1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * TTUSB DEC Driver
4  *
5  * Copyright (C) 2003-2004 Alex Woods <linux-dvb@giblets.org>
6  * IR support by Peter Beutner <p.beutner@gmx.net>
7  */
8 
9 #include <linux/list.h>
10 #include <linux/module.h>
11 #include <linux/pci.h>
12 #include <linux/slab.h>
13 #include <linux/spinlock.h>
14 #include <linux/usb.h>
15 #include <linux/interrupt.h>
16 #include <linux/firmware.h>
17 #include <linux/crc32.h>
18 #include <linux/init.h>
19 #include <linux/input.h>
20 
21 #include <linux/mutex.h>
22 
23 #include <media/dmxdev.h>
24 #include <media/dvb_demux.h>
25 #include <media/dvb_frontend.h>
26 #include <media/dvb_net.h>
27 #include "ttusbdecfe.h"
28 
29 static int debug;
30 static int output_pva;
31 static int enable_rc;
32 
33 module_param(debug, int, 0644);
34 MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
35 module_param(output_pva, int, 0444);
36 MODULE_PARM_DESC(output_pva, "Output PVA from dvr device (default:off)");
37 module_param(enable_rc, int, 0644);
38 MODULE_PARM_DESC(enable_rc, "Turn on/off IR remote control(default: off)");
39 
40 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
41 
42 #define dprintk	if (debug) printk
43 
44 #define DRIVER_NAME		"TechnoTrend/Hauppauge DEC USB"
45 
46 #define COMMAND_PIPE		0x03
47 #define RESULT_PIPE		0x04
48 #define IN_PIPE			0x08
49 #define OUT_PIPE		0x07
50 #define IRQ_PIPE		0x0A
51 
52 #define COMMAND_PACKET_SIZE	0x3c
53 #define ARM_PACKET_SIZE		0x1000
54 #define IRQ_PACKET_SIZE		0x8
55 
56 #define ISO_BUF_COUNT		0x04
57 #define FRAMES_PER_ISO_BUF	0x04
58 #define ISO_FRAME_SIZE		0x0380
59 
60 #define	MAX_PVA_LENGTH		6144
61 
62 enum ttusb_dec_model {
63 	TTUSB_DEC2000T,
64 	TTUSB_DEC2540T,
65 	TTUSB_DEC3000S
66 };
67 
68 enum ttusb_dec_packet_type {
69 	TTUSB_DEC_PACKET_PVA,
70 	TTUSB_DEC_PACKET_SECTION,
71 	TTUSB_DEC_PACKET_EMPTY
72 };
73 
74 enum ttusb_dec_interface {
75 	TTUSB_DEC_INTERFACE_INITIAL,
76 	TTUSB_DEC_INTERFACE_IN,
77 	TTUSB_DEC_INTERFACE_OUT
78 };
79 
80 typedef int (dvb_filter_pes2ts_cb_t) (void *, unsigned char *);
81 
82 struct dvb_filter_pes2ts {
83 	unsigned char buf[188];
84 	unsigned char cc;
85 	dvb_filter_pes2ts_cb_t *cb;
86 	void *priv;
87 };
88 
89 struct ttusb_dec {
90 	enum ttusb_dec_model		model;
91 	char				*model_name;
92 	char				*firmware_name;
93 	int				can_playback;
94 
95 	/* DVB bits */
96 	struct dvb_adapter		adapter;
97 	struct dmxdev			dmxdev;
98 	struct dvb_demux		demux;
99 	struct dmx_frontend		frontend;
100 	struct dvb_net			dvb_net;
101 	struct dvb_frontend*		fe;
102 
103 	u16			pid[DMX_PES_OTHER];
104 
105 	/* USB bits */
106 	struct usb_device		*udev;
107 	u8				trans_count;
108 	unsigned int			command_pipe;
109 	unsigned int			result_pipe;
110 	unsigned int			in_pipe;
111 	unsigned int			out_pipe;
112 	unsigned int			irq_pipe;
113 	enum ttusb_dec_interface	interface;
114 	struct mutex			usb_mutex;
115 
116 	void			*irq_buffer;
117 	struct urb		*irq_urb;
118 	dma_addr_t		irq_dma_handle;
119 	void			*iso_buffer;
120 	struct urb		*iso_urb[ISO_BUF_COUNT];
121 	int			iso_stream_count;
122 	struct mutex		iso_mutex;
123 
124 	u8				packet[MAX_PVA_LENGTH + 4];
125 	enum ttusb_dec_packet_type	packet_type;
126 	int				packet_state;
127 	int				packet_length;
128 	int				packet_payload_length;
129 	u16				next_packet_id;
130 
131 	int				pva_stream_count;
132 	int				filter_stream_count;
133 
134 	struct dvb_filter_pes2ts	a_pes2ts;
135 	struct dvb_filter_pes2ts	v_pes2ts;
136 
137 	u8			v_pes[16 + MAX_PVA_LENGTH];
138 	int			v_pes_length;
139 	int			v_pes_postbytes;
140 
141 	struct list_head	urb_frame_list;
142 	struct tasklet_struct	urb_tasklet;
143 	spinlock_t		urb_frame_list_lock;
144 
145 	struct dvb_demux_filter	*audio_filter;
146 	struct dvb_demux_filter	*video_filter;
147 	struct list_head	filter_info_list;
148 	spinlock_t		filter_info_list_lock;
149 
150 	struct input_dev	*rc_input_dev;
151 	char			rc_phys[64];
152 
153 	int			active; /* Loaded successfully */
154 };
155 
156 struct urb_frame {
157 	u8			data[ISO_FRAME_SIZE];
158 	int			length;
159 	struct list_head	urb_frame_list;
160 };
161 
162 struct filter_info {
163 	u8			stream_id;
164 	struct dvb_demux_filter	*filter;
165 	struct list_head	filter_info_list;
166 };
167 
168 static u16 rc_keys[] = {
169 	KEY_POWER,
170 	KEY_MUTE,
171 	KEY_1,
172 	KEY_2,
173 	KEY_3,
174 	KEY_4,
175 	KEY_5,
176 	KEY_6,
177 	KEY_7,
178 	KEY_8,
179 	KEY_9,
180 	KEY_0,
181 	KEY_CHANNELUP,
182 	KEY_VOLUMEDOWN,
183 	KEY_OK,
184 	KEY_VOLUMEUP,
185 	KEY_CHANNELDOWN,
186 	KEY_PREVIOUS,
187 	KEY_ESC,
188 	KEY_RED,
189 	KEY_GREEN,
190 	KEY_YELLOW,
191 	KEY_BLUE,
192 	KEY_OPTION,
193 	KEY_M,
194 	KEY_RADIO
195 };
196 
197 static void dvb_filter_pes2ts_init(struct dvb_filter_pes2ts *p2ts,
198 				   unsigned short pid,
199 				   dvb_filter_pes2ts_cb_t *cb, void *priv)
200 {
201 	unsigned char *buf=p2ts->buf;
202 
203 	buf[0]=0x47;
204 	buf[1]=(pid>>8);
205 	buf[2]=pid&0xff;
206 	p2ts->cc=0;
207 	p2ts->cb=cb;
208 	p2ts->priv=priv;
209 }
210 
211 static int dvb_filter_pes2ts(struct dvb_filter_pes2ts *p2ts,
212 			     unsigned char *pes, int len, int payload_start)
213 {
214 	unsigned char *buf=p2ts->buf;
215 	int ret=0, rest;
216 
217 	//len=6+((pes[4]<<8)|pes[5]);
218 
219 	if (payload_start)
220 		buf[1]|=0x40;
221 	else
222 		buf[1]&=~0x40;
223 	while (len>=184) {
224 		buf[3]=0x10|((p2ts->cc++)&0x0f);
225 		memcpy(buf+4, pes, 184);
226 		if ((ret=p2ts->cb(p2ts->priv, buf)))
227 			return ret;
228 		len-=184; pes+=184;
229 		buf[1]&=~0x40;
230 	}
231 	if (!len)
232 		return 0;
233 	buf[3]=0x30|((p2ts->cc++)&0x0f);
234 	rest=183-len;
235 	if (rest) {
236 		buf[5]=0x00;
237 		if (rest-1)
238 			memset(buf+6, 0xff, rest-1);
239 	}
240 	buf[4]=rest;
241 	memcpy(buf+5+rest, pes, len);
242 	return p2ts->cb(p2ts->priv, buf);
243 }
244 
245 static void ttusb_dec_set_model(struct ttusb_dec *dec,
246 				enum ttusb_dec_model model);
247 
248 static void ttusb_dec_handle_irq( struct urb *urb)
249 {
250 	struct ttusb_dec *dec = urb->context;
251 	char *buffer = dec->irq_buffer;
252 	int retval;
253 	int index = buffer[4];
254 
255 	switch(urb->status) {
256 		case 0: /*success*/
257 			break;
258 		case -ECONNRESET:
259 		case -ENOENT:
260 		case -ESHUTDOWN:
261 		case -ETIME:
262 			/* this urb is dead, cleanup */
263 			dprintk("%s:urb shutting down with status: %d\n",
264 					__func__, urb->status);
265 			return;
266 		default:
267 			dprintk("%s:nonzero status received: %d\n",
268 					__func__,urb->status);
269 			goto exit;
270 	}
271 
272 	if ((buffer[0] == 0x1) && (buffer[2] == 0x15))  {
273 		/*
274 		 * IR - Event
275 		 *
276 		 * this is an fact a bit too simple implementation;
277 		 * the box also reports a keyrepeat signal
278 		 * (with buffer[3] == 0x40) in an interval of ~100ms.
