1// SPDX-License-Identifier: GPL-2.0+
   2/*
   3 * Azoteq IQS550/572/525 Trackpad/Touchscreen Controller
   4 *
   5 * Copyright (C) 2018 Jeff LaBundy <jeff@labundy.com>
   6 *
   7 * These devices require firmware exported from a PC-based configuration tool
   8 * made available by the vendor. Firmware files may be pushed to the device's
   9 * nonvolatile memory by writing the filename to the 'fw_file' sysfs control.
  10 *
  11 * Link to PC-based configuration tool and datasheet: https://www.azoteq.com/
  12 */
  13
  14#include <linux/bits.h>
  15#include <linux/delay.h>
  16#include <linux/device.h>
  17#include <linux/err.h>
  18#include <linux/firmware.h>
  19#include <linux/gpio/consumer.h>
  20#include <linux/i2c.h>
  21#include <linux/input.h>
  22#include <linux/input/mt.h>
  23#include <linux/input/touchscreen.h>
  24#include <linux/interrupt.h>
  25#include <linux/kernel.h>
  26#include <linux/mod_devicetable.h>
  27#include <linux/module.h>
 
  28#include <linux/slab.h>
  29#include <asm/unaligned.h>
  30
  31#define IQS5XX_FW_FILE_LEN	64
  32#define IQS5XX_NUM_RETRIES	10
  33#define IQS5XX_NUM_CONTACTS	5
  34#define IQS5XX_WR_BYTES_MAX	2
  35
  36#define IQS5XX_PROD_NUM_IQS550	40
  37#define IQS5XX_PROD_NUM_IQS572	58
  38#define IQS5XX_PROD_NUM_IQS525	52
  39
  40#define IQS5XX_SHOW_RESET	BIT(7)
  41#define IQS5XX_ACK_RESET	BIT(7)
  42
  43#define IQS5XX_SUSPEND		BIT(0)
  44#define IQS5XX_RESUME		0
  45
  46#define IQS5XX_SETUP_COMPLETE	BIT(6)
  47#define IQS5XX_WDT		BIT(5)
  48#define IQS5XX_ALP_REATI	BIT(3)
  49#define IQS5XX_REATI		BIT(2)
  50
  51#define IQS5XX_TP_EVENT		BIT(2)
  52#define IQS5XX_EVENT_MODE	BIT(0)
  53
  54#define IQS5XX_PROD_NUM		0x0000
  55#define IQS5XX_SYS_INFO0	0x000F
  56#define IQS5XX_SYS_INFO1	0x0010
  57#define IQS5XX_SYS_CTRL0	0x0431
  58#define IQS5XX_SYS_CTRL1	0x0432
  59#define IQS5XX_SYS_CFG0		0x058E
  60#define IQS5XX_SYS_CFG1		0x058F
  61#define IQS5XX_X_RES		0x066E
  62#define IQS5XX_Y_RES		0x0670
  63#define IQS5XX_EXP_FILE		0x0677
  64#define IQS5XX_CHKSM		0x83C0
  65#define IQS5XX_APP		0x8400
  66#define IQS5XX_CSTM		0xBE00
  67#define IQS5XX_PMAP_END		0xBFFF
  68#define IQS5XX_END_COMM		0xEEEE
  69
  70#define IQS5XX_CHKSM_LEN	(IQS5XX_APP - IQS5XX_CHKSM)
  71#define IQS5XX_APP_LEN		(IQS5XX_CSTM - IQS5XX_APP)
  72#define IQS5XX_CSTM_LEN		(IQS5XX_PMAP_END + 1 - IQS5XX_CSTM)
  73#define IQS5XX_PMAP_LEN		(IQS5XX_PMAP_END + 1 - IQS5XX_CHKSM)
  74
  75#define IQS5XX_REC_HDR_LEN	4
  76#define IQS5XX_REC_LEN_MAX	255
  77#define IQS5XX_REC_TYPE_DATA	0x00
  78#define IQS5XX_REC_TYPE_EOF	0x01
  79
  80#define IQS5XX_BL_ADDR_MASK	0x40
  81#define IQS5XX_BL_CMD_VER	0x00
  82#define IQS5XX_BL_CMD_READ	0x01
  83#define IQS5XX_BL_CMD_EXEC	0x02
  84#define IQS5XX_BL_CMD_CRC	0x03
  85#define IQS5XX_BL_BLK_LEN_MAX	64
  86#define IQS5XX_BL_ID		0x0200
  87#define IQS5XX_BL_STATUS_NONE	0xEE
  88#define IQS5XX_BL_CRC_PASS	0x00
  89#define IQS5XX_BL_CRC_FAIL	0x01
  90#define IQS5XX_BL_ATTEMPTS	3
  91
  92struct iqs5xx_dev_id_info {
  93	__be16 prod_num;
  94	__be16 proj_num;
  95	u8 major_ver;
  96	u8 minor_ver;
  97	u8 bl_status;
  98} __packed;
  99
 100struct iqs5xx_ihex_rec {
 101	char start;
 102	char len[2];
 103	char addr[4];
 104	char type[2];
 105	char data[2];
 106} __packed;
 107
 108struct iqs5xx_touch_data {
 109	__be16 abs_x;
 110	__be16 abs_y;
 111	__be16 strength;
 112	u8 area;
 113} __packed;
 114
 115struct iqs5xx_status {
 116	u8 sys_info[2];
 117	u8 num_active;
 118	__be16 rel_x;
 119	__be16 rel_y;
 120	struct iqs5xx_touch_data touch_data[IQS5XX_NUM_CONTACTS];
 121} __packed;
 122
 123struct iqs5xx_private {
 124	struct i2c_client *client;
 125	struct input_dev *input;
 126	struct gpio_desc *reset_gpio;
 127	struct touchscreen_properties prop;
 128	struct mutex lock;
 129	struct iqs5xx_dev_id_info dev_id_info;
 130	u8 exp_file[2];
 131};
 132
 133static int iqs5xx_read_burst(struct i2c_client *client,
