Avoid beyond bounds copy while caching ACL
[zen-stable.git] / drivers / media / dvb / frontends / tda10071.c
blobc21bc92d2811219d11c468ece8fc9a171498a131
1 /*
2 * NXP TDA10071 + Conexant CX24118A DVB-S/S2 demodulator + tuner driver
4 * Copyright (C) 2011 Antti Palosaari <crope@iki.fi>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License along
17 * with this program; if not, write to the Free Software Foundation, Inc.,
18 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 #include "tda10071_priv.h"
23 int tda10071_debug;
24 module_param_named(debug, tda10071_debug, int, 0644);
25 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
27 static struct dvb_frontend_ops tda10071_ops;
29 /* write multiple registers */
30 static int tda10071_wr_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
31 int len)
33 int ret;
34 u8 buf[len+1];
35 struct i2c_msg msg[1] = {
37 .addr = priv->cfg.i2c_address,
38 .flags = 0,
39 .len = sizeof(buf),
40 .buf = buf,
44 buf[0] = reg;
45 memcpy(&buf[1], val, len);
47 ret = i2c_transfer(priv->i2c, msg, 1);
48 if (ret == 1) {
49 ret = 0;
50 } else {
51 warn("i2c wr failed=%d reg=%02x len=%d", ret, reg, len);
52 ret = -EREMOTEIO;
54 return ret;
57 /* read multiple registers */
58 static int tda10071_rd_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
59 int len)
61 int ret;
62 u8 buf[len];
63 struct i2c_msg msg[2] = {
65 .addr = priv->cfg.i2c_address,
66 .flags = 0,
67 .len = 1,
68 .buf = &reg,
69 }, {
70 .addr = priv->cfg.i2c_address,
71 .flags = I2C_M_RD,
72 .len = sizeof(buf),
73 .buf = buf,
77 ret = i2c_transfer(priv->i2c, msg, 2);
78 if (ret == 2) {
79 memcpy(val, buf, len);
80 ret = 0;
81 } else {
82 warn("i2c rd failed=%d reg=%02x len=%d", ret, reg, len);
83 ret = -EREMOTEIO;
85 return ret;
88 /* write single register */
89 static int tda10071_wr_reg(struct tda10071_priv *priv, u8 reg, u8 val)
91 return tda10071_wr_regs(priv, reg, &val, 1);
94 /* read single register */
95 static int tda10071_rd_reg(struct tda10071_priv *priv, u8 reg, u8 *val)
97 return tda10071_rd_regs(priv, reg, val, 1);
100 /* write single register with mask */
101 int tda10071_wr_reg_mask(struct tda10071_priv *priv, u8 reg, u8 val, u8 mask)
103 int ret;
104 u8 tmp;
106 /* no need for read if whole reg is written */
107 if (mask != 0xff) {
108 ret = tda10071_rd_regs(priv, reg, &tmp, 1);
109 if (ret)
110 return ret;
112 val &= mask;
113 tmp &= ~mask;
114 val |= tmp;
117 return tda10071_wr_regs(priv, reg, &val, 1);
120 /* read single register with mask */
121 int tda10071_rd_reg_mask(struct tda10071_priv *priv, u8 reg, u8 *val, u8 mask)
123 int ret, i;
124 u8 tmp;
126 ret = tda10071_rd_regs(priv, reg, &tmp, 1);
127 if (ret)
128 return ret;
130 tmp &= mask;
