xref: /linux/drivers/media/usb/dvb-usb/af9005.c (revision 44f57d78)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* DVB USB compliant Linux driver for the Afatech 9005
3  * USB1.1 DVB-T receiver.
4  *
5  * Copyright (C) 2007 Luca Olivetti (luca@ventoso.org)
6  *
7  * Thanks to Afatech who kindly provided information.
8  *
9  * see Documentation/media/dvb-drivers/dvb-usb.rst for more information
10  */
11 #include "af9005.h"
12 
13 /* debug */
14 int dvb_usb_af9005_debug;
15 module_param_named(debug, dvb_usb_af9005_debug, int, 0644);
16 MODULE_PARM_DESC(debug,
17 		 "set debugging level (1=info,xfer=2,rc=4,reg=8,i2c=16,fw=32 (or-able))."
18 		 DVB_USB_DEBUG_STATUS);
19 /* enable obnoxious led */
20 bool dvb_usb_af9005_led = true;
21 module_param_named(led, dvb_usb_af9005_led, bool, 0644);
22 MODULE_PARM_DESC(led, "enable led (default: 1).");
23 
24 /* eeprom dump */
25 static int dvb_usb_af9005_dump_eeprom;
26 module_param_named(dump_eeprom, dvb_usb_af9005_dump_eeprom, int, 0);
27 MODULE_PARM_DESC(dump_eeprom, "dump contents of the eeprom.");
28 
29 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
30 
31 /* remote control decoder */
32 static int (*rc_decode) (struct dvb_usb_device *d, u8 *data, int len,
33 		u32 *event, int *state);
34 static void *rc_keys;
35 static int *rc_keys_size;
36 
37 u8 regmask[8] = { 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f, 0xff };
38 
39 struct af9005_device_state {
40 	u8 sequence;
41 	int led_state;
42 	unsigned char data[256];
43 };
44 
45 static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg,
46 			      int readwrite, int type, u8 * values, int len)
47 {
48 	struct af9005_device_state *st = d->priv;
49 	u8 command, seq;
50 	int i, ret;
51 
52 	if (len < 1) {
53 		err("generic read/write, less than 1 byte. Makes no sense.");
54 		return -EINVAL;
55 	}
56 	if (len > 8) {
57 		err("generic read/write, more than 8 bytes. Not supported.");
58 		return -EINVAL;
59 	}
60 
61 	mutex_lock(&d->data_mutex);
62 	st->data[0] = 14;		/* rest of buffer length low */
63 	st->data[1] = 0;		/* rest of buffer length high */
64 
65 	st->data[2] = AF9005_REGISTER_RW;	/* register operation */
66 	st->data[3] = 12;		/* rest of buffer length */
67 
68 	st->data[4] = seq = st->sequence++;	/* sequence number */
69 
70 	st->data[5] = (u8) (reg >> 8);	/* register address */
71 	st->data[6] = (u8) (reg & 0xff);
72 
73 	if (type == AF9005_OFDM_REG) {
74 		command = AF9005_CMD_OFDM_REG;
75 	} else {
76 		command = AF9005_CMD_TUNER;
77 	}
78 
79 	if (len > 1)
80 		command |=
81 		    AF9005_CMD_BURST | AF9005_CMD_AUTOINC | (len - 1) << 3;
82 	command |= readwrite;
83 	if (readwrite == AF9005_CMD_WRITE)
84 		for (i = 0; i < len; i++)
85 			st->data[8 + i] = values[i];
86 	else if (type == AF9005_TUNER_REG)
87 		/* read command for tuner, the first byte contains the i2c address */
88 		st->data[8] = values[0];
89 	st->data[7] = command;
90 
91 	ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 17, 0);
92 	if (ret)
93 		goto ret;
94 
95 	/* sanity check */
96 	if (st->data[2] != AF9005_REGISTER_RW_ACK) {
97 		err("generic read/write, wrong reply code.");
98 		ret = -EIO;
99 		goto ret;
100 	}
101 	if (st->data[3] != 0x0d) {
102 		err("generic read/write, wrong length in reply.");
103 		ret = -EIO;
104 		goto ret;
105 	}
106 	if (st->data[4] != seq) {
107 		err("generic read/write, wrong sequence in reply.");
108 		ret = -EIO;
109 		goto ret;
110 	}
111 	/*
112 	 * In thesis, both input and output buffers should have
113 	 * identical values for st->data[5] to st->data[8].
