1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Chromium OS cros_ec driver - sandbox emulation
4  *
5  * Copyright (c) 2013 The Chromium OS Authors.
6  */
7 
8 #include <common.h>
9 #include <cros_ec.h>
10 #include <dm.h>
11 #include <ec_commands.h>
12 #include <errno.h>
13 #include <hash.h>
14 #include <log.h>
15 #include <os.h>
16 #include <u-boot/sha256.h>
17 #include <spi.h>
18 #include <asm/malloc.h>
19 #include <asm/state.h>
20 #include <asm/sdl.h>
21 #include <asm/test.h>
22 #include <linux/input.h>
23 
24 /*
25  * Ultimately it shold be possible to connect an Chrome OS EC emulation
26  * to U-Boot and remove all of this code. But this provides a test
27  * environment for bringing up chromeos_sandbox and demonstrating its
28  * utility.
29  *
30  * This emulation includes the following:
31  *
32  * 1. Emulation of the keyboard, by converting keypresses received from SDL
33  * into key scan data, passed back from the EC as key scan messages. The
34  * key layout is read from the device tree.
35  *
36  * 2. Emulation of vboot context - so this can be read/written as required.
37  *
38  * 3. Save/restore of EC state, so that the vboot context, flash memory
39  * contents and current image can be preserved across boots. This is important
40  * since the EC is supposed to continue running even if the AP resets.
41  *
42  * 4. Some event support, in particular allowing Escape to be pressed on boot
43  * to enter recovery mode. The EC passes this to U-Boot through the normal
44  * event message.
45  *
46  * 5. Flash read/write/erase support, so that software sync works. The
47  * protect messages are supported but no protection is implemented.
48  *
49  * 6. Hashing of the EC image, again to support software sync.
50  *
51  * Other features can be added, although a better path is probably to link
52  * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
53  */
54 
55 #define KEYBOARD_ROWS	8
56 #define KEYBOARD_COLS	13
57 
58 /* A single entry of the key matrix */
59 struct ec_keymatrix_entry {
60 	int row;	/* key matrix row */
61 	int col;	/* key matrix column */
62 	int keycode;	/* corresponding linux key code */
63 };
64 
65 enum {
66 	VSTORE_SLOT_COUNT	= 4,
67 };
68 
69 struct vstore_slot {
70 	bool locked;
71 	u8 data[EC_VSTORE_SLOT_SIZE];
72 };
73 
74 /**
75  * struct ec_state - Information about the EC state
76  *
77  * @vbnv_context: Vboot context data stored by EC
78  * @ec_config: FDT config information about the EC (e.g. flashmap)
79  * @flash_data: Contents of flash memory
80  * @flash_data_len: Size of flash memory
81  * @current_image: Current image the EC is running
82  * @matrix_count: Number of keys to decode in matrix
83  * @matrix: Information about keyboard matrix
84  * @keyscan: Current keyscan information (bit set for each row/column pressed)
85  * @recovery_req: Keyboard recovery requested
86  * @test_flags: Flags that control behaviour for tests
87  * @slot_locked: Locked vstore slots (mask)
88  */
89 struct ec_state {
90 	u8 vbnv_context[EC_VBNV_BLOCK_SIZE_V2];
91 	struct fdt_cros_ec ec_config;
92 	uint8_t *flash_data;
93 	int flash_data_len;
94 	enum ec_current_image current_image;
95 	int matrix_count;
96 	struct ec_keymatrix_entry *matrix;	/* the key matrix info */
97 	uint8_t keyscan[KEYBOARD_COLS];
98 	bool recovery_req;
99 	uint test_flags;
100 	struct vstore_slot slot[VSTORE_SLOT_COUNT];
101 } s_state, *g_state;
102 
103 /**
104  * cros_ec_read_state() - read the sandbox EC state from the state file
105  *
106  * If data is available, then blob and node will provide access to it. If
107  * not this function sets up an empty EC.
