linux/drivers/input/touchscreen/atmel_mxt_ts.c
<<
>>
Prefs
   1/*
   2 * Atmel maXTouch Touchscreen driver
   3 *
   4 * Copyright (C) 2010 Samsung Electronics Co.Ltd
   5 * Copyright (C) 2011-2014 Atmel Corporation
   6 * Copyright (C) 2012 Google, Inc.
   7 * Copyright (C) 2016 Zodiac Inflight Innovations
   8 *
   9 * Author: Joonyoung Shim <jy0922.shim@samsung.com>
  10 *
  11 * This program is free software; you can redistribute  it and/or modify it
  12 * under  the terms of  the GNU General  Public License as published by the
  13 * Free Software Foundation;  either version 2 of the  License, or (at your
  14 * option) any later version.
  15 *
  16 */
  17
  18#include <linux/acpi.h>
  19#include <linux/dmi.h>
  20#include <linux/module.h>
  21#include <linux/init.h>
  22#include <linux/completion.h>
  23#include <linux/delay.h>
  24#include <linux/firmware.h>
  25#include <linux/i2c.h>
  26#include <linux/input/mt.h>
  27#include <linux/interrupt.h>
  28#include <linux/of.h>
  29#include <linux/property.h>
  30#include <linux/slab.h>
  31#include <linux/gpio/consumer.h>
  32#include <linux/property.h>
  33#include <asm/unaligned.h>
  34#include <media/v4l2-device.h>
  35#include <media/v4l2-ioctl.h>
  36#include <media/videobuf2-v4l2.h>
  37#include <media/videobuf2-vmalloc.h>
  38
  39/* Firmware files */
  40#define MXT_FW_NAME             "maxtouch.fw"
  41#define MXT_CFG_NAME            "maxtouch.cfg"
  42#define MXT_CFG_MAGIC           "OBP_RAW V1"
  43
  44/* Registers */
  45#define MXT_OBJECT_START        0x07
  46#define MXT_OBJECT_SIZE         6
  47#define MXT_INFO_CHECKSUM_SIZE  3
  48#define MXT_MAX_BLOCK_WRITE     256
  49
  50/* Object types */
  51#define MXT_DEBUG_DIAGNOSTIC_T37        37
  52#define MXT_GEN_MESSAGE_T5              5
  53#define MXT_GEN_COMMAND_T6              6
  54#define MXT_GEN_POWER_T7                7
  55#define MXT_GEN_ACQUIRE_T8              8
  56#define MXT_GEN_DATASOURCE_T53          53
  57#define MXT_TOUCH_MULTI_T9              9
  58#define MXT_TOUCH_KEYARRAY_T15          15
  59#define MXT_TOUCH_PROXIMITY_T23         23
  60#define MXT_TOUCH_PROXKEY_T52           52
  61#define MXT_PROCI_GRIPFACE_T20          20
  62#define MXT_PROCG_NOISE_T22             22
  63#define MXT_PROCI_ONETOUCH_T24          24
  64#define MXT_PROCI_TWOTOUCH_T27          27
  65#define MXT_PROCI_GRIP_T40              40
  66#define MXT_PROCI_PALM_T41              41
  67#define MXT_PROCI_TOUCHSUPPRESSION_T42  42
  68#define MXT_PROCI_STYLUS_T47            47
  69#define MXT_PROCG_NOISESUPPRESSION_T48  48
  70#define MXT_SPT_COMMSCONFIG_T18         18
  71#define MXT_SPT_GPIOPWM_T19             19
  72#define MXT_SPT_SELFTEST_T25            25
  73#define MXT_SPT_CTECONFIG_T28           28
  74#define MXT_SPT_USERDATA_T38            38
  75#define MXT_SPT_DIGITIZER_T43           43
  76#define MXT_SPT_MESSAGECOUNT_T44        44
  77#define MXT_SPT_CTECONFIG_T46           46
  78#define MXT_TOUCH_MULTITOUCHSCREEN_T100 100
  79
  80/* MXT_GEN_MESSAGE_T5 object */
  81#define MXT_RPTID_NOMSG         0xff
  82
  83/* MXT_GEN_COMMAND_T6 field */
  84#define MXT_COMMAND_RESET       0
  85#define MXT_COMMAND_BACKUPNV    1
  86#define MXT_COMMAND_CALIBRATE   2
  87#define MXT_COMMAND_REPORTALL   3
  88#define MXT_COMMAND_DIAGNOSTIC  5
  89
  90/* Define for T6 status byte */
  91#define MXT_T6_STATUS_RESET     (1 << 7)
  92#define MXT_T6_STATUS_OFL       (1 << 6)
  93#define MXT_T6_STATUS_SIGERR    (1 << 5)
  94#define MXT_T6_STATUS_CAL       (1 << 4)
  95#define MXT_T6_STATUS_CFGERR    (1 << 3)
  96#define MXT_T6_STATUS_COMSERR   (1 << 2)
  97
  98/* MXT_GEN_POWER_T7 field */
  99struct t7_config {
 100        u8 idle;
 101        u8 active;
 102} __packed;
 103
 104#define MXT_POWER_CFG_RUN               0
 105#define MXT_POWER_CFG_DEEPSLEEP         1
 106
 107/* MXT_TOUCH_MULTI_T9 field */
 108#define MXT_T9_CTRL             0
 109#define MXT_T9_XSIZE            3
 110#define MXT_T9_YSIZE            4
 111#define MXT_T9_ORIENT           9
 112#define MXT_T9_RANGE            18
 113
 114/* MXT_TOUCH_MULTI_T9 status */
 115#define MXT_T9_UNGRIP           (1 << 0)
 116#define MXT_T9_SUPPRESS         (1 << 1)
 117#define MXT_T9_AMP              (1 << 2)
 118#define MXT_T9_VECTOR           (1 << 3)
 119#define MXT_T9_MOVE             (1 << 4)
 120#define MXT_T9_RELEASE          (1 << 5)
 121#define MXT_T9_PRESS            (1 << 6)
 122#define MXT_T9_DETECT           (1 << 7)
 123
 124struct t9_range {
 125        __le16 x;
 126        __le16 y;
 127} __packed;
 128
 129/* MXT_TOUCH_MULTI_T9 orient */
 130#define MXT_T9_ORIENT_SWITCH    (1 << 0)
 131#define MXT_T9_ORIENT_INVERTX   (1 << 1)
 132#define MXT_T9_ORIENT_INVERTY   (1 << 2)
 133
 134/* MXT_SPT_COMMSCONFIG_T18 */
 135#define MXT_COMMS_CTRL          0
 136#define MXT_COMMS_CMD           1
 137
 138/* MXT_DEBUG_DIAGNOSTIC_T37 */
 139#define MXT_DIAGNOSTIC_PAGEUP   0x01
 140#define MXT_DIAGNOSTIC_DELTAS   0x10
 141#define MXT_DIAGNOSTIC_REFS     0x11
 142#define MXT_DIAGNOSTIC_SIZE     128
 143
 144#define MXT_FAMILY_1386                 160
 145#define MXT1386_COLUMNS                 3
 146#define MXT1386_PAGES_PER_COLUMN        8
 147
 148struct t37_debug {
 149#ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
 150        u8 mode;
 151        u8 page;
 152        u8 data[MXT_DIAGNOSTIC_SIZE];
 153#endif
 154};
 155
 156/* Define for MXT_GEN_COMMAND_T6 */
 157#define MXT_BOOT_VALUE          0xa5
 158#define MXT_RESET_VALUE         0x01
 159#define MXT_BACKUP_VALUE        0x55
 160
 161/* T100 Multiple Touch Touchscreen */
 162#define MXT_T100_CTRL           0
 163#define MXT_T100_CFG1           1
 164#define MXT_T100_TCHAUX         3
 165#define MXT_T100_XSIZE          9
 166#define MXT_T100_XRANGE         13
 167#define MXT_T100_YSIZE          20
 168#define MXT_T100_YRANGE         24
 169
 170#define MXT_T100_CFG_SWITCHXY   BIT(5)
 171#define MXT_T100_CFG_INVERTY    BIT(6)
 172#define MXT_T100_CFG_INVERTX    BIT(7)
 173
 174#define MXT_T100_TCHAUX_VECT    BIT(0)
 175#define MXT_T100_TCHAUX_AMPL    BIT(1)
 176#define MXT_T100_TCHAUX_AREA    BIT(2)
 177
 178#define MXT_T100_DETECT         BIT(7)
 179#define MXT_T100_TYPE_MASK      0x70
 180
 181enum t100_type {
 182        MXT_T100_TYPE_FINGER            = 1,
 183        MXT_T100_TYPE_PASSIVE_STYLUS    = 2,
 184        MXT_T100_TYPE_HOVERING_FINGER   = 4,
 185        MXT_T100_TYPE_GLOVE             = 5,
 186        MXT_T100_TYPE_LARGE_TOUCH       = 6,
 187};
 188
 189#define MXT_DISTANCE_ACTIVE_TOUCH       0
 190#define MXT_DISTANCE_HOVERING           1
 191
 192#define MXT_TOUCH_MAJOR_DEFAULT         1
 193#define MXT_PRESSURE_DEFAULT            1
 194
 195/* Delay times */
 196#define MXT_BACKUP_TIME         50      /* msec */
 197#define MXT_RESET_TIME          200     /* msec */
 198#define MXT_RESET_TIMEOUT       3000    /* msec */
 199#define MXT_CRC_TIMEOUT         1000    /* msec */
 200#define MXT_FW_RESET_TIME       3000    /* msec */
 201#define MXT_FW_CHG_TIMEOUT      300     /* msec */
 202
 203/* Command to unlock bootloader */
 204#define MXT_UNLOCK_CMD_MSB      0xaa
 205#define MXT_UNLOCK_CMD_LSB      0xdc
 206
 207/* Bootloader mode status */
 208#define MXT_WAITING_BOOTLOAD_CMD        0xc0    /* valid 7 6 bit only */
 209#define MXT_WAITING_FRAME_DATA  0x80    /* valid 7 6 bit only */
 210#define MXT_FRAME_CRC_CHECK     0x02
 211#define MXT_FRAME_CRC_FAIL      0x03
 212#define MXT_FRAME_CRC_PASS      0x04
 213#define MXT_APP_CRC_FAIL        0x40    /* valid 7 8 bit only */
 214#define MXT_BOOT_STATUS_MASK    0x3f
 215#define MXT_BOOT_EXTENDED_ID    (1 << 5)
 216#define MXT_BOOT_ID_MASK        0x1f
 217
 218/* Touchscreen absolute values */
 219#define MXT_MAX_AREA            0xff
 220
 221#define MXT_PIXELS_PER_MM       20
 222
 223struct mxt_info {
 224        u8 family_id;
 225        u8 variant_id;
 226        u8 version;
 227        u8 build;
 228        u8 matrix_xsize;
 229        u8 matrix_ysize;
 230        u8 object_num;
 231};
 232
 233struct mxt_object {
 234        u8 type;
 235        u16 start_address;
 236        u8 size_minus_one;
 237        u8 instances_minus_one;
 238        u8 num_report_ids;
 239} __packed;
 240
 241struct mxt_dbg {
 242        u16 t37_address;
 243        u16 diag_cmd_address;
 244        struct t37_debug *t37_buf;
 245        unsigned int t37_pages;
 246        unsigned int t37_nodes;
 247
 248        struct v4l2_device v4l2;
 249        struct v4l2_pix_format format;
 250        struct video_device vdev;
 251        struct vb2_queue queue;
 252        struct mutex lock;
 253        int input;
 254};
 255
 256enum v4l_dbg_inputs {
 257        MXT_V4L_INPUT_DELTAS,
 258        MXT_V4L_INPUT_REFS,
 259        MXT_V4L_INPUT_MAX,
 260};
 261
 262static const struct v4l2_file_operations mxt_video_fops = {
 263        .owner = THIS_MODULE,
 264        .open = v4l2_fh_open,
 265        .release = vb2_fop_release,
 266        .unlocked_ioctl = video_ioctl2,
 267        .read = vb2_fop_read,
 268        .mmap = vb2_fop_mmap,
 269        .poll = vb2_fop_poll,
 270};
 271
 272enum mxt_suspend_mode {
 273        MXT_SUSPEND_DEEP_SLEEP  = 0,
 274        MXT_SUSPEND_T9_CTRL     = 1,
 275};
 276
 277/* Each client has this additional data */
 278struct mxt_data {
 279        struct i2c_client *client;
 280        struct input_dev *input_dev;
 281        char phys[64];          /* device physical location */
 282        struct mxt_object *object_table;
 283        struct mxt_info *info;
 284        void *raw_info_block;
 285        unsigned int irq;
 286        unsigned int max_x;
 287        unsigned int max_y;
 288        bool invertx;
 289        bool inverty;
 290        bool xy_switch;
 291        u8 xsize;
 292        u8 ysize;
 293        bool in_bootloader;
 294        u16 mem_size;
 295        u8 t100_aux_ampl;
 296        u8 t100_aux_area;
 297        u8 t100_aux_vect;
 298        u8 max_reportid;
 299        u32 config_crc;
 300        u32 info_crc;
 301        u8 bootloader_addr;
 302        u8 *msg_buf;
 303        u8 t6_status;
 304        bool update_input;
 305        u8 last_message_count;
 306        u8 num_touchids;
 307        u8 multitouch;
 308        struct t7_config t7_cfg;
 309        struct mxt_dbg dbg;
 310        struct gpio_desc *reset_gpio;
 311
 312        /* Cached parameters from object table */
 313        u16 T5_address;
 314        u8 T5_msg_size;
 315        u8 T6_reportid;
 316        u16 T6_address;
 317        u16 T7_address;
 318        u8 T9_reportid_min;
 319        u8 T9_reportid_max;
 320        u8 T19_reportid;
 321        u16 T44_address;
 322        u8 T100_reportid_min;
 323        u8 T100_reportid_max;
 324
 325        /* for fw update in bootloader */
 326        struct completion bl_completion;
 327
 328        /* for reset handling */
 329        struct completion reset_completion;
 330
 331        /* for config update handling */
 332        struct completion crc_completion;
 333
 334        u32 *t19_keymap;
 335        unsigned int t19_num_keys;
 336
 337        enum mxt_suspend_mode suspend_mode;
 338};
 339
 340struct mxt_vb2_buffer {
 341        struct vb2_buffer       vb;
 342        struct list_head        list;
 343};
 344
 345static size_t mxt_obj_size(const struct mxt_object *obj)
 346{
 347        return obj->size_minus_one + 1;
 348}
 349
 350static size_t mxt_obj_instances(const struct mxt_object *obj)
 351{
 352        return obj->instances_minus_one + 1;
 353}
 354
 355static bool mxt_object_readable(unsigned int type)
 356{
 357        switch (type) {
 358        case MXT_GEN_COMMAND_T6:
 359        case MXT_GEN_POWER_T7:
 360        case MXT_GEN_ACQUIRE_T8:
 361        case MXT_GEN_DATASOURCE_T53:
 362        case MXT_TOUCH_MULTI_T9:
 363        case MXT_TOUCH_KEYARRAY_T15:
 364        case MXT_TOUCH_PROXIMITY_T23:
 365        case MXT_TOUCH_PROXKEY_T52:
 366        case MXT_TOUCH_MULTITOUCHSCREEN_T100:
 367        case MXT_PROCI_GRIPFACE_T20:
 368        case MXT_PROCG_NOISE_T22:
 369        case MXT_PROCI_ONETOUCH_T24:
 370        case MXT_PROCI_TWOTOUCH_T27:
 371        case MXT_PROCI_GRIP_T40:
 372        case MXT_PROCI_PALM_T41:
 373        case MXT_PROCI_TOUCHSUPPRESSION_T42:
 374        case MXT_PROCI_STYLUS_T47:
 375        case MXT_PROCG_NOISESUPPRESSION_T48:
 376        case MXT_SPT_COMMSCONFIG_T18:
 377        case MXT_SPT_GPIOPWM_T19:
 378        case MXT_SPT_SELFTEST_T25:
 379        case MXT_SPT_CTECONFIG_T28:
 380        case MXT_SPT_USERDATA_T38:
 381        case MXT_SPT_DIGITIZER_T43:
 382        case MXT_SPT_CTECONFIG_T46:
 383                return true;
 384        default:
 385                return false;
 386        }
 387}
 388
 389static void mxt_dump_message(struct mxt_data *data, u8 *message)
 390{
 391        dev_dbg(&data->client->dev, "message: %*ph\n",
 392                data->T5_msg_size, message);
 393}
 394
 395static int mxt_wait_for_completion(struct mxt_data *data,
 396                                   struct completion *comp,
 397                                   unsigned int timeout_ms)
 398{
 399        struct device *dev = &data->client->dev;
 400        unsigned long timeout = msecs_to_jiffies(timeout_ms);
 401        long ret;
 402
 403        ret = wait_for_completion_interruptible_timeout(comp, timeout);
 404        if (ret < 0) {
 405                return ret;
 406        } else if (ret == 0) {
 407                dev_err(dev, "Wait for completion timed out.\n");
 408                return -ETIMEDOUT;
 409        }
 410        return 0;
 411}
 412
 413static int mxt_bootloader_read(struct mxt_data *data,