132 /* find position of the first bit */
133 for (i = 0; i < 8; i++) {
134 if ((mask >> i) & 0x01)
135 break;
137 *val = tmp >> i;
139 return 0;
142 /* execute firmware command */
143 static int tda10071_cmd_execute(struct tda10071_priv *priv,
144 struct tda10071_cmd *cmd)
146 int ret, i;
147 u8 tmp;
149 if (!priv->warm) {
150 ret = -EFAULT;
151 goto error;
154 /* write cmd and args for firmware */
155 ret = tda10071_wr_regs(priv, 0x00, cmd->args, cmd->len);
156 if (ret)
157 goto error;
159 /* start cmd execution */
160 ret = tda10071_wr_reg(priv, 0x1f, 1);
161 if (ret)
162 goto error;
164 /* wait cmd execution terminate */
165 for (i = 1000, tmp = 1; i && tmp; i--) {
166 ret = tda10071_rd_reg(priv, 0x1f, &tmp);
167 if (ret)
168 goto error;
170 usleep_range(200, 5000);
173 dbg("%s: loop=%d", __func__, i);
175 if (i == 0) {
176 ret = -ETIMEDOUT;
177 goto error;
180 return ret;
181 error:
182 dbg("%s: failed=%d", __func__, ret);
183 return ret;
186 static int tda10071_set_tone(struct dvb_frontend *fe,
187 fe_sec_tone_mode_t fe_sec_tone_mode)
189 struct tda10071_priv *priv = fe->demodulator_priv;
190 struct tda10071_cmd cmd;
191 int ret;
192 u8 tone;
194 if (!priv->warm) {
195 ret = -EFAULT;
196 goto error;
199 dbg("%s: tone_mode=%d", __func__, fe_sec_tone_mode);
201 switch (fe_sec_tone_mode) {
202 case SEC_TONE_ON:
203 tone = 1;
204 break;
205 case SEC_TONE_OFF:
206 tone = 0;
207 break;
208 default:
209 dbg("%s: invalid fe_sec_tone_mode", __func__);
210 ret = -EINVAL;
211 goto error;
214 cmd.args[0x00] = CMD_LNB_PCB_CONFIG;
215 cmd.args[0x01] = 0;
216 cmd.args[0x02] = 0x00;
217 cmd.args[0x03] = 0x00;
218 cmd.args[0x04] = tone;
219 cmd.len = 0x05;
220 ret = tda10071_cmd_execute(priv, &cmd);
221 if (ret)
222 goto error;
224 return ret;
225 error:
226 dbg("%s: failed=%d", __func__, ret);
227 return ret;
230 static int tda10071_set_voltage(struct dvb_frontend *fe,
231 fe_sec_voltage_t fe_sec_voltage)
233 struct tda10071_priv *priv = fe->demodulator_priv;
234 struct tda10071_cmd cmd;
235 int ret;
236 u8 voltage;
238 if (!priv->warm) {
239 ret = -EFAULT;
240 goto error;
243 dbg("%s: voltage=%d", __func__, fe_sec_voltage);
245 switch (fe_sec_voltage) {
246 case SEC_VOLTAGE_13:
247 voltage = 0;
248 break;
249 case SEC_VOLTAGE_18:
250 voltage = 1;
251 break;
252 case SEC_VOLTAGE_OFF:
253 voltage = 0;
254 break;
255 default:
256 dbg("%s: invalid fe_sec_voltage", __func__);
257 ret = -EINVAL;
258 goto error;
261 cmd.args[0x00] = CMD_LNB_SET_DC_LEVEL;
262 cmd.args[0x01] = 0;
263 cmd.args[0x02] = voltage;
264 cmd.len = 0x03;
265 ret = tda10071_cmd_execute(priv, &cmd);
266 if (ret)
267 goto error;
269 return ret;
270 error:
271 dbg("%s: failed=%d", __func__, ret);
272 return ret;
