1 /* 2 * Copyright 2017 Rockchip Electronics Co., Ltd 3 * Frank Wang <frank.wang@rock-chips.com> 4 * 5 * SPDX-License-Identifier: GPL-2.0+ 6 */ 7 8 #include <asm/io.h> 9 #include <android_avb/avb_ops_user.h> 10 #include <android_avb/rk_avb_ops_user.h> 11 #include <asm/arch/boot_mode.h> 12 #include <asm/arch/chip_info.h> 13 #include <asm/arch/rk_atags.h> 14 #include <write_keybox.h> 15 #include <linux/mtd/mtd.h> 16 #include <optee_include/OpteeClientInterface.h> 17 #include <dm.h> 18 #include <misc.h> 19 #include <mmc.h> 20 #include <scsi.h> 21 #include <stdlib.h> 22 #include <usbplug.h> 23 #include <asm/arch/vendor.h> 24 #include <rockusb.h> 25 26 #define ROCKUSB_INTERFACE_CLASS 0xff 27 #define ROCKUSB_INTERFACE_SUB_CLASS 0x06 28 #define ROCKUSB_INTERFACE_PROTOCOL 0x05 29 30 #define ROCKCHIP_FLASH_BLOCK_SIZE 1024 31 #define ROCKCHIP_FLASH_PAGE_SIZE 4 32 33 static struct usb_interface_descriptor rkusb_intf_desc = { 34 .bLength = USB_DT_INTERFACE_SIZE, 35 .bDescriptorType = USB_DT_INTERFACE, 36 .bInterfaceNumber = 0x00, 37 .bAlternateSetting = 0x00, 38 .bNumEndpoints = 0x02, 39 .bInterfaceClass = ROCKUSB_INTERFACE_CLASS, 40 .bInterfaceSubClass = ROCKUSB_INTERFACE_SUB_CLASS, 41 .bInterfaceProtocol = ROCKUSB_INTERFACE_PROTOCOL, 42 }; 43 44 static struct usb_descriptor_header *rkusb_fs_function[] = { 45 (struct usb_descriptor_header *)&rkusb_intf_desc, 46 (struct usb_descriptor_header *)&fsg_fs_bulk_in_desc, 47 (struct usb_descriptor_header *)&fsg_fs_bulk_out_desc, 48 NULL, 49 }; 50 51 static struct usb_descriptor_header *rkusb_hs_function[] = { 52 (struct usb_descriptor_header *)&rkusb_intf_desc, 53 (struct usb_descriptor_header *)&fsg_hs_bulk_in_desc, 54 (struct usb_descriptor_header *)&fsg_hs_bulk_out_desc, 55 NULL, 56 }; 57 58 static struct usb_descriptor_header *rkusb_ss_function[] = { 59 (struct usb_descriptor_header *)&rkusb_intf_desc, 60 (struct usb_descriptor_header *)&fsg_ss_bulk_in_desc, 61 (struct usb_descriptor_header *)&fsg_ss_bulk_in_comp_desc, 62 (struct usb_descriptor_header *)&fsg_ss_bulk_out_desc, 63 (struct usb_descriptor_header *)&fsg_ss_bulk_out_comp_desc, 64 NULL, 65 }; 66 67 struct rk_flash_info { 68 u32 flash_size; 69 u16 block_size; 70 u8 page_size; 71 u8 ecc_bits; 72 u8 access_time; 73 u8 manufacturer; 74 u8 flash_mask; 75 } __packed; 76 77 static int rkusb_rst_code; /* The subcode in reset command (0xFF) */ 78 79 int g_dnl_bind_fixup(struct usb_device_descriptor *dev, const char *name) 80 { 81 if (IS_RKUSB_UMS_DNL(name)) { 82 /* Fix to Rockchip's VID and PID */ 83 dev->idVendor = __constant_cpu_to_le16(0x2207); 84 dev->idProduct = __constant_cpu_to_le16(CONFIG_ROCKUSB_G_DNL_PID); 85 86 /* Enumerate as a loader device */ 87 #if defined(CONFIG_SUPPORT_USBPLUG) 88 dev->bcdUSB = cpu_to_le16(0x0200); 89 #else 90 dev->bcdUSB = cpu_to_le16(0x0201); 91 #endif 92 } else if (!strncmp(name, "usb_dnl_fastboot", 16)) { 93 /* Fix to Google's VID and PID */ 94 dev->idVendor = __constant_cpu_to_le16(0x18d1); 95 dev->idProduct = __constant_cpu_to_le16(0x4d00); 96 } else if (!strncmp(name, "usb_dnl_dfu", 11)) { 97 /* Fix to Rockchip's VID and PID for DFU */ 98 dev->idVendor = cpu_to_le16(0x2207); 99 dev->idProduct = cpu_to_le16(0x0107); 100 } else if (!strncmp(name, "usb_dnl_ums", 11)) { 101 dev->idVendor = cpu_to_le16(0x2207); 102 dev->idProduct = cpu_to_le16(0x0010); 103 } 104 105 return 0; 106 } 107 108 __maybe_unused 109 static inline void dump_cbw(struct fsg_bulk_cb_wrap *cbw) 110 { 111 assert(!cbw); 112 113 debug("%s:\n", __func__); 114 debug("Signature %x\n", cbw->Signature); 115 debug("Tag %x\n", cbw->Tag); 116 debug("DataTransferLength %x\n", cbw->DataTransferLength); 117 debug("Flags %x\n", cbw->Flags); 118 debug("LUN %x\n", cbw->Lun); 119 debug("Length %x\n", cbw->Length); 120 debug("OptionCode %x\n", cbw->CDB[0]); 121 debug("SubCode %x\n", cbw->CDB[1]); 122 debug("SectorAddr %x\n", get_unaligned_be32(&cbw->CDB[2])); 123 debug("BlkSectors %x\n\n", get_unaligned_be16(&cbw->CDB[7])); 124 } 125 126 static int rkusb_check_lun(struct fsg_common *common) 127 { 128 struct fsg_lun *curlun; 129 130 /* Check the LUN */ 131 if (common->lun >= 0 && common->lun < common->nluns) { 132 curlun = &common->luns[common->lun]; 133 if (common->cmnd[0] != SC_REQUEST_SENSE) { 134 curlun->sense_data = SS_NO_SENSE; 135 curlun->info_valid = 0; 136 } 137 } else { 138 curlun = NULL; 139 common->bad_lun_okay = 0; 140 141 /* 142 * INQUIRY and REQUEST SENSE commands are explicitly allowed 143 * to use unsupported LUNs; all others may not. 144 */ 145 if (common->cmnd[0] != SC_INQUIRY && 146 common->cmnd[0] != SC_REQUEST_SENSE) { 147 debug("unsupported LUN %d\n", common->lun); 148 return -EINVAL; 149 } 150 } 151 152 return 0; 153 } 154 155 static void __do_reset(struct usb_ep *ep, struct usb_request *req) 156 { 157 u32 boot_flag = BOOT_NORMAL; 158 159 if (rkusb_rst_code == 0x03) 160 boot_flag = BOOT_BROM_DOWNLOAD; 161 else if (rkusb_rst_code == 0x06) 162 boot_flag = BOOT_LOADER; 163 164 rkusb_rst_code = 0; /* restore to default */ 165 writel(boot_flag, (void *)CONFIG_ROCKCHIP_BOOT_MODE_REG); 166 167 do_reset(NULL, 0, 0, NULL); 168 } 169 170 static int rkusb_do_reset(struct fsg_common *common, 171 struct fsg_buffhd *bh) 172 { 173 common->data_size_from_cmnd = common->cmnd[4]; 174 common->residue = 0; 175 bh->inreq->complete = __do_reset; 176 bh->state = BUF_STATE_EMPTY; 177 178 rkusb_rst_code = !common->cmnd[1] ? 0xff : common->cmnd[1]; 179 return 0; 180 } 181 182 __weak bool rkusb_usb3_capable(void) 183 { 184 return false; 185 } 186 187 static int rkusb_do_switch_to_usb3(struct fsg_common *common, 188 struct fsg_buffhd *bh) 189 { 190 g_dnl_set_serialnumber((char *)&common->cmnd[1]); 191 rkusb_switch_to_usb3_enable(true); 192 bh->state = BUF_STATE_EMPTY; 193 194 return 0; 195 } 196 197 static int rkusb_do_test_unit_ready(struct fsg_common *common, 198 struct fsg_buffhd *bh) 199 { 200 struct blk_desc *desc = &ums[common->lun].block_dev; 201 u32 usb_trb_size; 202 u16 residue; 203 204 if ((desc->if_type == IF_TYPE_MTD && desc->devnum == BLK_MTD_SPI_NOR) || 205 desc->if_type == IF_TYPE_SPINOR) 206 residue = 0x03; /* 128KB Max block xfer for SPI Nor */ 207 else if (common->cmnd[1] == 0xf7 && FSG_BUFLEN >= 0x400000) 208 residue = 0x0a; /* Max block xfer for USB DWC3 */ 209 else 210 residue = 0x06; /* Max block xfer support from host */ 211 212 usb_trb_size = (1 << residue) * 4096; 213 common->usb_trb_size = min(usb_trb_size, FSG_BUFLEN); 214 common->residue = residue << 24; 215 common->data_dir = DATA_DIR_NONE; 216 bh->state = BUF_STATE_EMPTY; 217 218 return 0; 219 } 220 221 static int rkusb_do_read_flash_id(struct fsg_common *common, 222 struct fsg_buffhd *bh) 223 { 224 u8 *buf = (u8 *)bh->buf; 225 u32 len = 5; 226 enum if_type type = ums[common->lun].block_dev.if_type; 227 u32 devnum = ums[common->lun].block_dev.devnum; 228 const char *str; 229 230 switch (type) { 231 case IF_TYPE_MMC: 232 str = "EMMC "; 233 break; 234 case IF_TYPE_RKNAND: 235 str = "NAND "; 236 break; 237 case IF_TYPE_MTD: 238 if (devnum == BLK_MTD_SPI_NAND) 239 str ="SNAND"; 240 else if (devnum == BLK_MTD_NAND) 241 str = "NAND "; 242 else 243 str = "NOR "; 244 break; 245 case IF_TYPE_SCSI: 246 str = "SATA "; 247 break; 248 case IF_TYPE_NVME: 249 str = "PCIE "; 250 break; 251 default: 252 str = "UNKN "; /* unknown */ 253 break; 254 } 255 256 memcpy((void *)&buf[0], str, len); 257 258 /* Set data xfer size */ 259 common->residue = common->data_size_from_cmnd = len; 260 common->data_size = len; 261 262 return len; 263 } 264 265 static int rkusb_do_test_bad_block(struct fsg_common *common, 266 struct fsg_buffhd *bh) 267 { 268 u8 *buf = (u8 *)bh->buf; 269 u32 len = 64; 270 271 memset((void *)&buf[0], 0, len); 272 273 /* Set data xfer size */ 274 common->residue = common->data_size_from_cmnd = len; 275 common->data_size = len; 276 277 return len; 278 } 279 280 static int rkusb_do_read_flash_info(struct fsg_common *common, 281 struct fsg_buffhd *bh) 282 { 283 struct blk_desc *desc = &ums[common->lun].block_dev; 284 u8 *buf = (u8 *)bh->buf; 285 u32 len = sizeof(struct rk_flash_info); 286 struct rk_flash_info finfo = { 287 .block_size = ROCKCHIP_FLASH_BLOCK_SIZE, 288 .ecc_bits = 0, 289 .page_size = ROCKCHIP_FLASH_PAGE_SIZE, 290 .access_time = 40, 291 .manufacturer = 0, 292 .flash_mask = 0 293 }; 294 295 /* Set the raw block size for tools to creat GPT with 4K block size */ 296 if (desc->rawblksz == 0x1000) 297 finfo.manufacturer = 208; 298 299 finfo.flash_size = (u32)desc->lba; 300 301 if (desc->if_type == IF_TYPE_MTD && 302 (desc->devnum == BLK_MTD_NAND || 303 desc->devnum == BLK_MTD_SPI_NAND)) { 304 struct mtd_info *mtd = (struct mtd_info *)desc->bdev->priv; 305 306 if (mtd) { 307 finfo.block_size = mtd->erasesize >> 9; 308 finfo.page_size = mtd->writesize >> 9; 309 #ifdef CONFIG_SUPPORT_USBPLUG 310 /* Using 4KB pagesize as 2KB for idblock */ 311 if (finfo.page_size == 8 && desc->devnum == BLK_MTD_SPI_NAND) 312 finfo.page_size |= (4 << 4); 313 #endif 314 } 315 } 316 317 if (desc->if_type == IF_TYPE_MTD && desc->devnum == BLK_MTD_SPI_NOR) { 318 /* RV1126 mtd spinor keep the former upgrade mode */ 319 #if !defined(CONFIG_ROCKCHIP_RV1126) 320 finfo.block_size = 0x80; /* Aligned to 64KB */ 321 #else 322 finfo.block_size = ROCKCHIP_FLASH_BLOCK_SIZE; 323 #endif 324 #if defined(CONFIG_ROCKCHIP_RK3308) 325 } else if (desc->if_type == IF_TYPE_SPINOR) { 326 finfo.block_size = 0x80; /* Aligned to 64KB */ 327 #endif 328 } 329 330 debug("Flash info: block_size= %x page_size= %x\n", finfo.block_size, 331 finfo.page_size); 332 333 if (finfo.flash_size) 334 finfo.flash_mask = 1; 335 336 memset((void *)&buf[0], 0, len); 337 memcpy((void *)&buf[0], (void *)&finfo, len); 338 339 /* Set data xfer size */ 340 common->residue = common->data_size_from_cmnd = len; 341 /* legacy upgrade_tool does not set correct transfer size */ 342 common->data_size = len; 343 344 return len; 345 } 346 347 static int rkusb_do_get_chip_info(struct fsg_common *common, 348 struct fsg_buffhd *bh) 349 { 350 u8 *buf = (u8 *)bh->buf; 351 u32 len = common->data_size; 352 u32 chip_info[4]; 353 354 memset((void *)chip_info, 0, sizeof(chip_info)); 355 rockchip_rockusb_get_chip_info(chip_info); 356 357 memset((void *)&buf[0], 0, len); 358 memcpy((void *)&buf[0], (void *)chip_info, len); 359 360 /* Set data xfer size */ 361 common->residue = common->data_size_from_cmnd = len; 362 363 return len; 364 } 365 366 static int rkusb_do_lba_erase(struct fsg_common *common, 367 struct fsg_buffhd *bh) 368 { 369 struct fsg_lun *curlun = &common->luns[common->lun]; 370 u32 lba, amount; 371 loff_t file_offset; 372 int rc; 373 374 lba = get_unaligned_be32(&common->cmnd[2]); 375 if (lba >= curlun->num_sectors) { 376 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 377 rc = -EINVAL; 378 goto out; 379 } 380 381 file_offset = ((loff_t) lba) << 9; 382 amount = get_unaligned_be16(&common->cmnd[7]) << 9; 383 if (unlikely(amount == 0)) { 384 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 385 rc = -EIO; 386 goto out; 387 } 388 389 /* Perform the erase */ 390 rc = ums[common->lun].erase_sector(&ums[common->lun], 391 file_offset / SECTOR_SIZE, 392 amount / SECTOR_SIZE); 393 if (!rc) { 394 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 395 rc = -EIO; 396 } 397 398 out: 399 common->data_dir = DATA_DIR_NONE; 400 bh->state = BUF_STATE_EMPTY; 401 402 return rc; 403 } 404 405 static int rkusb_do_erase_force(struct fsg_common *common, 406 struct fsg_buffhd *bh) 407 { 408 struct blk_desc *desc = &ums[common->lun].block_dev; 409 struct fsg_lun *curlun = &common->luns[common->lun]; 410 u16 block_size = ROCKCHIP_FLASH_BLOCK_SIZE; 411 u32 lba, amount; 412 loff_t file_offset; 413 int rc; 414 415 lba = get_unaligned_be32(&common->cmnd[2]); 416 if (lba >= curlun->num_sectors) { 417 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 418 rc = -EINVAL; 419 goto out; 420 } 421 422 if (desc->if_type == IF_TYPE_MTD && 423 (desc->devnum == BLK_MTD_NAND || 424 desc->devnum == BLK_MTD_SPI_NAND)) { 425 struct mtd_info *mtd = (struct mtd_info *)desc->bdev->priv; 426 427 if (mtd) 428 block_size = mtd->erasesize >> 9; 429 } 430 431 file_offset = ((loff_t)lba) * block_size; 432 amount = get_unaligned_be16(&common->cmnd[7]) * block_size; 433 434 debug("%s lba= %x, nsec= %x\n", __func__, lba, 435 (u32)get_unaligned_be16(&common->cmnd[7])); 436 437 if (unlikely(amount == 0)) { 438 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 439 rc = -EIO; 440 goto out; 441 } 442 443 /* Perform the erase */ 444 rc = ums[common->lun].erase_sector(&ums[common->lun], 445 file_offset, 446 amount); 447 if (!rc) { 448 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 449 rc = -EIO; 450 } 451 452 out: 453 common->data_dir = DATA_DIR_NONE; 454 bh->state = BUF_STATE_EMPTY; 455 456 return rc; 457 } 458 459 static int