1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * TTUSB DEC Driver
4  *
5  * Copyright (C) 2003-2004 Alex Woods <linux-dvb@giblets.org>
6  * IR support by Peter Beutner <p.beutner@gmx.net>
7  */
8 
9 #include <linux/list.h>
10 #include <linux/module.h>
11 #include <linux/pci.h>
12 #include <linux/slab.h>
13 #include <linux/spinlock.h>
14 #include <linux/usb.h>
15 #include <linux/interrupt.h>
16 #include <linux/firmware.h>
17 #include <linux/crc32.h>
18 #include <linux/init.h>
19 #include <linux/input.h>
20 
21 #include <linux/mutex.h>
22 
23 #include <media/dmxdev.h>
24 #include <media/dvb_demux.h>
25 #include <media/dvb_frontend.h>
26 #include <media/dvb_net.h>
27 #include "ttusbdecfe.h"
28 
29 static int debug;
30 static int output_pva;
31 static int enable_rc;
32 
33 module_param(debug, int, 0644);
34 MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
35 module_param(output_pva, int, 0444);
36 MODULE_PARM_DESC(output_pva, "Output PVA from dvr device (default:off)");
37 module_param(enable_rc, int, 0644);
38 MODULE_PARM_DESC(enable_rc, "Turn on/off IR remote control(default: off)");
39 
40 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
41 
42 #define dprintk	if (debug) printk
43 
44 #define DRIVER_NAME		"TechnoTrend/Hauppauge DEC USB"
45 
46 #define COMMAND_PIPE		0x03
47 #define RESULT_PIPE		0x04
48 #define IN_PIPE			0x08
49 #define OUT_PIPE		0x07
50 #define IRQ_PIPE		0x0A
51 
52 #define COMMAND_PACKET_SIZE	0x3c
53 #define ARM_PACKET_SIZE		0x1000
54 #define IRQ_PACKET_SIZE		0x8
55 
56 #define ISO_BUF_COUNT		0x04
57 #define FRAMES_PER_ISO_BUF	0x04
58 #define ISO_FRAME_SIZE		0x0380
59 
60 #define	MAX_PVA_LENGTH		6144
61 
62 enum ttusb_dec_model {
63 	TTUSB_DEC2000T,
64 	TTUSB_DEC2540T,
65 	TTUSB_DEC3000S
66 };
67 
68 enum ttusb_dec_packet_type {
69 	TTUSB_DEC_PACKET_PVA,
70 	TTUSB_DEC_PACKET_SECTION,
71 	TTUSB_DEC_PACKET_EMPTY
72 };
73 
74 enum ttusb_dec_interface {
75 	TTUSB_DEC_INTERFACE_INITIAL,
76 	TTUSB_DEC_INTERFACE_IN,
77 	TTUSB_DEC_INTERFACE_OUT
78 };
79 
80 typedef int (dvb_filter_pes2ts_cb_t) (void *, unsigned char *);
81 
82 struct dvb_filter_pes2ts {
83 	unsigned char buf[188];
84 	unsigned char cc;
85 	dvb_filter_pes2ts_cb_t *cb;
86 	void *priv;
87 };
88 
89 struct ttusb_dec {
90 	enum ttusb_dec_model		model;
91 	char				*model_name;
92 	char				*firmware_name;
93 	int				can_playback;
94 
95 	/* DVB bits */
96 	struct dvb_adapter		adapter;
97 	struct dmxdev			dmxdev;
98 	struct dvb_demux		demux;
99 	struct dmx_frontend		frontend;
100 	struct dvb_net			dvb_net;
101 	struct dvb_frontend*		fe;
102 
103 	u16			pid[DMX_PES_OTHER];
104 
105 	/* USB bits */
106 	struct usb_device		*udev;
107 	u8				trans_count;
108 	unsigned int			command_pipe;
109 	unsigned int			result_pipe;
110 	unsigned int			in_pipe;
111 	unsigned int			out_pipe;
112 	unsigned int			irq_pipe;
113 	enum ttusb_dec_interface	interface;
114 	struct mutex			usb_mutex;
115 
116 	void			*irq_buffer;
117 	struct urb		*irq_urb;
118 	dma_addr_t		irq_dma_handle;
119 	void			*iso_buffer;
120 	struct urb		*iso_urb[ISO_BUF_COUNT];
121 	int			iso_stream_count;
122 	struct mutex		iso_mutex;
123 
124 	u8				packet[MAX_PVA_LENGTH + 4];
125 	enum ttusb_dec_packet_type	packet_type;
126 	int				packet_state;
127 	int				packet_length;
128 	int				packet_payload_length;
129 	u16				next_packet_id;
130 
131 	int				pva_stream_count;
132 	int				filter_stream_count;
133 
134 	struct dvb_filter_pes2ts	a_pes2ts;
135 	struct dvb_filter_pes2ts	v_pes2ts;
136 
137 	u8			v_pes[16 + MAX_PVA_LENGTH];
138 	int			v_pes_length;
139 	int			v_pes_postbytes;
140 
141 	struct list_head	urb_frame_list;
142 	struct tasklet_struct	urb_tasklet;
143 	spinlock_t		urb_frame_list_lock;
144 
145 	struct dvb_demux_filter	*audio_filter;
146 	struct dvb_demux_filter	*video_filter;
147 	struct list_head	filter_info_list;
148 	spinlock_t		filter_info_list_lock;
149 
150 	struct input_dev	*rc_input_dev;
151 	char			rc_phys[64];
152 
153 	int			active; /* Loaded successfully */
154 };
155 
156 struct urb_frame {
157 	u8			data[ISO_FRAME_SIZE];
158 	int			length;
159 	struct list_head	urb_frame_list;
160 };
161 
162 struct filter_info {
163 	u8			stream_id;
164 	struct dvb_demux_filter	*filter;
165 	struct list_head	filter_info_list;
166 };
167 
168 static u16 rc_keys[] = {
169 	KEY_POWER,
170 	KEY_MUTE,
171 	KEY_1,
172 	KEY_2,
173 	KEY_3,
174 	KEY_4,
175 	KEY_5,
176 	KEY_6,
177 	KEY_7,
178 	KEY_8,
179 	KEY_9,
180 	KEY_0,
181 	KEY_CHANNELUP,
182 	KEY_VOLUMEDOWN,
183 	KEY_OK,
184 	KEY_VOLUMEUP,
185 	KEY_CHANNELDOWN,
186 	KEY_PREVIOUS,
187 	KEY_ESC,
188 	KEY_RED,
189 	KEY_GREEN,
190 	KEY_YELLOW,
191 	KEY_BLUE,
192 	KEY_OPTION,
193 	KEY_M,
194 	KEY_RADIO
195 };
196 
197 static void dvb_filter_pes2ts_init(struct dvb_filter_pes2ts *p2ts,
198 				   unsigned short pid,
199 				   dvb_filter_pes2ts_cb_t *cb, void *priv)
200 {
201 	unsigned char *buf=p2ts->buf;
202 
203 	buf[0]=0x47;
204 	buf[1]=(pid>>8);
205 	buf[2]=pid&0xff;
206 	p2ts->cc=0;
207 	p2ts->cb=cb;
208 	p2ts->priv=priv;
209 }
210 
211 static int dvb_filter_pes2ts(struct dvb_filter_pes2ts *p2ts,
212 			     unsigned char *pes, int len, int payload_start)
213 {
214 	unsigned char *buf=p2ts->buf;
215 	int ret=0, rest;
216 
217 	//len=6+((pes[4]<<8)|pes[5]);
218 
219 	if (payload_start)
220 		buf[1]|=0x40;
221 	else
222 		buf[1]&=~0x40;
223 	while (len>=184) {
224 		buf[3]=0x10|((p2ts->cc++)&0x0f);
225 		memcpy(buf+4, pes, 184);
226 		if ((ret=p2ts->cb(p2ts->priv, buf)))
227 			return ret;
228 		len-=184; pes+=184;
229 		buf[1]&=~0x40;
230 	}
231 	if (!len)
232 		return 0;
233 	buf[3]=0x30|((p2ts->cc++)&0x0f);
234 	rest=183-len;
235 	if (rest) {
236 		buf[5]=0x00;
237 		if (rest-1)
238 			memset(buf+6, 0xff, rest-1);
239 	}
240 	buf[4]=rest;
241 	memcpy(buf+5+rest, pes, len);
242 	return p2ts->cb(p2ts->priv, buf);
243 }
244 
245 static void ttusb_dec_set_model(struct ttusb_dec *dec,
246 				enum ttusb_dec_model model);
247 
248 static void ttusb_dec_handle_irq( struct urb *urb)
249 {
250 	struct ttusb_dec *dec = urb->context;
251 	char *buffer = dec->irq_buffer;
252 	int retval;
253 	int index = buffer[4];
254 
255 	switch(urb->status) {
256 		case 0: /*success*/
257 			break;
258 		case -ECONNRESET:
259 		case -ENOENT:
260 		case -ESHUTDOWN:
261 		case -ETIME:
262 			/* this urb is dead, cleanup */
263 			dprintk("%s:urb shutting down with status: %d\n",
264 					__func__, urb->status);
265 			return;
266 		default:
267 			dprintk("%s:nonzero status received: %d\n",
268 					__func__,urb->status);
269 			goto exit;
270 	}
271 
272 	if ((buffer[0] == 0x1) && (buffer[2] == 0x15))  {
273 		/*
274 		 * IR - Event
275 		 *
276 		 * this is an fact a bit too simple implementation;
277 		 * the box also reports a keyrepeat signal
278 		 * (with buffer[3] == 0x40) in an interval of ~100ms.
