1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * f_dfu.c -- Device Firmware Update USB function
4  *
5  * Copyright (C) 2012 Samsung Electronics
6  * authors: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
7  *          Lukasz Majewski <l.majewski@samsung.com>
8  *
9  * Based on OpenMoko u-boot: drivers/usb/usbdfu.c
10  * (C) 2007 by OpenMoko, Inc.
11  * Author: Harald Welte <laforge@openmoko.org>
12  *
13  * based on existing SAM7DFU code from OpenPCD:
14  * (C) Copyright 2006 by Harald Welte <hwelte at hmw-consulting.de>
15  */
16 
17 #include <env.h>
18 #include <errno.h>
19 #include <common.h>
20 #include <log.h>
21 #include <malloc.h>
22 
23 #include <linux/usb/ch9.h>
24 #include <linux/usb/gadget.h>
25 #include <linux/usb/composite.h>
26 
27 #include <dfu.h>
28 #include <g_dnl.h>
29 #include "f_dfu.h"
30 
31 struct f_dfu {
32 	struct usb_function		usb_function;
33 
34 	struct usb_descriptor_header	**function;
35 	struct usb_string		*strings;
36 
37 	/* when configured, we have one config */
38 	u8				config;
39 	u8				altsetting;
40 	enum dfu_state			dfu_state;
41 	unsigned int			dfu_status;
42 
43 	/* Send/received block number is handy for data integrity check */
44 	int                             blk_seq_num;
45 	unsigned int                    poll_timeout;
46 };
47 
48 struct dfu_entity *dfu_defer_flush;
49 
50 typedef int (*dfu_state_fn) (struct f_dfu *,
51 			     const struct usb_ctrlrequest *,
52 			     struct usb_gadget *,
53 			     struct usb_request *);
54 
func_to_dfu(struct usb_function * f)55 static inline struct f_dfu *func_to_dfu(struct usb_function *f)
56 {
57 	return container_of(f, struct f_dfu, usb_function);
58 }
59 
60 static const struct dfu_function_descriptor dfu_func = {
61 	.bLength =		sizeof dfu_func,
62 	.bDescriptorType =	DFU_DT_FUNC,
63 	.bmAttributes =		DFU_BIT_WILL_DETACH |
64 				DFU_BIT_MANIFESTATION_TOLERANT |
65 				DFU_BIT_CAN_UPLOAD |
66 				DFU_BIT_CAN_DNLOAD,
67 	.wDetachTimeOut =	0,
68 	.wTransferSize =	DFU_USB_BUFSIZ,
69 	.bcdDFUVersion =	__constant_cpu_to_le16(0x0110),
70 };
71 
72 static struct usb_interface_descriptor dfu_intf_runtime = {
73 	.bLength =		sizeof dfu_intf_runtime,
74 	.bDescriptorType =	USB_DT_INTERFACE,
75 	.bNumEndpoints =	0,
76 	.bInterfaceClass =	USB_CLASS_APP_SPEC,
77 	.bInterfaceSubClass =	1,
78 	.bInterfaceProtocol =	1,
79 	/* .iInterface = DYNAMIC */
80 };
81 
82 static struct usb_descriptor_header *dfu_runtime_descs[] = {
83 	(struct usb_descriptor_header *) &dfu_intf_runtime,
84 	NULL,
85 };
86 
87 static const char dfu_name[] = "Device Firmware Upgrade";
88 
89 /*
90  * static strings, in UTF-8
91  *
92  * dfu_generic configuration
93  */
94 static struct usb_string strings_dfu_generic[] = {
95 	[0].s = dfu_name,
96 	{  }			/* end of list */
97 };
98 
99 static struct usb_gadget_strings stringtab_dfu_generic = {
100 	.language	= 0x0409,	/* en-us */
101 	.strings	= strings_dfu_generic,
102 };
103 
104 static struct usb_gadget_strings *dfu_generic_strings[] = {
105 	&stringtab_dfu_generic,
106 	NULL,
107 };
108 
109 /*
110  * usb_function specific
111  */
