1 // SPDX-License-Identifier: GPL-2.0+
2 //
3 // em28xx-i2c.c - driver for Empia EM2800/EM2820/2840 USB video capture devices
4 //
5 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
6 //		      Markus Rechberger <mrechberger@gmail.com>
7 //		      Mauro Carvalho Chehab <mchehab@kernel.org>
8 //		      Sascha Sommer <saschasommer@freenet.de>
9 // Copyright (C) 2013 Frank Schäfer <fschaefer.oss@googlemail.com>
10 //
11 // This program is free software; you can redistribute it and/or modify
12 // it under the terms of the GNU General Public License as published by
13 // the Free Software Foundation; either version 2 of the License, or
14 // (at your option) any later version.
15 //
16 // This program is distributed in the hope that it will be useful,
17 // but WITHOUT ANY WARRANTY; without even the implied warranty of
18 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19 // GNU General Public License for more details.
20 
21 #include "em28xx.h"
22 
23 #include <linux/module.h>
24 #include <linux/kernel.h>
25 #include <linux/usb.h>
26 #include <linux/i2c.h>
27 #include <linux/jiffies.h>
28 
29 #include "tuner-xc2028.h"
30 #include <media/v4l2-common.h>
31 #include <media/tuner.h>
32 
33 /* ----------------------------------------------------------- */
34 
35 static unsigned int i2c_scan;
36 module_param(i2c_scan, int, 0444);
37 MODULE_PARM_DESC(i2c_scan, "scan i2c bus at insmod time");
38 
39 static unsigned int i2c_debug;
40 module_param(i2c_debug, int, 0644);
41 MODULE_PARM_DESC(i2c_debug, "i2c debug message level (1: normal debug, 2: show I2C transfers)");
42 
43 #define dprintk(level, fmt, arg...) do {				\
44 	if (i2c_debug > level)						\
45 		dev_printk(KERN_DEBUG, &dev->intf->dev,			\
46 			   "i2c: %s: " fmt, __func__, ## arg);		\
47 } while (0)
48 
49 /*
50  * Time in msecs to wait for i2c xfers to finish.
51  * 35ms is the maximum time a SMBUS device could wait when
52  * clock stretching is used. As the transfer itself will take
53  * some time to happen, set it to 35 ms.
54  *
55  * Ok, I2C doesn't specify any limit. So, eventually, we may need
56  * to increase this timeout.
57  */
58 #define EM28XX_I2C_XFER_TIMEOUT         35 /* ms */
59 
60 static int em28xx_i2c_timeout(struct em28xx *dev)
61 {
62 	int time = EM28XX_I2C_XFER_TIMEOUT;
63 
64 	switch (dev->i2c_speed & 0x03) {
65 	case EM28XX_I2C_FREQ_25_KHZ:
66 		time += 4;		/* Assume 4 ms for transfers */
67 		break;
68 	case EM28XX_I2C_FREQ_100_KHZ:
69 	case EM28XX_I2C_FREQ_400_KHZ:
70 		time += 1;		/* Assume 1 ms for transfers */
71 		break;
72 	default: /* EM28XX_I2C_FREQ_1_5_MHZ */
73 		break;
74 	}
75 
76 	return msecs_to_jiffies(time);
77 }
78 
79 /*
80  * em2800_i2c_send_bytes()
81  * send up to 4 bytes to the em2800 i2c device
82  */
83 static int em2800_i2c_send_bytes(struct em28xx *dev, u8 addr, u8 *buf, u16 len)
84 {
85 	unsigned long timeout = jiffies + em28xx_i2c_timeout(dev);
86 	int ret;
87 	u8 b2[6];
88 
89 	if (len < 1 || len > 4)
90 		return -EOPNOTSUPP;
91 
92 	b2[5] = 0x80 + len - 1;
93 	b2[4] = addr;
94 	b2[3] = buf[0];
95 	if (len > 1)
96 		b2[2] = buf[1];
97 	if (len > 2)
98 		b2[1] = buf[2];
99 	if (len > 3)
100 		b2[0] = buf[3];
101 
102 	/* trigger write */
103 	ret = dev->em28xx_write_regs(dev, 4 - len, &b2[4 - len], 2 + len);
104 	if (ret != 2 + len) {
105 		dev_warn(&dev->intf->dev,
106 			 "failed to trigger write to i2c address 0x%x (error=%i)\n",
107 			    addr, ret);
108 		return (ret < 0) ? ret : -EIO;
109 	}
110 	/* wait for completion */
111 	while (time_is_after_jiffies(timeout)) {
112 		ret = dev->em28xx_read_reg(dev, 0x05);
113 		if (ret == 0x80 + len - 1)
114 			return len;
115 		if (ret == 0x94 + len - 1) {
116 			dprintk(1, "R05 returned 0x%02x: I2C ACK error\n", ret);
117 			return -ENXIO;
118 		}
119 		if (ret < 0) {
120 			dev_warn(&dev->intf->dev,
