1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Azoteq IQS550/572/525 Trackpad/Touchscreen Controller 4 * 5 * Copyright (C) 2018 Jeff LaBundy <jeff@labundy.com> 6 * 7 * These devices require firmware exported from a PC-based configuration tool 8 * made available by the vendor. Firmware files may be pushed to the device's 9 * nonvolatile memory by writing the filename to the 'fw_file' sysfs control. 10 * 11 * Link to PC-based configuration tool and datasheet: https://www.azoteq.com/ 12 */ 13 14 #include <linux/bits.h> 15 #include <linux/delay.h> 16 #include <linux/device.h> 17 #include <linux/err.h> 18 #include <linux/firmware.h> 19 #include <linux/gpio/consumer.h> 20 #include <linux/hex.h> 21 #include <linux/i2c.h> 22 #include <linux/input.h> 23 #include <linux/input/mt.h> 24 #include <linux/input/touchscreen.h> 25 #include <linux/interrupt.h> 26 #include <linux/kernel.h> 27 #include <linux/mod_devicetable.h> 28 #include <linux/module.h> 29 #include <linux/slab.h> 30 #include <linux/unaligned.h> 31 32 #define IQS5XX_FW_FILE_LEN 64 33 #define IQS5XX_NUM_RETRIES 10 34 #define IQS5XX_NUM_CONTACTS 5 35 #define IQS5XX_WR_BYTES_MAX 2 36 37 #define IQS5XX_PROD_NUM_IQS550 40 38 #define IQS5XX_PROD_NUM_IQS572 58 39 #define IQS5XX_PROD_NUM_IQS525 52 40 41 #define IQS5XX_SHOW_RESET BIT(7) 42 #define IQS5XX_ACK_RESET BIT(7) 43 44 #define IQS5XX_SUSPEND BIT(0) 45 #define IQS5XX_RESUME 0 46 47 #define IQS5XX_SETUP_COMPLETE BIT(6) 48 #define IQS5XX_WDT BIT(5) 49 #define IQS5XX_ALP_REATI BIT(3) 50 #define IQS5XX_REATI BIT(2) 51 52 #define IQS5XX_TP_EVENT BIT(2) 53 #define IQS5XX_EVENT_MODE BIT(0) 54 55 #define IQS5XX_PROD_NUM 0x0000 56 #define IQS5XX_SYS_INFO0 0x000F 57 #define IQS5XX_SYS_INFO1 0x0010 58 #define IQS5XX_SYS_CTRL0 0x0431 59 #define IQS5XX_SYS_CTRL1 0x0432 60 #define IQS5XX_SYS_CFG0 0x058E 61 #define IQS5XX_SYS_CFG1 0x058F 62 #define IQS5XX_X_RES 0x066E 63 #define IQS5XX_Y_RES 0x0670 64 #define IQS5XX_EXP_FILE 0x0677 65 #define IQS5XX_CHKSM 0x83C0 66 #define IQS5XX_APP 0x8400 67 #define IQS5XX_CSTM 0xBE00 68 #define IQS5XX_PMAP_END 0xBFFF 69 #define IQS5XX_END_COMM 0xEEEE 70 71 #define IQS5XX_CHKSM_LEN (IQS5XX_APP - IQS5XX_CHKSM) 72 #define IQS5XX_APP_LEN (IQS5XX_CSTM - IQS5XX_APP) 73 #define IQS5XX_CSTM_LEN (IQS5XX_PMAP_END + 1 - IQS5XX_CSTM) 74 #define IQS5XX_PMAP_LEN (IQS5XX_PMAP_END + 1 - IQS5XX_CHKSM) 75 76 #define IQS5XX_REC_HDR_LEN 4 77 #define IQS5XX_REC_LEN_MAX 255 78 #define IQS5XX_REC_TYPE_DATA 0x00 79 #define IQS5XX_REC_TYPE_EOF 0x01 80 81 #define IQS5XX_BL_ADDR_MASK 0x40 82 #define IQS5XX_BL_CMD_VER 0x00 83 #define IQS5XX_BL_CMD_READ 0x01 84 #define IQS5XX_BL_CMD_EXEC 0x02 85 #define IQS5XX_BL_CMD_CRC 0x03 86 #define IQS5XX_BL_BLK_LEN_MAX 64 87 #define IQS5XX_BL_ID 0x0200 88 #define IQS5XX_BL_STATUS_NONE 0xEE 89 #define IQS5XX_BL_CRC_PASS 0x00 90 #define IQS5XX_BL_CRC_FAIL 0x01 91 #define IQS5XX_BL_ATTEMPTS 3 92 93 struct iqs5xx_dev_id_info { 94 __be16 prod_num; 95 __be16 proj_num; 96 u8 major_ver; 97 u8 minor_ver; 98 u8 bl_status; 99 } __packed; 100 101 struct iqs5xx_ihex_rec { 102 char start; 103 char len[2]; 104 char addr[4]; 105 char type[2]; 106 char data[2]; 107 } __packed; 108 109 struct iqs5xx_touch_data { 110 __be16 abs_x; 111 __be16 abs_y; 112 __be16 strength; 113 u8 area; 114 } __packed; 115 116 struct iqs5xx_status { 117 u8 sys_info[2]; 118 u8 num_active; 119 __be16 rel_x; 120 __be16 rel_y; 121 struct iqs5xx_touch_data touch_data[IQS5XX_NUM_CONTACTS]; 122 } __packed; 123 124 struct iqs5xx_private { 125 struct i2c_client *client; 126 struct input_dev *input; 127 struct gpio_desc *reset_gpio; 128 struct