drivers/input/touchscreen/atmel_mxt_ts.c

   1 /*
   2  * Atmel maXTouch Touchscreen driver
   3  *
   4  * Copyright (C) 2010 Samsung Electronics Co.Ltd
   5  * Copyright (C) 2011-2014 Atmel Corporation
   6  * Copyright (C) 2012 Google, Inc.
   7  * Copyright (C) 2016 Zodiac Inflight Innovations
   8  *
   9  * Author: Joonyoung Shim <[email protected]>
  10  *
  11  * This program is free software; you can redistribute  it and/or modify it
  12  * under  the terms of  the GNU General  Public License as published by the
  13  * Free Software Foundation;  either version 2 of the  License, or (at your
  14  * option) any later version.
  15  *
  16  */
  17
  18 #include <linux/acpi.h>
  19 #include <linux/dmi.h>
  20 #include <linux/module.h>
  21 #include <linux/init.h>
  22 #include <linux/completion.h>
  23 #include <linux/delay.h>
  24 #include <linux/firmware.h>
  25 #include <linux/i2c.h>
  26 #include <linux/input/mt.h>
  27 #include <linux/interrupt.h>
  28 #include <linux/of.h>
  29 #include <linux/property.h>
  30 #include <linux/slab.h>
  31 #include <linux/gpio/consumer.h>
  32 #include <linux/property.h>
  33 #include <asm/unaligned.h>
  34 #include <media/v4l2-device.h>
  35 #include <media/v4l2-ioctl.h>
  36 #include <media/videobuf2-v4l2.h>
  37 #include <media/videobuf2-vmalloc.h>
  38
  39 /* Firmware files */
  40 #define MXT_FW_NAME             "maxtouch.fw"
  41 #define MXT_CFG_NAME            "maxtouch.cfg"
  42 #define MXT_CFG_MAGIC           "OBP_RAW V1"
  43
  44 /* Registers */
  45 #define MXT_OBJECT_START        0x07
  46 #define MXT_OBJECT_SIZE         6
  47 #define MXT_INFO_CHECKSUM_SIZE  3
  48 #define MXT_MAX_BLOCK_WRITE     256
  49
  50 /* Object types */
  51 #define MXT_DEBUG_DIAGNOSTIC_T37        37
  52 #define MXT_GEN_MESSAGE_T5              5
  53 #define MXT_GEN_COMMAND_T6              6
  54 #define MXT_GEN_POWER_T7                7
  55 #define MXT_GEN_ACQUIRE_T8              8
  56 #define MXT_GEN_DATASOURCE_T53          53
  57 #define MXT_TOUCH_MULTI_T9              9
  58 #define MXT_TOUCH_KEYARRAY_T15          15
  59 #define MXT_TOUCH_PROXIMITY_T23         23
  60 #define MXT_TOUCH_PROXKEY_T52           52
  61 #define MXT_PROCI_GRIPFACE_T20          20
  62 #define MXT_PROCG_NOISE_T22             22
  63 #define MXT_PROCI_ONETOUCH_T24          24
  64 #define MXT_PROCI_TWOTOUCH_T27          27
  65 #define MXT_PROCI_GRIP_T40              40
  66 #define MXT_PROCI_PALM_T41              41
  67 #define MXT_PROCI_TOUCHSUPPRESSION_T42  42
  68 #define MXT_PROCI_STYLUS_T47            47
  69 #define MXT_PROCG_NOISESUPPRESSION_T48  48
  70 #define MXT_SPT_COMMSCONFIG_T18         18
  71 #define MXT_SPT_GPIOPWM_T19             19
  72 #define MXT_SPT_SELFTEST_T25            25
  73 #define MXT_SPT_CTECONFIG_T28           28
  74 #define MXT_SPT_USERDATA_T38            38
  75 #define MXT_SPT_DIGITIZER_T43           43
  76 #define MXT_SPT_MESSAGECOUNT_T44        44
  77 #define MXT_SPT_CTECONFIG_T46           46
  78 #define MXT_TOUCH_MULTITOUCHSCREEN_T100 100
  79
  80 /* MXT_GEN_MESSAGE_T5 object */
  81 #define MXT_RPTID_NOMSG         0xff
  82
  83 /* MXT_GEN_COMMAND_T6 field */
  84 #define MXT_COMMAND_RESET       0
  85 #define MXT_COMMAND_BACKUPNV    1
  86 #define MXT_COMMAND_CALIBRATE   2
  87 #define MXT_COMMAND_REPORTALL   3
  88 #define MXT_COMMAND_DIAGNOSTIC  5
  89
  90 /* Define for T6 status byte */
  91 #define MXT_T6_STATUS_RESET     (1 << 7)
  92 #define MXT_T6_STATUS_OFL       (1 << 6)
  93 #define MXT_T6_STATUS_SIGERR    (1 << 5)
  94 #define MXT_T6_STATUS_CAL       (1 << 4)
  95 #define MXT_T6_STATUS_CFGERR    (1 << 3)
  96 #define MXT_T6_STATUS_COMSERR   (1 << 2)
  97
  98 /* MXT_GEN_POWER_T7 field */
  99 struct t7_config {
 100         u8 idle;
 101         u8 active;
 102 } __packed;
 103
 104 #define MXT_POWER_CFG_RUN               0
 105 #define MXT_POWER_CFG_DEEPSLEEP         1
 106
 107 /* MXT_TOUCH_MULTI_T9 field */
 108 #define MXT_T9_CTRL             0
 109 #define MXT_T9_XSIZE            3
 110 #define MXT_T9_YSIZE            4
 111 #define MXT_T9_ORIENT           9
 112 #define MXT_T9_RANGE            18
 113
 114 /* MXT_TOUCH_MULTI_T9 status */
 115 #define MXT_T9_UNGRIP           (1 << 0)
 116 #define MXT_T9_SUPPRESS         (1 << 1)
 117 #define MXT_T9_AMP              (1 << 2)
 118 #define MXT_T9_VECTOR           (1 << 3)
 119 #define MXT_T9_MOVE             (1 << 4)
 120 #define MXT_T9_RELEASE          (1 << 5)
 121 #define MXT_T9_PRESS            (1 << 6)
 122 #define MXT_T9_DETECT           (1 << 7)
 123
 124 struct t9_range {
 125         __le16 x;
 126         __le16 y;
 127 } __packed;
 128
 129 /* MXT_TOUCH_MULTI_T9 orient */
 130 #define MXT_T9_ORIENT_SWITCH    (1 << 0)
 131 #define MXT_T9_ORIENT_INVERTX   (1 << 1)
 132 #define MXT_T9_ORIENT_INVERTY   (1 << 2)
 133
 134 /* MXT_SPT_COMMSCONFIG_T18 */
 135 #define MXT_COMMS_CTRL          0
 136 #define MXT_COMMS_CMD           1
 137
 138 /* MXT_DEBUG_DIAGNOSTIC_T37 */
 139 #define MXT_DIAGNOSTIC_PAGEUP   0x01
 140 #define MXT_DIAGNOSTIC_DELTAS   0x10
 141 #define MXT_DIAGNOSTIC_REFS     0x11
 142 #define MXT_DIAGNOSTIC_SIZE     128
 143
 144 #define MXT_FAMILY_1386                 160
 145 #define MXT1386_COLUMNS                 3
 146 #define MXT1386_PAGES_PER_COLUMN        8
 147
 148 struct t37_debug {
 149 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
 150         u8 mode;
 151         u8 page;
 152         u8 data[MXT_DIAGNOSTIC_SIZE];
 153 #endif
 154 };
 155
 156 /* Define for MXT_GEN_COMMAND_T6 */
 157 #define MXT_BOOT_VALUE          0xa5
 158 #define MXT_RESET_VALUE         0x01
 159 #define MXT_BACKUP_VALUE        0x55
 160
 161 /* T100 Multiple Touch Touchscreen */
 162 #define MXT_T100_CTRL           0
 163 #define MXT_T100_CFG1           1
 164 #define MXT_T100_TCHAUX         3
 165 #define MXT_T100_XSIZE          9
 166 #define MXT_T100_XRANGE         13
 167 #define MXT_T100_YSIZE          20
 168 #define MXT_T100_YRANGE         24
 169
 170 #define MXT_T100_CFG_SWITCHXY   BIT(5)
 171 #define MXT_T100_CFG_INVERTY    BIT(6)
 172 #define MXT_T100_CFG_INVERTX    BIT(7)
 173
 174 #define MXT_T100_TCHAUX_VECT    BIT(0)
 175 #define MXT_T100_TCHAUX_AMPL    BIT(1)
 176 #define MXT_T100_TCHAUX_AREA    BIT(2)
 177
 178 #define MXT_T100_DETECT         BIT(7)
 179 #define MXT_T100_TYPE_MASK      0x70
 180
 181 enum t100_type {
 182         MXT_T100_TYPE_FINGER            = 1,
 183         MXT_T100_TYPE_PASSIVE_STYLUS    = 2,
 184         MXT_T100_TYPE_HOVERING_FINGER   = 4,
 185         MXT_T100_TYPE_GLOVE             = 5,
 186         MXT_T100_TYPE_LARGE_TOUCH       = 6,
 187 };
 188
 189 #define MXT_DISTANCE_ACTIVE_TOUCH       0
 190 #define MXT_DISTANCE_HOVERING           1
 191
 192 #define MXT_TOUCH_MAJOR_DEFAULT         1
 193 #define MXT_PRESSURE_DEFAULT            1
 194
 195 /* Delay times */
 196 #define MXT_BACKUP_TIME         50      /* msec */
 197 #define MXT_RESET_GPIO_TIME     20      /* msec */
 198 #define MXT_RESET_INVALID_CHG   100     /* msec */
 199 #define MXT_RESET_TIME          200     /* msec */
 200 #define MXT_RESET_TIMEOUT       3000    /* msec */
 201 #define MXT_CRC_TIMEOUT         1000    /* msec */
 202 #define MXT_FW_RESET_TIME       3000    /* msec */
 203 #define MXT_FW_CHG_TIMEOUT      300     /* msec */
 204
 205 /* Command to unlock bootloader */
 206 #define MXT_UNLOCK_CMD_MSB      0xaa
 207 #define MXT_UNLOCK_CMD_LSB      0xdc
 208
 209 /* Bootloader mode status */
 210 #define MXT_WAITING_BOOTLOAD_CMD        0xc0    /* valid 7 6 bit only */
 211 #define MXT_WAITING_FRAME_DATA  0x80    /* valid 7 6 bit only */
 212 #define MXT_FRAME_CRC_CHECK     0x02
 213 #define MXT_FRAME_CRC_FAIL      0x03
 214 #define MXT_FRAME_CRC_PASS      0x04
 215 #define MXT_APP_CRC_FAIL        0x40    /* valid 7 8 bit only */
 216 #define MXT_BOOT_STATUS_MASK    0x3f
 217 #define MXT_BOOT_EXTENDED_ID    (1 << 5)
 218 #define MXT_BOOT_ID_MASK        0x1f
 219
 220 /* Touchscreen absolute values */
 221 #define MXT_MAX_AREA            0xff
 222
 223 #define MXT_PIXELS_PER_MM       20
 224
 225 struct mxt_info {
 226         u8 family_id;
 227         u8 variant_id;
 228         u8 version;
 229         u8 build;
 230         u8 matrix_xsize;
 231         u8 matrix_ysize;
 232         u8 object_num;
 233 };
 234
 235 struct mxt_object {
 236         u8 type;
 237         u16 start_address;
 238         u8 size_minus_one;
 239         u8 instances_minus_one;
 240         u8 num_report_ids;
 241 } __packed;
 242
 243 struct mxt_dbg {
 244         u16 t37_address;
 245         u16 diag_cmd_address;
 246         struct t37_debug *t37_buf;
 247         unsigned int t37_pages;
 248         unsigned int t37_nodes;
 249
 250         struct v4l2_device v4l2;
 251         struct v4l2_pix_format format;
 252         struct video_device vdev;
 253         struct vb2_queue queue;
 254         struct mutex lock;
 255         int input;
 256 };
 257
 258 enum v4l_dbg_inputs {
 259         MXT_V4L_INPUT_DELTAS,
 260         MXT_V4L_INPUT_REFS,
 261         MXT_V4L_INPUT_MAX,
 262 };
 263
 264 static const struct v4l2_file_operations mxt_video_fops = {
 265         .owner = THIS_MODULE,
 266         .open = v4l2_fh_open,
 267         .release = vb2_fop_release,
 268         .unlocked_ioctl = video_ioctl2,
 269         .read = vb2_fop_read,
 270         .mmap = vb2_fop_mmap,
 271         .poll = vb2_fop_poll,
 272 };
 273
 274 enum mxt_suspend_mode {
 275         MXT_SUSPEND_DEEP_SLEEP  = 0,
 276         MXT_SUSPEND_T9_CTRL     = 1,
 277 };
 278
 279 /* Each client has this additional data */
 280 struct mxt_data {
 281         struct i2c_client *client;
 282         struct input_dev *input_dev;
 283         char phys[64];          /* device physical location */
 284         struct mxt_object *object_table;
 285         struct mxt_info *info;
 286         void *raw_info_block;
 287         unsigned int irq;
 288         unsigned int max_x;
 289         unsigned int max_y;
 290         bool invertx;
 291         bool inverty;
 292         bool xy_switch;
 293         u8 xsize;
 294         u8 ysize;
 295         bool in_bootloader;
 296         u16 mem_size;
 297         u8 t100_aux_ampl;
 298         u8 t100_aux_area;
 299         u8 t100_aux_vect;
 300         u8 max_reportid;
 301         u32 config_crc;
 302         u32 info_crc;
 303         u8 bootloader_addr;
 304         u8 *msg_buf;
 305         u8 t6_status;
 306         bool update_input;
 307         u8 last_message_count;
 308         u8 num_touchids;
 309         u8 multitouch;
 310         struct t7_config t7_cfg;
 311         struct mxt_dbg dbg;
 312         struct gpio_desc *reset_gpio;
 313
 314         /* Cached parameters from object table */
 315         u16 T5_address;
 316         u8 T5_msg_size;
 317         u8 T6_reportid;
 318         u16 T6_address;
 319         u16 T7_address;
 320         u8 T9_reportid_min;
 321         u8 T9_reportid_max;
 322         u8 T19_reportid;
 323         u16 T44_address;
 324         u8 T100_reportid_min;
 325         u8 T100_reportid_max;
 326
 327         /* for fw update in bootloader */
 328         struct completion bl_completion;
 329
 330         /* for reset handling */
 331         struct completion reset_completion;
 332
 333         /* for config update handling */
 334         struct completion crc_completion;
 335
 336         u32 *t19_keymap;
 337         unsigned int t19_num_keys;
 338
 339         enum mxt_suspend_mode suspend_mode;
 340 };
 341
 342 struct mxt_vb2_buffer {
 343         struct vb2_buffer       vb;
 344         struct list_head        list;
 345 };
 346
 347 static size_t mxt_obj_size(const struct mxt_object *obj)
 348 {
 349         return obj->size_minus_one + 1;
 350 }
 351
 352 static size_t mxt_obj_instances(const struct mxt_object *obj)
 353 {
 354         return obj->instances_minus_one + 1;
 355 }
 356
 357 static bool mxt_object_readable(unsigned int type)
 358 {
 359         switch (type) {
 360         case MXT_GEN_COMMAND_T6:
 361         case MXT_GEN_POWER_T7:
 362         case MXT_GEN_ACQUIRE_T8:
 363         case MXT_GEN_DATASOURCE_T53:
 364         case MXT_TOUCH_MULTI_T9:
 365         case MXT_TOUCH_KEYARRAY_T15:
 366         case MXT_TOUCH_PROXIMITY_T23:
 367         case MXT_TOUCH_PROXKEY_T52:
 368         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
 369         case MXT_PROCI_GRIPFACE_T20:
 370         case MXT_PROCG_NOISE_T22:
 371         case MXT_PROCI_ONETOUCH_T24:
 372         case MXT_PROCI_TWOTOUCH_T27:
 373         case MXT_PROCI_GRIP_T40:
 374         case MXT_PROCI_PALM_T41:
 375         case MXT_PROCI_TOUCHSUPPRESSION_T42:
 376         case MXT_PROCI_STYLUS_T47:
 377         case MXT_PROCG_NOISESUPPRESSION_T48:
 378         case MXT_SPT_COMMSCONFIG_T18:
 379         case MXT_SPT_GPIOPWM_T19:
 380         case MXT_SPT_SELFTEST_T25:
 381         case MXT_SPT_CTECONFIG_T28:
 382         case MXT_SPT_USERDATA_T38:
 383         case MXT_SPT_DIGITIZER_T43:
 384         case MXT_SPT_CTECONFIG_T46:
 385                 return true;
 386         default:
 387                 return false;
 388         }
 389 }
 390
 391 static void mxt_dump_message(struct mxt_data *data, u8 *message)
 392 {
 393         dev_dbg(&data->client->dev, "message: %*ph\n",
 394                 data->T5_msg_size, message);
 395 }
 396
 397 static int mxt_wait_for_completion(struct mxt_data *data,
 398                                    struct completion *comp,
 399                                    unsigned int timeout_ms)
 400 {
 401         struct device *dev = &data->client->dev;
 402         unsigned long timeout = msecs_to_jiffies(timeout_ms);
 403         long ret;
 404
 405         ret = wait_for_completion_interruptible_timeout(comp, timeout);
 406         if (ret < 0) {
 407                 return ret;
 408         } else if (ret == 0) {
 409                 dev_err(dev, "Wait for completion timed out.\n");
 410                 return -ETIMEDOUT;
 411         }
 412         return 0;
 413 }
