cros_ec_sandbox.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Chromium OS cros_ec driver - sandbox emulation
  4. *
  5. * Copyright (c) 2013 The Chromium OS Authors.
  6. */
  7. #include <common.h>
  8. #include <cros_ec.h>
  9. #include <dm.h>
  10. #include <ec_commands.h>
  11. #include <errno.h>
  12. #include <hash.h>
  13. #include <malloc.h>
  14. #include <os.h>
  15. #include <u-boot/sha256.h>
  16. #include <spi.h>
  17. #include <asm/state.h>
  18. #include <asm/sdl.h>
  19. #include <linux/input.h>
  20. /*
  21. * Ultimately it shold be possible to connect an Chrome OS EC emulation
  22. * to U-Boot and remove all of this code. But this provides a test
  23. * environment for bringing up chromeos_sandbox and demonstrating its
  24. * utility.
  25. *
  26. * This emulation includes the following:
  27. *
  28. * 1. Emulation of the keyboard, by converting keypresses received from SDL
  29. * into key scan data, passed back from the EC as key scan messages. The
  30. * key layout is read from the device tree.
  31. *
  32. * 2. Emulation of vboot context - so this can be read/written as required.
  33. *
  34. * 3. Save/restore of EC state, so that the vboot context, flash memory
  35. * contents and current image can be preserved across boots. This is important
  36. * since the EC is supposed to continue running even if the AP resets.
  37. *
  38. * 4. Some event support, in particular allowing Escape to be pressed on boot
  39. * to enter recovery mode. The EC passes this to U-Boot through the normal
  40. * event message.
  41. *
  42. * 5. Flash read/write/erase support, so that software sync works. The
  43. * protect messages are supported but no protection is implemented.
  44. *
  45. * 6. Hashing of the EC image, again to support software sync.
  46. *
  47. * Other features can be added, although a better path is probably to link
  48. * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
  49. */
  50. #define KEYBOARD_ROWS 8
  51. #define KEYBOARD_COLS 13
  52. /* A single entry of the key matrix */
  53. struct ec_keymatrix_entry {
  54. int row; /* key matrix row */
  55. int col; /* key matrix column */
  56. int keycode; /* corresponding linux key code */
  57. };
  58. /**
  59. * struct ec_state - Information about the EC state
  60. *
  61. * @vbnv_context: Vboot context data stored by EC
  62. * @ec_config: FDT config information about the EC (e.g. flashmap)
  63. * @flash_data: Contents of flash memory
  64. * @flash_data_len: Size of flash memory
  65. * @current_image: Current image the EC is running
  66. * @matrix_count: Number of keys to decode in matrix
  67. * @matrix: Information about keyboard matrix
  68. * @keyscan: Current keyscan information (bit set for each row/column pressed)
  69. * @recovery_req: Keyboard recovery requested
  70. */
  71. struct ec_state {
  72. u8 vbnv_context[EC_VBNV_BLOCK_SIZE_V2];
  73. struct fdt_cros_ec ec_config;
  74. uint8_t *flash_data;
  75. int flash_data_len;
  76. enum ec_current_image current_image;
  77. int matrix_count;
  78. struct ec_keymatrix_entry *matrix; /* the key matrix info */
  79. uint8_t keyscan[KEYBOARD_COLS];
  80. bool recovery_req;
  81. } s_state, *g_state;
  82. /**
  83. * cros_ec_read_state() - read the sandbox EC state from the state file
  84. *
  85. * If data is available, then blob and node will provide access to it. If
  86. * not this function sets up an empty EC.
