Input: atmel_mxt_ts - add support for dynamic message size
[pandora-kernel.git] / drivers / input / touchscreen / atmel_mxt_ts.c
index a248414..215ffe1 100644 (file)
@@ -2,6 +2,7 @@
  * Atmel maXTouch Touchscreen driver
  *
  * Copyright (C) 2010 Samsung Electronics Co.Ltd
+ * Copyright (C) 2011-2014 Atmel Corporation
  * Copyright (C) 2012 Google, Inc.
  *
  * Author: Joonyoung Shim <jy0922.shim@samsung.com>
@@ -22,6 +23,7 @@
 #include <linux/i2c/atmel_mxt_ts.h>
 #include <linux/input/mt.h>
 #include <linux/interrupt.h>
+#include <linux/of.h>
 #include <linux/slab.h>
 
 /* Version */
 #define MXT_VER_21             21
 #define MXT_VER_22             22
 
-/* Firmware */
+/* Firmware files */
 #define MXT_FW_NAME            "maxtouch.fw"
+#define MXT_CFG_NAME           "maxtouch.cfg"
+#define MXT_CFG_MAGIC          "OBP_RAW V1"
 
 /* Registers */
 #define MXT_INFO               0x00
@@ -44,6 +48,8 @@
 #define MXT_OBJECT_START       0x07
 
 #define MXT_OBJECT_SIZE                6
+#define MXT_INFO_CHECKSUM_SIZE 3
+#define MXT_MAX_BLOCK_WRITE    256
 
 /* Object types */
 #define MXT_DEBUG_DIAGNOSTIC_T37       37
@@ -74,6 +80,9 @@
 #define MXT_SPT_MESSAGECOUNT_T44       44
 #define MXT_SPT_CTECONFIG_T46          46
 
+/* MXT_GEN_MESSAGE_T5 object */
+#define MXT_RPTID_NOMSG                0xff
+
 /* MXT_GEN_COMMAND_T6 field */
 #define MXT_COMMAND_RESET      0
 #define MXT_COMMAND_BACKUPNV   1
@@ -217,11 +226,6 @@ struct mxt_object {
        u8 num_report_ids;
 } __packed;
 
-struct mxt_message {
-       u8 reportid;
-       u8 message[7];
-};
-
 /* Each client has this additional data */
 struct mxt_data {
        struct i2c_client *client;
@@ -234,12 +238,17 @@ struct mxt_data {
        unsigned int max_x;
        unsigned int max_y;
        bool in_bootloader;
+       u16 mem_size;
        u32 config_crc;
+       u32 info_crc;
        u8 bootloader_addr;
+       u8 *msg_buf;
 
        /* Cached parameters from object table */
+       u8 T5_msg_size;
        u8 T6_reportid;
        u16 T6_address;
+       u16 T7_address;
        u8 T9_reportid_min;
        u8 T9_reportid_max;
        u8 T19_reportid;
@@ -297,42 +306,10 @@ static bool mxt_object_readable(unsigned int type)
        }
 }
 
-static bool mxt_object_writable(unsigned int type)
+static void mxt_dump_message(struct mxt_data *data, u8 *message)
 {
-       switch (type) {
-       case MXT_GEN_COMMAND_T6:
-       case MXT_GEN_POWER_T7:
-       case MXT_GEN_ACQUIRE_T8:
-       case MXT_TOUCH_MULTI_T9:
-       case MXT_TOUCH_KEYARRAY_T15:
-       case MXT_TOUCH_PROXIMITY_T23:
-       case MXT_TOUCH_PROXKEY_T52:
-       case MXT_PROCI_GRIPFACE_T20:
-       case MXT_PROCG_NOISE_T22:
-       case MXT_PROCI_ONETOUCH_T24:
-       case MXT_PROCI_TWOTOUCH_T27:
-       case MXT_PROCI_GRIP_T40:
-       case MXT_PROCI_PALM_T41:
-       case MXT_PROCI_TOUCHSUPPRESSION_T42:
-       case MXT_PROCI_STYLUS_T47:
-       case MXT_PROCG_NOISESUPPRESSION_T48:
-       case MXT_SPT_COMMSCONFIG_T18:
-       case MXT_SPT_GPIOPWM_T19:
-       case MXT_SPT_SELFTEST_T25:
-       case MXT_SPT_CTECONFIG_T28:
-       case MXT_SPT_DIGITIZER_T43:
-       case MXT_SPT_CTECONFIG_T46:
-               return true;
-       default:
-               return false;
-       }
-}
-
-static void mxt_dump_message(struct device *dev,
-                            struct mxt_message *message)
-{
-       dev_dbg(dev, "reportid: %u\tmessage: %*ph\n",
-               message->reportid, 7, message->message);
+       dev_dbg(&data->client->dev, "message: %*ph\n",
+               data->T5_msg_size, message);
 }
 
 static int mxt_wait_for_completion(struct mxt_data *data,
@@ -401,7 +378,7 @@ static int mxt_bootloader_write(struct mxt_data *data,
        return ret;
 }
 
