cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

af9005.c (27801B)


      1// SPDX-License-Identifier: GPL-2.0-or-later
      2/* DVB USB compliant Linux driver for the Afatech 9005
      3 * USB1.1 DVB-T receiver.
      4 *
      5 * Copyright (C) 2007 Luca Olivetti (luca@ventoso.org)
      6 *
      7 * Thanks to Afatech who kindly provided information.
      8 *
      9 * see Documentation/driver-api/media/drivers/dvb-usb.rst for more information
     10 */
     11#include "af9005.h"
     12
     13/* debug */
     14int dvb_usb_af9005_debug;
     15module_param_named(debug, dvb_usb_af9005_debug, int, 0644);
     16MODULE_PARM_DESC(debug,
     17		 "set debugging level (1=info,xfer=2,rc=4,reg=8,i2c=16,fw=32 (or-able))."
     18		 DVB_USB_DEBUG_STATUS);
     19/* enable obnoxious led */
     20bool dvb_usb_af9005_led = true;
     21module_param_named(led, dvb_usb_af9005_led, bool, 0644);
     22MODULE_PARM_DESC(led, "enable led (default: 1).");
     23
     24/* eeprom dump */
     25static int dvb_usb_af9005_dump_eeprom;
     26module_param_named(dump_eeprom, dvb_usb_af9005_dump_eeprom, int, 0);
     27MODULE_PARM_DESC(dump_eeprom, "dump contents of the eeprom.");
     28
     29DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
     30
     31/* remote control decoder */
     32static int (*rc_decode) (struct dvb_usb_device *d, u8 *data, int len,
     33		u32 *event, int *state);
     34static void *rc_keys;
     35static int *rc_keys_size;
     36
     37u8 regmask[8] = { 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f, 0xff };
     38
     39struct af9005_device_state {
     40	u8 sequence;
     41	int led_state;
     42	unsigned char data[256];
     43};
     44
     45static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg,
     46			      int readwrite, int type, u8 * values, int len)
     47{
     48	struct af9005_device_state *st = d->priv;
     49	u8 command, seq;
     50	int i, ret;
     51
     52	if (len < 1) {
     53		err("generic read/write, less than 1 byte. Makes no sense.");
     54		return -EINVAL;
     55	}
     56	if (len > 8) {
     57		err("generic read/write, more than 8 bytes. Not supported.");
     58		return -EINVAL;
     59	}
     60
     61	mutex_lock(&d->data_mutex);
     62	st->data[0] = 14;		/* rest of buffer length low */
     63	st->data[1] = 0;		/* rest of buffer length high */
     64
     65	st->data[2] = AF9005_REGISTER_RW;	/* register operation */
     66	st->data[3] = 12;		/* rest of buffer length */
     67
     68	st->data[4] = seq = st->sequence++;	/* sequence number */
     69
     70	st->data[5] = (u8) (reg >> 8);	/* register address */
     71	st->data[6] = (u8) (reg & 0xff);
     72
     73	if (type == AF9005_OFDM_REG) {
     74		command = AF9005_CMD_OFDM_REG;
     75	} else {
     76		command = AF9005_CMD_TUNER;
     77	}
     78
     79	if (len > 1)
     80		command |=
     81		    AF9005_CMD_BURST | AF9005_CMD_AUTOINC | (len - 1) << 3;
     82	command |= readwrite;
     83	if (readwrite == AF9005_CMD_WRITE)
     84		for (i = 0; i < len; i++)
     85			st->data[8 + i] = values[i];
     86	else if (type == AF9005_TUNER_REG)
     87		/* read command for tuner, the first byte contains the i2c address */
     88		st->data[8] = values[0];
     89	st->data[7] = command;
     90
     91	ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 17, 0);
     92	if (ret)
     93		goto ret;
     94
     95	/* sanity check */
     96	if (st->data[2] != AF9005_REGISTER_RW_ACK) {
     97		err("generic read/write, wrong reply code.");
     98		ret = -EIO;
     99		goto ret;
    100	}
    101	if (st->data[3] != 0x0d) {
    102		err("generic read/write, wrong length in reply.");
    103		ret = -EIO;
    104		goto ret;
    105	}
    106	if (st->data[4] != seq) {
    107		err("generic read/write, wrong sequence in reply.");
    108		ret = -EIO;
    109		goto ret;
    110	}
    111	/*
    112	 * In thesis, both input and output buffers should have
    113	 * identical values for st->data[5] to st->data[8].
