1 /*
2  * Afatech AF9035 DVB USB driver
3  *
4  * Copyright (C) 2009 Antti Palosaari <crope@iki.fi>
5  * Copyright (C) 2012 Antti Palosaari <crope@iki.fi>
6  *
7  *    This program is free software; you can redistribute it and/or modify
8  *    it under the terms of the GNU General Public License as published by
9  *    the Free Software Foundation; either version 2 of the License, or
10  *    (at your option) any later version.
11  *
12  *    This program is distributed in the hope that it will be useful,
13  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
14  *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  *    GNU General Public License for more details.
16  *
17  *    You should have received a copy of the GNU General Public License along
18  *    with this program; if not, write to the Free Software Foundation, Inc.,
19  *    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20  */
21 
22 #include "af9035.h"
23 
24 /* Max transfer size done by I2C transfer functions */
25 #define MAX_XFER_SIZE  64
26 
27 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
28 
29 static u16 af9035_checksum(const u8 *buf, size_t len)
30 {
31 	size_t i;
32 	u16 checksum = 0;
33 
34 	for (i = 1; i < len; i++) {
35 		if (i % 2)
36 			checksum += buf[i] << 8;
37 		else
38 			checksum += buf[i];
39 	}
40 	checksum = ~checksum;
41 
42 	return checksum;
43 }
44 
45 static int af9035_ctrl_msg(struct dvb_usb_device *d, struct usb_req *req)
46 {
47 #define REQ_HDR_LEN 4 /* send header size */
48 #define ACK_HDR_LEN 3 /* rece header size */
49 #define CHECKSUM_LEN 2
50 #define USB_TIMEOUT 2000
51 	struct state *state = d_to_priv(d);
52 	int ret, wlen, rlen;
53 	u16 checksum, tmp_checksum;
54 
55 	mutex_lock(&d->usb_mutex);
56 
57 	/* buffer overflow check */
58 	if (req->wlen > (BUF_LEN - REQ_HDR_LEN - CHECKSUM_LEN) ||
59 			req->rlen > (BUF_LEN - ACK_HDR_LEN - CHECKSUM_LEN)) {
60 		dev_err(&d->udev->dev, "%s: too much data wlen=%d rlen=%d\n",
61 				KBUILD_MODNAME, req->wlen, req->rlen);
62 		ret = -EINVAL;
63 		goto exit;
64 	}
65 
66 	state->buf[0] = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN - 1;
67 	state->buf[1] = req->mbox;
68 	state->buf[2] = req->cmd;
69 	state->buf[3] = state->seq++;
70 	memcpy(&state->buf[REQ_HDR_LEN], req->wbuf, req->wlen);
71 
72 	wlen = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN;
73 	rlen = ACK_HDR_LEN + req->rlen + CHECKSUM_LEN;
74 
75 	/* calc and add checksum */
76 	checksum = af9035_checksum(state->buf, state->buf[0] - 1);
77 	state->buf[state->buf[0] - 1] = (checksum >> 8);
78 	state->buf[state->buf[0] - 0] = (checksum & 0xff);
79 
80 	/* no ack for these packets */
81 	if (req->cmd == CMD_FW_DL)
82 		rlen = 0;
83 
84 	ret = dvb_usbv2_generic_rw_locked(d,
85 			state->buf, wlen, state->buf, rlen);
86 	if (ret)
87 		goto exit;
88 
89 	/* no ack for those packets */
90 	if (req->cmd == CMD_FW_DL)
91 		goto exit;
92 
93 	/* verify checksum */
94 	checksum = af9035_checksum(state->buf, rlen - 2);
95 	tmp_checksum = (state->buf[rlen - 2] << 8) | state->buf[rlen - 1];
96 	if (tmp_checksum != checksum) {
97 		dev_err(&d->udev->dev,
98 				"%s: command=%02x checksum mismatch (%04x != %04x)\n",
99 				KBUILD_MODNAME, req->cmd, tmp_checksum,
100 				checksum);
101 		ret = -EIO;
102 		goto exit;
103 	}
104 
105 	/* check status */
106 	if (state->buf[2]) {
107 		/* fw returns status 1 when IR code was not received */
108 		if (req->cmd == CMD_IR_GET || state->buf[2] == 1) {
109 			ret = 1;
110 			goto exit;
111 		}
112 
113 		dev_dbg(&d->udev->dev, "%s: command=%02x failed fw error=%d\n",
114 				__func__, req->cmd, state->buf[2]);
115 		ret = -EIO;
116 		goto exit;
117 	}
118 
119 	/* read request, copy returned data to return buf */
120 	if (req->rlen)
121 		memcpy(req->rbuf, &state->buf[ACK_HDR_LEN], req->rlen);
122 exit:
123 	mutex_unlock(&d->usb_mutex);
124 	if (ret < 0)
125 		dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
126 	return ret;
127 }
128 
129 /* write multiple registers */
130 static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
131 {
132 	u8 wbuf[MAX_XFER_SIZE];
133 	u8 mbox = (reg >> 16) & 0xff;
134 	struct usb_req req = { CMD_MEM_WR, mbox, sizeof(wbuf), wbuf, 0, NULL };
135 
136 	if (6 + len > sizeof(wbuf)) {
137 		dev_warn(&d->udev->dev, "%s: i2c wr: len=%d is too big!\n",
138 			 KBUILD_MODNAME, len);
139 		return -EOPNOTSUPP;
140 	}
141 
142 	wbuf[0] = len;
143 	wbuf[1] = 2;
144 	wbuf[2] = 0;
145 	wbuf[3] = 0;
146 	wbuf[4] = (reg >> 8) & 0xff;
147 	wbuf[5] = (reg >> 0) & 0xff;
148 	memcpy(&wbuf[6], val, len);
149 
150 	return af9035_ctrl_msg(d, &req);
151 }
152 
153 /* read multiple registers */
154 static int af9035_rd_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
155 {
156 	u8 wbuf[] = { len, 2, 0, 0, (reg >> 8) & 0xff, reg & 0xff };
157 	u8 mbox = (reg >> 16) & 0xff;
158 	struct usb_req req = { CMD_MEM_RD, mbox, sizeof(wbuf), wbuf, len, val };
159 
160 	return af9035_ctrl_msg(d, &req);
161 }
162 
163 /* write single register */
164 static int af9035_wr_reg(struct dvb_usb_device *d, u32 reg, u8 val)
165 {
166 	return af9035_wr_regs(d, reg, &val, 1);
167 }
168 
169 /* read single register */
170 static int af9035_rd_reg(struct dvb_usb_device *d, u32 reg, u8 *val)
171 {
172 	return af9035_rd_regs(d, reg, val, 1);
173 }
174 
175 /* write single register with mask */
176 static int af9035_wr_reg_mask(struct dvb_usb_device *d, u32 reg, u8 val,
177 		u8 mask)
178 {
179 	int ret;
180 	u8 tmp;
181 
182 	/* no need for read if whole reg is written */
183 	if (mask != 0xff) {
184 		ret = af9035_rd_regs(d, reg, &tmp, 1);
185 		if (ret)
186 			return ret;
187 
188 		val &= mask;
189 		tmp &= ~mask;
190 		val |= tmp;
191 	}
192 
193 	return af9035_wr_regs(d, reg, &val, 1);
194 }
195 
196 static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
197 		struct i2c_msg msg[], int num)
198 {
199 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
200 	struct state *state = d_to_priv(d);
201 	int ret;
202 
203 	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
204 		return -EAGAIN;
205 
206 	/*
207 	 * I2C sub header is 5 bytes long. Meaning of those bytes are:
208 	 * 0: data len
209 	 * 1: I2C addr << 1
210 	 * 2: reg addr len
211 	 *    byte 3 and 4 can be used as reg addr
212 	 * 3: reg addr MSB
213 	 *    used when reg addr len is set to 2
214 	 * 4: reg addr LSB
215 	 *    used when reg addr len is set to 1 or 2
216 	 *
217 	 * For the simplify we do not use register addr at all.