-static int mxt_lookup_bootloader_address(struct mxt_data *data)
+static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 {
        u8 appmode = data->client->addr;
        u8 bootloader;
@@ -409,6 +386,12 @@ static int mxt_lookup_bootloader_address(struct mxt_data *data)
        switch (appmode) {
        case 0x4a:
        case 0x4b:
+               /* Chips after 1664S use different scheme */
+               if (retry || data->info.family_id >= 0xa2) {
+                       bootloader = appmode - 0x24;
+                       break;
+               }
+               /* Fall through for normal case */
        case 0x4c:
        case 0x4d:
        case 0x5a:
@@ -426,6 +409,30 @@ static int mxt_lookup_bootloader_address(struct mxt_data *data)
        return 0;
 }
 
+static int mxt_probe_bootloader(struct mxt_data *data, bool retry)
+{
+       struct device *dev = &data->client->dev;
+       int ret;
+       u8 val;
+       bool crc_failure;
+
+       ret = mxt_lookup_bootloader_address(data, retry);
+       if (ret)
+               return ret;
+
+       ret = mxt_bootloader_read(data, &val, 1);
+       if (ret)
+               return ret;
+
+       /* Check app crc fail mode */
+       crc_failure = (val & ~MXT_BOOT_STATUS_MASK) == MXT_APP_CRC_FAIL;
+
+       dev_err(dev, "Detected bootloader, status:%02X%s\n",
+                       val, crc_failure ? ", APP_CRC_FAIL" : "");
+
+       return 0;
+}
+
 static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
 {
        struct device *dev = &data->client->dev;
@@ -447,14 +454,15 @@ static u8 mxt_get_bootloader_version(struct mxt_data *data, u8 val)
        }
 }
 
-static int mxt_check_bootloader(struct mxt_data *data, unsigned int state)
+static int mxt_check_bootloader(struct mxt_data *data, unsigned int state,
+                               bool wait)
 {
        struct device *dev = &data->client->dev;
        u8 val;
        int ret;
 
 recheck:
-       if (state != MXT_WAITING_BOOTLOAD_CMD) {
+       if (wait) {
                /*
                 * In application update mode, the interrupt
                 * line signals state transitions. We must wait for the
@@ -485,6 +493,7 @@ recheck:
        switch (state) {
        case MXT_WAITING_BOOTLOAD_CMD:
        case MXT_WAITING_FRAME_DATA:
+       case MXT_APP_CRC_FAIL:
                val &= ~MXT_BOOT_STATUS_MASK;
                break;
        case MXT_FRAME_CRC_PASS:
@@ -508,13 +517,18 @@ recheck:
        return 0;
 }
 
-static int mxt_unlock_bootloader(struct mxt_data *data)
+static int mxt_send_bootloader_cmd(struct mxt_data *data, bool unlock)
 {
        int ret;
        u8 buf[2];
 
-       buf[0] = MXT_UNLOCK_CMD_LSB;
-       buf[1] = MXT_UNLOCK_CMD_MSB;
+       if (unlock) {
+               buf[0] = MXT_UNLOCK_CMD_LSB;
+               buf[1] = MXT_UNLOCK_CMD_MSB;
+       } else {
+               buf[0] = 0x01;
+               buf[1] = 0x01;
+       }
 
        ret = mxt_bootloader_write(data, buf, 2);
        if (ret)
@@ -605,12 +619,11 @@ mxt_get_object(struct mxt_data *data, u8 type)
                        return object;
        }
 
-       dev_err(&data->client->dev, "Invalid object type T%u\n", type);
+       dev_warn(&data->client->dev, "Invalid object type T%u\n", type);
        return NULL;
 }
 
-static int mxt_read_message(struct mxt_data *data,
-                                struct mxt_message *message)
+static int mxt_read_message(struct mxt_data *data, u8 *message)
 {
        struct mxt_object *object;
        u16 reg;
@@ -621,7 +634,7 @@ static int mxt_read_message(struct mxt_data *data,
 
        reg = object->start_address;
        return __mxt_read_reg(data->client, reg,
-                       sizeof(struct mxt_message), message);
+                       data->T5_msg_size, message);
 }
 
 static int mxt_write_object(struct mxt_data *data,
@@ -638,7 +651,7 @@ static int mxt_write_object(struct mxt_data *data,
        return mxt_write_reg(data->client, reg + offset, val);
 }
 
-static void mxt_input_button(struct mxt_data *data, struct mxt_message *message)
+static void mxt_input_button(struct mxt_data *data, u8 *message)
 {
        struct input_dev *input = data->input_dev;
        const struct mxt_platform_data *pdata = data->pdata;
@@ -649,30 +662,33 @@ static void mxt_input_button(struct mxt_data *data, struct mxt_message *message)
        for (i = 0; i < pdata->t19_num_keys; i++) {
                if (pdata->t19_keymap[i] == KEY_RESERVED)
                        continue;
-               button = !(message->message[0] & (1 << i));
+               button = !(message[1] & (1 << i));
                input_report_key(input, pdata->t19_keymap[i], button);
        }
 }
 
