1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Azoteq IQS550/572/525 Trackpad/Touchscreen Controller
4  *
5  * Copyright (C) 2018 Jeff LaBundy <jeff@labundy.com>
6  *
7  * These devices require firmware exported from a PC-based configuration tool
8  * made available by the vendor. Firmware files may be pushed to the device's
9  * nonvolatile memory by writing the filename to the 'fw_file' sysfs control.
10  *
11  * Link to PC-based configuration tool and datasheet: https://www.azoteq.com/
12  */
13 
14 #include <linux/bits.h>
15 #include <linux/delay.h>
16 #include <linux/device.h>
17 #include <linux/err.h>
18 #include <linux/firmware.h>
19 #include <linux/gpio/consumer.h>
20 #include <linux/i2c.h>
21 #include <linux/input.h>
22 #include <linux/input/mt.h>
23 #include <linux/input/touchscreen.h>
24 #include <linux/interrupt.h>
25 #include <linux/kernel.h>
26 #include <linux/module.h>
27 #include <linux/of_device.h>
28 #include <linux/slab.h>
29 #include <asm/unaligned.h>
30 
31 #define IQS5XX_FW_FILE_LEN	64
32 #define IQS5XX_NUM_RETRIES	10
33 #define IQS5XX_NUM_CONTACTS	5
34 #define IQS5XX_WR_BYTES_MAX	2
35 
36 #define IQS5XX_PROD_NUM_IQS550	40
37 #define IQS5XX_PROD_NUM_IQS572	58
38 #define IQS5XX_PROD_NUM_IQS525	52
39 
40 #define IQS5XX_SHOW_RESET	BIT(7)
41 #define IQS5XX_ACK_RESET	BIT(7)
42 
43 #define IQS5XX_SUSPEND		BIT(0)
44 #define IQS5XX_RESUME		0
45 
46 #define IQS5XX_SETUP_COMPLETE	BIT(6)
47 #define IQS5XX_WDT		BIT(5)
48 #define IQS5XX_ALP_REATI	BIT(3)
49 #define IQS5XX_REATI		BIT(2)
50 
51 #define IQS5XX_TP_EVENT		BIT(2)
52 #define IQS5XX_EVENT_MODE	BIT(0)
53 
54 #define IQS5XX_PROD_NUM		0x0000
55 #define IQS5XX_SYS_INFO0	0x000F
56 #define IQS5XX_SYS_INFO1	0x0010
57 #define IQS5XX_SYS_CTRL0	0x0431
58 #define IQS5XX_SYS_CTRL1	0x0432
59 #define IQS5XX_SYS_CFG0		0x058E
60 #define IQS5XX_SYS_CFG1		0x058F
61 #define IQS5XX_X_RES		0x066E
62 #define IQS5XX_Y_RES		0x0670
63 #define IQS5XX_EXP_FILE		0x0677
64 #define IQS5XX_CHKSM		0x83C0
65 #define IQS5XX_APP		0x8400
66 #define IQS5XX_CSTM		0xBE00
67 #define IQS5XX_PMAP_END		0xBFFF
68 #define IQS5XX_END_COMM		0xEEEE
69 
70 #define IQS5XX_CHKSM_LEN	(IQS5XX_APP - IQS5XX_CHKSM)
71 #define IQS5XX_APP_LEN		(IQS5XX_CSTM - IQS5XX_APP)
72 #define IQS5XX_CSTM_LEN		(IQS5XX_PMAP_END + 1 - IQS5XX_CSTM)
73 #define IQS5XX_PMAP_LEN		(IQS5XX_PMAP_END + 1 - IQS5XX_CHKSM)
74 
75 #define IQS5XX_REC_HDR_LEN	4
76 #define IQS5XX_REC_LEN_MAX	255
77 #define IQS5XX_REC_TYPE_DATA	0x00
78 #define IQS5XX_REC_TYPE_EOF	0x01
79 
80 #define IQS5XX_BL_ADDR_MASK	0x40
81 #define IQS5XX_BL_CMD_VER	0x00
82 #define IQS5XX_BL_CMD_READ	0x01
83 #define IQS5XX_BL_CMD_EXEC	0x02
84 #define IQS5XX_BL_CMD_CRC	0x03
85 #define IQS5XX_BL_BLK_LEN_MAX	64
86 #define IQS5XX_BL_ID		0x0200
87 #define IQS5XX_BL_STATUS_NONE	0xEE
88 #define IQS5XX_BL_CRC_PASS	0x00
89 #define IQS5XX_BL_CRC_FAIL	0x01
90 #define IQS5XX_BL_ATTEMPTS	3
91 
92 struct iqs5xx_dev_id_info {
93 	__be16 prod_num;
94 	__be16 proj_num;
95 	u8 major_ver;
96 	u8 minor_ver;
97 	u8 bl_status;
98 } __packed;
99 
100 struct iqs5xx_ihex_rec {
101 	char start;
102 	char len[2];
103 	char addr[4];
104 	char type[2];
105 	char data[2];
106 } __packed;
107 
108 struct iqs5xx_touch_data {
109 	__be16 abs_x;
110 	__be16 abs_y;
111 	__be16 strength;
112 	u8 area;
113 } __packed;
114 
115 struct iqs5xx_status {
116 	u8 sys_info[2];
117 	u8 num_active;
118 	__be16 rel_x;
119 	__be16 rel_y;
120 	struct iqs5xx_touch_data touch_data[IQS5XX_NUM_CONTACTS];
121 } __packed;
122 
123 struct iqs5xx_private {
124 	struct i2c_client *client;
125 	struct input_dev *input;
126 	struct gpio_desc *reset_gpio;
127 	struct touchscreen_properties prop;
128 	struct mutex lock;
129 	struct iqs5xx_dev_id_info dev_id_info;
130 	u8 exp_file[2];
131 };
132 
133 static int iqs5xx_read_burst(struct i2c_client *client,
134 			     u16 reg, void *val, u16 len)
