drivers/input/touchscreen/atmel_mxt_ts.c

   1 /*
   2  * Atmel maXTouch Touchscreen driver
   3  *
   4  * Copyright (C) 2010 Samsung Electronics Co.Ltd
   5  * Copyright (C) 2011-2014 Atmel Corporation
   6  * Copyright (C) 2012 Google, Inc.
   7  *
   8  * Author: Joonyoung Shim <jy0922.shim@samsung.com>
   9  *
  10  * This program is free software; you can redistribute  it and/or modify it
  11  * under  the terms of  the GNU General  Public License as published by the
  12  * Free Software Foundation;  either version 2 of the  License, or (at your
  13  * option) any later version.
  14  *
  15  */
  16
  17 #include <linux/acpi.h>
  18 #include <linux/dmi.h>
  19 #include <linux/module.h>
  20 #include <linux/init.h>
  21 #include <linux/completion.h>
  22 #include <linux/delay.h>
  23 #include <linux/firmware.h>
  24 #include <linux/i2c.h>
  25 #include <linux/platform_data/atmel_mxt_ts.h>
  26 #include <linux/input/mt.h>
  27 #include <linux/interrupt.h>
  28 #include <linux/of.h>
  29 #include <linux/slab.h>
  30 #include <asm/unaligned.h>
  31 #include <media/v4l2-device.h>
  32 #include <media/v4l2-ioctl.h>
  33 #include <media/videobuf2-v4l2.h>
  34 #include <media/videobuf2-vmalloc.h>
  35
  36 /* Firmware files */
  37 #define MXT_FW_NAME             "maxtouch.fw"
  38 #define MXT_CFG_NAME            "maxtouch.cfg"
  39 #define MXT_CFG_MAGIC           "OBP_RAW V1"
  40
  41 /* Registers */
  42 #define MXT_OBJECT_START        0x07
  43 #define MXT_OBJECT_SIZE         6
  44 #define MXT_INFO_CHECKSUM_SIZE  3
  45 #define MXT_MAX_BLOCK_WRITE     256
  46
  47 /* Object types */
  48 #define MXT_DEBUG_DIAGNOSTIC_T37        37
  49 #define MXT_GEN_MESSAGE_T5              5
  50 #define MXT_GEN_COMMAND_T6              6
  51 #define MXT_GEN_POWER_T7                7
  52 #define MXT_GEN_ACQUIRE_T8              8
  53 #define MXT_GEN_DATASOURCE_T53          53
  54 #define MXT_TOUCH_MULTI_T9              9
  55 #define MXT_TOUCH_KEYARRAY_T15          15
  56 #define MXT_TOUCH_PROXIMITY_T23         23
  57 #define MXT_TOUCH_PROXKEY_T52           52
  58 #define MXT_PROCI_GRIPFACE_T20          20
  59 #define MXT_PROCG_NOISE_T22             22
  60 #define MXT_PROCI_ONETOUCH_T24          24
  61 #define MXT_PROCI_TWOTOUCH_T27          27
  62 #define MXT_PROCI_GRIP_T40              40
  63 #define MXT_PROCI_PALM_T41              41
  64 #define MXT_PROCI_TOUCHSUPPRESSION_T42  42
  65 #define MXT_PROCI_STYLUS_T47            47
  66 #define MXT_PROCG_NOISESUPPRESSION_T48  48
  67 #define MXT_SPT_COMMSCONFIG_T18         18
  68 #define MXT_SPT_GPIOPWM_T19             19
  69 #define MXT_SPT_SELFTEST_T25            25
  70 #define MXT_SPT_CTECONFIG_T28           28
  71 #define MXT_SPT_USERDATA_T38            38
  72 #define MXT_SPT_DIGITIZER_T43           43
  73 #define MXT_SPT_MESSAGECOUNT_T44        44
  74 #define MXT_SPT_CTECONFIG_T46           46
  75 #define MXT_TOUCH_MULTITOUCHSCREEN_T100 100
  76
  77 /* MXT_GEN_MESSAGE_T5 object */
  78 #define MXT_RPTID_NOMSG         0xff
  79
  80 /* MXT_GEN_COMMAND_T6 field */
  81 #define MXT_COMMAND_RESET       0
  82 #define MXT_COMMAND_BACKUPNV    1
  83 #define MXT_COMMAND_CALIBRATE   2
  84 #define MXT_COMMAND_REPORTALL   3
  85 #define MXT_COMMAND_DIAGNOSTIC  5
  86
  87 /* Define for T6 status byte */
  88 #define MXT_T6_STATUS_RESET     (1 << 7)
  89 #define MXT_T6_STATUS_OFL       (1 << 6)
  90 #define MXT_T6_STATUS_SIGERR    (1 << 5)
  91 #define MXT_T6_STATUS_CAL       (1 << 4)
  92 #define MXT_T6_STATUS_CFGERR    (1 << 3)
  93 #define MXT_T6_STATUS_COMSERR   (1 << 2)
  94
  95 /* MXT_GEN_POWER_T7 field */
  96 struct t7_config {
  97         u8 idle;
  98         u8 active;
  99 } __packed;
 100
 101 #define MXT_POWER_CFG_RUN               0
 102 #define MXT_POWER_CFG_DEEPSLEEP         1
 103
 104 /* MXT_TOUCH_MULTI_T9 field */
 105 #define MXT_T9_CTRL             0
 106 #define MXT_T9_XSIZE            3
 107 #define MXT_T9_YSIZE            4
 108 #define MXT_T9_ORIENT           9
 109 #define MXT_T9_RANGE            18
 110
 111 /* MXT_TOUCH_MULTI_T9 status */
 112 #define MXT_T9_UNGRIP           (1 << 0)
 113 #define MXT_T9_SUPPRESS         (1 << 1)
 114 #define MXT_T9_AMP              (1 << 2)
 115 #define MXT_T9_VECTOR           (1 << 3)
 116 #define MXT_T9_MOVE             (1 << 4)
 117 #define MXT_T9_RELEASE          (1 << 5)
 118 #define MXT_T9_PRESS            (1 << 6)
 119 #define MXT_T9_DETECT           (1 << 7)
 120
 121 struct t9_range {
 122         __le16 x;
 123         __le16 y;
 124 } __packed;
 125
 126 /* MXT_TOUCH_MULTI_T9 orient */
 127 #define MXT_T9_ORIENT_SWITCH    (1 << 0)
 128 #define MXT_T9_ORIENT_INVERTX   (1 << 1)
 129 #define MXT_T9_ORIENT_INVERTY   (1 << 2)
 130
 131 /* MXT_SPT_COMMSCONFIG_T18 */
 132 #define MXT_COMMS_CTRL          0
 133 #define MXT_COMMS_CMD           1
 134
 135 /* MXT_DEBUG_DIAGNOSTIC_T37 */
 136 #define MXT_DIAGNOSTIC_PAGEUP   0x01
 137 #define MXT_DIAGNOSTIC_DELTAS   0x10
 138 #define MXT_DIAGNOSTIC_SIZE     128
 139
 140 struct t37_debug {
 141 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
 142         u8 mode;
 143         u8 page;
 144         u8 data[MXT_DIAGNOSTIC_SIZE];
 145 #endif
 146 };
 147
 148 /* Define for MXT_GEN_COMMAND_T6 */
 149 #define MXT_BOOT_VALUE          0xa5
 150 #define MXT_RESET_VALUE         0x01
 151 #define MXT_BACKUP_VALUE        0x55
 152
 153 /* T100 Multiple Touch Touchscreen */
 154 #define MXT_T100_CTRL           0
 155 #define MXT_T100_CFG1           1
 156 #define MXT_T100_TCHAUX         3
 157 #define MXT_T100_XSIZE          9
 158 #define MXT_T100_XRANGE         13
 159 #define MXT_T100_YSIZE          20
 160 #define MXT_T100_YRANGE         24
 161
 162 #define MXT_T100_CFG_SWITCHXY   BIT(5)
 163 #define MXT_T100_CFG_INVERTY    BIT(6)
 164 #define MXT_T100_CFG_INVERTX    BIT(7)
 165
 166 #define MXT_T100_TCHAUX_VECT    BIT(0)
 167 #define MXT_T100_TCHAUX_AMPL    BIT(1)
 168 #define MXT_T100_TCHAUX_AREA    BIT(2)
 169
 170 #define MXT_T100_DETECT         BIT(7)
 171 #define MXT_T100_TYPE_MASK      0x70
 172
 173 enum t100_type {
 174         MXT_T100_TYPE_FINGER            = 1,
 175         MXT_T100_TYPE_PASSIVE_STYLUS    = 2,
 176         MXT_T100_TYPE_HOVERING_FINGER   = 4,
 177         MXT_T100_TYPE_GLOVE             = 5,
 178         MXT_T100_TYPE_LARGE_TOUCH       = 6,
 179 };
 180
 181 #define MXT_DISTANCE_ACTIVE_TOUCH       0
 182 #define MXT_DISTANCE_HOVERING           1
 183
 184 #define MXT_TOUCH_MAJOR_DEFAULT         1
 185 #define MXT_PRESSURE_DEFAULT            1
 186
 187 /* Delay times */
 188 #define MXT_BACKUP_TIME         50      /* msec */
 189 #define MXT_RESET_TIME          200     /* msec */
 190 #define MXT_RESET_TIMEOUT       3000    /* msec */
 191 #define MXT_CRC_TIMEOUT         1000    /* msec */
 192 #define MXT_FW_RESET_TIME       3000    /* msec */
 193 #define MXT_FW_CHG_TIMEOUT      300     /* msec */
 194
 195 /* Command to unlock bootloader */
 196 #define MXT_UNLOCK_CMD_MSB      0xaa
 197 #define MXT_UNLOCK_CMD_LSB      0xdc
 198
 199 /* Bootloader mode status */
 200 #define MXT_WAITING_BOOTLOAD_CMD        0xc0    /* valid 7 6 bit only */
 201 #define MXT_WAITING_FRAME_DATA  0x80    /* valid 7 6 bit only */
 202 #define MXT_FRAME_CRC_CHECK     0x02
 203 #define MXT_FRAME_CRC_FAIL      0x03
 204 #define MXT_FRAME_CRC_PASS      0x04
 205 #define MXT_APP_CRC_FAIL        0x40    /* valid 7 8 bit only */
 206 #define MXT_BOOT_STATUS_MASK    0x3f
 207 #define MXT_BOOT_EXTENDED_ID    (1 << 5)
 208 #define MXT_BOOT_ID_MASK        0x1f
 209
 210 /* Touchscreen absolute values */
 211 #define MXT_MAX_AREA            0xff
 212
 213 #define MXT_PIXELS_PER_MM       20
 214
 215 struct mxt_info {
 216         u8 family_id;
 217         u8 variant_id;
 218         u8 version;
 219         u8 build;
 220         u8 matrix_xsize;
 221         u8 matrix_ysize;
 222         u8 object_num;
 223 };
 224
 225 struct mxt_object {
 226         u8 type;
 227         u16 start_address;
 228         u8 size_minus_one;
 229         u8 instances_minus_one;
 230         u8 num_report_ids;
 231 } __packed;
 232
 233 struct mxt_dbg {
 234         u16 t37_address;
 235         u16 diag_cmd_address;
 236         struct t37_debug *t37_buf;
 237         unsigned int t37_pages;
 238         unsigned int t37_nodes;
 239
 240         struct v4l2_device v4l2;
 241         struct v4l2_pix_format format;
 242         struct video_device vdev;
 243         struct vb2_queue queue;
 244         struct mutex lock;
 245         int input;
 246 };
 247
 248 static const struct v4l2_file_operations mxt_video_fops = {
 249         .owner = THIS_MODULE,
 250         .open = v4l2_fh_open,
 251         .release = vb2_fop_release,
 252         .unlocked_ioctl = video_ioctl2,
 253         .read = vb2_fop_read,
 254         .mmap = vb2_fop_mmap,
 255         .poll = vb2_fop_poll,
 256 };
 257
 258 /* Each client has this additional data */
 259 struct mxt_data {
 260         struct i2c_client *client;
 261         struct input_dev *input_dev;
 262         char phys[64];          /* device physical location */
 263         const struct mxt_platform_data *pdata;
 264         struct mxt_object *object_table;
 265         struct mxt_info info;
 266         unsigned int irq;
 267         unsigned int max_x;
 268         unsigned int max_y;
 269         bool invertx;
 270         bool inverty;
 271         bool xy_switch;
 272         u8 xsize;
 273         u8 ysize;
 274         bool in_bootloader;
 275         u16 mem_size;
 276         u8 t100_aux_ampl;
 277         u8 t100_aux_area;
 278         u8 t100_aux_vect;
 279         u8 max_reportid;
 280         u32 config_crc;
 281         u32 info_crc;
 282         u8 bootloader_addr;
 283         u8 *msg_buf;
 284         u8 t6_status;
 285         bool update_input;
 286         u8 last_message_count;
 287         u8 num_touchids;
 288         u8 multitouch;
 289         struct t7_config t7_cfg;
 290         struct mxt_dbg dbg;
 291
 292         /* Cached parameters from object table */
 293         u16 T5_address;
 294         u8 T5_msg_size;
 295         u8 T6_reportid;
 296         u16 T6_address;
 297         u16 T7_address;
 298         u8 T9_reportid_min;
 299         u8 T9_reportid_max;
 300         u8 T19_reportid;
 301         u16 T44_address;
 302         u8 T100_reportid_min;
 303         u8 T100_reportid_max;
 304
 305         /* for fw update in bootloader */
 306         struct completion bl_completion;
 307
 308         /* for reset handling */
 309         struct completion reset_completion;
 310
 311         /* for config update handling */
 312         struct completion crc_completion;
 313 };
 314
 315 struct mxt_vb2_buffer {
 316         struct vb2_buffer       vb;
 317         struct list_head        list;
 318 };
 319
 320 static size_t mxt_obj_size(const struct mxt_object *obj)
 321 {
 322         return obj->size_minus_one + 1;
 323 }
 324
 325 static size_t mxt_obj_instances(const struct mxt_object *obj)
 326 {
 327         return obj->instances_minus_one + 1;
 328 }
 329
 330 static bool mxt_object_readable(unsigned int type)
 331 {
 332         switch (type) {
 333         case MXT_GEN_COMMAND_T6:
 334         case MXT_GEN_POWER_T7:
 335         case MXT_GEN_ACQUIRE_T8:
 336         case MXT_GEN_DATASOURCE_T53:
 337         case MXT_TOUCH_MULTI_T9:
 338         case MXT_TOUCH_KEYARRAY_T15:
 339         case MXT_TOUCH_PROXIMITY_T23:
 340         case MXT_TOUCH_PROXKEY_T52:
 341         case MXT_PROCI_GRIPFACE_T20:
 342         case MXT_PROCG_NOISE_T22:
 343         case MXT_PROCI_ONETOUCH_T24:
 344         case MXT_PROCI_TWOTOUCH_T27:
 345         case MXT_PROCI_GRIP_T40:
 346         case MXT_PROCI_PALM_T41:
 347         case MXT_PROCI_TOUCHSUPPRESSION_T42:
 348         case MXT_PROCI_STYLUS_T47:
 349         case MXT_PROCG_NOISESUPPRESSION_T48:
 350         case MXT_SPT_COMMSCONFIG_T18:
 351         case MXT_SPT_GPIOPWM_T19:
 352         case MXT_SPT_SELFTEST_T25:
 353         case MXT_SPT_CTECONFIG_T28:
 354         case MXT_SPT_USERDATA_T38:
 355         case MXT_SPT_DIGITIZER_T43:
 356         case MXT_SPT_CTECONFIG_T46:
 357                 return true;
 358         default:
 359                 return false;
 360         }
 361 }
 362
 363 static void mxt_dump_message(struct mxt_data *data, u8 *message)
 364 {
 365         dev_dbg(&data->client->dev, "message: %*ph\n",
 366                 data->T5_msg_size, message);
 367 }
 368
 369 static int mxt_wait_for_completion(struct mxt_data *data,
 370                                    struct completion *comp,
 371                                    unsigned int timeout_ms)
 372 {
 373         struct device *dev = &data->client->dev;
 374         unsigned long timeout = msecs_to_jiffies(timeout_ms);
 375         long ret;
 376
 377         ret = wait_for_completion_interruptible_timeout(comp, timeout);
 378         if (ret < 0) {
 379                 return ret;
 380         } else if (ret == 0) {
 381                 dev_err(dev, "Wait for completion timed out.\n");
 382                 return -ETIMEDOUT;
 383         }
 384         return 0;
 385 }
 386
 387 static int mxt_bootloader_read(struct mxt_data *data,
 388                                u8 *val, unsigned int count)
 389 {
 390         int ret;
 391         struct i2c_msg msg;
 392
 393         msg.addr = data->bootloader_addr;
 394         msg.flags = data->client->flags & I2C_M_TEN;
 395         msg.flags |= I2C_M_RD;
 396         msg.len = count;
 397         msg.buf = val;
 398
 399         ret = i2c_transfer(data->client->adapter, &msg, 1);
