1 // SPDX-License-Identifier: GPL-2.0+
2 //
3 // em28xx-i2c.c - driver for Empia EM2800/EM2820/2840 USB video capture devices
4 //
5 // Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
6 //		      Markus Rechberger <mrechberger@gmail.com>
7 //		      Mauro Carvalho Chehab <mchehab@kernel.org>
8 //		      Sascha Sommer <saschasommer@freenet.de>
9 // Copyright (C) 2013 Frank Schäfer <fschaefer.oss@googlemail.com>
10 //
11 // This program is free software; you can redistribute it and/or modify
12 // it under the terms of the GNU General Public License as published by
13 // the Free Software Foundation; either version 2 of the License, or
14 // (at your option) any later version.
15 //
16 // This program is distributed in the hope that it will be useful,
17 // but WITHOUT ANY WARRANTY; without even the implied warranty of
18 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19 // GNU General Public License for more details.
20 
21 #include "em28xx.h"
22 
23 #include <linux/module.h>
24 #include <linux/kernel.h>
25 #include <linux/usb.h>
26 #include <linux/i2c.h>
27 #include <linux/jiffies.h>
28 
29 #include "xc2028.h"
30 #include <media/v4l2-common.h>
31 #include <media/tuner.h>
32 
33 /* ----------------------------------------------------------- */
34 
35 static unsigned int i2c_scan;
36 module_param(i2c_scan, int, 0444);
37 MODULE_PARM_DESC(i2c_scan, "scan i2c bus at insmod time");
38 
39 static unsigned int i2c_debug;
40 module_param(i2c_debug, int, 0644);
41 MODULE_PARM_DESC(i2c_debug, "i2c debug message level (1: normal debug, 2: show I2C transfers)");
42 
43 #define dprintk(level, fmt, arg...) do {				\
44 	if (i2c_debug > level)						\
45 		dev_printk(KERN_DEBUG, &dev->intf->dev,			\
46 			   "i2c: %s: " fmt, __func__, ## arg);		\
47 } while (0)
48 
49 /*
50  * Time in msecs to wait for i2c xfers to finish.
51  * 35ms is the maximum time a SMBUS device could wait when
52  * clock stretching is used. As the transfer itself will take
53  * some time to happen, set it to 35 ms.
54  *
55  * Ok, I2C doesn't specify any limit. So, eventually, we may need
56  * to increase this timeout.
57  */
58 #define EM28XX_I2C_XFER_TIMEOUT         35 /* ms */
59 
60 static int em28xx_i2c_timeout(struct em28xx *dev)
61 {
62 	int time = EM28XX_I2C_XFER_TIMEOUT;
63 
64 	switch (dev->i2c_speed & 0x03) {
65 	case EM28XX_I2C_FREQ_25_KHZ:
66 		time += 4;		/* Assume 4 ms for transfers */
67 		break;
68 	case EM28XX_I2C_FREQ_100_KHZ:
69 	case EM28XX_I2C_FREQ_400_KHZ:
70 		time += 1;		/* Assume 1 ms for transfers */
71 		break;
72 	default: /* EM28XX_I2C_FREQ_1_5_MHZ */
73 		break;
74 	}
75 
76 	return msecs_to_jiffies(time);
77 }
78 
79 /*
80  * em2800_i2c_send_bytes()
81  * send up to 4 bytes to the em2800 i2c device
82  */
83 static int em2800_i2c_send_bytes(struct em28xx *dev, u8 addr, u8 *buf, u16 len)
84 {
85 	unsigned long timeout = jiffies + em28xx_i2c_timeout(dev);
86 	int ret;
87 	u8 b2[6];
88 
89 	if (len < 1 || len > 4)
90 		return -EOPNOTSUPP;
91 
92 	b2[5] = 0x80 + len - 1;
93 	b2[4] = addr;
94 	b2[3] = buf[0];
95 	if (len > 1)
96 		b2[2] = buf[1];
97 	if (len > 2)
98 		b2[1] = buf[2];
99 	if (len > 3)
100 		b2[0] = buf[3];
101 
102 	/* trigger write */
103 	ret = dev->em28xx_write_regs(dev, 4 - len, &b2[4 - len], 2 + len);
104 	if (ret != 2 + len) {
105 		dev_warn(&dev->intf->dev,
106 			 "failed to trigger write to i2c address 0x%x (error=%i)\n",
107 			    addr, ret);
108 		return (ret < 0) ? ret : -EIO;
109 	}
110 	/* wait for completion */
111 	while (time_is_after_jiffies(timeout)) {
112 		ret = dev->em28xx_read_reg(dev, 0x05);
113 		if (ret == 0x80 + len - 1)
114 			return len;
115 		if (ret == 0x94 + len - 1) {
116 			dprintk(1, "R05 returned 0x%02x: I2C ACK error\n", ret);
117 			return -ENXIO;
118 		}
119 		if (ret < 0) {
120 			dev_warn(&dev->intf->dev,
121 				 "failed to get i2c transfer status from bridge register (error=%i)\n",
