1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * TTUSB DEC Driver
4  *
5  * Copyright (C) 2003-2004 Alex Woods <linux-dvb@giblets.org>
6  * IR support by Peter Beutner <p.beutner@gmx.net>
7  */
8 
9 #include <linux/list.h>
10 #include <linux/module.h>
11 #include <linux/pci.h>
12 #include <linux/slab.h>
13 #include <linux/spinlock.h>
14 #include <linux/usb.h>
15 #include <linux/interrupt.h>
16 #include <linux/firmware.h>
17 #include <linux/crc32.h>
18 #include <linux/init.h>
19 #include <linux/input.h>
20 
21 #include <linux/mutex.h>
22 
23 #include <media/dmxdev.h>
24 #include <media/dvb_demux.h>
25 #include <media/dvb_frontend.h>
26 #include <media/dvb_net.h>
27 #include "ttusbdecfe.h"
28 
29 static int debug;
30 static int output_pva;
31 static int enable_rc;
32 
33 module_param(debug, int, 0644);
34 MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
35 module_param(output_pva, int, 0444);
36 MODULE_PARM_DESC(output_pva, "Output PVA from dvr device (default:off)");
37 module_param(enable_rc, int, 0644);
38 MODULE_PARM_DESC(enable_rc, "Turn on/off IR remote control(default: off)");
39 
40 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
41 
42 #define dprintk	if (debug) printk
43 
44 #define DRIVER_NAME		"TechnoTrend/Hauppauge DEC USB"
45 
46 #define COMMAND_PIPE		0x03
47 #define RESULT_PIPE		0x04
48 #define IN_PIPE			0x08
49 #define OUT_PIPE		0x07
50 #define IRQ_PIPE		0x0A
51 
52 #define COMMAND_PACKET_SIZE	0x3c
53 #define ARM_PACKET_SIZE		0x1000
54 #define IRQ_PACKET_SIZE		0x8
55 
56 #define ISO_BUF_COUNT		0x04
57 #define FRAMES_PER_ISO_BUF	0x04
58 #define ISO_FRAME_SIZE		0x0380
59 
60 #define	MAX_PVA_LENGTH		6144
61 
62 enum ttusb_dec_model {
63 	TTUSB_DEC2000T,
64 	TTUSB_DEC2540T,
65 	TTUSB_DEC3000S
66 };
67 
68 enum ttusb_dec_packet_type {
69 	TTUSB_DEC_PACKET_PVA,
70 	TTUSB_DEC_PACKET_SECTION,
71 	TTUSB_DEC_PACKET_EMPTY
72 };
73 
74 enum ttusb_dec_interface {
75 	TTUSB_DEC_INTERFACE_INITIAL,
76 	TTUSB_DEC_INTERFACE_IN,
77 	TTUSB_DEC_INTERFACE_OUT
78 };
79 
80 typedef int (dvb_filter_pes2ts_cb_t) (void *, unsigned char *);
81 
82 struct dvb_filter_pes2ts {
83 	unsigned char buf[188];
84 	unsigned char cc;
85 	dvb_filter_pes2ts_cb_t *cb;
86 	void *priv;
87 };
88 
89 struct ttusb_dec {
90 	enum ttusb_dec_model		model;
91 	char				*model_name;
92 	char				*firmware_name;
93 	int				can_playback;
94 
95 	/* DVB bits */
96 	struct dvb_adapter		adapter;
97 	struct dmxdev			dmxdev;
98 	struct dvb_demux		demux;
99 	struct dmx_frontend		frontend;
100 	struct dvb_net			dvb_net;
101 	struct dvb_frontend*		fe;
102 
103 	u16			pid[DMX_PES_OTHER];
104 
105 	/* USB bits */
106 	struct usb_device		*udev;
107 	u8				trans_count;
108 	unsigned int			command_pipe;
109 	unsigned int			result_pipe;
110 	unsigned int			in_pipe;
111 	unsigned int			out_pipe;
112 	unsigned int			irq_pipe;
113 	enum ttusb_dec_interface	interface;
114 	struct mutex			usb_mutex;
115 
116 	void			*irq_buffer;
117 	struct urb		*irq_urb;
118 	dma_addr_t		irq_dma_handle;
119 	void			*iso_buffer;
120 	struct urb		*iso_urb[ISO_BUF_COUNT];
121 	int			iso_stream_count;
122 	struct mutex		iso_mutex;
123 
124 	u8				packet[MAX_PVA_LENGTH + 4];
125 	enum ttusb_dec_packet_type	packet_type;
126 	int				packet_state;
127 	int				packet_length;
128 	int				packet_payload_length;
129 	u16				next_packet_id;
130 
131 	int				pva_stream_count;
132 	int				filter_stream_count;
133 
134 	struct dvb_filter_pes2ts	a_pes2ts;
135 	struct dvb_filter_pes2ts	v_pes2ts;
136 
137 	u8			v_pes[16 + MAX_PVA_LENGTH];
138 	int			v_pes_length;
139 	int			v_pes_postbytes;
140 
141 	struct list_head	urb_frame_list;
142 	struct tasklet_struct	urb_tasklet;
143 	spinlock_t		urb_frame_list_lock;
144 
145 	struct dvb_demux_filter	*audio_filter;
146 	struct dvb_demux_filter	*video_filter;
147 	struct list_head	filter_info_list;
148 	spinlock_t		filter_info_list_lock;
149 
150 	struct input_dev	*rc_input_dev;
151 	char			rc_phys[64];
152 
153 	int			active; /* Loaded successfully */
154 };
155 
156 struct urb_frame {
157 	u8			data[ISO_FRAME_SIZE];
158 	int			length;
159 	struct list_head	urb_frame_list;
160 };
161 
162 struct filter_info {
163 	u8			stream_id;
164 	struct dvb_demux_filter	*filter;
165 	struct list_head	filter_info_list;
166 };
167 
168 static u16 rc_keys[] = {
169 	KEY_POWER,
170 	KEY_MUTE,
171 	KEY_1,
172 	KEY_2,
173 	KEY_3,
174 	KEY_4,
175 	KEY_5,
176 	KEY_6,
177 	KEY_7,
178 	KEY_8,
179 	KEY_9,
180 	KEY_0,
181 	KEY_CHANNELUP,
182 	KEY_VOLUMEDOWN,
183 	KEY_OK,
184 	KEY_VOLUMEUP,
185 	KEY_CHANNELDOWN,
186 	KEY_PREVIOUS,
187 	KEY_ESC,
188 	KEY_RED,
189 	KEY_GREEN,
190 	KEY_YELLOW,
191 	KEY_BLUE,
192 	KEY_OPTION,
193 	KEY_M,
194 	KEY_RADIO
195 };
196 
197 static void dvb_filter_pes2ts_init(struct dvb_filter_pes2ts *p2ts,
198 				   unsigned short pid,
199 				   dvb_filter_pes2ts_cb_t *cb, void *priv)
200 {
201 	unsigned char *buf=p2ts->buf;
202 
203 	buf[0]=0x47;
204 	buf[1]=(pid>>8);
205 	buf[2]=pid&0xff;
206 	p2ts->cc=0;
207 	p2ts->cb=cb;
208 	p2ts->priv=priv;
209 }
210 
211 static int dvb_filter_pes2ts(struct dvb_filter_pes2ts *p2ts,
212 			     unsigned char *pes, int len, int payload_start)
213 {
214 	unsigned char *buf=p2ts->buf;
215 	int ret=0, rest;
216 
217 	//len=6+((pes[4]<<8)|pes[5]);
218 
219 	if (payload_start)
220 		buf[1]|=0x40;
221 	else
222 		buf[1]&=~0x40;
223 	while (len>=184) {
224 		buf[3]=0x10|((p2ts->cc++)&0x0f);
225 		memcpy(buf+4, pes, 184);
226 		if ((ret=p2ts->cb(p2ts->priv, buf)))
227 			return ret;
228 		len-=184; pes+=184;
229 		buf[1]&=~0x40;
230 	}
231 	if (!len)
232 		return 0;
233 	buf[3]=0x30|((p2ts->cc++)&0x0f);
234 	rest=183-len;
235 	if (rest) {
236 		buf[5]=0x00;
237 		if (rest-1)
238 			memset(buf+6, 0xff, rest-1);
239 	}
240 	buf[4]=rest;
241 	memcpy(buf+5+rest, pes, len);
242 	return p2ts->cb(p2ts->priv, buf);
243 }
244 
245 static void ttusb_dec_set_model(struct ttusb_dec *dec,
246 				enum ttusb_dec_model model);
247 
248 static void ttusb_dec_handle_irq( struct urb *urb)
249 {
250 	struct ttusb_dec *dec = urb->context;
251 	char *buffer = dec->irq_buffer;
252 	int retval;
253 	int index = buffer[4];
254 
255 	switch(urb->status) {
256 		case 0: /*success*/
257 			break;
258 		case -ECONNRESET:
259 		case -ENOENT:
260 		case -ESHUTDOWN:
261 		case -ETIME:
262 			/* this urb is dead, cleanup */
263 			dprintk("%s:urb shutting down with status: %d\n",
264 					__func__, urb->status);
265 			return;
266 		default:
267 			dprintk("%s:nonzero status received: %d\n",
268 					__func__,urb->status);
269 			goto exit;
270 	}
271 
272 	if ((buffer[0] == 0x1) && (buffer[2] == 0x15))  {
273 		/*
274 		 * IR - Event
275 		 *
276 		 * this is an fact a bit too simple implementation;
277 		 * the box also reports a keyrepeat signal
278 		 * (with buffer[3] == 0x40) in an interval of ~100ms.
