1 /* 2 * Copyright 2017 Rockchip Electronics Co., Ltd 3 * Frank Wang <frank.wang@rock-chips.com> 4 * 5 * SPDX-License-Identifier: GPL-2.0+ 6 */ 7 8 #include <asm/io.h> 9 #include <asm/arch/boot_mode.h> 10 #include <asm/arch/chip_info.h> 11 #include <write_keybox.h> 12 13 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 14 #include <asm/arch/vendor.h> 15 #endif 16 17 #include <rockusb.h> 18 19 #define ROCKUSB_INTERFACE_CLASS 0xff 20 #define ROCKUSB_INTERFACE_SUB_CLASS 0x06 21 #define ROCKUSB_INTERFACE_PROTOCOL 0x05 22 23 static struct usb_interface_descriptor rkusb_intf_desc = { 24 .bLength = USB_DT_INTERFACE_SIZE, 25 .bDescriptorType = USB_DT_INTERFACE, 26 .bInterfaceNumber = 0x00, 27 .bAlternateSetting = 0x00, 28 .bNumEndpoints = 0x02, 29 .bInterfaceClass = ROCKUSB_INTERFACE_CLASS, 30 .bInterfaceSubClass = ROCKUSB_INTERFACE_SUB_CLASS, 31 .bInterfaceProtocol = ROCKUSB_INTERFACE_PROTOCOL, 32 }; 33 34 static struct usb_descriptor_header *rkusb_fs_function[] = { 35 (struct usb_descriptor_header *)&rkusb_intf_desc, 36 (struct usb_descriptor_header *)&fsg_fs_bulk_in_desc, 37 (struct usb_descriptor_header *)&fsg_fs_bulk_out_desc, 38 NULL, 39 }; 40 41 static struct usb_descriptor_header *rkusb_hs_function[] = { 42 (struct usb_descriptor_header *)&rkusb_intf_desc, 43 (struct usb_descriptor_header *)&fsg_hs_bulk_in_desc, 44 (struct usb_descriptor_header *)&fsg_hs_bulk_out_desc, 45 NULL, 46 }; 47 48 static struct usb_descriptor_header *rkusb_ss_function[] = { 49 (struct usb_descriptor_header *)&rkusb_intf_desc, 50 (struct usb_descriptor_header *)&fsg_ss_bulk_in_desc, 51 (struct usb_descriptor_header *)&fsg_ss_bulk_in_comp_desc, 52 (struct usb_descriptor_header *)&fsg_ss_bulk_out_desc, 53 (struct usb_descriptor_header *)&fsg_ss_bulk_out_comp_desc, 54 NULL, 55 }; 56 57 struct rk_flash_info { 58 u32 flash_size; 59 u16 block_size; 60 u8 page_size; 61 u8 ecc_bits; 62 u8 access_time; 63 u8 manufacturer; 64 u8 flash_mask; 65 } __packed; 66 67 static int rkusb_rst_code; /* The subcode in reset command (0xFF) */ 68 69 int g_dnl_bind_fixup(struct usb_device_descriptor *dev, const char *name) 70 { 71 if (IS_RKUSB_UMS_DNL(name)) { 72 /* Fix to Rockchip's VID and PID */ 73 dev->idVendor = __constant_cpu_to_le16(0x2207); 74 dev->idProduct = __constant_cpu_to_le16(CONFIG_ROCKUSB_G_DNL_PID); 75 76 /* Enumerate as a loader device */ 77 #if defined(CONFIG_SUPPORT_USBPLUG) 78 dev->bcdUSB = cpu_to_le16(0x0200); 79 #else 80 dev->bcdUSB = cpu_to_le16(0x0201); 81 #endif 82 } else if (!strncmp(name, "usb_dnl_fastboot", 16)) { 83 /* Fix to Google's VID and PID */ 84 dev->idVendor = __constant_cpu_to_le16(0x18d1); 85 dev->idProduct = __constant_cpu_to_le16(0xd00d); 86 } 87 88 return 0; 89 } 90 91 __maybe_unused 92 static inline void dump_cbw(struct fsg_bulk_cb_wrap *cbw) 93 { 94 assert(!cbw); 95 96 debug("%s:\n", __func__); 97 debug("Signature %x\n", cbw->Signature); 98 debug("Tag %x\n", cbw->Tag); 99 debug("DataTransferLength %x\n", cbw->DataTransferLength); 100 debug("Flags %x\n", cbw->Flags); 101 debug("LUN %x\n", cbw->Lun); 102 debug("Length %x\n", cbw->Length); 103 debug("OptionCode %x\n", cbw->CDB[0]); 104 debug("SubCode %x\n", cbw->CDB[1]); 105 debug("SectorAddr %x\n", get_unaligned_be32(&cbw->CDB[2])); 106 debug("BlkSectors %x\n\n", get_unaligned_be16(&cbw->CDB[7])); 107 } 108 109 static int rkusb_check_lun(struct fsg_common *common) 