 414
 415 static int mxt_bootloader_read(struct mxt_data *data,
 416                                u8 *val, unsigned int count)
 417 {
 418         int ret;
 419         struct i2c_msg msg;
 420
 421         msg.addr = data->bootloader_addr;
 422         msg.flags = data->client->flags & I2C_M_TEN;
 423         msg.flags |= I2C_M_RD;
 424         msg.len = count;
 425         msg.buf = val;
 426
 427         ret = i2c_transfer(data->client->adapter, &msg, 1);
 428         if (ret == 1) {
 429                 ret = 0;
 430         } else {
 431                 ret = ret < 0 ? ret : -EIO;
 432                 dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
 433                         __func__, ret);
 434         }
 435
 436         return ret;
 437 }
 438
 439 static int mxt_bootloader_write(struct mxt_data *data,
 440                                 const u8 * const val, unsigned int count)
 441 {
 442         int ret;
 443         struct i2c_msg msg;
 444
 445         msg.addr = data->bootloader_addr;
 446         msg.flags = data->client->flags & I2C_M_TEN;
 447         msg.len = count;
 448         msg.buf = (u8 *)val;
 449
 450         ret = i2c_transfer(data->client->adapter, &msg, 1);
 451         if (ret == 1) {
 452                 ret = 0;
 453         } else {
 454                 ret = ret < 0 ? ret : -EIO;
 455                 dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
 456                         __func__, ret);
 457         }
 458
 459         return ret;
 460 }
 461
 462 static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 463 {
 464         u8 appmode = data->client->addr;
 465         u8 bootloader;
 466         u8 family_id = data->info ? data->info->family_id : 0;
 467
 468         switch (appmode) {
 469         case 0x4a:
 470         case 0x4b:
 471                 /* Chips after 1664S use different scheme */
 472                 if (retry || family_id >= 0xa2) {
 473                         bootloader = appmode - 0x24;
 474                         break;
 475                 }
 476                 /* Fall through for normal case */
 477         case 0x4c:
 478         case 0x4d:
 479         case 0x5a:
 480         case 0x5b:
 481                 bootloader = appmode - 0x26;
 482                 break;
 483
 484         default:
 485                 dev_err(&data->client->dev,
 486                         "Appmode i2c address 0x%02x not found\n",
 487                         appmode);
 488                 return -EINVAL;
 489         }
 490
 491         data->bootloader_addr = bootloader;
 492         return 0;
 493 }
 494
 495 static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
 496 {
 497         struct device *dev = &data->client->dev;
 498         int error;
 499         u8 val;
 500         bool crc_failure;
 501
 502         error = mxt_lookup_bootloader_address(data, alt_address);
 503         if (error)
 504                 return error;
 505
 506         error = mxt_bootloader_read(data, &val, 1);
 507         if (error)
 508                 return error;
 509
 510         /* Check app crc fail mode */
 511         crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
 512
 513         dev_err(dev, "Detected bootloader, status:%02X%s\n",
 514                         val, crc_failure ? ", APP_CRC_FAIL" : "");
 515
 516         return 0;
 517 }
 518
 519 static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
 520 {
 521         struct device *dev = &data->client->dev;
 522         u8 buf[3];
 523
 524         if (val & MXT_BOOT_EXTENDED_ID) {
 525                 if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
 526                         dev_err(dev, "%s: i2c failure\n", __func__);
 527                         return val;
 528                 }
 529
 530                 dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
 531
 532                 return buf[0];
 533         } else {
 534                 dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
 535
 536                 return val;
 537         }
 538 }
 539
 540 static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
 541                                 bool wait)
 542 {
 543         struct device *dev = &data->client->dev;
 544         u8 val;
 545         int ret;
 546
 547 recheck:
 548         if (wait) {
 549                 /*
 550                  * In application update mode, the interrupt
 551                  * line signals state transitions. We must wait for the
 552                  * CHG assertion before reading the status byte.
 553                  * Once the status byte has been read, the line is deasserted.
 554                  */
 555                 ret = mxt_wait_for_completion(data, &data->bl_completion,
 556                                               MXT_FW_CHG_TIMEOUT);
 557                 if (ret) {
 558                         /*
 559                          * TODO: handle -ERESTARTSYS better by terminating
 560                          * fw update process before returning to userspace
 561                          * by writing length 0x000 to device (iff we are in
 562                          * WAITING_FRAME_DATA state).
 563                          */
 564                         dev_err(dev, "Update wait error %d\n", ret);
 565                         return ret;
 566                 }
 567         }
 568
 569         ret = mxt_bootloader_read(data, &val, 1);
 570         if (ret)
 571                 return ret;
 572
 573         if (state == MXT_WAITING_BOOTLOAD_CMD)
 574                 val = mxt_get_bootloader_version(data, val);
 575
 576         switch (state) {
 577         case MXT_WAITING_BOOTLOAD_CMD:
 578         case MXT_WAITING_FRAME_DATA:
 579         case MXT_APP_CRC_FAIL:
 580                 val &= ~MXT_BOOT_STATUS_MASK;
 581                 break;
 582         case MXT_FRAME_CRC_PASS:
 583                 if (val == MXT_FRAME_CRC_CHECK) {
 584                         goto recheck;
 585                 } else if (val == MXT_FRAME_CRC_FAIL) {
 586                         dev_err(dev, "Bootloader CRC fail\n");
 587                         return -EINVAL;
 588                 }
 589                 break;
 590         default:
 591                 return -EINVAL;
 592         }
 593
 594         if (val != state) {
 595                 dev_err(dev, "Invalid bootloader state %02X != %02X\n",
 596                         val, state);
 597                 return -EINVAL;
 598         }
 599
 600         return 0;
 601 }
 602
 603 static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
 604 {
 605         int ret;
 606         u8 buf[2];
 607
 608         if (unlock) {
 609                 buf[0] = MXT_UNLOCK_CMD_LSB;
 610                 buf[1] = MXT_UNLOCK_CMD_MSB;
 611         } else {
 612                 buf[0] = 0x01;
 613                 buf[1] = 0x01;
 614         }
 615
 616         ret = mxt_bootloader_write(data, buf, 2);
 617         if (ret)
 618                 return ret;
 619
 620         return 0;
 621 }
 622
 623 static int __mxt_read_reg(struct i2c_client *client,
 624                                u16 reg, u16 len, void *val)
 625 {
 626         struct i2c_msg xfer[2];
 627         u8 buf[2];
 628         int ret;
 629
 630         buf[0] = reg & 0xff;
 631         buf[1] = (reg >> 8) & 0xff;
 632
 633         /* Write register */
 634         xfer[0].addr = client->addr;
 635         xfer[0].flags = 0;
 636         xfer[0].len = 2;
 637         xfer[0].buf = buf;
 638
 639         /* Read data */
 640         xfer[1].addr = client->addr;
 641         xfer[1].flags = I2C_M_RD;
 642         xfer[1].len = len;
 643         xfer[1].buf = val;
 644
 645         ret = i2c_transfer(client->adapter, xfer, 2);
 646         if (ret == 2) {
 647                 ret = 0;
 648         } else {
 649                 if (ret >= 0)
 650                         ret = -EIO;
 651                 dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
 652                         __func__, ret);
 653         }
 654
 655         return ret;
 656 }
 657
 658 static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
 659                            const void *val)
 660 {
 661         u8 *buf;
 662         size_t count;
 663         int ret;
 664
 665         count = len + 2;
 666         buf = kmalloc(count, GFP_KERNEL);
 667         if (!buf)
 668                 return -ENOMEM;
 669
 670         buf[0] = reg & 0xff;
 671         buf[1] = (reg >> 8) & 0xff;
 672         memcpy(&buf[2], val, len);
 673
 674         ret = i2c_master_send(client, buf, count);
 675         if (ret == count) {
 676                 ret = 0;
 677         } else {
 678                 if (ret >= 0)
 679                         ret = -EIO;
 680                 dev_err(&client->dev, "%s: i2c send failed (%d)\n",
 681                         __func__, ret);
 682         }
 683
 684         kfree(buf);
 685         return ret;
 686 }
 687
 688 static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
 689 {
 690         return __mxt_write_reg(client, reg, 1, &val);
 691 }
 692
 693 static struct mxt_object *
 694 mxt_get_object(struct mxt_data *data, u8 type)
 695 {
 696         struct mxt_object *object;
 697         int i;
 698
 699         for (i = 0; i < data->info->object_num; i++) {
 700                 object = data->object_table + i;
 701                 if (object->type == type)
 702                         return object;
 703         }
 704
 705         dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
 706         return NULL;
 707 }
 708
 709 static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
 710 {
 711         struct device *dev = &data->client->dev;
 712         u8 status = msg[1];
 713         u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
 714
 715         complete(&data->crc_completion);
 716
 717         if (crc != data->config_crc) {
 718                 data->config_crc = crc;
 719                 dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
 720         }
 721
 722         /* Detect reset */
 723         if (status & MXT_T6_STATUS_RESET)
 724                 complete(&data->reset_completion);
 725
 726         /* Output debug if status has changed */
 727         if (status != data->t6_status)
 728                 dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
 729                         status,
 730                         status == 0 ? " OK" : "",
 731                         status & MXT_T6_STATUS_RESET ? " RESET" : "",
 732                         status & MXT_T6_STATUS_OFL ? " OFL" : "",
 733                         status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
 734                         status & MXT_T6_STATUS_CAL ? " CAL" : "",
 735                         status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
 736                         status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
 737
 738         /* Save current status */
 739         data->t6_status = status;
 740 }
 741
 742 static int mxt_write_object(struct mxt_data *data,
 743                                  u8 type, u8 offset, u8 val)
 744 {
 745         struct mxt_object *object;
 746         u16 reg;
 747
 748         object = mxt_get_object(data, type);
 749         if (!object || offset >= mxt_obj_size(object))
 750                 return -EINVAL;
 751
 752         reg = object->start_address;
 753         return mxt_write_reg(data->client, reg + offset, val);
 754 }
 755
 756 static void mxt_input_button(struct mxt_data *data, u8 *message)
 757 {
 758         struct input_dev *input = data->input_dev;
 759         int i;
 760
 761         for (i = 0; i < data->t19_num_keys; i++) {
 762                 if (data->t19_keymap[i] == KEY_RESERVED)
 763                         continue;
 764
 765                 /* Active-low switch */
 766                 input_report_key(input, data->t19_keymap[i],
 767                                  !(message[1] & BIT(i)));
 768         }
 769 }
 770
 771 static void mxt_input_sync(struct mxt_data *data)
 772 {
 773         input_mt_report_pointer_emulation(data->input_dev,
 774                                           data->t19_num_keys);
 775         input_sync(data->input_dev);
 776 }
 777
 778 static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
 779 {
 780         struct device *dev = &data->client->dev;
 781         struct input_dev *input_dev = data->input_dev;
 782         int id;
 783         u8 status;
 784         int x;
 785         int y;
 786         int area;
 787         int amplitude;
 788
 789         id = message[0] - data->T9_reportid_min;
 790         status = message[1];
 791         x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
 792         y = (message[3] << 4) | ((message[4] & 0xf));
 793
 794         /* Handle 10/12 bit switching */
 795         if (data->max_x < 1024)
 796                 x >>= 2;
 797         if (data->max_y < 1024)
 798                 y >>= 2;
 799
 800         area = message[5];
 801         amplitude = message[6];
 802
 803         dev_dbg(dev,
 804                 "[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
 805                 id,
 806                 (status & MXT_T9_DETECT) ? 'D' : '.',
 807                 (status & MXT_T9_PRESS) ? 'P' : '.',
 808                 (status & MXT_T9_RELEASE) ? 'R' : '.',
 809                 (status & MXT_T9_MOVE) ? 'M' : '.',
 810                 (status & MXT_T9_VECTOR) ? 'V' : '.',
 811                 (status & MXT_T9_AMP) ? 'A' : '.',
 812                 (status & MXT_T9_SUPPRESS) ? 'S' : '.',
 813                 (status & MXT_T9_UNGRIP) ? 'U' : '.',
 814                 x, y, area, amplitude);
 815
 816         input_mt_slot(input_dev, id);
 817
 818         if (status & MXT_T9_DETECT) {
 819                 /*
 820                  * Multiple bits may be set if the host is slow to read
 821                  * the status messages, indicating all the events that
 822                  * have happened.
