uru4000: handle images without headers

[libfprint.git] / libfprint / drivers / uru4000.c

/*
 * Digital Persona U.are.U 4000/4000B driver for libfprint
 * Copyright (C) 2007 Daniel Drake <dsd@gentoo.org>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

#define FP_COMPONENT "uru4000"

#include <errno.h>
#include <string.h>
#include <unistd.h>

#include <usb.h>

#include <fp_internal.h>

#define EP_INTR                 (1 | USB_ENDPOINT_IN)
#define EP_DATA                 (2 | USB_ENDPOINT_IN)
#define USB_RQ                  0x04
#define CTRL_IN                 (USB_TYPE_VENDOR | USB_ENDPOINT_IN)
#define CTRL_OUT                (USB_TYPE_VENDOR | USB_ENDPOINT_OUT)
#define CTRL_TIMEOUT    5000
#define BULK_TIMEOUT    5000
#define DATABLK1_RQLEN  0x10000
#define DATABLK2_RQLEN  0xb340
#define DATABLK2_EXPECT 0xb1c0
#define CAPTURE_HDRLEN  64
#define IRQ_LENGTH              64

enum {
        IRQDATA_SCANPWR_ON = 0x56aa,
        IRQDATA_FINGER_ON = 0x0101,
        IRQDATA_FINGER_OFF = 0x0200,
        IRQDATA_DEATH = 0x0800,
};

enum {
        REG_HWSTAT = 0x07,
        REG_MODE = 0x4e,
};

enum {
        MODE_INIT = 0x00,
        MODE_AWAIT_FINGER_ON = 0x10,
        MODE_AWAIT_FINGER_OFF = 0x12,
        MODE_CAPTURE = 0x20,
        MODE_SHUT_UP = 0x30,
        MODE_READY = 0x80,
};

enum {
        MS_KBD,
        MS_INTELLIMOUSE,
        MS_STANDALONE,
        MS_STANDALONE_V2,
        DP_URU4000,
        DP_URU4000B,
};

static const struct uru4k_dev_profile {
        const char *name;
        uint16_t firmware_start;
        uint16_t fw_enc_offset;
} uru4k_dev_info[] = {
        [MS_KBD] = {
                .name = "Microsoft Keyboard with Fingerprint Reader",
                .firmware_start = 0x100,
                .fw_enc_offset = 0x42b,
        },
        [MS_INTELLIMOUSE] = {
                .name = "Microsoft Wireless IntelliMouse with Fingerprint Reader",
                .firmware_start = 0x100,
                .fw_enc_offset = 0x42b,
        },
        [MS_STANDALONE] = {
                .name = "Microsoft Fingerprint Reader",
                .firmware_start = 0x100,
                .fw_enc_offset = 0x42b,
        },
        [DP_URU4000B] = {
                .name = "Digital Persona U.are.U 4000B",
                .firmware_start = 0x100,
                .fw_enc_offset = 0x42b,
        },
};

struct uru4k_dev {
        uint8_t interface;
};

/*
 * HWSTAT
 *
 * This register has caused me a lot of headaches. It pretty much defines
 * code flow, and if you don't get it right, the pretty lights don't come on.
 * I think the situation is somewhat complicated by the fact that writing it
 * doesn't affect the read results in the way you'd expect -- but then again
 * it does have some obvious effects. Here's what we know
 *
 * BIT 7: LOW POWER MODE
 * When this bit is set, the device is partially turned off or something. Some
 * things, like firmware upload, need to be done in this state. But generally
 * we want to clear this bit during late initialization, which can sometimes
 * be tricky.
 *
 * BIT 2: SOMETHING WENT WRONG
 * Not sure about this, but see the init function, as when we detect it,
 * we reboot the device. Well, we mess with hwstat until this evil bit gets
 * cleared.
 *
 * BIT 1: IRQ PENDING
 * Just had a brainwave. This bit is set when the device is trying to deliver
 * and interrupt to the host. Maybe?
 */

static int get_hwstat(struct fp_img_dev *dev, unsigned char *data)
{
        int r;

