1 /* 2 * Copyright 2017 Rockchip Electronics Co., Ltd 3 * Frank Wang <frank.wang@rock-chips.com> 4 * 5 * SPDX-License-Identifier: GPL-2.0+ 6 */ 7 8 #include <asm/io.h> 9 #include <android_avb/avb_ops_user.h> 10 #include <android_avb/rk_avb_ops_user.h> 11 #include <asm/arch/boot_mode.h> 12 #include <asm/arch/chip_info.h> 13 #include <asm/arch/rk_atags.h> 14 #include <write_keybox.h> 15 #include <linux/mtd/mtd.h> 16 #include <optee_include/OpteeClientInterface.h> 17 18 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 19 #include <asm/arch/vendor.h> 20 #endif 21 #include <rockusb.h> 22 23 #define ROCKUSB_INTERFACE_CLASS 0xff 24 #define ROCKUSB_INTERFACE_SUB_CLASS 0x06 25 #define ROCKUSB_INTERFACE_PROTOCOL 0x05 26 27 #define ROCKCHIP_FLASH_BLOCK_SIZE 1024 28 #define ROCKCHIP_FLASH_PAGE_SIZE 4 29 30 static struct usb_interface_descriptor rkusb_intf_desc = { 31 .bLength = USB_DT_INTERFACE_SIZE, 32 .bDescriptorType = USB_DT_INTERFACE, 33 .bInterfaceNumber = 0x00, 34 .bAlternateSetting = 0x00, 35 .bNumEndpoints = 0x02, 36 .bInterfaceClass = ROCKUSB_INTERFACE_CLASS, 37 .bInterfaceSubClass = ROCKUSB_INTERFACE_SUB_CLASS, 38 .bInterfaceProtocol = ROCKUSB_INTERFACE_PROTOCOL, 39 }; 40 41 static struct usb_descriptor_header *rkusb_fs_function[] = { 42 (struct usb_descriptor_header *)&rkusb_intf_desc, 43 (struct usb_descriptor_header *)&fsg_fs_bulk_in_desc, 44 (struct usb_descriptor_header *)&fsg_fs_bulk_out_desc, 45 NULL, 46 }; 47 48 static struct usb_descriptor_header *rkusb_hs_function[] = { 49 (struct usb_descriptor_header *)&rkusb_intf_desc, 50 (struct usb_descriptor_header *)&fsg_hs_bulk_in_desc, 51 (struct usb_descriptor_header *)&fsg_hs_bulk_out_desc, 52 NULL, 53 }; 54 55 static struct usb_descriptor_header *rkusb_ss_function[] = { 56 (struct usb_descriptor_header *)&rkusb_intf_desc, 57 (struct usb_descriptor_header *)&fsg_ss_bulk_in_desc, 58 (struct usb_descriptor_header *)&fsg_ss_bulk_in_comp_desc, 59 (struct usb_descriptor_header *)&fsg_ss_bulk_out_desc, 60 (struct usb_descriptor_header *)&fsg_ss_bulk_out_comp_desc, 61 NULL, 62 }; 63 64 struct rk_flash_info { 65 u32 flash_size; 66 u16 block_size; 67 u8 page_size; 68 u8 ecc_bits; 69 u8 access_time; 70 u8 manufacturer; 71 u8 flash_mask; 72 } __packed; 73 74 static int rkusb_rst_code; /* The subcode in reset command (0xFF) */ 75 76 int g_dnl_bind_fixup(struct usb_device_descriptor *dev, const char *name) 77 { 78 if (IS_RKUSB_UMS_DNL(name)) { 79 /* Fix to Rockchip's VID and PID */ 80 dev->idVendor = __constant_cpu_to_le16(0x2207); 81 dev->idProduct = __constant_cpu_to_le16(CONFIG_ROCKUSB_G_DNL_PID); 82 83 /* Enumerate as a loader device */ 84 #if defined(CONFIG_SUPPORT_USBPLUG) 85 dev->bcdUSB = cpu_to_le16(0x0200); 86 #else 87 dev->bcdUSB = cpu_to_le16(0x0201); 88 #endif 89 } else if (!strncmp(name, "usb_dnl_fastboot", 16)) { 90 /* Fix to Google's VID and PID */ 91 dev->idVendor = __constant_cpu_to_le16(0x18d1); 92 dev->idProduct = __constant_cpu_to_le16(0xd00d); 93 } else if (!strncmp(name, "usb_dnl_dfu", 11)) { 94 /* Fix to Rockchip's VID and PID for DFU */ 95 dev->idVendor = cpu_to_le16(0x2207); 