From 11363b6d15180af30da361e2fd9cd84eef09f6ca Mon Sep 17 00:00:00 2001 From: Paulus Schoutsen Date: Mon, 6 Jul 2026 02:04:00 -0400 Subject: [PATCH] Reject unsupported color schemes at direct-write START nRF firmware only renders BW (color_scheme 0) and BWR (color_scheme 1). map_panel_ic_to_model_id() maps every nonzero color_scheme to a BWR model and direct-write START sizes the transfer with a single BWR plane byte count. For BWY, 2bpp and 4-gray schemes the client streams a differently sized payload, so the firmware over/under-runs RAM and refreshes garbage while still ACKing success. Check display_config->color_scheme at direct-write START and reject any scheme other than 0/1 with the standard 4-byte NACK frame {0xFF, cmd, RESP_ERR_UNSUPPORTED_SCHEME, 0x00} before powering the panel. The client's validate_ack_response() sees 0xFF70 instead of the 0x0070 ACK echo and raises InvalidResponseError, so it fails fast instead of rendering garbage. BW and BWR are unchanged. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_012g2e8mr132vcizx92WsgiR --- EPD/EPD_service.c | 13 +++++++++++++ EPD/EPD_service.h | 1 + 2 files changed, 14 insertions(+) diff --git a/EPD/EPD_service.c b/EPD/EPD_service.c index 7f34a5c..1553e3a 100755 --- a/EPD/EPD_service.c +++ b/EPD/EPD_service.c @@ -397,6 +397,19 @@ static void handle_direct_write_start(ble_epd_t* p_epd, uint8_t* data, uint16_t send_error_response(p_epd, RESP_DIRECT_WRITE_ERROR); return; } + // nRF only renders BW (color_scheme 0) and BWR (color_scheme 1). For any + // other scheme the client streams data whose size this firmware cannot + // compute, so it would over/under-run RAM and refresh garbage while still + // ACKing success. Reject unsupported schemes up front instead of powering + // the panel. Reply with the standard 4-byte NACK frame + // {0xFF, cmd, error, 0x00} so the client fails fast. + if (p_epd->display_config == NULL || p_epd->display_config->color_scheme > 1) { + NRF_LOG_WARNING("DW: unsupported color_scheme; sending NACK"); + uint8_t nack[] = {0xFF, (uint8_t)(CMD_DIRECT_WRITE_START & 0xFF), + RESP_ERR_UNSUPPORTED_SCHEME, 0x00}; + (void)send_response(p_epd, nack, sizeof(nack)); + return; + } if (directWriteState.active) { cleanup_direct_write_state(p_epd); } diff --git a/EPD/EPD_service.h b/EPD/EPD_service.h index 7ff82ef..4de548d 100755 --- a/EPD/EPD_service.h +++ b/EPD/EPD_service.h @@ -101,6 +101,7 @@ void ble_epd_evt_handler(ble_evt_t const* p_ble_evt, void* p_context); #define RESP_DIRECT_WRITE_REFRESH_SUCCESS 0x73 #define RESP_DIRECT_WRITE_REFRESH_TIMEOUT 0x74 #define RESP_DIRECT_WRITE_ERROR 0xFF +#define RESP_ERR_UNSUPPORTED_SCHEME 0x02 // NACK error code for color schemes this firmware cannot render #define RESP_LED_ACTIVATE_ACK 0x73 #define RESP_FIRMWARE_VERSION 0x43 #define RESP_MSD_READ 0x44