218 	 * NOTE: As a firmware knows tuner type there is very small possibility
219 	 * there could be some tuner I2C hacks done by firmware and this may
220 	 * lead problems if firmware expects those bytes are used.
221 	 */
222 	if (num == 2 && !(msg[0].flags & I2C_M_RD) &&
223 			(msg[1].flags & I2C_M_RD)) {
224 		if (msg[0].len > 40 || msg[1].len > 40) {
225 			/* TODO: correct limits > 40 */
226 			ret = -EOPNOTSUPP;
227 		} else if ((msg[0].addr == state->af9033_config[0].i2c_addr) ||
228 			   (msg[0].addr == state->af9033_config[1].i2c_addr)) {
229 			/* demod access via firmware interface */
230 			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
231 					msg[0].buf[2];
232 
233 			if (msg[0].addr == state->af9033_config[1].i2c_addr)
234 				reg |= 0x100000;
235 
236 			ret = af9035_rd_regs(d, reg, &msg[1].buf[0],
237 					msg[1].len);
238 		} else {
239 			/* I2C */
240 			u8 buf[MAX_XFER_SIZE];
241 			struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
242 					buf, msg[1].len, msg[1].buf };
243 
244 			if (5 + msg[0].len > sizeof(buf)) {
245 				dev_warn(&d->udev->dev,
246 					 "%s: i2c xfer: len=%d is too big!\n",
247 					 KBUILD_MODNAME, msg[0].len);
248 				return -EOPNOTSUPP;
249 			}
250 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
251 			buf[0] = msg[1].len;
252 			buf[1] = msg[0].addr << 1;
253 			buf[2] = 0x00; /* reg addr len */
254 			buf[3] = 0x00; /* reg addr MSB */
255 			buf[4] = 0x00; /* reg addr LSB */
256 			memcpy(&buf[5], msg[0].buf, msg[0].len);
257 			ret = af9035_ctrl_msg(d, &req);
258 		}
259 	} else if (num == 1 && !(msg[0].flags & I2C_M_RD)) {
260 		if (msg[0].len > 40) {
261 			/* TODO: correct limits > 40 */
262 			ret = -EOPNOTSUPP;
263 		} else if ((msg[0].addr == state->af9033_config[0].i2c_addr) ||
264 			   (msg[0].addr == state->af9033_config[1].i2c_addr)) {
265 			/* demod access via firmware interface */
266 			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
267 					msg[0].buf[2];
268 
269 			if (msg[0].addr == state->af9033_config[1].i2c_addr)
270 				reg |= 0x100000;
271 
272 			ret = af9035_wr_regs(d, reg, &msg[0].buf[3],
273 					msg[0].len - 3);
274 		} else {
275 			/* I2C */
276 			u8 buf[MAX_XFER_SIZE];
277 			struct usb_req req = { CMD_I2C_WR, 0, sizeof(buf), buf,
278 					0, NULL };
279 
280 			if (5 + msg[0].len > sizeof(buf)) {
281 				dev_warn(&d->udev->dev,
282 					 "%s: i2c xfer: len=%d is too big!\n",
283 					 KBUILD_MODNAME, msg[0].len);
284 				return -EOPNOTSUPP;
285 			}
286 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
287 			buf[0] = msg[0].len;
288 			buf[1] = msg[0].addr << 1;
289 			buf[2] = 0x00; /* reg addr len */
290 			buf[3] = 0x00; /* reg addr MSB */
291 			buf[4] = 0x00; /* reg addr LSB */
292 			memcpy(&buf[5], msg[0].buf, msg[0].len);
293 			ret = af9035_ctrl_msg(d, &req);
294 		}
295 	} else if (num == 1 && (msg[0].flags & I2C_M_RD)) {
296 		if (msg[0].len > 40) {
297 			/* TODO: correct limits > 40 */
298 			ret = -EOPNOTSUPP;
299 		} else {
300 			/* I2C */
301 			u8 buf[5];
302 			struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
303 					buf, msg[0].len, msg[0].buf };
304 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
305 			buf[0] = msg[0].len;
306 			buf[1] = msg[0].addr << 1;
307 			buf[2] = 0x00; /* reg addr len */
308 			buf[3] = 0x00; /* reg addr MSB */
309 			buf[4] = 0x00; /* reg addr LSB */
310 			ret = af9035_ctrl_msg(d, &req);
311 		}
312 	} else {
313 		/*
314 		 * We support only three kind of I2C transactions:
315 		 * 1) 1 x read + 1 x write (repeated start)
316 		 * 2) 1 x write
317 		 * 3) 1 x read
318 		 */
319 		ret = -EOPNOTSUPP;
320 	}
321 
322 	mutex_unlock(&d->i2c_mutex);
323 
324 	if (ret < 0)
325 		return ret;
326 	else
327 		return num;
328 }
329 
330 static u32 af9035_i2c_functionality(struct i2c_adapter *adapter)
331 {
332 	return I2C_FUNC_I2C;
333 }
334 
335 static struct i2c_algorithm af9035_i2c_algo = {
336 	.master_xfer = af9035_i2c_master_xfer,
337 	.functionality = af9035_i2c_functionality,
338 };
339 
340 static int af9035_identify_state(struct dvb_usb_device *d, const char **name)
341 {
342 	struct state *state = d_to_priv(d);
343 	int ret;
344 	u8 wbuf[1] = { 1 };
345 	u8 rbuf[4];
346 	struct usb_req req = { CMD_FW_QUERYINFO, 0, sizeof(wbuf), wbuf,
347 			sizeof(rbuf), rbuf };
348 
349 	ret = af9035_rd_regs(d, 0x1222, rbuf, 3);
350 	if (ret < 0)
351 		goto err;
352 
353 	state->chip_version = rbuf[0];
354 	state->chip_type = rbuf[2] << 8 | rbuf[1] << 0;
355 
356 	ret = af9035_rd_reg(d, 0x384f, &state->prechip_version);
357 	if (ret < 0)
358 		goto err;
359 
360 	dev_info(&d->udev->dev,
361 			"%s: prechip_version=%02x chip_version=%02x chip_type=%04x\n",
362 			KBUILD_MODNAME, state->prechip_version,
363 			state->chip_version, state->chip_type);
364 
365 	if (state->chip_type == 0x9135) {
366 		if (state->chip_version == 0x02)
367 			*name = AF9035_FIRMWARE_IT9135_V2;
368 		else
369 			*name = AF9035_FIRMWARE_IT9135_V1;
370 		state->eeprom_addr = EEPROM_BASE_IT9135;
371 	} else {
372 		*name = AF9035_FIRMWARE_AF9035;
373 		state->eeprom_addr = EEPROM_BASE_AF9035;
374 	}
375 
376 	ret = af9035_ctrl_msg(d, &req);
377 	if (ret < 0)
378 		goto err;
379 
380 	dev_dbg(&d->udev->dev, "%s: reply=%*ph\n", __func__, 4, rbuf);
381 	if (rbuf[0] || rbuf[1] || rbuf[2] || rbuf[3])
382 		ret = WARM;
383 	else
384 		ret = COLD;
385 
386 	return ret;
387 
388 err:
389 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
390 
391 	return ret;
392 }
393 
394 static int af9035_download_firmware_old(struct dvb_usb_device *d,
395 		const struct firmware *fw)
396 {
397 	int ret, i, j, len;
398 	u8 wbuf[1];
399 	struct usb_req req = { 0, 0, 0, NULL, 0, NULL };
400 	struct usb_req req_fw_dl = { CMD_FW_DL, 0, 0, wbuf, 0, NULL };
401 	u8 hdr_core;
402 	u16 hdr_addr, hdr_data_len, hdr_checksum;
403 	#define MAX_DATA 58
404 	#define HDR_SIZE 7
405 
406 	/*
407 	 * Thanks to Daniel Glöckner <daniel-gl@gmx.net> about that info!
