g2flash/patches/zlib_glue.c at main · hmmhmmhm/g2flash

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

668

669

670

671

672

673

674

675

676

677

678

679

680

681

682

683

684

685

686

687

688

689

690

691

692

693

694

695

696

697

698

699

700

701

702

703

704

705

706

707

708

709

710

711

712

713

714

715

716

717

718

719

720

721

722

723

724

725

726

727

728

729

730

731

732

733

734

735

736

737

738

739

740

741

742

743

744

745

746

747

748

749

750

751

752

753

754

755

756

757

758

759

760

761

762

763

764

765

766

767

768

769

770

771

772

773

774

775

776

777

778

779

780

781

782

783

784

785

786

787

788

789

790

791

792

793

794

795

796

797

798

799

800

801

802

803

804

805

806

807

808

809

810

811

812

813

814

815

816

817

818

819

820

821

822

823

824

825

826

827

828

829

830

831

832

833

834

835

836

837

838

839

840

841

842

843

844

845

846

847

848

849

850

851

852

853

854

855

856

857

858

859

860

861

862

863

864

865

866

867

868

869

870

871

872

873

874

875

876

877

878

879

880

881

882

883

884

885

886

887

888

889

890

891

892

893

894

895

896

897

898

899

900

901

902

903

904

905

906

907

908

909

910

911

912

913

914

915

916

917

918

919

920

921

922

923

924

925

926

927

928

929

930

931

932

933

934

935

936

937

938

939

940

941

942

943

944

945

946

947

948

949

950

951

952

953

954

955

956

957

958

959

960

961

962

963

964

965

966

967

968

969

970

971

972

973

974

975

976

977

978

979

980

981

982

983

984

985

986

987

988

989

990

991

992

993

994

995

996

997

998

999

1000

#include <stdint.h>

* zlib (DEFLATE) image support for the G2 CFW — multi-mode load wrapper.

* Replaces the one BMP-loader call FUN_0050164a(state, buf, len) in FUN_004ae69c.

* Dispatch on the first byte of the reassembled image buffer:

* 'B' (0x42) -> raw BMP: decode with our own fast 4bpp decoder (load_bmp_fast).

* 3 -> [3][l/4][t/2][w/4][h/2][fid16][zlib(rle)] bounding-box delta: composite a

* tight-4bpp rectangle onto the persistent 640x480

* shadow, then queue a direct physical-framebuffer

* refresh. Box origin/size is quantized (left/width *4,

* top/height *2). Needs a prior mode-6 keyframe.

* 5 -> [5][...] play a UI sound on the arm buzzer (no display change).

* The G2 "speaker" is a PWM piezo buzzer — it can only

* emit square-wave tones, not PCM/WAV — so this drives

* the firmware's own buzzer driver instead of streaming

* samples. Sub-dispatch on src[1]:

* 0 [0][type] -> DRV_BuzzerPlayAfterQueue:

* play preset voice `type` (0..8) from the flash

* preset table (single beep / alarm / ringtone).

* 1 [1][note][oct][beat] -> DRV_BuzzerPlayNote: one

* tone. note 1..7, oct 0..3 (freq from the 28-

* entry note table), beat = duration in ~62ms

* units. Good for click/beep on tap/notification.

* 2 [2] -> stop/silence the buzzer.

* 3 [3][freqLo][freqHi][duty][msLo][msHi] -> raw tone:

* program the PWM to an ARBITRARY frequency

* (1..20000 Hz, 16-bit LE) at `duty` percent

* (0..100) for `ms` milliseconds (16-bit LE).

* Bypasses the 7-note x 4-octave lookup table

* entirely (that table is just a convenience);

* the hardware timer takes any Hz. Auto-stops

* by arming the buzzer's own osTimer with a

* null note list so the driver's timer callback

* shuts the PWM off after `ms`. Enables fine /

* microtonal pitch, chirps and pitch sweeps

* (send a run of these), and sub-62ms durations.

* The preset/note/stop entries are self-contained fw

* entries that queue into the buzzer's osTimer; the

* raw-tone entry drives the low-level PWM start and

* arms that same osTimer for auto-stop. None spin or

* block here. Returns 0 (success).

* 6 -> [6][zlib(rle)] headerless 4bpp full frame: inflate + RLE-decode the

* tightly packed 640x480 pixels into the persistent CFW

* shadow (seeding it for mode-3 deltas), then queue a

* direct physical-framebuffer refresh.

* 7 -> [7][sub] diagnostic control (no display change): 0 clears the

* overlay flags, 1 hides the overlay, 2 shows it.

* 8 -> [8][count][len16][submsg]... multi-segment: apply each sub-message

* to the shadow with the panel push DEFERRED, then present

* once — an atomic multi-op update (e.g. scroll = rect-copy

* + delta). Bounded to an uncompressed 4bpp BMP's size; no

* nesting. Intended for shadow ops (modes 3/6/9).

* 9 -> [9][srcrect][dstrect] rect-copy inside the 4bpp shadow (full uint16

* L/T/W/H each; same size; may overlap), then present.

* Pairs with a delta (usually via mode 8) to scroll.

* anything else / too short -> load_bmp_fast (rejects cleanly if not a BMP).

* The HIGH BIT of the mode byte is a "lenses differ" flag; most modes ignore it. For

* mode 3 it carries two boxes (left then right, same size) sharing one zlib payload —

* a stereo shift without duplicating pixels; each lens draws at its own box. For mode 9

* it carries two rect-sets (left then right); each lens uses its own.

* Custom modes 3/6/8/9 operate on the full 640x480 physical image. The EvenHub

* container remains 576x288 and supplies two 165888-byte allocations: its display

* buffer A holds the 153600-byte packed-4bpp shadow, while reconstruction buffer B

* remains wholly available for multi-packet messages. Direct mode does not otherwise

* use A, so this separation reaches the full panel without another large allocation.

* RLE (modes 3 and 6 only): those two modes do not deflate the packed 4bpp bytes

* directly — the pixels are first run-length encoded and the RLE STREAM is what gets

* deflated, so the on-wire payload is zlib(rle(pixels)) and the firmware inflates then

* RLE-decodes. RLE runs over the pixel NIBBLES of the tightly packed rows in wire

* order (high nibble = left pixel), including the pad nibble that ends each row when

* the width is odd — i.e. exactly the byte buffer that used to be deflated, read as

* 2*len nibbles. One token is:

* [cnt4|color4] cnt 1..15 (1 byte)

* [0|color4][cnt8] cnt 1..255 (2 bytes)

* [0|color4][0][cntLo][cntHi] cnt 1..65535, little-endian (4 bytes)

* The low nibble is always the 4bpp color; the high nibble is the repeat count, and 0

* escapes to the wider forms. 65535 is the longest single run — an encoder splits

* anything longer into consecutive tokens. A run may cross row boundaries. Decoding is

* streamed straight out of inflate through a small stack chunk (no scratch allocation,

* tokens may straddle chunk boundaries), and same-color pixel pairs are written as

* whole bytes (color*0x11) rather than nibble at a time. A stream that decodes to

* anything other than exactly rows*rowbytes*2 nibbles is rejected and the previous

* frame is left on screen.

* Every invocation (any mode) first kicks the EvenHub keepalive: stock firmware

* resets the ticks-since-heartbeat counter only on the sid-0x0c heartbeat msg, so

* a client streaming image updates to maximize throughput would otherwise trip the

* "Connection lost" teardown. See FW_KEEPALIVE_RESET at the top of load_image_z.

* BMP handling (mode 'B') does NOT use the stock loader FUN_0050164a: that

* decoder runs two non-inlined function calls PER PIXEL (palette pack + luminance

* blend) plus a whole-buffer CRC, which costs more CPU than the airtime it saves.