 823                  */
 824                 if (status & MXT_T9_RELEASE) {
 825                         input_mt_report_slot_state(input_dev,
 826                                                    MT_TOOL_FINGER, 0);
 827                         mxt_input_sync(data);
 828                 }
 829
 830                 /* Touch active */
 831                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
 832                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 833                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 834                 input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
 835                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
 836         } else {
 837                 /* Touch no longer active, close out slot */
 838                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 0);
 839         }
 840
 841         data->update_input = true;
 842 }
 843
 844 static void mxt_proc_t100_message(struct mxt_data *data, u8 *message)
 845 {
 846         struct device *dev = &data->client->dev;
 847         struct input_dev *input_dev = data->input_dev;
 848         int id;
 849         u8 status;
 850         u8 type = 0;
 851         u16 x;
 852         u16 y;
 853         int distance = 0;
 854         int tool = 0;
 855         u8 major = 0;
 856         u8 pressure = 0;
 857         u8 orientation = 0;
 858
 859         id = message[0] - data->T100_reportid_min - 2;
 860
 861         /* ignore SCRSTATUS events */
 862         if (id < 0)
 863                 return;
 864
 865         status = message[1];
 866         x = get_unaligned_le16(&message[2]);
 867         y = get_unaligned_le16(&message[4]);
 868
 869         if (status & MXT_T100_DETECT) {
 870                 type = (status & MXT_T100_TYPE_MASK) >> 4;
 871
 872                 switch (type) {
 873                 case MXT_T100_TYPE_HOVERING_FINGER:
 874                         tool = MT_TOOL_FINGER;
 875                         distance = MXT_DISTANCE_HOVERING;
 876
 877                         if (data->t100_aux_vect)
 878                                 orientation = message[data->t100_aux_vect];
 879
 880                         break;
 881
 882                 case MXT_T100_TYPE_FINGER:
 883                 case MXT_T100_TYPE_GLOVE:
 884                         tool = MT_TOOL_FINGER;
 885                         distance = MXT_DISTANCE_ACTIVE_TOUCH;
 886
 887                         if (data->t100_aux_area)
 888                                 major = message[data->t100_aux_area];
 889
 890                         if (data->t100_aux_ampl)
 891                                 pressure = message[data->t100_aux_ampl];
 892
 893                         if (data->t100_aux_vect)
 894                                 orientation = message[data->t100_aux_vect];
 895
 896                         break;
 897
 898                 case MXT_T100_TYPE_PASSIVE_STYLUS:
 899                         tool = MT_TOOL_PEN;
 900
 901                         /*
 902                          * Passive stylus is reported with size zero so
 903                          * hardcode.
 904                          */
 905                         major = MXT_TOUCH_MAJOR_DEFAULT;
 906
 907                         if (data->t100_aux_ampl)
 908                                 pressure = message[data->t100_aux_ampl];
 909
 910                         break;
 911
 912                 case MXT_T100_TYPE_LARGE_TOUCH:
 913                         /* Ignore suppressed touch */
 914                         break;
 915
 916                 default:
 917                         dev_dbg(dev, "Unexpected T100 type\n");
 918                         return;
 919                 }
 920         }
 921
 922         /*
 923          * Values reported should be non-zero if tool is touching the
 924          * device
 925          */
 926         if (!pressure && type != MXT_T100_TYPE_HOVERING_FINGER)
 927                 pressure = MXT_PRESSURE_DEFAULT;
 928
 929         input_mt_slot(input_dev, id);
 930
 931         if (status & MXT_T100_DETECT) {
 932                 dev_dbg(dev, "[%u] type:%u x:%u y:%u a:%02X p:%02X v:%02X\n",
 933                         id, type, x, y, major, pressure, orientation);
 934
 935                 input_mt_report_slot_state(input_dev, tool, 1);
 936                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 937                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 938                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, major);
 939                 input_report_abs(input_dev, ABS_MT_PRESSURE, pressure);
 940                 input_report_abs(input_dev, ABS_MT_DISTANCE, distance);
 941                 input_report_abs(input_dev, ABS_MT_ORIENTATION, orientation);
 942         } else {
 943                 dev_dbg(dev, "[%u] release\n", id);
 944
 945                 /* close out slot */
 946                 input_mt_report_slot_state(input_dev, 0, 0);
 947         }
 948
 949         data->update_input = true;
 950 }
 951
 952 static int mxt_proc_message(struct mxt_data *data, u8 *message)
 953 {
 954         u8 report_id = message[0];
 955
 956         if (report_id == MXT_RPTID_NOMSG)
 957                 return 0;
 958
 959         if (report_id == data->T6_reportid) {
 960                 mxt_proc_t6_messages(data, message);
 961         } else if (!data->input_dev) {
 962                 /*
 963                  * Do not report events if input device
 964                  * is not yet registered.
 965                  */
 966                 mxt_dump_message(data, message);
 967         } else if (report_id >= data->T9_reportid_min &&
 968                    report_id <= data->T9_reportid_max) {
 969                 mxt_proc_t9_message(data, message);
 970         } else if (report_id >= data->T100_reportid_min &&
 971                    report_id <= data->T100_reportid_max) {
 972                 mxt_proc_t100_message(data, message);
 973         } else if (report_id == data->T19_reportid) {
 974                 mxt_input_button(data, message);
 975                 data->update_input = true;
 976         } else {
 977                 mxt_dump_message(data, message);
 978         }
 979
 980         return 1;
 981 }
 982
 983 static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
 984 {
 985         struct device *dev = &data->client->dev;
 986         int ret;
 987         int i;
 988         u8 num_valid = 0;
 989
 990         /* Safety check for msg_buf */
 991         if (count > data->max_reportid)
 992                 return -EINVAL;
 993
 994         /* Process remaining messages if necessary */
 995         ret = __mxt_read_reg(data->client, data->T5_address,
 996                                 data->T5_msg_size * count, data->msg_buf);
 997         if (ret) {
 998                 dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
 999                 return ret;
1000         }
1001
1002         for (i = 0;  i < count; i++) {
1003                 ret = mxt_proc_message(data,
1004                         data->msg_buf + data->T5_msg_size * i);
1005
1006                 if (ret == 1)
1007                         num_valid++;
1008         }
1009
1010         /* return number of messages read */
1011         return num_valid;
1012 }
1013
1014 static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
1015 {
1016         struct device *dev = &data->client->dev;
1017         int ret;
1018         u8 count, num_left;
1019
1020         /* Read T44 and T5 together */
1021         ret = __mxt_read_reg(data->client, data->T44_address,
1022                 data->T5_msg_size + 1, data->msg_buf);
1023         if (ret) {
1024                 dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
1025                 return IRQ_NONE;
1026         }
1027
1028         count = data->msg_buf[0];
1029
1030         /*
1031          * This condition may be caused by the CHG line being configured in
1032          * Mode 0. It results in unnecessary I2C operations but it is benign.
1033          */
1034         if (count == 0)
1035                 return IRQ_NONE;
1036
1037         if (count > data->max_reportid) {
1038                 dev_warn(dev, "T44 count %d exceeded max report id\n", count);
1039                 count = data->max_reportid;
1040         }
1041
1042         /* Process first message */
1043         ret = mxt_proc_message(data, data->msg_buf + 1);
1044         if (ret < 0) {
1045                 dev_warn(dev, "Unexpected invalid message\n");
1046                 return IRQ_NONE;
1047         }
1048
1049         num_left = count - 1;
1050
1051         /* Process remaining messages if necessary */
1052         if (num_left) {
1053                 ret = mxt_read_and_process_messages(data, num_left);
1054                 if (ret < 0)
1055                         goto end;
1056                 else if (ret != num_left)
1057                         dev_warn(dev, "Unexpected invalid message\n");
1058         }
1059
1060 end:
1061         if (data->update_input) {
1062                 mxt_input_sync(data);
1063                 data->update_input = false;
1064         }
1065
1066         return IRQ_HANDLED;
1067 }
1068
1069 static int mxt_process_messages_until_invalid(struct mxt_data *data)
1070 {
1071         struct device *dev = &data->client->dev;
1072         int count, read;
1073         u8 tries = 2;
1074
1075         count = data->max_reportid;
1076
1077         /* Read messages until we force an invalid */
1078         do {
1079                 read = mxt_read_and_process_messages(data, count);
1080                 if (read < count)
1081                         return 0;
1082         } while (--tries);
1083
1084         if (data->update_input) {
1085                 mxt_input_sync(data);
1086                 data->update_input = false;
1087         }
1088
1089         dev_err(dev, "CHG pin isn't cleared\n");
1090         return -EBUSY;
1091 }
1092
1093 static irqreturn_t mxt_process_messages(struct mxt_data *data)
1094 {
1095         int total_handled, num_handled;
1096         u8 count = data->last_message_count;
1097
1098         if (count < 1 || count > data->max_reportid)
1099                 count = 1;
1100
1101         /* include final invalid message */
1102         total_handled = mxt_read_and_process_messages(data, count + 1);
1103         if (total_handled < 0)
1104                 return IRQ_NONE;
1105         /* if there were invalid messages, then we are done */
1106         else if (total_handled <= count)
1107                 goto update_count;
1108
1109         /* keep reading two msgs until one is invalid or reportid limit */
1110         do {
1111                 num_handled = mxt_read_and_process_messages(data, 2);
1112                 if (num_handled < 0)
1113                         return IRQ_NONE;
1114
1115                 total_handled += num_handled;
1116
1117                 if (num_handled < 2)
1118                         break;
1119         } while (total_handled < data->num_touchids);
1120
1121 update_count:
1122         data->last_message_count = total_handled;
1123
1124         if (data->update_input) {
1125                 mxt_input_sync(data);
1126                 data->update_input = false;
1127         }
1128
1129         return IRQ_HANDLED;
1130 }
1131
1132 static irqreturn_t mxt_interrupt(int irq, void *dev_id)
1133 {
1134         struct mxt_data *data = dev_id;
1135
1136         if (data->in_bootloader) {
1137                 /* bootloader state transition completion */
1138                 complete(&data->bl_completion);
1139                 return IRQ_HANDLED;
1140         }
1141
1142         if (!data->object_table)
1143                 return IRQ_HANDLED;
1144
1145         if (data->T44_address) {
1146                 return mxt_process_messages_t44(data);
1147         } else {
1148                 return mxt_process_messages(data);
1149         }
1150 }
1151
1152 static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
1153                           u8 value, bool wait)
1154 {
1155         u16 reg;
1156         u8 command_register;
1157         int timeout_counter = 0;
1158         int ret;
1159
1160         reg = data->T6_address + cmd_offset;
1161
1162         ret = mxt_write_reg(data->client, reg, value);
1163         if (ret)
1164                 return ret;
1165
1166         if (!wait)
1167                 return 0;
1168
1169         do {
1170                 msleep(20);
1171                 ret = __mxt_read_reg(data->client, reg, 1, &command_register);
1172                 if (ret)
1173                         return ret;
1174         } while (command_register != 0 && timeout_counter++ <= 100);
1175
1176         if (timeout_counter > 100) {
1177                 dev_err(&data->client->dev, "Command failed!\n");
1178                 return -EIO;
1179         }
1180
1181         return 0;
1182 }
1183
1184 static int mxt_acquire_irq(struct mxt_data *data)
1185 {
1186         int error;
1187
1188         enable_irq(data->irq);
1189
1190         error = mxt_process_messages_until_invalid(data);
1191         if (error)
1192                 return error;
1193
1194         return 0;
1195 }
1196
1197 static int mxt_soft_reset(struct mxt_data *data)
1198 {
1199         struct device *dev = &data->client->dev;
1200         int ret = 0;
1201
1202         dev_info(dev, "Resetting device\n");
1203
1204         disable_irq(data->irq);
1205
1206         reinit_completion(&data->reset_completion);
1207
1208         ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1209         if (ret)
1210                 return ret;
1211
1212         /* Ignore CHG line for 100ms after reset */
1213         msleep(MXT_RESET_INVALID_CHG);
1214
1215         mxt_acquire_irq(data);
1216
1217         ret = mxt_wait_for_completion(data, &data->reset_completion,
1218                                       MXT_RESET_TIMEOUT);
1219         if (ret)
1220                 return ret;
1221
1222         return 0;
1223 }
1224
1225 static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1226 {
1227         /*
1228          * On failure, CRC is set to 0 and config will always be
1229          * downloaded.
