1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Atmel maXTouch Touchscreen driver
4  *
5  * Copyright (C) 2010 Samsung Electronics Co.Ltd
6  * Copyright (C) 2011-2014 Atmel Corporation
7  * Copyright (C) 2012 Google, Inc.
8  * Copyright (C) 2016 Zodiac Inflight Innovations
9  *
10  * Author: Joonyoung Shim <jy0922.shim@samsung.com>
11  */
12 
13 #include <linux/acpi.h>
14 #include <linux/dmi.h>
15 #include <linux/module.h>
16 #include <linux/init.h>
17 #include <linux/completion.h>
18 #include <linux/delay.h>
19 #include <linux/firmware.h>
20 #include <linux/i2c.h>
21 #include <linux/input/mt.h>
22 #include <linux/interrupt.h>
23 #include <linux/of.h>
24 #include <linux/property.h>
25 #include <linux/slab.h>
26 #include <linux/gpio/consumer.h>
27 #include <asm/unaligned.h>
28 #include <media/v4l2-device.h>
29 #include <media/v4l2-ioctl.h>
30 #include <media/videobuf2-v4l2.h>
31 #include <media/videobuf2-vmalloc.h>
32 
33 /* Firmware files */
34 #define MXT_FW_NAME		"maxtouch.fw"
35 #define MXT_CFG_NAME		"maxtouch.cfg"
36 #define MXT_CFG_MAGIC		"OBP_RAW V1"
37 
38 /* Registers */
39 #define MXT_OBJECT_START	0x07
40 #define MXT_OBJECT_SIZE		6
41 #define MXT_INFO_CHECKSUM_SIZE	3
42 #define MXT_MAX_BLOCK_WRITE	256
43 
44 /* Object types */
45 #define MXT_DEBUG_DIAGNOSTIC_T37	37
46 #define MXT_GEN_MESSAGE_T5		5
47 #define MXT_GEN_COMMAND_T6		6
48 #define MXT_GEN_POWER_T7		7
49 #define MXT_GEN_ACQUIRE_T8		8
50 #define MXT_GEN_DATASOURCE_T53		53
51 #define MXT_TOUCH_MULTI_T9		9
52 #define MXT_TOUCH_KEYARRAY_T15		15
53 #define MXT_TOUCH_PROXIMITY_T23		23
54 #define MXT_TOUCH_PROXKEY_T52		52
55 #define MXT_PROCI_GRIPFACE_T20		20
56 #define MXT_PROCG_NOISE_T22		22
57 #define MXT_PROCI_ONETOUCH_T24		24
58 #define MXT_PROCI_TWOTOUCH_T27		27
59 #define MXT_PROCI_GRIP_T40		40
60 #define MXT_PROCI_PALM_T41		41
61 #define MXT_PROCI_TOUCHSUPPRESSION_T42	42
62 #define MXT_PROCI_STYLUS_T47		47
63 #define MXT_PROCG_NOISESUPPRESSION_T48	48
64 #define MXT_SPT_COMMSCONFIG_T18		18
65 #define MXT_SPT_GPIOPWM_T19		19
66 #define MXT_SPT_SELFTEST_T25		25
67 #define MXT_SPT_CTECONFIG_T28		28
68 #define MXT_SPT_USERDATA_T38		38
69 #define MXT_SPT_DIGITIZER_T43		43
70 #define MXT_SPT_MESSAGECOUNT_T44	44
71 #define MXT_SPT_CTECONFIG_T46		46
72 #define MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71 71
73 #define MXT_TOUCH_MULTITOUCHSCREEN_T100 100
74 
75 /* MXT_GEN_MESSAGE_T5 object */
76 #define MXT_RPTID_NOMSG		0xff
77 
78 /* MXT_GEN_COMMAND_T6 field */
79 #define MXT_COMMAND_RESET	0
80 #define MXT_COMMAND_BACKUPNV	1
81 #define MXT_COMMAND_CALIBRATE	2
82 #define MXT_COMMAND_REPORTALL	3
83 #define MXT_COMMAND_DIAGNOSTIC	5
84 
85 /* Define for T6 status byte */
86 #define MXT_T6_STATUS_RESET	BIT(7)
87 #define MXT_T6_STATUS_OFL	BIT(6)
88 #define MXT_T6_STATUS_SIGERR	BIT(5)
89 #define MXT_T6_STATUS_CAL	BIT(4)
90 #define MXT_T6_STATUS_CFGERR	BIT(3)
91 #define MXT_T6_STATUS_COMSERR	BIT(2)
92 
93 /* MXT_GEN_POWER_T7 field */
94 struct t7_config {
95 	u8 idle;
96 	u8 active;
97 } __packed;
98 
99 #define MXT_POWER_CFG_RUN		0
100 #define MXT_POWER_CFG_DEEPSLEEP		1
101 
102 /* MXT_TOUCH_MULTI_T9 field */
103 #define MXT_T9_CTRL		0
104 #define MXT_T9_XSIZE		3
105 #define MXT_T9_YSIZE		4
106 #define MXT_T9_ORIENT		9
107 #define MXT_T9_RANGE		18
108 
109 /* MXT_TOUCH_MULTI_T9 status */
110 #define MXT_T9_UNGRIP		BIT(0)
111 #define MXT_T9_SUPPRESS		BIT(1)
112 #define MXT_T9_AMP		BIT(2)
113 #define MXT_T9_VECTOR		BIT(3)
114 #define MXT_T9_MOVE		BIT(4)
115 #define MXT_T9_RELEASE		BIT(5)
116 #define MXT_T9_PRESS		BIT(6)
117 #define MXT_T9_DETECT		BIT(7)
118 
119 struct t9_range {
120 	__le16 x;
121 	__le16 y;
122 } __packed;
123 
124 /* MXT_TOUCH_MULTI_T9 orient */
125 #define MXT_T9_ORIENT_SWITCH	BIT(0)
126 #define MXT_T9_ORIENT_INVERTX	BIT(1)
127 #define MXT_T9_ORIENT_INVERTY	BIT(2)
128 
129 /* MXT_SPT_COMMSCONFIG_T18 */
130 #define MXT_COMMS_CTRL		0
131 #define MXT_COMMS_CMD		1
132 
133 /* MXT_DEBUG_DIAGNOSTIC_T37 */
134 #define MXT_DIAGNOSTIC_PAGEUP	0x01
135 #define MXT_DIAGNOSTIC_DELTAS	0x10
136 #define MXT_DIAGNOSTIC_REFS	0x11
137 #define MXT_DIAGNOSTIC_SIZE	128
138 
139 #define MXT_FAMILY_1386			160
140 #define MXT1386_COLUMNS			3
141 #define MXT1386_PAGES_PER_COLUMN	8
142 
143 struct t37_debug {
144 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
145 	u8 mode;
146 	u8 page;
147 	u8 data[MXT_DIAGNOSTIC_SIZE];
148 #endif
149 };
150 
151 /* Define for MXT_GEN_COMMAND_T6 */
152 #define MXT_BOOT_VALUE		0xa5
153 #define MXT_RESET_VALUE		0x01
154 #define MXT_BACKUP_VALUE	0x55
155 
156 /* T100 Multiple Touch Touchscreen */
157 #define MXT_T100_CTRL		0
158 #define MXT_T100_CFG1		1
159 #define MXT_T100_TCHAUX		3
160 #define MXT_T100_XSIZE		9
161 #define MXT_T100_XRANGE		13
162 #define MXT_T100_YSIZE		20
163 #define MXT_T100_YRANGE		24
164 
165 #define MXT_T100_CFG_SWITCHXY	BIT(5)
166 #define MXT_T100_CFG_INVERTY	BIT(6)
167 #define MXT_T100_CFG_INVERTX	BIT(7)
168 
169 #define MXT_T100_TCHAUX_VECT	BIT(0)
170 #define MXT_T100_TCHAUX_AMPL	BIT(1)
171 #define MXT_T100_TCHAUX_AREA	BIT(2)
172 
173 #define MXT_T100_DETECT		BIT(7)
174 #define MXT_T100_TYPE_MASK	0x70
175 
176 enum t100_type {
177 	MXT_T100_TYPE_FINGER		= 1,
178 	MXT_T100_TYPE_PASSIVE_STYLUS	= 2,
179 	MXT_T100_TYPE_HOVERING_FINGER	= 4,
180 	MXT_T100_TYPE_GLOVE		= 5,
181 	MXT_T100_TYPE_LARGE_TOUCH	= 6,
182 };
183 
184 #define MXT_DISTANCE_ACTIVE_TOUCH	0
185 #define MXT_DISTANCE_HOVERING		1
186 
187 #define MXT_TOUCH_MAJOR_DEFAULT		1
188 #define MXT_PRESSURE_DEFAULT		1
189 
190 /* Delay times */
191 #define MXT_BACKUP_TIME		50	/* msec */
192 #define MXT_RESET_GPIO_TIME	20	/* msec */
193 #define MXT_RESET_INVALID_CHG	100	/* msec */
194 #define MXT_RESET_TIME		200	/* msec */
195 #define MXT_RESET_TIMEOUT	3000	/* msec */
196 #define MXT_CRC_TIMEOUT		1000	/* msec */
197 #define MXT_FW_RESET_TIME	3000	/* msec */
198 #define MXT_FW_CHG_TIMEOUT	300	/* msec */
199 
200 /* Command to unlock bootloader */
201 #define MXT_UNLOCK_CMD_MSB	0xaa
202 #define MXT_UNLOCK_CMD_LSB	0xdc
203 
204 /* Bootloader mode status */
205 #define MXT_WAITING_BOOTLOAD_CMD	0xc0	/* valid 7 6 bit only */
206 #define MXT_WAITING_FRAME_DATA	0x80	/* valid 7 6 bit only */
207 #define MXT_FRAME_CRC_CHECK	0x02
208 #define MXT_FRAME_CRC_FAIL	0x03
209 #define MXT_FRAME_CRC_PASS	0x04
210 #define MXT_APP_CRC_FAIL	0x40	/* valid 7 8 bit only */
211 #define MXT_BOOT_STATUS_MASK	0x3f
212 #define MXT_BOOT_EXTENDED_ID	BIT(5)
213 #define MXT_BOOT_ID_MASK	0x1f
214 
215 /* Touchscreen absolute values */
216 #define MXT_MAX_AREA		0xff
217 
218 #define MXT_PIXELS_PER_MM	20
219 
220 struct mxt_info {
221 	u8 family_id;
222 	u8 variant_id;
223 	u8 version;
224 	u8 build;
225 	u8 matrix_xsize;
226 	u8 matrix_ysize;
227 	u8 object_num;
228 };
229 
230 struct mxt_object {
231 	u8 type;
232 	u16 start_address;
233 	u8 size_minus_one;
234 	u8 instances_minus_one;
235 	u8 num_report_ids;
236 } __packed;
237 
238 struct mxt_dbg {
239 	u16 t37_address;
240 	u16 diag_cmd_address;
241 	struct t37_debug *t37_buf;
242 	unsigned int t37_pages;
243 	unsigned int t37_nodes;
244 
245 	struct v4l2_device v4l2;
246 	struct v4l2_pix_format format;
247 	struct video_device vdev;
248 	struct vb2_queue queue;
249 	struct mutex lock;
250 	int input;
251 };
252 
253 enum v4l_dbg_inputs {
254 	MXT_V4L_INPUT_DELTAS,
255 	MXT_V4L_INPUT_REFS,
256 	MXT_V4L_INPUT_MAX,
257 };
258 
259 static const struct v4l2_file_operations mxt_video_fops = {
260 	.owner = THIS_MODULE,
261 	.open = v4l2_fh_open,
262 	.release = vb2_fop_release,
263 	.unlocked_ioctl = video_ioctl2,
264 	.read = vb2_fop_read,
265 	.mmap = vb2_fop_mmap,
266 	.poll = vb2_fop_poll,
267 };
268 
269 enum mxt_suspend_mode {
270 	MXT_SUSPEND_DEEP_SLEEP	= 0,
271 	MXT_SUSPEND_T9_CTRL	= 1,
272 };
273 
274 /* Config update context */
275 struct mxt_cfg {
276 	u8 *raw;
277 	size_t raw_size;
278 	off_t raw_pos;
279 
280 	u8 *mem;
281 	size_t mem_size;
282 	int start_ofs;
283 
284 	struct mxt_info info;
285 };
286 
287 /* Each client has this additional data */
288 struct mxt_data {
289 	struct i2c_client *client;
290 	struct input_dev *input_dev;
291 	char phys[64];		/* device physical location */
292 	struct mxt_object *object_table;
293 	struct mxt_info *info;
294 	void *raw_info_block;
295 	unsigned int irq;
296 	unsigned int max_x;
297 	unsigned int max_y;
298 	bool invertx;
299 	bool inverty;
300 	bool xy_switch;
301 	u8 xsize;
302 	u8 ysize;
303 	bool in_bootloader;
304 	u16 mem_size;
305 	u8 t100_aux_ampl;
306 	u8 t100_aux_area;
307 	u8 t100_aux_vect;
308 	u8 max_reportid;
309 	u32 config_crc;
310 	u32 info_crc;
311 	u8 bootloader_addr;
312 	u8 *msg_buf;
313 	u8 t6_status;
314 	bool update_input;
315 	u8 last_message_count;
316 	u8 num_touchids;
317 	u8 multitouch;
318 	struct t7_config t7_cfg;
319 	struct mxt_dbg dbg;
320 	struct gpio_desc *reset_gpio;
321 
322 	/* Cached parameters from object table */
323 	u16 T5_address;
324 	u8 T5_msg_size;
325 	u8 T6_reportid;
326 	u16 T6_address;
327 	u16 T7_address;
328 	u16 T71_address;
329 	u8 T9_reportid_min;
330 	u8 T9_reportid_max;
331 	u8 T19_reportid;
332 	u16 T44_address;
333 	u8 T100_reportid_min;
334 	u8 T100_reportid_max;
335 
336 	/* for fw update in bootloader */
337 	struct completion bl_completion;
338 
339 	/* for reset handling */
340 	struct completion reset_completion;
341 
342 	/* for config update handling */
343 	struct completion crc_completion;
344 
345 	u32 *t19_keymap;
346 	unsigned int t19_num_keys;
347 
348 	enum mxt_suspend_mode suspend_mode;
349 };
350 
351 struct mxt_vb2_buffer {
352 	struct vb2_buffer	vb;
353 	struct list_head	list;
354 };
355 
356 static size_t mxt_obj_size(const struct mxt_object *obj)
357 {
358 	return obj->size_minus_one + 1;
359 }
360 
361 static size_t mxt_obj_instances(const struct mxt_object *obj)
362 {
363 	return obj->instances_minus_one + 1;
364 }
365 
366 static bool mxt_object_readable(unsigned int type)
367 {
368 	switch (type) {
369 	case MXT_GEN_COMMAND_T6:
370 	case MXT_GEN_POWER_T7:
371 	case MXT_GEN_ACQUIRE_T8:
372 	case MXT_GEN_DATASOURCE_T53:
373 	case MXT_TOUCH_MULTI_T9:
374 	case MXT_TOUCH_KEYARRAY_T15:
375 	case MXT_TOUCH_PROXIMITY_T23:
376 	case MXT_TOUCH_PROXKEY_T52:
377 	case MXT_TOUCH_MULTITOUCHSCREEN_T100:
378 	case MXT_PROCI_GRIPFACE_T20:
379 	case MXT_PROCG_NOISE_T22:
380 	case MXT_PROCI_ONETOUCH_T24:
381 	case MXT_PROCI_TWOTOUCH_T27:
382 	case MXT_PROCI_GRIP_T40:
383 	case MXT_PROCI_PALM_T41:
384 	case MXT_PROCI_TOUCHSUPPRESSION_T42:
385 	case MXT_PROCI_STYLUS_T47:
386 	case MXT_PROCG_NOISESUPPRESSION_T48:
387 	case MXT_SPT_COMMSCONFIG_T18:
388 	case MXT_SPT_GPIOPWM_T19:
389 	case MXT_SPT_SELFTEST_T25:
390 	case MXT_SPT_CTECONFIG_T28:
391 	case MXT_SPT_USERDATA_T38:
392 	case MXT_SPT_DIGITIZER_T43:
393 	case MXT_SPT_CTECONFIG_T46:
394 	case MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71:
395 		return true;
396 	default:
397 		return false;
398 	}
399 }
400 
401 static void mxt_dump_message(struct mxt_data *data, u8 *message)
402 {
403 	dev_dbg(&data->client->dev, "message: %*ph\n",