touchscreen_properties prop; 129 struct mutex lock; 130 struct iqs5xx_dev_id_info dev_id_info; 131 u8 exp_file[2]; 132 }; 133 134 static int iqs5xx_read_burst(struct i2c_client *client, 135 u16 reg, void *val, u16 len) 136 { 137 __be16 reg_buf = cpu_to_be16(reg); 138 int ret, i; 139 struct i2c_msg msg[] = { 140 { 141 .addr = client->addr, 142 .flags = 0, 143 .len = sizeof(reg_buf), 144 .buf = (u8 *)®_buf, 145 }, 146 { 147 .addr = client->addr, 148 .flags = I2C_M_RD, 149 .len = len, 150 .buf = (u8 *)val, 151 }, 152 }; 153 154 /* 155 * The first addressing attempt outside of a communication window fails 156 * and must be retried, after which the device clock stretches until it 157 * is available. 158 */ 159 for (i = 0; i < IQS5XX_NUM_RETRIES; i++) { 160 ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); 161 if (ret == ARRAY_SIZE(msg)) 162 return 0; 163 164 usleep_range(200, 300); 165 } 166 167 if (ret >= 0) 168 ret = -EIO; 169 170 dev_err(&client->dev, "Failed to read from address 0x%04X: %d\n", 171 reg, ret); 172 173 return ret; 174 } 175 176 static int iqs5xx_read_word(struct i2c_client *client, u16 reg, u16 *val) 177 { 178 __be16 val_buf; 179 int error; 180 181 error = iqs5xx_read_burst(client, reg, &val_buf, sizeof(val_buf)); 182 if (error) 183 return error; 184 185 *val = be16_to_cpu(val_buf); 186 187 return 0; 188 } 189 190 static int iqs5xx_write_burst(struct i2c_client *client, 191 u16 reg, const void *val, u16 len) 192 { 193 int ret, i; 194 u16 mlen = sizeof(reg) + len; 195 u8 mbuf[sizeof(reg) + IQS5XX_WR_BYTES_MAX]; 196 197 if (len > IQS5XX_WR_BYTES_MAX) 198 return -EINVAL; 199 200 put_unaligned_be16(reg, mbuf); 201 memcpy(mbuf + sizeof(reg), val, len); 202 203 /* 204 * The first addressing attempt outside of a communication window fails 205 * and must be retried, after which the device clock stretches until it 206 * is available. 207 */ 208 for (i = 0; i < IQS5XX_NUM_RETRIES; i++) { 209 ret = i2c_master_send(client, mbuf, mlen); 210 if (ret == mlen) 211 return 0; 212 213 usleep_range(200, 300); 214 } 215 216 if (ret >= 0) 217 ret = -EIO; 218 219 dev_err(&client->dev, "Failed to write to address 0x%04X: %d\n", 220 reg, ret); 221 222 return ret; 223 } 224 225 static int iqs5xx_write_word(struct i2c_client *client, u16 reg, u16 val) 226 { 227 __be16 val_buf = cpu_to_be16(val); 228 229 return iqs5xx_write_burst(client, reg, &val_buf, sizeof(val_buf)); 230 } 231 232 static int iqs5xx_write_byte(struct i2c_client *client, u16 reg, u8 val) 233 { 234 return iqs5xx_write_burst(client, reg, &val, sizeof(val)); 235 } 236 237 static void iqs5xx_reset(struct i2c_client *client) 238 { 239 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 240 241 gpiod_set_value_cansleep(iqs5xx->reset_gpio, 1); 242 usleep_range(200, 300); 243 244 gpiod_set_value_cansleep(iqs5xx->reset_gpio, 0); 245 } 246 247 static int iqs5xx_bl_cmd(struct i2c_client *client, u8 bl_cmd, u16 bl_addr) 248 { 249 struct i2c_msg msg; 250 int ret; 251 u8 mbuf[sizeof(bl_cmd) + sizeof(bl_addr)]; 252 253 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 254 msg.flags = 0; 255 msg.len = sizeof(bl_cmd); 256 msg.buf = mbuf; 257 258 *mbuf = bl_cmd; 259 260 switch (bl_cmd) { 261 case IQS5XX_BL_CMD_VER: 262 case IQS5XX_BL_CMD_CRC: 263 case IQS5XX_BL_CMD_EXEC: 264 break; 265 case IQS5XX_BL_CMD_READ: 266 msg.len += sizeof(bl_addr); 267 put_unaligned_be16(bl_addr, mbuf + sizeof(bl_cmd)); 268 break; 269 default: 270 return -EINVAL; 271 } 272 273 ret = i2c_transfer(client->adapter, &msg, 1); 274 if (ret != 1) 275 goto msg_fail; 276 277 switch (bl_cmd) { 278 case IQS5XX_BL_CMD_VER: 279 msg.len = sizeof(u16); 280 break; 281 case IQS5XX_BL_CMD_CRC: 282 msg.len = sizeof(u8); 283 /* 284 * This delay saves the bus controller the trouble of having to 285 * tolerate a relatively long clock-stretching period while the 286 * CRC is calculated. 