1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * TTUSB DEC Driver
4  *
5  * Copyright (C) 2003-2004 Alex Woods <linux-dvb@giblets.org>
6  * IR support by Peter Beutner <p.beutner@gmx.net>
7  */
8 
9 #include <linux/list.h>
10 #include <linux/module.h>
11 #include <linux/pci.h>
12 #include <linux/slab.h>
13 #include <linux/spinlock.h>
14 #include <linux/usb.h>
15 #include <linux/interrupt.h>
16 #include <linux/firmware.h>
17 #include <linux/crc32.h>
18 #include <linux/init.h>
19 #include <linux/input.h>
20 
21 #include <linux/mutex.h>
22 
23 #include <media/dmxdev.h>
24 #include <media/dvb_demux.h>
25 #include <media/dvb_frontend.h>
26 #include <media/dvb_net.h>
27 #include "ttusbdecfe.h"
28 
29 static int debug;
30 static int output_pva;
31 static int enable_rc;
32 
33 module_param(debug, int, 0644);
34 MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
35 module_param(output_pva, int, 0444);
36 MODULE_PARM_DESC(output_pva, "Output PVA from dvr device (default:off)");
37 module_param(enable_rc, int, 0644);
38 MODULE_PARM_DESC(enable_rc, "Turn on/off IR remote control(default: off)");
39 
40 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
41 
42 #define dprintk	if (debug) printk
43 
44 #define DRIVER_NAME		"TechnoTrend/Hauppauge DEC USB"
45 
46 #define COMMAND_PIPE		0x03
47 #define RESULT_PIPE		0x04
48 #define IN_PIPE			0x08
49 #define OUT_PIPE		0x07
50 #define IRQ_PIPE		0x0A
51 
52 #define COMMAND_PACKET_SIZE	0x3c
53 #define ARM_PACKET_SIZE		0x1000
54 #define IRQ_PACKET_SIZE		0x8
55 
56 #define ISO_BUF_COUNT		0x04
57 #define FRAMES_PER_ISO_BUF	0x04
58 #define ISO_FRAME_SIZE		0x0380
59 
60 #define	MAX_PVA_LENGTH		6144
61 
62 enum ttusb_dec_model {
63 	TTUSB_DEC2000T,
64 	TTUSB_DEC2540T,
65 	TTUSB_DEC3000S
66 };
67 
68 enum ttusb_dec_packet_type {
69 	TTUSB_DEC_PACKET_PVA,
70 	TTUSB_DEC_PACKET_SECTION,
71 	TTUSB_DEC_PACKET_EMPTY
72 };
73 
74 enum ttusb_dec_interface {
75 	TTUSB_DEC_INTERFACE_INITIAL,
76 	TTUSB_DEC_INTERFACE_IN,
77 	TTUSB_DEC_INTERFACE_OUT
78 };
79 
80 typedef int (dvb_filter_pes2ts_cb_t) (void *, unsigned char *);
81 
82 struct dvb_filter_pes2ts {
83 	unsigned char buf[188];
84 	unsigned char cc;
85 	dvb_filter_pes2ts_cb_t *cb;
86 	void *priv;
87 };
88 
89 struct ttusb_dec {
90 	enum ttusb_dec_model		model;
91 	char				*model_name;
92 	char				*firmware_name;
93 	int				can_playback;
94 
95 	/* DVB bits */
96 	struct dvb_adapter		adapter;
97 	struct dmxdev			dmxdev;
98 	struct dvb_demux		demux;
99 	struct dmx_frontend		frontend;
100 	struct dvb_net			dvb_net;
101 	struct dvb_frontend*		fe;
102 
103 	u16			pid[DMX_PES_OTHER];
104 
105 	/* USB bits */
106 	struct usb_device		*udev;
107 	u8				trans_count;
108 	unsigned int			command_pipe;
109 	unsigned int			result_pipe;
110 	unsigned int			in_pipe;
111 	unsigned int			out_pipe;
112 	unsigned int			irq_pipe;
113 	enum ttusb_dec_interface	interface;
114 	struct mutex			usb_mutex;
115 
116 	void			*irq_buffer;
117 	struct urb		*irq_urb;
118 	dma_addr_t		irq_dma_handle;
119 	void			*iso_buffer;
120 	struct urb		*iso_urb[ISO_BUF_COUNT];
121 	int			iso_stream_count;
122 	struct mutex		iso_mutex;
123 
124 	u8				packet[MAX_PVA_LENGTH + 4];
125 	enum ttusb_dec_packet_type	packet_type;
126 	int				packet_state;
127 	int				packet_length;
128 	int				packet_payload_length;
129 	u16				next_packet_id;
130 
131 	int				pva_stream_count;
132 	int				filter_stream_count;
133 
134 	struct dvb_filter_pes2ts	a_pes2ts;
135 	struct dvb_filter_pes2ts	v_pes2ts;
136 
137 	u8			v_pes[16 + MAX_PVA_LENGTH];
138 	int			v_pes_length;
139 	int			v_pes_postbytes;
140 
141 	struct list_head	urb_frame_list;
142 	struct tasklet_struct	urb_tasklet;
143 	spinlock_t		urb_frame_list_lock;
144 
145 	struct dvb_demux_filter	*audio_filter;
146 	struct dvb_demux_filter	*video_filter;
147 	struct list_head	filter_info_list;
148 	spinlock_t		filter_info_list_lock;
149 
150 	struct input_dev	*rc_input_dev;
151 	char			rc_phys[64];
152 
153 	int			active; /* Loaded successfully */
154 };
155 
156 struct urb_frame {
157 	u8			data[ISO_FRAME_SIZE];
158 	int			length;
159 	struct list_head	urb_frame_list;
160 };
161 
162 struct filter_info {
163 	u8			stream_id;
164 	struct dvb_demux_filter	*filter;
165 	struct list_head	filter_info_list;
166 };
167 
168 static u16 rc_keys[] = {
169 	KEY_POWER,
170 	KEY_MUTE,
171 	KEY_1,
172 	KEY_2,
173 	KEY_3,
174 	KEY_4,
175 	KEY_5,
176 	KEY_6,
177 	KEY_7,
178 	KEY_8,
179 	KEY_9,
180 	KEY_0,
181 	KEY_CHANNELUP,
182 	KEY_VOLUMEDOWN,
183 	KEY_OK,
184 	KEY_VOLUMEUP,
185 	KEY_CHANNELDOWN,
186 	KEY_PREVIOUS,
187 	KEY_ESC,
188 	KEY_RED,
189 	KEY_GREEN,
190 	KEY_YELLOW,
191 	KEY_BLUE,
192 	KEY_OPTION,
193 	KEY_M,
194 	KEY_RADIO
195 };
196 
197 static void dvb_filter_pes2ts_init(struct dvb_filter_pes2ts *p2ts,
198 				   unsigned short pid,
199 				   dvb_filter_pes2ts_cb_t *cb, void *priv)
200 {
201 	unsigned char *buf=p2ts->buf;
202 
203 	buf[0]=0x47;
204 	buf[1]=(pid>>8);
205 	buf[2]=pid&0xff;
206 	p2ts->cc=0;
207 	p2ts->cb=cb;
208 	p2ts->priv=priv;
209 }
210 
211 static int dvb_filter_pes2ts(struct dvb_filter_pes2ts *p2ts,
212 			     unsigned char *pes, int len, int payload_start)
213 {
214 	unsigned char *buf=p2ts->buf;
215 	int ret=0, rest;
216 
217 	//len=6+((pes[4]<<8)|pes[5]);
218 
219 	if (payload_start)
220 		buf[1]|=0x40;
221 	else
222 		buf[1]&=~0x40;
223 	while (len>=184) {
224 		buf[3]=0x10|((p2ts->cc++)&0x0f);
225 		memcpy(buf+4, pes, 184);
226 		if ((ret=p2ts->cb(p2ts->priv, buf)))
227 			return ret;
228 		len-=184; pes+=184;
229 		buf[1]&=~0x40;
230 	}
231 	if (!len)
232 		return 0;
233 	buf[3]=0x30|((p2ts->cc++)&0x0f);
234 	rest=183-len;
235 	if (rest) {
236 		buf[5]=0x00;
237 		if (rest-1)
238 			memset(buf+6, 0xff, rest-1);
239 	}
240 	buf[4]=rest;
241 	memcpy(buf+5+rest, pes, len);
242 	return p2ts->cb(p2ts->priv, buf);
243 }
244 
245 static void ttusb_dec_set_model(struct ttusb_dec *dec,
246 				enum ttusb_dec_model model);
247 
248 static void ttusb_dec_handle_irq( struct urb *urb)
249 {
250 	struct ttusb_dec *dec = urb->context;
251 	char *buffer = dec->irq_buffer;
252 	int retval;
253 	int index = buffer[4];
254 
255 	switch(urb->status) {
256 		case 0: /*success*/
257 			break;
258 		case -ECONNRESET:
259 		case -ENOENT:
260 		case -ESHUTDOWN:
261 		case -ETIME:
262 			/* this urb is dead, cleanup */
263 			dprintk("%s:urb shutting down with status: %d\n",
264 					__func__, urb->status);
265 			return;
266 		default:
267 			dprintk("%s:nonzero status received: %d\n",
268 					__func__,urb->status);
269 			goto exit;
270 	}
271 
272 	if ((buffer[0] == 0x1) && (buffer[2] == 0x15))  {
273 		/*
274 		 * IR - Event
275 		 *
276 		 * this is an fact a bit too simple implementation;
277 		 * the box also reports a keyrepeat signal
278 		 * (with buffer[3] == 0x40) in an interval of ~100ms.
