cros_ec_sandbox.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Chromium OS cros_ec driver - sandbox emulation
  4. *
  5. * Copyright (c) 2013 The Chromium OS Authors.
  6. */
  7. #include <common.h>
  8. #include <cros_ec.h>
  9. #include <dm.h>
  10. #include <ec_commands.h>
  11. #include <errno.h>
  12. #include <hash.h>
  13. #include <log.h>
  14. #include <os.h>
  15. #include <u-boot/sha256.h>
  16. #include <spi.h>
  17. #include <asm/malloc.h>
  18. #include <asm/state.h>
  19. #include <asm/sdl.h>
  20. #include <linux/input.h>
  21. /*
  22. * Ultimately it shold be possible to connect an Chrome OS EC emulation
  23. * to U-Boot and remove all of this code. But this provides a test
  24. * environment for bringing up chromeos_sandbox and demonstrating its
  25. * utility.
  26. *
  27. * This emulation includes the following:
  28. *
  29. * 1. Emulation of the keyboard, by converting keypresses received from SDL
  30. * into key scan data, passed back from the EC as key scan messages. The
  31. * key layout is read from the device tree.
  32. *
  33. * 2. Emulation of vboot context - so this can be read/written as required.
  34. *
  35. * 3. Save/restore of EC state, so that the vboot context, flash memory
  36. * contents and current image can be preserved across boots. This is important
  37. * since the EC is supposed to continue running even if the AP resets.
  38. *
  39. * 4. Some event support, in particular allowing Escape to be pressed on boot
  40. * to enter recovery mode. The EC passes this to U-Boot through the normal
  41. * event message.
  42. *
  43. * 5. Flash read/write/erase support, so that software sync works. The
  44. * protect messages are supported but no protection is implemented.
  45. *
  46. * 6. Hashing of the EC image, again to support software sync.
  47. *
  48. * Other features can be added, although a better path is probably to link
  49. * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
  50. */
  51. #define KEYBOARD_ROWS 8
  52. #define KEYBOARD_COLS 13
  53. /* A single entry of the key matrix */
  54. struct ec_keymatrix_entry {
  55. int row; /* key matrix row */
  56. int col; /* key matrix column */
  57. int keycode; /* corresponding linux key code */
  58. };
  59. /**
  60. * struct ec_state - Information about the EC state
  61. *
  62. * @vbnv_context: Vboot context data stored by EC
  63. * @ec_config: FDT config information about the EC (e.g. flashmap)
  64. * @flash_data: Contents of flash memory
  65. * @flash_data_len: Size of flash memory
  66. * @current_image: Current image the EC is running
  67. * @matrix_count: Number of keys to decode in matrix
  68. * @matrix: Information about keyboard matrix
  69. * @keyscan: Current keyscan information (bit set for each row/column pressed)
  70. * @recovery_req: Keyboard recovery requested
  71. */
  72. struct ec_state {
  73. u8 vbnv_context[EC_VBNV_BLOCK_SIZE_V2];
  74. struct fdt_cros_ec ec_config;
  75. uint8_t *flash_data;
  76. int flash_data_len;
  77. enum ec_current_image current_image;
  78. int matrix_count;
  79. struct ec_keymatrix_entry *matrix; /* the key matrix info */
  80. uint8_t keyscan[KEYBOARD_COLS];
  81. bool recovery_req;
  82. } s_state, *g_state;
  83. /**
  84. * cros_ec_read_state() - read the sandbox EC state from the state file
  85. *
  86. * If data is available, then blob and node will provide access to it. If
  87. * not this function sets up an empty EC.