408 	 *
409 	 * byte 0: MCS 51 core
410 	 *  There are two inside the AF9035 (1=Link and 2=OFDM) with separate
411 	 *  address spaces
412 	 * byte 1-2: Big endian destination address
413 	 * byte 3-4: Big endian number of data bytes following the header
414 	 * byte 5-6: Big endian header checksum, apparently ignored by the chip
415 	 *  Calculated as ~(h[0]*256+h[1]+h[2]*256+h[3]+h[4]*256)
416 	 */
417 
418 	for (i = fw->size; i > HDR_SIZE;) {
419 		hdr_core = fw->data[fw->size - i + 0];
420 		hdr_addr = fw->data[fw->size - i + 1] << 8;
421 		hdr_addr |= fw->data[fw->size - i + 2] << 0;
422 		hdr_data_len = fw->data[fw->size - i + 3] << 8;
423 		hdr_data_len |= fw->data[fw->size - i + 4] << 0;
424 		hdr_checksum = fw->data[fw->size - i + 5] << 8;
425 		hdr_checksum |= fw->data[fw->size - i + 6] << 0;
426 
427 		dev_dbg(&d->udev->dev,
428 				"%s: core=%d addr=%04x data_len=%d checksum=%04x\n",
429 				__func__, hdr_core, hdr_addr, hdr_data_len,
430 				hdr_checksum);
431 
432 		if (((hdr_core != 1) && (hdr_core != 2)) ||
433 				(hdr_data_len > i)) {
434 			dev_dbg(&d->udev->dev, "%s: bad firmware\n", __func__);
435 			break;
436 		}
437 
438 		/* download begin packet */
439 		req.cmd = CMD_FW_DL_BEGIN;
440 		ret = af9035_ctrl_msg(d, &req);
441 		if (ret < 0)
442 			goto err;
443 
444 		/* download firmware packet(s) */
445 		for (j = HDR_SIZE + hdr_data_len; j > 0; j -= MAX_DATA) {
446 			len = j;
447 			if (len > MAX_DATA)
448 				len = MAX_DATA;
449 			req_fw_dl.wlen = len;
450 			req_fw_dl.wbuf = (u8 *) &fw->data[fw->size - i +
451 					HDR_SIZE + hdr_data_len - j];
452 			ret = af9035_ctrl_msg(d, &req_fw_dl);
453 			if (ret < 0)
454 				goto err;
455 		}
456 
457 		/* download end packet */
458 		req.cmd = CMD_FW_DL_END;
459 		ret = af9035_ctrl_msg(d, &req);
460 		if (ret < 0)
461 			goto err;
462 
463 		i -= hdr_data_len + HDR_SIZE;
464 
465 		dev_dbg(&d->udev->dev, "%s: data uploaded=%zu\n",
466 				__func__, fw->size - i);
467 	}
468 
469 	/* print warn if firmware is bad, continue and see what happens */
470 	if (i)
471 		dev_warn(&d->udev->dev, "%s: bad firmware\n", KBUILD_MODNAME);
472 
473 	return 0;
474 
475 err:
476 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
477 
478 	return ret;
479 }
480 
481 static int af9035_download_firmware_new(struct dvb_usb_device *d,
482 		const struct firmware *fw)
483 {
484 	int ret, i, i_prev;
485 	struct usb_req req_fw_dl = { CMD_FW_SCATTER_WR, 0, 0, NULL, 0, NULL };
486 	#define HDR_SIZE 7
487 
488 	/*
489 	 * There seems to be following firmware header. Meaning of bytes 0-3
490 	 * is unknown.
491 	 *
492 	 * 0: 3
493 	 * 1: 0, 1
494 	 * 2: 0
495 	 * 3: 1, 2, 3
496 	 * 4: addr MSB
497 	 * 5: addr LSB
498 	 * 6: count of data bytes ?
499 	 */
500 	for (i = HDR_SIZE, i_prev = 0; i <= fw->size; i++) {
501 		if (i == fw->size ||
502 				(fw->data[i + 0] == 0x03 &&
503 				(fw->data[i + 1] == 0x00 ||
504 				fw->data[i + 1] == 0x01) &&
505 				fw->data[i + 2] == 0x00)) {
506 			req_fw_dl.wlen = i - i_prev;
507 			req_fw_dl.wbuf = (u8 *) &fw->data[i_prev];
508 			i_prev = i;
509 			ret = af9035_ctrl_msg(d, &req_fw_dl);
510 			if (ret < 0)
511 				goto err;
512 
513 			dev_dbg(&d->udev->dev, "%s: data uploaded=%d\n",
514 					__func__, i);
515 		}
516 	}
517 
518 	return 0;
519 
520 err:
521 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
522 
523 	return ret;
524 }
525 
526 static int af9035_download_firmware(struct dvb_usb_device *d,
527 		const struct firmware *fw)
528 {
529 	struct state *state = d_to_priv(d);
530 	int ret;
531 	u8 wbuf[1];
532 	u8 rbuf[4];
533 	u8 tmp;
534 	struct usb_req req = { 0, 0, 0, NULL, 0, NULL };
535 	struct usb_req req_fw_ver = { CMD_FW_QUERYINFO, 0, 1, wbuf, 4, rbuf };
536 	dev_dbg(&d->udev->dev, "%s:\n", __func__);
537 
538 	/*
539 	 * In case of dual tuner configuration we need to do some extra
540 	 * initialization in order to download firmware to slave demod too,
541 	 * which is done by master demod.
542 	 * Master feeds also clock and controls power via GPIO.