112 static struct usb_gadget_strings stringtab_dfu = {
113 	.language	= 0x0409,	/* en-us */
114 	/*
115 	 * .strings
116 	 *
117 	 * assigned during initialization,
118 	 * depends on number of flash entities
119 	 *
120 	 */
121 };
122 
123 static struct usb_gadget_strings *dfu_strings[] = {
124 	&stringtab_dfu,
125 	NULL,
126 };
127 
dfu_set_poll_timeout(struct dfu_status * dstat,unsigned int ms)128 static void dfu_set_poll_timeout(struct dfu_status *dstat, unsigned int ms)
129 {
130 	/*
131 	 * The bwPollTimeout DFU_GETSTATUS request payload provides information
132 	 * about minimum time, in milliseconds, that the host should wait before
133 	 * sending a subsequent DFU_GETSTATUS request
134 	 *
135 	 * This permits the device to vary the delay depending on its need to
136 	 * erase or program the memory
137 	 *
138 	 */
139 
140 	unsigned char *p = (unsigned char *)&ms;
141 
142 	if (!ms || (ms & ~DFU_POLL_TIMEOUT_MASK)) {
143 		dstat->bwPollTimeout[0] = 0;
144 		dstat->bwPollTimeout[1] = 0;
145 		dstat->bwPollTimeout[2] = 0;
146 
147 		return;
148 	}
149 
150 	dstat->bwPollTimeout[0] = *p++;
151 	dstat->bwPollTimeout[1] = *p++;
152 	dstat->bwPollTimeout[2] = *p;
153 }
154 
155 /*-------------------------------------------------------------------------*/
156 
dnload_request_complete(struct usb_ep * ep,struct usb_request * req)157 static void dnload_request_complete(struct usb_ep *ep, struct usb_request *req)
158 {
159 	struct f_dfu *f_dfu = req->context;
160 	int ret;
161 
162 	ret = dfu_write(dfu_get_entity(f_dfu->altsetting), req->buf,
163 			req->actual, f_dfu->blk_seq_num);
164 	if (ret) {
165 		f_dfu->dfu_status = DFU_STATUS_errUNKNOWN;
166 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
167 	}
168 }
169 
dnload_request_flush(struct usb_ep * ep,struct usb_request * req)170 static void dnload_request_flush(struct usb_ep *ep, struct usb_request *req)
171 {
172 	struct f_dfu *f_dfu = req->context;
173 	dfu_set_defer_flush(dfu_get_entity(f_dfu->altsetting));
174 }
175 
dfu_get_manifest_timeout(struct dfu_entity * dfu)176 static inline int dfu_get_manifest_timeout(struct dfu_entity *dfu)
177 {
178 	return dfu->poll_timeout ? dfu->poll_timeout(dfu) :
179 		DFU_MANIFEST_POLL_TIMEOUT;
180 }
181 
handle_getstatus(struct usb_request * req)182 static int handle_getstatus(struct usb_request *req)
183 {
184 	struct dfu_status *dstat = (struct dfu_status *)req->buf;
185 	struct f_dfu *f_dfu = req->context;
186 	struct dfu_entity *dfu = dfu_get_entity(f_dfu->altsetting);
187 
188 	dfu_set_poll_timeout(dstat, 0);
189 
190 	switch (f_dfu->dfu_state) {
191 	case DFU_STATE_dfuDNLOAD_SYNC:
192 	case DFU_STATE_dfuDNBUSY:
193 		f_dfu->dfu_state = DFU_STATE_dfuDNLOAD_IDLE;
194 		break;
195 	case DFU_STATE_dfuMANIFEST_SYNC:
196 		f_dfu->dfu_state = DFU_STATE_dfuMANIFEST;
197 		break;
198 	case DFU_STATE_dfuMANIFEST:
199 		dfu_set_poll_timeout(dstat, dfu_get_manifest_timeout(dfu));
200 		break;
201 	default:
202 		break;
203 	}
204 
205 	if (f_dfu->poll_timeout)
206 		if (!(f_dfu->blk_seq_num %
207 		      (dfu_get_buf_size() / DFU_USB_BUFSIZ)))
208 			dfu_set_poll_timeout(dstat, f_dfu->poll_timeout);