 134			     u16 reg, void *val, u16 len)
 135{
 136	__be16 reg_buf = cpu_to_be16(reg);
 137	int ret, i;
 138	struct i2c_msg msg[] = {
 139		{
 140			.addr = client->addr,
 141			.flags = 0,
 142			.len = sizeof(reg_buf),
 143			.buf = (u8 *)&reg_buf,
 144		},
 145		{
 146			.addr = client->addr,
 147			.flags = I2C_M_RD,
 148			.len = len,
 149			.buf = (u8 *)val,
 150		},
 151	};
 152
 153	/*
 154	 * The first addressing attempt outside of a communication window fails
 155	 * and must be retried, after which the device clock stretches until it
 156	 * is available.
 157	 */
 158	for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
 159		ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
 160		if (ret == ARRAY_SIZE(msg))
 161			return 0;
 162
 163		usleep_range(200, 300);
 164	}
 165
 166	if (ret >= 0)
 167		ret = -EIO;
 168
 169	dev_err(&client->dev, "Failed to read from address 0x%04X: %d\n",
 170		reg, ret);
 171
 172	return ret;
 173}
 174
 175static int iqs5xx_read_word(struct i2c_client *client, u16 reg, u16 *val)
 176{
 177	__be16 val_buf;
 178	int error;
 179
 180	error = iqs5xx_read_burst(client, reg, &val_buf, sizeof(val_buf));
 181	if (error)
 182		return error;
 183
 184	*val = be16_to_cpu(val_buf);
 185
 186	return 0;
 187}
 188
 189static int iqs5xx_write_burst(struct i2c_client *client,
 190			      u16 reg, const void *val, u16 len)
 191{
 192	int ret, i;
 193	u16 mlen = sizeof(reg) + len;
 194	u8 mbuf[sizeof(reg) + IQS5XX_WR_BYTES_MAX];
 195
 196	if (len > IQS5XX_WR_BYTES_MAX)
 197		return -EINVAL;
 198
 199	put_unaligned_be16(reg, mbuf);
 200	memcpy(mbuf + sizeof(reg), val, len);
 201
 202	/*
 203	 * The first addressing attempt outside of a communication window fails
 204	 * and must be retried, after which the device clock stretches until it
 205	 * is available.
 206	 */
 207	for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
 208		ret = i2c_master_send(client, mbuf, mlen);
 209		if (ret == mlen)
 210			return 0;
 211
 212		usleep_range(200, 300);
 213	}
 214
 215	if (ret >= 0)
 216		ret = -EIO;
 217
 218	dev_err(&client->dev, "Failed to write to address 0x%04X: %d\n",
 219		reg, ret);
 220
 221	return ret;
 222}
 223
 224static int iqs5xx_write_word(struct i2c_client *client, u16 reg, u16 val)
 225{
 226	__be16 val_buf = cpu_to_be16(val);
 227
 228	return iqs5xx_write_burst(client, reg, &val_buf, sizeof(val_buf));
 229}
 230
 231static int iqs5xx_write_byte(struct i2c_client *client, u16 reg, u8 val)
 232{
 233	return iqs5xx_write_burst(client, reg, &val, sizeof(val));
 234}
 235
 236static void iqs5xx_reset(struct i2c_client *client)
 237{
 238	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 239
 240	gpiod_set_value_cansleep(iqs5xx->reset_gpio, 1);
 241	usleep_range(200, 300);
 242
 243	gpiod_set_value_cansleep(iqs5xx->reset_gpio, 0);
 244}
 245
 246static int iqs5xx_bl_cmd(struct i2c_client *client, u8 bl_cmd, u16 bl_addr)
 247{
 248	struct i2c_msg msg;
 249	int ret;
 250	u8 mbuf[sizeof(bl_cmd) + sizeof(bl_addr)];
 251
 252	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
 253	msg.flags = 0;
 254	msg.len = sizeof(bl_cmd);
 255	msg.buf = mbuf;
 256
 257	*mbuf = bl_cmd;
 258
 259	switch (bl_cmd) {
 260	case IQS5XX_BL_CMD_VER:
 261	case IQS5XX_BL_CMD_CRC:
 262	case IQS5XX_BL_CMD_EXEC:
 263		break;
 264	case IQS5XX_BL_CMD_READ:
 265		msg.len += sizeof(bl_addr);
 266		put_unaligned_be16(bl_addr, mbuf + sizeof(bl_cmd));
 267		break;
 268	default:
 269		return -EINVAL;
 270	}
 271
 272	ret = i2c_transfer(client->adapter, &msg, 1);
 273	if (ret != 1)
 274		goto msg_fail;
 275
 276	switch (bl_cmd) {
 277	case IQS5XX_BL_CMD_VER:
 278		msg.len = sizeof(u16);
 279		break;
 280	case IQS5XX_BL_CMD_CRC:
 281		msg.len = sizeof(u8);
 282		/*
 283		 * This delay saves the bus controller the trouble of having to
 284		 * tolerate a relatively long clock-stretching period while the
 285		 * CRC is calculated.
