1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Azoteq IQS550/572/525 Trackpad/Touchscreen Controller 4 * 5 * Copyright (C) 2018 Jeff LaBundy <jeff@labundy.com> 6 * 7 * These devices require firmware exported from a PC-based configuration tool 8 * made available by the vendor. Firmware files may be pushed to the device's 9 * nonvolatile memory by writing the filename to the 'fw_file' sysfs control. 10 * 11 * Link to PC-based configuration tool and datasheet: https://www.azoteq.com/ 12 */ 13 14 #include <linux/bits.h> 15 #include <linux/delay.h> 16 #include <linux/device.h> 17 #include <linux/err.h> 18 #include <linux/firmware.h> 19 #include <linux/gpio/consumer.h> 20 #include <linux/hex.h> 21 #include <linux/i2c.h> 22 #include <linux/input.h> 23 #include <linux/input/mt.h> 24 #include <linux/input/touchscreen.h> 25 #include <linux/interrupt.h> 26 #include <linux/kernel.h> 27 #include <linux/mod_devicetable.h> 28 #include <linux/module.h> 29 #include <linux/slab.h> 30 #include <linux/unaligned.h> 31 32 #define IQS5XX_FW_FILE_LEN 64 33 #define IQS5XX_NUM_RETRIES 10 34 #define IQS5XX_NUM_CONTACTS 5 35 #define IQS5XX_WR_BYTES_MAX 2 36 37 #define IQS5XX_PROD_NUM_IQS550 40 38 #define IQS5XX_PROD_NUM_IQS572 58 39 #define IQS5XX_PROD_NUM_IQS525 52 40 41 #define IQS5XX_SHOW_RESET BIT(7) 42 #define IQS5XX_ACK_RESET BIT(7) 43 44 #define IQS5XX_SUSPEND BIT(0) 45 #define IQS5XX_RESUME 0 46 47 #define IQS5XX_SETUP_COMPLETE BIT(6) 48 #define IQS5XX_WDT BIT(5) 49 #define IQS5XX_ALP_REATI BIT(3) 50 #define IQS5XX_REATI BIT(2) 51 52 #define IQS5XX_TP_EVENT BIT(2) 53 #define IQS5XX_EVENT_MODE BIT(0) 54 55 #define IQS5XX_PROD_NUM 0x0000 56 #define IQS5XX_SYS_INFO0 0x000F 57 #define IQS5XX_SYS_INFO1 0x0010 58 #define IQS5XX_SYS_CTRL0 0x0431 59 #define IQS5XX_SYS_CTRL1 0x0432 60 #define IQS5XX_SYS_CFG0 0x058E 61 #define IQS5XX_SYS_CFG1 0x058F 62 #define IQS5XX_X_RES 0x066E 63 #define IQS5XX_Y_RES 0x0670 64 #define IQS5XX_EXP_FILE 0x0677 65 #define IQS5XX_CHKSM 0x83C0 66 #define IQS5XX_APP 0x8400 67 #define IQS5XX_CSTM 0xBE00 68 #define IQS5XX_PMAP_END 0xBFFF 69 #define IQS5XX_END_COMM 0xEEEE 70 71 #define IQS5XX_CHKSM_LEN (IQS5XX_APP - IQS5XX_CHKSM) 72 #define IQS5XX_APP_LEN (IQS5XX_CSTM - IQS5XX_APP) 73 #define IQS5XX_CSTM_LEN (IQS5XX_PMAP_END + 1 - IQS5XX_CSTM) 74 #define IQS5XX_PMAP_LEN (IQS5XX_PMAP_END + 1 - IQS5XX_CHKSM) 75 76 /* Length of firmware header in hexadecimal characters */ 77 #define IQS5XX_REC_HDR_LEN_HEX (1 /* start */ + 2 /* size */ + \ 78 4 /* addr */ + 2 /* type */) 79 #define IQS5XX_REC_HDR_SIZE 4 /* size + addr (2 bytes) + type, in bytes*/ 80 #define IQS5XX_REC_DATA_SIZE 255 /* maximum size of the data portion */ 81 #define IQS5XX_REC_TYPE_DATA 0x00 82 #define IQS5XX_REC_TYPE_EOF 0x01 83 84 #define IQS5XX_BL_ADDR_MASK 0x40 85 #define IQS5XX_BL_CMD_VER 0x00 86 #define IQS5XX_BL_CMD_READ 0x01 87 #define IQS5XX_BL_CMD_EXEC 0x02 88 #define IQS5XX_BL_CMD_CRC 0x03 89 #define IQS5XX_BL_BLK_LEN_MAX 64 90 #define IQS5XX_BL_ID 0x0200 91 #define IQS5XX_BL_STATUS_NONE 0xEE 92 #define IQS5XX_BL_CRC_PASS 0x00 93 #define IQS5XX_BL_CRC_FAIL 0x01 94 #define IQS5XX_BL_ATTEMPTS 3 95 96 struct iqs5xx_dev_id_info { 97 __be16 prod_num; 98 __be16 proj_num; 99 u8 major_ver; 100 u8 minor_ver; 101 u8 bl_status; 102 } __packed; 103 104 struct iqs5xx_touch_data { 105 __be16 abs_x; 106 __be16 abs_y; 107 __be16 strength; 108 u8 area; 109 } __packed; 110 111 struct iqs5xx_status { 112 u8 sys_info[2]; 113 u8 num_active; 114 __be16 rel_x; 115 __be16 rel_y; 116 struct iqs5xx_touch_data touch_data[IQS5XX_NUM_CONTACTS]; 117 } __packed; 118 119 struct iqs5xx_private { 120 struct i2c_client *client; 