1// SPDX-License-Identifier: GPL-2.0+ 2/* 3 * Azoteq IQS550/572/525 Trackpad/Touchscreen Controller 4 * 5 * Copyright (C) 2018 Jeff LaBundy <jeff@labundy.com> 6 * 7 * These devices require firmware exported from a PC-based configuration tool 8 * made available by the vendor. Firmware files may be pushed to the device's 9 * nonvolatile memory by writing the filename to the 'fw_file' sysfs control. 10 * 11 * Link to PC-based configuration tool and datasheet: https://www.azoteq.com/ 12 */ 13 14#include <linux/bits.h> 15#include <linux/delay.h> 16#include <linux/device.h> 17#include <linux/err.h> 18#include <linux/firmware.h> 19#include <linux/gpio/consumer.h> 20#include <linux/i2c.h> 21#include <linux/input.h> 22#include <linux/input/mt.h> 23#include <linux/input/touchscreen.h> 24#include <linux/interrupt.h> 25#include <linux/kernel.h> 26#include <linux/mod_devicetable.h> 27#include <linux/module.h> 28#include <linux/slab.h> 29#include <asm/unaligned.h> 30 31#define IQS5XX_FW_FILE_LEN 64 32#define IQS5XX_NUM_RETRIES 10 33#define IQS5XX_NUM_CONTACTS 5 34#define IQS5XX_WR_BYTES_MAX 2 35 36#define IQS5XX_PROD_NUM_IQS550 40 37#define IQS5XX_PROD_NUM_IQS572 58 38#define IQS5XX_PROD_NUM_IQS525 52 39 40#define IQS5XX_SHOW_RESET BIT(7) 41#define IQS5XX_ACK_RESET BIT(7) 42 43#define IQS5XX_SUSPEND BIT(0) 44#define IQS5XX_RESUME 0 45 46#define IQS5XX_SETUP_COMPLETE BIT(6) 47#define IQS5XX_WDT BIT(5) 48#define IQS5XX_ALP_REATI BIT(3) 49#define IQS5XX_REATI BIT(2) 50 51#define IQS5XX_TP_EVENT BIT(2) 52#define IQS5XX_EVENT_MODE BIT(0) 53 54#define IQS5XX_PROD_NUM 0x0000 55#define IQS5XX_SYS_INFO0 0x000F 56#define IQS5XX_SYS_INFO1 0x0010 57#define IQS5XX_SYS_CTRL0 0x0431 58#define IQS5XX_SYS_CTRL1 0x0432 59#define IQS5XX_SYS_CFG0 0x058E 60#define IQS5XX_SYS_CFG1 0x058F 61#define IQS5XX_X_RES 0x066E 62#define IQS5XX_Y_RES 0x0670 63#define IQS5XX_EXP_FILE 0x0677 64#define IQS5XX_CHKSM 0x83C0 65#define IQS5XX_APP 0x8400 66#define IQS5XX_CSTM 0xBE00 67#define IQS5XX_PMAP_END 0xBFFF 68#define IQS5XX_END_COMM 0xEEEE 69 70#define IQS5XX_CHKSM_LEN (IQS5XX_APP - IQS5XX_CHKSM) 71#define IQS5XX_APP_LEN (IQS5XX_CSTM - IQS5XX_APP) 72#define IQS5XX_CSTM_LEN (IQS5XX_PMAP_END + 1 - IQS5XX_CSTM) 73#define IQS5XX_PMAP_LEN (IQS5XX_PMAP_END + 1 - IQS5XX_CHKSM) 74 75#define IQS5XX_REC_HDR_LEN 4 76#define IQS5XX_REC_LEN_MAX 255 77#define IQS5XX_REC_TYPE_DATA 0x00 78#define IQS5XX_REC_TYPE_EOF 0x01 79 80#define IQS5XX_BL_ADDR_MASK 0x40 81#define IQS5XX_BL_CMD_VER 0x00 82#define IQS5XX_BL_CMD_READ 0x01 83#define IQS5XX_BL_CMD_EXEC 0x02 84#define IQS5XX_BL_CMD_CRC 0x03 85#define IQS5XX_BL_BLK_LEN_MAX 64 86#define IQS5XX_BL_ID 0x0200 87#define IQS5XX_BL_STATUS_NONE 0xEE 88#define IQS5XX_BL_CRC_PASS 0x00 89#define IQS5XX_BL_CRC_FAIL 0x01 90#define IQS5XX_BL_ATTEMPTS 3 91 92struct iqs5xx_dev_id_info { 93 __be16 prod_num; 94 __be16 proj_num; 95 u8 major_ver; 96 u8 minor_ver; 97 u8 bl_status; 98} __packed; 99 100struct iqs5xx_ihex_rec { 101 char start; 102 char len[2]; 103 char addr[4]; 104 char type[2]; 105 char data[2]; 106} __packed; 107 108struct iqs5xx_touch_data { 109 __be16 abs_x; 110 __be16 abs_y; 111 __be16 strength; 112 u8 area; 113} __packed; 114 115struct iqs5xx_status { 116 u8 sys_info[2]; 117 u8 num_active; 118 __be16 rel_x; 119 __be16 rel_y; 120 struct iqs5xx_touch_data touch_data[IQS5XX_NUM_CONTACTS]; 121} __packed; 122 123struct iqs5xx_private { 124 struct i2c_client *client; 125 struct input_dev *input; 126 struct gpio_desc *reset_gpio; 127 struct touchscreen_properties prop; 128 struct mutex lock; 129 struct iqs5xx_dev_id_info dev_id_info; 130 u8 