1 // SPDX-License-Identifier: GPL-2.0+
3 * (C) Copyright 2008 - 2009
4 * Windriver, <www.windriver.com>
5 * Tom Rix <Tom.Rix@windriver.com>
7 * Copyright 2011 Sebastian Andrzej Siewior <bigeasy@linutronix.de>
9 * Copyright 2014 Linaro, Ltd.
10 * Rob Herring <robh@kernel.org>
20 #include <linux/printk.h>
21 #include <linux/usb/ch9.h>
22 #include <linux/usb/gadget.h>
23 #include <linux/usb/composite.h>
24 #include <linux/compiler.h>
27 #define FASTBOOT_INTERFACE_CLASS 0xff
28 #define FASTBOOT_INTERFACE_SUB_CLASS 0x42
29 #define FASTBOOT_INTERFACE_PROTOCOL 0x03
31 #define RX_ENDPOINT_MAXIMUM_PACKET_SIZE_2_0 (0x0200)
32 #define RX_ENDPOINT_MAXIMUM_PACKET_SIZE_1_1 (0x0040)
33 #define TX_ENDPOINT_MAXIMUM_PACKET_SIZE (0x0040)
35 #define EP_BUFFER_SIZE 4096
37 * EP_BUFFER_SIZE must always be an integral multiple of maxpacket size
38 * (64 or 512 or 1024), else we break on certain controllers like DWC3
39 * that expect bulk OUT requests to be divisible by maxpacket size.
43 struct usb_function usb_function
;
45 /* IN/OUT EP's and corresponding requests */
46 struct usb_ep
*in_ep
, *out_ep
;
47 struct usb_request
*in_req
, *out_req
;
50 static char fb_ext_prop_name
[] = "DeviceInterfaceGUID";
51 static char fb_ext_prop_data
[] = "{4866319A-F4D6-4374-93B9-DC2DEB361BA9}";
53 static struct usb_os_desc_ext_prop fb_ext_prop
= {
54 .type
= 1, /* NUL-terminated Unicode String (REG_SZ) */
55 .name
= fb_ext_prop_name
,
56 .data
= fb_ext_prop_data
,
59 /* 16 bytes of "Compatible ID" and "Subcompatible ID" */
60 static char fb_cid
[16] = {'W', 'I', 'N', 'U', 'S', 'B'};
61 static struct usb_os_desc fb_os_desc
= {
62 .ext_compat_id
= fb_cid
,
65 static struct usb_os_desc_table fb_os_desc_table
= {
66 .os_desc
= &fb_os_desc
,
69 static inline struct f_fastboot
*func_to_fastboot(struct usb_function
*f
)
71 return container_of(f
, struct f_fastboot
, usb_function
);
74 static struct f_fastboot
*fastboot_func
;
76 static struct usb_endpoint_descriptor fs_ep_in
= {
77 .bLength
= USB_DT_ENDPOINT_SIZE
,
78 .bDescriptorType
= USB_DT_ENDPOINT
,
79 .bEndpointAddress
= USB_DIR_IN
,
80 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
81 .wMaxPacketSize
= cpu_to_le16(64),
84 static struct usb_endpoint_descriptor fs_ep_out
= {
85 .bLength
= USB_DT_ENDPOINT_SIZE
,
86 .bDescriptorType
= USB_DT_ENDPOINT
,
87 .bEndpointAddress
= USB_DIR_OUT
,
88 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
89 .wMaxPacketSize
= cpu_to_le16(64),
92 static struct usb_endpoint_descriptor hs_ep_in
= {
93 .bLength
= USB_DT_ENDPOINT_SIZE
,
94 .bDescriptorType
= USB_DT_ENDPOINT
,
95 .bEndpointAddress
= USB_DIR_IN
,
96 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
97 .wMaxPacketSize
= cpu_to_le16(512),
100 static struct usb_endpoint_descriptor hs_ep_out
= {
101 .bLength
= USB_DT_ENDPOINT_SIZE
,
102 .bDescriptorType
= USB_DT_ENDPOINT
,
103 .bEndpointAddress
= USB_DIR_OUT
