Merge branch 'master' of git://git.denx.de/u-boot-arm into master

Conflicts:
	arch/arm/cpu/arm926ejs/mxs/mxsimage.mx23.cfg
	arch/arm/cpu/arm926ejs/mxs/mxsimage.mx28.cfg

Signed-off-by: Stefano Babic <sbabic@denx.de>

6 files changed, 1180 insertions, 165 deletions

diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 0f9f6f1fdd..2f2e48f979 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_CBMEM_CONSOLE) += cbmem_console.o
 obj-$(CONFIG_CROS_EC) += cros_ec.o
 obj-$(CONFIG_CROS_EC_LPC) += cros_ec_lpc.o
 obj-$(CONFIG_CROS_EC_I2C) += cros_ec_i2c.o
+obj-$(CONFIG_CROS_EC_SANDBOX) += cros_ec_sandbox.o
 obj-$(CONFIG_CROS_EC_SPI) += cros_ec_spi.o
 obj-$(CONFIG_FSL_IIM) += fsl_iim.o
 obj-$(CONFIG_GPIO_LED) += gpio_led.o
diff --git a/drivers/misc/cros_ec.c b/drivers/misc/cros_ec.c
index 301e8ebbf5..068373b942 100644
--- a/drivers/misc/cros_ec.c
+++ b/drivers/misc/cros_ec.c
@@ -7,10 +7,11 @@
  */
 
 /*
- * The Matrix Keyboard Protocol driver handles talking to the keyboard
- * controller chip. Mostly this is for keyboard functions, but some other
- * things have slipped in, so we provide generic services to talk to the
- * KBC.
+ * This is the interface to the Chrome OS EC. It provides keyboard functions,
+ * power control and battery management. Quite a few other functions are
+ * provided to enable the EC software to be updated, talk to the EC's I2C bus
+ * and store a small amount of data in a memory which persists while the EC
+ * is not reset.
  */
 
 #include <common.h>
@@ -20,6 +21,7 @@
 #include <fdtdec.h>
 #include <malloc.h>
 #include <spi.h>
+#include <asm/errno.h>
 #include <asm/io.h>
 #include <asm-generic/gpio.h>
 
@@ -73,11 +75,184 @@ int cros_ec_calc_checksum(const uint8_t *data, int size)
 	return csum & 0xff;
 }
 
+/**
+ * Create a request packet for protocol version 3.
+ *
+ * The packet is stored in the device's internal output buffer.
+ *
+ * @param dev		CROS-EC device
+ * @param cmd		Command to send (EC_CMD_...)
+ * @param cmd_version	Version of command to send (EC_VER_...)
+ * @param dout          Output data (may be NULL If dout_len=0)
+ * @param dout_len      Size of output data in bytes
+ * @return packet size in bytes, or <0 if error.
+ */
+static int create_proto3_request(struct cros_ec_dev *dev,
+				 int cmd, int cmd_version,
+				 const void *dout, int dout_len)
+{
+	struct ec_host_request *rq = (struct ec_host_request *)dev->dout;
+	int out_bytes = dout_len + sizeof(*rq);
+
+	/* Fail if output size is too big */
+	if (out_bytes > (int)sizeof(dev->dout)) {
+		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
+		return -EC_RES_REQUEST_TRUNCATED;
+	}
+
+	/* Fill in request packet */
+	rq->struct_version = EC_HOST_REQUEST_VERSION;
+	rq->checksum = 0;
+	rq->command = cmd;
+	rq->command_version = cmd_version;
+	rq->reserved = 0;
+	rq->data_len = dout_len;
+
+	/* Copy data after header */
+	memcpy(rq + 1, dout, dout_len);
+
+	/* Write checksum field so the entire packet sums to 0 */
+	rq->checksum = (uint8_t)(-cros_ec_calc_checksum(dev->dout, out_bytes));
+
+	cros_ec_dump_data("out", cmd, dev->dout, out_bytes);
+
+	/* Return size of request packet */
+	return out_bytes;
+}
+
+/**
+ * Prepare the device to receive a protocol version 3 response.
+ *
+ * @param dev		CROS-EC device
+ * @param din_len       Maximum size of response in bytes
+ * @return maximum expected number of bytes in response, or <0 if error.
+ */
+static int prepare_proto3_response_buffer(struct cros_ec_dev *dev, int din_len)
+{
+	int in_bytes = din_len + sizeof(struct ec_host_response);
+
+	/* Fail if input size is too big */
+	if (in_bytes > (int)sizeof(dev->din)) {
+		debug("%s: Cannot receive %d bytes\n", __func__, din_len);
+		return -EC_RES_RESPONSE_TOO_BIG;
+	}
+
+	/* Return expected size of response packet */
+	return in_bytes;
+}
+
+/**
+ * Handle a protocol version 3 response packet.
+ *
+ * The packet must already be stored in the device's internal input buffer.
+ *
+ * @param dev		CROS-EC device
+ * @param dinp          Returns pointer to response data
+ * @param din_len       Maximum size of response in bytes
+ * @return number of bytes of response data, or <0 if error
+ */
+static int handle_proto3_response(struct cros_ec_dev *dev,
+				  uint8_t **dinp, int din_len)
+{
+	struct ec_host_response *rs = (struct ec_host_response *)dev->din;
+	int in_bytes;
+	int csum;
+
+	cros_ec_dump_data("in-header", -1, dev->din, sizeof(*rs));
+
+	/* Check input data */
+	if (rs->struct_version != EC_HOST_RESPONSE_VERSION) {
+		debug("%s: EC response version mismatch\n", __func__);
+		return -EC_RES_INVALID_RESPONSE;
+	}
+
+	if (rs->reserved) {
+		debug("%s: EC response reserved != 0\n", __func__);
+		return -EC_RES_INVALID_RESPONSE;
+	}
+
+	if (rs->data_len > din_len) {
+		debug("%s: EC returned too much data\n", __func__);
+		return -EC_RES_RESPONSE_TOO_BIG;
+	}
+
+	cros_ec_dump_data("in-data", -1, dev->din + sizeof(*rs), rs->data_len);
+
+	/* Update in_bytes to actual data size */
+	in_bytes = sizeof(*rs) + rs->data_len;
+
+	/* Verify checksum */
+	csum = cros_ec_calc_checksum(dev->din, in_bytes);
+	if (csum) {
+		debug("%s: EC response checksum invalid: 0x%02x\n", __func__,
+		      csum);
+		return -EC_RES_INVALID_CHECKSUM;
+	}
+
+	/* Return error result, if any */
+	if (rs->result)
+		return -(int)rs->result;
+
+	/* If we're still here, set response data pointer and return length */
+	*dinp = (uint8_t *)(rs + 1);
+
+	return rs->data_len;
+}
+
+static int send_command_proto3(struct cros_ec_dev *dev,
+			       int cmd, int cmd_version,
+			       const void *dout, int dout_len,
+			       uint8_t **dinp, int din_len)
+{
+	int out_bytes, in_bytes;
+	int rv;
+
+	/* Create request packet */
+	out_bytes = create_proto3_request(dev, cmd, cmd_version,
+					  dout, dout_len);
+	if (out_bytes < 0)
+		return out_bytes;
+
+	/* Prepare response buffer */
+	in_bytes = prepare_proto3_response_buffer(dev, din_len);
+	if (in_bytes < 0)
+		return in_bytes;
+
+	switch (dev->interface) {
+#ifdef CONFIG_CROS_EC_SPI
+	case CROS_EC_IF_SPI:
+		rv = cros_ec_spi_packet(dev, out_bytes, in_bytes);
+		break;
+#endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case CROS_EC_IF_SANDBOX:
+		rv = cros_ec_sandbox_packet(dev, out_bytes, in_bytes);
+		break;
+#endif
+	case CROS_EC_IF_NONE:
+	/* TODO: support protocol 3 for LPC, I2C; for now fall through */
+	default:
+		debug("%s: Unsupported interface\n", __func__);
+		rv = -1;
+	}
+	if (rv < 0)
+		return rv;
+
+	/* Process the response */
+	return handle_proto3_response(dev, dinp, din_len);
+}
+
 static int send_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 			const void *dout, int dout_len,
 			uint8_t **dinp, int din_len)
 {
-	int ret;
+	int ret = -1;
+
+	/* Handle protocol version 3 support */
+	if (dev->protocol_version == 3) {
+		return send_command_proto3(dev, cmd, cmd_version,
+					   dout, dout_len, dinp, din_len);
+	}
 
