1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Chromium OS cros_ec driver - sandbox emulation
4  *
5  * Copyright (c) 2013 The Chromium OS Authors.
6  */
7 
8 #include <common.h>
9 #include <cros_ec.h>
10 #include <dm.h>
11 #include <ec_commands.h>
12 #include <errno.h>
13 #include <hash.h>
14 #include <log.h>
15 #include <os.h>
16 #include <u-boot/sha256.h>
17 #include <spi.h>
18 #include <asm/malloc.h>
19 #include <asm/state.h>
20 #include <asm/sdl.h>
21 #include <asm/test.h>
22 #include <linux/input.h>
23 
24 /*
25  * Ultimately it shold be possible to connect an Chrome OS EC emulation
26  * to U-Boot and remove all of this code. But this provides a test
27  * environment for bringing up chromeos_sandbox and demonstrating its
28  * utility.
29  *
30  * This emulation includes the following:
31  *
32  * 1. Emulation of the keyboard, by converting keypresses received from SDL
33  * into key scan data, passed back from the EC as key scan messages. The
34  * key layout is read from the device tree.
35  *
36  * 2. Emulation of vboot context - so this can be read/written as required.
37  *
38  * 3. Save/restore of EC state, so that the vboot context, flash memory
39  * contents and current image can be preserved across boots. This is important
40  * since the EC is supposed to continue running even if the AP resets.
41  *
42  * 4. Some event support, in particular allowing Escape to be pressed on boot
43  * to enter recovery mode. The EC passes this to U-Boot through the normal
44  * event message.
45  *
46  * 5. Flash read/write/erase support, so that software sync works. The
47  * protect messages are supported but no protection is implemented.
48  *
49  * 6. Hashing of the EC image, again to support software sync.
50  *
51  * Other features can be added, although a better path is probably to link
52  * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
53  */
54 
55 #define KEYBOARD_ROWS	8
56 #define KEYBOARD_COLS	13
57 
58 /* A single entry of the key matrix */
59 struct ec_keymatrix_entry {
60 	int row;	/* key matrix row */
61 	int col;	/* key matrix column */
62 	int keycode;	/* corresponding linux key code */
63 };
64 
65 enum {
66 	VSTORE_SLOT_COUNT	= 4,
67 };
68 
69 struct vstore_slot {
70 	bool locked;
71 	u8 data[EC_VSTORE_SLOT_SIZE];
72 };
73 
74 /**
75  * struct ec_state - Information about the EC state
76  *
77  * @vbnv_context: Vboot context data stored by EC
78  * @ec_config: FDT config information about the EC (e.g. flashmap)
79  * @flash_data: Contents of flash memory
80  * @flash_data_len: Size of flash memory
81  * @current_image: Current image the EC is running
82  * @matrix_count: Number of keys to decode in matrix
83  * @matrix: Information about keyboard matrix
84  * @keyscan: Current keyscan information (bit set for each row/column pressed)
85  * @recovery_req: Keyboard recovery requested
86  * @test_flags: Flags that control behaviour for tests
87  * @slot_locked: Locked vstore slots (mask)
88  */
89 struct ec_state {
90 	u8 vbnv_context[EC_VBNV_BLOCK_SIZE_V2];
91 	struct fdt_cros_ec ec_config;
92 	uint8_t *flash_data;
93 	int flash_data_len;
94 	enum ec_current_image current_image;
95 	int matrix_count;
96 	struct ec_keymatrix_entry *matrix;	/* the key matrix info */
97 	uint8_t keyscan[KEYBOARD_COLS];
98 	bool recovery_req;
99 	uint test_flags;
100 	struct vstore_slot slot[VSTORE_SLOT_COUNT];
101 } s_state, *g_state;
102 
103 /**
104  * cros_ec_read_state() - read the sandbox EC state from the state file
105  *
106  * If data is available, then blob and node will provide access to it. If
107  * not this function sets up an empty EC.
