1 /*
2  * TTUSB DEC Driver
3  *
4  * Copyright (C) 2003-2004 Alex Woods <linux-dvb@giblets.org>
5  * IR support by Peter Beutner <p.beutner@gmx.net>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, write to the Free Software
19  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20  *
21  */
22 
23 #include <linux/list.h>
24 #include <linux/module.h>
25 #include <linux/pci.h>
26 #include <linux/slab.h>
27 #include <linux/spinlock.h>
28 #include <linux/usb.h>
29 #include <linux/interrupt.h>
30 #include <linux/firmware.h>
31 #include <linux/crc32.h>
32 #include <linux/init.h>
33 #include <linux/input.h>
34 
35 #include <linux/mutex.h>
36 
37 #include "dmxdev.h"
38 #include "dvb_demux.h"
39 #include "dvb_filter.h"
40 #include "dvb_frontend.h"
41 #include "dvb_net.h"
42 #include "ttusbdecfe.h"
43 
44 static int debug;
45 static int output_pva;
46 static int enable_rc;
47 
48 module_param(debug, int, 0644);
49 MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
50 module_param(output_pva, int, 0444);
51 MODULE_PARM_DESC(output_pva, "Output PVA from dvr device (default:off)");
52 module_param(enable_rc, int, 0644);
53 MODULE_PARM_DESC(enable_rc, "Turn on/off IR remote control(default: off)");
54 
55 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
56 
57 #define dprintk	if (debug) printk
58 
59 #define DRIVER_NAME		"TechnoTrend/Hauppauge DEC USB"
60 
61 #define COMMAND_PIPE		0x03
62 #define RESULT_PIPE		0x04
63 #define IN_PIPE			0x08
64 #define OUT_PIPE		0x07
65 #define IRQ_PIPE		0x0A
66 
67 #define COMMAND_PACKET_SIZE	0x3c
68 #define ARM_PACKET_SIZE		0x1000
69 #define IRQ_PACKET_SIZE		0x8
70 
71 #define ISO_BUF_COUNT		0x04
72 #define FRAMES_PER_ISO_BUF	0x04
73 #define ISO_FRAME_SIZE		0x0380
74 
75 #define	MAX_PVA_LENGTH		6144
76 
77 enum ttusb_dec_model {
78 	TTUSB_DEC2000T,
79 	TTUSB_DEC2540T,
80 	TTUSB_DEC3000S
81 };
82 
83 enum ttusb_dec_packet_type {
84 	TTUSB_DEC_PACKET_PVA,
85 	TTUSB_DEC_PACKET_SECTION,
86 	TTUSB_DEC_PACKET_EMPTY
87 };
88 
89 enum ttusb_dec_interface {
90 	TTUSB_DEC_INTERFACE_INITIAL,
91 	TTUSB_DEC_INTERFACE_IN,
92 	TTUSB_DEC_INTERFACE_OUT
93 };
94 
95 struct ttusb_dec {
96 	enum ttusb_dec_model		model;
97 	char				*model_name;
98 	char				*firmware_name;
99 	int				can_playback;
100 
101 	/* DVB bits */
102 	struct dvb_adapter		adapter;
103 	struct dmxdev			dmxdev;
104 	struct dvb_demux		demux;
105 	struct dmx_frontend		frontend;
106 	struct dvb_net			dvb_net;
107 	struct dvb_frontend*		fe;
108 
109 	u16			pid[DMX_PES_OTHER];
110 
111 	/* USB bits */
112 	struct usb_device		*udev;
113 	u8				trans_count;
114 	unsigned int			command_pipe;
115 	unsigned int			result_pipe;
116 	unsigned int			in_pipe;
117 	unsigned int			out_pipe;
118 	unsigned int			irq_pipe;
119 	enum ttusb_dec_interface	interface;
120 	struct mutex			usb_mutex;
121 
122 	void			*irq_buffer;
123 	struct urb		*irq_urb;
124 	dma_addr_t		irq_dma_handle;
125 	void			*iso_buffer;
126 	dma_addr_t		iso_dma_handle;
127 	struct urb		*iso_urb[ISO_BUF_COUNT];
128 	int			iso_stream_count;
129 	struct mutex		iso_mutex;
130 
131 	u8				packet[MAX_PVA_LENGTH + 4];
132 	enum ttusb_dec_packet_type	packet_type;
133 	int				packet_state;
134 	int				packet_length;
135 	int				packet_payload_length;
136 	u16				next_packet_id;
137 
138 	int				pva_stream_count;
139 	int				filter_stream_count;
140 
141 	struct dvb_filter_pes2ts	a_pes2ts;
142 	struct dvb_filter_pes2ts	v_pes2ts;
143 
144 	u8			v_pes[16 + MAX_PVA_LENGTH];
145 	int			v_pes_length;
146 	int			v_pes_postbytes;
147 
148 	struct list_head	urb_frame_list;
149 	struct tasklet_struct	urb_tasklet;
150 	spinlock_t		urb_frame_list_lock;
151 
152 	struct dvb_demux_filter	*audio_filter;
153 	struct dvb_demux_filter	*video_filter;
154 	struct list_head	filter_info_list;
155 	spinlock_t		filter_info_list_lock;
156 
157 	struct input_dev	*rc_input_dev;
158 	char			rc_phys[64];
159 
160 	int			active; /* Loaded successfully */
161 };
162 
163 struct urb_frame {
164 	u8			data[ISO_FRAME_SIZE];
165 	int			length;
166 	struct list_head	urb_frame_list;
167 };
168 
169 struct filter_info {
170 	u8			stream_id;
171 	struct dvb_demux_filter	*filter;
172 	struct list_head	filter_info_list;
173 };
174 
175 static u16 rc_keys[] = {
176 	KEY_POWER,
177 	KEY_MUTE,
178 	KEY_1,
179 	KEY_2,
180 	KEY_3,
181 	KEY_4,
182 	KEY_5,
183 	KEY_6,
184 	KEY_7,
185 	KEY_8,
186 	KEY_9,
187 	KEY_0,
188 	KEY_CHANNELUP,
189 	KEY_VOLUMEDOWN,
190 	KEY_OK,
191 	KEY_VOLUMEUP,
192 	KEY_CHANNELDOWN,
193 	KEY_PREVIOUS,
194 	KEY_ESC,
195 	KEY_RED,
196 	KEY_GREEN,
197 	KEY_YELLOW,
198 	KEY_BLUE,
199 	KEY_OPTION,
200 	KEY_M,
201 	KEY_RADIO
202 };
203 
204 static void ttusb_dec_set_model(struct ttusb_dec *dec,
205 				enum ttusb_dec_model model);
206 
207 static void ttusb_dec_handle_irq( struct urb *urb)
208 {
209 	struct ttusb_dec * dec = urb->context;
210 	char *buffer = dec->irq_buffer;
211 	int retval;
212 
213 	switch(urb->status) {
214 		case 0: /*success*/
215 			break;
216 		case -ECONNRESET:
217 		case -ENOENT:
218 		case -ESHUTDOWN:
219 		case -ETIME:
220 			/* this urb is dead, cleanup */
221 			dprintk("%s:urb shutting down with status: %d\n",
222 					__func__, urb->status);
223 			return;
224 		default:
225 			dprintk("%s:nonzero status received: %d\n",
226 					__func__,urb->status);
227 			goto exit;
228 	}
229 
230 	if( (buffer[0] == 0x1) && (buffer[2] == 0x15) )  {
231 		/* IR - Event */
232 		/* this is an fact a bit too simple implementation;
233 		 * the box also reports a keyrepeat signal
234 		 * (with buffer[3] == 0x40) in an intervall of ~100ms.
235 		 * But to handle this correctly we had to imlemenent some
236 		 * kind of timer which signals a 'key up' event if no
237 		 * keyrepeat signal is received for lets say 200ms.
238 		 * this should/could be added later ...
