xref: /linux/drivers/input/touchscreen/atmel_mxt_ts.c (revision 4949009eb8d40a441dcddcd96e101e77d31cf1b2)
1 /*
2  * Atmel maXTouch Touchscreen driver
3  *
4  * Copyright (C) 2010 Samsung Electronics Co.Ltd
5  * Copyright (C) 2011-2014 Atmel Corporation
6  * Copyright (C) 2012 Google, Inc.
7  *
8  * Author: Joonyoung Shim <jy0922.shim@samsung.com>
9  *
10  * This program is free software; you can redistribute  it and/or modify it
11  * under  the terms of  the GNU General  Public License as published by the
12  * Free Software Foundation;  either version 2 of the  License, or (at your
13  * option) any later version.
14  *
15  */
16 
17 #include <linux/module.h>
18 #include <linux/init.h>
19 #include <linux/completion.h>
20 #include <linux/delay.h>
21 #include <linux/firmware.h>
22 #include <linux/i2c.h>
23 #include <linux/i2c/atmel_mxt_ts.h>
24 #include <linux/input/mt.h>
25 #include <linux/interrupt.h>
26 #include <linux/of.h>
27 #include <linux/slab.h>
28 
29 /* Version */
30 #define MXT_VER_20		20
31 #define MXT_VER_21		21
32 #define MXT_VER_22		22
33 
34 /* Firmware files */
35 #define MXT_FW_NAME		"maxtouch.fw"
36 #define MXT_CFG_NAME		"maxtouch.cfg"
37 #define MXT_CFG_MAGIC		"OBP_RAW V1"
38 
39 /* Registers */
40 #define MXT_INFO		0x00
41 #define MXT_FAMILY_ID		0x00
42 #define MXT_VARIANT_ID		0x01
43 #define MXT_VERSION		0x02
44 #define MXT_BUILD		0x03
45 #define MXT_MATRIX_X_SIZE	0x04
46 #define MXT_MATRIX_Y_SIZE	0x05
47 #define MXT_OBJECT_NUM		0x06
48 #define MXT_OBJECT_START	0x07
49 
50 #define MXT_OBJECT_SIZE		6
51 #define MXT_INFO_CHECKSUM_SIZE	3
52 #define MXT_MAX_BLOCK_WRITE	256
53 
54 /* Object types */
55 #define MXT_DEBUG_DIAGNOSTIC_T37	37
56 #define MXT_GEN_MESSAGE_T5		5
57 #define MXT_GEN_COMMAND_T6		6
58 #define MXT_GEN_POWER_T7		7
59 #define MXT_GEN_ACQUIRE_T8		8
60 #define MXT_GEN_DATASOURCE_T53		53
61 #define MXT_TOUCH_MULTI_T9		9
62 #define MXT_TOUCH_KEYARRAY_T15		15
63 #define MXT_TOUCH_PROXIMITY_T23		23
64 #define MXT_TOUCH_PROXKEY_T52		52
65 #define MXT_PROCI_GRIPFACE_T20		20
66 #define MXT_PROCG_NOISE_T22		22
67 #define MXT_PROCI_ONETOUCH_T24		24
68 #define MXT_PROCI_TWOTOUCH_T27		27
69 #define MXT_PROCI_GRIP_T40		40
70 #define MXT_PROCI_PALM_T41		41
71 #define MXT_PROCI_TOUCHSUPPRESSION_T42	42
72 #define MXT_PROCI_STYLUS_T47		47
73 #define MXT_PROCG_NOISESUPPRESSION_T48	48
74 #define MXT_SPT_COMMSCONFIG_T18		18
75 #define MXT_SPT_GPIOPWM_T19		19
76 #define MXT_SPT_SELFTEST_T25		25
77 #define MXT_SPT_CTECONFIG_T28		28
78 #define MXT_SPT_USERDATA_T38		38
79 #define MXT_SPT_DIGITIZER_T43		43
80 #define MXT_SPT_MESSAGECOUNT_T44	44
81 #define MXT_SPT_CTECONFIG_T46		46
82 
83 /* MXT_GEN_MESSAGE_T5 object */
84 #define MXT_RPTID_NOMSG		0xff
85 
86 /* MXT_GEN_COMMAND_T6 field */
87 #define MXT_COMMAND_RESET	0
88 #define MXT_COMMAND_BACKUPNV	1
89 #define MXT_COMMAND_CALIBRATE	2
90 #define MXT_COMMAND_REPORTALL	3
91 #define MXT_COMMAND_DIAGNOSTIC	5
92 
93 /* Define for T6 status byte */
94 #define MXT_T6_STATUS_RESET	(1 << 7)
95 #define MXT_T6_STATUS_OFL	(1 << 6)
96 #define MXT_T6_STATUS_SIGERR	(1 << 5)
97 #define MXT_T6_STATUS_CAL	(1 << 4)
98 #define MXT_T6_STATUS_CFGERR	(1 << 3)
99 #define MXT_T6_STATUS_COMSERR	(1 << 2)
100 
101 /* MXT_GEN_POWER_T7 field */
102 #define MXT_POWER_IDLEACQINT	0
103 #define MXT_POWER_ACTVACQINT	1
104 #define MXT_POWER_ACTV2IDLETO	2
105 
106 /* MXT_GEN_ACQUIRE_T8 field */
107 #define MXT_ACQUIRE_CHRGTIME	0
108 #define MXT_ACQUIRE_TCHDRIFT	2
109 #define MXT_ACQUIRE_DRIFTST	3
110 #define MXT_ACQUIRE_TCHAUTOCAL	4
111 #define MXT_ACQUIRE_SYNC	5
112 #define MXT_ACQUIRE_ATCHCALST	6
113 #define MXT_ACQUIRE_ATCHCALSTHR	7
114 
115 /* MXT_TOUCH_MULTI_T9 field */
116 #define MXT_TOUCH_CTRL		0
117 #define MXT_T9_ORIENT		9
118 #define MXT_T9_RANGE		18
119 
120 /* MXT_TOUCH_MULTI_T9 status */
121 #define MXT_T9_UNGRIP		(1 << 0)
122 #define MXT_T9_SUPPRESS		(1 << 1)
123 #define MXT_T9_AMP		(1 << 2)
124 #define MXT_T9_VECTOR		(1 << 3)
125 #define MXT_T9_MOVE		(1 << 4)
126 #define MXT_T9_RELEASE		(1 << 5)
127 #define MXT_T9_PRESS		(1 << 6)
128 #define MXT_T9_DETECT		(1 << 7)
129 
130 struct t9_range {
131 	u16 x;
132 	u16 y;
133 } __packed;
134 
135 /* MXT_TOUCH_MULTI_T9 orient */
136 #define MXT_T9_ORIENT_SWITCH	(1 << 0)
137 
138 /* MXT_PROCI_GRIPFACE_T20 field */
139 #define MXT_GRIPFACE_CTRL	0
140 #define MXT_GRIPFACE_XLOGRIP	1
141 #define MXT_GRIPFACE_XHIGRIP	2
142 #define MXT_GRIPFACE_YLOGRIP	3
143 #define MXT_GRIPFACE_YHIGRIP	4
144 #define MXT_GRIPFACE_MAXTCHS	5
145 #define MXT_GRIPFACE_SZTHR1	7
146 #define MXT_GRIPFACE_SZTHR2	8
147 #define MXT_GRIPFACE_SHPTHR1	9
148 #define MXT_GRIPFACE_SHPTHR2	10
149 #define MXT_GRIPFACE_SUPEXTTO	11
150 
151 /* MXT_PROCI_NOISE field */
152 #define MXT_NOISE_CTRL		0
153 #define MXT_NOISE_OUTFLEN	1
154 #define MXT_NOISE_GCAFUL_LSB	3
155 #define MXT_NOISE_GCAFUL_MSB	4
156 #define MXT_NOISE_GCAFLL_LSB	5
157 #define MXT_NOISE_GCAFLL_MSB	6
158 #define MXT_NOISE_ACTVGCAFVALID	7
159 #define MXT_NOISE_NOISETHR	8
160 #define MXT_NOISE_FREQHOPSCALE	10
161 #define MXT_NOISE_FREQ0		11
162 #define MXT_NOISE_FREQ1		12
163 #define MXT_NOISE_FREQ2		13
164 #define MXT_NOISE_FREQ3		14
165 #define MXT_NOISE_FREQ4		15
166 #define MXT_NOISE_IDLEGCAFVALID	16
167 
168 /* MXT_SPT_COMMSCONFIG_T18 */
169 #define MXT_COMMS_CTRL		0
170 #define MXT_COMMS_CMD		1
171 
172 /* MXT_SPT_CTECONFIG_T28 field */
173 #define MXT_CTE_CTRL		0
174 #define MXT_CTE_CMD		1
175 #define MXT_CTE_MODE		2
176 #define MXT_CTE_IDLEGCAFDEPTH	3
177 #define MXT_CTE_ACTVGCAFDEPTH	4
178 #define MXT_CTE_VOLTAGE		5
179 
180 #define MXT_VOLTAGE_DEFAULT	2700000
181 #define MXT_VOLTAGE_STEP	10000
182 
183 /* Define for MXT_GEN_COMMAND_T6 */
184 #define MXT_BOOT_VALUE		0xa5
185 #define MXT_RESET_VALUE		0x01
186 #define MXT_BACKUP_VALUE	0x55
187 
188 /* Delay times */
189 #define MXT_BACKUP_TIME		50	/* msec */
190 #define MXT_RESET_TIME		200	/* msec */
191 #define MXT_RESET_TIMEOUT	3000	/* msec */
192 #define MXT_CRC_TIMEOUT		1000	/* msec */
193 #define MXT_FW_RESET_TIME	3000	/* msec */
194 #define MXT_FW_CHG_TIMEOUT	300	/* msec */
195 
196 /* Command to unlock bootloader */
197 #define MXT_UNLOCK_CMD_MSB	0xaa
198 #define MXT_UNLOCK_CMD_LSB	0xdc
199 
200 /* Bootloader mode status */
201 #define MXT_WAITING_BOOTLOAD_CMD	0xc0	/* valid 7 6 bit only */
202 #define MXT_WAITING_FRAME_DATA	0x80	/* valid 7 6 bit only */
203 #define MXT_FRAME_CRC_CHECK	0x02
204 #define MXT_FRAME_CRC_FAIL	0x03
205 #define MXT_FRAME_CRC_PASS	0x04
206 #define MXT_APP_CRC_FAIL	0x40	/* valid 7 8 bit only */
207 #define MXT_BOOT_STATUS_MASK	0x3f
208 #define MXT_BOOT_EXTENDED_ID	(1 << 5)
209 #define MXT_BOOT_ID_MASK	0x1f
210 
211 /* Touchscreen absolute values */
212 #define MXT_MAX_AREA		0xff
213 
214 #define MXT_PIXELS_PER_MM	20
215 
216 struct mxt_info {
217 	u8 family_id;
218 	u8 variant_id;
219 	u8 version;
220 	u8 build;
221 	u8 matrix_xsize;
222 	u8 matrix_ysize;
223 	u8 object_num;
224 };
225 
226 struct mxt_object {