108  *
109  * @param blob: Pointer to device tree blob, or NULL if no data to read
110  * @param node: Node offset to read from
111  */
cros_ec_read_state(const void * blob,int node)112 static int cros_ec_read_state(const void *blob, int node)
113 {
114 	struct ec_state *ec = &s_state;
115 	const char *prop;
116 	int len;
117 
118 	/* Set everything to defaults */
119 	ec->current_image = EC_IMAGE_RO;
120 	if (!blob)
121 		return 0;
122 
123 	/* Read the data if available */
124 	ec->current_image = fdtdec_get_int(blob, node, "current-image",
125 					   EC_IMAGE_RO);
126 	prop = fdt_getprop(blob, node, "vbnv-context", &len);
127 	if (prop && len == sizeof(ec->vbnv_context))
128 		memcpy(ec->vbnv_context, prop, len);
129 
130 	prop = fdt_getprop(blob, node, "flash-data", &len);
131 	if (prop) {
132 		ec->flash_data_len = len;
133 		ec->flash_data = malloc(len);
134 		if (!ec->flash_data)
135 			return -ENOMEM;
136 		memcpy(ec->flash_data, prop, len);
137 		debug("%s: Loaded EC flash data size %#x\n", __func__, len);
138 	}
139 
140 	return 0;
141 }
142 
143 /**
144  * cros_ec_write_state() - Write out our state to the state file
145  *
146  * The caller will ensure that there is a node ready for the state. The node
147  * may already contain the old state, in which case it is overridden.
148  *
149  * @param blob: Device tree blob holding state
150  * @param node: Node to write our state into
151  */
cros_ec_write_state(void * blob,int node)152 static int cros_ec_write_state(void *blob, int node)
153 {
154 	struct ec_state *ec = g_state;
155 
156 	/* We are guaranteed enough space to write basic properties */
157 	fdt_setprop_u32(blob, node, "current-image", ec->current_image);
158 	fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
159 		    sizeof(ec->vbnv_context));
160 	return state_setprop(node, "flash-data", ec->flash_data,
161 			     ec->ec_config.flash.length);
162 }
163 
164 SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
165 		 cros_ec_write_state);
166 
167 /**
168  * Return the number of bytes used in the specified image.
169  *
170  * This is the actual size of code+data in the image, as opposed to the
171  * amount of space reserved in flash for that image. This code is similar to
172  * that used by the real EC code base.
173  *
174  * @param ec	Current emulated EC state
175  * @param entry	Flash map entry containing the image to check
176  * @return actual image size in bytes, 0 if the image contains no content or
177  * error.
178  */
get_image_used(struct ec_state * ec,struct fmap_entry * entry)179 static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
180 {
181 	int size;
182 
183 	/*
184 	 * Scan backwards looking for 0xea byte, which is by definition the
185 	 * last byte of the image.  See ec.lds.S for how this is inserted at
186 	 * the end of the image.
187 	 */
188 	for (size = entry->length - 1;
189 	     size > 0 && ec->flash_data[entry->offset + size] != 0xea;
190 	     size--)
191 		;
192 
193 	return size ? size + 1 : 0;  /* 0xea byte IS part of the image */
194 }
195 
196 /**
197  * Read the key matrix from the device tree
198  *
199  * Keymap entries in the fdt take the form of 0xRRCCKKKK where
200  * RR=Row CC=Column KKKK=Key Code
201  *
202  * @param ec	Current emulated EC state
203  * @param node	Keyboard node of device tree containing keyscan information
204  * @return 0 if ok, -1 on error
205  */
keyscan_read_fdt_matrix(struct ec_state * ec,ofnode node)206 static int keyscan_read_fdt_matrix(struct ec_state *ec, ofnode node)
207 {
208 	const u32 *cell;
209 	int upto;
210 	int len;
211 
212 	cell = ofnode_get_property(node, "linux,keymap", &len);
213 	ec->matrix_count = len / 4;