239 		 * for now lets report each signal as a key down and up*/
240 		dprintk("%s:rc signal:%d\n", __func__, buffer[4]);
241 		input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 1);
242 		input_sync(dec->rc_input_dev);
243 		input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 0);
244 		input_sync(dec->rc_input_dev);
245 	}
246 
247 exit:	retval = usb_submit_urb(urb, GFP_ATOMIC);
248 	if(retval)
249 		printk("%s - usb_commit_urb failed with result: %d\n",
250 			__func__, retval);
251 }
252 
253 static u16 crc16(u16 crc, const u8 *buf, size_t len)
254 {
255 	u16 tmp;
256 
257 	while (len--) {
258 		crc ^= *buf++;
259 		crc ^= (u8)crc >> 4;
260 		tmp = (u8)crc;
261 		crc ^= (tmp ^ (tmp << 1)) << 4;
262 	}
263 	return crc;
264 }
265 
266 static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
267 				  int param_length, const u8 params[],
268 				  int *result_length, u8 cmd_result[])
269 {
270 	int result, actual_len, i;
271 	u8 *b;
272 
273 	dprintk("%s\n", __func__);
274 
275 	b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
276 	if (!b)
277 		return -ENOMEM;
278 
279 	if ((result = mutex_lock_interruptible(&dec->usb_mutex))) {
280 		kfree(b);
281 		printk("%s: Failed to lock usb mutex.\n", __func__);
282 		return result;
283 	}
284 
285 	b[0] = 0xaa;
286 	b[1] = ++dec->trans_count;
287 	b[2] = command;
288 	b[3] = param_length;
289 
290 	if (params)
291 		memcpy(&b[4], params, param_length);
292 
293 	if (debug) {
294 		printk("%s: command: ", __func__);
295 		for (i = 0; i < param_length + 4; i++)
296 			printk("0x%02X ", b[i]);
297 		printk("\n");
298 	}
299 
300 	result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
301 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
302 
303 	if (result) {
304 		printk("%s: command bulk message failed: error %d\n",
305 		       __func__, result);
306 		mutex_unlock(&dec->usb_mutex);
307 		kfree(b);
308 		return result;
309 	}
310 
311 	result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
312 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
313 
314 	if (result) {
315 		printk("%s: result bulk message failed: error %d\n",
316 		       __func__, result);
317 		mutex_unlock(&dec->usb_mutex);
318 		kfree(b);
319 		return result;
320 	} else {
321 		if (debug) {
322 			printk("%s: result: ", __func__);
323 			for (i = 0; i < actual_len; i++)
324 				printk("0x%02X ", b[i]);
325 			printk("\n");
326 		}
327 
328 		if (result_length)
329 			*result_length = b[3];
330 		if (cmd_result && b[3] > 0)
331 			memcpy(cmd_result, &b[4], b[3]);
332 
333 		mutex_unlock(&dec->usb_mutex);
334 
335 		kfree(b);
336 		return 0;
337 	}
338 }
339 
340 static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode,
341 				    unsigned int *model, unsigned int *version)
342 {
343 	u8 c[COMMAND_PACKET_SIZE];
344 	int c_length;
345 	int result;
346 	__be32 tmp;
347 
348 	dprintk("%s\n", __func__);
349 
350 	result = ttusb_dec_send_command(dec, 0x08, 0, NULL, &c_length, c);
351 	if (result)
352 		return result;
353 
354 	if (c_length >= 0x0c) {
355 		if (mode != NULL) {
356 			memcpy(&tmp, c, 4);
357 			*mode = ntohl(tmp);
358 		}
359 		if (model != NULL) {
360 			memcpy(&tmp, &c[4], 4);
361 			*model = ntohl(tmp);
362 		}
363 		if (version != NULL) {
364 			memcpy(&tmp, &c[8], 4);
365 			*version = ntohl(tmp);
366 		}
367 		return 0;
368 	} else {
369 		return -ENOENT;
370 	}
371 }
372 
373 static int ttusb_dec_audio_pes2ts_cb(void *priv, unsigned char *data)
374 {
375 	struct ttusb_dec *dec = priv;
376 
377 	dec->audio_filter->feed->cb.ts(data, 188, NULL, 0,
378 				       &dec->audio_filter->feed->feed.ts,
379 				       DMX_OK);
380 
381 	return 0;
382 }
383 
384 static int ttusb_dec_video_pes2ts_cb(void *priv, unsigned char *data)
385 {
386 	struct ttusb_dec *dec = priv;
387 
388 	dec->video_filter->feed->cb.ts(data, 188, NULL, 0,
389 				       &dec->video_filter->feed->feed.ts,
390 				       DMX_OK);
391 
392 	return 0;
393 }
394 
395 static void ttusb_dec_set_pids(struct ttusb_dec *dec)
396 {
397 	u8 b[] = { 0x00, 0x00, 0x00, 0x00,
398 		   0x00, 0x00, 0xff, 0xff,
399 		   0xff, 0xff, 0xff, 0xff };
400 
401 	__be16 pcr = htons(dec->pid[DMX_PES_PCR]);
402 	__be16 audio = htons(dec->pid[DMX_PES_AUDIO]);
403 	__be16 video = htons(dec->pid[DMX_PES_VIDEO]);
404 
405 	dprintk("%s\n", __func__);
406 
407 	memcpy(&b[0], &pcr, 2);
408 	memcpy(&b[2], &audio, 2);
409 	memcpy(&b[4], &video, 2);
410 
411 	ttusb_dec_send_command(dec, 0x50, sizeof(b), b, NULL, NULL);
412 
413 	dvb_filter_pes2ts_init(&dec->a_pes2ts, dec->pid[DMX_PES_AUDIO],
414 			       ttusb_dec_audio_pes2ts_cb, dec);
415 	dvb_filter_pes2ts_init(&dec->v_pes2ts, dec->pid[DMX_PES_VIDEO],
416 			       ttusb_dec_video_pes2ts_cb, dec);
417 	dec->v_pes_length = 0;
418 	dec->v_pes_postbytes = 0;
419 }
420 
421 static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
422 {
423 	if (length < 8) {
424 		printk("%s: packet too short - discarding\n", __func__);
425 		return;
426 	}
427 
428 	if (length > 8 + MAX_PVA_LENGTH) {
429 		printk("%s: packet too long - discarding\n", __func__);
430 		return;
431 	}
432 
433 	switch (pva[2]) {
434 
435 	case 0x01: {		/* VideoStream */
436 		int prebytes = pva[5] & 0x03;
437 		int postbytes = (pva[5] & 0x0c) >> 2;
438 		__be16 v_pes_payload_length;
439 
440 		if (output_pva) {
441 			dec->video_filter->feed->cb.ts(pva, length, NULL, 0,
442 				&dec->video_filter->feed->feed.ts, DMX_OK);
443 			return;
444 		}
445 
446 		if (dec->v_pes_postbytes > 0 &&
447 		    dec->v_pes_postbytes == prebytes) {
448 			memcpy(&dec->v_pes[dec->v_pes_length],
449 			       &pva[12], prebytes);
450 
451 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
452 					  dec->v_pes_length + prebytes, 1);
453 		}
454 
455 		if (pva[5] & 0x10) {
456 			dec->v_pes[7] = 0x80;
457 			dec->v_pes[8] = 0x05;
458 
459 			dec->v_pes[9] = 0x21 | ((pva[8] & 0xc0) >> 5);
460 			dec->v_pes[10] = ((pva[8] & 0x3f) << 2) |
461 					 ((pva[9] & 0xc0) >> 6);
462 			dec->v_pes[11] = 0x01 |
463 					 ((pva[9] & 0x3f) << 2) |
464 					 ((pva[10] & 0x80) >> 6);