-static void mxt_input_sync(struct input_dev *input_dev)
+static void mxt_input_sync(struct mxt_data *data)
 {
-       input_mt_report_pointer_emulation(input_dev, false);
-       input_sync(input_dev);
+       input_mt_report_pointer_emulation(data->input_dev,
+                                         data->pdata->t19_num_keys);
+       input_sync(data->input_dev);
 }
 
-static void mxt_input_touchevent(struct mxt_data *data,
-                                     struct mxt_message *message, int id)
+static void mxt_input_touchevent(struct mxt_data *data, u8 *message)
 {
        struct device *dev = &data->client->dev;
-       u8 status = message->message[0];
        struct input_dev *input_dev = data->input_dev;
+       int id;
+       u8 status;
        int x;
        int y;
        int area;
        int amplitude;
 
-       x = (message->message[1] << 4) | ((message->message[3] >> 4) & 0xf);
-       y = (message->message[2] << 4) | ((message->message[3] & 0xf));
+       id = message[0] - data->T9_reportid_min;
+       status = message[1];
+       x = (message[2] << 4) | ((message[4] >> 4) & 0xf);
+       y = (message[3] << 4) | ((message[4] & 0xf));
 
        /* Handle 10/12 bit switching */
        if (data->max_x < 1024)
@@ -680,8 +696,8 @@ static void mxt_input_touchevent(struct mxt_data *data,
        if (data->max_y < 1024)
                y >>= 2;
 
-       area = message->message[4];
-       amplitude = message->message[5];
+       area = message[5];
+       amplitude = message[6];
 
        dev_dbg(dev,
                "[%u] %c%c%c%c%c%c%c%c x: %5u y: %5u area: %3u amp: %3u\n",
@@ -707,7 +723,7 @@ static void mxt_input_touchevent(struct mxt_data *data,
                if (status & MXT_T9_RELEASE) {
                        input_mt_report_slot_state(input_dev,
                                                   MT_TOOL_FINGER, 0);
-                       mxt_input_sync(input_dev);
+                       mxt_input_sync(data);
                }
 
                /* Touch active */
@@ -727,28 +743,28 @@ static u16 mxt_extract_T6_csum(const u8 *csum)
        return csum[0] | (csum[1] << 8) | (csum[2] << 16);
 }
 
-static bool mxt_is_T9_message(struct mxt_data *data, struct mxt_message *msg)
+static bool mxt_is_T9_message(struct mxt_data *data, u8 *msg)
 {
-       u8 id = msg->reportid;
+       u8 id = msg[0];
        return (id >= data->T9_reportid_min && id <= data->T9_reportid_max);
 }
 
 static irqreturn_t mxt_process_messages_until_invalid(struct mxt_data *data)
 {
-       struct mxt_message message;
-       const u8 *payload = &message.message[0];
+       u8 *message = &data->msg_buf[0];
+       const u8 *payload = &data->msg_buf[1];
        struct device *dev = &data->client->dev;
        u8 reportid;
        bool update_input = false;
        u32 crc;
 
        do {
-               if (mxt_read_message(data, &message)) {
+               if (mxt_read_message(data, message)) {
                        dev_err(dev, "Failed to read message\n");
                        return IRQ_NONE;
                }
 
-               reportid = message.reportid;
+               reportid = message[0];
 
                if (reportid == data->T6_reportid) {
                        u8 status = payload[0];
@@ -769,21 +785,20 @@ static irqreturn_t mxt_process_messages_until_invalid(struct mxt_data *data)
                         * do not report events if input device
                         * is not yet registered
                         */
-                       mxt_dump_message(dev, &message);
-               } else if (mxt_is_T9_message(data, &message)) {
-                       int id = reportid - data->T9_reportid_min;
-                       mxt_input_touchevent(data, &message, id);
+                       mxt_dump_message(data, message);
+               } else if (mxt_is_T9_message(data, message)) {
+                       mxt_input_touchevent(data, message);
                        update_input = true;
-               } else if (message.reportid == data->T19_reportid) {
-                       mxt_input_button(data, &message);
+               } else if (reportid == data->T19_reportid) {
+                       mxt_input_button(data, message);
                        update_input = true;
                } else {
-                       mxt_dump_message(dev, &message);
+                       mxt_dump_message(data, message);
                }
-       } while (reportid != 0xff);
+       } while (reportid != MXT_RPTID_NOMSG);
 
        if (update_input)
-               mxt_input_sync(data->input_dev);
+               mxt_input_sync(data);
 
        return IRQ_HANDLED;
 }
@@ -875,73 +890,317 @@ static void mxt_update_crc(struct mxt_data *data, u8 cmd, u8 value)
        mxt_wait_for_completion(data, &data->crc_completion, MXT_CRC_TIMEOUT);
 }
 
