1 // SPDX-License-Identifier: GPL-2.0+
3 * Chromium OS cros_ec driver - sandbox emulation
5 * Copyright (c) 2013 The Chromium OS Authors.
8 #define LOG_CATEGORY UCLASS_CROS_EC
13 #include <ec_commands.h>
18 #include <u-boot/sha256.h>
20 #include <asm/malloc.h>
21 #include <asm/state.h>
24 #include <linux/input.h>
27 * Ultimately it shold be possible to connect an Chrome OS EC emulation
28 * to U-Boot and remove all of this code. But this provides a test
29 * environment for bringing up chromeos_sandbox and demonstrating its
32 * This emulation includes the following:
34 * 1. Emulation of the keyboard, by converting keypresses received from SDL
35 * into key scan data, passed back from the EC as key scan messages. The
36 * key layout is read from the device tree.
38 * 2. Emulation of vboot context - so this can be read/written as required.
40 * 3. Save/restore of EC state, so that the vboot context, flash memory
41 * contents and current image can be preserved across boots. This is important
42 * since the EC is supposed to continue running even if the AP resets.
44 * 4. Some event support, in particular allowing Escape to be pressed on boot
45 * to enter recovery mode. The EC passes this to U-Boot through the normal
48 * 5. Flash read/write/erase support, so that software sync works. The
49 * protect messages are supported but no protection is implemented.
51 * 6. Hashing of the EC image, again to support software sync.
53 * Other features can be added, although a better path is probably to link
54 * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
57 #define KEYBOARD_ROWS 8
58 #define KEYBOARD_COLS 13
60 /* A single entry of the key matrix */
61 struct ec_keymatrix_entry {
62 int row; /* key matrix row */
63 int col; /* key matrix column */
64 int keycode; /* corresponding linux key code */
68 VSTORE_SLOT_COUNT = 4,
69 PWM_CHANNEL_COUNT = 4,
74 u8 data[EC_VSTORE_SLOT_SIZE];
77 struct ec_pwm_channel {
78 uint duty; /* not ns, EC_PWM_MAX_DUTY = 100% */
82 * struct ec_state - Information about the EC state
84 * @vbnv_context: Vboot context data stored by EC
85 * @ec_config: FDT config information about the EC (e.g. flashmap)
86 * @flash_data: Contents of flash memory
87 * @flash_data_len: Size of flash memory
88 * @current_image: Current image the EC is running
89 * @matrix_count: Number of keys to decode in matrix
90 * @matrix: Information about keyboard matrix
91 * @keyscan: Current keyscan information (bit set for each row/column pressed)
92 * @recovery_req: Keyboard recovery requested
93 * @test_flags: Flags that control behaviour for tests
94 * @slot_locked: Locked vstore slots (mask)
95 * @pwm: Information per PWM channel
98 u8 vbnv_context[EC_VBNV_BLOCK_SIZE_V2];
99 struct fdt_cros_ec ec_config;
102 enum ec_current_image current_image;
104 struct ec_keymatrix_entry *matrix; /* the key matrix info */
105 uint8_t keyscan[KEYBOARD_COLS];
108 struct vstore_slot slot[VSTORE_SLOT_COUNT];
109 struct ec_pwm_channel pwm[PWM_CHANNEL_COUNT];
113 * cros_ec_read_state() - read the sandbox EC state from the state file
115 * If data is available, then blob and node will provide access to it. If
116 * not this function sets up an empty EC.
118 * @param blob: Pointer to device tree blob, or NULL if no data to read
119 * @param node: Node offset to read from
121 static int cros_ec_read_state(const void *blob, int node)
123 struct ec_state *ec = &s_state;
127 /* Set everything to defaults */
128 ec->current_image = EC_IMAGE_RO;
132 /* Read the data if available */
133 ec->current_image = fdtdec_get_int(blob, node, "current-image",
135 prop = fdt_getprop(blob, node, "vbnv-context", &len);
136 if (prop && len == sizeof(ec->vbnv_context))
137 memcpy(ec->vbnv_context, prop, len);
139 prop = fdt_getprop(blob, node, "flash-data", &len);
141 ec->flash_data_len = len;
142 ec->flash_data = malloc(len);
145 memcpy(ec->flash_data, prop, len);
146 debug("%s: Loaded EC flash data size %#x\n", __func__, len);
153 * cros_ec_write_state() - Write out our state to the state file
155 * The caller will ensure that there is a node ready for the state. The node
156 * may already contain the old state, in which case it is overridden.
