drivers/usb/gadget/f_sdp.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * f_sdp.c -- USB HID Serial Download Protocol
   4  *
   5  * Copyright (C) 2017 Toradex
   6  * Author: Stefan Agner <stefan.agner@toradex.com>
   7  *
   8  * This file implements the Serial Download Protocol (SDP) as specified in
   9  * the i.MX 6 Reference Manual. The SDP is a USB HID based protocol and
  10  * allows to download images directly to memory. The implementation
  11  * works with the imx_loader (imx_usb) USB client software on host side.
  12  *
  13  * Not all commands are implemented, e.g. WRITE_REGISTER, DCD_WRITE and
  14  * SKIP_DCD_HEADER are only stubs.
  15  *
  16  * Parts of the implementation are based on f_dfu and f_thor.
  17  */
  18
  19 #include <errno.h>
  20 #include <common.h>
  21 #include <console.h>
  22 #include <env.h>
  23 #include <log.h>
  24 #include <malloc.h>
  25
  26 #include <linux/usb/ch9.h>
  27 #include <linux/usb/gadget.h>
  28 #include <linux/usb/composite.h>
  29
  30 #include <asm/io.h>
  31 #include <g_dnl.h>
  32 #include <sdp.h>
  33 #include <spl.h>
  34 #include <image.h>
  35 #include <imximage.h>
  36 #include <watchdog.h>
  37
  38 #define HID_REPORT_ID_MASK      0x000000ff
  39
  40 /*
  41  * HID class requests
  42  */
  43 #define HID_REQ_GET_REPORT              0x01
  44 #define HID_REQ_GET_IDLE                0x02
  45 #define HID_REQ_GET_PROTOCOL            0x03
  46 #define HID_REQ_SET_REPORT              0x09
  47 #define HID_REQ_SET_IDLE                0x0A
  48 #define HID_REQ_SET_PROTOCOL            0x0B
  49
  50 #define HID_USAGE_PAGE_LEN              76
  51
  52 struct hid_report {
  53         u8 usage_page[HID_USAGE_PAGE_LEN];
  54 } __packed;
  55
  56 #define SDP_READ_REGISTER       0x0101
  57 #define SDP_WRITE_REGISTER      0x0202
  58 #define SDP_WRITE_FILE          0x0404
  59 #define SDP_ERROR_STATUS        0x0505
  60 #define SDP_DCD_WRITE           0x0a0a
  61 #define SDP_JUMP_ADDRESS        0x0b0b
  62 #define SDP_SKIP_DCD_HEADER     0x0c0c
  63
  64 #define SDP_SECURITY_CLOSED             0x12343412
  65 #define SDP_SECURITY_OPEN               0x56787856
  66
  67 #define SDP_WRITE_FILE_COMPLETE         0x88888888
  68 #define SDP_WRITE_REGISTER_COMPLETE     0x128A8A12
  69 #define SDP_SKIP_DCD_HEADER_COMPLETE    0x900DD009
  70 #define SDP_ERROR_IMXHEADER             0x000a0533
  71
  72 #define SDP_COMMAND_LEN         16
  73
  74 struct sdp_command {
  75         u16 cmd;
  76         u32 addr;
  77         u8 format;
  78         u32 cnt;
  79         u32 data;
  80         u8 rsvd;
  81 } __packed;
  82
  83 enum sdp_state {
  84         SDP_STATE_IDLE,
  85         SDP_STATE_RX_DCD_DATA,
  86         SDP_STATE_RX_FILE_DATA,
  87         SDP_STATE_TX_SEC_CONF,
  88         SDP_STATE_TX_SEC_CONF_BUSY,
  89         SDP_STATE_TX_REGISTER,
  90         SDP_STATE_TX_REGISTER_BUSY,
  91         SDP_STATE_TX_STATUS,
  92         SDP_STATE_TX_STATUS_BUSY,
  93         SDP_STATE_JUMP,
  94 };
  95
  96 struct f_sdp {
  97         struct usb_function             usb_function;
  98
  99         struct usb_descriptor_header    **function;
 100
 101         u8                              altsetting;
 102         enum sdp_state                  state;