287 */ 288 msleep(50); 289 break; 290 case IQS5XX_BL_CMD_EXEC: 291 usleep_range(10000, 10100); 292 fallthrough; 293 default: 294 return 0; 295 } 296 297 msg.flags = I2C_M_RD; 298 299 ret = i2c_transfer(client->adapter, &msg, 1); 300 if (ret != 1) 301 goto msg_fail; 302 303 if (bl_cmd == IQS5XX_BL_CMD_VER && 304 get_unaligned_be16(mbuf) != IQS5XX_BL_ID) { 305 dev_err(&client->dev, "Unrecognized bootloader ID: 0x%04X\n", 306 get_unaligned_be16(mbuf)); 307 return -EINVAL; 308 } 309 310 if (bl_cmd == IQS5XX_BL_CMD_CRC && *mbuf != IQS5XX_BL_CRC_PASS) { 311 dev_err(&client->dev, "Bootloader CRC failed\n"); 312 return -EIO; 313 } 314 315 return 0; 316 317 msg_fail: 318 if (ret >= 0) 319 ret = -EIO; 320 321 if (bl_cmd != IQS5XX_BL_CMD_VER) 322 dev_err(&client->dev, 323 "Unsuccessful bootloader command 0x%02X: %d\n", 324 bl_cmd, ret); 325 326 return ret; 327 } 328 329 static int iqs5xx_bl_open(struct i2c_client *client) 330 { 331 int error, i, j; 332 333 /* 334 * The device opens a bootloader polling window for 2 ms following the 335 * release of reset. If the host cannot establish communication during 336 * this time frame, it must cycle reset again. 337 */ 338 for (i = 0; i < IQS5XX_BL_ATTEMPTS; i++) { 339 iqs5xx_reset(client); 340 usleep_range(350, 400); 341 342 for (j = 0; j < IQS5XX_NUM_RETRIES; j++) { 343 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0); 344 if (!error) 345 usleep_range(10000, 10100); 346 else if (error != -EINVAL) 347 continue; 348 349 return error; 350 } 351 } 352 353 dev_err(&client->dev, "Failed to open bootloader: %d\n", error); 354 355 return error; 356 } 357 358 static int iqs5xx_bl_write(struct i2c_client *client, 359 u16 bl_addr, u8 *pmap_data, u16 pmap_len) 360 { 361 struct i2c_msg msg; 362 int ret, i; 363 u8 mbuf[sizeof(bl_addr) + IQS5XX_BL_BLK_LEN_MAX]; 364 365 if (pmap_len % IQS5XX_BL_BLK_LEN_MAX) 366 return -EINVAL; 367 368 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 369 msg.flags = 0; 370 msg.len = sizeof(mbuf); 371 msg.buf = mbuf; 372 373 for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) { 374 put_unaligned_be16(bl_addr + i, mbuf); 375 memcpy(mbuf + sizeof(bl_addr), pmap_data + i, 376 sizeof(mbuf) - sizeof(bl_addr)); 377 378 ret = i2c_transfer(client->adapter, &msg, 1); 379 if (ret != 1) 380 goto msg_fail; 381 382 usleep_range(10000, 10100); 383 } 384 385 return 0; 386 387 msg_fail: 388 if (ret >= 0) 389 ret = -EIO; 390 391 dev_err(&client->dev, "Failed to write block at address 0x%04X: %d\n", 392 bl_addr + i, ret); 393 394 return ret; 395 } 396 397 static int iqs5xx_bl_verify(struct i2c_client *client, 398 u16 bl_addr, u8 *pmap_data, u16 pmap_len) 399 { 400 struct i2c_msg msg; 401 int ret, i; 402 u8 bl_data[IQS5XX_BL_BLK_LEN_MAX]; 403 404 if (pmap_len % IQS5XX_BL_BLK_LEN_MAX) 405 return -EINVAL; 406 407 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 408 msg.flags = I2C_M_RD; 409 msg.len = sizeof(bl_data); 410 msg.buf = bl_data; 411 412 for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) { 413 ret = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_READ, bl_addr + i); 414 if (ret) 415 return ret; 416 417 ret = i2c_transfer(client->adapter, &msg, 1); 418 if (ret != 1) 419 goto msg_fail; 420 421 if (memcmp(bl_data, pmap_data + i, sizeof(bl_data))) { 422 dev_err(&client->dev, 423 "Failed to verify block at address 0x%04X\n", 424 bl_addr + i); 425 return -EIO; 426 } 427 } 428 429 return 0; 430 431 msg_fail: 432 if (ret >= 0) 433 ret = -EIO; 434 435 dev_err(&client->dev, "Failed to read block at address 0x%04X: %d\n", 436 bl_addr + i, ret); 437 438 return ret; 439 } 440 441 static int iqs5xx_set_state(struct i2c_client *client, u8 state) 442 { 443 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 444 int error1, error2; 445 446 if (!iqs5xx->dev_id_info.bl_status) 447 return 0; 448 449 mutex_lock(&iqs5xx->lock); 450 451 /* 452 * Addressing the device outside of a communication window prompts it 453 * to assert the RDY output, so disable the interrupt line to prevent 454 * the handler from servicing a false interrupt. 455 */ 456 disable_irq(client->irq); 457 458 error1 = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL1, state); 459 error2 = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 460 461 usleep_range(50, 100); 462 enable_irq(client->irq); 463 464 mutex_unlock(&iqs5xx->lock); 465 466 if (error1) 467 return error1; 468 469 return error2; 470 } 471 472 static int iqs5xx_open(struct input_dev *input) 473 { 474 struct iqs5xx_private *iqs5xx = input_get_drvdata(input); 475 476 return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME); 477 } 478 479 static void iqs5xx_close(struct input_dev *input) 480 { 481 struct iqs5xx_private *iqs5xx = input_get_drvdata(input); 482 483 iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND); 484 } 485 486 static int iqs5xx_axis_init(struct i2c_client *client) 487 { 488 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 489 struct touchscreen_properties *prop = &iqs5xx->prop; 490 struct input_dev *input = iqs5xx->input; 491 u16 max_x, max_y; 492 int error; 493 494 if (!input) { 495 input = devm_input_allocate_device(&client->dev); 496 if (!input) 497 return -ENOMEM; 498 499 input->name = client->name; 500 input->id.bustype = BUS_I2C; 501 input->open = iqs5xx_open; 502 input->close = iqs5xx_close; 503 504 input_set_drvdata(input, iqs5xx); 505 iqs5xx->input = input; 506 } 507 508 error = iqs5xx_read_word(client, IQS5XX_X_RES, &max_x); 509 if (error) 510 return error; 511 512 error = iqs5xx_read_word(client, IQS5XX_Y_RES, &max_y); 513 if (error) 514 return error; 515 516 input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0); 517 input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0); 518 input_set_abs_params(input, ABS_MT_PRESSURE, 0, U16_MAX, 0, 0); 519 520 touchscreen_parse_properties(input, true, prop); 521 522 /* 523 * The device reserves 0xFFFF for coordinates that correspond to slots 524 * which are not in a state of touch. 525 */ 526 if (prop->max_x >= U16_MAX || prop->max_y >= U16_MAX) { 527 dev_err(&client->dev, "Invalid touchscreen size: %u*%u\n", 528 prop->max_x, prop->max_y); 529 return -EINVAL; 530 } 531 532 if (prop->max_x != max_x) { 533 error = iqs5xx_write_word(client, IQS5XX_X_RES, prop->max_x); 534 if (error) 535 return error; 536 } 537 538 if (prop->max_y != max_y) { 539 error = iqs5xx_write_word(client, IQS5XX_Y_RES, prop->max_y); 540 if (error) 541 return error; 542 } 543 544 error = input_mt_init_slots(input, IQS5XX_NUM_CONTACTS, 545 INPUT_MT_DIRECT); 546 if (error) 547 dev_err(&client->dev, "Failed to initialize slots: %d\n", 548 error); 549 550 return error; 551 } 552 553 static int iqs5xx_dev_init(struct i2c_client *client) 554 { 555 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 556 struct iqs5xx_dev_id_info *dev_id_info; 557 int error; 558 u8 buf[sizeof(*dev_id_info) + 1]; 559 560 error = iqs5xx_read_burst(client, IQS5XX_PROD_NUM, 561 &buf[1], sizeof(*dev_id_info)); 562 if (error) 563 return iqs5xx_bl_open(client); 564 565 /* 566 * A000 and B000 devices use 8-bit and 16-bit addressing, respectively. 