    114	 * However, windows driver doesn't check these fields, in fact
    115	 * sometimes the register in the reply is different that what
    116	 * has been sent
    117	 */
    118	if (st->data[16] != 0x01) {
    119		err("generic read/write wrong status code in reply.");
    120		ret = -EIO;
    121		goto ret;
    122	}
    123
    124	if (readwrite == AF9005_CMD_READ)
    125		for (i = 0; i < len; i++)
    126			values[i] = st->data[8 + i];
    127
    128ret:
    129	mutex_unlock(&d->data_mutex);
    130	return ret;
    131
    132}
    133
    134int af9005_read_ofdm_register(struct dvb_usb_device *d, u16 reg, u8 * value)
    135{
    136	int ret;
    137	deb_reg("read register %x ", reg);
    138	ret = af9005_generic_read_write(d, reg,
    139					AF9005_CMD_READ, AF9005_OFDM_REG,
    140					value, 1);
    141	if (ret)
    142		deb_reg("failed\n");
    143	else
    144		deb_reg("value %x\n", *value);
    145	return ret;
    146}
    147
    148int af9005_read_ofdm_registers(struct dvb_usb_device *d, u16 reg,
    149			       u8 * values, int len)
    150{
    151	int ret;
    152	deb_reg("read %d registers %x ", len, reg);
    153	ret = af9005_generic_read_write(d, reg,
    154					AF9005_CMD_READ, AF9005_OFDM_REG,
    155					values, len);
    156	if (ret)
    157		deb_reg("failed\n");
    158	else
    159		debug_dump(values, len, deb_reg);
    160	return ret;
    161}
    162
    163int af9005_write_ofdm_register(struct dvb_usb_device *d, u16 reg, u8 value)
    164{
    165	int ret;
    166	u8 temp = value;
    167	deb_reg("write register %x value %x ", reg, value);
    168	ret = af9005_generic_read_write(d, reg,
    169					AF9005_CMD_WRITE, AF9005_OFDM_REG,
    170					&temp, 1);
    171	if (ret)
    172		deb_reg("failed\n");
    173	else
    174		deb_reg("ok\n");
    175	return ret;
    176}
    177
    178int af9005_write_ofdm_registers(struct dvb_usb_device *d, u16 reg,
    179				u8 * values, int len)
    180{
    181	int ret;
    182	deb_reg("write %d registers %x values ", len, reg);
    183	debug_dump(values, len, deb_reg);
    184
    185	ret = af9005_generic_read_write(d, reg,
    186					AF9005_CMD_WRITE, AF9005_OFDM_REG,
    187					values, len);
    188	if (ret)
    189		deb_reg("failed\n");
    190	else
    191		deb_reg("ok\n");
    192	return ret;
    193}
    194
    195int af9005_read_register_bits(struct dvb_usb_device *d, u16 reg, u8 pos,
    196			      u8 len, u8 * value)
    197{
    198	u8 temp;
    199	int ret;
    200	deb_reg("read bits %x %x %x", reg, pos, len);
    201	ret = af9005_read_ofdm_register(d, reg, &temp);
    202	if (ret) {
    203		deb_reg(" failed\n");
    204		return ret;
    205	}
    206	*value = (temp >> pos) & regmask[len - 1];
    207	deb_reg(" value %x\n", *value);
    208	return 0;
    209
    210}
    211
    212int af9005_write_register_bits(struct dvb_usb_device *d, u16 reg, u8 pos,
    213			       u8 len, u8 value)
    214{
    215	u8 temp, mask;
    216	int ret;
    217	deb_reg("write bits %x %x %x value %x\n", reg, pos, len, value);
    218	if (pos == 0 && len == 8)
    219		return af9005_write_ofdm_register(d, reg, value);
    220	ret = af9005_read_ofdm_register(d, reg, &temp);
    221	if (ret)
    222		return ret;
    223	mask = regmask[len - 1] << pos;
    224	temp = (temp & ~mask) | ((value << pos) & mask);
    225	return af9005_write_ofdm_register(d, reg, temp);
    226
    227}
    228
    229static int af9005_usb_read_tuner_registers(struct dvb_usb_device *d,
    230					   u16 reg, u8 * values, int len)
    231{
    232	return af9005_generic_read_write(d, reg,
    233					 AF9005_CMD_READ, AF9005_TUNER_REG,
    234					 values, len);
    235}
    236
    237static int af9005_usb_write_tuner_registers(struct dvb_usb_device *d,
    238					    u16 reg, u8 * values, int len)
    239{
    240	return af9005_generic_read_write(d, reg,
    241					 AF9005_CMD_WRITE,
    242					 AF9005_TUNER_REG, values, len);
    243}
    244
    245int af9005_write_tuner_registers(struct dvb_usb_device *d, u16 reg,
    246				 u8 * values, int len)
    247{
    248	/* don't let the name of this function mislead you: it's just used
    249	   as an interface from the firmware to the i2c bus. The actual
    250	   i2c addresses are contained in the data */
    251	int ret, i, done = 0, fail = 0;
    252	u8 temp;
    253	ret = af9005_usb_write_tuner_registers(d, reg, values, len);
    254	if (ret)
    255		return ret;
    256	if (reg != 0xffff) {
    257		/* check if write done (0xa40d bit 1) or fail (0xa40d bit 2) */
