Input: atmel_mxt_ts - calculate and check CRC in config file

By validating the checksum, we can identify if the configuration is
corrupt.  In addition, this patch writes the configuration in a short
series of block writes rather than as many individual values.

Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk>
Acked-by: Benson Leung <bleung@chromium.org>
Acked-by: Yufeng Shen <miletus@chromium.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

1 files changed, 177 insertions, 55 deletions

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index c6b5e7dbd942..d2feb9c771a4 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -48,6 +48,8 @@
 #define MXT_OBJECT_START        0x07
 
 #define MXT_OBJECT_SIZE         6
+#define MXT_INFO_CHECKSUM_SIZE  3
+#define MXT_MAX_BLOCK_WRITE     256
 
 /* Object types */
 #define MXT_DEBUG_DIAGNOSTIC_T37        37
@@ -238,12 +240,15 @@ struct mxt_data {
         unsigned int max_x;
         unsigned int max_y;
         bool in_bootloader;
+        u16 mem_size;
         u32 config_crc;
+        u32 info_crc;
         u8 bootloader_addr;
 
         /* Cached parameters from object table */
         u8 T6_reportid;
         u16 T6_address;
+        u16 T7_address;
         u8 T9_reportid_min;
         u8 T9_reportid_max;
         u8 T19_reportid;
@@ -849,6 +854,45 @@ static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
         mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
 }
 
+static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
+{
+        static const unsigned int crcpoly = 0x80001B;
+        u32 result;
+        u32 data_word;
+
+        data_word = (secondbyte << 8) | firstbyte;
+        result = ((*crc << 1) ^ data_word);
+
+        if (result & 0x1000000)
+                result ^= crcpoly;
+
+        *crc = result;
+}
+
+static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
+{
+        u32 crc = 0;
+        u8 *ptr = base + start_off;
+        u8 *last_val = base + end_off - 1;
+
+        if (end_off < start_off)
+                return -EINVAL;
+
+        while (ptr < last_val) {
+                mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
+                ptr += 2;
+        }
+
+        /* if len is odd, fill the last byte with 0 */
+        if (ptr == last_val)
+                mxt_calc_crc24(&crc, *ptr, 0);
+
+        /* Mask to 24-bit */
+        crc &= 0x00FFFFFF;
+
+        return crc;
+}
+
 /*
  * mxt_update_cfg - download configuration to chip
  *
@@ -875,9 +919,13 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
         struct mxt_object *object;
         int ret;
         int offset;
-        int pos;
+        int data_pos;
+        int byte_offset;
         int i;
-        u32 info_crc, config_crc;
+        int cfg_start_ofs;
+        u32 info_crc, config_crc, calculated_crc;
+        u8 *config_mem;
+        size_t config_mem_size;
         unsigned int type, instance, size;
         u8 val;
         u16 reg;
@@ -890,11 +938,11 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
                 goto release;
         }
 
-        pos = strlen(MXT_CFG_MAGIC);
+        data_pos = strlen(MXT_CFG_MAGIC);
 
         /* Load information block and check */
         for (i = 0; i < sizeof(struct mxt_info); i++) {
-                ret = sscanf(cfg->data + pos, "%hhx%n",
+                ret = sscanf(cfg->data + data_pos, "%hhx%n",
                              (unsigned char *)&cfg_info + i,
                              &offset);
                 if (ret != 1) {
@@ -903,7 +951,7 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
                         goto release;
                 }
 
-                pos += offset;
+                data_pos += offset;
         }
 
         if (cfg_info.family_id != data->info.family_id) {
@@ -918,125 +966,188 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
                 goto release;
         }
 
-        if (cfg_info.version != data->info.version)
-                dev_err(dev, "Warning: version mismatch!\n");
-
-        if (cfg_info.build != data->info.build)
-                dev_err(dev, "Warning: build num mismatch!\n");
-
-        ret = sscanf(cfg->data + pos, "%x%n", &info_crc, &offset);
+        /* Read CRCs */
+        ret = sscanf(cfg->data + data_pos, "%x%n", &info_crc, &offset);
         if (ret != 1) {
                 dev_err(dev, "Bad format: failed to parse Info CRC\n");
                 ret = -EINVAL;
                 goto release;
         }
-        pos += offset;
+        data_pos += offset;
 
-        /* Check config CRC */
-        ret = sscanf(cfg->data + pos, "%x%n", &config_crc, &offset);
+        ret = sscanf(cfg->data + data_pos, "%x%n", &config_crc, &offset);
         if (ret != 1) {
                 dev_err(dev, "Bad format: failed to parse Config CRC\n");
                 ret = -EINVAL;
                 goto release;
         }
-        pos += offset;
+        data_pos += offset;
 
-        if (data->config_crc == config_crc) {
-                dev_dbg(dev, "Config CRC 0x%06X: OK\n", config_crc);
-                ret = 0;
-                goto release;
+        /*
+         * The Info Block CRC is calculated over mxt_info and the object
+         * table. If it does not match then we are trying to load the
+         * configuration from a different chip or firmware version, so
+         * the configuration CRC is invalid anyway.
+         */
+        if (info_crc == data->info_crc) {
+                if (config_crc == 0 || data->config_crc == 0) {
+                        dev_info(dev, "CRC zero, attempting to apply config\n");
+                } else if (config_crc == data->config_crc) {
+                        dev_dbg(dev, "Config CRC 0x%06X: OK\n",
+                                 data->config_crc);
+                        ret = 0;