drivers/input/touchscreen/atmel_mxt_ts.c

   1 /*
   2  * Atmel maXTouch Touchscreen driver
   3  *
   4  * Copyright (C) 2010 Samsung Electronics Co.Ltd
   5  * Copyright (C) 2011-2014 Atmel Corporation
   6  * Copyright (C) 2012 Google, Inc.
   7  * Copyright (C) 2016 Zodiac Inflight Innovations
   8  *
   9  * Author: Joonyoung Shim <jy0922.shim@samsung.com>
  10  *
  11  * This program is free software; you can redistribute  it and/or modify it
  12  * under  the terms of  the GNU General  Public License as published by the
  13  * Free Software Foundation;  either version 2 of the  License, or (at your
  14  * option) any later version.
  15  *
  16  */
  17
  18 #include <linux/acpi.h>
  19 #include <linux/dmi.h>
  20 #include <linux/module.h>
  21 #include <linux/init.h>
  22 #include <linux/completion.h>
  23 #include <linux/delay.h>
  24 #include <linux/firmware.h>
  25 #include <linux/i2c.h>
  26 #include <linux/input/mt.h>
  27 #include <linux/interrupt.h>
  28 #include <linux/of.h>
  29 #include <linux/property.h>
  30 #include <linux/slab.h>
  31 #include <linux/gpio/consumer.h>
  32 #include <asm/unaligned.h>
  33 #include <media/v4l2-device.h>
  34 #include <media/v4l2-ioctl.h>
  35 #include <media/videobuf2-v4l2.h>
  36 #include <media/videobuf2-vmalloc.h>
  37
  38 /* Firmware files */
  39 #define MXT_FW_NAME             "maxtouch.fw"
  40 #define MXT_CFG_NAME            "maxtouch.cfg"
  41 #define MXT_CFG_MAGIC           "OBP_RAW V1"
  42
  43 /* Registers */
  44 #define MXT_OBJECT_START        0x07
  45 #define MXT_OBJECT_SIZE         6
  46 #define MXT_INFO_CHECKSUM_SIZE  3
  47 #define MXT_MAX_BLOCK_WRITE     256
  48
  49 /* Object types */
  50 #define MXT_DEBUG_DIAGNOSTIC_T37        37
  51 #define MXT_GEN_MESSAGE_T5              5
  52 #define MXT_GEN_COMMAND_T6              6
  53 #define MXT_GEN_POWER_T7                7
  54 #define MXT_GEN_ACQUIRE_T8              8
  55 #define MXT_GEN_DATASOURCE_T53          53
  56 #define MXT_TOUCH_MULTI_T9              9
  57 #define MXT_TOUCH_KEYARRAY_T15          15
  58 #define MXT_TOUCH_PROXIMITY_T23         23
  59 #define MXT_TOUCH_PROXKEY_T52           52
  60 #define MXT_PROCI_GRIPFACE_T20          20
  61 #define MXT_PROCG_NOISE_T22             22
  62 #define MXT_PROCI_ONETOUCH_T24          24
  63 #define MXT_PROCI_TWOTOUCH_T27          27
  64 #define MXT_PROCI_GRIP_T40              40
  65 #define MXT_PROCI_PALM_T41              41
  66 #define MXT_PROCI_TOUCHSUPPRESSION_T42  42
  67 #define MXT_PROCI_STYLUS_T47            47
  68 #define MXT_PROCG_NOISESUPPRESSION_T48  48
  69 #define MXT_SPT_COMMSCONFIG_T18         18
  70 #define MXT_SPT_GPIOPWM_T19             19
  71 #define MXT_SPT_SELFTEST_T25            25
  72 #define MXT_SPT_CTECONFIG_T28           28
  73 #define MXT_SPT_USERDATA_T38            38
  74 #define MXT_SPT_DIGITIZER_T43           43
  75 #define MXT_SPT_MESSAGECOUNT_T44        44
  76 #define MXT_SPT_CTECONFIG_T46           46
  77 #define MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71 71
  78 #define MXT_TOUCH_MULTITOUCHSCREEN_T100 100
  79
  80 /* MXT_GEN_MESSAGE_T5 object */
  81 #define MXT_RPTID_NOMSG         0xff
  82
  83 /* MXT_GEN_COMMAND_T6 field */
  84 #define MXT_COMMAND_RESET       0
  85 #define MXT_COMMAND_BACKUPNV    1
  86 #define MXT_COMMAND_CALIBRATE   2
  87 #define MXT_COMMAND_REPORTALL   3
  88 #define MXT_COMMAND_DIAGNOSTIC  5
  89
  90 /* Define for T6 status byte */
  91 #define MXT_T6_STATUS_RESET     BIT(7)
  92 #define MXT_T6_STATUS_OFL       BIT(6)
  93 #define MXT_T6_STATUS_SIGERR    BIT(5)
  94 #define MXT_T6_STATUS_CAL       BIT(4)
  95 #define MXT_T6_STATUS_CFGERR    BIT(3)
  96 #define MXT_T6_STATUS_COMSERR   BIT(2)
  97
  98 /* MXT_GEN_POWER_T7 field */
  99 struct t7_config {
 100         u8 idle;
 101         u8 active;
 102 } __packed;
 103
 104 #define MXT_POWER_CFG_RUN               0
 105 #define MXT_POWER_CFG_DEEPSLEEP         1
 106
 107 /* MXT_TOUCH_MULTI_T9 field */
 108 #define MXT_T9_CTRL             0
 109 #define MXT_T9_XSIZE            3
 110 #define MXT_T9_YSIZE            4
 111 #define MXT_T9_ORIENT           9
 112 #define MXT_T9_RANGE            18
 113
 114 /* MXT_TOUCH_MULTI_T9 status */
 115 #define MXT_T9_UNGRIP           BIT(0)
 116 #define MXT_T9_SUPPRESS         BIT(1)
 117 #define MXT_T9_AMP              BIT(2)
 118 #define MXT_T9_VECTOR           BIT(3)
 119 #define MXT_T9_MOVE             BIT(4)
 120 #define MXT_T9_RELEASE          BIT(5)
 121 #define MXT_T9_PRESS            BIT(6)
 122 #define MXT_T9_DETECT           BIT(7)
 123
 124 struct t9_range {
 125         __le16 x;
 126         __le16 y;
 127 } __packed;
 128
 129 /* MXT_TOUCH_MULTI_T9 orient */
 130 #define MXT_T9_ORIENT_SWITCH    BIT(0)
 131 #define MXT_T9_ORIENT_INVERTX   BIT(1)
 132 #define MXT_T9_ORIENT_INVERTY   BIT(2)
 133
 134 /* MXT_SPT_COMMSCONFIG_T18 */
 135 #define MXT_COMMS_CTRL          0
 136 #define MXT_COMMS_CMD           1
 137
 138 /* MXT_DEBUG_DIAGNOSTIC_T37 */
 139 #define MXT_DIAGNOSTIC_PAGEUP   0x01
 140 #define MXT_DIAGNOSTIC_DELTAS   0x10
 141 #define MXT_DIAGNOSTIC_REFS     0x11
 142 #define MXT_DIAGNOSTIC_SIZE     128
 143
 144 #define MXT_FAMILY_1386                 160
 145 #define MXT1386_COLUMNS                 3
 146 #define MXT1386_PAGES_PER_COLUMN        8
 147
 148 struct t37_debug {
 149 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
 150         u8 mode;
 151         u8 page;
 152         u8 data[MXT_DIAGNOSTIC_SIZE];
 153 #endif
 154 };
 155
 156 /* Define for MXT_GEN_COMMAND_T6 */
 157 #define MXT_BOOT_VALUE          0xa5
 158 #define MXT_RESET_VALUE         0x01
 159 #define MXT_BACKUP_VALUE        0x55
 160
 161 /* T100 Multiple Touch Touchscreen */
 162 #define MXT_T100_CTRL           0
 163 #define MXT_T100_CFG1           1
 164 #define MXT_T100_TCHAUX         3
 165 #define MXT_T100_XSIZE          9
 166 #define MXT_T100_XRANGE         13
 167 #define MXT_T100_YSIZE          20
 168 #define MXT_T100_YRANGE         24
 169
 170 #define MXT_T100_CFG_SWITCHXY   BIT(5)
 171 #define MXT_T100_CFG_INVERTY    BIT(6)
 172 #define MXT_T100_CFG_INVERTX    BIT(7)
 173
 174 #define MXT_T100_TCHAUX_VECT    BIT(0)
 175 #define MXT_T100_TCHAUX_AMPL    BIT(1)
 176 #define MXT_T100_TCHAUX_AREA    BIT(2)
 177
 178 #define MXT_T100_DETECT         BIT(7)
 179 #define MXT_T100_TYPE_MASK      0x70
 180
 181 enum t100_type {
 182         MXT_T100_TYPE_FINGER            = 1,
 183         MXT_T100_TYPE_PASSIVE_STYLUS    = 2,
 184         MXT_T100_TYPE_HOVERING_FINGER   = 4,
 185         MXT_T100_TYPE_GLOVE             = 5,
 186         MXT_T100_TYPE_LARGE_TOUCH       = 6,
 187 };
 188
 189 #define MXT_DISTANCE_ACTIVE_TOUCH       0
 190 #define MXT_DISTANCE_HOVERING           1
 191
 192 #define MXT_TOUCH_MAJOR_DEFAULT         1
 193 #define MXT_PRESSURE_DEFAULT            1
 194
 195 /* Delay times */
 196 #define MXT_BACKUP_TIME         50      /* msec */
 197 #define MXT_RESET_GPIO_TIME     20      /* msec */
 198 #define MXT_RESET_INVALID_CHG   100     /* msec */
 199 #define MXT_RESET_TIME          200     /* msec */
 200 #define MXT_RESET_TIMEOUT       3000    /* msec */
 201 #define MXT_CRC_TIMEOUT         1000    /* msec */
 202 #define MXT_FW_RESET_TIME       3000    /* msec */
 203 #define MXT_FW_CHG_TIMEOUT      300     /* msec */
 204
 205 /* Command to unlock bootloader */
 206 #define MXT_UNLOCK_CMD_MSB      0xaa
 207 #define MXT_UNLOCK_CMD_LSB      0xdc
 208
 209 /* Bootloader mode status */
 210 #define MXT_WAITING_BOOTLOAD_CMD        0xc0    /* valid 7 6 bit only */
 211 #define MXT_WAITING_FRAME_DATA  0x80    /* valid 7 6 bit only */
 212 #define MXT_FRAME_CRC_CHECK     0x02
 213 #define MXT_FRAME_CRC_FAIL      0x03
 214 #define MXT_FRAME_CRC_PASS      0x04
 215 #define MXT_APP_CRC_FAIL        0x40    /* valid 7 8 bit only */
 216 #define MXT_BOOT_STATUS_MASK    0x3f
 217 #define MXT_BOOT_EXTENDED_ID    BIT(5)
 218 #define MXT_BOOT_ID_MASK        0x1f
 219
 220 /* Touchscreen absolute values */
 221 #define MXT_MAX_AREA            0xff
 222
 223 #define MXT_PIXELS_PER_MM       20
 224
 225 struct mxt_info {
 226         u8 family_id;
 227         u8 variant_id;
 228         u8 version;
 229         u8 build;
 230         u8 matrix_xsize;
 231         u8 matrix_ysize;
 232         u8 object_num;
 233 };
 234
 235 struct mxt_object {
 236         u8 type;
 237         u16 start_address;
 238         u8 size_minus_one;
 239         u8 instances_minus_one;
 240         u8 num_report_ids;
 241 } __packed;
 242
 243 struct mxt_dbg {
 244         u16 t37_address;
 245         u16 diag_cmd_address;
 246         struct t37_debug *t37_buf;
 247         unsigned int t37_pages;
 248         unsigned int t37_nodes;
 249
 250         struct v4l2_device v4l2;
 251         struct v4l2_pix_format format;
 252         struct video_device vdev;
 253         struct vb2_queue queue;
 254         struct mutex lock;
 255         int input;
 256 };
 257
 258 enum v4l_dbg_inputs {
 259         MXT_V4L_INPUT_DELTAS,
 260         MXT_V4L_INPUT_REFS,
 261         MXT_V4L_INPUT_MAX,
 262 };
 263
 264 enum mxt_suspend_mode {
 265         MXT_SUSPEND_DEEP_SLEEP  = 0,
 266         MXT_SUSPEND_T9_CTRL     = 1,
 267 };
 268
 269 /* Config update context */
 270 struct mxt_cfg {
 271         u8 *raw;
 272         size_t raw_size;
 273         off_t raw_pos;
 274
 275         u8 *mem;
 276         size_t mem_size;
 277         int start_ofs;
 278
 279         struct mxt_info info;
 280 };
 281
 282 /* Each client has this additional data */
 283 struct mxt_data {
 284         struct i2c_client *client;
 285         struct input_dev *input_dev;
 286         char phys[64];          /* device physical location */
 287         struct mxt_object *object_table;
 288         struct mxt_info *info;
 289         void *raw_info_block;
 290         unsigned int irq;
 291         unsigned int max_x;
 292         unsigned int max_y;
 293         bool invertx;
 294         bool inverty;
 295         bool xy_switch;
 296         u8 xsize;
 297         u8 ysize;
 298         bool in_bootloader;
 299         u16 mem_size;
 300         u8 t100_aux_ampl;
 301         u8 t100_aux_area;
 302         u8 t100_aux_vect;
 303         u8 max_reportid;
 304         u32 config_crc;
 305         u32 info_crc;
 306         u8 bootloader_addr;
 307         u8 *msg_buf;
 308         u8 t6_status;
 309         bool update_input;
 310         u8 last_message_count;
 311         u8 num_touchids;
 312         u8 multitouch;
 313         struct t7_config t7_cfg;
 314         struct mxt_dbg dbg;
 315         struct gpio_desc *reset_gpio;
 316
 317         /* Cached parameters from object table */
 318         u16 T5_address;
 319         u8 T5_msg_size;
 320         u8 T6_reportid;
 321         u16 T6_address;
 322         u16 T7_address;
 323         u16 T71_address;
 324         u8 T9_reportid_min;
 325         u8 T9_reportid_max;
 326         u8 T19_reportid;
 327         u16 T44_address;
 328         u8 T100_reportid_min;
 329         u8 T100_reportid_max;
 330
 331         /* for fw update in bootloader */
 332         struct completion bl_completion;
 333
 334         /* for reset handling */
 335         struct completion reset_completion;
 336
 337         /* for config update handling */
 338         struct completion crc_completion;
 339
 340         u32 *t19_keymap;
 341         unsigned int t19_num_keys;
 342
 343         enum mxt_suspend_mode suspend_mode;
 344 };
 345
 346 struct mxt_vb2_buffer {
 347         struct vb2_buffer       vb;
 348         struct list_head        list;
 349 };
 350
 351 static size_t mxt_obj_size(const struct mxt_object *obj)
 352 {
 353         return obj->size_minus_one + 1;
 354 }
 355
 356 static size_t mxt_obj_instances(const struct mxt_object *obj)
 357 {
 358         return obj->instances_minus_one + 1;
 359 }
 360
 361 static bool mxt_object_readable(unsigned int type)
 362 {
 363         switch (type) {
 364         case MXT_GEN_COMMAND_T6:
 365         case MXT_GEN_POWER_T7:
 366         case MXT_GEN_ACQUIRE_T8:
 367         case MXT_GEN_DATASOURCE_T53:
 368         case MXT_TOUCH_MULTI_T9:
 369         case MXT_TOUCH_KEYARRAY_T15:
 370         case MXT_TOUCH_PROXIMITY_T23:
 371         case MXT_TOUCH_PROXKEY_T52:
 372         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
 373         case MXT_PROCI_GRIPFACE_T20:
 374         case MXT_PROCG_NOISE_T22:
 375         case MXT_PROCI_ONETOUCH_T24:
 376         case MXT_PROCI_TWOTOUCH_T27:
 377         case MXT_PROCI_GRIP_T40:
 378         case MXT_PROCI_PALM_T41:
 379         case MXT_PROCI_TOUCHSUPPRESSION_T42:
 380         case MXT_PROCI_STYLUS_T47:
 381         case MXT_PROCG_NOISESUPPRESSION_T48:
 382         case MXT_SPT_COMMSCONFIG_T18:
 383         case MXT_SPT_GPIOPWM_T19:
 384         case MXT_SPT_SELFTEST_T25:
 385         case MXT_SPT_CTECONFIG_T28:
 386         case MXT_SPT_USERDATA_T38:
 387         case MXT_SPT_DIGITIZER_T43:
 388         case MXT_SPT_CTECONFIG_T46:
 389         case MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71:
 390                 return true;
 391         default:
 392                 return false;
 393         }
 394 }
 395
 396 static void mxt_dump_message(struct mxt_data *data, u8 *message)
 397 {
 398         dev_dbg(&data->client->dev, "message: %*ph\n",
 399                 data->T5_msg_size, message);
 400 }
 401
 402 static int mxt_wait_for_completion(struct mxt_data *data,
 403                                    struct completion *comp,
 404                                    unsigned int timeout_ms)
 405 {
 406         struct device *dev = &data->client->dev;
 407         unsigned long timeout = msecs_to_jiffies(timeout_ms);
 408         long ret;
 409
 410         ret = wait_for_completion_interruptible_timeout(comp, timeout);
 411         if (ret < 0) {
 412                 return ret;
 413         } else if (ret == 0) {
 414                 dev_err(dev, "Wait for completion timed out.\n");
 415                 return -ETIMEDOUT;
 416         }