  88. *
  89. * @param blob: Pointer to device tree blob, or NULL if no data to read
  90. * @param node: Node offset to read from
  91. */
  92. static int cros_ec_read_state(const void *blob, int node)
  93. {
  94. struct ec_state *ec = &s_state;
  95. const char *prop;
  96. int len;
  97. /* Set everything to defaults */
  98. ec->current_image = EC_IMAGE_RO;
  99. if (!blob)
  100. return 0;
  101. /* Read the data if available */
  102. ec->current_image = fdtdec_get_int(blob, node, "current-image",
  103. EC_IMAGE_RO);
  104. prop = fdt_getprop(blob, node, "vbnv-context", &len);
  105. if (prop && len == sizeof(ec->vbnv_context))
  106. memcpy(ec->vbnv_context, prop, len);
  107. prop = fdt_getprop(blob, node, "flash-data", &len);
  108. if (prop) {
  109. ec->flash_data_len = len;
  110. ec->flash_data = malloc(len);
  111. if (!ec->flash_data)
  112. return -ENOMEM;
  113. memcpy(ec->flash_data, prop, len);
  114. debug("%s: Loaded EC flash data size %#x\n", __func__, len);
  115. }
  116. return 0;
  117. }
  118. /**
  119. * cros_ec_write_state() - Write out our state to the state file
  120. *
  121. * The caller will ensure that there is a node ready for the state. The node
  122. * may already contain the old state, in which case it is overridden.
  123. *
  124. * @param blob: Device tree blob holding state
  125. * @param node: Node to write our state into
  126. */
  127. static int cros_ec_write_state(void *blob, int node)
  128. {
  129. struct ec_state *ec = g_state;
  130. /* We are guaranteed enough space to write basic properties */
  131. fdt_setprop_u32(blob, node, "current-image", ec->current_image);
  132. fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
  133. sizeof(ec->vbnv_context));
  134. return state_setprop(node, "flash-data", ec->flash_data,
  135. ec->ec_config.flash.length);
  136. }
  137. SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
  138. cros_ec_write_state);
  139. /**
  140. * Return the number of bytes used in the specified image.
  141. *
  142. * This is the actual size of code+data in the image, as opposed to the
  143. * amount of space reserved in flash for that image. This code is similar to
  144. * that used by the real EC code base.
  145. *
  146. * @param ec Current emulated EC state
  147. * @param entry Flash map entry containing the image to check
  148. * @return actual image size in bytes, 0 if the image contains no content or
  149. * error.
  150. */
  151. static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
  152. {
  153. int size;
  154. /*
  155. * Scan backwards looking for 0xea byte, which is by definition the
  156. * last byte of the image. See ec.lds.S for how this is inserted at
  157. * the end of the image.
  158. */
  159. for (size = entry->length - 1;
  160. size > 0 && ec->flash_data[entry->offset + size] != 0xea;
  161. size--)
  162. ;
  163. return size ? size + 1 : 0; /* 0xea byte IS part of the image */
  164. }
  165. /**
  166. * Read the key matrix from the device tree
  167. *
  168. * Keymap entries in the fdt take the form of 0xRRCCKKKK where
  169. * RR=Row CC=Column KKKK=Key Code
  170. *
  171. * @param ec Current emulated EC state
  172. * @param node Keyboard node of device tree containing keyscan information
  173. * @return 0 if ok, -1 on error
  174. */
  175. static int keyscan_read_fdt_matrix(struct ec_state *ec, ofnode node)
  176. {
  177. const u32 *cell;
  178. int upto;
  179. int len;
  180. cell = ofnode_get_property(node, "linux,keymap", &len);
  181. ec->matrix_count = len / 4;
  182. ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
  183. if (!ec->matrix) {
  184. debug("%s: Out of memory for key matrix\n", __func__);
  185. return -1;
  186. }
  187. /* Now read the data */
  188. for (upto = 0; upto < ec->matrix_count; upto++) {
