linux/drivers/input/touchscreen/atmel_mxt_ts.c
<<
>>
Prefs
   1/*
   2 * Atmel maXTouch Touchscreen driver
   3 *
   4 * Copyright (C) 2010 Samsung Electronics Co.Ltd
   5 * Copyright (C) 2011-2014 Atmel Corporation
   6 * Copyright (C) 2012 Google, Inc.
   7 *
   8 * Author: Joonyoung Shim <jy0922.shim@samsung.com>
   9 *
  10 * This program is free software; you can redistribute  it and/or modify it
  11 * under  the terms of  the GNU General  Public License as published by the
  12 * Free Software Foundation;  either version 2 of the  License, or (at your
  13 * option) any later version.
  14 *
  15 */
  16
  17#include <linux/acpi.h>
  18#include <linux/dmi.h>
  19#include <linux/module.h>
  20#include <linux/init.h>
  21#include <linux/completion.h>
  22#include <linux/delay.h>
  23#include <linux/firmware.h>
  24#include <linux/i2c.h>
  25#include <linux/platform_data/atmel_mxt_ts.h>
  26#include <linux/input/mt.h>
  27#include <linux/interrupt.h>
  28#include <linux/of.h>
  29#include <linux/slab.h>
  30#include <asm/unaligned.h>
  31
  32/* Firmware files */
  33#define MXT_FW_NAME             "maxtouch.fw"
  34#define MXT_CFG_NAME            "maxtouch.cfg"
  35#define MXT_CFG_MAGIC           "OBP_RAW V1"
  36
  37/* Registers */
  38#define MXT_OBJECT_START        0x07
  39#define MXT_OBJECT_SIZE         6
  40#define MXT_INFO_CHECKSUM_SIZE  3
  41#define MXT_MAX_BLOCK_WRITE     256
  42
  43/* Object types */
  44#define MXT_DEBUG_DIAGNOSTIC_T37        37
  45#define MXT_GEN_MESSAGE_T5              5
  46#define MXT_GEN_COMMAND_T6              6
  47#define MXT_GEN_POWER_T7                7
  48#define MXT_GEN_ACQUIRE_T8              8
  49#define MXT_GEN_DATASOURCE_T53          53
  50#define MXT_TOUCH_MULTI_T9              9
  51#define MXT_TOUCH_KEYARRAY_T15          15
  52#define MXT_TOUCH_PROXIMITY_T23         23
  53#define MXT_TOUCH_PROXKEY_T52           52
  54#define MXT_PROCI_GRIPFACE_T20          20
  55#define MXT_PROCG_NOISE_T22             22
  56#define MXT_PROCI_ONETOUCH_T24          24
  57#define MXT_PROCI_TWOTOUCH_T27          27
  58#define MXT_PROCI_GRIP_T40              40
  59#define MXT_PROCI_PALM_T41              41
  60#define MXT_PROCI_TOUCHSUPPRESSION_T42  42
  61#define MXT_PROCI_STYLUS_T47            47
  62#define MXT_PROCG_NOISESUPPRESSION_T48  48
  63#define MXT_SPT_COMMSCONFIG_T18         18
  64#define MXT_SPT_GPIOPWM_T19             19
  65#define MXT_SPT_SELFTEST_T25            25
  66#define MXT_SPT_CTECONFIG_T28           28
  67#define MXT_SPT_USERDATA_T38            38
  68#define MXT_SPT_DIGITIZER_T43           43
  69#define MXT_SPT_MESSAGECOUNT_T44        44
  70#define MXT_SPT_CTECONFIG_T46           46
  71#define MXT_TOUCH_MULTITOUCHSCREEN_T100 100
  72
  73/* MXT_GEN_MESSAGE_T5 object */
  74#define MXT_RPTID_NOMSG         0xff
  75
  76/* MXT_GEN_COMMAND_T6 field */
  77#define MXT_COMMAND_RESET       0
  78#define MXT_COMMAND_BACKUPNV    1
  79#define MXT_COMMAND_CALIBRATE   2
  80#define MXT_COMMAND_REPORTALL   3
  81#define MXT_COMMAND_DIAGNOSTIC  5
  82
  83/* Define for T6 status byte */
  84#define MXT_T6_STATUS_RESET     (1 << 7)
  85#define MXT_T6_STATUS_OFL       (1 << 6)
  86#define MXT_T6_STATUS_SIGERR    (1 << 5)
  87#define MXT_T6_STATUS_CAL       (1 << 4)
  88#define MXT_T6_STATUS_CFGERR    (1 << 3)
  89#define MXT_T6_STATUS_COMSERR   (1 << 2)
  90
  91/* MXT_GEN_POWER_T7 field */
  92struct t7_config {
  93        u8 idle;
  94        u8 active;
  95} __packed;
  96
  97#define MXT_POWER_CFG_RUN               0
  98#define MXT_POWER_CFG_DEEPSLEEP         1
  99
 100/* MXT_TOUCH_MULTI_T9 field */
 101#define MXT_T9_CTRL             0
 102#define MXT_T9_ORIENT           9
 103#define MXT_T9_RANGE            18
 104
 105/* MXT_TOUCH_MULTI_T9 status */
 106#define MXT_T9_UNGRIP           (1 << 0)
 107#define MXT_T9_SUPPRESS         (1 << 1)
 108#define MXT_T9_AMP              (1 << 2)
 109#define MXT_T9_VECTOR           (1 << 3)
 110#define MXT_T9_MOVE             (1 << 4)
 111#define MXT_T9_RELEASE          (1 << 5)
 112#define MXT_T9_PRESS            (1 << 6)
 113#define MXT_T9_DETECT           (1 << 7)
 114
 115struct t9_range {
 116        __le16 x;
 117        __le16 y;
 118} __packed;
 119
 120/* MXT_TOUCH_MULTI_T9 orient */
 121#define MXT_T9_ORIENT_SWITCH    (1 << 0)
 122
 123/* MXT_SPT_COMMSCONFIG_T18 */
 124#define MXT_COMMS_CTRL          0
 125#define MXT_COMMS_CMD           1
 126
 127/* Define for MXT_GEN_COMMAND_T6 */
 128#define MXT_BOOT_VALUE          0xa5
 129#define MXT_RESET_VALUE         0x01
 130#define MXT_BACKUP_VALUE        0x55
 131
 132/* T100 Multiple Touch Touchscreen */
 133#define MXT_T100_CTRL           0
 134#define MXT_T100_CFG1           1
 135#define MXT_T100_TCHAUX         3
 136#define MXT_T100_XRANGE         13
 137#define MXT_T100_YRANGE         24
 138
 139#define MXT_T100_CFG_SWITCHXY   BIT(5)
 140
 141#define MXT_T100_TCHAUX_VECT    BIT(0)
 142#define MXT_T100_TCHAUX_AMPL    BIT(1)
 143#define MXT_T100_TCHAUX_AREA    BIT(2)
 144
 145#define MXT_T100_DETECT         BIT(7)
 146#define MXT_T100_TYPE_MASK      0x70
 147
 148enum t100_type {
 149        MXT_T100_TYPE_FINGER            = 1,
 150        MXT_T100_TYPE_PASSIVE_STYLUS    = 2,
 151        MXT_T100_TYPE_HOVERING_FINGER   = 4,
 152        MXT_T100_TYPE_GLOVE             = 5,
 153        MXT_T100_TYPE_LARGE_TOUCH       = 6,
 154};
 155
 156#define MXT_DISTANCE_ACTIVE_TOUCH       0
 157#define MXT_DISTANCE_HOVERING           1
 158
 159#define MXT_TOUCH_MAJOR_DEFAULT         1
 160#define MXT_PRESSURE_DEFAULT            1
 161
 162/* Delay times */
 163#define MXT_BACKUP_TIME         50      /* msec */
 164#define MXT_RESET_TIME          200     /* msec */
 165#define MXT_RESET_TIMEOUT       3000    /* msec */
 166#define MXT_CRC_TIMEOUT         1000    /* msec */
 167#define MXT_FW_RESET_TIME       3000    /* msec */
 168#define MXT_FW_CHG_TIMEOUT      300     /* msec */
 169
 170/* Command to unlock bootloader */
 171#define MXT_UNLOCK_CMD_MSB      0xaa
 172#define MXT_UNLOCK_CMD_LSB      0xdc
 173
 174/* Bootloader mode status */
 175#define MXT_WAITING_BOOTLOAD_CMD        0xc0    /* valid 7 6 bit only */
 176#define MXT_WAITING_FRAME_DATA  0x80    /* valid 7 6 bit only */
 177#define MXT_FRAME_CRC_CHECK     0x02
 178#define MXT_FRAME_CRC_FAIL      0x03
 179#define MXT_FRAME_CRC_PASS      0x04
 180#define MXT_APP_CRC_FAIL        0x40    /* valid 7 8 bit only */
 181#define MXT_BOOT_STATUS_MASK    0x3f
 182#define MXT_BOOT_EXTENDED_ID    (1 << 5)
 183#define MXT_BOOT_ID_MASK        0x1f
 184
 185/* Touchscreen absolute values */
 186#define MXT_MAX_AREA            0xff
 187
 188#define MXT_PIXELS_PER_MM       20
 189
 190struct mxt_info {
 191        u8 family_id;
 192        u8 variant_id;
 193        u8 version;
 194        u8 build;
 195        u8 matrix_xsize;
 196        u8 matrix_ysize;
 197        u8 object_num;
 198};
 199
 200struct mxt_object {
 201        u8 type;
 202        u16 start_address;
 203        u8 size_minus_one;
 204        u8 instances_minus_one;
 205        u8 num_report_ids;
 206} __packed;
 207
 208/* Each client has this additional data */
 209struct mxt_data {
 210        struct i2c_client *client;
 211        struct input_dev *input_dev;
 212        char phys[64];          /* device physical location */
 213        const struct mxt_platform_data *pdata;
 214        struct mxt_object *object_table;
 215        struct mxt_info info;
 216        unsigned int irq;
 217        unsigned int max_x;
 218        unsigned int max_y;
 219        bool xy_switch;
 220        bool in_bootloader;
 221        u16 mem_size;
 222        u8 t100_aux_ampl;
 223        u8 t100_aux_area;
 224        u8 t100_aux_vect;
 225        u8 max_reportid;
 226        u32 config_crc;
 227        u32 info_crc;
 228        u8 bootloader_addr;
 229        u8 *msg_buf;
 230        u8 t6_status;
 231        bool update_input;
 232        u8 last_message_count;
 233        u8 num_touchids;
 234        u8 multitouch;
 235        struct t7_config t7_cfg;
 236
 237        /* Cached parameters from object table */
 238        u16 T5_address;
 239        u8 T5_msg_size;
 240        u8 T6_reportid;
 241        u16 T6_address;
 242        u16 T7_address;
 243        u8 T9_reportid_min;
 244        u8 T9_reportid_max;
 245        u8 T19_reportid;
 246        u16 T44_address;
 247        u8 T100_reportid_min;
 248        u8 T100_reportid_max;
 249
 250        /* for fw update in bootloader */
 251        struct completion bl_completion;
 252
 253        /* for reset handling */
 254        struct completion reset_completion;
 255
 256        /* for config update handling */
 257        struct completion crc_completion;
 258};
 259
 260static size_t mxt_obj_size(const struct mxt_object *obj)
 261{
 262        return obj->size_minus_one + 1;
 263}
 264
 265static size_t mxt_obj_instances(const struct mxt_object *obj)
 266{
 267        return obj->instances_minus_one + 1;
 268}
 269
 270static bool mxt_object_readable(unsigned int type)
 271{
 272        switch (type) {
 273        case MXT_GEN_COMMAND_T6:
 274        case MXT_GEN_POWER_T7:
 275        case MXT_GEN_ACQUIRE_T8:
 276        case MXT_GEN_DATASOURCE_T53:
 277        case MXT_TOUCH_MULTI_T9:
 278        case MXT_TOUCH_KEYARRAY_T15:
 279        case MXT_TOUCH_PROXIMITY_T23:
 280        case MXT_TOUCH_PROXKEY_T52:
 281        case MXT_PROCI_GRIPFACE_T20:
 282        case MXT_PROCG_NOISE_T22:
 283        case MXT_PROCI_ONETOUCH_T24:
 284        case MXT_PROCI_TWOTOUCH_T27:
 285        case MXT_PROCI_GRIP_T40:
 286        case MXT_PROCI_PALM_T41:
 287        case MXT_PROCI_TOUCHSUPPRESSION_T42:
 288        case MXT_PROCI_STYLUS_T47:
 289        case MXT_PROCG_NOISESUPPRESSION_T48:
 290        case MXT_SPT_COMMSCONFIG_T18:
 291        case MXT_SPT_GPIOPWM_T19:
 292        case MXT_SPT_SELFTEST_T25:
 293        case MXT_SPT_CTECONFIG_T28:
 294        case MXT_SPT_USERDATA_T38:
 295        case MXT_SPT_DIGITIZER_T43:
 296        case MXT_SPT_CTECONFIG_T46:
 297                return true;
 298        default:
 299                return false;
 300        }
 301}
 302
 303static void mxt_dump_message(struct mxt_data *data, u8 *message)
 304{
 305        dev_dbg(&data->client->dev, "message: %*ph\n",
 306                data->T5_msg_size, message);
 307}
 308
 309static int mxt_wait_for_completion(struct mxt_data *data,
 310                                   struct completion *comp,
 311                                   unsigned int timeout_ms)
 312{
 313        struct device *dev = &data->client->dev;
 314        unsigned long timeout = msecs_to_jiffies(timeout_ms);
 315        long ret;
 316
 317        ret = wait_for_completion_interruptible_timeout(comp, timeout);
 318        if (ret < 0) {
 319                return ret;
 320        } else if (ret == 0) {
 321                dev_err(dev, "Wait for completion timed out.\n");