465 			dec->v_pes[12] = ((pva[10] & 0x7f) << 1) |
466 					 ((pva[11] & 0xc0) >> 7);
467 			dec->v_pes[13] = 0x01 | ((pva[11] & 0x7f) << 1);
468 
469 			memcpy(&dec->v_pes[14], &pva[12 + prebytes],
470 			       length - 12 - prebytes);
471 			dec->v_pes_length = 14 + length - 12 - prebytes;
472 		} else {
473 			dec->v_pes[7] = 0x00;
474 			dec->v_pes[8] = 0x00;
475 
476 			memcpy(&dec->v_pes[9], &pva[8], length - 8);
477 			dec->v_pes_length = 9 + length - 8;
478 		}
479 
480 		dec->v_pes_postbytes = postbytes;
481 
482 		if (dec->v_pes[9 + dec->v_pes[8]] == 0x00 &&
483 		    dec->v_pes[10 + dec->v_pes[8]] == 0x00 &&
484 		    dec->v_pes[11 + dec->v_pes[8]] == 0x01)
485 			dec->v_pes[6] = 0x84;
486 		else
487 			dec->v_pes[6] = 0x80;
488 
489 		v_pes_payload_length = htons(dec->v_pes_length - 6 +
490 					     postbytes);
491 		memcpy(&dec->v_pes[4], &v_pes_payload_length, 2);
492 
493 		if (postbytes == 0)
494 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
495 					  dec->v_pes_length, 1);
496 
497 		break;
498 	}
499 
500 	case 0x02:		/* MainAudioStream */
501 		if (output_pva) {
502 			dec->audio_filter->feed->cb.ts(pva, length, NULL, 0,
503 				&dec->audio_filter->feed->feed.ts, DMX_OK);
504 			return;
505 		}
506 
507 		dvb_filter_pes2ts(&dec->a_pes2ts, &pva[8], length - 8,
508 				  pva[5] & 0x10);
509 		break;
510 
511 	default:
512 		printk("%s: unknown PVA type: %02x.\n", __func__,
513 		       pva[2]);
514 		break;
515 	}
516 }
517 
518 static void ttusb_dec_process_filter(struct ttusb_dec *dec, u8 *packet,
519 				     int length)
520 {
521 	struct list_head *item;
522 	struct filter_info *finfo;
523 	struct dvb_demux_filter *filter = NULL;
524 	unsigned long flags;
525 	u8 sid;
526 
527 	sid = packet[1];
528 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
529 	for (item = dec->filter_info_list.next; item != &dec->filter_info_list;
530 	     item = item->next) {
531 		finfo = list_entry(item, struct filter_info, filter_info_list);
532 		if (finfo->stream_id == sid) {
533 			filter = finfo->filter;
534 			break;
535 		}
536 	}
537 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
538 
539 	if (filter)
540 		filter->feed->cb.sec(&packet[2], length - 2, NULL, 0,
541 				     &filter->filter, DMX_OK);
542 }
543 
544 static void ttusb_dec_process_packet(struct ttusb_dec *dec)
545 {
546 	int i;
547 	u16 csum = 0;
548 	u16 packet_id;
549 
550 	if (dec->packet_length % 2) {
551 		printk("%s: odd sized packet - discarding\n", __func__);
552 		return;
553 	}
554 
555 	for (i = 0; i < dec->packet_length; i += 2)
556 		csum ^= ((dec->packet[i] << 8) + dec->packet[i + 1]);
557 
558 	if (csum) {
559 		printk("%s: checksum failed - discarding\n", __func__);
560 		return;
561 	}
562 
563 	packet_id = dec->packet[dec->packet_length - 4] << 8;
564 	packet_id += dec->packet[dec->packet_length - 3];
565 
566 	if ((packet_id != dec->next_packet_id) && dec->next_packet_id) {
567 		printk("%s: warning: lost packets between %u and %u\n",
568 		       __func__, dec->next_packet_id - 1, packet_id);
569 	}
570 
571 	if (packet_id == 0xffff)
572 		dec->next_packet_id = 0x8000;
573 	else
574 		dec->next_packet_id = packet_id + 1;
575 
576 	switch (dec->packet_type) {
577 	case TTUSB_DEC_PACKET_PVA:
578 		if (dec->pva_stream_count)
579 			ttusb_dec_process_pva(dec, dec->packet,
580 					      dec->packet_payload_length);
581 		break;
582 
583 	case TTUSB_DEC_PACKET_SECTION:
584 		if (dec->filter_stream_count)
585 			ttusb_dec_process_filter(dec, dec->packet,
586 						 dec->packet_payload_length);
587 		break;
588 
589 	case TTUSB_DEC_PACKET_EMPTY:
590 		break;
591 	}
592 }
593 
594 static void swap_bytes(u8 *b, int length)
595 {
596 	u8 c;
597 
598 	length -= length % 2;
599 	for (; length; b += 2, length -= 2) {
600 		c = *b;
601 		*b = *(b + 1);
602 		*(b + 1) = c;
603 	}
604 }
605 
606 static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,
607 					int length)
608 {
609 	swap_bytes(b, length);
610 
611 	while (length) {
612 		switch (dec->packet_state) {
613 
614 		case 0:
615 		case 1:
616 		case 2:
617 			if (*b++ == 0xaa)
618 				dec->packet_state++;
619 			else
620 				dec->packet_state = 0;
621 
622 			length--;
623 			break;
624 
625 		case 3:
626 			if (*b == 0x00) {
627 				dec->packet_state++;
628 				dec->packet_length = 0;
629 			} else if (*b != 0xaa) {
630 				dec->packet_state = 0;
631 			}
632 
633 			b++;
634 			length--;
635 			break;
636 
637 		case 4:
638 			dec->packet[dec->packet_length++] = *b++;
639 
640 			if (dec->packet_length == 2) {
641 				if (dec->packet[0] == 'A' &&
642 				    dec->packet[1] == 'V') {
643 					dec->packet_type =
644 						TTUSB_DEC_PACKET_PVA;
645 					dec->packet_state++;
646 				} else if (dec->packet[0] == 'S') {
647 					dec->packet_type =
648 						TTUSB_DEC_PACKET_SECTION;
649 					dec->packet_state++;
650 				} else if (dec->packet[0] == 0x00) {
651 					dec->packet_type =
652 						TTUSB_DEC_PACKET_EMPTY;
653 					dec->packet_payload_length = 2;
654 					dec->packet_state = 7;
655 				} else {
656 					printk("%s: unknown packet type: "
657 					       "%02x%02x\n", __func__,
658 					       dec->packet[0], dec->packet[1]);
659 					dec->packet_state = 0;
660 				}
661 			}
662 
663 			length--;
664 			break;
665 
666 		case 5:
667 			dec->packet[dec->packet_length++] = *b++;
668 
669 			if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
670 			    dec->packet_length == 8) {
671 				dec->packet_state++;
672 				dec->packet_payload_length = 8 +
673 					(dec->packet[6] << 8) +
674 					dec->packet[7];
675 			} else if (dec->packet_type ==
676 					TTUSB_DEC_PACKET_SECTION &&
677 				   dec->packet_length == 5) {
678 				dec->packet_state++;
679 				dec->packet_payload_length = 5 +
680 					((dec->packet[3] & 0x0f) << 8) +
681 					dec->packet[4];
682 			}
683 
684 			length--;
685 			break;
686 
687 		case 6: {
688 			int remainder = dec->packet_payload_length -
689 					dec->packet_length;
690 
691 			if (length >= remainder) {
692 				memcpy(dec->packet + dec->packet_length,
693 				       b, remainder);
694 				dec->packet_length += remainder;