    258		for (i = 0; i < 200; i++) {
    259			ret =
    260			    af9005_read_ofdm_register(d,
    261						      xd_I2C_i2c_m_status_wdat_done,
    262						      &temp);
    263			if (ret)
    264				return ret;
    265			done = temp & (regmask[i2c_m_status_wdat_done_len - 1]
    266				       << i2c_m_status_wdat_done_pos);
    267			if (done)
    268				break;
    269			fail = temp & (regmask[i2c_m_status_wdat_fail_len - 1]
    270				       << i2c_m_status_wdat_fail_pos);
    271			if (fail)
    272				break;
    273			msleep(50);
    274		}
    275		if (i == 200)
    276			return -ETIMEDOUT;
    277		if (fail) {
    278			/* clear write fail bit */
    279			af9005_write_register_bits(d,
    280						   xd_I2C_i2c_m_status_wdat_fail,
    281						   i2c_m_status_wdat_fail_pos,
    282						   i2c_m_status_wdat_fail_len,
    283						   1);
    284			return -EIO;
    285		}
    286		/* clear write done bit */
    287		ret =
    288		    af9005_write_register_bits(d,
    289					       xd_I2C_i2c_m_status_wdat_fail,
    290					       i2c_m_status_wdat_done_pos,
    291					       i2c_m_status_wdat_done_len, 1);
    292		if (ret)
    293			return ret;
    294	}
    295	return 0;
    296}
    297
    298int af9005_read_tuner_registers(struct dvb_usb_device *d, u16 reg, u8 addr,
    299				u8 * values, int len)
    300{
    301	/* don't let the name of this function mislead you: it's just used
    302	   as an interface from the firmware to the i2c bus. The actual
    303	   i2c addresses are contained in the data */
    304	int ret, i;
    305	u8 temp, buf[2];
    306
    307	buf[0] = addr;		/* tuner i2c address */
    308	buf[1] = values[0];	/* tuner register */
    309
    310	values[0] = addr + 0x01;	/* i2c read address */
    311
    312	if (reg == APO_REG_I2C_RW_SILICON_TUNER) {
    313		/* write tuner i2c address to tuner, 0c00c0 undocumented, found by sniffing */
    314		ret = af9005_write_tuner_registers(d, 0x00c0, buf, 2);
    315		if (ret)
    316			return ret;
    317	}
    318
    319	/* send read command to ofsm */
    320	ret = af9005_usb_read_tuner_registers(d, reg, values, 1);
    321	if (ret)
    322		return ret;
    323
    324	/* check if read done */
    325	for (i = 0; i < 200; i++) {
    326		ret = af9005_read_ofdm_register(d, 0xa408, &temp);
    327		if (ret)
    328			return ret;
    329		if (temp & 0x01)
    330			break;
    331		msleep(50);
    332	}
    333	if (i == 200)
    334		return -ETIMEDOUT;
    335
    336	/* clear read done bit (by writing 1) */
    337	ret = af9005_write_ofdm_register(d, xd_I2C_i2c_m_data8, 1);
    338	if (ret)
    339		return ret;
    340
    341	/* get read data (available from 0xa400) */
    342	for (i = 0; i < len; i++) {
    343		ret = af9005_read_ofdm_register(d, 0xa400 + i, &temp);
    344		if (ret)
    345			return ret;
    346		values[i] = temp;
    347	}
    348	return 0;
    349}
    350
    351static int af9005_i2c_write(struct dvb_usb_device *d, u8 i2caddr, u8 reg,
    352			    u8 * data, int len)
    353{
    354	int ret, i;
    355	u8 buf[3];
    356	deb_i2c("i2c_write i2caddr %x, reg %x, len %d data ", i2caddr,
    357		reg, len);
    358	debug_dump(data, len, deb_i2c);
    359
    360	for (i = 0; i < len; i++) {
    361		buf[0] = i2caddr;
    362		buf[1] = reg + (u8) i;
    363		buf[2] = data[i];
    364		ret =
    365		    af9005_write_tuner_registers(d,
    366						 APO_REG_I2C_RW_SILICON_TUNER,
    367						 buf, 3);
    368		if (ret) {
    369			deb_i2c("i2c_write failed\n");
    370			return ret;
    371		}
    372	}
    373	deb_i2c("i2c_write ok\n");
    374	return 0;
    375}
    376
    377static int af9005_i2c_read(struct dvb_usb_device *d, u8 i2caddr, u8 reg,
    378			   u8 * data, int len)
    379{
    380	int ret, i;
    381	u8 temp;
    382	deb_i2c("i2c_read i2caddr %x, reg %x, len %d\n ", i2caddr, reg, len);
    383	for (i = 0; i < len; i++) {
    384		temp = reg + i;
    385		ret =
    386		    af9005_read_tuner_registers(d,
    387						APO_REG_I2C_RW_SILICON_TUNER,
    388						i2caddr, &temp, 1);
    389		if (ret) {
    390			deb_i2c("i2c_read failed\n");
    391			return ret;
    392		}
    393		data[i] = temp;
    394	}
    395	deb_i2c("i2c data read: ");
    396	debug_dump(data, len, deb_i2c);
    397	return 0;
    398}
    399
    400static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
    401			   int num)
    402{
    403	/* only implements what the mt2060 module does, don't know how
    404	   to make it really generic */
