Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
[muen/linux.git] / drivers / input / touchscreen / atmel_mxt_ts.c
1 /*
2  * Atmel maXTouch Touchscreen driver
3  *
4  * Copyright (C) 2010 Samsung Electronics Co.Ltd
5  * Copyright (C) 2011-2014 Atmel Corporation
6  * Copyright (C) 2012 Google, Inc.
7  * Copyright (C) 2016 Zodiac Inflight Innovations
8  *
9  * Author: Joonyoung Shim <jy0922.shim@samsung.com>
10  *
11  * This program is free software; you can redistribute  it and/or modify it
12  * under  the terms of  the GNU General  Public License as published by the
13  * Free Software Foundation;  either version 2 of the  License, or (at your
14  * option) any later version.
15  *
16  */
17
18 #include <linux/acpi.h>
19 #include <linux/dmi.h>
20 #include <linux/module.h>
21 #include <linux/init.h>
22 #include <linux/completion.h>
23 #include <linux/delay.h>
24 #include <linux/firmware.h>
25 #include <linux/i2c.h>
26 #include <linux/input/mt.h>
27 #include <linux/interrupt.h>
28 #include <linux/of.h>
29 #include <linux/property.h>
30 #include <linux/slab.h>
31 #include <linux/gpio/consumer.h>
32 #include <linux/property.h>
33 #include <asm/unaligned.h>
34 #include <media/v4l2-device.h>
35 #include <media/v4l2-ioctl.h>
36 #include <media/videobuf2-v4l2.h>
37 #include <media/videobuf2-vmalloc.h>
38
39 /* Firmware files */
40 #define MXT_FW_NAME             "maxtouch.fw"
41 #define MXT_CFG_NAME            "maxtouch.cfg"
42 #define MXT_CFG_MAGIC           "OBP_RAW V1"
43
44 /* Registers */
45 #define MXT_OBJECT_START        0x07
46 #define MXT_OBJECT_SIZE         6
47 #define MXT_INFO_CHECKSUM_SIZE  3
48 #define MXT_MAX_BLOCK_WRITE     256
49
50 /* Object types */
51 #define MXT_DEBUG_DIAGNOSTIC_T37        37
52 #define MXT_GEN_MESSAGE_T5              5
53 #define MXT_GEN_COMMAND_T6              6
54 #define MXT_GEN_POWER_T7                7
55 #define MXT_GEN_ACQUIRE_T8              8
56 #define MXT_GEN_DATASOURCE_T53          53
57 #define MXT_TOUCH_MULTI_T9              9
58 #define MXT_TOUCH_KEYARRAY_T15          15
59 #define MXT_TOUCH_PROXIMITY_T23         23
60 #define MXT_TOUCH_PROXKEY_T52           52
61 #define MXT_PROCI_GRIPFACE_T20          20
62 #define MXT_PROCG_NOISE_T22             22
63 #define MXT_PROCI_ONETOUCH_T24          24
64 #define MXT_PROCI_TWOTOUCH_T27          27
65 #define MXT_PROCI_GRIP_T40              40
66 #define MXT_PROCI_PALM_T41              41
67 #define MXT_PROCI_TOUCHSUPPRESSION_T42  42
68 #define MXT_PROCI_STYLUS_T47            47
69 #define MXT_PROCG_NOISESUPPRESSION_T48  48
70 #define MXT_SPT_COMMSCONFIG_T18         18
71 #define MXT_SPT_GPIOPWM_T19             19
72 #define MXT_SPT_SELFTEST_T25            25
73 #define MXT_SPT_CTECONFIG_T28           28
74 #define MXT_SPT_USERDATA_T38            38
75 #define MXT_SPT_DIGITIZER_T43           43
76 #define MXT_SPT_MESSAGECOUNT_T44        44
77 #define MXT_SPT_CTECONFIG_T46           46
78 #define MXT_TOUCH_MULTITOUCHSCREEN_T100 100
79
80 /* MXT_GEN_MESSAGE_T5 object */
81 #define MXT_RPTID_NOMSG         0xff
82
83 /* MXT_GEN_COMMAND_T6 field */
84 #define MXT_COMMAND_RESET       0
85 #define MXT_COMMAND_BACKUPNV    1
86 #define MXT_COMMAND_CALIBRATE   2
87 #define MXT_COMMAND_REPORTALL   3
88 #define MXT_COMMAND_DIAGNOSTIC  5
89
90 /* Define for T6 status byte */
91 #define MXT_T6_STATUS_RESET     (1 << 7)
92 #define MXT_T6_STATUS_OFL       (1 << 6)
93 #define MXT_T6_STATUS_SIGERR    (1 << 5)
94 #define MXT_T6_STATUS_CAL       (1 << 4)
95 #define MXT_T6_STATUS_CFGERR    (1 << 3)
96 #define MXT_T6_STATUS_COMSERR   (1 << 2)
97
98 /* MXT_GEN_POWER_T7 field */
99 struct t7_config {
100         u8 idle;
101         u8 active;
102 } __packed;
103
104 #define MXT_POWER_CFG_RUN               0
105 #define MXT_POWER_CFG_DEEPSLEEP         1
106
107 /* MXT_TOUCH_MULTI_T9 field */
108 #define MXT_T9_CTRL             0
109 #define MXT_T9_XSIZE            3
110 #define MXT_T9_YSIZE            4
111 #define MXT_T9_ORIENT           9
112 #define MXT_T9_RANGE            18
113
114 /* MXT_TOUCH_MULTI_T9 status */
115 #define MXT_T9_UNGRIP           (1 << 0)
116 #define MXT_T9_SUPPRESS         (1 << 1)
117 #define MXT_T9_AMP              (1 << 2)
118 #define MXT_T9_VECTOR           (1 << 3)
119 #define MXT_T9_MOVE             (1 << 4)
120 #define MXT_T9_RELEASE          (1 << 5)
121 #define MXT_T9_PRESS            (1 << 6)
122 #define MXT_T9_DETECT           (1 << 7)
123
124 struct t9_range {
125         __le16 x;
126         __le16 y;
127 } __packed;
128
129 /* MXT_TOUCH_MULTI_T9 orient */
130 #define MXT_T9_ORIENT_SWITCH    (1 << 0)
131 #define MXT_T9_ORIENT_INVERTX   (1 << 1)
132 #define MXT_T9_ORIENT_INVERTY   (1 << 2)
133
134 /* MXT_SPT_COMMSCONFIG_T18 */
135 #define MXT_COMMS_CTRL          0
136 #define MXT_COMMS_CMD           1
137
138 /* MXT_DEBUG_DIAGNOSTIC_T37 */
139 #define MXT_DIAGNOSTIC_PAGEUP   0x01
140 #define MXT_DIAGNOSTIC_DELTAS   0x10
141 #define MXT_DIAGNOSTIC_REFS     0x11
142 #define MXT_DIAGNOSTIC_SIZE     128
143
144 #define MXT_FAMILY_1386                 160
145 #define MXT1386_COLUMNS                 3
146 #define MXT1386_PAGES_PER_COLUMN        8
147
148 struct t37_debug {
149 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
150         u8 mode;
151         u8 page;
152         u8 data[MXT_DIAGNOSTIC_SIZE];
153 #endif
154 };
155
156 /* Define for MXT_GEN_COMMAND_T6 */
157 #define MXT_BOOT_VALUE          0xa5
158 #define MXT_RESET_VALUE         0x01
159 #define MXT_BACKUP_VALUE        0x55
160
161 /* T100 Multiple Touch Touchscreen */
162 #define MXT_T100_CTRL           0
163 #define MXT_T100_CFG1           1
164 #define MXT_T100_TCHAUX         3
165 #define MXT_T100_XSIZE          9
166 #define MXT_T100_XRANGE         13
167 #define MXT_T100_YSIZE          20
168 #define MXT_T100_YRANGE         24
169
170 #define MXT_T100_CFG_SWITCHXY   BIT(5)
171 #define MXT_T100_CFG_INVERTY    BIT(6)
172 #define MXT_T100_CFG_INVERTX    BIT(7)
173
174 #define MXT_T100_TCHAUX_VECT    BIT(0)
175 #define MXT_T100_TCHAUX_AMPL    BIT(1)
176 #define MXT_T100_TCHAUX_AREA    BIT(2)
177
178 #define MXT_T100_DETECT         BIT(7)
179 #define MXT_T100_TYPE_MASK      0x70
180
181 enum t100_type {
182         MXT_T100_TYPE_FINGER            = 1,
183         MXT_T100_TYPE_PASSIVE_STYLUS    = 2,
184         MXT_T100_TYPE_HOVERING_FINGER   = 4,
185         MXT_T100_TYPE_GLOVE             = 5,
186         MXT_T100_TYPE_LARGE_TOUCH       = 6,
187 };
188
189 #define MXT_DISTANCE_ACTIVE_TOUCH       0
190 #define MXT_DISTANCE_HOVERING           1
191
192 #define MXT_TOUCH_MAJOR_DEFAULT         1
193 #define MXT_PRESSURE_DEFAULT            1
194
195 /* Delay times */
196 #define MXT_BACKUP_TIME         50      /* msec */
197 #define MXT_RESET_TIME          200     /* msec */
198 #define MXT_RESET_TIMEOUT       3000    /* msec */
199 #define MXT_CRC_TIMEOUT         1000    /* msec */
200 #define MXT_FW_RESET_TIME       3000    /* msec */
201 #define MXT_FW_CHG_TIMEOUT      300     /* msec */
202
203 /* Command to unlock bootloader */
204 #define MXT_UNLOCK_CMD_MSB      0xaa
205 #define MXT_UNLOCK_CMD_LSB      0xdc
206
207 /* Bootloader mode status */
208 #define MXT_WAITING_BOOTLOAD_CMD        0xc0    /* valid 7 6 bit only */
209 #define MXT_WAITING_FRAME_DATA  0x80    /* valid 7 6 bit only */
210 #define MXT_FRAME_CRC_CHECK     0x02
211 #define MXT_FRAME_CRC_FAIL      0x03
212 #define MXT_FRAME_CRC_PASS      0x04
213 #define MXT_APP_CRC_FAIL        0x40    /* valid 7 8 bit only */
214 #define MXT_BOOT_STATUS_MASK    0x3f
215 #define MXT_BOOT_EXTENDED_ID    (1 << 5)
216 #define MXT_BOOT_ID_MASK        0x1f
217
218 /* Touchscreen absolute values */
219 #define MXT_MAX_AREA            0xff
220
221 #define MXT_PIXELS_PER_MM       20
222
223 struct mxt_info {
224         u8 family_id;
225         u8 variant_id;
226         u8 version;
227         u8 build;
228         u8 matrix_xsize;
229         u8 matrix_ysize;
230         u8 object_num;
231 };
232
233 struct mxt_object {
234         u8 type;
235         u16 start_address;
236         u8 size_minus_one;
237         u8 instances_minus_one;
238         u8 num_report_ids;
239 } __packed;
240
241 struct mxt_dbg {
242         u16 t37_address;
243         u16 diag_cmd_address;
244         struct t37_debug *t37_buf;
245         unsigned int t37_pages;
246         unsigned int t37_nodes;
247
248         struct v4l2_device v4l2;
249         struct v4l2_pix_format format;
250         struct video_device vdev;
251         struct vb2_queue queue;
252         struct mutex lock;
253         int input;
254 };
255
256 enum v4l_dbg_inputs {
257         MXT_V4L_INPUT_DELTAS,
258         MXT_V4L_INPUT_REFS,
259         MXT_V4L_INPUT_MAX,
260 };
261
262 static const struct v4l2_file_operations mxt_video_fops = {
263         .owner = THIS_MODULE,
264         .open = v4l2_fh_open,
265         .release = vb2_fop_release,
266         .unlocked_ioctl = video_ioctl2,
267         .read = vb2_fop_read,
268         .mmap = vb2_fop_mmap,
269         .poll = vb2_fop_poll,
270 };
271
272 enum mxt_suspend_mode {
273         MXT_SUSPEND_DEEP_SLEEP  = 0,
274         MXT_SUSPEND_T9_CTRL     = 1,
275 };
276
277 /* Each client has this additional data */
278 struct mxt_data {
279         struct i2c_client *client;
280         struct input_dev *input_dev;
281         char phys[64];          /* device physical location */
282         struct mxt_object *object_table;
283         struct mxt_info *info;
284         void *raw_info_block;
285         unsigned int irq;
286         unsigned int max_x;
287         unsigned int max_y;
288         bool invertx;
289         bool inverty;
290         bool xy_switch;
291         u8 xsize;
292         u8 ysize;
293         bool in_bootloader;
294         u16 mem_size;
295         u8 t100_aux_ampl;
296         u8 t100_aux_area;
297         u8 t100_aux_vect;
298         u8 max_reportid;
299         u32 config_crc;
300         u32 info_crc;
301         u8 bootloader_addr;
302         u8 *msg_buf;
303         u8 t6_status;
304         bool update_input;
305         u8 last_message_count;
306         u8 num_touchids;
307         u8 multitouch;
308         struct t7_config t7_cfg;
309         struct mxt_dbg dbg;
310         struct gpio_desc *reset_gpio;
311
312         /* Cached parameters from object table */
313         u16 T5_address;
314         u8 T5_msg_size;
315         u8 T6_reportid;
316         u16 T6_address;
317         u16 T7_address;
318         u8 T9_reportid_min;
319         u8 T9_reportid_max;
320         u8 T19_reportid;
321         u16 T44_address;
322         u8 T100_reportid_min;
323         u8 T100_reportid_max;
324
325         /* for fw update in bootloader */
326         struct completion bl_completion;
327
328         /* for reset handling */
329         struct completion reset_completion;
330
331         /* for config update handling */
332         struct completion crc_completion;
333
334         u32 *t19_keymap;
335         unsigned int t19_num_keys;
336
337         enum mxt_suspend_mode suspend_mode;
338 };
339
340 struct mxt_vb2_buffer {
341         struct vb2_buffer       vb;
342         struct list_head        list;
343 };
344
345 static size_t mxt_obj_size(const struct mxt_object *obj)
346 {
347         return obj->size_minus_one + 1;
348 }
349
350 static size_t mxt_obj_instances(const struct mxt_object *obj)
351 {
352         return obj->instances_minus_one + 1;
353 }
354
355 static bool mxt_object_readable(unsigned int type)
356 {
357         switch (type) {
358         case MXT_GEN_COMMAND_T6:
359         case MXT_GEN_POWER_T7:
360         case MXT_GEN_ACQUIRE_T8:
361         case MXT_GEN_DATASOURCE_T53:
362         case MXT_TOUCH_MULTI_T9:
363         case MXT_TOUCH_KEYARRAY_T15:
364         case MXT_TOUCH_PROXIMITY_T23:
365         case MXT_TOUCH_PROXKEY_T52:
366         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
367         case MXT_PROCI_GRIPFACE_T20:
368         case MXT_PROCG_NOISE_T22:
369         case MXT_PROCI_ONETOUCH_T24:
370         case MXT_PROCI_TWOTOUCH_T27:
371         case MXT_PROCI_GRIP_T40:
372         case MXT_PROCI_PALM_T41:
373         case MXT_PROCI_TOUCHSUPPRESSION_T42:
374         case MXT_PROCI_STYLUS_T47:
375         case MXT_PROCG_NOISESUPPRESSION_T48:
376         case MXT_SPT_COMMSCONFIG_T18:
377         case MXT_SPT_GPIOPWM_T19:
378         case MXT_SPT_SELFTEST_T25:
379         case MXT_SPT_CTECONFIG_T28:
380         case MXT_SPT_USERDATA_T38:
381         case MXT_SPT_DIGITIZER_T43:
382         case MXT_SPT_CTECONFIG_T46:
383                 return true;
384         default:
385                 return false;
386         }
387 }
388
389 static void mxt_dump_message(struct mxt_data *data, u8 *message)
390 {
391         dev_dbg(&data->client->dev, "message: %*ph\n",
392                 data->T5_msg_size, message);
393 }
394
395 static int mxt_wait_for_completion(struct mxt_data *data,
396                                    struct completion *comp,
397                                    unsigned int timeout_ms)
398 {
399         struct device *dev = &data->client->dev;
400         unsigned long timeout = msecs_to_jiffies(timeout_ms);
401         long ret;
402
403         ret = wait_for_completion_interruptible_timeout(comp, timeout);
404         if (ret < 0) {
405                 return ret;
406         } else if (ret == 0) {
407                 dev_err(dev, "Wait for completion timed out.\n");
408                 return -ETIMEDOUT;
409         }
410         return 0;
411 }
412
413 static int mxt_bootloader_read(struct mxt_data *data,