122 				ret);
123 			return ret;
124 		}
125 		usleep_range(5000, 6000);
126 	}
127 	dprintk(0, "write to i2c device at 0x%x timed out\n", addr);
128 	return -ETIMEDOUT;
129 }
130 
131 /*
132  * em2800_i2c_recv_bytes()
133  * read up to 4 bytes from the em2800 i2c device
134  */
135 static int em2800_i2c_recv_bytes(struct em28xx *dev, u8 addr, u8 *buf, u16 len)
136 {
137 	unsigned long timeout = jiffies + em28xx_i2c_timeout(dev);
138 	u8 buf2[4];
139 	int ret;
140 	int i;
141 
142 	if (len < 1 || len > 4)
143 		return -EOPNOTSUPP;
144 
145 	/* trigger read */
146 	buf2[1] = 0x84 + len - 1;
147 	buf2[0] = addr;
148 	ret = dev->em28xx_write_regs(dev, 0x04, buf2, 2);
149 	if (ret != 2) {
150 		dev_warn(&dev->intf->dev,
151 			 "failed to trigger read from i2c address 0x%x (error=%i)\n",
152 			 addr, ret);
153 		return (ret < 0) ? ret : -EIO;
154 	}
155 
156 	/* wait for completion */
157 	while (time_is_after_jiffies(timeout)) {
158 		ret = dev->em28xx_read_reg(dev, 0x05);
159 		if (ret == 0x84 + len - 1)
160 			break;
161 		if (ret == 0x94 + len - 1) {
162 			dprintk(1, "R05 returned 0x%02x: I2C ACK error\n",
163 				ret);
164 			return -ENXIO;
165 		}
166 		if (ret < 0) {
167 			dev_warn(&dev->intf->dev,
168 				 "failed to get i2c transfer status from bridge register (error=%i)\n",
169 				 ret);
170 			return ret;
171 		}
172 		usleep_range(5000, 6000);
173 	}
174 	if (ret != 0x84 + len - 1)
175 		dprintk(0, "read from i2c device at 0x%x timed out\n", addr);
176 
177 	/* get the received message */
178 	ret = dev->em28xx_read_reg_req_len(dev, 0x00, 4 - len, buf2, len);
179 	if (ret != len) {
180 		dev_warn(&dev->intf->dev,
181 			 "reading from i2c device at 0x%x failed: couldn't get the received message from the bridge (error=%i)\n",
182 			 addr, ret);
183 		return (ret < 0) ? ret : -EIO;
184 	}
185 	for (i = 0; i < len; i++)
186 		buf[i] = buf2[len - 1 - i];
187 
188 	return ret;
189 }
190 
191 /*
192  * em2800_i2c_check_for_device()
193  * check if there is an i2c device at the supplied address
194  */
195 static int em2800_i2c_check_for_device(struct em28xx *dev, u8 addr)
196 {
197 	u8 buf;
198 	int ret;
199 
200 	ret = em2800_i2c_recv_bytes(dev, addr, &buf, 1);
201 	if (ret == 1)
202 		return 0;
203 	return (ret < 0) ? ret : -EIO;
204 }
205 
206 /*
207  * em28xx_i2c_send_bytes()
208  */
209 static int em28xx_i2c_send_bytes(struct em28xx *dev, u16 addr, u8 *buf,
210 				 u16 len, int stop)
211 {
212 	unsigned long timeout = jiffies + em28xx_i2c_timeout(dev);
213 	int ret;
214 
215 	if (len < 1 || len > 64)
216 		return -EOPNOTSUPP;
217 	/*
218 	 * NOTE: limited by the USB ctrl message constraints
219 	 * Zero length reads always succeed, even if no device is connected
220 	 */
221 
222 	/* Write to i2c device */
223 	ret = dev->em28xx_write_regs_req(dev, stop ? 2 : 3, addr, buf, len);
224 	if (ret != len) {
225 		if (ret < 0) {
226 			dev_warn(&dev->intf->dev,
227 				 "writing to i2c device at 0x%x failed (error=%i)\n",
228 				 addr, ret);
229 			return ret;
230 		}
231 		dev_warn(&dev->intf->dev,
232 			 "%i bytes write to i2c device at 0x%x requested, but %i bytes written\n",
233 				len, addr, ret);
234 		return -EIO;
235 	}
236 
237 	/* wait for completion */
238 	while (time_is_after_jiffies(timeout)) {
239 		ret = dev->em28xx_read_reg(dev, 0x05);
240 		if (ret == 0) /* success */
241 			return len;
242 		if (ret == 0x10) {
243 			dprintk(1, "I2C ACK error on writing to addr 0x%02x\n",
244 				addr);
245 			return -ENXIO;
246 		}
247 		if (ret < 0) {
248 			dev_warn(&dev->intf->dev,
249 				 "failed to get i2c transfer status from bridge register (error=%i)\n",
250 				 ret);
251 			return ret;
252 		}
253 		usleep_range(5000, 6000);
254 		/*
255 		 * NOTE: do we really have to wait for success ?
256 		 * Never seen anything else than 0x00 or 0x10
257 		 * (even with high payload) ...
