Merge branch 'u-boot/master' into 'u-boot-arm/master'

Trivial merge conflict, needed to manually remove
local_info as per commit 41364f0f.

Conflicts:
	board/samsung/common/board.c

22 files changed, 2404 insertions, 417 deletions

diff --git a/drivers/input/cros_ec_keyb.c b/drivers/input/cros_ec_keyb.c
index e8dac23..a2501e0 100644
--- a/drivers/input/cros_ec_keyb.c
+++ b/drivers/input/cros_ec_keyb.c
@@ -8,6 +8,7 @@
 
 #include <common.h>
 #include <cros_ec.h>
+#include <errno.h>
 #include <fdtdec.h>
 #include <input.h>
 #include <key_matrix.h>
@@ -39,20 +40,34 @@ static struct keyb {
  * @param config	Keyboard config
  * @param keys		List of keys that we have detected
  * @param max_count	Maximum number of keys to return
- * @return number of pressed keys, 0 for none
+ * @param samep		Set to true if this scan repeats the last, else false
+ * @return number of pressed keys, 0 for none, -EIO on error
  */
 static int check_for_keys(struct keyb *config,
-			   struct key_matrix_key *keys, int max_count)
+			   struct key_matrix_key *keys, int max_count,
+			   bool *samep)
 {
 	struct key_matrix_key *key;
+	static struct mbkp_keyscan last_scan;
+	static bool last_scan_valid;
 	struct mbkp_keyscan scan;
 	unsigned int row, col, bit, data;
 	int num_keys;
 
 	if (cros_ec_scan_keyboard(config->dev, &scan)) {
 		debug("%s: keyboard scan failed\n", __func__);
-		return -1;
+		return -EIO;
 	}
+	*samep = last_scan_valid && !memcmp(&last_scan, &scan, sizeof(scan));
+
+	/*
+	 * This is a bit odd. The EC has no way to tell us that it has run
+	 * out of key scans. It just returns the same scan over and over
+	 * again. So the only way to detect that we have run out is to detect
+	 * that this scan is the same as the last.
+	 */
+	last_scan_valid = true;
+	memcpy(&last_scan, &scan, sizeof(last_scan));
 
 	for (col = num_keys = bit = 0; col < config->matrix.num_cols;
 			col++) {
@@ -112,6 +127,7 @@ int cros_ec_kbc_check(struct input_config *input)
 	int keycodes[KBC_MAX_KEYS];
 	int num_keys, num_keycodes;
 	int irq_pending, sent;
+	bool same = false;
 
 	/*
 	 * Loop until the EC has no more keyscan records, or we have
@@ -125,7 +141,10 @@ int cros_ec_kbc_check(struct input_config *input)
 	do {
 		irq_pending = cros_ec_interrupt_pending(config.dev);
 		if (irq_pending) {
-			num_keys = check_for_keys(&config, keys, KBC_MAX_KEYS);
+			num_keys = check_for_keys(&config, keys, KBC_MAX_KEYS,
+						  &same);
+			if (num_keys < 0)
+				return 0;
 			last_num_keys = num_keys;
 			memcpy(last_keys, keys, sizeof(keys));
 		} else {
@@ -142,6 +161,13 @@ int cros_ec_kbc_check(struct input_config *input)
 		num_keycodes = key_matrix_decode(&config.matrix, keys,
 				num_keys, keycodes, KBC_MAX_KEYS);
 		sent = input_send_keycodes(input, keycodes, num_keycodes);
+
+		/*
+		 * For those ECs without an interrupt, stop scanning when we
+		 * see that the scan is the same as last time.
+		 */
+		if ((irq_pending < 0) && same)
+			break;
 	} while (irq_pending && !sent);
 
 	return 1;
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index c77e40a..c25e92d 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_CBMEM_CONSOLE) += cbmem_console.o
 obj-$(CONFIG_CROS_EC) += cros_ec.o
 obj-$(CONFIG_CROS_EC_LPC) += cros_ec_lpc.o
 obj-$(CONFIG_CROS_EC_I2C) += cros_ec_i2c.o
+obj-$(CONFIG_CROS_EC_SANDBOX) += cros_ec_sandbox.o
 obj-$(CONFIG_CROS_EC_SPI) += cros_ec_spi.o
 obj-$(CONFIG_FSL_IIM) += fsl_iim.o
 obj-$(CONFIG_GPIO_LED) += gpio_led.o
diff --git a/drivers/misc/cros_ec.c b/drivers/misc/cros_ec.c
index 301e8eb..068373b 100644
--- a/drivers/misc/cros_ec.c
+++ b/drivers/misc/cros_ec.c
@@ -7,10 +7,11 @@
  */
 
 /*
- * The Matrix Keyboard Protocol driver handles talking to the keyboard
- * controller chip. Mostly this is for keyboard functions, but some other
- * things have slipped in, so we provide generic services to talk to the
- * KBC.
+ * This is the interface to the Chrome OS EC. It provides keyboard functions,
+ * power control and battery management. Quite a few other functions are
+ * provided to enable the EC software to be updated, talk to the EC's I2C bus
+ * and store a small amount of data in a memory which persists while the EC
+ * is not reset.
  */
 
 #include <common.h>
@@ -20,6 +21,7 @@
 #include <fdtdec.h>
 #include <malloc.h>
 #include <spi.h>
+#include <asm/errno.h>
 #include <asm/io.h>
 #include <asm-generic/gpio.h>
 
@@ -73,11 +75,184 @@ int cros_ec_calc_checksum(const uint8_t *data, int size)
 	return csum & 0xff;
 }
 
+/**
+ * Create a request packet for protocol version 3.
+ *
+ * The packet is stored in the device's internal output buffer.
+ *
+ * @param dev		CROS-EC device
+ * @param cmd		Command to send (EC_CMD_...)
+ * @param cmd_version	Version of command to send (EC_VER_...)
+ * @param dout          Output data (may be NULL If dout_len=0)
+ * @param dout_len      Size of output data in bytes
+ * @return packet size in bytes, or <0 if error.
+ */
+static int create_proto3_request(struct cros_ec_dev *dev,
+				 int cmd, int cmd_version,
+				 const void *dout, int dout_len)
+{
+	struct ec_host_request *rq = (struct ec_host_request *)dev->dout;
+	int out_bytes = dout_len + sizeof(*rq);
+
+	/* Fail if output size is too big */
+	if (out_bytes > (int)sizeof(dev->dout)) {
+		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
+		return -EC_RES_REQUEST_TRUNCATED;
+	}
+
+	/* Fill in request packet */
+	rq->struct_version = EC_HOST_REQUEST_VERSION;
+	rq->checksum = 0;
+	rq->command = cmd;
+	rq->command_version = cmd_version;
+	rq->reserved = 0;
+	rq->data_len = dout_len;
+
+	/* Copy data after header */
+	memcpy(rq + 1, dout, dout_len);
+
+	/* Write checksum field so the entire packet sums to 0 */
+	rq->checksum = (uint8_t)(-cros_ec_calc_checksum(dev->dout, out_bytes));
+
+	cros_ec_dump_data("out", cmd, dev->dout, out_bytes);
+
+	/* Return size of request packet */
+	return out_bytes;
+}
+
+/**
+ * Prepare the device to receive a protocol version 3 response.
+ *
+ * @param dev		CROS-EC device
+ * @param din_len       Maximum size of response in bytes
+ * @return maximum expected number of bytes in response, or <0 if error.
+ */
+static int prepare_proto3_response_buffer(struct cros_ec_dev *dev, int din_len)
+{
+	int in_bytes = din_len + sizeof(struct ec_host_response);
+
+	/* Fail if input size is too big */
+	if (in_bytes > (int)sizeof(dev->din)) {
+		debug("%s: Cannot receive %d bytes\n", __func__, din_len);
+		return -EC_RES_RESPONSE_TOO_BIG;
+	}
+
+	/* Return expected size of response packet */
+	return in_bytes;
+}
+
+/**
+ * Handle a protocol version 3 response packet.
+ *
+ * The packet must already be stored in the device's internal input buffer.
+ *
+ * @param dev		CROS-EC device
+ * @param dinp          Returns pointer to response data
+ * @param din_len       Maximum size of response in bytes
+ * @return number of bytes of response data, or <0 if error
+ */
+static int handle_proto3_response(struct cros_ec_dev *dev,
+				  uint8_t **dinp, int din_len)
+{
+	struct ec_host_response *rs = (struct ec_host_response *)dev->din;
+	int in_bytes;
+	int csum;
+
+	cros_ec_dump_data("in-header", -1, dev->din, sizeof(*rs));
+
+	/* Check input data */
+	if (rs->struct_version != EC_HOST_RESPONSE_VERSION) {
+		debug("%s: EC response version mismatch\n", __func__);
+		return -EC_RES_INVALID_RESPONSE;
+	}
+
+	if (rs->reserved) {
+		debug("%s: EC response reserved != 0\n", __func__);
+		return -EC_RES_INVALID_RESPONSE;
+	}
+
+	if (rs->data_len > din_len) {
+		debug("%s: EC returned too much data\n", __func__);
+		return -EC_RES_RESPONSE_TOO_BIG;
+	}
+
+	cros_ec_dump_data("in-data", -1, dev->din + sizeof(*rs), rs->data_len);
+
+	/* Update in_bytes to actual data size */
+	in_bytes = sizeof(*rs) + rs->data_len;
+
+	/* Verify checksum */
+	csum = cros_ec_calc_checksum(dev->din, in_bytes);
+	if (csum) {
+		debug("%s: EC response checksum invalid: 0x%02x\n", __func__,
+		      csum);
+		return -EC_RES_INVALID_CHECKSUM;
+	}
+
+	/* Return error result, if any */
+	if (rs->result)
+		return -(int)rs->result;
+
+	/* If we're still here, set response data pointer and return length */
+	*dinp = (uint8_t *)(rs + 1);
+
+	return rs->data_len;
+}
+
+static int send_command_proto3(struct cros_ec_dev *dev,
+			       int cmd, int cmd_version,
+			       const void *dout, int dout_len,
+			       uint8_t **dinp, int din_len)
+{
+	int out_bytes, in_bytes;
+	int rv;
+
+	/* Create request packet */
+	out_bytes = create_proto3_request(dev, cmd, cmd_version,
+					  dout, dout_len);
+	if (out_bytes < 0)
+		return out_bytes;
+
+	/* Prepare response buffer */
+	in_bytes = prepare_proto3_response_buffer(dev, din_len);
+	if (in_bytes < 0)
+		return in_bytes;
+
+	switch (dev->interface) {
+#ifdef CONFIG_CROS_EC_SPI
+	case CROS_EC_IF_SPI:
+		rv = cros_ec_spi_packet(dev, out_bytes, in_bytes);
+		break;
+#endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case CROS_EC_IF_SANDBOX:
+		rv = cros_ec_sandbox_packet(dev, out_bytes, in_bytes);
+		break;
+#endif
+	case CROS_EC_IF_NONE:
+	/* TODO: support protocol 3 for LPC, I2C; for now fall through */
+	default:
+		debug("%s: Unsupported interface\n", __func__);
+		rv = -1;
+	}
+	if (rv < 0)
+		return rv;
+
+	/* Process the response */
+	return handle_proto3_response(dev, dinp, din_len);
+}
+
 static int send_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 			const void *dout, int dout_len,
 			uint8_t **dinp, int din_len)
 {
-	int ret;
+	int ret = -1;
+
+	/* Handle protocol version 3 support */
+	if (dev->protocol_version == 3) {
+		return send_command_proto3(dev, cmd, cmd_version,
+					   dout, dout_len, dinp, din_len);
+	}
 
 	switch (dev->interface) {
 #ifdef CONFIG_CROS_EC_SPI
@@ -129,19 +304,15 @@ static int ec_command_inptr(struct cros_ec_dev *dev, uint8_t cmd,
 		int cmd_version, const void *dout, int dout_len, uint8_t **dinp,
 		int din_len)
 {
-	uint8_t *din;
+	uint8_t *din = NULL;
 	int len;
 
-	if (cmd_version != 0 && !dev->cmd_version_is_supported) {
-		debug("%s: Command version >0 unsupported\n", __func__);
-		return -1;
-	}
 	len = send_command(dev, cmd, cmd_version, dout, dout_len,
 				&din, din_len);
 
 	/* If the command doesn't complete, wait a while */
 	if (len == -EC_RES_IN_PROGRESS) {
-		struct ec_response_get_comms_status *resp;
+		struct ec_response_get_comms_status *resp = NULL;
 		ulong start;
 
 		/* Wait for command to complete */
@@ -169,7 +340,8 @@ static int ec_command_inptr(struct cros_ec_dev *dev, uint8_t cmd,
 				NULL, 0, &din, din_len);
 	}
 
-	debug("%s: len=%d, dinp=%p, *dinp=%p\n", __func__, len, dinp, *dinp);
+	debug("%s: len=%d, dinp=%p, *dinp=%p\n", __func__, len, dinp,
+	      dinp ? *dinp : NULL);
 	if (dinp) {
 		/* If we have any data to return, it must be 64bit-aligned */
 		assert(len <= 0 || !((uintptr_t)din & 7));
@@ -220,8 +392,8 @@ static int ec_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 
 int cros_ec_scan_keyboard(struct cros_ec_dev *dev, struct mbkp_keyscan *scan)
 {
-	if (ec_command(dev, EC_CMD_CROS_EC_STATE, 0, NULL, 0, scan,
-		       sizeof(scan->data)) < sizeof(scan->data))
+	if (ec_command(dev, EC_CMD_MKBP_STATE, 0, NULL, 0, scan,
+		       sizeof(scan->data)) != sizeof(scan->data))
 		return -1;
 
 	return 0;
@@ -232,10 +404,10 @@ int cros_ec_read_id(struct cros_ec_dev *dev, char *id, int maxlen)
 	struct ec_response_get_version *r;
 
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
-			(uint8_t **)&r, sizeof(*r)) < sizeof(*r))
+			(uint8_t **)&r, sizeof(*r)) != sizeof(*r))
 		return -1;
 
-	if (maxlen > sizeof(r->version_string_ro))
+	if (maxlen > (int)sizeof(r->version_string_ro))
 		maxlen = sizeof(r->version_string_ro);
 
 	switch (r->current_image) {
@@ -258,7 +430,7 @@ int cros_ec_read_version(struct cros_ec_dev *dev,
 {
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
 			(uint8_t **)versionp, sizeof(**versionp))
-			< sizeof(**versionp))
+			!= sizeof(**versionp))
 		return -1;
 
 	return 0;
@@ -267,7 +439,7 @@ int cros_ec_read_version(struct cros_ec_dev *dev,
 int cros_ec_read_build_info(struct cros_ec_dev *dev, char **strp)
 {
 	if (ec_command_inptr(dev, EC_CMD_GET_BUILD_INFO, 0, NULL, 0,
-			(uint8_t **)strp, EC_HOST_PARAM_SIZE) < 0)
+			(uint8_t **)strp, EC_PROTO2_MAX_PARAM_SIZE) < 0)
 		return -1;
 
 	return 0;
@@ -279,7 +451,7 @@ int cros_ec_read_current_image(struct cros_ec_dev *dev,
 	struct ec_response_get_version *r;
 