404 		data->T5_msg_size, message);
405 }
406 
407 static int mxt_wait_for_completion(struct mxt_data *data,
408 				   struct completion *comp,
409 				   unsigned int timeout_ms)
410 {
411 	struct device *dev = &data->client->dev;
412 	unsigned long timeout = msecs_to_jiffies(timeout_ms);
413 	long ret;
414 
415 	ret = wait_for_completion_interruptible_timeout(comp, timeout);
416 	if (ret < 0) {
417 		return ret;
418 	} else if (ret == 0) {
419 		dev_err(dev, "Wait for completion timed out.\n");
420 		return -ETIMEDOUT;
421 	}
422 	return 0;
423 }
424 
425 static int mxt_bootloader_read(struct mxt_data *data,
426 			       u8 *val, unsigned int count)
427 {
428 	int ret;
429 	struct i2c_msg msg;
430 
431 	msg.addr = data->bootloader_addr;
432 	msg.flags = data->client->flags & I2C_M_TEN;
433 	msg.flags |= I2C_M_RD;
434 	msg.len = count;
435 	msg.buf = val;
436 
437 	ret = i2c_transfer(data->client->adapter, &msg, 1);
438 	if (ret == 1) {
439 		ret = 0;
440 	} else {
441 		ret = ret < 0 ? ret : -EIO;
442 		dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
443 			__func__, ret);
444 	}
445 
446 	return ret;
447 }
448 
449 static int mxt_bootloader_write(struct mxt_data *data,
450 				const u8 * const val, unsigned int count)
451 {
452 	int ret;
453 	struct i2c_msg msg;
454 
455 	msg.addr = data->bootloader_addr;
456 	msg.flags = data->client->flags & I2C_M_TEN;
457 	msg.len = count;
458 	msg.buf = (u8 *)val;
459 
460 	ret = i2c_transfer(data->client->adapter, &msg, 1);
461 	if (ret == 1) {
462 		ret = 0;
463 	} else {
464 		ret = ret < 0 ? ret : -EIO;
465 		dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
466 			__func__, ret);
467 	}
468 
469 	return ret;
470 }
471 
472 static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
473 {
474 	u8 appmode = data->client->addr;
475 	u8 bootloader;
476 	u8 family_id = data->info ? data->info->family_id : 0;
477 
478 	switch (appmode) {
479 	case 0x4a:
480 	case 0x4b:
481 		/* Chips after 1664S use different scheme */
482 		if (retry || family_id >= 0xa2) {
483 			bootloader = appmode - 0x24;
484 			break;
485 		}
486 		/* Fall through - for normal case */
487 	case 0x4c:
488 	case 0x4d:
489 	case 0x5a:
490 	case 0x5b:
491 		bootloader = appmode - 0x26;
492 		break;
493 
494 	default:
495 		dev_err(&data->client->dev,
496 			"Appmode i2c address 0x%02x not found\n",
497 			appmode);
498 		return -EINVAL;
499 	}
500 
501 	data->bootloader_addr = bootloader;
502 	return 0;
503 }
504 
505 static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
506 {
507 	struct device *dev = &data->client->dev;
508 	int error;
509 	u8 val;
510 	bool crc_failure;
511 
512 	error = mxt_lookup_bootloader_address(data, alt_address);
513 	if (error)
514 		return error;
515 
516 	error = mxt_bootloader_read(data, &val, 1);
517 	if (error)
518 		return error;
519 
520 	/* Check app crc fail mode */
521 	crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
522 
523 	dev_err(dev, "Detected bootloader, status:%02X%s\n",
524 			val, crc_failure ? ", APP_CRC_FAIL" : "");
525 
526 	return 0;
527 }
528 
529 static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
530 {
531 	struct device *dev = &data->client->dev;
532 	u8 buf[3];
533 
534 	if (val & MXT_BOOT_EXTENDED_ID) {
535 		if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
536 			dev_err(dev, "%s: i2c failure\n", __func__);
537 			return val;
538 		}
539 
540 		dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
541 
542 		return buf[0];
543 	} else {
544 		dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
545 
546 		return val;
547 	}
548 }
549 
550 static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
551 				bool wait)
552 {
553 	struct device *dev = &data->client->dev;
554 	u8 val;
555 	int ret;
556 
557 recheck:
558 	if (wait) {
559 		/*
560 		 * In application update mode, the interrupt
561 		 * line signals state transitions. We must wait for the
562 		 * CHG assertion before reading the status byte.
563 		 * Once the status byte has been read, the line is deasserted.
564 		 */
565 		ret = mxt_wait_for_completion(data, &data->bl_completion,
566 					      MXT_FW_CHG_TIMEOUT);
567 		if (ret) {
568 			/*
569 			 * TODO: handle -ERESTARTSYS better by terminating
570 			 * fw update process before returning to userspace
571 			 * by writing length 0x000 to device (iff we are in
572 			 * WAITING_FRAME_DATA state).
573 			 */
574 			dev_err(dev, "Update wait error %d\n", ret);
575 			return ret;
576 		}
577 	}
578 
579 	ret = mxt_bootloader_read(data, &val, 1);
580 	if (ret)
581 		return ret;
582 
583 	if (state == MXT_WAITING_BOOTLOAD_CMD)
584 		val = mxt_get_bootloader_version(data, val);
585 
586 	switch (state) {
587 	case MXT_WAITING_BOOTLOAD_CMD:
588 	case MXT_WAITING_FRAME_DATA:
589 	case MXT_APP_CRC_FAIL:
590 		val &= ~MXT_BOOT_STATUS_MASK;
591 		break;
592 	case MXT_FRAME_CRC_PASS:
593 		if (val == MXT_FRAME_CRC_CHECK) {
594 			goto recheck;
595 		} else if (val == MXT_FRAME_CRC_FAIL) {
596 			dev_err(dev, "Bootloader CRC fail\n");
597 			return -EINVAL;
598 		}
599 		break;
600 	default:
601 		return -EINVAL;
602 	}
603 
604 	if (val != state) {
605 		dev_err(dev, "Invalid bootloader state %02X != %02X\n",
606 			val, state);
607 		return -EINVAL;
608 	}
609 
610 	return 0;
611 }
612 
613 static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
614 {
615 	int ret;
616 	u8 buf[2];
617 
618 	if (unlock) {
619 		buf[0] = MXT_UNLOCK_CMD_LSB;
620 		buf[1] = MXT_UNLOCK_CMD_MSB;
621 	} else {
622 		buf[0] = 0x01;
623 		buf[1] = 0x01;
624 	}
625 
626 	ret = mxt_bootloader_write(data, buf, 2);
627 	if (ret)
628 		return ret;
629 
630 	return 0;
631 }
632 
633 static int __mxt_read_reg(struct i2c_client *client,
634 			       u16 reg, u16 len, void *val)
635 {
636 	struct i2c_msg xfer[2];
637 	u8 buf[2];
638 	int ret;
639 
640 	buf[0] = reg & 0xff;
641 	buf[1] = (reg >> 8) & 0xff;
642 
643 	/* Write register */
644 	xfer[0].addr = client->addr;
645 	xfer[0].flags = 0;
646 	xfer[0].len = 2;
647 	xfer[0].buf = buf;
648 
649 	/* Read data */
650 	xfer[1].addr = client->addr;
651 	xfer[1].flags = I2C_M_RD;
652 	xfer[1].len = len;
653 	xfer[1].buf = val;
654 
655 	ret = i2c_transfer(client->adapter, xfer, 2);
656 	if (ret == 2) {
657 		ret = 0;
658 	} else {
659 		if (ret >= 0)
660 			ret = -EIO;
661 		dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
662 			__func__, ret);
663 	}
664 
665 	return ret;
666 }
667 
668 static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
669 			   const void *val)
670 {
671 	u8 *buf;
672 	size_t count;
673 	int ret;
674 
675 	count = len + 2;
676 	buf = kmalloc(count, GFP_KERNEL);
677 	if (!buf)
678 		return -ENOMEM;
679 
680 	buf[0] = reg & 0xff;
681 	buf[1] = (reg >> 8) & 0xff;
682 	memcpy(&buf[2], val, len);
683 
684 	ret = i2c_master_send(client, buf, count);
685 	if (ret == count) {
686 		ret = 0;
687 	} else {
688 		if (ret >= 0)
689 			ret = -EIO;
690 		dev_err(&client->dev, "%s: i2c send failed (%d)\n",
691 			__func__, ret);
692 	}
693 
694 	kfree(buf);
695 	return ret;
696 }
697 
698 static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
699 {
700 	return __mxt_write_reg(client, reg, 1, &val);
701 }
702 
703 static struct mxt_object *
704 mxt_get_object(struct mxt_data *data, u8 type)
705 {
706 	struct mxt_object *object;
707 	int i;
708 
709 	for (i = 0; i < data->info->object_num; i++) {
710 		object = data->object_table + i;
711 		if (object->type == type)
712 			return object;
713 	}
714 
715 	dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
716 	return NULL;
717 }
718 
719 static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
720 {
721 	struct device *dev = &data->client->dev;
722 	u8 status = msg[1];
723 	u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
724 
725 	if (crc != data->config_crc) {
726 		data->config_crc = crc;
727 		dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
728 	}
729 
730 	complete(&data->crc_completion);
731 
732 	/* Detect reset */
733 	if (status & MXT_T6_STATUS_RESET)
734 		complete(&data->reset_completion);
735 
736 	/* Output debug if status has changed */
737 	if (status != data->t6_status)
738 		dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
739 			status,
740 			status == 0 ? " OK" : "",
741 			status & MXT_T6_STATUS_RESET ? " RESET" : "",
742 			status & MXT_T6_STATUS_OFL ? " OFL" : "",
743 			status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
744 			status & MXT_T6_STATUS_CAL ? " CAL" : "",
745 			status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
746 			status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
747 
748 	/* Save current status */
749 	data->t6_status = status;
750 }
751 
752 static int mxt_write_object(struct mxt_data *data,
753 				 u8 type, u8 offset, u8 val)
754 {
755 	struct mxt_object *object;
756 	u16 reg;
757 
758 	object = mxt_get_object(data, type);
759 	if (!object || offset >= mxt_obj_size(object))
760 		return -EINVAL;
761 
762 	reg = object->start_address;
763 	return mxt_write_reg(data->client, reg + offset, val);
764 }
765 
766 static void mxt_input_button(struct mxt_data *data, u8 *message)
767 {
768 	struct input_dev *input = data->input_dev;
769 	int i;
770 
771 	for (i = 0; i < data->t19_num_keys; i++) {
772 		if (data->t19_keymap[i] == KEY_RESERVED)
773 			continue;
774 
775 		/* Active-low switch */
776 		input_report_key(input, data->t19_keymap[i],
777 				 !(message[1] & BIT(i)));
778 	}
779 }
780 
781 static void mxt_input_sync(struct mxt_data *data)
782 {
783 	input_mt_report_pointer_emulation(data->input_dev,
784 					  data->t19_num_keys);
785 	input_sync(data->input_dev);
786 }
787 
788 static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
789 {
790 	struct device *dev = &data->client->dev;
791 	struct input_dev *input_dev = data->input_dev;
792 	int id;
793 	u8 status;
794 	int x;
795 	int y;
796 	int area;
797 	int amplitude;
798 
799 	id = message[0] - data->T9_reportid_min;
800 	status = message[1];
801 	x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
802 	y = (message[3] << 4) | ((message[4] & 0xf));
803 
804 	/* Handle 10/12 bit switching */
805 	if (data->max_x < 1024)
806 		x >>= 2;
807 	if (data->max_y < 1024)
808 		y >>= 2;
809 
810 	area = message[5];
811 	amplitude = message[6];
812 
813 	dev_dbg(dev,
814 		"[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
815 		id,
816 		(status & MXT_T9_DETECT) ? 'D' : '.',
817 		(status & MXT_T9_PRESS) ? 'P' : '.',
818 		(status & MXT_T9_RELEASE) ? 'R' : '.',
819 		(status & MXT_T9_MOVE) ? 'M' : '.',
820 		(status & MXT_T9_VECTOR) ? 'V' : '.',
821 		(status & MXT_T9_AMP) ? 'A' : '.',
822 		(status & MXT_T9_SUPPRESS) ? 'S' : '.',
823 		(status & MXT_T9_UNGRIP) ? 'U' : '.',
824 		x, y, area, amplitude);
825 
826 	input_mt_slot(input_dev, id);
827 
828 	if (status & MXT_T9_DETECT) {
829 		/*
830 		 * Multiple bits may be set if the host is slow to read
831 		 * the status messages, indicating all the events that
832 		 * have happened.
