1 /* 2 * Copyright 2017 Rockchip Electronics Co., Ltd 3 * Frank Wang <frank.wang@rock-chips.com> 4 * 5 * SPDX-License-Identifier: GPL-2.0+ 6 */ 7 8 #include <asm/io.h> 9 #include <asm/arch/boot_mode.h> 10 #include <asm/arch/chip_info.h> 11 #include <optee_include/OpteeClientInterface.h> 12 13 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 14 #include <asm/arch/vendor.h> 15 #endif 16 17 #include <rockusb.h> 18 19 #define ROCKUSB_INTERFACE_CLASS 0xff 20 #define ROCKUSB_INTERFACE_SUB_CLASS 0x06 21 #define ROCKUSB_INTERFACE_PROTOCOL 0x05 22 23 static struct usb_interface_descriptor rkusb_intf_desc = { 24 .bLength = USB_DT_INTERFACE_SIZE, 25 .bDescriptorType = USB_DT_INTERFACE, 26 .bInterfaceNumber = 0x00, 27 .bAlternateSetting = 0x00, 28 .bNumEndpoints = 0x02, 29 .bInterfaceClass = ROCKUSB_INTERFACE_CLASS, 30 .bInterfaceSubClass = ROCKUSB_INTERFACE_SUB_CLASS, 31 .bInterfaceProtocol = ROCKUSB_INTERFACE_PROTOCOL, 32 }; 33 34 static struct usb_descriptor_header *rkusb_fs_function[] = { 35 (struct usb_descriptor_header *)&rkusb_intf_desc, 36 (struct usb_descriptor_header *)&fsg_fs_bulk_in_desc, 37 (struct usb_descriptor_header *)&fsg_fs_bulk_out_desc, 38 NULL, 39 }; 40 41 static struct usb_descriptor_header *rkusb_hs_function[] = { 42 (struct usb_descriptor_header *)&rkusb_intf_desc, 43 (struct usb_descriptor_header *)&fsg_hs_bulk_in_desc, 44 (struct usb_descriptor_header *)&fsg_hs_bulk_out_desc, 45 NULL, 46 }; 47 48 struct rk_flash_info { 49 u32 flash_size; 50 u16 block_size; 51 u8 page_size; 52 u8 ecc_bits; 53 u8 access_time; 54 u8 manufacturer; 55 u8 flash_mask; 56 } __packed; 57 58 static int rkusb_rst_code; /* The subcode in reset command (0xFF) */ 59 60 int g_dnl_bind_fixup(struct usb_device_descriptor *dev, const char *name) 61 { 62 if (IS_RKUSB_UMS_DNL(name)) { 63 /* Fix to Rockchip's VID and PID */ 64 dev->idVendor = __constant_cpu_to_le16(0x2207); 65 dev->idProduct = __constant_cpu_to_le16(CONFIG_ROCKUSB_G_DNL_PID); 66 67 /* Enumerate as a loader device */ 68 dev->bcdUSB = cpu_to_le16(0x0201); 69 } else if (!strncmp(name, "usb_dnl_fastboot", 16)) { 70 /* Fix to Google's VID and PID */ 71 dev->idVendor = __constant_cpu_to_le16(0x18d1); 72 dev->idProduct = __constant_cpu_to_le16(0xd00d); 73 } 74 75 return 0; 76 } 77 78 __maybe_unused 79 static inline void dump_cbw(struct fsg_bulk_cb_wrap *cbw) 80 { 81 assert(!cbw); 82 83 debug("%s:\n", __func__); 84 debug("Signature %x\n", cbw->Signature); 85 debug("Tag %x\n", cbw->Tag); 86 debug("DataTransferLength %x\n", cbw->DataTransferLength); 87 debug("Flags %x\n", cbw->Flags); 88 debug("LUN %x\n", cbw->Lun); 89 debug("Length %x\n", cbw->Length); 90 debug("OptionCode %x\n", cbw->CDB[0]); 91 debug("SubCode %x\n", cbw->CDB[1]); 92 debug("SectorAddr %x\n", get_unaligned_be32(&cbw->CDB[2])); 93 debug("BlkSectors %x\n\n", get_unaligned_be16(&cbw->CDB[7])); 94 } 95 96 static int rkusb_check_lun(struct fsg_common *common) 97 { 98 struct fsg_lun *curlun; 99 100 /* Check the LUN */ 101 if (common->lun >= 0 && common->lun < common->nluns) { 102 curlun = &common->luns[common->lun]; 103 if (common->cmnd[0] != SC_REQUEST_SENSE) { 104 curlun->sense_data = SS_NO_SENSE; 105 curlun->info_valid = 0; 106 } 107 } else { 