275 static int tda10071_diseqc_send_master_cmd(struct dvb_frontend *fe,
276 struct dvb_diseqc_master_cmd *diseqc_cmd)
278 struct tda10071_priv *priv = fe->demodulator_priv;
279 struct tda10071_cmd cmd;
280 int ret, i;
281 u8 tmp;
283 if (!priv->warm) {
284 ret = -EFAULT;
285 goto error;
288 dbg("%s: msg_len=%d", __func__, diseqc_cmd->msg_len);
290 if (diseqc_cmd->msg_len < 3 || diseqc_cmd->msg_len > 16) {
291 ret = -EINVAL;
292 goto error;
295 /* wait LNB TX */
296 for (i = 500, tmp = 0; i && !tmp; i--) {
297 ret = tda10071_rd_reg_mask(priv, 0x47, &tmp, 0x01);
298 if (ret)
299 goto error;
301 usleep_range(10000, 20000);
304 dbg("%s: loop=%d", __func__, i);
306 if (i == 0) {
307 ret = -ETIMEDOUT;
308 goto error;
311 ret = tda10071_wr_reg_mask(priv, 0x47, 0x00, 0x01);
312 if (ret)
313 goto error;
315 cmd.args[0x00] = CMD_LNB_SEND_DISEQC;
316 cmd.args[0x01] = 0;
317 cmd.args[0x02] = 0;
318 cmd.args[0x03] = 0;
319 cmd.args[0x04] = 2;
320 cmd.args[0x05] = 0;
321 cmd.args[0x06] = diseqc_cmd->msg_len;
322 memcpy(&cmd.args[0x07], diseqc_cmd->msg, diseqc_cmd->msg_len);
323 cmd.len = 0x07 + diseqc_cmd->msg_len;
324 ret = tda10071_cmd_execute(priv, &cmd);
325 if (ret)
326 goto error;
328 return ret;
329 error:
330 dbg("%s: failed=%d", __func__, ret);
331 return ret;
334 static int tda10071_diseqc_recv_slave_reply(struct dvb_frontend *fe,
335 struct dvb_diseqc_slave_reply *reply)
337 struct tda10071_priv *priv = fe->demodulator_priv;
338 struct tda10071_cmd cmd;
339 int ret, i;
340 u8 tmp;
342 if (!priv->warm) {
343 ret = -EFAULT;
344 goto error;
347 dbg("%s:", __func__);
349 /* wait LNB RX */
350 for (i = 500, tmp = 0; i && !tmp; i--) {
351 ret = tda10071_rd_reg_mask(priv, 0x47, &tmp, 0x02);
352 if (ret)
353 goto error;
355 usleep_range(10000, 20000);
358 dbg("%s: loop=%d", __func__, i);
360 if (i == 0) {
361 ret = -ETIMEDOUT;
362 goto error;
365 /* reply len */
366 ret = tda10071_rd_reg(priv, 0x46, &tmp);
367 if (ret)
368 goto error;
370 reply->msg_len = tmp & 0x1f; /* [4:0] */;
371 if (reply->msg_len > sizeof(reply->msg))
372 reply->msg_len = sizeof(reply->msg); /* truncate API max */
374 /* read reply */
375 cmd.args[0x00] = CMD_LNB_UPDATE_REPLY;
376 cmd.args[0x01] = 0;
377 cmd.len = 0x02;
378 ret = tda10071_cmd_execute(priv, &cmd);
379 if (ret)
380 goto error;
382 ret = tda10071_rd_regs(priv, cmd.len, reply->msg, reply->msg_len);
383 if (ret)
384 goto error;
386 return ret;
387 error:
388 dbg("%s: failed=%d", __func__, ret);
389 return ret;
392 static int tda10071_diseqc_send_burst(struct dvb_frontend *fe,
393 fe_sec_mini_cmd_t fe_sec_mini_cmd)
395 struct tda10071_priv *priv = fe->demodulator_priv;
396 struct tda10071_cmd cmd;
397 int ret, i;
398 u8 tmp, burst;