279 		 * But to handle this correctly we had to imlemenent some
280 		 * kind of timer which signals a 'key up' event if no
281 		 * keyrepeat signal is received for lets say 200ms.
282 		 * this should/could be added later ...
283 		 * for now lets report each signal as a key down and up
284 		 */
285 		if (index - 1 < ARRAY_SIZE(rc_keys)) {
286 			dprintk("%s:rc signal:%d\n", __func__, index);
287 			input_report_key(dec->rc_input_dev, rc_keys[index - 1], 1);
288 			input_sync(dec->rc_input_dev);
289 			input_report_key(dec->rc_input_dev, rc_keys[index - 1], 0);
290 			input_sync(dec->rc_input_dev);
291 		}
292 	}
293 
294 exit:
295 	retval = usb_submit_urb(urb, GFP_ATOMIC);
296 	if (retval)
297 		printk("%s - usb_commit_urb failed with result: %d\n",
298 			__func__, retval);
299 }
300 
301 static u16 crc16(u16 crc, const u8 *buf, size_t len)
302 {
303 	u16 tmp;
304 
305 	while (len--) {
306 		crc ^= *buf++;
307 		crc ^= (u8)crc >> 4;
308 		tmp = (u8)crc;
309 		crc ^= (tmp ^ (tmp << 1)) << 4;
310 	}
311 	return crc;
312 }
313 
314 static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
315 				  int param_length, const u8 params[],
316 				  int *result_length, u8 cmd_result[])
317 {
318 	int result, actual_len;
319 	u8 *b;
320 
321 	dprintk("%s\n", __func__);
322 
323 	b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
324 	if (!b)
325 		return -ENOMEM;
326 
327 	if ((result = mutex_lock_interruptible(&dec->usb_mutex))) {
328 		kfree(b);
329 		printk("%s: Failed to lock usb mutex.\n", __func__);
330 		return result;
331 	}
332 
333 	b[0] = 0xaa;
334 	b[1] = ++dec->trans_count;
335 	b[2] = command;
336 	b[3] = param_length;
337 
338 	if (params)
339 		memcpy(&b[4], params, param_length);
340 
341 	if (debug) {
342 		printk(KERN_DEBUG "%s: command: %*ph\n",
343 		       __func__, param_length, b);
344 	}
345 
346 	result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
347 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
348 
349 	if (result) {
350 		printk("%s: command bulk message failed: error %d\n",
351 		       __func__, result);
352 		mutex_unlock(&dec->usb_mutex);
353 		kfree(b);
354 		return result;
355 	}
356 
357 	result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
358 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
359 
360 	if (result) {
361 		printk("%s: result bulk message failed: error %d\n",
362 		       __func__, result);
363 		mutex_unlock(&dec->usb_mutex);
364 		kfree(b);
365 		return result;
366 	} else {
367 		if (debug) {
368 			printk(KERN_DEBUG "%s: result: %*ph\n",
369 			       __func__, actual_len, b);
370 		}
371 
372 		if (result_length)
373 			*result_length = b[3];
374 		if (cmd_result && b[3] > 0)
375 			memcpy(cmd_result, &b[4], b[3]);
376 
377 		mutex_unlock(&dec->usb_mutex);
378 
379 		kfree(b);
380 		return 0;
381 	}
382 }
383 
384 static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode,
385 				    unsigned int *model, unsigned int *version)
386 {
387 	u8 c[COMMAND_PACKET_SIZE];
388 	int c_length;
389 	int result;
390 	__be32 tmp;
391 
392 	dprintk("%s\n", __func__);
393 
394 	result = ttusb_dec_send_command(dec, 0x08, 0, NULL, &c_length, c);
395 	if (result)
396 		return result;
397 
398 	if (c_length >= 0x0c) {
399 		if (mode != NULL) {
400 			memcpy(&tmp, c, 4);
401 			*mode = ntohl(tmp);
402 		}
403 		if (model != NULL) {
404 			memcpy(&tmp, &c[4], 4);
405 			*model = ntohl(tmp);
406 		}
407 		if (version != NULL) {
408 			memcpy(&tmp, &c[8], 4);
409 			*version = ntohl(tmp);
410 		}
411 		return 0;
412 	} else {
413 		return -ENOENT;
414 	}
415 }
416 
417 static int ttusb_dec_audio_pes2ts_cb(void *priv, unsigned char *data)
418 {
419 	struct ttusb_dec *dec = priv;
420 
421 	dec->audio_filter->feed->cb.ts(data, 188, NULL, 0,
422 				       &dec->audio_filter->feed->feed.ts, NULL);
423 
424 	return 0;
425 }
426 
427 static int ttusb_dec_video_pes2ts_cb(void *priv, unsigned char *data)
428 {
429 	struct ttusb_dec *dec = priv;
430 
431 	dec->video_filter->feed->cb.ts(data, 188, NULL, 0,
432 				       &dec->video_filter->feed->feed.ts, NULL);
433 
434 	return 0;
435 }
436 
437 static void ttusb_dec_set_pids(struct ttusb_dec *dec)
438 {
439 	u8 b[] = { 0x00, 0x00, 0x00, 0x00,
440 		   0x00, 0x00, 0xff, 0xff,
441 		   0xff, 0xff, 0xff, 0xff };
442 
443 	__be16 pcr = htons(dec->pid[DMX_PES_PCR]);
444 	__be16 audio = htons(dec->pid[DMX_PES_AUDIO]);
445 	__be16 video = htons(dec->pid[DMX_PES_VIDEO]);
446 
447 	dprintk("%s\n", __func__);
448 
449 	memcpy(&b[0], &pcr, 2);
450 	memcpy(&b[2], &audio, 2);
451 	memcpy(&b[4], &video, 2);
452 
453 	ttusb_dec_send_command(dec, 0x50, sizeof(b), b, NULL, NULL);
454 
455 	dvb_filter_pes2ts_init(&dec->a_pes2ts, dec->pid[DMX_PES_AUDIO],
456 			       ttusb_dec_audio_pes2ts_cb, dec);
457 	dvb_filter_pes2ts_init(&dec->v_pes2ts, dec->pid[DMX_PES_VIDEO],
458 			       ttusb_dec_video_pes2ts_cb, dec);
459 	dec->v_pes_length = 0;
460 	dec->v_pes_postbytes = 0;
461 }
462 
463 static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
464 {
465 	if (length < 8) {
466 		printk("%s: packet too short - discarding\n", __func__);
467 		return;
468 	}
469 
470 	if (length > 8 + MAX_PVA_LENGTH) {
471 		printk("%s: packet too long - discarding\n", __func__);
472 		return;
473 	}
474 
475 	switch (pva[2]) {
476 
477 	case 0x01: {		/* VideoStream */
478 		int prebytes = pva[5] & 0x03;
479 		int postbytes = (pva[5] & 0x0c) >> 2;
480 		__be16 v_pes_payload_length;
481 
482 		if (output_pva) {
483 			dec->video_filter->feed->cb.ts(pva, length, NULL, 0,