-static int mxt_check_reg_init(struct mxt_data *data)
+static void mxt_calc_crc24(u32 *crc, u8 firstbyte, u8 secondbyte)
+{
+       static const unsigned int crcpoly = 0x80001B;
+       u32 result;
+       u32 data_word;
+
+       data_word = (secondbyte << 8) | firstbyte;
+       result = ((*crc << 1) ^ data_word);
+
+       if (result & 0x1000000)
+               result ^= crcpoly;
+
+       *crc = result;
+}
+
+static u32 mxt_calculate_crc(u8 *base, off_t start_off, off_t end_off)
+{
+       u32 crc = 0;
+       u8 *ptr = base + start_off;
+       u8 *last_val = base + end_off - 1;
+
+       if (end_off < start_off)
+               return -EINVAL;
+
+       while (ptr < last_val) {
+               mxt_calc_crc24(&crc, *ptr, *(ptr + 1));
+               ptr += 2;
+       }
+
+       /* if len is odd, fill the last byte with 0 */
+       if (ptr == last_val)
+               mxt_calc_crc24(&crc, *ptr, 0);
+
+       /* Mask to 24-bit */
+       crc &= 0x00FFFFFF;
+
+       return crc;
+}
+
+/*
+ * mxt_update_cfg - download configuration to chip
+ *
+ * Atmel Raw Config File Format
+ *
+ * The first four lines of the raw config file contain:
+ *  1) Version
+ *  2) Chip ID Information (first 7 bytes of device memory)
+ *  3) Chip Information Block 24-bit CRC Checksum
+ *  4) Chip Configuration 24-bit CRC Checksum
+ *
+ * The rest of the file consists of one line per object instance:
+ *   <TYPE> <INSTANCE> <SIZE> <CONTENTS>
+ *
+ *   <TYPE> - 2-byte object type as hex
+ *   <INSTANCE> - 2-byte object instance number as hex
+ *   <SIZE> - 2-byte object size as hex
+ *   <CONTENTS> - array of <SIZE> 1-byte hex values
+ */
+static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
 {
-       const struct mxt_platform_data *pdata = data->pdata;
-       struct mxt_object *object;
        struct device *dev = &data->client->dev;
-       int index = 0;
-       int i, size;
+       struct mxt_info cfg_info;
+       struct mxt_object *object;
        int ret;
+       int offset;
+       int data_pos;
+       int byte_offset;
+       int i;
+       int cfg_start_ofs;
+       u32 info_crc, config_crc, calculated_crc;
+       u8 *config_mem;
+       size_t config_mem_size;
+       unsigned int type, instance, size;
+       u8 val;
+       u16 reg;
 
-       if (!pdata->config) {
-               dev_dbg(dev, "No cfg data defined, skipping reg init\n");
-               return 0;
+       mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
+
+       if (strncmp(cfg->data, MXT_CFG_MAGIC, strlen(MXT_CFG_MAGIC))) {
+               dev_err(dev, "Unrecognised config file\n");
+               ret = -EINVAL;
+               goto release;
        }
 
-       mxt_update_crc(data, MXT_COMMAND_REPORTALL, 1);
+       data_pos = strlen(MXT_CFG_MAGIC);
+
+       /* Load information block and check */
+       for (i = 0; i < sizeof(struct mxt_info); i++) {
+               ret = sscanf(cfg->data + data_pos, "%hhx%n",
+                            (unsigned char *)&cfg_info + i,
+                            &offset);
+               if (ret != 1) {
+                       dev_err(dev, "Bad format\n");
+                       ret = -EINVAL;
+                       goto release;
+               }
 
-       if (data->config_crc == pdata->config_crc) {
-               dev_info(dev, "Config CRC 0x%06X: OK\n", data->config_crc);
-               return 0;
+               data_pos += offset;
        }
 
-       dev_info(dev, "Config CRC 0x%06X: does not match 0x%06X\n",
-                data->config_crc, pdata->config_crc);
+       if (cfg_info.family_id != data->info.family_id) {
+               dev_err(dev, "Family ID mismatch!\n");
+               ret = -EINVAL;
+               goto release;
+       }
 
-       for (i = 0; i < data->info.object_num; i++) {
-               object = data->object_table + i;
+       if (cfg_info.variant_id != data->info.variant_id) {
+               dev_err(dev, "Variant ID mismatch!\n");
+               ret = -EINVAL;
+               goto release;
+       }
+
+       /* Read CRCs */
+       ret = sscanf(cfg->data + data_pos, "%x%n", &info_crc, &offset);
+       if (ret != 1) {
+               dev_err(dev, "Bad format: failed to parse Info CRC\n");
+               ret = -EINVAL;
+               goto release;
+       }
+       data_pos += offset;
+
+       ret = sscanf(cfg->data + data_pos, "%x%n", &config_crc, &offset);
+       if (ret != 1) {
+               dev_err(dev, "Bad format: failed to parse Config CRC\n");
+               ret = -EINVAL;
+               goto release;
+       }
+       data_pos += offset;
 