 322                return -ETIMEDOUT;
 323        }
 324        return 0;
 325}
 326
 327static int mxt_bootloader_read(struct mxt_data *data,
 328                               u8 *val, unsigned int count)
 329{
 330        int ret;
 331        struct i2c_msg msg;
 332
 333        msg.addr = data->bootloader_addr;
 334        msg.flags = data->client->flags & I2C_M_TEN;
 335        msg.flags |= I2C_M_RD;
 336        msg.len = count;
 337        msg.buf = val;
 338
 339        ret = i2c_transfer(data->client->adapter, &msg, 1);
 340        if (ret == 1) {
 341                ret = 0;
 342        } else {
 343                ret = ret < 0 ? ret : -EIO;
 344                dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
 345                        __func__, ret);
 346        }
 347
 348        return ret;
 349}
 350
 351static int mxt_bootloader_write(struct mxt_data *data,
 352                                const u8 * const val, unsigned int count)
 353{
 354        int ret;
 355        struct i2c_msg msg;
 356
 357        msg.addr = data->bootloader_addr;
 358        msg.flags = data->client->flags & I2C_M_TEN;
 359        msg.len = count;
 360        msg.buf = (u8 *)val;
 361
 362        ret = i2c_transfer(data->client->adapter, &msg, 1);
 363        if (ret == 1) {
 364                ret = 0;
 365        } else {
 366                ret = ret < 0 ? ret : -EIO;
 367                dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
 368                        __func__, ret);
 369        }
 370
 371        return ret;
 372}
 373
 374static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 375{
 376        u8 appmode = data->client->addr;
 377        u8 bootloader;
 378
 379        switch (appmode) {
 380        case 0x4a:
 381        case 0x4b:
 382                /* Chips after 1664S use different scheme */
 383                if (retry || data->info.family_id >= 0xa2) {
 384                        bootloader = appmode - 0x24;
 385                        break;
 386                }
 387                /* Fall through for normal case */
 388        case 0x4c:
 389        case 0x4d:
 390        case 0x5a:
 391        case 0x5b:
 392                bootloader = appmode - 0x26;
 393                break;
 394
 395        default:
 396                dev_err(&data->client->dev,
 397                        "Appmode i2c address 0x%02x not found\n",
 398                        appmode);
 399                return -EINVAL;
 400        }
 401
 402        data->bootloader_addr = bootloader;
 403        return 0;
 404}
 405
 406static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
 407{
 408        struct device *dev = &data->client->dev;
 409        int error;
 410        u8 val;
 411        bool crc_failure;
 412
 413        error = mxt_lookup_bootloader_address(data, alt_address);
 414        if (error)
 415                return error;
 416
 417        error = mxt_bootloader_read(data, &val, 1);
 418        if (error)
 419                return error;
 420
 421        /* Check app crc fail mode */
 422        crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
 423
 424        dev_err(dev, "Detected bootloader, status:%02X%s\n",
 425                        val, crc_failure ? ", APP_CRC_FAIL" : "");
 426
 427        return 0;
 428}
 429
 430static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
 431{
 432        struct device *dev = &data->client->dev;
 433        u8 buf[3];
 434
 435        if (val & MXT_BOOT_EXTENDED_ID) {
 436                if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
 437                        dev_err(dev, "%s: i2c failure\n", __func__);
 438                        return val;
 439                }
 440
 441                dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
 442
 443                return buf[0];
 444        } else {
 445                dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
 446
 447                return val;
 448        }
 449}
 450
 451static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
 452                                bool wait)
 453{
 454        struct device *dev = &data->client->dev;
 455        u8 val;
 456        int ret;
 457
 458recheck:
 459        if (wait) {
 460                /*
 461                 * In application update mode, the interrupt
 462                 * line signals state transitions. We must wait for the
 463                 * CHG assertion before reading the status byte.
 464                 * Once the status byte has been read, the line is deasserted.
 465                 */
 466                ret = mxt_wait_for_completion(data, &data->bl_completion,
 467                                              MXT_FW_CHG_TIMEOUT);
 468                if (ret) {
 469                        /*
 470                         * TODO: handle -ERESTARTSYS better by terminating
 471                         * fw update process before returning to userspace
 472                         * by writing length 0x000 to device (iff we are in
 473                         * WAITING_FRAME_DATA state).
 474                         */
 475                        dev_err(dev, "Update wait error %d\n", ret);
 476                        return ret;
 477                }
 478        }
 479
 480        ret = mxt_bootloader_read(data, &val, 1);
 481        if (ret)
 482                return ret;
 483
 484        if (state == MXT_WAITING_BOOTLOAD_CMD)
 485                val = mxt_get_bootloader_version(data, val);
 486
 487        switch (state) {
 488        case MXT_WAITING_BOOTLOAD_CMD:
 489        case MXT_WAITING_FRAME_DATA:
 490        case MXT_APP_CRC_FAIL:
 491                val &= ~MXT_BOOT_STATUS_MASK;
 492                break;
 493        case MXT_FRAME_CRC_PASS:
 494                if (val == MXT_FRAME_CRC_CHECK) {
 495                        goto recheck;
 496                } else if (val == MXT_FRAME_CRC_FAIL) {
 497                        dev_err(dev, "Bootloader CRC fail\n");
 498                        return -EINVAL;
 499                }
 500                break;
 501        default:
 502                return -EINVAL;
 503        }
 504
 505        if (val != state) {
 506                dev_err(dev, "Invalid bootloader state %02X != %02X\n",
 507                        val, state);
 508                return -EINVAL;
 509        }
 510
 511        return 0;
 512}
 513
 514static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
 515{
 516        int ret;
 517        u8 buf[2];
 518
 519        if (unlock) {
 520                buf[0] = MXT_UNLOCK_CMD_LSB;
 521                buf[1] = MXT_UNLOCK_CMD_MSB;
 522        } else {
 523                buf[0] = 0x01;
 524                buf[1] = 0x01;
 525        }
 526
 527        ret = mxt_bootloader_write(data, buf, 2);
 528        if (ret)
 529                return ret;
 530
 531        return 0;
 532}
 533
 534static int __mxt_read_reg(struct i2c_client *client,
 535                               u16 reg, u16 len, void *val)
 536{
 537        struct i2c_msg xfer[2];
 538        u8 buf[2];
 539        int ret;
 540
 541        buf[0] = reg & 0xff;
 542        buf[1] = (reg >> 8) & 0xff;
 543
 544        /* Write register */
 545        xfer[0].addr = client->addr;
 546        xfer[0].flags = 0;
 547        xfer[0].len = 2;
 548        xfer[0].buf = buf;
 549
 550        /* Read data */
 551        xfer[1].addr = client->addr;
 552        xfer[1].flags = I2C_M_RD;
 553        xfer[1].len = len;
 554        xfer[1].buf = val;
 555
 556        ret = i2c_transfer(client->adapter, xfer, 2);
 557        if (ret == 2) {
 558                ret = 0;
 559        } else {
 560                if (ret >= 0)
 561                        ret = -EIO;
 562                dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
 563                        __func__, ret);
 564        }
 565
 566        return ret;
 567}
 568
 569static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
 570                           const void *val)
 571{
 572        u8 *buf;
 573        size_t count;
 574        int ret;
 575
 576        count = len + 2;
 577        buf = kmalloc(count, GFP_KERNEL);
 578        if (!buf)
 579                return -ENOMEM;
 580
 581        buf[0] = reg & 0xff;
 582        buf[1] = (reg >> 8) & 0xff;
 583        memcpy(&buf[2], val, len);
 584
 585        ret = i2c_master_send(client, buf, count);
 586        if (ret == count) {
 587                ret = 0;
 588        } else {
 589                if (ret >= 0)
 590                        ret = -EIO;
 591                dev_err(&client->dev, "%s: i2c send failed (%d)\n",
 592                        __func__, ret);
 593        }
 594
 595        kfree(buf);
 596        return ret;
 597}
 598
 599static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
 600{
 601        return __mxt_write_reg(client, reg, 1, &val);
 602}
 603
 604static struct mxt_object *
 605mxt_get_object(struct mxt_data *data, u8 type)
 606{
 607        struct mxt_object *object;
 608        int i;
 609
 610        for (i = 0; i < data->info.object_num; i++) {
 611                object = data->object_table + i;
 612                if (object->type == type)
 613                        return object;
 614        }
 615
 616        dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
 617        return NULL;
 618}
 619
 620static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
 621{
 622        struct device *dev = &data->client->dev;
 623        u8 status = msg[1];
 624        u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
 625
 626        complete(&data->crc_completion);
 627
 628        if (crc != data->config_crc) {
 629                data->config_crc = crc;
 630                dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
 631        }
 632
 633        /* Detect reset */
 634        if (status & MXT_T6_STATUS_RESET)
 635                complete(&data->reset_completion);
 636
 637        /* Output debug if status has changed */
 638        if (status != data->t6_status)
 639                dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
 640                        status,
 641                        status == 0 ? " OK" : "",
 642                        status & MXT_T6_STATUS_RESET ? " RESET" : "",
 643                        status & MXT_T6_STATUS_OFL ? " OFL" : "",
 644                        status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
 645                        status & MXT_T6_STATUS_CAL ? " CAL" : "",
 646                        status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
 647                        status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
 648
 649        /* Save current status */
 650        data->t6_status = status;
 651}
 652
 653static int mxt_write_object(struct mxt_data *data,