227 	u8 type;
228 	u16 start_address;
229 	u8 size_minus_one;
230 	u8 instances_minus_one;
231 	u8 num_report_ids;
232 } __packed;
233 
234 /* Each client has this additional data */
235 struct mxt_data {
236 	struct i2c_client *client;
237 	struct input_dev *input_dev;
238 	char phys[64];		/* device physical location */
239 	const struct mxt_platform_data *pdata;
240 	struct mxt_object *object_table;
241 	struct mxt_info info;
242 	unsigned int irq;
243 	unsigned int max_x;
244 	unsigned int max_y;
245 	bool in_bootloader;
246 	u16 mem_size;
247 	u8 max_reportid;
248 	u32 config_crc;
249 	u32 info_crc;
250 	u8 bootloader_addr;
251 	u8 *msg_buf;
252 	u8 t6_status;
253 	bool update_input;
254 	u8 last_message_count;
255 	u8 num_touchids;
256 
257 	/* Cached parameters from object table */
258 	u16 T5_address;
259 	u8 T5_msg_size;
260 	u8 T6_reportid;
261 	u16 T6_address;
262 	u16 T7_address;
263 	u8 T9_reportid_min;
264 	u8 T9_reportid_max;
265 	u8 T19_reportid;
266 	u16 T44_address;
267 
268 	/* for fw update in bootloader */
269 	struct completion bl_completion;
270 
271 	/* for reset handling */
272 	struct completion reset_completion;
273 
274 	/* for config update handling */
275 	struct completion crc_completion;
276 };
277 
278 static size_t mxt_obj_size(const struct mxt_object *obj)
279 {
280 	return obj->size_minus_one + 1;
281 }
282 
283 static size_t mxt_obj_instances(const struct mxt_object *obj)
284 {
285 	return obj->instances_minus_one + 1;
286 }
287 
288 static bool mxt_object_readable(unsigned int type)
289 {
290 	switch (type) {
291 	case MXT_GEN_COMMAND_T6:
292 	case MXT_GEN_POWER_T7:
293 	case MXT_GEN_ACQUIRE_T8:
294 	case MXT_GEN_DATASOURCE_T53:
295 	case MXT_TOUCH_MULTI_T9:
296 	case MXT_TOUCH_KEYARRAY_T15:
297 	case MXT_TOUCH_PROXIMITY_T23:
298 	case MXT_TOUCH_PROXKEY_T52:
299 	case MXT_PROCI_GRIPFACE_T20:
300 	case MXT_PROCG_NOISE_T22:
301 	case MXT_PROCI_ONETOUCH_T24:
302 	case MXT_PROCI_TWOTOUCH_T27:
303 	case MXT_PROCI_GRIP_T40:
304 	case MXT_PROCI_PALM_T41:
305 	case MXT_PROCI_TOUCHSUPPRESSION_T42:
306 	case MXT_PROCI_STYLUS_T47:
307 	case MXT_PROCG_NOISESUPPRESSION_T48:
308 	case MXT_SPT_COMMSCONFIG_T18:
309 	case MXT_SPT_GPIOPWM_T19:
310 	case MXT_SPT_SELFTEST_T25:
311 	case MXT_SPT_CTECONFIG_T28:
312 	case MXT_SPT_USERDATA_T38:
313 	case MXT_SPT_DIGITIZER_T43:
314 	case MXT_SPT_CTECONFIG_T46:
315 		return true;
316 	default:
317 		return false;
318 	}
319 }
320 
321 static void mxt_dump_message(struct mxt_data *data, u8 *message)
322 {
323 	dev_dbg(&data->client->dev, "message: %*ph\n",
324 		data->T5_msg_size, message);
325 }
326 
327 static int mxt_wait_for_completion(struct mxt_data *data,
328 				   struct completion *comp,
329 				   unsigned int timeout_ms)
330 {
331 	struct device *dev = &data->client->dev;
332 	unsigned long timeout = msecs_to_jiffies(timeout_ms);
333 	long ret;
334 
335 	ret = wait_for_completion_interruptible_timeout(comp, timeout);
336 	if (ret < 0) {
337 		return ret;
338 	} else if (ret == 0) {
339 		dev_err(dev, "Wait for completion timed out.\n");
340 		return -ETIMEDOUT;
341 	}
342 	return 0;
343 }
344 
345 static int mxt_bootloader_read(struct mxt_data *data,
346 			       u8 *val, unsigned int count)
347 {
348 	int ret;
349 	struct i2c_msg msg;
350 
351 	msg.addr = data->bootloader_addr;
352 	msg.flags = data->client->flags & I2C_M_TEN;
353 	msg.flags |= I2C_M_RD;
354 	msg.len = count;
355 	msg.buf = val;
356 
357 	ret = i2c_transfer(data->client->adapter, &msg, 1);
358 	if (ret == 1) {
359 		ret = 0;
360 	} else {
361 		ret = ret < 0 ? ret : -EIO;
362 		dev_err(&data->client->dev, "%s: i2c recv failed (%d)\n",
363 			__func__, ret);
364 	}
365 
366 	return ret;
367 }
368 
369 static int mxt_bootloader_write(struct mxt_data *data,
370 				const u8 * const val, unsigned int count)
371 {
372 	int ret;
373 	struct i2c_msg msg;
374 
375 	msg.addr = data->bootloader_addr;
376 	msg.flags = data->client->flags & I2C_M_TEN;
377 	msg.len = count;
378 	msg.buf = (u8 *)val;
379 
380 	ret = i2c_transfer(data->client->adapter, &msg, 1);
381 	if (ret == 1) {
382 		ret = 0;
383 	} else {
384 		ret = ret < 0 ? ret : -EIO;
385 		dev_err(&data->client->dev, "%s: i2c send failed (%d)\n",
386 			__func__, ret);
387 	}
388 
389 	return ret;
390 }
391 
392 static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
393 {
394 	u8 appmode = data->client->addr;
395 	u8 bootloader;
396 
397 	switch (appmode) {
398 	case 0x4a:
399 	case 0x4b:
400 		/* Chips after 1664S use different scheme */
401 		if (retry || data->info.family_id >= 0xa2) {
402 			bootloader = appmode - 0x24;
403 			break;
404 		}
405 		/* Fall through for normal case */
406 	case 0x4c:
407 	case 0x4d:
408 	case 0x5a:
409 	case 0x5b:
410 		bootloader = appmode - 0x26;
411 		break;
412 
413 	default:
414 		dev_err(&data->client->dev,
415 			"Appmode i2c address 0x%02x not found\n",
416 			appmode);
417 		return -EINVAL;
418 	}
419 
420 	data->bootloader_addr = bootloader;
421 	return 0;
422 }
423 
424 static int mxt_probe_bootloader(struct mxt_data *data, bool alt_address)
425 {
426 	struct device *dev = &data->client->dev;
427 	int error;
428 	u8 val;
429 	bool crc_failure;
430 
431 	error = mxt_lookup_bootloader_address(data, alt_address);
432 	if (error)
433 		return error;
434 
435 	error = mxt_bootloader_read(data, &val, 1);
436 	if (error)
437 		return error;
438 
439 	/* Check app crc fail mode */
440 	crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
441 
442 	dev_err(dev, "Detected bootloader, status:%02X%s\n",
443 			val, crc_failure ? ", APP_CRC_FAIL" : "");
444 
445 	return 0;
446 }
447 
448 static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
449 {
450 	struct device *dev = &data->client->dev;
451 	u8 buf[3];
452 
453 	if (val & MXT_BOOT_EXTENDED_ID) {
454 		if (mxt_bootloader_read(data, &buf[0], 3) != 0) {
455 			dev_err(dev, "%s: i2c failure\n", __func__);
456 			return val;
457 		}
458 
459 		dev_dbg(dev, "Bootloader ID:%d Version:%d\n", buf[1], buf[2]);
460 
461 		return buf[0];
462 	} else {
463 		dev_dbg(dev, "Bootloader ID:%d\n", val & MXT_BOOT_ID_MASK);
464 
465 		return val;
466 	}
467 }
468 
469 static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
470 				bool wait)
471 {
472 	struct device *dev = &data->client->dev;
473 	u8 val;
474 	int ret;
475 
476 recheck:
477 	if (wait) {
478 		/*
479 		 * In application update mode, the interrupt
480 		 * line signals state transitions. We must wait for the
481 		 * CHG assertion before reading the status byte.
482 		 * Once the status byte has been read, the line is deasserted.
483 		 */
484 		ret = mxt_wait_for_completion(data, &data->bl_completion,
485 					      MXT_FW_CHG_TIMEOUT);
486 		if (ret) {
487 			/*
488 			 * TODO: handle -ERESTARTSYS better by terminating
489 			 * fw update process before returning to userspace
490 			 * by writing length 0x000 to device (iff we are in
491 			 * WAITING_FRAME_DATA state).