279 		 * But to handle this correctly we had to imlemenent some
280 		 * kind of timer which signals a 'key up' event if no
281 		 * keyrepeat signal is received for lets say 200ms.
282 		 * this should/could be added later ...
283 		 * for now lets report each signal as a key down and up
284 		 */
285 		if (index - 1 < ARRAY_SIZE(rc_keys)) {
286 			dprintk("%s:rc signal:%d\n", __func__, index);
287 			input_report_key(dec->rc_input_dev, rc_keys[index - 1], 1);
288 			input_sync(dec->rc_input_dev);
289 			input_report_key(dec->rc_input_dev, rc_keys[index - 1], 0);
290 			input_sync(dec->rc_input_dev);
291 		}
292 	}
293 
294 exit:
295 	retval = usb_submit_urb(urb, GFP_ATOMIC);
296 	if (retval)
297 		printk("%s - usb_commit_urb failed with result: %d\n",
298 			__func__, retval);
299 }
300 
301 static u16 crc16(u16 crc, const u8 *buf, size_t len)
302 {
303 	u16 tmp;
304 
305 	while (len--) {
306 		crc ^= *buf++;
307 		crc ^= (u8)crc >> 4;
308 		tmp = (u8)crc;
309 		crc ^= (tmp ^ (tmp << 1)) << 4;
310 	}
311 	return crc;
312 }
313 
314 static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
315 				  int param_length, const u8 params[],
316 				  int *result_length, u8 cmd_result[])
317 {
318 	int result, actual_len;
319 	u8 *b;
320 
321 	dprintk("%s\n", __func__);
322 
323 	b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
324 	if (!b)
325 		return -ENOMEM;
326 
327 	if ((result = mutex_lock_interruptible(&dec->usb_mutex))) {
328 		kfree(b);
329 		printk("%s: Failed to lock usb mutex.\n", __func__);
330 		return result;
331 	}
332 
333 	b[0] = 0xaa;
334 	b[1] = ++dec->trans_count;
335 	b[2] = command;
336 	b[3] = param_length;
337 
338 	if (params)
339 		memcpy(&b[4], params, param_length);
340 
341 	if (debug) {
342 		printk(KERN_DEBUG "%s: command: %*ph\n",
343 		       __func__, param_length, b);
344 	}
345 
346 	result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
347 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
348 
349 	if (result) {
350 		printk("%s: command bulk message failed: error %d\n",
351 		       __func__, result);
352 		mutex_unlock(&dec->usb_mutex);
353 		kfree(b);
354 		return result;
355 	}
356 
357 	result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
358 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
359 
360 	if (result) {
361 		printk("%s: result bulk message failed: error %d\n",
362 		       __func__, result);
363 		mutex_unlock(&dec->usb_mutex);
364 		kfree(b);
365 		return result;
366 	} else {
367 		if (debug) {
368 			printk(KERN_DEBUG "%s: result: %*ph\n",
369 			       __func__, actual_len, b);
370 		}
371 
372 		if (result_length)
373 			*result_length = b[3];
374 		if (cmd_result && b[3] > 0)
375 			memcpy(cmd_result, &b[4], b[3]);
376 
377 		mutex_unlock(&dec->usb_mutex);
378 
379 		kfree(b);
380 		return 0;
381 	}
382 }
383 
384 static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode,
385 				    unsigned int *model, unsigned int *version)
386 {
387 	u8 c[COMMAND_PACKET_SIZE];
388 	int c_length;
389 	int result;
390 	__be32 tmp;
391 
392 	dprintk("%s\n", __func__);
393 
394 	result = ttusb_dec_send_command(dec, 0x08, 0, NULL, &c_length, c);
395 	if (result)
396 		return result;
397 
398 	if (c_length >= 0x0c) {
399 		if (mode != NULL) {
400 			memcpy(&tmp, c, 4);
401 			*mode = ntohl(tmp);
402 		}
403 		if (model != NULL) {
404 			memcpy(&tmp, &c[4], 4);
405 			*model = ntohl(tmp);
406 		}
407 		if (version != NULL) {
408 			memcpy(&tmp, &c[8], 4);
409 			*version = ntohl(tmp);
410 		}
411 		return 0;
412 	} else {
413 		return -ENOENT;
414 	}
415 }
416 
417 static int ttusb_dec_audio_pes2ts_cb(void *priv, unsigned char *data)
418 {
419 	struct ttusb_dec *dec = priv;
420 
421 	dec->audio_filter->feed->cb.ts(data, 188, NULL, 0,
422 				       &dec->audio_filter->feed->feed.ts, NULL);
423 
424 	return 0;
425 }
426 
427 static int ttusb_dec_video_pes2ts_cb(void *priv, unsigned char *data)
428 {
429 	struct ttusb_dec *dec = priv;
430 
431 	dec->video_filter->feed->cb.ts(data, 188, NULL, 0,
432 				       &dec->video_filter->feed->feed.ts, NULL);
433 
434 	return 0;
435 }
436 
437 static void ttusb_dec_set_pids(struct ttusb_dec *dec)
438 {
439 	u8 b[] = { 0x00, 0x00, 0x00, 0x00,
440 		   0x00, 0x00, 0xff, 0xff,
441 		   0xff, 0xff, 0xff, 0xff };
442 
443 	__be16 pcr = htons(dec->pid[DMX_PES_PCR]);
444 	__be16 audio = htons(dec->pid[DMX_PES_AUDIO]);
445 	__be16 video = htons(dec->pid[DMX_PES_VIDEO]);
446 
447 	dprintk("%s\n", __func__);
448 
449 	memcpy(&b[0], &pcr, 2);
450 	memcpy(&b[2], &audio, 2);
451 	memcpy(&b[4], &video, 2);
452 
453 	ttusb_dec_send_command(dec, 0x50, sizeof(b), b, NULL, NULL);
454 
455 	dvb_filter_pes2ts_init(&dec->a_pes2ts, dec->pid[DMX_PES_AUDIO],
456 			       ttusb_dec_audio_pes2ts_cb, dec);
457 	dvb_filter_pes2ts_init(&dec->v_pes2ts, dec->pid[DMX_PES_VIDEO],
458 			       ttusb_dec_video_pes2ts_cb, dec);
459 	dec->v_pes_length = 0;
460 	dec->v_pes_postbytes = 0;
461 }
462 
463 static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
464 {
465 	if (length < 8) {
466 		printk("%s: packet too short - discarding\n", __func__);
467 		return;
468 	}
469 
470 	if (length > 8 + MAX_PVA_LENGTH) {
471 		printk("%s: packet too long - discarding\n", __func__);
472 		return;
473 	}
474 
475 	switch (pva[2]) {
476 
477 	case 0x01: {		/* VideoStream */
478 		int prebytes = pva[5] & 0x03;
479 		int postbytes = (pva[5] & 0x0c) >> 2;
480 		__be16 v_pes_payload_length;
481 
482 		if (output_pva) {
483 			dec->video_filter->feed->cb.ts(pva, length, NULL, 0,