 654                                 u8 type, u8 offset, u8 val)
 655{
 656        struct mxt_object *object;
 657        u16 reg;
 658
 659        object = mxt_get_object(data, type);
 660        if (!object || offset >= mxt_obj_size(object))
 661                return -EINVAL;
 662
 663        reg = object->start_address;
 664        return mxt_write_reg(data->client, reg + offset, val);
 665}
 666
 667static void mxt_input_button(struct mxt_data *data, u8 *message)
 668{
 669        struct input_dev *input = data->input_dev;
 670        const struct mxt_platform_data *pdata = data->pdata;
 671        int i;
 672
 673        for (i = 0; i < pdata->t19_num_keys; i++) {
 674                if (pdata->t19_keymap[i] == KEY_RESERVED)
 675                        continue;
 676
 677                /* Active-low switch */
 678                input_report_key(input, pdata->t19_keymap[i],
 679                                 !(message[1] & BIT(i)));
 680        }
 681}
 682
 683static void mxt_input_sync(struct mxt_data *data)
 684{
 685        input_mt_report_pointer_emulation(data->input_dev,
 686                                          data->pdata->t19_num_keys);
 687        input_sync(data->input_dev);
 688}
 689
 690static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
 691{
 692        struct device *dev = &data->client->dev;
 693        struct input_dev *input_dev = data->input_dev;
 694        int id;
 695        u8 status;
 696        int x;
 697        int y;
 698        int area;
 699        int amplitude;
 700
 701        id = message[0] - data->T9_reportid_min;
 702        status = message[1];
 703        x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
 704        y = (message[3] << 4) | ((message[4] & 0xf));
 705
 706        /* Handle 10/12 bit switching */
 707        if (data->max_x < 1024)
 708                x >>= 2;
 709        if (data->max_y < 1024)
 710                y >>= 2;
 711
 712        area = message[5];
 713        amplitude = message[6];
 714
 715        dev_dbg(dev,
 716                "[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
 717                id,
 718                (status & MXT_T9_DETECT) ? 'D' : '.',
 719                (status & MXT_T9_PRESS) ? 'P' : '.',
 720                (status & MXT_T9_RELEASE) ? 'R' : '.',
 721                (status & MXT_T9_MOVE) ? 'M' : '.',
 722                (status & MXT_T9_VECTOR) ? 'V' : '.',
 723                (status & MXT_T9_AMP) ? 'A' : '.',
 724                (status & MXT_T9_SUPPRESS) ? 'S' : '.',
 725                (status & MXT_T9_UNGRIP) ? 'U' : '.',
 726                x, y, area, amplitude);
 727
 728        input_mt_slot(input_dev, id);
 729
 730        if (status & MXT_T9_DETECT) {
 731                /*
 732                 * Multiple bits may be set if the host is slow to read
 733                 * the status messages, indicating all the events that
 734                 * have happened.
 735                 */
 736                if (status & MXT_T9_RELEASE) {
 737                        input_mt_report_slot_state(input_dev,
 738                                                   MT_TOOL_FINGER, 0);
 739                        mxt_input_sync(data);
 740                }
 741
 742                /* Touch active */
 743                input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
 744                input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 745                input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 746                input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
 747                input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
 748        } else {
 749                /* Touch no longer active, close out slot */
 750                input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 0);
 751        }
 752
 753        data->update_input = true;
 754}
 755
 756static void mxt_proc_t100_message(struct mxt_data *data, u8 *message)
 757{
 758        struct device *dev = &data->client->dev;
 759        struct input_dev *input_dev = data->input_dev;
 760        int id;
 761        u8 status;
 762        u8 type = 0;
 763        u16 x;
 764        u16 y;
 765        int distance = 0;
 766        int tool = 0;
 767        u8 major = 0;
 768        u8 pressure = 0;
 769        u8 orientation = 0;
 770
 771        id = message[0] - data->T100_reportid_min - 2;
 772
 773        /* ignore SCRSTATUS events */
 774        if (id < 0)
 775                return;
 776
 777        status = message[1];
 778        x = get_unaligned_le16(&message[2]);
 779        y = get_unaligned_le16(&message[4]);
 780
 781        if (status & MXT_T100_DETECT) {
 782                type = (status & MXT_T100_TYPE_MASK) >> 4;
 783
 784                switch (type) {
 785                case MXT_T100_TYPE_HOVERING_FINGER:
 786                        tool = MT_TOOL_FINGER;
 787                        distance = MXT_DISTANCE_HOVERING;
 788
 789                        if (data->t100_aux_vect)
 790                                orientation = message[data->t100_aux_vect];
 791
 792                        break;
 793
 794                case MXT_T100_TYPE_FINGER:
 795                case MXT_T100_TYPE_GLOVE:
 796                        tool = MT_TOOL_FINGER;
 797                        distance = MXT_DISTANCE_ACTIVE_TOUCH;
 798
 799                        if (data->t100_aux_area)
 800                                major = message[data->t100_aux_area];
 801
 802                        if (data->t100_aux_ampl)
 803                                pressure = message[data->t100_aux_ampl];
 804
 805                        if (data->t100_aux_vect)
 806                                orientation = message[data->t100_aux_vect];
 807
 808                        break;
 809
 810                case MXT_T100_TYPE_PASSIVE_STYLUS:
 811                        tool = MT_TOOL_PEN;
 812
 813                        /*
 814                         * Passive stylus is reported with size zero so
 815                         * hardcode.
 816                         */
 817                        major = MXT_TOUCH_MAJOR_DEFAULT;
 818
 819                        if (data->t100_aux_ampl)
 820                                pressure = message[data->t100_aux_ampl];
 821
 822                        break;
 823
 824                case MXT_T100_TYPE_LARGE_TOUCH:
 825                        /* Ignore suppressed touch */
 826                        break;
 827
 828                default:
 829                        dev_dbg(dev, "Unexpected T100 type\n");
 830                        return;
 831                }
 832        }
 833
 834        /*
 835         * Values reported should be non-zero if tool is touching the
 836         * device
 837         */
 838        if (!pressure && type != MXT_T100_TYPE_HOVERING_FINGER)
 839                pressure = MXT_PRESSURE_DEFAULT;
 840
 841        input_mt_slot(input_dev, id);
 842
 843        if (status & MXT_T100_DETECT) {
 844                dev_dbg(dev, "[%u] type:%u x:%u y:%u a:%02X p:%02X v:%02X\n",
 845                        id, type, x, y, major, pressure, orientation);
 846
 847                input_mt_report_slot_state(input_dev, tool, 1);
 848                input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 849                input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 850                input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, major);
 851                input_report_abs(input_dev, ABS_MT_PRESSURE, pressure);
 852                input_report_abs(input_dev, ABS_MT_DISTANCE, distance);
 853                input_report_abs(input_dev, ABS_MT_ORIENTATION, orientation);
 854        } else {
 855                dev_dbg(dev, "[%u] release\n", id);
 856
 857                /* close out slot */
 858                input_mt_report_slot_state(input_dev, 0, 0);
 859        }
 860
 861        data->update_input = true;
 862}
 863
 864static int mxt_proc_message(struct mxt_data *data, u8 *message)
 865{
 866        u8 report_id = message[0];
 867
 868        if (report_id == MXT_RPTID_NOMSG)
 869                return 0;
 870
 871        if (report_id == data->T6_reportid) {
 872                mxt_proc_t6_messages(data, message);
 873        } else if (!data->input_dev) {
 874                /*
 875                 * Do not report events if input device
 876                 * is not yet registered.
 877                 */
 878                mxt_dump_message(data, message);
 879        } else if (report_id >= data->T9_reportid_min &&
 880                   report_id <= data->T9_reportid_max) {
 881                mxt_proc_t9_message(data, message);
 882        } else if (report_id >= data->T100_reportid_min &&
 883                   report_id <= data->T100_reportid_max) {
 884                mxt_proc_t100_message(data, message);
 885        } else if (report_id == data->T19_reportid) {
 886                mxt_input_button(data, message);
 887                data->update_input = true;
 888        } else {
 889                mxt_dump_message(data, message);
 890        }
 891
 892        return 1;
 893}
 894
 895static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
 896{
 897        struct device *dev = &data->client->dev;
 898        int ret;
 899        int i;
 900        u8 num_valid = 0;
 901
 902        /* Safety check for msg_buf */
 903        if (count > data->max_reportid)
 904                return -EINVAL;
 905
 906        /* Process remaining messages if necessary */
 907        ret = __mxt_read_reg(data->client, data->T5_address,
 908                                data->T5_msg_size * count, data->msg_buf);
 909        if (ret) {
 910                dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
 911                return ret;
 912        }
 913
 914        for (i = 0;  i < count; i++) {
 915                ret = mxt_proc_message(data,
 916                        data->msg_buf + data->T5_msg_size * i);
 917
 918                if (ret == 1)
 919                        num_valid++;
 920        }
 921
 922        /* return number of messages read */
 923        return num_valid;
 924}
 925
 926static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
 927{
 928        struct device *dev = &data->client->dev;
 929        int ret;
 930        u8 count, num_left;
 931
 932        /* Read T44 and T5 together */
 933        ret = __mxt_read_reg(data->client, data->T44_address,
 934                data->T5_msg_size + 1, data->msg_buf);
 935        if (ret) {
 936                dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
 937                return IRQ_NONE;
 938        }
 939
 940        count = data->msg_buf[0];
 941
 942        /*
 943         * This condition may be caused by the CHG line being configured in
 944         * Mode 0. It results in unnecessary I2C operations but it is benign.
