f_sdp.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * f_sdp.c -- USB HID Serial Download Protocol
  4. *
  5. * Copyright (C) 2017 Toradex
  6. * Author: Stefan Agner <stefan.agner@toradex.com>
  7. *
  8. * This file implements the Serial Download Protocol (SDP) as specified in
  9. * the i.MX 6 Reference Manual. The SDP is a USB HID based protocol and
  10. * allows to download images directly to memory. The implementation
  11. * works with the imx_loader (imx_usb) USB client software on host side.
  12. *
  13. * Not all commands are implemented, e.g. WRITE_REGISTER, DCD_WRITE and
  14. * SKIP_DCD_HEADER are only stubs.
  15. *
  16. * Parts of the implementation are based on f_dfu and f_thor.
  17. */
  18. #include <errno.h>
  19. #include <common.h>
  20. #include <console.h>
  21. #include <env.h>
  22. #include <log.h>
  23. #include <malloc.h>
  24. #include <linux/usb/ch9.h>
  25. #include <linux/usb/gadget.h>
  26. #include <linux/usb/composite.h>
  27. #include <asm/io.h>
  28. #include <g_dnl.h>
  29. #include <sdp.h>
  30. #include <spl.h>
  31. #include <image.h>
  32. #include <imximage.h>
  33. #include <watchdog.h>
  34. #define HID_REPORT_ID_MASK 0x000000ff
  35. /*
  36. * HID class requests
  37. */
  38. #define HID_REQ_GET_REPORT 0x01
  39. #define HID_REQ_GET_IDLE 0x02
  40. #define HID_REQ_GET_PROTOCOL 0x03
  41. #define HID_REQ_SET_REPORT 0x09
  42. #define HID_REQ_SET_IDLE 0x0A
  43. #define HID_REQ_SET_PROTOCOL 0x0B
  44. #define HID_USAGE_PAGE_LEN 76
  45. struct hid_report {
  46. u8 usage_page[HID_USAGE_PAGE_LEN];
  47. } __packed;
  48. #define SDP_READ_REGISTER 0x0101
  49. #define SDP_WRITE_REGISTER 0x0202
  50. #define SDP_WRITE_FILE 0x0404
  51. #define SDP_ERROR_STATUS 0x0505
  52. #define SDP_DCD_WRITE 0x0a0a
  53. #define SDP_JUMP_ADDRESS 0x0b0b
  54. #define SDP_SKIP_DCD_HEADER 0x0c0c
  55. #define SDP_SECURITY_CLOSED 0x12343412
  56. #define SDP_SECURITY_OPEN 0x56787856
  57. #define SDP_WRITE_FILE_COMPLETE 0x88888888
  58. #define SDP_WRITE_REGISTER_COMPLETE 0x128A8A12
  59. #define SDP_SKIP_DCD_HEADER_COMPLETE 0x900DD009
  60. #define SDP_ERROR_IMXHEADER 0x000a0533
  61. #define SDP_COMMAND_LEN 16
  62. #define SDP_HID_PACKET_SIZE_EP1 1024
  63. #define SDP_EXIT 1
  64. struct sdp_command {
  65. u16 cmd;
  66. u32 addr;
  67. u8 format;
  68. u32 cnt;
  69. u32 data;
  70. u8 rsvd;
  71. } __packed;
  72. enum sdp_state {
  73. SDP_STATE_IDLE,
  74. SDP_STATE_RX_CMD,
  75. SDP_STATE_RX_DCD_DATA,
  76. SDP_STATE_RX_FILE_DATA,
  77. SDP_STATE_RX_FILE_DATA_BUSY,
  78. SDP_STATE_TX_SEC_CONF,
  79. SDP_STATE_TX_SEC_CONF_BUSY,
  80. SDP_STATE_TX_REGISTER,
  81. SDP_STATE_TX_REGISTER_BUSY,
  82. SDP_STATE_TX_STATUS,
  83. SDP_STATE_TX_STATUS_BUSY,
  84. SDP_STATE_JUMP,
  85. };
  86. struct f_sdp {
  87. struct usb_function usb_function;
  88. struct usb_descriptor_header **function;
  89. u8 altsetting;
  90. enum sdp_state state;
  91. enum sdp_state next_state;
  92. u32 dnl_address;
  93. u32 dnl_bytes;
  94. u32 dnl_bytes_remaining;
  95. u32 jmp_address;
  96. bool always_send_status;
  97. u32 error_status;
  98. /* EP0 request */
  99. struct usb_request *req;
  100. /* EP1 IN */
  101. struct usb_ep *in_ep;
  102. struct usb_request *in_req;
  103. /* EP1 OUT */
  104. struct usb_ep *out_ep;
  105. struct usb_request *out_req;
  106. bool configuration_done;
  107. bool ep_int_enable;
  108. };
  109. static struct f_sdp *sdp_func;
  110. static inline struct f_sdp *func_to_sdp(struct usb_function *f)