 414                               u8 *val, unsigned int count)
 415{
 416        int ret;
 417        struct i2c_msg msg;
 418
 419        msg.addr = data->bootloader_addr;
 420        msg.flags = data->client->flags & I2C_M_TEN;
 421        msg.flags |= I2C_M_RD;
 422        msg.len = count;
 423        msg.buf = val;
 424
 425        ret = i2c_transfer(data->client->adapter, &msg, 1);
 426        if (ret == 1) {
 427                ret = 0;
 428        } else {
 429                ret = ret < 0 ? ret : -EIO;
 430                dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
 431                        __func__, ret);
 432        }
 433
 434        return ret;
 435}
 436
 437static int mxt_bootloader_write(struct mxt_data *data,
 438                                const u8 * const val, unsigned int count)
 439{
 440        int ret;
 441        struct i2c_msg msg;
 442
 443        msg.addr = data->bootloader_addr;
 444        msg.flags = data->client->flags & I2C_M_TEN;
 445        msg.len = count;
 446        msg.buf = (u8 *)val;
 447
 448        ret = i2c_transfer(data->client->adapter, &msg, 1);
 449        if (ret == 1) {
 450                ret = 0;
 451        } else {
 452                ret = ret < 0 ? ret : -EIO;
 453                dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
 454                        __func__, ret);
 455        }
 456
 457        return ret;
 458}
 459
 460static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 461{
 462        u8 appmode = data->client->addr;
 463        u8 bootloader;
 464        u8 family_id = data->info ? data->info->family_id : 0;
 465
 466        switch (appmode) {
 467        case 0x4a:
 468        case 0x4b:
 469                /* Chips after 1664S use different scheme */
 470                if (retry || family_id >= 0xa2) {
 471                        bootloader = appmode - 0x24;
 472                        break;
 473                }
 474                /* Fall through for normal case */
 475        case 0x4c:
 476        case 0x4d:
 477        case 0x5a:
 478        case 0x5b:
 479                bootloader = appmode - 0x26;
 480                break;
 481
 482        default:
 483                dev_err(&data->client->dev,
 484                        "Appmode i2c address 0x%02x not found\n",
 485                        appmode);
 486                return -EINVAL;
 487        }
 488
 489        data->bootloader_addr = bootloader;
 490        return 0;
 491}
 492
 493static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
 494{
 495        struct device *dev = &data->client->dev;
 496        int error;
 497        u8 val;
 498        bool crc_failure;
 499
 500        error = mxt_lookup_bootloader_address(data, alt_address);
 501        if (error)
 502                return error;
 503
 504        error = mxt_bootloader_read(data, &val, 1);
 505        if (error)
 506                return error;
 507
 508        /* Check app crc fail mode */
 509        crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
 510
 511        dev_err(dev, "Detected bootloader, status:%02X%s\n",
 512                        val, crc_failure ? ", APP_CRC_FAIL" : "");
 513
 514        return 0;
 515}
 516
 517static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
 518{
 519        struct device *dev = &data->client->dev;
 520        u8 buf[3];
 521
 522        if (val & MXT_BOOT_EXTENDED_ID) {
 523                if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
 524                        dev_err(dev, "%s: i2c failure\n", __func__);
 525                        return val;
 526                }
 527
 528                dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
 529
 530                return buf[0];
 531        } else {
 532                dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
 533
 534                return val;
 535        }
 536}
 537
 538static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
 539                                bool wait)
 540{
 541        struct device *dev = &data->client->dev;
 542        u8 val;
 543        int ret;
 544
 545recheck:
 546        if (wait) {
 547                /*
 548                 * In application update mode, the interrupt
 549                 * line signals state transitions. We must wait for the
 550                 * CHG assertion before reading the status byte.
 551                 * Once the status byte has been read, the line is deasserted.
 552                 */
 553                ret = mxt_wait_for_completion(data, &data->bl_completion,
 554                                              MXT_FW_CHG_TIMEOUT);
 555                if (ret) {
 556                        /*
 557                         * TODO: handle -ERESTARTSYS better by terminating
 558                         * fw update process before returning to userspace
 559                         * by writing length 0x000 to device (iff we are in
 560                         * WAITING_FRAME_DATA state).
 561                         */
 562                        dev_err(dev, "Update wait error %d\n", ret);
 563                        return ret;
 564                }
 565        }
 566
 567        ret = mxt_bootloader_read(data, &val, 1);
 568        if (ret)
 569                return ret;
 570
 571        if (state == MXT_WAITING_BOOTLOAD_CMD)
 572                val = mxt_get_bootloader_version(data, val);
 573
 574        switch (state) {
 575        case MXT_WAITING_BOOTLOAD_CMD:
 576        case MXT_WAITING_FRAME_DATA:
 577        case MXT_APP_CRC_FAIL:
 578                val &= ~MXT_BOOT_STATUS_MASK;
 579                break;
 580        case MXT_FRAME_CRC_PASS:
 581                if (val == MXT_FRAME_CRC_CHECK) {
 582                        goto recheck;
 583                } else if (val == MXT_FRAME_CRC_FAIL) {
 584                        dev_err(dev, "Bootloader CRC fail\n");
 585                        return -EINVAL;
 586                }
 587                break;
 588        default:
 589                return -EINVAL;
 590        }
 591
 592        if (val != state) {
 593                dev_err(dev, "Invalid bootloader state %02X != %02X\n",
 594                        val, state);
 595                return -EINVAL;
 596        }
 597
 598        return 0;
 599}
 600
 601static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
 602{
 603        int ret;
 604        u8 buf[2];
 605
 606        if (unlock) {
 607                buf[0] = MXT_UNLOCK_CMD_LSB;
 608                buf[1] = MXT_UNLOCK_CMD_MSB;
 609        } else {
 610                buf[0] = 0x01;
 611                buf[1] = 0x01;
 612        }
 613
 614        ret = mxt_bootloader_write(data, buf, 2);
 615        if (ret)
 616                return ret;
 617
 618        return 0;
 619}
 620
 621static int __mxt_read_reg(struct i2c_client *client,
 622                               u16 reg, u16 len, void *val)
 623{
 624        struct i2c_msg xfer[2];
 625        u8 buf[2];
 626        int ret;
 627
 628        buf[0] = reg & 0xff;
 629        buf[1] = (reg >> 8) & 0xff;
 630
 631        /* Write register */
 632        xfer[0].addr = client->addr;
 633        xfer[0].flags = 0;
 634        xfer[0].len = 2;
 635        xfer[0].buf = buf;
 636
 637        /* Read data */
 638        xfer[1].addr = client->addr;
 639        xfer[1].flags = I2C_M_RD;
 640        xfer[1].len = len;
 641        xfer[1].buf = val;
 642
 643        ret = i2c_transfer(client->adapter, xfer, 2);
 644        if (ret == 2) {
 645                ret = 0;
 646        } else {
 647                if (ret >= 0)
 648                        ret = -EIO;
 649                dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
 650                        __func__, ret);
 651        }
 652
 653        return ret;
 654}
 655
 656static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
 657                           const void *val)
 658{
 659        u8 *buf;
 660        size_t count;
 661        int ret;
 662
 663        count = len + 2;
 664        buf = kmalloc(count, GFP_KERNEL);
 665        if (!buf)
 666                return -ENOMEM;
 667
 668        buf[0] = reg & 0xff;
 669        buf[1] = (reg >> 8) & 0xff;
 670        memcpy(&buf[2], val, len);
 671
 672        ret = i2c_master_send(client, buf, count);
 673        if (ret == count) {
 674                ret = 0;
 675        } else {
 676                if (ret >= 0)
 677                        ret = -EIO;
 678                dev_err(&client->dev, "%s: i2c send failed (%d)\n",
 679                        __func__, ret);
 680        }
 681
 682        kfree(buf);
 683        return ret;
 684}
 685
 686static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
 687{
 688        return __mxt_write_reg(client, reg, 1, &val);
 689}
 690
 691static struct mxt_object *
 692mxt_get_object(struct mxt_data *data, u8 type)
 693{
 694        struct mxt_object *object;
 695        int i;
 696
 697        for (i = 0; i < data->info->object_num; i++) {
 698                object = data->object_table + i;
 699                if (object->type == type)
 700                        return object;
 701        }
 702
 703        dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
 704        return NULL;
 705}
 706
 707static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
 708{
 709        struct device *dev = &data->client->dev;
 710        u8 status = msg[1];
 711        u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
 712
 713        complete(&data->crc_completion);
 714
 715        if (crc != data->config_crc) {
 716                data->config_crc = crc;
 717                dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
 718        }
 719
 720        /* Detect reset */
 721        if (status & MXT_T6_STATUS_RESET)
 722                complete(&data->reset_completion);
 723
 724        /* Output debug if status has changed */
 725        if (status != data->t6_status)
 726                dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
 727                        status,
 728                        status == 0 ? " OK" : "",
 729                        status & MXT_T6_STATUS_RESET ? " RESET" : "",
 730                        status & MXT_T6_STATUS_OFL ? " OFL" : "",
 731                        status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
 732                        status & MXT_T6_STATUS_CAL ? " CAL" : "",
 733                        status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
 734                        status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
 735
 736        /* Save current status */
 737        data->t6_status = status;
 738}
 739
 740static int mxt_write_object(struct mxt_data *data,
 741                                 u8 type, u8 offset, u8 val)
 742{
 743        struct mxt_object *object;
 744        u16 reg;
 745
 746        object = mxt_get_object(data, type);
 747        if (!object || offset >= mxt_obj_size(object))
 748                return -EINVAL;
 749
 750        reg = object->start_address;
 751        return mxt_write_reg(data->client, reg + offset, val);
 752}
 753
 754static void mxt_input_button(struct mxt_data *data, u8 *message)
 755{
 756        struct input_dev *input = data->input_dev;
 757        int i;
 758
 759        for (i = 0; i < data->t19_num_keys; i++) {
 760                if (data->t19_keymap[i] == KEY_RESERVED)
 761                        continue;
 762
 763                /* Active-low switch */
 764                input_report_key(input, data->t19_keymap[i],
 765                                 !(message[1] & BIT(i)));
 766        }
 767}
 768
 769static void mxt_input_sync(struct mxt_data *data)
 770{
 771        input_mt_report_pointer_emulation(data->input_dev,
 772                                          data->t19_num_keys);
 773        input_sync(data->input_dev);
 774}
 775
 776static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
 777{
 778        struct device *dev = &data->client->dev;
 779        struct input_dev *input_dev = data->input_dev;
 780        int id;
 781        u8 status;
 782        int x;
 783        int y;
 784        int area;
 785        int amplitude;
 786
 787        id = message[0] - data->T9_reportid_min;
 788        status = message[1];
 789        x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
 790        y = (message[3] << 4) | ((message[4] & 0xf));
 791
 792        /* Handle 10/12 bit switching */
 793        if (data->max_x < 1024)
 794                x >>= 2;
 795        if (data->max_y < 1024)
 796                y >>= 2;
 797
 798        area = message[5];
 799        amplitude = message[6];
 800
 801        dev_dbg(dev,
 802                "[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
 803                id,
 804                (status & MXT_T9_DETECT) ? 'D' : '.',
 805                (status & MXT_T9_PRESS) ? 'P' : '.',
 806                (status & MXT_T9_RELEASE) ? 'R' : '.',
 807                (status & MXT_T9_MOVE) ? 'M' : '.',
 808                (status & MXT_T9_VECTOR) ? 'V' : '.',
 809                (status & MXT_T9_AMP) ? 'A' : '.',
 810                (status & MXT_T9_SUPPRESS) ? 'S' : '.',
 811                (status & MXT_T9_UNGRIP) ? 'U' : '.',
 812                x, y, area, amplitude);
 813
 814        input_mt_slot(input_dev, id);
 815
 816        if (status & MXT_T9_DETECT) {
 817                /*
 818                 * Multiple bits may be set if the host is slow to read
 819                 * the status messages, indicating all the events that
 820                 * have happened.
