drivers/input/touchscreen/iqs5xx.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * Azoteq IQS550/572/525 Trackpad/Touchscreen Controller
   4  *
   5  * Copyright (C) 2018 Jeff LaBundy <[email protected]>
   6  *
   7  * These devices require firmware exported from a PC-based configuration tool
   8  * made available by the vendor. Firmware files may be pushed to the device's
   9  * nonvolatile memory by writing the filename to the 'fw_file' sysfs control.
  10  *
  11  * Link to PC-based configuration tool and datasheet: https://www.azoteq.com/
  12  */
  13
  14 #include <linux/bits.h>
  15 #include <linux/delay.h>
  16 #include <linux/device.h>
  17 #include <linux/err.h>
  18 #include <linux/firmware.h>
  19 #include <linux/gpio/consumer.h>
  20 #include <linux/i2c.h>
  21 #include <linux/input.h>
  22 #include <linux/input/mt.h>
  23 #include <linux/input/touchscreen.h>
  24 #include <linux/interrupt.h>
  25 #include <linux/kernel.h>
  26 #include <linux/module.h>
  27 #include <linux/of_device.h>
  28 #include <linux/slab.h>
  29 #include <asm/unaligned.h>
  30
  31 #define IQS5XX_FW_FILE_LEN      64
  32 #define IQS5XX_NUM_RETRIES      10
  33 #define IQS5XX_NUM_CONTACTS     5
  34 #define IQS5XX_WR_BYTES_MAX     2
  35
  36 #define IQS5XX_PROD_NUM_IQS550  40
  37 #define IQS5XX_PROD_NUM_IQS572  58
  38 #define IQS5XX_PROD_NUM_IQS525  52
  39
  40 #define IQS5XX_SHOW_RESET       BIT(7)
  41 #define IQS5XX_ACK_RESET        BIT(7)
  42
  43 #define IQS5XX_SUSPEND          BIT(0)
  44 #define IQS5XX_RESUME           0
  45
  46 #define IQS5XX_SETUP_COMPLETE   BIT(6)
  47 #define IQS5XX_WDT              BIT(5)
  48 #define IQS5XX_ALP_REATI        BIT(3)
  49 #define IQS5XX_REATI            BIT(2)
  50
  51 #define IQS5XX_TP_EVENT         BIT(2)
  52 #define IQS5XX_EVENT_MODE       BIT(0)
  53
  54 #define IQS5XX_PROD_NUM         0x0000
  55 #define IQS5XX_SYS_INFO0        0x000F
  56 #define IQS5XX_SYS_INFO1        0x0010
  57 #define IQS5XX_SYS_CTRL0        0x0431
  58 #define IQS5XX_SYS_CTRL1        0x0432
  59 #define IQS5XX_SYS_CFG0         0x058E
  60 #define IQS5XX_SYS_CFG1         0x058F
  61 #define IQS5XX_X_RES            0x066E
  62 #define IQS5XX_Y_RES            0x0670
  63 #define IQS5XX_EXP_FILE         0x0677
  64 #define IQS5XX_CHKSM            0x83C0
  65 #define IQS5XX_APP              0x8400
  66 #define IQS5XX_CSTM             0xBE00
  67 #define IQS5XX_PMAP_END         0xBFFF
  68 #define IQS5XX_END_COMM         0xEEEE
  69
  70 #define IQS5XX_CHKSM_LEN        (IQS5XX_APP - IQS5XX_CHKSM)
  71 #define IQS5XX_APP_LEN          (IQS5XX_CSTM - IQS5XX_APP)
  72 #define IQS5XX_CSTM_LEN         (IQS5XX_PMAP_END + 1 - IQS5XX_CSTM)
  73 #define IQS5XX_PMAP_LEN         (IQS5XX_PMAP_END + 1 - IQS5XX_CHKSM)
  74
  75 #define IQS5XX_REC_HDR_LEN      4
  76 #define IQS5XX_REC_LEN_MAX      255
  77 #define IQS5XX_REC_TYPE_DATA    0x00
  78 #define IQS5XX_REC_TYPE_EOF     0x01
  79
  80 #define IQS5XX_BL_ADDR_MASK     0x40
  81 #define IQS5XX_BL_CMD_VER       0x00
  82 #define IQS5XX_BL_CMD_READ      0x01
  83 #define IQS5XX_BL_CMD_EXEC      0x02
  84 #define IQS5XX_BL_CMD_CRC       0x03
  85 #define IQS5XX_BL_BLK_LEN_MAX   64
  86 #define IQS5XX_BL_ID            0x0200
  87 #define IQS5XX_BL_STATUS_NONE   0xEE
  88 #define IQS5XX_BL_CRC_PASS      0x00
  89 #define IQS5XX_BL_CRC_FAIL      0x01
  90 #define IQS5XX_BL_ATTEMPTS      3
  91
  92 struct iqs5xx_dev_id_info {
  93         __be16 prod_num;
  94         __be16 proj_num;
  95         u8 major_ver;
  96         u8 minor_ver;
  97         u8 bl_status;
  98 } __packed;
  99
 100 struct iqs5xx_ihex_rec {
 101         char start;
 102         char len[2];
 103         char addr[4];
 104         char type[2];
 105         char data[2];
 106 } __packed;
 107
 108 struct iqs5xx_touch_data {
 109         __be16 abs_x;
 110         __be16 abs_y;
 111         __be16 strength;
 112         u8 area;
 113 } __packed;
 114
 115 struct iqs5xx_status {
 116         u8 sys_info[2];
 117         u8 num_active;
 118         __be16 rel_x;
 119         __be16 rel_y;
 120         struct iqs5xx_touch_data touch_data[IQS5XX_NUM_CONTACTS];
 121 } __packed;
 122
 123 struct iqs5xx_private {
 124         struct i2c_client *client;
 125         struct input_dev *input;
 126         struct gpio_desc *reset_gpio;
 127         struct touchscreen_properties prop;
 128         struct mutex lock;
 129         struct iqs5xx_dev_id_info dev_id_info;
 130         u8 exp_file[2];
 131 };
 132
 133 static int iqs5xx_read_burst(struct i2c_client *client,
 134                              u16 reg, void *val, u16 len)
 135 {
 136         __be16 reg_buf = cpu_to_be16(reg);
 137         int ret, i;
 138         struct i2c_msg msg[] = {
 139                 {
 140                         .addr = client->addr,
 141                         .flags = 0,