 400         if (ret == 1) {
 401                 ret = 0;
 402         } else {
 403                 ret = ret < 0 ? ret : -EIO;
 404                 dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
 405                         __func__, ret);
 406         }
 407
 408         return ret;
 409 }
 410
 411 static int mxt_bootloader_write(struct mxt_data *data,
 412                                 const u8 * const val, unsigned int count)
 413 {
 414         int ret;
 415         struct i2c_msg msg;
 416
 417         msg.addr = data->bootloader_addr;
 418         msg.flags = data->client->flags & I2C_M_TEN;
 419         msg.len = count;
 420         msg.buf = (u8 *)val;
 421
 422         ret = i2c_transfer(data->client->adapter, &msg, 1);
 423         if (ret == 1) {
 424                 ret = 0;
 425         } else {
 426                 ret = ret < 0 ? ret : -EIO;
 427                 dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
 428                         __func__, ret);
 429         }
 430
 431         return ret;
 432 }
 433
 434 static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 435 {
 436         u8 appmode = data->client->addr;
 437         u8 bootloader;
 438
 439         switch (appmode) {
 440         case 0x4a:
 441         case 0x4b:
 442                 /* Chips after 1664S use different scheme */
 443                 if (retry || data->info.family_id >= 0xa2) {
 444                         bootloader = appmode - 0x24;
 445                         break;
 446                 }
 447                 /* Fall through for normal case */
 448         case 0x4c:
 449         case 0x4d:
 450         case 0x5a:
 451         case 0x5b:
 452                 bootloader = appmode - 0x26;
 453                 break;
 454
 455         default:
 456                 dev_err(&data->client->dev,
 457                         "Appmode i2c address 0x%02x not found\n",
 458                         appmode);
 459                 return -EINVAL;
 460         }
 461
 462         data->bootloader_addr = bootloader;
 463         return 0;
 464 }
 465
 466 static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
 467 {
 468         struct device *dev = &data->client->dev;
 469         int error;
 470         u8 val;
 471         bool crc_failure;
 472
 473         error = mxt_lookup_bootloader_address(data, alt_address);
 474         if (error)
 475                 return error;
 476
 477         error = mxt_bootloader_read(data, &val, 1);
 478         if (error)
 479                 return error;
 480
 481         /* Check app crc fail mode */
 482         crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
 483
 484         dev_err(dev, "Detected bootloader, status:%02X%s\n",
 485                         val, crc_failure ? ", APP_CRC_FAIL" : "");
 486
 487         return 0;
 488 }
 489
 490 static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
 491 {
 492         struct device *dev = &data->client->dev;
 493         u8 buf[3];
 494
 495         if (val & MXT_BOOT_EXTENDED_ID) {
 496                 if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
 497                         dev_err(dev, "%s: i2c failure\n", __func__);
 498                         return val;
 499                 }
 500
 501                 dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
 502
 503                 return buf[0];
 504         } else {
 505                 dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
 506
 507                 return val;
 508         }
 509 }
 510
 511 static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
 512                                 bool wait)
 513 {
 514         struct device *dev = &data->client->dev;
 515         u8 val;
 516         int ret;
 517
 518 recheck:
 519         if (wait) {
 520                 /*
 521                  * In application update mode, the interrupt
 522                  * line signals state transitions. We must wait for the
 523                  * CHG assertion before reading the status byte.
 524                  * Once the status byte has been read, the line is deasserted.
 525                  */
 526                 ret = mxt_wait_for_completion(data, &data->bl_completion,
 527                                               MXT_FW_CHG_TIMEOUT);
 528                 if (ret) {
 529                         /*
 530                          * TODO: handle -ERESTARTSYS better by terminating
 531                          * fw update process before returning to userspace
 532                          * by writing length 0x000 to device (iff we are in
 533                          * WAITING_FRAME_DATA state).
 534                          */
 535                         dev_err(dev, "Update wait error %d\n", ret);
 536                         return ret;
 537                 }
 538         }
 539
 540         ret = mxt_bootloader_read(data, &val, 1);
 541         if (ret)
 542                 return ret;
 543
 544         if (state == MXT_WAITING_BOOTLOAD_CMD)
 545                 val = mxt_get_bootloader_version(data, val);
 546
 547         switch (state) {
 548         case MXT_WAITING_BOOTLOAD_CMD:
 549         case MXT_WAITING_FRAME_DATA:
 550         case MXT_APP_CRC_FAIL:
 551                 val &= ~MXT_BOOT_STATUS_MASK;
 552                 break;
 553         case MXT_FRAME_CRC_PASS:
 554                 if (val == MXT_FRAME_CRC_CHECK) {
 555                         goto recheck;
 556                 } else if (val == MXT_FRAME_CRC_FAIL) {
 557                         dev_err(dev, "Bootloader CRC fail\n");
 558                         return -EINVAL;
 559                 }
 560                 break;
 561         default:
 562                 return -EINVAL;
 563         }
 564
 565         if (val != state) {
 566                 dev_err(dev, "Invalid bootloader state %02X != %02X\n",
 567                         val, state);
 568                 return -EINVAL;
 569         }
 570
 571         return 0;
 572 }
 573
 574 static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
 575 {
 576         int ret;
 577         u8 buf[2];
 578
 579         if (unlock) {
 580                 buf[0] = MXT_UNLOCK_CMD_LSB;
 581                 buf[1] = MXT_UNLOCK_CMD_MSB;
 582         } else {
 583                 buf[0] = 0x01;
 584                 buf[1] = 0x01;
 585         }
 586
 587         ret = mxt_bootloader_write(data, buf, 2);
 588         if (ret)
 589                 return ret;
 590
 591         return 0;
 592 }
 593
 594 static int __mxt_read_reg(struct i2c_client *client,
 595                                u16 reg, u16 len, void *val)
 596 {
 597         struct i2c_msg xfer[2];
 598         u8 buf[2];
 599         int ret;
 600
 601         buf[0] = reg & 0xff;
 602         buf[1] = (reg >> 8) & 0xff;
 603
 604         /* Write register */
 605         xfer[0].addr = client->addr;
 606         xfer[0].flags = 0;
 607         xfer[0].len = 2;
 608         xfer[0].buf = buf;
 609
 610         /* Read data */
 611         xfer[1].addr = client->addr;
 612         xfer[1].flags = I2C_M_RD;
 613         xfer[1].len = len;
 614         xfer[1].buf = val;
 615
 616         ret = i2c_transfer(client->adapter, xfer, 2);
 617         if (ret == 2) {
 618                 ret = 0;
 619         } else {
 620                 if (ret >= 0)
 621                         ret = -EIO;
 622                 dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
 623                         __func__, ret);
 624         }
 625
 626         return ret;
 627 }
 628
 629 static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
 630                            const void *val)
 631 {
 632         u8 *buf;
 633         size_t count;
 634         int ret;
 635
 636         count = len + 2;
 637         buf = kmalloc(count, GFP_KERNEL);
 638         if (!buf)
 639                 return -ENOMEM;
 640
 641         buf[0] = reg & 0xff;
 642         buf[1] = (reg >> 8) & 0xff;
 643         memcpy(&buf[2], val, len);
 644
 645         ret = i2c_master_send(client, buf, count);
 646         if (ret == count) {
 647                 ret = 0;
 648         } else {
 649                 if (ret >= 0)
 650                         ret = -EIO;
 651                 dev_err(&client->dev, "%s: i2c send failed (%d)\n",
 652                         __func__, ret);
 653         }
 654
 655         kfree(buf);
 656         return ret;
 657 }
 658
 659 static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
 660 {
 661         return __mxt_write_reg(client, reg, 1, &val);
 662 }
 663
 664 static struct mxt_object *
 665 mxt_get_object(struct mxt_data *data, u8 type)
 666 {
 667         struct mxt_object *object;
 668         int i;
 669
 670         for (i = 0; i < data->info.object_num; i++) {
 671                 object = data->object_table + i;
 672                 if (object->type == type)
 673                         return object;
 674         }
 675
 676         dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
 677         return NULL;
 678 }
 679
 680 static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
 681 {
 682         struct device *dev = &data->client->dev;
 683         u8 status = msg[1];
 684         u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
 685
 686         complete(&data->crc_completion);
 687
 688         if (crc != data->config_crc) {
 689                 data->config_crc = crc;
 690                 dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
 691         }
 692
 693         /* Detect reset */
 694         if (status & MXT_T6_STATUS_RESET)
 695                 complete(&data->reset_completion);
 696
 697         /* Output debug if status has changed */
 698         if (status != data->t6_status)
 699                 dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
 700                         status,
 701                         status == 0 ? " OK" : "",
 702                         status & MXT_T6_STATUS_RESET ? " RESET" : "",
 703                         status & MXT_T6_STATUS_OFL ? " OFL" : "",
 704                         status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
 705                         status & MXT_T6_STATUS_CAL ? " CAL" : "",
 706                         status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
 707                         status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
 708
 709         /* Save current status */
 710         data->t6_status = status;
 711 }
 712
 713 static int mxt_write_object(struct mxt_data *data,
 714                                  u8 type, u8 offset, u8 val)
 715 {
 716         struct mxt_object *object;
 717         u16 reg;
 718
 719         object = mxt_get_object(data, type);
 720         if (!object || offset >= mxt_obj_size(object))
 721                 return -EINVAL;
 722
 723         reg = object->start_address;
 724         return mxt_write_reg(data->client, reg + offset, val);
 725 }
 726
 727 static void mxt_input_button(struct mxt_data *data, u8 *message)
 728 {
 729         struct input_dev *input = data->input_dev;
 730         const struct mxt_platform_data *pdata = data->pdata;
 731         int i;
 732
 733         for (i = 0; i < pdata->t19_num_keys; i++) {
 734                 if (pdata->t19_keymap[i] == KEY_RESERVED)
 735                         continue;
 736
 737                 /* Active-low switch */
 738                 input_report_key(input, pdata->t19_keymap[i],
 739                                  !(message[1] & BIT(i)));
 740         }
 741 }
 742
 743 static void mxt_input_sync(struct mxt_data *data)
 744 {
 745         input_mt_report_pointer_emulation(data->input_dev,
 746                                           data->pdata->t19_num_keys);
 747         input_sync(data->input_dev);
 748 }
 749
 750 static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
 751 {
 752         struct device *dev = &data->client->dev;
 753         struct input_dev *input_dev = data->input_dev;
 754         int id;
 755         u8 status;
 756         int x;
 757         int y;
 758         int area;
 759         int amplitude;
 760
 761         id = message[0] - data->T9_reportid_min;
 762         status = message[1];
 763         x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
 764         y = (message[3] << 4) | ((message[4] & 0xf));
 765
 766         /* Handle 10/12 bit switching */
 767         if (data->max_x < 1024)
 768                 x >>= 2;
 769         if (data->max_y < 1024)
 770                 y >>= 2;
 771
 772         area = message[5];
 773         amplitude = message[6];
 774
 775         dev_dbg(dev,
 776                 "[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
 777                 id,
 778                 (status & MXT_T9_DETECT) ? 'D' : '.',
 779                 (status & MXT_T9_PRESS) ? 'P' : '.',
 780                 (status & MXT_T9_RELEASE) ? 'R' : '.',
 781                 (status & MXT_T9_MOVE) ? 'M' : '.',
 782                 (status & MXT_T9_VECTOR) ? 'V' : '.',
 783                 (status & MXT_T9_AMP) ? 'A' : '.',
 784                 (status & MXT_T9_SUPPRESS) ? 'S' : '.',
 785                 (status & MXT_T9_UNGRIP) ? 'U' : '.',
 786                 x, y, area, amplitude);
 787
 788         input_mt_slot(input_dev, id);
 789
 790         if (status & MXT_T9_DETECT) {
 791                 /*
 792                  * Multiple bits may be set if the host is slow to read
 793                  * the status messages, indicating all the events that
 794                  * have happened.