484 				&dec->video_filter->feed->feed.ts, NULL);
485 			return;
486 		}
487 
488 		if (dec->v_pes_postbytes > 0 &&
489 		    dec->v_pes_postbytes == prebytes) {
490 			memcpy(&dec->v_pes[dec->v_pes_length],
491 			       &pva[12], prebytes);
492 
493 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
494 					  dec->v_pes_length + prebytes, 1);
495 		}
496 
497 		if (pva[5] & 0x10) {
498 			dec->v_pes[7] = 0x80;
499 			dec->v_pes[8] = 0x05;
500 
501 			dec->v_pes[9] = 0x21 | ((pva[8] & 0xc0) >> 5);
502 			dec->v_pes[10] = ((pva[8] & 0x3f) << 2) |
503 					 ((pva[9] & 0xc0) >> 6);
504 			dec->v_pes[11] = 0x01 |
505 					 ((pva[9] & 0x3f) << 2) |
506 					 ((pva[10] & 0x80) >> 6);
507 			dec->v_pes[12] = ((pva[10] & 0x7f) << 1) |
508 					 ((pva[11] & 0xc0) >> 7);
509 			dec->v_pes[13] = 0x01 | ((pva[11] & 0x7f) << 1);
510 
511 			memcpy(&dec->v_pes[14], &pva[12 + prebytes],
512 			       length - 12 - prebytes);
513 			dec->v_pes_length = 14 + length - 12 - prebytes;
514 		} else {
515 			dec->v_pes[7] = 0x00;
516 			dec->v_pes[8] = 0x00;
517 
518 			memcpy(&dec->v_pes[9], &pva[8], length - 8);
519 			dec->v_pes_length = 9 + length - 8;
520 		}
521 
522 		dec->v_pes_postbytes = postbytes;
523 
524 		if (dec->v_pes[9 + dec->v_pes[8]] == 0x00 &&
525 		    dec->v_pes[10 + dec->v_pes[8]] == 0x00 &&
526 		    dec->v_pes[11 + dec->v_pes[8]] == 0x01)
527 			dec->v_pes[6] = 0x84;
528 		else
529 			dec->v_pes[6] = 0x80;
530 
531 		v_pes_payload_length = htons(dec->v_pes_length - 6 +
532 					     postbytes);
533 		memcpy(&dec->v_pes[4], &v_pes_payload_length, 2);
534 
535 		if (postbytes == 0)
536 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
537 					  dec->v_pes_length, 1);
538 
539 		break;
540 	}
541 
542 	case 0x02:		/* MainAudioStream */
543 		if (output_pva) {
544 			dec->audio_filter->feed->cb.ts(pva, length, NULL, 0,
545 				&dec->audio_filter->feed->feed.ts, NULL);
546 			return;
547 		}
548 
549 		dvb_filter_pes2ts(&dec->a_pes2ts, &pva[8], length - 8,
550 				  pva[5] & 0x10);
551 		break;
552 
553 	default:
554 		printk("%s: unknown PVA type: %02x.\n", __func__,
555 		       pva[2]);
556 		break;
557 	}
558 }
559 
560 static void ttusb_dec_process_filter(struct ttusb_dec *dec, u8 *packet,
561 				     int length)
562 {
563 	struct list_head *item;
564 	struct filter_info *finfo;
565 	struct dvb_demux_filter *filter = NULL;
566 	unsigned long flags;
567 	u8 sid;
568 
569 	sid = packet[1];
570 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
571 	for (item = dec->filter_info_list.next; item != &dec->filter_info_list;
572 	     item = item->next) {
573 		finfo = list_entry(item, struct filter_info, filter_info_list);
574 		if (finfo->stream_id == sid) {
575 			filter = finfo->filter;
576 			break;
577 		}
578 	}
579 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
580 
581 	if (filter)
582 		filter->feed->cb.sec(&packet[2], length - 2, NULL, 0,
583 				     &filter->filter, NULL);
584 }
585 
586 static void ttusb_dec_process_packet(struct ttusb_dec *dec)
587 {
588 	int i;
589 	u16 csum = 0;
590 	u16 packet_id;
591 
592 	if (dec->packet_length % 2) {
593 		printk("%s: odd sized packet - discarding\n", __func__);
594 		return;
595 	}
596 
597 	for (i = 0; i < dec->packet_length; i += 2)
598 		csum ^= ((dec->packet[i] << 8) + dec->packet[i + 1]);
599 
600 	if (csum) {
601 		printk("%s: checksum failed - discarding\n", __func__);
602 		return;
603 	}
604 
605 	packet_id = dec->packet[dec->packet_length - 4] << 8;
606 	packet_id += dec->packet[dec->packet_length - 3];
607 
608 	if ((packet_id != dec->next_packet_id) && dec->next_packet_id) {
609 		printk("%s: warning: lost packets between %u and %u\n",
610 		       __func__, dec->next_packet_id - 1, packet_id);
611 	}
612 
613 	if (packet_id == 0xffff)
614 		dec->next_packet_id = 0x8000;
615 	else
616 		dec->next_packet_id = packet_id + 1;
617 
618 	switch (dec->packet_type) {
619 	case TTUSB_DEC_PACKET_PVA:
620 		if (dec->pva_stream_count)
621 			ttusb_dec_process_pva(dec, dec->packet,
622 					      dec->packet_payload_length);
623 		break;
624 
625 	case TTUSB_DEC_PACKET_SECTION:
626 		if (dec->filter_stream_count)
627 			ttusb_dec_process_filter(dec, dec->packet,
628 						 dec->packet_payload_length);
629 		break;
630 
631 	case TTUSB_DEC_PACKET_EMPTY:
632 		break;
633 	}
634 }
635 
636 static void swap_bytes(u8 *b, int length)
637 {
638 	length -= length % 2;
639 	for (; length; b += 2, length -= 2)
640 		swap(*b, *(b + 1));
641 }
642 
643 static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,
644 					int length)
645 {
646 	swap_bytes(b, length);
647 
648 	while (length) {
649 		switch (dec->packet_state) {
650 
651 		case 0:
652 		case 1:
653 		case 2:
654 			if (*b++ == 0xaa)
655 				dec->packet_state++;
656 			else
657 				dec->packet_state = 0;
658 
659 			length--;
660 			break;
661 
662 		case 3:
663 			if (*b == 0x00) {
664 				dec->packet_state++;
665 				dec->packet_length = 0;
666 			} else if (*b != 0xaa) {
667 				dec->packet_state = 0;
668 			}
669 
670 			b++;
671 			length--;
672 			break;
673 
674 		case 4:
675 			dec->packet[dec->packet_length++] = *b++;
676 
677 			if (dec->packet_length == 2) {
678 				if (dec->packet[0] == 'A' &&
679 				    dec->packet[1] == 'V') {
680 					dec->packet_type =
681 						TTUSB_DEC_PACKET_PVA;
682 					dec->packet_state++;
683 				} else if (dec->packet[0] == 'S') {
684 					dec->packet_type =
685 						TTUSB_DEC_PACKET_SECTION;
686 					dec->packet_state++;
687 				} else if (dec->packet[0] == 0x00) {
688 					dec->packet_type =
689 						TTUSB_DEC_PACKET_EMPTY;