400 if (!priv->warm) {
401 ret = -EFAULT;
402 goto error;
405 dbg("%s: fe_sec_mini_cmd=%d", __func__, fe_sec_mini_cmd);
407 switch (fe_sec_mini_cmd) {
408 case SEC_MINI_A:
409 burst = 0;
410 break;
411 case SEC_MINI_B:
412 burst = 1;
413 break;
414 default:
415 dbg("%s: invalid fe_sec_mini_cmd", __func__);
416 ret = -EINVAL;
417 goto error;
420 /* wait LNB TX */
421 for (i = 500, tmp = 0; i && !tmp; i--) {
422 ret = tda10071_rd_reg_mask(priv, 0x47, &tmp, 0x01);
423 if (ret)
424 goto error;
426 usleep_range(10000, 20000);
429 dbg("%s: loop=%d", __func__, i);
431 if (i == 0) {
432 ret = -ETIMEDOUT;
433 goto error;
436 ret = tda10071_wr_reg_mask(priv, 0x47, 0x00, 0x01);
437 if (ret)
438 goto error;
440 cmd.args[0x00] = CMD_LNB_SEND_TONEBURST;
441 cmd.args[0x01] = 0;
442 cmd.args[0x02] = burst;
443 cmd.len = 0x03;
444 ret = tda10071_cmd_execute(priv, &cmd);
445 if (ret)
446 goto error;
448 return ret;
449 error:
450 dbg("%s: failed=%d", __func__, ret);
451 return ret;
454 static int tda10071_read_status(struct dvb_frontend *fe, fe_status_t *status)
456 struct tda10071_priv *priv = fe->demodulator_priv;
457 int ret;
458 u8 tmp;
460 *status = 0;
462 if (!priv->warm) {
463 ret = 0;
464 goto error;
467 ret = tda10071_rd_reg(priv, 0x39, &tmp);
468 if (ret)
469 goto error;
471 if (tmp & 0x01) /* tuner PLL */
472 *status |= FE_HAS_SIGNAL;
473 if (tmp & 0x02) /* demod PLL */
474 *status |= FE_HAS_CARRIER;
475 if (tmp & 0x04) /* viterbi or LDPC*/
476 *status |= FE_HAS_VITERBI;
477 if (tmp & 0x08) /* RS or BCH */
478 *status |= FE_HAS_SYNC | FE_HAS_LOCK;
480 priv->fe_status = *status;
482 return ret;
483 error:
484 dbg("%s: failed=%d", __func__, ret);
485 return ret;
488 static int tda10071_read_snr(struct dvb_frontend *fe, u16 *snr)
490 struct tda10071_priv *priv = fe->demodulator_priv;
491 int ret;
492 u8 buf[2];
494 if (!priv->warm || !(priv->fe_status & FE_HAS_LOCK)) {
495 *snr = 0;
496 ret = 0;
497 goto error;
500 ret = tda10071_rd_regs(priv, 0x3a, buf, 2);
501 if (ret)
502 goto error;
504 /* Es/No dBx10 */
505 *snr = buf[0] << 8 | buf[1];
507 return ret;
508 error:
509 dbg("%s: failed=%d", __func__, ret);
510 return ret;
513 static int tda10071_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
515 struct tda10071_priv *priv = fe->demodulator_priv;
516 struct tda10071_cmd cmd;
517 int ret;
518 u8 tmp;
520 if (!priv->warm || !(priv->fe_status & FE_HAS_LOCK)) {
521 *strength = 0;
522 ret = 0;
523 goto error;
526 cmd.args[0x00] = CMD_GET_AGCACC;
527 cmd.args[0x01] = 0;
528 cmd.len = 0x02;
529 ret = tda10071_cmd_execute(priv, &cmd);
530 if (ret)
531 goto error;
533 /* input power estimate dBm */
534 ret = tda10071_rd_reg(priv, 0x50, &tmp);
535 if (ret)
536 goto error;
