drivers/input/touchscreen/atmel_mxt_ts.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Atmel maXTouch Touchscreen driver
   4  *
   5  * Copyright (C) 2010 Samsung Electronics Co.Ltd
   6  * Copyright (C) 2011-2014 Atmel Corporation
   7  * Copyright (C) 2012 Google, Inc.
   8  * Copyright (C) 2016 Zodiac Inflight Innovations
   9  *
  10  * Author: Joonyoung Shim <jy0922.shim@samsung.com>
  11  */
  12
  13 #include <linux/acpi.h>
  14 #include <linux/dmi.h>
  15 #include <linux/module.h>
  16 #include <linux/init.h>
  17 #include <linux/completion.h>
  18 #include <linux/delay.h>
  19 #include <linux/firmware.h>
  20 #include <linux/i2c.h>
  21 #include <linux/input/mt.h>
  22 #include <linux/interrupt.h>
  23 #include <linux/irq.h>
  24 #include <linux/of.h>
  25 #include <linux/property.h>
  26 #include <linux/slab.h>
  27 #include <linux/regulator/consumer.h>
  28 #include <linux/gpio/consumer.h>
  29 #include <asm/unaligned.h>
  30 #include <media/v4l2-device.h>
  31 #include <media/v4l2-ioctl.h>
  32 #include <media/videobuf2-v4l2.h>
  33 #include <media/videobuf2-vmalloc.h>
  34
  35 /* Firmware files */
  36 #define MXT_FW_NAME             "maxtouch.fw"
  37 #define MXT_CFG_NAME            "maxtouch.cfg"
  38 #define MXT_CFG_MAGIC           "OBP_RAW V1"
  39
  40 /* Registers */
  41 #define MXT_OBJECT_START        0x07
  42 #define MXT_OBJECT_SIZE         6
  43 #define MXT_INFO_CHECKSUM_SIZE  3
  44 #define MXT_MAX_BLOCK_WRITE     256
  45
  46 /* Object types */
  47 #define MXT_DEBUG_DIAGNOSTIC_T37        37
  48 #define MXT_GEN_MESSAGE_T5              5
  49 #define MXT_GEN_COMMAND_T6              6
  50 #define MXT_GEN_POWER_T7                7
  51 #define MXT_GEN_ACQUIRE_T8              8
  52 #define MXT_GEN_DATASOURCE_T53          53
  53 #define MXT_TOUCH_MULTI_T9              9
  54 #define MXT_TOUCH_KEYARRAY_T15          15
  55 #define MXT_TOUCH_PROXIMITY_T23         23
  56 #define MXT_TOUCH_PROXKEY_T52           52
  57 #define MXT_PROCI_GRIPFACE_T20          20
  58 #define MXT_PROCG_NOISE_T22             22
  59 #define MXT_PROCI_ONETOUCH_T24          24
  60 #define MXT_PROCI_TWOTOUCH_T27          27
  61 #define MXT_PROCI_GRIP_T40              40
  62 #define MXT_PROCI_PALM_T41              41
  63 #define MXT_PROCI_TOUCHSUPPRESSION_T42  42
  64 #define MXT_PROCI_STYLUS_T47            47
  65 #define MXT_PROCG_NOISESUPPRESSION_T48  48
  66 #define MXT_SPT_COMMSCONFIG_T18         18
  67 #define MXT_SPT_GPIOPWM_T19             19
  68 #define MXT_SPT_SELFTEST_T25            25
  69 #define MXT_SPT_CTECONFIG_T28           28
  70 #define MXT_SPT_USERDATA_T38            38
  71 #define MXT_SPT_DIGITIZER_T43           43
  72 #define MXT_SPT_MESSAGECOUNT_T44        44
  73 #define MXT_SPT_CTECONFIG_T46           46
  74 #define MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71 71
  75 #define MXT_TOUCH_MULTITOUCHSCREEN_T100 100
  76
  77 /* MXT_GEN_MESSAGE_T5 object */
  78 #define MXT_RPTID_NOMSG         0xff
  79
  80 /* MXT_GEN_COMMAND_T6 field */
  81 #define MXT_COMMAND_RESET       0
  82 #define MXT_COMMAND_BACKUPNV    1
  83 #define MXT_COMMAND_CALIBRATE   2
  84 #define MXT_COMMAND_REPORTALL   3
  85 #define MXT_COMMAND_DIAGNOSTIC  5
  86
  87 /* Define for T6 status byte */
  88 #define MXT_T6_STATUS_RESET     BIT(7)
  89 #define MXT_T6_STATUS_OFL       BIT(6)
  90 #define MXT_T6_STATUS_SIGERR    BIT(5)
  91 #define MXT_T6_STATUS_CAL       BIT(4)
  92 #define MXT_T6_STATUS_CFGERR    BIT(3)
  93 #define MXT_T6_STATUS_COMSERR   BIT(2)
  94
  95 /* MXT_GEN_POWER_T7 field */
  96 struct t7_config {
  97         u8 idle;
  98         u8 active;
  99 } __packed;
 100
 101 #define MXT_POWER_CFG_RUN               0
 102 #define MXT_POWER_CFG_DEEPSLEEP         1
 103
 104 /* MXT_TOUCH_MULTI_T9 field */
 105 #define MXT_T9_CTRL             0
 106 #define MXT_T9_XSIZE            3
 107 #define MXT_T9_YSIZE            4
 108 #define MXT_T9_ORIENT           9
 109 #define MXT_T9_RANGE            18
 110
 111 /* MXT_TOUCH_MULTI_T9 status */
 112 #define MXT_T9_UNGRIP           BIT(0)
 113 #define MXT_T9_SUPPRESS         BIT(1)
 114 #define MXT_T9_AMP              BIT(2)
 115 #define MXT_T9_VECTOR           BIT(3)
 116 #define MXT_T9_MOVE             BIT(4)
 117 #define MXT_T9_RELEASE          BIT(5)
 118 #define MXT_T9_PRESS            BIT(6)
 119 #define MXT_T9_DETECT           BIT(7)
 120
 121 struct t9_range {
 122         __le16 x;
 123         __le16 y;
 124 } __packed;
 125
 126 /* MXT_TOUCH_MULTI_T9 orient */
 127 #define MXT_T9_ORIENT_SWITCH    BIT(0)
 128 #define MXT_T9_ORIENT_INVERTX   BIT(1)
 129 #define MXT_T9_ORIENT_INVERTY   BIT(2)
 130
 131 /* MXT_SPT_COMMSCONFIG_T18 */
 132 #define MXT_COMMS_CTRL          0
 133 #define MXT_COMMS_CMD           1
 134 #define MXT_COMMS_RETRIGEN      BIT(6)
 135
 136 /* MXT_DEBUG_DIAGNOSTIC_T37 */
 137 #define MXT_DIAGNOSTIC_PAGEUP   0x01
 138 #define MXT_DIAGNOSTIC_DELTAS   0x10
 139 #define MXT_DIAGNOSTIC_REFS     0x11
 140 #define MXT_DIAGNOSTIC_SIZE     128
 141
 142 #define MXT_FAMILY_1386                 160
 143 #define MXT1386_COLUMNS                 3
 144 #define MXT1386_PAGES_PER_COLUMN        8
 145
 146 struct t37_debug {
 147 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
 148         u8 mode;
 149         u8 page;
 150         u8 data[MXT_DIAGNOSTIC_SIZE];
 151 #endif
 152 };
 153
 154 /* Define for MXT_GEN_COMMAND_T6 */
 155 #define MXT_BOOT_VALUE          0xa5
 156 #define MXT_RESET_VALUE         0x01
 157 #define MXT_BACKUP_VALUE        0x55
 158
 159 /* T100 Multiple Touch Touchscreen */
 160 #define MXT_T100_CTRL           0
 161 #define MXT_T100_CFG1           1
 162 #define MXT_T100_TCHAUX         3
 163 #define MXT_T100_XSIZE          9
 164 #define MXT_T100_XRANGE         13
 165 #define MXT_T100_YSIZE          20
 166 #define MXT_T100_YRANGE         24
 167
 168 #define MXT_T100_CFG_SWITCHXY   BIT(5)
 169 #define MXT_T100_CFG_INVERTY    BIT(6)
 170 #define MXT_T100_CFG_INVERTX    BIT(7)
 171
 172 #define MXT_T100_TCHAUX_VECT    BIT(0)
 173 #define MXT_T100_TCHAUX_AMPL    BIT(1)
 174 #define MXT_T100_TCHAUX_AREA    BIT(2)
 175
 176 #define MXT_T100_DETECT         BIT(7)
 177 #define MXT_T100_TYPE_MASK      0x70
 178
 179 enum t100_type {
 180         MXT_T100_TYPE_FINGER            = 1,
 181         MXT_T100_TYPE_PASSIVE_STYLUS    = 2,
 182         MXT_T100_TYPE_HOVERING_FINGER   = 4,
 183         MXT_T100_TYPE_GLOVE             = 5,
 184         MXT_T100_TYPE_LARGE_TOUCH       = 6,
 185 };
 186
 187 #define MXT_DISTANCE_ACTIVE_TOUCH       0
 188 #define MXT_DISTANCE_HOVERING           1
 189
 190 #define MXT_TOUCH_MAJOR_DEFAULT         1
 191 #define MXT_PRESSURE_DEFAULT            1
 192
 193 /* Delay times */
 194 #define MXT_BACKUP_TIME         50      /* msec */
 195 #define MXT_RESET_GPIO_TIME     20      /* msec */
 196 #define MXT_RESET_INVALID_CHG   100     /* msec */
 197 #define MXT_RESET_TIME          200     /* msec */
 198 #define MXT_RESET_TIMEOUT       3000    /* msec */
 199 #define MXT_CRC_TIMEOUT         1000    /* msec */
 200 #define MXT_FW_RESET_TIME       3000    /* msec */
 201 #define MXT_FW_CHG_TIMEOUT      300     /* msec */
 202
 203 /* Command to unlock bootloader */
 204 #define MXT_UNLOCK_CMD_MSB      0xaa
 205 #define MXT_UNLOCK_CMD_LSB      0xdc
 206
 207 /* Bootloader mode status */
 208 #define MXT_WAITING_BOOTLOAD_CMD        0xc0    /* valid 7 6 bit only */
 209 #define MXT_WAITING_FRAME_DATA  0x80    /* valid 7 6 bit only */
 210 #define MXT_FRAME_CRC_CHECK     0x02
 211 #define MXT_FRAME_CRC_FAIL      0x03
 212 #define MXT_FRAME_CRC_PASS      0x04
 213 #define MXT_APP_CRC_FAIL        0x40    /* valid 7 8 bit only */
 214 #define MXT_BOOT_STATUS_MASK    0x3f
 215 #define MXT_BOOT_EXTENDED_ID    BIT(5)
 216 #define MXT_BOOT_ID_MASK        0x1f
 217
 218 /* Touchscreen absolute values */
 219 #define MXT_MAX_AREA            0xff
 220
 221 #define MXT_PIXELS_PER_MM       20
 222
 223 struct mxt_info {
 224         u8 family_id;
 225         u8 variant_id;
 226         u8 version;
 227         u8 build;
 228         u8 matrix_xsize;
 229         u8 matrix_ysize;
 230         u8 object_num;
 231 };
 232
 233 struct mxt_object {
 234         u8 type;
 235         u16 start_address;
 236         u8 size_minus_one;
 237         u8 instances_minus_one;
 238         u8 num_report_ids;
 239 } __packed;
 240
 241 struct mxt_dbg {
 242         u16 t37_address;
 243         u16 diag_cmd_address;
 244         struct t37_debug *t37_buf;
 245         unsigned int t37_pages;
 246         unsigned int t37_nodes;
 247
 248         struct v4l2_device v4l2;
 249         struct v4l2_pix_format format;
 250         struct video_device vdev;
 251         struct vb2_queue queue;
 252         struct mutex lock;
 253         int input;
 254 };
 255
 256 enum v4l_dbg_inputs {
 257         MXT_V4L_INPUT_DELTAS,
 258         MXT_V4L_INPUT_REFS,
 259         MXT_V4L_INPUT_MAX,
 260 };
 261
 262 enum mxt_suspend_mode {
 263         MXT_SUSPEND_DEEP_SLEEP  = 0,
 264         MXT_SUSPEND_T9_CTRL     = 1,
 265 };
 266
 267 /* Config update context */
 268 struct mxt_cfg {
 269         u8 *raw;
 270         size_t raw_size;
 271         off_t raw_pos;
 272
 273         u8 *mem;
 274         size_t mem_size;
 275         int start_ofs;
 276
 277         struct mxt_info info;
 278 };
 279
 280 /* Each client has this additional data */
 281 struct mxt_data {
 282         struct i2c_client *client;
 283         struct input_dev *input_dev;
 284         char phys[64];          /* device physical location */
 285         struct mxt_object *object_table;
 286         struct mxt_info *info;
 287         void *raw_info_block;
 288         unsigned int irq;
 289         unsigned int max_x;
 290         unsigned int max_y;
 291         bool invertx;
 292         bool inverty;
 293         bool xy_switch;
 294         u8 xsize;
 295         u8 ysize;
 296         bool in_bootloader;
 297         u16 mem_size;
 298         u8 t100_aux_ampl;
 299         u8 t100_aux_area;
 300         u8 t100_aux_vect;
 301         u8 max_reportid;
 302         u32 config_crc;
 303         u32 info_crc;
 304         u8 bootloader_addr;
 305         u8 *msg_buf;
 306         u8 t6_status;
 307         bool update_input;
 308         u8 last_message_count;
 309         u8 num_touchids;
 310         u8 multitouch;
 311         struct t7_config t7_cfg;
 312         struct mxt_dbg dbg;
 313         struct regulator_bulk_data regulators[2];
 314         struct gpio_desc *reset_gpio;
 315         bool use_retrigen_workaround;
 316
 317         /* Cached parameters from object table */
 318         u16 T5_address;
 319         u8 T5_msg_size;
 320         u8 T6_reportid;
 321         u16 T6_address;
 322         u16 T7_address;
 323         u16 T71_address;
 324         u8 T9_reportid_min;
 325         u8 T9_reportid_max;
 326         u16 T18_address;
 327         u8 T19_reportid;
 328         u16 T44_address;
 329         u8 T100_reportid_min;
 330         u8 T100_reportid_max;
 331
 332         /* for fw update in bootloader */
 333         struct completion bl_completion;
 334
 335         /* for reset handling */
 336         struct completion reset_completion;
 337
 338         /* for config update handling */
 339         struct completion crc_completion;
 340
 341         u32 *t19_keymap;
 342         unsigned int t19_num_keys;
 343
 344         enum mxt_suspend_mode suspend_mode;
 345 };
 346
 347 struct mxt_vb2_buffer {
 348         struct vb2_buffer       vb;
 349         struct list_head        list;
 350 };
 351
 352 static size_t mxt_obj_size(const struct mxt_object *obj)
 353 {
 354         return obj->size_minus_one + 1;
 355 }
 356
 357 static size_t mxt_obj_instances(const struct mxt_object *obj)
 358 {
 359         return obj->instances_minus_one + 1;
 360 }
 361
 362 static bool mxt_object_readable(unsigned int type)
 363 {
 364         switch (type) {
 365         case MXT_GEN_COMMAND_T6:
 366         case MXT_GEN_POWER_T7:
 367         case MXT_GEN_ACQUIRE_T8:
 368         case MXT_GEN_DATASOURCE_T53:
 369         case MXT_TOUCH_MULTI_T9:
 370         case MXT_TOUCH_KEYARRAY_T15:
 371         case MXT_TOUCH_PROXIMITY_T23:
 372         case MXT_TOUCH_PROXKEY_T52:
 373         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
 374         case MXT_PROCI_GRIPFACE_T20:
 375         case MXT_PROCG_NOISE_T22:
 376         case MXT_PROCI_ONETOUCH_T24:
 377         case MXT_PROCI_TWOTOUCH_T27:
 378         case MXT_PROCI_GRIP_T40:
 379         case MXT_PROCI_PALM_T41:
 380         case MXT_PROCI_TOUCHSUPPRESSION_T42:
 381         case MXT_PROCI_STYLUS_T47:
 382         case MXT_PROCG_NOISESUPPRESSION_T48:
 383         case MXT_SPT_COMMSCONFIG_T18:
 384         case MXT_SPT_GPIOPWM_T19:
 385         case MXT_SPT_SELFTEST_T25:
 386         case MXT_SPT_CTECONFIG_T28:
 387         case MXT_SPT_USERDATA_T38:
 388         case MXT_SPT_DIGITIZER_T43:
 389         case MXT_SPT_CTECONFIG_T46:
 390         case MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71:
 391                 return true;
 392         default:
 393                 return false;
 394         }
 395 }
 396
 397 static void mxt_dump_message(struct mxt_data *data, u8 *message)
 398 {
 399         dev_dbg(&data->client->dev, "message: %*ph\n",
 400                 data->T5_msg_size, message);
 401 }
 402
 403 static int mxt_wait_for_completion(struct mxt_data *data,
 404                                    struct completion *comp,
 405                                    unsigned int timeout_ms)
 406 {
 407         struct device *dev = &data->client->dev;
 408         unsigned long timeout = msecs_to_jiffies(timeout_ms);
 409         long ret;
 410
 411         ret = wait_for_completion_interruptible_timeout(comp, timeout);
 412         if (ret < 0) {
 413                 return ret;
 414         } else if (ret == 0) {
 415                 dev_err(dev, "Wait for completion timed out.\n");
 416                 return -ETIMEDOUT;