-               if (!mxt_object_writable(object->type))
+       /*
+        * The Info Block CRC is calculated over mxt_info and the object
+        * table. If it does not match then we are trying to load the
+        * configuration from a different chip or firmware version, so
+        * the configuration CRC is invalid anyway.
+        */
+       if (info_crc == data->info_crc) {
+               if (config_crc == 0 || data->config_crc == 0) {
+                       dev_info(dev, "CRC zero, attempting to apply config\n");
+               } else if (config_crc == data->config_crc) {
+                       dev_dbg(dev, "Config CRC 0x%06X: OK\n",
+                                data->config_crc);
+                       ret = 0;
+                       goto release;
+               } else {
+                       dev_info(dev, "Config CRC 0x%06X: does not match file 0x%06X\n",
+                                data->config_crc, config_crc);
+               }
+       } else {
+               dev_warn(dev,
+                        "Warning: Info CRC error - device=0x%06X file=0x%06X\n",
+                        data->info_crc, info_crc);
+       }
+
+       /* Malloc memory to store configuration */
+       cfg_start_ofs = MXT_OBJECT_START +
+                       data->info.object_num * sizeof(struct mxt_object) +
+                       MXT_INFO_CHECKSUM_SIZE;
+       config_mem_size = data->mem_size - cfg_start_ofs;
+       config_mem = kzalloc(config_mem_size, GFP_KERNEL);
+       if (!config_mem) {
+               dev_err(dev, "Failed to allocate memory\n");
+               ret = -ENOMEM;
+               goto release;
+       }
+
+       while (data_pos < cfg->size) {
+               /* Read type, instance, length */
+               ret = sscanf(cfg->data + data_pos, "%x %x %x%n",
+                            &type, &instance, &size, &offset);
+               if (ret == 0) {
+                       /* EOF */
+                       break;
+               } else if (ret != 3) {
+                       dev_err(dev, "Bad format: failed to parse object\n");
+                       ret = -EINVAL;
+                       goto release_mem;
+               }
+               data_pos += offset;
+
+               object = mxt_get_object(data, type);
+               if (!object) {
+                       /* Skip object */
+                       for (i = 0; i < size; i++) {
+                               ret = sscanf(cfg->data + data_pos, "%hhx%n",
+                                            &val,
+                                            &offset);
+                               data_pos += offset;
+                       }
                        continue;
+               }
 
-               size = mxt_obj_size(object) * mxt_obj_instances(object);
-               if (index + size > pdata->config_length) {
-                       dev_err(dev, "Not enough config data!\n");
-                       return -EINVAL;
+               if (size > mxt_obj_size(object)) {
+                       /*
+                        * Either we are in fallback mode due to wrong
+                        * config or config from a later fw version,
+                        * or the file is corrupt or hand-edited.
+                        */
+                       dev_warn(dev, "Discarding %zu byte(s) in T%u\n",
+                                size - mxt_obj_size(object), type);
+               } else if (mxt_obj_size(object) > size) {
+                       /*
+                        * If firmware is upgraded, new bytes may be added to
+                        * end of objects. It is generally forward compatible
+                        * to zero these bytes - previous behaviour will be
+                        * retained. However this does invalidate the CRC and
+                        * will force fallback mode until the configuration is
+                        * updated. We warn here but do nothing else - the
+                        * malloc has zeroed the entire configuration.
+                        */
+                       dev_warn(dev, "Zeroing %zu byte(s) in T%d\n",
+                                mxt_obj_size(object) - size, type);
                }
 
-               ret = __mxt_write_reg(data->client, object->start_address,
-                               size, &pdata->config[index]);
-               if (ret)
-                       return ret;
-               index += size;
+               if (instance >= mxt_obj_instances(object)) {
+                       dev_err(dev, "Object instances exceeded!\n");
+                       ret = -EINVAL;
+                       goto release_mem;
+               }
+
+               reg = object->start_address + mxt_obj_size(object) * instance;
+
+               for (i = 0; i < size; i++) {
+                       ret = sscanf(cfg->data + data_pos, "%hhx%n",
+                                    &val,
+                                    &offset);
+                       if (ret != 1) {
+                               dev_err(dev, "Bad format in T%d\n", type);
+                               ret = -EINVAL;
+                               goto release_mem;
+                       }
+                       data_pos += offset;
+
+                       if (i > mxt_obj_size(object))
+                               continue;
+
+                       byte_offset = reg + i - cfg_start_ofs;
+
+                       if ((byte_offset >= 0)
+                           && (byte_offset <= config_mem_size)) {
+                               *(config_mem + byte_offset) = val;
+                       } else {
+                               dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
+                                       reg, object->type, byte_offset);
+                               ret = -EINVAL;
+                               goto release_mem;
+                       }
+               }
+       }
+
+       /* Calculate crc of the received configs (not the raw config file) */
+       if (data->T7_address < cfg_start_ofs) {
+               dev_err(dev, "Bad T7 address, T7addr = %x, config offset %x\n",
+                       data->T7_address, cfg_start_ofs);
+               ret = 0;
+               goto release_mem;
+       }
+
+       calculated_crc = mxt_calculate_crc(config_mem,
+                                          data->T7_address - cfg_start_ofs,
+                                          config_mem_size);
+
+       if (config_crc > 0 && (config_crc != calculated_crc))
+               dev_warn(dev, "Config CRC error, calculated=%06X, file=%06X\n",
+                        calculated_crc, config_crc);
+
+       /* Write configuration as blocks */
+       byte_offset = 0;
+       while (byte_offset < config_mem_size) {
+               size = config_mem_size - byte_offset;
+
+               if (size > MXT_MAX_BLOCK_WRITE)
+                       size = MXT_MAX_BLOCK_WRITE;
+
+               ret = __mxt_write_reg(data->client,
+                                     cfg_start_ofs + byte_offset,
+                                     size, config_mem + byte_offset);
+               if (ret != 0) {
+                       dev_err(dev, "Config write error, ret=%d\n", ret);
+                       goto release_mem;
+               }
+
+               byte_offset += size;
        }
 