  111. {
  112. return container_of(f, struct f_sdp, usb_function);
  113. }
  114. static struct usb_interface_descriptor sdp_intf_runtime = {
  115. .bLength = sizeof(sdp_intf_runtime),
  116. .bDescriptorType = USB_DT_INTERFACE,
  117. .bAlternateSetting = 0,
  118. .bNumEndpoints = 2,
  119. .bInterfaceClass = USB_CLASS_HID,
  120. .bInterfaceSubClass = 0,
  121. .bInterfaceProtocol = 0,
  122. /* .iInterface = DYNAMIC */
  123. };
  124. /* HID configuration */
  125. static struct usb_class_hid_descriptor sdp_hid_desc = {
  126. .bLength = sizeof(sdp_hid_desc),
  127. .bDescriptorType = USB_DT_CS_DEVICE,
  128. .bcdCDC = __constant_cpu_to_le16(0x0110),
  129. .bCountryCode = 0,
  130. .bNumDescriptors = 1,
  131. .bDescriptorType0 = USB_DT_HID_REPORT,
  132. .wDescriptorLength0 = HID_USAGE_PAGE_LEN,
  133. };
  134. static struct usb_endpoint_descriptor in_desc = {
  135. .bLength = USB_DT_ENDPOINT_SIZE,
  136. .bDescriptorType = USB_DT_ENDPOINT, /*USB_DT_CS_ENDPOINT*/
  137. .bEndpointAddress = 1 | USB_DIR_IN,
  138. .bmAttributes = USB_ENDPOINT_XFER_INT,
  139. .wMaxPacketSize = 64,
  140. .bInterval = 1,
  141. };
  142. static struct usb_endpoint_descriptor out_desc = {
  143. .bLength = USB_DT_ENDPOINT_SIZE,
  144. .bDescriptorType = USB_DT_ENDPOINT, /*USB_DT_CS_ENDPOINT*/
  145. .bEndpointAddress = 1 | USB_DIR_OUT,
  146. .bmAttributes = USB_ENDPOINT_XFER_INT,
  147. .wMaxPacketSize = 64,
  148. .bInterval = 1,
  149. };
  150. static struct usb_endpoint_descriptor in_hs_desc = {
  151. .bLength = USB_DT_ENDPOINT_SIZE,
  152. .bDescriptorType = USB_DT_ENDPOINT, /*USB_DT_CS_ENDPOINT*/
  153. .bEndpointAddress = 1 | USB_DIR_IN,
  154. .bmAttributes = USB_ENDPOINT_XFER_INT,
  155. .wMaxPacketSize = 512,
  156. .bInterval = 3,
  157. };
  158. static struct usb_endpoint_descriptor out_hs_desc = {
  159. .bLength = USB_DT_ENDPOINT_SIZE,
  160. .bDescriptorType = USB_DT_ENDPOINT, /*USB_DT_CS_ENDPOINT*/
  161. .bEndpointAddress = 1 | USB_DIR_OUT,
  162. .bmAttributes = USB_ENDPOINT_XFER_INT,
  163. .wMaxPacketSize = SDP_HID_PACKET_SIZE_EP1,
  164. .bInterval = 3,
  165. };
  166. static struct usb_descriptor_header *sdp_runtime_descs[] = {
  167. (struct usb_descriptor_header *)&sdp_intf_runtime,
  168. (struct usb_descriptor_header *)&sdp_hid_desc,
  169. (struct usb_descriptor_header *)&in_desc,
  170. (struct usb_descriptor_header *)&out_desc,
  171. NULL,
  172. };
  173. static struct usb_descriptor_header *sdp_runtime_hs_descs[] = {
  174. (struct usb_descriptor_header *)&sdp_intf_runtime,
  175. (struct usb_descriptor_header *)&sdp_hid_desc,
  176. (struct usb_descriptor_header *)&in_hs_desc,
  177. (struct usb_descriptor_header *)&out_hs_desc,
  178. NULL,
  179. };
  180. /* This is synchronized with what the SoC implementation reports */
  181. static struct hid_report sdp_hid_report = {
  182. .usage_page = {
  183. 0x06, 0x00, 0xff, /* Usage Page */
  184. 0x09, 0x01, /* Usage (Pointer?) */
  185. 0xa1, 0x01, /* Collection */
  186. 0x85, 0x01, /* Report ID */
  187. 0x19, 0x01, /* Usage Minimum */
  188. 0x29, 0x01, /* Usage Maximum */
  189. 0x15, 0x00, /* Local Minimum */
  190. 0x26, 0xFF, 0x00, /* Local Maximum? */
  191. 0x75, 0x08, /* Report Size */
  192. 0x95, 0x10, /* Report Count */
  193. 0x91, 0x02, /* Output Data */
  194. 0x85, 0x02, /* Report ID */
  195. 0x19, 0x01, /* Usage Minimum */
  196. 0x29, 0x01, /* Usage Maximum */
  197. 0x15, 0x00, /* Local Minimum */
  198. 0x26, 0xFF, 0x00, /* Local Maximum? */