exp_file[2]; 131}; 132 133static int iqs5xx_read_burst(struct i2c_client *client, 134 u16 reg, void *val, u16 len) 135{ 136 __be16 reg_buf = cpu_to_be16(reg); 137 int ret, i; 138 struct i2c_msg msg[] = { 139 { 140 .addr = client->addr, 141 .flags = 0, 142 .len = sizeof(reg_buf), 143 .buf = (u8 *)®_buf, 144 }, 145 { 146 .addr = client->addr, 147 .flags = I2C_M_RD, 148 .len = len, 149 .buf = (u8 *)val, 150 }, 151 }; 152 153 /* 154 * The first addressing attempt outside of a communication window fails 155 * and must be retried, after which the device clock stretches until it 156 * is available. 157 */ 158 for (i = 0; i < IQS5XX_NUM_RETRIES; i++) { 159 ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); 160 if (ret == ARRAY_SIZE(msg)) 161 return 0; 162 163 usleep_range(200, 300); 164 } 165 166 if (ret >= 0) 167 ret = -EIO; 168 169 dev_err(&client->dev, "Failed to read from address 0x%04X: %d\n", 170 reg, ret); 171 172 return ret; 173} 174 175static int iqs5xx_read_word(struct i2c_client *client, u16 reg, u16 *val) 176{ 177 __be16 val_buf; 178 int error; 179 180 error = iqs5xx_read_burst(client, reg, &val_buf, sizeof(val_buf)); 181 if (error) 182 return error; 183 184 *val = be16_to_cpu(val_buf); 185 186 return 0; 187} 188 189static int iqs5xx_write_burst(struct i2c_client *client, 190 u16 reg, const void *val, u16 len) 191{ 192 int ret, i; 193 u16 mlen = sizeof(reg) + len; 194 u8 mbuf[sizeof(reg) + IQS5XX_WR_BYTES_MAX]; 195 196 if (len > IQS5XX_WR_BYTES_MAX) 197 return -EINVAL; 198 199 put_unaligned_be16(reg, mbuf); 200 memcpy(mbuf + sizeof(reg), val, len); 201 202 /* 203 * The first addressing attempt outside of a communication window fails 204 * and must be retried, after which the device clock stretches until it 205 * is available. 206 */ 207 for (i = 0; i < IQS5XX_NUM_RETRIES; i++) { 208 ret = i2c_master_send(client, mbuf, mlen); 209 if (ret == mlen) 210 return 0; 211 212 usleep_range(200, 300); 213 } 214 215 if (ret >= 0) 216 ret = -EIO; 217 218 dev_err(&client->dev, "Failed to write to address 0x%04X: %d\n", 219 reg, ret); 220 221 return ret; 222} 223 224static int iqs5xx_write_word(struct i2c_client *client, u16 reg, u16 val) 225{ 226 __be16 val_buf = cpu_to_be16(val); 227 228 return iqs5xx_write_burst(client, reg, &val_buf, sizeof(val_buf)); 229} 230 231static int iqs5xx_write_byte(struct i2c_client *client, u16 reg, u8 val) 232{ 233 return iqs5xx_write_burst(client, reg, &val, sizeof(val)); 234} 235 236static void iqs5xx_reset(struct i2c_client *client) 237{ 238 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 239 240 gpiod_set_value_cansleep(iqs5xx->reset_gpio, 1); 241 usleep_range(200, 300); 242 243 gpiod_set_value_cansleep(iqs5xx->reset_gpio, 0); 244} 245 246static int iqs5xx_bl_cmd(struct i2c_client *client, u8 bl_cmd, u16 bl_addr) 247{ 248 struct i2c_msg msg; 249 int ret; 250 u8 mbuf[sizeof(bl_cmd) + sizeof(bl_addr)]; 251 252 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 253 msg.flags = 0; 254 msg.len = sizeof(bl_cmd); 255 msg.buf = mbuf; 256 257 *mbuf = bl_cmd; 258 259 switch (bl_cmd) { 260 case IQS5XX_BL_CMD_VER: 261 case IQS5XX_BL_CMD_CRC: 262 case IQS5XX_BL_CMD_EXEC: 263 break; 264 case IQS5XX_BL_CMD_READ: 265 msg.len += sizeof(bl_addr); 266 put_unaligned_be16(bl_addr, mbuf + sizeof(bl_cmd)); 267 break; 268 default: 269 return -EINVAL; 270 } 271 272 ret = i2c_transfer(client->adapter, &msg, 1); 273 if (ret != 1) 274 goto msg_fail; 275 276 switch (bl_cmd) { 277 case IQS5XX_BL_CMD_VER: 278 msg.len = sizeof(u16); 279 break; 280 case IQS5XX_BL_CMD_CRC: 281 msg.len = sizeof(u8); 282 /* 283 * This delay saves the bus controller the trouble of having to 284 * tolerate a relatively long clock-stretching period while the 285 * CRC is calculated. 