1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Azoteq IQS550/572/525 Trackpad/Touchscreen Controller
4  *
5  * Copyright (C) 2018 Jeff LaBundy <jeff@labundy.com>
6  *
7  * These devices require firmware exported from a PC-based configuration tool
8  * made available by the vendor. Firmware files may be pushed to the device's
9  * nonvolatile memory by writing the filename to the 'fw_file' sysfs control.
10  *
11  * Link to PC-based configuration tool and data sheet: http://www.azoteq.com/
12  */
13 
14 #include <linux/bits.h>
15 #include <linux/delay.h>
16 #include <linux/device.h>
17 #include <linux/err.h>
18 #include <linux/firmware.h>
19 #include <linux/gpio/consumer.h>
20 #include <linux/i2c.h>
21 #include <linux/input.h>
22 #include <linux/input/mt.h>
23 #include <linux/input/touchscreen.h>
24 #include <linux/interrupt.h>
25 #include <linux/kernel.h>
26 #include <linux/module.h>
27 #include <linux/of_device.h>
28 #include <linux/slab.h>
29 #include <asm/unaligned.h>
30 
31 #define IQS5XX_FW_FILE_LEN	64
32 #define IQS5XX_NUM_RETRIES	10
33 #define IQS5XX_NUM_CONTACTS	5
34 #define IQS5XX_WR_BYTES_MAX	2
35 #define IQS5XX_XY_RES_MAX	0xFFFE
36 
37 #define IQS5XX_PROD_NUM_IQS550	40
38 #define IQS5XX_PROD_NUM_IQS572	58
39 #define IQS5XX_PROD_NUM_IQS525	52
40 #define IQS5XX_PROJ_NUM_A000	0
41 #define IQS5XX_PROJ_NUM_B000	15
42 #define IQS5XX_MAJOR_VER_MIN	2
43 
44 #define IQS5XX_SHOW_RESET	BIT(7)
45 #define IQS5XX_ACK_RESET	BIT(7)
46 
47 #define IQS5XX_SUSPEND		BIT(0)
48 #define IQS5XX_RESUME		0
49 
50 #define IQS5XX_SETUP_COMPLETE	BIT(6)
51 #define IQS5XX_WDT		BIT(5)
52 #define IQS5XX_ALP_REATI	BIT(3)
53 #define IQS5XX_REATI		BIT(2)
54 
55 #define IQS5XX_TP_EVENT		BIT(2)
56 #define IQS5XX_EVENT_MODE	BIT(0)
57 
58 #define IQS5XX_PROD_NUM		0x0000
59 #define IQS5XX_SYS_INFO0	0x000F
60 #define IQS5XX_SYS_INFO1	0x0010
61 #define IQS5XX_SYS_CTRL0	0x0431
62 #define IQS5XX_SYS_CTRL1	0x0432
63 #define IQS5XX_SYS_CFG0		0x058E
64 #define IQS5XX_SYS_CFG1		0x058F
65 #define IQS5XX_X_RES		0x066E
66 #define IQS5XX_Y_RES		0x0670
67 #define IQS5XX_CHKSM		0x83C0
68 #define IQS5XX_APP		0x8400
69 #define IQS5XX_CSTM		0xBE00
70 #define IQS5XX_PMAP_END		0xBFFF
71 #define IQS5XX_END_COMM		0xEEEE
72 
73 #define IQS5XX_CHKSM_LEN	(IQS5XX_APP - IQS5XX_CHKSM)
74 #define IQS5XX_APP_LEN		(IQS5XX_CSTM - IQS5XX_APP)
75 #define IQS5XX_CSTM_LEN		(IQS5XX_PMAP_END + 1 - IQS5XX_CSTM)
76 #define IQS5XX_PMAP_LEN		(IQS5XX_PMAP_END + 1 - IQS5XX_CHKSM)
77 
78 #define IQS5XX_REC_HDR_LEN	4
79 #define IQS5XX_REC_LEN_MAX	255
80 #define IQS5XX_REC_TYPE_DATA	0x00
81 #define IQS5XX_REC_TYPE_EOF	0x01
82 
83 #define IQS5XX_BL_ADDR_MASK	0x40
84 #define IQS5XX_BL_CMD_VER	0x00
85 #define IQS5XX_BL_CMD_READ	0x01
86 #define IQS5XX_BL_CMD_EXEC	0x02
87 #define IQS5XX_BL_CMD_CRC	0x03
88 #define IQS5XX_BL_BLK_LEN_MAX	64
89 #define IQS5XX_BL_ID		0x0200
90 #define IQS5XX_BL_STATUS_RESET	0x00
91 #define IQS5XX_BL_STATUS_AVAIL	0xA5
92 #define IQS5XX_BL_STATUS_NONE	0xEE
93 #define IQS5XX_BL_CRC_PASS	0x00
94 #define IQS5XX_BL_CRC_FAIL	0x01
95 #define IQS5XX_BL_ATTEMPTS	3
96 
97 struct iqs5xx_private {
98 	struct i2c_client *client;
99 	struct input_dev *input;
100 	struct gpio_desc *reset_gpio;
101 	struct touchscreen_properties prop;
102 	struct mutex lock;
103 	u8 bl_status;
104 };
105 
106 struct iqs5xx_dev_id_info {
107 	__be16 prod_num;
108 	__be16 proj_num;
109 	u8 major_ver;
110 	u8 minor_ver;
111 	u8 bl_status;
112 } __packed;
113 
114 struct iqs5xx_ihex_rec {
115 	char start;
116 	char len[2];
117 	char addr[4];
118 	char type[2];
119 	char data[2];
120 } __packed;
121 
122 struct iqs5xx_touch_data {
123 	__be16 abs_x;
124 	__be16 abs_y;
125 	__be16 strength;
126 	u8 area;
127 } __packed;
128 
129 struct iqs5xx_status {
130 	u8 sys_info[2];
131 	u8 num_active;
132 	__be16 rel_x;
133 	__be16 rel_y;
134 	struct iqs5xx_touch_data touch_data[IQS5XX_NUM_CONTACTS];
135 } __packed;
136 
137 static int iqs5xx_read_burst(struct i2c_client *client,
