cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

af9035.c (56992B)


      1// SPDX-License-Identifier: GPL-2.0-or-later
      2/*
      3 * Afatech AF9035 DVB USB driver
      4 *
      5 * Copyright (C) 2009 Antti Palosaari <crope@iki.fi>
      6 * Copyright (C) 2012 Antti Palosaari <crope@iki.fi>
      7 */
      8
      9#include "af9035.h"
     10
     11/* Max transfer size done by I2C transfer functions */
     12#define MAX_XFER_SIZE  64
     13
     14DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
     15
     16static u16 af9035_checksum(const u8 *buf, size_t len)
     17{
     18	size_t i;
     19	u16 checksum = 0;
     20
     21	for (i = 1; i < len; i++) {
     22		if (i % 2)
     23			checksum += buf[i] << 8;
     24		else
     25			checksum += buf[i];
     26	}
     27	checksum = ~checksum;
     28
     29	return checksum;
     30}
     31
     32static int af9035_ctrl_msg(struct dvb_usb_device *d, struct usb_req *req)
     33{
     34#define REQ_HDR_LEN 4 /* send header size */
     35#define ACK_HDR_LEN 3 /* rece header size */
     36#define CHECKSUM_LEN 2
     37#define USB_TIMEOUT 2000
     38	struct state *state = d_to_priv(d);
     39	struct usb_interface *intf = d->intf;
     40	int ret, wlen, rlen;
     41	u16 checksum, tmp_checksum;
     42
     43	mutex_lock(&d->usb_mutex);
     44
     45	/* buffer overflow check */
     46	if (req->wlen > (BUF_LEN - REQ_HDR_LEN - CHECKSUM_LEN) ||
     47			req->rlen > (BUF_LEN - ACK_HDR_LEN - CHECKSUM_LEN)) {
     48		dev_err(&intf->dev, "too much data wlen=%d rlen=%d\n",
     49			req->wlen, req->rlen);
     50		ret = -EINVAL;
     51		goto exit;
     52	}
     53
     54	state->buf[0] = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN - 1;
     55	state->buf[1] = req->mbox;
     56	state->buf[2] = req->cmd;
     57	state->buf[3] = state->seq++;
     58	memcpy(&state->buf[REQ_HDR_LEN], req->wbuf, req->wlen);
     59
     60	wlen = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN;
     61	rlen = ACK_HDR_LEN + req->rlen + CHECKSUM_LEN;
     62
     63	/* calc and add checksum */
     64	checksum = af9035_checksum(state->buf, state->buf[0] - 1);
     65	state->buf[state->buf[0] - 1] = (checksum >> 8);
     66	state->buf[state->buf[0] - 0] = (checksum & 0xff);
     67
     68	/* no ack for these packets */
     69	if (req->cmd == CMD_FW_DL)
     70		rlen = 0;
     71
     72	ret = dvb_usbv2_generic_rw_locked(d,
     73			state->buf, wlen, state->buf, rlen);
     74	if (ret)
     75		goto exit;
     76
     77	/* no ack for those packets */
     78	if (req->cmd == CMD_FW_DL)
     79		goto exit;
     80
     81	/* verify checksum */
     82	checksum = af9035_checksum(state->buf, rlen - 2);
     83	tmp_checksum = (state->buf[rlen - 2] << 8) | state->buf[rlen - 1];
     84	if (tmp_checksum != checksum) {
     85		dev_err(&intf->dev, "command=%02x checksum mismatch (%04x != %04x)\n",
     86			req->cmd, tmp_checksum, checksum);
     87		ret = -EIO;
     88		goto exit;
     89	}
     90
     91	/* check status */
     92	if (state->buf[2]) {
     93		/* fw returns status 1 when IR code was not received */
     94		if (req->cmd == CMD_IR_GET || state->buf[2] == 1) {
     95			ret = 1;
     96			goto exit;
     97		}
     98
     99		dev_dbg(&intf->dev, "command=%02x failed fw error=%d\n",
    100			req->cmd, state->buf[2]);
    101		ret = -EIO;
    102		goto exit;
    103	}
    104
    105	/* read request, copy returned data to return buf */
    106	if (req->rlen)
    107		memcpy(req->rbuf, &state->buf[ACK_HDR_LEN], req->rlen);
    108exit:
    109	mutex_unlock(&d->usb_mutex);
    110	return ret;
    111}
    112
    113/* write multiple registers */
    114static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
    115{
    116	struct usb_interface *intf = d->intf;
    117	u8 wbuf[MAX_XFER_SIZE];
    118	u8 mbox = (reg >> 16) & 0xff;
    119	struct usb_req req = { CMD_MEM_WR, mbox, 6 + len, wbuf, 0, NULL };
    120
    121	if (6 + len > sizeof(wbuf)) {
    122		dev_warn(&intf->dev, "i2c wr: len=%d is too big!\n", len);
    123		return -EOPNOTSUPP;
    124	}
    125
    126	wbuf[0] = len;
    127	wbuf[1] = 2;
    128	wbuf[2] = 0;
    129	wbuf[3] = 0;
    130	wbuf[4] = (reg >> 8) & 0xff;
    131	wbuf[5] = (reg >> 0) & 0xff;
    132	memcpy(&wbuf[6], val, len);
    133
    134	return af9035_ctrl_msg(d, &req);
    135}
    136
    137/* read multiple registers */
    138static int af9035_rd_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
    139{
    140	u8 wbuf[] = { len, 2, 0, 0, (reg >> 8) & 0xff, reg & 0xff };
    141	u8 mbox = (reg >> 16) & 0xff;
    142	struct usb_req req = { CMD_MEM_RD, mbox, sizeof(wbuf), wbuf, len, val };
    143
    144	return af9035_ctrl_msg(d, &req);
    145}
    146
    147/* write single register */
    148static int af9035_wr_reg(struct dvb_usb_device *d, u32 reg, u8 val)
    149{
    150	return af9035_wr_regs(d, reg, &val, 1);
    151}
    152
    153/* read single register */
    154static int af9035_rd_reg(struct dvb_usb_device *d, u32 reg, u8 *val)
    155{
    156	return af9035_rd_regs(d, reg, val, 1);
    157}
    158
    159/* write single register with mask */
    160static int af9035_wr_reg_mask(struct dvb_usb_device *d, u32 reg, u8 val,
    161		u8 mask)
    162{
    163	int ret;
    164	u8 tmp;
    165
    166	/* no need for read if whole reg is written */
    167	if (mask != 0xff) {
    168		ret = af9035_rd_regs(d, reg, &tmp, 1);
    169		if (ret)
    170			return ret;
    171
    172		val &= mask;
    173		tmp &= ~mask;
    174		val |= tmp;
    175	}
    176
    177	return af9035_wr_regs(d, reg, &val, 1);
    178}
    179
    180static int af9035_add_i2c_dev(struct dvb_usb_device *d, const char *type,
    181		u8 addr, void *platform_data, struct i2c_adapter *adapter)
    182{
    183	int ret, num;
    184	struct state *state = d_to_priv(d);
    185	struct usb_interface *intf = d->intf;
    186	struct i2c_client *client;
    187	struct i2c_board_info board_info = {
    188		.addr = addr,
    189		.platform_data = platform_data,
    190	};
    191
    192	strscpy(board_info.type, type, I2C_NAME_SIZE);
    193
    194	/* find first free client */
    195	for (num = 0; num < AF9035_I2C_CLIENT_MAX; num++) {
    196		if (state->i2c_client[num] == NULL)
    197			break;
    198	}
    199
    200	dev_dbg(&intf->dev, "num=%d\n", num);
    201
    202	if (num == AF9035_I2C_CLIENT_MAX) {
    203		dev_err(&intf->dev, "I2C client out of index\n");
    204		ret = -ENODEV;
    205		goto err;
    206	}
    207
    208	request_module("%s", board_info.type);
    209
    210	/* register I2C device */
    211	client = i2c_new_client_device(adapter, &board_info);
    212	if (!i2c_client_has_driver(client)) {
    213		dev_err(&intf->dev, "failed to bind i2c device to %s driver\n", type);
    214		ret = -ENODEV;
    215		goto err;
    216	}
    217
    218	/* increase I2C driver usage count */
    219	if (!try_module_get(client->dev.driver->owner)) {
    220		i2c_unregister_device(client);
    221		ret = -ENODEV;
    222		goto err;
    223	}
    224
    225	state->i2c_client[num] = client;
    226	return 0;
    227err:
    228	dev_dbg(&intf->dev, "failed=%d\n", ret);
    229	return ret;
    230}
    231
    232static void af9035_del_i2c_dev(struct dvb_usb_device *d)
    233{
    234	int num;
    235	struct state *state = d_to_priv(d);
    236	struct usb_interface *intf = d->intf;
    237	struct i2c_client *client;
    238
    239	/* find last used client */
    240	num = AF9035_I2C_CLIENT_MAX;
    241	while (num--) {
    242		if (state->i2c_client[num] != NULL)
    243			break;
    244	}
    245
    246	dev_dbg(&intf->dev, "num=%d\n", num);
    247
    248	if (num == -1) {
    249		dev_err(&intf->dev, "I2C client out of index\n");
    250		goto err;
    251	}
    252
    253	client = state->i2c_client[num];
    254
    255	/* decrease I2C driver usage count */
    256	module_put(client->dev.driver->owner);
    257
    258	/* unregister I2C device */
    259	i2c_unregister_device(client);
    260
    261	state->i2c_client[num] = NULL;
    262	return;
    263err:
    264	dev_dbg(&intf->dev, "failed\n");
    265}
    266
    267static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
    268		struct i2c_msg msg[], int num)
    269{
    270	struct dvb_usb_device *d = i2c_get_adapdata(adap);
    271	struct state *state = d_to_priv(d);
    272	int ret;
    273
    274	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
    275		return -EAGAIN;
    276
    277	/*
    278	 * AF9035 I2C sub header is 5 bytes long. Meaning of those bytes are:
    279	 * 0: data len
    280	 * 1: I2C addr << 1
    281	 * 2: reg addr len
    282	 *    byte 3 and 4 can be used as reg addr
    283	 * 3: reg addr MSB
    284	 *    used when reg addr len is set to 2
    285	 * 4: reg addr LSB
    286	 *    used when reg addr len is set to 1 or 2
    287	 *
    288	 * For the simplify we do not use register addr at all.
    289	 * NOTE: As a firmware knows tuner type there is very small possibility
    290	 * there could be some tuner I2C hacks done by firmware and this may
    291	 * lead problems if firmware expects those bytes are used.
    292	 *
    293	 * TODO: Here is few hacks. AF9035 chip integrates AF9033 demodulator.
    294	 * IT9135 chip integrates AF9033 demodulator and RF tuner. For dual
    295	 * tuner devices, there is also external AF9033 demodulator connected
    296	 * via external I2C bus. All AF9033 demod I2C traffic, both single and
    297	 * dual tuner configuration, is covered by firmware - actual USB IO
    298	 * looks just like a memory access.
    299	 * In case of IT913x chip, there is own tuner driver. It is implemented
    300	 * currently as a I2C driver, even tuner IP block is likely build
    301	 * directly into the demodulator memory space and there is no own I2C
    302	 * bus. I2C subsystem does not allow register multiple devices to same
    303	 * bus, having same slave address. Due to that we reuse demod address,
    304	 * shifted by one bit, on that case.
