3. CEC Pin Framework Error Injection

The CEC Pin Framework is a core CEC framework for CEC hardware that only has low-level support for the CEC bus. Most hardware today will have high-level CEC support where the hardware deals with driving the CEC bus, but some older devices aren't that fancy. However, this framework also allows you to connect the CEC pin to a GPIO on e.g. a Raspberry Pi and you have now made a CEC adapter.

What makes doing this so interesting is that since we have full control over the bus it is easy to support error injection. This is ideal to test how well CEC adapters can handle error conditions.

Currently only the cec-gpio driver (when the CEC line is directly connected to a pull-up GPIO line) and the AllWinner A10/A20 drm driver support this framework.

If CONFIG_CEC_PIN_ERROR_INJ is enabled, then error injection is available through debugfs. Specifically, in /sys/kernel/debug/cec/cecX/ there is now an error-inj file.

Note

The error injection commands are not a stable ABI and may change in the future.

With cat error-inj you can see both the possible commands and the current error injection status:

$ cat /sys/kernel/debug/cec/cec0/error-inj
# Clear error injections:
#   clear          clear all rx and tx error injections
#   rx-clear       clear all rx error injections
#   tx-clear       clear all tx error injections
#   <op> clear     clear all rx and tx error injections for <op>
#   <op> rx-clear  clear all rx error injections for <op>
#   <op> tx-clear  clear all tx error injections for <op>
#
# RX error injection:
#   <op>[,<mode>] rx-nack              NACK the message instead of sending an ACK
#   <op>[,<mode>] rx-low-drive <bit>   force a low-drive condition at this bit position
#   <op>[,<mode>] rx-add-byte          add a spurious byte to the received CEC message
#   <op>[,<mode>] rx-remove-byte       remove the last byte from the received CEC message
#   <op>[,<mode>] rx-arb-lost <poll>   generate a POLL message to trigger an arbitration lost
#
# TX error injection settings:
#   tx-ignore-nack-until-eom           ignore early NACKs until EOM
#   tx-custom-low-usecs <usecs>        define the 'low' time for the custom pulse
#   tx-custom-high-usecs <usecs>       define the 'high' time for the custom pulse
#   tx-custom-pulse                    transmit the custom pulse once the bus is idle
#
# TX error injection:
#   <op>[,<mode>] tx-no-eom            don't set the EOM bit
#   <op>[,<mode>] tx-early-eom         set the EOM bit one byte too soon
#   <op>[,<mode>] tx-add-bytes <num>   append <num> (1-255) spurious bytes to the message
#   <op>[,<mode>] tx-remove-byte       drop the last byte from the message
#   <op>[,<mode>] tx-short-bit <bit>   make this bit shorter than allowed
#   <op>[,<mode>] tx-long-bit <bit>    make this bit longer than allowed
#   <op>[,<mode>] tx-custom-bit <bit>  send the custom pulse instead of this bit
#   <op>[,<mode>] tx-short-start       send a start pulse that's too short
#   <op>[,<mode>] tx-long-start        send a start pulse that's too long
#   <op>[,<mode>] tx-custom-start      send the custom pulse instead of the start pulse
#   <op>[,<mode>] tx-last-bit <bit>    stop sending after this bit
#   <op>[,<mode>] tx-low-drive <bit>   force a low-drive condition at this bit position
#
# <op>       CEC message opcode (0-255) or 'any'
# <mode>     'once' (default), 'always', 'toggle' or 'off'
# <bit>      CEC message bit (0-159)
#            10 bits per 'byte': bits 0-7: data, bit 8: EOM, bit 9: ACK
# <poll>     CEC poll message used to test arbitration lost (0x00-0xff, default 0x0f)
# <usecs>    microseconds (0-10000000, default 1000)

clear

You can write error injection commands to error-inj using echo 'cmd' >error-inj or cat cmd.txt >error-inj. The cat error-inj output contains the current error commands. You can save the output to a file and use it as an input to error-inj later.

3.1. Basic Syntax

Leading spaces/tabs are ignored. If the next character is a # or the end of the line was reached, then the whole line is ignored. Otherwise a command is expected.

The error injection commands fall in two main groups: those relating to receiving CEC messages and those relating to transmitting CEC messages. In addition, there are commands to clear existing error injection commands and to create custom pulses on the CEC bus.