114 	 * However, windows driver doesn't check these fields, in fact
115 	 * sometimes the register in the reply is different that what
116 	 * has been sent
117 	 */
118 	if (st->data[16] != 0x01) {
119 		err("generic read/write wrong status code in reply.");
120 		ret = -EIO;
121 		goto ret;
122 	}
123 
124 	if (readwrite == AF9005_CMD_READ)
125 		for (i = 0; i < len; i++)
126 			values[i] = st->data[8 + i];
127 
128 ret:
129 	mutex_unlock(&d->data_mutex);
130 	return ret;
131 
132 }
133 
134 int af9005_read_ofdm_register(struct dvb_usb_device *d, u16 reg, u8 * value)
135 {
136 	int ret;
137 	deb_reg("read register %x ", reg);
138 	ret = af9005_generic_read_write(d, reg,
139 					AF9005_CMD_READ, AF9005_OFDM_REG,
140 					value, 1);
141 	if (ret)
142 		deb_reg("failed\n");
143 	else
144 		deb_reg("value %x\n", *value);
145 	return ret;
146 }
147 
148 int af9005_read_ofdm_registers(struct dvb_usb_device *d, u16 reg,
149 			       u8 * values, int len)
150 {
151 	int ret;
152 	deb_reg("read %d registers %x ", len, reg);
153 	ret = af9005_generic_read_write(d, reg,
154 					AF9005_CMD_READ, AF9005_OFDM_REG,
155 					values, len);
156 	if (ret)
157 		deb_reg("failed\n");
158 	else
159 		debug_dump(values, len, deb_reg);
160 	return ret;
161 }
162 
163 int af9005_write_ofdm_register(struct dvb_usb_device *d, u16 reg, u8 value)
164 {
165 	int ret;
166 	u8 temp = value;
167 	deb_reg("write register %x value %x ", reg, value);
168 	ret = af9005_generic_read_write(d, reg,
169 					AF9005_CMD_WRITE, AF9005_OFDM_REG,
170 					&temp, 1);
171 	if (ret)
172 		deb_reg("failed\n");
173 	else
174 		deb_reg("ok\n");
175 	return ret;
176 }
177 
178 int af9005_write_ofdm_registers(struct dvb_usb_device *d, u16 reg,
179 				u8 * values, int len)
180 {
181 	int ret;
182 	deb_reg("write %d registers %x values ", len, reg);
183 	debug_dump(values, len, deb_reg);
184 
185 	ret = af9005_generic_read_write(d, reg,
186 					AF9005_CMD_WRITE, AF9005_OFDM_REG,
187 					values, len);
188 	if (ret)
189 		deb_reg("failed\n");
190 	else
191 		deb_reg("ok\n");
192 	return ret;
193 }
194 
195 int af9005_read_register_bits(struct dvb_usb_device *d, u16 reg, u8 pos,
196 			      u8 len, u8 * value)
197 {
198 	u8 temp;
199 	int ret;
200 	deb_reg("read bits %x %x %x", reg, pos, len);
201 	ret = af9005_read_ofdm_register(d, reg, &temp);
202 	if (ret) {
203 		deb_reg(" failed\n");
204 		return ret;
205 	}
206 	*value = (temp >> pos) & regmask[len - 1];
207 	deb_reg(" value %x\n", *value);
208 	return 0;
209 
210 }
211 
212 int af9005_write_register_bits(struct dvb_usb_device *d, u16 reg, u8 pos,
213 			       u8 len, u8 value)
214 {
215 	u8 temp, mask;
216 	int ret;
217 	deb_reg("write bits %x %x %x value %x\n", reg, pos, len, value);
218 	if (pos == 0 && len == 8)
219 		return af9005_write_ofdm_register(d, reg, value);
220 	ret = af9005_read_ofdm_register(d, reg, &temp);
221 	if (ret)
222 		return ret;
223 	mask = regmask[len - 1] << pos;
224 	temp = (temp & ~mask) | ((value << pos) & mask);
225 	return af9005_write_ofdm_register(d, reg, temp);
226 
227 }
228 
229 static int af9005_usb_read_tuner_registers(struct dvb_usb_device *d,
230 					   u16 reg, u8 * values, int len)
231 {
232 	return af9005_generic_read_write(d, reg,
233 					 AF9005_CMD_READ, AF9005_TUNER_REG,
234 					 values, len);
235 }
236 
237 static int af9005_usb_write_tuner_registers(struct dvb_usb_device *d,
238 					    u16 reg, u8 * values, int len)
239 {
240 	return af9005_generic_read_write(d, reg,
241 					 AF9005_CMD_WRITE,
242 					 AF9005_TUNER_REG, values, len);
243 }
244 
245 int af9005_write_tuner_registers(struct dvb_usb_device *d, u16 reg,
246 				 u8 * values, int len)
247 {
248 	/* don't let the name of this function mislead you: it's just used
249 	   as an interface from the firmware to the i2c bus. The actual
250 	   i2c addresses are contained in the data */
251 	int ret, i, done = 0, fail = 0;
252 	u8 temp;
253 	ret = af9005_usb_write_tuner_registers(d, reg, values, len);
254 	if (ret)
255 		return ret;
256 	if (reg != 0xffff) {
257 		/* check if write done (0xa40d bit 1) or fail (0xa40d bit 2) */
258 		for (i = 0; i < 200; i++) {