 	switch (dev->interface) {
 #ifdef CONFIG_CROS_EC_SPI
@@ -129,19 +304,15 @@ static int ec_command_inptr(struct cros_ec_dev *dev, uint8_t cmd,
 		int cmd_version, const void *dout, int dout_len, uint8_t **dinp,
 		int din_len)
 {
-	uint8_t *din;
+	uint8_t *din = NULL;
 	int len;
 
-	if (cmd_version != 0 && !dev->cmd_version_is_supported) {
-		debug("%s: Command version >0 unsupported\n", __func__);
-		return -1;
-	}
 	len = send_command(dev, cmd, cmd_version, dout, dout_len,
 				&din, din_len);
 
 	/* If the command doesn't complete, wait a while */
 	if (len == -EC_RES_IN_PROGRESS) {
-		struct ec_response_get_comms_status *resp;
+		struct ec_response_get_comms_status *resp = NULL;
 		ulong start;
 
 		/* Wait for command to complete */
@@ -169,7 +340,8 @@ static int ec_command_inptr(struct cros_ec_dev *dev, uint8_t cmd,
 				NULL, 0, &din, din_len);
 	}
 
-	debug("%s: len=%d, dinp=%p, *dinp=%p\n", __func__, len, dinp, *dinp);
+	debug("%s: len=%d, dinp=%p, *dinp=%p\n", __func__, len, dinp,
+	      dinp ? *dinp : NULL);
 	if (dinp) {
 		/* If we have any data to return, it must be 64bit-aligned */
 		assert(len <= 0 || !((uintptr_t)din & 7));
@@ -220,8 +392,8 @@ static int ec_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 
 int cros_ec_scan_keyboard(struct cros_ec_dev *dev, struct mbkp_keyscan *scan)
 {
-	if (ec_command(dev, EC_CMD_CROS_EC_STATE, 0, NULL, 0, scan,
-		       sizeof(scan->data)) < sizeof(scan->data))
+	if (ec_command(dev, EC_CMD_MKBP_STATE, 0, NULL, 0, scan,
+		       sizeof(scan->data)) != sizeof(scan->data))
 		return -1;
 
 	return 0;
@@ -232,10 +404,10 @@ int cros_ec_read_id(struct cros_ec_dev *dev, char *id, int maxlen)
 	struct ec_response_get_version *r;
 
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
-			(uint8_t **)&r, sizeof(*r)) < sizeof(*r))
+			(uint8_t **)&r, sizeof(*r)) != sizeof(*r))
 		return -1;
 
-	if (maxlen > sizeof(r->version_string_ro))
+	if (maxlen > (int)sizeof(r->version_string_ro))
 		maxlen = sizeof(r->version_string_ro);
 
 	switch (r->current_image) {
@@ -258,7 +430,7 @@ int cros_ec_read_version(struct cros_ec_dev *dev,
 {
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
 			(uint8_t **)versionp, sizeof(**versionp))
-			< sizeof(**versionp))
+			!= sizeof(**versionp))
 		return -1;
 
 	return 0;
@@ -267,7 +439,7 @@ int cros_ec_read_version(struct cros_ec_dev *dev,
 int cros_ec_read_build_info(struct cros_ec_dev *dev, char **strp)
 {
 	if (ec_command_inptr(dev, EC_CMD_GET_BUILD_INFO, 0, NULL, 0,
-			(uint8_t **)strp, EC_HOST_PARAM_SIZE) < 0)
+			(uint8_t **)strp, EC_PROTO2_MAX_PARAM_SIZE) < 0)
 		return -1;
 
 	return 0;
@@ -279,7 +451,7 @@ int cros_ec_read_current_image(struct cros_ec_dev *dev,
 	struct ec_response_get_version *r;
 
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
-			(uint8_t **)&r, sizeof(*r)) < sizeof(*r))
+			(uint8_t **)&r, sizeof(*r)) != sizeof(*r))
 		return -1;
 
 	*image = r->current_image;
@@ -336,7 +508,7 @@ int cros_ec_read_hash(struct cros_ec_dev *dev,
 	debug("%s: No valid hash (status=%d size=%d). Compute one...\n",
 	      __func__, hash->status, hash->size);
 
-	p.cmd = EC_VBOOT_HASH_RECALC;
+	p.cmd = EC_VBOOT_HASH_START;
 	p.hash_type = EC_VBOOT_HASH_TYPE_SHA256;
 	p.nonce_size = 0;
 	p.offset = EC_VBOOT_HASH_OFFSET_RW;
@@ -413,15 +585,15 @@ int cros_ec_interrupt_pending(struct cros_ec_dev *dev)
 {
 	/* no interrupt support : always poll */
 	if (!fdt_gpio_isvalid(&dev->ec_int))
-		return 1;
+		return -ENOENT;
 
 	return !gpio_get_value(dev->ec_int.gpio);
 }
 
-int cros_ec_info(struct cros_ec_dev *dev, struct ec_response_cros_ec_info *info)
+int cros_ec_info(struct cros_ec_dev *dev, struct ec_response_mkbp_info *info)
 {
-	if (ec_command(dev, EC_CMD_CROS_EC_INFO, 0, NULL, 0, info,
-			sizeof(*info)) < sizeof(*info))
+	if (ec_command(dev, EC_CMD_MKBP_INFO, 0, NULL, 0, info,
+		       sizeof(*info)) != sizeof(*info))
 		return -1;
 
 	return 0;
@@ -436,7 +608,7 @@ int cros_ec_get_host_events(struct cros_ec_dev *dev, uint32_t *events_ptr)
 	 * used by ACPI/SMI.
 	 */
 	if (ec_command_inptr(dev, EC_CMD_HOST_EVENT_GET_B, 0, NULL, 0,
-		       (uint8_t **)&resp, sizeof(*resp)) < sizeof(*resp))
+		       (uint8_t **)&resp, sizeof(*resp)) < (int)sizeof(*resp))
 		return -1;
 
 	if (resp->mask & EC_HOST_EVENT_MASK(EC_HOST_EVENT_INVALID))
@@ -474,7 +646,7 @@ int cros_ec_flash_protect(struct cros_ec_dev *dev,
 
 	if (ec_command(dev, EC_CMD_FLASH_PROTECT, EC_VER_FLASH_PROTECT,
 		       &params, sizeof(params),
-		       resp, sizeof(*resp)) < sizeof(*resp))
+		       resp, sizeof(*resp)) != sizeof(*resp))
 		return -1;
 