* load_bmp_fast instead does a direct 4bpp-nibble -> 8bpp (nibble*17) expand,

* ignoring the palette (the sender only ever uses the standard gray ramp). The

* stock loader is kept only as a fallback for non-4bpp or mismatched-size BMPs.

* Raw BMP remains on the legacy LVGL path for backwards compatibility. Custom

* shadow modes bypass LVGL and the stock 576x288-to-640x480 copy: they serialize

* with the stock display semaphore, and display_copy_hook copies packed 4bpp

* directly into the physical framebuffer before the normal panel refresh.

* Self-contained: no external symbols, no writable globals. Firmware entry points

* are called by absolute constant address (movw/movt + blx, no relocation).

* Addresses of OUR OWN functions (the z_stream zalloc/zfree pair, the seq_tick

* osTimer callback) are taken with plain `&fn`: under -fropi clang materializes an

* intra-CU function address PC-relatively (movw/movt of a resolved constant +

* `add rX, pc`, Thumb bit included) with no relocation at all, so it needs no load

* address at build time and stays correct wherever the blob is placed.

typedef void *(*malloc_fn)(uint32_t);

typedef void (*free_fn)(void *);

typedef int (*inflateInit2_fn)(void *strm, int windowBits, const char *ver, int ssize);

typedef int (*inflate_fn)(void *strm, int flush);

typedef int (*inflateEnd_fn)(void *strm);

typedef int (*loadbmp_fn)(void *state, void *bmp, uint32_t len);

typedef void (*cacheflush_fn)(void *desc); /* desc = uint32[2]{ptr,size} */

typedef void (*lv_set_src_fn)(uint32_t obj, void *desc);

typedef void (*lv_invalidate_fn)(uint32_t obj);

typedef uint32_t (*lens_side_fn)(void); /* 2 = LEFT lens, 1 = RIGHT lens */

typedef void (*buzz_preset_fn)(uint32_t type); /* DRV_BuzzerPlayAfterQueue */

typedef void (*buzz_note_fn)(uint32_t note, uint32_t tone, uint32_t beat); /* DRV_BuzzerPlayNote */

typedef void (*buzz_reset_fn)(void); /* buzzer stop/reset */

typedef void (*buzz_raw_fn)(uint32_t freq, uint32_t duty); /* reset+power+PWM(freq,duty) */

typedef int (*timer_start_fn)(uint32_t handle, uint32_t ms); /* osTimer start (one-shot) */

typedef uint32_t (*timer_new_fn)(void *cb, uint32_t type, void *arg, void *attr); /* osTimerNew-> handle */

typedef int (*timer_stop_fn)(uint32_t handle); /* osTimer stop */

typedef void (*keepalive_reset_fn)(void); /* zero the EvenHub keepalive counter */

typedef uint8_t *(*lookup_fn)(uint32_t container_id); /* container id -> spec-list node (or 0) */

typedef int (*complete_emit_fn)(uint32_t id, void *hdr, int kind, uint32_t p4); /* completion emit */

typedef void (*display_gate_fn)(void); /* display semaphore take/give */

typedef int (*display_queue_fn)(uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t);

typedef void (*display_copy_fn)(void); /* stock 576x288 -> 640x480 packed copy */

/* firmware entry points (Thumb bit set for blx via constant pointer) */

#define FW_MALLOC ((malloc_fn)0x00474cd3U) /* FUN_00474cd2 malloc(size) */

#define FW_FREE ((free_fn)0x00474d17U) /* FUN_00474d16 free(ptr) */

#define FW_INIT2 ((inflateInit2_fn)0x005beac3U) /* FUN_005beac2 inflateInit2_ */

#define FW_INFLATE ((inflate_fn)0x005beb91U) /* FUN_005beb90 inflate */

#define FW_END ((inflateEnd_fn)0x005bea87U) /* FUN_005bea86 inflateEnd */

#define FW_LOADBMP ((loadbmp_fn)0x004dc5afU) /* FUN_004dc5ae set_image_data / BMP decoder */

#define FW_FLUSH ((cacheflush_fn)0x0047510fU) /* FUN_0047510e dcache clean range */

#define FW_SETSRC ((lv_set_src_fn)0x00498681U) /* FUN_00498680 lv_image_set_src */

#define FW_INVAL ((lv_invalidate_fn)0x00440657U) /* FUN_00440656 lv_obj_invalidate */

#define FW_SIDE ((lens_side_fn)0x0045a569U) /* FUN_0045a568 -> 2=left, 1=right */

#define FW_BUZZ_PRESET ((buzz_preset_fn)0x00502b5bU) /* FUN_00502b5a DRV_BuzzerPlayAfterQueue(type 0..8) */

#define FW_BUZZ_NOTE ((buzz_note_fn)0x00502bf9U) /* FUN_00502bf8 DRV_BuzzerPlayNote(note,tone,beat) */

#define FW_BUZZ_RESET ((buzz_reset_fn)0x00502ac5U) /* FUN_00502ac4 buzzer stop/reset */

#define FW_BUZZ_RAW ((buzz_raw_fn)0x00502c89U) /* FUN_00502c88 reset+power+PWM(freq,duty) */

#define FW_TIMER_START ((timer_start_fn)0x00449499U) /* FUN_00449498 osTimerStart(handle,ms) */

#define FW_TIMER_NEW ((timer_new_fn)0x004493b1U) /* FUN_004493b0 osTimerNew(cb,type,arg,attr) */

#define FW_TIMER_STOP ((timer_stop_fn)0x004494d9U) /* FUN_004494d8 osTimerStop(handle) */

#define FW_KEEPALIVE_RESET ((keepalive_reset_fn)0x004e0cbbU) /* FUN_004e0cba: EvenHub keepalive

* counter (@0x200745ac) = 0. This is the exact

* leaf the stock sid-0x0c heartbeat handler in

* the EvenHub UI event handler calls; it takes no args and reads

* the counter pointer from its own literal pool. */

#define FW_LOOKUP ((lookup_fn)0x004e0ccfU) /* FUN_004e0cce(id) -> spec node; state=*(node+0x10) */

#define FW_COMPLETE_EMIT ((complete_emit_fn)0x004da383U) /* FUN_004da382: stock image-complete emitter */

#define FW_DISPLAY_WAIT ((display_gate_fn)0x0047381fU) /* FUN_0047381e: take display semaphore */

#define FW_DISPLAY_SIGNAL ((display_gate_fn)0x0047386bU) /* FUN_0047386a: give display semaphore */

#define FW_DISPLAY_QUEUE ((display_queue_fn)0x00474067U) /* FUN_00474066: queue type-3 refresh */

#define FW_DISPLAY_COPY ((display_copy_fn)0x0046ca15U) /* FUN_0046ca14: stock packed-buffer copy */

#define FW_DISPLAY_FB (*(uint8_t * volatile *)0x200007b8U) /* stock copier's 640x480 destination */

#define BUZZ_TIMER_ADDR 0x20074504U /* RAM: buzzer osTimer handle (buzzer osTimer handle global) */

#define ZLIB_VER ((const char *)0x0078d654U) /* "1.1.4" */

#define PANEL_W 640u

#define PANEL_H 480u

#define PANEL_STRIDE (PANEL_W / 2u)

#define PANEL_BYTES (PANEL_STRIDE * PANEL_H)

#define IMAGE_W PANEL_W

#define IMAGE_H PANEL_H

#define IMAGE_STRIDE (IMAGE_W / 2u)

#define IMAGE_BYTES (IMAGE_STRIDE * IMAGE_H)

#define IMAGE_X 0u

#define IMAGE_Y 0u

/* --- glasses-side timing: Arm DWT cycle counter, clock derived by calibration -----

* CYCCNT is a free-running core-cycle counter (~4 ns). To use it we (1) UNLOCK the DWT

* via its CoreSight software-lock register (write 0xC5ACCE55 to LAR at DWT_base+0xFB0)

* — without this, writes to DWT->CTRL are ignored and CYCCNT stays 0 (observed on hw);

* then (2) set DEMCR.TRCENA and DWT->CTRL.CYCCNTENA. We re-assert all three cheaply per

* measurement (only the idle SWO-trace block touches DEMCR).