 821                 */
 822                if (status & MXT_T9_RELEASE) {
 823                        input_mt_report_slot_state(input_dev,
 824                                                   MT_TOOL_FINGER, 0);
 825                        mxt_input_sync(data);
 826                }
 827
 828                /* Touch active */
 829                input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
 830                input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 831                input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 832                input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
 833                input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
 834        } else {
 835                /* Touch no longer active, close out slot */
 836                input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 0);
 837        }
 838
 839        data->update_input = true;
 840}
 841
 842static void mxt_proc_t100_message(struct mxt_data *data, u8 *message)
 843{
 844        struct device *dev = &data->client->dev;
 845        struct input_dev *input_dev = data->input_dev;
 846        int id;
 847        u8 status;
 848        u8 type = 0;
 849        u16 x;
 850        u16 y;
 851        int distance = 0;
 852        int tool = 0;
 853        u8 major = 0;
 854        u8 pressure = 0;
 855        u8 orientation = 0;
 856
 857        id = message[0] - data->T100_reportid_min - 2;
 858
 859        /* ignore SCRSTATUS events */
 860        if (id < 0)
 861                return;
 862
 863        status = message[1];
 864        x = get_unaligned_le16(&message[2]);
 865        y = get_unaligned_le16(&message[4]);
 866
 867        if (status & MXT_T100_DETECT) {
 868                type = (status & MXT_T100_TYPE_MASK) >> 4;
 869
 870                switch (type) {
 871                case MXT_T100_TYPE_HOVERING_FINGER:
 872                        tool = MT_TOOL_FINGER;
 873                        distance = MXT_DISTANCE_HOVERING;
 874
 875                        if (data->t100_aux_vect)
 876                                orientation = message[data->t100_aux_vect];
 877
 878                        break;
 879
 880                case MXT_T100_TYPE_FINGER:
 881                case MXT_T100_TYPE_GLOVE:
 882                        tool = MT_TOOL_FINGER;
 883                        distance = MXT_DISTANCE_ACTIVE_TOUCH;
 884
 885                        if (data->t100_aux_area)
 886                                major = message[data->t100_aux_area];
 887
 888                        if (data->t100_aux_ampl)
 889                                pressure = message[data->t100_aux_ampl];
 890
 891                        if (data->t100_aux_vect)
 892                                orientation = message[data->t100_aux_vect];
 893
 894                        break;
 895
 896                case MXT_T100_TYPE_PASSIVE_STYLUS:
 897                        tool = MT_TOOL_PEN;
 898
 899                        /*
 900                         * Passive stylus is reported with size zero so
 901                         * hardcode.
 902                         */
 903                        major = MXT_TOUCH_MAJOR_DEFAULT;
 904
 905                        if (data->t100_aux_ampl)
 906                                pressure = message[data->t100_aux_ampl];
 907
 908                        break;
 909
 910                case MXT_T100_TYPE_LARGE_TOUCH:
 911                        /* Ignore suppressed touch */
 912                        break;
 913
 914                default:
 915                        dev_dbg(dev, "Unexpected T100 type\n");
 916                        return;
 917                }
 918        }
 919
 920        /*
 921         * Values reported should be non-zero if tool is touching the
 922         * device
 923         */
 924        if (!pressure && type != MXT_T100_TYPE_HOVERING_FINGER)
 925                pressure = MXT_PRESSURE_DEFAULT;
 926
 927        input_mt_slot(input_dev, id);
 928
 929        if (status & MXT_T100_DETECT) {
 930                dev_dbg(dev, "[%u] type:%u x:%u y:%u a:%02X p:%02X v:%02X\n",
 931                        id, type, x, y, major, pressure, orientation);
 932
 933                input_mt_report_slot_state(input_dev, tool, 1);
 934                input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 935                input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 936                input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, major);
 937                input_report_abs(input_dev, ABS_MT_PRESSURE, pressure);
 938                input_report_abs(input_dev, ABS_MT_DISTANCE, distance);
 939                input_report_abs(input_dev, ABS_MT_ORIENTATION, orientation);
 940        } else {
 941                dev_dbg(dev, "[%u] release\n", id);
 942
 943                /* close out slot */
 944                input_mt_report_slot_state(input_dev, 0, 0);
 945        }
 946
 947        data->update_input = true;
 948}
 949
 950static int mxt_proc_message(struct mxt_data *data, u8 *message)
 951{
 952        u8 report_id = message[0];
 953
 954        if (report_id == MXT_RPTID_NOMSG)
 955                return 0;
 956
 957        if (report_id == data->T6_reportid) {
 958                mxt_proc_t6_messages(data, message);
 959        } else if (!data->input_dev) {
 960                /*
 961                 * Do not report events if input device
 962                 * is not yet registered.
 963                 */
 964                mxt_dump_message(data, message);
 965        } else if (report_id >= data->T9_reportid_min &&
 966                   report_id <= data->T9_reportid_max) {
 967                mxt_proc_t9_message(data, message);
 968        } else if (report_id >= data->T100_reportid_min &&
 969                   report_id <= data->T100_reportid_max) {
 970                mxt_proc_t100_message(data, message);
 971        } else if (report_id == data->T19_reportid) {
 972                mxt_input_button(data, message);
 973                data->update_input = true;
 974        } else {
 975                mxt_dump_message(data, message);
 976        }
 977
 978        return 1;
 979}
 980
 981static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
 982{
 983        struct device *dev = &data->client->dev;
 984        int ret;
 985        int i;
 986        u8 num_valid = 0;
 987
 988        /* Safety check for msg_buf */
 989        if (count > data->max_reportid)
 990                return -EINVAL;
 991
 992        /* Process remaining messages if necessary */
 993        ret = __mxt_read_reg(data->client, data->T5_address,
 994                                data->T5_msg_size * count, data->msg_buf);
 995        if (ret) {
 996                dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
 997                return ret;
 998        }
 999
1000        for (i = 0;  i < count; i++) {
1001                ret = mxt_proc_message(data,
1002                        data->msg_buf + data->T5_msg_size * i);
1003
1004                if (ret == 1)
1005                        num_valid++;
1006        }
1007
1008        /* return number of messages read */
1009        return num_valid;
1010}
1011
1012static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
1013{
1014        struct device *dev = &data->client->dev;
1015        int ret;
1016        u8 count, num_left;
1017
1018        /* Read T44 and T5 together */
1019        ret = __mxt_read_reg(data->client, data->T44_address,
1020                data->T5_msg_size + 1, data->msg_buf);
1021        if (ret) {
1022                dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
1023                return IRQ_NONE;
1024        }
1025
1026        count = data->msg_buf[0];
1027
1028        /*
1029         * This condition may be caused by the CHG line being configured in
1030         * Mode 0. It results in unnecessary I2C operations but it is benign.
1031         */
1032        if (count == 0)
1033                return IRQ_NONE;
1034
1035        if (count > data->max_reportid) {
1036                dev_warn(dev, "T44 count %d exceeded max report id\n", count);
1037                count = data->max_reportid;
1038        }
1039
1040        /* Process first message */
1041        ret = mxt_proc_message(data, data->msg_buf + 1);
1042        if (ret < 0) {
1043                dev_warn(dev, "Unexpected invalid message\n");
1044                return IRQ_NONE;
1045        }
1046
1047        num_left = count - 1;
1048
1049        /* Process remaining messages if necessary */
1050        if (num_left) {
1051                ret = mxt_read_and_process_messages(data, num_left);
1052                if (ret < 0)
1053                        goto end;
1054                else if (ret != num_left)
1055                        dev_warn(dev, "Unexpected invalid message\n");
1056        }
1057
1058end:
1059        if (data->update_input) {
1060                mxt_input_sync(data);
1061                data->update_input = false;
1062        }
1063
1064        return IRQ_HANDLED;
1065}
1066
1067static int mxt_process_messages_until_invalid(struct mxt_data *data)
1068{
1069        struct device *dev = &data->client->dev;
1070        int count, read;
1071        u8 tries = 2;
1072
1073        count = data->max_reportid;
1074
1075        /* Read messages until we force an invalid */
1076        do {
1077                read = mxt_read_and_process_messages(data, count);
1078                if (read < count)
1079                        return 0;
1080        } while (--tries);
1081
1082        if (data->update_input) {
1083                mxt_input_sync(data);
1084                data->update_input = false;
1085        }
1086
1087        dev_err(dev, "CHG pin isn't cleared\n");
1088        return -EBUSY;
1089}
1090
1091static irqreturn_t mxt_process_messages(struct mxt_data *data)
1092{
1093        int total_handled, num_handled;
1094        u8 count = data->last_message_count;
1095
1096        if (count < 1 || count > data->max_reportid)
1097                count = 1;
1098
1099        /* include final invalid message */
1100        total_handled = mxt_read_and_process_messages(data, count + 1);
1101        if (total_handled < 0)
1102                return IRQ_NONE;
1103        /* if there were invalid messages, then we are done */
1104        else if (total_handled <= count)
1105                goto update_count;
1106
1107        /* keep reading two msgs until one is invalid or reportid limit */
1108        do {
1109                num_handled = mxt_read_and_process_messages(data, 2);
1110                if (num_handled < 0)
1111                        return IRQ_NONE;
1112
1113                total_handled += num_handled;
1114
1115                if (num_handled < 2)
1116                        break;
1117        } while (total_handled < data->num_touchids);
1118
1119update_count:
1120        data->last_message_count = total_handled;
1121
1122        if (data->update_input) {
1123                mxt_input_sync(data);
1124                data->update_input = false;
1125        }
1126
1127        return IRQ_HANDLED;
1128}
1129
1130static irqreturn_t mxt_interrupt(int irq, void *dev_id)
1131{
1132        struct mxt_data *data = dev_id;
1133
1134        if (data->in_bootloader) {
1135                /* bootloader state transition completion */
1136                complete(&data->bl_completion);
1137                return IRQ_HANDLED;
1138        }
1139
1140        if (!data->object_table)
1141                return IRQ_HANDLED;
1142
1143        if (data->T44_address) {
1144                return mxt_process_messages_t44(data);
1145        } else {
1146                return mxt_process_messages(data);
1147        }
1148}
1149
1150static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
1151                          u8 value, bool wait)
1152{
1153        u16 reg;
1154        u8 command_register;
1155        int timeout_counter = 0;
1156        int ret;
1157
1158        reg = data->T6_address + cmd_offset;
1159
1160        ret = mxt_write_reg(data->client, reg, value);
1161        if (ret)
1162                return ret;
1163
1164        if (!wait)
1165                return 0;
1166
1167        do {
1168                msleep(20);
1169                ret = __mxt_read_reg(data->client, reg, 1, &command_register);
1170                if (ret)
1171                        return ret;
1172        } while (command_register != 0 && timeout_counter++ <= 100);
1173
1174        if (timeout_counter > 100) {
1175                dev_err(&data->client->dev, "Command failed!\n");
1176                return -EIO;
1177        }
1178
1179        return 0;
1180}
1181
1182static int mxt_acquire_irq(struct mxt_data *data)
1183{
1184        int error;
1185
1186        enable_irq(data->irq);
1187
1188        error = mxt_process_messages_until_invalid(data);
1189        if (error)
1190                return error;
1191
1192        return 0;
1193}
1194
1195static int mxt_soft_reset(struct mxt_data *data)
1196{
1197        struct device *dev = &data->client->dev;
1198        int ret = 0;
1199
1200        dev_info(dev, "Resetting device\n");
1201
1202        disable_irq(data->irq);
1203
1204        reinit_completion(&data->reset_completion);
1205
1206        ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1207        if (ret)
1208                return ret;
1209
1210        /* Ignore CHG line for 100ms after reset */
1211        msleep(100);
1212
1213        mxt_acquire_irq(data);
1214
1215        ret = mxt_wait_for_completion(data, &data->reset_completion,
1216                                      MXT_RESET_TIMEOUT);
1217        if (ret)
1218                return ret;
1219
1220        return 0;
1221}
1222
1223static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1224{
1225        /*
1226         * On failure, CRC is set to 0 and config will always be
1227         * downloaded.
1228         */
1229        data->config_crc = 0;
1230        reinit_completion(&data->crc_completion);
1231
1232        mxt_t6_command(data, cmd, value, true);
1233
1234        /*
1235         * Wait for crc message. On failure, CRC is set to 0 and config will
1236         * always be downloaded.