690 					dec->packet_payload_length = 2;
691 					dec->packet_state = 7;
692 				} else {
693 					printk("%s: unknown packet type: %02x%02x\n",
694 					       __func__,
695 					       dec->packet[0], dec->packet[1]);
696 					dec->packet_state = 0;
697 				}
698 			}
699 
700 			length--;
701 			break;
702 
703 		case 5:
704 			dec->packet[dec->packet_length++] = *b++;
705 
706 			if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
707 			    dec->packet_length == 8) {
708 				dec->packet_state++;
709 				dec->packet_payload_length = 8 +
710 					(dec->packet[6] << 8) +
711 					dec->packet[7];
712 			} else if (dec->packet_type ==
713 					TTUSB_DEC_PACKET_SECTION &&
714 				   dec->packet_length == 5) {
715 				dec->packet_state++;
716 				dec->packet_payload_length = 5 +
717 					((dec->packet[3] & 0x0f) << 8) +
718 					dec->packet[4];
719 			}
720 
721 			length--;
722 			break;
723 
724 		case 6: {
725 			int remainder = dec->packet_payload_length -
726 					dec->packet_length;
727 
728 			if (length >= remainder) {
729 				memcpy(dec->packet + dec->packet_length,
730 				       b, remainder);
731 				dec->packet_length += remainder;
732 				b += remainder;
733 				length -= remainder;
734 				dec->packet_state++;
735 			} else {
736 				memcpy(&dec->packet[dec->packet_length],
737 				       b, length);
738 				dec->packet_length += length;
739 				length = 0;
740 			}
741 
742 			break;
743 		}
744 
745 		case 7: {
746 			int tail = 4;
747 
748 			dec->packet[dec->packet_length++] = *b++;
749 
750 			if (dec->packet_type == TTUSB_DEC_PACKET_SECTION &&
751 			    dec->packet_payload_length % 2)
752 				tail++;
753 
754 			if (dec->packet_length ==
755 			    dec->packet_payload_length + tail) {
756 				ttusb_dec_process_packet(dec);
757 				dec->packet_state = 0;
758 			}
759 
760 			length--;
761 			break;
762 		}
763 
764 		default:
765 			printk("%s: illegal packet state encountered.\n",
766 			       __func__);
767 			dec->packet_state = 0;
768 		}
769 	}
770 }
771 
772 static void ttusb_dec_process_urb_frame_list(struct tasklet_struct *t)
773 {
774 	struct ttusb_dec *dec = from_tasklet(dec, t, urb_tasklet);
775 	struct list_head *item;
776 	struct urb_frame *frame;
777 	unsigned long flags;
778 
779 	while (1) {
780 		spin_lock_irqsave(&dec->urb_frame_list_lock, flags);
781 		if ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
782 			frame = list_entry(item, struct urb_frame,
783 					   urb_frame_list);
784 			list_del(&frame->urb_frame_list);
785 		} else {
786 			spin_unlock_irqrestore(&dec->urb_frame_list_lock,
787 					       flags);
788 			return;
789 		}
790 		spin_unlock_irqrestore(&dec->urb_frame_list_lock, flags);
791 
792 		ttusb_dec_process_urb_frame(dec, frame->data, frame->length);
793 		kfree(frame);
794 	}
795 }
796 
797 static void ttusb_dec_process_urb(struct urb *urb)
798 {
799 	struct ttusb_dec *dec = urb->context;
800 
801 	if (!urb->status) {
802 		int i;
803 
804 		for (i = 0; i < FRAMES_PER_ISO_BUF; i++) {
805 			struct usb_iso_packet_descriptor *d;
806 			u8 *b;
807 			int length;
808 			struct urb_frame *frame;
809 
810 			d = &urb->iso_frame_desc[i];
811 			b = urb->transfer_buffer + d->offset;
812 			length = d->actual_length;
813 
814 			if ((frame = kmalloc(sizeof(struct urb_frame),
815 					     GFP_ATOMIC))) {
816 				unsigned long flags;
817 
818 				memcpy(frame->data, b, length);
819 				frame->length = length;
820 
821 				spin_lock_irqsave(&dec->urb_frame_list_lock,
822 						     flags);
823 				list_add_tail(&frame->urb_frame_list,
824 					      &dec->urb_frame_list);
825 				spin_unlock_irqrestore(&dec->urb_frame_list_lock,
826 						       flags);
827 
828 				tasklet_schedule(&dec->urb_tasklet);
829 			}
830 		}
831 	} else {
832 		 /* -ENOENT is expected when unlinking urbs */
833 		if (urb->status != -ENOENT)
834 			dprintk("%s: urb error: %d\n", __func__,
835 				urb->status);
836 	}
837 
838 	if (dec->iso_stream_count)
839 		usb_submit_urb(urb, GFP_ATOMIC);
840 }
841 
842 static void ttusb_dec_setup_urbs(struct ttusb_dec *dec)
843 {
844 	int i, j, buffer_offset = 0;
845 
846 	dprintk("%s\n", __func__);
847 
848 	for (i = 0; i < ISO_BUF_COUNT; i++) {
849 		int frame_offset = 0;
850 		struct urb *urb = dec->iso_urb[i];
851 
852 		urb->dev = dec->udev;
853 		urb->context = dec;
854 		urb->complete = ttusb_dec_process_urb;
855 		urb->pipe = dec->in_pipe;
856 		urb->transfer_flags = URB_ISO_ASAP;
857 		urb->interval = 1;
858 		urb->number_of_packets = FRAMES_PER_ISO_BUF;
859 		urb->transfer_buffer_length = ISO_FRAME_SIZE *
860 					      FRAMES_PER_ISO_BUF;
861 		urb->transfer_buffer = dec->iso_buffer + buffer_offset;
862 		buffer_offset += ISO_FRAME_SIZE * FRAMES_PER_ISO_BUF;
863 
864 		for (j = 0; j < FRAMES_PER_ISO_BUF; j++) {
865 			urb->iso_frame_desc[j].offset = frame_offset;
866 			urb->iso_frame_desc[j].length = ISO_FRAME_SIZE;
867 			frame_offset += ISO_FRAME_SIZE;
868 		}
869 	}
870 }
871 
872 static void ttusb_dec_stop_iso_xfer(struct ttusb_dec *dec)
873 {
874 	int i;
875 
876 	dprintk("%s\n", __func__);
877 
878 	if (mutex_lock_interruptible(&dec->iso_mutex))
879 		return;
880 
881 	dec->iso_stream_count--;
882 
883 	if (!dec->iso_stream_count) {
884 		for (i = 0; i < ISO_BUF_COUNT; i++)
885 			usb_kill_urb(dec->iso_urb[i]);
886 	}
887 
888 	mutex_unlock(&dec->iso_mutex);
889 }
890 
891 /* Setting the interface of the DEC tends to take down the USB communications
892  * for a short period, so it's important not to call this function just before
893  * trying to talk to it.