279 		 * But to handle this correctly we had to imlemenent some
280 		 * kind of timer which signals a 'key up' event if no
281 		 * keyrepeat signal is received for lets say 200ms.
282 		 * this should/could be added later ...
283 		 * for now lets report each signal as a key down and up
284 		 */
285 		if (index - 1 < ARRAY_SIZE(rc_keys)) {
286 			dprintk("%s:rc signal:%d\n", __func__, index);
287 			input_report_key(dec->rc_input_dev, rc_keys[index - 1], 1);
288 			input_sync(dec->rc_input_dev);
289 			input_report_key(dec->rc_input_dev, rc_keys[index - 1], 0);
290 			input_sync(dec->rc_input_dev);
291 		}
292 	}
293 
294 exit:
295 	retval = usb_submit_urb(urb, GFP_ATOMIC);
296 	if (retval)
297 		printk("%s - usb_commit_urb failed with result: %d\n",
298 			__func__, retval);
299 }
300 
301 static u16 crc16(u16 crc, const u8 *buf, size_t len)
302 {
303 	u16 tmp;
304 
305 	while (len--) {
306 		crc ^= *buf++;
307 		crc ^= (u8)crc >> 4;
308 		tmp = (u8)crc;
309 		crc ^= (tmp ^ (tmp << 1)) << 4;
310 	}
311 	return crc;
312 }
313 
314 static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
315 				  int param_length, const u8 params[],
316 				  int *result_length, u8 cmd_result[])
317 {
318 	int result, actual_len;
319 	u8 *b;
320 
321 	dprintk("%s\n", __func__);
322 
323 	b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
324 	if (!b)
325 		return -ENOMEM;
326 
327 	if ((result = mutex_lock_interruptible(&dec->usb_mutex))) {
328 		kfree(b);
329 		printk("%s: Failed to lock usb mutex.\n", __func__);
330 		return result;
331 	}
332 
333 	b[0] = 0xaa;
334 	b[1] = ++dec->trans_count;
335 	b[2] = command;
336 	b[3] = param_length;
337 
338 	if (params)
339 		memcpy(&b[4], params, param_length);
340 
341 	if (debug) {
342 		printk(KERN_DEBUG "%s: command: %*ph\n",
343 		       __func__, param_length, b);
344 	}
345 
346 	result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
347 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
348 
349 	if (result) {
350 		printk("%s: command bulk message failed: error %d\n",
351 		       __func__, result);
352 		mutex_unlock(&dec->usb_mutex);
353 		kfree(b);
354 		return result;
355 	}
356 
357 	result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
358 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
359 
360 	if (result) {
361 		printk("%s: result bulk message failed: error %d\n",
362 		       __func__, result);
363 		mutex_unlock(&dec->usb_mutex);
364 		kfree(b);
365 		return result;
366 	} else {
367 		if (debug) {
368 			printk(KERN_DEBUG "%s: result: %*ph\n",
369 			       __func__, actual_len, b);
370 		}
371 
372 		if (result_length)
373 			*result_length = b[3];
374 		if (cmd_result && b[3] > 0)
375 			memcpy(cmd_result, &b[4], b[3]);
376 
377 		mutex_unlock(&dec->usb_mutex);
378 
379 		kfree(b);
380 		return 0;
381 	}
382 }
383 
384 static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode,
385 				    unsigned int *model, unsigned int *version)
386 {
387 	u8 c[COMMAND_PACKET_SIZE];
388 	int c_length;
389 	int result;
390 	__be32 tmp;
391 
392 	dprintk("%s\n", __func__);
393 
394 	result = ttusb_dec_send_command(dec, 0x08, 0, NULL, &c_length, c);
395 	if (result)
396 		return result;
397 
398 	if (c_length >= 0x0c) {
399 		if (mode != NULL) {
400 			memcpy(&tmp, c, 4);
401 			*mode = ntohl(tmp);
402 		}
403 		if (model != NULL) {
404 			memcpy(&tmp, &c[4], 4);
405 			*model = ntohl(tmp);
406 		}
407 		if (version != NULL) {
408 			memcpy(&tmp, &c[8], 4);
409 			*version = ntohl(tmp);
410 		}
411 		return 0;
412 	} else {
413 		return -ENOENT;
414 	}
415 }
416 
417 static int ttusb_dec_audio_pes2ts_cb(void *priv, unsigned char *data)
418 {
419 	struct ttusb_dec *dec = priv;
420 
421 	dec->audio_filter->feed->cb.ts(data, 188, NULL, 0,
422 				       &dec->audio_filter->feed->feed.ts, NULL);
423 
424 	return 0;
425 }
426 
427 static int ttusb_dec_video_pes2ts_cb(void *priv, unsigned char *data)
428 {
429 	struct ttusb_dec *dec = priv;
430 
431 	dec->video_filter->feed->cb.ts(data, 188, NULL, 0,
432 				       &dec->video_filter->feed->feed.ts, NULL);
433 
434 	return 0;
435 }
436 
437 static void ttusb_dec_set_pids(struct ttusb_dec *dec)
438 {
439 	u8 b[] = { 0x00, 0x00, 0x00, 0x00,
440 		   0x00, 0x00, 0xff, 0xff,
441 		   0xff, 0xff, 0xff, 0xff };
442 
443 	__be16 pcr = htons(dec->pid[DMX_PES_PCR]);
444 	__be16 audio = htons(dec->pid[DMX_PES_AUDIO]);
445 	__be16 video = htons(dec->pid[DMX_PES_VIDEO]);
446 
447 	dprintk("%s\n", __func__);
448 
449 	memcpy(&b[0], &pcr, 2);
450 	memcpy(&b[2], &audio, 2);
451 	memcpy(&b[4], &video, 2);
452 
453 	ttusb_dec_send_command(dec, 0x50, sizeof(b), b, NULL, NULL);
454 
455 	dvb_filter_pes2ts_init(&dec->a_pes2ts, dec->pid[DMX_PES_AUDIO],
456 			       ttusb_dec_audio_pes2ts_cb, dec);
457 	dvb_filter_pes2ts_init(&dec->v_pes2ts, dec->pid[DMX_PES_VIDEO],
458 			       ttusb_dec_video_pes2ts_cb, dec);
459 	dec->v_pes_length = 0;
460 	dec->v_pes_postbytes = 0;
461 }
462 
463 static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
464 {
465 	if (length < 8) {
466 		printk("%s: packet too short - discarding\n", __func__);
467 		return;
468 	}
469 
470 	if (length > 8 + MAX_PVA_LENGTH) {
471 		printk("%s: packet too long - discarding\n", __func__);
472 		return;
473 	}
474 
475 	switch (pva[2]) {
476 
477 	case 0x01: {		/* VideoStream */
478 		int prebytes = pva[5] & 0x03;
479 		int postbytes = (pva[5] & 0x0c) >> 2;
480 		__be16 v_pes_payload_length;
481 
482 		if (output_pva) {
483 			dec->video_filter->feed->cb.ts(pva, length, NULL, 0,