    305	 *
    306	 * For IT930x we use a different command and the sub header is
    307	 * different as well:
    308	 * 0: data len
    309	 * 1: I2C bus (0x03 seems to be only value used)
    310	 * 2: I2C addr << 1
    311	 */
    312#define AF9035_IS_I2C_XFER_WRITE_READ(_msg, _num) \
    313	(_num == 2 && !(_msg[0].flags & I2C_M_RD) && (_msg[1].flags & I2C_M_RD))
    314#define AF9035_IS_I2C_XFER_WRITE(_msg, _num) \
    315	(_num == 1 && !(_msg[0].flags & I2C_M_RD))
    316#define AF9035_IS_I2C_XFER_READ(_msg, _num) \
    317	(_num == 1 && (_msg[0].flags & I2C_M_RD))
    318
    319	if (AF9035_IS_I2C_XFER_WRITE_READ(msg, num)) {
    320		if (msg[0].len > 40 || msg[1].len > 40) {
    321			/* TODO: correct limits > 40 */
    322			ret = -EOPNOTSUPP;
    323		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
    324			   (msg[0].addr == state->af9033_i2c_addr[1])) {
    325			/* demod access via firmware interface */
    326			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
    327					msg[0].buf[2];
    328
    329			if (msg[0].addr == state->af9033_i2c_addr[1])
    330				reg |= 0x100000;
    331
    332			ret = af9035_rd_regs(d, reg, &msg[1].buf[0],
    333					msg[1].len);
    334		} else if (state->no_read) {
    335			memset(msg[1].buf, 0, msg[1].len);
    336			ret = 0;
    337		} else {
    338			/* I2C write + read */
    339			u8 buf[MAX_XFER_SIZE];
    340			struct usb_req req = { CMD_I2C_RD, 0, 5 + msg[0].len,
    341					buf, msg[1].len, msg[1].buf };
    342
    343			if (state->chip_type == 0x9306) {
    344				req.cmd = CMD_GENERIC_I2C_RD;
    345				req.wlen = 3 + msg[0].len;
    346			}
    347			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
    348
    349			buf[0] = msg[1].len;
    350			if (state->chip_type == 0x9306) {
    351				buf[1] = 0x03; /* I2C bus */
    352				buf[2] = msg[0].addr << 1;
    353				memcpy(&buf[3], msg[0].buf, msg[0].len);
    354			} else {
    355				buf[1] = msg[0].addr << 1;
    356				buf[3] = 0x00; /* reg addr MSB */
    357				buf[4] = 0x00; /* reg addr LSB */
    358
    359				/* Keep prev behavior for write req len > 2*/
    360				if (msg[0].len > 2) {
    361					buf[2] = 0x00; /* reg addr len */
    362					memcpy(&buf[5], msg[0].buf, msg[0].len);
    363
    364				/* Use reg addr fields if write req len <= 2 */
    365				} else {
    366					req.wlen = 5;
    367					buf[2] = msg[0].len;
    368					if (msg[0].len == 2) {
    369						buf[3] = msg[0].buf[0];
    370						buf[4] = msg[0].buf[1];
    371					} else if (msg[0].len == 1) {
    372						buf[4] = msg[0].buf[0];
    373					}
    374				}
    375			}
    376			ret = af9035_ctrl_msg(d, &req);
    377		}
    378	} else if (AF9035_IS_I2C_XFER_WRITE(msg, num)) {
    379		if (msg[0].len > 40) {
    380			/* TODO: correct limits > 40 */
    381			ret = -EOPNOTSUPP;
    382		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
    383			   (msg[0].addr == state->af9033_i2c_addr[1])) {
    384			/* demod access via firmware interface */
    385			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
    386					msg[0].buf[2];
    387
    388			if (msg[0].addr == state->af9033_i2c_addr[1])
    389				reg |= 0x100000;
    390
    391			ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,
    392							         &msg[0].buf[3],
    393							         msg[0].len - 3)
    394					        : -EOPNOTSUPP;
    395		} else {
    396			/* I2C write */
    397			u8 buf[MAX_XFER_SIZE];
    398			struct usb_req req = { CMD_I2C_WR, 0, 5 + msg[0].len,
    399					buf, 0, NULL };
    400
    401			if (state->chip_type == 0x9306) {
    402				req.cmd = CMD_GENERIC_I2C_WR;
    403				req.wlen = 3 + msg[0].len;
    404			}
    405
    406			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
    407			buf[0] = msg[0].len;
    408			if (state->chip_type == 0x9306) {
    409				buf[1] = 0x03; /* I2C bus */
    410				buf[2] = msg[0].addr << 1;
    411				memcpy(&buf[3], msg[0].buf, msg[0].len);
    412			} else {
    413				buf[1] = msg[0].addr << 1;
    414				buf[2] = 0x00; /* reg addr len */
    415				buf[3] = 0x00; /* reg addr MSB */
    416				buf[4] = 0x00; /* reg addr LSB */
    417				memcpy(&buf[5], msg[0].buf, msg[0].len);
    418			}
    419			ret = af9035_ctrl_msg(d, &req);
    420		}
    421	} else if (AF9035_IS_I2C_XFER_READ(msg, num)) {
    422		if (msg[0].len > 40) {
    423			/* TODO: correct limits > 40 */
    424			ret = -EOPNOTSUPP;
    425		} else if (state->no_read) {
    426			memset(msg[0].buf, 0, msg[0].len);
    427			ret = 0;
    428		} else {
    429			/* I2C read */
    430			u8 buf[5];
    431			struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
    432						buf, msg[0].len, msg[0].buf };
    433
    434			if (state->chip_type == 0x9306) {
    435				req.cmd = CMD_GENERIC_I2C_RD;
    436				req.wlen = 3;
    437			}
    438			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
    439			buf[0] = msg[0].len;
    440			if (state->chip_type == 0x9306) {
    441				buf[1] = 0x03; /* I2C bus */
    442				buf[2] = msg[0].addr << 1;
    443			} else {
    444				buf[1] = msg[0].addr << 1;
    445				buf[2] = 0x00; /* reg addr len */
    446				buf[3] = 0x00; /* reg addr MSB */
    447				buf[4] = 0x00; /* reg addr LSB */
    448			}
    449			ret = af9035_ctrl_msg(d, &req);
    450		}
    451	} else {
    452		/*
    453		 * We support only three kind of I2C transactions:
    454		 * 1) 1 x write + 1 x read (repeated start)
    455		 * 2) 1 x write
    456		 * 3) 1 x read
    457		 */
    458		ret = -EOPNOTSUPP;
    459	}
    460
    461	mutex_unlock(&d->i2c_mutex);
    462
    463	if (ret < 0)
    464		return ret;
    465	else
    466		return num;
    467}
    468
    469static u32 af9035_i2c_functionality(struct i2c_adapter *adapter)
    470{
    471	return I2C_FUNC_I2C;
    472}
    473
    474static struct i2c_algorithm af9035_i2c_algo = {
    475	.master_xfer = af9035_i2c_master_xfer,
    476	.functionality = af9035_i2c_functionality,
    477};
    478
    479static int af9035_identify_state(struct dvb_usb_device *d, const char **name)
    480{
    481	struct state *state = d_to_priv(d);
    482	struct usb_interface *intf = d->intf;
    483	int ret, i, ts_mode_invalid;
    484	unsigned int utmp, eeprom_addr;
    485	u8 tmp;
    486	u8 wbuf[1] = { 1 };
    487	u8 rbuf[4];
    488	struct usb_req req = { CMD_FW_QUERYINFO, 0, sizeof(wbuf), wbuf,
    489			sizeof(rbuf), rbuf };
    490
    491	ret = af9035_rd_regs(d, 0x1222, rbuf, 3);
    492	if (ret < 0)
    493		goto err;
    494
    495	state->chip_version = rbuf[0];
    496	state->chip_type = rbuf[2] << 8 | rbuf[1] << 0;
    497
    498	ret = af9035_rd_reg(d, 0x384f, &state->prechip_version);
    499	if (ret < 0)
    500		goto err;
    501
    502	dev_info(&intf->dev, "prechip_version=%02x chip_version=%02x chip_type=%04x\n",
    503		 state->prechip_version, state->chip_version, state->chip_type);
    504
    505	if (state->chip_type == 0x9135) {
    506		if (state->chip_version == 0x02) {
    507			*name = AF9035_FIRMWARE_IT9135_V2;
    508			utmp = 0x00461d;
    509		} else {
    510			*name = AF9035_FIRMWARE_IT9135_V1;
    511			utmp = 0x00461b;
    512		}
    513
    514		/* Check if eeprom exists */
    515		ret = af9035_rd_reg(d, utmp, &tmp);
    516		if (ret < 0)
    517			goto err;
    518
    519		if (tmp == 0x00) {
    520			dev_dbg(&intf->dev, "no eeprom\n");
    521			state->no_eeprom = true;
    522			goto check_firmware_status;
    523		}
    524
    525		eeprom_addr = EEPROM_BASE_IT9135;
    526	} else if (state->chip_type == 0x9306) {
    527		*name = AF9035_FIRMWARE_IT9303;
    528		state->no_eeprom = true;
    529		goto check_firmware_status;
    530	} else {
    531		*name = AF9035_FIRMWARE_AF9035;
    532		eeprom_addr = EEPROM_BASE_AF9035;
    533	}
    534
    535	/* Read and store eeprom */
    536	for (i = 0; i < 256; i += 32) {
    537		ret = af9035_rd_regs(d, eeprom_addr + i, &state->eeprom[i], 32);
    538		if (ret < 0)
    539			goto err;
    540	}
    541
    542	dev_dbg(&intf->dev, "eeprom dump:\n");
    543	for (i = 0; i < 256; i += 16)
    544		dev_dbg(&intf->dev, "%*ph\n", 16, &state->eeprom[i]);
    545
    546	/* check for dual tuner mode */
    547	tmp = state->eeprom[EEPROM_TS_MODE];
    548	ts_mode_invalid = 0;
    549	switch (tmp) {
    550	case 0:
    551		break;
    552	case 1:
    553	case 3:
    554		state->dual_mode = true;
    555		break;
    556	case 5:
    557		if (state->chip_type != 0x9135 && state->chip_type != 0x9306)
    558			state->dual_mode = true;	/* AF9035 */
    559		else
    560			ts_mode_invalid = 1;
    561		break;
    562	default:
    563		ts_mode_invalid = 1;
    564	}
    565
    566	dev_dbg(&intf->dev, "ts mode=%d dual mode=%d\n", tmp, state->dual_mode);
    567
    568	if (ts_mode_invalid)
    569		dev_info(&intf->dev, "ts mode=%d not supported, defaulting to single tuner mode!", tmp);
    570
    571check_firmware_status:
    572	ret = af9035_ctrl_msg(d, &req);
    573	if (ret < 0)
    574		goto err;
    575
    576	dev_dbg(&intf->dev, "reply=%*ph\n", 4, rbuf);
    577	if (rbuf[0] || rbuf[1] || rbuf[2] || rbuf[3])
    578		ret = WARM;
    579	else
    580		ret = COLD;
    581
    582	return ret;
    583
    584err:
    585	dev_dbg(&intf->dev, "failed=%d\n", ret);
    586
    587	return ret;
    588}
    589
    590static int af9035_download_firmware_old(struct dvb_usb_device *d,
    591		const struct firmware *fw)
    592{
    593	struct usb_interface *intf = d->intf;
    594	int ret, i, j, len;
    595	u8 wbuf[1];
    596	struct usb_req req = { 0, 0, 0, NULL, 0, NULL };
    597	struct usb_req req_fw_dl = { CMD_FW_DL, 0, 0, wbuf, 0, NULL };
    598	u8 hdr_core;
    599	u16 hdr_addr, hdr_data_len, hdr_checksum;
    600	#define MAX_DATA 58
    601	#define HDR_SIZE 7
    602
    603	/*
    604	 * Thanks to Daniel Glöckner <daniel-gl@gmx.net> about that info!