158 * @param blob: Device tree blob holding state
159 * @param node: Node to write our state into
161 static int cros_ec_write_state(void *blob, int node)
163 struct ec_state *ec = g_state;
168 /* We are guaranteed enough space to write basic properties */
169 fdt_setprop_u32(blob, node, "current-image", ec->current_image);
170 fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
171 sizeof(ec->vbnv_context));
173 return state_setprop(node, "flash-data", ec->flash_data,
174 ec->ec_config.flash.length);
177 SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
178 cros_ec_write_state);
181 * Return the number of bytes used in the specified image.
183 * This is the actual size of code+data in the image, as opposed to the
184 * amount of space reserved in flash for that image. This code is similar to
185 * that used by the real EC code base.
187 * @param ec Current emulated EC state
188 * @param entry Flash map entry containing the image to check
189 * @return actual image size in bytes, 0 if the image contains no content or
192 static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
197 * Scan backwards looking for 0xea byte, which is by definition the
198 * last byte of the image. See ec.lds.S for how this is inserted at
199 * the end of the image.
201 for (size = entry->length - 1;
202 size > 0 && ec->flash_data[entry->offset + size] != 0xea;
206 return size ? size + 1 : 0; /* 0xea byte IS part of the image */
210 * Read the key matrix from the device tree
212 * Keymap entries in the fdt take the form of 0xRRCCKKKK where
213 * RR=Row CC=Column KKKK=Key Code
215 * @param ec Current emulated EC state
216 * @param node Keyboard node of device tree containing keyscan information
217 * @return 0 if ok, -1 on error
219 static int keyscan_read_fdt_matrix(struct ec_state *ec, ofnode node)
225 cell = ofnode_get_property(node, "linux,keymap", &len);
227 return log_msg_ret("prop", -EINVAL);
228 ec->matrix_count = len / 4;
229 ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
231 return log_msg_ret("mem", -ENOMEM);
234 /* Now read the data */
235 for (upto = 0; upto < ec->matrix_count; upto++) {
236 struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
239 word = fdt32_to_cpu(*cell++);
240 matrix->row = word >> 24;
241 matrix->col = (word >> 16) & 0xff;
242 matrix->keycode = word & 0xffff;
244 /* Hard-code some sanity limits for now */
245 if (matrix->row >= KEYBOARD_ROWS ||
246 matrix->col >= KEYBOARD_COLS) {
247 debug("%s: Matrix pos out of range (%d,%d)\n",
248 __func__, matrix->row, matrix->col);
249 return log_msg_ret("matrix", -ERANGE);
253 if (upto != ec->matrix_count) {
254 return log_msg_ret("matrix", -E2BIG);
261 * Return the next keyscan message contents
263 * @param ec Current emulated EC state
264 * @param scan Place to put keyscan bytes for the keyscan message (must hold
265 * enough space for a full keyscan)
266 * @return number of bytes of valid scan data
268 static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
270 const struct ec_keymatrix_entry *matrix;
271 int bytes = KEYBOARD_COLS;
272 int key[8]; /* allow up to 8 keys to be pressed at once */
276 memset(ec->keyscan, '\0', bytes);
277 count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
279 /* Look up keycode in matrix */
280 for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
284 for (found = false, j = 0; j < count; j++) {
285 if (matrix->keycode == key[j])