 945         */
 946        if (count == 0)
 947                return IRQ_NONE;
 948
 949        if (count > data->max_reportid) {
 950                dev_warn(dev, "T44 count %d exceeded max report id\n", count);
 951                count = data->max_reportid;
 952        }
 953
 954        /* Process first message */
 955        ret = mxt_proc_message(data, data->msg_buf + 1);
 956        if (ret < 0) {
 957                dev_warn(dev, "Unexpected invalid message\n");
 958                return IRQ_NONE;
 959        }
 960
 961        num_left = count - 1;
 962
 963        /* Process remaining messages if necessary */
 964        if (num_left) {
 965                ret = mxt_read_and_process_messages(data, num_left);
 966                if (ret < 0)
 967                        goto end;
 968                else if (ret != num_left)
 969                        dev_warn(dev, "Unexpected invalid message\n");
 970        }
 971
 972end:
 973        if (data->update_input) {
 974                mxt_input_sync(data);
 975                data->update_input = false;
 976        }
 977
 978        return IRQ_HANDLED;
 979}
 980
 981static int mxt_process_messages_until_invalid(struct mxt_data *data)
 982{
 983        struct device *dev = &data->client->dev;
 984        int count, read;
 985        u8 tries = 2;
 986
 987        count = data->max_reportid;
 988
 989        /* Read messages until we force an invalid */
 990        do {
 991                read = mxt_read_and_process_messages(data, count);
 992                if (read < count)
 993                        return 0;
 994        } while (--tries);
 995
 996        if (data->update_input) {
 997                mxt_input_sync(data);
 998                data->update_input = false;
 999        }
1000
1001        dev_err(dev, "CHG pin isn't cleared\n");
1002        return -EBUSY;
1003}
1004
1005static irqreturn_t mxt_process_messages(struct mxt_data *data)
1006{
1007        int total_handled, num_handled;
1008        u8 count = data->last_message_count;
1009
1010        if (count < 1 || count > data->max_reportid)
1011                count = 1;
1012
1013        /* include final invalid message */
1014        total_handled = mxt_read_and_process_messages(data, count + 1);
1015        if (total_handled < 0)
1016                return IRQ_NONE;
1017        /* if there were invalid messages, then we are done */
1018        else if (total_handled <= count)
1019                goto update_count;
1020
1021        /* keep reading two msgs until one is invalid or reportid limit */
1022        do {
1023                num_handled = mxt_read_and_process_messages(data, 2);
1024                if (num_handled < 0)
1025                        return IRQ_NONE;
1026
1027                total_handled += num_handled;
1028
1029                if (num_handled < 2)
1030                        break;
1031        } while (total_handled < data->num_touchids);
1032
1033update_count:
1034        data->last_message_count = total_handled;
1035
1036        if (data->update_input) {
1037                mxt_input_sync(data);
1038                data->update_input = false;
1039        }
1040
1041        return IRQ_HANDLED;
1042}
1043
1044static irqreturn_t mxt_interrupt(int irq, void *dev_id)
1045{
1046        struct mxt_data *data = dev_id;
1047
1048        if (data->in_bootloader) {
1049                /* bootloader state transition completion */
1050                complete(&data->bl_completion);
1051                return IRQ_HANDLED;
1052        }
1053
1054        if (!data->object_table)
1055                return IRQ_HANDLED;
1056
1057        if (data->T44_address) {
1058                return mxt_process_messages_t44(data);
1059        } else {
1060                return mxt_process_messages(data);
1061        }
1062}
1063
1064static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
1065                          u8 value, bool wait)
1066{
1067        u16 reg;
1068        u8 command_register;
1069        int timeout_counter = 0;
1070        int ret;
1071
1072        reg = data->T6_address + cmd_offset;
1073
1074        ret = mxt_write_reg(data->client, reg, value);
1075        if (ret)
1076                return ret;
1077
1078        if (!wait)
1079                return 0;
1080
1081        do {
1082                msleep(20);
1083                ret = __mxt_read_reg(data->client, reg, 1, &command_register);
1084                if (ret)
1085                        return ret;
1086        } while (command_register != 0 && timeout_counter++ <= 100);
1087
1088        if (timeout_counter > 100) {
1089                dev_err(&data->client->dev, "Command failed!\n");
1090                return -EIO;
1091        }
1092
1093        return 0;
1094}
1095
1096static int mxt_acquire_irq(struct mxt_data *data)
1097{
1098        int error;
1099
1100        enable_irq(data->irq);
1101
1102        error = mxt_process_messages_until_invalid(data);
1103        if (error)
1104                return error;
1105
1106        return 0;
1107}
1108
1109static int mxt_soft_reset(struct mxt_data *data)
1110{
1111        struct device *dev = &data->client->dev;
1112        int ret = 0;
1113
1114        dev_info(dev, "Resetting device\n");
1115
1116        disable_irq(data->irq);
1117
1118        reinit_completion(&data->reset_completion);
1119
1120        ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1121        if (ret)
1122                return ret;
1123
1124        /* Ignore CHG line for 100ms after reset */
1125        msleep(100);
1126
1127        mxt_acquire_irq(data);
1128
1129        ret = mxt_wait_for_completion(data, &data->reset_completion,
1130                                      MXT_RESET_TIMEOUT);
1131        if (ret)
1132                return ret;
1133
1134        return 0;
1135}
1136
1137static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1138{
1139        /*
1140         * On failure, CRC is set to 0 and config will always be
1141         * downloaded.
1142         */
1143        data->config_crc = 0;
1144        reinit_completion(&data->crc_completion);
1145
1146        mxt_t6_command(data, cmd, value, true);
1147
1148        /*
1149         * Wait for crc message. On failure, CRC is set to 0 and config will
1150         * always be downloaded.
1151         */
1152        mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1153}
1154
1155static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1156{
1157        static const unsigned int crcpoly = 0x80001B;
1158        u32 result;
1159        u32 data_word;
1160
1161        data_word = (secondbyte << 8) | firstbyte;
1162        result = ((*crc << 1) ^ data_word);
1163
1164        if (result & 0x1000000)
1165                result ^= crcpoly;
1166
1167        *crc = result;
1168}
1169
1170static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1171{
1172        u32 crc = 0;
1173        u8 *ptr = base + start_off;
1174        u8 *last_val = base + end_off - 1;
1175
1176        if (end_off < start_off)
1177                return -EINVAL;
1178
1179        while (ptr < last_val) {
1180                mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1181                ptr += 2;
1182        }
1183
1184        /* if len is odd, fill the last byte with 0 */
1185        if (ptr == last_val)
1186                mxt_calc_crc24(&crc, *ptr, 0);
1187
1188        /* Mask to 24-bit */
1189        crc &= 0x00FFFFFF;
1190
1191        return crc;
1192}
1193
1194static int mxt_prepare_cfg_mem(struct mxt_data *data,
1195                               const struct firmware *cfg,
1196                               unsigned int data_pos,
1197                               unsigned int cfg_start_ofs,
1198                               u8 *config_mem,
1199                               size_t config_mem_size)
1200{
1201        struct device *dev = &data->client->dev;
1202        struct mxt_object *object;
1203        unsigned int type, instance, size, byte_offset;
1204        int offset;
1205        int ret;
1206        int i;
1207        u16 reg;
1208        u8 val;
1209
1210        while (data_pos < cfg->size) {
1211                /* Read type, instance, length */
1212                ret = sscanf(cfg->data + data_pos, "%x %x %x%n",
1213                             &type, &instance, &size, &offset);
1214                if (ret == 0) {
1215                        /* EOF */
1216                        break;
1217                } else if (ret != 3) {
1218                        dev_err(dev, "Bad format: failed to parse object\n");
1219                        return -EINVAL;
1220                }
1221                data_pos += offset;
1222
1223                object = mxt_get_object(data, type);
1224                if (!object) {
1225                        /* Skip object */
1226                        for (i = 0; i < size; i++) {
1227                                ret = sscanf(cfg->data + data_pos, "%hhx%n",
1228                                             &val, &offset);
1229                                if (ret != 1) {
1230                                        dev_err(dev, "Bad format in T%d at %d\n",
1231                                                type, i);
1232                                        return -EINVAL;
1233                                }
1234                                data_pos += offset;
1235                        }
1236                        continue;
1237                }
1238
1239                if (size > mxt_obj_size(object)) {
1240                        /*
1241                         * Either we are in fallback mode due to wrong
1242                         * config or config from a later fw version,
1243                         * or the file is corrupt or hand-edited.
1244                         */
1245                        dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1246                                 size - mxt_obj_size(object), type);
1247                } else if (mxt_obj_size(object) > size) {
1248                        /*
1249                         * If firmware is upgraded, new bytes may be added to
1250                         * end of objects. It is generally forward compatible
1251                         * to zero these bytes - previous behaviour will be
1252                         * retained. However this does invalidate the CRC and
1253                         * will force fallback mode until the configuration is
1254                         * updated. We warn here but do nothing else - the
1255                         * malloc has zeroed the entire configuration.
1256                         */
1257                        dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1258                                 mxt_obj_size(object) - size, type);
1259                }
1260
1261                if (instance >= mxt_obj_instances(object)) {
1262                        dev_err(dev, "Object instances exceeded!\n");
1263                        return -EINVAL;
1264                }
1265
1266                reg = object->start_address + mxt_obj_size(object) * instance;
1267
1268                for (i = 0; i < size; i++) {
1269                        ret = sscanf(cfg->data + data_pos, "%hhx%n",
1270                                     &val,
1271                                     &offset);
1272                        if (ret != 1) {
1273                                dev_err(dev, "Bad format in T%d at %d\n",
1274                                        type, i);
1275                                return -EINVAL;
1276                        }
1277                        data_pos += offset;
1278
1279                        if (i > mxt_obj_size(object))
1280                                continue;
1281
1282                        byte_offset = reg + i - cfg_start_ofs;
1283
1284                        if (byte_offset >= 0 && byte_offset < config_mem_size) {
1285                                *(config_mem + byte_offset) = val;
1286                        } else {
1287                                dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1288                                        reg, object->type, byte_offset);
1289                                return -EINVAL;
1290                        }
1291                }
1292        }
1293
1294        return 0;
1295}
1296
1297static int mxt_upload_cfg_mem(struct mxt_data *data, unsigned int cfg_start,
1298                              u8 *config_mem, size_t config_mem_size)
1299{
1300        unsigned int byte_offset = 0;
1301        int error;
1302
1303        /* Write configuration as blocks */
1304        while (byte_offset < config_mem_size) {
1305                unsigned int size = config_mem_size - byte_offset;
1306
1307                if (size > MXT_MAX_BLOCK_WRITE)
1308                        size = MXT_MAX_BLOCK_WRITE;
1309
1310                error = __mxt_write_reg(data->client,
1311                                        cfg_start + byte_offset,
1312                                        size, config_mem + byte_offset);
1313                if (error) {
1314                        dev_err(&data->client->dev,
1315                                "Config write error, ret=%d\n", error);
1316                        return error;
1317                }
1318
1319                byte_offset += size;
1320        }
1321
1322        return 0;
1323}
1324
1325static int mxt_init_t7_power_cfg(struct mxt_data *data);
1326
1327/*
1328 * mxt_update_cfg - download configuration to chip
1329 *
1330 * Atmel Raw Config File Format
1331 *
1332 * The first four lines of the raw config file contain:
1333 *  1) Version
1334 *  2) Chip ID Information (first 7 bytes of device memory)
1335 *  3) Chip Information Block 24-bit CRC Checksum
1336 *  4) Chip Configuration 24-bit CRC Checksum
1337 *
1338 * The rest of the file consists of one line per object instance:
1339 *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1340 *
1341 *   <TYPE> - 2-byte object type as hex
1342 *   <INSTANCE> - 2-byte object instance number as hex
1343 *   <SIZE> - 2-byte object size as hex
1344 *   <CONTENTS> - array of <SIZE> 1-byte hex values
1345 */
1346static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
1347{
1348        struct device *dev = &data->client->dev;
1349        struct mxt_info cfg_info;
1350        int ret;
1351        int offset;
1352        int data_pos;
1353        int i;
1354        int cfg_start_ofs;
1355        u32 info_crc, config_crc, calculated_crc;
1356        u8 *config_mem;
1357        size_t config_mem_size;
1358
1359        mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1360
1361        if (strncmp(cfg->data, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1362                dev_err(dev, "Unrecognised config file\n");
1363                return -EINVAL;
1364        }
1365
1366        data_pos = strlen(MXT_CFG_MAGIC);
1367
1368        /* Load information block and check */
1369        for (i = 0; i < sizeof(struct mxt_info); i++) {
1370                ret = sscanf(cfg->data + data_pos, "%hhx%n",
1371                             (unsigned char *)&cfg_info + i,
1372                             &offset);
1373                if (ret != 1) {
1374                        dev_err(dev, "Bad format\n");
1375                        return -EINVAL;
1376                }
1377
1378                data_pos += offset;
1379        }
1380
1381        if (cfg_info.family_id != data->info.family_id) {
1382                dev_err(dev, "Family ID mismatch!\n");
1383                return -EINVAL;
1384        }
1385
1386        if (cfg_info.variant_id != data->info.variant_id) {
1387                dev_err(dev, "Variant ID mismatch!\n");
1388                return -EINVAL;
1389        }
1390
1391        /* Read CRCs */
1392        ret = sscanf(cfg->data + data_pos, "%x%n", &info_crc, &offset);
1393        if (ret != 1) {
1394                dev_err(dev, "Bad format: failed to parse Info CRC\n");
1395                return -EINVAL;
1396        }
1397        data_pos += offset;
1398
1399        ret = sscanf(cfg->data + data_pos, "%x%n", &config_crc, &offset);
1400        if (ret != 1) {
1401                dev_err(dev, "Bad format: failed to parse Config CRC\n");
1402                return -EINVAL;
1403        }
1404        data_pos += offset;
1405
1406        /*
1407         * The Info Block CRC is calculated over mxt_info and the object
1408         * table. If it does not match then we are trying to load the
1409         * configuration from a different chip or firmware version, so
1410         * the configuration CRC is invalid anyway.