    605	 *
    606	 * byte 0: MCS 51 core
    607	 *  There are two inside the AF9035 (1=Link and 2=OFDM) with separate
    608	 *  address spaces
    609	 * byte 1-2: Big endian destination address
    610	 * byte 3-4: Big endian number of data bytes following the header
    611	 * byte 5-6: Big endian header checksum, apparently ignored by the chip
    612	 *  Calculated as ~(h[0]*256+h[1]+h[2]*256+h[3]+h[4]*256)
    613	 */
    614
    615	for (i = fw->size; i > HDR_SIZE;) {
    616		hdr_core = fw->data[fw->size - i + 0];
    617		hdr_addr = fw->data[fw->size - i + 1] << 8;
    618		hdr_addr |= fw->data[fw->size - i + 2] << 0;
    619		hdr_data_len = fw->data[fw->size - i + 3] << 8;
    620		hdr_data_len |= fw->data[fw->size - i + 4] << 0;
    621		hdr_checksum = fw->data[fw->size - i + 5] << 8;
    622		hdr_checksum |= fw->data[fw->size - i + 6] << 0;
    623
    624		dev_dbg(&intf->dev, "core=%d addr=%04x data_len=%d checksum=%04x\n",
    625			hdr_core, hdr_addr, hdr_data_len, hdr_checksum);
    626
    627		if (((hdr_core != 1) && (hdr_core != 2)) ||
    628				(hdr_data_len > i)) {
    629			dev_dbg(&intf->dev, "bad firmware\n");
    630			break;
    631		}
    632
    633		/* download begin packet */
    634		req.cmd = CMD_FW_DL_BEGIN;
    635		ret = af9035_ctrl_msg(d, &req);
    636		if (ret < 0)
    637			goto err;
    638
    639		/* download firmware packet(s) */
    640		for (j = HDR_SIZE + hdr_data_len; j > 0; j -= MAX_DATA) {
    641			len = j;
    642			if (len > MAX_DATA)
    643				len = MAX_DATA;
    644			req_fw_dl.wlen = len;
    645			req_fw_dl.wbuf = (u8 *) &fw->data[fw->size - i +
    646					HDR_SIZE + hdr_data_len - j];
    647			ret = af9035_ctrl_msg(d, &req_fw_dl);
    648			if (ret < 0)
    649				goto err;
    650		}
    651
    652		/* download end packet */
    653		req.cmd = CMD_FW_DL_END;
    654		ret = af9035_ctrl_msg(d, &req);
    655		if (ret < 0)
    656			goto err;
    657
    658		i -= hdr_data_len + HDR_SIZE;
    659
    660		dev_dbg(&intf->dev, "data uploaded=%zu\n", fw->size - i);
    661	}
    662
    663	/* print warn if firmware is bad, continue and see what happens */
    664	if (i)
    665		dev_warn(&intf->dev, "bad firmware\n");
    666
    667	return 0;
    668
    669err:
    670	dev_dbg(&intf->dev, "failed=%d\n", ret);
    671
    672	return ret;
    673}
    674
    675static int af9035_download_firmware_new(struct dvb_usb_device *d,
    676		const struct firmware *fw)
    677{
    678	struct usb_interface *intf = d->intf;
    679	int ret, i, i_prev;
    680	struct usb_req req_fw_dl = { CMD_FW_SCATTER_WR, 0, 0, NULL, 0, NULL };
    681	#define HDR_SIZE 7
    682
    683	/*
    684	 * There seems to be following firmware header. Meaning of bytes 0-3
    685	 * is unknown.
    686	 *
    687	 * 0: 3
    688	 * 1: 0, 1
    689	 * 2: 0
    690	 * 3: 1, 2, 3
    691	 * 4: addr MSB
    692	 * 5: addr LSB
    693	 * 6: count of data bytes ?
    694	 */
    695	for (i = HDR_SIZE, i_prev = 0; i <= fw->size; i++) {
    696		if (i == fw->size ||
    697				(fw->data[i + 0] == 0x03 &&
    698				(fw->data[i + 1] == 0x00 ||
    699				fw->data[i + 1] == 0x01) &&
    700				fw->data[i + 2] == 0x00)) {
    701			req_fw_dl.wlen = i - i_prev;
    702			req_fw_dl.wbuf = (u8 *) &fw->data[i_prev];
    703			i_prev = i;
    704			ret = af9035_ctrl_msg(d, &req_fw_dl);
    705			if (ret < 0)
    706				goto err;
    707
    708			dev_dbg(&intf->dev, "data uploaded=%d\n", i);
    709		}
    710	}
    711
    712	return 0;
    713
    714err:
    715	dev_dbg(&intf->dev, "failed=%d\n", ret);
    716
    717	return ret;
    718}
    719
    720static int af9035_download_firmware(struct dvb_usb_device *d,
    721		const struct firmware *fw)
    722{
    723	struct usb_interface *intf = d->intf;
    724	struct state *state = d_to_priv(d);
    725	int ret;
    726	u8 wbuf[1];
    727	u8 rbuf[4];
    728	u8 tmp;
    729	struct usb_req req = { 0, 0, 0, NULL, 0, NULL };
    730	struct usb_req req_fw_ver = { CMD_FW_QUERYINFO, 0, 1, wbuf, 4, rbuf };
    731
    732	dev_dbg(&intf->dev, "\n");
    733
    734	/*
    735	 * In case of dual tuner configuration we need to do some extra
    736	 * initialization in order to download firmware to slave demod too,
    737	 * which is done by master demod.
    738	 * Master feeds also clock and controls power via GPIO.
    739	 */
    740	if (state->dual_mode) {
    741		/* configure gpioh1, reset & power slave demod */
    742		ret = af9035_wr_reg_mask(d, 0x00d8b0, 0x01, 0x01);
    743		if (ret < 0)
    744			goto err;
    745
    746		ret = af9035_wr_reg_mask(d, 0x00d8b1, 0x01, 0x01);
    747		if (ret < 0)
    748			goto err;
    749
    750		ret = af9035_wr_reg_mask(d, 0x00d8af, 0x00, 0x01);
    751		if (ret < 0)
    752			goto err;
    753
    754		usleep_range(10000, 50000);
    755
    756		ret = af9035_wr_reg_mask(d, 0x00d8af, 0x01, 0x01);
    757		if (ret < 0)
    758			goto err;
    759
    760		/* tell the slave I2C address */
    761		tmp = state->eeprom[EEPROM_2ND_DEMOD_ADDR];
    762
    763		/* Use default I2C address if eeprom has no address set */
    764		if (!tmp)
    765			tmp = 0x1d << 1; /* 8-bit format used by chip */
    766
    767		if ((state->chip_type == 0x9135) ||
    768				(state->chip_type == 0x9306)) {
    769			ret = af9035_wr_reg(d, 0x004bfb, tmp);
    770			if (ret < 0)
    771				goto err;
    772		} else {
    773			ret = af9035_wr_reg(d, 0x00417f, tmp);
    774			if (ret < 0)
    775				goto err;
    776
    777			/* enable clock out */
    778			ret = af9035_wr_reg_mask(d, 0x00d81a, 0x01, 0x01);
    779			if (ret < 0)
    780				goto err;
    781		}
    782	}
    783
    784	if (fw->data[0] == 0x01)
    785		ret = af9035_download_firmware_old(d, fw);
    786	else
    787		ret = af9035_download_firmware_new(d, fw);
    788	if (ret < 0)
    789		goto err;
    790
    791	/* firmware loaded, request boot */
    792	req.cmd = CMD_FW_BOOT;
    793	ret = af9035_ctrl_msg(d, &req);
    794	if (ret < 0)
    795		goto err;
    796
    797	/* ensure firmware starts */
    798	wbuf[0] = 1;
    799	ret = af9035_ctrl_msg(d, &req_fw_ver);
    800	if (ret < 0)
    801		goto err;
    802
    803	if (!(rbuf[0] || rbuf[1] || rbuf[2] || rbuf[3])) {
    804		dev_err(&intf->dev, "firmware did not run\n");
    805		ret = -ENODEV;
    806		goto err;
    807	}
    808
    809	dev_info(&intf->dev, "firmware version=%d.%d.%d.%d",
    810		 rbuf[0], rbuf[1], rbuf[2], rbuf[3]);
    811
    812	return 0;
    813
    814err:
    815	dev_dbg(&intf->dev, "failed=%d\n", ret);
    816
    817	return ret;
    818}
    819
    820static int af9035_read_config(struct dvb_usb_device *d)
    821{
    822	struct usb_interface *intf = d->intf;
    823	struct state *state = d_to_priv(d);
    824	int ret, i;
    825	u8 tmp;
    826	u16 tmp16;
    827
    828	/* Demod I2C address */
    829	state->af9033_i2c_addr[0] = 0x1c;
    830	state->af9033_i2c_addr[1] = 0x1d;
    831	state->af9033_config[0].adc_multiplier = AF9033_ADC_MULTIPLIER_2X;
    832	state->af9033_config[1].adc_multiplier = AF9033_ADC_MULTIPLIER_2X;
    833	state->af9033_config[0].ts_mode = AF9033_TS_MODE_USB;
    834	state->af9033_config[1].ts_mode = AF9033_TS_MODE_SERIAL;
    835	state->it930x_addresses = 0;
    836
    837	if (state->chip_type == 0x9135) {
    838		/* feed clock for integrated RF tuner */
    839		state->af9033_config[0].dyn0_clk = true;
    840		state->af9033_config[1].dyn0_clk = true;
    841
    842		if (state->chip_version == 0x02) {
    843			state->af9033_config[0].tuner = AF9033_TUNER_IT9135_60;
    844			state->af9033_config[1].tuner = AF9033_TUNER_IT9135_60;
    845		} else {
    846			state->af9033_config[0].tuner = AF9033_TUNER_IT9135_38;
    847			state->af9033_config[1].tuner = AF9033_TUNER_IT9135_38;
    848		}
    849
    850		if (state->no_eeprom) {
    851			/* Remote controller to NEC polling by default */
    852			state->ir_mode = 0x05;
    853			state->ir_type = 0x00;
    854
    855			goto skip_eeprom;
    856		}
    857	} else if (state->chip_type == 0x9306) {
    858		/*
    859		 * IT930x is an USB bridge, only single demod-single tuner
    860		 * configurations seen so far.