135 {
136 	__be16 reg_buf = cpu_to_be16(reg);
137 	int ret, i;
138 	struct i2c_msg msg[] = {
139 		{
140 			.addr = client->addr,
141 			.flags = 0,
142 			.len = sizeof(reg_buf),
143 			.buf = (u8 *)&reg_buf,
144 		},
145 		{
146 			.addr = client->addr,
147 			.flags = I2C_M_RD,
148 			.len = len,
149 			.buf = (u8 *)val,
150 		},
151 	};
152 
153 	/*
154 	 * The first addressing attempt outside of a communication window fails
155 	 * and must be retried, after which the device clock stretches until it
156 	 * is available.
157 	 */
158 	for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
159 		ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
160 		if (ret == ARRAY_SIZE(msg))
161 			return 0;
162 
163 		usleep_range(200, 300);
164 	}
165 
166 	if (ret >= 0)
167 		ret = -EIO;
168 
169 	dev_err(&client->dev, "Failed to read from address 0x%04X: %d\n",
170 		reg, ret);
171 
172 	return ret;
173 }
174 
175 static int iqs5xx_read_word(struct i2c_client *client, u16 reg, u16 *val)
176 {
177 	__be16 val_buf;
178 	int error;
179 
180 	error = iqs5xx_read_burst(client, reg, &val_buf, sizeof(val_buf));
181 	if (error)
182 		return error;
183 
184 	*val = be16_to_cpu(val_buf);
185 
186 	return 0;
187 }
188 
189 static int iqs5xx_write_burst(struct i2c_client *client,
190 			      u16 reg, const void *val, u16 len)
191 {
192 	int ret, i;
193 	u16 mlen = sizeof(reg) + len;
194 	u8 mbuf[sizeof(reg) + IQS5XX_WR_BYTES_MAX];
195 
196 	if (len > IQS5XX_WR_BYTES_MAX)
197 		return -EINVAL;
198 
199 	put_unaligned_be16(reg, mbuf);
200 	memcpy(mbuf + sizeof(reg), val, len);
201 
202 	/*
203 	 * The first addressing attempt outside of a communication window fails
204 	 * and must be retried, after which the device clock stretches until it
205 	 * is available.
206 	 */
207 	for (i = 0; i < IQS5XX_NUM_RETRIES; i++) {
208 		ret = i2c_master_send(client, mbuf, mlen);
209 		if (ret == mlen)
210 			return 0;
211 
212 		usleep_range(200, 300);
213 	}
214 
215 	if (ret >= 0)
216 		ret = -EIO;
217 
218 	dev_err(&client->dev, "Failed to write to address 0x%04X: %d\n",
219 		reg, ret);
220 
221 	return ret;
222 }
223 
224 static int iqs5xx_write_word(struct i2c_client *client, u16 reg, u16 val)
225 {
226 	__be16 val_buf = cpu_to_be16(val);
227 
228 	return iqs5xx_write_burst(client, reg, &val_buf, sizeof(val_buf));
229 }
230 
231 static int iqs5xx_write_byte(struct i2c_client *client, u16 reg, u8 val)
232 {
233 	return iqs5xx_write_burst(client, reg, &val, sizeof(val));
234 }
235 
236 static void iqs5xx_reset(struct i2c_client *client)
237 {
238 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
239 
240 	gpiod_set_value_cansleep(iqs5xx->reset_gpio, 1);
241 	usleep_range(200, 300);
242 
243 	gpiod_set_value_cansleep(iqs5xx->reset_gpio, 0);
244 }
245 
246 static int iqs5xx_bl_cmd(struct i2c_client *client, u8 bl_cmd, u16 bl_addr)
247 {
248 	struct i2c_msg msg;
249 	int ret;
250 	u8 mbuf[sizeof(bl_cmd) + sizeof(bl_addr)];
251 
252 	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
253 	msg.flags = 0;
254 	msg.len = sizeof(bl_cmd);
255 	msg.buf = mbuf;
256 
257 	*mbuf = bl_cmd;
258 
259 	switch (bl_cmd) {
260 	case IQS5XX_BL_CMD_VER:
261 	case IQS5XX_BL_CMD_CRC:
262 	case IQS5XX_BL_CMD_EXEC:
263 		break;
264 	case IQS5XX_BL_CMD_READ:
265 		msg.len += sizeof(bl_addr);
266 		put_unaligned_be16(bl_addr, mbuf + sizeof(bl_cmd));
267 		break;
268 	default:
269 		return -EINVAL;
270 	}
271 
272 	ret = i2c_transfer(client->adapter, &msg, 1);
273 	if (ret != 1)
274 		goto msg_fail;
275 
276 	switch (bl_cmd) {
277 	case IQS5XX_BL_CMD_VER:
278 		msg.len = sizeof(u16);
279 		break;
280 	case IQS5XX_BL_CMD_CRC:
281 		msg.len = sizeof(u8);
282 		/*
283 		 * This delay saves the bus controller the trouble of having to
284 		 * tolerate a relatively long clock-stretching period while the
285 		 * CRC is calculated.