121 struct input_dev *input; 122 struct gpio_desc *reset_gpio; 123 struct touchscreen_properties prop; 124 struct mutex lock; 125 struct iqs5xx_dev_id_info dev_id_info; 126 u8 exp_file[2]; 127 }; 128 129 static int iqs5xx_read_burst(struct i2c_client *client, 130 u16 reg, void *val, u16 len) 131 { 132 __be16 reg_buf = cpu_to_be16(reg); 133 int ret, i; 134 struct i2c_msg msg[] = { 135 { 136 .addr = client->addr, 137 .flags = 0, 138 .len = sizeof(reg_buf), 139 .buf = (u8 *)®_buf, 140 }, 141 { 142 .addr = client->addr, 143 .flags = I2C_M_RD, 144 .len = len, 145 .buf = (u8 *)val, 146 }, 147 }; 148 149 /* 150 * The first addressing attempt outside of a communication window fails 151 * and must be retried, after which the device clock stretches until it 152 * is available. 153 */ 154 for (i = 0; i < IQS5XX_NUM_RETRIES; i++) { 155 ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); 156 if (ret == ARRAY_SIZE(msg)) 157 return 0; 158 159 usleep_range(200, 300); 160 } 161 162 if (ret >= 0) 163 ret = -EIO; 164 165 dev_err(&client->dev, "Failed to read from address 0x%04X: %d\n", 166 reg, ret); 167 168 return ret; 169 } 170 171 static int iqs5xx_read_word(struct i2c_client *client, u16 reg, u16 *val) 172 { 173 __be16 val_buf; 174 int error; 175 176 error = iqs5xx_read_burst(client, reg, &val_buf, sizeof(val_buf)); 177 if (error) 178 return error; 179 180 *val = be16_to_cpu(val_buf); 181 182 return 0; 183 } 184 185 static int iqs5xx_write_burst(struct i2c_client *client, 186 u16 reg, const void *val, u16 len) 187 { 188 int ret, i; 189 u16 mlen = sizeof(reg) + len; 190 u8 mbuf[sizeof(reg) + IQS5XX_WR_BYTES_MAX]; 191 192 if (len > IQS5XX_WR_BYTES_MAX) 193 return -EINVAL; 194 195 put_unaligned_be16(reg, mbuf); 196 memcpy(mbuf + sizeof(reg), val, len); 197 198 /* 199 * The first addressing attempt outside of a communication window fails 200 * and must be retried, after which the device clock stretches until it 201 * is available. 202 */ 203 for (i = 0; i < IQS5XX_NUM_RETRIES; i++) { 204 ret = i2c_master_send(client, mbuf, mlen); 205 if (ret == mlen) 206 return 0; 207 208 usleep_range(200, 300); 209 } 210 211 if (ret >= 0) 212 ret = -EIO; 213 214 dev_err(&client->dev, "Failed to write to address 0x%04X: %d\n", 215 reg, ret); 216 217 return ret; 218 } 219 220 static int iqs5xx_write_word(struct i2c_client *client, u16 reg, u16 val) 221 { 222 __be16 val_buf = cpu_to_be16(val); 223 224 return iqs5xx_write_burst(client, reg, &val_buf, sizeof(val_buf)); 225 } 226 227 static int iqs5xx_write_byte(struct i2c_client *client, u16 reg, u8 val) 228 { 229 return iqs5xx_write_burst(client, reg, &val, sizeof(val)); 230 } 231 232 static void iqs5xx_reset(struct i2c_client *client) 233 { 234 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 235 236 gpiod_set_value_cansleep(iqs5xx->reset_gpio, 1); 237 usleep_range(200, 300); 238 239 gpiod_set_value_cansleep(iqs5xx->reset_gpio, 0); 240 } 241 242 static int iqs5xx_bl_cmd(struct i2c_client *client, u8 bl_cmd, u16 bl_addr) 243 { 244 struct i2c_msg msg; 245 int ret; 246 u8 mbuf[sizeof(bl_cmd) + sizeof(bl_addr)]; 247 248 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 249 msg.flags = 0; 250 msg.len = sizeof(bl_cmd); 251 msg.buf = mbuf; 252 253 *mbuf = bl_cmd; 254 255 switch (bl_cmd) { 256 case IQS5XX_BL_CMD_VER: 257 case IQS5XX_BL_CMD_CRC: 258 case IQS5XX_BL_CMD_EXEC: 259 break; 260 case IQS5XX_BL_CMD_READ: 261 msg.len += sizeof(bl_addr); 262 put_unaligned_be16(bl_addr, mbuf + sizeof(bl_cmd)); 263 break; 264 default: 265 return -EINVAL; 266 } 267 268 ret = i2c_transfer(client->adapter, &msg, 1); 269 if (ret != 1) 270 goto msg_fail; 271 272 switch (bl_cmd) { 273 case IQS5XX_BL_CMD_VER: 274 msg.len = sizeof(u16); 275 break; 276 case IQS5XX_BL_CMD_CRC: 277 msg.len = sizeof(u8); 278 /* 279 * This delay saves the bus controller the trouble of having to 280 * tolerate a relatively long clock-stretching period while the 281 * CRC is calculated. 