543 	 */
544 	ret = af9035_rd_reg(d, state->eeprom_addr + EEPROM_TS_MODE, &tmp);
545 	if (ret < 0)
546 		goto err;
547 
548 	if (tmp == 1 || tmp == 3) {
549 		/* configure gpioh1, reset & power slave demod */
550 		ret = af9035_wr_reg_mask(d, 0x00d8b0, 0x01, 0x01);
551 		if (ret < 0)
552 			goto err;
553 
554 		ret = af9035_wr_reg_mask(d, 0x00d8b1, 0x01, 0x01);
555 		if (ret < 0)
556 			goto err;
557 
558 		ret = af9035_wr_reg_mask(d, 0x00d8af, 0x00, 0x01);
559 		if (ret < 0)
560 			goto err;
561 
562 		usleep_range(10000, 50000);
563 
564 		ret = af9035_wr_reg_mask(d, 0x00d8af, 0x01, 0x01);
565 		if (ret < 0)
566 			goto err;
567 
568 		/* tell the slave I2C address */
569 		ret = af9035_rd_reg(d,
570 				state->eeprom_addr + EEPROM_2ND_DEMOD_ADDR,
571 				&tmp);
572 		if (ret < 0)
573 			goto err;
574 
575 		if (state->chip_type == 0x9135) {
576 			ret = af9035_wr_reg(d, 0x004bfb, tmp);
577 			if (ret < 0)
578 				goto err;
579 		} else {
580 			ret = af9035_wr_reg(d, 0x00417f, tmp);
581 			if (ret < 0)
582 				goto err;
583 
584 			/* enable clock out */
585 			ret = af9035_wr_reg_mask(d, 0x00d81a, 0x01, 0x01);
586 			if (ret < 0)
587 				goto err;
588 		}
589 	}
590 
591 	if (fw->data[0] == 0x01)
592 		ret = af9035_download_firmware_old(d, fw);
593 	else
594 		ret = af9035_download_firmware_new(d, fw);
595 	if (ret < 0)
596 		goto err;
597 
598 	/* firmware loaded, request boot */
599 	req.cmd = CMD_FW_BOOT;
600 	ret = af9035_ctrl_msg(d, &req);
601 	if (ret < 0)
602 		goto err;
603 
604 	/* ensure firmware starts */
605 	wbuf[0] = 1;
606 	ret = af9035_ctrl_msg(d, &req_fw_ver);
607 	if (ret < 0)
608 		goto err;
609 
610 	if (!(rbuf[0] || rbuf[1] || rbuf[2] || rbuf[3])) {
611 		dev_err(&d->udev->dev, "%s: firmware did not run\n",
612 				KBUILD_MODNAME);
613 		ret = -ENODEV;
614 		goto err;
615 	}
616 
617 	dev_info(&d->udev->dev, "%s: firmware version=%d.%d.%d.%d",
618 			KBUILD_MODNAME, rbuf[0], rbuf[1], rbuf[2], rbuf[3]);
619 
620 	return 0;
621 
622 err:
623 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
624 
625 	return ret;
626 }
627 
628 static int af9035_read_config(struct dvb_usb_device *d)
629 {
630 	struct state *state = d_to_priv(d);
631 	int ret, i;
632 	u8 tmp;
633 	u16 tmp16, addr;
634 
635 	/* demod I2C "address" */
636 	state->af9033_config[0].i2c_addr = 0x38;
637 	state->af9033_config[0].adc_multiplier = AF9033_ADC_MULTIPLIER_2X;
638 	state->af9033_config[1].adc_multiplier = AF9033_ADC_MULTIPLIER_2X;
639 	state->af9033_config[0].ts_mode = AF9033_TS_MODE_USB;
640 	state->af9033_config[1].ts_mode = AF9033_TS_MODE_SERIAL;
641 
642 	/* eeprom memory mapped location */
643 	if (state->chip_type == 0x9135) {
644 		if (state->chip_version == 0x02) {
645 			state->af9033_config[0].tuner = AF9033_TUNER_IT9135_60;
646 			state->af9033_config[1].tuner = AF9033_TUNER_IT9135_60;
647 			tmp16 = 0x00461d;
648 		} else {
649 			state->af9033_config[0].tuner = AF9033_TUNER_IT9135_38;
650 			state->af9033_config[1].tuner = AF9033_TUNER_IT9135_38;
651 			tmp16 = 0x00461b;
652 		}
653 
654 		/* check if eeprom exists */
655 		ret = af9035_rd_reg(d, tmp16, &tmp);
656 		if (ret < 0)
657 			goto err;
658 
659 		if (tmp == 0x00) {
660 			dev_dbg(&d->udev->dev, "%s: no eeprom\n", __func__);
661 			goto skip_eeprom;
662 		}
663 	}
664 
665 	/* check if there is dual tuners */
666 	ret = af9035_rd_reg(d, state->eeprom_addr + EEPROM_TS_MODE, &tmp);
667 	if (ret < 0)
668 		goto err;
669 
670 	if (tmp == 1 || tmp == 3)
671 		state->dual_mode = true;
672 
673 	dev_dbg(&d->udev->dev, "%s: ts mode=%d dual mode=%d\n", __func__,
674 			tmp, state->dual_mode);
675 
676 	if (state->dual_mode) {
677 		/* read 2nd demodulator I2C address */
678 		ret = af9035_rd_reg(d,
679 				state->eeprom_addr + EEPROM_2ND_DEMOD_ADDR,
680 				&tmp);
681 		if (ret < 0)
682 			goto err;
683 
684 		state->af9033_config[1].i2c_addr = tmp;
685 		dev_dbg(&d->udev->dev, "%s: 2nd demod I2C addr=%02x\n",
686 				__func__, tmp);
687 	}
688 
689 	addr = state->eeprom_addr;
690 
691 	for (i = 0; i < state->dual_mode + 1; i++) {
692 		/* tuner */
693 		ret = af9035_rd_reg(d, addr + EEPROM_1_TUNER_ID, &tmp);
694 		if (ret < 0)
695 			goto err;
696 
697 		if (tmp == 0x00)
698 			dev_dbg(&d->udev->dev,
699 					"%s: [%d]tuner not set, using default\n",
700 					__func__, i);
701 		else
702 			state->af9033_config[i].tuner = tmp;
703 
704 		dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
705 				__func__, i, state->af9033_config[i].tuner);
706 
707 		switch (state->af9033_config[i].tuner) {
708 		case AF9033_TUNER_TUA9001:
709 		case AF9033_TUNER_FC0011:
710 		case AF9033_TUNER_MXL5007T:
711 		case AF9033_TUNER_TDA18218:
712 		case AF9033_TUNER_FC2580:
713 		case AF9033_TUNER_FC0012:
714 			state->af9033_config[i].spec_inv = 1;
715 			break;
716 		case AF9033_TUNER_IT9135_38:
717 		case AF9033_TUNER_IT9135_51:
718 		case AF9033_TUNER_IT9135_52:
719 		case AF9033_TUNER_IT9135_60:
720 		case AF9033_TUNER_IT9135_61:
721 		case AF9033_TUNER_IT9135_62:
722 			break;
723 		default:
724 			dev_warn(&d->udev->dev,
725 					"%s: tuner id=%02x not supported, please report!",
726 					KBUILD_MODNAME, tmp);
727 		}
728 
729 		/* disable dual mode if driver does not support it */
730 		if (i == 1)
731 			switch (state->af9033_config[i].tuner) {
732 			case AF9033_TUNER_FC0012:
733 			case AF9033_TUNER_IT9135_38:
734 			case AF9033_TUNER_IT9135_51:
735 			case AF9033_TUNER_IT9135_52:
736 			case AF9033_TUNER_IT9135_60:
737 			case AF9033_TUNER_IT9135_61:
738 			case AF9033_TUNER_IT9135_62:
739 			case AF9033_TUNER_MXL5007T:
740 				break;
741 			default:
742 				state->dual_mode = false;
743 				dev_info(&d->udev->dev,
744 						"%s: driver does not support 2nd tuner and will disable it",
745 						KBUILD_MODNAME);
746 		}
747 
748 		/* tuner IF frequency */
749 		ret = af9035_rd_reg(d, addr + EEPROM_1_IF_L, &tmp);
750 		if (ret < 0)
751 			goto err;
752 
753 		tmp16 = tmp;
754 
755 		ret = af9035_rd_reg(d, addr + EEPROM_1_IF_H, &tmp);
756 		if (ret < 0)
757 			goto err;
758 
759 		tmp16 |= tmp << 8;
760 
761 		dev_dbg(&d->udev->dev, "%s: [%d]IF=%d\n", __func__, i, tmp16);
762 
763 		addr += 0x10; /* shift for the 2nd tuner params */
764 	}
765 
766 skip_eeprom:
767 	/* get demod clock */
768 	ret = af9035_rd_reg(d, 0x00d800, &tmp);
769 	if (ret < 0)
770 		goto err;
771 
772 	tmp = (tmp >> 0) & 0x0f;
773 
774 	for (i = 0; i < ARRAY_SIZE(state->af9033_config); i++) {
