1 /*
2  * TTUSB DEC Driver
3  *
4  * Copyright (C) 2003-2004 Alex Woods <linux-dvb@giblets.org>
5  * IR support by Peter Beutner <p.beutner@gmx.net>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, write to the Free Software
19  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20  *
21  */
22 
23 #include <linux/list.h>
24 #include <linux/module.h>
25 #include <linux/pci.h>
26 #include <linux/slab.h>
27 #include <linux/spinlock.h>
28 #include <linux/usb.h>
29 #include <linux/interrupt.h>
30 #include <linux/firmware.h>
31 #include <linux/crc32.h>
32 #include <linux/init.h>
33 #include <linux/input.h>
34 
35 #include <linux/mutex.h>
36 
37 #include "dmxdev.h"
38 #include "dvb_demux.h"
39 #include "dvb_filter.h"
40 #include "dvb_frontend.h"
41 #include "dvb_net.h"
42 #include "ttusbdecfe.h"
43 
44 static int debug;
45 static int output_pva;
46 static int enable_rc;
47 
48 module_param(debug, int, 0644);
49 MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
50 module_param(output_pva, int, 0444);
51 MODULE_PARM_DESC(output_pva, "Output PVA from dvr device (default:off)");
52 module_param(enable_rc, int, 0644);
53 MODULE_PARM_DESC(enable_rc, "Turn on/off IR remote control(default: off)");
54 
55 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
56 
57 #define dprintk	if (debug) printk
58 
59 #define DRIVER_NAME		"TechnoTrend/Hauppauge DEC USB"
60 
61 #define COMMAND_PIPE		0x03
62 #define RESULT_PIPE		0x04
63 #define IN_PIPE			0x08
64 #define OUT_PIPE		0x07
65 #define IRQ_PIPE		0x0A
66 
67 #define COMMAND_PACKET_SIZE	0x3c
68 #define ARM_PACKET_SIZE		0x1000
69 #define IRQ_PACKET_SIZE		0x8
70 
71 #define ISO_BUF_COUNT		0x04
72 #define FRAMES_PER_ISO_BUF	0x04
73 #define ISO_FRAME_SIZE		0x0380
74 
75 #define	MAX_PVA_LENGTH		6144
76 
77 enum ttusb_dec_model {
78 	TTUSB_DEC2000T,
79 	TTUSB_DEC2540T,
80 	TTUSB_DEC3000S
81 };
82 
83 enum ttusb_dec_packet_type {
84 	TTUSB_DEC_PACKET_PVA,
85 	TTUSB_DEC_PACKET_SECTION,
86 	TTUSB_DEC_PACKET_EMPTY
87 };
88 
89 enum ttusb_dec_interface {
90 	TTUSB_DEC_INTERFACE_INITIAL,
91 	TTUSB_DEC_INTERFACE_IN,
92 	TTUSB_DEC_INTERFACE_OUT
93 };
94 
95 struct ttusb_dec {
96 	enum ttusb_dec_model		model;
97 	char				*model_name;
98 	char				*firmware_name;
99 	int				can_playback;
100 
101 	/* DVB bits */
102 	struct dvb_adapter		adapter;
103 	struct dmxdev			dmxdev;
104 	struct dvb_demux		demux;
105 	struct dmx_frontend		frontend;
106 	struct dvb_net			dvb_net;
107 	struct dvb_frontend*		fe;
108 
109 	u16			pid[DMX_PES_OTHER];
110 
111 	/* USB bits */
112 	struct usb_device		*udev;
113 	u8				trans_count;
114 	unsigned int			command_pipe;
115 	unsigned int			result_pipe;
116 	unsigned int			in_pipe;
117 	unsigned int			out_pipe;
118 	unsigned int			irq_pipe;
119 	enum ttusb_dec_interface	interface;
120 	struct mutex			usb_mutex;
121 
122 	void			*irq_buffer;
123 	struct urb		*irq_urb;
124 	dma_addr_t		irq_dma_handle;
125 	void			*iso_buffer;
126 	dma_addr_t		iso_dma_handle;
127 	struct urb		*iso_urb[ISO_BUF_COUNT];
128 	int			iso_stream_count;
129 	struct mutex		iso_mutex;
130 
131 	u8				packet[MAX_PVA_LENGTH + 4];
132 	enum ttusb_dec_packet_type	packet_type;
133 	int				packet_state;
134 	int				packet_length;
135 	int				packet_payload_length;
136 	u16				next_packet_id;
137 
138 	int				pva_stream_count;
139 	int				filter_stream_count;
140 
141 	struct dvb_filter_pes2ts	a_pes2ts;
142 	struct dvb_filter_pes2ts	v_pes2ts;
143 
144 	u8			v_pes[16 + MAX_PVA_LENGTH];
145 	int			v_pes_length;
146 	int			v_pes_postbytes;
147 
148 	struct list_head	urb_frame_list;
149 	struct tasklet_struct	urb_tasklet;
150 	spinlock_t		urb_frame_list_lock;
151 
152 	struct dvb_demux_filter	*audio_filter;
153 	struct dvb_demux_filter	*video_filter;
154 	struct list_head	filter_info_list;
155 	spinlock_t		filter_info_list_lock;
156 
157 	struct input_dev	*rc_input_dev;
158 	char			rc_phys[64];
159 
160 	int			active; /* Loaded successfully */
161 };
162 
163 struct urb_frame {
164 	u8			data[ISO_FRAME_SIZE];
165 	int			length;
166 	struct list_head	urb_frame_list;
167 };
168 
169 struct filter_info {
170 	u8			stream_id;
171 	struct dvb_demux_filter	*filter;
172 	struct list_head	filter_info_list;
173 };
174 
175 static u16 rc_keys[] = {
176 	KEY_POWER,
177 	KEY_MUTE,
178 	KEY_1,
179 	KEY_2,
180 	KEY_3,
181 	KEY_4,
182 	KEY_5,
183 	KEY_6,
184 	KEY_7,
185 	KEY_8,
186 	KEY_9,
187 	KEY_0,
188 	KEY_CHANNELUP,
189 	KEY_VOLUMEDOWN,
190 	KEY_OK,
191 	KEY_VOLUMEUP,
192 	KEY_CHANNELDOWN,
193 	KEY_PREVIOUS,
194 	KEY_ESC,
195 	KEY_RED,
196 	KEY_GREEN,
197 	KEY_YELLOW,
198 	KEY_BLUE,
199 	KEY_OPTION,
200 	KEY_M,
201 	KEY_RADIO
202 };
203 
204 static void ttusb_dec_set_model(struct ttusb_dec *dec,
205 				enum ttusb_dec_model model);
206 
207 static void ttusb_dec_handle_irq( struct urb *urb)
208 {
209 	struct ttusb_dec * dec = urb->context;
210 	char *buffer = dec->irq_buffer;
211 	int retval;
212 
213 	switch(urb->status) {
214 		case 0: /*success*/
215 			break;
216 		case -ECONNRESET:
217 		case -ENOENT:
218 		case -ESHUTDOWN:
219 		case -ETIME:
220 			/* this urb is dead, cleanup */
221 			dprintk("%s:urb shutting down with status: %d\n",
222 					__func__, urb->status);
223 			return;
224 		default:
225 			dprintk("%s:nonzero status received: %d\n",
226 					__func__,urb->status);
227 			goto exit;
228 	}
229 
230 	if( (buffer[0] == 0x1) && (buffer[2] == 0x15) )  {
231 		/* IR - Event */
232 		/* this is an fact a bit too simple implementation;
233 		 * the box also reports a keyrepeat signal
234 		 * (with buffer[3] == 0x40) in an intervall of ~100ms.
235 		 * But to handle this correctly we had to imlemenent some
236 		 * kind of timer which signals a 'key up' event if no
237 		 * keyrepeat signal is received for lets say 200ms.
238 		 * this should/could be added later ...