 795                  */
 796                 if (status & MXT_T9_RELEASE) {
 797                         input_mt_report_slot_state(input_dev,
 798                                                    MT_TOOL_FINGER, 0);
 799                         mxt_input_sync(data);
 800                 }
 801
 802                 /* Touch active */
 803                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
 804                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 805                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 806                 input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
 807                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
 808         } else {
 809                 /* Touch no longer active, close out slot */
 810                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 0);
 811         }
 812
 813         data->update_input = true;
 814 }
 815
 816 static void mxt_proc_t100_message(struct mxt_data *data, u8 *message)
 817 {
 818         struct device *dev = &data->client->dev;
 819         struct input_dev *input_dev = data->input_dev;
 820         int id;
 821         u8 status;
 822         u8 type = 0;
 823         u16 x;
 824         u16 y;
 825         int distance = 0;
 826         int tool = 0;
 827         u8 major = 0;
 828         u8 pressure = 0;
 829         u8 orientation = 0;
 830
 831         id = message[0] - data->T100_reportid_min - 2;
 832
 833         /* ignore SCRSTATUS events */
 834         if (id < 0)
 835                 return;
 836
 837         status = message[1];
 838         x = get_unaligned_le16(&message[2]);
 839         y = get_unaligned_le16(&message[4]);
 840
 841         if (status & MXT_T100_DETECT) {
 842                 type = (status & MXT_T100_TYPE_MASK) >> 4;
 843
 844                 switch (type) {
 845                 case MXT_T100_TYPE_HOVERING_FINGER:
 846                         tool = MT_TOOL_FINGER;
 847                         distance = MXT_DISTANCE_HOVERING;
 848
 849                         if (data->t100_aux_vect)
 850                                 orientation = message[data->t100_aux_vect];
 851
 852                         break;
 853
 854                 case MXT_T100_TYPE_FINGER:
 855                 case MXT_T100_TYPE_GLOVE:
 856                         tool = MT_TOOL_FINGER;
 857                         distance = MXT_DISTANCE_ACTIVE_TOUCH;
 858
 859                         if (data->t100_aux_area)
 860                                 major = message[data->t100_aux_area];
 861
 862                         if (data->t100_aux_ampl)
 863                                 pressure = message[data->t100_aux_ampl];
 864
 865                         if (data->t100_aux_vect)
 866                                 orientation = message[data->t100_aux_vect];
 867
 868                         break;
 869
 870                 case MXT_T100_TYPE_PASSIVE_STYLUS:
 871                         tool = MT_TOOL_PEN;
 872
 873                         /*
 874                          * Passive stylus is reported with size zero so
 875                          * hardcode.
 876                          */
 877                         major = MXT_TOUCH_MAJOR_DEFAULT;
 878
 879                         if (data->t100_aux_ampl)
 880                                 pressure = message[data->t100_aux_ampl];
 881
 882                         break;
 883
 884                 case MXT_T100_TYPE_LARGE_TOUCH:
 885                         /* Ignore suppressed touch */
 886                         break;
 887
 888                 default:
 889                         dev_dbg(dev, "Unexpected T100 type\n");
 890                         return;
 891                 }
 892         }
 893
 894         /*
 895          * Values reported should be non-zero if tool is touching the
 896          * device
 897          */
 898         if (!pressure && type != MXT_T100_TYPE_HOVERING_FINGER)
 899                 pressure = MXT_PRESSURE_DEFAULT;
 900
 901         input_mt_slot(input_dev, id);
 902
 903         if (status & MXT_T100_DETECT) {
 904                 dev_dbg(dev, "[%u] type:%u x:%u y:%u a:%02X p:%02X v:%02X\n",
 905                         id, type, x, y, major, pressure, orientation);
 906
 907                 input_mt_report_slot_state(input_dev, tool, 1);
 908                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 909                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 910                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, major);
 911                 input_report_abs(input_dev, ABS_MT_PRESSURE, pressure);
 912                 input_report_abs(input_dev, ABS_MT_DISTANCE, distance);
 913                 input_report_abs(input_dev, ABS_MT_ORIENTATION, orientation);
 914         } else {
 915                 dev_dbg(dev, "[%u] release\n", id);
 916
 917                 /* close out slot */
 918                 input_mt_report_slot_state(input_dev, 0, 0);
 919         }
 920
 921         data->update_input = true;
 922 }
 923
 924 static int mxt_proc_message(struct mxt_data *data, u8 *message)
 925 {
 926         u8 report_id = message[0];
 927
 928         if (report_id == MXT_RPTID_NOMSG)
 929                 return 0;
 930
 931         if (report_id == data->T6_reportid) {
 932                 mxt_proc_t6_messages(data, message);
 933         } else if (!data->input_dev) {
 934                 /*
 935                  * Do not report events if input device
 936                  * is not yet registered.
 937                  */
 938                 mxt_dump_message(data, message);
 939         } else if (report_id >= data->T9_reportid_min &&
 940                    report_id <= data->T9_reportid_max) {
 941                 mxt_proc_t9_message(data, message);
 942         } else if (report_id >= data->T100_reportid_min &&
 943                    report_id <= data->T100_reportid_max) {
 944                 mxt_proc_t100_message(data, message);
 945         } else if (report_id == data->T19_reportid) {
 946                 mxt_input_button(data, message);
 947                 data->update_input = true;
 948         } else {
 949                 mxt_dump_message(data, message);
 950         }
 951
 952         return 1;
 953 }
 954
 955 static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
 956 {
 957         struct device *dev = &data->client->dev;
 958         int ret;
 959         int i;
 960         u8 num_valid = 0;
 961
 962         /* Safety check for msg_buf */
 963         if (count > data->max_reportid)
 964                 return -EINVAL;
 965
 966         /* Process remaining messages if necessary */
 967         ret = __mxt_read_reg(data->client, data->T5_address,
 968                                 data->T5_msg_size * count, data->msg_buf);
 969         if (ret) {
 970                 dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
 971                 return ret;
 972         }
 973
 974         for (i = 0;  i < count; i++) {
 975                 ret = mxt_proc_message(data,
 976                         data->msg_buf + data->T5_msg_size * i);
 977
 978                 if (ret == 1)
 979                         num_valid++;
 980         }
 981
 982         /* return number of messages read */
 983         return num_valid;
 984 }
 985
 986 static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
 987 {
 988         struct device *dev = &data->client->dev;
 989         int ret;
 990         u8 count, num_left;
 991
 992         /* Read T44 and T5 together */
 993         ret = __mxt_read_reg(data->client, data->T44_address,
 994                 data->T5_msg_size + 1, data->msg_buf);
 995         if (ret) {
 996                 dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
 997                 return IRQ_NONE;
 998         }
 999
1000         count = data->msg_buf[0];
1001
1002         /*
1003          * This condition may be caused by the CHG line being configured in
1004          * Mode 0. It results in unnecessary I2C operations but it is benign.
1005          */
1006         if (count == 0)
1007                 return IRQ_NONE;
1008
1009         if (count > data->max_reportid) {
1010                 dev_warn(dev, "T44 count %d exceeded max report id\n", count);
1011                 count = data->max_reportid;
1012         }
1013
1014         /* Process first message */
1015         ret = mxt_proc_message(data, data->msg_buf + 1);
1016         if (ret < 0) {
1017                 dev_warn(dev, "Unexpected invalid message\n");
1018                 return IRQ_NONE;
1019         }
1020
1021         num_left = count - 1;
1022
1023         /* Process remaining messages if necessary */
1024         if (num_left) {
1025                 ret = mxt_read_and_process_messages(data, num_left);
1026                 if (ret < 0)
1027                         goto end;
1028                 else if (ret != num_left)
1029                         dev_warn(dev, "Unexpected invalid message\n");
1030         }
1031
1032 end:
1033         if (data->update_input) {
1034                 mxt_input_sync(data);
1035                 data->update_input = false;
1036         }
1037
1038         return IRQ_HANDLED;
1039 }
1040
1041 static int mxt_process_messages_until_invalid(struct mxt_data *data)
1042 {
1043         struct device *dev = &data->client->dev;
1044         int count, read;
1045         u8 tries = 2;
1046
1047         count = data->max_reportid;
1048
1049         /* Read messages until we force an invalid */
1050         do {
1051                 read = mxt_read_and_process_messages(data, count);
1052                 if (read < count)
1053                         return 0;
1054         } while (--tries);
1055
1056         if (data->update_input) {
1057                 mxt_input_sync(data);
1058                 data->update_input = false;
1059         }
1060
1061         dev_err(dev, "CHG pin isn't cleared\n");
1062         return -EBUSY;
1063 }
1064
1065 static irqreturn_t mxt_process_messages(struct mxt_data *data)
1066 {
1067         int total_handled, num_handled;
1068         u8 count = data->last_message_count;
1069
1070         if (count < 1 || count > data->max_reportid)
1071                 count = 1;
1072
1073         /* include final invalid message */
1074         total_handled = mxt_read_and_process_messages(data, count + 1);
1075         if (total_handled < 0)
1076                 return IRQ_NONE;
1077         /* if there were invalid messages, then we are done */
1078         else if (total_handled <= count)
1079                 goto update_count;
1080
1081         /* keep reading two msgs until one is invalid or reportid limit */
1082         do {
1083                 num_handled = mxt_read_and_process_messages(data, 2);
1084                 if (num_handled < 0)
1085                         return IRQ_NONE;
1086
1087                 total_handled += num_handled;
1088
1089                 if (num_handled < 2)
1090                         break;
1091         } while (total_handled < data->num_touchids);
1092
1093 update_count:
1094         data->last_message_count = total_handled;
1095
1096         if (data->update_input) {
1097                 mxt_input_sync(data);
1098                 data->update_input = false;
1099         }
1100
1101         return IRQ_HANDLED;
1102 }
1103
1104 static irqreturn_t mxt_interrupt(int irq, void *dev_id)
1105 {
1106         struct mxt_data *data = dev_id;
1107
1108         if (data->in_bootloader) {
1109                 /* bootloader state transition completion */
1110                 complete(&data->bl_completion);
1111                 return IRQ_HANDLED;
1112         }
1113
1114         if (!data->object_table)
1115                 return IRQ_HANDLED;
1116
1117         if (data->T44_address) {
1118                 return mxt_process_messages_t44(data);
1119         } else {
1120                 return mxt_process_messages(data);
1121         }
1122 }
1123
1124 static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
1125                           u8 value, bool wait)
1126 {
1127         u16 reg;
1128         u8 command_register;
1129         int timeout_counter = 0;
1130         int ret;
1131
1132         reg = data->T6_address + cmd_offset;
1133
1134         ret = mxt_write_reg(data->client, reg, value);
1135         if (ret)
1136                 return ret;
1137
1138         if (!wait)
1139                 return 0;
1140
1141         do {
1142                 msleep(20);
1143                 ret = __mxt_read_reg(data->client, reg, 1, &command_register);
1144                 if (ret)
1145                         return ret;
1146         } while (command_register != 0 && timeout_counter++ <= 100);
1147
1148         if (timeout_counter > 100) {
1149                 dev_err(&data->client->dev, "Command failed!\n");
1150                 return -EIO;
1151         }
1152
1153         return 0;
1154 }
1155
1156 static int mxt_acquire_irq(struct mxt_data *data)
1157 {
1158         int error;
1159
1160         enable_irq(data->irq);
1161
1162         error = mxt_process_messages_until_invalid(data);
1163         if (error)
1164                 return error;
1165
1166         return 0;
1167 }
1168
1169 static int mxt_soft_reset(struct mxt_data *data)
1170 {
1171         struct device *dev = &data->client->dev;
1172         int ret = 0;
1173
1174         dev_info(dev, "Resetting device\n");
1175
1176         disable_irq(data->irq);
1177
1178         reinit_completion(&data->reset_completion);
1179
1180         ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1181         if (ret)
1182                 return ret;
1183
1184         /* Ignore CHG line for 100ms after reset */
1185         msleep(100);
1186
1187         mxt_acquire_irq(data);
1188
1189         ret = mxt_wait_for_completion(data, &data->reset_completion,
1190                                       MXT_RESET_TIMEOUT);
1191         if (ret)
1192                 return ret;
1193
1194         return 0;
1195 }
1196
1197 static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1198 {
1199         /*
1200          * On failure, CRC is set to 0 and config will always be
1201          * downloaded.