695 				b += remainder;
696 				length -= remainder;
697 				dec->packet_state++;
698 			} else {
699 				memcpy(&dec->packet[dec->packet_length],
700 				       b, length);
701 				dec->packet_length += length;
702 				length = 0;
703 			}
704 
705 			break;
706 		}
707 
708 		case 7: {
709 			int tail = 4;
710 
711 			dec->packet[dec->packet_length++] = *b++;
712 
713 			if (dec->packet_type == TTUSB_DEC_PACKET_SECTION &&
714 			    dec->packet_payload_length % 2)
715 				tail++;
716 
717 			if (dec->packet_length ==
718 			    dec->packet_payload_length + tail) {
719 				ttusb_dec_process_packet(dec);
720 				dec->packet_state = 0;
721 			}
722 
723 			length--;
724 			break;
725 		}
726 
727 		default:
728 			printk("%s: illegal packet state encountered.\n",
729 			       __func__);
730 			dec->packet_state = 0;
731 		}
732 	}
733 }
734 
735 static void ttusb_dec_process_urb_frame_list(unsigned long data)
736 {
737 	struct ttusb_dec *dec = (struct ttusb_dec *)data;
738 	struct list_head *item;
739 	struct urb_frame *frame;
740 	unsigned long flags;
741 
742 	while (1) {
743 		spin_lock_irqsave(&dec->urb_frame_list_lock, flags);
744 		if ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
745 			frame = list_entry(item, struct urb_frame,
746 					   urb_frame_list);
747 			list_del(&frame->urb_frame_list);
748 		} else {
749 			spin_unlock_irqrestore(&dec->urb_frame_list_lock,
750 					       flags);
751 			return;
752 		}
753 		spin_unlock_irqrestore(&dec->urb_frame_list_lock, flags);
754 
755 		ttusb_dec_process_urb_frame(dec, frame->data, frame->length);
756 		kfree(frame);
757 	}
758 }
759 
760 static void ttusb_dec_process_urb(struct urb *urb)
761 {
762 	struct ttusb_dec *dec = urb->context;
763 
764 	if (!urb->status) {
765 		int i;
766 
767 		for (i = 0; i < FRAMES_PER_ISO_BUF; i++) {
768 			struct usb_iso_packet_descriptor *d;
769 			u8 *b;
770 			int length;
771 			struct urb_frame *frame;
772 
773 			d = &urb->iso_frame_desc[i];
774 			b = urb->transfer_buffer + d->offset;
775 			length = d->actual_length;
776 
777 			if ((frame = kmalloc(sizeof(struct urb_frame),
778 					     GFP_ATOMIC))) {
779 				unsigned long flags;
780 
781 				memcpy(frame->data, b, length);
782 				frame->length = length;
783 
784 				spin_lock_irqsave(&dec->urb_frame_list_lock,
785 						     flags);
786 				list_add_tail(&frame->urb_frame_list,
787 					      &dec->urb_frame_list);
788 				spin_unlock_irqrestore(&dec->urb_frame_list_lock,
789 						       flags);
790 
791 				tasklet_schedule(&dec->urb_tasklet);
792 			}
793 		}
794 	} else {
795 		 /* -ENOENT is expected when unlinking urbs */
796 		if (urb->status != -ENOENT)
797 			dprintk("%s: urb error: %d\n", __func__,
798 				urb->status);
799 	}
800 
801 	if (dec->iso_stream_count)
802 		usb_submit_urb(urb, GFP_ATOMIC);
803 }
804 
805 static void ttusb_dec_setup_urbs(struct ttusb_dec *dec)
806 {
807 	int i, j, buffer_offset = 0;
808 
809 	dprintk("%s\n", __func__);
810 
811 	for (i = 0; i < ISO_BUF_COUNT; i++) {
812 		int frame_offset = 0;
813 		struct urb *urb = dec->iso_urb[i];
814 
815 		urb->dev = dec->udev;
816 		urb->context = dec;
817 		urb->complete = ttusb_dec_process_urb;
818 		urb->pipe = dec->in_pipe;
819 		urb->transfer_flags = URB_ISO_ASAP;
820 		urb->interval = 1;
821 		urb->number_of_packets = FRAMES_PER_ISO_BUF;
822 		urb->transfer_buffer_length = ISO_FRAME_SIZE *
823 					      FRAMES_PER_ISO_BUF;
824 		urb->transfer_buffer = dec->iso_buffer + buffer_offset;
825 		buffer_offset += ISO_FRAME_SIZE * FRAMES_PER_ISO_BUF;
826 
827 		for (j = 0; j < FRAMES_PER_ISO_BUF; j++) {
828 			urb->iso_frame_desc[j].offset = frame_offset;
829 			urb->iso_frame_desc[j].length = ISO_FRAME_SIZE;
830 			frame_offset += ISO_FRAME_SIZE;
831 		}
832 	}
833 }
834 
835 static void ttusb_dec_stop_iso_xfer(struct ttusb_dec *dec)
836 {
837 	int i;
838 
839 	dprintk("%s\n", __func__);
840 
841 	if (mutex_lock_interruptible(&dec->iso_mutex))
842 		return;
843 
844 	dec->iso_stream_count--;
845 
846 	if (!dec->iso_stream_count) {
847 		for (i = 0; i < ISO_BUF_COUNT; i++)
848 			usb_kill_urb(dec->iso_urb[i]);
849 	}
850 
851 	mutex_unlock(&dec->iso_mutex);
852 }
853 
854 /* Setting the interface of the DEC tends to take down the USB communications
855  * for a short period, so it's important not to call this function just before
856  * trying to talk to it.
857  */
858 static int ttusb_dec_set_interface(struct ttusb_dec *dec,
859 				   enum ttusb_dec_interface interface)
860 {
861 	int result = 0;
862 	u8 b[] = { 0x05 };
863 
864 	if (interface != dec->interface) {
865 		switch (interface) {
866 		case TTUSB_DEC_INTERFACE_INITIAL:
867 			result = usb_set_interface(dec->udev, 0, 0);
868 			break;
869 		case TTUSB_DEC_INTERFACE_IN:
870 			result = ttusb_dec_send_command(dec, 0x80, sizeof(b),
871 							b, NULL, NULL);
872 			if (result)
873 				return result;
874 			result = usb_set_interface(dec->udev, 0, 8);
875 			break;
876 		case TTUSB_DEC_INTERFACE_OUT:
877 			result = usb_set_interface(dec->udev, 0, 1);
878 			break;
879 		}
880 
881 		if (result)
882 			return result;
883 
884 		dec->interface = interface;
885 	}
886 
887 	return 0;
888 }
889 
890 static int ttusb_dec_start_iso_xfer(struct ttusb_dec *dec)
891 {
892 	int i, result;
893 
894 	dprintk("%s\n", __func__);
895 
896 	if (mutex_lock_interruptible(&dec->iso_mutex))
897 		return -EAGAIN;
898 
899 	if (!dec->iso_stream_count) {
900 		ttusb_dec_setup_urbs(dec);
901 
902 		dec->packet_state = 0;
903 		dec->v_pes_postbytes = 0;
904 		dec->next_packet_id = 0;
905 
906 		for (i = 0; i < ISO_BUF_COUNT; i++) {
907 			if ((result = usb_submit_urb(dec->iso_urb[i],
908 						     GFP_ATOMIC))) {
909 				printk("%s: failed urb submission %d: "
910 				       "error %d\n", __func__, i, result);
911 
912 				while (i) {
913 					usb_kill_urb(dec->iso_urb[i - 1]);
914 					i--;
915 				}
916 
917 				mutex_unlock(&dec->iso_mutex);
918 				return result;
919 			}
920 		}
921 	}
922 
923 	dec->iso_stream_count++;
924 
925 	mutex_unlock(&dec->iso_mutex);
926 
927 	return 0;
928 }
929 