286 		 */
287 		msleep(50);
288 		break;
289 	case IQS5XX_BL_CMD_EXEC:
290 		usleep_range(10000, 10100);
291 		fallthrough;
292 	default:
293 		return 0;
294 	}
295 
296 	msg.flags = I2C_M_RD;
297 
298 	ret = i2c_transfer(client->adapter, &msg, 1);
299 	if (ret != 1)
300 		goto msg_fail;
301 
302 	if (bl_cmd == IQS5XX_BL_CMD_VER &&
303 	    get_unaligned_be16(mbuf) != IQS5XX_BL_ID) {
304 		dev_err(&client->dev, "Unrecognized bootloader ID: 0x%04X\n",
305 			get_unaligned_be16(mbuf));
306 		return -EINVAL;
307 	}
308 
309 	if (bl_cmd == IQS5XX_BL_CMD_CRC && *mbuf != IQS5XX_BL_CRC_PASS) {
310 		dev_err(&client->dev, "Bootloader CRC failed\n");
311 		return -EIO;
312 	}
313 
314 	return 0;
315 
316 msg_fail:
317 	if (ret >= 0)
318 		ret = -EIO;
319 
320 	if (bl_cmd != IQS5XX_BL_CMD_VER)
321 		dev_err(&client->dev,
322 			"Unsuccessful bootloader command 0x%02X: %d\n",
323 			bl_cmd, ret);
324 
325 	return ret;
326 }
327 
328 static int iqs5xx_bl_open(struct i2c_client *client)
329 {
330 	int error, i, j;
331 
332 	/*
333 	 * The device opens a bootloader polling window for 2 ms following the
334 	 * release of reset. If the host cannot establish communication during
335 	 * this time frame, it must cycle reset again.
336 	 */
337 	for (i = 0; i < IQS5XX_BL_ATTEMPTS; i++) {
338 		iqs5xx_reset(client);
339 		usleep_range(350, 400);
340 
341 		for (j = 0; j < IQS5XX_NUM_RETRIES; j++) {
342 			error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
343 			if (!error)
344 				usleep_range(10000, 10100);
345 			else if (error != -EINVAL)
346 				continue;
347 
348 			return error;
349 		}
350 	}
351 
352 	dev_err(&client->dev, "Failed to open bootloader: %d\n", error);
353 
354 	return error;
355 }
356 
357 static int iqs5xx_bl_write(struct i2c_client *client,
358 			   u16 bl_addr, u8 *pmap_data, u16 pmap_len)
359 {
360 	struct i2c_msg msg;
361 	int ret, i;
362 	u8 mbuf[sizeof(bl_addr) + IQS5XX_BL_BLK_LEN_MAX];
363 
364 	if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
365 		return -EINVAL;
366 
367 	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
368 	msg.flags = 0;
369 	msg.len = sizeof(mbuf);
370 	msg.buf = mbuf;
371 
372 	for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
373 		put_unaligned_be16(bl_addr + i, mbuf);
374 		memcpy(mbuf + sizeof(bl_addr), pmap_data + i,
375 		       sizeof(mbuf) - sizeof(bl_addr));
376 
377 		ret = i2c_transfer(client->adapter, &msg, 1);
378 		if (ret != 1)
379 			goto msg_fail;
380 
381 		usleep_range(10000, 10100);
382 	}
383 
384 	return 0;
385 
386 msg_fail:
387 	if (ret >= 0)
388 		ret = -EIO;
389 
390 	dev_err(&client->dev, "Failed to write block at address 0x%04X: %d\n",
391 		bl_addr + i, ret);
392 
393 	return ret;
394 }
395 
396 static int iqs5xx_bl_verify(struct i2c_client *client,
397 			    u16 bl_addr, u8 *pmap_data, u16 pmap_len)
398 {
399 	struct i2c_msg msg;
400 	int ret, i;
401 	u8 bl_data[IQS5XX_BL_BLK_LEN_MAX];
402 
403 	if (pmap_len % IQS5XX_BL_BLK_LEN_MAX)
404 		return -EINVAL;
405 
406 	msg.addr = client->addr ^ IQS5XX_BL_ADDR_MASK;
407 	msg.flags = I2C_M_RD;
408 	msg.len = sizeof(bl_data);
409 	msg.buf = bl_data;
410 
411 	for (i = 0; i < pmap_len; i += IQS5XX_BL_BLK_LEN_MAX) {
412 		ret = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_READ, bl_addr + i);
413 		if (ret)
414 			return ret;
415 
416 		ret = i2c_transfer(client->adapter, &msg, 1);
417 		if (ret != 1)
418 			goto msg_fail;
419 
420 		if (memcmp(bl_data, pmap_data + i, sizeof(bl_data))) {
421 			dev_err(&client->dev,
422 				"Failed to verify block at address 0x%04X\n",
423 				bl_addr + i);
424 			return -EIO;
425 		}
426 	}
427 
428 	return 0;
429 
430 msg_fail:
431 	if (ret >= 0)
432 		ret = -EIO;
433 