108  *
109  * @param blob: Pointer to device tree blob, or NULL if no data to read
110  * @param node: Node offset to read from
111  */
cros_ec_read_state(const void * blob,int node)112 static int cros_ec_read_state(const void *blob, int node)
113 {
114 	struct ec_state *ec = &s_state;
115 	const char *prop;
116 	int len;
117 
118 	/* Set everything to defaults */
119 	ec->current_image = EC_IMAGE_RO;
120 	if (!blob)
121 		return 0;
122 
123 	/* Read the data if available */
124 	ec->current_image = fdtdec_get_int(blob, node, "current-image",
125 					   EC_IMAGE_RO);
126 	prop = fdt_getprop(blob, node, "vbnv-context", &len);
127 	if (prop && len == sizeof(ec->vbnv_context))
128 		memcpy(ec->vbnv_context, prop, len);
129 
130 	prop = fdt_getprop(blob, node, "flash-data", &len);
131 	if (prop) {
132 		ec->flash_data_len = len;
133 		ec->flash_data = malloc(len);
134 		if (!ec->flash_data)
135 			return -ENOMEM;
136 		memcpy(ec->flash_data, prop, len);
137 		debug("%s: Loaded EC flash data size %#x\n", __func__, len);
138 	}
139 
140 	return 0;
141 }
142 
143 /**
144  * cros_ec_write_state() - Write out our state to the state file
145  *
146  * The caller will ensure that there is a node ready for the state. The node
147  * may already contain the old state, in which case it is overridden.
148  *
149  * @param blob: Device tree blob holding state
150  * @param node: Node to write our state into
151  */
cros_ec_write_state(void * blob,int node)152 static int cros_ec_write_state(void *blob, int node)
153 {
154 	struct ec_state *ec = g_state;
155 
156 	if (!g_state)
157 		return 0;
158 
159 	/* We are guaranteed enough space to write basic properties */
160 	fdt_setprop_u32(blob, node, "current-image", ec->current_image);
161 	fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
162 		    sizeof(ec->vbnv_context));
163 
164 	return state_setprop(node, "flash-data", ec->flash_data,
165 			     ec->ec_config.flash.length);
166 }
167 
168 SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
169 		 cros_ec_write_state);
170 
171 /**
172  * Return the number of bytes used in the specified image.
173  *
174  * This is the actual size of code+data in the image, as opposed to the
175  * amount of space reserved in flash for that image. This code is similar to
176  * that used by the real EC code base.
177  *
178  * @param ec	Current emulated EC state
179  * @param entry	Flash map entry containing the image to check
180  * @return actual image size in bytes, 0 if the image contains no content or
181  * error.
182  */
get_image_used(struct ec_state * ec,struct fmap_entry * entry)183 static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
184 {
185 	int size;
186 
187 	/*
188 	 * Scan backwards looking for 0xea byte, which is by definition the
189 	 * last byte of the image.  See ec.lds.S for how this is inserted at
190 	 * the end of the image.
191 	 */
192 	for (size = entry->length - 1;
193 	     size > 0 && ec->flash_data[entry->offset + size] != 0xea;
194 	     size--)
195 		;
196 
197 	return size ? size + 1 : 0;  /* 0xea byte IS part of the image */
198 }
199 
200 /**
201  * Read the key matrix from the device tree
202  *
203  * Keymap entries in the fdt take the form of 0xRRCCKKKK where
204  * RR=Row CC=Column KKKK=Key Code
205  *
206  * @param ec	Current emulated EC state
207  * @param node	Keyboard node of device tree containing keyscan information
208  * @return 0 if ok, -1 on error
209  */
keyscan_read_fdt_matrix(struct ec_state * ec,ofnode node)210 static int keyscan_read_fdt_matrix(struct ec_state *ec, ofnode node)
211 {
212 	const u32 *cell;
213 	int upto;
214 	int len;
215 
216 	cell = ofnode_get_property(node, "linux,keymap", &len);