 286		 */
 287		msleep(50);
 288		break;
 289	case IQS5XX_BL_CMD_EXEC:
 290		usleep_range(10000, 10100);
 291		fallthrough;
 292	default:
 293		return 0;
 294	}
 295
 296	msg.flags = I2C_M_RD;
 297
 298	ret = i2c_transfer(client->adapter, &msg, 1);
 299	if (ret != 1)
 300		goto msg_fail;
 301
 302	if (bl_cmd == IQS5XX_BL_CMD_VER &&
 303	    get_unaligned_be16(mbuf) != IQS5XX_BL_ID) {
 304		dev_err(&client->dev, "Unrecognized bootloader ID: 0x%04X\n",
 305			get_unaligned_be16(mbuf));
 306		return -EINVAL;
 307	}
 308
 309	if (bl_cmd == IQS5XX_BL_CMD_CRC && *mbuf != IQS5XX_BL_CRC_PASS) {
 310		dev_err(&client->dev, "Bootloader CRC failed\n");
 311		return -EIO;
 312	}
 313
 314	return 0;
 315
 316msg_fail:
 317	if (ret >= 0)
 318		ret = -EIO;
 319
 320	if (bl_cmd != IQS5XX_BL_CMD_VER)
 321		dev_err(&client->dev,
 322			"Unsuccessful bootloader command 0x%02X: %d\n",
 323			bl_cmd, ret);
 324
 325	return ret;
 326}
 327
 328static int iqs5xx_bl_open(struct i2c_client *client)
 329{
 330	int error, i, j;
 331
 332	/*
 333	 * The device opens a bootloader polling window for 2 ms following the
 334	 * release of reset. If the host cannot establish communication during
 335	 * this time frame, it must cycle reset again.
 336	 */
 337	for (i = 0; i < IQS5XX_BL_ATTEMPTS; i++) {
 338		iqs5xx_reset(client);
 339		usleep_range(350, 400);
 340
 341		for (j = 0; j < IQS5XX_NUM_RETRIES; j++) {
 342			error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
 343			if (!error)
 344				usleep_range(10000, 10100);
 345			else if (error != -EINVAL)
 346				continue;
 347
 348			return error;
 349		}
 350	}
 351
 352	dev_err(&client->dev, "Failed to open bootloader: %d\n", error);
 353
 354	return error;
 355}
 356
 357static int iqs5xx_bl_write(struct i2c_client *client,
 358			   u16 bl_addr, u8 *pmap_data, u16 pmap_len)
 359{
 360	struct i2c_msg msg;
 361	int ret, i;
 362	u8 mbuf[sizeof(bl_addr) + IQS5XX_BL_BLK_LEN_MAX];
 363
 364	if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
 365		return -EINVAL;
 366
 367	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
 368	msg.flags = 0;
 369	msg.len = sizeof(mbuf);
 370	msg.buf = mbuf;
 371
 372	for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
 373		put_unaligned_be16(bl_addr + i, mbuf);
 374		memcpy(mbuf + sizeof(bl_addr), pmap_data + i,
 375		       sizeof(mbuf) - sizeof(bl_addr));
 376
 377		ret = i2c_transfer(client->adapter, &msg, 1);
 378		if (ret != 1)
 379			goto msg_fail;
 380
 381		usleep_range(10000, 10100);
 382	}
 383
 384	return 0;
 385
 386msg_fail:
 387	if (ret >= 0)
 388		ret = -EIO;
 389
 390	dev_err(&client->dev, "Failed to write block at address 0x%04X: %d\n",
 391		bl_addr + i, ret);
 392
 393	return ret;
 394}
 395
 396static int iqs5xx_bl_verify(struct i2c_client *client,
 397			    u16 bl_addr, u8 *pmap_data, u16 pmap_len)
 398{
 399	struct i2c_msg msg;
 400	int ret, i;
 401	u8 bl_data[IQS5XX_BL_BLK_LEN_MAX];
 402
 403	if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
 404		return -EINVAL;
 405
 406	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
 407	msg.flags = I2C_M_RD;
 408	msg.len = sizeof(bl_data);
 409	msg.buf = bl_data;
 410
 411	for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
 412		ret = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_READ, bl_addr + i);
 413		if (ret)
 414			return ret;
 415
 416		ret = i2c_transfer(client->adapter, &msg, 1);
 417		if (ret != 1)
 418			goto msg_fail;
 419
 420		if (memcmp(bl_data, pmap_data + i, sizeof(bl_data))) {
 421			dev_err(&client->dev,
 422				"Failed to verify block at address 0x%04X\n",
 423				bl_addr + i);
 424			return -EIO;
 425		}
 426	}
 427
 428	return 0;
 429
 430msg_fail:
 431	if (ret >= 0)
 432		ret = -EIO;
 433