Most error injection commands can be executed for specific CEC opcodes or for all opcodes (any). Each command also has a 'mode' which can be off (can be used to turn off an existing error injection command), once (the default) which will trigger the error injection only once for the next received or transmitted message, always to always trigger the error injection and toggle to toggle the error injection on or off for every transmit or receive.

So 'any rx-nack' will NACK the next received CEC message, 'any,always rx-nack' will NACK all received CEC messages and '0x82,toggle rx-nack' will only NACK if an Active Source message was received and do that only for every other received message.

After an error was injected with mode once the error injection command is cleared automatically, so once is a one-time deal.

All combinations of <op> and error injection commands can co-exist. So this is fine:

0x9e tx-add-bytes 1
0x9e tx-early-eom
0x9f tx-add-bytes 2
any rx-nack

All four error injection commands will be active simultaneously.

However, if the same <op> and command combination is specified, but with different arguments:

0x9e tx-add-bytes 1
0x9e tx-add-bytes 2

Then the second will overwrite the first.

3.2. Clear Error Injections

clear
Clear all error injections.
rx-clear
Clear all receive error injections
tx-clear
Clear all transmit error injections
<op> clear
Clear all error injections for the given opcode.
<op> rx-clear
Clear all receive error injections for the given opcode.
<op> tx-clear
Clear all transmit error injections for the given opcode.

3.3. Receive Messages

<op>[,<mode>] rx-nack
NACK broadcast messages and messages directed to this CEC adapter. Every byte of the message will be NACKed in case the transmitter keeps transmitting after the first byte was NACKed.
<op>[,<mode>] rx-low-drive <bit>
Force a Low Drive condition at this bit position. If <op> specifies a specific CEC opcode then the bit position must be at least 18, otherwise the opcode hasn't been received yet. This tests if the transmitter can handle the Low Drive condition correctly and reports the error correctly. Note that a Low Drive in the first 4 bits can also be interpreted as an Arbitration Lost condition by the transmitter. This is implementation dependent.
<op>[,<mode>] rx-add-byte
Add a spurious 0x55 byte to the received CEC message, provided the message was 15 bytes long or less. This is useful to test the high-level protocol since spurious bytes should be ignored.
<op>[,<mode>] rx-remove-byte
Remove the last byte from the received CEC message, provided it was at least 2 bytes long. This is useful to test the high-level protocol since messages that are too short should be ignored.
<op>[,<mode>] rx-arb-lost <poll>

Generate a POLL message to trigger an Arbitration Lost condition. This command is only allowed for <op> values of next or all. As soon as a start bit has been received the CEC adapter will switch to transmit mode and it will transmit a POLL message. By default this is 0x0f, but it can also be specified explicitly via the <poll> argument.

This command can be used to test the Arbitration Lost condition in the remote CEC transmitter. Arbitration happens when two CEC adapters start sending a message at the same time. In that case the initiator with the most leading zeroes wins and the other transmitter has to stop transmitting ('Arbitration Lost'). This is very hard to test, except by using this error injection command.

This does not work if the remote CEC transmitter has logical address 0 ('TV') since that will always win.

3.4. Transmit Messages

tx-ignore-nack-until-eom

This setting changes the behavior of transmitting CEC messages. Normally as soon as the receiver NACKs a byte the transmit will stop, but the specification also allows that the full message is transmitted and only at the end will the transmitter look at the ACK bit. This is not recommended behavior since there is no point in keeping the CEC bus busy for longer than is strictly needed. Especially given how slow the bus is.

This setting can be used to test how well a receiver deals with transmitters that ignore NACKs until the very end of the message.

<op>[,<mode>] tx-no-eom
Don't set the EOM bit. Normally the last byte of the message has the EOM (End-Of-Message) bit set. With this command the transmit will just stop without ever sending an EOM. This can be used to test how a receiver handles this case. Normally receivers have a time-out after which they will go back to the Idle state.
<op>[,<mode>] tx-early-eom
Set the EOM bit one byte too soon. This obviously only works for messages of two bytes or more. The EOM bit will be set for the second-to-last byte and not for the final byte. The receiver should ignore the last byte in this case. Since the resulting message is likely to be too short for this same reason the whole message is typically ignored. The receiver should be in Idle state after the last byte was transmitted.
<op>[,<mode>] tx-add-bytes <num>

Append <num> (1-255) spurious bytes to the message. The extra bytes have the value of the byte position in the message. So if you transmit a two byte message (e.g. a Get CEC Version message) and add 2 bytes, then the full message received by the remote CEC adapter is 0x40 0x9f 0x02 0x03.