1411         */
1412        if (info_crc == data->info_crc) {
1413                if (config_crc == 0 || data->config_crc == 0) {
1414                        dev_info(dev, "CRC zero, attempting to apply config\n");
1415                } else if (config_crc == data->config_crc) {
1416                        dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1417                                 data->config_crc);
1418                        return 0;
1419                } else {
1420                        dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1421                                 data->config_crc, config_crc);
1422                }
1423        } else {
1424                dev_warn(dev,
1425                         "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1426                         data->info_crc, info_crc);
1427        }
1428
1429        /* Malloc memory to store configuration */
1430        cfg_start_ofs = MXT_OBJECT_START +
1431                        data->info.object_num * sizeof(struct mxt_object) +
1432                        MXT_INFO_CHECKSUM_SIZE;
1433        config_mem_size = data->mem_size - cfg_start_ofs;
1434        config_mem = kzalloc(config_mem_size, GFP_KERNEL);
1435        if (!config_mem) {
1436                dev_err(dev, "Failed to allocate memory\n");
1437                return -ENOMEM;
1438        }
1439
1440        ret = mxt_prepare_cfg_mem(data, cfg, data_pos, cfg_start_ofs,
1441                                  config_mem, config_mem_size);
1442        if (ret)
1443                goto release_mem;
1444
1445        /* Calculate crc of the received configs (not the raw config file) */
1446        if (data->T7_address < cfg_start_ofs) {
1447                dev_err(dev, "Bad T7 address, T7addr = %x, config offset %x\n",
1448                        data->T7_address, cfg_start_ofs);
1449                ret = 0;
1450                goto release_mem;
1451        }
1452
1453        calculated_crc = mxt_calculate_crc(config_mem,
1454                                           data->T7_address - cfg_start_ofs,
1455                                           config_mem_size);
1456
1457        if (config_crc > 0 && config_crc != calculated_crc)
1458                dev_warn(dev, "Config CRC error, calculated=%06X, file=%06X\n",
1459                         calculated_crc, config_crc);
1460
1461        ret = mxt_upload_cfg_mem(data, cfg_start_ofs,
1462                                 config_mem, config_mem_size);
1463        if (ret)
1464                goto release_mem;
1465
1466        mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1467
1468        ret = mxt_soft_reset(data);
1469        if (ret)
1470                goto release_mem;
1471
1472        dev_info(dev, "Config successfully updated\n");
1473
1474        /* T7 config may have changed */
1475        mxt_init_t7_power_cfg(data);
1476
1477release_mem:
1478        kfree(config_mem);
1479        return ret;
1480}
1481
1482static int mxt_get_info(struct mxt_data *data)
1483{
1484        struct i2c_client *client = data->client;
1485        struct mxt_info *info = &data->info;
1486        int error;
1487
1488        /* Read 7-byte info block starting at address 0 */
1489        error = __mxt_read_reg(client, 0, sizeof(*info), info);
1490        if (error)
1491                return error;
1492
1493        return 0;
1494}
1495
1496static void mxt_free_input_device(struct mxt_data *data)
1497{
1498        if (data->input_dev) {
1499                input_unregister_device(data->input_dev);
1500                data->input_dev = NULL;
1501        }
1502}
1503
1504static void mxt_free_object_table(struct mxt_data *data)
1505{
1506        kfree(data->object_table);
1507        data->object_table = NULL;
1508        kfree(data->msg_buf);
1509        data->msg_buf = NULL;
1510        data->T5_address = 0;
1511        data->T5_msg_size = 0;
1512        data->T6_reportid = 0;
1513        data->T7_address = 0;
1514        data->T9_reportid_min = 0;
1515        data->T9_reportid_max = 0;
1516        data->T19_reportid = 0;
1517        data->T44_address = 0;
1518        data->T100_reportid_min = 0;
1519        data->T100_reportid_max = 0;
1520        data->max_reportid = 0;
1521}
1522
1523static int mxt_get_object_table(struct mxt_data *data)
1524{
1525        struct i2c_client *client = data->client;
1526        size_t table_size;
1527        struct mxt_object *object_table;
1528        int error;
1529        int i;
1530        u8 reportid;
1531        u16 end_address;
1532
1533        table_size = data->info.object_num * sizeof(struct mxt_object);
1534        object_table = kzalloc(table_size, GFP_KERNEL);
1535        if (!object_table) {
1536                dev_err(&data->client->dev, "Failed to allocate memory\n");
1537                return -ENOMEM;
1538        }
1539
1540        error = __mxt_read_reg(client, MXT_OBJECT_START, table_size,
1541                        object_table);
1542        if (error) {
1543                kfree(object_table);
1544                return error;
1545        }
1546
1547        /* Valid Report IDs start counting from 1 */
1548        reportid = 1;
1549        data->mem_size = 0;
1550        for (i = 0; i < data->info.object_num; i++) {
1551                struct mxt_object *object = object_table + i;
1552                u8 min_id, max_id;
1553
1554                le16_to_cpus(&object->start_address);
1555
1556                if (object->num_report_ids) {
1557                        min_id = reportid;
1558                        reportid += object->num_report_ids *
1559                                        mxt_obj_instances(object);
1560                        max_id = reportid - 1;
1561                } else {
1562                        min_id = 0;
1563                        max_id = 0;
1564                }
1565
1566                dev_dbg(&data->client->dev,
1567                        "T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1568                        object->type, object->start_address,
1569                        mxt_obj_size(object), mxt_obj_instances(object),
1570                        min_id, max_id);
1571
1572                switch (object->type) {
1573                case MXT_GEN_MESSAGE_T5:
1574                        if (data->info.family_id == 0x80 &&
1575                            data->info.version < 0x20) {
1576                                /*
1577                                 * On mXT224 firmware versions prior to V2.0
1578                                 * read and discard unused CRC byte otherwise
1579                                 * DMA reads are misaligned.