121 				 "failed to get i2c transfer status from bridge register (error=%i)\n",
122 				ret);
123 			return ret;
124 		}
125 		usleep_range(5000, 6000);
126 	}
127 	dprintk(0, "write to i2c device at 0x%x timed out\n", addr);
128 	return -ETIMEDOUT;
129 }
130 
131 /*
132  * em2800_i2c_recv_bytes()
133  * read up to 4 bytes from the em2800 i2c device
134  */
135 static int em2800_i2c_recv_bytes(struct em28xx *dev, u8 addr, u8 *buf, u16 len)
136 {
137 	unsigned long timeout = jiffies + em28xx_i2c_timeout(dev);
138 	u8 buf2[4];
139 	int ret;
140 	int i;
141 
142 	if (len < 1 || len > 4)
143 		return -EOPNOTSUPP;
144 
145 	/* trigger read */
146 	buf2[1] = 0x84 + len - 1;
147 	buf2[0] = addr;
148 	ret = dev->em28xx_write_regs(dev, 0x04, buf2, 2);
149 	if (ret != 2) {
150 		dev_warn(&dev->intf->dev,
151 			 "failed to trigger read from i2c address 0x%x (error=%i)\n",
152 			 addr, ret);
153 		return (ret < 0) ? ret : -EIO;
154 	}
155 
156 	/* wait for completion */
157 	while (time_is_after_jiffies(timeout)) {
158 		ret = dev->em28xx_read_reg(dev, 0x05);
159 		if (ret == 0x84 + len - 1)
160 			break;
161 		if (ret == 0x94 + len - 1) {
162 			dprintk(1, "R05 returned 0x%02x: I2C ACK error\n",
163 				ret);
164 			return -ENXIO;
165 		}
166 		if (ret < 0) {
167 			dev_warn(&dev->intf->dev,
168 				 "failed to get i2c transfer status from bridge register (error=%i)\n",
169 				 ret);
170 			return ret;
171 		}
172 		usleep_range(5000, 6000);
173 	}
174 	if (ret != 0x84 + len - 1)
175 		dprintk(0, "read from i2c device at 0x%x timed out\n", addr);
176 
177 	/* get the received message */
178 	ret = dev->em28xx_read_reg_req_len(dev, 0x00, 4 - len, buf2, len);
179 	if (ret != len) {
180 		dev_warn(&dev->intf->dev,
181 			 "reading from i2c device at 0x%x failed: couldn't get the received message from the bridge (error=%i)\n",
182 			 addr, ret);
183 		return (ret < 0) ? ret : -EIO;
184 	}
185 	for (i = 0; i < len; i++)
186 		buf[i] = buf2[len - 1 - i];
187 
188 	return ret;
189 }
190 
191 /*
192  * em2800_i2c_check_for_device()
193  * check if there is an i2c device at the supplied address
194  */
195 static int em2800_i2c_check_for_device(struct em28xx *dev, u8 addr)
196 {
197 	u8 buf;
198 	int ret;
199 
200 	ret = em2800_i2c_recv_bytes(dev, addr, &buf, 1);
201 	if (ret == 1)
202 		return 0;
203 	return (ret < 0) ? ret : -EIO;
204 }
205 
206 /*
207  * em28xx_i2c_send_bytes()
208  */
209 static int em28xx_i2c_send_bytes(struct em28xx *dev, u16 addr, u8 *buf,
210 				 u16 len, int stop)
211 {
212 	unsigned long timeout = jiffies + em28xx_i2c_timeout(dev);
213 	int ret;
214 
215 	if (len < 1 || len > 64)
216 		return -EOPNOTSUPP;
217 	/*
218 	 * NOTE: limited by the USB ctrl message constraints
219 	 * Zero length reads always succeed, even if no device is connected
220 	 */
221 
222 	/* Write to i2c device */
223 	ret = dev->em28xx_write_regs_req(dev, stop ? 2 : 3, addr, buf, len);
224 	if (ret != len) {
225 		if (ret < 0) {
226 			dev_warn(&dev->intf->dev,
227 				 "writing to i2c device at 0x%x failed (error=%i)\n",
228 				 addr, ret);
229 			return ret;
230 		}
231 		dev_warn(&dev->intf->dev,
232 			 "%i bytes write to i2c device at 0x%x requested, but %i bytes written\n",
233 				len, addr, ret);
234 		return -EIO;
235 	}
236 
237 	/* wait for completion */
238 	while (time_is_after_jiffies(timeout)) {
239 		ret = dev->em28xx_read_reg(dev, 0x05);
240 		if (ret == 0) /* success */
241 			return len;
242 		if (ret == 0x10) {
243 			dprintk(1, "I2C ACK error on writing to addr 0x%02x\n",
244 				addr);
245 			return -ENXIO;
246 		}
247 		if (ret < 0) {
248 			dev_warn(&dev->intf->dev,
249 				 "failed to get i2c transfer status from bridge register (error=%i)\n",
250 				 ret);
251 			return ret;
252 		}
253 		usleep_range(5000, 6000);
254 		/*
255 		 * NOTE: do we really have to wait for success ?