282 */ 283 msleep(50); 284 break; 285 case IQS5XX_BL_CMD_EXEC: 286 usleep_range(10000, 10100); 287 fallthrough; 288 default: 289 return 0; 290 } 291 292 msg.flags = I2C_M_RD; 293 294 ret = i2c_transfer(client->adapter, &msg, 1); 295 if (ret != 1) 296 goto msg_fail; 297 298 if (bl_cmd == IQS5XX_BL_CMD_VER && 299 get_unaligned_be16(mbuf) != IQS5XX_BL_ID) { 300 dev_err(&client->dev, "Unrecognized bootloader ID: 0x%04X\n", 301 get_unaligned_be16(mbuf)); 302 return -EINVAL; 303 } 304 305 if (bl_cmd == IQS5XX_BL_CMD_CRC && *mbuf != IQS5XX_BL_CRC_PASS) { 306 dev_err(&client->dev, "Bootloader CRC failed\n"); 307 return -EIO; 308 } 309 310 return 0; 311 312 msg_fail: 313 if (ret >= 0) 314 ret = -EIO; 315 316 if (bl_cmd != IQS5XX_BL_CMD_VER) 317 dev_err(&client->dev, 318 "Unsuccessful bootloader command 0x%02X: %d\n", 319 bl_cmd, ret); 320 321 return ret; 322 } 323 324 static int iqs5xx_bl_open(struct i2c_client *client) 325 { 326 int error, i, j; 327 328 /* 329 * The device opens a bootloader polling window for 2 ms following the 330 * release of reset. If the host cannot establish communication during 331 * this time frame, it must cycle reset again. 332 */ 333 for (i = 0; i < IQS5XX_BL_ATTEMPTS; i++) { 334 iqs5xx_reset(client); 335 usleep_range(350, 400); 336 337 for (j = 0; j < IQS5XX_NUM_RETRIES; j++) { 338 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0); 339 if (!error) 340 usleep_range(10000, 10100); 341 else if (error != -EINVAL) 342 continue; 343 344 return error; 345 } 346 } 347 348 dev_err(&client->dev, "Failed to open bootloader: %d\n", error); 349 350 return error; 351 } 352 353 static int iqs5xx_bl_write(struct i2c_client *client, 354 u16 bl_addr, const u8 *pmap_data, u16 pmap_len) 355 { 356 struct i2c_msg msg; 357 int ret, i; 358 u8 mbuf[sizeof(bl_addr) + IQS5XX_BL_BLK_LEN_MAX]; 359 360 if (pmap_len % IQS5XX_BL_BLK_LEN_MAX) 361 return -EINVAL; 362 363 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 364 msg.flags = 0; 365 msg.len = sizeof(mbuf); 366 msg.buf = mbuf; 367 368 for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) { 369 put_unaligned_be16(bl_addr + i, mbuf); 370 memcpy(mbuf + sizeof(bl_addr), pmap_data + i, 371 sizeof(mbuf) - sizeof(bl_addr)); 372 373 ret = i2c_transfer(client->adapter, &msg, 1); 374 if (ret != 1) 375 goto msg_fail; 376 377 usleep_range(10000, 10100); 378 } 379 380 return 0; 381 382 msg_fail: 383 if (ret >= 0) 384 ret = -EIO; 385 386 dev_err(&client->dev, "Failed to write block at address 0x%04X: %d\n", 387 bl_addr + i, ret); 388 389 return ret; 390 } 391 392 static int iqs5xx_bl_verify(struct i2c_client *client, 393 u16 bl_addr, const u8 *pmap_data, u16 pmap_len) 394 { 395 struct i2c_msg msg; 396 int ret, i; 397 u8 bl_data[IQS5XX_BL_BLK_LEN_MAX]; 398 399 if (pmap_len % IQS5XX_BL_BLK_LEN_MAX) 400 return -EINVAL; 401 402 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 403 msg.flags = I2C_M_RD; 404 msg.len = sizeof(bl_data); 405 msg.buf = bl_data; 406 407 for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) { 408 ret = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_READ, bl_addr + i); 409 if (ret) 410 return ret; 411 412 ret = i2c_transfer(client->adapter, &msg, 1); 413 if (ret != 1) 414 goto msg_fail; 415 416 if (memcmp(bl_data, pmap_data + i, sizeof(bl_data))) { 417 dev_err(&client->dev, 418 "Failed to verify