  199. 0x75, 0x80, /* Report Size 128 */
  200. 0x95, 0x40, /* Report Count */
  201. 0x91, 0x02, /* Output Data */
  202. 0x85, 0x03, /* Report ID */
  203. 0x19, 0x01, /* Usage Minimum */
  204. 0x29, 0x01, /* Usage Maximum */
  205. 0x15, 0x00, /* Local Minimum */
  206. 0x26, 0xFF, 0x00, /* Local Maximum? */
  207. 0x75, 0x08, /* Report Size 8 */
  208. 0x95, 0x04, /* Report Count */
  209. 0x81, 0x02, /* Input Data */
  210. 0x85, 0x04, /* Report ID */
  211. 0x19, 0x01, /* Usage Minimum */
  212. 0x29, 0x01, /* Usage Maximum */
  213. 0x15, 0x00, /* Local Minimum */
  214. 0x26, 0xFF, 0x00, /* Local Maximum? */
  215. 0x75, 0x08, /* Report Size 8 */
  216. 0x95, 0x40, /* Report Count */
  217. 0x81, 0x02, /* Input Data */
  218. 0xc0
  219. },
  220. };
  221. static const char sdp_name[] = "Serial Downloader Protocol";
  222. /*
  223. * static strings, in UTF-8
  224. */
  225. static struct usb_string strings_sdp_generic[] = {
  226. [0].s = sdp_name,
  227. { } /* end of list */
  228. };
  229. static struct usb_gadget_strings stringtab_sdp_generic = {
  230. .language = 0x0409, /* en-us */
  231. .strings = strings_sdp_generic,
  232. };
  233. static struct usb_gadget_strings *sdp_generic_strings[] = {
  234. &stringtab_sdp_generic,
  235. NULL,
  236. };
  237. static inline void *sdp_ptr(u32 val)
  238. {
  239. return (void *)(uintptr_t)val;
  240. }
  241. static void sdp_rx_command_complete(struct usb_ep *ep, struct usb_request *req)
  242. {
  243. struct f_sdp *sdp = req->context;
  244. int status = req->status;
  245. u8 *data = req->buf;
  246. u8 report = data[0];
  247. if (status != 0) {
  248. pr_err("Status: %d\n", status);
  249. return;
  250. }
  251. if (report != 1) {
  252. pr_err("Unexpected report %d\n", report);
  253. return;
  254. }
  255. struct sdp_command *cmd = req->buf + 1;
  256. debug("%s: command: %04x, addr: %08x, cnt: %u\n",
  257. __func__, be16_to_cpu(cmd->cmd),
  258. be32_to_cpu(cmd->addr), be32_to_cpu(cmd->cnt));
  259. switch (be16_to_cpu(cmd->cmd)) {
  260. case SDP_READ_REGISTER:
  261. sdp->always_send_status = false;
  262. sdp->error_status = 0x0;
  263. sdp->state = SDP_STATE_TX_SEC_CONF;
  264. sdp->dnl_address = be32_to_cpu(cmd->addr);
  265. sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
  266. sdp->next_state = SDP_STATE_TX_REGISTER;
  267. printf("Reading %d registers at 0x%08x... ",
  268. sdp->dnl_bytes_remaining, sdp->dnl_address);
  269. break;
  270. case SDP_WRITE_FILE:
  271. sdp->always_send_status = true;
  272. sdp->error_status = SDP_WRITE_FILE_COMPLETE;
  273. sdp->state = SDP_STATE_RX_FILE_DATA;
  274. sdp->dnl_address = cmd->addr ? be32_to_cpu(cmd->addr) : CONFIG_SDP_LOADADDR;
  275. sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
  276. sdp->dnl_bytes = sdp->dnl_bytes_remaining;
  277. sdp->next_state = SDP_STATE_IDLE;
  278. printf("Downloading file of size %d to 0x%08x... ",
  279. sdp->dnl_bytes_remaining, sdp->dnl_address);
  280. break;
  281. case SDP_ERROR_STATUS:
  282. sdp->always_send_status = true;
  283. sdp->error_status = 0;
  284. sdp->state = SDP_STATE_TX_SEC_CONF;
  285. sdp->next_state = SDP_STATE_IDLE;
  286. break;
  287. case SDP_DCD_WRITE:
  288. sdp->always_send_status = true;
  289. sdp->error_status = SDP_WRITE_REGISTER_COMPLETE;
  290. sdp->state = SDP_STATE_RX_DCD_DATA;
  291. sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
  292. sdp->next_state = SDP_STATE_IDLE;
  293. break;
  294. case SDP_JUMP_ADDRESS:
  295. sdp->always_send_status = false;
  296. sdp->error_status = 0;
  297. sdp->jmp_address = cmd->addr ? be32_to_cpu(cmd->addr) : CONFIG_SDP_LOADADDR;
  298. sdp->state = SDP_STATE_TX_SEC_CONF;
  299. sdp->next_state = SDP_STATE_JUMP;
  300. break;
  301. case SDP_SKIP_DCD_HEADER:
  302. sdp->always_send_status = true;
  303. sdp->error_status = SDP_SKIP_DCD_HEADER_COMPLETE;
  304. /* Ignore command, DCD not supported anyway */
  305. sdp->state = SDP_STATE_TX_SEC_CONF;
  306. sdp->next_state = SDP_STATE_IDLE;
  307. break;
  308. default:
  309. pr_err("Unknown command: %04x\n", be16_to_cpu(cmd->cmd));
  310. }
  311. }
  312. static void sdp_rx_data_complete(struct usb_ep *ep, struct usb_request *req)
  313. {
  314. struct f_sdp *sdp = req->context;
  315. int status = req->status;
  316. u8 *data = req->buf;
  317. u8 report = data[0];
  318. int datalen = req->actual - 1;
  319. if (status != 0) {
  320. pr_err("Status: %d\n", status);
  321. return;
  322. }
  323. if (report != 2) {
  324. pr_err("Unexpected report %d\n", report);
  325. return;
  326. }
  327. if (sdp->dnl_bytes_remaining < datalen) {
  328. /*
  329. * Some USB stacks require to send a complete buffer as
  330. * specified in the HID descriptor. This leads to longer
  331. * transfers than the file length, no problem for us.
  332. */
  333. sdp->dnl_bytes_remaining = 0;
  334. } else {
  335. sdp->dnl_bytes_remaining -= datalen;
  336. }
  337. if (sdp->state == SDP_STATE_RX_FILE_DATA_BUSY) {
  338. memcpy(sdp_ptr(sdp->dnl_address), req->buf + 1, datalen);
  339. sdp->dnl_address += datalen;
  340. }
  341. if (sdp->dnl_bytes_remaining) {
  342. sdp->state = SDP_STATE_RX_FILE_DATA;
  343. return;
  344. }
  345. #ifndef CONFIG_SPL_BUILD
  346. env_set_hex("filesize", sdp->dnl_bytes);
  347. #endif
  348. printf("done\n");
  349. switch (sdp->state) {
  350. case SDP_STATE_RX_FILE_DATA_BUSY:
  351. sdp->state = SDP_STATE_TX_SEC_CONF;
  352. break;
  353. case SDP_STATE_RX_DCD_DATA:
  354. sdp->state = SDP_STATE_TX_SEC_CONF;
  355. break;
  356. default:
  357. pr_err("Invalid state: %d\n", sdp->state);
  358. }
  359. }
  360. static void sdp_tx_complete(struct usb_ep *ep, struct usb_request *req)
  361. {
  362. struct f_sdp *sdp = req->context;
  363. int status = req->status;
  364. if (status != 0) {
  365. pr_err("Status: %d\n", status);
  366. return;
  367. }
  368. switch (sdp->state) {
  369. case SDP_STATE_TX_SEC_CONF_BUSY:
  370. /* Not all commands require status report */
  371. if (sdp->always_send_status || sdp->error_status)
  372. sdp->state = SDP_STATE_TX_STATUS;
  373. else
  374. sdp->state = sdp->next_state;
  375. break;
  376. case SDP_STATE_TX_STATUS_BUSY:
  377. sdp->state = sdp->next_state;
  378. break;
  379. case SDP_STATE_TX_REGISTER_BUSY:
  380. if (sdp->dnl_bytes_remaining)
  381. sdp->state = SDP_STATE_TX_REGISTER;
  382. else
  383. sdp->state = SDP_STATE_IDLE;
  384. break;
  385. default:
  386. pr_err("Wrong State: %d\n", sdp->state);
  387. sdp->state = SDP_STATE_IDLE;
  388. break;
  389. }
  390. debug("%s complete --> %d, %d/%d\n", ep->name,
  391. status, req->actual, req->length);
  392. }
  393. static int sdp_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
  394. {
  395. struct usb_gadget *gadget = f->config->cdev->gadget;
  396. struct usb_request *req = f->config->cdev->req;
  397. struct f_sdp *sdp = f->config->cdev->req->context;
  398. u16 len = le16_to_cpu(ctrl->wLength);
  399. u16 w_value = le16_to_cpu(ctrl->wValue);