 142                         .len = sizeof(reg_buf),
 143                         .buf = (u8 *)&reg_buf,
 144                 },
 145                 {
 146                         .addr = client->addr,
 147                         .flags = I2C_M_RD,
 148                         .len = len,
 149                         .buf = (u8 *)val,
 150                 },
 151         };
 152
 153         /*
 154          * The first addressing attempt outside of a communication window fails
 155          * and must be retried, after which the device clock stretches until it
 156          * is available.
 157          */
 158         for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
 159                 ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
 160                 if (ret == ARRAY_SIZE(msg))
 161                         return 0;
 162
 163                 usleep_range(200, 300);
 164         }
 165
 166         if (ret >= 0)
 167                 ret = -EIO;
 168
 169         dev_err(&client->dev, "Failed to read from address 0x%04X: %d\n",
 170                 reg, ret);
 171
 172         return ret;
 173 }
 174
 175 static int iqs5xx_read_word(struct i2c_client *client, u16 reg, u16 *val)
 176 {
 177         __be16 val_buf;
 178         int error;
 179
 180         error = iqs5xx_read_burst(client, reg, &val_buf, sizeof(val_buf));
 181         if (error)
 182                 return error;
 183
 184         *val = be16_to_cpu(val_buf);
 185
 186         return 0;
 187 }
 188
 189 static int iqs5xx_write_burst(struct i2c_client *client,
 190                               u16 reg, const void *val, u16 len)
 191 {
 192         int ret, i;
 193         u16 mlen = sizeof(reg) + len;
 194         u8 mbuf[sizeof(reg) + IQS5XX_WR_BYTES_MAX];
 195
 196         if (len > IQS5XX_WR_BYTES_MAX)
 197                 return -EINVAL;
 198
 199         put_unaligned_be16(reg, mbuf);
 200         memcpy(mbuf + sizeof(reg), val, len);
 201
 202         /*
 203          * The first addressing attempt outside of a communication window fails
 204          * and must be retried, after which the device clock stretches until it
 205          * is available.
 206          */
 207         for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
 208                 ret = i2c_master_send(client, mbuf, mlen);
 209                 if (ret == mlen)
 210                         return 0;
 211
 212                 usleep_range(200, 300);
 213         }
 214
 215         if (ret >= 0)
 216                 ret = -EIO;
 217
 218         dev_err(&client->dev, "Failed to write to address 0x%04X: %d\n",
 219                 reg, ret);
 220
 221         return ret;
 222 }
 223
 224 static int iqs5xx_write_word(struct i2c_client *client, u16 reg, u16 val)
 225 {
 226         __be16 val_buf = cpu_to_be16(val);
 227
 228         return iqs5xx_write_burst(client, reg, &val_buf, sizeof(val_buf));
 229 }
 230
 231 static int iqs5xx_write_byte(struct i2c_client *client, u16 reg, u8 val)
 232 {
 233         return iqs5xx_write_burst(client, reg, &val, sizeof(val));
 234 }
 235
 236 static void iqs5xx_reset(struct i2c_client *client)
 237 {
 238         struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 239
 240         gpiod_set_value_cansleep(iqs5xx->reset_gpio, 1);
 241         usleep_range(200, 300);
 242
 243         gpiod_set_value_cansleep(iqs5xx->reset_gpio, 0);
 244 }
 245
 246 static int iqs5xx_bl_cmd(struct i2c_client *client, u8 bl_cmd, u16 bl_addr)
 247 {
 248         struct i2c_msg msg;
 249         int ret;
 250         u8 mbuf[sizeof(bl_cmd) + sizeof(bl_addr)];
 251
 252         msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
 253         msg.flags = 0;
 254         msg.len = sizeof(bl_cmd);
 255         msg.buf = mbuf;
 256
 257         *mbuf = bl_cmd;
 258
 259         switch (bl_cmd) {
 260         case IQS5XX_BL_CMD_VER:
 261         case IQS5XX_BL_CMD_CRC:
 262         case IQS5XX_BL_CMD_EXEC:
 263                 break;
 264         case IQS5XX_BL_CMD_READ:
 265                 msg.len += sizeof(bl_addr);
 266                 put_unaligned_be16(bl_addr, mbuf + sizeof(bl_cmd));
 267                 break;
 268         default:
 269                 return -EINVAL;
 270         }
 271
 272         ret = i2c_transfer(client->adapter, &msg, 1);
 273         if (ret != 1)
 274                 goto msg_fail;
 275
 276         switch (bl_cmd) {
 277         case IQS5XX_BL_CMD_VER:
 278                 msg.len = sizeof(u16);
 279                 break;
 280         case IQS5XX_BL_CMD_CRC:
 281                 msg.len = sizeof(u8);
 282                 /*
 283                  * This delay saves the bus controller the trouble of having to
 284                  * tolerate a relatively long clock-stretching period while the
 285                  * CRC is calculated.