290 debug("%d: %d,%d\n", matrix->keycode, matrix->row,
292 ec->keyscan[matrix->col] |= 1 << matrix->row;
296 memcpy(scan, ec->keyscan, bytes);
301 * Process an emulated EC command
303 * @param ec Current emulated EC state
304 * @param req_hdr Pointer to request header
305 * @param req_data Pointer to body of request
306 * @param resp_hdr Pointer to place to put response header
307 * @param resp_data Pointer to place to put response data, if any
308 * @return length of response data, or 0 for no response data, or -1 on error
310 static int process_cmd(struct ec_state *ec,
311 struct ec_host_request *req_hdr, const void *req_data,
312 struct ec_host_response *resp_hdr, void *resp_data)
316 /* TODO(sjg@chromium.org): Check checksums */
317 debug("EC command %#0x\n", req_hdr->command);
319 switch (req_hdr->command) {
321 const struct ec_params_hello *req = req_data;
322 struct ec_response_hello *resp = resp_data;
324 resp->out_data = req->in_data + 0x01020304;
325 if (ec->test_flags & CROSECT_BREAK_HELLO)
330 case EC_CMD_GET_VERSION: {
331 struct ec_response_get_version *resp = resp_data;
333 strcpy(resp->version_string_ro, "sandbox_ro");
334 strcpy(resp->version_string_rw, "sandbox_rw");
335 resp->current_image = ec->current_image;
336 debug("Current image %d\n", resp->current_image);
340 case EC_CMD_VBNV_CONTEXT: {
341 const struct ec_params_vbnvcontext *req = req_data;
342 struct ec_response_vbnvcontext *resp = resp_data;
345 case EC_VBNV_CONTEXT_OP_READ:
346 /* TODO(sjg@chromium.org): Support full-size context */
347 memcpy(resp->block, ec->vbnv_context,
351 case EC_VBNV_CONTEXT_OP_WRITE:
352 /* TODO(sjg@chromium.org): Support full-size context */
353 memcpy(ec->vbnv_context, req->block,
358 printf(" ** Unknown vbnv_context command %#02x\n",
364 case EC_CMD_REBOOT_EC: {
365 const struct ec_params_reboot_ec *req = req_data;
367 printf("Request reboot type %d\n", req->cmd);
369 case EC_REBOOT_DISABLE_JUMP:
372 case EC_REBOOT_JUMP_RW:
373 ec->current_image = EC_IMAGE_RW;
377 puts(" ** Unknown type");
382 case EC_CMD_HOST_EVENT_GET_B: {
383 struct ec_response_host_event_mask *resp = resp_data;
386 if (ec->recovery_req) {
387 resp->mask |= EC_HOST_EVENT_MASK(
388 EC_HOST_EVENT_KEYBOARD_RECOVERY);
390 if (ec->test_flags & CROSECT_LID_OPEN)
392 EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_OPEN);
396 case EC_CMD_HOST_EVENT_CLEAR_B: {
397 const struct ec_params_host_event_mask *req = req_data;
399 if (req->mask & EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_OPEN))
400 ec->test_flags &= ~CROSECT_LID_OPEN;
404 case EC_CMD_VBOOT_HASH: {
405 const struct ec_params_vboot_hash *req = req_data;
406 struct ec_response_vboot_hash *resp = resp_data;
407 struct fmap_entry *entry;
410 entry = &ec->ec_config.region[EC_FLASH_REGION_ACTIVE];
413 case EC_VBOOT_HASH_RECALC:
414 case EC_VBOOT_HASH_GET:
415 size = SHA256_SUM_LEN;
416 len = get_image_used(ec, entry);
417 ret = hash_block("sha256",
418 ec->flash_data + entry->offset,
419 len, resp->hash_digest, &size);
421 printf(" ** hash_block() failed\n");
424 resp->status = EC_VBOOT_HASH_STATUS_DONE;
425 resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
426 resp->digest_size = size;
428 resp->offset = entry->offset;
433 printf(" ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
439 case EC_CMD_FLASH_PROTECT: {
440 const struct ec_params_flash_protect *req = req_data;