  189. struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
  190. u32 word;
  191. word = fdt32_to_cpu(*cell++);
  192. matrix->row = word >> 24;
  193. matrix->col = (word >> 16) & 0xff;
  194. matrix->keycode = word & 0xffff;
  195. /* Hard-code some sanity limits for now */
  196. if (matrix->row >= KEYBOARD_ROWS ||
  197. matrix->col >= KEYBOARD_COLS) {
  198. debug("%s: Matrix pos out of range (%d,%d)\n",
  199. __func__, matrix->row, matrix->col);
  200. return -1;
  201. }
  202. }
  203. if (upto != ec->matrix_count) {
  204. debug("%s: Read mismatch from key matrix\n", __func__);
  205. return -1;
  206. }
  207. return 0;
  208. }
  209. /**
  210. * Return the next keyscan message contents
  211. *
  212. * @param ec Current emulated EC state
  213. * @param scan Place to put keyscan bytes for the keyscan message (must hold
  214. * enough space for a full keyscan)
  215. * @return number of bytes of valid scan data
  216. */
  217. static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
  218. {
  219. const struct ec_keymatrix_entry *matrix;
  220. int bytes = KEYBOARD_COLS;
  221. int key[8]; /* allow up to 8 keys to be pressed at once */
  222. int count;
  223. int i;
  224. memset(ec->keyscan, '\0', bytes);
  225. count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
  226. /* Look up keycode in matrix */
  227. for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
  228. bool found;
  229. int j;
  230. for (found = false, j = 0; j < count; j++) {
  231. if (matrix->keycode == key[j])
  232. found = true;
  233. }
  234. if (found) {
  235. debug("%d: %d,%d\n", matrix->keycode, matrix->row,
  236. matrix->col);
  237. ec->keyscan[matrix->col] |= 1 << matrix->row;
  238. }
  239. }
  240. memcpy(scan, ec->keyscan, bytes);
  241. return bytes;
  242. }
  243. /**
  244. * Process an emulated EC command
  245. *
  246. * @param ec Current emulated EC state
  247. * @param req_hdr Pointer to request header
  248. * @param req_data Pointer to body of request
  249. * @param resp_hdr Pointer to place to put response header
  250. * @param resp_data Pointer to place to put response data, if any
  251. * @return length of response data, or 0 for no response data, or -1 on error
  252. */
  253. static int process_cmd(struct ec_state *ec,
  254. struct ec_host_request *req_hdr, const void *req_data,
  255. struct ec_host_response *resp_hdr, void *resp_data)
  256. {
  257. int len;
  258. /* TODO(sjg@chromium.org): Check checksums */
  259. debug("EC command %#0x\n", req_hdr->command);
  260. switch (req_hdr->command) {
  261. case EC_CMD_HELLO: {
  262. const struct ec_params_hello *req = req_data;
  263. struct ec_response_hello *resp = resp_data;
  264. resp->out_data = req->in_data + 0x01020304;
  265. len = sizeof(*resp);
  266. break;
  267. }
  268. case EC_CMD_GET_VERSION: {
  269. struct ec_response_get_version *resp = resp_data;
  270. strcpy(resp->version_string_ro, "sandbox_ro");
  271. strcpy(resp->version_string_rw, "sandbox_rw");
  272. resp->current_image = ec->current_image;
  273. debug("Current image %d\n", resp->current_image);
  274. len = sizeof(*resp);
  275. break;
  276. }
  277. case EC_CMD_VBNV_CONTEXT: {
  278. const struct ec_params_vbnvcontext *req = req_data;
  279. struct ec_response_vbnvcontext *resp = resp_data;
  280. switch (req->op) {
  281. case EC_VBNV_CONTEXT_OP_READ:
  282. /* TODO(sjg@chromium.org): Support full-size context */
  283. memcpy(resp->block, ec->vbnv_context,
  284. EC_VBNV_BLOCK_SIZE);
  285. len = 16;
  286. break;
  287. case EC_VBNV_CONTEXT_OP_WRITE:
  288. /* TODO(sjg@chromium.org): Support full-size context */
  289. memcpy(ec->vbnv_context, req->block,
  290. EC_VBNV_BLOCK_SIZE);
  291. len = 0;
  292. break;
  293. default:
  294. printf(" ** Unknown vbnv_context command %#02x\n",