567 * Querying an A000 device's version information with 16-bit addressing 568 * gives the appearance that the data is shifted by one byte; a nonzero 569 * leading array element suggests this could be the case (in which case 570 * the missing zero is prepended). 571 */ 572 buf[0] = 0; 573 dev_id_info = (struct iqs5xx_dev_id_info *)&buf[buf[1] ? 0 : 1]; 574 575 switch (be16_to_cpu(dev_id_info->prod_num)) { 576 case IQS5XX_PROD_NUM_IQS550: 577 case IQS5XX_PROD_NUM_IQS572: 578 case IQS5XX_PROD_NUM_IQS525: 579 break; 580 default: 581 dev_err(&client->dev, "Unrecognized product number: %u\n", 582 be16_to_cpu(dev_id_info->prod_num)); 583 return -EINVAL; 584 } 585 586 /* 587 * With the product number recognized yet shifted by one byte, open the 588 * bootloader and wait for user space to convert the A000 device into a 589 * B000 device via new firmware. 590 */ 591 if (buf[1]) { 592 dev_err(&client->dev, "Opening bootloader for A000 device\n"); 593 return iqs5xx_bl_open(client); 594 } 595 596 error = iqs5xx_read_burst(client, IQS5XX_EXP_FILE, 597 iqs5xx->exp_file, sizeof(iqs5xx->exp_file)); 598 if (error) 599 return error; 600 601 error = iqs5xx_axis_init(client); 602 if (error) 603 return error; 604 605 error = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL0, IQS5XX_ACK_RESET); 606 if (error) 607 return error; 608 609 error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG0, 610 IQS5XX_SETUP_COMPLETE | IQS5XX_WDT | 611 IQS5XX_ALP_REATI | IQS5XX_REATI); 612 if (error) 613 return error; 614 615 error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG1, 616 IQS5XX_TP_EVENT | IQS5XX_EVENT_MODE); 617 if (error) 618 return error; 619 620 error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 621 if (error) 622 return error; 623 624 iqs5xx->dev_id_info = *dev_id_info; 625 626 /* 627 * The following delay allows ATI to complete before the open and close 628 * callbacks are free to elicit I2C communication. Any attempts to read 629 * from or write to the device during this time may face extended clock 630 * stretching and prompt the I2C controller to report an error. 631 */ 632 msleep(250); 633 634 return 0; 635 } 636 637 static irqreturn_t iqs5xx_irq(int irq, void *data) 638 { 639 struct iqs5xx_private *iqs5xx = data; 640 struct iqs5xx_status status; 641 struct i2c_client *client = iqs5xx->client; 642 struct input_dev *input = iqs5xx->input; 643 int error, i; 644 645 /* 646 * This check is purely a precaution, as the device does not assert the 647 * RDY output during bootloader mode. If the device operates outside of 648 * bootloader mode, the input device is guaranteed to be allocated. 649 */ 650 if (!iqs5xx->dev_id_info.bl_status) 651 return IRQ_NONE; 652 653 error = iqs5xx_read_burst(client, IQS5XX_SYS_INFO0, 654 &status, sizeof(status)); 655 if (error) 656 return IRQ_NONE; 657 658 if (status.sys_info[0] & IQS5XX_SHOW_RESET) { 659 dev_err(&client->dev, "Unexpected device reset\n"); 660 661 error = iqs5xx_dev_init(client); 662 if (error) { 663 dev_err(&client->dev, 664 "Failed to re-initialize device: %d\n", error); 665 return IRQ_NONE; 666 } 667 668 return IRQ_HANDLED; 669 } 670 671 for (i = 0; i < ARRAY_SIZE(status.touch_data); i++) { 672 struct iqs5xx_touch_data *touch_data = &status.touch_data[i]; 673 u16 pressure = be16_to_cpu(touch_data->strength); 674 675 input_mt_slot(input, i); 676 if (input_mt_report_slot_state(input, MT_TOOL_FINGER, 677 pressure != 0)) { 678 touchscreen_report_pos(input, &iqs5xx->prop, 679 be16_to_cpu(touch_data->abs_x), 680 be16_to_cpu(touch_data->abs_y), 681 true); 682 input_report_abs(input, ABS_MT_PRESSURE, pressure); 683 } 684 } 685 686 input_mt_sync_frame(input); 687 input_sync(input); 688 689 error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 690 if (error) 691 return IRQ_NONE; 692 693 /* 694 * Once the communication window is closed, a small delay is added to 695 * ensure the device's RDY output has been deasserted by the time the 696 * interrupt handler returns. 