block at address 0x%04X\n", 419 bl_addr + i); 420 return -EIO; 421 } 422 } 423 424 return 0; 425 426 msg_fail: 427 if (ret >= 0) 428 ret = -EIO; 429 430 dev_err(&client->dev, "Failed to read block at address 0x%04X: %d\n", 431 bl_addr + i, ret); 432 433 return ret; 434 } 435 436 static int iqs5xx_set_state(struct i2c_client *client, u8 state) 437 { 438 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 439 int error1, error2; 440 441 if (!iqs5xx->dev_id_info.bl_status) 442 return 0; 443 444 guard(mutex)(&iqs5xx->lock); 445 446 /* 447 * Addressing the device outside of a communication window prompts it 448 * to assert the RDY output, so disable the interrupt line to prevent 449 * the handler from servicing a false interrupt. 450 */ 451 guard(disable_irq)(&client->irq); 452 453 error1 = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL1, state); 454 error2 = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 455 456 usleep_range(50, 100); 457 458 return error1 ?: error2; 459 } 460 461 static int iqs5xx_open(struct input_dev *input) 462 { 463 struct iqs5xx_private *iqs5xx = input_get_drvdata(input); 464 465 return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME); 466 } 467 468 static void iqs5xx_close(struct input_dev *input) 469 { 470 struct iqs5xx_private *iqs5xx = input_get_drvdata(input); 471 472 iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND); 473 } 474 475 static int iqs5xx_axis_init(struct i2c_client *client) 476 { 477 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 478 struct touchscreen_properties *prop = &iqs5xx->prop; 479 struct input_dev *input = iqs5xx->input; 480 u16 max_x, max_y; 481 int error; 482 483 if (!input) { 484 input = devm_input_allocate_device(&client->dev); 485 if (!input) 486 return -ENOMEM; 487 488 input->name = client->name; 489 input->id.bustype = BUS_I2C; 490 input->open = iqs5xx_open; 491 input->close = iqs5xx_close; 492 493 input_set_drvdata(input, iqs5xx); 494 iqs5xx->input = input; 495 } 496 497 error = iqs5xx_read_word(client, IQS5XX_X_RES, &max_x); 498 if (error) 499 return error; 500 501 error = iqs5xx_read_word(client, IQS5XX_Y_RES, &max_y); 502 if (error) 503 return error; 504 505 input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0); 506 input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0); 507 input_set_abs_params(input, ABS_MT_PRESSURE, 0, U16_MAX, 0, 0); 508 509 touchscreen_parse_properties(input, true, prop); 510 511 /* 512 * The device reserves 0xFFFF for coordinates that correspond to slots 513 * which are not in a state of touch. 514 */ 515 if (prop->max_x >= U16_MAX || prop->max_y >= U16_MAX) { 516 dev_err(&client->dev, "Invalid touchscreen size: %u*%u\n", 517 prop->max_x, prop->max_y); 518 return -EINVAL; 519 } 520 521 if (prop->max_x != max_x) { 522 error = iqs5xx_write_word(client, IQS5XX_X_RES, prop->max_x); 523 if (error) 524 return error; 525 } 526 527 if (prop->max_y != max_y) { 528 error = iqs5xx_write_word(client, IQS5XX_Y_RES, prop->max_y); 529 if (error) 530 return error; 531 } 532 533 error = input_mt_init_slots(input, IQS5XX_NUM_CONTACTS, 534 INPUT_MT_DIRECT); 535 if (error) 536 dev_err(&client->dev, "Failed to initialize slots: %d\n", 537 error); 538 539 return error; 540 } 541 542 static int iqs5xx_dev_init(struct i2c_client *client) 543 { 544 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 545 struct iqs5xx_dev_id_info *dev_id_info; 546 int error; 547 u8 buf[sizeof(*dev_id_info) + 1]; 548 549 error = iqs5xx_read_burst(client, IQS5XX_PROD_NUM, 550 &buf[1], sizeof(*dev_id_info)); 551 if (error) 552 return iqs5xx_bl_open(client); 553 554 /* 555 * A000 and B000 devices use 8-bit and 16-bit addressing, respectively. 