930 static int ttusb_dec_start_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
931 {
932 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
933 	struct ttusb_dec *dec = dvbdmx->priv;
934 	u8 b0[] = { 0x05 };
935 	int result = 0;
936 
937 	dprintk("%s\n", __func__);
938 
939 	dprintk("  ts_type:");
940 
941 	if (dvbdmxfeed->ts_type & TS_DECODER)
942 		dprintk(" TS_DECODER");
943 
944 	if (dvbdmxfeed->ts_type & TS_PACKET)
945 		dprintk(" TS_PACKET");
946 
947 	if (dvbdmxfeed->ts_type & TS_PAYLOAD_ONLY)
948 		dprintk(" TS_PAYLOAD_ONLY");
949 
950 	dprintk("\n");
951 
952 	switch (dvbdmxfeed->pes_type) {
953 
954 	case DMX_PES_VIDEO:
955 		dprintk("  pes_type: DMX_PES_VIDEO\n");
956 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
957 		dec->pid[DMX_PES_VIDEO] = dvbdmxfeed->pid;
958 		dec->video_filter = dvbdmxfeed->filter;
959 		ttusb_dec_set_pids(dec);
960 		break;
961 
962 	case DMX_PES_AUDIO:
963 		dprintk("  pes_type: DMX_PES_AUDIO\n");
964 		dec->pid[DMX_PES_AUDIO] = dvbdmxfeed->pid;
965 		dec->audio_filter = dvbdmxfeed->filter;
966 		ttusb_dec_set_pids(dec);
967 		break;
968 
969 	case DMX_PES_TELETEXT:
970 		dec->pid[DMX_PES_TELETEXT] = dvbdmxfeed->pid;
971 		dprintk("  pes_type: DMX_PES_TELETEXT(not supported)\n");
972 		return -ENOSYS;
973 
974 	case DMX_PES_PCR:
975 		dprintk("  pes_type: DMX_PES_PCR\n");
976 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
977 		ttusb_dec_set_pids(dec);
978 		break;
979 
980 	case DMX_PES_OTHER:
981 		dprintk("  pes_type: DMX_PES_OTHER(not supported)\n");
982 		return -ENOSYS;
983 
984 	default:
985 		dprintk("  pes_type: unknown (%d)\n", dvbdmxfeed->pes_type);
986 		return -EINVAL;
987 
988 	}
989 
990 	result = ttusb_dec_send_command(dec, 0x80, sizeof(b0), b0, NULL, NULL);
991 	if (result)
992 		return result;
993 
994 	dec->pva_stream_count++;
995 	return ttusb_dec_start_iso_xfer(dec);
996 }
997 
998 static int ttusb_dec_start_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
999 {
1000 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1001 	u8 b0[] = { 0x00, 0x00, 0x00, 0x01,
1002 		    0x00, 0x00, 0x00, 0x00,
1003 		    0x00, 0x00, 0x00, 0x00,
1004 		    0x00, 0x00, 0x00, 0x00,
1005 		    0x00, 0xff, 0x00, 0x00,
1006 		    0x00, 0x00, 0x00, 0x00,
1007 		    0x00, 0x00, 0x00, 0x00,
1008 		    0x00 };
1009 	__be16 pid;
1010 	u8 c[COMMAND_PACKET_SIZE];
1011 	int c_length;
1012 	int result;
1013 	struct filter_info *finfo;
1014 	unsigned long flags;
1015 	u8 x = 1;
1016 
1017 	dprintk("%s\n", __func__);
1018 
1019 	pid = htons(dvbdmxfeed->pid);
1020 	memcpy(&b0[0], &pid, 2);
1021 	memcpy(&b0[4], &x, 1);
1022 	memcpy(&b0[5], &dvbdmxfeed->filter->filter.filter_value[0], 1);
1023 
1024 	result = ttusb_dec_send_command(dec, 0x60, sizeof(b0), b0,
1025 					&c_length, c);
1026 
1027 	if (!result) {
1028 		if (c_length == 2) {
1029 			if (!(finfo = kmalloc(sizeof(struct filter_info),
1030 					      GFP_ATOMIC)))
1031 				return -ENOMEM;
1032 
1033 			finfo->stream_id = c[1];
1034 			finfo->filter = dvbdmxfeed->filter;
1035 
1036 			spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1037 			list_add_tail(&finfo->filter_info_list,
1038 				      &dec->filter_info_list);
1039 			spin_unlock_irqrestore(&dec->filter_info_list_lock,
1040 					       flags);
1041 
1042 			dvbdmxfeed->priv = finfo;
1043 
1044 			dec->filter_stream_count++;
1045 			return ttusb_dec_start_iso_xfer(dec);
1046 		}
1047 
1048 		return -EAGAIN;
1049 	} else
1050 		return result;
1051 }
1052 
1053 static int ttusb_dec_start_feed(struct dvb_demux_feed *dvbdmxfeed)
1054 {
1055 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
1056 
1057 	dprintk("%s\n", __func__);
1058 
1059 	if (!dvbdmx->dmx.frontend)
1060 		return -EINVAL;
1061 
1062 	dprintk("  pid: 0x%04X\n", dvbdmxfeed->pid);
1063 
1064 	switch (dvbdmxfeed->type) {
1065 
1066 	case DMX_TYPE_TS:
1067 		return ttusb_dec_start_ts_feed(dvbdmxfeed);
1068 		break;
1069 
1070 	case DMX_TYPE_SEC:
1071 		return ttusb_dec_start_sec_feed(dvbdmxfeed);
1072 		break;
1073 
1074 	default:
1075 		dprintk("  type: unknown (%d)\n", dvbdmxfeed->type);
1076 		return -EINVAL;
1077 
1078 	}
1079 }
1080 
1081 static int ttusb_dec_stop_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
1082 {
1083 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1084 	u8 b0[] = { 0x00 };
1085 
1086 	ttusb_dec_send_command(dec, 0x81, sizeof(b0), b0, NULL, NULL);
1087 
1088 	dec->pva_stream_count--;
1089 
1090 	ttusb_dec_stop_iso_xfer(dec);
1091 
1092 	return 0;
1093 }
1094 
1095 static int ttusb_dec_stop_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1096 {
1097 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1098 	u8 b0[] = { 0x00, 0x00 };
1099 	struct filter_info *finfo = (struct filter_info *)dvbdmxfeed->priv;
1100 	unsigned long flags;
1101 
1102 	b0[1] = finfo->stream_id;
1103 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1104 	list_del(&finfo->filter_info_list);
1105 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
1106 	kfree(finfo);
1107 	ttusb_dec_send_command(dec, 0x62, sizeof(b0), b0, NULL, NULL);
1108 
1109 	dec->filter_stream_count--;
1110 
1111 	ttusb_dec_stop_iso_xfer(dec);
1112 
1113 	return 0;
1114 }
1115 
1116 static int ttusb_dec_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
1117 {
1118 	dprintk("%s\n", __func__);
1119 
1120 	switch (dvbdmxfeed->type) {
1121 	case DMX_TYPE_TS:
1122 		return ttusb_dec_stop_ts_feed(dvbdmxfeed);
1123 		break;
1124 
1125 	case DMX_TYPE_SEC:
1126 		return ttusb_dec_stop_sec_feed(dvbdmxfeed);
1127 		break;
1128 	}
1129 
1130 	return 0;
1131 }
1132 
1133 static void ttusb_dec_free_iso_urbs(struct ttusb_dec *dec)
1134 {
1135 	int i;
1136 
1137 	dprintk("%s\n", __func__);
1138 
1139 	for (i = 0; i < ISO_BUF_COUNT; i++)
1140 		usb_free_urb(dec->iso_urb[i]);
1141 
1142 	pci_free_consistent(NULL,
1143 			    ISO_FRAME_SIZE * (FRAMES_PER_ISO_BUF *
1144 					      ISO_BUF_COUNT),
1145 			    dec->iso_buffer, dec->iso_dma_handle);
1146 }
1147 
1148 static int ttusb_dec_alloc_iso_urbs(struct ttusb_dec *dec)
1149 {
1150 	int i;
1151 
1152 	dprintk("%s\n", __func__);
1153 