* To convert cycles->us we need the core clock. The guessed global 0x20074254 reads 0

* on hardware (it's only written on a DVFS event, if ever), so instead we CALIBRATE:

* measure how many CYCCNT cycles elapse across one edge of the firmware's 1 ms OS tick

* (RAM 0x20074a34, SysTick chain) — that IS cycles-per-ms. Cached in the ctx; a bounded

* spin falls back to 250 MHz if the tick never advances. All divides are 32-bit

* (hardware UDIV) — a 64-bit divide would emit an external __aeabi_uldivmod build.py

* rejects. (Limitation: cached across DVFS; a clock switch makes the figure ~stale.) */

#define DWT_DEMCR (*(volatile uint32_t *)0xE000EDFCU) /* CoreDebug->DEMCR (TRCENA bit24) */

#define DWT_LAR (*(volatile uint32_t *)0xE0001FB0U) /* DWT CoreSight Lock Access Reg */

#define DWT_CTRL (*(volatile uint32_t *)0xE0001000U) /* DWT->CTRL (CYCCNTENA bit0) */

#define DWT_CYCCNT (*(volatile uint32_t *)0xE0001004U) /* DWT->CYCCNT (core cycles) */

#define FW_MS_TICK (*(volatile uint32_t *)0x20074a34U) /* firmware 1 ms OS tick (SysTick chain) */

#define FW_CORE_HZ (*(volatile uint32_t *)0x20074254U) /* guessed core-clock global (reads 0 on hw) */

#define DWT_UNLOCK_KEY 0xC5ACCE55U

/* z_stream (zlib 1.1.4, sizeof = 0x38) field offsets */

#define ZS_NEXT_IN 0x00

#define ZS_AVAIL_IN 0x04

#define ZS_NEXT_OUT 0x0c

#define ZS_AVAIL_OUT 0x10

#define ZS_TOTAL_OUT 0x14

#define ZS_ZALLOC 0x20

#define ZS_ZFREE 0x24

#define ZS_OPAQUE 0x28

#define ZS_SIZE 0x38

#define RLE_CHUNK 256 /* mode-3/6 inflate scratch feeding the RLE decoder (stack) */

/* Persistent CFW-owned state that must survive image-container teardown/rebuild.

* The image container (its display buffer A @ state+0x8 and recon buffer B @

* state+0xc) is freed and reallocated on rebuild. The packed shadow lives in A

* only for the lifetime of the current streaming layout and must be seeded by a

* mode-6 keyframe after every rebuild. The bookkeeping that does

* need to survive rebuilds is anchored by a pointer to this struct in a spare

* word of the BLE-RX task context (ble_msgrx, base = *0x004a069c ->

* 0x20003ffc; only its +0x8/+0xc are used by the firmware, and it is never freed).

* We only ever touch that word from inside our image handler, i.e. only after a

* custom-firmware image message has arrived — so if the word is not actually free

* the damage is confined to CFW use and a reboot recovers. The struct's `magic`

* guards against warm-reset garbage; the slot ptr is range-checked before deref. */

#define CFW_FID_RING 16 /* recent mode-3 frame ids kept for duplicate detection */

#define CFW_SNAP_RING 12 /* in-flight compressed-message snapshots (per producer race depth) */

#define CFW_SEQ_MAX 48 /* max steps in a buzzer tone sequence (mode-5 kind 4) */

/* One snapshotted compressed image message. Taken at reconstruction-complete (both

* lenses), consumed FIFO in the deferred handler. Keyed by the owning image-state

* pointer so multiple containers (e.g. faceclaw's 4 tiles) don't cross-feed. */

typedef struct {

uint8_t *state; /* owning image-state (key); 0 = empty slot */

uint8_t *buf; /* malloc'd copy of the reassembled message */

uint32_t len;

uint32_t seq; /* push order, for per-state FIFO */

} cfw_snap;

typedef struct {

uint32_t magic; /* CFW_CTX_MAGIC when valid */

/* --- snapshot FIFO: fixes the producer/consumer race on the shared recon buffer.

* snapshot_side() copies each completed message here (both lenses); image_deferred

* drains this lens's pending snapshots and runs the worker on each, ignoring the

* live (possibly-overwritten) recon buffer B. (The 4bpp shadow of the last frame,

* needed by mode-3 deltas, reuses each container's display buffer A — see

* cfw_shadow_buffer — so it's per-container and costs no extra RAM.) */

cfw_snap snaps[CFW_SNAP_RING];

uint32_t snap_seq; /* next push sequence number */

/* --- diagnostics, overlaid as a text line (verify the fix; should stay clear). Mode

* 7 clears the flags / toggles the overlay visibility (diag_hide). --- */

uint16_t last_fid; /* last frame id seen (mode-3 messages) */

uint16_t high_fid; /* highest frame id seen */

uint8_t diag_seen; /* recorded at least one frame yet */

uint8_t fid_resync; /* keyframe rebaselines the next delta's fid (no false skip) */

uint8_t diag_hide; /* 1 = don't draw the flag overlay (default 0 = visible) */

uint32_t last_worker_us; /* image_worker() duration of the PREVIOUS message (overlay) */

uint32_t last_present_us; /* present_shadow() duration of the PREVIOUS present (overlay) */

uint32_t cyc_per_ms; /* calibrated DWT cycles per 1 ms OS tick (0 = not yet done) */

uint8_t f_reorder; /* FLAG: ever saw a frame id go backward */

uint8_t f_skip; /* FLAG: ever saw a frame id gap (skipped) */

uint8_t f_dup; /* FLAG: ever saw a duplicate frame id (in the recent ring) */

uint8_t f_snap_of; /* FLAG: snapshot ring overflowed (dropped an in-flight frame) */

uint16_t recent_fids[CFW_FID_RING]; /* ring of the last N mode-3 frame ids seen */

uint8_t recent_pos; /* next write index into recent_fids */

/* --- buzzer tone sequencer (mode-5 kind 4). Plays a list of (freq,duty,ms)

* steps back-to-back on OUR OWN one-shot osTimer — the firmware buzzer timer's

* callback is the fixed note-walker, which can't emit arbitrary frequencies.

* State lives in this singleton so it survives the handler return and is

* reachable from seq_tick (the timer callback, in the RTOS timer thread). --- */

uint32_t seq_timer; /* our osTimer handle; created lazily, reused, never freed */

uint8_t seq_count; /* steps in the current sequence (0 = idle) */

uint8_t seq_cursor; /* index of the next step to play */

uint8_t seq_steps[CFW_SEQ_MAX * 5]; /* freqLo,freqHi,duty,msLo,msHi per step */

/* --- Faceclaw wake takeover. A volatile, fail-open ownership lease lets

* Faceclaw defer the stock dashboard only while its phone process is

* demonstrably alive. See settings_ext.c for the private sid-0x09 control

* protocol and the double-tap / Even AI entry hooks. */

uint32_t wake_lease_deadline; /* FW_MS_TICK deadline; 0 = no owner */

uint32_t wake_fallback_timer; /* one-shot stock-dashboard fallback */

uint16_t wake_nonce; /* current pending wake, 0 = none */

uint8_t wake_dashboard_pending; /* dashboard request held for Faceclaw */

uint8_t wake_notify_buf[16]; /* stable storage for sid-0x09 notify */

uint8_t wear_notify_buf[12]; /* stable storage for sid-0x10 wear notify */

/* Direct-framebuffer job. The EvenHub worker holds the stock display gate

* before it mutates the shadow and until the display task consumes this

* pointer, so no second snapshot or full-size display buffer is required. */

const uint8_t *direct_shadow;

volatile uint8_t direct_pending;

uint8_t direct_failed;

uint8_t direct_active; /* physical framebuffer currently owns the image */

uint32_t direct_lease_deadline; /* fail-open repaint-guard deadline */

} customCfwContext;