    405	struct dvb_usb_device *d = i2c_get_adapdata(adap);
    406	int ret;
    407	u8 reg, addr;
    408	u8 *value;
    409
    410	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
    411		return -EAGAIN;
    412
    413	if (num > 2)
    414		warn("more than 2 i2c messages at a time is not handled yet. TODO.");
    415
    416	if (num == 2) {
    417		/* reads a single register */
    418		reg = *msg[0].buf;
    419		addr = msg[0].addr;
    420		value = msg[1].buf;
    421		ret = af9005_i2c_read(d, addr, reg, value, 1);
    422		if (ret == 0)
    423			ret = 2;
    424	} else {
    425		/* write one or more registers */
    426		reg = msg[0].buf[0];
    427		addr = msg[0].addr;
    428		value = &msg[0].buf[1];
    429		ret = af9005_i2c_write(d, addr, reg, value, msg[0].len - 1);
    430		if (ret == 0)
    431			ret = 1;
    432	}
    433
    434	mutex_unlock(&d->i2c_mutex);
    435	return ret;
    436}
    437
    438static u32 af9005_i2c_func(struct i2c_adapter *adapter)
    439{
    440	return I2C_FUNC_I2C;
    441}
    442
    443static struct i2c_algorithm af9005_i2c_algo = {
    444	.master_xfer = af9005_i2c_xfer,
    445	.functionality = af9005_i2c_func,
    446};
    447
    448int af9005_send_command(struct dvb_usb_device *d, u8 command, u8 * wbuf,
    449			int wlen, u8 * rbuf, int rlen)
    450{
    451	struct af9005_device_state *st = d->priv;
    452
    453	int ret, i, packet_len;
    454	u8 seq;
    455
    456	if (wlen < 0) {
    457		err("send command, wlen less than 0 bytes. Makes no sense.");
    458		return -EINVAL;
    459	}
    460	if (wlen > 54) {
    461		err("send command, wlen more than 54 bytes. Not supported.");
    462		return -EINVAL;
    463	}
    464	if (rlen > 54) {
    465		err("send command, rlen more than 54 bytes. Not supported.");
    466		return -EINVAL;
    467	}
    468	packet_len = wlen + 5;
    469
    470	mutex_lock(&d->data_mutex);
    471
    472	st->data[0] = (u8) (packet_len & 0xff);
    473	st->data[1] = (u8) ((packet_len & 0xff00) >> 8);
    474
    475	st->data[2] = 0x26;		/* packet type */
    476	st->data[3] = wlen + 3;
    477	st->data[4] = seq = st->sequence++;
    478	st->data[5] = command;
    479	st->data[6] = wlen;
    480	for (i = 0; i < wlen; i++)
    481		st->data[7 + i] = wbuf[i];
    482	ret = dvb_usb_generic_rw(d, st->data, wlen + 7, st->data, rlen + 7, 0);
    483	if (st->data[2] != 0x27) {
    484		err("send command, wrong reply code.");
    485		ret = -EIO;
    486	} else if (st->data[4] != seq) {
    487		err("send command, wrong sequence in reply.");
    488		ret = -EIO;
    489	} else if (st->data[5] != 0x01) {
    490		err("send command, wrong status code in reply.");
    491		ret = -EIO;
    492	} else if (st->data[6] != rlen) {
    493		err("send command, invalid data length in reply.");
    494		ret = -EIO;
    495	}
    496	if (!ret) {
    497		for (i = 0; i < rlen; i++)
    498			rbuf[i] = st->data[i + 7];
    499	}
    500
    501	mutex_unlock(&d->data_mutex);
    502	return ret;
    503}
    504
    505int af9005_read_eeprom(struct dvb_usb_device *d, u8 address, u8 * values,
    506		       int len)
    507{
    508	struct af9005_device_state *st = d->priv;
    509	u8 seq;
    510	int ret, i;
    511
    512	mutex_lock(&d->data_mutex);
    513
    514	memset(st->data, 0, sizeof(st->data));
    515
    516	st->data[0] = 14;		/* length of rest of packet low */
    517	st->data[1] = 0;		/* length of rest of packer high */
    518
    519	st->data[2] = 0x2a;		/* read/write eeprom */
    520
    521	st->data[3] = 12;		/* size */
    522
    523	st->data[4] = seq = st->sequence++;
    524
    525	st->data[5] = 0;		/* read */
    526
    527	st->data[6] = len;
    528	st->data[7] = address;
    529	ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 14, 0);
    530	if (st->data[2] != 0x2b) {
    531		err("Read eeprom, invalid reply code");
    532		ret = -EIO;
    533	} else if (st->data[3] != 10) {
    534		err("Read eeprom, invalid reply length");
    535		ret = -EIO;
    536	} else if (st->data[4] != seq) {
    537		err("Read eeprom, wrong sequence in reply ");
    538		ret = -EIO;
    539	} else if (st->data[5] != 1) {
    540		err("Read eeprom, wrong status in reply ");
    541		ret = -EIO;
    542	}
    543
    544	if (!ret) {
    545		for (i = 0; i < len; i++)
    546			values[i] = st->data[6 + i];
    547	}
    548	mutex_unlock(&d->data_mutex);
    549
    550	return ret;
    551}
    552
    553static int af9005_boot_packet(struct usb_device *udev, int type, u8 *reply,
    554			      u8 *buf, int size)