  87. *
  88. * @param blob: Pointer to device tree blob, or NULL if no data to read
  89. * @param node: Node offset to read from
  90. */
  91. static int cros_ec_read_state(const void *blob, int node)
  92. {
  93. struct ec_state *ec = &s_state;
  94. const char *prop;
  95. int len;
  96. /* Set everything to defaults */
  97. ec->current_image = EC_IMAGE_RO;
  98. if (!blob)
  99. return 0;
  100. /* Read the data if available */
  101. ec->current_image = fdtdec_get_int(blob, node, "current-image",
  102. EC_IMAGE_RO);
  103. prop = fdt_getprop(blob, node, "vbnv-context", &len);
  104. if (prop && len == sizeof(ec->vbnv_context))
  105. memcpy(ec->vbnv_context, prop, len);
  106. prop = fdt_getprop(blob, node, "flash-data", &len);
  107. if (prop) {
  108. ec->flash_data_len = len;
  109. ec->flash_data = os_malloc(len);
  110. if (!ec->flash_data)
  111. return -ENOMEM;
  112. memcpy(ec->flash_data, prop, len);
  113. debug("%s: Loaded EC flash data size %#x\n", __func__, len);
  114. }
  115. return 0;
  116. }
  117. /**
  118. * cros_ec_write_state() - Write out our state to the state file
  119. *
  120. * The caller will ensure that there is a node ready for the state. The node
  121. * may already contain the old state, in which case it is overridden.
  122. *
  123. * @param blob: Device tree blob holding state
  124. * @param node: Node to write our state into
  125. */
  126. static int cros_ec_write_state(void *blob, int node)
  127. {
  128. struct ec_state *ec = g_state;
  129. /* We are guaranteed enough space to write basic properties */
  130. fdt_setprop_u32(blob, node, "current-image", ec->current_image);
  131. fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
  132. sizeof(ec->vbnv_context));
  133. return state_setprop(node, "flash-data", ec->flash_data,
  134. ec->ec_config.flash.length);
  135. }
  136. SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
  137. cros_ec_write_state);
  138. /**
  139. * Return the number of bytes used in the specified image.
  140. *
  141. * This is the actual size of code+data in the image, as opposed to the
  142. * amount of space reserved in flash for that image. This code is similar to
  143. * that used by the real EC code base.
  144. *
  145. * @param ec Current emulated EC state
  146. * @param entry Flash map entry containing the image to check
  147. * @return actual image size in bytes, 0 if the image contains no content or
  148. * error.
  149. */
  150. static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
  151. {
  152. int size;
  153. /*
  154. * Scan backwards looking for 0xea byte, which is by definition the
  155. * last byte of the image. See ec.lds.S for how this is inserted at
  156. * the end of the image.
  157. */
  158. for (size = entry->length - 1;
  159. size > 0 && ec->flash_data[entry->offset + size] != 0xea;
  160. size--)
  161. ;
  162. return size ? size + 1 : 0; /* 0xea byte IS part of the image */
  163. }
  164. /**
  165. * Read the key matrix from the device tree
  166. *
  167. * Keymap entries in the fdt take the form of 0xRRCCKKKK where
  168. * RR=Row CC=Column KKKK=Key Code
  169. *
  170. * @param ec Current emulated EC state
  171. * @param node Keyboard node of device tree containing keyscan information
  172. * @return 0 if ok, -1 on error
  173. */
  174. static int keyscan_read_fdt_matrix(struct ec_state *ec, ofnode node)
  175. {
  176. const u32 *cell;
  177. int upto;
  178. int len;
  179. cell = ofnode_get_property(node, "linux,keymap", &len);
  180. ec->matrix_count = len / 4;
  181. ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
  182. if (!ec->matrix) {
  183. debug("%s: Out of memory for key matrix\n", __func__);
  184. return -1;
  185. }