217 	ec->matrix_count = len / 4;
218 	ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
219 	if (!ec->matrix) {
220 		debug("%s: Out of memory for key matrix\n", __func__);
221 		return -1;
222 	}
223 
224 	/* Now read the data */
225 	for (upto = 0; upto < ec->matrix_count; upto++) {
226 		struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
227 		u32 word;
228 
229 		word = fdt32_to_cpu(*cell++);
230 		matrix->row = word >> 24;
231 		matrix->col = (word >> 16) & 0xff;
232 		matrix->keycode = word & 0xffff;
233 
234 		/* Hard-code some sanity limits for now */
235 		if (matrix->row >= KEYBOARD_ROWS ||
236 		    matrix->col >= KEYBOARD_COLS) {
237 			debug("%s: Matrix pos out of range (%d,%d)\n",
238 			      __func__, matrix->row, matrix->col);
239 			return -1;
240 		}
241 	}
242 
243 	if (upto != ec->matrix_count) {
244 		debug("%s: Read mismatch from key matrix\n", __func__);
245 		return -1;
246 	}
247 
248 	return 0;
249 }
250 
251 /**
252  * Return the next keyscan message contents
253  *
254  * @param ec	Current emulated EC state
255  * @param scan	Place to put keyscan bytes for the keyscan message (must hold
256  *		enough space for a full keyscan)
257  * @return number of bytes of valid scan data
258  */
cros_ec_keyscan(struct ec_state * ec,uint8_t * scan)259 static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
260 {
261 	const struct ec_keymatrix_entry *matrix;
262 	int bytes = KEYBOARD_COLS;
263 	int key[8];	/* allow up to 8 keys to be pressed at once */
264 	int count;
265 	int i;
266 
267 	memset(ec->keyscan, '\0', bytes);
268 	count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
269 
270 	/* Look up keycode in matrix */
271 	for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
272 		bool found;
273 		int j;
274 
275 		for (found = false, j = 0; j < count; j++) {
276 			if (matrix->keycode == key[j])
277 				found = true;
278 		}
279 
280 		if (found) {
281 			debug("%d: %d,%d\n", matrix->keycode, matrix->row,
282 			      matrix->col);
283 			ec->keyscan[matrix->col] |= 1 << matrix->row;
284 		}
285 	}
286 
287 	memcpy(scan, ec->keyscan, bytes);
288 	return bytes;
289 }
290 
291 /**
292  * Process an emulated EC command
293  *
294  * @param ec		Current emulated EC state
295  * @param req_hdr	Pointer to request header
296  * @param req_data	Pointer to body of request
297  * @param resp_hdr	Pointer to place to put response header
298  * @param resp_data	Pointer to place to put response data, if any
299  * @return length of response data, or 0 for no response data, or -1 on error
300  */
process_cmd(struct ec_state * ec,struct ec_host_request * req_hdr,const void * req_data,struct ec_host_response * resp_hdr,void * resp_data)301 static int process_cmd(struct ec_state *ec,
302 		       struct ec_host_request *req_hdr, const void *req_data,
303 		       struct ec_host_response *resp_hdr, void *resp_data)
304 {
305 	int len;
306 
307 	/* TODO(sjg@chromium.org): Check checksums */
308 	debug("EC command %#0x\n", req_hdr->command);
309 
310 	switch (req_hdr->command) {
311 	case EC_CMD_HELLO: {
312 		const struct ec_params_hello *req = req_data;
313 		struct ec_response_hello *resp = resp_data;
314 
315 		resp->out_data = req->in_data + 0x01020304;
316 		if (ec->test_flags & CROSECT_BREAK_HELLO)
317 			resp->out_data++;
318 		len = sizeof(*resp);
319 		break;
320 	}
321 	case EC_CMD_GET_VERSION: {
322 		struct ec_response_get_version *resp = resp_data;
323 
324 		strcpy(resp->version_string_ro, "sandbox_ro");
325 		strcpy(resp->version_string_rw, "sandbox_rw");
326 		resp->current_image = ec->current_image;
327 		debug("Current image %d\n", resp->current_image);
328 		len = sizeof(*resp);