 	return 0;
@@ -504,23 +676,30 @@ static int cros_ec_check_version(struct cros_ec_dev *dev)
 	 *
 	 * So for now, just read all the data anyway.
 	 */
-	dev->cmd_version_is_supported = 1;
+
+	/* Try sending a version 3 packet */
+	dev->protocol_version = 3;
+	if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req, sizeof(req),
+			     (uint8_t **)&resp, sizeof(*resp)) > 0) {
+		return 0;
+	}
+
+	/* Try sending a version 2 packet */
+	dev->protocol_version = 2;
 	if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req, sizeof(req),
 		       (uint8_t **)&resp, sizeof(*resp)) > 0) {
-		/* It appears to understand new version commands */
-		dev->cmd_version_is_supported = 1;
-	} else {
-		dev->cmd_version_is_supported = 0;
-		if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req,
-			      sizeof(req), (uint8_t **)&resp,
-			      sizeof(*resp)) < 0) {
-			debug("%s: Failed both old and new command style\n",
-				__func__);
-			return -1;
-		}
+		return 0;
 	}
 
-	return 0;
+	/*
+	 * Fail if we're still here, since the EC doesn't understand any
+	 * protcol version we speak.  Version 1 interface without command
+	 * version is no longer supported, and we don't know about any new
+	 * protocol versions.
+	 */
+	dev->protocol_version = 0;
+	printf("%s: ERROR: old EC interface not supported\n", __func__);
+	return -1;
 }
 
 int cros_ec_test(struct cros_ec_dev *dev)
@@ -599,8 +778,8 @@ static int cros_ec_flash_write_block(struct cros_ec_dev *dev,
 
 	p.offset = offset;
 	p.size = size;
-	assert(data && p.size <= sizeof(p.data));
-	memcpy(p.data, data, p.size);
+	assert(data && p.size <= EC_FLASH_WRITE_VER0_SIZE);
+	memcpy(&p + 1, data, p.size);
 
 	return ec_command_inptr(dev, EC_CMD_FLASH_WRITE, 0,
 			  &p, sizeof(p), NULL, 0) >= 0 ? 0 : -1;
@@ -611,8 +790,7 @@ static int cros_ec_flash_write_block(struct cros_ec_dev *dev,
  */
 static int cros_ec_flash_write_burst_size(struct cros_ec_dev *dev)
 {
-	struct ec_params_flash_write p;
-	return sizeof(p.data);
+	return EC_FLASH_WRITE_VER0_SIZE;
 }
 
 /**
@@ -718,7 +896,7 @@ int cros_ec_flash_update_rw(struct cros_ec_dev *dev,
 
 	if (cros_ec_flash_offset(dev, EC_FLASH_REGION_RW, &rw_offset, &rw_size))
 		return -1;
-	if (image_size > rw_size)
+	if (image_size > (int)rw_size)
 		return -1;
 
 	/* Invalidate the existing hash, just in case the AP reboots
@@ -804,7 +982,7 @@ int cros_ec_get_ldo(struct cros_ec_dev *dev, uint8_t index, uint8_t *state)
 
 	if (ec_command_inptr(dev, EC_CMD_LDO_GET, 0,
 		       &params, sizeof(params),
-		       (uint8_t **)&resp, sizeof(*resp)) < sizeof(*resp))
+		       (uint8_t **)&resp, sizeof(*resp)) != sizeof(*resp))
 		return -1;
 
 	*state = resp->state;
@@ -813,7 +991,8 @@ int cros_ec_get_ldo(struct cros_ec_dev *dev, uint8_t index, uint8_t *state)
 }
 
 /**
- * Decode MBKP details from the device tree and allocate a suitable device.
+ * Decode EC interface details from the device tree and allocate a suitable
+ * device.
  *
  * @param blob		Device tree blob
  * @param node		Node to decode from
@@ -859,6 +1038,11 @@ static int cros_ec_decode_fdt(const void *blob, int node,
 		dev->interface = CROS_EC_IF_LPC;
 		break;
 #endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case COMPAT_SANDBOX_HOST_EMULATION:
+		dev->interface = CROS_EC_IF_SANDBOX;
+		break;
+#endif
 	default:
 		debug("%s: Unknown compat id %d\n", __func__, compat);
 		return -1;
@@ -914,6 +1098,12 @@ int cros_ec_init(const void *blob, struct cros_ec_dev **cros_ecp)
 			return -CROS_EC_ERR_DEV_INIT;
 		break;
 #endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case CROS_EC_IF_SANDBOX:
+		if (cros_ec_sandbox_init(dev, blob))
+			return -CROS_EC_ERR_DEV_INIT;
+		break;
+#endif
 	case CROS_EC_IF_NONE:
 	default:
 		return 0;
@@ -941,7 +1131,6 @@ int cros_ec_init(const void *blob, struct cros_ec_dev **cros_ecp)
 	return 0;
 }
 
-#ifdef CONFIG_CMD_CROS_EC
 int cros_ec_decode_region(int argc, char * const argv[])
 {
 	if (argc > 0) {
@@ -958,6 +1147,139 @@ int cros_ec_decode_region(int argc, char * const argv[])
 	return -1;
 }
 