258 		 */
259 	}
260 
261 	if (ret == 0x02 || ret == 0x04) {
262 		/* NOTE: these errors seem to be related to clock stretching */
263 		dprintk(0,
264 			"write to i2c device at 0x%x timed out (status=%i)\n",
265 			addr, ret);
266 		return -ETIMEDOUT;
267 	}
268 
269 	dev_warn(&dev->intf->dev,
270 		 "write to i2c device at 0x%x failed with unknown error (status=%i)\n",
271 		 addr, ret);
272 	return -EIO;
273 }
274 
275 /*
276  * em28xx_i2c_recv_bytes()
277  * read a byte from the i2c device
278  */
279 static int em28xx_i2c_recv_bytes(struct em28xx *dev, u16 addr, u8 *buf, u16 len)
280 {
281 	int ret;
282 
283 	if (len < 1 || len > 64)
284 		return -EOPNOTSUPP;
285 	/*
286 	 * NOTE: limited by the USB ctrl message constraints
287 	 * Zero length reads always succeed, even if no device is connected
288 	 */
289 
290 	/* Read data from i2c device */
291 	ret = dev->em28xx_read_reg_req_len(dev, 2, addr, buf, len);
292 	if (ret < 0) {
293 		dev_warn(&dev->intf->dev,
294 			 "reading from i2c device at 0x%x failed (error=%i)\n",
295 			 addr, ret);
296 		return ret;
297 	} else if (ret != len) {
298 		dev_dbg(&dev->intf->dev,
299 			"%i bytes read from i2c device at 0x%x requested, but %i bytes written\n",
300 				ret, addr, len);
301 	}
302 	/*
303 	 * NOTE: some devices with two i2c buses have the bad habit to return 0
304 	 * bytes if we are on bus B AND there was no write attempt to the
305 	 * specified slave address before AND no device is present at the
306 	 * requested slave address.
307 	 * Anyway, the next check will fail with -ENXIO in this case, so avoid
308 	 * spamming the system log on device probing and do nothing here.
309 	 */
310 
311 	/* Check success of the i2c operation */
312 	ret = dev->em28xx_read_reg(dev, 0x05);
313 	if (ret == 0) /* success */
314 		return len;
315 	if (ret < 0) {
316 		dev_warn(&dev->intf->dev,
317 			 "failed to get i2c transfer status from bridge register (error=%i)\n",
318 			 ret);
319 		return ret;
320 	}
321 	if (ret == 0x10) {
322 		dprintk(1, "I2C ACK error on writing to addr 0x%02x\n",
323 			addr);
324 		return -ENXIO;
325 	}
326 
327 	if (ret == 0x02 || ret == 0x04) {
328 		/* NOTE: these errors seem to be related to clock stretching */
329 		dprintk(0,
330 			"write to i2c device at 0x%x timed out (status=%i)\n",
331 			addr, ret);
332 		return -ETIMEDOUT;
333 	}
334 
335 	dev_warn(&dev->intf->dev,
336 		 "read from i2c device at 0x%x failed with unknown error (status=%i)\n",
337 		 addr, ret);
338 	return -EIO;
339 }
340 
341 /*
342  * em28xx_i2c_check_for_device()
343  * check if there is a i2c_device at the supplied address
344  */
345 static int em28xx_i2c_check_for_device(struct em28xx *dev, u16 addr)
346 {
347 	int ret;
348 	u8 buf;
349 
350 	ret = em28xx_i2c_recv_bytes(dev, addr, &buf, 1);
351 	if (ret == 1)
352 		return 0;
353 	return (ret < 0) ? ret : -EIO;
354 }
355 
356 /*
357  * em25xx_bus_B_send_bytes
358  * write bytes to the i2c device
359  */
360 static int em25xx_bus_B_send_bytes(struct em28xx *dev, u16 addr, u8 *buf,
361 				   u16 len)
362 {
363 	int ret;
364 
365 	if (len < 1 || len > 64)
366 		return -EOPNOTSUPP;
367 	/*
368 	 * NOTE: limited by the USB ctrl message constraints
369 	 * Zero length reads always succeed, even if no device is connected
370 	 */
371 
372 	/* Set register and write value */
373 	ret = dev->em28xx_write_regs_req(dev, 0x06, addr, buf, len);
374 	if (ret != len) {
375 		if (ret < 0) {
376 			dev_warn(&dev->intf->dev,
377 				 "writing to i2c device at 0x%x failed (error=%i)\n",
378 				 addr, ret);
379 			return ret;
380 		}
381 
382 		dev_warn(&dev->intf->dev,
383 			 "%i bytes write to i2c device at 0x%x requested, but %i bytes written\n",
384 			 len, addr, ret);
385 		return -EIO;
386 	}
387 	/* Check success */
388 	ret = dev->em28xx_read_reg_req(dev, 0x08, 0x0000);
389 	/*
390 	 * NOTE: the only error we've seen so far is
391 	 * 0x01 when the slave device is not present
392 	 */
393 	if (!ret)
394 		return len;
395 
396 	if (ret > 0) {
397 		dprintk(1, "Bus B R08 returned 0x%02x: I2C ACK error\n", ret);
398 		return -ENXIO;
399 	}
400 
401 	return ret;
402 	/*
403 	 * NOTE: With chip types (other chip IDs) which actually don't support