484 				&dec->video_filter->feed->feed.ts, NULL);
485 			return;
486 		}
487 
488 		if (dec->v_pes_postbytes > 0 &&
489 		    dec->v_pes_postbytes == prebytes) {
490 			memcpy(&dec->v_pes[dec->v_pes_length],
491 			       &pva[12], prebytes);
492 
493 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
494 					  dec->v_pes_length + prebytes, 1);
495 		}
496 
497 		if (pva[5] & 0x10) {
498 			dec->v_pes[7] = 0x80;
499 			dec->v_pes[8] = 0x05;
500 
501 			dec->v_pes[9] = 0x21 | ((pva[8] & 0xc0) >> 5);
502 			dec->v_pes[10] = ((pva[8] & 0x3f) << 2) |
503 					 ((pva[9] & 0xc0) >> 6);
504 			dec->v_pes[11] = 0x01 |
505 					 ((pva[9] & 0x3f) << 2) |
506 					 ((pva[10] & 0x80) >> 6);
507 			dec->v_pes[12] = ((pva[10] & 0x7f) << 1) |
508 					 ((pva[11] & 0xc0) >> 7);
509 			dec->v_pes[13] = 0x01 | ((pva[11] & 0x7f) << 1);
510 
511 			memcpy(&dec->v_pes[14], &pva[12 + prebytes],
512 			       length - 12 - prebytes);
513 			dec->v_pes_length = 14 + length - 12 - prebytes;
514 		} else {
515 			dec->v_pes[7] = 0x00;
516 			dec->v_pes[8] = 0x00;
517 
518 			memcpy(&dec->v_pes[9], &pva[8], length - 8);
519 			dec->v_pes_length = 9 + length - 8;
520 		}
521 
522 		dec->v_pes_postbytes = postbytes;
523 
524 		if (dec->v_pes[9 + dec->v_pes[8]] == 0x00 &&
525 		    dec->v_pes[10 + dec->v_pes[8]] == 0x00 &&
526 		    dec->v_pes[11 + dec->v_pes[8]] == 0x01)
527 			dec->v_pes[6] = 0x84;
528 		else
529 			dec->v_pes[6] = 0x80;
530 
531 		v_pes_payload_length = htons(dec->v_pes_length - 6 +
532 					     postbytes);
533 		memcpy(&dec->v_pes[4], &v_pes_payload_length, 2);
534 
535 		if (postbytes == 0)
536 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
537 					  dec->v_pes_length, 1);
538 
539 		break;
540 	}
541 
542 	case 0x02:		/* MainAudioStream */
543 		if (output_pva) {
544 			dec->audio_filter->feed->cb.ts(pva, length, NULL, 0,
545 				&dec->audio_filter->feed->feed.ts, NULL);
546 			return;
547 		}
548 
549 		dvb_filter_pes2ts(&dec->a_pes2ts, &pva[8], length - 8,
550 				  pva[5] & 0x10);
551 		break;
552 
553 	default:
554 		printk("%s: unknown PVA type: %02x.\n", __func__,
555 		       pva[2]);
556 		break;
557 	}
558 }
559 
560 static void ttusb_dec_process_filter(struct ttusb_dec *dec, u8 *packet,
561 				     int length)
562 {
563 	struct list_head *item;
564 	struct filter_info *finfo;
565 	struct dvb_demux_filter *filter = NULL;
566 	unsigned long flags;
567 	u8 sid;
568 
569 	sid = packet[1];
570 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
571 	for (item = dec->filter_info_list.next; item != &dec->filter_info_list;
572 	     item = item->next) {
573 		finfo = list_entry(item, struct filter_info, filter_info_list);
574 		if (finfo->stream_id == sid) {
575 			filter = finfo->filter;
576 			break;
577 		}
578 	}
579 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
580 
581 	if (filter)
582 		filter->feed->cb.sec(&packet[2], length - 2, NULL, 0,
583 				     &filter->filter, NULL);
584 }
585 
586 static void ttusb_dec_process_packet(struct ttusb_dec *dec)
587 {
588 	int i;
589 	u16 csum = 0;
590 	u16 packet_id;
591 
592 	if (dec->packet_length % 2) {
593 		printk("%s: odd sized packet - discarding\n", __func__);
594 		return;
595 	}
596 
597 	for (i = 0; i < dec->packet_length; i += 2)
598 		csum ^= ((dec->packet[i] << 8) + dec->packet[i + 1]);
599 
600 	if (csum) {
601 		printk("%s: checksum failed - discarding\n", __func__);
602 		return;
603 	}
604 
605 	packet_id = dec->packet[dec->packet_length - 4] << 8;
606 	packet_id += dec->packet[dec->packet_length - 3];
607 
608 	if ((packet_id != dec->next_packet_id) && dec->next_packet_id) {
609 		printk("%s: warning: lost packets between %u and %u\n",
610 		       __func__, dec->next_packet_id - 1, packet_id);
611 	}
612 
613 	if (packet_id == 0xffff)
614 		dec->next_packet_id = 0x8000;
615 	else
616 		dec->next_packet_id = packet_id + 1;
617 
618 	switch (dec->packet_type) {
619 	case TTUSB_DEC_PACKET_PVA:
620 		if (dec->pva_stream_count)
621 			ttusb_dec_process_pva(dec, dec->packet,
622 					      dec->packet_payload_length);
623 		break;
624 
625 	case TTUSB_DEC_PACKET_SECTION:
626 		if (dec->filter_stream_count)
627 			ttusb_dec_process_filter(dec, dec->packet,
628 						 dec->packet_payload_length);
629 		break;
630 
631 	case TTUSB_DEC_PACKET_EMPTY:
632 		break;
633 	}
634 }
635 
636 static void swap_bytes(u8 *b, int length)
637 {
638 	length -= length % 2;
639 	for (; length; b += 2, length -= 2)
640 		swap(*b, *(b + 1));
641 }
642 
643 static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,
644 					int length)
645 {
646 	swap_bytes(b, length);
647 
648 	while (length) {
649 		switch (dec->packet_state) {
650 
651 		case 0:
652 		case 1:
653 		case 2:
654 			if (*b++ == 0xaa)
655 				dec->packet_state++;
656 			else
657 				dec->packet_state = 0;
658 
659 			length--;
660 			break;
661 
662 		case 3:
663 			if (*b == 0x00) {
664 				dec->packet_state++;
665 				dec->packet_length = 0;
666 			} else if (*b != 0xaa) {
667 				dec->packet_state = 0;
668 			}
669 
670 			b++;
671 			length--;
672 			break;
673 
674 		case 4:
675 			dec->packet[dec->packet_length++] = *b++;
676 
677 			if (dec->packet_length == 2) {
678 				if (dec->packet[0] == 'A' &&
679 				    dec->packet[1] == 'V') {
680 					dec->packet_type =
681 						TTUSB_DEC_PACKET_PVA;
682 					dec->packet_state++;
683 				} else if (dec->packet[0] == 'S') {
684 					dec->packet_type =
685 						TTUSB_DEC_PACKET_SECTION;
686 					dec->packet_state++;
687 				} else if (dec->packet[0] == 0x00) {
688 					dec->packet_type =
689 						TTUSB_DEC_PACKET_EMPTY;