279 		 * But to handle this correctly we had to imlemenent some
280 		 * kind of timer which signals a 'key up' event if no
281 		 * keyrepeat signal is received for lets say 200ms.
282 		 * this should/could be added later ...
283 		 * for now lets report each signal as a key down and up
284 		 */
285 		if (index - 1 < ARRAY_SIZE(rc_keys)) {
286 			dprintk("%s:rc signal:%d\n", __func__, index);
287 			input_report_key(dec->rc_input_dev, rc_keys[index - 1], 1);
288 			input_sync(dec->rc_input_dev);
289 			input_report_key(dec->rc_input_dev, rc_keys[index - 1], 0);
290 			input_sync(dec->rc_input_dev);
291 		}
292 	}
293 
294 exit:
295 	retval = usb_submit_urb(urb, GFP_ATOMIC);
296 	if (retval)
297 		printk("%s - usb_commit_urb failed with result: %d\n",
298 			__func__, retval);
299 }
300 
301 static u16 crc16(u16 crc, const u8 *buf, size_t len)
302 {
303 	u16 tmp;
304 
305 	while (len--) {
306 		crc ^= *buf++;
307 		crc ^= (u8)crc >> 4;
308 		tmp = (u8)crc;
309 		crc ^= (tmp ^ (tmp << 1)) << 4;
310 	}
311 	return crc;
312 }
313 
314 static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
315 				  int param_length, const u8 params[],
316 				  int *result_length, u8 cmd_result[])
317 {
318 	int result, actual_len;
319 	u8 *b;
320 
321 	dprintk("%s\n", __func__);
322 
323 	b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
324 	if (!b)
325 		return -ENOMEM;
326 
327 	result = mutex_lock_interruptible(&dec->usb_mutex);
328 	if (result) {
329 		printk("%s: Failed to lock usb mutex.\n", __func__);
330 		goto err_free;
331 	}
332 
333 	b[0] = 0xaa;
334 	b[1] = ++dec->trans_count;
335 	b[2] = command;
336 	b[3] = param_length;
337 
338 	if (params)
339 		memcpy(&b[4], params, param_length);
340 
341 	if (debug) {
342 		printk(KERN_DEBUG "%s: command: %*ph\n",
343 		       __func__, param_length, b);
344 	}
345 
346 	result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
347 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
348 
349 	if (result) {
350 		printk("%s: command bulk message failed: error %d\n",
351 		       __func__, result);
352 		goto err_mutex_unlock;
353 	}
354 
355 	result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
356 			      COMMAND_PACKET_SIZE + 4, &actual_len, 1000);
357 
358 	if (result) {
359 		printk("%s: result bulk message failed: error %d\n",
360 		       __func__, result);
361 		goto err_mutex_unlock;
362 	} else {
363 		if (debug) {
364 			printk(KERN_DEBUG "%s: result: %*ph\n",
365 			       __func__, actual_len, b);
366 		}
367 
368 		if (result_length)
369 			*result_length = b[3];
370 		if (cmd_result && b[3] > 0)
371 			memcpy(cmd_result, &b[4], b[3]);
372 	}
373 
374 err_mutex_unlock:
375 	mutex_unlock(&dec->usb_mutex);
376 err_free:
377 	kfree(b);
378 	return result;
379 }
380 
381 static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode,
382 				    unsigned int *model, unsigned int *version)
383 {
384 	u8 c[COMMAND_PACKET_SIZE];
385 	int c_length;
386 	int result;
387 	__be32 tmp;
388 
389 	dprintk("%s\n", __func__);
390 
391 	result = ttusb_dec_send_command(dec, 0x08, 0, NULL, &c_length, c);
392 	if (result)
393 		return result;
394 
395 	if (c_length >= 0x0c) {
396 		if (mode != NULL) {
397 			memcpy(&tmp, c, 4);
398 			*mode = ntohl(tmp);
399 		}
400 		if (model != NULL) {
401 			memcpy(&tmp, &c[4], 4);
402 			*model = ntohl(tmp);
403 		}
404 		if (version != NULL) {
405 			memcpy(&tmp, &c[8], 4);
406 			*version = ntohl(tmp);
407 		}
408 		return 0;
409 	} else {
410 		return -ENOENT;
411 	}
412 }
413 
414 static int ttusb_dec_audio_pes2ts_cb(void *priv, unsigned char *data)
415 {
416 	struct ttusb_dec *dec = priv;
417 
418 	dec->audio_filter->feed->cb.ts(data, 188, NULL, 0,
419 				       &dec->audio_filter->feed->feed.ts, NULL);
420 
421 	return 0;
422 }
423 
424 static int ttusb_dec_video_pes2ts_cb(void *priv, unsigned char *data)
425 {
426 	struct ttusb_dec *dec = priv;
427 
428 	dec->video_filter->feed->cb.ts(data, 188, NULL, 0,
429 				       &dec->video_filter->feed->feed.ts, NULL);
430 
431 	return 0;
432 }
433 
434 static void ttusb_dec_set_pids(struct ttusb_dec *dec)
435 {
436 	u8 b[] = { 0x00, 0x00, 0x00, 0x00,
437 		   0x00, 0x00, 0xff, 0xff,
438 		   0xff, 0xff, 0xff, 0xff };
439 
440 	__be16 pcr = htons(dec->pid[DMX_PES_PCR]);
441 	__be16 audio = htons(dec->pid[DMX_PES_AUDIO]);
442 	__be16 video = htons(dec->pid[DMX_PES_VIDEO]);
443 
444 	dprintk("%s\n", __func__);
445 
446 	memcpy(&b[0], &pcr, 2);
447 	memcpy(&b[2], &audio, 2);
448 	memcpy(&b[4], &video, 2);
449 
450 	ttusb_dec_send_command(dec, 0x50, sizeof(b), b, NULL, NULL);
451 
452 	dvb_filter_pes2ts_init(&dec->a_pes2ts, dec->pid[DMX_PES_AUDIO],
453 			       ttusb_dec_audio_pes2ts_cb, dec);
454 	dvb_filter_pes2ts_init(&dec->v_pes2ts, dec->pid[DMX_PES_VIDEO],
455 			       ttusb_dec_video_pes2ts_cb, dec);
456 	dec->v_pes_length = 0;
457 	dec->v_pes_postbytes = 0;
458 }
459 
460 static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
461 {
462 	if (length < 8) {
463 		printk("%s: packet too short - discarding\n", __func__);
464 		return;
465 	}
466 
467 	if (length > 8 + MAX_PVA_LENGTH) {
468 		printk("%s: packet too long - discarding\n", __func__);
469 		return;
470 	}
471 
472 	switch (pva[2]) {
473 
474 	case 0x01: {		/* VideoStream */
475 		int prebytes = pva[5] & 0x03;
476 		int postbytes = (pva[5] & 0x0c) >> 2;
477 		__be16 v_pes_payload_length;
478 
479 		if (output_pva) {
480 			dec->video_filter->feed->cb.ts(pva, length, NULL, 0,
481 				&dec->video_filter->feed->feed.ts, NULL);
482 			return;