1230          */
1231         data->config_crc = 0;
1232         reinit_completion(&data->crc_completion);
1233
1234         mxt_t6_command(data, cmd, value, true);
1235
1236         /*
1237          * Wait for crc message. On failure, CRC is set to 0 and config will
1238          * always be downloaded.
1239          */
1240         mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1241 }
1242
1243 static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1244 {
1245         static const unsigned int crcpoly = 0x80001B;
1246         u32 result;
1247         u32 data_word;
1248
1249         data_word = (secondbyte << 8) | firstbyte;
1250         result = ((*crc << 1) ^ data_word);
1251
1252         if (result & 0x1000000)
1253                 result ^= crcpoly;
1254
1255         *crc = result;
1256 }
1257
1258 static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1259 {
1260         u32 crc = 0;
1261         u8 *ptr = base + start_off;
1262         u8 *last_val = base + end_off - 1;
1263
1264         if (end_off < start_off)
1265                 return -EINVAL;
1266
1267         while (ptr < last_val) {
1268                 mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1269                 ptr += 2;
1270         }
1271
1272         /* if len is odd, fill the last byte with 0 */
1273         if (ptr == last_val)
1274                 mxt_calc_crc24(&crc, *ptr, 0);
1275
1276         /* Mask to 24-bit */
1277         crc &= 0x00FFFFFF;
1278
1279         return crc;
1280 }
1281
1282 static int mxt_prepare_cfg_mem(struct mxt_data *data,
1283                                const struct firmware *cfg,
1284                                unsigned int data_pos,
1285                                unsigned int cfg_start_ofs,
1286                                u8 *config_mem,
1287                                size_t config_mem_size)
1288 {
1289         struct device *dev = &data->client->dev;
1290         struct mxt_object *object;
1291         unsigned int type, instance, size, byte_offset;
1292         int offset;
1293         int ret;
1294         int i;
1295         u16 reg;
1296         u8 val;
1297
1298         while (data_pos < cfg->size) {
1299                 /* Read type, instance, length */
1300                 ret = sscanf(cfg->data + data_pos, "%x %x %x%n",
1301                              &type, &instance, &size, &offset);
1302                 if (ret == 0) {
1303                         /* EOF */
1304                         break;
1305                 } else if (ret != 3) {
1306                         dev_err(dev, "Bad format: failed to parse object\n");
1307                         return -EINVAL;
1308                 }
1309                 data_pos += offset;
1310
1311                 object = mxt_get_object(data, type);
1312                 if (!object) {
1313                         /* Skip object */
1314                         for (i = 0; i < size; i++) {
1315                                 ret = sscanf(cfg->data + data_pos, "%hhx%n",
1316                                              &val, &offset);
1317                                 if (ret != 1) {
1318                                         dev_err(dev, "Bad format in T%d at %d\n",
1319                                                 type, i);
1320                                         return -EINVAL;
1321                                 }
1322                                 data_pos += offset;
1323                         }
1324                         continue;
1325                 }
1326
1327                 if (size > mxt_obj_size(object)) {
1328                         /*
1329                          * Either we are in fallback mode due to wrong
1330                          * config or config from a later fw version,
1331                          * or the file is corrupt or hand-edited.
1332                          */
1333                         dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1334                                  size - mxt_obj_size(object), type);
1335                 } else if (mxt_obj_size(object) > size) {
1336                         /*
1337                          * If firmware is upgraded, new bytes may be added to
1338                          * end of objects. It is generally forward compatible
1339                          * to zero these bytes - previous behaviour will be
1340                          * retained. However this does invalidate the CRC and
1341                          * will force fallback mode until the configuration is
1342                          * updated. We warn here but do nothing else - the
1343                          * malloc has zeroed the entire configuration.
1344                          */
1345                         dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1346                                  mxt_obj_size(object) - size, type);
1347                 }
1348
1349                 if (instance >= mxt_obj_instances(object)) {
1350                         dev_err(dev, "Object instances exceeded!\n");
1351                         return -EINVAL;
1352                 }
1353
1354                 reg = object->start_address + mxt_obj_size(object) * instance;
1355
1356                 for (i = 0; i < size; i++) {
1357                         ret = sscanf(cfg->data + data_pos, "%hhx%n",
1358                                      &val,
1359                                      &offset);
1360                         if (ret != 1) {
1361                                 dev_err(dev, "Bad format in T%d at %d\n",
1362                                         type, i);
1363                                 return -EINVAL;
1364                         }
1365                         data_pos += offset;
1366
1367                         if (i > mxt_obj_size(object))
1368                                 continue;
1369
1370                         byte_offset = reg + i - cfg_start_ofs;
1371
1372                         if (byte_offset >= 0 && byte_offset < config_mem_size) {
1373                                 *(config_mem + byte_offset) = val;
1374                         } else {
1375                                 dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1376                                         reg, object->type, byte_offset);
1377                                 return -EINVAL;
1378                         }
1379                 }
1380         }
1381
1382         return 0;
1383 }
1384
1385 static int mxt_upload_cfg_mem(struct mxt_data *data, unsigned int cfg_start,
1386                               u8 *config_mem, size_t config_mem_size)
1387 {
1388         unsigned int byte_offset = 0;
1389         int error;
1390
1391         /* Write configuration as blocks */
1392         while (byte_offset < config_mem_size) {
1393                 unsigned int size = config_mem_size - byte_offset;
1394
1395                 if (size > MXT_MAX_BLOCK_WRITE)
1396                         size = MXT_MAX_BLOCK_WRITE;
1397
1398                 error = __mxt_write_reg(data->client,
1399                                         cfg_start + byte_offset,
1400                                         size, config_mem + byte_offset);
1401                 if (error) {
1402                         dev_err(&data->client->dev,
1403                                 "Config write error, ret=%d\n", error);
1404                         return error;
1405                 }
1406
1407                 byte_offset += size;
1408         }
1409
1410         return 0;
1411 }
1412
1413 static int mxt_init_t7_power_cfg(struct mxt_data *data);
1414
1415 /*
1416  * mxt_update_cfg - download configuration to chip
1417  *
1418  * Atmel Raw Config File Format
1419  *
1420  * The first four lines of the raw config file contain:
1421  *  1) Version
1422  *  2) Chip ID Information (first 7 bytes of device memory)
1423  *  3) Chip Information Block 24-bit CRC Checksum
1424  *  4) Chip Configuration 24-bit CRC Checksum
1425  *
1426  * The rest of the file consists of one line per object instance:
1427  *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1428  *
1429  *   <TYPE> - 2-byte object type as hex
1430  *   <INSTANCE> - 2-byte object instance number as hex
1431  *   <SIZE> - 2-byte object size as hex
1432  *   <CONTENTS> - array of <SIZE> 1-byte hex values
1433  */
1434 static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
1435 {
1436         struct device *dev = &data->client->dev;
1437         struct mxt_info cfg_info;
1438         int ret;
1439         int offset;
1440         int data_pos;
1441         int i;
1442         int cfg_start_ofs;
1443         u32 info_crc, config_crc, calculated_crc;
1444         u8 *config_mem;
1445         size_t config_mem_size;
1446
1447         mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1448
1449         if (strncmp(cfg->data, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1450                 dev_err(dev, "Unrecognised config file\n");
1451                 return -EINVAL;
1452         }
1453
1454         data_pos = strlen(MXT_CFG_MAGIC);
1455
1456         /* Load information block and check */
1457         for (i = 0; i < sizeof(struct mxt_info); i++) {
1458                 ret = sscanf(cfg->data + data_pos, "%hhx%n",
1459                              (unsigned char *)&cfg_info + i,
1460                              &offset);
1461                 if (ret != 1) {
1462                         dev_err(dev, "Bad format\n");
1463                         return -EINVAL;
1464                 }
1465
1466                 data_pos += offset;
1467         }
1468
1469         if (cfg_info.family_id != data->info->family_id) {
1470                 dev_err(dev, "Family ID mismatch!\n");
1471                 return -EINVAL;
1472         }
1473
1474         if (cfg_info.variant_id != data->info->variant_id) {
1475                 dev_err(dev, "Variant ID mismatch!\n");
1476                 return -EINVAL;
1477         }
1478
1479         /* Read CRCs */
1480         ret = sscanf(cfg->data + data_pos, "%x%n", &info_crc, &offset);
1481         if (ret != 1) {
1482                 dev_err(dev, "Bad format: failed to parse Info CRC\n");
1483                 return -EINVAL;
1484         }
1485         data_pos += offset;
1486
1487         ret = sscanf(cfg->data + data_pos, "%x%n", &config_crc, &offset);
1488         if (ret != 1) {
1489                 dev_err(dev, "Bad format: failed to parse Config CRC\n");
1490                 return -EINVAL;
1491         }
1492         data_pos += offset;
1493
1494         /*
1495          * The Info Block CRC is calculated over mxt_info and the object
1496          * table. If it does not match then we are trying to load the
1497          * configuration from a different chip or firmware version, so
1498          * the configuration CRC is invalid anyway.
1499          */
1500         if (info_crc == data->info_crc) {
1501                 if (config_crc == 0 || data->config_crc == 0) {
1502                         dev_info(dev, "CRC zero, attempting to apply config\n");
1503                 } else if (config_crc == data->config_crc) {
1504                         dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1505                                  data->config_crc);
1506                         return 0;
1507                 } else {
1508                         dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1509                                  data->config_crc, config_crc);
1510                 }
1511         } else {
1512                 dev_warn(dev,
1513                          "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1514                          data->info_crc, info_crc);
1515         }
1516
1517         /* Malloc memory to store configuration */
1518         cfg_start_ofs = MXT_OBJECT_START +
1519                         data->info->object_num * sizeof(struct mxt_object) +
1520                         MXT_INFO_CHECKSUM_SIZE;
1521         config_mem_size = data->mem_size - cfg_start_ofs;
1522         config_mem = kzalloc(config_mem_size, GFP_KERNEL);
1523         if (!config_mem) {
1524                 dev_err(dev, "Failed to allocate memory\n");
1525                 return -ENOMEM;
1526         }
1527
1528         ret = mxt_prepare_cfg_mem(data, cfg, data_pos, cfg_start_ofs,
1529                                   config_mem, config_mem_size);
1530         if (ret)
1531                 goto release_mem;
1532
1533         /* Calculate crc of the received configs (not the raw config file) */
1534         if (data->T7_address < cfg_start_ofs) {
1535                 dev_err(dev, "Bad T7 address, T7addr = %x, config offset %x\n",
1536                         data->T7_address, cfg_start_ofs);
1537                 ret = 0;
1538                 goto release_mem;
1539         }
1540
1541         calculated_crc = mxt_calculate_crc(config_mem,
1542                                            data->T7_address - cfg_start_ofs,
1543                                            config_mem_size);
1544
1545         if (config_crc > 0 && config_crc != calculated_crc)
1546                 dev_warn(dev, "Config CRC error, calculated=%06X, file=%06X\n",
1547                          calculated_crc, config_crc);
1548
1549         ret = mxt_upload_cfg_mem(data, cfg_start_ofs,
1550                                  config_mem, config_mem_size);
1551         if (ret)
1552                 goto release_mem;
1553
1554         mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1555
1556         ret = mxt_soft_reset(data);
1557         if (ret)
1558                 goto release_mem;
1559
1560         dev_info(dev, "Config successfully updated\n");
1561
1562         /* T7 config may have changed */
1563         mxt_init_t7_power_cfg(data);
1564
1565 release_mem:
1566         kfree(config_mem);
1567         return ret;
1568 }
1569
1570 static void mxt_free_input_device(struct mxt_data *data)
1571 {
1572         if (data->input_dev) {
1573                 input_unregister_device(data->input_dev);
1574                 data->input_dev = NULL;
1575         }
1576 }
1577
1578 static void mxt_free_object_table(struct mxt_data *data)
1579 {
1580 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
1581         video_unregister_device(&data->dbg.vdev);
1582         v4l2_device_unregister(&data->dbg.v4l2);
1583 #endif
1584         data->object_table = NULL;
1585         data->info = NULL;
1586         kfree(data->raw_info_block);
1587         data->raw_info_block = NULL;
1588         kfree(data->msg_buf);
1589         data->msg_buf = NULL;
1590         data->T5_address = 0;
1591         data->T5_msg_size = 0;
1592         data->T6_reportid = 0;
1593         data->T7_address = 0;
1594         data->T9_reportid_min = 0;
1595         data->T9_reportid_max = 0;
1596         data->T19_reportid = 0;
1597         data->T44_address = 0;
1598         data->T100_reportid_min = 0;
1599         data->T100_reportid_max = 0;
1600         data->max_reportid = 0;
1601 }
1602
1603 static int mxt_parse_object_table(struct mxt_data *data,
1604                                   struct mxt_object *object_table)
1605 {
1606         struct i2c_client *client = data->client;
1607         int i;
1608         u8 reportid;
1609         u16 end_address;
1610
1611         /* Valid Report IDs start counting from 1 */
1612         reportid = 1;
1613         data->mem_size = 0;
1614         for (i = 0; i < data->info->object_num; i++) {
1615                 struct mxt_object *object = object_table + i;
1616                 u8 min_id, max_id;
1617
1618                 le16_to_cpus(&object->start_address);
1619
1620                 if (object->num_report_ids) {
1621                         min_id = reportid;
1622                         reportid += object->num_report_ids *
1623                                         mxt_obj_instances(object);
1624                         max_id = reportid - 1;
1625                 } else {
1626                         min_id = 0;
1627                         max_id = 0;
1628                 }
1629
1630                 dev_dbg(&data->client->dev,
1631                         "T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1632                         object->type, object->start_address,
1633                         mxt_obj_size(object), mxt_obj_instances(object),
1634                         min_id, max_id);
1635
1636                 switch (object->type) {
1637                 case MXT_GEN_MESSAGE_T5:
1638                         if (data->info->family_id == 0x80 &&
1639                             data->info->version < 0x20) {
1640                                 /*
1641                                  * On mXT224 firmware versions prior to V2.0
1642                                  * read and discard unused CRC byte otherwise
1643                                  * DMA reads are misaligned.
