326 lines
15 KiB
ReStructuredText
Executable file
326 lines
15 KiB
ReStructuredText
Executable file
CEC Pin Framework Error Injection
|
|
=================================
|
|
|
|
The CEC Pin Framework is a core CEC framework for CEC hardware that only
|
|
has low-level support for the CEC bus. Most hardware today will have
|
|
high-level CEC support where the hardware deals with driving the CEC bus,
|
|
but some older devices aren't that fancy. However, this framework also
|
|
allows you to connect the CEC pin to a GPIO on e.g. a Raspberry Pi and
|
|
you have now made a CEC adapter.
|
|
|
|
What makes doing this so interesting is that since we have full control
|
|
over the bus it is easy to support error injection. This is ideal to
|
|
test how well CEC adapters can handle error conditions.
|
|
|
|
Currently only the cec-gpio driver (when the CEC line is directly
|
|
connected to a pull-up GPIO line) and the AllWinner A10/A20 drm driver
|
|
support this framework.
|
|
|
|
If ``CONFIG_CEC_PIN_ERROR_INJ`` is enabled, then error injection is available
|
|
through debugfs. Specifically, in ``/sys/kernel/debug/cec/cecX/`` there is
|
|
now an ``error-inj`` file.
|
|
|
|
.. note::
|
|
|
|
The error injection commands are not a stable ABI and may change in the
|
|
future.
|
|
|
|
With ``cat error-inj`` you can see both the possible commands and the current
|
|
error injection status::
|
|
|
|
$ cat /sys/kernel/debug/cec/cec0/error-inj
|
|
# Clear error injections:
|
|
# clear clear all rx and tx error injections
|
|
# rx-clear clear all rx error injections
|
|
# tx-clear clear all tx error injections
|
|
# <op> clear clear all rx and tx error injections for <op>
|
|
# <op> rx-clear clear all rx error injections for <op>
|
|
# <op> tx-clear clear all tx error injections for <op>
|
|
#
|
|
# RX error injection:
|
|
# <op>[,<mode>] rx-nack NACK the message instead of sending an ACK
|
|
# <op>[,<mode>] rx-low-drive <bit> force a low-drive condition at this bit position
|
|
# <op>[,<mode>] rx-add-byte add a spurious byte to the received CEC message
|
|
# <op>[,<mode>] rx-remove-byte remove the last byte from the received CEC message
|
|
# <op>[,<mode>] rx-arb-lost <poll> generate a POLL message to trigger an arbitration lost
|
|
#
|
|
# TX error injection settings:
|
|
# tx-ignore-nack-until-eom ignore early NACKs until EOM
|
|
# tx-custom-low-usecs <usecs> define the 'low' time for the custom pulse
|
|
# tx-custom-high-usecs <usecs> define the 'high' time for the custom pulse
|
|
# tx-custom-pulse transmit the custom pulse once the bus is idle
|
|
#
|
|
# TX error injection:
|
|
# <op>[,<mode>] tx-no-eom don't set the EOM bit
|
|
# <op>[,<mode>] tx-early-eom set the EOM bit one byte too soon
|
|
# <op>[,<mode>] tx-add-bytes <num> append <num> (1-255) spurious bytes to the message
|
|
# <op>[,<mode>] tx-remove-byte drop the last byte from the message
|
|
# <op>[,<mode>] tx-short-bit <bit> make this bit shorter than allowed
|
|
# <op>[,<mode>] tx-long-bit <bit> make this bit longer than allowed
|
|
# <op>[,<mode>] tx-custom-bit <bit> send the custom pulse instead of this bit
|
|
# <op>[,<mode>] tx-short-start send a start pulse that's too short
|
|
# <op>[,<mode>] tx-long-start send a start pulse that's too long
|
|
# <op>[,<mode>] tx-custom-start send the custom pulse instead of the start pulse
|
|
# <op>[,<mode>] tx-last-bit <bit> stop sending after this bit
|
|
# <op>[,<mode>] tx-low-drive <bit> force a low-drive condition at this bit position
|
|
#
|
|
# <op> CEC message opcode (0-255) or 'any'
|
|
# <mode> 'once' (default), 'always', 'toggle' or 'off'
|
|
# <bit> CEC message bit (0-159)
|
|
# 10 bits per 'byte': bits 0-7: data, bit 8: EOM, bit 9: ACK
|
|
# <poll> CEC poll message used to test arbitration lost (0x00-0xff, default 0x0f)
|
|
# <usecs> microseconds (0-10000000, default 1000)
|
|
|
|
clear
|
|
|
|
You can write error injection commands to ``error-inj`` using
|
|
``echo 'cmd' >error-inj`` or ``cat cmd.txt >error-inj``. The ``cat error-inj``
|
|
output contains the current error commands. You can save the output to a file
|
|
and use it as an input to ``error-inj`` later.