 103         enum sdp_state                  next_state;
 104         u32                             dnl_address;
 105         u32                             dnl_bytes;
 106         u32                             dnl_bytes_remaining;
 107         u32                             jmp_address;
 108         bool                            always_send_status;
 109         u32                             error_status;
 110
 111         /* EP0 request */
 112         struct usb_request              *req;
 113
 114         /* EP1 IN */
 115         struct usb_ep                   *in_ep;
 116         struct usb_request              *in_req;
 117
 118         bool                            configuration_done;
 119 };
 120
 121 static struct f_sdp *sdp_func;
 122
 123 static inline struct f_sdp *func_to_sdp(struct usb_function *f)
 124 {
 125         return container_of(f, struct f_sdp, usb_function);
 126 }
 127
 128 static struct usb_interface_descriptor sdp_intf_runtime = {
 129         .bLength =              sizeof(sdp_intf_runtime),
 130         .bDescriptorType =      USB_DT_INTERFACE,
 131         .bAlternateSetting =    0,
 132         .bNumEndpoints =        1,
 133         .bInterfaceClass =      USB_CLASS_HID,
 134         .bInterfaceSubClass =   0,
 135         .bInterfaceProtocol =   0,
 136         /* .iInterface = DYNAMIC */
 137 };
 138
 139 /* HID configuration */
 140 static struct usb_class_hid_descriptor sdp_hid_desc = {
 141         .bLength =              sizeof(sdp_hid_desc),
 142         .bDescriptorType =      USB_DT_CS_DEVICE,
 143
 144         .bcdCDC =               __constant_cpu_to_le16(0x0110),
 145         .bCountryCode =         0,
 146         .bNumDescriptors =      1,
 147
 148         .bDescriptorType0       = USB_DT_HID_REPORT,
 149         .wDescriptorLength0     = HID_USAGE_PAGE_LEN,
 150 };
 151
 152 static struct usb_endpoint_descriptor in_desc = {
 153         .bLength =              USB_DT_ENDPOINT_SIZE,
 154         .bDescriptorType =      USB_DT_ENDPOINT, /*USB_DT_CS_ENDPOINT*/
 155
 156         .bEndpointAddress =     1 | USB_DIR_IN,
 157         .bmAttributes = USB_ENDPOINT_XFER_INT,
 158         .wMaxPacketSize =       64,
 159         .bInterval =            1,
 160 };
 161
 162 static struct usb_descriptor_header *sdp_runtime_descs[] = {
 163         (struct usb_descriptor_header *)&sdp_intf_runtime,
 164         (struct usb_descriptor_header *)&sdp_hid_desc,
 165         (struct usb_descriptor_header *)&in_desc,
 166         NULL,
 167 };
 168
 169 /* This is synchronized with what the SoC implementation reports */
 170 static struct hid_report sdp_hid_report = {
 171         .usage_page = {
 172                 0x06, 0x00, 0xff, /* Usage Page */
 173                 0x09, 0x01, /* Usage (Pointer?) */
 174                 0xa1, 0x01, /* Collection */
 175
 176                 0x85, 0x01, /* Report ID */
 177                 0x19, 0x01, /* Usage Minimum */
 178                 0x29, 0x01, /* Usage Maximum */
 179                 0x15, 0x00, /* Local Minimum */
 180                 0x26, 0xFF, 0x00, /* Local Maximum? */
 181                 0x75, 0x08, /* Report Size */
 182                 0x95, 0x10, /* Report Count */
 183                 0x91, 0x02, /* Output Data */