256 		 * Never seen anything else than 0x00 or 0x10
257 		 * (even with high payload) ...
258 		 */
259 	}
260 
261 	if (ret == 0x02 || ret == 0x04) {
262 		/* NOTE: these errors seem to be related to clock stretching */
263 		dprintk(0,
264 			"write to i2c device at 0x%x timed out (status=%i)\n",
265 			addr, ret);
266 		return -ETIMEDOUT;
267 	}
268 
269 	dev_warn(&dev->intf->dev,
270 		 "write to i2c device at 0x%x failed with unknown error (status=%i)\n",
271 		 addr, ret);
272 	return -EIO;
273 }
274 
275 /*
276  * em28xx_i2c_recv_bytes()
277  * read a byte from the i2c device
278  */
279 static int em28xx_i2c_recv_bytes(struct em28xx *dev, u16 addr, u8 *buf, u16 len)
280 {
281 	int ret;
282 
283 	if (len < 1 || len > 64)
284 		return -EOPNOTSUPP;
285 	/*
286 	 * NOTE: limited by the USB ctrl message constraints
287 	 * Zero length reads always succeed, even if no device is connected
288 	 */
289 
290 	/* Read data from i2c device */
291 	ret = dev->em28xx_read_reg_req_len(dev, 2, addr, buf, len);
292 	if (ret < 0) {
293 		dev_warn(&dev->intf->dev,
294 			 "reading from i2c device at 0x%x failed (error=%i)\n",
295 			 addr, ret);
296 		return ret;
297 	}
298 	/*
299 	 * NOTE: some devices with two i2c buses have the bad habit to return 0
300 	 * bytes if we are on bus B AND there was no write attempt to the
301 	 * specified slave address before AND no device is present at the
302 	 * requested slave address.
303 	 * Anyway, the next check will fail with -ENXIO in this case, so avoid
304 	 * spamming the system log on device probing and do nothing here.
305 	 */
306 
307 	/* Check success of the i2c operation */
308 	ret = dev->em28xx_read_reg(dev, 0x05);
309 	if (ret == 0) /* success */
310 		return len;
311 	if (ret < 0) {
312 		dev_warn(&dev->intf->dev,
313 			 "failed to get i2c transfer status from bridge register (error=%i)\n",
314 			 ret);
315 		return ret;
316 	}
317 	if (ret == 0x10) {
318 		dprintk(1, "I2C ACK error on writing to addr 0x%02x\n",
319 			addr);
320 		return -ENXIO;
321 	}
322 
323 	if (ret == 0x02 || ret == 0x04) {
324 		/* NOTE: these errors seem to be related to clock stretching */
325 		dprintk(0,
326 			"write to i2c device at 0x%x timed out (status=%i)\n",
327 			addr, ret);
328 		return -ETIMEDOUT;
329 	}
330 
331 	dev_warn(&dev->intf->dev,
332 		 "write to i2c device at 0x%x failed with unknown error (status=%i)\n",
333 		 addr, ret);
334 	return -EIO;
335 }
336 
337 /*
338  * em28xx_i2c_check_for_device()
339  * check if there is a i2c_device at the supplied address
340  */
341 static int em28xx_i2c_check_for_device(struct em28xx *dev, u16 addr)
342 {
343 	int ret;
344 	u8 buf;
345 
346 	ret = em28xx_i2c_recv_bytes(dev, addr, &buf, 1);
347 	if (ret == 1)
348 		return 0;
349 	return (ret < 0) ? ret : -EIO;
350 }
351 
352 /*
353  * em25xx_bus_B_send_bytes
354  * write bytes to the i2c device
355  */
356 static int em25xx_bus_B_send_bytes(struct em28xx *dev, u16 addr, u8 *buf,
357 				   u16 len)
358 {
359 	int ret;
360 
361 	if (len < 1 || len > 64)
362 		return -EOPNOTSUPP;
363 	/*
364 	 * NOTE: limited by the USB ctrl message constraints
365 	 * Zero length reads always succeed, even if no device is connected
366 	 */
367 
368 	/* Set register and write value */
369 	ret = dev->em28xx_write_regs_req(dev, 0x06, addr, buf, len);
370 	if (ret != len) {
371 		if (ret < 0) {
372 			dev_warn(&dev->intf->dev,
373 				 "writing to i2c device at 0x%x failed (error=%i)\n",
374 				 addr, ret);
375 			return ret;
376 		}
377 
378 		dev_warn(&dev->intf->dev,
379 			 "%i bytes write to i2c device at 0x%x requested, but %i bytes written\n",
380 			 len, addr, ret);
381 		return -EIO;
382 	}
383 	/* Check success */
384 	ret = dev->em28xx_read_reg_req(dev, 0x08, 0x0000);
385 	/*
386 	 * NOTE: the only error we've seen so far is
387 	 * 0x01 when the slave device is not present
388 	 */
389 	if (!ret)
390 		return len;
391 
392 	if (ret > 0) {
393 		dprintk(1, "Bus B R08 returned 0x%02x: I2C ACK error\n", ret);
394 		return -ENXIO;
395 	}
396 
397 	return ret;
398 	/*
399 	 * NOTE: With chip types (other chip IDs) which actually don't support
400 	 * this operation, it seems to succeed ALWAYS ! (even if there is no
401 	 * slave device or even no second i2c bus provided)
402 	 */
403 }
404 
405 /*
406  * em25xx_bus_B_recv_bytes
407  * read bytes from the i2c device
408  */
409 static int em25xx_bus_B_recv_bytes(struct em28xx *dev, u16 addr, u8 *buf,
410 				   u16 len)
411 {
412 	int ret;
413 
414 	if (len < 1 || len > 64)
415 		return -EOPNOTSUPP;
416 	/*
417 	 * NOTE: limited by the USB ctrl message constraints
418 	 * Zero length reads always succeed, even if no device is connected
419 	 */
420 
421 	/* Read value */
422 	ret = dev->em28xx_read_reg_req_len(dev, 0x06, addr, buf, len);
423 	if (ret < 0) {
424 		dev_warn(&dev->intf->dev,
425 			 "reading from i2c device at 0x%x failed (error=%i)\n",
426 			 addr, ret);
427 		return ret;
428 	}
429 	/*
430 	 * NOTE: some devices with two i2c buses have the bad habit to return 0
431 	 * bytes if we are on bus B AND there was no write attempt to the
432 	 * specified slave address before AND no device is present at the
433 	 * requested slave address.