239 		 * for now lets report each signal as a key down and up*/
240 		dprintk("%s:rc signal:%d\n", __func__, buffer[4]);
241 		input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 1);
242 		input_sync(dec->rc_input_dev);
243 		input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 0);
244 		input_sync(dec->rc_input_dev);
245 	}
246 
247 exit:	retval = usb_submit_urb(urb, GFP_ATOMIC);
248 	if(retval)
249 		printk("%s - usb_commit_urb failed with result: %d\n",
250 			__func__, retval);
251 }
252 
253 static u16 crc16(u16 crc, const u8 *buf, size_t len)
254 {
255 	u16 tmp;
256 
257 	while (len--) {
258 		crc ^= *buf++;
259 		crc ^= (u8)crc >> 4;
260 		tmp = (u8)crc;
261 		crc ^= (tmp ^ (tmp << 1)) << 4;
262 	}
263 	return crc;
264 }
265 
266 static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
267 				  int param_length, const u8 params[],
268 				  int *result_length, u8 cmd_result[])
269 {
270 	int result, actual_len, i;
271 	u8 *b;
272 
273 	dprintk("%s\n", __func__);
274 
275 	b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
276 	if (!b)
277 		return -ENOMEM;
278 
279 	if ((result = mutex_lock_interruptible(&dec->usb_mutex))) {
280 		kfree(b);
281 		printk("%s: Failed to lock usb mutex.\n", __func__);
282 		return result;
283 	}
284 
285 	b[0] = 0xaa;
286 	b[1] = ++dec->trans_count;
287 	b[2] = command;
288 	b[3] = param_length;
289 
290 	if (params)
291 		memcpy(&b[4], params, param_length);
292 
293 	if (debug) {
294 		printk("%s: command: ", __func__);
295 		for (i = 0; i < param_length + 4; i++)
296 			printk("0x%02X ", b[i]);
297 		printk("\n");
298 	}
299 
300 	result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
301 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
302 
303 	if (result) {
304 		printk("%s: command bulk message failed: error %d\n",
305 		       __func__, result);
306 		mutex_unlock(&dec->usb_mutex);
307 		kfree(b);
308 		return result;
309 	}
310 
311 	result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
312 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
313 
314 	if (result) {
315 		printk("%s: result bulk message failed: error %d\n",
316 		       __func__, result);
317 		mutex_unlock(&dec->usb_mutex);
318 		kfree(b);
319 		return result;
320 	} else {
321 		if (debug) {
322 			printk("%s: result: ", __func__);
323 			for (i = 0; i < actual_len; i++)
324 				printk("0x%02X ", b[i]);
325 			printk("\n");
326 		}
327 
328 		if (result_length)
329 			*result_length = b[3];
330 		if (cmd_result && b[3] > 0)
331 			memcpy(cmd_result, &b[4], b[3]);
332 
333 		mutex_unlock(&dec->usb_mutex);
334 
335 		kfree(b);
336 		return 0;
337 	}
338 }
339 
340 static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode,
341 				    unsigned int *model, unsigned int *version)
342 {
343 	u8 c[COMMAND_PACKET_SIZE];
344 	int c_length;
345 	int result;
346 	__be32 tmp;
347 
348 	dprintk("%s\n", __func__);
349 
350 	result = ttusb_dec_send_command(dec, 0x08, 0, NULL, &c_length, c);
351 	if (result)
352 		return result;
353 
354 	if (c_length >= 0x0c) {
355 		if (mode != NULL) {
356 			memcpy(&tmp, c, 4);
357 			*mode = ntohl(tmp);
358 		}
359 		if (model != NULL) {
360 			memcpy(&tmp, &c[4], 4);
361 			*model = ntohl(tmp);
362 		}
363 		if (version != NULL) {
364 			memcpy(&tmp, &c[8], 4);
365 			*version = ntohl(tmp);
366 		}
367 		return 0;
368 	} else {
369 		return -1;
370 	}
371 }
372 
373 static int ttusb_dec_audio_pes2ts_cb(void *priv, unsigned char *data)
374 {
375 	struct ttusb_dec *dec = priv;
376 
377 	dec->audio_filter->feed->cb.ts(data, 188, NULL, 0,
378 				       &dec->audio_filter->feed->feed.ts,
379 				       DMX_OK);
380 
381 	return 0;
382 }
383 
384 static int ttusb_dec_video_pes2ts_cb(void *priv, unsigned char *data)
385 {
386 	struct ttusb_dec *dec = priv;
387 
388 	dec->video_filter->feed->cb.ts(data, 188, NULL, 0,
389 				       &dec->video_filter->feed->feed.ts,
390 				       DMX_OK);
391 
392 	return 0;
393 }
394 
395 static void ttusb_dec_set_pids(struct ttusb_dec *dec)
396 {
397 	u8 b[] = { 0x00, 0x00, 0x00, 0x00,
398 		   0x00, 0x00, 0xff, 0xff,
399 		   0xff, 0xff, 0xff, 0xff };
400 
401 	__be16 pcr = htons(dec->pid[DMX_PES_PCR]);
402 	__be16 audio = htons(dec->pid[DMX_PES_AUDIO]);
403 	__be16 video = htons(dec->pid[DMX_PES_VIDEO]);
404 
405 	dprintk("%s\n", __func__);
406 
407 	memcpy(&b[0], &pcr, 2);
408 	memcpy(&b[2], &audio, 2);
409 	memcpy(&b[4], &video, 2);
410 
411 	ttusb_dec_send_command(dec, 0x50, sizeof(b), b, NULL, NULL);
412 
413 	dvb_filter_pes2ts_init(&dec->a_pes2ts, dec->pid[DMX_PES_AUDIO],
414 			       ttusb_dec_audio_pes2ts_cb, dec);
415 	dvb_filter_pes2ts_init(&dec->v_pes2ts, dec->pid[DMX_PES_VIDEO],
416 			       ttusb_dec_video_pes2ts_cb, dec);
417 	dec->v_pes_length = 0;
418 	dec->v_pes_postbytes = 0;
419 }
420 
421 static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
422 {
423 	if (length < 8) {
424 		printk("%s: packet too short - discarding\n", __func__);
425 		return;
426 	}
427 
428 	if (length > 8 + MAX_PVA_LENGTH) {
429 		printk("%s: packet too long - discarding\n", __func__);
430 		return;
431 	}
432 
433 	switch (pva[2]) {
434 
435 	case 0x01: {		/* VideoStream */
436 		int prebytes = pva[5] & 0x03;
437 		int postbytes = (pva[5] & 0x0c) >> 2;
438 		__be16 v_pes_payload_length;
439 
440 		if (output_pva) {
441 			dec->video_filter->feed->cb.ts(pva, length, NULL, 0,
442 				&dec->video_filter->feed->feed.ts, DMX_OK);
443 			return;
444 		}
445 
446 		if (dec->v_pes_postbytes > 0 &&
447 		    dec->v_pes_postbytes == prebytes) {
448 			memcpy(&dec->v_pes[dec->v_pes_length],
449 			       &pva[12], prebytes);
450 
451 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
452 					  dec->v_pes_length + prebytes, 1);
453 		}
454 
455 		if (pva[5] & 0x10) {
456 			dec->v_pes[7] = 0x80;
457 			dec->v_pes[8] = 0x05;
458 
459 			dec->v_pes[9] = 0x21 | ((pva[8] & 0xc0) >> 5);
460 			dec->v_pes[10] = ((pva[8] & 0x3f) << 2) |
461 					 ((pva[9] & 0xc0) >> 6);
462 			dec->v_pes[11] = 0x01 |
463 					 ((pva[9] & 0x3f) << 2) |