,
104 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
105 .wMaxPacketSize
= cpu_to_le16(512),
108 static struct usb_interface_descriptor interface_desc
= {
109 .bLength
= USB_DT_INTERFACE_SIZE
,
110 .bDescriptorType
= USB_DT_INTERFACE
,
111 .bInterfaceNumber
= 0x00,
112 .bAlternateSetting
= 0x00,
113 .bNumEndpoints
= 0x02,
114 .bInterfaceClass
= FASTBOOT_INTERFACE_CLASS
,
115 .bInterfaceSubClass
= FASTBOOT_INTERFACE_SUB_CLASS
,
116 .bInterfaceProtocol
= FASTBOOT_INTERFACE_PROTOCOL
,
119 static struct usb_descriptor_header
*fb_fs_function
[] = {
120 (struct usb_descriptor_header
*)&interface_desc
,
121 (struct usb_descriptor_header
*)&fs_ep_in
,
122 (struct usb_descriptor_header
*)&fs_ep_out
,
126 static struct usb_descriptor_header
*fb_hs_function
[] = {
127 (struct usb_descriptor_header
*)&interface_desc
,
128 (struct usb_descriptor_header
*)&hs_ep_in
,
129 (struct usb_descriptor_header
*)&hs_ep_out
,
134 static struct usb_endpoint_descriptor ss_ep_in
= {
135 .bLength
= USB_DT_ENDPOINT_SIZE
,
136 .bDescriptorType
= USB_DT_ENDPOINT
,
137 .bEndpointAddress
= USB_DIR_IN
,
138 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
139 .wMaxPacketSize
= cpu_to_le16(1024),
142 static struct usb_endpoint_descriptor ss_ep_out
= {
143 .bLength
= USB_DT_ENDPOINT_SIZE
,
144 .bDescriptorType
= USB_DT_ENDPOINT
,
145 .bEndpointAddress
= USB_DIR_OUT
,
146 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
147 .wMaxPacketSize
= cpu_to_le16(1024),
150 static struct usb_ss_ep_comp_descriptor fb_ss_bulk_comp_desc
= {
151 .bLength
= sizeof(fb_ss_bulk_comp_desc
),
152 .bDescriptorType
= USB_DT_SS_ENDPOINT_COMP
,
155 static struct usb_descriptor_header
*fb_ss_function
[] = {
156 (struct usb_descriptor_header
*)&interface_desc
,
157 (struct usb_descriptor_header
*)&ss_ep_in
,
158 (struct usb_descriptor_header
*)&fb_ss_bulk_comp_desc
,
159 (struct usb_descriptor_header
*)&ss_ep_out
,
160 (struct usb_descriptor_header
*)&fb_ss_bulk_comp_desc
,
164 static struct usb_endpoint_descriptor
*
165 fb_ep_desc(struct usb_gadget
*g
, struct usb_endpoint_descriptor
*fs
,
166 struct usb_endpoint_descriptor
*hs
,
167 struct usb_endpoint_descriptor
*ss
)
169 if (gadget_is_superspeed(g
) && g
->speed
>= USB_SPEED_SUPER
)
172 if (gadget_is_dualspeed(g
) && g
->speed
== USB_SPEED_HIGH
)
178 * static strings, in UTF-8
180 static const char fastboot_name
[] = "Android Fastboot";
182 static struct usb_string fastboot_string_defs
[] = {
183 [0].s
= fastboot_name
,
184 { } /* end of list */
187 static struct usb_gadget_strings stringtab_fastboot
= {
188 .language
= 0x0409, /* en-us */
189 .strings
= fastboot_string_defs
,
192 static struct usb_gadget_strings
*fastboot_strings
[] = {
197 static void rx_handler_command(struct usb_ep
*ep
, struct usb_request
*req
);
199 static void fastboot_complete(struct usb_ep
*ep
, struct usb_request
*req
)
201 int status
= req