434 	 * Anyway, the next check will fail with -ENXIO in this case, so avoid
435 	 * spamming the system log on device probing and do nothing here.
436 	 */
437 
438 	/* Check success */
439 	ret = dev->em28xx_read_reg_req(dev, 0x08, 0x0000);
440 	/*
441 	 * NOTE: the only error we've seen so far is
442 	 * 0x01 when the slave device is not present
443 	 */
444 	if (!ret)
445 		return len;
446 
447 	if (ret > 0) {
448 		dprintk(1, "Bus B R08 returned 0x%02x: I2C ACK error\n", ret);
449 		return -ENXIO;
450 	}
451 
452 	return ret;
453 	/*
454 	 * NOTE: With chip types (other chip IDs) which actually don't support
455 	 * this operation, it seems to succeed ALWAYS ! (even if there is no
456 	 * slave device or even no second i2c bus provided)
457 	 */
458 }
459 
460 /*
461  * em25xx_bus_B_check_for_device()
462  * check if there is a i2c device at the supplied address
463  */
464 static int em25xx_bus_B_check_for_device(struct em28xx *dev, u16 addr)
465 {
466 	u8 buf;
467 	int ret;
468 
469 	ret = em25xx_bus_B_recv_bytes(dev, addr, &buf, 1);
470 	if (ret < 0)
471 		return ret;
472 
473 	return 0;
474 	/*
475 	 * NOTE: With chips which do not support this operation,
476 	 * it seems to succeed ALWAYS ! (even if no device connected)
477 	 */
478 }
479 
480 static inline int i2c_check_for_device(struct em28xx_i2c_bus *i2c_bus, u16 addr)
481 {
482 	struct em28xx *dev = i2c_bus->dev;
483 	int rc = -EOPNOTSUPP;
484 
485 	if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX)
486 		rc = em28xx_i2c_check_for_device(dev, addr);
487 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM2800)
488 		rc = em2800_i2c_check_for_device(dev, addr);
489 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM25XX_BUS_B)
490 		rc = em25xx_bus_B_check_for_device(dev, addr);
491 	return rc;
492 }
493 
494 static inline int i2c_recv_bytes(struct em28xx_i2c_bus *i2c_bus,
495 				 struct i2c_msg msg)
496 {
497 	struct em28xx *dev = i2c_bus->dev;
498 	u16 addr = msg.addr << 1;
499 	int rc = -EOPNOTSUPP;
500 
501 	if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX)
502 		rc = em28xx_i2c_recv_bytes(dev, addr, msg.buf, msg.len);
503 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM2800)
504 		rc = em2800_i2c_recv_bytes(dev, addr, msg.buf, msg.len);
505 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM25XX_BUS_B)
506 		rc = em25xx_bus_B_recv_bytes(dev, addr, msg.buf, msg.len);
507 	return rc;
508 }
509 
510 static inline int i2c_send_bytes(struct em28xx_i2c_bus *i2c_bus,
511 				 struct i2c_msg msg, int stop)
512 {
513 	struct em28xx *dev = i2c_bus->dev;
514 	u16 addr = msg.addr << 1;
515 	int rc = -EOPNOTSUPP;
516 
517 	if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX)
518 		rc = em28xx_i2c_send_bytes(dev, addr, msg.buf, msg.len, stop);
519 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM2800)
520 		rc = em2800_i2c_send_bytes(dev, addr, msg.buf, msg.len);
521 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM25XX_BUS_B)
522 		rc = em25xx_bus_B_send_bytes(dev, addr, msg.buf, msg.len);
523 	return rc;
524 }
525 
526 /*
527  * em28xx_i2c_xfer()
528  * the main i2c transfer function
529  */
530 static int em28xx_i2c_xfer(struct i2c_adapter *i2c_adap,
531 			   struct i2c_msg msgs[], int num)
532 {
533 	struct em28xx_i2c_bus *i2c_bus = i2c_adap->algo_data;
534 	struct em28xx *dev = i2c_bus->dev;
535 	unsigned int bus = i2c_bus->bus;
536 	int addr, rc, i;
537 	u8 reg;
538 
539 	/*
540 	 * prevent i2c xfer attempts after device is disconnected
541 	 * some fe's try to do i2c writes/reads from their release
542 	 * interfaces when called in disconnect path
543 	 */
544 	if (dev->disconnected)
545 		return -ENODEV;
546 
547 	if (!rt_mutex_trylock(&dev->i2c_bus_lock))