484 				&dec->video_filter->feed->feed.ts, NULL);
485 			return;
486 		}
487 
488 		if (dec->v_pes_postbytes > 0 &&
489 		    dec->v_pes_postbytes == prebytes) {
490 			memcpy(&dec->v_pes[dec->v_pes_length],
491 			       &pva[12], prebytes);
492 
493 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
494 					  dec->v_pes_length + prebytes, 1);
495 		}
496 
497 		if (pva[5] & 0x10) {
498 			dec->v_pes[7] = 0x80;
499 			dec->v_pes[8] = 0x05;
500 
501 			dec->v_pes[9] = 0x21 | ((pva[8] & 0xc0) >> 5);
502 			dec->v_pes[10] = ((pva[8] & 0x3f) << 2) |
503 					 ((pva[9] & 0xc0) >> 6);
504 			dec->v_pes[11] = 0x01 |
505 					 ((pva[9] & 0x3f) << 2) |
506 					 ((pva[10] & 0x80) >> 6);
507 			dec->v_pes[12] = ((pva[10] & 0x7f) << 1) |
508 					 ((pva[11] & 0xc0) >> 7);
509 			dec->v_pes[13] = 0x01 | ((pva[11] & 0x7f) << 1);
510 
511 			memcpy(&dec->v_pes[14], &pva[12 + prebytes],
512 			       length - 12 - prebytes);
513 			dec->v_pes_length = 14 + length - 12 - prebytes;
514 		} else {
515 			dec->v_pes[7] = 0x00;
516 			dec->v_pes[8] = 0x00;
517 
518 			memcpy(&dec->v_pes[9], &pva[8], length - 8);
519 			dec->v_pes_length = 9 + length - 8;
520 		}
521 
522 		dec->v_pes_postbytes = postbytes;
523 
524 		if (dec->v_pes[9 + dec->v_pes[8]] == 0x00 &&
525 		    dec->v_pes[10 + dec->v_pes[8]] == 0x00 &&
526 		    dec->v_pes[11 + dec->v_pes[8]] == 0x01)
527 			dec->v_pes[6] = 0x84;
528 		else
529 			dec->v_pes[6] = 0x80;
530 
531 		v_pes_payload_length = htons(dec->v_pes_length - 6 +
532 					     postbytes);
533 		memcpy(&dec->v_pes[4], &v_pes_payload_length, 2);
534 
535 		if (postbytes == 0)
536 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
537 					  dec->v_pes_length, 1);
538 
539 		break;
540 	}
541 
542 	case 0x02:		/* MainAudioStream */
543 		if (output_pva) {
544 			dec->audio_filter->feed->cb.ts(pva, length, NULL, 0,
545 				&dec->audio_filter->feed->feed.ts, NULL);
546 			return;
547 		}
548 
549 		dvb_filter_pes2ts(&dec->a_pes2ts, &pva[8], length - 8,
550 				  pva[5] & 0x10);
551 		break;
552 
553 	default:
554 		printk("%s: unknown PVA type: %02x.\n", __func__,
555 		       pva[2]);
556 		break;
557 	}
558 }
559 
560 static void ttusb_dec_process_filter(struct ttusb_dec *dec, u8 *packet,
561 				     int length)
562 {
563 	struct list_head *item;
564 	struct filter_info *finfo;
565 	struct dvb_demux_filter *filter = NULL;
566 	unsigned long flags;
567 	u8 sid;
568 
569 	sid = packet[1];
570 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
571 	for (item = dec->filter_info_list.next; item != &dec->filter_info_list;
572 	     item = item->next) {
573 		finfo = list_entry(item, struct filter_info, filter_info_list);
574 		if (finfo->stream_id == sid) {
575 			filter = finfo->filter;
576 			break;
577 		}
578 	}
579 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
580 
581 	if (filter)
582 		filter->feed->cb.sec(&packet[2], length - 2, NULL, 0,
583 				     &filter->filter, NULL);
584 }
585 
586 static void ttusb_dec_process_packet(struct ttusb_dec *dec)
587 {
588 	int i;
589 	u16 csum = 0;
590 	u16 packet_id;
591 
592 	if (dec->packet_length % 2) {
593 		printk("%s: odd sized packet - discarding\n", __func__);
594 		return;
595 	}
596 
597 	for (i = 0; i < dec->packet_length; i += 2)
598 		csum ^= ((dec->packet[i] << 8) + dec->packet[i + 1]);
599 
600 	if (csum) {
601 		printk("%s: checksum failed - discarding\n", __func__);
602 		return;
603 	}
604 
605 	packet_id = dec->packet[dec->packet_length - 4] << 8;
606 	packet_id += dec->packet[dec->packet_length - 3];
607 
608 	if ((packet_id != dec->next_packet_id) && dec->next_packet_id) {
609 		printk("%s: warning: lost packets between %u and %u\n",
610 		       __func__, dec->next_packet_id - 1, packet_id);
611 	}
612 
613 	if (packet_id == 0xffff)
614 		dec->next_packet_id = 0x8000;
615 	else
616 		dec->next_packet_id = packet_id + 1;
617 
618 	switch (dec->packet_type) {
619 	case TTUSB_DEC_PACKET_PVA:
620 		if (dec->pva_stream_count)
621 			ttusb_dec_process_pva(dec, dec->packet,
622 					      dec->packet_payload_length);
623 		break;
624 
625 	case TTUSB_DEC_PACKET_SECTION:
626 		if (dec->filter_stream_count)
627 			ttusb_dec_process_filter(dec, dec->packet,
628 						 dec->packet_payload_length);
629 		break;
630 
631 	case TTUSB_DEC_PACKET_EMPTY:
632 		break;
633 	}
634 }
635 
636 static void swap_bytes(u8 *b, int length)
637 {
638 	length -= length % 2;
639 	for (; length; b += 2, length -= 2)
640 		swap(*b, *(b + 1));
641 }
642 
643 static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,
644 					int length)
645 {
646 	swap_bytes(b, length);
647 
648 	while (length) {
649 		switch (dec->packet_state) {
650 
651 		case 0:
652 		case 1:
653 		case 2:
654 			if (*b++ == 0xaa)
655 				dec->packet_state++;
656 			else
657 				dec->packet_state = 0;
658 
659 			length--;
660 			break;
661 
662 		case 3:
663 			if (*b == 0x00) {
664 				dec->packet_state++;
665 				dec->packet_length = 0;
666 			} else if (*b != 0xaa) {
667 				dec->packet_state = 0;
668 			}
669 
670 			b++;
671 			length--;
672 			break;
673 
674 		case 4:
675 			dec->packet[dec->packet_length++] = *b++;
676 
677 			if (dec->packet_length == 2) {
678 				if (dec->packet[0] == 'A' &&
679 				    dec->packet[1] == 'V') {
680 					dec->packet_type =
681 						TTUSB_DEC_PACKET_PVA;
682 					dec->packet_state++;
683 				} else if (dec->packet[0] == 'S') {
684 					dec->packet_type =
685 						TTUSB_DEC_PACKET_SECTION;
686 					dec->packet_state++;
687 				} else if (dec->packet[0] == 0x00) {
688 					dec->packet_type =