404 	 * this operation, it seems to succeed ALWAYS ! (even if there is no
405 	 * slave device or even no second i2c bus provided)
406 	 */
407 }
408 
409 /*
410  * em25xx_bus_B_recv_bytes
411  * read bytes from the i2c device
412  */
413 static int em25xx_bus_B_recv_bytes(struct em28xx *dev, u16 addr, u8 *buf,
414 				   u16 len)
415 {
416 	int ret;
417 
418 	if (len < 1 || len > 64)
419 		return -EOPNOTSUPP;
420 	/*
421 	 * NOTE: limited by the USB ctrl message constraints
422 	 * Zero length reads always succeed, even if no device is connected
423 	 */
424 
425 	/* Read value */
426 	ret = dev->em28xx_read_reg_req_len(dev, 0x06, addr, buf, len);
427 	if (ret < 0) {
428 		dev_warn(&dev->intf->dev,
429 			 "reading from i2c device at 0x%x failed (error=%i)\n",
430 			 addr, ret);
431 		return ret;
432 	}
433 	/*
434 	 * NOTE: some devices with two i2c buses have the bad habit to return 0
435 	 * bytes if we are on bus B AND there was no write attempt to the
436 	 * specified slave address before AND no device is present at the
437 	 * requested slave address.
438 	 * Anyway, the next check will fail with -ENXIO in this case, so avoid
439 	 * spamming the system log on device probing and do nothing here.
440 	 */
441 
442 	/* Check success */
443 	ret = dev->em28xx_read_reg_req(dev, 0x08, 0x0000);
444 	/*
445 	 * NOTE: the only error we've seen so far is
446 	 * 0x01 when the slave device is not present
447 	 */
448 	if (!ret)
449 		return len;
450 
451 	if (ret > 0) {
452 		dprintk(1, "Bus B R08 returned 0x%02x: I2C ACK error\n", ret);
453 		return -ENXIO;
454 	}
455 
456 	return ret;
457 	/*
458 	 * NOTE: With chip types (other chip IDs) which actually don't support
459 	 * this operation, it seems to succeed ALWAYS ! (even if there is no
460 	 * slave device or even no second i2c bus provided)
461 	 */
462 }
463 
464 /*
465  * em25xx_bus_B_check_for_device()
466  * check if there is a i2c device at the supplied address
467  */
468 static int em25xx_bus_B_check_for_device(struct em28xx *dev, u16 addr)
469 {
470 	u8 buf;
471 	int ret;
472 
473 	ret = em25xx_bus_B_recv_bytes(dev, addr, &buf, 1);
474 	if (ret < 0)
475 		return ret;
476 
477 	return 0;
478 	/*
479 	 * NOTE: With chips which do not support this operation,
480 	 * it seems to succeed ALWAYS ! (even if no device connected)
481 	 */
482 }
483 
484 static inline int i2c_check_for_device(struct em28xx_i2c_bus *i2c_bus, u16 addr)
485 {
486 	struct em28xx *dev = i2c_bus->dev;
487 	int rc = -EOPNOTSUPP;
488 
489 	if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX)
490 		rc = em28xx_i2c_check_for_device(dev, addr);
491 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM2800)
492 		rc = em2800_i2c_check_for_device(dev, addr);
493 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM25XX_BUS_B)
494 		rc = em25xx_bus_B_check_for_device(dev, addr);
495 	return rc;
496 }
497 
498 static inline int i2c_recv_bytes(struct em28xx_i2c_bus *i2c_bus,
499 				 struct i2c_msg msg)
500 {
501 	struct em28xx *dev = i2c_bus->dev;
502 	u16 addr = msg.addr << 1;
503 	int rc = -EOPNOTSUPP;
504 
505 	if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX)
506 		rc = em28xx_i2c_recv_bytes(dev, addr, msg.buf, msg.len);
507 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM2800)
508 		rc = em2800_i2c_recv_bytes(dev, addr, msg.buf, msg.len);
509 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM25XX_BUS_B)
510 		rc = em25xx_bus_B_recv_bytes(dev, addr, msg.buf, msg.len);
511 	return rc;
512 }
513 
514 static inline int i2c_send_bytes(struct em28xx_i2c_bus *i2c_bus,
515 				 struct i2c_msg msg, int stop)
516 {
517 	struct em28xx *dev = i2c_bus->dev;
518 	u16 addr = msg.addr << 1;
519 	int rc = -EOPNOTSUPP;
520 
521 	if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX)
522 		rc = em28xx_i2c_send_bytes(dev, addr, msg.buf, msg.len, stop);
523 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM2800)
524 		rc = em2800_i2c_send_bytes(dev, addr, msg.buf, msg.len);
525 	else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM25XX_BUS_B)
526 		rc = em25xx_bus_B_send_bytes(dev, addr, msg.buf, msg.len);
527 	return rc;
528 }
529 
530 /*
531  * em28xx_i2c_xfer()
532  * the main i2c transfer function
533  */
534 static int em28xx_i2c_xfer(struct i2c_adapter *i2c_adap,