 417         }
 418         return 0;
 419 }
 420
 421 static int mxt_bootloader_read(struct mxt_data *data,
 422                                u8 *val, unsigned int count)
 423 {
 424         int ret;
 425         struct i2c_msg msg;
 426
 427         msg.addr = data->bootloader_addr;
 428         msg.flags = data->client->flags & I2C_M_TEN;
 429         msg.flags |= I2C_M_RD;
 430         msg.len = count;
 431         msg.buf = val;
 432
 433         ret = i2c_transfer(data->client->adapter, &msg, 1);
 434         if (ret == 1) {
 435                 ret = 0;
 436         } else {
 437                 ret = ret < 0 ? ret : -EIO;
 438                 dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
 439                         __func__, ret);
 440         }
 441
 442         return ret;
 443 }
 444
 445 static int mxt_bootloader_write(struct mxt_data *data,
 446                                 const u8 * const val, unsigned int count)
 447 {
 448         int ret;
 449         struct i2c_msg msg;
 450
 451         msg.addr = data->bootloader_addr;
 452         msg.flags = data->client->flags & I2C_M_TEN;
 453         msg.len = count;
 454         msg.buf = (u8 *)val;
 455
 456         ret = i2c_transfer(data->client->adapter, &msg, 1);
 457         if (ret == 1) {
 458                 ret = 0;
 459         } else {
 460                 ret = ret < 0 ? ret : -EIO;
 461                 dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
 462                         __func__, ret);
 463         }
 464
 465         return ret;
 466 }
 467
 468 static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 469 {
 470         u8 appmode = data->client->addr;
 471         u8 bootloader;
 472         u8 family_id = data->info ? data->info->family_id : 0;
 473
 474         switch (appmode) {
 475         case 0x4a:
 476         case 0x4b:
 477                 /* Chips after 1664S use different scheme */
 478                 if (retry || family_id >= 0xa2) {
 479                         bootloader = appmode - 0x24;
 480                         break;
 481                 }
 482                 fallthrough;    /* for normal case */
 483         case 0x4c:
 484         case 0x4d:
 485         case 0x5a:
 486         case 0x5b:
 487                 bootloader = appmode - 0x26;
 488                 break;
 489
 490         default:
 491                 dev_err(&data->client->dev,
 492                         "Appmode i2c address 0x%02x not found\n",
 493                         appmode);
 494                 return -EINVAL;
 495         }
 496
 497         data->bootloader_addr = bootloader;
 498         return 0;
 499 }
 500
 501 static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
 502 {
 503         struct device *dev = &data->client->dev;
 504         int error;
 505         u8 val;
 506         bool crc_failure;
 507
 508         error = mxt_lookup_bootloader_address(data, alt_address);
 509         if (error)
 510                 return error;
 511
 512         error = mxt_bootloader_read(data, &val, 1);
 513         if (error)
 514                 return error;
 515
 516         /* Check app crc fail mode */
 517         crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
 518
 519         dev_err(dev, "Detected bootloader, status:%02X%s\n",
 520                         val, crc_failure ? ", APP_CRC_FAIL" : "");
 521
 522         return 0;
 523 }
 524
 525 static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
 526 {
 527         struct device *dev = &data->client->dev;
 528         u8 buf[3];
 529
 530         if (val & MXT_BOOT_EXTENDED_ID) {
 531                 if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
 532                         dev_err(dev, "%s: i2c failure\n", __func__);
 533                         return val;
 534                 }
 535
 536                 dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
 537
 538                 return buf[0];
 539         } else {
 540                 dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
 541
 542                 return val;
 543         }
 544 }
 545
 546 static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
 547                                 bool wait)
 548 {
 549         struct device *dev = &data->client->dev;
 550         u8 val;
 551         int ret;
 552
 553 recheck:
 554         if (wait) {
 555                 /*
 556                  * In application update mode, the interrupt
 557                  * line signals state transitions. We must wait for the
 558                  * CHG assertion before reading the status byte.
 559                  * Once the status byte has been read, the line is deasserted.
 560                  */
 561                 ret = mxt_wait_for_completion(data, &data->bl_completion,
 562                                               MXT_FW_CHG_TIMEOUT);
 563                 if (ret) {
 564                         /*
 565                          * TODO: handle -ERESTARTSYS better by terminating
 566                          * fw update process before returning to userspace
 567                          * by writing length 0x000 to device (iff we are in
 568                          * WAITING_FRAME_DATA state).
 569                          */
 570                         dev_err(dev, "Update wait error %d\n", ret);
 571                         return ret;
 572                 }
 573         }
 574
 575         ret = mxt_bootloader_read(data, &val, 1);
 576         if (ret)
 577                 return ret;
 578
 579         if (state == MXT_WAITING_BOOTLOAD_CMD)
 580                 val = mxt_get_bootloader_version(data, val);
 581
 582         switch (state) {
 583         case MXT_WAITING_BOOTLOAD_CMD:
 584         case MXT_WAITING_FRAME_DATA:
 585         case MXT_APP_CRC_FAIL:
 586                 val &= ~MXT_BOOT_STATUS_MASK;
 587                 break;
 588         case MXT_FRAME_CRC_PASS:
 589                 if (val == MXT_FRAME_CRC_CHECK) {
 590                         goto recheck;
 591                 } else if (val == MXT_FRAME_CRC_FAIL) {
 592                         dev_err(dev, "Bootloader CRC fail\n");
 593                         return -EINVAL;
 594                 }
 595                 break;
 596         default:
 597                 return -EINVAL;
 598         }
 599
 600         if (val != state) {
 601                 dev_err(dev, "Invalid bootloader state %02X != %02X\n",
 602                         val, state);
 603                 return -EINVAL;
 604         }
 605
 606         return 0;
 607 }
 608
 609 static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
 610 {
 611         u8 buf[2];
 612
 613         if (unlock) {
 614                 buf[0] = MXT_UNLOCK_CMD_LSB;
 615                 buf[1] = MXT_UNLOCK_CMD_MSB;
 616         } else {
 617                 buf[0] = 0x01;
 618                 buf[1] = 0x01;
 619         }
 620
 621         return mxt_bootloader_write(data, buf, sizeof(buf));
 622 }
 623
 624 static int __mxt_read_reg(struct i2c_client *client,
 625                                u16 reg, u16 len, void *val)
 626 {
 627         struct i2c_msg xfer[2];
 628         u8 buf[2];
 629         int ret;
 630
 631         buf[0] = reg & 0xff;
 632         buf[1] = (reg >> 8) & 0xff;
 633
 634         /* Write register */
 635         xfer[0].addr = client->addr;
 636         xfer[0].flags = 0;
 637         xfer[0].len = 2;
 638         xfer[0].buf = buf;
 639
 640         /* Read data */
 641         xfer[1].addr = client->addr;
 642         xfer[1].flags = I2C_M_RD;
 643         xfer[1].len = len;
 644         xfer[1].buf = val;
 645
 646         ret = i2c_transfer(client->adapter, xfer, 2);
 647         if (ret == 2) {
 648                 ret = 0;
 649         } else {
 650                 if (ret >= 0)
 651                         ret = -EIO;
 652                 dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
 653                         __func__, ret);
 654         }
 655
 656         return ret;
 657 }
 658
 659 static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
 660                            const void *val)
 661 {
 662         u8 *buf;
 663         size_t count;
 664         int ret;
 665
 666         count = len + 2;
 667         buf = kmalloc(count, GFP_KERNEL);
 668         if (!buf)
 669                 return -ENOMEM;
 670
 671         buf[0] = reg & 0xff;
 672         buf[1] = (reg >> 8) & 0xff;
 673         memcpy(&buf[2], val, len);
 674
 675         ret = i2c_master_send(client, buf, count);
 676         if (ret == count) {
 677                 ret = 0;
 678         } else {
 679                 if (ret >= 0)
 680                         ret = -EIO;
 681                 dev_err(&client->dev, "%s: i2c send failed (%d)\n",
 682                         __func__, ret);
 683         }
 684
 685         kfree(buf);
 686         return ret;
 687 }
 688
 689 static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
 690 {
 691         return __mxt_write_reg(client, reg, 1, &val);
 692 }
 693
 694 static struct mxt_object *
 695 mxt_get_object(struct mxt_data *data, u8 type)
 696 {
 697         struct mxt_object *object;
 698         int i;
 699
 700         for (i = 0; i < data->info->object_num; i++) {
 701                 object = data->object_table + i;
 702                 if (object->type == type)
 703                         return object;
 704         }
 705
 706         dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
 707         return NULL;
 708 }
 709
 710 static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
 711 {
 712         struct device *dev = &data->client->dev;
 713         u8 status = msg[1];
 714         u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
 715
 716         if (crc != data->config_crc) {
 717                 data->config_crc = crc;
 718                 dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
 719         }
 720
 721         complete(&data->crc_completion);
 722
 723         /* Detect reset */
 724         if (status & MXT_T6_STATUS_RESET)
 725                 complete(&data->reset_completion);
 726
 727         /* Output debug if status has changed */
 728         if (status != data->t6_status)
 729                 dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
 730                         status,
 731                         status == 0 ? " OK" : "",
 732                         status & MXT_T6_STATUS_RESET ? " RESET" : "",
 733                         status & MXT_T6_STATUS_OFL ? " OFL" : "",
 734                         status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
 735                         status & MXT_T6_STATUS_CAL ? " CAL" : "",
 736                         status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
 737                         status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
 738
 739         /* Save current status */
 740         data->t6_status = status;
 741 }
 742
 743 static int mxt_write_object(struct mxt_data *data,
 744                                  u8 type, u8 offset, u8 val)
 745 {
 746         struct mxt_object *object;
 747         u16 reg;
 748
 749         object = mxt_get_object(data, type);
 750         if (!object || offset >= mxt_obj_size(object))
 751                 return -EINVAL;
 752
 753         reg = object->start_address;
 754         return mxt_write_reg(data->client, reg + offset, val);
 755 }
 756
 757 static void mxt_input_button(struct mxt_data *data, u8 *message)
 758 {
 759         struct input_dev *input = data->input_dev;
 760         int i;
 761
 762         for (i = 0; i < data->t19_num_keys; i++) {
 763                 if (data->t19_keymap[i] == KEY_RESERVED)
 764                         continue;
 765
 766                 /* Active-low switch */
 767                 input_report_key(input, data->t19_keymap[i],
 768                                  !(message[1] & BIT(i)));
 769         }
 770 }
 771
 772 static void mxt_input_sync(struct mxt_data *data)
 773 {
 774         input_mt_report_pointer_emulation(data->input_dev,
 775                                           data->t19_num_keys);
 776         input_sync(data->input_dev);
 777 }
 778
 779 static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
 780 {
 781         struct device *dev = &data->client->dev;
 782         struct input_dev *input_dev = data->input_dev;
 783         int id;
 784         u8 status;
 785         int x;
 786         int y;
 787         int area;
 788         int amplitude;
 789
 790         id = message[0] - data->T9_reportid_min;
 791         status = message[1];
 792         x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
 793         y = (message[3] << 4) | ((message[4] & 0xf));
 794
 795         /* Handle 10/12 bit switching */
 796         if (data->max_x < 1024)
 797                 x >>= 2;
 798         if (data->max_y < 1024)
 799                 y >>= 2;
 800
 801         area = message[5];
 802         amplitude = message[6];
 803
 804         dev_dbg(dev,
 805                 "[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
 806                 id,
 807                 (status & MXT_T9_DETECT) ? 'D' : '.',
 808                 (status & MXT_T9_PRESS) ? 'P' : '.',
 809                 (status & MXT_T9_RELEASE) ? 'R' : '.',
 810                 (status & MXT_T9_MOVE) ? 'M' : '.',
 811                 (status & MXT_T9_VECTOR) ? 'V' : '.',
 812                 (status & MXT_T9_AMP) ? 'A' : '.',
 813                 (status & MXT_T9_SUPPRESS) ? 'S' : '.',
 814                 (status & MXT_T9_UNGRIP) ? 'U' : '.',
 815                 x, y, area, amplitude);
 816
 817         input_mt_slot(input_dev, id);
 818
 819         if (status & MXT_T9_DETECT) {
 820                 /*
 821                  * Multiple bits may be set if the host is slow to read
 822                  * the status messages, indicating all the events that
 823                  * have happened.