+int cros_ec_decode_ec_flash(const void *blob, struct fdt_cros_ec *config)
+{
+	int flash_node, node;
+
+	node = fdtdec_next_compatible(blob, 0, COMPAT_GOOGLE_CROS_EC);
+	if (node < 0) {
+		debug("Failed to find chrome-ec node'\n");
+		return -1;
+	}
+
+	flash_node = fdt_subnode_offset(blob, node, "flash");
+	if (flash_node < 0) {
+		debug("Failed to find flash node\n");
+		return -1;
+	}
+
+	if (fdtdec_read_fmap_entry(blob, flash_node, "flash",
+				   &config->flash)) {
+		debug("Failed to decode flash node in chrome-ec'\n");
+		return -1;
+	}
+
+	config->flash_erase_value = fdtdec_get_int(blob, flash_node,
+						    "erase-value", -1);
+	for (node = fdt_first_subnode(blob, flash_node); node >= 0;
+	     node = fdt_next_subnode(blob, node)) {
+		const char *name = fdt_get_name(blob, node, NULL);
+		enum ec_flash_region region;
+
+		if (0 == strcmp(name, "ro")) {
+			region = EC_FLASH_REGION_RO;
+		} else if (0 == strcmp(name, "rw")) {
+			region = EC_FLASH_REGION_RW;
+		} else if (0 == strcmp(name, "wp-ro")) {
+			region = EC_FLASH_REGION_WP_RO;
+		} else {
+			debug("Unknown EC flash region name '%s'\n", name);
+			return -1;
+		}
+
+		if (fdtdec_read_fmap_entry(blob, node, "reg",
+					   &config->region[region])) {
+			debug("Failed to decode flash region in chrome-ec'\n");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+int cros_ec_i2c_xfer(struct cros_ec_dev *dev, uchar chip, uint addr,
+		     int alen, uchar *buffer, int len, int is_read)
+{
+	union {
+		struct ec_params_i2c_passthru p;
+		uint8_t outbuf[EC_PROTO2_MAX_PARAM_SIZE];
+	} params;
+	union {
+		struct ec_response_i2c_passthru r;
+		uint8_t inbuf[EC_PROTO2_MAX_PARAM_SIZE];
+	} response;
+	struct ec_params_i2c_passthru *p = &params.p;
+	struct ec_response_i2c_passthru *r = &response.r;
+	struct ec_params_i2c_passthru_msg *msg = p->msg;
+	uint8_t *pdata;
+	int read_len, write_len;
+	int size;
+	int rv;
+
+	p->port = 0;
+
+	if (alen != 1) {
+		printf("Unsupported address length %d\n", alen);
+		return -1;
+	}
+	if (is_read) {
+		read_len = len;
+		write_len = alen;
+		p->num_msgs = 2;
+	} else {
+		read_len = 0;
+		write_len = alen + len;
+		p->num_msgs = 1;
+	}
+
+	size = sizeof(*p) + p->num_msgs * sizeof(*msg);
+	if (size + write_len > sizeof(params)) {
+		puts("Params too large for buffer\n");
+		return -1;
+	}
+	if (sizeof(*r) + read_len > sizeof(response)) {
+		puts("Read length too big for buffer\n");
+		return -1;
+	}
+
+	/* Create a message to write the register address and optional data */
+	pdata = (uint8_t *)p + size;
+	msg->addr_flags = chip;
+	msg->len = write_len;
+	pdata[0] = addr;
+	if (!is_read)
+		memcpy(pdata + 1, buffer, len);
+	msg++;
+
+	if (read_len) {
+		msg->addr_flags = chip | EC_I2C_FLAG_READ;
+		msg->len = read_len;
+	}
+
+	rv = ec_command(dev, EC_CMD_I2C_PASSTHRU, 0, p, size + write_len,
+			r, sizeof(*r) + read_len);
+	if (rv < 0)
+		return rv;
+
+	/* Parse response */
+	if (r->i2c_status & EC_I2C_STATUS_ERROR) {
+		printf("Transfer failed with status=0x%x\n", r->i2c_status);
+		return -1;
+	}
+
+	if (rv < sizeof(*r) + read_len) {
+		puts("Truncated read response\n");
+		return -1;
+	}
+
+	if (read_len)
+		memcpy(buffer, r->data, read_len);
+
+	return 0;
+}
+
+#ifdef CONFIG_CMD_CROS_EC
+
 /**
  * Perform a flash read or write command
  *
@@ -1011,6 +1333,187 @@ static int do_read_write(struct cros_ec_dev *dev, int is_write, int argc,
 	return 0;
 }
 
+/**
+ * get_alen() - Small parser helper function to get address length
+ *
+ * Returns the address length.
+ */
+static uint get_alen(char *arg)
+{
+	int	j;
+	int	alen;
+
+	alen = 1;
+	for (j = 0; j < 8; j++) {
+		if (arg[j] == '.') {
+			alen = arg[j+1] - '0';
+			break;
+		} else if (arg[j] == '\0') {
+			break;
+		}
+	}
+	return alen;
+}
+
+#define DISP_LINE_LEN	16
+
+/*
+ * TODO(sjg@chromium.org): This code copied almost verbatim from cmd_i2c.c
+ * so we can remove it later.
+ */
+static int cros_ec_i2c_md(struct cros_ec_dev *dev, int flag, int argc,
+			  char * const argv[])
+{
+	u_char	chip;
+	uint	addr, alen, length = 0x10;
+	int	j, nbytes, linebytes;
+
+	if (argc < 2)
+		return CMD_RET_USAGE;
+
+	if (1 || (flag & CMD_FLAG_REPEAT) == 0) {
+		/*
+		 * New command specified.
+		 */
+
+		/*
+		 * I2C chip address
+		 */
+		chip = simple_strtoul(argv[0], NULL, 16);
+
+		/*
+		 * I2C data address within the chip.  This can be 1 or
+		 * 2 bytes long.  Some day it might be 3 bytes long :-).
+		 */
+		addr = simple_strtoul(argv[1], NULL, 16);
+		alen = get_alen(argv[1]);
+		if (alen > 3)
+			return CMD_RET_USAGE;
+
+		/*
+		 * If another parameter, it is the length to display.
+		 * Length is the number of objects, not number of bytes.
+		 */
+		if (argc > 2)
+			length = simple_strtoul(argv[2], NULL, 16);
+	}
+
+	/*
+	 * Print the lines.
+	 *
+	 * We buffer all read data, so we can make sure data is read only
+	 * once.
+	 */
+	nbytes = length;
+	do {
+		unsigned char	linebuf[DISP_LINE_LEN];
+		unsigned char	*cp;
+
+		linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes;
+
+		if (cros_ec_i2c_xfer(dev, chip, addr, alen, linebuf, linebytes,
+				     1))
+			puts("Error reading the chip.\n");
+		else {
+			printf("%04x:", addr);
+			cp = linebuf;
+			for (j = 0; j < linebytes; j++) {
+				printf(" %02x", *cp++);
+				addr++;
+			}
+			puts("    ");
+			cp = linebuf;
+			for (j = 0; j < linebytes; j++) {
+				if ((*cp < 0x20) || (*cp > 0x7e))
+					puts(".");
+				else
+					printf("%c", *cp);
+				cp++;
+			}
+			putc('\n');
+		}
+		nbytes -= linebytes;
+	} while (nbytes > 0);
+
+	return 0;
+}
+
+static int cros_ec_i2c_mw(struct cros_ec_dev *dev, int flag, int argc,
+			  char * const argv[])
+{
+	uchar	chip;
+	ulong	addr;
+	uint	alen;
+	uchar	byte;
+	int	count;
+
+	if ((argc < 3) || (argc > 4))
+		return CMD_RET_USAGE;
+
+	/*
+	 * Chip is always specified.
+	 */
+	chip = simple_strtoul(argv[0], NULL, 16);
+
+	/*
+	 * Address is always specified.
+	 */
+	addr = simple_strtoul(argv[1], NULL, 16);
+	alen = get_alen(argv[1]);
+	if (alen > 3)
+		return CMD_RET_USAGE;
+
+	/*
+	 * Value to write is always specified.
+	 */
+	byte = simple_strtoul(argv[2], NULL, 16);
+
+	/*
+	 * Optional count
+	 */
+	if (argc == 4)
+		count = simple_strtoul(argv[3], NULL, 16);
+	else
+		count = 1;
+
+	while (count-- > 0) {
+		if (cros_ec_i2c_xfer(dev, chip, addr++, alen, &byte, 1, 0))
+			puts("Error writing the chip.\n");
+		/*
+		 * Wait for the write to complete.  The write can take
+		 * up to 10mSec (we allow a little more time).
+		 */
+/*
+ * No write delay with FRAM devices.
+ */
+#if !defined(CONFIG_SYS_I2C_FRAM)
+		udelay(11000);
+#endif
+	}
+
+	return 0;
+}
+
+/* Temporary code until we have driver model and can use the i2c command */
+static int cros_ec_i2c_passthrough(struct cros_ec_dev *dev, int flag,
+				   int argc, char * const argv[])
+{
+	const char *cmd;
+
+	if (argc < 1)
+		return CMD_RET_USAGE;
+	cmd = *argv++;
+	argc--;
+	if (0 == strcmp("md", cmd))
+		cros_ec_i2c_md(dev, flag, argc, argv);
+	else if (0 == strcmp("mw", cmd))
+		cros_ec_i2c_mw(dev, flag, argc, argv);
+	else
+		return CMD_RET_USAGE;
+
+	return 0;
+}
+
 static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	struct cros_ec_dev *dev = last_dev;
@@ -1044,7 +1547,7 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 		}
 		printf("%s\n", id);
 	} else if (0 == strcmp("info", cmd)) {
-		struct ec_response_cros_ec_info info;
+		struct ec_response_mkbp_info info;
 
