1 /*
2  * Afatech AF9035 DVB USB driver
3  *
4  * Copyright (C) 2009 Antti Palosaari <crope@iki.fi>
5  * Copyright (C) 2012 Antti Palosaari <crope@iki.fi>
6  *
7  *    This program is free software; you can redistribute it and/or modify
8  *    it under the terms of the GNU General Public License as published by
9  *    the Free Software Foundation; either version 2 of the License, or
10  *    (at your option) any later version.
11  *
12  *    This program is distributed in the hope that it will be useful,
13  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
14  *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  *    GNU General Public License for more details.
16  *
17  *    You should have received a copy of the GNU General Public License along
18  *    with this program; if not, write to the Free Software Foundation, Inc.,
19  *    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20  */
21 
22 #include "af9035.h"
23 
24 /* Max transfer size done by I2C transfer functions */
25 #define MAX_XFER_SIZE  64
26 
27 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
28 
29 static u16 af9035_checksum(const u8 *buf, size_t len)
30 {
31 	size_t i;
32 	u16 checksum = 0;
33 
34 	for (i = 1; i < len; i++) {
35 		if (i % 2)
36 			checksum += buf[i] << 8;
37 		else
38 			checksum += buf[i];
39 	}
40 	checksum = ~checksum;
41 
42 	return checksum;
43 }
44 
45 static int af9035_ctrl_msg(struct dvb_usb_device *d, struct usb_req *req)
46 {
47 #define REQ_HDR_LEN 4 /* send header size */
48 #define ACK_HDR_LEN 3 /* rece header size */
49 #define CHECKSUM_LEN 2
50 #define USB_TIMEOUT 2000
51 	struct state *state = d_to_priv(d);
52 	int ret, wlen, rlen;
53 	u16 checksum, tmp_checksum;
54 
55 	mutex_lock(&d->usb_mutex);
56 
57 	/* buffer overflow check */
58 	if (req->wlen > (BUF_LEN - REQ_HDR_LEN - CHECKSUM_LEN) ||
59 			req->rlen > (BUF_LEN - ACK_HDR_LEN - CHECKSUM_LEN)) {
60 		dev_err(&d->udev->dev, "%s: too much data wlen=%d rlen=%d\n",
61 				KBUILD_MODNAME, req->wlen, req->rlen);
62 		ret = -EINVAL;
63 		goto exit;
64 	}
65 
66 	state->buf[0] = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN - 1;
67 	state->buf[1] = req->mbox;
68 	state->buf[2] = req->cmd;
69 	state->buf[3] = state->seq++;
70 	memcpy(&state->buf[REQ_HDR_LEN], req->wbuf, req->wlen);
71 
72 	wlen = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN;
73 	rlen = ACK_HDR_LEN + req->rlen + CHECKSUM_LEN;
74 
75 	/* calc and add checksum */
76 	checksum = af9035_checksum(state->buf, state->buf[0] - 1);
77 	state->buf[state->buf[0] - 1] = (checksum >> 8);
78 	state->buf[state->buf[0] - 0] = (checksum & 0xff);
79 
80 	/* no ack for these packets */
81 	if (req->cmd == CMD_FW_DL)
82 		rlen = 0;
83 
84 	ret = dvb_usbv2_generic_rw_locked(d,
85 			state->buf, wlen, state->buf, rlen);
86 	if (ret)
87 		goto exit;
88 
89 	/* no ack for those packets */
90 	if (req->cmd == CMD_FW_DL)
91 		goto exit;
92 
93 	/* verify checksum */
94 	checksum = af9035_checksum(state->buf, rlen - 2);
95 	tmp_checksum = (state->buf[rlen - 2] << 8) | state->buf[rlen - 1];
96 	if (tmp_checksum != checksum) {
97 		dev_err(&d->udev->dev,
98 				"%s: command=%02x checksum mismatch (%04x != %04x)\n",
99 				KBUILD_MODNAME, req->cmd, tmp_checksum,
100 				checksum);
101 		ret = -EIO;
102 		goto exit;
103 	}
104 
105 	/* check status */
106 	if (state->buf[2]) {
107 		/* fw returns status 1 when IR code was not received */
108 		if (req->cmd == CMD_IR_GET || state->buf[2] == 1) {
109 			ret = 1;
110 			goto exit;
111 		}
112 
113 		dev_dbg(&d->udev->dev, "%s: command=%02x failed fw error=%d\n",
114 				__func__, req->cmd, state->buf[2]);
115 		ret = -EIO;
116 		goto exit;
117 	}
118 
119 	/* read request, copy returned data to return buf */
120 	if (req->rlen)
121 		memcpy(req->rbuf, &state->buf[ACK_HDR_LEN], req->rlen);
122 exit:
123 	mutex_unlock(&d->usb_mutex);
124 	if (ret < 0)
125 		dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
126 	return ret;
127 }
128 
129 /* write multiple registers */
130 static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
131 {
132 	u8 wbuf[MAX_XFER_SIZE];
133 	u8 mbox = (reg >> 16) & 0xff;
134 	struct usb_req req = { CMD_MEM_WR, mbox, 6 + len, wbuf, 0, NULL };
135 
136 	if (6 + len > sizeof(wbuf)) {
137 		dev_warn(&d->udev->dev, "%s: i2c wr: len=%d is too big!\n",
138 			 KBUILD_MODNAME, len);
139 		return -EOPNOTSUPP;
140 	}
141 
142 	wbuf[0] = len;
143 	wbuf[1] = 2;
144 	wbuf[2] = 0;
145 	wbuf[3] = 0;
146 	wbuf[4] = (reg >> 8) & 0xff;
147 	wbuf[5] = (reg >> 0) & 0xff;
148 	memcpy(&wbuf[6], val, len);
149 
150 	return af9035_ctrl_msg(d, &req);
151 }
152 
153 /* read multiple registers */
154 static int af9035_rd_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
155 {
156 	u8 wbuf[] = { len, 2, 0, 0, (reg >> 8) & 0xff, reg & 0xff };
157 	u8 mbox = (reg >> 16) & 0xff;
158 	struct usb_req req = { CMD_MEM_RD, mbox, sizeof(wbuf), wbuf, len, val };
159 
160 	return af9035_ctrl_msg(d, &req);
161 }
162 
163 /* write single register */
164 static int af9035_wr_reg(struct dvb_usb_device *d, u32 reg, u8 val)
165 {
166 	return af9035_wr_regs(d, reg, &val, 1);
167 }
168 
169 /* read single register */
170 static int af9035_rd_reg(struct dvb_usb_device *d, u32 reg, u8 *val)
171 {
172 	return af9035_rd_regs(d, reg, val, 1);
173 }
174 
175 /* write single register with mask */
176 static int af9035_wr_reg_mask(struct dvb_usb_device *d, u32 reg, u8 val,
177 		u8 mask)
178 {
179 	int ret;
180 	u8 tmp;
181 
182 	/* no need for read if whole reg is written */
183 	if (mask != 0xff) {
184 		ret = af9035_rd_regs(d, reg, &tmp, 1);
185 		if (ret)
186 			return ret;
187 
188 		val &= mask;
189 		tmp &= ~mask;
190 		val |= tmp;
191 	}
192 
193 	return af9035_wr_regs(d, reg, &val, 1);
194 }
195 
196 static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
197 		struct i2c_msg msg[], int num)
198 {
199 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
200 	struct state *state = d_to_priv(d);
201 	int ret;
202 
203 	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
204 		return -EAGAIN;
205 
206 	/*
207 	 * I2C sub header is 5 bytes long. Meaning of those bytes are:
208 	 * 0: data len
209 	 * 1: I2C addr << 1
210 	 * 2: reg addr len
211 	 *    byte 3 and 4 can be used as reg addr
212 	 * 3: reg addr MSB
213 	 *    used when reg addr len is set to 2
214 	 * 4: reg addr LSB
215 	 *    used when reg addr len is set to 1 or 2
216 	 *
217 	 * For the simplify we do not use register addr at all.