1154 	dec->iso_buffer = pci_alloc_consistent(NULL,
1155 					       ISO_FRAME_SIZE *
1156 					       (FRAMES_PER_ISO_BUF *
1157 						ISO_BUF_COUNT),
1158 					       &dec->iso_dma_handle);
1159 
1160 	if (!dec->iso_buffer) {
1161 		dprintk("%s: pci_alloc_consistent - not enough memory\n",
1162 			__func__);
1163 		return -ENOMEM;
1164 	}
1165 
1166 	memset(dec->iso_buffer, 0,
1167 	       ISO_FRAME_SIZE * (FRAMES_PER_ISO_BUF * ISO_BUF_COUNT));
1168 
1169 	for (i = 0; i < ISO_BUF_COUNT; i++) {
1170 		struct urb *urb;
1171 
1172 		if (!(urb = usb_alloc_urb(FRAMES_PER_ISO_BUF, GFP_ATOMIC))) {
1173 			ttusb_dec_free_iso_urbs(dec);
1174 			return -ENOMEM;
1175 		}
1176 
1177 		dec->iso_urb[i] = urb;
1178 	}
1179 
1180 	ttusb_dec_setup_urbs(dec);
1181 
1182 	return 0;
1183 }
1184 
1185 static void ttusb_dec_init_tasklet(struct ttusb_dec *dec)
1186 {
1187 	spin_lock_init(&dec->urb_frame_list_lock);
1188 	INIT_LIST_HEAD(&dec->urb_frame_list);
1189 	tasklet_init(&dec->urb_tasklet, ttusb_dec_process_urb_frame_list,
1190 		     (unsigned long)dec);
1191 }
1192 
1193 static int ttusb_init_rc( struct ttusb_dec *dec)
1194 {
1195 	struct input_dev *input_dev;
1196 	u8 b[] = { 0x00, 0x01 };
1197 	int i;
1198 	int err;
1199 
1200 	usb_make_path(dec->udev, dec->rc_phys, sizeof(dec->rc_phys));
1201 	strlcat(dec->rc_phys, "/input0", sizeof(dec->rc_phys));
1202 
1203 	input_dev = input_allocate_device();
1204 	if (!input_dev)
1205 		return -ENOMEM;
1206 
1207 	input_dev->name = "ttusb_dec remote control";
1208 	input_dev->phys = dec->rc_phys;
1209 	input_dev->evbit[0] = BIT_MASK(EV_KEY);
1210 	input_dev->keycodesize = sizeof(u16);
1211 	input_dev->keycodemax = 0x1a;
1212 	input_dev->keycode = rc_keys;
1213 
1214 	for (i = 0; i < ARRAY_SIZE(rc_keys); i++)
1215 		  set_bit(rc_keys[i], input_dev->keybit);
1216 
1217 	err = input_register_device(input_dev);
1218 	if (err) {
1219 		input_free_device(input_dev);
1220 		return err;
1221 	}
1222 
1223 	dec->rc_input_dev = input_dev;
1224 	if (usb_submit_urb(dec->irq_urb, GFP_KERNEL))
1225 		printk("%s: usb_submit_urb failed\n",__func__);
1226 	/* enable irq pipe */
1227 	ttusb_dec_send_command(dec,0xb0,sizeof(b),b,NULL,NULL);
1228 
1229 	return 0;
1230 }
1231 
1232 static void ttusb_dec_init_v_pes(struct ttusb_dec *dec)
1233 {
1234 	dprintk("%s\n", __func__);
1235 
1236 	dec->v_pes[0] = 0x00;
1237 	dec->v_pes[1] = 0x00;
1238 	dec->v_pes[2] = 0x01;
1239 	dec->v_pes[3] = 0xe0;
1240 }
1241 
1242 static int ttusb_dec_init_usb(struct ttusb_dec *dec)
1243 {
1244 	int result;
1245 
1246 	dprintk("%s\n", __func__);
1247 
1248 	mutex_init(&dec->usb_mutex);
1249 	mutex_init(&dec->iso_mutex);
1250 
1251 	dec->command_pipe = usb_sndbulkpipe(dec->udev, COMMAND_PIPE);
1252 	dec->result_pipe = usb_rcvbulkpipe(dec->udev, RESULT_PIPE);
1253 	dec->in_pipe = usb_rcvisocpipe(dec->udev, IN_PIPE);
1254 	dec->out_pipe = usb_sndisocpipe(dec->udev, OUT_PIPE);
1255 	dec->irq_pipe = usb_rcvintpipe(dec->udev, IRQ_PIPE);
1256 
1257 	if(enable_rc) {
1258 		dec->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
1259 		if(!dec->irq_urb) {
1260 			return -ENOMEM;
1261 		}
1262 		dec->irq_buffer = usb_alloc_coherent(dec->udev,IRQ_PACKET_SIZE,
1263 					GFP_KERNEL, &dec->irq_dma_handle);
1264 		if(!dec->irq_buffer) {
1265 			usb_free_urb(dec->irq_urb);
1266 			return -ENOMEM;
1267 		}
1268 		usb_fill_int_urb(dec->irq_urb, dec->udev,dec->irq_pipe,
1269 				 dec->irq_buffer, IRQ_PACKET_SIZE,
1270 				 ttusb_dec_handle_irq, dec, 1);
1271 		dec->irq_urb->transfer_dma = dec->irq_dma_handle;
1272 		dec->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1273 	}
1274 
1275 	result = ttusb_dec_alloc_iso_urbs(dec);
1276 	if (result) {
1277 		usb_free_urb(dec->irq_urb);
1278 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1279 				  dec->irq_buffer, dec->irq_dma_handle);
1280 	}
1281 	return result;
1282 }
1283 
1284 static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
1285 {
1286 	int i, j, actual_len, result, size, trans_count;
1287 	u8 b0[] = { 0x00, 0x00, 0x00, 0x00,
1288 		    0x00, 0x00, 0x00, 0x00,
1289 		    0x61, 0x00 };
1290 	u8 b1[] = { 0x61 };
1291 	u8 *b;
1292 	char idstring[21];
1293 	const u8 *firmware = NULL;
1294 	size_t firmware_size = 0;
1295 	u16 firmware_csum = 0;
1296 	__be16 firmware_csum_ns;
1297 	__be32 firmware_size_nl;
1298 	u32 crc32_csum, crc32_check;
1299 	__be32 tmp;
1300 	const struct firmware *fw_entry = NULL;
1301 
1302 	dprintk("%s\n", __func__);
1303 
1304 	result = request_firmware(&fw_entry, dec->firmware_name, &dec->udev->dev);
1305 	if (result) {
1306 		printk(KERN_ERR "%s: Firmware (%s) unavailable.\n",
1307 		       __func__, dec->firmware_name);
1308 		return result;
1309 	}
1310 
1311 	firmware = fw_entry->data;
1312 	firmware_size = fw_entry->size;
1313 
1314 	if (firmware_size < 60) {
1315 		printk("%s: firmware size too small for DSP code (%zu < 60).\n",
1316 			__func__, firmware_size);
1317 		release_firmware(fw_entry);
1318 		return -ENOENT;
1319 	}
1320 
1321 	/* a 32 bit checksum over the first 56 bytes of the DSP Code is stored
1322 	   at offset 56 of file, so use it to check if the firmware file is
1323 	   valid. */
1324 	crc32_csum = crc32(~0L, firmware, 56) ^ ~0L;
1325 	memcpy(&tmp, &firmware[56], 4);
1326 	crc32_check = ntohl(tmp);
1327 	if (crc32_csum != crc32_check) {
1328 		printk("%s: crc32 check of DSP code failed (calculated "
1329 		       "0x%08x != 0x%08x in file), file invalid.\n",
1330 			__func__, crc32_csum, crc32_check);
1331 		release_firmware(fw_entry);
1332 		return -ENOENT;
1333 	}
1334 	memcpy(idstring, &firmware[36], 20);
1335 	idstring[20] = '\0';
1336 	printk(KERN_INFO "ttusb_dec: found DSP code \"%s\".\n", idstring);
1337 
1338 	firmware_size_nl = htonl(firmware_size);
1339 	memcpy(b0, &firmware_size_nl, 4);
1340 	firmware_csum = crc16(~0, firmware, firmware_size) ^ ~0;
1341 	firmware_csum_ns = htons(firmware_csum);
1342 	memcpy(&b0[6], &firmware_csum_ns, 2);
1343 
1344 	result = ttusb_dec_send_command(dec, 0x41, sizeof(b0), b0, NULL, NULL);
1345 
1346 	if (result) {
1347 		release_firmware(fw_entry);
1348 		return result;