833 		 */
834 		if (status & MXT_T9_RELEASE) {
835 			input_mt_report_slot_state(input_dev,
836 						   MT_TOOL_FINGER, 0);
837 			mxt_input_sync(data);
838 		}
839 
840 		/* if active, pressure must be non-zero */
841 		if (!amplitude)
842 			amplitude = MXT_PRESSURE_DEFAULT;
843 
844 		/* Touch active */
845 		input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
846 		input_report_abs(input_dev, ABS_MT_POSITION_X, x);
847 		input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
848 		input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
849 		input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
850 	} else {
851 		/* Touch no longer active, close out slot */
852 		input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 0);
853 	}
854 
855 	data->update_input = true;
856 }
857 
858 static void mxt_proc_t100_message(struct mxt_data *data, u8 *message)
859 {
860 	struct device *dev = &data->client->dev;
861 	struct input_dev *input_dev = data->input_dev;
862 	int id;
863 	u8 status;
864 	u8 type = 0;
865 	u16 x;
866 	u16 y;
867 	int distance = 0;
868 	int tool = 0;
869 	u8 major = 0;
870 	u8 pressure = 0;
871 	u8 orientation = 0;
872 
873 	id = message[0] - data->T100_reportid_min - 2;
874 
875 	/* ignore SCRSTATUS events */
876 	if (id < 0)
877 		return;
878 
879 	status = message[1];
880 	x = get_unaligned_le16(&message[2]);
881 	y = get_unaligned_le16(&message[4]);
882 
883 	if (status & MXT_T100_DETECT) {
884 		type = (status & MXT_T100_TYPE_MASK) >> 4;
885 
886 		switch (type) {
887 		case MXT_T100_TYPE_HOVERING_FINGER:
888 			tool = MT_TOOL_FINGER;
889 			distance = MXT_DISTANCE_HOVERING;
890 
891 			if (data->t100_aux_vect)
892 				orientation = message[data->t100_aux_vect];
893 
894 			break;
895 
896 		case MXT_T100_TYPE_FINGER:
897 		case MXT_T100_TYPE_GLOVE:
898 			tool = MT_TOOL_FINGER;
899 			distance = MXT_DISTANCE_ACTIVE_TOUCH;
900 
901 			if (data->t100_aux_area)
902 				major = message[data->t100_aux_area];
903 
904 			if (data->t100_aux_ampl)
905 				pressure = message[data->t100_aux_ampl];
906 
907 			if (data->t100_aux_vect)
908 				orientation = message[data->t100_aux_vect];
909 
910 			break;
911 
912 		case MXT_T100_TYPE_PASSIVE_STYLUS:
913 			tool = MT_TOOL_PEN;
914 
915 			/*
916 			 * Passive stylus is reported with size zero so
917 			 * hardcode.
918 			 */
919 			major = MXT_TOUCH_MAJOR_DEFAULT;
920 
921 			if (data->t100_aux_ampl)
922 				pressure = message[data->t100_aux_ampl];
923 
924 			break;
925 
926 		case MXT_T100_TYPE_LARGE_TOUCH:
927 			/* Ignore suppressed touch */
928 			break;
929 
930 		default:
931 			dev_dbg(dev, "Unexpected T100 type\n");
932 			return;
933 		}
934 	}
935 
936 	/*
937 	 * Values reported should be non-zero if tool is touching the
938 	 * device
939 	 */
940 	if (!pressure && type != MXT_T100_TYPE_HOVERING_FINGER)
941 		pressure = MXT_PRESSURE_DEFAULT;
942 
943 	input_mt_slot(input_dev, id);
944 
945 	if (status & MXT_T100_DETECT) {
946 		dev_dbg(dev, "[%u] type:%u x:%u y:%u a:%02X p:%02X v:%02X\n",
947 			id, type, x, y, major, pressure, orientation);
948 
949 		input_mt_report_slot_state(input_dev, tool, 1);
950 		input_report_abs(input_dev, ABS_MT_POSITION_X, x);
951 		input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
952 		input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, major);
953 		input_report_abs(input_dev, ABS_MT_PRESSURE, pressure);
954 		input_report_abs(input_dev, ABS_MT_DISTANCE, distance);
955 		input_report_abs(input_dev, ABS_MT_ORIENTATION, orientation);
956 	} else {
957 		dev_dbg(dev, "[%u] release\n", id);
958 
959 		/* close out slot */
960 		input_mt_report_slot_state(input_dev, 0, 0);
961 	}
962 
963 	data->update_input = true;
964 }
965 
966 static int mxt_proc_message(struct mxt_data *data, u8 *message)
967 {
968 	u8 report_id = message[0];
969 
970 	if (report_id == MXT_RPTID_NOMSG)
971 		return 0;
972 
973 	if (report_id == data->T6_reportid) {
974 		mxt_proc_t6_messages(data, message);
975 	} else if (!data->input_dev) {
976 		/*
977 		 * Do not report events if input device
978 		 * is not yet registered.
979 		 */
980 		mxt_dump_message(data, message);
981 	} else if (report_id >= data->T9_reportid_min &&
982 		   report_id <= data->T9_reportid_max) {
983 		mxt_proc_t9_message(data, message);
984 	} else if (report_id >= data->T100_reportid_min &&
985 		   report_id <= data->T100_reportid_max) {
986 		mxt_proc_t100_message(data, message);
987 	} else if (report_id == data->T19_reportid) {
988 		mxt_input_button(data, message);
989 		data->update_input = true;
990 	} else {
991 		mxt_dump_message(data, message);
992 	}
993 
994 	return 1;
995 }
996 
997 static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
998 {
999 	struct device *dev = &data->client->dev;
1000 	int ret;
1001 	int i;
1002 	u8 num_valid = 0;
1003 
1004 	/* Safety check for msg_buf */
1005 	if (count > data->max_reportid)
1006 		return -EINVAL;
1007 
1008 	/* Process remaining messages if necessary */
1009 	ret = __mxt_read_reg(data->client, data->T5_address,
1010 				data->T5_msg_size * count, data->msg_buf);
1011 	if (ret) {
1012 		dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
1013 		return ret;
1014 	}
1015 
1016 	for (i = 0;  i < count; i++) {
1017 		ret = mxt_proc_message(data,
1018 			data->msg_buf + data->T5_msg_size * i);
1019 
1020 		if (ret == 1)
1021 			num_valid++;
1022 	}
1023 
1024 	/* return number of messages read */
1025 	return num_valid;
1026 }
1027 
1028 static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
1029 {
1030 	struct device *dev = &data->client->dev;
1031 	int ret;
1032 	u8 count, num_left;
1033 
1034 	/* Read T44 and T5 together */
1035 	ret = __mxt_read_reg(data->client, data->T44_address,
1036 		data->T5_msg_size + 1, data->msg_buf);
1037 	if (ret) {
1038 		dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
1039 		return IRQ_NONE;
1040 	}
1041 
1042 	count = data->msg_buf[0];
1043 
1044 	/*
1045 	 * This condition may be caused by the CHG line being configured in
1046 	 * Mode 0. It results in unnecessary I2C operations but it is benign.
1047 	 */
1048 	if (count == 0)
1049 		return IRQ_NONE;
1050 
1051 	if (count > data->max_reportid) {
1052 		dev_warn(dev, "T44 count %d exceeded max report id\n", count);
1053 		count = data->max_reportid;
1054 	}
1055 
1056 	/* Process first message */
1057 	ret = mxt_proc_message(data, data->msg_buf + 1);
1058 	if (ret < 0) {
1059 		dev_warn(dev, "Unexpected invalid message\n");
1060 		return IRQ_NONE;
1061 	}
1062 
1063 	num_left = count - 1;
1064 
1065 	/* Process remaining messages if necessary */
1066 	if (num_left) {
1067 		ret = mxt_read_and_process_messages(data, num_left);
1068 		if (ret < 0)
1069 			goto end;
1070 		else if (ret != num_left)
1071 			dev_warn(dev, "Unexpected invalid message\n");
1072 	}
1073 
1074 end:
1075 	if (data->update_input) {
1076 		mxt_input_sync(data);
1077 		data->update_input = false;
1078 	}
1079 
1080 	return IRQ_HANDLED;
1081 }
1082 
1083 static int mxt_process_messages_until_invalid(struct mxt_data *data)
1084 {
1085 	struct device *dev = &data->client->dev;
1086 	int count, read;
1087 	u8 tries = 2;
1088 
1089 	count = data->max_reportid;
1090 
1091 	/* Read messages until we force an invalid */
1092 	do {
1093 		read = mxt_read_and_process_messages(data, count);
1094 		if (read < count)
1095 			return 0;
1096 	} while (--tries);
1097 
1098 	if (data->update_input) {
1099 		mxt_input_sync(data);
1100 		data->update_input = false;
1101 	}
1102 
1103 	dev_err(dev, "CHG pin isn't cleared\n");
1104 	return -EBUSY;
1105 }
1106 
1107 static irqreturn_t mxt_process_messages(struct mxt_data *data)
1108 {
1109 	int total_handled, num_handled;
1110 	u8 count = data->last_message_count;
1111 
1112 	if (count < 1 || count > data->max_reportid)
1113 		count = 1;
1114 
1115 	/* include final invalid message */
1116 	total_handled = mxt_read_and_process_messages(data, count + 1);
1117 	if (total_handled < 0)
1118 		return IRQ_NONE;
1119 	/* if there were invalid messages, then we are done */
1120 	else if (total_handled <= count)
1121 		goto update_count;
1122 
1123 	/* keep reading two msgs until one is invalid or reportid limit */
1124 	do {
1125 		num_handled = mxt_read_and_process_messages(data, 2);
1126 		if (num_handled < 0)
1127 			return IRQ_NONE;
1128 
1129 		total_handled += num_handled;
1130 
1131 		if (num_handled < 2)
1132 			break;
1133 	} while (total_handled < data->num_touchids);
1134 
1135 update_count:
1136 	data->last_message_count = total_handled;
1137 
1138 	if (data->update_input) {
1139 		mxt_input_sync(data);
1140 		data->update_input = false;
1141 	}
1142 
1143 	return IRQ_HANDLED;
1144 }
1145 
1146 static irqreturn_t mxt_interrupt(int irq, void *dev_id)
1147 {
1148 	struct mxt_data *data = dev_id;
1149 
1150 	if (data->in_bootloader) {
1151 		/* bootloader state transition completion */
1152 		complete(&data->bl_completion);
1153 		return IRQ_HANDLED;
1154 	}
1155 
1156 	if (!data->object_table)
1157 		return IRQ_HANDLED;
1158 
1159 	if (data->T44_address) {
1160 		return mxt_process_messages_t44(data);
1161 	} else {
1162 		return mxt_process_messages(data);
1163 	}
1164 }
1165 
1166 static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
1167 			  u8 value, bool wait)
1168 {
1169 	u16 reg;
1170 	u8 command_register;
1171 	int timeout_counter = 0;
1172 	int ret;
1173 
1174 	reg = data->T6_address + cmd_offset;
1175 
1176 	ret = mxt_write_reg(data->client, reg, value);
1177 	if (ret)
1178 		return ret;
1179 
1180 	if (!wait)
1181 		return 0;
1182 
1183 	do {
1184 		msleep(20);
1185 		ret = __mxt_read_reg(data->client, reg, 1, &command_register);
1186 		if (ret)
1187 			return ret;
1188 	} while (command_register != 0 && timeout_counter++ <= 100);
1189 
1190 	if (timeout_counter > 100) {
1191 		dev_err(&data->client->dev, "Command failed!\n");
1192 		return -EIO;
1193 	}
1194 
1195 	return 0;
1196 }
1197 
1198 static int mxt_acquire_irq(struct mxt_data *data)
1199 {
1200 	int error;
1201 
1202 	enable_irq(data->irq);
1203 
1204 	error = mxt_process_messages_until_invalid(data);
1205 	if (error)
1206 		return error;
1207 
1208 	return 0;
1209 }
1210 
1211 static int mxt_soft_reset(struct mxt_data *data)
1212 {
1213 	struct device *dev = &data->client->dev;
1214 	int ret = 0;
1215 
1216 	dev_info(dev, "Resetting device\n");
1217 
1218 	disable_irq(data->irq);
1219 
1220 	reinit_completion(&data->reset_completion);
1221 
1222 	ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1223 	if (ret)
1224 		return ret;
1225 
1226 	/* Ignore CHG line for 100ms after reset */
1227 	msleep(MXT_RESET_INVALID_CHG);
1228 
1229 	mxt_acquire_irq(data);
1230 
1231 	ret = mxt_wait_for_completion(data, &data->reset_completion,
1232 				      MXT_RESET_TIMEOUT);
1233 	if (ret)
1234 		return ret;
1235 
1236 	return 0;
1237 }
1238 
1239 static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1240 {
1241 	/*
1242 	 * On failure, CRC is set to 0 and config will always be
1243 	 * downloaded.