556 * Querying an A000 device's version information with 16-bit addressing 557 * gives the appearance that the data is shifted by one byte; a nonzero 558 * leading array element suggests this could be the case (in which case 559 * the missing zero is prepended). 560 */ 561 buf[0] = 0; 562 dev_id_info = (struct iqs5xx_dev_id_info *)&buf[buf[1] ? 0 : 1]; 563 564 switch (be16_to_cpu(dev_id_info->prod_num)) { 565 case IQS5XX_PROD_NUM_IQS550: 566 case IQS5XX_PROD_NUM_IQS572: 567 case IQS5XX_PROD_NUM_IQS525: 568 break; 569 default: 570 dev_err(&client->dev, "Unrecognized product number: %u\n", 571 be16_to_cpu(dev_id_info->prod_num)); 572 return -EINVAL; 573 } 574 575 /* 576 * With the product number recognized yet shifted by one byte, open the 577 * bootloader and wait for user space to convert the A000 device into a 578 * B000 device via new firmware. 579 */ 580 if (buf[1]) { 581 dev_err(&client->dev, "Opening bootloader for A000 device\n"); 582 return iqs5xx_bl_open(client); 583 } 584 585 error = iqs5xx_read_burst(client, IQS5XX_EXP_FILE, 586 iqs5xx->exp_file, sizeof(iqs5xx->exp_file)); 587 if (error) 588 return error; 589 590 error = iqs5xx_axis_init(client); 591 if (error) 592 return error; 593 594 error = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL0, IQS5XX_ACK_RESET); 595 if (error) 596 return error; 597 598 error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG0, 599 IQS5XX_SETUP_COMPLETE | IQS5XX_WDT | 600 IQS5XX_ALP_REATI | IQS5XX_REATI); 601 if (error) 602 return error; 603 604 error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG1, 605 IQS5XX_TP_EVENT | IQS5XX_EVENT_MODE); 606 if (error) 607 return error; 608 609 error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 610 if (error) 611 return error; 612 613 iqs5xx->dev_id_info = *dev_id_info; 614 615 /* 616 * The following delay allows ATI to complete before the open and close 617 * callbacks are free to elicit I2C communication. Any attempts to read 618 * from or write to the device during this time may face extended clock 619 * stretching and prompt the I2C controller to report an error. 620 */ 621 msleep(250); 622 623 return 0; 624 } 625 626 static irqreturn_t iqs5xx_irq(int irq, void *data) 627 { 628 struct iqs5xx_private *iqs5xx = data; 629 struct iqs5xx_status status; 630 struct i2c_client *client = iqs5xx->client; 631 struct input_dev *input = iqs5xx->input; 632 int error, i; 633 634 /* 635 * This check is purely a precaution, as the device does not assert the 636 * RDY output during bootloader mode. If the device operates outside of 637 * bootloader mode, the input device is guaranteed to be allocated. 638 */ 639 if (!iqs5xx->dev_id_info.bl_status) 640 return IRQ_NONE; 641 642 error = iqs5xx_read_burst(client, IQS5XX_SYS_INFO0, 643 &status, sizeof(status)); 644 if (error) 645 return IRQ_NONE; 646 647 if (status.sys_info[0] & IQS5XX_SHOW_RESET) { 648 dev_err(&client->dev, "Unexpected device reset\n"); 649 650 error = iqs5xx_dev_init(client); 651 if (error) { 652 dev_err(&client->dev, 653 "Failed to re-initialize device: %d\n", error); 654 return IRQ_NONE; 655 } 656 657 return IRQ_HANDLED; 658 } 659 660 for (i = 0; i < ARRAY_SIZE(status.touch_data); i++) { 661 struct iqs5xx_touch_data *touch_data = &status.touch_data[i]; 662 u16 pressure = be16_to_cpu(touch_data->strength); 663 664 input_mt_slot(input, i); 665 if (input_mt_report_slot_state(input, MT_TOOL_FINGER, 666 pressure != 0)) { 667 touchscreen_report_pos(input, &iqs5xx->prop, 668 be16_to_cpu(touch_data->abs_x), 669 be16_to_cpu(touch_data->abs_y), 670 true); 671 input_report_abs(input, ABS_MT_PRESSURE, pressure); 672 } 673 } 674 675 input_mt_sync_frame(input); 676 input_sync(input); 677 678 error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 679 if (error) 680 return IRQ_NONE; 681 682 /* 683 * Once the communication window is closed, a small delay is added to 684 * ensure the device's RDY output has been deasserted by the time the 685 * interrupt handler returns. 