1644                                  */
1645                                 data->T5_msg_size = mxt_obj_size(object);
1646                         } else {
1647                                 /* CRC not enabled, so skip last byte */
1648                                 data->T5_msg_size = mxt_obj_size(object) - 1;
1649                         }
1650                         data->T5_address = object->start_address;
1651                         break;
1652                 case MXT_GEN_COMMAND_T6:
1653                         data->T6_reportid = min_id;
1654                         data->T6_address = object->start_address;
1655                         break;
1656                 case MXT_GEN_POWER_T7:
1657                         data->T7_address = object->start_address;
1658                         break;
1659                 case MXT_TOUCH_MULTI_T9:
1660                         data->multitouch = MXT_TOUCH_MULTI_T9;
1661                         data->T9_reportid_min = min_id;
1662                         data->T9_reportid_max = max_id;
1663                         data->num_touchids = object->num_report_ids
1664                                                 * mxt_obj_instances(object);
1665                         break;
1666                 case MXT_SPT_MESSAGECOUNT_T44:
1667                         data->T44_address = object->start_address;
1668                         break;
1669                 case MXT_SPT_GPIOPWM_T19:
1670                         data->T19_reportid = min_id;
1671                         break;
1672                 case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1673                         data->multitouch = MXT_TOUCH_MULTITOUCHSCREEN_T100;
1674                         data->T100_reportid_min = min_id;
1675                         data->T100_reportid_max = max_id;
1676                         /* first two report IDs reserved */
1677                         data->num_touchids = object->num_report_ids - 2;
1678                         break;
1679                 }
1680
1681                 end_address = object->start_address
1682                         + mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1683
1684                 if (end_address >= data->mem_size)
1685                         data->mem_size = end_address + 1;
1686         }
1687
1688         /* Store maximum reportid */
1689         data->max_reportid = reportid;
1690
1691         /* If T44 exists, T5 position has to be directly after */
1692         if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1693                 dev_err(&client->dev, "Invalid T44 position\n");
1694                 return -EINVAL;
1695         }
1696
1697         data->msg_buf = kcalloc(data->max_reportid,
1698                                 data->T5_msg_size, GFP_KERNEL);
1699         if (!data->msg_buf)
1700                 return -ENOMEM;
1701
1702         return 0;
1703 }
1704
1705 static int mxt_read_info_block(struct mxt_data *data)
1706 {
1707         struct i2c_client *client = data->client;
1708         int error;
1709         size_t size;
1710         void *id_buf, *buf;
1711         uint8_t num_objects;
1712         u32 calculated_crc;
1713         u8 *crc_ptr;
1714
1715         /* If info block already allocated, free it */
1716         if (data->raw_info_block)
1717                 mxt_free_object_table(data);
1718
1719         /* Read 7-byte ID information block starting at address 0 */
1720         size = sizeof(struct mxt_info);
1721         id_buf = kzalloc(size, GFP_KERNEL);
1722         if (!id_buf)
1723                 return -ENOMEM;
1724
1725         error = __mxt_read_reg(client, 0, size, id_buf);
1726         if (error)
1727                 goto err_free_mem;
1728
1729         /* Resize buffer to give space for rest of info block */
1730         num_objects = ((struct mxt_info *)id_buf)->object_num;
1731         size += (num_objects * sizeof(struct mxt_object))
1732                 + MXT_INFO_CHECKSUM_SIZE;
1733
1734         buf = krealloc(id_buf, size, GFP_KERNEL);
1735         if (!buf) {
1736                 error = -ENOMEM;
1737                 goto err_free_mem;
1738         }
1739         id_buf = buf;
1740
1741         /* Read rest of info block */
1742         error = __mxt_read_reg(client, MXT_OBJECT_START,
1743                                size - MXT_OBJECT_START,
1744                                id_buf + MXT_OBJECT_START);
1745         if (error)
1746                 goto err_free_mem;
1747
1748         /* Extract & calculate checksum */
1749         crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
1750         data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
1751
1752         calculated_crc = mxt_calculate_crc(id_buf, 0,
1753                                            size - MXT_INFO_CHECKSUM_SIZE);
1754
1755         /*
1756          * CRC mismatch can be caused by data corruption due to I2C comms
1757          * issue or else device is not using Object Based Protocol (eg i2c-hid)
1758          */
1759         if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
1760                 dev_err(&client->dev,
1761                         "Info Block CRC error calculated=0x%06X read=0x%06X\n",
1762                         calculated_crc, data->info_crc);
1763                 error = -EIO;
1764                 goto err_free_mem;
1765         }
1766
1767         data->raw_info_block = id_buf;
1768         data->info = (struct mxt_info *)id_buf;
1769
1770         dev_info(&client->dev,
1771                  "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
1772                  data->info->family_id, data->info->variant_id,
1773                  data->info->version >> 4, data->info->version & 0xf,
1774                  data->info->build, data->info->object_num);
1775
1776         /* Parse object table information */
1777         error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
1778         if (error) {
1779                 dev_err(&client->dev, "Error %d parsing object table\n", error);
1780                 mxt_free_object_table(data);
1781                 goto err_free_mem;
1782         }
1783
1784         data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
1785
1786         return 0;
1787
1788 err_free_mem:
1789         kfree(id_buf);
1790         return error;
1791 }
1792
1793 static int mxt_read_t9_resolution(struct mxt_data *data)
1794 {
1795         struct i2c_client *client = data->client;
1796         int error;
1797         struct t9_range range;
1798         unsigned char orient;
1799         struct mxt_object *object;
1800
1801         object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1802         if (!object)
1803                 return -EINVAL;
1804
1805         error = __mxt_read_reg(client,
1806                                object->start_address + MXT_T9_XSIZE,
1807                                sizeof(data->xsize), &data->xsize);
1808         if (error)
1809                 return error;
1810
1811         error = __mxt_read_reg(client,
1812                                object->start_address + MXT_T9_YSIZE,
1813                                sizeof(data->ysize), &data->ysize);
1814         if (error)
1815                 return error;
1816
1817         error = __mxt_read_reg(client,
1818                                object->start_address + MXT_T9_RANGE,
1819                                sizeof(range), &range);
1820         if (error)
1821                 return error;
1822
1823         data->max_x = get_unaligned_le16(&range.x);
1824         data->max_y = get_unaligned_le16(&range.y);
1825
1826         error =  __mxt_read_reg(client,
1827                                 object->start_address + MXT_T9_ORIENT,
1828                                 1, &orient);
1829         if (error)
1830                 return error;
1831
1832         data->xy_switch = orient & MXT_T9_ORIENT_SWITCH;
1833         data->invertx = orient & MXT_T9_ORIENT_INVERTX;
1834         data->inverty = orient & MXT_T9_ORIENT_INVERTY;
1835
1836         return 0;
1837 }
1838
1839 static int mxt_read_t100_config(struct mxt_data *data)
1840 {
1841         struct i2c_client *client = data->client;
1842         int error;
1843         struct mxt_object *object;
1844         u16 range_x, range_y;
1845         u8 cfg, tchaux;
1846         u8 aux;
1847
1848         object = mxt_get_object(data, MXT_TOUCH_MULTITOUCHSCREEN_T100);
1849         if (!object)
1850                 return -EINVAL;
1851
1852         /* read touchscreen dimensions */
1853         error = __mxt_read_reg(client,
1854                                object->start_address + MXT_T100_XRANGE,
1855                                sizeof(range_x), &range_x);
1856         if (error)
1857                 return error;
1858
1859         data->max_x = get_unaligned_le16(&range_x);
1860
1861         error = __mxt_read_reg(client,
1862                                object->start_address + MXT_T100_YRANGE,
1863                                sizeof(range_y), &range_y);
1864         if (error)
1865                 return error;
1866
1867         data->max_y = get_unaligned_le16(&range_y);
1868
1869         error = __mxt_read_reg(client,
1870                                object->start_address + MXT_T100_XSIZE,
1871                                sizeof(data->xsize), &data->xsize);
1872         if (error)
1873                 return error;
1874
1875         error = __mxt_read_reg(client,
1876                                object->start_address + MXT_T100_YSIZE,
1877                                sizeof(data->ysize), &data->ysize);
1878         if (error)
1879                 return error;
1880
1881         /* read orientation config */
1882         error =  __mxt_read_reg(client,
1883                                 object->start_address + MXT_T100_CFG1,
1884                                 1, &cfg);
1885         if (error)
1886                 return error;
1887
1888         data->xy_switch = cfg & MXT_T100_CFG_SWITCHXY;
1889         data->invertx = cfg & MXT_T100_CFG_INVERTX;
1890         data->inverty = cfg & MXT_T100_CFG_INVERTY;
1891
1892         /* allocate aux bytes */
1893         error =  __mxt_read_reg(client,
1894                                 object->start_address + MXT_T100_TCHAUX,
1895                                 1, &tchaux);
1896         if (error)
1897                 return error;
1898
1899         aux = 6;
1900
1901         if (tchaux & MXT_T100_TCHAUX_VECT)
1902                 data->t100_aux_vect = aux++;
1903
1904         if (tchaux & MXT_T100_TCHAUX_AMPL)
1905                 data->t100_aux_ampl = aux++;
1906
1907         if (tchaux & MXT_T100_TCHAUX_AREA)
1908                 data->t100_aux_area = aux++;
1909
1910         dev_dbg(&client->dev,
1911                 "T100 aux mappings vect:%u ampl:%u area:%u\n",
1912                 data->t100_aux_vect, data->t100_aux_ampl, data->t100_aux_area);
1913
1914         return 0;
1915 }
1916
1917 static int mxt_input_open(struct input_dev *dev);
1918 static void mxt_input_close(struct input_dev *dev);
1919
1920 static void mxt_set_up_as_touchpad(struct input_dev *input_dev,
1921                                    struct mxt_data *data)
1922 {
1923         int i;
1924
1925         input_dev->name = "Atmel maXTouch Touchpad";
1926
1927         __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1928
1929         input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1930         input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1931         input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1932                           MXT_PIXELS_PER_MM);
1933         input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1934                           MXT_PIXELS_PER_MM);
1935
1936         for (i = 0; i < data->t19_num_keys; i++)
1937                 if (data->t19_keymap[i] != KEY_RESERVED)
1938                         input_set_capability(input_dev, EV_KEY,
1939                                              data->t19_keymap[i]);
1940 }
1941
1942 static int mxt_initialize_input_device(struct mxt_data *data)
1943 {
1944         struct device *dev = &data->client->dev;
1945         struct input_dev *input_dev;
1946         int error;
1947         unsigned int num_mt_slots;
1948         unsigned int mt_flags = 0;
1949
1950         switch (data->multitouch) {
1951         case MXT_TOUCH_MULTI_T9:
1952                 num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
1953                 error = mxt_read_t9_resolution(data);
1954                 if (error)
1955                         dev_warn(dev, "Failed to initialize T9 resolution\n");
1956                 break;
1957
1958         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1959                 num_mt_slots = data->num_touchids;
1960                 error = mxt_read_t100_config(data);
1961                 if (error)
1962                         dev_warn(dev, "Failed to read T100 config\n");
1963                 break;
1964
1965         default:
1966                 dev_err(dev, "Invalid multitouch object\n");
1967                 return -EINVAL;
1968         }
1969
1970         /* Handle default values and orientation switch */
1971         if (data->max_x == 0)
1972                 data->max_x = 1023;
1973
1974         if (data->max_y == 0)
1975                 data->max_y = 1023;
1976
1977         if (data->xy_switch)
1978                 swap(data->max_x, data->max_y);
1979
1980         dev_info(dev, "Touchscreen size X%uY%u\n", data->max_x, data->max_y);
1981
1982         /* Register input device */
1983         input_dev = input_allocate_device();
1984         if (!input_dev) {
1985                 dev_err(dev, "Failed to allocate memory\n");
1986                 return -ENOMEM;
1987         }
1988
1989         input_dev->name = "Atmel maXTouch Touchscreen";
1990         input_dev->phys = data->phys;
1991         input_dev->id.bustype = BUS_I2C;
1992         input_dev->dev.parent = dev;
1993         input_dev->open = mxt_input_open;
1994         input_dev->close = mxt_input_close;
1995
1996         input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
1997
1998         /* For single touch */
1999         input_set_abs_params(input_dev, ABS_X, 0, data->max_x, 0, 0);
2000         input_set_abs_params(input_dev, ABS_Y, 0, data->max_y, 0, 0);
2001
2002         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2003             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2004              data->t100_aux_ampl)) {
2005                 input_set_abs_params(input_dev, ABS_PRESSURE, 0, 255, 0, 0);
2006         }
2007
2008         /* If device has buttons we assume it is a touchpad */
2009         if (data->t19_num_keys) {
2010                 mxt_set_up_as_touchpad(input_dev, data);
2011                 mt_flags |= INPUT_MT_POINTER;
2012         } else {
2013                 mt_flags |= INPUT_MT_DIRECT;
2014         }
2015
2016         /* For multi touch */
2017         error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
2018         if (error) {
2019                 dev_err(dev, "Error %d initialising slots\n", error);
2020                 goto err_free_mem;
2021         }
2022
2023         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100) {
2024                 input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
2025                                      0, MT_TOOL_MAX, 0, 0);
2026                 input_set_abs_params(input_dev, ABS_MT_DISTANCE,