1202          */
1203         data->config_crc = 0;
1204         reinit_completion(&data->crc_completion);
1205
1206         mxt_t6_command(data, cmd, value, true);
1207
1208         /*
1209          * Wait for crc message. On failure, CRC is set to 0 and config will
1210          * always be downloaded.
1211          */
1212         mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1213 }
1214
1215 static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1216 {
1217         static const unsigned int crcpoly = 0x80001B;
1218         u32 result;
1219         u32 data_word;
1220
1221         data_word = (secondbyte << 8) | firstbyte;
1222         result = ((*crc << 1) ^ data_word);
1223
1224         if (result & 0x1000000)
1225                 result ^= crcpoly;
1226
1227         *crc = result;
1228 }
1229
1230 static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1231 {
1232         u32 crc = 0;
1233         u8 *ptr = base + start_off;
1234         u8 *last_val = base + end_off - 1;
1235
1236         if (end_off < start_off)
1237                 return -EINVAL;
1238
1239         while (ptr < last_val) {
1240                 mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1241                 ptr += 2;
1242         }
1243
1244         /* if len is odd, fill the last byte with 0 */
1245         if (ptr == last_val)
1246                 mxt_calc_crc24(&crc, *ptr, 0);
1247
1248         /* Mask to 24-bit */
1249         crc &= 0x00FFFFFF;
1250
1251         return crc;
1252 }
1253
1254 static int mxt_prepare_cfg_mem(struct mxt_data *data,
1255                                const struct firmware *cfg,
1256                                unsigned int data_pos,
1257                                unsigned int cfg_start_ofs,
1258                                u8 *config_mem,
1259                                size_t config_mem_size)
1260 {
1261         struct device *dev = &data->client->dev;
1262         struct mxt_object *object;
1263         unsigned int type, instance, size, byte_offset;
1264         int offset;
1265         int ret;
1266         int i;
1267         u16 reg;
1268         u8 val;
1269
1270         while (data_pos < cfg->size) {
1271                 /* Read type, instance, length */
1272                 ret = sscanf(cfg->data + data_pos, "%x %x %x%n",
1273                              &type, &instance, &size, &offset);
1274                 if (ret == 0) {
1275                         /* EOF */
1276                         break;
1277                 } else if (ret != 3) {
1278                         dev_err(dev, "Bad format: failed to parse object\n");
1279                         return -EINVAL;
1280                 }
1281                 data_pos += offset;
1282
1283                 object = mxt_get_object(data, type);
1284                 if (!object) {
1285                         /* Skip object */
1286                         for (i = 0; i < size; i++) {
1287                                 ret = sscanf(cfg->data + data_pos, "%hhx%n",
1288                                              &val, &offset);
1289                                 if (ret != 1) {
1290                                         dev_err(dev, "Bad format in T%d at %d\n",
1291                                                 type, i);
1292                                         return -EINVAL;
1293                                 }
1294                                 data_pos += offset;
1295                         }
1296                         continue;
1297                 }
1298
1299                 if (size > mxt_obj_size(object)) {
1300                         /*
1301                          * Either we are in fallback mode due to wrong
1302                          * config or config from a later fw version,
1303                          * or the file is corrupt or hand-edited.
1304                          */
1305                         dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1306                                  size - mxt_obj_size(object), type);
1307                 } else if (mxt_obj_size(object) > size) {
1308                         /*
1309                          * If firmware is upgraded, new bytes may be added to
1310                          * end of objects. It is generally forward compatible
1311                          * to zero these bytes - previous behaviour will be
1312                          * retained. However this does invalidate the CRC and
1313                          * will force fallback mode until the configuration is
1314                          * updated. We warn here but do nothing else - the
1315                          * malloc has zeroed the entire configuration.
1316                          */
1317                         dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1318                                  mxt_obj_size(object) - size, type);
1319                 }
1320
1321                 if (instance >= mxt_obj_instances(object)) {
1322                         dev_err(dev, "Object instances exceeded!\n");
1323                         return -EINVAL;
1324                 }
1325
1326                 reg = object->start_address + mxt_obj_size(object) * instance;
1327
1328                 for (i = 0; i < size; i++) {
1329                         ret = sscanf(cfg->data + data_pos, "%hhx%n",
1330                                      &val,
1331                                      &offset);
1332                         if (ret != 1) {
1333                                 dev_err(dev, "Bad format in T%d at %d\n",
1334                                         type, i);
1335                                 return -EINVAL;
1336                         }
1337                         data_pos += offset;
1338
1339                         if (i > mxt_obj_size(object))
1340                                 continue;
1341
1342                         byte_offset = reg + i - cfg_start_ofs;
1343
1344                         if (byte_offset >= 0 && byte_offset < config_mem_size) {
1345                                 *(config_mem + byte_offset) = val;
1346                         } else {
1347                                 dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1348                                         reg, object->type, byte_offset);
1349                                 return -EINVAL;
1350                         }
1351                 }
1352         }
1353
1354         return 0;
1355 }
1356
1357 static int mxt_upload_cfg_mem(struct mxt_data *data, unsigned int cfg_start,
1358                               u8 *config_mem, size_t config_mem_size)
1359 {
1360         unsigned int byte_offset = 0;
1361         int error;
1362
1363         /* Write configuration as blocks */
1364         while (byte_offset < config_mem_size) {
1365                 unsigned int size = config_mem_size - byte_offset;
1366
1367                 if (size > MXT_MAX_BLOCK_WRITE)
1368                         size = MXT_MAX_BLOCK_WRITE;
1369
1370                 error = __mxt_write_reg(data->client,
1371                                         cfg_start + byte_offset,
1372                                         size, config_mem + byte_offset);
1373                 if (error) {
1374                         dev_err(&data->client->dev,
1375                                 "Config write error, ret=%d\n", error);
1376                         return error;
1377                 }
1378
1379                 byte_offset += size;
1380         }
1381
1382         return 0;
1383 }
1384
1385 static int mxt_init_t7_power_cfg(struct mxt_data *data);
1386
1387 /*
1388  * mxt_update_cfg - download configuration to chip
1389  *
1390  * Atmel Raw Config File Format
1391  *
1392  * The first four lines of the raw config file contain:
1393  *  1) Version
1394  *  2) Chip ID Information (first 7 bytes of device memory)
1395  *  3) Chip Information Block 24-bit CRC Checksum
1396  *  4) Chip Configuration 24-bit CRC Checksum
1397  *
1398  * The rest of the file consists of one line per object instance:
1399  *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1400  *
1401  *   <TYPE> - 2-byte object type as hex
1402  *   <INSTANCE> - 2-byte object instance number as hex
1403  *   <SIZE> - 2-byte object size as hex
1404  *   <CONTENTS> - array of <SIZE> 1-byte hex values
1405  */
1406 static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
1407 {
1408         struct device *dev = &data->client->dev;
1409         struct mxt_info cfg_info;
1410         int ret;
1411         int offset;
1412         int data_pos;
1413         int i;
1414         int cfg_start_ofs;
1415         u32 info_crc, config_crc, calculated_crc;
1416         u8 *config_mem;
1417         size_t config_mem_size;
1418
1419         mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1420
1421         if (strncmp(cfg->data, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1422                 dev_err(dev, "Unrecognised config file\n");
1423                 return -EINVAL;
1424         }
1425
1426         data_pos = strlen(MXT_CFG_MAGIC);
1427
1428         /* Load information block and check */
1429         for (i = 0; i < sizeof(struct mxt_info); i++) {
1430                 ret = sscanf(cfg->data + data_pos, "%hhx%n",
1431                              (unsigned char *)&cfg_info + i,
1432                              &offset);
1433                 if (ret != 1) {
1434                         dev_err(dev, "Bad format\n");
1435                         return -EINVAL;
1436                 }
1437
1438                 data_pos += offset;
1439         }
1440
1441         if (cfg_info.family_id != data->info.family_id) {
1442                 dev_err(dev, "Family ID mismatch!\n");
1443                 return -EINVAL;
1444         }
1445
1446         if (cfg_info.variant_id != data->info.variant_id) {
1447                 dev_err(dev, "Variant ID mismatch!\n");
1448                 return -EINVAL;
1449         }
1450
1451         /* Read CRCs */
1452         ret = sscanf(cfg->data + data_pos, "%x%n", &info_crc, &offset);
1453         if (ret != 1) {
1454                 dev_err(dev, "Bad format: failed to parse Info CRC\n");
1455                 return -EINVAL;
1456         }
1457         data_pos += offset;
1458
1459         ret = sscanf(cfg->data + data_pos, "%x%n", &config_crc, &offset);
1460         if (ret != 1) {
1461                 dev_err(dev, "Bad format: failed to parse Config CRC\n");
1462                 return -EINVAL;
1463         }
1464         data_pos += offset;
1465
1466         /*
1467          * The Info Block CRC is calculated over mxt_info and the object
1468          * table. If it does not match then we are trying to load the
1469          * configuration from a different chip or firmware version, so
1470          * the configuration CRC is invalid anyway.
1471          */
1472         if (info_crc == data->info_crc) {
1473                 if (config_crc == 0 || data->config_crc == 0) {
1474                         dev_info(dev, "CRC zero, attempting to apply config\n");
1475                 } else if (config_crc == data->config_crc) {
1476                         dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1477                                  data->config_crc);
1478                         return 0;
1479                 } else {
1480                         dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1481                                  data->config_crc, config_crc);
1482                 }
1483         } else {
1484                 dev_warn(dev,
1485                          "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1486                          data->info_crc, info_crc);
1487         }
1488
1489         /* Malloc memory to store configuration */
1490         cfg_start_ofs = MXT_OBJECT_START +
1491                         data->info.object_num * sizeof(struct mxt_object) +
1492                         MXT_INFO_CHECKSUM_SIZE;
1493         config_mem_size = data->mem_size - cfg_start_ofs;
1494         config_mem = kzalloc(config_mem_size, GFP_KERNEL);
1495         if (!config_mem) {
1496                 dev_err(dev, "Failed to allocate memory\n");
1497                 return -ENOMEM;
1498         }
1499
1500         ret = mxt_prepare_cfg_mem(data, cfg, data_pos, cfg_start_ofs,
1501                                   config_mem, config_mem_size);
1502         if (ret)
1503                 goto release_mem;
1504
1505         /* Calculate crc of the received configs (not the raw config file) */
1506         if (data->T7_address < cfg_start_ofs) {
1507                 dev_err(dev, "Bad T7 address, T7addr = %x, config offset %x\n",
1508                         data->T7_address, cfg_start_ofs);
1509                 ret = 0;
1510                 goto release_mem;
1511         }
1512
1513         calculated_crc = mxt_calculate_crc(config_mem,
1514                                            data->T7_address - cfg_start_ofs,
1515                                            config_mem_size);
1516
1517         if (config_crc > 0 && config_crc != calculated_crc)
1518                 dev_warn(dev, "Config CRC error, calculated=%06X, file=%06X\n",
1519                          calculated_crc, config_crc);
1520
1521         ret = mxt_upload_cfg_mem(data, cfg_start_ofs,
1522                                  config_mem, config_mem_size);
1523         if (ret)
1524                 goto release_mem;
1525
1526         mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1527
1528         ret = mxt_soft_reset(data);
1529         if (ret)
1530                 goto release_mem;
1531
1532         dev_info(dev, "Config successfully updated\n");
1533
1534         /* T7 config may have changed */
1535         mxt_init_t7_power_cfg(data);
1536
1537 release_mem:
1538         kfree(config_mem);
1539         return ret;
1540 }
1541
1542 static int mxt_get_info(struct mxt_data *data)
1543 {
1544         struct i2c_client *client = data->client;
1545         struct mxt_info *info = &data->info;
1546         int error;
1547
1548         /* Read 7-byte info block starting at address 0 */
1549         error = __mxt_read_reg(client, 0, sizeof(*info), info);
1550         if (error)
1551                 return error;
1552
1553         return 0;
1554 }
1555
1556 static void mxt_free_input_device(struct mxt_data *data)
1557 {
1558         if (data->input_dev) {
1559                 input_unregister_device(data->input_dev);
1560                 data->input_dev = NULL;
1561         }
1562 }
1563
1564 static void mxt_free_object_table(struct mxt_data *data)
1565 {
1566 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
1567         video_unregister_device(&data->dbg.vdev);
1568         v4l2_device_unregister(&data->dbg.v4l2);
1569 #endif
1570
1571         kfree(data->object_table);
1572         data->object_table = NULL;
1573         kfree(data->msg_buf);
1574         data->msg_buf = NULL;
1575         data->T5_address = 0;
1576         data->T5_msg_size = 0;
1577         data->T6_reportid = 0;
1578         data->T7_address = 0;
1579         data->T9_reportid_min = 0;
1580         data->T9_reportid_max = 0;
1581         data->T19_reportid = 0;
1582         data->T44_address = 0;
1583         data->T100_reportid_min = 0;
1584         data->T100_reportid_max = 0;
1585         data->max_reportid = 0;
1586 }
1587
1588 static int mxt_get_object_table(struct mxt_data *data)
1589 {
1590         struct i2c_client *client = data->client;
1591         size_t table_size;
1592         struct mxt_object *object_table;
1593         int error;
1594         int i;
1595         u8 reportid;
1596         u16 end_address;
1597
1598         table_size = data->info.object_num * sizeof(struct mxt_object);
1599         object_table = kzalloc(table_size, GFP_KERNEL);
1600         if (!object_table) {
1601                 dev_err(&data->client->dev, "Failed to allocate memory\n");
1602                 return -ENOMEM;
1603         }
1604
1605         error = __mxt_read_reg(client, MXT_OBJECT_START, table_size,
1606                         object_table);
1607         if (error) {
1608                 kfree(object_table);
1609                 return error;
1610         }
1611
1612         /* Valid Report IDs start counting from 1 */
1613         reportid = 1;
1614         data->mem_size = 0;
1615         for (i = 0; i < data->info.object_num; i++) {
1616                 struct mxt_object *object = object_table + i;
1617                 u8 min_id, max_id;
1618
1619                 le16_to_cpus(&object->start_address);
1620
1621                 if (object->num_report_ids) {
1622                         min_id = reportid;
1623                         reportid += object->num_report_ids *
1624                                         mxt_obj_instances(object);
1625                         max_id = reportid - 1;
1626                 } else {
1627                         min_id = 0;
1628                         max_id = 0;
1629                 }
1630
1631                 dev_dbg(&data->client->dev,
1632                         "T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1633                         object->type, object->start_address,
1634                         mxt_obj_size(object), mxt_obj_instances(object),
1635                         min_id, max_id);
1636
1637                 switch (object->type) {
1638                 case MXT_GEN_MESSAGE_T5:
1639                         if (data->info.family_id == 0x80 &&
1640                             data->info.version < 0x20) {
1641                                 /*
1642                                  * On mXT224 firmware versions prior to V2.0
1643                                  * read and discard unused CRC byte otherwise
1644                                  * DMA reads are misaligned.