434 	dev_err(&client->dev, "Failed to read block at address 0x%04X: %d\n",
435 		bl_addr + i, ret);
436 
437 	return ret;
438 }
439 
440 static int iqs5xx_set_state(struct i2c_client *client, u8 state)
441 {
442 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
443 	int error1, error2;
444 
445 	if (!iqs5xx->dev_id_info.bl_status)
446 		return 0;
447 
448 	mutex_lock(&iqs5xx->lock);
449 
450 	/*
451 	 * Addressing the device outside of a communication window prompts it
452 	 * to assert the RDY output, so disable the interrupt line to prevent
453 	 * the handler from servicing a false interrupt.
454 	 */
455 	disable_irq(client->irq);
456 
457 	error1 = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL1, state);
458 	error2 = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
459 
460 	usleep_range(50, 100);
461 	enable_irq(client->irq);
462 
463 	mutex_unlock(&iqs5xx->lock);
464 
465 	if (error1)
466 		return error1;
467 
468 	return error2;
469 }
470 
471 static int iqs5xx_open(struct input_dev *input)
472 {
473 	struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
474 
475 	return iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
476 }
477 
478 static void iqs5xx_close(struct input_dev *input)
479 {
480 	struct iqs5xx_private *iqs5xx = input_get_drvdata(input);
481 
482 	iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
483 }
484 
485 static int iqs5xx_axis_init(struct i2c_client *client)
486 {
487 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
488 	struct touchscreen_properties *prop = &iqs5xx->prop;
489 	struct input_dev *input = iqs5xx->input;
490 	u16 max_x, max_y;
491 	int error;
492 
493 	if (!input) {
494 		input = devm_input_allocate_device(&client->dev);
495 		if (!input)
496 			return -ENOMEM;
497 
498 		input->name = client->name;
499 		input->id.bustype = BUS_I2C;
500 		input->open = iqs5xx_open;
501 		input->close = iqs5xx_close;
502 
503 		input_set_drvdata(input, iqs5xx);
504 		iqs5xx->input = input;
505 	}
506 
507 	error = iqs5xx_read_word(client, IQS5XX_X_RES, &max_x);
508 	if (error)
509 		return error;
510 
511 	error = iqs5xx_read_word(client, IQS5XX_Y_RES, &max_y);
512 	if (error)
513 		return error;
514 
515 	input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0);
516 	input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0);
517 	input_set_abs_params(input, ABS_MT_PRESSURE, 0, U16_MAX, 0, 0);
518 
519 	touchscreen_parse_properties(input, true, prop);
520 
521 	/*
522 	 * The device reserves 0xFFFF for coordinates that correspond to slots
523 	 * which are not in a state of touch.
524 	 */
525 	if (prop->max_x >= U16_MAX || prop->max_y >= U16_MAX) {
526 		dev_err(&client->dev, "Invalid touchscreen size: %u*%u\n",
527 			prop->max_x, prop->max_y);
528 		return -EINVAL;
529 	}
530 
531 	if (prop->max_x != max_x) {
532 		error = iqs5xx_write_word(client, IQS5XX_X_RES, prop->max_x);
533 		if (error)
534 			return error;
535 	}
536 
537 	if (prop->max_y != max_y) {
538 		error = iqs5xx_write_word(client, IQS5XX_Y_RES, prop->max_y);
539 		if (error)
540 			return error;
541 	}
542 
543 	error = input_mt_init_slots(input, IQS5XX_NUM_CONTACTS,
544 				    INPUT_MT_DIRECT);
545 	if (error)
546 		dev_err(&client->dev, "Failed to initialize slots: %d\n",
547 			error);
548 
549 	return error;
550 }
551 
552 static int iqs5xx_dev_init(struct i2c_client *client)
553 {
554 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
555 	struct iqs5xx_dev_id_info *dev_id_info;
556 	int error;
557 	u8 buf[sizeof(*dev_id_info) + 1];
558 
559 	error = iqs5xx_read_burst(client, IQS5XX_PROD_NUM,
560 				  &buf[1], sizeof(*dev_id_info));
561 	if (error)
562 		return iqs5xx_bl_open(client);
563 
564 	/*
565 	 * A000 and B000 devices use 8-bit and 16-bit addressing, respectively.