rkusb_do_vs_write(struct fsg_common *common) 460 { 461 struct fsg_lun *curlun = &common->luns[common->lun]; 462 u16 type = get_unaligned_be16(&common->cmnd[4]); 463 struct vendor_item *vhead; 464 struct fsg_buffhd *bh; 465 void *data; 466 int rc; 467 468 if (common->data_size >= (u32)65536) { 469 /* _MUST_ small than 64K */ 470 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 471 return -EINVAL; 472 } 473 474 common->residue = common->data_size; 475 common->usb_amount_left = common->data_size; 476 477 /* Carry out the file writes */ 478 if (unlikely(common->data_size == 0)) 479 return -EIO; /* No data to write */ 480 481 for (;;) { 482 if (common->usb_amount_left > 0) { 483 /* Wait for the next buffer to become available */ 484 bh = common->next_buffhd_to_fill; 485 if (bh->state != BUF_STATE_EMPTY) 486 goto wait; 487 488 /* Request the next buffer */ 489 common->usb_amount_left -= common->data_size; 490 bh->outreq->length = common->data_size; 491 bh->bulk_out_intended_length = common->data_size; 492 bh->outreq->short_not_ok = 1; 493 494 START_TRANSFER_OR(common, bulk_out, bh->outreq, 495 &bh->outreq_busy, &bh->state) 496 /* 497 * Don't know what to do if 498 * common->fsg is NULL 499 */ 500 return -EIO; 501 common->next_buffhd_to_fill = bh->next; 502 } else { 503 /* Then, wait for the data to become available */ 504 bh = common->next_buffhd_to_drain; 505 if (bh->state != BUF_STATE_FULL) 506 goto wait; 507 508 common->next_buffhd_to_drain = bh->next; 509 bh->state = BUF_STATE_EMPTY; 510 511 /* Did something go wrong with the transfer? */ 512 if (bh->outreq->status != 0) { 513 curlun->sense_data = SS_COMMUNICATION_FAILURE; 514 curlun->info_valid = 1; 515 break; 516 } 517 518 /* Perform the write */ 519 vhead = (struct vendor_item *)bh->buf; 520 data = bh->buf + sizeof(struct vendor_item); 521 if (CONFIG_IS_ENABLED(ROCKCHIP_VENDOR_PARTITION) && !type) { 522 #ifndef CONFIG_SUPPORT_USBPLUG 523 if (vhead->id == HDCP_14_HDMI_ID || 524 vhead->id == HDCP_14_HDMIRX_ID || 525 vhead->id == HDCP_14_DP_ID) { 526 rc = vendor_handle_hdcp(vhead); 527 if (rc < 0) { 528 curlun->sense_data = SS_WRITE_ERROR; 529 return -EIO; 530 } 531 } 532 #endif 533 534 /* Vendor storage */ 535 rc = vendor_storage_write(vhead->id, 536 (char __user *)data, 537 vhead->size); 538 if (rc < 0) { 539 curlun->sense_data = SS_WRITE_ERROR; 540 return -EIO; 541 } 542 } else if (type == 1) { 543 /* RPMB */ 544 rc = 545 write_keybox_to_secure_storage((u8 *)data, 546 vhead->size); 547 if (rc < 0) { 548 curlun->sense_data = SS_WRITE_ERROR; 549 return -EIO; 550 } 551 } else if (type == 2) { 552 /* security storage */ 553 #ifdef CONFIG_RK_AVB_LIBAVB_USER 554 debug("%s call rk_avb_write_perm_attr %d, %d\n", 555 __func__, vhead->id, vhead->size); 556 rc = rk_avb_write_perm_attr(vhead->id, 557 (char __user *)data, 558 vhead->size); 559 if (rc < 0) { 560 curlun->sense_data = SS_WRITE_ERROR; 561 return -EIO; 562 } 563 #else 564 printf("Please enable CONFIG_RK_AVB_LIBAVB_USER\n"); 565 #endif 566 } else if (type == 3) { 567 /* efuse or otp*/ 568 #ifdef CONFIG_OPTEE_CLIENT 569 if (memcmp(data, "TAEK", 4) == 0) { 570 if (vhead->size - 8 != 32) { 571 printf("check ta encryption key size fail!\n"); 572 curlun->sense_data = SS_WRITE_ERROR; 573 return -EIO; 574 } 575 if (trusty_write_ta_encryption_key((uint32_t *)(data + 8), 8) != 0) { 576 printf("trusty_write_ta_encryption_key error!"); 577 curlun->sense_data = SS_WRITE_ERROR; 578 return -EIO; 579 } 580 } else if (memcmp(data, "EHUK", 4) == 0) { 581 if (vhead->size - 8 != 32) { 582 printf("check oem huk size fail!\n"); 583 curlun->sense_data = SS_WRITE_ERROR; 584 return -EIO; 585 } 586 if (trusty_write_oem_huk((uint32_t *)(data + 8), 8) != 0) { 587 printf("trusty_write_oem_huk error!"); 588 curlun->sense_data = SS_WRITE_ERROR; 589 return -EIO; 590 } 591 } else if (memcmp(data, "ENDA", 4) == 0) { 592 if (vhead->size - 8 != 16) { 593 printf("check oem encrypt data size fail!