2027                                      MXT_DISTANCE_ACTIVE_TOUCH,
2028                                      MXT_DISTANCE_HOVERING,
2029                                      0, 0);
2030         }
2031
2032         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
2033                              0, data->max_x, 0, 0);
2034         input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
2035                              0, data->max_y, 0, 0);
2036
2037         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2038             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2039              data->t100_aux_area)) {
2040                 input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
2041                                      0, MXT_MAX_AREA, 0, 0);
2042         }
2043
2044         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2045             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2046              data->t100_aux_ampl)) {
2047                 input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2048                                      0, 255, 0, 0);
2049         }
2050
2051         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2052             data->t100_aux_vect) {
2053                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2054                                      0, 255, 0, 0);
2055         }
2056
2057         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2058             data->t100_aux_ampl) {
2059                 input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2060                                      0, 255, 0, 0);
2061         }
2062
2063         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2064             data->t100_aux_vect) {
2065                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2066                                      0, 255, 0, 0);
2067         }
2068
2069         input_set_drvdata(input_dev, data);
2070
2071         error = input_register_device(input_dev);
2072         if (error) {
2073                 dev_err(dev, "Error %d registering input device\n", error);
2074                 goto err_free_mem;
2075         }
2076
2077         data->input_dev = input_dev;
2078
2079         return 0;
2080
2081 err_free_mem:
2082         input_free_device(input_dev);
2083         return error;
2084 }
2085
2086 static int mxt_configure_objects(struct mxt_data *data,
2087                                  const struct firmware *cfg);
2088
2089 static void mxt_config_cb(const struct firmware *cfg, void *ctx)
2090 {
2091         mxt_configure_objects(ctx, cfg);
2092         release_firmware(cfg);
2093 }
2094
2095 static int mxt_initialize(struct mxt_data *data)
2096 {
2097         struct i2c_client *client = data->client;
2098         int recovery_attempts = 0;
2099         int error;
2100
2101         while (1) {
2102                 error = mxt_read_info_block(data);
2103                 if (!error)
2104                         break;
2105
2106                 /* Check bootloader state */
2107                 error = mxt_probe_bootloader(data, false);
2108                 if (error) {
2109                         dev_info(&client->dev, "Trying alternate bootloader address\n");
2110                         error = mxt_probe_bootloader(data, true);
2111                         if (error) {
2112                                 /* Chip is not in appmode or bootloader mode */
2113                                 return error;
2114                         }
2115                 }
2116
2117                 /* OK, we are in bootloader, see if we can recover */
2118                 if (++recovery_attempts > 1) {
2119                         dev_err(&client->dev, "Could not recover from bootloader mode\n");
2120                         /*
2121                          * We can reflash from this state, so do not
2122                          * abort initialization.
2123                          */
2124                         data->in_bootloader = true;
2125                         return 0;
2126                 }
2127
2128                 /* Attempt to exit bootloader into app mode */
2129                 mxt_send_bootloader_cmd(data, false);
2130                 msleep(MXT_FW_RESET_TIME);
2131         }
2132
2133         error = mxt_acquire_irq(data);
2134         if (error)
2135                 return error;
2136
2137         error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
2138                                         &client->dev, GFP_KERNEL, data,
2139                                         mxt_config_cb);
2140         if (error) {
2141                 dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
2142                         error);
2143                 return error;
2144         }
2145
2146         return 0;
2147 }
2148
2149 static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
2150 {
2151         struct device *dev = &data->client->dev;
2152         int error;
2153         struct t7_config *new_config;
2154         struct t7_config deepsleep = { .active = 0, .idle = 0 };
2155
2156         if (sleep == MXT_POWER_CFG_DEEPSLEEP)
2157                 new_config = &deepsleep;
2158         else
2159                 new_config = &data->t7_cfg;
2160
2161         error = __mxt_write_reg(data->client, data->T7_address,
2162                                 sizeof(data->t7_cfg), new_config);
2163         if (error)
2164                 return error;
2165
2166         dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
2167                 new_config->active, new_config->idle);
2168
2169         return 0;
2170 }
2171
2172 static int mxt_init_t7_power_cfg(struct mxt_data *data)
2173 {
2174         struct device *dev = &data->client->dev;
2175         int error;
2176         bool retry = false;
2177
2178 recheck:
2179         error = __mxt_read_reg(data->client, data->T7_address,
2180                                 sizeof(data->t7_cfg), &data->t7_cfg);
2181         if (error)
2182                 return error;
2183
2184         if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
2185                 if (!retry) {
2186                         dev_dbg(dev, "T7 cfg zero, resetting\n");
2187                         mxt_soft_reset(data);
2188                         retry = true;
2189                         goto recheck;
2190                 } else {
2191                         dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
2192                         data->t7_cfg.active = 20;
2193                         data->t7_cfg.idle = 100;
2194                         return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2195                 }
2196         }
2197
2198         dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
2199                 data->t7_cfg.active, data->t7_cfg.idle);
2200         return 0;
2201 }
2202
2203 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
2204 static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
2205                                unsigned int y)
2206 {
2207         struct mxt_info *info = data->info;
2208         struct mxt_dbg *dbg = &data->dbg;
2209         unsigned int ofs, page;
2210         unsigned int col = 0;
2211         unsigned int col_width;
2212
2213         if (info->family_id == MXT_FAMILY_1386) {
2214                 col_width = info->matrix_ysize / MXT1386_COLUMNS;
2215                 col = y / col_width;
2216                 y = y % col_width;
2217         } else {
2218                 col_width = info->matrix_ysize;
2219         }
2220
2221         ofs = (y + (x * col_width)) * sizeof(u16);
2222         page = ofs / MXT_DIAGNOSTIC_SIZE;
2223         ofs %= MXT_DIAGNOSTIC_SIZE;
2224
2225         if (info->family_id == MXT_FAMILY_1386)
2226                 page += col * MXT1386_PAGES_PER_COLUMN;
2227
2228         return get_unaligned_le16(&dbg->t37_buf[page].data[ofs]);
2229 }
2230
2231 static int mxt_convert_debug_pages(struct mxt_data *data, u16 *outbuf)
2232 {
2233         struct mxt_dbg *dbg = &data->dbg;
2234         unsigned int x = 0;
2235         unsigned int y = 0;
2236         unsigned int i, rx, ry;
2237
2238         for (i = 0; i < dbg->t37_nodes; i++) {
2239                 /* Handle orientation */
2240                 rx = data->xy_switch ? y : x;
2241                 ry = data->xy_switch ? x : y;
2242                 rx = data->invertx ? (data->xsize - 1 - rx) : rx;
2243                 ry = data->inverty ? (data->ysize - 1 - ry) : ry;
2244
2245                 outbuf[i] = mxt_get_debug_value(data, rx, ry);
2246
2247                 /* Next value */
2248                 if (++x >= (data->xy_switch ? data->ysize : data->xsize)) {
2249                         x = 0;
2250                         y++;
2251                 }
2252         }
2253
2254         return 0;
2255 }
2256
2257 static int mxt_read_diagnostic_debug(struct mxt_data *data, u8 mode,
2258                                      u16 *outbuf)
2259 {
2260         struct mxt_dbg *dbg = &data->dbg;
2261         int retries = 0;
2262         int page;
2263         int ret;
2264         u8 cmd = mode;
2265         struct t37_debug *p;
2266         u8 cmd_poll;
2267
2268         for (page = 0; page < dbg->t37_pages; page++) {
2269                 p = dbg->t37_buf + page;
2270
2271                 ret = mxt_write_reg(data->client, dbg->diag_cmd_address,
2272                                     cmd);
2273                 if (ret)
2274                         return ret;
2275
2276                 retries = 0;
2277                 msleep(20);
2278 wait_cmd:
2279                 /* Read back command byte */
2280                 ret = __mxt_read_reg(data->client, dbg->diag_cmd_address,
2281                                      sizeof(cmd_poll), &cmd_poll);
2282                 if (ret)
2283                         return ret;
2284
2285                 /* Field is cleared once the command has been processed */
2286                 if (cmd_poll) {
2287                         if (retries++ > 100)
2288                                 return -EINVAL;
2289
2290                         msleep(20);
2291                         goto wait_cmd;
2292                 }
2293
2294                 /* Read T37 page */
2295                 ret = __mxt_read_reg(data->client, dbg->t37_address,
2296                                      sizeof(struct t37_debug), p);
2297                 if (ret)
2298                         return ret;
2299
2300                 if (p->mode != mode || p->page != page) {
2301                         dev_err(&data->client->dev, "T37 page mismatch\n");
2302                         return -EINVAL;
2303                 }
2304
2305                 dev_dbg(&data->client->dev, "%s page:%d retries:%d\n",
2306                         __func__, page, retries);
2307
2308                 /* For remaining pages, write PAGEUP rather than mode */
2309                 cmd = MXT_DIAGNOSTIC_PAGEUP;
2310         }
2311
2312         return mxt_convert_debug_pages(data, outbuf);
2313 }
2314
2315 static int mxt_queue_setup(struct vb2_queue *q,
2316                        unsigned int *nbuffers, unsigned int *nplanes,
2317                        unsigned int sizes[], struct device *alloc_devs[])
2318 {
2319         struct mxt_data *data = q->drv_priv;
2320         size_t size = data->dbg.t37_nodes * sizeof(u16);
2321
2322         if (*nplanes)
2323                 return sizes[0] < size ? -EINVAL : 0;
2324
2325         *nplanes = 1;
2326         sizes[0] = size;
2327
2328         return 0;
2329 }
2330
2331 static void mxt_buffer_queue(struct vb2_buffer *vb)
2332 {
2333         struct mxt_data *data = vb2_get_drv_priv(vb->vb2_queue);
2334         u16 *ptr;
2335         int ret;
2336         u8 mode;
2337
2338         ptr = vb2_plane_vaddr(vb, 0);
2339         if (!ptr) {
2340                 dev_err(&data->client->dev, "Error acquiring frame ptr\n");
2341                 goto fault;
2342         }
2343
2344         switch (data->dbg.input) {
2345         case MXT_V4L_INPUT_DELTAS:
2346         default:
2347                 mode = MXT_DIAGNOSTIC_DELTAS;
2348                 break;
2349
2350         case MXT_V4L_INPUT_REFS:
2351                 mode = MXT_DIAGNOSTIC_REFS;
2352                 break;
2353         }
2354
2355         ret = mxt_read_diagnostic_debug(data, mode, ptr);
2356         if (ret)
2357                 goto fault;
2358
2359         vb2_set_plane_payload(vb, 0, data->dbg.t37_nodes * sizeof(u16));
2360         vb2_buffer_done(vb, VB2_BUF_STATE_DONE);
2361         return;
2362
2363 fault:
2364         vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
2365 }
2366
2367 /* V4L2 structures */
2368 static const struct vb2_ops mxt_queue_ops = {
2369         .queue_setup            = mxt_queue_setup,
2370         .buf_queue              = mxt_buffer_queue,
2371         .wait_prepare           = vb2_ops_wait_prepare,
2372         .wait_finish            = vb2_ops_wait_finish,
2373 };
2374
2375 static const struct vb2_queue mxt_queue = {
2376         .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
2377         .io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
2378         .buf_struct_size = sizeof(struct mxt_vb2_buffer),
2379         .ops = &mxt_queue_ops,
2380         .mem_ops = &vb2_vmalloc_memops,
2381         .timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
2382         .min_buffers_needed = 1,
2383 };
2384
2385 static int mxt_vidioc_querycap(struct file *file, void *priv,
2386                                  struct v4l2_capability *cap)
2387 {
2388         struct mxt_data *data = video_drvdata(file);
2389
2390         strlcpy(cap->driver, "atmel_mxt_ts", sizeof(cap->driver));
2391         strlcpy(cap->card, "atmel_mxt_ts touch", sizeof(cap->card));
2392         snprintf(cap->bus_info, sizeof(cap->bus_info),
2393                  "I2C:%s", dev_name(&data->client->dev));
2394         return 0;
2395 }
2396
2397 static int mxt_vidioc_enum_input(struct file *file, void *priv,
2398                                    struct v4l2_input *i)
2399 {
2400         if (i->index >= MXT_V4L_INPUT_MAX)
2401                 return -EINVAL;
2402
2403         i->type = V4L2_INPUT_TYPE_TOUCH;
2404
2405         switch (i->index) {
2406         case MXT_V4L_INPUT_REFS:
2407                 strlcpy(i->name, "Mutual Capacitance References",
2408                         sizeof(i->name));
2409                 break;
2410         case MXT_V4L_INPUT_DELTAS:
2411                 strlcpy(i->name, "Mutual Capacitance Deltas", sizeof(i->name));
2412                 break;
2413         }
2414
2415         return 0;
2416 }
2417
2418 static int mxt_set_input(struct mxt_data *data, unsigned int i)
2419 {
2420         struct v4l2_pix_format *f = &data->dbg.format;
2421
2422         if (i >= MXT_V4L_INPUT_MAX)
2423                 return -EINVAL;
2424
2425         if (i == MXT_V4L_INPUT_DELTAS)
2426                 f->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2427         else
2428                 f->pixelformat = V4L2_TCH_FMT_TU16;
2429
2430         f->width = data->xy_switch ? data->ysize : data->xsize;
2431         f->height = data->xy_switch ? data->xsize : data->ysize;
2432         f->field = V4L2_FIELD_NONE;
2433         f->colorspace = V4L2_COLORSPACE_RAW;
2434         f->bytesperline = f->width * sizeof(u16);
2435         f->sizeimage = f->width * f->height * sizeof(u16);
2436
2437         data->dbg.input = i;
2438