|
|
|
|
Basic Syntax
|
|
------------
|
|
|
|
Leading spaces/tabs are ignored. If the next character is a ``#`` or the end
|
|
of the line was reached, then the whole line is ignored. Otherwise a command
|
|
is expected.
|
|
|
|
The error injection commands fall in two main groups: those relating to
|
|
receiving CEC messages and those relating to transmitting CEC messages. In
|
|
addition, there are commands to clear existing error injection commands and
|
|
to create custom pulses on the CEC bus.
|
|
|
|
Most error injection commands can be executed for specific CEC opcodes or for
|
|
all opcodes (``any``). Each command also has a 'mode' which can be ``off``
|
|
(can be used to turn off an existing error injection command), ``once``
|
|
(the default) which will trigger the error injection only once for the next
|
|
received or transmitted message, ``always`` to always trigger the error
|
|
injection and ``toggle`` to toggle the error injection on or off for every
|
|
transmit or receive.
|
|
|
|
So '``any rx-nack``' will NACK the next received CEC message,
|
|
'``any,always rx-nack``' will NACK all received CEC messages and
|
|
'``0x82,toggle rx-nack``' will only NACK if an Active Source message was
|
|
received and do that only for every other received message.
|
|
|
|
After an error was injected with mode ``once`` the error injection command
|
|
is cleared automatically, so ``once`` is a one-time deal.
|
|
|
|
All combinations of ``<op>`` and error injection commands can co-exist. So
|
|
this is fine::
|
|
|
|
0x9e tx-add-bytes 1
|
|
0x9e tx-early-eom
|
|
0x9f tx-add-bytes 2
|
|
any rx-nack
|
|
|
|
All four error injection commands will be active simultaneously.
|
|
|
|
However, if the same ``<op>`` and command combination is specified,
|
|
but with different arguments::
|
|
|
|
0x9e tx-add-bytes 1
|
|
0x9e tx-add-bytes 2
|
|
|
|
Then the second will overwrite the first.
|
|
|
|
Clear Error Injections
|
|
----------------------
|
|
|
|
``clear``
|
|
Clear all error injections.
|
|
|
|
``rx-clear``
|
|
Clear all receive error injections
|
|
|
|
``tx-clear``
|
|
Clear all transmit error injections
|
|
|
|
``<op> clear``
|
|
Clear all error injections for the given opcode.
|
|
|
|
``<op> rx-clear``
|
|
Clear all receive error injections for the given opcode.
|
|
|
|
``<op> tx-clear``
|
|
Clear all transmit error injections for the given opcode.
|
|
|
|
Receive Messages
|
|
----------------
|
|
|
|
``<op>[,<mode>] rx-nack``
|
|
NACK broadcast messages and messages directed to this CEC adapter.
|
|
Every byte of the message will be NACKed in case the transmitter
|
|
keeps transmitting after the first byte was NACKed.
|
|
|
|
``<op>[,<mode>] rx-low-drive <bit>``
|
|
Force a Low Drive condition at this bit position. If <op> specifies
|
|
a specific CEC opcode then the bit position must be at least 18,
|
|
otherwise the opcode hasn't been received yet. This tests if the
|
|
transmitter can handle the Low Drive condition correctly and reports
|
|
the error correctly. Note that a Low Drive in the first 4 bits can also
|
|
be interpreted as an Arbitration Lost condition by the transmitter.
|
|
This is implementation dependent.
|
|
|
|
``<op>[,<mode>] rx-add-byte``
|
|
Add a spurious 0x55 byte to the received CEC message, provided
|
|
the message was 15 bytes long or less. This is useful to test
|
|
the high-level protocol since spurious bytes should be ignored.