#define CFW_CTX_SLOT 0x20003ffcU /* ble_msgrx context +0x0 (spare, never freed) */

#define CFW_CTX_MAGIC 0xC0FFEE62U /* bumped for the wear-notify buffer */

void *zwrap_alloc(void *opaque, uint32_t items, uint32_t size) {

(void)opaque;

return FW_MALLOC(items * size);

}

void zwrap_free(void *opaque, void *ptr) {

(void)opaque;

FW_FREE(ptr);

}

/* Buzzer tone-sequence timer callback (mode-5 kind 4). Plays seq_steps[cursor],

* advances the cursor, and re-arms this timer for that step's ms; after the final

* step's ms elapses it powers the PWM off and goes idle. `arg` is the singleton

* context (passed as the osTimer argument at creation). Runs in the RTOS timer

* thread — the only shared state is the singleton, guarded by magic + bounds.

* Non-static (external linkage) so -O2 keeps it despite having no direct caller —

* osTimerNew only ever receives it as a fn-ptr value. */

void seq_tick(void *arg) {

customCfwContext *ctx = (customCfwContext *)arg;

if (ctx == 0 || ctx->magic != CFW_CTX_MAGIC) return;

uint32_t c = ctx->seq_cursor;

if (c >= ctx->seq_count) { /* final step's ms elapsed -> sequence done */

ctx->seq_count = 0;

FW_BUZZ_RESET(); /* PWM off */

return;

}

const uint8_t *s = &ctx->seq_steps[c * 5];

uint32_t freq = (uint32_t)s[0] | ((uint32_t)s[1] << 8);

uint32_t duty = s[2];

uint32_t ms = (uint32_t)s[3] | ((uint32_t)s[4] << 8);

if (freq < 1) freq = 1;

if (freq > 20000) freq = 20000;

if (duty > 100) duty = 100;

if (ms < 1) ms = 1;

ctx->seq_cursor = (uint8_t)(c + 1);

if (duty == 0) FW_BUZZ_RESET(); /* duty 0 = rest: silent for ms */

else FW_BUZZ_RAW(freq, duty); /* start this tone */

if (ctx->seq_timer) FW_TIMER_START(ctx->seq_timer, ms);

}

static void push_display(uint8_t *state, uint8_t *disp, uint32_t w, uint32_t h);

static void unpack4bpp(uint8_t *dst, uint32_t dst_stride, const uint8_t *pix,

uint32_t w, uint32_t h, uint32_t src_stride, int bottom_up);

static int load_bmp_fast(uint8_t *state, const uint8_t *bmp, uint32_t len);

static customCfwContext *peekCustomCfwContext(void);

static customCfwContext *getCustomCfwContext(void);

static uint8_t *cfw_shadow_buffer(uint8_t *state);

static void bzero(uint8_t *buf, uint32_t len);

static int is_shadow_message(const uint8_t *src, uint32_t srclen);

static int cfw_diag(int has_fid, uint16_t fid);

static void cfw_draw_flags(uint8_t *disp, uint32_t w, uint32_t h);

static uint32_t rd16(const uint8_t *p);

/* Per-frame list of updated rectangles (pixel coords), assembled on the stack of the

* top-level image_worker and threaded through image_dispatch; present_shadow outlines

* them in the display buffer when the debug overlay is on, to visualize update regions. */

#define CFW_RECT_MAX 16

typedef struct { uint16_t l, t, w, h; } cfw_rect;

typedef struct {

uint32_t n;

uint8_t direct_submitted;

cfw_rect r[CFW_RECT_MAX];

} cfw_rectlist;

static void rl_add(cfw_rectlist *rl, uint32_t l, uint32_t t, uint32_t w, uint32_t h);

static int inflate_rle(uint8_t *strm, uint8_t *base, uint32_t stride,

uint32_t rowbytes, uint32_t rows);

static void present_shadow(uint8_t *state, uint32_t w, uint32_t h, cfw_rectlist *rl);

static void rect_copy_4bpp(uint8_t *buf, uint32_t stride, uint32_t sL, uint32_t sT,

uint32_t dL, uint32_t dT, uint32_t bw, uint32_t bh);

static int image_dispatch(uint8_t *state, const uint8_t *src, uint32_t srclen,

int present, cfw_rectlist *rl);

static uint32_t strlcpy(char *dst, const char *src, uint32_t len);

static uint32_t strnlen(const char *s, uint32_t maxlen);

static uint32_t strlcat(char *dst, const char *str, uint32_t len);

/* Calibrate DWT cycles-per-millisecond against the firmware's 1 ms OS tick, once,

* cached in the ctx. DWT must already be unlocked + enabled. Bounded spin across two

* tick edges (~1-2 ms when the tick runs); returns 0 if the tick never advances (the

* caller then falls back to an assumed clock). */

static uint32_t cfw_cyc_per_ms(customCfwContext *ctx) {

if (ctx->cyc_per_ms) return ctx->cyc_per_ms;

uint32_t g = 500000u;

uint32_t t0 = FW_MS_TICK;

while (FW_MS_TICK == t0 && --g) ; /* wait for a tick edge */

if (g == 0) return 0;

uint32_t c0 = DWT_CYCCNT, t1 = FW_MS_TICK;

g = 500000u;

while (FW_MS_TICK == t1 && --g) ; /* wait for the next edge (~1 ms) */

if (g == 0) return 0;

ctx->cyc_per_ms = DWT_CYCCNT - c0; /* cycles elapsed across one 1 ms tick */

return ctx->cyc_per_ms;

}

/* Time a region of code with the DWT cycle counter (see the timing note above):

* uint32_t t; cfw_time_start(&t); ...work...; uint32_t us = cfw_time_end(&t);

* start re-asserts the DWT unlock/enable (cheap, and the state is not ours to assume)

* and calibrates cycles-per-ms if that hasn't happened yet — deliberately BEFORE the

* start stamp is taken, so the one-time ~1-2 ms calibration spin is never billed to the

* region being measured. Regions may nest: by the time an inner start runs, the outer

* one has already primed the calibration. end converts to microseconds; the subtraction

* is unsigned, so it tolerates one CYCCNT wrap (~17 s at 250 MHz). */

static void cfw_time_start(uint32_t *t) {

DWT_LAR = DWT_UNLOCK_KEY; /* unlock the DWT (CoreSight lock) */

DWT_DEMCR |= (1u << 24); /* TRCENA */

DWT_CTRL |= 1u; /* CYCCNTENA */

customCfwContext *ctx = getCustomCfwContext();

if (ctx) cfw_cyc_per_ms(ctx); /* calibrate once, outside the window */

*t = DWT_CYCCNT;

}

static uint32_t cfw_time_end(const uint32_t *t) {

uint32_t dc = DWT_CYCCNT - *t;

customCfwContext *ctx = getCustomCfwContext();

uint32_t cpm = ctx ? cfw_cyc_per_ms(ctx) : 0; /* calibrated cycles/ms (cached) */

uint32_t cyc_per_us = cpm ? (cpm / 1000u) : 250u; /* fallback: assume 250 MHz */

if (cyc_per_us == 0) cyc_per_us = 1;

return dc / cyc_per_us;

}

/* True for top-level messages that can mutate/present the custom 4bpp shadow.