218 	 * NOTE: As a firmware knows tuner type there is very small possibility
219 	 * there could be some tuner I2C hacks done by firmware and this may
220 	 * lead problems if firmware expects those bytes are used.
221 	 */
222 	if (num == 2 && !(msg[0].flags & I2C_M_RD) &&
223 			(msg[1].flags & I2C_M_RD)) {
224 		if (msg[0].len > 40 || msg[1].len > 40) {
225 			/* TODO: correct limits > 40 */
226 			ret = -EOPNOTSUPP;
227 		} else if ((msg[0].addr == state->af9033_config[0].i2c_addr) ||
228 			   (msg[0].addr == state->af9033_config[1].i2c_addr)) {
229 			/* demod access via firmware interface */
230 			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
231 					msg[0].buf[2];
232 
233 			if (msg[0].addr == state->af9033_config[1].i2c_addr)
234 				reg |= 0x100000;
235 
236 			ret = af9035_rd_regs(d, reg, &msg[1].buf[0],
237 					msg[1].len);
238 		} else {
239 			/* I2C */
240 			u8 buf[MAX_XFER_SIZE];
241 			struct usb_req req = { CMD_I2C_RD, 0, 5 + msg[0].len,
242 					buf, msg[1].len, msg[1].buf };
243 
244 			if (5 + msg[0].len > sizeof(buf)) {
245 				dev_warn(&d->udev->dev,
246 					 "%s: i2c xfer: len=%d is too big!\n",
247 					 KBUILD_MODNAME, msg[0].len);
248 				ret = -EOPNOTSUPP;
249 				goto unlock;
250 			}
251 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
252 			buf[0] = msg[1].len;
253 			buf[1] = msg[0].addr << 1;
254 			buf[2] = 0x00; /* reg addr len */
255 			buf[3] = 0x00; /* reg addr MSB */
256 			buf[4] = 0x00; /* reg addr LSB */
257 			memcpy(&buf[5], msg[0].buf, msg[0].len);
258 			ret = af9035_ctrl_msg(d, &req);
259 		}
260 	} else if (num == 1 && !(msg[0].flags & I2C_M_RD)) {
261 		if (msg[0].len > 40) {
262 			/* TODO: correct limits > 40 */
263 			ret = -EOPNOTSUPP;
264 		} else if ((msg[0].addr == state->af9033_config[0].i2c_addr) ||
265 			   (msg[0].addr == state->af9033_config[1].i2c_addr)) {
266 			/* demod access via firmware interface */
267 			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
268 					msg[0].buf[2];
269 
270 			if (msg[0].addr == state->af9033_config[1].i2c_addr)
271 				reg |= 0x100000;
272 
273 			ret = af9035_wr_regs(d, reg, &msg[0].buf[3],
274 					msg[0].len - 3);
275 		} else {
276 			/* I2C */
277 			u8 buf[MAX_XFER_SIZE];
278 			struct usb_req req = { CMD_I2C_WR, 0, 5 + msg[0].len,
279 					buf, 0, NULL };
280 
281 			if (5 + msg[0].len > sizeof(buf)) {
282 				dev_warn(&d->udev->dev,
283 					 "%s: i2c xfer: len=%d is too big!\n",
284 					 KBUILD_MODNAME, msg[0].len);
285 				ret = -EOPNOTSUPP;
286 				goto unlock;
287 			}
288 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
289 			buf[0] = msg[0].len;
290 			buf[1] = msg[0].addr << 1;
291 			buf[2] = 0x00; /* reg addr len */
292 			buf[3] = 0x00; /* reg addr MSB */
293 			buf[4] = 0x00; /* reg addr LSB */
294 			memcpy(&buf[5], msg[0].buf, msg[0].len);
295 			ret = af9035_ctrl_msg(d, &req);
296 		}
297 	} else if (num == 1 && (msg[0].flags & I2C_M_RD)) {
298 		if (msg[0].len > 40) {
299 			/* TODO: correct limits > 40 */
300 			ret = -EOPNOTSUPP;
301 		} else {
302 			/* I2C */
303 			u8 buf[5];
304 			struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
305 					buf, msg[0].len, msg[0].buf };
306 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
307 			buf[0] = msg[0].len;
308 			buf[1] = msg[0].addr << 1;
309 			buf[2] = 0x00; /* reg addr len */
310 			buf[3] = 0x00; /* reg addr MSB */
311 			buf[4] = 0x00; /* reg addr LSB */
312 			ret = af9035_ctrl_msg(d, &req);
313 		}
314 	} else {
315 		/*
316 		 * We support only three kind of I2C transactions:
317 		 * 1) 1 x read + 1 x write (repeated start)
318 		 * 2) 1 x write
319 		 * 3) 1 x read
320 		 */
321 		ret = -EOPNOTSUPP;
322 	}
323 
324 unlock:
325 	mutex_unlock(&d->i2c_mutex);
326 
327 	if (ret < 0)
328 		return ret;
329 	else
330 		return num;
331 }
332 
333 static u32 af9035_i2c_functionality(struct i2c_adapter *adapter)
334 {
335 	return I2C_FUNC_I2C;
336 }
337 
338 static struct i2c_algorithm af9035_i2c_algo = {
339 	.master_xfer = af9035_i2c_master_xfer,
340 	.functionality = af9035_i2c_functionality,
341 };
342 
343 static int af9035_identify_state(struct dvb_usb_device *d, const char **name)
344 {
345 	struct state *state = d_to_priv(d);
346 	int ret;
347 	u8 wbuf[1] = { 1 };
348 	u8 rbuf[4];
349 	struct usb_req req = { CMD_FW_QUERYINFO, 0, sizeof(wbuf), wbuf,
350 			sizeof(rbuf), rbuf };
351 
352 	ret = af9035_rd_regs(d, 0x1222, rbuf, 3);
353 	if (ret < 0)
354 		goto err;
355 
356 	state->chip_version = rbuf[0];
357 	state->chip_type = rbuf[2] << 8 | rbuf[1] << 0;
358 
359 	ret = af9035_rd_reg(d, 0x384f, &state->prechip_version);
360 	if (ret < 0)
361 		goto err;
362 
363 	dev_info(&d->udev->dev,
364 			"%s: prechip_version=%02x chip_version=%02x chip_type=%04x\n",
365 			KBUILD_MODNAME, state->prechip_version,
366 			state->chip_version, state->chip_type);
367 
368 	if (state->chip_type == 0x9135) {
369 		if (state->chip_version == 0x02)
370 			*name = AF9035_FIRMWARE_IT9135_V2;
371 		else
372 			*name = AF9035_FIRMWARE_IT9135_V1;
373 		state->eeprom_addr = EEPROM_BASE_IT9135;
374 	} else {
375 		*name = AF9035_FIRMWARE_AF9035;
376 		state->eeprom_addr = EEPROM_BASE_AF9035;
377 	}
378 
379 	ret = af9035_ctrl_msg(d, &req);
380 	if (ret < 0)
381 		goto err;
382 
383 	dev_dbg(&d->udev->dev, "%s: reply=%*ph\n", __func__, 4, rbuf);
384 	if (rbuf[0] || rbuf[1] || rbuf[2] || rbuf[3])
385 		ret = WARM;
386 	else
387 		ret = COLD;
388 
389 	return ret;
390 
391 err:
392 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
393 
394 	return ret;
395 }
396 
397 static int af9035_download_firmware_old(struct dvb_usb_device *d,
398 		const struct firmware *fw)
399 {
400 	int ret, i, j, len;
401 	u8 wbuf[1];
402 	struct usb_req req = { 0, 0, 0, NULL, 0, NULL };
403 	struct usb_req req_fw_dl = { CMD_FW_DL, 0, 0, wbuf, 0, NULL };
404 	u8 hdr_core;
405 	u16 hdr_addr, hdr_data_len, hdr_checksum;
406 	#define MAX_DATA 58
407 	#define HDR_SIZE 7
408 
409 	/*
410 	 * Thanks to Daniel Glöckner <daniel-gl@gmx.net> about that info!