|
|
|
|
``<op>[,<mode>] rx-remove-byte``
|
|
Remove the last byte from the received CEC message, provided it
|
|
was at least 2 bytes long. This is useful to test the high-level
|
|
protocol since messages that are too short should be ignored.
|
|
|
|
``<op>[,<mode>] rx-arb-lost <poll>``
|
|
Generate a POLL message to trigger an Arbitration Lost condition.
|
|
This command is only allowed for ``<op>`` values of ``next`` or ``all``.
|
|
As soon as a start bit has been received the CEC adapter will switch
|
|
to transmit mode and it will transmit a POLL message. By default this is
|
|
0x0f, but it can also be specified explicitly via the ``<poll>`` argument.
|
|
|
|
This command can be used to test the Arbitration Lost condition in
|
|
the remote CEC transmitter. Arbitration happens when two CEC adapters
|
|
start sending a message at the same time. In that case the initiator
|
|
with the most leading zeroes wins and the other transmitter has to
|
|
stop transmitting ('Arbitration Lost'). This is very hard to test,
|
|
except by using this error injection command.
|
|
|
|
This does not work if the remote CEC transmitter has logical address
|
|
0 ('TV') since that will always win.
|
|
|
|
Transmit Messages
|
|
-----------------
|
|
|
|
``tx-ignore-nack-until-eom``
|
|
This setting changes the behavior of transmitting CEC messages. Normally
|
|
as soon as the receiver NACKs a byte the transmit will stop, but the
|
|
specification also allows that the full message is transmitted and only
|
|
at the end will the transmitter look at the ACK bit. This is not
|
|
recommended behavior since there is no point in keeping the CEC bus busy
|
|
for longer than is strictly needed. Especially given how slow the bus is.
|
|
|
|
This setting can be used to test how well a receiver deals with
|
|
transmitters that ignore NACKs until the very end of the message.
|
|
|
|
``<op>[,<mode>] tx-no-eom``
|
|
Don't set the EOM bit. Normally the last byte of the message has the EOM
|
|
(End-Of-Message) bit set. With this command the transmit will just stop
|
|
without ever sending an EOM. This can be used to test how a receiver
|
|
handles this case. Normally receivers have a time-out after which
|
|
they will go back to the Idle state.
|
|
|
|
``<op>[,<mode>] tx-early-eom``
|
|
Set the EOM bit one byte too soon. This obviously only works for messages
|
|
of two bytes or more. The EOM bit will be set for the second-to-last byte
|
|
and not for the final byte. The receiver should ignore the last byte in
|
|
this case. Since the resulting message is likely to be too short for this
|
|
same reason the whole message is typically ignored. The receiver should be
|
|
in Idle state after the last byte was transmitted.
|
|
|
|
``<op>[,<mode>] tx-add-bytes <num>``
|
|
Append ``<num>`` (1-255) spurious bytes to the message. The extra bytes
|
|
have the value of the byte position in the message. So if you transmit a
|
|
two byte message (e.g. a Get CEC Version message) and add 2 bytes, then
|
|
the full message received by the remote CEC adapter is
|
|
``0x40 0x9f 0x02 0x03``.
|
|
|
|
This command can be used to test buffer overflows in the receiver. E.g.
|
|
what does it do when it receives more than the maximum message size of 16
|
|
bytes.
|
|
|
|
``<op>[,<mode>] tx-remove-byte``
|
|
Drop the last byte from the message, provided the message is at least
|
|
two bytes long. The receiver should ignore messages that are too short.
|
|
|
|
``<op>[,<mode>] tx-short-bit <bit>``
|
|
Make this bit period shorter than allowed. The bit position cannot be
|
|
an Ack bit. If <op> specifies a specific CEC opcode then the bit position
|
|
must be at least 18, otherwise the opcode hasn't been received yet.
|
|
Normally the period of a data bit is between 2.05 and 2.75 milliseconds.
|
|
With this command the period of this bit is 1.8 milliseconds, this is
|
|
done by reducing the time the CEC bus is high. This bit period is less
|
|
than is allowed and the receiver should respond with a Low Drive
|
|
condition.