697 */ 698 usleep_range(50, 100); 699 700 return IRQ_HANDLED; 701 } 702 703 static int iqs5xx_fw_file_parse(struct i2c_client *client, 704 const char *fw_file, u8 *pmap) 705 { 706 const struct firmware *fw; 707 struct iqs5xx_ihex_rec *rec; 708 size_t pos = 0; 709 int error, i; 710 u16 rec_num = 1; 711 u16 rec_addr; 712 u8 rec_len, rec_type, rec_chksm, chksm; 713 u8 rec_hdr[IQS5XX_REC_HDR_LEN]; 714 u8 rec_data[IQS5XX_REC_LEN_MAX]; 715 716 /* 717 * Firmware exported from the vendor's configuration tool deviates from 718 * standard ihex as follows: (1) the checksum for records corresponding 719 * to user-exported settings is not recalculated, and (2) an address of 720 * 0xFFFF is used for the EOF record. 721 * 722 * Because the ihex2fw tool tolerates neither (1) nor (2), the slightly 723 * nonstandard ihex firmware is parsed directly by the driver. 724 */ 725 error = request_firmware(&fw, fw_file, &client->dev); 726 if (error) { 727 dev_err(&client->dev, "Failed to request firmware %s: %d\n", 728 fw_file, error); 729 return error; 730 } 731 732 do { 733 if (pos + sizeof(*rec) > fw->size) { 734 dev_err(&client->dev, "Insufficient firmware size\n"); 735 error = -EINVAL; 736 break; 737 } 738 rec = (struct iqs5xx_ihex_rec *)(fw->data + pos); 739 pos += sizeof(*rec); 740 741 if (rec->start != ':') { 742 dev_err(&client->dev, "Invalid start at record %u\n", 743 rec_num); 744 error = -EINVAL; 745 break; 746 } 747 748 error = hex2bin(rec_hdr, rec->len, sizeof(rec_hdr)); 749 if (error) { 750 dev_err(&client->dev, "Invalid header at record %u\n", 751 rec_num); 752 break; 753 } 754 755 rec_len = *rec_hdr; 756 rec_addr = get_unaligned_be16(rec_hdr + sizeof(rec_len)); 757 rec_type = *(rec_hdr + sizeof(rec_len) + sizeof(rec_addr)); 758 759 if (pos + rec_len * 2 > fw->size) { 760 dev_err(&client->dev, "Insufficient firmware size\n"); 761 error = -EINVAL; 762 break; 763 } 764 pos += (rec_len * 2); 765 766 error = hex2bin(rec_data, rec->data, rec_len); 767 if (error) { 768 dev_err(&client->dev, "Invalid data at record %u\n", 769 rec_num); 770 break; 771 } 772 773 error = hex2bin(&rec_chksm, 774 rec->data + rec_len * 2, sizeof(rec_chksm)); 775 if (error) { 776 dev_err(&client->dev, "Invalid checksum at record %u\n", 777 rec_num); 778 break; 779 } 780 781 chksm = 0; 782 for (i = 0; i < sizeof(rec_hdr); i++) 783 chksm += rec_hdr[i]; 784 for (i = 0; i < rec_len; i++) 785 chksm += rec_data[i]; 786 chksm = ~chksm + 1; 787 788 if (chksm != rec_chksm && rec_addr < IQS5XX_CSTM) { 789 dev_err(&client->dev, 790 "Incorrect checksum at record %u\n", 791 rec_num); 792 error = -EINVAL; 793 break; 794 } 795 796 switch (rec_type) { 797 case IQS5XX_REC_TYPE_DATA: 798 if (rec_addr < IQS5XX_CHKSM || 799 rec_addr > IQS5XX_PMAP_END) { 800 dev_err(&client->dev, 801 "Invalid address at record %u\n", 802 rec_num); 803 error = -EINVAL; 804 } else { 805 memcpy(pmap + rec_addr - IQS5XX_CHKSM, 806 rec_data, rec_len); 807 } 808 break; 809 case IQS5XX_REC_TYPE_EOF: 810 break; 811 default: 812 dev_err(&client->dev, "Invalid type at record %u\n", 813 rec_num); 814 error = -EINVAL; 815 } 816 