        mxt_update_crc(data, MXT_COMMAND_BACKUPNV, MXT_BACKUP_VALUE);
 
        ret = mxt_soft_reset(data);
        if (ret)
-               return ret;
+               goto release_mem;
 
        dev_info(dev, "Config successfully updated\n");
 
-       return 0;
+release_mem:
+       kfree(config_mem);
+release:
+       release_firmware(cfg);
+       return ret;
 }
 
 static int mxt_make_highchg(struct mxt_data *data)
 {
        struct device *dev = &data->client->dev;
-       struct mxt_message message;
        int count = 10;
        int error;
 
        /* Read dummy message to make high CHG pin */
        do {
-               error = mxt_read_message(data, &message);
+               error = mxt_read_message(data, data->msg_buf);
                if (error)
                        return error;
-       } while (message.reportid != 0xff && --count);
+       } while (data->msg_buf[0] != MXT_RPTID_NOMSG && --count);
 
        if (!count) {
                dev_err(dev, "CHG pin isn't cleared\n");
@@ -978,6 +1237,23 @@ static int mxt_get_info(struct mxt_data *data)
        return 0;
 }
 
+static void mxt_free_object_table(struct mxt_data *data)
+{
+       input_unregister_device(data->input_dev);
+       data->input_dev = NULL;
+
+       kfree(data->object_table);
+       data->object_table = NULL;
+       kfree(data->msg_buf);
+       data->msg_buf = NULL;
+       data->T5_msg_size = 0;
+       data->T6_reportid = 0;
+       data->T7_address = 0;
+       data->T9_reportid_min = 0;
+       data->T9_reportid_max = 0;
+       data->T19_reportid = 0;
+}
+
 static int mxt_get_object_table(struct mxt_data *data)
 {
        struct i2c_client *client = data->client;
@@ -986,6 +1262,7 @@ static int mxt_get_object_table(struct mxt_data *data)
        int error;
        int i;
        u8 reportid;
+       u16 end_address;
 
        table_size = data->info.object_num * sizeof(struct mxt_object);
        object_table = kzalloc(table_size, GFP_KERNEL);
@@ -1003,6 +1280,7 @@ static int mxt_get_object_table(struct mxt_data *data)
 
        /* Valid Report IDs start counting from 1 */
        reportid = 1;
+       data->mem_size = 0;
        for (i = 0; i < data->info.object_num; i++) {
                struct mxt_object *object = object_table + i;
                u8 min_id, max_id;
@@ -1026,10 +1304,16 @@ static int mxt_get_object_table(struct mxt_data *data)
                        min_id, max_id);
 
                switch (object->type) {
+               case MXT_GEN_MESSAGE_T5:
+                       /* CRC not enabled, therefore don't read last byte */
+                       data->T5_msg_size = mxt_obj_size(object) - 1;
                case MXT_GEN_COMMAND_T6:
                        data->T6_reportid = min_id;
                        data->T6_address = object->start_address;
                        break;
+               case MXT_GEN_POWER_T7:
+                       data->T7_address = object->start_address;
+                       break;
                case MXT_TOUCH_MULTI_T9:
                        data->T9_reportid_min = min_id;
                        data->T9_reportid_max = max_id;
@@ -1038,24 +1322,28 @@ static int mxt_get_object_table(struct mxt_data *data)
                        data->T19_reportid = min_id;
                        break;
                }
+
+               end_address = object->start_address
+                       + mxt_obj_size(object) * mxt_obj_instances(object) - 1;
+
+               if (end_address >= data->mem_size)
+                       data->mem_size = end_address + 1;
+       }
+
+       data->msg_buf = kzalloc(data->T5_msg_size, GFP_KERNEL);
+       if (!data->msg_buf) {
+               dev_err(&client->dev, "Failed to allocate message buffer\n");
+               error = -ENOMEM;
+               goto free_object_table;
        }
 
        data->object_table = object_table;
 
        return 0;
-}
-
-static void mxt_free_object_table(struct mxt_data *data)
-{
-       input_unregister_device(data->input_dev);
-       data->input_dev = NULL;
 