411 	 *
412 	 * byte 0: MCS 51 core
413 	 *  There are two inside the AF9035 (1=Link and 2=OFDM) with separate
414 	 *  address spaces
415 	 * byte 1-2: Big endian destination address
416 	 * byte 3-4: Big endian number of data bytes following the header
417 	 * byte 5-6: Big endian header checksum, apparently ignored by the chip
418 	 *  Calculated as ~(h[0]*256+h[1]+h[2]*256+h[3]+h[4]*256)
419 	 */
420 
421 	for (i = fw->size; i > HDR_SIZE;) {
422 		hdr_core = fw->data[fw->size - i + 0];
423 		hdr_addr = fw->data[fw->size - i + 1] << 8;
424 		hdr_addr |= fw->data[fw->size - i + 2] << 0;
425 		hdr_data_len = fw->data[fw->size - i + 3] << 8;
426 		hdr_data_len |= fw->data[fw->size - i + 4] << 0;
427 		hdr_checksum = fw->data[fw->size - i + 5] << 8;
428 		hdr_checksum |= fw->data[fw->size - i + 6] << 0;
429 
430 		dev_dbg(&d->udev->dev,
431 				"%s: core=%d addr=%04x data_len=%d checksum=%04x\n",
432 				__func__, hdr_core, hdr_addr, hdr_data_len,
433 				hdr_checksum);
434 
435 		if (((hdr_core != 1) && (hdr_core != 2)) ||
436 				(hdr_data_len > i)) {
437 			dev_dbg(&d->udev->dev, "%s: bad firmware\n", __func__);
438 			break;
439 		}
440 
441 		/* download begin packet */
442 		req.cmd = CMD_FW_DL_BEGIN;
443 		ret = af9035_ctrl_msg(d, &req);
444 		if (ret < 0)
445 			goto err;
446 
447 		/* download firmware packet(s) */
448 		for (j = HDR_SIZE + hdr_data_len; j > 0; j -= MAX_DATA) {
449 			len = j;
450 			if (len > MAX_DATA)
451 				len = MAX_DATA;
452 			req_fw_dl.wlen = len;
453 			req_fw_dl.wbuf = (u8 *) &fw->data[fw->size - i +
454 					HDR_SIZE + hdr_data_len - j];
455 			ret = af9035_ctrl_msg(d, &req_fw_dl);
456 			if (ret < 0)
457 				goto err;
458 		}
459 
460 		/* download end packet */
461 		req.cmd = CMD_FW_DL_END;
462 		ret = af9035_ctrl_msg(d, &req);
463 		if (ret < 0)
464 			goto err;
465 
466 		i -= hdr_data_len + HDR_SIZE;
467 
468 		dev_dbg(&d->udev->dev, "%s: data uploaded=%zu\n",
469 				__func__, fw->size - i);
470 	}
471 
472 	/* print warn if firmware is bad, continue and see what happens */
473 	if (i)
474 		dev_warn(&d->udev->dev, "%s: bad firmware\n", KBUILD_MODNAME);
475 
476 	return 0;
477 
478 err:
479 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
480 
481 	return ret;
482 }
483 
484 static int af9035_download_firmware_new(struct dvb_usb_device *d,
485 		const struct firmware *fw)
486 {
487 	int ret, i, i_prev;
488 	struct usb_req req_fw_dl = { CMD_FW_SCATTER_WR, 0, 0, NULL, 0, NULL };
489 	#define HDR_SIZE 7
490 
491 	/*
492 	 * There seems to be following firmware header. Meaning of bytes 0-3
493 	 * is unknown.
494 	 *
495 	 * 0: 3
496 	 * 1: 0, 1
497 	 * 2: 0
498 	 * 3: 1, 2, 3
499 	 * 4: addr MSB
500 	 * 5: addr LSB
501 	 * 6: count of data bytes ?
502 	 */
503 	for (i = HDR_SIZE, i_prev = 0; i <= fw->size; i++) {
504 		if (i == fw->size ||
505 				(fw->data[i + 0] == 0x03 &&
506 				(fw->data[i + 1] == 0x00 ||
507 				fw->data[i + 1] == 0x01) &&
508 				fw->data[i + 2] == 0x00)) {
509 			req_fw_dl.wlen = i - i_prev;
510 			req_fw_dl.wbuf = (u8 *) &fw->data[i_prev];
511 			i_prev = i;
512 			ret = af9035_ctrl_msg(d, &req_fw_dl);
513 			if (ret < 0)
514 				goto err;
515 
516 			dev_dbg(&d->udev->dev, "%s: data uploaded=%d\n",
517 					__func__, i);
518 		}
519 	}
520 
521 	return 0;
522 
523 err:
524 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
525 
526 	return ret;
527 }
528 
529 static int af9035_download_firmware(struct dvb_usb_device *d,
530 		const struct firmware *fw)
531 {
532 	struct state *state = d_to_priv(d);
533 	int ret;
534 	u8 wbuf[1];
535 	u8 rbuf[4];
536 	u8 tmp;
537 	struct usb_req req = { 0, 0, 0, NULL, 0, NULL };
538 	struct usb_req req_fw_ver = { CMD_FW_QUERYINFO, 0, 1, wbuf, 4, rbuf };
539 	dev_dbg(&d->udev->dev, "%s:\n", __func__);
540 
541 	/*
542 	 * In case of dual tuner configuration we need to do some extra
543 	 * initialization in order to download firmware to slave demod too,
544 	 * which is done by master demod.
545 	 * Master feeds also clock and controls power via GPIO.
546 	 */
547 	ret = af9035_rd_reg(d, state->eeprom_addr + EEPROM_TS_MODE, &tmp);
548 	if (ret < 0)
549 		goto err;
550 
551 	if (tmp == 1 || tmp == 3) {
552 		/* configure gpioh1, reset & power slave demod */
553 		ret = af9035_wr_reg_mask(d, 0x00d8b0, 0x01, 0x01);
554 		if (ret < 0)
555 			goto err;
556 
557 		ret = af9035_wr_reg_mask(d, 0x00d8b1, 0x01, 0x01);
558 		if (ret < 0)
559 			goto err;
560 
561 		ret = af9035_wr_reg_mask(d, 0x00d8af, 0x00, 0x01);
562 		if (ret < 0)
563 			goto err;
564 
565 		usleep_range(10000, 50000);
566 
567 		ret = af9035_wr_reg_mask(d, 0x00d8af, 0x01, 0x01);
568 		if (ret < 0)
569 			goto err;
570 
571 		/* tell the slave I2C address */
572 		ret = af9035_rd_reg(d,
573 				state->eeprom_addr + EEPROM_2ND_DEMOD_ADDR,
574 				&tmp);
575 		if (ret < 0)
576 			goto err;
577 
578 		/* use default I2C address if eeprom has no address set */
579 		if (!tmp)
580 			tmp = 0x3a;
581 
582 		if (state->chip_type == 0x9135) {
583 			ret = af9035_wr_reg(d, 0x004bfb, tmp);
584 			if (ret < 0)
585 				goto err;
586 		} else {
587 			ret = af9035_wr_reg(d, 0x00417f, tmp);
588 			if (ret < 0)
589 				goto err;
590 
591 			/* enable clock out */
592 			ret = af9035_wr_reg_mask(d, 0x00d81a, 0x01, 0x01);
593 			if (ret < 0)
594 				goto err;
595 		}
596 	}
597 
598 	if (fw->data[0] == 0x01)
599 		ret = af9035_download_firmware_old(d, fw);
600 	else
601 		ret = af9035_download_firmware_new(d, fw);
602 	if (ret < 0)
603 		goto err;
604 
605 	/* firmware loaded, request boot */
606 	req.cmd = CMD_FW_BOOT;
607 	ret = af9035_ctrl_msg(d, &req);
608 	if (ret < 0)