214 	ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
215 	if (!ec->matrix) {
216 		debug("%s: Out of memory for key matrix\n", __func__);
217 		return -1;
218 	}
219 
220 	/* Now read the data */
221 	for (upto = 0; upto < ec->matrix_count; upto++) {
222 		struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
223 		u32 word;
224 
225 		word = fdt32_to_cpu(*cell++);
226 		matrix->row = word >> 24;
227 		matrix->col = (word >> 16) & 0xff;
228 		matrix->keycode = word & 0xffff;
229 
230 		/* Hard-code some sanity limits for now */
231 		if (matrix->row >= KEYBOARD_ROWS ||
232 		    matrix->col >= KEYBOARD_COLS) {
233 			debug("%s: Matrix pos out of range (%d,%d)\n",
234 			      __func__, matrix->row, matrix->col);
235 			return -1;
236 		}
237 	}
238 
239 	if (upto != ec->matrix_count) {
240 		debug("%s: Read mismatch from key matrix\n", __func__);
241 		return -1;
242 	}
243 
244 	return 0;
245 }
246 
247 /**
248  * Return the next keyscan message contents
249  *
250  * @param ec	Current emulated EC state
251  * @param scan	Place to put keyscan bytes for the keyscan message (must hold
252  *		enough space for a full keyscan)
253  * @return number of bytes of valid scan data
254  */
cros_ec_keyscan(struct ec_state * ec,uint8_t * scan)255 static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
256 {
257 	const struct ec_keymatrix_entry *matrix;
258 	int bytes = KEYBOARD_COLS;
259 	int key[8];	/* allow up to 8 keys to be pressed at once */
260 	int count;
261 	int i;
262 
263 	memset(ec->keyscan, '\0', bytes);
264 	count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
265 
266 	/* Look up keycode in matrix */
267 	for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
268 		bool found;
269 		int j;
270 
271 		for (found = false, j = 0; j < count; j++) {
272 			if (matrix->keycode == key[j])
273 				found = true;
274 		}
275 
276 		if (found) {
277 			debug("%d: %d,%d\n", matrix->keycode, matrix->row,
278 			      matrix->col);
279 			ec->keyscan[matrix->col] |= 1 << matrix->row;
280 		}
281 	}
282 
283 	memcpy(scan, ec->keyscan, bytes);
284 	return bytes;
285 }
286 
287 /**
288  * Process an emulated EC command
289  *
290  * @param ec		Current emulated EC state
291  * @param req_hdr	Pointer to request header
292  * @param req_data	Pointer to body of request
293  * @param resp_hdr	Pointer to place to put response header
294  * @param resp_data	Pointer to place to put response data, if any
295  * @return length of response data, or 0 for no response data, or -1 on error
296  */
process_cmd(struct ec_state * ec,struct ec_host_request * req_hdr,const void * req_data,struct ec_host_response * resp_hdr,void * resp_data)297 static int process_cmd(struct ec_state *ec,
298 		       struct ec_host_request *req_hdr, const void *req_data,
299 		       struct ec_host_response *resp_hdr, void *resp_data)
300 {
301 	int len;
302 
303 	/* TODO(sjg@chromium.org): Check checksums */
304 	debug("EC command %#0x\n", req_hdr->command);
305 
306 	switch (req_hdr->command) {
307 	case EC_CMD_HELLO: {
308 		const struct ec_params_hello *req = req_data;
309 		struct ec_response_hello *resp = resp_data;
310 
311 		resp->out_data = req->in_data + 0x01020304;
312 		if (ec->test_flags & CROSECT_BREAK_HELLO)
313 			resp->out_data++;
314 		len = sizeof(*resp);
315 		break;
316 	}
317 	case EC_CMD_GET_VERSION: {
318 		struct ec_response_get_version *resp = resp_data;
319 
320 		strcpy(resp->version_string_ro, "sandbox_ro");
321 		strcpy(resp->version_string_rw, "sandbox_rw");
322 		resp->current_image = ec->current_image;
323 		debug("Current image %d\n", resp->current_image);
324 		len = sizeof(*resp);
325 		break;
326 	}