286 */ 287 msleep(50); 288 break; 289 case IQS5XX_BL_CMD_EXEC: 290 usleep_range(10000, 10100); 291 fallthrough; 292 default: 293 return 0; 294 } 295 296 msg.flags = I2C_M_RD; 297 298 ret = i2c_transfer(client->adapter, &msg, 1); 299 if (ret != 1) 300 goto msg_fail; 301 302 if (bl_cmd == IQS5XX_BL_CMD_VER && 303 get_unaligned_be16(mbuf) != IQS5XX_BL_ID) { 304 dev_err(&client->dev, "Unrecognized bootloader ID: 0x%04X\n", 305 get_unaligned_be16(mbuf)); 306 return -EINVAL; 307 } 308 309 if (bl_cmd == IQS5XX_BL_CMD_CRC && *mbuf != IQS5XX_BL_CRC_PASS) { 310 dev_err(&client->dev, "Bootloader CRC failed\n"); 311 return -EIO; 312 } 313 314 return 0; 315 316msg_fail: 317 if (ret >= 0) 318 ret = -EIO; 319 320 if (bl_cmd != IQS5XX_BL_CMD_VER) 321 dev_err(&client->dev, 322 "Unsuccessful bootloader command 0x%02X: %d\n", 323 bl_cmd, ret); 324 325 return ret; 326} 327 328static int iqs5xx_bl_open(struct i2c_client *client) 329{ 330 int error, i, j; 331 332 /* 333 * The device opens a bootloader polling window for 2 ms following the 334 * release of reset. If the host cannot establish communication during 335 * this time frame, it must cycle reset again. 336 */ 337 for (i = 0; i < IQS5XX_BL_ATTEMPTS; i++) { 338 iqs5xx_reset(client); 339 usleep_range(350, 400); 340 341 for (j = 0; j < IQS5XX_NUM_RETRIES; j++) { 342 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0); 343 if (!error) 344 usleep_range(10000, 10100); 345 else if (error != -EINVAL) 346 continue; 347 348 return error; 349 } 350 } 351 352 dev_err(&client->dev, "Failed to open bootloader: %d\n", error); 353 354 return error; 355} 356 357static int iqs5xx_bl_write(struct i2c_client *client, 358 u16 bl_addr, u8 *pmap_data, u16 pmap_len) 359{ 360 struct i2c_msg msg; 361 int ret, i; 362 u8 mbuf[sizeof(bl_addr) + IQS5XX_BL_BLK_LEN_MAX]; 363 364 if (pmap_len % IQS5XX_BL_BLK_LEN_MAX) 365 return -EINVAL; 366 367 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 368 msg.flags = 0; 369 msg.len = sizeof(mbuf); 370 msg.buf = mbuf; 371 372 for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) { 373 put_unaligned_be16(bl_addr + i, mbuf); 374 memcpy(mbuf + sizeof(bl_addr), pmap_data + i, 375 sizeof(mbuf) - sizeof(bl_addr)); 376 377 ret = i2c_transfer(client->adapter, &msg, 1); 378 if (ret != 1) 379 goto msg_fail; 380 381 usleep_range(10000, 10100); 382 } 383 384 return 0; 385 386msg_fail: 387 if (ret >= 0) 388 ret = -EIO; 389 390 dev_err(&client->dev, "Failed to write block at address 0x%04X: %d\n", 391 bl_addr + i, ret); 392 393 return ret; 394} 395 396static int iqs5xx_bl_verify(struct i2c_client *client, 397 u16 bl_addr, u8 *pmap_data, u16 pmap_len) 398{ 399 struct i2c_msg msg; 400 int ret, i; 401 u8 bl_data[IQS5XX_BL_BLK_LEN_MAX]; 402 403 if (pmap_len % IQS5XX_BL_BLK_LEN_MAX) 404 return -EINVAL; 405 406 msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK; 407 msg.flags = I2C_M_RD; 408 msg.len = sizeof(bl_data); 409 msg.buf = bl_data; 410 411 for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) { 412 ret = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_READ, bl_addr + i); 413 if (ret) 414 return ret; 415 416 ret = i2c_transfer(client->adapter, &msg, 1); 417 if (ret != 1) 418 goto msg_fail; 419 420 if (memcmp(bl_data, pmap_data + i, sizeof(bl_data))) { 421 dev_err(&client->dev, 422 "Failed to verify block at address 0x%04X\n", 423 bl_addr + i); 424 return -EIO; 425 } 426 } 427 428 return 0; 429 430msg_fail: 