329 		break;
330 	}
331 	case EC_CMD_VBNV_CONTEXT: {
332 		const struct ec_params_vbnvcontext *req = req_data;
333 		struct ec_response_vbnvcontext *resp = resp_data;
334 
335 		switch (req->op) {
336 		case EC_VBNV_CONTEXT_OP_READ:
337 			/* TODO(sjg@chromium.org): Support full-size context */
338 			memcpy(resp->block, ec->vbnv_context,
339 			       EC_VBNV_BLOCK_SIZE);
340 			len = 16;
341 			break;
342 		case EC_VBNV_CONTEXT_OP_WRITE:
343 			/* TODO(sjg@chromium.org): Support full-size context */
344 			memcpy(ec->vbnv_context, req->block,
345 			       EC_VBNV_BLOCK_SIZE);
346 			len = 0;
347 			break;
348 		default:
349 			printf("   ** Unknown vbnv_context command %#02x\n",
350 			       req->op);
351 			return -1;
352 		}
353 		break;
354 	}
355 	case EC_CMD_REBOOT_EC: {
356 		const struct ec_params_reboot_ec *req = req_data;
357 
358 		printf("Request reboot type %d\n", req->cmd);
359 		switch (req->cmd) {
360 		case EC_REBOOT_DISABLE_JUMP:
361 			len = 0;
362 			break;
363 		case EC_REBOOT_JUMP_RW:
364 			ec->current_image = EC_IMAGE_RW;
365 			len = 0;
366 			break;
367 		default:
368 			puts("   ** Unknown type");
369 			return -1;
370 		}
371 		break;
372 	}
373 	case EC_CMD_HOST_EVENT_GET_B: {
374 		struct ec_response_host_event_mask *resp = resp_data;
375 
376 		resp->mask = 0;
377 		if (ec->recovery_req) {
378 			resp->mask |= EC_HOST_EVENT_MASK(
379 					EC_HOST_EVENT_KEYBOARD_RECOVERY);
380 		}
381 		if (ec->test_flags & CROSECT_LID_OPEN)
382 			resp->mask |=
383 				EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_OPEN);
384 		len = sizeof(*resp);
385 		break;
386 	}
387 	case EC_CMD_HOST_EVENT_CLEAR_B: {
388 		const struct ec_params_host_event_mask *req = req_data;
389 
390 		if (req->mask & EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_OPEN))
391 			ec->test_flags &= ~CROSECT_LID_OPEN;
392 		len = 0;
393 		break;
394 		}
395 	case EC_CMD_VBOOT_HASH: {
396 		const struct ec_params_vboot_hash *req = req_data;
397 		struct ec_response_vboot_hash *resp = resp_data;
398 		struct fmap_entry *entry;
399 		int ret, size;
400 
401 		entry = &ec->ec_config.region[EC_FLASH_REGION_ACTIVE];
402 
403 		switch (req->cmd) {
404 		case EC_VBOOT_HASH_RECALC:
405 		case EC_VBOOT_HASH_GET:
406 			size = SHA256_SUM_LEN;
407 			len = get_image_used(ec, entry);
408 			ret = hash_block("sha256",
409 					 ec->flash_data + entry->offset,
410 					 len, resp->hash_digest, &size);
411 			if (ret) {
412 				printf("   ** hash_block() failed\n");
413 				return -1;
414 			}
415 			resp->status = EC_VBOOT_HASH_STATUS_DONE;
416 			resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
417 			resp->digest_size = size;
418 			resp->reserved0 = 0;
419 			resp->offset = entry->offset;
420 			resp->size = len;
421 			len = sizeof(*resp);
422 			break;
423 		default:
424 			printf("   ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
425 			       req->cmd);
426 			return -1;
427 		}
428 		break;
429 	}
430 	case EC_CMD_FLASH_PROTECT: {
431 		const struct ec_params_flash_protect *req = req_data;
432 		struct ec_response_flash_protect *resp = resp_data;
433 		uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
434 				EC_FLASH_PROTECT_ALL_AT_BOOT;
435 
436 		printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
437 		if (req->flags == expect || req->flags == 0) {
438 			resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
439 								0;
440 			resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
441 			resp->writable_flags = 0;
442 			len = sizeof(*resp);
443 		} else {
444 			puts("   ** unexpected flash protect request\n");
445 			return -1;
446 		}
447 		break;
448 	}
449 	case EC_CMD_FLASH_REGION_INFO: {