538 if (tmp < 181)
539 tmp = 181; /* -75 dBm */
540 else if (tmp > 236)
541 tmp = 236; /* -20 dBm */
543 /* scale value to 0x0000-0xffff */
544 *strength = (tmp-181) * 0xffff / (236-181);
546 return ret;
547 error:
548 dbg("%s: failed=%d", __func__, ret);
549 return ret;
552 static int tda10071_read_ber(struct dvb_frontend *fe, u32 *ber)
554 struct tda10071_priv *priv = fe->demodulator_priv;
555 struct tda10071_cmd cmd;
556 int ret, i, len;
557 u8 tmp, reg, buf[8];
559 if (!priv->warm || !(priv->fe_status & FE_HAS_LOCK)) {
560 *ber = priv->ber = 0;
561 ret = 0;
562 goto error;
565 switch (priv->delivery_system) {
566 case SYS_DVBS:
567 reg = 0x4c;
568 len = 8;
569 i = 1;
570 break;
571 case SYS_DVBS2:
572 reg = 0x4d;
573 len = 4;
574 i = 0;
575 break;
576 default:
577 *ber = priv->ber = 0;
578 return 0;
581 ret = tda10071_rd_reg(priv, reg, &tmp);
582 if (ret)
583 goto error;
585 if (priv->meas_count[i] == tmp) {
586 dbg("%s: meas not ready=%02x", __func__, tmp);
587 *ber = priv->ber;
588 return 0;
589 } else {
590 priv->meas_count[i] = tmp;
593 cmd.args[0x00] = CMD_BER_UPDATE_COUNTERS;
594 cmd.args[0x01] = 0;
595 cmd.args[0x02] = i;
596 cmd.len = 0x03;
597 ret = tda10071_cmd_execute(priv, &cmd);
598 if (ret)
599 goto error;
601 ret = tda10071_rd_regs(priv, cmd.len, buf, len);
602 if (ret)
603 goto error;
605 if (priv->delivery_system == SYS_DVBS) {
606 *ber = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
607 priv->ucb += (buf[4] << 8) | buf[5];
608 } else {
609 *ber = (buf[0] << 8) | buf[1];
611 priv->ber = *ber;
613 return ret;
614 error:
615 dbg("%s: failed=%d", __func__, ret);
616 return ret;
619 static int tda10071_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
621 struct tda10071_priv *priv = fe->demodulator_priv;
622 int ret = 0;
624 if (!priv->warm || !(priv->fe_status & FE_HAS_LOCK)) {
625 *ucblocks = 0;
626 goto error;
629 /* UCB is updated when BER is read. Assume BER is read anyway. */
631 *ucblocks = priv->ucb;
633 return ret;
634 error:
635 dbg("%s: failed=%d", __func__, ret);
636 return ret;
639 static int tda10071_set_frontend(struct dvb_frontend *fe)
641 struct tda10071_priv *priv = fe->demodulator_priv;
642 struct tda10071_cmd cmd;
643 struct dtv_frontend_properties *c = &fe->dtv_property_cache;
644 int ret, i;
645 u8 mode, rolloff, pilot, inversion, div;
647 dbg("%s: delivery_system=%d modulation=%d frequency=%d " \
648 "symbol_rate=%d inversion=%d pilot=%d rolloff=%d", __func__,
649 c->delivery_system, c->modulation, c->frequency,
650 c->symbol_rate, c->inversion, c->pilot, c->rolloff);
652 priv->delivery_system = SYS_UNDEFINED;
654 if (!priv->warm) {
655 ret = -EFAULT;
656 goto error;
659 switch (c->inversion) {
660 case INVERSION_OFF:
661 inversion = 1;
662 break;
663 case INVERSION_ON:
664 inversion = 0;
665 break;
666 case INVERSION_AUTO:
667 /* 2 = auto; try first on then off
668 * 3 = auto; try first off then on */
669 inversion = 3;
670 break;
671 default:
672 dbg("%s: invalid inversion", __func__);
673 ret = -EINVAL;
674 goto error;
677 switch (c->delivery_system) {
678 case SYS_DVBS:
679 rolloff = 0;
680 pilot = 2;
681 break;
682 case SYS_DVBS2:
683 switch (c->rolloff) {
684 case ROLLOFF_20:
685 rolloff = 2;
686 break;
687 case ROLLOFF_25:
688 rolloff = 1;
689 break;
690 case ROLLOFF_35:
691 rolloff = 0;
692 break;
693 case ROLLOFF_AUTO:
694 default:
695 dbg("%s: invalid rolloff", __func__);
696 ret = -EINVAL;
697 goto error;
700 switch (c->pilot) {
701 case PILOT_OFF:
702 pilot = 0;
703 break;
704 case PILOT_ON:
705 pilot = 1;
706 break;
707 case PILOT_AUTO:
708 pilot = 2;
709 break;
710 default:
711 dbg("%s: invalid pilot", __func__);
712 ret = -EINVAL;
713 goto error;
715 break;
716 default:
717 dbg("%s: invalid delivery_system", __func__);
718 ret = -EINVAL;
719 goto error;
722 for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
723 if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
724 c->modulation == TDA10071_MODCOD[i].modulation &&
725 c->fec_inner == TDA10071_MODCOD[i].fec) {
726 mode = TDA10071_MODCOD[i].val;
727 dbg("%s: mode found=%02x", __func__, mode);
728 break;
732 if (mode == 0xff) {
733 dbg("%s: invalid parameter combination", __func__);
734 ret = -EINVAL;
735 goto error;
738 if (c->symbol_rate <= 5000000)
739 div = 14;
740 else
741 div = 4;
743 ret = tda10071_wr_reg(priv, 0x81, div);
744 if (ret)
745 goto error;
747 ret = tda10071_wr_reg(priv, 0xe3, div);
748 if (ret)
749 goto error;
751 cmd.args[0x00] = CMD_CHANGE_CHANNEL;
752 cmd.args[0x01] = 0;
753 cmd.args[0x02] = mode;
754 cmd.args[0x03] = (c->frequency >> 16) & 0xff;
755 cmd.args[0x04] = (c->frequency >> 8) & 0xff;
756 cmd.args[0x05] = (c->frequency >> 0) & 0xff;
757 cmd.args[0x06] = ((c->symbol_rate / 1000) >> 8) & 0xff;
758 cmd.args[0x07] = ((c->symbol_rate / 1000) >> 0) & 0xff;
759 cmd.args[0x08] = (tda10071_ops.info.frequency_tolerance >> 8) & 0xff;
760 cmd.args[0x09] = (tda10071_ops.info.frequency_tolerance >> 0) & 0xff;
761 cmd.args[0x0a] = rolloff;
762 cmd.args[0x0b] = inversion;
763 cmd.args[0x0c] = pilot;
764 cmd.args[0x0d] = 0x00;
765 cmd.args[0x0e] = 0x00;
766 cmd.len = 0x0f;
767 ret = tda10071_cmd_execute(priv, &cmd);
768 if (ret)
769 goto error;
771 priv->delivery_system = c->delivery_system;
773 return ret;
774 error:
775 dbg("%s: failed=%d", __func__, ret);
776 return ret;
779 static int tda10071_get_frontend(struct dvb_frontend *fe)
781 struct tda10071_priv *priv = fe->demodulator_priv;