690 					dec->packet_payload_length = 2;
691 					dec->packet_state = 7;
692 				} else {
693 					printk("%s: unknown packet type: %02x%02x\n",
694 					       __func__,
695 					       dec->packet[0], dec->packet[1]);
696 					dec->packet_state = 0;
697 				}
698 			}
699 
700 			length--;
701 			break;
702 
703 		case 5:
704 			dec->packet[dec->packet_length++] = *b++;
705 
706 			if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
707 			    dec->packet_length == 8) {
708 				dec->packet_state++;
709 				dec->packet_payload_length = 8 +
710 					(dec->packet[6] << 8) +
711 					dec->packet[7];
712 			} else if (dec->packet_type ==
713 					TTUSB_DEC_PACKET_SECTION &&
714 				   dec->packet_length == 5) {
715 				dec->packet_state++;
716 				dec->packet_payload_length = 5 +
717 					((dec->packet[3] & 0x0f) << 8) +
718 					dec->packet[4];
719 			}
720 
721 			length--;
722 			break;
723 
724 		case 6: {
725 			int remainder = dec->packet_payload_length -
726 					dec->packet_length;
727 
728 			if (length >= remainder) {
729 				memcpy(dec->packet + dec->packet_length,
730 				       b, remainder);
731 				dec->packet_length += remainder;
732 				b += remainder;
733 				length -= remainder;
734 				dec->packet_state++;
735 			} else {
736 				memcpy(&dec->packet[dec->packet_length],
737 				       b, length);
738 				dec->packet_length += length;
739 				length = 0;
740 			}
741 
742 			break;
743 		}
744 
745 		case 7: {
746 			int tail = 4;
747 
748 			dec->packet[dec->packet_length++] = *b++;
749 
750 			if (dec->packet_type == TTUSB_DEC_PACKET_SECTION &&
751 			    dec->packet_payload_length % 2)
752 				tail++;
753 
754 			if (dec->packet_length ==
755 			    dec->packet_payload_length + tail) {
756 				ttusb_dec_process_packet(dec);
757 				dec->packet_state = 0;
758 			}
759 
760 			length--;
761 			break;
762 		}
763 
764 		default:
765 			printk("%s: illegal packet state encountered.\n",
766 			       __func__);
767 			dec->packet_state = 0;
768 		}
769 	}
770 }
771 
772 static void ttusb_dec_process_urb_frame_list(struct tasklet_struct *t)
773 {
774 	struct ttusb_dec *dec = from_tasklet(dec, t, urb_tasklet);
775 	struct list_head *item;
776 	struct urb_frame *frame;
777 	unsigned long flags;
778 
779 	while (1) {
780 		spin_lock_irqsave(&dec->urb_frame_list_lock, flags);
781 		if ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
782 			frame = list_entry(item, struct urb_frame,
783 					   urb_frame_list);
784 			list_del(&frame->urb_frame_list);
785 		} else {
786 			spin_unlock_irqrestore(&dec->urb_frame_list_lock,
787 					       flags);
788 			return;
789 		}
790 		spin_unlock_irqrestore(&dec->urb_frame_list_lock, flags);
791 
792 		ttusb_dec_process_urb_frame(dec, frame->data, frame->length);
793 		kfree(frame);
794 	}
795 }
796 
797 static void ttusb_dec_process_urb(struct urb *urb)
798 {
799 	struct ttusb_dec *dec = urb->context;
800 
801 	if (!urb->status) {
802 		int i;
803 
804 		for (i = 0; i < FRAMES_PER_ISO_BUF; i++) {
805 			struct usb_iso_packet_descriptor *d;
806 			u8 *b;
807 			int length;
808 			struct urb_frame *frame;
809 
810 			d = &urb->iso_frame_desc[i];
811 			b = urb->transfer_buffer + d->offset;
812 			length = d->actual_length;
813 
814 			if ((frame = kmalloc(sizeof(struct urb_frame),
815 					     GFP_ATOMIC))) {
816 				unsigned long flags;
817 
818 				memcpy(frame->data, b, length);
819 				frame->length = length;
820 
821 				spin_lock_irqsave(&dec->urb_frame_list_lock,
822 						     flags);
823 				list_add_tail(&frame->urb_frame_list,
824 					      &dec->urb_frame_list);
825 				spin_unlock_irqrestore(&dec->urb_frame_list_lock,
826 						       flags);
827 
828 				tasklet_schedule(&dec->urb_tasklet);
829 			}
830 		}
831 	} else {
832 		 /* -ENOENT is expected when unlinking urbs */
833 		if (urb->status != -ENOENT)
834 			dprintk("%s: urb error: %d\n", __func__,
835 				urb->status);
836 	}
837 
838 	if (dec->iso_stream_count)
839 		usb_submit_urb(urb, GFP_ATOMIC);
840 }
841 
842 static void ttusb_dec_setup_urbs(struct ttusb_dec *dec)
843 {
844 	int i, j, buffer_offset = 0;
845 
846 	dprintk("%s\n", __func__);
847 
848 	for (i = 0; i < ISO_BUF_COUNT; i++) {
849 		int frame_offset = 0;
850 		struct urb *urb = dec->iso_urb[i];
851 
852 		urb->dev = dec->udev;
853 		urb->context = dec;
854 		urb->complete = ttusb_dec_process_urb;
855 		urb->pipe = dec->in_pipe;
856 		urb->transfer_flags = URB_ISO_ASAP;
857 		urb->interval = 1;
858 		urb->number_of_packets = FRAMES_PER_ISO_BUF;
859 		urb->transfer_buffer_length = ISO_FRAME_SIZE *
860 					      FRAMES_PER_ISO_BUF;
861 		urb->transfer_buffer = dec->iso_buffer + buffer_offset;
862 		buffer_offset += ISO_FRAME_SIZE * FRAMES_PER_ISO_BUF;
863 
864 		for (j = 0; j < FRAMES_PER_ISO_BUF; j++) {
865 			urb->iso_frame_desc[j].offset = frame_offset;
866 			urb->iso_frame_desc[j].length = ISO_FRAME_SIZE;
867 			frame_offset += ISO_FRAME_SIZE;
868 		}
869 	}
870 }
871 
872 static void ttusb_dec_stop_iso_xfer(struct ttusb_dec *dec)
873 {
874 	int i;
875 
876 	dprintk("%s\n", __func__);
877 
878 	if (mutex_lock_interruptible(&dec->iso_mutex))
879 		return;
880 
881 	dec->iso_stream_count--;
882 
883 	if (!dec->iso_stream_count) {
884 		for (i = 0; i < ISO_BUF_COUNT; i++)
885 			usb_kill_urb(dec->iso_urb[i]);
886 	}
887 
888 	mutex_unlock(&dec->iso_mutex);
889 }
890 
891 /* Setting the interface of the DEC tends to take down the USB communications
892  * for a short period, so it's important not to call this function just before
893  * trying to talk to it.