689 						TTUSB_DEC_PACKET_EMPTY;
690 					dec->packet_payload_length = 2;
691 					dec->packet_state = 7;
692 				} else {
693 					printk("%s: unknown packet type: %02x%02x\n",
694 					       __func__,
695 					       dec->packet[0], dec->packet[1]);
696 					dec->packet_state = 0;
697 				}
698 			}
699 
700 			length--;
701 			break;
702 
703 		case 5:
704 			dec->packet[dec->packet_length++] = *b++;
705 
706 			if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
707 			    dec->packet_length == 8) {
708 				dec->packet_state++;
709 				dec->packet_payload_length = 8 +
710 					(dec->packet[6] << 8) +
711 					dec->packet[7];
712 			} else if (dec->packet_type ==
713 					TTUSB_DEC_PACKET_SECTION &&
714 				   dec->packet_length == 5) {
715 				dec->packet_state++;
716 				dec->packet_payload_length = 5 +
717 					((dec->packet[3] & 0x0f) << 8) +
718 					dec->packet[4];
719 			}
720 
721 			length--;
722 			break;
723 
724 		case 6: {
725 			int remainder = dec->packet_payload_length -
726 					dec->packet_length;
727 
728 			if (length >= remainder) {
729 				memcpy(dec->packet + dec->packet_length,
730 				       b, remainder);
731 				dec->packet_length += remainder;
732 				b += remainder;
733 				length -= remainder;
734 				dec->packet_state++;
735 			} else {
736 				memcpy(&dec->packet[dec->packet_length],
737 				       b, length);
738 				dec->packet_length += length;
739 				length = 0;
740 			}
741 
742 			break;
743 		}
744 
745 		case 7: {
746 			int tail = 4;
747 
748 			dec->packet[dec->packet_length++] = *b++;
749 
750 			if (dec->packet_type == TTUSB_DEC_PACKET_SECTION &&
751 			    dec->packet_payload_length % 2)
752 				tail++;
753 
754 			if (dec->packet_length ==
755 			    dec->packet_payload_length + tail) {
756 				ttusb_dec_process_packet(dec);
757 				dec->packet_state = 0;
758 			}
759 
760 			length--;
761 			break;
762 		}
763 
764 		default:
765 			printk("%s: illegal packet state encountered.\n",
766 			       __func__);
767 			dec->packet_state = 0;
768 		}
769 	}
770 }
771 
772 static void ttusb_dec_process_urb_frame_list(unsigned long data)
773 {
774 	struct ttusb_dec *dec = (struct ttusb_dec *)data;
775 	struct list_head *item;
776 	struct urb_frame *frame;
777 	unsigned long flags;
778 
779 	while (1) {
780 		spin_lock_irqsave(&dec->urb_frame_list_lock, flags);
781 		if ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
782 			frame = list_entry(item, struct urb_frame,
783 					   urb_frame_list);
784 			list_del(&frame->urb_frame_list);
785 		} else {
786 			spin_unlock_irqrestore(&dec->urb_frame_list_lock,
787 					       flags);
788 			return;
789 		}
790 		spin_unlock_irqrestore(&dec->urb_frame_list_lock, flags);
791 
792 		ttusb_dec_process_urb_frame(dec, frame->data, frame->length);
793 		kfree(frame);
794 	}
795 }
796 
797 static void ttusb_dec_process_urb(struct urb *urb)
798 {
799 	struct ttusb_dec *dec = urb->context;
800 
801 	if (!urb->status) {
802 		int i;
803 
804 		for (i = 0; i < FRAMES_PER_ISO_BUF; i++) {
805 			struct usb_iso_packet_descriptor *d;
806 			u8 *b;
807 			int length;
808 			struct urb_frame *frame;
809 
810 			d = &urb->iso_frame_desc[i];
811 			b = urb->transfer_buffer + d->offset;
812 			length = d->actual_length;
813 
814 			if ((frame = kmalloc(sizeof(struct urb_frame),
815 					     GFP_ATOMIC))) {
816 				unsigned long flags;
817 
818 				memcpy(frame->data, b, length);
819 				frame->length = length;
820 
821 				spin_lock_irqsave(&dec->urb_frame_list_lock,
822 						     flags);
823 				list_add_tail(&frame->urb_frame_list,
824 					      &dec->urb_frame_list);
825 				spin_unlock_irqrestore(&dec->urb_frame_list_lock,
826 						       flags);
827 
828 				tasklet_schedule(&dec->urb_tasklet);
829 			}
830 		}
831 	} else {
832 		 /* -ENOENT is expected when unlinking urbs */
833 		if (urb->status != -ENOENT)
834 			dprintk("%s: urb error: %d\n", __func__,
835 				urb->status);
836 	}
837 
838 	if (dec->iso_stream_count)
839 		usb_submit_urb(urb, GFP_ATOMIC);
840 }
841 
842 static void ttusb_dec_setup_urbs(struct ttusb_dec *dec)
843 {
844 	int i, j, buffer_offset = 0;
845 
846 	dprintk("%s\n", __func__);
847 
848 	for (i = 0; i < ISO_BUF_COUNT; i++) {
849 		int frame_offset = 0;
850 		struct urb *urb = dec->iso_urb[i];
851 
852 		urb->dev = dec->udev;
853 		urb->context = dec;
854 		urb->complete = ttusb_dec_process_urb;
855 		urb->pipe = dec->in_pipe;
856 		urb->transfer_flags = URB_ISO_ASAP;
857 		urb->interval = 1;
858 		urb->number_of_packets = FRAMES_PER_ISO_BUF;
859 		urb->transfer_buffer_length = ISO_FRAME_SIZE *
860 					      FRAMES_PER_ISO_BUF;
861 		urb->transfer_buffer = dec->iso_buffer + buffer_offset;
862 		buffer_offset += ISO_FRAME_SIZE * FRAMES_PER_ISO_BUF;
863 
864 		for (j = 0; j < FRAMES_PER_ISO_BUF; j++) {
865 			urb->iso_frame_desc[j].offset = frame_offset;
866 			urb->iso_frame_desc[j].length = ISO_FRAME_SIZE;
867 			frame_offset += ISO_FRAME_SIZE;
868 		}
869 	}
870 }
871 
872 static void ttusb_dec_stop_iso_xfer(struct ttusb_dec *dec)
873 {
874 	int i;
875 
876 	dprintk("%s\n", __func__);
877 
878 	if (mutex_lock_interruptible(&dec->iso_mutex))
879 		return;
880 
881 	dec->iso_stream_count--;
882 
883 	if (!dec->iso_stream_count) {
884 		for (i = 0; i < ISO_BUF_COUNT; i++)
885 			usb_kill_urb(dec->iso_urb[i]);
886 	}
887 
888 	mutex_unlock(&dec->iso_mutex);
889 }
890 
891 /* Setting the interface of the DEC tends to take down the USB communications
892  * for a short period, so it's important not to call this function just before
893  * trying to talk to it.
