;
1180
1181 #ifdef CONFIG_ROCKCHIP_OTP
1182 case RKUSB_READ_OTP_DATA:
1183 *reply = rkusb_do_read_otp(common, bh);
1184 rc = RKUSB_RC_FINISHED;
1185 break;
1186 #endif
1187
1188 case RKUSB_READ_10:
1189 case RKUSB_WRITE_10:
1190 printf("CMD Not support, pls use new version Tool\n");
1191 case RKUSB_SET_DEVICE_ID:
1192 case RKUSB_ERASE_10:
1193 case RKUSB_WRITE_SPARE:
1194 case RKUSB_READ_SPARE:
1195 case RKUSB_GET_VERSION:
1196 case RKUSB_ERASE_SYS_DISK:
1197 case RKUSB_SDRAM_READ_10:
1198 case RKUSB_SDRAM_WRITE_10:
1199 case RKUSB_SDRAM_EXECUTE:
1200 case RKUSB_LOW_FORMAT:
1201 case RKUSB_SET_RESET_FLAG:
1202 case RKUSB_SPI_READ_10:
1203 case RKUSB_SPI_WRITE_10:
1204 /* Fall through */
1205 default:
1206 rc = RKUSB_RC_UNKNOWN_CMND;
1207 break;
1208 }
1209
1210 return rc;
1211 }
1212
rkusb_do_check_parity(struct fsg_common * common)1213 int rkusb_do_check_parity(struct fsg_common *common)
1214 {
1215 int ret = 0, rc;
1216 u32 parity, i, usb_parity, lba, len;
1217 static u32 usb_check_buffer[1024 * 256];
1218
1219 usb_parity = common->cmnd[9] | (common->cmnd[10] << 8) |
1220 (common->cmnd[11] << 16) | (common->cmnd[12] << 24);
1221
1222 if (common->cmnd[0] == SC_WRITE_10 && (usb_parity)) {
1223 lba = get_unaligned_be32(&common->cmnd[2]);
1224 len = common->data_size_from_cmnd >> 9;
1225 rc = blk_dread(&ums[common->lun].block_dev, lba, len, usb_check_buffer);
1226 parity = 0x000055aa;
1227 for (i = 0; i < len * 128; i++)
1228 parity += usb_check_buffer[i];
1229 if (!rc || parity != usb_parity)
1230 common->phase_error = 1;
1231 }
1232
1233 return ret;
1234 }
1235
1236 DECLARE_GADGET_BIND_CALLBACK(rkusb_ums_dnl, fsg_add);
1237