  400. int value = 0;
  401. u8 req_type = ctrl->bRequestType & USB_TYPE_MASK;
  402. debug("w_value: 0x%04x len: 0x%04x\n", w_value, len);
  403. debug("req_type: 0x%02x ctrl->bRequest: 0x%02x sdp->state: %d\n",
  404. req_type, ctrl->bRequest, sdp->state);
  405. if (req_type == USB_TYPE_STANDARD) {
  406. if (ctrl->bRequest == USB_REQ_GET_DESCRIPTOR) {
  407. /* Send HID report descriptor */
  408. value = min(len, (u16) sizeof(sdp_hid_report));
  409. memcpy(req->buf, &sdp_hid_report, value);
  410. sdp->configuration_done = true;
  411. }
  412. }
  413. if (req_type == USB_TYPE_CLASS) {
  414. int report = w_value & HID_REPORT_ID_MASK;
  415. /* HID (SDP) request */
  416. switch (ctrl->bRequest) {
  417. case HID_REQ_SET_REPORT:
  418. switch (report) {
  419. case 1:
  420. value = SDP_COMMAND_LEN + 1;
  421. req->complete = sdp_rx_command_complete;
  422. sdp_func->ep_int_enable = false;
  423. break;
  424. case 2:
  425. value = len;
  426. req->complete = sdp_rx_data_complete;
  427. sdp_func->state = SDP_STATE_RX_FILE_DATA_BUSY;
  428. break;
  429. }
  430. }
  431. }
  432. if (value >= 0) {
  433. req->length = value;
  434. req->zero = value < len;
  435. value = usb_ep_queue(gadget->ep0, req, 0);
  436. if (value < 0) {
  437. debug("ep_queue --> %d\n", value);
  438. req->status = 0;
  439. }
  440. }
  441. return value;
  442. }
  443. static int sdp_bind(struct usb_configuration *c, struct usb_function *f)
  444. {
  445. struct usb_gadget *gadget = c->cdev->gadget;
  446. struct usb_composite_dev *cdev = c->cdev;
  447. struct f_sdp *sdp = func_to_sdp(f);
  448. int rv = 0, id;
  449. id = usb_interface_id(c, f);
  450. if (id < 0)
  451. return id;
  452. sdp_intf_runtime.bInterfaceNumber = id;
  453. struct usb_ep *ep_in, *ep_out;
  454. /* allocate instance-specific endpoints */
  455. ep_in = usb_ep_autoconfig(gadget, &in_desc);
  456. if (!ep_in) {
  457. rv = -ENODEV;
  458. goto error;
  459. }
  460. ep_out = usb_ep_autoconfig(gadget, &out_desc);
  461. if (!ep_out) {
  462. rv = -ENODEV;
  463. goto error;
  464. }
  465. if (gadget_is_dualspeed(gadget)) {
  466. /* Assume endpoint addresses are the same for both speeds */
  467. in_hs_desc.bEndpointAddress = in_desc.bEndpointAddress;
  468. out_hs_desc.bEndpointAddress = out_desc.bEndpointAddress;
  469. }
  470. sdp->in_ep = ep_in; /* Store IN EP for enabling @ setup */
  471. sdp->out_ep = ep_out;
  472. cdev->req->context = sdp;
  473. error:
  474. return rv;
  475. }
  476. static void sdp_unbind(struct usb_configuration *c, struct usb_function *f)
  477. {
  478. free(sdp_func);
  479. sdp_func = NULL;
  480. }
  481. static struct usb_request *alloc_ep_req(struct usb_ep *ep, unsigned length)
  482. {
  483. struct usb_request *req;
  484. req = usb_ep_alloc_request(ep, 0);
  485. if (!req)
  486. return req;
  487. req->length = length;
  488. req->buf = memalign(CONFIG_SYS_CACHELINE_SIZE, length);
  489. if (!req->buf) {
  490. usb_ep_free_request(ep, req);
  491. req = NULL;
  492. }
  493. return req;
  494. }
  495. static struct usb_request *sdp_start_ep(struct usb_ep *ep, bool in)
  496. {
  497. struct usb_request *req;
  498. if (in)
  499. req = alloc_ep_req(ep, 65);
  500. else
  501. req = alloc_ep_req(ep, 2048);
  502. /*
  503. * OUT endpoint request length should be an integral multiple of
  504. * maxpacket size 1024, else we break on certain controllers like
  505. * DWC3 that expect bulk OUT requests to be divisible by maxpacket size.