 286                  */
 287                 msleep(50);
 288                 break;
 289         case IQS5XX_BL_CMD_EXEC:
 290                 usleep_range(10000, 10100);
 291                 fallthrough;
 292         default:
 293                 return 0;
 294         }
 295
 296         msg.flags = I2C_M_RD;
 297
 298         ret = i2c_transfer(client->adapter, &msg, 1);
 299         if (ret != 1)
 300                 goto msg_fail;
 301
 302         if (bl_cmd == IQS5XX_BL_CMD_VER &&
 303             get_unaligned_be16(mbuf) != IQS5XX_BL_ID) {
 304                 dev_err(&client->dev, "Unrecognized bootloader ID: 0x%04X\n",
 305                         get_unaligned_be16(mbuf));
 306                 return -EINVAL;
 307         }
 308
 309         if (bl_cmd == IQS5XX_BL_CMD_CRC && *mbuf != IQS5XX_BL_CRC_PASS) {
 310                 dev_err(&client->dev, "Bootloader CRC failed\n");
 311                 return -EIO;
 312         }
 313
 314         return 0;
 315
 316 msg_fail:
 317         if (ret >= 0)
 318                 ret = -EIO;
 319
 320         if (bl_cmd != IQS5XX_BL_CMD_VER)
 321                 dev_err(&client->dev,
 322                         "Unsuccessful bootloader command 0x%02X: %d\n",
 323                         bl_cmd, ret);
 324
 325         return ret;
 326 }
 327
 328 static int iqs5xx_bl_open(struct i2c_client *client)
 329 {
 330         int error, i, j;
 331
 332         /*
 333          * The device opens a bootloader polling window for 2 ms following the
 334          * release of reset. If the host cannot establish communication during
 335          * this time frame, it must cycle reset again.
 336          */
 337         for (i = 0; i < IQS5XX_BL_ATTEMPTS; i++) {
 338                 iqs5xx_reset(client);
 339                 usleep_range(350, 400);
 340
 341                 for (j = 0; j < IQS5XX_NUM_RETRIES; j++) {
 342                         error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
 343                         if (!error)
 344                                 usleep_range(10000, 10100);
 345                         else if (error != -EINVAL)
 346                                 continue;
 347
 348                         return error;
 349                 }
 350         }
 351
 352         dev_err(&client->dev, "Failed to open bootloader: %d\n", error);
 353
 354         return error;
 355 }
 356
 357 static int iqs5xx_bl_write(struct i2c_client *client,
 358                            u16 bl_addr, u8 *pmap_data, u16 pmap_len)
 359 {
 360         struct i2c_msg msg;
 361         int ret, i;
 362         u8 mbuf[sizeof(bl_addr) + IQS5XX_BL_BLK_LEN_MAX];
 363
 364         if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
 365                 return -EINVAL;
 366
 367         msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
 368         msg.flags = 0;
 369         msg.len = sizeof(mbuf);
 370         msg.buf = mbuf;
 371
 372         for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
 373                 put_unaligned_be16(bl_addr + i, mbuf);
 374                 memcpy(mbuf + sizeof(bl_addr), pmap_data + i,
 375                        sizeof(mbuf) - sizeof(bl_addr));
 376
 377                 ret = i2c_transfer(client->adapter, &msg, 1);
 378                 if (ret != 1)
 379                         goto msg_fail;
 380
 381                 usleep_range(10000, 10100);
 382         }
 383
 384         return 0;
 385
 386 msg_fail:
 387         if (ret >= 0)
 388                 ret = -EIO;
 389
 390         dev_err(&client->dev, "Failed to write block at address 0x%04X: %d\n",
 391                 bl_addr + i, ret);
 392
 393         return ret;
 394 }
 395
 396 static int iqs5xx_bl_verify(struct i2c_client *client,
 397                             u16 bl_addr, u8 *pmap_data, u16 pmap_len)
 398 {
 399         struct i2c_msg msg;
 400         int ret, i;
 401         u8 bl_data[IQS5XX_BL_BLK_LEN_MAX];
 402
 403         if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
 404                 return -EINVAL;
 405
 406         msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
 407         msg.flags = I2C_M_RD;
 408         msg.len = sizeof(bl_data);
 409         msg.buf = bl_data;
 410
 411         for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
 412                 ret = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_READ, bl_addr + i);
 413                 if (ret)
 414                         return ret;
 415
 416                 ret = i2c_transfer(client->adapter, &msg, 1);
 417                 if (ret != 1)
 418                         goto msg_fail;
 419
 420                 if (memcmp(bl_data, pmap_data + i, sizeof(bl_data))) {
 421                         dev_err(&client->dev,
 422                                 "Failed to verify block at address 0x%04X\n",
 423                                 bl_addr + i);
 424                         return -EIO;