686 */ 687 usleep_range(50, 100); 688 689 return IRQ_HANDLED; 690 } 691 692 static int iqs5xx_fw_file_parse(struct i2c_client *client, 693 const char *fw_file, u8 *pmap) 694 { 695 size_t pos = 0; 696 int error, i; 697 u16 rec_num = 1; 698 u16 rec_addr; 699 u8 rec_len, rec_type, rec_chksm, chksm; 700 u8 rec_hdr[IQS5XX_REC_HDR_SIZE]; 701 u8 rec_data[IQS5XX_REC_DATA_SIZE]; 702 703 /* 704 * Firmware exported from the vendor's configuration tool deviates from 705 * standard ihex as follows: (1) the checksum for records corresponding 706 * to user-exported settings is not recalculated, and (2) an address of 707 * 0xFFFF is used for the EOF record. 708 * 709 * Because the ihex2fw tool tolerates neither (1) nor (2), the slightly 710 * nonstandard ihex firmware is parsed directly by the driver. 711 */ 712 const struct firmware *fw __free(firmware) = NULL; 713 error = request_firmware(&fw, fw_file, &client->dev); 714 if (error) { 715 dev_err(&client->dev, "Failed to request firmware %s: %d\n", 716 fw_file, error); 717 return error; 718 } 719 720 do { 721 if (pos + IQS5XX_REC_HDR_LEN_HEX > fw->size) { 722 dev_err(&client->dev, "Insufficient firmware size\n"); 723 return -EINVAL; 724 } 725 726 if (fw->data[pos] != ':') { 727 dev_err(&client->dev, "Invalid start at record %u\n", 728 rec_num); 729 return -EINVAL; 730 } 731 732 /* Convert all 3 fields (length, address, and type) in one go */ 733 error = hex2bin(rec_hdr, &fw->data[pos + 1], sizeof(rec_hdr)); 734 if (error) { 735 dev_err(&client->dev, "Invalid header at record %u\n", 736 rec_num); 737 return error; 738 } 739 pos += IQS5XX_REC_HDR_LEN_HEX; 740 741 rec_len = *rec_hdr; 742 rec_addr = get_unaligned_be16(rec_hdr + sizeof(rec_len)); 743 rec_type = *(rec_hdr + sizeof(rec_len) + sizeof(rec_addr)); 744 745 /* 746 * Check if we have enough data for the data portion of the 747 * record, as well as the checksum byte. Everything is doubled 748 * because data is in ASCII HEX and not binary format. 749 */ 750 if (pos + (rec_len + sizeof(rec_chksm)) * 2 > fw->size) { 751 dev_err(&client->dev, "Insufficient firmware size\n"); 752 return -EINVAL; 753 } 754 755 error = hex2bin(rec_data, &fw->data[pos], rec_len); 756 if (error) { 757 dev_err(&client->dev, "Invalid data at record %u\n", 758 rec_num); 759 return error; 760 } 761 pos += rec_len * 2; 762 763 error = hex2bin(&rec_chksm, &fw->data[pos], sizeof(rec_chksm)); 764 if (error) { 765 dev_err(&client->dev, "Invalid checksum at record %u\n", 766 rec_num); 767 return error; 768 } 769 pos += 2; 770 771 chksm = 0; 772 for (i = 0; i < sizeof(rec_hdr); i++) 773 chksm += rec_hdr[i]; 774 for (i = 0; i < rec_len; i++) 775 chksm += rec_data[i]; 776 chksm = ~chksm + 1; 777 778 if (chksm != rec_chksm && rec_addr < IQS5XX_CSTM) { 779 dev_err(&client->dev, 780 "Incorrect checksum at record %u\n", 781 rec_num); 782 error = -EINVAL; 783 break; 784 } 785 786 switch (rec_type) { 787 case IQS5XX_REC_TYPE_DATA: 788 if (rec_addr < IQS5XX_CHKSM || 789 rec_addr > IQS5XX_PMAP_END) { 790 dev_err(&client->dev, 791 "Invalid address at record %u\n", 792 rec_num); 793 return -EINVAL; 794 } 795 796 memcpy(pmap + rec_addr - IQS5XX_CHKSM, 797 rec_data, rec_len); 798 break; 799 800 case IQS5XX_REC_TYPE_EOF: 801 