327 	case EC_CMD_VBNV_CONTEXT: {
328 		const struct ec_params_vbnvcontext *req = req_data;
329 		struct ec_response_vbnvcontext *resp = resp_data;
330 
331 		switch (req->op) {
332 		case EC_VBNV_CONTEXT_OP_READ:
333 			/* TODO(sjg@chromium.org): Support full-size context */
334 			memcpy(resp->block, ec->vbnv_context,
335 			       EC_VBNV_BLOCK_SIZE);
336 			len = 16;
337 			break;
338 		case EC_VBNV_CONTEXT_OP_WRITE:
339 			/* TODO(sjg@chromium.org): Support full-size context */
340 			memcpy(ec->vbnv_context, req->block,
341 			       EC_VBNV_BLOCK_SIZE);
342 			len = 0;
343 			break;
344 		default:
345 			printf("   ** Unknown vbnv_context command %#02x\n",
346 			       req->op);
347 			return -1;
348 		}
349 		break;
350 	}
351 	case EC_CMD_REBOOT_EC: {
352 		const struct ec_params_reboot_ec *req = req_data;
353 
354 		printf("Request reboot type %d\n", req->cmd);
355 		switch (req->cmd) {
356 		case EC_REBOOT_DISABLE_JUMP:
357 			len = 0;
358 			break;
359 		case EC_REBOOT_JUMP_RW:
360 			ec->current_image = EC_IMAGE_RW;
361 			len = 0;
362 			break;
363 		default:
364 			puts("   ** Unknown type");
365 			return -1;
366 		}
367 		break;
368 	}
369 	case EC_CMD_HOST_EVENT_GET_B: {
370 		struct ec_response_host_event_mask *resp = resp_data;
371 
372 		resp->mask = 0;
373 		if (ec->recovery_req) {
374 			resp->mask |= EC_HOST_EVENT_MASK(
375 					EC_HOST_EVENT_KEYBOARD_RECOVERY);
376 		}
377 		if (ec->test_flags & CROSECT_LID_OPEN)
378 			resp->mask |=
379 				EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_OPEN);
380 		len = sizeof(*resp);
381 		break;
382 	}
383 	case EC_CMD_HOST_EVENT_CLEAR_B: {
384 		const struct ec_params_host_event_mask *req = req_data;
385 
386 		if (req->mask & EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_OPEN))
387 			ec->test_flags &= ~CROSECT_LID_OPEN;
388 		len = 0;
389 		break;
390 		}
391 	case EC_CMD_VBOOT_HASH: {
392 		const struct ec_params_vboot_hash *req = req_data;
393 		struct ec_response_vboot_hash *resp = resp_data;
394 		struct fmap_entry *entry;
395 		int ret, size;
396 
397 		entry = &ec->ec_config.region[EC_FLASH_REGION_ACTIVE];
398 
399 		switch (req->cmd) {
400 		case EC_VBOOT_HASH_RECALC:
401 		case EC_VBOOT_HASH_GET:
402 			size = SHA256_SUM_LEN;
403 			len = get_image_used(ec, entry);
404 			ret = hash_block("sha256",
405 					 ec->flash_data + entry->offset,
406 					 len, resp->hash_digest, &size);
407 			if (ret) {
408 				printf("   ** hash_block() failed\n");
409 				return -1;
410 			}
411 			resp->status = EC_VBOOT_HASH_STATUS_DONE;
412 			resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
413 			resp->digest_size = size;
414 			resp->reserved0 = 0;
415 			resp->offset = entry->offset;
416 			resp->size = len;
417 			len = sizeof(*resp);
418 			break;
419 		default:
420 			printf("   ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
421 			       req->cmd);
422 			return -1;
423 		}
424 		break;
425 	}
426 	case EC_CMD_FLASH_PROTECT: {
427 		const struct ec_params_flash_protect *req = req_data;
428 		struct ec_response_flash_protect *resp = resp_data;
429 		uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
430 				EC_FLASH_PROTECT_ALL_AT_BOOT;
431 
432 		printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
433 		if (req->flags == expect || req->flags == 0) {
434 			resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
435 								0;
436 			resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
437 			resp->writable_flags = 0;
438 			len = sizeof(*resp);
439 		} else {
440 			puts("   ** unexpected flash protect request\n");
441 			return -1;
442 		}
443 		break;
444 	}
445 	case EC_CMD_FLASH_REGION_INFO: {