483 		}
484 
485 		if (dec->v_pes_postbytes > 0 &&
486 		    dec->v_pes_postbytes == prebytes) {
487 			memcpy(&dec->v_pes[dec->v_pes_length],
488 			       &pva[12], prebytes);
489 
490 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
491 					  dec->v_pes_length + prebytes, 1);
492 		}
493 
494 		if (pva[5] & 0x10) {
495 			dec->v_pes[7] = 0x80;
496 			dec->v_pes[8] = 0x05;
497 
498 			dec->v_pes[9] = 0x21 | ((pva[8] & 0xc0) >> 5);
499 			dec->v_pes[10] = ((pva[8] & 0x3f) << 2) |
500 					 ((pva[9] & 0xc0) >> 6);
501 			dec->v_pes[11] = 0x01 |
502 					 ((pva[9] & 0x3f) << 2) |
503 					 ((pva[10] & 0x80) >> 6);
504 			dec->v_pes[12] = ((pva[10] & 0x7f) << 1) |
505 					 ((pva[11] & 0xc0) >> 7);
506 			dec->v_pes[13] = 0x01 | ((pva[11] & 0x7f) << 1);
507 
508 			memcpy(&dec->v_pes[14], &pva[12 + prebytes],
509 			       length - 12 - prebytes);
510 			dec->v_pes_length = 14 + length - 12 - prebytes;
511 		} else {
512 			dec->v_pes[7] = 0x00;
513 			dec->v_pes[8] = 0x00;
514 
515 			memcpy(&dec->v_pes[9], &pva[8], length - 8);
516 			dec->v_pes_length = 9 + length - 8;
517 		}
518 
519 		dec->v_pes_postbytes = postbytes;
520 
521 		if (dec->v_pes[9 + dec->v_pes[8]] == 0x00 &&
522 		    dec->v_pes[10 + dec->v_pes[8]] == 0x00 &&
523 		    dec->v_pes[11 + dec->v_pes[8]] == 0x01)
524 			dec->v_pes[6] = 0x84;
525 		else
526 			dec->v_pes[6] = 0x80;
527 
528 		v_pes_payload_length = htons(dec->v_pes_length - 6 +
529 					     postbytes);
530 		memcpy(&dec->v_pes[4], &v_pes_payload_length, 2);
531 
532 		if (postbytes == 0)
533 			dvb_filter_pes2ts(&dec->v_pes2ts, dec->v_pes,
534 					  dec->v_pes_length, 1);
535 
536 		break;
537 	}
538 
539 	case 0x02:		/* MainAudioStream */
540 		if (output_pva) {
541 			dec->audio_filter->feed->cb.ts(pva, length, NULL, 0,
542 				&dec->audio_filter->feed->feed.ts, NULL);
543 			return;
544 		}
545 
546 		dvb_filter_pes2ts(&dec->a_pes2ts, &pva[8], length - 8,
547 				  pva[5] & 0x10);
548 		break;
549 
550 	default:
551 		printk("%s: unknown PVA type: %02x.\n", __func__,
552 		       pva[2]);
553 		break;
554 	}
555 }
556 
557 static void ttusb_dec_process_filter(struct ttusb_dec *dec, u8 *packet,
558 				     int length)
559 {
560 	struct list_head *item;
561 	struct filter_info *finfo;
562 	struct dvb_demux_filter *filter = NULL;
563 	unsigned long flags;
564 	u8 sid;
565 
566 	sid = packet[1];
567 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
568 	for (item = dec->filter_info_list.next; item != &dec->filter_info_list;
569 	     item = item->next) {
570 		finfo = list_entry(item, struct filter_info, filter_info_list);
571 		if (finfo->stream_id == sid) {
572 			filter = finfo->filter;
573 			break;
574 		}
575 	}
576 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
577 
578 	if (filter)
579 		filter->feed->cb.sec(&packet[2], length - 2, NULL, 0,
580 				     &filter->filter, NULL);
581 }
582 
583 static void ttusb_dec_process_packet(struct ttusb_dec *dec)
584 {
585 	int i;
586 	u16 csum = 0;
587 	u16 packet_id;
588 
589 	if (dec->packet_length % 2) {
590 		printk("%s: odd sized packet - discarding\n", __func__);
591 		return;
592 	}
593 
594 	for (i = 0; i < dec->packet_length; i += 2)
595 		csum ^= ((dec->packet[i] << 8) + dec->packet[i + 1]);
596 
597 	if (csum) {
598 		printk("%s: checksum failed - discarding\n", __func__);
599 		return;
600 	}
601 
602 	packet_id = dec->packet[dec->packet_length - 4] << 8;
603 	packet_id += dec->packet[dec->packet_length - 3];
604 
605 	if ((packet_id != dec->next_packet_id) && dec->next_packet_id) {
606 		printk("%s: warning: lost packets between %u and %u\n",
607 		       __func__, dec->next_packet_id - 1, packet_id);
608 	}
609 
610 	if (packet_id == 0xffff)
611 		dec->next_packet_id = 0x8000;
612 	else
613 		dec->next_packet_id = packet_id + 1;
614 
615 	switch (dec->packet_type) {
616 	case TTUSB_DEC_PACKET_PVA:
617 		if (dec->pva_stream_count)
618 			ttusb_dec_process_pva(dec, dec->packet,
619 					      dec->packet_payload_length);
620 		break;
621 
622 	case TTUSB_DEC_PACKET_SECTION:
623 		if (dec->filter_stream_count)
624 			ttusb_dec_process_filter(dec, dec->packet,
625 						 dec->packet_payload_length);
626 		break;
627 
628 	case TTUSB_DEC_PACKET_EMPTY:
629 		break;
630 	}
631 }
632 
633 static void swap_bytes(u8 *b, int length)
634 {
635 	length -= length % 2;
636 	for (; length; b += 2, length -= 2)
637 		swap(*b, *(b + 1));
638 }
639 
640 static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,
641 					int length)
642 {
643 	swap_bytes(b, length);
644 
645 	while (length) {
646 		switch (dec->packet_state) {
647 
648 		case 0:
649 		case 1:
650 		case 2:
651 			if (*b++ == 0xaa)
652 				dec->packet_state++;
653 			else
654 				dec->packet_state = 0;
655 
656 			length--;
657 			break;
658 
659 		case 3:
660 			if (*b == 0x00) {
661 				dec->packet_state++;
662 				dec->packet_length = 0;
663 			} else if (*b != 0xaa) {
664 				dec->packet_state = 0;
665 			}
666 
667 			b++;
668 			length--;
669 			break;
670 
671 		case 4:
672 			dec->packet[dec->packet_length++] = *b++;
673 
674 			if (dec->packet_length == 2) {
675 				if (dec->packet[0] == 'A' &&
676 				    dec->packet[1] == 'V') {
677 					dec->packet_type =
678 						TTUSB_DEC_PACKET_PVA;
679 					dec->packet_state++;
680 				} else if (dec->packet[0] == 'S') {
681 					dec->packet_type =
682 						TTUSB_DEC_PACKET_SECTION;
683 					dec->packet_state++;
684 				} else if (dec->packet[0] == 0x00) {
685 					dec->packet_type =
686 						TTUSB_DEC_PACKET_EMPTY;