 184
 185                 0x85, 0x02, /* Report ID */
 186                 0x19, 0x01, /* Usage Minimum */
 187                 0x29, 0x01, /* Usage Maximum */
 188                 0x15, 0x00, /* Local Minimum */
 189                 0x26, 0xFF, 0x00, /* Local Maximum? */
 190                 0x75, 0x80, /* Report Size 128 */
 191                 0x95, 0x40, /* Report Count */
 192                 0x91, 0x02, /* Output Data */
 193
 194                 0x85, 0x03, /* Report ID */
 195                 0x19, 0x01, /* Usage Minimum */
 196                 0x29, 0x01, /* Usage Maximum */
 197                 0x15, 0x00, /* Local Minimum */
 198                 0x26, 0xFF, 0x00, /* Local Maximum? */
 199                 0x75, 0x08, /* Report Size 8 */
 200                 0x95, 0x04, /* Report Count */
 201                 0x81, 0x02, /* Input Data */
 202
 203                 0x85, 0x04, /* Report ID */
 204                 0x19, 0x01, /* Usage Minimum */
 205                 0x29, 0x01, /* Usage Maximum */
 206                 0x15, 0x00, /* Local Minimum */
 207                 0x26, 0xFF, 0x00, /* Local Maximum? */
 208                 0x75, 0x08, /* Report Size 8 */
 209                 0x95, 0x40, /* Report Count */
 210                 0x81, 0x02, /* Input Data */
 211                 0xc0
 212         },
 213 };
 214
 215 static const char sdp_name[] = "Serial Downloader Protocol";
 216
 217 /*
 218  * static strings, in UTF-8
 219  */
 220 static struct usb_string strings_sdp_generic[] = {
 221         [0].s = sdp_name,
 222         {  }                    /* end of list */
 223 };
 224
 225 static struct usb_gadget_strings stringtab_sdp_generic = {
 226         .language       = 0x0409,       /* en-us */
 227         .strings        = strings_sdp_generic,
 228 };
 229
 230 static struct usb_gadget_strings *sdp_generic_strings[] = {
 231         &stringtab_sdp_generic,
 232         NULL,
 233 };
 234
 235 static inline void *sdp_ptr(u32 val)
 236 {
 237         return (void *)(uintptr_t)val;
 238 }
 239
 240 static void sdp_rx_command_complete(struct usb_ep *ep, struct usb_request *req)
 241 {
 242         struct f_sdp *sdp = req->context;
 243         int status = req->status;
 244         u8 *data = req->buf;
 245         u8 report = data[0];
 246
 247         if (status != 0) {
 248                 pr_err("Status: %d\n", status);
 249                 return;
 250         }
 251
 252         if (report != 1) {
 253                 pr_err("Unexpected report %d\n", report);
 254                 return;
 255         }
 256
 257         struct sdp_command *cmd = req->buf + 1;
 258
 259         debug("%s: command: %04x, addr: %08x, cnt: %u\n",
 260               __func__, be16_to_cpu(cmd->cmd),
 261               be32_to_cpu(cmd->addr), be32_to_cpu(cmd->cnt));
 262
 263         switch (be16_to_cpu(cmd->cmd)) {
 264         case SDP_READ_REGISTER:
 265                 sdp->always_send_status = false;
 266                 sdp->error_status = 0x0;
 267
 268                 sdp->state = SDP_STATE_TX_SEC_CONF;
 269                 sdp->dnl_address = be32_to_cpu(cmd->addr);
 270                 sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
 271                 sdp->next_state = SDP_STATE_TX_REGISTER;
