1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Azoteq IQS550/572/525 Trackpad/Touchscreen Controller
4 *
5 * Copyright (C) 2018 Jeff LaBundy <jeff@labundy.com>
6 *
7 * These devices require firmware exported from a PC-based configuration tool
8 * made available by the vendor. Firmware files may be pushed to the device's
9 * nonvolatile memory by writing the filename to the 'fw_file' sysfs control.
10 *
11 * Link to PC-based configuration tool and datasheet: https://www.azoteq.com/
12 */
13
14 #include <linux/bits.h>
15 #include <linux/delay.h>
16 #include <linux/device.h>
17 #include <linux/err.h>
18 #include <linux/firmware.h>
19 #include <linux/gpio/consumer.h>
20 #include <linux/i2c.h>
21 #include <linux/input.h>
22 #include <linux/input/mt.h>
23 #include <linux/input/touchscreen.h>
24 #include <linux/interrupt.h>
25 #include <linux/kernel.h>
26 #include <linux/mod_devicetable.h>
27 #include <linux/module.h>
28 #include <linux/slab.h>
29 #include <linux/unaligned.h>
30
31 #define IQS5XX_FW_FILE_LEN 64
32 #define IQS5XX_NUM_RETRIES 10
33 #define IQS5XX_NUM_CONTACTS 5
34 #define IQS5XX_WR_BYTES_MAX 2
35
36 #define IQS5XX_PROD_NUM_IQS550 40
37 #define IQS5XX_PROD_NUM_IQS572 58
38 #define IQS5XX_PROD_NUM_IQS525 52
39
40 #define IQS5XX_SHOW_RESET BIT(7)
41 #define IQS5XX_ACK_RESET BIT(7)
42
43 #define IQS5XX_SUSPEND BIT(0)
44 #define IQS5XX_RESUME 0
45
46 #define IQS5XX_SETUP_COMPLETE BIT(6)
47 #define IQS5XX_WDT BIT(5)
48 #define IQS5XX_ALP_REATI BIT(3)
49 #define IQS5XX_REATI BIT(2)
50
51 #define IQS5XX_TP_EVENT BIT(2)
52 #define IQS5XX_EVENT_MODE BIT(0)
53
54 #define IQS5XX_PROD_NUM 0x0000
55 #define IQS5XX_SYS_INFO0 0x000F
56 #define IQS5XX_SYS_INFO1 0x0010
57 #define IQS5XX_SYS_CTRL0 0x0431
58 #define IQS5XX_SYS_CTRL1 0x0432
59 #define IQS5XX_SYS_CFG0 0x058E
60 #define IQS5XX_SYS_CFG1 0x058F
61 #define IQS5XX_X_RES 0x066E
62 #define IQS5XX_Y_RES 0x0670
63 #define IQS5XX_EXP_FILE 0x0677
64 #define IQS5XX_CHKSM 0x83C0
65 #define IQS5XX_APP 0x8400
66 #define IQS5XX_CSTM 0xBE00
67 #define IQS5XX_PMAP_END 0xBFFF
68 #define IQS5XX_END_COMM 0xEEEE
69
70 #define IQS5XX_CHKSM_LEN (IQS5XX_APP - IQS5XX_CHKSM)
71 #define IQS5XX_APP_LEN (IQS5XX_CSTM - IQS5XX_APP)
72 #define IQS5XX_CSTM_LEN (IQS5XX_PMAP_END + 1 - IQS5XX_CSTM)
73 #define IQS5XX_PMAP_LEN (IQS5XX_PMAP_END + 1 - IQS5XX_CHKSM)
74
75 #define IQS5XX_REC_HDR_LEN 4
76 #define IQS5XX_REC_LEN_MAX 255
77 #define IQS5XX_REC_TYPE_DATA 0x00
78 #define IQS5XX_REC_TYPE_EOF 0x01
79
80 #define IQS5XX_BL_ADDR_MASK 0x40
81 #define IQS5XX_BL_CMD_VER 0x00
82 #define IQS5XX_BL_CMD_READ 0x01
83 #define IQS5XX_BL_CMD_EXEC 0x02
84 #define IQS5XX_BL_CMD_CRC 0x03
85 #define IQS5XX_BL_BLK_LEN_MAX 64
86 #define IQS5XX_BL_ID 0x0200
87 #define IQS5XX_BL_STATUS_NONE 0xEE
88 #define IQS5XX_BL_CRC_PASS 0x00
89 #define IQS5XX_BL_CRC_FAIL 0x01
90 #define IQS5XX_BL_ATTEMPTS 3
91
92 struct iqs5xx_dev_id_info {
93 __be16 prod_num;
94 __be16 proj_num;
95 u8 major_ver;
96 u8 minor_ver;
97 u8 bl_status;
98 } __packed;
99
100 struct iqs5xx_ihex_rec {
101 char start;
102 char len[2];
103 char addr[4];
104 char type[2];
105 char data[2];
106 } __packed;
107
108 struct iqs5xx_touch_data {
109 __be16 abs_x;
110 __be16 abs_y;
111 __be16 strength;
112 u8 area;
113 } __packed;
114
115 struct iqs5xx_status {
116 u8 sys_info[2];
117 u8 num_active;
118 __be16 rel_x;
119 __be16 rel_y;
120 struct iqs5xx_touch_data touch_data[IQS5XX_NUM_CONTACTS];
121 } __packed;
122
123 struct iqs5xx_private {
124 struct i2c_client *client;
125 struct input_dev *input;
126 struct gpio_desc *reset_gpio;
127 struct touchscreen_properties prop;
128 struct mutex lock;
129 struct iqs5xx_dev_id_info dev_id_info;
130 u8 exp_file[2];
131 };
132
iqs5xx_read_burst(struct i2c_client * client,u16 reg,void * val,u16 len)133 static int iqs5xx_read_burst(struct i2c_client *client,
134 u16 reg, void *val, u16 len)