492 			 */
493 			dev_err(dev, "Update wait error %d\n", ret);
494 			return ret;
495 		}
496 	}
497 
498 	ret = mxt_bootloader_read(data, &val, 1);
499 	if (ret)
500 		return ret;
501 
502 	if (state == MXT_WAITING_BOOTLOAD_CMD)
503 		val = mxt_get_bootloader_version(data, val);
504 
505 	switch (state) {
506 	case MXT_WAITING_BOOTLOAD_CMD:
507 	case MXT_WAITING_FRAME_DATA:
508 	case MXT_APP_CRC_FAIL:
509 		val &= ~MXT_BOOT_STATUS_MASK;
510 		break;
511 	case MXT_FRAME_CRC_PASS:
512 		if (val == MXT_FRAME_CRC_CHECK) {
513 			goto recheck;
514 		} else if (val == MXT_FRAME_CRC_FAIL) {
515 			dev_err(dev, "Bootloader CRC fail\n");
516 			return -EINVAL;
517 		}
518 		break;
519 	default:
520 		return -EINVAL;
521 	}
522 
523 	if (val != state) {
524 		dev_err(dev, "Invalid bootloader state %02X != %02X\n",
525 			val, state);
526 		return -EINVAL;
527 	}
528 
529 	return 0;
530 }
531 
532 static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
533 {
534 	int ret;
535 	u8 buf[2];
536 
537 	if (unlock) {
538 		buf[0] = MXT_UNLOCK_CMD_LSB;
539 		buf[1] = MXT_UNLOCK_CMD_MSB;
540 	} else {
541 		buf[0] = 0x01;
542 		buf[1] = 0x01;
543 	}
544 
545 	ret = mxt_bootloader_write(data, buf, 2);
546 	if (ret)
547 		return ret;
548 
549 	return 0;
550 }
551 
552 static int __mxt_read_reg(struct i2c_client *client,
553 			       u16 reg, u16 len, void *val)
554 {
555 	struct i2c_msg xfer[2];
556 	u8 buf[2];
557 	int ret;
558 
559 	buf[0] = reg & 0xff;
560 	buf[1] = (reg >> 8) & 0xff;
561 
562 	/* Write register */
563 	xfer[0].addr = client->addr;
564 	xfer[0].flags = 0;
565 	xfer[0].len = 2;
566 	xfer[0].buf = buf;
567 
568 	/* Read data */
569 	xfer[1].addr = client->addr;
570 	xfer[1].flags = I2C_M_RD;
571 	xfer[1].len = len;
572 	xfer[1].buf = val;
573 
574 	ret = i2c_transfer(client->adapter, xfer, 2);
575 	if (ret == 2) {
576 		ret = 0;
577 	} else {
578 		if (ret >= 0)
579 			ret = -EIO;
580 		dev_err(&client->dev, "%s: i2c transfer failed (%d)\n",
581 			__func__, ret);
582 	}
583 
584 	return ret;
585 }
586 
587 static int __mxt_write_reg(struct i2c_client *client, u16 reg, u16 len,
588 			   const void *val)
589 {
590 	u8 *buf;
591 	size_t count;
592 	int ret;
593 
594 	count = len + 2;
595 	buf = kmalloc(count, GFP_KERNEL);
596 	if (!buf)
597 		return -ENOMEM;
598 
599 	buf[0] = reg & 0xff;
600 	buf[1] = (reg >> 8) & 0xff;
601 	memcpy(&buf[2], val, len);
602 
603 	ret = i2c_master_send(client, buf, count);
604 	if (ret == count) {
605 		ret = 0;
606 	} else {
607 		if (ret >= 0)
608 			ret = -EIO;
609 		dev_err(&client->dev, "%s: i2c send failed (%d)\n",
610 			__func__, ret);
611 	}
612 
613 	kfree(buf);
614 	return ret;
615 }
616 
617 static int mxt_write_reg(struct i2c_client *client, u16 reg, u8 val)
618 {
619 	return __mxt_write_reg(client, reg, 1, &val);
620 }
621 
622 static struct mxt_object *
623 mxt_get_object(struct mxt_data *data, u8 type)
624 {
625 	struct mxt_object *object;
626 	int i;
627 
628 	for (i = 0; i < data->info.object_num; i++) {
629 		object = data->object_table + i;
630 		if (object->type == type)
631 			return object;
632 	}
633 
634 	dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
635 	return NULL;
636 }
637 
638 static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
639 {
640 	struct device *dev = &data->client->dev;
641 	u8 status = msg[1];
642 	u32 crc = msg[2] | (msg[3] << 8) | (msg[4] << 16);
643 
644 	complete(&data->crc_completion);
645 
646 	if (crc != data->config_crc) {
647 		data->config_crc = crc;
648 		dev_dbg(dev, "T6 Config Checksum: 0x%06X\n", crc);
649 	}
650 
651 	/* Detect reset */
652 	if (status & MXT_T6_STATUS_RESET)
653 		complete(&data->reset_completion);
654 
655 	/* Output debug if status has changed */
656 	if (status != data->t6_status)
657 		dev_dbg(dev, "T6 Status 0x%02X%s%s%s%s%s%s%s\n",
658 			status,
659 			status == 0 ? " OK" : "",
660 			status & MXT_T6_STATUS_RESET ? " RESET" : "",
661 			status & MXT_T6_STATUS_OFL ? " OFL" : "",
662 			status & MXT_T6_STATUS_SIGERR ? " SIGERR" : "",
663 			status & MXT_T6_STATUS_CAL ? " CAL" : "",
664 			status & MXT_T6_STATUS_CFGERR ? " CFGERR" : "",
665 			status & MXT_T6_STATUS_COMSERR ? " COMSERR" : "");
666 
667 	/* Save current status */
668 	data->t6_status = status;
669 }
670 
671 static int mxt_write_object(struct mxt_data *data,
672 				 u8 type, u8 offset, u8 val)
673 {
674 	struct mxt_object *object;
675 	u16 reg;
676 
677 	object = mxt_get_object(data, type);
678 	if (!object || offset >= mxt_obj_size(object))
679 		return -EINVAL;
680 
681 	reg = object->start_address;
682 	return mxt_write_reg(data->client, reg + offset, val);
683 }
684 
685 static void mxt_input_button(struct mxt_data *data, u8 *message)
686 {
687 	struct input_dev *input = data->input_dev;
688 	const struct mxt_platform_data *pdata = data->pdata;
689 	bool button;
690 	int i;
691 
692 	/* Active-low switch */
693 	for (i = 0; i < pdata->t19_num_keys; i++) {
694 		if (pdata->t19_keymap[i] == KEY_RESERVED)
695 			continue;
696 		button = !(message[1] & (1 << i));
697 		input_report_key(input, pdata->t19_keymap[i], button);
698 	}
699 }
700 
701 static void mxt_input_sync(struct mxt_data *data)
702 {
703 	input_mt_report_pointer_emulation(data->input_dev,
704 					  data->pdata->t19_num_keys);
705 	input_sync(data->input_dev);
706 }
707 
708 static void mxt_proc_t9_message(struct mxt_data *data, u8 *message)
709 {
710 	struct device *dev = &data->client->dev;
711 	struct input_dev *input_dev = data->input_dev;
712 	int id;
713 	u8 status;
714 	int x;
715 	int y;
716 	int area;
717 	int amplitude;
718 
719 	id = message[0] - data->T9_reportid_min;
720 	status = message[1];
721 	x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
722 	y = (message[3] << 4) | ((message[4] & 0xf));
723 
724 	/* Handle 10/12 bit switching */
725 	if (data->max_x < 1024)
726 		x >>= 2;
727 	if (data->max_y < 1024)
728 		y >>= 2;
729 
730 	area = message[5];
731 	amplitude = message[6];
732 
733 	dev_dbg(dev,
734 		"[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
735 		id,
736 		(status & MXT_T9_DETECT) ? 'D' : '.',
737 		(status & MXT_T9_PRESS) ? 'P' : '.',
738 		(status & MXT_T9_RELEASE) ? 'R' : '.',
739 		(status & MXT_T9_MOVE) ? 'M' : '.',
740 		(status & MXT_T9_VECTOR) ? 'V' : '.',
741 		(status & MXT_T9_AMP) ? 'A' : '.',
742 		(status & MXT_T9_SUPPRESS) ? 'S' : '.',
743 		(status & MXT_T9_UNGRIP) ? 'U' : '.',
744 		x, y, area, amplitude);
745 
746 	input_mt_slot(input_dev, id);
747 
748 	if (status & MXT_T9_DETECT) {
749 		/*
750 		 * Multiple bits may be set if the host is slow to read
751 		 * the status messages, indicating all the events that
752 		 * have happened.
753 		 */
754 		if (status & MXT_T9_RELEASE) {
755 			input_mt_report_slot_state(input_dev,
756 						   MT_TOOL_FINGER, 0);
757 			mxt_input_sync(data);
758 		}
759 
760 		/* Touch active */
761 		input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 1);
762 		input_report_abs(input_dev, ABS_MT_POSITION_X, x);
763 		input_report_abs(input_dev, ABS_MT_POSITION_Y, y);
764 		input_report_abs(input_dev, ABS_MT_PRESSURE, amplitude);
765 		input_report_abs(input_dev, ABS_MT_TOUCH_MAJOR, area);
766 	} else {
767 		/* Touch no longer active, close out slot */
768 		input_mt_report_slot_state(input_dev, MT_TOOL_FINGER, 0);
769 	}
770 
771 	data->update_input = true;
772 }
773 
774 static int mxt_proc_message(struct mxt_data *data, u8 *message)
775 {
776 	u8 report_id = message[0];
777 
778 	if (report_id == MXT_RPTID_NOMSG)
779 		return 0;
780 
781 	if (report_id == data->T6_reportid) {
782 		mxt_proc_t6_messages(data, message);
783 	} else if (!data->input_dev) {
784 		/*
785 		 * Do not report events if input device
786 		 * is not yet registered.