1237         */
1238        mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1239}
1240
1241static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1242{
1243        static const unsigned int crcpoly = 0x80001B;
1244        u32 result;
1245        u32 data_word;
1246
1247        data_word = (secondbyte << 8) | firstbyte;
1248        result = ((*crc << 1) ^ data_word);
1249
1250        if (result & 0x1000000)
1251                result ^= crcpoly;
1252
1253        *crc = result;
1254}
1255
1256static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1257{
1258        u32 crc = 0;
1259        u8 *ptr = base + start_off;
1260        u8 *last_val = base + end_off - 1;
1261
1262        if (end_off < start_off)
1263                return -EINVAL;
1264
1265        while (ptr < last_val) {
1266                mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1267                ptr += 2;
1268        }
1269
1270        /* if len is odd, fill the last byte with 0 */
1271        if (ptr == last_val)
1272                mxt_calc_crc24(&crc, *ptr, 0);
1273
1274        /* Mask to 24-bit */
1275        crc &= 0x00FFFFFF;
1276
1277        return crc;
1278}
1279
1280static int mxt_prepare_cfg_mem(struct mxt_data *data,
1281                               const struct firmware *cfg,
1282                               unsigned int data_pos,
1283                               unsigned int cfg_start_ofs,
1284                               u8 *config_mem,
1285                               size_t config_mem_size)
1286{
1287        struct device *dev = &data->client->dev;
1288        struct mxt_object *object;
1289        unsigned int type, instance, size, byte_offset;
1290        int offset;
1291        int ret;
1292        int i;
1293        u16 reg;
1294        u8 val;
1295
1296        while (data_pos < cfg->size) {
1297                /* Read type, instance, length */
1298                ret = sscanf(cfg->data + data_pos, "%x %x %x%n",
1299                             &type, &instance, &size, &offset);
1300                if (ret == 0) {
1301                        /* EOF */
1302                        break;
1303                } else if (ret != 3) {
1304                        dev_err(dev, "Bad format: failed to parse object\n");
1305                        return -EINVAL;
1306                }
1307                data_pos += offset;
1308
1309                object = mxt_get_object(data, type);
1310                if (!object) {
1311                        /* Skip object */
1312                        for (i = 0; i < size; i++) {
1313                                ret = sscanf(cfg->data + data_pos, "%hhx%n",
1314                                             &val, &offset);
1315                                if (ret != 1) {
1316                                        dev_err(dev, "Bad format in T%d at %d\n",
1317                                                type, i);
1318                                        return -EINVAL;
1319                                }
1320                                data_pos += offset;
1321                        }
1322                        continue;
1323                }
1324
1325                if (size > mxt_obj_size(object)) {
1326                        /*
1327                         * Either we are in fallback mode due to wrong
1328                         * config or config from a later fw version,
1329                         * or the file is corrupt or hand-edited.
1330                         */
1331                        dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1332                                 size - mxt_obj_size(object), type);
1333                } else if (mxt_obj_size(object) > size) {
1334                        /*
1335                         * If firmware is upgraded, new bytes may be added to
1336                         * end of objects. It is generally forward compatible
1337                         * to zero these bytes - previous behaviour will be
1338                         * retained. However this does invalidate the CRC and
1339                         * will force fallback mode until the configuration is
1340                         * updated. We warn here but do nothing else - the
1341                         * malloc has zeroed the entire configuration.
1342                         */
1343                        dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1344                                 mxt_obj_size(object) - size, type);
1345                }
1346
1347                if (instance >= mxt_obj_instances(object)) {
1348                        dev_err(dev, "Object instances exceeded!\n");
1349                        return -EINVAL;
1350                }
1351
1352                reg = object->start_address + mxt_obj_size(object) * instance;
1353
1354                for (i = 0; i < size; i++) {
1355                        ret = sscanf(cfg->data + data_pos, "%hhx%n",
1356                                     &val,
1357                                     &offset);
1358                        if (ret != 1) {
1359                                dev_err(dev, "Bad format in T%d at %d\n",
1360                                        type, i);
1361                                return -EINVAL;
1362                        }
1363                        data_pos += offset;
1364
1365                        if (i > mxt_obj_size(object))
1366                                continue;
1367
1368                        byte_offset = reg + i - cfg_start_ofs;
1369
1370                        if (byte_offset >= 0 && byte_offset < config_mem_size) {
1371                                *(config_mem + byte_offset) = val;
1372                        } else {
1373                                dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1374                                        reg, object->type, byte_offset);
1375                                return -EINVAL;
1376                        }
1377                }
1378        }
1379
1380        return 0;
1381}
1382
1383static int mxt_upload_cfg_mem(struct mxt_data *data, unsigned int cfg_start,
1384                              u8 *config_mem, size_t config_mem_size)
1385{
1386        unsigned int byte_offset = 0;
1387        int error;
1388
1389        /* Write configuration as blocks */
1390        while (byte_offset < config_mem_size) {
1391                unsigned int size = config_mem_size - byte_offset;
1392
1393                if (size > MXT_MAX_BLOCK_WRITE)
1394                        size = MXT_MAX_BLOCK_WRITE;
1395
1396                error = __mxt_write_reg(data->client,
1397                                        cfg_start + byte_offset,
1398                                        size, config_mem + byte_offset);
1399                if (error) {
1400                        dev_err(&data->client->dev,
1401                                "Config write error, ret=%d\n", error);
1402                        return error;
1403                }
1404
1405                byte_offset += size;
1406        }
1407
1408        return 0;
1409}
1410
1411static int mxt_init_t7_power_cfg(struct mxt_data *data);
1412
1413/*
1414 * mxt_update_cfg - download configuration to chip
1415 *
1416 * Atmel Raw Config File Format
1417 *
1418 * The first four lines of the raw config file contain:
1419 *  1) Version
1420 *  2) Chip ID Information (first 7 bytes of device memory)
1421 *  3) Chip Information Block 24-bit CRC Checksum
1422 *  4) Chip Configuration 24-bit CRC Checksum
1423 *
1424 * The rest of the file consists of one line per object instance:
1425 *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1426 *
1427 *   <TYPE> - 2-byte object type as hex
1428 *   <INSTANCE> - 2-byte object instance number as hex
1429 *   <SIZE> - 2-byte object size as hex
1430 *   <CONTENTS> - array of <SIZE> 1-byte hex values
1431 */
1432static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
1433{
1434        struct device *dev = &data->client->dev;
1435        struct mxt_info cfg_info;
1436        int ret;
1437        int offset;
1438        int data_pos;
1439        int i;
1440        int cfg_start_ofs;
1441        u32 info_crc, config_crc, calculated_crc;
1442        u8 *config_mem;
1443        size_t config_mem_size;
1444
1445        mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1446
1447        if (strncmp(cfg->data, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1448                dev_err(dev, "Unrecognised config file\n");
1449                return -EINVAL;
1450        }
1451
1452        data_pos = strlen(MXT_CFG_MAGIC);
1453
1454        /* Load information block and check */
1455        for (i = 0; i < sizeof(struct mxt_info); i++) {
1456                ret = sscanf(cfg->data + data_pos, "%hhx%n",
1457                             (unsigned char *)&cfg_info + i,
1458                             &offset);
1459                if (ret != 1) {
1460                        dev_err(dev, "Bad format\n");
1461                        return -EINVAL;
1462                }
1463
1464                data_pos += offset;
1465        }
1466
1467        if (cfg_info.family_id != data->info->family_id) {
1468                dev_err(dev, "Family ID mismatch!\n");
1469                return -EINVAL;
1470        }
1471
1472        if (cfg_info.variant_id != data->info->variant_id) {
1473                dev_err(dev, "Variant ID mismatch!\n");
1474                return -EINVAL;
1475        }
1476
1477        /* Read CRCs */
1478        ret = sscanf(cfg->data + data_pos, "%x%n", &info_crc, &offset);
1479        if (ret != 1) {
1480                dev_err(dev, "Bad format: failed to parse Info CRC\n");
1481                return -EINVAL;
1482        }
1483        data_pos += offset;
1484
1485        ret = sscanf(cfg->data + data_pos, "%x%n", &config_crc, &offset);
1486        if (ret != 1) {
1487                dev_err(dev, "Bad format: failed to parse Config CRC\n");
1488                return -EINVAL;
1489        }
1490        data_pos += offset;
1491
1492        /*
1493         * The Info Block CRC is calculated over mxt_info and the object
1494         * table. If it does not match then we are trying to load the
1495         * configuration from a different chip or firmware version, so
1496         * the configuration CRC is invalid anyway.
1497         */
1498        if (info_crc == data->info_crc) {
1499                if (config_crc == 0 || data->config_crc == 0) {
1500                        dev_info(dev, "CRC zero, attempting to apply config\n");
1501                } else if (config_crc == data->config_crc) {
1502                        dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1503                                 data->config_crc);
1504                        return 0;
1505                } else {
1506                        dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1507                                 data->config_crc, config_crc);
1508                }
1509        } else {
1510                dev_warn(dev,
1511                         "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1512                         data->info_crc, info_crc);
1513        }
1514
1515        /* Malloc memory to store configuration */
1516        cfg_start_ofs = MXT_OBJECT_START +
1517                        data->info->object_num * sizeof(struct mxt_object) +
1518                        MXT_INFO_CHECKSUM_SIZE;
1519        config_mem_size = data->mem_size - cfg_start_ofs;
1520        config_mem = kzalloc(config_mem_size, GFP_KERNEL);
1521        if (!config_mem) {
1522                dev_err(dev, "Failed to allocate memory\n");
1523                return -ENOMEM;
1524        }
1525
1526        ret = mxt_prepare_cfg_mem(data, cfg, data_pos, cfg_start_ofs,
1527                                  config_mem, config_mem_size);
1528        if (ret)
1529                goto release_mem;
1530
1531        /* Calculate crc of the received configs (not the raw config file) */
1532        if (data->T7_address < cfg_start_ofs) {
1533                dev_err(dev, "Bad T7 address, T7addr = %x, config offset %x\n",
1534                        data->T7_address, cfg_start_ofs);
1535                ret = 0;
1536                goto release_mem;
1537        }
1538
1539        calculated_crc = mxt_calculate_crc(config_mem,
1540                                           data->T7_address - cfg_start_ofs,
1541                                           config_mem_size);
1542
1543        if (config_crc > 0 && config_crc != calculated_crc)
1544                dev_warn(dev, "Config CRC error, calculated=%06X, file=%06X\n",
1545                         calculated_crc, config_crc);
1546
1547        ret = mxt_upload_cfg_mem(data, cfg_start_ofs,
1548                                 config_mem, config_mem_size);
1549        if (ret)
1550                goto release_mem;
1551
1552        mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1553
1554        ret = mxt_soft_reset(data);
1555        if (ret)
1556                goto release_mem;
1557
1558        dev_info(dev, "Config successfully updated\n");
1559
1560        /* T7 config may have changed */
1561        mxt_init_t7_power_cfg(data);
1562
1563release_mem:
1564        kfree(config_mem);
1565        return ret;
1566}
1567
1568static void mxt_free_input_device(struct mxt_data *data)
1569{
1570        if (data->input_dev) {
1571                input_unregister_device(data->input_dev);
1572                data->input_dev = NULL;
1573        }
1574}
1575
1576static void mxt_free_object_table(struct mxt_data *data)
1577{
1578#ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
1579        video_unregister_device(&data->dbg.vdev);
1580        v4l2_device_unregister(&data->dbg.v4l2);
1581#endif
1582        data->object_table = NULL;
1583        data->info = NULL;
1584        kfree(data->raw_info_block);
1585        data->raw_info_block = NULL;
1586        kfree(data->msg_buf);
1587        data->msg_buf = NULL;
1588        data->T5_address = 0;
1589        data->T5_msg_size = 0;
1590        data->T6_reportid = 0;
1591        data->T7_address = 0;
1592        data->T9_reportid_min = 0;
1593        data->T9_reportid_max = 0;
1594        data->T19_reportid = 0;
1595        data->T44_address = 0;
1596        data->T100_reportid_min = 0;
1597        data->T100_reportid_max = 0;
1598        data->max_reportid = 0;
1599}
1600
1601static int mxt_parse_object_table(struct mxt_data *data,
1602                                  struct mxt_object *object_table)
1603{
1604        struct i2c_client *client = data->client;
1605        int i;
1606        u8 reportid;
1607        u16 end_address;
1608
1609        /* Valid Report IDs start counting from 1 */
1610        reportid = 1;
1611        data->mem_size = 0;
1612        for (i = 0; i < data->info->object_num; i++) {
1613                struct mxt_object *object = object_table + i;
1614                u8 min_id, max_id;
1615
1616                le16_to_cpus(&object->start_address);
1617
1618                if (object->num_report_ids) {
1619                        min_id = reportid;
1620                        reportid += object->num_report_ids *
1621                                        mxt_obj_instances(object);
1622                        max_id = reportid - 1;
1623                } else {
1624                        min_id = 0;
1625                        max_id = 0;
1626                }
1627
1628                dev_dbg(&data->client->dev,
1629                        "T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1630                        object->type, object->start_address,
1631                        mxt_obj_size(object), mxt_obj_instances(object),
1632                        min_id, max_id);
1633
1634                switch (object->type) {
1635                case MXT_GEN_MESSAGE_T5:
1636                        if (data->info->family_id == 0x80 &&
1637                            data->info->version < 0x20) {
1638                                /*
1639                                 * On mXT224 firmware versions prior to V2.0
1640                                 * read and discard unused CRC byte otherwise
1641                                 * DMA reads are misaligned.