    555{
    556	u16 checksum;
    557	int act_len = 0, i, ret;
    558
    559	memset(buf, 0, size);
    560	buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
    561	buf[1] = (u8) ((FW_BULKOUT_SIZE >> 8) & 0xff);
    562	switch (type) {
    563	case FW_CONFIG:
    564		buf[2] = 0x11;
    565		buf[3] = 0x04;
    566		buf[4] = 0x00;	/* sequence number, original driver doesn't increment it here */
    567		buf[5] = 0x03;
    568		checksum = buf[4] + buf[5];
    569		buf[6] = (u8) ((checksum >> 8) & 0xff);
    570		buf[7] = (u8) (checksum & 0xff);
    571		break;
    572	case FW_CONFIRM:
    573		buf[2] = 0x11;
    574		buf[3] = 0x04;
    575		buf[4] = 0x00;	/* sequence number, original driver doesn't increment it here */
    576		buf[5] = 0x01;
    577		checksum = buf[4] + buf[5];
    578		buf[6] = (u8) ((checksum >> 8) & 0xff);
    579		buf[7] = (u8) (checksum & 0xff);
    580		break;
    581	case FW_BOOT:
    582		buf[2] = 0x10;
    583		buf[3] = 0x08;
    584		buf[4] = 0x00;	/* sequence number, original driver doesn't increment it here */
    585		buf[5] = 0x97;
    586		buf[6] = 0xaa;
    587		buf[7] = 0x55;
    588		buf[8] = 0xa5;
    589		buf[9] = 0x5a;
    590		checksum = 0;
    591		for (i = 4; i <= 9; i++)
    592			checksum += buf[i];
    593		buf[10] = (u8) ((checksum >> 8) & 0xff);
    594		buf[11] = (u8) (checksum & 0xff);
    595		break;
    596	default:
    597		err("boot packet invalid boot packet type");
    598		return -EINVAL;
    599	}
    600	deb_fw(">>> ");
    601	debug_dump(buf, FW_BULKOUT_SIZE + 2, deb_fw);
    602
    603	ret = usb_bulk_msg(udev,
    604			   usb_sndbulkpipe(udev, 0x02),
    605			   buf, FW_BULKOUT_SIZE + 2, &act_len, 2000);
    606	if (ret)
    607		err("boot packet bulk message failed: %d (%d/%d)", ret,
    608		    FW_BULKOUT_SIZE + 2, act_len);
    609	else
    610		ret = act_len != FW_BULKOUT_SIZE + 2 ? -1 : 0;
    611	if (ret)
    612		return ret;
    613	memset(buf, 0, 9);
    614	ret = usb_bulk_msg(udev,
    615			   usb_rcvbulkpipe(udev, 0x01), buf, 9, &act_len, 2000);
    616	if (ret) {
    617		err("boot packet recv bulk message failed: %d", ret);
    618		return ret;
    619	}
    620	deb_fw("<<< ");
    621	debug_dump(buf, act_len, deb_fw);
    622	checksum = 0;
    623	switch (type) {
    624	case FW_CONFIG:
    625		if (buf[2] != 0x11) {
    626			err("boot bad config header.");
    627			return -EIO;
    628		}
    629		if (buf[3] != 0x05) {
    630			err("boot bad config size.");
    631			return -EIO;
    632		}
    633		if (buf[4] != 0x00) {
    634			err("boot bad config sequence.");
    635			return -EIO;
    636		}
    637		if (buf[5] != 0x04) {
    638			err("boot bad config subtype.");
    639			return -EIO;
    640		}
    641		for (i = 4; i <= 6; i++)
    642			checksum += buf[i];
    643		if (buf[7] * 256 + buf[8] != checksum) {
    644			err("boot bad config checksum.");
    645			return -EIO;
    646		}
    647		*reply = buf[6];
    648		break;
    649	case FW_CONFIRM:
    650		if (buf[2] != 0x11) {
    651			err("boot bad confirm header.");
    652			return -EIO;
    653		}
    654		if (buf[3] != 0x05) {
    655			err("boot bad confirm size.");
    656			return -EIO;
    657		}
    658		if (buf[4] != 0x00) {
    659			err("boot bad confirm sequence.");
    660			return -EIO;
    661		}
    662		if (buf[5] != 0x02) {
    663			err("boot bad confirm subtype.");
    664			return -EIO;
    665		}
    666		for (i = 4; i <= 6; i++)
    667			checksum += buf[i];
    668		if (buf[7] * 256 + buf[8] != checksum) {
    669			err("boot bad confirm checksum.");
    670			return -EIO;
    671		}
    672		*reply = buf[6];
    673		break;
    674	case FW_BOOT:
    675		if (buf[2] != 0x10) {
    676			err("boot bad boot header.");
    677			return -EIO;
    678		}
    679		if (buf[3] != 0x05) {
    680			err("boot bad boot size.");
    681			return -EIO;
    682		}
    683		if (buf[4] != 0x00) {
    684			err("boot bad boot sequence.");
    685			return -EIO;
    686		}
    687		if (buf[5] != 0x01) {
    688			err("boot bad boot pattern 01.");
    689			return -EIO;
    690		}
    691		if (buf[6] != 0x10) {
    692			err("boot bad boot pattern 10.");
    693			return -EIO;
    694		}
    695		for (i = 4; i <= 6; i++)
    696			checksum += buf[i];
    697		if (buf[7] * 256 + buf[8] != checksum) {
    698			err("boot bad boot checksum.");
    699			return -EIO;
    700		}
    701		break;
    702
    703	}
    704
    705	return 0;
    706}
    707
    708static int af9005_download_firmware(struct usb_device *udev, const struct firmware *fw)