break; 802 803 default: 804 dev_err(&client->dev, "Invalid type at record %u\n", 805 rec_num); 806 return -EINVAL; 807 } 808 809 rec_num++; 810 while (pos < fw->size) { 811 if (*(fw->data + pos) == ':') 812 break; 813 pos++; 814 } 815 } while (rec_type != IQS5XX_REC_TYPE_EOF); 816 817 return 0; 818 } 819 820 static int iqs5xx_update_firmware(struct iqs5xx_private *iqs5xx, const u8 *pmap) 821 { 822 struct i2c_client *client = iqs5xx->client; 823 int error; 824 825 iqs5xx->dev_id_info.bl_status = 0; 826 827 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0); 828 if (error) { 829 error = iqs5xx_bl_open(client); 830 if (error) 831 return error; 832 } 833 834 error = iqs5xx_bl_write(client, IQS5XX_CHKSM, pmap, IQS5XX_PMAP_LEN); 835 if (error) 836 return error; 837 838 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_CRC, 0); 839 if (error) 840 return error; 841 842 error = iqs5xx_bl_verify(client, IQS5XX_CSTM, 843 pmap + IQS5XX_CHKSM_LEN + IQS5XX_APP_LEN, 844 IQS5XX_CSTM_LEN); 845 if (error) 846 return error; 847 848 return 0; 849 } 850 851 static int iqs5xx_fw_file_write(struct i2c_client *client, const char *fw_file) 852 { 853 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 854 int error, error_init = 0; 855 856 u8 *pmap __free(kfree) = kzalloc(IQS5XX_PMAP_LEN, GFP_KERNEL); 857 if (!pmap) 858 return -ENOMEM; 859 860 error = iqs5xx_fw_file_parse(client, fw_file, pmap); 861 if (error) 862 return error; 863 864 guard(mutex)(&iqs5xx->lock); 865 866 /* 867 * Disable the interrupt line in case the first attempt(s) to enter the 868 * bootloader don't happen quickly enough, in which case the device may 869 * assert the RDY output until the next attempt. 870 */ 871 guard(disable_irq)(&client->irq); 872 873 error = iqs5xx_update_firmware(iqs5xx, pmap); 874 875 iqs5xx_reset(client); 876 usleep_range(15000, 15100); 877 878 error_init = iqs5xx_dev_init(client); 879 if (!iqs5xx->dev_id_info.bl_status) 880 error_init = error_init ? : -EINVAL; 881 882 return error ?: error_init; 883 } 884 885 static ssize_t fw_file_store(struct device *dev, 886 struct device_attribute *attr, const char *buf, 887 size_t count) 888 { 889 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 890 struct i2c_client *client = iqs5xx->client; 891 size_t len = count; 892 bool input_reg = !iqs5xx->input; 893 char fw_file[IQS5XX_FW_FILE_LEN + 1]; 894 int error; 895 896 if (!len) 897 return -EINVAL; 898 899 if (buf[len - 1] == '\n') 900 len--; 901 902 if (len > IQS5XX_FW_FILE_LEN) 903 return -ENAMETOOLONG; 904 905 memcpy(fw_file, buf, len); 906 fw_file[len] = '\0'; 907 908 error = iqs5xx_fw_file_write(client, fw_file); 909 if (error) 910 return error; 911 912 /* 913 * If the input device was not allocated already, it is guaranteed to 914 * be allocated by this point and can finally be registered. 915 */ 916 if (input_reg) { 917 error = input_register_device(iqs5xx->input); 918 if (error) { 919 dev_err(&client->dev, 920 "Failed to register device: %d\n", 921 error); 922 return error; 923 } 924 } 925 926 return count; 927 } 928 929 static ssize_t fw_info_show(struct device *dev, 930 struct device_attribute *attr, char *buf) 931 { 932 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 933 934 if (!iqs5xx->dev_id_info.bl_status) 935 return -ENODATA; 936 937 return sysfs_emit(buf, "%u.%u.%u.%u:%u.