 		if (cros_ec_info(dev, &info)) {
 			debug("%s: Could not read KBC info\n", __func__);
@@ -1213,10 +1716,10 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 		if (!ret) {
 			/* Print versions */
 			printf("RO version:    %1.*s\n",
-			       sizeof(p->version_string_ro),
+			       (int)sizeof(p->version_string_ro),
 			       p->version_string_ro);
 			printf("RW version:    %1.*s\n",
-			       sizeof(p->version_string_rw),
+			       (int)sizeof(p->version_string_rw),
 			       p->version_string_rw);
 			printf("Firmware copy: %s\n",
 				(p->current_image <
@@ -1254,6 +1757,8 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 			debug("%s: Could not access LDO%d\n", __func__, index);
 			return ret;
 		}
+	} else if (0 == strcmp("i2c", cmd)) {
+		ret = cros_ec_i2c_passthrough(dev, flag, argc - 2, argv + 2);
 	} else {
 		return CMD_RET_USAGE;
 	}
@@ -1267,7 +1772,7 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 }
 
 U_BOOT_CMD(
-	crosec,	5,	1,	do_cros_ec,
+	crosec,	6,	1,	do_cros_ec,
 	"CROS-EC utility command",
 	"init                Re-init CROS-EC (done on startup automatically)\n"
 	"crosec id                  Read CROS-EC ID\n"
@@ -1284,6 +1789,8 @@ U_BOOT_CMD(
 	"crosec vbnvcontext [hexstring]        Read [write] VbNvContext from EC\n"
 	"crosec ldo <idx> [<state>] Switch/Read LDO state\n"
 	"crosec test                run tests on cros_ec\n"
-	"crosec version             Read CROS-EC version"
+	"crosec version             Read CROS-EC version\n"
+	"crosec i2c md chip address[.0, .1, .2] [# of objects] - read from I2C passthru\n"
+	"crosec i2c mw chip address[.0, .1, .2] value [count] - write to I2C passthru (fill)"
 );
 #endif
diff --git a/drivers/misc/cros_ec_i2c.c b/drivers/misc/cros_ec_i2c.c
index 0fbab991b5..513cdb1cb0 100644
--- a/drivers/misc/cros_ec_i2c.c
+++ b/drivers/misc/cros_ec_i2c.c
@@ -35,7 +35,7 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	uint8_t *ptr;
 	/* Receive input data, so that args will be dword aligned */
 	uint8_t *in_ptr;
-	int ret;
+	int len, csum, ret;
 
 	old_bus = i2c_get_bus_num();
 
@@ -67,24 +67,24 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	 * will be dword aligned.
 	 */
 	in_ptr = dev->din + sizeof(int64_t);
-	if (!dev->cmd_version_is_supported) {
-		/* Send an old-style command */
-		*ptr++ = cmd;
-		out_bytes = dout_len + 1;
-		in_bytes = din_len + 2;
-		in_ptr--;	/* Expect just a status byte */
-	} else {
-		*ptr++ = EC_CMD_VERSION0 + cmd_version;
-		*ptr++ = cmd;
-		*ptr++ = dout_len;
-		in_ptr -= 2;	/* Expect status, length bytes */
+
+	if (dev->protocol_version != 2) {
+		/* Something we don't support */
+		debug("%s: Protocol version %d unsupported\n",
+		      __func__, dev->protocol_version);
+		return -1;
 	}
+
+	*ptr++ = EC_CMD_VERSION0 + cmd_version;
+	*ptr++ = cmd;
+	*ptr++ = dout_len;
+	in_ptr -= 2;	/* Expect status, length bytes */
+
 	memcpy(ptr, dout, dout_len);
 	ptr += dout_len;
 
-	if (dev->cmd_version_is_supported)
-		*ptr++ = (uint8_t)
-			 cros_ec_calc_checksum(dev->dout, dout_len + 3);
+	*ptr++ = (uint8_t)
+		cros_ec_calc_checksum(dev->dout, dout_len + 3);
 
 	/* Set to the proper i2c bus */
 	if (i2c_set_bus_num(dev->bus_num)) {
@@ -121,26 +121,20 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 		return -(int)*in_ptr;
 	}
 
-	if (dev->cmd_version_is_supported) {
-		int len, csum;
-
-		len = in_ptr[1];
-		if (len + 3 > sizeof(dev->din)) {
-			debug("%s: Received length %#02x too large\n",
-			      __func__, len);
-			return -1;
-		}
-		csum = cros_ec_calc_checksum(in_ptr, 2 + len);
-		if (csum != in_ptr[2 + len]) {
-			debug("%s: Invalid checksum rx %#02x, calced %#02x\n",
-			      __func__, in_ptr[2 + din_len], csum);
-			return -1;
-		}
-		din_len = min(din_len, len);
-		cros_ec_dump_data("in", -1, in_ptr, din_len + 3);
-	} else {
-		cros_ec_dump_data("in (old)", -1, in_ptr, in_bytes);
+	len = in_ptr[1];
+	if (len + 3 > sizeof(dev->din)) {
+		debug("%s: Received length %#02x too large\n",
+		      __func__, len);
+		return -1;
 	}
+	csum = cros_ec_calc_checksum(in_ptr, 2 + len);
+	if (csum != in_ptr[2 + len]) {
+		debug("%s: Invalid checksum rx %#02x, calced %#02x\n",
+		      __func__, in_ptr[2 + din_len], csum);
+		return -1;
+	}
+	din_len = min(din_len, len);
+	cros_ec_dump_data("in", -1, in_ptr, din_len + 3);
 
 	/* Return pointer to dword-aligned input data, if any */
 	*dinp = dev->din + sizeof(int64_t);
@@ -178,7 +172,5 @@ int cros_ec_i2c_init(struct cros_ec_dev *dev, const void *blob)
 {
 	i2c_init(dev->max_frequency, dev->addr);
 
-	dev->cmd_version_is_supported = 0;
-
 	return 0;
 }
diff --git a/drivers/misc/cros_ec_lpc.c b/drivers/misc/cros_ec_lpc.c
index 725747693d..0e02671c93 100644
--- a/drivers/misc/cros_ec_lpc.c
+++ b/drivers/misc/cros_ec_lpc.c
@@ -40,71 +40,6 @@ static int wait_for_sync(struct cros_ec_dev *dev)
 	return 0;
 }
 