 434	dev_err(&client->dev, "Failed to read block at address 0x%04X: %d\n",
 435		bl_addr + i, ret);
 436
 437	return ret;
 438}
 439
 440static int iqs5xx_set_state(struct i2c_client *client, u8 state)
 441{
 442	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 443	int error1, error2;
 444
 445	if (!iqs5xx->dev_id_info.bl_status)
 446		return 0;
 447
 448	mutex_lock(&iqs5xx->lock);
 449
 450	/*
 451	 * Addressing the device outside of a communication window prompts it
 452	 * to assert the RDY output, so disable the interrupt line to prevent
 453	 * the handler from servicing a false interrupt.
 454	 */
 455	disable_irq(client->irq);
 456
 457	error1 = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL1, state);
 458	error2 = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
 459
 460	usleep_range(50, 100);
 461	enable_irq(client->irq);
 462
 463	mutex_unlock(&iqs5xx->lock);
 464
 465	if (error1)
 466		return error1;
 467
 468	return error2;
 469}
 470
 471static int iqs5xx_open(struct input_dev *input)
 472{
 473	struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
 474
 475	return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
 476}
 477
 478static void iqs5xx_close(struct input_dev *input)
 479{
 480	struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
 481
 482	iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
 483}
 484
 485static int iqs5xx_axis_init(struct i2c_client *client)
 486{
 487	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 488	struct touchscreen_properties *prop = &iqs5xx->prop;
 489	struct input_dev *input = iqs5xx->input;
 490	u16 max_x, max_y;
 491	int error;
 492
 493	if (!input) {
 494		input = devm_input_allocate_device(&client->dev);
 495		if (!input)
 496			return -ENOMEM;
 497
 498		input->name = client->name;
 499		input->id.bustype = BUS_I2C;
 500		input->open = iqs5xx_open;
 501		input->close = iqs5xx_close;
 502
 503		input_set_drvdata(input, iqs5xx);
 504		iqs5xx->input = input;
 505	}
 506
 507	error = iqs5xx_read_word(client, IQS5XX_X_RES, &max_x);
 508	if (error)
 509		return error;
 510
 511	error = iqs5xx_read_word(client, IQS5XX_Y_RES, &max_y);
 512	if (error)
 513		return error;
 514
 515	input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0);
 516	input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0);
 517	input_set_abs_params(input, ABS_MT_PRESSURE, 0, U16_MAX, 0, 0);
 518
 519	touchscreen_parse_properties(input, true, prop);
 520
 521	/*
 522	 * The device reserves 0xFFFF for coordinates that correspond to slots
 523	 * which are not in a state of touch.
 524	 */
 525	if (prop->max_x >= U16_MAX || prop->max_y >= U16_MAX) {
 526		dev_err(&client->dev, "Invalid touchscreen size: %u*%u\n",
 527			prop->max_x, prop->max_y);
 528		return -EINVAL;
 529	}
 530
 531	if (prop->max_x != max_x) {
 532		error = iqs5xx_write_word(client, IQS5XX_X_RES, prop->max_x);
 533		if (error)
 534			return error;
 535	}
 536
 537	if (prop->max_y != max_y) {
 538		error = iqs5xx_write_word(client, IQS5XX_Y_RES, prop->max_y);
 539		if (error)
 540			return error;
 541	}
 542
 543	error = input_mt_init_slots(input, IQS5XX_NUM_CONTACTS,
 544				    INPUT_MT_DIRECT);
 545	if (error)
 546		dev_err(&client->dev, "Failed to initialize slots: %d\n",
 547			error);
 548
 549	return error;
 550}
 551
 552static int iqs5xx_dev_init(struct i2c_client *client)
 553{
 554	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 555	struct iqs5xx_dev_id_info *dev_id_info;
 556	int error;
 557	u8 buf[sizeof(*dev_id_info) + 1];
 558
 559	error = iqs5xx_read_burst(client, IQS5XX_PROD_NUM,
 560				  &buf[1], sizeof(*dev_id_info));
 561	if (error)
 562		return iqs5xx_bl_open(client);
 563
 564	/*
 565	 * A000 and B000 devices use 8-bit and 16-bit addressing, respectively.