 417         return 0;
 418 }
 419
 420 static int mxt_bootloader_read(struct mxt_data *data,
 421                                u8 *val, unsigned int count)
 422 {
 423         int ret;
 424         struct i2c_msg msg;
 425
 426         msg.addr = data->bootloader_addr;
 427         msg.flags = data->client->flags & I2C_M_TEN;
 428         msg.flags |= I2C_M_RD;
 429         msg.len = count;
 430         msg.buf = val;
 431
 432         ret = i2c_transfer(data->client->adapter, &msg, 1);
 433         if (ret == 1) {
 434                 ret = 0;
 435         } else {
 436                 ret = ret < 0 ? ret : -EIO;
 437                 dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
 438                         __func__, ret);
 439         }
 440
 441         return ret;
 442 }
 443
 444 static int mxt_bootloader_write(struct mxt_data *data,
 445                                 const u8 * const val, unsigned int count)
 446 {
 447         int ret;
 448         struct i2c_msg msg;
 449
 450         msg.addr = data->bootloader_addr;
 451         msg.flags = data->client->flags & I2C_M_TEN;
 452         msg.len = count;
 453         msg.buf = (u8 *)val;
 454
 455         ret = i2c_transfer(data->client->adapter, &msg, 1);
 456         if (ret == 1) {
 457                 ret = 0;
 458         } else {
 459                 ret = ret < 0 ? ret : -EIO;
 460                 dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
 461                         __func__, ret);
 462         }
 463
 464         return ret;
 465 }
 466
 467 static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 468 {
 469         u8 appmode = data->client->addr;
 470         u8 bootloader;
 471         u8 family_id = data->info ? data->info->family_id : 0;
 472
 473         switch (appmode) {
 474         case 0x4a:
 475         case 0x4b:
 476                 /* Chips after 1664S use different scheme */
 477                 if (retry || family_id >= 0xa2) {
 478                         bootloader = appmode - 0x24;
 479                         break;
 480                 }
 481                 /* Fall through - for normal case */
 482         case 0x4c:
 483         case 0x4d:
 484         case 0x5a:
 485         case 0x5b:
 486                 bootloader = appmode - 0x26;
 487                 break;
 488
 489         default:
 490                 dev_err(&data->client->dev,
 491                         "Appmode i2c address 0x%02x not found\n",
 492                         appmode);
 493                 return -EINVAL;
 494         }
 495
 496         data->bootloader_addr = bootloader;
 497         return 0;
 498 }
 499
 500 static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
 501 {
 502         struct device *dev = &data->client->dev;
 503         int error;
 504         u8 val;
 505         bool crc_failure;
 506
 507         error = mxt_lookup_bootloader_address(data, alt_address);
 508         if (error)
 509                 return error;
 510
 511         error = mxt_bootloader_read(data, &val, 1);
 512         if (error)
 513                 return error;
 514
 515         /* Check app crc fail mode */
 516         crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
 517
 518         dev_err(dev, "Detected bootloader, status:%02X%s\n",
 519                         val, crc_failure ? ", APP_CRC_FAIL" : "");
 520
 521         return 0;
 522 }
 523
 524 static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
 525 {
 526         struct device *dev = &data->client->dev;
 527         u8 buf[3];
 528
 529         if (val & MXT_BOOT_EXTENDED_ID) {
 530                 if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
 531                         dev_err(dev, "%s: i2c failure\n", __func__);
 532                         return val;
 533                 }
 534
 535                 dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
 536
 537                 return buf[0];
 538         } else {
 539                 dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
 540
 541                 return val;
 542         }
 543 }
 544
 545 static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
 546                                 bool wait)
 547 {
 548         struct device *dev = &data->client->dev;
 549         u8 val;
 550         int ret;
 551
 552 recheck:
 553         if (wait) {
 554                 /*
 555                  * In application update mode, the interrupt
 556                  * line signals state transitions. We must wait for the
 557                  * CHG assertion before reading the status byte.
 558                  * Once the status byte has been read, the line is deasserted.
 559                  */
 560                 ret = mxt_wait_for_completion(data, &data->bl_completion,
 561                                               MXT_FW_CHG_TIMEOUT);
 562                 if (ret) {
 563                         /*
 564                          * TODO: handle -ERESTARTSYS better by terminating
 565                          * fw update process before returning to userspace
 566                          * by writing length 0x000 to device (iff we are in
 567                          * WAITING_FRAME_DATA state).
 568                          */
 569                         dev_err(dev, "Update wait error %d\n", ret);
 570                         return ret;
 571                 }
 572         }
 573
 574         ret = mxt_bootloader_read(data, &val, 1);
 575         if (ret)
 576                 return ret;
 577
 578         if (state == MXT_WAITING_BOOTLOAD_CMD)
 579                 val = mxt_get_bootloader_version(data, val);
 580
 581         switch (state) {
 582         case MXT_WAITING_BOOTLOAD_CMD:
 583         case MXT_WAITING_FRAME_DATA:
 584         case MXT_APP_CRC_FAIL:
 585                 val &= ~MXT_BOOT_STATUS_MASK;
 586                 break;
 587         case MXT_FRAME_CRC_PASS:
 588                 if (val == MXT_FRAME_CRC_CHECK) {
 589                         goto recheck;
 590                 } else if (val == MXT_FRAME_CRC_FAIL) {
 591                         dev_err(dev, "Bootloader CRC fail\n");
 592                         return -EINVAL;
 593                 }
 594                 break;
 595         default:
 596                 return -EINVAL;
 597         }
 598
 599         if (val != state) {
 600                 dev_err(dev, "Invalid bootloader state %02X != %02X\n",
 601                         val, state);
 602                 return -EINVAL;
 603         }
 604
 605         return 0;
 606 }
 607
 608 static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
 609 {
 610         int ret;
 611         u8 buf[2];
 612
 613         if (unlock) {
 614                 buf[0] = MXT_UNLOCK_CMD_LSB;
 615                 buf[1] = MXT_UNLOCK_CMD_MSB;
 616         } else {
 617                 buf[0] = 0x01;
 618                 buf[1] = 0x01;
 619         }
 620
 621         ret = mxt_bootloader_write(data, buf, 2);
 622         if (ret)
 623                 return ret;
 624
 625         return 0;
 626 }
 627
 628 static int __mxt_read_reg(struct i2c_client *client,
 629                                u16 reg, u16 len, void *val)
 630 {
 631         struct i2c_msg xfer[2];
 632         u8 buf[2];
 633         int ret;
 634
 635         buf[0] = reg & 0xff;
 636         buf[1] = (reg >> 8) & 0xff;
 637
 638         /* Write register */
 639         xfer[0].addr = client->addr;
 640         xfer[0].flags = 0;
 641         xfer[0].len = 2;
 642         xfer[0].buf = buf;
 643
 644         /* Read data */
 645         xfer[1].addr = client->addr;
 646         xfer[1].flags = I2C_M_RD;
 647         xfer[1].len = len;
 648         xfer[1].buf = val;
 649
 650         ret = i2c_transfer(client->adapter, xfer, 2);
 651         if (ret == 2) {
 652                 ret = 0;
 653         } else {
 654                 if (ret >= 0)
 655                         ret = -EIO;
 656                 dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
 657                         __func__, ret);
 658         }
 659
 660         return ret;
 661 }
 662
 663 static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
 664                            const void *val)
 665 {
 666         u8 *buf;
 667         size_t count;
 668         int ret;
 669
 670         count = len + 2;
 671         buf = kmalloc(count, GFP_KERNEL);
 672         if (!buf)
 673                 return -ENOMEM;
 674
 675         buf[0] = reg & 0xff;
 676         buf[1] = (reg >> 8) & 0xff;
 677         memcpy(&buf[2], val, len);
 678
 679         ret = i2c_master_send(client, buf, count);
 680         if (ret == count) {
 681                 ret = 0;
 682         } else {
 683                 if (ret >= 0)
 684                         ret = -EIO;
 685                 dev_err(&client->dev, "%s: i2c send failed (%d)\n",
 686                         __func__, ret);
 687         }
 688
 689         kfree(buf);
 690         return ret;
 691 }
 692
 693 static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
 694 {
 695         return __mxt_write_reg(client, reg, 1, &val);
 696 }
 697
 698 static struct mxt_object *
 699 mxt_get_object(struct mxt_data *data, u8 type)
 700 {
 701         struct mxt_object *object;
 702         int i;
 703
 704         for (i = 0; i < data->info->object_num; i++) {
 705                 object = data->object_table + i;
 706                 if (object->type == type)
 707                         return object;
 708         }
 709
 710         dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
 711         return NULL;
 712 }
 713
 714 static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
 715 {
 716         struct device *dev = &data->client->dev;
 717         u8 status = msg[1];
 718         u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
 719
 720         if (crc != data->config_crc) {
 721                 data->config_crc = crc;
 722                 dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
 723         }
 724
 725         complete(&data->crc_completion);
 726
 727         /* Detect reset */
 728         if (status & MXT_T6_STATUS_RESET)
 729                 complete(&data->reset_completion);
 730
 731         /* Output debug if status has changed */
 732         if (status != data->t6_status)
 733                 dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
 734                         status,
 735                         status == 0 ? " OK" : "",
 736                         status & MXT_T6_STATUS_RESET ? " RESET" : "",
 737                         status & MXT_T6_STATUS_OFL ? " OFL" : "",
 738                         status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
 739                         status & MXT_T6_STATUS_CAL ? " CAL" : "",
 740                         status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
 741                         status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
 742
 743         /* Save current status */
 744         data->t6_status = status;
 745 }
 746
 747 static int mxt_write_object(struct mxt_data *data,
 748                                  u8 type, u8 offset, u8 val)
 749 {
 750         struct mxt_object *object;
 751         u16 reg;
 752
 753         object = mxt_get_object(data, type);
 754         if (!object || offset >= mxt_obj_size(object))
 755                 return -EINVAL;
 756
 757         reg = object->start_address;
 758         return mxt_write_reg(data->client, reg + offset, val);
 759 }
 760
 761 static void mxt_input_button(struct mxt_data *data, u8 *message)
 762 {
 763         struct input_dev *input = data->input_dev;
 764         int i;
 765
 766         for (i = 0; i < data->t19_num_keys; i++) {
 767                 if (data->t19_keymap[i] == KEY_RESERVED)
 768                         continue;
 769
 770                 /* Active-low switch */
 771                 input_report_key(input, data->t19_keymap[i],
 772                                  !(message[1] & BIT(i)));
 773         }
 774 }
 775
 776 static void mxt_input_sync(struct mxt_data *data)
 777 {
 778         input_mt_report_pointer_emulation(data->input_dev,
 779                                           data->t19_num_keys);
 780         input_sync(data->input_dev);
 781 }
 782
 783 static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
 784 {
 785         struct device *dev = &data->client->dev;
 786         struct input_dev *input_dev = data->input_dev;
 787         int id;
 788         u8 status;
 789         int x;
 790         int y;
 791         int area;
 792         int amplitude;
 793
 794         id = message[0] - data->T9_reportid_min;
 795         status = message[1];
 796         x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
 797         y = (message[3] << 4) | ((message[4] & 0xf));
 798
 799         /* Handle 10/12 bit switching */
 800         if (data->max_x < 1024)
 801                 x >>= 2;
 802         if (data->max_y < 1024)
 803                 y >>= 2;
 804
 805         area = message[5];
 806         amplitude = message[6];
 807
 808         dev_dbg(dev,
 809                 "[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
 810                 id,
 811                 (status & MXT_T9_DETECT) ? 'D' : '.',
 812                 (status & MXT_T9_PRESS) ? 'P' : '.',
 813                 (status & MXT_T9_RELEASE) ? 'R' : '.',
 814                 (status & MXT_T9_MOVE) ? 'M' : '.',
 815                 (status & MXT_T9_VECTOR) ? 'V' : '.',
 816                 (status & MXT_T9_AMP) ? 'A' : '.',
 817                 (status & MXT_T9_SUPPRESS) ? 'S' : '.',
 818                 (status & MXT_T9_UNGRIP) ? 'U' : '.',
 819                 x, y, area, amplitude);
 820
 821         input_mt_slot(input_dev, id);
 822
 823         if (status & MXT_T9_DETECT) {
 824                 /*
 825                  * Multiple bits may be set if the host is slow to read
 826                  * the status messages, indicating all the events that
 827                  * have happened.