894  */
895 static int ttusb_dec_set_interface(struct ttusb_dec *dec,
896 				   enum ttusb_dec_interface interface)
897 {
898 	int result = 0;
899 	u8 b[] = { 0x05 };
900 
901 	if (interface != dec->interface) {
902 		switch (interface) {
903 		case TTUSB_DEC_INTERFACE_INITIAL:
904 			result = usb_set_interface(dec->udev, 0, 0);
905 			break;
906 		case TTUSB_DEC_INTERFACE_IN:
907 			result = ttusb_dec_send_command(dec, 0x80, sizeof(b),
908 							b, NULL, NULL);
909 			if (result)
910 				return result;
911 			result = usb_set_interface(dec->udev, 0, 8);
912 			break;
913 		case TTUSB_DEC_INTERFACE_OUT:
914 			result = usb_set_interface(dec->udev, 0, 1);
915 			break;
916 		}
917 
918 		if (result)
919 			return result;
920 
921 		dec->interface = interface;
922 	}
923 
924 	return 0;
925 }
926 
927 static int ttusb_dec_start_iso_xfer(struct ttusb_dec *dec)
928 {
929 	int i, result;
930 
931 	dprintk("%s\n", __func__);
932 
933 	if (mutex_lock_interruptible(&dec->iso_mutex))
934 		return -EAGAIN;
935 
936 	if (!dec->iso_stream_count) {
937 		ttusb_dec_setup_urbs(dec);
938 
939 		dec->packet_state = 0;
940 		dec->v_pes_postbytes = 0;
941 		dec->next_packet_id = 0;
942 
943 		for (i = 0; i < ISO_BUF_COUNT; i++) {
944 			if ((result = usb_submit_urb(dec->iso_urb[i],
945 						     GFP_ATOMIC))) {
946 				printk("%s: failed urb submission %d: error %d\n",
947 				       __func__, i, result);
948 
949 				while (i) {
950 					usb_kill_urb(dec->iso_urb[i - 1]);
951 					i--;
952 				}
953 
954 				mutex_unlock(&dec->iso_mutex);
955 				return result;
956 			}
957 		}
958 	}
959 
960 	dec->iso_stream_count++;
961 
962 	mutex_unlock(&dec->iso_mutex);
963 
964 	return 0;
965 }
966 
967 static int ttusb_dec_start_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
968 {
969 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
970 	struct ttusb_dec *dec = dvbdmx->priv;
971 	u8 b0[] = { 0x05 };
972 	int result = 0;
973 
974 	dprintk("%s\n", __func__);
975 
976 	dprintk("  ts_type:");
977 
978 	if (dvbdmxfeed->ts_type & TS_DECODER)
979 		dprintk(" TS_DECODER");
980 
981 	if (dvbdmxfeed->ts_type & TS_PACKET)
982 		dprintk(" TS_PACKET");
983 
984 	if (dvbdmxfeed->ts_type & TS_PAYLOAD_ONLY)
985 		dprintk(" TS_PAYLOAD_ONLY");
986 
987 	dprintk("\n");
988 
989 	switch (dvbdmxfeed->pes_type) {
990 
991 	case DMX_PES_VIDEO:
992 		dprintk("  pes_type: DMX_PES_VIDEO\n");
993 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
994 		dec->pid[DMX_PES_VIDEO] = dvbdmxfeed->pid;
995 		dec->video_filter = dvbdmxfeed->filter;
996 		ttusb_dec_set_pids(dec);
997 		break;
998 
999 	case DMX_PES_AUDIO:
1000 		dprintk("  pes_type: DMX_PES_AUDIO\n");
1001 		dec->pid[DMX_PES_AUDIO] = dvbdmxfeed->pid;
1002 		dec->audio_filter = dvbdmxfeed->filter;
1003 		ttusb_dec_set_pids(dec);
1004 		break;
1005 
1006 	case DMX_PES_TELETEXT:
1007 		dec->pid[DMX_PES_TELETEXT] = dvbdmxfeed->pid;
1008 		dprintk("  pes_type: DMX_PES_TELETEXT(not supported)\n");
1009 		return -ENOSYS;
1010 
1011 	case DMX_PES_PCR:
1012 		dprintk("  pes_type: DMX_PES_PCR\n");
1013 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
1014 		ttusb_dec_set_pids(dec);
1015 		break;
1016 
1017 	case DMX_PES_OTHER:
1018 		dprintk("  pes_type: DMX_PES_OTHER(not supported)\n");
1019 		return -ENOSYS;
1020 
1021 	default:
1022 		dprintk("  pes_type: unknown (%d)\n", dvbdmxfeed->pes_type);
1023 		return -EINVAL;
1024 
1025 	}
1026 
1027 	result = ttusb_dec_send_command(dec, 0x80, sizeof(b0), b0, NULL, NULL);
1028 	if (result)
1029 		return result;
1030 
1031 	dec->pva_stream_count++;
1032 	return ttusb_dec_start_iso_xfer(dec);
1033 }
1034 
1035 static int ttusb_dec_start_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1036 {
1037 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1038 	u8 b0[] = { 0x00, 0x00, 0x00, 0x01,
1039 		    0x00, 0x00, 0x00, 0x00,
1040 		    0x00, 0x00, 0x00, 0x00,
1041 		    0x00, 0x00, 0x00, 0x00,
1042 		    0x00, 0xff, 0x00, 0x00,
1043 		    0x00, 0x00, 0x00, 0x00,
1044 		    0x00, 0x00, 0x00, 0x00,
1045 		    0x00 };
1046 	__be16 pid;
1047 	u8 c[COMMAND_PACKET_SIZE];
1048 	int c_length;
1049 	int result;
1050 	struct filter_info *finfo;
1051 	unsigned long flags;
1052 	u8 x = 1;
1053 
1054 	dprintk("%s\n", __func__);
1055 
1056 	pid = htons(dvbdmxfeed->pid);
1057 	memcpy(&b0[0], &pid, 2);
1058 	memcpy(&b0[4], &x, 1);
1059 	memcpy(&b0[5], &dvbdmxfeed->filter->filter.filter_value[0], 1);
1060 
1061 	result = ttusb_dec_send_command(dec, 0x60, sizeof(b0), b0,
1062 					&c_length, c);
1063 
1064 	if (!result) {
1065 		if (c_length == 2) {
1066 			if (!(finfo = kmalloc(sizeof(struct filter_info),
1067 					      GFP_ATOMIC)))
1068 				return -ENOMEM;
1069 
1070 			finfo->stream_id = c[1];
1071 			finfo->filter = dvbdmxfeed->filter;
1072 
1073 			spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1074 			list_add_tail(&finfo->filter_info_list,
1075 				      &dec->filter_info_list);
1076 			spin_unlock_irqrestore(&dec->filter_info_list_lock,
1077 					       flags);
1078 
1079 			dvbdmxfeed->priv = finfo;
1080 
1081 			dec->filter_stream_count++;
1082 			return ttusb_dec_start_iso_xfer(dec);
1083 		}
1084 
1085 		return -EAGAIN;
1086 	} else
1087 		return result;
1088 }
1089 
1090 static int ttusb_dec_start_feed(struct dvb_demux_feed *dvbdmxfeed)
1091 {
1092 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
1093 
1094 	dprintk("%s\n", __func__);
1095 
1096 	if (!dvbdmx->dmx.frontend)
1097 		return -EINVAL;
1098 
1099 	dprintk("  pid: 0x%04X\n", dvbdmxfeed->pid);
1100 
1101 	switch (dvbdmxfeed->type) {
1102 
1103 	case DMX_TYPE_TS:
1104 		return ttusb_dec_start_ts_feed(dvbdmxfeed);
1105 
1106 	case DMX_TYPE_SEC:
1107 		return ttusb_dec_start_sec_feed(dvbdmxfeed);
1108 
1109 	default:
1110 		dprintk("  type: unknown (%d)\n", dvbdmxfeed->type);
1111 		return -EINVAL;
1112 
1113 	}
1114 }
1115 
1116 static int ttusb_dec_stop_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
1117 {
1118 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1119 	u8 b0[] = { 0x00 };
1120 
1121 	ttusb_dec_send_command(dec, 0x81, sizeof(b0), b0, NULL, NULL);
1122 
1123 	dec->pva_stream_count--;
1124 
1125 	ttusb_dec_stop_iso_xfer(dec);
1126 
1127 	return 0;
1128 }
1129 
1130 static int ttusb_dec_stop_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1131 {
1132 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1133 	u8 b0[] = { 0x00, 0x00 };
1134 	struct filter_info *finfo = (struct filter_info *)dvbdmxfeed->priv;