  295. req->op);
  296. return -1;
  297. }
  298. break;
  299. }
  300. case EC_CMD_REBOOT_EC: {
  301. const struct ec_params_reboot_ec *req = req_data;
  302. printf("Request reboot type %d\n", req->cmd);
  303. switch (req->cmd) {
  304. case EC_REBOOT_DISABLE_JUMP:
  305. len = 0;
  306. break;
  307. case EC_REBOOT_JUMP_RW:
  308. ec->current_image = EC_IMAGE_RW;
  309. len = 0;
  310. break;
  311. default:
  312. puts(" ** Unknown type");
  313. return -1;
  314. }
  315. break;
  316. }
  317. case EC_CMD_HOST_EVENT_GET_B: {
  318. struct ec_response_host_event_mask *resp = resp_data;
  319. resp->mask = 0;
  320. if (ec->recovery_req) {
  321. resp->mask |= EC_HOST_EVENT_MASK(
  322. EC_HOST_EVENT_KEYBOARD_RECOVERY);
  323. }
  324. len = sizeof(*resp);
  325. break;
  326. }
  327. case EC_CMD_VBOOT_HASH: {
  328. const struct ec_params_vboot_hash *req = req_data;
  329. struct ec_response_vboot_hash *resp = resp_data;
  330. struct fmap_entry *entry;
  331. int ret, size;
  332. entry = &ec->ec_config.region[EC_FLASH_REGION_ACTIVE];
  333. switch (req->cmd) {
  334. case EC_VBOOT_HASH_RECALC:
  335. case EC_VBOOT_HASH_GET:
  336. size = SHA256_SUM_LEN;
  337. len = get_image_used(ec, entry);
  338. ret = hash_block("sha256",
  339. ec->flash_data + entry->offset,
  340. len, resp->hash_digest, &size);
  341. if (ret) {
  342. printf(" ** hash_block() failed\n");
  343. return -1;
  344. }
  345. resp->status = EC_VBOOT_HASH_STATUS_DONE;
  346. resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
  347. resp->digest_size = size;
  348. resp->reserved0 = 0;
  349. resp->offset = entry->offset;
  350. resp->size = len;
  351. len = sizeof(*resp);
  352. break;
  353. default:
  354. printf(" ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
  355. req->cmd);
  356. return -1;
  357. }
  358. break;
  359. }
  360. case EC_CMD_FLASH_PROTECT: {
  361. const struct ec_params_flash_protect *req = req_data;
  362. struct ec_response_flash_protect *resp = resp_data;
  363. uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
  364. EC_FLASH_PROTECT_ALL_AT_BOOT;
  365. printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
  366. if (req->flags == expect || req->flags == 0) {
  367. resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
  368. 0;
  369. resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
  370. resp->writable_flags = 0;
  371. len = sizeof(*resp);
  372. } else {
  373. puts(" ** unexpected flash protect request\n");
  374. return -1;
  375. }
  376. break;
  377. }
  378. case EC_CMD_FLASH_REGION_INFO: {
  379. const struct ec_params_flash_region_info *req = req_data;
  380. struct ec_response_flash_region_info *resp = resp_data;
  381. struct fmap_entry *entry;
  382. switch (req->region) {
  383. case EC_FLASH_REGION_RO:
  384. case EC_FLASH_REGION_ACTIVE:
  385. case EC_FLASH_REGION_WP_RO:
  386. entry = &ec->ec_config.region[req->region];
  387. resp->offset = entry->offset;
  388. resp->size = entry->length;
  389. len = sizeof(*resp);
  390. printf("EC flash region %d: offset=%#x, size=%#x\n",
  391. req->region, resp->offset, resp->size);
  392. break;
  393. default:
  394. printf("** Unknown flash region %d\n", req->region);
  395. return -1;
  396. }
  397. break;
  398. }
  399. case EC_CMD_FLASH_ERASE: {
  400. const struct ec_params_flash_erase *req = req_data;
  401. memset(ec->flash_data + req->offset,
  402. ec->ec_config.flash_erase_value,
  403. req->size);
  404. len = 0;
  405. break;
  406. }
  407. case EC_CMD_FLASH_WRITE: {
  408. const struct ec_params_flash_write *req = req_data;
  409. memcpy(ec->flash_data + req->offset, req + 1, req->size);
  410. len = 0;
  411. break;
  412. }
  413. case EC_CMD_MKBP_STATE:
  414. len = cros_ec_keyscan(ec, resp_data);
  415. break;
  416. case EC_CMD_ENTERING_MODE:
  417. len = 0;