110 { 111 struct fsg_lun *curlun; 112 113 /* Check the LUN */ 114 if (common->lun >= 0 && common->lun < common->nluns) { 115 curlun = &common->luns[common->lun]; 116 if (common->cmnd[0] != SC_REQUEST_SENSE) { 117 curlun->sense_data = SS_NO_SENSE; 118 curlun->info_valid = 0; 119 } 120 } else { 121 curlun = NULL; 122 common->bad_lun_okay = 0; 123 124 /* 125 * INQUIRY and REQUEST SENSE commands are explicitly allowed 126 * to use unsupported LUNs; all others may not. 127 */ 128 if (common->cmnd[0] != SC_INQUIRY && 129 common->cmnd[0] != SC_REQUEST_SENSE) { 130 debug("unsupported LUN %d\n", common->lun); 131 return -EINVAL; 132 } 133 } 134 135 return 0; 136 } 137 138 static void __do_reset(struct usb_ep *ep, struct usb_request *req) 139 { 140 u32 boot_flag = BOOT_NORMAL; 141 142 if (rkusb_rst_code == 0x03) 143 boot_flag = BOOT_BROM_DOWNLOAD; 144 145 rkusb_rst_code = 0; /* restore to default */ 146 writel(boot_flag, (void *)CONFIG_ROCKCHIP_BOOT_MODE_REG); 147 148 do_reset(NULL, 0, 0, NULL); 149 } 150 151 static int rkusb_do_reset(struct fsg_common *common, 152 struct fsg_buffhd *bh) 153 { 154 common->data_size_from_cmnd = common->cmnd[4]; 155 common->residue = 0; 156 bh->inreq->complete = __do_reset; 157 bh->state = BUF_STATE_EMPTY; 158 159 rkusb_rst_code = !common->cmnd[1] ? 0xff : common->cmnd[1]; 160 return 0; 161 } 162 163 static int rkusb_do_test_unit_ready(struct fsg_common *common, 164 struct fsg_buffhd *bh) 165 { 166 common->residue = 0x06 << 24; /* Max block xfer support from host */ 167 common->data_dir = DATA_DIR_NONE; 168 bh->state = BUF_STATE_EMPTY; 169 170 return 0; 171 } 172 173 static int rkusb_do_read_flash_id(struct fsg_common *common, 174 struct fsg_buffhd *bh) 175 { 176 u8 *buf = (u8 *)bh->buf; 177 u32 len = 5; 178 enum if_type type = ums[common->lun].block_dev.if_type; 179 180 if (type == IF_TYPE_MMC) 181 memcpy((void *)&buf[0], "EMMC ", 5); 182 else if (type == IF_TYPE_RKNAND) 183 memcpy((void *)&buf[0], "NAND ", 5); 184 else 185 memcpy((void *)&buf[0], "UNKN ", 5); /* unknown */ 186 187 /* Set data xfer size */ 188 common->residue = common->data_size_from_cmnd = len; 189 common->data_size = len; 190 191 return len; 192 } 193 194 static int rkusb_do_test_bad_block(struct fsg_common *common, 195 struct fsg_buffhd *bh) 196 { 197 u8 *buf = (u8 *)bh->buf; 198 u32 len = 64; 199 200 memset((void *)&buf[0], 0, len); 201 202 /* Set data xfer size */ 203 common->residue = common->data_size_from_cmnd = len; 204 common->data_size = len; 205 206 return len; 207 } 208 209 static int rkusb_do_read_flash_info(struct fsg_common *common, 210 struct fsg_buffhd *bh) 211 { 212 u8 *buf = (u8 *)bh->buf; 213 u32 len = sizeof(struct rk_flash_info); 214 struct rk_flash_info finfo = { 215 .block_size = 1024, 216 .ecc_bits = 0, 217 .page_size = 4, 218 .access_time = 40, 219 .manufacturer = 0, 220 .flash_mask = 0 221 }; 222 223 finfo.flash_size = (u32)ums[common->lun].block_dev.lba; 224 if (finfo.flash_size) 225 finfo.flash_mask = 1; 226 227 memset((void *)&buf[0], 0, len); 228 memcpy((void *)&buf[0], (void *)&finfo, len); 229 230 /* Set data xfer size */ 231 common->residue = common->data_size_from_cmnd = len; 232 /* legacy upgrade_tool does not set correct transfer size */ 233 common->data_size = len; 234 235 return len; 236 } 237 238 static int rkusb_do_get_chip_info(struct fsg_common *common, 239 struct fsg_buffhd *bh) 