609 		goto err;
610 
611 	/* ensure firmware starts */
612 	wbuf[0] = 1;
613 	ret = af9035_ctrl_msg(d, &req_fw_ver);
614 	if (ret < 0)
615 		goto err;
616 
617 	if (!(rbuf[0] || rbuf[1] || rbuf[2] || rbuf[3])) {
618 		dev_err(&d->udev->dev, "%s: firmware did not run\n",
619 				KBUILD_MODNAME);
620 		ret = -ENODEV;
621 		goto err;
622 	}
623 
624 	dev_info(&d->udev->dev, "%s: firmware version=%d.%d.%d.%d",
625 			KBUILD_MODNAME, rbuf[0], rbuf[1], rbuf[2], rbuf[3]);
626 
627 	return 0;
628 
629 err:
630 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
631 
632 	return ret;
633 }
634 
635 static int af9035_read_config(struct dvb_usb_device *d)
636 {
637 	struct state *state = d_to_priv(d);
638 	int ret, i;
639 	u8 tmp;
640 	u16 tmp16, addr;
641 
642 	/* demod I2C "address" */
643 	state->af9033_config[0].i2c_addr = 0x38;
644 	state->af9033_config[1].i2c_addr = 0x3a;
645 	state->af9033_config[0].adc_multiplier = AF9033_ADC_MULTIPLIER_2X;
646 	state->af9033_config[1].adc_multiplier = AF9033_ADC_MULTIPLIER_2X;
647 	state->af9033_config[0].ts_mode = AF9033_TS_MODE_USB;
648 	state->af9033_config[1].ts_mode = AF9033_TS_MODE_SERIAL;
649 
650 	/* eeprom memory mapped location */
651 	if (state->chip_type == 0x9135) {
652 		if (state->chip_version == 0x02) {
653 			state->af9033_config[0].tuner = AF9033_TUNER_IT9135_60;
654 			state->af9033_config[1].tuner = AF9033_TUNER_IT9135_60;
655 			tmp16 = 0x00461d;
656 		} else {
657 			state->af9033_config[0].tuner = AF9033_TUNER_IT9135_38;
658 			state->af9033_config[1].tuner = AF9033_TUNER_IT9135_38;
659 			tmp16 = 0x00461b;
660 		}
661 
662 		/* check if eeprom exists */
663 		ret = af9035_rd_reg(d, tmp16, &tmp);
664 		if (ret < 0)
665 			goto err;
666 
667 		if (tmp == 0x00) {
668 			dev_dbg(&d->udev->dev, "%s: no eeprom\n", __func__);
669 			goto skip_eeprom;
670 		}
671 	}
672 
673 	/* check if there is dual tuners */
674 	ret = af9035_rd_reg(d, state->eeprom_addr + EEPROM_TS_MODE, &tmp);
675 	if (ret < 0)
676 		goto err;
677 
678 	if (tmp == 1 || tmp == 3)
679 		state->dual_mode = true;
680 
681 	dev_dbg(&d->udev->dev, "%s: ts mode=%d dual mode=%d\n", __func__,
682 			tmp, state->dual_mode);
683 
684 	if (state->dual_mode) {
685 		/* read 2nd demodulator I2C address */
686 		ret = af9035_rd_reg(d,
687 				state->eeprom_addr + EEPROM_2ND_DEMOD_ADDR,
688 				&tmp);
689 		if (ret < 0)
690 			goto err;
691 
692 		if (tmp)
693 			state->af9033_config[1].i2c_addr = tmp;
694 
695 		dev_dbg(&d->udev->dev, "%s: 2nd demod I2C addr=%02x\n",
696 				__func__, tmp);
697 	}
698 
699 	addr = state->eeprom_addr;
700 
701 	for (i = 0; i < state->dual_mode + 1; i++) {
702 		/* tuner */
703 		ret = af9035_rd_reg(d, addr + EEPROM_1_TUNER_ID, &tmp);
704 		if (ret < 0)
705 			goto err;
706 
707 		dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
708 				__func__, i, tmp);
709 
710 		/* tuner sanity check */
711 		if (state->chip_type == 0x9135) {
712 			if (state->chip_version == 0x02) {
713 				/* IT9135 BX (v2) */
714 				switch (tmp) {
715 				case AF9033_TUNER_IT9135_60:
716 				case AF9033_TUNER_IT9135_61:
717 				case AF9033_TUNER_IT9135_62:
718 					state->af9033_config[i].tuner = tmp;
719 					break;
720 				}
721 			} else {
722 				/* IT9135 AX (v1) */
723 				switch (tmp) {
724 				case AF9033_TUNER_IT9135_38:
725 				case AF9033_TUNER_IT9135_51:
726 				case AF9033_TUNER_IT9135_52:
727 					state->af9033_config[i].tuner = tmp;
728 					break;
729 				}
730 			}
731 		} else {
732 			/* AF9035 */
733 			state->af9033_config[i].tuner = tmp;
734 		}
735 
736 		if (state->af9033_config[i].tuner != tmp) {
737 			dev_info(&d->udev->dev,
738 					"%s: [%d] overriding tuner from %02x to %02x\n",
739 					KBUILD_MODNAME, i, tmp,
740 					state->af9033_config[i].tuner);
741 		}
742 
743 		switch (state->af9033_config[i].tuner) {
744 		case AF9033_TUNER_TUA9001:
745 		case AF9033_TUNER_FC0011:
746 		case AF9033_TUNER_MXL5007T:
747 		case AF9033_TUNER_TDA18218:
748 		case AF9033_TUNER_FC2580:
749 		case AF9033_TUNER_FC0012:
750 			state->af9033_config[i].spec_inv = 1;
751 			break;
752 		case AF9033_TUNER_IT9135_38:
753 		case AF9033_TUNER_IT9135_51:
754 		case AF9033_TUNER_IT9135_52:
755 		case AF9033_TUNER_IT9135_60:
756 		case AF9033_TUNER_IT9135_61:
757 		case AF9033_TUNER_IT9135_62:
758 			break;
759 		default:
760 			dev_warn(&d->udev->dev,
761 					"%s: tuner id=%02x not supported, please report!",
762 					KBUILD_MODNAME, tmp);
763 		}
764 
765 		/* disable dual mode if driver does not support it */
766 		if (i == 1)
767 			switch (state->af9033_config[i].tuner) {
768 			case AF9033_TUNER_FC0012:
769 			case AF9033_TUNER_IT9135_38:
770 			case AF9033_TUNER_IT9135_51:
771 			case AF9033_TUNER_IT9135_52:
772 			case AF9033_TUNER_IT9135_60:
773 			case AF9033_TUNER_IT9135_61:
774 			case AF9033_TUNER_IT9135_62:
775 			case AF9033_TUNER_MXL5007T:
776 				break;
777 			default:
778 				state->dual_mode = false;
779 				dev_info(&d->udev->dev,
780 						"%s: driver does not support 2nd tuner and will disable it",
781 						KBUILD_MODNAME);
782 		}
783 
784 		/* tuner IF frequency */
785 		ret = af9035_rd_reg(d, addr + EEPROM_1_IF_L, &tmp);
786 		if (ret < 0)
787 			goto err;
788 
789 		tmp16 = tmp;
790 
791 		ret = af9035_rd_reg(d, addr + EEPROM_1_IF_H, &tmp);
792 		if (ret < 0)
793 			goto err;
794 
795 		tmp16 |= tmp << 8;
796 
797 		dev_dbg(&d->udev->dev, "%s: [%d]IF=%d\n", __func__, i, tmp16);
798 
799 		addr += 0x10; /* shift for the 2nd tuner params */
800 	}
801 
802 	/*
803 	 * These AVerMedia devices has a bad EEPROM content :-(
804 	 * Override some wrong values here.