* Mode 8 is included because its nested operations are modes 3/6/9. */

static int is_shadow_message(const uint8_t *src, uint32_t srclen) {

if (src == 0 || srclen == 0) return 0;

uint8_t mode = src[0] & 0x7fu;

return mode == 3 || mode == 6 || mode == 8 || mode == 9;

}

/* The image worker: static, called from image_deferred (the deferred consumer, which

* runs on BOTH lenses via the cross-lens-synchronized completion message). NOTE: image

* handling lives here / in the deferred path on purpose — the sync-completion path

* (image_complete) runs on only the RECEIVING lens, so doing the work there leaves the

* other lens blank. image_worker kicks the keepalive once per top-level message, then

* defers to image_dispatch (which recurses for multi-segment messages). */

static int image_worker(void *state_, uint8_t *src, uint32_t srclen) {

/* An inbound image message proves the phone is still connected, so kick the

* EvenHub keepalive back to life exactly as the stock heartbeat handler does.

* Stock firmware resets the ticks-since-last-heartbeat counter (@0x200745ac)

* ONLY on the sid-0x0c heartbeat message; the periodic evenhub_ui_event_handler

* (FUN_00506460, param_1==4) increments it every tick and, once it passes 899,

* fires FUN_004fee62(0,0) -> "DISPLAY_AUTO_REFLASH heartbeat timeout" -> the

* "Connection lost" context teardown. A client streaming image updates to

* maximize throughput would otherwise have to interleave heartbeats to avoid

* that teardown; resetting here lets a steady image stream keep the context

* alive on its own. Placed before any dispatch so every mode (image, delta,

* stereo, sound, BMP) counts as liveness. Runs on the same evenhub task that

* owns the counter, so no locking is needed. */

FW_KEEPALIVE_RESET();

/* Time this whole message. The display-task overlay can run before this worker

* stores the new value, so its worker duration may lag by one update. */

cfw_rectlist rl; /* per-frame updated-rect list (stack) */

rl.n = 0;

rl.direct_submitted = 0;

/* Shadow updates bypass LVGL, but still use the stock display task to refresh

* the panel. Take its gate before touching the shared shadow and leave it held

* through the queued refresh; the stock task signals it after display_copy_hook.

* This prevents the next pipelined delta from changing the shadow while the hook

* is copying it. Non-image control messages never take the gate. */

customCfwContext *ctx = getCustomCfwContext();

int gated = is_shadow_message(src, srclen);

if (gated) {

if (ctx == 0) return -1;

FW_DISPLAY_WAIT();

if (ctx->direct_pending) return -1; /* timed out; caller does not own gate */

}

uint32_t t;

cfw_time_start(&t);

int r = image_dispatch((uint8_t *)state_, src, srclen, 1, &rl);

uint32_t us = cfw_time_end(&t);

if (gated && !rl.direct_submitted) FW_DISPLAY_SIGNAL();

if (ctx) ctx->last_worker_us = us;

return r;

}

/* Dispatch one message. `present`=1 means push the result to the panel now; a

* multi-segment message (mode 8) dispatches each sub-message with present=0 (so they

* only mutate the shadow) and then presents once, giving an atomic multi-op update

* (e.g. scroll = rect-copy + delta). The high bit of the mode byte is the "lenses

* differ" flag; most modes ignore it. */

static int image_dispatch(uint8_t *state, const uint8_t *src, uint32_t srclen,

int present, cfw_rectlist *rl) {

if (src == 0 || srclen < 1) return load_bmp_fast(state, src, srclen);

int lenses_differ = src[0] & 0x80; /* high bit: per-lens variant */

uint8_t mode = src[0] & 0x7f;

if (mode == 0x42) return load_bmp_fast(state, src, srclen); /* raw BMP */

if (mode == 5) {

/* play a UI sound on the buzzer; no display change. [5][kind][args...].

* kinds 0-3 use firmware entry points that copy their args into fw-owned

* storage (preset table is flash; PlayNote copies into an 8-byte scratch;

* raw uses a one-shot on the buzzer's own timer), so the recon buffer is

* free to be reused immediately. kind 4 (tone sequence) steps through our

* own osTimer whose callback (seq_tick) reads the sequence out of the

* persistent CFW context. */

uint8_t kind = (srclen >= 2) ? src[1] : 0xffu;

customCfwContext *ctx = getCustomCfwContext();

/* Any new sound supersedes an in-flight tone sequence — otherwise seq_tick

* would keep reprogramming the PWM underneath it. Stop our sequencer first

* (same handler thread; mirrors the firmware's stop-before-restart order). */

if (ctx && ctx->seq_count) {

if (ctx->seq_timer) FW_TIMER_STOP(ctx->seq_timer);

ctx->seq_count = 0;

}

if (kind == 0 && srclen >= 3) { /* preset 0..8 */

if (src[2] <= 8) FW_BUZZ_PRESET(src[2]);

} else if (kind == 1 && srclen >= 5) { /* single tone */

uint8_t note = src[2], oct = src[3], beat = src[4];

/* note 1..7 x oct 0..3 keeps the freq-table index in [0,27] so the

* driver's `1000000 / (0xffff - table[idx])` can never divide by 0 */

if (note >= 1 && note <= 7 && oct <= 3 && beat != 0)

FW_BUZZ_NOTE(note, oct, beat);

} else if (kind == 2) { /* stop / silence */

FW_BUZZ_RESET();

} else if (kind == 3 && srclen >= 7) { /* raw tone: freq/duty/ms */

uint32_t freq = (uint32_t)src[2] | ((uint32_t)src[3] << 8);

uint32_t duty = src[4];

uint32_t ms = (uint32_t)src[5] | ((uint32_t)src[6] << 8);

if (freq < 1) freq = 1; /* freq 0 -> bad PWM period */

if (freq > 20000) freq = 20000; /* hw range per AT^BUZZER */

if (duty > 100) duty = 100; /* duty is a 0..100 percent */

if (ms < 1) ms = 1;

FW_BUZZ_RAW(freq, duty); /* reset+power+PWM; note list now null */

uint32_t h = *(volatile uint32_t *)BUZZ_TIMER_ADDR;

if (h) FW_TIMER_START(h, ms); /* callback stops PWM after ms */

} else if (kind == 4 && srclen >= 3 && ctx) { /* tone sequence */

/* [4][nSteps][ (freqLo,freqHi,duty,msLo,msHi) x nSteps ]. Copy the steps

* into the persistent context, create our one-shot osTimer once (arg =

* ctx, so seq_tick can find the state), and kick it — seq_tick plays

* step 0 and chains the rest, auto-stopping after the last step's ms. */

uint32_t avail = (srclen - 3) / 5;

uint32_t n = src[2];

if (n > avail) n = avail;

if (n > CFW_SEQ_MAX) n = CFW_SEQ_MAX;

for (uint32_t i = 0; i < n * 5; i++) ctx->seq_steps[i] = src[3 + i];

ctx->seq_count = (uint8_t)n;

ctx->seq_cursor = 0;

if (n) {

if (ctx->seq_timer == 0)

ctx->seq_timer = FW_TIMER_NEW((void *)&seq_tick, 0, ctx, 0);

if (ctx->seq_timer) FW_TIMER_START(ctx->seq_timer, 1); /* kick: seq_tick runs step 0 */

else { ctx->seq_count = 0; FW_BUZZ_RESET(); } /* timer create failed */

}

return 0;

}

if (mode == 7) {

/* Diagnostic control (no display change). [7][sub]:

* 0 -> clear the sticky flags and frame-order tracking (use between tests)

* 1 -> hide the flag overlay 2 -> show the flag overlay

* Runs on both lenses via the normal snapshot/deferred path, so it clears/toggles

* both eyes. */

customCfwContext *ctx = getCustomCfwContext();

uint8_t sub = (srclen >= 2) ? src[1] : 0xffu;

if (ctx) {

if (sub == 0) {

ctx->f_reorder = ctx->f_skip = ctx->f_dup = ctx->f_snap_of = 0;

ctx->diag_seen = ctx->fid_resync = 0;

ctx->last_fid = ctx->high_fid = 0;

for (uint32_t i = 0; i < CFW_FID_RING; i++) ctx->recent_fids[i] = 0xffff;

ctx->recent_pos = 0;

} else if (sub == 1) {

ctx->diag_hide = 1;

} else if (sub == 2) {

ctx->diag_hide = 0;

}

return 0;

}

/* Custom shadow geometry is deliberately independent from the EvenHub carrier. */

uint32_t w = IMAGE_W;

uint32_t h = IMAGE_H;

if (mode == 8) {

/* Multi-segment: [8][count][len16][submsg]... — dispatch each sub with

* present=0 (mutate the shadow only), then present once, giving an atomic

* multi-op update (e.g. scroll = rect-copy + delta, no intermediate flash).