|
|
|
|
This command is ignored for 0 bits in bit positions 0 to 3. This is
|
|
because the receiver also looks for an Arbitration Lost condition in
|
|
those first four bits and it is undefined what will happen if it
|
|
sees a too-short 0 bit.
|
|
|
|
``<op>[,<mode>] tx-long-bit <bit>``
|
|
Make this bit period longer than is valid. The bit position cannot be
|
|
an Ack bit. If <op> specifies a specific CEC opcode then the bit position
|
|
must be at least 18, otherwise the opcode hasn't been received yet.
|
|
Normally the period of a data bit is between 2.05 and 2.75 milliseconds.
|
|
With this command the period of this bit is 2.9 milliseconds, this is
|
|
done by increasing the time the CEC bus is high.
|
|
|
|
Even though this bit period is longer than is valid it is undefined what
|
|
a receiver will do. It might just accept it, or it might time out and
|
|
return to Idle state. Unfortunately the CEC specification is silent about
|
|
this.
|
|
|
|
This command is ignored for 0 bits in bit positions 0 to 3. This is
|
|
because the receiver also looks for an Arbitration Lost condition in
|
|
those first four bits and it is undefined what will happen if it
|
|
sees a too-long 0 bit.
|
|
|
|
``<op>[,<mode>] tx-short-start``
|
|
Make this start bit period shorter than allowed. Normally the period of
|
|
a start bit is between 4.3 and 4.7 milliseconds. With this command the
|
|
period of the start bit is 4.1 milliseconds, this is done by reducing
|
|
the time the CEC bus is high. This start bit period is less than is
|
|
allowed and the receiver should return to Idle state when this is detected.
|
|
|
|
``<op>[,<mode>] tx-long-start``
|
|
Make this start bit period longer than is valid. Normally the period of
|
|
a start bit is between 4.3 and 4.7 milliseconds. With this command the
|
|
period of the start bit is 5 milliseconds, this is done by increasing
|
|
the time the CEC bus is high. This start bit period is more than is
|
|
valid and the receiver should return to Idle state when this is detected.
|
|
|
|
Even though this start bit period is longer than is valid it is undefined
|
|
what a receiver will do. It might just accept it, or it might time out and
|
|
return to Idle state. Unfortunately the CEC specification is silent about
|
|
this.
|
|
|
|
``<op>[,<mode>] tx-last-bit <bit>``
|
|
Just stop transmitting after this bit. If <op> specifies a specific CEC
|
|
opcode then the bit position must be at least 18, otherwise the opcode
|
|
hasn't been received yet. This command can be used to test how the receiver
|
|
reacts when a message just suddenly stops. It should time out and go back
|
|
to Idle state.
|
|
|
|
``<op>[,<mode>] tx-low-drive <bit>``
|
|
Force a Low Drive condition at this bit position. If <op> specifies a
|
|
specific CEC opcode then the bit position must be at least 18, otherwise
|
|
the opcode hasn't been received yet. This can be used to test how the
|
|
receiver handles Low Drive conditions. Note that if this happens at bit
|
|
positions 0-3 the receiver can interpret this as an Arbitration Lost
|
|
condition. This is implementation dependent.
|
|
|
|
Custom Pulses
|
|
-------------
|
|
|
|
``tx-custom-low-usecs <usecs>``
|
|
This defines the duration in microseconds that the custom pulse pulls
|
|
the CEC line low. The default is 1000 microseconds.
|
|
|
|
``tx-custom-high-usecs <usecs>``
|
|
This defines the duration in microseconds that the custom pulse keeps the
|
|
CEC line high (unless another CEC adapter pulls it low in that time).
|
|
The default is 1000 microseconds. The total period of the custom pulse is
|
|
``tx-custom-low-usecs + tx-custom-high-usecs``.
|
|
|
|
``<op>[,<mode>] tx-custom-bit <bit>``
|
|
Send the custom bit instead of a regular data bit. The bit position cannot
|
|
be an Ack bit. If <op> specifies a specific CEC opcode then the bit
|
|
position must be at least 18, otherwise the opcode hasn't been received yet.
|
|
|
|
``<op>[,<mode>] tx-custom-start``
|
|
Send the custom bit instead of a regular start bit.
|
|
|
|
``tx-custom-pulse``
|
|
Transmit a single custom pulse as soon as the CEC bus is idle.
|