138 			     u16 reg, void *val, u16 len)
139 {
140 	__be16 reg_buf = cpu_to_be16(reg);
141 	int ret, i;
142 	struct i2c_msg msg[] = {
143 		{
144 			.addr = client->addr,
145 			.flags = 0,
146 			.len = sizeof(reg_buf),
147 			.buf = (u8 *)&reg_buf,
148 		},
149 		{
150 			.addr = client->addr,
151 			.flags = I2C_M_RD,
152 			.len = len,
153 			.buf = (u8 *)val,
154 		},
155 	};
156 
157 	/*
158 	 * The first addressing attempt outside of a communication window fails
159 	 * and must be retried, after which the device clock stretches until it
160 	 * is available.
161 	 */
162 	for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
163 		ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
164 		if (ret == ARRAY_SIZE(msg))
165 			return 0;
166 
167 		usleep_range(200, 300);
168 	}
169 
170 	if (ret >= 0)
171 		ret = -EIO;
172 
173 	dev_err(&client->dev, "Failed to read from address 0x%04X: %d\n",
174 		reg, ret);
175 
176 	return ret;
177 }
178 
179 static int iqs5xx_read_word(struct i2c_client *client, u16 reg, u16 *val)
180 {
181 	__be16 val_buf;
182 	int error;
183 
184 	error = iqs5xx_read_burst(client, reg, &val_buf, sizeof(val_buf));
185 	if (error)
186 		return error;
187 
188 	*val = be16_to_cpu(val_buf);
189 
190 	return 0;
191 }
192 
193 static int iqs5xx_write_burst(struct i2c_client *client,
194 			      u16 reg, const void *val, u16 len)
195 {
196 	int ret, i;
197 	u16 mlen = sizeof(reg) + len;
198 	u8 mbuf[sizeof(reg) + IQS5XX_WR_BYTES_MAX];
199 
200 	if (len > IQS5XX_WR_BYTES_MAX)
201 		return -EINVAL;
202 
203 	put_unaligned_be16(reg, mbuf);
204 	memcpy(mbuf + sizeof(reg), val, len);
205 
206 	/*
207 	 * The first addressing attempt outside of a communication window fails
208 	 * and must be retried, after which the device clock stretches until it
209 	 * is available.
210 	 */
211 	for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
212 		ret = i2c_master_send(client, mbuf, mlen);
213 		if (ret == mlen)
214 			return 0;
215 
216 		usleep_range(200, 300);
217 	}
218 
219 	if (ret >= 0)
220 		ret = -EIO;
221 
222 	dev_err(&client->dev, "Failed to write to address 0x%04X: %d\n",
223 		reg, ret);
224 
225 	return ret;
226 }
227 
228 static int iqs5xx_write_word(struct i2c_client *client, u16 reg, u16 val)
229 {
230 	__be16 val_buf = cpu_to_be16(val);
231 
232 	return iqs5xx_write_burst(client, reg, &val_buf, sizeof(val_buf));
233 }
234 
235 static int iqs5xx_write_byte(struct i2c_client *client, u16 reg, u8 val)
236 {
237 	return iqs5xx_write_burst(client, reg, &val, sizeof(val));
238 }
239 
240 static void iqs5xx_reset(struct i2c_client *client)
241 {
242 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
243 
244 	gpiod_set_value_cansleep(iqs5xx->reset_gpio, 1);
245 	usleep_range(200, 300);
246 
247 	gpiod_set_value_cansleep(iqs5xx->reset_gpio, 0);
248 }
249 
250 static int iqs5xx_bl_cmd(struct i2c_client *client, u8 bl_cmd, u16 bl_addr)
251 {
252 	struct i2c_msg msg;
253 	int ret;
254 	u8 mbuf[sizeof(bl_cmd) + sizeof(bl_addr)];
255 
256 	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
257 	msg.flags = 0;
258 	msg.len = sizeof(bl_cmd);
259 	msg.buf = mbuf;
260 
261 	*mbuf = bl_cmd;
262 
263 	switch (bl_cmd) {
264 	case IQS5XX_BL_CMD_VER:
265 	case IQS5XX_BL_CMD_CRC:
266 	case IQS5XX_BL_CMD_EXEC:
267 		break;
268 	case IQS5XX_BL_CMD_READ:
269 		msg.len += sizeof(bl_addr);
270 		put_unaligned_be16(bl_addr, mbuf + sizeof(bl_cmd));
271 		break;
272 	default:
273 		return -EINVAL;
274 	}
275 
276 	ret = i2c_transfer(client->adapter, &msg, 1);
277 	if (ret != 1)
278 		goto msg_fail;
279 
280 	switch (bl_cmd) {
281 	case IQS5XX_BL_CMD_VER:
282 		msg.len = sizeof(u16);
283 		break;
284 	case IQS5XX_BL_CMD_CRC:
285 		msg.len = sizeof(u8);
286 		/*
287 		 * This delay saves the bus controller the trouble of having to
288 		 * tolerate a relatively long clock-stretching period while the
289 		 * CRC is calculated.