135 {
136 __be16 reg_buf = cpu_to_be16(reg);
137 int ret, i;
138 struct i2c_msg msg[] = {
139 {
140 .addr = client->addr,
141 .flags = 0,
142 .len = sizeof(reg_buf),
143 .buf = (u8 *)®_buf,
144 },
145 {
146 .addr = client->addr,
147 .flags = I2C_M_RD,
148 .len = len,
149 .buf = (u8 *)val,
150 },
151 };
152
153 /*
154 * The first addressing attempt outside of a communication window fails
155 * and must be retried, after which the device clock stretches until it
156 * is available.
157 */
158 for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
159 ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
160 if (ret == ARRAY_SIZE(msg))
161 return 0;
162
163 usleep_range(200, 300);
164 }
165
166 if (ret >= 0)
167 ret = -EIO;
168
169 dev_err(&client->dev, "Failed to read from address 0x%04X: %d\n",
170 reg, ret);
171
172 return ret;
173 }
174
iqs5xx_read_word(struct i2c_client * client,u16 reg,u16 * val)175 static int iqs5xx_read_word(struct i2c_client *client, u16 reg, u16 *val)
176 {
177 __be16 val_buf;
178 int error;
179
180 error = iqs5xx_read_burst(client, reg, &val_buf, sizeof(val_buf));
181 if (error)
182 return error;
183
184 *val = be16_to_cpu(val_buf);
185
186 return 0;
187 }
188
iqs5xx_write_burst(struct i2c_client * client,u16 reg,const void * val,u16 len)189 static int iqs5xx_write_burst(struct i2c_client *client,
190 u16 reg, const void *val, u16 len)
191 {
192 int ret, i;
193 u16 mlen = sizeof(reg) + len;
194 u8 mbuf[sizeof(reg) + IQS5XX_WR_BYTES_MAX];
195
196 if (len > IQS5XX_WR_BYTES_MAX)
197 return -EINVAL;
198
199 put_unaligned_be16(reg, mbuf);
200 memcpy(mbuf + sizeof(reg), val, len);
201
202 /*
203 * The first addressing attempt outside of a communication window fails
204 * and must be retried, after which the device clock stretches until it
205 * is available.
206 */
207 for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
208 ret = i2c_master_send(client, mbuf, mlen);
209 if (ret == mlen)
210 return 0;
211
212 usleep_range(200, 300);
213 }
214
215 if (ret >= 0)
216 ret = -EIO;
217
218 dev_err(&client->dev, "Failed to write to address 0x%04X: %d\n",
219 reg, ret);
220
221 return ret;
222 }
223
iqs5xx_write_word(struct i2c_client * client,u16 reg,u16 val)224 static int iqs5xx_write_word(struct i2c_client *client, u16 reg, u16 val)
225 {
226 __be16 val_buf = cpu_to_be16(val);
227
228 return iqs5xx_write_burst(client, reg, &val_buf, sizeof(val_buf));
229 }
230
iqs5xx_write_byte(struct i2c_client * client,u16 reg,u8 val)231 static int iqs5xx_write_byte(struct i2c_client *client, u16 reg, u8 val)
232 {
233 return iqs5xx_write_burst(client, reg, &val, sizeof(val));
234 }
235
iqs5xx_reset(struct i2c_client * client)236 static void iqs5xx_reset(struct i2c_client *client)
237 {
238 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
239
240 gpiod_set_value_cansleep(iqs5xx->reset_gpio, 1);
241 usleep_range(200, 300);
242
243 gpiod_set_value_cansleep(iqs5xx->reset_gpio, 0);
244 }
245
iqs5xx_bl_cmd(struct i2c_client * client,u8 bl_cmd,u16 bl_addr)246 static int iqs5xx_bl_cmd(struct i2c_client *client, u8 bl_cmd, u16 bl_addr)
247 {
248 struct i2c_msg msg;
249 int ret;
250 u8 mbuf[sizeof(bl_cmd) + sizeof(bl_addr)];
251
252 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
253 msg.flags = 0;
254 msg.len = sizeof(bl_cmd);
255 msg.buf = mbuf;
256
257 *mbuf = bl_cmd;
258
259 switch (bl_cmd) {
260 case IQS5XX_BL_CMD_VER:
261 case IQS5XX_BL_CMD_CRC:
262 case IQS5XX_BL_CMD_EXEC:
263 break;
264 case IQS5XX_BL_CMD_READ:
265 msg.len += sizeof(bl_addr);
266 put_unaligned_be16(bl_addr, mbuf + sizeof(bl_cmd));
267 break;
268 default:
269 return -EINVAL;
270 }
271
272 ret = i2c_transfer(client->adapter, &msg, 1);
273 if (ret != 1)
274 goto msg_fail;
275
276 switch (bl_cmd) {
277 case IQS5XX_BL_CMD_VER:
278 msg.len = sizeof(u16);
279 break;
280 case IQS5XX_BL_CMD_CRC:
281 msg.len = sizeof(u8);