1642                                 */
1643                                data->T5_msg_size = mxt_obj_size(object);
1644                        } else {
1645                                /* CRC not enabled, so skip last byte */
1646                                data->T5_msg_size = mxt_obj_size(object) - 1;
1647                        }
1648                        data->T5_address = object->start_address;
1649                        break;
1650                case MXT_GEN_COMMAND_T6:
1651                        data->T6_reportid = min_id;
1652                        data->T6_address = object->start_address;
1653                        break;
1654                case MXT_GEN_POWER_T7:
1655                        data->T7_address = object->start_address;
1656                        break;
1657                case MXT_TOUCH_MULTI_T9:
1658                        data->multitouch = MXT_TOUCH_MULTI_T9;
1659                        data->T9_reportid_min = min_id;
1660                        data->T9_reportid_max = max_id;
1661                        data->num_touchids = object->num_report_ids
1662                                                * mxt_obj_instances(object);
1663                        break;
1664                case MXT_SPT_MESSAGECOUNT_T44:
1665                        data->T44_address = object->start_address;
1666                        break;
1667                case MXT_SPT_GPIOPWM_T19:
1668                        data->T19_reportid = min_id;
1669                        break;
1670                case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1671                        data->multitouch = MXT_TOUCH_MULTITOUCHSCREEN_T100;
1672                        data->T100_reportid_min = min_id;
1673                        data->T100_reportid_max = max_id;
1674                        /* first two report IDs reserved */
1675                        data->num_touchids = object->num_report_ids - 2;
1676                        break;
1677                }
1678
1679                end_address = object->start_address
1680                        + mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1681
1682                if (end_address >= data->mem_size)
1683                        data->mem_size = end_address + 1;
1684        }
1685
1686        /* Store maximum reportid */
1687        data->max_reportid = reportid;
1688
1689        /* If T44 exists, T5 position has to be directly after */
1690        if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1691                dev_err(&client->dev, "Invalid T44 position\n");
1692                return -EINVAL;
1693        }
1694
1695        data->msg_buf = kcalloc(data->max_reportid,
1696                                data->T5_msg_size, GFP_KERNEL);
1697        if (!data->msg_buf)
1698                return -ENOMEM;
1699
1700        return 0;
1701}
1702
1703static int mxt_read_info_block(struct mxt_data *data)
1704{
1705        struct i2c_client *client = data->client;
1706        int error;
1707        size_t size;
1708        void *id_buf, *buf;
1709        uint8_t num_objects;
1710        u32 calculated_crc;
1711        u8 *crc_ptr;
1712
1713        /* If info block already allocated, free it */
1714        if (data->raw_info_block)
1715                mxt_free_object_table(data);
1716
1717        /* Read 7-byte ID information block starting at address 0 */
1718        size = sizeof(struct mxt_info);
1719        id_buf = kzalloc(size, GFP_KERNEL);
1720        if (!id_buf)
1721                return -ENOMEM;
1722
1723        error = __mxt_read_reg(client, 0, size, id_buf);
1724        if (error)
1725                goto err_free_mem;
1726
1727        /* Resize buffer to give space for rest of info block */
1728        num_objects = ((struct mxt_info *)id_buf)->object_num;
1729        size += (num_objects * sizeof(struct mxt_object))
1730                + MXT_INFO_CHECKSUM_SIZE;
1731
1732        buf = krealloc(id_buf, size, GFP_KERNEL);
1733        if (!buf) {
1734                error = -ENOMEM;
1735                goto err_free_mem;
1736        }
1737        id_buf = buf;
1738
1739        /* Read rest of info block */
1740        error = __mxt_read_reg(client, MXT_OBJECT_START,
1741                               size - MXT_OBJECT_START,
1742                               id_buf + MXT_OBJECT_START);
1743        if (error)
1744                goto err_free_mem;
1745
1746        /* Extract & calculate checksum */
1747        crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
1748        data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
1749
1750        calculated_crc = mxt_calculate_crc(id_buf, 0,
1751                                           size - MXT_INFO_CHECKSUM_SIZE);
1752
1753        /*
1754         * CRC mismatch can be caused by data corruption due to I2C comms
1755         * issue or else device is not using Object Based Protocol (eg i2c-hid)
1756         */
1757        if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
1758                dev_err(&client->dev,
1759                        "Info Block CRC error calculated=0x%06X read=0x%06X\n",
1760                        calculated_crc, data->info_crc);
1761                error = -EIO;
1762                goto err_free_mem;
1763        }
1764
1765        data->raw_info_block = id_buf;
1766        data->info = (struct mxt_info *)id_buf;
1767
1768        dev_info(&client->dev,
1769                 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
1770                 data->info->family_id, data->info->variant_id,
1771                 data->info->version >> 4, data->info->version & 0xf,
1772                 data->info->build, data->info->object_num);
1773
1774        /* Parse object table information */
1775        error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
1776        if (error) {
1777                dev_err(&client->dev, "Error %d parsing object table\n", error);
1778                mxt_free_object_table(data);
1779                goto err_free_mem;
1780        }
1781
1782        data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
1783
1784        return 0;
1785
1786err_free_mem:
1787        kfree(id_buf);
1788        return error;
1789}
1790
1791static int mxt_read_t9_resolution(struct mxt_data *data)
1792{
1793        struct i2c_client *client = data->client;
1794        int error;
1795        struct t9_range range;
1796        unsigned char orient;
1797        struct mxt_object *object;
1798
1799        object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1800        if (!object)
1801                return -EINVAL;
1802
1803        error = __mxt_read_reg(client,
1804                               object->start_address + MXT_T9_XSIZE,
1805                               sizeof(data->xsize), &data->xsize);
1806        if (error)
1807                return error;
1808
1809        error = __mxt_read_reg(client,
1810                               object->start_address + MXT_T9_YSIZE,
1811                               sizeof(data->ysize), &data->ysize);
1812        if (error)
1813                return error;
1814
1815        error = __mxt_read_reg(client,
1816                               object->start_address + MXT_T9_RANGE,
1817                               sizeof(range), &range);
1818        if (error)
1819                return error;
1820
1821        data->max_x = get_unaligned_le16(&range.x);
1822        data->max_y = get_unaligned_le16(&range.y);
1823
1824        error =  __mxt_read_reg(client,
1825                                object->start_address + MXT_T9_ORIENT,
1826                                1, &orient);
1827        if (error)
1828                return error;
1829
1830        data->xy_switch = orient & MXT_T9_ORIENT_SWITCH;
1831        data->invertx = orient & MXT_T9_ORIENT_INVERTX;
1832        data->inverty = orient & MXT_T9_ORIENT_INVERTY;
1833
1834        return 0;
1835}
1836
1837static int mxt_read_t100_config(struct mxt_data *data)
1838{
1839        struct i2c_client *client = data->client;
1840        int error;
1841        struct mxt_object *object;
1842        u16 range_x, range_y;
1843        u8 cfg, tchaux;
1844        u8 aux;
1845
1846        object = mxt_get_object(data, MXT_TOUCH_MULTITOUCHSCREEN_T100);
1847        if (!object)
1848                return -EINVAL;
1849
1850        /* read touchscreen dimensions */
1851        error = __mxt_read_reg(client,
1852                               object->start_address + MXT_T100_XRANGE,
1853                               sizeof(range_x), &range_x);
1854        if (error)
1855                return error;
1856
1857        data->max_x = get_unaligned_le16(&range_x);
1858
1859        error = __mxt_read_reg(client,
1860                               object->start_address + MXT_T100_YRANGE,
1861                               sizeof(range_y), &range_y);
1862        if (error)
1863                return error;
1864
1865        data->max_y = get_unaligned_le16(&range_y);
1866
1867        error = __mxt_read_reg(client,
1868                               object->start_address + MXT_T100_XSIZE,
1869                               sizeof(data->xsize), &data->xsize);
1870        if (error)
1871                return error;
1872
1873        error = __mxt_read_reg(client,
1874                               object->start_address + MXT_T100_YSIZE,
1875                               sizeof(data->ysize), &data->ysize);
1876        if (error)
1877                return error;
1878
1879        /* read orientation config */
1880        error =  __mxt_read_reg(client,
1881                                object->start_address + MXT_T100_CFG1,
1882                                1, &cfg);
1883        if (error)
1884                return error;
1885
1886        data->xy_switch = cfg & MXT_T100_CFG_SWITCHXY;
1887        data->invertx = cfg & MXT_T100_CFG_INVERTX;
1888        data->inverty = cfg & MXT_T100_CFG_INVERTY;
1889
1890        /* allocate aux bytes */
1891        error =  __mxt_read_reg(client,
1892                                object->start_address + MXT_T100_TCHAUX,
1893                                1, &tchaux);
1894        if (error)
1895                return error;
1896
1897        aux = 6;
1898
1899        if (tchaux & MXT_T100_TCHAUX_VECT)
1900                data->t100_aux_vect = aux++;
1901
1902        if (tchaux & MXT_T100_TCHAUX_AMPL)
1903                data->t100_aux_ampl = aux++;
1904
1905        if (tchaux & MXT_T100_TCHAUX_AREA)
1906                data->t100_aux_area = aux++;
1907
1908        dev_dbg(&client->dev,
1909                "T100 aux mappings vect:%u ampl:%u area:%u\n",
1910                data->t100_aux_vect, data->t100_aux_ampl, data->t100_aux_area);
1911
1912        return 0;
1913}
1914
1915static int mxt_input_open(struct input_dev *dev);
1916static void mxt_input_close(struct input_dev *dev);
1917
1918static void mxt_set_up_as_touchpad(struct input_dev *input_dev,
1919                                   struct mxt_data *data)
1920{
1921        int i;
1922
1923        input_dev->name = "Atmel maXTouch Touchpad";
1924
1925        __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1926
1927        input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1928        input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1929        input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1930                          MXT_PIXELS_PER_MM);
1931        input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1932                          MXT_PIXELS_PER_MM);
1933
1934        for (i = 0; i < data->t19_num_keys; i++)
1935                if (data->t19_keymap[i] != KEY_RESERVED)
1936                        input_set_capability(input_dev, EV_KEY,
1937                                             data->t19_keymap[i]);
1938}
1939
1940static int mxt_initialize_input_device(struct mxt_data *data)
1941{
1942        struct device *dev = &data->client->dev;
1943        struct input_dev *input_dev;
1944        int error;
1945        unsigned int num_mt_slots;
1946        unsigned int mt_flags = 0;
1947
1948        switch (data->multitouch) {
1949        case MXT_TOUCH_MULTI_T9:
1950                num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
1951                error = mxt_read_t9_resolution(data);
1952                if (error)
1953                        dev_warn(dev, "Failed to initialize T9 resolution\n");
1954                break;
1955
1956        case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1957                num_mt_slots = data->num_touchids;
1958                error = mxt_read_t100_config(data);
1959                if (error)
1960                        dev_warn(dev, "Failed to read T100 config\n");
1961                break;
1962
1963        default:
1964                dev_err(dev, "Invalid multitouch object\n");
1965                return -EINVAL;
1966        }
1967
1968        /* Handle default values and orientation switch */
1969        if (data->max_x == 0)
1970                data->max_x = 1023;
1971
1972        if (data->max_y == 0)
1973                data->max_y = 1023;
1974
1975        if (data->xy_switch)
1976                swap(data->max_x, data->max_y);
1977
1978        dev_info(dev, "Touchscreen size X%uY%u\n", data->max_x, data->max_y);
1979
1980        /* Register input device */
1981        input_dev = input_allocate_device();
1982        if (!input_dev) {
1983                dev_err(dev, "Failed to allocate memory\n");
1984                return -ENOMEM;
1985        }
1986
1987        input_dev->name = "Atmel maXTouch Touchscreen";
1988        input_dev->phys = data->phys;
1989        input_dev->id.bustype = BUS_I2C;
1990        input_dev->dev.parent = dev;
1991        input_dev->open = mxt_input_open;
1992        input_dev->close = mxt_input_close;
1993
1994        input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
1995
1996        /* For single touch */
1997        input_set_abs_params(input_dev, ABS_X, 0, data->max_x, 0, 0);
1998        input_set_abs_params(input_dev, ABS_Y, 0, data->max_y, 0, 0);
1999
2000        if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2001            (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2002             data->t100_aux_ampl)) {
2003                input_set_abs_params(input_dev, ABS_PRESSURE, 0, 255, 0, 0);
2004        }
2005
2006        /* If device has buttons we assume it is a touchpad */
2007        if (data->t19_num_keys) {
2008                mxt_set_up_as_touchpad(input_dev, data);
2009                mt_flags |= INPUT_MT_POINTER;
2010        } else {
2011                mt_flags |= INPUT_MT_DIRECT;
2012        }
2013
2014        /* For multi touch */
2015        error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
2016        if (error) {
2017                dev_err(dev, "Error %d initialising slots\n", error);
2018                goto err_free_mem;
2019        }
2020
2021        if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100) {
2022                input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
2023                                     0, MT_TOOL_MAX, 0, 0);
2024                input_set_abs_params(input_dev, ABS_MT_DISTANCE,
2025                                     MXT_DISTANCE_ACTIVE_TOUCH,
2026                                     MXT_DISTANCE_HOVERING,
2027                                     0, 0);
2028        }
2029
2030        input_set_abs_params(input_dev, ABS_MT_POSITION_X,
2031                             0, data->max_x, 0, 0);
2032        input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
2033                             0, data->max_y, 0, 0);
2034
2035        if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2036            (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2037             data->t100_aux_area)) {
2038                input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
2039                                     0, MXT_MAX_AREA, 0, 0);
2040        }
2041
2042        if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2043            (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2044             data->t100_aux_ampl)) {
2045                input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2046                                     0, 255, 0, 0);
2047        }
2048
2049        if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2050            data->t100_aux_vect) {
2051                input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2052                                     0, 255, 0, 0);
2053        }
2054
2055        if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2056            data->t100_aux_ampl) {
2057                input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2058                                     0, 255, 0, 0);
2059        }
2060
2061        if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2062            data->t100_aux_vect) {
2063                input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2064                                     0, 255, 0, 0);
2065        }
2066
2067        input_set_drvdata(input_dev, data);
2068
2069        error = input_register_device(input_dev);
2070        if (error) {
2071                dev_err(dev, "Error %d registering input device\n", error);
2072                goto err_free_mem;
2073        }
2074
2075        data->input_dev = input_dev;
2076
2077        return 0;
2078
2079err_free_mem:
2080        input_free_device(input_dev);
2081        return error;
2082}
2083
2084static int mxt_configure_objects(struct mxt_data *data,
2085                                 const struct firmware *cfg);
2086
2087static void mxt_config_cb(const struct firmware *cfg, void *ctx)
2088{
2089        mxt_configure_objects(ctx, cfg);
2090        release_firmware(cfg);
2091}
2092
2093static int mxt_initialize(struct mxt_data *data)
2094{
2095        struct i2c_client *client = data->client;
2096        int recovery_attempts = 0;
2097        int error;
2098
2099        while (1) {
2100                error = mxt_read_info_block(data);
2101                if (!error)
2102                        break;
2103
2104                /* Check bootloader state */
2105                error = mxt_probe_bootloader(data, false);
2106                if (error) {
2107                        dev_info(&client->dev, "Trying alternate bootloader address\n");
2108                        error = mxt_probe_bootloader(data, true);
2109                        if (error) {
2110                                /* Chip is not in appmode or bootloader mode */
2111                                return error;
2112                        }
2113                }
2114
2115                /* OK, we are in bootloader, see if we can recover */
2116                if (++recovery_attempts > 1) {
2117                        dev_err(&client->dev, "Could not recover from bootloader mode\n");
2118                        /*
2119                         * We can reflash from this state, so do not
2120                         * abort initialization.
