├── .gitignore ├── spidev ├── spidev_test └── spidev_test.c ├── logs ├── goodix_enable_logs.reg └── README.md ├── experiments ├── README.md ├── extract_images_from_pcap.sh ├── analyze_goodix.dat.py ├── convert_to_pseudo_colors.py └── decode_image_packet.py ├── contrib └── 55-goodix.rules ├── Makefile ├── README.md ├── LICENSE └── goodix_fp_dump.c /.gitignore: -------------------------------------------------------------------------------- 1 | *~ 2 | *.swp 3 | *.o 4 | *.bin 5 | goodix_fp_dump 6 | -------------------------------------------------------------------------------- /spidev/spidev_test: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SQL-enwiki/goodix_fp_dump/master/spidev/spidev_test -------------------------------------------------------------------------------- /logs/goodix_enable_logs.reg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SQL-enwiki/goodix_fp_dump/master/logs/goodix_enable_logs.reg -------------------------------------------------------------------------------- /experiments/README.md: -------------------------------------------------------------------------------- 1 | Some experiments to explore data formats used By the Goodix fingerprint reader. 2 | 3 | Start extracting image data from a pcapng capture using the 4 | `extract_images_from_pcap.sh` script. 5 | -------------------------------------------------------------------------------- /logs/README.md: -------------------------------------------------------------------------------- 1 | It is possible to enable verbose logging in the Windows driver by setting some 2 | registry keys. 3 | 4 | See the `goodix_enable_logs.reg` file for an example. 5 | 6 | After merging the registry file from above and rebooting, new log files will be 7 | created in the hidden directory `C:\ProgramData\Goodix`: 8 | 9 | * ENGINE.log 10 | * WBDI.log (an example is provided) 11 | -------------------------------------------------------------------------------- /experiments/extract_images_from_pcap.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | set -e 4 | 5 | [ "x$1" = "x" ] && { echo "usage: $(basename "$0") " 1>&2; exit 1; } 6 | 7 | i=0 8 | 9 | tshark -r "$1" -Y 'frame.len > 1000' -T fields -e usb.capdata | \ 10 | while read -r line 11 | do 12 | suffix=$(printf "%04d" $i) 13 | hex_string=$(printf "%s" "$line" | sed -e 's/://g' -e 's/../\\x&/g') 14 | 15 | # shellcheck disable=SC2059 16 | printf "$hex_string" > "image_packet_$suffix.bin" 17 | 18 | ./decode_image_packet.py "image_packet_$suffix.bin" "$suffix" 19 | ./convert_to_pseudo_colors.py "unpacked_image_$suffix.bin" "$suffix" 20 | 21 | i=$((i + 1)) 22 | done 23 | -------------------------------------------------------------------------------- /contrib/55-goodix.rules: -------------------------------------------------------------------------------- 1 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="5201", MODE="0660", GROUP="plugdev" TAG+="uaccess" 2 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="5301", MODE="0660", GROUP="plugdev" TAG+="uaccess" 3 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="530c", MODE="0660", GROUP="plugdev" TAG+="uaccess" 4 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="5385", MODE="0660", GROUP="plugdev" TAG+="uaccess" 5 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="5395", MODE="0660", GROUP="plugdev" TAG+="uaccess" 6 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="5584", MODE="0660", GROUP="plugdev" TAG+="uaccess" 7 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="55b4", MODE="0660", GROUP="plugdev" TAG+="uaccess" 8 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="5740", MODE="0660", GROUP="plugdev" TAG+="uaccess" 9 | -------------------------------------------------------------------------------- /experiments/analyze_goodix.dat.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # 3 | # analyze_doodix.dat - parse the goodix.dat file created by the Windows driver 4 | # 5 | # Copyright 2019, Collabora Ltd 6 | # Author: Antonio Ospite 7 | # 8 | # SPDX-License-Identifier: LGPL-2.1-or-later 9 | 10 | import crcmod 11 | import struct 12 | import sys 13 | 14 | 15 | def main(): 16 | if len(sys.argv) < 2: 17 | sys.stderr.write("usage: %s \n" % sys.argv[0]) 18 | return 1 19 | 20 | fin = open(sys.argv[1], 'rb') 21 | buf = fin.read() 22 | fin.close() 23 | 24 | # CRC is on the last 4 bytes, in little-endian format 25 | data_crc = struct.unpack_from('= 4.6 35 | CFLAGS += -Wunused-but-set-variable 36 | endif 37 | 38 | CFLAGS += $(shell pkg-config --cflags libusb-1.0) 39 | LDLIBS += $(shell pkg-config --libs libusb-1.0) 40 | 41 | PREFIX ?= /usr/local 42 | bindir := $(PREFIX)/bin 43 | 44 | CFLAGS += -DTRACE 45 | 46 | all: goodix_fp_dump 47 | 48 | install_udev_rules: contrib/55-goodix.rules 49 | sudo -v 50 | install -d $(DESTDIR)/lib/udev/rules.d 51 | install -m 644 contrib/55-goodix.rules $(DESTDIR)/lib/udev/rules.d 52 | udevadm control --reload 53 | usbreset $(lsusb -d 27c6: | cut -d ' ' -f 6) 54 | 55 | install: goodix_fp_dump 56 | install -d $(DESTDIR)$(bindir) 57 | install -m 755 goodix_fp_dump $(DESTDIR)$(bindir) 58 | 59 | clean: 60 | rm -rf *~ *.o goodix_fp_dump 61 | 62 | test: goodix_fp_dump 63 | valgrind --leak-check=full --show-reachable=yes --track-origins=yes \ 64 | ./goodix_fp_dump 65 | -------------------------------------------------------------------------------- /experiments/convert_to_pseudo_colors.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # 3 | # pseudo_colors - convert a 16bpp little-endian grayscale image to pseudo colors 4 | # 5 | # Copyright 2019, Collabora Ltd 6 | # Author: Antonio Ospite 7 | # 8 | # SPDX-License-Identifier: LGPL-2.1-or-later 9 | 10 | import colorsys 11 | import struct 12 | import sys 13 | 14 | 15 | # Hardcode image size for now 16 | WIDTH = 108 17 | HEIGHT= 88 18 | 19 | # data has 12bpp precision scale hue values to that 20 | MAX_VALUE = (1 << 12) - 1 21 | 22 | 23 | def pseudo_color(value): 24 | hue = value / MAX_VALUE 25 | 26 | # scale hue to be between 0 and 120 27 | hue /= (360 / 120) 28 | rgb_color = colorsys.hsv_to_rgb(hue, 1, 1) 29 | 30 | r, g, b = (int(c * 255) for c in rgb_color) 31 | 32 | return r, g, b 33 | 34 | 35 | # data is an array of 16-bit elements 36 | # the output is an array of rgb values 37 | def convert_to_pseudo_colors(data): 38 | rgb_data = [] 39 | 40 | for value in data: 41 | r, g, b = pseudo_color(value) 42 | rgb_data.append(r) 43 | rgb_data.append(g) 44 | rgb_data.append(b) 45 | 46 | return rgb_data 47 | 48 | 49 | def save_pnm(rgb_data, filename): 50 | fout = open(filename, 'w+') 51 | fout.write('P3\n') 52 | fout.write("%d %d\n" % (WIDTH, HEIGHT)) 53 | fout.write("255\n") 54 | 55 | for c in rgb_data: 56 | fout.write("%d\n" % c) 57 | 58 | fout.close() 59 | 60 | 61 | def main(): 62 | if len(sys.argv) < 2: 63 | sys.stderr.write("usage: %s []\n" % sys.argv[0]) 64 | return 1 65 | 66 | try: 67 | suffix = "_" + sys.argv[2] 68 | except IndexError: 69 | suffix = "" 70 | 71 | fin = open(sys.argv[1], 'rb') 72 | buf = fin.read() 73 | fin.close() 74 | 75 | # work with unpacked 16bpp data 76 | #assert (len(buf) == WIDTH * HEIGHT * 2) 77 | 78 | # each data element is two bytes in little-endian order 79 | gray16_data_len = len(buf) // 2 80 | data_fmt = "<%dH" % gray16_data_len 81 | gray16_data = struct.unpack_from(data_fmt, buf) 82 | 83 | rgb_data = convert_to_pseudo_colors(gray16_data) 84 | 85 | save_pnm(rgb_data, "rgb_image%s.pnm" % suffix) 86 | 87 | fout = open("rgb_image%s.bin" % suffix, 'wb+') 88 | fout.write(bytearray(rgb_data)) 89 | fout.close() 90 | 91 | return 0 92 | 93 | 94 | if __name__ == "__main__": 95 | sys.exit(main()) 96 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | `goodix_fp_dump` is a simple test program for the Goodix HTK32 Fingerprint reader present in the 2 | Dell XPS13 9370. 3 | 4 | # Test setup 5 | 6 | In order to make the device accessible the user needs access to the USB device 7 | node (e.g. `/dev/bus/usb/001/004`); so either run the program with sudo, or add 8 | a udev rule. 9 | 10 | Assuming that the user is in the `plugdev` group, something like the following 11 | should work: 12 | 13 | ``` 14 | ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="5385", MODE="0660", GROUP="plugdev" TAG+="uaccess" 15 | ``` 16 | # Goodix USB Fingerprint scanner protocol 17 | 18 | The USB protocol seems to be quite simple at the packet level. 19 | 20 | The general format of a packet is: 21 | 22 | ``` 23 | struct { 24 | uint8_t type; 25 | uint16_t payload_size; /* little-endian */ 26 | uint8_t payload[]; /* conatains a checksum as last byte */ 27 | } goodif_fp_packet; 28 | ``` 29 | 30 | The communication takes place as follows: 31 | 32 | 1. The host sends a command packet with a type `ID` (an even number), and 33 | possibly some associated data and checksum. 34 | 35 | If the payload data and checksum do not fit in one 64 bytes packet then 36 | multiple packets are sent. Packets following the first one have the type 37 | equal to `ID + 1` to signal that they are **continuation** packets. 38 | 39 | Each output request is 64 bytes. 40 | 41 | 2. The device replies with a reply packet: `type: 0xb0, payload_size: 3` the 42 | payload contains the ID of the packet to which this is a reply and a status 43 | indicator, finally followed by a one-byte checksum. 44 | 45 | All input requests are 32768 bytes, but the number of actually transferred 46 | bytes depends on the packet type. 47 | 48 | 3. For some commands there is a response packet which starts with the ID of the 49 | command, followed by the payload size, and the payload data, and the 50 | checksum. 51 | 52 | If the payload data does not fit into 64 bytes, the data in the response 53 | packet would contain continuation packets. 54 | 55 | Note that the value of `payload_size` is the size of the useful data in 56 | response to a command plus one checksum byte, it does not include header 57 | fields and continuation bytes. 58 | 59 | Image data seems to be encrypted. 60 | 61 | ## Packet structure 62 | 63 | Packets are sent with bulk-out requests of 64 bytes on endpoint 0x03 of interface 1. 64 | 65 | Replies are read with bulk-in requests of 32768 bytes on endpoint 0x81 of interface 1. 66 | 67 | The [Kaitai struct](http://kaitai.io/) description of some single-packet 68 | commands follows: 69 | 70 | ``` 71 | meta: 72 | id: goodix_fp 73 | endian: le 74 | license: CC0-1.0 75 | seq: 76 | - id: header 77 | type: header 78 | types: 79 | header: 80 | seq: 81 | - id: type 82 | type: u1 83 | enum: packet_type 84 | - id: payload_size 85 | type: u2 86 | - id: payload 87 | size: payload_size - 1 88 | type: 89 | switch-on: type 90 | cases: 91 | 'packet_type::reply': payload_reply 92 | 'packet_type::firmware_version': payload_firmware_version 93 | - id: checksum 94 | type: u1 95 | payload_reply: 96 | seq: 97 | - id: reply_to 98 | type: u1 99 | enum: packet_type 100 | - id: status 101 | type: u1 102 | payload_firmware_version: 103 | seq: 104 | - id: firmware_version 105 | type: str 106 | encoding: ascii 107 | terminator: 0 108 | enums: 109 | packet_type: 110 | 0xb0: reply 111 | 0xa8: firmware_version 112 | ``` 113 | 114 | ## Packet types 115 | 116 | ### Packet 0xb0 117 | 118 | This is the generic reply, it is sent in response to every packet and precedes the actual response packet if there is any. 119 | 120 | ### Packet 0xa8 121 | 122 | This returns the firmware version. 123 | 124 | # Notes 125 | 126 | [Ghidra](https://ghidra-sre.org/) project files for Windows drivers, with some 127 | renamed functions and variables, are available here: 128 | https://people.collabora.com/~ao2/ghidra-projects-2019-04-17.tar.gz 129 | -------------------------------------------------------------------------------- /experiments/decode_image_packet.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # 3 | # decode_image_data - extract payload and unpack data from an image packet 4 | # 5 | # Copyright 2019, Collabora Ltd 6 | # Author: Antonio Ospite 7 | # 8 | # SPDX-License-Identifier: LGPL-2.1-or-later 9 | 10 | import struct 11 | import sys 12 | 13 | import crcmod 14 | 15 | 16 | # Hardcode image size for now 17 | WIDTH = 108 18 | HEIGHT = 88 19 | 20 | 21 | # The data passed is the raw image packet received from a Goodix fingerprint 22 | # reader, e.g. the Leftover Capture Data of a USB URB in a Wireshark capture. 