 824                  */
 825                 if (status & MXT_T9_RELEASE) {
 826                         input_mt_report_slot_inactive(input_dev);
 827                         mxt_input_sync(data);
 828                 }
 829
 830                 /* if active, pressure must be non-zero */
 831                 if (!amplitude)
 832                         amplitude = MXT_PRESSURE_DEFAULT;
 833
 834                 /* Touch active */
 835                 input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
 836                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 837                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 838                 input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
 839                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
 840         } else {
 841                 /* Touch no longer active, close out slot */
 842                 input_mt_report_slot_inactive(input_dev);
 843         }
 844
 845         data->update_input = true;
 846 }
 847
 848 static void mxt_proc_t100_message(struct mxt_data *data, u8 *message)
 849 {
 850         struct device *dev = &data->client->dev;
 851         struct input_dev *input_dev = data->input_dev;
 852         int id;
 853         u8 status;
 854         u8 type = 0;
 855         u16 x;
 856         u16 y;
 857         int distance = 0;
 858         int tool = 0;
 859         u8 major = 0;
 860         u8 pressure = 0;
 861         u8 orientation = 0;
 862
 863         id = message[0] - data->T100_reportid_min - 2;
 864
 865         /* ignore SCRSTATUS events */
 866         if (id < 0)
 867                 return;
 868
 869         status = message[1];
 870         x = get_unaligned_le16(&message[2]);
 871         y = get_unaligned_le16(&message[4]);
 872
 873         if (status & MXT_T100_DETECT) {
 874                 type = (status & MXT_T100_TYPE_MASK) >> 4;
 875
 876                 switch (type) {
 877                 case MXT_T100_TYPE_HOVERING_FINGER:
 878                         tool = MT_TOOL_FINGER;
 879                         distance = MXT_DISTANCE_HOVERING;
 880
 881                         if (data->t100_aux_vect)
 882                                 orientation = message[data->t100_aux_vect];
 883
 884                         break;
 885
 886                 case MXT_T100_TYPE_FINGER:
 887                 case MXT_T100_TYPE_GLOVE:
 888                         tool = MT_TOOL_FINGER;
 889                         distance = MXT_DISTANCE_ACTIVE_TOUCH;
 890
 891                         if (data->t100_aux_area)
 892                                 major = message[data->t100_aux_area];
 893
 894                         if (data->t100_aux_ampl)
 895                                 pressure = message[data->t100_aux_ampl];
 896
 897                         if (data->t100_aux_vect)
 898                                 orientation = message[data->t100_aux_vect];
 899
 900                         break;
 901
 902                 case MXT_T100_TYPE_PASSIVE_STYLUS:
 903                         tool = MT_TOOL_PEN;
 904
 905                         /*
 906                          * Passive stylus is reported with size zero so
 907                          * hardcode.
 908                          */
 909                         major = MXT_TOUCH_MAJOR_DEFAULT;
 910
 911                         if (data->t100_aux_ampl)
 912                                 pressure = message[data->t100_aux_ampl];
 913
 914                         break;
 915
 916                 case MXT_T100_TYPE_LARGE_TOUCH:
 917                         /* Ignore suppressed touch */
 918                         break;
 919
 920                 default:
 921                         dev_dbg(dev, "Unexpected T100 type\n");
 922                         return;
 923                 }
 924         }
 925
 926         /*
 927          * Values reported should be non-zero if tool is touching the
 928          * device
 929          */
 930         if (!pressure && type != MXT_T100_TYPE_HOVERING_FINGER)
 931                 pressure = MXT_PRESSURE_DEFAULT;
 932
 933         input_mt_slot(input_dev, id);
 934
 935         if (status & MXT_T100_DETECT) {
 936                 dev_dbg(dev, "[%u] type:%u x:%u y:%u a:%02X p:%02X v:%02X\n",
 937                         id, type, x, y, major, pressure, orientation);
 938
 939                 input_mt_report_slot_state(input_dev, tool, 1);
 940                 input_report_abs(input_dev, ABS_MT_POSITION_X, x);
 941                 input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
 942                 input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, major);
 943                 input_report_abs(input_dev, ABS_MT_PRESSURE, pressure);
 944                 input_report_abs(input_dev, ABS_MT_DISTANCE, distance);
 945                 input_report_abs(input_dev, ABS_MT_ORIENTATION, orientation);
 946         } else {
 947                 dev_dbg(dev, "[%u] release\n", id);
 948
 949                 /* close out slot */
 950                 input_mt_report_slot_inactive(input_dev);
 951         }
 952
 953         data->update_input = true;
 954 }
 955
 956 static int mxt_proc_message(struct mxt_data *data, u8 *message)
 957 {
 958         u8 report_id = message[0];
 959
 960         if (report_id == MXT_RPTID_NOMSG)
 961                 return 0;
 962
 963         if (report_id == data->T6_reportid) {
 964                 mxt_proc_t6_messages(data, message);
 965         } else if (!data->input_dev) {
 966                 /*
 967                  * Do not report events if input device
 968                  * is not yet registered.
 969                  */
 970                 mxt_dump_message(data, message);
 971         } else if (report_id >= data->T9_reportid_min &&
 972                    report_id <= data->T9_reportid_max) {
 973                 mxt_proc_t9_message(data, message);
 974         } else if (report_id >= data->T100_reportid_min &&
 975                    report_id <= data->T100_reportid_max) {
 976                 mxt_proc_t100_message(data, message);
 977         } else if (report_id == data->T19_reportid) {
 978                 mxt_input_button(data, message);
 979                 data->update_input = true;
 980         } else {
 981                 mxt_dump_message(data, message);
 982         }
 983
 984         return 1;
 985 }
 986
 987 static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
 988 {
 989         struct device *dev = &data->client->dev;
 990         int ret;
 991         int i;
 992         u8 num_valid = 0;
 993
 994         /* Safety check for msg_buf */
 995         if (count > data->max_reportid)
 996                 return -EINVAL;
 997
 998         /* Process remaining messages if necessary */
 999         ret = __mxt_read_reg(data->client, data->T5_address,
1000                                 data->T5_msg_size * count, data->msg_buf);
1001         if (ret) {
1002                 dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
1003                 return ret;
1004         }
1005
1006         for (i = 0;  i < count; i++) {
1007                 ret = mxt_proc_message(data,
1008                         data->msg_buf + data->T5_msg_size * i);
1009
1010                 if (ret == 1)
1011                         num_valid++;
1012         }
1013
1014         /* return number of messages read */
1015         return num_valid;
1016 }
1017
1018 static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
1019 {
1020         struct device *dev = &data->client->dev;
1021         int ret;
1022         u8 count, num_left;
1023
1024         /* Read T44 and T5 together */
1025         ret = __mxt_read_reg(data->client, data->T44_address,
1026                 data->T5_msg_size + 1, data->msg_buf);
1027         if (ret) {
1028                 dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
1029                 return IRQ_NONE;
1030         }
1031
1032         count = data->msg_buf[0];
1033
1034         /*
1035          * This condition may be caused by the CHG line being configured in
1036          * Mode 0. It results in unnecessary I2C operations but it is benign.
1037          */
1038         if (count == 0)
1039                 return IRQ_NONE;
1040
1041         if (count > data->max_reportid) {
1042                 dev_warn(dev, "T44 count %d exceeded max report id\n", count);
1043                 count = data->max_reportid;
1044         }
1045
1046         /* Process first message */
1047         ret = mxt_proc_message(data, data->msg_buf + 1);
1048         if (ret < 0) {
1049                 dev_warn(dev, "Unexpected invalid message\n");
1050                 return IRQ_NONE;
1051         }
1052
1053         num_left = count - 1;
1054
1055         /* Process remaining messages if necessary */
1056         if (num_left) {
1057                 ret = mxt_read_and_process_messages(data, num_left);
1058                 if (ret < 0)
1059                         goto end;
1060                 else if (ret != num_left)
1061                         dev_warn(dev, "Unexpected invalid message\n");
1062         }
1063
1064 end:
1065         if (data->update_input) {
1066                 mxt_input_sync(data);
1067                 data->update_input = false;
1068         }
1069
1070         return IRQ_HANDLED;
1071 }
1072
1073 static int mxt_process_messages_until_invalid(struct mxt_data *data)
1074 {
1075         struct device *dev = &data->client->dev;
1076         int count, read;
1077         u8 tries = 2;
1078
1079         count = data->max_reportid;
1080
1081         /* Read messages until we force an invalid */
1082         do {
1083                 read = mxt_read_and_process_messages(data, count);
1084                 if (read < count)
1085                         return 0;
1086         } while (--tries);
1087
1088         if (data->update_input) {
1089                 mxt_input_sync(data);
1090                 data->update_input = false;
1091         }
1092
1093         dev_err(dev, "CHG pin isn't cleared\n");
1094         return -EBUSY;
1095 }
1096
1097 static irqreturn_t mxt_process_messages(struct mxt_data *data)
1098 {
1099         int total_handled, num_handled;
1100         u8 count = data->last_message_count;
1101
1102         if (count < 1 || count > data->max_reportid)
1103                 count = 1;
1104
1105         /* include final invalid message */
1106         total_handled = mxt_read_and_process_messages(data, count + 1);
1107         if (total_handled < 0)
1108                 return IRQ_NONE;
1109         /* if there were invalid messages, then we are done */
1110         else if (total_handled <= count)
1111                 goto update_count;
1112
1113         /* keep reading two msgs until one is invalid or reportid limit */
1114         do {
1115                 num_handled = mxt_read_and_process_messages(data, 2);
1116                 if (num_handled < 0)
1117                         return IRQ_NONE;
1118
1119                 total_handled += num_handled;
1120
1121                 if (num_handled < 2)
1122                         break;
1123         } while (total_handled < data->num_touchids);
1124
1125 update_count:
1126         data->last_message_count = total_handled;
1127
1128         if (data->update_input) {
1129                 mxt_input_sync(data);
1130                 data->update_input = false;
1131         }
1132
1133         return IRQ_HANDLED;
1134 }
1135
1136 static irqreturn_t mxt_interrupt(int irq, void *dev_id)
1137 {
1138         struct mxt_data *data = dev_id;
1139
1140         if (data->in_bootloader) {
1141                 /* bootloader state transition completion */
1142                 complete(&data->bl_completion);
1143                 return IRQ_HANDLED;
1144         }
1145
1146         if (!data->object_table)
1147                 return IRQ_HANDLED;
1148
1149         if (data->T44_address) {
1150                 return mxt_process_messages_t44(data);
1151         } else {
1152                 return mxt_process_messages(data);
1153         }
1154 }
1155
1156 static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
1157                           u8 value, bool wait)
1158 {
1159         u16 reg;
1160         u8 command_register;
1161         int timeout_counter = 0;
1162         int ret;
1163
1164         reg = data->T6_address + cmd_offset;
1165
1166         ret = mxt_write_reg(data->client, reg, value);
1167         if (ret)
1168                 return ret;
1169
1170         if (!wait)
1171                 return 0;
1172
1173         do {
1174                 msleep(20);
1175                 ret = __mxt_read_reg(data->client, reg, 1, &command_register);
1176                 if (ret)
1177                         return ret;
1178         } while (command_register != 0 && timeout_counter++ <= 100);
1179
1180         if (timeout_counter > 100) {
1181                 dev_err(&data->client->dev, "Command failed!\n");
1182                 return -EIO;
1183         }
1184
1185         return 0;
1186 }
1187
1188 static int mxt_acquire_irq(struct mxt_data *data)
1189 {
1190         int error;
1191
1192         enable_irq(data->irq);
1193
1194         if (data->use_retrigen_workaround) {
1195                 error = mxt_process_messages_until_invalid(data);
1196                 if (error)
1197                         return error;
1198         }
1199
1200         return 0;
1201 }
1202
1203 static int mxt_soft_reset(struct mxt_data *data)
1204 {
1205         struct device *dev = &data->client->dev;
1206         int ret = 0;
1207
1208         dev_info(dev, "Resetting device\n");
1209
1210         disable_irq(data->irq);
1211
1212         reinit_completion(&data->reset_completion);
1213
1214         ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1215         if (ret)
1216                 return ret;
1217
1218         /* Ignore CHG line for 100ms after reset */
1219         msleep(MXT_RESET_INVALID_CHG);
1220
1221         mxt_acquire_irq(data);
1222
1223         ret = mxt_wait_for_completion(data, &data->reset_completion,
1224                                       MXT_RESET_TIMEOUT);
1225         if (ret)
1226                 return ret;
1227
1228         return 0;
1229 }
1230
1231 static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1232 {
1233         /*
1234          * On failure, CRC is set to 0 and config will always be
1235          * downloaded.