 828                  */
 829                 if (status & MXT_T9_RELEASE) {
 830                         input_mt_report_slot_state(input_dev,
 831                                                    MT_TOOL_FINGER, 0);
 832                         mxt_input_sync(data);
 833                 }
 834
 835                 /* if active, pressure must be non-zero */
 836                 if (!amplitude)
 837                         amplitude = MXT_PRESSURE_DEFAULT;
 838
 839                 /* Touch active */
 840                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
 841                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 842                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 843                 input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
 844                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
 845         } else {
 846                 /* Touch no longer active, close out slot */
 847                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 0);
 848         }
 849
 850         data->update_input = true;
 851 }
 852
 853 static void mxt_proc_t100_message(struct mxt_data *data, u8 *message)
 854 {
 855         struct device *dev = &data->client->dev;
 856         struct input_dev *input_dev = data->input_dev;
 857         int id;
 858         u8 status;
 859         u8 type = 0;
 860         u16 x;
 861         u16 y;
 862         int distance = 0;
 863         int tool = 0;
 864         u8 major = 0;
 865         u8 pressure = 0;
 866         u8 orientation = 0;
 867
 868         id = message[0] - data->T100_reportid_min - 2;
 869
 870         /* ignore SCRSTATUS events */
 871         if (id < 0)
 872                 return;
 873
 874         status = message[1];
 875         x = get_unaligned_le16(&message[2]);
 876         y = get_unaligned_le16(&message[4]);
 877
 878         if (status & MXT_T100_DETECT) {
 879                 type = (status & MXT_T100_TYPE_MASK) >> 4;
 880
 881                 switch (type) {
 882                 case MXT_T100_TYPE_HOVERING_FINGER:
 883                         tool = MT_TOOL_FINGER;
 884                         distance = MXT_DISTANCE_HOVERING;
 885
 886                         if (data->t100_aux_vect)
 887                                 orientation = message[data->t100_aux_vect];
 888
 889                         break;
 890
 891                 case MXT_T100_TYPE_FINGER:
 892                 case MXT_T100_TYPE_GLOVE:
 893                         tool = MT_TOOL_FINGER;
 894                         distance = MXT_DISTANCE_ACTIVE_TOUCH;
 895
 896                         if (data->t100_aux_area)
 897                                 major = message[data->t100_aux_area];
 898
 899                         if (data->t100_aux_ampl)
 900                                 pressure = message[data->t100_aux_ampl];
 901
 902                         if (data->t100_aux_vect)
 903                                 orientation = message[data->t100_aux_vect];
 904
 905                         break;
 906
 907                 case MXT_T100_TYPE_PASSIVE_STYLUS:
 908                         tool = MT_TOOL_PEN;
 909
 910                         /*
 911                          * Passive stylus is reported with size zero so
 912                          * hardcode.
 913                          */
 914                         major = MXT_TOUCH_MAJOR_DEFAULT;
 915
 916                         if (data->t100_aux_ampl)
 917                                 pressure = message[data->t100_aux_ampl];
 918
 919                         break;
 920
 921                 case MXT_T100_TYPE_LARGE_TOUCH:
 922                         /* Ignore suppressed touch */
 923                         break;
 924
 925                 default:
 926                         dev_dbg(dev, "Unexpected T100 type\n");
 927                         return;
 928                 }
 929         }
 930
 931         /*
 932          * Values reported should be non-zero if tool is touching the
 933          * device
 934          */
 935         if (!pressure && type != MXT_T100_TYPE_HOVERING_FINGER)
 936                 pressure = MXT_PRESSURE_DEFAULT;
 937
 938         input_mt_slot(input_dev, id);
 939
 940         if (status & MXT_T100_DETECT) {
 941                 dev_dbg(dev, "[%u] type:%u x:%u y:%u a:%02X p:%02X v:%02X\n",
 942                         id, type, x, y, major, pressure, orientation);
 943
 944                 input_mt_report_slot_state(input_dev, tool, 1);
 945                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 946                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 947                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, major);
 948                 input_report_abs(input_dev, ABS_MT_PRESSURE, pressure);
 949                 input_report_abs(input_dev, ABS_MT_DISTANCE, distance);
 950                 input_report_abs(input_dev, ABS_MT_ORIENTATION, orientation);
 951         } else {
 952                 dev_dbg(dev, "[%u] release\n", id);
 953
 954                 /* close out slot */
 955                 input_mt_report_slot_state(input_dev, 0, 0);
 956         }
 957
 958         data->update_input = true;
 959 }
 960
 961 static int mxt_proc_message(struct mxt_data *data, u8 *message)
 962 {
 963         u8 report_id = message[0];
 964
 965         if (report_id == MXT_RPTID_NOMSG)
 966                 return 0;
 967
 968         if (report_id == data->T6_reportid) {
 969                 mxt_proc_t6_messages(data, message);
 970         } else if (!data->input_dev) {
 971                 /*
 972                  * Do not report events if input device
 973                  * is not yet registered.
 974                  */
 975                 mxt_dump_message(data, message);
 976         } else if (report_id >= data->T9_reportid_min &&
 977                    report_id <= data->T9_reportid_max) {
 978                 mxt_proc_t9_message(data, message);
 979         } else if (report_id >= data->T100_reportid_min &&
 980                    report_id <= data->T100_reportid_max) {
 981                 mxt_proc_t100_message(data, message);
 982         } else if (report_id == data->T19_reportid) {
 983                 mxt_input_button(data, message);
 984                 data->update_input = true;
 985         } else {
 986                 mxt_dump_message(data, message);
 987         }
 988
 989         return 1;
 990 }
 991
 992 static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
 993 {
 994         struct device *dev = &data->client->dev;
 995         int ret;
 996         int i;
 997         u8 num_valid = 0;
 998
 999         /* Safety check for msg_buf */
1000         if (count > data->max_reportid)
1001                 return -EINVAL;
1002
1003         /* Process remaining messages if necessary */
1004         ret = __mxt_read_reg(data->client, data->T5_address,
1005                                 data->T5_msg_size * count, data->msg_buf);
1006         if (ret) {
1007                 dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
1008                 return ret;
1009         }
1010
1011         for (i = 0;  i < count; i++) {
1012                 ret = mxt_proc_message(data,
1013                         data->msg_buf + data->T5_msg_size * i);
1014
1015                 if (ret == 1)
1016                         num_valid++;
1017         }
1018
1019         /* return number of messages read */
1020         return num_valid;
1021 }
1022
1023 static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
1024 {
1025         struct device *dev = &data->client->dev;
1026         int ret;
1027         u8 count, num_left;
1028
1029         /* Read T44 and T5 together */
1030         ret = __mxt_read_reg(data->client, data->T44_address,
1031                 data->T5_msg_size + 1, data->msg_buf);
1032         if (ret) {
1033                 dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
1034                 return IRQ_NONE;
1035         }
1036
1037         count = data->msg_buf[0];
1038
1039         /*
1040          * This condition may be caused by the CHG line being configured in
1041          * Mode 0. It results in unnecessary I2C operations but it is benign.
1042          */
1043         if (count == 0)
1044                 return IRQ_NONE;
1045
1046         if (count > data->max_reportid) {
1047                 dev_warn(dev, "T44 count %d exceeded max report id\n", count);
1048                 count = data->max_reportid;
1049         }
1050
1051         /* Process first message */
1052         ret = mxt_proc_message(data, data->msg_buf + 1);
1053         if (ret < 0) {
1054                 dev_warn(dev, "Unexpected invalid message\n");
1055                 return IRQ_NONE;
1056         }
1057
1058         num_left = count - 1;
1059
1060         /* Process remaining messages if necessary */
1061         if (num_left) {
1062                 ret = mxt_read_and_process_messages(data, num_left);
1063                 if (ret < 0)
1064                         goto end;
1065                 else if (ret != num_left)
1066                         dev_warn(dev, "Unexpected invalid message\n");
1067         }
1068
1069 end:
1070         if (data->update_input) {
1071                 mxt_input_sync(data);
1072                 data->update_input = false;
1073         }
1074
1075         return IRQ_HANDLED;
1076 }
1077
1078 static int mxt_process_messages_until_invalid(struct mxt_data *data)
1079 {
1080         struct device *dev = &data->client->dev;
1081         int count, read;
1082         u8 tries = 2;
1083
1084         count = data->max_reportid;
1085
1086         /* Read messages until we force an invalid */
1087         do {
1088                 read = mxt_read_and_process_messages(data, count);
1089                 if (read < count)
1090                         return 0;
1091         } while (--tries);
1092
1093         if (data->update_input) {
1094                 mxt_input_sync(data);
1095                 data->update_input = false;
1096         }
1097
1098         dev_err(dev, "CHG pin isn't cleared\n");
1099         return -EBUSY;
1100 }
1101
1102 static irqreturn_t mxt_process_messages(struct mxt_data *data)
1103 {
1104         int total_handled, num_handled;
1105         u8 count = data->last_message_count;
1106
1107         if (count < 1 || count > data->max_reportid)
1108                 count = 1;
1109
1110         /* include final invalid message */
1111         total_handled = mxt_read_and_process_messages(data, count + 1);
1112         if (total_handled < 0)
1113                 return IRQ_NONE;
1114         /* if there were invalid messages, then we are done */
1115         else if (total_handled <= count)
1116                 goto update_count;
1117
1118         /* keep reading two msgs until one is invalid or reportid limit */
1119         do {
1120                 num_handled = mxt_read_and_process_messages(data, 2);
1121                 if (num_handled < 0)
1122                         return IRQ_NONE;
1123
1124                 total_handled += num_handled;
1125
1126                 if (num_handled < 2)
1127                         break;
1128         } while (total_handled < data->num_touchids);
1129
1130 update_count:
1131         data->last_message_count = total_handled;
1132
1133         if (data->update_input) {
1134                 mxt_input_sync(data);
1135                 data->update_input = false;
1136         }
1137
1138         return IRQ_HANDLED;
1139 }
1140
1141 static irqreturn_t mxt_interrupt(int irq, void *dev_id)
1142 {
1143         struct mxt_data *data = dev_id;
1144
1145         if (data->in_bootloader) {
1146                 /* bootloader state transition completion */
1147                 complete(&data->bl_completion);
1148                 return IRQ_HANDLED;
1149         }
1150
1151         if (!data->object_table)
1152                 return IRQ_HANDLED;
1153
1154         if (data->T44_address) {
1155                 return mxt_process_messages_t44(data);
1156         } else {
1157                 return mxt_process_messages(data);
1158         }
1159 }
1160
1161 static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
1162                           u8 value, bool wait)
1163 {
1164         u16 reg;
1165         u8 command_register;
1166         int timeout_counter = 0;
1167         int ret;
1168
1169         reg = data->T6_address + cmd_offset;
1170
1171         ret = mxt_write_reg(data->client, reg, value);
1172         if (ret)
1173                 return ret;
1174
1175         if (!wait)
1176                 return 0;
1177
1178         do {
1179                 msleep(20);
1180                 ret = __mxt_read_reg(data->client, reg, 1, &command_register);
1181                 if (ret)
1182                         return ret;
1183         } while (command_register != 0 && timeout_counter++ <= 100);
1184
1185         if (timeout_counter > 100) {
1186                 dev_err(&data->client->dev, "Command failed!\n");
1187                 return -EIO;
1188         }
1189
1190         return 0;
1191 }
1192
1193 static int mxt_acquire_irq(struct mxt_data *data)
1194 {
1195         int error;
1196
1197         enable_irq(data->irq);
1198
1199         error = mxt_process_messages_until_invalid(data);
1200         if (error)
1201                 return error;
1202
1203         return 0;
1204 }
1205
1206 static int mxt_soft_reset(struct mxt_data *data)
1207 {
1208         struct device *dev = &data->client->dev;
1209         int ret = 0;
1210
1211         dev_info(dev, "Resetting device\n");
1212
1213         disable_irq(data->irq);
1214
1215         reinit_completion(&data->reset_completion);
1216
1217         ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1218         if (ret)
1219                 return ret;
1220
1221         /* Ignore CHG line for 100ms after reset */
1222         msleep(MXT_RESET_INVALID_CHG);
1223
1224         mxt_acquire_irq(data);
1225
1226         ret = mxt_wait_for_completion(data, &data->reset_completion,
1227                                       MXT_RESET_TIMEOUT);
1228         if (ret)
1229                 return ret;
1230
1231         return 0;
1232 }
1233
1234 static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1235 {
1236         /*
1237          * On failure, CRC is set to 0 and config will always be
1238          * downloaded.