894  */
895 static int ttusb_dec_set_interface(struct ttusb_dec *dec,
896 				   enum ttusb_dec_interface interface)
897 {
898 	int result = 0;
899 	u8 b[] = { 0x05 };
900 
901 	if (interface != dec->interface) {
902 		switch (interface) {
903 		case TTUSB_DEC_INTERFACE_INITIAL:
904 			result = usb_set_interface(dec->udev, 0, 0);
905 			break;
906 		case TTUSB_DEC_INTERFACE_IN:
907 			result = ttusb_dec_send_command(dec, 0x80, sizeof(b),
908 							b, NULL, NULL);
909 			if (result)
910 				return result;
911 			result = usb_set_interface(dec->udev, 0, 8);
912 			break;
913 		case TTUSB_DEC_INTERFACE_OUT:
914 			result = usb_set_interface(dec->udev, 0, 1);
915 			break;
916 		}
917 
918 		if (result)
919 			return result;
920 
921 		dec->interface = interface;
922 	}
923 
924 	return 0;
925 }
926 
927 static int ttusb_dec_start_iso_xfer(struct ttusb_dec *dec)
928 {
929 	int i, result;
930 
931 	dprintk("%s\n", __func__);
932 
933 	if (mutex_lock_interruptible(&dec->iso_mutex))
934 		return -EAGAIN;
935 
936 	if (!dec->iso_stream_count) {
937 		ttusb_dec_setup_urbs(dec);
938 
939 		dec->packet_state = 0;
940 		dec->v_pes_postbytes = 0;
941 		dec->next_packet_id = 0;
942 
943 		for (i = 0; i < ISO_BUF_COUNT; i++) {
944 			if ((result = usb_submit_urb(dec->iso_urb[i],
945 						     GFP_ATOMIC))) {
946 				printk("%s: failed urb submission %d: error %d\n",
947 				       __func__, i, result);
948 
949 				while (i) {
950 					usb_kill_urb(dec->iso_urb[i - 1]);
951 					i--;
952 				}
953 
954 				mutex_unlock(&dec->iso_mutex);
955 				return result;
956 			}
957 		}
958 	}
959 
960 	dec->iso_stream_count++;
961 
962 	mutex_unlock(&dec->iso_mutex);
963 
964 	return 0;
965 }
966 
967 static int ttusb_dec_start_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
968 {
969 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
970 	struct ttusb_dec *dec = dvbdmx->priv;
971 	u8 b0[] = { 0x05 };
972 	int result = 0;
973 
974 	dprintk("%s\n", __func__);
975 
976 	dprintk("  ts_type:");
977 
978 	if (dvbdmxfeed->ts_type & TS_DECODER)
979 		dprintk(" TS_DECODER");
980 
981 	if (dvbdmxfeed->ts_type & TS_PACKET)
982 		dprintk(" TS_PACKET");
983 
984 	if (dvbdmxfeed->ts_type & TS_PAYLOAD_ONLY)
985 		dprintk(" TS_PAYLOAD_ONLY");
986 
987 	dprintk("\n");
988 
989 	switch (dvbdmxfeed->pes_type) {
990 
991 	case DMX_PES_VIDEO:
992 		dprintk("  pes_type: DMX_PES_VIDEO\n");
993 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
994 		dec->pid[DMX_PES_VIDEO] = dvbdmxfeed->pid;
995 		dec->video_filter = dvbdmxfeed->filter;
996 		ttusb_dec_set_pids(dec);
997 		break;
998 
999 	case DMX_PES_AUDIO:
1000 		dprintk("  pes_type: DMX_PES_AUDIO\n");
1001 		dec->pid[DMX_PES_AUDIO] = dvbdmxfeed->pid;
1002 		dec->audio_filter = dvbdmxfeed->filter;
1003 		ttusb_dec_set_pids(dec);
1004 		break;
1005 
1006 	case DMX_PES_TELETEXT:
1007 		dec->pid[DMX_PES_TELETEXT] = dvbdmxfeed->pid;
1008 		dprintk("  pes_type: DMX_PES_TELETEXT(not supported)\n");
1009 		return -ENOSYS;
1010 
1011 	case DMX_PES_PCR:
1012 		dprintk("  pes_type: DMX_PES_PCR\n");
1013 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
1014 		ttusb_dec_set_pids(dec);
1015 		break;
1016 
1017 	case DMX_PES_OTHER:
1018 		dprintk("  pes_type: DMX_PES_OTHER(not supported)\n");
1019 		return -ENOSYS;
1020 
1021 	default:
1022 		dprintk("  pes_type: unknown (%d)\n", dvbdmxfeed->pes_type);
1023 		return -EINVAL;
1024 
1025 	}
1026 
1027 	result = ttusb_dec_send_command(dec, 0x80, sizeof(b0), b0, NULL, NULL);
1028 	if (result)
1029 		return result;
1030 
1031 	dec->pva_stream_count++;
1032 	return ttusb_dec_start_iso_xfer(dec);
1033 }
1034 
1035 static int ttusb_dec_start_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1036 {
1037 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1038 	u8 b0[] = { 0x00, 0x00, 0x00, 0x01,
1039 		    0x00, 0x00, 0x00, 0x00,
1040 		    0x00, 0x00, 0x00, 0x00,
1041 		    0x00, 0x00, 0x00, 0x00,
1042 		    0x00, 0xff, 0x00, 0x00,
1043 		    0x00, 0x00, 0x00, 0x00,
1044 		    0x00, 0x00, 0x00, 0x00,
1045 		    0x00 };
1046 	__be16 pid;
1047 	u8 c[COMMAND_PACKET_SIZE];
1048 	int c_length;
1049 	int result;
1050 	struct filter_info *finfo;
1051 	unsigned long flags;
1052 	u8 x = 1;
1053 
1054 	dprintk("%s\n", __func__);
1055 
1056 	pid = htons(dvbdmxfeed->pid);
1057 	memcpy(&b0[0], &pid, 2);
1058 	memcpy(&b0[4], &x, 1);
1059 	memcpy(&b0[5], &dvbdmxfeed->filter->filter.filter_value[0], 1);
1060 
1061 	result = ttusb_dec_send_command(dec, 0x60, sizeof(b0), b0,
1062 					&c_length, c);
1063 
1064 	if (!result) {
1065 		if (c_length == 2) {
1066 			if (!(finfo = kmalloc(sizeof(struct filter_info),
1067 					      GFP_ATOMIC)))
1068 				return -ENOMEM;
1069 
1070 			finfo->stream_id = c[1];
1071 			finfo->filter = dvbdmxfeed->filter;
1072 
1073 			spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1074 			list_add_tail(&finfo->filter_info_list,
1075 				      &dec->filter_info_list);
1076 			spin_unlock_irqrestore(&dec->filter_info_list_lock,
1077 					       flags);
1078 
1079 			dvbdmxfeed->priv = finfo;
1080 
1081 			dec->filter_stream_count++;
1082 			return ttusb_dec_start_iso_xfer(dec);
1083 		}
1084 
1085 		return -EAGAIN;
1086 	} else
1087 		return result;
1088 }
1089 
1090 static int ttusb_dec_start_feed(struct dvb_demux_feed *dvbdmxfeed)
1091 {
1092 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
1093 
1094 	dprintk("%s\n", __func__);
1095 
1096 	if (!dvbdmx->dmx.frontend)
1097 		return -EINVAL;
1098 
1099 	dprintk("  pid: 0x%04X\n", dvbdmxfeed->pid);
1100 
1101 	switch (dvbdmxfeed->type) {
1102 
1103 	case DMX_TYPE_TS:
1104 		return ttusb_dec_start_ts_feed(dvbdmxfeed);
1105 		break;
1106 
1107 	case DMX_TYPE_SEC:
1108 		return ttusb_dec_start_sec_feed(dvbdmxfeed);
1109 		break;
1110 
1111 	default:
1112 		dprintk("  type: unknown (%d)\n", dvbdmxfeed->type);
1113 		return -EINVAL;
1114 
1115 	}
1116 }
1117 
1118 static int ttusb_dec_stop_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
1119 {
1120 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1121 	u8 b0[] = { 0x00 };
1122 
1123 	ttusb_dec_send_command(dec, 0x81, sizeof(b0), b0, NULL, NULL);
1124 
1125 	dec->pva_stream_count--;
1126 
1127 	ttusb_dec_stop_iso_xfer(dec);
1128 
1129 	return 0;
1130 }
1131 
1132 static int ttusb_dec_stop_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1133 {
1134 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1135 	u8 b0[] = { 0x00, 0x00 };