96 dev->idProduct = cpu_to_le16(0x0107); 97 } else if (!strncmp(name, "usb_dnl_ums", 11)) { 98 dev->idVendor = cpu_to_le16(0x2207); 99 dev->idProduct = cpu_to_le16(0x0010); 100 } 101 102 return 0; 103 } 104 105 __maybe_unused 106 static inline void dump_cbw(struct fsg_bulk_cb_wrap *cbw) 107 { 108 assert(!cbw); 109 110 debug("%s:\n", __func__); 111 debug("Signature %x\n", cbw->Signature); 112 debug("Tag %x\n", cbw->Tag); 113 debug("DataTransferLength %x\n", cbw->DataTransferLength); 114 debug("Flags %x\n", cbw->Flags); 115 debug("LUN %x\n", cbw->Lun); 116 debug("Length %x\n", cbw->Length); 117 debug("OptionCode %x\n", cbw->CDB[0]); 118 debug("SubCode %x\n", cbw->CDB[1]); 119 debug("SectorAddr %x\n", get_unaligned_be32(&cbw->CDB[2])); 120 debug("BlkSectors %x\n\n", get_unaligned_be16(&cbw->CDB[7])); 121 } 122 123 static int rkusb_check_lun(struct fsg_common *common) 124 { 125 struct fsg_lun *curlun; 126 127 /* Check the LUN */ 128 if (common->lun >= 0 && common->lun < common->nluns) { 129 curlun = &common->luns[common->lun]; 130 if (common->cmnd[0] != SC_REQUEST_SENSE) { 131 curlun->sense_data = SS_NO_SENSE; 132 curlun->info_valid = 0; 133 } 134 } else { 135 curlun = NULL; 136 common->bad_lun_okay = 0; 137 138 /* 139 * INQUIRY and REQUEST SENSE commands are explicitly allowed 140 * to use unsupported LUNs; all others may not. 141 */ 142 if (common->cmnd[0] != SC_INQUIRY && 143 common->cmnd[0] != SC_REQUEST_SENSE) { 144 debug("unsupported LUN %d\n", common->lun); 145 return -EINVAL; 146 } 147 } 148 149 return 0; 150 } 151 152 static void __do_reset(struct usb_ep *ep, struct usb_request *req) 153 { 154 u32 boot_flag = BOOT_NORMAL; 155 156 if (rkusb_rst_code == 0x03) 157 boot_flag = BOOT_BROM_DOWNLOAD; 158 159 rkusb_rst_code = 0; /* restore to default */ 160 writel(boot_flag, (void *)CONFIG_ROCKCHIP_BOOT_MODE_REG); 161 162 do_reset(NULL, 0, 0, NULL); 163 } 164 165 static int rkusb_do_reset(struct fsg_common *common, 166 struct fsg_buffhd *bh) 167 { 168 common->data_size_from_cmnd = common->cmnd[4]; 169 common->residue = 0; 170 bh->inreq->complete = __do_reset; 171 bh->state = BUF_STATE_EMPTY; 172 173 rkusb_rst_code = !common->cmnd[1] ? 0xff : common->cmnd[1]; 174 return 0; 175 } 176 177 static int rkusb_do_test_unit_ready(struct fsg_common *common, 178 struct fsg_buffhd *bh) 179 { 180 struct blk_desc *desc = &ums[common->lun].block_dev; 181 182 if ((desc->if_type == IF_TYPE_MTD && desc->devnum == BLK_MTD_SPI_NOR) || 183 desc->if_type == IF_TYPE_SPINOR) 184 common->residue = 0x03 << 24; /* 128KB Max block xfer for SPI Nor */ 185 else 186 common->residue = 0x06 << 24; /* Max block xfer support from host */ 187 188 common->data_dir = DATA_DIR_NONE; 189 bh->state = BUF_STATE_EMPTY; 190 191 return 0; 192 } 193 194 static int rkusb_do_read_flash_id(struct fsg_common *common, 195 struct fsg_buffhd *bh) 196 { 197 u8 *buf = (u8 *)bh->buf; 198 u32 len = 5; 199 enum if_type type = ums[common->lun].block_dev.if_type; 200 201 if (type == IF_TYPE_MMC) 202 memcpy((void *)&buf[0], "EMMC ", 5); 203 else if (type == IF_TYPE_RKNAND) 204 memcpy((void *)&buf[0], "NAND ", 