->status
;
204 printf("status: %d ep '%s' trans: %d\n", status
, ep
->name
, req
->actual
);
207 static int fastboot_bind(struct usb_configuration
*c
, struct usb_function
*f
)
210 struct usb_gadget
*gadget
= c
->cdev
->gadget
;
211 struct f_fastboot
*f_fb
= func_to_fastboot(f
);
214 /* DYNAMIC interface numbers assignments */
215 id
= usb_interface_id(c
, f
);
218 interface_desc
.bInterfaceNumber
= id
;
220 /* Enable OS and Extended Properties Feature Descriptor */
221 c
->cdev
->use_os_string
= 1;
222 f
->os_desc_table
= &fb_os_desc_table
;
224 f
->os_desc_table
->if_id
= id
;
225 INIT_LIST_HEAD(&fb_os_desc
.ext_prop
);
226 fb_ext_prop
.name_len
= strlen(fb_ext_prop
.name
) * 2 + 2;
227 fb_os_desc
.ext_prop_len
= 10 + fb_ext_prop
.name_len
;
228 fb_os_desc
.ext_prop_count
= 1;
229 fb_ext_prop
.data_len
= strlen(fb_ext_prop
.data
) * 2 + 2;
230 fb_os_desc
.ext_prop_len
+= fb_ext_prop
.data_len
+ 4;
231 list_add_tail(&fb_ext_prop
.entry
, &fb_os_desc
.ext_prop
);
233 id
= usb_string_id(c
->cdev
);
236 fastboot_string_defs
[0].id
= id
;
237 interface_desc
.iInterface
= id
;
239 f_fb
->in_ep
= usb_ep_autoconfig(gadget
, &fs_ep_in
);
242 f_fb
->in_ep
->driver_data
= c
->cdev
;
244 f_fb
->out_ep
= usb_ep_autoconfig(gadget
, &fs_ep_out
);
247 f_fb
->out_ep
->driver_data
= c
->cdev
;
249 f
->descriptors
= fb_fs_function
;
251 if (gadget_is_dualspeed(gadget
)) {
252 /* Assume endpoint addresses are the same for both speeds */
253 hs_ep_in
.bEndpointAddress
= fs_ep_in
.bEndpointAddress
;
254 hs_ep_out
.bEndpointAddress
= fs_ep_out
.bEndpointAddress
;
255 /* copy HS descriptors */
256 f
->hs_descriptors
= fb_hs_function
;
259 if (gadget_is_superspeed(gadget
)) {
260 ss_ep_in
.bEndpointAddress
= fs_ep_in
.bEndpointAddress
;
261 ss_ep_out
.bEndpointAddress
= fs_ep_out
.bEndpointAddress
;
262 f
->ss_descriptors
= fb_ss_function
;
265 s
= env_get("serial#");
267 g_dnl_set_serialnumber((char *)s
);
272 static void fastboot_unbind(struct usb_configuration
*c
, struct usb_function
*f
)
274 f
->os_desc_table
= NULL
;
275 list_del(&fb_os_desc
.ext_prop
);
276 memset(fastboot_func
, 0, sizeof(*fastboot_func
));
279 static void fastboot_disable(struct usb_function
*f
)
281 struct f_fastboot
*f_fb
= func_to_fastboot(f
);
283 usb_ep_disable(f_fb
->out_ep
);
284 usb_ep_disable(f_fb
->in_ep
);
287 free(f_fb
->out_req
->buf
);
288 usb_ep_free_request(f_fb
->out_ep
, f_fb
->out_req
);
289 f_fb
->out_req
= NULL
;
292 free(f_fb
->in_req
->buf
);
293 usb_ep_free_request(f_fb
->in_ep
, f_fb
->in_req
);
298 static struct usb_request
*fastboot_start_ep(struct usb_ep
*ep
)
300 struct usb_request
*req
;
302 req
= usb_ep_alloc_request(ep
, 0);
306 req
->length
= EP_BUFFER_SIZE
;
307 req
->buf
= memalign(CONFIG_SYS_CACHELINE_SIZE
, EP_BUFFER_SIZE
);
309 usb_ep_free_request(ep
, req
);
313 memset(req
->buf
, 0, req
->length
);
317 static int fastboot_set_alt(struct usb_function