1135 	unsigned long flags;
1136 
1137 	b0[1] = finfo->stream_id;
1138 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1139 	list_del(&finfo->filter_info_list);
1140 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
1141 	kfree(finfo);
1142 	ttusb_dec_send_command(dec, 0x62, sizeof(b0), b0, NULL, NULL);
1143 
1144 	dec->filter_stream_count--;
1145 
1146 	ttusb_dec_stop_iso_xfer(dec);
1147 
1148 	return 0;
1149 }
1150 
1151 static int ttusb_dec_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
1152 {
1153 	dprintk("%s\n", __func__);
1154 
1155 	switch (dvbdmxfeed->type) {
1156 	case DMX_TYPE_TS:
1157 		return ttusb_dec_stop_ts_feed(dvbdmxfeed);
1158 
1159 	case DMX_TYPE_SEC:
1160 		return ttusb_dec_stop_sec_feed(dvbdmxfeed);
1161 	}
1162 
1163 	return 0;
1164 }
1165 
1166 static void ttusb_dec_free_iso_urbs(struct ttusb_dec *dec)
1167 {
1168 	int i;
1169 
1170 	dprintk("%s\n", __func__);
1171 
1172 	for (i = 0; i < ISO_BUF_COUNT; i++)
1173 		usb_free_urb(dec->iso_urb[i]);
1174 	kfree(dec->iso_buffer);
1175 }
1176 
1177 static int ttusb_dec_alloc_iso_urbs(struct ttusb_dec *dec)
1178 {
1179 	int i;
1180 
1181 	dprintk("%s\n", __func__);
1182 
1183 	dec->iso_buffer = kcalloc(FRAMES_PER_ISO_BUF * ISO_BUF_COUNT,
1184 			ISO_FRAME_SIZE, GFP_KERNEL);
1185 	if (!dec->iso_buffer)
1186 		return -ENOMEM;
1187 
1188 	for (i = 0; i < ISO_BUF_COUNT; i++) {
1189 		struct urb *urb;
1190 
1191 		if (!(urb = usb_alloc_urb(FRAMES_PER_ISO_BUF, GFP_ATOMIC))) {
1192 			ttusb_dec_free_iso_urbs(dec);
1193 			return -ENOMEM;
1194 		}
1195 
1196 		dec->iso_urb[i] = urb;
1197 	}
1198 
1199 	ttusb_dec_setup_urbs(dec);
1200 
1201 	return 0;
1202 }
1203 
1204 static void ttusb_dec_init_tasklet(struct ttusb_dec *dec)
1205 {
1206 	spin_lock_init(&dec->urb_frame_list_lock);
1207 	INIT_LIST_HEAD(&dec->urb_frame_list);
1208 	tasklet_setup(&dec->urb_tasklet, ttusb_dec_process_urb_frame_list);
1209 }
1210 
1211 static int ttusb_init_rc( struct ttusb_dec *dec)
1212 {
1213 	struct input_dev *input_dev;
1214 	u8 b[] = { 0x00, 0x01 };
1215 	int i;
1216 	int err;
1217 
1218 	usb_make_path(dec->udev, dec->rc_phys, sizeof(dec->rc_phys));
1219 	strlcat(dec->rc_phys, "/input0", sizeof(dec->rc_phys));
1220 
1221 	input_dev = input_allocate_device();
1222 	if (!input_dev)
1223 		return -ENOMEM;
1224 
1225 	input_dev->name = "ttusb_dec remote control";
1226 	input_dev->phys = dec->rc_phys;
1227 	input_dev->evbit[0] = BIT_MASK(EV_KEY);
1228 	input_dev->keycodesize = sizeof(u16);
1229 	input_dev->keycodemax = 0x1a;
1230 	input_dev->keycode = rc_keys;
1231 
1232 	for (i = 0; i < ARRAY_SIZE(rc_keys); i++)
1233 		  set_bit(rc_keys[i], input_dev->keybit);
1234 
1235 	err = input_register_device(input_dev);
1236 	if (err) {
1237 		input_free_device(input_dev);
1238 		return err;
1239 	}
1240 
1241 	dec->rc_input_dev = input_dev;
1242 	if (usb_submit_urb(dec->irq_urb, GFP_KERNEL))
1243 		printk("%s: usb_submit_urb failed\n",__func__);
1244 	/* enable irq pipe */
1245 	ttusb_dec_send_command(dec,0xb0,sizeof(b),b,NULL,NULL);
1246 
1247 	return 0;
1248 }
1249 
1250 static void ttusb_dec_init_v_pes(struct ttusb_dec *dec)
1251 {
1252 	dprintk("%s\n", __func__);
1253 
1254 	dec->v_pes[0] = 0x00;
1255 	dec->v_pes[1] = 0x00;
1256 	dec->v_pes[2] = 0x01;
1257 	dec->v_pes[3] = 0xe0;
1258 }
1259 
1260 static int ttusb_dec_init_usb(struct ttusb_dec *dec)
1261 {
1262 	int result;
1263 
1264 	dprintk("%s\n", __func__);
1265 
1266 	mutex_init(&dec->usb_mutex);
1267 	mutex_init(&dec->iso_mutex);
1268 
1269 	dec->command_pipe = usb_sndbulkpipe(dec->udev, COMMAND_PIPE);
1270 	dec->result_pipe = usb_rcvbulkpipe(dec->udev, RESULT_PIPE);
1271 	dec->in_pipe = usb_rcvisocpipe(dec->udev, IN_PIPE);
1272 	dec->out_pipe = usb_sndisocpipe(dec->udev, OUT_PIPE);
1273 	dec->irq_pipe = usb_rcvintpipe(dec->udev, IRQ_PIPE);
1274 
1275 	if(enable_rc) {
1276 		dec->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
1277 		if(!dec->irq_urb) {
1278 			return -ENOMEM;
1279 		}
1280 		dec->irq_buffer = usb_alloc_coherent(dec->udev,IRQ_PACKET_SIZE,
1281 					GFP_KERNEL, &dec->irq_dma_handle);
1282 		if(!dec->irq_buffer) {
1283 			usb_free_urb(dec->irq_urb);
1284 			return -ENOMEM;
1285 		}
1286 		usb_fill_int_urb(dec->irq_urb, dec->udev,dec->irq_pipe,
1287 				 dec->irq_buffer, IRQ_PACKET_SIZE,
1288 				 ttusb_dec_handle_irq, dec, 1);
1289 		dec->irq_urb->transfer_dma = dec->irq_dma_handle;
1290 		dec->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1291 	}
1292 
1293 	result = ttusb_dec_alloc_iso_urbs(dec);
1294 	if (result) {
1295 		usb_free_urb(dec->irq_urb);
1296 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1297 				  dec->irq_buffer, dec->irq_dma_handle);
1298 	}
1299 	return result;
1300 }
1301 
1302 static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
1303 {
1304 	int i, j, actual_len, result, size, trans_count;
1305 	u8 b0[] = { 0x00, 0x00, 0x00, 0x00,
1306 		    0x00, 0x00, 0x00, 0x00,
1307 		    0x61, 0x00 };
1308 	u8 b1[] = { 0x61 };
1309 	u8 *b;
1310 	char idstring[21];
1311 	const u8 *firmware = NULL;
1312 	size_t firmware_size = 0;
1313 	u16 firmware_csum = 0;
1314 	__be16 firmware_csum_ns;
1315 	__be32 firmware_size_nl;
1316 	u32 crc32_csum, crc32_check;
1317 	__be32 tmp;
1318 	const struct firmware *fw_entry = NULL;
1319 
1320 	dprintk("%s\n", __func__);
1321 
1322 	result = request_firmware(&fw_entry, dec->firmware_name, &dec->udev->dev);
1323 	if (result) {
1324 		printk(KERN_ERR "%s: Firmware (%s) unavailable.\n",
1325 		       __func__, dec->firmware_name);
1326 		return result;
1327 	}
1328 
1329 	firmware = fw_entry->data;
1330 	firmware_size = fw_entry->size;
1331 
1332 	if (firmware_size < 60) {
1333 		printk("%s: firmware size too small for DSP code (%zu < 60).\n",
1334 			__func__, firmware_size);
1335 		release_firmware(fw_entry);
1336 		return -ENOENT;
1337 	}
1338 
1339 	/* a 32 bit checksum over the first 56 bytes of the DSP Code is stored
1340 	   at offset 56 of file, so use it to check if the firmware file is
1341 	   valid. */
1342 	crc32_csum = crc32(~0L, firmware, 56) ^ ~0L;
1343 	memcpy(&tmp, &firmware[56], 4);
1344 	crc32_check = ntohl(tmp);
1345 	if (crc32_csum != crc32_check) {
1346 		printk("%s: crc32 check of DSP code failed (calculated 0x%08x != 0x%08x in file), file invalid.\n",
1347 			__func__, crc32_csum, crc32_check);
1348 		release_firmware(fw_entry);
1349 		return -ENOENT;
1350 	}
1351 	memcpy(idstring, &firmware[36], 20);