259 			ret =
260 			    af9005_read_ofdm_register(d,
261 						      xd_I2C_i2c_m_status_wdat_done,
262 						      &temp);
263 			if (ret)
264 				return ret;
265 			done = temp & (regmask[i2c_m_status_wdat_done_len - 1]
266 				       << i2c_m_status_wdat_done_pos);
267 			if (done)
268 				break;
269 			fail = temp & (regmask[i2c_m_status_wdat_fail_len - 1]
270 				       << i2c_m_status_wdat_fail_pos);
271 			if (fail)
272 				break;
273 			msleep(50);
274 		}
275 		if (i == 200)
276 			return -ETIMEDOUT;
277 		if (fail) {
278 			/* clear write fail bit */
279 			af9005_write_register_bits(d,
280 						   xd_I2C_i2c_m_status_wdat_fail,
281 						   i2c_m_status_wdat_fail_pos,
282 						   i2c_m_status_wdat_fail_len,
283 						   1);
284 			return -EIO;
285 		}
286 		/* clear write done bit */
287 		ret =
288 		    af9005_write_register_bits(d,
289 					       xd_I2C_i2c_m_status_wdat_fail,
290 					       i2c_m_status_wdat_done_pos,
291 					       i2c_m_status_wdat_done_len, 1);
292 		if (ret)
293 			return ret;
294 	}
295 	return 0;
296 }
297 
298 int af9005_read_tuner_registers(struct dvb_usb_device *d, u16 reg, u8 addr,
299 				u8 * values, int len)
300 {
301 	/* don't let the name of this function mislead you: it's just used
302 	   as an interface from the firmware to the i2c bus. The actual
303 	   i2c addresses are contained in the data */
304 	int ret, i;
305 	u8 temp, buf[2];
306 
307 	buf[0] = addr;		/* tuner i2c address */
308 	buf[1] = values[0];	/* tuner register */
309 
310 	values[0] = addr + 0x01;	/* i2c read address */
311 
312 	if (reg == APO_REG_I2C_RW_SILICON_TUNER) {
313 		/* write tuner i2c address to tuner, 0c00c0 undocumented, found by sniffing */
314 		ret = af9005_write_tuner_registers(d, 0x00c0, buf, 2);
315 		if (ret)
316 			return ret;
317 	}
318 
319 	/* send read command to ofsm */
320 	ret = af9005_usb_read_tuner_registers(d, reg, values, 1);
321 	if (ret)
322 		return ret;
323 
324 	/* check if read done */
325 	for (i = 0; i < 200; i++) {
326 		ret = af9005_read_ofdm_register(d, 0xa408, &temp);
327 		if (ret)
328 			return ret;
329 		if (temp & 0x01)
330 			break;
331 		msleep(50);
332 	}
333 	if (i == 200)
334 		return -ETIMEDOUT;
335 
336 	/* clear read done bit (by writing 1) */
337 	ret = af9005_write_ofdm_register(d, xd_I2C_i2c_m_data8, 1);
338 	if (ret)
339 		return ret;
340 
341 	/* get read data (available from 0xa400) */
342 	for (i = 0; i < len; i++) {
343 		ret = af9005_read_ofdm_register(d, 0xa400 + i, &temp);
344 		if (ret)
345 			return ret;
346 		values[i] = temp;
347 	}
348 	return 0;
349 }
350 
351 static int af9005_i2c_write(struct dvb_usb_device *d, u8 i2caddr, u8 reg,
352 			    u8 * data, int len)
353 {
354 	int ret, i;
355 	u8 buf[3];
356 	deb_i2c("i2c_write i2caddr %x, reg %x, len %d data ", i2caddr,
357 		reg, len);
358 	debug_dump(data, len, deb_i2c);
359 
360 	for (i = 0; i < len; i++) {
361 		buf[0] = i2caddr;
362 		buf[1] = reg + (u8) i;
363 		buf[2] = data[i];
364 		ret =
365 		    af9005_write_tuner_registers(d,
366 						 APO_REG_I2C_RW_SILICON_TUNER,
367 						 buf, 3);
368 		if (ret) {
369 			deb_i2c("i2c_write failed\n");
370 			return ret;
371 		}
372 	}
373 	deb_i2c("i2c_write ok\n");
374 	return 0;
375 }
376 
377 static int af9005_i2c_read(struct dvb_usb_device *d, u8 i2caddr, u8 reg,
378 			   u8 * data, int len)
379 {
380 	int ret, i;
381 	u8 temp;
382 	deb_i2c("i2c_read i2caddr %x, reg %x, len %d\n ", i2caddr, reg, len);
383 	for (i = 0; i < len; i++) {
384 		temp = reg + i;
385 		ret =
386 		    af9005_read_tuner_registers(d,
387 						APO_REG_I2C_RW_SILICON_TUNER,
388 						i2caddr, &temp, 1);
389 		if (ret) {
390 			deb_i2c("i2c_read failed\n");
391 			return ret;
392 		}
393 		data[i] = temp;
394 	}
395 	deb_i2c("i2c data read: ");
396 	debug_dump(data, len, deb_i2c);
397 	return 0;
398 }
399 
400 static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
401 			   int num)
402 {
403 	/* only implements what the mt2060 module does, don't know how
404 	   to make it really generic */
405 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
406 	int ret;
407 	u8 reg, addr;