209 
210 	/* send status response */
211 	dstat->bStatus = f_dfu->dfu_status;
212 	dstat->bState = f_dfu->dfu_state;
213 	dstat->iString = 0;
214 
215 	return sizeof(struct dfu_status);
216 }
217 
handle_getstate(struct usb_request * req)218 static int handle_getstate(struct usb_request *req)
219 {
220 	struct f_dfu *f_dfu = req->context;
221 
222 	((u8 *)req->buf)[0] = f_dfu->dfu_state;
223 	return sizeof(u8);
224 }
225 
to_dfu_mode(struct f_dfu * f_dfu)226 static inline void to_dfu_mode(struct f_dfu *f_dfu)
227 {
228 	f_dfu->usb_function.strings = dfu_strings;
229 	f_dfu->usb_function.hs_descriptors = f_dfu->function;
230 	f_dfu->usb_function.descriptors = f_dfu->function;
231 	f_dfu->dfu_state = DFU_STATE_dfuIDLE;
232 }
233 
to_runtime_mode(struct f_dfu * f_dfu)234 static inline void to_runtime_mode(struct f_dfu *f_dfu)
235 {
236 	f_dfu->usb_function.strings = NULL;
237 	f_dfu->usb_function.hs_descriptors = dfu_runtime_descs;
238 	f_dfu->usb_function.descriptors = dfu_runtime_descs;
239 }
240 
handle_upload(struct usb_request * req,u16 len)241 static int handle_upload(struct usb_request *req, u16 len)
242 {
243 	struct f_dfu *f_dfu = req->context;
244 
245 	return dfu_read(dfu_get_entity(f_dfu->altsetting), req->buf,
246 			req->length, f_dfu->blk_seq_num);
247 }
248 
handle_dnload(struct usb_gadget * gadget,u16 len)249 static int handle_dnload(struct usb_gadget *gadget, u16 len)
250 {
251 	struct usb_composite_dev *cdev = get_gadget_data(gadget);
252 	struct usb_request *req = cdev->req;
253 	struct f_dfu *f_dfu = req->context;
254 
255 	if (len == 0)
256 		f_dfu->dfu_state = DFU_STATE_dfuMANIFEST_SYNC;
257 
258 	req->complete = dnload_request_complete;
259 
260 	return len;
261 }
262 
263 /*-------------------------------------------------------------------------*/
264 /* DFU state machine  */
state_app_idle(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)265 static int state_app_idle(struct f_dfu *f_dfu,
266 			  const struct usb_ctrlrequest *ctrl,
267 			  struct usb_gadget *gadget,
268 			  struct usb_request *req)
269 {
270 	int value = 0;
271 
272 	switch (ctrl->bRequest) {
273 	case USB_REQ_DFU_GETSTATUS:
274 		value = handle_getstatus(req);
275 		break;
276 	case USB_REQ_DFU_GETSTATE:
277 		value = handle_getstate(req);
278 		break;
279 	case USB_REQ_DFU_DETACH:
280 		f_dfu->dfu_state = DFU_STATE_appDETACH;
281 		to_dfu_mode(f_dfu);
282 		value = RET_ZLP;
283 		break;
284 	default:
285 		value = RET_STALL;
286 		break;
287 	}
288 
289 	return value;
290 }
291 
state_app_detach(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)292 static int state_app_detach(struct f_dfu *f_dfu,
293 			    const struct usb_ctrlrequest *ctrl,
294 			    struct usb_gadget *gadget,
295 			    struct usb_request *req)
296 {
297 	int value = 0;
298 
299 	switch (ctrl->bRequest) {
300 	case USB_REQ_DFU_GETSTATUS:
301 		value = handle_getstatus(req);
302 		break;
303 	case USB_REQ_DFU_GETSTATE:
304 		value = handle_getstate(req);
305 		break;
306 	default:
307 		f_dfu->dfu_state = DFU_STATE_appIDLE;
308 		value = RET_STALL;
309 		break;
310 	}
311 
312 	return value;