414                                u8 *val, unsigned int count)
415 {
416         int ret;
417         struct i2c_msg msg;
418
419         msg.addr = data->bootloader_addr;
420         msg.flags = data->client->flags & I2C_M_TEN;
421         msg.flags |= I2C_M_RD;
422         msg.len = count;
423         msg.buf = val;
424
425         ret = i2c_transfer(data->client->adapter, &msg, 1);
426         if (ret == 1) {
427                 ret = 0;
428         } else {
429                 ret = ret < 0 ? ret : -EIO;
430                 dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
431                         __func__, ret);
432         }
433
434         return ret;
435 }
436
437 static int mxt_bootloader_write(struct mxt_data *data,
438                                 const u8 * const val, unsigned int count)
439 {
440         int ret;
441         struct i2c_msg msg;
442
443         msg.addr = data->bootloader_addr;
444         msg.flags = data->client->flags & I2C_M_TEN;
445         msg.len = count;
446         msg.buf = (u8 *)val;
447
448         ret = i2c_transfer(data->client->adapter, &msg, 1);
449         if (ret == 1) {
450                 ret = 0;
451         } else {
452                 ret = ret < 0 ? ret : -EIO;
453                 dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
454                         __func__, ret);
455         }
456
457         return ret;
458 }
459
460 static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
461 {
462         u8 appmode = data->client->addr;
463         u8 bootloader;
464         u8 family_id = data->info ? data->info->family_id : 0;
465
466         switch (appmode) {
467         case 0x4a:
468         case 0x4b:
469                 /* Chips after 1664S use different scheme */
470                 if (retry || family_id >= 0xa2) {
471                         bootloader = appmode - 0x24;
472                         break;
473                 }
474                 /* Fall through for normal case */
475         case 0x4c:
476         case 0x4d:
477         case 0x5a:
478         case 0x5b:
479                 bootloader = appmode - 0x26;
480                 break;
481
482         default:
483                 dev_err(&data->client->dev,
484                         "Appmode i2c address 0x%02x not found\n",
485                         appmode);
486                 return -EINVAL;
487         }
488
489         data->bootloader_addr = bootloader;
490         return 0;
491 }
492
493 static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
494 {
495         struct device *dev = &data->client->dev;
496         int error;
497         u8 val;
498         bool crc_failure;
499
500         error = mxt_lookup_bootloader_address(data, alt_address);
501         if (error)
502                 return error;
503
504         error = mxt_bootloader_read(data, &val, 1);
505         if (error)
506                 return error;
507
508         /* Check app crc fail mode */
509         crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
510
511         dev_err(dev, "Detected bootloader, status:%02X%s\n",
512                         val, crc_failure ? ", APP_CRC_FAIL" : "");
513
514         return 0;
515 }
516
517 static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
518 {
519         struct device *dev = &data->client->dev;
520         u8 buf[3];
521
522         if (val & MXT_BOOT_EXTENDED_ID) {
523                 if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
524                         dev_err(dev, "%s: i2c failure\n", __func__);
525                         return val;
526                 }
527
528                 dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
529
530                 return buf[0];
531         } else {
532                 dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
533
534                 return val;
535         }
536 }
537
538 static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
539                                 bool wait)
540 {
541         struct device *dev = &data->client->dev;
542         u8 val;
543         int ret;
544
545 recheck:
546         if (wait) {
547                 /*
548                  * In application update mode, the interrupt
549                  * line signals state transitions. We must wait for the
550                  * CHG assertion before reading the status byte.
551                  * Once the status byte has been read, the line is deasserted.
552                  */
553                 ret = mxt_wait_for_completion(data, &data->bl_completion,
554                                               MXT_FW_CHG_TIMEOUT);
555                 if (ret) {
556                         /*
557                          * TODO: handle -ERESTARTSYS better by terminating
558                          * fw update process before returning to userspace
559                          * by writing length 0x000 to device (iff we are in
560                          * WAITING_FRAME_DATA state).
561                          */
562                         dev_err(dev, "Update wait error %d\n", ret);
563                         return ret;
564                 }
565         }
566
567         ret = mxt_bootloader_read(data, &val, 1);
568         if (ret)
569                 return ret;
570
571         if (state == MXT_WAITING_BOOTLOAD_CMD)
572                 val = mxt_get_bootloader_version(data, val);
573
574         switch (state) {
575         case MXT_WAITING_BOOTLOAD_CMD:
576         case MXT_WAITING_FRAME_DATA:
577         case MXT_APP_CRC_FAIL:
578                 val &= ~MXT_BOOT_STATUS_MASK;
579                 break;
580         case MXT_FRAME_CRC_PASS:
581                 if (val == MXT_FRAME_CRC_CHECK) {
582                         goto recheck;
583                 } else if (val == MXT_FRAME_CRC_FAIL) {
584                         dev_err(dev, "Bootloader CRC fail\n");
585                         return -EINVAL;
586                 }
587                 break;
588         default:
589                 return -EINVAL;
590         }
591
592         if (val != state) {
593                 dev_err(dev, "Invalid bootloader state %02X != %02X\n",
594                         val, state);
595                 return -EINVAL;
596         }
597
598         return 0;
599 }
600
601 static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
602 {
603         int ret;
604         u8 buf[2];
605
606         if (unlock) {
607                 buf[0] = MXT_UNLOCK_CMD_LSB;
608                 buf[1] = MXT_UNLOCK_CMD_MSB;
609         } else {
610                 buf[0] = 0x01;
611                 buf[1] = 0x01;
612         }
613
614         ret = mxt_bootloader_write(data, buf, 2);
615         if (ret)
616                 return ret;
617
618         return 0;
619 }
620
621 static int __mxt_read_reg(struct i2c_client *client,
622                                u16 reg, u16 len, void *val)
623 {
624         struct i2c_msg xfer[2];
625         u8 buf[2];
626         int ret;
627
628         buf[0] = reg & 0xff;
629         buf[1] = (reg >> 8) & 0xff;
630
631         /* Write register */
632         xfer[0].addr = client->addr;
633         xfer[0].flags = 0;
634         xfer[0].len = 2;
635         xfer[0].buf = buf;
636
637         /* Read data */
638         xfer[1].addr = client->addr;
639         xfer[1].flags = I2C_M_RD;
640         xfer[1].len = len;
641         xfer[1].buf = val;
642
643         ret = i2c_transfer(client->adapter, xfer, 2);
644         if (ret == 2) {
645                 ret = 0;
646         } else {
647                 if (ret >= 0)
648                         ret = -EIO;
649                 dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
650                         __func__, ret);
651         }
652
653         return ret;
654 }
655
656 static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
657                            const void *val)
658 {
659         u8 *buf;
660         size_t count;
661         int ret;
662
663         count = len + 2;
664         buf = kmalloc(count, GFP_KERNEL);
665         if (!buf)
666                 return -ENOMEM;
667
668         buf[0] = reg & 0xff;
669         buf[1] = (reg >> 8) & 0xff;
670         memcpy(&buf[2], val, len);
671
672         ret = i2c_master_send(client, buf, count);
673         if (ret == count) {
674                 ret = 0;
675         } else {
676                 if (ret >= 0)
677                         ret = -EIO;
678                 dev_err(&client->dev, "%s: i2c send failed (%d)\n",
679                         __func__, ret);
680         }
681
682         kfree(buf);
683         return ret;
684 }
685
686 static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
687 {
688         return __mxt_write_reg(client, reg, 1, &val);
689 }
690
691 static struct mxt_object *
692 mxt_get_object(struct mxt_data *data, u8 type)
693 {
694         struct mxt_object *object;
695         int i;
696
697         for (i = 0; i < data->info->object_num; i++) {
698                 object = data->object_table + i;
699                 if (object->type == type)
700                         return object;
701         }
702
703         dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
704         return NULL;
705 }
706
707 static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
708 {
709         struct device *dev = &data->client->dev;
710         u8 status = msg[1];
711         u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
712
713         complete(&data->crc_completion);
714
715         if (crc != data->config_crc) {
716                 data->config_crc = crc;
717                 dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
718         }
719
720         /* Detect reset */
721         if (status & MXT_T6_STATUS_RESET)
722                 complete(&data->reset_completion);
723
724         /* Output debug if status has changed */
725         if (status != data->t6_status)
726                 dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
727                         status,
728                         status == 0 ? " OK" : "",
729                         status & MXT_T6_STATUS_RESET ? " RESET" : "",
730                         status & MXT_T6_STATUS_OFL ? " OFL" : "",
731                         status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
732                         status & MXT_T6_STATUS_CAL ? " CAL" : "",
733                         status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
734                         status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
735
736         /* Save current status */
737         data->t6_status = status;
738 }
739
740 static int mxt_write_object(struct mxt_data *data,
741                                  u8 type, u8 offset, u8 val)
742 {
743         struct mxt_object *object;
744         u16 reg;
745
746         object = mxt_get_object(data, type);
747         if (!object || offset >= mxt_obj_size(object))
748                 return -EINVAL;
749
750         reg = object->start_address;
751         return mxt_write_reg(data->client, reg + offset, val);
752 }
753
754 static void mxt_input_button(struct mxt_data *data, u8 *message)
755 {
756         struct input_dev *input = data->input_dev;
757         int i;
758
759         for (i = 0; i < data->t19_num_keys; i++) {
760                 if (data->t19_keymap[i] == KEY_RESERVED)
761                         continue;
762
763                 /* Active-low switch */
764                 input_report_key(input, data->t19_keymap[i],
765                                  !(message[1] & BIT(i)));
766         }
767 }
768
769 static void mxt_input_sync(struct mxt_data *data)
770 {
771         input_mt_report_pointer_emulation(data->input_dev,
772                                           data->t19_num_keys);
773         input_sync(data->input_dev);
774 }
775
776 static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
777 {
778         struct device *dev = &data->client->dev;
779         struct input_dev *input_dev = data->input_dev;
780         int id;
781         u8 status;
782         int x;
783         int y;
784         int area;
785         int amplitude;
786
787         id = message[0] - data->T9_reportid_min;
788         status = message[1];
789         x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
790         y = (message[3] << 4) | ((message[4] & 0xf));
791
792         /* Handle 10/12 bit switching */
793         if (data->max_x < 1024)
794                 x >>= 2;
795         if (data->max_y < 1024)
796                 y >>= 2;
797
798         area = message[5];
799         amplitude = message[6];
800
801         dev_dbg(dev,
802                 "[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
803                 id,
804                 (status & MXT_T9_DETECT) ? 'D' : '.',
805                 (status & MXT_T9_PRESS) ? 'P' : '.',
806                 (status & MXT_T9_RELEASE) ? 'R' : '.',
807                 (status & MXT_T9_MOVE) ? 'M' : '.',
808                 (status & MXT_T9_VECTOR) ? 'V' : '.',
809                 (status & MXT_T9_AMP) ? 'A' : '.',
810                 (status & MXT_T9_SUPPRESS) ? 'S' : '.',
811                 (status & MXT_T9_UNGRIP) ? 'U' : '.',
812                 x, y, area, amplitude);
813
814         input_mt_slot(input_dev, id);
815
816         if (status & MXT_T9_DETECT) {
817                 /*
818                  * Multiple bits may be set if the host is slow to read
819                  * the status messages, indicating all the events that
820                  * have happened.