775 		if (state->chip_type == 0x9135)
776 			state->af9033_config[i].clock = clock_lut_it9135[tmp];
777 		else
778 			state->af9033_config[i].clock = clock_lut_af9035[tmp];
779 	}
780 
781 	return 0;
782 
783 err:
784 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
785 
786 	return ret;
787 }
788 
789 static int af9035_tua9001_tuner_callback(struct dvb_usb_device *d,
790 		int cmd, int arg)
791 {
792 	int ret;
793 	u8 val;
794 
795 	dev_dbg(&d->udev->dev, "%s: cmd=%d arg=%d\n", __func__, cmd, arg);
796 
797 	/*
798 	 * CEN     always enabled by hardware wiring
799 	 * RESETN  GPIOT3
800 	 * RXEN    GPIOT2
801 	 */
802 
803 	switch (cmd) {
804 	case TUA9001_CMD_RESETN:
805 		if (arg)
806 			val = 0x00;
807 		else
808 			val = 0x01;
809 
810 		ret = af9035_wr_reg_mask(d, 0x00d8e7, val, 0x01);
811 		if (ret < 0)
812 			goto err;
813 		break;
814 	case TUA9001_CMD_RXEN:
815 		if (arg)
816 			val = 0x01;
817 		else
818 			val = 0x00;
819 
820 		ret = af9035_wr_reg_mask(d, 0x00d8eb, val, 0x01);
821 		if (ret < 0)
822 			goto err;
823 		break;
824 	}
825 
826 	return 0;
827 
828 err:
829 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
830 
831 	return ret;
832 }
833 
834 
835 static int af9035_fc0011_tuner_callback(struct dvb_usb_device *d,
836 		int cmd, int arg)
837 {
838 	int ret;
839 
840 	switch (cmd) {
841 	case FC0011_FE_CALLBACK_POWER:
842 		/* Tuner enable */
843 		ret = af9035_wr_reg_mask(d, 0xd8eb, 1, 1);
844 		if (ret < 0)
845 			goto err;
846 
847 		ret = af9035_wr_reg_mask(d, 0xd8ec, 1, 1);
848 		if (ret < 0)
849 			goto err;
850 
851 		ret = af9035_wr_reg_mask(d, 0xd8ed, 1, 1);
852 		if (ret < 0)
853 			goto err;
854 
855 		/* LED */
856 		ret = af9035_wr_reg_mask(d, 0xd8d0, 1, 1);
857 		if (ret < 0)
858 			goto err;
859 
860 		ret = af9035_wr_reg_mask(d, 0xd8d1, 1, 1);
861 		if (ret < 0)
862 			goto err;
863 
864 		usleep_range(10000, 50000);
865 		break;
866 	case FC0011_FE_CALLBACK_RESET:
867 		ret = af9035_wr_reg(d, 0xd8e9, 1);
868 		if (ret < 0)
869 			goto err;
870 
871 		ret = af9035_wr_reg(d, 0xd8e8, 1);
872 		if (ret < 0)
873 			goto err;
874 
875 		ret = af9035_wr_reg(d, 0xd8e7, 1);
876 		if (ret < 0)
877 			goto err;
878 
879 		usleep_range(10000, 20000);
880 
881 		ret = af9035_wr_reg(d, 0xd8e7, 0);
882 		if (ret < 0)
883 			goto err;
884 
885 		usleep_range(10000, 20000);
886 		break;
887 	default:
888 		ret = -EINVAL;
889 		goto err;
890 	}
891 
892 	return 0;
893 
894 err:
895 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
896 
897 	return ret;
898 }
899 
900 static int af9035_tuner_callback(struct dvb_usb_device *d, int cmd, int arg)
901 {
902 	struct state *state = d_to_priv(d);
903 
904 	switch (state->af9033_config[0].tuner) {
905 	case AF9033_TUNER_FC0011:
906 		return af9035_fc0011_tuner_callback(d, cmd, arg);
907 	case AF9033_TUNER_TUA9001:
908 		return af9035_tua9001_tuner_callback(d, cmd, arg);
909 	default:
910 		break;
911 	}
912 
913 	return 0;
914 }
915 
916 static int af9035_frontend_callback(void *adapter_priv, int component,
917 				    int cmd, int arg)
918 {
919 	struct i2c_adapter *adap = adapter_priv;
920 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
921 
922 	dev_dbg(&d->udev->dev, "%s: component=%d cmd=%d arg=%d\n",
923 			__func__, component, cmd, arg);
924 
925 	switch (component) {
926 	case DVB_FRONTEND_COMPONENT_TUNER:
927 		return af9035_tuner_callback(d, cmd, arg);
928 	default:
929 		break;
930 	}
931 
932 	return 0;
933 }
934 
935 static int af9035_get_adapter_count(struct dvb_usb_device *d)
936 {
937 	struct state *state = d_to_priv(d);
938 
939 	/* disable 2nd adapter as we don't have PID filters implemented */
940 	if (d->udev->speed == USB_SPEED_FULL)
941 		return 1;
942 	else
943 		return state->dual_mode + 1;
944 }
945 
946 static int af9035_frontend_attach(struct dvb_usb_adapter *adap)
947 {
948 	struct state *state = adap_to_priv(adap);
949 	struct dvb_usb_device *d = adap_to_d(adap);
950 	int ret;
951 	dev_dbg(&d->udev->dev, "%s:\n", __func__);
952 
953 	if (!state->af9033_config[adap->id].tuner) {
954 		/* unsupported tuner */
955 		ret = -ENODEV;
956 		goto err;
957 	}
958 
959 	/* attach demodulator */
960 	adap->fe[0] = dvb_attach(af9033_attach, &state->af9033_config[adap->id],
961 			&d->i2c_adap);
962 	if (adap->fe[0] == NULL) {
963 		ret = -ENODEV;
964 		goto err;
965 	}
966 
967 	/* disable I2C-gate */
968 	adap->fe[0]->ops.i2c_gate_ctrl = NULL;
969 	adap->fe[0]->callback = af9035_frontend_callback;
970 
971 	return 0;
972 
973 err:
974 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
975 
976 	return ret;
977 }
978 
979 static struct tua9001_config af9035_tua9001_config = {
980 	.i2c_addr = 0x60,
981 };
982 
983 static const struct fc0011_config af9035_fc0011_config = {
984 	.i2c_address = 0x60,
985 };
986 
987 static struct mxl5007t_config af9035_mxl5007t_config[] = {
988 	{
989 		.xtal_freq_hz = MxL_XTAL_24_MHZ,
990 		.if_freq_hz = MxL_IF_4_57_MHZ,
991 		.invert_if = 0,
992 		.loop_thru_enable = 0,
993 		.clk_out_enable = 0,
994 		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
995 	}, {
996 		.xtal_freq_hz = MxL_XTAL_24_MHZ,
997 		.if_freq_hz = MxL_IF_4_57_MHZ,
998 		.invert_if = 0,
999 		.loop_thru_enable = 1,
1000 		.clk_out_enable = 1,
1001 		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
1002 	}
1003 };
1004 
1005 static struct tda18218_config af9035_tda18218_config = {
1006 	.i2c_address = 0x60,
1007 	.i2c_wr_max = 21,
1008 };
1009 
1010 static const struct fc2580_config af9035_fc2580_config = {
1011 	.i2c_addr = 0x56,
1012 	.clock = 16384000,
1013 };
1014 
1015 static const struct fc0012_config af9035_fc0012_config[] = {
1016 	{
1017 		.i2c_address = 0x63,
1018 		.xtal_freq = FC_XTAL_36_MHZ,
1019 		.dual_master = true,
1020 		.loop_through = true,
1021 		.clock_out = true,
1022 	}, {
1023 		.i2c_address = 0x63 | 0x80, /* I2C bus select hack */
1024 		.xtal_freq = FC_XTAL_36_MHZ,
1025 		.dual_master = true,
1026 	}
1027 };
1028 
1029 static int af9035_tuner_attach(struct dvb_usb_adapter *adap)
1030 {
1031 	struct state *state = adap_to_priv(adap);
1032 	struct dvb_usb_device *d = adap_to_d(adap);
1033 	int ret;
1034 	struct dvb_frontend *fe;
1035 	struct i2c_msg msg[1];
1036 	u8 tuner_addr;
1037 	dev_dbg(&d->udev->dev, "%s:\n", __func__);
1038 
1039 	/*
1040 	 * XXX: Hack used in that function: we abuse unused I2C address bit [7]
1041 	 * to carry info about used I2C bus for dual tuner configuration.