 425                 }
 426         }
 427
 428         return 0;
 429
 430 msg_fail:
 431         if (ret >= 0)
 432                 ret = -EIO;
 433
 434         dev_err(&client->dev, "Failed to read block at address 0x%04X: %d\n",
 435                 bl_addr + i, ret);
 436
 437         return ret;
 438 }
 439
 440 static int iqs5xx_set_state(struct i2c_client *client, u8 state)
 441 {
 442         struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 443         int error1, error2;
 444
 445         if (!iqs5xx->dev_id_info.bl_status)
 446                 return 0;
 447
 448         mutex_lock(&iqs5xx->lock);
 449
 450         /*
 451          * Addressing the device outside of a communication window prompts it
 452          * to assert the RDY output, so disable the interrupt line to prevent
 453          * the handler from servicing a false interrupt.
 454          */
 455         disable_irq(client->irq);
 456
 457         error1 = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL1, state);
 458         error2 = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
 459
 460         usleep_range(50, 100);
 461         enable_irq(client->irq);
 462
 463         mutex_unlock(&iqs5xx->lock);
 464
 465         if (error1)
 466                 return error1;
 467
 468         return error2;
 469 }
 470
 471 static int iqs5xx_open(struct input_dev *input)
 472 {
 473         struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
 474
 475         return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
 476 }
 477
 478 static void iqs5xx_close(struct input_dev *input)
 479 {
 480         struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
 481
 482         iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
 483 }
 484
 485 static int iqs5xx_axis_init(struct i2c_client *client)
 486 {
 487         struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 488         struct touchscreen_properties *prop = &iqs5xx->prop;
 489         struct input_dev *input = iqs5xx->input;
 490         u16 max_x, max_y;
 491         int error;
 492
 493         if (!input) {
 494                 input = devm_input_allocate_device(&client->dev);
 495                 if (!input)
 496                         return -ENOMEM;
 497
 498                 input->name = client->name;
 499                 input->id.bustype = BUS_I2C;
 500                 input->open = iqs5xx_open;
 501                 input->close = iqs5xx_close;
 502
 503                 input_set_drvdata(input, iqs5xx);
 504                 iqs5xx->input = input;
 505         }
 506
 507         error = iqs5xx_read_word(client, IQS5XX_X_RES, &max_x);
 508         if (error)
 509                 return error;
 510
 511         error = iqs5xx_read_word(client, IQS5XX_Y_RES, &max_y);
 512         if (error)
 513                 return error;
 514
 515         input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0);
 516         input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0);
 517         input_set_abs_params(input, ABS_MT_PRESSURE, 0, U16_MAX, 0, 0);
 518
 519         touchscreen_parse_properties(input, true, prop);
 520
 521         /*
 522          * The device reserves 0xFFFF for coordinates that correspond to slots
 523          * which are not in a state of touch.
 524          */
 525         if (prop->max_x >= U16_MAX || prop->max_y >= U16_MAX) {
 526                 dev_err(&client->dev, "Invalid touchscreen size: %u*%u\n",
 527                         prop->max_x, prop->max_y);
 528                 return -EINVAL;
 529         }
 530
 531         if (prop->max_x != max_x) {
 532                 error = iqs5xx_write_word(client, IQS5XX_X_RES, prop->max_x);
 533                 if (error)
 534                         return error;
 535         }
 536
 537         if (prop->max_y != max_y) {
 538                 error = iqs5xx_write_word(client, IQS5XX_Y_RES, prop->max_y);
 539                 if (error)
 540                         return error;
 541         }
 542
 543         error = input_mt_init_slots(input, IQS5XX_NUM_CONTACTS,
 544                                     INPUT_MT_DIRECT);
 545         if (error)
 546                 dev_err(&client->dev, "Failed to initialize slots: %d\n",
 547                         error);
 548
 549         return error;
 550 }
 551
 552 static int iqs5xx_dev_init(struct i2c_client *client)
 553 {
 554         struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 555         struct iqs5xx_dev_id_info *dev_id_info;
 556         int error;
 557         u8 buf[sizeof(*dev_id_info) + 1];
 558
 559         error = iqs5xx_read_burst(client, IQS5XX_PROD_NUM,
 560                                   &buf[1], sizeof(*dev_id_info));
 561         if (error)
 562                 return iqs5xx_bl_open(client);
 563
 564         /*
 565          * A000 and B000 devices use 8-bit and 16-bit addressing, respectively.
