1 /* 2 * Copyright 2017 Rockchip Electronics Co., Ltd 3 * Frank Wang <frank.wang@rock-chips.com> 4 * 5 * SPDX-License-Identifier: GPL-2.0+ 6 */ 7 8 #include <asm/io.h> 9 #include <android_avb/avb_ops_user.h> 10 #include <android_avb/rk_avb_ops_user.h> 11 #include <asm/arch/boot_mode.h> 12 #include <asm/arch/chip_info.h> 13 #include <asm/arch/rk_atags.h> 14 #include <write_keybox.h> 15 #include <linux/mtd/mtd.h> 16 #include <optee_include/OpteeClientInterface.h> 17 #include <dm.h> 18 #include <misc.h> 19 #include <mmc.h> 20 #include <scsi.h> 21 #include <stdlib.h> 22 #include <usbplug.h> 23 #include <asm/arch/vendor.h> 24 #include <rockusb.h> 25 26 #define ROCKUSB_INTERFACE_CLASS 0xff 27 #define ROCKUSB_INTERFACE_SUB_CLASS 0x06 28 #define ROCKUSB_INTERFACE_PROTOCOL 0x05 29 30 #define ROCKCHIP_FLASH_BLOCK_SIZE 1024 31 #define ROCKCHIP_FLASH_PAGE_SIZE 4 32 33 static struct usb_interface_descriptor rkusb_intf_desc = { 34 .bLength = USB_DT_INTERFACE_SIZE, 35 .bDescriptorType = USB_DT_INTERFACE, 36 .bInterfaceNumber = 0x00, 37 .bAlternateSetting = 0x00, 38 .bNumEndpoints = 0x02, 39 .bInterfaceClass = ROCKUSB_INTERFACE_CLASS, 40 .bInterfaceSubClass = ROCKUSB_INTERFACE_SUB_CLASS, 41 .bInterfaceProtocol = ROCKUSB_INTERFACE_PROTOCOL, 42 }; 43 44 static struct usb_descriptor_header *rkusb_fs_function[] = { 45 (struct usb_descriptor_header *)&rkusb_intf_desc, 46 (struct usb_descriptor_header *)&fsg_fs_bulk_in_desc, 47 (struct usb_descriptor_header *)&fsg_fs_bulk_out_desc, 48 NULL, 49 }; 50 51 static struct usb_descriptor_header *rkusb_hs_function[] = { 52 (struct usb_descriptor_header *)&rkusb_intf_desc, 53 (struct usb_descriptor_header *)&fsg_hs_bulk_in_desc, 54 (struct usb_descriptor_header *)&fsg_hs_bulk_out_desc, 55 NULL, 56 }; 57 58 static struct usb_descriptor_header *rkusb_ss_function[] = { 59 (struct usb_descriptor_header *)&rkusb_intf_desc, 60 (struct usb_descriptor_header *)&fsg_ss_bulk_in_desc, 61 (struct usb_descriptor_header *)&fsg_ss_bulk_in_comp_desc, 62 (struct usb_descriptor_header *)&fsg_ss_bulk_out_desc, 63 (struct usb_descriptor_header *)&fsg_ss_bulk_out_comp_desc, 64 NULL, 65 }; 66 67 struct rk_flash_info { 68 u32 flash_size; 69 u16 block_size; 70 u8 page_size; 71 u8 ecc_bits; 72 u8 access_time; 73 u8 manufacturer; 74 u8 flash_mask; 75 } __packed; 76 77 static int rkusb_rst_code; /* The subcode in reset command (0xFF) */ 78 79 int g_dnl_bind_fixup(struct usb_device_descriptor *dev, const char *name) 80 { 81 if (IS_RKUSB_UMS_DNL(name)) { 82 /* Fix to Rockchip's VID and PID */ 83 dev->idVendor = __constant_cpu_to_le16(0x2207); 84 dev->idProduct = __constant_cpu_to_le16(CONFIG_ROCKUSB_G_DNL_PID); 85 86 /* Enumerate as a loader device */ 87 #if defined(CONFIG_SUPPORT_USBPLUG) 88 dev->bcdUSB = cpu_to_le16(0x0200); 89 #else 90 dev->bcdUSB = cpu_to_le16(0x0201); 91 #endif 92 } else if (!strncmp(name, "usb_dnl_fastboot", 16)) { 93 /* Fix to Google's VID and PID */ 94 dev->idVendor = __constant_cpu_to_le16(0x18d1); 95 dev->idProduct = __constant_cpu_to_le16(0x4d00); 96 } else if (!strncmp(name, "usb_dnl_dfu", 11)) { 97 /* Fix to Rockchip's VID and PID for DFU */ 98 dev->idVendor = cpu_to_le16(0x2207); 99 dev->idProduct = cpu_to_le16(0x0107); 100 } else if (!strncmp(name, "usb_dnl_ums", 11)) { 101 dev->idVendor = cpu_to_le16(0x2207); 102 dev->idProduct = cpu_to_le16(0x0010); 103 } 104 105 return 0; 106 } 107 108 __maybe_unused 109 static inline void dump_cbw(struct fsg_bulk_cb_wrap *cbw) 110 { 111 assert(!cbw); 112 113 debug("%s:\n", __func__); 114 debug("Signature %x\n", cbw->Signature); 115 debug("Tag %x\n", cbw->Tag); 116 debug("DataTransferLength %x\n", cbw->DataTransferLength); 117 debug("Flags %x\n", cbw->Flags); 118 debug("LUN %x\n", cbw->Lun); 119 debug("Length %x\n", cbw->Length); 120 debug("OptionCode %x\n", cbw->CDB[0]); 121 debug("SubCode %x\n", cbw->CDB[1]); 122 debug("SectorAddr %x\n", get_unaligned_be32(&cbw->CDB[2])); 123 debug("BlkSectors %x\n\n", get_unaligned_be16(&cbw->CDB[7])); 124 } 125 126 static int rkusb_check_lun(struct fsg_common *common) 127 { 128 struct fsg_lun *curlun; 129 130 /* Check the LUN */ 131 if (common->lun >= 0 && common->lun < common->nluns) { 132 curlun = &common->luns[common->lun]; 133 if (common->cmnd[0] != SC_REQUEST_SENSE) { 134 