548 		return -EAGAIN;
549 
550 	/* Switch I2C bus if needed */
551 	if (bus != dev->cur_i2c_bus &&
552 	    i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX) {
553 		if (bus == 1)
554 			reg = EM2874_I2C_SECONDARY_BUS_SELECT;
555 		else
556 			reg = 0;
557 		em28xx_write_reg_bits(dev, EM28XX_R06_I2C_CLK, reg,
558 				      EM2874_I2C_SECONDARY_BUS_SELECT);
559 		dev->cur_i2c_bus = bus;
560 	}
561 
562 	for (i = 0; i < num; i++) {
563 		addr = msgs[i].addr << 1;
564 		if (!msgs[i].len) {
565 			/*
566 			 * no len: check only for device presence
567 			 * This code is only called during device probe.
568 			 */
569 			rc = i2c_check_for_device(i2c_bus, addr);
570 
571 			if (rc == -ENXIO)
572 				rc = -ENODEV;
573 		} else if (msgs[i].flags & I2C_M_RD) {
574 			/* read bytes */
575 			rc = i2c_recv_bytes(i2c_bus, msgs[i]);
576 		} else {
577 			/* write bytes */
578 			rc = i2c_send_bytes(i2c_bus, msgs[i], i == num - 1);
579 		}
580 
581 		if (rc < 0)
582 			goto error;
583 
584 		dprintk(2, "%s %s addr=%02x len=%d: %*ph\n",
585 			(msgs[i].flags & I2C_M_RD) ? "read" : "write",
586 			i == num - 1 ? "stop" : "nonstop",
587 			addr, msgs[i].len,
588 			msgs[i].len, msgs[i].buf);
589 	}
590 
591 	rt_mutex_unlock(&dev->i2c_bus_lock);
592 	return num;
593 
594 error:
595 	dprintk(2, "%s %s addr=%02x len=%d: %sERROR: %i\n",
596 		(msgs[i].flags & I2C_M_RD) ? "read" : "write",
597 		i == num - 1 ? "stop" : "nonstop",
598 		addr, msgs[i].len,
599 		(rc == -ENODEV) ? "no device " : "",
600 		rc);
601 
602 	rt_mutex_unlock(&dev->i2c_bus_lock);
603 	return rc;
604 }
605 
606 /*
607  * based on linux/sunrpc/svcauth.h and linux/hash.h
608  * The original hash function returns a different value, if arch is x86_64
609  * or i386.
610  */
611 static inline unsigned long em28xx_hash_mem(char *buf, int length, int bits)
612 {
613 	unsigned long hash = 0;
614 	unsigned long l = 0;
615 	int len = 0;
616 	unsigned char c;
617 
618 	do {
619 		if (len == length) {
620 			c = (char)len;
621 			len = -1;
622 		} else {
623 			c = *buf++;
624 		}
625 		l = (l << 8) | c;
626 		len++;
627 		if ((len & (32 / 8 - 1)) == 0)
628 			hash = ((hash ^ l) * 0x9e370001UL);
629 	} while (len);
630 
631 	return (hash >> (32 - bits)) & 0xffffffffUL;
632 }
633 
634 /*
635  * Helper function to read data blocks from i2c clients with 8 or 16 bit
636  * address width, 8 bit register width and auto incrementation been activated
637  */
638 static int em28xx_i2c_read_block(struct em28xx *dev, unsigned int bus, u16 addr,
639 				 bool addr_w16, u16 len, u8 *data)
640 {
641 	int remain = len, rsize, rsize_max, ret;
642 	u8 buf[2];
643 
644 	/* Sanity check */
645 	if (addr + remain > (addr_w16 * 0xff00 + 0xff + 1))
646 		return -EINVAL;
647 	/* Select address */
648 	buf[0] = addr >> 8;
649 	buf[1] = addr & 0xff;
650 	ret = i2c_master_send(&dev->i2c_client[bus],
651 			      buf + !addr_w16, 1 + addr_w16);
652 	if (ret < 0)
653 		return ret;
654 	/* Read data */
655 	if (dev->board.is_em2800)
656 		rsize_max = 4;
657 	else
658 		rsize_max = 64;
659 	while (remain > 0) {
660 		if (remain > rsize_max)
661 			rsize = rsize_max;
662 		else
663 			rsize = remain;
664 
665 		ret = i2c_master_recv(&dev->i2c_client[bus], data, rsize);
666 		if (ret < 0)
667 			return ret;
668 
669 		remain -= rsize;
670 		data += rsize;
671 	}
672 
673 	return len;
674 }
675 
676 static int em28xx_i2c_eeprom(struct em28xx *dev, unsigned int bus,
677 			     u8 **eedata, u16 *eedata_len)
678 {
679 	const u16 len = 256;
680 	/*
681 	 * FIXME common length/size for bytes to read, to display, hash
682 	 * calculation and returned device dataset. Simplifies the code a lot,
683 	 * but we might have to deal with multiple sizes in the future !