    861		 */
    862		if ((le16_to_cpu(d->udev->descriptor.idVendor) == USB_VID_AVERMEDIA) &&
    863		    (le16_to_cpu(d->udev->descriptor.idProduct) == USB_PID_AVERMEDIA_TD310)) {
    864			state->it930x_addresses = 1;
    865		}
    866		return 0;
    867	}
    868
    869	/* Remote controller */
    870	state->ir_mode = state->eeprom[EEPROM_IR_MODE];
    871	state->ir_type = state->eeprom[EEPROM_IR_TYPE];
    872
    873	if (state->dual_mode) {
    874		/* Read 2nd demodulator I2C address. 8-bit format on eeprom */
    875		tmp = state->eeprom[EEPROM_2ND_DEMOD_ADDR];
    876		if (tmp)
    877			state->af9033_i2c_addr[1] = tmp >> 1;
    878
    879		dev_dbg(&intf->dev, "2nd demod I2C addr=%02x\n",
    880			state->af9033_i2c_addr[1]);
    881	}
    882
    883	for (i = 0; i < state->dual_mode + 1; i++) {
    884		unsigned int eeprom_offset = 0;
    885
    886		/* tuner */
    887		tmp = state->eeprom[EEPROM_1_TUNER_ID + eeprom_offset];
    888		dev_dbg(&intf->dev, "[%d]tuner=%02x\n", i, tmp);
    889
    890		/* tuner sanity check */
    891		if (state->chip_type == 0x9135) {
    892			if (state->chip_version == 0x02) {
    893				/* IT9135 BX (v2) */
    894				switch (tmp) {
    895				case AF9033_TUNER_IT9135_60:
    896				case AF9033_TUNER_IT9135_61:
    897				case AF9033_TUNER_IT9135_62:
    898					state->af9033_config[i].tuner = tmp;
    899					break;
    900				}
    901			} else {
    902				/* IT9135 AX (v1) */
    903				switch (tmp) {
    904				case AF9033_TUNER_IT9135_38:
    905				case AF9033_TUNER_IT9135_51:
    906				case AF9033_TUNER_IT9135_52:
    907					state->af9033_config[i].tuner = tmp;
    908					break;
    909				}
    910			}
    911		} else {
    912			/* AF9035 */
    913			state->af9033_config[i].tuner = tmp;
    914		}
    915
    916		if (state->af9033_config[i].tuner != tmp) {
    917			dev_info(&intf->dev, "[%d] overriding tuner from %02x to %02x\n",
    918				 i, tmp, state->af9033_config[i].tuner);
    919		}
    920
    921		switch (state->af9033_config[i].tuner) {
    922		case AF9033_TUNER_TUA9001:
    923		case AF9033_TUNER_FC0011:
    924		case AF9033_TUNER_MXL5007T:
    925		case AF9033_TUNER_TDA18218:
    926		case AF9033_TUNER_FC2580:
    927		case AF9033_TUNER_FC0012:
    928			state->af9033_config[i].spec_inv = 1;
    929			break;
    930		case AF9033_TUNER_IT9135_38:
    931		case AF9033_TUNER_IT9135_51:
    932		case AF9033_TUNER_IT9135_52:
    933		case AF9033_TUNER_IT9135_60:
    934		case AF9033_TUNER_IT9135_61:
    935		case AF9033_TUNER_IT9135_62:
    936			break;
    937		default:
    938			dev_warn(&intf->dev, "tuner id=%02x not supported, please report!",
    939				 tmp);
    940		}
    941
    942		/* disable dual mode if driver does not support it */
    943		if (i == 1)
    944			switch (state->af9033_config[i].tuner) {
    945			case AF9033_TUNER_FC0012:
    946			case AF9033_TUNER_IT9135_38:
    947			case AF9033_TUNER_IT9135_51:
    948			case AF9033_TUNER_IT9135_52:
    949			case AF9033_TUNER_IT9135_60:
    950			case AF9033_TUNER_IT9135_61:
    951			case AF9033_TUNER_IT9135_62:
    952			case AF9033_TUNER_MXL5007T:
    953				break;
    954			default:
    955				state->dual_mode = false;
    956				dev_info(&intf->dev, "driver does not support 2nd tuner and will disable it");
    957		}
    958
    959		/* tuner IF frequency */
    960		tmp = state->eeprom[EEPROM_1_IF_L + eeprom_offset];
    961		tmp16 = tmp << 0;
    962		tmp = state->eeprom[EEPROM_1_IF_H + eeprom_offset];
    963		tmp16 |= tmp << 8;
    964		dev_dbg(&intf->dev, "[%d]IF=%d\n", i, tmp16);
    965
    966		eeprom_offset += 0x10; /* shift for the 2nd tuner params */
    967	}
    968
    969skip_eeprom:
    970	/* get demod clock */
    971	ret = af9035_rd_reg(d, 0x00d800, &tmp);
    972	if (ret < 0)
    973		goto err;
    974
    975	tmp = (tmp >> 0) & 0x0f;
    976
    977	for (i = 0; i < ARRAY_SIZE(state->af9033_config); i++) {
    978		if (state->chip_type == 0x9135)
    979			state->af9033_config[i].clock = clock_lut_it9135[tmp];
    980		else
    981			state->af9033_config[i].clock = clock_lut_af9035[tmp];
    982	}
    983
    984	state->no_read = false;
    985	/* Some MXL5007T devices cannot properly handle tuner I2C read ops. */
    986	if (state->af9033_config[0].tuner == AF9033_TUNER_MXL5007T &&
    987		le16_to_cpu(d->udev->descriptor.idVendor) == USB_VID_AVERMEDIA)
    988
    989		switch (le16_to_cpu(d->udev->descriptor.idProduct)) {
    990		case USB_PID_AVERMEDIA_A867:
    991		case USB_PID_AVERMEDIA_TWINSTAR:
    992			dev_info(&intf->dev,
    993				 "Device may have issues with I2C read operations. Enabling fix.\n");
    994			state->no_read = true;
    995			break;
    996		}
    997
    998	return 0;
    999
   1000err:
   1001	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1002
   1003	return ret;
   1004}
   1005
   1006static int af9035_tua9001_tuner_callback(struct dvb_usb_device *d,
   1007		int cmd, int arg)
   1008{
   1009	struct usb_interface *intf = d->intf;
   1010	int ret;
   1011	u8 val;
   1012
   1013	dev_dbg(&intf->dev, "cmd=%d arg=%d\n", cmd, arg);
   1014
   1015	/*
   1016	 * CEN     always enabled by hardware wiring
   1017	 * RESETN  GPIOT3
   1018	 * RXEN    GPIOT2
   1019	 */
   1020
   1021	switch (cmd) {
   1022	case TUA9001_CMD_RESETN:
   1023		if (arg)
   1024			val = 0x00;
   1025		else
   1026			val = 0x01;
   1027
   1028		ret = af9035_wr_reg_mask(d, 0x00d8e7, val, 0x01);
   1029		if (ret < 0)
   1030			goto err;
   1031		break;
   1032	case TUA9001_CMD_RXEN:
   1033		if (arg)
   1034			val = 0x01;
   1035		else
   1036			val = 0x00;
   1037
   1038		ret = af9035_wr_reg_mask(d, 0x00d8eb, val, 0x01);
   1039		if (ret < 0)
   1040			goto err;
   1041		break;
   1042	}
   1043
   1044	return 0;
   1045
   1046err:
   1047	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1048
   1049	return ret;
   1050}
   1051
   1052
   1053static int af9035_fc0011_tuner_callback(struct dvb_usb_device *d,
   1054		int cmd, int arg)
   1055{
   1056	struct usb_interface *intf = d->intf;
   1057	int ret;
   1058
   1059	switch (cmd) {
   1060	case FC0011_FE_CALLBACK_POWER:
   1061		/* Tuner enable */
   1062		ret = af9035_wr_reg_mask(d, 0xd8eb, 1, 1);
   1063		if (ret < 0)
   1064			goto err;
   1065
   1066		ret = af9035_wr_reg_mask(d, 0xd8ec, 1, 1);
   1067		if (ret < 0)
   1068			goto err;
   1069
   1070		ret = af9035_wr_reg_mask(d, 0xd8ed, 1, 1);
   1071		if (ret < 0)
   1072			goto err;
   1073
   1074		/* LED */
   1075		ret = af9035_wr_reg_mask(d, 0xd8d0, 1, 1);
   1076		if (ret < 0)
   1077			goto err;
   1078
   1079		ret = af9035_wr_reg_mask(d, 0xd8d1, 1, 1);
   1080		if (ret < 0)
   1081			goto err;
   1082
   1083		usleep_range(10000, 50000);
   1084		break;
   1085	case FC0011_FE_CALLBACK_RESET:
   1086		ret = af9035_wr_reg(d, 0xd8e9, 1);
   1087		if (ret < 0)
   1088			goto err;
   1089
   1090		ret = af9035_wr_reg(d, 0xd8e8, 1);
   1091		if (ret < 0)
   1092			goto err;
   1093
   1094		ret = af9035_wr_reg(d, 0xd8e7, 1);
   1095		if (ret < 0)
   1096			goto err;
   1097
   1098		usleep_range(10000, 20000);
   1099
   1100		ret = af9035_wr_reg(d, 0xd8e7, 0);
   1101		if (ret < 0)
   1102			goto err;
   1103
   1104		usleep_range(10000, 20000);
   1105		break;
   1106	default:
   1107		ret = -EINVAL;
   1108		goto err;
   1109	}
   1110
   1111	return 0;
   1112
   1113err:
   1114	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1115
   1116	return ret;
   1117}
   1118
   1119static int af9035_tuner_callback(struct dvb_usb_device *d, int cmd, int arg)
   1120{
   1121	struct state *state = d_to_priv(d);
   1122
   1123	switch (state->af9033_config[0].tuner) {
   1124	case AF9033_TUNER_FC0011:
   1125		return af9035_fc0011_tuner_callback(d, cmd, arg);
   1126	case AF9033_TUNER_TUA9001:
   1127		return af9035_tua9001_tuner_callback(d, cmd, arg);
   1128	default:
   1129		break;
   1130	}
   1131
   1132	return 0;
   1133}
   1134
   1135static int af9035_frontend_callback(void *adapter_priv, int component,
   1136				    int cmd, int arg)
   1137{
   1138	struct i2c_adapter *adap = adapter_priv;
   1139	struct dvb_usb_device *d = i2c_get_adapdata(adap);
   1140	struct usb_interface *intf = d->intf;
   1141
   1142	dev_dbg(&intf->dev, "component=%d cmd=%d arg=%d\n",
   1143		component, cmd, arg);
   1144
   1145	switch (component) {
   1146	case DVB_FRONTEND_COMPONENT_TUNER:
   1147		return af9035_tuner_callback(d, cmd, arg);
   1148	default:
   1149		break;
   1150	}
   1151
   1152	return 0;
   1153}
   1154
   1155static int af9035_get_adapter_count(struct dvb_usb_device *d)
   1156{
   1157	struct state *state = d_to_priv(d);
   1158
   1159	return state->dual_mode + 1;
   1160}
   1161
   1162static int af9035_frontend_attach(struct dvb_usb_adapter *adap)
   1163{
   1164	struct state *state = adap_to_priv(adap);
   1165	struct dvb_usb_device *d = adap_to_d(adap);
   1166	struct usb_interface *intf = d->intf;
   1167	int ret;
   1168
   1169	dev_dbg(&intf->dev, "adap->id=%d\n", adap->id);
   1170
   1171	if (!state->af9033_config[adap->id].tuner) {
   1172		/* unsupported tuner */
   1173		ret = -ENODEV;
   1174		goto err;
   1175	}
   1176
   1177	state->af9033_config[adap->id].fe = &adap->fe[0];
   1178	state->af9033_config[adap->id].ops = &state->ops;
   1179	ret = af9035_add_i2c_dev(d, "af9033", state->af9033_i2c_addr[adap->id],