23 | def extract_payload(data): 24 | assert len(data) >= 4 25 | assert data[0] == 0x20 26 | 27 | payload_size = struct.unpack_from(' 0 30 | 31 | payload = bytearray() 32 | 33 | # first chunk 34 | offset = 3 35 | remaining = payload_size - 1 # skip checksum byte 36 | 37 | # the first chunk can also be the last one 38 | if remaining < 64 - 3: 39 | payload += data[offset:offset + remaining] 40 | return payload 41 | 42 | # first of multiple chunks 43 | chunk_size = 64 - 3 44 | 45 | payload += data[offset:offset + chunk_size] 46 | offset += chunk_size + 1 # skip the next continuation byte 47 | remaining -= chunk_size 48 | 49 | # copy most of the data, skipping the continuation bytes 50 | chunk_size = 64 - 1 51 | while remaining >= chunk_size: 52 | payload += data[offset:offset + chunk_size] 53 | offset += chunk_size + 1 # skip the next continuation byte 54 | remaining -= chunk_size 55 | 56 | # copy the last chunk 57 | payload += data[offset:offset + remaining] 58 | 59 | return payload 60 | 61 | 62 | # data is 12-bit packed, unpack it to 16-bit elements 63 | def unpack_data_to_16bit(data): 64 | # 3 bytes are needed to represent 2 16-bit values 65 | assert (len(data) % 3) == 0 66 | 67 | mask = (1 << 12) - 1 68 | num_values = len(data) // (12 / 8) 69 | 70 | i = 0 71 | offset = 0 72 | unpacked_values = [] 73 | 74 | while i < num_values: 75 | tmp_buffer = (data[offset] << 16) | (data[offset + 1] << 8) | data[offset + 2] 76 | 77 | value1 = (tmp_buffer >> 12) & mask 78 | unpacked_values.append(value1) 79 | 80 | value2 = tmp_buffer & mask 81 | unpacked_values.append(value2) 82 | 83 | i += 2 84 | offset += 3 85 | 86 | return unpacked_values 87 | 88 | 89 | def save_as_16bit_le(unpacked_values, suffix=""): 90 | unpacked_data = [] 91 | 92 | for value in unpacked_values: 93 | upper = (value >> 8) & 0xff 94 | lower = value & 0xff 95 | # Write single bytes in little-endian order 96 | unpacked_data.append(lower) 97 | unpacked_data.append(upper) 98 | 99 | fout = open("unpacked_image%s.bin" % suffix, 'wb+') 100 | fout.write(bytearray(unpacked_data)) 101 | fout.close() 102 | 103 | 104 | def save_pgm(unpacked_values, suffix=""): 105 | fout = open('unpacked_image%s.pgm' % suffix, 'w+') 106 | fout.write('P2\n') 107 | fout.write("%d %d\n" % (WIDTH, HEIGHT)) 108 | 109 | # 16bpp data 110 | fout.write("4095\n") 111 | 112 | for value in unpacked_values: 113 | fout.write("%d\n" % value) 114 | 115 | fout.close() 116 | 117 | 118 | def main(): 119 | if len(sys.argv) < 2: 120 | sys.stderr.write("usage: %s []\n" % sys.argv[0]) 121 | return 1 122 | 123 | try: 124 | suffix = "_" + sys.argv[2] 125 | except IndexError: 126 | suffix = "" 127 | 128 | fin = open(sys.argv[1], 'rb') 129 | buf = fin.read() 130 | fin.close() 131 | 132 | payload = extract_payload(buf) 133 | 134 | fout = open("payload%s.bin" % suffix, 'wb+') 135 | fout.write(bytearray(payload)) 136 | fout.close() 137 | 138 | # According to the Windows driver the first 5 bytes are to be skipped 139 | # (probably some header), and the last 4 bytes too as they should be a crc. 140 | image_data = payload[5:-4] 141 | 142 | assert len(image_data) == WIDTH * HEIGHT * 3 / 2 143 | 144 | fout = open("image_data%s.bin" % suffix, 'wb+') 145 | fout.write(bytearray(image_data)) 146 | fout.close() 147 | 148 | # CRC is on the last 4 bytes, but it is in a mixed endian scheme. 149 | # Swap two big endian 16-bit values 150 | data_crc = \ 151 | struct.unpack_from('>H', payload[-2:])[0] << 16 | \ 152 | struct.unpack_from('>H', payload[-4:])[0] 153 | 154 | # The algorithm used is CRC-32/MPEG-2 155 | crc32_func = crcmod.predefined.mkCrcFun('crc-32-mpeg') 156 | calc_crc = crc32_func(image_data) 157 | 158 | #print(hex(data_crc)) 159 | #print(hex(calc_crc)) 160 | 161 | assert data_crc == calc_crc 162 | 163 | unpacked_values = unpack_data_to_16bit(image_data) 164 | 165 | assert len(unpacked_values) == WIDTH * HEIGHT 166 | 167 | save_pgm(unpacked_values, suffix) 168 | save_as_16bit_le(unpacked_values, suffix) 169 | 170 | return 0 171 | 172 | 173 | if __name__ == "__main__": 174 | sys.exit(main()) 175 | -------------------------------------------------------------------------------- /spidev/spidev_test.c: -------------------------------------------------------------------------------- 1 | // SPDX-License-Identifier: GPL-2.0-only 2 | /* 3 | * SPI testing utility (using spidev driver) 4 | * 5 | * Copyright (c) 2007 MontaVista Software, Inc. 6 | * Copyright (c) 2007 Anton Vorontsov 7 | * 8 | * Cross-compile with cross-gcc -I/path/to/cross-kernel/include 9 | */ 10 | 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #include 20 | #include 21 | #include 22 | #include 23 | #include 24 | 25 | #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0])) 26 | 27 | typedef union { 28 | uint8_t data[64]; 29 | struct __attribute__((packed)) { 30 | uint8_t type; 31 | uint16_t payload_size; 32 | uint8_t payload[61]; 33 | } fields; 34 | struct { 35 | uint8_t type; 36 | uint8_t payload[63]; 37 | } continuation; 38 | } goodix_fp_out_packet; 39 | 40 | typedef union { 41 | uint8_t data[32768]; 42 | struct __attribute__((packed)) { 43 | uint8_t type; 44 | uint16_t payload_size; 45 | uint8_t payload[32765]; 46 | } fields; 47 | struct __attribute__((packed)) { 48 | uint8_t type; 49 | uint16_t payload_size; 50 | uint8_t reply_to; 51 | uint8_t status; 52 | uint8_t checksum; 53 | } reply_packet; 54 | } goodix_fp_in_packet; 55 | 56 | typedef enum { 57 | GOODIX_FP_PACKET_TYPE_REPLY = 0xb0, 58 | GOODIX_FP_PACKET_TYPE_FIRMWARE_VERSION = 0xa8, 59 | GOODIX_FP_PACKET_TYPE_RESET = 0xa2, 60 | GOODIX_FP_PACKET_TYPE_OTP = 0xa6, 61 | GOODIX_FP_PACKET_TYPE_HANDSHAKE = 0xd2, 62 | GOODIX_FP_PACKET_TYPE_PSK = 0xe4, 63 | GOODIX_FP_PACKET_TYPE_CONFIG = 0x90, 64 | } goodix_fp_packet_type; 65 | 66 | static void pabort(const char *s) 67 | { 68 | perror(s); 69 | abort(); 70 | } 71 | 72 | static const char *device = "/dev/spidev0.0"; 73 | static uint32_t mode; 74 | static uint8_t bits = 8; 75 | static char *input_file; 76 | static char *output_file; 77 | static uint32_t speed = 10000000; 78 | static uint16_t delay; 79 | static int verbose; 80 | static int transfer_size; 81 | static int iterations; 82 | static int interval = 5; /* interval in seconds for showing transfer rate */ 83 | 84 | uint8_t default_tx[] = { 85 | 0xA8,0x03,0x00,0x00,0x00,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 86 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 87 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 88 | }; 89 | 90 | uint8_t default_rx[ARRAY_SIZE(default_tx)] = {0, }; 91 | char *input_tx; 92 | 93 | static void get_msg_a8_firmware_version(int fd); 94 | 95 | static uint8_t calc_checksum(uint8_t packet_type, uint8_t *payload, uint16_t payload_size) 96 | { 97 | unsigned int i; 98 | uint8_t sum; 99 | 100 | sum = packet_type; 101 | sum += (payload_size + 1) & 0xff; 102 | sum += (payload_size + 1) >> 8; 103 | for (i = 0; i < payload_size; i++) 104 | sum += payload[i]; 105 | 106 | return (uint8_t)(0xaa - sum); 107 | } 108 | 109 | static void hex_dump(const void *src, size_t length, size_t line_size, 110 | char *prefix) 111 | { 112 | int i = 0; 113 | const unsigned char *address = src; 114 | const unsigned char *line = address; 115 | unsigned char c; 116 | 117 | printf("%s | ", prefix); 118 | while (length-- > 0) { 119 | printf("%02X ", *address++); 120 | if (!(++i % line_size) || (length == 0 && i % line_size)) { 121 | if (length == 0) { 122 | while (i++ % line_size) 123 | printf("__ "); 124 | } 125 | printf(" |"); 126 | while (line < address) { 127 | c = *line++; 128 | printf("%c", (c < 32 || c > 126) ? '.' : c); 129 | } 130 | printf("|\n"); 131 | if (length > 0) 132 | printf("%s | ", prefix); 133 | } 134 | } 135 | } 136 | 137 | /* 138 | * Unescape - process hexadecimal escape character 139 | * converts shell input "\x23" -> 0x23 140 | */ 141 | static int unescape(char *_dst, char *_src, size_t len) 142 | { 143 | int ret = 0; 144 | int match; 145 | char *src = _src; 146 | char *dst = _dst; 147 | unsigned int ch; 148 | 149 | while (*src) { 150 | if (*src == '\\' && *(src+1) == 'x') { 151 | match = sscanf(src + 2, "%2x", &ch); 152 | if (!match) 153 | pabort("malformed input string"); 154 | 155 | src += 4; 156 | *dst++ = (unsigned char)ch; 157 | } else { 158 | *dst++ = *src++; 159 | } 160 | ret++; 161 | } 162 | return ret; 163 | } 164 | 165 | static void transfer(int fd, uint8_t const *tx, uint8_t const *rx, size_t len) 166 | { 167 | int ret; 168 | int out_fd; 169 | struct spi_ioc_transfer tr = { 170 | .len = len, 171 | .delay_usecs = delay, 172 | .speed_hz = speed, 173 | .bits_per_word = bits, 174 | }; 175 | 176 | if (tx) 177 | tr.tx_buf = (unsigned long)tx; 178 | 179 | if (rx) 180 | tr.rx_buf = (unsigned long)rx; 181 | 182 | if (mode & SPI_TX_QUAD) 183 | tr.tx_nbits = 4; 184 | else if (mode & SPI_TX_DUAL) 185 | tr.tx_nbits = 2; 186 | if (mode & SPI_RX_QUAD) 187 | tr.rx_nbits = 4; 188 | else if (mode & SPI_RX_DUAL) 189 | tr.rx_nbits = 2; 190 | if (!(mode & SPI_LOOP)) { 191 | if (mode & (SPI_TX_QUAD | SPI_TX_DUAL)) 192 | tr.rx_buf = 0; 193 | else if (mode & (SPI_RX_QUAD | SPI_RX_DUAL)) 194 | tr.tx_buf = 0; 195 | } 196 | 197 | ret = ioctl(fd, SPI_IOC_MESSAGE(1), &tr); 198 | if (ret < 1) 199 | pabort("can't send spi message"); 200 | 201 | if (verbose && tx) 202 | hex_dump(tx, len, 32, "TX"); 203 | 204 | if (output_file) { 205 | out_fd = open(output_file, O_WRONLY | O_CREAT | O_TRUNC, 0666); 206 | if (out_fd < 0) 207 | pabort("could not open output file"); 208 | 209 | ret = write(out_fd, rx, len); 210 | if (ret != len) 211 | pabort("not all bytes written to output file"); 212 | 213 | close(out_fd); 214 | } 215 | 216 | if (verbose && rx) 217 | hex_dump(rx, len, 32, "RX"); 218 | } 219 | 220 | static void print_usage(const char *prog) 221 | { 222 | printf("Usage: %s [-DsbdlHOLC3vpNR24SI]\n", prog); 223 | puts(" -D --device device to use (default /dev/spidev1.1)\n" 224 | " -s --speed max speed (Hz)\n" 225 | " -d --delay delay (usec)\n" 226 | " -b --bpw bits per word\n" 227 | " -i --input input data from a file (e.g. \"test.bin\")\n" 228 | " -o --output output data to a file (e.g. \"results.bin\")\n" 229 | " -l --loop loopback\n" 230 | " -H --cpha clock phase\n" 231 | " -O --cpol clock polarity\n" 232 | " -L --lsb least significant bit first\n" 233 | " -C --cs-high chip select active high\n" 234 | " -3 --3wire SI/SO signals shared\n" 235 | " -v --verbose Verbose (show tx buffer)\n" 236 | " -p Send data (e.g. \"1234\\xde\\xad\")\n" 237 | " -N --no-cs no chip select\n" 238 | " -R --ready slave pulls low to pause\n" 239 | " -2 --dual dual transfer\n" 240 | " -4 --quad quad transfer\n" 241 | " -S --size transfer size\n" 242 | " -I --iter iterations\n"); 243 | exit(1); 244 | } 245 | 246 | static void parse_opts(int argc, char *argv[]) 247 | { 248 | while (1) { 249 | static const struct option lopts[] = { 250 | { "device", 1, 0, 'D' }, 251 | { "speed", 1, 0, 's' }, 252 | { "delay", 1, 0, 'd' }, 253 | { "bpw", 1, 0, 'b' }, 254 | { "input", 1, 0, 'i' }, 255 | { "output", 1, 0, 'o' }, 256 | { "loop", 0, 0, 'l' }, 257 | { "cpha", 0, 0, 'H' }, 258 | { "cpol", 0, 0, 'O' }, 259 | { "lsb", 0, 0, 'L' }, 260 | { "cs-high", 0, 0, 'C' }, 261 | { "3wire", 0, 0, '3' }, 262 | { "no-cs", 0, 0, 'N' }, 263 | { "ready", 0, 0, 'R' }, 264 | { "dual", 0, 0, '2' }, 265 | { "verbose", 0, 0, 'v' }, 266 | { "quad", 0, 0, '4' }, 267 | { "size", 1, 0, 'S' }, 268 | { "iter", 1, 0, 'I' }, 269 | { NULL, 0, 0, 0 }, 270 | }; 271 | int c; 272 | 273 | c = getopt_long(argc, argv, "D:s:d:b:i:o:lHOLC3NR24p:vS:I:", 274 | lopts, NULL); 275 | 276 | if (c == -1) 277 | break; 278 | 279 | switch (c) { 280 | case 'D': 281 | device = optarg; 282 | break; 283 | case 's': 284 | speed = atoi(optarg); 285 | break; 286 | case 'd': 287 | delay = atoi(optarg); 288 | break; 289 | case 'b': 290 | bits = atoi(optarg); 291 | break; 292 | case 'i': 293 | input_file = optarg; 294 | break; 295 | case 'o': 296 | output_file = optarg; 297 | break; 298 | case 'l': 299 | mode |= SPI_LOOP; 300 | break; 301 | case 'H': 302 | mode |= SPI_CPHA; 303 | break; 304 | case 'O': 305 | mode |= SPI_CPOL; 306 | break; 307 | case 'L': 308 | mode |= SPI_LSB_FIRST; 309 | break; 310 | case 'C': 311 | mode |= SPI_CS_HIGH; 312 | break; 313 | case '3': 314 | mode |= SPI_3WIRE; 315 | break; 