* Sized no larger than an uncompressed 4bpp logical image; no nesting

* (a sub-message may not itself be a multi-segment message). Only shadow

* operations (modes 3/6/9) are accepted. */

if (!present) return -1; /* only valid at top level */

if (srclen < 2) return -1;

uint32_t bmp_max = 118 + ((((w + 1) >> 1) + 3) & ~3u) * h;

if (srclen > bmp_max) return -1;

uint32_t count = src[1];

uint32_t pos = 2;

for (uint32_t i = 0; i < count; i++) {

if (pos + 2 > srclen) return -1;

uint32_t seglen = rd16(src + pos);

pos += 2;

if (seglen < 1 || pos + seglen > srclen) return -1;

uint8_t submode = src[pos] & 0x7fu;

if (submode != 3 && submode != 6 && submode != 9) return -1;

if (image_dispatch(state, src + pos, seglen, 0, rl) != 0) return -1;

pos += seglen;

}

present_shadow(state, w, h, rl); /* one atomic present */

return 0;

}

if (mode == 9) {

/* Rect-copy within the 4bpp shadow: move a block from a source rect to a

* destination rect (full uint16 coords; the rects may overlap). Both rects must

* be the same size and wholly in bounds. With the lenses-differ flag there are

* two rect-sets (left then right) and each lens uses its own. rect_copy_4bpp

* takes a whole-byte fast path when left/width are even, else a nibble path.

* Pairs with a follow-up delta (usually in one mode-8 message) to scroll. */

const uint8_t *r = src + 1;

uint32_t need = lenses_differ ? 32u : 16u; /* 8 bytes per rect, 2 or 4 rects */

if (srclen < 1 + need) return -1;

if (lenses_differ && FW_SIDE() != 2) r += 16; /* right lens uses the 2nd set */

uint32_t sL = rd16(r), sT = rd16(r + 2), sW = rd16(r + 4), sH = rd16(r + 6);

uint32_t dL = rd16(r + 8), dT = rd16(r + 10), dW = rd16(r + 12), dH = rd16(r + 14);

if (sW == 0 || sH == 0 || sW != dW || sH != dH) return -1; /* copy = same size */

if (sL + sW > w || sT + sH > h || dL + dW > w || dT + dH > h) return -1; /* bounds */

uint8_t *shadow = cfw_shadow_buffer(state);

if (shadow == 0) return -1;

rect_copy_4bpp(shadow, (w + 1) >> 1, sL, sT, dL, dT, sW, sH);

rl_add(rl, dL, dT, dW, dH); /* updated region = destination rect */

if (present) present_shadow(state, w, h, rl);

return 0;

}

if ((mode != 3 && mode != 6) || srclen < 3)

return load_bmp_fast(state, src, srclen);

const uint8_t *zsrc = src + 1;

uint32_t zlen = srclen - 1;

uint8_t strm[ZS_SIZE];

for (uint32_t i = 0; i < ZS_SIZE; i++) strm[i] = 0;

*(const uint8_t **)(strm + ZS_NEXT_IN) = zsrc;

*(uint32_t *)(strm + ZS_AVAIL_IN) = zlen;

*(uint32_t *)(strm + ZS_ZALLOC) = (uint32_t)(uintptr_t)&zwrap_alloc;

*(uint32_t *)(strm + ZS_ZFREE) = (uint32_t)(uintptr_t)&zwrap_free;

*(uint32_t *)(strm + ZS_OPAQUE) = 0;

if (mode == 6) {

/* Full headerless 4bpp frame. Inflate + RLE-decode it into the persistent

* shadow (this container's display allocation A) that mode-3 deltas composite

* onto, so a mode-6 keyframe seeds a stable base, then present (unless

* deferred by a multi-segment wrapper). */

cfw_diag(0, 0); /* keyframe: rebaseline delta fid */

uint32_t stride = (w + 1) >> 1; /* tight 4bpp */

uint8_t *dst = cfw_shadow_buffer(state);

if (dst == 0) return -1; /* no shadow allocation -> can't proceed */

if (!inflate_rle(strm, dst, stride, stride, h)) return -1;

rl_add(rl, 0, 0, w, h); /* keyframe updates the whole screen */

if (present) present_shadow(state, w, h, rl);

return 0;

}

if (mode == 3) {

/* Bounding-box delta, composited onto a PERSISTENT 4bpp shadow of the last

* frame kept in this container's display allocation (see cfw_shadow_buffer),

* then the packed shadow is queued for a direct framebuffer refresh.

* The stale-base race that used to force a CFW-owned shadow is now fixed at the

* source: the worker runs on a per-frame SNAPSHOT (drained in order by

* image_deferred), not the live recon buffer, so successive deltas compose onto

* the shadow in the right order. The shadow is stable in A, while B remains

* dedicated to reassembly and can use its full carrier-sized allocation.

* [3][left/4][top/2][width/4][height/2][fid_lo][fid_hi][zlib(rle(box pixels))]

* left/width are *4 (=> multiples of 4 => even) so left>>1 and bw>>1 are whole

* byte offsets: each box row lands in the 4bpp shadow as a plain byte run, no

* nibble shifting. fid is a uint16 per-frame counter (diagnostics). Rejected

* (old frame kept) if the box isn't wholly in bounds. The sender must have sent

* a mode-6 keyframe before/among deltas.

* lenses-differ variant: [3|80][Lbox 4][Rbox 4][fid 2][shared zlib]. Both boxes

* must be the same size; each lens draws the SAME decompressed pixels at its own

* box — a stereo shift (e.g. a raised dialog) with the pixel data sent once. */

uint32_t box_off, fid_off, z_off;

if (lenses_differ) {

if (srclen < 12) return -1; /* mode + 2 boxes + fid + some zlib */

if (src[3] != src[7] || src[4] != src[8]) return -1; /* boxes must match size */

box_off = (FW_SIDE() == 2) ? 1 : 5; /* left set / right set */

fid_off = 9;

z_off = 11;

} else {

if (srclen < 8) return -1; /* 4 box hdr + 2 fid + some zlib */

box_off = 1;

fid_off = 5;

z_off = 7;

}

uint32_t left = (uint32_t)src[box_off] * 4;

uint32_t top = (uint32_t)src[box_off + 1] * 2;

uint32_t bw = (uint32_t)src[box_off + 2] * 4;

uint32_t bh = (uint32_t)src[box_off + 3] * 2;

uint16_t fid = (uint16_t)rd16(src + fid_off);

if (bw == 0 || bh == 0 || left + bw > w || top + bh > h) return -1;