-       kfree(data->object_table);
-       data->object_table = NULL;
-       data->T6_reportid = 0;
-       data->T9_reportid_min = 0;
-       data->T9_reportid_max = 0;
-       data->T19_reportid = 0;
+free_object_table:
+       mxt_free_object_table(data);
+       return error;
 }
 
 static int mxt_read_t9_resolution(struct mxt_data *data)
@@ -1202,15 +1490,53 @@ err_free_mem:
        return error;
 }
 
+static int mxt_configure_objects(struct mxt_data *data,
+                                const struct firmware *cfg);
+
+static void mxt_config_cb(const struct firmware *cfg, void *ctx)
+{
+       mxt_configure_objects(ctx, cfg);
+}
+
 static int mxt_initialize(struct mxt_data *data)
 {
        struct i2c_client *client = data->client;
-       struct mxt_info *info = &data->info;
        int error;
+       bool alt_bootloader_addr = false;
+       bool retry = false;
 
+retry_info:
        error = mxt_get_info(data);
-       if (error)
-               return error;
+       if (error) {
+retry_bootloader:
+               error = mxt_probe_bootloader(data, alt_bootloader_addr);
+               if (error) {
+                       if (alt_bootloader_addr) {
+                               /* Chip is not in appmode or bootloader mode */
+                               return error;
+                       }
+
+                       dev_info(&client->dev, "Trying alternate bootloader address\n");
+                       alt_bootloader_addr = true;
+                       goto retry_bootloader;
+               } else {
+                       if (retry) {
+                               dev_err(&client->dev, "Could not recover from bootloader mode\n");
+                               /*
+                                * We can reflash from this state, so do not
+                                * abort init
+                                */
+                               data->in_bootloader = true;
+                               return 0;
+                       }
+
+                       /* Attempt to exit bootloader into app mode */
+                       mxt_send_bootloader_cmd(data, false);
+                       msleep(MXT_FW_RESET_TIME);
+                       retry = true;
+                       goto retry_info;
+               }
+       }
 
        /* Get object table information */
        error = mxt_get_object_table(data);
@@ -1223,28 +1549,40 @@ static int mxt_initialize(struct mxt_data *data)
        if (error)
                goto err_free_object_table;
 
-       /* Check register init values */
-       error = mxt_check_reg_init(data);
-       if (error) {
-               dev_err(&client->dev, "Error %d initializing configuration\n",
-                       error);
-               goto err_free_object_table;
+       request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
+                               &data->client->dev, GFP_KERNEL, data,
+                               mxt_config_cb);
+
+       return 0;
+
+err_free_object_table:
+       mxt_free_object_table(data);
+       return error;
+}
+
+static int mxt_configure_objects(struct mxt_data *data,
+                                const struct firmware *cfg)
+{
+       struct device *dev = &data->client->dev;
+       struct mxt_info *info = &data->info;
+       int error;
+
+       if (cfg) {
+               error = mxt_update_cfg(data, cfg);
+               if (error)
+                       dev_warn(dev, "Error %d updating config\n", error);
        }
 
        error = mxt_initialize_t9_input_device(data);
        if (error)
-               goto err_free_object_table;
+               return error;
 
-       dev_info(&client->dev,
+       dev_info(dev,
                 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
                 info->family_id, info->variant_id, info->version >> 4,
                 info->version & 0xf, info->build, info->object_num);
 
        return 0;
-
-err_free_object_table:
-       mxt_free_object_table(data);
-       return error;
 }
 
 /* Firmware Version is returned as Major.Minor.Build */
@@ -1372,30 +1710,45 @@ static int mxt_load_fw(struct device *dev, const char *fn)
        if (ret)
                goto release_firmware;
 
-       ret = mxt_lookup_bootloader_address(data);
-       if (ret)
-               goto release_firmware;
+       if (!data->in_bootloader) {
+               /* Change to the bootloader mode */
+               data->in_bootloader = true;
 
-       /* Change to the bootloader mode */
-       data->in_bootloader = true;
+               ret = mxt_t6_command(data, MXT_COMMAND_RESET,
+                                    MXT_BOOT_VALUE, false);
+               if (ret)
+                       goto release_firmware;
 
-       ret = mxt_t6_command(data, MXT_COMMAND_RESET, MXT_BOOT_VALUE, false);
-       if (ret)
-               goto release_firmware;
+               msleep(MXT_RESET_TIME);
 
-       msleep(MXT_RESET_TIME);
+               /* Do not need to scan since we know family ID */
+               ret = mxt_lookup_bootloader_address(data, 0);
+               if (ret)
+                       goto release_firmware;
+       } else {
+               enable_irq(data->irq);
+       }
 
+       mxt_free_object_table(data);
        reinit_completion(&data->bl_completion);
 
-       ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD);
-       if (ret)
-               goto disable_irq;
+       ret = mxt_check_bootloader(data, MXT_WAITING_BOOTLOAD_CMD, false);
+       if (ret) {
+               /* Bootloader may still be unlocked from previous attempt */
+               ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, false);
+               if (ret)
+                       goto disable_irq;
+       } else {
+               dev_info(dev, "Unlocking bootloader\n");
 