805 	 */
806 	if (le16_to_cpu(d->udev->descriptor.idVendor) == USB_VID_AVERMEDIA) {
807 		switch (le16_to_cpu(d->udev->descriptor.idProduct)) {
808 		case USB_PID_AVERMEDIA_A835B_1835:
809 		case USB_PID_AVERMEDIA_A835B_2835:
810 		case USB_PID_AVERMEDIA_A835B_3835:
811 			dev_info(&d->udev->dev,
812 				 "%s: overriding tuner from %02x to %02x\n",
813 				 KBUILD_MODNAME, state->af9033_config[0].tuner,
814 				 AF9033_TUNER_IT9135_60);
815 
816 			state->af9033_config[0].tuner = AF9033_TUNER_IT9135_60;
817 			break;
818 		}
819 	}
820 
821 skip_eeprom:
822 	/* get demod clock */
823 	ret = af9035_rd_reg(d, 0x00d800, &tmp);
824 	if (ret < 0)
825 		goto err;
826 
827 	tmp = (tmp >> 0) & 0x0f;
828 
829 	for (i = 0; i < ARRAY_SIZE(state->af9033_config); i++) {
830 		if (state->chip_type == 0x9135)
831 			state->af9033_config[i].clock = clock_lut_it9135[tmp];
832 		else
833 			state->af9033_config[i].clock = clock_lut_af9035[tmp];
834 	}
835 
836 	return 0;
837 
838 err:
839 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
840 
841 	return ret;
842 }
843 
844 static int af9035_tua9001_tuner_callback(struct dvb_usb_device *d,
845 		int cmd, int arg)
846 {
847 	int ret;
848 	u8 val;
849 
850 	dev_dbg(&d->udev->dev, "%s: cmd=%d arg=%d\n", __func__, cmd, arg);
851 
852 	/*
853 	 * CEN     always enabled by hardware wiring
854 	 * RESETN  GPIOT3
855 	 * RXEN    GPIOT2
856 	 */
857 
858 	switch (cmd) {
859 	case TUA9001_CMD_RESETN:
860 		if (arg)
861 			val = 0x00;
862 		else
863 			val = 0x01;
864 
865 		ret = af9035_wr_reg_mask(d, 0x00d8e7, val, 0x01);
866 		if (ret < 0)
867 			goto err;
868 		break;
869 	case TUA9001_CMD_RXEN:
870 		if (arg)
871 			val = 0x01;
872 		else
873 			val = 0x00;
874 
875 		ret = af9035_wr_reg_mask(d, 0x00d8eb, val, 0x01);
876 		if (ret < 0)
877 			goto err;
878 		break;
879 	}
880 
881 	return 0;
882 
883 err:
884 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
885 
886 	return ret;
887 }
888 
889 
890 static int af9035_fc0011_tuner_callback(struct dvb_usb_device *d,
891 		int cmd, int arg)
892 {
893 	int ret;
894 
895 	switch (cmd) {
896 	case FC0011_FE_CALLBACK_POWER:
897 		/* Tuner enable */
898 		ret = af9035_wr_reg_mask(d, 0xd8eb, 1, 1);
899 		if (ret < 0)
900 			goto err;
901 
902 		ret = af9035_wr_reg_mask(d, 0xd8ec, 1, 1);
903 		if (ret < 0)
904 			goto err;
905 
906 		ret = af9035_wr_reg_mask(d, 0xd8ed, 1, 1);
907 		if (ret < 0)
908 			goto err;
909 
910 		/* LED */
911 		ret = af9035_wr_reg_mask(d, 0xd8d0, 1, 1);
912 		if (ret < 0)
913 			goto err;
914 
915 		ret = af9035_wr_reg_mask(d, 0xd8d1, 1, 1);
916 		if (ret < 0)
917 			goto err;
918 
919 		usleep_range(10000, 50000);
920 		break;
921 	case FC0011_FE_CALLBACK_RESET:
922 		ret = af9035_wr_reg(d, 0xd8e9, 1);
923 		if (ret < 0)
924 			goto err;
925 
926 		ret = af9035_wr_reg(d, 0xd8e8, 1);
927 		if (ret < 0)
928 			goto err;
929 
930 		ret = af9035_wr_reg(d, 0xd8e7, 1);
931 		if (ret < 0)
932 			goto err;
933 
934 		usleep_range(10000, 20000);
935 
936 		ret = af9035_wr_reg(d, 0xd8e7, 0);
937 		if (ret < 0)
938 			goto err;
939 
940 		usleep_range(10000, 20000);
941 		break;
942 	default:
943 		ret = -EINVAL;
944 		goto err;
945 	}
946 
947 	return 0;
948 
949 err:
950 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
951 
952 	return ret;
953 }
954 
955 static int af9035_tuner_callback(struct dvb_usb_device *d, int cmd, int arg)
956 {
957 	struct state *state = d_to_priv(d);
958 
959 	switch (state->af9033_config[0].tuner) {
960 	case AF9033_TUNER_FC0011:
961 		return af9035_fc0011_tuner_callback(d, cmd, arg);
962 	case AF9033_TUNER_TUA9001:
963 		return af9035_tua9001_tuner_callback(d, cmd, arg);
964 	default:
965 		break;
966 	}
967 
968 	return 0;
969 }
970 
971 static int af9035_frontend_callback(void *adapter_priv, int component,
972 				    int cmd, int arg)
973 {
974 	struct i2c_adapter *adap = adapter_priv;
975 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
976 
977 	dev_dbg(&d->udev->dev, "%s: component=%d cmd=%d arg=%d\n",
978 			__func__, component, cmd, arg);
979 
980 	switch (component) {
981 	case DVB_FRONTEND_COMPONENT_TUNER:
982 		return af9035_tuner_callback(d, cmd, arg);
983 	default:
984 		break;
985 	}
986 
987 	return 0;
988 }
989 
990 static int af9035_get_adapter_count(struct dvb_usb_device *d)
991 {
992 	struct state *state = d_to_priv(d);
993 	return state->dual_mode + 1;
994 }
995 
996 static int af9035_frontend_attach(struct dvb_usb_adapter *adap)
997 {
998 	struct state *state = adap_to_priv(adap);
999 	struct dvb_usb_device *d = adap_to_d(adap);
1000 	int ret;
1001 	dev_dbg(&d->udev->dev, "%s:\n", __func__);
1002 
1003 	if (!state->af9033_config[adap->id].tuner) {
1004 		/* unsupported tuner */
1005 		ret = -ENODEV;
1006 		goto err;
1007 	}
1008 
1009 	/* attach demodulator */
1010 	adap->fe[0] = dvb_attach(af9033_attach, &state->af9033_config[adap->id],
1011 			&d->i2c_adap, &state->ops);
1012 	if (adap->fe[0] == NULL) {
1013 		ret = -ENODEV;
1014 		goto err;
1015 	}
1016 
1017 	/* disable I2C-gate */
1018 	adap->fe[0]->ops.i2c_gate_ctrl = NULL;
1019 	adap->fe[0]->callback = af9035_frontend_callback;
1020 
1021 	return 0;
1022 
1023 err:
1024 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1025 
1026 	return ret;
1027 }
1028 
1029 static struct tua9001_config af9035_tua9001_config = {
1030 	.i2c_addr = 0x60,
1031 };
1032 
1033 static const struct fc0011_config af9035_fc0011_config = {
1034 	.i2c_address = 0x60,
1035 };
1036 
1037 static struct mxl5007t_config af9035_mxl5007t_config[] = {
1038 	{
1039 		.xtal_freq_hz = MxL_XTAL_24_MHZ,
1040 		.if_freq_hz = MxL_IF_4_57_MHZ,
1041 		.invert_if = 0,
1042 		.loop_thru_enable = 0,
1043 		.clk_out_enable = 0,
1044 		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
1045 	}, {
1046 		.xtal_freq_hz = MxL_XTAL_24_MHZ,
1047 		.if_freq_hz = MxL_IF_4_57_MHZ,
1048 		.invert_if = 0,
1049 		.loop_thru_enable = 1,
1050 		.clk_out_enable = 1,
1051 		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
1052 	}
1053 };
1054 
1055 static struct tda18218_config af9035_tda18218_config = {
1056 	.i2c_address = 0x60,
1057 	.i2c_wr_max = 21,
1058 };
1059 
1060 static const struct fc2580_config af9035_fc2580_config = {
1061 	.i2c_addr = 0x56,
1062 	.clock = 16384000,
1063 };
1064 
1065 static const struct fc0012_config af9035_fc0012_config[] = {
1066 	{
1067 		.i2c_address = 0x63,
1068 		.xtal_freq = FC_XTAL_36_MHZ,
1069 		.dual_master = true,
1070 		.loop_through = true,
1071 		.clock_out = true,
1072 	}, {
1073 		.i2c_address = 0x63 | 0x80, /* I2C bus select hack */
1074 		.xtal_freq = FC_XTAL_36_MHZ,
1075 		.dual_master = true,
1076 	}
1077 };
1078 
1079 static int af9035_tuner_attach(struct dvb_usb_adapter *adap)
1080 {
1081 	struct state *state = adap_to_priv(adap);
1082 	struct dvb_usb_device *d = adap_to_d(adap);
1083 	int ret;
1084 	struct dvb_frontend *fe;
1085 	struct i2c_msg msg[1];
1086 	u8 tuner_addr;
1087 	dev_dbg(&d->udev->dev, "%s:\n", __func__);
1088 
1089 	/*
1090 	 * XXX: Hack used in that function: we abuse unused I2C address bit [7]
1091 	 * to carry info about used I2C bus for dual tuner configuration.