787 		 */
788 		mxt_dump_message(data, message);
789 	} else if (report_id >= data->T9_reportid_min
790 	    && report_id <= data->T9_reportid_max) {
791 		mxt_proc_t9_message(data, message);
792 	} else if (report_id == data->T19_reportid) {
793 		mxt_input_button(data, message);
794 		data->update_input = true;
795 	} else {
796 		mxt_dump_message(data, message);
797 	}
798 
799 	return 1;
800 }
801 
802 static int mxt_read_and_process_messages(struct mxt_data *data, u8 count)
803 {
804 	struct device *dev = &data->client->dev;
805 	int ret;
806 	int i;
807 	u8 num_valid = 0;
808 
809 	/* Safety check for msg_buf */
810 	if (count > data->max_reportid)
811 		return -EINVAL;
812 
813 	/* Process remaining messages if necessary */
814 	ret = __mxt_read_reg(data->client, data->T5_address,
815 				data->T5_msg_size * count, data->msg_buf);
816 	if (ret) {
817 		dev_err(dev, "Failed to read %u messages (%d)\n", count, ret);
818 		return ret;
819 	}
820 
821 	for (i = 0;  i < count; i++) {
822 		ret = mxt_proc_message(data,
823 			data->msg_buf + data->T5_msg_size * i);
824 
825 		if (ret == 1)
826 			num_valid++;
827 	}
828 
829 	/* return number of messages read */
830 	return num_valid;
831 }
832 
833 static irqreturn_t mxt_process_messages_t44(struct mxt_data *data)
834 {
835 	struct device *dev = &data->client->dev;
836 	int ret;
837 	u8 count, num_left;
838 
839 	/* Read T44 and T5 together */
840 	ret = __mxt_read_reg(data->client, data->T44_address,
841 		data->T5_msg_size + 1, data->msg_buf);
842 	if (ret) {
843 		dev_err(dev, "Failed to read T44 and T5 (%d)\n", ret);
844 		return IRQ_NONE;
845 	}
846 
847 	count = data->msg_buf[0];
848 
849 	if (count == 0) {
850 		/*
851 		 * This condition is caused by the CHG line being configured
852 		 * in Mode 0. It results in unnecessary I2C operations but it
853 		 * is benign.
854 		 */
855 		dev_dbg(dev, "Interrupt triggered but zero messages\n");
856 		return IRQ_NONE;
857 	} else if (count > data->max_reportid) {
858 		dev_err(dev, "T44 count %d exceeded max report id\n", count);
859 		count = data->max_reportid;
860 	}
861 
862 	/* Process first message */
863 	ret = mxt_proc_message(data, data->msg_buf + 1);
864 	if (ret < 0) {
865 		dev_warn(dev, "Unexpected invalid message\n");
866 		return IRQ_NONE;
867 	}
868 
869 	num_left = count - 1;
870 
871 	/* Process remaining messages if necessary */
872 	if (num_left) {
873 		ret = mxt_read_and_process_messages(data, num_left);
874 		if (ret < 0)
875 			goto end;
876 		else if (ret != num_left)
877 			dev_warn(dev, "Unexpected invalid message\n");
878 	}
879 
880 end:
881 	if (data->update_input) {
882 		mxt_input_sync(data);
883 		data->update_input = false;
884 	}
885 
886 	return IRQ_HANDLED;
887 }
888 
889 static int mxt_process_messages_until_invalid(struct mxt_data *data)
890 {
891 	struct device *dev = &data->client->dev;
892 	int count, read;
893 	u8 tries = 2;
894 
895 	count = data->max_reportid;
896 
897 	/* Read messages until we force an invalid */
898 	do {
899 		read = mxt_read_and_process_messages(data, count);
900 		if (read < count)
901 			return 0;
902 	} while (--tries);
903 
904 	if (data->update_input) {
905 		mxt_input_sync(data);
906 		data->update_input = false;
907 	}
908 
909 	dev_err(dev, "CHG pin isn't cleared\n");
910 	return -EBUSY;
911 }
912 
913 static irqreturn_t mxt_process_messages(struct mxt_data *data)
914 {
915 	int total_handled, num_handled;
916 	u8 count = data->last_message_count;
917 
918 	if (count < 1 || count > data->max_reportid)
919 		count = 1;
920 
921 	/* include final invalid message */
922 	total_handled = mxt_read_and_process_messages(data, count + 1);
923 	if (total_handled < 0)
924 		return IRQ_NONE;
925 	/* if there were invalid messages, then we are done */
926 	else if (total_handled <= count)
927 		goto update_count;
928 
929 	/* keep reading two msgs until one is invalid or reportid limit */
930 	do {
931 		num_handled = mxt_read_and_process_messages(data, 2);
932 		if (num_handled < 0)
933 			return IRQ_NONE;
934 
935 		total_handled += num_handled;
936 
937 		if (num_handled < 2)
938 			break;
939 	} while (total_handled < data->num_touchids);
940 
941 update_count:
942 	data->last_message_count = total_handled;
943 
944 	if (data->update_input) {
945 		mxt_input_sync(data);
946 		data->update_input = false;
947 	}
948 
949 	return IRQ_HANDLED;
950 }
951 
952 static irqreturn_t mxt_interrupt(int irq, void *dev_id)
953 {
954 	struct mxt_data *data = dev_id;
955 
956 	if (data->in_bootloader) {
957 		/* bootloader state transition completion */
958 		complete(&data->bl_completion);
959 		return IRQ_HANDLED;
960 	}
961 
962 	if (!data->object_table)
963 		return IRQ_HANDLED;
964 
965 	if (data->T44_address) {
966 		return mxt_process_messages_t44(data);
967 	} else {
968 		return mxt_process_messages(data);
969 	}
970 }
971 
972 static int mxt_t6_command(struct mxt_data *data, u16 cmd_offset,
973 			  u8 value, bool wait)
974 {
975 	u16 reg;
976 	u8 command_register;
977 	int timeout_counter = 0;
978 	int ret;
979 
980 	reg = data->T6_address + cmd_offset;
981 
982 	ret = mxt_write_reg(data->client, reg, value);
983 	if (ret)
984 		return ret;
985 
986 	if (!wait)
987 		return 0;
988 
989 	do {
990 		msleep(20);
991 		ret = __mxt_read_reg(data->client, reg, 1, &command_register);
992 		if (ret)
993 			return ret;
994 	} while (command_register != 0 && timeout_counter++ <= 100);
995 
996 	if (timeout_counter > 100) {
997 		dev_err(&data->client->dev, "Command failed!\n");
998 		return -EIO;
999 	}
1000 
1001 	return 0;
1002 }
1003 
1004 static int mxt_soft_reset(struct mxt_data *data)
1005 {
1006 	struct device *dev = &data->client->dev;
1007 	int ret = 0;
1008 
1009 	dev_info(dev, "Resetting chip\n");
1010 
1011 	reinit_completion(&data->reset_completion);
1012 
1013 	ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_RESET_VALUE, false);
1014 	if (ret)
1015 		return ret;
1016 
1017 	ret = mxt_wait_for_completion(data, &data->reset_completion,
1018 				      MXT_RESET_TIMEOUT);
1019 	if (ret)
1020 		return ret;
1021 
1022 	return 0;
1023 }
1024 
1025 static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
1026 {
1027 	/*
1028 	 * On failure, CRC is set to 0 and config will always be
1029 	 * downloaded.
1030 	 */
1031 	data->config_crc = 0;
1032 	reinit_completion(&data->crc_completion);
1033 
1034 	mxt_t6_command(data, cmd, value, true);
1035 
1036 	/*
1037 	 * Wait for crc message. On failure, CRC is set to 0 and config will
1038 	 * always be downloaded.
1039 	 */
1040 	mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
1041 }
1042 
1043 static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
1044 {
1045 	static const unsigned int crcpoly = 0x80001B;
1046 	u32 result;
1047 	u32 data_word;
1048 
1049 	data_word = (secondbyte << 8) | firstbyte;
1050 	result = ((*crc << 1) ^ data_word);
1051 
1052 	if (result & 0x1000000)
1053 		result ^= crcpoly;
1054 
1055 	*crc = result;
1056 }
1057 
1058 static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
1059 {
1060 	u32 crc = 0;
1061 	u8 *ptr = base + start_off;
1062 	u8 *last_val = base + end_off - 1;
1063 
1064 	if (end_off < start_off)
1065 		return -EINVAL;
1066 
1067 	while (ptr < last_val) {
1068 		mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
1069 		ptr += 2;
1070 	}
1071 
1072 	/* if len is odd, fill the last byte with 0 */
1073 	if (ptr == last_val)
1074 		mxt_calc_crc24(&crc, *ptr, 0);
1075 
1076 	/* Mask to 24-bit */
1077 	crc &= 0x00FFFFFF;
1078 
1079 	return crc;
1080 }
1081 
1082 static int mxt_prepare_cfg_mem(struct mxt_data *data,
1083 			       const struct firmware *cfg,
1084 			       unsigned int data_pos,
1085 			       unsigned int cfg_start_ofs,
1086 			       u8 *config_mem,
1087 			       size_t config_mem_size)
1088 {
1089 	struct device *dev = &data->client->dev;
1090 	struct mxt_object *object;
1091 	unsigned int type, instance, size, byte_offset;
1092 	int offset;
1093 	int ret;
1094 	int i;
1095 	u16 reg;
1096 	u8 val;
1097 
1098 	while (data_pos < cfg->size) {
1099 		/* Read type, instance, length */
1100 		ret = sscanf(cfg->data + data_pos, "%x %x %x%n",
1101 			     &type, &instance, &size, &offset);
1102 		if (ret == 0) {
1103 			/* EOF */
1104 			break;
1105 		} else if (ret != 3) {
1106 			dev_err(dev, "Bad format: failed to parse object\n");
1107 			return -EINVAL;
1108 		}
1109 		data_pos += offset;
1110 
1111 		object = mxt_get_object(data, type);
1112 		if (!object) {
1113 			/* Skip object */
1114 			for (i = 0; i < size; i++) {
1115 				ret = sscanf(cfg->data + data_pos, "%hhx%n",
1116 					     &val, &offset);
1117 				if (ret != 1) {
1118 					dev_err(dev, "Bad format in T%d at %d\n",
1119 						type, i);
1120 					return -EINVAL;
1121 				}
1122 				data_pos += offset;
1123 			}
1124 			continue;
1125 		}
1126 
1127 		if (size > mxt_obj_size(object)) {
1128 			/*
1129 			 * Either we are in fallback mode due to wrong
1130 			 * config or config from a later fw version,
1131 			 * or the file is corrupt or hand-edited.
