/* * UPEK TouchChip driver for libfprint * Copyright (C) 2013 Vasily Khoruzhick * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ #define FP_COMPONENT "upektc_img" #include "drivers_api.h" #include "upek_proto.h" #include "upektc_img.h" static void start_capture (FpImageDevice *dev); static void start_deactivation (FpImageDevice *dev); #define EP_IN (1 | FPI_USB_ENDPOINT_IN) #define EP_OUT (2 | FPI_USB_ENDPOINT_OUT) #define CTRL_TIMEOUT 4000 #define BULK_TIMEOUT 4000 #define MAX_CMD_SIZE 64 #define MAX_RESPONSE_SIZE 2052 #define SHORT_RESPONSE_SIZE 64 struct _FpiDeviceUpektcImg { FpImageDevice parent; unsigned char cmd[MAX_CMD_SIZE]; unsigned char response[MAX_RESPONSE_SIZE]; unsigned char *image_bits; unsigned char seq; size_t expected_image_size; size_t image_size; size_t response_rest; gboolean area_sensor; gboolean deactivating; }; G_DECLARE_FINAL_TYPE (FpiDeviceUpektcImg, fpi_device_upektc_img, FPI, DEVICE_UPEKTC_IMG, FpImageDevice); G_DEFINE_TYPE (FpiDeviceUpektcImg, fpi_device_upektc_img, FP_TYPE_IMAGE_DEVICE); /****** HELPERS ******/ static void upektc_img_cmd_fix_seq (unsigned char *cmd_buf, unsigned char seq) { uint8_t byte; byte = cmd_buf[5]; byte &= 0x0f; byte |= (seq << 4); cmd_buf[5] = byte; } static void upektc_img_cmd_update_crc (unsigned char *cmd_buf, size_t size) { /* CRC does not cover Ciao prefix (4 bytes) and CRC location (2 bytes) */ uint16_t crc = udf_crc (cmd_buf + 4, size - 6); cmd_buf[size - 2] = (crc & 0x00ff); cmd_buf[size - 1] = (crc & 0xff00) >> 8; } FP_GNUC_ACCESS (read_only, 3, 4) static void upektc_img_submit_req (FpiSsm *ssm, FpImageDevice *dev, const unsigned char *buf, size_t buf_size, unsigned char seq, FpiUsbTransferCallback cb) { FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); FpiUsbTransfer *transfer = fpi_usb_transfer_new (FP_DEVICE (dev)); BUG_ON (buf_size > MAX_CMD_SIZE); memcpy (self->cmd, buf, buf_size); upektc_img_cmd_fix_seq (self->cmd, seq); upektc_img_cmd_update_crc (self->cmd, buf_size); fpi_usb_transfer_fill_bulk_full (transfer, EP_OUT, self->cmd, buf_size, NULL); transfer->ssm = ssm; transfer->short_is_error = TRUE; fpi_usb_transfer_submit (transfer, BULK_TIMEOUT, NULL, cb, NULL); } static void upektc_img_read_data (FpiSsm *ssm, FpImageDevice *dev, size_t buf_size, size_t buf_offset, FpiUsbTransferCallback cb) { FpiUsbTransfer *transfer = fpi_usb_transfer_new (FP_DEVICE (dev)); FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); BUG_ON (buf_offset + buf_size > MAX_RESPONSE_SIZE); fpi_usb_transfer_fill_bulk_full (transfer, EP_IN, self->response + buf_offset, buf_size, NULL); transfer->ssm = ssm; fpi_usb_transfer_submit (transfer, BULK_TIMEOUT, NULL, cb, NULL); } /****** CAPTURE ******/ enum capture_states { CAPTURE_INIT_CAPTURE, CAPTURE_READ_DATA, CAPTURE_READ_DATA_TERM, CAPTURE_ACK_00_28, CAPTURE_ACK_08, CAPTURE_ACK_FRAME, CAPTURE_ACK_00_28_TERM, CAPTURE_NUM_STATES, }; static void capture_reqs_cb (FpiUsbTransfer *transfer, FpDevice *device, gpointer user_data, GError *error) { if (error) { fpi_ssm_mark_failed (transfer->ssm, error); return; } switch (fpi_ssm_get_cur_state (transfer->ssm)) { case CAPTURE_ACK_00_28_TERM: fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_READ_DATA_TERM); break; default: fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_READ_DATA); break; } } static int upektc_img_process_image_frame (unsigned char *image_buf, unsigned char *cmd_res) { int offset = 8; int len = ((cmd_res[5] & 0x0f) << 8) | (cmd_res[6]); len -= 1; if (cmd_res[7] == 0x2c) { len -= 10; offset += 10; } if (cmd_res[7] == 0x20) len -= 4; memcpy (image_buf, cmd_res + offset, len); return len; } static void