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
-			(uint8_t **)&r, sizeof(*r)) < sizeof(*r))
+			(uint8_t **)&r, sizeof(*r)) != sizeof(*r))
 		return -1;
 
 	*image = r->current_image;
@@ -336,7 +508,7 @@ int cros_ec_read_hash(struct cros_ec_dev *dev,
 	debug("%s: No valid hash (status=%d size=%d). Compute one...\n",
 	      __func__, hash->status, hash->size);
 
-	p.cmd = EC_VBOOT_HASH_RECALC;
+	p.cmd = EC_VBOOT_HASH_START;
 	p.hash_type = EC_VBOOT_HASH_TYPE_SHA256;
 	p.nonce_size = 0;
 	p.offset = EC_VBOOT_HASH_OFFSET_RW;
@@ -413,15 +585,15 @@ int cros_ec_interrupt_pending(struct cros_ec_dev *dev)
 {
 	/* no interrupt support : always poll */
 	if (!fdt_gpio_isvalid(&dev->ec_int))
-		return 1;
+		return -ENOENT;
 
 	return !gpio_get_value(dev->ec_int.gpio);
 }
 
-int cros_ec_info(struct cros_ec_dev *dev, struct ec_response_cros_ec_info *info)
+int cros_ec_info(struct cros_ec_dev *dev, struct ec_response_mkbp_info *info)
 {
-	if (ec_command(dev, EC_CMD_CROS_EC_INFO, 0, NULL, 0, info,
-			sizeof(*info)) < sizeof(*info))
+	if (ec_command(dev, EC_CMD_MKBP_INFO, 0, NULL, 0, info,
+		       sizeof(*info)) != sizeof(*info))
 		return -1;
 
 	return 0;
@@ -436,7 +608,7 @@ int cros_ec_get_host_events(struct cros_ec_dev *dev, uint32_t *events_ptr)
 	 * used by ACPI/SMI.
 	 */
 	if (ec_command_inptr(dev, EC_CMD_HOST_EVENT_GET_B, 0, NULL, 0,
-		       (uint8_t **)&resp, sizeof(*resp)) < sizeof(*resp))
+		       (uint8_t **)&resp, sizeof(*resp)) < (int)sizeof(*resp))
 		return -1;
 
 	if (resp->mask & EC_HOST_EVENT_MASK(EC_HOST_EVENT_INVALID))
@@ -474,7 +646,7 @@ int cros_ec_flash_protect(struct cros_ec_dev *dev,
 
 	if (ec_command(dev, EC_CMD_FLASH_PROTECT, EC_VER_FLASH_PROTECT,
 		       &params, sizeof(params),
-		       resp, sizeof(*resp)) < sizeof(*resp))
+		       resp, sizeof(*resp)) != sizeof(*resp))
 		return -1;
 
 	return 0;
@@ -504,23 +676,30 @@ static int cros_ec_check_version(struct cros_ec_dev *dev)
 	 *
 	 * So for now, just read all the data anyway.
 	 */
-	dev->cmd_version_is_supported = 1;
+
+	/* Try sending a version 3 packet */
+	dev->protocol_version = 3;
+	if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req, sizeof(req),
+			     (uint8_t **)&resp, sizeof(*resp)) > 0) {
+		return 0;
+	}
+
+	/* Try sending a version 2 packet */
+	dev->protocol_version = 2;
 	if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req, sizeof(req),
 		       (uint8_t **)&resp, sizeof(*resp)) > 0) {
-		/* It appears to understand new version commands */
-		dev->cmd_version_is_supported = 1;
-	} else {
-		dev->cmd_version_is_supported = 0;
-		if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req,
-			      sizeof(req), (uint8_t **)&resp,
-			      sizeof(*resp)) < 0) {
-			debug("%s: Failed both old and new command style\n",
-				__func__);
-			return -1;
-		}
+		return 0;
 	}
 
-	return 0;
+	/*
+	 * Fail if we're still here, since the EC doesn't understand any
+	 * protcol version we speak.  Version 1 interface without command
+	 * version is no longer supported, and we don't know about any new
+	 * protocol versions.
+	 */
+	dev->protocol_version = 0;
+	printf("%s: ERROR: old EC interface not supported\n", __func__);
+	return -1;
 }
 
 int cros_ec_test(struct cros_ec_dev *dev)
@@ -599,8 +778,8 @@ static int cros_ec_flash_write_block(struct cros_ec_dev *dev,
 
 	p.offset = offset;
 	p.size = size;
-	assert(data && p.size <= sizeof(p.data));
-	memcpy(p.data, data, p.size);
+	assert(data && p.size <= EC_FLASH_WRITE_VER0_SIZE);
+	memcpy(&p + 1, data, p.size);
 
 	return ec_command_inptr(dev, EC_CMD_FLASH_WRITE, 0,
 			  &p, sizeof(p), NULL, 0) >= 0 ? 0 : -1;
@@ -611,8 +790,7 @@ static int cros_ec_flash_write_block(struct cros_ec_dev *dev,
  */
 static int cros_ec_flash_write_burst_size(struct cros_ec_dev *dev)
 {
-	struct ec_params_flash_write p;
-	return sizeof(p.data);
+	return EC_FLASH_WRITE_VER0_SIZE;
 }
 
 /**
@@ -718,7 +896,7 @@ int cros_ec_flash_update_rw(struct cros_ec_dev *dev,
 
 	if (cros_ec_flash_offset(dev, EC_FLASH_REGION_RW, &rw_offset, &rw_size))
 		return -1;
-	if (image_size > rw_size)
+	if (image_size > (int)rw_size)
 		return -1;
 
 	/* Invalidate the existing hash, just in case the AP reboots
@@ -804,7 +982,7 @@ int cros_ec_get_ldo(struct cros_ec_dev *dev, uint8_t index, uint8_t *state)
 
 	if (ec_command_inptr(dev, EC_CMD_LDO_GET, 0,
 		       &params, sizeof(params),
-		       (uint8_t **)&resp, sizeof(*resp)) < sizeof(*resp))
+		       (uint8_t **)&resp, sizeof(*resp)) != sizeof(*resp))
 		return -1;
 
 	*state = resp->state;
@@ -813,7 +991,8 @@ int cros_ec_get_ldo(struct cros_ec_dev *dev, uint8_t index, uint8_t *state)
 }
 
 /**
- * Decode MBKP details from the device tree and allocate a suitable device.
+ * Decode EC interface details from the device tree and allocate a suitable
+ * device.
  *
  * @param blob		Device tree blob
  * @param node		Node to decode from
@@ -859,6 +1038,11 @@ static int cros_ec_decode_fdt(const void *blob, int node,
 		dev->interface = CROS_EC_IF_LPC;
 		break;
 #endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case COMPAT_SANDBOX_HOST_EMULATION:
+		dev->interface = CROS_EC_IF_SANDBOX;
+		break;
+#endif
 	default:
 		debug("%s: Unknown compat id %d\n", __func__, compat);
 		return -1;
@@ -914,6 +1098,12 @@ int cros_ec_init(const void *blob, struct cros_ec_dev **cros_ecp)
 			return -CROS_EC_ERR_DEV_INIT;
 		break;
 #endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case CROS_EC_IF_SANDBOX:
+		if (cros_ec_sandbox_init(dev, blob))
+			return -CROS_EC_ERR_DEV_INIT;
+		break;
+#endif
 	case CROS_EC_IF_NONE:
 	default:
 		return 0;
@@ -941,7 +1131,6 @@ int cros_ec_init(const void *blob, struct cros_ec_dev **cros_ecp)
 	return 0;
 }
 
-#ifdef CONFIG_CMD_CROS_EC
 int cros_ec_decode_region(int argc, char * const argv[])
 {
 	if (argc > 0) {
@@ -958,6 +1147,139 @@ int cros_ec_decode_region(int argc, char * const argv[])
 	return -1;
 }
 
+int cros_ec_decode_ec_flash(const void *blob, struct fdt_cros_ec *config)
+{
+	int flash_node, node;
+
+	node = fdtdec_next_compatible(blob, 0, COMPAT_GOOGLE_CROS_EC);
+	if (node < 0) {
+		debug("Failed to find chrome-ec node'\n");
+		return -1;
+	}
+
+	flash_node = fdt_subnode_offset(blob, node, "flash");
+	if (flash_node < 0) {
+		debug("Failed to find flash node\n");
+		return -1;
+	}
+
+	if (fdtdec_read_fmap_entry(blob, flash_node, "flash",
+				   &config->flash)) {
+		debug("Failed to decode flash node in chrome-ec'\n");
+		return -1;
+	}
+
+	config->flash_erase_value = fdtdec_get_int(blob, flash_node,
+						    "erase-value", -1);
+	for (node = fdt_first_subnode(blob, flash_node); node >= 0;
+	     node = fdt_next_subnode(blob, node)) {
+		const char *name = fdt_get_name(blob, node, NULL);
+		enum ec_flash_region region;
+
+		if (0 == strcmp(name, "ro")) {
+			region = EC_FLASH_REGION_RO;
+		} else if (0 == strcmp(name, "rw")) {
+			region = EC_FLASH_REGION_RW;
+		} else if (0 == strcmp(name, "wp-ro")) {
+			region = EC_FLASH_REGION_WP_RO;
+		} else {
+			debug("Unknown EC flash region name '%s'\n", name);
+			return -1;
+		}
+
+		if (fdtdec_read_fmap_entry(blob, node, "reg",
+					   &config->region[region])) {
+			debug("Failed to decode flash region in chrome-ec'\n");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+int cros_ec_i2c_xfer(struct cros_ec_dev *dev, uchar chip, uint addr,
+		     int alen, uchar *buffer, int len, int is_read)
+{
+	union {
+		struct ec_params_i2c_passthru p;
+		uint8_t outbuf[EC_PROTO2_MAX_PARAM_SIZE];
+	} params;
+	union {
+		struct ec_response_i2c_passthru r;
+		uint8_t inbuf[EC_PROTO2_MAX_PARAM_SIZE];
+	} response;
+	struct ec_params_i2c_passthru *p = &params.p;
+	struct ec_response_i2c_passthru *r = &response.r;
+	struct ec_params_i2c_passthru_msg *msg = p->msg;
+	uint8_t *pdata;
+	int read_len, write_len;
+	int size;
+	int rv;
+
+	p->port = 0;
+
+	if (alen != 1) {
+		printf("Unsupported address length %d\n", alen);
+		return -1;
+	}
+	if (is_read) {
+		read_len = len;
+		write_len = alen;
+		p->num_msgs = 2;
+	} else {
+		read_len = 0;
+		write_len = alen + len;
+		p->num_msgs = 1;
+	}
+
+	size = sizeof(*p) + p->num_msgs * sizeof(*msg);
+	if (size + write_len > sizeof(params)) {
+		puts("Params too large for buffer\n");
+		return -1;
+	}
+	if (sizeof(*r) + read_len > sizeof(response)) {
+		puts("Read length too big for buffer\n");
+		return -1;
+	}
+
+	/* Create a message to write the register address and optional data */
+	pdata = (uint8_t *)p + size;
+	msg->addr_flags = chip;
+	msg->len = write_len;
+	pdata[0] = addr;
+	if (!is_read)
+		memcpy(pdata + 1, buffer, len);
+	msg++;
+
+	if (read_len) {
+		msg->addr_flags = chip | EC_I2C_FLAG_READ;
+		msg->len = read_len;
+	}
+
+	rv = ec_command(dev, EC_CMD_I2C_PASSTHRU, 0, p, size + write_len,
+			r, sizeof(*r) + read_len);
+	if (rv < 0)
+		return rv;
+
+	/* Parse response */
+	if (r->i2c_status & EC_I2C_STATUS_ERROR) {
+		printf("Transfer failed with status=0x%x\n", r->i2c_status);
+		return -1;
+	}
+
+	if (rv < sizeof(*r) + read_len) {
+		puts("Truncated read response\n");
+		return -1;
+	}
+
+	if (read_len)
+		memcpy(buffer, r->data, read_len);
+
+	return 0;
+}
+
+#ifdef CONFIG_CMD_CROS_EC
+
 /**
  * Perform a flash read or write command
  *
@@ -1011,6 +1333,187 @@ static int do_read_write(struct cros_ec_dev *dev, int is_write, int argc,
 	return 0;
 }
 
+/**
+ * get_alen() - Small parser helper function to get address length
+ *
+ * Returns the address length.
+ */
+static uint get_alen(char *arg)
+{
+	int	j;
+	int	alen;
+
+	alen = 1;
+	for (j = 0; j < 8; j++) {
+		if (arg[j] == '.') {
+			alen = arg[j+1] - '0';
+			break;
+		} else if (arg[j] == '\0') {
+			break;
+		}
+	}
+	return alen;
+}
+
+#define DISP_LINE_LEN	16
+
+/*
+ * TODO(sjg@chromium.org): This code copied almost verbatim from cmd_i2c.c
+ * so we can remove it later.
+ */
+static int cros_ec_i2c_md(struct cros_ec_dev *dev, int flag, int argc,
+			  char * const argv[])
+{
+	u_char	chip;
+	uint	addr, alen, length = 0x10;
+	int	j, nbytes, linebytes;
+
+	if (argc < 2)
+		return CMD_RET_USAGE;
+
+	if (1 || (flag & CMD_FLAG_REPEAT) == 0) {
+		/*
+		 * New command specified.
+		 */
+
+		/*
+		 * I2C chip address
+		 */
+		chip = simple_strtoul(argv[0], NULL, 16);
+
+		/*
+		 * I2C data address within the chip.  This can be 1 or
+		 * 2 bytes long.  Some day it might be 3 bytes long :-).
+		 */
+		addr = simple_strtoul(argv[1], NULL, 16);
+		alen = get_alen(argv[1]);
+		if (alen > 3)
+			return CMD_RET_USAGE;
+
+		/*
+		 * If another parameter, it is the length to display.
+		 * Length is the number of objects, not number of bytes.
+		 */
+		if (argc > 2)
+			length = simple_strtoul(argv[2], NULL, 16);
+	}
+
+	/*
+	 * Print the lines.
+	 *
+	 * We buffer all read data, so we can make sure data is read only
+	 * once.
+	 */
+	nbytes = length;
+	do {
+		unsigned char	linebuf[DISP_LINE_LEN];
+		unsigned char	*cp;
+
+		linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes;
+
+		if (cros_ec_i2c_xfer(dev, chip, addr, alen, linebuf, linebytes,
+				     1))
+			puts("Error reading the chip.\n");
+		else {
+			printf("%04x:", addr);
+			cp = linebuf;
+			for (j = 0; j < linebytes; j++) {
+				printf(" %02x", *cp++);
+				addr++;
+			}
+			puts("    ");
+			cp = linebuf;
+			for (j = 0; j < linebytes; j++) {
+				if ((*cp < 0x20) || (*cp > 0x7e))
+					puts(".");
+				else
+					printf("%c", *cp);
+				cp++;
+			}
+			putc('\n');
+		}
+		nbytes -= linebytes;
+	} while (nbytes > 0);
+
+	return 0;
+}
+
+static int cros_ec_i2c_mw(struct cros_ec_dev *dev, int flag, int argc,
+			  char * const argv[])
+{
+	uchar	chip;
+	ulong	addr;
+	uint	alen;
+	uchar	byte;
+	int	count;
+
+	if ((argc < 3) || (argc > 4))
+		return CMD_RET_USAGE;
+
+	/*
+	 * Chip is always specified.
+	 */
+	chip = simple_strtoul(argv[0], NULL, 16);
+
+	/*
+	 * Address is always specified.
+	 */
+	addr = simple_strtoul(argv[1], NULL, 16);
+	alen = get_alen(argv[1]);
+	if (alen > 3)
+		return CMD_RET_USAGE;
+
+	/*
+	 * Value to write is always specified.
+	 */
+	byte = simple_strtoul(argv[2], NULL, 16);
+
+	/*
+	 * Optional count
+	 */
+	if (argc == 4)
+		count = simple_strtoul(argv[3], NULL, 16);
+	else
+		count = 1;
+
+	while (count-- > 0) {
+		if (cros_ec_i2c_xfer(dev, chip, addr++, alen, &byte, 1, 0))
+			puts("Error writing the chip.\n");
+		/*
+		 * Wait for the write to complete.  The write can take
+		 * up to 10mSec (we allow a little more time).
+		 */
+/*
+ * No write delay with FRAM devices.
+ */
+#if !defined(CONFIG_SYS_I2C_FRAM)
+		udelay(11000);
+#endif
+	}
+
+	return 0;
+}
+
+/* Temporary code until we have driver model and can use the i2c command */
+static int cros_ec_i2c_passthrough(struct cros_ec_dev *dev, int flag,
+				   int argc, char * const argv[])
+{
+	const char *cmd;
+
+	if (argc < 1)
+		return CMD_RET_USAGE;
+	cmd = *argv++;
+	argc--;
+	if (0 == strcmp("md", cmd))
+		cros_ec_i2c_md(dev, flag, argc, argv);
+	else if (0 == strcmp("mw", cmd))
+		cros_ec_i2c_mw(dev, flag, argc, argv);
+	else
+		return CMD_RET_USAGE;
+
+	return 0;
+}
+
 static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	struct cros_ec_dev *dev = last_dev;
@@ -1044,7 +1547,7 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 		}
 		printf("%s\n", id);
 	} else if (0 == strcmp("info", cmd)) {
-		struct ec_response_cros_ec_info info;
+		struct ec_response_mkbp_info info;
 