  506. */
  507. debug("%s: ep:%p req:%p\n", __func__, ep, req);
  508. if (!req)
  509. return NULL;
  510. memset(req->buf, 0, req->length);
  511. if (in)
  512. req->complete = sdp_tx_complete;
  513. else
  514. req->complete = sdp_rx_command_complete;
  515. return req;
  516. }
  517. static int sdp_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
  518. {
  519. struct f_sdp *sdp = func_to_sdp(f);
  520. struct usb_composite_dev *cdev = f->config->cdev;
  521. struct usb_gadget *gadget = cdev->gadget;
  522. int result;
  523. debug("%s: intf: %d alt: %d\n", __func__, intf, alt);
  524. if (gadget_is_dualspeed(gadget) && gadget->speed == USB_SPEED_HIGH) {
  525. result = usb_ep_enable(sdp->in_ep, &in_hs_desc);
  526. result |= usb_ep_enable(sdp->out_ep, &out_hs_desc);
  527. } else {
  528. result = usb_ep_enable(sdp->in_ep, &in_desc);
  529. result |= usb_ep_enable(sdp->out_ep, &out_desc);
  530. }
  531. if (result)
  532. return result;
  533. sdp->in_req = sdp_start_ep(sdp->in_ep, true);
  534. sdp->in_req->context = sdp;
  535. sdp->out_req = sdp_start_ep(sdp->out_ep, false);
  536. sdp->out_req->context = sdp;
  537. sdp->in_ep->driver_data = cdev; /* claim */
  538. sdp->out_ep->driver_data = cdev; /* claim */
  539. sdp->altsetting = alt;
  540. sdp->state = SDP_STATE_IDLE;
  541. sdp->ep_int_enable = true;
  542. return 0;
  543. }
  544. static int sdp_get_alt(struct usb_function *f, unsigned intf)
  545. {
  546. struct f_sdp *sdp = func_to_sdp(f);
  547. return sdp->altsetting;
  548. }
  549. static void sdp_disable(struct usb_function *f)
  550. {
  551. struct f_sdp *sdp = func_to_sdp(f);
  552. usb_ep_disable(sdp->in_ep);
  553. usb_ep_disable(sdp->out_ep);
  554. if (sdp->in_req) {
  555. free(sdp->in_req->buf);
  556. usb_ep_free_request(sdp->in_ep, sdp->in_req);
  557. sdp->in_req = NULL;
  558. }
  559. if (sdp->out_req) {
  560. free(sdp->out_req->buf);
  561. usb_ep_free_request(sdp->out_ep, sdp->out_req);
  562. sdp->out_req = NULL;
  563. }
  564. }
  565. static int sdp_bind_config(struct usb_configuration *c)
  566. {
  567. int status;
  568. if (!sdp_func) {
  569. sdp_func = memalign(CONFIG_SYS_CACHELINE_SIZE, sizeof(*sdp_func));
  570. if (!sdp_func)
  571. return -ENOMEM;
  572. }
  573. memset(sdp_func, 0, sizeof(*sdp_func));
  574. sdp_func->usb_function.name = "sdp";
  575. sdp_func->usb_function.hs_descriptors = sdp_runtime_hs_descs;
  576. sdp_func->usb_function.descriptors = sdp_runtime_descs;
  577. sdp_func->usb_function.bind = sdp_bind;
  578. sdp_func->usb_function.unbind = sdp_unbind;
  579. sdp_func->usb_function.set_alt = sdp_set_alt;
  580. sdp_func->usb_function.get_alt = sdp_get_alt;
  581. sdp_func->usb_function.disable = sdp_disable;
  582. sdp_func->usb_function.strings = sdp_generic_strings;
  583. sdp_func->usb_function.setup = sdp_setup;
  584. status = usb_add_function(c, &sdp_func->usb_function);
  585. return status;
  586. }
  587. int sdp_init(int controller_index)
  588. {
  589. printf("SDP: initialize...\n");
  590. while (!sdp_func->configuration_done) {
  591. if (ctrlc()) {
  592. puts("\rCTRL+C - Operation aborted.\n");
  593. return 1;
  594. }
  595. WATCHDOG_RESET();
  596. usb_gadget_handle_interrupts(controller_index);
  597. }
  598. return 0;
  599. }
  600. static u32 sdp_jump_imxheader(void *address)
  601. {
