| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20160516164145.GA12752@dtor-ws>
Date: Mon, 16 May 2016 09:41:45 -0700
From: Dmitry Torokhov <dmitry.torokhov@...il.com>
To: "jeffrey.lin" <yajohn@...il.com>
Cc: rydberg@...omail.se, grant.likely@...aro.org, robh+dt@...nel.org,
jeesw@...fas.com, bleung@...omium.org, jeffrey.lin@...-ic.com,
roger.yang@...-ic.com, KP.li@...-ic.com, albert.shieh@...-ic.com,
linux-kernel@...r.kernel.org, linux-input@...r.kernel.org,
devicetree@...r.kernel.org
Subject: Re: [PATCH] driver: input :touchscreen : add Raydium I2C touch driver
On Mon, May 16, 2016 at 11:46:51PM +0800, jeffrey.lin wrote:
> Hi Dmitry:
> I've finished issues under the format you suggested as below.
>
> >#define RM_RESET_MSG_ADDR 0x40000004
> >#define RM_FASTBOOT_MSG_ADDR 0x50000620
>
> >#define RM_MAX_READ_SIZE 63
> change maximum read size to 56 bytes
> #define RM_MAX_READ_SIZE 56
OK.
>
> >#define RM_CONTACT_X_POS 1
> >#define RM_CONTACT_Y_POS 3
> >#define RM_CONTACT_PRESSURE_POS 5 // XXX - check - original was 4
> #define RM_CONTACT_PRESSURE_POS 5 /*FIXME, correct 5*/
OK.
>
> >#define RM_BL_WRT_CMD_SIZE 3 /* bl flash wrt cmd size */
> >#define RM_BL_WRT_PKG_SIZE 32 /* bl wrt pkg size */
> >#define RM_BL_WRT_LEN (RM_BL_WRT_PKG_SIZE + RM_BL_WRT_CMD_SIZE)
> >#define RM_FW_PAGE_SIZE 128
> >#define RM_MAX_FW_RETRIES 30
> additional maximum firmware size for protection
> #define RM_MAX_FW_SIZE (0xD000) /*define max firmware size*/
OK.
>
> >static int raydium_i2c_read_message(struct i2c_client *client,
> > u32 addr, void *data, size_t len)
> >{
> > __be32 be_addr;
> > size_t xfer_len;
> > int error;
> > while (len) {
> > xfer_len = min_t(size_t, len, RM_MAX_READ_SIZE);
> >
> > be_addr = cpu_to_be32(addr);
> >
> > error = raydium_i2c_send(client, RM_CMD_BANK_SWITCH,
> > &be_addr, sizeof(be_addr));
> > if (!error)
> > error = raydium_i2c_read(client, addr & 0xff,
> > data, xfer_len);
> Change as:
> if (!error)
> error = raydium_i2c_read(client, (be_addr >> 24) & 0xff,
> data, xfer_len);
I think it is the same on LE, and I suspect it will not work correctly
on BE... You want to have the 8 least significant bits of the bank to be
used as the address, right?
>
> >static int raydium_i2c_send_message(struct i2c_client *client,
> > u32 addr, const void *data, size_t len)
> >{
> > __be32 be_addr = cpu_to_be32(addr);
> > int error;
> > error = raydium_i2c_send(client, RM_CMD_BANK_SWITCH,
> > &be_addr, sizeof(be_addr));
> > if (!error)
> > error = raydium_i2c_send(client, addr & 0xff, data, len);
> Change as:
> error = raydium_i2c_send(client, (be_addr >> 24) & 0xff,
> data, len);
Same here.
>
>
> >static int raydium_i2c_fastboot(struct i2c_client *client)
> >{
> /*FIXME;Correct, direct access mode is word alignment*/
> > u8 buf[4];
> > int error;
> >
> > error = raydium_i2c_read_message(client, RM_FASTBOOT_MSG_ADDR,
> > buf, sizeof(buf));
>
> >static int raydium_i2c_check_fw_status(struct raydium_data *ts)
> >{
> > struct i2c_client *client = ts->client;
> > static const u8 bl_area[] = { 0x62, 0x6f, 0x6f, 0x74 };
> > static const u8 main_area[] = { 0x66, 0x69, 0x72, 0x6d };
> > u8 buf[4];
> > int error;
> >
> > error = raydium_i2c_read(client, RM_CMD_BOOT_READ, buf, sizeof(buf));
> > if (!error) {
> > // XXX FIXME: why do we compare only 1st bytes? Do we even
> > // need 4-byte constants?
> > if (buf[0] == bl_area[0])
> > ts->boot_mode = RAYDIUM_TS_BLDR;
> > else if (buf[0] == main_area[0])
> > ts->boot_mode = RAYDIUM_TS_MAIN;
> > return 0;
> > }
> >
> > return error;
> >}
> Change as below,
> static int raydium_i2c_check_fw_status(struct raydium_data *ts)
> {
> struct i2c_client *client = ts->client;
> static const u8 bl_ack = 0x62;
> static const u8 main_ack = 0x66;
> u8 buf[4];
> int error;
>
> error = raydium_i2c_read(client, RM_CMD_BOOT_READ, buf, sizeof(buf));
> if (!error) {
> /*FIXME, changed as one byte comparison*/
> if (buf[0] == bl_ack)
> ts->boot_mode = RAYDIUM_TS_BLDR;
> else if (buf[0] == main_ack)
> ts->boot_mode = RAYDIUM_TS_MAIN;
> return 0;
> }
>
> return error;
> }
>
> >static int raydium_i2c_fw_write_page(struct i2c_client *client,
> > u8 page_idx, void *data, size_t len)
> >{
> > u8 buf[RM_BL_WRT_LEN];
> > u8 pkg_idx = 1;
> > size_t xfer_len;
> > int error;
> >
> > while (len) {
> > xfer_len = min_t(size_t, len, RM_BL_WRT_PKG_SIZE);
> >
> > buf[BL_HEADER] = 0x0b;
> > // XXX FIXME: is this correct? Do we really want all pages
> > // after 1st to have 0xff? Should it be a counter?