1349 	}
1350 
1351 	trans_count = 0;
1352 	j = 0;
1353 
1354 	b = kmalloc(ARM_PACKET_SIZE, GFP_KERNEL);
1355 	if (b == NULL) {
1356 		release_firmware(fw_entry);
1357 		return -ENOMEM;
1358 	}
1359 
1360 	for (i = 0; i < firmware_size; i += COMMAND_PACKET_SIZE) {
1361 		size = firmware_size - i;
1362 		if (size > COMMAND_PACKET_SIZE)
1363 			size = COMMAND_PACKET_SIZE;
1364 
1365 		b[j + 0] = 0xaa;
1366 		b[j + 1] = trans_count++;
1367 		b[j + 2] = 0xf0;
1368 		b[j + 3] = size;
1369 		memcpy(&b[j + 4], &firmware[i], size);
1370 
1371 		j += COMMAND_PACKET_SIZE + 4;
1372 
1373 		if (j >= ARM_PACKET_SIZE) {
1374 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1375 					      ARM_PACKET_SIZE, &actual_len,
1376 					      100);
1377 			j = 0;
1378 		} else if (size < COMMAND_PACKET_SIZE) {
1379 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1380 					      j - COMMAND_PACKET_SIZE + size,
1381 					      &actual_len, 100);
1382 		}
1383 	}
1384 
1385 	result = ttusb_dec_send_command(dec, 0x43, sizeof(b1), b1, NULL, NULL);
1386 
1387 	release_firmware(fw_entry);
1388 	kfree(b);
1389 
1390 	return result;
1391 }
1392 
1393 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
1394 {
1395 	int result;
1396 	unsigned int mode = 0, model = 0, version = 0;
1397 
1398 	dprintk("%s\n", __func__);
1399 
1400 	result = ttusb_dec_get_stb_state(dec, &mode, &model, &version);
1401 	if (result)
1402 		return result;
1403 
1404 	if (!mode) {
1405 		if (version == 0xABCDEFAB)
1406 			printk(KERN_INFO "ttusb_dec: no version "
1407 			       "info in Firmware\n");
1408 		else
1409 			printk(KERN_INFO "ttusb_dec: Firmware "
1410 			       "%x.%02x%c%c\n",
1411 			       version >> 24, (version >> 16) & 0xff,
1412 			       (version >> 8) & 0xff, version & 0xff);
1413 
1414 		result = ttusb_dec_boot_dsp(dec);
1415 		if (result)
1416 			return result;
1417 	} else {
1418 		/* We can't trust the USB IDs that some firmwares
1419 		   give the box */
1420 		switch (model) {
1421 		case 0x00070001:
1422 		case 0x00070008:
1423 		case 0x0007000c:
1424 			ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1425 			break;
1426 		case 0x00070009:
1427 		case 0x00070013:
1428 			ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1429 			break;
1430 		case 0x00070011:
1431 			ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1432 			break;
1433 		default:
1434 			printk(KERN_ERR "%s: unknown model returned "
1435 			       "by firmware (%08x) - please report\n",
1436 			       __func__, model);
1437 			return -ENOENT;
1438 		}
1439 			if (version >= 0x01770000)
1440 				dec->can_playback = 1;
1441 	}
1442 	return 0;
1443 }
1444 
1445 static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
1446 {
1447 	int result;
1448 
1449 	dprintk("%s\n", __func__);
1450 
1451 	if ((result = dvb_register_adapter(&dec->adapter,
1452 					   dec->model_name, THIS_MODULE,
1453 					   &dec->udev->dev,
1454 					   adapter_nr)) < 0) {
1455 		printk("%s: dvb_register_adapter failed: error %d\n",
1456 		       __func__, result);
1457 
1458 		return result;
1459 	}
1460 
1461 	dec->demux.dmx.capabilities = DMX_TS_FILTERING | DMX_SECTION_FILTERING;
1462 
1463 	dec->demux.priv = (void *)dec;
1464 	dec->demux.filternum = 31;
1465 	dec->demux.feednum = 31;
1466 	dec->demux.start_feed = ttusb_dec_start_feed;
1467 	dec->demux.stop_feed = ttusb_dec_stop_feed;
1468 	dec->demux.write_to_decoder = NULL;
1469 
1470 	if ((result = dvb_dmx_init(&dec->demux)) < 0) {
1471 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1472 		       result);
1473 
1474 		dvb_unregister_adapter(&dec->adapter);
1475 
1476 		return result;
1477 	}
1478 
1479 	dec->dmxdev.filternum = 32;
1480 	dec->dmxdev.demux = &dec->demux.dmx;
1481 	dec->dmxdev.capabilities = 0;
1482 
1483 	if ((result = dvb_dmxdev_init(&dec->dmxdev, &dec->adapter)) < 0) {
1484 		printk("%s: dvb_dmxdev_init failed: error %d\n",
1485 		       __func__, result);
1486 
1487 		dvb_dmx_release(&dec->demux);
1488 		dvb_unregister_adapter(&dec->adapter);
1489 
1490 		return result;
1491 	}
1492 
1493 	dec->frontend.source = DMX_FRONTEND_0;
1494 
1495 	if ((result = dec->demux.dmx.add_frontend(&dec->demux.dmx,
1496 						  &dec->frontend)) < 0) {
1497 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1498 		       result);
1499 
1500 		dvb_dmxdev_release(&dec->dmxdev);
1501 		dvb_dmx_release(&dec->demux);
1502 		dvb_unregister_adapter(&dec->adapter);
1503 
1504 		return result;
1505 	}
1506 
1507 	if ((result = dec->demux.dmx.connect_frontend(&dec->demux.dmx,
1508 						      &dec->frontend)) < 0) {
1509 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1510 		       result);
1511 
1512 		dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1513 		dvb_dmxdev_release(&dec->dmxdev);
1514 		dvb_dmx_release(&dec->demux);
1515 		dvb_unregister_adapter(&dec->adapter);
1516 
1517 		return result;
1518 	}
1519 
1520 	dvb_net_init(&dec->adapter, &dec->dvb_net, &dec->demux.dmx);
1521 
1522 	return 0;
1523 }
1524 
1525 static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
1526 {
1527 	dprintk("%s\n", __func__);
1528 
1529 	dvb_net_release(&dec->dvb_net);
1530 	dec->demux.dmx.close(&dec->demux.dmx);
1531 	dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1532 	dvb_dmxdev_release(&dec->dmxdev);
1533 	dvb_dmx_release(&dec->demux);
1534 	if (dec->fe) {
1535 		dvb_unregister_frontend(dec->fe);
1536 		if (dec->fe->ops.release)
1537 			dec->fe->ops.release(dec->fe);
1538 	}
1539 	dvb_unregister_adapter(&dec->adapter);
1540 }
1541 
1542 static void ttusb_dec_exit_rc(struct ttusb_dec *dec)
1543 {
1544 	dprintk("%s\n", __func__);
1545 
1546 	if (dec->rc_input_dev) {
1547 		input_unregister_device(dec->rc_input_dev);
1548 		dec->rc_input_dev = NULL;
1549 	}
1550 }
1551 
1552 
1553 static void ttusb_dec_exit_usb(struct ttusb_dec *dec)
1554 {
1555 	int i;
1556 
1557 	dprintk("%s\n", __func__);
1558 
1559 	if (enable_rc) {
1560 		/* we have to check whether the irq URB is already submitted.
1561 		 * As the irq is submitted after the interface is changed,
1562 		 * this is the best method i figured out.
