| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20160516164336.GB12752@dtor-ws>
Date: Mon, 16 May 2016 09:43:36 -0700
From: Dmitry Torokhov <dmitry.torokhov@...il.com>
To: "jeffrey.lin" <yajohn@...il.com>
Cc: rydberg@...omail.se, grant.likely@...aro.org, robh+dt@...nel.org,
jeesw@...fas.com, bleung@...omium.org, jeffrey.lin@...-ic.com,
roger.yang@...-ic.com, KP.li@...-ic.com, albert.shieh@...-ic.com,
linux-kernel@...r.kernel.org, linux-input@...r.kernel.org,
devicetree@...r.kernel.org
Subject: Re: [PATCH] driver: input :touchscreen : add Raydium I2C touch driver
On Mon, May 16, 2016 at 09:41:45AM -0700, Dmitry Torokhov wrote:
> On Mon, May 16, 2016 at 11:46:51PM +0800, jeffrey.lin wrote:
> > Hi Dmitry:
> > I've finished issues under the format you suggested as below.
> >
> > >#define RM_RESET_MSG_ADDR 0x40000004
> > >#define RM_FASTBOOT_MSG_ADDR 0x50000620
> >
> > >#define RM_MAX_READ_SIZE 63
> > change maximum read size to 56 bytes
> > #define RM_MAX_READ_SIZE 56
>
> OK.
>
> >
> > >#define RM_CONTACT_X_POS 1
> > >#define RM_CONTACT_Y_POS 3
> > >#define RM_CONTACT_PRESSURE_POS 5 // XXX - check - original was 4
> > #define RM_CONTACT_PRESSURE_POS 5 /*FIXME, correct 5*/
>
> OK.
>
> >
> > >#define RM_BL_WRT_CMD_SIZE 3 /* bl flash wrt cmd size */
> > >#define RM_BL_WRT_PKG_SIZE 32 /* bl wrt pkg size */
> > >#define RM_BL_WRT_LEN (RM_BL_WRT_PKG_SIZE + RM_BL_WRT_CMD_SIZE)
> > >#define RM_FW_PAGE_SIZE 128
> > >#define RM_MAX_FW_RETRIES 30
> > additional maximum firmware size for protection
> > #define RM_MAX_FW_SIZE (0xD000) /*define max firmware size*/
>
> OK.
>
> >
> > >static int raydium_i2c_read_message(struct i2c_client *client,
> > > u32 addr, void *data, size_t len)
> > >{
> > > __be32 be_addr;
> > > size_t xfer_len;
> > > int error;
> > > while (len) {
> > > xfer_len = min_t(size_t, len, RM_MAX_READ_SIZE);
> > >
> > > be_addr = cpu_to_be32(addr);
> > >
> > > error = raydium_i2c_send(client, RM_CMD_BANK_SWITCH,
> > > &be_addr, sizeof(be_addr));
> > > if (!error)
> > > error = raydium_i2c_read(client, addr & 0xff,
> > > data, xfer_len);
> > Change as:
> > if (!error)
> > error = raydium_i2c_read(client, (be_addr >> 24) & 0xff,
> > data, xfer_len);
>
> I think it is the same on LE, and I suspect it will not work correctly
> on BE... You want to have the 8 least significant bits of the bank to be
> used as the address, right?
>
> >
> > >static int raydium_i2c_send_message(struct i2c_client *client,
> > > u32 addr, const void *data, size_t len)
> > >{
> > > __be32 be_addr = cpu_to_be32(addr);
> > > int error;
> > > error = raydium_i2c_send(client, RM_CMD_BANK_SWITCH,
> > > &be_addr, sizeof(be_addr));
> > > if (!error)
> > > error = raydium_i2c_send(client, addr & 0xff, data, len);
> > Change as:
> > error = raydium_i2c_send(client, (be_addr >> 24) & 0xff,
> > data, len);
>
> Same here.