535 			   struct i2c_msg msgs[], int num)
536 {
537 	struct em28xx_i2c_bus *i2c_bus = i2c_adap->algo_data;
538 	struct em28xx *dev = i2c_bus->dev;
539 	unsigned int bus = i2c_bus->bus;
540 	int addr, rc, i;
541 	u8 reg;
542 
543 	/*
544 	 * prevent i2c xfer attempts after device is disconnected
545 	 * some fe's try to do i2c writes/reads from their release
546 	 * interfaces when called in disconnect path
547 	 */
548 	if (dev->disconnected)
549 		return -ENODEV;
550 
551 	if (!rt_mutex_trylock(&dev->i2c_bus_lock))
552 		return -EAGAIN;
553 
554 	/* Switch I2C bus if needed */
555 	if (bus != dev->cur_i2c_bus &&
556 	    i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX) {
557 		if (bus == 1)
558 			reg = EM2874_I2C_SECONDARY_BUS_SELECT;
559 		else
560 			reg = 0;
561 		em28xx_write_reg_bits(dev, EM28XX_R06_I2C_CLK, reg,
562 				      EM2874_I2C_SECONDARY_BUS_SELECT);
563 		dev->cur_i2c_bus = bus;
564 	}
565 
566 	for (i = 0; i < num; i++) {
567 		addr = msgs[i].addr << 1;
568 		if (!msgs[i].len) {
569 			/*
570 			 * no len: check only for device presence
571 			 * This code is only called during device probe.
572 			 */
573 			rc = i2c_check_for_device(i2c_bus, addr);
574 
575 			if (rc == -ENXIO)
576 				rc = -ENODEV;
577 		} else if (msgs[i].flags & I2C_M_RD) {
578 			/* read bytes */
579 			rc = i2c_recv_bytes(i2c_bus, msgs[i]);
580 		} else {
581 			/* write bytes */
582 			rc = i2c_send_bytes(i2c_bus, msgs[i], i == num - 1);
583 		}
584 
585 		if (rc < 0)
586 			goto error;
587 
588 		dprintk(2, "%s %s addr=%02x len=%d: %*ph\n",
589 			(msgs[i].flags & I2C_M_RD) ? "read" : "write",
590 			i == num - 1 ? "stop" : "nonstop",
591 			addr, msgs[i].len,
592 			msgs[i].len, msgs[i].buf);
593 	}
594 
595 	rt_mutex_unlock(&dev->i2c_bus_lock);
596 	return num;
597 
598 error:
599 	dprintk(2, "%s %s addr=%02x len=%d: %sERROR: %i\n",
600 		(msgs[i].flags & I2C_M_RD) ? "read" : "write",
601 		i == num - 1 ? "stop" : "nonstop",
602 		addr, msgs[i].len,
603 		(rc == -ENODEV) ? "no device " : "",
604 		rc);
605 
606 	rt_mutex_unlock(&dev->i2c_bus_lock);
607 	return rc;
608 }
609 
610 /*
611  * based on linux/sunrpc/svcauth.h and linux/hash.h
612  * The original hash function returns a different value, if arch is x86_64
613  * or i386.
614  */
615 static inline unsigned long em28xx_hash_mem(char *buf, int length, int bits)
616 {
617 	unsigned long hash = 0;
618 	unsigned long l = 0;
619 	int len = 0;
620 	unsigned char c;
621 
622 	do {
623 		if (len == length) {
624 			c = (char)len;
625 			len = -1;
626 		} else {
627 			c = *buf++;
628 		}
629 		l = (l << 8) | c;
630 		len++;
631 		if ((len & (32 / 8 - 1)) == 0)
632 			hash = ((hash ^ l) * 0x9e370001UL);
633 	} while (len);
634 
635 	return (hash >> (32 - bits)) & 0xffffffffUL;
636 }
637 
638 /*
639  * Helper function to read data blocks from i2c clients with 8 or 16 bit
640  * address width, 8 bit register width and auto incrementation been activated
641  */
642 static int em28xx_i2c_read_block(struct em28xx *dev, unsigned int bus, u16 addr,
643 				 bool addr_w16, u16 len, u8 *data)
644 {
645 	int remain = len, rsize, rsize_max, ret;
646 	u8 buf[2];
647 
648 	/* Sanity check */
649 	if (addr + remain > (addr_w16 * 0xff00 + 0xff + 1))
650 		return -EINVAL;
651 	/* Select address */
652 	buf[0] = addr >> 8;
653 	buf[1] = addr & 0xff;
654 	ret = i2c_master_send(&dev->i2c_client[bus],
655 			      buf + !addr_w16, 1 + addr_w16);
656 	if (ret < 0)
657 		return ret;
658 	/* Read data */
659 	if (dev->board.is_em2800)
660 		rsize_max = 4;
661 	else
662 		rsize_max = 64;
663 	while (remain > 0) {
664 		if (remain > rsize_max)
665 			rsize = rsize_max;
666 		else
667 			rsize = remain;
668 
669 		ret = i2c_master_recv(&dev->i2c_client[bus], data, rsize);
670 		if (ret < 0)
671 			return ret;
672 
673 		remain -= rsize;
674 		data += rsize;
675 	}
676 
677 	return len;
678 }
679 
680 static int em28xx_i2c_eeprom(struct em28xx *dev, unsigned int bus,
681 			     u8 **eedata, u16 *eedata_len)
682 {
683 	const u16 len = 256;
684 	/*
685 	 * FIXME common length/size for bytes to read, to display, hash
686 	 * calculation and returned device dataset. Simplifies the code a lot,
687 	 * but we might have to deal with multiple sizes in the future !