408 	u8 *value;
409 
410 	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
411 		return -EAGAIN;
412 
413 	if (num > 2)
414 		warn("more than 2 i2c messages at a time is not handled yet. TODO.");
415 
416 	if (num == 2) {
417 		/* reads a single register */
418 		reg = *msg[0].buf;
419 		addr = msg[0].addr;
420 		value = msg[1].buf;
421 		ret = af9005_i2c_read(d, addr, reg, value, 1);
422 		if (ret == 0)
423 			ret = 2;
424 	} else {
425 		/* write one or more registers */
426 		reg = msg[0].buf[0];
427 		addr = msg[0].addr;
428 		value = &msg[0].buf[1];
429 		ret = af9005_i2c_write(d, addr, reg, value, msg[0].len - 1);
430 		if (ret == 0)
431 			ret = 1;
432 	}
433 
434 	mutex_unlock(&d->i2c_mutex);
435 	return ret;
436 }
437 
438 static u32 af9005_i2c_func(struct i2c_adapter *adapter)
439 {
440 	return I2C_FUNC_I2C;
441 }
442 
443 static struct i2c_algorithm af9005_i2c_algo = {
444 	.master_xfer = af9005_i2c_xfer,
445 	.functionality = af9005_i2c_func,
446 };
447 
448 int af9005_send_command(struct dvb_usb_device *d, u8 command, u8 * wbuf,
449 			int wlen, u8 * rbuf, int rlen)
450 {
451 	struct af9005_device_state *st = d->priv;
452 
453 	int ret, i, packet_len;
454 	u8 seq;
455 
456 	if (wlen < 0) {
457 		err("send command, wlen less than 0 bytes. Makes no sense.");
458 		return -EINVAL;
459 	}
460 	if (wlen > 54) {
461 		err("send command, wlen more than 54 bytes. Not supported.");
462 		return -EINVAL;
463 	}
464 	if (rlen > 54) {
465 		err("send command, rlen more than 54 bytes. Not supported.");
466 		return -EINVAL;
467 	}
468 	packet_len = wlen + 5;
469 
470 	mutex_lock(&d->data_mutex);
471 
472 	st->data[0] = (u8) (packet_len & 0xff);
473 	st->data[1] = (u8) ((packet_len & 0xff00) >> 8);
474 
475 	st->data[2] = 0x26;		/* packet type */
476 	st->data[3] = wlen + 3;
477 	st->data[4] = seq = st->sequence++;
478 	st->data[5] = command;
479 	st->data[6] = wlen;
480 	for (i = 0; i < wlen; i++)
481 		st->data[7 + i] = wbuf[i];
482 	ret = dvb_usb_generic_rw(d, st->data, wlen + 7, st->data, rlen + 7, 0);
483 	if (st->data[2] != 0x27) {
484 		err("send command, wrong reply code.");
485 		ret = -EIO;
486 	} else if (st->data[4] != seq) {
487 		err("send command, wrong sequence in reply.");
488 		ret = -EIO;
489 	} else if (st->data[5] != 0x01) {
490 		err("send command, wrong status code in reply.");
491 		ret = -EIO;
492 	} else if (st->data[6] != rlen) {
493 		err("send command, invalid data length in reply.");
494 		ret = -EIO;
495 	}
496 	if (!ret) {
497 		for (i = 0; i < rlen; i++)
498 			rbuf[i] = st->data[i + 7];
499 	}
500 
501 	mutex_unlock(&d->data_mutex);
502 	return ret;
503 }
504 
505 int af9005_read_eeprom(struct dvb_usb_device *d, u8 address, u8 * values,
506 		       int len)
507 {
508 	struct af9005_device_state *st = d->priv;
509 	u8 seq;
510 	int ret, i;
511 
512 	mutex_lock(&d->data_mutex);
513 
514 	memset(st->data, 0, sizeof(st->data));
515 
516 	st->data[0] = 14;		/* length of rest of packet low */
517 	st->data[1] = 0;		/* length of rest of packer high */
518 
519 	st->data[2] = 0x2a;		/* read/write eeprom */
520 
521 	st->data[3] = 12;		/* size */
522 
523 	st->data[4] = seq = st->sequence++;
524 
525 	st->data[5] = 0;		/* read */
526 
527 	st->data[6] = len;
528 	st->data[7] = address;
529 	ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 14, 0);
530 	if (st->data[2] != 0x2b) {
531 		err("Read eeprom, invalid reply code");
532 		ret = -EIO;
533 	} else if (st->data[3] != 10) {
534 		err("Read eeprom, invalid reply length");
535 		ret = -EIO;
536 	} else if (st->data[4] != seq) {
537 		err("Read eeprom, wrong sequence in reply ");
538 		ret = -EIO;
539 	} else if (st->data[5] != 1) {
540 		err("Read eeprom, wrong status in reply ");
541 		ret = -EIO;
542 	}
543 
544 	if (!ret) {
545 		for (i = 0; i < len; i++)
546 			values[i] = st->data[6 + i];
547 	}
548 	mutex_unlock(&d->data_mutex);
549 
550 	return ret;
551 }
552 
553 static int af9005_boot_packet(struct usb_device *udev, int type, u8 *reply,
554 			      u8 *buf, int size)
555 {
556 	u16 checksum;
557 	int act_len, i, ret;
558 
559 	memset(buf, 0, size);