687 					dec->packet_payload_length = 2;
688 					dec->packet_state = 7;
689 				} else {
690 					printk("%s: unknown packet type: %02x%02x\n",
691 					       __func__,
692 					       dec->packet[0], dec->packet[1]);
693 					dec->packet_state = 0;
694 				}
695 			}
696 
697 			length--;
698 			break;
699 
700 		case 5:
701 			dec->packet[dec->packet_length++] = *b++;
702 
703 			if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
704 			    dec->packet_length == 8) {
705 				dec->packet_state++;
706 				dec->packet_payload_length = 8 +
707 					(dec->packet[6] << 8) +
708 					dec->packet[7];
709 			} else if (dec->packet_type ==
710 					TTUSB_DEC_PACKET_SECTION &&
711 				   dec->packet_length == 5) {
712 				dec->packet_state++;
713 				dec->packet_payload_length = 5 +
714 					((dec->packet[3] & 0x0f) << 8) +
715 					dec->packet[4];
716 			}
717 
718 			length--;
719 			break;
720 
721 		case 6: {
722 			int remainder = dec->packet_payload_length -
723 					dec->packet_length;
724 
725 			if (length >= remainder) {
726 				memcpy(dec->packet + dec->packet_length,
727 				       b, remainder);
728 				dec->packet_length += remainder;
729 				b += remainder;
730 				length -= remainder;
731 				dec->packet_state++;
732 			} else {
733 				memcpy(&dec->packet[dec->packet_length],
734 				       b, length);
735 				dec->packet_length += length;
736 				length = 0;
737 			}
738 
739 			break;
740 		}
741 
742 		case 7: {
743 			int tail = 4;
744 
745 			dec->packet[dec->packet_length++] = *b++;
746 
747 			if (dec->packet_type == TTUSB_DEC_PACKET_SECTION &&
748 			    dec->packet_payload_length % 2)
749 				tail++;
750 
751 			if (dec->packet_length ==
752 			    dec->packet_payload_length + tail) {
753 				ttusb_dec_process_packet(dec);
754 				dec->packet_state = 0;
755 			}
756 
757 			length--;
758 			break;
759 		}
760 
761 		default:
762 			printk("%s: illegal packet state encountered.\n",
763 			       __func__);
764 			dec->packet_state = 0;
765 		}
766 	}
767 }
768 
769 static void ttusb_dec_process_urb_frame_list(struct tasklet_struct *t)
770 {
771 	struct ttusb_dec *dec = from_tasklet(dec, t, urb_tasklet);
772 	struct list_head *item;
773 	struct urb_frame *frame;
774 	unsigned long flags;
775 
776 	while (1) {
777 		spin_lock_irqsave(&dec->urb_frame_list_lock, flags);
778 		if ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
779 			frame = list_entry(item, struct urb_frame,
780 					   urb_frame_list);
781 			list_del(&frame->urb_frame_list);
782 		} else {
783 			spin_unlock_irqrestore(&dec->urb_frame_list_lock,
784 					       flags);
785 			return;
786 		}
787 		spin_unlock_irqrestore(&dec->urb_frame_list_lock, flags);
788 
789 		ttusb_dec_process_urb_frame(dec, frame->data, frame->length);
790 		kfree(frame);
791 	}
792 }
793 
794 static void ttusb_dec_process_urb(struct urb *urb)
795 {
796 	struct ttusb_dec *dec = urb->context;
797 
798 	if (!urb->status) {
799 		int i;
800 
801 		for (i = 0; i < FRAMES_PER_ISO_BUF; i++) {
802 			struct usb_iso_packet_descriptor *d;
803 			u8 *b;
804 			int length;
805 			struct urb_frame *frame;
806 
807 			d = &urb->iso_frame_desc[i];
808 			b = urb->transfer_buffer + d->offset;
809 			length = d->actual_length;
810 
811 			if ((frame = kmalloc(sizeof(struct urb_frame),
812 					     GFP_ATOMIC))) {
813 				unsigned long flags;
814 
815 				memcpy(frame->data, b, length);
816 				frame->length = length;
817 
818 				spin_lock_irqsave(&dec->urb_frame_list_lock,
819 						     flags);
820 				list_add_tail(&frame->urb_frame_list,
821 					      &dec->urb_frame_list);
822 				spin_unlock_irqrestore(&dec->urb_frame_list_lock,
823 						       flags);
824 
825 				tasklet_schedule(&dec->urb_tasklet);
826 			}
827 		}
828 	} else {
829 		 /* -ENOENT is expected when unlinking urbs */
830 		if (urb->status != -ENOENT)
831 			dprintk("%s: urb error: %d\n", __func__,
832 				urb->status);
833 	}
834 
835 	if (dec->iso_stream_count)
836 		usb_submit_urb(urb, GFP_ATOMIC);
837 }
838 
839 static void ttusb_dec_setup_urbs(struct ttusb_dec *dec)
840 {
841 	int i, j, buffer_offset = 0;
842 
843 	dprintk("%s\n", __func__);
844 
845 	for (i = 0; i < ISO_BUF_COUNT; i++) {
846 		int frame_offset = 0;
847 		struct urb *urb = dec->iso_urb[i];
848 
849 		urb->dev = dec->udev;
850 		urb->context = dec;
851 		urb->complete = ttusb_dec_process_urb;
852 		urb->pipe = dec->in_pipe;
853 		urb->transfer_flags = URB_ISO_ASAP;
854 		urb->interval = 1;
855 		urb->number_of_packets = FRAMES_PER_ISO_BUF;
856 		urb->transfer_buffer_length = ISO_FRAME_SIZE *
857 					      FRAMES_PER_ISO_BUF;
858 		urb->transfer_buffer = dec->iso_buffer + buffer_offset;
859 		buffer_offset += ISO_FRAME_SIZE * FRAMES_PER_ISO_BUF;
860 
861 		for (j = 0; j < FRAMES_PER_ISO_BUF; j++) {
862 			urb->iso_frame_desc[j].offset = frame_offset;
863 			urb->iso_frame_desc[j].length = ISO_FRAME_SIZE;
864 			frame_offset += ISO_FRAME_SIZE;
865 		}
866 	}
867 }
868 
869 static void ttusb_dec_stop_iso_xfer(struct ttusb_dec *dec)
870 {
871 	int i;
872 
873 	dprintk("%s\n", __func__);
874 
875 	if (mutex_lock_interruptible(&dec->iso_mutex))
876 		return;
877 
878 	dec->iso_stream_count--;
879 
880 	if (!dec->iso_stream_count) {
881 		for (i = 0; i < ISO_BUF_COUNT; i++)
882 			usb_kill_urb(dec->iso_urb[i]);
883 	}
884 
885 	mutex_unlock(&dec->iso_mutex);
886 }
887 
888 /* Setting the interface of the DEC tends to take down the USB communications
889  * for a short period, so it's important not to call this function just before
890  * trying to talk to it.