-/**
- * Send a command to a LPC CROS_EC device and return the reply.
- *
- * The device's internal input/output buffers are used.
- *
- * @param dev		CROS_EC device
- * @param cmd		Command to send (EC_CMD_...)
- * @param cmd_version	Version of command to send (EC_VER_...)
- * @param dout          Output data (may be NULL If dout_len=0)
- * @param dout_len      Size of output data in bytes
- * @param dinp          Place to put pointer to response data
- * @param din_len       Maximum size of response in bytes
- * @return number of bytes in response, or -1 on error
- */
-static int old_lpc_command(struct cros_ec_dev *dev, uint8_t cmd,
-		     const uint8_t *dout, int dout_len,
-		     uint8_t **dinp, int din_len)
-{
-	int ret, i;
-
-	if (dout_len > EC_OLD_PARAM_SIZE) {
-		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
-		return -1;
-	}
-
-	if (din_len > EC_OLD_PARAM_SIZE) {
-		debug("%s: Cannot receive %d bytes\n", __func__, din_len);
-		return -1;
-	}
-
-	if (wait_for_sync(dev)) {
-		debug("%s: Timeout waiting ready\n", __func__);
-		return -1;
-	}
-
-	debug_trace("cmd: %02x, ", cmd);
-	for (i = 0; i < dout_len; i++) {
-		debug_trace("%02x ", dout[i]);
-		outb(dout[i], EC_LPC_ADDR_OLD_PARAM + i);
-	}
-	outb(cmd, EC_LPC_ADDR_HOST_CMD);
-	debug_trace("\n");
-
-	if (wait_for_sync(dev)) {
-		debug("%s: Timeout waiting ready\n", __func__);
-		return -1;
-	}
-
-	ret = inb(EC_LPC_ADDR_HOST_DATA);
-	if (ret) {
-		debug("%s: CROS_EC result code %d\n", __func__, ret);
-		return -ret;
-	}
-
-	debug_trace("resp: %02x, ", ret);
-	for (i = 0; i < din_len; i++) {
-		dev->din[i] = inb(EC_LPC_ADDR_OLD_PARAM + i);
-		debug_trace("%02x ", dev->din[i]);
-	}
-	debug_trace("\n");
-	*dinp = dev->din;
-
-	return din_len;
-}
-
 int cros_ec_lpc_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 		     const uint8_t *dout, int dout_len,
 		     uint8_t **dinp, int din_len)
@@ -119,11 +54,6 @@ int cros_ec_lpc_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	int csum;
 	int i;
 
-	/* Fall back to old-style command interface if args aren't supported */
-	if (!dev->cmd_version_is_supported)
-		return old_lpc_command(dev, cmd, dout, dout_len, dinp,
-				       din_len);
-
 	if (dout_len > EC_HOST_PARAM_SIZE) {
 		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
 		return -1;
@@ -256,13 +186,9 @@ int cros_ec_lpc_check_version(struct cros_ec_dev *dev)
 			(inb(EC_LPC_ADDR_MEMMAP +
 				EC_MEMMAP_HOST_CMD_FLAGS) &
 				EC_HOST_CMD_FLAG_LPC_ARGS_SUPPORTED)) {
-		dev->cmd_version_is_supported = 1;
-	} else {
-		/* We are going to use the old IO ports */
-		dev->cmd_version_is_supported = 0;
+		return 0;
 	}
-	debug("lpc: version %s\n", dev->cmd_version_is_supported ?
-			"new" : "old");
 