108 curlun = NULL; 109 common->bad_lun_okay = 0; 110 111 /* 112 * INQUIRY and REQUEST SENSE commands are explicitly allowed 113 * to use unsupported LUNs; all others may not. 114 */ 115 if (common->cmnd[0] != SC_INQUIRY && 116 common->cmnd[0] != SC_REQUEST_SENSE) { 117 debug("unsupported LUN %d\n", common->lun); 118 return -EINVAL; 119 } 120 } 121 122 return 0; 123 } 124 125 static void __do_reset(struct usb_ep *ep, struct usb_request *req) 126 { 127 u32 boot_flag = BOOT_NORMAL; 128 129 if (rkusb_rst_code == 0x03) 130 boot_flag = BOOT_BROM_DOWNLOAD; 131 132 rkusb_rst_code = 0; /* restore to default */ 133 writel(boot_flag, (void *)CONFIG_ROCKCHIP_BOOT_MODE_REG); 134 135 do_reset(NULL, 0, 0, NULL); 136 } 137 138 static int rkusb_do_reset(struct fsg_common *common, 139 struct fsg_buffhd *bh) 140 { 141 common->data_size_from_cmnd = common->cmnd[4]; 142 common->residue = 0; 143 bh->inreq->complete = __do_reset; 144 bh->state = BUF_STATE_EMPTY; 145 146 rkusb_rst_code = !common->cmnd[1] ? 0xff : common->cmnd[1]; 147 return 0; 148 } 149 150 static int rkusb_do_test_unit_ready(struct fsg_common *common, 151 struct fsg_buffhd *bh) 152 { 153 common->residue = 0x06 << 24; /* Max block xfer support from host */ 154 common->data_dir = DATA_DIR_NONE; 155 bh->state = BUF_STATE_EMPTY; 156 157 return 0; 158 } 159 160 static int rkusb_do_read_flash_id(struct fsg_common *common, 161 struct fsg_buffhd *bh) 162 { 163 u8 *buf = (u8 *)bh->buf; 164 u32 len = 5; 165 enum if_type type = ums[common->lun].block_dev.if_type; 166 167 if (type == IF_TYPE_MMC) 168 memcpy((void *)&buf[0], "EMMC ", 5); 169 else if (type == IF_TYPE_RKNAND) 170 memcpy((void *)&buf[0], "NAND ", 5); 171 else 172 memcpy((void *)&buf[0], "UNKN ", 5); /* unknown */ 173 174 /* Set data xfer size */ 175 common->residue = common->data_size_from_cmnd = len; 176 common->data_size = len; 177 178 return len; 179 } 180 181 static int rkusb_do_test_bad_block(struct fsg_common *common, 182 struct fsg_buffhd *bh) 183 { 184 u8 *buf = (u8 *)bh->buf; 185 u32 len = 64; 186 187 memset((void *)&buf[0], 0, len); 188 189 /* Set data xfer size */ 190 common->residue = common->data_size_from_cmnd = len; 191 common->data_size = len; 192 193 return len; 194 } 195 196 static int rkusb_do_read_flash_info(struct fsg_common *common, 197 struct fsg_buffhd *bh) 198 { 199 u8 *buf = (u8 *)bh->buf; 200 u32 len = sizeof(struct rk_flash_info); 201 struct rk_flash_info finfo = { 202 .block_size = 1024, 203 .ecc_bits = 0, 204 .page_size = 4, 205 .access_time = 40, 206 .manufacturer = 0, 207 .flash_mask = 0 208 }; 209 210 finfo.flash_size = (u32)ums[common->lun].block_dev.lba; 211 if (finfo.flash_size) 212 finfo.flash_mask = 1; 213 214 memset((void *)&buf[0], 0, len); 215 memcpy((void *)&buf[0], (void *)&finfo, len); 216 217 /* Set data xfer size */ 218 common->residue = common->data_size_from_cmnd = len; 219 /* legacy upgrade_tool does not set correct transfer size */ 220 common->data_size = len; 221 222 return len; 223 } 224 225 static int rkusb_do_get_chip_info(struct fsg_common *common, 226 struct fsg_buffhd *bh) 227 { 228 u8 *buf = (u8 *)bh->buf; 229 u32 len = common->data_size; 230 u32 chip_info[4]; 231 232 memset((void *)chip_info, 