560 	buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
561 	buf[1] = (u8) ((FW_BULKOUT_SIZE >> 8) & 0xff);
562 	switch (type) {
563 	case FW_CONFIG:
564 		buf[2] = 0x11;
565 		buf[3] = 0x04;
566 		buf[4] = 0x00;	/* sequence number, original driver doesn't increment it here */
567 		buf[5] = 0x03;
568 		checksum = buf[4] + buf[5];
569 		buf[6] = (u8) ((checksum >> 8) & 0xff);
570 		buf[7] = (u8) (checksum & 0xff);
571 		break;
572 	case FW_CONFIRM:
573 		buf[2] = 0x11;
574 		buf[3] = 0x04;
575 		buf[4] = 0x00;	/* sequence number, original driver doesn't increment it here */
576 		buf[5] = 0x01;
577 		checksum = buf[4] + buf[5];
578 		buf[6] = (u8) ((checksum >> 8) & 0xff);
579 		buf[7] = (u8) (checksum & 0xff);
580 		break;
581 	case FW_BOOT:
582 		buf[2] = 0x10;
583 		buf[3] = 0x08;
584 		buf[4] = 0x00;	/* sequence number, original driver doesn't increment it here */
585 		buf[5] = 0x97;
586 		buf[6] = 0xaa;
587 		buf[7] = 0x55;
588 		buf[8] = 0xa5;
589 		buf[9] = 0x5a;
590 		checksum = 0;
591 		for (i = 4; i <= 9; i++)
592 			checksum += buf[i];
593 		buf[10] = (u8) ((checksum >> 8) & 0xff);
594 		buf[11] = (u8) (checksum & 0xff);
595 		break;
596 	default:
597 		err("boot packet invalid boot packet type");
598 		return -EINVAL;
599 	}
600 	deb_fw(">>> ");
601 	debug_dump(buf, FW_BULKOUT_SIZE + 2, deb_fw);
602 
603 	ret = usb_bulk_msg(udev,
604 			   usb_sndbulkpipe(udev, 0x02),
605 			   buf, FW_BULKOUT_SIZE + 2, &act_len, 2000);
606 	if (ret)
607 		err("boot packet bulk message failed: %d (%d/%d)", ret,
608 		    FW_BULKOUT_SIZE + 2, act_len);
609 	else
610 		ret = act_len != FW_BULKOUT_SIZE + 2 ? -1 : 0;
611 	if (ret)
612 		return ret;
613 	memset(buf, 0, 9);
614 	ret = usb_bulk_msg(udev,
615 			   usb_rcvbulkpipe(udev, 0x01), buf, 9, &act_len, 2000);
616 	if (ret) {
617 		err("boot packet recv bulk message failed: %d", ret);
618 		return ret;
619 	}
620 	deb_fw("<<< ");
621 	debug_dump(buf, act_len, deb_fw);
622 	checksum = 0;
623 	switch (type) {
624 	case FW_CONFIG:
625 		if (buf[2] != 0x11) {
626 			err("boot bad config header.");
627 			return -EIO;
628 		}
629 		if (buf[3] != 0x05) {
630 			err("boot bad config size.");
631 			return -EIO;
632 		}
633 		if (buf[4] != 0x00) {
634 			err("boot bad config sequence.");
635 			return -EIO;
636 		}
637 		if (buf[5] != 0x04) {
638 			err("boot bad config subtype.");
639 			return -EIO;
640 		}
641 		for (i = 4; i <= 6; i++)
642 			checksum += buf[i];
643 		if (buf[7] * 256 + buf[8] != checksum) {
644 			err("boot bad config checksum.");
645 			return -EIO;
646 		}
647 		*reply = buf[6];
648 		break;
649 	case FW_CONFIRM:
650 		if (buf[2] != 0x11) {
651 			err("boot bad confirm header.");
652 			return -EIO;
653 		}
654 		if (buf[3] != 0x05) {
655 			err("boot bad confirm size.");
656 			return -EIO;
657 		}
658 		if (buf[4] != 0x00) {
659 			err("boot bad confirm sequence.");
660 			return -EIO;
661 		}
662 		if (buf[5] != 0x02) {
663 			err("boot bad confirm subtype.");
664 			return -EIO;
665 		}
666 		for (i = 4; i <= 6; i++)
667 			checksum += buf[i];
668 		if (buf[7] * 256 + buf[8] != checksum) {
669 			err("boot bad confirm checksum.");
670 			return -EIO;
671 		}
672 		*reply = buf[6];
673 		break;
674 	case FW_BOOT:
675 		if (buf[2] != 0x10) {
676 			err("boot bad boot header.");
677 			return -EIO;
678 		}
679 		if (buf[3] != 0x05) {
680 			err("boot bad boot size.");
681 			return -EIO;
682 		}
683 		if (buf[4] != 0x00) {
684 			err("boot bad boot sequence.");
685 			return -EIO;
686 		}
687 		if (buf[5] != 0x01) {
688 			err("boot bad boot pattern 01.");
689 			return -EIO;
690 		}
691 		if (buf[6] != 0x10) {
692 			err("boot bad boot pattern 10.");
693 			return -EIO;
694 		}
695 		for (i = 4; i <= 6; i++)
696 			checksum += buf[i];
697 		if (buf[7] * 256 + buf[8] != checksum) {
698 			err("boot bad boot checksum.");
699 			return -EIO;
700 		}
701 		break;
702 
703 	}
704 
705 	return 0;
706 }
707 
708 static int af9005_download_firmware(struct usb_device *udev, const struct firmware *fw)
709 {
710 	int i, packets, ret, act_len;
711 
712 	u8 *buf;
713 	u8 reply;
714 
715 	buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL);