This command can be used to test buffer overflows in the receiver. E.g. what does it do when it receives more than the maximum message size of 16 bytes.

<op>[,<mode>] tx-remove-byte
Drop the last byte from the message, provided the message is at least two bytes long. The receiver should ignore messages that are too short.
<op>[,<mode>] tx-short-bit <bit>

Make this bit period shorter than allowed. The bit position cannot be an Ack bit. If <op> specifies a specific CEC opcode then the bit position must be at least 18, otherwise the opcode hasn't been received yet. Normally the period of a data bit is between 2.05 and 2.75 milliseconds. With this command the period of this bit is 1.8 milliseconds, this is done by reducing the time the CEC bus is high. This bit period is less than is allowed and the receiver should respond with a Low Drive condition.

This command is ignored for 0 bits in bit positions 0 to 3. This is because the receiver also looks for an Arbitration Lost condition in those first four bits and it is undefined what will happen if it sees a too-short 0 bit.

<op>[,<mode>] tx-long-bit <bit>

Make this bit period longer than is valid. The bit position cannot be an Ack bit. If <op> specifies a specific CEC opcode then the bit position must be at least 18, otherwise the opcode hasn't been received yet. Normally the period of a data bit is between 2.05 and 2.75 milliseconds. With this command the period of this bit is 2.9 milliseconds, this is done by increasing the time the CEC bus is high.

Even though this bit period is longer than is valid it is undefined what a receiver will do. It might just accept it, or it might time out and return to Idle state. Unfortunately the CEC specification is silent about this.

This command is ignored for 0 bits in bit positions 0 to 3. This is because the receiver also looks for an Arbitration Lost condition in those first four bits and it is undefined what will happen if it sees a too-long 0 bit.

<op>[,<mode>] tx-short-start
Make this start bit period shorter than allowed. Normally the period of a start bit is between 4.3 and 4.7 milliseconds. With this command the period of the start bit is 4.1 milliseconds, this is done by reducing the time the CEC bus is high. This start bit period is less than is allowed and the receiver should return to Idle state when this is detected.
<op>[,<mode>] tx-long-start

Make this start bit period longer than is valid. Normally the period of a start bit is between 4.3 and 4.7 milliseconds. With this command the period of the start bit is 5 milliseconds, this is done by increasing the time the CEC bus is high. This start bit period is more than is valid and the receiver should return to Idle state when this is detected.

Even though this start bit period is longer than is valid it is undefined what a receiver will do. It might just accept it, or it might time out and return to Idle state. Unfortunately the CEC specification is silent about this.

<op>[,<mode>] tx-last-bit <bit>
Just stop transmitting after this bit. If <op> specifies a specific CEC opcode then the bit position must be at least 18, otherwise the opcode hasn't been received yet. This command can be used to test how the receiver reacts when a message just suddenly stops. It should time out and go back to Idle state.
<op>[,<mode>] tx-low-drive <bit>
Force a Low Drive condition at this bit position. If <op> specifies a specific CEC opcode then the bit position must be at least 18, otherwise the opcode hasn't been received yet. This can be used to test how the receiver handles Low Drive conditions. Note that if this happens at bit positions 0-3 the receiver can interpret this as an Arbitration Lost condition. This is implementation dependent.

3.5. Custom Pulses

tx-custom-low-usecs <usecs>
This defines the duration in microseconds that the custom pulse pulls the CEC line low. The default is 1000 microseconds.
tx-custom-high-usecs <usecs>
This defines the duration in microseconds that the custom pulse keeps the CEC line high (unless another CEC adapter pulls it low in that time). The default is 1000 microseconds. The total period of the custom pulse is tx-custom-low-usecs + tx-custom-high-usecs.
<op>[,<mode>] tx-custom-bit <bit>
Send the custom bit instead of a regular data bit. The bit position cannot be an Ack bit. If <op> specifies a specific CEC opcode then the bit position must be at least 18, otherwise the opcode hasn't been received yet.
<op>[,<mode>] tx-custom-start
Send the custom bit instead of a regular start bit.
tx-custom-pulse
Transmit a single custom pulse as soon as the CEC bus is idle.