curlun->sense_data = SS_NO_SENSE; 135 curlun->info_valid = 0; 136 } 137 } else { 138 curlun = NULL; 139 common->bad_lun_okay = 0; 140 141 /* 142 * INQUIRY and REQUEST SENSE commands are explicitly allowed 143 * to use unsupported LUNs; all others may not. 144 */ 145 if (common->cmnd[0] != SC_INQUIRY && 146 common->cmnd[0] != SC_REQUEST_SENSE) { 147 debug("unsupported LUN %d\n", common->lun); 148 return -EINVAL; 149 } 150 } 151 152 return 0; 153 } 154 155 static void __do_reset(struct usb_ep *ep, struct usb_request *req) 156 { 157 u32 boot_flag = BOOT_NORMAL; 158 159 if (rkusb_rst_code == 0x03) 160 boot_flag = BOOT_BROM_DOWNLOAD; 161 162 rkusb_rst_code = 0; /* restore to default */ 163 writel(boot_flag, (void *)CONFIG_ROCKCHIP_BOOT_MODE_REG); 164 165 do_reset(NULL, 0, 0, NULL); 166 } 167 168 static int rkusb_do_reset(struct fsg_common *common, 169 struct fsg_buffhd *bh) 170 { 171 common->data_size_from_cmnd = common->cmnd[4]; 172 common->residue = 0; 173 bh->inreq->complete = __do_reset; 174 bh->state = BUF_STATE_EMPTY; 175 176 rkusb_rst_code = !common->cmnd[1] ? 0xff : common->cmnd[1]; 177 return 0; 178 } 179 180 __weak bool rkusb_usb3_capable(void) 181 { 182 return false; 183 } 184 185 static int rkusb_do_switch_to_usb3(struct fsg_common *common, 186 struct fsg_buffhd *bh) 187 { 188 g_dnl_set_serialnumber((char *)&common->cmnd[1]); 189 rkusb_switch_to_usb3_enable(true); 190 bh->state = BUF_STATE_EMPTY; 191 192 return 0; 193 } 194 195 static int rkusb_do_test_unit_ready(struct fsg_common *common, 196 struct fsg_buffhd *bh) 197 { 198 struct blk_desc *desc = &ums[common->lun].block_dev; 199 u32 usb_trb_size; 200 u16 residue; 201 202 if ((desc->if_type == IF_TYPE_MTD && desc->devnum == BLK_MTD_SPI_NOR) || 203 desc->if_type == IF_TYPE_SPINOR) 204 residue = 0x03; /* 128KB Max block xfer for SPI Nor */ 205 else if (common->cmnd[1] == 0xf7 && FSG_BUFLEN >= 0x400000) 206 residue = 0x0a; /* Max block xfer for USB DWC3 */ 207 else 208 residue = 0x06; /* Max block xfer support from host */ 209 210 usb_trb_size = (1 << residue) * 4096; 211 common->usb_trb_size = min(usb_trb_size, FSG_BUFLEN); 212 common->residue = residue << 24; 213 common->data_dir = DATA_DIR_NONE; 214 bh->state = BUF_STATE_EMPTY; 215 216 return 0; 217 } 218 219 static int rkusb_do_read_flash_id(struct fsg_common *common, 220 struct fsg_buffhd *bh) 221 { 222 u8 *buf = (u8 *)bh->buf; 223 u32 len = 5; 224 enum if_type type = ums[common->lun].block_dev.if_type; 225 u32 devnum = ums[common->lun].block_dev.devnum; 226 const char *str; 227 228 switch (type) { 229 case IF_TYPE_MMC: 230 str = "EMMC "; 231 break; 232 case IF_TYPE_RKNAND: 233 str = "NAND "; 234 break; 235 case IF_TYPE_MTD: 236 if (devnum == BLK_MTD_SPI_NAND) 237 str ="SNAND"; 238 else if (devnum == BLK_MTD_NAND) 239 str = "NAND "; 240 else 241 str = "NOR "; 242 break; 243 case IF_TYPE_SCSI: 244 str = "SATA "; 245 break; 246 case IF_TYPE_NVME: 247 str = "PCIE "; 248 break; 249 default: 250 str = "UNKN "; /* unknown */ 251 break; 252 } 253 254 memcpy((void *)&buf[0], str, len); 255 256 /* Set data xfer size */ 257 common->residue = common->data_size_from_cmnd = len; 258 common->data_size = len; 259 260 return len; 261 } 262 263 static int rkusb_do_test_bad_block(struct fsg_common *common, 264 struct fsg_buffhd *bh) 265 { 266 u8 *buf = (u8 *)bh->buf; 267 u32 len = 64; 268 269 memset((void *)&buf[0], 0, len); 270 271 /* Set data xfer size */ 272 common->residue = common->data_size_from_cmnd = len; 273 common->data_size = len; 274 275 return len; 276 } 277 278 static int rkusb_do_read_flash_info(struct fsg_common *common, 279 struct fsg_buffhd *bh) 280 { 281 struct blk_desc *desc = &ums[common->lun].block_dev; 282 u8 *buf = (u8 *)bh->buf; 283 u32 len = sizeof(struct rk_flash_info); 284 struct rk_flash_info finfo = { 285 .block_size = ROCKCHIP_FLASH_BLOCK_SIZE, 286 .ecc_bits = 0, 287 .page_size = ROCKCHIP_FLASH_PAGE_SIZE, 288 .access_time = 40, 289 .manufacturer = 0, 290 .flash_mask = 0 291 }; 292 293 /* Set the raw block size for tools to creat GPT with 4K block size */ 294 if (desc->rawblksz == 0x1000) 295 finfo.manufacturer = 208; 296 297 finfo.flash_size = (u32)desc->lba; 298 299 if (desc->if_type == IF_TYPE_MTD && 300 (desc->devnum == BLK_MTD_NAND || 301 desc->devnum == BLK_MTD_SPI_NAND)) { 