821                  */
822                 if (status & MXT_T9_RELEASE) {
823                         input_mt_report_slot_state(input_dev,
824                                                    MT_TOOL_FINGER, 0);
825                         mxt_input_sync(data);
826                 }
827
828                 /* Touch active */
829                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
830                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
831                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
832                 input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
833                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
834         } else {
835                 /* Touch no longer active, close out slot */
836                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 0);
837         }
838
839         data->update_input = true;
840 }
841
842 static void mxt_proc_t100_message(struct mxt_data *data, u8 *message)
843 {
844         struct device *dev = &data->client->dev;
845         struct input_dev *input_dev = data->input_dev;
846         int id;
847         u8 status;
848         u8 type = 0;
849         u16 x;
850         u16 y;
851         int distance = 0;
852         int tool = 0;
853         u8 major = 0;
854         u8 pressure = 0;
855         u8 orientation = 0;
856
857         id = message[0] - data->T100_reportid_min - 2;
858
859         /* ignore SCRSTATUS events */
860         if (id < 0)
861                 return;
862
863         status = message[1];
864         x = get_unaligned_le16(&message[2]);
865         y = get_unaligned_le16(&message[4]);
866
867         if (status & MXT_T100_DETECT) {
868                 type = (status & MXT_T100_TYPE_MASK) >> 4;
869
870                 switch (type) {
871                 case MXT_T100_TYPE_HOVERING_FINGER:
872                         tool = MT_TOOL_FINGER;
873                         distance = MXT_DISTANCE_HOVERING;
874
875                         if (data->t100_aux_vect)
876                                 orientation = message[data->t100_aux_vect];
877
878                         break;
879
880                 case MXT_T100_TYPE_FINGER:
881                 case MXT_T100_TYPE_GLOVE:
882                         tool = MT_TOOL_FINGER;
883                         distance = MXT_DISTANCE_ACTIVE_TOUCH;
884
885                         if (data->t100_aux_area)
886                                 major = message[data->t100_aux_area];
887
888                         if (data->t100_aux_ampl)
889                                 pressure = message[data->t100_aux_ampl];
890
891                         if (data->t100_aux_vect)
892                                 orientation = message[data->t100_aux_vect];
893
894                         break;
895
896                 case MXT_T100_TYPE_PASSIVE_STYLUS:
897                         tool = MT_TOOL_PEN;
898
899                         /*
900                          * Passive stylus is reported with size zero so
901                          * hardcode.
902                          */
903                         major = MXT_TOUCH_MAJOR_DEFAULT;
904
905                         if (data->t100_aux_ampl)
906                                 pressure = message[data->t100_aux_ampl];
907
908                         break;
909
910                 case MXT_T100_TYPE_LARGE_TOUCH:
911                         /* Ignore suppressed touch */
912                         break;
913
914                 default:
915                         dev_dbg(dev, "Unexpected T100 type\n");
916                         return;
917                 }
918         }
919
920         /*
921          * Values reported should be non-zero if tool is touching the
922          * device
923          */
924         if (!pressure && type != MXT_T100_TYPE_HOVERING_FINGER)
925                 pressure = MXT_PRESSURE_DEFAULT;
926
927         input_mt_slot(input_dev, id);
928
929         if (status & MXT_T100_DETECT) {
930                 dev_dbg(dev, "[%u] type:%u x:%u y:%u a:%02X p:%02X v:%02X\n",
931                         id, type, x, y, major, pressure, orientation);
932
933                 input_mt_report_slot_state(input_dev, tool, 1);
934                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
935                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
936                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, major);
937                 input_report_abs(input_dev, ABS_MT_PRESSURE, pressure);
938                 input_report_abs(input_dev, ABS_MT_DISTANCE, distance);
939                 input_report_abs(input_dev, ABS_MT_ORIENTATION, orientation);
940         } else {
941                 dev_dbg(dev, "[%u] release\n", id);
942
943                 /* close out slot */
944                 input_mt_report_slot_state(input_dev, 0, 0);
945         }
946
947         data->update_input = true;
948 }
949
950 static int mxt_proc_message(struct mxt_data *data, u8 *message)
951 {
952         u8 report_id = message[0];
953
954         if (report_id == MXT_RPTID_NOMSG)
955                 return 0;
956
957         if (report_id == data->T6_reportid) {
958                 mxt_proc_t6_messages(data, message);
959         } else if (!data->input_dev) {
960                 /*
961                  * Do not report events if input device
962                  * is not yet registered.
963                  */
964                 mxt_dump_message(data, message);
965         } else if (report_id >= data->T9_reportid_min &&
966                    report_id <= data->T9_reportid_max) {
967                 mxt_proc_t9_message(data, message);
968         } else if (report_id >= data->T100_reportid_min &&
969                    report_id <= data->T100_reportid_max) {
970                 mxt_proc_t100_message(data, message);
971         } else if (report_id == data->T19_reportid) {
972                 mxt_input_button(data, message);
973                 data->update_input = true;
974         } else {
975                 mxt_dump_message(data, message);
976         }
977
978         return 1;
979 }
980
981 static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
982 {
983         struct device *dev = &data->client->dev;
984         int ret;
985         int i;
986         u8 num_valid = 0;
987
988         /* Safety check for msg_buf */
989         if (count > data->max_reportid)
990                 return -EINVAL;
991
992         /* Process remaining messages if necessary */
993         ret = __mxt_read_reg(data->client, data->T5_address,
994                                 data->T5_msg_size * count, data->msg_buf);
995         if (ret) {
996                 dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
997                 return ret;
998         }
999
1000         for (i = 0;  i < count; i++) {
1001                 ret = mxt_proc_message(data,
1002                         data->msg_buf + data->T5_msg_size * i);
1003
1004                 if (ret == 1)
1005                         num_valid++;
1006         }
1007
1008         /* return number of messages read */
1009         return num_valid;
1010 }
1011
1012 static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
1013 {
1014         struct device *dev = &data->client->dev;
1015         int ret;
1016         u8 count, num_left;
1017
1018         /* Read T44 and T5 together */
1019         ret = __mxt_read_reg(data->client, data->T44_address,
1020                 data->T5_msg_size + 1, data->msg_buf);
1021         if (ret) {
1022                 dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
1023                 return IRQ_NONE;
1024         }
1025
1026         count = data->msg_buf[0];
1027
1028         /*
1029          * This condition may be caused by the CHG line being configured in
1030          * Mode 0. It results in unnecessary I2C operations but it is benign.
1031          */
1032         if (count == 0)
1033                 return IRQ_NONE;
1034
1035         if (count > data->max_reportid) {
1036                 dev_warn(dev, "T44 count %d exceeded max report id\n", count);
1037                 count = data->max_reportid;
1038         }
1039
1040         /* Process first message */
1041         ret = mxt_proc_message(data, data->msg_buf + 1);
1042         if (ret < 0) {
1043                 dev_warn(dev, "Unexpected invalid message\n");
1044                 return IRQ_NONE;
1045         }
1046
1047         num_left = count - 1;
1048
1049         /* Process remaining messages if necessary */
1050         if (num_left) {
1051                 ret = mxt_read_and_process_messages(data, num_left);
1052                 if (ret < 0)
1053                         goto end;
1054                 else if (ret != num_left)
1055                         dev_warn(dev, "Unexpected invalid message\n");
1056         }
1057
1058 end:
1059         if (data->update_input) {
1060                 mxt_input_sync(data);
1061                 data->update_input = false;
1062         }
1063
1064         return IRQ_HANDLED;
1065 }
1066
1067 static int mxt_process_messages_until_invalid(struct mxt_data *data)
1068 {
1069         struct device *dev = &data->client->dev;
1070         int count, read;
1071         u8 tries = 2;
1072
1073         count = data->max_reportid;
1074
1075         /* Read messages until we force an invalid */
1076         do {
1077                 read = mxt_read_and_process_messages(data, count);
1078                 if (read < count)
1079                         return 0;
1080         } while (--tries);
1081
1082         if (data->update_input) {
1083                 mxt_input_sync(data);
1084                 data->update_input = false;
1085         }
1086
1087         dev_err(dev, "CHG pin isn't cleared\n");
1088         return -EBUSY;
1089 }
1090
1091 static irqreturn_t mxt_process_messages(struct mxt_data *data)
1092 {
1093         int total_handled, num_handled;
1094         u8 count = data->last_message_count;
1095
1096         if (count < 1 || count > data->max_reportid)
1097                 count = 1;
1098
1099         /* include final invalid message */
1100         total_handled = mxt_read_and_process_messages(data, count + 1);
1101         if (total_handled < 0)
1102                 return IRQ_NONE;
1103         /* if there were invalid messages, then we are done */
1104         else if (total_handled <= count)
1105                 goto update_count;
1106
1107         /* keep reading two msgs until one is invalid or reportid limit */
1108         do {
1109                 num_handled = mxt_read_and_process_messages(data, 2);
1110                 if (num_handled < 0)
1111                         return IRQ_NONE;
1112
1113                 total_handled += num_handled;
1114
1115                 if (num_handled < 2)
1116                         break;
1117         } while (total_handled < data->num_touchids);
1118
1119 update_count:
1120         data->last_message_count = total_handled;
1121
1122         if (data->update_input) {
1123                 mxt_input_sync(data);
1124                 data->update_input = false;
1125         }
1126
1127         return IRQ_HANDLED;
1128 }
1129
1130 static irqreturn_t mxt_interrupt(int irq, void *dev_id)
1131 {
1132         struct mxt_data *data = dev_id;
1133
1134         if (data->in_bootloader) {
1135                 /* bootloader state transition completion */
1136                 complete(&data->bl_completion);
1137                 return IRQ_HANDLED;
1138         }
1139
1140         if (!data->object_table)
1141                 return IRQ_HANDLED;
1142
1143         if (data->T44_address) {
1144                 return mxt_process_messages_t44(data);
1145         } else {
1146                 return mxt_process_messages(data);
1147         }
1148 }
1149
1150 static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
1151                           u8 value, bool wait)
1152 {
1153         u16 reg;
1154         u8 command_register;
1155         int timeout_counter = 0;
1156         int ret;
1157
1158         reg = data->T6_address + cmd_offset;
1159
1160         ret = mxt_write_reg(data->client, reg, value);
1161         if (ret)
1162                 return ret;
1163
1164         if (!wait)
1165                 return 0;
1166
1167         do {
1168                 msleep(20);
1169                 ret = __mxt_read_reg(data->client, reg, 1, &command_register);
1170                 if (ret)
1171                         return ret;
1172         } while (command_register != 0 && timeout_counter++ <= 100);
1173
1174         if (timeout_counter > 100) {
1175                 dev_err(&data->client->dev, "Command failed!\n");
1176                 return -EIO;
1177         }
1178
1179         return 0;
1180 }
1181
1182 static int mxt_acquire_irq(struct mxt_data *data)
1183 {
1184         int error;
1185
1186         enable_irq(data->irq);
1187
1188         error = mxt_process_messages_until_invalid(data);
1189         if (error)
1190                 return error;
1191
1192         return 0;
1193 }
1194
1195 static int mxt_soft_reset(struct mxt_data *data)
1196 {
1197         struct device *dev = &data->client->dev;
1198         int ret = 0;
1199
1200         dev_info(dev, "Resetting device\n");
1201
1202         disable_irq(data->irq);
1203
1204         reinit_completion(&data->reset_completion);
1205
1206         ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1207         if (ret)
1208                 return ret;
1209
1210         /* Ignore CHG line for 100ms after reset */
1211         msleep(100);
1212
1213         mxt_acquire_irq(data);
1214
1215         ret = mxt_wait_for_completion(data, &data->reset_completion,
1216                                       MXT_RESET_TIMEOUT);
1217         if (ret)
1218                 return ret;
1219
1220         return 0;
1221 }
1222
1223 static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1224 {
1225         /*
1226          * On failure, CRC is set to 0 and config will always be
1227          * downloaded.
1228          */
1229         data->config_crc = 0;
1230         reinit_completion(&data->crc_completion);
1231
1232         mxt_t6_command(data, cmd, value, true);
1233
1234         /*
1235          * Wait for crc message. On failure, CRC is set to 0 and config will
1236          * always be downloaded.