2439         return 0;
2440 }
2441
2442 static int mxt_vidioc_s_input(struct file *file, void *priv, unsigned int i)
2443 {
2444         return mxt_set_input(video_drvdata(file), i);
2445 }
2446
2447 static int mxt_vidioc_g_input(struct file *file, void *priv, unsigned int *i)
2448 {
2449         struct mxt_data *data = video_drvdata(file);
2450
2451         *i = data->dbg.input;
2452
2453         return 0;
2454 }
2455
2456 static int mxt_vidioc_fmt(struct file *file, void *priv, struct v4l2_format *f)
2457 {
2458         struct mxt_data *data = video_drvdata(file);
2459
2460         f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
2461         f->fmt.pix = data->dbg.format;
2462
2463         return 0;
2464 }
2465
2466 static int mxt_vidioc_enum_fmt(struct file *file, void *priv,
2467                                  struct v4l2_fmtdesc *fmt)
2468 {
2469         if (fmt->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2470                 return -EINVAL;
2471
2472         switch (fmt->index) {
2473         case 0:
2474                 fmt->pixelformat = V4L2_TCH_FMT_TU16;
2475                 break;
2476
2477         case 1:
2478                 fmt->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2479                 break;
2480
2481         default:
2482                 return -EINVAL;
2483         }
2484
2485         return 0;
2486 }
2487
2488 static int mxt_vidioc_g_parm(struct file *file, void *fh,
2489                              struct v4l2_streamparm *a)
2490 {
2491         if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2492                 return -EINVAL;
2493
2494         a->parm.capture.readbuffers = 1;
2495         a->parm.capture.timeperframe.numerator = 1;
2496         a->parm.capture.timeperframe.denominator = 10;
2497         return 0;
2498 }
2499
2500 static const struct v4l2_ioctl_ops mxt_video_ioctl_ops = {
2501         .vidioc_querycap        = mxt_vidioc_querycap,
2502
2503         .vidioc_enum_fmt_vid_cap = mxt_vidioc_enum_fmt,
2504         .vidioc_s_fmt_vid_cap   = mxt_vidioc_fmt,
2505         .vidioc_g_fmt_vid_cap   = mxt_vidioc_fmt,
2506         .vidioc_try_fmt_vid_cap = mxt_vidioc_fmt,
2507         .vidioc_g_parm          = mxt_vidioc_g_parm,
2508
2509         .vidioc_enum_input      = mxt_vidioc_enum_input,
2510         .vidioc_g_input         = mxt_vidioc_g_input,
2511         .vidioc_s_input         = mxt_vidioc_s_input,
2512
2513         .vidioc_reqbufs         = vb2_ioctl_reqbufs,
2514         .vidioc_create_bufs     = vb2_ioctl_create_bufs,
2515         .vidioc_querybuf        = vb2_ioctl_querybuf,
2516         .vidioc_qbuf            = vb2_ioctl_qbuf,
2517         .vidioc_dqbuf           = vb2_ioctl_dqbuf,
2518         .vidioc_expbuf          = vb2_ioctl_expbuf,
2519
2520         .vidioc_streamon        = vb2_ioctl_streamon,
2521         .vidioc_streamoff       = vb2_ioctl_streamoff,
2522 };
2523
2524 static const struct video_device mxt_video_device = {
2525         .name = "Atmel maxTouch",
2526         .fops = &mxt_video_fops,
2527         .ioctl_ops = &mxt_video_ioctl_ops,
2528         .release = video_device_release_empty,
2529         .device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TOUCH |
2530                        V4L2_CAP_READWRITE | V4L2_CAP_STREAMING,
2531 };
2532
2533 static void mxt_debug_init(struct mxt_data *data)
2534 {
2535         struct mxt_info *info = data->info;
2536         struct mxt_dbg *dbg = &data->dbg;
2537         struct mxt_object *object;
2538         int error;
2539
2540         object = mxt_get_object(data, MXT_GEN_COMMAND_T6);
2541         if (!object)
2542                 goto error;
2543
2544         dbg->diag_cmd_address = object->start_address + MXT_COMMAND_DIAGNOSTIC;
2545
2546         object = mxt_get_object(data, MXT_DEBUG_DIAGNOSTIC_T37);
2547         if (!object)
2548                 goto error;
2549
2550         if (mxt_obj_size(object) != sizeof(struct t37_debug)) {
2551                 dev_warn(&data->client->dev, "Bad T37 size");
2552                 goto error;
2553         }
2554
2555         dbg->t37_address = object->start_address;
2556
2557         /* Calculate size of data and allocate buffer */
2558         dbg->t37_nodes = data->xsize * data->ysize;
2559
2560         if (info->family_id == MXT_FAMILY_1386)
2561                 dbg->t37_pages = MXT1386_COLUMNS * MXT1386_PAGES_PER_COLUMN;
2562         else
2563                 dbg->t37_pages = DIV_ROUND_UP(data->xsize *
2564                                               info->matrix_ysize *
2565                                               sizeof(u16),
2566                                               sizeof(dbg->t37_buf->data));
2567
2568         dbg->t37_buf = devm_kmalloc_array(&data->client->dev, dbg->t37_pages,
2569                                           sizeof(struct t37_debug), GFP_KERNEL);
2570         if (!dbg->t37_buf)
2571                 goto error;
2572
2573         /* init channel to zero */
2574         mxt_set_input(data, 0);
2575
2576         /* register video device */
2577         snprintf(dbg->v4l2.name, sizeof(dbg->v4l2.name), "%s", "atmel_mxt_ts");
2578         error = v4l2_device_register(&data->client->dev, &dbg->v4l2);
2579         if (error)
2580                 goto error;
2581
2582         /* initialize the queue */
2583         mutex_init(&dbg->lock);
2584         dbg->queue = mxt_queue;
2585         dbg->queue.drv_priv = data;
2586         dbg->queue.lock = &dbg->lock;
2587         dbg->queue.dev = &data->client->dev;
2588
2589         error = vb2_queue_init(&dbg->queue);
2590         if (error)
2591                 goto error_unreg_v4l2;
2592
2593         dbg->vdev = mxt_video_device;
2594         dbg->vdev.v4l2_dev = &dbg->v4l2;
2595         dbg->vdev.lock = &dbg->lock;
2596         dbg->vdev.vfl_dir = VFL_DIR_RX;
2597         dbg->vdev.queue = &dbg->queue;
2598         video_set_drvdata(&dbg->vdev, data);
2599
2600         error = video_register_device(&dbg->vdev, VFL_TYPE_TOUCH, -1);
2601         if (error)
2602                 goto error_unreg_v4l2;
2603
2604         return;
2605
2606 error_unreg_v4l2:
2607         v4l2_device_unregister(&dbg->v4l2);
2608 error:
2609         dev_warn(&data->client->dev, "Error initializing T37\n");
2610 }
2611 #else
2612 static void mxt_debug_init(struct mxt_data *data)
2613 {
2614 }
2615 #endif
2616
2617 static int mxt_configure_objects(struct mxt_data *data,
2618                                  const struct firmware *cfg)
2619 {
2620         struct device *dev = &data->client->dev;
2621         int error;
2622
2623         error = mxt_init_t7_power_cfg(data);
2624         if (error) {
2625                 dev_err(dev, "Failed to initialize power cfg\n");
2626                 return error;
2627         }
2628
2629         if (cfg) {
2630                 error = mxt_update_cfg(data, cfg);
2631                 if (error)
2632                         dev_warn(dev, "Error %d updating config\n", error);
2633         }
2634
2635         if (data->multitouch) {
2636                 error = mxt_initialize_input_device(data);
2637                 if (error)
2638                         return error;
2639         } else {
2640                 dev_warn(dev, "No touch object detected\n");
2641         }
2642
2643         mxt_debug_init(data);
2644
2645         return 0;
2646 }
2647
2648 /* Firmware Version is returned as Major.Minor.Build */
2649 static ssize_t mxt_fw_version_show(struct device *dev,
2650                                    struct device_attribute *attr, char *buf)
2651 {
2652         struct mxt_data *data = dev_get_drvdata(dev);
2653         struct mxt_info *info = data->info;
2654         return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
2655                          info->version >> 4, info->version & 0xf, info->build);
2656 }
2657
2658 /* Hardware Version is returned as FamilyID.VariantID */
2659 static ssize_t mxt_hw_version_show(struct device *dev,
2660                                    struct device_attribute *attr, char *buf)
2661 {
2662         struct mxt_data *data = dev_get_drvdata(dev);
2663         struct mxt_info *info = data->info;
2664         return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
2665                          info->family_id, info->variant_id);
2666 }
2667
2668 static ssize_t mxt_show_instance(char *buf, int count,
2669                                  struct mxt_object *object, int instance,
2670                                  const u8 *val)
2671 {
2672         int i;
2673
2674         if (mxt_obj_instances(object) > 1)
2675                 count += scnprintf(buf + count, PAGE_SIZE - count,
2676                                    "Instance %u\n", instance);
2677
2678         for (i = 0; i < mxt_obj_size(object); i++)
2679                 count += scnprintf(buf + count, PAGE_SIZE - count,
2680                                 "\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
2681         count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
2682
2683         return count;
2684 }
2685
2686 static ssize_t mxt_object_show(struct device *dev,
2687                                     struct device_attribute *attr, char *buf)
2688 {
2689         struct mxt_data *data = dev_get_drvdata(dev);
2690         struct mxt_object *object;
2691         int count = 0;
2692         int i, j;
2693         int error;
2694         u8 *obuf;
2695
2696         /* Pre-allocate buffer large enough to hold max sized object. */
2697         obuf = kmalloc(256, GFP_KERNEL);
2698         if (!obuf)
2699                 return -ENOMEM;
2700
2701         error = 0;
2702         for (i = 0; i < data->info->object_num; i++) {
2703                 object = data->object_table + i;
2704
2705                 if (!mxt_object_readable(object->type))
2706                         continue;
2707
2708                 count += scnprintf(buf + count, PAGE_SIZE - count,
2709                                 "T%u:\n", object->type);
2710
2711                 for (j = 0; j < mxt_obj_instances(object); j++) {
2712                         u16 size = mxt_obj_size(object);
2713                         u16 addr = object->start_address + j * size;
2714
2715                         error = __mxt_read_reg(data->client, addr, size, obuf);
2716                         if (error)
2717                                 goto done;
2718
2719                         count = mxt_show_instance(buf, count, object, j, obuf);
2720                 }
2721         }
2722
2723 done:
2724         kfree(obuf);
2725         return error ?: count;
2726 }
2727
2728 static int mxt_check_firmware_format(struct device *dev,
2729                                      const struct firmware *fw)
2730 {
2731         unsigned int pos = 0;
2732         char c;
2733
2734         while (pos < fw->size) {
2735                 c = *(fw->data + pos);
2736
2737                 if (c < '0' || (c > '9' && c < 'A') || c > 'F')
2738                         return 0;
2739
2740                 pos++;
2741         }
2742
2743         /*
2744          * To convert file try:
2745          * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
2746          */
2747         dev_err(dev, "Aborting: firmware file must be in binary format\n");
2748
2749         return -EINVAL;
2750 }
2751
2752 static int mxt_load_fw(struct device *dev, const char *fn)
2753 {
2754         struct mxt_data *data = dev_get_drvdata(dev);
2755         const struct firmware *fw = NULL;
2756         unsigned int frame_size;
2757         unsigned int pos = 0;
2758         unsigned int retry = 0;
2759         unsigned int frame = 0;
2760         int ret;
2761
2762         ret = request_firmware(&fw, fn, dev);
2763         if (ret) {
2764                 dev_err(dev, "Unable to open firmware %s\n", fn);
2765                 return ret;
2766         }
2767
2768         /* Check for incorrect enc file */
2769         ret = mxt_check_firmware_format(dev, fw);
2770         if (ret)
2771                 goto release_firmware;
2772
2773         if (!data->in_bootloader) {
2774                 /* Change to the bootloader mode */
2775                 data->in_bootloader = true;
2776
2777                 ret = mxt_t6_command(data, MXT_COMMAND_RESET,
2778                                      MXT_BOOT_VALUE, false);
2779                 if (ret)
2780                         goto release_firmware;
2781
2782                 msleep(MXT_RESET_TIME);
2783
2784                 /* Do not need to scan since we know family ID */
2785                 ret = mxt_lookup_bootloader_address(data, 0);
2786                 if (ret)
2787                         goto release_firmware;
2788
2789                 mxt_free_input_device(data);
2790                 mxt_free_object_table(data);
2791         } else {
2792                 enable_irq(data->irq);
2793         }
2794
2795         reinit_completion(&data->bl_completion);
2796
2797         ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
2798         if (ret) {
2799                 /* Bootloader may still be unlocked from previous attempt */
2800                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
2801                 if (ret)
2802                         goto disable_irq;
2803         } else {
2804                 dev_info(dev, "Unlocking bootloader\n");
2805
2806                 /* Unlock bootloader */
2807                 ret = mxt_send_bootloader_cmd(data, true);
2808                 if (ret)
2809                         goto disable_irq;
2810         }
2811
2812         while (pos < fw->size) {
2813                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
2814                 if (ret)
2815                         goto disable_irq;
2816
2817                 frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
2818
2819                 /* Take account of CRC bytes */
2820                 frame_size += 2;
2821
2822                 /* Write one frame to device */
2823                 ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
2824                 if (ret)
2825                         goto disable_irq;
2826
2827                 ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
2828                 if (ret) {
2829                         retry++;
2830
2831                         /* Back off by 20ms per retry */
2832                         msleep(retry * 20);
2833
2834                         if (retry > 20) {
2835                                 dev_err(dev, "Retry count exceeded\n");
2836                                 goto disable_irq;
2837                         }
2838                 } else {
2839                         retry = 0;
2840                         pos += frame_size;
2841                         frame++;
2842                 }
2843
2844                 if (frame % 50 == 0)
2845                         dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
2846                                 frame, pos, fw->size);
2847         }
2848
2849         /* Wait for flash. */
2850         ret = mxt_wait_for_completion(data, &data->bl_completion,
2851                                       MXT_FW_RESET_TIME);
2852         if (ret)
2853                 goto disable_irq;
2854
2855         dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
2856
2857         /*
2858          * Wait for device to reset. Some bootloader versions do not assert
2859          * the CHG line after bootloading has finished, so ignore potential
2860          * errors.