-	return 0;
+	printf("%s: ERROR: old EC interface not supported\n", __func__);
+	return -1;
 }
diff --git a/drivers/misc/cros_ec_sandbox.c b/drivers/misc/cros_ec_sandbox.c
new file mode 100644
index 0000000000..4bb1d60e5a
--- /dev/null
+++ b/drivers/misc/cros_ec_sandbox.c
@@ -0,0 +1,559 @@
+/*
+ * Chromium OS cros_ec driver - sandbox emulation
+ *
+ * Copyright (c) 2013 The Chromium OS Authors.
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <cros_ec.h>
+#include <ec_commands.h>
+#include <errno.h>
+#include <hash.h>
+#include <malloc.h>
+#include <os.h>
+#include <sha256.h>
+#include <spi.h>
+#include <asm/state.h>
+#include <asm/sdl.h>
+#include <linux/input.h>
+
+/*
+ * Ultimately it shold be possible to connect an Chrome OS EC emulation
+ * to U-Boot and remove all of this code. But this provides a test
+ * environment for bringing up chromeos_sandbox and demonstrating its
+ * utility.
+ *
+ * This emulation includes the following:
+ *
+ * 1. Emulation of the keyboard, by converting keypresses received from SDL
+ * into key scan data, passed back from the EC as key scan messages. The
+ * key layout is read from the device tree.
+ *
+ * 2. Emulation of vboot context - so this can be read/written as required.
+ *
+ * 3. Save/restore of EC state, so that the vboot context, flash memory
+ * contents and current image can be preserved across boots. This is important
+ * since the EC is supposed to continue running even if the AP resets.
+ *
+ * 4. Some event support, in particular allowing Escape to be pressed on boot
+ * to enter recovery mode. The EC passes this to U-Boot through the normal
+ * event message.
+ *
+ * 5. Flash read/write/erase support, so that software sync works. The
+ * protect messages are supported but no protection is implemented.
+ *
+ * 6. Hashing of the EC image, again to support software sync.
+ *
+ * Other features can be added, although a better path is probably to link
+ * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
+ */
+
+DECLARE_GLOBAL_DATA_PTR;
+
+#define KEYBOARD_ROWS	8
+#define KEYBOARD_COLS	13
+
+/* A single entry of the key matrix */
+struct ec_keymatrix_entry {
+	int row;	/* key matrix row */
+	int col;	/* key matrix column */
+	int keycode;	/* corresponding linux key code */
+};
+
+/**
+ * struct ec_state - Information about the EC state
+ *
+ * @vbnv_context: Vboot context data stored by EC
+ * @ec_config: FDT config information about the EC (e.g. flashmap)
+ * @flash_data: Contents of flash memory
+ * @flash_data_len: Size of flash memory
+ * @current_image: Current image the EC is running
+ * @matrix_count: Number of keys to decode in matrix
+ * @matrix: Information about keyboard matrix
+ * @keyscan: Current keyscan information (bit set for each row/column pressed)
+ * @recovery_req: Keyboard recovery requested
+ */
+struct ec_state {
+	uint8_t vbnv_context[EC_VBNV_BLOCK_SIZE];
+	struct fdt_cros_ec ec_config;
+	uint8_t *flash_data;
+	int flash_data_len;
+	enum ec_current_image current_image;
+	int matrix_count;
+	struct ec_keymatrix_entry *matrix;	/* the key matrix info */
+	uint8_t keyscan[KEYBOARD_COLS];
+	bool recovery_req;
+} s_state, *state;
+
+/**
+ * cros_ec_read_state() - read the sandbox EC state from the state file
+ *
+ * If data is available, then blob and node will provide access to it. If
+ * not this function sets up an empty EC.
+ *
+ * @param blob: Pointer to device tree blob, or NULL if no data to read
+ * @param node: Node offset to read from
+ */
+static int cros_ec_read_state(const void *blob, int node)
+{
+	struct ec_state *ec = &s_state;
+	const char *prop;
+	int len;
+
+	/* Set everything to defaults */
+	ec->current_image = EC_IMAGE_RO;
+	if (!blob)
+		return 0;
+
+	/* Read the data if available */
+	ec->current_image = fdtdec_get_int(blob, node, "current-image",
+					   EC_IMAGE_RO);
+	prop = fdt_getprop(blob, node, "vbnv-context", &len);
+	if (prop && len == sizeof(ec->vbnv_context))
+		memcpy(ec->vbnv_context, prop, len);
+
+	prop = fdt_getprop(blob, node, "flash-data", &len);
+	if (prop) {
+		ec->flash_data_len = len;
+		ec->flash_data = os_malloc(len);
+		if (!ec->flash_data)
+			return -ENOMEM;
+		memcpy(ec->flash_data, prop, len);
+		debug("%s: Loaded EC flash data size %#x\n", __func__, len);
+	}
+
+	return 0;
+}
+
+/**
+ * cros_ec_write_state() - Write out our state to the state file
+ *
+ * The caller will ensure that there is a node ready for the state. The node
+ * may already contain the old state, in which case it is overridden.
+ *
+ * @param blob: Device tree blob holding state
+ * @param node: Node to write our state into
+ */
+static int cros_ec_write_state(void *blob, int node)
+{
+	struct ec_state *ec = &s_state;
+
+	/* We are guaranteed enough space to write basic properties */
+	fdt_setprop_u32(blob, node, "current-image", ec->current_image);
+	fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
+		    sizeof(ec->vbnv_context));
+	return state_setprop(node, "flash-data", ec->flash_data,
+			     ec->ec_config.flash.length);
+}
+
+SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
+		 cros_ec_write_state);
+
+/**
+ * Return the number of bytes used in the specified image.
+ *
+ * This is the actual size of code+data in the image, as opposed to the
+ * amount of space reserved in flash for that image. This code is similar to
+ * that used by the real EC code base.
+ *
+ * @param ec	Current emulated EC state
+ * @param entry	Flash map entry containing the image to check
+ * @return actual image size in bytes, 0 if the image contains no content or
+ * error.
+ */
+static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
+{
+	int size;
+
+	/*
+	 * Scan backwards looking for 0xea byte, which is by definition the
+	 * last byte of the image.  See ec.lds.S for how this is inserted at
+	 * the end of the image.
+	 */
+	for (size = entry->length - 1;
+	     size > 0 && ec->flash_data[entry->offset + size] != 0xea;
+	     size--)
+		;
+
+	return size ? size + 1 : 0;  /* 0xea byte IS part of the image */
+}
+
+/**
+ * Read the key matrix from the device tree
+ *
+ * Keymap entries in the fdt take the form of 0xRRCCKKKK where
+ * RR=Row CC=Column KKKK=Key Code
+ *
+ * @param ec	Current emulated EC state
+ * @param blob	Device tree blob containing keyscan information
+ * @param node	Keyboard node of device tree containing keyscan information
+ * @return 0 if ok, -1 on error
+ */
+static int keyscan_read_fdt_matrix(struct ec_state *ec, const void *blob,
+				   int node)
+{
+	const u32 *cell;
+	int upto;
+	int len;
+
+	cell = fdt_getprop(blob, node, "linux,keymap", &len);
+	ec->matrix_count = len / 4;
+	ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
+	if (!ec->matrix) {
+		debug("%s: Out of memory for key matrix\n", __func__);
+		return -1;
+	}
+
+	/* Now read the data */
+	for (upto = 0; upto < ec->matrix_count; upto++) {
+		struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
+		u32 word;
+
+		word = fdt32_to_cpu(*cell++);
+		matrix->row = word >> 24;
+		matrix->col = (word >> 16) & 0xff;
+		matrix->keycode = word & 0xffff;
+
+		/* Hard-code some sanity limits for now */
+		if (matrix->row >= KEYBOARD_ROWS ||
+		    matrix->col >= KEYBOARD_COLS) {
+			debug("%s: Matrix pos out of range (%d,%d)\n",
+			      __func__, matrix->row, matrix->col);
+			return -1;
+		}
+	}
+
+	if (upto != ec->matrix_count) {
+		debug("%s: Read mismatch from key matrix\n", __func__);
+		return -1;
+	}
+
+	return 0;
+}
+
+/**
+ * Return the next keyscan message contents
+ *
+ * @param ec	Current emulated EC state
+ * @param scan	Place to put keyscan bytes for the keyscan message (must hold
+ *		enough space for a full keyscan)
+ * @return number of bytes of valid scan data
+ */
+static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
+{
+	const struct ec_keymatrix_entry *matrix;
+	int bytes = KEYBOARD_COLS;
+	int key[8];	/* allow up to 8 keys to be pressed at once */
+	int count;
+	int i;
+
+	memset(ec->keyscan, '\0', bytes);
+	count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
+
+	/* Look up keycode in matrix */
+	for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
+		bool found;
+		int j;
+
+		for (found = false, j = 0; j < count; j++) {
+			if (matrix->keycode == key[j])
+				found = true;
+		}
+
+		if (found) {
+			debug("%d: %d,%d\n", matrix->keycode, matrix->row,
+			      matrix->col);
+			ec->keyscan[matrix->col] |= 1 << matrix->row;
+		}
+	}
+
+	memcpy(scan, ec->keyscan, bytes);
+	return bytes;
+}
+
+/**
+ * Process an emulated EC command
+ *
+ * @param ec		Current emulated EC state
+ * @param req_hdr	Pointer to request header
+ * @param req_data	Pointer to body of request