1236          */
1237         data->config_crc = 0;
1238         reinit_completion(&data->crc_completion);
1239
1240         mxt_t6_command(data, cmd, value, true);
1241
1242         /*
1243          * Wait for crc message. On failure, CRC is set to 0 and config will
1244          * always be downloaded.
1245          */
1246         mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1247 }
1248
1249 static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1250 {
1251         static const unsigned int crcpoly = 0x80001B;
1252         u32 result;
1253         u32 data_word;
1254
1255         data_word = (secondbyte << 8) | firstbyte;
1256         result = ((*crc << 1) ^ data_word);
1257
1258         if (result & 0x1000000)
1259                 result ^= crcpoly;
1260
1261         *crc = result;
1262 }
1263
1264 static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1265 {
1266         u32 crc = 0;
1267         u8 *ptr = base + start_off;
1268         u8 *last_val = base + end_off - 1;
1269
1270         if (end_off < start_off)
1271                 return -EINVAL;
1272
1273         while (ptr < last_val) {
1274                 mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1275                 ptr += 2;
1276         }
1277
1278         /* if len is odd, fill the last byte with 0 */
1279         if (ptr == last_val)
1280                 mxt_calc_crc24(&crc, *ptr, 0);
1281
1282         /* Mask to 24-bit */
1283         crc &= 0x00FFFFFF;
1284
1285         return crc;
1286 }
1287
1288 static int mxt_check_retrigen(struct mxt_data *data)
1289 {
1290         struct i2c_client *client = data->client;
1291         int error;
1292         int val;
1293         struct irq_data *irqd;
1294
1295         data->use_retrigen_workaround = false;
1296
1297         irqd = irq_get_irq_data(data->irq);
1298         if (!irqd)
1299                 return -EINVAL;
1300
1301         if (irqd_is_level_type(irqd))
1302                 return 0;
1303
1304         if (data->T18_address) {
1305                 error = __mxt_read_reg(client,
1306                                        data->T18_address + MXT_COMMS_CTRL,
1307                                        1, &val);
1308                 if (error)
1309                         return error;
1310
1311                 if (val & MXT_COMMS_RETRIGEN)
1312                         return 0;
1313         }
1314
1315         dev_warn(&client->dev, "Enabling RETRIGEN workaround\n");
1316         data->use_retrigen_workaround = true;
1317         return 0;
1318 }
1319
1320 static int mxt_prepare_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
1321 {
1322         struct device *dev = &data->client->dev;
1323         struct mxt_object *object;
1324         unsigned int type, instance, size, byte_offset;
1325         int offset;
1326         int ret;
1327         int i;
1328         u16 reg;
1329         u8 val;
1330
1331         while (cfg->raw_pos < cfg->raw_size) {
1332                 /* Read type, instance, length */
1333                 ret = sscanf(cfg->raw + cfg->raw_pos, "%x %x %x%n",
1334                              &type, &instance, &size, &offset);
1335                 if (ret == 0) {
1336                         /* EOF */
1337                         break;
1338                 } else if (ret != 3) {
1339                         dev_err(dev, "Bad format: failed to parse object\n");
1340                         return -EINVAL;
1341                 }
1342                 cfg->raw_pos += offset;
1343
1344                 object = mxt_get_object(data, type);
1345                 if (!object) {
1346                         /* Skip object */
1347                         for (i = 0; i < size; i++) {
1348                                 ret = sscanf(cfg->raw + cfg->raw_pos, "%hhx%n",
1349                                              &val, &offset);
1350                                 if (ret != 1) {
1351                                         dev_err(dev, "Bad format in T%d at %d\n",
1352                                                 type, i);
1353                                         return -EINVAL;
1354                                 }
1355                                 cfg->raw_pos += offset;
1356                         }
1357                         continue;
1358                 }
1359
1360                 if (size > mxt_obj_size(object)) {
1361                         /*
1362                          * Either we are in fallback mode due to wrong
1363                          * config or config from a later fw version,
1364                          * or the file is corrupt or hand-edited.
1365                          */
1366                         dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1367                                  size - mxt_obj_size(object), type);
1368                 } else if (mxt_obj_size(object) > size) {
1369                         /*
1370                          * If firmware is upgraded, new bytes may be added to
1371                          * end of objects. It is generally forward compatible
1372                          * to zero these bytes - previous behaviour will be
1373                          * retained. However this does invalidate the CRC and
1374                          * will force fallback mode until the configuration is
1375                          * updated. We warn here but do nothing else - the
1376                          * malloc has zeroed the entire configuration.
1377                          */
1378                         dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1379                                  mxt_obj_size(object) - size, type);
1380                 }
1381
1382                 if (instance >= mxt_obj_instances(object)) {
1383                         dev_err(dev, "Object instances exceeded!\n");
1384                         return -EINVAL;
1385                 }
1386
1387                 reg = object->start_address + mxt_obj_size(object) * instance;
1388
1389                 for (i = 0; i < size; i++) {
1390                         ret = sscanf(cfg->raw + cfg->raw_pos, "%hhx%n",
1391                                      &val,
1392                                      &offset);
1393                         if (ret != 1) {
1394                                 dev_err(dev, "Bad format in T%d at %d\n",
1395                                         type, i);
1396                                 return -EINVAL;
1397                         }
1398                         cfg->raw_pos += offset;
1399
1400                         if (i > mxt_obj_size(object))
1401                                 continue;
1402
1403                         byte_offset = reg + i - cfg->start_ofs;
1404
1405                         if (byte_offset >= 0 && byte_offset < cfg->mem_size) {
1406                                 *(cfg->mem + byte_offset) = val;
1407                         } else {
1408                                 dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1409                                         reg, object->type, byte_offset);
1410                                 return -EINVAL;
1411                         }
1412                 }
1413         }
1414
1415         return 0;
1416 }
1417
1418 static int mxt_upload_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
1419 {
1420         unsigned int byte_offset = 0;
1421         int error;
1422
1423         /* Write configuration as blocks */
1424         while (byte_offset < cfg->mem_size) {
1425                 unsigned int size = cfg->mem_size - byte_offset;
1426
1427                 if (size > MXT_MAX_BLOCK_WRITE)
1428                         size = MXT_MAX_BLOCK_WRITE;
1429
1430                 error = __mxt_write_reg(data->client,
1431                                         cfg->start_ofs + byte_offset,
1432                                         size, cfg->mem + byte_offset);
1433                 if (error) {
1434                         dev_err(&data->client->dev,
1435                                 "Config write error, ret=%d\n", error);
1436                         return error;
1437                 }
1438
1439                 byte_offset += size;
1440         }
1441
1442         return 0;
1443 }
1444
1445 static int mxt_init_t7_power_cfg(struct mxt_data *data);
1446
1447 /*
1448  * mxt_update_cfg - download configuration to chip
1449  *
1450  * Atmel Raw Config File Format
1451  *
1452  * The first four lines of the raw config file contain:
1453  *  1) Version
1454  *  2) Chip ID Information (first 7 bytes of device memory)
1455  *  3) Chip Information Block 24-bit CRC Checksum
1456  *  4) Chip Configuration 24-bit CRC Checksum
1457  *
1458  * The rest of the file consists of one line per object instance:
1459  *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1460  *
1461  *   <TYPE> - 2-byte object type as hex
1462  *   <INSTANCE> - 2-byte object instance number as hex
1463  *   <SIZE> - 2-byte object size as hex
1464  *   <CONTENTS> - array of <SIZE> 1-byte hex values
1465  */
1466 static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
1467 {
1468         struct device *dev = &data->client->dev;
1469         struct mxt_cfg cfg;
1470         int ret;
1471         int offset;
1472         int i;
1473         u32 info_crc, config_crc, calculated_crc;
1474         u16 crc_start = 0;
1475
1476         /* Make zero terminated copy of the OBP_RAW file */
1477         cfg.raw = kmemdup_nul(fw->data, fw->size, GFP_KERNEL);
1478         if (!cfg.raw)
1479                 return -ENOMEM;
1480
1481         cfg.raw_size = fw->size;
1482
1483         mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1484
1485         if (strncmp(cfg.raw, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1486                 dev_err(dev, "Unrecognised config file\n");
1487                 ret = -EINVAL;
1488                 goto release_raw;
1489         }
1490
1491         cfg.raw_pos = strlen(MXT_CFG_MAGIC);
1492
1493         /* Load information block and check */
1494         for (i = 0; i < sizeof(struct mxt_info); i++) {
1495                 ret = sscanf(cfg.raw + cfg.raw_pos, "%hhx%n",
1496                              (unsigned char *)&cfg.info + i,
1497                              &offset);
1498                 if (ret != 1) {
1499                         dev_err(dev, "Bad format\n");
1500                         ret = -EINVAL;
1501                         goto release_raw;
1502                 }
1503
1504                 cfg.raw_pos += offset;
1505         }
1506
1507         if (cfg.info.family_id != data->info->family_id) {
1508                 dev_err(dev, "Family ID mismatch!\n");
1509                 ret = -EINVAL;
1510                 goto release_raw;
1511         }
1512
1513         if (cfg.info.variant_id != data->info->variant_id) {
1514                 dev_err(dev, "Variant ID mismatch!\n");
1515                 ret = -EINVAL;
1516                 goto release_raw;
1517         }
1518
1519         /* Read CRCs */
1520         ret = sscanf(cfg.raw + cfg.raw_pos, "%x%n", &info_crc, &offset);
1521         if (ret != 1) {
1522                 dev_err(dev, "Bad format: failed to parse Info CRC\n");
1523                 ret = -EINVAL;
1524                 goto release_raw;
1525         }
1526         cfg.raw_pos += offset;
1527
1528         ret = sscanf(cfg.raw + cfg.raw_pos, "%x%n", &config_crc, &offset);
1529         if (ret != 1) {
1530                 dev_err(dev, "Bad format: failed to parse Config CRC\n");
1531                 ret = -EINVAL;
1532                 goto release_raw;
1533         }
1534         cfg.raw_pos += offset;
1535
1536         /*
1537          * The Info Block CRC is calculated over mxt_info and the object
1538          * table. If it does not match then we are trying to load the
1539          * configuration from a different chip or firmware version, so
1540          * the configuration CRC is invalid anyway.
1541          */
1542         if (info_crc == data->info_crc) {
1543                 if (config_crc == 0 || data->config_crc == 0) {
1544                         dev_info(dev, "CRC zero, attempting to apply config\n");
1545                 } else if (config_crc == data->config_crc) {
1546                         dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1547                                  data->config_crc);
1548                         ret = 0;
1549                         goto release_raw;
1550                 } else {
1551                         dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1552                                  data->config_crc, config_crc);
1553                 }
1554         } else {
1555                 dev_warn(dev,
1556                          "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1557                          data->info_crc, info_crc);
1558         }
1559
1560         /* Malloc memory to store configuration */
1561         cfg.start_ofs = MXT_OBJECT_START +
1562                         data->info->object_num * sizeof(struct mxt_object) +
1563                         MXT_INFO_CHECKSUM_SIZE;
1564         cfg.mem_size = data->mem_size - cfg.start_ofs;
1565         cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);
1566         if (!cfg.mem) {
1567                 ret = -ENOMEM;
1568                 goto release_raw;
1569         }
1570
1571         ret = mxt_prepare_cfg_mem(data, &cfg);
1572         if (ret)
1573                 goto release_mem;
1574
1575         /* Calculate crc of the received configs (not the raw config file) */
1576         if (data->T71_address)
1577                 crc_start = data->T71_address;
1578         else if (data->T7_address)
1579                 crc_start = data->T7_address;
1580         else
1581                 dev_warn(dev, "Could not find CRC start\n");
1582
1583         if (crc_start > cfg.start_ofs) {
1584                 calculated_crc = mxt_calculate_crc(cfg.mem,
1585                                                    crc_start - cfg.start_ofs,
1586                                                    cfg.mem_size);
1587
1588                 if (config_crc > 0 && config_crc != calculated_crc)
1589                         dev_warn(dev, "Config CRC in file inconsistent, calculated=%06X, file=%06X\n",
1590                                  calculated_crc, config_crc);
1591         }
1592
1593         ret = mxt_upload_cfg_mem(data, &cfg);
1594         if (ret)
1595                 goto release_mem;
1596
1597         mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1598
1599         ret = mxt_check_retrigen(data);
1600         if (ret)
1601                 goto release_mem;
1602
1603         ret = mxt_soft_reset(data);
1604         if (ret)
1605                 goto release_mem;
1606
1607         dev_info(dev, "Config successfully updated\n");
1608
1609         /* T7 config may have changed */
1610         mxt_init_t7_power_cfg(data);
1611
1612 release_mem:
1613         kfree(cfg.mem);
1614 release_raw:
1615         kfree(cfg.raw);
1616         return ret;
1617 }
1618
1619 static void mxt_free_input_device(struct mxt_data *data)
1620 {
1621         if (data->input_dev) {
1622                 input_unregister_device(data->input_dev);
1623                 data->input_dev = NULL;
1624         }
1625 }
1626
1627 static void mxt_free_object_table(struct mxt_data *data)
1628 {
1629 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
1630         video_unregister_device(&data->dbg.vdev);
1631         v4l2_device_unregister(&data->dbg.v4l2);
1632 #endif
1633         data->object_table = NULL;
1634         data->info = NULL;
1635         kfree(data->raw_info_block);
1636         data->raw_info_block = NULL;
1637         kfree(data->msg_buf);
1638         data->msg_buf = NULL;
1639         data->T5_address = 0;
1640         data->T5_msg_size = 0;
1641         data->T6_reportid = 0;
1642         data->T7_address = 0;
1643         data->T71_address = 0;
1644         data->T9_reportid_min = 0;
1645         data->T9_reportid_max = 0;
1646         data->T18_address = 0;
1647         data->T19_reportid = 0;
1648         data->T44_address = 0;
1649         data->T100_reportid_min = 0;
1650         data->T100_reportid_max = 0;
1651         data->max_reportid = 0;
1652 }
1653
1654 static int mxt_parse_object_table(struct mxt_data *data,
1655                                   struct mxt_object *object_table)
1656 {
1657         struct i2c_client *client = data->client;
1658         int i;
1659         u8 reportid;
1660         u16 end_address;
1661
1662         /* Valid Report IDs start counting from 1 */
1663         reportid = 1;
1664         data->mem_size = 0;
1665         for (i = 0; i < data->info->object_num; i++) {
1666                 struct mxt_object *object = object_table + i;
1667                 u8 min_id, max_id;
1668
1669                 le16_to_cpus(&object->start_address);
1670
1671                 if (object->num_report_ids) {
1672                         min_id = reportid;
1673                         reportid += object->num_report_ids *
1674                                         mxt_obj_instances(object);
1675                         max_id = reportid - 1;
1676                 } else {
1677                         min_id = 0;
1678                         max_id = 0;
1679                 }
1680
1681                 dev_dbg(&data->client->dev,
1682                         "T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1683                         object->type, object->start_address,
1684                         mxt_obj_size(object), mxt_obj_instances(object),
1685                         min_id, max_id);
1686
1687                 switch (object->type) {
1688                 case MXT_GEN_MESSAGE_T5:
1689                         if (data->info->family_id == 0x80 &&
1690                             data->info->version < 0x20) {
1691                                 /*
1692                                  * On mXT224 firmware versions prior to V2.0
1693                                  * read and discard unused CRC byte otherwise
1694                                  * DMA reads are misaligned.