290 		 */
291 		msleep(50);
292 		break;
293 	case IQS5XX_BL_CMD_EXEC:
294 		usleep_range(10000, 10100);
295 		fallthrough;
296 	default:
297 		return 0;
298 	}
299 
300 	msg.flags = I2C_M_RD;
301 
302 	ret = i2c_transfer(client->adapter, &msg, 1);
303 	if (ret != 1)
304 		goto msg_fail;
305 
306 	if (bl_cmd == IQS5XX_BL_CMD_VER &&
307 	    get_unaligned_be16(mbuf) != IQS5XX_BL_ID) {
308 		dev_err(&client->dev, "Unrecognized bootloader ID: 0x%04X\n",
309 			get_unaligned_be16(mbuf));
310 		return -EINVAL;
311 	}
312 
313 	if (bl_cmd == IQS5XX_BL_CMD_CRC && *mbuf != IQS5XX_BL_CRC_PASS) {
314 		dev_err(&client->dev, "Bootloader CRC failed\n");
315 		return -EIO;
316 	}
317 
318 	return 0;
319 
320 msg_fail:
321 	if (ret >= 0)
322 		ret = -EIO;
323 
324 	if (bl_cmd != IQS5XX_BL_CMD_VER)
325 		dev_err(&client->dev,
326 			"Unsuccessful bootloader command 0x%02X: %d\n",
327 			bl_cmd, ret);
328 
329 	return ret;
330 }
331 
332 static int iqs5xx_bl_open(struct i2c_client *client)
333 {
334 	int error, i, j;
335 
336 	/*
337 	 * The device opens a bootloader polling window for 2 ms following the
338 	 * release of reset. If the host cannot establish communication during
339 	 * this time frame, it must cycle reset again.
340 	 */
341 	for (i = 0; i < IQS5XX_BL_ATTEMPTS; i++) {
342 		iqs5xx_reset(client);
343 		usleep_range(350, 400);
344 
345 		for (j = 0; j < IQS5XX_NUM_RETRIES; j++) {
346 			error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
347 			if (!error)
348 				usleep_range(10000, 10100);
349 			else if (error != -EINVAL)
350 				continue;
351 
352 			return error;
353 		}
354 	}
355 
356 	dev_err(&client->dev, "Failed to open bootloader: %d\n", error);
357 
358 	return error;
359 }
360 
361 static int iqs5xx_bl_write(struct i2c_client *client,
362 			   u16 bl_addr, u8 *pmap_data, u16 pmap_len)
363 {
364 	struct i2c_msg msg;
365 	int ret, i;
366 	u8 mbuf[sizeof(bl_addr) + IQS5XX_BL_BLK_LEN_MAX];
367 
368 	if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
369 		return -EINVAL;
370 
371 	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
372 	msg.flags = 0;
373 	msg.len = sizeof(mbuf);
374 	msg.buf = mbuf;
375 
376 	for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
377 		put_unaligned_be16(bl_addr + i, mbuf);
378 		memcpy(mbuf + sizeof(bl_addr), pmap_data + i,
379 		       sizeof(mbuf) - sizeof(bl_addr));
380 
381 		ret = i2c_transfer(client->adapter, &msg, 1);
382 		if (ret != 1)
383 			goto msg_fail;
384 
385 		usleep_range(10000, 10100);
386 	}
387 
388 	return 0;
389 
390 msg_fail:
391 	if (ret >= 0)
392 		ret = -EIO;
393 
394 	dev_err(&client->dev, "Failed to write block at address 0x%04X: %d\n",
395 		bl_addr + i, ret);
396 
397 	return ret;
398 }
399 
400 static int iqs5xx_bl_verify(struct i2c_client *client,
401 			    u16 bl_addr, u8 *pmap_data, u16 pmap_len)
402 {
403 	struct i2c_msg msg;
404 	int ret, i;
405 	u8 bl_data[IQS5XX_BL_BLK_LEN_MAX];
406 
407 	if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
408 		return -EINVAL;
409 
410 	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
411 	msg.flags = I2C_M_RD;
412 	msg.len = sizeof(bl_data);
413 	msg.buf = bl_data;
414 
415 	for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
416 		ret = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_READ, bl_addr + i);
417 		if (ret)
418 			return ret;
419 
420 		ret = i2c_transfer(client->adapter, &msg, 1);
421 		if (ret != 1)
422 			goto msg_fail;
423 
424 		if (memcmp(bl_data, pmap_data + i, sizeof(bl_data))) {
425 			dev_err(&client->dev,
426 				"Failed to verify block at address 0x%04X\n",
427 				bl_addr + i);
428 			return -EIO;
429 		}
430 	}
431 
432 	return 0;
433 
434 msg_fail:
435 	if (ret >= 0)
436 		ret = -EIO;
437 
438 	dev_err(&client->dev, "Failed to read block at address 0x%04X: %d\n",
439 		bl_addr + i, ret);
440 