+ * @param resp_hdr	Pointer to place to put response header
+ * @param resp_data	Pointer to place to put response data, if any
+ * @return length of response data, or 0 for no response data, or -1 on error
+ */
+static int process_cmd(struct ec_state *ec,
+		       struct ec_host_request *req_hdr, const void *req_data,
+		       struct ec_host_response *resp_hdr, void *resp_data)
+{
+	int len;
+
+	/* TODO(sjg@chromium.org): Check checksums */
+	debug("EC command %#0x\n", req_hdr->command);
+
+	switch (req_hdr->command) {
+	case EC_CMD_HELLO: {
+		const struct ec_params_hello *req = req_data;
+		struct ec_response_hello *resp = resp_data;
+
+		resp->out_data = req->in_data + 0x01020304;
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_GET_VERSION: {
+		struct ec_response_get_version *resp = resp_data;
+
+		strcpy(resp->version_string_ro, "sandbox_ro");
+		strcpy(resp->version_string_rw, "sandbox_rw");
+		resp->current_image = ec->current_image;
+		debug("Current image %d\n", resp->current_image);
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_VBNV_CONTEXT: {
+		const struct ec_params_vbnvcontext *req = req_data;
+		struct ec_response_vbnvcontext *resp = resp_data;
+
+		switch (req->op) {
+		case EC_VBNV_CONTEXT_OP_READ:
+			memcpy(resp->block, ec->vbnv_context,
+			       sizeof(resp->block));
+			len = sizeof(*resp);
+			break;
+		case EC_VBNV_CONTEXT_OP_WRITE:
+			memcpy(ec->vbnv_context, resp->block,
+			       sizeof(resp->block));
+			len = 0;
+			break;
+		default:
+			printf("   ** Unknown vbnv_context command %#02x\n",
+			       req->op);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_REBOOT_EC: {
+		const struct ec_params_reboot_ec *req = req_data;
+
+		printf("Request reboot type %d\n", req->cmd);
+		switch (req->cmd) {
+		case EC_REBOOT_DISABLE_JUMP:
+			len = 0;
+			break;
+		case EC_REBOOT_JUMP_RW:
+			ec->current_image = EC_IMAGE_RW;
+			len = 0;
+			break;
+		default:
+			puts("   ** Unknown type");
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_HOST_EVENT_GET_B: {
+		struct ec_response_host_event_mask *resp = resp_data;
+
+		resp->mask = 0;
+		if (ec->recovery_req) {
+			resp->mask |= EC_HOST_EVENT_MASK(
+					EC_HOST_EVENT_KEYBOARD_RECOVERY);
+		}
+
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_VBOOT_HASH: {
+		const struct ec_params_vboot_hash *req = req_data;
+		struct ec_response_vboot_hash *resp = resp_data;
+		struct fmap_entry *entry;
+		int ret, size;
+
+		entry = &state->ec_config.region[EC_FLASH_REGION_RW];
+
+		switch (req->cmd) {
+		case EC_VBOOT_HASH_RECALC:
+		case EC_VBOOT_HASH_GET:
+			size = SHA256_SUM_LEN;
+			len = get_image_used(ec, entry);
+			ret = hash_block("sha256",
+					 ec->flash_data + entry->offset,
+					 len, resp->hash_digest, &size);
+			if (ret) {
+				printf("   ** hash_block() failed\n");
+				return -1;
+			}
+			resp->status = EC_VBOOT_HASH_STATUS_DONE;
+			resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
+			resp->digest_size = size;
+			resp->reserved0 = 0;
+			resp->offset = entry->offset;
+			resp->size = len;
+			len = sizeof(*resp);
+			break;
+		default:
+			printf("   ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
+			       req->cmd);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_PROTECT: {
+		const struct ec_params_flash_protect *req = req_data;
+		struct ec_response_flash_protect *resp = resp_data;
+		uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
+				EC_FLASH_PROTECT_ALL_AT_BOOT;
+
+		printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
+		if (req->flags == expect || req->flags == 0) {
+			resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
+								0;
+			resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
+			resp->writable_flags = 0;
+			len = sizeof(*resp);
+		} else {
+			puts("   ** unexpected flash protect request\n");
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_REGION_INFO: {
+		const struct ec_params_flash_region_info *req = req_data;
+		struct ec_response_flash_region_info *resp = resp_data;
+		struct fmap_entry *entry;
+
+		switch (req->region) {
+		case EC_FLASH_REGION_RO:
+		case EC_FLASH_REGION_RW:
+		case EC_FLASH_REGION_WP_RO:
+			entry = &state->ec_config.region[req->region];
+			resp->offset = entry->offset;
+			resp->size = entry->length;
+			len = sizeof(*resp);
+			printf("EC flash region %d: offset=%#x, size=%#x\n",
+			       req->region, resp->offset, resp->size);
+			break;
+		default:
+			printf("** Unknown flash region %d\n", req->region);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_ERASE: {
+		const struct ec_params_flash_erase *req = req_data;
+
+		memset(ec->flash_data + req->offset,
+		       ec->ec_config.flash_erase_value,
+		       req->size);
+		len = 0;
+		break;
+	}
+	case EC_CMD_FLASH_WRITE: {
+		const struct ec_params_flash_write *req = req_data;
+
+		memcpy(ec->flash_data + req->offset, req + 1, req->size);
+		len = 0;
+		break;
+	}
+	case EC_CMD_MKBP_STATE:
+		len = cros_ec_keyscan(ec, resp_data);
+		break;
+	default:
+		printf("   ** Unknown EC command %#02x\n", req_hdr->command);
+		return -1;
+	}
+
+	return len;
+}
+
+int cros_ec_sandbox_packet(struct cros_ec_dev *dev, int out_bytes,
+			   int in_bytes)
+{
+	struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
+	const void *req_data = req_hdr + 1;
+	struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
+	void *resp_data = resp_hdr + 1;
+	int len;
+
+	len = process_cmd(&s_state, req_hdr, req_data, resp_hdr, resp_data);
+	if (len < 0)
+		return len;
+
+	resp_hdr->struct_version = 3;
+	resp_hdr->result = EC_RES_SUCCESS;
+	resp_hdr->data_len = len;
+	resp_hdr->reserved = 0;
+	len += sizeof(*resp_hdr);
+	resp_hdr->checksum = 0;
+	resp_hdr->checksum = (uint8_t)
+		-cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
+
+	return in_bytes;
+}
+
+int cros_ec_sandbox_decode_fdt(struct cros_ec_dev *dev, const void *blob)
+{
+	return 0;
+}
+
+void cros_ec_check_keyboard(struct cros_ec_dev *dev)
+{
+	struct ec_state *ec = &s_state;
+	ulong start;
+
+	printf("Press keys for EC to detect on reset (ESC=recovery)...");
+	start = get_timer(0);
+	while (get_timer(start) < 1000)
+		;
+	putc('\n');
+	if (!sandbox_sdl_key_pressed(KEY_ESC)) {
+		ec->recovery_req = true;
+		printf("   - EC requests recovery\n");
+	}
+}
+
+/**
+ * Initialize sandbox EC emulation.
+ *
+ * @param dev		CROS_EC device
+ * @param blob		Device tree blob
+ * @return 0 if ok, -1 on error
+ */
+int cros_ec_sandbox_init(struct cros_ec_dev *dev, const void *blob)
+{
+	struct ec_state *ec = &s_state;
+	int node;
+	int err;
+
+	state = &s_state;
+	err = cros_ec_decode_ec_flash(blob, &ec->ec_config);
+	if (err)
+		return err;
+
+	node = fdtdec_next_compatible(blob, 0, COMPAT_GOOGLE_CROS_EC_KEYB);
+	if (node < 0) {
+		debug("%s: No cros_ec keyboard found\n", __func__);
+	} else if (keyscan_read_fdt_matrix(ec, blob, node)) {
+		debug("%s: Could not read key matrix\n", __func__);
+		return -1;
+	}
+
+	/* If we loaded EC data, check that the length matches */
+	if (ec->flash_data &&
+	    ec->flash_data_len != ec->ec_config.flash.length) {
+		printf("EC data length is %x, expected %x, discarding data\n",
+		       ec->flash_data_len, ec->ec_config.flash.length);
+		os_free(ec->flash_data);
+		ec->flash_data = NULL;
+	}
+
+	/* Otherwise allocate the memory */
+	if (!ec->flash_data) {
+		ec->flash_data_len = ec->ec_config.flash.length;
+		ec->flash_data = os_malloc(ec->flash_data_len);
+		if (!ec->flash_data)
+			return -ENOMEM;
+	}
+
+	return 0;
+}
diff --git a/drivers/misc/cros_ec_spi.c b/drivers/misc/cros_ec_spi.c
index 2fc911025e..7df709cc71 100644
--- a/drivers/misc/cros_ec_spi.c
+++ b/drivers/misc/cros_ec_spi.c
@@ -17,6 +17,30 @@
 #include <cros_ec.h>
 #include <spi.h>
 
+int cros_ec_spi_packet(struct cros_ec_dev *dev, int out_bytes, int in_bytes)
+{
+	int rv;
+
+	/* Do the transfer */
+	if (spi_claim_bus(dev->spi)) {
+		debug("%s: Cannot claim SPI bus\n", __func__);
+		return -1;
+	}
+
+	rv = spi_xfer(dev->spi, max(out_bytes, in_bytes) * 8,
+		      dev->dout, dev->din,
+		      SPI_XFER_BEGIN | SPI_XFER_END);
+
+	spi_release_bus(dev->spi);
+
+	if (rv) {
+		debug("%s: Cannot complete SPI transfer\n", __func__);
+		return -1;
+	}
+
+	return in_bytes;
+}
+
 /**
  * Send a command to a LPC CROS_EC device and return the reply.
  *
@@ -42,6 +66,12 @@ int cros_ec_spi_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	int csum, len;
 	int rv;
 
+	if (dev->protocol_version != 2) {
+		debug("%s: Unsupported EC protcol version %d\n",
+		      __func__, dev->protocol_version);
+		return -1;
+	}
+
 	/*
 	 * Sanity-check input size to make sure it plus transaction overhead
 	 * fits in the internal device buffer.