431 if (ret >= 0) 432 ret = -EIO; 433 434 dev_err(&client->dev, "Failed to read block at address 0x%04X: %d\n", 435 bl_addr + i, ret); 436 437 return ret; 438} 439 440static int iqs5xx_set_state(struct i2c_client *client, u8 state) 441{ 442 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 443 int error1, error2; 444 445 if (!iqs5xx->dev_id_info.bl_status) 446 return 0; 447 448 mutex_lock(&iqs5xx->lock); 449 450 /* 451 * Addressing the device outside of a communication window prompts it 452 * to assert the RDY output, so disable the interrupt line to prevent 453 * the handler from servicing a false interrupt. 454 */ 455 disable_irq(client->irq); 456 457 error1 = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL1, state); 458 error2 = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 459 460 usleep_range(50, 100); 461 enable_irq(client->irq); 462 463 mutex_unlock(&iqs5xx->lock); 464 465 if (error1) 466 return error1; 467 468 return error2; 469} 470 471static int iqs5xx_open(struct input_dev *input) 472{ 473 struct iqs5xx_private *iqs5xx = input_get_drvdata(input); 474 475 return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME); 476} 477 478static void iqs5xx_close(struct input_dev *input) 479{ 480 struct iqs5xx_private *iqs5xx = input_get_drvdata(input); 481 482 iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND); 483} 484 485static int iqs5xx_axis_init(struct i2c_client *client) 486{ 487 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 488 struct touchscreen_properties *prop = &iqs5xx->prop; 489 struct input_dev *input = iqs5xx->input; 490 u16 max_x, max_y; 491 int error; 492 493 if (!input) { 494 input = devm_input_allocate_device(&client->dev); 495 if (!input) 496 return -ENOMEM; 497 498 input->name = client->name; 499 input->id.bustype = BUS_I2C; 500 input->open = iqs5xx_open; 501 input->close = iqs5xx_close; 502 503 input_set_drvdata(input, iqs5xx); 504 iqs5xx->input = input; 505 } 506 507 error = iqs5xx_read_word(client, IQS5XX_X_RES, &max_x); 508 if (error) 509 return error; 510 511 error = iqs5xx_read_word(client, IQS5XX_Y_RES, &max_y); 512 if (error) 513 return error; 514 515 input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0); 516 input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0); 517 input_set_abs_params(input, ABS_MT_PRESSURE, 0, U16_MAX, 0, 0); 518 519 touchscreen_parse_properties(input, true, prop); 520 521 /* 522 * The device reserves 0xFFFF for coordinates that correspond to slots 523 * which are not in a state of touch. 524 */ 525 if (prop->max_x >= U16_MAX || prop->max_y >= U16_MAX) { 526 dev_err(&client->dev, "Invalid touchscreen size: %u*%u\n", 527 prop->max_x, prop->max_y); 528 return -EINVAL; 529 } 530 531 if (prop->max_x != max_x) { 532 error = iqs5xx_write_word(client, IQS5XX_X_RES, prop->max_x); 533 if (error) 534 return error; 535 } 536 537 if (prop->max_y != max_y) { 538 error = iqs5xx_write_word(client, IQS5XX_Y_RES, prop->max_y); 539 if (error) 540 return error; 541 } 542 543 error = input_mt_init_slots(input, IQS5XX_NUM_CONTACTS, 544 INPUT_MT_DIRECT); 545 if (error) 546 dev_err(&client->dev, "Failed to initialize slots: %d\n", 547 error); 548 549 return error; 550} 551 552static int iqs5xx_dev_init(struct i2c_client *client) 553{ 554 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 555 struct iqs5xx_dev_id_info *dev_id_info; 556 int error; 557 u8 buf[sizeof(*dev_id_info) + 1]; 558 559 error = iqs5xx_read_burst(client, IQS5XX_PROD_NUM, 560 &buf[1], sizeof(*dev_id_info)); 561 if (error) 562 return iqs5xx_bl_open(client); 563 564 /* 565 * A000 and B000 devices use 8-bit and 16-bit addressing, respectively. 