1132 			 */
1133 			dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
1134 				 size - mxt_obj_size(object), type);
1135 		} else if (mxt_obj_size(object) > size) {
1136 			/*
1137 			 * If firmware is upgraded, new bytes may be added to
1138 			 * end of objects. It is generally forward compatible
1139 			 * to zero these bytes - previous behaviour will be
1140 			 * retained. However this does invalidate the CRC and
1141 			 * will force fallback mode until the configuration is
1142 			 * updated. We warn here but do nothing else - the
1143 			 * malloc has zeroed the entire configuration.
1144 			 */
1145 			dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
1146 				 mxt_obj_size(object) - size, type);
1147 		}
1148 
1149 		if (instance >= mxt_obj_instances(object)) {
1150 			dev_err(dev, "Object instances exceeded!\n");
1151 			return -EINVAL;
1152 		}
1153 
1154 		reg = object->start_address + mxt_obj_size(object) * instance;
1155 
1156 		for (i = 0; i < size; i++) {
1157 			ret = sscanf(cfg->data + data_pos, "%hhx%n",
1158 				     &val,
1159 				     &offset);
1160 			if (ret != 1) {
1161 				dev_err(dev, "Bad format in T%d at %d\n",
1162 					type, i);
1163 				return -EINVAL;
1164 			}
1165 			data_pos += offset;
1166 
1167 			if (i > mxt_obj_size(object))
1168 				continue;
1169 
1170 			byte_offset = reg + i - cfg_start_ofs;
1171 
1172 			if (byte_offset >= 0 && byte_offset < config_mem_size) {
1173 				*(config_mem + byte_offset) = val;
1174 			} else {
1175 				dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
1176 					reg, object->type, byte_offset);
1177 				return -EINVAL;
1178 			}
1179 		}
1180 	}
1181 
1182 	return 0;
1183 }
1184 
1185 static int mxt_upload_cfg_mem(struct mxt_data *data, unsigned int cfg_start,
1186 			      u8 *config_mem, size_t config_mem_size)
1187 {
1188 	unsigned int byte_offset = 0;
1189 	int error;
1190 
1191 	/* Write configuration as blocks */
1192 	while (byte_offset < config_mem_size) {
1193 		unsigned int size = config_mem_size - byte_offset;
1194 
1195 		if (size > MXT_MAX_BLOCK_WRITE)
1196 			size = MXT_MAX_BLOCK_WRITE;
1197 
1198 		error = __mxt_write_reg(data->client,
1199 					cfg_start + byte_offset,
1200 					size, config_mem + byte_offset);
1201 		if (error) {
1202 			dev_err(&data->client->dev,
1203 				"Config write error, ret=%d\n", error);
1204 			return error;
1205 		}
1206 
1207 		byte_offset += size;
1208 	}
1209 
1210 	return 0;
1211 }
1212 
1213 /*
1214  * mxt_update_cfg - download configuration to chip
1215  *
1216  * Atmel Raw Config File Format
1217  *
1218  * The first four lines of the raw config file contain:
1219  *  1) Version
1220  *  2) Chip ID Information (first 7 bytes of device memory)
1221  *  3) Chip Information Block 24-bit CRC Checksum
1222  *  4) Chip Configuration 24-bit CRC Checksum
1223  *
1224  * The rest of the file consists of one line per object instance:
1225  *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
1226  *
1227  *   <TYPE> - 2-byte object type as hex
1228  *   <INSTANCE> - 2-byte object instance number as hex
1229  *   <SIZE> - 2-byte object size as hex
1230  *   <CONTENTS> - array of <SIZE> 1-byte hex values
1231  */
1232 static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
1233 {
1234 	struct device *dev = &data->client->dev;
1235 	struct mxt_info cfg_info;
1236 	int ret;
1237 	int offset;
1238 	int data_pos;
1239 	int i;
1240 	int cfg_start_ofs;
1241 	u32 info_crc, config_crc, calculated_crc;
1242 	u8 *config_mem;
1243 	size_t config_mem_size;
1244 
1245 	mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
1246 
1247 	if (strncmp(cfg->data, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
1248 		dev_err(dev, "Unrecognised config file\n");
1249 		return -EINVAL;
1250 	}
1251 
1252 	data_pos = strlen(MXT_CFG_MAGIC);
1253 
1254 	/* Load information block and check */
1255 	for (i = 0; i < sizeof(struct mxt_info); i++) {
1256 		ret = sscanf(cfg->data + data_pos, "%hhx%n",
1257 			     (unsigned char *)&cfg_info + i,
1258 			     &offset);
1259 		if (ret != 1) {
1260 			dev_err(dev, "Bad format\n");
1261 			return -EINVAL;
1262 		}
1263 
1264 		data_pos += offset;
1265 	}
1266 
1267 	if (cfg_info.family_id != data->info.family_id) {
1268 		dev_err(dev, "Family ID mismatch!\n");
1269 		return -EINVAL;
1270 	}
1271 
1272 	if (cfg_info.variant_id != data->info.variant_id) {
1273 		dev_err(dev, "Variant ID mismatch!\n");
1274 		return -EINVAL;
1275 	}
1276 
1277 	/* Read CRCs */
1278 	ret = sscanf(cfg->data + data_pos, "%x%n", &info_crc, &offset);
1279 	if (ret != 1) {
1280 		dev_err(dev, "Bad format: failed to parse Info CRC\n");
1281 		return -EINVAL;
1282 	}
1283 	data_pos += offset;
1284 
1285 	ret = sscanf(cfg->data + data_pos, "%x%n", &config_crc, &offset);
1286 	if (ret != 1) {
1287 		dev_err(dev, "Bad format: failed to parse Config CRC\n");
1288 		return -EINVAL;
1289 	}
1290 	data_pos += offset;
1291 
1292 	/*
1293 	 * The Info Block CRC is calculated over mxt_info and the object
1294 	 * table. If it does not match then we are trying to load the
1295 	 * configuration from a different chip or firmware version, so
1296 	 * the configuration CRC is invalid anyway.
1297 	 */
1298 	if (info_crc == data->info_crc) {
1299 		if (config_crc == 0 || data->config_crc == 0) {
1300 			dev_info(dev, "CRC zero, attempting to apply config\n");
1301 		} else if (config_crc == data->config_crc) {
1302 			dev_dbg(dev, "Config CRC 0x%06X: OK\n",
1303 				 data->config_crc);
1304 			return 0;
1305 		} else {
1306 			dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
1307 				 data->config_crc, config_crc);
1308 		}
1309 	} else {
1310 		dev_warn(dev,
1311 			 "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
1312 			 data->info_crc, info_crc);
1313 	}
1314 
1315 	/* Malloc memory to store configuration */
1316 	cfg_start_ofs = MXT_OBJECT_START +
1317 			data->info.object_num * sizeof(struct mxt_object) +
1318 			MXT_INFO_CHECKSUM_SIZE;
1319 	config_mem_size = data->mem_size - cfg_start_ofs;
1320 	config_mem = kzalloc(config_mem_size, GFP_KERNEL);
1321 	if (!config_mem) {
1322 		dev_err(dev, "Failed to allocate memory\n");
1323 		return -ENOMEM;
1324 	}
1325 
1326 	ret = mxt_prepare_cfg_mem(data, cfg, data_pos, cfg_start_ofs,
1327 				  config_mem, config_mem_size);
1328 	if (ret)
1329 		goto release_mem;
1330 
1331 	/* Calculate crc of the received configs (not the raw config file) */
1332 	if (data->T7_address < cfg_start_ofs) {
1333 		dev_err(dev, "Bad T7 address, T7addr = %x, config offset %x\n",
1334 			data->T7_address, cfg_start_ofs);
1335 		ret = 0;
1336 		goto release_mem;
1337 	}
1338 
1339 	calculated_crc = mxt_calculate_crc(config_mem,
1340 					   data->T7_address - cfg_start_ofs,
1341 					   config_mem_size);
1342 
1343 	if (config_crc > 0 && config_crc != calculated_crc)
1344 		dev_warn(dev, "Config CRC error, calculated=%06X, file=%06X\n",
1345 			 calculated_crc, config_crc);
1346 
1347 	ret = mxt_upload_cfg_mem(data, cfg_start_ofs,
1348 				 config_mem, config_mem_size);
1349 	if (ret)
1350 		goto release_mem;
1351 
1352 	mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
1353 
1354 	ret = mxt_soft_reset(data);
1355 	if (ret)
1356 		goto release_mem;
1357 
1358 	dev_info(dev, "Config successfully updated\n");
1359 
1360 release_mem:
1361 	kfree(config_mem);
1362 	return ret;
1363 }
1364 
1365 static int mxt_acquire_irq(struct mxt_data *data)
1366 {
1367 	int error;
1368 
1369 	enable_irq(data->irq);
1370 
1371 	error = mxt_process_messages_until_invalid(data);
1372 	if (error)
1373 		return error;
1374 
1375 	return 0;
1376 }
1377 
1378 static int mxt_get_info(struct mxt_data *data)
1379 {
1380 	struct i2c_client *client = data->client;
1381 	struct mxt_info *info = &data->info;
1382 	int error;
1383 
1384 	/* Read 7-byte info block starting at address 0 */
1385 	error = __mxt_read_reg(client, MXT_INFO, sizeof(*info), info);
1386 	if (error)
1387 		return error;
1388 
1389 	return 0;
1390 }
1391 
1392 static void mxt_free_input_device(struct mxt_data *data)
1393 {
1394 	if (data->input_dev) {
1395 		input_unregister_device(data->input_dev);
1396 		data->input_dev = NULL;
1397 	}
1398 }
1399 
1400 static void mxt_free_object_table(struct mxt_data *data)
1401 {
1402 	kfree(data->object_table);
1403 	data->object_table = NULL;
1404 	kfree(data->msg_buf);
1405 	data->msg_buf = NULL;
1406 	data->T5_address = 0;
1407 	data->T5_msg_size = 0;
1408 	data->T6_reportid = 0;
1409 	data->T7_address = 0;
1410 	data->T9_reportid_min = 0;
1411 	data->T9_reportid_max = 0;
1412 	data->T19_reportid = 0;
1413 	data->T44_address = 0;
1414 	data->max_reportid = 0;
1415 }
1416 
1417 static int mxt_get_object_table(struct mxt_data *data)
1418 {
1419 	struct i2c_client *client = data->client;
1420 	size_t table_size;
1421 	struct mxt_object *object_table;
1422 	int error;
1423 	int i;
1424 	u8 reportid;
1425 	u16 end_address;
1426 
1427 	table_size = data->info.object_num * sizeof(struct mxt_object);
1428 	object_table = kzalloc(table_size, GFP_KERNEL);
1429 	if (!object_table) {
1430 		dev_err(&data->client->dev, "Failed to allocate memory\n");
1431 		return -ENOMEM;
1432 	}
1433 
1434 	error = __mxt_read_reg(client, MXT_OBJECT_START, table_size,
1435 			object_table);
1436 	if (error) {
1437 		kfree(object_table);
1438 		return error;
1439 	}
1440 
1441 	/* Valid Report IDs start counting from 1 */
1442 	reportid = 1;
1443 	data->mem_size = 0;
1444 	for (i = 0; i < data->info.object_num; i++) {
1445 		struct mxt_object *object = object_table + i;
1446 		u8 min_id, max_id;
1447 
1448 		le16_to_cpus(&object->start_address);
1449 
1450 		if (object->num_report_ids) {
1451 			min_id = reportid;
1452 			reportid += object->num_report_ids *
1453 					mxt_obj_instances(object);
1454 			max_id = reportid - 1;
1455 		} else {
1456 			min_id = 0;
1457 			max_id = 0;
1458 		}
1459 
1460 		dev_dbg(&data->client->dev,
1461 			"T%u Start:%u Size:%zu Instances:%zu Report IDs:%u-%u\n",
1462 			object->type, object->start_address,
1463 			mxt_obj_size(object), mxt_obj_instances(object),
1464 			min_id, max_id);
1465 
1466 		switch (object->type) {
1467 		case MXT_GEN_MESSAGE_T5:
1468 			if (data->info.family_id == 0x80 &&
1469 			    data->info.version < 0x20) {
1470 				/*
1471 				 * On mXT224 firmware versions prior to V2.0
1472 				 * read and discard unused CRC byte otherwise
1473 				 * DMA reads are misaligned.