 272                 printf("Reading %d registers at 0x%08x... ",
 273                        sdp->dnl_bytes_remaining, sdp->dnl_address);
 274                 break;
 275         case SDP_WRITE_FILE:
 276                 sdp->always_send_status = true;
 277                 sdp->error_status = SDP_WRITE_FILE_COMPLETE;
 278
 279                 sdp->state = SDP_STATE_RX_FILE_DATA;
 280                 sdp->dnl_address = cmd->addr ? be32_to_cpu(cmd->addr) : CONFIG_SDP_LOADADDR;
 281                 sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
 282                 sdp->dnl_bytes = sdp->dnl_bytes_remaining;
 283                 sdp->next_state = SDP_STATE_IDLE;
 284
 285                 printf("Downloading file of size %d to 0x%08x... ",
 286                        sdp->dnl_bytes_remaining, sdp->dnl_address);
 287
 288                 break;
 289         case SDP_ERROR_STATUS:
 290                 sdp->always_send_status = true;
 291                 sdp->error_status = 0;
 292
 293                 sdp->state = SDP_STATE_TX_SEC_CONF;
 294                 sdp->next_state = SDP_STATE_IDLE;
 295                 break;
 296         case SDP_DCD_WRITE:
 297                 sdp->always_send_status = true;
 298                 sdp->error_status = SDP_WRITE_REGISTER_COMPLETE;
 299
 300                 sdp->state = SDP_STATE_RX_DCD_DATA;
 301                 sdp->dnl_bytes_remaining = be32_to_cpu(cmd->cnt);
 302                 sdp->next_state = SDP_STATE_IDLE;
 303                 break;
 304         case SDP_JUMP_ADDRESS:
 305                 sdp->always_send_status = false;
 306                 sdp->error_status = 0;
 307
 308                 sdp->jmp_address = cmd->addr ? be32_to_cpu(cmd->addr) : CONFIG_SDP_LOADADDR;
 309                 sdp->state = SDP_STATE_TX_SEC_CONF;
 310                 sdp->next_state = SDP_STATE_JUMP;
 311                 break;
 312         case SDP_SKIP_DCD_HEADER:
 313                 sdp->always_send_status = true;
 314                 sdp->error_status = SDP_SKIP_DCD_HEADER_COMPLETE;
 315
 316                 /* Ignore command, DCD not supported anyway */
 317                 sdp->state = SDP_STATE_TX_SEC_CONF;
 318                 sdp->next_state = SDP_STATE_IDLE;
 319                 break;
 320         default:
 321                 pr_err("Unknown command: %04x\n", be16_to_cpu(cmd->cmd));
 322         }
 323 }
 324
 325 static void sdp_rx_data_complete(struct usb_ep *ep, struct usb_request *req)
 326 {
 327         struct f_sdp *sdp = req->context;
 328         int status = req->status;
 329         u8 *data = req->buf;
 330         u8 report = data[0];
 331         int datalen = req->length - 1;
 332
 333         if (status != 0) {
 334                 pr_err("Status: %d\n", status);
 335                 return;
 336         }
 337
 338         if (report != 2) {
 339                 pr_err("Unexpected report %d\n", report);
 340                 return;
 341         }
 342
 343         if (sdp->dnl_bytes_remaining < datalen) {
 344                 /*
 345                  * Some USB stacks require to send a complete buffer as
 346                  * specified in the HID descriptor. This leads to longer
 347                  * transfers than the file length, no problem for us.