 566          * Querying an A000 device's version information with 16-bit addressing
 567          * gives the appearance that the data is shifted by one byte; a nonzero
 568          * leading array element suggests this could be the case (in which case
 569          * the missing zero is prepended).
 570          */
 571         buf[0] = 0;
 572         dev_id_info = (struct iqs5xx_dev_id_info *)&buf[buf[1] ? 0 : 1];
 573
 574         switch (be16_to_cpu(dev_id_info->prod_num)) {
 575         case IQS5XX_PROD_NUM_IQS550:
 576         case IQS5XX_PROD_NUM_IQS572:
 577         case IQS5XX_PROD_NUM_IQS525:
 578                 break;
 579         default:
 580                 dev_err(&client->dev, "Unrecognized product number: %u\n",
 581                         be16_to_cpu(dev_id_info->prod_num));
 582                 return -EINVAL;
 583         }
 584
 585         /*
 586          * With the product number recognized yet shifted by one byte, open the
 587          * bootloader and wait for user space to convert the A000 device into a
 588          * B000 device via new firmware.
 589          */
 590         if (buf[1]) {
 591                 dev_err(&client->dev, "Opening bootloader for A000 device\n");
 592                 return iqs5xx_bl_open(client);
 593         }
 594
 595         error = iqs5xx_read_burst(client, IQS5XX_EXP_FILE,
 596                                   iqs5xx->exp_file, sizeof(iqs5xx->exp_file));
 597         if (error)
 598                 return error;
 599
 600         error = iqs5xx_axis_init(client);
 601         if (error)
 602                 return error;
 603
 604         error = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL0, IQS5XX_ACK_RESET);
 605         if (error)
 606                 return error;
 607
 608         error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG0,
 609                                   IQS5XX_SETUP_COMPLETE | IQS5XX_WDT |
 610                                   IQS5XX_ALP_REATI | IQS5XX_REATI);
 611         if (error)
 612                 return error;
 613
 614         error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG1,
 615                                   IQS5XX_TP_EVENT | IQS5XX_EVENT_MODE);
 616         if (error)
 617                 return error;
 618
 619         error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
 620         if (error)
 621                 return error;
 622
 623         iqs5xx->dev_id_info = *dev_id_info;
 624
 625         /*
 626          * The following delay allows ATI to complete before the open and close
 627          * callbacks are free to elicit I2C communication. Any attempts to read
 628          * from or write to the device during this time may face extended clock
 629          * stretching and prompt the I2C controller to report an error.
 630          */
 631         msleep(250);
 632
 633         return 0;
 634 }
 635
 636 static irqreturn_t iqs5xx_irq(int irq, void *data)
 637 {
 638         struct iqs5xx_private *iqs5xx = data;
 639         struct iqs5xx_status status;
 640         struct i2c_client *client = iqs5xx->client;
 641         struct input_dev *input = iqs5xx->input;
 642         int error, i;
 643
 644         /*
 645          * This check is purely a precaution, as the device does not assert the
 646          * RDY output during bootloader mode. If the device operates outside of
 647          * bootloader mode, the input device is guaranteed to be allocated.
 648          */
 649         if (!iqs5xx->dev_id_info.bl_status)
 650                 return IRQ_NONE;
 651
 652         error = iqs5xx_read_burst(client, IQS5XX_SYS_INFO0,
 653                                   &status, sizeof(status));
 654         if (error)
 655                 return IRQ_NONE;
 656
 657         if (status.sys_info[0] & IQS5XX_SHOW_RESET) {
 658                 dev_err(&client->dev, "Unexpected device reset\n");
 659
 660                 error = iqs5xx_dev_init(client);
 661                 if (error) {
 662                         dev_err(&client->dev,
 663                                 "Failed to re-initialize device: %d\n", error);
 664                         return IRQ_NONE;
 665                 }
 666
 667                 return IRQ_HANDLED;
 668         }
 669
 670         for (i = 0; i < ARRAY_SIZE(status.touch_data); i++) {
 671                 struct iqs5xx_touch_data *touch_data = &status.touch_data[i];
 672                 u16 pressure = be16_to_cpu(touch_data->strength);
 673
 674                 input_mt_slot(input, i);
 675                 if (input_mt_report_slot_state(input, MT_TOOL_FINGER,
 676                                                pressure != 0)) {
 677                         touchscreen_report_pos(input, &iqs5xx->prop,
 678                                                be16_to_cpu(touch_data->abs_x),
 679                                                be16_to_cpu(touch_data->abs_y),
 680                                                true);
 681                         input_report_abs(input, ABS_MT_PRESSURE, pressure);
 682                 }
 683         }
 684
 685         input_mt_sync_frame(input);
 686         input_sync(input);
 687
 688         error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
 689         if (error)
 690                 return IRQ_NONE;
 691
 692         /*
 693          * Once the communication window is closed, a small delay is added to
 694          * ensure the device's RDY output has been deasserted by the time the
 695          * interrupt handler returns.