/* Duplicate frame id (re-processed message) -> skip: re-applying a delta

* out of order corrupts the shadow. Leaves the current frame on screen. */

if (cfw_diag(1, fid)) return 0; /* dup fid -> skip (records order/skip) */

uint32_t sstride = (w + 1) >> 1; /* 4bpp shadow row stride */

uint8_t *shadow = cfw_shadow_buffer(state); /* persistent last frame (buffer A) */

if (shadow == 0) return -1; /* no stable base -> keyframe resyncs */

uint32_t rowbytes = bw >> 1; /* whole bytes (bw even) */

*(const uint8_t **)(strm + ZS_NEXT_IN) = src + z_off; /* zlib past box(es) + fid */

*(uint32_t *)(strm + ZS_AVAIL_IN) = srclen - z_off;

/* Decode the box straight into its slot in the shadow: rows of rowbytes bytes

* at the shadow's stride. left/bw are multiples of 4 so every row starts (and

* ends) on a byte boundary. */

if (!inflate_rle(strm, shadow + top * sstride + (left >> 1), sstride, rowbytes, bh))

return -1; /* leave the old frame on screen */

rl_add(rl, left, top, bw, bh); /* updated region = this lens's box */

if (present) present_shadow(state, w, h, rl); /* queue one full packed refresh */

return 0;

}

return -1;

}

/* Append (l,t,w,h) to the per-frame updated-rect list, if there's room. */

static void rl_add(cfw_rectlist *rl, uint32_t l, uint32_t t, uint32_t w, uint32_t h) {

if (rl && rl->n < CFW_RECT_MAX) {

rl->r[rl->n].l = (uint16_t)l; rl->r[rl->n].t = (uint16_t)t;

rl->r[rl->n].w = (uint16_t)w; rl->r[rl->n].h = (uint16_t)h;

rl->n++;

}

/* Publish this container's packed-4bpp shadow to the stock display task. image_worker

* already owns the stock display gate, so the shadow cannot change until the task has

* copied it. The display task consumes this job in display_copy_hook immediately before

* its normal panel refresh, bypassing LVGL and the stock 576x288 compositor copy. */

static void present_shadow(uint8_t *state, uint32_t w, uint32_t h, cfw_rectlist *rl) {

customCfwContext *ctx = getCustomCfwContext();

uint8_t *shadow = cfw_shadow_buffer(state);

if (ctx == 0 || shadow == 0 || w != IMAGE_W || h != IMAGE_H) return;

ctx->direct_shadow = shadow;

ctx->direct_pending = 1; /* publish last */

if (FW_DISPLAY_QUEUE(0, 0, 0, 0, PANEL_W, PANEL_H) != 0) {

ctx->direct_pending = 0;

ctx->direct_shadow = 0;

return;

}

if (rl) rl->direct_submitted = 1;

}

/* Copy a bw x bh block of 4bpp pixels within one buffer (stride bytes/row) from

* (sL,sT) to (dL,dT). The rects may overlap: iteration direction is chosen per axis

* like a 2D memmove (bottom-up when the destination is lower, right-to-left when it is

* further right). Fast whole-byte path when sL, dL and bw are all even; otherwise a

* per-pixel nibble path (high nibble = the left / even pixel). */

static void rect_copy_4bpp(uint8_t *buf, uint32_t stride, uint32_t sL, uint32_t sT,

uint32_t dL, uint32_t dT, uint32_t bw, uint32_t bh) {

int rev_y = (dT > sT);

int rev_x = (dL > sL);

if ((sL & 1) == 0 && (dL & 1) == 0 && (bw & 1) == 0) {

uint32_t bytes = bw >> 1;

for (uint32_t i = 0; i < bh; i++) {

uint32_t y = rev_y ? (bh - 1 - i) : i;

uint8_t *srow = buf + (sT + y) * stride + (sL >> 1);

uint8_t *drow = buf + (dT + y) * stride + (dL >> 1);

if (rev_x) { for (uint32_t x = bytes; x-- > 0; ) drow[x] = srow[x]; }

else { for (uint32_t x = 0; x < bytes; x++) drow[x] = srow[x]; }

}

} else {

for (uint32_t i = 0; i < bh; i++) {

uint32_t y = rev_y ? (bh - 1 - i) : i;

uint8_t *srow = buf + (sT + y) * stride;

uint8_t *drow = buf + (dT + y) * stride;

for (uint32_t j = 0; j < bw; j++) {

uint32_t x = rev_x ? (bw - 1 - j) : j;

uint32_t sx = sL + x, dx = dL + x;

uint8_t sv = (sx & 1) ? (srow[sx >> 1] & 0x0f) : (uint8_t)(srow[sx >> 1] >> 4);

uint8_t *db = &drow[dx >> 1];

if (dx & 1) *db = (uint8_t)((*db & 0xf0) | sv);

else *db = (uint8_t)((*db & 0x0f) | (uint8_t)(sv << 4));

}

/* ---- RLE over 4bpp pixels (the inner layer of modes 3 and 6) ----------------

* See the RLE paragraph at the top of the file for the token format. The decoder is a

* byte-at-a-time state machine so it can be driven straight from inflate's output in

* small chunks (a token may straddle a chunk boundary), writing pixels into a

* rectangular 4bpp destination: `rows` rows of `rowbytes` bytes, row r at

* base + r*stride. For mode 6 that's the whole shadow; for mode 3 it's the box within

* it (rowbytes < stride). Runs cross rows freely — the nibble stream is the wire

* order, not per-row.

* `left` counts the nibbles still expected; the decode is complete only when it hits

* exactly 0 with no token half-parsed. Overrunning it (or running past the last row)

* sets `err` and the caller drops the frame. */

typedef struct {

uint8_t *base;

uint32_t stride; /* bytes between rows in the destination */

uint32_t rowbytes; /* bytes per row actually written */

uint32_t rows;

uint32_t r; /* current row */

uint32_t bpos; /* byte offset within the current row */

uint32_t hi; /* 1 = next nibble is the high (left) one */

uint32_t left; /* nibbles still expected */

uint32_t st; /* token parser: 0 = opcode, 1 = cnt8, 2 = cntLo, 3 = cntHi */

uint32_t cnt;

uint8_t color;

uint8_t err;

} rle_state;

static void rle_init(rle_state *s, uint8_t *base, uint32_t stride,

uint32_t rowbytes, uint32_t rows) {

s->base = base; s->stride = stride; s->rowbytes = rowbytes; s->rows = rows;

s->r = 0; s->bpos = 0; s->hi = 1;

s->left = rowbytes * rows * 2;

s->st = 0; s->cnt = 0; s->color = 0; s->err = 0;

}

/* Write `n` pixels of color `v`. Aligned whole-byte spans are filled a byte at a time

* (both nibbles at once, v*0x11); only a leading/trailing odd nibble is read-modify-

* written. */

static void rle_emit(rle_state *s, uint8_t v, uint32_t n) {

if (n > s->left) { s->err = 1; return; } /* overruns the frame -> malformed */

s->left -= n;

uint8_t pair = (uint8_t)(v * 0x11u);

while (n) {

if (s->r >= s->rows) { s->err = 1; return; }

uint8_t *row = s->base + s->r * s->stride;

if (!s->hi) { /* finish the byte we're inside */

row[s->bpos] = (uint8_t)((row[s->bpos] & 0xf0u) | v);

s->bpos++; s->hi = 1; n--;

} else {

uint32_t avail = s->rowbytes - s->bpos; /* whole bytes left in this row */

uint32_t bytes = n >> 1;

if (bytes > avail) bytes = avail;

for (uint32_t i = 0; i < bytes; i++) row[s->bpos + i] = pair;

s->bpos += bytes; n -= bytes * 2;

if (n && s->bpos < s->rowbytes) { /* odd tail: open the next byte */

row[s->bpos] = (uint8_t)((row[s->bpos] & 0x0fu) | (uint8_t)(v << 4));

s->hi = 0; n--;