894  */
895 static int ttusb_dec_set_interface(struct ttusb_dec *dec,
896 				   enum ttusb_dec_interface interface)
897 {
898 	int result = 0;
899 	u8 b[] = { 0x05 };
900 
901 	if (interface != dec->interface) {
902 		switch (interface) {
903 		case TTUSB_DEC_INTERFACE_INITIAL:
904 			result = usb_set_interface(dec->udev, 0, 0);
905 			break;
906 		case TTUSB_DEC_INTERFACE_IN:
907 			result = ttusb_dec_send_command(dec, 0x80, sizeof(b),
908 							b, NULL, NULL);
909 			if (result)
910 				return result;
911 			result = usb_set_interface(dec->udev, 0, 8);
912 			break;
913 		case TTUSB_DEC_INTERFACE_OUT:
914 			result = usb_set_interface(dec->udev, 0, 1);
915 			break;
916 		}
917 
918 		if (result)
919 			return result;
920 
921 		dec->interface = interface;
922 	}
923 
924 	return 0;
925 }
926 
927 static int ttusb_dec_start_iso_xfer(struct ttusb_dec *dec)
928 {
929 	int i, result;
930 
931 	dprintk("%s\n", __func__);
932 
933 	if (mutex_lock_interruptible(&dec->iso_mutex))
934 		return -EAGAIN;
935 
936 	if (!dec->iso_stream_count) {
937 		ttusb_dec_setup_urbs(dec);
938 
939 		dec->packet_state = 0;
940 		dec->v_pes_postbytes = 0;
941 		dec->next_packet_id = 0;
942 
943 		for (i = 0; i < ISO_BUF_COUNT; i++) {
944 			if ((result = usb_submit_urb(dec->iso_urb[i],
945 						     GFP_ATOMIC))) {
946 				printk("%s: failed urb submission %d: error %d\n",
947 				       __func__, i, result);
948 
949 				while (i) {
950 					usb_kill_urb(dec->iso_urb[i - 1]);
951 					i--;
952 				}
953 
954 				mutex_unlock(&dec->iso_mutex);
955 				return result;
956 			}
957 		}
958 	}
959 
960 	dec->iso_stream_count++;
961 
962 	mutex_unlock(&dec->iso_mutex);
963 
964 	return 0;
965 }
966 
967 static int ttusb_dec_start_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
968 {
969 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
970 	struct ttusb_dec *dec = dvbdmx->priv;
971 	u8 b0[] = { 0x05 };
972 	int result = 0;
973 
974 	dprintk("%s\n", __func__);
975 
976 	dprintk("  ts_type:");
977 
978 	if (dvbdmxfeed->ts_type & TS_DECODER)
979 		dprintk(" TS_DECODER");
980 
981 	if (dvbdmxfeed->ts_type & TS_PACKET)
982 		dprintk(" TS_PACKET");
983 
984 	if (dvbdmxfeed->ts_type & TS_PAYLOAD_ONLY)
985 		dprintk(" TS_PAYLOAD_ONLY");
986 
987 	dprintk("\n");
988 
989 	switch (dvbdmxfeed->pes_type) {
990 
991 	case DMX_PES_VIDEO:
992 		dprintk("  pes_type: DMX_PES_VIDEO\n");
993 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
994 		dec->pid[DMX_PES_VIDEO] = dvbdmxfeed->pid;
995 		dec->video_filter = dvbdmxfeed->filter;
996 		ttusb_dec_set_pids(dec);
997 		break;
998 
999 	case DMX_PES_AUDIO:
1000 		dprintk("  pes_type: DMX_PES_AUDIO\n");
1001 		dec->pid[DMX_PES_AUDIO] = dvbdmxfeed->pid;
1002 		dec->audio_filter = dvbdmxfeed->filter;
1003 		ttusb_dec_set_pids(dec);
1004 		break;
1005 
1006 	case DMX_PES_TELETEXT:
1007 		dec->pid[DMX_PES_TELETEXT] = dvbdmxfeed->pid;
1008 		dprintk("  pes_type: DMX_PES_TELETEXT(not supported)\n");
1009 		return -ENOSYS;
1010 
1011 	case DMX_PES_PCR:
1012 		dprintk("  pes_type: DMX_PES_PCR\n");
1013 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
1014 		ttusb_dec_set_pids(dec);
1015 		break;
1016 
1017 	case DMX_PES_OTHER:
1018 		dprintk("  pes_type: DMX_PES_OTHER(not supported)\n");
1019 		return -ENOSYS;
1020 
1021 	default:
1022 		dprintk("  pes_type: unknown (%d)\n", dvbdmxfeed->pes_type);
1023 		return -EINVAL;
1024 
1025 	}
1026 
1027 	result = ttusb_dec_send_command(dec, 0x80, sizeof(b0), b0, NULL, NULL);
1028 	if (result)
1029 		return result;
1030 
1031 	dec->pva_stream_count++;
1032 	return ttusb_dec_start_iso_xfer(dec);
1033 }
1034 
1035 static int ttusb_dec_start_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1036 {
1037 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1038 	u8 b0[] = { 0x00, 0x00, 0x00, 0x01,
1039 		    0x00, 0x00, 0x00, 0x00,
1040 		    0x00, 0x00, 0x00, 0x00,
1041 		    0x00, 0x00, 0x00, 0x00,
1042 		    0x00, 0xff, 0x00, 0x00,
1043 		    0x00, 0x00, 0x00, 0x00,
1044 		    0x00, 0x00, 0x00, 0x00,
1045 		    0x00 };
1046 	__be16 pid;
1047 	u8 c[COMMAND_PACKET_SIZE];
1048 	int c_length;
1049 	int result;
1050 	struct filter_info *finfo;
1051 	unsigned long flags;
1052 	u8 x = 1;
1053 
1054 	dprintk("%s\n", __func__);
1055 
1056 	pid = htons(dvbdmxfeed->pid);
1057 	memcpy(&b0[0], &pid, 2);
1058 	memcpy(&b0[4], &x, 1);
1059 	memcpy(&b0[5], &dvbdmxfeed->filter->filter.filter_value[0], 1);
1060 
1061 	result = ttusb_dec_send_command(dec, 0x60, sizeof(b0), b0,
1062 					&c_length, c);
1063 
1064 	if (!result) {
1065 		if (c_length == 2) {
1066 			if (!(finfo = kmalloc(sizeof(struct filter_info),
1067 					      GFP_ATOMIC)))
1068 				return -ENOMEM;
1069 
1070 			finfo->stream_id = c[1];
1071 			finfo->filter = dvbdmxfeed->filter;
1072 
1073 			spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1074 			list_add_tail(&finfo->filter_info_list,
1075 				      &dec->filter_info_list);
1076 			spin_unlock_irqrestore(&dec->filter_info_list_lock,
1077 					       flags);
1078 
1079 			dvbdmxfeed->priv = finfo;
1080 
1081 			dec->filter_stream_count++;
1082 			return ttusb_dec_start_iso_xfer(dec);
1083 		}
1084 
1085 		return -EAGAIN;
1086 	} else
1087 		return result;
1088 }
1089 
1090 static int ttusb_dec_start_feed(struct dvb_demux_feed *dvbdmxfeed)
1091 {
1092 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
1093 
1094 	dprintk("%s\n", __func__);
1095 
1096 	if (!dvbdmx->dmx.frontend)
1097 		return -EINVAL;
1098 
1099 	dprintk("  pid: 0x%04X\n", dvbdmxfeed->pid);
1100 
1101 	switch (dvbdmxfeed->type) {
1102 
1103 	case DMX_TYPE_TS:
1104 		return ttusb_dec_start_ts_feed(dvbdmxfeed);
1105 		break;
1106 
1107 	case DMX_TYPE_SEC:
1108 		return ttusb_dec_start_sec_feed(dvbdmxfeed);
1109 		break;
1110 
1111 	default:
1112 		dprintk("  type: unknown (%d)\n", dvbdmxfeed->type);
1113 		return -EINVAL;
1114 
1115 	}
1116 }
1117 
1118 static int ttusb_dec_stop_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
1119 {
1120 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1121 	u8 b0[] = { 0x00 };
1122 
1123 	ttusb_dec_send_command(dec, 0x81, sizeof(b0), b0, NULL, NULL);
1124 
1125 	dec->pva_stream_count--;
1126 
1127 	ttusb_dec_stop_iso_xfer(dec);
1128 
1129 	return 0;
1130 }
1131 
1132 static int ttusb_dec_stop_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1133 {
1134 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1135 	u8 b0[] = { 0x00, 0x00 };
1136 	struct filter_info *finfo = (struct filter_info *)dvbdmxfeed->priv;