891  */
892 static int ttusb_dec_set_interface(struct ttusb_dec *dec,
893 				   enum ttusb_dec_interface interface)
894 {
895 	int result = 0;
896 	u8 b[] = { 0x05 };
897 
898 	if (interface != dec->interface) {
899 		switch (interface) {
900 		case TTUSB_DEC_INTERFACE_INITIAL:
901 			result = usb_set_interface(dec->udev, 0, 0);
902 			break;
903 		case TTUSB_DEC_INTERFACE_IN:
904 			result = ttusb_dec_send_command(dec, 0x80, sizeof(b),
905 							b, NULL, NULL);
906 			if (result)
907 				return result;
908 			result = usb_set_interface(dec->udev, 0, 8);
909 			break;
910 		case TTUSB_DEC_INTERFACE_OUT:
911 			result = usb_set_interface(dec->udev, 0, 1);
912 			break;
913 		}
914 
915 		if (result)
916 			return result;
917 
918 		dec->interface = interface;
919 	}
920 
921 	return 0;
922 }
923 
924 static int ttusb_dec_start_iso_xfer(struct ttusb_dec *dec)
925 {
926 	int i, result;
927 
928 	dprintk("%s\n", __func__);
929 
930 	if (mutex_lock_interruptible(&dec->iso_mutex))
931 		return -EAGAIN;
932 
933 	if (!dec->iso_stream_count) {
934 		ttusb_dec_setup_urbs(dec);
935 
936 		dec->packet_state = 0;
937 		dec->v_pes_postbytes = 0;
938 		dec->next_packet_id = 0;
939 
940 		for (i = 0; i < ISO_BUF_COUNT; i++) {
941 			if ((result = usb_submit_urb(dec->iso_urb[i],
942 						     GFP_ATOMIC))) {
943 				printk("%s: failed urb submission %d: error %d\n",
944 				       __func__, i, result);
945 
946 				while (i) {
947 					usb_kill_urb(dec->iso_urb[i - 1]);
948 					i--;
949 				}
950 
951 				mutex_unlock(&dec->iso_mutex);
952 				return result;
953 			}
954 		}
955 	}
956 
957 	dec->iso_stream_count++;
958 
959 	mutex_unlock(&dec->iso_mutex);
960 
961 	return 0;
962 }
963 
964 static int ttusb_dec_start_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
965 {
966 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
967 	struct ttusb_dec *dec = dvbdmx->priv;
968 	u8 b0[] = { 0x05 };
969 	int result = 0;
970 
971 	dprintk("%s\n", __func__);
972 
973 	dprintk("  ts_type:");
974 
975 	if (dvbdmxfeed->ts_type & TS_DECODER)
976 		dprintk(" TS_DECODER");
977 
978 	if (dvbdmxfeed->ts_type & TS_PACKET)
979 		dprintk(" TS_PACKET");
980 
981 	if (dvbdmxfeed->ts_type & TS_PAYLOAD_ONLY)
982 		dprintk(" TS_PAYLOAD_ONLY");
983 
984 	dprintk("\n");
985 
986 	switch (dvbdmxfeed->pes_type) {
987 
988 	case DMX_PES_VIDEO:
989 		dprintk("  pes_type: DMX_PES_VIDEO\n");
990 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
991 		dec->pid[DMX_PES_VIDEO] = dvbdmxfeed->pid;
992 		dec->video_filter = dvbdmxfeed->filter;
993 		ttusb_dec_set_pids(dec);
994 		break;
995 
996 	case DMX_PES_AUDIO:
997 		dprintk("  pes_type: DMX_PES_AUDIO\n");
998 		dec->pid[DMX_PES_AUDIO] = dvbdmxfeed->pid;
999 		dec->audio_filter = dvbdmxfeed->filter;
1000 		ttusb_dec_set_pids(dec);
1001 		break;
1002 
1003 	case DMX_PES_TELETEXT:
1004 		dec->pid[DMX_PES_TELETEXT] = dvbdmxfeed->pid;
1005 		dprintk("  pes_type: DMX_PES_TELETEXT(not supported)\n");
1006 		return -ENOSYS;
1007 
1008 	case DMX_PES_PCR:
1009 		dprintk("  pes_type: DMX_PES_PCR\n");
1010 		dec->pid[DMX_PES_PCR] = dvbdmxfeed->pid;
1011 		ttusb_dec_set_pids(dec);
1012 		break;
1013 
1014 	case DMX_PES_OTHER:
1015 		dprintk("  pes_type: DMX_PES_OTHER(not supported)\n");
1016 		return -ENOSYS;
1017 
1018 	default:
1019 		dprintk("  pes_type: unknown (%d)\n", dvbdmxfeed->pes_type);
1020 		return -EINVAL;
1021 
1022 	}
1023 
1024 	result = ttusb_dec_send_command(dec, 0x80, sizeof(b0), b0, NULL, NULL);
1025 	if (result)
1026 		return result;
1027 
1028 	dec->pva_stream_count++;
1029 	return ttusb_dec_start_iso_xfer(dec);
1030 }
1031 
1032 static int ttusb_dec_start_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1033 {
1034 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1035 	u8 b0[] = { 0x00, 0x00, 0x00, 0x01,
1036 		    0x00, 0x00, 0x00, 0x00,
1037 		    0x00, 0x00, 0x00, 0x00,
1038 		    0x00, 0x00, 0x00, 0x00,
1039 		    0x00, 0xff, 0x00, 0x00,
1040 		    0x00, 0x00, 0x00, 0x00,
1041 		    0x00, 0x00, 0x00, 0x00,
1042 		    0x00 };
1043 	__be16 pid;
1044 	u8 c[COMMAND_PACKET_SIZE];
1045 	int c_length;
1046 	int result;
1047 	struct filter_info *finfo;
1048 	unsigned long flags;
1049 	u8 x = 1;
1050 
1051 	dprintk("%s\n", __func__);
1052 
1053 	pid = htons(dvbdmxfeed->pid);
1054 	memcpy(&b0[0], &pid, 2);
1055 	memcpy(&b0[4], &x, 1);
1056 	memcpy(&b0[5], &dvbdmxfeed->filter->filter.filter_value[0], 1);
1057 
1058 	result = ttusb_dec_send_command(dec, 0x60, sizeof(b0), b0,
1059 					&c_length, c);
1060 
1061 	if (!result) {
1062 		if (c_length == 2) {
1063 			if (!(finfo = kmalloc(sizeof(struct filter_info),
1064 					      GFP_ATOMIC)))
1065 				return -ENOMEM;
1066 
1067 			finfo->stream_id = c[1];
1068 			finfo->filter = dvbdmxfeed->filter;
1069 
1070 			spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1071 			list_add_tail(&finfo->filter_info_list,
1072 				      &dec->filter_info_list);
1073 			spin_unlock_irqrestore(&dec->filter_info_list_lock,
1074 					       flags);
1075 
1076 			dvbdmxfeed->priv = finfo;
1077 
1078 			dec->filter_stream_count++;
1079 			return ttusb_dec_start_iso_xfer(dec);
1080 		}
1081 
1082 		return -EAGAIN;
1083 	} else
1084 		return result;
1085 }
1086 
1087 static int ttusb_dec_start_feed(struct dvb_demux_feed *dvbdmxfeed)
1088 {
1089 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
1090 
1091 	dprintk("%s\n", __func__);
1092 
1093 	if (!dvbdmx->dmx.frontend)
1094 		return -EINVAL;
1095 
1096 	dprintk("  pid: 0x%04X\n", dvbdmxfeed->pid);
1097 
1098 	switch (dvbdmxfeed->type) {
1099 
1100 	case DMX_TYPE_TS:
1101 		return ttusb_dec_start_ts_feed(dvbdmxfeed);
1102 
1103 	case DMX_TYPE_SEC:
1104 		return ttusb_dec_start_sec_feed(dvbdmxfeed);
1105 
1106 	default:
1107 		dprintk("  type: unknown (%d)\n", dvbdmxfeed->type);
1108 		return -EINVAL;
1109 
1110 	}
1111 }
1112 
1113 static int ttusb_dec_stop_ts_feed(struct dvb_demux_feed *dvbdmxfeed)
1114 {
1115 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1116 	u8 b0[] = { 0x00 };
1117 
1118 	ttusb_dec_send_command(dec, 0x81, sizeof(b0), b0, NULL, NULL);
1119 
1120 	dec->pva_stream_count--;
1121 
1122 	ttusb_dec_stop_iso_xfer(dec);
1123 
1124 	return 0;
1125 }
1126 
1127 static int ttusb_dec_stop_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
1128 {
1129 	struct ttusb_dec *dec = dvbdmxfeed->demux->priv;
1130 	u8 b0[] = { 0x00, 0x00 };
1131 	struct filter_info *finfo = (struct filter_info *)dvbdmxfeed->priv;
1132 	unsigned long flags;
1133 