1136 	struct filter_info *finfo = (struct filter_info *)dvbdmxfeed->priv;
1137 	unsigned long flags;
1138 
1139 	b0[1] = finfo->stream_id;
1140 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1141 	list_del(&finfo->filter_info_list);
1142 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
1143 	kfree(finfo);
1144 	ttusb_dec_send_command(dec, 0x62, sizeof(b0), b0, NULL, NULL);
1145 
1146 	dec->filter_stream_count--;
1147 
1148 	ttusb_dec_stop_iso_xfer(dec);
1149 
1150 	return 0;
1151 }
1152 
1153 static int ttusb_dec_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
1154 {
1155 	dprintk("%s\n", __func__);
1156 
1157 	switch (dvbdmxfeed->type) {
1158 	case DMX_TYPE_TS:
1159 		return ttusb_dec_stop_ts_feed(dvbdmxfeed);
1160 		break;
1161 
1162 	case DMX_TYPE_SEC:
1163 		return ttusb_dec_stop_sec_feed(dvbdmxfeed);
1164 		break;
1165 	}
1166 
1167 	return 0;
1168 }
1169 
1170 static void ttusb_dec_free_iso_urbs(struct ttusb_dec *dec)
1171 {
1172 	int i;
1173 
1174 	dprintk("%s\n", __func__);
1175 
1176 	for (i = 0; i < ISO_BUF_COUNT; i++)
1177 		usb_free_urb(dec->iso_urb[i]);
1178 	kfree(dec->iso_buffer);
1179 }
1180 
1181 static int ttusb_dec_alloc_iso_urbs(struct ttusb_dec *dec)
1182 {
1183 	int i;
1184 
1185 	dprintk("%s\n", __func__);
1186 
1187 	dec->iso_buffer = kcalloc(FRAMES_PER_ISO_BUF * ISO_BUF_COUNT,
1188 			ISO_FRAME_SIZE, GFP_KERNEL);
1189 	if (!dec->iso_buffer)
1190 		return -ENOMEM;
1191 
1192 	for (i = 0; i < ISO_BUF_COUNT; i++) {
1193 		struct urb *urb;
1194 
1195 		if (!(urb = usb_alloc_urb(FRAMES_PER_ISO_BUF, GFP_ATOMIC))) {
1196 			ttusb_dec_free_iso_urbs(dec);
1197 			return -ENOMEM;
1198 		}
1199 
1200 		dec->iso_urb[i] = urb;
1201 	}
1202 
1203 	ttusb_dec_setup_urbs(dec);
1204 
1205 	return 0;
1206 }
1207 
1208 static void ttusb_dec_init_tasklet(struct ttusb_dec *dec)
1209 {
1210 	spin_lock_init(&dec->urb_frame_list_lock);
1211 	INIT_LIST_HEAD(&dec->urb_frame_list);
1212 	tasklet_setup(&dec->urb_tasklet, ttusb_dec_process_urb_frame_list);
1213 }
1214 
1215 static int ttusb_init_rc( struct ttusb_dec *dec)
1216 {
1217 	struct input_dev *input_dev;
1218 	u8 b[] = { 0x00, 0x01 };
1219 	int i;
1220 	int err;
1221 
1222 	usb_make_path(dec->udev, dec->rc_phys, sizeof(dec->rc_phys));
1223 	strlcat(dec->rc_phys, "/input0", sizeof(dec->rc_phys));
1224 
1225 	input_dev = input_allocate_device();
1226 	if (!input_dev)
1227 		return -ENOMEM;
1228 
1229 	input_dev->name = "ttusb_dec remote control";
1230 	input_dev->phys = dec->rc_phys;
1231 	input_dev->evbit[0] = BIT_MASK(EV_KEY);
1232 	input_dev->keycodesize = sizeof(u16);
1233 	input_dev->keycodemax = 0x1a;
1234 	input_dev->keycode = rc_keys;
1235 
1236 	for (i = 0; i < ARRAY_SIZE(rc_keys); i++)
1237 		  set_bit(rc_keys[i], input_dev->keybit);
1238 
1239 	err = input_register_device(input_dev);
1240 	if (err) {
1241 		input_free_device(input_dev);
1242 		return err;
1243 	}
1244 
1245 	dec->rc_input_dev = input_dev;
1246 	if (usb_submit_urb(dec->irq_urb, GFP_KERNEL))
1247 		printk("%s: usb_submit_urb failed\n",__func__);
1248 	/* enable irq pipe */
1249 	ttusb_dec_send_command(dec,0xb0,sizeof(b),b,NULL,NULL);
1250 
1251 	return 0;
1252 }
1253 
1254 static void ttusb_dec_init_v_pes(struct ttusb_dec *dec)
1255 {
1256 	dprintk("%s\n", __func__);
1257 
1258 	dec->v_pes[0] = 0x00;
1259 	dec->v_pes[1] = 0x00;
1260 	dec->v_pes[2] = 0x01;
1261 	dec->v_pes[3] = 0xe0;
1262 }
1263 
1264 static int ttusb_dec_init_usb(struct ttusb_dec *dec)
1265 {
1266 	int result;
1267 
1268 	dprintk("%s\n", __func__);
1269 
1270 	mutex_init(&dec->usb_mutex);
1271 	mutex_init(&dec->iso_mutex);
1272 
1273 	dec->command_pipe = usb_sndbulkpipe(dec->udev, COMMAND_PIPE);
1274 	dec->result_pipe = usb_rcvbulkpipe(dec->udev, RESULT_PIPE);
1275 	dec->in_pipe = usb_rcvisocpipe(dec->udev, IN_PIPE);
1276 	dec->out_pipe = usb_sndisocpipe(dec->udev, OUT_PIPE);
1277 	dec->irq_pipe = usb_rcvintpipe(dec->udev, IRQ_PIPE);
1278 
1279 	if(enable_rc) {
1280 		dec->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
1281 		if(!dec->irq_urb) {
1282 			return -ENOMEM;
1283 		}
1284 		dec->irq_buffer = usb_alloc_coherent(dec->udev,IRQ_PACKET_SIZE,
1285 					GFP_KERNEL, &dec->irq_dma_handle);
1286 		if(!dec->irq_buffer) {
1287 			usb_free_urb(dec->irq_urb);
1288 			return -ENOMEM;
1289 		}
1290 		usb_fill_int_urb(dec->irq_urb, dec->udev,dec->irq_pipe,
1291 				 dec->irq_buffer, IRQ_PACKET_SIZE,
1292 				 ttusb_dec_handle_irq, dec, 1);
1293 		dec->irq_urb->transfer_dma = dec->irq_dma_handle;
1294 		dec->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1295 	}
1296 
1297 	result = ttusb_dec_alloc_iso_urbs(dec);
1298 	if (result) {
1299 		usb_free_urb(dec->irq_urb);
1300 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1301 				  dec->irq_buffer, dec->irq_dma_handle);
1302 	}
1303 	return result;
1304 }
1305 
1306 static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
1307 {
1308 	int i, j, actual_len, result, size, trans_count;
1309 	u8 b0[] = { 0x00, 0x00, 0x00, 0x00,
1310 		    0x00, 0x00, 0x00, 0x00,
1311 		    0x61, 0x00 };
1312 	u8 b1[] = { 0x61 };
1313 	u8 *b;
1314 	char idstring[21];
1315 	const u8 *firmware = NULL;
1316 	size_t firmware_size = 0;
1317 	u16 firmware_csum = 0;
1318 	__be16 firmware_csum_ns;
1319 	__be32 firmware_size_nl;
1320 	u32 crc32_csum, crc32_check;
1321 	__be32 tmp;
1322 	const struct firmware *fw_entry = NULL;
1323 
1324 	dprintk("%s\n", __func__);
1325 
1326 	result = request_firmware(&fw_entry, dec->firmware_name, &dec->udev->dev);
1327 	if (result) {
1328 		printk(KERN_ERR "%s: Firmware (%s) unavailable.\n",
1329 		       __func__, dec->firmware_name);
1330 		return result;
1331 	}
1332 
1333 	firmware = fw_entry->data;
1334 	firmware_size = fw_entry->size;
1335 
1336 	if (firmware_size < 60) {
1337 		printk("%s: firmware size too small for DSP code (%zu < 60).\n",
1338 			__func__, firmware_size);
1339 		release_firmware(fw_entry);
1340 		return -ENOENT;
1341 	}
1342 
1343 	/* a 32 bit checksum over the first 56 bytes of the DSP Code is stored
1344 	   at offset 56 of file, so use it to check if the firmware file is
1345 	   valid. */
1346 	crc32_csum = crc32(~0L, firmware, 56) ^ ~0L;
1347 	memcpy(&tmp, &firmware[56], 4);
1348 	crc32_check = ntohl(tmp);
1349 	if (crc32_csum != crc32_check) {
1350 		printk("%s: crc32 check of DSP code failed (calculated 0x%08x != 0x%08x in file), file invalid.\n",
1351 			__func__, crc32_csum, crc32_check);
1352 		release_firmware(fw_entry);
1353 		return -ENOENT;
1354 	}