1137 	unsigned long flags;
1138 
1139 	b0[1] = finfo->stream_id;
1140 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1141 	list_del(&finfo->filter_info_list);
1142 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
1143 	kfree(finfo);
1144 	ttusb_dec_send_command(dec, 0x62, sizeof(b0), b0, NULL, NULL);
1145 
1146 	dec->filter_stream_count--;
1147 
1148 	ttusb_dec_stop_iso_xfer(dec);
1149 
1150 	return 0;
1151 }
1152 
1153 static int ttusb_dec_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
1154 {
1155 	dprintk("%s\n", __func__);
1156 
1157 	switch (dvbdmxfeed->type) {
1158 	case DMX_TYPE_TS:
1159 		return ttusb_dec_stop_ts_feed(dvbdmxfeed);
1160 		break;
1161 
1162 	case DMX_TYPE_SEC:
1163 		return ttusb_dec_stop_sec_feed(dvbdmxfeed);
1164 		break;
1165 	}
1166 
1167 	return 0;
1168 }
1169 
1170 static void ttusb_dec_free_iso_urbs(struct ttusb_dec *dec)
1171 {
1172 	int i;
1173 
1174 	dprintk("%s\n", __func__);
1175 
1176 	for (i = 0; i < ISO_BUF_COUNT; i++)
1177 		usb_free_urb(dec->iso_urb[i]);
1178 	kfree(dec->iso_buffer);
1179 }
1180 
1181 static int ttusb_dec_alloc_iso_urbs(struct ttusb_dec *dec)
1182 {
1183 	int i;
1184 
1185 	dprintk("%s\n", __func__);
1186 
1187 	dec->iso_buffer = kcalloc(FRAMES_PER_ISO_BUF * ISO_BUF_COUNT,
1188 			ISO_FRAME_SIZE, GFP_KERNEL);
1189 	if (!dec->iso_buffer)
1190 		return -ENOMEM;
1191 
1192 	for (i = 0; i < ISO_BUF_COUNT; i++) {
1193 		struct urb *urb;
1194 
1195 		if (!(urb = usb_alloc_urb(FRAMES_PER_ISO_BUF, GFP_ATOMIC))) {
1196 			ttusb_dec_free_iso_urbs(dec);
1197 			return -ENOMEM;
1198 		}
1199 
1200 		dec->iso_urb[i] = urb;
1201 	}
1202 
1203 	ttusb_dec_setup_urbs(dec);
1204 
1205 	return 0;
1206 }
1207 
1208 static void ttusb_dec_init_tasklet(struct ttusb_dec *dec)
1209 {
1210 	spin_lock_init(&dec->urb_frame_list_lock);
1211 	INIT_LIST_HEAD(&dec->urb_frame_list);
1212 	tasklet_init(&dec->urb_tasklet, ttusb_dec_process_urb_frame_list,
1213 		     (unsigned long)dec);
1214 }
1215 
1216 static int ttusb_init_rc( struct ttusb_dec *dec)
1217 {
1218 	struct input_dev *input_dev;
1219 	u8 b[] = { 0x00, 0x01 };
1220 	int i;
1221 	int err;
1222 
1223 	usb_make_path(dec->udev, dec->rc_phys, sizeof(dec->rc_phys));
1224 	strlcat(dec->rc_phys, "/input0", sizeof(dec->rc_phys));
1225 
1226 	input_dev = input_allocate_device();
1227 	if (!input_dev)
1228 		return -ENOMEM;
1229 
1230 	input_dev->name = "ttusb_dec remote control";
1231 	input_dev->phys = dec->rc_phys;
1232 	input_dev->evbit[0] = BIT_MASK(EV_KEY);
1233 	input_dev->keycodesize = sizeof(u16);
1234 	input_dev->keycodemax = 0x1a;
1235 	input_dev->keycode = rc_keys;
1236 
1237 	for (i = 0; i < ARRAY_SIZE(rc_keys); i++)
1238 		  set_bit(rc_keys[i], input_dev->keybit);
1239 
1240 	err = input_register_device(input_dev);
1241 	if (err) {
1242 		input_free_device(input_dev);
1243 		return err;
1244 	}
1245 
1246 	dec->rc_input_dev = input_dev;
1247 	if (usb_submit_urb(dec->irq_urb, GFP_KERNEL))
1248 		printk("%s: usb_submit_urb failed\n",__func__);
1249 	/* enable irq pipe */
1250 	ttusb_dec_send_command(dec,0xb0,sizeof(b),b,NULL,NULL);
1251 
1252 	return 0;
1253 }
1254 
1255 static void ttusb_dec_init_v_pes(struct ttusb_dec *dec)
1256 {
1257 	dprintk("%s\n", __func__);
1258 
1259 	dec->v_pes[0] = 0x00;
1260 	dec->v_pes[1] = 0x00;
1261 	dec->v_pes[2] = 0x01;
1262 	dec->v_pes[3] = 0xe0;
1263 }
1264 
1265 static int ttusb_dec_init_usb(struct ttusb_dec *dec)
1266 {
1267 	int result;
1268 
1269 	dprintk("%s\n", __func__);
1270 
1271 	mutex_init(&dec->usb_mutex);
1272 	mutex_init(&dec->iso_mutex);
1273 
1274 	dec->command_pipe = usb_sndbulkpipe(dec->udev, COMMAND_PIPE);
1275 	dec->result_pipe = usb_rcvbulkpipe(dec->udev, RESULT_PIPE);
1276 	dec->in_pipe = usb_rcvisocpipe(dec->udev, IN_PIPE);
1277 	dec->out_pipe = usb_sndisocpipe(dec->udev, OUT_PIPE);
1278 	dec->irq_pipe = usb_rcvintpipe(dec->udev, IRQ_PIPE);
1279 
1280 	if(enable_rc) {
1281 		dec->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
1282 		if(!dec->irq_urb) {
1283 			return -ENOMEM;
1284 		}
1285 		dec->irq_buffer = usb_alloc_coherent(dec->udev,IRQ_PACKET_SIZE,
1286 					GFP_KERNEL, &dec->irq_dma_handle);
1287 		if(!dec->irq_buffer) {
1288 			usb_free_urb(dec->irq_urb);
1289 			return -ENOMEM;
1290 		}
1291 		usb_fill_int_urb(dec->irq_urb, dec->udev,dec->irq_pipe,
1292 				 dec->irq_buffer, IRQ_PACKET_SIZE,
1293 				 ttusb_dec_handle_irq, dec, 1);
1294 		dec->irq_urb->transfer_dma = dec->irq_dma_handle;
1295 		dec->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1296 	}
1297 
1298 	result = ttusb_dec_alloc_iso_urbs(dec);
1299 	if (result) {
1300 		usb_free_urb(dec->irq_urb);
1301 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1302 				  dec->irq_buffer, dec->irq_dma_handle);
1303 	}
1304 	return result;
1305 }
1306 
1307 static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
1308 {
1309 	int i, j, actual_len, result, size, trans_count;
1310 	u8 b0[] = { 0x00, 0x00, 0x00, 0x00,
1311 		    0x00, 0x00, 0x00, 0x00,
1312 		    0x61, 0x00 };
1313 	u8 b1[] = { 0x61 };
1314 	u8 *b;
1315 	char idstring[21];
1316 	const u8 *firmware = NULL;
1317 	size_t firmware_size = 0;
1318 	u16 firmware_csum = 0;
1319 	__be16 firmware_csum_ns;
1320 	__be32 firmware_size_nl;
1321 	u32 crc32_csum, crc32_check;
1322 	__be32 tmp;
1323 	const struct firmware *fw_entry = NULL;
1324 
1325 	dprintk("%s\n", __func__);
1326 
1327 	result = request_firmware(&fw_entry, dec->firmware_name, &dec->udev->dev);
1328 	if (result) {
1329 		printk(KERN_ERR "%s: Firmware (%s) unavailable.\n",
1330 		       __func__, dec->firmware_name);
1331 		return result;
1332 	}
1333 
1334 	firmware = fw_entry->data;
1335 	firmware_size = fw_entry->size;
1336 
1337 	if (firmware_size < 60) {
1338 		printk("%s: firmware size too small for DSP code (%zu < 60).\n",
1339 			__func__, firmware_size);
1340 		release_firmware(fw_entry);
1341 		return -ENOENT;
1342 	}
1343 
1344 	/* a 32 bit checksum over the first 56 bytes of the DSP Code is stored
1345 	   at offset 56 of file, so use it to check if the firmware file is
1346 	   valid. */
1347 	crc32_csum = crc32(~0L, firmware, 56) ^ ~0L;
1348 	memcpy(&tmp, &firmware[56], 4);
1349 	crc32_check = ntohl(tmp);
1350 	if (crc32_csum != crc32_check) {
1351 		printk("%s: crc32 check of DSP code failed (calculated 0x%08x != 0x%08x in file), file invalid.\n",
1352 			__func__, crc32_csum, crc32_check);
1353 		release_firmware(fw_entry);
1354 		return -ENOENT;
1355 	}