 348                  */
 349                 sdp->dnl_bytes_remaining = 0;
 350         } else {
 351                 sdp->dnl_bytes_remaining -= datalen;
 352         }
 353
 354         if (sdp->state == SDP_STATE_RX_FILE_DATA) {
 355                 memcpy(sdp_ptr(sdp->dnl_address), req->buf + 1, datalen);
 356                 sdp->dnl_address += datalen;
 357         }
 358
 359         if (sdp->dnl_bytes_remaining)
 360                 return;
 361
 362 #ifndef CONFIG_SPL_BUILD
 363         env_set_hex("filesize", sdp->dnl_bytes);
 364 #endif
 365         printf("done\n");
 366
 367         switch (sdp->state) {
 368         case SDP_STATE_RX_FILE_DATA:
 369                 sdp->state = SDP_STATE_TX_SEC_CONF;
 370                 break;
 371         case SDP_STATE_RX_DCD_DATA:
 372                 sdp->state = SDP_STATE_TX_SEC_CONF;
 373                 break;
 374         default:
 375                 pr_err("Invalid state: %d\n", sdp->state);
 376         }
 377 }
 378
 379 static void sdp_tx_complete(struct usb_ep *ep, struct usb_request *req)
 380 {
 381         struct f_sdp *sdp = req->context;
 382         int status = req->status;
 383
 384         if (status != 0) {
 385                 pr_err("Status: %d\n", status);
 386                 return;
 387         }
 388
 389         switch (sdp->state) {
 390         case SDP_STATE_TX_SEC_CONF_BUSY:
 391                 /* Not all commands require status report */
 392                 if (sdp->always_send_status || sdp->error_status)
 393                         sdp->state = SDP_STATE_TX_STATUS;
 394                 else
 395                         sdp->state = sdp->next_state;
 396
 397                 break;
 398         case SDP_STATE_TX_STATUS_BUSY:
 399                 sdp->state = sdp->next_state;
 400                 break;
 401         case SDP_STATE_TX_REGISTER_BUSY:
 402                 if (sdp->dnl_bytes_remaining)
 403                         sdp->state = SDP_STATE_TX_REGISTER;
 404                 else
 405                         sdp->state = SDP_STATE_IDLE;
 406                 break;
 407         default:
 408                 pr_err("Wrong State: %d\n", sdp->state);
 409                 sdp->state = SDP_STATE_IDLE;
 410                 break;
 411         }
 412         debug("%s complete --> %d, %d/%d\n", ep->name,
 413               status, req->actual, req->length);
 414 }
 415
 416 static int sdp_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 417 {
 418         struct usb_gadget *gadget = f->config->cdev->gadget;
 419         struct usb_request *req = f->config->cdev->req;
 420         struct f_sdp *sdp = f->config->cdev->req->context;
 421         u16 len = le16_to_cpu(ctrl->wLength);
 422         u16 w_value = le16_to_cpu(ctrl->wValue);
 423         int value = 0;
 424         u8 req_type = ctrl->bRequestType & USB_TYPE_MASK;
 425
 426         debug("w_value: 0x%04x len: 0x%04x\n", w_value, len);
 427         debug("req_type: 0x%02x ctrl->bRequest: 0x%02x sdp->state: %d\n",
 428               req_type, ctrl->bRequest, sdp->state);
 429
 430         if (req_type == USB_TYPE_STANDARD) {
 431                 if (ctrl->bRequest == USB_REQ_GET_DESCRIPTOR) {
 432                         /* Send HID report descriptor */
 433                         value = min(len, (u16) sizeof(sdp_hid_report));
 434                         memcpy(req->buf, &sdp_hid_report, value);
 435                         sdp->configuration_done = true;
 436                 }
 437         }
 438
 439         if (req_type == USB_TYPE_CLASS) {
 440                 int report = w_value & HID_REPORT_ID_MASK;
 441
 442                 /* HID (SDP) request */
 443                 switch (ctrl->bRequest) {
 444                 case HID_REQ_SET_REPORT:
 445                         switch (report) {
 446                         case 1:
 447                                 value = SDP_COMMAND_LEN + 1;