   1180			&state->af9033_config[adap->id], &d->i2c_adap);
   1181	if (ret)
   1182		goto err;
   1183
   1184	if (adap->fe[0] == NULL) {
   1185		ret = -ENODEV;
   1186		goto err;
   1187	}
   1188
   1189	/* disable I2C-gate */
   1190	adap->fe[0]->ops.i2c_gate_ctrl = NULL;
   1191	adap->fe[0]->callback = af9035_frontend_callback;
   1192
   1193	return 0;
   1194
   1195err:
   1196	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1197
   1198	return ret;
   1199}
   1200
   1201/*
   1202 * The I2C speed register is calculated with:
   1203 *	I2C speed register = (1000000000 / (24.4 * 16 * I2C_speed))
   1204 *
   1205 * The default speed register for it930x is 7, with means a
   1206 * speed of ~366 kbps
   1207 */
   1208#define I2C_SPEED_366K 7
   1209
   1210static int it930x_frontend_attach(struct dvb_usb_adapter *adap)
   1211{
   1212	struct state *state = adap_to_priv(adap);
   1213	struct dvb_usb_device *d = adap_to_d(adap);
   1214	struct usb_interface *intf = d->intf;
   1215	int ret;
   1216	struct si2168_config si2168_config;
   1217	struct i2c_adapter *adapter;
   1218
   1219	dev_dbg(&intf->dev, "adap->id=%d\n", adap->id);
   1220
   1221	/* I2C master bus 2 clock speed 366k */
   1222	ret = af9035_wr_reg(d, 0x00f6a7, I2C_SPEED_366K);
   1223	if (ret < 0)
   1224		goto err;
   1225
   1226	/* I2C master bus 1,3 clock speed 366k */
   1227	ret = af9035_wr_reg(d, 0x00f103, I2C_SPEED_366K);
   1228	if (ret < 0)
   1229		goto err;
   1230
   1231	/* set gpio11 low */
   1232	ret = af9035_wr_reg_mask(d, 0xd8d4, 0x01, 0x01);
   1233	if (ret < 0)
   1234		goto err;
   1235
   1236	ret = af9035_wr_reg_mask(d, 0xd8d5, 0x01, 0x01);
   1237	if (ret < 0)
   1238		goto err;
   1239
   1240	ret = af9035_wr_reg_mask(d, 0xd8d3, 0x01, 0x01);
   1241	if (ret < 0)
   1242		goto err;
   1243
   1244	/* Tuner enable using gpiot2_en, gpiot2_on and gpiot2_o (reset) */
   1245	ret = af9035_wr_reg_mask(d, 0xd8b8, 0x01, 0x01);
   1246	if (ret < 0)
   1247		goto err;
   1248
   1249	ret = af9035_wr_reg_mask(d, 0xd8b9, 0x01, 0x01);
   1250	if (ret < 0)
   1251		goto err;
   1252
   1253	ret = af9035_wr_reg_mask(d, 0xd8b7, 0x00, 0x01);
   1254	if (ret < 0)
   1255		goto err;
   1256
   1257	msleep(200);
   1258
   1259	ret = af9035_wr_reg_mask(d, 0xd8b7, 0x01, 0x01);
   1260	if (ret < 0)
   1261		goto err;
   1262
   1263	memset(&si2168_config, 0, sizeof(si2168_config));
   1264	si2168_config.i2c_adapter = &adapter;
   1265	si2168_config.fe = &adap->fe[0];
   1266	si2168_config.ts_mode = SI2168_TS_SERIAL;
   1267
   1268	state->af9033_config[adap->id].fe = &adap->fe[0];
   1269	state->af9033_config[adap->id].ops = &state->ops;
   1270	ret = af9035_add_i2c_dev(d, "si2168",
   1271				 it930x_addresses_table[state->it930x_addresses].frontend_i2c_addr,
   1272				 &si2168_config, &d->i2c_adap);
   1273	if (ret)
   1274		goto err;
   1275
   1276	if (adap->fe[0] == NULL) {
   1277		ret = -ENODEV;
   1278		goto err;
   1279	}
   1280	state->i2c_adapter_demod = adapter;
   1281
   1282	return 0;
   1283
   1284err:
   1285	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1286
   1287	return ret;
   1288}
   1289
   1290static int af9035_frontend_detach(struct dvb_usb_adapter *adap)
   1291{
   1292	struct state *state = adap_to_priv(adap);
   1293	struct dvb_usb_device *d = adap_to_d(adap);
   1294	struct usb_interface *intf = d->intf;
   1295
   1296	dev_dbg(&intf->dev, "adap->id=%d\n", adap->id);
   1297
   1298	if (adap->id == 1) {
   1299		if (state->i2c_client[1])
   1300			af9035_del_i2c_dev(d);
   1301	} else if (adap->id == 0) {
   1302		if (state->i2c_client[0])
   1303			af9035_del_i2c_dev(d);
   1304	}
   1305
   1306	return 0;
   1307}
   1308
   1309static const struct fc0011_config af9035_fc0011_config = {
   1310	.i2c_address = 0x60,
   1311};
   1312
   1313static struct mxl5007t_config af9035_mxl5007t_config[] = {
   1314	{
   1315		.xtal_freq_hz = MxL_XTAL_24_MHZ,
   1316		.if_freq_hz = MxL_IF_4_57_MHZ,
   1317		.invert_if = 0,
   1318		.loop_thru_enable = 0,
   1319		.clk_out_enable = 0,
   1320		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
   1321	}, {
   1322		.xtal_freq_hz = MxL_XTAL_24_MHZ,
   1323		.if_freq_hz = MxL_IF_4_57_MHZ,
   1324		.invert_if = 0,
   1325		.loop_thru_enable = 1,
   1326		.clk_out_enable = 1,
   1327		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
   1328	}
   1329};
   1330
   1331static struct tda18218_config af9035_tda18218_config = {
   1332	.i2c_address = 0x60,
   1333	.i2c_wr_max = 21,
   1334};
   1335
   1336static const struct fc0012_config af9035_fc0012_config[] = {
   1337	{
   1338		.i2c_address = 0x63,
   1339		.xtal_freq = FC_XTAL_36_MHZ,
   1340		.dual_master = true,
   1341		.loop_through = true,
   1342		.clock_out = true,
   1343	}, {
   1344		.i2c_address = 0x63 | 0x80, /* I2C bus select hack */
   1345		.xtal_freq = FC_XTAL_36_MHZ,
   1346		.dual_master = true,
   1347	}
   1348};
   1349
   1350static int af9035_tuner_attach(struct dvb_usb_adapter *adap)
   1351{
   1352	struct state *state = adap_to_priv(adap);
   1353	struct dvb_usb_device *d = adap_to_d(adap);
   1354	struct usb_interface *intf = d->intf;
   1355	int ret;
   1356	struct dvb_frontend *fe;
   1357	struct i2c_msg msg[1];
   1358	u8 tuner_addr;
   1359
   1360	dev_dbg(&intf->dev, "adap->id=%d\n", adap->id);
   1361
   1362	/*
   1363	 * XXX: Hack used in that function: we abuse unused I2C address bit [7]
   1364	 * to carry info about used I2C bus for dual tuner configuration.
   1365	 */
   1366
   1367	switch (state->af9033_config[adap->id].tuner) {
   1368	case AF9033_TUNER_TUA9001: {
   1369		struct tua9001_platform_data tua9001_pdata = {
   1370			.dvb_frontend = adap->fe[0],
   1371		};
   1372
   1373		/*
   1374		 * AF9035 gpiot3 = TUA9001 RESETN
   1375		 * AF9035 gpiot2 = TUA9001 RXEN
   1376		 */
   1377
   1378		/* configure gpiot2 and gpiot2 as output */
   1379		ret = af9035_wr_reg_mask(d, 0x00d8ec, 0x01, 0x01);
   1380		if (ret < 0)
   1381			goto err;
   1382
   1383		ret = af9035_wr_reg_mask(d, 0x00d8ed, 0x01, 0x01);
   1384		if (ret < 0)
   1385			goto err;
   1386
   1387		ret = af9035_wr_reg_mask(d, 0x00d8e8, 0x01, 0x01);
   1388		if (ret < 0)
   1389			goto err;
   1390
   1391		ret = af9035_wr_reg_mask(d, 0x00d8e9, 0x01, 0x01);
   1392		if (ret < 0)
   1393			goto err;
   1394
   1395		/* attach tuner */
   1396		ret = af9035_add_i2c_dev(d, "tua9001", 0x60, &tua9001_pdata,
   1397					 &d->i2c_adap);
   1398		if (ret)
   1399			goto err;
   1400
   1401		fe = adap->fe[0];
   1402		break;
   1403	}
   1404	case AF9033_TUNER_FC0011:
   1405		fe = dvb_attach(fc0011_attach, adap->fe[0],
   1406				&d->i2c_adap, &af9035_fc0011_config);
   1407		break;
   1408	case AF9033_TUNER_MXL5007T:
   1409		if (adap->id == 0) {
   1410			ret = af9035_wr_reg(d, 0x00d8e0, 1);
   1411			if (ret < 0)
   1412				goto err;
   1413
   1414			ret = af9035_wr_reg(d, 0x00d8e1, 1);
   1415			if (ret < 0)
   1416				goto err;
   1417
   1418			ret = af9035_wr_reg(d, 0x00d8df, 0);
   1419			if (ret < 0)
   1420				goto err;
   1421
   1422			msleep(30);
   1423
   1424			ret = af9035_wr_reg(d, 0x00d8df, 1);
   1425			if (ret < 0)
   1426				goto err;
   1427
   1428			msleep(300);
   1429
   1430			ret = af9035_wr_reg(d, 0x00d8c0, 1);
   1431			if (ret < 0)
   1432				goto err;
   1433
   1434			ret = af9035_wr_reg(d, 0x00d8c1, 1);
   1435			if (ret < 0)
   1436				goto err;
   1437
   1438			ret = af9035_wr_reg(d, 0x00d8bf, 0);
   1439			if (ret < 0)
   1440				goto err;
   1441
   1442			ret = af9035_wr_reg(d, 0x00d8b4, 1);
   1443			if (ret < 0)
   1444				goto err;
   1445
   1446			ret = af9035_wr_reg(d, 0x00d8b5, 1);
   1447			if (ret < 0)
   1448				goto err;
   1449
   1450			ret = af9035_wr_reg(d, 0x00d8b3, 1);
   1451			if (ret < 0)
   1452				goto err;
   1453
   1454			tuner_addr = 0x60;
   1455		} else {
   1456			tuner_addr = 0x60 | 0x80; /* I2C bus hack */
   1457		}
   1458
   1459		/* attach tuner */
   1460		fe = dvb_attach(mxl5007t_attach, adap->fe[0], &d->i2c_adap,
   1461				tuner_addr, &af9035_mxl5007t_config[adap->id]);
   1462		break;
   1463	case AF9033_TUNER_TDA18218:
   1464		/* attach tuner */
   1465		fe = dvb_attach(tda18218_attach, adap->fe[0],
   1466				&d->i2c_adap, &af9035_tda18218_config);
   1467		break;
   1468	case AF9033_TUNER_FC2580: {
   1469		struct fc2580_platform_data fc2580_pdata = {
   1470			.dvb_frontend = adap->fe[0],
   1471		};
   1472
   1473		/* Tuner enable using gpiot2_o, gpiot2_en and gpiot2_on  */
   1474		ret = af9035_wr_reg_mask(d, 0xd8eb, 0x01, 0x01);
   1475		if (ret < 0)
   1476			goto err;
   1477
   1478		ret = af9035_wr_reg_mask(d, 0xd8ec, 0x01, 0x01);
   1479		if (ret < 0)
   1480			goto err;
   1481
   1482		ret = af9035_wr_reg_mask(d, 0xd8ed, 0x01, 0x01);
   1483		if (ret < 0)
   1484			goto err;
   1485
   1486		usleep_range(10000, 50000);
   1487		/* attach tuner */
   1488		ret = af9035_add_i2c_dev(d, "fc2580", 0x56, &fc2580_pdata,
   1489					 &d->i2c_adap);
   1490		if (ret)
   1491			goto err;
   1492
   1493		fe = adap->fe[0];
   1494		break;
   1495	}
   1496	case AF9033_TUNER_FC0012:
   1497		/*
   1498		 * AF9035 gpiot2 = FC0012 enable
   1499		 * XXX: there seems to be something on gpioh8 too, but on my
   1500		 * my test I didn't find any difference.