464 					 ((pva[10] & 0x80) >> 6);
465 			dec->v_pes[12] = ((pva[10] & 0x7f) << 1) |
466 					 ((pva[11] & 0xc0) >> 7);
467 			dec->v_pes[13] = 0x01 | ((pva[11] & 0x7f) << 1);
468 
469 			memcpy(&dec->v_pes[14], &pva[12 + prebytes],
470 			       length - 12 - prebytes);
471 			dec->v_pes_length = 14 + length - 12 - prebytes;
472 		} else {
473 			dec->v_pes[7] = 0x00;
474 			dec->v_pes[8] = 0x00;
475 
476 			memcpy(&dec->v_pes[9], &pva[8], length - 8);
477 			dec->v_pes_length = 9 + length - 8;
478 		}
479 
480 		dec->v_pes_postbytes = postbytes;
481 
482 		if (dec->v_pes[9 + dec->v_pes[8]] == 0x00 &&
483 		    dec->v_pes[10 + dec->v_pes[8]] == 0x00 &&
484 		    dec->v_pes[11 + dec->v_pes[8]] == 0x01)
485 			dec->v_pes[6] = 0x84;
486 		else
487 			dec->v_pes[6] = 0x80;
488 
489 		v_pes_payload_length = htons(dec->v_pes_length - 6 +
490 					     postbytes);
491 		memcpy(&dec->v_pes[4], &v_pes_payload_length, 2);
492 
493 		if (postbytes == 0)
494 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
495 					  dec->v_pes_length, 1);
496 
497 		break;
498 	}
499 
500 	case 0x02:		/* MainAudioStream */
501 		if (output_pva) {
502 			dec->audio_filter->feed->cb.ts(pva, length, NULL, 0,
503 				&dec->audio_filter->feed->feed.ts, DMX_OK);
504 			return;
505 		}
506 
507 		dvb_filter_pes2ts(&dec->a_pes2ts, &pva[8], length - 8,
508 				  pva[5] & 0x10);
509 		break;
510 
511 	default:
512 		printk("%s: unknown PVA type: %02x.\n", __func__,
513 		       pva[2]);
514 		break;
515 	}
516 }
517 
518 static void ttusb_dec_process_filter(struct ttusb_dec *dec, u8 *packet,
519 				     int length)
520 {
521 	struct list_head *item;
522 	struct filter_info *finfo;
523 	struct dvb_demux_filter *filter = NULL;
524 	unsigned long flags;
525 	u8 sid;
526 
527 	sid = packet[1];
528 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
529 	for (item = dec->filter_info_list.next; item != &dec->filter_info_list;
530 	     item = item->next) {
531 		finfo = list_entry(item, struct filter_info, filter_info_list);
532 		if (finfo->stream_id == sid) {
533 			filter = finfo->filter;
534 			break;
535 		}
536 	}
537 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
538 
539 	if (filter)
540 		filter->feed->cb.sec(&packet[2], length - 2, NULL, 0,
541 				     &filter->filter, DMX_OK);
542 }
543 
544 static void ttusb_dec_process_packet(struct ttusb_dec *dec)
545 {
546 	int i;
547 	u16 csum = 0;
548 	u16 packet_id;
549 
550 	if (dec->packet_length % 2) {
551 		printk("%s: odd sized packet - discarding\n", __func__);
552 		return;
553 	}
554 
555 	for (i = 0; i < dec->packet_length; i += 2)
556 		csum ^= ((dec->packet[i] << 8) + dec->packet[i + 1]);
557 
558 	if (csum) {
559 		printk("%s: checksum failed - discarding\n", __func__);
560 		return;
561 	}
562 
563 	packet_id = dec->packet[dec->packet_length - 4] << 8;
564 	packet_id += dec->packet[dec->packet_length - 3];
565 
566 	if ((packet_id != dec->next_packet_id) && dec->next_packet_id) {
567 		printk("%s: warning: lost packets between %u and %u\n",
568 		       __func__, dec->next_packet_id - 1, packet_id);
569 	}
570 
571 	if (packet_id == 0xffff)
572 		dec->next_packet_id = 0x8000;
573 	else
574 		dec->next_packet_id = packet_id + 1;
575 
576 	switch (dec->packet_type) {
577 	case TTUSB_DEC_PACKET_PVA:
578 		if (dec->pva_stream_count)
579 			ttusb_dec_process_pva(dec, dec->packet,
580 					      dec->packet_payload_length);
581 		break;
582 
583 	case TTUSB_DEC_PACKET_SECTION:
584 		if (dec->filter_stream_count)
585 			ttusb_dec_process_filter(dec, dec->packet,
586 						 dec->packet_payload_length);
587 		break;
588 
589 	case TTUSB_DEC_PACKET_EMPTY:
590 		break;
591 	}
592 }
593 
594 static void swap_bytes(u8 *b, int length)
595 {
596 	u8 c;
597 
598 	length -= length % 2;
599 	for (; length; b += 2, length -= 2) {
600 		c = *b;
601 		*b = *(b + 1);
602 		*(b + 1) = c;
603 	}
604 }
605 
606 static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,
607 					int length)
608 {
609 	swap_bytes(b, length);
610 
611 	while (length) {
612 		switch (dec->packet_state) {
613 
614 		case 0:
615 		case 1:
616 		case 2:
617 			if (*b++ == 0xaa)
618 				dec->packet_state++;
619 			else
620 				dec->packet_state = 0;
621 
622 			length--;
623 			break;
624 
625 		case 3:
626 			if (*b == 0x00) {
627 				dec->packet_state++;
628 				dec->packet_length = 0;
629 			} else if (*b != 0xaa) {
630 				dec->packet_state = 0;
631 			}
632 
633 			b++;
634 			length--;
635 			break;
636 
637 		case 4:
638 			dec->packet[dec->packet_length++] = *b++;
639 
640 			if (dec->packet_length == 2) {
641 				if (dec->packet[0] == 'A' &&
642 				    dec->packet[1] == 'V') {
643 					dec->packet_type =
644 						TTUSB_DEC_PACKET_PVA;
645 					dec->packet_state++;
646 				} else if (dec->packet[0] == 'S') {
647 					dec->packet_type =
648 						TTUSB_DEC_PACKET_SECTION;
649 					dec->packet_state++;
650 				} else if (dec->packet[0] == 0x00) {
651 					dec->packet_type =
652 						TTUSB_DEC_PACKET_EMPTY;
653 					dec->packet_payload_length = 2;
654 					dec->packet_state = 7;
655 				} else {
656 					printk("%s: unknown packet type: "
657 					       "%02x%02x\n", __func__,
658 					       dec->packet[0], dec->packet[1]);
659 					dec->packet_state = 0;
660 				}
661 			}
662 
663 			length--;
664 			break;
665 
666 		case 5:
667 			dec->packet[dec->packet_length++] = *b++;
668 
669 			if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
670 			    dec->packet_length == 8) {
671 				dec->packet_state++;
672 				dec->packet_payload_length = 8 +
673 					(dec->packet[6] << 8) +
674 					dec->packet[7];
675 			} else if (dec->packet_type ==
676 					TTUSB_DEC_PACKET_SECTION &&
677 				   dec->packet_length == 5) {
678 				dec->packet_state++;
679 				dec->packet_payload_length = 5 +
680 					((dec->packet[3] & 0x0f) << 8) +
681 					dec->packet[4];
682 			}
683 
684 			length--;
685 			break;
686 
687 		case 6: {
688 			int remainder = dec->packet_payload_length -
689 					dec->packet_length;
690 