1239          */
1240         data->config_crc = 0;
1241         reinit_completion(&data->crc_completion);
1242
1243         mxt_t6_command(data, cmd, value, true);
1244
1245         /*
1246          * Wait for crc message. On failure, CRC is set to 0 and config will
1247          * always be downloaded.
1248          */
1249         mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1250 }
1251
1252 static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1253 {
1254         static const unsigned int crcpoly = 0x80001B;
1255         u32 result;
1256         u32 data_word;
1257
1258         data_word = (secondbyte << 8) | firstbyte;
1259         result = ((*crc << 1) ^ data_word);
1260
1261         if (result & 0x1000000)
1262                 result ^= crcpoly;
1263
1264         *crc = result;
1265 }
1266
1267 static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1268 {
1269         u32 crc = 0;
1270         u8 *ptr = base + start_off;
1271         u8 *last_val = base + end_off - 1;
1272
1273         if (end_off < start_off)
1274                 return -EINVAL;
1275
1276         while (ptr < last_val) {
1277                 mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1278                 ptr += 2;
1279         }
1280
1281         /* if len is odd, fill the last byte with 0 */
1282         if (ptr == last_val)
1283                 mxt_calc_crc24(&crc, *ptr, 0);
1284
1285         /* Mask to 24-bit */
1286         crc &= 0x00FFFFFF;
1287
1288         return crc;
1289 }
1290
1291 static int mxt_prepare_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
1292 {
1293         struct device *dev = &data->client->dev;
1294         struct mxt_object *object;
1295         unsigned int type, instance, size, byte_offset;
1296         int offset;
1297         int ret;
1298         int i;
1299         u16 reg;
1300         u8 val;
1301
1302         while (cfg->raw_pos < cfg->raw_size) {
1303                 /* Read type, instance, length */
1304                 ret = sscanf(cfg->raw + cfg->raw_pos, "%x %x %x%n",
1305                              &type, &instance, &size, &offset);
1306                 if (ret == 0) {
1307                         /* EOF */
1308                         break;
1309                 } else if (ret != 3) {
1310                         dev_err(dev, "Bad format: failed to parse object\n");
1311                         return -EINVAL;
1312                 }
1313                 cfg->raw_pos += offset;
1314
1315                 object = mxt_get_object(data, type);
1316                 if (!object) {
1317                         /* Skip object */
1318                         for (i = 0; i < size; i++) {
1319                                 ret = sscanf(cfg->raw + cfg->raw_pos, "%hhx%n",
1320                                              &val, &offset);
1321                                 if (ret != 1) {
1322                                         dev_err(dev, "Bad format in T%d at %d\n",
1323                                                 type, i);
1324                                         return -EINVAL;
1325                                 }
1326                                 cfg->raw_pos += offset;
1327                         }
1328                         continue;
1329                 }
1330
1331                 if (size > mxt_obj_size(object)) {
1332                         /*
1333                          * Either we are in fallback mode due to wrong
1334                          * config or config from a later fw version,
1335                          * or the file is corrupt or hand-edited.
1336                          */
1337                         dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1338                                  size - mxt_obj_size(object), type);
1339                 } else if (mxt_obj_size(object) > size) {
1340                         /*
1341                          * If firmware is upgraded, new bytes may be added to
1342                          * end of objects. It is generally forward compatible
1343                          * to zero these bytes - previous behaviour will be
1344                          * retained. However this does invalidate the CRC and
1345                          * will force fallback mode until the configuration is
1346                          * updated. We warn here but do nothing else - the
1347                          * malloc has zeroed the entire configuration.
1348                          */
1349                         dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1350                                  mxt_obj_size(object) - size, type);
1351                 }
1352
1353                 if (instance >= mxt_obj_instances(object)) {
1354                         dev_err(dev, "Object instances exceeded!\n");
1355                         return -EINVAL;
1356                 }
1357
1358                 reg = object->start_address + mxt_obj_size(object) * instance;
1359
1360                 for (i = 0; i < size; i++) {
1361                         ret = sscanf(cfg->raw + cfg->raw_pos, "%hhx%n",
1362                                      &val,
1363                                      &offset);
1364                         if (ret != 1) {
1365                                 dev_err(dev, "Bad format in T%d at %d\n",
1366                                         type, i);
1367                                 return -EINVAL;
1368                         }
1369                         cfg->raw_pos += offset;
1370
1371                         if (i > mxt_obj_size(object))
1372                                 continue;
1373
1374                         byte_offset = reg + i - cfg->start_ofs;
1375
1376                         if (byte_offset >= 0 && byte_offset < cfg->mem_size) {
1377                                 *(cfg->mem + byte_offset) = val;
1378                         } else {
1379                                 dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1380                                         reg, object->type, byte_offset);
1381                                 return -EINVAL;
1382                         }
1383                 }
1384         }
1385
1386         return 0;
1387 }
1388
1389 static int mxt_upload_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
1390 {
1391         unsigned int byte_offset = 0;
1392         int error;
1393
1394         /* Write configuration as blocks */
1395         while (byte_offset < cfg->mem_size) {
1396                 unsigned int size = cfg->mem_size - byte_offset;
1397
1398                 if (size > MXT_MAX_BLOCK_WRITE)
1399                         size = MXT_MAX_BLOCK_WRITE;
1400
1401                 error = __mxt_write_reg(data->client,
1402                                         cfg->start_ofs + byte_offset,
1403                                         size, cfg->mem + byte_offset);
1404                 if (error) {
1405                         dev_err(&data->client->dev,
1406                                 "Config write error, ret=%d\n", error);
1407                         return error;
1408                 }
1409
1410                 byte_offset += size;
1411         }
1412
1413         return 0;
1414 }
1415
1416 static int mxt_init_t7_power_cfg(struct mxt_data *data);
1417
1418 /*
1419  * mxt_update_cfg - download configuration to chip
1420  *
1421  * Atmel Raw Config File Format
1422  *
1423  * The first four lines of the raw config file contain:
1424  *  1) Version
1425  *  2) Chip ID Information (first 7 bytes of device memory)
1426  *  3) Chip Information Block 24-bit CRC Checksum
1427  *  4) Chip Configuration 24-bit CRC Checksum
1428  *
1429  * The rest of the file consists of one line per object instance:
1430  *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1431  *
1432  *   <TYPE> - 2-byte object type as hex
1433  *   <INSTANCE> - 2-byte object instance number as hex
1434  *   <SIZE> - 2-byte object size as hex
1435  *   <CONTENTS> - array of <SIZE> 1-byte hex values
1436  */
1437 static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
1438 {
1439         struct device *dev = &data->client->dev;
1440         struct mxt_cfg cfg;
1441         int ret;
1442         int offset;
1443         int i;
1444         u32 info_crc, config_crc, calculated_crc;
1445         u16 crc_start = 0;
1446
1447         /* Make zero terminated copy of the OBP_RAW file */
1448         cfg.raw = kmemdup_nul(fw->data, fw->size, GFP_KERNEL);
1449         if (!cfg.raw)
1450                 return -ENOMEM;
1451
1452         cfg.raw_size = fw->size;
1453
1454         mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1455
1456         if (strncmp(cfg.raw, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1457                 dev_err(dev, "Unrecognised config file\n");
1458                 ret = -EINVAL;
1459                 goto release_raw;
1460         }
1461
1462         cfg.raw_pos = strlen(MXT_CFG_MAGIC);
1463
1464         /* Load information block and check */
1465         for (i = 0; i < sizeof(struct mxt_info); i++) {
1466                 ret = sscanf(cfg.raw + cfg.raw_pos, "%hhx%n",
1467                              (unsigned char *)&cfg.info + i,
1468                              &offset);
1469                 if (ret != 1) {
1470                         dev_err(dev, "Bad format\n");
1471                         ret = -EINVAL;
1472                         goto release_raw;
1473                 }
1474
1475                 cfg.raw_pos += offset;
1476         }
1477
1478         if (cfg.info.family_id != data->info->family_id) {
1479                 dev_err(dev, "Family ID mismatch!\n");
1480                 ret = -EINVAL;
1481                 goto release_raw;
1482         }
1483
1484         if (cfg.info.variant_id != data->info->variant_id) {
1485                 dev_err(dev, "Variant ID mismatch!\n");
1486                 ret = -EINVAL;
1487                 goto release_raw;
1488         }
1489
1490         /* Read CRCs */
1491         ret = sscanf(cfg.raw + cfg.raw_pos, "%x%n", &info_crc, &offset);
1492         if (ret != 1) {
1493                 dev_err(dev, "Bad format: failed to parse Info CRC\n");
1494                 ret = -EINVAL;
1495                 goto release_raw;
1496         }
1497         cfg.raw_pos += offset;
1498
1499         ret = sscanf(cfg.raw + cfg.raw_pos, "%x%n", &config_crc, &offset);
1500         if (ret != 1) {
1501                 dev_err(dev, "Bad format: failed to parse Config CRC\n");
1502                 ret = -EINVAL;
1503                 goto release_raw;
1504         }
1505         cfg.raw_pos += offset;
1506
1507         /*
1508          * The Info Block CRC is calculated over mxt_info and the object
1509          * table. If it does not match then we are trying to load the
1510          * configuration from a different chip or firmware version, so
1511          * the configuration CRC is invalid anyway.
1512          */
1513         if (info_crc == data->info_crc) {
1514                 if (config_crc == 0 || data->config_crc == 0) {
1515                         dev_info(dev, "CRC zero, attempting to apply config\n");
1516                 } else if (config_crc == data->config_crc) {
1517                         dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1518                                  data->config_crc);
1519                         ret = 0;
1520                         goto release_raw;
1521                 } else {
1522                         dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1523                                  data->config_crc, config_crc);
1524                 }
1525         } else {
1526                 dev_warn(dev,
1527                          "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1528                          data->info_crc, info_crc);
1529         }
1530
1531         /* Malloc memory to store configuration */
1532         cfg.start_ofs = MXT_OBJECT_START +
1533                         data->info->object_num * sizeof(struct mxt_object) +
1534                         MXT_INFO_CHECKSUM_SIZE;
1535         cfg.mem_size = data->mem_size - cfg.start_ofs;
1536         cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);
1537         if (!cfg.mem) {
1538                 ret = -ENOMEM;
1539                 goto release_raw;
1540         }
1541
1542         ret = mxt_prepare_cfg_mem(data, &cfg);
1543         if (ret)
1544                 goto release_mem;
1545
1546         /* Calculate crc of the received configs (not the raw config file) */
1547         if (data->T71_address)
1548                 crc_start = data->T71_address;
1549         else if (data->T7_address)
1550                 crc_start = data->T7_address;
1551         else
1552                 dev_warn(dev, "Could not find CRC start\n");
1553
1554         if (crc_start > cfg.start_ofs) {
1555                 calculated_crc = mxt_calculate_crc(cfg.mem,
1556                                                    crc_start - cfg.start_ofs,
1557                                                    cfg.mem_size);
1558
1559                 if (config_crc > 0 && config_crc != calculated_crc)
1560                         dev_warn(dev, "Config CRC in file inconsistent, calculated=%06X, file=%06X\n",
1561                                  calculated_crc, config_crc);
1562         }
1563
1564         ret = mxt_upload_cfg_mem(data, &cfg);
1565         if (ret)
1566                 goto release_mem;
1567
1568         mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1569
1570         ret = mxt_soft_reset(data);
1571         if (ret)
1572                 goto release_mem;
1573
1574         dev_info(dev, "Config successfully updated\n");
1575
1576         /* T7 config may have changed */
1577         mxt_init_t7_power_cfg(data);
1578
1579 release_mem:
1580         kfree(cfg.mem);
1581 release_raw:
1582         kfree(cfg.raw);
1583         return ret;
1584 }
1585
1586 static void mxt_free_input_device(struct mxt_data *data)
1587 {
1588         if (data->input_dev) {
1589                 input_unregister_device(data->input_dev);
1590                 data->input_dev = NULL;
1591         }
1592 }
1593
1594 static void mxt_free_object_table(struct mxt_data *data)
1595 {
1596 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
1597         video_unregister_device(&data->dbg.vdev);
1598         v4l2_device_unregister(&data->dbg.v4l2);
1599 #endif
1600         data->object_table = NULL;
1601         data->info = NULL;
1602         kfree(data->raw_info_block);
1603         data->raw_info_block = NULL;
1604         kfree(data->msg_buf);
1605         data->msg_buf = NULL;
1606         data->T5_address = 0;
1607         data->T5_msg_size = 0;
1608         data->T6_reportid = 0;
1609         data->T7_address = 0;
1610         data->T71_address = 0;
1611         data->T9_reportid_min = 0;
1612         data->T9_reportid_max = 0;
1613         data->T19_reportid = 0;
1614         data->T44_address = 0;
1615         data->T100_reportid_min = 0;
1616         data->T100_reportid_max = 0;
1617         data->max_reportid = 0;
1618 }
1619
1620 static int mxt_parse_object_table(struct mxt_data *data,
1621                                   struct mxt_object *object_table)
1622 {
1623         struct i2c_client *client = data->client;
1624         int i;
1625         u8 reportid;
1626         u16 end_address;
1627
1628         /* Valid Report IDs start counting from 1 */
1629         reportid = 1;
1630         data->mem_size = 0;
1631         for (i = 0; i < data->info->object_num; i++) {
1632                 struct mxt_object *object = object_table + i;
1633                 u8 min_id, max_id;
1634
1635                 le16_to_cpus(&object->start_address);
1636
1637                 if (object->num_report_ids) {
1638                         min_id = reportid;
1639                         reportid += object->num_report_ids *
1640                                         mxt_obj_instances(object);
1641                         max_id = reportid - 1;
1642                 } else {
1643                         min_id = 0;
1644                         max_id = 0;
1645                 }
1646
1647                 dev_dbg(&data->client->dev,
1648                         "T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1649                         object->type, object->start_address,
1650                         mxt_obj_size(object), mxt_obj_instances(object),
1651                         min_id, max_id);
1652
1653                 switch (object->type) {
1654                 case MXT_GEN_MESSAGE_T5:
1655                         if (data->info->family_id == 0x80 &&
1656                             data->info->version < 0x20) {
1657                                 /*
1658                                  * On mXT224 firmware versions prior to V2.0
1659                                  * read and discard unused CRC byte otherwise
1660                                  * DMA reads are misaligned.