\n"); 594 curlun->sense_data = SS_WRITE_ERROR; 595 return -EIO; 596 } 597 if (trusty_write_oem_encrypt_data((uint32_t *)(data + 8), 4) != 0) { 598 printf("trusty_write_oem_encrypt_data error!"); 599 curlun->sense_data = SS_WRITE_ERROR; 600 return -EIO; 601 } 602 } else if (memcmp(data, "OTPK", 4) == 0) { 603 uint32_t key_len = vhead->size - 9; 604 uint8_t key_id = *((uint8_t *)data + 8); 605 if (key_len == 4 && memcmp(data + 9, "lock", 4) == 0) { 606 if (trusty_set_oem_hr_otp_read_lock(key_id) != 0) { 607 printf("trusty_set_oem_hr_otp_read_lock error!"); 608 curlun->sense_data = SS_WRITE_ERROR; 609 return -EIO; 610 } 611 } else { 612 if (key_len != 16 && key_len != 24 && key_len != 32) { 613 printf("check oem otp key size fail!\n"); 614 curlun->sense_data = SS_WRITE_ERROR; 615 return -EIO; 616 } 617 if (trusty_write_oem_otp_key(key_id, (uint8_t *)(data + 9), key_len) != 0) { 618 printf("trusty_write_oem_otp_key error!"); 619 curlun->sense_data = SS_WRITE_ERROR; 620 return -EIO; 621 } 622 } 623 } else if (memcmp(data, "FWEK", 4) == 0) { 624 uint32_t key_len = vhead->size - 9; 625 uint8_t key_id = *((uint8_t *)data + 8); 626 if (key_len == 4 && memcmp(data + 9, "lock", 4) == 0) { 627 if (trusty_set_fw_encrypt_key_mask(key_id) != 0) { 628 printf("trusty_set_fw_encrypt_key_mask error!"); 629 curlun->sense_data = SS_WRITE_ERROR; 630 return -EIO; 631 } 632 } else { 633 if (key_len != 16 && key_len != 32) { 634 printf("check FW encrypt key size fail!\n"); 635 curlun->sense_data = SS_WRITE_ERROR; 636 return -EIO; 637 } 638 if (trusty_write_fw_encrypt_key(key_id, (uint8_t *)(data + 9), key_len) != 0) { 639 printf("trusty_write_fw_encrypt_key error!"); 640 curlun->sense_data = SS_WRITE_ERROR; 641 return -EIO; 642 } 643 } 644 } else { 645 printf("Unknown tag\n"); 646 curlun->sense_data = SS_WRITE_ERROR; 647 return -EIO; 648 } 649 #else 650 printf("Please enable CONFIG_OPTEE_CLIENT\n"); 651 #endif 652 } else { 653 return -EINVAL; 654 } 655 656 common->residue -= common->data_size; 657 658 /* Did the host decide to stop early? */ 659 if (bh->outreq->actual != bh->outreq->length) 660 common->short_packet_received = 1; 661 break; /* Command done */ 662 } 663 wait: 664 /* Wait for something to happen */ 665 rc = sleep_thread(common); 666 if (rc) 667 return rc; 668 } 669 670 return -EIO; /* No default reply */ 671 } 672 673 static int rkusb_do_vs_read(struct fsg_common *common) 674 { 675 struct fsg_lun *curlun = &common->luns[common->lun]; 676 u16 type = get_unaligned_be16(&common->cmnd[4]); 677 struct vendor_item *vhead; 678 struct fsg_buffhd *bh; 679 void *data; 680 int rc; 681 682 if (common->data_size >= (u32)65536) { 683 /* _MUST_ small than 64K */ 684 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 685 return -EINVAL; 686 } 687 688 common->residue = common->data_size; 689 common->usb_amount_left = common->data_size; 690 691 /* Carry out the file reads */ 692 if (unlikely(common->data_size == 0)) 693 return -EIO; /* No default reply */ 694 695 for (;;) { 696 /* Wait for the next buffer to become available */ 697 bh = common->next_buffhd_to_fill; 698 while (bh->state != BUF_STATE_EMPTY) { 699 rc = sleep_thread(common); 700 if (rc) 701 return rc; 702 } 703 704 memset(bh->buf, 0, FSG_BUFLEN); 705 vhead = (struct vendor_item *)bh->buf; 706 data = bh->buf + sizeof(struct vendor_item); 707 vhead->id = get_unaligned_be16(&common->cmnd[2]); 708 if (CONFIG_IS_ENABLED(ROCKCHIP_VENDOR_PARTITION) && !type) { 709 /* Vendor storage */ 710 rc = vendor_storage_read(vhead->id, 711 (char __user *)data, 712 common->data_size); 713 if (!rc) { 714 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 715 return -EIO; 716 } 717 vhead->size = rc; 718 } else if (type == 1) { 719 /* RPMB */ 720 rc = 721 read_raw_data_from_secure_storage((u8 *)data, 722 common->data_size); 723 if (!rc) { 724 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 725 return -EIO; 726 } 727 vhead->size = rc; 728 } else if (type == 2) { 729 /* security storage */ 730 #ifdef CONFIG_RK_AVB_LIBAVB_USER 731 rc = rk_avb_read_perm_attr(vhead->id, 732 (char __user *)data, 733 vhead->size); 734 if (rc < 0) 735 return -EIO; 736 vhead->size = rc; 737 #else 738 printf("Please enable CONFIG_RK_AVB_LIBAVB_USER!