282 /*
283 * This delay saves the bus controller the trouble of having to
284 * tolerate a relatively long clock-stretching period while the
285 * CRC is calculated.
286 */
287 msleep(50);
288 break;
289 case IQS5XX_BL_CMD_EXEC:
290 usleep_range(10000, 10100);
291 fallthrough;
292 default:
293 return 0;
294 }
295
296 msg.flags = I2C_M_RD;
297
298 ret = i2c_transfer(client->adapter, &msg, 1);
299 if (ret != 1)
300 goto msg_fail;
301
302 if (bl_cmd == IQS5XX_BL_CMD_VER &&
303 get_unaligned_be16(mbuf) != IQS5XX_BL_ID) {
304 dev_err(&client->dev, "Unrecognized bootloader ID: 0x%04X\n",
305 get_unaligned_be16(mbuf));
306 return -EINVAL;
307 }
308
309 if (bl_cmd == IQS5XX_BL_CMD_CRC && *mbuf != IQS5XX_BL_CRC_PASS) {
310 dev_err(&client->dev, "Bootloader CRC failed\n");
311 return -EIO;
312 }
313
314 return 0;
315
316 msg_fail:
317 if (ret >= 0)
318 ret = -EIO;
319
320 if (bl_cmd != IQS5XX_BL_CMD_VER)
321 dev_err(&client->dev,
322 "Unsuccessful bootloader command 0x%02X: %d\n",
323 bl_cmd, ret);
324
325 return ret;
326 }
327
iqs5xx_bl_open(struct i2c_client * client)328 static int iqs5xx_bl_open(struct i2c_client *client)
329 {
330 int error, i, j;
331
332 /*
333 * The device opens a bootloader polling window for 2 ms following the
334 * release of reset. If the host cannot establish communication during
335 * this time frame, it must cycle reset again.
336 */
337 for (i = 0; i < IQS5XX_BL_ATTEMPTS; i++) {
338 iqs5xx_reset(client);
339 usleep_range(350, 400);
340
341 for (j = 0; j < IQS5XX_NUM_RETRIES; j++) {
342 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
343 if (!error)
344 usleep_range(10000, 10100);
345 else if (error != -EINVAL)
346 continue;
347
348 return error;
349 }
350 }
351
352 dev_err(&client->dev, "Failed to open bootloader: %d\n", error);
353
354 return error;
355 }
356
iqs5xx_bl_write(struct i2c_client * client,u16 bl_addr,u8 * pmap_data,u16 pmap_len)357 static int iqs5xx_bl_write(struct i2c_client *client,
358 u16 bl_addr, u8 *pmap_data, u16 pmap_len)
359 {
360 struct i2c_msg msg;
361 int ret, i;
362 u8 mbuf[sizeof(bl_addr) + IQS5XX_BL_BLK_LEN_MAX];
363
364 if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
365 return -EINVAL;
366
367 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
368 msg.flags = 0;
369 msg.len = sizeof(mbuf);
370 msg.buf = mbuf;
371
372 for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
373 put_unaligned_be16(bl_addr + i, mbuf);
374 memcpy(mbuf + sizeof(bl_addr), pmap_data + i,
375 sizeof(mbuf) - sizeof(bl_addr));
376
377 ret = i2c_transfer(client->adapter, &msg, 1);
378 if (ret != 1)
379 goto msg_fail;
380
381 usleep_range(10000, 10100);
382 }
383
384 return 0;
385
386 msg_fail:
387 if (ret >= 0)
388 ret = -EIO;
389
390 dev_err(&client->dev, "Failed to write block at address 0x%04X: %d\n",
391 bl_addr + i, ret);
392
393 return ret;
394 }
395
iqs5xx_bl_verify(struct i2c_client * client,u16 bl_addr,u8 * pmap_data,u16 pmap_len)396 static int iqs5xx_bl_verify(struct i2c_client *client,
397 u16 bl_addr, u8 *pmap_data, u16 pmap_len)
398 {
399 struct i2c_msg msg;
400 int ret, i;
401 u8 bl_data[IQS5XX_BL_BLK_LEN_MAX];
402
403 if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
404 return -EINVAL;
405
406 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
407 msg.flags = I2C_M_RD;
408 msg.len = sizeof(bl_data);
409 msg.buf = bl_data;
410
411 for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
412 ret = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_READ, bl_addr + i);
413 if (ret)
414 return ret;
415
416 ret = i2c_transfer(client->adapter, &msg, 1);
417 if (ret != 1)
418 goto msg_fail;
419
420 if (memcmp(bl_data, pmap_data + i, sizeof(bl_data))) {
421 dev_err(&client->dev,
422 "Failed to verify block at address 0x%04X\n",
423 bl_addr + i);
424 return -EIO;
425 }
426 }
427
428 return 0;
429
430 msg_fail:
431 if (ret >= 0)