1474 				 */
1475 				data->T5_msg_size = mxt_obj_size(object);
1476 			} else {
1477 				/* CRC not enabled, so skip last byte */
1478 				data->T5_msg_size = mxt_obj_size(object) - 1;
1479 			}
1480 			data->T5_address = object->start_address;
1481 			break;
1482 		case MXT_GEN_COMMAND_T6:
1483 			data->T6_reportid = min_id;
1484 			data->T6_address = object->start_address;
1485 			break;
1486 		case MXT_GEN_POWER_T7:
1487 			data->T7_address = object->start_address;
1488 			break;
1489 		case MXT_TOUCH_MULTI_T9:
1490 			data->T9_reportid_min = min_id;
1491 			data->T9_reportid_max = max_id;
1492 			data->num_touchids = object->num_report_ids
1493 						* mxt_obj_instances(object);
1494 			break;
1495 		case MXT_SPT_MESSAGECOUNT_T44:
1496 			data->T44_address = object->start_address;
1497 			break;
1498 		case MXT_SPT_GPIOPWM_T19:
1499 			data->T19_reportid = min_id;
1500 			break;
1501 		}
1502 
1503 		end_address = object->start_address
1504 			+ mxt_obj_size(object) * mxt_obj_instances(object) - 1;
1505 
1506 		if (end_address >= data->mem_size)
1507 			data->mem_size = end_address + 1;
1508 	}
1509 
1510 	/* Store maximum reportid */
1511 	data->max_reportid = reportid;
1512 
1513 	/* If T44 exists, T5 position has to be directly after */
1514 	if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
1515 		dev_err(&client->dev, "Invalid T44 position\n");
1516 		error = -EINVAL;
1517 		goto free_object_table;
1518 	}
1519 
1520 	data->msg_buf = kcalloc(data->max_reportid,
1521 				data->T5_msg_size, GFP_KERNEL);
1522 	if (!data->msg_buf) {
1523 		dev_err(&client->dev, "Failed to allocate message buffer\n");
1524 		error = -ENOMEM;
1525 		goto free_object_table;
1526 	}
1527 
1528 	data->object_table = object_table;
1529 
1530 	return 0;
1531 
1532 free_object_table:
1533 	mxt_free_object_table(data);
1534 	return error;
1535 }
1536 
1537 static int mxt_read_t9_resolution(struct mxt_data *data)
1538 {
1539 	struct i2c_client *client = data->client;
1540 	int error;
1541 	struct t9_range range;
1542 	unsigned char orient;
1543 	struct mxt_object *object;
1544 
1545 	object = mxt_get_object(data, MXT_TOUCH_MULTI_T9);
1546 	if (!object)
1547 		return -EINVAL;
1548 
1549 	error = __mxt_read_reg(client,
1550 			       object->start_address + MXT_T9_RANGE,
1551 			       sizeof(range), &range);
1552 	if (error)
1553 		return error;
1554 
1555 	le16_to_cpus(&range.x);
1556 	le16_to_cpus(&range.y);
1557 
1558 	error =  __mxt_read_reg(client,
1559 				object->start_address + MXT_T9_ORIENT,
1560 				1, &orient);
1561 	if (error)
1562 		return error;
1563 
1564 	/* Handle default values */
1565 	if (range.x == 0)
1566 		range.x = 1023;
1567 
1568 	if (range.y == 0)
1569 		range.y = 1023;
1570 
1571 	if (orient & MXT_T9_ORIENT_SWITCH) {
1572 		data->max_x = range.y;
1573 		data->max_y = range.x;
1574 	} else {
1575 		data->max_x = range.x;
1576 		data->max_y = range.y;
1577 	}
1578 
1579 	dev_dbg(&client->dev,
1580 		"Touchscreen size X%uY%u\n", data->max_x, data->max_y);
1581 
1582 	return 0;
1583 }
1584 
1585 static int mxt_input_open(struct input_dev *dev);
1586 static void mxt_input_close(struct input_dev *dev);
1587 
1588 static int mxt_initialize_t9_input_device(struct mxt_data *data)
1589 {
1590 	struct device *dev = &data->client->dev;
1591 	const struct mxt_platform_data *pdata = data->pdata;
1592 	struct input_dev *input_dev;
1593 	int error;
1594 	unsigned int num_mt_slots;
1595 	unsigned int mt_flags = 0;
1596 	int i;
1597 
1598 	error = mxt_read_t9_resolution(data);
1599 	if (error)
1600 		dev_warn(dev, "Failed to initialize T9 resolution\n");
1601 
1602 	input_dev = input_allocate_device();
1603 	if (!input_dev) {
1604 		dev_err(dev, "Failed to allocate memory\n");
1605 		return -ENOMEM;
1606 	}
1607 
1608 	input_dev->name = "Atmel maXTouch Touchscreen";
1609 	input_dev->phys = data->phys;
1610 	input_dev->id.bustype = BUS_I2C;
1611 	input_dev->dev.parent = dev;
1612 	input_dev->open = mxt_input_open;
1613 	input_dev->close = mxt_input_close;
1614 
1615 	__set_bit(EV_ABS, input_dev->evbit);
1616 	__set_bit(EV_KEY, input_dev->evbit);
1617 	__set_bit(BTN_TOUCH, input_dev->keybit);
1618 
1619 	if (pdata->t19_num_keys) {
1620 		__set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1621 
1622 		for (i = 0; i < pdata->t19_num_keys; i++)
1623 			if (pdata->t19_keymap[i] != KEY_RESERVED)
1624 				input_set_capability(input_dev, EV_KEY,
1625 						     pdata->t19_keymap[i]);
1626 
1627 		mt_flags |= INPUT_MT_POINTER;
1628 
1629 		input_abs_set_res(input_dev, ABS_X, MXT_PIXELS_PER_MM);
1630 		input_abs_set_res(input_dev, ABS_Y, MXT_PIXELS_PER_MM);
1631 		input_abs_set_res(input_dev, ABS_MT_POSITION_X,
1632 				  MXT_PIXELS_PER_MM);
1633 		input_abs_set_res(input_dev, ABS_MT_POSITION_Y,
1634 				  MXT_PIXELS_PER_MM);
1635 
1636 		input_dev->name = "Atmel maXTouch Touchpad";
1637 	}
1638 
1639 	/* For single touch */
1640 	input_set_abs_params(input_dev, ABS_X,
1641 			     0, data->max_x, 0, 0);
1642 	input_set_abs_params(input_dev, ABS_Y,
1643 			     0, data->max_y, 0, 0);
1644 	input_set_abs_params(input_dev, ABS_PRESSURE,
1645 			     0, 255, 0, 0);
1646 
1647 	/* For multi touch */
1648 	num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
1649 	error = input_mt_init_slots(input_dev, num_mt_slots, mt_flags);
1650 	if (error) {
1651 		dev_err(dev, "Error %d initialising slots\n", error);
1652 		goto err_free_mem;
1653 	}
1654 
1655 	input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
1656 			     0, MXT_MAX_AREA, 0, 0);
1657 	input_set_abs_params(input_dev, ABS_MT_POSITION_X,
1658 			     0, data->max_x, 0, 0);
1659 	input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
1660 			     0, data->max_y, 0, 0);
1661 	input_set_abs_params(input_dev, ABS_MT_PRESSURE,
1662 			     0, 255, 0, 0);
1663 
1664 	input_set_drvdata(input_dev, data);
1665 
1666 	error = input_register_device(input_dev);
1667 	if (error) {
1668 		dev_err(dev, "Error %d registering input device\n", error);
1669 		goto err_free_mem;
1670 	}
1671 
1672 	data->input_dev = input_dev;
1673 
1674 	return 0;
1675 
1676 err_free_mem:
1677 	input_free_device(input_dev);
1678 	return error;
1679 }
1680 
1681 static int mxt_configure_objects(struct mxt_data *data,
1682 				 const struct firmware *cfg);
1683 
1684 static void mxt_config_cb(const struct firmware *cfg, void *ctx)
1685 {
1686 	mxt_configure_objects(ctx, cfg);
1687 	release_firmware(cfg);
1688 }
1689 
1690 static int mxt_initialize(struct mxt_data *data)
1691 {
1692 	struct i2c_client *client = data->client;
1693 	int recovery_attempts = 0;
1694 	int error;
1695 
1696 	while (1) {
1697 		error = mxt_get_info(data);
1698 		if (!error)
1699 			break;
1700 
1701 		/* Check bootloader state */
1702 		error = mxt_probe_bootloader(data, false);
1703 		if (error) {
1704 			dev_info(&client->dev, "Trying alternate bootloader address\n");
1705 			error = mxt_probe_bootloader(data, true);
1706 			if (error) {
1707 				/* Chip is not in appmode or bootloader mode */
1708 				return error;
1709 			}
1710 		}
1711 
1712 		/* OK, we are in bootloader, see if we can recover */
1713 		if (++recovery_attempts > 1) {
1714 			dev_err(&client->dev, "Could not recover from bootloader mode\n");
1715 			/*
1716 			 * We can reflash from this state, so do not
1717 			 * abort initialization.