240 { 241 u8 *buf = (u8 *)bh->buf; 242 u32 len = common->data_size; 243 u32 chip_info[4]; 244 245 memset((void *)chip_info, 0, sizeof(chip_info)); 246 rockchip_rockusb_get_chip_info(chip_info); 247 248 memset((void *)&buf[0], 0, len); 249 memcpy((void *)&buf[0], (void *)chip_info, len); 250 251 /* Set data xfer size */ 252 common->residue = common->data_size_from_cmnd = len; 253 254 return len; 255 } 256 257 static int rkusb_do_lba_erase(struct fsg_common *common, 258 struct fsg_buffhd *bh) 259 { 260 struct fsg_lun *curlun = &common->luns[common->lun]; 261 u32 lba, amount; 262 loff_t file_offset; 263 int rc; 264 265 lba = get_unaligned_be32(&common->cmnd[2]); 266 if (lba >= curlun->num_sectors) { 267 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 268 rc = -EINVAL; 269 goto out; 270 } 271 272 file_offset = ((loff_t) lba) << 9; 273 amount = get_unaligned_be16(&common->cmnd[7]) << 9; 274 if (unlikely(amount == 0)) { 275 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 276 rc = -EIO; 277 goto out; 278 } 279 280 /* Perform the erase */ 281 rc = ums[common->lun].erase_sector(&ums[common->lun], 282 file_offset / SECTOR_SIZE, 283 amount / SECTOR_SIZE); 284 if (!rc) { 285 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 286 rc = -EIO; 287 } 288 289 out: 290 common->data_dir = DATA_DIR_NONE; 291 bh->state = BUF_STATE_EMPTY; 292 293 return rc; 294 } 295 296 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 297 static int rkusb_do_vs_write(struct fsg_common *common) 298 { 299 struct fsg_lun *curlun = &common->luns[common->lun]; 300 u16 type = get_unaligned_be16(&common->cmnd[4]); 301 struct vendor_item *vhead; 302 struct fsg_buffhd *bh; 303 void *data; 304 int rc; 305 306 if (common->data_size >= (u32)65536) { 307 /* _MUST_ small than 64K */ 308 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 309 return -EINVAL; 310 } 311 312 common->residue = common->data_size; 313 common->usb_amount_left = common->data_size; 314 315 /* Carry out the file writes */ 316 if (unlikely(common->data_size == 0)) 317 return -EIO; /* No data to write */ 318 319 for (;;) { 320 if (common->usb_amount_left > 0) { 321 /* Wait for the next buffer to become available */ 322 bh = common->next_buffhd_to_fill; 323 if (bh->state != BUF_STATE_EMPTY) 324 goto wait; 325 326 /* Request the next buffer */ 327 common->usb_amount_left -= common->data_size; 328 bh->outreq->length = common->data_size; 329 bh->bulk_out_intended_length = common->data_size; 330 bh->outreq->short_not_ok = 1; 331 332 START_TRANSFER_OR(common, bulk_out, bh->outreq, 333 &bh->outreq_busy, &bh->state) 334 /* 335 * Don't know what to do if 336 * common->fsg is NULL 337 */ 338 return -EIO; 339 common->next_buffhd_to_fill = bh->next; 340 } else { 341 /* Then, wait for the data to become available */ 342 bh = common->next_buffhd_to_drain; 343 if (bh->state != BUF_STATE_FULL) 344 goto wait; 345 346 common->next_buffhd_to_drain = bh->next; 347 bh->state = BUF_STATE_EMPTY; 348 349 /* Did something go wrong with the transfer? */ 350 if (bh->outreq->status != 0) { 351 curlun->sense_data = SS_COMMUNICATION_FAILURE; 352 curlun->info_valid = 1; 353 break; 354 } 355 356 /* Perform the write */ 357 vhead = (struct vendor_item *)bh->buf; 358 data = bh->buf + sizeof(struct vendor_item); 359 360 if (!type) { 361 /* Vendor storage */ 362 rc = vendor_storage_write(vhead->id, 363 (char __user *)data, 364 vhead->size); 365 if (rc < 0) { 366 curlun->sense_data = SS_WRITE_ERROR; 367 return -EIO; 368 } 369 } else { 370 /* RPMB */ 371 rc = 372 write_keybox_to_secure_storage((u8 *)data, 373 vhead->size); 374 if (rc < 0) { 375 curlun->sense_data = SS_WRITE_ERROR; 376 return -EIO; 377 } 378 } 379 380 common->residue -= common->data_size; 381 382 /* Did the host decide to stop early? */ 383 if (bh->outreq->actual != bh->outreq->length) 384 common->short_packet_received = 1; 385 break; /* Command done */ 386 } 387 wait: 388 /* Wait for something to happen */ 389 rc = sleep_thread(common); 390 if (rc) 391 return rc; 392 } 393 394 return -EIO; /* No default reply */ 395 } 396 397 static int rkusb_do_vs_read(struct fsg_common *common) 398 { 399 struct fsg_lun *curlun = &common->luns[common->lun]; 400 u16 type = get_unaligned_be16(&common->cmnd[4]); 401 struct vendor_item *vhead; 402 struct fsg_buffhd *bh; 403 void *data; 404 int rc; 405 406 if (common->data_size >= (u32)65536) { 407 /* _MUST_ small than 64K */ 408 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 409 return -EINVAL; 410 } 411 412 common->residue = common->data_size; 413 common->usb_amount_left = common->data_size; 414 415 /* Carry out the file reads */ 416 if (unlikely(common->data_size == 0)) 417 return -EIO; /* No default reply */ 418 419 for (;;) { 420 /* Wait for the next buffer to become available */ 421 bh = common->next_buffhd_to_fill; 422 while (bh->state != BUF_STATE_EMPTY) { 423 rc = sleep_thread(common); 424 if (rc) 425 return rc; 426 } 427 428 memset(bh->buf, 0, FSG_BUFLEN); 429 vhead = (struct vendor_item *)bh->buf; 430 data = bh->buf + sizeof(struct vendor_item); 431 vhead->id = get_unaligned_be16(&common->cmnd[2]); 432 433 if (!type) { 434 /* Vendor storage */ 435 rc = vendor_storage_read(vhead->id, 436 (char __user *)data, 437 common->data_size); 438 if (!rc) { 439 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 440 return -EIO; 441 } 442 vhead->size = rc; 443 } else { 444 /* RPMB */ 445 rc = 446 read_raw_data_from_secure_storage((u8 *)data, 447 common->data_size); 448 if (!rc) { 449 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 450 return -EIO; 451 } 452 vhead->size = rc; 453 } 454 455 common->residue -= common->data_size; 456 bh->inreq->length = common->data_size; 457 bh->state = BUF_STATE_FULL; 458 459 break; /* No more left to read */ 460 } 461 462 return -EIO; /* No default reply */ 463 } 464 #endif 465 466 static int rkusb_do_read_capacity(struct fsg_common *common, 467 struct fsg_buffhd *bh) 468 { 469 u8 *buf = (u8 *)bh->buf; 470 u32 len = common->data_size; 471 enum if_type type = ums[common->lun].block_dev.if_type; 472 473 /* 474 * bit[0]: Direct LBA, 0: Disabled; 475 * bit[1]: Vendor Storage API, 0: Disabed (default); 476 * bit[2]: First 4M Access, 0: Disabled; 477 * bit[3]: Read LBA On, 0: Disabed (default); 478 * bit[4]: New Vendor Storage API, 0: Disabed; 479 * bit[5:63}: Reserved. 