432 ret = -EIO;
433
434 dev_err(&client->dev, "Failed to read block at address 0x%04X: %d\n",
435 bl_addr + i, ret);
436
437 return ret;
438 }
439
iqs5xx_set_state(struct i2c_client * client,u8 state)440 static int iqs5xx_set_state(struct i2c_client *client, u8 state)
441 {
442 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
443 int error1, error2;
444
445 if (!iqs5xx->dev_id_info.bl_status)
446 return 0;
447
448 mutex_lock(&iqs5xx->lock);
449
450 /*
451 * Addressing the device outside of a communication window prompts it
452 * to assert the RDY output, so disable the interrupt line to prevent
453 * the handler from servicing a false interrupt.
454 */
455 disable_irq(client->irq);
456
457 error1 = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL1, state);
458 error2 = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
459
460 usleep_range(50, 100);
461 enable_irq(client->irq);
462
463 mutex_unlock(&iqs5xx->lock);
464
465 if (error1)
466 return error1;
467
468 return error2;
469 }
470
iqs5xx_open(struct input_dev * input)471 static int iqs5xx_open(struct input_dev *input)
472 {
473 struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
474
475 return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
476 }
477
iqs5xx_close(struct input_dev * input)478 static void iqs5xx_close(struct input_dev *input)
479 {
480 struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
481
482 iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
483 }
484
iqs5xx_axis_init(struct i2c_client * client)485 static int iqs5xx_axis_init(struct i2c_client *client)
486 {
487 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
488 struct touchscreen_properties *prop = &iqs5xx->prop;
489 struct input_dev *input = iqs5xx->input;
490 u16 max_x, max_y;
491 int error;
492
493 if (!input) {
494 input = devm_input_allocate_device(&client->dev);
495 if (!input)
496 return -ENOMEM;
497
498 input->name = client->name;
499 input->id.bustype = BUS_I2C;
500 input->open = iqs5xx_open;
501 input->close = iqs5xx_close;
502
503 input_set_drvdata(input, iqs5xx);
504 iqs5xx->input = input;
505 }
506
507 error = iqs5xx_read_word(client, IQS5XX_X_RES, &max_x);
508 if (error)
509 return error;
510
511 error = iqs5xx_read_word(client, IQS5XX_Y_RES, &max_y);
512 if (error)
513 return error;
514
515 input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0);
516 input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0);
517 input_set_abs_params(input, ABS_MT_PRESSURE, 0, U16_MAX, 0, 0);
518
519 touchscreen_parse_properties(input, true, prop);
520
521 /*
522 * The device reserves 0xFFFF for coordinates that correspond to slots
523 * which are not in a state of touch.
524 */
525 if (prop->max_x >= U16_MAX || prop->max_y >= U16_MAX) {
526 dev_err(&client->dev, "Invalid touchscreen size: %u*%u\n",
527 prop->max_x, prop->max_y);
528 return -EINVAL;
529 }
530
531 if (prop->max_x != max_x) {
532 error = iqs5xx_write_word(client, IQS5XX_X_RES, prop->max_x);
533 if (error)
534 return error;
535 }
536
537 if (prop->max_y != max_y) {
538 error = iqs5xx_write_word(client, IQS5XX_Y_RES, prop->max_y);
539 if (error)
540 return error;
541 }
542
543 error = input_mt_init_slots(input, IQS5XX_NUM_CONTACTS,
544 INPUT_MT_DIRECT);
545 if (error)
546 dev_err(&client->dev, "Failed to initialize slots: %d\n",
547 error);
548
549 return error;
550 }
551
iqs5xx_dev_init(struct i2c_client * client)552 static int iqs5xx_dev_init(struct i2c_client *client)
553 {
554 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
555 struct iqs5xx_dev_id_info *dev_id_info;
556 int error;
557 u8 buf[sizeof(*dev_id_info) + 1];
558
559 error = iqs5xx_read_burst(client, IQS5XX_PROD_NUM,
560 &buf[1], sizeof(*dev_id_info));
561 if (error)
562 return iqs5xx_bl_open(client);
563
564 /*
565 * A000 and B000 devices use 8-bit and 16-bit addressing, respectively.