688 	 */
689 	int err;
690 	struct em28xx_eeprom *dev_config;
691 	u8 buf, *data;
692 
693 	*eedata = NULL;
694 	*eedata_len = 0;
695 
696 	/* EEPROM is always on i2c bus 0 on all known devices. */
697 
698 	dev->i2c_client[bus].addr = 0xa0 >> 1;
699 
700 	/* Check if board has eeprom */
701 	err = i2c_master_recv(&dev->i2c_client[bus], &buf, 0);
702 	if (err < 0) {
703 		dev_info(&dev->intf->dev, "board has no eeprom\n");
704 		return -ENODEV;
705 	}
706 
707 	data = kzalloc(len, GFP_KERNEL);
708 	if (!data)
709 		return -ENOMEM;
710 
711 	/* Read EEPROM content */
712 	err = em28xx_i2c_read_block(dev, bus, 0x0000,
713 				    dev->eeprom_addrwidth_16bit,
714 				    len, data);
715 	if (err != len) {
716 		dev_err(&dev->intf->dev,
717 			"failed to read eeprom (err=%d)\n", err);
718 		goto error;
719 	}
720 
721 	if (i2c_debug) {
722 		/* Display eeprom content */
723 		print_hex_dump(KERN_DEBUG, "em28xx eeprom ", DUMP_PREFIX_OFFSET,
724 			       16, 1, data, len, true);
725 
726 		if (dev->eeprom_addrwidth_16bit)
727 			dev_info(&dev->intf->dev,
728 				 "eeprom %06x: ... (skipped)\n", 256);
729 	}
730 
731 	if (dev->eeprom_addrwidth_16bit &&
732 	    data[0] == 0x26 && data[3] == 0x00) {
733 		/* new eeprom format; size 4-64kb */
734 		u16 mc_start;
735 		u16 hwconf_offset;
736 
737 		dev->hash = em28xx_hash_mem(data, len, 32);
738 		mc_start = (data[1] << 8) + 4;	/* usually 0x0004 */
739 
740 		dev_info(&dev->intf->dev,
741 			 "EEPROM ID = %4ph, EEPROM hash = 0x%08lx\n",
742 			 data, dev->hash);
743 		dev_info(&dev->intf->dev,
744 			 "EEPROM info:\n");
745 		dev_info(&dev->intf->dev,
746 			 "\tmicrocode start address = 0x%04x, boot configuration = 0x%02x\n",
747 			 mc_start, data[2]);
748 		/*
749 		 * boot configuration (address 0x0002):
750 		 * [0]   microcode download speed: 1 = 400 kHz; 0 = 100 kHz
751 		 * [1]   always selects 12 kb RAM
752 		 * [2]   USB device speed: 1 = force Full Speed; 0 = auto detect
753 		 * [4]   1 = force fast mode and no suspend for device testing
754 		 * [5:7] USB PHY tuning registers; determined by device
755 		 *       characterization
756 		 */
757 
758 		/*
759 		 * Read hardware config dataset offset from address
760 		 * (microcode start + 46)
761 		 */
762 		err = em28xx_i2c_read_block(dev, bus, mc_start + 46, 1, 2,
763 					    data);
764 		if (err != 2) {
765 			dev_err(&dev->intf->dev,
766 				"failed to read hardware configuration data from eeprom (err=%d)\n",
767 				err);
768 			goto error;
769 		}
770 
771 		/* Calculate hardware config dataset start address */
772 		hwconf_offset = mc_start + data[0] + (data[1] << 8);
773 
774 		/* Read hardware config dataset */
775 		/*
776 		 * NOTE: the microcode copy can be multiple pages long, but
777 		 * we assume the hardware config dataset is the same as in
778 		 * the old eeprom and not longer than 256 bytes.
779 		 * tveeprom is currently also limited to 256 bytes.