446 		const struct ec_params_flash_region_info *req = req_data;
447 		struct ec_response_flash_region_info *resp = resp_data;
448 		struct fmap_entry *entry;
449 
450 		switch (req->region) {
451 		case EC_FLASH_REGION_RO:
452 		case EC_FLASH_REGION_ACTIVE:
453 		case EC_FLASH_REGION_WP_RO:
454 			entry = &ec->ec_config.region[req->region];
455 			resp->offset = entry->offset;
456 			resp->size = entry->length;
457 			len = sizeof(*resp);
458 			printf("EC flash region %d: offset=%#x, size=%#x\n",
459 			       req->region, resp->offset, resp->size);
460 			break;
461 		default:
462 			printf("** Unknown flash region %d\n", req->region);
463 			return -1;
464 		}
465 		break;
466 	}
467 	case EC_CMD_FLASH_ERASE: {
468 		const struct ec_params_flash_erase *req = req_data;
469 
470 		memset(ec->flash_data + req->offset,
471 		       ec->ec_config.flash_erase_value,
472 		       req->size);
473 		len = 0;
474 		break;
475 	}
476 	case EC_CMD_FLASH_WRITE: {
477 		const struct ec_params_flash_write *req = req_data;
478 
479 		memcpy(ec->flash_data + req->offset, req + 1, req->size);
480 		len = 0;
481 		break;
482 	}
483 	case EC_CMD_MKBP_STATE:
484 		len = cros_ec_keyscan(ec, resp_data);
485 		break;
486 	case EC_CMD_ENTERING_MODE:
487 		len = 0;
488 		break;
489 	case EC_CMD_GET_NEXT_EVENT: {
490 		struct ec_response_get_next_event *resp = resp_data;
491 
492 		resp->event_type = EC_MKBP_EVENT_KEY_MATRIX;
493 		cros_ec_keyscan(ec, resp->data.key_matrix);
494 		len = sizeof(*resp);
495 		break;
496 	}
497 	case EC_CMD_GET_SKU_ID: {
498 		struct ec_sku_id_info *resp = resp_data;
499 
500 		resp->sku_id = 1234;
501 		len = sizeof(*resp);
502 		break;
503 	}
504 	case EC_CMD_GET_FEATURES: {
505 		struct ec_response_get_features *resp = resp_data;
506 
507 		resp->flags[0] = EC_FEATURE_MASK_0(EC_FEATURE_FLASH) |
508 			EC_FEATURE_MASK_0(EC_FEATURE_I2C) |
509 			EC_FEATURE_MASK_0(EC_FEATURE_VSTORE);
510 		resp->flags[1] =
511 			EC_FEATURE_MASK_1(EC_FEATURE_UNIFIED_WAKE_MASKS) |
512 			EC_FEATURE_MASK_1(EC_FEATURE_ISH);
513 		len = sizeof(*resp);
514 		break;
515 	}
516 	case EC_CMD_VSTORE_INFO: {
517 		struct ec_response_vstore_info *resp = resp_data;
518 		int i;
519 
520 		resp->slot_count = VSTORE_SLOT_COUNT;
521 		resp->slot_locked = 0;
522 		for (i = 0; i < VSTORE_SLOT_COUNT; i++) {
523 			if (ec->slot[i].locked)
524 				resp->slot_locked |= 1 << i;
525 		}
526 		len = sizeof(*resp);
527 		break;
528 	};
529 	case EC_CMD_VSTORE_WRITE: {
530 		const struct ec_params_vstore_write *req = req_data;
531 		struct vstore_slot *slot;
532 
533 		if (req->slot >= EC_VSTORE_SLOT_MAX)
534 			return -EINVAL;
535 		slot = &ec->slot[req->slot];
536 		slot->locked = true;
537 		memcpy(slot->data, req->data, EC_VSTORE_SLOT_SIZE);
538 		len = 0;
539 		break;
540 	}
541 	case EC_CMD_VSTORE_READ: {
542 		const struct ec_params_vstore_read *req = req_data;
543 		struct ec_response_vstore_read *resp = resp_data;
544 		struct vstore_slot *slot;
545 
546 		if (req->slot >= EC_VSTORE_SLOT_MAX)
547 			return -EINVAL;
548 		slot = &ec->slot[req->slot];
549 		memcpy(resp->data, slot->data, EC_VSTORE_SLOT_SIZE);
550 		len = sizeof(*resp);
551 		break;
552 	}
553 	default:
554 		printf("   ** Unknown EC command %#02x\n", req_hdr->command);
555 		return -1;
556 	}
557 
558 	return len;
559 }
560 
cros_ec_sandbox_packet(struct udevice * udev,int out_bytes,int in_bytes)561 int cros_ec_sandbox_packet(struct udevice *udev, int out_bytes, int in_bytes)
562 {
563 	struct cros_ec_dev *dev = dev_get_uclass_priv(udev);
564 	struct ec_state *ec = dev_get_priv(dev->dev);
565 	struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
566 	const void *req_data = req_hdr + 1;