  186. /* Now read the data */
  187. for (upto = 0; upto < ec->matrix_count; upto++) {
  188. struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
  189. u32 word;
  190. word = fdt32_to_cpu(*cell++);
  191. matrix->row = word >> 24;
  192. matrix->col = (word >> 16) & 0xff;
  193. matrix->keycode = word & 0xffff;
  194. /* Hard-code some sanity limits for now */
  195. if (matrix->row >= KEYBOARD_ROWS ||
  196. matrix->col >= KEYBOARD_COLS) {
  197. debug("%s: Matrix pos out of range (%d,%d)\n",
  198. __func__, matrix->row, matrix->col);
  199. return -1;
  200. }
  201. }
  202. if (upto != ec->matrix_count) {
  203. debug("%s: Read mismatch from key matrix\n", __func__);
  204. return -1;
  205. }
  206. return 0;
  207. }
  208. /**
  209. * Return the next keyscan message contents
  210. *
  211. * @param ec Current emulated EC state
  212. * @param scan Place to put keyscan bytes for the keyscan message (must hold
  213. * enough space for a full keyscan)
  214. * @return number of bytes of valid scan data
  215. */
  216. static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
  217. {
  218. const struct ec_keymatrix_entry *matrix;
  219. int bytes = KEYBOARD_COLS;
  220. int key[8]; /* allow up to 8 keys to be pressed at once */
  221. int count;
  222. int i;
  223. memset(ec->keyscan, '\0', bytes);
  224. count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
  225. /* Look up keycode in matrix */
  226. for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
  227. bool found;
  228. int j;
  229. for (found = false, j = 0; j < count; j++) {
  230. if (matrix->keycode == key[j])
  231. found = true;
  232. }
  233. if (found) {
  234. debug("%d: %d,%d\n", matrix->keycode, matrix->row,
  235. matrix->col);
  236. ec->keyscan[matrix->col] |= 1 << matrix->row;
  237. }
  238. }
  239. memcpy(scan, ec->keyscan, bytes);
  240. return bytes;
  241. }
  242. /**
  243. * Process an emulated EC command
  244. *
  245. * @param ec Current emulated EC state
  246. * @param req_hdr Pointer to request header
  247. * @param req_data Pointer to body of request
  248. * @param resp_hdr Pointer to place to put response header
  249. * @param resp_data Pointer to place to put response data, if any
  250. * @return length of response data, or 0 for no response data, or -1 on error
  251. */
  252. static int process_cmd(struct ec_state *ec,
  253. struct ec_host_request *req_hdr, const void *req_data,
  254. struct ec_host_response *resp_hdr, void *resp_data)
  255. {
  256. int len;
  257. /* TODO(sjg@chromium.org): Check checksums */
  258. debug("EC command %#0x\n", req_hdr->command);
  259. switch (req_hdr->command) {
  260. case EC_CMD_HELLO: {
  261. const struct ec_params_hello *req = req_data;
  262. struct ec_response_hello *resp = resp_data;
  263. resp->out_data = req->in_data + 0x01020304;
  264. len = sizeof(*resp);
  265. break;
  266. }
  267. case EC_CMD_GET_VERSION: {
  268. struct ec_response_get_version *resp = resp_data;
  269. strcpy(resp->version_string_ro, "sandbox_ro");
  270. strcpy(resp->version_string_rw, "sandbox_rw");
  271. resp->current_image = ec->current_image;
  272. debug("Current image %d\n", resp->current_image);
  273. len = sizeof(*resp);
  274. break;
  275. }
  276. case EC_CMD_VBNV_CONTEXT: {
  277. const struct ec_params_vbnvcontext *req = req_data;
  278. struct ec_response_vbnvcontext *resp = resp_data;
  279. switch (req->op) {
  280. case EC_VBNV_CONTEXT_OP_READ:
  281. memcpy(resp->block, ec->vbnv_context,
  282. sizeof(resp->block));
  283. len = sizeof(*resp);
  284. break;
  285. case EC_VBNV_CONTEXT_OP_WRITE:
  286. memcpy(ec->vbnv_context, resp->block,
  287. sizeof(resp->block));
  288. len = 0;
  289. break;