1695                                  */
1696                                 data->T5_msg_size = mxt_obj_size(object);
1697                         } else {
1698                                 /* CRC not enabled, so skip last byte */
1699                                 data->T5_msg_size = mxt_obj_size(object) - 1;
1700                         }
1701                         data->T5_address = object->start_address;
1702                         break;
1703                 case MXT_GEN_COMMAND_T6:
1704                         data->T6_reportid = min_id;
1705                         data->T6_address = object->start_address;
1706                         break;
1707                 case MXT_GEN_POWER_T7:
1708                         data->T7_address = object->start_address;
1709                         break;
1710                 case MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71:
1711                         data->T71_address = object->start_address;
1712                         break;
1713                 case MXT_TOUCH_MULTI_T9:
1714                         data->multitouch = MXT_TOUCH_MULTI_T9;
1715                         /* Only handle messages from first T9 instance */
1716                         data->T9_reportid_min = min_id;
1717                         data->T9_reportid_max = min_id +
1718                                                 object->num_report_ids - 1;
1719                         data->num_touchids = object->num_report_ids;
1720                         break;
1721                 case MXT_SPT_COMMSCONFIG_T18:
1722                         data->T18_address = object->start_address;
1723                         break;
1724                 case MXT_SPT_MESSAGECOUNT_T44:
1725                         data->T44_address = object->start_address;
1726                         break;
1727                 case MXT_SPT_GPIOPWM_T19:
1728                         data->T19_reportid = min_id;
1729                         break;
1730                 case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1731                         data->multitouch = MXT_TOUCH_MULTITOUCHSCREEN_T100;
1732                         data->T100_reportid_min = min_id;
1733                         data->T100_reportid_max = max_id;
1734                         /* first two report IDs reserved */
1735                         data->num_touchids = object->num_report_ids - 2;
1736                         break;
1737                 }
1738
1739                 end_address = object->start_address
1740                         + mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1741
1742                 if (end_address >= data->mem_size)
1743                         data->mem_size = end_address + 1;
1744         }
1745
1746         /* Store maximum reportid */
1747         data->max_reportid = reportid;
1748
1749         /* If T44 exists, T5 position has to be directly after */
1750         if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1751                 dev_err(&client->dev, "Invalid T44 position\n");
1752                 return -EINVAL;
1753         }
1754
1755         data->msg_buf = kcalloc(data->max_reportid,
1756                                 data->T5_msg_size, GFP_KERNEL);
1757         if (!data->msg_buf)
1758                 return -ENOMEM;
1759
1760         return 0;
1761 }
1762
1763 static int mxt_read_info_block(struct mxt_data *data)
1764 {
1765         struct i2c_client *client = data->client;
1766         int error;
1767         size_t size;
1768         void *id_buf, *buf;
1769         uint8_t num_objects;
1770         u32 calculated_crc;
1771         u8 *crc_ptr;
1772
1773         /* If info block already allocated, free it */
1774         if (data->raw_info_block)
1775                 mxt_free_object_table(data);
1776
1777         /* Read 7-byte ID information block starting at address 0 */
1778         size = sizeof(struct mxt_info);
1779         id_buf = kzalloc(size, GFP_KERNEL);
1780         if (!id_buf)
1781                 return -ENOMEM;
1782
1783         error = __mxt_read_reg(client, 0, size, id_buf);
1784         if (error)
1785                 goto err_free_mem;
1786
1787         /* Resize buffer to give space for rest of info block */
1788         num_objects = ((struct mxt_info *)id_buf)->object_num;
1789         size += (num_objects * sizeof(struct mxt_object))
1790                 + MXT_INFO_CHECKSUM_SIZE;
1791
1792         buf = krealloc(id_buf, size, GFP_KERNEL);
1793         if (!buf) {
1794                 error = -ENOMEM;
1795                 goto err_free_mem;
1796         }
1797         id_buf = buf;
1798
1799         /* Read rest of info block */
1800         error = __mxt_read_reg(client, MXT_OBJECT_START,
1801                                size - MXT_OBJECT_START,
1802                                id_buf + MXT_OBJECT_START);
1803         if (error)
1804                 goto err_free_mem;
1805
1806         /* Extract & calculate checksum */
1807         crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
1808         data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
1809
1810         calculated_crc = mxt_calculate_crc(id_buf, 0,
1811                                            size - MXT_INFO_CHECKSUM_SIZE);
1812
1813         /*
1814          * CRC mismatch can be caused by data corruption due to I2C comms
1815          * issue or else device is not using Object Based Protocol (eg i2c-hid)
1816          */
1817         if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
1818                 dev_err(&client->dev,
1819                         "Info Block CRC error calculated=0x%06X read=0x%06X\n",
1820                         calculated_crc, data->info_crc);
1821                 error = -EIO;
1822                 goto err_free_mem;
1823         }
1824
1825         data->raw_info_block = id_buf;
1826         data->info = (struct mxt_info *)id_buf;
1827
1828         dev_info(&client->dev,
1829                  "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
1830                  data->info->family_id, data->info->variant_id,
1831                  data->info->version >> 4, data->info->version & 0xf,
1832                  data->info->build, data->info->object_num);
1833
1834         /* Parse object table information */
1835         error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
1836         if (error) {
1837                 dev_err(&client->dev, "Error %d parsing object table\n", error);
1838                 mxt_free_object_table(data);
1839                 goto err_free_mem;
1840         }
1841
1842         data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
1843
1844         return 0;
1845
1846 err_free_mem:
1847         kfree(id_buf);
1848         return error;
1849 }
1850
1851 static int mxt_read_t9_resolution(struct mxt_data *data)
1852 {
1853         struct i2c_client *client = data->client;
1854         int error;
1855         struct t9_range range;
1856         unsigned char orient;
1857         struct mxt_object *object;
1858
1859         object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1860         if (!object)
1861                 return -EINVAL;
1862
1863         error = __mxt_read_reg(client,
1864                                object->start_address + MXT_T9_XSIZE,
1865                                sizeof(data->xsize), &data->xsize);
1866         if (error)
1867                 return error;
1868
1869         error = __mxt_read_reg(client,
1870                                object->start_address + MXT_T9_YSIZE,
1871                                sizeof(data->ysize), &data->ysize);
1872         if (error)
1873                 return error;
1874
1875         error = __mxt_read_reg(client,
1876                                object->start_address + MXT_T9_RANGE,
1877                                sizeof(range), &range);
1878         if (error)
1879                 return error;
1880
1881         data->max_x = get_unaligned_le16(&range.x);
1882         data->max_y = get_unaligned_le16(&range.y);
1883
1884         error =  __mxt_read_reg(client,
1885                                 object->start_address + MXT_T9_ORIENT,
1886                                 1, &orient);
1887         if (error)
1888                 return error;
1889
1890         data->xy_switch = orient & MXT_T9_ORIENT_SWITCH;
1891         data->invertx = orient & MXT_T9_ORIENT_INVERTX;
1892         data->inverty = orient & MXT_T9_ORIENT_INVERTY;
1893
1894         return 0;
1895 }
1896
1897 static int mxt_read_t100_config(struct mxt_data *data)
1898 {
1899         struct i2c_client *client = data->client;
1900         int error;
1901         struct mxt_object *object;
1902         u16 range_x, range_y;
1903         u8 cfg, tchaux;
1904         u8 aux;
1905
1906         object = mxt_get_object(data, MXT_TOUCH_MULTITOUCHSCREEN_T100);
1907         if (!object)
1908                 return -EINVAL;
1909
1910         /* read touchscreen dimensions */
1911         error = __mxt_read_reg(client,
1912                                object->start_address + MXT_T100_XRANGE,
1913                                sizeof(range_x), &range_x);
1914         if (error)
1915                 return error;
1916
1917         data->max_x = get_unaligned_le16(&range_x);
1918
1919         error = __mxt_read_reg(client,
1920                                object->start_address + MXT_T100_YRANGE,
1921                                sizeof(range_y), &range_y);
1922         if (error)
1923                 return error;
1924
1925         data->max_y = get_unaligned_le16(&range_y);
1926
1927         error = __mxt_read_reg(client,
1928                                object->start_address + MXT_T100_XSIZE,
1929                                sizeof(data->xsize), &data->xsize);
1930         if (error)
1931                 return error;
1932
1933         error = __mxt_read_reg(client,
1934                                object->start_address + MXT_T100_YSIZE,
1935                                sizeof(data->ysize), &data->ysize);
1936         if (error)
1937                 return error;
1938
1939         /* read orientation config */
1940         error =  __mxt_read_reg(client,
1941                                 object->start_address + MXT_T100_CFG1,
1942                                 1, &cfg);
1943         if (error)
1944                 return error;
1945
1946         data->xy_switch = cfg & MXT_T100_CFG_SWITCHXY;
1947         data->invertx = cfg & MXT_T100_CFG_INVERTX;
1948         data->inverty = cfg & MXT_T100_CFG_INVERTY;
1949
1950         /* allocate aux bytes */
1951         error =  __mxt_read_reg(client,
1952                                 object->start_address + MXT_T100_TCHAUX,
1953                                 1, &tchaux);
1954         if (error)
1955                 return error;
1956
1957         aux = 6;
1958
1959         if (tchaux & MXT_T100_TCHAUX_VECT)
1960                 data->t100_aux_vect = aux++;
1961
1962         if (tchaux & MXT_T100_TCHAUX_AMPL)
1963                 data->t100_aux_ampl = aux++;
1964
1965         if (tchaux & MXT_T100_TCHAUX_AREA)
1966                 data->t100_aux_area = aux++;
1967
1968         dev_dbg(&client->dev,
1969                 "T100 aux mappings vect:%u ampl:%u area:%u\n",
1970                 data->t100_aux_vect, data->t100_aux_ampl, data->t100_aux_area);
1971
1972         return 0;
1973 }
1974
1975 static int mxt_input_open(struct input_dev *dev);
1976 static void mxt_input_close(struct input_dev *dev);
1977
1978 static void mxt_set_up_as_touchpad(struct input_dev *input_dev,
1979                                    struct mxt_data *data)
1980 {
1981         int i;
1982
1983         input_dev->name = "Atmel maXTouch Touchpad";
1984
1985         __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1986
1987         input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1988         input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1989         input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1990                           MXT_PIXELS_PER_MM);
1991         input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1992                           MXT_PIXELS_PER_MM);
1993
1994         for (i = 0; i < data->t19_num_keys; i++)
1995                 if (data->t19_keymap[i] != KEY_RESERVED)
1996                         input_set_capability(input_dev, EV_KEY,
1997                                              data->t19_keymap[i]);
1998 }
1999
2000 static int mxt_initialize_input_device(struct mxt_data *data)
2001 {
2002         struct device *dev = &data->client->dev;
2003         struct input_dev *input_dev;
2004         int error;
2005         unsigned int num_mt_slots;
2006         unsigned int mt_flags = 0;
2007
2008         switch (data->multitouch) {
2009         case MXT_TOUCH_MULTI_T9:
2010                 num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
2011                 error = mxt_read_t9_resolution(data);
2012                 if (error)
2013                         dev_warn(dev, "Failed to initialize T9 resolution\n");
2014                 break;
2015
2016         case MXT_TOUCH_MULTITOUCHSCREEN_T100:
2017                 num_mt_slots = data->num_touchids;
2018                 error = mxt_read_t100_config(data);
2019                 if (error)
2020                         dev_warn(dev, "Failed to read T100 config\n");
2021                 break;
2022
2023         default:
2024                 dev_err(dev, "Invalid multitouch object\n");
2025                 return -EINVAL;
2026         }
2027
2028         /* Handle default values and orientation switch */
2029         if (data->max_x == 0)
2030                 data->max_x = 1023;
2031
2032         if (data->max_y == 0)
2033                 data->max_y = 1023;
2034
2035         if (data->xy_switch)
2036                 swap(data->max_x, data->max_y);
2037
2038         dev_info(dev, "Touchscreen size X%uY%u\n", data->max_x, data->max_y);
2039
2040         /* Register input device */
2041         input_dev = input_allocate_device();
2042         if (!input_dev)
2043                 return -ENOMEM;
2044
2045         input_dev->name = "Atmel maXTouch Touchscreen";
2046         input_dev->phys = data->phys;
2047         input_dev->id.bustype = BUS_I2C;
2048         input_dev->dev.parent = dev;
2049         input_dev->open = mxt_input_open;
2050         input_dev->close = mxt_input_close;
2051
2052         input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
2053
2054         /* For single touch */
2055         input_set_abs_params(input_dev, ABS_X, 0, data->max_x, 0, 0);
2056         input_set_abs_params(input_dev, ABS_Y, 0, data->max_y, 0, 0);
2057
2058         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2059             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2060              data->t100_aux_ampl)) {
2061                 input_set_abs_params(input_dev, ABS_PRESSURE, 0, 255, 0, 0);
2062         }
2063
2064         /* If device has buttons we assume it is a touchpad */
2065         if (data->t19_num_keys) {
2066                 mxt_set_up_as_touchpad(input_dev, data);
2067                 mt_flags |= INPUT_MT_POINTER;
2068         } else {
2069                 mt_flags |= INPUT_MT_DIRECT;
2070         }
2071
2072         /* For multi touch */
2073         error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
2074         if (error) {
2075                 dev_err(dev, "Error %d initialising slots\n", error);
2076                 goto err_free_mem;
2077         }
2078
2079         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100) {
2080                 input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
2081                                      0, MT_TOOL_MAX, 0, 0);
2082                 input_set_abs_params(input_dev, ABS_MT_DISTANCE,
2083                                      MXT_DISTANCE_ACTIVE_TOUCH,
2084                                      MXT_DISTANCE_HOVERING,
2085                                      0, 0);
2086         }
2087
2088         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
2089                              0, data->max_x, 0, 0);
2090         input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
2091                              0, data->max_y, 0, 0);
2092
2093         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2094             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2095              data->t100_aux_area)) {
2096                 input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
2097                                      0, MXT_MAX_AREA, 0, 0);
2098         }
2099
2100         if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2101             (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2102              data->t100_aux_ampl)) {
2103                 input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2104                                      0, 255, 0, 0);
2105         }
2106
2107         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2108             data->t100_aux_vect) {
2109                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2110                                      0, 255, 0, 0);
2111         }
2112
2113         if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2114             data->t100_aux_vect) {
2115                 input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2116                                      0, 255, 0, 0);
2117         }
2118
2119         input_set_drvdata(input_dev, data);
2120
2121         error = input_register_device(input_dev);
2122         if (error) {
2123                 dev_err(dev, "Error %d registering input device\n", error);
2124                 goto err_free_mem;
2125         }
2126
2127         data->input_dev = input_dev;
2128
2129         return 0;
2130
2131 err_free_mem:
2132         input_free_device(input_dev);
2133         return error;
2134 }
2135
2136 static int mxt_configure_objects(struct mxt_data *data,
2137                                  const struct firmware *cfg);
2138
2139 static void mxt_config_cb(const struct firmware *cfg, void *ctx)
2140 {
2141         mxt_configure_objects(ctx, cfg);
2142         release_firmware(cfg);
2143 }
2144
2145 static int mxt_initialize(struct mxt_data *data)
2146 {
2147         struct i2c_client *client = data->client;
2148         int recovery_attempts = 0;
2149         int error;
2150
2151         while (1) {
2152                 error = mxt_read_info_block(data);
2153                 if (!error)
2154                         break;
2155
2156                 /* Check bootloader state */
2157                 error = mxt_probe_bootloader(data, false);
2158                 if (error) {
2159                         dev_info(&client->dev, "Trying alternate bootloader address\n");
2160                         error = mxt_probe_bootloader(data, true);
2161                         if (error) {
2162                                 /* Chip is not in appmode or bootloader mode */
2163                                 return error;
2164                         }
2165                 }
2166
2167                 /* OK, we are in bootloader, see if we can recover */
2168                 if (++recovery_attempts > 1) {
2169                         dev_err(&client->dev, "Could not recover from bootloader mode\n");
2170                         /*
2171                          * We can reflash from this state, so do not
2172                          * abort initialization.