567 	struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
568 	void *resp_data = resp_hdr + 1;
569 	int len;
570 
571 	len = process_cmd(ec, req_hdr, req_data, resp_hdr, resp_data);
572 	if (len < 0)
573 		return len;
574 
575 	resp_hdr->struct_version = 3;
576 	resp_hdr->result = EC_RES_SUCCESS;
577 	resp_hdr->data_len = len;
578 	resp_hdr->reserved = 0;
579 	len += sizeof(*resp_hdr);
580 	resp_hdr->checksum = 0;
581 	resp_hdr->checksum = (uint8_t)
582 		-cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
583 
584 	return in_bytes;
585 }
586 
cros_ec_check_keyboard(struct udevice * dev)587 void cros_ec_check_keyboard(struct udevice *dev)
588 {
589 	struct ec_state *ec = dev_get_priv(dev);
590 	ulong start;
591 
592 	printf("Press keys for EC to detect on reset (ESC=recovery)...");
593 	start = get_timer(0);
594 	while (get_timer(start) < 1000)
595 		;
596 	putc('\n');
597 	if (!sandbox_sdl_key_pressed(KEY_ESC)) {
598 		ec->recovery_req = true;
599 		printf("   - EC requests recovery\n");
600 	}
601 }
602 
603 /* Return the byte of EC switch states */
cros_ec_sandbox_get_switches(struct udevice * dev)604 static int cros_ec_sandbox_get_switches(struct udevice *dev)
605 {
606 	struct ec_state *ec = dev_get_priv(dev);
607 
608 	return ec->test_flags & CROSECT_LID_OPEN ? EC_SWITCH_LID_OPEN : 0;
609 }
610 
sandbox_cros_ec_set_test_flags(struct udevice * dev,uint flags)611 void sandbox_cros_ec_set_test_flags(struct udevice *dev, uint flags)
612 {
613 	struct ec_state *ec = dev_get_priv(dev);
614 
615 	ec->test_flags = flags;
616 }
617 
cros_ec_probe(struct udevice * dev)618 int cros_ec_probe(struct udevice *dev)
619 {
620 	struct ec_state *ec = dev_get_priv(dev);
621 	struct cros_ec_dev *cdev = dev_get_uclass_priv(dev);
622 	struct udevice *keyb_dev;
623 	ofnode node;
624 	int err;
625 
626 	memcpy(ec, &s_state, sizeof(*ec));
627 	err = cros_ec_decode_ec_flash(dev, &ec->ec_config);
628 	if (err) {
629 		debug("%s: Cannot device EC flash\n", __func__);
630 		return err;
631 	}
632 
633 	node = ofnode_null();
634 	for (device_find_first_child(dev, &keyb_dev);
635 	     keyb_dev;
636 	     device_find_next_child(&keyb_dev)) {
637 		if (device_get_uclass_id(keyb_dev) == UCLASS_KEYBOARD) {
638 			node = dev_ofnode(keyb_dev);
639 			break;
640 		}
641 	}
642 	if (!ofnode_valid(node)) {
643 		debug("%s: No cros_ec keyboard found\n", __func__);
644 	} else if (keyscan_read_fdt_matrix(ec, node)) {
645 		debug("%s: Could not read key matrix\n", __func__);
646 		return -1;
647 	}
648 
649 	/* If we loaded EC data, check that the length matches */
650 	if (ec->flash_data &&
651 	    ec->flash_data_len != ec->ec_config.flash.length) {
652 		printf("EC data length is %x, expected %x, discarding data\n",
653 		       ec->flash_data_len, ec->ec_config.flash.length);
654 		free(ec->flash_data);
655 		ec->flash_data = NULL;
656 	}
657 
658 	/* Otherwise allocate the memory */
659 	if (!ec->flash_data) {
660 		ec->flash_data_len = ec->ec_config.flash.length;
661 		ec->flash_data = malloc(ec->flash_data_len);
662 		if (!ec->flash_data)
663 			return -ENOMEM;
664 	}
665 
666 	cdev->dev = dev;
667 	g_state = ec;
668 	return cros_ec_register(dev);
669 }
670 
671 struct dm_cros_ec_ops cros_ec_ops = {
672 	.packet = cros_ec_sandbox_packet,
673 	.get_switches = cros_ec_sandbox_get_switches,
674 };
675 
676 static const struct udevice_id cros_ec_ids[] = {
677 	{ .compatible = "google,cros-ec-sandbox" },
678 	{ }
679 };
680 
681 U_BOOT_DRIVER(google_cros_ec_sandbox) = {
682 	.name		= "google_cros_ec_sandbox",
683 	.id		= UCLASS_CROS_EC,
684 	.of_match	= cros_ec_ids,
685 	.probe		= cros_ec_probe,
686 	.priv_auto	= sizeof(struct ec_state),
687 	.ops		= &cros_ec_ops,
688 };
689