313 }
314 
state_dfu_idle(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)315 static int state_dfu_idle(struct f_dfu *f_dfu,
316 			  const struct usb_ctrlrequest *ctrl,
317 			  struct usb_gadget *gadget,
318 			  struct usb_request *req)
319 {
320 	u16 w_value = le16_to_cpu(ctrl->wValue);
321 	u16 len = le16_to_cpu(ctrl->wLength);
322 	int value = 0;
323 
324 	switch (ctrl->bRequest) {
325 	case USB_REQ_DFU_DNLOAD:
326 		if (len == 0) {
327 			f_dfu->dfu_state = DFU_STATE_dfuERROR;
328 			value = RET_STALL;
329 			break;
330 		}
331 		f_dfu->dfu_state = DFU_STATE_dfuDNLOAD_SYNC;
332 		f_dfu->blk_seq_num = w_value;
333 		value = handle_dnload(gadget, len);
334 		break;
335 	case USB_REQ_DFU_UPLOAD:
336 		f_dfu->dfu_state = DFU_STATE_dfuUPLOAD_IDLE;
337 		f_dfu->blk_seq_num = 0;
338 		value = handle_upload(req, len);
339 		break;
340 	case USB_REQ_DFU_ABORT:
341 		/* no zlp? */
342 		value = RET_ZLP;
343 		break;
344 	case USB_REQ_DFU_GETSTATUS:
345 		value = handle_getstatus(req);
346 		break;
347 	case USB_REQ_DFU_GETSTATE:
348 		value = handle_getstate(req);
349 		break;
350 	case USB_REQ_DFU_DETACH:
351 		/*
352 		 * Proprietary extension: 'detach' from idle mode and
353 		 * get back to runtime mode in case of USB Reset.  As
354 		 * much as I dislike this, we just can't use every USB
355 		 * bus reset to switch back to runtime mode, since at
356 		 * least the Linux USB stack likes to send a number of
357 		 * resets in a row :(
358 		 */
359 		f_dfu->dfu_state =
360 			DFU_STATE_dfuMANIFEST_WAIT_RST;
361 		to_runtime_mode(f_dfu);
362 		f_dfu->dfu_state = DFU_STATE_appIDLE;
363 
364 		g_dnl_trigger_detach();
365 		break;
366 	default:
367 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
368 		value = RET_STALL;
369 		break;
370 	}
371 
372 	return value;
373 }
374 
state_dfu_dnload_sync(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)375 static int state_dfu_dnload_sync(struct f_dfu *f_dfu,
376 				 const struct usb_ctrlrequest *ctrl,
377 				 struct usb_gadget *gadget,
378 				 struct usb_request *req)
379 {
380 	int value = 0;
381 
382 	switch (ctrl->bRequest) {
383 	case USB_REQ_DFU_GETSTATUS:
384 		value = handle_getstatus(req);
385 		break;
386 	case USB_REQ_DFU_GETSTATE:
387 		value = handle_getstate(req);
388 		break;
389 	default:
390 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
391 		value = RET_STALL;
392 		break;
393 	}
394 
395 	return value;
396 }
397 
state_dfu_dnbusy(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)398 static int state_dfu_dnbusy(struct f_dfu *f_dfu,
399 			    const struct usb_ctrlrequest *ctrl,
400 			    struct usb_gadget *gadget,
401 			    struct usb_request *req)
402 {
403 	int value = 0;
404 
405 	switch (ctrl->bRequest) {
406 	case USB_REQ_DFU_GETSTATUS:
407 		value = handle_getstatus(req);
408 		break;
409 	default:
410 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
411 		value = RET_STALL;
412 		break;
413 	}
414 
415 	return value;
416 }
417 
state_dfu_dnload_idle(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)418 static int state_dfu_dnload_idle(struct f_dfu *f_dfu,