 448                                 req->complete = sdp_rx_command_complete;
 449                                 break;
 450                         case 2:
 451                                 value = len;
 452                                 req->complete = sdp_rx_data_complete;
 453                                 break;
 454                         }
 455                 }
 456         }
 457
 458         if (value >= 0) {
 459                 req->length = value;
 460                 req->zero = value < len;
 461                 value = usb_ep_queue(gadget->ep0, req, 0);
 462                 if (value < 0) {
 463                         debug("ep_queue --> %d\n", value);
 464                         req->status = 0;
 465                 }
 466         }
 467
 468         return value;
 469 }
 470
 471 static int sdp_bind(struct usb_configuration *c, struct usb_function *f)
 472 {
 473         struct usb_gadget *gadget = c->cdev->gadget;
 474         struct usb_composite_dev *cdev = c->cdev;
 475         struct f_sdp *sdp = func_to_sdp(f);
 476         int rv = 0, id;
 477
 478         id = usb_interface_id(c, f);
 479         if (id < 0)
 480                 return id;
 481         sdp_intf_runtime.bInterfaceNumber = id;
 482
 483         struct usb_ep *ep;
 484
 485         /* allocate instance-specific endpoints */
 486         ep = usb_ep_autoconfig(gadget, &in_desc);
 487         if (!ep) {
 488                 rv = -ENODEV;
 489                 goto error;
 490         }
 491
 492         sdp->in_ep = ep; /* Store IN EP for enabling @ setup */
 493
 494         cdev->req->context = sdp;
 495
 496 error:
 497         return rv;
 498 }
 499
 500 static void sdp_unbind(struct usb_configuration *c, struct usb_function *f)
 501 {
 502         free(sdp_func);
 503         sdp_func = NULL;
 504 }
 505
 506 static struct usb_request *alloc_ep_req(struct usb_ep *ep, unsigned length)
 507 {
 508         struct usb_request *req;
 509
 510         req = usb_ep_alloc_request(ep, 0);
 511         if (!req)
 512                 return req;
 513
 514         req->length = length;
 515         req->buf = memalign(CONFIG_SYS_CACHELINE_SIZE, length);
 516         if (!req->buf) {
 517                 usb_ep_free_request(ep, req);
 518                 req = NULL;
 519         }
 520
 521         return req;
 522 }
 523
 524
 525 static struct usb_request *sdp_start_ep(struct usb_ep *ep)
 526 {
 527         struct usb_request *req;
 528
 529         req = alloc_ep_req(ep, 64);
 530         debug("%s: ep:%p req:%p\n", __func__, ep, req);
 531
 532         if (!req)
 533                 return NULL;
 534
 535         memset(req->buf, 0, req->length);
 536         req->complete = sdp_tx_complete;
 537
 538         return req;
 539 }
 540 static int sdp_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 541 {
 542         struct f_sdp *sdp = func_to_sdp(f);
 543         struct usb_composite_dev *cdev = f->config->cdev;
 544         int result;
 545
 546         debug("%s: intf: %d alt: %d\n", __func__, intf, alt);
 547
 548         result = usb_ep_enable(sdp->in_ep, &in_desc);
 549         if (result)
 550                 return result;
 551         sdp->in_req = sdp_start_ep(sdp->in_ep);
 552         sdp->in_req->context = sdp;
 553
 554         sdp->in_ep->driver_data = cdev; /* claim */
 555
 556         sdp->altsetting = alt;
 557         sdp->state = SDP_STATE_IDLE;
 558
 559         return 0;
 560 }
 561
 562 static int sdp_get_alt(struct usb_function *f, unsigned intf)
 563 {
 564         struct f_sdp *sdp = func_to_sdp(f);
 565
 566         return sdp->altsetting;
 567 }
 568
 569 static void sdp_disable(struct usb_function *f)
 570 {
 571         struct f_sdp *sdp = func_to_sdp(f);
 572
 573         usb_ep_disable(sdp->in_ep);
 574
 575         if (sdp->in_req) {
 576                 free(sdp->in_req);
 577                 sdp->in_req = NULL;
 578         }
 579 }
 580