1134 	b0[1] = finfo->stream_id;
1135 	spin_lock_irqsave(&dec->filter_info_list_lock, flags);
1136 	list_del(&finfo->filter_info_list);
1137 	spin_unlock_irqrestore(&dec->filter_info_list_lock, flags);
1138 	kfree(finfo);
1139 	ttusb_dec_send_command(dec, 0x62, sizeof(b0), b0, NULL, NULL);
1140 
1141 	dec->filter_stream_count--;
1142 
1143 	ttusb_dec_stop_iso_xfer(dec);
1144 
1145 	return 0;
1146 }
1147 
1148 static int ttusb_dec_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
1149 {
1150 	dprintk("%s\n", __func__);
1151 
1152 	switch (dvbdmxfeed->type) {
1153 	case DMX_TYPE_TS:
1154 		return ttusb_dec_stop_ts_feed(dvbdmxfeed);
1155 
1156 	case DMX_TYPE_SEC:
1157 		return ttusb_dec_stop_sec_feed(dvbdmxfeed);
1158 	}
1159 
1160 	return 0;
1161 }
1162 
1163 static void ttusb_dec_free_iso_urbs(struct ttusb_dec *dec)
1164 {
1165 	int i;
1166 
1167 	dprintk("%s\n", __func__);
1168 
1169 	for (i = 0; i < ISO_BUF_COUNT; i++)
1170 		usb_free_urb(dec->iso_urb[i]);
1171 	kfree(dec->iso_buffer);
1172 }
1173 
1174 static int ttusb_dec_alloc_iso_urbs(struct ttusb_dec *dec)
1175 {
1176 	int i;
1177 
1178 	dprintk("%s\n", __func__);
1179 
1180 	dec->iso_buffer = kcalloc(FRAMES_PER_ISO_BUF * ISO_BUF_COUNT,
1181 			ISO_FRAME_SIZE, GFP_KERNEL);
1182 	if (!dec->iso_buffer)
1183 		return -ENOMEM;
1184 
1185 	for (i = 0; i < ISO_BUF_COUNT; i++) {
1186 		struct urb *urb;
1187 
1188 		if (!(urb = usb_alloc_urb(FRAMES_PER_ISO_BUF, GFP_ATOMIC))) {
1189 			ttusb_dec_free_iso_urbs(dec);
1190 			return -ENOMEM;
1191 		}
1192 
1193 		dec->iso_urb[i] = urb;
1194 	}
1195 
1196 	ttusb_dec_setup_urbs(dec);
1197 
1198 	return 0;
1199 }
1200 
1201 static void ttusb_dec_init_tasklet(struct ttusb_dec *dec)
1202 {
1203 	spin_lock_init(&dec->urb_frame_list_lock);
1204 	INIT_LIST_HEAD(&dec->urb_frame_list);
1205 	tasklet_setup(&dec->urb_tasklet, ttusb_dec_process_urb_frame_list);
1206 }
1207 
1208 static int ttusb_init_rc( struct ttusb_dec *dec)
1209 {
1210 	struct input_dev *input_dev;
1211 	u8 b[] = { 0x00, 0x01 };
1212 	int i;
1213 	int err;
1214 
1215 	usb_make_path(dec->udev, dec->rc_phys, sizeof(dec->rc_phys));
1216 	strlcat(dec->rc_phys, "/input0", sizeof(dec->rc_phys));
1217 
1218 	input_dev = input_allocate_device();
1219 	if (!input_dev)
1220 		return -ENOMEM;
1221 
1222 	input_dev->name = "ttusb_dec remote control";
1223 	input_dev->phys = dec->rc_phys;
1224 	input_dev->evbit[0] = BIT_MASK(EV_KEY);
1225 	input_dev->keycodesize = sizeof(u16);
1226 	input_dev->keycodemax = 0x1a;
1227 	input_dev->keycode = rc_keys;
1228 
1229 	for (i = 0; i < ARRAY_SIZE(rc_keys); i++)
1230 		  set_bit(rc_keys[i], input_dev->keybit);
1231 
1232 	err = input_register_device(input_dev);
1233 	if (err) {
1234 		input_free_device(input_dev);
1235 		return err;
1236 	}
1237 
1238 	dec->rc_input_dev = input_dev;
1239 	if (usb_submit_urb(dec->irq_urb, GFP_KERNEL))
1240 		printk("%s: usb_submit_urb failed\n",__func__);
1241 	/* enable irq pipe */
1242 	ttusb_dec_send_command(dec,0xb0,sizeof(b),b,NULL,NULL);
1243 
1244 	return 0;
1245 }
1246 
1247 static void ttusb_dec_init_v_pes(struct ttusb_dec *dec)
1248 {
1249 	dprintk("%s\n", __func__);
1250 
1251 	dec->v_pes[0] = 0x00;
1252 	dec->v_pes[1] = 0x00;
1253 	dec->v_pes[2] = 0x01;
1254 	dec->v_pes[3] = 0xe0;
1255 }
1256 
1257 static int ttusb_dec_init_usb(struct ttusb_dec *dec)
1258 {
1259 	int result;
1260 
1261 	dprintk("%s\n", __func__);
1262 
1263 	mutex_init(&dec->usb_mutex);
1264 	mutex_init(&dec->iso_mutex);
1265 
1266 	dec->command_pipe = usb_sndbulkpipe(dec->udev, COMMAND_PIPE);
1267 	dec->result_pipe = usb_rcvbulkpipe(dec->udev, RESULT_PIPE);
1268 	dec->in_pipe = usb_rcvisocpipe(dec->udev, IN_PIPE);
1269 	dec->out_pipe = usb_sndisocpipe(dec->udev, OUT_PIPE);
1270 	dec->irq_pipe = usb_rcvintpipe(dec->udev, IRQ_PIPE);
1271 
1272 	if(enable_rc) {
1273 		dec->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
1274 		if(!dec->irq_urb) {
1275 			return -ENOMEM;
1276 		}
1277 		dec->irq_buffer = usb_alloc_coherent(dec->udev,IRQ_PACKET_SIZE,
1278 					GFP_KERNEL, &dec->irq_dma_handle);
1279 		if(!dec->irq_buffer) {
1280 			usb_free_urb(dec->irq_urb);
1281 			return -ENOMEM;
1282 		}
1283 		usb_fill_int_urb(dec->irq_urb, dec->udev,dec->irq_pipe,
1284 				 dec->irq_buffer, IRQ_PACKET_SIZE,
1285 				 ttusb_dec_handle_irq, dec, 1);
1286 		dec->irq_urb->transfer_dma = dec->irq_dma_handle;
1287 		dec->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1288 	}
1289 
1290 	result = ttusb_dec_alloc_iso_urbs(dec);
1291 	if (result) {
1292 		usb_free_urb(dec->irq_urb);
1293 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1294 				  dec->irq_buffer, dec->irq_dma_handle);
1295 	}
1296 	return result;
1297 }
1298 
1299 static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
1300 {
1301 	int i, j, actual_len, result, size, trans_count;
1302 	u8 b0[] = { 0x00, 0x00, 0x00, 0x00,
1303 		    0x00, 0x00, 0x00, 0x00,
1304 		    0x61, 0x00 };
1305 	u8 b1[] = { 0x61 };
1306 	u8 *b;
1307 	char idstring[21];
1308 	const u8 *firmware = NULL;
1309 	size_t firmware_size = 0;
1310 	u16 firmware_csum = 0;
1311 	__be16 firmware_csum_ns;
1312 	__be32 firmware_size_nl;
1313 	u32 crc32_csum, crc32_check;
1314 	__be32 tmp;
1315 	const struct firmware *fw_entry = NULL;
1316 
1317 	dprintk("%s\n", __func__);
1318 
1319 	result = request_firmware(&fw_entry, dec->firmware_name, &dec->udev->dev);
1320 	if (result) {
1321 		printk(KERN_ERR "%s: Firmware (%s) unavailable.\n",
1322 		       __func__, dec->firmware_name);
1323 		return result;
1324 	}
1325 
1326 	firmware = fw_entry->data;
1327 	firmware_size = fw_entry->size;
1328 
1329 	if (firmware_size < 60) {
1330 		printk("%s: firmware size too small for DSP code (%zu < 60).\n",
1331 			__func__, firmware_size);
1332 		release_firmware(fw_entry);
1333 		return -ENOENT;
1334 	}
1335 
1336 	/* a 32 bit checksum over the first 56 bytes of the DSP Code is stored
1337 	   at offset 56 of file, so use it to check if the firmware file is
1338 	   valid. */
1339 	crc32_csum = crc32(~0L, firmware, 56) ^ ~0L;
1340 	memcpy(&tmp, &firmware[56], 4);
1341 	crc32_check = ntohl(tmp);
1342 	if (crc32_csum != crc32_check) {
1343 		printk("%s: crc32 check of DSP code failed (calculated 0x%08x != 0x%08x in file), file invalid.\n",
1344 			__func__, crc32_csum, crc32_check);
1345 		release_firmware(fw_entry);
1346 		return -ENOENT;
1347 	}
1348 	memcpy(idstring, &firmware[36], 20);
1349 	idstring[20] = '\0';
1350 	printk(KERN_INFO "ttusb_dec: found DSP code \"%s\".\n", idstring);