1244 	 */
1245 	data->config_crc = 0;
1246 	reinit_completion(&data->crc_completion);
1247 
1248 	mxt_t6_command(data, cmd, value, true);
1249 
1250 	/*
1251 	 * Wait for crc message. On failure, CRC is set to 0 and config will
1252 	 * always be downloaded.
1253 	 */
1254 	mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1255 }
1256 
1257 static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1258 {
1259 	static const unsigned int crcpoly = 0x80001B;
1260 	u32 result;
1261 	u32 data_word;
1262 
1263 	data_word = (secondbyte << 8) | firstbyte;
1264 	result = ((*crc << 1) ^ data_word);
1265 
1266 	if (result & 0x1000000)
1267 		result ^= crcpoly;
1268 
1269 	*crc = result;
1270 }
1271 
1272 static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1273 {
1274 	u32 crc = 0;
1275 	u8 *ptr = base + start_off;
1276 	u8 *last_val = base + end_off - 1;
1277 
1278 	if (end_off < start_off)
1279 		return -EINVAL;
1280 
1281 	while (ptr < last_val) {
1282 		mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1283 		ptr += 2;
1284 	}
1285 
1286 	/* if len is odd, fill the last byte with 0 */
1287 	if (ptr == last_val)
1288 		mxt_calc_crc24(&crc, *ptr, 0);
1289 
1290 	/* Mask to 24-bit */
1291 	crc &= 0x00FFFFFF;
1292 
1293 	return crc;
1294 }
1295 
1296 static int mxt_prepare_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
1297 {
1298 	struct device *dev = &data->client->dev;
1299 	struct mxt_object *object;
1300 	unsigned int type, instance, size, byte_offset;
1301 	int offset;
1302 	int ret;
1303 	int i;
1304 	u16 reg;
1305 	u8 val;
1306 
1307 	while (cfg->raw_pos < cfg->raw_size) {
1308 		/* Read type, instance, length */
1309 		ret = sscanf(cfg->raw + cfg->raw_pos, "%x %x %x%n",
1310 			     &type, &instance, &size, &offset);
1311 		if (ret == 0) {
1312 			/* EOF */
1313 			break;
1314 		} else if (ret != 3) {
1315 			dev_err(dev, "Bad format: failed to parse object\n");
1316 			return -EINVAL;
1317 		}
1318 		cfg->raw_pos += offset;
1319 
1320 		object = mxt_get_object(data, type);
1321 		if (!object) {
1322 			/* Skip object */
1323 			for (i = 0; i < size; i++) {
1324 				ret = sscanf(cfg->raw + cfg->raw_pos, "%hhx%n",
1325 					     &val, &offset);
1326 				if (ret != 1) {
1327 					dev_err(dev, "Bad format in T%d at %d\n",
1328 						type, i);
1329 					return -EINVAL;
1330 				}
1331 				cfg->raw_pos += offset;
1332 			}
1333 			continue;
1334 		}
1335 
1336 		if (size > mxt_obj_size(object)) {
1337 			/*
1338 			 * Either we are in fallback mode due to wrong
1339 			 * config or config from a later fw version,
1340 			 * or the file is corrupt or hand-edited.
1341 			 */
1342 			dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1343 				 size - mxt_obj_size(object), type);
1344 		} else if (mxt_obj_size(object) > size) {
1345 			/*
1346 			 * If firmware is upgraded, new bytes may be added to
1347 			 * end of objects. It is generally forward compatible
1348 			 * to zero these bytes - previous behaviour will be
1349 			 * retained. However this does invalidate the CRC and
1350 			 * will force fallback mode until the configuration is
1351 			 * updated. We warn here but do nothing else - the
1352 			 * malloc has zeroed the entire configuration.
1353 			 */
1354 			dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1355 				 mxt_obj_size(object) - size, type);
1356 		}
1357 
1358 		if (instance >= mxt_obj_instances(object)) {
1359 			dev_err(dev, "Object instances exceeded!\n");
1360 			return -EINVAL;
1361 		}
1362 
1363 		reg = object->start_address + mxt_obj_size(object) * instance;
1364 
1365 		for (i = 0; i < size; i++) {
1366 			ret = sscanf(cfg->raw + cfg->raw_pos, "%hhx%n",
1367 				     &val,
1368 				     &offset);
1369 			if (ret != 1) {
1370 				dev_err(dev, "Bad format in T%d at %d\n",
1371 					type, i);
1372 				return -EINVAL;
1373 			}
1374 			cfg->raw_pos += offset;
1375 
1376 			if (i > mxt_obj_size(object))
1377 				continue;
1378 
1379 			byte_offset = reg + i - cfg->start_ofs;
1380 
1381 			if (byte_offset >= 0 && byte_offset < cfg->mem_size) {
1382 				*(cfg->mem + byte_offset) = val;
1383 			} else {
1384 				dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1385 					reg, object->type, byte_offset);
1386 				return -EINVAL;
1387 			}
1388 		}
1389 	}
1390 
1391 	return 0;
1392 }
1393 
1394 static int mxt_upload_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
1395 {
1396 	unsigned int byte_offset = 0;
1397 	int error;
1398 
1399 	/* Write configuration as blocks */
1400 	while (byte_offset < cfg->mem_size) {
1401 		unsigned int size = cfg->mem_size - byte_offset;
1402 
1403 		if (size > MXT_MAX_BLOCK_WRITE)
1404 			size = MXT_MAX_BLOCK_WRITE;
1405 
1406 		error = __mxt_write_reg(data->client,
1407 					cfg->start_ofs + byte_offset,
1408 					size, cfg->mem + byte_offset);
1409 		if (error) {
1410 			dev_err(&data->client->dev,
1411 				"Config write error, ret=%d\n", error);
1412 			return error;
1413 		}
1414 
1415 		byte_offset += size;
1416 	}
1417 
1418 	return 0;
1419 }
1420 
1421 static int mxt_init_t7_power_cfg(struct mxt_data *data);
1422 
1423 /*
1424  * mxt_update_cfg - download configuration to chip
1425  *
1426  * Atmel Raw Config File Format
1427  *
1428  * The first four lines of the raw config file contain:
1429  *  1) Version
1430  *  2) Chip ID Information (first 7 bytes of device memory)
1431  *  3) Chip Information Block 24-bit CRC Checksum
1432  *  4) Chip Configuration 24-bit CRC Checksum
1433  *
1434  * The rest of the file consists of one line per object instance:
1435  *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1436  *
1437  *   <TYPE> - 2-byte object type as hex
1438  *   <INSTANCE> - 2-byte object instance number as hex
1439  *   <SIZE> - 2-byte object size as hex
1440  *   <CONTENTS> - array of <SIZE> 1-byte hex values
1441  */
1442 static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
1443 {
1444 	struct device *dev = &data->client->dev;
1445 	struct mxt_cfg cfg;
1446 	int ret;
1447 	int offset;
1448 	int i;
1449 	u32 info_crc, config_crc, calculated_crc;
1450 	u16 crc_start = 0;
1451 
1452 	/* Make zero terminated copy of the OBP_RAW file */
1453 	cfg.raw = kmemdup_nul(fw->data, fw->size, GFP_KERNEL);
1454 	if (!cfg.raw)
1455 		return -ENOMEM;
1456 
1457 	cfg.raw_size = fw->size;
1458 
1459 	mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1460 
1461 	if (strncmp(cfg.raw, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1462 		dev_err(dev, "Unrecognised config file\n");
1463 		ret = -EINVAL;
1464 		goto release_raw;
1465 	}
1466 
1467 	cfg.raw_pos = strlen(MXT_CFG_MAGIC);
1468 
1469 	/* Load information block and check */
1470 	for (i = 0; i < sizeof(struct mxt_info); i++) {
1471 		ret = sscanf(cfg.raw + cfg.raw_pos, "%hhx%n",
1472 			     (unsigned char *)&cfg.info + i,
1473 			     &offset);
1474 		if (ret != 1) {
1475 			dev_err(dev, "Bad format\n");
1476 			ret = -EINVAL;
1477 			goto release_raw;
1478 		}
1479 
1480 		cfg.raw_pos += offset;
1481 	}
1482 
1483 	if (cfg.info.family_id != data->info->family_id) {
1484 		dev_err(dev, "Family ID mismatch!\n");
1485 		ret = -EINVAL;
1486 		goto release_raw;
1487 	}
1488 
1489 	if (cfg.info.variant_id != data->info->variant_id) {
1490 		dev_err(dev, "Variant ID mismatch!\n");
1491 		ret = -EINVAL;
1492 		goto release_raw;
1493 	}
1494 
1495 	/* Read CRCs */
1496 	ret = sscanf(cfg.raw + cfg.raw_pos, "%x%n", &info_crc, &offset);
1497 	if (ret != 1) {
1498 		dev_err(dev, "Bad format: failed to parse Info CRC\n");
1499 		ret = -EINVAL;
1500 		goto release_raw;
1501 	}
1502 	cfg.raw_pos += offset;
1503 
1504 	ret = sscanf(cfg.raw + cfg.raw_pos, "%x%n", &config_crc, &offset);
1505 	if (ret != 1) {
1506 		dev_err(dev, "Bad format: failed to parse Config CRC\n");
1507 		ret = -EINVAL;
1508 		goto release_raw;
1509 	}
1510 	cfg.raw_pos += offset;
1511 
1512 	/*
1513 	 * The Info Block CRC is calculated over mxt_info and the object
1514 	 * table. If it does not match then we are trying to load the
1515 	 * configuration from a different chip or firmware version, so
1516 	 * the configuration CRC is invalid anyway.
1517 	 */
1518 	if (info_crc == data->info_crc) {
1519 		if (config_crc == 0 || data->config_crc == 0) {
1520 			dev_info(dev, "CRC zero, attempting to apply config\n");
1521 		} else if (config_crc == data->config_crc) {
1522 			dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1523 				 data->config_crc);
1524 			return 0;
1525 		} else {
1526 			dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1527 				 data->config_crc, config_crc);
1528 		}
1529 	} else {
1530 		dev_warn(dev,
1531 			 "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1532 			 data->info_crc, info_crc);
1533 	}
1534 
1535 	/* Malloc memory to store configuration */
1536 	cfg.start_ofs = MXT_OBJECT_START +
1537 			data->info->object_num * sizeof(struct mxt_object) +
1538 			MXT_INFO_CHECKSUM_SIZE;
1539 	cfg.mem_size = data->mem_size - cfg.start_ofs;
1540 	cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);
1541 	if (!cfg.mem) {
1542 		ret = -ENOMEM;
1543 		goto release_raw;
1544 	}
1545 
1546 	ret = mxt_prepare_cfg_mem(data, &cfg);
1547 	if (ret)
1548 		goto release_mem;
1549 
1550 	/* Calculate crc of the received configs (not the raw config file) */
1551 	if (data->T71_address)
1552 		crc_start = data->T71_address;
1553 	else if (data->T7_address)
1554 		crc_start = data->T7_address;
1555 	else
1556 		dev_warn(dev, "Could not find CRC start\n");
1557 
1558 	if (crc_start > cfg.start_ofs) {
1559 		calculated_crc = mxt_calculate_crc(cfg.mem,
1560 						   crc_start - cfg.start_ofs,
1561 						   cfg.mem_size);
1562 
1563 		if (config_crc > 0 && config_crc != calculated_crc)
1564 			dev_warn(dev, "Config CRC in file inconsistent, calculated=%06X, file=%06X\n",
1565 				 calculated_crc, config_crc);
1566 	}
1567 
1568 	ret = mxt_upload_cfg_mem(data, &cfg);
1569 	if (ret)
1570 		goto release_mem;
1571 
1572 	mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1573 
1574 	ret = mxt_soft_reset(data);
1575 	if (ret)
1576 		goto release_mem;
1577 
1578 	dev_info(dev, "Config successfully updated\n");
1579 
1580 	/* T7 config may have changed */
1581 	mxt_init_t7_power_cfg(data);
1582 
1583 release_mem:
1584 	kfree(cfg.mem);
1585 release_raw:
1586 	kfree(cfg.raw);
1587 	return ret;
1588 }
1589 
1590 static void mxt_free_input_device(struct mxt_data *data)
1591 {
1592 	if (data->input_dev) {
1593 		input_unregister_device(data->input_dev);
1594 		data->input_dev = NULL;
1595 	}
1596 }
1597 
1598 static void mxt_free_object_table(struct mxt_data *data)
1599 {
1600 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
1601 	video_unregister_device(&data->dbg.vdev);
1602 	v4l2_device_unregister(&data->dbg.v4l2);
1603 #endif
1604 	data->object_table = NULL;
1605 	data->info = NULL;
1606 	kfree(data->raw_info_block);
1607 	data->raw_info_block = NULL;
1608 	kfree(data->msg_buf);
1609 	data->msg_buf = NULL;
1610 	data->T5_address = 0;
1611 	data->T5_msg_size = 0;
1612 	data->T6_reportid = 0;
1613 	data->T7_address = 0;
1614 	data->T71_address = 0;
1615 	data->T9_reportid_min = 0;
1616 	data->T9_reportid_max = 0;
1617 	data->T19_reportid = 0;
1618 	data->T44_address = 0;
1619 	data->T100_reportid_min = 0;
1620 	data->T100_reportid_max = 0;
1621 	data->max_reportid = 0;
1622 }
1623 
1624 static int mxt_parse_object_table(struct mxt_data *data,
1625 				  struct mxt_object *object_table)
1626 {
1627 	struct i2c_client *client = data->client;
1628 	int i;
1629 	u8 reportid;
1630 	u16 end_address;
1631 
1632 	/* Valid Report IDs start counting from 1 */
1633 	reportid = 1;
1634 	data->mem_size = 0;
1635 	for (i = 0; i < data->info->object_num; i++) {
1636 		struct mxt_object *object = object_table + i;
1637 		u8 min_id, max_id;
1638 
1639 		le16_to_cpus(&object->start_address);
1640 
1641 		if (object->num_report_ids) {
1642 			min_id = reportid;
1643 			reportid += object->num_report_ids *
1644 					mxt_obj_instances(object);
1645 			max_id = reportid - 1;
1646 		} else {
1647 			min_id = 0;
1648 			max_id = 0;
1649 		}
1650 
1651 		dev_dbg(&data->client->dev,
1652 			"T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1653 			object->type, object->start_address,
1654 			mxt_obj_size(object), mxt_obj_instances(object),
1655 			min_id, max_id);
1656 
1657 		switch (object->type) {
1658 		case MXT_GEN_MESSAGE_T5:
1659 			if (data->info->family_id == 0x80 &&
1660 			    data->info->version < 0x20) {
1661 				/*
1662 				 * On mXT224 firmware versions prior to V2.0
1663 				 * read and discard unused CRC byte otherwise
1664 				 * DMA reads are misaligned.