716 	if (!buf)
717 		return -ENOMEM;
718 
719 	ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf,
720 				 FW_BULKOUT_SIZE + 2);
721 	if (ret)
722 		goto err;
723 	if (reply != 0x01) {
724 		err("before downloading firmware, FW_CONFIG expected 0x01, received 0x%x", reply);
725 		ret = -EIO;
726 		goto err;
727 	}
728 	packets = fw->size / FW_BULKOUT_SIZE;
729 	buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
730 	buf[1] = (u8) ((FW_BULKOUT_SIZE >> 8) & 0xff);
731 	for (i = 0; i < packets; i++) {
732 		memcpy(&buf[2], fw->data + i * FW_BULKOUT_SIZE,
733 		       FW_BULKOUT_SIZE);
734 		deb_fw(">>> ");
735 		debug_dump(buf, FW_BULKOUT_SIZE + 2, deb_fw);
736 		ret = usb_bulk_msg(udev,
737 				   usb_sndbulkpipe(udev, 0x02),
738 				   buf, FW_BULKOUT_SIZE + 2, &act_len, 1000);
739 		if (ret) {
740 			err("firmware download failed at packet %d with code %d", i, ret);
741 			goto err;
742 		}
743 	}
744 	ret = af9005_boot_packet(udev, FW_CONFIRM, &reply,
745 				 buf, FW_BULKOUT_SIZE + 2);
746 	if (ret)
747 		goto err;
748 	if (reply != (u8) (packets & 0xff)) {
749 		err("after downloading firmware, FW_CONFIRM expected 0x%x, received 0x%x", packets & 0xff, reply);
750 		ret = -EIO;
751 		goto err;
752 	}
753 	ret = af9005_boot_packet(udev, FW_BOOT, &reply, buf,
754 				 FW_BULKOUT_SIZE + 2);
755 	if (ret)
756 		goto err;
757 	ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf,
758 				 FW_BULKOUT_SIZE + 2);
759 	if (ret)
760 		goto err;
761 	if (reply != 0x02) {
762 		err("after downloading firmware, FW_CONFIG expected 0x02, received 0x%x", reply);
763 		ret = -EIO;
764 		goto err;
765 	}
766 
767 err:
768 	kfree(buf);
769 	return ret;
770 
771 }
772 
773 int af9005_led_control(struct dvb_usb_device *d, int onoff)
774 {
775 	struct af9005_device_state *st = d->priv;
776 	int temp, ret;
777 
778 	if (onoff && dvb_usb_af9005_led)
779 		temp = 1;
780 	else
781 		temp = 0;
782 	if (st->led_state != temp) {
783 		ret =
784 		    af9005_write_register_bits(d, xd_p_reg_top_locken1,
785 					       reg_top_locken1_pos,
786 					       reg_top_locken1_len, temp);
787 		if (ret)
788 			return ret;
789 		ret =
790 		    af9005_write_register_bits(d, xd_p_reg_top_lock1,
791 					       reg_top_lock1_pos,
792 					       reg_top_lock1_len, temp);
793 		if (ret)
794 			return ret;
795 		st->led_state = temp;
796 	}
797 	return 0;
798 }
799 
800 static int af9005_frontend_attach(struct dvb_usb_adapter *adap)
801 {
802 	u8 buf[8];
803 	int i;
804 
805 	/* without these calls the first commands after downloading
806 	   the firmware fail. I put these calls here to simulate
807 	   what it is done in dvb-usb-init.c.
808 	 */
809 	struct usb_device *udev = adap->dev->udev;
810 	usb_clear_halt(udev, usb_sndbulkpipe(udev, 2));
811 	usb_clear_halt(udev, usb_rcvbulkpipe(udev, 1));
812 	if (dvb_usb_af9005_dump_eeprom) {
813 		printk("EEPROM DUMP\n");
814 		for (i = 0; i < 255; i += 8) {
815 			af9005_read_eeprom(adap->dev, i, buf, 8);
816 			debug_dump(buf, 8, printk);
817 		}
818 	}
819 	adap->fe_adap[0].fe = af9005_fe_attach(adap->dev);
820 	return 0;
821 }
822 
823 static int af9005_rc_query(struct dvb_usb_device *d, u32 * event, int *state)
824 {
825 	struct af9005_device_state *st = d->priv;
826 	int ret, len;
827 	u8 seq;
828 
829 	*state = REMOTE_NO_KEY_PRESSED;
830 	if (rc_decode == NULL) {
831 		/* it shouldn't never come here */
832 		return 0;
833 	}
834 
835 	mutex_lock(&d->data_mutex);
836 
837 	/* deb_info("rc_query\n"); */
838 	st->data[0] = 3;		/* rest of packet length low */
839 	st->data[1] = 0;		/* rest of packet length high */
840 	st->data[2] = 0x40;		/* read remote */
841 	st->data[3] = 1;		/* rest of packet length */
842 	st->data[4] = seq = st->sequence++;	/* sequence number */
843 	ret = dvb_usb_generic_rw(d, st->data, 5, st->data, 256, 0);
844 	if (ret) {
845 		err("rc query failed");
846 		goto ret;
847 	}
848 	if (st->data[2] != 0x41) {
849 		err("rc query bad header.");
850 		ret = -EIO;
851 		goto ret;
852 	} else if (st->data[4] != seq) {
853 		err("rc query bad sequence.");
854 		ret = -EIO;
855 		goto ret;
856 	}
857 	len = st->data[5];