1351 
1352 	firmware_size_nl = htonl(firmware_size);
1353 	memcpy(b0, &firmware_size_nl, 4);
1354 	firmware_csum = crc16(~0, firmware, firmware_size) ^ ~0;
1355 	firmware_csum_ns = htons(firmware_csum);
1356 	memcpy(&b0[6], &firmware_csum_ns, 2);
1357 
1358 	result = ttusb_dec_send_command(dec, 0x41, sizeof(b0), b0, NULL, NULL);
1359 
1360 	if (result) {
1361 		release_firmware(fw_entry);
1362 		return result;
1363 	}
1364 
1365 	trans_count = 0;
1366 	j = 0;
1367 
1368 	b = kmalloc(ARM_PACKET_SIZE, GFP_KERNEL);
1369 	if (b == NULL) {
1370 		release_firmware(fw_entry);
1371 		return -ENOMEM;
1372 	}
1373 
1374 	for (i = 0; i < firmware_size; i += COMMAND_PACKET_SIZE) {
1375 		size = firmware_size - i;
1376 		if (size > COMMAND_PACKET_SIZE)
1377 			size = COMMAND_PACKET_SIZE;
1378 
1379 		b[j + 0] = 0xaa;
1380 		b[j + 1] = trans_count++;
1381 		b[j + 2] = 0xf0;
1382 		b[j + 3] = size;
1383 		memcpy(&b[j + 4], &firmware[i], size);
1384 
1385 		j += COMMAND_PACKET_SIZE + 4;
1386 
1387 		if (j >= ARM_PACKET_SIZE) {
1388 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1389 					      ARM_PACKET_SIZE, &actual_len,
1390 					      100);
1391 			j = 0;
1392 		} else if (size < COMMAND_PACKET_SIZE) {
1393 			result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
1394 					      j - COMMAND_PACKET_SIZE + size,
1395 					      &actual_len, 100);
1396 		}
1397 	}
1398 
1399 	result = ttusb_dec_send_command(dec, 0x43, sizeof(b1), b1, NULL, NULL);
1400 
1401 	release_firmware(fw_entry);
1402 	kfree(b);
1403 
1404 	return result;
1405 }
1406 
1407 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
1408 {
1409 	int result;
1410 	unsigned int mode = 0, model = 0, version = 0;
1411 
1412 	dprintk("%s\n", __func__);
1413 
1414 	result = ttusb_dec_get_stb_state(dec, &mode, &model, &version);
1415 	if (result)
1416 		return result;
1417 
1418 	if (!mode) {
1419 		if (version == 0xABCDEFAB)
1420 			printk(KERN_INFO "ttusb_dec: no version info in Firmware\n");
1421 		else
1422 			printk(KERN_INFO "ttusb_dec: Firmware %x.%02x%c%c\n",
1423 			       version >> 24, (version >> 16) & 0xff,
1424 			       (version >> 8) & 0xff, version & 0xff);
1425 
1426 		result = ttusb_dec_boot_dsp(dec);
1427 		if (result)
1428 			return result;
1429 	} else {
1430 		/* We can't trust the USB IDs that some firmwares
1431 		   give the box */
1432 		switch (model) {
1433 		case 0x00070001:
1434 		case 0x00070008:
1435 		case 0x0007000c:
1436 			ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1437 			break;
1438 		case 0x00070009:
1439 		case 0x00070013:
1440 			ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1441 			break;
1442 		case 0x00070011:
1443 			ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1444 			break;
1445 		default:
1446 			printk(KERN_ERR "%s: unknown model returned by firmware (%08x) - please report\n",
1447 			       __func__, model);
1448 			return -ENOENT;
1449 		}
1450 		if (version >= 0x01770000)
1451 			dec->can_playback = 1;
1452 	}
1453 	return 0;
1454 }
1455 
1456 static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
1457 {
1458 	int result;
1459 
1460 	dprintk("%s\n", __func__);
1461 
1462 	if ((result = dvb_register_adapter(&dec->adapter,
1463 					   dec->model_name, THIS_MODULE,
1464 					   &dec->udev->dev,
1465 					   adapter_nr)) < 0) {
1466 		printk("%s: dvb_register_adapter failed: error %d\n",
1467 		       __func__, result);
1468 
1469 		return result;
1470 	}
1471 
1472 	dec->demux.dmx.capabilities = DMX_TS_FILTERING | DMX_SECTION_FILTERING;
1473 
1474 	dec->demux.priv = (void *)dec;
1475 	dec->demux.filternum = 31;
1476 	dec->demux.feednum = 31;
1477 	dec->demux.start_feed = ttusb_dec_start_feed;
1478 	dec->demux.stop_feed = ttusb_dec_stop_feed;
1479 	dec->demux.write_to_decoder = NULL;
1480 
1481 	if ((result = dvb_dmx_init(&dec->demux)) < 0) {
1482 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1483 		       result);
1484 
1485 		dvb_unregister_adapter(&dec->adapter);
1486 
1487 		return result;
1488 	}
1489 
1490 	dec->dmxdev.filternum = 32;
1491 	dec->dmxdev.demux = &dec->demux.dmx;
1492 	dec->dmxdev.capabilities = 0;
1493 
1494 	if ((result = dvb_dmxdev_init(&dec->dmxdev, &dec->adapter)) < 0) {
1495 		printk("%s: dvb_dmxdev_init failed: error %d\n",
1496 		       __func__, result);
1497 
1498 		dvb_dmx_release(&dec->demux);
1499 		dvb_unregister_adapter(&dec->adapter);
1500 
1501 		return result;
1502 	}
1503 
1504 	dec->frontend.source = DMX_FRONTEND_0;
1505 
1506 	if ((result = dec->demux.dmx.add_frontend(&dec->demux.dmx,
1507 						  &dec->frontend)) < 0) {
1508 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1509 		       result);
1510 
1511 		dvb_dmxdev_release(&dec->dmxdev);
1512 		dvb_dmx_release(&dec->demux);
1513 		dvb_unregister_adapter(&dec->adapter);
1514 
1515 		return result;
1516 	}
1517 
1518 	if ((result = dec->demux.dmx.connect_frontend(&dec->demux.dmx,
1519 						      &dec->frontend)) < 0) {
1520 		printk("%s: dvb_dmx_init failed: error %d\n", __func__,
1521 		       result);
1522 
1523 		dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1524 		dvb_dmxdev_release(&dec->dmxdev);
1525 		dvb_dmx_release(&dec->demux);
1526 		dvb_unregister_adapter(&dec->adapter);
1527 
1528 		return result;
1529 	}
1530 
1531 	dvb_net_init(&dec->adapter, &dec->dvb_net, &dec->demux.dmx);
1532 
1533 	return 0;
1534 }
1535 
1536 static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
1537 {
1538 	dprintk("%s\n", __func__);
1539 
1540 	dvb_net_release(&dec->dvb_net);
1541 	dec->demux.dmx.close(&dec->demux.dmx);
1542 	dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
1543 	dvb_dmxdev_release(&dec->dmxdev);
1544 	dvb_dmx_release(&dec->demux);
1545 	if (dec->fe) {
1546 		dvb_unregister_frontend(dec->fe);
1547 		if (dec->fe->ops.release)
1548 			dec->fe->ops.release(dec->fe);
1549 	}
1550 	dvb_unregister_adapter(&dec->adapter);
1551 }
1552 
1553 static void ttusb_dec_exit_rc(struct ttusb_dec *dec)
1554 {
1555 	dprintk("%s\n", __func__);
1556 
1557 	if (dec->rc_input_dev) {
1558 		input_unregister_device(dec->rc_input_dev);
1559 		dec->rc_input_dev = NULL;
1560 	}
1561 }
1562 
1563 
1564 static void ttusb_dec_exit_usb(struct ttusb_dec *dec)
1565 {
1566 	int i;
1567 
1568 	dprintk("%s\n", __func__);
1569 
1570 	if (enable_rc) {
1571 		/* we have to check whether the irq URB is already submitted.
1572 		 * As the irq is submitted after the interface is changed,
1573 		 * this is the best method i figured out.