2861          */
2862         mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
2863
2864         data->in_bootloader = false;
2865
2866 disable_irq:
2867         disable_irq(data->irq);
2868 release_firmware:
2869         release_firmware(fw);
2870         return ret;
2871 }
2872
2873 static ssize_t mxt_update_fw_store(struct device *dev,
2874                                         struct device_attribute *attr,
2875                                         const char *buf, size_t count)
2876 {
2877         struct mxt_data *data = dev_get_drvdata(dev);
2878         int error;
2879
2880         error = mxt_load_fw(dev, MXT_FW_NAME);
2881         if (error) {
2882                 dev_err(dev, "The firmware update failed(%d)\n", error);
2883                 count = error;
2884         } else {
2885                 dev_info(dev, "The firmware update succeeded\n");
2886
2887                 error = mxt_initialize(data);
2888                 if (error)
2889                         return error;
2890         }
2891
2892         return count;
2893 }
2894
2895 static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2896 static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2897 static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2898 static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2899
2900 static struct attribute *mxt_attrs[] = {
2901         &dev_attr_fw_version.attr,
2902         &dev_attr_hw_version.attr,
2903         &dev_attr_object.attr,
2904         &dev_attr_update_fw.attr,
2905         NULL
2906 };
2907
2908 static const struct attribute_group mxt_attr_group = {
2909         .attrs = mxt_attrs,
2910 };
2911
2912 static void mxt_start(struct mxt_data *data)
2913 {
2914         switch (data->suspend_mode) {
2915         case MXT_SUSPEND_T9_CTRL:
2916                 mxt_soft_reset(data);
2917
2918                 /* Touch enable */
2919                 /* 0x83 = SCANEN | RPTEN | ENABLE */
2920                 mxt_write_object(data,
2921                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0x83);
2922                 break;
2923
2924         case MXT_SUSPEND_DEEP_SLEEP:
2925         default:
2926                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2927
2928                 /* Recalibrate since chip has been in deep sleep */
2929                 mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
2930                 break;
2931         }
2932 }
2933
2934 static void mxt_stop(struct mxt_data *data)
2935 {
2936         switch (data->suspend_mode) {
2937         case MXT_SUSPEND_T9_CTRL:
2938                 /* Touch disable */
2939                 mxt_write_object(data,
2940                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0);
2941                 break;
2942
2943         case MXT_SUSPEND_DEEP_SLEEP:
2944         default:
2945                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
2946                 break;
2947         }
2948 }
2949
2950 static int mxt_input_open(struct input_dev *dev)
2951 {
2952         struct mxt_data *data = input_get_drvdata(dev);
2953
2954         mxt_start(data);
2955
2956         return 0;
2957 }
2958
2959 static void mxt_input_close(struct input_dev *dev)
2960 {
2961         struct mxt_data *data = input_get_drvdata(dev);
2962
2963         mxt_stop(data);
2964 }
2965
2966 static int mxt_parse_device_properties(struct mxt_data *data)
2967 {
2968         static const char keymap_property[] = "linux,gpio-keymap";
2969         struct device *dev = &data->client->dev;
2970         u32 *keymap;
2971         int n_keys;
2972         int error;
2973
2974         if (device_property_present(dev, keymap_property)) {
2975                 n_keys = device_property_read_u32_array(dev, keymap_property,
2976                                                         NULL, 0);
2977                 if (n_keys <= 0) {
2978                         error = n_keys < 0 ? n_keys : -EINVAL;
2979                         dev_err(dev, "invalid/malformed '%s' property: %d\n",
2980                                 keymap_property, error);
2981                         return error;
2982                 }
2983
2984                 keymap = devm_kmalloc_array(dev, n_keys, sizeof(*keymap),
2985                                             GFP_KERNEL);
2986                 if (!keymap)
2987                         return -ENOMEM;
2988
2989                 error = device_property_read_u32_array(dev, keymap_property,
2990                                                        keymap, n_keys);
2991                 if (error) {
2992                         dev_err(dev, "failed to parse '%s' property: %d\n",
2993                                 keymap_property, error);
2994                         return error;
2995                 }
2996
2997                 data->t19_keymap = keymap;
2998                 data->t19_num_keys = n_keys;
2999         }
3000
3001         return 0;
3002 }
3003
3004 static const struct dmi_system_id chromebook_T9_suspend_dmi[] = {
3005         {
3006                 .matches = {
3007                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3008                         DMI_MATCH(DMI_PRODUCT_NAME, "Link"),
3009                 },
3010         },
3011         {
3012                 .matches = {
3013                         DMI_MATCH(DMI_PRODUCT_NAME, "Peppy"),
3014                 },
3015         },
3016         { }
3017 };
3018
3019 static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
3020 {
3021         struct mxt_data *data;
3022         int error;
3023
3024         /*
3025          * Ignore devices that do not have device properties attached to
3026          * them, as we need help determining whether we are dealing with
3027          * touch screen or touchpad.
3028          *
3029          * So far on x86 the only users of Atmel touch controllers are
3030          * Chromebooks, and chromeos_laptop driver will ensure that
3031          * necessary properties are provided (if firmware does not do that).
3032          */
3033         if (!device_property_present(&client->dev, "compatible"))
3034                 return -ENXIO;
3035
3036         /*
3037          * Ignore ACPI devices representing bootloader mode.
3038          *
3039          * This is a bit of a hack: Google Chromebook BIOS creates ACPI
3040          * devices for both application and bootloader modes, but we are
3041          * interested in application mode only (if device is in bootloader
3042          * mode we'll end up switching into application anyway). So far
3043          * application mode addresses were all above 0x40, so we'll use it
3044          * as a threshold.
3045          */
3046         if (ACPI_COMPANION(&client->dev) && client->addr < 0x40)
3047                 return -ENXIO;
3048
3049         data = devm_kzalloc(&client->dev, sizeof(struct mxt_data), GFP_KERNEL);
3050         if (!data)
3051                 return -ENOMEM;
3052
3053         snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
3054                  client->adapter->nr, client->addr);
3055
3056         data->client = client;
3057         data->irq = client->irq;
3058         i2c_set_clientdata(client, data);
3059
3060         init_completion(&data->bl_completion);
3061         init_completion(&data->reset_completion);
3062         init_completion(&data->crc_completion);
3063
3064         data->suspend_mode = dmi_check_system(chromebook_T9_suspend_dmi) ?
3065                 MXT_SUSPEND_T9_CTRL : MXT_SUSPEND_DEEP_SLEEP;
3066
3067         error = mxt_parse_device_properties(data);
3068         if (error)
3069                 return error;
3070
3071         data->reset_gpio = devm_gpiod_get_optional(&client->dev,
3072                                                    "reset", GPIOD_OUT_LOW);
3073         if (IS_ERR(data->reset_gpio)) {
3074                 error = PTR_ERR(data->reset_gpio);
3075                 dev_err(&client->dev, "Failed to get reset gpio: %d\n", error);
3076                 return error;
3077         }
3078
3079         error = devm_request_threaded_irq(&client->dev, client->irq,
3080                                           NULL, mxt_interrupt, IRQF_ONESHOT,
3081                                           client->name, data);
3082         if (error) {
3083                 dev_err(&client->dev, "Failed to register interrupt\n");
3084                 return error;
3085         }
3086
3087         disable_irq(client->irq);
3088
3089         if (data->reset_gpio) {
3090                 msleep(MXT_RESET_GPIO_TIME);
3091                 gpiod_set_value(data->reset_gpio, 1);
3092                 msleep(MXT_RESET_INVALID_CHG);
3093         }
3094
3095         error = mxt_initialize(data);
3096         if (error)
3097                 return error;
3098
3099         error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
3100         if (error) {
3101                 dev_err(&client->dev, "Failure %d creating sysfs group\n",
3102                         error);
3103                 goto err_free_object;
3104         }
3105
3106         return 0;
3107
3108 err_free_object:
3109         mxt_free_input_device(data);
3110         mxt_free_object_table(data);
3111         return error;
3112 }
3113
3114 static int mxt_remove(struct i2c_client *client)
3115 {
3116         struct mxt_data *data = i2c_get_clientdata(client);
3117
3118         disable_irq(data->irq);
3119         sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
3120         mxt_free_input_device(data);
3121         mxt_free_object_table(data);
3122
3123         return 0;
3124 }
3125
3126 static int __maybe_unused mxt_suspend(struct device *dev)
3127 {
3128         struct i2c_client *client = to_i2c_client(dev);
3129         struct mxt_data *data = i2c_get_clientdata(client);
3130         struct input_dev *input_dev = data->input_dev;
3131
3132         if (!input_dev)
3133                 return 0;
3134
3135         mutex_lock(&input_dev->mutex);
3136
3137         if (input_dev->users)
3138                 mxt_stop(data);
3139
3140         mutex_unlock(&input_dev->mutex);
3141
3142         return 0;
3143 }
3144
3145 static int __maybe_unused mxt_resume(struct device *dev)
3146 {
3147         struct i2c_client *client = to_i2c_client(dev);
3148         struct mxt_data *data = i2c_get_clientdata(client);
3149         struct input_dev *input_dev = data->input_dev;
3150
3151         if (!input_dev)
3152                 return 0;
3153
3154         mutex_lock(&input_dev->mutex);
3155
3156         if (input_dev->users)
3157                 mxt_start(data);
3158
3159         mutex_unlock(&input_dev->mutex);
3160
3161         return 0;
3162 }
3163
3164 static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
3165
3166 static const struct of_device_id mxt_of_match[] = {
3167         { .compatible = "atmel,maxtouch", },
3168         /* Compatibles listed below are deprecated */
3169         { .compatible = "atmel,qt602240_ts", },
3170         { .compatible = "atmel,atmel_mxt_ts", },
3171         { .compatible = "atmel,atmel_mxt_tp", },
3172         { .compatible = "atmel,mXT224", },
3173         {},
3174 };
3175 MODULE_DEVICE_TABLE(of, mxt_of_match);
3176
3177 #ifdef CONFIG_ACPI
3178 static const struct acpi_device_id mxt_acpi_id[] = {
3179         { "ATML0000", 0 },      /* Touchpad */
3180         { "ATML0001", 0 },      /* Touchscreen */
3181         { }
3182 };
3183 MODULE_DEVICE_TABLE(acpi, mxt_acpi_id);
3184 #endif
3185
3186 static const struct i2c_device_id mxt_id[] = {
3187         { "qt602240_ts", 0 },
3188         { "atmel_mxt_ts", 0 },
3189         { "atmel_mxt_tp", 0 },
3190         { "maxtouch", 0 },
3191         { "mXT224", 0 },
3192         { }
3193 };
3194 MODULE_DEVICE_TABLE(i2c, mxt_id);
3195
3196 static struct i2c_driver mxt_driver = {
3197         .driver = {
3198                 .name   = "atmel_mxt_ts",
3199                 .of_match_table = mxt_of_match,
3200                 .acpi_match_table = ACPI_PTR(mxt_acpi_id),
3201                 .pm     = &mxt_pm_ops,
3202         },
3203         .probe          = mxt_probe,
3204         .remove         = mxt_remove,
3205         .id_table       = mxt_id,
3206 };
3207
3208 module_i2c_driver(mxt_driver);
3209
3210 /* Module information */
3211 MODULE_AUTHOR("Joonyoung Shim <[email protected]>");
3212 MODULE_DESCRIPTION("Atmel maXTouch Touchscreen driver");
3213 MODULE_LICENSE("GPL");