441 	return ret;
442 }
443 
444 static int iqs5xx_set_state(struct i2c_client *client, u8 state)
445 {
446 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
447 	int error1, error2;
448 
449 	if (iqs5xx->bl_status == IQS5XX_BL_STATUS_RESET)
450 		return 0;
451 
452 	mutex_lock(&iqs5xx->lock);
453 
454 	/*
455 	 * Addressing the device outside of a communication window prompts it
456 	 * to assert the RDY output, so disable the interrupt line to prevent
457 	 * the handler from servicing a false interrupt.
458 	 */
459 	disable_irq(client->irq);
460 
461 	error1 = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL1, state);
462 	error2 = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
463 
464 	usleep_range(50, 100);
465 	enable_irq(client->irq);
466 
467 	mutex_unlock(&iqs5xx->lock);
468 
469 	if (error1)
470 		return error1;
471 
472 	return error2;
473 }
474 
475 static int iqs5xx_open(struct input_dev *input)
476 {
477 	struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
478 
479 	return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
480 }
481 
482 static void iqs5xx_close(struct input_dev *input)
483 {
484 	struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
485 
486 	iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
487 }
488 
489 static int iqs5xx_axis_init(struct i2c_client *client)
490 {
491 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
492 	struct touchscreen_properties *prop = &iqs5xx->prop;
493 	struct input_dev *input;
494 	u16 max_x, max_y;
495 	int error;
496 
497 	if (!iqs5xx->input) {
498 		input = devm_input_allocate_device(&client->dev);
499 		if (!input)
500 			return -ENOMEM;
501 
502 		input->name = client->name;
503 		input->id.bustype = BUS_I2C;
504 		input->open = iqs5xx_open;
505 		input->close = iqs5xx_close;
506 
507 		input_set_capability(input, EV_ABS, ABS_MT_POSITION_X);
508 		input_set_capability(input, EV_ABS, ABS_MT_POSITION_Y);
509 		input_set_capability(input, EV_ABS, ABS_MT_PRESSURE);
510 
511 		input_set_drvdata(input, iqs5xx);
512 		iqs5xx->input = input;
513 	}
514 
515 	error = iqs5xx_read_word(client, IQS5XX_X_RES, &max_x);
516 	if (error)
517 		return error;
518 
519 	error = iqs5xx_read_word(client, IQS5XX_Y_RES, &max_y);
520 	if (error)
521 		return error;
522 
523 	input_abs_set_max(iqs5xx->input, ABS_MT_POSITION_X, max_x);
524 	input_abs_set_max(iqs5xx->input, ABS_MT_POSITION_Y, max_y);
525 
526 	touchscreen_parse_properties(iqs5xx->input, true, prop);
527 
528 	if (prop->max_x > IQS5XX_XY_RES_MAX) {
529 		dev_err(&client->dev, "Invalid maximum x-coordinate: %u > %u\n",
530 			prop->max_x, IQS5XX_XY_RES_MAX);
531 		return -EINVAL;
532 	} else if (prop->max_x != max_x) {
533 		error = iqs5xx_write_word(client, IQS5XX_X_RES, prop->max_x);
534 		if (error)
535 			return error;
536 	}
537 
538 	if (prop->max_y > IQS5XX_XY_RES_MAX) {
539 		dev_err(&client->dev, "Invalid maximum y-coordinate: %u > %u\n",
540 			prop->max_y, IQS5XX_XY_RES_MAX);
541 		return -EINVAL;
542 	} else if (prop->max_y != max_y) {
543 		error = iqs5xx_write_word(client, IQS5XX_Y_RES, prop->max_y);
544 		if (error)
545 			return error;
546 	}
547 
548 	error = input_mt_init_slots(iqs5xx->input, IQS5XX_NUM_CONTACTS,
549 				    INPUT_MT_DIRECT);
550 	if (error)
551 		dev_err(&client->dev, "Failed to initialize slots: %d\n",
552 			error);
553 
554 	return error;
555 }
556 
557 static int iqs5xx_dev_init(struct i2c_client *client)
558 {
559 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
560 	struct iqs5xx_dev_id_info *dev_id_info;
561 	int error;
562 	u8 buf[sizeof(*dev_id_info) + 1];
563 
564 	error = iqs5xx_read_burst(client, IQS5XX_PROD_NUM,
565 				  &buf[1], sizeof(*dev_id_info));
566 	if (error)
567 		return iqs5xx_bl_open(client);
568 
569 	/*
570 	 * A000 and B000 devices use 8-bit and 16-bit addressing, respectively.