 696          */
 697         usleep_range(50, 100);
 698
 699         return IRQ_HANDLED;
 700 }
 701
 702 static int iqs5xx_fw_file_parse(struct i2c_client *client,
 703                                 const char *fw_file, u8 *pmap)
 704 {
 705         const struct firmware *fw;
 706         struct iqs5xx_ihex_rec *rec;
 707         size_t pos = 0;
 708         int error, i;
 709         u16 rec_num = 1;
 710         u16 rec_addr;
 711         u8 rec_len, rec_type, rec_chksm, chksm;
 712         u8 rec_hdr[IQS5XX_REC_HDR_LEN];
 713         u8 rec_data[IQS5XX_REC_LEN_MAX];
 714
 715         /*
 716          * Firmware exported from the vendor's configuration tool deviates from
 717          * standard ihex as follows: (1) the checksum for records corresponding
 718          * to user-exported settings is not recalculated, and (2) an address of
 719          * 0xFFFF is used for the EOF record.
 720          *
 721          * Because the ihex2fw tool tolerates neither (1) nor (2), the slightly
 722          * nonstandard ihex firmware is parsed directly by the driver.
 723          */
 724         error = request_firmware(&fw, fw_file, &client->dev);
 725         if (error) {
 726                 dev_err(&client->dev, "Failed to request firmware %s: %d\n",
 727                         fw_file, error);
 728                 return error;
 729         }
 730
 731         do {
 732                 if (pos + sizeof(*rec) > fw->size) {
 733                         dev_err(&client->dev, "Insufficient firmware size\n");
 734                         error = -EINVAL;
 735                         break;
 736                 }
 737                 rec = (struct iqs5xx_ihex_rec *)(fw->data + pos);
 738                 pos += sizeof(*rec);
 739
 740                 if (rec->start != ':') {
 741                         dev_err(&client->dev, "Invalid start at record %u\n",
 742                                 rec_num);
 743                         error = -EINVAL;
 744                         break;
 745                 }
 746
 747                 error = hex2bin(rec_hdr, rec->len, sizeof(rec_hdr));
 748                 if (error) {
 749                         dev_err(&client->dev, "Invalid header at record %u\n",
 750                                 rec_num);
 751                         break;
 752                 }
 753
 754                 rec_len = *rec_hdr;
 755                 rec_addr = get_unaligned_be16(rec_hdr + sizeof(rec_len));
 756                 rec_type = *(rec_hdr + sizeof(rec_len) + sizeof(rec_addr));
 757
 758                 if (pos + rec_len * 2 > fw->size) {
 759                         dev_err(&client->dev, "Insufficient firmware size\n");
 760                         error = -EINVAL;
 761                         break;
 762                 }
 763                 pos += (rec_len * 2);
 764
 765                 error = hex2bin(rec_data, rec->data, rec_len);
 766                 if (error) {
 767                         dev_err(&client->dev, "Invalid data at record %u\n",
 768                                 rec_num);
 769                         break;
 770                 }
 771
 772                 error = hex2bin(&rec_chksm,
 773                                 rec->data + rec_len * 2, sizeof(rec_chksm));
 774                 if (error) {
 775                         dev_err(&client->dev, "Invalid checksum at record %u\n",
 776                                 rec_num);
 777                         break;
 778                 }
 779
 780                 chksm = 0;
 781                 for (i = 0; i < sizeof(rec_hdr); i++)
 782                         chksm += rec_hdr[i];
 783                 for (i = 0; i < rec_len; i++)
 784                         chksm += rec_data[i];
 785                 chksm = ~chksm + 1;
 786
 787                 if (chksm != rec_chksm && rec_addr < IQS5XX_CSTM) {
 788                         dev_err(&client->dev,
 789                                 "Incorrect checksum at record %u\n",
 790                                 rec_num);
 791                         error = -EINVAL;
 792                         break;
 793                 }
 794
 795                 switch (rec_type) {
 796                 case IQS5XX_REC_TYPE_DATA:
 797                         if (rec_addr < IQS5XX_CHKSM ||
 798                             rec_addr > IQS5XX_PMAP_END) {
 799                                 dev_err(&client->dev,
 800                                         "Invalid address at record %u\n",
 801                                         rec_num);
 802                                 error = -EINVAL;
 803                         } else {
 804                                 memcpy(pmap + rec_addr - IQS5XX_CHKSM,
 805                                        rec_data, rec_len);
 806                         }
 807                         break;
 808                 case IQS5XX_REC_TYPE_EOF:
 809                         break;
 810                 default:
 811                         dev_err(&client->dev, "Invalid type at record %u\n",
 812                                 rec_num);
 813                         error = -EINVAL;
 814                 }
 815
 816                 if (error)
 817                         break;
 818
 819                 rec_num++;
 820                 while (pos < fw->size) {
 821                         if (*(fw->data + pos) == ':')
 822                                 break;
 823                         pos++;
 824                 }
 825         } while (rec_type != IQS5XX_REC_TYPE_EOF);
 826
 827         release_firmware(fw);
 828
 829         return error;
 830 }
 831
 832 static int iqs5xx_fw_file_write(struct i2c_client *client, const char *fw_file)
 833 {
 834         struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
 835         int error, error_init = 0;
 836         u8 *pmap;
 837
 838         pmap = kzalloc(IQS5XX_PMAP_LEN, GFP_KERNEL);
 839         if (!pmap)
 840                 return -ENOMEM;
 841
 842         error = iqs5xx_fw_file_parse(client, fw_file, pmap);
 843         if (error)
 844                 goto err_kfree;
 845
 846         mutex_lock(&iqs5xx->lock);
 847
 848         /*
 849          * Disable the interrupt line in case the first attempt(s) to enter the
 850          * bootloader don't happen quickly enough, in which case the device may
 851          * assert the RDY output until the next attempt.