1645                                  */
1646                                 data->T5_msg_size = mxt_obj_size(object);
1647                         } else {
1648                                 /* CRC not enabled, so skip last byte */
1649                                 data->T5_msg_size = mxt_obj_size(object) - 1;
1650                         }
1651                         data->T5_address = object->start_address;
1652                         break;
1653                 case MXT_GEN_COMMAND_T6:
1654                         data->T6_reportid = min_id;
1655                         data->T6_address = object->start_address;
1656                         break;
1657                 case MXT_GEN_POWER_T7:
1658                         data->T7_address = object->start_address;
1659                         break;
1660                 case MXT_TOUCH_MULTI_T9:
1661                         data->multitouch = MXT_TOUCH_MULTI_T9;
1662                         data->T9_reportid_min = min_id;
1663                         data->T9_reportid_max = max_id;
1664                         data->num_touchids = object->num_report_ids
1665                                                 * mxt_obj_instances(object);
1666                         break;
1667                 case MXT_SPT_MESSAGECOUNT_T44:
1668                         data->T44_address = object->start_address;
1669                         break;
1670                 case MXT_SPT_GPIOPWM_T19:
1671                         data->T19_reportid = min_id;
1672                         break;
1673                 case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1674                         data->multitouch = MXT_TOUCH_MULTITOUCHSCREEN_T100;
1675                         data->T100_reportid_min = min_id;
1676                         data->T100_reportid_max = max_id;
1677                         /* first two report IDs reserved */
1678                         data->num_touchids = object->num_report_ids - 2;
1679                         break;
1680                 }
1681
1682                 end_address = object->start_address
1683                         + mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1684
1685                 if (end_address >= data->mem_size)
1686                         data->mem_size = end_address + 1;
1687         }
1688
1689         /* Store maximum reportid */
1690         data->max_reportid = reportid;
1691
1692         /* If T44 exists, T5 position has to be directly after */
1693         if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1694                 dev_err(&client->dev, "Invalid T44 position\n");
1695                 error = -EINVAL;
1696                 goto free_object_table;
1697         }
1698
1699         data->msg_buf = kcalloc(data->max_reportid,
1700                                 data->T5_msg_size, GFP_KERNEL);
1701         if (!data->msg_buf) {
1702                 dev_err(&client->dev, "Failed to allocate message buffer\n");
1703                 error = -ENOMEM;
1704                 goto free_object_table;
1705         }
1706
1707         data->object_table = object_table;
1708
1709         return 0;
1710
1711 free_object_table:
1712         mxt_free_object_table(data);
1713         return error;
1714 }
1715
1716 static int mxt_read_t9_resolution(struct mxt_data *data)
1717 {
1718         struct i2c_client *client = data->client;
1719         int error;
1720         struct t9_range range;
1721         unsigned char orient;
1722         struct mxt_object *object;
1723
1724         object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1725         if (!object)
1726                 return -EINVAL;
1727
1728         error = __mxt_read_reg(client,
1729                                object->start_address + MXT_T9_XSIZE,
1730                                sizeof(data->xsize), &data->xsize);
1731         if (error)
1732                 return error;
1733
1734         error = __mxt_read_reg(client,
1735                                object->start_address + MXT_T9_YSIZE,
1736                                sizeof(data->ysize), &data->ysize);
1737         if (error)
1738                 return error;
1739
1740         error = __mxt_read_reg(client,
1741                                object->start_address + MXT_T9_RANGE,
1742                                sizeof(range), &range);
1743         if (error)
1744                 return error;
1745
1746         data->max_x = get_unaligned_le16(&range.x);
1747         data->max_y = get_unaligned_le16(&range.y);
1748
1749         error =  __mxt_read_reg(client,
1750                                 object->start_address + MXT_T9_ORIENT,
1751                                 1, &orient);
1752         if (error)
1753                 return error;
1754
1755         data->xy_switch = orient & MXT_T9_ORIENT_SWITCH;
1756         data->invertx = orient & MXT_T9_ORIENT_INVERTX;
1757         data->inverty = orient & MXT_T9_ORIENT_INVERTY;
1758
1759         return 0;
1760 }
1761
1762 static int mxt_read_t100_config(struct mxt_data *data)
1763 {
1764         struct i2c_client *client = data->client;
1765         int error;
1766         struct mxt_object *object;
1767         u16 range_x, range_y;
1768         u8 cfg, tchaux;
1769         u8 aux;
1770
1771         object = mxt_get_object(data, MXT_TOUCH_MULTITOUCHSCREEN_T100);
1772         if (!object)
1773                 return -EINVAL;
1774
1775         /* read touchscreen dimensions */
1776         error = __mxt_read_reg(client,
1777                                object->start_address + MXT_T100_XRANGE,
1778                                sizeof(range_x), &range_x);
1779         if (error)
1780                 return error;
1781
1782         data->max_x = get_unaligned_le16(&range_x);
1783
1784         error = __mxt_read_reg(client,
1785                                object->start_address + MXT_T100_YRANGE,
1786                                sizeof(range_y), &range_y);
1787         if (error)
1788                 return error;
1789
1790         data->max_y = get_unaligned_le16(&range_y);
1791
1792         error = __mxt_read_reg(client,
1793                                object->start_address + MXT_T100_XSIZE,
1794                                sizeof(data->xsize), &data->xsize);
1795         if (error)
1796                 return error;
1797
1798         error = __mxt_read_reg(client,
1799                                object->start_address + MXT_T100_YSIZE,
1800                                sizeof(data->ysize), &data->ysize);
1801         if (error)
1802                 return error;
1803
1804         /* read orientation config */
1805         error =  __mxt_read_reg(client,
1806                                 object->start_address + MXT_T100_CFG1,
1807                                 1, &cfg);
1808         if (error)
1809                 return error;
1810
1811         data->xy_switch = cfg & MXT_T100_CFG_SWITCHXY;
1812         data->invertx = cfg & MXT_T100_CFG_INVERTX;
1813         data->inverty = cfg & MXT_T100_CFG_INVERTY;
1814
1815         /* allocate aux bytes */
1816         error =  __mxt_read_reg(client,
1817                                 object->start_address + MXT_T100_TCHAUX,
1818                                 1, &tchaux);
1819         if (error)
1820                 return error;
1821
1822         aux = 6;
1823
1824         if (tchaux & MXT_T100_TCHAUX_VECT)
1825                 data->t100_aux_vect = aux++;
1826
1827         if (tchaux & MXT_T100_TCHAUX_AMPL)
1828                 data->t100_aux_ampl = aux++;
1829
1830         if (tchaux & MXT_T100_TCHAUX_AREA)
1831                 data->t100_aux_area = aux++;
1832
1833         dev_dbg(&client->dev,
1834                 "T100 aux mappings vect:%u ampl:%u area:%u\n",
1835                 data->t100_aux_vect, data->t100_aux_ampl, data->t100_aux_area);
1836
1837         return 0;
1838 }
1839
1840 static int mxt_input_open(struct input_dev *dev);
1841 static void mxt_input_close(struct input_dev *dev);
1842
1843 static void mxt_set_up_as_touchpad(struct input_dev *input_dev,
1844                                    struct mxt_data *data)
1845 {
1846         const struct mxt_platform_data *pdata = data->pdata;
1847         int i;
1848
1849         input_dev->name = "Atmel maXTouch Touchpad";
1850
1851         __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1852
1853         input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1854         input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1855         input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1856                           MXT_PIXELS_PER_MM);
1857         input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1858                           MXT_PIXELS_PER_MM);
1859
1860         for (i = 0; i < pdata->t19_num_keys; i++)
1861                 if (pdata->t19_keymap[i] != KEY_RESERVED)
1862                         input_set_capability(input_dev, EV_KEY,
1863                                              pdata->t19_keymap[i]);
1864 }
1865
1866 static int mxt_initialize_input_device(struct mxt_data *data)
1867 {
1868         const struct mxt_platform_data *pdata = data->pdata;
1869         struct device *dev = &data->client->dev;
1870         struct input_dev *input_dev;
1871         int error;
1872         unsigned int num_mt_slots;
1873         unsigned int mt_flags = 0;
1874
1875         switch (data->multitouch) {
1876         case MXT_TOUCH_MULTI_T9:
1877                 num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
1878                 error = mxt_read_t9_resolution(data);
1879                 if (error)
1880                         dev_warn(dev, "Failed to initialize T9 resolution\n");
1881                 break;
1882
1883         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1884                 num_mt_slots = data->num_touchids;
1885                 error = mxt_read_t100_config(data);
1886                 if (error)
1887                         dev_warn(dev, "Failed to read T100 config\n");
1888                 break;
1889
1890         default:
1891                 dev_err(dev, "Invalid multitouch object\n");
1892                 return -EINVAL;
1893         }
1894
1895         /* Handle default values and orientation switch */
1896         if (data->max_x == 0)
1897                 data->max_x = 1023;
1898
1899         if (data->max_y == 0)
1900                 data->max_y = 1023;
1901
1902         if (data->xy_switch)
1903                 swap(data->max_x, data->max_y);
1904
1905         dev_info(dev, "Touchscreen size X%uY%u\n", data->max_x, data->max_y);
1906
1907         /* Register input device */
1908         input_dev = input_allocate_device();
1909         if (!input_dev) {
1910                 dev_err(dev, "Failed to allocate memory\n");
1911                 return -ENOMEM;
1912         }
1913
1914         input_dev->name = "Atmel maXTouch Touchscreen";
1915         input_dev->phys = data->phys;
1916         input_dev->id.bustype = BUS_I2C;
1917         input_dev->dev.parent = dev;
1918         input_dev->open = mxt_input_open;
1919         input_dev->close = mxt_input_close;
1920
1921         input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
1922
1923         /* For single touch */
1924         input_set_abs_params(input_dev, ABS_X, 0, data->max_x, 0, 0);
1925         input_set_abs_params(input_dev, ABS_Y, 0, data->max_y, 0, 0);
1926
1927         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
1928             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1929              data->t100_aux_ampl)) {
1930                 input_set_abs_params(input_dev, ABS_PRESSURE, 0, 255, 0, 0);
1931         }
1932
1933         /* If device has buttons we assume it is a touchpad */
1934         if (pdata->t19_num_keys) {
1935                 mxt_set_up_as_touchpad(input_dev, data);
1936                 mt_flags |= INPUT_MT_POINTER;
1937         } else {
1938                 mt_flags |= INPUT_MT_DIRECT;
1939         }
1940
1941         /* For multi touch */
1942         error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
1943         if (error) {
1944                 dev_err(dev, "Error %d initialising slots\n", error);
1945                 goto err_free_mem;
1946         }
1947
1948         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100) {
1949                 input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
1950                                      0, MT_TOOL_MAX, 0, 0);
1951                 input_set_abs_params(input_dev, ABS_MT_DISTANCE,
1952                                      MXT_DISTANCE_ACTIVE_TOUCH,
1953                                      MXT_DISTANCE_HOVERING,
1954                                      0, 0);
1955         }
1956
1957         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
1958                              0, data->max_x, 0, 0);
1959         input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
1960                              0, data->max_y, 0, 0);
1961
1962         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
1963             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1964              data->t100_aux_area)) {
1965                 input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
1966                                      0, MXT_MAX_AREA, 0, 0);
1967         }
1968
1969         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
1970             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1971              data->t100_aux_ampl)) {
1972                 input_set_abs_params(input_dev, ABS_MT_PRESSURE,
1973                                      0, 255, 0, 0);
1974         }
1975
1976         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1977             data->t100_aux_vect) {
1978                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
1979                                      0, 255, 0, 0);
1980         }
1981
1982         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1983             data->t100_aux_ampl) {
1984                 input_set_abs_params(input_dev, ABS_MT_PRESSURE,
1985                                      0, 255, 0, 0);
1986         }
1987
1988         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
1989             data->t100_aux_vect) {
1990                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
1991                                      0, 255, 0, 0);
1992         }
1993
1994         input_set_drvdata(input_dev, data);
1995
1996         error = input_register_device(input_dev);
1997         if (error) {
1998                 dev_err(dev, "Error %d registering input device\n", error);
1999                 goto err_free_mem;
2000         }
2001
2002         data->input_dev = input_dev;
2003
2004         return 0;
2005
2006 err_free_mem:
2007         input_free_device(input_dev);
2008         return error;
2009 }
2010
2011 static int mxt_configure_objects(struct mxt_data *data,
2012                                  const struct firmware *cfg);
2013
2014 static void mxt_config_cb(const struct firmware *cfg, void *ctx)
2015 {
2016         mxt_configure_objects(ctx, cfg);
2017         release_firmware(cfg);
2018 }
2019
2020 static int mxt_initialize(struct mxt_data *data)
2021 {
2022         struct i2c_client *client = data->client;
2023         int recovery_attempts = 0;
2024         int error;
2025
2026         while (1) {
2027                 error = mxt_get_info(data);
2028                 if (!error)
2029                         break;
2030
2031                 /* Check bootloader state */
2032                 error = mxt_probe_bootloader(data, false);
2033                 if (error) {
2034                         dev_info(&client->dev, "Trying alternate bootloader address\n");
2035                         error = mxt_probe_bootloader(data, true);
2036                         if (error) {
2037                                 /* Chip is not in appmode or bootloader mode */
2038                                 return error;
2039                         }
2040                 }
2041
2042                 /* OK, we are in bootloader, see if we can recover */
2043                 if (++recovery_attempts > 1) {
2044                         dev_err(&client->dev, "Could not recover from bootloader mode\n");
2045                         /*
2046                          * We can reflash from this state, so do not
2047                          * abort initialization.