1092 	 */
1093 
1094 	switch (state->af9033_config[adap->id].tuner) {
1095 	case AF9033_TUNER_TUA9001:
1096 		/* AF9035 gpiot3 = TUA9001 RESETN
1097 		   AF9035 gpiot2 = TUA9001 RXEN */
1098 
1099 		/* configure gpiot2 and gpiot2 as output */
1100 		ret = af9035_wr_reg_mask(d, 0x00d8ec, 0x01, 0x01);
1101 		if (ret < 0)
1102 			goto err;
1103 
1104 		ret = af9035_wr_reg_mask(d, 0x00d8ed, 0x01, 0x01);
1105 		if (ret < 0)
1106 			goto err;
1107 
1108 		ret = af9035_wr_reg_mask(d, 0x00d8e8, 0x01, 0x01);
1109 		if (ret < 0)
1110 			goto err;
1111 
1112 		ret = af9035_wr_reg_mask(d, 0x00d8e9, 0x01, 0x01);
1113 		if (ret < 0)
1114 			goto err;
1115 
1116 		/* attach tuner */
1117 		fe = dvb_attach(tua9001_attach, adap->fe[0],
1118 				&d->i2c_adap, &af9035_tua9001_config);
1119 		break;
1120 	case AF9033_TUNER_FC0011:
1121 		fe = dvb_attach(fc0011_attach, adap->fe[0],
1122 				&d->i2c_adap, &af9035_fc0011_config);
1123 		break;
1124 	case AF9033_TUNER_MXL5007T:
1125 		if (adap->id == 0) {
1126 			ret = af9035_wr_reg(d, 0x00d8e0, 1);
1127 			if (ret < 0)
1128 				goto err;
1129 
1130 			ret = af9035_wr_reg(d, 0x00d8e1, 1);
1131 			if (ret < 0)
1132 				goto err;
1133 
1134 			ret = af9035_wr_reg(d, 0x00d8df, 0);
1135 			if (ret < 0)
1136 				goto err;
1137 
1138 			msleep(30);
1139 
1140 			ret = af9035_wr_reg(d, 0x00d8df, 1);
1141 			if (ret < 0)
1142 				goto err;
1143 
1144 			msleep(300);
1145 
1146 			ret = af9035_wr_reg(d, 0x00d8c0, 1);
1147 			if (ret < 0)
1148 				goto err;
1149 
1150 			ret = af9035_wr_reg(d, 0x00d8c1, 1);
1151 			if (ret < 0)
1152 				goto err;
1153 
1154 			ret = af9035_wr_reg(d, 0x00d8bf, 0);
1155 			if (ret < 0)
1156 				goto err;
1157 
1158 			ret = af9035_wr_reg(d, 0x00d8b4, 1);
1159 			if (ret < 0)
1160 				goto err;
1161 
1162 			ret = af9035_wr_reg(d, 0x00d8b5, 1);
1163 			if (ret < 0)
1164 				goto err;
1165 
1166 			ret = af9035_wr_reg(d, 0x00d8b3, 1);
1167 			if (ret < 0)
1168 				goto err;
1169 
1170 			tuner_addr = 0x60;
1171 		} else {
1172 			tuner_addr = 0x60 | 0x80; /* I2C bus hack */
1173 		}
1174 
1175 		/* attach tuner */
1176 		fe = dvb_attach(mxl5007t_attach, adap->fe[0], &d->i2c_adap,
1177 				tuner_addr, &af9035_mxl5007t_config[adap->id]);
1178 		break;
1179 	case AF9033_TUNER_TDA18218:
1180 		/* attach tuner */
1181 		fe = dvb_attach(tda18218_attach, adap->fe[0],
1182 				&d->i2c_adap, &af9035_tda18218_config);
1183 		break;
1184 	case AF9033_TUNER_FC2580:
1185 		/* Tuner enable using gpiot2_o, gpiot2_en and gpiot2_on  */
1186 		ret = af9035_wr_reg_mask(d, 0xd8eb, 0x01, 0x01);
1187 		if (ret < 0)
1188 			goto err;
1189 
1190 		ret = af9035_wr_reg_mask(d, 0xd8ec, 0x01, 0x01);
1191 		if (ret < 0)
1192 			goto err;
1193 
1194 		ret = af9035_wr_reg_mask(d, 0xd8ed, 0x01, 0x01);
1195 		if (ret < 0)
1196 			goto err;
1197 
1198 		usleep_range(10000, 50000);
1199 		/* attach tuner */
1200 		fe = dvb_attach(fc2580_attach, adap->fe[0],
1201 				&d->i2c_adap, &af9035_fc2580_config);
1202 		break;
1203 	case AF9033_TUNER_FC0012:
1204 		/*
1205 		 * AF9035 gpiot2 = FC0012 enable
1206 		 * XXX: there seems to be something on gpioh8 too, but on my
1207 		 * my test I didn't find any difference.
1208 		 */
1209 
1210 		if (adap->id == 0) {
1211 			/* configure gpiot2 as output and high */
1212 			ret = af9035_wr_reg_mask(d, 0xd8eb, 0x01, 0x01);
1213 			if (ret < 0)
1214 				goto err;
1215 
1216 			ret = af9035_wr_reg_mask(d, 0xd8ec, 0x01, 0x01);
1217 			if (ret < 0)
1218 				goto err;
1219 
1220 			ret = af9035_wr_reg_mask(d, 0xd8ed, 0x01, 0x01);
1221 			if (ret < 0)
1222 				goto err;
1223 		} else {
1224 			/*
1225 			 * FIXME: That belongs for the FC0012 driver.
1226 			 * Write 02 to FC0012 master tuner register 0d directly
1227 			 * in order to make slave tuner working.