1237          */
1238         mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1239 }
1240
1241 static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1242 {
1243         static const unsigned int crcpoly = 0x80001B;
1244         u32 result;
1245         u32 data_word;
1246
1247         data_word = (secondbyte << 8) | firstbyte;
1248         result = ((*crc << 1) ^ data_word);
1249
1250         if (result & 0x1000000)
1251                 result ^= crcpoly;
1252
1253         *crc = result;
1254 }
1255
1256 static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1257 {
1258         u32 crc = 0;
1259         u8 *ptr = base + start_off;
1260         u8 *last_val = base + end_off - 1;
1261
1262         if (end_off < start_off)
1263                 return -EINVAL;
1264
1265         while (ptr < last_val) {
1266                 mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1267                 ptr += 2;
1268         }
1269
1270         /* if len is odd, fill the last byte with 0 */
1271         if (ptr == last_val)
1272                 mxt_calc_crc24(&crc, *ptr, 0);
1273
1274         /* Mask to 24-bit */
1275         crc &= 0x00FFFFFF;
1276
1277         return crc;
1278 }
1279
1280 static int mxt_prepare_cfg_mem(struct mxt_data *data,
1281                                const struct firmware *cfg,
1282                                unsigned int data_pos,
1283                                unsigned int cfg_start_ofs,
1284                                u8 *config_mem,
1285                                size_t config_mem_size)
1286 {
1287         struct device *dev = &data->client->dev;
1288         struct mxt_object *object;
1289         unsigned int type, instance, size, byte_offset;
1290         int offset;
1291         int ret;
1292         int i;
1293         u16 reg;
1294         u8 val;
1295
1296         while (data_pos < cfg->size) {
1297                 /* Read type, instance, length */
1298                 ret = sscanf(cfg->data + data_pos, "%x %x %x%n",
1299                              &type, &instance, &size, &offset);
1300                 if (ret == 0) {
1301                         /* EOF */
1302                         break;
1303                 } else if (ret != 3) {
1304                         dev_err(dev, "Bad format: failed to parse object\n");
1305                         return -EINVAL;
1306                 }
1307                 data_pos += offset;
1308
1309                 object = mxt_get_object(data, type);
1310                 if (!object) {
1311                         /* Skip object */
1312                         for (i = 0; i < size; i++) {
1313                                 ret = sscanf(cfg->data + data_pos, "%hhx%n",
1314                                              &val, &offset);
1315                                 if (ret != 1) {
1316                                         dev_err(dev, "Bad format in T%d at %d\n",
1317                                                 type, i);
1318                                         return -EINVAL;
1319                                 }
1320                                 data_pos += offset;
1321                         }
1322                         continue;
1323                 }
1324
1325                 if (size > mxt_obj_size(object)) {
1326                         /*
1327                          * Either we are in fallback mode due to wrong
1328                          * config or config from a later fw version,
1329                          * or the file is corrupt or hand-edited.
1330                          */
1331                         dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1332                                  size - mxt_obj_size(object), type);
1333                 } else if (mxt_obj_size(object) > size) {
1334                         /*
1335                          * If firmware is upgraded, new bytes may be added to
1336                          * end of objects. It is generally forward compatible
1337                          * to zero these bytes - previous behaviour will be
1338                          * retained. However this does invalidate the CRC and
1339                          * will force fallback mode until the configuration is
1340                          * updated. We warn here but do nothing else - the
1341                          * malloc has zeroed the entire configuration.
1342                          */
1343                         dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1344                                  mxt_obj_size(object) - size, type);
1345                 }
1346
1347                 if (instance >= mxt_obj_instances(object)) {
1348                         dev_err(dev, "Object instances exceeded!\n");
1349                         return -EINVAL;
1350                 }
1351
1352                 reg = object->start_address + mxt_obj_size(object) * instance;
1353
1354                 for (i = 0; i < size; i++) {
1355                         ret = sscanf(cfg->data + data_pos, "%hhx%n",
1356                                      &val,
1357                                      &offset);
1358                         if (ret != 1) {
1359                                 dev_err(dev, "Bad format in T%d at %d\n",
1360                                         type, i);
1361                                 return -EINVAL;
1362                         }
1363                         data_pos += offset;
1364
1365                         if (i > mxt_obj_size(object))
1366                                 continue;
1367
1368                         byte_offset = reg + i - cfg_start_ofs;
1369
1370                         if (byte_offset >= 0 && byte_offset < config_mem_size) {
1371                                 *(config_mem + byte_offset) = val;
1372                         } else {
1373                                 dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1374                                         reg, object->type, byte_offset);
1375                                 return -EINVAL;
1376                         }
1377                 }
1378         }
1379
1380         return 0;
1381 }
1382
1383 static int mxt_upload_cfg_mem(struct mxt_data *data, unsigned int cfg_start,
1384                               u8 *config_mem, size_t config_mem_size)
1385 {
1386         unsigned int byte_offset = 0;
1387         int error;
1388
1389         /* Write configuration as blocks */
1390         while (byte_offset < config_mem_size) {
1391                 unsigned int size = config_mem_size - byte_offset;
1392
1393                 if (size > MXT_MAX_BLOCK_WRITE)
1394                         size = MXT_MAX_BLOCK_WRITE;
1395
1396                 error = __mxt_write_reg(data->client,
1397                                         cfg_start + byte_offset,
1398                                         size, config_mem + byte_offset);
1399                 if (error) {
1400                         dev_err(&data->client->dev,
1401                                 "Config write error, ret=%d\n", error);
1402                         return error;
1403                 }
1404
1405                 byte_offset += size;
1406         }
1407
1408         return 0;
1409 }
1410
1411 static int mxt_init_t7_power_cfg(struct mxt_data *data);
1412
1413 /*
1414  * mxt_update_cfg - download configuration to chip
1415  *
1416  * Atmel Raw Config File Format
1417  *
1418  * The first four lines of the raw config file contain:
1419  *  1) Version
1420  *  2) Chip ID Information (first 7 bytes of device memory)
1421  *  3) Chip Information Block 24-bit CRC Checksum
1422  *  4) Chip Configuration 24-bit CRC Checksum
1423  *
1424  * The rest of the file consists of one line per object instance:
1425  *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1426  *
1427  *   <TYPE> - 2-byte object type as hex
1428  *   <INSTANCE> - 2-byte object instance number as hex
1429  *   <SIZE> - 2-byte object size as hex
1430  *   <CONTENTS> - array of <SIZE> 1-byte hex values
1431  */
1432 static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
1433 {
1434         struct device *dev = &data->client->dev;
1435         struct mxt_info cfg_info;
1436         int ret;
1437         int offset;
1438         int data_pos;
1439         int i;
1440         int cfg_start_ofs;
1441         u32 info_crc, config_crc, calculated_crc;
1442         u8 *config_mem;
1443         size_t config_mem_size;
1444
1445         mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1446
1447         if (strncmp(cfg->data, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1448                 dev_err(dev, "Unrecognised config file\n");
1449                 return -EINVAL;
1450         }
1451
1452         data_pos = strlen(MXT_CFG_MAGIC);
1453
1454         /* Load information block and check */
1455         for (i = 0; i < sizeof(struct mxt_info); i++) {
1456                 ret = sscanf(cfg->data + data_pos, "%hhx%n",
1457                              (unsigned char *)&cfg_info + i,
1458                              &offset);
1459                 if (ret != 1) {
1460                         dev_err(dev, "Bad format\n");
1461                         return -EINVAL;
1462                 }
1463
1464                 data_pos += offset;
1465         }
1466
1467         if (cfg_info.family_id != data->info->family_id) {
1468                 dev_err(dev, "Family ID mismatch!\n");
1469                 return -EINVAL;
1470         }
1471
1472         if (cfg_info.variant_id != data->info->variant_id) {
1473                 dev_err(dev, "Variant ID mismatch!\n");
1474                 return -EINVAL;
1475         }
1476
1477         /* Read CRCs */
1478         ret = sscanf(cfg->data + data_pos, "%x%n", &info_crc, &offset);
1479         if (ret != 1) {
1480                 dev_err(dev, "Bad format: failed to parse Info CRC\n");
1481                 return -EINVAL;
1482         }
1483         data_pos += offset;
1484
1485         ret = sscanf(cfg->data + data_pos, "%x%n", &config_crc, &offset);
1486         if (ret != 1) {
1487                 dev_err(dev, "Bad format: failed to parse Config CRC\n");
1488                 return -EINVAL;
1489         }
1490         data_pos += offset;
1491
1492         /*
1493          * The Info Block CRC is calculated over mxt_info and the object
1494          * table. If it does not match then we are trying to load the
1495          * configuration from a different chip or firmware version, so
1496          * the configuration CRC is invalid anyway.
1497          */
1498         if (info_crc == data->info_crc) {
1499                 if (config_crc == 0 || data->config_crc == 0) {
1500                         dev_info(dev, "CRC zero, attempting to apply config\n");
1501                 } else if (config_crc == data->config_crc) {
1502                         dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1503                                  data->config_crc);
1504                         return 0;
1505                 } else {
1506                         dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1507                                  data->config_crc, config_crc);
1508                 }
1509         } else {
1510                 dev_warn(dev,
1511                          "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1512                          data->info_crc, info_crc);
1513         }
1514
1515         /* Malloc memory to store configuration */
1516         cfg_start_ofs = MXT_OBJECT_START +
1517                         data->info->object_num * sizeof(struct mxt_object) +
1518                         MXT_INFO_CHECKSUM_SIZE;
1519         config_mem_size = data->mem_size - cfg_start_ofs;
1520         config_mem = kzalloc(config_mem_size, GFP_KERNEL);
1521         if (!config_mem) {
1522                 dev_err(dev, "Failed to allocate memory\n");
1523                 return -ENOMEM;
1524         }
1525
1526         ret = mxt_prepare_cfg_mem(data, cfg, data_pos, cfg_start_ofs,
1527                                   config_mem, config_mem_size);
1528         if (ret)
1529                 goto release_mem;
1530
1531         /* Calculate crc of the received configs (not the raw config file) */
1532         if (data->T7_address < cfg_start_ofs) {
1533                 dev_err(dev, "Bad T7 address, T7addr = %x, config offset %x\n",
1534                         data->T7_address, cfg_start_ofs);
1535                 ret = 0;
1536                 goto release_mem;
1537         }
1538
1539         calculated_crc = mxt_calculate_crc(config_mem,
1540                                            data->T7_address - cfg_start_ofs,
1541                                            config_mem_size);
1542
1543         if (config_crc > 0 && config_crc != calculated_crc)
1544                 dev_warn(dev, "Config CRC error, calculated=%06X, file=%06X\n",
1545                          calculated_crc, config_crc);
1546
1547         ret = mxt_upload_cfg_mem(data, cfg_start_ofs,
1548                                  config_mem, config_mem_size);
1549         if (ret)
1550                 goto release_mem;
1551
1552         mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1553
1554         ret = mxt_soft_reset(data);
1555         if (ret)
1556                 goto release_mem;
1557
1558         dev_info(dev, "Config successfully updated\n");
1559
1560         /* T7 config may have changed */
1561         mxt_init_t7_power_cfg(data);
1562
1563 release_mem:
1564         kfree(config_mem);
1565         return ret;
1566 }
1567
1568 static void mxt_free_input_device(struct mxt_data *data)
1569 {
1570         if (data->input_dev) {
1571                 input_unregister_device(data->input_dev);
1572                 data->input_dev = NULL;
1573         }
1574 }
1575
1576 static void mxt_free_object_table(struct mxt_data *data)
1577 {
1578 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
1579         video_unregister_device(&data->dbg.vdev);
1580         v4l2_device_unregister(&data->dbg.v4l2);
1581 #endif
1582         data->object_table = NULL;
1583         data->info = NULL;
1584         kfree(data->raw_info_block);
1585         data->raw_info_block = NULL;
1586         kfree(data->msg_buf);
1587         data->msg_buf = NULL;
1588         data->T5_address = 0;
1589         data->T5_msg_size = 0;
1590         data->T6_reportid = 0;
1591         data->T7_address = 0;
1592         data->T9_reportid_min = 0;
1593         data->T9_reportid_max = 0;
1594         data->T19_reportid = 0;
1595         data->T44_address = 0;
1596         data->T100_reportid_min = 0;
1597         data->T100_reportid_max = 0;
1598         data->max_reportid = 0;
1599 }
1600
1601 static int mxt_parse_object_table(struct mxt_data *data,
1602                                   struct mxt_object *object_table)
1603 {
1604         struct i2c_client *client = data->client;
1605         int i;
1606         u8 reportid;
1607         u16 end_address;
1608
1609         /* Valid Report IDs start counting from 1 */
1610         reportid = 1;
1611         data->mem_size = 0;
1612         for (i = 0; i < data->info->object_num; i++) {
1613                 struct mxt_object *object = object_table + i;
1614                 u8 min_id, max_id;
1615
1616                 le16_to_cpus(&object->start_address);
1617
1618                 if (object->num_report_ids) {
1619                         min_id = reportid;
1620                         reportid += object->num_report_ids *
1621                                         mxt_obj_instances(object);
1622                         max_id = reportid - 1;
1623                 } else {
1624                         min_id = 0;
1625                         max_id = 0;
1626                 }
1627
1628                 dev_dbg(&data->client->dev,
1629                         "T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1630                         object->type, object->start_address,
1631                         mxt_obj_size(object), mxt_obj_instances(object),
1632                         min_id, max_id);
1633
1634                 switch (object->type) {
1635                 case MXT_GEN_MESSAGE_T5:
1636                         if (data->info->family_id == 0x80 &&
1637                             data->info->version < 0x20) {
1638                                 /*
1639                                  * On mXT224 firmware versions prior to V2.0
1640                                  * read and discard unused CRC byte otherwise
1641                                  * DMA reads are misaligned.