1042 	 */
1043 
1044 	switch (state->af9033_config[adap->id].tuner) {
1045 	case AF9033_TUNER_TUA9001:
1046 		/* AF9035 gpiot3 = TUA9001 RESETN
1047 		   AF9035 gpiot2 = TUA9001 RXEN */
1048 
1049 		/* configure gpiot2 and gpiot2 as output */
1050 		ret = af9035_wr_reg_mask(d, 0x00d8ec, 0x01, 0x01);
1051 		if (ret < 0)
1052 			goto err;
1053 
1054 		ret = af9035_wr_reg_mask(d, 0x00d8ed, 0x01, 0x01);
1055 		if (ret < 0)
1056 			goto err;
1057 
1058 		ret = af9035_wr_reg_mask(d, 0x00d8e8, 0x01, 0x01);
1059 		if (ret < 0)
1060 			goto err;
1061 
1062 		ret = af9035_wr_reg_mask(d, 0x00d8e9, 0x01, 0x01);
1063 		if (ret < 0)
1064 			goto err;
1065 
1066 		/* attach tuner */
1067 		fe = dvb_attach(tua9001_attach, adap->fe[0],
1068 				&d->i2c_adap, &af9035_tua9001_config);
1069 		break;
1070 	case AF9033_TUNER_FC0011:
1071 		fe = dvb_attach(fc0011_attach, adap->fe[0],
1072 				&d->i2c_adap, &af9035_fc0011_config);
1073 		break;
1074 	case AF9033_TUNER_MXL5007T:
1075 		if (adap->id == 0) {
1076 			ret = af9035_wr_reg(d, 0x00d8e0, 1);
1077 			if (ret < 0)
1078 				goto err;
1079 
1080 			ret = af9035_wr_reg(d, 0x00d8e1, 1);
1081 			if (ret < 0)
1082 				goto err;
1083 
1084 			ret = af9035_wr_reg(d, 0x00d8df, 0);
1085 			if (ret < 0)
1086 				goto err;
1087 
1088 			msleep(30);
1089 
1090 			ret = af9035_wr_reg(d, 0x00d8df, 1);
1091 			if (ret < 0)
1092 				goto err;
1093 
1094 			msleep(300);
1095 
1096 			ret = af9035_wr_reg(d, 0x00d8c0, 1);
1097 			if (ret < 0)
1098 				goto err;
1099 
1100 			ret = af9035_wr_reg(d, 0x00d8c1, 1);
1101 			if (ret < 0)
1102 				goto err;
1103 
1104 			ret = af9035_wr_reg(d, 0x00d8bf, 0);
1105 			if (ret < 0)
1106 				goto err;
1107 
1108 			ret = af9035_wr_reg(d, 0x00d8b4, 1);
1109 			if (ret < 0)
1110 				goto err;
1111 
1112 			ret = af9035_wr_reg(d, 0x00d8b5, 1);
1113 			if (ret < 0)
1114 				goto err;
1115 
1116 			ret = af9035_wr_reg(d, 0x00d8b3, 1);
1117 			if (ret < 0)
1118 				goto err;
1119 
1120 			tuner_addr = 0x60;
1121 		} else {
1122 			tuner_addr = 0x60 | 0x80; /* I2C bus hack */
1123 		}
1124 
1125 		/* attach tuner */
1126 		fe = dvb_attach(mxl5007t_attach, adap->fe[0], &d->i2c_adap,
1127 				tuner_addr, &af9035_mxl5007t_config[adap->id]);
1128 		break;
1129 	case AF9033_TUNER_TDA18218:
1130 		/* attach tuner */
1131 		fe = dvb_attach(tda18218_attach, adap->fe[0],
1132 				&d->i2c_adap, &af9035_tda18218_config);
1133 		break;
1134 	case AF9033_TUNER_FC2580:
1135 		/* Tuner enable using gpiot2_o, gpiot2_en and gpiot2_on  */
1136 		ret = af9035_wr_reg_mask(d, 0xd8eb, 0x01, 0x01);
1137 		if (ret < 0)
1138 			goto err;
1139 
1140 		ret = af9035_wr_reg_mask(d, 0xd8ec, 0x01, 0x01);
1141 		if (ret < 0)
1142 			goto err;
1143 
1144 		ret = af9035_wr_reg_mask(d, 0xd8ed, 0x01, 0x01);
1145 		if (ret < 0)
1146 			goto err;
1147 
1148 		usleep_range(10000, 50000);
1149 		/* attach tuner */
1150 		fe = dvb_attach(fc2580_attach, adap->fe[0],
1151 				&d->i2c_adap, &af9035_fc2580_config);
1152 		break;
1153 	case AF9033_TUNER_FC0012:
1154 		/*
1155 		 * AF9035 gpiot2 = FC0012 enable
1156 		 * XXX: there seems to be something on gpioh8 too, but on my
1157 		 * my test I didn't find any difference.
1158 		 */
1159 
1160 		if (adap->id == 0) {
1161 			/* configure gpiot2 as output and high */
1162 			ret = af9035_wr_reg_mask(d, 0xd8eb, 0x01, 0x01);
1163 			if (ret < 0)
1164 				goto err;
1165 
1166 			ret = af9035_wr_reg_mask(d, 0xd8ec, 0x01, 0x01);
1167 			if (ret < 0)
1168 				goto err;
1169 
1170 			ret = af9035_wr_reg_mask(d, 0xd8ed, 0x01, 0x01);
1171 			if (ret < 0)
1172 				goto err;
1173 		} else {
1174 			/*
1175 			 * FIXME: That belongs for the FC0012 driver.
1176 			 * Write 02 to FC0012 master tuner register 0d directly
1177 			 * in order to make slave tuner working.