316 | case 'N': 317 | mode |= SPI_NO_CS; 318 | break; 319 | case 'v': 320 | verbose = 1; 321 | break; 322 | case 'R': 323 | mode |= SPI_READY; 324 | break; 325 | case 'p': 326 | input_tx = optarg; 327 | break; 328 | case '2': 329 | mode |= SPI_TX_DUAL; 330 | break; 331 | case '4': 332 | mode |= SPI_TX_QUAD; 333 | break; 334 | case 'S': 335 | transfer_size = atoi(optarg); 336 | break; 337 | case 'I': 338 | iterations = atoi(optarg); 339 | break; 340 | default: 341 | print_usage(argv[0]); 342 | break; 343 | } 344 | } 345 | if (mode & SPI_LOOP) { 346 | if (mode & SPI_TX_DUAL) 347 | mode |= SPI_RX_DUAL; 348 | if (mode & SPI_TX_QUAD) 349 | mode |= SPI_RX_QUAD; 350 | } 351 | } 352 | 353 | static void transfer_escaped_string(int fd, char *str) 354 | { 355 | size_t size = strlen(str); 356 | uint8_t *tx; 357 | uint8_t *rx; 358 | 359 | tx = malloc(size); 360 | if (!tx) 361 | pabort("can't allocate tx buffer"); 362 | 363 | rx = malloc(size); 364 | if (!rx) 365 | pabort("can't allocate rx buffer"); 366 | 367 | size = unescape((char *)tx, str, size); 368 | transfer(fd, tx, rx, size); 369 | free(rx); 370 | free(tx); 371 | } 372 | 373 | static void transfer_file(int fd, char *filename) 374 | { 375 | ssize_t bytes; 376 | struct stat sb; 377 | int tx_fd; 378 | uint8_t *tx; 379 | uint8_t *rx; 380 | 381 | if (stat(filename, &sb) == -1) 382 | pabort("can't stat input file"); 383 | 384 | tx_fd = open(filename, O_RDONLY); 385 | if (tx_fd < 0) 386 | pabort("can't open input file"); 387 | 388 | tx = malloc(sb.st_size); 389 | if (!tx) 390 | pabort("can't allocate tx buffer"); 391 | 392 | rx = malloc(sb.st_size); 393 | if (!rx) 394 | pabort("can't allocate rx buffer"); 395 | 396 | bytes = read(tx_fd, tx, sb.st_size); 397 | if (bytes != sb.st_size) 398 | pabort("failed to read input file"); 399 | 400 | transfer(fd, tx, rx, sb.st_size); 401 | free(rx); 402 | free(tx); 403 | close(tx_fd); 404 | } 405 | 406 | static uint64_t _read_count; 407 | static uint64_t _write_count; 408 | 409 | static void show_transfer_rate(void) 410 | { 411 | static uint64_t prev_read_count, prev_write_count; 412 | double rx_rate, tx_rate; 413 | 414 | rx_rate = ((_read_count - prev_read_count) * 8) / (interval*1000.0); 415 | tx_rate = ((_write_count - prev_write_count) * 8) / (interval*1000.0); 416 | 417 | printf("rate: tx %.1fkbps, rx %.1fkbps\n", rx_rate, tx_rate); 418 | 419 | prev_read_count = _read_count; 420 | prev_write_count = _write_count; 421 | } 422 | 423 | static void transfer_buf(int fd, int len) 424 | { 425 | uint8_t *tx; 426 | uint8_t *rx; 427 | int i; 428 | 429 | tx = malloc(len); 430 | if (!tx) 431 | pabort("can't allocate tx buffer"); 432 | for (i = 0; i < len; i++) 433 | tx[i] = random(); 434 | 435 | rx = malloc(len); 436 | if (!rx) 437 | pabort("can't allocate rx buffer"); 438 | 439 | transfer(fd, tx, rx, len); 440 | 441 | _write_count += len; 442 | _read_count += len; 443 | 444 | if (mode & SPI_LOOP) { 445 | if (memcmp(tx, rx, len)) { 446 | fprintf(stderr, "transfer error !\n"); 447 | hex_dump(tx, len, 32, "TX"); 448 | hex_dump(rx, len, 32, "RX"); 449 | exit(1); 450 | } 451 | } 452 | 453 | free(rx); 454 | free(tx); 455 | } 456 | 457 | static void init_device(int fd) { 458 | goodix_fp_out_packet packet = { 459 | .fields = { 460 | .type = 0, 461 | .payload_size = 2 + 1, 462 | .payload = { 0 } 463 | } 464 | }; 465 | goodix_fp_in_packet reply = { 466 | .data = { 0 } 467 | }; 468 | packet.fields.payload[2] = calc_checksum(0, packet.fields.payload, 2); 469 | 470 | transfer(fd, packet.data, NULL, sizeof(packet.data)); 471 | transfer(fd, NULL, reply.data, sizeof(reply.data)); 472 | } 473 | 474 | static void get_msg_a8_firmware_version(int fd) { 475 | goodix_fp_out_packet packet = { 476 | .fields = { 477 | .type = GOODIX_FP_PACKET_TYPE_FIRMWARE_VERSION, 478 | .payload_size = 2 + 1, 479 | .payload = { 0 } 480 | } 481 | }; 482 | goodix_fp_in_packet reply = { 483 | .data = { 0 } 484 | }; 485 | packet.fields.payload[2] = calc_checksum(GOODIX_FP_PACKET_TYPE_FIRMWARE_VERSION, packet.fields.payload, 2); 486 | 487 | transfer(fd, packet.data, NULL, sizeof(packet.data)); 488 | transfer(fd, NULL, reply.data, sizeof(reply.data)); 489 | } 490 | 491 | int main(int argc, char *argv[]) 492 | { 493 | int ret = 0; 494 | int fd; 495 | 496 | parse_opts(argc, argv); 497 | 498 | fd = open(device, O_RDWR); 499 | if (fd < 0) 500 | pabort("can't open device"); 501 | 502 | /* 503 | * spi mode 504 | */ 505 | ret = ioctl(fd, SPI_IOC_WR_MODE32, &mode); 506 | if (ret == -1) 507 | pabort("can't set spi mode"); 508 | 509 | ret = ioctl(fd, SPI_IOC_RD_MODE32, &mode); 510 | if (ret == -1) 511 | pabort("can't get spi mode"); 512 | 513 | /* 514 | * bits per word 515 | */ 516 | ret = ioctl(fd, SPI_IOC_WR_BITS_PER_WORD, &bits); 517 | if (ret == -1) 518 | pabort("can't set bits per word"); 519 | 520 | ret = ioctl(fd, SPI_IOC_RD_BITS_PER_WORD, &bits); 521 | if (ret == -1) 522 | pabort("can't get bits per word"); 523 | 524 | /* 525 | * max speed hz 526 | */ 527 | ret = ioctl(fd, SPI_IOC_WR_MAX_SPEED_HZ, &speed); 528 | if (ret == -1) 529 | pabort("can't set max speed hz"); 530 | 531 | ret = ioctl(fd, SPI_IOC_RD_MAX_SPEED_HZ, &speed); 532 | if (ret == -1) 533 | pabort("can't get max speed hz"); 534 | 535 | printf("spi mode: 0x%x\n", mode); 536 | printf("bits per word: %d\n", bits); 537 | printf("max speed: %d Hz (%d KHz)\n", speed, speed/1000); 538 | 539 | if (input_tx && input_file) 540 | pabort("only one of -p and --input may be selected"); 541 | 542 | if (input_tx) 543 | transfer_escaped_string(fd, input_tx); 544 | else if (input_file) 545 | transfer_file(fd, input_file); 546 | else if (transfer_size) { 547 | struct timespec last_stat; 548 | 549 | clock_gettime(CLOCK_MONOTONIC, &last_stat); 550 | 551 | while (iterations-- > 0) { 552 | struct timespec current; 553 | 554 | transfer_buf(fd, transfer_size); 555 | 556 | clock_gettime(CLOCK_MONOTONIC, ¤t); 557 | if (current.tv_sec - last_stat.tv_sec > interval) { 558 | show_transfer_rate(); 559 | last_stat = current; 560 | } 561 | } 562 | printf("total: tx %.1fKB, rx %.1fKB\n", 563 | _write_count/1024.0, _read_count/1024.0); 564 | } else { 565 | init_device(fd); 566 | // firmware version 567 | get_msg_a8_firmware_version(fd); 568 | } 569 | 570 | close(fd); 571 | 572 | return ret; 573 | } 574 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU LESSER GENERAL PUBLIC LICENSE 2 | Version 2.1, February 1999 3 | 4 | Copyright (C) 1991, 1999 Free Software Foundation, Inc. 5 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 6 | Everyone is permitted to copy and distribute verbatim copies 7 | of this license document, but changing it is not allowed. 8 | 9 | (This is the first released version of the Lesser GPL. It also counts 10 | as the successor of the GNU Library Public License, version 2, hence 11 | the version number 2.1.) 12 | 13 | Preamble 14 | 15 | The licenses for most software are designed to take away your 16 | freedom to share and change it. By contrast, the GNU General Public 17 | Licenses are intended to guarantee your freedom to share and change 18 | free software--to make sure the software is free for all its users. 19 | 20 | This license, the Lesser General Public License, applies to some 21 | specially designated software packages--typically libraries--of the 22 | Free Software Foundation and other authors who decide to use it. You 23 | can use it too, but we suggest you first think carefully about whether 24 | this license or the ordinary General Public License is the better 25 | strategy to use in any particular case, based on the explanations below. 26 | 27 | When we speak of free software, we are referring to freedom of use, 28 | not price. Our General Public Licenses are designed to make sure that 29 | you have the freedom to distribute copies of free software (and charge 30 | for this service if you wish); that you receive source code or can get 31 | it if you want it; that you can change the software and use pieces of 32 | it in new free programs; and that you are informed that you can do 33 | these things. 34 | 35 | To protect your rights, we need to make restrictions that forbid 36 | distributors to deny you these rights or to ask you to surrender these 37 | rights. These restrictions translate to certain responsibilities for 38 | you if you distribute copies of the library or if you modify it. 39 | 40 | For example, if you distribute copies of the library, whether gratis 41 | or for a fee, you must give the recipients all the rights that we gave 42 | you. You must make sure that they, too, receive or can get the source 43 | code. If you link other code with the library, you must provide 44 | complete object files to the recipients, so that they can relink them 45 | with the library after making changes to the library and recompiling 46 | it. And you must show them these terms so they know their rights. 47 | 48 | We protect your rights with a two-step method: (1) we copyright the 49 | library, and (2) we offer you this license, which gives you legal 50 | permission to copy, distribute and/or modify the library. 51 | 52 | To protect each distributor, we want to make it very clear that 53 | there is no warranty for the free library. Also, if the library is 54 | modified by someone else and passed on, the recipients should know 55 | that what they have is not the original version, so that the original 56 | author's reputation will not be affected by problems that might be 57 | introduced by others. 58 | 59 | Finally, software patents pose a constant threat to the existence of 60 | any free program. We wish to make sure that a company cannot 61 | effectively restrict the users of a free program by obtaining a 62 | restrictive license from a patent holder. Therefore, we insist that 63 | any patent license obtained for a version of the library must be 64 | consistent with the full freedom of use specified in this license. 65 | 66 | Most GNU software, including some libraries, is covered by the 67 | ordinary GNU General Public License. This license, the GNU Lesser 68 | General Public License, applies to certain designated libraries, and 69 | is quite different from the ordinary General Public License. We use 70 | this license for certain libraries in order to permit linking those 71 | libraries into non-free programs. 72 | 73 | When a program is linked with a library, whether statically or using 74 | a shared library, the combination of the two is legally speaking a 75 | combined work, a derivative of the original library. The ordinary 76 | General Public License therefore permits such linking only if the 77 | entire combination fits its criteria of freedom. The Lesser General 78 | Public License permits more lax criteria for linking other code with 79 | the library. 80 | 81 | We call this license the "Lesser" General Public License because it 82 | does Less to protect the user's freedom than the ordinary General 83 | Public License. It also provides other free software developers Less 84 | of an advantage over competing non-free programs. These disadvantages 85 | are the reason we use the ordinary General Public License for many 86 | libraries. However, the Lesser license provides advantages in certain 87 | special circumstances. 88 | 89 | For example, on rare occasions, there may be a special need to 90 | encourage the widest possible use of a certain library, so that it becomes 91 | a de-facto standard. To achieve this, non-free programs must be 92 | allowed to use the library. A more frequent case is that a free 93 | library does the same job as widely used non-free libraries. In this 94 | case, there is little to gain by limiting the free library to free 95 | software only, so we use the Lesser General Public License. 96 | 97 | In other cases, permission to use a particular library in non-free 98 | programs enables a greater number of people to use a large body of 99 | free software. For example, permission to use the GNU C Library in 100 | non-free programs enables many more people to use the whole GNU 101 | operating system, as well as its variant, the GNU/Linux operating 102 | system. 103 | 104 | Although the Lesser General Public License is Less protective of the 105 | users' freedom, it does ensure that the user of a program that is 106 | linked with the Library has the freedom and the wherewithal to run 107 | that program using a modified version of the Library. 