capture_read_data_cb (FpiUsbTransfer *transfer, FpDevice *device, gpointer user_data, GError *error) { FpImageDevice *dev = FP_IMAGE_DEVICE (device); FpImageDeviceClass *img_class = FP_IMAGE_DEVICE_GET_CLASS (dev); FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); unsigned char *data = self->response; FpImage *img; size_t response_size; if (error) { fp_dbg ("request is not completed, %s", error->message); fpi_ssm_mark_failed (transfer->ssm, error); return; } if (self->deactivating) { fp_dbg ("Deactivate requested"); fpi_ssm_mark_completed (transfer->ssm); return; } fp_dbg ("request completed, len: %.4x", (gint) transfer->actual_length); if (transfer->actual_length == 0) { fpi_ssm_jump_to_state (transfer->ssm, fpi_ssm_get_cur_state (transfer->ssm)); return; } if (fpi_ssm_get_cur_state (transfer->ssm) == CAPTURE_READ_DATA_TERM) { fp_dbg ("Terminating SSM"); fpi_ssm_mark_completed (transfer->ssm); return; } if (!self->response_rest) { response_size = ((data[5] & 0x0f) << 8) + data[6]; response_size += 9; /* 7 bytes for header, 2 for CRC */ if (response_size > transfer->actual_length) { fp_dbg ("response_size is %lu, actual_length is %d", (gulong) response_size, (gint) transfer->actual_length); fp_dbg ("Waiting for rest of transfer"); BUG_ON (self->response_rest); self->response_rest = response_size - transfer->actual_length; fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_READ_DATA); return; } } self->response_rest = 0; switch (data[4]) { case 0x00: switch (data[7]) { /* No finger */ case 0x28: fp_dbg ("18th byte is %.2x", data[18]); switch (data[18]) { case 0x0c: /* no finger */ fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_ACK_00_28); break; case 0x13: /* finger is present keep your finger on reader */ fpi_device_report_finger_status_changes (device, FP_FINGER_STATUS_NEEDED, FP_FINGER_STATUS_NONE); fpi_ssm_jump_to_state (transfer->ssm, self->area_sensor ? CAPTURE_ACK_00_28 : CAPTURE_ACK_00_28_TERM); break; case 0x00: /* finger is present! */ fpi_device_report_finger_status_changes (device, FP_FINGER_STATUS_PRESENT, FP_FINGER_STATUS_NONE); fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_ACK_00_28); break; case 0x01: /* no finger! */ fpi_device_report_finger_status_changes (device, FP_FINGER_STATUS_NONE, FP_FINGER_STATUS_PRESENT); fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_ACK_00_28); break; case 0x1e: /* short scan */ fp_err ("short scan, aborting"); fpi_image_device_retry_scan (dev, FP_DEVICE_RETRY_TOO_SHORT); fpi_image_device_report_finger_status (dev, FALSE); fpi_ssm_jump_to_state (transfer->ssm, self->area_sensor ? CAPTURE_ACK_00_28 : CAPTURE_ACK_00_28_TERM); break; case 0x1d: /* too much horizontal movement */ fp_err ("too much horizontal movement, aborting"); fpi_image_device_retry_scan (dev, FP_DEVICE_RETRY_CENTER_FINGER); fpi_image_device_report_finger_status (dev, FALSE); fpi_ssm_jump_to_state (transfer->ssm, self->area_sensor ? CAPTURE_ACK_00_28 : CAPTURE_ACK_00_28_TERM); break; default: /* some error happened, cancel scan */ fp_err ("something bad happened, stop scan"); fpi_image_device_retry_scan (dev, FP_DEVICE_RETRY); fpi_image_device_report_finger_status (dev, FALSE); fpi_ssm_jump_to_state (transfer->ssm, self->area_sensor ? CAPTURE_ACK_00_28 : CAPTURE_ACK_00_28_TERM); break; } break; /* Image frame with additional info */ case 0x2c: fpi_image_device_report_finger_status (dev, TRUE); /* Plain image frame */ case 0x24: self->image_size += upektc_img_process_image_frame (self->image_bits + self->image_size, data); fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_ACK_FRAME); break; /* Last image frame */ case 0x20: self->image_size += upektc_img_process_image_frame (self->image_bits + self->image_size, data); BUG_ON (self->image_size != self->expected_image_size); fp_dbg ("Image size is %lu", (gulong) self->image_size); img = fp_image_new (img_class->img_width, img_class->img_height); img->flags |= FPI_IMAGE_PARTIAL; memcpy (img->data, self->image_bits, self->image_size); fpi_image_device_image_captured (dev, img); fpi_image_device_report_finger_status (dev, FALSE); fpi_ssm_mark_completed (transfer->ssm); break; default: fp_err ("Unknown response!"); fpi_ssm_mark_failed (transfer->ssm, fpi_device_error_new (FP_DEVICE_ERROR_GENERAL)); break; } break; case 0x08: fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_ACK_08); break; default: fp_err ("Not handled response!"); fpi_ssm_mark_failed (transfer->ssm, fpi_device_error_new (FP_DEVICE_ERROR_GENERAL)); } } static void capture_run_state (FpiSsm *ssm, FpDevice *_dev) { FpImageDevice *dev = FP_IMAGE_DEVICE (_dev); FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (_dev); switch (fpi_ssm_get_cur_state (ssm)) { case CAPTURE_INIT_CAPTURE: if (self->area_sensor) upektc_img_submit_req (ssm, dev, upek2020_init_capture_press, sizeof (upek2020_init_capture_press), self->seq, capture_reqs_cb); else upektc_img_submit_req (ssm, dev, upek2020_init_capture, sizeof (upek2020_init_capture), self->seq, capture_reqs_cb); self->seq++; break; case CAPTURE_READ_DATA: case CAPTURE_READ_DATA_TERM: if (!self->response_rest) upektc_img_read_data (ssm, dev, SHORT_RESPONSE_SIZE, 0, capture_read_data_cb); else upektc_img_read_data (ssm, dev, MAX_RESPONSE_SIZE - SHORT_RESPONSE_SIZE, SHORT_RESPONSE_SIZE, capture_read_data_cb); break; case CAPTURE_ACK_00_28: case CAPTURE_ACK_00_28_TERM: upektc_img_submit_req (ssm, dev, upek2020_ack_00_28, sizeof (upek2020_ack_00_28), self->seq, capture_reqs_cb); self->seq++; break; case CAPTURE_ACK_08: upektc_img_submit_req (ssm, dev, upek2020_ack_08, sizeof (upek2020_ack_08), 0, capture_reqs_cb); break; case CAPTURE_ACK_FRAME: upektc_img_submit_req (ssm, dev, upek2020_ack_frame, sizeof (upek2020_ack_frame), self->seq, capture_reqs_cb); self->seq++; break; } ; } static void capture_sm_complete (FpiSsm *ssm, FpDevice *_dev, GError *error_arg) { FpImageDevice *dev = FP_IMAGE_DEVICE (_dev); FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (_dev); g_autoptr(GError) error = error_arg; /* Note: We assume that the error is a cancellation in the deactivation case */ if (self->deactivating) start_deactivation (dev); else if (error) fpi_image_device_session_error (dev, g_steal_pointer (&error)); else start_capture (dev); } static void start_capture (FpImageDevice *dev) { FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); FpiSsm *ssm; self->image_size = 0; ssm = fpi_ssm_new (FP_DEVICE (dev), capture_run_state, CAPTURE_NUM_STATES); fpi_ssm_start (ssm, capture_sm_complete); } /****** INITIALIZATION/DEINITIALIZATION ******/ enum deactivate_states { DEACTIVATE_DEINIT, DEACTIVATE_READ_DEINIT_DATA, DEACTIVATE_NUM_STATES, }; static void deactivate_reqs_cb (FpiUsbTransfer *transfer, FpDevice *device, gpointer user_data, GError *error) { if (!error) fpi_ssm_jump_to_state (transfer->ssm, CAPTURE_READ_DATA); else fpi_ssm_mark_failed (transfer->ssm, error); } /* TODO: process response properly */ static void deactivate_read_data_cb (FpiUsbTransfer *transfer, FpDevice *device, gpointer user_data, GError *error) { if (!error) fpi_ssm_mark_completed (transfer->ssm); else fpi_ssm_mark_failed (transfer->ssm, error); } static void deactivate_run_state (FpiSsm *ssm, FpDevice *_dev) { FpImageDevice *dev = FP_IMAGE_DEVICE (_dev); FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (_dev); switch (fpi_ssm_get_cur_state (ssm)) { case DEACTIVATE_DEINIT: upektc_img_submit_req (ssm, dev, upek2020_deinit, sizeof (upek2020_deinit), self->seq, deactivate_reqs_cb); self->seq++; break; case DEACTIVATE_READ_DEINIT_DATA: upektc_img_read_data (ssm, dev, SHORT_RESPONSE_SIZE, 0, deactivate_read_data_cb); break; } ; } static void deactivate_sm_complete (FpiSsm *ssm, FpDevice *_dev, GError *error) { FpImageDevice *dev = FP_IMAGE_DEVICE (_dev); FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (_dev); fp_dbg ("Deactivate completed"); self->deactivating = FALSE; fpi_image_device_deactivate_complete (dev, error); } static void start_deactivation (FpImageDevice *dev) { FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); FpiSsm *ssm; self->image_size = 0; ssm = fpi_ssm_new (FP_DEVICE (dev), deactivate_run_state, DEACTIVATE_NUM_STATES); fpi_ssm_start (ssm, deactivate_sm_complete); } enum activate_states { ACTIVATE_CONTROL_REQ_1, ACTIVATE_READ_CTRL_RESP_1, ACTIVATE_INIT_1, ACTIVATE_READ_INIT_1_RESP, ACTIVATE_INIT_2, ACTIVATE_READ_INIT_2_RESP, ACTIVATE_CONTROL_REQ_2, ACTIVATE_READ_CTRL_RESP_2, ACTIVATE_INIT_3, ACTIVATE_READ_INIT_3_RESP, ACTIVATE_INIT_4, ACTIVATE_READ_INIT_4_RESP, ACTIVATE_NUM_STATES, }; static void init_reqs_cb (FpiUsbTransfer *transfer, FpDevice *device, gpointer user_data, GError *error) { if (!error) fpi_ssm_next_state (transfer->ssm); else fpi_ssm_mark_failed (transfer->ssm, error); } static void init_read_data_cb (FpiUsbTransfer *transfer, FpDevice *device, gpointer user_data, GError *error) { FpImageDevice *dev = FP_IMAGE_DEVICE (device); FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); unsigned char *data = self->response; if (error) { fpi_ssm_mark_failed (transfer->ssm, error); return; } if (data[12] == 0x06 && data[13] == 0x14) /* if get_info */ { FpImageDeviceClass *img_class = FP_IMAGE_DEVICE_GET_CLASS (dev); uint16_t width = (data[51] << 8) | data[50]; uint16_t height = (data[53] << 8) | data[52]; self->area_sensor = !(data[49] & 0x80); switch (width) { case 256: fp_dbg ("Sensor type : TCS1x, width x height: %hu x %hu", width, height); /* 360x256 --- 270x192 must be set */ BUG_ON (height != 360); img_class->img_width = 192; img_class->img_height = 270; break; case 208: fp_dbg ("Sensor type : TCS2, width x height: %hu x %hu", width, height); /* 288x208 --- 216x156 must be set */ BUG_ON (height != 288); img_class->img_width = 156; img_class->img_height = 216; break; case 248: fp_dbg ("Sensor type : TCS3, width x height: %hu x %hu", width, height); /* 360x248 --- 270x186 must be set */ BUG_ON (height != 360); img_class->img_width = 186; img_class->img_height = 270; break; case 192: fp_dbg ("Sensor type : TCS4x, width x height: %hu x %hu", width, height); /* 512x192 --- 384x144 must be set */ BUG_ON (height != 512); img_class->img_width = 144; img_class->img_height = 384; break; case 144: fp_dbg ("Sensor type : TCS5x, width x height: %hu x %hu", width, height); /* 512x144 --- 384x108 must be set */ BUG_ON (height != 512); img_class->img_width = 108; img_class->img_height = 384; break; default: fp_dbg ("Sensor type : Unknown"); fpi_ssm_mark_failed (transfer->ssm, fpi_device_error_new_msg (FP_DEVICE_ERROR_PROTO, "Unknown sensor type (reported size %dx%d)", width, height)); return; } self->expected_image_size = img_class->img_width * img_class->img_height; self->image_bits = g_malloc0 (self->expected_image_size * 2); } fpi_ssm_next_state (transfer->ssm); } static void activate_run_state (FpiSsm *ssm, FpDevice *dev) { FpiUsbTransfer *transfer; FpImageDevice *idev = FP_IMAGE_DEVICE (dev); FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); switch (fpi_ssm_get_cur_state (ssm)) { case ACTIVATE_CONTROL_REQ_1: case ACTIVATE_CONTROL_REQ_2: { transfer = fpi_usb_transfer_new (dev); fpi_usb_transfer_fill_control (transfer, G_USB_DEVICE_DIRECTION_HOST_TO_DEVICE, G_USB_DEVICE_REQUEST_TYPE_VENDOR, G_USB_DEVICE_RECIPIENT_DEVICE, 0x0c, 0x100, 0x0400, 1); transfer->buffer[0] = '\0'; transfer->ssm = ssm; fpi_usb_transfer_submit (transfer, CTRL_TIMEOUT, NULL, fpi_ssm_usb_transfer_cb, NULL); } break; case ACTIVATE_INIT_1: upektc_img_submit_req (ssm, idev, upek2020_init_1, sizeof (upek2020_init_1), 0, init_reqs_cb); break; case ACTIVATE_INIT_2: upektc_img_submit_req (ssm, idev, upek2020_init_2, sizeof (upek2020_init_2), 0, init_reqs_cb); break; case ACTIVATE_INIT_3: upektc_img_submit_req (ssm, idev, upek2020_init_3, sizeof (upek2020_init_3), 0, init_reqs_cb); break; case ACTIVATE_INIT_4: upektc_img_submit_req (ssm, idev, upek2020_init_4, sizeof (upek2020_init_4), self->seq, init_reqs_cb); /* Seq should be updated after 4th init */ self->seq++; break; case ACTIVATE_READ_CTRL_RESP_1: case ACTIVATE_READ_CTRL_RESP_2: case ACTIVATE_READ_INIT_1_RESP: case ACTIVATE_READ_INIT_2_RESP: case ACTIVATE_READ_INIT_3_RESP: case ACTIVATE_READ_INIT_4_RESP: upektc_img_read_data (ssm, idev, SHORT_RESPONSE_SIZE, 0, init_read_data_cb); break; } } static void activate_sm_complete (FpiSsm *ssm, FpDevice *_dev, GError *error) { FpImageDevice *dev = FP_IMAGE_DEVICE (_dev); fpi_image_device_activate_complete (dev, error); if (!error) start_capture (dev); } static void dev_activate (FpImageDevice *dev) { FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); FpiSsm *ssm = fpi_ssm_new (FP_DEVICE (dev), activate_run_state, ACTIVATE_NUM_STATES); self->seq = 0; fpi_ssm_start (ssm, activate_sm_complete); } static void dev_deactivate (FpImageDevice *dev) { FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); self->deactivating = TRUE; } static void dev_init (FpImageDevice *dev) { GError *error = NULL; /* TODO check that device has endpoints we're using */ if (!g_usb_device_claim_interface (fpi_device_get_usb_device (FP_DEVICE (dev)), 0, 0, &error)) { fpi_image_device_open_complete (dev, error); return; } fpi_image_device_open_complete (dev, NULL); } static void dev_deinit (FpImageDevice *dev) { FpiDeviceUpektcImg *self = FPI_DEVICE_UPEKTC_IMG (dev); GError *error = NULL; g_clear_pointer (&self->image_bits, g_free); g_usb_device_release_interface (fpi_device_get_usb_device (FP_DEVICE (dev)), 0, 0, &error); fpi_image_device_close_complete (dev, error); } static int discover (GUsbDevice *usb_device) { gint16 pid = g_usb_device_get_pid (usb_device); gint16 bcd = g_usb_device_get_release (usb_device); if (pid == 0x2020 && bcd == 1) return 100; if (pid == 0x2016 && bcd == 2) return 100; return 0; } static const FpIdEntry id_table[] = { { .vid = 0x147e, .pid = 0x2016, }, { .vid = 0x147e, .pid = 0x2020, }, { .vid = 0, .pid = 0, .driver_data = 0 }, }; static void fpi_device_upektc_img_init (FpiDeviceUpektcImg *self) { } static void fpi_device_upektc_img_class_init (FpiDeviceUpektcImgClass *klass) { FpDeviceClass *dev_class = FP_DEVICE_CLASS (klass); FpImageDeviceClass *img_class = FP_IMAGE_DEVICE_CLASS (klass); dev_class->id = "upektc_img"; dev_class->full_name = "Upek TouchChip Fingerprint Coprocessor"; dev_class->type = FP_DEVICE_TYPE_USB; dev_class->id_table = id_table; dev_class->scan_type = FP_SCAN_TYPE_SWIPE; dev_class->usb_discover = discover; img_class->img_open = dev_init; img_class->img_close = dev_deinit; img_class->activate = dev_activate; img_class->deactivate = dev_deactivate; img_class->bz3_threshold = 20; img_class->img_width = -1; img_class->img_height = -1; }