5); 205 else 206 memcpy((void *)&buf[0], "UNKN ", 5); /* unknown */ 207 208 /* Set data xfer size */ 209 common->residue = common->data_size_from_cmnd = len; 210 common->data_size = len; 211 212 return len; 213 } 214 215 static int rkusb_do_test_bad_block(struct fsg_common *common, 216 struct fsg_buffhd *bh) 217 { 218 u8 *buf = (u8 *)bh->buf; 219 u32 len = 64; 220 221 memset((void *)&buf[0], 0, len); 222 223 /* Set data xfer size */ 224 common->residue = common->data_size_from_cmnd = len; 225 common->data_size = len; 226 227 return len; 228 } 229 230 static int rkusb_do_read_flash_info(struct fsg_common *common, 231 struct fsg_buffhd *bh) 232 { 233 struct blk_desc *desc = &ums[common->lun].block_dev; 234 u8 *buf = (u8 *)bh->buf; 235 u32 len = sizeof(struct rk_flash_info); 236 struct rk_flash_info finfo = { 237 .block_size = ROCKCHIP_FLASH_BLOCK_SIZE, 238 .ecc_bits = 0, 239 .page_size = ROCKCHIP_FLASH_PAGE_SIZE, 240 .access_time = 40, 241 .manufacturer = 0, 242 .flash_mask = 0 243 }; 244 245 finfo.flash_size = (u32)desc->lba; 246 247 if (desc->if_type == IF_TYPE_MTD && 248 (desc->devnum == BLK_MTD_NAND || 249 desc->devnum == BLK_MTD_SPI_NAND)) { 250 struct mtd_info *mtd = (struct mtd_info *)desc->bdev->priv; 251 252 if (mtd) { 253 finfo.block_size = mtd->erasesize >> 9; 254 finfo.page_size = mtd->writesize >> 9; 255 } 256 } 257 258 if (desc->if_type == IF_TYPE_MTD && desc->devnum == BLK_MTD_SPI_NOR) { 259 /* RV1126/RK3308 mtd spinor keep the former upgrade mode */ 260 #if !defined(CONFIG_ROCKCHIP_RV1126) && !defined(CONFIG_ROCKCHIP_RK3308) 261 finfo.block_size = 0x80; /* Aligned to 64KB */ 262 #else 263 finfo.block_size = ROCKCHIP_FLASH_BLOCK_SIZE; 264 #endif 265 } 266 267 debug("Flash info: block_size= %x page_size= %x\n", finfo.block_size, 268 finfo.page_size); 269 270 if (finfo.flash_size) 271 finfo.flash_mask = 1; 272 273 memset((void *)&buf[0], 0, len); 274 memcpy((void *)&buf[0], (void *)&finfo, len); 275 276 /* Set data xfer size */ 277 common->residue = common->data_size_from_cmnd = len; 278 /* legacy upgrade_tool does not set correct transfer size */ 279 common->data_size = len; 280 281 return len; 282 } 283 284 static int rkusb_do_get_chip_info(struct fsg_common *common, 285 struct fsg_buffhd *bh) 286 { 287 u8 *buf = (u8 *)bh->buf; 288 u32 len = common->data_size; 289 u32 chip_info[4]; 290 291 memset((void *)chip_info, 0, sizeof(chip_info)); 292 rockchip_rockusb_get_chip_info(chip_info); 293 294 memset((void *)&buf[0], 0, len); 295 memcpy((void *)&buf[0], (void *)chip_info, len); 296 297 /* Set data xfer size */ 298 common->residue = common->data_size_from_cmnd = len; 299 300 return len; 301 } 302 303 static int rkusb_do_lba_erase(struct fsg_common *common, 304 struct fsg_buffhd *bh) 305 { 306 struct fsg_lun *curlun = &common->luns[common->lun]; 307 u32 lba, amount; 308 loff_t file_offset; 309 int rc; 310 311 lba = get_unaligned_be32(&common->cmnd[2]); 312 if (lba >= curlun->num_sectors) { 313 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 314 rc = -EINVAL; 315 goto out; 316 } 317 318 file_offset = ((loff_t) lba) << 9; 319 amount = get_unaligned_be16(&common->cmnd[7]) << 9; 320 if (unlikely(amount == 0)) { 321 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 322 rc = -EIO; 323 goto out; 324 } 325 326 /* Perform the erase */ 327 rc = ums[common->lun].erase_sector(&ums[common->lun], 328 file_offset / SECTOR_SIZE, 329 amount / SECTOR_SIZE); 330 if (!rc) { 331 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 332 rc = -EIO; 333 } 334 335 out: 336 common->data_dir = DATA_DIR_NONE; 337 bh->state = BUF_STATE_EMPTY; 338 339 return rc; 340 } 341 342 static int rkusb_do_erase_force(struct fsg_common *common, 343 struct fsg_buffhd *bh) 344 { 345 struct blk_desc *desc = &ums[common->lun].block_dev; 346 struct fsg_lun *curlun = &common->luns[common->lun]; 347 u16 block_size = ROCKCHIP_FLASH_BLOCK_SIZE; 348 u32 lba, amount; 349 loff_t file_offset; 350 int rc; 351 352 lba = get_unaligned_be32(&common->cmnd[2]); 353 if (lba >= curlun->num_sectors) { 354 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 355 rc = -EINVAL; 356 goto out; 357 } 358 359 if (desc->if_type == IF_TYPE_MTD && 360 (desc->devnum == BLK_MTD_NAND || 361 desc->devnum == BLK_MTD_SPI_NAND)) { 362 struct mtd_info *mtd = (struct mtd_info *)desc->bdev->priv; 363 364 if (mtd) 365 block_size = mtd->erasesize >> 9; 366 } 367 368 file_offset = ((loff_t)lba) * block_size; 369 amount = get_unaligned_be16(&common->cmnd[7]) * block_size; 370 371 debug("%s lba= %x, nsec= %x\n", __func__, lba, 372 (u32)get_unaligned_be16(&common->cmnd[7])); 373 374 if (unlikely(amount == 0)) { 375 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 376 rc = -EIO; 377 goto out; 378 } 379 380 /* Perform the erase */ 381 rc = ums[common->lun].erase_sector(&ums[common->lun], 382 file_offset, 383 amount); 384 if (!rc) { 385 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 386 rc = -EIO; 387 } 388 389 out: 390 common->data_dir = DATA_DIR_NONE; 391 bh->state = BUF_STATE_EMPTY; 392 393 return rc; 394 } 395 396 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 397 static int rkusb_do_vs_write(struct fsg_common *common) 398 { 399 struct fsg_lun *curlun = &common->luns[common->lun]; 400 u16 type = get_unaligned_be16(&common->cmnd[4]); 401 struct vendor_item *vhead; 402 struct fsg_buffhd *bh; 403 void *data; 404 int rc; 405 406 if (common->data_size >= (u32)65536) { 407 /* _MUST_ small than 64K */ 408 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 409 return -EINVAL; 410 } 411 412 common->residue = common->data_size; 413 common->usb_amount_left = common->data_size; 414 415 /* Carry out the file writes */ 416 if (unlikely(common->data_size == 0)) 417 return -EIO; /* No data to write */ 418 419 for (;;) { 420 if (common->usb_amount_left > 0) { 421 /* Wait for the next buffer to become available */ 422 bh = common->next_buffhd_to_fill; 423 if (bh->state != BUF_STATE_EMPTY) 424 goto wait; 425 426 /* Request the next buffer */ 427 common->usb_amount_left -= common->data_size; 428 bh->outreq->length = common->data_size; 429 bh->bulk_out_intended_length = common->data_size; 430 bh->outreq->short_not_ok = 1; 431 432 