1718 			 */
1719 			data->in_bootloader = true;
1720 			return 0;
1721 		}
1722 
1723 		/* Attempt to exit bootloader into app mode */
1724 		mxt_send_bootloader_cmd(data, false);
1725 		msleep(MXT_FW_RESET_TIME);
1726 	}
1727 
1728 	/* Get object table information */
1729 	error = mxt_get_object_table(data);
1730 	if (error) {
1731 		dev_err(&client->dev, "Error %d reading object table\n", error);
1732 		return error;
1733 	}
1734 
1735 	error = mxt_acquire_irq(data);
1736 	if (error)
1737 		goto err_free_object_table;
1738 
1739 	error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
1740 					&client->dev, GFP_KERNEL, data,
1741 					mxt_config_cb);
1742 	if (error) {
1743 		dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
1744 			error);
1745 		goto err_free_object_table;
1746 	}
1747 
1748 	return 0;
1749 
1750 err_free_object_table:
1751 	mxt_free_object_table(data);
1752 	return error;
1753 }
1754 
1755 static int mxt_configure_objects(struct mxt_data *data,
1756 				 const struct firmware *cfg)
1757 {
1758 	struct device *dev = &data->client->dev;
1759 	struct mxt_info *info = &data->info;
1760 	int error;
1761 
1762 	if (cfg) {
1763 		error = mxt_update_cfg(data, cfg);
1764 		if (error)
1765 			dev_warn(dev, "Error %d updating config\n", error);
1766 	}
1767 
1768 	error = mxt_initialize_t9_input_device(data);
1769 	if (error)
1770 		return error;
1771 
1772 	dev_info(dev,
1773 		 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
1774 		 info->family_id, info->variant_id, info->version >> 4,
1775 		 info->version & 0xf, info->build, info->object_num);
1776 
1777 	return 0;
1778 }
1779 
1780 /* Firmware Version is returned as Major.Minor.Build */
1781 static ssize_t mxt_fw_version_show(struct device *dev,
1782 				   struct device_attribute *attr, char *buf)
1783 {
1784 	struct mxt_data *data = dev_get_drvdata(dev);
1785 	struct mxt_info *info = &data->info;
1786 	return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
1787 			 info->version >> 4, info->version & 0xf, info->build);
1788 }
1789 
1790 /* Hardware Version is returned as FamilyID.VariantID */
1791 static ssize_t mxt_hw_version_show(struct device *dev,
1792 				   struct device_attribute *attr, char *buf)
1793 {
1794 	struct mxt_data *data = dev_get_drvdata(dev);
1795 	struct mxt_info *info = &data->info;
1796 	return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
1797 			 info->family_id, info->variant_id);
1798 }
1799 
1800 static ssize_t mxt_show_instance(char *buf, int count,
1801 				 struct mxt_object *object, int instance,
1802 				 const u8 *val)
1803 {
1804 	int i;
1805 
1806 	if (mxt_obj_instances(object) > 1)
1807 		count += scnprintf(buf + count, PAGE_SIZE - count,
1808 				   "Instance %u\n", instance);
1809 
1810 	for (i = 0; i < mxt_obj_size(object); i++)
1811 		count += scnprintf(buf + count, PAGE_SIZE - count,
1812 				"\t[%2u]: %02x (%d)\n", i, val[i], val[i]);
1813 	count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
1814 
1815 	return count;
1816 }
1817 
1818 static ssize_t mxt_object_show(struct device *dev,
1819 				    struct device_attribute *attr, char *buf)
1820 {
1821 	struct mxt_data *data = dev_get_drvdata(dev);
1822 	struct mxt_object *object;
1823 	int count = 0;
1824 	int i, j;
1825 	int error;
1826 	u8 *obuf;
1827 
1828 	/* Pre-allocate buffer large enough to hold max sized object. */
1829 	obuf = kmalloc(256, GFP_KERNEL);
1830 	if (!obuf)
1831 		return -ENOMEM;
1832 
1833 	error = 0;
1834 	for (i = 0; i < data->info.object_num; i++) {
1835 		object = data->object_table + i;
1836 
1837 		if (!mxt_object_readable(object->type))
1838 			continue;
1839 
1840 		count += scnprintf(buf + count, PAGE_SIZE - count,
1841 				"T%u:\n", object->type);
1842 
1843 		for (j = 0; j < mxt_obj_instances(object); j++) {
1844 			u16 size = mxt_obj_size(object);
1845 			u16 addr = object->start_address + j * size;
1846 
1847 			error = __mxt_read_reg(data->client, addr, size, obuf);
1848 			if (error)
1849 				goto done;
1850 
1851 			count = mxt_show_instance(buf, count, object, j, obuf);
1852 		}
1853 	}
1854 
1855 done:
1856 	kfree(obuf);
1857 	return error ?: count;
1858 }
1859 
1860 static int mxt_check_firmware_format(struct device *dev,
1861 				     const struct firmware *fw)
1862 {
1863 	unsigned int pos = 0;
1864 	char c;
1865 
1866 	while (pos < fw->size) {
1867 		c = *(fw->data + pos);
1868 
1869 		if (c < '0' || (c > '9' && c < 'A') || c > 'F')
1870 			return 0;
1871 
1872 		pos++;
1873 	}
1874 
1875 	/*
1876 	 * To convert file try:
1877 	 * xxd -r -p mXTXXX__APP_VX-X-XX.enc > maxtouch.fw
1878 	 */
1879 	dev_err(dev, "Aborting: firmware file must be in binary format\n");
1880 
1881 	return -EINVAL;
1882 }
1883 
1884 static int mxt_load_fw(struct device *dev, const char *fn)
1885 {
1886 	struct mxt_data *data = dev_get_drvdata(dev);
1887 	const struct firmware *fw = NULL;
1888 	unsigned int frame_size;
1889 	unsigned int pos = 0;
1890 	unsigned int retry = 0;
1891 	unsigned int frame = 0;
1892 	int ret;
1893 
1894 	ret = request_firmware(&fw, fn, dev);
1895 	if (ret) {
1896 		dev_err(dev, "Unable to open firmware %s\n", fn);
1897 		return ret;
1898 	}
1899 
1900 	/* Check for incorrect enc file */
1901 	ret = mxt_check_firmware_format(dev, fw);
1902 	if (ret)
1903 		goto release_firmware;
1904 
1905 	if (!data->in_bootloader) {
1906 		/* Change to the bootloader mode */
1907 		data->in_bootloader = true;
1908 
1909 		ret = mxt_t6_command(data, MXT_COMMAND_RESET,
1910 				     MXT_BOOT_VALUE, false);
1911 		if (ret)
1912 			goto release_firmware;
1913 
1914 		msleep(MXT_RESET_TIME);
1915 
1916 		/* Do not need to scan since we know family ID */
1917 		ret = mxt_lookup_bootloader_address(data, 0);
1918 		if (ret)
1919 			goto release_firmware;
1920 
1921 		mxt_free_input_device(data);
1922 		mxt_free_object_table(data);
1923 	} else {
1924 		enable_irq(data->irq);
1925 	}
1926 
1927 	reinit_completion(&data->bl_completion);
1928 
1929 	ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
1930 	if (ret) {
1931 		/* Bootloader may still be unlocked from previous attempt */
1932 		ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
1933 		if (ret)
1934 			goto disable_irq;
1935 	} else {
1936 		dev_info(dev, "Unlocking bootloader\n");
1937 
1938 		/* Unlock bootloader */
1939 		ret = mxt_send_bootloader_cmd(data, true);
1940 		if (ret)
1941 			goto disable_irq;
1942 	}
1943 
1944 	while (pos < fw->size) {
1945 		ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
1946 		if (ret)
1947 			goto disable_irq;
1948 
1949 		frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1));
1950 
1951 		/* Take account of CRC bytes */
1952 		frame_size += 2;
1953 
1954 		/* Write one frame to device */
1955 		ret = mxt_bootloader_write(data, fw->data + pos, frame_size);
1956 		if (ret)
1957 			goto disable_irq;
1958 
1959 		ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
1960 		if (ret) {
1961 			retry++;
1962 
1963 			/* Back off by 20ms per retry */
1964 			msleep(retry * 20);
1965 
1966 			if (retry > 20) {
1967 				dev_err(dev, "Retry count exceeded\n");
1968 				goto disable_irq;
1969 			}
1970 		} else {
1971 			retry = 0;
1972 			pos += frame_size;
1973 			frame++;
1974 		}
1975 
1976 		if (frame % 50 == 0)
1977 			dev_dbg(dev, "Sent %d frames, %d/%zd bytes\n",
1978 				frame, pos, fw->size);
1979 	}
1980 
1981 	/* Wait for flash. */
1982 	ret = mxt_wait_for_completion(data, &data->bl_completion,
1983 				      MXT_FW_RESET_TIME);
1984 	if (ret)
1985 		goto disable_irq;
1986 
1987 	dev_dbg(dev, "Sent %d frames, %d bytes\n", frame, pos);
1988 
1989 	/*
1990 	 * Wait for device to reset. Some bootloader versions do not assert
1991 	 * the CHG line after bootloading has finished, so ignore potential
1992 	 * errors.