1665 				 */
1666 				data->T5_msg_size = mxt_obj_size(object);
1667 			} else {
1668 				/* CRC not enabled, so skip last byte */
1669 				data->T5_msg_size = mxt_obj_size(object) - 1;
1670 			}
1671 			data->T5_address = object->start_address;
1672 			break;
1673 		case MXT_GEN_COMMAND_T6:
1674 			data->T6_reportid = min_id;
1675 			data->T6_address = object->start_address;
1676 			break;
1677 		case MXT_GEN_POWER_T7:
1678 			data->T7_address = object->start_address;
1679 			break;
1680 		case MXT_SPT_DYNAMICCONFIGURATIONCONTAINER_T71:
1681 			data->T71_address = object->start_address;
1682 			break;
1683 		case MXT_TOUCH_MULTI_T9:
1684 			data->multitouch = MXT_TOUCH_MULTI_T9;
1685 			/* Only handle messages from first T9 instance */
1686 			data->T9_reportid_min = min_id;
1687 			data->T9_reportid_max = min_id +
1688 						object->num_report_ids - 1;
1689 			data->num_touchids = object->num_report_ids;
1690 			break;
1691 		case MXT_SPT_MESSAGECOUNT_T44:
1692 			data->T44_address = object->start_address;
1693 			break;
1694 		case MXT_SPT_GPIOPWM_T19:
1695 			data->T19_reportid = min_id;
1696 			break;
1697 		case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1698 			data->multitouch = MXT_TOUCH_MULTITOUCHSCREEN_T100;
1699 			data->T100_reportid_min = min_id;
1700 			data->T100_reportid_max = max_id;
1701 			/* first two report IDs reserved */
1702 			data->num_touchids = object->num_report_ids - 2;
1703 			break;
1704 		}
1705 
1706 		end_address = object->start_address
1707 			+ mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1708 
1709 		if (end_address >= data->mem_size)
1710 			data->mem_size = end_address + 1;
1711 	}
1712 
1713 	/* Store maximum reportid */
1714 	data->max_reportid = reportid;
1715 
1716 	/* If T44 exists, T5 position has to be directly after */
1717 	if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1718 		dev_err(&client->dev, "Invalid T44 position\n");
1719 		return -EINVAL;
1720 	}
1721 
1722 	data->msg_buf = kcalloc(data->max_reportid,
1723 				data->T5_msg_size, GFP_KERNEL);
1724 	if (!data->msg_buf)
1725 		return -ENOMEM;
1726 
1727 	return 0;
1728 }
1729 
1730 static int mxt_read_info_block(struct mxt_data *data)
1731 {
1732 	struct i2c_client *client = data->client;
1733 	int error;
1734 	size_t size;
1735 	void *id_buf, *buf;
1736 	uint8_t num_objects;
1737 	u32 calculated_crc;
1738 	u8 *crc_ptr;
1739 
1740 	/* If info block already allocated, free it */
1741 	if (data->raw_info_block)
1742 		mxt_free_object_table(data);
1743 
1744 	/* Read 7-byte ID information block starting at address 0 */
1745 	size = sizeof(struct mxt_info);
1746 	id_buf = kzalloc(size, GFP_KERNEL);
1747 	if (!id_buf)
1748 		return -ENOMEM;
1749 
1750 	error = __mxt_read_reg(client, 0, size, id_buf);
1751 	if (error)
1752 		goto err_free_mem;
1753 
1754 	/* Resize buffer to give space for rest of info block */
1755 	num_objects = ((struct mxt_info *)id_buf)->object_num;
1756 	size += (num_objects * sizeof(struct mxt_object))
1757 		+ MXT_INFO_CHECKSUM_SIZE;
1758 
1759 	buf = krealloc(id_buf, size, GFP_KERNEL);
1760 	if (!buf) {
1761 		error = -ENOMEM;
1762 		goto err_free_mem;
1763 	}
1764 	id_buf = buf;
1765 
1766 	/* Read rest of info block */
1767 	error = __mxt_read_reg(client, MXT_OBJECT_START,
1768 			       size - MXT_OBJECT_START,
1769 			       id_buf + MXT_OBJECT_START);
1770 	if (error)
1771 		goto err_free_mem;
1772 
1773 	/* Extract & calculate checksum */
1774 	crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
1775 	data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
1776 
1777 	calculated_crc = mxt_calculate_crc(id_buf, 0,
1778 					   size - MXT_INFO_CHECKSUM_SIZE);
1779 
1780 	/*
1781 	 * CRC mismatch can be caused by data corruption due to I2C comms
1782 	 * issue or else device is not using Object Based Protocol (eg i2c-hid)
1783 	 */
1784 	if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
1785 		dev_err(&client->dev,
1786 			"Info Block CRC error calculated=0x%06X read=0x%06X\n",
1787 			calculated_crc, data->info_crc);
1788 		error = -EIO;
1789 		goto err_free_mem;
1790 	}
1791 
1792 	data->raw_info_block = id_buf;
1793 	data->info = (struct mxt_info *)id_buf;
1794 
1795 	dev_info(&client->dev,
1796 		 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
1797 		 data->info->family_id, data->info->variant_id,
1798 		 data->info->version >> 4, data->info->version & 0xf,
1799 		 data->info->build, data->info->object_num);
1800 
1801 	/* Parse object table information */
1802 	error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
1803 	if (error) {
1804 		dev_err(&client->dev, "Error %d parsing object table\n", error);
1805 		mxt_free_object_table(data);
1806 		goto err_free_mem;
1807 	}
1808 
1809 	data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
1810 
1811 	return 0;
1812 
1813 err_free_mem:
1814 	kfree(id_buf);
1815 	return error;
1816 }
1817 
1818 static int mxt_read_t9_resolution(struct mxt_data *data)
1819 {
1820 	struct i2c_client *client = data->client;
1821 	int error;
1822 	struct t9_range range;
1823 	unsigned char orient;
1824 	struct mxt_object *object;
1825 
1826 	object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1827 	if (!object)
1828 		return -EINVAL;
1829 
1830 	error = __mxt_read_reg(client,
1831 			       object->start_address + MXT_T9_XSIZE,
1832 			       sizeof(data->xsize), &data->xsize);
1833 	if (error)
1834 		return error;
1835 
1836 	error = __mxt_read_reg(client,
1837 			       object->start_address + MXT_T9_YSIZE,
1838 			       sizeof(data->ysize), &data->ysize);
1839 	if (error)
1840 		return error;
1841 
1842 	error = __mxt_read_reg(client,
1843 			       object->start_address + MXT_T9_RANGE,
1844 			       sizeof(range), &range);
1845 	if (error)
1846 		return error;
1847 
1848 	data->max_x = get_unaligned_le16(&range.x);
1849 	data->max_y = get_unaligned_le16(&range.y);
1850 
1851 	error =  __mxt_read_reg(client,
1852 				object->start_address + MXT_T9_ORIENT,
1853 				1, &orient);
1854 	if (error)
1855 		return error;
1856 
1857 	data->xy_switch = orient & MXT_T9_ORIENT_SWITCH;
1858 	data->invertx = orient & MXT_T9_ORIENT_INVERTX;
1859 	data->inverty = orient & MXT_T9_ORIENT_INVERTY;
1860 
1861 	return 0;
1862 }
1863 
1864 static int mxt_read_t100_config(struct mxt_data *data)
1865 {
1866 	struct i2c_client *client = data->client;
1867 	int error;
1868 	struct mxt_object *object;
1869 	u16 range_x, range_y;
1870 	u8 cfg, tchaux;
1871 	u8 aux;
1872 
1873 	object = mxt_get_object(data, MXT_TOUCH_MULTITOUCHSCREEN_T100);
1874 	if (!object)
1875 		return -EINVAL;
1876 
1877 	/* read touchscreen dimensions */
1878 	error = __mxt_read_reg(client,
1879 			       object->start_address + MXT_T100_XRANGE,
1880 			       sizeof(range_x), &range_x);
1881 	if (error)
1882 		return error;
1883 
1884 	data->max_x = get_unaligned_le16(&range_x);
1885 
1886 	error = __mxt_read_reg(client,
1887 			       object->start_address + MXT_T100_YRANGE,
1888 			       sizeof(range_y), &range_y);
1889 	if (error)
1890 		return error;
1891 
1892 	data->max_y = get_unaligned_le16(&range_y);
1893 
1894 	error = __mxt_read_reg(client,
1895 			       object->start_address + MXT_T100_XSIZE,
1896 			       sizeof(data->xsize), &data->xsize);
1897 	if (error)
1898 		return error;
1899 
1900 	error = __mxt_read_reg(client,
1901 			       object->start_address + MXT_T100_YSIZE,
1902 			       sizeof(data->ysize), &data->ysize);
1903 	if (error)
1904 		return error;
1905 
1906 	/* read orientation config */
1907 	error =  __mxt_read_reg(client,
1908 				object->start_address + MXT_T100_CFG1,
1909 				1, &cfg);
1910 	if (error)
1911 		return error;
1912 
1913 	data->xy_switch = cfg & MXT_T100_CFG_SWITCHXY;
1914 	data->invertx = cfg & MXT_T100_CFG_INVERTX;
1915 	data->inverty = cfg & MXT_T100_CFG_INVERTY;
1916 
1917 	/* allocate aux bytes */
1918 	error =  __mxt_read_reg(client,
1919 				object->start_address + MXT_T100_TCHAUX,
1920 				1, &tchaux);
1921 	if (error)
1922 		return error;
1923 
1924 	aux = 6;
1925 
1926 	if (tchaux & MXT_T100_TCHAUX_VECT)
1927 		data->t100_aux_vect = aux++;
1928 
1929 	if (tchaux & MXT_T100_TCHAUX_AMPL)
1930 		data->t100_aux_ampl = aux++;
1931 
1932 	if (tchaux & MXT_T100_TCHAUX_AREA)
1933 		data->t100_aux_area = aux++;
1934 
1935 	dev_dbg(&client->dev,
1936 		"T100 aux mappings vect:%u ampl:%u area:%u\n",
1937 		data->t100_aux_vect, data->t100_aux_ampl, data->t100_aux_area);
1938 
1939 	return 0;
1940 }
1941 
1942 static int mxt_input_open(struct input_dev *dev);
1943 static void mxt_input_close(struct input_dev *dev);
1944 
1945 static void mxt_set_up_as_touchpad(struct input_dev *input_dev,
1946 				   struct mxt_data *data)
1947 {
1948 	int i;
1949 
1950 	input_dev->name = "Atmel maXTouch Touchpad";
1951 
1952 	__set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1953 
1954 	input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1955 	input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1956 	input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1957 			  MXT_PIXELS_PER_MM);
1958 	input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1959 			  MXT_PIXELS_PER_MM);
1960 
1961 	for (i = 0; i < data->t19_num_keys; i++)
1962 		if (data->t19_keymap[i] != KEY_RESERVED)
1963 			input_set_capability(input_dev, EV_KEY,
1964 					     data->t19_keymap[i]);
1965 }
1966 
1967 static int mxt_initialize_input_device(struct mxt_data *data)
1968 {
1969 	struct device *dev = &data->client->dev;
1970 	struct input_dev *input_dev;
1971 	int error;
1972 	unsigned int num_mt_slots;
1973 	unsigned int mt_flags = 0;
1974 
1975 	switch (data->multitouch) {
1976 	case MXT_TOUCH_MULTI_T9:
1977 		num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
1978 		error = mxt_read_t9_resolution(data);
1979 		if (error)
1980 			dev_warn(dev, "Failed to initialize T9 resolution\n");
1981 		break;
1982 
1983 	case MXT_TOUCH_MULTITOUCHSCREEN_T100:
1984 		num_mt_slots = data->num_touchids;
1985 		error = mxt_read_t100_config(data);
1986 		if (error)
1987 			dev_warn(dev, "Failed to read T100 config\n");
1988 		break;
1989 
1990 	default:
1991 		dev_err(dev, "Invalid multitouch object\n");
1992 		return -EINVAL;
1993 	}
1994 
1995 	/* Handle default values and orientation switch */
1996 	if (data->max_x == 0)
1997 		data->max_x = 1023;
1998 
1999 	if (data->max_y == 0)
2000 		data->max_y = 1023;
2001 
2002 	if (data->xy_switch)
2003 		swap(data->max_x, data->max_y);
2004 
2005 	dev_info(dev, "Touchscreen size X%uY%u\n", data->max_x, data->max_y);
2006 
2007 	/* Register input device */
2008 	input_dev = input_allocate_device();
2009 	if (!input_dev)
2010 		return -ENOMEM;
2011 
2012 	input_dev->name = "Atmel maXTouch Touchscreen";
2013 	input_dev->phys = data->phys;
2014 	input_dev->id.bustype = BUS_I2C;
2015 	input_dev->dev.parent = dev;
2016 	input_dev->open = mxt_input_open;
2017 	input_dev->close = mxt_input_close;
2018 
2019 	input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
2020 
2021 	/* For single touch */
2022 	input_set_abs_params(input_dev, ABS_X, 0, data->max_x, 0, 0);
2023 	input_set_abs_params(input_dev, ABS_Y, 0, data->max_y, 0, 0);
2024 
2025 	if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2026 	    (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2027 	     data->t100_aux_ampl)) {
2028 		input_set_abs_params(input_dev, ABS_PRESSURE, 0, 255, 0, 0);
2029 	}
2030 
2031 	/* If device has buttons we assume it is a touchpad */
2032 	if (data->t19_num_keys) {
2033 		mxt_set_up_as_touchpad(input_dev, data);
2034 		mt_flags |= INPUT_MT_POINTER;
2035 	} else {
2036 		mt_flags |= INPUT_MT_DIRECT;
2037 	}
2038 
2039 	/* For multi touch */
2040 	error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
2041 	if (error) {
2042 		dev_err(dev, "Error %d initialising slots\n", error);
2043 		goto err_free_mem;
2044 	}
2045 
2046 	if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100) {
2047 		input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
2048 				     0, MT_TOOL_MAX, 0, 0);
2049 		input_set_abs_params(input_dev, ABS_MT_DISTANCE,
2050 				     MXT_DISTANCE_ACTIVE_TOUCH,
2051 				     MXT_DISTANCE_HOVERING,
2052 				     0, 0);
2053 	}
2054 
2055 	input_set_abs_params(input_dev, ABS_MT_POSITION_X,
2056 			     0, data->max_x, 0, 0);
2057 	input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
2058 			     0, data->max_y, 0, 0);
2059 
2060 	if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2061 	    (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2062 	     data->t100_aux_area)) {
2063 		input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
2064 				     0, MXT_MAX_AREA, 0, 0);
2065 	}
2066 
2067 	if (data->multitouch == MXT_TOUCH_MULTI_T9 ||
2068 	    (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2069 	     data->t100_aux_ampl)) {
2070 		input_set_abs_params(input_dev, ABS_MT_PRESSURE,
2071 				     0, 255, 0, 0);
2072 	}
2073 
2074 	if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2075 	    data->t100_aux_vect) {
2076 		input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2077 				     0, 255, 0, 0);
2078 	}
2079 
2080 	if (data->multitouch == MXT_TOUCH_MULTITOUCHSCREEN_T100 &&
2081 	    data->t100_aux_vect) {
2082 		input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
2083 				     0, 255, 0, 0);
2084 	}
2085 
2086 	input_set_drvdata(input_dev, data);
2087 
2088 	error = input_register_device(input_dev);
2089 	if (error) {
2090 		dev_err(dev, "Error %d registering input device\n", error);
2091 		goto err_free_mem;
2092 	}
2093 
2094 	data->input_dev = input_dev;
2095 
2096 	return 0;
2097 
2098 err_free_mem:
2099 	input_free_device(input_dev);
2100 	return error;
2101 }
2102 
2103 static int mxt_configure_objects(struct mxt_data *data,
2104 				 const struct firmware *cfg);
2105 
2106 static void mxt_config_cb(const struct firmware *cfg, void *ctx)
2107 {
2108 	mxt_configure_objects(ctx, cfg);
2109 	release_firmware(cfg);
2110 }
2111 
2112 static int mxt_initialize(struct mxt_data *data)
2113 {
2114 	struct i2c_client *client = data->client;
2115 	int recovery_attempts = 0;
2116 	int error;
2117 
2118 	while (1) {
2119 		error = mxt_read_info_block(data);
2120 		if (!error)
2121 			break;
2122 
2123 		/* Check bootloader state */
2124 		error = mxt_probe_bootloader(data, false);
2125 		if (error) {
2126 			dev_info(&client->dev, "Trying alternate bootloader address\n");
2127 			error = mxt_probe_bootloader(data, true);
2128 			if (error) {
2129 				/* Chip is not in appmode or bootloader mode */
2130 				return error;
2131 			}
2132 		}
2133 
2134 		/* OK, we are in bootloader, see if we can recover */
2135 		if (++recovery_attempts > 1) {
2136 			dev_err(&client->dev, "Could not recover from bootloader mode\n");
2137 			/*
2138 			 * We can reflash from this state, so do not
2139 			 * abort initialization.