1352 	idstring[20] = '\0';
1353 	printk(KERN_INFO "ttusb_dec: found DSP code \"%s\".\n", idstring);
1354 
1355 	firmware_size_nl = htonl(firmware_size);
1356 	memcpy(b0, &firmware_size_nl, 4);
1357 	firmware_csum = crc16(~0, firmware, firmware_size) ^ ~0;
1358 	firmware_csum_ns = htons(firmware_csum);
1359 	memcpy(&b0[6], &firmware_csum_ns, 2);
1360 
1361 	result = ttusb_dec_send_command(dec, 0x41, sizeof(b0), b0, NULL, NULL);
1362 
1363 	if (result) {
1364 		release_firmware(fw_entry);
1365 		return result;
1366 	}
1367 
1368 	trans_count = 0;
1369 	j = 0;
1370 
1371 	b = kmalloc(ARM_PACKET_SIZE, GFP_KERNEL);
1372 	if (b == NULL) {
1373 		release_firmware(fw_entry);
1374 		return -ENOMEM;
1375 	}
1376 
1377 	for (i = 0; i < firmware_size; i += COMMAND_PACKET_SIZE) {
1378 		size = firmware_size - i;
1379 		if (size > COMMAND_PACKET_SIZE)
1380 			size = COMMAND_PACKET_SIZE;
1381 
1382 		b[j + 0] = 0xaa;
1383 		b[j + 1] = trans_count++;
1384 		b[j + 2] = 0xf0;
1385 		b[j + 3] = size;
1386 		memcpy(&b[j + 4], &firmware[i], size);
1387 
1388 		j += COMMAND_PACKET_SIZE + 4;
1389 
1390 		if (j >= ARM_PACKET_SIZE) {
1391 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1392 					      ARM_PACKET_SIZE, &actual_len,
1393 					      100);
1394 			j = 0;
1395 		} else if (size < COMMAND_PACKET_SIZE) {
1396 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1397 					      j - COMMAND_PACKET_SIZE + size,
1398 					      &actual_len, 100);
1399 		}
1400 	}
1401 
1402 	result = ttusb_dec_send_command(dec, 0x43, sizeof(b1), b1, NULL, NULL);
1403 
1404 	release_firmware(fw_entry);
1405 	kfree(b);
1406 
1407 	return result;
1408 }
1409 
1410 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
1411 {
1412 	int result;
1413 	unsigned int mode = 0, model = 0, version = 0;
1414 
1415 	dprintk("%s\n", __func__);
1416 
1417 	result = ttusb_dec_get_stb_state(dec, &mode, &model, &version);
1418 	if (result)
1419 		return result;
1420 
1421 	if (!mode) {
1422 		if (version == 0xABCDEFAB)
1423 			printk(KERN_INFO "ttusb_dec: no version info in Firmware\n");
1424 		else
1425 			printk(KERN_INFO "ttusb_dec: Firmware %x.%02x%c%c\n",
1426 			       version >> 24, (version >> 16) & 0xff,
1427 			       (version >> 8) & 0xff, version & 0xff);
1428 
1429 		result = ttusb_dec_boot_dsp(dec);
1430 		if (result)
1431 			return result;
1432 	} else {
1433 		/* We can't trust the USB IDs that some firmwares
1434 		   give the box */
1435 		switch (model) {
1436 		case 0x00070001:
1437 		case 0x00070008:
1438 		case 0x0007000c:
1439 			ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1440 			break;
1441 		case 0x00070009:
1442 		case 0x00070013:
1443 			ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1444 			break;
1445 		case 0x00070011:
1446 			ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1447 			break;
1448 		default:
1449 			printk(KERN_ERR "%s: unknown model returned by firmware (%08x) - please report\n",
1450 			       __func__, model);
1451 			return -ENOENT;
1452 		}
1453 		if (version >= 0x01770000)
1454 			dec->can_playback = 1;
1455 	}
1456 	return 0;
1457 }
1458 
1459 static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
1460 {
1461 	int result;
1462 
1463 	dprintk("%s\n", __func__);
1464 
1465 	if ((result = dvb_register_adapter(&dec->adapter,
1466 					   dec->model_name, THIS_MODULE,
1467 					   &dec->udev->dev,
1468 					   adapter_nr)) < 0) {
1469 		printk("%s: dvb_register_adapter failed: error %d\n",
1470 		       __func__, result);
1471 
1472 		return result;
1473 	}
1474 
1475 	dec->demux.dmx.capabilities = DMX_TS_FILTERING | DMX_SECTION_FILTERING;
1476 
1477 	dec->demux.priv = (void *)dec;
1478 	dec->demux.filternum = 31;
1479 	dec->demux.feednum = 31;
1480 	dec->demux.start_feed = ttusb_dec_start_feed;
1481 	dec->demux.stop_feed = ttusb_dec_stop_feed;
1482 	dec->demux.write_to_decoder = NULL;
1483 
1484 	if ((result = dvb_dmx_init(&dec->demux)) < 0) {
1485 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1486 		       result);
1487 
1488 		dvb_unregister_adapter(&dec->adapter);
1489 
1490 		return result;
1491 	}
1492 
1493 	dec->dmxdev.filternum = 32;
1494 	dec->dmxdev.demux = &dec->demux.dmx;
1495 	dec->dmxdev.capabilities = 0;
1496 
1497 	if ((result = dvb_dmxdev_init(&dec->dmxdev, &dec->adapter)) < 0) {
1498 		printk("%s: dvb_dmxdev_init failed: error %d\n",
1499 		       __func__, result);
1500 
1501 		dvb_dmx_release(&dec->demux);
1502 		dvb_unregister_adapter(&dec->adapter);
1503 
1504 		return result;
1505 	}
1506 
1507 	dec->frontend.source = DMX_FRONTEND_0;
1508 
1509 	if ((result = dec->demux.dmx.add_frontend(&dec->demux.dmx,
1510 						  &dec->frontend)) < 0) {
1511 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1512 		       result);
1513 
1514 		dvb_dmxdev_release(&dec->dmxdev);
1515 		dvb_dmx_release(&dec->demux);
1516 		dvb_unregister_adapter(&dec->adapter);
1517 
1518 		return result;
1519 	}
1520 
1521 	if ((result = dec->demux.dmx.connect_frontend(&dec->demux.dmx,
1522 						      &dec->frontend)) < 0) {
1523 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1524 		       result);
1525 
1526 		dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1527 		dvb_dmxdev_release(&dec->dmxdev);
1528 		dvb_dmx_release(&dec->demux);
1529 		dvb_unregister_adapter(&dec->adapter);
1530 
1531 		return result;
1532 	}
1533 
1534 	dvb_net_init(&dec->adapter, &dec->dvb_net, &dec->demux.dmx);
1535 
1536 	return 0;
1537 }
1538 
1539 static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
1540 {
1541 	dprintk("%s\n", __func__);
1542 
1543 	dvb_net_release(&dec->dvb_net);
1544 	dec->demux.dmx.close(&dec->demux.dmx);
1545 	dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1546 	dvb_dmxdev_release(&dec->dmxdev);
1547 	dvb_dmx_release(&dec->demux);
1548 	if (dec->fe) {
1549 		dvb_unregister_frontend(dec->fe);
1550 		if (dec->fe->ops.release)
1551 			dec->fe->ops.release(dec->fe);
1552 	}
1553 	dvb_unregister_adapter(&dec->adapter);
1554 }
1555 
1556 static void ttusb_dec_exit_rc(struct ttusb_dec *dec)
1557 {
1558 	dprintk("%s\n", __func__);
1559 
1560 	if (dec->rc_input_dev) {
1561 		input_unregister_device(dec->rc_input_dev);
1562 		dec->rc_input_dev = NULL;
1563 	}
1564 }
1565 
1566 
1567 static void ttusb_dec_exit_usb(struct ttusb_dec *dec)
1568 {
1569 	int i;
1570 
1571 	dprintk("%s\n", __func__);
1572 
1573 	if (enable_rc) {
1574 		/* we have to check whether the irq URB is already submitted.