 566	 * Querying an A000 device's version information with 16-bit addressing
 567	 * gives the appearance that the data is shifted by one byte; a nonzero
 568	 * leading array element suggests this could be the case (in which case
 569	 * the missing zero is prepended).
 570	 */
 571	buf[0] = 0;
 572	dev_id_info = (struct iqs5xx_dev_id_info *)&buf[buf[1] ? 0 : 1];
 573
 574	switch (be16_to_cpu(dev_id_info->prod_num)) {
 575	case IQS5XX_PROD_NUM_IQS550:
 576	case IQS5XX_PROD_NUM_IQS572:
 577	case IQS5XX_PROD_NUM_IQS525:
 578		break;
 579	default:
 580		dev_err(&client->dev, "Unrecognized product number: %u\n",
 581			be16_to_cpu(dev_id_info->prod_num));
 582		return -EINVAL;
 583	}
 584
 585	/*
 586	 * With the product number recognized yet shifted by one byte, open the
 587	 * bootloader and wait for user space to convert the A000 device into a
 588	 * B000 device via new firmware.
 589	 */
 590	if (buf[1]) {
 591		dev_err(&client->dev, "Opening bootloader for A000 device\n");
 592		return iqs5xx_bl_open(client);
 593	}
 594
 595	error = iqs5xx_read_burst(client, IQS5XX_EXP_FILE,
 596				  iqs5xx->exp_file, sizeof(iqs5xx->exp_file));
 597	if (error)
 598		return error;
 599
 600	error = iqs5xx_axis_init(client);
 601	if (error)
 602		return error;
 603
 604	error = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL0, IQS5XX_ACK_RESET);
 605	if (error)
 606		return error;
 607
 608	error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG0,
 609				  IQS5XX_SETUP_COMPLETE | IQS5XX_WDT |
 610				  IQS5XX_ALP_REATI | IQS5XX_REATI);
 611	if (error)
 612		return error;
 613
 614	error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG1,
 615				  IQS5XX_TP_EVENT | IQS5XX_EVENT_MODE);
 616	if (error)
 617		return error;
 618
 619	error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
 620	if (error)
 621		return error;
 622
 623	iqs5xx->dev_id_info = *dev_id_info;
 624
 625	/*
 626	 * The following delay allows ATI to complete before the open and close
 627	 * callbacks are free to elicit I2C communication. Any attempts to read
 628	 * from or write to the device during this time may face extended clock
 629	 * stretching and prompt the I2C controller to report an error.
 630	 */
 631	msleep(250);
 632
 633	return 0;
 634}
 635
 636static irqreturn_t iqs5xx_irq(int irq, void *data)
 637{
 638	struct iqs5xx_private *iqs5xx = data;
 639	struct iqs5xx_status status;
 640	struct i2c_client *client = iqs5xx->client;
 641	struct input_dev *input = iqs5xx->input;
 642	int error, i;
 643
 644	/*
 645	 * This check is purely a precaution, as the device does not assert the
 646	 * RDY output during bootloader mode. If the device operates outside of
 647	 * bootloader mode, the input device is guaranteed to be allocated.
 648	 */
 649	if (!iqs5xx->dev_id_info.bl_status)
 650		return IRQ_NONE;
 651
 652	error = iqs5xx_read_burst(client, IQS5XX_SYS_INFO0,
 653				  &status, sizeof(status));
 654	if (error)
 655		return IRQ_NONE;
 656
 657	if (status.sys_info[0] & IQS5XX_SHOW_RESET) {
 658		dev_err(&client->dev, "Unexpected device reset\n");
 659
 660		error = iqs5xx_dev_init(client);
 661		if (error) {
 662			dev_err(&client->dev,
 663				"Failed to re-initialize device: %d\n", error);
 664			return IRQ_NONE;
 665		}
 666
 667		return IRQ_HANDLED;
 668	}
 669
 670	for (i = 0; i < ARRAY_SIZE(status.touch_data); i++) {
 671		struct iqs5xx_touch_data *touch_data = &status.touch_data[i];
 672		u16 pressure = be16_to_cpu(touch_data->strength);
 673
 674		input_mt_slot(input, i);
 675		if (input_mt_report_slot_state(input, MT_TOOL_FINGER,
 676					       pressure != 0)) {
 677			touchscreen_report_pos(input, &iqs5xx->prop,
 678					       be16_to_cpu(touch_data->abs_x),
 679					       be16_to_cpu(touch_data->abs_y),
 680					       true);
 681			input_report_abs(input, ABS_MT_PRESSURE, pressure);
 682		}
 683	}
 684
 685	input_mt_sync_frame(input);
 686	input_sync(input);
 687
 688	error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
 689	if (error)
 690		return IRQ_NONE;
 691
 692	/*
 693	 * Once the communication window is closed, a small delay is added to
 694	 * ensure the device's RDY output has been deasserted by the time the
 695	 * interrupt handler returns.