 		if (cros_ec_info(dev, &info)) {
 			debug("%s: Could not read KBC info\n", __func__);
@@ -1213,10 +1716,10 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 		if (!ret) {
 			/* Print versions */
 			printf("RO version:    %1.*s\n",
-			       sizeof(p->version_string_ro),
+			       (int)sizeof(p->version_string_ro),
 			       p->version_string_ro);
 			printf("RW version:    %1.*s\n",
-			       sizeof(p->version_string_rw),
+			       (int)sizeof(p->version_string_rw),
 			       p->version_string_rw);
 			printf("Firmware copy: %s\n",
 				(p->current_image <
@@ -1254,6 +1757,8 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 			debug("%s: Could not access LDO%d\n", __func__, index);
 			return ret;
 		}
+	} else if (0 == strcmp("i2c", cmd)) {
+		ret = cros_ec_i2c_passthrough(dev, flag, argc - 2, argv + 2);
 	} else {
 		return CMD_RET_USAGE;
 	}
@@ -1267,7 +1772,7 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 }
 
 U_BOOT_CMD(
-	crosec,	5,	1,	do_cros_ec,
+	crosec,	6,	1,	do_cros_ec,
 	"CROS-EC utility command",
 	"init                Re-init CROS-EC (done on startup automatically)\n"
 	"crosec id                  Read CROS-EC ID\n"
@@ -1284,6 +1789,8 @@ U_BOOT_CMD(
 	"crosec vbnvcontext [hexstring]        Read [write] VbNvContext from EC\n"
 	"crosec ldo <idx> [<state>] Switch/Read LDO state\n"
 	"crosec test                run tests on cros_ec\n"
-	"crosec version             Read CROS-EC version"
+	"crosec version             Read CROS-EC version\n"
+	"crosec i2c md chip address[.0, .1, .2] [# of objects] - read from I2C passthru\n"
+	"crosec i2c mw chip address[.0, .1, .2] value [count] - write to I2C passthru (fill)"
 );
 #endif
diff --git a/drivers/misc/cros_ec_i2c.c b/drivers/misc/cros_ec_i2c.c
index 0fbab99..513cdb1 100644
--- a/drivers/misc/cros_ec_i2c.c
+++ b/drivers/misc/cros_ec_i2c.c
@@ -35,7 +35,7 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	uint8_t *ptr;
 	/* Receive input data, so that args will be dword aligned */
 	uint8_t *in_ptr;
-	int ret;
+	int len, csum, ret;
 
 	old_bus = i2c_get_bus_num();
 
@@ -67,24 +67,24 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	 * will be dword aligned.
 	 */
 	in_ptr = dev->din + sizeof(int64_t);
-	if (!dev->cmd_version_is_supported) {
-		/* Send an old-style command */
-		*ptr++ = cmd;
-		out_bytes = dout_len + 1;
-		in_bytes = din_len + 2;
-		in_ptr--;	/* Expect just a status byte */
-	} else {
-		*ptr++ = EC_CMD_VERSION0 + cmd_version;
-		*ptr++ = cmd;
-		*ptr++ = dout_len;
-		in_ptr -= 2;	/* Expect status, length bytes */
+
+	if (dev->protocol_version != 2) {
+		/* Something we don't support */
+		debug("%s: Protocol version %d unsupported\n",
+		      __func__, dev->protocol_version);
+		return -1;
 	}
+
+	*ptr++ = EC_CMD_VERSION0 + cmd_version;
+	*ptr++ = cmd;
+	*ptr++ = dout_len;
+	in_ptr -= 2;	/* Expect status, length bytes */
+
 	memcpy(ptr, dout, dout_len);
 	ptr += dout_len;
 
-	if (dev->cmd_version_is_supported)
-		*ptr++ = (uint8_t)
-			 cros_ec_calc_checksum(dev->dout, dout_len + 3);
+	*ptr++ = (uint8_t)
+		cros_ec_calc_checksum(dev->dout, dout_len + 3);
 
 	/* Set to the proper i2c bus */
 	if (i2c_set_bus_num(dev->bus_num)) {
@@ -121,26 +121,20 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 		return -(int)*in_ptr;
 	}
 
-	if (dev->cmd_version_is_supported) {
-		int len, csum;
-
-		len = in_ptr[1];
-		if (len + 3 > sizeof(dev->din)) {
-			debug("%s: Received length %#02x too large\n",
-			      __func__, len);
-			return -1;
-		}
-		csum = cros_ec_calc_checksum(in_ptr, 2 + len);
-		if (csum != in_ptr[2 + len]) {
-			debug("%s: Invalid checksum rx %#02x, calced %#02x\n",
-			      __func__, in_ptr[2 + din_len], csum);
-			return -1;
-		}
-		din_len = min(din_len, len);
-		cros_ec_dump_data("in", -1, in_ptr, din_len + 3);
-	} else {
-		cros_ec_dump_data("in (old)", -1, in_ptr, in_bytes);
+	len = in_ptr[1];
+	if (len + 3 > sizeof(dev->din)) {
+		debug("%s: Received length %#02x too large\n",
+		      __func__, len);
+		return -1;
 	}
+	csum = cros_ec_calc_checksum(in_ptr, 2 + len);
+	if (csum != in_ptr[2 + len]) {
+		debug("%s: Invalid checksum rx %#02x, calced %#02x\n",
+		      __func__, in_ptr[2 + din_len], csum);
+		return -1;
+	}
+	din_len = min(din_len, len);
+	cros_ec_dump_data("in", -1, in_ptr, din_len + 3);
 
 	/* Return pointer to dword-aligned input data, if any */
 	*dinp = dev->din + sizeof(int64_t);
@@ -178,7 +172,5 @@ int cros_ec_i2c_init(struct cros_ec_dev *dev, const void *blob)
 {
 	i2c_init(dev->max_frequency, dev->addr);
 
-	dev->cmd_version_is_supported = 0;
-
 	return 0;
 }
diff --git a/drivers/misc/cros_ec_lpc.c b/drivers/misc/cros_ec_lpc.c
index 7257476..0e02671 100644
--- a/drivers/misc/cros_ec_lpc.c
+++ b/drivers/misc/cros_ec_lpc.c
@@ -40,71 +40,6 @@ static int wait_for_sync(struct cros_ec_dev *dev)
 	return 0;
 }
 
-/**
- * Send a command to a LPC CROS_EC device and return the reply.
- *
- * The device's internal input/output buffers are used.
- *
- * @param dev		CROS_EC device
- * @param cmd		Command to send (EC_CMD_...)
- * @param cmd_version	Version of command to send (EC_VER_...)
- * @param dout          Output data (may be NULL If dout_len=0)
- * @param dout_len      Size of output data in bytes
- * @param dinp          Place to put pointer to response data
- * @param din_len       Maximum size of response in bytes
- * @return number of bytes in response, or -1 on error
- */
-static int old_lpc_command(struct cros_ec_dev *dev, uint8_t cmd,
-		     const uint8_t *dout, int dout_len,
-		     uint8_t **dinp, int din_len)
-{
-	int ret, i;
-
-	if (dout_len > EC_OLD_PARAM_SIZE) {
-		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
-		return -1;
-	}
-
-	if (din_len > EC_OLD_PARAM_SIZE) {
-		debug("%s: Cannot receive %d bytes\n", __func__, din_len);
-		return -1;
-	}
-
-	if (wait_for_sync(dev)) {
-		debug("%s: Timeout waiting ready\n", __func__);
-		return -1;
-	}
-
-	debug_trace("cmd: %02x, ", cmd);
-	for (i = 0; i < dout_len; i++) {
-		debug_trace("%02x ", dout[i]);
-		outb(dout[i], EC_LPC_ADDR_OLD_PARAM + i);
-	}
-	outb(cmd, EC_LPC_ADDR_HOST_CMD);
-	debug_trace("\n");
-
-	if (wait_for_sync(dev)) {
-		debug("%s: Timeout waiting ready\n", __func__);
-		return -1;
-	}
-
-	ret = inb(EC_LPC_ADDR_HOST_DATA);
-	if (ret) {
-		debug("%s: CROS_EC result code %d\n", __func__, ret);
-		return -ret;
-	}
-
-	debug_trace("resp: %02x, ", ret);
-	for (i = 0; i < din_len; i++) {
-		dev->din[i] = inb(EC_LPC_ADDR_OLD_PARAM + i);
-		debug_trace("%02x ", dev->din[i]);
-	}
-	debug_trace("\n");
-	*dinp = dev->din;
-
-	return din_len;
-}
-
 int cros_ec_lpc_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 		     const uint8_t *dout, int dout_len,
 		     uint8_t **dinp, int din_len)
@@ -119,11 +54,6 @@ int cros_ec_lpc_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	int csum;
 	int i;
 
-	/* Fall back to old-style command interface if args aren't supported */
-	if (!dev->cmd_version_is_supported)
-		return old_lpc_command(dev, cmd, dout, dout_len, dinp,
-				       din_len);
-
 	if (dout_len > EC_HOST_PARAM_SIZE) {
 		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
 		return -1;
@@ -256,13 +186,9 @@ int cros_ec_lpc_check_version(struct cros_ec_dev *dev)
 			(inb(EC_LPC_ADDR_MEMMAP +
 				EC_MEMMAP_HOST_CMD_FLAGS) &
 				EC_HOST_CMD_FLAG_LPC_ARGS_SUPPORTED)) {
-		dev->cmd_version_is_supported = 1;
-	} else {
-		/* We are going to use the old IO ports */
-		dev->cmd_version_is_supported = 0;
+		return 0;
 	}
-	debug("lpc: version %s\n", dev->cmd_version_is_supported ?
-			"new" : "old");
 