 852          */
 853         disable_irq(client->irq);
 854
 855         iqs5xx->dev_id_info.bl_status = 0;
 856
 857         error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
 858         if (error) {
 859                 error = iqs5xx_bl_open(client);
 860                 if (error)
 861                         goto err_reset;
 862         }
 863
 864         error = iqs5xx_bl_write(client, IQS5XX_CHKSM, pmap, IQS5XX_PMAP_LEN);
 865         if (error)
 866                 goto err_reset;
 867
 868         error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_CRC, 0);
 869         if (error)
 870                 goto err_reset;
 871
 872         error = iqs5xx_bl_verify(client, IQS5XX_CSTM,
 873                                  pmap + IQS5XX_CHKSM_LEN + IQS5XX_APP_LEN,
 874                                  IQS5XX_CSTM_LEN);
 875
 876 err_reset:
 877         iqs5xx_reset(client);
 878         usleep_range(15000, 15100);
 879
 880         error_init = iqs5xx_dev_init(client);
 881         if (!iqs5xx->dev_id_info.bl_status)
 882                 error_init = error_init ? : -EINVAL;
 883
 884         enable_irq(client->irq);
 885
 886         mutex_unlock(&iqs5xx->lock);
 887
 888 err_kfree:
 889         kfree(pmap);
 890
 891         return error ? : error_init;
 892 }
 893
 894 static ssize_t fw_file_store(struct device *dev,
 895                              struct device_attribute *attr, const char *buf,
 896                              size_t count)
 897 {
 898         struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
 899         struct i2c_client *client = iqs5xx->client;
 900         size_t len = count;
 901         bool input_reg = !iqs5xx->input;
 902         char fw_file[IQS5XX_FW_FILE_LEN + 1];
 903         int error;
 904
 905         if (!len)
 906                 return -EINVAL;
 907
 908         if (buf[len - 1] == '\n')
 909                 len--;
 910
 911         if (len > IQS5XX_FW_FILE_LEN)
 912                 return -ENAMETOOLONG;
 913
 914         memcpy(fw_file, buf, len);
 915         fw_file[len] = '\0';
 916
 917         error = iqs5xx_fw_file_write(client, fw_file);
 918         if (error)
 919                 return error;
 920
 921         /*
 922          * If the input device was not allocated already, it is guaranteed to
 923          * be allocated by this point and can finally be registered.