 696	 */
 697	usleep_range(50, 100);
 698
 699	return IRQ_HANDLED;
 700}
 701
 702static int iqs5xx_fw_file_parse(struct i2c_client *client,
 703				const char *fw_file, u8 *pmap)
 704{
 705	const struct firmware *fw;
 706	struct iqs5xx_ihex_rec *rec;
 707	size_t pos = 0;
 708	int error, i;
 709	u16 rec_num = 1;
 710	u16 rec_addr;
 711	u8 rec_len, rec_type, rec_chksm, chksm;
 712	u8 rec_hdr[IQS5XX_REC_HDR_LEN];
 713	u8 rec_data[IQS5XX_REC_LEN_MAX];
 714
 715	/*
 716	 * Firmware exported from the vendor's configuration tool deviates from
 717	 * standard ihex as follows: (1) the checksum for records corresponding
 718	 * to user-exported settings is not recalculated, and (2) an address of
 719	 * 0xFFFF is used for the EOF record.
 720	 *
 721	 * Because the ihex2fw tool tolerates neither (1) nor (2), the slightly
 722	 * nonstandard ihex firmware is parsed directly by the driver.
 723	 */
 724	error = request_firmware(&fw, fw_file, &client->dev);
 725	if (error) {
 726		dev_err(&client->dev, "Failed to request firmware %s: %d\n",
 727			fw_file, error);
 728		return error;
 729	}
 730
 731	do {
 732		if (pos + sizeof(*rec) > fw->size) {
 733			dev_err(&client->dev, "Insufficient firmware size\n");
 734			error = -EINVAL;
 735			break;
 736		}
 737		rec = (struct iqs5xx_ihex_rec *)(fw->data + pos);
 738		pos += sizeof(*rec);
 739
 740		if (rec->start != ':') {
 741			dev_err(&client->dev, "Invalid start at record %u\n",
 742				rec_num);
 743			error = -EINVAL;
 744			break;
 745		}
 746
 747		error = hex2bin(rec_hdr, rec->len, sizeof(rec_hdr));
 748		if (error) {
 749			dev_err(&client->dev, "Invalid header at record %u\n",
 750				rec_num);
 751			break;
 752		}
 753
 754		rec_len = *rec_hdr;
 755		rec_addr = get_unaligned_be16(rec_hdr + sizeof(rec_len));
 756		rec_type = *(rec_hdr + sizeof(rec_len) + sizeof(rec_addr));
 757
 758		if (pos + rec_len * 2 > fw->size) {
 759			dev_err(&client->dev, "Insufficient firmware size\n");
 760			error = -EINVAL;
 761			break;
 762		}
 763		pos += (rec_len * 2);
 764
 765		error = hex2bin(rec_data, rec->data, rec_len);
 766		if (error) {
 767			dev_err(&client->dev, "Invalid data at record %u\n",
 768				rec_num);
 769			break;
 770		}
 771
 772		error = hex2bin(&rec_chksm,
 773				rec->data + rec_len * 2, sizeof(rec_chksm));
 774		if (error) {
 775			dev_err(&client->dev, "Invalid checksum at record %u\n",
 776				rec_num);
 777			break;
 778		}
 779
 780		chksm = 0;
 781		for (i = 0; i < sizeof(rec_hdr); i++)
 782			chksm += rec_hdr[i];
 783		for (i = 0; i < rec_len; i++)
 784			chksm += rec_data[i];
 785		chksm = ~chksm + 1;
 786
 787		if (chksm != rec_chksm && rec_addr < IQS5XX_CSTM) {
 788			dev_err(&client->dev,
 789				"Incorrect checksum at record %u\n",
 790				rec_num);
 791			error = -EINVAL;
 792			break;
 793		}
 794
 795		switch (rec_type) {
 796		case IQS5XX_REC_TYPE_DATA:
 797			if (rec_addr < IQS5XX_CHKSM ||
 798			    rec_addr > IQS5XX_PMAP_END) {
 799				dev_err(&client->dev,
 800					"Invalid address at record %u\n",
 801					rec_num);
 802				error = -EINVAL;
 803			} else {
 804				memcpy(pmap + rec_addr - IQS5XX_CHKSM,
 805				       rec_data, rec_len);
 806			}
 807			break;
 808		case IQS5XX_REC_TYPE_EOF:
 809			break;
 810		default:
 811			dev_err(&client->dev, "Invalid type at record %u\n",
 812				rec_num);
 813			error = -EINVAL;
 814		}
 815
 816		if (error)
 817			break;
 818
 819		rec_num++;
 820		while (pos < fw->size) {
 821			if (*(fw->data + pos) == ':')
 822				break;
 823			pos++;
 824		}
 825	} while (rec_type != IQS5XX_REC_TYPE_EOF);
 826
 827	release_firmware(fw);
 828
 829	return error;
 830}
 831
 832static int iqs5xx_fw_file_write(struct i2c_client *client, const char *fw_file)
 833{
 834	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 835	int error, error_init = 0;
 836	u8 *pmap;
 837
 838	pmap = kzalloc(IQS5XX_PMAP_LEN, GFP_KERNEL);
 839	if (!pmap)
 840		return -ENOMEM;
 841
 842	error = iqs5xx_fw_file_parse(client, fw_file, pmap);
 843	if (error)
 844		goto err_kfree;
 845
 846	mutex_lock(&iqs5xx->lock);
 847
 848	/*
 849	 * Disable the interrupt line in case the first attempt(s) to enter the
 850	 * bootloader don't happen quickly enough, in which case the device may
 851	 * assert the RDY output until the next attempt.