2140 			 */
2141 			data->in_bootloader = true;
2142 			return 0;
2143 		}
2144 
2145 		/* Attempt to exit bootloader into app mode */
2146 		mxt_send_bootloader_cmd(data, false);
2147 		msleep(MXT_FW_RESET_TIME);
2148 	}
2149 
2150 	error = mxt_acquire_irq(data);
2151 	if (error)
2152 		return error;
2153 
2154 	error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
2155 					&client->dev, GFP_KERNEL, data,
2156 					mxt_config_cb);
2157 	if (error) {
2158 		dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
2159 			error);
2160 		return error;
2161 	}
2162 
2163 	return 0;
2164 }
2165 
2166 static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
2167 {
2168 	struct device *dev = &data->client->dev;
2169 	int error;
2170 	struct t7_config *new_config;
2171 	struct t7_config deepsleep = { .active = 0, .idle = 0 };
2172 
2173 	if (sleep == MXT_POWER_CFG_DEEPSLEEP)
2174 		new_config = &deepsleep;
2175 	else
2176 		new_config = &data->t7_cfg;
2177 
2178 	error = __mxt_write_reg(data->client, data->T7_address,
2179 				sizeof(data->t7_cfg), new_config);
2180 	if (error)
2181 		return error;
2182 
2183 	dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
2184 		new_config->active, new_config->idle);
2185 
2186 	return 0;
2187 }
2188 
2189 static int mxt_init_t7_power_cfg(struct mxt_data *data)
2190 {
2191 	struct device *dev = &data->client->dev;
2192 	int error;
2193 	bool retry = false;
2194 
2195 recheck:
2196 	error = __mxt_read_reg(data->client, data->T7_address,
2197 				sizeof(data->t7_cfg), &data->t7_cfg);
2198 	if (error)
2199 		return error;
2200 
2201 	if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
2202 		if (!retry) {
2203 			dev_dbg(dev, "T7 cfg zero, resetting\n");
2204 			mxt_soft_reset(data);
2205 			retry = true;
2206 			goto recheck;
2207 		} else {
2208 			dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
2209 			data->t7_cfg.active = 20;
2210 			data->t7_cfg.idle = 100;
2211 			return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2212 		}
2213 	}
2214 
2215 	dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
2216 		data->t7_cfg.active, data->t7_cfg.idle);
2217 	return 0;
2218 }
2219 
2220 #ifdef CONFIG_TOUCHSCREEN_ATMEL_MXT_T37
2221 static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
2222 			       unsigned int y)
2223 {
2224 	struct mxt_info *info = data->info;
2225 	struct mxt_dbg *dbg = &data->dbg;
2226 	unsigned int ofs, page;
2227 	unsigned int col = 0;
2228 	unsigned int col_width;
2229 
2230 	if (info->family_id == MXT_FAMILY_1386) {
2231 		col_width = info->matrix_ysize / MXT1386_COLUMNS;
2232 		col = y / col_width;
2233 		y = y % col_width;
2234 	} else {
2235 		col_width = info->matrix_ysize;
2236 	}
2237 
2238 	ofs = (y + (x * col_width)) * sizeof(u16);
2239 	page = ofs / MXT_DIAGNOSTIC_SIZE;
2240 	ofs %= MXT_DIAGNOSTIC_SIZE;
2241 
2242 	if (info->family_id == MXT_FAMILY_1386)
2243 		page += col * MXT1386_PAGES_PER_COLUMN;
2244 
2245 	return get_unaligned_le16(&dbg->t37_buf[page].data[ofs]);
2246 }
2247 
2248 static int mxt_convert_debug_pages(struct mxt_data *data, u16 *outbuf)
2249 {
2250 	struct mxt_dbg *dbg = &data->dbg;
2251 	unsigned int x = 0;
2252 	unsigned int y = 0;
2253 	unsigned int i, rx, ry;
2254 
2255 	for (i = 0; i < dbg->t37_nodes; i++) {
2256 		/* Handle orientation */
2257 		rx = data->xy_switch ? y : x;
2258 		ry = data->xy_switch ? x : y;
2259 		rx = data->invertx ? (data->xsize - 1 - rx) : rx;
2260 		ry = data->inverty ? (data->ysize - 1 - ry) : ry;
2261 
2262 		outbuf[i] = mxt_get_debug_value(data, rx, ry);
2263 
2264 		/* Next value */
2265 		if (++x >= (data->xy_switch ? data->ysize : data->xsize)) {
2266 			x = 0;
2267 			y++;
2268 		}
2269 	}
2270 
2271 	return 0;
2272 }
2273 
2274 static int mxt_read_diagnostic_debug(struct mxt_data *data, u8 mode,
2275 				     u16 *outbuf)
2276 {
2277 	struct mxt_dbg *dbg = &data->dbg;
2278 	int retries = 0;
2279 	int page;
2280 	int ret;
2281 	u8 cmd = mode;
2282 	struct t37_debug *p;
2283 	u8 cmd_poll;
2284 
2285 	for (page = 0; page < dbg->t37_pages; page++) {
2286 		p = dbg->t37_buf + page;
2287 
2288 		ret = mxt_write_reg(data->client, dbg->diag_cmd_address,
2289 				    cmd);
2290 		if (ret)
2291 			return ret;
2292 
2293 		retries = 0;
2294 		msleep(20);
2295 wait_cmd:
2296 		/* Read back command byte */
2297 		ret = __mxt_read_reg(data->client, dbg->diag_cmd_address,
2298 				     sizeof(cmd_poll), &cmd_poll);
2299 		if (ret)
2300 			return ret;
2301 
2302 		/* Field is cleared once the command has been processed */
2303 		if (cmd_poll) {
2304 			if (retries++ > 100)
2305 				return -EINVAL;
2306 
2307 			msleep(20);
2308 			goto wait_cmd;
2309 		}
2310 
2311 		/* Read T37 page */
2312 		ret = __mxt_read_reg(data->client, dbg->t37_address,
2313 				     sizeof(struct t37_debug), p);
2314 		if (ret)
2315 			return ret;
2316 
2317 		if (p->mode != mode || p->page != page) {
2318 			dev_err(&data->client->dev, "T37 page mismatch\n");
2319 			return -EINVAL;
2320 		}
2321 
2322 		dev_dbg(&data->client->dev, "%s page:%d retries:%d\n",
2323 			__func__, page, retries);
2324 
2325 		/* For remaining pages, write PAGEUP rather than mode */
2326 		cmd = MXT_DIAGNOSTIC_PAGEUP;
2327 	}
2328 
2329 	return mxt_convert_debug_pages(data, outbuf);
2330 }
2331 
2332 static int mxt_queue_setup(struct vb2_queue *q,
2333 		       unsigned int *nbuffers, unsigned int *nplanes,
2334 		       unsigned int sizes[], struct device *alloc_devs[])
2335 {
2336 	struct mxt_data *data = q->drv_priv;
2337 	size_t size = data->dbg.t37_nodes * sizeof(u16);
2338 
2339 	if (*nplanes)
2340 		return sizes[0] < size ? -EINVAL : 0;
2341 
2342 	*nplanes = 1;
2343 	sizes[0] = size;
2344 
2345 	return 0;
2346 }
2347 
2348 static void mxt_buffer_queue(struct vb2_buffer *vb)
2349 {
2350 	struct mxt_data *data = vb2_get_drv_priv(vb->vb2_queue);
2351 	u16 *ptr;
2352 	int ret;
2353 	u8 mode;
2354 
2355 	ptr = vb2_plane_vaddr(vb, 0);
2356 	if (!ptr) {
2357 		dev_err(&data->client->dev, "Error acquiring frame ptr\n");
2358 		goto fault;
2359 	}
2360 
2361 	switch (data->dbg.input) {
2362 	case MXT_V4L_INPUT_DELTAS:
2363 	default:
2364 		mode = MXT_DIAGNOSTIC_DELTAS;
2365 		break;
2366 
2367 	case MXT_V4L_INPUT_REFS:
2368 		mode = MXT_DIAGNOSTIC_REFS;
2369 		break;
2370 	}
2371 
2372 	ret = mxt_read_diagnostic_debug(data, mode, ptr);
2373 	if (ret)
2374 		goto fault;
2375 
2376 	vb2_set_plane_payload(vb, 0, data->dbg.t37_nodes * sizeof(u16));
2377 	vb2_buffer_done(vb, VB2_BUF_STATE_DONE);
2378 	return;
2379 
2380 fault:
2381 	vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
2382 }
2383 
2384 /* V4L2 structures */
2385 static const struct vb2_ops mxt_queue_ops = {
2386 	.queue_setup		= mxt_queue_setup,
2387 	.buf_queue		= mxt_buffer_queue,
2388 	.wait_prepare		= vb2_ops_wait_prepare,
2389 	.wait_finish		= vb2_ops_wait_finish,
2390 };
2391 
2392 static const struct vb2_queue mxt_queue = {
2393 	.type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
2394 	.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
2395 	.buf_struct_size = sizeof(struct mxt_vb2_buffer),
2396 	.ops = &mxt_queue_ops,
2397 	.mem_ops = &vb2_vmalloc_memops,
2398 	.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
2399 	.min_buffers_needed = 1,
2400 };
2401 
2402 static int mxt_vidioc_querycap(struct file *file, void *priv,
2403 				 struct v4l2_capability *cap)
2404 {
2405 	struct mxt_data *data = video_drvdata(file);
2406 
2407 	strlcpy(cap->driver, "atmel_mxt_ts", sizeof(cap->driver));
2408 	strlcpy(cap->card, "atmel_mxt_ts touch", sizeof(cap->card));
2409 	snprintf(cap->bus_info, sizeof(cap->bus_info),
2410 		 "I2C:%s", dev_name(&data->client->dev));
2411 	return 0;
2412 }
2413 
2414 static int mxt_vidioc_enum_input(struct file *file, void *priv,
2415 				   struct v4l2_input *i)
2416 {
2417 	if (i->index >= MXT_V4L_INPUT_MAX)
2418 		return -EINVAL;
2419 
2420 	i->type = V4L2_INPUT_TYPE_TOUCH;
2421 
2422 	switch (i->index) {
2423 	case MXT_V4L_INPUT_REFS:
2424 		strlcpy(i->name, "Mutual Capacitance References",
2425 			sizeof(i->name));
2426 		break;
2427 	case MXT_V4L_INPUT_DELTAS:
2428 		strlcpy(i->name, "Mutual Capacitance Deltas", sizeof(i->name));
2429 		break;
2430 	}
2431 
2432 	return 0;
2433 }
2434 
2435 static int mxt_set_input(struct mxt_data *data, unsigned int i)
2436 {
2437 	struct v4l2_pix_format *f = &data->dbg.format;
2438 
2439 	if (i >= MXT_V4L_INPUT_MAX)
2440 		return -EINVAL;
2441 
2442 	if (i == MXT_V4L_INPUT_DELTAS)
2443 		f->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2444 	else
2445 		f->pixelformat = V4L2_TCH_FMT_TU16;
2446 
2447 	f->width = data->xy_switch ? data->ysize : data->xsize;
2448 	f->height = data->xy_switch ? data->xsize : data->ysize;
2449 	f->field = V4L2_FIELD_NONE;
2450 	f->colorspace = V4L2_COLORSPACE_RAW;
2451 	f->bytesperline = f->width * sizeof(u16);
2452 	f->sizeimage = f->width * f->height * sizeof(u16);
2453 
2454 	data->dbg.input = i;
2455 
2456 	return 0;
2457 }
2458 
2459 static int mxt_vidioc_s_input(struct file *file, void *priv, unsigned int i)
2460 {
2461 	return mxt_set_input(video_drvdata(file), i);
2462 }
2463 
2464 static int mxt_vidioc_g_input(struct file *file, void *priv, unsigned int *i)
2465 {
2466 	struct mxt_data *data = video_drvdata(file);
2467 
2468 	*i = data->dbg.input;
2469 
2470 	return 0;
2471 }
2472 
2473 static int mxt_vidioc_fmt(struct file *file, void *priv, struct v4l2_format *f)
2474 {
2475 	struct mxt_data *data = video_drvdata(file);
2476 
2477 	f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
2478 	f->fmt.pix = data->dbg.format;
2479 
2480 	return 0;
2481 }
2482 
2483 static int mxt_vidioc_enum_fmt(struct file *file, void *priv,
2484 				 struct v4l2_fmtdesc *fmt)
2485 {
2486 	if (fmt->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2487 		return -EINVAL;
2488 
2489 	switch (fmt->index) {
2490 	case 0:
2491 		fmt->pixelformat = V4L2_TCH_FMT_TU16;
2492 		break;
2493 
2494 	case 1:
2495 		fmt->pixelformat = V4L2_TCH_FMT_DELTA_TD16;
2496 		break;
2497 
2498 	default:
2499 		return -EINVAL;
2500 	}
2501 
2502 	return 0;
2503 }
2504 
2505 static int mxt_vidioc_g_parm(struct file *file, void *fh,
2506 			     struct v4l2_streamparm *a)
2507 {
2508 	if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
2509 		return -EINVAL;
2510 
2511 	a->parm.capture.readbuffers = 1;
2512 	a->parm.capture.timeperframe.numerator = 1;
2513 	a->parm.capture.timeperframe.denominator = 10;
2514 	return 0;
2515 }
2516 
2517 static const struct v4l2_ioctl_ops mxt_video_ioctl_ops = {
2518 	.vidioc_querycap        = mxt_vidioc_querycap,
2519 
