1 // SPDX-License-Identifier: GPL-2.0+
3 * Chromium OS cros_ec driver - sandbox emulation
5 * Copyright (c) 2013 The Chromium OS Authors.
8 #define LOG_CATEGORY UCLASS_CROS_EC
12 #include <ec_commands.h>
17 #include <u-boot/sha256.h>
20 #include <asm/malloc.h>
21 #include <asm/state.h>
24 #include <linux/input.h>
27 * Ultimately it shold be possible to connect an Chrome OS EC emulation
28 * to U-Boot and remove all of this code. But this provides a test
29 * environment for bringing up chromeos_sandbox and demonstrating its
32 * This emulation includes the following:
34 * 1. Emulation of the keyboard, by converting keypresses received from SDL
35 * into key scan data, passed back from the EC as key scan messages. The
36 * key layout is read from the device tree.
38 * 2. Emulation of vboot context - so this can be read/written as required.
40 * 3. Save/restore of EC state, so that the vboot context, flash memory
41 * contents and current image can be preserved across boots. This is important
42 * since the EC is supposed to continue running even if the AP resets.
44 * 4. Some event support, in particular allowing Escape to be pressed on boot
45 * to enter recovery mode. The EC passes this to U-Boot through the normal
48 * 5. Flash read/write/erase support, so that software sync works. The
49 * protect messages are supported but no protection is implemented.
51 * 6. Hashing of the EC image, again to support software sync.
53 * Other features can be added, although a better path is probably to link
54 * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
57 #define KEYBOARD_ROWS 8
58 #define KEYBOARD_COLS 13
60 /* A single entry of the key matrix */
61 struct ec_keymatrix_entry {
62 int row; /* key matrix row */
63 int col; /* key matrix column */
64 int keycode; /* corresponding linux key code */
68 VSTORE_SLOT_COUNT = 4,
69 PWM_CHANNEL_COUNT = 4,
74 u8 data[EC_VSTORE_SLOT_SIZE];
77 struct ec_pwm_channel {
78 uint duty; /* not ns, EC_PWM_MAX_DUTY = 100% */
82 * struct ec_state - Information about the EC state
84 * @valid: true if this struct contains valid state data
85 * @vbnv_context: Vboot context data stored by EC
86 * @ec_config: FDT config information about the EC (e.g. flashmap)
87 * @flash_data: Contents of flash memory
88 * @flash_data_len: Size of flash memory
89 * @current_image: Current image the EC is running
90 * @matrix_count: Number of keys to decode in matrix
91 * @matrix: Information about keyboard matrix
92 * @keyscan: Current keyscan information (bit set for each row/column pressed)
93 * @recovery_req: Keyboard recovery requested
94 * @test_flags: Flags that control behaviour for tests
95 * @slot_locked: Locked vstore slots (mask)
96 * @pwm: Information per PWM channel
100 u8 vbnv_context[EC_VBNV_BLOCK_SIZE_V2];
101 struct fdt_cros_ec ec_config;
104 enum ec_current_image current_image;
106 struct ec_keymatrix_entry *matrix; /* the key matrix info */
107 uint8_t keyscan[KEYBOARD_COLS];
110 struct vstore_slot slot[VSTORE_SLOT_COUNT];
111 struct ec_pwm_channel pwm[PWM_CHANNEL_COUNT];
115 * cros_ec_read_state() - read the sandbox EC state from the state file
117 * If data is available, then blob and node will provide access to it. If
118 * not this function sets up an empty EC.
120 * @param blob: Pointer to device tree blob, or NULL if no data to read
121 * @param node: Node offset to read from
123 static int cros_ec_read_state(const void *blob, int node)
125 struct ec_state *ec = &s_state;
129 /* Set everything to defaults */
130 ec->current_image = EC_IMAGE_RO;
134 /* Read the data if available */
135 ec->current_image = fdtdec_get_int(blob, node, "current-image",
137 prop = fdt_getprop(blob, node, "vbnv-context", &len);
138 if (prop && len == sizeof(ec->vbnv_context))
139 memcpy(ec->vbnv_context, prop, len);
141 prop = fdt_getprop(blob, node, "flash-data", &len);
143 ec->flash_data_len = len;
144 ec->flash_data = malloc(len);
147 memcpy(ec->flash_data, prop, len);
148 debug("%s: Loaded EC flash data size %#x\n", __func__, len);
156 * cros_ec_write_state() - Write out our state to the state file
158 * The caller will ensure that there is a node ready for the state. The node
159 * may already contain the old state, in which case it is overridden.