1356 	memcpy(idstring, &firmware[36], 20);
1357 	idstring[20] = '\0';
1358 	printk(KERN_INFO "ttusb_dec: found DSP code \"%s\".\n", idstring);
1359 
1360 	firmware_size_nl = htonl(firmware_size);
1361 	memcpy(b0, &firmware_size_nl, 4);
1362 	firmware_csum = crc16(~0, firmware, firmware_size) ^ ~0;
1363 	firmware_csum_ns = htons(firmware_csum);
1364 	memcpy(&b0[6], &firmware_csum_ns, 2);
1365 
1366 	result = ttusb_dec_send_command(dec, 0x41, sizeof(b0), b0, NULL, NULL);
1367 
1368 	if (result) {
1369 		release_firmware(fw_entry);
1370 		return result;
1371 	}
1372 
1373 	trans_count = 0;
1374 	j = 0;
1375 
1376 	b = kmalloc(ARM_PACKET_SIZE, GFP_KERNEL);
1377 	if (b == NULL) {
1378 		release_firmware(fw_entry);
1379 		return -ENOMEM;
1380 	}
1381 
1382 	for (i = 0; i < firmware_size; i += COMMAND_PACKET_SIZE) {
1383 		size = firmware_size - i;
1384 		if (size > COMMAND_PACKET_SIZE)
1385 			size = COMMAND_PACKET_SIZE;
1386 
1387 		b[j + 0] = 0xaa;
1388 		b[j + 1] = trans_count++;
1389 		b[j + 2] = 0xf0;
1390 		b[j + 3] = size;
1391 		memcpy(&b[j + 4], &firmware[i], size);
1392 
1393 		j += COMMAND_PACKET_SIZE + 4;
1394 
1395 		if (j >= ARM_PACKET_SIZE) {
1396 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1397 					      ARM_PACKET_SIZE, &actual_len,
1398 					      100);
1399 			j = 0;
1400 		} else if (size < COMMAND_PACKET_SIZE) {
1401 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1402 					      j - COMMAND_PACKET_SIZE + size,
1403 					      &actual_len, 100);
1404 		}
1405 	}
1406 
1407 	result = ttusb_dec_send_command(dec, 0x43, sizeof(b1), b1, NULL, NULL);
1408 
1409 	release_firmware(fw_entry);
1410 	kfree(b);
1411 
1412 	return result;
1413 }
1414 
1415 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
1416 {
1417 	int result;
1418 	unsigned int mode = 0, model = 0, version = 0;
1419 
1420 	dprintk("%s\n", __func__);
1421 
1422 	result = ttusb_dec_get_stb_state(dec, &mode, &model, &version);
1423 	if (result)
1424 		return result;
1425 
1426 	if (!mode) {
1427 		if (version == 0xABCDEFAB)
1428 			printk(KERN_INFO "ttusb_dec: no version info in Firmware\n");
1429 		else
1430 			printk(KERN_INFO "ttusb_dec: Firmware %x.%02x%c%c\n",
1431 			       version >> 24, (version >> 16) & 0xff,
1432 			       (version >> 8) & 0xff, version & 0xff);
1433 
1434 		result = ttusb_dec_boot_dsp(dec);
1435 		if (result)
1436 			return result;
1437 	} else {
1438 		/* We can't trust the USB IDs that some firmwares
1439 		   give the box */
1440 		switch (model) {
1441 		case 0x00070001:
1442 		case 0x00070008:
1443 		case 0x0007000c:
1444 			ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1445 			break;
1446 		case 0x00070009:
1447 		case 0x00070013:
1448 			ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1449 			break;
1450 		case 0x00070011:
1451 			ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1452 			break;
1453 		default:
1454 			printk(KERN_ERR "%s: unknown model returned by firmware (%08x) - please report\n",
1455 			       __func__, model);
1456 			return -ENOENT;
1457 		}
1458 		if (version >= 0x01770000)
1459 			dec->can_playback = 1;
1460 	}
1461 	return 0;
1462 }
1463 
1464 static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
1465 {
1466 	int result;
1467 
1468 	dprintk("%s\n", __func__);
1469 
1470 	if ((result = dvb_register_adapter(&dec->adapter,
1471 					   dec->model_name, THIS_MODULE,
1472 					   &dec->udev->dev,
1473 					   adapter_nr)) < 0) {
1474 		printk("%s: dvb_register_adapter failed: error %d\n",
1475 		       __func__, result);
1476 
1477 		return result;
1478 	}
1479 
1480 	dec->demux.dmx.capabilities = DMX_TS_FILTERING | DMX_SECTION_FILTERING;
1481 
1482 	dec->demux.priv = (void *)dec;
1483 	dec->demux.filternum = 31;
1484 	dec->demux.feednum = 31;
1485 	dec->demux.start_feed = ttusb_dec_start_feed;
1486 	dec->demux.stop_feed = ttusb_dec_stop_feed;
1487 	dec->demux.write_to_decoder = NULL;
1488 
1489 	if ((result = dvb_dmx_init(&dec->demux)) < 0) {
1490 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1491 		       result);
1492 
1493 		dvb_unregister_adapter(&dec->adapter);
1494 
1495 		return result;
1496 	}
1497 
1498 	dec->dmxdev.filternum = 32;
1499 	dec->dmxdev.demux = &dec->demux.dmx;
1500 	dec->dmxdev.capabilities = 0;
1501 
1502 	if ((result = dvb_dmxdev_init(&dec->dmxdev, &dec->adapter)) < 0) {
1503 		printk("%s: dvb_dmxdev_init failed: error %d\n",
1504 		       __func__, result);
1505 
1506 		dvb_dmx_release(&dec->demux);
1507 		dvb_unregister_adapter(&dec->adapter);
1508 
1509 		return result;
1510 	}
1511 
1512 	dec->frontend.source = DMX_FRONTEND_0;
1513 
1514 	if ((result = dec->demux.dmx.add_frontend(&dec->demux.dmx,
1515 						  &dec->frontend)) < 0) {
1516 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1517 		       result);
1518 
1519 		dvb_dmxdev_release(&dec->dmxdev);
1520 		dvb_dmx_release(&dec->demux);
1521 		dvb_unregister_adapter(&dec->adapter);
1522 
1523 		return result;
1524 	}
1525 
1526 	if ((result = dec->demux.dmx.connect_frontend(&dec->demux.dmx,
1527 						      &dec->frontend)) < 0) {
1528 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1529 		       result);
1530 
1531 		dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1532 		dvb_dmxdev_release(&dec->dmxdev);
1533 		dvb_dmx_release(&dec->demux);
1534 		dvb_unregister_adapter(&dec->adapter);
1535 
1536 		return result;
1537 	}
1538 
1539 	dvb_net_init(&dec->adapter, &dec->dvb_net, &dec->demux.dmx);
1540 
1541 	return 0;
1542 }
1543 
1544 static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
1545 {
1546 	dprintk("%s\n", __func__);
1547 
1548 	dvb_net_release(&dec->dvb_net);
1549 	dec->demux.dmx.close(&dec->demux.dmx);
1550 	dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1551 	dvb_dmxdev_release(&dec->dmxdev);
1552 	dvb_dmx_release(&dec->demux);
1553 	if (dec->fe) {
1554 		dvb_unregister_frontend(dec->fe);
1555 		if (dec->fe->ops.release)
1556 			dec->fe->ops.release(dec->fe);
1557 	}
1558 	dvb_unregister_adapter(&dec->adapter);
1559 }
1560 
1561 static void ttusb_dec_exit_rc(struct ttusb_dec *dec)
1562 {
1563 	dprintk("%s\n", __func__);
1564 
1565 	if (dec->rc_input_dev) {
1566 		input_unregister_device(dec->rc_input_dev);
1567 		dec->rc_input_dev = NULL;
1568 	}
1569 }
1570 
1571 
1572 static void ttusb_dec_exit_usb(struct ttusb_dec *dec)
1573 {
1574 	int i;
1575 
1576 	dprintk("%s\n", __func__);
1577 
1578 	if (enable_rc) {
1579 		/* we have to check whether the irq URB is already submitted.