691 			if (length >= remainder) {
692 				memcpy(dec->packet + dec->packet_length,
693 				       b, remainder);
694 				dec->packet_length += remainder;
695 				b += remainder;
696 				length -= remainder;
697 				dec->packet_state++;
698 			} else {
699 				memcpy(&dec->packet[dec->packet_length],
700 				       b, length);
701 				dec->packet_length += length;
702 				length = 0;
703 			}
704 
705 			break;
706 		}
707 
708 		case 7: {
709 			int tail = 4;
710 
711 			dec->packet[dec->packet_length++] = *b++;
712 
713 			if (dec->packet_type == TTUSB_DEC_PACKET_SECTION &&
714 			    dec->packet_payload_length % 2)
715 				tail++;
716 
717 			if (dec->packet_length ==
718 			    dec->packet_payload_length + tail) {
719 				ttusb_dec_process_packet(dec);
720 				dec->packet_state = 0;
721 			}
722 
723 			length--;
724 			break;
725 		}
726 
727 		default:
728 			printk("%s: illegal packet state encountered.\n",
729 			       __func__);
730 			dec->packet_state = 0;
731 		}
732 	}
733 }
734 
735 static void ttusb_dec_process_urb_frame_list(unsigned long data)
736 {
737 	struct ttusb_dec *dec = (struct ttusb_dec *)data;
738 	struct list_head *item;
739 	struct urb_frame *frame;
740 	unsigned long flags;
741 
742 	while (1) {
743 		spin_lock_irqsave(&dec->urb_frame_list_lock, flags);
744 		if ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
745 			frame = list_entry(item, struct urb_frame,
746 					   urb_frame_list);
747 			list_del(&frame->urb_frame_list);
748 		} else {
749 			spin_unlock_irqrestore(&dec->urb_frame_list_lock,
750 					       flags);
751 			return;
752 		}
753 		spin_unlock_irqrestore(&dec->urb_frame_list_lock, flags);
754 
755 		ttusb_dec_process_urb_frame(dec, frame->data, frame->length);
756 		kfree(frame);
757 	}
758 }
759 
760 static void ttusb_dec_process_urb(struct urb *urb)
761 {
762 	struct ttusb_dec *dec = urb->context;
763 
764 	if (!urb->status) {
765 		int i;
766 
767 		for (i = 0; i < FRAMES_PER_ISO_BUF; i++) {
768 			struct usb_iso_packet_descriptor *d;
769 			u8 *b;
770 			int length;
771 			struct urb_frame *frame;
772 
773 			d = &urb->iso_frame_desc[i];
774 			b = urb->transfer_buffer + d->offset;
775 			length = d->actual_length;
776 
777 			if ((frame = kmalloc(sizeof(struct urb_frame),
778 					     GFP_ATOMIC))) {
779 				unsigned long flags;
780 
781 				memcpy(frame->data, b, length);
782 				frame->length = length;
783 
784 				spin_lock_irqsave(&dec->urb_frame_list_lock,
785 						     flags);
786 				list_add_tail(&frame->urb_frame_list,
787 					      &dec->urb_frame_list);
788 				spin_unlock_irqrestore(&dec->urb_frame_list_lock,
789 						       flags);
790 
791 				tasklet_schedule(&dec->urb_tasklet);
792 			}
793 		}
794 	} else {
795 		 /* -ENOENT is expected when unlinking urbs */
796 		if (urb->status != -ENOENT)
797 			dprintk("%s: urb error: %d\n", __func__,
798 				urb->status);
799 	}
800 
801 	if (dec->iso_stream_count)
802 		usb_submit_urb(urb, GFP_ATOMIC);
803 }
804 
805 static void ttusb_dec_setup_urbs(struct ttusb_dec *dec)
806 {
807 	int i, j, buffer_offset = 0;
808 
809 	dprintk("%s\n", __func__);
810 
811 	for (i = 0; i < ISO_BUF_COUNT; i++) {
812 		int frame_offset = 0;
813 		struct urb *urb = dec->iso_urb[i];
814 
815 		urb->dev = dec->udev;
816 		urb->context = dec;
817 		urb->complete = ttusb_dec_process_urb;
818 		urb->pipe = dec->in_pipe;
819 		urb->transfer_flags = URB_ISO_ASAP;
820 		urb->interval = 1;
821 		urb->number_of_packets = FRAMES_PER_ISO_BUF;
822 		urb->transfer_buffer_length = ISO_FRAME_SIZE *
823 					      FRAMES_PER_ISO_BUF;
824 		urb->transfer_buffer = dec->iso_buffer + buffer_offset;
825 		buffer_offset += ISO_FRAME_SIZE * FRAMES_PER_ISO_BUF;
826 
827 		for (j = 0; j < FRAMES_PER_ISO_BUF; j++) {
828 			urb->iso_frame_desc[j].offset = frame_offset;
829 			urb->iso_frame_desc[j].length = ISO_FRAME_SIZE;
830 			frame_offset += ISO_FRAME_SIZE;
831 		}
832 	}
833 }
834 
835 static void ttusb_dec_stop_iso_xfer(struct ttusb_dec *dec)
836 {
837 	int i;
838 
839 	dprintk("%s\n", __func__);
840 
841 	if (mutex_lock_interruptible(&dec->iso_mutex))
842 		return;
843 
844 	dec->iso_stream_count--;
845 
846 	if (!dec->iso_stream_count) {
847 		for (i = 0; i < ISO_BUF_COUNT; i++)
848 			usb_kill_urb(dec->iso_urb[i]);
849 	}
850 
851 	mutex_unlock(&dec->iso_mutex);
852 }
853 
854 /* Setting the interface of the DEC tends to take down the USB communications
855  * for a short period, so it's important not to call this function just before
856  * trying to talk to it.
857  */
858 static int ttusb_dec_set_interface(struct ttusb_dec *dec,
859 				   enum ttusb_dec_interface interface)
860 {
861 	int result = 0;
862 	u8 b[] = { 0x05 };
863 
864 	if (interface != dec->interface) {
865 		switch (interface) {
866 		case TTUSB_DEC_INTERFACE_INITIAL:
867 			result = usb_set_interface(dec->udev, 0, 0);
868 			break;
869 		case TTUSB_DEC_INTERFACE_IN:
870 			result = ttusb_dec_send_command(dec, 0x80, sizeof(b),
871 							b, NULL, NULL);
872 			if (result)
873 				return result;
874 			result = usb_set_interface(dec->udev, 0, 8);
875 			break;
876 		case TTUSB_DEC_INTERFACE_OUT:
877 			result = usb_set_interface(dec->udev, 0, 1);
878 			break;
879 		}
880 
881 		if (result)
882 			return result;
883 
884 		dec->interface = interface;
885 	}
886 
887 	return 0;
888 }
889 
890 static int ttusb_dec_start_iso_xfer(struct ttusb_dec *dec)
891 {
892 	int i, result;
893 
894 	dprintk("%s\n", __func__);
895 
896 	if (mutex_lock_interruptible(&dec->iso_mutex))
897 		return -EAGAIN;
898 
899 	if (!dec->iso_stream_count) {
900 		ttusb_dec_setup_urbs(dec);
901 
902 		dec->packet_state = 0;
903 		dec->v_pes_postbytes = 0;
904 		dec->next_packet_id = 0;
905 
906 		for (i = 0; i < ISO_BUF_COUNT; i++) {
907 			if ((result = usb_submit_urb(dec->iso_urb[i],
908 						     GFP_ATOMIC))) {
909 				printk("%s: failed urb submission %d: "
910 				       "error %d\n", __func__, i, result);
911 
912 				while (i) {
913 					usb_kill_urb(dec->iso_urb[i - 1]);
914 					i--;
915 				}