1574 		 * Any others?*/
1575 		if (dec->interface == TTUSB_DEC_INTERFACE_IN)
1576 			usb_kill_urb(dec->irq_urb);
1577 
1578 		usb_free_urb(dec->irq_urb);
1579 
1580 		usb_free_coherent(dec->udev, IRQ_PACKET_SIZE,
1581 				  dec->irq_buffer, dec->irq_dma_handle);
1582 	}
1583 
1584 	dec->iso_stream_count = 0;
1585 
1586 	for (i = 0; i < ISO_BUF_COUNT; i++)
1587 		usb_kill_urb(dec->iso_urb[i]);
1588 
1589 	ttusb_dec_free_iso_urbs(dec);
1590 }
1591 
1592 static void ttusb_dec_exit_tasklet(struct ttusb_dec *dec)
1593 {
1594 	struct list_head *item;
1595 	struct urb_frame *frame;
1596 
1597 	tasklet_kill(&dec->urb_tasklet);
1598 
1599 	while ((item = dec->urb_frame_list.next) != &dec->urb_frame_list) {
1600 		frame = list_entry(item, struct urb_frame, urb_frame_list);
1601 		list_del(&frame->urb_frame_list);
1602 		kfree(frame);
1603 	}
1604 }
1605 
1606 static void ttusb_dec_init_filters(struct ttusb_dec *dec)
1607 {
1608 	INIT_LIST_HEAD(&dec->filter_info_list);
1609 	spin_lock_init(&dec->filter_info_list_lock);
1610 }
1611 
1612 static void ttusb_dec_exit_filters(struct ttusb_dec *dec)
1613 {
1614 	struct list_head *item;
1615 	struct filter_info *finfo;
1616 
1617 	while ((item = dec->filter_info_list.next) != &dec->filter_info_list) {
1618 		finfo = list_entry(item, struct filter_info, filter_info_list);
1619 		list_del(&finfo->filter_info_list);
1620 		kfree(finfo);
1621 	}
1622 }
1623 
1624 static int fe_send_command(struct dvb_frontend* fe, const u8 command,
1625 			   int param_length, const u8 params[],
1626 			   int *result_length, u8 cmd_result[])
1627 {
1628 	struct ttusb_dec* dec = fe->dvb->priv;
1629 	return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
1630 }
1631 
1632 static const struct ttusbdecfe_config fe_config = {
1633 	.send_command = fe_send_command
1634 };
1635 
1636 static int ttusb_dec_probe(struct usb_interface *intf,
1637 			   const struct usb_device_id *id)
1638 {
1639 	struct usb_device *udev;
1640 	struct ttusb_dec *dec;
1641 	int result;
1642 
1643 	dprintk("%s\n", __func__);
1644 
1645 	udev = interface_to_usbdev(intf);
1646 
1647 	if (!(dec = kzalloc(sizeof(struct ttusb_dec), GFP_KERNEL))) {
1648 		printk("%s: couldn't allocate memory.\n", __func__);
1649 		return -ENOMEM;
1650 	}
1651 
1652 	usb_set_intfdata(intf, (void *)dec);
1653 
1654 	switch (id->idProduct) {
1655 	case 0x1006:
1656 		ttusb_dec_set_model(dec, TTUSB_DEC3000S);
1657 		break;
1658 
1659 	case 0x1008:
1660 		ttusb_dec_set_model(dec, TTUSB_DEC2000T);
1661 		break;
1662 
1663 	case 0x1009:
1664 		ttusb_dec_set_model(dec, TTUSB_DEC2540T);
1665 		break;
1666 	}
1667 
1668 	dec->udev = udev;
1669 
1670 	result = ttusb_dec_init_usb(dec);
1671 	if (result)
1672 		goto err_usb;
1673 	result = ttusb_dec_init_stb(dec);
1674 	if (result)
1675 		goto err_stb;
1676 	result = ttusb_dec_init_dvb(dec);
1677 	if (result)
1678 		goto err_stb;
1679 
1680 	dec->adapter.priv = dec;
1681 	switch (id->idProduct) {
1682 	case 0x1006:
1683 		dec->fe = ttusbdecfe_dvbs_attach(&fe_config);
1684 		break;
1685 
1686 	case 0x1008:
1687 	case 0x1009:
1688 		dec->fe = ttusbdecfe_dvbt_attach(&fe_config);
1689 		break;
1690 	}
1691 
1692 	if (dec->fe == NULL) {
1693 		printk("dvb-ttusb-dec: A frontend driver was not found for device [%04x:%04x]\n",
1694 		       le16_to_cpu(dec->udev->descriptor.idVendor),
1695 		       le16_to_cpu(dec->udev->descriptor.idProduct));
1696 	} else {
1697 		if (dvb_register_frontend(&dec->adapter, dec->fe)) {
1698 			printk("budget-ci: Frontend registration failed!\n");
1699 			if (dec->fe->ops.release)
1700 				dec->fe->ops.release(dec->fe);
1701 			dec->fe = NULL;
1702 		}
1703 	}
1704 
1705 	ttusb_dec_init_v_pes(dec);
1706 	ttusb_dec_init_filters(dec);
1707 	ttusb_dec_init_tasklet(dec);
1708 
1709 	dec->active = 1;
1710 
1711 	ttusb_dec_set_interface(dec, TTUSB_DEC_INTERFACE_IN);
1712 
1713 	if (enable_rc)
1714 		ttusb_init_rc(dec);
1715 
1716 	return 0;
1717 err_stb:
1718 	ttusb_dec_exit_usb(dec);
1719 err_usb:
1720 	kfree(dec);
1721 	return result;
1722 }
1723 
1724 static void ttusb_dec_disconnect(struct usb_interface *intf)
1725 {
1726 	struct ttusb_dec *dec = usb_get_intfdata(intf);
1727 
1728 	usb_set_intfdata(intf, NULL);
1729 
1730 	dprintk("%s\n", __func__);
1731 
1732 	if (dec->active) {
1733 		ttusb_dec_exit_tasklet(dec);
1734 		ttusb_dec_exit_filters(dec);
1735 		if(enable_rc)
1736 			ttusb_dec_exit_rc(dec);
1737 		ttusb_dec_exit_usb(dec);
1738 		ttusb_dec_exit_dvb(dec);
1739 	}
1740 
1741 	kfree(dec);
1742 }
1743 
1744 static void ttusb_dec_set_model(struct ttusb_dec *dec,
1745 				enum ttusb_dec_model model)
1746 {
1747 	dec->model = model;
1748 
1749 	switch (model) {
1750 	case TTUSB_DEC2000T:
1751 		dec->model_name = "DEC2000-t";
1752 		dec->firmware_name = "dvb-ttusb-dec-2000t.fw";
1753 		break;
1754 
1755 	case TTUSB_DEC2540T:
1756 		dec->model_name = "DEC2540-t";
1757 		dec->firmware_name = "dvb-ttusb-dec-2540t.fw";
1758 		break;
1759 
1760 	case TTUSB_DEC3000S:
1761 		dec->model_name = "DEC3000-s";
1762 		dec->firmware_name = "dvb-ttusb-dec-3000s.fw";
1763 		break;
1764 	}
1765 }
1766 
1767 static const struct usb_device_id ttusb_dec_table[] = {
1768 	{USB_DEVICE(0x0b48, 0x1006)},	/* DEC3000-s */
1769 	/*{USB_DEVICE(0x0b48, 0x1007)},	   Unconfirmed */
1770 	{USB_DEVICE(0x0b48, 0x1008)},	/* DEC2000-t */
1771 	{USB_DEVICE(0x0b48, 0x1009)},	/* DEC2540-t */
1772 	{}
1773 };
1774 
1775 static struct usb_driver ttusb_dec_driver = {
1776 	.name		= "ttusb-dec",
1777 	.probe		= ttusb_dec_probe,
1778 	.disconnect	= ttusb_dec_disconnect,
1779 	.id_table	= ttusb_dec_table,
1780 };
1781 
1782 module_usb_driver(ttusb_dec_driver);
1783 
1784 MODULE_AUTHOR("Alex Woods <linux-dvb@giblets.org>");
1785 MODULE_DESCRIPTION(DRIVER_NAME);
1786 MODULE_LICENSE("GPL");
1787 MODULE_DEVICE_TABLE(usb, ttusb_dec_table);
1788