566 * Querying an A000 device's version information with 16-bit addressing
567 * gives the appearance that the data is shifted by one byte; a nonzero
568 * leading array element suggests this could be the case (in which case
569 * the missing zero is prepended).
570 */
571 buf[0] = 0;
572 dev_id_info = (struct iqs5xx_dev_id_info *)&buf[buf[1] ? 0 : 1];
573
574 switch (be16_to_cpu(dev_id_info->prod_num)) {
575 case IQS5XX_PROD_NUM_IQS550:
576 case IQS5XX_PROD_NUM_IQS572:
577 case IQS5XX_PROD_NUM_IQS525:
578 break;
579 default:
580 dev_err(&client->dev, "Unrecognized product number: %u\n",
581 be16_to_cpu(dev_id_info->prod_num));
582 return -EINVAL;
583 }
584
585 /*
586 * With the product number recognized yet shifted by one byte, open the
587 * bootloader and wait for user space to convert the A000 device into a
588 * B000 device via new firmware.
589 */
590 if (buf[1]) {
591 dev_err(&client->dev, "Opening bootloader for A000 device\n");
592 return iqs5xx_bl_open(client);
593 }
594
595 error = iqs5xx_read_burst(client, IQS5XX_EXP_FILE,
596 iqs5xx->exp_file, sizeof(iqs5xx->exp_file));
597 if (error)
598 return error;
599
600 error = iqs5xx_axis_init(client);
601 if (error)
602 return error;
603
604 error = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL0, IQS5XX_ACK_RESET);
605 if (error)
606 return error;
607
608 error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG0,
609 IQS5XX_SETUP_COMPLETE | IQS5XX_WDT |
610 IQS5XX_ALP_REATI | IQS5XX_REATI);
611 if (error)
612 return error;
613
614 error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG1,
615 IQS5XX_TP_EVENT | IQS5XX_EVENT_MODE);
616 if (error)
617 return error;
618
619 error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
620 if (error)
621 return error;
622
623 iqs5xx->dev_id_info = *dev_id_info;
624
625 /*
626 * The following delay allows ATI to complete before the open and close
627 * callbacks are free to elicit I2C communication. Any attempts to read
628 * from or write to the device during this time may face extended clock
629 * stretching and prompt the I2C controller to report an error.
630 */
631 msleep(250);
632
633 return 0;
634 }
635
iqs5xx_irq(int irq,void * data)636 static irqreturn_t iqs5xx_irq(int irq, void *data)
637 {
638 struct iqs5xx_private *iqs5xx = data;
639 struct iqs5xx_status status;
640 struct i2c_client *client = iqs5xx->client;
641 struct input_dev *input = iqs5xx->input;
642 int error, i;
643
644 /*
645 * This check is purely a precaution, as the device does not assert the
646 * RDY output during bootloader mode. If the device operates outside of
647 * bootloader mode, the input device is guaranteed to be allocated.
648 */
649 if (!iqs5xx->dev_id_info.bl_status)
650 return IRQ_NONE;
651
652 error = iqs5xx_read_burst(client, IQS5XX_SYS_INFO0,
653 &status, sizeof(status));
654 if (error)
655 return IRQ_NONE;
656
657 if (status.sys_info[0] & IQS5XX_SHOW_RESET) {
658 dev_err(&client->dev, "Unexpected device reset\n");
659
660 error = iqs5xx_dev_init(client);
661 if (error) {
662 dev_err(&client->dev,
663 "Failed to re-initialize device: %d\n", error);
664 return IRQ_NONE;
665 }
666
667 return IRQ_HANDLED;
668 }
669
670 for (i = 0; i < ARRAY_SIZE(status.touch_data); i++) {
671 struct iqs5xx_touch_data *touch_data = &status.touch_data[i];
672 u16 pressure = be16_to_cpu(touch_data->strength);
673
674 input_mt_slot(input, i);
675 if (input_mt_report_slot_state(input, MT_TOOL_FINGER,
676 pressure != 0)) {
677 touchscreen_report_pos(input, &iqs5xx->prop,
678 be16_to_cpu(touch_data->abs_x),
679 be16_to_cpu(touch_data->abs_y),
680 true);
681 input_report_abs(input, ABS_MT_PRESSURE, pressure);
682 }
683 }
684
685 input_mt_sync_frame(input);
686 input_sync(input);
687
688 error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
689 if (error)
690 return IRQ_NONE;
691
692 /*
693 * Once the communication window is closed, a small delay is added to
694 * ensure the device's RDY output has been deasserted by the time the
695 * interrupt handler returns.