1642                                  */
1643                                 data->T5_msg_size = mxt_obj_size(object);
1644                         } else {
1645                                 /* CRC not enabled, so skip last byte */
1646                                 data->T5_msg_size = mxt_obj_size(object) - 1;
1647                         }
1648                         data->T5_address = object->start_address;
1649                         break;
1650                 case MXT_GEN_COMMAND_T6:
1651                         data->T6_reportid = min_id;
1652                         data->T6_address = object->start_address;
1653                         break;
1654                 case MXT_GEN_POWER_T7:
1655                         data->T7_address = object->start_address;
1656                         break;
1657                 case MXT_TOUCH_MULTI_T9:
1658                         data->multitouch = MXT_TOUCH_MULTI_T9;
1659                         data->T9_reportid_min = min_id;
1660                         data->T9_reportid_max = max_id;
1661                         data->num_touchids = object->num_report_ids
1662                                                 * mxt_obj_instances(object);
1663                         break;
1664                 case MXT_SPT_MESSAGECOUNT_T44:
1665                         data->T44_address = object->start_address;
1666                         break;
1667                 case MXT_SPT_GPIOPWM_T19:
1668                         data->T19_reportid = min_id;
1669                         break;
1670                 case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1671                         data->multitouch = MXT_TOUCH_MULTITOUCHSCREEN_T100;
1672                         data->T100_reportid_min = min_id;
1673                         data->T100_reportid_max = max_id;
1674                         /* first two report IDs reserved */
1675                         data->num_touchids = object->num_report_ids - 2;
1676                         break;
1677                 }
1678
1679                 end_address = object->start_address
1680                         + mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1681
1682                 if (end_address >= data->mem_size)
1683                         data->mem_size = end_address + 1;
1684         }
1685
1686         /* Store maximum reportid */
1687         data->max_reportid = reportid;
1688
1689         /* If T44 exists, T5 position has to be directly after */
1690         if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1691                 dev_err(&client->dev, "Invalid T44 position\n");
1692                 return -EINVAL;
1693         }
1694
1695         data->msg_buf = kcalloc(data->max_reportid,
1696                                 data->T5_msg_size, GFP_KERNEL);
1697         if (!data->msg_buf)
1698                 return -ENOMEM;
1699
1700         return 0;
1701 }
1702
1703 static int mxt_read_info_block(struct mxt_data *data)
1704 {
1705         struct i2c_client *client = data->client;
1706         int error;
1707         size_t size;
1708         void *id_buf, *buf;
1709         uint8_t num_objects;
1710         u32 calculated_crc;
1711         u8 *crc_ptr;
1712
1713         /* If info block already allocated, free it */
1714         if (data->raw_info_block)
1715                 mxt_free_object_table(data);
1716
1717         /* Read 7-byte ID information block starting at address 0 */
1718         size = sizeof(struct mxt_info);
1719         id_buf = kzalloc(size, GFP_KERNEL);
1720         if (!id_buf)
1721                 return -ENOMEM;
1722
1723         error = __mxt_read_reg(client, 0, size, id_buf);
1724         if (error)
1725                 goto err_free_mem;
1726
1727         /* Resize buffer to give space for rest of info block */
1728         num_objects = ((struct mxt_info *)id_buf)->object_num;
1729         size += (num_objects * sizeof(struct mxt_object))
1730                 + MXT_INFO_CHECKSUM_SIZE;
1731
1732         buf = krealloc(id_buf, size, GFP_KERNEL);
1733         if (!buf) {
1734                 error = -ENOMEM;
1735                 goto err_free_mem;
1736         }
1737         id_buf = buf;
1738
1739         /* Read rest of info block */
1740         error = __mxt_read_reg(client, MXT_OBJECT_START,
1741                                size - MXT_OBJECT_START,
1742                                id_buf + MXT_OBJECT_START);
1743         if (error)
1744                 goto err_free_mem;
1745
1746         /* Extract & calculate checksum */
1747         crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
1748         data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
1749
1750         calculated_crc = mxt_calculate_crc(id_buf, 0,
1751                                            size - MXT_INFO_CHECKSUM_SIZE);
1752
1753         /*
1754          * CRC mismatch can be caused by data corruption due to I2C comms
1755          * issue or else device is not using Object Based Protocol (eg i2c-hid)
1756          */
1757         if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
1758                 dev_err(&client->dev,
1759                         "Info Block CRC error calculated=0x%06X read=0x%06X\n",
1760                         calculated_crc, data->info_crc);
1761                 error = -EIO;
1762                 goto err_free_mem;
1763         }
1764
1765         data->raw_info_block = id_buf;
1766         data->info = (struct mxt_info *)id_buf;
1767
1768         dev_info(&client->dev,
1769                  "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
1770                  data->info->family_id, data->info->variant_id,
1771                  data->info->version >> 4, data->info->version & 0xf,
1772                  data->info->build, data->info->object_num);
1773
1774         /* Parse object table information */
1775         error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
1776         if (error) {
1777                 dev_err(&client->dev, "Error %d parsing object table\n", error);
1778                 mxt_free_object_table(data);
1779                 goto err_free_mem;
1780         }
1781
1782         data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
1783
1784         return 0;
1785
1786 err_free_mem:
1787         kfree(id_buf);
1788         return error;
1789 }
1790
1791 static int mxt_read_t9_resolution(struct mxt_data *data)
1792 {
1793         struct i2c_client *client = data->client;
1794         int error;
1795         struct t9_range range;
1796         unsigned char orient;
1797         struct mxt_object *object;
1798
1799         object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1800         if (!object)
1801                 return -EINVAL;
1802
1803         error = __mxt_read_reg(client,
1804                                object->start_address + MXT_T9_XSIZE,
1805                                sizeof(data->xsize), &data->xsize);
1806         if (error)
1807                 return error;
1808
1809         error = __mxt_read_reg(client,
1810                                object->start_address + MXT_T9_YSIZE,
1811                                sizeof(data->ysize), &data->ysize);
1812         if (error)
1813                 return error;
1814
1815         error = __mxt_read_reg(client,
1816                                object->start_address + MXT_T9_RANGE,
1817                                sizeof(range), &range);
1818         if (error)
1819                 return error;
1820
1821         data->max_x = get_unaligned_le16(&range.x);
1822         data->max_y = get_unaligned_le16(&range.y);
1823
1824         error =  __mxt_read_reg(client,
1825                                 object->start_address + MXT_T9_ORIENT,
1826                                 1, &orient);
1827         if (error)
1828                 return error;
1829
1830         data->xy_switch = orient & MXT_T9_ORIENT_SWITCH;
1831         data->invertx = orient & MXT_T9_ORIENT_INVERTX;
1832         data->inverty = orient & MXT_T9_ORIENT_INVERTY;
1833
1834         return 0;
1835 }
1836
1837 static int mxt_read_t100_config(struct mxt_data *data)
1838 {
1839         struct i2c_client *client = data->client;
1840         int error;
1841         struct mxt_object *object;
1842         u16 range_x, range_y;
1843         u8 cfg, tchaux;
1844         u8 aux;
1845
1846         object = mxt_get_object(data, MXT_TOUCH_MULTITOUCHSCREEN_T100);
1847         if (!object)
1848                 return -EINVAL;
1849
1850         /* read touchscreen dimensions */
1851         error = __mxt_read_reg(client,
1852                                object->start_address + MXT_T100_XRANGE,
1853                                sizeof(range_x), &range_x);
1854         if (error)
1855                 return error;
1856
1857         data->max_x = get_unaligned_le16(&range_x);
1858
1859         error = __mxt_read_reg(client,
1860                                object->start_address + MXT_T100_YRANGE,
1861                                sizeof(range_y), &range_y);
1862         if (error)
1863                 return error;
1864
1865         data->max_y = get_unaligned_le16(&range_y);
1866
1867         error = __mxt_read_reg(client,
1868                                object->start_address + MXT_T100_XSIZE,
1869                                sizeof(data->xsize), &data->xsize);
1870         if (error)
1871                 return error;
1872
1873         error = __mxt_read_reg(client,
1874                                object->start_address + MXT_T100_YSIZE,
1875                                sizeof(data->ysize), &data->ysize);
1876         if (error)
1877                 return error;
1878
1879         /* read orientation config */
1880         error =  __mxt_read_reg(client,
1881                                 object->start_address + MXT_T100_CFG1,
1882                                 1, &cfg);
1883         if (error)
1884                 return error;
1885
1886         data->xy_switch = cfg & MXT_T100_CFG_SWITCHXY;
1887         data->invertx = cfg & MXT_T100_CFG_INVERTX;
1888         data->inverty = cfg & MXT_T100_CFG_INVERTY;
1889
1890         /* allocate aux bytes */
1891         error =  __mxt_read_reg(client,
1892                                 object->start_address + MXT_T100_TCHAUX,
1893                                 1, &tchaux);
1894         if (error)
1895                 return error;
1896
1897         aux = 6;
1898
1899         if (tchaux & MXT_T100_TCHAUX_VECT)
1900                 data->t100_aux_vect = aux++;
1901
1902         if (tchaux & MXT_T100_TCHAUX_AMPL)
1903                 data->t100_aux_ampl = aux++;
1904
1905         if (tchaux & MXT_T100_TCHAUX_AREA)
1906                 data->t100_aux_area = aux++;
1907
1908         dev_dbg(&client->dev,
1909                 "T100 aux mappings vect:%u ampl:%u area:%u\n",
1910                 data->t100_aux_vect, data->t100_aux_ampl, data->t100_aux_area);
1911
1912         return 0;
1913 }
1914
1915 static int mxt_input_open(struct input_dev *dev);
1916 static void mxt_input_close(struct input_dev *dev);
1917
1918 static void mxt_set_up_as_touchpad(struct input_dev *input_dev,
1919                                    struct mxt_data *data)
1920 {
1921         int i;
1922
1923         input_dev->name = "Atmel maXTouch Touchpad";
1924
1925         __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1926
1927         input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1928         input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1929         input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1930                           MXT_PIXELS_PER_MM);
1931         input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1932                           MXT_PIXELS_PER_MM);
1933
1934         for (i = 0; i < data->t19_num_keys; i++)
1935                 if (data->t19_keymap[i] != KEY_RESERVED)
1936                         input_set_capability(input_dev, EV_KEY,
1937                                              data->t19_keymap[i]);
1938 }
1939
1940 static int mxt_initialize_input_device(struct mxt_data *data)
1941 {
1942         struct device *dev = &data->client->dev;
1943         struct input_dev *input_dev;
1944         int error;
1945         unsigned int num_mt_slots;
1946         unsigned int mt_flags = 0;
1947
1948         switch (data->multitouch) {
1949         case MXT_TOUCH_MULTI_T9:
1950                 num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
1951                 error = mxt_read_t9_resolution(data);
1952                 if (error)
1953                         dev_warn(dev, "Failed to initialize T9 resolution\n");
1954                 break;
1955
1956         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1957                 num_mt_slots = data->num_touchids;
1958                 error = mxt_read_t100_config(data);
1959                 if (error)
1960                         dev_warn(dev, "Failed to read T100 config\n");
1961                 break;
1962
1963         default:
1964                 dev_err(dev, "Invalid multitouch object\n");
1965                 return -EINVAL;
1966         }
1967
1968         /* Handle default values and orientation switch */
1969         if (data->max_x == 0)
1970                 data->max_x = 1023;
1971
1972         if (data->max_y == 0)
1973                 data->max_y = 1023;
1974
1975         if (data->xy_switch)
1976                 swap(data->max_x, data->max_y);
1977
1978         dev_info(dev, "Touchscreen size X%uY%u\n", data->max_x, data->max_y);
1979
1980         /* Register input device */
1981         input_dev = input_allocate_device();
1982         if (!input_dev) {
1983                 dev_err(dev, "Failed to allocate memory\n");
1984                 return -ENOMEM;
1985         }
1986
1987         input_dev->name = "Atmel maXTouch Touchscreen";
1988         input_dev->phys = data->phys;
1989         input_dev->id.bustype = BUS_I2C;
1990         input_dev->dev.parent = dev;
1991         input_dev->open = mxt_input_open;
1992         input_dev->close = mxt_input_close;
1993
1994         input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
1995
1996         /* For single touch */
1997         input_set_abs_params(input_dev, ABS_X, 0, data->max_x, 0, 0);
1998         input_set_abs_params(input_dev, ABS_Y, 0, data->max_y, 0, 0);
1999
2000         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2001             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2002              data->t100_aux_ampl)) {
2003                 input_set_abs_params(input_dev, ABS_PRESSURE, 0, 255, 0, 0);
2004         }
2005
2006         /* If device has buttons we assume it is a touchpad */
2007         if (data->t19_num_keys) {
2008                 mxt_set_up_as_touchpad(input_dev, data);
2009                 mt_flags |= INPUT_MT_POINTER;
2010         } else {
2011                 mt_flags |= INPUT_MT_DIRECT;
2012         }
2013
2014         /* For multi touch */
2015         error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
2016         if (error) {
2017                 dev_err(dev, "Error %d initialising slots\n", error);
2018                 goto err_free_mem;
2019         }
2020
2021         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100) {
2022                 input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
2023                                      0, MT_TOOL_MAX, 0, 0);
2024                 input_set_abs_params(input_dev, ABS_MT_DISTANCE,
2025                                      MXT_DISTANCE_ACTIVE_TOUCH,
2026                                      MXT_DISTANCE_HOVERING,
2027                                      0, 0);
2028         }
2029
2030         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
2031                              0, data->max_x, 0, 0);
2032         input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
2033                              0, data->max_y, 0, 0);
2034
2035         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2036             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2037              data->t100_aux_area)) {
2038                 input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
2039                                      0, MXT_MAX_AREA, 0, 0);
2040         }
2041
2042         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2043             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2044              data->t100_aux_ampl)) {
2045                 input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2046                                      0, 255, 0, 0);
2047         }
2048
2049         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2050             data->t100_aux_vect) {
2051                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2052                                      0, 255, 0, 0);
2053         }
2054
2055         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2056             data->t100_aux_ampl) {
2057                 input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2058                                      0, 255, 0, 0);
2059         }
2060
2061         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2062             data->t100_aux_vect) {
2063                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2064                                      0, 255, 0, 0);
2065         }
2066
2067         input_set_drvdata(input_dev, data);
2068
2069         error = input_register_device(input_dev);
2070         if (error) {
2071                 dev_err(dev, "Error %d registering input device\n", error);
2072                 goto err_free_mem;
2073         }
2074
2075         data->input_dev = input_dev;
2076
2077         return 0;
2078
2079 err_free_mem:
2080         input_free_device(input_dev);
2081         return error;
2082 }
2083
2084 static int mxt_configure_objects(struct mxt_data *data,
2085                                  const struct firmware *cfg);
2086
2087 static void mxt_config_cb(const struct firmware *cfg, void *ctx)
2088 {
2089         mxt_configure_objects(ctx, cfg);
2090         release_firmware(cfg);
2091 }
2092
2093 static int mxt_initialize(struct mxt_data *data)
2094 {
2095         struct i2c_client *client = data->client;
2096         int recovery_attempts = 0;
2097         int error;
2098
2099         while (1) {
2100                 error = mxt_read_info_block(data);
2101                 if (!error)
2102                         break;
2103
2104                 /* Check bootloader state */
2105                 error = mxt_probe_bootloader(data, false);
2106                 if (error) {
2107                         dev_info(&client->dev, "Trying alternate bootloader address\n");
2108                         error = mxt_probe_bootloader(data, true);
2109                         if (error) {
2110                                 /* Chip is not in appmode or bootloader mode */
2111                                 return error;
2112                         }
2113                 }
2114
2115                 /* OK, we are in bootloader, see if we can recover */
2116                 if (++recovery_attempts > 1) {
2117                         dev_err(&client->dev, "Could not recover from bootloader mode\n");
2118                         /*
2119                          * We can reflash from this state, so do not
2120                          * abort initialization.