START_TRANSFER_OR(common, bulk_out, bh->outreq, 433 &bh->outreq_busy, &bh->state) 434 /* 435 * Don't know what to do if 436 * common->fsg is NULL 437 */ 438 return -EIO; 439 common->next_buffhd_to_fill = bh->next; 440 } else { 441 /* Then, wait for the data to become available */ 442 bh = common->next_buffhd_to_drain; 443 if (bh->state != BUF_STATE_FULL) 444 goto wait; 445 446 common->next_buffhd_to_drain = bh->next; 447 bh->state = BUF_STATE_EMPTY; 448 449 /* Did something go wrong with the transfer? */ 450 if (bh->outreq->status != 0) { 451 curlun->sense_data = SS_COMMUNICATION_FAILURE; 452 curlun->info_valid = 1; 453 break; 454 } 455 456 /* Perform the write */ 457 vhead = (struct vendor_item *)bh->buf; 458 data = bh->buf + sizeof(struct vendor_item); 459 460 if (!type) { 461 if (vhead->id == HDCP_14_HDMI_ID || 462 vhead->id == HDCP_14_HDMIRX_ID || 463 vhead->id == HDCP_14_DP_ID) { 464 rc = vendor_handle_hdcp(vhead); 465 if (rc < 0) { 466 curlun->sense_data = SS_WRITE_ERROR; 467 return -EIO; 468 } 469 } 470 471 /* Vendor storage */ 472 rc = vendor_storage_write(vhead->id, 473 (char __user *)data, 474 vhead->size); 475 if (rc < 0) { 476 curlun->sense_data = SS_WRITE_ERROR; 477 return -EIO; 478 } 479 } else if (type == 1) { 480 /* RPMB */ 481 rc = 482 write_keybox_to_secure_storage((u8 *)data, 483 vhead->size); 484 if (rc < 0) { 485 curlun->sense_data = SS_WRITE_ERROR; 486 return -EIO; 487 } 488 } else if (type == 2) { 489 /* security storage */ 490 #ifdef CONFIG_RK_AVB_LIBAVB_USER 491 debug("%s call rk_avb_write_perm_attr %d, %d\n", 492 __func__, vhead->id, vhead->size); 493 rc = rk_avb_write_perm_attr(vhead->id, 494 (char __user *)data, 495 vhead->size); 496 if (rc < 0) { 497 curlun->sense_data = SS_WRITE_ERROR; 498 return -EIO; 499 } 500 #else 501 printf("Please enable CONFIG_RK_AVB_LIBAVB_USER\n"); 502 #endif 503 } else if (type == 3) { 504 /* efuse or otp*/ 505 #ifdef CONFIG_OPTEE_CLIENT 506 if (memcmp(data, "TAEK", 4) == 0) { 507 if (vhead->size - 8 != 32) { 508 printf("check ta encryption key size fail!\n"); 509 curlun->sense_data = SS_WRITE_ERROR; 510 return -EIO; 511 } 512 if (trusty_write_ta_encryption_key((uint32_t *)(data + 8), 8) != 0) { 513 printf("trusty_write_ta_encryption_key error!"); 514 curlun->sense_data = SS_WRITE_ERROR; 515 return -EIO; 516 } 517 } else if (memcmp(data, "EHUK", 4) == 0) { 518 if (vhead->size - 8 != 32) { 519 printf("check oem huk size fail!\n"); 520 curlun->sense_data = SS_WRITE_ERROR; 521 return -EIO; 522 } 523 if (trusty_write_oem_huk((uint32_t *)(data + 8), 8) != 0) { 524 printf("trusty_write_oem_huk error!"); 525 curlun->sense_data = SS_WRITE_ERROR; 526 return -EIO; 527 } 528 } else { 529 printf("Unknown tag\n"); 530 curlun->sense_data = SS_WRITE_ERROR; 531 return -EIO; 532 } 533 #else 534 printf("Please enable CONFIG_OPTEE_CLIENT\n"); 535 #endif 536 } else { 537 return -EINVAL; 538 } 539 540 common->residue -= common->data_size; 541 542 /* Did the host decide to stop early? */ 543 if (bh->outreq->actual != bh->outreq->length) 544 common->short_packet_received = 1; 545 break; /* Command done */ 546 } 547 wait: 548 /* Wait