   1501		 */
   1502
   1503		if (adap->id == 0) {
   1504			/* configure gpiot2 as output and high */
   1505			ret = af9035_wr_reg_mask(d, 0xd8eb, 0x01, 0x01);
   1506			if (ret < 0)
   1507				goto err;
   1508
   1509			ret = af9035_wr_reg_mask(d, 0xd8ec, 0x01, 0x01);
   1510			if (ret < 0)
   1511				goto err;
   1512
   1513			ret = af9035_wr_reg_mask(d, 0xd8ed, 0x01, 0x01);
   1514			if (ret < 0)
   1515				goto err;
   1516		} else {
   1517			/*
   1518			 * FIXME: That belongs for the FC0012 driver.
   1519			 * Write 02 to FC0012 master tuner register 0d directly
   1520			 * in order to make slave tuner working.
   1521			 */
   1522			msg[0].addr = 0x63;
   1523			msg[0].flags = 0;
   1524			msg[0].len = 2;
   1525			msg[0].buf = "\x0d\x02";
   1526			ret = i2c_transfer(&d->i2c_adap, msg, 1);
   1527			if (ret < 0)
   1528				goto err;
   1529		}
   1530
   1531		usleep_range(10000, 50000);
   1532
   1533		fe = dvb_attach(fc0012_attach, adap->fe[0], &d->i2c_adap,
   1534				&af9035_fc0012_config[adap->id]);
   1535		break;
   1536	case AF9033_TUNER_IT9135_38:
   1537	case AF9033_TUNER_IT9135_51:
   1538	case AF9033_TUNER_IT9135_52:
   1539	case AF9033_TUNER_IT9135_60:
   1540	case AF9033_TUNER_IT9135_61:
   1541	case AF9033_TUNER_IT9135_62:
   1542	{
   1543		struct platform_device *pdev;
   1544		const char *name;
   1545		struct it913x_platform_data it913x_pdata = {
   1546			.regmap = state->af9033_config[adap->id].regmap,
   1547			.fe = adap->fe[0],
   1548		};
   1549
   1550		switch (state->af9033_config[adap->id].tuner) {
   1551		case AF9033_TUNER_IT9135_38:
   1552		case AF9033_TUNER_IT9135_51:
   1553		case AF9033_TUNER_IT9135_52:
   1554			name = "it9133ax-tuner";
   1555			break;
   1556		case AF9033_TUNER_IT9135_60:
   1557		case AF9033_TUNER_IT9135_61:
   1558		case AF9033_TUNER_IT9135_62:
   1559			name = "it9133bx-tuner";
   1560			break;
   1561		default:
   1562			ret = -ENODEV;
   1563			goto err;
   1564		}
   1565
   1566		if (state->dual_mode) {
   1567			if (adap->id == 0)
   1568				it913x_pdata.role = IT913X_ROLE_DUAL_MASTER;
   1569			else
   1570				it913x_pdata.role = IT913X_ROLE_DUAL_SLAVE;
   1571		} else {
   1572			it913x_pdata.role = IT913X_ROLE_SINGLE;
   1573		}
   1574
   1575		request_module("%s", "it913x");
   1576		pdev = platform_device_register_data(&d->intf->dev, name,
   1577						     PLATFORM_DEVID_AUTO,
   1578						     &it913x_pdata,
   1579						     sizeof(it913x_pdata));
   1580		if (IS_ERR(pdev) || !pdev->dev.driver) {
   1581			ret = -ENODEV;
   1582			goto err;
   1583		}
   1584		if (!try_module_get(pdev->dev.driver->owner)) {
   1585			platform_device_unregister(pdev);
   1586			ret = -ENODEV;
   1587			goto err;
   1588		}
   1589
   1590		state->platform_device_tuner[adap->id] = pdev;
   1591		fe = adap->fe[0];
   1592		break;
   1593	}
   1594	default:
   1595		fe = NULL;
   1596	}
   1597
   1598	if (fe == NULL) {
   1599		ret = -ENODEV;
   1600		goto err;
   1601	}
   1602
   1603	return 0;
   1604
   1605err:
   1606	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1607
   1608	return ret;
   1609}
   1610
   1611static int it930x_tuner_attach(struct dvb_usb_adapter *adap)
   1612{
   1613	struct state *state = adap_to_priv(adap);
   1614	struct dvb_usb_device *d = adap_to_d(adap);
   1615	struct usb_interface *intf = d->intf;
   1616	int ret;
   1617	struct si2157_config si2157_config;
   1618
   1619	dev_dbg(&intf->dev, "adap->id=%d\n", adap->id);
   1620
   1621	memset(&si2157_config, 0, sizeof(si2157_config));
   1622	si2157_config.fe = adap->fe[0];
   1623
   1624	/*
   1625	 * HACK: The Logilink VG0022A and TerraTec TC2 Stick have
   1626	 * a bug: when the si2157 firmware that came with the device
   1627	 * is replaced by a new one, the I2C transfers to the tuner
   1628	 * will return just 0xff.
   1629	 *
   1630	 * Probably, the vendor firmware has some patch specifically
   1631	 * designed for this device. So, we can't replace by the
   1632	 * generic firmware. The right solution would be to extract
   1633	 * the si2157 firmware from the original driver and ask the
   1634	 * driver to load the specifically designed firmware, but,
   1635	 * while we don't have that, the next best solution is to just
   1636	 * keep the original firmware at the device.
   1637	 */
   1638	if ((le16_to_cpu(d->udev->descriptor.idVendor) == USB_VID_DEXATEK &&
   1639	     le16_to_cpu(d->udev->descriptor.idProduct) == 0x0100) ||
   1640	    (le16_to_cpu(d->udev->descriptor.idVendor) == USB_VID_TERRATEC &&
   1641	     le16_to_cpu(d->udev->descriptor.idProduct) == USB_PID_TERRATEC_CINERGY_TC2_STICK))
   1642		si2157_config.dont_load_firmware = true;
   1643
   1644	si2157_config.if_port = it930x_addresses_table[state->it930x_addresses].tuner_if_port;
   1645	ret = af9035_add_i2c_dev(d, "si2157",
   1646				 it930x_addresses_table[state->it930x_addresses].tuner_i2c_addr,
   1647				 &si2157_config, state->i2c_adapter_demod);
   1648	if (ret)
   1649		goto err;
   1650
   1651	return 0;
   1652
   1653err:
   1654	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1655
   1656	return ret;
   1657}
   1658
   1659
   1660static int it930x_tuner_detach(struct dvb_usb_adapter *adap)
   1661{
   1662	struct state *state = adap_to_priv(adap);
   1663	struct dvb_usb_device *d = adap_to_d(adap);
   1664	struct usb_interface *intf = d->intf;
   1665
   1666	dev_dbg(&intf->dev, "adap->id=%d\n", adap->id);
   1667
   1668	if (adap->id == 1) {
   1669		if (state->i2c_client[3])
   1670			af9035_del_i2c_dev(d);
   1671	} else if (adap->id == 0) {
   1672		if (state->i2c_client[1])
   1673			af9035_del_i2c_dev(d);
   1674	}
   1675
   1676	return 0;
   1677}
   1678
   1679
   1680static int af9035_tuner_detach(struct dvb_usb_adapter *adap)
   1681{
   1682	struct state *state = adap_to_priv(adap);
   1683	struct dvb_usb_device *d = adap_to_d(adap);
   1684	struct usb_interface *intf = d->intf;
   1685
   1686	dev_dbg(&intf->dev, "adap->id=%d\n", adap->id);
   1687
   1688	switch (state->af9033_config[adap->id].tuner) {
   1689	case AF9033_TUNER_TUA9001:
   1690	case AF9033_TUNER_FC2580:
   1691		if (adap->id == 1) {
   1692			if (state->i2c_client[3])
   1693				af9035_del_i2c_dev(d);
   1694		} else if (adap->id == 0) {
   1695			if (state->i2c_client[1])
   1696				af9035_del_i2c_dev(d);
   1697		}
   1698		break;
   1699	case AF9033_TUNER_IT9135_38:
   1700	case AF9033_TUNER_IT9135_51:
   1701	case AF9033_TUNER_IT9135_52:
   1702	case AF9033_TUNER_IT9135_60:
   1703	case AF9033_TUNER_IT9135_61:
   1704	case AF9033_TUNER_IT9135_62:
   1705	{
   1706		struct platform_device *pdev;
   1707
   1708		pdev = state->platform_device_tuner[adap->id];
   1709		if (pdev) {
   1710			module_put(pdev->dev.driver->owner);
   1711			platform_device_unregister(pdev);
   1712		}
   1713		break;
   1714	}
   1715	}
   1716
   1717	return 0;
   1718}
   1719
   1720static int af9035_init(struct dvb_usb_device *d)
   1721{
   1722	struct state *state = d_to_priv(d);
   1723	struct usb_interface *intf = d->intf;
   1724	int ret, i;
   1725	u16 frame_size = (d->udev->speed == USB_SPEED_FULL ? 5 : 87) * 188 / 4;
   1726	u8 packet_size = (d->udev->speed == USB_SPEED_FULL ? 64 : 512) / 4;
   1727	struct reg_val_mask tab[] = {
   1728		{ 0x80f99d, 0x01, 0x01 },
   1729		{ 0x80f9a4, 0x01, 0x01 },
   1730		{ 0x00dd11, 0x00, 0x20 },
   1731		{ 0x00dd11, 0x00, 0x40 },
   1732		{ 0x00dd13, 0x00, 0x20 },
   1733		{ 0x00dd13, 0x00, 0x40 },
   1734		{ 0x00dd11, 0x20, 0x20 },
   1735		{ 0x00dd88, (frame_size >> 0) & 0xff, 0xff},
   1736		{ 0x00dd89, (frame_size >> 8) & 0xff, 0xff},
   1737		{ 0x00dd0c, packet_size, 0xff},
   1738		{ 0x00dd11, state->dual_mode << 6, 0x40 },
   1739		{ 0x00dd8a, (frame_size >> 0) & 0xff, 0xff},
   1740		{ 0x00dd8b, (frame_size >> 8) & 0xff, 0xff},
   1741		{ 0x00dd0d, packet_size, 0xff },
   1742		{ 0x80f9a3, state->dual_mode, 0x01 },
   1743		{ 0x80f9cd, state->dual_mode, 0x01 },
   1744		{ 0x80f99d, 0x00, 0x01 },
   1745		{ 0x80f9a4, 0x00, 0x01 },
   1746	};
   1747
   1748	dev_dbg(&intf->dev, "USB speed=%d frame_size=%04x packet_size=%02x\n",