161 * @param blob: Device tree blob holding state
162 * @param node: Node to write our state into
164 static int cros_ec_write_state(void *blob, int node)
166 struct ec_state *ec = g_state;
171 /* We are guaranteed enough space to write basic properties */
172 fdt_setprop_u32(blob, node, "current-image", ec->current_image);
173 fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
174 sizeof(ec->vbnv_context));
176 return state_setprop(node, "flash-data", ec->flash_data,
177 ec->ec_config.flash.length);
180 SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
181 cros_ec_write_state);
184 * Return the number of bytes used in the specified image.
186 * This is the actual size of code+data in the image, as opposed to the
187 * amount of space reserved in flash for that image. This code is similar to
188 * that used by the real EC code base.
190 * @param ec Current emulated EC state
191 * @param entry Flash map entry containing the image to check
192 * Return: actual image size in bytes, 0 if the image contains no content or
195 static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
200 * Scan backwards looking for 0xea byte, which is by definition the
201 * last byte of the image. See ec.lds.S for how this is inserted at
202 * the end of the image.
204 for (size = entry->length - 1;
205 size > 0 && ec->flash_data[entry->offset + size] != 0xea;
209 return size ? size + 1 : 0; /* 0xea byte IS part of the image */
213 * Read the key matrix from the device tree
215 * Keymap entries in the fdt take the form of 0xRRCCKKKK where
216 * RR=Row CC=Column KKKK=Key Code
218 * @param ec Current emulated EC state
219 * @param node Keyboard node of device tree containing keyscan information
220 * Return: 0 if ok, -1 on error
222 static int keyscan_read_fdt_matrix(struct ec_state *ec, ofnode node)
228 cell = ofnode_get_property(node, "linux,keymap", &len);
230 return log_msg_ret("prop", -EINVAL);
231 ec->matrix_count = len / 4;
232 ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
234 return log_msg_ret("mem", -ENOMEM);
237 /* Now read the data */
238 for (upto = 0; upto < ec->matrix_count; upto++) {
239 struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
242 word = fdt32_to_cpu(*cell++);
243 matrix->row = word >> 24;
244 matrix->col = (word >> 16) & 0xff;
245 matrix->keycode = word & 0xffff;
247 /* Hard-code some sanity limits for now */
248 if (matrix->row >= KEYBOARD_ROWS ||
249 matrix->col >= KEYBOARD_COLS) {
250 debug("%s: Matrix pos out of range (%d,%d)\n",
251 __func__, matrix->row, matrix->col);
252 return log_msg_ret("matrix", -ERANGE);
256 if (upto != ec->matrix_count) {
257 return log_msg_ret("matrix", -E2BIG);
264 * Return the next keyscan message contents
266 * @param ec Current emulated EC state
267 * @param scan Place to put keyscan bytes for the keyscan message (must hold
268 * enough space for a full keyscan)
269 * Return: number of bytes of valid scan data
271 static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
273 const struct ec_keymatrix_entry *matrix;
274 int bytes = KEYBOARD_COLS;
275 int key[8]; /* allow up to 8 keys to be pressed at once */
279 memset(ec->keyscan, '\0', bytes);
280 count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
282 /* Look up keycode in matrix */
283 for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
287 for (found = false, j = 0; j < count; j++) {
288 if (matrix->keycode == key[j])