302 struct mtd_info *mtd = (struct mtd_info *)desc->bdev->priv; 303 304 if (mtd) { 305 finfo.block_size = mtd->erasesize >> 9; 306 finfo.page_size = mtd->writesize >> 9; 307 #ifdef CONFIG_SUPPORT_USBPLUG 308 /* Using 4KB pagesize as 2KB for idblock */ 309 if (finfo.page_size == 8 && desc->devnum == BLK_MTD_SPI_NAND) 310 finfo.page_size |= (4 << 4); 311 #endif 312 } 313 } 314 315 if (desc->if_type == IF_TYPE_MTD && desc->devnum == BLK_MTD_SPI_NOR) { 316 /* RV1126 mtd spinor keep the former upgrade mode */ 317 #if !defined(CONFIG_ROCKCHIP_RV1126) 318 finfo.block_size = 0x80; /* Aligned to 64KB */ 319 #else 320 finfo.block_size = ROCKCHIP_FLASH_BLOCK_SIZE; 321 #endif 322 #if defined(CONFIG_ROCKCHIP_RK3308) 323 } else if (desc->if_type == IF_TYPE_SPINOR) { 324 finfo.block_size = 0x80; /* Aligned to 64KB */ 325 #endif 326 } 327 328 debug("Flash info: block_size= %x page_size= %x\n", finfo.block_size, 329 finfo.page_size); 330 331 if (finfo.flash_size) 332 finfo.flash_mask = 1; 333 334 memset((void *)&buf[0], 0, len); 335 memcpy((void *)&buf[0], (void *)&finfo, len); 336 337 /* Set data xfer size */ 338 common->residue = common->data_size_from_cmnd = len; 339 /* legacy upgrade_tool does not set correct transfer size */ 340 common->data_size = len; 341 342 return len; 343 } 344 345 static int rkusb_do_get_chip_info(struct fsg_common *common, 346 struct fsg_buffhd *bh) 347 { 348 u8 *buf = (u8 *)bh->buf; 349 u32 len = common->data_size; 350 u32 chip_info[4]; 351 352 memset((void *)chip_info, 0, sizeof(chip_info)); 353 rockchip_rockusb_get_chip_info(chip_info); 354 355 memset((void *)&buf[0], 0, len); 356 memcpy((void *)&buf[0], (void *)chip_info, len); 357 358 /* Set data xfer size */ 359 common->residue = common->data_size_from_cmnd = len; 360 361 return len; 362 } 363 364 static int rkusb_do_lba_erase(struct fsg_common *common, 365 struct fsg_buffhd *bh) 366 { 367 struct fsg_lun *curlun = &common->luns[common->lun]; 368 u32 lba, amount; 369 loff_t file_offset; 370 int rc; 371 372 lba = get_unaligned_be32(&common->cmnd[2]); 373 if (lba >= curlun->num_sectors) { 374 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 375 rc = -EINVAL; 376 goto out; 377 } 378 379 file_offset = ((loff_t) lba) << 9; 380 amount = get_unaligned_be16(&common->cmnd[7]) << 9; 381 if (unlikely(amount == 0)) { 382 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 383 rc = -EIO; 384 goto out; 385 } 386 387 /* Perform the erase */ 388 rc = ums[common->lun].erase_sector(&ums[common->lun], 389 file_offset / SECTOR_SIZE, 390 amount / SECTOR_SIZE); 391 if (!rc) { 392 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 393 rc = -EIO; 394 } 395 396 out: 397 common->data_dir = DATA_DIR_NONE; 398 bh->state = BUF_STATE_EMPTY; 399 400 return rc; 401 } 402 403 static int rkusb_do_erase_force(struct fsg_common *common, 404 struct fsg_buffhd *bh) 405 { 406 struct blk_desc *desc = &ums[common->lun].block_dev; 407 struct fsg_lun *curlun = &common->luns[common->lun]; 408 u16 block_size = ROCKCHIP_FLASH_BLOCK_SIZE; 409 u32 lba, amount; 410 loff_t file_offset; 411 int rc; 412 413 lba = get_unaligned_be32(&common->cmnd[2]); 414 if (lba >= curlun->num_sectors) { 415 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 416 rc = -EINVAL; 417 goto out; 418 } 419 420 if (desc->if_type == IF_TYPE_MTD && 421 (desc->devnum == BLK_MTD_NAND || 422 desc->devnum == BLK_MTD_SPI_NAND)) { 423 struct mtd_info *mtd = (struct mtd_info *)desc->bdev->priv; 424 425 if (mtd) 426 block_size = mtd->erasesize >> 9; 427 } 428 429 file_offset = ((loff_t)lba) * block_size; 430 amount = get_unaligned_be16(&common->cmnd[7]) * block_size; 431 432 debug("%s lba= %x, nsec= %x\n", __func__, lba, 433 (u32)get_unaligned_be16(&common->cmnd[7])); 434 435 if (unlikely(amount == 0)) { 436 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 437 rc = -EIO; 438 goto out; 439 } 440 441 /* Perform the erase */ 442 rc = ums[common->lun].erase_sector(&ums[common->lun], 443 file_offset, 444 amount); 445 if (!rc) { 446 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 447 rc = -EIO; 448 } 449 450 out: 451 common->data_dir = DATA_DIR_NONE; 452 bh->state = BUF_STATE_EMPTY; 453 454 return rc; 455 } 456 457 static int rkusb_do_vs_write(struct fsg_common *common) 458 { 459 struct fsg_lun *curlun = &common->luns[common->lun]; 460 u16 type = get_unaligned_be16(&common->cmnd[4]); 461 struct vendor_item *vhead; 462 struct fsg_buffhd *bh; 463 void *data; 464 int rc; 465 466 if (common->data_size >= (u32)65536) { 467 /* _MUST_ small than 64K */ 468 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 469 return -EINVAL; 470 } 471 472 common->residue = common->data_size; 473 common->usb_amount_left = common->data_size; 474 475 /* Carry out the file writes */ 476 if (unlikely(common->data_size == 0)) 477 return -EIO; /* No data to write */ 478 479 for (;;) { 480 if (common->usb_amount_left > 0) { 481 /* Wait for the next buffer to become available */ 482 bh = common->next_buffhd_to_fill; 483 if (bh->state != BUF_STATE_EMPTY) 484 goto wait; 485 486 /* Request the next buffer */ 487 common->usb_amount_left -= common->data_size; 488 bh->outreq->length = common->data_size; 489 bh->bulk_out_intended_length = common->data_size; 490 bh->outreq->short_not_ok = 1; 491 492 START_TRANSFER_OR(common, bulk_out, bh->outreq, 493 &bh->outreq_busy, &bh->state) 494 /* 495 * Don't know what to do if 496 * common->fsg is NULL 497 */ 498 return -EIO; 499 common->next_buffhd_to_fill = bh->next; 500 } else { 501 /* Then, wait for the data to become available */ 502 bh = common->next_buffhd_to_drain; 503 if (bh->state != BUF_STATE_FULL) 504 goto wait; 505 506 common->next_buffhd_to_drain = bh->next; 507 bh->state = BUF_STATE_EMPTY; 508 509 /* Did something go wrong with the transfer? */ 510 if (bh->outreq->status != 0) { 511 curlun->sense_data = SS_COMMUNICATION_FAILURE; 512 curlun->info_valid = 1; 513 break; 514 } 515 516 /* Perform the write */ 517 vhead = (struct vendor_item *)bh->buf; 518 data = bh->buf + sizeof(struct vendor_item); 519 if (CONFIG_IS_ENABLED(ROCKCHIP_VENDOR_PARTITION) && !type) { 520 #ifndef CONFIG_SUPPORT_USBPLUG 521 if (vhead->id == HDCP_14_HDMI_ID || 522 vhead->id == HDCP_14_HDMIRX_ID || 523 vhead->id == HDCP_14_DP_ID) { 524 rc = vendor_handle_hdcp(vhead); 525 if (rc < 0) { 526 curlun->sense_data = SS_WRITE_ERROR; 527 return -EIO; 528 } 529 } 530 #endif 531 532 /* Vendor storage */ 533 rc = vendor_storage_write(vhead->id, 534 (char __user *)data, 535 vhead->size); 536 if (rc < 0) { 537 curlun->sense_data = SS_WRITE_ERROR; 538 return -EIO; 539 } 540 } else if (type == 1) { 541 /* RPMB */ 542 rc = 543 write_keybox_to_secure_storage((u8 *)data, 544 vhead->size); 545 if (rc < 0) { 546 curlun->sense_data = SS_WRITE_ERROR; 547 return -EIO; 548 } 549 } else if (type == 2) { 550 /* security storage */ 551 #ifdef CONFIG_RK_AVB_LIBAVB_USER 552 debug("%s call rk_avb_write_perm_attr %d, %d\n", 553 __func__, vhead->id, vhead->size); 554 rc = rk_avb_write_perm_attr(vhead->id, 555 (char __user *)data, 556 vhead->size); 557 if (rc < 0) { 558 curlun->sense_data = SS_WRITE_ERROR; 559 return -EIO; 560 } 561 #else 562 printf("Please enable CONFIG_RK_AVB_LIBAVB_USER\n"); 563 #endif 564 } else if (type == 3) { 565 /* efuse or otp*/ 566 #ifdef CONFIG_OPTEE_CLIENT 567 if (memcmp(data, "TAEK", 4) == 0) { 568 if (vhead->size - 8 != 32) { 569 printf("check ta encryption key size fail!\n"); 570 curlun->sense_data = SS_WRITE_ERROR; 571 return -EIO; 572 } 573 if (trusty_write_ta_encryption_key((uint32_t *)(data + 8), 8) != 0) { 574 printf("trusty_write_ta_encryption_key error!"); 575 curlun->sense_data = SS_WRITE_ERROR; 576 return -EIO; 577 } 578 } else if (memcmp(data, "EHUK", 4) == 0) { 579 if (vhead->size - 8 != 32) { 580 printf("check oem huk size fail!\n"); 581 curlun->sense_data = SS_WRITE_ERROR; 582 return -EIO; 583 } 584 if (trusty_write_oem_huk((uint32_t *)(data + 8), 8) != 0) { 585 printf("trusty_write_oem_huk error!"); 586 curlun->sense_data = SS_WRITE_ERROR; 587 return -EIO; 588 } 589 } else if (memcmp(data, "ENDA", 4) == 0) { 590 if (vhead->size - 8 != 16) { 591 printf("check oem encrypt data size fail!\n"); 592 curlun->sense_data = SS_WRITE_ERROR; 593 return -EIO; 594 } 595 if (trusty_write_oem_encrypt_data((uint32_t *)(data + 8), 4) != 0) { 596 printf("trusty_write_oem_encrypt_data error!"); 597 curlun->sense_data = SS_WRITE_ERROR; 598 return -EIO; 599 } 600 } else if (memcmp(data, "OTPK", 4) == 0) { 601 uint32_t key_len = vhead->size - 9; 602 uint8_t key_id = *((uint8_t *)data + 8); 603 if (key_len == 4 && memcmp(data + 9, "lock", 4) == 0) { 604 if (trusty_set_oem_hr_otp_read_lock(key_id) != 0) { 605 printf("trusty_set_oem_hr_otp_read_lock error!"); 606 curlun->sense_data = SS_WRITE_ERROR; 607 return -EIO; 608 } 609 } else { 610 if (key_len != 16 && key_len != 24 && key_len != 32) { 611 printf("check oem otp key size fail!