858 	if (len > 246) {
859 		err("rc query invalid length");
860 		ret = -EIO;
861 		goto ret;
862 	}
863 	if (len > 0) {
864 		deb_rc("rc data (%d) ", len);
865 		debug_dump((st->data + 6), len, deb_rc);
866 		ret = rc_decode(d, &st->data[6], len, event, state);
867 		if (ret) {
868 			err("rc_decode failed");
869 			goto ret;
870 		} else {
871 			deb_rc("rc_decode state %x event %x\n", *state, *event);
872 			if (*state == REMOTE_KEY_REPEAT)
873 				*event = d->last_event;
874 		}
875 	}
876 
877 ret:
878 	mutex_unlock(&d->data_mutex);
879 	return ret;
880 }
881 
882 static int af9005_power_ctrl(struct dvb_usb_device *d, int onoff)
883 {
884 
885 	return 0;
886 }
887 
888 static int af9005_pid_filter_control(struct dvb_usb_adapter *adap, int onoff)
889 {
890 	int ret;
891 	deb_info("pid filter control  onoff %d\n", onoff);
892 	if (onoff) {
893 		ret =
894 		    af9005_write_ofdm_register(adap->dev, XD_MP2IF_DMX_CTRL, 1);
895 		if (ret)
896 			return ret;
897 		ret =
898 		    af9005_write_register_bits(adap->dev,
899 					       XD_MP2IF_DMX_CTRL, 1, 1, 1);
900 		if (ret)
901 			return ret;
902 		ret =
903 		    af9005_write_ofdm_register(adap->dev, XD_MP2IF_DMX_CTRL, 1);
904 	} else
905 		ret =
906 		    af9005_write_ofdm_register(adap->dev, XD_MP2IF_DMX_CTRL, 0);
907 	if (ret)
908 		return ret;
909 	deb_info("pid filter control ok\n");
910 	return 0;
911 }
912 
913 static int af9005_pid_filter(struct dvb_usb_adapter *adap, int index,
914 			     u16 pid, int onoff)
915 {
916 	u8 cmd = index & 0x1f;
917 	int ret;
918 	deb_info("set pid filter, index %d, pid %x, onoff %d\n", index,
919 		 pid, onoff);
920 	if (onoff) {
921 		/* cannot use it as pid_filter_ctrl since it has to be done
922 		   before setting the first pid */
923 		if (adap->feedcount == 1) {
924 			deb_info("first pid set, enable pid table\n");
925 			ret = af9005_pid_filter_control(adap, onoff);
926 			if (ret)
927 				return ret;
928 		}
929 		ret =
930 		    af9005_write_ofdm_register(adap->dev,
931 					       XD_MP2IF_PID_DATA_L,
932 					       (u8) (pid & 0xff));
933 		if (ret)
934 			return ret;
935 		ret =
936 		    af9005_write_ofdm_register(adap->dev,
937 					       XD_MP2IF_PID_DATA_H,
938 					       (u8) (pid >> 8));
939 		if (ret)
940 			return ret;
941 		cmd |= 0x20 | 0x40;
942 	} else {
943 		if (adap->feedcount == 0) {
944 			deb_info("last pid unset, disable pid table\n");
945 			ret = af9005_pid_filter_control(adap, onoff);
946 			if (ret)
947 				return ret;
948 		}
949 	}
950 	ret = af9005_write_ofdm_register(adap->dev, XD_MP2IF_PID_IDX, cmd);
951 	if (ret)
952 		return ret;
953 	deb_info("set pid ok\n");
954 	return 0;
955 }
956 
957 static int af9005_identify_state(struct usb_device *udev,
958 				 struct dvb_usb_device_properties *props,
959 				 struct dvb_usb_device_description **desc,
960 				 int *cold)
961 {
962 	int ret;
963 	u8 reply, *buf;
964 
965 	buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL);
966 	if (!buf)
967 		return -ENOMEM;
968 
969 	ret = af9005_boot_packet(udev, FW_CONFIG, &reply,
970 				 buf, FW_BULKOUT_SIZE + 2);
971 	if (ret)
972 		goto err;
973 	deb_info("result of FW_CONFIG in identify state %d\n", reply);
974 	if (reply == 0x01)
975 		*cold = 1;
976 	else if (reply == 0x02)
977 		*cold = 0;
978 	else
979 		return -EIO;
980 	deb_info("Identify state cold = %d\n", *cold);
981 
982 err:
983 	kfree(buf);
984 	return ret;
985 }
986 
987 static struct dvb_usb_device_properties af9005_properties;
988 
989 static int af9005_usb_probe(struct usb_interface *intf,
990 			    const struct usb_device_id *id)
991 {
992 	return dvb_usb_device_init(intf, &af9005_properties,
993 				  THIS_MODULE, NULL, adapter_nr);
994 }
995 
996 enum af9005_usb_table_entry {
997 	AFATECH_AF9005,
998 	TERRATEC_AF9005,
999 	ANSONIC_AF9005,
1000 };
1001 
1002 static struct usb_device_id af9005_usb_table[] = {
1003 	[AFATECH_AF9005] = {USB_DEVICE(USB_VID_AFATECH,
1004 				USB_PID_AFATECH_AF9005)},
1005 	[TERRATEC_AF9005] = {USB_DEVICE(USB_VID_TERRATEC,
1006 				USB_PID_TERRATEC_CINERGY_T_USB_XE)},
1007 	[ANSONIC_AF9005] = {USB_DEVICE(USB_VID_ANSONIC,
1008 				USB_PID_ANSONIC_DVBT_USB)},