566 	 * Querying an A000 device's version information with 16-bit addressing
567 	 * gives the appearance that the data is shifted by one byte; a nonzero
568 	 * leading array element suggests this could be the case (in which case
569 	 * the missing zero is prepended).
570 	 */
571 	buf[0] = 0;
572 	dev_id_info = (struct iqs5xx_dev_id_info *)&buf[buf[1] ? 0 : 1];
573 
574 	switch (be16_to_cpu(dev_id_info->prod_num)) {
575 	case IQS5XX_PROD_NUM_IQS550:
576 	case IQS5XX_PROD_NUM_IQS572:
577 	case IQS5XX_PROD_NUM_IQS525:
578 		break;
579 	default:
580 		dev_err(&client->dev, "Unrecognized product number: %u\n",
581 			be16_to_cpu(dev_id_info->prod_num));
582 		return -EINVAL;
583 	}
584 
585 	/*
586 	 * With the product number recognized yet shifted by one byte, open the
587 	 * bootloader and wait for user space to convert the A000 device into a
588 	 * B000 device via new firmware.
589 	 */
590 	if (buf[1]) {
591 		dev_err(&client->dev, "Opening bootloader for A000 device\n");
592 		return iqs5xx_bl_open(client);
593 	}
594 
595 	error = iqs5xx_read_burst(client, IQS5XX_EXP_FILE,
596 				  iqs5xx->exp_file, sizeof(iqs5xx->exp_file));
597 	if (error)
598 		return error;
599 
600 	error = iqs5xx_axis_init(client);
601 	if (error)
602 		return error;
603 
604 	error = iqs5xx_write_byte(client, IQS5XX_SYS_CTRL0, IQS5XX_ACK_RESET);
605 	if (error)
606 		return error;
607 
608 	error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG0,
609 				  IQS5XX_SETUP_COMPLETE | IQS5XX_WDT |
610 				  IQS5XX_ALP_REATI | IQS5XX_REATI);
611 	if (error)
612 		return error;
613 
614 	error = iqs5xx_write_byte(client, IQS5XX_SYS_CFG1,
615 				  IQS5XX_TP_EVENT | IQS5XX_EVENT_MODE);
616 	if (error)
617 		return error;
618 
619 	error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
620 	if (error)
621 		return error;
622 
623 	iqs5xx->dev_id_info = *dev_id_info;
624 
625 	/*
626 	 * The following delay allows ATI to complete before the open and close
627 	 * callbacks are free to elicit I2C communication. Any attempts to read
628 	 * from or write to the device during this time may face extended clock
629 	 * stretching and prompt the I2C controller to report an error.
630 	 */
631 	msleep(250);
632 
633 	return 0;
634 }
635 
636 static irqreturn_t iqs5xx_irq(int irq, void *data)
637 {
638 	struct iqs5xx_private *iqs5xx = data;
639 	struct iqs5xx_status status;
640 	struct i2c_client *client = iqs5xx->client;
641 	struct input_dev *input = iqs5xx->input;
642 	int error, i;
643 
644 	/*
645 	 * This check is purely a precaution, as the device does not assert the
646 	 * RDY output during bootloader mode. If the device operates outside of
647 	 * bootloader mode, the input device is guaranteed to be allocated.
648 	 */
649 	if (!iqs5xx->dev_id_info.bl_status)
650 		return IRQ_NONE;
651 
652 	error = iqs5xx_read_burst(client, IQS5XX_SYS_INFO0,
653 				  &status, sizeof(status));
654 	if (error)
655 		return IRQ_NONE;
656 
657 	if (status.sys_info[0] & IQS5XX_SHOW_RESET) {
658 		dev_err(&client->dev, "Unexpected device reset\n");
659 
660 		error = iqs5xx_dev_init(client);
661 		if (error) {
662 			dev_err(&client->dev,
663 				"Failed to re-initialize device: %d\n", error);
664 			return IRQ_NONE;
665 		}
666 
667 		return IRQ_HANDLED;
668 	}
669 
670 	for (i = 0; i < ARRAY_SIZE(status.touch_data); i++) {
671 		struct iqs5xx_touch_data *touch_data = &status.touch_data[i];
672 		u16 pressure = be16_to_cpu(touch_data->strength);
673 
674 		input_mt_slot(input, i);
675 		if (input_mt_report_slot_state(input, MT_TOOL_FINGER,
676 					       pressure != 0)) {
677 			touchscreen_report_pos(input, &iqs5xx->prop,
678 					       be16_to_cpu(touch_data->abs_x),
679 					       be16_to_cpu(touch_data->abs_y),
680 					       true);
681 			input_report_abs(input, ABS_MT_PRESSURE, pressure);
682 		}
683 	}
684 
685 	input_mt_sync_frame(input);
686 	input_sync(input);
687 
688 	error = iqs5xx_write_byte(client, IQS5XX_END_COMM, 0);
689 	if (error)
690 		return IRQ_NONE;
691 
692 	/*
693 	 * Once the communication window is closed, a small delay is added to
694 	 * ensure the device's RDY output has been deasserted by the time the
695 	 * interrupt handler returns.