1575 		 * As the irq is submitted after the interface is changed,
1576 		 * this is the best method i figured out.
1577 		 * Any others?*/
1578 		if (dec->interface == TTUSB_DEC_INTERFACE_IN)
1579 			usb_kill_urb(dec->irq_urb);
1580 
1581 		usb_free_urb(dec->irq_urb);
1582 
1583 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1584 				  dec->irq_buffer, dec->irq_dma_handle);
1585 	}
1586 
1587 	dec->iso_stream_count = 0;
1588 
1589 	for (i = 0; i < ISO_BUF_COUNT; i++)
1590 		usb_kill_urb(dec->iso_urb[i]);
1591 
1592 	ttusb_dec_free_iso_urbs(dec);
1593 }
1594 
1595 static void ttusb_dec_exit_tasklet(struct ttusb_dec *dec)
1596 {
1597 	struct list_head *item;
1598 	struct urb_frame *frame;
1599 
1600 	tasklet_kill(&dec->urb_tasklet);
1601 
1602 	while ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
1603 		frame = list_entry(item, struct urb_frame, urb_frame_list);
1604 		list_del(&frame->urb_frame_list);
1605 		kfree(frame);
1606 	}
1607 }
1608 
1609 static void ttusb_dec_init_filters(struct ttusb_dec *dec)
1610 {
1611 	INIT_LIST_HEAD(&dec->filter_info_list);
1612 	spin_lock_init(&dec->filter_info_list_lock);
1613 }
1614 
1615 static void ttusb_dec_exit_filters(struct ttusb_dec *dec)
1616 {
1617 	struct list_head *item;
1618 	struct filter_info *finfo;
1619 
1620 	while ((item = dec->filter_info_list.next) != &dec->filter_info_list) {
1621 		finfo = list_entry(item, struct filter_info, filter_info_list);
1622 		list_del(&finfo->filter_info_list);
1623 		kfree(finfo);
1624 	}
1625 }
1626 
1627 static int fe_send_command(struct dvb_frontend* fe, const u8 command,
1628 			   int param_length, const u8 params[],
1629 			   int *result_length, u8 cmd_result[])
1630 {
1631 	struct ttusb_dec* dec = fe->dvb->priv;
1632 	return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
1633 }
1634 
1635 static const struct ttusbdecfe_config fe_config = {
1636 	.send_command = fe_send_command
1637 };
1638 
1639 static int ttusb_dec_probe(struct usb_interface *intf,
1640 			   const struct usb_device_id *id)
1641 {
1642 	struct usb_device *udev;
1643 	struct ttusb_dec *dec;
1644 	int result;
1645 
1646 	dprintk("%s\n", __func__);
1647 
1648 	udev = interface_to_usbdev(intf);
1649 
1650 	if (!(dec = kzalloc(sizeof(struct ttusb_dec), GFP_KERNEL))) {
1651 		printk("%s: couldn't allocate memory.\n", __func__);
1652 		return -ENOMEM;
1653 	}
1654 
1655 	usb_set_intfdata(intf, (void *)dec);
1656 
1657 	switch (id->idProduct) {
1658 	case 0x1006:
1659 		ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1660 		break;
1661 
1662 	case 0x1008:
1663 		ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1664 		break;
1665 
1666 	case 0x1009:
1667 		ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1668 		break;
1669 	}
1670 
1671 	dec->udev = udev;
1672 
1673 	result = ttusb_dec_init_usb(dec);
1674 	if (result)
1675 		goto err_usb;
1676 	result = ttusb_dec_init_stb(dec);
1677 	if (result)
1678 		goto err_stb;
1679 	result = ttusb_dec_init_dvb(dec);
1680 	if (result)
1681 		goto err_stb;
1682 
1683 	dec->adapter.priv = dec;
1684 	switch (id->idProduct) {
1685 	case 0x1006:
1686 		dec->fe = ttusbdecfe_dvbs_attach(&fe_config);
1687 		break;
1688 
1689 	case 0x1008:
1690 	case 0x1009:
1691 		dec->fe = ttusbdecfe_dvbt_attach(&fe_config);
1692 		break;
1693 	}
1694 
1695 	if (dec->fe == NULL) {
1696 		printk("dvb-ttusb-dec: A frontend driver was not found for device [%04x:%04x]\n",
1697 		       le16_to_cpu(dec->udev->descriptor.idVendor),
1698 		       le16_to_cpu(dec->udev->descriptor.idProduct));
1699 	} else {
1700 		if (dvb_register_frontend(&dec->adapter, dec->fe)) {
1701 			printk("budget-ci: Frontend registration failed!\n");
1702 			if (dec->fe->ops.release)
1703 				dec->fe->ops.release(dec->fe);
1704 			dec->fe = NULL;
1705 		}
1706 	}
1707 
1708 	ttusb_dec_init_v_pes(dec);
1709 	ttusb_dec_init_filters(dec);
1710 	ttusb_dec_init_tasklet(dec);
1711 
1712 	dec->active = 1;
1713 
1714 	ttusb_dec_set_interface(dec, TTUSB_DEC_INTERFACE_IN);
1715 
1716 	if (enable_rc)
1717 		ttusb_init_rc(dec);
1718 
1719 	return 0;
1720 err_stb:
1721 	ttusb_dec_exit_usb(dec);
1722 err_usb:
1723 	kfree(dec);
1724 	return result;
1725 }
1726 
1727 static void ttusb_dec_disconnect(struct usb_interface *intf)
1728 {
1729 	struct ttusb_dec *dec = usb_get_intfdata(intf);
1730 
1731 	usb_set_intfdata(intf, NULL);
1732 
1733 	dprintk("%s\n", __func__);
1734 
1735 	if (dec->active) {
1736 		ttusb_dec_exit_tasklet(dec);
1737 		ttusb_dec_exit_filters(dec);
1738 		if(enable_rc)
1739 			ttusb_dec_exit_rc(dec);
1740 		ttusb_dec_exit_usb(dec);
1741 		ttusb_dec_exit_dvb(dec);
1742 	}
1743 
1744 	kfree(dec);
1745 }
1746 
1747 static void ttusb_dec_set_model(struct ttusb_dec *dec,
1748 				enum ttusb_dec_model model)
1749 {
1750 	dec->model = model;
1751 
1752 	switch (model) {
1753 	case TTUSB_DEC2000T:
1754 		dec->model_name = "DEC2000-t";
1755 		dec->firmware_name = "dvb-ttusb-dec-2000t.fw";
1756 		break;
1757 
1758 	case TTUSB_DEC2540T:
1759 		dec->model_name = "DEC2540-t";
1760 		dec->firmware_name = "dvb-ttusb-dec-2540t.fw";
1761 		break;
1762 
1763 	case TTUSB_DEC3000S:
1764 		dec->model_name = "DEC3000-s";
1765 		dec->firmware_name = "dvb-ttusb-dec-3000s.fw";
1766 		break;
1767 	}
1768 }
1769 
1770 static const struct usb_device_id ttusb_dec_table[] = {
1771 	{USB_DEVICE(0x0b48, 0x1006)},	/* DEC3000-s */
1772 	/*{USB_DEVICE(0x0b48, 0x1007)},	   Unconfirmed */
1773 	{USB_DEVICE(0x0b48, 0x1008)},	/* DEC2000-t */
1774 	{USB_DEVICE(0x0b48, 0x1009)},	/* DEC2540-t */
1775 	{}
1776 };
1777 
1778 static struct usb_driver ttusb_dec_driver = {
1779 	.name		= "ttusb-dec",
1780 	.probe		= ttusb_dec_probe,
1781 	.disconnect	= ttusb_dec_disconnect,
1782 	.id_table	= ttusb_dec_table,
1783 };
1784 
1785 module_usb_driver(ttusb_dec_driver);
1786 
1787 MODULE_AUTHOR("Alex Woods <linux-dvb@giblets.org>");
1788 MODULE_DESCRIPTION(DRIVER_NAME);
1789 MODULE_LICENSE("GPL");
1790 MODULE_DEVICE_TABLE(usb, ttusb_dec_table);
1791