  602. flash_header_v2_t *headerv2 = address;
  603. ulong (*entry)(void);
  604. if (headerv2->header.tag != IVT_HEADER_TAG) {
  605. printf("Header Tag is not an IMX image\n");
  606. return SDP_ERROR_IMXHEADER;
  607. }
  608. printf("Jumping to 0x%08x\n", headerv2->entry);
  609. entry = sdp_ptr(headerv2->entry);
  610. entry();
  611. /* The image probably never returns hence we won't reach that point */
  612. return 0;
  613. }
  614. #ifdef CONFIG_SPL_BUILD
  615. static ulong sdp_load_read(struct spl_load_info *load, ulong sector,
  616. ulong count, void *buf)
  617. {
  618. debug("%s: sector %lx, count %lx, buf %lx\n",
  619. __func__, sector, count, (ulong)buf);
  620. memcpy(buf, (void *)(load->dev + sector), count);
  621. return count;
  622. }
  623. static ulong search_fit_header(ulong p, int size)
  624. {
  625. int i;
  626. for (i = 0; i < size; i += 4) {
  627. if (genimg_get_format((const void *)(p + i)) == IMAGE_FORMAT_FIT)
  628. return p + i;
  629. }
  630. return 0;
  631. }
  632. static ulong search_container_header(ulong p, int size)
  633. {
  634. int i;
  635. u8 *hdr;
  636. for (i = 0; i < size; i += 4) {
  637. hdr = (u8 *)(p + i);
  638. if (*(hdr + 3) == 0x87 && *hdr == 0)
  639. if (*(hdr + 1) != 0 || *(hdr + 2) != 0)
  640. return p + i;
  641. }
  642. return 0;
  643. }
  644. #endif
  645. static int sdp_handle_in_ep(struct spl_image_info *spl_image)
  646. {
  647. u8 *data = sdp_func->in_req->buf;
  648. u32 status;
  649. int datalen;
  650. switch (sdp_func->state) {
  651. case SDP_STATE_TX_SEC_CONF:
  652. debug("Report 3: HAB security\n");
  653. data[0] = 3;
  654. status = SDP_SECURITY_OPEN;
  655. memcpy(&data[1], &status, 4);
  656. sdp_func->in_req->length = 5;
  657. usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
  658. sdp_func->state = SDP_STATE_TX_SEC_CONF_BUSY;
  659. break;
  660. case SDP_STATE_TX_STATUS:
  661. debug("Report 4: Status\n");
  662. data[0] = 4;
  663. memcpy(&data[1], &sdp_func->error_status, 4);
  664. sdp_func->in_req->length = 65;
  665. usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
  666. sdp_func->state = SDP_STATE_TX_STATUS_BUSY;
  667. break;
  668. case SDP_STATE_TX_REGISTER:
  669. debug("Report 4: Register Values\n");
  670. data[0] = 4;
  671. datalen = sdp_func->dnl_bytes_remaining;
  672. if (datalen > 64)
  673. datalen = 64;
  674. memcpy(&data[1], sdp_ptr(sdp_func->dnl_address), datalen);
  675. sdp_func->in_req->length = 65;
  676. sdp_func->dnl_bytes_remaining -= datalen;
  677. sdp_func->dnl_address += datalen;
  678. usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
  679. sdp_func->state = SDP_STATE_TX_REGISTER_BUSY;
  680. break;
  681. case SDP_STATE_JUMP:
  682. printf("Jumping to header at 0x%08x\n", sdp_func->jmp_address);
  683. status = sdp_jump_imxheader(sdp_ptr(sdp_func->jmp_address));
  684. /* If imx header fails, try some U-Boot specific headers */
  685. if (status) {
  686. #ifdef CONFIG_SPL_BUILD
  687. if (IS_ENABLED(CONFIG_SPL_LOAD_IMX_CONTAINER))
  688. sdp_func->jmp_address = (u32)search_container_header((ulong)sdp_func->jmp_address, sdp_func->dnl_bytes);
  689. else if (IS_ENABLED(CONFIG_SPL_LOAD_FIT))
  690. sdp_func->jmp_address = (u32)search_fit_header((ulong)sdp_func->jmp_address, sdp_func->dnl_bytes);
  691. if (sdp_func->jmp_address == 0)