817 if (error) 818 break; 819 820 rec_num++; 821 while (pos < fw->size) { 822 if (*(fw->data + pos) == ':') 823 break; 824 pos++; 825 } 826 } while (rec_type != IQS5XX_REC_TYPE_EOF); 827 828 release_firmware(fw); 829 830 return error; 831 } 832 833 static int iqs5xx_fw_file_write(struct i2c_client *client, const char *fw_file) 834 { 835 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 836 int error, error_init = 0; 837 u8 *pmap; 838 839 pmap = kzalloc(IQS5XX_PMAP_LEN, GFP_KERNEL); 840 if (!pmap) 841 return -ENOMEM; 842 843 error = iqs5xx_fw_file_parse(client, fw_file, pmap); 844 if (error) 845 goto err_kfree; 846 847 mutex_lock(&iqs5xx->lock); 848 849 /* 850 * Disable the interrupt line in case the first attempt(s) to enter the 851 * bootloader don't happen quickly enough, in which case the device may 852 * assert the RDY output until the next attempt. 853 */ 854 disable_irq(client->irq); 855 856 iqs5xx->dev_id_info.bl_status = 0; 857 858 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0); 859 if (error) { 860 error = iqs5xx_bl_open(client); 861 if (error) 862 goto err_reset; 863 } 864 865 error = iqs5xx_bl_write(client, IQS5XX_CHKSM, pmap, IQS5XX_PMAP_LEN); 866 if (error) 867 goto err_reset; 868 869 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_CRC, 0); 870 if (error) 871 goto err_reset; 872 873 error = iqs5xx_bl_verify(client, IQS5XX_CSTM, 874 pmap + IQS5XX_CHKSM_LEN + IQS5XX_APP_LEN, 875 IQS5XX_CSTM_LEN); 876 877 err_reset: 878 iqs5xx_reset(client); 879 usleep_range(15000, 15100); 880 881 error_init = iqs5xx_dev_init(client); 882 if (!iqs5xx->dev_id_info.bl_status) 883 error_init = error_init ? : -EINVAL; 884 885 enable_irq(client->irq); 886 887 mutex_unlock(&iqs5xx->lock); 888 889 err_kfree: 890 kfree(pmap); 891 892 return error ? : error_init; 893 } 894 895 static ssize_t fw_file_store(struct device *dev, 896 struct device_attribute *attr, const char *buf, 897 size_t count) 898 { 899 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 900 struct i2c_client *client = iqs5xx->client; 901 size_t len = count; 902 bool input_reg = !iqs5xx->input; 903 char fw_file[IQS5XX_FW_FILE_LEN + 1]; 904 int error; 905 906 if (!len) 907 return -EINVAL; 908 909 if (buf[len - 1] == '\n') 910 len--; 911 912 if (len > IQS5XX_FW_FILE_LEN) 913 return -ENAMETOOLONG; 914 915 memcpy(fw_file, buf, len); 916 fw_file[len] = '\0'; 917 918 error = iqs5xx_fw_file_write(client, fw_file); 919 if (error) 920 return error; 921 922 /* 923 * If the input device was not allocated already, it is guaranteed to 924 * be allocated by this point and can finally be registered. 925 */ 926 if (input_reg) { 927 error = input_register_device(iqs5xx->input); 928 if (error) { 929 dev_err(&client->dev, 930 "Failed to register device: %d\n", 931 error); 932 return error; 933 } 934 } 935 936 return count; 937 } 938 939 static ssize_t fw_info_show(struct device *dev, 940 struct device_attribute *attr, char *buf) 941 { 942 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 943 944 if (!iqs5xx->dev_id_info.bl_status) 945 return -ENODATA; 946 947 return sysfs_emit(buf, "%u.%u.%u.%u:%u.