1228 			 */
1229 			msg[0].addr = 0x63;
1230 			msg[0].flags = 0;
1231 			msg[0].len = 2;
1232 			msg[0].buf = "\x0d\x02";
1233 			ret = i2c_transfer(&d->i2c_adap, msg, 1);
1234 			if (ret < 0)
1235 				goto err;
1236 		}
1237 
1238 		usleep_range(10000, 50000);
1239 
1240 		fe = dvb_attach(fc0012_attach, adap->fe[0], &d->i2c_adap,
1241 				&af9035_fc0012_config[adap->id]);
1242 		break;
1243 	case AF9033_TUNER_IT9135_38:
1244 	case AF9033_TUNER_IT9135_51:
1245 	case AF9033_TUNER_IT9135_52:
1246 	case AF9033_TUNER_IT9135_60:
1247 	case AF9033_TUNER_IT9135_61:
1248 	case AF9033_TUNER_IT9135_62:
1249 		/* attach tuner */
1250 		fe = dvb_attach(it913x_attach, adap->fe[0], &d->i2c_adap,
1251 				state->af9033_config[adap->id].i2c_addr,
1252 				state->af9033_config[0].tuner);
1253 		break;
1254 	default:
1255 		fe = NULL;
1256 	}
1257 
1258 	if (fe == NULL) {
1259 		ret = -ENODEV;
1260 		goto err;
1261 	}
1262 
1263 	return 0;
1264 
1265 err:
1266 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1267 
1268 	return ret;
1269 }
1270 
1271 static int af9035_init(struct dvb_usb_device *d)
1272 {
1273 	struct state *state = d_to_priv(d);
1274 	int ret, i;
1275 	u16 frame_size = (d->udev->speed == USB_SPEED_FULL ? 5 : 87) * 188 / 4;
1276 	u8 packet_size = (d->udev->speed == USB_SPEED_FULL ? 64 : 512) / 4;
1277 	struct reg_val_mask tab[] = {
1278 		{ 0x80f99d, 0x01, 0x01 },
1279 		{ 0x80f9a4, 0x01, 0x01 },
1280 		{ 0x00dd11, 0x00, 0x20 },
1281 		{ 0x00dd11, 0x00, 0x40 },
1282 		{ 0x00dd13, 0x00, 0x20 },
1283 		{ 0x00dd13, 0x00, 0x40 },
1284 		{ 0x00dd11, 0x20, 0x20 },
1285 		{ 0x00dd88, (frame_size >> 0) & 0xff, 0xff},
1286 		{ 0x00dd89, (frame_size >> 8) & 0xff, 0xff},
1287 		{ 0x00dd0c, packet_size, 0xff},
1288 		{ 0x00dd11, state->dual_mode << 6, 0x40 },
1289 		{ 0x00dd8a, (frame_size >> 0) & 0xff, 0xff},
1290 		{ 0x00dd8b, (frame_size >> 8) & 0xff, 0xff},
1291 		{ 0x00dd0d, packet_size, 0xff },
1292 		{ 0x80f9a3, state->dual_mode, 0x01 },
1293 		{ 0x80f9cd, state->dual_mode, 0x01 },
1294 		{ 0x80f99d, 0x00, 0x01 },
1295 		{ 0x80f9a4, 0x00, 0x01 },
1296 	};
1297 
1298 	dev_dbg(&d->udev->dev,
1299 			"%s: USB speed=%d frame_size=%04x packet_size=%02x\n",
1300 			__func__, d->udev->speed, frame_size, packet_size);
1301 
1302 	/* init endpoints */
1303 	for (i = 0; i < ARRAY_SIZE(tab); i++) {
1304 		ret = af9035_wr_reg_mask(d, tab[i].reg, tab[i].val,
1305 				tab[i].mask);
1306 		if (ret < 0)
1307 			goto err;
1308 	}
1309 
1310 	return 0;
1311 
1312 err:
1313 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1314 
1315 	return ret;
1316 }
1317 
1318 #if IS_ENABLED(CONFIG_RC_CORE)
1319 static int af9035_rc_query(struct dvb_usb_device *d)
1320 {
1321 	int ret;
1322 	u32 key;
1323 	u8 buf[4];
1324 	struct usb_req req = { CMD_IR_GET, 0, 0, NULL, 4, buf };
1325 
1326 	ret = af9035_ctrl_msg(d, &req);
1327 	if (ret == 1)
1328 		return 0;
1329 	else if (ret < 0)
1330 		goto err;
1331 
1332 	if ((buf[2] + buf[3]) == 0xff) {
1333 		if ((buf[0] + buf[1]) == 0xff) {
1334 			/* NEC standard 16bit */
1335 			key = RC_SCANCODE_NEC(buf[0], buf[2]);
1336 		} else {
1337 			/* NEC extended 24bit */
1338 			key = RC_SCANCODE_NECX(buf[0] << 8 | buf[1], buf[2]);
1339 		}
1340 	} else {
1341 		/* NEC full code 32bit */
1342 		key = RC_SCANCODE_NEC32(buf[0] << 24 | buf[1] << 16 |
1343 					buf[2] << 8  | buf[3]);
1344 	}
1345 
1346 	dev_dbg(&d->udev->dev, "%s: %*ph\n", __func__, 4, buf);
1347 
1348 	rc_keydown(d->rc_dev, RC_TYPE_NEC, key, 0);
1349 
1350 	return 0;
1351 
1352 err:
1353 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1354 
1355 	return ret;
1356 }
1357 
1358 static int af9035_get_rc_config(struct dvb_usb_device *d, struct dvb_usb_rc *rc)
1359 {
1360 	struct state *state = d_to_priv(d);
1361 	int ret;
1362 	u8 tmp;
1363 
1364 	ret = af9035_rd_reg(d, state->eeprom_addr + EEPROM_IR_MODE, &tmp);
1365 	if (ret < 0)
1366 		goto err;
1367 
1368 	dev_dbg(&d->udev->dev, "%s: ir_mode=%02x\n", __func__, tmp);
1369 
1370 	/* don't activate rc if in HID mode or if not available */
1371 	if (tmp == 5) {
1372 		ret = af9035_rd_reg(d, state->eeprom_addr + EEPROM_IR_TYPE,
1373 				&tmp);
1374 		if (ret < 0)
1375 			goto err;
1376 
1377 		dev_dbg(&d->udev->dev, "%s: ir_type=%02x\n", __func__, tmp);
1378 
1379 		switch (tmp) {
1380 		case 0: /* NEC */
1381 		default:
1382 			rc->allowed_protos = RC_BIT_NEC;
1383 			break;
1384 		case 1: /* RC6 */
1385 			rc->allowed_protos = RC_BIT_RC6_MCE;
1386 			break;
1387 		}
1388 
1389 		rc->query = af9035_rc_query;
1390 		rc->interval = 500;
1391 
1392 		/* load empty to enable rc */
1393 		if (!rc->map_name)
1394 			rc->map_name = RC_MAP_EMPTY;
1395 	}
1396 
1397 	return 0;
1398 
1399 err:
1400 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1401 
1402 	return ret;
1403 }
1404 #else
1405 	#define af9035_get_rc_config NULL
1406 #endif
1407 
1408 static int af9035_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,
1409 		struct usb_data_stream_properties *stream)
1410 {
1411 	struct dvb_usb_device *d = fe_to_d(fe);
1412 	dev_dbg(&d->udev->dev, "%s: adap=%d\n", __func__, fe_to_adap(fe)->id);
1413 
1414 	if (d->udev->speed == USB_SPEED_FULL)
1415 		stream->u.bulk.buffersize = 5 * 188;
1416 
1417 	return 0;
1418 }
1419 
1420 static int af9035_pid_filter_ctrl(struct dvb_usb_adapter *adap, int onoff)
1421 {
1422 	struct state *state = adap_to_priv(adap);
1423 
1424 	return state->ops.pid_filter_ctrl(adap->fe[0], onoff);
1425 }
1426 
1427 static int af9035_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid,
1428 		int onoff)
1429 {
1430 	struct state *state = adap_to_priv(adap);
1431 
1432 	return state->ops.pid_filter(adap->fe[0], index, pid, onoff);
1433 }
1434 
1435 static int af9035_probe(struct usb_interface *intf,
1436 		const struct usb_device_id *id)
1437 {
1438 	struct usb_device *udev = interface_to_usbdev(intf);
1439 	char manufacturer[sizeof("Afatech")];
1440 
1441 	memset(manufacturer, 0, sizeof(manufacturer));
1442 	usb_string(udev, udev->descriptor.iManufacturer,
1443 			manufacturer, sizeof(manufacturer));
1444 	/*
1445 	 * There is two devices having same ID but different chipset. One uses
1446 	 * AF9015 and the other IT9135 chipset. Only difference seen on lsusb
1447 	 * is iManufacturer string.