   1749		d->udev->speed, frame_size, packet_size);
   1750
   1751	/* init endpoints */
   1752	for (i = 0; i < ARRAY_SIZE(tab); i++) {
   1753		ret = af9035_wr_reg_mask(d, tab[i].reg, tab[i].val,
   1754				tab[i].mask);
   1755		if (ret < 0)
   1756			goto err;
   1757	}
   1758
   1759	return 0;
   1760
   1761err:
   1762	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1763
   1764	return ret;
   1765}
   1766
   1767static int it930x_init(struct dvb_usb_device *d)
   1768{
   1769	struct state *state = d_to_priv(d);
   1770	struct usb_interface *intf = d->intf;
   1771	int ret, i;
   1772	u16 frame_size = (d->udev->speed == USB_SPEED_FULL ? 5 : 816) * 188 / 4;
   1773	u8 packet_size = (d->udev->speed == USB_SPEED_FULL ? 64 : 512) / 4;
   1774	struct reg_val_mask tab[] = {
   1775		{ 0x00da1a, 0x00, 0x01 }, /* ignore_sync_byte */
   1776		{ 0x00f41f, 0x04, 0x04 }, /* dvbt_inten */
   1777		{ 0x00da10, 0x00, 0x01 }, /* mpeg_full_speed */
   1778		{ 0x00f41a, 0x01, 0x01 }, /* dvbt_en */
   1779		{ 0x00da1d, 0x01, 0x01 }, /* mp2_sw_rst, reset EP4 */
   1780		{ 0x00dd11, 0x00, 0x20 }, /* ep4_tx_en, disable EP4 */
   1781		{ 0x00dd13, 0x00, 0x20 }, /* ep4_tx_nak, disable EP4 NAK */
   1782		{ 0x00dd11, 0x20, 0x20 }, /* ep4_tx_en, enable EP4 */
   1783		{ 0x00dd11, 0x00, 0x40 }, /* ep5_tx_en, disable EP5 */
   1784		{ 0x00dd13, 0x00, 0x40 }, /* ep5_tx_nak, disable EP5 NAK */
   1785		{ 0x00dd11, state->dual_mode << 6, 0x40 }, /* enable EP5 */
   1786		{ 0x00dd88, (frame_size >> 0) & 0xff, 0xff},
   1787		{ 0x00dd89, (frame_size >> 8) & 0xff, 0xff},
   1788		{ 0x00dd0c, packet_size, 0xff},
   1789		{ 0x00dd8a, (frame_size >> 0) & 0xff, 0xff},
   1790		{ 0x00dd8b, (frame_size >> 8) & 0xff, 0xff},
   1791		{ 0x00dd0d, packet_size, 0xff },
   1792		{ 0x00da1d, 0x00, 0x01 }, /* mp2_sw_rst, disable */
   1793		{ 0x00d833, 0x01, 0xff }, /* slew rate ctrl: slew rate boosts */
   1794		{ 0x00d830, 0x00, 0xff }, /* Bit 0 of output driving control */
   1795		{ 0x00d831, 0x01, 0xff }, /* Bit 1 of output driving control */
   1796		{ 0x00d832, 0x00, 0xff }, /* Bit 2 of output driving control */
   1797
   1798		/* suspend gpio1 for TS-C */
   1799		{ 0x00d8b0, 0x01, 0xff }, /* gpio1 */
   1800		{ 0x00d8b1, 0x01, 0xff }, /* gpio1 */
   1801		{ 0x00d8af, 0x00, 0xff }, /* gpio1 */
   1802
   1803		/* suspend gpio7 for TS-D */
   1804		{ 0x00d8c4, 0x01, 0xff }, /* gpio7 */
   1805		{ 0x00d8c5, 0x01, 0xff }, /* gpio7 */
   1806		{ 0x00d8c3, 0x00, 0xff }, /* gpio7 */
   1807
   1808		/* suspend gpio13 for TS-B */
   1809		{ 0x00d8dc, 0x01, 0xff }, /* gpio13 */
   1810		{ 0x00d8dd, 0x01, 0xff }, /* gpio13 */
   1811		{ 0x00d8db, 0x00, 0xff }, /* gpio13 */
   1812
   1813		/* suspend gpio14 for TS-E */
   1814		{ 0x00d8e4, 0x01, 0xff }, /* gpio14 */
   1815		{ 0x00d8e5, 0x01, 0xff }, /* gpio14 */
   1816		{ 0x00d8e3, 0x00, 0xff }, /* gpio14 */
   1817
   1818		/* suspend gpio15 for TS-A */
   1819		{ 0x00d8e8, 0x01, 0xff }, /* gpio15 */
   1820		{ 0x00d8e9, 0x01, 0xff }, /* gpio15 */
   1821		{ 0x00d8e7, 0x00, 0xff }, /* gpio15 */
   1822
   1823		{ 0x00da58, 0x00, 0x01 }, /* ts_in_src, serial */
   1824		{ 0x00da73, 0x01, 0xff }, /* ts0_aggre_mode */
   1825		{ 0x00da78, 0x47, 0xff }, /* ts0_sync_byte */
   1826		{ 0x00da4c, 0x01, 0xff }, /* ts0_en */
   1827		{ 0x00da5a, 0x1f, 0xff }, /* ts_fail_ignore */
   1828	};
   1829
   1830	dev_dbg(&intf->dev, "USB speed=%d frame_size=%04x packet_size=%02x\n",
   1831		d->udev->speed, frame_size, packet_size);
   1832
   1833	/* init endpoints */
   1834	for (i = 0; i < ARRAY_SIZE(tab); i++) {
   1835		ret = af9035_wr_reg_mask(d, tab[i].reg,
   1836				tab[i].val, tab[i].mask);
   1837
   1838		if (ret < 0)
   1839			goto err;
   1840	}
   1841
   1842	return 0;
   1843err:
   1844	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1845
   1846	return ret;
   1847}
   1848
   1849
   1850#if IS_ENABLED(CONFIG_RC_CORE)
   1851static int af9035_rc_query(struct dvb_usb_device *d)
   1852{
   1853	struct usb_interface *intf = d->intf;
   1854	int ret;
   1855	enum rc_proto proto;
   1856	u32 key;
   1857	u8 buf[4];
   1858	struct usb_req req = { CMD_IR_GET, 0, 0, NULL, 4, buf };
   1859
   1860	ret = af9035_ctrl_msg(d, &req);
   1861	if (ret == 1)
   1862		return 0;
   1863	else if (ret < 0)
   1864		goto err;
   1865
   1866	if ((buf[2] + buf[3]) == 0xff) {
   1867		if ((buf[0] + buf[1]) == 0xff) {
   1868			/* NEC standard 16bit */
   1869			key = RC_SCANCODE_NEC(buf[0], buf[2]);
   1870			proto = RC_PROTO_NEC;
   1871		} else {
   1872			/* NEC extended 24bit */
   1873			key = RC_SCANCODE_NECX(buf[0] << 8 | buf[1], buf[2]);
   1874			proto = RC_PROTO_NECX;
   1875		}
   1876	} else {
   1877		/* NEC full code 32bit */
   1878		key = RC_SCANCODE_NEC32(buf[0] << 24 | buf[1] << 16 |
   1879					buf[2] << 8  | buf[3]);
   1880		proto = RC_PROTO_NEC32;
   1881	}
   1882
   1883	dev_dbg(&intf->dev, "%*ph\n", 4, buf);
   1884
   1885	rc_keydown(d->rc_dev, proto, key, 0);
   1886
   1887	return 0;
   1888
   1889err:
   1890	dev_dbg(&intf->dev, "failed=%d\n", ret);
   1891
   1892	return ret;
   1893}
   1894
   1895static int af9035_get_rc_config(struct dvb_usb_device *d, struct dvb_usb_rc *rc)
   1896{
   1897	struct state *state = d_to_priv(d);
   1898	struct usb_interface *intf = d->intf;
   1899
   1900	dev_dbg(&intf->dev, "ir_mode=%02x ir_type=%02x\n",
   1901		state->ir_mode, state->ir_type);
   1902
   1903	/* don't activate rc if in HID mode or if not available */
   1904	if (state->ir_mode == 0x05) {
   1905		switch (state->ir_type) {
   1906		case 0: /* NEC */
   1907		default:
   1908			rc->allowed_protos = RC_PROTO_BIT_NEC |
   1909					RC_PROTO_BIT_NECX | RC_PROTO_BIT_NEC32;
   1910			break;
   1911		case 1: /* RC6 */
   1912			rc->allowed_protos = RC_PROTO_BIT_RC6_MCE;
   1913			break;
   1914		}
   1915
   1916		rc->query = af9035_rc_query;
   1917		rc->interval = 500;
   1918
   1919		/* load empty to enable rc */
   1920		if (!rc->map_name)
   1921			rc->map_name = RC_MAP_EMPTY;
   1922	}
   1923
   1924	return 0;
   1925}
   1926#else
   1927	#define af9035_get_rc_config NULL
   1928#endif
   1929
   1930static int af9035_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,
   1931		struct usb_data_stream_properties *stream)
   1932{
   1933	struct dvb_usb_device *d = fe_to_d(fe);
   1934	struct usb_interface *intf = d->intf;
   1935
   1936	dev_dbg(&intf->dev, "adap=%d\n", fe_to_adap(fe)->id);
   1937
   1938	if (d->udev->speed == USB_SPEED_FULL)
   1939		stream->u.bulk.buffersize = 5 * 188;
   1940
   1941	return 0;
   1942}
   1943
   1944static int af9035_pid_filter_ctrl(struct dvb_usb_adapter *adap, int onoff)
   1945{
   1946	struct state *state = adap_to_priv(adap);
   1947
   1948	return state->ops.pid_filter_ctrl(adap->fe[0], onoff);
   1949}
   1950
   1951static int af9035_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid,
   1952		int onoff)
   1953{
   1954	struct state *state = adap_to_priv(adap);
   1955
   1956	return state->ops.pid_filter(adap->fe[0], index, pid, onoff);
   1957}
   1958
   1959static int af9035_probe(struct usb_interface *intf,
   1960		const struct usb_device_id *id)
   1961{
   1962	struct usb_device *udev = interface_to_usbdev(intf);
   1963	char manufacturer[sizeof("Afatech")];
   1964
   1965	memset(manufacturer, 0, sizeof(manufacturer));
   1966	usb_string(udev, udev->descriptor.iManufacturer,
   1967			manufacturer, sizeof(manufacturer));
   1968	/*
   1969	 * There is two devices having same ID but different chipset. One uses
   1970	 * AF9015 and the other IT9135 chipset. Only difference seen on lsusb
   1971	 * is iManufacturer string.
   1972	 *
   1973	 * idVendor           0x0ccd TerraTec Electronic GmbH
   1974	 * idProduct          0x0099
   1975	 * bcdDevice            2.00
   1976	 * iManufacturer           1 Afatech
   1977	 * iProduct                2 DVB-T 2
   1978	 *
   1979	 * idVendor           0x0ccd TerraTec Electronic GmbH
   1980	 * idProduct          0x0099
   1981	 * bcdDevice            2.00
   1982	 * iManufacturer           1 ITE Technologies, Inc.