        /* The windows driver uses a request of 0x0c here. We use 0x04 to be
         * consistent with every other command we know about. */
        r = usb_control_msg(dev->udev, CTRL_IN, USB_RQ, REG_HWSTAT, 0,
                data, 1, CTRL_TIMEOUT);
        if (r < 0) {
                fp_err("error %d", r);
                return r;
        } else if (r < 1) {
                fp_err("read too short (%d)", r);
                return -EIO;
        }

        fp_dbg("val=%02x", *data);
        return 0;
}

static int set_hwstat(struct fp_img_dev *dev, unsigned char data)
{
        int r;
        fp_dbg("val=%02x", data);

        r = usb_control_msg(dev->udev, CTRL_OUT, USB_RQ, REG_HWSTAT, 0,
                &data, 1, CTRL_TIMEOUT);
        if (r < 0) {
                fp_err("error %d", r);
                return r;
        } else if (r < 1) {
                fp_err("read too short (%d)", r);
                return -EIO;
        }

        return 0;
}

static int set_mode(struct fp_img_dev *dev, unsigned char mode)
{
        int r;

        fp_dbg("%02x", mode);
        r = usb_control_msg(dev->udev, CTRL_OUT, USB_RQ, REG_MODE, 0, &mode, 1,
                CTRL_TIMEOUT);
        if (r < 0) {
                fp_err("error %d", r);
                return r;
        } else if (r < 1) {
                fp_err("write too short (%d)", r);
                return -EIO;
        }

        return 0;
}

static int get_irq(struct fp_img_dev *dev, unsigned char *buf, int timeout)
{
        uint16_t type;
        int r;
        int infinite_timeout = 0;

        if (timeout == 0)
                infinite_timeout = 1;

        /* Darwin and Linux behave inconsistently with regard to infinite timeouts.
         * Linux accepts a timeout value of 0 as infinite timeout, whereas darwin
         * returns -ETIMEDOUT immediately when a 0 timeout is used. We use a
         * looping hack until libusb is fixed.
         * See http://thread.gmane.org/gmane.comp.lib.libusb.devel.general/1315 */

retry:
        r = usb_interrupt_read(dev->udev, EP_INTR, buf, IRQ_LENGTH, 1000);
        if (r == -ETIMEDOUT &&
                        ((!infinite_timeout && timeout > 0) || infinite_timeout)) {
                fp_dbg("timeout, retry");
                timeout--;
                goto retry;
        }

        if (r < 0) {
                fp_err("interrupt read failed, error %d", r);
                return r;
        } else if (r < IRQ_LENGTH) {
                fp_err("received %d byte IRQ!?", r);
                return -EIO;
        }

        type = GUINT16_FROM_BE(*((uint16_t *) buf));
        fp_dbg("irq type %04x", type);

        /* The 0800 interrupt seems to indicate imminent failure (0 bytes transfer)
         * of the next scan. I think I've stopped it from coming up, not sure
         * though! */
        if (type == IRQDATA_DEATH)
                fp_warn("oh no! got the interrupt OF DEATH! expect things to go bad");

        return 0;
}

enum get_irq_status {
        GET_IRQ_SUCCESS = 0,
        GET_IRQ_OVERFLOW = 1,
};

static int get_irq_with_type(struct fp_img_dev *dev,
        uint16_t irqtype, int timeout)
{
        uint16_t hdr;
        int discarded = 0;
        unsigned char irqbuf[IRQ_LENGTH];

        fp_dbg("type=%04x", irqtype);

        do {
                int r = get_irq(dev, irqbuf, timeout);
                if (r < 0)
                        return r;

                hdr = GUINT16_FROM_BE(*((uint16_t *) irqbuf));
                if (hdr == irqtype)
                        break;
                discarded++;
        } while (discarded < 3);

        if (discarded > 0)
                fp_dbg("discarded %d interrupts", discarded);

        if (hdr == irqtype) {
                return GET_IRQ_SUCCESS;
        } else {
                /* I've seen several cases where we're waiting for the 56aa powerup
                 * interrupt, but instead we just get three 0200 interrupts and then
                 * nothing. My theory is that the device can only queue 3 interrupts,
                 * or something. So, if we discard 3, ask the caller to retry whatever
                 * it was doing. */
                fp_dbg("possible IRQ overflow detected!");
                return GET_IRQ_OVERFLOW;
        }
}

static int await_finger_on(struct fp_img_dev *dev)
{
        int r;

retry:
        r = set_mode(dev, MODE_AWAIT_FINGER_ON);
        if (r < 0)
                return r;

        r = get_irq_with_type(dev, IRQDATA_FINGER_ON, 0);
        if (r == GET_IRQ_OVERFLOW)
                goto retry;
        else
                return r;
}

static int await_finger_off(struct fp_img_dev *dev)
{
        int r;

retry:
        r = set_mode(dev, MODE_AWAIT_FINGER_OFF);
        if (r < 0)
                return r;
        
        r = get_irq_with_type(dev, IRQDATA_FINGER_OFF, 0);
        if (r == GET_IRQ_OVERFLOW)
                goto retry;
        else
                return r;
}

static int capture(struct fp_img_dev *dev, gboolean unconditional,
        struct fp_img **ret)
{
        int r;
        struct fp_img *img;
        size_t image_size = DATABLK1_RQLEN + DATABLK2_EXPECT - CAPTURE_HDRLEN;
        int hdr_skip = CAPTURE_HDRLEN;

        r = set_mode(dev, MODE_CAPTURE);
        if (r < 0)
                return r;