\n"); 739 #endif 740 } else if (type == 3) { 741 /* efuse or otp*/ 742 #ifdef CONFIG_OPTEE_CLIENT 743 if (vhead->id == 120) { 744 u8 value; 745 char *written_str = "key is written!"; 746 char *not_written_str = "key is not written!"; 747 if (trusty_ta_encryption_key_is_written(&value) != 0) { 748 printf("trusty_ta_encryption_key_is_written error!"); 749 return -EIO; 750 } 751 if (value) { 752 memcpy(data, written_str, strlen(written_str)); 753 vhead->size = strlen(written_str); 754 } else { 755 memcpy(data, not_written_str, strlen(not_written_str)); 756 vhead->size = strlen(not_written_str); 757 } 758 } else { 759 printf("Unknown tag\n"); 760 return -EIO; 761 } 762 #else 763 printf("Please enable CONFIG_OPTEE_CLIENT\n"); 764 #endif 765 } else { 766 return -EINVAL; 767 } 768 769 common->residue -= common->data_size; 770 bh->inreq->length = common->data_size; 771 bh->state = BUF_STATE_FULL; 772 773 break; /* No more left to read */ 774 } 775 776 return -EIO; /* No default reply */ 777 } 778 779 #if CONFIG_PSTORE 780 static int rkusb_do_uart_debug_read(struct fsg_common *common) 781 { 782 struct fsg_buffhd *bh; 783 int *debug_head; 784 int debug_data_size; 785 int rc; 786 787 if (common->data_size >= (u32)FSG_BUFLEN) 788 return -EINVAL; 789 790 common->residue = common->data_size; 791 common->usb_amount_left = common->data_size; 792 793 /* Carry out the file reads */ 794 if (unlikely(common->data_size == 0) || unlikely(!gd->pstore_addr)) 795 return -EIO; /* No default reply */ 796 797 /* Wait for the next buffer to become available */ 798 bh = common->next_buffhd_to_fill; 799 while (bh->state != BUF_STATE_EMPTY) { 800 rc = sleep_thread(common); 801 if (rc) 802 return rc; 803 } 804 805 debug_head = (int *)gd->pstore_addr; 806 debug_data_size = debug_head[2]; 807 if (debug_data_size > FSG_BUFLEN - 8) 808 debug_data_size = FSG_BUFLEN - 8; 809 if (debug_data_size > common->data_size - 8) 810 debug_data_size = common->data_size - 8; 811 812 debug_head = (int *)bh->buf; 813 debug_head[0] = 0x55424544; 814 debug_head[1] = debug_data_size + 8; 815 816 memcpy((void *)(bh->buf + 8), (void *)(gd->pstore_addr + 12), debug_data_size); 817 818 common->residue -= common->data_size; 819 bh->inreq->length = common->data_size; 820 bh->state = BUF_STATE_FULL; 821 822 return -EIO; /* No default reply */ 823 } 824 #endif 825 826 static int rkusb_do_switch_storage(struct fsg_common *common) 827 { 828 enum if_type type, cur_type = ums[common->lun].block_dev.if_type; 829 int devnum, cur_devnum = ums[common->lun].block_dev.devnum; 830 struct blk_desc *block_dev; 831 u32 media = BOOT_TYPE_UNKNOWN; 832 833 media = 1 << common->cmnd[1]; 834 835 switch (media) { 836 #ifdef CONFIG_MMC 837 case BOOT_TYPE_EMMC: 838 type = IF_TYPE_MMC; 839 devnum = 0; 840 mmc_initialize(gd->bd); 841 break; 842 #endif 843 case BOOT_TYPE_MTD_BLK_NAND: 844 type = IF_TYPE_MTD; 845 devnum = 0; 846 break; 847 case BOOT_TYPE_MTD_BLK_SPI_NAND: 848 type = IF_TYPE_MTD; 849 devnum = 1; 850 break; 851 case BOOT_TYPE_MTD_BLK_SPI_NOR: 852 type = IF_TYPE_MTD; 853 devnum = 2; 854 break; 855 #if defined(CONFIG_SCSI) && defined(CONFIG_CMD_SCSI) && (defined(CONFIG_AHCI) || defined(CONFIG_UFS)) 856 case BOOT_TYPE_SATA: 857 type = IF_TYPE_SCSI; 858 devnum = 0; 859 scsi_scan(true); 860 break; 861 #endif 862 case BOOT_TYPE_PCIE: 863 type = IF_TYPE_NVME; 864 devnum = 0; 865 break; 866 default: 867 printf("Bootdev 0x%x is not support\n", media); 868 return -ENODEV; 869 } 870 871 if (cur_type == type && cur_devnum == devnum) 872 return 0; 873 874 #if CONFIG_IS_ENABLED(SUPPORT_USBPLUG) 875 block_dev = usbplug_blk_get_devnum_by_type(type, devnum); 876 #else 877 block_dev = blk_get_devnum_by_type(type, devnum); 878 #endif 879 if (!block_dev) { 880 printf("Bootdev if_type=%d num=%d toggle fail\n", type, devnum); 881 return -ENODEV; 882 } 883 884 common->luns[common->lun].num_sectors = block_dev->lba; 885 ums[common->lun].num_sectors = block_dev->lba; 886 ums[common->lun].block_dev = *block_dev; 887 888 printf("RKUSB: LUN %d, dev %d, hwpart %d, sector %#x, count %#x\n", 889 0, 890 ums[common->lun].block_dev.devnum, 891 ums[common->lun].block_dev.hwpart, 892 ums[common->lun].start_sector, 893 ums[common->lun].num_sectors); 894 895 return 0; 896 } 897 898 static int rkusb_do_get_storage_info(struct fsg_common *common, 899 struct fsg_buffhd *bh) 900 { 901 enum if_type type = ums[common->lun].block_dev.if_type; 902 int devnum = ums[common->lun].block_dev.devnum; 903 u32 media = BOOT_TYPE_UNKNOWN; 904 u32 len = common->data_size; 905 u8 *buf = (u8 *)bh->buf; 906 907 if (len > 4) 908 len = 4; 909 910 switch (type) { 911 case IF_TYPE_MMC: 912 media = BOOT_TYPE_EMMC; 