>
> >
> >
> > >static int raydium_i2c_fastboot(struct i2c_client *client)
> > >{
> > /*FIXME;Correct, direct access mode is word alignment*/
> > > u8 buf[4];
> > > int error;
> > >
> > > error = raydium_i2c_read_message(client, RM_FASTBOOT_MSG_ADDR,
> > > buf, sizeof(buf));
> >
> > >static int raydium_i2c_check_fw_status(struct raydium_data *ts)
> > >{
> > > struct i2c_client *client = ts->client;
> > > static const u8 bl_area[] = { 0x62, 0x6f, 0x6f, 0x74 };
> > > static const u8 main_area[] = { 0x66, 0x69, 0x72, 0x6d };
> > > u8 buf[4];
> > > int error;
> > >
> > > error = raydium_i2c_read(client, RM_CMD_BOOT_READ, buf, sizeof(buf));
> > > if (!error) {
> > > // XXX FIXME: why do we compare only 1st bytes? Do we even
> > > // need 4-byte constants?
> > > if (buf[0] == bl_area[0])
> > > ts->boot_mode = RAYDIUM_TS_BLDR;
> > > else if (buf[0] == main_area[0])
> > > ts->boot_mode = RAYDIUM_TS_MAIN;
> > > return 0;
> > > }
> > >
> > > return error;
> > >}
> > Change as below,
> > static int raydium_i2c_check_fw_status(struct raydium_data *ts)
> > {
> > struct i2c_client *client = ts->client;
> > static const u8 bl_ack = 0x62;
> > static const u8 main_ack = 0x66;
> > u8 buf[4];
> > int error;
> >
> > error = raydium_i2c_read(client, RM_CMD_BOOT_READ, buf, sizeof(buf));
> > if (!error) {
> > /*FIXME, changed as one byte comparison*/
> > if (buf[0] == bl_ack)
> > ts->boot_mode = RAYDIUM_TS_BLDR;
> > else if (buf[0] == main_ack)
> > ts->boot_mode = RAYDIUM_TS_MAIN;
> > return 0;
> > }
> >
> > return error;
> > }
> >
> > >static int raydium_i2c_fw_write_page(struct i2c_client *client,
> > > u8 page_idx, void *data, size_t len)
> > >{
> > > u8 buf[RM_BL_WRT_LEN];
> > > u8 pkg_idx = 1;
> > > size_t xfer_len;
> > > int error;
> > >
> > > while (len) {
> > > xfer_len = min_t(size_t, len, RM_BL_WRT_PKG_SIZE);
> > >
> > > buf[BL_HEADER] = 0x0b;
> > > // XXX FIXME: is this correct? Do we really want all pages
> > > // after 1st to have 0xff? Should it be a counter?
> > > // Why do we need both pages and packages within pages?
> > > buf[BL_PAGE_STR] = page_idx ? 0 : 0xff;
> > > buf[BL_PKG_IDX] = pkg_idx;
> > > memcpy(&buf[BL_DATA_STR], data, xfer_len);
> > >
> > > error = raydium_i2c_write_object(client, buf, xfer_len,
> > > RAYDIUM_WAIT_READY);
> > > if (error) {
> > > dev_err(&client->dev,
> > > "page write command failed for page %d, chunk %d: %d\n",
> > > page_idx, pkg_idx, error);
> > > return error;
> > > }
> > >
> > > msleep(20);
> > >
> > > data += xfer_len;
> > > len -= xfer_len;
> > > pkg_idx++;
> > > }
> > >
> > > return error;
> > >}
> > Because of need fully fill 128bytes in pages, so that function change as below:
>
> I see. In this case, how about we do:
>
> > static int raydium_i2c_fw_write_page(struct i2c_client *client,
> > u16 page_idx, const void *data, size_t len)
> > {
> > u8 buf[RM_BL_WRT_LEN];
> > u8 pkg_idx = 1;
> > u8 div_cnt;
> > size_t xfer_len;
> > int error;
> > int i;
> >
> > div_cnt = len % RM_BL_WRT_PKG_SIZE ?
> > len / RM_BL_WRT_PKG_SIZE + 1:len / RM_BL_WRT_PKG_SIZE;
>
> Drop this. BTW, if you ever need it we have DIV_ROUND_UP macro.