\n"); 612 curlun->sense_data = SS_WRITE_ERROR; 613 return -EIO; 614 } 615 if (trusty_write_oem_otp_key(key_id, (uint8_t *)(data + 9), key_len) != 0) { 616 printf("trusty_write_oem_otp_key error!"); 617 curlun->sense_data = SS_WRITE_ERROR; 618 return -EIO; 619 } 620 } 621 } else if (memcmp(data, "FWEK", 4) == 0) { 622 uint32_t key_len = vhead->size - 9; 623 uint8_t key_id = *((uint8_t *)data + 8); 624 if (key_len == 4 && memcmp(data + 9, "lock", 4) == 0) { 625 if (trusty_set_fw_encrypt_key_mask(key_id) != 0) { 626 printf("trusty_set_fw_encrypt_key_mask error!"); 627 curlun->sense_data = SS_WRITE_ERROR; 628 return -EIO; 629 } 630 } else { 631 if (key_len != 16 && key_len != 32) { 632 printf("check FW encrypt key size fail!\n"); 633 curlun->sense_data = SS_WRITE_ERROR; 634 return -EIO; 635 } 636 if (trusty_write_fw_encrypt_key(key_id, (uint8_t *)(data + 9), key_len) != 0) { 637 printf("trusty_write_fw_encrypt_key error!"); 638 curlun->sense_data = SS_WRITE_ERROR; 639 return -EIO; 640 } 641 } 642 } else { 643 printf("Unknown tag\n"); 644 curlun->sense_data = SS_WRITE_ERROR; 645 return -EIO; 646 } 647 #else 648 printf("Please enable CONFIG_OPTEE_CLIENT\n"); 649 #endif 650 } else { 651 return -EINVAL; 652 } 653 654 common->residue -= common->data_size; 655 656 /* Did the host decide to stop early? */ 657 if (bh->outreq->actual != bh->outreq->length) 658 common->short_packet_received = 1; 659 break; /* Command done */ 660 } 661 wait: 662 /* Wait for something to happen */ 663 rc = sleep_thread(common); 664 if (rc) 665 return rc; 666 } 667 668 return -EIO; /* No default reply */ 669 } 670 671 static int rkusb_do_vs_read(struct fsg_common *common) 672 { 673 struct fsg_lun *curlun = &common->luns[common->lun]; 674 u16 type = get_unaligned_be16(&common->cmnd[4]); 675 struct vendor_item *vhead; 676 struct fsg_buffhd *bh; 677 void *data; 678 int rc; 679 680 if (common->data_size >= (u32)65536) { 681 /* _MUST_ small than 64K */ 682 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 683 return -EINVAL; 684 } 685 686 common->residue = common->data_size; 687 common->usb_amount_left = common->data_size; 688 689 /* Carry out the file reads */ 690 if (unlikely(common->data_size == 0)) 691 return -EIO; /* No default reply */ 692 693 for (;;) { 694 /* Wait for the next buffer to become available */ 695 bh = common->next_buffhd_to_fill; 696 while (bh->state != BUF_STATE_EMPTY) { 697 rc = sleep_thread(common); 698 if (rc) 699 return rc; 700 } 701 702 memset(bh->buf, 0, FSG_BUFLEN); 703 vhead = (struct vendor_item *)bh->buf; 704 data = bh->buf + sizeof(struct vendor_item); 705 vhead->id = get_unaligned_be16(&common->cmnd[2]); 706 if (CONFIG_IS_ENABLED(ROCKCHIP_VENDOR_PARTITION) && !type) { 707 /* Vendor storage */ 708 rc = vendor_storage_read(vhead->id, 709 (char __user *)data, 710 common->data_size); 711 if (!rc) { 712 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 713 return -EIO; 714 } 715 vhead->size = rc; 716 } else if (type == 1) { 717 /* RPMB */ 718 rc = 719 read_raw_data_from_secure_storage((u8 *)data, 720 common->data_size); 721 if (!rc) { 722 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 723 return -EIO; 724 } 725 vhead->size = rc; 726 } else if (type == 2) { 727 /* security storage */ 728 #ifdef CONFIG_RK_AVB_LIBAVB_USER 729 rc = rk_avb_read_perm_attr(vhead->id, 730 (char __user *)data, 731 vhead->size); 732 if (rc < 0) 733 return -EIO; 734 vhead->size = rc; 735 #else 736 printf("Please enable CONFIG_RK_AVB_LIBAVB_USER!