566 * Querying an A000 device's version information with 16-bit addressing 567 * gives the appearance that the data is shifted by one byte; a nonzero 568 * leading array element suggests this could be the case (in which case 569 * the missing zero is prepended). 570 */ 571 buf[0] = 0; 572 dev_id_info = (struct iqs5xx_dev_id_info *)&buf[buf[1] ? 0 : 1]; 573 574 switch (be16_to_cpu(dev_id_info->prod_num)) { 575 case IQS5XX_PROD_NUM_IQS550: 576 case IQS5XX_PROD_NUM_IQS572: 577 case IQS5XX_PROD_NUM_IQS525: 578 break; 579 default: 580 dev_err(&client->dev, "Unrecognized product number: %u\n", 581 be16_to_cpu(dev_id_info->prod_num)); 582 return -EINVAL; 583 } 584 585 /* 586 * With the product number recognized yet shifted by one byte, open the 587 * bootloader and wait for user space to convert the A000 device into a 588 * B000 device via new firmware. 589 */ 590 if (buf[1]) { 591 dev_err(&client->dev, "Opening bootloader for A000 device\n"); 592 return iqs5xx_bl_open(client); 593 } 594 595 error = iqs5xx_read_burst(client, IQS5XX_EXP_FILE, 596 iqs5xx->exp_file, sizeof(iqs5xx->exp_file)); 597 if (error) 598 return error; 599 600 error = iqs5xx_axis_init(client); 601 if (error) 602 return error; 603 604 error = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL0, IQS5XX_ACK_RESET); 605 if (error) 606 return error; 607 608 error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG0, 609 IQS5XX_SETUP_COMPLETE | IQS5XX_WDT | 610 IQS5XX_ALP_REATI | IQS5XX_REATI); 611 if (error) 612 return error; 613 614 error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG1, 615 IQS5XX_TP_EVENT | IQS5XX_EVENT_MODE); 616 if (error) 617 return error; 618 619 error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 620 if (error) 621 return error; 622 623 iqs5xx->dev_id_info = *dev_id_info; 624 625 /* 626 * The following delay allows ATI to complete before the open and close 627 * callbacks are free to elicit I2C communication. Any attempts to read 628 * from or write to the device during this time may face extended clock 629 * stretching and prompt the I2C controller to report an error. 630 */ 631 msleep(250); 632 633 return 0; 634} 635 636static irqreturn_t iqs5xx_irq(int irq, void *data) 637{ 638 struct iqs5xx_private *iqs5xx = data; 639 struct iqs5xx_status status; 640 struct i2c_client *client = iqs5xx->client; 641 struct input_dev *input = iqs5xx->input; 642 int error, i; 643 644 /* 645 * This check is purely a precaution, as the device does not assert the 646 * RDY output during bootloader mode. If the device operates outside of 647 * bootloader mode, the input device is guaranteed to be allocated. 648 */ 649 if (!iqs5xx->dev_id_info.bl_status) 650 return IRQ_NONE; 651 652 error = iqs5xx_read_burst(client, IQS5XX_SYS_INFO0, 653 &status, sizeof(status)); 654 if (error) 655 return IRQ_NONE; 656 657 if (status.sys_info[0] & IQS5XX_SHOW_RESET) { 658 dev_err(&client->dev, "Unexpected device reset\n"); 659 660 error = iqs5xx_dev_init(client); 661 if (error) { 662 dev_err(&client->dev, 663 "Failed to re-initialize device: %d\n", error); 664 return IRQ_NONE; 665 } 666 667 return IRQ_HANDLED; 668 } 669 670 for (i = 0; i < ARRAY_SIZE(status.touch_data); i++) { 671 struct iqs5xx_touch_data *touch_data = &status.touch_data[i]; 672 u16 pressure = be16_to_cpu(touch_data->strength); 673 674 input_mt_slot(input, i); 675 if (input_mt_report_slot_state(input, MT_TOOL_FINGER, 676 pressure != 0)) { 677 touchscreen_report_pos(input, &iqs5xx->prop, 678 be16_to_cpu(touch_data->abs_x), 679 be16_to_cpu(touch_data->abs_y), 680 true); 681 input_report_abs(input, ABS_MT_PRESSURE, pressure); 682 } 683 } 684 685 input_mt_sync_frame(input); 686 input_sync(input); 687 688 error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0); 689 if (error) 690 return IRQ_NONE; 691 692 /* 693 * Once the communication window is closed, a small delay is added to 694 * ensure the device's RDY output has been deasserted by the time the 695 * interrupt handler returns. 