2121                          */
2122                         data->in_bootloader = true;
2123                         return 0;
2124                 }
2125
2126                 /* Attempt to exit bootloader into app mode */
2127                 mxt_send_bootloader_cmd(data, false);
2128                 msleep(MXT_FW_RESET_TIME);
2129         }
2130
2131         error = mxt_acquire_irq(data);
2132         if (error)
2133                 return error;
2134
2135         error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
2136                                         &client->dev, GFP_KERNEL, data,
2137                                         mxt_config_cb);
2138         if (error) {
2139                 dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
2140                         error);
2141                 return error;
2142         }
2143
2144         return 0;
2145 }
2146
2147 static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
2148 {
2149         struct device *dev = &data->client->dev;
2150         int error;
2151         struct t7_config *new_config;
2152         struct t7_config deepsleep = { .active = 0, .idle = 0 };
2153
2154         if (sleep == MXT_POWER_CFG_DEEPSLEEP)
2155                 new_config = &deepsleep;
2156         else
2157                 new_config = &data->t7_cfg;
2158
2159         error = __mxt_write_reg(data->client, data->T7_address,
2160                                 sizeof(data->t7_cfg), new_config);
2161         if (error)
2162                 return error;
2163
2164         dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
2165                 new_config->active, new_config->idle);
2166
2167         return 0;
2168 }
2169
2170 static int mxt_init_t7_power_cfg(struct mxt_data *data)
2171 {
2172         struct device *dev = &data->client->dev;
2173         int error;
2174         bool retry = false;
2175
2176 recheck:
2177         error = __mxt_read_reg(data->client, data->T7_address,
2178                                 sizeof(data->t7_cfg), &data->t7_cfg);
2179         if (error)
2180                 return error;
2181
2182         if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
2183                 if (!retry) {
2184                         dev_dbg(dev, "T7 cfg zero, resetting\n");
2185                         mxt_soft_reset(data);
2186                         retry = true;
2187                         goto recheck;
2188                 } else {
2189                         dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
2190                         data->t7_cfg.active = 20;
2191                         data->t7_cfg.idle = 100;
2192                         return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2193                 }
2194         }
2195
2196         dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
2197                 data->t7_cfg.active, data->t7_cfg.idle);
2198         return 0;
2199 }
2200
2201 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
2202 static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
2203                                unsigned int y)
2204 {
2205         struct mxt_info *info = data->info;
2206         struct mxt_dbg *dbg = &data->dbg;
2207         unsigned int ofs, page;
2208         unsigned int col = 0;
2209         unsigned int col_width;
2210
2211         if (info->family_id == MXT_FAMILY_1386) {
2212                 col_width = info->matrix_ysize / MXT1386_COLUMNS;
2213                 col = y / col_width;
2214                 y = y % col_width;
2215         } else {
2216                 col_width = info->matrix_ysize;
2217         }
2218
2219         ofs = (y + (x * col_width)) * sizeof(u16);
2220         page = ofs / MXT_DIAGNOSTIC_SIZE;
2221         ofs %= MXT_DIAGNOSTIC_SIZE;
2222
2223         if (info->family_id == MXT_FAMILY_1386)
2224                 page += col * MXT1386_PAGES_PER_COLUMN;
2225
2226         return get_unaligned_le16(&dbg->t37_buf[page].data[ofs]);
2227 }
2228
2229 static int mxt_convert_debug_pages(struct mxt_data *data, u16 *outbuf)
2230 {
2231         struct mxt_dbg *dbg = &data->dbg;
2232         unsigned int x = 0;
2233         unsigned int y = 0;
2234         unsigned int i, rx, ry;
2235
2236         for (i = 0; i < dbg->t37_nodes; i++) {
2237                 /* Handle orientation */
2238                 rx = data->xy_switch ? y : x;
2239                 ry = data->xy_switch ? x : y;
2240                 rx = data->invertx ? (data->xsize - 1 - rx) : rx;
2241                 ry = data->inverty ? (data->ysize - 1 - ry) : ry;
2242
2243                 outbuf[i] = mxt_get_debug_value(data, rx, ry);
2244
2245                 /* Next value */
2246                 if (++x >= (data->xy_switch ? data->ysize : data->xsize)) {
2247                         x = 0;
2248                         y++;
2249                 }
2250         }
2251
2252         return 0;
2253 }
2254
2255 static int mxt_read_diagnostic_debug(struct mxt_data *data, u8 mode,
2256                                      u16 *outbuf)
2257 {
2258         struct mxt_dbg *dbg = &data->dbg;
2259         int retries = 0;
2260         int page;
2261         int ret;
2262         u8 cmd = mode;
2263         struct t37_debug *p;
2264         u8 cmd_poll;
2265
2266         for (page = 0; page < dbg->t37_pages; page++) {
2267                 p = dbg->t37_buf + page;
2268
2269                 ret = mxt_write_reg(data->client, dbg->diag_cmd_address,
2270                                     cmd);
2271                 if (ret)
2272                         return ret;
2273
2274                 retries = 0;
2275                 msleep(20);
2276 wait_cmd:
2277                 /* Read back command byte */
2278                 ret = __mxt_read_reg(data->client, dbg->diag_cmd_address,
2279                                      sizeof(cmd_poll), &cmd_poll);
2280                 if (ret)
2281                         return ret;
2282
2283                 /* Field is cleared once the command has been processed */
2284                 if (cmd_poll) {
2285                         if (retries++ > 100)
2286                                 return -EINVAL;
2287
2288                         msleep(20);
2289                         goto wait_cmd;
2290                 }
2291
2292                 /* Read T37 page */
2293                 ret = __mxt_read_reg(data->client, dbg->t37_address,
2294                                      sizeof(struct t37_debug), p);
2295                 if (ret)
2296                         return ret;
2297
2298                 if (p->mode != mode || p->page != page) {
2299                         dev_err(&data->client->dev, "T37 page mismatch\n");
2300                         return -EINVAL;
2301                 }
2302
2303                 dev_dbg(&data->client->dev, "%s page:%d retries:%d\n",
2304                         __func__, page, retries);
2305
2306                 /* For remaining pages, write PAGEUP rather than mode */
2307                 cmd = MXT_DIAGNOSTIC_PAGEUP;
2308         }
2309
2310         return mxt_convert_debug_pages(data, outbuf);
2311 }
2312
2313 static int mxt_queue_setup(struct vb2_queue *q,
2314                        unsigned int *nbuffers, unsigned int *nplanes,
2315                        unsigned int sizes[], struct device *alloc_devs[])
2316 {
2317         struct mxt_data *data = q->drv_priv;
2318         size_t size = data->dbg.t37_nodes * sizeof(u16);
2319
2320         if (*nplanes)
2321                 return sizes[0] < size ? -EINVAL : 0;
2322
2323         *nplanes = 1;
2324         sizes[0] = size;
2325
2326         return 0;
2327 }
2328
2329 static void mxt_buffer_queue(struct vb2_buffer *vb)
2330 {
2331         struct mxt_data *data = vb2_get_drv_priv(vb->vb2_queue);
2332         u16 *ptr;
2333         int ret;
2334         u8 mode;
2335
2336         ptr = vb2_plane_vaddr(vb, 0);
2337         if (!ptr) {
2338                 dev_err(&data->client->dev, "Error acquiring frame ptr\n");
2339                 goto fault;
2340         }
2341
2342         switch (data->dbg.input) {
2343         case MXT_V4L_INPUT_DELTAS:
2344         default:
2345                 mode = MXT_DIAGNOSTIC_DELTAS;
2346                 break;
2347
2348         case MXT_V4L_INPUT_REFS:
2349                 mode = MXT_DIAGNOSTIC_REFS;
2350                 break;
2351         }
2352
2353         ret = mxt_read_diagnostic_debug(data, mode, ptr);
2354         if (ret)
2355                 goto fault;
2356
2357         vb2_set_plane_payload(vb, 0, data->dbg.t37_nodes * sizeof(u16));
2358         vb2_buffer_done(vb, VB2_BUF_STATE_DONE);
2359         return;
2360
2361 fault:
2362         vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
2363 }
2364
2365 /* V4L2 structures */
2366 static const struct vb2_ops mxt_queue_ops = {
2367         .queue_setup            = mxt_queue_setup,
2368         .buf_queue              = mxt_buffer_queue,
2369         .wait_prepare           = vb2_ops_wait_prepare,
2370         .wait_finish            = vb2_ops_wait_finish,
2371 };
2372
2373 static const struct vb2_queue mxt_queue = {
2374         .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
2375         .io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
2376         .buf_struct_size = sizeof(struct mxt_vb2_buffer),
2377         .ops = &mxt_queue_ops,
2378         .mem_ops = &vb2_vmalloc_memops,
2379         .timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
2380         .min_buffers_needed = 1,
2381 };
2382
2383 static int mxt_vidioc_querycap(struct file *file, void *priv,
2384                                  struct v4l2_capability *cap)
2385 {
2386         struct mxt_data *data = video_drvdata(file);
2387
2388         strlcpy(cap->driver, "atmel_mxt_ts", sizeof(cap->driver));
2389         strlcpy(cap->card, "atmel_mxt_ts touch", sizeof(cap->card));
2390         snprintf(cap->bus_info, sizeof(cap->bus_info),
2391                  "I2C:%s", dev_name(&data->client->dev));
2392         return 0;
2393 }
2394
2395 static int mxt_vidioc_enum_input(struct file *file, void *priv,
2396                                    struct v4l2_input *i)
2397 {
2398         if (i->index >= MXT_V4L_INPUT_MAX)
2399                 return -EINVAL;
2400
2401         i->type = V4L2_INPUT_TYPE_TOUCH;
2402
2403         switch (i->index) {
2404         case MXT_V4L_INPUT_REFS:
2405                 strlcpy(i->name, "Mutual Capacitance References",
2406                         sizeof(i->name));
2407                 break;
2408         case MXT_V4L_INPUT_DELTAS:
2409                 strlcpy(i->name, "Mutual Capacitance Deltas", sizeof(i->name));
2410                 break;
2411         }
2412
2413         return 0;
2414 }
2415
2416 static int mxt_set_input(struct mxt_data *data, unsigned int i)
2417 {
2418         struct v4l2_pix_format *f = &data->dbg.format;
2419
2420         if (i >= MXT_V4L_INPUT_MAX)
2421                 return -EINVAL;
2422
2423         if (i == MXT_V4L_INPUT_DELTAS)
2424                 f->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2425         else
2426                 f->pixelformat = V4L2_TCH_FMT_TU16;
2427
2428         f->width = data->xy_switch ? data->ysize : data->xsize;
2429         f->height = data->xy_switch ? data->xsize : data->ysize;
2430         f->field = V4L2_FIELD_NONE;
2431         f->colorspace = V4L2_COLORSPACE_RAW;
2432         f->bytesperline = f->width * sizeof(u16);
2433         f->sizeimage = f->width * f->height * sizeof(u16);
2434
2435         data->dbg.input = i;
2436
2437         return 0;
2438 }
2439
2440 static int mxt_vidioc_s_input(struct file *file, void *priv, unsigned int i)
2441 {
2442         return mxt_set_input(video_drvdata(file), i);
2443 }
2444
2445 static int mxt_vidioc_g_input(struct file *file, void *priv, unsigned int *i)
2446 {
2447         struct mxt_data *data = video_drvdata(file);
2448
2449         *i = data->dbg.input;
2450
2451         return 0;
2452 }
2453
2454 static int mxt_vidioc_fmt(struct file *file, void *priv, struct v4l2_format *f)
2455 {
2456         struct mxt_data *data = video_drvdata(file);
2457
2458         f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
2459         f->fmt.pix = data->dbg.format;
2460
2461         return 0;
2462 }
2463
2464 static int mxt_vidioc_enum_fmt(struct file *file, void *priv,
2465                                  struct v4l2_fmtdesc *fmt)
2466 {
2467         if (fmt->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2468                 return -EINVAL;
2469
2470         switch (fmt->index) {
2471         case 0:
2472                 fmt->pixelformat = V4L2_TCH_FMT_TU16;
2473                 break;
2474
2475         case 1:
2476                 fmt->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2477                 break;
2478
2479         default:
2480                 return -EINVAL;
2481         }
2482
2483         return 0;
2484 }
2485
2486 static int mxt_vidioc_g_parm(struct file *file, void *fh,
2487                              struct v4l2_streamparm *a)
2488 {
2489         if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2490                 return -EINVAL;
2491
2492         a->parm.capture.readbuffers = 1;
2493         a->parm.capture.timeperframe.numerator = 1;
2494         a->parm.capture.timeperframe.denominator = 10;
2495         return 0;
2496 }
2497
2498 static const struct v4l2_ioctl_ops mxt_video_ioctl_ops = {
2499         .vidioc_querycap        = mxt_vidioc_querycap,
2500
2501         .vidioc_enum_fmt_vid_cap = mxt_vidioc_enum_fmt,