684 	 */
685 	int err;
686 	struct em28xx_eeprom *dev_config;
687 	u8 buf, *data;
688 
689 	*eedata = NULL;
690 	*eedata_len = 0;
691 
692 	/* EEPROM is always on i2c bus 0 on all known devices. */
693 
694 	dev->i2c_client[bus].addr = 0xa0 >> 1;
695 
696 	/* Check if board has eeprom */
697 	err = i2c_master_recv(&dev->i2c_client[bus], &buf, 0);
698 	if (err < 0) {
699 		dev_info(&dev->intf->dev, "board has no eeprom\n");
700 		return -ENODEV;
701 	}
702 
703 	data = kzalloc(len, GFP_KERNEL);
704 	if (!data)
705 		return -ENOMEM;
706 
707 	/* Read EEPROM content */
708 	err = em28xx_i2c_read_block(dev, bus, 0x0000,
709 				    dev->eeprom_addrwidth_16bit,
710 				    len, data);
711 	if (err != len) {
712 		dev_err(&dev->intf->dev,
713 			"failed to read eeprom (err=%d)\n", err);
714 		goto error;
715 	}
716 
717 	if (i2c_debug) {
718 		/* Display eeprom content */
719 		print_hex_dump(KERN_DEBUG, "em28xx eeprom ", DUMP_PREFIX_OFFSET,
720 			       16, 1, data, len, true);
721 
722 		if (dev->eeprom_addrwidth_16bit)
723 			dev_info(&dev->intf->dev,
724 				 "eeprom %06x: ... (skipped)\n", 256);
725 	}
726 
727 	if (dev->eeprom_addrwidth_16bit &&
728 	    data[0] == 0x26 && data[3] == 0x00) {
729 		/* new eeprom format; size 4-64kb */
730 		u16 mc_start;
731 		u16 hwconf_offset;
732 
733 		dev->hash = em28xx_hash_mem(data, len, 32);
734 		mc_start = (data[1] << 8) + 4;	/* usually 0x0004 */
735 
736 		dev_info(&dev->intf->dev,
737 			 "EEPROM ID = %4ph, EEPROM hash = 0x%08lx\n",
738 			 data, dev->hash);
739 		dev_info(&dev->intf->dev,
740 			 "EEPROM info:\n");
741 		dev_info(&dev->intf->dev,
742 			 "\tmicrocode start address = 0x%04x, boot configuration = 0x%02x\n",
743 			 mc_start, data[2]);
744 		/*
745 		 * boot configuration (address 0x0002):
746 		 * [0]   microcode download speed: 1 = 400 kHz; 0 = 100 kHz
747 		 * [1]   always selects 12 kb RAM
748 		 * [2]   USB device speed: 1 = force Full Speed; 0 = auto detect
749 		 * [4]   1 = force fast mode and no suspend for device testing
750 		 * [5:7] USB PHY tuning registers; determined by device
751 		 *       characterization
752 		 */
753 
754 		/*
755 		 * Read hardware config dataset offset from address
756 		 * (microcode start + 46)
757 		 */
758 		err = em28xx_i2c_read_block(dev, bus, mc_start + 46, 1, 2,
759 					    data);
760 		if (err != 2) {
761 			dev_err(&dev->intf->dev,
762 				"failed to read hardware configuration data from eeprom (err=%d)\n",
763 				err);
764 			goto error;
765 		}
766 
767 		/* Calculate hardware config dataset start address */
768 		hwconf_offset = mc_start + data[0] + (data[1] << 8);
769 
770 		/* Read hardware config dataset */
771 		/*
772 		 * NOTE: the microcode copy can be multiple pages long, but
773 		 * we assume the hardware config dataset is the same as in
774 		 * the old eeprom and not longer than 256 bytes.
775 		 * tveeprom is currently also limited to 256 bytes.