108 | 109 | The precise terms and conditions for copying, distribution and 110 | modification follow. Pay close attention to the difference between a 111 | "work based on the library" and a "work that uses the library". The 112 | former contains code derived from the library, whereas the latter must 113 | be combined with the library in order to run. 114 | 115 | GNU LESSER GENERAL PUBLIC LICENSE 116 | TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 117 | 118 | 0. This License Agreement applies to any software library or other 119 | program which contains a notice placed by the copyright holder or 120 | other authorized party saying it may be distributed under the terms of 121 | this Lesser General Public License (also called "this License"). 122 | Each licensee is addressed as "you". 123 | 124 | A "library" means a collection of software functions and/or data 125 | prepared so as to be conveniently linked with application programs 126 | (which use some of those functions and data) to form executables. 127 | 128 | The "Library", below, refers to any such software library or work 129 | which has been distributed under these terms. A "work based on the 130 | Library" means either the Library or any derivative work under 131 | copyright law: that is to say, a work containing the Library or a 132 | portion of it, either verbatim or with modifications and/or translated 133 | straightforwardly into another language. (Hereinafter, translation is 134 | included without limitation in the term "modification".) 135 | 136 | "Source code" for a work means the preferred form of the work for 137 | making modifications to it. For a library, complete source code means 138 | all the source code for all modules it contains, plus any associated 139 | interface definition files, plus the scripts used to control compilation 140 | and installation of the library. 141 | 142 | Activities other than copying, distribution and modification are not 143 | covered by this License; they are outside its scope. The act of 144 | running a program using the Library is not restricted, and output from 145 | such a program is covered only if its contents constitute a work based 146 | on the Library (independent of the use of the Library in a tool for 147 | writing it). Whether that is true depends on what the Library does 148 | and what the program that uses the Library does. 149 | 150 | 1. You may copy and distribute verbatim copies of the Library's 151 | complete source code as you receive it, in any medium, provided that 152 | you conspicuously and appropriately publish on each copy an 153 | appropriate copyright notice and disclaimer of warranty; keep intact 154 | all the notices that refer to this License and to the absence of any 155 | warranty; and distribute a copy of this License along with the 156 | Library. 157 | 158 | You may charge a fee for the physical act of transferring a copy, 159 | and you may at your option offer warranty protection in exchange for a 160 | fee. 161 | 162 | 2. You may modify your copy or copies of the Library or any portion 163 | of it, thus forming a work based on the Library, and copy and 164 | distribute such modifications or work under the terms of Section 1 165 | above, provided that you also meet all of these conditions: 166 | 167 | a) The modified work must itself be a software library. 168 | 169 | b) You must cause the files modified to carry prominent notices 170 | stating that you changed the files and the date of any change. 171 | 172 | c) You must cause the whole of the work to be licensed at no 173 | charge to all third parties under the terms of this License. 174 | 175 | d) If a facility in the modified Library refers to a function or a 176 | table of data to be supplied by an application program that uses 177 | the facility, other than as an argument passed when the facility 178 | is invoked, then you must make a good faith effort to ensure that, 179 | in the event an application does not supply such function or 180 | table, the facility still operates, and performs whatever part of 181 | its purpose remains meaningful. 182 | 183 | (For example, a function in a library to compute square roots has 184 | a purpose that is entirely well-defined independent of the 185 | application. Therefore, Subsection 2d requires that any 186 | application-supplied function or table used by this function must 187 | be optional: if the application does not supply it, the square 188 | root function must still compute square roots.) 189 | 190 | These requirements apply to the modified work as a whole. If 191 | identifiable sections of that work are not derived from the Library, 192 | and can be reasonably considered independent and separate works in 193 | themselves, then this License, and its terms, do not apply to those 194 | sections when you distribute them as separate works. But when you 195 | distribute the same sections as part of a whole which is a work based 196 | on the Library, the distribution of the whole must be on the terms of 197 | this License, whose permissions for other licensees extend to the 198 | entire whole, and thus to each and every part regardless of who wrote 199 | it. 200 | 201 | Thus, it is not the intent of this section to claim rights or contest 202 | your rights to work written entirely by you; rather, the intent is to 203 | exercise the right to control the distribution of derivative or 204 | collective works based on the Library. 205 | 206 | In addition, mere aggregation of another work not based on the Library 207 | with the Library (or with a work based on the Library) on a volume of 208 | a storage or distribution medium does not bring the other work under 209 | the scope of this License. 210 | 211 | 3. You may opt to apply the terms of the ordinary GNU General Public 212 | License instead of this License to a given copy of the Library. To do 213 | this, you must alter all the notices that refer to this License, so 214 | that they refer to the ordinary GNU General Public License, version 2, 215 | instead of to this License. (If a newer version than version 2 of the 216 | ordinary GNU General Public License has appeared, then you can specify 217 | that version instead if you wish.) Do not make any other change in 218 | these notices. 219 | 220 | Once this change is made in a given copy, it is irreversible for 221 | that copy, so the ordinary GNU General Public License applies to all 222 | subsequent copies and derivative works made from that copy. 223 | 224 | This option is useful when you wish to copy part of the code of 225 | the Library into a program that is not a library. 226 | 227 | 4. You may copy and distribute the Library (or a portion or 228 | derivative of it, under Section 2) in object code or executable form 229 | under the terms of Sections 1 and 2 above provided that you accompany 230 | it with the complete corresponding machine-readable source code, which 231 | must be distributed under the terms of Sections 1 and 2 above on a 232 | medium customarily used for software interchange. 233 | 234 | If distribution of object code is made by offering access to copy 235 | from a designated place, then offering equivalent access to copy the 236 | source code from the same place satisfies the requirement to 237 | distribute the source code, even though third parties are not 238 | compelled to copy the source along with the object code. 239 | 240 | 5. A program that contains no derivative of any portion of the 241 | Library, but is designed to work with the Library by being compiled or 242 | linked with it, is called a "work that uses the Library". Such a 243 | work, in isolation, is not a derivative work of the Library, and 244 | therefore falls outside the scope of this License. 245 | 246 | However, linking a "work that uses the Library" with the Library 247 | creates an executable that is a derivative of the Library (because it 248 | contains portions of the Library), rather than a "work that uses the 249 | library". The executable is therefore covered by this License. 250 | Section 6 states terms for distribution of such executables. 251 | 252 | When a "work that uses the Library" uses material from a header file 253 | that is part of the Library, the object code for the work may be a 254 | derivative work of the Library even though the source code is not. 255 | Whether this is true is especially significant if the work can be 256 | linked without the Library, or if the work is itself a library. The 257 | threshold for this to be true is not precisely defined by law. 258 | 259 | If such an object file uses only numerical parameters, data 260 | structure layouts and accessors, and small macros and small inline 261 | functions (ten lines or less in length), then the use of the object 262 | file is unrestricted, regardless of whether it is legally a derivative 263 | work. (Executables containing this object code plus portions of the 264 | Library will still fall under Section 6.) 265 | 266 | Otherwise, if the work is a derivative of the Library, you may 267 | distribute the object code for the work under the terms of Section 6. 268 | Any executables containing that work also fall under Section 6, 269 | whether or not they are linked directly with the Library itself. 270 | 271 | 6. As an exception to the Sections above, you may also combine or 272 | link a "work that uses the Library" with the Library to produce a 273 | work containing portions of the Library, and distribute that work 274 | under terms of your choice, provided that the terms permit 275 | modification of the work for the customer's own use and reverse 276 | engineering for debugging such modifications. 277 | 278 | You must give prominent notice with each copy of the work that the 279 | Library is used in it and that the Library and its use are covered by 280 | this License. You must supply a copy of this License. If the work 281 | during execution displays copyright notices, you must include the 282 | copyright notice for the Library among them, as well as a reference 283 | directing the user to the copy of this License. Also, you must do one 284 | of these things: 285 | 286 | a) Accompany the work with the complete corresponding 287 | machine-readable source code for the Library including whatever 288 | changes were used in the work (which must be distributed under 289 | Sections 1 and 2 above); and, if the work is an executable linked 290 | with the Library, with the complete machine-readable "work that 291 | uses the Library", as object code and/or source code, so that the 292 | user can modify the Library and then relink to produce a modified 293 | executable containing the modified Library. (It is understood 294 | that the user who changes the contents of definitions files in the 295 | Library will not necessarily be able to recompile the application 296 | to use the modified definitions.) 297 | 298 | b) Use a suitable shared library mechanism for linking with the 299 | Library. A suitable mechanism is one that (1) uses at run time a 300 | copy of the library already present on the user's computer system, 301 | rather than copying library functions into the executable, and (2) 302 | will operate properly with a modified version of the library, if 303 | the user installs one, as long as the modified version is 304 | interface-compatible with the version that the work was made with. 305 | 306 | c) Accompany the work with a written offer, valid for at 307 | least three years, to give the same user the materials 308 | specified in Subsection 6a, above, for a charge no more 309 | than the cost of performing this distribution. 310 | 311 | d) If distribution of the work is made by offering access to copy 312 | from a designated place, offer equivalent access to copy the above 313 | specified materials from the same place. 314 | 315 | e) Verify that the user has already received a copy of these 316 | materials or that you have already sent this user a copy. 317 | 318 | For an executable, the required form of the "work that uses the 319 | Library" must include any data and utility programs needed for 320 | reproducing the executable from it. However, as a special exception, 321 | the materials to be distributed need not include anything that is 322 | normally distributed (in either source or binary form) with the major 323 | components (compiler, kernel, and so on) of the operating system on 324 | which the executable runs, unless that component itself accompanies 325 | the executable. 