 581 static int sdp_bind_config(struct usb_configuration *c)
 582 {
 583         int status;
 584
 585         if (!sdp_func) {
 586                 sdp_func = memalign(CONFIG_SYS_CACHELINE_SIZE, sizeof(*sdp_func));
 587                 if (!sdp_func)
 588                         return -ENOMEM;
 589         }
 590
 591         memset(sdp_func, 0, sizeof(*sdp_func));
 592
 593         sdp_func->usb_function.name = "sdp";
 594         sdp_func->usb_function.hs_descriptors = sdp_runtime_descs;
 595         sdp_func->usb_function.descriptors = sdp_runtime_descs;
 596         sdp_func->usb_function.bind = sdp_bind;
 597         sdp_func->usb_function.unbind = sdp_unbind;
 598         sdp_func->usb_function.set_alt = sdp_set_alt;
 599         sdp_func->usb_function.get_alt = sdp_get_alt;
 600         sdp_func->usb_function.disable = sdp_disable;
 601         sdp_func->usb_function.strings = sdp_generic_strings;
 602         sdp_func->usb_function.setup = sdp_setup;
 603
 604         status = usb_add_function(c, &sdp_func->usb_function);
 605
 606         return status;
 607 }
 608
 609 int sdp_init(int controller_index)
 610 {
 611         printf("SDP: initialize...\n");
 612         while (!sdp_func->configuration_done) {
 613                 if (ctrlc()) {
 614                         puts("\rCTRL+C - Operation aborted.\n");
 615                         return 1;
 616                 }
 617
 618                 WATCHDOG_RESET();
 619                 usb_gadget_handle_interrupts(controller_index);
 620         }
 621
 622         return 0;
 623 }
 624
 625 static u32 sdp_jump_imxheader(void *address)
 626 {
 627         flash_header_v2_t *headerv2 = address;
 628         ulong (*entry)(void);
 629
 630         if (headerv2->header.tag != IVT_HEADER_TAG) {
 631                 printf("Header Tag is not an IMX image\n");
 632                 return SDP_ERROR_IMXHEADER;
 633         }
 634
 635         printf("Jumping to 0x%08x\n", headerv2->entry);
 636         entry = sdp_ptr(headerv2->entry);
 637         entry();
 638
 639         /* The image probably never returns hence we won't reach that point */
 640         return 0;
 641 }
 642
 643 #ifdef CONFIG_SPL_BUILD
 644 #ifdef CONFIG_SPL_LOAD_FIT
 645 static ulong sdp_fit_read(struct spl_load_info *load, ulong sector,
 646                           ulong count, void *buf)
 647 {
 648         debug("%s: sector %lx, count %lx, buf %lx\n",
 649               __func__, sector, count, (ulong)buf);
 650         memcpy(buf, (void *)(load->dev + sector), count);
 651         return count;
 652 }
 653 #endif
 654 #endif
 655
 656 static void sdp_handle_in_ep(struct spl_image_info *spl_image)
 657 {
 658         u8 *data = sdp_func->in_req->buf;
 659         u32 status;
 660         int datalen;
 661
 662         switch (sdp_func->state) {
 663         case SDP_STATE_TX_SEC_CONF:
 664                 debug("Report 3: HAB security\n");
 665                 data[0] = 3;
 666
 667                 status = SDP_SECURITY_OPEN;
 668                 memcpy(&data[1], &status, 4);
 669                 sdp_func->in_req->length = 5;
 670                 usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
 671                 sdp_func->state = SDP_STATE_TX_SEC_CONF_BUSY;
 672                 break;
 673
 674         case SDP_STATE_TX_STATUS:
 675                 debug("Report 4: Status\n");
 676                 data[0] = 4;
 677
 678                 memcpy(&data[1], &sdp_func->error_status, 4);
 679                 sdp_func->in_req->length = 65;
 680                 usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
 681                 sdp_func->state = SDP_STATE_TX_STATUS_BUSY;
 682                 break;
 683         case SDP_STATE_TX_REGISTER:
 684                 debug("Report 4: Register Values\n");
 685                 data[0] = 4;
 686
 687                 datalen = sdp_func->dnl_bytes_remaining;
 688
 689                 if (datalen > 64)