-	return 0;
+	printf("%s: ERROR: old EC interface not supported\n", __func__);
+	return -1;
 }
diff --git a/drivers/misc/cros_ec_sandbox.c b/drivers/misc/cros_ec_sandbox.c
new file mode 100644
index 0000000..4bb1d60
--- /dev/null
+++ b/drivers/misc/cros_ec_sandbox.c
@@ -0,0 +1,559 @@
+/*
+ * Chromium OS cros_ec driver - sandbox emulation
+ *
+ * Copyright (c) 2013 The Chromium OS Authors.
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <cros_ec.h>
+#include <ec_commands.h>
+#include <errno.h>
+#include <hash.h>
+#include <malloc.h>
+#include <os.h>
+#include <sha256.h>
+#include <spi.h>
+#include <asm/state.h>
+#include <asm/sdl.h>
+#include <linux/input.h>
+
+/*
+ * Ultimately it shold be possible to connect an Chrome OS EC emulation
+ * to U-Boot and remove all of this code. But this provides a test
+ * environment for bringing up chromeos_sandbox and demonstrating its
+ * utility.
+ *
+ * This emulation includes the following:
+ *
+ * 1. Emulation of the keyboard, by converting keypresses received from SDL
+ * into key scan data, passed back from the EC as key scan messages. The
+ * key layout is read from the device tree.
+ *
+ * 2. Emulation of vboot context - so this can be read/written as required.
+ *
+ * 3. Save/restore of EC state, so that the vboot context, flash memory
+ * contents and current image can be preserved across boots. This is important
+ * since the EC is supposed to continue running even if the AP resets.
+ *
+ * 4. Some event support, in particular allowing Escape to be pressed on boot
+ * to enter recovery mode. The EC passes this to U-Boot through the normal
+ * event message.
+ *
+ * 5. Flash read/write/erase support, so that software sync works. The
+ * protect messages are supported but no protection is implemented.
+ *
+ * 6. Hashing of the EC image, again to support software sync.
+ *
+ * Other features can be added, although a better path is probably to link
+ * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
+ */
+
+DECLARE_GLOBAL_DATA_PTR;
+
+#define KEYBOARD_ROWS	8
+#define KEYBOARD_COLS	13
+
+/* A single entry of the key matrix */
+struct ec_keymatrix_entry {
+	int row;	/* key matrix row */
+	int col;	/* key matrix column */
+	int keycode;	/* corresponding linux key code */
+};
+
+/**
+ * struct ec_state - Information about the EC state
+ *
+ * @vbnv_context: Vboot context data stored by EC
+ * @ec_config: FDT config information about the EC (e.g. flashmap)
+ * @flash_data: Contents of flash memory
+ * @flash_data_len: Size of flash memory
+ * @current_image: Current image the EC is running
+ * @matrix_count: Number of keys to decode in matrix
+ * @matrix: Information about keyboard matrix
+ * @keyscan: Current keyscan information (bit set for each row/column pressed)
+ * @recovery_req: Keyboard recovery requested
+ */
+struct ec_state {
+	uint8_t vbnv_context[EC_VBNV_BLOCK_SIZE];
+	struct fdt_cros_ec ec_config;
+	uint8_t *flash_data;
+	int flash_data_len;
+	enum ec_current_image current_image;
+	int matrix_count;
+	struct ec_keymatrix_entry *matrix;	/* the key matrix info */
+	uint8_t keyscan[KEYBOARD_COLS];
+	bool recovery_req;
+} s_state, *state;
+
+/**
+ * cros_ec_read_state() - read the sandbox EC state from the state file
+ *
+ * If data is available, then blob and node will provide access to it. If
+ * not this function sets up an empty EC.
+ *
+ * @param blob: Pointer to device tree blob, or NULL if no data to read
+ * @param node: Node offset to read from
+ */
+static int cros_ec_read_state(const void *blob, int node)
+{
+	struct ec_state *ec = &s_state;
+	const char *prop;
+	int len;
+
+	/* Set everything to defaults */
+	ec->current_image = EC_IMAGE_RO;
+	if (!blob)
+		return 0;
+
+	/* Read the data if available */
+	ec->current_image = fdtdec_get_int(blob, node, "current-image",
+					   EC_IMAGE_RO);
+	prop = fdt_getprop(blob, node, "vbnv-context", &len);
+	if (prop && len == sizeof(ec->vbnv_context))
+		memcpy(ec->vbnv_context, prop, len);
+
+	prop = fdt_getprop(blob, node, "flash-data", &len);
+	if (prop) {
+		ec->flash_data_len = len;
+		ec->flash_data = os_malloc(len);
+		if (!ec->flash_data)
+			return -ENOMEM;
+		memcpy(ec->flash_data, prop, len);
+		debug("%s: Loaded EC flash data size %#x\n", __func__, len);
+	}
+
+	return 0;
+}
+
+/**
+ * cros_ec_write_state() - Write out our state to the state file
+ *
+ * The caller will ensure that there is a node ready for the state. The node
+ * may already contain the old state, in which case it is overridden.
+ *
+ * @param blob: Device tree blob holding state
+ * @param node: Node to write our state into
+ */
+static int cros_ec_write_state(void *blob, int node)
+{
+	struct ec_state *ec = &s_state;
+
+	/* We are guaranteed enough space to write basic properties */
+	fdt_setprop_u32(blob, node, "current-image", ec->current_image);
+	fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
+		    sizeof(ec->vbnv_context));
+	return state_setprop(node, "flash-data", ec->flash_data,
+			     ec->ec_config.flash.length);
+}
+
+SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
+		 cros_ec_write_state);
+
+/**
+ * Return the number of bytes used in the specified image.
+ *
+ * This is the actual size of code+data in the image, as opposed to the
+ * amount of space reserved in flash for that image. This code is similar to
+ * that used by the real EC code base.
+ *
+ * @param ec	Current emulated EC state
+ * @param entry	Flash map entry containing the image to check
+ * @return actual image size in bytes, 0 if the image contains no content or
+ * error.
+ */
+static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
+{
+	int size;
+
+	/*
+	 * Scan backwards looking for 0xea byte, which is by definition the
+	 * last byte of the image.  See ec.lds.S for how this is inserted at
+	 * the end of the image.
+	 */
+	for (size = entry->length - 1;
+	     size > 0 && ec->flash_data[entry->offset + size] != 0xea;
+	     size--)
+		;
+
+	return size ? size + 1 : 0;  /* 0xea byte IS part of the image */
+}
+
+/**
+ * Read the key matrix from the device tree
+ *
+ * Keymap entries in the fdt take the form of 0xRRCCKKKK where
+ * RR=Row CC=Column KKKK=Key Code
+ *
+ * @param ec	Current emulated EC state
+ * @param blob	Device tree blob containing keyscan information
+ * @param node	Keyboard node of device tree containing keyscan information
+ * @return 0 if ok, -1 on error
+ */
+static int keyscan_read_fdt_matrix(struct ec_state *ec, const void *blob,
+				   int node)
+{
+	const u32 *cell;
+	int upto;
+	int len;
+
+	cell = fdt_getprop(blob, node, "linux,keymap", &len);
+	ec->matrix_count = len / 4;
+	ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
+	if (!ec->matrix) {
+		debug("%s: Out of memory for key matrix\n", __func__);
+		return -1;
+	}
+
+	/* Now read the data */
+	for (upto = 0; upto < ec->matrix_count; upto++) {
+		struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
+		u32 word;
+
+		word = fdt32_to_cpu(*cell++);
+		matrix->row = word >> 24;
+		matrix->col = (word >> 16) & 0xff;
+		matrix->keycode = word & 0xffff;
+
+		/* Hard-code some sanity limits for now */
+		if (matrix->row >= KEYBOARD_ROWS ||
+		    matrix->col >= KEYBOARD_COLS) {
+			debug("%s: Matrix pos out of range (%d,%d)\n",
+			      __func__, matrix->row, matrix->col);
+			return -1;
+		}
+	}
+
+	if (upto != ec->matrix_count) {
+		debug("%s: Read mismatch from key matrix\n", __func__);
+		return -1;
+	}
+
+	return 0;
+}
+
+/**
+ * Return the next keyscan message contents
+ *
+ * @param ec	Current emulated EC state
+ * @param scan	Place to put keyscan bytes for the keyscan message (must hold
+ *		enough space for a full keyscan)
+ * @return number of bytes of valid scan data
+ */
+static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
+{
+	const struct ec_keymatrix_entry *matrix;
+	int bytes = KEYBOARD_COLS;
+	int key[8];	/* allow up to 8 keys to be pressed at once */
+	int count;
+	int i;
+
+	memset(ec->keyscan, '\0', bytes);
+	count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
+
+	/* Look up keycode in matrix */
+	for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
+		bool found;
+		int j;
+
+		for (found = false, j = 0; j < count; j++) {
+			if (matrix->keycode == key[j])
+				found = true;
+		}
+
+		if (found) {
+			debug("%d: %d,%d\n", matrix->keycode, matrix->row,
+			      matrix->col);
+			ec->keyscan[matrix->col] |= 1 << matrix->row;
+		}
+	}
+
+	memcpy(scan, ec->keyscan, bytes);
+	return bytes;
+}
+
+/**
+ * Process an emulated EC command
+ *
+ * @param ec		Current emulated EC state
+ * @param req_hdr	Pointer to request header
+ * @param req_data	Pointer to body of request
+ * @param resp_hdr	Pointer to place to put response header
+ * @param resp_data	Pointer to place to put response data, if any
+ * @return length of response data, or 0 for no response data, or -1 on error
+ */
+static int process_cmd(struct ec_state *ec,
+		       struct ec_host_request *req_hdr, const void *req_data,
+		       struct ec_host_response *resp_hdr, void *resp_data)
+{
+	int len;
+
+	/* TODO(sjg@chromium.org): Check checksums */
+	debug("EC command %#0x\n", req_hdr->command);
+
+	switch (req_hdr->command) {
+	case EC_CMD_HELLO: {
+		const struct ec_params_hello *req = req_data;
+		struct ec_response_hello *resp = resp_data;
+
+		resp->out_data = req->in_data + 0x01020304;
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_GET_VERSION: {
+		struct ec_response_get_version *resp = resp_data;
+
+		strcpy(resp->version_string_ro, "sandbox_ro");
+		strcpy(resp->version_string_rw, "sandbox_rw");
+		resp->current_image = ec->current_image;
+		debug("Current image %d\n", resp->current_image);
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_VBNV_CONTEXT: {
+		const struct ec_params_vbnvcontext *req = req_data;
+		struct ec_response_vbnvcontext *resp = resp_data;
+
+		switch (req->op) {
+		case EC_VBNV_CONTEXT_OP_READ:
+			memcpy(resp->block, ec->vbnv_context,
+			       sizeof(resp->block));
+			len = sizeof(*resp);
+			break;
+		case EC_VBNV_CONTEXT_OP_WRITE:
+			memcpy(ec->vbnv_context, resp->block,
+			       sizeof(resp->block));
+			len = 0;
+			break;
+		default:
+			printf("   ** Unknown vbnv_context command %#02x\n",
+			       req->op);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_REBOOT_EC: {
+		const struct ec_params_reboot_ec *req = req_data;
+
+		printf("Request reboot type %d\n", req->cmd);
+		switch (req->cmd) {
+		case EC_REBOOT_DISABLE_JUMP:
+			len = 0;
+			break;
+		case EC_REBOOT_JUMP_RW:
+			ec->current_image = EC_IMAGE_RW;
+			len = 0;
+			break;
+		default:
+			puts("   ** Unknown type");
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_HOST_EVENT_GET_B: {
+		struct ec_response_host_event_mask *resp = resp_data;
+
+		resp->mask = 0;
+		if (ec->recovery_req) {
+			resp->mask |= EC_HOST_EVENT_MASK(
+					EC_HOST_EVENT_KEYBOARD_RECOVERY);
+		}
+
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_VBOOT_HASH: {
+		const struct ec_params_vboot_hash *req = req_data;
+		struct ec_response_vboot_hash *resp = resp_data;
+		struct fmap_entry *entry;
+		int ret, size;
+
+		entry = &state->ec_config.region[EC_FLASH_REGION_RW];
+
+		switch (req->cmd) {
+		case EC_VBOOT_HASH_RECALC:
+		case EC_VBOOT_HASH_GET:
+			size = SHA256_SUM_LEN;
+			len = get_image_used(ec, entry);
+			ret = hash_block("sha256",
+					 ec->flash_data + entry->offset,
+					 len, resp->hash_digest, &size);
+			if (ret) {
+				printf("   ** hash_block() failed\n");
+				return -1;
+			}
+			resp->status = EC_VBOOT_HASH_STATUS_DONE;
+			resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
+			resp->digest_size = size;
+			resp->reserved0 = 0;
+			resp->offset = entry->offset;
+			resp->size = len;
+			len = sizeof(*resp);
+			break;
+		default:
+			printf("   ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
+			       req->cmd);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_PROTECT: {
+		const struct ec_params_flash_protect *req = req_data;
+		struct ec_response_flash_protect *resp = resp_data;
+		uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
+				EC_FLASH_PROTECT_ALL_AT_BOOT;
+
+		printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
+		if (req->flags == expect || req->flags == 0) {
+			resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
+								0;
+			resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
+			resp->writable_flags = 0;
+			len = sizeof(*resp);
+		} else {
+			puts("   ** unexpected flash protect request\n");
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_REGION_INFO: {
+		const struct ec_params_flash_region_info *req = req_data;
+		struct ec_response_flash_region_info *resp = resp_data;
+		struct fmap_entry *entry;
+
+		switch (req->region) {
+		case EC_FLASH_REGION_RO:
+		case EC_FLASH_REGION_RW:
+		case EC_FLASH_REGION_WP_RO:
+			entry = &state->ec_config.region[req->region];
+			resp->offset = entry->offset;
+			resp->size = entry->length;
+			len = sizeof(*resp);
+			printf("EC flash region %d: offset=%#x, size=%#x\n",
+			       req->region, resp->offset, resp->size);
+			break;
+		default:
+			printf("** Unknown flash region %d\n", req->region);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_ERASE: {
+		const struct ec_params_flash_erase *req = req_data;
+
+		memset(ec->flash_data + req->offset,
+		       ec->ec_config.flash_erase_value,
+		       req->size);
+		len = 0;
+		break;
+	}
+	case EC_CMD_FLASH_WRITE: {
+		const struct ec_params_flash_write *req = req_data;
+
+		memcpy(ec->flash_data + req->offset, req + 1, req->size);
+		len = 0;
+		break;
+	}
+	case EC_CMD_MKBP_STATE:
+		len = cros_ec_keyscan(ec, resp_data);
+		break;
+	default:
+		printf("   ** Unknown EC command %#02x\n", req_hdr->command);
+		return -1;
+	}
+
+	return len;
+}
+
+int cros_ec_sandbox_packet(struct cros_ec_dev *dev, int out_bytes,
+			   int in_bytes)
+{
+	struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
+	const void *req_data = req_hdr + 1;
+	struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
+	void *resp_data = resp_hdr + 1;
+	int len;
+
+	len = process_cmd(&s_state, req_hdr, req_data, resp_hdr, resp_data);
+	if (len < 0)
+		return len;
+
+	resp_hdr->struct_version = 3;
+	resp_hdr->result = EC_RES_SUCCESS;
+	resp_hdr->data_len = len;
+	resp_hdr->reserved = 0;
+	len += sizeof(*resp_hdr);
+	resp_hdr->checksum = 0;
+	resp_hdr->checksum = (uint8_t)
+		-cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
+
+	return in_bytes;
+}
+
+int cros_ec_sandbox_decode_fdt(struct cros_ec_dev *dev, const void *blob)
+{
+	return 0;
+}
+
+void cros_ec_check_keyboard(struct cros_ec_dev *dev)
+{
+	struct ec_state *ec = &s_state;
+	ulong start;
+
+	printf("Press keys for EC to detect on reset (ESC=recovery)...");
+	start = get_timer(0);
+	while (get_timer(start) < 1000)
+		;
+	putc('\n');
+	if (!sandbox_sdl_key_pressed(KEY_ESC)) {
+		ec->recovery_req = true;
+		printf("   - EC requests recovery\n");
+	}
+}
+
+/**
+ * Initialize sandbox EC emulation.
+ *
+ * @param dev		CROS_EC device
+ * @param blob		Device tree blob
+ * @return 0 if ok, -1 on error
+ */
+int cros_ec_sandbox_init(struct cros_ec_dev *dev, const void *blob)
+{
+	struct ec_state *ec = &s_state;
+	int node;
+	int err;
+
+	state = &s_state;
+	err = cros_ec_decode_ec_flash(blob, &ec->ec_config);
+	if (err)
+		return err;
+
+	node = fdtdec_next_compatible(blob, 0, COMPAT_GOOGLE_CROS_EC_KEYB);
+	if (node < 0) {
+		debug("%s: No cros_ec keyboard found\n", __func__);
+	} else if (keyscan_read_fdt_matrix(ec, blob, node)) {
+		debug("%s: Could not read key matrix\n", __func__);
+		return -1;
+	}
+
+	/* If we loaded EC data, check that the length matches */
+	if (ec->flash_data &&
+	    ec->flash_data_len != ec->ec_config.flash.length) {
+		printf("EC data length is %x, expected %x, discarding data\n",
+		       ec->flash_data_len, ec->ec_config.flash.length);
+		os_free(ec->flash_data);
+		ec->flash_data = NULL;
+	}
+
+	/* Otherwise allocate the memory */
+	if (!ec->flash_data) {
+		ec->flash_data_len = ec->ec_config.flash.length;
+		ec->flash_data = os_malloc(ec->flash_data_len);
+		if (!ec->flash_data)
+			return -ENOMEM;
+	}
+
+	return 0;
+}
diff --git a/drivers/misc/cros_ec_spi.c b/drivers/misc/cros_ec_spi.c
index 2fc9110..7df709c 100644
--- a/drivers/misc/cros_ec_spi.c
+++ b/drivers/misc/cros_ec_spi.c
@@ -17,6 +17,30 @@
 #include <cros_ec.h>
 #include <spi.h>
 