696 */
697 usleep_range(50, 100);
698
699 return IRQ_HANDLED;
700 }
701
iqs5xx_fw_file_parse(struct i2c_client * client,const char * fw_file,u8 * pmap)702 static int iqs5xx_fw_file_parse(struct i2c_client *client,
703 const char *fw_file, u8 *pmap)
704 {
705 const struct firmware *fw;
706 struct iqs5xx_ihex_rec *rec;
707 size_t pos = 0;
708 int error, i;
709 u16 rec_num = 1;
710 u16 rec_addr;
711 u8 rec_len, rec_type, rec_chksm, chksm;
712 u8 rec_hdr[IQS5XX_REC_HDR_LEN];
713 u8 rec_data[IQS5XX_REC_LEN_MAX];
714
715 /*
716 * Firmware exported from the vendor's configuration tool deviates from
717 * standard ihex as follows: (1) the checksum for records corresponding
718 * to user-exported settings is not recalculated, and (2) an address of
719 * 0xFFFF is used for the EOF record.
720 *
721 * Because the ihex2fw tool tolerates neither (1) nor (2), the slightly
722 * nonstandard ihex firmware is parsed directly by the driver.
723 */
724 error = request_firmware(&fw, fw_file, &client->dev);
725 if (error) {
726 dev_err(&client->dev, "Failed to request firmware %s: %d\n",
727 fw_file, error);
728 return error;
729 }
730
731 do {
732 if (pos + sizeof(*rec) > fw->size) {
733 dev_err(&client->dev, "Insufficient firmware size\n");
734 error = -EINVAL;
735 break;
736 }
737 rec = (struct iqs5xx_ihex_rec *)(fw->data + pos);
738 pos += sizeof(*rec);
739
740 if (rec->start != ':') {
741 dev_err(&client->dev, "Invalid start at record %u\n",
742 rec_num);
743 error = -EINVAL;
744 break;
745 }
746
747 error = hex2bin(rec_hdr, rec->len, sizeof(rec_hdr));
748 if (error) {
749 dev_err(&client->dev, "Invalid header at record %u\n",
750 rec_num);
751 break;
752 }
753
754 rec_len = *rec_hdr;
755 rec_addr = get_unaligned_be16(rec_hdr + sizeof(rec_len));
756 rec_type = *(rec_hdr + sizeof(rec_len) + sizeof(rec_addr));
757
758 if (pos + rec_len * 2 > fw->size) {
759 dev_err(&client->dev, "Insufficient firmware size\n");
760 error = -EINVAL;
761 break;
762 }
763 pos += (rec_len * 2);
764
765 error = hex2bin(rec_data, rec->data, rec_len);
766 if (error) {
767 dev_err(&client->dev, "Invalid data at record %u\n",
768 rec_num);
769 break;
770 }
771
772 error = hex2bin(&rec_chksm,
773 rec->data + rec_len * 2, sizeof(rec_chksm));
774 if (error) {
775 dev_err(&client->dev, "Invalid checksum at record %u\n",
776 rec_num);
777 break;
778 }
779
780 chksm = 0;
781 for (i = 0; i < sizeof(rec_hdr); i++)
782 chksm += rec_hdr[i];
783 for (i = 0; i < rec_len; i++)
784 chksm += rec_data[i];
785 chksm = ~chksm + 1;
786
787 if (chksm != rec_chksm && rec_addr < IQS5XX_CSTM) {
788 dev_err(&client->dev,
789 "Incorrect checksum at record %u\n",
790 rec_num);
791 error = -EINVAL;
792 break;
793 }
794
795 switch (rec_type) {
796 case IQS5XX_REC_TYPE_DATA:
797 if (rec_addr < IQS5XX_CHKSM ||
798 rec_addr > IQS5XX_PMAP_END) {
799 dev_err(&client->dev,
800 "Invalid address at record %u\n",
801 rec_num);
802 error = -EINVAL;
803 } else {
804 memcpy(pmap + rec_addr - IQS5XX_CHKSM,
805 rec_data, rec_len);
806 }
807 break;
808 case IQS5XX_REC_TYPE_EOF:
809 break;
810 default:
811 dev_err(&client->dev, "Invalid type at record %u\n",
812 rec_num);
813 error = -EINVAL;
814 }
815
816 if (error)
817 break;
818
819 rec_num++;
820 while (pos < fw->size) {
821 if (*(fw->data + pos) == ':')
822 break;
823 pos++;
824 }
825 } while (rec_type != IQS5XX_REC_TYPE_EOF);
826
827 release_firmware(fw);
828
829 return error;
830 }
831
iqs5xx_fw_file_write(struct i2c_client * client,const char * fw_file)832 static int iqs5xx_fw_file_write(struct i2c_client *client, const char *fw_file)
833 {
834 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
835 int error, error_init = 0;
836 u8 *pmap;
837
838 pmap = kzalloc(IQS5XX_PMAP_LEN, GFP_KERNEL);
839 if (!pmap)
840 return -ENOMEM;
841
842 error = iqs5xx_fw_file_parse(client, fw_file, pmap);
843 if (error)
844 goto err_kfree;
845
846 mutex_lock(&iqs5xx->lock);
847
848 /*
849 * Disable the interrupt line in case the first attempt(s) to enter the
850 * bootloader don't happen quickly enough, in which case the device may
851 * assert the RDY output until the next attempt.