0, sizeof(chip_info)); 233 rockchip_rockusb_get_chip_info(chip_info); 234 235 memset((void *)&buf[0], 0, len); 236 memcpy((void *)&buf[0], (void *)chip_info, len); 237 238 /* Set data xfer size */ 239 common->residue = common->data_size_from_cmnd = len; 240 241 return len; 242 } 243 244 static int rkusb_do_lba_erase(struct fsg_common *common, 245 struct fsg_buffhd *bh) 246 { 247 struct fsg_lun *curlun = &common->luns[common->lun]; 248 u32 lba, amount; 249 loff_t file_offset; 250 int rc; 251 252 lba = get_unaligned_be32(&common->cmnd[2]); 253 if (lba >= curlun->num_sectors) { 254 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 255 rc = -EINVAL; 256 goto out; 257 } 258 259 file_offset = ((loff_t) lba) << 9; 260 amount = get_unaligned_be16(&common->cmnd[7]) << 9; 261 if (unlikely(amount == 0)) { 262 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 263 rc = -EIO; 264 goto out; 265 } 266 267 /* Perform the erase */ 268 rc = ums[common->lun].erase_sector(&ums[common->lun], 269 file_offset / SECTOR_SIZE, 270 amount / SECTOR_SIZE); 271 if (!rc) { 272 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 273 rc = -EIO; 274 } 275 276 out: 277 common->data_dir = DATA_DIR_NONE; 278 bh->state = BUF_STATE_EMPTY; 279 280 return rc; 281 } 282 283 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 284 static int rkusb_do_vs_write(struct fsg_common *common) 285 { 286 struct fsg_lun *curlun = &common->luns[common->lun]; 287 u16 type = get_unaligned_be16(&common->cmnd[4]); 288 struct vendor_item *vhead; 289 struct fsg_buffhd *bh; 290 void *data; 291 int rc; 292 293 if (common->data_size >= (u32)65536) { 294 /* _MUST_ small than 64K */ 295 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 296 return -EINVAL; 297 } 298 299 common->residue = common->data_size; 300 common->usb_amount_left = common->data_size; 301 302 /* Carry out the file writes */ 303 if (unlikely(common->data_size == 0)) 304 return -EIO; /* No data to write */ 305 306 for (;;) { 307 if (common->usb_amount_left > 0) { 308 /* Wait for the next buffer to become available */ 309 bh = common->next_buffhd_to_fill; 310 if (bh->state != BUF_STATE_EMPTY) 311 goto wait; 312 313 /* Request the next buffer */ 314 common->usb_amount_left -= common->data_size; 315 bh->outreq->length = common->data_size; 316 bh->bulk_out_intended_length = common->data_size; 317 bh->outreq->short_not_ok = 1; 318 319 START_TRANSFER_OR(common, bulk_out, bh->outreq, 320 &bh->outreq_busy, &bh->state) 321 /* 322 * Don't know what to do if 323 * common->fsg is NULL 324 */ 325 return -EIO; 326 common->next_buffhd_to_fill = bh->next; 327 } else { 328 /* Then, wait for the data to become available */ 329 bh = common->next_buffhd_to_drain; 330 if (bh->state != BUF_STATE_FULL) 331 goto wait; 332 333 common->next_buffhd_to_drain = bh->next; 334 bh->state = BUF_STATE_EMPTY; 335 336 /* Did something go wrong with the transfer? */ 337 if (bh->outreq->status != 0) { 338 curlun->sense_data = SS_COMMUNICATION_FAILURE; 339 curlun->info_valid = 1; 340 break; 341 } 342 343 /* Perform the write */ 344 vhead = (struct vendor_item *)bh->buf; 345 data = bh->buf + sizeof(struct vendor_item); 346 347 if (!type) { 348 /* Vendor storage */ 349 rc = vendor_storage_write(vhead->id, 350 (char __user *)data, 351 vhead->size); 352 if (rc < 0) 353 return -EIO; 354 } else { 355 /* RPMB */ 356 #ifdef CONFIG_OPTEE_V1 357 rc = 358 write_keybox_to_secure_storage((u8 *)data, 359 vhead->size); 360 if (!rc) 361 return -EIO; 362 #endif 363 } 364 365 common->residue -= common->data_size; 366 367 /* Did the host decide to stop early? */ 368 if (bh->outreq->actual != bh->outreq->length) 369 common->short_packet_received = 1; 370 break; /* Command done */ 371 } 372 wait: 373 /* Wait for something to happen */ 374 rc = sleep_thread(common); 375 if (rc) 376 return rc; 377 } 378 379 return -EIO; /* No default reply */ 380 } 381 382 static int rkusb_do_vs_read(struct fsg_common *common) 383 { 384 struct fsg_lun *curlun = &common->luns[common->lun]; 385 u16 type = get_unaligned_be16(&common->cmnd[4]); 386 struct vendor_item *vhead; 387 struct fsg_buffhd *bh; 388 void *data; 389 int rc; 390 391 if (common->data_size >= (u32)65536) { 392 /* _MUST_ small than 64K */ 393 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 394 return -EINVAL; 395 } 396 397 common->residue = common->data_size; 398 common->usb_amount_left = common->data_size; 399 400 /* Carry out the file reads */ 401 if (unlikely(common->data_size == 0)) 402 return -EIO; /* No default reply */ 403 404 for (;;) { 405 /* Wait for the next buffer to become available */ 406 bh = common->next_buffhd_to_fill; 407 while (bh->state != BUF_STATE_EMPTY) { 408 rc = sleep_thread(common); 409 if (rc) 410 return rc; 411 } 412 413 memset(bh->buf, 0, FSG_BUFLEN); 414 vhead = (struct vendor_item *)bh->buf; 415 data = bh->buf + sizeof(struct vendor_item); 416 vhead->id = get_unaligned_be16(&common->cmnd[2]); 417 418 if (!type) { 419 /* Vendor storage */ 420 rc = vendor_storage_read(vhead->id, 421 (char __user *)data, 422 common->data_size); 423 if (!rc) 424 return -EIO; 425 vhead->size = rc; 426 } else { 427 /* RPMB */ 428 } 429 430 common->residue -= common->data_size; 431 bh->inreq->length = common->data_size; 432 bh->state = BUF_STATE_FULL; 433 434 break; /* No more left to read */ 435 } 436 437 return -EIO; /* No default reply */ 438 } 439 #endif 440 441 static int rkusb_do_read_capacity(struct fsg_common *common, 442 struct fsg_buffhd *bh) 443 { 444 u8 *buf = (u8 *)bh->buf; 445 u32 len = common->data_size; 446 enum if_type type = ums[common->lun].block_dev.if_type; 447 448 /* 449 * bit[0]: Direct LBA, 0: Disabled; 450 * bit[1]: Vendor Storage API, 0: Disabed (default); 451 * bit[2]: First 4M Access, 0: Disabled; 452 * bit[3]: Read LBA On, 0: Disabed (default); 453 * bit[4]: New Vendor Storage API, 0: Disabed; 454 * bit[5:63}: Reserved. 455 */ 456 memset((void *)&buf[0], 0, len); 457 if (type == IF_TYPE_MMC) 458 buf[0] = BIT(0) | BIT(2) | BIT(4); 459 else 460 buf[0] = BIT(0) | BIT(4); 461 462 /* Set data xfer size */ 463 common->residue = common->data_size_from_cmnd = len; 464 465 return len; 466 } 467 468 static void rkusb_fixup_cbwcb(struct fsg_common *common, 469 struct fsg_buffhd *bh) 470 { 471 struct usb_request *req = bh->outreq; 472 struct fsg_bulk_cb_wrap *cbw = req->buf; 473 474 /* FIXME cbw.DataTransferLength was not set by Upgrade Tool */ 475 common->data_size = le32_to_cpu(cbw->DataTransferLength); 476 if (common->data_size == 0) { 477 common->data_size = 478 get_unaligned_be16(&common->cmnd[7]) << 9; 479 printf("Trasfer Length NOT set, please use new version tool\n"); 480 debug("%s %d, cmnd1 %x\n", __func__, 481 get_unaligned_be16(&common->cmnd[7]), 482 get_unaligned_be16(&common->cmnd[1])); 483 } 484 if (cbw->Flags & USB_BULK_IN_FLAG) 485 common->data_dir = DATA_DIR_TO_HOST; 486 else 487 common->data_dir = DATA_DIR_FROM_HOST; 488 489 /* Not support */ 490 common->cmnd[1] = 0; 491 } 492 493 static int rkusb_cmd_process(struct fsg_common *common, 494 struct fsg_buffhd *bh, int *reply) 495 { 496 struct usb_request *req = bh->outreq; 497 struct fsg_bulk_cb_wrap *cbw = req->buf; 498 int rc; 499 500 dump_cbw(cbw); 501 502 if (rkusb_check_lun(common)) { 503 *reply = -EINVAL; 504 return RKUSB_RC_ERROR; 505 } 506 507 switch (common->cmnd[0]) { 508 case RKUSB_TEST_UNIT_READY: 509 *reply = rkusb_do_test_unit_ready(common, bh); 510 rc = RKUSB_RC_FINISHED; 511 break; 512 513 case RKUSB_READ_FLASH_ID: 514 *reply = rkusb_do_read_flash_id(common, bh); 515 rc = RKUSB_RC_FINISHED; 516 break; 517 518 case RKUSB_TEST_BAD_BLOCK: 519 *reply = rkusb_do_test_bad_block(common, bh); 520 rc = RKUSB_RC_FINISHED; 521 break; 522 523 case RKUSB_LBA_READ_10: 524 rkusb_fixup_cbwcb(common, bh); 525 common->cmnd[0] = SC_READ_10; 526 common->cmnd[1] = 0; /* Not support */ 527 rc = RKUSB_RC_CONTINUE; 528 break; 529 530 case RKUSB_LBA_WRITE_10: 531 rkusb_fixup_cbwcb(common, bh); 532 common->cmnd[0] = SC_WRITE_10; 533 common->cmnd[1] = 0; /* Not support */ 534 rc = RKUSB_RC_CONTINUE; 535 break; 536 537 case RKUSB_READ_FLASH_INFO: 538 *reply = rkusb_do_read_flash_info(common, bh); 539 rc = RKUSB_RC_FINISHED; 540 break; 541 542 case RKUSB_GET_CHIP_VER: 543 *reply = rkusb_do_get_chip_info(common, bh); 544 rc = RKUSB_RC_FINISHED; 545 break; 546 547 case RKUSB_LBA_ERASE: 548 *reply = rkusb_do_lba_erase(common, bh); 549 rc = RKUSB_RC_FINISHED; 550 break; 551 552 #ifdef CONFIG_ROCKCHIP_VENDOR_PARTITION 553 case RKUSB_VS_WRITE: 554 *reply = rkusb_do_vs_write(common); 555 rc = RKUSB_RC_FINISHED; 556 break; 557 558 case RKUSB_VS_READ: 559 *reply = rkusb_do_vs_read(common); 560 rc = RKUSB_RC_FINISHED; 561 break; 562 #endif 563 564 case RKUSB_READ_CAPACITY: 565 *reply = rkusb_do_read_capacity(common, bh); 566 rc = RKUSB_RC_FINISHED; 567 break; 568 569 case RKUSB_RESET: 570 *reply = rkusb_do_reset(common, bh); 571 rc = RKUSB_RC_FINISHED; 572 break; 573 574 case RKUSB_READ_10: 575 case RKUSB_WRITE_10: 576 printf("CMD Not support, pls use new version Tool\n"); 577 case RKUSB_SET_DEVICE_ID: 578 case RKUSB_ERASE_10: 579 case RKUSB_WRITE_SPARE: 580 case RKUSB_READ_SPARE: 581 case RKUSB_ERASE_10_FORCE: 582 case RKUSB_GET_VERSION: 583 case RKUSB_ERASE_SYS_DISK: 584 case RKUSB_SDRAM_READ_10: 585 case RKUSB_SDRAM_WRITE_10: 586 case RKUSB_SDRAM_EXECUTE: 587 case RKUSB_LOW_FORMAT: 588 case RKUSB_SET_RESET_FLAG: 589 case RKUSB_SPI_READ_10: 590 case RKUSB_SPI_WRITE_10: 591 case RKUSB_SESSION: 592 /* Fall through */ 593 default: 594 rc = RKUSB_RC_UNKNOWN_CMND; 595 break; 596 } 597 598 return rc; 599 } 600 601 DECLARE_GADGET_BIND_CALLBACK(rkusb_ums_dnl, fsg_add); 602