571 	 * Querying an A000 device's version information with 16-bit addressing
572 	 * gives the appearance that the data is shifted by one byte; a nonzero
573 	 * leading array element suggests this could be the case (in which case
574 	 * the missing zero is prepended).
575 	 */
576 	buf[0] = 0;
577 	dev_id_info = (struct iqs5xx_dev_id_info *)&buf[(buf[1] > 0) ? 0 : 1];
578 
579 	switch (be16_to_cpu(dev_id_info->prod_num)) {
580 	case IQS5XX_PROD_NUM_IQS550:
581 	case IQS5XX_PROD_NUM_IQS572:
582 	case IQS5XX_PROD_NUM_IQS525:
583 		break;
584 	default:
585 		dev_err(&client->dev, "Unrecognized product number: %u\n",
586 			be16_to_cpu(dev_id_info->prod_num));
587 		return -EINVAL;
588 	}
589 
590 	switch (be16_to_cpu(dev_id_info->proj_num)) {
591 	case IQS5XX_PROJ_NUM_A000:
592 		dev_err(&client->dev, "Unsupported project number: %u\n",
593 			be16_to_cpu(dev_id_info->proj_num));
594 		return iqs5xx_bl_open(client);
595 	case IQS5XX_PROJ_NUM_B000:
596 		break;
597 	default:
598 		dev_err(&client->dev, "Unrecognized project number: %u\n",
599 			be16_to_cpu(dev_id_info->proj_num));
600 		return -EINVAL;
601 	}
602 
603 	if (dev_id_info->major_ver < IQS5XX_MAJOR_VER_MIN) {
604 		dev_err(&client->dev, "Unsupported major version: %u\n",
605 			dev_id_info->major_ver);
606 		return iqs5xx_bl_open(client);
607 	}
608 
609 	switch (dev_id_info->bl_status) {
610 	case IQS5XX_BL_STATUS_AVAIL:
611 	case IQS5XX_BL_STATUS_NONE:
612 		break;
613 	default:
614 		dev_err(&client->dev,
615 			"Unrecognized bootloader status: 0x%02X\n",
616 			dev_id_info->bl_status);
617 		return -EINVAL;
618 	}
619 
620 	error = iqs5xx_axis_init(client);
621 	if (error)
622 		return error;
623 
624 	error = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL0, IQS5XX_ACK_RESET);
625 	if (error)
626 		return error;
627 
628 	error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG0,
629 				  IQS5XX_SETUP_COMPLETE | IQS5XX_WDT |
630 				  IQS5XX_ALP_REATI | IQS5XX_REATI);
631 	if (error)
632 		return error;
633 
634 	error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG1,
635 				  IQS5XX_TP_EVENT | IQS5XX_EVENT_MODE);
636 	if (error)
637 		return error;
638 
639 	error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
640 	if (error)
641 		return error;
642 
643 	iqs5xx->bl_status = dev_id_info->bl_status;
644 
645 	/*
646 	 * The following delay allows ATI to complete before the open and close
647 	 * callbacks are free to elicit I2C communication. Any attempts to read
648 	 * from or write to the device during this time may face extended clock
649 	 * stretching and prompt the I2C controller to report an error.
650 	 */
651 	msleep(250);
652 
653 	return 0;
654 }
655 
656 static irqreturn_t iqs5xx_irq(int irq, void *data)
657 {
658 	struct iqs5xx_private *iqs5xx = data;
659 	struct iqs5xx_status status;
660 	struct i2c_client *client = iqs5xx->client;
661 	struct input_dev *input = iqs5xx->input;
662 	int error, i;
663 
664 	/*
665 	 * This check is purely a precaution, as the device does not assert the
666 	 * RDY output during bootloader mode. If the device operates outside of
667 	 * bootloader mode, the input device is guaranteed to be allocated.