852 */
853 disable_irq(client->irq);
854
855 iqs5xx->dev_id_info.bl_status = 0;
856
857 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
858 if (error) {
859 error = iqs5xx_bl_open(client);
860 if (error)
861 goto err_reset;
862 }
863
864 error = iqs5xx_bl_write(client, IQS5XX_CHKSM, pmap, IQS5XX_PMAP_LEN);
865 if (error)
866 goto err_reset;
867
868 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_CRC, 0);
869 if (error)
870 goto err_reset;
871
872 error = iqs5xx_bl_verify(client, IQS5XX_CSTM,
873 pmap + IQS5XX_CHKSM_LEN + IQS5XX_APP_LEN,
874 IQS5XX_CSTM_LEN);
875
876 err_reset:
877 iqs5xx_reset(client);
878 usleep_range(15000, 15100);
879
880 error_init = iqs5xx_dev_init(client);
881 if (!iqs5xx->dev_id_info.bl_status)
882 error_init = error_init ? : -EINVAL;
883
884 enable_irq(client->irq);
885
886 mutex_unlock(&iqs5xx->lock);
887
888 err_kfree:
889 kfree(pmap);
890
891 return error ? : error_init;
892 }
893
fw_file_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)894 static ssize_t fw_file_store(struct device *dev,
895 struct device_attribute *attr, const char *buf,
896 size_t count)
897 {
898 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
899 struct i2c_client *client = iqs5xx->client;
900 size_t len = count;
901 bool input_reg = !iqs5xx->input;
902 char fw_file[IQS5XX_FW_FILE_LEN + 1];
903 int error;
904
905 if (!len)
906 return -EINVAL;
907
908 if (buf[len - 1] == '\n')
909 len--;
910
911 if (len > IQS5XX_FW_FILE_LEN)
912 return -ENAMETOOLONG;
913
914 memcpy(fw_file, buf, len);
915 fw_file[len] = '\0';
916
917 error = iqs5xx_fw_file_write(client, fw_file);
918 if (error)
919 return error;
920
921 /*
922 * If the input device was not allocated already, it is guaranteed to
923 * be allocated by this point and can finally be registered.
924 */
925 if (input_reg) {
926 error = input_register_device(iqs5xx->input);
927 if (error) {
928 dev_err(&client->dev,
929 "Failed to register device: %d\n",
930 error);
931 return error;
932 }
933 }
934
935 return count;
936 }
937
fw_info_show(struct device * dev,struct device_attribute * attr,char * buf)938 static ssize_t fw_info_show(struct device *dev,
939 struct device_attribute *attr, char *buf)
940 {
941 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
942
943 if (!iqs5xx->dev_id_info.bl_status)
944 return -ENODATA;
945
946 return sysfs_emit(buf, "%u.%u.%u.%u:%u.%u\n",
947 be16_to_cpu(iqs5xx->dev_id_info.prod_num),
948 be16_to_cpu(iqs5xx->dev_id_info.proj_num),
949 iqs5xx->dev_id_info.major_ver,
950 iqs5xx->dev_id_info.minor_ver,
951 iqs5xx->exp_file[0], iqs5xx->exp_file[1]);
952 }
953
954 static DEVICE_ATTR_WO(fw_file);
955 static DEVICE_ATTR_RO(fw_info);
956
957 static struct attribute *iqs5xx_attrs[] = {
958 &dev_attr_fw_file.attr,
959 &dev_attr_fw_info.attr,
960 NULL,
961 };
962
iqs5xx_attr_is_visible(struct kobject * kobj,struct attribute * attr,int i)963 static umode_t iqs5xx_attr_is_visible(struct kobject *kobj,
964 struct attribute *attr, int i)
965 {
966 struct device *dev = kobj_to_dev(kobj);
967 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
968
969 if (attr == &dev_attr_fw_file.attr &&
970 (iqs5xx->dev_id_info.bl_status == IQS5XX_BL_STATUS_NONE ||
971 !iqs5xx->reset_gpio))
972 return 0;
973
974 return attr->mode;
975 }
976
977 static const struct attribute_group iqs5xx_group = {