2121                         */
2122                        data->in_bootloader = true;
2123                        return 0;
2124                }
2125
2126                /* Attempt to exit bootloader into app mode */
2127                mxt_send_bootloader_cmd(data, false);
2128                msleep(MXT_FW_RESET_TIME);
2129        }
2130
2131        error = mxt_acquire_irq(data);
2132        if (error)
2133                return error;
2134
2135        error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
2136                                        &client->dev, GFP_KERNEL, data,
2137                                        mxt_config_cb);
2138        if (error) {
2139                dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
2140                        error);
2141                return error;
2142        }
2143
2144        return 0;
2145}
2146
2147static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
2148{
2149        struct device *dev = &data->client->dev;
2150        int error;
2151        struct t7_config *new_config;
2152        struct t7_config deepsleep = { .active = 0, .idle = 0 };
2153
2154        if (sleep == MXT_POWER_CFG_DEEPSLEEP)
2155                new_config = &deepsleep;
2156        else
2157                new_config = &data->t7_cfg;
2158
2159        error = __mxt_write_reg(data->client, data->T7_address,
2160                                sizeof(data->t7_cfg), new_config);
2161        if (error)
2162                return error;
2163
2164        dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
2165                new_config->active, new_config->idle);
2166
2167        return 0;
2168}
2169
2170static int mxt_init_t7_power_cfg(struct mxt_data *data)
2171{
2172        struct device *dev = &data->client->dev;
2173        int error;
2174        bool retry = false;
2175
2176recheck:
2177        error = __mxt_read_reg(data->client, data->T7_address,
2178                                sizeof(data->t7_cfg), &data->t7_cfg);
2179        if (error)
2180                return error;
2181
2182        if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
2183                if (!retry) {
2184                        dev_dbg(dev, "T7 cfg zero, resetting\n");
2185                        mxt_soft_reset(data);
2186                        retry = true;
2187                        goto recheck;
2188                } else {
2189                        dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
2190                        data->t7_cfg.active = 20;
2191                        data->t7_cfg.idle = 100;
2192                        return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2193                }
2194        }
2195
2196        dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
2197                data->t7_cfg.active, data->t7_cfg.idle);
2198        return 0;
2199}
2200
2201#ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
2202static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
2203                               unsigned int y)
2204{
2205        struct mxt_info *info = data->info;
2206        struct mxt_dbg *dbg = &data->dbg;
2207        unsigned int ofs, page;
2208        unsigned int col = 0;
2209        unsigned int col_width;
2210
2211        if (info->family_id == MXT_FAMILY_1386) {
2212                col_width = info->matrix_ysize / MXT1386_COLUMNS;
2213                col = y / col_width;
2214                y = y % col_width;
2215        } else {
2216                col_width = info->matrix_ysize;
2217        }
2218
2219        ofs = (y + (x * col_width)) * sizeof(u16);
2220        page = ofs / MXT_DIAGNOSTIC_SIZE;
2221        ofs %= MXT_DIAGNOSTIC_SIZE;
2222
2223        if (info->family_id == MXT_FAMILY_1386)
2224                page += col * MXT1386_PAGES_PER_COLUMN;
2225
2226        return get_unaligned_le16(&dbg->t37_buf[page].data[ofs]);
2227}
2228
2229static int mxt_convert_debug_pages(struct mxt_data *data, u16 *outbuf)
2230{
2231        struct mxt_dbg *dbg = &data->dbg;
2232        unsigned int x = 0;
2233        unsigned int y = 0;
2234        unsigned int i, rx, ry;
2235
2236        for (i = 0; i < dbg->t37_nodes; i++) {
2237                /* Handle orientation */
2238                rx = data->xy_switch ? y : x;
2239                ry = data->xy_switch ? x : y;
2240                rx = data->invertx ? (data->xsize - 1 - rx) : rx;
2241                ry = data->inverty ? (data->ysize - 1 - ry) : ry;
2242
2243                outbuf[i] = mxt_get_debug_value(data, rx, ry);
2244
2245                /* Next value */
2246                if (++x >= (data->xy_switch ? data->ysize : data->xsize)) {
2247                        x = 0;
2248                        y++;
2249                }
2250        }
2251
2252        return 0;
2253}
2254
2255static int mxt_read_diagnostic_debug(struct mxt_data *data, u8 mode,
2256                                     u16 *outbuf)
2257{
2258        struct mxt_dbg *dbg = &data->dbg;
2259        int retries = 0;
2260        int page;
2261        int ret;
2262        u8 cmd = mode;
2263        struct t37_debug *p;
2264        u8 cmd_poll;
2265
2266        for (page = 0; page < dbg->t37_pages; page++) {
2267                p = dbg->t37_buf + page;
2268
2269                ret = mxt_write_reg(data->client, dbg->diag_cmd_address,
2270                                    cmd);
2271                if (ret)
2272                        return ret;
2273
2274                retries = 0;
2275                msleep(20);
2276wait_cmd:
2277                /* Read back command byte */
2278                ret = __mxt_read_reg(data->client, dbg->diag_cmd_address,
2279                                     sizeof(cmd_poll), &cmd_poll);
2280                if (ret)
2281                        return ret;
2282
2283                /* Field is cleared once the command has been processed */
2284                if (cmd_poll) {
2285                        if (retries++ > 100)
2286                                return -EINVAL;
2287
2288                        msleep(20);
2289                        goto wait_cmd;
2290                }
2291
2292                /* Read T37 page */
2293                ret = __mxt_read_reg(data->client, dbg->t37_address,
2294                                     sizeof(struct t37_debug), p);
2295                if (ret)
2296                        return ret;
2297
2298                if (p->mode != mode || p->page != page) {
2299                        dev_err(&data->client->dev, "T37 page mismatch\n");
2300                        return -EINVAL;
2301                }
2302
2303                dev_dbg(&data->client->dev, "%s page:%d retries:%d\n",
2304                        __func__, page, retries);
2305
2306                /* For remaining pages, write PAGEUP rather than mode */
2307                cmd = MXT_DIAGNOSTIC_PAGEUP;
2308        }
2309
2310        return mxt_convert_debug_pages(data, outbuf);
2311}
2312
2313static int mxt_queue_setup(struct vb2_queue *q,
2314                       unsigned int *nbuffers, unsigned int *nplanes,
2315                       unsigned int sizes[], struct device *alloc_devs[])
2316{
2317        struct mxt_data *data = q->drv_priv;
2318        size_t size = data->dbg.t37_nodes * sizeof(u16);
2319
2320        if (*nplanes)
2321                return sizes[0] < size ? -EINVAL : 0;
2322
2323        *nplanes = 1;
2324        sizes[0] = size;
2325
2326        return 0;
2327}
2328
2329static void mxt_buffer_queue(struct vb2_buffer *vb)
2330{
2331        struct mxt_data *data = vb2_get_drv_priv(vb->vb2_queue);
2332        u16 *ptr;
2333        int ret;
2334        u8 mode;
2335
2336        ptr = vb2_plane_vaddr(vb, 0);
2337        if (!ptr) {
2338                dev_err(&data->client->dev, "Error acquiring frame ptr\n");
2339                goto fault;
2340        }
2341
2342        switch (data->dbg.input) {
2343        case MXT_V4L_INPUT_DELTAS:
2344        default:
2345                mode = MXT_DIAGNOSTIC_DELTAS;
2346                break;
2347
2348        case MXT_V4L_INPUT_REFS:
2349                mode = MXT_DIAGNOSTIC_REFS;
2350                break;
2351        }
2352
2353        ret = mxt_read_diagnostic_debug(data, mode, ptr);
2354        if (ret)
2355                goto fault;
2356
2357        vb2_set_plane_payload(vb, 0, data->dbg.t37_nodes * sizeof(u16));
2358        vb2_buffer_done(vb, VB2_BUF_STATE_DONE);
2359        return;
2360
2361fault:
2362        vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
2363}
2364
2365/* V4L2 structures */
2366static const struct vb2_ops mxt_queue_ops = {
2367        .queue_setup            = mxt_queue_setup,
2368        .buf_queue              = mxt_buffer_queue,
2369        .wait_prepare           = vb2_ops_wait_prepare,
2370        .wait_finish            = vb2_ops_wait_finish,
2371};
2372
2373static const struct vb2_queue mxt_queue = {
2374        .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
2375        .io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
2376        .buf_struct_size = sizeof(struct mxt_vb2_buffer),
2377        .ops = &mxt_queue_ops,
2378        .mem_ops = &vb2_vmalloc_memops,
2379        .timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
2380        .min_buffers_needed = 1,
2381};
2382
2383static int mxt_vidioc_querycap(struct file *file, void *priv,
2384                                 struct v4l2_capability *cap)
2385{
2386        struct mxt_data *data = video_drvdata(file);
2387
2388        strlcpy(cap->driver, "atmel_mxt_ts", sizeof(cap->driver));
2389        strlcpy(cap->card, "atmel_mxt_ts touch", sizeof(cap->card));
2390        snprintf(cap->bus_info, sizeof(cap->bus_info),
2391                 "I2C:%s", dev_name(&data->client->dev));
2392        return 0;
2393}
2394
2395static int mxt_vidioc_enum_input(struct file *file, void *priv,
2396                                   struct v4l2_input *i)
2397{
2398        if (i->index >= MXT_V4L_INPUT_MAX)
2399                return -EINVAL;
2400
2401        i->type = V4L2_INPUT_TYPE_TOUCH;
2402
2403        switch (i->index) {
2404        case MXT_V4L_INPUT_REFS:
2405                strlcpy(i->name, "Mutual Capacitance References",
2406                        sizeof(i->name));
2407                break;
2408        case MXT_V4L_INPUT_DELTAS:
2409                strlcpy(i->name, "Mutual Capacitance Deltas", sizeof(i->name));
2410                break;
2411        }
2412
2413        return 0;
2414}
2415
2416static int mxt_set_input(struct mxt_data *data, unsigned int i)
2417{
2418        struct v4l2_pix_format *f = &data->dbg.format;
2419
2420        if (i >= MXT_V4L_INPUT_MAX)
2421                return -EINVAL;
2422
2423        if (i == MXT_V4L_INPUT_DELTAS)
2424                f->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2425        else
2426                f->pixelformat = V4L2_TCH_FMT_TU16;
2427
2428        f->width = data->xy_switch ? data->ysize : data->xsize;
2429        f->height = data->xy_switch ? data->xsize : data->ysize;
2430        f->field = V4L2_FIELD_NONE;
2431        f->colorspace = V4L2_COLORSPACE_RAW;
2432        f->bytesperline = f->width * sizeof(u16);
2433        f->sizeimage = f->width * f->height * sizeof(u16);
2434
2435        data->dbg.input = i;
2436
2437        return 0;
2438}
2439
2440static int mxt_vidioc_s_input(struct file *file, void *priv, unsigned int i)
2441{
2442        return mxt_set_input(video_drvdata(file), i);
2443}
2444
2445static int mxt_vidioc_g_input(struct file *file, void *priv, unsigned int *i)
2446{
2447        struct mxt_data *data = video_drvdata(file);
2448
2449        *i = data->dbg.input;
2450
2451        return 0;
2452}
2453
2454static int mxt_vidioc_fmt(struct file *file, void *priv, struct v4l2_format *f)
2455{
2456        struct mxt_data *data = video_drvdata(file);
2457
2458        f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
2459        f->fmt.pix = data->dbg.format;
2460
2461        return 0;
2462}
2463
2464static int mxt_vidioc_enum_fmt(struct file *file, void *priv,
2465                                 struct v4l2_fmtdesc *fmt)
2466{
2467        if (fmt->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2468                return -EINVAL;
2469
2470        switch (fmt->index) {
2471        case 0:
2472                fmt->pixelformat = V4L2_TCH_FMT_TU16;
2473                break;
2474
2475        case 1:
2476                fmt->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2477                break;
2478
2479        default:
2480                return -EINVAL;
2481        }
2482
2483        return 0;
2484}
2485
2486static int mxt_vidioc_g_parm(struct file *file, void *fh,
2487                             struct v4l2_streamparm *a)
2488{
2489        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2490                return -EINVAL;
2491
2492        a->parm.capture.readbuffers = 1;
2493        a->parm.capture.timeperframe.numerator = 1;
2494        a->parm.capture.timeperframe.denominator = 10;
2495        return 0;
2496}
2497
2498static const struct v4l2_ioctl_ops mxt_video_ioctl_ops = {
2499        .vidioc_querycap        = mxt_vidioc_querycap,
2500
2501        .vidioc_enum_fmt_vid_cap = mxt_vidioc_enum_fmt,