> > // Why do we need both pages and packages within pages?
> > buf[BL_PAGE_STR] = page_idx ? 0 : 0xff;
> > buf[BL_PKG_IDX] = pkg_idx;
> > memcpy(&buf[BL_DATA_STR], data, xfer_len);
> >
> > error = raydium_i2c_write_object(client, buf, xfer_len,
> > RAYDIUM_WAIT_READY);
> > if (error) {
> > dev_err(&client->dev,
> > "page write command failed for page %d, chunk %d: %d\n",
> > page_idx, pkg_idx, error);
> > return error;
> > }
> >
> > msleep(20);
> >
> > data += xfer_len;
> > len -= xfer_len;
> > pkg_idx++;
> > }
> >
> > return error;
> >}
> Because of need fully fill 128bytes in pages, so that function change as below:
I see. In this case, how about we do:
> static int raydium_i2c_fw_write_page(struct i2c_client *client,
> u16 page_idx, const void *data, size_t len)
> {
> u8 buf[RM_BL_WRT_LEN];
> u8 pkg_idx = 1;
> u8 div_cnt;
> size_t xfer_len;
> int error;
> int i;
>
> div_cnt = len % RM_BL_WRT_PKG_SIZE ?
> len / RM_BL_WRT_PKG_SIZE + 1:len / RM_BL_WRT_PKG_SIZE;
Drop this. BTW, if you ever need it we have DIV_ROUND_UP macro.
>
> for (i = 0; i < div_cnt; i++) {
while (len) {
> xfer_len = min_t(size_t, len, RM_BL_WRT_PKG_SIZE);
> buf[BL_HEADER] = RM_CMD_BOOT_PAGE_WRT;
> /*FIXME,Touch MCU need zero index as start page*/
> buf[BL_PAGE_STR] = page_idx ? 0xff : 0;
> buf[BL_PKG_IDX] = pkg_idx++;
>
> memcpy(&buf[BL_DATA_STR], data, xfer_len);
/* we need to pad to full page size */
if (len < RM_BL_WRT_PKG_SIZE)
memset(&buf[BL_DATA_STR] + len, 0xff,
RM_BL_WRT_PKG_SIZE - len);
>
> if (len == 0)
> memset(buf + BL_DATA_STR, 0xff, RM_BL_WRT_PKG_SIZE);
> else if (len < RM_BL_WRT_PKG_SIZE)
> memset(buf + BL_DATA_STR + xfer_len, 0xff,
> RM_BL_WRT_PKG_SIZE - xfer_len);
>
> error = raydium_i2c_write_object(client, buf, RM_BL_WRT_LEN,
> RAYDIUM_WAIT_READY);
> if (error) {
> dev_err(&client->dev,
> "page write command failed for page %d, chunk %d: %d\n",
> page_idx, pkg_idx, error);
> return error;
> }
> data += RM_BL_WRT_PKG_SIZE;
> len -= RM_BL_WRT_PKG_SIZE;
> }
>
> return error;
> }
>
> >static void raydium_mt_event(struct raydium_data *ts)
> >{
> > int i;
> > int error;
> memory allocate
> ts->report_data = kmalloc(ts->report_size, GFP_KERNEL);
> if (!ts->report_data)
> return;
I thought I was allocating it after I queried the touchscreen
parameters... If not it was oversight. I do not think we should be
doing this on every interrupt, so please do the allocation in ->probe()
code.
> >
> > error = raydium_i2c_read_message(ts->client, ts->data_bank_addr,
> > ts->report_data, ts->report_size);
> > if (error) {
> > dev_err(&ts->client->dev, "%s: failed to read data: %d\n",
> > __func__, error);
> > return;
> goto out_of_event;
> > }
> >
> >
> > for (i = 0; i < ts->report_size / ts->contact_size; i++) {
> > u8 *contact = &ts->report_data[ts->contact_size * i];
> > bool state = contact[RM_CONTACT_STATE_POS];
> > u8 wx, wy;
> >
> > input_mt_slot(ts->input, i);
> > input_mt_report_slot_state(ts->input, MT_TOOL_FINGER, state);
> >
> > if (!state)
> > continue;
> >
> > input_report_abs(ts->input, ABS_MT_POSITION_X,
> > get_unaligned_le16(&contact[RM_CONTACT_X_POS]));
> > input_report_abs(ts->input, ABS_MT_POSITION_Y,
> > get_unaligned_le16(&contact[RM_CONTACT_Y_POS]));
> > input_report_abs(ts->input, ABS_MT_PRESSURE,
> > contact[RM_CONTACT_PRESSURE_POS]);
> >
> > wx = contact[RM_CONTACT_WIDTH_X_POS];
> > wy = contact[RM_CONTACT_WIDTH_Y_POS];
> >
> > input_report_abs(ts->input, ABS_MT_TOUCH_MAJOR, max(wx, wy));
> > input_report_abs(ts->input, ABS_MT_TOUCH_MINOR, min(wx, wy));
> > }
> >
> > input_mt_sync_frame(ts->input);
> > input_sync(ts->input);
> out_of_event:
> kfree(ts->report_data);
> >}
>
>
Please prepare full new patch and post it so I can give it one more look
over before I can merge it.
Thanks!
--
Dmitry
Powered by blists - more mailing lists