1178 			 */
1179 			msg[0].addr = 0x63;
1180 			msg[0].flags = 0;
1181 			msg[0].len = 2;
1182 			msg[0].buf = "\x0d\x02";
1183 			ret = i2c_transfer(&d->i2c_adap, msg, 1);
1184 			if (ret < 0)
1185 				goto err;
1186 		}
1187 
1188 		usleep_range(10000, 50000);
1189 
1190 		fe = dvb_attach(fc0012_attach, adap->fe[0], &d->i2c_adap,
1191 				&af9035_fc0012_config[adap->id]);
1192 		break;
1193 	case AF9033_TUNER_IT9135_38:
1194 	case AF9033_TUNER_IT9135_51:
1195 	case AF9033_TUNER_IT9135_52:
1196 	case AF9033_TUNER_IT9135_60:
1197 	case AF9033_TUNER_IT9135_61:
1198 	case AF9033_TUNER_IT9135_62:
1199 		/* attach tuner */
1200 		fe = dvb_attach(it913x_attach, adap->fe[0], &d->i2c_adap,
1201 				state->af9033_config[adap->id].i2c_addr,
1202 				state->af9033_config[0].tuner);
1203 		break;
1204 	default:
1205 		fe = NULL;
1206 	}
1207 
1208 	if (fe == NULL) {
1209 		ret = -ENODEV;
1210 		goto err;
1211 	}
1212 
1213 	return 0;
1214 
1215 err:
1216 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1217 
1218 	return ret;
1219 }
1220 
1221 static int af9035_init(struct dvb_usb_device *d)
1222 {
1223 	struct state *state = d_to_priv(d);
1224 	int ret, i;
1225 	u16 frame_size = (d->udev->speed == USB_SPEED_FULL ? 5 : 87) * 188 / 4;
1226 	u8 packet_size = (d->udev->speed == USB_SPEED_FULL ? 64 : 512) / 4;
1227 	struct reg_val_mask tab[] = {
1228 		{ 0x80f99d, 0x01, 0x01 },
1229 		{ 0x80f9a4, 0x01, 0x01 },
1230 		{ 0x00dd11, 0x00, 0x20 },
1231 		{ 0x00dd11, 0x00, 0x40 },
1232 		{ 0x00dd13, 0x00, 0x20 },
1233 		{ 0x00dd13, 0x00, 0x40 },
1234 		{ 0x00dd11, 0x20, 0x20 },
1235 		{ 0x00dd88, (frame_size >> 0) & 0xff, 0xff},
1236 		{ 0x00dd89, (frame_size >> 8) & 0xff, 0xff},
1237 		{ 0x00dd0c, packet_size, 0xff},
1238 		{ 0x00dd11, state->dual_mode << 6, 0x40 },
1239 		{ 0x00dd8a, (frame_size >> 0) & 0xff, 0xff},
1240 		{ 0x00dd8b, (frame_size >> 8) & 0xff, 0xff},
1241 		{ 0x00dd0d, packet_size, 0xff },
1242 		{ 0x80f9a3, state->dual_mode, 0x01 },
1243 		{ 0x80f9cd, state->dual_mode, 0x01 },
1244 		{ 0x80f99d, 0x00, 0x01 },
1245 		{ 0x80f9a4, 0x00, 0x01 },
1246 	};
1247 
1248 	dev_dbg(&d->udev->dev,
1249 			"%s: USB speed=%d frame_size=%04x packet_size=%02x\n",
1250 			__func__, d->udev->speed, frame_size, packet_size);
1251 
1252 	/* init endpoints */
1253 	for (i = 0; i < ARRAY_SIZE(tab); i++) {
1254 		ret = af9035_wr_reg_mask(d, tab[i].reg, tab[i].val,
1255 				tab[i].mask);
1256 		if (ret < 0)
1257 			goto err;
1258 	}
1259 
1260 	return 0;
1261 
1262 err:
1263 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1264 
1265 	return ret;
1266 }
1267 
1268 #if IS_ENABLED(CONFIG_RC_CORE)
1269 static int af9035_rc_query(struct dvb_usb_device *d)
1270 {
1271 	int ret;
1272 	u32 key;
1273 	u8 buf[4];
1274 	struct usb_req req = { CMD_IR_GET, 0, 0, NULL, 4, buf };
1275 
1276 	ret = af9035_ctrl_msg(d, &req);
1277 	if (ret == 1)
1278 		return 0;
1279 	else if (ret < 0)
1280 		goto err;
1281 
1282 	if ((buf[2] + buf[3]) == 0xff) {
1283 		if ((buf[0] + buf[1]) == 0xff) {
1284 			/* NEC standard 16bit */
1285 			key = buf[0] << 8 | buf[2];
1286 		} else {
1287 			/* NEC extended 24bit */
1288 			key = buf[0] << 16 | buf[1] << 8 | buf[2];
1289 		}
1290 	} else {
1291 		/* NEC full code 32bit */
1292 		key = buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3];
1293 	}
1294 
1295 	dev_dbg(&d->udev->dev, "%s: %*ph\n", __func__, 4, buf);
1296 
1297 	rc_keydown(d->rc_dev, key, 0);
1298 
1299 	return 0;
1300 
1301 err:
1302 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1303 
1304 	return ret;
1305 }
1306 
1307 static int af9035_get_rc_config(struct dvb_usb_device *d, struct dvb_usb_rc *rc)
1308 {
1309 	struct state *state = d_to_priv(d);
1310 	int ret;
1311 	u8 tmp;
1312 
1313 	ret = af9035_rd_reg(d, state->eeprom_addr + EEPROM_IR_MODE, &tmp);
1314 	if (ret < 0)
1315 		goto err;
1316 
1317 	dev_dbg(&d->udev->dev, "%s: ir_mode=%02x\n", __func__, tmp);
1318 
1319 	/* don't activate rc if in HID mode or if not available */
1320 	if (tmp == 5) {
1321 		ret = af9035_rd_reg(d, state->eeprom_addr + EEPROM_IR_TYPE,
1322 				&tmp);
1323 		if (ret < 0)
1324 			goto err;
1325 
1326 		dev_dbg(&d->udev->dev, "%s: ir_type=%02x\n", __func__, tmp);
1327 
1328 		switch (tmp) {
1329 		case 0: /* NEC */
1330 		default:
1331 			rc->allowed_protos = RC_BIT_NEC;
1332 			break;
1333 		case 1: /* RC6 */
1334 			rc->allowed_protos = RC_BIT_RC6_MCE;
1335 			break;
1336 		}
1337 
1338 		rc->query = af9035_rc_query;
1339 		rc->interval = 500;
1340 
1341 		/* load empty to enable rc */
1342 		if (!rc->map_name)
1343 			rc->map_name = RC_MAP_EMPTY;
1344 	}
1345 
1346 	return 0;
1347 
1348 err:
1349 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1350 
1351 	return ret;
1352 }
1353 #else
1354 	#define af9035_get_rc_config NULL
1355 #endif
1356 
1357 static int af9035_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,
1358 		struct usb_data_stream_properties *stream)
1359 {
1360 	struct dvb_usb_device *d = fe_to_d(fe);
1361 	dev_dbg(&d->udev->dev, "%s: adap=%d\n", __func__, fe_to_adap(fe)->id);
1362 
1363 	if (d->udev->speed == USB_SPEED_FULL)
1364 		stream->u.bulk.buffersize = 5 * 188;
1365 
1366 	return 0;
1367 }
1368 
1369 /*
1370  * FIXME: PID filter is property of demodulator and should be moved to the
1371  * correct driver. Also we support only adapter #0 PID filter and will
1372  * disable adapter #1 if USB1.1 is used.