1355 	memcpy(idstring, &firmware[36], 20);
1356 	idstring[20] = '\0';
1357 	printk(KERN_INFO "ttusb_dec: found DSP code \"%s\".\n", idstring);
1358 
1359 	firmware_size_nl = htonl(firmware_size);
1360 	memcpy(b0, &firmware_size_nl, 4);
1361 	firmware_csum = crc16(~0, firmware, firmware_size) ^ ~0;
1362 	firmware_csum_ns = htons(firmware_csum);
1363 	memcpy(&b0[6], &firmware_csum_ns, 2);
1364 
1365 	result = ttusb_dec_send_command(dec, 0x41, sizeof(b0), b0, NULL, NULL);
1366 
1367 	if (result) {
1368 		release_firmware(fw_entry);
1369 		return result;
1370 	}
1371 
1372 	trans_count = 0;
1373 	j = 0;
1374 
1375 	b = kmalloc(ARM_PACKET_SIZE, GFP_KERNEL);
1376 	if (b == NULL) {
1377 		release_firmware(fw_entry);
1378 		return -ENOMEM;
1379 	}
1380 
1381 	for (i = 0; i < firmware_size; i += COMMAND_PACKET_SIZE) {
1382 		size = firmware_size - i;
1383 		if (size > COMMAND_PACKET_SIZE)
1384 			size = COMMAND_PACKET_SIZE;
1385 
1386 		b[j + 0] = 0xaa;
1387 		b[j + 1] = trans_count++;
1388 		b[j + 2] = 0xf0;
1389 		b[j + 3] = size;
1390 		memcpy(&b[j + 4], &firmware[i], size);
1391 
1392 		j += COMMAND_PACKET_SIZE + 4;
1393 
1394 		if (j >= ARM_PACKET_SIZE) {
1395 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1396 					      ARM_PACKET_SIZE, &actual_len,
1397 					      100);
1398 			j = 0;
1399 		} else if (size < COMMAND_PACKET_SIZE) {
1400 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1401 					      j - COMMAND_PACKET_SIZE + size,
1402 					      &actual_len, 100);
1403 		}
1404 	}
1405 
1406 	result = ttusb_dec_send_command(dec, 0x43, sizeof(b1), b1, NULL, NULL);
1407 
1408 	release_firmware(fw_entry);
1409 	kfree(b);
1410 
1411 	return result;
1412 }
1413 
1414 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
1415 {
1416 	int result;
1417 	unsigned int mode = 0, model = 0, version = 0;
1418 
1419 	dprintk("%s\n", __func__);
1420 
1421 	result = ttusb_dec_get_stb_state(dec, &mode, &model, &version);
1422 	if (result)
1423 		return result;
1424 
1425 	if (!mode) {
1426 		if (version == 0xABCDEFAB)
1427 			printk(KERN_INFO "ttusb_dec: no version info in Firmware\n");
1428 		else
1429 			printk(KERN_INFO "ttusb_dec: Firmware %x.%02x%c%c\n",
1430 			       version >> 24, (version >> 16) & 0xff,
1431 			       (version >> 8) & 0xff, version & 0xff);
1432 
1433 		result = ttusb_dec_boot_dsp(dec);
1434 		if (result)
1435 			return result;
1436 	} else {
1437 		/* We can't trust the USB IDs that some firmwares
1438 		   give the box */
1439 		switch (model) {
1440 		case 0x00070001:
1441 		case 0x00070008:
1442 		case 0x0007000c:
1443 			ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1444 			break;
1445 		case 0x00070009:
1446 		case 0x00070013:
1447 			ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1448 			break;
1449 		case 0x00070011:
1450 			ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1451 			break;
1452 		default:
1453 			printk(KERN_ERR "%s: unknown model returned by firmware (%08x) - please report\n",
1454 			       __func__, model);
1455 			return -ENOENT;
1456 		}
1457 		if (version >= 0x01770000)
1458 			dec->can_playback = 1;
1459 	}
1460 	return 0;
1461 }
1462 
1463 static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
1464 {
1465 	int result;
1466 
1467 	dprintk("%s\n", __func__);
1468 
1469 	if ((result = dvb_register_adapter(&dec->adapter,
1470 					   dec->model_name, THIS_MODULE,
1471 					   &dec->udev->dev,
1472 					   adapter_nr)) < 0) {
1473 		printk("%s: dvb_register_adapter failed: error %d\n",
1474 		       __func__, result);
1475 
1476 		return result;
1477 	}
1478 
1479 	dec->demux.dmx.capabilities = DMX_TS_FILTERING | DMX_SECTION_FILTERING;
1480 
1481 	dec->demux.priv = (void *)dec;
1482 	dec->demux.filternum = 31;
1483 	dec->demux.feednum = 31;
1484 	dec->demux.start_feed = ttusb_dec_start_feed;
1485 	dec->demux.stop_feed = ttusb_dec_stop_feed;
1486 	dec->demux.write_to_decoder = NULL;
1487 
1488 	if ((result = dvb_dmx_init(&dec->demux)) < 0) {
1489 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1490 		       result);
1491 
1492 		dvb_unregister_adapter(&dec->adapter);
1493 
1494 		return result;
1495 	}
1496 
1497 	dec->dmxdev.filternum = 32;
1498 	dec->dmxdev.demux = &dec->demux.dmx;
1499 	dec->dmxdev.capabilities = 0;
1500 
1501 	if ((result = dvb_dmxdev_init(&dec->dmxdev, &dec->adapter)) < 0) {
1502 		printk("%s: dvb_dmxdev_init failed: error %d\n",
1503 		       __func__, result);
1504 
1505 		dvb_dmx_release(&dec->demux);
1506 		dvb_unregister_adapter(&dec->adapter);
1507 
1508 		return result;
1509 	}
1510 
1511 	dec->frontend.source = DMX_FRONTEND_0;
1512 
1513 	if ((result = dec->demux.dmx.add_frontend(&dec->demux.dmx,
1514 						  &dec->frontend)) < 0) {
1515 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1516 		       result);
1517 
1518 		dvb_dmxdev_release(&dec->dmxdev);
1519 		dvb_dmx_release(&dec->demux);
1520 		dvb_unregister_adapter(&dec->adapter);
1521 
1522 		return result;
1523 	}
1524 
1525 	if ((result = dec->demux.dmx.connect_frontend(&dec->demux.dmx,
1526 						      &dec->frontend)) < 0) {
1527 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1528 		       result);
1529 
1530 		dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1531 		dvb_dmxdev_release(&dec->dmxdev);
1532 		dvb_dmx_release(&dec->demux);
1533 		dvb_unregister_adapter(&dec->adapter);
1534 
1535 		return result;
1536 	}
1537 
1538 	dvb_net_init(&dec->adapter, &dec->dvb_net, &dec->demux.dmx);
1539 
1540 	return 0;
1541 }
1542 
1543 static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
1544 {
1545 	dprintk("%s\n", __func__);
1546 
1547 	dvb_net_release(&dec->dvb_net);
1548 	dec->demux.dmx.close(&dec->demux.dmx);
1549 	dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1550 	dvb_dmxdev_release(&dec->dmxdev);
1551 	dvb_dmx_release(&dec->demux);
1552 	if (dec->fe) {
1553 		dvb_unregister_frontend(dec->fe);
1554 		if (dec->fe->ops.release)
1555 			dec->fe->ops.release(dec->fe);
1556 	}
1557 	dvb_unregister_adapter(&dec->adapter);
1558 }
1559 
1560 static void ttusb_dec_exit_rc(struct ttusb_dec *dec)
1561 {
1562 	dprintk("%s\n", __func__);
1563 
1564 	if (dec->rc_input_dev) {
1565 		input_unregister_device(dec->rc_input_dev);
1566 		dec->rc_input_dev = NULL;
1567 	}
1568 }
1569 
1570 
1571 static void ttusb_dec_exit_usb(struct ttusb_dec *dec)
1572 {
1573 	int i;
1574 
1575 	dprintk("%s\n", __func__);
1576 
1577 	if (enable_rc) {
1578 		/* we have to check whether the irq URB is already submitted.