419 				 const struct usb_ctrlrequest *ctrl,
420 				 struct usb_gadget *gadget,
421 				 struct usb_request *req)
422 {
423 	u16 w_value = le16_to_cpu(ctrl->wValue);
424 	u16 len = le16_to_cpu(ctrl->wLength);
425 	int value = 0;
426 
427 	switch (ctrl->bRequest) {
428 	case USB_REQ_DFU_DNLOAD:
429 		f_dfu->dfu_state = DFU_STATE_dfuDNLOAD_SYNC;
430 		f_dfu->blk_seq_num = w_value;
431 		value = handle_dnload(gadget, len);
432 		break;
433 	case USB_REQ_DFU_ABORT:
434 		f_dfu->dfu_state = DFU_STATE_dfuIDLE;
435 		value = RET_ZLP;
436 		break;
437 	case USB_REQ_DFU_GETSTATUS:
438 		value = handle_getstatus(req);
439 		break;
440 	case USB_REQ_DFU_GETSTATE:
441 		value = handle_getstate(req);
442 		break;
443 	default:
444 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
445 		value = RET_STALL;
446 		break;
447 	}
448 
449 	return value;
450 }
451 
state_dfu_manifest_sync(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)452 static int state_dfu_manifest_sync(struct f_dfu *f_dfu,
453 				   const struct usb_ctrlrequest *ctrl,
454 				   struct usb_gadget *gadget,
455 				   struct usb_request *req)
456 {
457 	int value = 0;
458 
459 	switch (ctrl->bRequest) {
460 	case USB_REQ_DFU_GETSTATUS:
461 		/* We're MainfestationTolerant */
462 		f_dfu->dfu_state = DFU_STATE_dfuMANIFEST;
463 		value = handle_getstatus(req);
464 		f_dfu->blk_seq_num = 0;
465 		req->complete = dnload_request_flush;
466 		break;
467 	case USB_REQ_DFU_GETSTATE:
468 		value = handle_getstate(req);
469 		break;
470 	default:
471 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
472 		value = RET_STALL;
473 		break;
474 	}
475 
476 	return value;
477 }
478 
state_dfu_manifest(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)479 static int state_dfu_manifest(struct f_dfu *f_dfu,
480 			      const struct usb_ctrlrequest *ctrl,
481 			      struct usb_gadget *gadget,
482 			      struct usb_request *req)
483 {
484 	int value = 0;
485 
486 	switch (ctrl->bRequest) {
487 	case USB_REQ_DFU_GETSTATUS:
488 		/* We're MainfestationTolerant */
489 		f_dfu->dfu_state = DFU_STATE_dfuIDLE;
490 		value = handle_getstatus(req);
491 		f_dfu->blk_seq_num = 0;
492 		puts("DOWNLOAD ... OK\nCtrl+C to exit ...\n");
493 		break;
494 	case USB_REQ_DFU_GETSTATE:
495 		value = handle_getstate(req);
496 		break;
497 	default:
498 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
499 		value = RET_STALL;
500 		break;
501 	}
502 	return value;
503 }
504 
state_dfu_upload_idle(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)505 static int state_dfu_upload_idle(struct f_dfu *f_dfu,
506 				 const struct usb_ctrlrequest *ctrl,
507 				 struct usb_gadget *gadget,
508 				 struct usb_request *req)
509 {
510 	u16 w_value = le16_to_cpu(ctrl->wValue);
511 	u16 len = le16_to_cpu(ctrl->wLength);
512 	int value = 0;
513 
514 	switch (ctrl->bRequest) {
515 	case USB_REQ_DFU_UPLOAD:
516 		/* state transition if less data then requested */
517 		f_dfu->blk_seq_num = w_value;
518 		value = handle_upload(req, len);
519 		if (value >= 0 && value < len)
520 			f_dfu->dfu_state = DFU_STATE_dfuIDLE;
521 		break;