%u\n", 938 be16_to_cpu(iqs5xx->dev_id_info.prod_num), 939 be16_to_cpu(iqs5xx->dev_id_info.proj_num), 940 iqs5xx->dev_id_info.major_ver, 941 iqs5xx->dev_id_info.minor_ver, 942 iqs5xx->exp_file[0], iqs5xx->exp_file[1]); 943 } 944 945 static DEVICE_ATTR_WO(fw_file); 946 static DEVICE_ATTR_RO(fw_info); 947 948 static struct attribute *iqs5xx_attrs[] = { 949 &dev_attr_fw_file.attr, 950 &dev_attr_fw_info.attr, 951 NULL, 952 }; 953 954 static umode_t iqs5xx_attr_is_visible(struct kobject *kobj, 955 struct attribute *attr, int i) 956 { 957 struct device *dev = kobj_to_dev(kobj); 958 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 959 960 if (attr == &dev_attr_fw_file.attr && 961 (iqs5xx->dev_id_info.bl_status == IQS5XX_BL_STATUS_NONE || 962 !iqs5xx->reset_gpio)) 963 return 0; 964 965 return attr->mode; 966 } 967 968 static const struct attribute_group iqs5xx_group = { 969 .is_visible = iqs5xx_attr_is_visible, 970 .attrs = iqs5xx_attrs, 971 }; 972 __ATTRIBUTE_GROUPS(iqs5xx); 973 974 static int iqs5xx_suspend(struct device *dev) 975 { 976 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 977 struct input_dev *input = iqs5xx->input; 978 979 if (!input || device_may_wakeup(dev)) 980 return 0; 981 982 guard(mutex)(&input->mutex); 983 if (input_device_enabled(input)) 984 return iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND); 985 986 return 0; 987 } 988 989 static int iqs5xx_resume(struct device *dev) 990 { 991 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 992 struct input_dev *input = iqs5xx->input; 993 994 if (!input || device_may_wakeup(dev)) 995 return 0; 996 997 guard(mutex)(&input->mutex); 998 if (input_device_enabled(input)) 999 return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME); 1000 1001 return 0; 1002 } 1003 1004 static DEFINE_SIMPLE_DEV_PM_OPS(iqs5xx_pm, iqs5xx_suspend, iqs5xx_resume); 1005 1006 static int iqs5xx_probe(struct i2c_client *client) 1007 { 1008 struct iqs5xx_private *iqs5xx; 1009 int error; 1010 1011 iqs5xx = devm_kzalloc(&client->dev, sizeof(*iqs5xx), GFP_KERNEL); 1012 if (!iqs5xx) 1013 return -ENOMEM; 1014 1015 i2c_set_clientdata(client, iqs5xx); 1016 iqs5xx->client = client; 1017 1018 iqs5xx->reset_gpio = devm_gpiod_get_optional(&client->dev, 1019 "reset", GPIOD_OUT_LOW); 1020 if (IS_ERR(iqs5xx->reset_gpio)) { 1021 error = PTR_ERR(iqs5xx->reset_gpio); 1022 dev_err(&client->dev, "Failed to request GPIO: %d\n", error); 1023 return error; 1024 } 1025 1026 mutex_init(&iqs5xx->lock); 1027 1028 error = iqs5xx_dev_init(client); 1029 if (error) 1030 return error; 1031 1032 error = devm_request_threaded_irq(&client->dev, client->irq, 1033 NULL, iqs5xx_irq, IRQF_ONESHOT, 1034 client->name, iqs5xx); 1035 if (error) { 1036 dev_err(&client->dev, "Failed to request IRQ: %d\n", error); 1037 return error; 1038 } 1039 1040 if (iqs5xx->input) { 1041 error = input_register_device(iqs5xx->input); 1042 if (error) 1043 dev_err(&client->dev, 1044 "Failed to register device: %d\n", 1045 error); 1046 } 1047 1048 return error; 1049 } 1050 1051 static const struct i2c_device_id iqs5xx_id[] = { 1052 { "iqs550", 0 }, 1053 { "iqs572", 1 }, 1054 { "iqs525", 2 }, 1055 { } 1056 }; 1057 MODULE_DEVICE_TABLE(i2c, iqs5xx_id); 1058 1059 static const struct of_device_id iqs5xx_of_match[] = { 1060 { .compatible = "azoteq,iqs550" }, 1061 { .compatible = "azoteq,iqs572" }, 1062 { .compatible = "azoteq,iqs525" }, 1063 { } 1064 }; 1065 MODULE_DEVICE_TABLE(of, iqs5xx_of_match); 1066 1067 static struct i2c_driver iqs5xx_i2c_driver = { 1068 .driver = { 1069 .name = "iqs5xx", 1070 .dev_groups = iqs5xx_groups, 1071 .of_match_table = iqs5xx_of_match, 1072 .pm = pm_sleep_ptr(&iqs5xx_pm), 1073 }, 1074 .id_table = iqs5xx_id, 1075 .probe = iqs5xx_probe, 1076 }; 1077 module_i2c_driver(iqs5xx_i2c_driver); 1078 1079 MODULE_AUTHOR("Jeff LaBundy <jeff@labundy.com>"); 1080 MODULE_DESCRIPTION("Azoteq IQS550/572/525 Trackpad/Touchscreen Controller"); 1081 MODULE_LICENSE("GPL"); 1082