for something to happen */ 549 rc = sleep_thread(common); 550 if (rc) 551 return rc; 552 } 553 554 return -EIO; /* No default reply */ 555 } 556 557 static int rkusb_do_vs_read(struct fsg_common *common) 558 { 559 struct fsg_lun *curlun = &common->luns[common->lun]; 560 u16 type = get_unaligned_be16(&common->cmnd[4]); 561 struct vendor_item *vhead; 562 struct fsg_buffhd *bh; 563 void *data; 564 int rc; 565 566 if (common->data_size >= (u32)65536) { 567 /* _MUST_ small than 64K */ 568 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 569 return -EINVAL; 570 } 571 572 common->residue = common->data_size; 573 common->usb_amount_left = common->data_size; 574 575 /* Carry out the file reads */ 576 if (unlikely(common->data_size == 0)) 577 return -EIO; /* No default reply */ 578 579 for (;;) { 580 /* Wait for the next buffer to become available */ 581 bh = common->next_buffhd_to_fill; 582 while (bh->state != BUF_STATE_EMPTY) { 583 rc = sleep_thread(common); 584 if (rc) 585 return rc; 586 } 587 588 memset(bh->buf, 0, FSG_BUFLEN); 589 vhead = (struct vendor_item *)bh->buf; 590 data = bh->buf + sizeof(struct vendor_item); 591 vhead->id = get_unaligned_be16(&common->cmnd[2]); 592 593 if (!type) { 594 /* Vendor storage */ 595 rc = vendor_storage_read(vhead->id, 596 (char __user *)data, 597 common->data_size); 598 if (!rc) { 599 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 600 return -EIO; 601 } 602 vhead->size = rc; 603 } else if (type == 1) { 604 /* RPMB */ 605 rc = 606 read_raw_data_from_secure_storage((u8 *)data, 607 common->data_size); 608 if (!rc) { 609 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 610 return -EIO; 611 } 612 vhead->size = rc; 613 } else if (type == 2) { 614 /* security storage */ 615 #ifdef CONFIG_RK_AVB_LIBAVB_USER 616 rc = rk_avb_read_perm_attr(vhead->id, 617 (char __user *)data, 618 vhead->size); 619 if (rc < 0) 620 return -EIO; 621 vhead->size = rc; 622 #else 623 printf("Please enable CONFIG_RK_AVB_LIBAVB_USER!\n"); 624 #endif 625 } else { 626 return -EINVAL; 627 } 628 629 common->residue -= common->data_size; 630 bh->inreq->length = common->data_size; 631 bh->state = BUF_STATE_FULL; 632 633 break; /* No more left to read */ 634 } 635 636 return -EIO; /* No default reply */ 637 } 638 #endif 639 640 static int rkusb_do_get_storage_info(struct fsg_common *common, 641 struct fsg_buffhd *bh) 642 { 643 enum if_type type = ums[common->lun].block_dev.if_type; 644 int devnum = ums[common->lun].block_dev.devnum; 645 u32 media = BOOT_TYPE_UNKNOWN; 646 u32 len = common->data_size; 647 u8 *buf = (u8 *)bh->buf; 648 649 if (len > 4) 650 len = 4; 651 652 switch (type) { 653 case IF_TYPE_MMC: 654 media = BOOT_TYPE_EMMC; 655 break; 656 657 case IF_TYPE_SD: 658 media = BOOT_TYPE_SD0; 659 break; 660 661 case IF_TYPE_MTD: 662 if (devnum == BLK_MTD_SPI_NAND) 663 media = BOOT_TYPE_MTD_BLK_SPI_NAND; 664 else if (devnum == BLK_MTD_NAND) 665 media = BOOT_TYPE_NAND; 666 else 667 media = BOOT_TYPE_MTD_BLK_SPI_NOR; 668 break; 669 670 case IF_TYPE_SCSI: 671 media = BOOT_TYPE_SATA; 672 break; 673 674 case IF_TYPE_RKNAND: 675 media = BOOT_TYPE_NAND; 676 break; 677 678 case IF_TYPE_NVME: 679 media = BOOT_TYPE_PCIE; 680 break; 681 682 default: 683 break; 684 } 685 686 memcpy((void *)&buf[0], (void *)&media, len); 687 common->residue = len; 688 common->data_size_from_cmnd = len; 689 690 return len; 691 } 692 693 static int rkusb_do_read_capacity(struct fsg_common *common, 694 struct fsg_buffhd *bh) 695 { 696 u8 *buf = (u8 *)bh->buf; 697 u32 len = common->data_size; 698 enum if_type type = ums[common->lun].block_dev.if_type; 699 int devnum = ums[common->lun].block_dev.devnum; 700 701 /* 702 * bit[0]: Direct LBA, 0: Disabled; 703 * bit[1]: Vendor Storage API, 0: Disabed (default); 704 * bit[2]: First 4M Access, 0: Disabled; 705 * bit[3]: Read LBA On, 0: Disabed (default); 706 * bit[4]: New Vendor Storage API, 0: Disabed; 707 * bit[5]: Read uart data from ram 708 * bit[6]: Read IDB config 709 * bit[7]: Read SecureMode 710 * bit[8]: New IDB feature 711 * bit[9]: Get storage media info 712 * bit[10:63}: Reserved. 713 */ 714 memset((void *)&buf[0], 0, len); 715 if (type == IF_TYPE_MMC || type == IF_TYPE_SD || type == IF_TYPE_NVME) 716 buf[0] = BIT(0) | BIT(2) | BIT(4); 717 else 718 buf[0] = BIT(0) | BIT(4); 719 720 if (type == IF_TYPE_MTD && 721 (devnum == BLK_MTD_NAND || 722 devnum == BLK_MTD_SPI_NAND)) 723 buf[0] |= (1 << 6); 724 725 #if !defined(CONFIG_ROCKCHIP_RV1126) && !defined(CONFIG_ROCKCHIP_RK3308) 726 if (type == IF_TYPE_MTD && devnum == BLK_MTD_SPI_NOR) 727 buf[0] |= (1 << 6); 728 #endif 729 730 #if defined(CONFIG_ROCKCHIP_NEW_IDB) 731 buf[1] = BIT(0); 732 #endif 733 buf[1] |= BIT(1); /* Switch Storage */ 734 buf[1] |= BIT(2); /* LBAwrite Parity */ 735 736 /* Set data xfer size */ 737 common->residue = len; 738 common->data_size_from_cmnd = len; 739 740 return len; 741 } 742 743 static void rkusb_fixup_cbwcb(struct fsg_common *common, 744 struct fsg_buffhd *bh) 745 { 746 struct usb_request *req = bh->outreq; 747 struct fsg_bulk_cb_wrap *cbw = req->buf; 748 749 /* FIXME cbw.DataTransferLength was not set by Upgrade Tool */ 750 common->data_size = le32_to_cpu(cbw->DataTransferLength); 751 if (common->data_size == 0) { 752 common->data_size = 753 get_unaligned_be16(&common->cmnd[7]) << 9; 754 printf("Trasfer Length NOT set, please use new version tool\n"); 755 debug("%s %d, cmnd1 %x\n", __func__, 756 get_unaligned_be16(&common->cmnd[7]), 757 get_unaligned_be16(&common->cmnd[1])); 758 } 759 if (cbw->Flags & USB_BULK_IN_FLAG) 760 common->data_dir = DATA_DIR_TO_HOST; 761 else 762 common->data_dir = DATA_DIR_FROM_HOST; 763 764 /* Not support */ 765 common->cmnd[1] = 0; 766 } 767 768 static int rkusb_cmd_process(struct fsg_common *common, 769 struct fsg_buffhd *bh, int *reply) 770 { 771 struct usb_request *req = bh->outreq; 772 struct fsg_bulk_cb_wrap *cbw = req->buf; 773 int rc; 774 775 dump_cbw(cbw); 776 777 if (rkusb_check_lun(common)) { 778 *reply = -EINVAL; 779 return RKUSB_RC_ERROR; 780 } 781 782 switch (common->cmnd[0]) { 783 case RKUSB_TEST_UNIT_READY: 784 *reply = rkusb_do_test_unit_ready(common, bh); 785 rc = RKUSB_RC_FINISHED; 786 break; 787 788 case RKUSB_READ_FLASH_ID: 789 *reply = rkusb_do_read_flash_id(common, bh); 790 rc = RKUSB_RC_FINISHED; 791 break; 792 793 case RKUSB_TEST_BAD_BLOCK: 794 *reply = rkusb_do_test_bad_block(common, bh); 795 rc = RKUSB_RC_FINISHED; 796 break; 797 798 case RKUSB_ERASE_10_FORCE: 799 *reply = rkusb_do_erase_force(common, bh); 800 rc = RKUSB_RC_FINISHED; 801 break; 802 803 case RKUSB_LBA_READ_10: 804 rkusb_fixup_cbwcb(common, bh); 805 common->cmnd[0] = SC_READ_10; 806 common->cmnd[1] = 0; /* Not support */ 807 rc = RKUSB_RC_CONTINUE; 808 break; 809 810 case RKUSB_LBA_WRITE_10: 811 rkusb_fixup_cbwcb(common, bh); 812 common->cmnd[0] = SC_WRITE_10; 813 common->cmnd[1] = 0; /* Not support */ 814 rc = RKUSB_RC_CONTINUE; 815 break; 816 817 case RKUSB_READ_FLASH_INFO: 818 *reply = rkusb_do_read_flash_info(common, bh); 819 rc = RKUSB_RC_FINISHED; 820 break; 821 822 case RKUSB_GET_CHIP_VER: 823 *reply = rkusb_do_get_chip_info(common, bh); 824 rc = RKUSB_RC_FINISHED; 825 break; 826 827 case RKUSB_LBA_ERASE: 828 *reply = rkusb_do_lba_erase(common, bh); 829 rc = RKUSB_RC_FINISHED; 830 break; 831 832 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 833 case RKUSB_VS_WRITE: 834 *reply = rkusb_do_vs_write(common); 835 rc = RKUSB_RC_FINISHED; 836 break; 837 838 case RKUSB_VS_READ: 839 *reply = rkusb_do_vs_read(common); 840 rc = RKUSB_RC_FINISHED; 841 break; 842 #endif 843 case RKUSB_GET_STORAGE_MEDIA: 844 *reply = rkusb_do_get_storage_info(common, bh); 845 rc = RKUSB_RC_FINISHED; 846 break; 847 848 case RKUSB_READ_CAPACITY: 849 *reply = rkusb_do_read_capacity(common, bh); 850 rc = RKUSB_RC_FINISHED; 851 break; 852 853 case RKUSB_RESET: 854 *reply = rkusb_do_reset(common, bh); 855 rc = RKUSB_RC_FINISHED; 856 break; 857 858 case RKUSB_READ_10: 859 case RKUSB_WRITE_10: 860 printf("CMD Not support, pls use new version Tool\n"); 861 case RKUSB_SET_DEVICE_ID: 862 case RKUSB_ERASE_10: 863 case RKUSB_WRITE_SPARE: 864 case RKUSB_READ_SPARE: 865 case RKUSB_GET_VERSION: 866 case RKUSB_ERASE_SYS_DISK: 867 case RKUSB_SDRAM_READ_10: 868 case RKUSB_SDRAM_WRITE_10: 869 case RKUSB_SDRAM_EXECUTE: 870 case RKUSB_LOW_FORMAT: 871 case RKUSB_SET_RESET_FLAG: 872 case RKUSB_SPI_READ_10: 873 case RKUSB_SPI_WRITE_10: 874 case RKUSB_SESSION: 875 /* Fall through */ 876 default: 877 rc = RKUSB_RC_UNKNOWN_CMND; 878 break; 879 } 880 881 return rc; 882 } 883 884 int rkusb_do_check_parity(struct fsg_common *common) 885 { 886 int ret = 0, rc; 887 u32 parity, i, usb_parity, lba, len; 888 static u32 usb_check_buffer[1024 * 256]; 889 890 usb_parity = common->cmnd[9] | (common->cmnd[10] << 8) | 891 (common->cmnd[11] << 16) | (common->cmnd[12] << 24); 892 893 if (common->cmnd[0] == SC_WRITE_10 && (usb_parity)) { 894 lba = get_unaligned_be32(&common->cmnd[2]); 895 len = common->data_size_from_cmnd >> 9; 896 rc = blk_dread(&ums[common->lun].block_dev, lba, len, usb_check_buffer); 897 parity = 0x000055aa; 898 for (i = 0; i < len * 128; i++) 899 parity += usb_check_buffer[i]; 900 if (!rc || parity != usb_parity) 901 common->phase_error = 1; 902 } 903 904 return ret; 905 } 906 907 DECLARE_GADGET_BIND_CALLBACK(rkusb_ums_dnl, fsg_add); 908