522 	case USB_REQ_DFU_ABORT:
523 		f_dfu->dfu_state = DFU_STATE_dfuIDLE;
524 		/* no zlp? */
525 		value = RET_ZLP;
526 		break;
527 	case USB_REQ_DFU_GETSTATUS:
528 		value = handle_getstatus(req);
529 		break;
530 	case USB_REQ_DFU_GETSTATE:
531 		value = handle_getstate(req);
532 		break;
533 	default:
534 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
535 		value = RET_STALL;
536 		break;
537 	}
538 
539 	return value;
540 }
541 
state_dfu_error(struct f_dfu * f_dfu,const struct usb_ctrlrequest * ctrl,struct usb_gadget * gadget,struct usb_request * req)542 static int state_dfu_error(struct f_dfu *f_dfu,
543 				 const struct usb_ctrlrequest *ctrl,
544 				 struct usb_gadget *gadget,
545 				 struct usb_request *req)
546 {
547 	int value = 0;
548 
549 	switch (ctrl->bRequest) {
550 	case USB_REQ_DFU_GETSTATUS:
551 		value = handle_getstatus(req);
552 		break;
553 	case USB_REQ_DFU_GETSTATE:
554 		value = handle_getstate(req);
555 		break;
556 	case USB_REQ_DFU_CLRSTATUS:
557 		f_dfu->dfu_state = DFU_STATE_dfuIDLE;
558 		f_dfu->dfu_status = DFU_STATUS_OK;
559 		/* no zlp? */
560 		value = RET_ZLP;
561 		break;
562 	default:
563 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
564 		value = RET_STALL;
565 		break;
566 	}
567 
568 	return value;
569 }
570 
571 static dfu_state_fn dfu_state[] = {
572 	state_app_idle,          /* DFU_STATE_appIDLE */
573 	state_app_detach,        /* DFU_STATE_appDETACH */
574 	state_dfu_idle,          /* DFU_STATE_dfuIDLE */
575 	state_dfu_dnload_sync,   /* DFU_STATE_dfuDNLOAD_SYNC */
576 	state_dfu_dnbusy,        /* DFU_STATE_dfuDNBUSY */
577 	state_dfu_dnload_idle,   /* DFU_STATE_dfuDNLOAD_IDLE */
578 	state_dfu_manifest_sync, /* DFU_STATE_dfuMANIFEST_SYNC */
579 	state_dfu_manifest,	 /* DFU_STATE_dfuMANIFEST */
580 	NULL,                    /* DFU_STATE_dfuMANIFEST_WAIT_RST */
581 	state_dfu_upload_idle,   /* DFU_STATE_dfuUPLOAD_IDLE */
582 	state_dfu_error          /* DFU_STATE_dfuERROR */
583 };
584 
585 static int
dfu_handle(struct usb_function * f,const struct usb_ctrlrequest * ctrl)586 dfu_handle(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
587 {
588 	struct usb_gadget *gadget = f->config->cdev->gadget;
589 	struct usb_request *req = f->config->cdev->req;
590 	struct f_dfu *f_dfu = f->config->cdev->req->context;
591 	u16 len = le16_to_cpu(ctrl->wLength);
592 	u16 w_value = le16_to_cpu(ctrl->wValue);
593 	int value = 0;
594 	u8 req_type = ctrl->bRequestType & USB_TYPE_MASK;
595 
596 	debug("w_value: 0x%x len: 0x%x\n", w_value, len);
597 	debug("req_type: 0x%x ctrl->bRequest: 0x%x f_dfu->dfu_state: 0x%x\n",
598 	       req_type, ctrl->bRequest, f_dfu->dfu_state);
599 
600 #ifdef CONFIG_DFU_TIMEOUT
601 	/* Forbid aborting by timeout. Next dfu command may update this */
602 	dfu_set_timeout(0);
603 #endif
604 
605 	if (req_type == USB_TYPE_STANDARD) {
606 		if (ctrl->bRequest == USB_REQ_GET_DESCRIPTOR &&
607 		    (w_value >> 8) == DFU_DT_FUNC) {
608 			value = min(len, (u16) sizeof(dfu_func));
609 			memcpy(req->buf, &dfu_func, value);
610 		}
611 	} else /* DFU specific request */