 690                         datalen = 64;
 691
 692                 memcpy(&data[1], sdp_ptr(sdp_func->dnl_address), datalen);
 693                 sdp_func->in_req->length = 65;
 694
 695                 sdp_func->dnl_bytes_remaining -= datalen;
 696                 sdp_func->dnl_address += datalen;
 697
 698                 usb_ep_queue(sdp_func->in_ep, sdp_func->in_req, 0);
 699                 sdp_func->state = SDP_STATE_TX_REGISTER_BUSY;
 700                 break;
 701         case SDP_STATE_JUMP:
 702                 printf("Jumping to header at 0x%08x\n", sdp_func->jmp_address);
 703                 status = sdp_jump_imxheader(sdp_ptr(sdp_func->jmp_address));
 704
 705                 /* If imx header fails, try some U-Boot specific headers */
 706                 if (status) {
 707 #ifdef CONFIG_SPL_BUILD
 708                         image_header_t *header =
 709                                 sdp_ptr(sdp_func->jmp_address);
 710 #ifdef CONFIG_SPL_LOAD_FIT
 711                         if (image_get_magic(header) == FDT_MAGIC) {
 712                                 struct spl_load_info load;
 713
 714                                 debug("Found FIT\n");
 715                                 load.dev = header;
 716                                 load.bl_len = 1;
 717                                 load.read = sdp_fit_read;
 718                                 spl_load_simple_fit(spl_image, &load, 0,
 719                                                     header);
 720
 721                                 return;
 722                         }
 723 #endif
 724                         /* In SPL, allow jumps to U-Boot images */
 725                         struct spl_image_info spl_image = {};
 726                         spl_parse_image_header(&spl_image, header);
 727                         jump_to_image_no_args(&spl_image);
 728 #else
 729                         /* In U-Boot, allow jumps to scripts */
 730                         image_source_script(sdp_func->jmp_address, "script@1");
 731 #endif
 732                 }
 733
 734                 sdp_func->next_state = SDP_STATE_IDLE;
 735                 sdp_func->error_status = status;
 736
 737                 /* Only send Report 4 if there was an error */
 738                 if (status)
 739                         sdp_func->state = SDP_STATE_TX_STATUS;
 740                 else
 741                         sdp_func->state = SDP_STATE_IDLE;
 742                 break;
 743         default:
 744                 break;
 745         };
 746 }
 747
 748 #ifndef CONFIG_SPL_BUILD
 749 int sdp_handle(int controller_index)
 750 #else
 751 int spl_sdp_handle(int controller_index, struct spl_image_info *spl_image)
 752 #endif
 753 {
 754         printf("SDP: handle requests...\n");
 755         while (1) {
 756                 if (ctrlc()) {
 757                         puts("\rCTRL+C - Operation aborted.\n");
 758                         return -EINVAL;
 759                 }
 760
 761 #ifdef CONFIG_SPL_BUILD
 762                 if (spl_image->flags & SPL_FIT_FOUND)
 763                         return 0;
 764 #endif
 765
 766                 WATCHDOG_RESET();
 767                 usb_gadget_handle_interrupts(controller_index);
 768
 769 #ifdef CONFIG_SPL_BUILD
 770                 sdp_handle_in_ep(spl_image);
 771 #else
 772                 sdp_handle_in_ep(NULL);
 773 #endif
 774         }
 775 }
 776
 777 int sdp_add(struct usb_configuration *c)
 778 {
 779         int id;
 780
 781         id = usb_string_id(c->cdev);
 782         if (id < 0)
 783                 return id;
 784         strings_sdp_generic[0].id = id;
 785         sdp_intf_runtime.iInterface = id;
 786
 787         debug("%s: cdev: %p gadget: %p gadget->ep0: %p\n", __func__,
 788               c->cdev, c->cdev->gadget, c->cdev->gadget->ep0);
 789
 790         return sdp_bind_config(c);
 791 }
 792
 793 DECLARE_GADGET_BIND_CALLBACK(usb_dnl_sdp, sdp_add);