+int cros_ec_spi_packet(struct cros_ec_dev *dev, int out_bytes, int in_bytes)
+{
+	int rv;
+
+	/* Do the transfer */
+	if (spi_claim_bus(dev->spi)) {
+		debug("%s: Cannot claim SPI bus\n", __func__);
+		return -1;
+	}
+
+	rv = spi_xfer(dev->spi, max(out_bytes, in_bytes) * 8,
+		      dev->dout, dev->din,
+		      SPI_XFER_BEGIN | SPI_XFER_END);
+
+	spi_release_bus(dev->spi);
+
+	if (rv) {
+		debug("%s: Cannot complete SPI transfer\n", __func__);
+		return -1;
+	}
+
+	return in_bytes;
+}
+
 /**
  * Send a command to a LPC CROS_EC device and return the reply.
  *
@@ -42,6 +66,12 @@ int cros_ec_spi_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	int csum, len;
 	int rv;
 
+	if (dev->protocol_version != 2) {
+		debug("%s: Unsupported EC protcol version %d\n",
+		      __func__, dev->protocol_version);
+		return -1;
+	}
+
 	/*
 	 * Sanity-check input size to make sure it plus transaction overhead
 	 * fits in the internal device buffer.
diff --git a/drivers/mtd/spi/sf_ops.c b/drivers/mtd/spi/sf_ops.c
index 1f1bb36..ef91b92 100644
--- a/drivers/mtd/spi/sf_ops.c
+++ b/drivers/mtd/spi/sf_ops.c
@@ -9,6 +9,7 @@
  */
 
 #include <common.h>
+#include <errno.h>
 #include <malloc.h>
 #include <spi.h>
 #include <spi_flash.h>
@@ -381,8 +382,11 @@ int spi_flash_cmd_read_ops(struct spi_flash *flash, u32 offset,
 	}
 
 	cmdsz = SPI_FLASH_CMD_LEN + flash->dummy_byte;
-	cmd = malloc(cmdsz);
-	memset(cmd, 0, cmdsz);
+	cmd = calloc(1, cmdsz);
+	if (!cmd) {
+		debug("SF: Failed to allocate cmd\n");
+		return -ENOMEM;
+	}
 
 	cmd[0] = flash->read_cmd;
 	while (len) {
diff --git a/drivers/mtd/spi/sf_params.c b/drivers/mtd/spi/sf_params.c
index daf8fe7..eb372b7 100644
--- a/drivers/mtd/spi/sf_params.c
+++ b/drivers/mtd/spi/sf_params.c
@@ -54,10 +54,11 @@ const struct spi_flash_params spi_flash_params_table[] = {
 	{"S25FL128P_64K",  0x012018, 0x0301,    64 * 1024,   256, RD_FULL,		     WR_QPP},
 	{"S25FL032P",	   0x010215, 0x4d00,    64 * 1024,    64, RD_FULL,		     WR_QPP},
 	{"S25FL064P",	   0x010216, 0x4d00,    64 * 1024,   128, RD_FULL,		     WR_QPP},
+	{"S25FL128S_256K", 0x012018, 0x4d00,   256 * 1024,    64, RD_FULL,		     WR_QPP},
 	{"S25FL128S_64K",  0x012018, 0x4d01,    64 * 1024,   256, RD_FULL,		     WR_QPP},
-	{"S25FL256S_256K", 0x010219, 0x4d00,    64 * 1024,   512, RD_FULL,		     WR_QPP},
+	{"S25FL256S_256K", 0x010219, 0x4d00,   256 * 1024,   128, RD_FULL,		     WR_QPP},
 	{"S25FL256S_64K",  0x010219, 0x4d01,	64 * 1024,   512, RD_FULL,		     WR_QPP},
-	{"S25FL512S_256K", 0x010220, 0x4d00,    64 * 1024,  1024, RD_FULL,		     WR_QPP},
+	{"S25FL512S_256K", 0x010220, 0x4d00,   256 * 1024,   256, RD_FULL,		     WR_QPP},
 	{"S25FL512S_64K",  0x010220, 0x4d01,    64 * 1024,  1024, RD_FULL,		     WR_QPP},
 #endif
 #ifdef CONFIG_SPI_FLASH_STMICRO		/* STMICRO */
diff --git a/drivers/mtd/spi/sf_probe.c b/drivers/mtd/spi/sf_probe.c
index bc3cf6c..0a46fe3 100644
--- a/drivers/mtd/spi/sf_probe.c
+++ b/drivers/mtd/spi/sf_probe.c
@@ -123,12 +123,11 @@ static struct spi_flash *spi_flash_validate_params(struct spi_slave *spi,
 		return NULL;
 	}
 
-	flash = malloc(sizeof(*flash));
+	flash = calloc(1, sizeof(*flash));
 	if (!flash) {
 		debug("SF: Failed to allocate spi_flash\n");
 		return NULL;
 	}
-	memset(flash, '\0', sizeof(*flash));
 
 	/* Assign spi data */
 	flash->spi = spi;
@@ -147,7 +146,21 @@ static struct spi_flash *spi_flash_validate_params(struct spi_slave *spi,
 
 	/* Compute the flash size */
 	flash->shift = (flash->dual_flash & SF_DUAL_PARALLEL_FLASH) ? 1 : 0;
-	flash->page_size = ((ext_jedec == 0x4d00) ? 512 : 256) << flash->shift;
+	/*
+	 * The Spansion S25FL032P and S25FL064P have 256b pages, yet use the
+	 * 0x4d00 Extended JEDEC code. The rest of the Spansion flashes with
+	 * the 0x4d00 Extended JEDEC code have 512b pages. All of the others
+	 * have 256b pages.
+	 */
+	if (ext_jedec == 0x4d00) {
+		if ((jedec == 0x0215) || (jedec == 0x216))
+			flash->page_size = 256;
+		else
+			flash->page_size = 512;
+	} else {
+		flash->page_size = 256;
+	}
+	flash->page_size <<= flash->shift;
 	flash->sector_size = params->sector_size << flash->shift;
 	flash->size = flash->sector_size * params->nr_sectors << flash->shift;
 #ifdef CONFIG_SF_DUAL_FLASH
diff --git a/drivers/serial/sandbox.c b/drivers/serial/sandbox.c
index ffff5e1..51fd871 100644
--- a/drivers/serial/sandbox.c
+++ b/drivers/serial/sandbox.c
@@ -11,9 +11,11 @@
  */
 
 #include <common.h>
+#include <lcd.h>
 #include <os.h>
 #include <serial.h>
 #include <linux/compiler.h>
+#include <asm/state.h>
 
 /*
  *
@@ -30,7 +32,10 @@ static unsigned int serial_buf_read;
 
 static int sandbox_serial_init(void)
 {
-	os_tty_raw(0);
+	struct sandbox_state *state = state_get_current();
+
+	if (state->term_raw != STATE_TERM_COOKED)
+		os_tty_raw(0, state->term_raw == STATE_TERM_RAW_WITH_SIGS);
 	return 0;
 }
 
@@ -60,6 +65,9 @@ static int sandbox_serial_tstc(void)
 	ssize_t count;
 
 	os_usleep(100);
+#ifdef CONFIG_LCD
+	lcd_sync();
+#endif
 	if (next_index == serial_buf_read)
 		return 1;	/* buffer full */
 
diff --git a/drivers/sound/Makefile b/drivers/sound/Makefile
index 6d25292..981ed61 100644
--- a/drivers/sound/Makefile
+++ b/drivers/sound/Makefile
@@ -6,6 +6,8 @@
 #
 
 obj-$(CONFIG_SOUND)	+= sound.o
-obj-$(CONFIG_I2S)	+= samsung-i2s.o
+obj-$(CONFIG_I2S)	+= sound-i2s.o
+obj-$(CONFIG_I2S_SAMSUNG)	+= samsung-i2s.o
+obj-$(CONFIG_SOUND_SANDBOX)	+= sandbox.o
 obj-$(CONFIG_SOUND_WM8994)	+= wm8994.o
 obj-$(CONFIG_SOUND_MAX98095)	+= max98095.o
diff --git a/drivers/sound/sandbox.c b/drivers/sound/sandbox.c
new file mode 100644
index 0000000..fe5c9e9
--- /dev/null
+++ b/drivers/sound/sandbox.c
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <asm/arch/sound.h>
+#include <asm/sdl.h>
+
+int sound_play(uint32_t msec, uint32_t frequency)
+{
+	sandbox_sdl_sound_start(frequency);
+	mdelay(msec);
+	sandbox_sdl_sound_stop();
+
+	return 0;
+}
+
+int sound_init(const void *blob)
+{
+	return sandbox_sdl_sound_init();
+}
diff --git a/drivers/sound/sound-i2s.c b/drivers/sound/sound-i2s.c
new file mode 100644
index 0000000..749bbbd
--- /dev/null
+++ b/drivers/sound/sound-i2s.c
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ * R. Chandrasekar <rcsekar@samsung.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <malloc.h>
+#include <common.h>
+#include <asm/io.h>
+#include <libfdt.h>
+#include <fdtdec.h>
+#include <i2c.h>
+#include <i2s.h>
+#include <sound.h>
+#include <asm/arch/sound.h>
+#include "wm8994.h"
+#include "max98095.h"
+
+/* defines */
+#define SOUND_400_HZ 400
+#define SOUND_BITS_IN_BYTE 8
+
+static struct i2stx_info g_i2stx_pri;
+
+/*
+ * get_sound_i2s_values gets values for i2s parameters
+ *
+ * @param i2stx_info	i2s transmitter transfer param structure
+ * @param blob		FDT blob if enabled else NULL
+ */
+static int get_sound_i2s_values(struct i2stx_info *i2s, const void *blob)
+{
+	int node;
+	int error = 0;
+	int base;
+
+	node = fdt_path_offset(blob, "i2s");
+	if (node <= 0) {
+		debug("EXYNOS_SOUND: No node for sound in device tree\n");
+		return -1;
+	}
+
+	/*
+	 * Get the pre-defined sound specific values from FDT.
+	 * All of these are expected to be correct otherwise
+	 * wrong register values in i2s setup parameters
+	 * may result in no sound play.
+	 */
+	base = fdtdec_get_addr(blob, node, "reg");
+	if (base == FDT_ADDR_T_NONE) {
+		debug("%s: Missing  i2s base\n", __func__);
+		return -1;
+	}
+	i2s->base_address = base;
+
+	i2s->audio_pll_clk = fdtdec_get_int(blob,
+				node, "samsung,i2s-epll-clock-frequency", -1);
+	error |= i2s->audio_pll_clk;
+	debug("audio_pll_clk = %d\n", i2s->audio_pll_clk);
+	i2s->samplingrate = fdtdec_get_int(blob,
+				node, "samsung,i2s-sampling-rate", -1);
+	error |= i2s->samplingrate;
+	debug("samplingrate = %d\n", i2s->samplingrate);
+	i2s->bitspersample = fdtdec_get_int(blob,
+				node, "samsung,i2s-bits-per-sample", -1);
+	error |= i2s->bitspersample;
+	debug("bitspersample = %d\n", i2s->bitspersample);
+	i2s->channels = fdtdec_get_int(blob,
+			node, "samsung,i2s-channels", -1);
+	error |= i2s->channels;
+	debug("channels = %d\n", i2s->channels);
+	i2s->rfs = fdtdec_get_int(blob,
+				node, "samsung,i2s-lr-clk-framesize", -1);
+	error |= i2s->rfs;
+	debug("rfs = %d\n", i2s->rfs);
+	i2s->bfs = fdtdec_get_int(blob,
+				node, "samsung,i2s-bit-clk-framesize", -1);
+	error |= i2s->bfs;
+	debug("bfs = %d\n", i2s->bfs);
+
+	i2s->id = fdtdec_get_int(blob, node, "samsung,i2s-id", -1);
+	error |= i2s->id;
+	debug("id = %d\n", i2s->id);
+
+	if (error == -1) {
+		debug("fail to get sound i2s node properties\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+/*
+ * Init codec
+ *
+ * @param blob          FDT blob
+ * @param pi2s_tx	i2s parameters required by codec
+ * @return              int value, 0 for success
+ */
+static int codec_init(const void *blob, struct i2stx_info *pi2s_tx)
+{
+	int ret;
+	const char *codectype;
+	int node;
+
+	/* Get the node from FDT for sound */
+	node = fdt_path_offset(blob, "i2s");
+	if (node <= 0) {
+		debug("EXYNOS_SOUND: No node for sound in device tree\n");
+		debug("node = %d\n", node);
+		return -1;
+	}
+
+	/*
+	 * Get the pre-defined sound codec specific values from FDT.
+	 * All of these are expected to be correct otherwise sound
+	 * can not be played
+	 */
+	codectype = fdt_getprop(blob, node, "samsung,codec-type", NULL);
+	debug("device = %s\n", codectype);
+	if (!strcmp(codectype, "wm8994")) {
+		/* Check the codec type and initialise the same */
+		ret = wm8994_init(blob, pi2s_tx->id + 1,
+				  pi2s_tx->samplingrate,
+				  (pi2s_tx->samplingrate * (pi2s_tx->rfs)),
+				  pi2s_tx->bitspersample, pi2s_tx->channels);
+	} else if (!strcmp(codectype, "max98095")) {
+		ret = max98095_init(blob, pi2s_tx->id + 1,
+				    pi2s_tx->samplingrate,
+				    (pi2s_tx->samplingrate * (pi2s_tx->rfs)),
+				    pi2s_tx->bitspersample);
+	} else {
+		debug("%s: Unknown codec type %s\n", __func__, codectype);
+		return -1;
+	}
+
+	if (ret) {
+		debug("%s: Codec init failed\n", __func__);
+		return -1;
+	}
+
+	return 0;
+}
+
+int sound_init(const void *blob)
+{
+	int ret;
+	struct i2stx_info *pi2s_tx = &g_i2stx_pri;
+
+	/* Get the I2S Values */
+	if (get_sound_i2s_values(pi2s_tx, blob) < 0) {
+		debug(" FDT I2S values failed\n");
+		return -1;
+	}
+
+	if (codec_init(blob, pi2s_tx) < 0) {
+		debug(" Codec init failed\n");
+		return -1;
+	}
+
+	ret = i2s_tx_init(pi2s_tx);
+	if (ret) {
+		debug("%s: Failed to init i2c transmit: ret=%d\n", __func__,
+		      ret);
+		return ret;
+	}
+
+
+	return ret;
+}
+
+int sound_play(uint32_t msec, uint32_t frequency)
+{
+	unsigned int *data;
+	unsigned long data_size;
+	unsigned int ret = 0;
+
+	/*Buffer length computation */
+	data_size = g_i2stx_pri.samplingrate * g_i2stx_pri.channels;
+	data_size *= (g_i2stx_pri.bitspersample / SOUND_BITS_IN_BYTE);
+	data = malloc(data_size);
+
+	if (data == NULL) {
+		debug("%s: malloc failed\n", __func__);
+		return -1;
+	}
+
+	sound_create_square_wave((unsigned short *)data,
+				 data_size / sizeof(unsigned short),
+				 frequency);
+
+	while (msec >= 1000) {
+		ret = i2s_transfer_tx_data(&g_i2stx_pri, data,
+					   (data_size / sizeof(int)));
+		msec -= 1000;
+	}
+	if (msec) {
+		unsigned long size =
+			(data_size * msec) / (sizeof(int) * 1000);
+
+		ret = i2s_transfer_tx_data(&g_i2stx_pri, data, size);
+	}
+
+	free(data);
+
+	return ret;
+}
diff --git a/drivers/sound/sound.c b/drivers/sound/sound.c
index 9b8ce5a..9dda2db 100644
--- a/drivers/sound/sound.c
+++ b/drivers/sound/sound.c
@@ -5,193 +5,10 @@
  * SPDX-License-Identifier:	GPL-2.0+
  */
 