450 		const struct ec_params_flash_region_info *req = req_data;
451 		struct ec_response_flash_region_info *resp = resp_data;
452 		struct fmap_entry *entry;
453 
454 		switch (req->region) {
455 		case EC_FLASH_REGION_RO:
456 		case EC_FLASH_REGION_ACTIVE:
457 		case EC_FLASH_REGION_WP_RO:
458 			entry = &ec->ec_config.region[req->region];
459 			resp->offset = entry->offset;
460 			resp->size = entry->length;
461 			len = sizeof(*resp);
462 			printf("EC flash region %d: offset=%#x, size=%#x\n",
463 			       req->region, resp->offset, resp->size);
464 			break;
465 		default:
466 			printf("** Unknown flash region %d\n", req->region);
467 			return -1;
468 		}
469 		break;
470 	}
471 	case EC_CMD_FLASH_ERASE: {
472 		const struct ec_params_flash_erase *req = req_data;
473 
474 		memset(ec->flash_data + req->offset,
475 		       ec->ec_config.flash_erase_value,
476 		       req->size);
477 		len = 0;
478 		break;
479 	}
480 	case EC_CMD_FLASH_WRITE: {
481 		const struct ec_params_flash_write *req = req_data;
482 
483 		memcpy(ec->flash_data + req->offset, req + 1, req->size);
484 		len = 0;
485 		break;
486 	}
487 	case EC_CMD_MKBP_STATE:
488 		len = cros_ec_keyscan(ec, resp_data);
489 		break;
490 	case EC_CMD_ENTERING_MODE:
491 		len = 0;
492 		break;
493 	case EC_CMD_GET_NEXT_EVENT: {
494 		struct ec_response_get_next_event *resp = resp_data;
495 
496 		resp->event_type = EC_MKBP_EVENT_KEY_MATRIX;
497 		cros_ec_keyscan(ec, resp->data.key_matrix);
498 		len = sizeof(*resp);
499 		break;
500 	}
501 	case EC_CMD_GET_SKU_ID: {
502 		struct ec_sku_id_info *resp = resp_data;
503 
504 		resp->sku_id = 1234;
505 		len = sizeof(*resp);
506 		break;
507 	}
508 	case EC_CMD_GET_FEATURES: {
509 		struct ec_response_get_features *resp = resp_data;
510 
511 		resp->flags[0] = EC_FEATURE_MASK_0(EC_FEATURE_FLASH) |
512 			EC_FEATURE_MASK_0(EC_FEATURE_I2C) |
513 			EC_FEATURE_MASK_0(EC_FEATURE_VSTORE);
514 		resp->flags[1] =
515 			EC_FEATURE_MASK_1(EC_FEATURE_UNIFIED_WAKE_MASKS) |
516 			EC_FEATURE_MASK_1(EC_FEATURE_ISH);
517 		len = sizeof(*resp);
518 		break;
519 	}
520 	case EC_CMD_VSTORE_INFO: {
521 		struct ec_response_vstore_info *resp = resp_data;
522 		int i;
523 
524 		resp->slot_count = VSTORE_SLOT_COUNT;
525 		resp->slot_locked = 0;
526 		for (i = 0; i < VSTORE_SLOT_COUNT; i++) {
527 			if (ec->slot[i].locked)
528 				resp->slot_locked |= 1 << i;
529 		}
530 		len = sizeof(*resp);
531 		break;
532 	};
533 	case EC_CMD_VSTORE_WRITE: {
534 		const struct ec_params_vstore_write *req = req_data;
535 		struct vstore_slot *slot;
536 
537 		if (req->slot >= EC_VSTORE_SLOT_MAX)
538 			return -EINVAL;
539 		slot = &ec->slot[req->slot];
540 		slot->locked = true;
541 		memcpy(slot->data, req->data, EC_VSTORE_SLOT_SIZE);
542 		len = 0;
543 		break;
544 	}
545 	case EC_CMD_VSTORE_READ: {
546 		const struct ec_params_vstore_read *req = req_data;
547 		struct ec_response_vstore_read *resp = resp_data;
548 		struct vstore_slot *slot;
549 
550 		if (req->slot >= EC_VSTORE_SLOT_MAX)
551 			return -EINVAL;
552 		slot = &ec->slot[req->slot];
553 		memcpy(resp->data, slot->data, EC_VSTORE_SLOT_SIZE);
554 		len = sizeof(*resp);
555 		break;
556 	}
557 	default:
558 		printf("   ** Unknown EC command %#02x\n", req_hdr->command);
559 		return -1;
560 	}
561 
562 	return len;
563 }
564 
cros_ec_sandbox_packet(struct udevice * udev,int out_bytes,int in_bytes)565 int cros_ec_sandbox_packet(struct udevice *udev, int out_bytes, int in_bytes)
566 {
567 	struct cros_ec_dev *dev = dev_get_uclass_priv(udev);
568 	struct ec_state *ec = dev_get_priv(dev->dev);
569 	struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
570 	const void *req_data = req_hdr + 1;