326 | 327 | It may happen that this requirement contradicts the license 328 | restrictions of other proprietary libraries that do not normally 329 | accompany the operating system. Such a contradiction means you cannot 330 | use both them and the Library together in an executable that you 331 | distribute. 332 | 333 | 7. You may place library facilities that are a work based on the 334 | Library side-by-side in a single library together with other library 335 | facilities not covered by this License, and distribute such a combined 336 | library, provided that the separate distribution of the work based on 337 | the Library and of the other library facilities is otherwise 338 | permitted, and provided that you do these two things: 339 | 340 | a) Accompany the combined library with a copy of the same work 341 | based on the Library, uncombined with any other library 342 | facilities. This must be distributed under the terms of the 343 | Sections above. 344 | 345 | b) Give prominent notice with the combined library of the fact 346 | that part of it is a work based on the Library, and explaining 347 | where to find the accompanying uncombined form of the same work. 348 | 349 | 8. You may not copy, modify, sublicense, link with, or distribute 350 | the Library except as expressly provided under this License. Any 351 | attempt otherwise to copy, modify, sublicense, link with, or 352 | distribute the Library is void, and will automatically terminate your 353 | rights under this License. However, parties who have received copies, 354 | or rights, from you under this License will not have their licenses 355 | terminated so long as such parties remain in full compliance. 356 | 357 | 9. You are not required to accept this License, since you have not 358 | signed it. However, nothing else grants you permission to modify or 359 | distribute the Library or its derivative works. These actions are 360 | prohibited by law if you do not accept this License. Therefore, by 361 | modifying or distributing the Library (or any work based on the 362 | Library), you indicate your acceptance of this License to do so, and 363 | all its terms and conditions for copying, distributing or modifying 364 | the Library or works based on it. 365 | 366 | 10. Each time you redistribute the Library (or any work based on the 367 | Library), the recipient automatically receives a license from the 368 | original licensor to copy, distribute, link with or modify the Library 369 | subject to these terms and conditions. You may not impose any further 370 | restrictions on the recipients' exercise of the rights granted herein. 371 | You are not responsible for enforcing compliance by third parties with 372 | this License. 373 | 374 | 11. If, as a consequence of a court judgment or allegation of patent 375 | infringement or for any other reason (not limited to patent issues), 376 | conditions are imposed on you (whether by court order, agreement or 377 | otherwise) that contradict the conditions of this License, they do not 378 | excuse you from the conditions of this License. If you cannot 379 | distribute so as to satisfy simultaneously your obligations under this 380 | License and any other pertinent obligations, then as a consequence you 381 | may not distribute the Library at all. For example, if a patent 382 | license would not permit royalty-free redistribution of the Library by 383 | all those who receive copies directly or indirectly through you, then 384 | the only way you could satisfy both it and this License would be to 385 | refrain entirely from distribution of the Library. 386 | 387 | If any portion of this section is held invalid or unenforceable under any 388 | particular circumstance, the balance of the section is intended to apply, 389 | and the section as a whole is intended to apply in other circumstances. 390 | 391 | It is not the purpose of this section to induce you to infringe any 392 | patents or other property right claims or to contest validity of any 393 | such claims; this section has the sole purpose of protecting the 394 | integrity of the free software distribution system which is 395 | implemented by public license practices. Many people have made 396 | generous contributions to the wide range of software distributed 397 | through that system in reliance on consistent application of that 398 | system; it is up to the author/donor to decide if he or she is willing 399 | to distribute software through any other system and a licensee cannot 400 | impose that choice. 401 | 402 | This section is intended to make thoroughly clear what is believed to 403 | be a consequence of the rest of this License. 404 | 405 | 12. If the distribution and/or use of the Library is restricted in 406 | certain countries either by patents or by copyrighted interfaces, the 407 | original copyright holder who places the Library under this License may add 408 | an explicit geographical distribution limitation excluding those countries, 409 | so that distribution is permitted only in or among countries not thus 410 | excluded. In such case, this License incorporates the limitation as if 411 | written in the body of this License. 412 | 413 | 13. The Free Software Foundation may publish revised and/or new 414 | versions of the Lesser General Public License from time to time. 415 | Such new versions will be similar in spirit to the present version, 416 | but may differ in detail to address new problems or concerns. 417 | 418 | Each version is given a distinguishing version number. If the Library 419 | specifies a version number of this License which applies to it and 420 | "any later version", you have the option of following the terms and 421 | conditions either of that version or of any later version published by 422 | the Free Software Foundation. If the Library does not specify a 423 | license version number, you may choose any version ever published by 424 | the Free Software Foundation. 425 | 426 | 14. If you wish to incorporate parts of the Library into other free 427 | programs whose distribution conditions are incompatible with these, 428 | write to the author to ask for permission. For software which is 429 | copyrighted by the Free Software Foundation, write to the Free 430 | Software Foundation; we sometimes make exceptions for this. Our 431 | decision will be guided by the two goals of preserving the free status 432 | of all derivatives of our free software and of promoting the sharing 433 | and reuse of software generally. 434 | 435 | NO WARRANTY 436 | 437 | 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO 438 | WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. 439 | EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR 440 | OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY 441 | KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE 442 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 443 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE 444 | LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME 445 | THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 446 | 447 | 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN 448 | WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY 449 | AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU 450 | FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR 451 | CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE 452 | LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING 453 | RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A 454 | FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF 455 | SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH 456 | DAMAGES. 457 | 458 | END OF TERMS AND CONDITIONS 459 | 460 | How to Apply These Terms to Your New Libraries 461 | 462 | If you develop a new library, and you want it to be of the greatest 463 | possible use to the public, we recommend making it free software that 464 | everyone can redistribute and change. You can do so by permitting 465 | redistribution under these terms (or, alternatively, under the terms of the 466 | ordinary General Public License). 467 | 468 | To apply these terms, attach the following notices to the library. It is 469 | safest to attach them to the start of each source file to most effectively 470 | convey the exclusion of warranty; and each file should have at least the 471 | "copyright" line and a pointer to where the full notice is found. 472 | 473 | Goodix fingerprint dump 474 | Copyright (C) 2019 Antonio Ospite 475 | 476 | This library is free software; you can redistribute it and/or 477 | modify it under the terms of the GNU Lesser General Public 478 | License as published by the Free Software Foundation; either 479 | version 2.1 of the License, or (at your option) any later version. 480 | 481 | This library is distributed in the hope that it will be useful, 482 | but WITHOUT ANY WARRANTY; without even the implied warranty of 483 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 484 | Lesser General Public License for more details. 485 | 486 | You should have received a copy of the GNU Lesser General Public 487 | License along with this library; if not, write to the Free Software 488 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 489 | USA 490 | 491 | Also add information on how to contact you by electronic and paper mail. 492 | 493 | You should also get your employer (if you work as a programmer) or your 494 | school, if any, to sign a "copyright disclaimer" for the library, if 495 | necessary. Here is a sample; alter the names: 496 | 497 | Yoyodyne, Inc., hereby disclaims all copyright interest in the 498 | library `Frob' (a library for tweaking knobs) written by James Random 499 | Hacker. 500 | 501 | {signature of Ty Coon}, 1 April 1990 502 | Ty Coon, President of Vice 503 | 504 | That's all there is to it! 505 | -------------------------------------------------------------------------------- /goodix_fp_dump.c: -------------------------------------------------------------------------------- 1 | /* 2 | * goodix_fp_dump - dump data from the Goodix HTK32 fingerprint reader 3 | * 4 | * Copyright 2019, Collabora Ltd 5 | * Author: Antonio Ospite 6 | * 7 | * SPDX-License-Identifier: LGPL-2.1-or-later 8 | */ 9 | 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) 18 | 19 | #define debug(...) fprintf(stderr, __VA_ARGS__) 20 | #define error(...) fprintf(stderr, __VA_ARGS__) 21 | #define warning(...) fprintf(stderr, __VA_ARGS__) 22 | 23 | struct goodix_fp_usb_device_descriptor { 24 | uint16_t vendor_id; 25 | uint16_t product_id; 26 | uint8_t configuration; 27 | uint8_t output_endpoint; 28 | uint8_t input_endpoint; 29 | 30 | }; 31 | 32 | static const struct goodix_fp_usb_device_descriptor supported_devices[] = { 33 | { 34 | /* found on ASUS ZenBook S UX391FA AH001T */ 35 | .vendor_id = 0x27c6, 36 | .product_id = 0x5201, 37 | .configuration = 1, 38 | .output_endpoint = 0x03, 39 | .input_endpoint = 0x81, 40 | }, 41 | { 42 | /* found on Dell XPS 13 9370/9380 */ 43 | .vendor_id = 0x27c6, 44 | .product_id = 0x5385, 45 | .configuration = 1, 46 | .output_endpoint = 0x03, 47 | .input_endpoint = 0x81, 48 | }, 49 | { 50 | /* found on Dell XPS 13 9570 */ 51 | .vendor_id = 0x27c6, 52 | .product_id = 0x5395, 53 | .configuration = 1, 54 | .output_endpoint = 0x03, 55 | .input_endpoint = 0x81, 56 | }, 57 | { 58 | /* found on Teclast F6 Pro */ 59 | .vendor_id = 0x27c6, 60 | .product_id = 0x5740, 61 | .configuration = 1, 62 | .output_endpoint = 0x03, 63 | .input_endpoint = 0x81, 64 | }, 65 | { 66 | /* found on Lenovo Yoga 730 13IWL-81JR */ 67 | .vendor_id = 0x27c6, 68 | .product_id = 0x5584, 69 | .configuration = 1, 70 | .output_endpoint = 0x01, 71 | .input_endpoint = 0x82, 72 | }, 73 | { 74 | /* found on Lenovo Flex 81SS */ 75 | .vendor_id = 0x27c6, 76 | .product_id = 0x55b4, 77 | .configuration = 1, 78 | .output_endpoint = 0x01, 79 | .input_endpoint = 0x82, 80 | }, 81 | { 82 | /* found on Dell G3 3579, Dell G3 3779, and Dell Inspiron 7577 */ 83 | .vendor_id = 0x27c6, 84 | .product_id = 0x5301, 85 | .configuration = 1, 86 | .output_endpoint = 0x03, 87 | .input_endpoint = 0x81, 88 | }, 89 | { 90 | /* found on Dell G5 (2019) */ 91 | .vendor_id = 0x27c6, 92 | .product_id = 0x530c, 93 | .configuration = 1, 94 | .output_endpoint = 0x01, 95 | .input_endpoint = 0x83, 96 | }, 97 | { 98 | /* found on Asus Zephyrus G14 */ 99 | .vendor_id = 0x27c6, 100 | .product_id = 0x521d, 101 | .configuration = 1, 102 | .output_endpoint = 0x01, 103 | .input_endpoint = 0x83, 104 | }, 105 | }; 106 | 107 | struct _goodix_fp_device { 108 | libusb_device_handle *usb_device; 109 | const struct goodix_fp_usb_device_descriptor *desc; 110 | }; 111 | 112 | typedef struct _goodix_fp_device goodix_fp_device; 113 | 114 | /* 115 | * The device expects numeric values as little-endian. 