696 */ 697 usleep_range(50, 100); 698 699 return IRQ_HANDLED; 700} 701 702static int iqs5xx_fw_file_parse(struct i2c_client *client, 703 const char *fw_file, u8 *pmap) 704{ 705 const struct firmware *fw; 706 struct iqs5xx_ihex_rec *rec; 707 size_t pos = 0; 708 int error, i; 709 u16 rec_num = 1; 710 u16 rec_addr; 711 u8 rec_len, rec_type, rec_chksm, chksm; 712 u8 rec_hdr[IQS5XX_REC_HDR_LEN]; 713 u8 rec_data[IQS5XX_REC_LEN_MAX]; 714 715 /* 716 * Firmware exported from the vendor's configuration tool deviates from 717 * standard ihex as follows: (1) the checksum for records corresponding 718 * to user-exported settings is not recalculated, and (2) an address of 719 * 0xFFFF is used for the EOF record. 720 * 721 * Because the ihex2fw tool tolerates neither (1) nor (2), the slightly 722 * nonstandard ihex firmware is parsed directly by the driver. 723 */ 724 error = request_firmware(&fw, fw_file, &client->dev); 725 if (error) { 726 dev_err(&client->dev, "Failed to request firmware %s: %d\n", 727 fw_file, error); 728 return error; 729 } 730 731 do { 732 if (pos + sizeof(*rec) > fw->size) { 733 dev_err(&client->dev, "Insufficient firmware size\n"); 734 error = -EINVAL; 735 break; 736 } 737 rec = (struct iqs5xx_ihex_rec *)(fw->data + pos); 738 pos += sizeof(*rec); 739 740 if (rec->start != ':') { 741 dev_err(&client->dev, "Invalid start at record %u\n", 742 rec_num); 743 error = -EINVAL; 744 break; 745 } 746 747 error = hex2bin(rec_hdr, rec->len, sizeof(rec_hdr)); 748 if (error) { 749 dev_err(&client->dev, "Invalid header at record %u\n", 750 rec_num); 751 break; 752 } 753 754 rec_len = *rec_hdr; 755 rec_addr = get_unaligned_be16(rec_hdr + sizeof(rec_len)); 756 rec_type = *(rec_hdr + sizeof(rec_len) + sizeof(rec_addr)); 757 758 if (pos + rec_len * 2 > fw->size) { 759 dev_err(&client->dev, "Insufficient firmware size\n"); 760 error = -EINVAL; 761 break; 762 } 763 pos += (rec_len * 2); 764 765 error = hex2bin(rec_data, rec->data, rec_len); 766 if (error) { 767 dev_err(&client->dev, "Invalid data at record %u\n", 768 rec_num); 769 break; 770 } 771 772 error = hex2bin(&rec_chksm, 773 rec->data + rec_len * 2, sizeof(rec_chksm)); 774 if (error) { 775 dev_err(&client->dev, "Invalid checksum at record %u\n", 776 rec_num); 777 break; 778 } 779 780 chksm = 0; 781 for (i = 0; i < sizeof(rec_hdr); i++) 782 chksm += rec_hdr[i]; 783 for (i = 0; i < rec_len; i++) 784 chksm += rec_data[i]; 785 chksm = ~chksm + 1; 786 787 if (chksm != rec_chksm && rec_addr < IQS5XX_CSTM) { 788 dev_err(&client->dev, 789 "Incorrect checksum at record %u\n", 790 rec_num); 791 error = -EINVAL; 792 break; 793 } 794 795 switch (rec_type) { 796 case IQS5XX_REC_TYPE_DATA: 797 if (rec_addr < IQS5XX_CHKSM || 798 rec_addr > IQS5XX_PMAP_END) { 799 dev_err(&client->dev, 800 "Invalid address at record %u\n", 801 rec_num); 802 error = -EINVAL; 803 } else { 804 memcpy(pmap + rec_addr - IQS5XX_CHKSM, 805 rec_data, rec_len); 806 } 807 break; 808 case IQS5XX_REC_TYPE_EOF: 809 break; 810 default: 811 dev_err(&client->dev, "Invalid type at record %u\n", 812 rec_num); 813 error = -EINVAL; 814 } 815 816 if (error) 817 break; 