2502        .vidioc_s_fmt_vid_cap   = mxt_vidioc_fmt,
2503        .vidioc_g_fmt_vid_cap   = mxt_vidioc_fmt,
2504        .vidioc_try_fmt_vid_cap = mxt_vidioc_fmt,
2505        .vidioc_g_parm          = mxt_vidioc_g_parm,
2506
2507        .vidioc_enum_input      = mxt_vidioc_enum_input,
2508        .vidioc_g_input         = mxt_vidioc_g_input,
2509        .vidioc_s_input         = mxt_vidioc_s_input,
2510
2511        .vidioc_reqbufs         = vb2_ioctl_reqbufs,
2512        .vidioc_create_bufs     = vb2_ioctl_create_bufs,
2513        .vidioc_querybuf        = vb2_ioctl_querybuf,
2514        .vidioc_qbuf            = vb2_ioctl_qbuf,
2515        .vidioc_dqbuf           = vb2_ioctl_dqbuf,
2516        .vidioc_expbuf          = vb2_ioctl_expbuf,
2517
2518        .vidioc_streamon        = vb2_ioctl_streamon,
2519        .vidioc_streamoff       = vb2_ioctl_streamoff,
2520};
2521
2522static const struct video_device mxt_video_device = {
2523        .name = "Atmel maxTouch",
2524        .fops = &mxt_video_fops,
2525        .ioctl_ops = &mxt_video_ioctl_ops,
2526        .release = video_device_release_empty,
2527        .device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TOUCH |
2528                       V4L2_CAP_READWRITE | V4L2_CAP_STREAMING,
2529};
2530
2531static void mxt_debug_init(struct mxt_data *data)
2532{
2533        struct mxt_info *info = data->info;
2534        struct mxt_dbg *dbg = &data->dbg;
2535        struct mxt_object *object;
2536        int error;
2537
2538        object = mxt_get_object(data, MXT_GEN_COMMAND_T6);
2539        if (!object)
2540                goto error;
2541
2542        dbg->diag_cmd_address = object->start_address + MXT_COMMAND_DIAGNOSTIC;
2543
2544        object = mxt_get_object(data, MXT_DEBUG_DIAGNOSTIC_T37);
2545        if (!object)
2546                goto error;
2547
2548        if (mxt_obj_size(object) != sizeof(struct t37_debug)) {
2549                dev_warn(&data->client->dev, "Bad T37 size");
2550                goto error;
2551        }
2552
2553        dbg->t37_address = object->start_address;
2554
2555        /* Calculate size of data and allocate buffer */
2556        dbg->t37_nodes = data->xsize * data->ysize;
2557
2558        if (info->family_id == MXT_FAMILY_1386)
2559                dbg->t37_pages = MXT1386_COLUMNS * MXT1386_PAGES_PER_COLUMN;
2560        else
2561                dbg->t37_pages = DIV_ROUND_UP(data->xsize *
2562                                              info->matrix_ysize *
2563                                              sizeof(u16),
2564                                              sizeof(dbg->t37_buf->data));
2565
2566        dbg->t37_buf = devm_kmalloc_array(&data->client->dev, dbg->t37_pages,
2567                                          sizeof(struct t37_debug), GFP_KERNEL);
2568        if (!dbg->t37_buf)
2569                goto error;
2570
2571        /* init channel to zero */
2572        mxt_set_input(data, 0);
2573
2574        /* register video device */
2575        snprintf(dbg->v4l2.name, sizeof(dbg->v4l2.name), "%s", "atmel_mxt_ts");
2576        error = v4l2_device_register(&data->client->dev, &dbg->v4l2);
2577        if (error)
2578                goto error;
2579
2580        /* initialize the queue */
2581        mutex_init(&dbg->lock);
2582        dbg->queue = mxt_queue;
2583        dbg->queue.drv_priv = data;
2584        dbg->queue.lock = &dbg->lock;
2585        dbg->queue.dev = &data->client->dev;
2586
2587        error = vb2_queue_init(&dbg->queue);
2588        if (error)
2589                goto error_unreg_v4l2;
2590
2591        dbg->vdev = mxt_video_device;
2592        dbg->vdev.v4l2_dev = &dbg->v4l2;
2593        dbg->vdev.lock = &dbg->lock;
2594        dbg->vdev.vfl_dir = VFL_DIR_RX;
2595        dbg->vdev.queue = &dbg->queue;
2596        video_set_drvdata(&dbg->vdev, data);
2597
2598        error = video_register_device(&dbg->vdev, VFL_TYPE_TOUCH, -1);
2599        if (error)
2600                goto error_unreg_v4l2;
2601
2602        return;
2603
2604error_unreg_v4l2:
2605        v4l2_device_unregister(&dbg->v4l2);
2606error:
2607        dev_warn(&data->client->dev, "Error initializing T37\n");
2608}
2609#else
2610static void mxt_debug_init(struct mxt_data *data)
2611{
2612}
2613#endif
2614
2615static int mxt_configure_objects(struct mxt_data *data,
2616                                 const struct firmware *cfg)
2617{
2618        struct device *dev = &data->client->dev;
2619        int error;
2620
2621        error = mxt_init_t7_power_cfg(data);
2622        if (error) {
2623                dev_err(dev, "Failed to initialize power cfg\n");
2624                return error;
2625        }
2626
2627        if (cfg) {
2628                error = mxt_update_cfg(data, cfg);
2629                if (error)
2630                        dev_warn(dev, "Error %d updating config\n", error);
2631        }
2632
2633        if (data->multitouch) {
2634                error = mxt_initialize_input_device(data);
2635                if (error)
2636                        return error;
2637        } else {
2638                dev_warn(dev, "No touch object detected\n");
2639        }
2640
2641        mxt_debug_init(data);
2642
2643        return 0;
2644}
2645
2646/* Firmware Version is returned as Major.Minor.Build */
2647static ssize_t mxt_fw_version_show(struct device *dev,
2648                                   struct device_attribute *attr, char *buf)
2649{
2650        struct mxt_data *data = dev_get_drvdata(dev);
2651        struct mxt_info *info = data->info;
2652        return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
2653                         info->version >> 4, info->version & 0xf, info->build);
2654}
2655
2656/* Hardware Version is returned as FamilyID.VariantID */
2657static ssize_t mxt_hw_version_show(struct device *dev,
2658                                   struct device_attribute *attr, char *buf)
2659{
2660        struct mxt_data *data = dev_get_drvdata(dev);
2661        struct mxt_info *info = data->info;
2662        return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
2663                         info->family_id, info->variant_id);
2664}
2665
2666static ssize_t mxt_show_instance(char *buf, int count,
2667                                 struct mxt_object *object, int instance,
2668                                 const u8 *val)
2669{
2670        int i;
2671
2672        if (mxt_obj_instances(object) > 1)
2673                count += scnprintf(buf + count, PAGE_SIZE - count,
2674                                   "Instance %u\n", instance);
2675
2676        for (i = 0; i < mxt_obj_size(object); i++)
2677                count += scnprintf(buf + count, PAGE_SIZE - count,
2678                                "\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
2679        count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
2680
2681        return count;
2682}
2683
2684static ssize_t mxt_object_show(struct device *dev,
2685                                    struct device_attribute *attr, char *buf)
2686{
2687        struct mxt_data *data = dev_get_drvdata(dev);
2688        struct mxt_object *object;
2689        int count = 0;
2690        int i, j;
2691        int error;
2692        u8 *obuf;
2693
2694        /* Pre-allocate buffer large enough to hold max sized object. */
2695        obuf = kmalloc(256, GFP_KERNEL);
2696        if (!obuf)
2697                return -ENOMEM;
2698
2699        error = 0;
2700        for (i = 0; i < data->info->object_num; i++) {
2701                object = data->object_table + i;
2702
2703                if (!mxt_object_readable(object->type))
2704                        continue;
2705
2706                count += scnprintf(buf + count, PAGE_SIZE - count,
2707                                "T%u:\n", object->type);
2708
2709                for (j = 0; j < mxt_obj_instances(object); j++) {
2710                        u16 size = mxt_obj_size(object);
2711                        u16 addr = object->start_address + j * size;
2712
2713                        error = __mxt_read_reg(data->client, addr, size, obuf);
2714                        if (error)
2715                                goto done;
2716
2717                        count = mxt_show_instance(buf, count, object, j, obuf);
2718                }
2719        }
2720
2721done:
2722        kfree(obuf);
2723        return error ?: count;
2724}
2725
2726static int mxt_check_firmware_format(struct device *dev,
2727                                     const struct firmware *fw)
2728{
2729        unsigned int pos = 0;
2730        char c;
2731
2732        while (pos < fw->size) {
2733                c = *(fw->data + pos);
2734
2735                if (c < '0' || (c > '9' && c < 'A') || c > 'F')
2736                        return 0;
2737
2738                pos++;
2739        }
2740
2741        /*
2742         * To convert file try:
2743         * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
2744         */
2745        dev_err(dev, "Aborting: firmware file must be in binary format\n");
2746
2747        return -EINVAL;
2748}
2749
2750static int mxt_load_fw(struct device *dev, const char *fn)
2751{
2752        struct mxt_data *data = dev_get_drvdata(dev);
2753        const struct firmware *fw = NULL;
2754        unsigned int frame_size;
2755        unsigned int pos = 0;
2756        unsigned int retry = 0;
2757        unsigned int frame = 0;
2758        int ret;
2759
2760        ret = request_firmware(&fw, fn, dev);
2761        if (ret) {
2762                dev_err(dev, "Unable to open firmware %s\n", fn);
2763                return ret;
2764        }
2765
2766        /* Check for incorrect enc file */
2767        ret = mxt_check_firmware_format(dev, fw);
2768        if (ret)
2769                goto release_firmware;
2770
2771        if (!data->in_bootloader) {
2772                /* Change to the bootloader mode */
2773                data->in_bootloader = true;
2774
2775                ret = mxt_t6_command(data, MXT_COMMAND_RESET,
2776                                     MXT_BOOT_VALUE, false);
2777                if (ret)
2778                        goto release_firmware;
2779
2780                msleep(MXT_RESET_TIME);
2781
2782                /* Do not need to scan since we know family ID */
2783                ret = mxt_lookup_bootloader_address(data, 0);
2784                if (ret)
2785                        goto release_firmware;
2786
2787                mxt_free_input_device(data);
2788                mxt_free_object_table(data);
2789        } else {
2790                enable_irq(data->irq);
2791        }
2792
2793        reinit_completion(&data->bl_completion);
2794
2795        ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
2796        if (ret) {
2797                /* Bootloader may still be unlocked from previous attempt */
2798                ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
2799                if (ret)
2800                        goto disable_irq;
2801        } else {
2802                dev_info(dev, "Unlocking bootloader\n");
2803
2804                /* Unlock bootloader */
2805                ret = mxt_send_bootloader_cmd(data, true);
2806                if (ret)
2807                        goto disable_irq;
2808        }
2809
2810        while (pos < fw->size) {
2811                ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
2812                if (ret)
2813                        goto disable_irq;
2814
2815                frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
2816
2817                /* Take account of CRC bytes */
2818                frame_size += 2;
2819
2820                /* Write one frame to device */
2821                ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
2822                if (ret)
2823                        goto disable_irq;
2824
2825                ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
2826                if (ret) {
2827                        retry++;
2828
2829                        /* Back off by 20ms per retry */
2830                        msleep(retry * 20);
2831
2832                        if (retry > 20) {
2833                                dev_err(dev, "Retry count exceeded\n");
2834                                goto disable_irq;
2835                        }
2836                } else {
2837                        retry = 0;
2838                        pos += frame_size;
2839                        frame++;
2840                }
2841
2842                if (frame % 50 == 0)
2843                        dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
2844                                frame, pos, fw->size);
2845        }
2846
2847        /* Wait for flash. */
2848        ret = mxt_wait_for_completion(data, &data->bl_completion,
2849                                      MXT_FW_RESET_TIME);
2850        if (ret)
2851                goto disable_irq;
2852
2853        dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
2854
2855        /*
2856         * Wait for device to reset. Some bootloader versions do not assert
2857         * the CHG line after bootloading has finished, so ignore potential
2858         * errors.