916 
917 				mutex_unlock(&dec->iso_mutex);
918 				return result;
919 			}
920 		}
921 	}
922 
923 	dec->iso_stream_count++;
924 
925 	mutex_unlock(&dec->iso_mutex);
926 
927 	return 0;
928 }
929 
930 static int ttusb_dec_start_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
931 {
932 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
933 	struct ttusb_dec *dec = dvbdmx->priv;
934 	u8 b0[] = { 0x05 };
935 	int result = 0;
936 
937 	dprintk("%s\n", __func__);
938 
939 	dprintk("  ts_type:");
940 
941 	if (dvbdmxfeed->ts_type & TS_DECODER)
942 		dprintk(" TS_DECODER");
943 
944 	if (dvbdmxfeed->ts_type & TS_PACKET)
945 		dprintk(" TS_PACKET");
946 
947 	if (dvbdmxfeed->ts_type & TS_PAYLOAD_ONLY)
948 		dprintk(" TS_PAYLOAD_ONLY");
949 
950 	dprintk("\n");
951 
952 	switch (dvbdmxfeed->pes_type) {
953 
954 	case DMX_PES_VIDEO:
955 		dprintk("  pes_type: DMX_PES_VIDEO\n");
956 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
957 		dec->pid[DMX_PES_VIDEO] = dvbdmxfeed->pid;
958 		dec->video_filter = dvbdmxfeed->filter;
959 		ttusb_dec_set_pids(dec);
960 		break;
961 
962 	case DMX_PES_AUDIO:
963 		dprintk("  pes_type: DMX_PES_AUDIO\n");
964 		dec->pid[DMX_PES_AUDIO] = dvbdmxfeed->pid;
965 		dec->audio_filter = dvbdmxfeed->filter;
966 		ttusb_dec_set_pids(dec);
967 		break;
968 
969 	case DMX_PES_TELETEXT:
970 		dec->pid[DMX_PES_TELETEXT] = dvbdmxfeed->pid;
971 		dprintk("  pes_type: DMX_PES_TELETEXT(not supported)\n");
972 		return -ENOSYS;
973 
974 	case DMX_PES_PCR:
975 		dprintk("  pes_type: DMX_PES_PCR\n");
976 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
977 		ttusb_dec_set_pids(dec);
978 		break;
979 
980 	case DMX_PES_OTHER:
981 		dprintk("  pes_type: DMX_PES_OTHER(not supported)\n");
982 		return -ENOSYS;
983 
984 	default:
985 		dprintk("  pes_type: unknown (%d)\n", dvbdmxfeed->pes_type);
986 		return -EINVAL;
987 
988 	}
989 
990 	result = ttusb_dec_send_command(dec, 0x80, sizeof(b0), b0, NULL, NULL);
991 	if (result)
992 		return result;
993 
994 	dec->pva_stream_count++;
995 	return ttusb_dec_start_iso_xfer(dec);
996 }
997 
998 static int ttusb_dec_start_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
999 {
1000 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1001 	u8 b0[] = { 0x00, 0x00, 0x00, 0x01,
1002 		    0x00, 0x00, 0x00, 0x00,
1003 		    0x00, 0x00, 0x00, 0x00,
1004 		    0x00, 0x00, 0x00, 0x00,
1005 		    0x00, 0xff, 0x00, 0x00,
1006 		    0x00, 0x00, 0x00, 0x00,
1007 		    0x00, 0x00, 0x00, 0x00,
1008 		    0x00 };
1009 	__be16 pid;
1010 	u8 c[COMMAND_PACKET_SIZE];
1011 	int c_length;
1012 	int result;
1013 	struct filter_info *finfo;
1014 	unsigned long flags;
1015 	u8 x = 1;
1016 
1017 	dprintk("%s\n", __func__);
1018 
1019 	pid = htons(dvbdmxfeed->pid);
1020 	memcpy(&b0[0], &pid, 2);
1021 	memcpy(&b0[4], &x, 1);
1022 	memcpy(&b0[5], &dvbdmxfeed->filter->filter.filter_value[0], 1);
1023 
1024 	result = ttusb_dec_send_command(dec, 0x60, sizeof(b0), b0,
1025 					&c_length, c);
1026 
1027 	if (!result) {
1028 		if (c_length == 2) {
1029 			if (!(finfo = kmalloc(sizeof(struct filter_info),
1030 					      GFP_ATOMIC)))
1031 				return -ENOMEM;
1032 
1033 			finfo->stream_id = c[1];
1034 			finfo->filter = dvbdmxfeed->filter;
1035 
1036 			spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1037 			list_add_tail(&finfo->filter_info_list,
1038 				      &dec->filter_info_list);
1039 			spin_unlock_irqrestore(&dec->filter_info_list_lock,
1040 					       flags);
1041 
1042 			dvbdmxfeed->priv = finfo;
1043 
1044 			dec->filter_stream_count++;
1045 			return ttusb_dec_start_iso_xfer(dec);
1046 		}
1047 
1048 		return -EAGAIN;
1049 	} else
1050 		return result;
1051 }
1052 
1053 static int ttusb_dec_start_feed(struct dvb_demux_feed *dvbdmxfeed)
1054 {
1055 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
1056 
1057 	dprintk("%s\n", __func__);
1058 
1059 	if (!dvbdmx->dmx.frontend)
1060 		return -EINVAL;
1061 
1062 	dprintk("  pid: 0x%04X\n", dvbdmxfeed->pid);
1063 
1064 	switch (dvbdmxfeed->type) {
1065 
1066 	case DMX_TYPE_TS:
1067 		return ttusb_dec_start_ts_feed(dvbdmxfeed);
1068 		break;
1069 
1070 	case DMX_TYPE_SEC:
1071 		return ttusb_dec_start_sec_feed(dvbdmxfeed);
1072 		break;
1073 
1074 	default:
1075 		dprintk("  type: unknown (%d)\n", dvbdmxfeed->type);
1076 		return -EINVAL;
1077 
1078 	}
1079 }
1080 
1081 static int ttusb_dec_stop_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
1082 {
1083 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1084 	u8 b0[] = { 0x00 };
1085 
1086 	ttusb_dec_send_command(dec, 0x81, sizeof(b0), b0, NULL, NULL);
1087 
1088 	dec->pva_stream_count--;
1089 
1090 	ttusb_dec_stop_iso_xfer(dec);
1091 
1092 	return 0;
1093 }
1094 
1095 static int ttusb_dec_stop_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1096 {
1097 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1098 	u8 b0[] = { 0x00, 0x00 };
1099 	struct filter_info *finfo = (struct filter_info *)dvbdmxfeed->priv;
1100 	unsigned long flags;
1101 
1102 	b0[1] = finfo->stream_id;
1103 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1104 	list_del(&finfo->filter_info_list);
1105 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
1106 	kfree(finfo);
1107 	ttusb_dec_send_command(dec, 0x62, sizeof(b0), b0, NULL, NULL);
1108 
1109 	dec->filter_stream_count--;
1110 
1111 	ttusb_dec_stop_iso_xfer(dec);
1112 
1113 	return 0;
1114 }
1115 
1116 static int ttusb_dec_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
1117 {
1118 	dprintk("%s\n", __func__);
1119 
1120 	switch (dvbdmxfeed->type) {
1121 	case DMX_TYPE_TS:
1122 		return ttusb_dec_stop_ts_feed(dvbdmxfeed);
1123 		break;
1124 
1125 	case DMX_TYPE_SEC:
1126 		return ttusb_dec_stop_sec_feed(dvbdmxfeed);
1127 		break;
1128 	}
1129 
1130 	return 0;
1131 }
1132 
1133 static void ttusb_dec_free_iso_urbs(struct ttusb_dec *dec)
1134 {
1135 	int i;
1136 
1137 	dprintk("%s\n", __func__);
1138 
1139 	for (i = 0; i < ISO_BUF_COUNT; i++)
1140 		usb_free_urb(dec->iso_urb[i]);
1141 
1142 	pci_free_consistent(NULL,