    709{
    710	int i, packets, ret, act_len;
    711
    712	u8 *buf;
    713	u8 reply;
    714
    715	buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL);
    716	if (!buf)
    717		return -ENOMEM;
    718
    719	ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf,
    720				 FW_BULKOUT_SIZE + 2);
    721	if (ret)
    722		goto err;
    723	if (reply != 0x01) {
    724		err("before downloading firmware, FW_CONFIG expected 0x01, received 0x%x", reply);
    725		ret = -EIO;
    726		goto err;
    727	}
    728	packets = fw->size / FW_BULKOUT_SIZE;
    729	buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
    730	buf[1] = (u8) ((FW_BULKOUT_SIZE >> 8) & 0xff);
    731	for (i = 0; i < packets; i++) {
    732		memcpy(&buf[2], fw->data + i * FW_BULKOUT_SIZE,
    733		       FW_BULKOUT_SIZE);
    734		deb_fw(">>> ");
    735		debug_dump(buf, FW_BULKOUT_SIZE + 2, deb_fw);
    736		ret = usb_bulk_msg(udev,
    737				   usb_sndbulkpipe(udev, 0x02),
    738				   buf, FW_BULKOUT_SIZE + 2, &act_len, 1000);
    739		if (ret) {
    740			err("firmware download failed at packet %d with code %d", i, ret);
    741			goto err;
    742		}
    743	}
    744	ret = af9005_boot_packet(udev, FW_CONFIRM, &reply,
    745				 buf, FW_BULKOUT_SIZE + 2);
    746	if (ret)
    747		goto err;
    748	if (reply != (u8) (packets & 0xff)) {
    749		err("after downloading firmware, FW_CONFIRM expected 0x%x, received 0x%x", packets & 0xff, reply);
    750		ret = -EIO;
    751		goto err;
    752	}
    753	ret = af9005_boot_packet(udev, FW_BOOT, &reply, buf,
    754				 FW_BULKOUT_SIZE + 2);
    755	if (ret)
    756		goto err;
    757	ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf,
    758				 FW_BULKOUT_SIZE + 2);
    759	if (ret)
    760		goto err;
    761	if (reply != 0x02) {
    762		err("after downloading firmware, FW_CONFIG expected 0x02, received 0x%x", reply);
    763		ret = -EIO;
    764		goto err;
    765	}
    766
    767err:
    768	kfree(buf);
    769	return ret;
    770
    771}
    772
    773int af9005_led_control(struct dvb_usb_device *d, int onoff)
    774{
    775	struct af9005_device_state *st = d->priv;
    776	int temp, ret;
    777
    778	if (onoff && dvb_usb_af9005_led)
    779		temp = 1;
    780	else
    781		temp = 0;
    782	if (st->led_state != temp) {
    783		ret =
    784		    af9005_write_register_bits(d, xd_p_reg_top_locken1,
    785					       reg_top_locken1_pos,
    786					       reg_top_locken1_len, temp);
    787		if (ret)
    788			return ret;
    789		ret =
    790		    af9005_write_register_bits(d, xd_p_reg_top_lock1,
    791					       reg_top_lock1_pos,
    792					       reg_top_lock1_len, temp);
    793		if (ret)
    794			return ret;
    795		st->led_state = temp;
    796	}
    797	return 0;
    798}
    799
    800static int af9005_frontend_attach(struct dvb_usb_adapter *adap)
    801{
    802	u8 buf[8];
    803	int i;
    804
    805	/* without these calls the first commands after downloading
    806	   the firmware fail. I put these calls here to simulate
    807	   what it is done in dvb-usb-init.c.
    808	 */
    809	struct usb_device *udev = adap->dev->udev;
    810	usb_clear_halt(udev, usb_sndbulkpipe(udev, 2));
    811	usb_clear_halt(udev, usb_rcvbulkpipe(udev, 1));
    812	if (dvb_usb_af9005_dump_eeprom) {
    813		printk("EEPROM DUMP\n");
    814		for (i = 0; i < 255; i += 8) {
    815			af9005_read_eeprom(adap->dev, i, buf, 8);
    816			debug_dump(buf, 8, printk);
    817		}
    818	}
    819	adap->fe_adap[0].fe = af9005_fe_attach(adap->dev);
    820	return 0;
    821}
    822
    823static int af9005_rc_query(struct dvb_usb_device *d, u32 * event, int *state)
    824{
    825	struct af9005_device_state *st = d->priv;
    826	int ret, len;
    827	u8 seq;
    828
    829	*state = REMOTE_NO_KEY_PRESSED;
    830	if (rc_decode == NULL) {
    831		/* it shouldn't never come here */
    832		return 0;
    833	}
    834
    835	mutex_lock(&d->data_mutex);
    836
    837	/* deb_info("rc_query\n"); */
    838	st->data[0] = 3;		/* rest of packet length low */
    839	st->data[1] = 0;		/* rest of packet length high */
    840	st->data[2] = 0x40;		/* read remote */
    841	st->data[3] = 1;		/* rest of packet length */
    842	st->data[4] = seq = st->sequence++;	/* sequence number */
    843	ret = dvb_usb_generic_rw(d, st->data, 5, st->data, 256, 0);
    844	if (ret) {
    845		err("rc query failed");
    846		goto ret;
    847	}
    848	if (st->data[2] != 0x41) {