2173                          */
2174                         data->in_bootloader = true;
2175                         return 0;
2176                 }
2177
2178                 /* Attempt to exit bootloader into app mode */
2179                 mxt_send_bootloader_cmd(data, false);
2180                 msleep(MXT_FW_RESET_TIME);
2181         }
2182
2183         error = mxt_check_retrigen(data);
2184         if (error)
2185                 return error;
2186
2187         error = mxt_acquire_irq(data);
2188         if (error)
2189                 return error;
2190
2191         error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
2192                                         &client->dev, GFP_KERNEL, data,
2193                                         mxt_config_cb);
2194         if (error) {
2195                 dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
2196                         error);
2197                 return error;
2198         }
2199
2200         return 0;
2201 }
2202
2203 static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
2204 {
2205         struct device *dev = &data->client->dev;
2206         int error;
2207         struct t7_config *new_config;
2208         struct t7_config deepsleep = { .active = 0, .idle = 0 };
2209
2210         if (sleep == MXT_POWER_CFG_DEEPSLEEP)
2211                 new_config = &deepsleep;
2212         else
2213                 new_config = &data->t7_cfg;
2214
2215         error = __mxt_write_reg(data->client, data->T7_address,
2216                                 sizeof(data->t7_cfg), new_config);
2217         if (error)
2218                 return error;
2219
2220         dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
2221                 new_config->active, new_config->idle);
2222
2223         return 0;
2224 }
2225
2226 static int mxt_init_t7_power_cfg(struct mxt_data *data)
2227 {
2228         struct device *dev = &data->client->dev;
2229         int error;
2230         bool retry = false;
2231
2232 recheck:
2233         error = __mxt_read_reg(data->client, data->T7_address,
2234                                 sizeof(data->t7_cfg), &data->t7_cfg);
2235         if (error)
2236                 return error;
2237
2238         if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
2239                 if (!retry) {
2240                         dev_dbg(dev, "T7 cfg zero, resetting\n");
2241                         mxt_soft_reset(data);
2242                         retry = true;
2243                         goto recheck;
2244                 } else {
2245                         dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
2246                         data->t7_cfg.active = 20;
2247                         data->t7_cfg.idle = 100;
2248                         return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2249                 }
2250         }
2251
2252         dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
2253                 data->t7_cfg.active, data->t7_cfg.idle);
2254         return 0;
2255 }
2256
2257 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
2258 static const struct v4l2_file_operations mxt_video_fops = {
2259         .owner = THIS_MODULE,
2260         .open = v4l2_fh_open,
2261         .release = vb2_fop_release,
2262         .unlocked_ioctl = video_ioctl2,
2263         .read = vb2_fop_read,
2264         .mmap = vb2_fop_mmap,
2265         .poll = vb2_fop_poll,
2266 };
2267
2268 static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
2269                                unsigned int y)
2270 {
2271         struct mxt_info *info = data->info;
2272         struct mxt_dbg *dbg = &data->dbg;
2273         unsigned int ofs, page;
2274         unsigned int col = 0;
2275         unsigned int col_width;
2276
2277         if (info->family_id == MXT_FAMILY_1386) {
2278                 col_width = info->matrix_ysize / MXT1386_COLUMNS;
2279                 col = y / col_width;
2280                 y = y % col_width;
2281         } else {
2282                 col_width = info->matrix_ysize;
2283         }
2284
2285         ofs = (y + (x * col_width)) * sizeof(u16);
2286         page = ofs / MXT_DIAGNOSTIC_SIZE;
2287         ofs %= MXT_DIAGNOSTIC_SIZE;
2288
2289         if (info->family_id == MXT_FAMILY_1386)
2290                 page += col * MXT1386_PAGES_PER_COLUMN;
2291
2292         return get_unaligned_le16(&dbg->t37_buf[page].data[ofs]);
2293 }
2294
2295 static int mxt_convert_debug_pages(struct mxt_data *data, u16 *outbuf)
2296 {
2297         struct mxt_dbg *dbg = &data->dbg;
2298         unsigned int x = 0;
2299         unsigned int y = 0;
2300         unsigned int i, rx, ry;
2301
2302         for (i = 0; i < dbg->t37_nodes; i++) {
2303                 /* Handle orientation */
2304                 rx = data->xy_switch ? y : x;
2305                 ry = data->xy_switch ? x : y;
2306                 rx = data->invertx ? (data->xsize - 1 - rx) : rx;
2307                 ry = data->inverty ? (data->ysize - 1 - ry) : ry;
2308
2309                 outbuf[i] = mxt_get_debug_value(data, rx, ry);
2310
2311                 /* Next value */
2312                 if (++x >= (data->xy_switch ? data->ysize : data->xsize)) {
2313                         x = 0;
2314                         y++;
2315                 }
2316         }
2317
2318         return 0;
2319 }
2320
2321 static int mxt_read_diagnostic_debug(struct mxt_data *data, u8 mode,
2322                                      u16 *outbuf)
2323 {
2324         struct mxt_dbg *dbg = &data->dbg;
2325         int retries = 0;
2326         int page;
2327         int ret;
2328         u8 cmd = mode;
2329         struct t37_debug *p;
2330         u8 cmd_poll;
2331
2332         for (page = 0; page < dbg->t37_pages; page++) {
2333                 p = dbg->t37_buf + page;
2334
2335                 ret = mxt_write_reg(data->client, dbg->diag_cmd_address,
2336                                     cmd);
2337                 if (ret)
2338                         return ret;
2339
2340                 retries = 0;
2341                 msleep(20);
2342 wait_cmd:
2343                 /* Read back command byte */
2344                 ret = __mxt_read_reg(data->client, dbg->diag_cmd_address,
2345                                      sizeof(cmd_poll), &cmd_poll);
2346                 if (ret)
2347                         return ret;
2348
2349                 /* Field is cleared once the command has been processed */
2350                 if (cmd_poll) {
2351                         if (retries++ > 100)
2352                                 return -EINVAL;
2353
2354                         msleep(20);
2355                         goto wait_cmd;
2356                 }
2357
2358                 /* Read T37 page */
2359                 ret = __mxt_read_reg(data->client, dbg->t37_address,
2360                                      sizeof(struct t37_debug), p);
2361                 if (ret)
2362                         return ret;
2363
2364                 if (p->mode != mode || p->page != page) {
2365                         dev_err(&data->client->dev, "T37 page mismatch\n");
2366                         return -EINVAL;
2367                 }
2368
2369                 dev_dbg(&data->client->dev, "%s page:%d retries:%d\n",
2370                         __func__, page, retries);
2371
2372                 /* For remaining pages, write PAGEUP rather than mode */
2373                 cmd = MXT_DIAGNOSTIC_PAGEUP;
2374         }
2375
2376         return mxt_convert_debug_pages(data, outbuf);
2377 }
2378
2379 static int mxt_queue_setup(struct vb2_queue *q,
2380                        unsigned int *nbuffers, unsigned int *nplanes,
2381                        unsigned int sizes[], struct device *alloc_devs[])
2382 {
2383         struct mxt_data *data = q->drv_priv;
2384         size_t size = data->dbg.t37_nodes * sizeof(u16);
2385
2386         if (*nplanes)
2387                 return sizes[0] < size ? -EINVAL : 0;
2388
2389         *nplanes = 1;
2390         sizes[0] = size;
2391
2392         return 0;
2393 }
2394
2395 static void mxt_buffer_queue(struct vb2_buffer *vb)
2396 {
2397         struct mxt_data *data = vb2_get_drv_priv(vb->vb2_queue);
2398         u16 *ptr;
2399         int ret;
2400         u8 mode;
2401
2402         ptr = vb2_plane_vaddr(vb, 0);
2403         if (!ptr) {
2404                 dev_err(&data->client->dev, "Error acquiring frame ptr\n");
2405                 goto fault;
2406         }
2407
2408         switch (data->dbg.input) {
2409         case MXT_V4L_INPUT_DELTAS:
2410         default:
2411                 mode = MXT_DIAGNOSTIC_DELTAS;
2412                 break;
2413
2414         case MXT_V4L_INPUT_REFS:
2415                 mode = MXT_DIAGNOSTIC_REFS;
2416                 break;
2417         }
2418
2419         ret = mxt_read_diagnostic_debug(data, mode, ptr);
2420         if (ret)
2421                 goto fault;
2422
2423         vb2_set_plane_payload(vb, 0, data->dbg.t37_nodes * sizeof(u16));
2424         vb2_buffer_done(vb, VB2_BUF_STATE_DONE);
2425         return;
2426
2427 fault:
2428         vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
2429 }
2430
2431 /* V4L2 structures */
2432 static const struct vb2_ops mxt_queue_ops = {
2433         .queue_setup            = mxt_queue_setup,
2434         .buf_queue              = mxt_buffer_queue,
2435         .wait_prepare           = vb2_ops_wait_prepare,
2436         .wait_finish            = vb2_ops_wait_finish,
2437 };
2438
2439 static const struct vb2_queue mxt_queue = {
2440         .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
2441         .io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
2442         .buf_struct_size = sizeof(struct mxt_vb2_buffer),
2443         .ops = &mxt_queue_ops,
2444         .mem_ops = &vb2_vmalloc_memops,
2445         .timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
2446         .min_buffers_needed = 1,
2447 };
2448
2449 static int mxt_vidioc_querycap(struct file *file, void *priv,
2450                                  struct v4l2_capability *cap)
2451 {
2452         struct mxt_data *data = video_drvdata(file);
2453
2454         strlcpy(cap->driver, "atmel_mxt_ts", sizeof(cap->driver));
2455         strlcpy(cap->card, "atmel_mxt_ts touch", sizeof(cap->card));
2456         snprintf(cap->bus_info, sizeof(cap->bus_info),
2457                  "I2C:%s", dev_name(&data->client->dev));
2458         return 0;
2459 }
2460
2461 static int mxt_vidioc_enum_input(struct file *file, void *priv,
2462                                    struct v4l2_input *i)
2463 {
2464         if (i->index >= MXT_V4L_INPUT_MAX)
2465                 return -EINVAL;
2466
2467         i->type = V4L2_INPUT_TYPE_TOUCH;
2468
2469         switch (i->index) {
2470         case MXT_V4L_INPUT_REFS:
2471                 strlcpy(i->name, "Mutual Capacitance References",
2472                         sizeof(i->name));
2473                 break;
2474         case MXT_V4L_INPUT_DELTAS:
2475                 strlcpy(i->name, "Mutual Capacitance Deltas", sizeof(i->name));
2476                 break;
2477         }
2478
2479         return 0;
2480 }
2481
2482 static int mxt_set_input(struct mxt_data *data, unsigned int i)
2483 {
2484         struct v4l2_pix_format *f = &data->dbg.format;
2485
2486         if (i >= MXT_V4L_INPUT_MAX)
2487                 return -EINVAL;
2488
2489         if (i == MXT_V4L_INPUT_DELTAS)
2490                 f->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2491         else
2492                 f->pixelformat = V4L2_TCH_FMT_TU16;
2493
2494         f->width = data->xy_switch ? data->ysize : data->xsize;
2495         f->height = data->xy_switch ? data->xsize : data->ysize;
2496         f->field = V4L2_FIELD_NONE;
2497         f->colorspace = V4L2_COLORSPACE_RAW;
2498         f->bytesperline = f->width * sizeof(u16);
2499         f->sizeimage = f->width * f->height * sizeof(u16);
2500
2501         data->dbg.input = i;
2502
2503         return 0;
2504 }
2505
2506 static int mxt_vidioc_s_input(struct file *file, void *priv, unsigned int i)
2507 {
2508         return mxt_set_input(video_drvdata(file), i);
2509 }
2510
2511 static int mxt_vidioc_g_input(struct file *file, void *priv, unsigned int *i)
2512 {
2513         struct mxt_data *data = video_drvdata(file);
2514
2515         *i = data->dbg.input;
2516
2517         return 0;
2518 }
2519
2520 static int mxt_vidioc_fmt(struct file *file, void *priv, struct v4l2_format *f)
2521 {
2522         struct mxt_data *data = video_drvdata(file);
2523
2524         f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
2525         f->fmt.pix = data->dbg.format;
2526
2527         return 0;
2528 }
2529
2530 static int mxt_vidioc_enum_fmt(struct file *file, void *priv,
2531                                  struct v4l2_fmtdesc *fmt)
2532 {
2533         if (fmt->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2534                 return -EINVAL;
2535
2536         switch (fmt->index) {
2537         case 0:
2538                 fmt->pixelformat = V4L2_TCH_FMT_TU16;
2539                 break;
2540
2541         case 1:
2542                 fmt->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2543                 break;
2544
2545         default:
2546                 return -EINVAL;
2547         }
2548
2549         return 0;
2550 }
2551
2552 static int mxt_vidioc_g_parm(struct file *file, void *fh,
2553                              struct v4l2_streamparm *a)
2554 {
2555         if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2556                 return -EINVAL;
2557
2558         a->parm.capture.readbuffers = 1;
2559         a->parm.capture.timeperframe.numerator = 1;
2560         a->parm.capture.timeperframe.denominator = 10;