        /* The image is split up into 2 blocks over 2 USB transactions, which are
         * joined contiguously. The image is prepended by a 64 byte header which
         * we completely ignore.
         *
         * We mimic the windows driver behaviour by requesting 0xb340 bytes in the
         * 2nd request, but we only expect 0xb1c0 in response. However, our buffers
         * must be set up on the offchance that we receive as much data as we
         * asked for. */

        img = fpi_img_new(DATABLK1_RQLEN + DATABLK2_RQLEN);

        r = usb_bulk_read(dev->udev, EP_DATA, img->data, DATABLK1_RQLEN,
                BULK_TIMEOUT);
        if (r < 0) {
                fp_err("part 1 capture failed, error %d", r);
                goto err;
        } else if (r < DATABLK1_RQLEN) {
                fp_err("part 1 capture too short (%d)", r);
                r = -EIO;
                goto err;
        }

        r = usb_bulk_read(dev->udev, EP_DATA, img->data + DATABLK1_RQLEN,
                DATABLK2_RQLEN, BULK_TIMEOUT);
        if (r < 0) {
                fp_err("part 2 capture failed, error %d", r);
                goto err;
        } else if (r != DATABLK2_EXPECT) {
                if (r == DATABLK2_EXPECT - CAPTURE_HDRLEN) {
                        /* this is rather odd, but it happens sometimes with my MS
                         * keyboard */
                        fp_dbg("got image with no header!");
                        hdr_skip = 0;
                } else {
                        fp_err("unexpected part 2 capture size (%d)", r);
                        r = -EIO;
                        goto err;
                }
        }

        /* remove header and shrink allocation */
        g_memmove(img->data, img->data + hdr_skip, image_size);
        img = fpi_img_resize(img, image_size);
        img->flags = FP_IMG_V_FLIPPED | FP_IMG_H_FLIPPED | FP_IMG_COLORS_INVERTED;

        *ret = img;
        return 0;
err:
        g_free(img);
        return r;
}

static int do_init(struct fp_img_dev *dev)
{
        unsigned char status;
        unsigned char tmp;
        int i;
        int r;

retry:
        r = get_hwstat(dev, &status);
        if (r < 0)
                return r;

        /* After closing an app and setting hwstat to 0x80, my ms keyboard
         * gets in a confused state and returns hwstat 0x85. On next app run,
         * we don't get the 56aa interrupt. This is the best way I've found to
         * fix it: mess around with hwstat until it starts returning more
         * recognisable values. This doesn't happen on my other devices:
         * uru4000, uru4000b, ms fp rdr v2 
         * The windows driver copes with this OK, but then again it uploads
         * firmware right after reading the 0x85 hwstat, allowing some time
         * to pass before it attempts to tweak hwstat again... */
        if ((status & 0x84) == 0x84) {
                fp_dbg("rebooting device power");
                r = set_hwstat(dev, status & 0xf);
                if (r < 0)
                        return r;

                for (i = 0; i < 100; i++) {
                        r = get_hwstat(dev, &status);
                        if (r < 0)
                                return r;
                        if (status & 0x1)
                                break;
                        usleep(10000);
                }
                if ((status & 0x1) == 0) {
                        fp_err("could not reboot device power");
                        return -EIO;
                }
        }
        
        if ((status & 0x80) == 0) {
                status |= 0x80;
                r = set_hwstat(dev, status);
                if (r < 0)
                        return r;
        }

        /* FIXME fix firmware (disable encryption) */

        /* Power up device and wait for interrupt notification */
        /* The combination of both modifying firmware *and* doing C-R auth on
         * my ms fp v2 device causes us not to get to get the 56aa interrupt and
         * for the hwstat write not to take effect. We loop a few times,
         * authenticating each time, until the device wakes up. */
        for (i = 0; i < 100; i++) { /* max 1 sec */
                r = set_hwstat(dev, status & 0xf);
                if (r < 0)
                        return r;

                r = get_hwstat(dev, &tmp);
                if (r < 0)
                        return r;

                if ((tmp & 0x80) == 0)
                        break;

                usleep(10000);