293 debug("%d: %d,%d\n", matrix->keycode, matrix->row,
295 ec->keyscan[matrix->col] |= 1 << matrix->row;
299 memcpy(scan, ec->keyscan, bytes);
304 * Process an emulated EC command
306 * @param ec Current emulated EC state
307 * @param req_hdr Pointer to request header
308 * @param req_data Pointer to body of request
309 * @param resp_hdr Pointer to place to put response header
310 * @param resp_data Pointer to place to put response data, if any
311 * Return: length of response data, or 0 for no response data, or -1 on error
313 static int process_cmd(struct ec_state *ec,
314 struct ec_host_request *req_hdr, const void *req_data,
315 struct ec_host_response *resp_hdr, void *resp_data)
319 /* TODO(sjg@chromium.org): Check checksums */
320 debug("EC command %#0x\n", req_hdr->command);
322 switch (req_hdr->command) {
324 const struct ec_params_hello *req = req_data;
325 struct ec_response_hello *resp = resp_data;
327 resp->out_data = req->in_data + 0x01020304;
328 if (ec->test_flags & CROSECT_BREAK_HELLO)
333 case EC_CMD_GET_VERSION: {
334 struct ec_response_get_version *resp = resp_data;
336 strcpy(resp->version_string_ro, "sandbox_ro");
337 strcpy(resp->version_string_rw, "sandbox_rw");
338 resp->current_image = ec->current_image;
339 debug("Current image %d\n", resp->current_image);
343 case EC_CMD_VBNV_CONTEXT: {
344 const struct ec_params_vbnvcontext *req = req_data;
345 struct ec_response_vbnvcontext *resp = resp_data;
348 case EC_VBNV_CONTEXT_OP_READ:
349 memcpy(resp->block, ec->vbnv_context,
350 EC_VBNV_BLOCK_SIZE_V2);
351 len = EC_VBNV_BLOCK_SIZE_V2;
353 case EC_VBNV_CONTEXT_OP_WRITE:
354 memcpy(ec->vbnv_context, req->block,
355 EC_VBNV_BLOCK_SIZE_V2);
359 printf(" ** Unknown vbnv_context command %#02x\n",
365 case EC_CMD_REBOOT_EC: {
366 const struct ec_params_reboot_ec *req = req_data;
368 printf("Request reboot type %d\n", req->cmd);
370 case EC_REBOOT_DISABLE_JUMP:
373 case EC_REBOOT_JUMP_RW:
374 ec->current_image = EC_IMAGE_RW;
378 puts(" ** Unknown type");
383 case EC_CMD_HOST_EVENT_GET_B: {
384 struct ec_response_host_event_mask *resp = resp_data;
387 if (ec->recovery_req) {
388 resp->mask |= EC_HOST_EVENT_MASK(
389 EC_HOST_EVENT_KEYBOARD_RECOVERY);
391 if (ec->test_flags & CROSECT_LID_OPEN)
393 EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_OPEN);
397 case EC_CMD_HOST_EVENT_CLEAR_B: {
398 const struct ec_params_host_event_mask *req = req_data;
400 if (req->mask & EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_OPEN))
401 ec->test_flags &= ~CROSECT_LID_OPEN;
405 case EC_CMD_VBOOT_HASH: {
406 const struct ec_params_vboot_hash *req = req_data;
407 struct ec_response_vboot_hash *resp = resp_data;
408 struct fmap_entry *entry;
411 entry = &ec->ec_config.region[EC_FLASH_REGION_ACTIVE];
414 case EC_VBOOT_HASH_RECALC:
415 case EC_VBOOT_HASH_GET:
416 size = SHA256_SUM_LEN;
417 len = get_image_used(ec, entry);
418 ret = hash_block("sha256",
419 ec->flash_data + entry->offset,
420 len, resp->hash_digest, &size);
422 printf(" ** hash_block() failed\n");
425 resp->status = EC_VBOOT_HASH_STATUS_DONE;
426 resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
427 resp->digest_size = size;
429 resp->offset = entry->offset;
434 printf(" ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
440 case EC_CMD_FLASH_PROTECT: {
441 const struct ec_params_flash_protect *req = req_data;
442 struct ec_response_flash_protect *resp = resp_data;