1448 	 *
1449 	 * idVendor           0x0ccd TerraTec Electronic GmbH
1450 	 * idProduct          0x0099
1451 	 * bcdDevice            2.00
1452 	 * iManufacturer           1 Afatech
1453 	 * iProduct                2 DVB-T 2
1454 	 *
1455 	 * idVendor           0x0ccd TerraTec Electronic GmbH
1456 	 * idProduct          0x0099
1457 	 * bcdDevice            2.00
1458 	 * iManufacturer           1 ITE Technologies, Inc.
1459 	 * iProduct                2 DVB-T TV Stick
1460 	 */
1461 	if ((le16_to_cpu(udev->descriptor.idVendor) == USB_VID_TERRATEC) &&
1462 			(le16_to_cpu(udev->descriptor.idProduct) == 0x0099)) {
1463 		if (!strcmp("Afatech", manufacturer)) {
1464 			dev_dbg(&udev->dev, "%s: rejecting device\n", __func__);
1465 			return -ENODEV;
1466 		}
1467 	}
1468 
1469 	return dvb_usbv2_probe(intf, id);
1470 }
1471 
1472 /* interface 0 is used by DVB-T receiver and
1473    interface 1 is for remote controller (HID) */
1474 static const struct dvb_usb_device_properties af9035_props = {
1475 	.driver_name = KBUILD_MODNAME,
1476 	.owner = THIS_MODULE,
1477 	.adapter_nr = adapter_nr,
1478 	.size_of_priv = sizeof(struct state),
1479 
1480 	.generic_bulk_ctrl_endpoint = 0x02,
1481 	.generic_bulk_ctrl_endpoint_response = 0x81,
1482 
1483 	.identify_state = af9035_identify_state,
1484 	.download_firmware = af9035_download_firmware,
1485 
1486 	.i2c_algo = &af9035_i2c_algo,
1487 	.read_config = af9035_read_config,
1488 	.frontend_attach = af9035_frontend_attach,
1489 	.tuner_attach = af9035_tuner_attach,
1490 	.init = af9035_init,
1491 	.get_rc_config = af9035_get_rc_config,
1492 	.get_stream_config = af9035_get_stream_config,
1493 
1494 	.get_adapter_count = af9035_get_adapter_count,
1495 	.adapter = {
1496 		{
1497 			.caps = DVB_USB_ADAP_HAS_PID_FILTER |
1498 				DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
1499 
1500 			.pid_filter_count = 32,
1501 			.pid_filter_ctrl = af9035_pid_filter_ctrl,
1502 			.pid_filter = af9035_pid_filter,
1503 
1504 			.stream = DVB_USB_STREAM_BULK(0x84, 6, 87 * 188),
1505 		}, {
1506 			.caps = DVB_USB_ADAP_HAS_PID_FILTER |
1507 				DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
1508 
1509 			.pid_filter_count = 32,
1510 			.pid_filter_ctrl = af9035_pid_filter_ctrl,
1511 			.pid_filter = af9035_pid_filter,
1512 
1513 			.stream = DVB_USB_STREAM_BULK(0x85, 6, 87 * 188),
1514 		},
1515 	},
1516 };
1517 
1518 static const struct usb_device_id af9035_id_table[] = {
1519 	/* AF9035 devices */
1520 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_9035,
1521 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1522 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1000,
1523 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1524 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1001,
1525 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1526 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1002,
1527 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1528 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1003,
1529 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1530 	{ DVB_USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_T_STICK,
1531 		&af9035_props, "TerraTec Cinergy T Stick", NULL) },
1532 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835,
1533 		&af9035_props, "AVerMedia AVerTV Volar HD/PRO (A835)", NULL) },
1534 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_B835,
1535 		&af9035_props, "AVerMedia AVerTV Volar HD/PRO (A835)", NULL) },
1536 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_1867,
1537 		&af9035_props, "AVerMedia HD Volar (A867)", NULL) },
1538 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A867,
1539 		&af9035_props, "AVerMedia HD Volar (A867)", NULL) },
1540 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_TWINSTAR,
1541 		&af9035_props, "AVerMedia Twinstar (A825)", NULL) },
1542 	{ DVB_USB_DEVICE(USB_VID_ASUS, USB_PID_ASUS_U3100MINI_PLUS,
1543 		&af9035_props, "Asus U3100Mini Plus", NULL) },
1544 	{ DVB_USB_DEVICE(USB_VID_TERRATEC, 0x00aa,
1545 		&af9035_props, "TerraTec Cinergy T Stick (rev. 2)", NULL) },
1546 	/* IT9135 devices */
1547 	{ DVB_USB_DEVICE(USB_VID_ITETECH, USB_PID_ITETECH_IT9135,
1548 		&af9035_props, "ITE 9135 Generic", RC_MAP_IT913X_V1) },
1549 	{ DVB_USB_DEVICE(USB_VID_ITETECH, USB_PID_ITETECH_IT9135_9005,
1550 		&af9035_props, "ITE 9135(9005) Generic", RC_MAP_IT913X_V2) },
1551 	{ DVB_USB_DEVICE(USB_VID_ITETECH, USB_PID_ITETECH_IT9135_9006,
1552 		&af9035_props, "ITE 9135(9006) Generic", RC_MAP_IT913X_V1) },
1553 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835B_1835,
1554 		&af9035_props, "Avermedia A835B(1835)", RC_MAP_IT913X_V2) },
1555 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835B_2835,
1556 		&af9035_props, "Avermedia A835B(2835)", RC_MAP_IT913X_V2) },
1557 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835B_3835,
1558 		&af9035_props, "Avermedia A835B(3835)", RC_MAP_IT913X_V2) },
1559 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835B_4835,
1560 		&af9035_props, "Avermedia A835B(4835)",	RC_MAP_IT913X_V2) },
1561 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_H335,
1562 		&af9035_props, "Avermedia H335", RC_MAP_IT913X_V2) },
1563 	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, USB_PID_KWORLD_UB499_2T_T09,
1564 		&af9035_props, "Kworld UB499-2T T09", RC_MAP_IT913X_V1) },
1565 	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, USB_PID_SVEON_STV22_IT9137,
1566 		&af9035_props, "Sveon STV22 Dual DVB-T HDTV",
1567 							RC_MAP_IT913X_V1) },
1568 	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, USB_PID_CTVDIGDUAL_V2,
1569 		&af9035_props, "Digital Dual TV Receiver CTVDIGDUAL_V2",
1570 							RC_MAP_IT913X_V1) },
1571 	/* XXX: that same ID [0ccd:0099] is used by af9015 driver too */
1572 	{ DVB_USB_DEVICE(USB_VID_TERRATEC, 0x0099,
1573 		&af9035_props, "TerraTec Cinergy T Stick Dual RC (rev. 2)", NULL) },
1574 	{ DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a05,
1575 		&af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) },
1576 	{ DVB_USB_DEVICE(USB_VID_HAUPPAUGE, 0xf900,
1577 		&af9035_props, "Hauppauge WinTV-MiniStick 2", NULL) },
1578 	{ }
1579 };
1580 MODULE_DEVICE_TABLE(usb, af9035_id_table);
1581 
1582 static struct usb_driver af9035_usb_driver = {
1583 	.name = KBUILD_MODNAME,
1584 	.id_table = af9035_id_table,
1585 	.probe = af9035_probe,
1586 	.disconnect = dvb_usbv2_disconnect,
1587 	.suspend = dvb_usbv2_suspend,
1588 	.resume = dvb_usbv2_resume,
1589 	.reset_resume = dvb_usbv2_reset_resume,
1590 	.no_dynamic_id = 1,
1591 	.soft_unbind = 1,
1592 };
1593 
1594 module_usb_driver(af9035_usb_driver);
1595 
1596 MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
1597 MODULE_DESCRIPTION("Afatech AF9035 driver");
1598 MODULE_LICENSE("GPL");
1599 MODULE_FIRMWARE(AF9035_FIRMWARE_AF9035);
1600 MODULE_FIRMWARE(AF9035_FIRMWARE_IT9135_V1);
1601 MODULE_FIRMWARE(AF9035_FIRMWARE_IT9135_V2);
1602