                /* FIXME do C-R auth for v2 devices */
        }

        if (tmp & 0x80) {
                fp_err("could not power up device");
                return -EIO;
        }

        r = get_irq_with_type(dev, IRQDATA_SCANPWR_ON, 5);
        if (r == GET_IRQ_OVERFLOW)
                goto retry;
        else
                return r;
}

static int dev_init(struct fp_img_dev *dev, unsigned long driver_data)
{
        struct usb_config_descriptor *config;
        struct usb_interface *iface = NULL;
        struct usb_interface_descriptor *iface_desc;
        struct usb_endpoint_descriptor *ep;
        struct uru4k_dev *urudev;
        int i;
        int r;

        /* Find fingerprint interface */
        config = usb_device(dev->udev)->config;
        for (i = 0; i < config->bNumInterfaces; i++) {
                struct usb_interface *cur_iface = &config->interface[i];

                if (cur_iface->num_altsetting < 1)
                        continue;

                iface_desc = &cur_iface->altsetting[0];
                if (iface_desc->bInterfaceClass == 255
                                && iface_desc->bInterfaceSubClass == 255 
                                && iface_desc->bInterfaceProtocol == 255) {
                        iface = cur_iface;
                        break;
                }
        }

        if (iface == NULL) {
                fp_err("could not find interface");
                return -ENODEV;
        }

        /* Find/check endpoints */

        if (iface_desc->bNumEndpoints != 2) {
                fp_err("found %d endpoints!?", iface_desc->bNumEndpoints);
                return -ENODEV;
        }

        ep = &iface_desc->endpoint[0];
        if (ep->bEndpointAddress != EP_INTR
                        || (ep->bmAttributes & USB_ENDPOINT_TYPE_MASK) !=
                                USB_ENDPOINT_TYPE_INTERRUPT) {
                fp_err("unrecognised interrupt endpoint");
                return -ENODEV;
        }

        ep = &iface_desc->endpoint[1];
        if (ep->bEndpointAddress != EP_DATA
                        || (ep->bmAttributes & USB_ENDPOINT_TYPE_MASK) !=
                                USB_ENDPOINT_TYPE_BULK) {
                fp_err("unrecognised bulk endpoint");
                return -ENODEV;
        }

        /* Device looks like a supported reader */

        r = usb_claim_interface(dev->udev, iface_desc->bInterfaceNumber);
        if (r < 0) {
                fp_err("interface claim failed");
                return r;
        }

        urudev = g_malloc0(sizeof(*urudev));
        urudev->interface = iface_desc->bInterfaceNumber;
        dev->priv = urudev;

        r = do_init(dev);
        if (r < 0)
                goto err;

        return 0;
err:
        usb_release_interface(dev->udev, iface_desc->bInterfaceNumber);
        g_free(urudev);
        return r;
}

static void dev_exit(struct fp_img_dev *dev)
{
        struct uru4k_dev *urudev = dev->priv;

        set_mode(dev, MODE_INIT);
        set_hwstat(dev, 0x80);
        usb_release_interface(dev->udev, urudev->interface);
        g_free(urudev);
}

static const struct usb_id id_table[] = {
        /* ms kbd with fp rdr */
        { .vendor = 0x045e, .product = 0x00bb, .driver_data = MS_KBD },

        /* ms intellimouse with fp rdr */
        { .vendor = 0x045e, .product = 0x00bc, .driver_data = MS_INTELLIMOUSE },

        /* ms fp rdr (standalone) */
        { .vendor = 0x045e, .product = 0x00bd, .driver_data = MS_STANDALONE },

        /* dp uru4000b (standalone) */
        { .vendor = 0x05ba, .product = 0x000a, .driver_data = DP_URU4000B },

        /* terminating entry */
        { 0, 0, 0, },
};

struct fp_img_driver uru4000_driver = {
        .driver = {
                .id = 2,
                .name = FP_COMPONENT,
                .full_name = "Digital Persona U.are.U 4000/4000B",
                .id_table = id_table,
        },
        .flags = FP_IMGDRV_SUPPORTS_UNCONDITIONAL_CAPTURE,
        .img_height = 289,
        .img_width = 384,

        .init = dev_init,
        .exit = dev_exit,
        .await_finger_on = await_finger_on,
        .await_finger_off = await_finger_off,
        .capture = capture,
};