818 819 rec_num++; 820 while (pos < fw->size) { 821 if (*(fw->data + pos) == ':') 822 break; 823 pos++; 824 } 825 } while (rec_type != IQS5XX_REC_TYPE_EOF); 826 827 release_firmware(fw); 828 829 return error; 830} 831 832static int iqs5xx_fw_file_write(struct i2c_client *client, const char *fw_file) 833{ 834 struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client); 835 int error, error_init = 0; 836 u8 *pmap; 837 838 pmap = kzalloc(IQS5XX_PMAP_LEN, GFP_KERNEL); 839 if (!pmap) 840 return -ENOMEM; 841 842 error = iqs5xx_fw_file_parse(client, fw_file, pmap); 843 if (error) 844 goto err_kfree; 845 846 mutex_lock(&iqs5xx->lock); 847 848 /* 849 * Disable the interrupt line in case the first attempt(s) to enter the 850 * bootloader don't happen quickly enough, in which case the device may 851 * assert the RDY output until the next attempt. 852 */ 853 disable_irq(client->irq); 854 855 iqs5xx->dev_id_info.bl_status = 0; 856 857 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0); 858 if (error) { 859 error = iqs5xx_bl_open(client); 860 if (error) 861 goto err_reset; 862 } 863 864 error = iqs5xx_bl_write(client, IQS5XX_CHKSM, pmap, IQS5XX_PMAP_LEN); 865 if (error) 866 goto err_reset; 867 868 error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_CRC, 0); 869 if (error) 870 goto err_reset; 871 872 error = iqs5xx_bl_verify(client, IQS5XX_CSTM, 873 pmap + IQS5XX_CHKSM_LEN + IQS5XX_APP_LEN, 874 IQS5XX_CSTM_LEN); 875 876err_reset: 877 iqs5xx_reset(client); 878 usleep_range(15000, 15100); 879 880 error_init = iqs5xx_dev_init(client); 881 if (!iqs5xx->dev_id_info.bl_status) 882 error_init = error_init ? : -EINVAL; 883 884 enable_irq(client->irq); 885 886 mutex_unlock(&iqs5xx->lock); 887 888err_kfree: 889 kfree(pmap); 890 891 return error ? : error_init; 892} 893 894static ssize_t fw_file_store(struct device *dev, 895 struct device_attribute *attr, const char *buf, 896 size_t count) 897{ 898 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 899 struct i2c_client *client = iqs5xx->client; 900 size_t len = count; 901 bool input_reg = !iqs5xx->input; 902 char fw_file[IQS5XX_FW_FILE_LEN + 1]; 903 int error; 904 905 if (!len) 906 return -EINVAL; 907 908 if (buf[len - 1] == '\n') 909 len--; 910 911 if (len > IQS5XX_FW_FILE_LEN) 912 return -ENAMETOOLONG; 913 914 memcpy(fw_file, buf, len); 915 fw_file[len] = '\0'; 916 917 error = iqs5xx_fw_file_write(client, fw_file); 918 if (error) 919 return error; 920 921 /* 922 * If the input device was not allocated already, it is guaranteed to 923 * be allocated by this point and can finally be registered. 924 */ 925 if (input_reg) { 926 error = input_register_device(iqs5xx->input); 927 if (error) { 928 dev_err(&client->dev, 929 "Failed to register device: %d\n", 930 error); 931 return error; 932 } 933 } 934 935 return count; 936} 937 938static ssize_t fw_info_show(struct device *dev, 939 struct device_attribute *attr, char *buf) 940{ 941 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 942 943 if (!iqs5xx->dev_id_info.bl_status) 944 return -ENODATA; 945 946 return sysfs_emit(buf, "%u.%u.%u.%u:%u.