116 | * 117 | * XXX Proper endianness conversion is needed if the code is run on big-endian systems. 118 | */ 119 | typedef union { 120 | uint8_t data[64]; 121 | struct __attribute__((packed)) { 122 | uint8_t type; 123 | uint16_t payload_size; 124 | uint8_t payload[61]; 125 | } fields; 126 | struct { 127 | uint8_t type; 128 | uint8_t payload[63]; 129 | } continuation; 130 | } goodix_fp_out_packet; 131 | 132 | typedef union { 133 | uint8_t data[32768]; 134 | struct __attribute__((packed)) { 135 | uint8_t type; 136 | uint16_t payload_size; 137 | uint8_t payload[32765]; 138 | } fields; 139 | struct __attribute__((packed)) { 140 | uint8_t type; 141 | uint16_t payload_size; 142 | uint8_t reply_to; 143 | uint8_t status; 144 | uint8_t checksum; 145 | } reply_packet; 146 | } goodix_fp_in_packet; 147 | 148 | typedef enum { 149 | GOODIX_FP_PACKET_TYPE_REPLY = 0xb0, 150 | GOODIX_FP_PACKET_TYPE_FIRMWARE_VERSION = 0xa8, 151 | GOODIX_FP_PACKET_TYPE_RESET = 0xa2, 152 | GOODIX_FP_PACKET_TYPE_CHIP_REG_READ = 0x82, 153 | GOODIX_FP_PACKET_TYPE_OTP = 0xa6, 154 | GOODIX_FP_PACKET_TYPE_HANDSHAKE = 0xd2, 155 | GOODIX_FP_PACKET_TYPE_PSK = 0xe4, 156 | GOODIX_FP_PACKET_TYPE_CONFIG = 0x90, 157 | } goodix_fp_packet_type; 158 | 159 | static void debug_dump_buffer(const char *message, uint8_t *buffer, int len) 160 | { 161 | int i; 162 | 163 | if (buffer == NULL || len <= 0) { 164 | debug("Invalid or empty buffer\n"); 165 | return; 166 | } 167 | 168 | debug("\n"); 169 | if (message) 170 | debug("%s\n", message); 171 | 172 | for (i = 0; i < len; i++) { 173 | debug("%02hhX%c", buffer[i], (((i + 1) % 16) && (i < len - 1)) ? ' ' : '\n'); 174 | } 175 | debug("\n"); 176 | } 177 | 178 | static void debug_dump_buffer_to_file(const char *filename, uint8_t *buffer, int len) 179 | { 180 | FILE *fp; 181 | 182 | if (buffer == NULL || len <= 0) 183 | return; 184 | 185 | fp = fopen(filename, "wb"); 186 | if (fp == NULL) { 187 | perror(filename); 188 | return; 189 | } 190 | 191 | fwrite(buffer, 1, len, fp); 192 | fclose(fp); 193 | } 194 | 195 | #ifdef TRACE 196 | #define trace debug 197 | #define trace_dump_buffer debug_dump_buffer 198 | 199 | static void trace_out_packet(goodix_fp_out_packet *packet) 200 | { 201 | trace("\n"); 202 | trace("out packet\n"); 203 | trace("type: 0x%02hhx %d\n", packet->fields.type, packet->fields.type); 204 | if (packet->fields.type % 2) 205 | trace("continuation packet\n"); 206 | else 207 | trace("size: 0x%02hx %d\n", packet->fields.payload_size, packet->fields.payload_size); 208 | } 209 | 210 | static void trace_in_packet(goodix_fp_in_packet *packet) 211 | { 212 | trace("in packet\n"); 213 | trace("type: 0x%02hhx %d\n", packet->fields.type, packet->fields.type); 214 | trace("size: 0x%02hx %d\n", packet->fields.payload_size, packet->fields.payload_size); 215 | trace("\n"); 216 | } 217 | #else 218 | #define trace(...) do {} while(0) 219 | static void trace_dump_buffer(const char *message, uint8_t *buffer, int len) 220 | { 221 | (void) message; 222 | (void) buffer; 223 | (void) len; 224 | } 225 | 226 | static void trace_out_packet(goodix_fp_out_packet *packet) 227 | { 228 | (void) packet; 229 | } 230 | static void trace_in_packet(goodix_fp_in_packet *packet) 231 | { 232 | (void) packet; 233 | } 234 | #endif 235 | 236 | static int usb_send_data(libusb_device_handle *dev, uint8_t out_ep, 237 | uint8_t *buffer, int len) 238 | { 239 | int ret; 240 | int transferred; 241 | 242 | trace_dump_buffer("sending -->", buffer, len); 243 | 244 | transferred = 0; 245 | ret = libusb_bulk_transfer(dev, out_ep, buffer, len, &transferred, 0); 246 | if (ret != 0 || transferred != len) { 247 | error("%s. Transferred: %d (expected %u)\n", 248 | libusb_error_name(ret), transferred, len); 249 | return ret; 250 | } 251 | 252 | return 0; 253 | } 254 | 255 | static int usb_read_data(libusb_device_handle *dev, uint8_t in_ep, 256 | uint8_t *buffer, int len) 257 | { 258 | int ret; 259 | int transferred; 260 | 261 | transferred = 0; 262 | ret = libusb_bulk_transfer(dev, in_ep, buffer, len, &transferred, 0); 263 | if (ret != 0) { 264 | error("%s. Transferred: %d (expected %u)\n", 265 | libusb_error_name(ret), transferred, len); 266 | return ret; 267 | } 268 | 269 | trace_dump_buffer("<-- received", buffer, transferred); 270 | 271 | return transferred; 272 | } 273 | 274 | static int usb_claim_interfaces(libusb_device_handle *dev, int configuration) 275 | { 276 | libusb_device *usb_device; 277 | struct libusb_config_descriptor *config_desc; 278 | int num_interfaces; 279 | int ret; 280 | int i; 281 | 282 | usb_device = libusb_get_device(dev); 283 | if (usb_device == NULL) 284 | return -ENODEV; 285 | 286 | ret = libusb_get_config_descriptor_by_value(usb_device, configuration, &config_desc); 287 | if (ret < 0) 288 | goto out; 289 | 290 | num_interfaces = config_desc->bNumInterfaces; 291 | libusb_free_config_descriptor(config_desc); 292 | 293 | for (i = 0; i < num_interfaces; i++) { 294 | ret = libusb_claim_interface(dev, i); 295 | if (ret < 0) { 296 | fprintf(stderr, "libusb_claim_interface failed: %s\n", 297 | libusb_error_name(ret)); 298 | fprintf(stderr, "Cannot claim interface %d\n", i); 299 | goto release_claimed_interfaces; 300 | } 301 | } 302 | 303 | return 0; 304 | 305 | release_claimed_interfaces: 306 | while (--i >= 0) { 307 | int release_ret = libusb_release_interface(dev, i); 308 | if (release_ret < 0) { 309 | fprintf(stderr, "libusb_release_interface failed: %s\n", 310 | libusb_error_name(release_ret)); 311 | fprintf(stderr, "Warning: could not release interface: %d\n", i); 312 | /* move on and try releasing the remaining interfaces */ 313 | } 314 | } 315 | 316 | out: 317 | return ret; 318 | } 319 | 320 | static int usb_release_interfaces(libusb_device_handle *dev, int configuration) 321 | { 322 | libusb_device *usb_device; 323 | struct libusb_config_descriptor *config_desc; 324 | int ret; 325 | int i; 326 | 327 | usb_device = libusb_get_device(dev); 328 | if (usb_device == NULL) 329 | return -ENODEV; 330 | 331 | ret = libusb_get_config_descriptor_by_value(usb_device, configuration, &config_desc); 332 | if (ret < 0) 333 | goto out; 334 | 335 | for (i = 0; i < config_desc->bNumInterfaces; i++) { 336 | ret = libusb_release_interface(dev, i); 337 | if (ret < 0) { 338 | fprintf(stderr, "libusb_release_interface failed: %s\n", 339 | libusb_error_name(ret)); 340 | fprintf(stderr, "Warning: could not release interface: %d\n", i); 341 | /* move on and try releasing the remaining interfaces */ 342 | } 343 | } 344 | 345 | libusb_free_config_descriptor(config_desc); 346 | out: 347 | return ret; 348 | } 349 | 350 | /* 351 | * Long payloads have some bytes on the 64 bytes boundary of the packet which 352 | * have to be skipped when copying data. 353 | */ 354 | static int extract_payload(goodix_fp_in_packet packet, uint8_t *response, uint8_t *checksum) 355 | { 356 | uint8_t *src; 357 | uint8_t *dst; 358 | int chunk_size; 359 | int remaining; 360 | unsigned int continuation_packets; 361 | 362 | if (packet.fields.payload_size == 0) { 363 | error("Invalid payload size, it cannot be 0\n"); 364 | return -1; 365 | } 366 | 367 | /* first chunk */ 368 | continuation_packets = 0; 369 | src = packet.fields.payload; 370 | dst = response; 371 | remaining = packet.fields.payload_size - 1; /* skip checksum byte */ 372 | 373 | /* the first chunk can also be the last one */ 374 | if (remaining < 64 - 3) 375 | goto last_chunk; 376 | 377 | /* first of multiple chunks */ 378 | chunk_size = 64 - 3; 379 | memcpy(dst, src, chunk_size); 380 | src += chunk_size + 1; /* skip the next continuation byte */ 381 | dst += chunk_size; 382 | remaining -= chunk_size; 383 | 384 | /* copy most of the data, skipping the continuation bytes */ 385 | chunk_size = 64 - 1; 386 | while (remaining >= chunk_size) { 387 | continuation_packets++; 388 | memcpy(dst, src, chunk_size); 389 | src += chunk_size + 1; /* skip the next continuation byte */ 390 | dst += chunk_size; 391 | remaining -= chunk_size; 392 | } 393 | 394 | /* copy the last chunk */ 395 | continuation_packets++; 396 | last_chunk: 397 | memcpy(dst, src, remaining); 398 | 399 | *checksum = packet.fields.payload[packet.fields.payload_size - 1 + continuation_packets]; 400 | return 0; 401 | } 402 | 403 | static uint8_t calc_checksum(uint8_t packet_type, uint8_t *payload, uint16_t payload_size) 404 | { 405 | unsigned int i; 406 | uint8_t sum; 407 | 408 | sum = packet_type; 409 | sum += (payload_size + 1) & 0xff; 410 | sum += (payload_size + 1) >> 8; 411 | for (i = 0; i < payload_size; i++) 412 | sum += payload[i]; 413 | 414 | return (uint8_t)(0xaa - sum); 415 | } 416 | 417 | static int send_payload(goodix_fp_device *dev, 418 | goodix_fp_packet_type packet_type, 419 | uint8_t *request, uint16_t request_size) 420 | { 421 | int ret; 422 | uint8_t *src; 423 | uint8_t *dst; 424 | int remaining; 425 | int chunk_size; 426 | uint8_t checksum; 427 | goodix_fp_out_packet packet = { 428 | .data = { 0 } 429 | }; 430 | 431 | checksum = calc_checksum(packet_type, request, request_size); 432 | 433 | /* first packet */ 434 | packet.fields.type = packet_type; 435 | packet.fields.payload_size = request_size + 1; /* extra checkum byte */ 436 | 437 | src = request; 438 | dst = packet.fields.payload; 439 | remaining = request_size; 440 | 441 | /* the first packet can also be the last one */ 442 | if (remaining < 64 - 3) { 443 | packet.fields.payload[remaining] = checksum; 444 | goto send_last_packet; 445 | } 446 | 447 | /* first of multiple packets */ 448 | chunk_size = 64 - 3; 449 | memcpy(dst, src, chunk_size); 450 | 451 | trace_out_packet(&packet); 452 | ret = usb_send_data(dev->usb_device, dev->desc->output_endpoint, 453 | packet.data, sizeof(packet.data)); 454 | if (ret < 0) 455 | goto out; 456 | 457 | remaining -= chunk_size; 458 | src += chunk_size; 459 | 460 | /* continuation packets */ 461 | packet.continuation.type = packet_type + 1; 462 | 463 | dst = packet.continuation.payload; 464 | chunk_size = 64 - 1; 465 | while (remaining >= chunk_size) { 466 | memcpy(dst, src, chunk_size); 467 | 468 | trace_out_packet(&packet); 469 | ret = usb_send_data(dev->usb_device, dev->desc->output_endpoint, 470 | packet.data, sizeof(packet.data)); 471 | if (ret < 0) 472 | goto out; 473 | 474 | src += chunk_size; 475 | remaining -= chunk_size; 476 | } 477 | 478 | /* last continuation packet */ 479 | packet.continuation.payload[remaining] = checksum; 480 | 481 | send_last_packet: 482 | memcpy(dst, src, remaining); 483 | 484 | trace_out_packet(&packet); 485 | ret = usb_send_data(dev->usb_device, dev->desc->output_endpoint, 486 | packet.data, sizeof(packet.data)); 487 | if (ret < 0) 488 | goto out; 489 | 490 | out: 491 | return ret; 492 | } 493 | 494 | static int send_packet_full(goodix_fp_device *dev, 495 | goodix_fp_packet_type packet_type, 496 | uint8_t *request, uint16_t request_size, 497 | uint8_t *response, uint16_t *response_size, 498 | bool verify_data_checksum) 499 | { 500 | goodix_fp_out_packet packet = { 501 | .fields = { 502 | .type = packet_type, 503 | /* the extra byte is for the checkum */ 504 | .payload_size = request_size + 1, 505 | .payload = { 0 } 506 | } 507 | }; 508 | goodix_fp_in_packet reply = { 509 | .data = { 0 } 510 | }; 511 | int ret; 512 | uint8_t response_checksum; 513 | uint8_t expected_checksum; 514 | 515 | ret = send_payload(dev, packet_type, request, request_size); 516 | if (ret < 0) 517 | goto out; 518 | 519 | ret = usb_read_data(dev->usb_device, dev->desc->input_endpoint, 