696 	 */
697 	usleep_range(50, 100);
698 
699 	return IRQ_HANDLED;
700 }
701 
702 static int iqs5xx_fw_file_parse(struct i2c_client *client,
703 				const char *fw_file, u8 *pmap)
704 {
705 	const struct firmware *fw;
706 	struct iqs5xx_ihex_rec *rec;
707 	size_t pos = 0;
708 	int error, i;
709 	u16 rec_num = 1;
710 	u16 rec_addr;
711 	u8 rec_len, rec_type, rec_chksm, chksm;
712 	u8 rec_hdr[IQS5XX_REC_HDR_LEN];
713 	u8 rec_data[IQS5XX_REC_LEN_MAX];
714 
715 	/*
716 	 * Firmware exported from the vendor's configuration tool deviates from
717 	 * standard ihex as follows: (1) the checksum for records corresponding
718 	 * to user-exported settings is not recalculated, and (2) an address of
719 	 * 0xFFFF is used for the EOF record.
720 	 *
721 	 * Because the ihex2fw tool tolerates neither (1) nor (2), the slightly
722 	 * nonstandard ihex firmware is parsed directly by the driver.
723 	 */
724 	error = request_firmware(&fw, fw_file, &client->dev);
725 	if (error) {
726 		dev_err(&client->dev, "Failed to request firmware %s: %d\n",
727 			fw_file, error);
728 		return error;
729 	}
730 
731 	do {
732 		if (pos + sizeof(*rec) > fw->size) {
733 			dev_err(&client->dev, "Insufficient firmware size\n");
734 			error = -EINVAL;
735 			break;
736 		}
737 		rec = (struct iqs5xx_ihex_rec *)(fw->data + pos);
738 		pos += sizeof(*rec);
739 
740 		if (rec->start != ':') {
741 			dev_err(&client->dev, "Invalid start at record %u\n",
742 				rec_num);
743 			error = -EINVAL;
744 			break;
745 		}
746 
747 		error = hex2bin(rec_hdr, rec->len, sizeof(rec_hdr));
748 		if (error) {
749 			dev_err(&client->dev, "Invalid header at record %u\n",
750 				rec_num);
751 			break;
752 		}
753 
754 		rec_len = *rec_hdr;
755 		rec_addr = get_unaligned_be16(rec_hdr + sizeof(rec_len));
756 		rec_type = *(rec_hdr + sizeof(rec_len) + sizeof(rec_addr));
757 
758 		if (pos + rec_len * 2 > fw->size) {
759 			dev_err(&client->dev, "Insufficient firmware size\n");
760 			error = -EINVAL;
761 			break;
762 		}
763 		pos += (rec_len * 2);
764 
765 		error = hex2bin(rec_data, rec->data, rec_len);
766 		if (error) {
767 			dev_err(&client->dev, "Invalid data at record %u\n",
768 				rec_num);
769 			break;
770 		}
771 
772 		error = hex2bin(&rec_chksm,
773 				rec->data + rec_len * 2, sizeof(rec_chksm));
774 		if (error) {
775 			dev_err(&client->dev, "Invalid checksum at record %u\n",
776 				rec_num);
777 			break;
778 		}
779 
780 		chksm = 0;
781 		for (i = 0; i < sizeof(rec_hdr); i++)
782 			chksm += rec_hdr[i];
783 		for (i = 0; i < rec_len; i++)
784 			chksm += rec_data[i];
785 		chksm = ~chksm + 1;
786 
787 		if (chksm != rec_chksm && rec_addr < IQS5XX_CSTM) {
788 			dev_err(&client->dev,
789 				"Incorrect checksum at record %u\n",
790 				rec_num);
791 			error = -EINVAL;
792 			break;
793 		}
794 
795 		switch (rec_type) {
796 		case IQS5XX_REC_TYPE_DATA:
797 			if (rec_addr < IQS5XX_CHKSM ||
798 			    rec_addr > IQS5XX_PMAP_END) {
799 				dev_err(&client->dev,
800 					"Invalid address at record %u\n",
801 					rec_num);
802 				error = -EINVAL;
803 			} else {
804 				memcpy(pmap + rec_addr - IQS5XX_CHKSM,
805 				       rec_data, rec_len);
806 			}
807 			break;
808 		case IQS5XX_REC_TYPE_EOF:
809 			break;
810 		default:
811 			dev_err(&client->dev, "Invalid type at record %u\n",
812 				rec_num);
813 			error = -EINVAL;
814 		}
815 
816 		if (error)
817 			break;
818 
819 		rec_num++;
820 		while (pos < fw->size) {
821 			if (*(fw->data + pos) == ':')
822 				break;
823 			pos++;
824 		}
825 	} while (rec_type != IQS5XX_REC_TYPE_EOF);
826 
827 	release_firmware(fw);
828 
829 	return error;
830 }
831 
832 static int iqs5xx_fw_file_write(struct i2c_client *client, const char *fw_file)
833 {
834 	struct iqs5xx_private *iqs5xx = i2c_get_clientdata(client);
835 	int error, error_init = 0;
836 	u8 *pmap;
837 
838 	pmap = kzalloc(IQS5XX_PMAP_LEN, GFP_KERNEL);
839 	if (!pmap)
840 		return -ENOMEM;
841 
842 	error = iqs5xx_fw_file_parse(client, fw_file, pmap);
843 	if (error)
844 		goto err_kfree;
845 
846 	mutex_lock(&iqs5xx->lock);
847 
848 	/*
849 	 * Disable the interrupt line in case the first attempt(s) to enter the
850 	 * bootloader don't happen quickly enough, in which case the device may
851 	 * assert the RDY output until the next attempt.