2048                          */
2049                         data->in_bootloader = true;
2050                         return 0;
2051                 }
2052
2053                 /* Attempt to exit bootloader into app mode */
2054                 mxt_send_bootloader_cmd(data, false);
2055                 msleep(MXT_FW_RESET_TIME);
2056         }
2057
2058         /* Get object table information */
2059         error = mxt_get_object_table(data);
2060         if (error) {
2061                 dev_err(&client->dev, "Error %d reading object table\n", error);
2062                 return error;
2063         }
2064
2065         error = mxt_acquire_irq(data);
2066         if (error)
2067                 goto err_free_object_table;
2068
2069         error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
2070                                         &client->dev, GFP_KERNEL, data,
2071                                         mxt_config_cb);
2072         if (error) {
2073                 dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
2074                         error);
2075                 goto err_free_object_table;
2076         }
2077
2078         return 0;
2079
2080 err_free_object_table:
2081         mxt_free_object_table(data);
2082         return error;
2083 }
2084
2085 static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
2086 {
2087         struct device *dev = &data->client->dev;
2088         int error;
2089         struct t7_config *new_config;
2090         struct t7_config deepsleep = { .active = 0, .idle = 0 };
2091
2092         if (sleep == MXT_POWER_CFG_DEEPSLEEP)
2093                 new_config = &deepsleep;
2094         else
2095                 new_config = &data->t7_cfg;
2096
2097         error = __mxt_write_reg(data->client, data->T7_address,
2098                                 sizeof(data->t7_cfg), new_config);
2099         if (error)
2100                 return error;
2101
2102         dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
2103                 new_config->active, new_config->idle);
2104
2105         return 0;
2106 }
2107
2108 static int mxt_init_t7_power_cfg(struct mxt_data *data)
2109 {
2110         struct device *dev = &data->client->dev;
2111         int error;
2112         bool retry = false;
2113
2114 recheck:
2115         error = __mxt_read_reg(data->client, data->T7_address,
2116                                 sizeof(data->t7_cfg), &data->t7_cfg);
2117         if (error)
2118                 return error;
2119
2120         if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
2121                 if (!retry) {
2122                         dev_dbg(dev, "T7 cfg zero, resetting\n");
2123                         mxt_soft_reset(data);
2124                         retry = true;
2125                         goto recheck;
2126                 } else {
2127                         dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
2128                         data->t7_cfg.active = 20;
2129                         data->t7_cfg.idle = 100;
2130                         return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2131                 }
2132         }
2133
2134         dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
2135                 data->t7_cfg.active, data->t7_cfg.idle);
2136         return 0;
2137 }
2138
2139 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
2140 static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
2141                                unsigned int y)
2142 {
2143         struct mxt_dbg *dbg = &data->dbg;
2144         unsigned int ofs, page;
2145
2146         ofs = (y + (x * data->info.matrix_ysize)) * sizeof(u16);
2147         page = ofs / MXT_DIAGNOSTIC_SIZE;
2148         ofs %= MXT_DIAGNOSTIC_SIZE;
2149
2150         return get_unaligned_le16(&dbg->t37_buf[page].data[ofs]);
2151 }
2152
2153 static int mxt_convert_debug_pages(struct mxt_data *data, u16 *outbuf)
2154 {
2155         struct mxt_dbg *dbg = &data->dbg;
2156         unsigned int x = 0;
2157         unsigned int y = 0;
2158         unsigned int i, rx, ry;
2159
2160         for (i = 0; i < dbg->t37_nodes; i++) {
2161                 /* Handle orientation */
2162                 rx = data->xy_switch ? y : x;
2163                 ry = data->xy_switch ? x : y;
2164                 rx = data->invertx ? (data->xsize - 1 - rx) : rx;
2165                 ry = data->inverty ? (data->ysize - 1 - ry) : ry;
2166
2167                 outbuf[i] = mxt_get_debug_value(data, rx, ry);
2168
2169                 /* Next value */
2170                 if (++x >= (data->xy_switch ? data->ysize : data->xsize)) {
2171                         x = 0;
2172                         y++;
2173                 }
2174         }
2175
2176         return 0;
2177 }
2178
2179 static int mxt_read_diagnostic_debug(struct mxt_data *data, u8 mode,
2180                                      u16 *outbuf)
2181 {
2182         struct mxt_dbg *dbg = &data->dbg;
2183         int retries = 0;
2184         int page;
2185         int ret;
2186         u8 cmd = mode;
2187         struct t37_debug *p;
2188         u8 cmd_poll;
2189
2190         for (page = 0; page < dbg->t37_pages; page++) {
2191                 p = dbg->t37_buf + page;
2192
2193                 ret = mxt_write_reg(data->client, dbg->diag_cmd_address,
2194                                     cmd);
2195                 if (ret)
2196                         return ret;
2197
2198                 retries = 0;
2199                 msleep(20);
2200 wait_cmd:
2201                 /* Read back command byte */
2202                 ret = __mxt_read_reg(data->client, dbg->diag_cmd_address,
2203                                      sizeof(cmd_poll), &cmd_poll);
2204                 if (ret)
2205                         return ret;
2206
2207                 /* Field is cleared once the command has been processed */
2208                 if (cmd_poll) {
2209                         if (retries++ > 100)
2210                                 return -EINVAL;
2211
2212                         msleep(20);
2213                         goto wait_cmd;
2214                 }
2215
2216                 /* Read T37 page */
2217                 ret = __mxt_read_reg(data->client, dbg->t37_address,
2218                                      sizeof(struct t37_debug), p);
2219                 if (ret)
2220                         return ret;
2221
2222                 if (p->mode != mode || p->page != page) {
2223                         dev_err(&data->client->dev, "T37 page mismatch\n");
2224                         return -EINVAL;
2225                 }
2226
2227                 dev_dbg(&data->client->dev, "%s page:%d retries:%d\n",
2228                         __func__, page, retries);
2229
2230                 /* For remaining pages, write PAGEUP rather than mode */
2231                 cmd = MXT_DIAGNOSTIC_PAGEUP;
2232         }
2233
2234         return mxt_convert_debug_pages(data, outbuf);
2235 }
2236
2237 static int mxt_queue_setup(struct vb2_queue *q,
2238                        unsigned int *nbuffers, unsigned int *nplanes,
2239                        unsigned int sizes[], struct device *alloc_devs[])
2240 {
2241         struct mxt_data *data = q->drv_priv;
2242         size_t size = data->dbg.t37_nodes * sizeof(u16);
2243
2244         if (*nplanes)
2245                 return sizes[0] < size ? -EINVAL : 0;
2246
2247         *nplanes = 1;
2248         sizes[0] = size;
2249
2250         return 0;
2251 }
2252
2253 static void mxt_buffer_queue(struct vb2_buffer *vb)
2254 {
2255         struct mxt_data *data = vb2_get_drv_priv(vb->vb2_queue);
2256         u16 *ptr;
2257         int ret;
2258
2259         ptr = vb2_plane_vaddr(vb, 0);
2260         if (!ptr) {
2261                 dev_err(&data->client->dev, "Error acquiring frame ptr\n");
2262                 goto fault;
2263         }
2264
2265         ret = mxt_read_diagnostic_debug(data, MXT_DIAGNOSTIC_DELTAS, ptr);
2266         if (ret)
2267                 goto fault;
2268
2269         vb2_set_plane_payload(vb, 0, data->dbg.t37_nodes * sizeof(u16));
2270         vb2_buffer_done(vb, VB2_BUF_STATE_DONE);
2271         return;
2272
2273 fault:
2274         vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
2275 }
2276
2277 /* V4L2 structures */
2278 static const struct vb2_ops mxt_queue_ops = {
2279         .queue_setup            = mxt_queue_setup,
2280         .buf_queue              = mxt_buffer_queue,
2281         .wait_prepare           = vb2_ops_wait_prepare,
2282         .wait_finish            = vb2_ops_wait_finish,
2283 };
2284
2285 static const struct vb2_queue mxt_queue = {
2286         .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
2287         .io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
2288         .buf_struct_size = sizeof(struct mxt_vb2_buffer),
2289         .ops = &mxt_queue_ops,
2290         .mem_ops = &vb2_vmalloc_memops,
2291         .timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
2292         .min_buffers_needed = 1,
2293 };
2294
2295 static int mxt_vidioc_querycap(struct file *file, void *priv,
2296                                  struct v4l2_capability *cap)
2297 {
2298         struct mxt_data *data = video_drvdata(file);
2299
2300         strlcpy(cap->driver, "atmel_mxt_ts", sizeof(cap->driver));
2301         strlcpy(cap->card, "atmel_mxt_ts touch", sizeof(cap->card));
2302         snprintf(cap->bus_info, sizeof(cap->bus_info),
2303                  "I2C:%s", dev_name(&data->client->dev));
2304         return 0;
2305 }
2306
2307 static int mxt_vidioc_enum_input(struct file *file, void *priv,
2308                                    struct v4l2_input *i)
2309 {
2310         if (i->index > 0)
2311                 return -EINVAL;
2312
2313         i->type = V4L2_INPUT_TYPE_TOUCH;
2314         strlcpy(i->name, "Mutual Capacitance Deltas", sizeof(i->name));
2315         return 0;
2316 }
2317
2318 static int mxt_set_input(struct mxt_data *data, unsigned int i)
2319 {
2320         struct v4l2_pix_format *f = &data->dbg.format;
2321
2322         if (i > 0)
2323                 return -EINVAL;
2324
2325         f->width = data->xy_switch ? data->ysize : data->xsize;
2326         f->height = data->xy_switch ? data->xsize : data->ysize;
2327         f->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2328         f->field = V4L2_FIELD_NONE;
2329         f->colorspace = V4L2_COLORSPACE_RAW;
2330         f->bytesperline = f->width * sizeof(u16);
2331         f->sizeimage = f->width * f->height * sizeof(u16);
2332
2333         data->dbg.input = i;
2334
2335         return 0;
2336 }
2337
2338 static int mxt_vidioc_s_input(struct file *file, void *priv, unsigned int i)
2339 {
2340         return mxt_set_input(video_drvdata(file), i);
2341 }
2342
2343 static int mxt_vidioc_g_input(struct file *file, void *priv, unsigned int *i)
2344 {
2345         struct mxt_data *data = video_drvdata(file);
2346
2347         *i = data->dbg.input;
2348
2349         return 0;
2350 }
2351
2352 static int mxt_vidioc_fmt(struct file *file, void *priv, struct v4l2_format *f)
2353 {
2354         struct mxt_data *data = video_drvdata(file);
2355
2356         f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
2357         f->fmt.pix = data->dbg.format;
2358
2359         return 0;
2360 }
2361
2362 static int mxt_vidioc_enum_fmt(struct file *file, void *priv,
2363                                  struct v4l2_fmtdesc *fmt)
2364 {
2365         if (fmt->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2366                 return -EINVAL;
2367
2368         fmt->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2369         return 0;
2370 }
2371
2372 static int mxt_vidioc_g_parm(struct file *file, void *fh,
2373                              struct v4l2_streamparm *a)
2374 {
2375         if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2376                 return -EINVAL;
2377
2378         a->parm.capture.readbuffers = 1;
2379         a->parm.capture.timeperframe.numerator = 1;
2380         a->parm.capture.timeperframe.denominator = 10;
2381         return 0;
2382 }
2383
2384 static const struct v4l2_ioctl_ops mxt_video_ioctl_ops = {
2385         .vidioc_querycap        = mxt_vidioc_querycap,
2386
2387         .vidioc_enum_fmt_vid_cap = mxt_vidioc_enum_fmt,
2388         .vidioc_s_fmt_vid_cap   = mxt_vidioc_fmt,
2389         .vidioc_g_fmt_vid_cap   = mxt_vidioc_fmt,
2390         .vidioc_try_fmt_vid_cap = mxt_vidioc_fmt,
2391         .vidioc_g_parm          = mxt_vidioc_g_parm,
2392
2393         .vidioc_enum_input      = mxt_vidioc_enum_input,
2394         .vidioc_g_input         = mxt_vidioc_g_input,
2395         .vidioc_s_input         = mxt_vidioc_s_input,
2396
2397         .vidioc_reqbufs         = vb2_ioctl_reqbufs,
2398         .vidioc_create_bufs     = vb2_ioctl_create_bufs,
2399         .vidioc_querybuf        = vb2_ioctl_querybuf,