-#include <malloc.h>
 #include <common.h>
-#include <asm/io.h>
-#include <libfdt.h>
-#include <fdtdec.h>
-#include <i2c.h>
-#include <i2s.h>
 #include <sound.h>
-#include <asm/arch/sound.h>
-#include "wm8994.h"
-#include "max98095.h"
 
-/* defines */
-#define SOUND_400_HZ 400
-#define SOUND_BITS_IN_BYTE 8
-
-static struct i2stx_info g_i2stx_pri;
-
-/*
- * get_sound_i2s_values gets values for i2s parameters
- *
- * @param i2stx_info	i2s transmitter transfer param structure
- * @param blob		FDT blob if enabled else NULL
- */
-static int get_sound_i2s_values(struct i2stx_info *i2s, const void *blob)
-{
-#ifdef CONFIG_OF_CONTROL
-	int node;
-	int error = 0;
-	int base;
-
-	node = fdt_path_offset(blob, "i2s");
-	if (node <= 0) {
-		debug("EXYNOS_SOUND: No node for sound in device tree\n");
-		return -1;
-	}
-
-	/*
-	 * Get the pre-defined sound specific values from FDT.
-	 * All of these are expected to be correct otherwise
-	 * wrong register values in i2s setup parameters
-	 * may result in no sound play.
-	 */
-	base = fdtdec_get_addr(blob, node, "reg");
-	if (base == FDT_ADDR_T_NONE) {
-		debug("%s: Missing  i2s base\n", __func__);
-		return -1;
-	}
-	i2s->base_address = base;
-
-	i2s->audio_pll_clk = fdtdec_get_int(blob,
-				node, "samsung,i2s-epll-clock-frequency", -1);
-	error |= i2s->audio_pll_clk;
-	debug("audio_pll_clk = %d\n", i2s->audio_pll_clk);
-	i2s->samplingrate = fdtdec_get_int(blob,
-				node, "samsung,i2s-sampling-rate", -1);
-	error |= i2s->samplingrate;
-	debug("samplingrate = %d\n", i2s->samplingrate);
-	i2s->bitspersample = fdtdec_get_int(blob,
-				node, "samsung,i2s-bits-per-sample", -1);
-	error |= i2s->bitspersample;
-	debug("bitspersample = %d\n", i2s->bitspersample);
-	i2s->channels = fdtdec_get_int(blob,
-			node, "samsung,i2s-channels", -1);
-	error |= i2s->channels;
-	debug("channels = %d\n", i2s->channels);
-	i2s->rfs = fdtdec_get_int(blob,
-				node, "samsung,i2s-lr-clk-framesize", -1);
-	error |= i2s->rfs;
-	debug("rfs = %d\n", i2s->rfs);
-	i2s->bfs = fdtdec_get_int(blob,
-				node, "samsung,i2s-bit-clk-framesize", -1);
-	error |= i2s->bfs;
-	debug("bfs = %d\n", i2s->bfs);
-
-	i2s->id = fdtdec_get_int(blob, node, "samsung,i2s-id", -1);
-	error |= i2s->id;
-	debug("id = %d\n", i2s->id);
-
-	if (error == -1) {
-		debug("fail to get sound i2s node properties\n");
-		return -1;
-	}
-#else
-	i2s->base_address = samsung_get_base_i2s();
-	i2s->audio_pll_clk = I2S_PLL_CLK;
-	i2s->samplingrate = I2S_SAMPLING_RATE;
-	i2s->bitspersample = I2S_BITS_PER_SAMPLE;
-	i2s->channels = I2S_CHANNELS;
-	i2s->rfs = I2S_RFS;
-	i2s->bfs = I2S_BFS;
-	i2s->id = 0;
-#endif
-	return 0;
-}
-
-/*
- * Init codec
- *
- * @param blob          FDT blob
- * @param pi2s_tx	i2s parameters required by codec
- * @return              int value, 0 for success
- */
-static int codec_init(const void *blob, struct i2stx_info *pi2s_tx)
-{
-	int ret;
-	const char *codectype;
-#ifdef CONFIG_OF_CONTROL
-	int node;
-
-	/* Get the node from FDT for sound */
-	node = fdt_path_offset(blob, "i2s");
-	if (node <= 0) {
-		debug("EXYNOS_SOUND: No node for sound in device tree\n");
-		debug("node = %d\n", node);
-		return -1;
-	}
-
-	/*
-	 * Get the pre-defined sound codec specific values from FDT.
-	 * All of these are expected to be correct otherwise sound
-	 * can not be played
-	 */
-	codectype = fdt_getprop(blob, node, "samsung,codec-type", NULL);
-	debug("device = %s\n", codectype);
-#else
-	codectype =  AUDIO_CODEC;
-#endif
-	if (!strcmp(codectype, "wm8994")) {
-		/* Check the codec type and initialise the same */
-		ret = wm8994_init(blob, pi2s_tx->id + 1,
-				  pi2s_tx->samplingrate,
-				  (pi2s_tx->samplingrate * (pi2s_tx->rfs)),
-				  pi2s_tx->bitspersample, pi2s_tx->channels);
-	} else if (!strcmp(codectype, "max98095")) {
-		ret = max98095_init(blob, pi2s_tx->id + 1,
-				    pi2s_tx->samplingrate,
-				    (pi2s_tx->samplingrate * (pi2s_tx->rfs)),
-				    pi2s_tx->bitspersample);
-	} else {
-		debug("%s: Unknown codec type %s\n", __func__, codectype);
-		return -1;
-	}
-
-	if (ret) {
-		debug("%s: Codec init failed\n", __func__);
-		return -1;
-	}
-
-	return 0;
-}
-
-int sound_init(const void *blob)
-{
-	int ret;
-	struct i2stx_info *pi2s_tx = &g_i2stx_pri;
-
-	/* Get the I2S Values */
-	if (get_sound_i2s_values(pi2s_tx, blob) < 0) {
-		debug(" FDT I2S values failed\n");
-		return -1;
-	}
-
-	if (codec_init(blob, pi2s_tx) < 0) {
-		debug(" Codec init failed\n");
-		return -1;
-	}
-
-	ret = i2s_tx_init(pi2s_tx);
-	if (ret) {
-		debug("%s: Failed to init i2c transmit: ret=%d\n", __func__,
-		      ret);
-		return ret;
-	}
-
-
-	return ret;
-}
-
-/*
- * Generates square wave sound data for 1 second
- *
- * @param data          data buffer pointer
- * @param size          size of the buffer
- * @param freq          frequency of the wave
- */
-static void sound_prepare_buffer(unsigned short *data, int size, uint32_t freq)
+void sound_create_square_wave(unsigned short *data, int size, uint32_t freq)
 {
 	const int sample = 48000;
 	const unsigned short amplitude = 16000; /* between 1 and 32767 */
@@ -218,39 +35,3 @@ static void sound_prepare_buffer(unsigned short *data, int size, uint32_t freq)
 		}
 	}
 }
-
-int sound_play(uint32_t msec, uint32_t frequency)
-{
-	unsigned int *data;
-	unsigned long data_size;
-	unsigned int ret = 0;
-
-	/*Buffer length computation */
-	data_size = g_i2stx_pri.samplingrate * g_i2stx_pri.channels;
-	data_size *= (g_i2stx_pri.bitspersample / SOUND_BITS_IN_BYTE);
-	data = malloc(data_size);
-
-	if (data == NULL) {
-		debug("%s: malloc failed\n", __func__);
-		return -1;
-	}
-
-	sound_prepare_buffer((unsigned short *)data,
-			     data_size / sizeof(unsigned short), frequency);
-
-	while (msec >= 1000) {
-		ret = i2s_transfer_tx_data(&g_i2stx_pri, data,
-					   (data_size / sizeof(int)));
-		msec -= 1000;
-	}
-	if (msec) {
-		unsigned long size =
-			(data_size * msec) / (sizeof(int) * 1000);
-
-		ret = i2s_transfer_tx_data(&g_i2stx_pri, data, size);
-	}
-
-	free(data);
-
-	return ret;
-}
diff --git a/drivers/spi/atmel_dataflash_spi.c b/drivers/spi/atmel_dataflash_spi.c
index 8a5eddc..a2e9c00 100644
--- a/drivers/spi/atmel_dataflash_spi.c
+++ b/drivers/spi/atmel_dataflash_spi.c
@@ -102,33 +102,26 @@ void AT91F_SpiEnable(int cs)
 {
 	unsigned long mode;
 
+	mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
+	mode &= ~AT91_SPI_PCS;
+
 	switch (cs) {
-	case 0:	/* Configure SPI CS0 for Serial DataFlash AT45DBxx */
-		mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
-		mode &= 0xFFF0FFFF;
-		writel(mode | ((AT91_SPI_PCS0_DATAFLASH_CARD<<16) & AT91_SPI_PCS),
-		       ATMEL_BASE_SPI0 + AT91_SPI_MR);
+	case 0:
+		mode |= AT91_SPI_PCS0_DATAFLASH_CARD << 16;
 		break;
-	case 1:	/* Configure SPI CS1 for Serial DataFlash AT45DBxx */
-		mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
-		mode &= 0xFFF0FFFF;
-		writel(mode | ((AT91_SPI_PCS1_DATAFLASH_CARD<<16) & AT91_SPI_PCS),
-		       ATMEL_BASE_SPI0 + AT91_SPI_MR);
+	case 1:
+		mode |= AT91_SPI_PCS1_DATAFLASH_CARD << 16;
 		break;
-	case 2:	/* Configure SPI CS2 for Serial DataFlash AT45DBxx */
-		mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
-		mode &= 0xFFF0FFFF;
-		writel(mode | ((AT91_SPI_PCS2_DATAFLASH_CARD<<16) & AT91_SPI_PCS),
-		       ATMEL_BASE_SPI0 + AT91_SPI_MR);
+	case 2:
+		mode |= AT91_SPI_PCS2_DATAFLASH_CARD << 16;
 		break;
 	case 3:
-		mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
-		mode &= 0xFFF0FFFF;
-		writel(mode | ((AT91_SPI_PCS3_DATAFLASH_CARD<<16) & AT91_SPI_PCS),
-		       ATMEL_BASE_SPI0 + AT91_SPI_MR);
+		mode |= AT91_SPI_PCS3_DATAFLASH_CARD << 16;
 		break;
 	}
 
+	writel(mode, ATMEL_BASE_SPI0 + AT91_SPI_MR);
+
 	/* SPI_Enable */
 	writel(AT91_SPI_SPIEN, ATMEL_BASE_SPI0 + AT91_SPI_CR);
 }
diff --git a/drivers/spi/sandbox_spi.c b/drivers/spi/sandbox_spi.c
index 7895305..12e9bda 100644
--- a/drivers/spi/sandbox_spi.c
+++ b/drivers/spi/sandbox_spi.c
@@ -202,3 +202,16 @@ int spi_xfer(struct spi_slave *slave, unsigned int bitlen, const void *dout,
 