 852	 */
 853	disable_irq(client->irq);
 854
 855	iqs5xx->dev_id_info.bl_status = 0;
 856
 857	error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
 858	if (error) {
 859		error = iqs5xx_bl_open(client);
 860		if (error)
 861			goto err_reset;
 862	}
 863
 864	error = iqs5xx_bl_write(client, IQS5XX_CHKSM, pmap, IQS5XX_PMAP_LEN);
 865	if (error)
 866		goto err_reset;
 867
 868	error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_CRC, 0);
 869	if (error)
 870		goto err_reset;
 871
 872	error = iqs5xx_bl_verify(client, IQS5XX_CSTM,
 873				 pmap + IQS5XX_CHKSM_LEN + IQS5XX_APP_LEN,
 874				 IQS5XX_CSTM_LEN);
 875
 876err_reset:
 877	iqs5xx_reset(client);
 878	usleep_range(15000, 15100);
 879
 880	error_init = iqs5xx_dev_init(client);
 881	if (!iqs5xx->dev_id_info.bl_status)
 882		error_init = error_init ? : -EINVAL;
 883
 884	enable_irq(client->irq);
 885
 886	mutex_unlock(&iqs5xx->lock);
 887
 888err_kfree:
 889	kfree(pmap);
 890
 891	return error ? : error_init;
 892}
 893
 894static ssize_t fw_file_store(struct device *dev,
 895			     struct device_attribute *attr, const char *buf,
 896			     size_t count)
 897{
 898	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
 899	struct i2c_client *client = iqs5xx->client;
 900	size_t len = count;
 901	bool input_reg = !iqs5xx->input;
 902	char fw_file[IQS5XX_FW_FILE_LEN + 1];
 903	int error;
 904
 905	if (!len)
 906		return -EINVAL;
 907
 908	if (buf[len - 1] == '\n')
 909		len--;
 910
 911	if (len > IQS5XX_FW_FILE_LEN)
 912		return -ENAMETOOLONG;
 913
 914	memcpy(fw_file, buf, len);
 915	fw_file[len] = '\0';
 916
 917	error = iqs5xx_fw_file_write(client, fw_file);
 918	if (error)
 919		return error;
 920
 921	/*
 922	 * If the input device was not allocated already, it is guaranteed to
 923	 * be allocated by this point and can finally be registered.