2520 	.vidioc_enum_fmt_vid_cap = mxt_vidioc_enum_fmt,
2521 	.vidioc_s_fmt_vid_cap   = mxt_vidioc_fmt,
2522 	.vidioc_g_fmt_vid_cap   = mxt_vidioc_fmt,
2523 	.vidioc_try_fmt_vid_cap	= mxt_vidioc_fmt,
2524 	.vidioc_g_parm		= mxt_vidioc_g_parm,
2525 
2526 	.vidioc_enum_input      = mxt_vidioc_enum_input,
2527 	.vidioc_g_input         = mxt_vidioc_g_input,
2528 	.vidioc_s_input         = mxt_vidioc_s_input,
2529 
2530 	.vidioc_reqbufs         = vb2_ioctl_reqbufs,
2531 	.vidioc_create_bufs     = vb2_ioctl_create_bufs,
2532 	.vidioc_querybuf        = vb2_ioctl_querybuf,
2533 	.vidioc_qbuf            = vb2_ioctl_qbuf,
2534 	.vidioc_dqbuf           = vb2_ioctl_dqbuf,
2535 	.vidioc_expbuf          = vb2_ioctl_expbuf,
2536 
2537 	.vidioc_streamon        = vb2_ioctl_streamon,
2538 	.vidioc_streamoff       = vb2_ioctl_streamoff,
2539 };
2540 
2541 static const struct video_device mxt_video_device = {
2542 	.name = "Atmel maxTouch",
2543 	.fops = &mxt_video_fops,
2544 	.ioctl_ops = &mxt_video_ioctl_ops,
2545 	.release = video_device_release_empty,
2546 	.device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TOUCH |
2547 		       V4L2_CAP_READWRITE | V4L2_CAP_STREAMING,
2548 };
2549 
2550 static void mxt_debug_init(struct mxt_data *data)
2551 {
2552 	struct mxt_info *info = data->info;
2553 	struct mxt_dbg *dbg = &data->dbg;
2554 	struct mxt_object *object;
2555 	int error;
2556 
2557 	object = mxt_get_object(data, MXT_GEN_COMMAND_T6);
2558 	if (!object)
2559 		goto error;
2560 
2561 	dbg->diag_cmd_address = object->start_address + MXT_COMMAND_DIAGNOSTIC;
2562 
2563 	object = mxt_get_object(data, MXT_DEBUG_DIAGNOSTIC_T37);
2564 	if (!object)
2565 		goto error;
2566 
2567 	if (mxt_obj_size(object) != sizeof(struct t37_debug)) {
2568 		dev_warn(&data->client->dev, "Bad T37 size");
2569 		goto error;
2570 	}
2571 
2572 	dbg->t37_address = object->start_address;
2573 
2574 	/* Calculate size of data and allocate buffer */
2575 	dbg->t37_nodes = data->xsize * data->ysize;
2576 
2577 	if (info->family_id == MXT_FAMILY_1386)
2578 		dbg->t37_pages = MXT1386_COLUMNS * MXT1386_PAGES_PER_COLUMN;
2579 	else
2580 		dbg->t37_pages = DIV_ROUND_UP(data->xsize *
2581 					      info->matrix_ysize *
2582 					      sizeof(u16),
2583 					      sizeof(dbg->t37_buf->data));
2584 
2585 	dbg->t37_buf = devm_kmalloc_array(&data->client->dev, dbg->t37_pages,
2586 					  sizeof(struct t37_debug), GFP_KERNEL);
2587 	if (!dbg->t37_buf)
2588 		goto error;
2589 
2590 	/* init channel to zero */
2591 	mxt_set_input(data, 0);
2592 
2593 	/* register video device */
2594 	snprintf(dbg->v4l2.name, sizeof(dbg->v4l2.name), "%s", "atmel_mxt_ts");
2595 	error = v4l2_device_register(&data->client->dev, &dbg->v4l2);
2596 	if (error)
2597 		goto error;
2598 
2599 	/* initialize the queue */
2600 	mutex_init(&dbg->lock);
2601 	dbg->queue = mxt_queue;
2602 	dbg->queue.drv_priv = data;
2603 	dbg->queue.lock = &dbg->lock;
2604 	dbg->queue.dev = &data->client->dev;
2605 
2606 	error = vb2_queue_init(&dbg->queue);
2607 	if (error)
2608 		goto error_unreg_v4l2;
2609 
2610 	dbg->vdev = mxt_video_device;
2611 	dbg->vdev.v4l2_dev = &dbg->v4l2;
2612 	dbg->vdev.lock = &dbg->lock;
2613 	dbg->vdev.vfl_dir = VFL_DIR_RX;
2614 	dbg->vdev.queue = &dbg->queue;
2615 	video_set_drvdata(&dbg->vdev, data);
2616 
2617 	error = video_register_device(&dbg->vdev, VFL_TYPE_TOUCH, -1);
2618 	if (error)
2619 		goto error_unreg_v4l2;
2620 
2621 	return;
2622 
2623 error_unreg_v4l2:
2624 	v4l2_device_unregister(&dbg->v4l2);
2625 error:
2626 	dev_warn(&data->client->dev, "Error initializing T37\n");
2627 }
2628 #else
2629 static void mxt_debug_init(struct mxt_data *data)
2630 {
2631 }
2632 #endif
2633 
2634 static int mxt_configure_objects(struct mxt_data *data,
2635 				 const struct firmware *cfg)
2636 {
2637 	struct device *dev = &data->client->dev;
2638 	int error;
2639 
2640 	error = mxt_init_t7_power_cfg(data);
2641 	if (error) {
2642 		dev_err(dev, "Failed to initialize power cfg\n");
2643 		return error;
2644 	}
2645 
2646 	if (cfg) {
2647 		error = mxt_update_cfg(data, cfg);
2648 		if (error)
2649 			dev_warn(dev, "Error %d updating config\n", error);
2650 	}
2651 
2652 	if (data->multitouch) {
2653 		error = mxt_initialize_input_device(data);
2654 		if (error)
2655 			return error;
2656 	} else {
2657 		dev_warn(dev, "No touch object detected\n");
2658 	}
2659 
2660 	mxt_debug_init(data);
2661 
2662 	return 0;
2663 }
2664 
2665 /* Firmware Version is returned as Major.Minor.Build */
2666 static ssize_t mxt_fw_version_show(struct device *dev,
2667 				   struct device_attribute *attr, char *buf)
2668 {
2669 	struct mxt_data *data = dev_get_drvdata(dev);
2670 	struct mxt_info *info = data->info;
2671 	return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
2672 			 info->version >> 4, info->version & 0xf, info->build);
2673 }
2674 
2675 /* Hardware Version is returned as FamilyID.VariantID */
2676 static ssize_t mxt_hw_version_show(struct device *dev,
2677 				   struct device_attribute *attr, char *buf)
2678 {
2679 	struct mxt_data *data = dev_get_drvdata(dev);
2680 	struct mxt_info *info = data->info;
2681 	return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
2682 			 info->family_id, info->variant_id);
2683 }
2684 
2685 static ssize_t mxt_show_instance(char *buf, int count,
2686 				 struct mxt_object *object, int instance,
2687 				 const u8 *val)
2688 {
2689 	int i;
2690 
2691 	if (mxt_obj_instances(object) > 1)
2692 		count += scnprintf(buf + count, PAGE_SIZE - count,
2693 				   "Instance %u\n", instance);
2694 
2695 	for (i = 0; i < mxt_obj_size(object); i++)
2696 		count += scnprintf(buf + count, PAGE_SIZE - count,
2697 				"\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
2698 	count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
2699 
2700 	return count;
2701 }
2702 
2703 static ssize_t mxt_object_show(struct device *dev,
2704 				    struct device_attribute *attr, char *buf)
2705 {
2706 	struct mxt_data *data = dev_get_drvdata(dev);
2707 	struct mxt_object *object;
2708 	int count = 0;
2709 	int i, j;
2710 	int error;
2711 	u8 *obuf;
2712 
2713 	/* Pre-allocate buffer large enough to hold max sized object. */
2714 	obuf = kmalloc(256, GFP_KERNEL);
2715 	if (!obuf)
2716 		return -ENOMEM;
2717 
2718 	error = 0;
2719 	for (i = 0; i < data->info->object_num; i++) {
2720 		object = data->object_table + i;
2721 
2722 		if (!mxt_object_readable(object->type))
2723 			continue;
2724 
2725 		count += scnprintf(buf + count, PAGE_SIZE - count,
2726 				"T%u:\n", object->type);
2727 
2728 		for (j = 0; j < mxt_obj_instances(object); j++) {
2729 			u16 size = mxt_obj_size(object);
2730 			u16 addr = object->start_address + j * size;
2731 
2732 			error = __mxt_read_reg(data->client, addr, size, obuf);
2733 			if (error)
2734 				goto done;
2735 
2736 			count = mxt_show_instance(buf, count, object, j, obuf);
2737 		}
2738 	}
2739 
2740 done:
2741 	kfree(obuf);
2742 	return error ?: count;
2743 }
2744 
2745 static int mxt_check_firmware_format(struct device *dev,
2746 				     const struct firmware *fw)
2747 {
2748 	unsigned int pos = 0;
2749 	char c;
2750 
2751 	while (pos < fw->size) {
2752 		c = *(fw->data + pos);
2753 
2754 		if (c < '0' || (c > '9' && c < 'A') || c > 'F')
2755 			return 0;
2756 
2757 		pos++;
2758 	}
2759 
2760 	/*
2761 	 * To convert file try:
2762 	 * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
2763 	 */
2764 	dev_err(dev, "Aborting: firmware file must be in binary format\n");
2765 
2766 	return -EINVAL;
2767 }
2768 
2769 static int mxt_load_fw(struct device *dev, const char *fn)
2770 {
2771 	struct mxt_data *data = dev_get_drvdata(dev);
2772 	const struct firmware *fw = NULL;
2773 	unsigned int frame_size;
2774 	unsigned int pos = 0;
2775 	unsigned int retry = 0;
2776 	unsigned int frame = 0;
2777 	int ret;
2778 
2779 	ret = request_firmware(&fw, fn, dev);
2780 	if (ret) {
2781 		dev_err(dev, "Unable to open firmware %s\n", fn);
2782 		return ret;
2783 	}
2784 
2785 	/* Check for incorrect enc file */
2786 	ret = mxt_check_firmware_format(dev, fw);
2787 	if (ret)
2788 		goto release_firmware;
2789 
2790 	if (!data->in_bootloader) {
2791 		/* Change to the bootloader mode */
2792 		data->in_bootloader = true;
2793 
2794 		ret = mxt_t6_command(data, MXT_COMMAND_RESET,
2795 				     MXT_BOOT_VALUE, false);
2796 		if (ret)
2797 			goto release_firmware;
2798 
2799 		msleep(MXT_RESET_TIME);
2800 
2801 		/* Do not need to scan since we know family ID */
2802 		ret = mxt_lookup_bootloader_address(data, 0);
2803 		if (ret)
2804 			goto release_firmware;
2805 
2806 		mxt_free_input_device(data);
2807 		mxt_free_object_table(data);
2808 	} else {
2809 		enable_irq(data->irq);
2810 	}
2811 
2812 	reinit_completion(&data->bl_completion);
2813 
2814 	ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
2815 	if (ret) {
2816 		/* Bootloader may still be unlocked from previous attempt */
2817 		ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
2818 		if (ret)
2819 			goto disable_irq;
2820 	} else {
2821 		dev_info(dev, "Unlocking bootloader\n");
2822 
2823 		/* Unlock bootloader */
2824 		ret = mxt_send_bootloader_cmd(data, true);
2825 		if (ret)
2826 			goto disable_irq;
2827 	}
2828 
2829 	while (pos < fw->size) {
2830 		ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
2831 		if (ret)
2832 			goto disable_irq;
2833 
2834 		frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
2835 
2836 		/* Take account of CRC bytes */
2837 		frame_size += 2;
2838 
2839 		/* Write one frame to device */
2840 		ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
2841 		if (ret)
2842 			goto disable_irq;
2843 
2844 		ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
2845 		if (ret) {
2846 			retry++;
2847 
2848 			/* Back off by 20ms per retry */
2849 			msleep(retry * 20);
2850 
2851 			if (retry > 20) {
2852 				dev_err(dev, "Retry count exceeded\n");
2853 				goto disable_irq;
2854 			}
2855 		} else {
2856 			retry = 0;
2857 			pos += frame_size;
2858 			frame++;
2859 		}
2860 
2861 		if (frame % 50 == 0)
2862 			dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
2863 				frame, pos, fw->size);
2864 	}
2865 
2866 	/* Wait for flash. */
2867 	ret = mxt_wait_for_completion(data, &data->bl_completion,
2868 				      MXT_FW_RESET_TIME);
2869 	if (ret)
2870 		goto disable_irq;
2871 
2872 	dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
2873 
2874 	/*
2875 	 * Wait for device to reset. Some bootloader versions do not assert
2876 	 * the CHG line after bootloading has finished, so ignore potential
2877 	 * errors.