1661                                  */
1662                                 data->T5_msg_size = mxt_obj_size(object);
1663                         } else {
1664                                 /* CRC not enabled, so skip last byte */
1665                                 data->T5_msg_size = mxt_obj_size(object) - 1;
1666                         }
1667                         data->T5_address = object->start_address;
1668                         break;
1669                 case MXT_GEN_COMMAND_T6:
1670                         data->T6_reportid = min_id;
1671                         data->T6_address = object->start_address;
1672                         break;
1673                 case MXT_GEN_POWER_T7:
1674                         data->T7_address = object->start_address;
1675                         break;
1676                 case MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71:
1677                         data->T71_address = object->start_address;
1678                         break;
1679                 case MXT_TOUCH_MULTI_T9:
1680                         data->multitouch = MXT_TOUCH_MULTI_T9;
1681                         /* Only handle messages from first T9 instance */
1682                         data->T9_reportid_min = min_id;
1683                         data->T9_reportid_max = min_id +
1684                                                 object->num_report_ids - 1;
1685                         data->num_touchids = object->num_report_ids;
1686                         break;
1687                 case MXT_SPT_MESSAGECOUNT_T44:
1688                         data->T44_address = object->start_address;
1689                         break;
1690                 case MXT_SPT_GPIOPWM_T19:
1691                         data->T19_reportid = min_id;
1692                         break;
1693                 case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1694                         data->multitouch = MXT_TOUCH_MULTITOUCHSCREEN_T100;
1695                         data->T100_reportid_min = min_id;
1696                         data->T100_reportid_max = max_id;
1697                         /* first two report IDs reserved */
1698                         data->num_touchids = object->num_report_ids - 2;
1699                         break;
1700                 }
1701
1702                 end_address = object->start_address
1703                         + mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1704
1705                 if (end_address >= data->mem_size)
1706                         data->mem_size = end_address + 1;
1707         }
1708
1709         /* Store maximum reportid */
1710         data->max_reportid = reportid;
1711
1712         /* If T44 exists, T5 position has to be directly after */
1713         if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1714                 dev_err(&client->dev, "Invalid T44 position\n");
1715                 return -EINVAL;
1716         }
1717
1718         data->msg_buf = kcalloc(data->max_reportid,
1719                                 data->T5_msg_size, GFP_KERNEL);
1720         if (!data->msg_buf)
1721                 return -ENOMEM;
1722
1723         return 0;
1724 }
1725
1726 static int mxt_read_info_block(struct mxt_data *data)
1727 {
1728         struct i2c_client *client = data->client;
1729         int error;
1730         size_t size;
1731         void *id_buf, *buf;
1732         uint8_t num_objects;
1733         u32 calculated_crc;
1734         u8 *crc_ptr;
1735
1736         /* If info block already allocated, free it */
1737         if (data->raw_info_block)
1738                 mxt_free_object_table(data);
1739
1740         /* Read 7-byte ID information block starting at address 0 */
1741         size = sizeof(struct mxt_info);
1742         id_buf = kzalloc(size, GFP_KERNEL);
1743         if (!id_buf)
1744                 return -ENOMEM;
1745
1746         error = __mxt_read_reg(client, 0, size, id_buf);
1747         if (error)
1748                 goto err_free_mem;
1749
1750         /* Resize buffer to give space for rest of info block */
1751         num_objects = ((struct mxt_info *)id_buf)->object_num;
1752         size += (num_objects * sizeof(struct mxt_object))
1753                 + MXT_INFO_CHECKSUM_SIZE;
1754
1755         buf = krealloc(id_buf, size, GFP_KERNEL);
1756         if (!buf) {
1757                 error = -ENOMEM;
1758                 goto err_free_mem;
1759         }
1760         id_buf = buf;
1761
1762         /* Read rest of info block */
1763         error = __mxt_read_reg(client, MXT_OBJECT_START,
1764                                size - MXT_OBJECT_START,
1765                                id_buf + MXT_OBJECT_START);
1766         if (error)
1767                 goto err_free_mem;
1768
1769         /* Extract & calculate checksum */
1770         crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
1771         data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
1772
1773         calculated_crc = mxt_calculate_crc(id_buf, 0,
1774                                            size - MXT_INFO_CHECKSUM_SIZE);
1775
1776         /*
1777          * CRC mismatch can be caused by data corruption due to I2C comms
1778          * issue or else device is not using Object Based Protocol (eg i2c-hid)
1779          */
1780         if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
1781                 dev_err(&client->dev,
1782                         "Info Block CRC error calculated=0x%06X read=0x%06X\n",
1783                         calculated_crc, data->info_crc);
1784                 error = -EIO;
1785                 goto err_free_mem;
1786         }
1787
1788         data->raw_info_block = id_buf;
1789         data->info = (struct mxt_info *)id_buf;
1790
1791         dev_info(&client->dev,
1792                  "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
1793                  data->info->family_id, data->info->variant_id,
1794                  data->info->version >> 4, data->info->version & 0xf,
1795                  data->info->build, data->info->object_num);
1796
1797         /* Parse object table information */
1798         error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
1799         if (error) {
1800                 dev_err(&client->dev, "Error %d parsing object table\n", error);
1801                 mxt_free_object_table(data);
1802                 goto err_free_mem;
1803         }
1804
1805         data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
1806
1807         return 0;
1808
1809 err_free_mem:
1810         kfree(id_buf);
1811         return error;
1812 }
1813
1814 static int mxt_read_t9_resolution(struct mxt_data *data)
1815 {
1816         struct i2c_client *client = data->client;
1817         int error;
1818         struct t9_range range;
1819         unsigned char orient;
1820         struct mxt_object *object;
1821
1822         object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1823         if (!object)
1824                 return -EINVAL;
1825
1826         error = __mxt_read_reg(client,
1827                                object->start_address + MXT_T9_XSIZE,
1828                                sizeof(data->xsize), &data->xsize);
1829         if (error)
1830                 return error;
1831
1832         error = __mxt_read_reg(client,
1833                                object->start_address + MXT_T9_YSIZE,
1834                                sizeof(data->ysize), &data->ysize);
1835         if (error)
1836                 return error;
1837
1838         error = __mxt_read_reg(client,
1839                                object->start_address + MXT_T9_RANGE,
1840                                sizeof(range), &range);
1841         if (error)
1842                 return error;
1843
1844         data->max_x = get_unaligned_le16(&range.x);
1845         data->max_y = get_unaligned_le16(&range.y);
1846
1847         error =  __mxt_read_reg(client,
1848                                 object->start_address + MXT_T9_ORIENT,
1849                                 1, &orient);
1850         if (error)
1851                 return error;
1852
1853         data->xy_switch = orient & MXT_T9_ORIENT_SWITCH;
1854         data->invertx = orient & MXT_T9_ORIENT_INVERTX;
1855         data->inverty = orient & MXT_T9_ORIENT_INVERTY;
1856
1857         return 0;
1858 }
1859
1860 static int mxt_read_t100_config(struct mxt_data *data)
1861 {
1862         struct i2c_client *client = data->client;
1863         int error;
1864         struct mxt_object *object;
1865         u16 range_x, range_y;
1866         u8 cfg, tchaux;
1867         u8 aux;
1868
1869         object = mxt_get_object(data, MXT_TOUCH_MULTITOUCHSCREEN_T100);
1870         if (!object)
1871                 return -EINVAL;
1872
1873         /* read touchscreen dimensions */
1874         error = __mxt_read_reg(client,
1875                                object->start_address + MXT_T100_XRANGE,
1876                                sizeof(range_x), &range_x);
1877         if (error)
1878                 return error;
1879
1880         data->max_x = get_unaligned_le16(&range_x);
1881
1882         error = __mxt_read_reg(client,
1883                                object->start_address + MXT_T100_YRANGE,
1884                                sizeof(range_y), &range_y);
1885         if (error)
1886                 return error;
1887
1888         data->max_y = get_unaligned_le16(&range_y);
1889
1890         error = __mxt_read_reg(client,
1891                                object->start_address + MXT_T100_XSIZE,
1892                                sizeof(data->xsize), &data->xsize);
1893         if (error)
1894                 return error;
1895
1896         error = __mxt_read_reg(client,
1897                                object->start_address + MXT_T100_YSIZE,
1898                                sizeof(data->ysize), &data->ysize);
1899         if (error)
1900                 return error;
1901
1902         /* read orientation config */
1903         error =  __mxt_read_reg(client,
1904                                 object->start_address + MXT_T100_CFG1,
1905                                 1, &cfg);
1906         if (error)
1907                 return error;
1908
1909         data->xy_switch = cfg & MXT_T100_CFG_SWITCHXY;
1910         data->invertx = cfg & MXT_T100_CFG_INVERTX;
1911         data->inverty = cfg & MXT_T100_CFG_INVERTY;
1912
1913         /* allocate aux bytes */
1914         error =  __mxt_read_reg(client,
1915                                 object->start_address + MXT_T100_TCHAUX,
1916                                 1, &tchaux);
1917         if (error)
1918                 return error;
1919
1920         aux = 6;
1921
1922         if (tchaux & MXT_T100_TCHAUX_VECT)
1923                 data->t100_aux_vect = aux++;
1924
1925         if (tchaux & MXT_T100_TCHAUX_AMPL)
1926                 data->t100_aux_ampl = aux++;
1927
1928         if (tchaux & MXT_T100_TCHAUX_AREA)
1929                 data->t100_aux_area = aux++;
1930
1931         dev_dbg(&client->dev,
1932                 "T100 aux mappings vect:%u ampl:%u area:%u\n",
1933                 data->t100_aux_vect, data->t100_aux_ampl, data->t100_aux_area);
1934
1935         return 0;
1936 }
1937
1938 static int mxt_input_open(struct input_dev *dev);
1939 static void mxt_input_close(struct input_dev *dev);
1940
1941 static void mxt_set_up_as_touchpad(struct input_dev *input_dev,
1942                                    struct mxt_data *data)
1943 {
1944         int i;
1945
1946         input_dev->name = "Atmel maXTouch Touchpad";
1947
1948         __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1949
1950         input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1951         input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1952         input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1953                           MXT_PIXELS_PER_MM);
1954         input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1955                           MXT_PIXELS_PER_MM);
1956
1957         for (i = 0; i < data->t19_num_keys; i++)
1958                 if (data->t19_keymap[i] != KEY_RESERVED)
1959                         input_set_capability(input_dev, EV_KEY,
1960                                              data->t19_keymap[i]);
1961 }
1962
1963 static int mxt_initialize_input_device(struct mxt_data *data)
1964 {
1965         struct device *dev = &data->client->dev;
1966         struct input_dev *input_dev;
1967         int error;
1968         unsigned int num_mt_slots;
1969         unsigned int mt_flags = 0;
1970
1971         switch (data->multitouch) {
1972         case MXT_TOUCH_MULTI_T9:
1973                 num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
1974                 error = mxt_read_t9_resolution(data);
1975                 if (error)
1976                         dev_warn(dev, "Failed to initialize T9 resolution\n");
1977                 break;
1978
1979         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1980                 num_mt_slots = data->num_touchids;
1981                 error = mxt_read_t100_config(data);
1982                 if (error)
1983                         dev_warn(dev, "Failed to read T100 config\n");
1984                 break;
1985
1986         default:
1987                 dev_err(dev, "Invalid multitouch object\n");
1988                 return -EINVAL;
1989         }
1990
1991         /* Handle default values and orientation switch */
1992         if (data->max_x == 0)
1993                 data->max_x = 1023;
1994
1995         if (data->max_y == 0)
1996                 data->max_y = 1023;
1997
1998         if (data->xy_switch)
1999                 swap(data->max_x, data->max_y);
2000
2001         dev_info(dev, "Touchscreen size X%uY%u\n", data->max_x, data->max_y);
2002
2003         /* Register input device */
2004         input_dev = input_allocate_device();
2005         if (!input_dev)
2006                 return -ENOMEM;
2007
2008         input_dev->name = "Atmel maXTouch Touchscreen";
2009         input_dev->phys = data->phys;
2010         input_dev->id.bustype = BUS_I2C;
2011         input_dev->dev.parent = dev;
2012         input_dev->open = mxt_input_open;
2013         input_dev->close = mxt_input_close;
2014
2015         input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
2016
2017         /* For single touch */
2018         input_set_abs_params(input_dev, ABS_X, 0, data->max_x, 0, 0);
2019         input_set_abs_params(input_dev, ABS_Y, 0, data->max_y, 0, 0);
2020
2021         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2022             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2023              data->t100_aux_ampl)) {
2024                 input_set_abs_params(input_dev, ABS_PRESSURE, 0, 255, 0, 0);
2025         }
2026
2027         /* If device has buttons we assume it is a touchpad */
2028         if (data->t19_num_keys) {
2029                 mxt_set_up_as_touchpad(input_dev, data);
2030                 mt_flags |= INPUT_MT_POINTER;
2031         } else {
2032                 mt_flags |= INPUT_MT_DIRECT;
2033         }
2034
2035         /* For multi touch */
2036         error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
2037         if (error) {
2038                 dev_err(dev, "Error %d initialising slots\n", error);
2039                 goto err_free_mem;
2040         }
2041
2042         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100) {
2043                 input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
2044                                      0, MT_TOOL_MAX, 0, 0);
2045                 input_set_abs_params(input_dev, ABS_MT_DISTANCE,
2046                                      MXT_DISTANCE_ACTIVE_TOUCH,
2047                                      MXT_DISTANCE_HOVERING,
2048                                      0, 0);
2049         }
2050
2051         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
2052                              0, data->max_x, 0, 0);
2053         input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
2054                              0, data->max_y, 0, 0);
2055
2056         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2057             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2058              data->t100_aux_area)) {
2059                 input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
2060                                      0, MXT_MAX_AREA, 0, 0);
2061         }
2062
2063         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2064             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2065              data->t100_aux_ampl)) {
2066                 input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2067                                      0, 255, 0, 0);
2068         }
2069
2070         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2071             data->t100_aux_vect) {
2072                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2073                                      0, 255, 0, 0);
2074         }
2075
2076         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2077             data->t100_aux_vect) {
2078                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2079                                      0, 255, 0, 0);
2080         }
2081
2082         input_set_drvdata(input_dev, data);
2083
2084         error = input_register_device(input_dev);
2085         if (error) {
2086                 dev_err(dev, "Error %d registering input device\n", error);
2087                 goto err_free_mem;
2088         }
2089
2090         data->input_dev = input_dev;
2091
2092         return 0;
2093
2094 err_free_mem:
2095         input_free_device(input_dev);
2096         return error;
2097 }
2098
2099 static int mxt_configure_objects(struct mxt_data *data,
2100                                  const struct firmware *cfg);
2101
2102 static void mxt_config_cb(const struct firmware *cfg, void *ctx)
2103 {
2104         mxt_configure_objects(ctx, cfg);
2105         release_firmware(cfg);
2106 }
2107
2108 static int mxt_initialize(struct mxt_data *data)
2109 {
2110         struct i2c_client *client = data->client;
2111         int recovery_attempts = 0;
2112         int error;
2113
2114         while (1) {
2115                 error = mxt_read_info_block(data);
2116                 if (!error)
2117                         break;
2118
2119                 /* Check bootloader state */
2120                 error = mxt_probe_bootloader(data, false);
2121                 if (error) {
2122                         dev_info(&client->dev, "Trying alternate bootloader address\n");
2123                         error = mxt_probe_bootloader(data, true);
2124                         if (error) {
2125                                 /* Chip is not in appmode or bootloader mode */
2126                                 return error;
2127                         }
2128                 }
2129
2130                 /* OK, we are in bootloader, see if we can recover */
2131                 if (++recovery_attempts > 1) {
2132                         dev_err(&client->dev, "Could not recover from bootloader mode\n");
2133                         /*
2134                          * We can reflash from this state, so do not
2135                          * abort initialization.