 	return ret;
 }
+
+/**
+ * Set up a new SPI slave for an fdt node
+ *
+ * @param blob		Device tree blob
+ * @param node		SPI peripheral node to use
+ * @return 0 if ok, -1 on error
+ */
+struct spi_slave *spi_setup_slave_fdt(const void *blob, int slave_node,
+				      int spi_node)
+{
+	return NULL;
+}
diff --git a/drivers/usb/eth/Makefile b/drivers/usb/eth/Makefile
index 03f5474..94551c4 100644
--- a/drivers/usb/eth/Makefile
+++ b/drivers/usb/eth/Makefile
@@ -8,4 +8,5 @@ obj-$(CONFIG_USB_HOST_ETHER) += usb_ether.o
 ifdef CONFIG_USB_ETHER_ASIX
 obj-y += asix.o
 endif
+obj-$(CONFIG_USB_ETHER_MCS7830) += mcs7830.o
 obj-$(CONFIG_USB_ETHER_SMSC95XX) += smsc95xx.o
diff --git a/drivers/usb/eth/mcs7830.c b/drivers/usb/eth/mcs7830.c
new file mode 100644
index 0000000..c353286
--- /dev/null
+++ b/drivers/usb/eth/mcs7830.c
@@ -0,0 +1,812 @@
+/*
+ * Copyright (c) 2013 Gerhard Sittig <gsi@denx.de>
+ * based on the U-Boot Asix driver as well as information
+ * from the Linux Moschip driver
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+/*
+ * MOSCHIP MCS7830 based (7730/7830/7832) USB 2.0 Ethernet Devices
+ */
+
+#include <common.h>
+#include <errno.h>
+#include <linux/mii.h>
+#include <malloc.h>
+#include <usb.h>
+
+#include "usb_ether.h"
+
+#define MCS7830_BASE_NAME	"mcs"
+
+#define USBCALL_TIMEOUT		1000
+#define LINKSTATUS_TIMEOUT	5000	/* link status, connect timeout */
+#define LINKSTATUS_TIMEOUT_RES	50	/* link status, resolution in msec */
+
+#define MCS7830_RX_URB_SIZE	2048
+
+/* command opcodes */
+#define MCS7830_WR_BREQ		0x0d
+#define MCS7830_RD_BREQ		0x0e
+
+/* register layout, numerical offset specs for USB API calls */
+struct mcs7830_regs {
+	uint8_t multicast_hashes[8];
+	uint8_t packet_gap[2];
+	uint8_t phy_data[2];
+	uint8_t phy_command[2];
+	uint8_t configuration;
+	uint8_t ether_address[6];
+	uint8_t frame_drop_count;
+	uint8_t pause_threshold;
+};
+#define REG_MULTICAST_HASH	offsetof(struct mcs7830_regs, multicast_hashes)
+#define REG_PHY_DATA		offsetof(struct mcs7830_regs, phy_data)
+#define REG_PHY_CMD		offsetof(struct mcs7830_regs, phy_command)
+#define REG_CONFIG		offsetof(struct mcs7830_regs, configuration)
+#define REG_ETHER_ADDR		offsetof(struct mcs7830_regs, ether_address)
+#define REG_FRAME_DROP_COUNTER	offsetof(struct mcs7830_regs, frame_drop_count)
+#define REG_PAUSE_THRESHOLD	offsetof(struct mcs7830_regs, pause_threshold)
+
+/* bit masks and default values for the above registers */
+#define PHY_CMD1_READ		0x40
+#define PHY_CMD1_WRITE		0x20
+#define PHY_CMD1_PHYADDR	0x01
+
+#define PHY_CMD2_PEND		0x80
+#define PHY_CMD2_READY		0x40
+
+#define CONF_CFG		0x80
+#define CONF_SPEED100		0x40
+#define CONF_FDX_ENABLE		0x20
+#define CONF_RXENABLE		0x10
+#define CONF_TXENABLE		0x08
+#define CONF_SLEEPMODE		0x04
+#define CONF_ALLMULTICAST	0x02
+#define CONF_PROMISCUOUS	0x01
+
+#define PAUSE_THRESHOLD_DEFAULT	0
+
+/* bit masks for the status byte which follows received ethernet frames */
+#define STAT_RX_FRAME_CORRECT	0x20
+#define STAT_RX_LARGE_FRAME	0x10
+#define STAT_RX_CRC_ERROR	0x08
+#define STAT_RX_ALIGNMENT_ERROR	0x04
+#define STAT_RX_LENGTH_ERROR	0x02
+#define STAT_RX_SHORT_FRAME	0x01
+
+/*
+ * struct mcs7830_private - private driver data for an individual adapter
+ * @config:	shadow for the network adapter's configuration register
+ * @mchash:	shadow for the network adapter's multicast hash registers
+ */
+struct mcs7830_private {
+	uint8_t config;
+	uint8_t mchash[8];
+};
+
+/*
+ * mcs7830_read_reg() - read a register of the network adapter
+ * @dev:	network device to read from
+ * @idx:	index of the register to start reading from
+ * @size:	number of bytes to read
+ * @data:	buffer to read into
+ * Return: zero upon success, negative upon error
+ */
+static int mcs7830_read_reg(struct ueth_data *dev, uint8_t idx,
+			    uint16_t size, void *data)
+{
+	int len;
+	ALLOC_CACHE_ALIGN_BUFFER(uint8_t, buf, size);
+
+	debug("%s() idx=0x%04X sz=%d\n", __func__, idx, size);
+
+	len = usb_control_msg(dev->pusb_dev,
+			      usb_rcvctrlpipe(dev->pusb_dev, 0),
+			      MCS7830_RD_BREQ,
+			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			      0, idx, buf, size,
+			      USBCALL_TIMEOUT);
+	if (len != size) {
+		debug("%s() len=%d != sz=%d\n", __func__, len, size);
+		return -EIO;
+	}
+	memcpy(data, buf, size);
+	return 0;
+}
+
+/*
+ * mcs7830_write_reg() - write a register of the network adapter
+ * @dev:	network device to write to
+ * @idx:	index of the register to start writing to
+ * @size:	number of bytes to write
+ * @data:	buffer holding the data to write
+ * Return: zero upon success, negative upon error
+ */
+static int mcs7830_write_reg(struct ueth_data *dev, uint8_t idx,
+			     uint16_t size, void *data)
+{
+	int len;
+	ALLOC_CACHE_ALIGN_BUFFER(uint8_t, buf, size);
+
+	debug("%s() idx=0x%04X sz=%d\n", __func__, idx, size);
+
+	memcpy(buf, data, size);
+	len = usb_control_msg(dev->pusb_dev,
+			      usb_sndctrlpipe(dev->pusb_dev, 0),
+			      MCS7830_WR_BREQ,
+			      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			      0, idx, buf, size,
+			      USBCALL_TIMEOUT);
+	if (len != size) {
+		debug("%s() len=%d != sz=%d\n", __func__, len, size);
+		return -EIO;
+	}
+	return 0;
+}
+
+/*
+ * mcs7830_phy_emit_wait() - emit PHY read/write access, wait for its execution
+ * @dev:	network device to talk to
+ * @rwflag:	PHY_CMD1_READ or PHY_CMD1_WRITE opcode
+ * @index:	number of the PHY register to read or write
+ * Return: zero upon success, negative upon error
+ */
+static int mcs7830_phy_emit_wait(struct ueth_data *dev,
+				 uint8_t rwflag, uint8_t index)
+{
+	int rc;
+	int retry;
+	uint8_t cmd[2];
+
+	/* send the PHY read/write request */
+	cmd[0] = rwflag | PHY_CMD1_PHYADDR;
+	cmd[1] = PHY_CMD2_PEND | (index & 0x1f);
+	rc = mcs7830_write_reg(dev, REG_PHY_CMD, sizeof(cmd), cmd);
+	if (rc < 0)
+		return rc;
+
+	/* wait for the response to become available (usually < 1ms) */
+	retry = 10;
+	do {
+		rc = mcs7830_read_reg(dev, REG_PHY_CMD, sizeof(cmd), cmd);
+		if (rc < 0)
+			return rc;
+		if (cmd[1] & PHY_CMD2_READY)
+			return 0;
+		if (!retry--)
+			return -ETIMEDOUT;
+		mdelay(1);
+	} while (1);
+	/* UNREACH */
+}
+
+/*
+ * mcs7830_read_phy() - read a PHY register of the network adapter
+ * @dev:	network device to read from
+ * @index:	index of the PHY register to read from
+ * Return: non-negative 16bit register content, negative upon error
+ */
+static int mcs7830_read_phy(struct ueth_data *dev, uint8_t index)
+{
+	int rc;
+	uint16_t val;
+
+	/* issue the PHY read request and wait for its execution */
+	rc = mcs7830_phy_emit_wait(dev, PHY_CMD1_READ, index);
+	if (rc < 0)
+		return rc;
+
+	/* fetch the PHY data which was read */
+	rc = mcs7830_read_reg(dev, REG_PHY_DATA, sizeof(val), &val);
+	if (rc < 0)
+		return rc;
+	rc = le16_to_cpu(val);
+	debug("%s(%s, %d) => 0x%04X\n", __func__, dev->eth_dev.name, index, rc);
+	return rc;
+}
+
+/*
+ * mcs7830_write_phy() - write a PHY register of the network adapter
+ * @dev:	network device to write to
+ * @index:	index of the PHY register to write to
+ * @val:	value to write to the PHY register
+ * Return: zero upon success, negative upon error
+ */
+static int mcs7830_write_phy(struct ueth_data *dev, uint8_t index, uint16_t val)
+{
+	int rc;
+
+	debug("%s(%s, %d, 0x%04X)\n", __func__, dev->eth_dev.name, index, val);
+
+	/* setup the PHY data which is to get written */
+	val = cpu_to_le16(val);
+	rc = mcs7830_write_reg(dev, REG_PHY_DATA, sizeof(val), &val);
+	if (rc < 0)
+		return rc;
+
+	/* issue the PHY write request and wait for its execution */
+	rc = mcs7830_phy_emit_wait(dev, PHY_CMD1_WRITE, index);
+	if (rc < 0)
+		return rc;
+
+	return 0;
+}
+
+/*
+ * mcs7830_write_config() - write to the network adapter's config register
+ * @eth:	network device to write to
+ * Return: zero upon success, negative upon error
+ *
+ * the data which gets written is taken from the shadow config register
+ * within the device driver's private data
+ */
+static int mcs7830_write_config(struct ueth_data *dev)
+{
+	struct mcs7830_private *priv;
+	int rc;
+
+	debug("%s()\n", __func__);
+	priv = dev->dev_priv;
+
+	rc = mcs7830_write_reg(dev, REG_CONFIG,
+			       sizeof(priv->config), &priv->config);
+	if (rc < 0) {
+		debug("writing config to adapter failed\n");
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ * mcs7830_write_mchash() - write the network adapter's multicast filter
+ * @eth:	network device to write to
+ * Return: zero upon success, negative upon error
+ *
+ * the data which gets written is taken from the shadow multicast hashes
+ * within the device driver's private data
+ */
+static int mcs7830_write_mchash(struct ueth_data *dev)
+{
+	struct mcs7830_private *priv;
+	int rc;
+
+	debug("%s()\n", __func__);
+	priv = dev->dev_priv;
+
+	rc = mcs7830_write_reg(dev, REG_MULTICAST_HASH,
+			       sizeof(priv->mchash), &priv->mchash);
+	if (rc < 0) {
+		debug("writing multicast hash to adapter failed\n");
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ * mcs7830_set_autoneg() - setup and trigger ethernet link autonegotiation
+ * @eth:	network device to run link negotiation on
+ * Return: zero upon success, negative upon error
+ *
+ * the routine advertises available media and starts autonegotiation
+ */
+static int mcs7830_set_autoneg(struct ueth_data *dev)
+{
+	int adv, flg;
+	int rc;
+
+	debug("%s()\n", __func__);
+
+	/*
+	 * algorithm taken from the Linux driver, which took it from
+	 * "the original mcs7830 version 1.4 driver":
+	 *
+	 * enable all media, reset BMCR, enable auto neg, restart
+	 * auto neg while keeping the enable auto neg flag set
+	 */
+
+	adv = ADVERTISE_PAUSE_CAP | ADVERTISE_ALL | ADVERTISE_CSMA;
+	rc = mcs7830_write_phy(dev, MII_ADVERTISE, adv);
+
+	flg = 0;
+	if (!rc)
+		rc = mcs7830_write_phy(dev, MII_BMCR, flg);
+
+	flg |= BMCR_ANENABLE;
+	if (!rc)
+		rc = mcs7830_write_phy(dev, MII_BMCR, flg);
+
+	flg |= BMCR_ANRESTART;
+	if (!rc)
+		rc = mcs7830_write_phy(dev, MII_BMCR, flg);
+
+	return rc;
+}
+
+/*
+ * mcs7830_get_rev() - identify a network adapter's chip revision
+ * @eth:	network device to identify
+ * Return: non-negative number, reflecting the revision number
+ *
+ * currently, only "rev C and higher" and "below rev C" are needed, so
+ * the return value is #1 for "below rev C", and #2 for "rev C and above"
+ */
+static int mcs7830_get_rev(struct ueth_data *dev)
+{
+	uint8_t buf[2];
+	int rc;
+	int rev;
+
+	/* register 22 is readable in rev C and higher */
+	rc = mcs7830_read_reg(dev, REG_FRAME_DROP_COUNTER, sizeof(buf), buf);
+	if (rc < 0)
+		rev = 1;
+	else
+		rev = 2;
+	debug("%s() rc=%d, rev=%d\n", __func__, rc, rev);
+	return rev;
+}
+
+/*
+ * mcs7830_apply_fixup() - identify an adapter and potentially apply fixups
+ * @eth:	network device to identify and apply fixups to
+ * Return: zero upon success (no errors emitted from here)
+ *
+ * this routine identifies the network adapter's chip revision, and applies
+ * fixups for known issues
+ */
+static int mcs7830_apply_fixup(struct ueth_data *dev)
+{
+	int rev;
+	int i;
+	uint8_t thr;
+
+	rev = mcs7830_get_rev(dev);
+	debug("%s() rev=%d\n", __func__, rev);
+
+	/*
+	 * rev C requires setting the pause threshold (the Linux driver
+	 * is inconsistent, the implementation does it for "rev C
+	 * exactly", the introductory comment says "rev C and above")
+	 */
+	if (rev == 2) {
+		debug("%s: applying rev C fixup\n", dev->eth_dev.name);
+		thr = PAUSE_THRESHOLD_DEFAULT;
+		for (i = 0; i < 2; i++) {
+			(void)mcs7830_write_reg(dev, REG_PAUSE_THRESHOLD,
+						sizeof(thr), &thr);
+			mdelay(1);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * mcs7830_basic_reset() - bring the network adapter into a known first state
+ * @eth:	network device to act upon
+ * Return: zero upon success, negative upon error
+ *
+ * this routine initializes the network adapter such that subsequent invocations
+ * of the interface callbacks can exchange ethernet frames; link negotiation is
+ * triggered from here already and continues in background
+ */
+static int mcs7830_basic_reset(struct ueth_data *dev)
+{
+	struct mcs7830_private *priv;
+	int rc;
+
+	debug("%s()\n", __func__);
+	priv = dev->dev_priv;
+
+	/*
+	 * comment from the respective Linux driver, which
+	 * unconditionally sets the ALLMULTICAST flag as well:
+	 * should not be needed, but does not work otherwise
+	 */
+	priv->config = CONF_TXENABLE;
+	priv->config |= CONF_ALLMULTICAST;
+
+	rc = mcs7830_set_autoneg(dev);
+	if (rc < 0) {
+		error("setting autoneg failed\n");
+		return rc;
+	}
+
+	rc = mcs7830_write_mchash(dev);
+	if (rc < 0) {
+		error("failed to set multicast hash\n");
+		return rc;
+	}
+
+	rc = mcs7830_write_config(dev);
+	if (rc < 0) {
+		error("failed to set configuration\n");
+		return rc;
+	}
+
+	rc = mcs7830_apply_fixup(dev);
+	if (rc < 0) {
+		error("fixup application failed\n");
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ * mcs7830_read_mac() - read an ethernet adapter's MAC address
+ * @eth:	network device to read from
+ * Return: zero upon success, negative upon error
+ *
+ * this routine fetches the MAC address stored within the ethernet adapter,
+ * and stores it in the ethernet interface's data structure
+ */
+static int mcs7830_read_mac(struct eth_device *eth)
+{
+	struct ueth_data *dev;
+	int rc;
+	uint8_t buf[ETH_ALEN];
+
+	debug("%s()\n", __func__);
+	dev = eth->priv;
+