852 	 */
853 	disable_irq(client->irq);
854 
855 	iqs5xx->dev_id_info.bl_status = 0;
856 
857 	error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_VER, 0);
858 	if (error) {
859 		error = iqs5xx_bl_open(client);
860 		if (error)
861 			goto err_reset;
862 	}
863 
864 	error = iqs5xx_bl_write(client, IQS5XX_CHKSM, pmap, IQS5XX_PMAP_LEN);
865 	if (error)
866 		goto err_reset;
867 
868 	error = iqs5xx_bl_cmd(client, IQS5XX_BL_CMD_CRC, 0);
869 	if (error)
870 		goto err_reset;
871 
872 	error = iqs5xx_bl_verify(client, IQS5XX_CSTM,
873 				 pmap + IQS5XX_CHKSM_LEN + IQS5XX_APP_LEN,
874 				 IQS5XX_CSTM_LEN);
875 
876 err_reset:
877 	iqs5xx_reset(client);
878 	usleep_range(15000, 15100);
879 
880 	error_init = iqs5xx_dev_init(client);
881 	if (!iqs5xx->dev_id_info.bl_status)
882 		error_init = error_init ? : -EINVAL;
883 
884 	enable_irq(client->irq);
885 
886 	mutex_unlock(&iqs5xx->lock);
887 
888 err_kfree:
889 	kfree(pmap);
890 
891 	return error ? : error_init;
892 }
893 
894 static ssize_t fw_file_store(struct device *dev,
895 			     struct device_attribute *attr, const char *buf,
896 			     size_t count)
897 {
898 	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
899 	struct i2c_client *client = iqs5xx->client;
900 	size_t len = count;
901 	bool input_reg = !iqs5xx->input;
902 	char fw_file[IQS5XX_FW_FILE_LEN + 1];
903 	int error;
904 
905 	if (!len)
906 		return -EINVAL;
907 
908 	if (buf[len - 1] == '\n')
909 		len--;
910 
911 	if (len > IQS5XX_FW_FILE_LEN)
912 		return -ENAMETOOLONG;
913 
914 	memcpy(fw_file, buf, len);
915 	fw_file[len] = '\0';
916 
917 	error = iqs5xx_fw_file_write(client, fw_file);
918 	if (error)
919 		return error;
920 
921 	/*
922 	 * If the input device was not allocated already, it is guaranteed to
923 	 * be allocated by this point and can finally be registered.
924 	 */
925 	if (input_reg) {
926 		error = input_register_device(iqs5xx->input);
927 		if (error) {
928 			dev_err(&client->dev,
929 				"Failed to register device: %d\n",
930 				error);
931 			return error;
932 		}
933 	}
934 
935 	return count;
936 }
937 
938 static ssize_t fw_info_show(struct device *dev,
939 			    struct device_attribute *attr, char *buf)
940 {
941 	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
942 
943 	if (!iqs5xx->dev_id_info.bl_status)
944 		return -ENODATA;
945 
946 	return scnprintf(buf, PAGE_SIZE, "%u.%u.%u.%u:%u.%u\n",
947 			 be16_to_cpu(iqs5xx->dev_id_info.prod_num),
948 			 be16_to_cpu(iqs5xx->dev_id_info.proj_num),
949 			 iqs5xx->dev_id_info.major_ver,
950 			 iqs5xx->dev_id_info.minor_ver,
951 			 iqs5xx->exp_file[0], iqs5xx->exp_file[1]);
952 }
953 
954 static DEVICE_ATTR_WO(fw_file);
955 static DEVICE_ATTR_RO(fw_info);
956 
957 static struct attribute *iqs5xx_attrs[] = {
958 	&dev_attr_fw_file.attr,
959 	&dev_attr_fw_info.attr,
960 	NULL,
961 };
962 
963 static umode_t iqs5xx_attr_is_visible(struct kobject *kobj,
964 				      struct attribute *attr, int i)
965 {
966 	struct device *dev = kobj_to_dev(kobj);
967 	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
968 
969 	if (attr == &dev_attr_fw_file.attr &&
970 	    (iqs5xx->dev_id_info.bl_status == IQS5XX_BL_STATUS_NONE ||
971 	    !iqs5xx->reset_gpio))
972 		return 0;
973 
974 	return attr->mode;
975 }
976 
977 static const struct attribute_group iqs5xx_attr_group = {
978 	.is_visible = iqs5xx_attr_is_visible,
979 	.attrs = iqs5xx_attrs,