2561         return 0;
2562 }
2563
2564 static const struct v4l2_ioctl_ops mxt_video_ioctl_ops = {
2565         .vidioc_querycap        = mxt_vidioc_querycap,
2566
2567         .vidioc_enum_fmt_vid_cap = mxt_vidioc_enum_fmt,
2568         .vidioc_s_fmt_vid_cap   = mxt_vidioc_fmt,
2569         .vidioc_g_fmt_vid_cap   = mxt_vidioc_fmt,
2570         .vidioc_try_fmt_vid_cap = mxt_vidioc_fmt,
2571         .vidioc_g_parm          = mxt_vidioc_g_parm,
2572
2573         .vidioc_enum_input      = mxt_vidioc_enum_input,
2574         .vidioc_g_input         = mxt_vidioc_g_input,
2575         .vidioc_s_input         = mxt_vidioc_s_input,
2576
2577         .vidioc_reqbufs         = vb2_ioctl_reqbufs,
2578         .vidioc_create_bufs     = vb2_ioctl_create_bufs,
2579         .vidioc_querybuf        = vb2_ioctl_querybuf,
2580         .vidioc_qbuf            = vb2_ioctl_qbuf,
2581         .vidioc_dqbuf           = vb2_ioctl_dqbuf,
2582         .vidioc_expbuf          = vb2_ioctl_expbuf,
2583
2584         .vidioc_streamon        = vb2_ioctl_streamon,
2585         .vidioc_streamoff       = vb2_ioctl_streamoff,
2586 };
2587
2588 static const struct video_device mxt_video_device = {
2589         .name = "Atmel maxTouch",
2590         .fops = &mxt_video_fops,
2591         .ioctl_ops = &mxt_video_ioctl_ops,
2592         .release = video_device_release_empty,
2593         .device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TOUCH |
2594                        V4L2_CAP_READWRITE | V4L2_CAP_STREAMING,
2595 };
2596
2597 static void mxt_debug_init(struct mxt_data *data)
2598 {
2599         struct mxt_info *info = data->info;
2600         struct mxt_dbg *dbg = &data->dbg;
2601         struct mxt_object *object;
2602         int error;
2603
2604         object = mxt_get_object(data, MXT_GEN_COMMAND_T6);
2605         if (!object)
2606                 goto error;
2607
2608         dbg->diag_cmd_address = object->start_address + MXT_COMMAND_DIAGNOSTIC;
2609
2610         object = mxt_get_object(data, MXT_DEBUG_DIAGNOSTIC_T37);
2611         if (!object)
2612                 goto error;
2613
2614         if (mxt_obj_size(object) != sizeof(struct t37_debug)) {
2615                 dev_warn(&data->client->dev, "Bad T37 size");
2616                 goto error;
2617         }
2618
2619         dbg->t37_address = object->start_address;
2620
2621         /* Calculate size of data and allocate buffer */
2622         dbg->t37_nodes = data->xsize * data->ysize;
2623
2624         if (info->family_id == MXT_FAMILY_1386)
2625                 dbg->t37_pages = MXT1386_COLUMNS * MXT1386_PAGES_PER_COLUMN;
2626         else
2627                 dbg->t37_pages = DIV_ROUND_UP(data->xsize *
2628                                               info->matrix_ysize *
2629                                               sizeof(u16),
2630                                               sizeof(dbg->t37_buf->data));
2631
2632         dbg->t37_buf = devm_kmalloc_array(&data->client->dev, dbg->t37_pages,
2633                                           sizeof(struct t37_debug), GFP_KERNEL);
2634         if (!dbg->t37_buf)
2635                 goto error;
2636
2637         /* init channel to zero */
2638         mxt_set_input(data, 0);
2639
2640         /* register video device */
2641         snprintf(dbg->v4l2.name, sizeof(dbg->v4l2.name), "%s", "atmel_mxt_ts");
2642         error = v4l2_device_register(&data->client->dev, &dbg->v4l2);
2643         if (error)
2644                 goto error;
2645
2646         /* initialize the queue */
2647         mutex_init(&dbg->lock);
2648         dbg->queue = mxt_queue;
2649         dbg->queue.drv_priv = data;
2650         dbg->queue.lock = &dbg->lock;
2651         dbg->queue.dev = &data->client->dev;
2652
2653         error = vb2_queue_init(&dbg->queue);
2654         if (error)
2655                 goto error_unreg_v4l2;
2656
2657         dbg->vdev = mxt_video_device;
2658         dbg->vdev.v4l2_dev = &dbg->v4l2;
2659         dbg->vdev.lock = &dbg->lock;
2660         dbg->vdev.vfl_dir = VFL_DIR_RX;
2661         dbg->vdev.queue = &dbg->queue;
2662         video_set_drvdata(&dbg->vdev, data);
2663
2664         error = video_register_device(&dbg->vdev, VFL_TYPE_TOUCH, -1);
2665         if (error)
2666                 goto error_unreg_v4l2;
2667
2668         return;
2669
2670 error_unreg_v4l2:
2671         v4l2_device_unregister(&dbg->v4l2);
2672 error:
2673         dev_warn(&data->client->dev, "Error initializing T37\n");
2674 }
2675 #else
2676 static void mxt_debug_init(struct mxt_data *data)
2677 {
2678 }
2679 #endif
2680
2681 static int mxt_configure_objects(struct mxt_data *data,
2682                                  const struct firmware *cfg)
2683 {
2684         struct device *dev = &data->client->dev;
2685         int error;
2686
2687         error = mxt_init_t7_power_cfg(data);
2688         if (error) {
2689                 dev_err(dev, "Failed to initialize power cfg\n");
2690                 return error;
2691         }
2692
2693         if (cfg) {
2694                 error = mxt_update_cfg(data, cfg);
2695                 if (error)
2696                         dev_warn(dev, "Error %d updating config\n", error);
2697         }
2698
2699         if (data->multitouch) {
2700                 error = mxt_initialize_input_device(data);
2701                 if (error)
2702                         return error;
2703         } else {
2704                 dev_warn(dev, "No touch object detected\n");
2705         }
2706
2707         mxt_debug_init(data);
2708
2709         return 0;
2710 }
2711
2712 /* Firmware Version is returned as Major.Minor.Build */
2713 static ssize_t mxt_fw_version_show(struct device *dev,
2714                                    struct device_attribute *attr, char *buf)
2715 {
2716         struct mxt_data *data = dev_get_drvdata(dev);
2717         struct mxt_info *info = data->info;
2718         return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
2719                          info->version >> 4, info->version & 0xf, info->build);
2720 }
2721
2722 /* Hardware Version is returned as FamilyID.VariantID */
2723 static ssize_t mxt_hw_version_show(struct device *dev,
2724                                    struct device_attribute *attr, char *buf)
2725 {
2726         struct mxt_data *data = dev_get_drvdata(dev);
2727         struct mxt_info *info = data->info;
2728         return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
2729                          info->family_id, info->variant_id);
2730 }
2731
2732 static ssize_t mxt_show_instance(char *buf, int count,
2733                                  struct mxt_object *object, int instance,
2734                                  const u8 *val)
2735 {
2736         int i;
2737
2738         if (mxt_obj_instances(object) > 1)
2739                 count += scnprintf(buf + count, PAGE_SIZE - count,
2740                                    "Instance %u\n", instance);
2741
2742         for (i = 0; i < mxt_obj_size(object); i++)
2743                 count += scnprintf(buf + count, PAGE_SIZE - count,
2744                                 "\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
2745         count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
2746
2747         return count;
2748 }
2749
2750 static ssize_t mxt_object_show(struct device *dev,
2751                                     struct device_attribute *attr, char *buf)
2752 {
2753         struct mxt_data *data = dev_get_drvdata(dev);
2754         struct mxt_object *object;
2755         int count = 0;
2756         int i, j;
2757         int error;
2758         u8 *obuf;
2759
2760         /* Pre-allocate buffer large enough to hold max sized object. */
2761         obuf = kmalloc(256, GFP_KERNEL);
2762         if (!obuf)
2763                 return -ENOMEM;
2764
2765         error = 0;
2766         for (i = 0; i < data->info->object_num; i++) {
2767                 object = data->object_table + i;
2768
2769                 if (!mxt_object_readable(object->type))
2770                         continue;
2771
2772                 count += scnprintf(buf + count, PAGE_SIZE - count,
2773                                 "T%u:\n", object->type);
2774
2775                 for (j = 0; j < mxt_obj_instances(object); j++) {
2776                         u16 size = mxt_obj_size(object);
2777                         u16 addr = object->start_address + j * size;
2778
2779                         error = __mxt_read_reg(data->client, addr, size, obuf);
2780                         if (error)
2781                                 goto done;
2782
2783                         count = mxt_show_instance(buf, count, object, j, obuf);
2784                 }
2785         }
2786
2787 done:
2788         kfree(obuf);
2789         return error ?: count;
2790 }
2791
2792 static int mxt_check_firmware_format(struct device *dev,
2793                                      const struct firmware *fw)
2794 {
2795         unsigned int pos = 0;
2796         char c;
2797
2798         while (pos < fw->size) {
2799                 c = *(fw->data + pos);
2800
2801                 if (c < '0' || (c > '9' && c < 'A') || c > 'F')
2802                         return 0;
2803
2804                 pos++;
2805         }
2806
2807         /*
2808          * To convert file try:
2809          * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
2810          */
2811         dev_err(dev, "Aborting: firmware file must be in binary format\n");
2812
2813         return -EINVAL;
2814 }
2815
2816 static int mxt_load_fw(struct device *dev, const char *fn)
2817 {
2818         struct mxt_data *data = dev_get_drvdata(dev);
2819         const struct firmware *fw = NULL;
2820         unsigned int frame_size;
2821         unsigned int pos = 0;
2822         unsigned int retry = 0;
2823         unsigned int frame = 0;
2824         int ret;
2825
2826         ret = request_firmware(&fw, fn, dev);
2827         if (ret) {
2828                 dev_err(dev, "Unable to open firmware %s\n", fn);
2829                 return ret;
2830         }
2831
2832         /* Check for incorrect enc file */
2833         ret = mxt_check_firmware_format(dev, fw);
2834         if (ret)
2835                 goto release_firmware;
2836
2837         if (!data->in_bootloader) {
2838                 /* Change to the bootloader mode */
2839                 data->in_bootloader = true;
2840
2841                 ret = mxt_t6_command(data, MXT_COMMAND_RESET,
2842                                      MXT_BOOT_VALUE, false);
2843                 if (ret)
2844                         goto release_firmware;
2845
2846                 msleep(MXT_RESET_TIME);
2847
2848                 /* Do not need to scan since we know family ID */
2849                 ret = mxt_lookup_bootloader_address(data, 0);
2850                 if (ret)
2851                         goto release_firmware;
2852
2853                 mxt_free_input_device(data);
2854                 mxt_free_object_table(data);
2855         } else {
2856                 enable_irq(data->irq);
2857         }
2858
2859         reinit_completion(&data->bl_completion);
2860
2861         ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
2862         if (ret) {
2863                 /* Bootloader may still be unlocked from previous attempt */
2864                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
2865                 if (ret)
2866                         goto disable_irq;
2867         } else {
2868                 dev_info(dev, "Unlocking bootloader\n");
2869
2870                 /* Unlock bootloader */
2871                 ret = mxt_send_bootloader_cmd(data, true);
2872                 if (ret)
2873                         goto disable_irq;
2874         }
2875
2876         while (pos < fw->size) {
2877                 ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
2878                 if (ret)
2879                         goto disable_irq;
2880
2881                 frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
2882
2883                 /* Take account of CRC bytes */
2884                 frame_size += 2;
2885
2886                 /* Write one frame to device */
2887                 ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
2888                 if (ret)
2889                         goto disable_irq;
2890
2891                 ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
2892                 if (ret) {
2893                         retry++;
2894
2895                         /* Back off by 20ms per retry */
2896                         msleep(retry * 20);
2897
2898                         if (retry > 20) {
2899                                 dev_err(dev, "Retry count exceeded\n");
2900                                 goto disable_irq;
2901                         }
2902                 } else {
2903                         retry = 0;
2904                         pos += frame_size;
2905                         frame++;
2906                 }
2907
2908                 if (frame % 50 == 0)
2909                         dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
2910                                 frame, pos, fw->size);
2911         }
2912
2913         /* Wait for flash. */
2914         ret = mxt_wait_for_completion(data, &data->bl_completion,
2915                                       MXT_FW_RESET_TIME);
2916         if (ret)
2917                 goto disable_irq;
2918
2919         dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
2920
2921         /*
2922          * Wait for device to reset. Some bootloader versions do not assert
2923          * the CHG line after bootloading has finished, so ignore potential
2924          * errors.