1580 		 * As the irq is submitted after the interface is changed,
1581 		 * this is the best method i figured out.
1582 		 * Any others?*/
1583 		if (dec->interface == TTUSB_DEC_INTERFACE_IN)
1584 			usb_kill_urb(dec->irq_urb);
1585 
1586 		usb_free_urb(dec->irq_urb);
1587 
1588 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1589 				  dec->irq_buffer, dec->irq_dma_handle);
1590 	}
1591 
1592 	dec->iso_stream_count = 0;
1593 
1594 	for (i = 0; i < ISO_BUF_COUNT; i++)
1595 		usb_kill_urb(dec->iso_urb[i]);
1596 
1597 	ttusb_dec_free_iso_urbs(dec);
1598 }
1599 
1600 static void ttusb_dec_exit_tasklet(struct ttusb_dec *dec)
1601 {
1602 	struct list_head *item;
1603 	struct urb_frame *frame;
1604 
1605 	tasklet_kill(&dec->urb_tasklet);
1606 
1607 	while ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
1608 		frame = list_entry(item, struct urb_frame, urb_frame_list);
1609 		list_del(&frame->urb_frame_list);
1610 		kfree(frame);
1611 	}
1612 }
1613 
1614 static void ttusb_dec_init_filters(struct ttusb_dec *dec)
1615 {
1616 	INIT_LIST_HEAD(&dec->filter_info_list);
1617 	spin_lock_init(&dec->filter_info_list_lock);
1618 }
1619 
1620 static void ttusb_dec_exit_filters(struct ttusb_dec *dec)
1621 {
1622 	struct list_head *item;
1623 	struct filter_info *finfo;
1624 
1625 	while ((item = dec->filter_info_list.next) != &dec->filter_info_list) {
1626 		finfo = list_entry(item, struct filter_info, filter_info_list);
1627 		list_del(&finfo->filter_info_list);
1628 		kfree(finfo);
1629 	}
1630 }
1631 
1632 static int fe_send_command(struct dvb_frontend* fe, const u8 command,
1633 			   int param_length, const u8 params[],
1634 			   int *result_length, u8 cmd_result[])
1635 {
1636 	struct ttusb_dec* dec = fe->dvb->priv;
1637 	return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
1638 }
1639 
1640 static const struct ttusbdecfe_config fe_config = {
1641 	.send_command = fe_send_command
1642 };
1643 
1644 static int ttusb_dec_probe(struct usb_interface *intf,
1645 			   const struct usb_device_id *id)
1646 {
1647 	struct usb_device *udev;
1648 	struct ttusb_dec *dec;
1649 	int result;
1650 
1651 	dprintk("%s\n", __func__);
1652 
1653 	udev = interface_to_usbdev(intf);
1654 
1655 	if (!(dec = kzalloc(sizeof(struct ttusb_dec), GFP_KERNEL))) {
1656 		printk("%s: couldn't allocate memory.\n", __func__);
1657 		return -ENOMEM;
1658 	}
1659 
1660 	usb_set_intfdata(intf, (void *)dec);
1661 
1662 	switch (id->idProduct) {
1663 	case 0x1006:
1664 		ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1665 		break;
1666 
1667 	case 0x1008:
1668 		ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1669 		break;
1670 
1671 	case 0x1009:
1672 		ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1673 		break;
1674 	}
1675 
1676 	dec->udev = udev;
1677 
1678 	result = ttusb_dec_init_usb(dec);
1679 	if (result)
1680 		goto err_usb;
1681 	result = ttusb_dec_init_stb(dec);
1682 	if (result)
1683 		goto err_stb;
1684 	result = ttusb_dec_init_dvb(dec);
1685 	if (result)
1686 		goto err_stb;
1687 
1688 	dec->adapter.priv = dec;
1689 	switch (id->idProduct) {
1690 	case 0x1006:
1691 		dec->fe = ttusbdecfe_dvbs_attach(&fe_config);
1692 		break;
1693 
1694 	case 0x1008:
1695 	case 0x1009:
1696 		dec->fe = ttusbdecfe_dvbt_attach(&fe_config);
1697 		break;
1698 	}
1699 
1700 	if (dec->fe == NULL) {
1701 		printk("dvb-ttusb-dec: A frontend driver was not found for device [%04x:%04x]\n",
1702 		       le16_to_cpu(dec->udev->descriptor.idVendor),
1703 		       le16_to_cpu(dec->udev->descriptor.idProduct));
1704 	} else {
1705 		if (dvb_register_frontend(&dec->adapter, dec->fe)) {
1706 			printk("budget-ci: Frontend registration failed!\n");
1707 			if (dec->fe->ops.release)
1708 				dec->fe->ops.release(dec->fe);
1709 			dec->fe = NULL;
1710 		}
1711 	}
1712 
1713 	ttusb_dec_init_v_pes(dec);
1714 	ttusb_dec_init_filters(dec);
1715 	ttusb_dec_init_tasklet(dec);
1716 
1717 	dec->active = 1;
1718 
1719 	ttusb_dec_set_interface(dec, TTUSB_DEC_INTERFACE_IN);
1720 
1721 	if (enable_rc)
1722 		ttusb_init_rc(dec);
1723 
1724 	return 0;
1725 err_stb:
1726 	ttusb_dec_exit_usb(dec);
1727 err_usb:
1728 	kfree(dec);
1729 	return result;
1730 }
1731 
1732 static void ttusb_dec_disconnect(struct usb_interface *intf)
1733 {
1734 	struct ttusb_dec *dec = usb_get_intfdata(intf);
1735 
1736 	usb_set_intfdata(intf, NULL);
1737 
1738 	dprintk("%s\n", __func__);
1739 
1740 	if (dec->active) {
1741 		ttusb_dec_exit_tasklet(dec);
1742 		ttusb_dec_exit_filters(dec);
1743 		if(enable_rc)
1744 			ttusb_dec_exit_rc(dec);
1745 		ttusb_dec_exit_usb(dec);
1746 		ttusb_dec_exit_dvb(dec);
1747 	}
1748 
1749 	kfree(dec);
1750 }
1751 
1752 static void ttusb_dec_set_model(struct ttusb_dec *dec,
1753 				enum ttusb_dec_model model)
1754 {
1755 	dec->model = model;
1756 
1757 	switch (model) {
1758 	case TTUSB_DEC2000T:
1759 		dec->model_name = "DEC2000-t";
1760 		dec->firmware_name = "dvb-ttusb-dec-2000t.fw";
1761 		break;
1762 
1763 	case TTUSB_DEC2540T:
1764 		dec->model_name = "DEC2540-t";
1765 		dec->firmware_name = "dvb-ttusb-dec-2540t.fw";
1766 		break;
1767 
1768 	case TTUSB_DEC3000S:
1769 		dec->model_name = "DEC3000-s";
1770 		dec->firmware_name = "dvb-ttusb-dec-3000s.fw";
1771 		break;
1772 	}
1773 }
1774 
1775 static const struct usb_device_id ttusb_dec_table[] = {
1776 	{USB_DEVICE(0x0b48, 0x1006)},	/* DEC3000-s */
1777 	/*{USB_DEVICE(0x0b48, 0x1007)},	   Unconfirmed */
1778 	{USB_DEVICE(0x0b48, 0x1008)},	/* DEC2000-t */
1779 	{USB_DEVICE(0x0b48, 0x1009)},	/* DEC2540-t */
1780 	{}
1781 };
1782 
1783 static struct usb_driver ttusb_dec_driver = {
1784 	.name		= "ttusb-dec",
1785 	.probe		= ttusb_dec_probe,
1786 	.disconnect	= ttusb_dec_disconnect,
1787 	.id_table	= ttusb_dec_table,
1788 };
1789 
1790 module_usb_driver(ttusb_dec_driver);
1791 
1792 MODULE_AUTHOR("Alex Woods <linux-dvb@giblets.org>");
1793 MODULE_DESCRIPTION(DRIVER_NAME);
1794 MODULE_LICENSE("GPL");
1795 MODULE_DEVICE_TABLE(usb, ttusb_dec_table);
1796