780 		 */
781 		err = em28xx_i2c_read_block(dev, bus, hwconf_offset, 1, len,
782 					    data);
783 		if (err != len) {
784 			dev_err(&dev->intf->dev,
785 				"failed to read hardware configuration data from eeprom (err=%d)\n",
786 				err);
787 			goto error;
788 		}
789 
790 		/* Verify hardware config dataset */
791 		/* NOTE: not all devices provide this type of dataset */
792 		if (data[0] != 0x1a || data[1] != 0xeb ||
793 		    data[2] != 0x67 || data[3] != 0x95) {
794 			dev_info(&dev->intf->dev,
795 				 "\tno hardware configuration dataset found in eeprom\n");
796 			kfree(data);
797 			return 0;
798 		}
799 
800 		/*
801 		 * TODO: decrypt eeprom data for camera bridges
802 		 * (em25xx, em276x+)
803 		 */
804 
805 	} else if (!dev->eeprom_addrwidth_16bit &&
806 		   data[0] == 0x1a && data[1] == 0xeb &&
807 		   data[2] == 0x67 && data[3] == 0x95) {
808 		dev->hash = em28xx_hash_mem(data, len, 32);
809 		dev_info(&dev->intf->dev,
810 			 "EEPROM ID = %4ph, EEPROM hash = 0x%08lx\n",
811 			 data, dev->hash);
812 		dev_info(&dev->intf->dev,
813 			 "EEPROM info:\n");
814 	} else {
815 		dev_info(&dev->intf->dev,
816 			 "unknown eeprom format or eeprom corrupted !\n");
817 		err = -ENODEV;
818 		goto error;
819 	}
820 
821 	*eedata = data;
822 	*eedata_len = len;
823 	dev_config = (void *)*eedata;
824 
825 	switch (le16_to_cpu(dev_config->chip_conf) >> 4 & 0x3) {
826 	case 0:
827 		dev_info(&dev->intf->dev, "\tNo audio on board.\n");
828 		break;
829 	case 1:
830 		dev_info(&dev->intf->dev, "\tAC97 audio (5 sample rates)\n");
831 		break;
832 	case 2:
833 		if (dev->chip_id < CHIP_ID_EM2860)
834 			dev_info(&dev->intf->dev,
835 				 "\tI2S audio, sample rate=32k\n");
836 		else
837 			dev_info(&dev->intf->dev,
838 				 "\tI2S audio, 3 sample rates\n");
839 		break;
840 	case 3:
841 		if (dev->chip_id < CHIP_ID_EM2860)
842 			dev_info(&dev->intf->dev,
843 				 "\tI2S audio, 3 sample rates\n");
844 		else
845 			dev_info(&dev->intf->dev,
846 				 "\tI2S audio, 5 sample rates\n");
847 		break;
848 	}
849 
850 	if (le16_to_cpu(dev_config->chip_conf) & 1 << 3)
851 		dev_info(&dev->intf->dev, "\tUSB Remote wakeup capable\n");
852 
853 	if (le16_to_cpu(dev_config->chip_conf) & 1 << 2)
854 		dev_info(&dev->intf->dev, "\tUSB Self power capable\n");
855 
856 	switch (le16_to_cpu(dev_config->chip_conf) & 0x3) {
857 	case 0:
858 		dev_info(&dev->intf->dev, "\t500mA max power\n");
859 		break;
860 	case 1:
861 		dev_info(&dev->intf->dev, "\t400mA max power\n");
862 		break;
863 	case 2:
864 		dev_info(&dev->intf->dev, "\t300mA max power\n");
865 		break;
866 	case 3:
867 		dev_info(&dev->intf->dev, "\t200mA max power\n");
868 		break;
869 	}
870 	dev_info(&dev->intf->dev,
871 		 "\tTable at offset 0x%02x, strings=0x%04x, 0x%04x, 0x%04x\n",
872 		 dev_config->string_idx_table,
873 		 le16_to_cpu(dev_config->string1),
874 		 le16_to_cpu(dev_config->string2),
875 		 le16_to_cpu(dev_config->string3));
876 
877 	return 0;
878 
879 error:
880 	kfree(data);
881 	return err;
882 }
883 
884 /* ----------------------------------------------------------- */
885 
886 /*
887  * functionality()
888  */
889 static u32 functionality(struct i2c_adapter *i2c_adap)
890 {
891 	struct em28xx_i2c_bus *i2c_bus = i2c_adap->algo_data;
892 
893 	if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM28XX ||
894 	    i2c_bus->algo_type == EM28XX_I2C_ALGO_EM25XX_BUS_B) {
895 		return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
896 	} else if (i2c_bus->algo_type == EM28XX_I2C_ALGO_EM2800)  {
897 		return (I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL) &
898 			~I2C_FUNC_SMBUS_WRITE_BLOCK_DATA;
899 	}
900 
901 	WARN(1, "Unknown i2c bus algorithm.\n");
902 	return 0;
903 }
904 
905 static const struct i2c_algorithm em28xx_algo = {