2400         .vidioc_qbuf            = vb2_ioctl_qbuf,
2401         .vidioc_dqbuf           = vb2_ioctl_dqbuf,
2402         .vidioc_expbuf          = vb2_ioctl_expbuf,
2403
2404         .vidioc_streamon        = vb2_ioctl_streamon,
2405         .vidioc_streamoff       = vb2_ioctl_streamoff,
2406 };
2407
2408 static const struct video_device mxt_video_device = {
2409         .name = "Atmel maxTouch",
2410         .fops = &mxt_video_fops,
2411         .ioctl_ops = &mxt_video_ioctl_ops,
2412         .release = video_device_release_empty,
2413         .device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TOUCH |
2414                        V4L2_CAP_READWRITE | V4L2_CAP_STREAMING,
2415 };
2416
2417 static void mxt_debug_init(struct mxt_data *data)
2418 {
2419         struct mxt_dbg *dbg = &data->dbg;
2420         struct mxt_object *object;
2421         int error;
2422
2423         object = mxt_get_object(data, MXT_GEN_COMMAND_T6);
2424         if (!object)
2425                 goto error;
2426
2427         dbg->diag_cmd_address = object->start_address + MXT_COMMAND_DIAGNOSTIC;
2428
2429         object = mxt_get_object(data, MXT_DEBUG_DIAGNOSTIC_T37);
2430         if (!object)
2431                 goto error;
2432
2433         if (mxt_obj_size(object) != sizeof(struct t37_debug)) {
2434                 dev_warn(&data->client->dev, "Bad T37 size");
2435                 goto error;
2436         }
2437
2438         dbg->t37_address = object->start_address;
2439
2440         /* Calculate size of data and allocate buffer */
2441         dbg->t37_nodes = data->xsize * data->ysize;
2442         dbg->t37_pages = DIV_ROUND_UP(data->xsize * data->info.matrix_ysize *
2443                                       sizeof(u16), sizeof(dbg->t37_buf->data));
2444
2445         dbg->t37_buf = devm_kmalloc_array(&data->client->dev, dbg->t37_pages,
2446                                           sizeof(struct t37_debug), GFP_KERNEL);
2447         if (!dbg->t37_buf)
2448                 goto error;
2449
2450         /* init channel to zero */
2451         mxt_set_input(data, 0);
2452
2453         /* register video device */
2454         snprintf(dbg->v4l2.name, sizeof(dbg->v4l2.name), "%s", "atmel_mxt_ts");
2455         error = v4l2_device_register(&data->client->dev, &dbg->v4l2);
2456         if (error)
2457                 goto error;
2458
2459         /* initialize the queue */
2460         mutex_init(&dbg->lock);
2461         dbg->queue = mxt_queue;
2462         dbg->queue.drv_priv = data;
2463         dbg->queue.lock = &dbg->lock;
2464         dbg->queue.dev = &data->client->dev;
2465
2466         error = vb2_queue_init(&dbg->queue);
2467         if (error)
2468                 goto error_unreg_v4l2;
2469
2470         dbg->vdev = mxt_video_device;
2471         dbg->vdev.v4l2_dev = &dbg->v4l2;
2472         dbg->vdev.lock = &dbg->lock;
2473         dbg->vdev.vfl_dir = VFL_DIR_RX;
2474         dbg->vdev.queue = &dbg->queue;
2475         video_set_drvdata(&dbg->vdev, data);
2476
2477         error = video_register_device(&dbg->vdev, VFL_TYPE_TOUCH, -1);
2478         if (error)
2479                 goto error_unreg_v4l2;
2480
2481         return;
2482
2483 error_unreg_v4l2:
2484         v4l2_device_unregister(&dbg->v4l2);
2485 error:
2486         dev_warn(&data->client->dev, "Error initializing T37\n");
2487 }
2488 #else
2489 static void mxt_debug_init(struct mxt_data *data)
2490 {
2491 }
2492 #endif
2493
2494 static int mxt_configure_objects(struct mxt_data *data,
2495                                  const struct firmware *cfg)
2496 {
2497         struct device *dev = &data->client->dev;
2498         struct mxt_info *info = &data->info;
2499         int error;
2500
2501         error = mxt_init_t7_power_cfg(data);
2502         if (error) {
2503                 dev_err(dev, "Failed to initialize power cfg\n");
2504                 return error;
2505         }
2506
2507         if (cfg) {
2508                 error = mxt_update_cfg(data, cfg);
2509                 if (error)
2510                         dev_warn(dev, "Error %d updating config\n", error);
2511         }
2512
2513         if (data->multitouch) {
2514                 error = mxt_initialize_input_device(data);
2515                 if (error)
2516                         return error;
2517         } else {
2518                 dev_warn(dev, "No touch object detected\n");
2519         }
2520
2521         mxt_debug_init(data);
2522
2523         dev_info(dev,
2524                  "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
2525                  info->family_id, info->variant_id, info->version >> 4,
2526                  info->version & 0xf, info->build, info->object_num);
2527
2528         return 0;
2529 }
2530
2531 /* Firmware Version is returned as Major.Minor.Build */
2532 static ssize_t mxt_fw_version_show(struct device *dev,
2533                                    struct device_attribute *attr, char *buf)
2534 {
2535         struct mxt_data *data = dev_get_drvdata(dev);
2536         struct mxt_info *info = &data->info;
2537         return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
2538                          info->version >> 4, info->version & 0xf, info->build);
2539 }
2540
2541 /* Hardware Version is returned as FamilyID.VariantID */
2542 static ssize_t mxt_hw_version_show(struct device *dev,
2543                                    struct device_attribute *attr, char *buf)
2544 {
2545         struct mxt_data *data = dev_get_drvdata(dev);
2546         struct mxt_info *info = &data->info;
2547         return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
2548                          info->family_id, info->variant_id);
2549 }
2550
2551 static ssize_t mxt_show_instance(char *buf, int count,
2552                                  struct mxt_object *object, int instance,
2553                                  const u8 *val)
2554 {
2555         int i;
2556
2557         if (mxt_obj_instances(object) > 1)
2558                 count += scnprintf(buf + count, PAGE_SIZE - count,
2559                                    "Instance %u\n", instance);
2560
2561         for (i = 0; i < mxt_obj_size(object); i++)
2562                 count += scnprintf(buf + count, PAGE_SIZE - count,
2563                                 "\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
2564         count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
2565
2566         return count;
2567 }
2568
2569 static ssize_t mxt_object_show(struct device *dev,
2570                                     struct device_attribute *attr, char *buf)
2571 {
2572         struct mxt_data *data = dev_get_drvdata(dev);
2573         struct mxt_object *object;
2574         int count = 0;
2575         int i, j;
2576         int error;
2577         u8 *obuf;
2578
2579         /* Pre-allocate buffer large enough to hold max sized object. */
2580         obuf = kmalloc(256, GFP_KERNEL);
2581         if (!obuf)
2582                 return -ENOMEM;
2583
2584         error = 0;
2585         for (i = 0; i < data->info.object_num; i++) {
2586                 object = data->object_table + i;
2587
2588                 if (!mxt_object_readable(object->type))
2589                         continue;
2590
2591                 count += scnprintf(buf + count, PAGE_SIZE - count,
2592                                 "T%u:\n", object->type);
2593
2594                 for (j = 0; j < mxt_obj_instances(object); j++) {
2595                         u16 size = mxt_obj_size(object);
2596                         u16 addr = object->start_address + j * size;
2597
2598                         error = __mxt_read_reg(data->client, addr, size, obuf);
2599                         if (error)
2600                                 goto done;
2601
2602                         count = mxt_show_instance(buf, count, object, j, obuf);
2603                 }
2604         }
2605
2606 done:
2607         kfree(obuf);
2608         return error ?: count;
2609 }
2610
2611 static int mxt_check_firmware_format(struct device *dev,
2612                                      const struct firmware *fw)
2613 {
2614         unsigned int pos = 0;
2615         char c;
2616
2617         while (pos < fw->size) {
2618                 c = *(fw->data + pos);
2619
2620                 if (c < '0' || (c > '9' && c < 'A') || c > 'F')
2621                         return 0;
2622
2623                 pos++;
2624         }
2625
2626         /*
2627          * To convert file try:
2628          * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
2629          */
2630         dev_err(dev, "Aborting: firmware file must be in binary format\n");
2631
2632         return -EINVAL;
2633 }
2634
2635 static int mxt_load_fw(struct device *dev, const char *fn)
2636 {
2637         struct mxt_data *data = dev_get_drvdata(dev);
2638         const struct firmware *fw = NULL;
2639         unsigned int frame_size;
2640         unsigned int pos = 0;
2641         unsigned int retry = 0;
2642         unsigned int frame = 0;
2643         int ret;
2644
2645         ret = request_firmware(&fw, fn, dev);
2646         if (ret) {
2647                 dev_err(dev, "Unable to open firmware %s\n", fn);
2648                 return ret;
2649         }
2650
2651         /* Check for incorrect enc file */
2652         ret = mxt_check_firmware_format(dev, fw);
2653         if (ret)
2654                 goto release_firmware;
2655
2656         if (!data->in_bootloader) {
2657                 /* Change to the bootloader mode */
2658                 data->in_bootloader = true;
2659
2660                 ret = mxt_t6_command(data, MXT_COMMAND_RESET,
2661                                      MXT_BOOT_VALUE, false);
2662                 if (ret)
2663                         goto release_firmware;
2664
2665                 msleep(MXT_RESET_TIME);
2666
2667                 /* Do not need to scan since we know family ID */
2668                 ret = mxt_lookup_bootloader_address(data, 0);
2669                 if (ret)
2670                         goto release_firmware;
2671
2672                 mxt_free_input_device(data);
2673                 mxt_free_object_table(data);
2674         } else {
2675                 enable_irq(data->irq);
2676         }
2677
2678         reinit_completion(&data->bl_completion);
2679
2680         ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
2681         if (ret) {
2682                 /* Bootloader may still be unlocked from previous attempt */
2683                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
2684                 if (ret)
2685                         goto disable_irq;
2686         } else {
2687                 dev_info(dev, "Unlocking bootloader\n");
2688
2689                 /* Unlock bootloader */
2690                 ret = mxt_send_bootloader_cmd(data, true);
2691                 if (ret)
2692                         goto disable_irq;
2693         }
2694
2695         while (pos < fw->size) {
2696                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
2697                 if (ret)
2698                         goto disable_irq;
2699
2700                 frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
2701
2702                 /* Take account of CRC bytes */
2703                 frame_size += 2;
2704
2705                 /* Write one frame to device */
2706                 ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
2707                 if (ret)
2708                         goto disable_irq;
2709
2710                 ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
2711                 if (ret) {
2712                         retry++;
2713
2714                         /* Back off by 20ms per retry */
2715                         msleep(retry * 20);
2716
2717                         if (retry > 20) {
2718                                 dev_err(dev, "Retry count exceeded\n");
2719                                 goto disable_irq;
2720                         }
2721                 } else {
2722                         retry = 0;
2723                         pos += frame_size;
2724                         frame++;
2725                 }
2726
2727                 if (frame % 50 == 0)
2728                         dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
2729                                 frame, pos, fw->size);
2730         }
2731
2732         /* Wait for flash. */
2733         ret = mxt_wait_for_completion(data, &data->bl_completion,
2734                                       MXT_FW_RESET_TIME);
2735         if (ret)
2736                 goto disable_irq;
2737
2738         dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
2739
2740         /*
2741          * Wait for device to reset. Some bootloader versions do not assert
2742          * the CHG line after bootloading has finished, so ignore potential
2743          * errors.