}

if (s->hi && s->bpos >= s->rowbytes) { s->bpos = 0; s->r++; } /* next row */

}

/* Feed `n` bytes of RLE stream. Stops early (leaving err set) on a malformed stream. */

static void rle_feed(rle_state *s, const uint8_t *p, uint32_t n) {

for (uint32_t i = 0; i < n && !s->err; i++) {

uint8_t b = p[i];

if (s->st == 0) {

s->color = (uint8_t)(b & 0x0fu);

uint32_t c = b >> 4;

if (c) rle_emit(s, s->color, c); /* short form: count in the high nibble */

else s->st = 1; /* escape: count follows */

} else if (s->st == 1) {

if (b) { rle_emit(s, s->color, b); s->st = 0; }

else s->st = 2; /* second escape: 16-bit count follows */

} else if (s->st == 2) {

s->cnt = b; s->st = 3;

} else {

s->cnt |= (uint32_t)b << 8;

if (s->cnt == 0) s->err = 1; /* a 0-length run can't be encoded */

else rle_emit(s, s->color, s->cnt);

s->st = 0;

}

/* Inflate an already-primed z_stream (NEXT_IN/AVAIL_IN set by the caller) and RLE-decode

* its output into the rectangular 4bpp destination, streaming through a stack chunk so

* no scratch buffer is allocated for either layer. Returns 1 only when the zlib stream

* ends AND the RLE stream filled the destination exactly. */

static int inflate_rle(uint8_t *strm, uint8_t *base, uint32_t stride,

uint32_t rowbytes, uint32_t rows) {

if (FW_INIT2(strm, 15, ZLIB_VER, ZS_SIZE) != 0) { FW_END(strm); return 0; }

rle_state rs;

rle_init(&rs, base, stride, rowbytes, rows);

uint8_t chunk[RLE_CHUNK];

int ok = 0;

for (;;) {

*(uint8_t **)(strm + ZS_NEXT_OUT) = chunk;

*(uint32_t *)(strm + ZS_AVAIL_OUT) = RLE_CHUNK;

int r = FW_INFLATE(strm, 0); /* Z_NO_FLUSH */

uint32_t got = (uint32_t)(*(uint8_t **)(strm + ZS_NEXT_OUT) - chunk);

rle_feed(&rs, chunk, got);

if (rs.err) break; /* malformed RLE */

if (r == 1) { ok = (rs.left == 0 && rs.st == 0); break; } /* Z_STREAM_END */

if (r != 0 || got == 0) break; /* inflate error, or no progress */

}

FW_END(strm);

return ok;

}

/* Replicate FUN_0050164a's tail: clean the display buffer out of dcache, set the

* LVGL image descriptor for an 8bpp (cf=0x619) w*h image, rebind and invalidate.

* (Defined after load_image_z so the entry offset, hence the bl target, is fixed.) */

static void push_display(uint8_t *state, uint8_t *disp, uint32_t w, uint32_t h) {

uint32_t wh = w * h;

uint32_t desc[2];

desc[0] = (uint32_t)(uintptr_t)disp;

desc[1] = wh;

FW_FLUSH(desc);

*(uint32_t *)(state + 0x24) = 0x619u; /* cf/header */

*(uint32_t *)(state + 0x2c) = (*(uint32_t *)(state + 0x2c) & 0xffff0000u) | w;

*(uint32_t *)(state + 0x28) = (h << 16) | w;

*(uint32_t *)(state + 0x30) = wh;

*(uint32_t *)(state + 0x34) = (uint32_t)(uintptr_t)disp;

uint32_t obj = *(uint32_t *)(state + 4);

FW_SETSRC(obj, state + 0x24);

FW_INVAL(obj);

}

/* little-endian unaligned reads (byte-wise; -mno-unaligned-access safe) */

static uint32_t rd16(const uint8_t *p) { return (uint32_t)p[0] | ((uint32_t)p[1] << 8); }

static uint32_t rd32(const uint8_t *p) {

return (uint32_t)p[0] | ((uint32_t)p[1] << 8) | ((uint32_t)p[2] << 16) | ((uint32_t)p[3] << 24);

}

/* Expand a w*h block of 4bpp pixels (2 px/byte, high nibble = left pixel) into an

* 8bpp destination: nibble n (0..15) -> n*17 (== (n<<4)|n) so 0->0, 15->255.

* `src_stride` is bytes per source row; `dst_stride` is bytes per destination row

* (= the full display width when writing a sub-rectangle); `bottom_up` flips the

* source row order (BMP). */

static void unpack4bpp(uint8_t *dst, uint32_t dst_stride, const uint8_t *pix,

uint32_t w, uint32_t h, uint32_t src_stride, int bottom_up) {

for (uint32_t y = 0; y < h; y++) {

uint32_t srcY = bottom_up ? (h - 1 - y) : y;

const uint8_t *row = pix + srcY * src_stride;

uint8_t *out = dst + y * dst_stride;

for (uint32_t x = 0; x < w; x++) {

uint8_t b = row[x >> 1];

uint8_t nib = (x & 1) ? (b & 0x0f) : (uint8_t)(b >> 4);

out[x] = (uint8_t)(nib * 17);

}

/* Fast replacement for the stock BMP loader FUN_0050164a: decode a 4bpp indexed

* BMP straight into the 8bpp display buffer via unpack4bpp, ignoring the palette

* (always the gray ramp) and skipping the per-pixel color calls + CRC pass. Only

* width/height/bpp/pixel-offset are read from the header. Falls back to the stock

* loader for anything that isn't a 4bpp BMP matching the container dimensions. */

static int load_bmp_fast(uint8_t *state, const uint8_t *bmp, uint32_t len) {

/* A legacy BMP deliberately hands presentation back to LVGL/the stock

* compositor, so subsequent widget repaints must not preserve a prior direct

* frame even if Faceclaw's ownership lease is still alive. */

customCfwContext *ctx = peekCustomCfwContext();

if (ctx) ctx->direct_active = 0;

if (bmp == 0 || len < 0x36 || bmp[0] != 0x42 || bmp[1] != 0x4d) /* "BM" */

return FW_LOADBMP(state, (void *)bmp, len);

if (rd16(bmp + 0x1c) != 4) /* not 4bpp */

return FW_LOADBMP(state, (void *)bmp, len);

uint32_t dataoff = rd32(bmp + 0x0a);

int32_t bh_signed = (int32_t)rd32(bmp + 0x16);

uint32_t w = rd32(bmp + 0x12);

uint32_t h = (bh_signed < 0) ? (uint32_t)(-bh_signed) : (uint32_t)bh_signed;

int bottom_up = bh_signed > 0;

/* Dimensions must match the container's display buffer, else let the stock

* loader handle (and reject) it — avoids writing past the display buffer. */

if (w != *(uint16_t *)(state + 0x40) || h != *(uint16_t *)(state + 0x42) ||

(uint64_t)dataoff >= len)

return FW_LOADBMP(state, (void *)bmp, len);

uint32_t stride = (((w + 1) >> 1) + 3) & ~3u; /* BMP rows padded to 4 bytes */

uint8_t *disp = *(uint8_t **)(state + 0x8);

unpack4bpp(disp, w, bmp + dataoff, w, h, stride, bottom_up);

push_display(state, disp, w, h);

return 0;

}

/* Return the singleton only if it already exists and passes the slot/magic checks.

* Ordinary stock refreshes pass through display_copy_hook, so that hook must never

* allocate CFW state. */

static customCfwContext *peekCustomCfwContext(void) {

customCfwContext *ctx = *(customCfwContext **)CFW_CTX_SLOT;

if (((uintptr_t)ctx & 3) == 0 && (uintptr_t)ctx - 0x20000000u < 0x00800000u &&

ctx->magic == CFW_CTX_MAGIC)

return ctx;

return 0;

View remainder of file in raw view

FilesExpand file tree

zlib_glue.c

Latest commit

History

zlib_glue.c

File metadata and controls