2136                          */
2137                         data->in_bootloader = true;
2138                         return 0;
2139                 }
2140
2141                 /* Attempt to exit bootloader into app mode */
2142                 mxt_send_bootloader_cmd(data, false);
2143                 msleep(MXT_FW_RESET_TIME);
2144         }
2145
2146         error = mxt_acquire_irq(data);
2147         if (error)
2148                 return error;
2149
2150         error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
2151                                         &client->dev, GFP_KERNEL, data,
2152                                         mxt_config_cb);
2153         if (error) {
2154                 dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
2155                         error);
2156                 return error;
2157         }
2158
2159         return 0;
2160 }
2161
2162 static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
2163 {
2164         struct device *dev = &data->client->dev;
2165         int error;
2166         struct t7_config *new_config;
2167         struct t7_config deepsleep = { .active = 0, .idle = 0 };
2168
2169         if (sleep == MXT_POWER_CFG_DEEPSLEEP)
2170                 new_config = &deepsleep;
2171         else
2172                 new_config = &data->t7_cfg;
2173
2174         error = __mxt_write_reg(data->client, data->T7_address,
2175                                 sizeof(data->t7_cfg), new_config);
2176         if (error)
2177                 return error;
2178
2179         dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
2180                 new_config->active, new_config->idle);
2181
2182         return 0;
2183 }
2184
2185 static int mxt_init_t7_power_cfg(struct mxt_data *data)
2186 {
2187         struct device *dev = &data->client->dev;
2188         int error;
2189         bool retry = false;
2190
2191 recheck:
2192         error = __mxt_read_reg(data->client, data->T7_address,
2193                                 sizeof(data->t7_cfg), &data->t7_cfg);
2194         if (error)
2195                 return error;
2196
2197         if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
2198                 if (!retry) {
2199                         dev_dbg(dev, "T7 cfg zero, resetting\n");
2200                         mxt_soft_reset(data);
2201                         retry = true;
2202                         goto recheck;
2203                 } else {
2204                         dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
2205                         data->t7_cfg.active = 20;
2206                         data->t7_cfg.idle = 100;
2207                         return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2208                 }
2209         }
2210
2211         dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
2212                 data->t7_cfg.active, data->t7_cfg.idle);
2213         return 0;
2214 }
2215
2216 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
2217 static const struct v4l2_file_operations mxt_video_fops = {
2218         .owner = THIS_MODULE,
2219         .open = v4l2_fh_open,
2220         .release = vb2_fop_release,
2221         .unlocked_ioctl = video_ioctl2,
2222         .read = vb2_fop_read,
2223         .mmap = vb2_fop_mmap,
2224         .poll = vb2_fop_poll,
2225 };
2226
2227 static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
2228                                unsigned int y)
2229 {
2230         struct mxt_info *info = data->info;
2231         struct mxt_dbg *dbg = &data->dbg;
2232         unsigned int ofs, page;
2233         unsigned int col = 0;
2234         unsigned int col_width;
2235
2236         if (info->family_id == MXT_FAMILY_1386) {
2237                 col_width = info->matrix_ysize / MXT1386_COLUMNS;
2238                 col = y / col_width;
2239                 y = y % col_width;
2240         } else {
2241                 col_width = info->matrix_ysize;
2242         }
2243
2244         ofs = (y + (x * col_width)) * sizeof(u16);
2245         page = ofs / MXT_DIAGNOSTIC_SIZE;
2246         ofs %= MXT_DIAGNOSTIC_SIZE;
2247
2248         if (info->family_id == MXT_FAMILY_1386)
2249                 page += col * MXT1386_PAGES_PER_COLUMN;
2250
2251         return get_unaligned_le16(&dbg->t37_buf[page].data[ofs]);
2252 }
2253
2254 static int mxt_convert_debug_pages(struct mxt_data *data, u16 *outbuf)
2255 {
2256         struct mxt_dbg *dbg = &data->dbg;
2257         unsigned int x = 0;
2258         unsigned int y = 0;
2259         unsigned int i, rx, ry;
2260
2261         for (i = 0; i < dbg->t37_nodes; i++) {
2262                 /* Handle orientation */
2263                 rx = data->xy_switch ? y : x;
2264                 ry = data->xy_switch ? x : y;
2265                 rx = data->invertx ? (data->xsize - 1 - rx) : rx;
2266                 ry = data->inverty ? (data->ysize - 1 - ry) : ry;
2267
2268                 outbuf[i] = mxt_get_debug_value(data, rx, ry);
2269
2270                 /* Next value */
2271                 if (++x >= (data->xy_switch ? data->ysize : data->xsize)) {
2272                         x = 0;
2273                         y++;
2274                 }
2275         }
2276
2277         return 0;
2278 }
2279
2280 static int mxt_read_diagnostic_debug(struct mxt_data *data, u8 mode,
2281                                      u16 *outbuf)
2282 {
2283         struct mxt_dbg *dbg = &data->dbg;
2284         int retries = 0;
2285         int page;
2286         int ret;
2287         u8 cmd = mode;
2288         struct t37_debug *p;
2289         u8 cmd_poll;
2290
2291         for (page = 0; page < dbg->t37_pages; page++) {
2292                 p = dbg->t37_buf + page;
2293
2294                 ret = mxt_write_reg(data->client, dbg->diag_cmd_address,
2295                                     cmd);
2296                 if (ret)
2297                         return ret;
2298
2299                 retries = 0;
2300                 msleep(20);
2301 wait_cmd:
2302                 /* Read back command byte */
2303                 ret = __mxt_read_reg(data->client, dbg->diag_cmd_address,
2304                                      sizeof(cmd_poll), &cmd_poll);
2305                 if (ret)
2306                         return ret;
2307
2308                 /* Field is cleared once the command has been processed */
2309                 if (cmd_poll) {
2310                         if (retries++ > 100)
2311                                 return -EINVAL;
2312
2313                         msleep(20);
2314                         goto wait_cmd;
2315                 }
2316
2317                 /* Read T37 page */
2318                 ret = __mxt_read_reg(data->client, dbg->t37_address,
2319                                      sizeof(struct t37_debug), p);
2320                 if (ret)
2321                         return ret;
2322
2323                 if (p->mode != mode || p->page != page) {
2324                         dev_err(&data->client->dev, "T37 page mismatch\n");
2325                         return -EINVAL;
2326                 }
2327
2328                 dev_dbg(&data->client->dev, "%s page:%d retries:%d\n",
2329                         __func__, page, retries);
2330
2331                 /* For remaining pages, write PAGEUP rather than mode */
2332                 cmd = MXT_DIAGNOSTIC_PAGEUP;
2333         }
2334
2335         return mxt_convert_debug_pages(data, outbuf);
2336 }
2337
2338 static int mxt_queue_setup(struct vb2_queue *q,
2339                        unsigned int *nbuffers, unsigned int *nplanes,
2340                        unsigned int sizes[], struct device *alloc_devs[])
2341 {
2342         struct mxt_data *data = q->drv_priv;
2343         size_t size = data->dbg.t37_nodes * sizeof(u16);
2344
2345         if (*nplanes)
2346                 return sizes[0] < size ? -EINVAL : 0;
2347
2348         *nplanes = 1;
2349         sizes[0] = size;
2350
2351         return 0;
2352 }
2353
2354 static void mxt_buffer_queue(struct vb2_buffer *vb)
2355 {
2356         struct mxt_data *data = vb2_get_drv_priv(vb->vb2_queue);
2357         u16 *ptr;
2358         int ret;
2359         u8 mode;
2360
2361         ptr = vb2_plane_vaddr(vb, 0);
2362         if (!ptr) {
2363                 dev_err(&data->client->dev, "Error acquiring frame ptr\n");
2364                 goto fault;
2365         }
2366
2367         switch (data->dbg.input) {
2368         case MXT_V4L_INPUT_DELTAS:
2369         default:
2370                 mode = MXT_DIAGNOSTIC_DELTAS;
2371                 break;
2372
2373         case MXT_V4L_INPUT_REFS:
2374                 mode = MXT_DIAGNOSTIC_REFS;
2375                 break;
2376         }
2377
2378         ret = mxt_read_diagnostic_debug(data, mode, ptr);
2379         if (ret)
2380                 goto fault;
2381
2382         vb2_set_plane_payload(vb, 0, data->dbg.t37_nodes * sizeof(u16));
2383         vb2_buffer_done(vb, VB2_BUF_STATE_DONE);
2384         return;
2385
2386 fault:
2387         vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
2388 }
2389
2390 /* V4L2 structures */
2391 static const struct vb2_ops mxt_queue_ops = {
2392         .queue_setup            = mxt_queue_setup,
2393         .buf_queue              = mxt_buffer_queue,
2394         .wait_prepare           = vb2_ops_wait_prepare,
2395         .wait_finish            = vb2_ops_wait_finish,
2396 };
2397
2398 static const struct vb2_queue mxt_queue = {
2399         .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
2400         .io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
2401         .buf_struct_size = sizeof(struct mxt_vb2_buffer),
2402         .ops = &mxt_queue_ops,
2403         .mem_ops = &vb2_vmalloc_memops,
2404         .timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
2405         .min_buffers_needed = 1,
2406 };
2407
2408 static int mxt_vidioc_querycap(struct file *file, void *priv,
2409                                  struct v4l2_capability *cap)
2410 {
2411         struct mxt_data *data = video_drvdata(file);
2412
2413         strlcpy(cap->driver, "atmel_mxt_ts", sizeof(cap->driver));
2414         strlcpy(cap->card, "atmel_mxt_ts touch", sizeof(cap->card));
2415         snprintf(cap->bus_info, sizeof(cap->bus_info),
2416                  "I2C:%s", dev_name(&data->client->dev));
2417         return 0;
2418 }
2419
2420 static int mxt_vidioc_enum_input(struct file *file, void *priv,
2421                                    struct v4l2_input *i)
2422 {
2423         if (i->index >= MXT_V4L_INPUT_MAX)
2424                 return -EINVAL;
2425
2426         i->type = V4L2_INPUT_TYPE_TOUCH;
2427
2428         switch (i->index) {
2429         case MXT_V4L_INPUT_REFS:
2430                 strlcpy(i->name, "Mutual Capacitance References",
2431                         sizeof(i->name));
2432                 break;
2433         case MXT_V4L_INPUT_DELTAS:
2434                 strlcpy(i->name, "Mutual Capacitance Deltas", sizeof(i->name));
2435                 break;
2436         }
2437
2438         return 0;
2439 }
2440
2441 static int mxt_set_input(struct mxt_data *data, unsigned int i)
2442 {
2443         struct v4l2_pix_format *f = &data->dbg.format;
2444
2445         if (i >= MXT_V4L_INPUT_MAX)
2446                 return -EINVAL;
2447
2448         if (i == MXT_V4L_INPUT_DELTAS)
2449                 f->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2450         else
2451                 f->pixelformat = V4L2_TCH_FMT_TU16;
2452
2453         f->width = data->xy_switch ? data->ysize : data->xsize;
2454         f->height = data->xy_switch ? data->xsize : data->ysize;
2455         f->field = V4L2_FIELD_NONE;
2456         f->colorspace = V4L2_COLORSPACE_RAW;
2457         f->bytesperline = f->width * sizeof(u16);
2458         f->sizeimage = f->width * f->height * sizeof(u16);
2459
2460         data->dbg.input = i;
2461
2462         return 0;
2463 }
2464
2465 static int mxt_vidioc_s_input(struct file *file, void *priv, unsigned int i)
2466 {
2467         return mxt_set_input(video_drvdata(file), i);
2468 }
2469
2470 static int mxt_vidioc_g_input(struct file *file, void *priv, unsigned int *i)
2471 {
2472         struct mxt_data *data = video_drvdata(file);
2473
2474         *i = data->dbg.input;
2475
2476         return 0;
2477 }
2478
2479 static int mxt_vidioc_fmt(struct file *file, void *priv, struct v4l2_format *f)
2480 {
2481         struct mxt_data *data = video_drvdata(file);
2482
2483         f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
2484         f->fmt.pix = data->dbg.format;
2485
2486         return 0;
2487 }
2488
2489 static int mxt_vidioc_enum_fmt(struct file *file, void *priv,
2490                                  struct v4l2_fmtdesc *fmt)
2491 {
2492         if (fmt->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2493                 return -EINVAL;
2494
2495         switch (fmt->index) {
2496         case 0:
2497                 fmt->pixelformat = V4L2_TCH_FMT_TU16;
2498                 break;
2499
2500         case 1:
2501                 fmt->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2502                 break;
2503
2504         default:
2505                 return -EINVAL;
2506         }
2507
2508         return 0;
2509 }
2510
2511 static int mxt_vidioc_g_parm(struct file *file, void *fh,
2512                              struct v4l2_streamparm *a)
2513 {
2514         if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2515                 return -EINVAL;
2516
2517         a->parm.capture.readbuffers = 1;
2518         a->parm.capture.timeperframe.numerator = 1;
2519         a->parm.capture.timeperframe.denominator = 10;
2520         return 0;