\n"); 737 #endif 738 } else if (type == 3) { 739 /* efuse or otp*/ 740 #ifdef CONFIG_OPTEE_CLIENT 741 if (vhead->id == 120) { 742 u8 value; 743 char *written_str = "key is written!"; 744 char *not_written_str = "key is not written!"; 745 if (trusty_ta_encryption_key_is_written(&value) != 0) { 746 printf("trusty_ta_encryption_key_is_written error!"); 747 return -EIO; 748 } 749 if (value) { 750 memcpy(data, written_str, strlen(written_str)); 751 vhead->size = strlen(written_str); 752 } else { 753 memcpy(data, not_written_str, strlen(not_written_str)); 754 vhead->size = strlen(not_written_str); 755 } 756 } else { 757 printf("Unknown tag\n"); 758 return -EIO; 759 } 760 #else 761 printf("Please enable CONFIG_OPTEE_CLIENT\n"); 762 #endif 763 } else { 764 return -EINVAL; 765 } 766 767 common->residue -= common->data_size; 768 bh->inreq->length = common->data_size; 769 bh->state = BUF_STATE_FULL; 770 771 break; /* No more left to read */ 772 } 773 774 return -EIO; /* No default reply */ 775 } 776 777 #if CONFIG_PSTORE 778 static int rkusb_do_uart_debug_read(struct fsg_common *common) 779 { 780 struct fsg_buffhd *bh; 781 int *debug_head; 782 int debug_data_size; 783 int rc; 784 785 if (common->data_size >= (u32)FSG_BUFLEN) 786 return -EINVAL; 787 788 common->residue = common->data_size; 789 common->usb_amount_left = common->data_size; 790 791 /* Carry out the file reads */ 792 if (unlikely(common->data_size == 0) || unlikely(!gd->pstore_addr)) 793 return -EIO; /* No default reply */ 794 795 /* Wait for the next buffer to become available */ 796 bh = common->next_buffhd_to_fill; 797 while (bh->state != BUF_STATE_EMPTY) { 798 rc = sleep_thread(common); 799 if (rc) 800 return rc; 801 } 802 803 debug_head = (int *)gd->pstore_addr; 804 debug_data_size = debug_head[2]; 805 if (debug_data_size > FSG_BUFLEN - 8) 806 debug_data_size = FSG_BUFLEN - 8; 807 if (debug_data_size > common->data_size - 8) 808 debug_data_size = common->data_size - 8; 809 810 debug_head = (int *)bh->buf; 811 debug_head[0] = 0x55424544; 812 debug_head[1] = debug_data_size + 8; 813 814 memcpy((void *)(bh->buf + 8), (void *)(gd->pstore_addr + 12), debug_data_size); 815 816 common->residue -= common->data_size; 817 bh->inreq->length = common->data_size; 818 bh->state = BUF_STATE_FULL; 819 820 return -EIO; /* No default reply */ 821 } 822 #endif 823 824 static int rkusb_do_switch_storage(struct fsg_common *common) 825 { 826 enum if_type type, cur_type = ums[common->lun].block_dev.if_type; 827 int devnum, cur_devnum = ums[common->lun].block_dev.devnum; 828 struct blk_desc *block_dev; 829 u32 media = BOOT_TYPE_UNKNOWN; 830 831 media = 1 << common->cmnd[1]; 832 833 switch (media) { 834 #ifdef CONFIG_MMC 835 case BOOT_TYPE_EMMC: 836 type = IF_TYPE_MMC; 837 devnum = 0; 838 mmc_initialize(gd->bd); 839 break; 840 #endif 841 case BOOT_TYPE_MTD_BLK_NAND: 842 type = IF_TYPE_MTD; 843 devnum = 0; 844 break; 845 case BOOT_TYPE_MTD_BLK_SPI_NAND: 846 type = IF_TYPE_MTD; 847 devnum = 1; 848 break; 849 case BOOT_TYPE_MTD_BLK_SPI_NOR: 850 type = IF_TYPE_MTD; 851 devnum = 2; 852 break; 853 #if defined(CONFIG_SCSI) && defined(CONFIG_CMD_SCSI) && (defined(CONFIG_AHCI) || defined(CONFIG_UFS)) 854 case BOOT_TYPE_SATA: 855 type = IF_TYPE_SCSI; 856 devnum = 0; 857 scsi_scan(true); 858 break; 859 #endif 860 case BOOT_TYPE_PCIE: 861 type = IF_TYPE_NVME; 862 devnum = 0; 863 break; 864 default: 865 printf("Bootdev 0x%x is not support\n", media); 866 return -ENODEV; 867 } 868 869 if (cur_type == type && cur_devnum == devnum) 870 return 0; 871 872 #if CONFIG_IS_ENABLED(SUPPORT_USBPLUG) 873 block_dev = usbplug_blk_get_devnum_by_type(type, devnum); 874 #else 875 block_dev = blk_get_devnum_by_type(type, devnum); 876 #endif 877 if (!block_dev) { 878 printf("Bootdev if_type=%d num=%d toggle fail\n", type, devnum); 879 return -ENODEV; 880 } 881 882 common->luns[common->lun].num_sectors = block_dev->lba; 883 ums[common->lun].num_sectors = block_dev->lba; 884 ums[common->lun].block_dev = *block_dev; 885 886 printf("RKUSB: LUN %d, dev %d, hwpart %d, sector %#x, count %#x\n", 887 0, 888 ums[common->lun].block_dev.devnum, 889 ums[common->lun].block_dev.hwpart, 890 ums[common->lun].start_sector, 891 ums[common->lun].num_sectors); 892 893 return 0; 894 } 895 896 static int rkusb_do_get_storage_info(struct fsg_common *common, 897 struct fsg_buffhd *bh) 898 { 899 enum if_type type = ums[common->lun].block_dev.if_type; 900 int devnum = ums[common->lun].block_dev.devnum; 901 u32 media = BOOT_TYPE_UNKNOWN; 902 u32 len = common->data_size; 903 u8 *buf = (u8 *)bh->buf; 904 905 if (len > 4) 906 len = 4; 907 908 switch (type) { 909 case IF_TYPE_MMC: 910 media = BOOT_TYPE_EMMC; 911 