520 | reply.data, sizeof(reply.data)); 521 | if (ret < 0) 522 | goto out; 523 | 524 | trace_in_packet(&reply); 525 | 526 | if (reply.fields.type != GOODIX_FP_PACKET_TYPE_REPLY) { 527 | error("Invalid reply to packet %02x\n", packet.fields.type); 528 | ret = -1; 529 | goto out; 530 | } 531 | 532 | response_checksum = reply.fields.payload[reply.fields.payload_size - 1]; 533 | expected_checksum = calc_checksum(reply.fields.type, 534 | reply.fields.payload, 535 | reply.fields.payload_size - 1); 536 | 537 | if (response_checksum != expected_checksum) { 538 | error("Invalid checksum for reply packet %02x\n", packet.fields.type); 539 | ret = -1; 540 | goto out; 541 | } 542 | 543 | if (reply.reply_packet.reply_to != packet.fields.type) { 544 | error("Unexpected reply to packet %02x (got %02x)\n", packet.fields.type, reply.reply_packet.reply_to); 545 | ret = -1; 546 | goto out; 547 | } 548 | 549 | if (reply.reply_packet.status != 0x1) 550 | warning("Unexpected status for packet %02x (expected 0x01, got 0x%02x)\n", packet.fields.type, reply.reply_packet.status); 551 | 552 | if (response) { 553 | ret = usb_read_data(dev->usb_device, dev->desc->input_endpoint, 554 | reply.data, sizeof(reply.data)); 555 | if (ret < 0) 556 | goto out; 557 | 558 | trace_in_packet(&reply); 559 | 560 | if (reply.fields.type != packet_type) { 561 | error("Invalid input packet %02x (got: %02x)\n", packet_type, reply.fields.type); 562 | ret = -1; 563 | goto out; 564 | } 565 | 566 | /* extract the payload, it may contain continuation bytes */ 567 | ret = extract_payload(reply, response, &response_checksum); 568 | if (ret < 0) 569 | goto out; 570 | 571 | if (verify_data_checksum) { 572 | expected_checksum = calc_checksum(reply.fields.type, 573 | response, 574 | reply.fields.payload_size - 1); 575 | } else { 576 | expected_checksum = 0x88; 577 | } 578 | 579 | if (response_checksum != expected_checksum) { 580 | error("Invalid checksum for input packet %02x\n", reply.fields.type); 581 | ret = -1; 582 | goto out; 583 | } 584 | 585 | *response_size = reply.fields.payload_size - 1; 586 | } 587 | 588 | ret = 0; 589 | 590 | out: 591 | return ret; 592 | 593 | } 594 | 595 | /* Usually packets do not need to change the verify_data_checksum parameter. */ 596 | static int send_packet(goodix_fp_device *dev, 597 | goodix_fp_packet_type packet_type, 598 | uint8_t *request, uint16_t request_size, 599 | uint8_t *response, uint16_t *response_size) 600 | { 601 | return send_packet_full(dev, packet_type, request, request_size, response, response_size, true); 602 | } 603 | 604 | /* Simple packets are those without a particular request buffer. */ 605 | static int send_packet_simple(goodix_fp_device *dev, 606 | goodix_fp_packet_type packet_type, 607 | uint8_t *response, uint16_t *response_size) 608 | { 609 | uint8_t payload[2] = { 0 }; 610 | 611 | return send_packet(dev, packet_type, payload, sizeof(payload), response, response_size); 612 | } 613 | 614 | static int get_msg_00_change_mode_start(goodix_fp_device *dev) 615 | { 616 | uint8_t payload[2] = { 0 }; 617 | 618 | return send_packet(dev, 0x00, payload, sizeof(payload), NULL, NULL); 619 | } 620 | 621 | static int get_msg_a8_firmware_version(goodix_fp_device *dev) 622 | { 623 | int ret; 624 | char firmware_version[64] = ""; 625 | uint16_t string_len; 626 | 627 | ret = send_packet_simple(dev, GOODIX_FP_PACKET_TYPE_FIRMWARE_VERSION, 628 | (uint8_t *)firmware_version, &string_len); 629 | if (ret < 0) 630 | goto out; 631 | 632 | printf("Firmware version: %s\n", firmware_version); 633 | out: 634 | return ret; 635 | } 636 | 637 | static int get_msg_a2_reset(goodix_fp_device *dev) 638 | { 639 | int ret; 640 | uint8_t payload[2] = { 0x05, 0x14 }; 641 | uint8_t response[32768] = { 0 }; 642 | uint16_t response_size = 0; 643 | 644 | ret = send_packet(dev, GOODIX_FP_PACKET_TYPE_RESET, 645 | payload, sizeof(payload), 646 | response, &response_size); 647 | if (ret < 0) 648 | goto out; 649 | 650 | debug_dump_buffer("0xa2 response: ", response, response_size); 651 | 652 | out: 653 | return ret; 654 | 655 | } 656 | 657 | static void swap_each_2_bytes(uint8_t *buffer, uint16_t len) 658 | { 659 | unsigned int i; 660 | uint8_t tmp; 661 | 662 | if (len < 2) 663 | return; 664 | 665 | for (i = 0; i < len; i += 2) { 666 | tmp = buffer[i]; 667 | buffer[i] = buffer[i + 1]; 668 | buffer[i + 1] = tmp; 669 | } 670 | } 671 | 672 | static int get_msg_82_chip_reg_read(goodix_fp_device *dev, uint16_t reg_start, uint16_t reg_size, uint8_t *response, uint16_t *response_size) 673 | { 674 | int ret; 675 | uint8_t chip_reg_read_payload[4] = { 0 }; 676 | 677 | /* The first two bytes are the register start position as big-endian. */ 678 | chip_reg_read_payload[0] = (reg_start >> 8) & 0xff; 679 | chip_reg_read_payload[1] = reg_start & 0xff; 680 | 681 | /* The remaining two bytes are the result size as big-endian. */ 682 | chip_reg_read_payload[2] = (reg_size >> 8) & 0xff; 683 | chip_reg_read_payload[3] = reg_size & 0xff; 684 | 685 | debug_dump_buffer("0x82 payload: ", chip_reg_read_payload, sizeof(chip_reg_read_payload)); 686 | 687 | ret = send_packet(dev, GOODIX_FP_PACKET_TYPE_CHIP_REG_READ, chip_reg_read_payload, sizeof(chip_reg_read_payload), response, response_size); 688 | if (ret < 0) 689 | goto out; 690 | 691 | if (reg_size != *response_size) { 692 | ret = -EINVAL; 693 | error("Unexpected response size (expected: %d, got: %d)", reg_size, *response_size); 694 | goto out; 695 | } 696 | 697 | debug_dump_buffer("0x82 response: ", response, *response_size); 698 | 699 | /* 700 | * Swap each 2 bytes because the response seems to be in some 701 | * mixed-endian order. 702 | */ 703 | swap_each_2_bytes(response, *response_size); 704 | 705 | out: 706 | return ret; 707 | } 708 | 709 | static int get_msg_82_chip_reg_read_chip_id(goodix_fp_device *dev, uint32_t *chip_id) 710 | { 711 | int ret; 712 | uint8_t response[32768] = { 0 }; 713 | uint16_t response_size = 0; 714 | 715 | ret = get_msg_82_chip_reg_read(dev, 0, 4, response, &response_size); 716 | if (ret < 0) 717 | goto out; 718 | 719 | /* After swapping every 2 bytes, values are now in little-endian order */ 720 | /* XXX Proper endianness conversion is needed if the code is run on big-endian systems. */ 721 | *chip_id = 0; 722 | *chip_id |= response[0]; 723 | *chip_id |= response[1] << 8; 724 | *chip_id |= response[2] << 16; 725 | *chip_id |= response[3] << 24; 726 | 727 | /* Discard the least significant byte to get the chip_id */ 728 | *chip_id >>= 8; 729 | 730 | debug("ChipId: 0x%04x\n\n", *chip_id); 731 | 732 | out: 733 | return ret; 734 | } 735 | 736 | static int get_msg_a6_otp(goodix_fp_device *dev) 737 | { 738 | int ret; 739 | uint8_t otp[32]; 740 | uint16_t otp_size; 741 | 742 | ret = send_packet_simple(dev, GOODIX_FP_PACKET_TYPE_OTP, 743 | otp, &otp_size); 744 | if (ret < 0) 745 | goto out; 746 | debug_dump_buffer("OTP:", otp, otp_size); 747 | debug_dump_buffer_to_file("payload_otp.bin", otp, otp_size); 748 | out: 749 | return ret; 750 | } 751 | 752 | static int get_msg_e4_psk(goodix_fp_device *dev) 753 | { 754 | int ret; 755 | uint8_t request_psk[4] = "\x01\xb0\x00\x00"; 756 | uint8_t request_hash[4] = "\x03\xb0\x00\x00"; 757 | uint8_t psk[601] = { 0 }; 758 | uint16_t psk_size; 759 | uint8_t hash[41] = { 0 }; 760 | uint16_t hash_size; 761 | 762 | ret = send_packet(dev, GOODIX_FP_PACKET_TYPE_PSK, 763 | request_psk, sizeof(request_psk), 764 | psk, &psk_size); 765 | if (ret < 0) 766 | goto out; 767 | 768 | /* 769 | * The PSK response contains one leading byte representing an error 770 | * code, followed by Type-Length-Value data. 771 | * 772 | * The TLV structure is as follows. 773 | * 774 | * The Type field is uint32_t (little-endian): 775 | * - 0x0000b001 means PSK 776 | * - 0x0000b003 means HASH 777 | * 778 | * The Length field is uint32_t (little-endian): 779 | * - 0x00000250 for the PSK 780 | * - 0x00000020 for the HASH 781 | * 782 | * Then the data follows: 783 | * - for the PSK this is a sgx_sealed_data_t 784 | * https://software.intel.com/en-us/sgx-sdk-dev-reference-sgx-sealed-data-t 785 | * - for the HASH it should be 32 bytes representing a sha256 hash 786 | * of something from the PSK, after unsealing the data 787 | */ 788 | debug_dump_buffer("PSK:", psk, psk_size); 789 | debug_dump_buffer_to_file("payload_psk.bin", psk, psk_size); 790 | 791 | ret = send_packet(dev, GOODIX_FP_PACKET_TYPE_PSK, 792 | request_hash, sizeof(request_hash), 793 | hash, &hash_size); 794 | if (ret < 0) 795 | goto out; 796 | 797 | debug_dump_buffer("HASH:", hash, hash_size); 798 | debug_dump_buffer_to_file("payload_hash.bin", hash, hash_size); 799 | 800 | out: 801 | return ret; 802 | } 803 | 804 | /* some negotiation happens with packet d2 */ 805 | static int get_msg_d2_handshake(goodix_fp_device *dev) 806 | { 807 | int ret; 808 | unsigned int i; 809 | uint8_t client_hello[8 + 32] = "\x01\xff\x00\x00\x28\x00\x00\x00"; 810 | uint8_t server_identity[8 + 64] = { 0 } ; 811 | uint16_t server_identity_size = 0; 812 | uint8_t client_reply[8 + 32 + 4] = "\x03\xff\x00\x00\x2c\x00\x00\x00"; 813 | uint8_t server_done[8 + 4] = { 0 }; 814 | uint16_t server_done_size = 0; 815 | 816 | /* Use a constant secret for now */ 817 | for (i = 0; i < 32; i++) 818 | client_hello[i + 8] = 0; 819 | 820 | debug_dump_buffer_to_file("client_random.bin", client_hello + 8, 32); 821 | 822 | ret = send_packet(dev, 823 | GOODIX_FP_PACKET_TYPE_HANDSHAKE, 824 | client_hello, sizeof(client_hello), 825 | server_identity, &server_identity_size); 826 | if (ret < 0) 827 | goto out; 828 | 829 | debug_dump_buffer_to_file("server_random1.bin", server_identity + 8, 32); 830 | debug_dump_buffer_to_file("server_random2.bin", server_identity + 8 + 32, 32); 831 | 832 | debug_dump_buffer("server_identity:", server_identity, server_identity_size); 833 | 834 | /* Client reply is not constant, it depends on the server identity. */ 835 | 836 | /* copy the server key into the reply packet */ 837 | memcpy(client_reply + 8, server_identity + 8 + 32, 32); 838 | 839 | /* add some constant bytes */ 840 | memcpy(client_reply + 8 + 32, "\xee\xee\xee\xee", 4); 841 | 842 | ret = send_packet(dev, 843 | GOODIX_FP_PACKET_TYPE_HANDSHAKE, 844 | client_reply, sizeof(client_reply), 845 | server_done, &server_done_size); 846 | if (ret < 0) 847 | goto out; 848 | 849 | debug_dump_buffer("server_done:", server_done, server_done_size); 850 | 851 | /* If we pass this point negotiation succeeded */ 852 | trace("Hurrah!\n"); 853 | 854 | out: 855 | return ret; 856 | } 857 | 858 | static int get_msg_90_config(goodix_fp_device *dev, uint16_t chip_id) 859 | { 860 | int ret; 861 | uint8_t config_2202[256] = "\x08\x11\x54\x65\x24\x89\x24\xad\x1c\xc9\x1c\xe5\x04\xe9\x04\xed" \ 862 | "\x13\xba\x00\x01\x00\xca\x00\x07\x00\x84\x00\x80\x81\x86\x00\x80" \ 863 | "\x8c\x88\x00\x80\x97\x8a\x00\x80\xb0\x8c\x00\x80\x86\x8e\x00\x80" \ 864 | "\x8c\x90\x00\x80\xa0\x92\x00\x80\xb3\x94\x00\x80\x84\x96\x00\x80" \ 865 | "\x88\x98\x00\x80\xa0\x9a\x00\x80\xb8\x56\x00\x08\x28\x58\x00\x48" \ 866 | "\x00\x70\x00\x01\x00\x72\x00\x78\x56\x74\x00\x34\x12\x26\x00\x00" \ 867 | "\x12\xd0\x00\x00\x00\x20\x01\x02\x04\x20\x00\x10\x40\x22\x00\x01" \ 868 | "\x20\x24\x00\x32\x00\x80\x00\x01\x04\x5c\x00\x80\x00\x28\x02\x00" \ 869 | "\x00\x2a\x02\x00\x00\x82\x00\x80\x15\x20\x01\x82\x04\x20\x00\x10" \ 870 | "\x40\x22\x00\x01\x20\x24\x00\x14\x00\x80\x00\x01\x04\x5c\x00\x00" \ 871 | "\x01\x28\x02\x00\x00\x2a\x02\x00\x00\x82\x00\x80\x1a\x20\x01\x08" \ 872 | "\x04\x22\x00\x10\x08\x80\x00\x01\x00\x5c\x00\x80\x00\x28\x02\x00" \ 873 | "\x00\x2a\x02\x00\x00\x82\x00\x80\x15\x20\x01\x08\x04\x5c\x00\xf0" \ 874 | "\x00\x50\x00\x01\x05\x52\x00\x08\x00\x54\x00\x10\x01\x28\x02\x00" \ 875 | "\x00\x2a\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ 876 | "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x66\x2f"; 877 | uint8_t config_220c[256] = "\x40\x11\x6c\x7d\x28\xa5\x28\xcd\x1c\xe9\x10\xf9\x00\xf9\x00\xf9" \ 878 | "\x00\x04\x02\x00\x00\x08\x00\x11\x11\xba\x00\x01\x80\xca\x00\x07" \ 879 | "\x00\x84\x00\xbe\xb2\x86\x00\xc5\xb9\x88\x00\xb5\xad\x8a\x00\x9d" \ 880 | "\x95\x8c\x00\x00\xbe\x8e\x00\x00\xc5\x90\x00\x00\xb5\x92\x00\x00" \ 881 | "\x9d\x94\x00\x00\xaf\x96\x00\x00\xbf\x98\x00\x00\xb6\x9a\x00\x00" \ 882 | "\xa7\x30\x00\x6c\x1c\x50\x00\x01\x05\xd0\x00\x00\x00\x70\x00\x00" \ 883 | "\x00\x72\x00\x78\x56\x74\x00\x34\x12\x26\x00\x00\x12\x20\x00\x10" \ 884 | "\x40\x12\x00\x03\x04\x02\x02\x16\x21\x2c\x02\x0a\x03\x2a\x01\x02" \ 885 | "\x00\x22\x00\x01\x20\x24\x00\x32\x00\x80\x00\x05\x04\x5c\x00\x00" \ 886 | "\x01\x56\x00\x28\x20\x58\x00\x01\x00\x32\x00\x24\x02\x82\x00\x80" \ 887 | "\x0c\x20\x02\x88\x0d\x2a\x01\x92\x07\x22\x00\x01\x20\x24\x00\x14" \ 888 | "\x00\x80\x00\x05\x04\x5c\x00\x9b\x00\x56\x00\x08\x20\x58\x00\x03" \ 889 | "\x00\x32\x00\x08\x04\x82\x00\x80\x12\x20\x02\xf8\x0c\x2a\x01\x18" \ 890 | "\x04\x5c\x00\x9b\x00\x54\x00\x00\x01\x62\x00\x09\x03\x64\x00\x18" \ 891 | "\x00\x82\x00\x80\x0c\x20\x02\xf8\x0c\x2a\x01\x18\x04\x5c\x00\x9b" \ 892 | "\x00\x52\x00\x08\x00\x54\x00\x00\x01\x00\x00\x00\x00\x00\x50\x5e"; 893 | uint8_t *config; 894 | uint16_t config_size; 895 | uint8_t response[32768] = { 0 }; 896 | uint16_t response_size = 0; 897 | 898 | switch (chip_id) { 899 | case 0x2202: 900 | config = config_2202; 901 | config_size = sizeof(config_2202); 902 | break; 903 | case 0x220c: 904 | config = config_220c; 905 | config_size = sizeof(config_220c); 906 | break; 907 | default: 908 | error("Unknown chip id 0x%04x", chip_id); 909 | ret = -EINVAL; 910 | goto out; 911 | } 912 | 913 | debug_dump_buffer("config:", config, config_size); 914 | 915 | ret = send_packet(dev, GOODIX_FP_PACKET_TYPE_CONFIG, 916 | config, config_size, 917 | response, &response_size); 918 | if (ret < 0) 919 | goto out; 920 | 921 | debug_dump_buffer("0x90 response:", response, response_size); 922 | 923 | out: 924 | return ret; 925 | } 926 | 927 | static int get_msg_36(goodix_fp_device *dev) 928 | { 929 | int ret; 930 | uint8_t request[26] = "\x0d\x01" \ 931 | "\x97\x97\xa1\xa1\x9b\x9b\x92\x92\x96\x96\xa4\xa4" \ 932 | "\x9d\x9d\x95\x95\x94\x94\xa1\xa1\x9c\x9c\x8e\x8e"; 933 | uint8_t response[32768] = { 0 }; 934 | uint16_t response_size = 0; 935 | 936 | ret = send_packet(dev, 0x36, request, sizeof(request), response, &response_size); 937 | if (ret < 0) 938 | goto out; 939 | 940 | debug_dump_buffer("0x36 response: ", response, response_size); 941 | 942 | out: 943 | return ret; 944 | } 945 | 946 | /* this is probably the message to get an image, together with 36 */ 947 | static int get_msg_20(goodix_fp_device *dev, uint16_t chip_id) 948 | { 949 | int ret; 950 | uint8_t request_2202[2] = "\x01\x00"; 951 | uint8_t request_220c[4] = "\x01\x06\xcf\x00"; 952 | uint8_t *request; 953 | uint16_t request_size; 954 | uint8_t response[32768] = { 0 }; 955 | uint16_t response_size = 0; 956 | 957 | switch (chip_id) { 958 | case 0x2202: 959 | request = request_2202; 960 | request_size = sizeof(request_2202); 961 | break; 962 | case 0x220c: 963 | request = request_220c; 964 | request_size = sizeof(request_220c); 965 | break; 966 | default: 967 | error("Unknown chip id 0x%04x", chip_id); 968 | ret = -EINVAL; 969 | goto out; 970 | } 971 | 972 | 973 | ret = send_packet_full(dev, 0x20, 974 | request, request_size, 975 | response, &response_size, false); 976 | if (ret < 0) 977 | goto out; 978 | 979 | debug_dump_buffer_to_file("payload_image.bin", response, response_size); 980 | 981 | out: 982 | return ret; 983 | } 984 | 985 | #if 0 986 | 987 | /* maybe some shutdown message */ 988 | static int get_msg_60(goodix_fp_device *dev) 989 | {} 990 | 991 | /* maybe some shutdown message */ 992 | static int get_msg_ae(goodix_fp_device *dev) 993 | {} 994 | 995 | /* maybe some shutdown message */ 996 | static int get_msg_32(goodix_fp_device *dev) 997 | {} 998 | 999 | #endif 1000 | 1001 | static int init_device_2202(goodix_fp_device * dev) 1002 | { 1003 | int ret; 1004 | 1005 | ret = get_msg_a6_otp(dev); 1006 | if (ret < 0) { 1007 | error("Error, cannot get OTP: %d\n", ret); 1008 | goto out; 1009 | } 1010 | 1011 | ret = get_msg_90_config(dev, 0x2202); 1012 | if (ret < 0) { 1013 | error("Error, cannot set config: %d\n", ret); 1014 | goto out; 1015 | } 1016 | 1017 | ret = get_msg_36(dev); 1018 | if (ret < 0) { 1019 | error("Error, cannot get message 0x36: %d\n", ret); 1020 | goto out; 1021 | } 1022 | 1023 | ret = get_msg_20(dev, 0x2202); 1024 | if (ret < 0) { 1025 | error("Error, cannot get message 0x20: %d\n", ret); 1026 | goto out; 1027 | } 1028 | 1029 | out: 1030 | return ret; 1031 | } 1032 | 1033 | static int init_device_220c(goodix_fp_device * dev) 1034 | { 1035 | int ret; 1036 | 1037 | ret = get_msg_a6_otp(dev); 1038 | if (ret < 0) { 1039 | error("Error, cannot get OTP: %d\n", ret); 1040 | goto out; 1041 | } 1042 | 1043 | ret = get_msg_e4_psk(dev); 1044 | if (ret < 0) { 1045 | error("Error, cannot get message 0xe4: %d\n", ret); 1046 | goto out; 1047 | } 1048 | 1049 | ret = get_msg_d2_handshake(dev); 1050 | if (ret < 0) { 1051 | error("Error, cannot perform handshake: %d\n", ret); 1052 | goto out; 1053 | } 1054 | 1055 | ret = get_msg_90_config(dev, 0x220c); 1056 | if (ret < 0) { 1057 | error("Error, cannot set config: %d\n", ret); 1058 | goto out; 1059 | } 1060 | 1061 | ret = get_msg_36(dev); 1062 | if (ret < 0) { 1063 | error("Error, cannot get message 0x36: %d\n", ret); 1064 | goto out; 1065 | } 1066 | 1067 | ret = get_msg_20(dev, 0x220c); 1068 | if (ret < 0) { 1069 | error("Error, cannot get message 0x20: %d\n", ret); 1070 | goto out; 1071 | } 1072 | 1073 | out: 1074 | return ret; 1075 | } 1076 | 1077 | static int init(goodix_fp_device *dev) 1078 | { 1079 | int ret; 1080 | uint32_t chip_id; 1081 | 1082 | #if 0 1083 | uint8_t buffer[32768] = { 0 }; 1084 | 1085 | /* XXX some devices do not like these USB control transfers */ 1086 | ret = libusb_control_transfer(dev->usb_device, 1087 | LIBUSB_ENDPOINT_IN | 1088 | LIBUSB_REQUEST_TYPE_VENDOR | 1089 | LIBUSB_RECIPIENT_DEVICE, 1090 | 1, 0, 4, buffer, 16, 0); 1091 | if (ret != 16) { 1092 | error("Error, control message 1: %d\n", ret); 1093 | goto out; 1094 | } 1095 | trace_dump_buffer("<-- received", buffer, ret); 1096 | 1097 | ret = libusb_control_transfer(dev->usb_device, 1098 | LIBUSB_ENDPOINT_IN | 1099 | LIBUSB_REQUEST_TYPE_VENDOR | 1100 | LIBUSB_RECIPIENT_DEVICE, 1101 | 1, 0, 4, buffer, 64, 0); 1102 | if (ret != 64) { 1103 | error("Error, control message 2: %d\n", ret); 1104 | goto out; 1105 | } 1106 | trace_dump_buffer("<-- received", buffer, ret); 1107 | 1108 | #endif 1109 | 1110 | ret = get_msg_00_change_mode_start(dev); 1111 | if (ret < 0) { 1112 | error("Error, cannot change mode to 0x00: %d\n", ret); 1113 | goto out; 1114 | } 1115 | 1116 | ret = get_msg_a8_firmware_version(dev); 1117 | if (ret < 0) { 1118 | error("Error, cannot get Firmware version: %d\n", ret); 1119 | goto out; 1120 | } 1121 | 1122 | ret = get_msg_a2_reset(dev); 1123 | if (ret < 0) { 1124 | error("Error, cannot perform reset: %d\n", ret); 1125 | goto out; 1126 | } 1127 | 1128 | ret = get_msg_82_chip_reg_read_chip_id(dev, &chip_id); 1129 | if (ret < 0) { 1130 | error("Error, cannot get chip id: %d\n", ret); 1131 | goto out; 1132 | } 1133 | 1134 | switch (chip_id) { 1135 | case 0x220c: 1136 | return init_device_220c(dev); 1137 | case 0x2202: 1138 | return init_device_2202(dev); 1139 | case 0x2207: 1140 | case 0x2208: 1141 | error("Unsupported device type 0x%04x", chip_id); 1142 | ret = -ENOTSUP; 1143 | goto out; 1144 | default: 1145 | error("Unknown device type 0x%04x", chip_id); 1146 | ret = -EINVAL; 1147 | goto out; 1148 | } 1149 | 1150 | out: 1151 | return ret; 1152 | } 1153 | 1154 | static int goodix_fp_init(void) 1155 | { 1156 | int ret; 1157 | 1158 | ret = libusb_init(NULL); 1159 | if (ret < 0) { 1160 | fprintf(stderr, "libusb_init failed: %s\n", 1161 | libusb_error_name(ret)); 1162 | goto out; 1163 | } 1164 | 1165 | #if defined(LIBUSB_API_VERSION) && (LIBUSB_API_VERSION >= 0x01000106) 1166 | libusb_set_option(NULL, LIBUSB_OPTION_LOG_LEVEL, 3); 1167 | #else 1168 | libusb_set_debug(NULL, 3); 1169 | #endif 1170 | 1171 | out: 1172 | return ret; 1173 | } 1174 | 1175 | static void goodix_fp_shutdown(void) 1176 | { 1177 | libusb_exit(NULL); 1178 | } 1179 | 1180 | /* dev is only populated when the function returns 0 */ 1181 | static int goodix_fp_device_open(goodix_fp_device **dev) 1182 | { 1183 | libusb_device **list; 1184 | libusb_device_handle *usb_dev; 1185 | goodix_fp_device *new_dev; 1186 | ssize_t num_devices; 1187 | int current_configuration; 1188 | int ret; 1189 | int i; 1190 | 1191 | num_devices = libusb_get_device_list(NULL, &list); 1192 | if (num_devices < 0) { 1193 | ret = -ENODEV; 1194 | goto out; 1195 | } 1196 | 1197 | new_dev = NULL; 1198 | for (i = 0; i < num_devices; i++) { 1199 | struct libusb_device_descriptor desc; 1200 | unsigned int j; 1201 | 1202 | ret = libusb_get_device_descriptor(list[i], &desc); 1203 | if (ret < 0) 1204 | continue; 1205 | 1206 | for (j = 0; j < ARRAY_SIZE(supported_devices); j++) { 1207 | if (desc.idVendor == supported_devices[j].vendor_id && 1208 | desc.idProduct == supported_devices[j].product_id) { 1209 | 1210 | ret = libusb_open(list[i], &usb_dev); 1211 | if (ret < 0) { 1212 | fprintf(stderr, "libusb_open failed: %s\n", libusb_error_name(ret)); 1213 | goto out; 1214 | } 1215 | 1216 | new_dev = malloc(sizeof(*new_dev)); 1217 | if (new_dev == NULL) { 1218 | ret = -ENOMEM; 1219 | goto out; 1220 | } 1221 | new_dev->usb_device = usb_dev; 1222 | new_dev->desc = &supported_devices[j]; 1223 | 1224 | /* only support the first device on the system */ 1225 | goto done; 1226 | } 1227 | } 1228 | } 1229 | if (new_dev == NULL) { 1230 | fprintf(stderr, "Cannot find any device to open\n"); 1231 | ret = -ENODEV; 1232 | goto out; 1233 | } 1234 | done: 1235 | 1236 | 1237 | #if 0 1238 | /* in case the device starts to act up */ 1239 | libusb_reset_device(usb_dev); 1240 | #endif 1241 | 1242 | current_configuration = -1; 1243 | ret = libusb_get_configuration(usb_dev, ¤t_configuration); 1244 | if (ret < 0) { 1245 | fprintf(stderr, "libusb_get_configuration failed: %s\n", 1246 | libusb_error_name(ret)); 1247 | goto out_libusb_close; 1248 | } 1249 | 1250 | if (current_configuration != new_dev->desc->configuration) { 1251 | ret = libusb_set_configuration(usb_dev, new_dev->desc->configuration); 1252 | if (ret < 0) { 1253 | fprintf(stderr, "libusb_set_configuration failed: %s\n", 1254 | libusb_error_name(ret)); 1255 | fprintf(stderr, "Cannot set configuration %d\n", 1256 | new_dev->desc->configuration); 1257 | goto out_libusb_close; 1258 | } 1259 | } 1260 | 1261 | libusb_set_auto_detach_kernel_driver(usb_dev, 1); 1262 | 1263 | /* Claim all interfaces, the cdc_acm driver may be bound to them. */ 1264 | ret = usb_claim_interfaces(usb_dev, new_dev->desc->configuration); 1265 | if (ret < 0) 1266 | goto out_libusb_close; 1267 | 1268 | /* 1269 | * Checking that the configuration has not changed, as suggested in 1270 | * http://libusb.sourceforge.net/api-1.0/caveats.html 1271 | */ 1272 | current_configuration = -1; 1273 | ret = libusb_get_configuration(usb_dev, ¤t_configuration); 1274 | if (ret < 0) { 1275 | fprintf(stderr, "libusb_get_configuration after claim failed: %s\n", 1276 | libusb_error_name(ret)); 1277 | goto out_release_interfaces; 1278 | } 1279 | 1280 | if (current_configuration != new_dev->desc->configuration) { 1281 | fprintf(stderr, "libusb configuration changed (expected: %d, current: %d)\n", 1282 | new_dev->desc->configuration, current_configuration); 1283 | ret = -EINVAL; 1284 | goto out_release_interfaces; 1285 | } 1286 | 1287 | *dev = new_dev; 1288 | ret = 0; 1289 | goto out; 1290 | 1291 | out_release_interfaces: 1292 | usb_release_interfaces(usb_dev, new_dev->desc->configuration); 1293 | out_libusb_close: 1294 | free(new_dev); 1295 | libusb_close(usb_dev); 1296 | 1297 | out: 1298 | libusb_free_device_list(list, 1); 1299 | return ret; 1300 | } 1301 | 1302 | static void goodix_fp_device_close(goodix_fp_device *dev) 1303 | { 1304 | usb_release_interfaces(dev->usb_device, dev->desc->configuration); 1305 | libusb_close(dev->usb_device); 1306 | free(dev); 1307 | } 1308 | 1309 | int main(void) 1310 | { 1311 | goodix_fp_device *dev; 1312 | int ret; 1313 | 1314 | ret = goodix_fp_init(); 1315 | if (ret < 0) 1316 | goto out; 1317 | 1318 | ret = goodix_fp_device_open(&dev); 1319 | if (ret < 0) 1320 | goto out_shutdown; 1321 | 1322 | ret = init(dev); 1323 | 1324 | goodix_fp_device_close(dev); 1325 | 1326 | out_shutdown: 1327 | goodix_fp_shutdown(); 1328 | out: 1329 | return ret; 1330 | } 1331 | --------------------------------------------------------------------------------