   1983	 * iProduct                2 DVB-T TV Stick
   1984	 */
   1985	if ((le16_to_cpu(udev->descriptor.idVendor) == USB_VID_TERRATEC) &&
   1986			(le16_to_cpu(udev->descriptor.idProduct) == 0x0099)) {
   1987		if (!strcmp("Afatech", manufacturer)) {
   1988			dev_dbg(&udev->dev, "rejecting device\n");
   1989			return -ENODEV;
   1990		}
   1991	}
   1992
   1993	return dvb_usbv2_probe(intf, id);
   1994}
   1995
   1996/* interface 0 is used by DVB-T receiver and
   1997   interface 1 is for remote controller (HID) */
   1998static const struct dvb_usb_device_properties af9035_props = {
   1999	.driver_name = KBUILD_MODNAME,
   2000	.owner = THIS_MODULE,
   2001	.adapter_nr = adapter_nr,
   2002	.size_of_priv = sizeof(struct state),
   2003
   2004	.generic_bulk_ctrl_endpoint = 0x02,
   2005	.generic_bulk_ctrl_endpoint_response = 0x81,
   2006
   2007	.identify_state = af9035_identify_state,
   2008	.download_firmware = af9035_download_firmware,
   2009
   2010	.i2c_algo = &af9035_i2c_algo,
   2011	.read_config = af9035_read_config,
   2012	.frontend_attach = af9035_frontend_attach,
   2013	.frontend_detach = af9035_frontend_detach,
   2014	.tuner_attach = af9035_tuner_attach,
   2015	.tuner_detach = af9035_tuner_detach,
   2016	.init = af9035_init,
   2017	.get_rc_config = af9035_get_rc_config,
   2018	.get_stream_config = af9035_get_stream_config,
   2019
   2020	.get_adapter_count = af9035_get_adapter_count,
   2021	.adapter = {
   2022		{
   2023			.caps = DVB_USB_ADAP_HAS_PID_FILTER |
   2024				DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
   2025
   2026			.pid_filter_count = 32,
   2027			.pid_filter_ctrl = af9035_pid_filter_ctrl,
   2028			.pid_filter = af9035_pid_filter,
   2029
   2030			.stream = DVB_USB_STREAM_BULK(0x84, 6, 87 * 188),
   2031		}, {
   2032			.caps = DVB_USB_ADAP_HAS_PID_FILTER |
   2033				DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
   2034
   2035			.pid_filter_count = 32,
   2036			.pid_filter_ctrl = af9035_pid_filter_ctrl,
   2037			.pid_filter = af9035_pid_filter,
   2038
   2039			.stream = DVB_USB_STREAM_BULK(0x85, 6, 87 * 188),
   2040		},
   2041	},
   2042};
   2043
   2044static const struct dvb_usb_device_properties it930x_props = {
   2045	.driver_name = KBUILD_MODNAME,
   2046	.owner = THIS_MODULE,
   2047	.adapter_nr = adapter_nr,
   2048	.size_of_priv = sizeof(struct state),
   2049
   2050	.generic_bulk_ctrl_endpoint = 0x02,
   2051	.generic_bulk_ctrl_endpoint_response = 0x81,
   2052
   2053	.identify_state = af9035_identify_state,
   2054	.download_firmware = af9035_download_firmware,
   2055
   2056	.i2c_algo = &af9035_i2c_algo,
   2057	.read_config = af9035_read_config,
   2058	.frontend_attach = it930x_frontend_attach,
   2059	.frontend_detach = af9035_frontend_detach,
   2060	.tuner_attach = it930x_tuner_attach,
   2061	.tuner_detach = it930x_tuner_detach,
   2062	.init = it930x_init,
   2063	.get_stream_config = af9035_get_stream_config,
   2064
   2065	.get_adapter_count = af9035_get_adapter_count,
   2066	.adapter = {
   2067		{
   2068			.stream = DVB_USB_STREAM_BULK(0x84, 4, 816 * 188),
   2069		}, {
   2070			.stream = DVB_USB_STREAM_BULK(0x85, 4, 816 * 188),
   2071		},
   2072	},
   2073};
   2074
   2075static const struct usb_device_id af9035_id_table[] = {
   2076	/* AF9035 devices */
   2077	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_9035,
   2078		&af9035_props, "Afatech AF9035 reference design", NULL) },
   2079	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1000,
   2080		&af9035_props, "Afatech AF9035 reference design", NULL) },
   2081	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1001,
   2082		&af9035_props, "Afatech AF9035 reference design", NULL) },
   2083	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1002,
   2084		&af9035_props, "Afatech AF9035 reference design", NULL) },
   2085	{ DVB_USB_DEVICE(USB_VID_AFATECH, USB_PID_AFATECH_AF9035_1003,
   2086		&af9035_props, "Afatech AF9035 reference design", NULL) },
   2087	{ DVB_USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_T_STICK,
   2088		&af9035_props, "TerraTec Cinergy T Stick", NULL) },
   2089	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835,
   2090		&af9035_props, "AVerMedia AVerTV Volar HD/PRO (A835)", NULL) },
   2091	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_B835,
   2092		&af9035_props, "AVerMedia AVerTV Volar HD/PRO (A835)", NULL) },
   2093	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_1867,
   2094		&af9035_props, "AVerMedia HD Volar (A867)", NULL) },
   2095	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A867,
   2096		&af9035_props, "AVerMedia HD Volar (A867)", NULL) },
   2097	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_TWINSTAR,
   2098		&af9035_props, "AVerMedia Twinstar (A825)", NULL) },
   2099	{ DVB_USB_DEVICE(USB_VID_ASUS, USB_PID_ASUS_U3100MINI_PLUS,
   2100		&af9035_props, "Asus U3100Mini Plus", NULL) },
   2101	{ DVB_USB_DEVICE(USB_VID_TERRATEC, 0x00aa,
   2102		&af9035_props, "TerraTec Cinergy T Stick (rev. 2)", NULL) },
   2103	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, 0x0337,
   2104		&af9035_props, "AVerMedia HD Volar (A867)", NULL) },
   2105       { DVB_USB_DEVICE(USB_VID_GTEK, USB_PID_EVOLVEO_XTRATV_STICK,
   2106	       &af9035_props, "EVOLVEO XtraTV stick", NULL) },
   2107
   2108	/* IT9135 devices */
   2109	{ DVB_USB_DEVICE(USB_VID_ITETECH, USB_PID_ITETECH_IT9135,
   2110		&af9035_props, "ITE 9135 Generic", RC_MAP_IT913X_V1) },
   2111	{ DVB_USB_DEVICE(USB_VID_ITETECH, USB_PID_ITETECH_IT9135_9005,
   2112		&af9035_props, "ITE 9135(9005) Generic", RC_MAP_IT913X_V2) },
   2113	{ DVB_USB_DEVICE(USB_VID_ITETECH, USB_PID_ITETECH_IT9135_9006,
   2114		&af9035_props, "ITE 9135(9006) Generic", RC_MAP_IT913X_V1) },
   2115	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835B_1835,
   2116		&af9035_props, "Avermedia A835B(1835)", RC_MAP_IT913X_V2) },
   2117	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835B_2835,
   2118		&af9035_props, "Avermedia A835B(2835)", RC_MAP_IT913X_V2) },
   2119	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835B_3835,
   2120		&af9035_props, "Avermedia A835B(3835)", RC_MAP_IT913X_V2) },
   2121	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_A835B_4835,
   2122		&af9035_props, "Avermedia A835B(4835)",	RC_MAP_IT913X_V2) },
   2123	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_TD110,
   2124		&af9035_props, "Avermedia AverTV Volar HD 2 (TD110)", RC_MAP_AVERMEDIA_RM_KS) },
   2125	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_H335,
   2126		&af9035_props, "Avermedia H335", RC_MAP_IT913X_V2) },
   2127	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, USB_PID_KWORLD_UB499_2T_T09,
   2128		&af9035_props, "Kworld UB499-2T T09", RC_MAP_IT913X_V1) },
   2129	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, USB_PID_SVEON_STV22_IT9137,
   2130		&af9035_props, "Sveon STV22 Dual DVB-T HDTV",
   2131							RC_MAP_IT913X_V1) },
   2132	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, USB_PID_CTVDIGDUAL_V2,
   2133		&af9035_props, "Digital Dual TV Receiver CTVDIGDUAL_V2",
   2134							RC_MAP_IT913X_V1) },
   2135	{ DVB_USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_T1,
   2136		&af9035_props, "TerraTec T1", RC_MAP_IT913X_V1) },
   2137	/* XXX: that same ID [0ccd:0099] is used by af9015 driver too */
   2138	{ DVB_USB_DEVICE(USB_VID_TERRATEC, 0x0099,
   2139		&af9035_props, "TerraTec Cinergy T Stick Dual RC (rev. 2)",
   2140		NULL) },
   2141	{ DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a05,
   2142		&af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) },
   2143	{ DVB_USB_DEVICE(USB_VID_HAUPPAUGE, 0xf900,
   2144		&af9035_props, "Hauppauge WinTV-MiniStick 2", NULL) },
   2145	{ DVB_USB_DEVICE(USB_VID_PCTV, USB_PID_PCTV_78E,
   2146		&af9035_props, "PCTV AndroiDTV (78e)", RC_MAP_IT913X_V1) },
   2147	{ DVB_USB_DEVICE(USB_VID_PCTV, USB_PID_PCTV_79E,
   2148		&af9035_props, "PCTV microStick (79e)", RC_MAP_IT913X_V2) },
   2149
   2150	/* IT930x devices */
   2151	{ DVB_USB_DEVICE(USB_VID_ITETECH, USB_PID_ITETECH_IT9303,
   2152		&it930x_props, "ITE 9303 Generic", NULL) },
   2153	{ DVB_USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_TD310,
   2154		&it930x_props, "AVerMedia TD310 DVB-T2", NULL) },
   2155	{ DVB_USB_DEVICE(USB_VID_DEXATEK, 0x0100,
   2156		&it930x_props, "Logilink VG0022A", NULL) },
   2157	{ DVB_USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_TC2_STICK,
   2158		&it930x_props, "TerraTec Cinergy TC2 Stick", NULL) },
   2159	{ }
   2160};
   2161MODULE_DEVICE_TABLE(usb, af9035_id_table);
   2162
   2163static struct usb_driver af9035_usb_driver = {
   2164	.name = KBUILD_MODNAME,
   2165	.id_table = af9035_id_table,
   2166	.probe = af9035_probe,
   2167	.disconnect = dvb_usbv2_disconnect,
   2168	.suspend = dvb_usbv2_suspend,
   2169	.resume = dvb_usbv2_resume,
   2170	.reset_resume = dvb_usbv2_reset_resume,
   2171	.no_dynamic_id = 1,
   2172	.soft_unbind = 1,
   2173};
   2174
   2175module_usb_driver(af9035_usb_driver);
   2176
   2177MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
   2178MODULE_DESCRIPTION("Afatech AF9035 driver");
   2179MODULE_LICENSE("GPL");
   2180MODULE_FIRMWARE(AF9035_FIRMWARE_AF9035);
   2181MODULE_FIRMWARE(AF9035_FIRMWARE_IT9135_V1);
   2182MODULE_FIRMWARE(AF9035_FIRMWARE_IT9135_V2);
   2183MODULE_FIRMWARE(AF9035_FIRMWARE_IT9303);