1143 			    ISO_FRAME_SIZE * (FRAMES_PER_ISO_BUF *
1144 					      ISO_BUF_COUNT),
1145 			    dec->iso_buffer, dec->iso_dma_handle);
1146 }
1147 
1148 static int ttusb_dec_alloc_iso_urbs(struct ttusb_dec *dec)
1149 {
1150 	int i;
1151 
1152 	dprintk("%s\n", __func__);
1153 
1154 	dec->iso_buffer = pci_alloc_consistent(NULL,
1155 					       ISO_FRAME_SIZE *
1156 					       (FRAMES_PER_ISO_BUF *
1157 						ISO_BUF_COUNT),
1158 					       &dec->iso_dma_handle);
1159 
1160 	if (!dec->iso_buffer) {
1161 		dprintk("%s: pci_alloc_consistent - not enough memory\n",
1162 			__func__);
1163 		return -ENOMEM;
1164 	}
1165 
1166 	memset(dec->iso_buffer, 0,
1167 	       ISO_FRAME_SIZE * (FRAMES_PER_ISO_BUF * ISO_BUF_COUNT));
1168 
1169 	for (i = 0; i < ISO_BUF_COUNT; i++) {
1170 		struct urb *urb;
1171 
1172 		if (!(urb = usb_alloc_urb(FRAMES_PER_ISO_BUF, GFP_ATOMIC))) {
1173 			ttusb_dec_free_iso_urbs(dec);
1174 			return -ENOMEM;
1175 		}
1176 
1177 		dec->iso_urb[i] = urb;
1178 	}
1179 
1180 	ttusb_dec_setup_urbs(dec);
1181 
1182 	return 0;
1183 }
1184 
1185 static void ttusb_dec_init_tasklet(struct ttusb_dec *dec)
1186 {
1187 	spin_lock_init(&dec->urb_frame_list_lock);
1188 	INIT_LIST_HEAD(&dec->urb_frame_list);
1189 	tasklet_init(&dec->urb_tasklet, ttusb_dec_process_urb_frame_list,
1190 		     (unsigned long)dec);
1191 }
1192 
1193 static int ttusb_init_rc( struct ttusb_dec *dec)
1194 {
1195 	struct input_dev *input_dev;
1196 	u8 b[] = { 0x00, 0x01 };
1197 	int i;
1198 	int err;
1199 
1200 	usb_make_path(dec->udev, dec->rc_phys, sizeof(dec->rc_phys));
1201 	strlcat(dec->rc_phys, "/input0", sizeof(dec->rc_phys));
1202 
1203 	input_dev = input_allocate_device();
1204 	if (!input_dev)
1205 		return -ENOMEM;
1206 
1207 	input_dev->name = "ttusb_dec remote control";
1208 	input_dev->phys = dec->rc_phys;
1209 	input_dev->evbit[0] = BIT_MASK(EV_KEY);
1210 	input_dev->keycodesize = sizeof(u16);
1211 	input_dev->keycodemax = 0x1a;
1212 	input_dev->keycode = rc_keys;
1213 
1214 	for (i = 0; i < ARRAY_SIZE(rc_keys); i++)
1215 		  set_bit(rc_keys[i], input_dev->keybit);
1216 
1217 	err = input_register_device(input_dev);
1218 	if (err) {
1219 		input_free_device(input_dev);
1220 		return err;
1221 	}
1222 
1223 	dec->rc_input_dev = input_dev;
1224 	if (usb_submit_urb(dec->irq_urb, GFP_KERNEL))
1225 		printk("%s: usb_submit_urb failed\n",__func__);
1226 	/* enable irq pipe */
1227 	ttusb_dec_send_command(dec,0xb0,sizeof(b),b,NULL,NULL);
1228 
1229 	return 0;
1230 }
1231 
1232 static void ttusb_dec_init_v_pes(struct ttusb_dec *dec)
1233 {
1234 	dprintk("%s\n", __func__);
1235 
1236 	dec->v_pes[0] = 0x00;
1237 	dec->v_pes[1] = 0x00;
1238 	dec->v_pes[2] = 0x01;
1239 	dec->v_pes[3] = 0xe0;
1240 }
1241 
1242 static int ttusb_dec_init_usb(struct ttusb_dec *dec)
1243 {
1244 	dprintk("%s\n", __func__);
1245 
1246 	mutex_init(&dec->usb_mutex);
1247 	mutex_init(&dec->iso_mutex);
1248 
1249 	dec->command_pipe = usb_sndbulkpipe(dec->udev, COMMAND_PIPE);
1250 	dec->result_pipe = usb_rcvbulkpipe(dec->udev, RESULT_PIPE);
1251 	dec->in_pipe = usb_rcvisocpipe(dec->udev, IN_PIPE);
1252 	dec->out_pipe = usb_sndisocpipe(dec->udev, OUT_PIPE);
1253 	dec->irq_pipe = usb_rcvintpipe(dec->udev, IRQ_PIPE);
1254 
1255 	if(enable_rc) {
1256 		dec->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
1257 		if(!dec->irq_urb) {
1258 			return -ENOMEM;
1259 		}
1260 		dec->irq_buffer = usb_alloc_coherent(dec->udev,IRQ_PACKET_SIZE,
1261 					GFP_ATOMIC, &dec->irq_dma_handle);
1262 		if(!dec->irq_buffer) {
1263 			usb_free_urb(dec->irq_urb);
1264 			return -ENOMEM;
1265 		}
1266 		usb_fill_int_urb(dec->irq_urb, dec->udev,dec->irq_pipe,
1267 				 dec->irq_buffer, IRQ_PACKET_SIZE,
1268 				 ttusb_dec_handle_irq, dec, 1);
1269 		dec->irq_urb->transfer_dma = dec->irq_dma_handle;
1270 		dec->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1271 	}
1272 
1273 	return ttusb_dec_alloc_iso_urbs(dec);
1274 }
1275 
1276 static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
1277 {
1278 	int i, j, actual_len, result, size, trans_count;
1279 	u8 b0[] = { 0x00, 0x00, 0x00, 0x00,
1280 		    0x00, 0x00, 0x00, 0x00,
1281 		    0x61, 0x00 };
1282 	u8 b1[] = { 0x61 };
1283 	u8 *b;
1284 	char idstring[21];
1285 	const u8 *firmware = NULL;
1286 	size_t firmware_size = 0;
1287 	u16 firmware_csum = 0;
1288 	__be16 firmware_csum_ns;
1289 	__be32 firmware_size_nl;
1290 	u32 crc32_csum, crc32_check;
1291 	__be32 tmp;
1292 	const struct firmware *fw_entry = NULL;
1293 
1294 	dprintk("%s\n", __func__);
1295 
1296 	if (request_firmware(&fw_entry, dec->firmware_name, &dec->udev->dev)) {
1297 		printk(KERN_ERR "%s: Firmware (%s) unavailable.\n",
1298 		       __func__, dec->firmware_name);
1299 		return 1;
1300 	}
1301 
1302 	firmware = fw_entry->data;
1303 	firmware_size = fw_entry->size;
1304 
1305 	if (firmware_size < 60) {
1306 		printk("%s: firmware size too small for DSP code (%zu < 60).\n",
1307 			__func__, firmware_size);
1308 		release_firmware(fw_entry);
1309 		return -1;
1310 	}
1311 
1312 	/* a 32 bit checksum over the first 56 bytes of the DSP Code is stored
1313 	   at offset 56 of file, so use it to check if the firmware file is
1314 	   valid. */
1315 	crc32_csum = crc32(~0L, firmware, 56) ^ ~0L;
1316 	memcpy(&tmp, &firmware[56], 4);
1317 	crc32_check = ntohl(tmp);
1318 	if (crc32_csum != crc32_check) {
1319 		printk("%s: crc32 check of DSP code failed (calculated "
1320 		       "0x%08x != 0x%08x in file), file invalid.\n",
1321 			__func__, crc32_csum, crc32_check);
1322 		release_firmware(fw_entry);
1323 		return -1;
1324 	}
1325 	memcpy(idstring, &firmware[36], 20);
1326 	idstring[20] = '\0';
1327 	printk(KERN_INFO "ttusb_dec: found DSP code \"%s\".\n", idstring);
1328 
1329 	firmware_size_nl = htonl(firmware_size);
1330 	memcpy(b0, &firmware_size_nl, 4);
1331 	firmware_csum = crc16(~0, firmware, firmware_size) ^ ~0;
1332 	firmware_csum_ns = htons(firmware_csum);
1333 	memcpy(&b0[6], &firmware_csum_ns, 2);
1334 
1335 	result = ttusb_dec_send_command(dec, 0x41, sizeof(b0), b0, NULL, NULL);