1580                                 */
1581                                data->T5_msg_size = mxt_obj_size(object);
1582                        } else {
1583                                /* CRC not enabled, so skip last byte */
1584                                data->T5_msg_size = mxt_obj_size(object) - 1;
1585                        }
1586                        data->T5_address = object->start_address;
1587                        break;
1588                case MXT_GEN_COMMAND_T6:
1589                        data->T6_reportid = min_id;
1590                        data->T6_address = object->start_address;
1591                        break;
1592                case MXT_GEN_POWER_T7:
1593                        data->T7_address = object->start_address;
1594                        break;
1595                case MXT_TOUCH_MULTI_T9:
1596                        data->multitouch = MXT_TOUCH_MULTI_T9;
1597                        data->T9_reportid_min = min_id;
1598                        data->T9_reportid_max = max_id;
1599                        data->num_touchids = object->num_report_ids
1600                                                * mxt_obj_instances(object);
1601                        break;
1602                case MXT_SPT_MESSAGECOUNT_T44:
1603                        data->T44_address = object->start_address;
1604                        break;
1605                case MXT_SPT_GPIOPWM_T19:
1606                        data->T19_reportid = min_id;
1607                        break;
1608                case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1609                        data->multitouch = MXT_TOUCH_MULTITOUCHSCREEN_T100;
1610                        data->T100_reportid_min = min_id;
1611                        data->T100_reportid_max = max_id;
1612                        /* first two report IDs reserved */
1613                        data->num_touchids = object->num_report_ids - 2;
1614                        break;
1615                }
1616
1617                end_address = object->start_address
1618                        + mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1619
1620                if (end_address >= data->mem_size)
1621                        data->mem_size = end_address + 1;
1622        }
1623
1624        /* Store maximum reportid */
1625        data->max_reportid = reportid;
1626
1627        /* If T44 exists, T5 position has to be directly after */
1628        if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1629                dev_err(&client->dev, "Invalid T44 position\n");
1630                error = -EINVAL;
1631                goto free_object_table;
1632        }
1633
1634        data->msg_buf = kcalloc(data->max_reportid,
1635                                data->T5_msg_size, GFP_KERNEL);
1636        if (!data->msg_buf) {
1637                dev_err(&client->dev, "Failed to allocate message buffer\n");
1638                error = -ENOMEM;
1639                goto free_object_table;
1640        }
1641
1642        data->object_table = object_table;
1643
1644        return 0;
1645
1646free_object_table:
1647        mxt_free_object_table(data);
1648        return error;
1649}
1650
1651static int mxt_read_t9_resolution(struct mxt_data *data)
1652{
1653        struct i2c_client *client = data->client;
1654        int error;
1655        struct t9_range range;
1656        unsigned char orient;
1657        struct mxt_object *object;
1658
1659        object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1660        if (!object)
1661                return -EINVAL;
1662
1663        error = __mxt_read_reg(client,
1664                               object->start_address + MXT_T9_RANGE,
1665                               sizeof(range), &range);
1666        if (error)
1667                return error;
1668
1669        data->max_x = get_unaligned_le16(&range.x);
1670        data->max_y = get_unaligned_le16(&range.y);
1671
1672        error =  __mxt_read_reg(client,
1673                                object->start_address + MXT_T9_ORIENT,
1674                                1, &orient);
1675        if (error)
1676                return error;
1677
1678        data->xy_switch = orient & MXT_T9_ORIENT_SWITCH;
1679
1680        return 0;
1681}
1682
1683static int mxt_read_t100_config(struct mxt_data *data)
1684{
1685        struct i2c_client *client = data->client;
1686        int error;
1687        struct mxt_object *object;
1688        u16 range_x, range_y;
1689        u8 cfg, tchaux;
1690        u8 aux;
1691
1692        object = mxt_get_object(data, MXT_TOUCH_MULTITOUCHSCREEN_T100);
1693        if (!object)
1694                return -EINVAL;
1695
1696        /* read touchscreen dimensions */
1697        error = __mxt_read_reg(client,
1698                               object->start_address + MXT_T100_XRANGE,
1699                               sizeof(range_x), &range_x);
1700        if (error)
1701                return error;
1702
1703        data->max_x = get_unaligned_le16(&range_x);
1704
1705        error = __mxt_read_reg(client,
1706                               object->start_address + MXT_T100_YRANGE,
1707                               sizeof(range_y), &range_y);
1708        if (error)
1709                return error;
1710
1711        data->max_y = get_unaligned_le16(&range_y);
1712
1713        /* read orientation config */
1714        error =  __mxt_read_reg(client,
1715                                object->start_address + MXT_T100_CFG1,
1716                                1, &cfg);
1717        if (error)
1718                return error;
1719
1720        data->xy_switch = cfg & MXT_T100_CFG_SWITCHXY;
1721
1722        /* allocate aux bytes */
1723        error =  __mxt_read_reg(client,
1724                                object->start_address + MXT_T100_TCHAUX,
1725                                1, &tchaux);
1726        if (error)
1727                return error;
1728
1729        aux = 6;
1730
1731        if (tchaux & MXT_T100_TCHAUX_VECT)
1732                data->t100_aux_vect = aux++;
1733
1734        if (tchaux & MXT_T100_TCHAUX_AMPL)
1735                data->t100_aux_ampl = aux++;
1736
1737        if (tchaux & MXT_T100_TCHAUX_AREA)
1738                data->t100_aux_area = aux++;
1739
1740        dev_dbg(&client->dev,
1741                "T100 aux mappings vect:%u ampl:%u area:%u\n",
1742                data->t100_aux_vect, data->t100_aux_ampl, data->t100_aux_area);
1743
1744        return 0;
1745}
1746
1747static int mxt_input_open(struct input_dev *dev);
1748static void mxt_input_close(struct input_dev *dev);
1749
1750static void mxt_set_up_as_touchpad(struct input_dev *input_dev,
1751                                   struct mxt_data *data)
1752{
1753        const struct mxt_platform_data *pdata = data->pdata;
1754        int i;
1755
1756        input_dev->name = "Atmel maXTouch Touchpad";
1757
1758        __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1759
1760        input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1761        input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1762        input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1763                          MXT_PIXELS_PER_MM);
1764        input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1765                          MXT_PIXELS_PER_MM);
1766
1767        for (i = 0; i < pdata->t19_num_keys; i++)
1768                if (pdata->t19_keymap[i] != KEY_RESERVED)
1769                        input_set_capability(input_dev, EV_KEY,
1770                                             pdata->t19_keymap[i]);
1771}
1772
1773static int mxt_initialize_input_device(struct mxt_data *data)
1774{
1775        const struct mxt_platform_data *pdata = data->pdata;
1776        struct device *dev = &data->client->dev;
1777        struct input_dev *input_dev;
1778        int error;
1779        unsigned int num_mt_slots;
1780        unsigned int mt_flags = 0;
1781
1782        switch (data->multitouch) {
1783        case MXT_TOUCH_MULTI_T9:
1784                num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
1785                error = mxt_read_t9_resolution(data);
1786                if (error)
1787                        dev_warn(dev, "Failed to initialize T9 resolution\n");
1788                break;
1789
1790        case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1791                num_mt_slots = data->num_touchids;
1792                error = mxt_read_t100_config(data);
1793                if (error)
1794                        dev_warn(dev, "Failed to read T100 config\n");
1795                break;
1796
1797        default:
1798                dev_err(dev, "Invalid multitouch object\n");
1799                return -EINVAL;
1800        }
1801
1802        /* Handle default values and orientation switch */
1803        if (data->max_x == 0)
1804                data->max_x = 1023;
1805
1806        if (data->max_y == 0)
1807                data->max_y = 1023;
1808
1809        if (data->xy_switch)
1810                swap(data->max_x, data->max_y);
1811
1812        dev_info(dev, "Touchscreen size X%uY%u\n", data->max_x, data->max_y);
1813
1814        /* Register input device */
1815        input_dev = input_allocate_device();
1816        if (!input_dev) {
1817                dev_err(dev, "Failed to allocate memory\n");
1818                return -ENOMEM;
1819        }
1820
1821        input_dev->name = "Atmel maXTouch Touchscreen";
1822        input_dev->phys = data->phys;
1823        input_dev->id.bustype = BUS_I2C;
1824        input_dev->dev.parent = dev;
1825        input_dev->open = mxt_input_open;
1826        input_dev->close = mxt_input_close;
1827
1828        input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
1829
1830        /* For single touch */
1831        input_set_abs_params(input_dev, ABS_X, 0, data->max_x, 0, 0);
1832        input_set_abs_params(input_dev, ABS_Y, 0, data->max_y, 0, 0);
1833
1834        if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
1835            (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1836             data->t100_aux_ampl)) {
1837                input_set_abs_params(input_dev, ABS_PRESSURE, 0, 255, 0, 0);
1838        }
1839
1840        /* If device has buttons we assume it is a touchpad */
1841        if (pdata->t19_num_keys) {
1842                mxt_set_up_as_touchpad(input_dev, data);
1843                mt_flags |= INPUT_MT_POINTER;
1844        } else {
1845                mt_flags |= INPUT_MT_DIRECT;
1846        }
1847
1848        /* For multi touch */
1849        error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
1850        if (error) {
1851                dev_err(dev, "Error %d initialising slots\n", error);
1852                goto err_free_mem;
1853        }
1854
1855        if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100) {
1856                input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
1857                                     0, MT_TOOL_MAX, 0, 0);
1858                input_set_abs_params(input_dev, ABS_MT_DISTANCE,
1859                                     MXT_DISTANCE_ACTIVE_TOUCH,
1860                                     MXT_DISTANCE_HOVERING,
1861                                     0, 0);
1862        }
1863
1864        input_set_abs_params(input_dev, ABS_MT_POSITION_X,
1865                             0, data->max_x, 0, 0);
1866        input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
1867                             0, data->max_y, 0, 0);
1868
1869        if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
1870            (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1871             data->t100_aux_area)) {
1872                input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
1873                                     0, MXT_MAX_AREA, 0, 0);
1874        }
1875
1876        if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
1877            (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1878             data->t100_aux_ampl)) {
1879                input_set_abs_params(input_dev, ABS_MT_PRESSURE,
1880                                     0, 255, 0, 0);
1881        }
1882
1883        if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1884            data->t100_aux_vect) {
1885                input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
1886                                     0, 255, 0, 0);
1887        }
1888
1889        if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1890            data->t100_aux_ampl) {
1891                input_set_abs_params(input_dev, ABS_MT_PRESSURE,
1892                                     0, 255, 0, 0);
1893        }
1894
1895        if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1896            data->t100_aux_vect) {
1897                input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
1898                                     0, 255, 0, 0);
1899        }
1900
1901        input_set_drvdata(input_dev, data);
1902
1903        error = input_register_device(input_dev);
1904        if (error) {
1905                dev_err(dev, "Error %d registering input device\n", error);
1906                goto err_free_mem;
1907        }
1908
1909        data->input_dev = input_dev;
1910
1911        return 0;
1912
1913err_free_mem:
1914        input_free_device(input_dev);
1915        return error;
1916}
1917
1918static int mxt_configure_objects(struct mxt_data *data,
1919                                 const struct firmware *cfg);
1920
1921static void mxt_config_cb(const struct firmware *cfg, void *ctx)
1922{
1923        mxt_configure_objects(ctx, cfg);
1924        release_firmware(cfg);
1925}
1926
1927static int mxt_initialize(struct mxt_data *data)
1928{
1929        struct i2c_client *client = data->client;
1930        int recovery_attempts = 0;
1931        int error;
1932
1933        while (1) {
1934                error = mxt_get_info(data);
1935                if (!error)
1936                        break;
1937
1938                /* Check bootloader state */
1939                error = mxt_probe_bootloader(data, false);
1940                if (error) {
1941                        dev_info(&client->dev, "Trying alternate bootloader address\n");
1942                        error = mxt_probe_bootloader(data, true);
1943                        if (error) {
1944                                /* Chip is not in appmode or bootloader mode */
1945                                return error;
1946                        }
1947                }
1948
1949                /* OK, we are in bootloader, see if we can recover */
1950                if (++recovery_attempts > 1) {
1951                        dev_err(&client->dev, "Could not recover from bootloader mode\n");
1952                        /*
1953                         * We can reflash from this state, so do not
1954                         * abort initialization.