-       /* Unlock bootloader */
-       mxt_unlock_bootloader(data);
+               /* Unlock bootloader */
+               ret = mxt_send_bootloader_cmd(data, true);
+               if (ret)
+                       goto disable_irq;
+       }
 
        while (pos < fw->size) {
-               ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA);
+               ret = mxt_check_bootloader(data, MXT_WAITING_FRAME_DATA, true);
                if (ret)
                        goto disable_irq;
 
@@ -1409,7 +1762,7 @@ static int mxt_load_fw(struct device *dev, const char *fn)
                if (ret)
                        goto disable_irq;
 
-               ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS);
+               ret = mxt_check_bootloader(data, MXT_FRAME_CRC_PASS, true);
                if (ret) {
                        retry++;
 
@@ -1469,8 +1822,6 @@ static ssize_t mxt_update_fw_store(struct device *dev,
        } else {
                dev_info(dev, "The firmware update succeeded\n");
 
-               mxt_free_object_table(data);
-
                error = mxt_initialize(data);
                if (error)
                        return error;
@@ -1526,15 +1877,65 @@ static void mxt_input_close(struct input_dev *dev)
        mxt_stop(data);
 }
 
-static int mxt_probe(struct i2c_client *client,
-               const struct i2c_device_id *id)
+#ifdef CONFIG_OF
+static struct mxt_platform_data *mxt_parse_dt(struct i2c_client *client)
+{
+       struct mxt_platform_data *pdata;
+       u32 *keymap;
+       u32 keycode;
+       int proplen, i, ret;
+
+       if (!client->dev.of_node)
+               return ERR_PTR(-ENODEV);
+
+       pdata = devm_kzalloc(&client->dev, sizeof(*pdata), GFP_KERNEL);
+       if (!pdata)
+               return ERR_PTR(-ENOMEM);
+
+       if (of_find_property(client->dev.of_node, "linux,gpio-keymap",
+                            &proplen)) {
+               pdata->t19_num_keys = proplen / sizeof(u32);
+
+               keymap = devm_kzalloc(&client->dev,
+                               pdata->t19_num_keys * sizeof(keymap[0]),
+                               GFP_KERNEL);
+               if (!keymap)
+                       return ERR_PTR(-ENOMEM);
+
+               for (i = 0; i < pdata->t19_num_keys; i++) {
+                       ret = of_property_read_u32_index(client->dev.of_node,
+                                       "linux,gpio-keymap", i, &keycode);
+                       if (ret)
+                               keycode = KEY_RESERVED;
+
+                       keymap[i] = keycode;
+               }
+
+               pdata->t19_keymap = keymap;
+       }
+
+       return pdata;
+}
+#else
+static struct mxt_platform_data *mxt_parse_dt(struct i2c_client *client)
+{
+       dev_dbg(&client->dev, "No platform data specified\n");
+       return ERR_PTR(-EINVAL);
+}
+#endif
+
+static int mxt_probe(struct i2c_client *client, const struct i2c_device_id *id)
 {
        struct mxt_data *data;
-       const struct mxt_platform_data *pdata = dev_get_platdata(&client->dev);
+       const struct mxt_platform_data *pdata;
        int error;
 
-       if (!pdata)
-               return -EINVAL;
+       pdata = dev_get_platdata(&client->dev);
+       if (!pdata) {
+               pdata = mxt_parse_dt(client);
+               if (IS_ERR(pdata))
+                       return PTR_ERR(pdata);
+       }
 
        data = kzalloc(sizeof(struct mxt_data), GFP_KERNEL);
        if (!data) {
@@ -1578,7 +1979,7 @@ static int mxt_probe(struct i2c_client *client,
        return 0;
 
 err_free_object:
-       kfree(data->object_table);
+       mxt_free_object_table(data);
 err_free_irq:
        free_irq(client->irq, data);
 err_free_mem:
@@ -1593,7 +1994,7 @@ static int mxt_remove(struct i2c_client *client)
        sysfs_remove_group(&client->dev.kobj, &mxt_attr_group);
        free_irq(data->irq, data);
        input_unregister_device(data->input_dev);
-       kfree(data->object_table);
+       mxt_free_object_table(data);
        kfree(data);
 
        return 0;
@@ -1637,6 +2038,12 @@ static int mxt_resume(struct device *dev)
 
 static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
 
+static const struct of_device_id mxt_of_match[] = {
+       { .compatible = "atmel,maxtouch", },
+       {},
+};
+MODULE_DEVICE_TABLE(of, mxt_of_match);
+
 static const struct i2c_device_id mxt_id[] = {
        { "qt602240_ts", 0 },
        { "atmel_mxt_ts", 0 },
@@ -1650,6 +2057,7 @@ static struct i2c_driver mxt_driver = {
        .driver = {
                .name   = "atmel_mxt_ts",
                .owner  = THIS_MODULE,
+               .of_match_table = of_match_ptr(mxt_of_match),
                .pm     = &mxt_pm_ops,
        },
        .probe          = mxt_probe,