571 	struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
572 	void *resp_data = resp_hdr + 1;
573 	int len;
574 
575 	len = process_cmd(ec, req_hdr, req_data, resp_hdr, resp_data);
576 	if (len < 0)
577 		return len;
578 
579 	resp_hdr->struct_version = 3;
580 	resp_hdr->result = EC_RES_SUCCESS;
581 	resp_hdr->data_len = len;
582 	resp_hdr->reserved = 0;
583 	len += sizeof(*resp_hdr);
584 	resp_hdr->checksum = 0;
585 	resp_hdr->checksum = (uint8_t)
586 		-cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
587 
588 	return in_bytes;
589 }
590 
cros_ec_check_keyboard(struct udevice * dev)591 void cros_ec_check_keyboard(struct udevice *dev)
592 {
593 	struct ec_state *ec = dev_get_priv(dev);
594 	ulong start;
595 
596 	printf("Press keys for EC to detect on reset (ESC=recovery)...");
597 	start = get_timer(0);
598 	while (get_timer(start) < 1000)
599 		;
600 	putc('\n');
601 	if (!sandbox_sdl_key_pressed(KEY_ESC)) {
602 		ec->recovery_req = true;
603 		printf("   - EC requests recovery\n");
604 	}
605 }
606 
607 /* Return the byte of EC switch states */
cros_ec_sandbox_get_switches(struct udevice * dev)608 static int cros_ec_sandbox_get_switches(struct udevice *dev)
609 {
610 	struct ec_state *ec = dev_get_priv(dev);
611 
612 	return ec->test_flags & CROSECT_LID_OPEN ? EC_SWITCH_LID_OPEN : 0;
613 }
614 
sandbox_cros_ec_set_test_flags(struct udevice * dev,uint flags)615 void sandbox_cros_ec_set_test_flags(struct udevice *dev, uint flags)
616 {
617 	struct ec_state *ec = dev_get_priv(dev);
618 
619 	ec->test_flags = flags;
620 }
621 
cros_ec_probe(struct udevice * dev)622 int cros_ec_probe(struct udevice *dev)
623 {
624 	struct ec_state *ec = dev_get_priv(dev);
625 	struct cros_ec_dev *cdev = dev_get_uclass_priv(dev);
626 	struct udevice *keyb_dev;
627 	ofnode node;
628 	int err;
629 
630 	memcpy(ec, &s_state, sizeof(*ec));
631 	err = cros_ec_decode_ec_flash(dev, &ec->ec_config);
632 	if (err) {
633 		debug("%s: Cannot device EC flash\n", __func__);
634 		return err;
635 	}
636 
637 	node = ofnode_null();
638 	for (device_find_first_child(dev, &keyb_dev);
639 	     keyb_dev;
640 	     device_find_next_child(&keyb_dev)) {
641 		if (device_get_uclass_id(keyb_dev) == UCLASS_KEYBOARD) {
642 			node = dev_ofnode(keyb_dev);
643 			break;
644 		}
645 	}
646 	if (!ofnode_valid(node)) {
647 		debug("%s: No cros_ec keyboard found\n", __func__);
648 	} else if (keyscan_read_fdt_matrix(ec, node)) {
649 		debug("%s: Could not read key matrix\n", __func__);
650 		return -1;
651 	}
652 
653 	/* If we loaded EC data, check that the length matches */
654 	if (ec->flash_data &&
655 	    ec->flash_data_len != ec->ec_config.flash.length) {
656 		printf("EC data length is %x, expected %x, discarding data\n",
657 		       ec->flash_data_len, ec->ec_config.flash.length);
658 		free(ec->flash_data);
659 		ec->flash_data = NULL;
660 	}
661 
662 	/* Otherwise allocate the memory */
663 	if (!ec->flash_data) {
664 		ec->flash_data_len = ec->ec_config.flash.length;
665 		ec->flash_data = malloc(ec->flash_data_len);
666 		if (!ec->flash_data)
667 			return -ENOMEM;
668 	}
669 
670 	cdev->dev = dev;
671 	g_state = ec;
672 	return cros_ec_register(dev);
673 }
674 
675 struct dm_cros_ec_ops cros_ec_ops = {
676 	.packet = cros_ec_sandbox_packet,
677 	.get_switches = cros_ec_sandbox_get_switches,
678 };
679 
680 static const struct udevice_id cros_ec_ids[] = {
681 	{ .compatible = "google,cros-ec-sandbox" },
682 	{ }
683 };
684 
685 U_BOOT_DRIVER(google_cros_ec_sandbox) = {
686 	.name		= "google_cros_ec_sandbox",
687 	.id		= UCLASS_CROS_EC,
688 	.of_match	= cros_ec_ids,
689 	.probe		= cros_ec_probe,
690 	.priv_auto	= sizeof(struct ec_state),
691 	.ops		= &cros_ec_ops,
692 };
693