  290. default:
  291. printf(" ** Unknown vbnv_context command %#02x\n",
  292. req->op);
  293. return -1;
  294. }
  295. break;
  296. }
  297. case EC_CMD_REBOOT_EC: {
  298. const struct ec_params_reboot_ec *req = req_data;
  299. printf("Request reboot type %d\n", req->cmd);
  300. switch (req->cmd) {
  301. case EC_REBOOT_DISABLE_JUMP:
  302. len = 0;
  303. break;
  304. case EC_REBOOT_JUMP_RW:
  305. ec->current_image = EC_IMAGE_RW;
  306. len = 0;
  307. break;
  308. default:
  309. puts(" ** Unknown type");
  310. return -1;
  311. }
  312. break;
  313. }
  314. case EC_CMD_HOST_EVENT_GET_B: {
  315. struct ec_response_host_event_mask *resp = resp_data;
  316. resp->mask = 0;
  317. if (ec->recovery_req) {
  318. resp->mask |= EC_HOST_EVENT_MASK(
  319. EC_HOST_EVENT_KEYBOARD_RECOVERY);
  320. }
  321. len = sizeof(*resp);
  322. break;
  323. }
  324. case EC_CMD_VBOOT_HASH: {
  325. const struct ec_params_vboot_hash *req = req_data;
  326. struct ec_response_vboot_hash *resp = resp_data;
  327. struct fmap_entry *entry;
  328. int ret, size;
  329. entry = &ec->ec_config.region[EC_FLASH_REGION_ACTIVE];
  330. switch (req->cmd) {
  331. case EC_VBOOT_HASH_RECALC:
  332. case EC_VBOOT_HASH_GET:
  333. size = SHA256_SUM_LEN;
  334. len = get_image_used(ec, entry);
  335. ret = hash_block("sha256",
  336. ec->flash_data + entry->offset,
  337. len, resp->hash_digest, &size);
  338. if (ret) {
  339. printf(" ** hash_block() failed\n");
  340. return -1;
  341. }
  342. resp->status = EC_VBOOT_HASH_STATUS_DONE;
  343. resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
  344. resp->digest_size = size;
  345. resp->reserved0 = 0;
  346. resp->offset = entry->offset;
  347. resp->size = len;
  348. len = sizeof(*resp);
  349. break;
  350. default:
  351. printf(" ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
  352. req->cmd);
  353. return -1;
  354. }
  355. break;
  356. }
  357. case EC_CMD_FLASH_PROTECT: {
  358. const struct ec_params_flash_protect *req = req_data;
  359. struct ec_response_flash_protect *resp = resp_data;
  360. uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
  361. EC_FLASH_PROTECT_ALL_AT_BOOT;
  362. printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
  363. if (req->flags == expect || req->flags == 0) {
  364. resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
  365. 0;
  366. resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
  367. resp->writable_flags = 0;
  368. len = sizeof(*resp);
  369. } else {
  370. puts(" ** unexpected flash protect request\n");
  371. return -1;
  372. }
  373. break;
  374. }
  375. case EC_CMD_FLASH_REGION_INFO: {
  376. const struct ec_params_flash_region_info *req = req_data;
  377. struct ec_response_flash_region_info *resp = resp_data;
  378. struct fmap_entry *entry;
  379. switch (req->region) {
  380. case EC_FLASH_REGION_RO:
  381. case EC_FLASH_REGION_ACTIVE:
  382. case EC_FLASH_REGION_WP_RO:
  383. entry = &ec->ec_config.region[req->region];
  384. resp->offset = entry->offset;
  385. resp->size = entry->length;
  386. len = sizeof(*resp);
  387. printf("EC flash region %d: offset=%#x, size=%#x\n",
  388. req->region, resp->offset, resp->size);
  389. break;
  390. default:
  391. printf("** Unknown flash region %d\n", req->region);
  392. return -1;
  393. }
  394. break;
  395. }
  396. case EC_CMD_FLASH_ERASE: {
  397. const struct ec_params_flash_erase *req = req_data;
  398. memset(ec->flash_data + req->offset,
  399. ec->ec_config.flash_erase_value,
  400. req->size);
  401. len = 0;
  402. break;
  403. }
  404. case EC_CMD_FLASH_WRITE: {
  405. const struct ec_params_flash_write *req = req_data;
  406. memcpy(ec->flash_data + req->offset, req + 1, req->size);