*f
,
318 unsigned interface
, unsigned alt
)
321 struct usb_composite_dev
*cdev
= f
->config
->cdev
;
322 struct usb_gadget
*gadget
= cdev
->gadget
;
323 struct f_fastboot
*f_fb
= func_to_fastboot(f
);
324 const struct usb_endpoint_descriptor
*d
;
326 debug("%s: func: %s intf: %d alt: %d\n",
327 __func__
, f
->name
, interface
, alt
);
329 d
= fb_ep_desc(gadget
, &fs_ep_out
, &hs_ep_out
, &ss_ep_out
);
330 ret
= usb_ep_enable(f_fb
->out_ep
, d
);
332 puts("failed to enable out ep\n");
336 f_fb
->out_req
= fastboot_start_ep(f_fb
->out_ep
);
337 if (!f_fb
->out_req
) {
338 puts("failed to alloc out req\n");
342 f_fb
->out_req
->complete
= rx_handler_command
;
344 d
= fb_ep_desc(gadget
, &fs_ep_in
, &hs_ep_in
, &ss_ep_in
);
345 ret
= usb_ep_enable(f_fb
->in_ep
, d
);
347 puts("failed to enable in ep\n");
351 f_fb
->in_req
= fastboot_start_ep(f_fb
->in_ep
);
353 puts("failed alloc req in\n");
357 f_fb
->in_req
->complete
= fastboot_complete
;
359 ret
= usb_ep_queue(f_fb
->out_ep
, f_fb
->out_req
, 0);
369 static int fastboot_add(struct usb_configuration
*c
)
371 struct f_fastboot
*f_fb
= fastboot_func
;
374 debug("%s: cdev: 0x%p\n", __func__
, c
->cdev
);
377 f_fb
= memalign(CONFIG_SYS_CACHELINE_SIZE
, sizeof(*f_fb
));
381 fastboot_func
= f_fb
;
382 memset(f_fb
, 0, sizeof(*f_fb
));
385 f_fb
->usb_function
.name
= "f_fastboot";
386 f_fb
->usb_function
.bind
= fastboot_bind
;
387 f_fb
->usb_function
.unbind
= fastboot_unbind
;
388 f_fb
->usb_function
.set_alt
= fastboot_set_alt
;
389 f_fb
->usb_function
.disable
= fastboot_disable
;
390 f_fb
->usb_function
.strings
= fastboot_strings
;
392 status
= usb_add_function(c
, &f_fb
->usb_function
);
395 fastboot_func
= NULL
;
400 DECLARE_GADGET_BIND_CALLBACK(usb_dnl_fastboot
, fastboot_add
);
402 static int fastboot_tx_write(const char *buffer
, unsigned int buffer_size
)
404 struct usb_request
*in_req
= fastboot_func
->in_req
;
407 memcpy(in_req
->buf
, buffer
, buffer_size
);
408 in_req
->length
= buffer_size
;
410 usb_ep_dequeue(fastboot_func
->in_ep
, in_req
);
412 ret
= usb_ep_queue(fastboot_func
->in_ep
, in_req
, 0);
414 printf("Error %d on queue\n", ret
);
418 static int fastboot_tx_write_str(const char *buffer
)
420 return fastboot_tx_write(buffer
, strlen(buffer
));
423 static void compl_do_reset(struct usb_ep
*ep
, struct usb_request
*req
)
426 do_reset(NULL
, 0, 0, NULL
);
429 static unsigned int rx_bytes_expected(struct usb_ep
*ep
)
431 int rx_remain
= fastboot_data_remaining();
433 unsigned int maxpacket
= usb_endpoint_maxp(ep
->desc
);
437 else if (rx_remain
> EP_BUFFER_SIZE
)
438 return EP_BUFFER_SIZE
;
441 * Some controllers e.g. DWC3 don't like OUT transfers to be
442 * not ending in maxpacket boundary. So just make them happy by
443 * always requesting for integral multiple of maxpackets.
444 * This shouldn't bother controllers that don't care about it.