2521 }
2522
2523 static const struct v4l2_ioctl_ops mxt_video_ioctl_ops = {
2524         .vidioc_querycap        = mxt_vidioc_querycap,
2525
2526         .vidioc_enum_fmt_vid_cap = mxt_vidioc_enum_fmt,
2527         .vidioc_s_fmt_vid_cap   = mxt_vidioc_fmt,
2528         .vidioc_g_fmt_vid_cap   = mxt_vidioc_fmt,
2529         .vidioc_try_fmt_vid_cap = mxt_vidioc_fmt,
2530         .vidioc_g_parm          = mxt_vidioc_g_parm,
2531
2532         .vidioc_enum_input      = mxt_vidioc_enum_input,
2533         .vidioc_g_input         = mxt_vidioc_g_input,
2534         .vidioc_s_input         = mxt_vidioc_s_input,
2535
2536         .vidioc_reqbufs         = vb2_ioctl_reqbufs,
2537         .vidioc_create_bufs     = vb2_ioctl_create_bufs,
2538         .vidioc_querybuf        = vb2_ioctl_querybuf,
2539         .vidioc_qbuf            = vb2_ioctl_qbuf,
2540         .vidioc_dqbuf           = vb2_ioctl_dqbuf,
2541         .vidioc_expbuf          = vb2_ioctl_expbuf,
2542
2543         .vidioc_streamon        = vb2_ioctl_streamon,
2544         .vidioc_streamoff       = vb2_ioctl_streamoff,
2545 };
2546
2547 static const struct video_device mxt_video_device = {
2548         .name = "Atmel maxTouch",
2549         .fops = &mxt_video_fops,
2550         .ioctl_ops = &mxt_video_ioctl_ops,
2551         .release = video_device_release_empty,
2552         .device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TOUCH |
2553                        V4L2_CAP_READWRITE | V4L2_CAP_STREAMING,
2554 };
2555
2556 static void mxt_debug_init(struct mxt_data *data)
2557 {
2558         struct mxt_info *info = data->info;
2559         struct mxt_dbg *dbg = &data->dbg;
2560         struct mxt_object *object;
2561         int error;
2562
2563         object = mxt_get_object(data, MXT_GEN_COMMAND_T6);
2564         if (!object)
2565                 goto error;
2566
2567         dbg->diag_cmd_address = object->start_address + MXT_COMMAND_DIAGNOSTIC;
2568
2569         object = mxt_get_object(data, MXT_DEBUG_DIAGNOSTIC_T37);
2570         if (!object)
2571                 goto error;
2572
2573         if (mxt_obj_size(object) != sizeof(struct t37_debug)) {
2574                 dev_warn(&data->client->dev, "Bad T37 size");
2575                 goto error;
2576         }
2577
2578         dbg->t37_address = object->start_address;
2579
2580         /* Calculate size of data and allocate buffer */
2581         dbg->t37_nodes = data->xsize * data->ysize;
2582
2583         if (info->family_id == MXT_FAMILY_1386)
2584                 dbg->t37_pages = MXT1386_COLUMNS * MXT1386_PAGES_PER_COLUMN;
2585         else
2586                 dbg->t37_pages = DIV_ROUND_UP(data->xsize *
2587                                               info->matrix_ysize *
2588                                               sizeof(u16),
2589                                               sizeof(dbg->t37_buf->data));
2590
2591         dbg->t37_buf = devm_kmalloc_array(&data->client->dev, dbg->t37_pages,
2592                                           sizeof(struct t37_debug), GFP_KERNEL);
2593         if (!dbg->t37_buf)
2594                 goto error;
2595
2596         /* init channel to zero */
2597         mxt_set_input(data, 0);
2598
2599         /* register video device */
2600         snprintf(dbg->v4l2.name, sizeof(dbg->v4l2.name), "%s", "atmel_mxt_ts");
2601         error = v4l2_device_register(&data->client->dev, &dbg->v4l2);
2602         if (error)
2603                 goto error;
2604
2605         /* initialize the queue */
2606         mutex_init(&dbg->lock);
2607         dbg->queue = mxt_queue;
2608         dbg->queue.drv_priv = data;
2609         dbg->queue.lock = &dbg->lock;
2610         dbg->queue.dev = &data->client->dev;
2611
2612         error = vb2_queue_init(&dbg->queue);
2613         if (error)
2614                 goto error_unreg_v4l2;
2615
2616         dbg->vdev = mxt_video_device;
2617         dbg->vdev.v4l2_dev = &dbg->v4l2;
2618         dbg->vdev.lock = &dbg->lock;
2619         dbg->vdev.vfl_dir = VFL_DIR_RX;
2620         dbg->vdev.queue = &dbg->queue;
2621         video_set_drvdata(&dbg->vdev, data);
2622
2623         error = video_register_device(&dbg->vdev, VFL_TYPE_TOUCH, -1);
2624         if (error)
2625                 goto error_unreg_v4l2;
2626
2627         return;
2628
2629 error_unreg_v4l2:
2630         v4l2_device_unregister(&dbg->v4l2);
2631 error:
2632         dev_warn(&data->client->dev, "Error initializing T37\n");
2633 }
2634 #else
2635 static void mxt_debug_init(struct mxt_data *data)
2636 {
2637 }
2638 #endif
2639
2640 static int mxt_configure_objects(struct mxt_data *data,
2641                                  const struct firmware *cfg)
2642 {
2643         struct device *dev = &data->client->dev;
2644         int error;
2645
2646         error = mxt_init_t7_power_cfg(data);
2647         if (error) {
2648                 dev_err(dev, "Failed to initialize power cfg\n");
2649                 return error;
2650         }
2651
2652         if (cfg) {
2653                 error = mxt_update_cfg(data, cfg);
2654                 if (error)
2655                         dev_warn(dev, "Error %d updating config\n", error);
2656         }
2657
2658         if (data->multitouch) {
2659                 error = mxt_initialize_input_device(data);
2660                 if (error)
2661                         return error;
2662         } else {
2663                 dev_warn(dev, "No touch object detected\n");
2664         }
2665
2666         mxt_debug_init(data);
2667
2668         return 0;
2669 }
2670
2671 /* Firmware Version is returned as Major.Minor.Build */
2672 static ssize_t mxt_fw_version_show(struct device *dev,
2673                                    struct device_attribute *attr, char *buf)
2674 {
2675         struct mxt_data *data = dev_get_drvdata(dev);
2676         struct mxt_info *info = data->info;
2677         return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
2678                          info->version >> 4, info->version & 0xf, info->build);
2679 }
2680
2681 /* Hardware Version is returned as FamilyID.VariantID */
2682 static ssize_t mxt_hw_version_show(struct device *dev,
2683                                    struct device_attribute *attr, char *buf)
2684 {
2685         struct mxt_data *data = dev_get_drvdata(dev);
2686         struct mxt_info *info = data->info;
2687         return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
2688                          info->family_id, info->variant_id);
2689 }
2690
2691 static ssize_t mxt_show_instance(char *buf, int count,
2692                                  struct mxt_object *object, int instance,
2693                                  const u8 *val)
2694 {
2695         int i;
2696
2697         if (mxt_obj_instances(object) > 1)
2698                 count += scnprintf(buf + count, PAGE_SIZE - count,
2699                                    "Instance %u\n", instance);
2700
2701         for (i = 0; i < mxt_obj_size(object); i++)
2702                 count += scnprintf(buf + count, PAGE_SIZE - count,
2703                                 "\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
2704         count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
2705
2706         return count;
2707 }
2708
2709 static ssize_t mxt_object_show(struct device *dev,
2710                                     struct device_attribute *attr, char *buf)
2711 {
2712         struct mxt_data *data = dev_get_drvdata(dev);
2713         struct mxt_object *object;
2714         int count = 0;
2715         int i, j;
2716         int error;
2717         u8 *obuf;
2718
2719         /* Pre-allocate buffer large enough to hold max sized object. */
2720         obuf = kmalloc(256, GFP_KERNEL);
2721         if (!obuf)
2722                 return -ENOMEM;
2723
2724         error = 0;
2725         for (i = 0; i < data->info->object_num; i++) {
2726                 object = data->object_table + i;
2727
2728                 if (!mxt_object_readable(object->type))
2729                         continue;
2730
2731                 count += scnprintf(buf + count, PAGE_SIZE - count,
2732                                 "T%u:\n", object->type);
2733
2734                 for (j = 0; j < mxt_obj_instances(object); j++) {
2735                         u16 size = mxt_obj_size(object);
2736                         u16 addr = object->start_address + j * size;
2737
2738                         error = __mxt_read_reg(data->client, addr, size, obuf);
2739                         if (error)
2740                                 goto done;
2741
2742                         count = mxt_show_instance(buf, count, object, j, obuf);
2743                 }
2744         }
2745
2746 done:
2747         kfree(obuf);
2748         return error ?: count;
2749 }
2750
2751 static int mxt_check_firmware_format(struct device *dev,
2752                                      const struct firmware *fw)
2753 {
2754         unsigned int pos = 0;
2755         char c;
2756
2757         while (pos < fw->size) {
2758                 c = *(fw->data + pos);
2759
2760                 if (c < '0' || (c > '9' && c < 'A') || c > 'F')
2761                         return 0;
2762
2763                 pos++;
2764         }
2765
2766         /*
2767          * To convert file try:
2768          * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
2769          */
2770         dev_err(dev, "Aborting: firmware file must be in binary format\n");
2771
2772         return -EINVAL;
2773 }
2774
2775 static int mxt_load_fw(struct device *dev, const char *fn)
2776 {
2777         struct mxt_data *data = dev_get_drvdata(dev);
2778         const struct firmware *fw = NULL;
2779         unsigned int frame_size;
2780         unsigned int pos = 0;
2781         unsigned int retry = 0;
2782         unsigned int frame = 0;
2783         int ret;
2784
2785         ret = request_firmware(&fw, fn, dev);
2786         if (ret) {
2787                 dev_err(dev, "Unable to open firmware %s\n", fn);
2788                 return ret;
2789         }
2790
2791         /* Check for incorrect enc file */
2792         ret = mxt_check_firmware_format(dev, fw);
2793         if (ret)
2794                 goto release_firmware;
2795
2796         if (!data->in_bootloader) {
2797                 /* Change to the bootloader mode */
2798                 data->in_bootloader = true;
2799
2800                 ret = mxt_t6_command(data, MXT_COMMAND_RESET,
2801                                      MXT_BOOT_VALUE, false);
2802                 if (ret)
2803                         goto release_firmware;
2804
2805                 msleep(MXT_RESET_TIME);
2806
2807                 /* Do not need to scan since we know family ID */
2808                 ret = mxt_lookup_bootloader_address(data, 0);
2809                 if (ret)
2810                         goto release_firmware;
2811
2812                 mxt_free_input_device(data);
2813                 mxt_free_object_table(data);
2814         } else {
2815                 enable_irq(data->irq);
2816         }
2817
2818         reinit_completion(&data->bl_completion);
2819
2820         ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
2821         if (ret) {
2822                 /* Bootloader may still be unlocked from previous attempt */
2823                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
2824                 if (ret)
2825                         goto disable_irq;
2826         } else {
2827                 dev_info(dev, "Unlocking bootloader\n");
2828
2829                 /* Unlock bootloader */
2830                 ret = mxt_send_bootloader_cmd(data, true);
2831                 if (ret)
2832                         goto disable_irq;
2833         }
2834
2835         while (pos < fw->size) {
2836                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
2837                 if (ret)
2838                         goto disable_irq;
2839
2840                 frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
2841
2842                 /* Take account of CRC bytes */
2843                 frame_size += 2;
2844
2845                 /* Write one frame to device */
2846                 ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
2847                 if (ret)
2848                         goto disable_irq;
2849
2850                 ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
2851                 if (ret) {
2852                         retry++;
2853
2854                         /* Back off by 20ms per retry */
2855                         msleep(retry * 20);
2856
2857                         if (retry > 20) {
2858                                 dev_err(dev, "Retry count exceeded\n");
2859                                 goto disable_irq;
2860                         }
2861                 } else {
2862                         retry = 0;
2863                         pos += frame_size;
2864                         frame++;
2865                 }
2866
2867                 if (frame % 50 == 0)
2868                         dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
2869                                 frame, pos, fw->size);
2870         }
2871
2872         /* Wait for flash. */
2873         ret = mxt_wait_for_completion(data, &data->bl_completion,
2874                                       MXT_FW_RESET_TIME);
2875         if (ret)
2876                 goto disable_irq;
2877
2878         dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
2879
2880         /*
2881          * Wait for device to reset. Some bootloader versions do not assert
2882          * the CHG line after bootloading has finished, so ignore potential
2883          * errors.