%u\n", 947 be16_to_cpu(iqs5xx->dev_id_info.prod_num), 948 be16_to_cpu(iqs5xx->dev_id_info.proj_num), 949 iqs5xx->dev_id_info.major_ver, 950 iqs5xx->dev_id_info.minor_ver, 951 iqs5xx->exp_file[0], iqs5xx->exp_file[1]); 952} 953 954static DEVICE_ATTR_WO(fw_file); 955static DEVICE_ATTR_RO(fw_info); 956 957static struct attribute *iqs5xx_attrs[] = { 958 &dev_attr_fw_file.attr, 959 &dev_attr_fw_info.attr, 960 NULL, 961}; 962 963static umode_t iqs5xx_attr_is_visible(struct kobject *kobj, 964 struct attribute *attr, int i) 965{ 966 struct device *dev = kobj_to_dev(kobj); 967 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 968 969 if (attr == &dev_attr_fw_file.attr && 970 (iqs5xx->dev_id_info.bl_status == IQS5XX_BL_STATUS_NONE || 971 !iqs5xx->reset_gpio)) 972 return 0; 973 974 return attr->mode; 975} 976 977static const struct attribute_group iqs5xx_group = { 978 .is_visible = iqs5xx_attr_is_visible, 979 .attrs = iqs5xx_attrs, 980}; 981__ATTRIBUTE_GROUPS(iqs5xx); 982 983static int iqs5xx_suspend(struct device *dev) 984{ 985 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 986 struct input_dev *input = iqs5xx->input; 987 int error = 0; 988 989 if (!input || device_may_wakeup(dev)) 990 return error; 991 992 mutex_lock(&input->mutex); 993 994 if (input_device_enabled(input)) 995 error = iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND); 996 997 mutex_unlock(&input->mutex); 998 999 return error; 1000} 1001 1002static int iqs5xx_resume(struct device *dev) 1003{ 1004 struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev); 1005 struct input_dev *input = iqs5xx->input; 1006 int error = 0; 1007 1008 if (!input || device_may_wakeup(dev)) 1009 return error; 1010 1011 mutex_lock(&input->mutex); 1012 1013 if (input_device_enabled(input)) 1014 error = iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME); 1015 1016 mutex_unlock(&input->mutex); 1017 1018 return error; 1019} 1020 1021static DEFINE_SIMPLE_DEV_PM_OPS(iqs5xx_pm, iqs5xx_suspend, iqs5xx_resume); 1022 1023static int iqs5xx_probe(struct i2c_client *client) 1024{ 1025 struct iqs5xx_private *iqs5xx; 1026 int error; 1027 1028 iqs5xx = devm_kzalloc(&client->dev, sizeof(*iqs5xx), GFP_KERNEL); 1029 if (!iqs5xx) 1030 return -ENOMEM; 1031 1032 i2c_set_clientdata(client, iqs5xx); 1033 iqs5xx->client = client; 1034 1035 iqs5xx->reset_gpio = devm_gpiod_get_optional(&client->dev, 1036 "reset", GPIOD_OUT_LOW); 1037 if (IS_ERR(iqs5xx->reset_gpio)) { 1038 error = PTR_ERR(iqs5xx->reset_gpio); 1039 dev_err(&client->dev, "Failed to request GPIO: %d\n", error); 1040 return error; 1041 } 1042 1043 mutex_init(&iqs5xx->lock); 1044 1045 error = iqs5xx_dev_init(client); 1046 if (error) 1047 return error; 1048 1049 error = devm_request_threaded_irq(&client->dev, client->irq, 1050 NULL, iqs5xx_irq, IRQF_ONESHOT, 1051 client->name, iqs5xx); 1052 if (error) { 1053 dev_err(&client->dev, "Failed to request IRQ: %d\n", error); 1054 return error; 1055 } 1056 1057 if (iqs5xx->input) { 1058 error = input_register_device(iqs5xx->input); 1059 if (error) 1060 dev_err(&client->dev, 1061 "Failed to register device: %d\n", 1062 error); 1063 } 1064 1065 return error; 1066} 1067 1068static const struct i2c_device_id iqs5xx_id[] = { 1069 { "iqs550", 0 }, 1070 { "iqs572", 1 }, 1071 { "iqs525", 2 }, 1072 { } 1073}; 1074MODULE_DEVICE_TABLE(i2c, iqs5xx_id); 1075 1076static const struct of_device_id iqs5xx_of_match[] = { 1077 { .compatible = "azoteq,iqs550" }, 1078 { .compatible = "azoteq,iqs572" }, 1079 { .compatible = "azoteq,iqs525" }, 1080 { } 1081}; 1082MODULE_DEVICE_TABLE(of, iqs5xx_of_match); 1083 1084static struct i2c_driver iqs5xx_i2c_driver = { 1085 .driver = { 1086 .name = "iqs5xx", 1087 .dev_groups = iqs5xx_groups, 1088 .of_match_table = iqs5xx_of_match, 1089 .pm = pm_sleep_ptr(&iqs5xx_pm), 1090 }, 1091 .id_table = iqs5xx_id, 1092 .probe = iqs5xx_probe, 1093}; 1094module_i2c_driver(iqs5xx_i2c_driver); 1095 1096MODULE_AUTHOR("Jeff LaBundy <jeff@labundy.com>"); 1097MODULE_DESCRIPTION("Azoteq IQS550/572/525 Trackpad/Touchscreen Controller"); 1098MODULE_LICENSE("GPL"); 1099