776 		 */
777 		err = em28xx_i2c_read_block(dev, bus, hwconf_offset, 1, len,
778 					    data);
779 		if (err != len) {
780 			dev_err(&dev->intf->dev,
781 				"failed to read hardware configuration data from eeprom (err=%d)\n",
782 				err);
783 			goto error;
784 		}
785 
786 		/* Verify hardware config dataset */
787 		/* NOTE: not all devices provide this type of dataset */
788 		if (data[0] != 0x1a || data[1] != 0xeb ||
789 		    data[2] != 0x67 || data[3] != 0x95) {
790 			dev_info(&dev->intf->dev,
791 				 "\tno hardware configuration dataset found in eeprom\n");
792 			kfree(data);
793 			return 0;
794 		}
795 
796 		/*
797 		 * TODO: decrypt eeprom data for camera bridges
798 		 * (em25xx, em276x+)
799 		 */
800 
801 	} else if (!dev->eeprom_addrwidth_16bit &&
802 		   data[0] == 0x1a && data[1] == 0xeb &&
803 		   data[2] == 0x67 && data[3] == 0x95) {
804 		dev->hash = em28xx_hash_mem(data, len, 32);
805 		dev_info(&dev->intf->dev,
806 			 "EEPROM ID = %4ph, EEPROM hash = 0x%08lx\n",
807 			 data, dev->hash);
808 		dev_info(&dev->intf->dev,
809 			 "EEPROM info:\n");
810 	} else {
811 		dev_info(&dev->intf->dev,
812 			 "unknown eeprom format or eeprom corrupted !\n");
813 		err = -ENODEV;
814 		goto error;
815 	}
816 
817 	*eedata = data;
818 	*eedata_len = len;
819 	dev_config = (void *)*eedata;
820 
821 	switch (le16_to_cpu(dev_config->chip_conf) >> 4 & 0x3) {
822 	case 0:
823 		dev_info(&dev->intf->dev, "\tNo audio on board.\n");
824 		break;
825 	case 1:
826 		dev_info(&dev->intf->dev, "\tAC97 audio (5 sample rates)\n");
827 		break;
828 	case 2:
829 		if (dev->chip_id < CHIP_ID_EM2860)
830 			dev_info(&dev->intf->dev,
831 				 "\tI2S audio, sample rate=32k\n");
832 		else
833 			dev_info(&dev->intf->dev,
834 				 "\tI2S audio, 3 sample rates\n");
835 		break;
836 	case 3:
837 		if (dev->chip_id < CHIP_ID_EM2860)
838 			dev_info(&dev->intf->dev,
839 				 "\tI2S audio, 3 sample rates\n");
840 		else
841 			dev_info(&dev->intf->dev,
842 				 "\tI2S audio, 5 sample rates\n");
843 		break;
844 	}
845 
846 	if (le16_to_cpu(dev_config->chip_conf) & 1 << 3)
847 		dev_info(&dev->intf->dev, "\tUSB Remote wakeup capable\n");
848 
849 	if (le16_to_cpu(dev_config->chip_conf) & 1 << 2)
850 		dev_info(&dev->intf->dev, "\tUSB Self power capable\n");
851 
852 	switch (le16_to_cpu(dev_config->chip_conf) & 0x3) {
853 	case 0:
854 		dev_info(&dev->intf->dev, "\t500mA max power\n");
855 		break;
856 	case 1:
857 		dev_info(&dev->intf->dev, "\t400mA max power\n");
858 		break;
859 	case 2:
860 		dev_info(&dev->intf->dev, "\t300mA max power\n");
861 		break;
862 	case 3:
863 		dev_info(&dev->intf->dev, "\t200mA max power\n");
864 		break;
865 	}
866 	dev_info(&dev->intf->dev,
867 		 "\tTable at offset 0x%02x, strings=0x%04x, 0x%04x, 0x%04x\n",
868 		 dev_config->string_idx_table,
869 		 le16_to_cpu(dev_config->string1),
870 		 le16_to_cpu(dev_config->string2),
871 		 le16_to_cpu(dev_config->string3));
872 
873 	return 0;
874 
875 error:
876 	kfree(data);
877 	return err;
878 }
879 
880 /* ----------------------------------------------------------- */
881 
882 /*
883  * functionality()
884  */
885 static u32 functionality(struct i2c_adapter *i2c_adap)
886 {
887 	struct em28xx_i2c_bus *i2c_bus = i2c_adap->algo_data;
888 
889 	if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX ||
890 	    i2c_bus->algo_type == EM28XX_I2C_ALGO_EM25XX_BUS_B) {
891 		return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
892 	} else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM2800)  {
893 		return (I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL) &
894 			~I2C_FUNC_SMBUS_WRITE_BLOCK_DATA;
895 	}
896 
897 	WARN(1, "Unknown i2c bus algorithm.\n");
898 	return 0;
899 }
900 
901 static const struct i2c_algorithm em28xx_algo = {