1336 
1337 	if (result) {
1338 		release_firmware(fw_entry);
1339 		return result;
1340 	}
1341 
1342 	trans_count = 0;
1343 	j = 0;
1344 
1345 	b = kmalloc(ARM_PACKET_SIZE, GFP_KERNEL);
1346 	if (b == NULL) {
1347 		release_firmware(fw_entry);
1348 		return -ENOMEM;
1349 	}
1350 
1351 	for (i = 0; i < firmware_size; i += COMMAND_PACKET_SIZE) {
1352 		size = firmware_size - i;
1353 		if (size > COMMAND_PACKET_SIZE)
1354 			size = COMMAND_PACKET_SIZE;
1355 
1356 		b[j + 0] = 0xaa;
1357 		b[j + 1] = trans_count++;
1358 		b[j + 2] = 0xf0;
1359 		b[j + 3] = size;
1360 		memcpy(&b[j + 4], &firmware[i], size);
1361 
1362 		j += COMMAND_PACKET_SIZE + 4;
1363 
1364 		if (j >= ARM_PACKET_SIZE) {
1365 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1366 					      ARM_PACKET_SIZE, &actual_len,
1367 					      100);
1368 			j = 0;
1369 		} else if (size < COMMAND_PACKET_SIZE) {
1370 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1371 					      j - COMMAND_PACKET_SIZE + size,
1372 					      &actual_len, 100);
1373 		}
1374 	}
1375 
1376 	result = ttusb_dec_send_command(dec, 0x43, sizeof(b1), b1, NULL, NULL);
1377 
1378 	release_firmware(fw_entry);
1379 	kfree(b);
1380 
1381 	return result;
1382 }
1383 
1384 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
1385 {
1386 	int result;
1387 	unsigned int mode = 0, model = 0, version = 0;
1388 
1389 	dprintk("%s\n", __func__);
1390 
1391 	result = ttusb_dec_get_stb_state(dec, &mode, &model, &version);
1392 
1393 	if (!result) {
1394 		if (!mode) {
1395 			if (version == 0xABCDEFAB)
1396 				printk(KERN_INFO "ttusb_dec: no version "
1397 				       "info in Firmware\n");
1398 			else
1399 				printk(KERN_INFO "ttusb_dec: Firmware "
1400 				       "%x.%02x%c%c\n",
1401 				       version >> 24, (version >> 16) & 0xff,
1402 				       (version >> 8) & 0xff, version & 0xff);
1403 
1404 			result = ttusb_dec_boot_dsp(dec);
1405 			if (result)
1406 				return result;
1407 			else
1408 				return 1;
1409 		} else {
1410 			/* We can't trust the USB IDs that some firmwares
1411 			   give the box */
1412 			switch (model) {
1413 			case 0x00070001:
1414 			case 0x00070008:
1415 			case 0x0007000c:
1416 				ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1417 				break;
1418 			case 0x00070009:
1419 			case 0x00070013:
1420 				ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1421 				break;
1422 			case 0x00070011:
1423 				ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1424 				break;
1425 			default:
1426 				printk(KERN_ERR "%s: unknown model returned "
1427 				       "by firmware (%08x) - please report\n",
1428 				       __func__, model);
1429 				return -1;
1430 				break;
1431 			}
1432 
1433 			if (version >= 0x01770000)
1434 				dec->can_playback = 1;
1435 
1436 			return 0;
1437 		}
1438 	}
1439 	else
1440 		return result;
1441 }
1442 
1443 static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
1444 {
1445 	int result;
1446 
1447 	dprintk("%s\n", __func__);
1448 
1449 	if ((result = dvb_register_adapter(&dec->adapter,
1450 					   dec->model_name, THIS_MODULE,
1451 					   &dec->udev->dev,
1452 					   adapter_nr)) < 0) {
1453 		printk("%s: dvb_register_adapter failed: error %d\n",
1454 		       __func__, result);
1455 
1456 		return result;
1457 	}
1458 
1459 	dec->demux.dmx.capabilities = DMX_TS_FILTERING | DMX_SECTION_FILTERING;
1460 
1461 	dec->demux.priv = (void *)dec;
1462 	dec->demux.filternum = 31;
1463 	dec->demux.feednum = 31;
1464 	dec->demux.start_feed = ttusb_dec_start_feed;
1465 	dec->demux.stop_feed = ttusb_dec_stop_feed;
1466 	dec->demux.write_to_decoder = NULL;
1467 
1468 	if ((result = dvb_dmx_init(&dec->demux)) < 0) {
1469 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1470 		       result);
1471 
1472 		dvb_unregister_adapter(&dec->adapter);
1473 
1474 		return result;
1475 	}
1476 
1477 	dec->dmxdev.filternum = 32;
1478 	dec->dmxdev.demux = &dec->demux.dmx;
1479 	dec->dmxdev.capabilities = 0;
1480 
1481 	if ((result = dvb_dmxdev_init(&dec->dmxdev, &dec->adapter)) < 0) {
1482 		printk("%s: dvb_dmxdev_init failed: error %d\n",
1483 		       __func__, result);
1484 
1485 		dvb_dmx_release(&dec->demux);
1486 		dvb_unregister_adapter(&dec->adapter);
1487 
1488 		return result;
1489 	}
1490 
1491 	dec->frontend.source = DMX_FRONTEND_0;
1492 
1493 	if ((result = dec->demux.dmx.add_frontend(&dec->demux.dmx,
1494 						  &dec->frontend)) < 0) {
1495 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1496 		       result);
1497 
1498 		dvb_dmxdev_release(&dec->dmxdev);
1499 		dvb_dmx_release(&dec->demux);
1500 		dvb_unregister_adapter(&dec->adapter);
1501 
1502 		return result;
1503 	}
1504 
1505 	if ((result = dec->demux.dmx.connect_frontend(&dec->demux.dmx,
1506 						      &dec->frontend)) < 0) {
1507 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1508 		       result);
1509 
1510 		dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1511 		dvb_dmxdev_release(&dec->dmxdev);
1512 		dvb_dmx_release(&dec->demux);
1513 		dvb_unregister_adapter(&dec->adapter);
1514 
1515 		return result;
1516 	}
1517 
1518 	dvb_net_init(&dec->adapter, &dec->dvb_net, &dec->demux.dmx);
1519 
1520 	return 0;
1521 }
1522 
1523 static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
1524 {
1525 	dprintk("%s\n", __func__);
1526 
1527 	dvb_net_release(&dec->dvb_net);
1528 	dec->demux.dmx.close(&dec->demux.dmx);
1529 	dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1530 	dvb_dmxdev_release(&dec->dmxdev);
1531 	dvb_dmx_release(&dec->demux);
1532 	if (dec->fe) {
1533 		dvb_unregister_frontend(dec->fe);
1534 		if (dec->fe->ops.release)
1535 			dec->fe->ops.release(dec->fe);
1536 	}
1537 	dvb_unregister_adapter(&dec->adapter);
1538 }
1539 
1540 static void ttusb_dec_exit_rc(struct ttusb_dec *dec)
1541 {
1542 
1543 	dprintk("%s\n", __func__);
1544 	/* we have to check whether the irq URB is already submitted.
1545 	  * As the irq is submitted after the interface is changed,
1546 	  * this is the best method i figured out.