668 	 */
669 	if (iqs5xx->bl_status == IQS5XX_BL_STATUS_RESET)
670 		return IRQ_NONE;
671 
672 	error = iqs5xx_read_burst(client, IQS5XX_SYS_INFO0,
673 				  &status, sizeof(status));
674 	if (error)
675 		return IRQ_NONE;
676 
677 	if (status.sys_info[0] & IQS5XX_SHOW_RESET) {
678 		dev_err(&client->dev, "Unexpected device reset\n");
679 
680 		error = iqs5xx_dev_init(client);
681 		if (error) {
682 			dev_err(&client->dev,
683 				"Failed to re-initialize device: %d\n", error);
684 			return IRQ_NONE;
685 		}
686 
687 		return IRQ_HANDLED;
688 	}
689 
690 	for (i = 0; i < ARRAY_SIZE(status.touch_data); i++) {
691 		struct iqs5xx_touch_data *touch_data = &status.touch_data[i];
692 		u16 pressure = be16_to_cpu(touch_data->strength);
693 
694 		input_mt_slot(input, i);
695 		if (input_mt_report_slot_state(input, MT_TOOL_FINGER,
696 					       pressure != 0)) {
697 			touchscreen_report_pos(iqs5xx->input, &iqs5xx->prop,
698 					       be16_to_cpu(touch_data->abs_x),
699 					       be16_to_cpu(touch_data->abs_y),
700 					       true);
701 			input_report_abs(input, ABS_MT_PRESSURE, pressure);
702 		}
703 	}
704 
705 	input_mt_sync_frame(input);
706 	input_sync(input);
707 
708 	error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
709 	if (error)
710 		return IRQ_NONE;
711 
712 	/*
713 	 * Once the communication window is closed, a small delay is added to
714 	 * ensure the device's RDY output has been deasserted by the time the
715 	 * interrupt handler returns.
716 	 */
717 	usleep_range(50, 100);
718 
719 	return IRQ_HANDLED;
720 }
721 
722 static int iqs5xx_fw_file_parse(struct i2c_client *client,
723 				const char *fw_file, u8 *pmap)
724 {
725 	const struct firmware *fw;
726 	struct iqs5xx_ihex_rec *rec;
727 	size_t pos = 0;
728 	int error, i;
729 	u16 rec_num = 1;
730 	u16 rec_addr;
731 	u8 rec_len, rec_type, rec_chksm, chksm;
732 	u8 rec_hdr[IQS5XX_REC_HDR_LEN];
733 	u8 rec_data[IQS5XX_REC_LEN_MAX];
734 
735 	/*
736 	 * Firmware exported from the vendor's configuration tool deviates from
737 	 * standard ihex as follows: (1) the checksum for records corresponding
738 	 * to user-exported settings is not recalculated, and (2) an address of
739 	 * 0xFFFF is used for the EOF record.
740 	 *
741 	 * Because the ihex2fw tool tolerates neither (1) nor (2), the slightly
742 	 * nonstandard ihex firmware is parsed directly by the driver.
743 	 */
744 	error = request_firmware(&fw, fw_file, &client->dev);
745 	if (error) {
746 		dev_err(&client->dev, "Failed to request firmware %s: %d\n",
747 			fw_file, error);
748 		return error;
749 	}
750 
751 	do {
752 		if (pos + sizeof(*rec) > fw->size) {
753 			dev_err(&client->dev, "Insufficient firmware size\n");
754 			error = -EINVAL;
755 			break;
756 		}
757 		rec = (struct iqs5xx_ihex_rec *)(fw->data + pos);
758 		pos += sizeof(*rec);
759 
760 		if (rec->start != ':') {
761 			dev_err(&client->dev, "Invalid start at record %u\n",
762 				rec_num);
763 			error = -EINVAL;
764 			break;
765 		}
766 
767 		error = hex2bin(rec_hdr, rec->len, sizeof(rec_hdr));
768 		if (error) {
769 			dev_err(&client->dev, "Invalid header at record %u\n",
770 				rec_num);
771 			break;
772 		}
773 
774 		rec_len = *rec_hdr;
775 		rec_addr = get_unaligned_be16(rec_hdr + sizeof(rec_len));
776 		rec_type = *(rec_hdr + sizeof(rec_len) + sizeof(rec_addr));
777 
778 		if (pos + rec_len * 2 > fw->size) {
779 			dev_err(&client->dev, "Insufficient firmware size\n");
780 			error = -EINVAL;
781 			break;
782 		}
783 		pos += (rec_len * 2);
784 
785 		error = hex2bin(rec_data, rec->data, rec_len);
786 		if (error) {
787 			dev_err(&client->dev, "Invalid data at record %u\n",
788 				rec_num);
789 			break;
790 		}
791 
792 		error = hex2bin(&rec_chksm,
793 				rec->data + rec_len * 2, sizeof(rec_chksm));
794 		if (error) {
795 			dev_err(&client->dev, "Invalid checksum at record %u\n",
796 				rec_num);
797 			break;
798 		}
799 
800 		chksm = 0;