  418. break;
  419. case EC_CMD_GET_NEXT_EVENT: {
  420. struct ec_response_get_next_event *resp = resp_data;
  421. resp->event_type = EC_MKBP_EVENT_KEY_MATRIX;
  422. cros_ec_keyscan(ec, resp->data.key_matrix);
  423. len = sizeof(*resp);
  424. break;
  425. }
  426. default:
  427. printf(" ** Unknown EC command %#02x\n", req_hdr->command);
  428. return -1;
  429. }
  430. return len;
  431. }
  432. int cros_ec_sandbox_packet(struct udevice *udev, int out_bytes, int in_bytes)
  433. {
  434. struct cros_ec_dev *dev = dev_get_uclass_priv(udev);
  435. struct ec_state *ec = dev_get_priv(dev->dev);
  436. struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
  437. const void *req_data = req_hdr + 1;
  438. struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
  439. void *resp_data = resp_hdr + 1;
  440. int len;
  441. len = process_cmd(ec, req_hdr, req_data, resp_hdr, resp_data);
  442. if (len < 0)
  443. return len;
  444. resp_hdr->struct_version = 3;
  445. resp_hdr->result = EC_RES_SUCCESS;
  446. resp_hdr->data_len = len;
  447. resp_hdr->reserved = 0;
  448. len += sizeof(*resp_hdr);
  449. resp_hdr->checksum = 0;
  450. resp_hdr->checksum = (uint8_t)
  451. -cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
  452. return in_bytes;
  453. }
  454. void cros_ec_check_keyboard(struct udevice *dev)
  455. {
  456. struct ec_state *ec = dev_get_priv(dev);
  457. ulong start;
  458. printf("Press keys for EC to detect on reset (ESC=recovery)...");
  459. start = get_timer(0);
  460. while (get_timer(start) < 1000)
  461. ;
  462. putc('\n');
  463. if (!sandbox_sdl_key_pressed(KEY_ESC)) {
  464. ec->recovery_req = true;
  465. printf(" - EC requests recovery\n");
  466. }
  467. }
  468. int cros_ec_probe(struct udevice *dev)
  469. {
  470. struct ec_state *ec = dev->priv;
  471. struct cros_ec_dev *cdev = dev->uclass_priv;
  472. struct udevice *keyb_dev;
  473. ofnode node;
  474. int err;
  475. memcpy(ec, &s_state, sizeof(*ec));
  476. err = cros_ec_decode_ec_flash(dev, &ec->ec_config);
  477. if (err) {
  478. debug("%s: Cannot device EC flash\n", __func__);
  479. return err;
  480. }
  481. node = ofnode_null();
  482. for (device_find_first_child(dev, &keyb_dev);
  483. keyb_dev;
  484. device_find_next_child(&keyb_dev)) {
  485. if (device_get_uclass_id(keyb_dev) == UCLASS_KEYBOARD) {
  486. node = dev_ofnode(keyb_dev);
  487. break;
  488. }
  489. }
  490. if (!ofnode_valid(node)) {
  491. debug("%s: No cros_ec keyboard found\n", __func__);
  492. } else if (keyscan_read_fdt_matrix(ec, node)) {
  493. debug("%s: Could not read key matrix\n", __func__);
  494. return -1;
  495. }
  496. /* If we loaded EC data, check that the length matches */
  497. if (ec->flash_data &&
  498. ec->flash_data_len != ec->ec_config.flash.length) {
  499. printf("EC data length is %x, expected %x, discarding data\n",
  500. ec->flash_data_len, ec->ec_config.flash.length);
  501. free(ec->flash_data);
  502. ec->flash_data = NULL;
  503. }
  504. /* Otherwise allocate the memory */
  505. if (!ec->flash_data) {
  506. ec->flash_data_len = ec->ec_config.flash.length;
  507. ec->flash_data = malloc(ec->flash_data_len);
  508. if (!ec->flash_data)
  509. return -ENOMEM;
  510. }
  511. cdev->dev = dev;
  512. g_state = ec;
  513. return cros_ec_register(dev);
  514. }
  515. struct dm_cros_ec_ops cros_ec_ops = {
  516. .packet = cros_ec_sandbox_packet,
  517. };
  518. static const struct udevice_id cros_ec_ids[] = {
  519. { .compatible = "google,cros-ec-sandbox" },
  520. { }
  521. };
  522. U_BOOT_DRIVER(google_cros_ec_sandbox) = {
  523. .name = "google_cros_ec_sandbox",
  524. .id = UCLASS_CROS_EC,
  525. .of_match = cros_ec_ids,
  526. .probe = cros_ec_probe,
  527. .priv_auto_alloc_size = sizeof(struct ec_state),
  528. .ops = &cros_ec_ops,
  529. };