+	rc = mcs7830_read_reg(dev, REG_ETHER_ADDR, ETH_ALEN, buf);
+	if (rc < 0) {
+		debug("reading MAC from adapter failed\n");
+		return rc;
+	}
+
+	memcpy(&eth->enetaddr[0], buf, ETH_ALEN);
+	return 0;
+}
+
+/*
+ * mcs7830_write_mac() - write an ethernet adapter's MAC address
+ * @eth:	network device to write to
+ * Return: zero upon success, negative upon error
+ *
+ * this routine takes the MAC address from the ethernet interface's data
+ * structure, and writes it into the ethernet adapter such that subsequent
+ * exchange of ethernet frames uses this address
+ */
+static int mcs7830_write_mac(struct eth_device *eth)
+{
+	struct ueth_data *dev;
+	int rc;
+
+	debug("%s()\n", __func__);
+	dev = eth->priv;
+
+	if (sizeof(eth->enetaddr) != ETH_ALEN)
+		return -EINVAL;
+	rc = mcs7830_write_reg(dev, REG_ETHER_ADDR, ETH_ALEN, eth->enetaddr);
+	if (rc < 0) {
+		debug("writing MAC to adapter failed\n");
+		return rc;
+	}
+	return 0;
+}
+
+/*
+ * mcs7830_init() - network interface's init callback
+ * @eth:	network device to initialize
+ * @bd:		board information
+ * Return: zero upon success, negative upon error
+ *
+ * after initial setup during probe() and get_info(), this init() callback
+ * ensures that the link is up and subsequent send() and recv() calls can
+ * exchange ethernet frames
+ */
+static int mcs7830_init(struct eth_device *eth, bd_t *bd)
+{
+	struct ueth_data *dev;
+	int timeout;
+	int have_link;
+
+	debug("%s()\n", __func__);
+	dev = eth->priv;
+
+	timeout = 0;
+	do {
+		have_link = mcs7830_read_phy(dev, MII_BMSR) & BMSR_LSTATUS;
+		if (have_link)
+			break;
+		udelay(LINKSTATUS_TIMEOUT_RES * 1000);
+		timeout += LINKSTATUS_TIMEOUT_RES;
+	} while (timeout < LINKSTATUS_TIMEOUT);
+	if (!have_link) {
+		debug("ethernet link is down\n");
+		return -ETIMEDOUT;
+	}
+	return 0;
+}
+
+/*
+ * mcs7830_send() - network interface's send callback
+ * @eth:	network device to send the frame from
+ * @packet:	ethernet frame content
+ * @length:	ethernet frame length
+ * Return: zero upon success, negative upon error
+ *
+ * this routine send an ethernet frame out of the network interface
+ */
+static int mcs7830_send(struct eth_device *eth, void *packet, int length)
+{
+	struct ueth_data *dev;
+	int rc;
+	int gotlen;
+	/* there is a status byte after the ethernet frame */
+	ALLOC_CACHE_ALIGN_BUFFER(uint8_t, buf, PKTSIZE + sizeof(uint8_t));
+
+	dev = eth->priv;
+
+	memcpy(buf, packet, length);
+	rc = usb_bulk_msg(dev->pusb_dev,
+			  usb_sndbulkpipe(dev->pusb_dev, dev->ep_out),
+			  &buf[0], length, &gotlen,
+			  USBCALL_TIMEOUT);
+	debug("%s() TX want len %d, got len %d, rc %d\n",
+	      __func__, length, gotlen, rc);
+	return rc;
+}
+
+/*
+ * mcs7830_recv() - network interface's recv callback
+ * @eth:	network device to receive frames from
+ * Return: zero upon success, negative upon error
+ *
+ * this routine checks for available ethernet frames that the network
+ * interface might have received, and notifies the network stack
+ */
+static int mcs7830_recv(struct eth_device *eth)
+{
+	struct ueth_data *dev;
+	ALLOC_CACHE_ALIGN_BUFFER(uint8_t, buf, MCS7830_RX_URB_SIZE);
+	int rc, wantlen, gotlen;
+	uint8_t sts;
+
+	debug("%s()\n", __func__);
+	dev = eth->priv;
+
+	/* fetch input data from the adapter */
+	wantlen = MCS7830_RX_URB_SIZE;
+	rc = usb_bulk_msg(dev->pusb_dev,
+			  usb_rcvbulkpipe(dev->pusb_dev, dev->ep_in),
+			  &buf[0], wantlen, &gotlen,
+			  USBCALL_TIMEOUT);
+	debug("%s() RX want len %d, got len %d, rc %d\n",
+	      __func__, wantlen, gotlen, rc);
+	if (rc != 0) {
+		error("RX: failed to receive\n");
+		return rc;
+	}
+	if (gotlen > wantlen) {
+		error("RX: got too many bytes (%d)\n", gotlen);
+		return -EIO;
+	}
+
+	/*
+	 * the bulk message that we received from USB contains exactly
+	 * one ethernet frame and a trailing status byte
+	 */
+	if (gotlen < sizeof(sts))
+		return -EIO;
+	gotlen -= sizeof(sts);
+	sts = buf[gotlen];
+
+	if (sts == STAT_RX_FRAME_CORRECT) {
+		debug("%s() got a frame, len=%d\n", __func__, gotlen);
+		NetReceive(buf, gotlen);
+		return 0;
+	}
+
+	debug("RX: frame error (sts 0x%02X, %s %s %s %s %s)\n",
+	      sts,
+	      (sts & STAT_RX_LARGE_FRAME) ? "large" : "-",
+	      (sts & STAT_RX_LENGTH_ERROR) ?  "length" : "-",
+	      (sts & STAT_RX_SHORT_FRAME) ? "short" : "-",
+	      (sts & STAT_RX_CRC_ERROR) ? "crc" : "-",
+	      (sts & STAT_RX_ALIGNMENT_ERROR) ?  "align" : "-");
+	return -EIO;
+}
+
+/*
+ * mcs7830_halt() - network interface's halt callback
+ * @eth:	network device to cease operation of
+ * Return: none
+ *
+ * this routine is supposed to undo the effect of previous initialization and
+ * ethernet frames exchange; in this implementation it's a NOP
+ */
+static void mcs7830_halt(struct eth_device *eth)
+{
+	debug("%s()\n", __func__);
+}
+
+/*
+ * mcs7830_iface_idx - index of detected network interfaces
+ *
+ * this counter keeps track of identified supported interfaces,
+ * to assign unique names as more interfaces are found
+ */
+static int mcs7830_iface_idx;
+
+/*
+ * mcs7830_eth_before_probe() - network driver's before_probe callback
+ * Return: none
+ *
+ * this routine initializes driver's internal data in preparation of
+ * subsequent probe callbacks
+ */
+void mcs7830_eth_before_probe(void)
+{
+	mcs7830_iface_idx = 0;
+}
+
+/*
+ * struct mcs7830_dongle - description of a supported Moschip ethernet dongle
+ * @vendor:	16bit USB vendor identification
+ * @product:	16bit USB product identification
+ *
+ * this structure describes a supported USB ethernet dongle by means of the
+ * vendor and product codes found during USB enumeration; no flags are held
+ * here since all supported dongles have identical behaviour, and required
+ * fixups get determined at runtime, such that no manual configuration is
+ * needed
+ */
+struct mcs7830_dongle {
+	uint16_t vendor;
+	uint16_t product;
+};
+
+/*
+ * mcs7830_dongles - the list of supported Moschip based USB ethernet dongles
+ */
+static const struct mcs7830_dongle const mcs7830_dongles[] = {
+	{ 0x9710, 0x7832, },	/* Moschip 7832 */
+	{ 0x9710, 0x7830, },	/* Moschip 7830 */
+	{ 0x9710, 0x7730, },	/* Moschip 7730 */
+	{ 0x0df6, 0x0021, },	/* Sitecom LN 30 */
+};
+
+/*
+ * mcs7830_eth_probe() - network driver's probe callback
+ * @dev:	detected USB device to check
+ * @ifnum:	detected USB interface to check
+ * @ss:		USB ethernet data structure to fill in upon match
+ * Return: #1 upon match, #0 upon mismatch or error
+ *
+ * this routine checks whether the found USB device is supported by
+ * this ethernet driver, and upon match fills in the USB ethernet
+ * data structure which later is passed to the get_info callback
+ */
+int mcs7830_eth_probe(struct usb_device *dev, unsigned int ifnum,
+		      struct ueth_data *ss)
+{
+	struct usb_interface *iface;
+	struct usb_interface_descriptor *iface_desc;
+	int i;
+	struct mcs7830_private *priv;
+	int ep_in_found, ep_out_found, ep_intr_found;
+
+	debug("%s()\n", __func__);
+
+	/* iterate the list of supported dongles */
+	iface = &dev->config.if_desc[ifnum];
+	iface_desc = &iface->desc;
+	for (i = 0; i < ARRAY_SIZE(mcs7830_dongles); i++) {
+		if (dev->descriptor.idVendor == mcs7830_dongles[i].vendor &&
+		    dev->descriptor.idProduct == mcs7830_dongles[i].product)
+			break;
+	}
+	if (i == ARRAY_SIZE(mcs7830_dongles))
+		return 0;
+	debug("detected USB ethernet device: %04X:%04X\n",
+	      dev->descriptor.idVendor, dev->descriptor.idProduct);
+
+	/* fill in driver private data */
+	priv = calloc(1, sizeof(*priv));
+	if (!priv)
+		return 0;
+
+	/* fill in the ueth_data structure, attach private data */
+	memset(ss, 0, sizeof(*ss));
+	ss->ifnum = ifnum;
+	ss->pusb_dev = dev;
+	ss->subclass = iface_desc->bInterfaceSubClass;
+	ss->protocol = iface_desc->bInterfaceProtocol;
+	ss->dev_priv = priv;
+
+	/*
+	 * a minimum of three endpoints is expected: in (bulk),
+	 * out (bulk), and interrupt; ignore all others
+	 */
+	ep_in_found = ep_out_found = ep_intr_found = 0;
+	for (i = 0; i < iface_desc->bNumEndpoints; i++) {
+		uint8_t eptype, epaddr;
+		bool is_input;
+
+		eptype = iface->ep_desc[i].bmAttributes;
+		eptype &= USB_ENDPOINT_XFERTYPE_MASK;
+
+		epaddr = iface->ep_desc[i].bEndpointAddress;
+		is_input = epaddr & USB_DIR_IN;
+		epaddr &= USB_ENDPOINT_NUMBER_MASK;
+
+		if (eptype == USB_ENDPOINT_XFER_BULK) {
+			if (is_input && !ep_in_found) {
+				ss->ep_in = epaddr;
+				ep_in_found++;
+			}
+			if (!is_input && !ep_out_found) {
+				ss->ep_out = epaddr;
+				ep_out_found++;
+			}
+		}
+
+		if (eptype == USB_ENDPOINT_XFER_INT) {
+			if (is_input && !ep_intr_found) {
+				ss->ep_int = epaddr;
+				ss->irqinterval = iface->ep_desc[i].bInterval;
+				ep_intr_found++;
+			}
+		}
+	}
+	debug("endpoints: in %d, out %d, intr %d\n",
+	      ss->ep_in, ss->ep_out, ss->ep_int);
+
+	/* apply basic sanity checks */
+	if (usb_set_interface(dev, iface_desc->bInterfaceNumber, 0) ||
+	    !ss->ep_in || !ss->ep_out || !ss->ep_int) {
+		debug("device probe incomplete\n");
+		return 0;
+	}
+
+	dev->privptr = ss;
+	return 1;
+}
+
+/*
+ * mcs7830_eth_get_info() - network driver's get_info callback
+ * @dev:	detected USB device
+ * @ss:		USB ethernet data structure filled in at probe()
+ * @eth:	ethernet interface data structure to fill in
+ * Return: #1 upon success, #0 upon error
+ *
+ * this routine registers the mandatory init(), send(), recv(), and
+ * halt() callbacks with the ethernet interface, can register the
+ * optional write_hwaddr() callback with the ethernet interface,
+ * and initiates configuration of the interface such that subsequent
+ * calls to those callbacks results in network communication
+ */
+int mcs7830_eth_get_info(struct usb_device *dev, struct ueth_data *ss,
+			 struct eth_device *eth)
+{
+	debug("%s()\n", __func__);
+	if (!eth) {
+		debug("%s: missing parameter.\n", __func__);
+		return 0;
+	}
+
+	snprintf(eth->name, sizeof(eth->name), "%s%d",
+		 MCS7830_BASE_NAME, mcs7830_iface_idx++);
+	eth->init = mcs7830_init;
+	eth->send = mcs7830_send;
+	eth->recv = mcs7830_recv;
+	eth->halt = mcs7830_halt;
+	eth->write_hwaddr = mcs7830_write_mac;
+	eth->priv = ss;
+
+	if (mcs7830_basic_reset(ss))
+		return 0;
+
+	if (mcs7830_read_mac(eth))
+		return 0;
+	debug("MAC %pM\n", eth->enetaddr);
+
+	return 1;
+}
diff --git a/drivers/usb/eth/usb_ether.c b/drivers/usb/eth/usb_ether.c
index 2c4126b..1dda54c 100644
--- a/drivers/usb/eth/usb_ether.c
+++ b/drivers/usb/eth/usb_ether.c
@@ -30,6 +30,13 @@ static const struct usb_eth_prob_dev prob_dev[] = {
 		.get_info = asix_eth_get_info,
 	},
 #endif
+#ifdef CONFIG_USB_ETHER_MCS7830
+	{
+		.before_probe = mcs7830_eth_before_probe,
+		.probe = mcs7830_eth_probe,
+		.get_info = mcs7830_eth_get_info,
+	},
+#endif
 #ifdef CONFIG_USB_ETHER_SMSC95XX
 	{
 		.before_probe = smsc95xx_eth_before_probe,
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index a7f5469..c527029 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -33,6 +33,7 @@ obj-$(CONFIG_VIDEO_MX3) += mx3fb.o videomodes.o
 obj-$(CONFIG_VIDEO_IPUV3) += mxc_ipuv3_fb.o ipu_common.o ipu_disp.o
 obj-$(CONFIG_VIDEO_MXS) += mxsfb.o videomodes.o
 obj-$(CONFIG_VIDEO_OMAP3) += omap3_dss.o
+obj-$(CONFIG_VIDEO_SANDBOX_SDL) += sandbox_sdl.o
 obj-$(CONFIG_VIDEO_SED13806) += sed13806.o
 obj-$(CONFIG_VIDEO_SM501) += sm501.o
 obj-$(CONFIG_VIDEO_SMI_LYNXEM) += smiLynxEM.o videomodes.o
diff --git a/drivers/video/sandbox_sdl.c b/drivers/video/sandbox_sdl.c
new file mode 100644
index 0000000..ba4578e
--- /dev/null
+++ b/drivers/video/sandbox_sdl.c
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <fdtdec.h>
+#include <lcd.h>
+#include <malloc.h>
+#include <asm/sdl.h>
+#include <asm/u-boot-sandbox.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+enum {
+	/* Maximum LCD size we support */
+	LCD_MAX_WIDTH		= 1366,
+	LCD_MAX_HEIGHT		= 768,
+	LCD_MAX_LOG2_BPP	= 4,		/* 2^4 = 16 bpp */
+};
+
+vidinfo_t panel_info;
+
+void lcd_setcolreg(ushort regno, ushort red, ushort green, ushort blue)
+{
+}
+
+void lcd_ctrl_init(void *lcdbase)
+{
+	/*
+	 * Allocate memory to keep BMP color conversion map. This is required
+	 * for 8 bit BMPs only (hence 256 colors). If malloc fails - keep
+	 * going, it is not even clear if displyaing the bitmap will be
+	 * required on the way up.
+	 */
+	panel_info.cmap = malloc(256 * NBITS(panel_info.vl_bpix) / 8);
+}
+
+void lcd_enable(void)
+{
+	if (sandbox_sdl_init_display(panel_info.vl_col, panel_info.vl_row,
+				     panel_info.vl_bpix))
+		puts("LCD init failed\n");
+}
+
+int sandbox_lcd_sdl_early_init(void)
+{
+	const void *blob = gd->fdt_blob;
+	int xres = LCD_MAX_WIDTH, yres = LCD_MAX_HEIGHT;
+	int node;
+	int ret = 0;
+
+	/*
+	 * The code in common/lcd.c does not cope with not being able to
+	 * set up a frame buffer. It will just happily keep writing to
+	 * invalid memory. So here we make sure that at least some buffer
+	 * is available even if it actually won't be displayed.
+	 */
+	node = fdtdec_next_compatible(blob, 0, COMPAT_SANDBOX_LCD_SDL);
+	if (node >= 0) {
+		xres = fdtdec_get_int(blob, node, "xres", LCD_MAX_WIDTH);
+		yres = fdtdec_get_int(blob, node, "yres", LCD_MAX_HEIGHT);
+		if (xres < 0 || xres > LCD_MAX_WIDTH) {
+			xres = LCD_MAX_WIDTH;
+			ret = -EINVAL;
+		}
+		if (yres < 0 || yres > LCD_MAX_HEIGHT) {
+			yres = LCD_MAX_HEIGHT;
+			ret = -EINVAL;
+		}
+	}
+
+	panel_info.vl_col = xres;
+	panel_info.vl_row = yres;
+	panel_info.vl_bpix = LCD_COLOR16;
+
+	return ret;
+}