1993 	 */
1994 	mxt_wait_for_completion(data, &data->bl_completion, MXT_FW_RESET_TIME);
1995 
1996 	data->in_bootloader = false;
1997 
1998 disable_irq:
1999 	disable_irq(data->irq);
2000 release_firmware:
2001 	release_firmware(fw);
2002 	return ret;
2003 }
2004 
2005 static ssize_t mxt_update_fw_store(struct device *dev,
2006 					struct device_attribute *attr,
2007 					const char *buf, size_t count)
2008 {
2009 	struct mxt_data *data = dev_get_drvdata(dev);
2010 	int error;
2011 
2012 	error = mxt_load_fw(dev, MXT_FW_NAME);
2013 	if (error) {
2014 		dev_err(dev, "The firmware update failed(%d)\n", error);
2015 		count = error;
2016 	} else {
2017 		dev_info(dev, "The firmware update succeeded\n");
2018 
2019 		error = mxt_initialize(data);
2020 		if (error)
2021 			return error;
2022 	}
2023 
2024 	return count;
2025 }
2026 
2027 static DEVICE_ATTR(fw_version, S_IRUGO, mxt_fw_version_show, NULL);
2028 static DEVICE_ATTR(hw_version, S_IRUGO, mxt_hw_version_show, NULL);
2029 static DEVICE_ATTR(object, S_IRUGO, mxt_object_show, NULL);
2030 static DEVICE_ATTR(update_fw, S_IWUSR, NULL, mxt_update_fw_store);
2031 
2032 static struct attribute *mxt_attrs[] = {
2033 	&dev_attr_fw_version.attr,
2034 	&dev_attr_hw_version.attr,
2035 	&dev_attr_object.attr,
2036 	&dev_attr_update_fw.attr,
2037 	NULL
2038 };
2039 
2040 static const struct attribute_group mxt_attr_group = {
2041 	.attrs = mxt_attrs,
2042 };
2043 
2044 static void mxt_start(struct mxt_data *data)
2045 {
2046 	/* Touch enable */
2047 	mxt_write_object(data,
2048 			MXT_TOUCH_MULTI_T9, MXT_TOUCH_CTRL, 0x83);
2049 }
2050 
2051 static void mxt_stop(struct mxt_data *data)
2052 {
2053 	/* Touch disable */
2054 	mxt_write_object(data,
2055 			MXT_TOUCH_MULTI_T9, MXT_TOUCH_CTRL, 0);
2056 }
2057 
2058 static int mxt_input_open(struct input_dev *dev)
2059 {
2060 	struct mxt_data *data = input_get_drvdata(dev);
2061 
2062 	mxt_start(data);
2063 
2064 	return 0;
2065 }
2066 
2067 static void mxt_input_close(struct input_dev *dev)
2068 {
2069 	struct mxt_data *data = input_get_drvdata(dev);
2070 
2071 	mxt_stop(data);
2072 }
2073 
2074 #ifdef CONFIG_OF
2075 static struct mxt_platform_data *mxt_parse_dt(struct i2c_client *client)
2076 {
2077 	struct mxt_platform_data *pdata;
2078 	u32 *keymap;
2079 	u32 keycode;
2080 	int proplen, i, ret;
2081 
2082 	if (!client->dev.of_node)
2083 		return ERR_PTR(-ENODEV);
2084 
2085 	pdata = devm_kzalloc(&client->dev, sizeof(*pdata), GFP_KERNEL);
2086 	if (!pdata)
2087 		return ERR_PTR(-ENOMEM);
2088 
2089 	if (of_find_property(client->dev.of_node, "linux,gpio-keymap",
2090 			     &proplen)) {
2091 		pdata->t19_num_keys = proplen / sizeof(u32);
2092 
2093 		keymap = devm_kzalloc(&client->dev,
2094 				pdata->t19_num_keys * sizeof(keymap[0]),
2095 				GFP_KERNEL);
2096 		if (!keymap)
2097 			return ERR_PTR(-ENOMEM);
2098 
2099 		for (i = 0; i < pdata->t19_num_keys; i++) {
2100 			ret = of_property_read_u32_index(client->dev.of_node,
2101 					"linux,gpio-keymap", i, &keycode);
2102 			if (ret)
2103 				keycode = KEY_RESERVED;
2104 
2105 			keymap[i] = keycode;
2106 		}
2107 
2108 		pdata->t19_keymap = keymap;
2109 	}
2110 
2111 	return pdata;
2112 }
2113 #else
2114 static struct mxt_platform_data *mxt_parse_dt(struct i2c_client *client)
2115 {
2116 	dev_dbg(&client->dev, "No platform data specified\n");
2117 	return ERR_PTR(-EINVAL);
2118 }
2119 #endif
2120 
2121 static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
2122 {
2123 	struct mxt_data *data;
2124 	const struct mxt_platform_data *pdata;
2125 	int error;
2126 
2127 	pdata = dev_get_platdata(&client->dev);
2128 	if (!pdata) {
2129 		pdata = mxt_parse_dt(client);
2130 		if (IS_ERR(pdata))
2131 			return PTR_ERR(pdata);
2132 	}
2133 
2134 	data = kzalloc(sizeof(struct mxt_data), GFP_KERNEL);
2135 	if (!data) {
2136 		dev_err(&client->dev, "Failed to allocate memory\n");
2137 		return -ENOMEM;
2138 	}
2139 
2140 	snprintf(data->phys, sizeof(data->phys), "i2c-%u-%04x/input0",
2141 		 client->adapter->nr, client->addr);
2142 
2143 	data->client = client;
2144 	data->pdata = pdata;
2145 	data->irq = client->irq;
2146 	i2c_set_clientdata(client, data);
2147 
2148 	init_completion(&data->bl_completion);
2149 	init_completion(&data->reset_completion);
2150 	init_completion(&data->crc_completion);
2151 
2152 	error = request_threaded_irq(client->irq, NULL, mxt_interrupt,
2153 				     pdata->irqflags | IRQF_ONESHOT,
2154 				     client->name, data);
2155 	if (error) {
2156 		dev_err(&client->dev, "Failed to register interrupt\n");
2157 		goto err_free_mem;
2158 	}
2159 
2160 	disable_irq(client->irq);
2161 
2162 	error = mxt_initialize(data);
2163 	if (error)
2164 		goto err_free_irq;
2165 
2166 	error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
2167 	if (error) {
2168 		dev_err(&client->dev, "Failure %d creating sysfs group\n",
2169 			error);
2170 		goto err_free_object;
2171 	}
2172 
2173 	return 0;
2174 
2175 err_free_object:
2176 	mxt_free_input_device(data);
2177 	mxt_free_object_table(data);
2178 err_free_irq:
2179 	free_irq(client->irq, data);
2180 err_free_mem:
2181 	kfree(data);
2182 	return error;
2183 }
2184 
2185 static int mxt_remove(struct i2c_client *client)
2186 {
2187 	struct mxt_data *data = i2c_get_clientdata(client);
2188 
2189 	sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
2190 	free_irq(data->irq, data);
2191 	mxt_free_input_device(data);
2192 	mxt_free_object_table(data);
2193 	kfree(data);
2194 
2195 	return 0;
2196 }
2197 
2198 static int __maybe_unused mxt_suspend(struct device *dev)
2199 {
2200 	struct i2c_client *client = to_i2c_client(dev);
2201 	struct mxt_data *data = i2c_get_clientdata(client);
2202 	struct input_dev *input_dev = data->input_dev;
2203 
2204 	mutex_lock(&input_dev->mutex);
2205 
2206 	if (input_dev->users)
2207 		mxt_stop(data);
2208 
2209 	mutex_unlock(&input_dev->mutex);
2210 
2211 	return 0;
2212 }
2213 
2214 static int __maybe_unused mxt_resume(struct device *dev)
2215 {
2216 	struct i2c_client *client = to_i2c_client(dev);
2217 	struct mxt_data *data = i2c_get_clientdata(client);
2218 	struct input_dev *input_dev = data->input_dev;
2219 
2220 	mxt_soft_reset(data);
2221 
2222 	mutex_lock(&input_dev->mutex);
2223 
2224 	if (input_dev->users)
2225 		mxt_start(data);
2226 
2227 	mutex_unlock(&input_dev->mutex);
2228 
2229 	return 0;
2230 }
2231 
2232 static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
2233 
2234 static const struct of_device_id mxt_of_match[] = {
2235 	{ .compatible = "atmel,maxtouch", },
2236 	{},
2237 };
2238 MODULE_DEVICE_TABLE(of, mxt_of_match);
2239 
2240 static const struct i2c_device_id mxt_id[] = {
2241 	{ "qt602240_ts", 0 },
2242 	{ "atmel_mxt_ts", 0 },
2243 	{ "atmel_mxt_tp", 0 },
2244 	{ "mXT224", 0 },
2245 	{ }
2246 };
2247 MODULE_DEVICE_TABLE(i2c, mxt_id);
2248 
2249 static struct i2c_driver mxt_driver = {
2250 	.driver = {
2251 		.name	= "atmel_mxt_ts",
2252 		.owner	= THIS_MODULE,
2253 		.of_match_table = of_match_ptr(mxt_of_match),
2254 		.pm	= &mxt_pm_ops,
2255 	},
2256 	.probe		= mxt_probe,
2257 	.remove		= mxt_remove,
2258 	.id_table	= mxt_id,
2259 };
2260 
2261 module_i2c_driver(mxt_driver);
2262 
2263 /* Module information */
2264 MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
2265 MODULE_DESCRIPTION("Atmel maXTouch Touchscreen driver");
2266 MODULE_LICENSE("GPL");
2267