 924          */
 925         if (input_reg) {
 926                 error = input_register_device(iqs5xx->input);
 927                 if (error) {
 928                         dev_err(&client->dev,
 929                                 "Failed to register device: %d\n",
 930                                 error);
 931                         return error;
 932                 }
 933         }
 934
 935         return count;
 936 }
 937
 938 static ssize_t fw_info_show(struct device *dev,
 939                             struct device_attribute *attr, char *buf)
 940 {
 941         struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
 942
 943         if (!iqs5xx->dev_id_info.bl_status)
 944                 return -ENODATA;
 945
 946         return scnprintf(buf, PAGE_SIZE, "%u.%u.%u.%u:%u.%u\n",
 947                          be16_to_cpu(iqs5xx->dev_id_info.prod_num),
 948                          be16_to_cpu(iqs5xx->dev_id_info.proj_num),
 949                          iqs5xx->dev_id_info.major_ver,
 950                          iqs5xx->dev_id_info.minor_ver,
 951                          iqs5xx->exp_file[0], iqs5xx->exp_file[1]);
 952 }
 953
 954 static DEVICE_ATTR_WO(fw_file);
 955 static DEVICE_ATTR_RO(fw_info);
 956
 957 static struct attribute *iqs5xx_attrs[] = {
 958         &dev_attr_fw_file.attr,
 959         &dev_attr_fw_info.attr,
 960         NULL,
 961 };
 962
 963 static umode_t iqs5xx_attr_is_visible(struct kobject *kobj,
 964                                       struct attribute *attr, int i)
 965 {
 966         struct device *dev = kobj_to_dev(kobj);
 967         struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
 968
 969         if (attr == &dev_attr_fw_file.attr &&
 970             (iqs5xx->dev_id_info.bl_status == IQS5XX_BL_STATUS_NONE ||
 971             !iqs5xx->reset_gpio))
 972                 return 0;
 973
 974         return attr->mode;
 975 }
 976
 977 static const struct attribute_group iqs5xx_attr_group = {
 978         .is_visible = iqs5xx_attr_is_visible,
 979         .attrs = iqs5xx_attrs,
 980 };
 981
 982 static int iqs5xx_suspend(struct device *dev)
 983 {
 984         struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
 985         struct input_dev *input = iqs5xx->input;
 986         int error = 0;
 987
 988         if (!input || device_may_wakeup(dev))
 989                 return error;
 990
 991         mutex_lock(&input->mutex);
 992
 993         if (input_device_enabled(input))
 994                 error = iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
 995
 996         mutex_unlock(&input->mutex);
 997
 998         return error;
 999 }
1000
1001 static int iqs5xx_resume(struct device *dev)
1002 {
1003         struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
1004         struct input_dev *input = iqs5xx->input;
1005         int error = 0;
1006
1007         if (!input || device_may_wakeup(dev))
1008                 return error;
1009
1010         mutex_lock(&input->mutex);
1011
1012         if (input_device_enabled(input))
1013                 error = iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
1014
1015         mutex_unlock(&input->mutex);
1016
1017         return error;
1018 }
1019
1020 static DEFINE_SIMPLE_DEV_PM_OPS(iqs5xx_pm, iqs5xx_suspend, iqs5xx_resume);
1021
1022 static int iqs5xx_probe(struct i2c_client *client)
1023 {
1024         struct iqs5xx_private *iqs5xx;
1025         int error;
1026
1027         iqs5xx = devm_kzalloc(&client->dev, sizeof(*iqs5xx), GFP_KERNEL);
1028         if (!iqs5xx)
1029                 return -ENOMEM;
1030
1031         i2c_set_clientdata(client, iqs5xx);
1032         iqs5xx->client = client;
1033
1034         iqs5xx->reset_gpio = devm_gpiod_get_optional(&client->dev,
1035                                                      "reset", GPIOD_OUT_LOW);
1036         if (IS_ERR(iqs5xx->reset_gpio)) {
1037                 error = PTR_ERR(iqs5xx->reset_gpio);
1038                 dev_err(&client->dev, "Failed to request GPIO: %d\n", error);
1039                 return error;
1040         }
1041
1042         mutex_init(&iqs5xx->lock);
1043
1044         error = iqs5xx_dev_init(client);
1045         if (error)
1046                 return error;
1047
1048         error = devm_request_threaded_irq(&client->dev, client->irq,
1049                                           NULL, iqs5xx_irq, IRQF_ONESHOT,
1050                                           client->name, iqs5xx);
1051         if (error) {
1052                 dev_err(&client->dev, "Failed to request IRQ: %d\n", error);
1053                 return error;
1054         }
1055
1056         error = devm_device_add_group(&client->dev, &iqs5xx_attr_group);
1057         if (error) {
1058                 dev_err(&client->dev, "Failed to add attributes: %d\n", error);
1059                 return error;
1060         }
1061
1062         if (iqs5xx->input) {
1063                 error = input_register_device(iqs5xx->input);
1064                 if (error)
1065                         dev_err(&client->dev,
1066                                 "Failed to register device: %d\n",
1067                                 error);
1068         }
1069
1070         return error;
1071 }
1072
1073 static const struct i2c_device_id iqs5xx_id[] = {
1074         { "iqs550", 0 },
1075         { "iqs572", 1 },
1076         { "iqs525", 2 },
1077         { }
1078 };
1079 MODULE_DEVICE_TABLE(i2c, iqs5xx_id);
1080
1081 static const struct of_device_id iqs5xx_of_match[] = {
1082         { .compatible = "azoteq,iqs550" },
1083         { .compatible = "azoteq,iqs572" },
1084         { .compatible = "azoteq,iqs525" },
1085         { }
1086 };
1087 MODULE_DEVICE_TABLE(of, iqs5xx_of_match);
1088
1089 static struct i2c_driver iqs5xx_i2c_driver = {
1090         .driver = {
1091                 .name           = "iqs5xx",
1092                 .of_match_table = iqs5xx_of_match,
1093                 .pm             = pm_sleep_ptr(&iqs5xx_pm),
1094         },
1095         .id_table       = iqs5xx_id,
1096         .probe          = iqs5xx_probe,
1097 };
1098 module_i2c_driver(iqs5xx_i2c_driver);
1099
1100 MODULE_AUTHOR("Jeff LaBundy <[email protected]>");
1101 MODULE_DESCRIPTION("Azoteq IQS550/572/525 Trackpad/Touchscreen Controller");
1102 MODULE_LICENSE("GPL");