978 .is_visible = iqs5xx_attr_is_visible,
979 .attrs = iqs5xx_attrs,
980 };
981 __ATTRIBUTE_GROUPS(iqs5xx);
982
iqs5xx_suspend(struct device * dev)983 static int iqs5xx_suspend(struct device *dev)
984 {
985 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
986 struct input_dev *input = iqs5xx->input;
987 int error = 0;
988
989 if (!input || device_may_wakeup(dev))
990 return error;
991
992 mutex_lock(&input->mutex);
993
994 if (input_device_enabled(input))
995 error = iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
996
997 mutex_unlock(&input->mutex);
998
999 return error;
1000 }
1001
iqs5xx_resume(struct device * dev)1002 static int iqs5xx_resume(struct device *dev)
1003 {
1004 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
1005 struct input_dev *input = iqs5xx->input;
1006 int error = 0;
1007
1008 if (!input || device_may_wakeup(dev))
1009 return error;
1010
1011 mutex_lock(&input->mutex);
1012
1013 if (input_device_enabled(input))
1014 error = iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
1015
1016 mutex_unlock(&input->mutex);
1017
1018 return error;
1019 }
1020
1021 static DEFINE_SIMPLE_DEV_PM_OPS(iqs5xx_pm, iqs5xx_suspend, iqs5xx_resume);
1022
iqs5xx_probe(struct i2c_client * client)1023 static int iqs5xx_probe(struct i2c_client *client)
1024 {
1025 struct iqs5xx_private *iqs5xx;
1026 int error;
1027
1028 iqs5xx = devm_kzalloc(&client->dev, sizeof(*iqs5xx), GFP_KERNEL);
1029 if (!iqs5xx)
1030 return -ENOMEM;
1031
1032 i2c_set_clientdata(client, iqs5xx);
1033 iqs5xx->client = client;
1034
1035 iqs5xx->reset_gpio = devm_gpiod_get_optional(&client->dev,
1036 "reset", GPIOD_OUT_LOW);
1037 if (IS_ERR(iqs5xx->reset_gpio)) {
1038 error = PTR_ERR(iqs5xx->reset_gpio);
1039 dev_err(&client->dev, "Failed to request GPIO: %d\n", error);
1040 return error;
1041 }
1042
1043 mutex_init(&iqs5xx->lock);
1044
1045 error = iqs5xx_dev_init(client);
1046 if (error)
1047 return error;
1048
1049 error = devm_request_threaded_irq(&client->dev, client->irq,
1050 NULL, iqs5xx_irq, IRQF_ONESHOT,
1051 client->name, iqs5xx);
1052 if (error) {
1053 dev_err(&client->dev, "Failed to request IRQ: %d\n", error);
1054 return error;
1055 }
1056
1057 if (iqs5xx->input) {
1058 error = input_register_device(iqs5xx->input);
1059 if (error)
1060 dev_err(&client->dev,
1061 "Failed to register device: %d\n",
1062 error);
1063 }
1064
1065 return error;
1066 }
1067
1068 static const struct i2c_device_id iqs5xx_id[] = {
1069 { "iqs550", 0 },
1070 { "iqs572", 1 },
1071 { "iqs525", 2 },
1072 { }
1073 };
1074 MODULE_DEVICE_TABLE(i2c, iqs5xx_id);
1075
1076 static const struct of_device_id iqs5xx_of_match[] = {
1077 { .compatible = "azoteq,iqs550" },
1078 { .compatible = "azoteq,iqs572" },
1079 { .compatible = "azoteq,iqs525" },
1080 { }
1081 };
1082 MODULE_DEVICE_TABLE(of, iqs5xx_of_match);
1083
1084 static struct i2c_driver iqs5xx_i2c_driver = {
1085 .driver = {
1086 .name = "iqs5xx",
1087 .dev_groups = iqs5xx_groups,
1088 .of_match_table = iqs5xx_of_match,
1089 .pm = pm_sleep_ptr(&iqs5xx_pm),
1090 },
1091 .id_table = iqs5xx_id,
1092 .probe = iqs5xx_probe,
1093 };
1094 module_i2c_driver(iqs5xx_i2c_driver);
1095
1096 MODULE_AUTHOR("Jeff LaBundy <jeff@labundy.com>");
1097 MODULE_DESCRIPTION("Azoteq IQS550/572/525 Trackpad/Touchscreen Controller");
1098 MODULE_LICENSE("GPL");
1099