480 */ 481 memset((void *)&buf[0], 0, len); 482 if (type == IF_TYPE_MMC || type == IF_TYPE_SD) 483 buf[0] = BIT(0) | BIT(2) | BIT(4); 484 else 485 buf[0] = BIT(0) | BIT(4); 486 487 /* Set data xfer size */ 488 common->residue = common->data_size_from_cmnd = len; 489 490 return len; 491 } 492 493 static void rkusb_fixup_cbwcb(struct fsg_common *common, 494 struct fsg_buffhd *bh) 495 { 496 struct usb_request *req = bh->outreq; 497 struct fsg_bulk_cb_wrap *cbw = req->buf; 498 499 /* FIXME cbw.DataTransferLength was not set by Upgrade Tool */ 500 common->data_size = le32_to_cpu(cbw->DataTransferLength); 501 if (common->data_size == 0) { 502 common->data_size = 503 get_unaligned_be16(&common->cmnd[7]) << 9; 504 printf("Trasfer Length NOT set, please use new version tool\n"); 505 debug("%s %d, cmnd1 %x\n", __func__, 506 get_unaligned_be16(&common->cmnd[7]), 507 get_unaligned_be16(&common->cmnd[1])); 508 } 509 if (cbw->Flags & USB_BULK_IN_FLAG) 510 common->data_dir = DATA_DIR_TO_HOST; 511 else 512 common->data_dir = DATA_DIR_FROM_HOST; 513 514 /* Not support */ 515 common->cmnd[1] = 0; 516 } 517 518 static int rkusb_cmd_process(struct fsg_common *common, 519 struct fsg_buffhd *bh, int *reply) 520 { 521 struct usb_request *req = bh->outreq; 522 struct fsg_bulk_cb_wrap *cbw = req->buf; 523 int rc; 524 525 dump_cbw(cbw); 526 527 if (rkusb_check_lun(common)) { 528 *reply = -EINVAL; 529 return RKUSB_RC_ERROR; 530 } 531 532 switch (common->cmnd[0]) { 533 case RKUSB_TEST_UNIT_READY: 534 *reply = rkusb_do_test_unit_ready(common, bh); 535 rc = RKUSB_RC_FINISHED; 536 break; 537 538 case RKUSB_READ_FLASH_ID: 539 *reply = rkusb_do_read_flash_id(common, bh); 540 rc = RKUSB_RC_FINISHED; 541 break; 542 543 case RKUSB_TEST_BAD_BLOCK: 544 *reply = rkusb_do_test_bad_block(common, bh); 545 rc = RKUSB_RC_FINISHED; 546 break; 547 548 case RKUSB_LBA_READ_10: 549 rkusb_fixup_cbwcb(common, bh); 550 common->cmnd[0] = SC_READ_10; 551 common->cmnd[1] = 0; /* Not support */ 552 rc = RKUSB_RC_CONTINUE; 553 break; 554 555 case RKUSB_LBA_WRITE_10: 556 rkusb_fixup_cbwcb(common, bh); 557 common->cmnd[0] = SC_WRITE_10; 558 common->cmnd[1] = 0; /* Not support */ 559 rc = RKUSB_RC_CONTINUE; 560 break; 561 562 case RKUSB_READ_FLASH_INFO: 563 *reply = rkusb_do_read_flash_info(common, bh); 564 rc = RKUSB_RC_FINISHED; 565 break; 566 567 case RKUSB_GET_CHIP_VER: 568 *reply = rkusb_do_get_chip_info(common, bh); 569 rc = RKUSB_RC_FINISHED; 570 break; 571 572 case RKUSB_LBA_ERASE: 573 *reply = rkusb_do_lba_erase(common, bh); 574 rc = RKUSB_RC_FINISHED; 575 break; 576 577 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 578 case RKUSB_VS_WRITE: 579 *reply = rkusb_do_vs_write(common); 580 rc = RKUSB_RC_FINISHED; 581 break; 582 583 case RKUSB_VS_READ: 584 *reply = rkusb_do_vs_read(common); 585 rc = RKUSB_RC_FINISHED; 586 break; 587 #endif 588 589 case RKUSB_READ_CAPACITY: 590 *reply = rkusb_do_read_capacity(common, bh); 591 rc = RKUSB_RC_FINISHED; 592 break; 593 594 case RKUSB_RESET: 595 *reply = rkusb_do_reset(common, bh); 596 rc = RKUSB_RC_FINISHED; 597 break; 598 599 case RKUSB_READ_10: 600 case RKUSB_WRITE_10: 601 printf("CMD Not support, pls use new version Tool\n"); 602 case RKUSB_SET_DEVICE_ID: 603 case RKUSB_ERASE_10: 604 case RKUSB_WRITE_SPARE: 605 case RKUSB_READ_SPARE: 606 case RKUSB_ERASE_10_FORCE: 607 case RKUSB_GET_VERSION: 608 case RKUSB_ERASE_SYS_DISK: 609 case RKUSB_SDRAM_READ_10: 610 case RKUSB_SDRAM_WRITE_10: 611 case RKUSB_SDRAM_EXECUTE: 612 case RKUSB_LOW_FORMAT: 613 case RKUSB_SET_RESET_FLAG: 614 case RKUSB_SPI_READ_10: 615 case RKUSB_SPI_WRITE_10: 616 case RKUSB_SESSION: 617 /* Fall through */ 618 default: 619 rc = RKUSB_RC_UNKNOWN_CMND; 620 break; 621 } 622 623 return rc; 624 } 625 626 DECLARE_GADGET_BIND_CALLBACK(rkusb_ums_dnl, fsg_add); 627