1373  */
1374 static int af9035_pid_filter_ctrl(struct dvb_usb_adapter *adap, int onoff)
1375 {
1376 	struct dvb_usb_device *d = adap_to_d(adap);
1377 	int ret;
1378 
1379 	dev_dbg(&d->udev->dev, "%s: onoff=%d\n", __func__, onoff);
1380 
1381 	ret = af9035_wr_reg_mask(d, 0x80f993, onoff, 0x01);
1382 	if (ret < 0)
1383 		goto err;
1384 
1385 	return 0;
1386 
1387 err:
1388 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1389 
1390 	return ret;
1391 }
1392 
1393 static int af9035_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid,
1394 		int onoff)
1395 {
1396 	struct dvb_usb_device *d = adap_to_d(adap);
1397 	int ret;
1398 	u8 wbuf[2] = {(pid >> 0) & 0xff, (pid >> 8) & 0xff};
1399 
1400 	dev_dbg(&d->udev->dev, "%s: index=%d pid=%04x onoff=%d\n",
1401 			__func__, index, pid, onoff);
1402 
1403 	ret = af9035_wr_regs(d, 0x80f996, wbuf, 2);
1404 	if (ret < 0)
1405 		goto err;
1406 
1407 	ret = af9035_wr_reg(d, 0x80f994, onoff);
1408 	if (ret < 0)
1409 		goto err;
1410 
1411 	ret = af9035_wr_reg(d, 0x80f995, index);
1412 	if (ret < 0)
1413 		goto err;
1414 
1415 	return 0;
1416 
1417 err:
1418 	dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
1419 
1420 	return ret;
1421 }
1422 
1423 static int af9035_probe(struct usb_interface *intf,
1424 		const struct usb_device_id *id)
1425 {
1426 	struct usb_device *udev = interface_to_usbdev(intf);
1427 	char manufacturer[sizeof("Afatech")];
1428 
1429 	memset(manufacturer, 0, sizeof(manufacturer));
1430 	usb_string(udev, udev->descriptor.iManufacturer,
1431 			manufacturer, sizeof(manufacturer));
1432 	/*
1433 	 * There is two devices having same ID but different chipset. One uses
1434 	 * AF9015 and the other IT9135 chipset. Only difference seen on lsusb
1435 	 * is iManufacturer string.
1436 	 *
1437 	 * idVendor           0x0ccd TerraTec Electronic GmbH
1438 	 * idProduct          0x0099
1439 	 * bcdDevice            2.00
1440 	 * iManufacturer           1 Afatech
1441 	 * iProduct                2 DVB-T 2
1442 	 *
1443 	 * idVendor           0x0ccd TerraTec Electronic GmbH
1444 	 * idProduct          0x0099
1445 	 * bcdDevice            2.00
1446 	 * iManufacturer           1 ITE Technologies, Inc.
1447 	 * iProduct                2 DVB-T TV Stick
1448 	 */
1449 	if ((le16_to_cpu(udev->descriptor.idVendor) == USB_VID_TERRATEC) &&
1450 			(le16_to_cpu(udev->descriptor.idProduct) == 0x0099)) {
1451 		if (!strcmp("Afatech", manufacturer)) {
1452 			dev_dbg(&udev->dev, "%s: rejecting device\n", __func__);
1453 			return -ENODEV;
1454 		}
1455 	}
1456 
1457 	return dvb_usbv2_probe(intf, id);
1458 }
1459 
1460 /* interface 0 is used by DVB-T receiver and
1461    interface 1 is for remote controller (HID) */
1462 static const struct dvb_usb_device_properties af9035_props = {
1463 	.driver_name = KBUILD_MODNAME,
1464 	.owner = THIS_MODULE,
1465 	.adapter_nr = adapter_nr,
1466 	.size_of_priv = sizeof(struct state),
1467 
1468 	.generic_bulk_ctrl_endpoint = 0x02,
1469 	.generic_bulk_ctrl_endpoint_response = 0x81,
1470 
1471 	.identify_state = af9035_identify_state,
1472 	.download_firmware = af9035_download_firmware,
1473 
1474 	.i2c_algo = &af9035_i2c_algo,
1475 	.read_config = af9035_read_config,
1476 	.frontend_attach = af9035_frontend_attach,
1477 	.tuner_attach = af9035_tuner_attach,
1478 	.init = af9035_init,
1479 	.get_rc_config = af9035_get_rc_config,
1480 	.get_stream_config = af9035_get_stream_config,
1481 
1482 	.get_adapter_count = af9035_get_adapter_count,
1483 	.adapter = {
1484 		{
1485 			.caps = DVB_USB_ADAP_HAS_PID_FILTER |
1486 				DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
1487 
1488 			.pid_filter_count = 32,
1489 			.pid_filter_ctrl = af9035_pid_filter_ctrl,
1490 			.pid_filter = af9035_pid_filter,
1491 
1492 			.stream = DVB_USB_STREAM_BULK(0x84, 6, 87 * 188),
1493 		}, {
1494 			.stream = DVB_USB_STREAM_BULK(0x85, 6, 87 * 188),
1495 		},
1496 	},
1497 };
1498 
1499 static const struct usb_device_id af9035_id_table[] = {
1500 	/* AF9035 devices */
1501 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_9035,
1502 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1503 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1000,
1504 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1505 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1001,
1506 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1507 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1002,
1508 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1509 	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1003,
1510 		&af9035_props, "Afatech AF9035 reference design", NULL) },
1511 	{ DVB_USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_T_STICK,
1512 		&af9035_props, "TerraTec Cinergy T Stick", NULL) },
1513 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835,
1514 		&af9035_props, "AVerMedia AVerTV Volar HD/PRO (A835)", NULL) },
1515 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_B835,
1516 		&af9035_props, "AVerMedia AVerTV Volar HD/PRO (A835)", NULL) },
1517 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_1867,
1518 		&af9035_props, "AVerMedia HD Volar (A867)", NULL) },
1519 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A867,
1520 		&af9035_props, "AVerMedia HD Volar (A867)", NULL) },
1521 	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_TWINSTAR,
1522 		&af9035_props, "AVerMedia Twinstar (A825)", NULL) },
1523 	{ DVB_USB_DEVICE(USB_VID_ASUS, USB_PID_ASUS_U3100MINI_PLUS,
1524 		&af9035_props, "Asus U3100Mini Plus", NULL) },
1525 	{ DVB_USB_DEVICE(USB_VID_TERRATEC, 0x00aa,
1526 		&af9035_props, "TerraTec Cinergy T Stick (rev. 2)", NULL) },
1527 	/* IT9135 devices */
1528 #if 0
1529 	{ DVB_USB_DEVICE(0x048d, 0x9135,
1530 		&af9035_props, "IT9135 reference design", NULL) },
1531 	{ DVB_USB_DEVICE(0x048d, 0x9006,
1532 		&af9035_props, "IT9135 reference design", NULL) },
1533 #endif
1534 	/* XXX: that same ID [0ccd:0099] is used by af9015 driver too */
1535 	{ DVB_USB_DEVICE(USB_VID_TERRATEC, 0x0099,
1536 		&af9035_props, "TerraTec Cinergy T Stick Dual RC (rev. 2)", NULL) },
1537 	{ }
1538 };
1539 MODULE_DEVICE_TABLE(usb, af9035_id_table);
1540 
1541 static struct usb_driver af9035_usb_driver = {
1542 	.name = KBUILD_MODNAME,
1543 	.id_table = af9035_id_table,
1544 	.probe = af9035_probe,
1545 	.disconnect = dvb_usbv2_disconnect,
1546 	.suspend = dvb_usbv2_suspend,
1547 	.resume = dvb_usbv2_resume,
1548 	.reset_resume = dvb_usbv2_reset_resume,
1549 	.no_dynamic_id = 1,
1550 	.soft_unbind = 1,
1551 };
1552 
1553 module_usb_driver(af9035_usb_driver);
1554 
1555 MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
1556 MODULE_DESCRIPTION("Afatech AF9035 driver");
1557 MODULE_LICENSE("GPL");
1558 MODULE_FIRMWARE(AF9035_FIRMWARE_AF9035);
1559 MODULE_FIRMWARE(AF9035_FIRMWARE_IT9135_V1);
1560 MODULE_FIRMWARE(AF9035_FIRMWARE_IT9135_V2);
1561