2859         */
2860        mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
2861
2862        data->in_bootloader = false;
2863
2864disable_irq:
2865        disable_irq(data->irq);
2866release_firmware:
2867        release_firmware(fw);
2868        return ret;
2869}
2870
2871static ssize_t mxt_update_fw_store(struct device *dev,
2872                                        struct device_attribute *attr,
2873                                        const char *buf, size_t count)
2874{
2875        struct mxt_data *data = dev_get_drvdata(dev);
2876        int error;
2877
2878        error = mxt_load_fw(dev, MXT_FW_NAME);
2879        if (error) {
2880                dev_err(dev, "The firmware update failed(%d)\n", error);
2881                count = error;
2882        } else {
2883                dev_info(dev, "The firmware update succeeded\n");
2884
2885                error = mxt_initialize(data);
2886                if (error)
2887                        return error;
2888        }
2889
2890        return count;
2891}
2892
2893static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2894static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2895static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2896static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2897
2898static struct attribute *mxt_attrs[] = {
2899        &dev_attr_fw_version.attr,
2900        &dev_attr_hw_version.attr,
2901        &dev_attr_object.attr,
2902        &dev_attr_update_fw.attr,
2903        NULL
2904};
2905
2906static const struct attribute_group mxt_attr_group = {
2907        .attrs = mxt_attrs,
2908};
2909
2910static void mxt_start(struct mxt_data *data)
2911{
2912        switch (data->suspend_mode) {
2913        case MXT_SUSPEND_T9_CTRL:
2914                mxt_soft_reset(data);
2915
2916                /* Touch enable */
2917                /* 0x83 = SCANEN | RPTEN | ENABLE */
2918                mxt_write_object(data,
2919                                MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0x83);
2920                break;
2921
2922        case MXT_SUSPEND_DEEP_SLEEP:
2923        default:
2924                mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2925
2926                /* Recalibrate since chip has been in deep sleep */
2927                mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
2928                break;
2929        }
2930}
2931
2932static void mxt_stop(struct mxt_data *data)
2933{
2934        switch (data->suspend_mode) {
2935        case MXT_SUSPEND_T9_CTRL:
2936                /* Touch disable */
2937                mxt_write_object(data,
2938                                MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0);
2939                break;
2940
2941        case MXT_SUSPEND_DEEP_SLEEP:
2942        default:
2943                mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
2944                break;
2945        }
2946}
2947
2948static int mxt_input_open(struct input_dev *dev)
2949{
2950        struct mxt_data *data = input_get_drvdata(dev);
2951
2952        mxt_start(data);
2953
2954        return 0;
2955}
2956
2957static void mxt_input_close(struct input_dev *dev)
2958{
2959        struct mxt_data *data = input_get_drvdata(dev);
2960
2961        mxt_stop(data);
2962}
2963
2964static int mxt_parse_device_properties(struct mxt_data *data)
2965{
2966        static const char keymap_property[] = "linux,gpio-keymap";
2967        struct device *dev = &data->client->dev;
2968        u32 *keymap;
2969        int n_keys;
2970        int error;
2971
2972        if (device_property_present(dev, keymap_property)) {
2973                n_keys = device_property_read_u32_array(dev, keymap_property,
2974                                                        NULL, 0);
2975                if (n_keys <= 0) {
2976                        error = n_keys < 0 ? n_keys : -EINVAL;
2977                        dev_err(dev, "invalid/malformed '%s' property: %d\n",
2978                                keymap_property, error);
2979                        return error;
2980                }
2981
2982                keymap = devm_kmalloc_array(dev, n_keys, sizeof(*keymap),
2983                                            GFP_KERNEL);
2984                if (!keymap)
2985                        return -ENOMEM;
2986
2987                error = device_property_read_u32_array(dev, keymap_property,
2988                                                       keymap, n_keys);
2989                if (error) {
2990                        dev_err(dev, "failed to parse '%s' property: %d\n",
2991                                keymap_property, error);
2992                        return error;
2993                }
2994
2995                data->t19_keymap = keymap;
2996                data->t19_num_keys = n_keys;
2997        }
2998
2999        return 0;
3000}
3001
3002#ifdef CONFIG_ACPI
3003
3004struct mxt_acpi_platform_data {
3005        const char *hid;
3006        const struct property_entry *props;
3007};
3008
3009static unsigned int samus_touchpad_buttons[] = {
3010        KEY_RESERVED,
3011        KEY_RESERVED,
3012        KEY_RESERVED,
3013        BTN_LEFT
3014};
3015
3016static const struct property_entry samus_touchpad_props[] = {
3017        PROPERTY_ENTRY_U32_ARRAY("linux,gpio-keymap", samus_touchpad_buttons),
3018        { }
3019};
3020
3021static struct mxt_acpi_platform_data samus_platform_data[] = {
3022        {
3023                /* Touchpad */
3024                .hid    = "ATML0000",
3025                .props  = samus_touchpad_props,
3026        },
3027        {
3028                /* Touchscreen */
3029                .hid    = "ATML0001",
3030        },
3031        { }
3032};
3033
3034static unsigned int chromebook_tp_buttons[] = {
3035        KEY_RESERVED,
3036        KEY_RESERVED,
3037        KEY_RESERVED,
3038        KEY_RESERVED,
3039        KEY_RESERVED,
3040        BTN_LEFT
3041};
3042
3043static const struct property_entry chromebook_tp_props[] = {
3044        PROPERTY_ENTRY_U32_ARRAY("linux,gpio-keymap", chromebook_tp_buttons),
3045        { }
3046};
3047
3048static struct mxt_acpi_platform_data chromebook_platform_data[] = {
3049        {
3050                /* Touchpad */
3051                .hid    = "ATML0000",
3052                .props  = chromebook_tp_props,
3053        },
3054        {
3055                /* Touchscreen */
3056                .hid    = "ATML0001",
3057        },
3058        { }
3059};
3060
3061static const struct dmi_system_id mxt_dmi_table[] = {
3062        {
3063                /* 2015 Google Pixel */
3064                .ident = "Chromebook Pixel 2",
3065                .matches = {
3066                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3067                        DMI_MATCH(DMI_PRODUCT_NAME, "Samus"),
3068                },
3069                .driver_data = samus_platform_data,
3070        },
3071        {
3072                /* Samsung Chromebook Pro */
3073                .ident = "Samsung Chromebook Pro",
3074                .matches = {
3075                        DMI_MATCH(DMI_SYS_VENDOR, "Google"),
3076                        DMI_MATCH(DMI_PRODUCT_NAME, "Caroline"),
3077                },
3078                .driver_data = samus_platform_data,
3079        },
3080        {
3081                /* Other Google Chromebooks */
3082                .ident = "Chromebook",
3083                .matches = {
3084                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3085                },
3086                .driver_data = chromebook_platform_data,
3087        },
3088        { }
3089};
3090
3091static int mxt_prepare_acpi_properties(struct i2c_client *client)
3092{
3093        struct acpi_device *adev;
3094        const struct dmi_system_id *system_id;
3095        const struct mxt_acpi_platform_data *acpi_pdata;
3096
3097        adev = ACPI_COMPANION(&client->dev);
3098        if (!adev)
3099                return -ENOENT;
3100
3101        system_id = dmi_first_match(mxt_dmi_table);
3102        if (!system_id)
3103                return -ENOENT;
3104
3105        acpi_pdata = system_id->driver_data;
3106        if (!acpi_pdata)
3107                return -ENOENT;
3108
3109        while (acpi_pdata->hid) {
3110                if (!strcmp(acpi_device_hid(adev), acpi_pdata->hid)) {
3111                        /*
3112                         * Remove previously installed properties if we
3113                         * are probing this device not for the very first
3114                         * time.
3115                         */
3116                        device_remove_properties(&client->dev);
3117
3118                        /*
3119                         * Now install the platform-specific properties
3120                         * that are missing from ACPI.
3121                         */
3122                        device_add_properties(&client->dev, acpi_pdata->props);
3123                        break;
3124                }
3125
3126                acpi_pdata++;
3127        }
3128
3129        return 0;
3130}
3131#else
3132static int mxt_prepare_acpi_properties(struct i2c_client *client)
3133{
3134        return -ENOENT;
3135}
3136#endif
3137
3138static const struct dmi_system_id chromebook_T9_suspend_dmi[] = {
3139        {
3140                .matches = {
3141                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3142                        DMI_MATCH(DMI_PRODUCT_NAME, "Link"),
3143                },
3144        },
3145        {
3146                .matches = {
3147                        DMI_MATCH(DMI_PRODUCT_NAME, "Peppy"),
3148                },
3149        },
3150        { }
3151};
3152
3153static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
3154{
3155        struct mxt_data *data;
3156        int error;
3157
3158        /*
3159         * Ignore ACPI devices representing bootloader mode.
3160         *
3161         * This is a bit of a hack: Google Chromebook BIOS creates ACPI
3162         * devices for both application and bootloader modes, but we are
3163         * interested in application mode only (if device is in bootloader
3164         * mode we'll end up switching into application anyway). So far
3165         * application mode addresses were all above 0x40, so we'll use it
3166         * as a threshold.
3167         */
3168        if (ACPI_COMPANION(&client->dev) && client->addr < 0x40)
3169                return -ENXIO;
3170
3171        data = devm_kzalloc(&client->dev, sizeof(struct mxt_data), GFP_KERNEL);
3172        if (!data)
3173                return -ENOMEM;
3174
3175        snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
3176                 client->adapter->nr, client->addr);
3177
3178        data->client = client;
3179        data->irq = client->irq;
3180        i2c_set_clientdata(client, data);
3181
3182        init_completion(&data->bl_completion);
3183        init_completion(&data->reset_completion);
3184        init_completion(&data->crc_completion);
3185
3186        data->suspend_mode = dmi_check_system(chromebook_T9_suspend_dmi) ?
3187                MXT_SUSPEND_T9_CTRL : MXT_SUSPEND_DEEP_SLEEP;
3188
3189        error = mxt_prepare_acpi_properties(client);
3190        if (error && error != -ENOENT)
3191                return error;
3192
3193        error = mxt_parse_device_properties(data);
3194        if (error)
3195                return error;
3196
3197        data->reset_gpio = devm_gpiod_get_optional(&client->dev,
3198                                                   "reset", GPIOD_OUT_LOW);
3199        if (IS_ERR(data->reset_gpio)) {
3200                error = PTR_ERR(data->reset_gpio);
3201                dev_err(&client->dev, "Failed to get reset gpio: %d\n", error);
3202                return error;
3203        }
3204
3205        error = devm_request_threaded_irq(&client->dev, client->irq,
3206                                          NULL, mxt_interrupt, IRQF_ONESHOT,
3207                                          client->name, data);
3208        if (error) {
3209                dev_err(&client->dev, "Failed to register interrupt\n");
3210                return error;
3211        }
3212
3213        if (data->reset_gpio) {
3214                data->in_bootloader = true;
3215                msleep(MXT_RESET_TIME);
3216                reinit_completion(&data->bl_completion);
3217                gpiod_set_value(data->reset_gpio, 1);
3218                error = mxt_wait_for_completion(data, &data->bl_completion,
3219                                                MXT_RESET_TIMEOUT);
3220                if (error)
3221                        return error;
3222                data->in_bootloader = false;
3223        }
3224
3225        disable_irq(client->irq);
3226
3227        error = mxt_initialize(data);
3228        if (error)
3229                return error;
3230
3231        error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
3232        if (error) {
3233                dev_err(&client->dev, "Failure %d creating sysfs group\n",
3234                        error);
3235                goto err_free_object;
3236        }
3237
3238        return 0;
3239
3240err_free_object:
3241        mxt_free_input_device(data);
3242        mxt_free_object_table(data);
3243        return error;
3244}
3245
3246static int mxt_remove(struct i2c_client *client)
3247{
3248        struct mxt_data *data = i2c_get_clientdata(client);
3249
3250        disable_irq(data->irq);
3251        sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
3252        mxt_free_input_device(data);
3253        mxt_free_object_table(data);
3254
3255        return 0;
3256}
3257
3258static int __maybe_unused mxt_suspend(struct device *dev)
3259{
3260        struct i2c_client *client = to_i2c_client(dev);
3261        struct mxt_data *data = i2c_get_clientdata(client);
3262        struct input_dev *input_dev = data->input_dev;
3263
3264        if (!input_dev)
3265                return 0;
3266
3267        mutex_lock(&input_dev->mutex);
3268
3269        if (input_dev->users)
3270                mxt_stop(data);
3271
3272        mutex_unlock(&input_dev->mutex);
3273
3274        return 0;
3275}
3276
3277static int __maybe_unused mxt_resume(struct device *dev)
3278{
3279        struct i2c_client *client = to_i2c_client(dev);
3280        struct mxt_data *data = i2c_get_clientdata(client);
3281        struct input_dev *input_dev = data->input_dev;
3282
3283        if (!input_dev)
3284                return 0;
3285
3286        mutex_lock(&input_dev->mutex);
3287
3288        if (input_dev->users)
3289                mxt_start(data);
3290
3291        mutex_unlock(&input_dev->mutex);
3292
3293        return 0;
3294}
3295
3296static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
3297
3298static const struct of_device_id mxt_of_match[] = {
3299        { .compatible = "atmel,maxtouch", },
3300        /* Compatibles listed below are deprecated */
3301        { .compatible = "atmel,qt602240_ts", },
3302        { .compatible = "atmel,atmel_mxt_ts", },
3303        { .compatible = "atmel,atmel_mxt_tp", },
3304        { .compatible = "atmel,mXT224", },
3305        {},
3306};
3307MODULE_DEVICE_TABLE(of, mxt_of_match);
3308
3309#ifdef CONFIG_ACPI
3310static const struct acpi_device_id mxt_acpi_id[] = {
3311        { "ATML0000", 0 },      /* Touchpad */
3312        { "ATML0001", 0 },      /* Touchscreen */
3313        { }
3314};
3315MODULE_DEVICE_TABLE(acpi, mxt_acpi_id);
3316#endif
3317
3318static const struct i2c_device_id mxt_id[] = {
3319        { "qt602240_ts", 0 },
3320        { "atmel_mxt_ts", 0 },
3321        { "atmel_mxt_tp", 0 },
3322        { "maxtouch", 0 },
3323        { "mXT224", 0 },
3324        { }
3325};
3326MODULE_DEVICE_TABLE(i2c, mxt_id);
3327
3328static struct i2c_driver mxt_driver = {
3329        .driver = {
3330                .name   = "atmel_mxt_ts",
3331                .of_match_table = mxt_of_match,
3332                .acpi_match_table = ACPI_PTR(mxt_acpi_id),
3333                .pm     = &mxt_pm_ops,
3334        },
3335        .probe          = mxt_probe,
3336        .remove         = mxt_remove,
3337        .id_table       = mxt_id,
3338};
3339
3340module_i2c_driver(mxt_driver);
3341
3342/* Module information */
3343MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
3344MODULE_DESCRIPTION("Atmel maXTouch Touchscreen driver");
3345MODULE_LICENSE("GPL");
3346