break; 912 913 case IF_TYPE_SD: 914 media = BOOT_TYPE_SD0; 915 break; 916 917 case IF_TYPE_MTD: 918 if (devnum == BLK_MTD_SPI_NAND) 919 media = BOOT_TYPE_MTD_BLK_SPI_NAND; 920 else if (devnum == BLK_MTD_NAND) 921 media = BOOT_TYPE_NAND; 922 else 923 media = BOOT_TYPE_MTD_BLK_SPI_NOR; 924 break; 925 926 case IF_TYPE_SCSI: 927 media = BOOT_TYPE_SATA; 928 break; 929 930 case IF_TYPE_RKNAND: 931 media = BOOT_TYPE_NAND; 932 break; 933 934 case IF_TYPE_NVME: 935 media = BOOT_TYPE_PCIE; 936 break; 937 938 default: 939 break; 940 } 941 942 memcpy((void *)&buf[0], (void *)&media, len); 943 common->residue = len; 944 common->data_size_from_cmnd = len; 945 946 return len; 947 } 948 949 static int rkusb_do_read_capacity(struct fsg_common *common, 950 struct fsg_buffhd *bh) 951 { 952 u8 *buf = (u8 *)bh->buf; 953 u32 len = common->data_size; 954 enum if_type type = ums[common->lun].block_dev.if_type; 955 int devnum = ums[common->lun].block_dev.devnum; 956 957 /* 958 * bit[0]: Direct LBA, 0: Disabled; 959 * bit[1]: Vendor Storage API, 0: Disabed (default); 960 * bit[2]: First 4M Access, 0: Disabled; 961 * bit[3]: Read LBA On, 0: Disabed (default); 962 * bit[4]: New Vendor Storage API, 0: Disabed; 963 * bit[5]: Read uart data from ram 964 * bit[6]: Read IDB config 965 * bit[7]: Read SecureMode 966 * bit[8]: New IDB feature 967 * bit[9]: Get storage media info 968 * bit[10]: LBAwrite Parity 969 * bit[11]: Read Otp Data 970 * bit[12]: usb3 download 971 * bit[13]: Write OTP proof 972 * bit[14]: Write Cipher Key 973 * bit[15:63}: Reserved. 974 */ 975 memset((void *)&buf[0], 0, len); 976 if (type == IF_TYPE_MMC || type == IF_TYPE_SD || type == IF_TYPE_NVME) 977 buf[0] = BIT(0) | BIT(2) | BIT(4); 978 else 979 buf[0] = BIT(0) | BIT(4); 980 981 if (type == IF_TYPE_MTD && 982 (devnum == BLK_MTD_NAND || 983 devnum == BLK_MTD_SPI_NAND)) 984 buf[0] |= (1 << 6); 985 986 #ifdef CONFIG_PSTORE 987 buf[0] |= (1 << 5); 988 #endif 989 990 #if !defined(CONFIG_ROCKCHIP_RV1126) 991 if (type == IF_TYPE_MTD && devnum == BLK_MTD_SPI_NOR) 992 buf[0] |= (1 << 6); 993 #if defined(CONFIG_ROCKCHIP_RK3308) 994 else if (type == IF_TYPE_SPINOR) 995 buf[0] |= (1 << 6); 996 #endif 997 #endif 998 999 #if defined(CONFIG_ROCKCHIP_NEW_IDB) 1000 buf[1] = BIT(0); 1001 #endif 1002 buf[1] |= BIT(1); /* Switch Storage */ 1003 buf[1] |= BIT(2); /* LBAwrite Parity */ 1004 1005 if (rkusb_usb3_capable() && !rkusb_force_usb2_enabled()) 1006 buf[1] |= BIT(4); 1007 else 1008 buf[1] &= ~BIT(4); 1009 1010 #ifdef CONFIG_ROCKCHIP_OTP 1011 buf[1] |= BIT(3); /* Read Otp Data */ 1012 buf[1] |= BIT(5); /* Write OTP proof */ 1013 buf[1] |= BIT(6); /* Write Cipher Key */ 1014 #endif 1015 1016 /* Set data xfer size */ 1017 common->residue = len; 1018 common->data_size_from_cmnd = len; 1019 1020 return len; 1021 } 1022 1023 #ifdef CONFIG_ROCKCHIP_OTP 1024 static int rkusb_do_read_otp(struct fsg_common *common, 1025 struct fsg_buffhd *bh) 1026 { 1027 u32 len = common->data_size; 1028 u32 type = common->cmnd[1]; 1029 u8 *buf = (u8 *)bh->buf; 1030 struct udevice *dev; 1031 1032 buf[0] = 0; 1033 if (type == 0) { /* soc uuid */ 1034 if (!uclass_get_device_by_driver(UCLASS_MISC, DM_GET_DRIVER(rockchip_otp), &dev)) { 1035 if (!misc_read(dev, CFG_CPUID_OFFSET, (void *)&buf[1], len)) 1036 buf[0] = len; 1037 } 1038 } 1039 1040 common->residue = len; 1041 common->data_size_from_cmnd = len; 1042 1043 return len; 1044 } 1045 #endif 1046 1047 static void rkusb_fixup_cbwcb(struct fsg_common *common, 1048 struct fsg_buffhd *bh) 1049 { 1050 struct usb_request *req = bh->outreq; 1051 struct fsg_bulk_cb_wrap *cbw = req->buf; 1052 1053 /* FIXME cbw.DataTransferLength was not set by Upgrade Tool */ 1054 common->data_size = le32_to_cpu(cbw->DataTransferLength); 1055 if (common->data_size == 0) { 1056 common->data_size = 1057 get_unaligned_be16(&common->cmnd[7]) << 9; 1058 printf("Trasfer Length NOT set, please use new version tool\n"); 1059 debug("%s %d, cmnd1 %x\n", __func__, 1060 get_unaligned_be16(&common->cmnd[7]), 1061 get_unaligned_be16(&common->cmnd[1])); 1062 } 1063 if (cbw->Flags & USB_BULK_IN_FLAG) 1064 common->data_dir = DATA_DIR_TO_HOST; 1065 else 1066 common->data_dir = DATA_DIR_FROM_HOST; 1067 1068 /* Not support */ 1069 common->cmnd[1] = 0; 1070 } 1071 1072 static int