2502         .vidioc_s_fmt_vid_cap   = mxt_vidioc_fmt,
2503         .vidioc_g_fmt_vid_cap   = mxt_vidioc_fmt,
2504         .vidioc_try_fmt_vid_cap = mxt_vidioc_fmt,
2505         .vidioc_g_parm          = mxt_vidioc_g_parm,
2506
2507         .vidioc_enum_input      = mxt_vidioc_enum_input,
2508         .vidioc_g_input         = mxt_vidioc_g_input,
2509         .vidioc_s_input         = mxt_vidioc_s_input,
2510
2511         .vidioc_reqbufs         = vb2_ioctl_reqbufs,
2512         .vidioc_create_bufs     = vb2_ioctl_create_bufs,
2513         .vidioc_querybuf        = vb2_ioctl_querybuf,
2514         .vidioc_qbuf            = vb2_ioctl_qbuf,
2515         .vidioc_dqbuf           = vb2_ioctl_dqbuf,
2516         .vidioc_expbuf          = vb2_ioctl_expbuf,
2517
2518         .vidioc_streamon        = vb2_ioctl_streamon,
2519         .vidioc_streamoff       = vb2_ioctl_streamoff,
2520 };
2521
2522 static const struct video_device mxt_video_device = {
2523         .name = "Atmel maxTouch",
2524         .fops = &mxt_video_fops,
2525         .ioctl_ops = &mxt_video_ioctl_ops,
2526         .release = video_device_release_empty,
2527         .device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TOUCH |
2528                        V4L2_CAP_READWRITE | V4L2_CAP_STREAMING,
2529 };
2530
2531 static void mxt_debug_init(struct mxt_data *data)
2532 {
2533         struct mxt_info *info = data->info;
2534         struct mxt_dbg *dbg = &data->dbg;
2535         struct mxt_object *object;
2536         int error;
2537
2538         object = mxt_get_object(data, MXT_GEN_COMMAND_T6);
2539         if (!object)
2540                 goto error;
2541
2542         dbg->diag_cmd_address = object->start_address + MXT_COMMAND_DIAGNOSTIC;
2543
2544         object = mxt_get_object(data, MXT_DEBUG_DIAGNOSTIC_T37);
2545         if (!object)
2546                 goto error;
2547
2548         if (mxt_obj_size(object) != sizeof(struct t37_debug)) {
2549                 dev_warn(&data->client->dev, "Bad T37 size");
2550                 goto error;
2551         }
2552
2553         dbg->t37_address = object->start_address;
2554
2555         /* Calculate size of data and allocate buffer */
2556         dbg->t37_nodes = data->xsize * data->ysize;
2557
2558         if (info->family_id == MXT_FAMILY_1386)
2559                 dbg->t37_pages = MXT1386_COLUMNS * MXT1386_PAGES_PER_COLUMN;
2560         else
2561                 dbg->t37_pages = DIV_ROUND_UP(data->xsize *
2562                                               info->matrix_ysize *
2563                                               sizeof(u16),
2564                                               sizeof(dbg->t37_buf->data));
2565
2566         dbg->t37_buf = devm_kmalloc_array(&data->client->dev, dbg->t37_pages,
2567                                           sizeof(struct t37_debug), GFP_KERNEL);
2568         if (!dbg->t37_buf)
2569                 goto error;
2570
2571         /* init channel to zero */
2572         mxt_set_input(data, 0);
2573
2574         /* register video device */
2575         snprintf(dbg->v4l2.name, sizeof(dbg->v4l2.name), "%s", "atmel_mxt_ts");
2576         error = v4l2_device_register(&data->client->dev, &dbg->v4l2);
2577         if (error)
2578                 goto error;
2579
2580         /* initialize the queue */
2581         mutex_init(&dbg->lock);
2582         dbg->queue = mxt_queue;
2583         dbg->queue.drv_priv = data;
2584         dbg->queue.lock = &dbg->lock;
2585         dbg->queue.dev = &data->client->dev;
2586
2587         error = vb2_queue_init(&dbg->queue);
2588         if (error)
2589                 goto error_unreg_v4l2;
2590
2591         dbg->vdev = mxt_video_device;
2592         dbg->vdev.v4l2_dev = &dbg->v4l2;
2593         dbg->vdev.lock = &dbg->lock;
2594         dbg->vdev.vfl_dir = VFL_DIR_RX;
2595         dbg->vdev.queue = &dbg->queue;
2596         video_set_drvdata(&dbg->vdev, data);
2597
2598         error = video_register_device(&dbg->vdev, VFL_TYPE_TOUCH, -1);
2599         if (error)
2600                 goto error_unreg_v4l2;
2601
2602         return;
2603
2604 error_unreg_v4l2:
2605         v4l2_device_unregister(&dbg->v4l2);
2606 error:
2607         dev_warn(&data->client->dev, "Error initializing T37\n");
2608 }
2609 #else
2610 static void mxt_debug_init(struct mxt_data *data)
2611 {
2612 }
2613 #endif
2614
2615 static int mxt_configure_objects(struct mxt_data *data,
2616                                  const struct firmware *cfg)
2617 {
2618         struct device *dev = &data->client->dev;
2619         int error;
2620
2621         error = mxt_init_t7_power_cfg(data);
2622         if (error) {
2623                 dev_err(dev, "Failed to initialize power cfg\n");
2624                 return error;
2625         }
2626
2627         if (cfg) {
2628                 error = mxt_update_cfg(data, cfg);
2629                 if (error)
2630                         dev_warn(dev, "Error %d updating config\n", error);
2631         }
2632
2633         if (data->multitouch) {
2634                 error = mxt_initialize_input_device(data);
2635                 if (error)
2636                         return error;
2637         } else {
2638                 dev_warn(dev, "No touch object detected\n");
2639         }
2640
2641         mxt_debug_init(data);
2642
2643         return 0;
2644 }
2645
2646 /* Firmware Version is returned as Major.Minor.Build */
2647 static ssize_t mxt_fw_version_show(struct device *dev,
2648                                    struct device_attribute *attr, char *buf)
2649 {
2650         struct mxt_data *data = dev_get_drvdata(dev);
2651         struct mxt_info *info = data->info;
2652         return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
2653                          info->version >> 4, info->version & 0xf, info->build);
2654 }
2655
2656 /* Hardware Version is returned as FamilyID.VariantID */
2657 static ssize_t mxt_hw_version_show(struct device *dev,
2658                                    struct device_attribute *attr, char *buf)
2659 {
2660         struct mxt_data *data = dev_get_drvdata(dev);
2661         struct mxt_info *info = data->info;
2662         return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
2663                          info->family_id, info->variant_id);
2664 }
2665
2666 static ssize_t mxt_show_instance(char *buf, int count,
2667                                  struct mxt_object *object, int instance,
2668                                  const u8 *val)
2669 {
2670         int i;
2671
2672         if (mxt_obj_instances(object) > 1)
2673                 count += scnprintf(buf + count, PAGE_SIZE - count,
2674                                    "Instance %u\n", instance);
2675
2676         for (i = 0; i < mxt_obj_size(object); i++)
2677                 count += scnprintf(buf + count, PAGE_SIZE - count,
2678                                 "\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
2679         count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
2680
2681         return count;
2682 }
2683
2684 static ssize_t mxt_object_show(struct device *dev,
2685                                     struct device_attribute *attr, char *buf)
2686 {
2687         struct mxt_data *data = dev_get_drvdata(dev);
2688         struct mxt_object *object;
2689         int count = 0;
2690         int i, j;
2691         int error;
2692         u8 *obuf;
2693
2694         /* Pre-allocate buffer large enough to hold max sized object. */
2695         obuf = kmalloc(256, GFP_KERNEL);
2696         if (!obuf)
2697                 return -ENOMEM;
2698
2699         error = 0;
2700         for (i = 0; i < data->info->object_num; i++) {
2701                 object = data->object_table + i;
2702
2703                 if (!mxt_object_readable(object->type))
2704                         continue;
2705
2706                 count += scnprintf(buf + count, PAGE_SIZE - count,
2707                                 "T%u:\n", object->type);
2708
2709                 for (j = 0; j < mxt_obj_instances(object); j++) {
2710                         u16 size = mxt_obj_size(object);
2711                         u16 addr = object->start_address + j * size;
2712
2713                         error = __mxt_read_reg(data->client, addr, size, obuf);
2714                         if (error)
2715                                 goto done;
2716
2717                         count = mxt_show_instance(buf, count, object, j, obuf);
2718                 }
2719         }
2720
2721 done:
2722         kfree(obuf);
2723         return error ?: count;
2724 }
2725
2726 static int mxt_check_firmware_format(struct device *dev,
2727                                      const struct firmware *fw)
2728 {
2729         unsigned int pos = 0;
2730         char c;
2731
2732         while (pos < fw->size) {
2733                 c = *(fw->data + pos);
2734
2735                 if (c < '0' || (c > '9' && c < 'A') || c > 'F')
2736                         return 0;
2737
2738                 pos++;
2739         }
2740
2741         /*
2742          * To convert file try:
2743          * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
2744          */
2745         dev_err(dev, "Aborting: firmware file must be in binary format\n");
2746
2747         return -EINVAL;
2748 }
2749
2750 static int mxt_load_fw(struct device *dev, const char *fn)
2751 {
2752         struct mxt_data *data = dev_get_drvdata(dev);
2753         const struct firmware *fw = NULL;
2754         unsigned int frame_size;
2755         unsigned int pos = 0;
2756         unsigned int retry = 0;
2757         unsigned int frame = 0;
2758         int ret;
2759
2760         ret = request_firmware(&fw, fn, dev);
2761         if (ret) {
2762                 dev_err(dev, "Unable to open firmware %s\n", fn);
2763                 return ret;
2764         }
2765
2766         /* Check for incorrect enc file */
2767         ret = mxt_check_firmware_format(dev, fw);
2768         if (ret)
2769                 goto release_firmware;
2770
2771         if (!data->in_bootloader) {
2772                 /* Change to the bootloader mode */
2773                 data->in_bootloader = true;
2774
2775                 ret = mxt_t6_command(data, MXT_COMMAND_RESET,
2776                                      MXT_BOOT_VALUE, false);
2777                 if (ret)
2778                         goto release_firmware;
2779
2780                 msleep(MXT_RESET_TIME);
2781
2782                 /* Do not need to scan since we know family ID */
2783                 ret = mxt_lookup_bootloader_address(data, 0);
2784                 if (ret)
2785                         goto release_firmware;
2786
2787                 mxt_free_input_device(data);
2788                 mxt_free_object_table(data);
2789         } else {
2790                 enable_irq(data->irq);
2791         }
2792
2793         reinit_completion(&data->bl_completion);
2794
2795         ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
2796         if (ret) {
2797                 /* Bootloader may still be unlocked from previous attempt */
2798                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
2799                 if (ret)
2800                         goto disable_irq;
2801         } else {
2802                 dev_info(dev, "Unlocking bootloader\n");
2803
2804                 /* Unlock bootloader */
2805                 ret = mxt_send_bootloader_cmd(data, true);
2806                 if (ret)
2807                         goto disable_irq;
2808         }
2809
2810         while (pos < fw->size) {
2811                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
2812                 if (ret)
2813                         goto disable_irq;
2814
2815                 frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
2816
2817                 /* Take account of CRC bytes */
2818                 frame_size += 2;
2819
2820                 /* Write one frame to device */
2821                 ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
2822                 if (ret)
2823                         goto disable_irq;
2824
2825                 ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
2826                 if (ret) {
2827                         retry++;
2828
2829                         /* Back off by 20ms per retry */
2830                         msleep(retry * 20);
2831
2832                         if (retry > 20) {
2833                                 dev_err(dev, "Retry count exceeded\n");
2834                                 goto disable_irq;
2835                         }
2836                 } else {
2837                         retry = 0;
2838                         pos += frame_size;
2839                         frame++;
2840                 }
2841
2842                 if (frame % 50 == 0)
2843                         dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
2844                                 frame, pos, fw->size);
2845         }
2846
2847         /* Wait for flash. */
2848         ret = mxt_wait_for_completion(data, &data->bl_completion,
2849                                       MXT_FW_RESET_TIME);
2850         if (ret)
2851                 goto disable_irq;
2852
2853         dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
2854
2855         /*
2856          * Wait for device to reset. Some bootloader versions do not assert
2857          * the CHG line after bootloading has finished, so ignore potential
2858          * errors.