1955                         */
1956                        data->in_bootloader = true;
1957                        return 0;
1958                }
1959
1960                /* Attempt to exit bootloader into app mode */
1961                mxt_send_bootloader_cmd(data, false);
1962                msleep(MXT_FW_RESET_TIME);
1963        }
1964
1965        /* Get object table information */
1966        error = mxt_get_object_table(data);
1967        if (error) {
1968                dev_err(&client->dev, "Error %d reading object table\n", error);
1969                return error;
1970        }
1971
1972        error = mxt_acquire_irq(data);
1973        if (error)
1974                goto err_free_object_table;
1975
1976        error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
1977                                        &client->dev, GFP_KERNEL, data,
1978                                        mxt_config_cb);
1979        if (error) {
1980                dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
1981                        error);
1982                goto err_free_object_table;
1983        }
1984
1985        return 0;
1986
1987err_free_object_table:
1988        mxt_free_object_table(data);
1989        return error;
1990}
1991
1992static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
1993{
1994        struct device *dev = &data->client->dev;
1995        int error;
1996        struct t7_config *new_config;
1997        struct t7_config deepsleep = { .active = 0, .idle = 0 };
1998
1999        if (sleep == MXT_POWER_CFG_DEEPSLEEP)
2000                new_config = &deepsleep;
2001        else
2002                new_config = &data->t7_cfg;
2003
2004        error = __mxt_write_reg(data->client, data->T7_address,
2005                                sizeof(data->t7_cfg), new_config);
2006        if (error)
2007                return error;
2008
2009        dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
2010                new_config->active, new_config->idle);
2011
2012        return 0;
2013}
2014
2015static int mxt_init_t7_power_cfg(struct mxt_data *data)
2016{
2017        struct device *dev = &data->client->dev;
2018        int error;
2019        bool retry = false;
2020
2021recheck:
2022        error = __mxt_read_reg(data->client, data->T7_address,
2023                                sizeof(data->t7_cfg), &data->t7_cfg);
2024        if (error)
2025                return error;
2026
2027        if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
2028                if (!retry) {
2029                        dev_dbg(dev, "T7 cfg zero, resetting\n");
2030                        mxt_soft_reset(data);
2031                        retry = true;
2032                        goto recheck;
2033                } else {
2034                        dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
2035                        data->t7_cfg.active = 20;
2036                        data->t7_cfg.idle = 100;
2037                        return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2038                }
2039        }
2040
2041        dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
2042                data->t7_cfg.active, data->t7_cfg.idle);
2043        return 0;
2044}
2045
2046static int mxt_configure_objects(struct mxt_data *data,
2047                                 const struct firmware *cfg)
2048{
2049        struct device *dev = &data->client->dev;
2050        struct mxt_info *info = &data->info;
2051        int error;
2052
2053        error = mxt_init_t7_power_cfg(data);
2054        if (error) {
2055                dev_err(dev, "Failed to initialize power cfg\n");
2056                return error;
2057        }
2058
2059        if (cfg) {
2060                error = mxt_update_cfg(data, cfg);
2061                if (error)
2062                        dev_warn(dev, "Error %d updating config\n", error);
2063        }
2064
2065        if (data->multitouch) {
2066                error = mxt_initialize_input_device(data);
2067                if (error)
2068                        return error;
2069        } else {
2070                dev_warn(dev, "No touch object detected\n");
2071        }
2072
2073        dev_info(dev,
2074                 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
2075                 info->family_id, info->variant_id, info->version >> 4,
2076                 info->version & 0xf, info->build, info->object_num);
2077
2078        return 0;
2079}
2080
2081/* Firmware Version is returned as Major.Minor.Build */
2082static ssize_t mxt_fw_version_show(struct device *dev,
2083                                   struct device_attribute *attr, char *buf)
2084{
2085        struct mxt_data *data = dev_get_drvdata(dev);
2086        struct mxt_info *info = &data->info;
2087        return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
2088                         info->version >> 4, info->version & 0xf, info->build);
2089}
2090
2091/* Hardware Version is returned as FamilyID.VariantID */
2092static ssize_t mxt_hw_version_show(struct device *dev,
2093                                   struct device_attribute *attr, char *buf)
2094{
2095        struct mxt_data *data = dev_get_drvdata(dev);
2096        struct mxt_info *info = &data->info;
2097        return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
2098                         info->family_id, info->variant_id);
2099}
2100
2101static ssize_t mxt_show_instance(char *buf, int count,
2102                                 struct mxt_object *object, int instance,
2103                                 const u8 *val)
2104{
2105        int i;
2106
2107        if (mxt_obj_instances(object) > 1)
2108                count += scnprintf(buf + count, PAGE_SIZE - count,
2109                                   "Instance %u\n", instance);
2110
2111        for (i = 0; i < mxt_obj_size(object); i++)
2112                count += scnprintf(buf + count, PAGE_SIZE - count,
2113                                "\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
2114        count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
2115
2116        return count;
2117}
2118
2119static ssize_t mxt_object_show(struct device *dev,
2120                                    struct device_attribute *attr, char *buf)
2121{
2122        struct mxt_data *data = dev_get_drvdata(dev);
2123        struct mxt_object *object;
2124        int count = 0;
2125        int i, j;
2126        int error;
2127        u8 *obuf;
2128
2129        /* Pre-allocate buffer large enough to hold max sized object. */
2130        obuf = kmalloc(256, GFP_KERNEL);
2131        if (!obuf)
2132                return -ENOMEM;
2133
2134        error = 0;
2135        for (i = 0; i < data->info.object_num; i++) {
2136                object = data->object_table + i;
2137
2138                if (!mxt_object_readable(object->type))
2139                        continue;
2140
2141                count += scnprintf(buf + count, PAGE_SIZE - count,
2142                                "T%u:\n", object->type);
2143
2144                for (j = 0; j < mxt_obj_instances(object); j++) {
2145                        u16 size = mxt_obj_size(object);
2146                        u16 addr = object->start_address + j * size;
2147
2148                        error = __mxt_read_reg(data->client, addr, size, obuf);
2149                        if (error)
2150                                goto done;
2151
2152                        count = mxt_show_instance(buf, count, object, j, obuf);
2153                }
2154        }
2155
2156done:
2157        kfree(obuf);
2158        return error ?: count;
2159}
2160
2161static int mxt_check_firmware_format(struct device *dev,
2162                                     const struct firmware *fw)
2163{
2164        unsigned int pos = 0;
2165        char c;
2166
2167        while (pos < fw->size) {
2168                c = *(fw->data + pos);
2169
2170                if (c < '0' || (c > '9' && c < 'A') || c > 'F')
2171                        return 0;
2172
2173                pos++;
2174        }
2175
2176        /*
2177         * To convert file try:
2178         * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
2179         */
2180        dev_err(dev, "Aborting: firmware file must be in binary format\n");
2181
2182        return -EINVAL;
2183}
2184
2185static int mxt_load_fw(struct device *dev, const char *fn)
2186{
2187        struct mxt_data *data = dev_get_drvdata(dev);
2188        const struct firmware *fw = NULL;
2189        unsigned int frame_size;
2190        unsigned int pos = 0;
2191        unsigned int retry = 0;
2192        unsigned int frame = 0;
2193        int ret;
2194
2195        ret = request_firmware(&fw, fn, dev);
2196        if (ret) {
2197                dev_err(dev, "Unable to open firmware %s\n", fn);
2198                return ret;
2199        }
2200
2201        /* Check for incorrect enc file */
2202        ret = mxt_check_firmware_format(dev, fw);
2203        if (ret)
2204                goto release_firmware;
2205
2206        if (!data->in_bootloader) {
2207                /* Change to the bootloader mode */
2208                data->in_bootloader = true;
2209
2210                ret = mxt_t6_command(data, MXT_COMMAND_RESET,
2211                                     MXT_BOOT_VALUE, false);
2212                if (ret)
2213                        goto release_firmware;
2214
2215                msleep(MXT_RESET_TIME);
2216
2217                /* Do not need to scan since we know family ID */
2218                ret = mxt_lookup_bootloader_address(data, 0);
2219                if (ret)
2220                        goto release_firmware;
2221
2222                mxt_free_input_device(data);
2223                mxt_free_object_table(data);
2224        } else {
2225                enable_irq(data->irq);
2226        }
2227
2228        reinit_completion(&data->bl_completion);
2229
2230        ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
2231        if (ret) {
2232                /* Bootloader may still be unlocked from previous attempt */
2233                ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
2234                if (ret)
2235                        goto disable_irq;
2236        } else {
2237                dev_info(dev, "Unlocking bootloader\n");
2238
2239                /* Unlock bootloader */
2240                ret = mxt_send_bootloader_cmd(data, true);
2241                if (ret)
2242                        goto disable_irq;
2243        }
2244
2245        while (pos < fw->size) {
2246                ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
2247                if (ret)
2248                        goto disable_irq;
2249
2250                frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
2251
2252                /* Take account of CRC bytes */
2253                frame_size += 2;
2254
2255                /* Write one frame to device */
2256                ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
2257                if (ret)
2258                        goto disable_irq;
2259
2260                ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
2261                if (ret) {
2262                        retry++;
2263
2264                        /* Back off by 20ms per retry */
2265                        msleep(retry * 20);
2266
2267                        if (retry > 20) {
2268                                dev_err(dev, "Retry count exceeded\n");
2269                                goto disable_irq;
2270                        }
2271                } else {
2272                        retry = 0;
2273                        pos += frame_size;
2274                        frame++;
2275                }
2276
2277                if (frame % 50 == 0)
2278                        dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
2279                                frame, pos, fw->size);
2280        }
2281
2282        /* Wait for flash. */
2283        ret = mxt_wait_for_completion(data, &data->bl_completion,
2284                                      MXT_FW_RESET_TIME);
2285        if (ret)
2286                goto disable_irq;
2287
2288        dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
2289
2290        /*
2291         * Wait for device to reset. Some bootloader versions do not assert
2292         * the CHG line after bootloading has finished, so ignore potential
2293         * errors.