2878 	 */
2879 	mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
2880 
2881 	data->in_bootloader = false;
2882 
2883 disable_irq:
2884 	disable_irq(data->irq);
2885 release_firmware:
2886 	release_firmware(fw);
2887 	return ret;
2888 }
2889 
2890 static ssize_t mxt_update_fw_store(struct device *dev,
2891 					struct device_attribute *attr,
2892 					const char *buf, size_t count)
2893 {
2894 	struct mxt_data *data = dev_get_drvdata(dev);
2895 	int error;
2896 
2897 	error = mxt_load_fw(dev, MXT_FW_NAME);
2898 	if (error) {
2899 		dev_err(dev, "The firmware update failed(%d)\n", error);
2900 		count = error;
2901 	} else {
2902 		dev_info(dev, "The firmware update succeeded\n");
2903 
2904 		error = mxt_initialize(data);
2905 		if (error)
2906 			return error;
2907 	}
2908 
2909 	return count;
2910 }
2911 
2912 static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2913 static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2914 static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2915 static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2916 
2917 static struct attribute *mxt_attrs[] = {
2918 	&dev_attr_fw_version.attr,
2919 	&dev_attr_hw_version.attr,
2920 	&dev_attr_object.attr,
2921 	&dev_attr_update_fw.attr,
2922 	NULL
2923 };
2924 
2925 static const struct attribute_group mxt_attr_group = {
2926 	.attrs = mxt_attrs,
2927 };
2928 
2929 static void mxt_start(struct mxt_data *data)
2930 {
2931 	switch (data->suspend_mode) {
2932 	case MXT_SUSPEND_T9_CTRL:
2933 		mxt_soft_reset(data);
2934 
2935 		/* Touch enable */
2936 		/* 0x83 = SCANEN | RPTEN | ENABLE */
2937 		mxt_write_object(data,
2938 				MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0x83);
2939 		break;
2940 
2941 	case MXT_SUSPEND_DEEP_SLEEP:
2942 	default:
2943 		mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
2944 
2945 		/* Recalibrate since chip has been in deep sleep */
2946 		mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
2947 		break;
2948 	}
2949 }
2950 
2951 static void mxt_stop(struct mxt_data *data)
2952 {
2953 	switch (data->suspend_mode) {
2954 	case MXT_SUSPEND_T9_CTRL:
2955 		/* Touch disable */
2956 		mxt_write_object(data,
2957 				MXT_TOUCH_MULTI_T9, MXT_T9_CTRL, 0);
2958 		break;
2959 
2960 	case MXT_SUSPEND_DEEP_SLEEP:
2961 	default:
2962 		mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
2963 		break;
2964 	}
2965 }
2966 
2967 static int mxt_input_open(struct input_dev *dev)
2968 {
2969 	struct mxt_data *data = input_get_drvdata(dev);
2970 
2971 	mxt_start(data);
2972 
2973 	return 0;
2974 }
2975 
2976 static void mxt_input_close(struct input_dev *dev)
2977 {
2978 	struct mxt_data *data = input_get_drvdata(dev);
2979 
2980 	mxt_stop(data);
2981 }
2982 
2983 static int mxt_parse_device_properties(struct mxt_data *data)
2984 {
2985 	static const char keymap_property[] = "linux,gpio-keymap";
2986 	struct device *dev = &data->client->dev;
2987 	u32 *keymap;
2988 	int n_keys;
2989 	int error;
2990 
2991 	if (device_property_present(dev, keymap_property)) {
2992 		n_keys = device_property_read_u32_array(dev, keymap_property,
2993 							NULL, 0);
2994 		if (n_keys <= 0) {
2995 			error = n_keys < 0 ? n_keys : -EINVAL;
2996 			dev_err(dev, "invalid/malformed '%s' property: %d\n",
2997 				keymap_property, error);
2998 			return error;
2999 		}
3000 
3001 		keymap = devm_kmalloc_array(dev, n_keys, sizeof(*keymap),
3002 					    GFP_KERNEL);
3003 		if (!keymap)
3004 			return -ENOMEM;
3005 
3006 		error = device_property_read_u32_array(dev, keymap_property,
3007 						       keymap, n_keys);
3008 		if (error) {
3009 			dev_err(dev, "failed to parse '%s' property: %d\n",
3010 				keymap_property, error);
3011 			return error;
3012 		}
3013 
3014 		data->t19_keymap = keymap;
3015 		data->t19_num_keys = n_keys;
3016 	}
3017 
3018 	return 0;
3019 }
3020 
3021 static const struct dmi_system_id chromebook_T9_suspend_dmi[] = {
3022 	{
3023 		.matches = {
3024 			DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
3025 			DMI_MATCH(DMI_PRODUCT_NAME, "Link"),
3026 		},
3027 	},
3028 	{
3029 		.matches = {
3030 			DMI_MATCH(DMI_PRODUCT_NAME, "Peppy"),
3031 		},
3032 	},
3033 	{ }
3034 };
3035 
3036 static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
3037 {
3038 	struct mxt_data *data;
3039 	int error;
3040 
3041 	/*
3042 	 * Ignore devices that do not have device properties attached to
3043 	 * them, as we need help determining whether we are dealing with
3044 	 * touch screen or touchpad.
3045 	 *
3046 	 * So far on x86 the only users of Atmel touch controllers are
3047 	 * Chromebooks, and chromeos_laptop driver will ensure that
3048 	 * necessary properties are provided (if firmware does not do that).
3049 	 */
3050 	if (!device_property_present(&client->dev, "compatible"))
3051 		return -ENXIO;
3052 
3053 	/*
3054 	 * Ignore ACPI devices representing bootloader mode.
3055 	 *
3056 	 * This is a bit of a hack: Google Chromebook BIOS creates ACPI
3057 	 * devices for both application and bootloader modes, but we are
3058 	 * interested in application mode only (if device is in bootloader
3059 	 * mode we'll end up switching into application anyway). So far
3060 	 * application mode addresses were all above 0x40, so we'll use it
3061 	 * as a threshold.
3062 	 */
3063 	if (ACPI_COMPANION(&client->dev) && client->addr < 0x40)
3064 		return -ENXIO;
3065 
3066 	data = devm_kzalloc(&client->dev, sizeof(struct mxt_data), GFP_KERNEL);
3067 	if (!data)
3068 		return -ENOMEM;
3069 
3070 	snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
3071 		 client->adapter->nr, client->addr);
3072 
3073 	data->client = client;
3074 	data->irq = client->irq;
3075 	i2c_set_clientdata(client, data);
3076 
3077 	init_completion(&data->bl_completion);
3078 	init_completion(&data->reset_completion);
3079 	init_completion(&data->crc_completion);
3080 
3081 	data->suspend_mode = dmi_check_system(chromebook_T9_suspend_dmi) ?
3082 		MXT_SUSPEND_T9_CTRL : MXT_SUSPEND_DEEP_SLEEP;
3083 
3084 	error = mxt_parse_device_properties(data);
3085 	if (error)
3086 		return error;
3087 
3088 	data->reset_gpio = devm_gpiod_get_optional(&client->dev,
3089 						   "reset", GPIOD_OUT_LOW);
3090 	if (IS_ERR(data->reset_gpio)) {
3091 		error = PTR_ERR(data->reset_gpio);
3092 		dev_err(&client->dev, "Failed to get reset gpio: %d\n", error);
3093 		return error;
3094 	}
3095 
3096 	error = devm_request_threaded_irq(&client->dev, client->irq,
3097 					  NULL, mxt_interrupt, IRQF_ONESHOT,
3098 					  client->name, data);
3099 	if (error) {
3100 		dev_err(&client->dev, "Failed to register interrupt\n");
3101 		return error;
3102 	}
3103 
3104 	disable_irq(client->irq);
3105 
3106 	if (data->reset_gpio) {
3107 		msleep(MXT_RESET_GPIO_TIME);
3108 		gpiod_set_value(data->reset_gpio, 1);
3109 		msleep(MXT_RESET_INVALID_CHG);
3110 	}
3111 
3112 	error = mxt_initialize(data);
3113 	if (error)
3114 		return error;
3115 
3116 	error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
3117 	if (error) {
3118 		dev_err(&client->dev, "Failure %d creating sysfs group\n",
3119 			error);
3120 		goto err_free_object;
3121 	}
3122 
3123 	return 0;
3124 
3125 err_free_object:
3126 	mxt_free_input_device(data);
3127 	mxt_free_object_table(data);
3128 	return error;
3129 }
3130 
3131 static int mxt_remove(struct i2c_client *client)
3132 {
3133 	struct mxt_data *data = i2c_get_clientdata(client);
3134 
3135 	disable_irq(data->irq);
3136 	sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
3137 	mxt_free_input_device(data);
3138 	mxt_free_object_table(data);
3139 
3140 	return 0;
3141 }
3142 
3143 static int __maybe_unused mxt_suspend(struct device *dev)
3144 {
3145 	struct i2c_client *client = to_i2c_client(dev);
3146 	struct mxt_data *data = i2c_get_clientdata(client);
3147 	struct input_dev *input_dev = data->input_dev;
3148 
3149 	if (!input_dev)
3150 		return 0;
3151 
3152 	mutex_lock(&input_dev->mutex);
3153 
3154 	if (input_dev->users)
3155 		mxt_stop(data);
3156 
3157 	mutex_unlock(&input_dev->mutex);
3158 
3159 	return 0;
3160 }
3161 
3162 static int __maybe_unused mxt_resume(struct device *dev)
3163 {
3164 	struct i2c_client *client = to_i2c_client(dev);
3165 	struct mxt_data *data = i2c_get_clientdata(client);
3166 	struct input_dev *input_dev = data->input_dev;
3167 
3168 	if (!input_dev)
3169 		return 0;
3170 
3171 	mutex_lock(&input_dev->mutex);
3172 
3173 	if (input_dev->users)
3174 		mxt_start(data);
3175 
3176 	mutex_unlock(&input_dev->mutex);
3177 
3178 	return 0;
3179 }
3180 
3181 static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
3182 
3183 static const struct of_device_id mxt_of_match[] = {
3184 	{ .compatible = "atmel,maxtouch", },
3185 	/* Compatibles listed below are deprecated */
3186 	{ .compatible = "atmel,qt602240_ts", },
3187 	{ .compatible = "atmel,atmel_mxt_ts", },
3188 	{ .compatible = "atmel,atmel_mxt_tp", },
3189 	{ .compatible = "atmel,mXT224", },
3190 	{},
3191 };
3192 MODULE_DEVICE_TABLE(of, mxt_of_match);
3193 
3194 #ifdef CONFIG_ACPI
3195 static const struct acpi_device_id mxt_acpi_id[] = {
3196 	{ "ATML0000", 0 },	/* Touchpad */
3197 	{ "ATML0001", 0 },	/* Touchscreen */
3198 	{ }
3199 };
3200 MODULE_DEVICE_TABLE(acpi, mxt_acpi_id);
3201 #endif
3202 
3203 static const struct i2c_device_id mxt_id[] = {
3204 	{ "qt602240_ts", 0 },
3205 	{ "atmel_mxt_ts", 0 },
3206 	{ "atmel_mxt_tp", 0 },
3207 	{ "maxtouch", 0 },
3208 	{ "mXT224", 0 },
3209 	{ }
3210 };
3211 MODULE_DEVICE_TABLE(i2c, mxt_id);
3212 
3213 static struct i2c_driver mxt_driver = {
3214 	.driver = {
3215 		.name	= "atmel_mxt_ts",
3216 		.of_match_table = mxt_of_match,
3217 		.acpi_match_table = ACPI_PTR(mxt_acpi_id),
3218 		.pm	= &mxt_pm_ops,
3219 	},
3220 	.probe		= mxt_probe,
3221 	.remove		= mxt_remove,
3222 	.id_table	= mxt_id,
3223 };
3224 
3225 module_i2c_driver(mxt_driver);
3226 
3227 /* Module information */
3228 MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
3229 MODULE_DESCRIPTION("Atmel maXTouch Touchscreen driver");
3230 MODULE_LICENSE("GPL");
3231