2884          */
2885         mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
2886
2887         data->in_bootloader = false;
2888
2889 disable_irq:
2890         disable_irq(data->irq);
2891 release_firmware:
2892         release_firmware(fw);
2893         return ret;
2894 }
2895
2896 static ssize_t mxt_update_fw_store(struct device *dev,
2897                                         struct device_attribute *attr,
2898                                         const char *buf, size_t count)
2899 {
2900         struct mxt_data *data = dev_get_drvdata(dev);
2901         int error;
2902
2903         error = mxt_load_fw(dev, MXT_FW_NAME);
2904         if (error) {
2905                 dev_err(dev, "The firmware update failed(%d)\n", error);
2906                 count = error;
2907         } else {
2908                 dev_info(dev, "The firmware update succeeded\n");
2909
2910                 error = mxt_initialize(data);
2911                 if (error)
2912                         return error;
2913         }
2914
2915         return count;
2916 }
2917
2918 static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2919 static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2920 static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2921 static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2922
2923 static struct attribute *mxt_attrs[] = {
2924         &dev_attr_fw_version.attr,
2925         &dev_attr_hw_version.attr,
2926         &dev_attr_object.attr,
2927         &dev_attr_update_fw.attr,
2928         NULL
2929 };
2930
2931 static const struct attribute_group mxt_attr_group = {
2932         .attrs = mxt_attrs,
2933 };
2934
2935 static void mxt_start(struct mxt_data *data)
2936 {
2937         switch (data->suspend_mode) {
2938         case MXT_SUSPEND_T9_CTRL:
2939                 mxt_soft_reset(data);
2940
2941                 /* Touch enable */
2942                 /* 0x83 = SCANEN | RPTEN | ENABLE */
2943                 mxt_write_object(data,
2944                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0x83);
2945                 break;
2946
2947         case MXT_SUSPEND_DEEP_SLEEP:
2948         default:
2949                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2950
2951                 /* Recalibrate since chip has been in deep sleep */
2952                 mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
2953                 break;
2954         }
2955 }
2956
2957 static void mxt_stop(struct mxt_data *data)
2958 {
2959         switch (data->suspend_mode) {
2960         case MXT_SUSPEND_T9_CTRL:
2961                 /* Touch disable */
2962                 mxt_write_object(data,
2963                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0);
2964                 break;
2965
2966         case MXT_SUSPEND_DEEP_SLEEP:
2967         default:
2968                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
2969                 break;
2970         }
2971 }
2972
2973 static int mxt_input_open(struct input_dev *dev)
2974 {
2975         struct mxt_data *data = input_get_drvdata(dev);
2976
2977         mxt_start(data);
2978
2979         return 0;
2980 }
2981
2982 static void mxt_input_close(struct input_dev *dev)
2983 {
2984         struct mxt_data *data = input_get_drvdata(dev);
2985
2986         mxt_stop(data);
2987 }
2988
2989 static int mxt_parse_device_properties(struct mxt_data *data)
2990 {
2991         static const char keymap_property[] = "linux,gpio-keymap";
2992         struct device *dev = &data->client->dev;
2993         u32 *keymap;
2994         int n_keys;
2995         int error;
2996
2997         if (device_property_present(dev, keymap_property)) {
2998                 n_keys = device_property_read_u32_array(dev, keymap_property,
2999                                                         NULL, 0);
3000                 if (n_keys <= 0) {
3001                         error = n_keys < 0 ? n_keys : -EINVAL;
3002                         dev_err(dev, "invalid/malformed '%s' property: %d\n",
3003                                 keymap_property, error);
3004                         return error;
3005                 }
3006
3007                 keymap = devm_kmalloc_array(dev, n_keys, sizeof(*keymap),
3008                                             GFP_KERNEL);
3009                 if (!keymap)
3010                         return -ENOMEM;
3011
3012                 error = device_property_read_u32_array(dev, keymap_property,
3013                                                        keymap, n_keys);
3014                 if (error) {
3015                         dev_err(dev, "failed to parse '%s' property: %d\n",
3016                                 keymap_property, error);
3017                         return error;
3018                 }
3019
3020                 data->t19_keymap = keymap;
3021                 data->t19_num_keys = n_keys;
3022         }
3023
3024         return 0;
3025 }
3026
3027 static const struct dmi_system_id chromebook_T9_suspend_dmi[] = {
3028         {
3029                 .matches = {
3030                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3031                         DMI_MATCH(DMI_PRODUCT_NAME, "Link"),
3032                 },
3033         },
3034         {
3035                 .matches = {
3036                         DMI_MATCH(DMI_PRODUCT_NAME, "Peppy"),
3037                 },
3038         },
3039         { }
3040 };
3041
3042 static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
3043 {
3044         struct mxt_data *data;
3045         int error;
3046
3047         /*
3048          * Ignore devices that do not have device properties attached to
3049          * them, as we need help determining whether we are dealing with
3050          * touch screen or touchpad.
3051          *
3052          * So far on x86 the only users of Atmel touch controllers are
3053          * Chromebooks, and chromeos_laptop driver will ensure that
3054          * necessary properties are provided (if firmware does not do that).
3055          */
3056         if (!device_property_present(&client->dev, "compatible"))
3057                 return -ENXIO;
3058
3059         /*
3060          * Ignore ACPI devices representing bootloader mode.
3061          *
3062          * This is a bit of a hack: Google Chromebook BIOS creates ACPI
3063          * devices for both application and bootloader modes, but we are
3064          * interested in application mode only (if device is in bootloader
3065          * mode we'll end up switching into application anyway). So far
3066          * application mode addresses were all above 0x40, so we'll use it
3067          * as a threshold.
3068          */
3069         if (ACPI_COMPANION(&client->dev) && client->addr < 0x40)
3070                 return -ENXIO;
3071
3072         data = devm_kzalloc(&client->dev, sizeof(struct mxt_data), GFP_KERNEL);
3073         if (!data)
3074                 return -ENOMEM;
3075
3076         snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
3077                  client->adapter->nr, client->addr);
3078
3079         data->client = client;
3080         data->irq = client->irq;
3081         i2c_set_clientdata(client, data);
3082
3083         init_completion(&data->bl_completion);
3084         init_completion(&data->reset_completion);
3085         init_completion(&data->crc_completion);
3086
3087         data->suspend_mode = dmi_check_system(chromebook_T9_suspend_dmi) ?
3088                 MXT_SUSPEND_T9_CTRL : MXT_SUSPEND_DEEP_SLEEP;
3089
3090         error = mxt_parse_device_properties(data);
3091         if (error)
3092                 return error;
3093
3094         data->reset_gpio = devm_gpiod_get_optional(&client->dev,
3095                                                    "reset", GPIOD_OUT_LOW);
3096         if (IS_ERR(data->reset_gpio)) {
3097                 error = PTR_ERR(data->reset_gpio);
3098                 dev_err(&client->dev, "Failed to get reset gpio: %d\n", error);
3099                 return error;
3100         }
3101
3102         error = devm_request_threaded_irq(&client->dev, client->irq,
3103                                           NULL, mxt_interrupt, IRQF_ONESHOT,
3104                                           client->name, data);
3105         if (error) {
3106                 dev_err(&client->dev, "Failed to register interrupt\n");
3107                 return error;
3108         }
3109
3110         disable_irq(client->irq);
3111
3112         if (data->reset_gpio) {
3113                 msleep(MXT_RESET_GPIO_TIME);
3114                 gpiod_set_value(data->reset_gpio, 1);
3115                 msleep(MXT_RESET_INVALID_CHG);
3116         }
3117
3118         error = mxt_initialize(data);
3119         if (error)
3120                 return error;
3121
3122         error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
3123         if (error) {
3124                 dev_err(&client->dev, "Failure %d creating sysfs group\n",
3125                         error);
3126                 goto err_free_object;
3127         }
3128
3129         return 0;
3130
3131 err_free_object:
3132         mxt_free_input_device(data);
3133         mxt_free_object_table(data);
3134         return error;
3135 }
3136
3137 static int mxt_remove(struct i2c_client *client)
3138 {
3139         struct mxt_data *data = i2c_get_clientdata(client);
3140
3141         disable_irq(data->irq);
3142         sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
3143         mxt_free_input_device(data);
3144         mxt_free_object_table(data);
3145
3146         return 0;
3147 }
3148
3149 static int __maybe_unused mxt_suspend(struct device *dev)
3150 {
3151         struct i2c_client *client = to_i2c_client(dev);
3152         struct mxt_data *data = i2c_get_clientdata(client);
3153         struct input_dev *input_dev = data->input_dev;
3154
3155         if (!input_dev)
3156                 return 0;
3157
3158         mutex_lock(&input_dev->mutex);
3159
3160         if (input_dev->users)
3161                 mxt_stop(data);
3162
3163         mutex_unlock(&input_dev->mutex);
3164
3165         return 0;
3166 }
3167
3168 static int __maybe_unused mxt_resume(struct device *dev)
3169 {
3170         struct i2c_client *client = to_i2c_client(dev);
3171         struct mxt_data *data = i2c_get_clientdata(client);
3172         struct input_dev *input_dev = data->input_dev;
3173
3174         if (!input_dev)
3175                 return 0;
3176
3177         mutex_lock(&input_dev->mutex);
3178
3179         if (input_dev->users)
3180                 mxt_start(data);
3181
3182         mutex_unlock(&input_dev->mutex);
3183
3184         return 0;
3185 }
3186
3187 static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
3188
3189 static const struct of_device_id mxt_of_match[] = {
3190         { .compatible = "atmel,maxtouch", },
3191         /* Compatibles listed below are deprecated */
3192         { .compatible = "atmel,qt602240_ts", },
3193         { .compatible = "atmel,atmel_mxt_ts", },
3194         { .compatible = "atmel,atmel_mxt_tp", },
3195         { .compatible = "atmel,mXT224", },
3196         {},
3197 };
3198 MODULE_DEVICE_TABLE(of, mxt_of_match);
3199
3200 #ifdef CONFIG_ACPI
3201 static const struct acpi_device_id mxt_acpi_id[] = {
3202         { "ATML0000", 0 },      /* Touchpad */
3203         { "ATML0001", 0 },      /* Touchscreen */
3204         { }
3205 };
3206 MODULE_DEVICE_TABLE(acpi, mxt_acpi_id);
3207 #endif
3208
3209 static const struct i2c_device_id mxt_id[] = {
3210         { "qt602240_ts", 0 },
3211         { "atmel_mxt_ts", 0 },
3212         { "atmel_mxt_tp", 0 },
3213         { "maxtouch", 0 },
3214         { "mXT224", 0 },
3215         { }
3216 };
3217 MODULE_DEVICE_TABLE(i2c, mxt_id);
3218
3219 static struct i2c_driver mxt_driver = {
3220         .driver = {
3221                 .name   = "atmel_mxt_ts",
3222                 .of_match_table = mxt_of_match,
3223                 .acpi_match_table = ACPI_PTR(mxt_acpi_id),
3224                 .pm     = &mxt_pm_ops,
3225         },
3226         .probe          = mxt_probe,
3227         .remove         = mxt_remove,
3228         .id_table       = mxt_id,
3229 };
3230
3231 module_i2c_driver(mxt_driver);
3232
3233 /* Module information */
3234 MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
3235 MODULE_DESCRIPTION("Atmel maXTouch Touchscreen driver");
3236 MODULE_LICENSE("GPL");