801 		for (i = 0; i < sizeof(rec_hdr); i++)
802 			chksm += rec_hdr[i];
803 		for (i = 0; i < rec_len; i++)
804 			chksm += rec_data[i];
805 		chksm = ~chksm + 1;
806 
807 		if (chksm != rec_chksm && rec_addr < IQS5XX_CSTM) {
808 			dev_err(&client->dev,
809 				"Incorrect checksum at record %u\n",
810 				rec_num);
811 			error = -EINVAL;
812 			break;
813 		}
814 
815 		switch (rec_type) {
816 		case IQS5XX_REC_TYPE_DATA:
817 			if (rec_addr < IQS5XX_CHKSM ||
818 			    rec_addr > IQS5XX_PMAP_END) {
819 				dev_err(&client->dev,
820 					"Invalid address at record %u\n",
821 					rec_num);
822 				error = -EINVAL;
823 			} else {
824 				memcpy(pmap + rec_addr - IQS5XX_CHKSM,
825 				       rec_data, rec_len);
826 			}
827 			break;
828 		case IQS5XX_REC_TYPE_EOF:
829 			break;
830 		default:
831 			dev_err(&client->dev, "Invalid type at record %u\n",
832 				rec_num);
833 			error = -EINVAL;
834 		}
835 
836 		if (error)
837 			break;
838 
839 		rec_num++;
840 		while (pos < fw->size) {
841 			if (*(fw->data + pos) == ':')
842 				break;
843 			pos++;
844 		}
845 	} while (rec_type != IQS5XX_REC_TYPE_EOF);
846 
847 	release_firmware(fw);
848 
849 	return error;
850 }
851 
852 static int iqs5xx_fw_file_write(struct i2c_client *client, const char *fw_file)
853 {
854 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
855 	int error, error_bl = 0;
856 	u8 *pmap;
857 
858 	if (iqs5xx->bl_status == IQS5XX_BL_STATUS_NONE)
859 		return -EPERM;
860 
861 	pmap = kzalloc(IQS5XX_PMAP_LEN, GFP_KERNEL);
862 	if (!pmap)
863 		return -ENOMEM;
864 
865 	error = iqs5xx_fw_file_parse(client, fw_file, pmap);
866 	if (error)
867 		goto err_kfree;
868 
869 	mutex_lock(&iqs5xx->lock);
870 
871 	/*
872 	 * Disable the interrupt line in case the first attempt(s) to enter the
873 	 * bootloader don't happen quickly enough, in which case the device may
874 	 * assert the RDY output until the next attempt.
875 	 */
876 	disable_irq(client->irq);
877 
878 	iqs5xx->bl_status = IQS5XX_BL_STATUS_RESET;
879 
880 	error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
881 	if (error) {
882 		error = iqs5xx_bl_open(client);
883 		if (error)
884 			goto err_reset;
885 	}
886 
887 	error = iqs5xx_bl_write(client, IQS5XX_CHKSM, pmap, IQS5XX_PMAP_LEN);
888 	if (error)
889 		goto err_reset;
890 
891 	error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_CRC, 0);
892 	if (error)
893 		goto err_reset;
894 
895 	error = iqs5xx_bl_verify(client, IQS5XX_CSTM,
896 				 pmap + IQS5XX_CHKSM_LEN + IQS5XX_APP_LEN,
897 				 IQS5XX_CSTM_LEN);
898 	if (error)
899 		goto err_reset;
900 
901 	error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_EXEC, 0);
902 
903 err_reset:
904 	if (error) {
905 		iqs5xx_reset(client);
906 		usleep_range(10000, 10100);
907 	}
908 
909 	error_bl = error;
910 	error = iqs5xx_dev_init(client);
911 	if (!error && iqs5xx->bl_status == IQS5XX_BL_STATUS_RESET)
912 		error = -EINVAL;
913 
914 	enable_irq(client->irq);
915 
916 	mutex_unlock(&iqs5xx->lock);
917 
918 err_kfree:
919 	kfree(pmap);
920 
921 	if (error_bl)
922 		return error_bl;
923 
924 	return error;
925 }
926 
927 static ssize_t fw_file_store(struct device *dev,
928 			     struct device_attribute *attr, const char *buf,
929 			     size_t count)
930 {
931 	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
932 	struct i2c_client *client = iqs5xx->client;
933 	size_t len = count;
934 	bool input_reg = !iqs5xx->input;
935 	char fw_file[IQS5XX_FW_FILE_LEN + 1];
936 	int error;
937 
938 	if (!len)
939 		return -EINVAL;
940 
941 	if (buf[len - 1] == '\n')
942 		len--;
943 
944 	if (len > IQS5XX_FW_FILE_LEN)
945 		return -ENAMETOOLONG;
946 
947 	memcpy(fw_file, buf, len);
948 	fw_file[len] = '\0';
949 
950 	error = iqs5xx_fw_file_write(client, fw_file);
951 	if (error)
952 		return error;
953 
954 	/*
955 	 * If the input device was not allocated already, it is guaranteed to
956 	 * be allocated by this point and can finally be registered.