446 rem
= rx_remain
% maxpacket
;
448 rx_remain
= rx_remain
+ (maxpacket
- rem
);
453 static void rx_handler_dl_image(struct usb_ep
*ep
, struct usb_request
*req
)
455 char response
[FASTBOOT_RESPONSE_LEN
] = {0};
456 unsigned int transfer_size
= fastboot_data_remaining();
457 const unsigned char *buffer
= req
->buf
;
458 unsigned int buffer_size
= req
->actual
;
460 if (req
->status
!= 0) {
461 printf("Bad status: %d\n", req
->status
);
465 if (buffer_size
< transfer_size
)
466 transfer_size
= buffer_size
;
468 fastboot_data_download(buffer
, transfer_size
, response
);
470 fastboot_tx_write_str(response
);
471 } else if (!fastboot_data_remaining()) {
472 fastboot_data_complete(response
);
475 * Reset global transfer variable
477 req
->complete
= rx_handler_command
;
478 req
->length
= EP_BUFFER_SIZE
;
480 fastboot_tx_write_str(response
);
482 req
->length
= rx_bytes_expected(ep
);
486 usb_ep_queue(ep
, req
, 0);
489 static void do_exit_on_complete(struct usb_ep
*ep
, struct usb_request
*req
)
491 g_dnl_trigger_detach();
494 static void do_bootm_on_complete(struct usb_ep
*ep
, struct usb_request
*req
)
497 do_exit_on_complete(ep
, req
);
500 static int multiresponse_cmd
= -1;
501 static void multiresponse_on_complete(struct usb_ep
*ep
, struct usb_request
*req
)
503 char response
[FASTBOOT_RESPONSE_LEN
] = {0};
505 if (multiresponse_cmd
== -1)
508 /* Call handler to obtain next response */
509 fastboot_multiresponse(multiresponse_cmd
, response
);
510 fastboot_tx_write_str(response
);
512 /* If response is final OKAY/FAIL response disconnect this handler and unset cmd */
513 if (!strncmp("OKAY", response
, 4) || !strncmp("FAIL", response
, 4)) {
514 multiresponse_cmd
= -1;
515 fastboot_func
->in_req
->complete
= fastboot_complete
;
519 static void do_acmd_complete(struct usb_ep
*ep
, struct usb_request
*req
)
521 /* When usb dequeue complete will be called
522 * Need status value before call run_command.
523 * otherwise, host can't get last message.
525 if (req
->status
== 0)
526 fastboot_acmd_complete();
529 static void rx_handler_command(struct usb_ep
*ep
, struct usb_request
*req
)
531 char *cmdbuf
= req
->buf
;
532 char response
[FASTBOOT_RESPONSE_LEN
] = {0};
535 if (req
->status
!= 0 || req
->length
== 0)
538 if (req
->actual
< req
->length
) {
539 cmdbuf
[req
->actual
] = '\0';
540 cmd
= fastboot_handle_command(cmdbuf
, response
);
542 pr_err("buffer overflow\n");
543 fastboot_fail("buffer overflow", response
);
546 if (!strncmp(FASTBOOT_MULTIRESPONSE_START
, response
, 4)) {
547 multiresponse_cmd
= cmd
;
548 fastboot_multiresponse(multiresponse_cmd
, response
);
550 /* Only add complete callback if first is not a final OKAY/FAIL response */
551 if (strncmp("OKAY", response
, 4) && strncmp("FAIL", response
, 4)) {
552 fastboot_func
->in_req
->complete
= multiresponse_on_complete
;
556 if (!strncmp("DATA", response
, 4)) {
557 req
->complete
= rx_handler_dl_image
;
558 req
->length
= rx_bytes_expected(ep
);
561 if (!strncmp("OKAY", response
, 4)) {
563 case FASTBOOT_COMMAND_BOOT
:
564 fastboot_func
->in_req
->complete
= do_bootm_on_complete
;
567 case FASTBOOT_COMMAND_CONTINUE
:
568 fastboot_func
->in_req
->complete
= do_exit_on_complete
;
571 case FASTBOOT_COMMAND_REBOOT
:
572 case FASTBOOT_COMMAND_REBOOT_BOOTLOADER
:
573 case FASTBOOT_COMMAND_REBOOT_FASTBOOTD
:
574 case FASTBOOT_COMMAND_REBOOT_RECOVERY
:
575 fastboot_func
->in_req
->complete
= compl_do_reset
;
577 case FASTBOOT_COMMAND_ACMD
:
578 if (CONFIG_IS_ENABLED(FASTBOOT_UUU_SUPPORT
))
579 fastboot_func
->in_req
->complete
= do_acmd_complete
;
584 fastboot_tx_write_str(response
);
588 usb_ep_queue(ep
, req
, 0);