 924	 */
 925	if (input_reg) {
 926		error = input_register_device(iqs5xx->input);
 927		if (error) {
 928			dev_err(&client->dev,
 929				"Failed to register device: %d\n",
 930				error);
 931			return error;
 932		}
 933	}
 934
 935	return count;
 936}
 937
 938static ssize_t fw_info_show(struct device *dev,
 939			    struct device_attribute *attr, char *buf)
 940{
 941	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
 942
 943	if (!iqs5xx->dev_id_info.bl_status)
 944		return -ENODATA;
 945
 946	return sysfs_emit(buf, "%u.%u.%u.%u:%u.%u\n",
 947			  be16_to_cpu(iqs5xx->dev_id_info.prod_num),
 948			  be16_to_cpu(iqs5xx->dev_id_info.proj_num),
 949			  iqs5xx->dev_id_info.major_ver,
 950			  iqs5xx->dev_id_info.minor_ver,
 951			  iqs5xx->exp_file[0], iqs5xx->exp_file[1]);
 952}
 953
 954static DEVICE_ATTR_WO(fw_file);
 955static DEVICE_ATTR_RO(fw_info);
 956
 957static struct attribute *iqs5xx_attrs[] = {
 958	&dev_attr_fw_file.attr,
 959	&dev_attr_fw_info.attr,
 960	NULL,
 961};
 962
 963static umode_t iqs5xx_attr_is_visible(struct kobject *kobj,
 964				      struct attribute *attr, int i)
 965{
 966	struct device *dev = kobj_to_dev(kobj);
 967	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
 968
 969	if (attr == &dev_attr_fw_file.attr &&
 970	    (iqs5xx->dev_id_info.bl_status == IQS5XX_BL_STATUS_NONE ||
 971	    !iqs5xx->reset_gpio))
 972		return 0;
 973
 974	return attr->mode;
 975}
 976
 977static const struct attribute_group iqs5xx_group = {
 978	.is_visible = iqs5xx_attr_is_visible,
 979	.attrs = iqs5xx_attrs,
 980};
 981__ATTRIBUTE_GROUPS(iqs5xx);
 982
 983static int iqs5xx_suspend(struct device *dev)
 984{
 985	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
 986	struct input_dev *input = iqs5xx->input;
 987	int error = 0;
 988
 989	if (!input || device_may_wakeup(dev))
 990		return error;
 991
 992	mutex_lock(&input->mutex);
 993
 994	if (input_device_enabled(input))
 995		error = iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
 996
 997	mutex_unlock(&input->mutex);
 998
 999	return error;
1000}
1001
1002static int iqs5xx_resume(struct device *dev)
1003{
1004	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
1005	struct input_dev *input = iqs5xx->input;
1006	int error = 0;
1007
1008	if (!input || device_may_wakeup(dev))
1009		return error;
1010
1011	mutex_lock(&input->mutex);
1012
1013	if (input_device_enabled(input))
1014		error = iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
1015
1016	mutex_unlock(&input->mutex);
1017
1018	return error;
1019}
1020
1021static DEFINE_SIMPLE_DEV_PM_OPS(iqs5xx_pm, iqs5xx_suspend, iqs5xx_resume);
1022
1023static int iqs5xx_probe(struct i2c_client *client)
1024{
1025	struct iqs5xx_private *iqs5xx;
1026	int error;
1027
1028	iqs5xx = devm_kzalloc(&client->dev, sizeof(*iqs5xx), GFP_KERNEL);
1029	if (!iqs5xx)
1030		return -ENOMEM;
1031
1032	i2c_set_clientdata(client, iqs5xx);
1033	iqs5xx->client = client;
1034
1035	iqs5xx->reset_gpio = devm_gpiod_get_optional(&client->dev,
1036						     "reset", GPIOD_OUT_LOW);
1037	if (IS_ERR(iqs5xx->reset_gpio)) {
1038		error = PTR_ERR(iqs5xx->reset_gpio);
1039		dev_err(&client->dev, "Failed to request GPIO: %d\n", error);
1040		return error;
1041	}
1042
1043	mutex_init(&iqs5xx->lock);
1044
1045	error = iqs5xx_dev_init(client);
1046	if (error)
1047		return error;
1048
1049	error = devm_request_threaded_irq(&client->dev, client->irq,
1050					  NULL, iqs5xx_irq, IRQF_ONESHOT,
1051					  client->name, iqs5xx);
1052	if (error) {
1053		dev_err(&client->dev, "Failed to request IRQ: %d\n", error);
1054		return error;
1055	}
1056
 
 
 
 
 
 
1057	if (iqs5xx->input) {
1058		error = input_register_device(iqs5xx->input);
1059		if (error)
1060			dev_err(&client->dev,
1061				"Failed to register device: %d\n",
1062				error);
1063	}
1064
1065	return error;
1066}
1067
1068static const struct i2c_device_id iqs5xx_id[] = {
1069	{ "iqs550", 0 },
1070	{ "iqs572", 1 },
1071	{ "iqs525", 2 },
1072	{ }
1073};
1074MODULE_DEVICE_TABLE(i2c, iqs5xx_id);
1075
1076static const struct of_device_id iqs5xx_of_match[] = {
1077	{ .compatible = "azoteq,iqs550" },
1078	{ .compatible = "azoteq,iqs572" },
1079	{ .compatible = "azoteq,iqs525" },
1080	{ }
1081};
1082MODULE_DEVICE_TABLE(of, iqs5xx_of_match);
1083
1084static struct i2c_driver iqs5xx_i2c_driver = {
1085	.driver = {
1086		.name		= "iqs5xx",
1087		.dev_groups	= iqs5xx_groups,
1088		.of_match_table	= iqs5xx_of_match,
1089		.pm		= pm_sleep_ptr(&iqs5xx_pm),
1090	},
1091	.id_table	= iqs5xx_id,
1092	.probe		= iqs5xx_probe,
1093};
1094module_i2c_driver(iqs5xx_i2c_driver);
1095
1096MODULE_AUTHOR("Jeff LaBundy <jeff@labundy.com>");
1097MODULE_DESCRIPTION("Azoteq IQS550/572/525 Trackpad/Touchscreen Controller");
1098MODULE_LICENSE("GPL");