443 uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
444 EC_FLASH_PROTECT_ALL_AT_BOOT;
446 printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
447 if (req->flags == expect || req->flags == 0) {
448 resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
450 resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
451 resp->writable_flags = 0;
454 puts(" ** unexpected flash protect request\n");
459 case EC_CMD_FLASH_REGION_INFO: {
460 const struct ec_params_flash_region_info *req = req_data;
461 struct ec_response_flash_region_info *resp = resp_data;
462 struct fmap_entry *entry;
464 switch (req->region) {
465 case EC_FLASH_REGION_RO:
466 case EC_FLASH_REGION_ACTIVE:
467 case EC_FLASH_REGION_WP_RO:
468 entry = &ec->ec_config.region[req->region];
469 resp->offset = entry->offset;
470 resp->size = entry->length;
472 printf("EC flash region %d: offset=%#x, size=%#x\n",
473 req->region, resp->offset, resp->size);
476 printf("** Unknown flash region %d\n", req->region);
481 case EC_CMD_FLASH_ERASE: {
482 const struct ec_params_flash_erase *req = req_data;
484 memset(ec->flash_data + req->offset,
485 ec->ec_config.flash_erase_value,
490 case EC_CMD_FLASH_WRITE: {
491 const struct ec_params_flash_write *req = req_data;
493 memcpy(ec->flash_data + req->offset, req + 1, req->size);
497 case EC_CMD_MKBP_STATE:
498 len = cros_ec_keyscan(ec, resp_data);
500 case EC_CMD_GET_NEXT_EVENT: {
501 struct ec_response_get_next_event *resp = resp_data;
503 resp->event_type = EC_MKBP_EVENT_KEY_MATRIX;
504 cros_ec_keyscan(ec, resp->data.key_matrix);
508 case EC_CMD_GET_SKU_ID: {
509 struct ec_sku_id_info *resp = resp_data;
515 case EC_CMD_GET_FEATURES: {
516 struct ec_response_get_features *resp = resp_data;
518 resp->flags[0] = EC_FEATURE_MASK_0(EC_FEATURE_FLASH) |
519 EC_FEATURE_MASK_0(EC_FEATURE_I2C) |
520 EC_FEATURE_MASK_0(EC_FEATURE_VSTORE);
522 EC_FEATURE_MASK_1(EC_FEATURE_UNIFIED_WAKE_MASKS) |
523 EC_FEATURE_MASK_1(EC_FEATURE_ISH);
527 case EC_CMD_VSTORE_INFO: {
528 struct ec_response_vstore_info *resp = resp_data;
531 resp->slot_count = VSTORE_SLOT_COUNT;
532 resp->slot_locked = 0;
533 for (i = 0; i < VSTORE_SLOT_COUNT; i++) {
534 if (ec->slot[i].locked)
535 resp->slot_locked |= 1 << i;
540 case EC_CMD_VSTORE_WRITE: {
541 const struct ec_params_vstore_write *req = req_data;
542 struct vstore_slot *slot;
544 if (req->slot >= EC_VSTORE_SLOT_MAX)
546 slot = &ec->slot[req->slot];
548 memcpy(slot->data, req->data, EC_VSTORE_SLOT_SIZE);
552 case EC_CMD_VSTORE_READ: {
553 const struct ec_params_vstore_read *req = req_data;
554 struct ec_response_vstore_read *resp = resp_data;
555 struct vstore_slot *slot;
557 if (req->slot >= EC_VSTORE_SLOT_MAX)
559 slot = &ec->slot[req->slot];
560 memcpy(resp->data, slot->data, EC_VSTORE_SLOT_SIZE);
564 case EC_CMD_PWM_GET_DUTY: {
565 const struct ec_params_pwm_get_duty *req = req_data;
566 struct ec_response_pwm_get_duty *resp = resp_data;
567 struct ec_pwm_channel *pwm;
569 if (req->pwm_type != EC_PWM_TYPE_GENERIC)
571 if (req->index >= PWM_CHANNEL_COUNT)
573 pwm = &ec->pwm[req->index];
574 resp->duty = pwm->duty;
578 case EC_CMD_PWM_SET_DUTY: {
579 const struct ec_params_pwm_set_duty *req = req_data;
580 struct ec_pwm_channel *pwm;
582 if (req->pwm_type != EC_PWM_TYPE_GENERIC)
584 if (req->index >= PWM_CHANNEL_COUNT)
586 pwm = &ec->pwm[req->index];
587 pwm->duty = req->duty;
592 printf(" ** Unknown EC command %#02x\n", req_hdr->command);