980 };
981 
982 static int iqs5xx_suspend(struct device *dev)
983 {
984 	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
985 	struct input_dev *input = iqs5xx->input;
986 	int error = 0;
987 
988 	if (!input || device_may_wakeup(dev))
989 		return error;
990 
991 	mutex_lock(&input->mutex);
992 
993 	if (input_device_enabled(input))
994 		error = iqs5xx_set_state(iqs5xx->client, IQS5XX_SUSPEND);
995 
996 	mutex_unlock(&input->mutex);
997 
998 	return error;
999 }
1000 
1001 static int iqs5xx_resume(struct device *dev)
1002 {
1003 	struct iqs5xx_private *iqs5xx = dev_get_drvdata(dev);
1004 	struct input_dev *input = iqs5xx->input;
1005 	int error = 0;
1006 
1007 	if (!input || device_may_wakeup(dev))
1008 		return error;
1009 
1010 	mutex_lock(&input->mutex);
1011 
1012 	if (input_device_enabled(input))
1013 		error = iqs5xx_set_state(iqs5xx->client, IQS5XX_RESUME);
1014 
1015 	mutex_unlock(&input->mutex);
1016 
1017 	return error;
1018 }
1019 
1020 static DEFINE_SIMPLE_DEV_PM_OPS(iqs5xx_pm, iqs5xx_suspend, iqs5xx_resume);
1021 
1022 static int iqs5xx_probe(struct i2c_client *client)
1023 {
1024 	struct iqs5xx_private *iqs5xx;
1025 	int error;
1026 
1027 	iqs5xx = devm_kzalloc(&client->dev, sizeof(*iqs5xx), GFP_KERNEL);
1028 	if (!iqs5xx)
1029 		return -ENOMEM;
1030 
1031 	i2c_set_clientdata(client, iqs5xx);
1032 	iqs5xx->client = client;
1033 
1034 	iqs5xx->reset_gpio = devm_gpiod_get_optional(&client->dev,
1035 						     "reset", GPIOD_OUT_LOW);
1036 	if (IS_ERR(iqs5xx->reset_gpio)) {
1037 		error = PTR_ERR(iqs5xx->reset_gpio);
1038 		dev_err(&client->dev, "Failed to request GPIO: %d\n", error);
1039 		return error;
1040 	}
1041 
1042 	mutex_init(&iqs5xx->lock);
1043 
1044 	error = iqs5xx_dev_init(client);
1045 	if (error)
1046 		return error;
1047 
1048 	error = devm_request_threaded_irq(&client->dev, client->irq,
1049 					  NULL, iqs5xx_irq, IRQF_ONESHOT,
1050 					  client->name, iqs5xx);
1051 	if (error) {
1052 		dev_err(&client->dev, "Failed to request IRQ: %d\n", error);
1053 		return error;
1054 	}
1055 
1056 	error = devm_device_add_group(&client->dev, &iqs5xx_attr_group);
1057 	if (error) {
1058 		dev_err(&client->dev, "Failed to add attributes: %d\n", error);
1059 		return error;
1060 	}
1061 
1062 	if (iqs5xx->input) {
1063 		error = input_register_device(iqs5xx->input);
1064 		if (error)
1065 			dev_err(&client->dev,
1066 				"Failed to register device: %d\n",
1067 				error);
1068 	}
1069 
1070 	return error;
1071 }
1072 
1073 static const struct i2c_device_id iqs5xx_id[] = {
1074 	{ "iqs550", 0 },
1075 	{ "iqs572", 1 },
1076 	{ "iqs525", 2 },
1077 	{ }
1078 };
1079 MODULE_DEVICE_TABLE(i2c, iqs5xx_id);
1080 
1081 static const struct of_device_id iqs5xx_of_match[] = {
1082 	{ .compatible = "azoteq,iqs550" },
1083 	{ .compatible = "azoteq,iqs572" },
1084 	{ .compatible = "azoteq,iqs525" },
1085 	{ }
1086 };
1087 MODULE_DEVICE_TABLE(of, iqs5xx_of_match);
1088 
1089 static struct i2c_driver iqs5xx_i2c_driver = {
1090 	.driver = {
1091 		.name		= "iqs5xx",
1092 		.of_match_table	= iqs5xx_of_match,
1093 		.pm		= pm_sleep_ptr(&iqs5xx_pm),
1094 	},
1095 	.id_table	= iqs5xx_id,
1096 	.probe		= iqs5xx_probe,
1097 };
1098 module_i2c_driver(iqs5xx_i2c_driver);
1099 
1100 MODULE_AUTHOR("Jeff LaBundy <jeff@labundy.com>");
1101 MODULE_DESCRIPTION("Azoteq IQS550/572/525 Trackpad/Touchscreen Controller");
1102 MODULE_LICENSE("GPL");
1103