441 struct ec_response_flash_protect *resp = resp_data;
442 uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
443 EC_FLASH_PROTECT_ALL_AT_BOOT;
445 printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
446 if (req->flags == expect || req->flags == 0) {
447 resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
449 resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
450 resp->writable_flags = 0;
453 puts(" ** unexpected flash protect request\n");
458 case EC_CMD_FLASH_REGION_INFO: {
459 const struct ec_params_flash_region_info *req = req_data;
460 struct ec_response_flash_region_info *resp = resp_data;
461 struct fmap_entry *entry;
463 switch (req->region) {
464 case EC_FLASH_REGION_RO:
465 case EC_FLASH_REGION_ACTIVE:
466 case EC_FLASH_REGION_WP_RO:
467 entry = &ec->ec_config.region[req->region];
468 resp->offset = entry->offset;
469 resp->size = entry->length;
471 printf("EC flash region %d: offset=%#x, size=%#x\n",
472 req->region, resp->offset, resp->size);
475 printf("** Unknown flash region %d\n", req->region);
480 case EC_CMD_FLASH_ERASE: {
481 const struct ec_params_flash_erase *req = req_data;
483 memset(ec->flash_data + req->offset,
484 ec->ec_config.flash_erase_value,
489 case EC_CMD_FLASH_WRITE: {
490 const struct ec_params_flash_write *req = req_data;
492 memcpy(ec->flash_data + req->offset, req + 1, req->size);
496 case EC_CMD_MKBP_STATE:
497 len = cros_ec_keyscan(ec, resp_data);
499 case EC_CMD_GET_NEXT_EVENT: {
500 struct ec_response_get_next_event *resp = resp_data;
502 resp->event_type = EC_MKBP_EVENT_KEY_MATRIX;
503 cros_ec_keyscan(ec, resp->data.key_matrix);
507 case EC_CMD_GET_SKU_ID: {
508 struct ec_sku_id_info *resp = resp_data;
514 case EC_CMD_GET_FEATURES: {
515 struct ec_response_get_features *resp = resp_data;
517 resp->flags[0] = EC_FEATURE_MASK_0(EC_FEATURE_FLASH) |
518 EC_FEATURE_MASK_0(EC_FEATURE_I2C) |
519 EC_FEATURE_MASK_0(EC_FEATURE_VSTORE);
521 EC_FEATURE_MASK_1(EC_FEATURE_UNIFIED_WAKE_MASKS) |
522 EC_FEATURE_MASK_1(EC_FEATURE_ISH);
526 case EC_CMD_VSTORE_INFO: {
527 struct ec_response_vstore_info *resp = resp_data;
530 resp->slot_count = VSTORE_SLOT_COUNT;
531 resp->slot_locked = 0;
532 for (i = 0; i < VSTORE_SLOT_COUNT; i++) {
533 if (ec->slot[i].locked)
534 resp->slot_locked |= 1 << i;
539 case EC_CMD_VSTORE_WRITE: {
540 const struct ec_params_vstore_write *req = req_data;
541 struct vstore_slot *slot;
543 if (req->slot >= EC_VSTORE_SLOT_MAX)
545 slot = &ec->slot[req->slot];
547 memcpy(slot->data, req->data, EC_VSTORE_SLOT_SIZE);
551 case EC_CMD_VSTORE_READ: {
552 const struct ec_params_vstore_read *req = req_data;
553 struct ec_response_vstore_read *resp = resp_data;
554 struct vstore_slot *slot;
556 if (req->slot >= EC_VSTORE_SLOT_MAX)
558 slot = &ec->slot[req->slot];
559 memcpy(resp->data, slot->data, EC_VSTORE_SLOT_SIZE);
563 case EC_CMD_PWM_GET_DUTY: {
564 const struct ec_params_pwm_get_duty *req = req_data;
565 struct ec_response_pwm_get_duty *resp = resp_data;
566 struct ec_pwm_channel *pwm;
568 if (req->pwm_type != EC_PWM_TYPE_GENERIC)
570 if (req->index >= PWM_CHANNEL_COUNT)
572 pwm = &ec->pwm[req->index];
573 resp->duty = pwm->duty;
577 case EC_CMD_PWM_SET_DUTY: {
578 const struct ec_params_pwm_set_duty *req = req_data;
579 struct ec_pwm_channel *pwm;
581 if (req->pwm_type != EC_PWM_TYPE_GENERIC)
583 if (req->index >= PWM_CHANNEL_COUNT)
585 pwm = &ec->pwm[req->index];
586 pwm->duty = req->duty;