2859          */
2860         mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
2861
2862         data->in_bootloader = false;
2863
2864 disable_irq:
2865         disable_irq(data->irq);
2866 release_firmware:
2867         release_firmware(fw);
2868         return ret;
2869 }
2870
2871 static ssize_t mxt_update_fw_store(struct device *dev,
2872                                         struct device_attribute *attr,
2873                                         const char *buf, size_t count)
2874 {
2875         struct mxt_data *data = dev_get_drvdata(dev);
2876         int error;
2877
2878         error = mxt_load_fw(dev, MXT_FW_NAME);
2879         if (error) {
2880                 dev_err(dev, "The firmware update failed(%d)\n", error);
2881                 count = error;
2882         } else {
2883                 dev_info(dev, "The firmware update succeeded\n");
2884
2885                 error = mxt_initialize(data);
2886                 if (error)
2887                         return error;
2888         }
2889
2890         return count;
2891 }
2892
2893 static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2894 static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2895 static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2896 static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2897
2898 static struct attribute *mxt_attrs[] = {
2899         &dev_attr_fw_version.attr,
2900         &dev_attr_hw_version.attr,
2901         &dev_attr_object.attr,
2902         &dev_attr_update_fw.attr,
2903         NULL
2904 };
2905
2906 static const struct attribute_group mxt_attr_group = {
2907         .attrs = mxt_attrs,
2908 };
2909
2910 static void mxt_start(struct mxt_data *data)
2911 {
2912         switch (data->suspend_mode) {
2913         case MXT_SUSPEND_T9_CTRL:
2914                 mxt_soft_reset(data);
2915
2916                 /* Touch enable */
2917                 /* 0x83 = SCANEN | RPTEN | ENABLE */
2918                 mxt_write_object(data,
2919                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0x83);
2920                 break;
2921
2922         case MXT_SUSPEND_DEEP_SLEEP:
2923         default:
2924                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2925
2926                 /* Recalibrate since chip has been in deep sleep */
2927                 mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
2928                 break;
2929         }
2930 }
2931
2932 static void mxt_stop(struct mxt_data *data)
2933 {
2934         switch (data->suspend_mode) {
2935         case MXT_SUSPEND_T9_CTRL:
2936                 /* Touch disable */
2937                 mxt_write_object(data,
2938                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0);
2939                 break;
2940
2941         case MXT_SUSPEND_DEEP_SLEEP:
2942         default:
2943                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
2944                 break;
2945         }
2946 }
2947
2948 static int mxt_input_open(struct input_dev *dev)
2949 {
2950         struct mxt_data *data = input_get_drvdata(dev);
2951
2952         mxt_start(data);
2953
2954         return 0;
2955 }
2956
2957 static void mxt_input_close(struct input_dev *dev)
2958 {
2959         struct mxt_data *data = input_get_drvdata(dev);
2960
2961         mxt_stop(data);
2962 }
2963
2964 static int mxt_parse_device_properties(struct mxt_data *data)
2965 {
2966         static const char keymap_property[] = "linux,gpio-keymap";
2967         struct device *dev = &data->client->dev;
2968         u32 *keymap;
2969         int n_keys;
2970         int error;
2971
2972         if (device_property_present(dev, keymap_property)) {
2973                 n_keys = device_property_read_u32_array(dev, keymap_property,
2974                                                         NULL, 0);
2975                 if (n_keys <= 0) {
2976                         error = n_keys < 0 ? n_keys : -EINVAL;
2977                         dev_err(dev, "invalid/malformed '%s' property: %d\n",
2978                                 keymap_property, error);
2979                         return error;
2980                 }
2981
2982                 keymap = devm_kmalloc_array(dev, n_keys, sizeof(*keymap),
2983                                             GFP_KERNEL);
2984                 if (!keymap)
2985                         return -ENOMEM;
2986
2987                 error = device_property_read_u32_array(dev, keymap_property,
2988                                                        keymap, n_keys);
2989                 if (error) {
2990                         dev_err(dev, "failed to parse '%s' property: %d\n",
2991                                 keymap_property, error);
2992                         return error;
2993                 }
2994
2995                 data->t19_keymap = keymap;
2996                 data->t19_num_keys = n_keys;
2997         }
2998
2999         return 0;
3000 }
3001
3002 #ifdef CONFIG_ACPI
3003
3004 struct mxt_acpi_platform_data {
3005         const char *hid;
3006         const struct property_entry *props;
3007 };
3008
3009 static unsigned int samus_touchpad_buttons[] = {
3010         KEY_RESERVED,
3011         KEY_RESERVED,
3012         KEY_RESERVED,
3013         BTN_LEFT
3014 };
3015
3016 static const struct property_entry samus_touchpad_props[] = {
3017         PROPERTY_ENTRY_U32_ARRAY("linux,gpio-keymap", samus_touchpad_buttons),
3018         { }
3019 };
3020
3021 static struct mxt_acpi_platform_data samus_platform_data[] = {
3022         {
3023                 /* Touchpad */
3024                 .hid    = "ATML0000",
3025                 .props  = samus_touchpad_props,
3026         },
3027         {
3028                 /* Touchscreen */
3029                 .hid    = "ATML0001",
3030         },
3031         { }
3032 };
3033
3034 static unsigned int chromebook_tp_buttons[] = {
3035         KEY_RESERVED,
3036         KEY_RESERVED,
3037         KEY_RESERVED,
3038         KEY_RESERVED,
3039         KEY_RESERVED,
3040         BTN_LEFT
3041 };
3042
3043 static const struct property_entry chromebook_tp_props[] = {
3044         PROPERTY_ENTRY_U32_ARRAY("linux,gpio-keymap", chromebook_tp_buttons),
3045         { }
3046 };
3047
3048 static struct mxt_acpi_platform_data chromebook_platform_data[] = {
3049         {
3050                 /* Touchpad */
3051                 .hid    = "ATML0000",
3052                 .props  = chromebook_tp_props,
3053         },
3054         {
3055                 /* Touchscreen */
3056                 .hid    = "ATML0001",
3057         },
3058         { }
3059 };
3060
3061 static const struct dmi_system_id mxt_dmi_table[] = {
3062         {
3063                 /* 2015 Google Pixel */
3064                 .ident = "Chromebook Pixel 2",
3065                 .matches = {
3066                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3067                         DMI_MATCH(DMI_PRODUCT_NAME, "Samus"),
3068                 },
3069                 .driver_data = samus_platform_data,
3070         },
3071         {
3072                 /* Samsung Chromebook Pro */
3073                 .ident = "Samsung Chromebook Pro",
3074                 .matches = {
3075                         DMI_MATCH(DMI_SYS_VENDOR, "Google"),
3076                         DMI_MATCH(DMI_PRODUCT_NAME, "Caroline"),
3077                 },
3078                 .driver_data = samus_platform_data,
3079         },
3080         {
3081                 /* Other Google Chromebooks */
3082                 .ident = "Chromebook",
3083                 .matches = {
3084                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3085                 },
3086                 .driver_data = chromebook_platform_data,
3087         },
3088         { }
3089 };
3090
3091 static int mxt_prepare_acpi_properties(struct i2c_client *client)
3092 {
3093         struct acpi_device *adev;
3094         const struct dmi_system_id *system_id;
3095         const struct mxt_acpi_platform_data *acpi_pdata;
3096
3097         adev = ACPI_COMPANION(&client->dev);
3098         if (!adev)
3099                 return -ENOENT;
3100
3101         system_id = dmi_first_match(mxt_dmi_table);
3102         if (!system_id)
3103                 return -ENOENT;
3104
3105         acpi_pdata = system_id->driver_data;
3106         if (!acpi_pdata)
3107                 return -ENOENT;
3108
3109         while (acpi_pdata->hid) {
3110                 if (!strcmp(acpi_device_hid(adev), acpi_pdata->hid)) {
3111                         /*
3112                          * Remove previously installed properties if we
3113                          * are probing this device not for the very first
3114                          * time.
3115                          */
3116                         device_remove_properties(&client->dev);
3117
3118                         /*
3119                          * Now install the platform-specific properties
3120                          * that are missing from ACPI.
3121                          */
3122                         device_add_properties(&client->dev, acpi_pdata->props);
3123                         break;
3124                 }
3125
3126                 acpi_pdata++;
3127         }
3128
3129         return 0;
3130 }
3131 #else
3132 static int mxt_prepare_acpi_properties(struct i2c_client *client)
3133 {
3134         return -ENOENT;
3135 }
3136 #endif
3137
3138 static const struct dmi_system_id chromebook_T9_suspend_dmi[] = {
3139         {
3140                 .matches = {
3141                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3142                         DMI_MATCH(DMI_PRODUCT_NAME, "Link"),
3143                 },
3144         },
3145         {
3146                 .matches = {
3147                         DMI_MATCH(DMI_PRODUCT_NAME, "Peppy"),
3148                 },
3149         },
3150         { }
3151 };
3152
3153 static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
3154 {
3155         struct mxt_data *data;
3156         int error;
3157
3158         /*
3159          * Ignore ACPI devices representing bootloader mode.
3160          *
3161          * This is a bit of a hack: Google Chromebook BIOS creates ACPI
3162          * devices for both application and bootloader modes, but we are
3163          * interested in application mode only (if device is in bootloader
3164          * mode we'll end up switching into application anyway). So far
3165          * application mode addresses were all above 0x40, so we'll use it
3166          * as a threshold.
3167          */
3168         if (ACPI_COMPANION(&client->dev) && client->addr < 0x40)
3169                 return -ENXIO;
3170
3171         data = devm_kzalloc(&client->dev, sizeof(struct mxt_data), GFP_KERNEL);
3172         if (!data)
3173                 return -ENOMEM;
3174
3175         snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
3176                  client->adapter->nr, client->addr);
3177
3178         data->client = client;
3179         data->irq = client->irq;
3180         i2c_set_clientdata(client, data);
3181
3182         init_completion(&data->bl_completion);
3183         init_completion(&data->reset_completion);
3184         init_completion(&data->crc_completion);
3185
3186         data->suspend_mode = dmi_check_system(chromebook_T9_suspend_dmi) ?
3187                 MXT_SUSPEND_T9_CTRL : MXT_SUSPEND_DEEP_SLEEP;
3188
3189         error = mxt_prepare_acpi_properties(client);
3190         if (error && error != -ENOENT)
3191                 return error;
3192
3193         error = mxt_parse_device_properties(data);
3194         if (error)
3195                 return error;
3196
3197         data->reset_gpio = devm_gpiod_get_optional(&client->dev,
3198                                                    "reset", GPIOD_OUT_LOW);
3199         if (IS_ERR(data->reset_gpio)) {
3200                 error = PTR_ERR(data->reset_gpio);
3201                 dev_err(&client->dev, "Failed to get reset gpio: %d\n", error);
3202                 return error;
3203         }
3204
3205         error = devm_request_threaded_irq(&client->dev, client->irq,
3206                                           NULL, mxt_interrupt, IRQF_ONESHOT,
3207                                           client->name, data);
3208         if (error) {
3209                 dev_err(&client->dev, "Failed to register interrupt\n");
3210                 return error;
3211         }
3212
3213         if (data->reset_gpio) {
3214                 data->in_bootloader = true;
3215                 msleep(MXT_RESET_TIME);
3216                 reinit_completion(&data->bl_completion);
3217                 gpiod_set_value(data->reset_gpio, 1);
3218                 error = mxt_wait_for_completion(data, &data->bl_completion,
3219                                                 MXT_RESET_TIMEOUT);
3220                 if (error)
3221                         return error;
3222                 data->in_bootloader = false;
3223         }
3224
3225         disable_irq(client->irq);
3226
3227         error = mxt_initialize(data);
3228         if (error)
3229                 return error;
3230
3231         error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
3232         if (error) {
3233                 dev_err(&client->dev, "Failure %d creating sysfs group\n",
3234                         error);
3235                 goto err_free_object;
3236         }
3237
3238         return 0;
3239
3240 err_free_object:
3241         mxt_free_input_device(data);
3242         mxt_free_object_table(data);
3243         return error;
3244 }
3245
3246 static int mxt_remove(struct i2c_client *client)
3247 {
3248         struct mxt_data *data = i2c_get_clientdata(client);
3249
3250         disable_irq(data->irq);
3251         sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
3252         mxt_free_input_device(data);
3253         mxt_free_object_table(data);
3254
3255         return 0;