  407. len = 0;
  408. break;
  409. }
  410. case EC_CMD_MKBP_STATE:
  411. len = cros_ec_keyscan(ec, resp_data);
  412. break;
  413. case EC_CMD_ENTERING_MODE:
  414. len = 0;
  415. break;
  416. default:
  417. printf(" ** Unknown EC command %#02x\n", req_hdr->command);
  418. return -1;
  419. }
  420. return len;
  421. }
  422. int cros_ec_sandbox_packet(struct udevice *udev, int out_bytes, int in_bytes)
  423. {
  424. struct cros_ec_dev *dev = dev_get_uclass_priv(udev);
  425. struct ec_state *ec = dev_get_priv(dev->dev);
  426. struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
  427. const void *req_data = req_hdr + 1;
  428. struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
  429. void *resp_data = resp_hdr + 1;
  430. int len;
  431. len = process_cmd(ec, req_hdr, req_data, resp_hdr, resp_data);
  432. if (len < 0)
  433. return len;
  434. resp_hdr->struct_version = 3;
  435. resp_hdr->result = EC_RES_SUCCESS;
  436. resp_hdr->data_len = len;
  437. resp_hdr->reserved = 0;
  438. len += sizeof(*resp_hdr);
  439. resp_hdr->checksum = 0;
  440. resp_hdr->checksum = (uint8_t)
  441. -cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
  442. return in_bytes;
  443. }
  444. void cros_ec_check_keyboard(struct udevice *dev)
  445. {
  446. struct ec_state *ec = dev_get_priv(dev);
  447. ulong start;
  448. printf("Press keys for EC to detect on reset (ESC=recovery)...");
  449. start = get_timer(0);
  450. while (get_timer(start) < 1000)
  451. ;
  452. putc('\n');
  453. if (!sandbox_sdl_key_pressed(KEY_ESC)) {
  454. ec->recovery_req = true;
  455. printf(" - EC requests recovery\n");
  456. }
  457. }
  458. int cros_ec_probe(struct udevice *dev)
  459. {
  460. struct ec_state *ec = dev->priv;
  461. struct cros_ec_dev *cdev = dev->uclass_priv;
  462. struct udevice *keyb_dev;
  463. ofnode node;
  464. int err;
  465. memcpy(ec, &s_state, sizeof(*ec));
  466. err = cros_ec_decode_ec_flash(dev, &ec->ec_config);
  467. if (err) {
  468. debug("%s: Cannot device EC flash\n", __func__);
  469. return err;
  470. }
  471. node = ofnode_null();
  472. for (device_find_first_child(dev, &keyb_dev);
  473. keyb_dev;
  474. device_find_next_child(&keyb_dev)) {
  475. if (device_get_uclass_id(keyb_dev) == UCLASS_KEYBOARD) {
  476. node = dev_ofnode(keyb_dev);
  477. break;
  478. }
  479. }
  480. if (!ofnode_valid(node)) {
  481. debug("%s: No cros_ec keyboard found\n", __func__);
  482. } else if (keyscan_read_fdt_matrix(ec, node)) {
  483. debug("%s: Could not read key matrix\n", __func__);
  484. return -1;
  485. }
  486. /* If we loaded EC data, check that the length matches */
  487. if (ec->flash_data &&
  488. ec->flash_data_len != ec->ec_config.flash.length) {
  489. printf("EC data length is %x, expected %x, discarding data\n",
  490. ec->flash_data_len, ec->ec_config.flash.length);
  491. os_free(ec->flash_data);
  492. ec->flash_data = NULL;
  493. }
  494. /* Otherwise allocate the memory */
  495. if (!ec->flash_data) {
  496. ec->flash_data_len = ec->ec_config.flash.length;
  497. ec->flash_data = os_malloc(ec->flash_data_len);
  498. if (!ec->flash_data)
  499. return -ENOMEM;
  500. }
  501. cdev->dev = dev;
  502. g_state = ec;
  503. return cros_ec_register(dev);
  504. }
  505. struct dm_cros_ec_ops cros_ec_ops = {
  506. .packet = cros_ec_sandbox_packet,
  507. };
  508. static const struct udevice_id cros_ec_ids[] = {
  509. { .compatible = "google,cros-ec-sandbox" },
  510. { }
  511. };
  512. U_BOOT_DRIVER(cros_ec_sandbox) = {
  513. .name = "cros_ec_sandbox",
  514. .id = UCLASS_CROS_EC,
  515. .of_match = cros_ec_ids,
  516. .probe = cros_ec_probe,
  517. .priv_auto_alloc_size = sizeof(struct ec_state),
  518. .ops = &cros_ec_ops,
  519. };