902 	.master_xfer   = em28xx_i2c_xfer,
903 	.functionality = functionality,
904 };
905 
906 static const struct i2c_adapter em28xx_adap_template = {
907 	.owner = THIS_MODULE,
908 	.name = "em28xx",
909 	.algo = &em28xx_algo,
910 };
911 
912 static const struct i2c_client em28xx_client_template = {
913 	.name = "em28xx internal",
914 };
915 
916 /* ----------------------------------------------------------- */
917 
918 /*
919  * i2c_devs
920  * incomplete list of known devices
921  */
922 static char *i2c_devs[128] = {
923 	[0x1c >> 1] = "lgdt330x",
924 	[0x3e >> 1] = "remote IR sensor",
925 	[0x4a >> 1] = "saa7113h",
926 	[0x52 >> 1] = "drxk",
927 	[0x60 >> 1] = "remote IR sensor",
928 	[0x8e >> 1] = "remote IR sensor",
929 	[0x86 >> 1] = "tda9887",
930 	[0x80 >> 1] = "msp34xx",
931 	[0x88 >> 1] = "msp34xx",
932 	[0xa0 >> 1] = "eeprom",
933 	[0xb0 >> 1] = "tda9874",
934 	[0xb8 >> 1] = "tvp5150a",
935 	[0xba >> 1] = "webcam sensor or tvp5150a",
936 	[0xc0 >> 1] = "tuner (analog)",
937 	[0xc2 >> 1] = "tuner (analog)",
938 	[0xc4 >> 1] = "tuner (analog)",
939 	[0xc6 >> 1] = "tuner (analog)",
940 };
941 
942 /*
943  * do_i2c_scan()
944  * check i2c address range for devices
945  */
946 void em28xx_do_i2c_scan(struct em28xx *dev, unsigned int bus)
947 {
948 	u8 i2c_devicelist[128];
949 	unsigned char buf;
950 	int i, rc;
951 
952 	memset(i2c_devicelist, 0, sizeof(i2c_devicelist));
953 
954 	for (i = 0; i < ARRAY_SIZE(i2c_devs); i++) {
955 		dev->i2c_client[bus].addr = i;
956 		rc = i2c_master_recv(&dev->i2c_client[bus], &buf, 0);
957 		if (rc < 0)
958 			continue;
959 		i2c_devicelist[i] = i;
960 		dev_info(&dev->intf->dev,
961 			 "found i2c device @ 0x%x on bus %d [%s]\n",
962 			 i << 1, bus, i2c_devs[i] ? i2c_devs[i] : "???");
963 	}
964 
965 	if (bus == dev->def_i2c_bus)
966 		dev->i2c_hash = em28xx_hash_mem(i2c_devicelist,
967 						sizeof(i2c_devicelist), 32);
968 }
969 
970 /*
971  * em28xx_i2c_register()
972  * register i2c bus
973  */
974 int em28xx_i2c_register(struct em28xx *dev, unsigned int bus,
975 			enum em28xx_i2c_algo_type algo_type)
976 {
977 	int retval;
978 
979 	if (WARN_ON(!dev->em28xx_write_regs || !dev->em28xx_read_reg ||
980 		    !dev->em28xx_write_regs_req || !dev->em28xx_read_reg_req))
981 		return -ENODEV;
982 
983 	if (bus >= NUM_I2C_BUSES)
984 		return -ENODEV;
985 
986 	dev->i2c_adap[bus] = em28xx_adap_template;
987 	dev->i2c_adap[bus].dev.parent = &dev->intf->dev;
988 	strscpy(dev->i2c_adap[bus].name, dev_name(&dev->intf->dev),
989 		sizeof(dev->i2c_adap[bus].name));
990 
991 	dev->i2c_bus[bus].bus = bus;
992 	dev->i2c_bus[bus].algo_type = algo_type;
993 	dev->i2c_bus[bus].dev = dev;
994 	dev->i2c_adap[bus].algo_data = &dev->i2c_bus[bus];
995 
996 	retval = i2c_add_adapter(&dev->i2c_adap[bus]);
997 	if (retval < 0) {
998 		dev_err(&dev->intf->dev,
999 			"%s: i2c_add_adapter failed! retval [%d]\n",
1000 			__func__, retval);
1001 		return retval;
1002 	}
1003 
1004 	dev->i2c_client[bus] = em28xx_client_template;
1005 	dev->i2c_client[bus].adapter = &dev->i2c_adap[bus];
1006 
1007 	/* Up to now, all eeproms are at bus 0 */
1008 	if (!bus) {
1009 		retval = em28xx_i2c_eeprom(dev, bus,
1010 					   &dev->eedata, &dev->eedata_len);
1011 		if (retval < 0 && retval != -ENODEV) {
1012 			dev_err(&dev->intf->dev,
1013 				"%s: em28xx_i2_eeprom failed! retval [%d]\n",
1014 				__func__, retval);
1015 		}
1016 	}
1017 
1018 	if (i2c_scan)
1019 		em28xx_do_i2c_scan(dev, bus);
1020 
1021 	return 0;
1022 }
1023 
1024 /*
1025  * em28xx_i2c_unregister()
1026  * unregister i2c_bus
1027  */
1028 int em28xx_i2c_unregister(struct em28xx *dev, unsigned int bus)
1029 {
1030 	if (bus >= NUM_I2C_BUSES)
1031 		return -ENODEV;
1032 
1033 	i2c_del_adapter(&dev->i2c_adap[bus]);
1034 	return 0;
1035 }
1036