591 printf(" ** Unknown EC command %#02x\n", req_hdr->command);
598 int cros_ec_sandbox_packet(struct udevice *udev, int out_bytes, int in_bytes)
600 struct cros_ec_dev *dev = dev_get_uclass_priv(udev);
601 struct ec_state *ec = dev_get_priv(dev->dev);
602 struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
603 const void *req_data = req_hdr + 1;
604 struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
605 void *resp_data = resp_hdr + 1;
608 len = process_cmd(ec, req_hdr, req_data, resp_hdr, resp_data);
612 resp_hdr->struct_version = 3;
613 resp_hdr->result = EC_RES_SUCCESS;
614 resp_hdr->data_len = len;
615 resp_hdr->reserved = 0;
616 len += sizeof(*resp_hdr);
617 resp_hdr->checksum = 0;
618 resp_hdr->checksum = (uint8_t)
619 -cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
624 void cros_ec_check_keyboard(struct udevice *dev)
626 struct ec_state *ec = dev_get_priv(dev);
629 printf("Press keys for EC to detect on reset (ESC=recovery)...");
630 start = get_timer(0);
631 while (get_timer(start) < 1000)
634 if (!sandbox_sdl_key_pressed(KEY_ESC)) {
635 ec->recovery_req = true;
636 printf(" - EC requests recovery\n");
640 /* Return the byte of EC switch states */
641 static int cros_ec_sandbox_get_switches(struct udevice *dev)
643 struct ec_state *ec = dev_get_priv(dev);
645 return ec->test_flags & CROSECT_LID_OPEN ? EC_SWITCH_LID_OPEN : 0;
648 void sandbox_cros_ec_set_test_flags(struct udevice *dev, uint flags)
650 struct ec_state *ec = dev_get_priv(dev);
652 ec->test_flags = flags;
655 int sandbox_cros_ec_get_pwm_duty(struct udevice *dev, uint index, uint *duty)
657 struct ec_state *ec = dev_get_priv(dev);
658 struct ec_pwm_channel *pwm;
660 if (index >= PWM_CHANNEL_COUNT)
662 pwm = &ec->pwm[index];
668 int cros_ec_probe(struct udevice *dev)
670 struct ec_state *ec = dev_get_priv(dev);
671 struct cros_ec_dev *cdev = dev_get_uclass_priv(dev);
672 struct udevice *keyb_dev;
676 memcpy(ec, &s_state, sizeof(*ec));
677 err = cros_ec_decode_ec_flash(dev, &ec->ec_config);
679 debug("%s: Cannot device EC flash\n", __func__);
683 node = ofnode_null();
684 for (device_find_first_child(dev, &keyb_dev);
686 device_find_next_child(&keyb_dev)) {
687 if (device_get_uclass_id(keyb_dev) == UCLASS_KEYBOARD) {
688 node = dev_ofnode(keyb_dev);
692 if (!ofnode_valid(node)) {
693 debug("%s: No cros_ec keyboard found\n", __func__);
694 } else if (keyscan_read_fdt_matrix(ec, node)) {
695 debug("%s: Could not read key matrix\n", __func__);
699 /* If we loaded EC data, check that the length matches */
700 if (ec->flash_data &&
701 ec->flash_data_len != ec->ec_config.flash.length) {
702 printf("EC data length is %x, expected %x, discarding data\n",
703 ec->flash_data_len, ec->ec_config.flash.length);
704 free(ec->flash_data);
705 ec->flash_data = NULL;
708 /* Otherwise allocate the memory */
709 if (!ec->flash_data) {
710 ec->flash_data_len = ec->ec_config.flash.length;
711 ec->flash_data = malloc(ec->flash_data_len);
718 return cros_ec_register(dev);
721 struct dm_cros_ec_ops cros_ec_ops = {
722 .packet = cros_ec_sandbox_packet,
723 .get_switches = cros_ec_sandbox_get_switches,
726 static const struct udevice_id cros_ec_ids[] = {
727 { .compatible = "google,cros-ec-sandbox" },
731 U_BOOT_DRIVER(google_cros_ec_sandbox) = {
732 .name = "google_cros_ec_sandbox",
733 .id = UCLASS_CROS_EC,
734 .of_match = cros_ec_ids,
735 .probe = cros_ec_probe,
736 .priv_auto = sizeof(struct ec_state),