957 	 */
958 	if (input_reg) {
959 		error = input_register_device(iqs5xx->input);
960 		if (error) {
961 			dev_err(&client->dev,
962 				"Failed to register device: %d\n",
963 				error);
964 			return error;
965 		}
966 	}
967 
968 	return count;
969 }
970 
971 static DEVICE_ATTR_WO(fw_file);
972 
973 static struct attribute *iqs5xx_attrs[] = {
974 	&dev_attr_fw_file.attr,
975 	NULL,
976 };
977 
978 static const struct attribute_group iqs5xx_attr_group = {
979 	.attrs = iqs5xx_attrs,
980 };
981 
982 static int __maybe_unused iqs5xx_suspend(struct device *dev)
983 {
984 	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
985 	struct input_dev *input = iqs5xx->input;
986 	int error = 0;
987 
988 	if (!input || device_may_wakeup(dev))
989 		return error;
990 
991 	mutex_lock(&input->mutex);
992 
993 	if (input_device_enabled(input))
994 		error = iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
995 
996 	mutex_unlock(&input->mutex);
997 
998 	return error;
999 }
1000 
1001 static int __maybe_unused iqs5xx_resume(struct device *dev)
1002 {
1003 	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
1004 	struct input_dev *input = iqs5xx->input;
1005 	int error = 0;
1006 
1007 	if (!input || device_may_wakeup(dev))
1008 		return error;
1009 
1010 	mutex_lock(&input->mutex);
1011 
1012 	if (input_device_enabled(input))
1013 		error = iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
1014 
1015 	mutex_unlock(&input->mutex);
1016 
1017 	return error;
1018 }
1019 
1020 static SIMPLE_DEV_PM_OPS(iqs5xx_pm, iqs5xx_suspend, iqs5xx_resume);
1021 
1022 static int iqs5xx_probe(struct i2c_client *client,
1023 			const struct i2c_device_id *id)
1024 {
1025 	struct iqs5xx_private *iqs5xx;
1026 	int error;
1027 
1028 	iqs5xx = devm_kzalloc(&client->dev, sizeof(*iqs5xx), GFP_KERNEL);
1029 	if (!iqs5xx)
1030 		return -ENOMEM;
1031 
1032 	i2c_set_clientdata(client, iqs5xx);
1033 	iqs5xx->client = client;
1034 
1035 	iqs5xx->reset_gpio = devm_gpiod_get(&client->dev,
1036 					    "reset", GPIOD_OUT_LOW);
1037 	if (IS_ERR(iqs5xx->reset_gpio)) {
1038 		error = PTR_ERR(iqs5xx->reset_gpio);
1039 		dev_err(&client->dev, "Failed to request GPIO: %d\n", error);
1040 		return error;
1041 	}
1042 
1043 	mutex_init(&iqs5xx->lock);
1044 
1045 	iqs5xx_reset(client);
1046 	usleep_range(10000, 10100);
1047 
1048 	error = iqs5xx_dev_init(client);
1049 	if (error)
1050 		return error;
1051 
1052 	error = devm_request_threaded_irq(&client->dev, client->irq,
1053 					  NULL, iqs5xx_irq, IRQF_ONESHOT,
1054 					  client->name, iqs5xx);
1055 	if (error) {
1056 		dev_err(&client->dev, "Failed to request IRQ: %d\n", error);
1057 		return error;
1058 	}
1059 
1060 	error = devm_device_add_group(&client->dev, &iqs5xx_attr_group);
1061 	if (error) {
1062 		dev_err(&client->dev, "Failed to add attributes: %d\n", error);
1063 		return error;
1064 	}
1065 
1066 	if (iqs5xx->input) {
1067 		error = input_register_device(iqs5xx->input);
1068 		if (error)
1069 			dev_err(&client->dev,
1070 				"Failed to register device: %d\n",
1071 				error);
1072 	}
1073 
1074 	return error;
1075 }
1076 
1077 static const struct i2c_device_id iqs5xx_id[] = {
1078 	{ "iqs550", 0 },
1079 	{ "iqs572", 1 },
1080 	{ "iqs525", 2 },
1081 	{ }
1082 };
1083 MODULE_DEVICE_TABLE(i2c, iqs5xx_id);
1084 
1085 static const struct of_device_id iqs5xx_of_match[] = {
1086 	{ .compatible = "azoteq,iqs550" },
1087 	{ .compatible = "azoteq,iqs572" },
1088 	{ .compatible = "azoteq,iqs525" },
1089 	{ }
1090 };
1091 MODULE_DEVICE_TABLE(of, iqs5xx_of_match);
1092 
1093 static struct i2c_driver iqs5xx_i2c_driver = {
1094 	.driver = {
1095 		.name		= "iqs5xx",
1096 		.of_match_table	= iqs5xx_of_match,
1097 		.pm		= &iqs5xx_pm,
1098 	},
1099 	.id_table	= iqs5xx_id,
1100 	.probe		= iqs5xx_probe,
1101 };
1102 module_i2c_driver(iqs5xx_i2c_driver);
1103 
1104 MODULE_AUTHOR("Jeff LaBundy <jeff@labundy.com>");
1105 MODULE_DESCRIPTION("Azoteq IQS550/572/525 Trackpad/Touchscreen Controller");
1106 MODULE_LICENSE("GPL");
1107