906 	.master_xfer   = em28xx_i2c_xfer,
907 	.functionality = functionality,
908 };
909 
910 static const struct i2c_adapter em28xx_adap_template = {
911 	.owner = THIS_MODULE,
912 	.name = "em28xx",
913 	.algo = &em28xx_algo,
914 };
915 
916 static const struct i2c_client em28xx_client_template = {
917 	.name = "em28xx internal",
918 };
919 
920 /* ----------------------------------------------------------- */
921 
922 /*
923  * i2c_devs
924  * incomplete list of known devices
925  */
926 static char *i2c_devs[128] = {
927 	[0x1c >> 1] = "lgdt330x",
928 	[0x3e >> 1] = "remote IR sensor",
929 	[0x4a >> 1] = "saa7113h",
930 	[0x52 >> 1] = "drxk",
931 	[0x60 >> 1] = "remote IR sensor",
932 	[0x8e >> 1] = "remote IR sensor",
933 	[0x86 >> 1] = "tda9887",
934 	[0x80 >> 1] = "msp34xx",
935 	[0x88 >> 1] = "msp34xx",
936 	[0xa0 >> 1] = "eeprom",
937 	[0xb0 >> 1] = "tda9874",
938 	[0xb8 >> 1] = "tvp5150a",
939 	[0xba >> 1] = "webcam sensor or tvp5150a",
940 	[0xc0 >> 1] = "tuner (analog)",
941 	[0xc2 >> 1] = "tuner (analog)",
942 	[0xc4 >> 1] = "tuner (analog)",
943 	[0xc6 >> 1] = "tuner (analog)",
944 };
945 
946 /*
947  * do_i2c_scan()
948  * check i2c address range for devices
949  */
950 void em28xx_do_i2c_scan(struct em28xx *dev, unsigned int bus)
951 {
952 	u8 i2c_devicelist[128];
953 	unsigned char buf;
954 	int i, rc;
955 
956 	memset(i2c_devicelist, 0, sizeof(i2c_devicelist));
957 
958 	for (i = 0; i < ARRAY_SIZE(i2c_devs); i++) {
959 		dev->i2c_client[bus].addr = i;
960 		rc = i2c_master_recv(&dev->i2c_client[bus], &buf, 0);
961 		if (rc < 0)
962 			continue;
963 		i2c_devicelist[i] = i;
964 		dev_info(&dev->intf->dev,
965 			 "found i2c device @ 0x%x on bus %d [%s]\n",
966 			 i << 1, bus, i2c_devs[i] ? i2c_devs[i] : "???");
967 	}
968 
969 	if (bus == dev->def_i2c_bus)
970 		dev->i2c_hash = em28xx_hash_mem(i2c_devicelist,
971 						sizeof(i2c_devicelist), 32);
972 }
973 
974 /*
975  * em28xx_i2c_register()
976  * register i2c bus
977  */
978 int em28xx_i2c_register(struct em28xx *dev, unsigned int bus,
979 			enum em28xx_i2c_algo_type algo_type)
980 {
981 	int retval;
982 
983 	if (WARN_ON(!dev->em28xx_write_regs || !dev->em28xx_read_reg ||
984 		    !dev->em28xx_write_regs_req || !dev->em28xx_read_reg_req))
985 		return -ENODEV;
986 
987 	if (bus >= NUM_I2C_BUSES)
988 		return -ENODEV;
989 
990 	dev->i2c_adap[bus] = em28xx_adap_template;
991 	dev->i2c_adap[bus].dev.parent = &dev->intf->dev;
992 	strscpy(dev->i2c_adap[bus].name, dev_name(&dev->intf->dev),
993 		sizeof(dev->i2c_adap[bus].name));
994 
995 	dev->i2c_bus[bus].bus = bus;
996 	dev->i2c_bus[bus].algo_type = algo_type;
997 	dev->i2c_bus[bus].dev = dev;
998 	dev->i2c_adap[bus].algo_data = &dev->i2c_bus[bus];
999 
1000 	retval = i2c_add_adapter(&dev->i2c_adap[bus]);
1001 	if (retval < 0) {
1002 		dev_err(&dev->intf->dev,
1003 			"%s: i2c_add_adapter failed! retval [%d]\n",
1004 			__func__, retval);
1005 		return retval;
1006 	}
1007 
1008 	dev->i2c_client[bus] = em28xx_client_template;
1009 	dev->i2c_client[bus].adapter = &dev->i2c_adap[bus];
1010 
1011 	/* Up to now, all eeproms are at bus 0 */
1012 	if (!bus) {
1013 		retval = em28xx_i2c_eeprom(dev, bus,
1014 					   &dev->eedata, &dev->eedata_len);
1015 		if (retval < 0 && retval != -ENODEV) {
1016 			dev_err(&dev->intf->dev,
1017 				"%s: em28xx_i2_eeprom failed! retval [%d]\n",
1018 				__func__, retval);
1019 		}
1020 	}
1021 
1022 	if (i2c_scan)
1023 		em28xx_do_i2c_scan(dev, bus);
1024 
1025 	return 0;
1026 }
1027 
1028 /*
1029  * em28xx_i2c_unregister()
1030  * unregister i2c_bus
1031  */
1032 int em28xx_i2c_unregister(struct em28xx *dev, unsigned int bus)
1033 {
1034 	if (bus >= NUM_I2C_BUSES)
1035 		return -ENODEV;
1036 
1037 	i2c_del_adapter(&dev->i2c_adap[bus]);
1038 	return 0;
1039 }
1040