%u\n", 948 be16_to_cpu(iqs5xx->dev_id_info.prod_num), 949 be16_to_cpu(iqs5xx->dev_id_info.proj_num), 950 iqs5xx->dev_id_info.major_ver, 951 iqs5xx->dev_id_info.minor_ver, 952 iqs5xx->exp_file[0], iqs5xx->exp_file[1]); 953 } 954 955 static DEVICE_ATTR_WO(fw_file); 956 static DEVICE_ATTR_RO(fw_info); 957 958 static struct attribute *iqs5xx_attrs[] = { 959 &dev_attr_fw_file.attr, 960 &dev_attr_fw_info.attr, 961 NULL, 962 }; 963 964 static umode_t iqs5xx_attr_is_visible(struct kobject *kobj, 965 struct attribute *attr, int i) 966 { 967 struct device *dev = kobj_to_dev(kobj); 968 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 969 970 if (attr == &dev_attr_fw_file.attr && 971 (iqs5xx->dev_id_info.bl_status == IQS5XX_BL_STATUS_NONE || 972 !iqs5xx->reset_gpio)) 973 return 0; 974 975 return attr->mode; 976 } 977 978 static const struct attribute_group iqs5xx_group = { 979 .is_visible = iqs5xx_attr_is_visible, 980 .attrs = iqs5xx_attrs, 981 }; 982 __ATTRIBUTE_GROUPS(iqs5xx); 983 984 static int iqs5xx_suspend(struct device *dev) 985 { 986 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 987 struct input_dev *input = iqs5xx->input; 988 int error = 0; 989 990 if (!input || device_may_wakeup(dev)) 991 return error; 992 993 mutex_lock(&input->mutex); 994 995 if (input_device_enabled(input)) 996 error = iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND); 997 998 mutex_unlock(&input->mutex); 999 1000 return error; 1001 } 1002 1003 static int iqs5xx_resume(struct device *dev) 1004 { 1005 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 1006 struct input_dev *input = iqs5xx->input; 1007 int error = 0; 1008 1009 if (!input || device_may_wakeup(dev)) 1010 return error; 1011 1012 mutex_lock(&input->mutex); 1013 1014 if (input_device_enabled(input)) 1015 error = iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME); 1016 1017 mutex_unlock(&input->mutex); 1018 1019 return error; 1020 } 1021 1022 static DEFINE_SIMPLE_DEV_PM_OPS(iqs5xx_pm, iqs5xx_suspend, iqs5xx_resume); 1023 1024 static int iqs5xx_probe(struct i2c_client *client) 1025 { 1026 struct iqs5xx_private *iqs5xx; 1027 int error; 1028 1029 iqs5xx = devm_kzalloc(&client->dev, sizeof(*iqs5xx), GFP_KERNEL); 1030 if (!iqs5xx) 1031 return -ENOMEM; 1032 1033 i2c_set_clientdata(client, iqs5xx); 1034 iqs5xx->client = client; 1035 1036 iqs5xx->reset_gpio = devm_gpiod_get_optional(&client->dev, 1037 "reset", GPIOD_OUT_LOW); 1038 if (IS_ERR(iqs5xx->reset_gpio)) { 1039 error = PTR_ERR(iqs5xx->reset_gpio); 1040 dev_err(&client->dev, "Failed to request GPIO: %d\n", error); 1041 return error; 1042 } 1043 1044 mutex_init(&iqs5xx->lock); 1045 1046 error = iqs5xx_dev_init(client); 1047 if (error) 1048 return error; 1049 1050 error = devm_request_threaded_irq(&client->dev, client->irq, 1051 NULL, iqs5xx_irq, IRQF_ONESHOT, 1052 client->name, iqs5xx); 1053 if (error) { 1054 dev_err(&client->dev, "Failed to request IRQ: %d\n", error); 1055 return error; 1056 } 1057 1058 if (iqs5xx->input) { 1059 error = input_register_device(iqs5xx->input); 1060 if (error) 1061 dev_err(&client->dev, 1062 "Failed to register device: %d\n", 1063 error); 1064 } 1065 1066 return error; 1067 } 1068 1069 static const struct i2c_device_id iqs5xx_id[] = { 1070 { "iqs550", 0 }, 1071 { "iqs572", 1 }, 1072 { "iqs525", 2 }, 1073 { } 1074 }; 1075 MODULE_DEVICE_TABLE(i2c, iqs5xx_id); 1076 1077 static const struct of_device_id iqs5xx_of_match[] = { 1078 { .compatible = "azoteq,iqs550" }, 1079 { .compatible = "azoteq,iqs572" }, 1080 { .compatible = "azoteq,iqs525" }, 1081 { } 1082 }; 1083 MODULE_DEVICE_TABLE(of, iqs5xx_of_match); 1084 1085 static struct i2c_driver iqs5xx_i2c_driver = { 1086 .driver = { 1087 .name = "iqs5xx", 1088 .dev_groups = iqs5xx_groups, 1089 .of_match_table = iqs5xx_of_match, 1090 .pm = pm_sleep_ptr(&iqs5xx_pm), 1091 }, 1092 .id_table = iqs5xx_id, 1093 .probe = iqs5xx_probe, 1094 }; 1095 module_i2c_driver(iqs5xx_i2c_driver); 1096 1097 MODULE_AUTHOR("Jeff LaBundy <jeff@labundy.com>"); 1098 MODULE_DESCRIPTION("Azoteq IQS550/572/525 Trackpad/Touchscreen Controller"); 1099 MODULE_LICENSE("GPL"); 1100