2925          */
2926         mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
2927
2928         data->in_bootloader = false;
2929
2930 disable_irq:
2931         disable_irq(data->irq);
2932 release_firmware:
2933         release_firmware(fw);
2934         return ret;
2935 }
2936
2937 static ssize_t mxt_update_fw_store(struct device *dev,
2938                                         struct device_attribute *attr,
2939                                         const char *buf, size_t count)
2940 {
2941         struct mxt_data *data = dev_get_drvdata(dev);
2942         int error;
2943
2944         error = mxt_load_fw(dev, MXT_FW_NAME);
2945         if (error) {
2946                 dev_err(dev, "The firmware update failed(%d)\n", error);
2947                 count = error;
2948         } else {
2949                 dev_info(dev, "The firmware update succeeded\n");
2950
2951                 error = mxt_initialize(data);
2952                 if (error)
2953                         return error;
2954         }
2955
2956         return count;
2957 }
2958
2959 static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2960 static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2961 static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2962 static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2963
2964 static struct attribute *mxt_attrs[] = {
2965         &dev_attr_fw_version.attr,
2966         &dev_attr_hw_version.attr,
2967         &dev_attr_object.attr,
2968         &dev_attr_update_fw.attr,
2969         NULL
2970 };
2971
2972 static const struct attribute_group mxt_attr_group = {
2973         .attrs = mxt_attrs,
2974 };
2975
2976 static void mxt_start(struct mxt_data *data)
2977 {
2978         switch (data->suspend_mode) {
2979         case MXT_SUSPEND_T9_CTRL:
2980                 mxt_soft_reset(data);
2981
2982                 /* Touch enable */
2983                 /* 0x83 = SCANEN | RPTEN | ENABLE */
2984                 mxt_write_object(data,
2985                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0x83);
2986                 break;
2987
2988         case MXT_SUSPEND_DEEP_SLEEP:
2989         default:
2990                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2991
2992                 /* Recalibrate since chip has been in deep sleep */
2993                 mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
2994                 break;
2995         }
2996 }
2997
2998 static void mxt_stop(struct mxt_data *data)
2999 {
3000         switch (data->suspend_mode) {
3001         case MXT_SUSPEND_T9_CTRL:
3002                 /* Touch disable */
3003                 mxt_write_object(data,
3004                                 MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0);
3005                 break;
3006
3007         case MXT_SUSPEND_DEEP_SLEEP:
3008         default:
3009                 mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
3010                 break;
3011         }
3012 }
3013
3014 static int mxt_input_open(struct input_dev *dev)
3015 {
3016         struct mxt_data *data = input_get_drvdata(dev);
3017
3018         mxt_start(data);
3019
3020         return 0;
3021 }
3022
3023 static void mxt_input_close(struct input_dev *dev)
3024 {
3025         struct mxt_data *data = input_get_drvdata(dev);
3026
3027         mxt_stop(data);
3028 }
3029
3030 static int mxt_parse_device_properties(struct mxt_data *data)
3031 {
3032         static const char keymap_property[] = "linux,gpio-keymap";
3033         struct device *dev = &data->client->dev;
3034         u32 *keymap;
3035         int n_keys;
3036         int error;
3037
3038         if (device_property_present(dev, keymap_property)) {
3039                 n_keys = device_property_count_u32(dev, keymap_property);
3040                 if (n_keys <= 0) {
3041                         error = n_keys < 0 ? n_keys : -EINVAL;
3042                         dev_err(dev, "invalid/malformed '%s' property: %d\n",
3043                                 keymap_property, error);
3044                         return error;
3045                 }
3046
3047                 keymap = devm_kmalloc_array(dev, n_keys, sizeof(*keymap),
3048                                             GFP_KERNEL);
3049                 if (!keymap)
3050                         return -ENOMEM;
3051
3052                 error = device_property_read_u32_array(dev, keymap_property,
3053                                                        keymap, n_keys);
3054                 if (error) {
3055                         dev_err(dev, "failed to parse '%s' property: %d\n",
3056                                 keymap_property, error);
3057                         return error;
3058                 }
3059
3060                 data->t19_keymap = keymap;
3061                 data->t19_num_keys = n_keys;
3062         }
3063
3064         return 0;
3065 }
3066
3067 static const struct dmi_system_id chromebook_T9_suspend_dmi[] = {
3068         {
3069                 .matches = {
3070                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3071                         DMI_MATCH(DMI_PRODUCT_NAME, "Link"),
3072                 },
3073         },
3074         {
3075                 .matches = {
3076                         DMI_MATCH(DMI_PRODUCT_NAME, "Peppy"),
3077                 },
3078         },
3079         { }
3080 };
3081
3082 static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
3083 {
3084         struct mxt_data *data;
3085         int error;
3086
3087         /*
3088          * Ignore devices that do not have device properties attached to
3089          * them, as we need help determining whether we are dealing with
3090          * touch screen or touchpad.
3091          *
3092          * So far on x86 the only users of Atmel touch controllers are
3093          * Chromebooks, and chromeos_laptop driver will ensure that
3094          * necessary properties are provided (if firmware does not do that).
3095          */
3096         if (!device_property_present(&client->dev, "compatible"))
3097                 return -ENXIO;
3098
3099         /*
3100          * Ignore ACPI devices representing bootloader mode.
3101          *
3102          * This is a bit of a hack: Google Chromebook BIOS creates ACPI
3103          * devices for both application and bootloader modes, but we are
3104          * interested in application mode only (if device is in bootloader
3105          * mode we'll end up switching into application anyway). So far
3106          * application mode addresses were all above 0x40, so we'll use it
3107          * as a threshold.
3108          */
3109         if (ACPI_COMPANION(&client->dev) && client->addr < 0x40)
3110                 return -ENXIO;
3111
3112         data = devm_kzalloc(&client->dev, sizeof(struct mxt_data), GFP_KERNEL);
3113         if (!data)
3114                 return -ENOMEM;
3115
3116         snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
3117                  client->adapter->nr, client->addr);
3118
3119         data->client = client;
3120         data->irq = client->irq;
3121         i2c_set_clientdata(client, data);
3122
3123         init_completion(&data->bl_completion);
3124         init_completion(&data->reset_completion);
3125         init_completion(&data->crc_completion);
3126
3127         data->suspend_mode = dmi_check_system(chromebook_T9_suspend_dmi) ?
3128                 MXT_SUSPEND_T9_CTRL : MXT_SUSPEND_DEEP_SLEEP;
3129
3130         error = mxt_parse_device_properties(data);
3131         if (error)
3132                 return error;
3133
3134         /*
3135          * VDDA is the analog voltage supply 2.57..3.47 V
3136          * VDD  is the digital voltage supply 1.71..3.47 V
3137          */
3138         data->regulators[0].supply = "vdda";
3139         data->regulators[1].supply = "vdd";
3140         error = devm_regulator_bulk_get(&client->dev, ARRAY_SIZE(data->regulators),
3141                                         data->regulators);
3142         if (error) {
3143                 if (error != -EPROBE_DEFER)
3144                         dev_err(&client->dev, "Failed to get regulators %d\n",
3145                                 error);
3146                 return error;
3147         }
3148
3149         /* Request the RESET line as asserted so we go into reset */
3150         data->reset_gpio = devm_gpiod_get_optional(&client->dev,
3151                                                    "reset", GPIOD_OUT_HIGH);
3152         if (IS_ERR(data->reset_gpio)) {
3153                 error = PTR_ERR(data->reset_gpio);
3154                 dev_err(&client->dev, "Failed to get reset gpio: %d\n", error);
3155                 return error;
3156         }
3157
3158         error = devm_request_threaded_irq(&client->dev, client->irq,
3159                                           NULL, mxt_interrupt, IRQF_ONESHOT,
3160                                           client->name, data);
3161         if (error) {
3162                 dev_err(&client->dev, "Failed to register interrupt\n");
3163                 return error;
3164         }
3165
3166         disable_irq(client->irq);
3167
3168         error = regulator_bulk_enable(ARRAY_SIZE(data->regulators),
3169                                       data->regulators);
3170         if (error) {
3171                 dev_err(&client->dev, "failed to enable regulators: %d\n",
3172                         error);
3173                 return error;
3174         }
3175         /*
3176          * The device takes 40ms to come up after power-on according
3177          * to the mXT224 datasheet, page 13.
3178          */
3179         msleep(MXT_BACKUP_TIME);
3180
3181         if (data->reset_gpio) {
3182                 /* Wait a while and then de-assert the RESET GPIO line */
3183                 msleep(MXT_RESET_GPIO_TIME);
3184                 gpiod_set_value(data->reset_gpio, 0);
3185                 msleep(MXT_RESET_INVALID_CHG);
3186         }
3187
3188         error = mxt_initialize(data);
3189         if (error)
3190                 goto err_disable_regulators;
3191
3192         error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
3193         if (error) {
3194                 dev_err(&client->dev, "Failure %d creating sysfs group\n",
3195                         error);
3196                 goto err_free_object;
3197         }
3198
3199         return 0;
3200
3201 err_free_object:
3202         mxt_free_input_device(data);
3203         mxt_free_object_table(data);
3204 err_disable_regulators:
3205         regulator_bulk_disable(ARRAY_SIZE(data->regulators),
3206                                data->regulators);
3207         return error;
3208 }
3209
3210 static int mxt_remove(struct i2c_client *client)
3211 {
3212         struct mxt_data *data = i2c_get_clientdata(client);
3213
3214         disable_irq(data->irq);
3215         sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
3216         mxt_free_input_device(data);
3217         mxt_free_object_table(data);
3218         regulator_bulk_disable(ARRAY_SIZE(data->regulators),
3219                                data->regulators);
3220
3221         return 0;
3222 }
3223
3224 static int __maybe_unused mxt_suspend(struct device *dev)
3225 {
3226         struct i2c_client *client = to_i2c_client(dev);
3227         struct mxt_data *data = i2c_get_clientdata(client);
3228         struct input_dev *input_dev = data->input_dev;
3229
3230         if (!input_dev)
3231                 return 0;
3232
3233         mutex_lock(&input_dev->mutex);
3234
3235         if (input_device_enabled(input_dev))
3236                 mxt_stop(data);
3237
3238         mutex_unlock(&input_dev->mutex);
3239
3240         disable_irq(data->irq);
3241
3242         return 0;
3243 }
3244
3245 static int __maybe_unused mxt_resume(struct device *dev)
3246 {
3247         struct i2c_client *client = to_i2c_client(dev);
3248         struct mxt_data *data = i2c_get_clientdata(client);
3249         struct input_dev *input_dev = data->input_dev;
3250
3251         if (!input_dev)
3252                 return 0;
3253
3254         enable_irq(data->irq);
3255
3256         mutex_lock(&input_dev->mutex);
3257
3258         if (input_device_enabled(input_dev))
3259                 mxt_start(data);
3260
3261         mutex_unlock(&input_dev->mutex);
3262
3263         return 0;
3264 }
3265
3266 static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
3267
3268 static const struct of_device_id mxt_of_match[] = {
3269         { .compatible = "atmel,maxtouch", },
3270         /* Compatibles listed below are deprecated */
3271         { .compatible = "atmel,qt602240_ts", },
3272         { .compatible = "atmel,atmel_mxt_ts", },
3273         { .compatible = "atmel,atmel_mxt_tp", },
3274         { .compatible = "atmel,mXT224", },
3275         {},
3276 };
3277 MODULE_DEVICE_TABLE(of, mxt_of_match);
3278
3279 #ifdef CONFIG_ACPI
3280 static const struct acpi_device_id mxt_acpi_id[] = {
3281         { "ATML0000", 0 },      /* Touchpad */
3282         { "ATML0001", 0 },      /* Touchscreen */
3283         { }
3284 };
3285 MODULE_DEVICE_TABLE(acpi, mxt_acpi_id);
3286 #endif
3287
3288 static const struct i2c_device_id mxt_id[] = {
3289         { "qt602240_ts", 0 },
3290         { "atmel_mxt_ts", 0 },
3291         { "atmel_mxt_tp", 0 },
3292         { "maxtouch", 0 },
3293         { "mXT224", 0 },
3294         { }
3295 };
3296 MODULE_DEVICE_TABLE(i2c, mxt_id);
3297
3298 static struct i2c_driver mxt_driver = {
3299         .driver = {
3300                 .name   = "atmel_mxt_ts",
3301                 .of_match_table = mxt_of_match,
3302                 .acpi_match_table = ACPI_PTR(mxt_acpi_id),
3303                 .pm     = &mxt_pm_ops,
3304         },
3305         .probe          = mxt_probe,
3306         .remove         = mxt_remove,
3307         .id_table       = mxt_id,
3308 };
3309
3310 module_i2c_driver(mxt_driver);
3311
3312 /* Module information */
3313 MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
3314 MODULE_DESCRIPTION("Atmel maXTouch Touchscreen driver");
3315 MODULE_LICENSE("GPL");