1579 		 * As the irq is submitted after the interface is changed,
1580 		 * this is the best method i figured out.
1581 		 * Any others?*/
1582 		if (dec->interface == TTUSB_DEC_INTERFACE_IN)
1583 			usb_kill_urb(dec->irq_urb);
1584 
1585 		usb_free_urb(dec->irq_urb);
1586 
1587 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1588 				  dec->irq_buffer, dec->irq_dma_handle);
1589 	}
1590 
1591 	dec->iso_stream_count = 0;
1592 
1593 	for (i = 0; i < ISO_BUF_COUNT; i++)
1594 		usb_kill_urb(dec->iso_urb[i]);
1595 
1596 	ttusb_dec_free_iso_urbs(dec);
1597 }
1598 
1599 static void ttusb_dec_exit_tasklet(struct ttusb_dec *dec)
1600 {
1601 	struct list_head *item;
1602 	struct urb_frame *frame;
1603 
1604 	tasklet_kill(&dec->urb_tasklet);
1605 
1606 	while ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
1607 		frame = list_entry(item, struct urb_frame, urb_frame_list);
1608 		list_del(&frame->urb_frame_list);
1609 		kfree(frame);
1610 	}
1611 }
1612 
1613 static void ttusb_dec_init_filters(struct ttusb_dec *dec)
1614 {
1615 	INIT_LIST_HEAD(&dec->filter_info_list);
1616 	spin_lock_init(&dec->filter_info_list_lock);
1617 }
1618 
1619 static void ttusb_dec_exit_filters(struct ttusb_dec *dec)
1620 {
1621 	struct list_head *item;
1622 	struct filter_info *finfo;
1623 
1624 	while ((item = dec->filter_info_list.next) != &dec->filter_info_list) {
1625 		finfo = list_entry(item, struct filter_info, filter_info_list);
1626 		list_del(&finfo->filter_info_list);
1627 		kfree(finfo);
1628 	}
1629 }
1630 
1631 static int fe_send_command(struct dvb_frontend* fe, const u8 command,
1632 			   int param_length, const u8 params[],
1633 			   int *result_length, u8 cmd_result[])
1634 {
1635 	struct ttusb_dec* dec = fe->dvb->priv;
1636 	return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
1637 }
1638 
1639 static const struct ttusbdecfe_config fe_config = {
1640 	.send_command = fe_send_command
1641 };
1642 
1643 static int ttusb_dec_probe(struct usb_interface *intf,
1644 			   const struct usb_device_id *id)
1645 {
1646 	struct usb_device *udev;
1647 	struct ttusb_dec *dec;
1648 	int result;
1649 
1650 	dprintk("%s\n", __func__);
1651 
1652 	udev = interface_to_usbdev(intf);
1653 
1654 	if (!(dec = kzalloc(sizeof(struct ttusb_dec), GFP_KERNEL))) {
1655 		printk("%s: couldn't allocate memory.\n", __func__);
1656 		return -ENOMEM;
1657 	}
1658 
1659 	usb_set_intfdata(intf, (void *)dec);
1660 
1661 	switch (id->idProduct) {
1662 	case 0x1006:
1663 		ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1664 		break;
1665 
1666 	case 0x1008:
1667 		ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1668 		break;
1669 
1670 	case 0x1009:
1671 		ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1672 		break;
1673 	}
1674 
1675 	dec->udev = udev;
1676 
1677 	result = ttusb_dec_init_usb(dec);
1678 	if (result)
1679 		goto err_usb;
1680 	result = ttusb_dec_init_stb(dec);
1681 	if (result)
1682 		goto err_stb;
1683 	result = ttusb_dec_init_dvb(dec);
1684 	if (result)
1685 		goto err_stb;
1686 
1687 	dec->adapter.priv = dec;
1688 	switch (id->idProduct) {
1689 	case 0x1006:
1690 		dec->fe = ttusbdecfe_dvbs_attach(&fe_config);
1691 		break;
1692 
1693 	case 0x1008:
1694 	case 0x1009:
1695 		dec->fe = ttusbdecfe_dvbt_attach(&fe_config);
1696 		break;
1697 	}
1698 
1699 	if (dec->fe == NULL) {
1700 		printk("dvb-ttusb-dec: A frontend driver was not found for device [%04x:%04x]\n",
1701 		       le16_to_cpu(dec->udev->descriptor.idVendor),
1702 		       le16_to_cpu(dec->udev->descriptor.idProduct));
1703 	} else {
1704 		if (dvb_register_frontend(&dec->adapter, dec->fe)) {
1705 			printk("budget-ci: Frontend registration failed!\n");
1706 			if (dec->fe->ops.release)
1707 				dec->fe->ops.release(dec->fe);
1708 			dec->fe = NULL;
1709 		}
1710 	}
1711 
1712 	ttusb_dec_init_v_pes(dec);
1713 	ttusb_dec_init_filters(dec);
1714 	ttusb_dec_init_tasklet(dec);
1715 
1716 	dec->active = 1;
1717 
1718 	ttusb_dec_set_interface(dec, TTUSB_DEC_INTERFACE_IN);
1719 
1720 	if (enable_rc)
1721 		ttusb_init_rc(dec);
1722 
1723 	return 0;
1724 err_stb:
1725 	ttusb_dec_exit_usb(dec);
1726 err_usb:
1727 	kfree(dec);
1728 	return result;
1729 }
1730 
1731 static void ttusb_dec_disconnect(struct usb_interface *intf)
1732 {
1733 	struct ttusb_dec *dec = usb_get_intfdata(intf);
1734 
1735 	usb_set_intfdata(intf, NULL);
1736 
1737 	dprintk("%s\n", __func__);
1738 
1739 	if (dec->active) {
1740 		ttusb_dec_exit_tasklet(dec);
1741 		ttusb_dec_exit_filters(dec);
1742 		if(enable_rc)
1743 			ttusb_dec_exit_rc(dec);
1744 		ttusb_dec_exit_usb(dec);
1745 		ttusb_dec_exit_dvb(dec);
1746 	}
1747 
1748 	kfree(dec);
1749 }
1750 
1751 static void ttusb_dec_set_model(struct ttusb_dec *dec,
1752 				enum ttusb_dec_model model)
1753 {
1754 	dec->model = model;
1755 
1756 	switch (model) {
1757 	case TTUSB_DEC2000T:
1758 		dec->model_name = "DEC2000-t";
1759 		dec->firmware_name = "dvb-ttusb-dec-2000t.fw";
1760 		break;
1761 
1762 	case TTUSB_DEC2540T:
1763 		dec->model_name = "DEC2540-t";
1764 		dec->firmware_name = "dvb-ttusb-dec-2540t.fw";
1765 		break;
1766 
1767 	case TTUSB_DEC3000S:
1768 		dec->model_name = "DEC3000-s";
1769 		dec->firmware_name = "dvb-ttusb-dec-3000s.fw";
1770 		break;
1771 	}
1772 }
1773 
1774 static const struct usb_device_id ttusb_dec_table[] = {
1775 	{USB_DEVICE(0x0b48, 0x1006)},	/* DEC3000-s */
1776 	/*{USB_DEVICE(0x0b48, 0x1007)},	   Unconfirmed */
1777 	{USB_DEVICE(0x0b48, 0x1008)},	/* DEC2000-t */
1778 	{USB_DEVICE(0x0b48, 0x1009)},	/* DEC2540-t */
1779 	{}
1780 };
1781 
1782 static struct usb_driver ttusb_dec_driver = {
1783 	.name		= "ttusb-dec",
1784 	.probe		= ttusb_dec_probe,
1785 	.disconnect	= ttusb_dec_disconnect,
1786 	.id_table	= ttusb_dec_table,
1787 };
1788 
1789 module_usb_driver(ttusb_dec_driver);
1790 
1791 MODULE_AUTHOR("Alex Woods <linux-dvb@giblets.org>");
1792 MODULE_DESCRIPTION(DRIVER_NAME);
1793 MODULE_LICENSE("GPL");
1794 MODULE_DEVICE_TABLE(usb, ttusb_dec_table);
1795