>
> >
> > for (i = 0; i < div_cnt; i++) {
>
> while (len) {
>
> > xfer_len = min_t(size_t, len, RM_BL_WRT_PKG_SIZE);
> > buf[BL_HEADER] = RM_CMD_BOOT_PAGE_WRT;
> > /*FIXME,Touch MCU need zero index as start page*/
> > buf[BL_PAGE_STR] = page_idx ? 0xff : 0;
> > buf[BL_PKG_IDX] = pkg_idx++;
> >
> > memcpy(&buf[BL_DATA_STR], data, xfer_len);
>
> /* we need to pad to full page size */
> if (len < RM_BL_WRT_PKG_SIZE)
> memset(&buf[BL_DATA_STR] + len, 0xff,
> RM_BL_WRT_PKG_SIZE - len);
> >
> > if (len == 0)
> > memset(buf + BL_DATA_STR, 0xff, RM_BL_WRT_PKG_SIZE);
> > else if (len < RM_BL_WRT_PKG_SIZE)
> > memset(buf + BL_DATA_STR + xfer_len, 0xff,
> > RM_BL_WRT_PKG_SIZE - xfer_len);
> >
> > error = raydium_i2c_write_object(client, buf, RM_BL_WRT_LEN,
> > RAYDIUM_WAIT_READY);
> > if (error) {
> > dev_err(&client->dev,
> > "page write command failed for page %d, chunk %d: %d\n",
> > page_idx, pkg_idx, error);
> > return error;
> > }
> > data += RM_BL_WRT_PKG_SIZE;
> > len -= RM_BL_WRT_PKG_SIZE;
> > }
> >
> > return error;
> > }
> >
> > >static void raydium_mt_event(struct raydium_data *ts)
> > >{
> > > int i;
> > > int error;
> > memory allocate
> > ts->report_data = kmalloc(ts->report_size, GFP_KERNEL);
> > if (!ts->report_data)
> > return;
>
> I thought I was allocating it after I queried the touchscreen
> parameters... If not it was oversight. I do not think we should be
> doing this on every interrupt, so please do the allocation in ->probe()
> code.
>
> > >
> > > error = raydium_i2c_read_message(ts->client, ts->data_bank_addr,
> > > ts->report_data, ts->report_size);
> > > if (error) {
> > > dev_err(&ts->client->dev, "%s: failed to read data: %d\n",
> > > __func__, error);
> > > return;
> > goto out_of_event;
> > > }
> > >
> > >
> > > for (i = 0; i < ts->report_size / ts->contact_size; i++) {
> > > u8 *contact = &ts->report_data[ts->contact_size * i];
> > > bool state = contact[RM_CONTACT_STATE_POS];
> > > u8 wx, wy;
> > >
> > > input_mt_slot(ts->input, i);
> > > input_mt_report_slot_state(ts->input, MT_TOOL_FINGER, state);
> > >
> > > if (!state)
> > > continue;
> > >
> > > input_report_abs(ts->input, ABS_MT_POSITION_X,
> > > get_unaligned_le16(&contact[RM_CONTACT_X_POS]));
> > > input_report_abs(ts->input, ABS_MT_POSITION_Y,
> > > get_unaligned_le16(&contact[RM_CONTACT_Y_POS]));
> > > input_report_abs(ts->input, ABS_MT_PRESSURE,
> > > contact[RM_CONTACT_PRESSURE_POS]);
> > >
> > > wx = contact[RM_CONTACT_WIDTH_X_POS];
> > > wy = contact[RM_CONTACT_WIDTH_Y_POS];
> > >
> > > input_report_abs(ts->input, ABS_MT_TOUCH_MAJOR, max(wx, wy));
> > > input_report_abs(ts->input, ABS_MT_TOUCH_MINOR, min(wx, wy));
> > > }
> > >
> > > input_mt_sync_frame(ts->input);
> > > input_sync(ts->input);
> > out_of_event:
> > kfree(ts->report_data);
> > >}
> >
> >
>
> Please prepare full new patch and post it so I can give it one more look
> over before I can merge it.
>
> Thanks!
Also please prepare binding documentation for the device, similar to
Documentation/devicetree/bindings/input/elants_i2c.txt (but have it in
Documentation/devicetree/bindings/input/touchscreen/).
--
Dmitry
Powered by blists - more mailing lists