2744          */
2745         mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
2746
2747         data->in_bootloader = false;
2748
2749 disable_irq:
2750         disable_irq(data->irq);
2751 release_firmware:
2752         release_firmware(fw);
2753         return ret;
2754 }
2755
2756 static ssize_t mxt_update_fw_store(struct device *dev,
2757                                         struct device_attribute *attr,
2758                                         const char *buf, size_t count)
2759 {
2760         struct mxt_data *data = dev_get_drvdata(dev);
2761         int error;
2762
2763         error = mxt_load_fw(dev, MXT_FW_NAME);
2764         if (error) {
2765                 dev_err(dev, "The firmware update failed(%d)\n", error);
2766                 count = error;
2767         } else {
2768                 dev_info(dev, "The firmware update succeeded\n");
2769
2770                 error = mxt_initialize(data);
2771                 if (error)
2772                         return error;
2773         }
2774
2775         return count;
2776 }
2777
2778 static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2779 static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2780 static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2781 static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2782
2783 static struct attribute *mxt_attrs[] = {
2784         &dev_attr_fw_version.attr,
2785         &dev_attr_hw_version.attr,
2786         &dev_attr_object.attr,
2787         &dev_attr_update_fw.attr,
2788         NULL
2789 };
2790
2791 static const struct attribute_group mxt_attr_group = {
2792         .attrs = mxt_attrs,
2793 };
2794
2795 static void mxt_start(struct mxt_data *data)
2796 {
2797         switch (data->pdata->suspend_mode) {
2798         case MXT_SUSPEND_T9_CTRL:
2799                 mxt_soft_reset(data);
2800
2801                 /* Touch enable */
2802                 /* 0x83 = SCANEN | RPTEN | ENABLE */
2803                 mxt_write_object(data,
2804                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0x83);
2805                 break;
2806
2807         case MXT_SUSPEND_DEEP_SLEEP:
2808         default:
2809                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2810
2811                 /* Recalibrate since chip has been in deep sleep */
2812                 mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
2813                 break;
2814         }
2815
2816 }
2817
2818 static void mxt_stop(struct mxt_data *data)
2819 {
2820         switch (data->pdata->suspend_mode) {
2821         case MXT_SUSPEND_T9_CTRL:
2822                 /* Touch disable */
2823                 mxt_write_object(data,
2824                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0);
2825                 break;
2826
2827         case MXT_SUSPEND_DEEP_SLEEP:
2828         default:
2829                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
2830                 break;
2831         }
2832 }
2833
2834 static int mxt_input_open(struct input_dev *dev)
2835 {
2836         struct mxt_data *data = input_get_drvdata(dev);
2837
2838         mxt_start(data);
2839
2840         return 0;
2841 }
2842
2843 static void mxt_input_close(struct input_dev *dev)
2844 {
2845         struct mxt_data *data = input_get_drvdata(dev);
2846
2847         mxt_stop(data);
2848 }
2849
2850 #ifdef CONFIG_OF
2851 static const struct mxt_platform_data *mxt_parse_dt(struct i2c_client *client)
2852 {
2853         struct mxt_platform_data *pdata;
2854         struct device_node *np = client->dev.of_node;
2855         u32 *keymap;
2856         int proplen, ret;
2857
2858         if (!np)
2859                 return ERR_PTR(-ENOENT);
2860
2861         pdata = devm_kzalloc(&client->dev, sizeof(*pdata), GFP_KERNEL);
2862         if (!pdata)
2863                 return ERR_PTR(-ENOMEM);
2864
2865         if (of_find_property(np, "linux,gpio-keymap", &proplen)) {
2866                 pdata->t19_num_keys = proplen / sizeof(u32);
2867
2868                 keymap = devm_kzalloc(&client->dev,
2869                                 pdata->t19_num_keys * sizeof(keymap[0]),
2870                                 GFP_KERNEL);
2871                 if (!keymap)
2872                         return ERR_PTR(-ENOMEM);
2873
2874                 ret = of_property_read_u32_array(np, "linux,gpio-keymap",
2875                                                  keymap, pdata->t19_num_keys);
2876                 if (ret)
2877                         dev_warn(&client->dev,
2878                                  "Couldn't read linux,gpio-keymap: %d\n", ret);
2879
2880                 pdata->t19_keymap = keymap;
2881         }
2882
2883         pdata->suspend_mode = MXT_SUSPEND_DEEP_SLEEP;
2884
2885         return pdata;
2886 }
2887 #else
2888 static const struct mxt_platform_data *mxt_parse_dt(struct i2c_client *client)
2889 {
2890         return ERR_PTR(-ENOENT);
2891 }
2892 #endif
2893
2894 #ifdef CONFIG_ACPI
2895
2896 struct mxt_acpi_platform_data {
2897         const char *hid;
2898         struct mxt_platform_data pdata;
2899 };
2900
2901 static unsigned int samus_touchpad_buttons[] = {
2902         KEY_RESERVED,
2903         KEY_RESERVED,
2904         KEY_RESERVED,
2905         BTN_LEFT
2906 };
2907
2908 static struct mxt_acpi_platform_data samus_platform_data[] = {
2909         {
2910                 /* Touchpad */
2911                 .hid    = "ATML0000",
2912                 .pdata  = {
2913                         .t19_num_keys   = ARRAY_SIZE(samus_touchpad_buttons),
2914                         .t19_keymap     = samus_touchpad_buttons,
2915                 },
2916         },
2917         {
2918                 /* Touchscreen */
2919                 .hid    = "ATML0001",
2920         },
2921         { }
2922 };
2923
2924 static unsigned int chromebook_tp_buttons[] = {
2925         KEY_RESERVED,
2926         KEY_RESERVED,
2927         KEY_RESERVED,
2928         KEY_RESERVED,
2929         KEY_RESERVED,
2930         BTN_LEFT
2931 };
2932
2933 static struct mxt_acpi_platform_data chromebook_platform_data[] = {
2934         {
2935                 /* Touchpad */
2936                 .hid    = "ATML0000",
2937                 .pdata  = {
2938                         .t19_num_keys   = ARRAY_SIZE(chromebook_tp_buttons),
2939                         .t19_keymap     = chromebook_tp_buttons,
2940                 },
2941         },
2942         {
2943                 /* Touchscreen */
2944                 .hid    = "ATML0001",
2945         },
2946         { }
2947 };
2948
2949 static const struct dmi_system_id mxt_dmi_table[] = {
2950         {
2951                 /* 2015 Google Pixel */
2952                 .ident = "Chromebook Pixel 2",
2953                 .matches = {
2954                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
2955                         DMI_MATCH(DMI_PRODUCT_NAME, "Samus"),
2956                 },
2957                 .driver_data = samus_platform_data,
2958         },
2959         {
2960                 /* Other Google Chromebooks */
2961                 .ident = "Chromebook",
2962                 .matches = {
2963                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
2964                 },
2965                 .driver_data = chromebook_platform_data,
2966         },
2967         { }
2968 };
2969
2970 static const struct mxt_platform_data *mxt_parse_acpi(struct i2c_client *client)
2971 {
2972         struct acpi_device *adev;
2973         const struct dmi_system_id *system_id;
2974         const struct mxt_acpi_platform_data *acpi_pdata;
2975
2976         /*
2977          * Ignore ACPI devices representing bootloader mode.
2978          *
2979          * This is a bit of a hack: Google Chromebook BIOS creates ACPI
2980          * devices for both application and bootloader modes, but we are
2981          * interested in application mode only (if device is in bootloader
2982          * mode we'll end up switching into application anyway). So far
2983          * application mode addresses were all above 0x40, so we'll use it
2984          * as a threshold.
2985          */
2986         if (client->addr < 0x40)
2987                 return ERR_PTR(-ENXIO);
2988
2989         adev = ACPI_COMPANION(&client->dev);
2990         if (!adev)
2991                 return ERR_PTR(-ENOENT);
2992
2993         system_id = dmi_first_match(mxt_dmi_table);
2994         if (!system_id)
2995                 return ERR_PTR(-ENOENT);
2996
2997         acpi_pdata = system_id->driver_data;
2998         if (!acpi_pdata)
2999                 return ERR_PTR(-ENOENT);
3000
3001         while (acpi_pdata->hid) {
3002                 if (!strcmp(acpi_device_hid(adev), acpi_pdata->hid))
3003                         return &acpi_pdata->pdata;
3004
3005                 acpi_pdata++;
3006         }
3007
3008         return ERR_PTR(-ENOENT);
3009 }
3010 #else
3011 static const struct mxt_platform_data *mxt_parse_acpi(struct i2c_client *client)
3012 {
3013         return ERR_PTR(-ENOENT);
3014 }
3015 #endif
3016
3017 static const struct mxt_platform_data *
3018 mxt_get_platform_data(struct i2c_client *client)
3019 {
3020         const struct mxt_platform_data *pdata;
3021
3022         pdata = dev_get_platdata(&client->dev);
3023         if (pdata)
3024                 return pdata;
3025
3026         pdata = mxt_parse_dt(client);
3027         if (!IS_ERR(pdata) || PTR_ERR(pdata) != -ENOENT)
3028                 return pdata;
3029
3030         pdata = mxt_parse_acpi(client);
3031         if (!IS_ERR(pdata) || PTR_ERR(pdata) != -ENOENT)
3032                 return pdata;
3033
3034         dev_err(&client->dev, "No platform data specified\n");
3035         return ERR_PTR(-EINVAL);
3036 }
3037
3038 static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
3039 {
3040         struct mxt_data *data;
3041         const struct mxt_platform_data *pdata;
3042         int error;
3043
3044         pdata = mxt_get_platform_data(client);
3045         if (IS_ERR(pdata))
3046                 return PTR_ERR(pdata);
3047
3048         data = kzalloc(sizeof(struct mxt_data), GFP_KERNEL);
3049         if (!data) {
3050                 dev_err(&client->dev, "Failed to allocate memory\n");
3051                 return -ENOMEM;
3052         }
3053
3054         snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
3055                  client->adapter->nr, client->addr);
3056
3057         data->client = client;
3058         data->pdata = pdata;
3059         data->irq = client->irq;
3060         i2c_set_clientdata(client, data);
3061
3062         init_completion(&data->bl_completion);
3063         init_completion(&data->reset_completion);
3064         init_completion(&data->crc_completion);
3065
3066         error = request_threaded_irq(client->irq, NULL, mxt_interrupt,
3067                                      pdata->irqflags | IRQF_ONESHOT,
3068                                      client->name, data);
3069         if (error) {
3070                 dev_err(&client->dev, "Failed to register interrupt\n");
3071                 goto err_free_mem;
3072         }
3073
3074         disable_irq(client->irq);
3075
3076         error = mxt_initialize(data);
3077         if (error)
3078                 goto err_free_irq;
3079
3080         error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
3081         if (error) {
3082                 dev_err(&client->dev, "Failure %d creating sysfs group\n",
3083                         error);
3084                 goto err_free_object;
3085         }
3086
3087         return 0;
3088
3089 err_free_object:
3090         mxt_free_input_device(data);
3091         mxt_free_object_table(data);
3092 err_free_irq:
3093         free_irq(client->irq, data);
3094 err_free_mem:
3095         kfree(data);
3096         return error;
3097 }
3098
3099 static int mxt_remove(struct i2c_client *client)
3100 {
3101         struct mxt_data *data = i2c_get_clientdata(client);
3102
3103         sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
3104         free_irq(data->irq, data);
3105         mxt_free_input_device(data);
3106         mxt_free_object_table(data);
3107         kfree(data);
3108
3109         return 0;
3110 }
3111
3112 static int __maybe_unused mxt_suspend(struct device *dev)
3113 {
3114         struct i2c_client *client = to_i2c_client(dev);
3115         struct mxt_data *data = i2c_get_clientdata(client);
3116         struct input_dev *input_dev = data->input_dev;
3117
3118         if (!input_dev)
3119                 return 0;
3120
3121         mutex_lock(&input_dev->mutex);
3122
3123         if (input_dev->users)
3124                 mxt_stop(data);
3125
3126         mutex_unlock(&input_dev->mutex);
3127
3128         return 0;
3129 }
3130
3131 static int __maybe_unused mxt_resume(struct device *dev)
3132 {
3133         struct i2c_client *client = to_i2c_client(dev);
3134         struct mxt_data *data = i2c_get_clientdata(client);
3135         struct input_dev *input_dev = data->input_dev;
3136
3137         if (!input_dev)
3138                 return 0;
3139
3140         mutex_lock(&input_dev->mutex);
3141
3142         if (input_dev->users)
3143                 mxt_start(data);
3144
3145         mutex_unlock(&input_dev->mutex);
3146
3147         return 0;
3148 }
3149
3150 static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
3151
3152 static const struct of_device_id mxt_of_match[] = {
3153         { .compatible = "atmel,maxtouch", },
3154         {},
3155 };
3156 MODULE_DEVICE_TABLE(of, mxt_of_match);
3157
3158 #ifdef CONFIG_ACPI
3159 static const struct acpi_device_id mxt_acpi_id[] = {
3160         { "ATML0000", 0 },      /* Touchpad */
3161         { "ATML0001", 0 },      /* Touchscreen */
3162         { }
3163 };
3164 MODULE_DEVICE_TABLE(acpi, mxt_acpi_id);
3165 #endif
3166
3167 static const struct i2c_device_id mxt_id[] = {
3168         { "qt602240_ts", 0 },
3169         { "atmel_mxt_ts", 0 },
3170         { "atmel_mxt_tp", 0 },
3171         { "maxtouch", 0 },
3172         { "mXT224", 0 },
3173         { }
3174 };
3175 MODULE_DEVICE_TABLE(i2c, mxt_id);
3176
3177 static struct i2c_driver mxt_driver = {
3178         .driver = {
3179                 .name   = "atmel_mxt_ts",
3180                 .of_match_table = of_match_ptr(mxt_of_match),
3181                 .acpi_match_table = ACPI_PTR(mxt_acpi_id),
3182                 .pm     = &mxt_pm_ops,
3183         },
3184         .probe          = mxt_probe,
3185         .remove         = mxt_remove,
3186         .id_table       = mxt_id,
3187 };
3188
3189 module_i2c_driver(mxt_driver);
3190
3191 /* Module information */
3192 MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
3193 MODULE_DESCRIPTION("Atmel maXTouch Touchscreen driver");
3194 MODULE_LICENSE("GPL");