    849		err("rc query bad header.");
    850		ret = -EIO;
    851		goto ret;
    852	} else if (st->data[4] != seq) {
    853		err("rc query bad sequence.");
    854		ret = -EIO;
    855		goto ret;
    856	}
    857	len = st->data[5];
    858	if (len > 246) {
    859		err("rc query invalid length");
    860		ret = -EIO;
    861		goto ret;
    862	}
    863	if (len > 0) {
    864		deb_rc("rc data (%d) ", len);
    865		debug_dump((st->data + 6), len, deb_rc);
    866		ret = rc_decode(d, &st->data[6], len, event, state);
    867		if (ret) {
    868			err("rc_decode failed");
    869			goto ret;
    870		} else {
    871			deb_rc("rc_decode state %x event %x\n", *state, *event);
    872			if (*state == REMOTE_KEY_REPEAT)
    873				*event = d->last_event;
    874		}
    875	}
    876
    877ret:
    878	mutex_unlock(&d->data_mutex);
    879	return ret;
    880}
    881
    882static int af9005_power_ctrl(struct dvb_usb_device *d, int onoff)
    883{
    884
    885	return 0;
    886}
    887
    888static int af9005_pid_filter_control(struct dvb_usb_adapter *adap, int onoff)
    889{
    890	int ret;
    891	deb_info("pid filter control  onoff %d\n", onoff);
    892	if (onoff) {
    893		ret =
    894		    af9005_write_ofdm_register(adap->dev, XD_MP2IF_DMX_CTRL, 1);
    895		if (ret)
    896			return ret;
    897		ret =
    898		    af9005_write_register_bits(adap->dev,
    899					       XD_MP2IF_DMX_CTRL, 1, 1, 1);
    900		if (ret)
    901			return ret;
    902		ret =
    903		    af9005_write_ofdm_register(adap->dev, XD_MP2IF_DMX_CTRL, 1);
    904	} else
    905		ret =
    906		    af9005_write_ofdm_register(adap->dev, XD_MP2IF_DMX_CTRL, 0);
    907	if (ret)
    908		return ret;
    909	deb_info("pid filter control ok\n");
    910	return 0;
    911}
    912
    913static int af9005_pid_filter(struct dvb_usb_adapter *adap, int index,
    914			     u16 pid, int onoff)
    915{
    916	u8 cmd = index & 0x1f;
    917	int ret;
    918	deb_info("set pid filter, index %d, pid %x, onoff %d\n", index,
    919		 pid, onoff);
    920	if (onoff) {
    921		/* cannot use it as pid_filter_ctrl since it has to be done
    922		   before setting the first pid */
    923		if (adap->feedcount == 1) {
    924			deb_info("first pid set, enable pid table\n");
    925			ret = af9005_pid_filter_control(adap, onoff);
    926			if (ret)
    927				return ret;
    928		}
    929		ret =
    930		    af9005_write_ofdm_register(adap->dev,
    931					       XD_MP2IF_PID_DATA_L,
    932					       (u8) (pid & 0xff));
    933		if (ret)
    934			return ret;
    935		ret =
    936		    af9005_write_ofdm_register(adap->dev,
    937					       XD_MP2IF_PID_DATA_H,
    938					       (u8) (pid >> 8));
    939		if (ret)
    940			return ret;
    941		cmd |= 0x20 | 0x40;
    942	} else {
    943		if (adap->feedcount == 0) {
    944			deb_info("last pid unset, disable pid table\n");
    945			ret = af9005_pid_filter_control(adap, onoff);
    946			if (ret)
    947				return ret;
    948		}
    949	}
    950	ret = af9005_write_ofdm_register(adap->dev, XD_MP2IF_PID_IDX, cmd);
    951	if (ret)
    952		return ret;
    953	deb_info("set pid ok\n");
    954	return 0;
    955}
    956
    957static int af9005_identify_state(struct usb_device *udev,
    958				 const struct dvb_usb_device_properties *props,
    959				 const struct dvb_usb_device_description **desc,
    960				 int *cold)
    961{
    962	int ret;
    963	u8 reply, *buf;
    964
    965	buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL);
    966	if (!buf)
    967		return -ENOMEM;
    968
    969	ret = af9005_boot_packet(udev, FW_CONFIG, &reply,
    970				 buf, FW_BULKOUT_SIZE + 2);
    971	if (ret)
    972		goto err;
    973	deb_info("result of FW_CONFIG in identify state %d\n", reply);
    974	if (reply == 0x01)
    975		*cold = 1;
    976	else if (reply == 0x02)
    977		*cold = 0;
    978	else
    979		ret = -EIO;
    980	if (!ret)
    981		deb_info("Identify state cold = %d\n", *cold);
    982
    983err:
    984	kfree(buf);
    985	return ret;
    986}
    987
    988static struct dvb_usb_device_properties af9005_properties;
    989
    990static int af9005_usb_probe(struct usb_interface *intf,
    991			    const struct usb_device_id *id)
    992{
    993	return dvb_usb_device_init(intf, &af9005_properties,
    994				  THIS_MODULE, NULL, adapter_nr);
    995}
    996
    997enum {
    998	AFATECH_AF9005,
    999	TERRATEC_CINERGY_T_USB_XE,
   1000	ANSONIC_DVBT_USB,
   1001};
   1002
   1003static struct usb_device_id af9005_usb_table[] = {