612 		value = dfu_state[f_dfu->dfu_state] (f_dfu, ctrl, gadget, req);
613 
614 	if (value >= 0) {
615 		req->length = value;
616 		req->zero = value < len;
617 		value = usb_ep_queue(gadget->ep0, req, 0);
618 		if (value < 0) {
619 			debug("ep_queue --> %d\n", value);
620 			req->status = 0;
621 		}
622 	}
623 
624 	return value;
625 }
626 
627 /*-------------------------------------------------------------------------*/
628 
629 static int
dfu_prepare_strings(struct f_dfu * f_dfu,int n)630 dfu_prepare_strings(struct f_dfu *f_dfu, int n)
631 {
632 	struct dfu_entity *de = NULL;
633 	int i = 0;
634 
635 	f_dfu->strings = calloc(sizeof(struct usb_string), n + 1);
636 	if (!f_dfu->strings)
637 		return -ENOMEM;
638 
639 	for (i = 0; i < n; ++i) {
640 		de = dfu_get_entity(i);
641 		f_dfu->strings[i].s = de->name;
642 	}
643 
644 	f_dfu->strings[i].id = 0;
645 	f_dfu->strings[i].s = NULL;
646 
647 	return 0;
648 }
649 
dfu_prepare_function(struct f_dfu * f_dfu,int n)650 static int dfu_prepare_function(struct f_dfu *f_dfu, int n)
651 {
652 	struct usb_interface_descriptor *d;
653 	int i = 0;
654 
655 	f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n + 2);
656 	if (!f_dfu->function)
657 		goto enomem;
658 
659 	for (i = 0; i < n; ++i) {
660 		d = calloc(sizeof(*d), 1);
661 		if (!d)
662 			goto enomem;
663 
664 		d->bLength =		sizeof(*d);
665 		d->bDescriptorType =	USB_DT_INTERFACE;
666 		d->bAlternateSetting =	i;
667 		d->bNumEndpoints =	0;
668 		d->bInterfaceClass =	USB_CLASS_APP_SPEC;
669 		d->bInterfaceSubClass =	1;
670 		d->bInterfaceProtocol =	2;
671 
672 		f_dfu->function[i] = (struct usb_descriptor_header *)d;
673 	}
674 
675 	/* add DFU Functional Descriptor */
676 	f_dfu->function[i] = calloc(sizeof(dfu_func), 1);
677 	if (!f_dfu->function[i])
678 		goto enomem;
679 	memcpy(f_dfu->function[i], &dfu_func, sizeof(dfu_func));
680 
681 	i++;
682 	f_dfu->function[i] = NULL;
683 
684 	return 0;
685 
686 enomem:
687 	while (i) {
688 		free(f_dfu->function[--i]);
689 		f_dfu->function[i] = NULL;
690 	}
691 	free(f_dfu->function);
692 
693 	return -ENOMEM;
694 }
695 
dfu_bind(struct usb_configuration * c,struct usb_function * f)696 static int dfu_bind(struct usb_configuration *c, struct usb_function *f)
697 {
698 	struct usb_composite_dev *cdev = c->cdev;
699 	struct f_dfu *f_dfu = func_to_dfu(f);
700 	const char *s;
701 	int alt_num = dfu_get_alt_number();
702 	int rv, id, i;
703 
704 	id = usb_interface_id(c, f);
705 	if (id < 0)
706 		return id;
707 	dfu_intf_runtime.bInterfaceNumber = id;
708 
709 	f_dfu->dfu_state = DFU_STATE_appIDLE;
710 	f_dfu->dfu_status = DFU_STATUS_OK;
711 
712 	rv = dfu_prepare_function(f_dfu, alt_num);
713 	if (rv)
714 		goto error;
715 
716 	rv = dfu_prepare_strings(f_dfu, alt_num);
717 	if (rv)
718 		goto error;
719 	for (i = 0; i < alt_num; i++) {
720 		id = usb_string_id(cdev);
721 		if (id < 0)
722 			return id;
723 		f_dfu->strings[i].id = id;
724 		((struct usb_interface_descriptor *)f_dfu->function[i])
725 			->iInterface = id;
726 	}
727 
728 	to_dfu_mode(f_dfu);
729 
730 	stringtab_dfu.strings = f_dfu->strings;
731 
732 	cdev->req->context = f_dfu;
733 