1563 		 * Any others?*/
1564 		if (dec->interface == TTUSB_DEC_INTERFACE_IN)
1565 			usb_kill_urb(dec->irq_urb);
1566 
1567 		usb_free_urb(dec->irq_urb);
1568 
1569 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1570 				  dec->irq_buffer, dec->irq_dma_handle);
1571 	}
1572 
1573 	dec->iso_stream_count = 0;
1574 
1575 	for (i = 0; i < ISO_BUF_COUNT; i++)
1576 		usb_kill_urb(dec->iso_urb[i]);
1577 
1578 	ttusb_dec_free_iso_urbs(dec);
1579 }
1580 
1581 static void ttusb_dec_exit_tasklet(struct ttusb_dec *dec)
1582 {
1583 	struct list_head *item;
1584 	struct urb_frame *frame;
1585 
1586 	tasklet_kill(&dec->urb_tasklet);
1587 
1588 	while ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
1589 		frame = list_entry(item, struct urb_frame, urb_frame_list);
1590 		list_del(&frame->urb_frame_list);
1591 		kfree(frame);
1592 	}
1593 }
1594 
1595 static void ttusb_dec_init_filters(struct ttusb_dec *dec)
1596 {
1597 	INIT_LIST_HEAD(&dec->filter_info_list);
1598 	spin_lock_init(&dec->filter_info_list_lock);
1599 }
1600 
1601 static void ttusb_dec_exit_filters(struct ttusb_dec *dec)
1602 {
1603 	struct list_head *item;
1604 	struct filter_info *finfo;
1605 
1606 	while ((item = dec->filter_info_list.next) != &dec->filter_info_list) {
1607 		finfo = list_entry(item, struct filter_info, filter_info_list);
1608 		list_del(&finfo->filter_info_list);
1609 		kfree(finfo);
1610 	}
1611 }
1612 
1613 static int fe_send_command(struct dvb_frontend* fe, const u8 command,
1614 			   int param_length, const u8 params[],
1615 			   int *result_length, u8 cmd_result[])
1616 {
1617 	struct ttusb_dec* dec = fe->dvb->priv;
1618 	return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
1619 }
1620 
1621 static struct ttusbdecfe_config fe_config = {
1622 	.send_command = fe_send_command
1623 };
1624 
1625 static int ttusb_dec_probe(struct usb_interface *intf,
1626 			   const struct usb_device_id *id)
1627 {
1628 	struct usb_device *udev;
1629 	struct ttusb_dec *dec;
1630 	int result;
1631 
1632 	dprintk("%s\n", __func__);
1633 
1634 	udev = interface_to_usbdev(intf);
1635 
1636 	if (!(dec = kzalloc(sizeof(struct ttusb_dec), GFP_KERNEL))) {
1637 		printk("%s: couldn't allocate memory.\n", __func__);
1638 		return -ENOMEM;
1639 	}
1640 
1641 	usb_set_intfdata(intf, (void *)dec);
1642 
1643 	switch (id->idProduct) {
1644 	case 0x1006:
1645 		ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1646 		break;
1647 
1648 	case 0x1008:
1649 		ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1650 		break;
1651 
1652 	case 0x1009:
1653 		ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1654 		break;
1655 	}
1656 
1657 	dec->udev = udev;
1658 
1659 	result = ttusb_dec_init_usb(dec);
1660 	if (result)
1661 		goto err_usb;
1662 	result = ttusb_dec_init_stb(dec);
1663 	if (result)
1664 		goto err_stb;
1665 	result = ttusb_dec_init_dvb(dec);
1666 	if (result)
1667 		goto err_stb;
1668 
1669 	dec->adapter.priv = dec;
1670 	switch (id->idProduct) {
1671 	case 0x1006:
1672 		dec->fe = ttusbdecfe_dvbs_attach(&fe_config);
1673 		break;
1674 
1675 	case 0x1008:
1676 	case 0x1009:
1677 		dec->fe = ttusbdecfe_dvbt_attach(&fe_config);
1678 		break;
1679 	}
1680 
1681 	if (dec->fe == NULL) {
1682 		printk("dvb-ttusb-dec: A frontend driver was not found for device [%04x:%04x]\n",
1683 		       le16_to_cpu(dec->udev->descriptor.idVendor),
1684 		       le16_to_cpu(dec->udev->descriptor.idProduct));
1685 	} else {
1686 		if (dvb_register_frontend(&dec->adapter, dec->fe)) {
1687 			printk("budget-ci: Frontend registration failed!\n");
1688 			if (dec->fe->ops.release)
1689 				dec->fe->ops.release(dec->fe);
1690 			dec->fe = NULL;
1691 		}
1692 	}
1693 
1694 	ttusb_dec_init_v_pes(dec);
1695 	ttusb_dec_init_filters(dec);
1696 	ttusb_dec_init_tasklet(dec);
1697 
1698 	dec->active = 1;
1699 
1700 	ttusb_dec_set_interface(dec, TTUSB_DEC_INTERFACE_IN);
1701 
1702 	if (enable_rc)
1703 		ttusb_init_rc(dec);
1704 
1705 	return 0;
1706 err_stb:
1707 	ttusb_dec_exit_usb(dec);
1708 err_usb:
1709 	kfree(dec);
1710 	return result;
1711 }
1712 
1713 static void ttusb_dec_disconnect(struct usb_interface *intf)
1714 {
1715 	struct ttusb_dec *dec = usb_get_intfdata(intf);
1716 
1717 	usb_set_intfdata(intf, NULL);
1718 
1719 	dprintk("%s\n", __func__);
1720 
1721 	if (dec->active) {
1722 		ttusb_dec_exit_tasklet(dec);
1723 		ttusb_dec_exit_filters(dec);
1724 		if(enable_rc)
1725 			ttusb_dec_exit_rc(dec);
1726 		ttusb_dec_exit_usb(dec);
1727 		ttusb_dec_exit_dvb(dec);
1728 	}
1729 
1730 	kfree(dec);
1731 }
1732 
1733 static void ttusb_dec_set_model(struct ttusb_dec *dec,
1734 				enum ttusb_dec_model model)
1735 {
1736 	dec->model = model;
1737 
1738 	switch (model) {
1739 	case TTUSB_DEC2000T:
1740 		dec->model_name = "DEC2000-t";
1741 		dec->firmware_name = "dvb-ttusb-dec-2000t.fw";
1742 		break;
1743 
1744 	case TTUSB_DEC2540T:
1745 		dec->model_name = "DEC2540-t";
1746 		dec->firmware_name = "dvb-ttusb-dec-2540t.fw";
1747 		break;
1748 
1749 	case TTUSB_DEC3000S:
1750 		dec->model_name = "DEC3000-s";
1751 		dec->firmware_name = "dvb-ttusb-dec-3000s.fw";
1752 		break;
1753 	}
1754 }
1755 
1756 static struct usb_device_id ttusb_dec_table[] = {
1757 	{USB_DEVICE(0x0b48, 0x1006)},	/* DEC3000-s */
1758 	/*{USB_DEVICE(0x0b48, 0x1007)},	   Unconfirmed */
1759 	{USB_DEVICE(0x0b48, 0x1008)},	/* DEC2000-t */
1760 	{USB_DEVICE(0x0b48, 0x1009)},	/* DEC2540-t */
1761 	{}
1762 };
1763 
1764 static struct usb_driver ttusb_dec_driver = {
1765 	.name		= "ttusb-dec",
1766 	.probe		= ttusb_dec_probe,
1767 	.disconnect	= ttusb_dec_disconnect,
1768 	.id_table	= ttusb_dec_table,
1769 };
1770 
1771 module_usb_driver(ttusb_dec_driver);
1772 
1773 MODULE_AUTHOR("Alex Woods <linux-dvb@giblets.org>");
1774 MODULE_DESCRIPTION(DRIVER_NAME);
1775 MODULE_LICENSE("GPL");
1776 MODULE_DEVICE_TABLE(usb, ttusb_dec_table);
1777