   1004	DVB_USB_DEV(AFATECH, AFATECH_AF9005),
   1005	DVB_USB_DEV(TERRATEC, TERRATEC_CINERGY_T_USB_XE),
   1006	DVB_USB_DEV(ANSONIC, ANSONIC_DVBT_USB),
   1007	{ }
   1008};
   1009
   1010MODULE_DEVICE_TABLE(usb, af9005_usb_table);
   1011
   1012static struct dvb_usb_device_properties af9005_properties = {
   1013	.caps = DVB_USB_IS_AN_I2C_ADAPTER,
   1014
   1015	.usb_ctrl = DEVICE_SPECIFIC,
   1016	.firmware = "af9005.fw",
   1017	.download_firmware = af9005_download_firmware,
   1018	.no_reconnect = 1,
   1019
   1020	.size_of_priv = sizeof(struct af9005_device_state),
   1021
   1022	.num_adapters = 1,
   1023	.adapter = {
   1024		    {
   1025		    .num_frontends = 1,
   1026		    .fe = {{
   1027		     .caps =
   1028		     DVB_USB_ADAP_HAS_PID_FILTER |
   1029		     DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
   1030		     .pid_filter_count = 32,
   1031		     .pid_filter = af9005_pid_filter,
   1032		     /* .pid_filter_ctrl = af9005_pid_filter_control, */
   1033		     .frontend_attach = af9005_frontend_attach,
   1034		     /* .tuner_attach     = af9005_tuner_attach, */
   1035		     /* parameter for the MPEG2-data transfer */
   1036		     .stream = {
   1037				.type = USB_BULK,
   1038				.count = 10,
   1039				.endpoint = 0x04,
   1040				.u = {
   1041				      .bulk = {
   1042					       .buffersize = 4096,	/* actual size seen is 3948 */
   1043					       }
   1044				      }
   1045				},
   1046		     }},
   1047		     }
   1048		    },
   1049	.power_ctrl = af9005_power_ctrl,
   1050	.identify_state = af9005_identify_state,
   1051
   1052	.i2c_algo = &af9005_i2c_algo,
   1053
   1054	.rc.legacy = {
   1055		.rc_interval = 200,
   1056		.rc_map_table = NULL,
   1057		.rc_map_size = 0,
   1058		.rc_query = af9005_rc_query,
   1059	},
   1060
   1061	.generic_bulk_ctrl_endpoint          = 2,
   1062	.generic_bulk_ctrl_endpoint_response = 1,
   1063
   1064	.num_device_descs = 3,
   1065	.devices = {
   1066		    {.name = "Afatech DVB-T USB1.1 stick",
   1067		     .cold_ids = {&af9005_usb_table[AFATECH_AF9005], NULL},
   1068		     .warm_ids = {NULL},
   1069		     },
   1070		    {.name = "TerraTec Cinergy T USB XE",
   1071		     .cold_ids = {&af9005_usb_table[TERRATEC_CINERGY_T_USB_XE], NULL},
   1072		     .warm_ids = {NULL},
   1073		     },
   1074		    {.name = "Ansonic DVB-T USB1.1 stick",
   1075		     .cold_ids = {&af9005_usb_table[ANSONIC_DVBT_USB], NULL},
   1076		     .warm_ids = {NULL},
   1077		     },
   1078		    {NULL},
   1079		    }
   1080};
   1081
   1082/* usb specific object needed to register this driver with the usb subsystem */
   1083static struct usb_driver af9005_usb_driver = {
   1084	.name = "dvb_usb_af9005",
   1085	.probe = af9005_usb_probe,
   1086	.disconnect = dvb_usb_device_exit,
   1087	.id_table = af9005_usb_table,
   1088};
   1089
   1090/* module stuff */
   1091static int __init af9005_usb_module_init(void)
   1092{
   1093	int result;
   1094	if ((result = usb_register(&af9005_usb_driver))) {
   1095		err("usb_register failed. (%d)", result);
   1096		return result;
   1097	}
   1098#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
   1099	/* FIXME: convert to todays kernel IR infrastructure */
   1100	rc_decode = symbol_request(af9005_rc_decode);
   1101	rc_keys = symbol_request(rc_map_af9005_table);
   1102	rc_keys_size = symbol_request(rc_map_af9005_table_size);
   1103#endif
   1104	if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
   1105		err("af9005_rc_decode function not found, disabling remote");
   1106		af9005_properties.rc.legacy.rc_query = NULL;
   1107	} else {
   1108		af9005_properties.rc.legacy.rc_map_table = rc_keys;
   1109		af9005_properties.rc.legacy.rc_map_size = *rc_keys_size;
   1110	}
   1111
   1112	return 0;
   1113}
   1114
   1115static void __exit af9005_usb_module_exit(void)
   1116{
   1117	/* release rc decode symbols */
   1118	if (rc_decode != NULL)
   1119		symbol_put(af9005_rc_decode);
   1120	if (rc_keys != NULL)
   1121		symbol_put(rc_map_af9005_table);
   1122	if (rc_keys_size != NULL)
   1123		symbol_put(rc_map_af9005_table_size);
   1124	/* deregister this driver from the USB subsystem */
   1125	usb_deregister(&af9005_usb_driver);
   1126}
   1127
   1128module_init(af9005_usb_module_init);
   1129module_exit(af9005_usb_module_exit);
   1130
   1131MODULE_AUTHOR("Luca Olivetti <luca@ventoso.org>");
   1132MODULE_DESCRIPTION("Driver for Afatech 9005 DVB-T USB1.1 stick");
   1133MODULE_VERSION("1.0");
   1134MODULE_LICENSE("GPL");