2294         */
2295        mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
2296
2297        data->in_bootloader = false;
2298
2299disable_irq:
2300        disable_irq(data->irq);
2301release_firmware:
2302        release_firmware(fw);
2303        return ret;
2304}
2305
2306static ssize_t mxt_update_fw_store(struct device *dev,
2307                                        struct device_attribute *attr,
2308                                        const char *buf, size_t count)
2309{
2310        struct mxt_data *data = dev_get_drvdata(dev);
2311        int error;
2312
2313        error = mxt_load_fw(dev, MXT_FW_NAME);
2314        if (error) {
2315                dev_err(dev, "The firmware update failed(%d)\n", error);
2316                count = error;
2317        } else {
2318                dev_info(dev, "The firmware update succeeded\n");
2319
2320                error = mxt_initialize(data);
2321                if (error)
2322                        return error;
2323        }
2324
2325        return count;
2326}
2327
2328static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2329static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2330static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2331static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2332
2333static struct attribute *mxt_attrs[] = {
2334        &dev_attr_fw_version.attr,
2335        &dev_attr_hw_version.attr,
2336        &dev_attr_object.attr,
2337        &dev_attr_update_fw.attr,
2338        NULL
2339};
2340
2341static const struct attribute_group mxt_attr_group = {
2342        .attrs = mxt_attrs,
2343};
2344
2345static void mxt_start(struct mxt_data *data)
2346{
2347        switch (data->pdata->suspend_mode) {
2348        case MXT_SUSPEND_T9_CTRL:
2349                mxt_soft_reset(data);
2350
2351                /* Touch enable */
2352                /* 0x83 = SCANEN | RPTEN | ENABLE */
2353                mxt_write_object(data,
2354                                MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0x83);
2355                break;
2356
2357        case MXT_SUSPEND_DEEP_SLEEP:
2358        default:
2359                mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2360
2361                /* Recalibrate since chip has been in deep sleep */
2362                mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
2363                break;
2364        }
2365
2366}
2367
2368static void mxt_stop(struct mxt_data *data)
2369{
2370        switch (data->pdata->suspend_mode) {
2371        case MXT_SUSPEND_T9_CTRL:
2372                /* Touch disable */
2373                mxt_write_object(data,
2374                                MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0);
2375                break;
2376
2377        case MXT_SUSPEND_DEEP_SLEEP:
2378        default:
2379                mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
2380                break;
2381        }
2382}
2383
2384static int mxt_input_open(struct input_dev *dev)
2385{
2386        struct mxt_data *data = input_get_drvdata(dev);
2387
2388        mxt_start(data);
2389
2390        return 0;
2391}
2392
2393static void mxt_input_close(struct input_dev *dev)
2394{
2395        struct mxt_data *data = input_get_drvdata(dev);
2396
2397        mxt_stop(data);
2398}
2399
2400#ifdef CONFIG_OF
2401static const struct mxt_platform_data *mxt_parse_dt(struct i2c_client *client)
2402{
2403        struct mxt_platform_data *pdata;
2404        struct device_node *np = client->dev.of_node;
2405        u32 *keymap;
2406        int proplen, ret;
2407
2408        if (!np)
2409                return ERR_PTR(-ENOENT);
2410
2411        pdata = devm_kzalloc(&client->dev, sizeof(*pdata), GFP_KERNEL);
2412        if (!pdata)
2413                return ERR_PTR(-ENOMEM);
2414
2415        if (of_find_property(np, "linux,gpio-keymap", &proplen)) {
2416                pdata->t19_num_keys = proplen / sizeof(u32);
2417
2418                keymap = devm_kzalloc(&client->dev,
2419                                pdata->t19_num_keys * sizeof(keymap[0]),
2420                                GFP_KERNEL);
2421                if (!keymap)
2422                        return ERR_PTR(-ENOMEM);
2423
2424                ret = of_property_read_u32_array(np, "linux,gpio-keymap",
2425                                                 keymap, pdata->t19_num_keys);
2426                if (ret)
2427                        dev_warn(&client->dev,
2428                                 "Couldn't read linux,gpio-keymap: %d\n", ret);
2429
2430                pdata->t19_keymap = keymap;
2431        }
2432
2433        pdata->suspend_mode = MXT_SUSPEND_DEEP_SLEEP;
2434
2435        return pdata;
2436}
2437#else
2438static const struct mxt_platform_data *mxt_parse_dt(struct i2c_client *client)
2439{
2440        return ERR_PTR(-ENOENT);
2441}
2442#endif
2443
2444#ifdef CONFIG_ACPI
2445
2446struct mxt_acpi_platform_data {
2447        const char *hid;
2448        struct mxt_platform_data pdata;
2449};
2450
2451static unsigned int samus_touchpad_buttons[] = {
2452        KEY_RESERVED,
2453        KEY_RESERVED,
2454        KEY_RESERVED,
2455        BTN_LEFT
2456};
2457
2458static struct mxt_acpi_platform_data samus_platform_data[] = {
2459        {
2460                /* Touchpad */
2461                .hid    = "ATML0000",
2462                .pdata  = {
2463                        .t19_num_keys   = ARRAY_SIZE(samus_touchpad_buttons),
2464                        .t19_keymap     = samus_touchpad_buttons,
2465                },
2466        },
2467        {
2468                /* Touchscreen */
2469                .hid    = "ATML0001",
2470        },
2471        { }
2472};
2473
2474static unsigned int chromebook_tp_buttons[] = {
2475        KEY_RESERVED,
2476        KEY_RESERVED,
2477        KEY_RESERVED,
2478        KEY_RESERVED,
2479        KEY_RESERVED,
2480        BTN_LEFT
2481};
2482
2483static struct mxt_acpi_platform_data chromebook_platform_data[] = {
2484        {
2485                /* Touchpad */
2486                .hid    = "ATML0000",
2487                .pdata  = {
2488                        .t19_num_keys   = ARRAY_SIZE(chromebook_tp_buttons),
2489                        .t19_keymap     = chromebook_tp_buttons,
2490                },
2491        },
2492        {
2493                /* Touchscreen */
2494                .hid    = "ATML0001",
2495        },
2496        { }
2497};
2498
2499static const struct dmi_system_id mxt_dmi_table[] = {
2500        {
2501                /* 2015 Google Pixel */
2502                .ident = "Chromebook Pixel 2",
2503                .matches = {
2504                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
2505                        DMI_MATCH(DMI_PRODUCT_NAME, "Samus"),
2506                },
2507                .driver_data = samus_platform_data,
2508        },
2509        {
2510                /* Other Google Chromebooks */
2511                .ident = "Chromebook",
2512                .matches = {
2513                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
2514                },
2515                .driver_data = chromebook_platform_data,
2516        },
2517        { }
2518};
2519
2520static const struct mxt_platform_data *mxt_parse_acpi(struct i2c_client *client)
2521{
2522        struct acpi_device *adev;
2523        const struct dmi_system_id *system_id;
2524        const struct mxt_acpi_platform_data *acpi_pdata;
2525
2526        /*
2527         * Ignore ACPI devices representing bootloader mode.
2528         *
2529         * This is a bit of a hack: Google Chromebook BIOS creates ACPI
2530         * devices for both application and bootloader modes, but we are
2531         * interested in application mode only (if device is in bootloader
2532         * mode we'll end up switching into application anyway). So far
2533         * application mode addresses were all above 0x40, so we'll use it
2534         * as a threshold.
2535         */
2536        if (client->addr < 0x40)
2537                return ERR_PTR(-ENXIO);
2538
2539        adev = ACPI_COMPANION(&client->dev);
2540        if (!adev)
2541                return ERR_PTR(-ENOENT);
2542
2543        system_id = dmi_first_match(mxt_dmi_table);
2544        if (!system_id)
2545                return ERR_PTR(-ENOENT);
2546
2547        acpi_pdata = system_id->driver_data;
2548        if (!acpi_pdata)
2549                return ERR_PTR(-ENOENT);
2550
2551        while (acpi_pdata->hid) {
2552                if (!strcmp(acpi_device_hid(adev), acpi_pdata->hid))
2553                        return &acpi_pdata->pdata;
2554
2555                acpi_pdata++;
2556        }
2557
2558        return ERR_PTR(-ENOENT);
2559}
2560#else
2561static const struct mxt_platform_data *mxt_parse_acpi(struct i2c_client *client)
2562{
2563        return ERR_PTR(-ENOENT);
2564}
2565#endif
2566
2567static const struct mxt_platform_data *
2568mxt_get_platform_data(struct i2c_client *client)
2569{
2570        const struct mxt_platform_data *pdata;
2571
2572        pdata = dev_get_platdata(&client->dev);
2573        if (pdata)
2574                return pdata;
2575
2576        pdata = mxt_parse_dt(client);
2577        if (!IS_ERR(pdata) || PTR_ERR(pdata) != -ENOENT)
2578                return pdata;
2579
2580        pdata = mxt_parse_acpi(client);
2581        if (!IS_ERR(pdata) || PTR_ERR(pdata) != -ENOENT)
2582                return pdata;
2583
2584        dev_err(&client->dev, "No platform data specified\n");
2585        return ERR_PTR(-EINVAL);
2586}
2587
2588static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
2589{
2590        struct mxt_data *data;
2591        const struct mxt_platform_data *pdata;
2592        int error;
2593
2594        pdata = mxt_get_platform_data(client);
2595        if (IS_ERR(pdata))
2596                return PTR_ERR(pdata);
2597
2598        data = kzalloc(sizeof(struct mxt_data), GFP_KERNEL);
2599        if (!data) {
2600                dev_err(&client->dev, "Failed to allocate memory\n");
2601                return -ENOMEM;
2602        }
2603
2604        snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
2605                 client->adapter->nr, client->addr);
2606
2607        data->client = client;
2608        data->pdata = pdata;
2609        data->irq = client->irq;
2610        i2c_set_clientdata(client, data);
2611
2612        init_completion(&data->bl_completion);
2613        init_completion(&data->reset_completion);
2614        init_completion(&data->crc_completion);
2615
2616        error = request_threaded_irq(client->irq, NULL, mxt_interrupt,
2617                                     pdata->irqflags | IRQF_ONESHOT,
2618                                     client->name, data);
2619        if (error) {
2620                dev_err(&client->dev, "Failed to register interrupt\n");
2621                goto err_free_mem;
2622        }
2623
2624        disable_irq(client->irq);
2625
2626        error = mxt_initialize(data);
2627        if (error)
2628                goto err_free_irq;
2629
2630        error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
2631        if (error) {
2632                dev_err(&client->dev, "Failure %d creating sysfs group\n",
2633                        error);
2634                goto err_free_object;
2635        }
2636
2637        return 0;
2638
2639err_free_object:
2640        mxt_free_input_device(data);
2641        mxt_free_object_table(data);
2642err_free_irq:
2643        free_irq(client->irq, data);
2644err_free_mem:
2645        kfree(data);
2646        return error;
2647}
2648
2649static int mxt_remove(struct i2c_client *client)
2650{
2651        struct mxt_data *data = i2c_get_clientdata(client);
2652
2653        sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
2654        free_irq(data->irq, data);
2655        mxt_free_input_device(data);
2656        mxt_free_object_table(data);
2657        kfree(data);
2658
2659        return 0;
2660}
2661
2662static int __maybe_unused mxt_suspend(struct device *dev)
2663{
2664        struct i2c_client *client = to_i2c_client(dev);
2665        struct mxt_data *data = i2c_get_clientdata(client);
2666        struct input_dev *input_dev = data->input_dev;
2667
2668        if (!input_dev)
2669                return 0;
2670
2671        mutex_lock(&input_dev->mutex);
2672
2673        if (input_dev->users)
2674                mxt_stop(data);
2675
2676        mutex_unlock(&input_dev->mutex);
2677
2678        return 0;
2679}
2680
2681static int __maybe_unused mxt_resume(struct device *dev)
2682{
2683        struct i2c_client *client = to_i2c_client(dev);
2684        struct mxt_data *data = i2c_get_clientdata(client);
2685        struct input_dev *input_dev = data->input_dev;
2686
2687        if (!input_dev)
2688                return 0;
2689
2690        mutex_lock(&input_dev->mutex);
2691
2692        if (input_dev->users)
2693                mxt_start(data);
2694
2695        mutex_unlock(&input_dev->mutex);
2696
2697        return 0;
2698}
2699
2700static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
2701
2702static const struct of_device_id mxt_of_match[] = {
2703        { .compatible = "atmel,maxtouch", },
2704        {},
2705};
2706MODULE_DEVICE_TABLE(of, mxt_of_match);
2707
2708#ifdef CONFIG_ACPI
2709static const struct acpi_device_id mxt_acpi_id[] = {
2710        { "ATML0000", 0 },      /* Touchpad */
2711        { "ATML0001", 0 },      /* Touchscreen */
2712        { }
2713};
2714MODULE_DEVICE_TABLE(acpi, mxt_acpi_id);
2715#endif
2716
2717static const struct i2c_device_id mxt_id[] = {
2718        { "qt602240_ts", 0 },
2719        { "atmel_mxt_ts", 0 },
2720        { "atmel_mxt_tp", 0 },
2721        { "maxtouch", 0 },
2722        { "mXT224", 0 },
2723        { }
2724};
2725MODULE_DEVICE_TABLE(i2c, mxt_id);
2726
2727static struct i2c_driver mxt_driver = {
2728        .driver = {
2729                .name   = "atmel_mxt_ts",
2730                .of_match_table = of_match_ptr(mxt_of_match),
2731                .acpi_match_table = ACPI_PTR(mxt_acpi_id),
2732                .pm     = &mxt_pm_ops,
2733        },
2734        .probe          = mxt_probe,
2735        .remove         = mxt_remove,
2736        .id_table       = mxt_id,
2737};
2738
2739module_i2c_driver(mxt_driver);
2740
2741/* Module information */
2742MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
2743MODULE_DESCRIPTION("Atmel maXTouch Touchscreen driver");
2744MODULE_LICENSE("GPL");
2745