rkusb_cmd_process(struct fsg_common *common, 1073 struct fsg_buffhd *bh, int *reply) 1074 { 1075 struct usb_request *req = bh->outreq; 1076 struct fsg_bulk_cb_wrap *cbw = req->buf; 1077 int rc; 1078 1079 dump_cbw(cbw); 1080 1081 if (rkusb_check_lun(common)) { 1082 *reply = -EINVAL; 1083 return RKUSB_RC_ERROR; 1084 } 1085 1086 switch (common->cmnd[0]) { 1087 case RKUSB_TEST_UNIT_READY: 1088 *reply = rkusb_do_test_unit_ready(common, bh); 1089 rc = RKUSB_RC_FINISHED; 1090 break; 1091 1092 case RKUSB_READ_FLASH_ID: 1093 *reply = rkusb_do_read_flash_id(common, bh); 1094 rc = RKUSB_RC_FINISHED; 1095 break; 1096 1097 case RKUSB_TEST_BAD_BLOCK: 1098 *reply = rkusb_do_test_bad_block(common, bh); 1099 rc = RKUSB_RC_FINISHED; 1100 break; 1101 1102 case RKUSB_ERASE_10_FORCE: 1103 *reply = rkusb_do_erase_force(common, bh); 1104 rc = RKUSB_RC_FINISHED; 1105 break; 1106 1107 case RKUSB_LBA_READ_10: 1108 rkusb_fixup_cbwcb(common, bh); 1109 common->cmnd[0] = SC_READ_10; 1110 common->cmnd[1] = 0; /* Not support */ 1111 rc = RKUSB_RC_CONTINUE; 1112 break; 1113 1114 case RKUSB_LBA_WRITE_10: 1115 rkusb_fixup_cbwcb(common, bh); 1116 common->cmnd[0] = SC_WRITE_10; 1117 common->cmnd[1] = 0; /* Not support */ 1118 rc = RKUSB_RC_CONTINUE; 1119 break; 1120 1121 case RKUSB_READ_FLASH_INFO: 1122 *reply = rkusb_do_read_flash_info(common, bh); 1123 rc = RKUSB_RC_FINISHED; 1124 break; 1125 1126 case RKUSB_GET_CHIP_VER: 1127 *reply = rkusb_do_get_chip_info(common, bh); 1128 rc = RKUSB_RC_FINISHED; 1129 break; 1130 1131 case RKUSB_LBA_ERASE: 1132 *reply = rkusb_do_lba_erase(common, bh); 1133 rc = RKUSB_RC_FINISHED; 1134 break; 1135 1136 case RKUSB_VS_WRITE: 1137 *reply = rkusb_do_vs_write(common); 1138 rc = RKUSB_RC_FINISHED; 1139 break; 1140 1141 case RKUSB_VS_READ: 1142 *reply = rkusb_do_vs_read(common); 1143 rc = RKUSB_RC_FINISHED; 1144 break; 1145 1146 #ifdef CONFIG_PSTORE 1147 case RKUSB_UART_READ: 1148 rkusb_fixup_cbwcb(common, bh); 1149 *reply = rkusb_do_uart_debug_read(common); 1150 rc = RKUSB_RC_FINISHED; 1151 break; 1152 #endif 1153 1154 case RKUSB_SWITCH_STORAGE: 1155 *reply = rkusb_do_switch_storage(common); 1156 rc = RKUSB_RC_FINISHED; 1157 break; 1158 1159 case RKUSB_GET_STORAGE_MEDIA: 1160 *reply = rkusb_do_get_storage_info(common, bh); 1161 rc = RKUSB_RC_FINISHED; 1162 break; 1163 1164 case RKUSB_READ_CAPACITY: 1165 *reply = rkusb_do_read_capacity(common, bh); 1166 rc = RKUSB_RC_FINISHED; 1167 break; 1168 1169 case RKUSB_SWITCH_USB3: 1170 *reply = rkusb_do_switch_to_usb3(common, bh); 1171 rc = RKUSB_RC_FINISHED; 1172 break; 1173 1174 case RKUSB_RESET: 1175 *reply = rkusb_do_reset(common, bh); 1176 rc = RKUSB_RC_FINISHED; 1177 break; 1178 1179 #ifdef CONFIG_ROCKCHIP_OTP 1180 case RKUSB_READ_OTP_DATA: 1181 *reply = rkusb_do_read_otp(common, bh); 1182 rc = RKUSB_RC_FINISHED; 1183 break; 1184 #endif 1185 1186 case RKUSB_READ_10: 1187 case RKUSB_WRITE_10: 1188 printf("CMD Not support, pls use new version Tool\n"); 1189 case RKUSB_SET_DEVICE_ID: 1190 case RKUSB_ERASE_10: 1191 case RKUSB_WRITE_SPARE: 1192 case RKUSB_READ_SPARE: 1193 case RKUSB_GET_VERSION: 1194 case RKUSB_ERASE_SYS_DISK: 1195 case RKUSB_SDRAM_READ_10: 1196 case RKUSB_SDRAM_WRITE_10: 1197 case RKUSB_SDRAM_EXECUTE: 1198 case RKUSB_LOW_FORMAT: 1199 case RKUSB_SET_RESET_FLAG: 1200 case RKUSB_SPI_READ_10: 1201 case RKUSB_SPI_WRITE_10: 1202 /* Fall through */ 1203 default: 1204 rc = RKUSB_RC_UNKNOWN_CMND; 1205 break; 1206 } 1207 1208 return rc; 1209 } 1210 1211 int rkusb_do_check_parity(struct fsg_common *common) 1212 { 1213 int ret = 0, rc; 1214 u32 parity, i, usb_parity, lba, len; 1215 static u32 usb_check_buffer[1024 * 256]; 1216 1217 usb_parity = common->cmnd[9] | (common->cmnd[10] << 8) | 1218 (common->cmnd[11] << 16) | (common->cmnd[12] << 24); 1219 1220 if (common->cmnd[0] == SC_WRITE_10 && (usb_parity)) { 1221 lba = get_unaligned_be32(&common->cmnd[2]); 1222 len = common->data_size_from_cmnd >> 9; 1223 rc = blk_dread(&ums[common->lun].block_dev, lba, len, usb_check_buffer); 1224 parity = 0x000055aa; 1225 for (i = 0; i < len * 128; i++) 1226 parity += usb_check_buffer[i]; 1227 if (!rc || parity != usb_parity) 1228 common->phase_error = 1; 1229 } 1230 1231 return ret; 1232 } 1233 1234 DECLARE_GADGET_BIND_CALLBACK(rkusb_ums_dnl, fsg_add); 1235