  692. panic("Error in search header, failed to jump\n");
  693. printf("Found header at 0x%08x\n", sdp_func->jmp_address);
  694. image_header_t *header =
  695. sdp_ptr(sdp_func->jmp_address);
  696. #ifdef CONFIG_SPL_LOAD_FIT
  697. if (image_get_magic(header) == FDT_MAGIC) {
  698. struct spl_load_info load;
  699. debug("Found FIT\n");
  700. load.dev = header;
  701. load.bl_len = 1;
  702. load.read = sdp_load_read;
  703. spl_load_simple_fit(spl_image, &load, 0,
  704. header);
  705. return SDP_EXIT;
  706. }
  707. #endif
  708. if (IS_ENABLED(CONFIG_SPL_LOAD_IMX_CONTAINER)) {
  709. struct spl_load_info load;
  710. load.dev = header;
  711. load.bl_len = 1;
  712. load.read = sdp_load_read;
  713. spl_load_imx_container(spl_image, &load, 0);
  714. return SDP_EXIT;
  715. }
  716. /* In SPL, allow jumps to U-Boot images */
  717. struct spl_image_info spl_image = {};
  718. spl_parse_image_header(&spl_image, header);
  719. jump_to_image_no_args(&spl_image);
  720. #else
  721. /* In U-Boot, allow jumps to scripts */
  722. image_source_script(sdp_func->jmp_address, "script@1");
  723. #endif
  724. }
  725. sdp_func->next_state = SDP_STATE_IDLE;
  726. sdp_func->error_status = status;
  727. /* Only send Report 4 if there was an error */
  728. if (status)
  729. sdp_func->state = SDP_STATE_TX_STATUS;
  730. else
  731. sdp_func->state = SDP_STATE_IDLE;
  732. break;
  733. default:
  734. break;
  735. };
  736. return 0;
  737. }
  738. static void sdp_handle_out_ep(void)
  739. {
  740. int rc;
  741. if (sdp_func->state == SDP_STATE_IDLE) {
  742. sdp_func->out_req->complete = sdp_rx_command_complete;
  743. rc = usb_ep_queue(sdp_func->out_ep, sdp_func->out_req, 0);
  744. if (rc)
  745. printf("error in submission: %s\n",
  746. sdp_func->out_ep->name);
  747. sdp_func->state = SDP_STATE_RX_CMD;
  748. } else if (sdp_func->state == SDP_STATE_RX_FILE_DATA) {
  749. sdp_func->out_req->complete = sdp_rx_data_complete;
  750. rc = usb_ep_queue(sdp_func->out_ep, sdp_func->out_req, 0);
  751. if (rc)
  752. printf("error in submission: %s\n",
  753. sdp_func->out_ep->name);
  754. sdp_func->state = SDP_STATE_RX_FILE_DATA_BUSY;
  755. }
  756. }
  757. #ifndef CONFIG_SPL_BUILD
  758. int sdp_handle(int controller_index)
  759. #else
  760. int spl_sdp_handle(int controller_index, struct spl_image_info *spl_image)
  761. #endif
  762. {
  763. int flag = 0;
  764. printf("SDP: handle requests...\n");
  765. while (1) {
  766. if (ctrlc()) {
  767. puts("\rCTRL+C - Operation aborted.\n");
  768. return -EINVAL;
  769. }
  770. if (flag == SDP_EXIT)
  771. return 0;
  772. WATCHDOG_RESET();
  773. usb_gadget_handle_interrupts(controller_index);
  774. #ifdef CONFIG_SPL_BUILD
  775. flag = sdp_handle_in_ep(spl_image);
  776. #else
  777. flag = sdp_handle_in_ep(NULL);
  778. #endif
  779. if (sdp_func->ep_int_enable)
  780. sdp_handle_out_ep();
  781. }
  782. }
  783. int sdp_add(struct usb_configuration *c)
  784. {
  785. int id;
  786. id = usb_string_id(c->cdev);
  787. if (id < 0)
  788. return id;
  789. strings_sdp_generic[0].id = id;
  790. sdp_intf_runtime.iInterface = id;
  791. debug("%s: cdev: %p gadget: %p gadget->ep0: %p\n", __func__,
  792. c->cdev, c->cdev->gadget, c->cdev->gadget->ep0);
  793. return sdp_bind_config(c);
  794. }
  795. DECLARE_GADGET_BIND_CALLBACK(usb_dnl_sdp, sdp_add);