734 	s = env_get("serial#");
735 	if (s)
736 		g_dnl_set_serialnumber((char *)s);
737 
738 error:
739 	return rv;
740 }
741 
dfu_unbind(struct usb_configuration * c,struct usb_function * f)742 static void dfu_unbind(struct usb_configuration *c, struct usb_function *f)
743 {
744 	struct f_dfu *f_dfu = func_to_dfu(f);
745 	int alt_num = dfu_get_alt_number();
746 	int i;
747 
748 	if (f_dfu->strings) {
749 		i = alt_num;
750 		while (i)
751 			f_dfu->strings[--i].s = NULL;
752 
753 		free(f_dfu->strings);
754 	}
755 
756 	if (f_dfu->function) {
757 		i = alt_num;
758 		i++; /* free DFU Functional Descriptor */
759 		while (i) {
760 			free(f_dfu->function[--i]);
761 			f_dfu->function[i] = NULL;
762 		}
763 		free(f_dfu->function);
764 	}
765 
766 	free(f_dfu);
767 }
768 
dfu_set_alt(struct usb_function * f,unsigned intf,unsigned alt)769 static int dfu_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
770 {
771 	struct f_dfu *f_dfu = func_to_dfu(f);
772 
773 	debug("%s: intf:%d alt:%d\n", __func__, intf, alt);
774 
775 	f_dfu->altsetting = alt;
776 	f_dfu->dfu_state = DFU_STATE_dfuIDLE;
777 	f_dfu->dfu_status = DFU_STATUS_OK;
778 
779 	return 0;
780 }
781 
__dfu_get_alt(struct usb_function * f,unsigned intf)782 static int __dfu_get_alt(struct usb_function *f, unsigned intf)
783 {
784 	struct f_dfu *f_dfu = func_to_dfu(f);
785 
786 	return f_dfu->altsetting;
787 }
788 
789 /* TODO: is this really what we need here? */
dfu_disable(struct usb_function * f)790 static void dfu_disable(struct usb_function *f)
791 {
792 	struct f_dfu *f_dfu = func_to_dfu(f);
793 	if (f_dfu->config == 0)
794 		return;
795 
796 	debug("%s: reset config\n", __func__);
797 
798 	f_dfu->config = 0;
799 }
800 
dfu_bind_config(struct usb_configuration * c)801 static int dfu_bind_config(struct usb_configuration *c)
802 {
803 	struct f_dfu *f_dfu;
804 	int status;
805 
806 	f_dfu = calloc(sizeof(*f_dfu), 1);
807 	if (!f_dfu)
808 		return -ENOMEM;
809 	f_dfu->usb_function.name = "dfu";
810 	f_dfu->usb_function.hs_descriptors = dfu_runtime_descs;
811 	f_dfu->usb_function.descriptors = dfu_runtime_descs;
812 	f_dfu->usb_function.bind = dfu_bind;
813 	f_dfu->usb_function.unbind = dfu_unbind;
814 	f_dfu->usb_function.set_alt = dfu_set_alt;
815 	f_dfu->usb_function.get_alt = __dfu_get_alt;
816 	f_dfu->usb_function.disable = dfu_disable;
817 	f_dfu->usb_function.strings = dfu_generic_strings;
818 	f_dfu->usb_function.setup = dfu_handle;
819 	f_dfu->poll_timeout = DFU_DEFAULT_POLL_TIMEOUT;
820 
821 	status = usb_add_function(c, &f_dfu->usb_function);
822 	if (status)
823 		free(f_dfu);
824 
825 	return status;
826 }
827 
dfu_add(struct usb_configuration * c)828 int dfu_add(struct usb_configuration *c)
829 {
830 	int id;
831 
832 	id = usb_string_id(c->cdev);
833 	if (id < 0)
834 		return id;
835 	strings_dfu_generic[0].id = id;
836 	dfu_intf_runtime.iInterface = id;
837 
838 	debug("%s: cdev: 0x%p gadget:0x%p gadget->ep0: 0x%p\n", __func__,
839 	       c->cdev, c->cdev->gadget, c->cdev->gadget->ep0);
840 
841 	return dfu_bind_config(c);
842 }
843 
844 DECLARE_GADGET_BIND_CALLBACK(usb_dnl_dfu, dfu_add);
845