913 break; 914 915 case IF_TYPE_SD: 916 media = BOOT_TYPE_SD0; 917 break; 918 919 case IF_TYPE_MTD: 920 if (devnum == BLK_MTD_SPI_NAND) 921 media = BOOT_TYPE_MTD_BLK_SPI_NAND; 922 else if (devnum == BLK_MTD_NAND) 923 media = BOOT_TYPE_NAND; 924 else 925 media = BOOT_TYPE_MTD_BLK_SPI_NOR; 926 break; 927 928 case IF_TYPE_SCSI: 929 media = BOOT_TYPE_SATA; 930 break; 931 932 case IF_TYPE_RKNAND: 933 media = BOOT_TYPE_NAND; 934 break; 935 936 case IF_TYPE_NVME: 937 media = BOOT_TYPE_PCIE; 938 break; 939 940 default: 941 break; 942 } 943 944 memcpy((void *)&buf[0], (void *)&media, len); 945 common->residue = len; 946 common->data_size_from_cmnd = len; 947 948 return len; 949 } 950 951 static int rkusb_do_read_capacity(struct fsg_common *common, 952 struct fsg_buffhd *bh) 953 { 954 u8 *buf = (u8 *)bh->buf; 955 u32 len = common->data_size; 956 enum if_type type = ums[common->lun].block_dev.if_type; 957 int devnum = ums[common->lun].block_dev.devnum; 958 959 /* 960 * bit[0]: Direct LBA, 0: Disabled; 961 * bit[1]: Vendor Storage API, 0: Disabed (default); 962 * bit[2]: First 4M Access, 0: Disabled; 963 * bit[3]: Read LBA On, 0: Disabed (default); 964 * bit[4]: New Vendor Storage API, 0: Disabed; 965 * bit[5]: Read uart data from ram 966 * bit[6]: Read IDB config 967 * bit[7]: Read SecureMode 968 * bit[8]: New IDB feature 969 * bit[9]: Get storage media info 970 * bit[10]: LBAwrite Parity 971 * bit[11]: Read Otp Data 972 * bit[12]: usb3 download 973 * bit[13]: Write OTP proof 974 * bit[14]: Write Cipher Key 975 * bit[15:63}: Reserved. 976 */ 977 memset((void *)&buf[0], 0, len); 978 if (type == IF_TYPE_MMC || type == IF_TYPE_SD || type == IF_TYPE_NVME) 979 buf[0] = BIT(0) | BIT(2) | BIT(4); 980 else 981 buf[0] = BIT(0) | BIT(4); 982 983 if (type == IF_TYPE_MTD && 984 (devnum == BLK_MTD_NAND || 985 devnum == BLK_MTD_SPI_NAND)) 986 buf[0] |= (1 << 6); 987 988 #ifdef CONFIG_PSTORE 989 buf[0] |= (1 << 5); 990 #endif 991 992 #if !defined(CONFIG_ROCKCHIP_RV1126) 993 if (type == IF_TYPE_MTD && devnum == BLK_MTD_SPI_NOR) 994 buf[0] |= (1 << 6); 995 #if defined(CONFIG_ROCKCHIP_RK3308) 996 else if (type == IF_TYPE_SPINOR) 997 buf[0] |= (1 << 6); 998 #endif 999 #endif 1000 1001 #if defined(CONFIG_ROCKCHIP_NEW_IDB) 1002 buf[1] = BIT(0); 1003 #endif 1004 buf[1] |= BIT(1); /* Switch Storage */ 1005 buf[1] |= BIT(2); /* LBAwrite Parity */ 1006 1007 if (rkusb_usb3_capable() && !rkusb_force_usb2_enabled()) 1008 buf[1] |= BIT(4); 1009 else 1010 buf[1] &= ~BIT(4); 1011 1012 #ifdef CONFIG_ROCKCHIP_OTP 1013 buf[1] |= BIT(3); /* Read Otp Data */ 1014 buf[1] |= BIT(5); /* Write OTP proof */ 1015 buf[1] |= BIT(6); /* Write Cipher Key */ 1016 #endif 1017 1018 /* Set data xfer size */ 1019 common->residue = len; 1020 common->data_size_from_cmnd = len; 1021 1022 return len; 1023 } 1024 1025 #ifdef CONFIG_ROCKCHIP_OTP 1026 static int rkusb_do_read_otp(struct fsg_common *common, 1027 struct fsg_buffhd *bh) 1028 { 1029 u32 len = common->data_size; 1030 u32 type = common->cmnd[1]; 1031 u8 *buf = (u8 *)bh->buf; 1032 struct udevice *dev; 1033 1034 buf[0] = 0; 1035 if (type == 0) { /* soc uuid */ 1036 if (!uclass_get_device_by_driver(UCLASS_MISC, DM_GET_DRIVER(rockchip_otp), &dev)) { 1037 if (!misc_read(dev, CFG_CPUID_OFFSET, (void *)&buf[1], len)) 1038 buf[0] = len; 1039 } 1040 } 1041 1042 common->residue = len; 1043 common->data_size_from_cmnd = len; 1044 1045 return len; 1046 } 1047 #endif 1048 1049 static void rkusb_fixup_cbwcb(struct fsg_common *common, 1050 struct fsg_buffhd *bh) 1051 { 1052 struct usb_request *req = bh->outreq; 1053 struct fsg_bulk_cb_wrap *cbw = req->buf; 1054 1055 /* FIXME cbw.DataTransferLength was not set by Upgrade Tool */ 1056 common->data_size = le32_to_cpu(cbw->DataTransferLength); 1057 if (common->data_size == 0) { 1058 common->data_size = 1059 get_unaligned_be16(&common->cmnd[7]) << 9; 1060 printf("Trasfer Length NOT set, please use new version tool\n"); 1061 debug("%s %d, cmnd1 %x\n", __func__, 1062 get_unaligned_be16(&common->cmnd[7]), 1063 get_unaligned_be16(&common->cmnd[1])); 1064 } 1065 if (cbw->Flags & USB_BULK_IN_FLAG) 1066 common->data_dir = DATA_DIR_TO_HOST; 1067 else 1068 common->data_dir = DATA_DIR_FROM_HOST; 1069 1070 /* Not support */ 1071 common->cmnd[1] = 0; 1072 } 1073 1074 static