1547 	  * Any others?*/
1548 	if (dec->interface == TTUSB_DEC_INTERFACE_IN)
1549 		usb_kill_urb(dec->irq_urb);
1550 
1551 	usb_free_urb(dec->irq_urb);
1552 
1553 	usb_free_coherent(dec->udev,IRQ_PACKET_SIZE,
1554 			  dec->irq_buffer, dec->irq_dma_handle);
1555 
1556 	if (dec->rc_input_dev) {
1557 		input_unregister_device(dec->rc_input_dev);
1558 		dec->rc_input_dev = NULL;
1559 	}
1560 }
1561 
1562 
1563 static void ttusb_dec_exit_usb(struct ttusb_dec *dec)
1564 {
1565 	int i;
1566 
1567 	dprintk("%s\n", __func__);
1568 
1569 	dec->iso_stream_count = 0;
1570 
1571 	for (i = 0; i < ISO_BUF_COUNT; i++)
1572 		usb_kill_urb(dec->iso_urb[i]);
1573 
1574 	ttusb_dec_free_iso_urbs(dec);
1575 }
1576 
1577 static void ttusb_dec_exit_tasklet(struct ttusb_dec *dec)
1578 {
1579 	struct list_head *item;
1580 	struct urb_frame *frame;
1581 
1582 	tasklet_kill(&dec->urb_tasklet);
1583 
1584 	while ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
1585 		frame = list_entry(item, struct urb_frame, urb_frame_list);
1586 		list_del(&frame->urb_frame_list);
1587 		kfree(frame);
1588 	}
1589 }
1590 
1591 static void ttusb_dec_init_filters(struct ttusb_dec *dec)
1592 {
1593 	INIT_LIST_HEAD(&dec->filter_info_list);
1594 	spin_lock_init(&dec->filter_info_list_lock);
1595 }
1596 
1597 static void ttusb_dec_exit_filters(struct ttusb_dec *dec)
1598 {
1599 	struct list_head *item;
1600 	struct filter_info *finfo;
1601 
1602 	while ((item = dec->filter_info_list.next) != &dec->filter_info_list) {
1603 		finfo = list_entry(item, struct filter_info, filter_info_list);
1604 		list_del(&finfo->filter_info_list);
1605 		kfree(finfo);
1606 	}
1607 }
1608 
1609 static int fe_send_command(struct dvb_frontend* fe, const u8 command,
1610 			   int param_length, const u8 params[],
1611 			   int *result_length, u8 cmd_result[])
1612 {
1613 	struct ttusb_dec* dec = fe->dvb->priv;
1614 	return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
1615 }
1616 
1617 static struct ttusbdecfe_config fe_config = {
1618 	.send_command = fe_send_command
1619 };
1620 
1621 static int ttusb_dec_probe(struct usb_interface *intf,
1622 			   const struct usb_device_id *id)
1623 {
1624 	struct usb_device *udev;
1625 	struct ttusb_dec *dec;
1626 
1627 	dprintk("%s\n", __func__);
1628 
1629 	udev = interface_to_usbdev(intf);
1630 
1631 	if (!(dec = kzalloc(sizeof(struct ttusb_dec), GFP_KERNEL))) {
1632 		printk("%s: couldn't allocate memory.\n", __func__);
1633 		return -ENOMEM;
1634 	}
1635 
1636 	usb_set_intfdata(intf, (void *)dec);
1637 
1638 	switch (id->idProduct) {
1639 	case 0x1006:
1640 		ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1641 		break;
1642 
1643 	case 0x1008:
1644 		ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1645 		break;
1646 
1647 	case 0x1009:
1648 		ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1649 		break;
1650 	}
1651 
1652 	dec->udev = udev;
1653 
1654 	if (ttusb_dec_init_usb(dec))
1655 		return 0;
1656 	if (ttusb_dec_init_stb(dec)) {
1657 		ttusb_dec_exit_usb(dec);
1658 		return 0;
1659 	}
1660 	ttusb_dec_init_dvb(dec);
1661 
1662 	dec->adapter.priv = dec;
1663 	switch (id->idProduct) {
1664 	case 0x1006:
1665 		dec->fe = ttusbdecfe_dvbs_attach(&fe_config);
1666 		break;
1667 
1668 	case 0x1008:
1669 	case 0x1009:
1670 		dec->fe = ttusbdecfe_dvbt_attach(&fe_config);
1671 		break;
1672 	}
1673 
1674 	if (dec->fe == NULL) {
1675 		printk("dvb-ttusb-dec: A frontend driver was not found for device [%04x:%04x]\n",
1676 		       le16_to_cpu(dec->udev->descriptor.idVendor),
1677 		       le16_to_cpu(dec->udev->descriptor.idProduct));
1678 	} else {
1679 		if (dvb_register_frontend(&dec->adapter, dec->fe)) {
1680 			printk("budget-ci: Frontend registration failed!\n");
1681 			if (dec->fe->ops.release)
1682 				dec->fe->ops.release(dec->fe);
1683 			dec->fe = NULL;
1684 		}
1685 	}
1686 
1687 	ttusb_dec_init_v_pes(dec);
1688 	ttusb_dec_init_filters(dec);
1689 	ttusb_dec_init_tasklet(dec);
1690 
1691 	dec->active = 1;
1692 
1693 	ttusb_dec_set_interface(dec, TTUSB_DEC_INTERFACE_IN);
1694 
1695 	if (enable_rc)
1696 		ttusb_init_rc(dec);
1697 
1698 	return 0;
1699 }
1700 
1701 static void ttusb_dec_disconnect(struct usb_interface *intf)
1702 {
1703 	struct ttusb_dec *dec = usb_get_intfdata(intf);
1704 
1705 	usb_set_intfdata(intf, NULL);
1706 
1707 	dprintk("%s\n", __func__);
1708 
1709 	if (dec->active) {
1710 		ttusb_dec_exit_tasklet(dec);
1711 		ttusb_dec_exit_filters(dec);
1712 		if(enable_rc)
1713 			ttusb_dec_exit_rc(dec);
1714 		ttusb_dec_exit_usb(dec);
1715 		ttusb_dec_exit_dvb(dec);
1716 	}
1717 
1718 	kfree(dec);
1719 }
1720 
1721 static void ttusb_dec_set_model(struct ttusb_dec *dec,
1722 				enum ttusb_dec_model model)
1723 {
1724 	dec->model = model;
1725 
1726 	switch (model) {
1727 	case TTUSB_DEC2000T:
1728 		dec->model_name = "DEC2000-t";
1729 		dec->firmware_name = "dvb-ttusb-dec-2000t.fw";
1730 		break;
1731 
1732 	case TTUSB_DEC2540T:
1733 		dec->model_name = "DEC2540-t";
1734 		dec->firmware_name = "dvb-ttusb-dec-2540t.fw";
1735 		break;
1736 
1737 	case TTUSB_DEC3000S:
1738 		dec->model_name = "DEC3000-s";
1739 		dec->firmware_name = "dvb-ttusb-dec-3000s.fw";
1740 		break;
1741 	}
1742 }
1743 
1744 static struct usb_device_id ttusb_dec_table[] = {
1745 	{USB_DEVICE(0x0b48, 0x1006)},	/* DEC3000-s */
1746 	/*{USB_DEVICE(0x0b48, 0x1007)},	   Unconfirmed */
1747 	{USB_DEVICE(0x0b48, 0x1008)},	/* DEC2000-t */
1748 	{USB_DEVICE(0x0b48, 0x1009)},	/* DEC2540-t */
1749 	{}
1750 };
1751 
1752 static struct usb_driver ttusb_dec_driver = {
1753 	.name		= "ttusb-dec",
1754 	.probe		= ttusb_dec_probe,
1755 	.disconnect	= ttusb_dec_disconnect,
1756 	.id_table	= ttusb_dec_table,
1757 };
1758 
1759 module_usb_driver(ttusb_dec_driver);
1760 
1761 MODULE_AUTHOR("Alex Woods <linux-dvb@giblets.org>");
1762 MODULE_DESCRIPTION(DRIVER_NAME);
1763 MODULE_LICENSE("GPL");
1764 MODULE_DEVICE_TABLE(usb, ttusb_dec_table);
1765