595 debug(" - EC command %#0x, result %d\n", req_hdr->command, len);
600 int cros_ec_sandbox_packet(struct udevice *udev, int out_bytes, int in_bytes)
602 struct cros_ec_dev *dev = dev_get_uclass_priv(udev);
603 struct ec_state *ec = dev_get_priv(dev->dev);
604 struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
605 const void *req_data = req_hdr + 1;
606 struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
607 void *resp_data = resp_hdr + 1;
610 len = process_cmd(ec, req_hdr, req_data, resp_hdr, resp_data);
614 resp_hdr->struct_version = 3;
615 resp_hdr->result = EC_RES_SUCCESS;
616 resp_hdr->data_len = len;
617 resp_hdr->reserved = 0;
618 len += sizeof(*resp_hdr);
619 resp_hdr->checksum = 0;
620 resp_hdr->checksum = (uint8_t)
621 -cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
626 void cros_ec_check_keyboard(struct udevice *dev)
628 struct ec_state *ec = dev_get_priv(dev);
631 printf("\nPress keys for EC to detect on reset (ESC=recovery)...");
632 start = get_timer(0);
633 while (get_timer(start) < 2000) {
638 ec->recovery_req = true;
639 printf("EC requests recovery");
646 /* Return the byte of EC switch states */
647 static int cros_ec_sandbox_get_switches(struct udevice *dev)
649 struct ec_state *ec = dev_get_priv(dev);
651 return ec->test_flags & CROSECT_LID_OPEN ? EC_SWITCH_LID_OPEN : 0;
654 void sandbox_cros_ec_set_test_flags(struct udevice *dev, uint flags)
656 struct ec_state *ec = dev_get_priv(dev);
658 ec->test_flags = flags;
661 int sandbox_cros_ec_get_pwm_duty(struct udevice *dev, uint index, uint *duty)
663 struct ec_state *ec = dev_get_priv(dev);
664 struct ec_pwm_channel *pwm;
666 if (index >= PWM_CHANNEL_COUNT)
668 pwm = &ec->pwm[index];
674 int cros_ec_probe(struct udevice *dev)
676 struct ec_state *ec = dev_get_priv(dev);
677 struct cros_ec_dev *cdev = dev_get_uclass_priv(dev);
678 struct udevice *keyb_dev;
683 memcpy(ec, &s_state, sizeof(*ec));
685 ec->current_image = EC_IMAGE_RO;
686 err = cros_ec_decode_ec_flash(dev, &ec->ec_config);
688 debug("%s: Cannot device EC flash\n", __func__);
692 node = ofnode_null();
693 for (device_find_first_child(dev, &keyb_dev);
695 device_find_next_child(&keyb_dev)) {
696 if (device_get_uclass_id(keyb_dev) == UCLASS_KEYBOARD) {
697 node = dev_ofnode(keyb_dev);
701 if (!ofnode_valid(node)) {
702 debug("%s: No cros_ec keyboard found\n", __func__);
703 } else if (keyscan_read_fdt_matrix(ec, node)) {
704 debug("%s: Could not read key matrix\n", __func__);
708 /* If we loaded EC data, check that the length matches */
709 if (ec->flash_data &&
710 ec->flash_data_len != ec->ec_config.flash.length) {
711 printf("EC data length is %x, expected %x, discarding data\n",
712 ec->flash_data_len, ec->ec_config.flash.length);
713 free(ec->flash_data);
714 ec->flash_data = NULL;
717 /* Otherwise allocate the memory */
718 if (!ec->flash_data) {
719 ec->flash_data_len = ec->ec_config.flash.length;
720 ec->flash_data = malloc(ec->flash_data_len);
727 return cros_ec_register(dev);
730 struct dm_cros_ec_ops cros_ec_ops = {
731 .packet = cros_ec_sandbox_packet,
732 .get_switches = cros_ec_sandbox_get_switches,
735 static const struct udevice_id cros_ec_ids[] = {
736 { .compatible = "google,cros-ec-sandbox" },
740 U_BOOT_DRIVER(google_cros_ec_sandbox) = {
741 .name = "google_cros_ec_sandbox",
742 .id = UCLASS_CROS_EC,
743 .of_match = cros_ec_ids,
744 .probe = cros_ec_probe,
745 .priv_auto = sizeof(struct ec_state),