int rkusb_cmd_process(struct fsg_common *common, 1075 struct fsg_buffhd *bh, int *reply) 1076 { 1077 struct usb_request *req = bh->outreq; 1078 struct fsg_bulk_cb_wrap *cbw = req->buf; 1079 int rc; 1080 1081 dump_cbw(cbw); 1082 1083 if (rkusb_check_lun(common)) { 1084 *reply = -EINVAL; 1085 return RKUSB_RC_ERROR; 1086 } 1087 1088 switch (common->cmnd[0]) { 1089 case RKUSB_TEST_UNIT_READY: 1090 *reply = rkusb_do_test_unit_ready(common, bh); 1091 rc = RKUSB_RC_FINISHED; 1092 break; 1093 1094 case RKUSB_READ_FLASH_ID: 1095 *reply = rkusb_do_read_flash_id(common, bh); 1096 rc = RKUSB_RC_FINISHED; 1097 break; 1098 1099 case RKUSB_TEST_BAD_BLOCK: 1100 *reply = rkusb_do_test_bad_block(common, bh); 1101 rc = RKUSB_RC_FINISHED; 1102 break; 1103 1104 case RKUSB_ERASE_10_FORCE: 1105 *reply = rkusb_do_erase_force(common, bh); 1106 rc = RKUSB_RC_FINISHED; 1107 break; 1108 1109 case RKUSB_LBA_READ_10: 1110 rkusb_fixup_cbwcb(common, bh); 1111 common->cmnd[0] = SC_READ_10; 1112 common->cmnd[1] = 0; /* Not support */ 1113 rc = RKUSB_RC_CONTINUE; 1114 break; 1115 1116 case RKUSB_LBA_WRITE_10: 1117 rkusb_fixup_cbwcb(common, bh); 1118 common->cmnd[0] = SC_WRITE_10; 1119 common->cmnd[1] = 0; /* Not support */ 1120 rc = RKUSB_RC_CONTINUE; 1121 break; 1122 1123 case RKUSB_READ_FLASH_INFO: 1124 *reply = rkusb_do_read_flash_info(common, bh); 1125 rc = RKUSB_RC_FINISHED; 1126 break; 1127 1128 case RKUSB_GET_CHIP_VER: 1129 *reply = rkusb_do_get_chip_info(common, bh); 1130 rc = RKUSB_RC_FINISHED; 1131 break; 1132 1133 case RKUSB_LBA_ERASE: 1134 *reply = rkusb_do_lba_erase(common, bh); 1135 rc = RKUSB_RC_FINISHED; 1136 break; 1137 1138 case RKUSB_VS_WRITE: 1139 *reply = rkusb_do_vs_write(common); 1140 rc = RKUSB_RC_FINISHED; 1141 break; 1142 1143 case RKUSB_VS_READ: 1144 *reply = rkusb_do_vs_read(common); 1145 rc = RKUSB_RC_FINISHED; 1146 break; 1147 1148 #ifdef CONFIG_PSTORE 1149 case RKUSB_UART_READ: 1150 rkusb_fixup_cbwcb(common, bh); 1151 *reply = rkusb_do_uart_debug_read(common); 1152 rc = RKUSB_RC_FINISHED; 1153 break; 1154 #endif 1155 1156 case RKUSB_SWITCH_STORAGE: 1157 *reply = rkusb_do_switch_storage(common); 1158 rc = RKUSB_RC_FINISHED; 1159 break; 1160 1161 case RKUSB_GET_STORAGE_MEDIA: 1162 *reply = rkusb_do_get_storage_info(common, bh); 1163 rc = RKUSB_RC_FINISHED; 1164 break; 1165 1166 case RKUSB_READ_CAPACITY: 1167 *reply = rkusb_do_read_capacity(common, bh); 1168 rc = RKUSB_RC_FINISHED; 1169 break; 1170 1171 case RKUSB_SWITCH_USB3: 1172 *reply = rkusb_do_switch_to_usb3(common, bh); 1173 rc = RKUSB_RC_FINISHED; 1174 break; 1175 1176 case RKUSB_RESET: 1177 *reply = rkusb_do_reset(common, bh); 1178 rc = RKUSB_RC_FINISHED; 1179 break; 1180 1181 #ifdef CONFIG_ROCKCHIP_OTP 1182 case RKUSB_READ_OTP_DATA: 1183 *reply = rkusb_do_read_otp(common, bh); 1184 rc = RKUSB_RC_FINISHED; 1185 break; 1186 #endif 1187 1188 case RKUSB_READ_10: 1189 case RKUSB_WRITE_10: 1190 printf("CMD Not support, pls use new version Tool\n"); 1191 case RKUSB_SET_DEVICE_ID: 1192 case RKUSB_ERASE_10: 1193 case RKUSB_WRITE_SPARE: 1194 case RKUSB_READ_SPARE: 1195 case RKUSB_GET_VERSION: 1196 case RKUSB_ERASE_SYS_DISK: 1197 case RKUSB_SDRAM_READ_10: 1198 case RKUSB_SDRAM_WRITE_10: 1199 case RKUSB_SDRAM_EXECUTE: 1200 case RKUSB_LOW_FORMAT: 1201 case RKUSB_SET_RESET_FLAG: 1202 case RKUSB_SPI_READ_10: 1203 case RKUSB_SPI_WRITE_10: 1204 /* Fall through */ 1205 default: 1206 rc = RKUSB_RC_UNKNOWN_CMND; 1207 break; 1208 } 1209 1210 return rc; 1211 } 1212 1213 int rkusb_do_check_parity(struct fsg_common *common) 1214 { 1215 int ret = 0, rc; 1216 u32 parity, i, usb_parity, lba, len; 1217 static u32 usb_check_buffer[1024 * 256]; 1218 1219 usb_parity = common->cmnd[9] | (common->cmnd[10] << 8) | 1220 (common->cmnd[11] << 16) | (common->cmnd[12] << 24); 1221 1222 if (common->cmnd[0] == SC_WRITE_10 && (usb_parity)) { 1223 lba = get_unaligned_be32(&common->cmnd[2]); 1224 len = common->data_size_from_cmnd >> 9; 1225 rc = blk_dread(&ums[common->lun].block_dev, lba, len, usb_check_buffer); 1226 parity = 0x000055aa; 1227 for (i = 0; i < len * 128; i++) 1228 parity += usb_check_buffer[i]; 1229 if (!rc || parity != usb_parity) 1230 common->phase_error = 1; 1231 } 1232 1233 return ret; 1234 } 1235 1236 DECLARE_GADGET_BIND_CALLBACK(rkusb_ums_dnl, fsg_add); 1237