1009 	{ }
1010 };
1011 
1012 MODULE_DEVICE_TABLE(usb, af9005_usb_table);
1013 
1014 static struct dvb_usb_device_properties af9005_properties = {
1015 	.caps = DVB_USB_IS_AN_I2C_ADAPTER,
1016 
1017 	.usb_ctrl = DEVICE_SPECIFIC,
1018 	.firmware = "af9005.fw",
1019 	.download_firmware = af9005_download_firmware,
1020 	.no_reconnect = 1,
1021 
1022 	.size_of_priv = sizeof(struct af9005_device_state),
1023 
1024 	.num_adapters = 1,
1025 	.adapter = {
1026 		    {
1027 		    .num_frontends = 1,
1028 		    .fe = {{
1029 		     .caps =
1030 		     DVB_USB_ADAP_HAS_PID_FILTER |
1031 		     DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
1032 		     .pid_filter_count = 32,
1033 		     .pid_filter = af9005_pid_filter,
1034 		     /* .pid_filter_ctrl = af9005_pid_filter_control, */
1035 		     .frontend_attach = af9005_frontend_attach,
1036 		     /* .tuner_attach     = af9005_tuner_attach, */
1037 		     /* parameter for the MPEG2-data transfer */
1038 		     .stream = {
1039 				.type = USB_BULK,
1040 				.count = 10,
1041 				.endpoint = 0x04,
1042 				.u = {
1043 				      .bulk = {
1044 					       .buffersize = 4096,	/* actual size seen is 3948 */
1045 					       }
1046 				      }
1047 				},
1048 		     }},
1049 		     }
1050 		    },
1051 	.power_ctrl = af9005_power_ctrl,
1052 	.identify_state = af9005_identify_state,
1053 
1054 	.i2c_algo = &af9005_i2c_algo,
1055 
1056 	.rc.legacy = {
1057 		.rc_interval = 200,
1058 		.rc_map_table = NULL,
1059 		.rc_map_size = 0,
1060 		.rc_query = af9005_rc_query,
1061 	},
1062 
1063 	.generic_bulk_ctrl_endpoint          = 2,
1064 	.generic_bulk_ctrl_endpoint_response = 1,
1065 
1066 	.num_device_descs = 3,
1067 	.devices = {
1068 		    {.name = "Afatech DVB-T USB1.1 stick",
1069 		     .cold_ids = {&af9005_usb_table[AFATECH_AF9005], NULL},
1070 		     .warm_ids = {NULL},
1071 		     },
1072 		    {.name = "TerraTec Cinergy T USB XE",
1073 		     .cold_ids = {&af9005_usb_table[TERRATEC_AF9005], NULL},
1074 		     .warm_ids = {NULL},
1075 		     },
1076 		    {.name = "Ansonic DVB-T USB1.1 stick",
1077 		     .cold_ids = {&af9005_usb_table[ANSONIC_AF9005], NULL},
1078 		     .warm_ids = {NULL},
1079 		     },
1080 		    {NULL},
1081 		    }
1082 };
1083 
1084 /* usb specific object needed to register this driver with the usb subsystem */
1085 static struct usb_driver af9005_usb_driver = {
1086 	.name = "dvb_usb_af9005",
1087 	.probe = af9005_usb_probe,
1088 	.disconnect = dvb_usb_device_exit,
1089 	.id_table = af9005_usb_table,
1090 };
1091 
1092 /* module stuff */
1093 static int __init af9005_usb_module_init(void)
1094 {
1095 	int result;
1096 	if ((result = usb_register(&af9005_usb_driver))) {
1097 		err("usb_register failed. (%d)", result);
1098 		return result;
1099 	}
1100 #if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
1101 	/* FIXME: convert to todays kernel IR infrastructure */
1102 	rc_decode = symbol_request(af9005_rc_decode);
1103 	rc_keys = symbol_request(rc_map_af9005_table);
1104 	rc_keys_size = symbol_request(rc_map_af9005_table_size);
1105 #endif
1106 	if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
1107 		err("af9005_rc_decode function not found, disabling remote");
1108 		af9005_properties.rc.legacy.rc_query = NULL;
1109 	} else {
1110 		af9005_properties.rc.legacy.rc_map_table = rc_keys;
1111 		af9005_properties.rc.legacy.rc_map_size = *rc_keys_size;
1112 	}
1113 
1114 	return 0;
1115 }
1116 
1117 static void __exit af9005_usb_module_exit(void)
1118 {
1119 	/* release rc decode symbols */
1120 	if (rc_decode != NULL)
1121 		symbol_put(af9005_rc_decode);
1122 	if (rc_keys != NULL)
1123 		symbol_put(rc_map_af9005_table);
1124 	if (rc_keys_size != NULL)
1125 		symbol_put(rc_map_af9005_table_size);
1126 	/* deregister this driver from the USB subsystem */
1127 	usb_deregister(&af9005_usb_driver);
1128 }
1129 
1130 module_init(af9005_usb_module_init);
1131 module_exit(af9005_usb_module_exit);
1132 
1133 MODULE_AUTHOR("Luca Olivetti <luca@ventoso.org>");
1134 MODULE_DESCRIPTION("Driver for Afatech 9005 DVB-T USB1.1 stick");
1135 MODULE_VERSION("1.0");
1136 MODULE_LICENSE("GPL");
1137