782 struct dtv_frontend_properties *c = &fe->dtv_property_cache;
783 int ret, i;
784 u8 buf[5], tmp;
786 if (!priv->warm || !(priv->fe_status & FE_HAS_LOCK)) {
787 ret = -EFAULT;
788 goto error;
791 ret = tda10071_rd_regs(priv, 0x30, buf, 5);
792 if (ret)
793 goto error;
795 tmp = buf[0] & 0x3f;
796 for (i = 0; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
797 if (tmp == TDA10071_MODCOD[i].val) {
798 c->modulation = TDA10071_MODCOD[i].modulation;
799 c->fec_inner = TDA10071_MODCOD[i].fec;
800 c->delivery_system = TDA10071_MODCOD[i].delivery_system;
804 switch ((buf[1] >> 0) & 0x01) {
805 case 0:
806 c->inversion = INVERSION_OFF;
807 break;
808 case 1:
809 c->inversion = INVERSION_ON;
810 break;
813 switch ((buf[1] >> 7) & 0x01) {
814 case 0:
815 c->pilot = PILOT_OFF;
816 break;
817 case 1:
818 c->pilot = PILOT_ON;
819 break;
822 c->frequency = (buf[2] << 16) | (buf[3] << 8) | (buf[4] << 0);
824 ret = tda10071_rd_regs(priv, 0x52, buf, 3);
825 if (ret)
826 goto error;
828 c->symbol_rate = (buf[0] << 16) | (buf[1] << 8) | (buf[2] << 0);
830 return ret;
831 error:
832 dbg("%s: failed=%d", __func__, ret);
833 return ret;
836 static int tda10071_init(struct dvb_frontend *fe)
838 struct tda10071_priv *priv = fe->demodulator_priv;
839 struct tda10071_cmd cmd;
840 int ret, i, len, remaining, fw_size;
841 const struct firmware *fw;
842 u8 *fw_file = TDA10071_DEFAULT_FIRMWARE;
843 u8 tmp, buf[4];
844 struct tda10071_reg_val_mask tab[] = {
845 { 0xcd, 0x00, 0x07 },
846 { 0x80, 0x00, 0x02 },
847 { 0xcd, 0x00, 0xc0 },
848 { 0xce, 0x00, 0x1b },
849 { 0x9d, 0x00, 0x01 },
850 { 0x9d, 0x00, 0x02 },
851 { 0x9e, 0x00, 0x01 },
852 { 0x87, 0x00, 0x80 },
853 { 0xce, 0x00, 0x08 },
854 { 0xce, 0x00, 0x10 },
856 struct tda10071_reg_val_mask tab2[] = {
857 { 0xf1, 0x70, 0xff },
858 { 0x88, priv->cfg.pll_multiplier, 0x3f },
859 { 0x89, 0x00, 0x10 },
860 { 0x89, 0x10, 0x10 },
861 { 0xc0, 0x01, 0x01 },
862 { 0xc0, 0x00, 0x01 },
863 { 0xe0, 0xff, 0xff },
864 { 0xe0, 0x00, 0xff },
865 { 0x96, 0x1e, 0x7e },
866 { 0x8b, 0x08, 0x08 },
867 { 0x8b, 0x00, 0x08 },
868 { 0x8f, 0x1a, 0x7e },
869 { 0x8c, 0x68, 0xff },
870 { 0x8d, 0x08, 0xff },
871 { 0x8e, 0x4c, 0xff },
872 { 0x8f, 0x01, 0x01 },
873 { 0x8b, 0x04, 0x04 },
874 { 0x8b, 0x00, 0x04 },
875 { 0x87, 0x05, 0x07 },
876 { 0x80, 0x00, 0x20 },
877 { 0xc8, 0x01, 0xff },
878 { 0xb4, 0x47, 0xff },
879 { 0xb5, 0x9c, 0xff },
880 { 0xb6, 0x7d, 0xff },
881 { 0xba, 0x00, 0x03 },
882 { 0xb7, 0x47, 0xff },
883 { 0xb8, 0x9c, 0xff },
884 { 0xb9, 0x7d, 0xff },
885 { 0xba, 0x00, 0x0c },
886 { 0xc8, 0x00, 0xff },
887 { 0xcd, 0x00, 0x04 },
888 { 0xcd, 0x00, 0x20 },
889 { 0xe8, 0x02, 0xff },
890 { 0xcf, 0x20, 0xff },
891 { 0x9b, 0xd7, 0xff },
892 { 0x9a, 0x01, 0x03 },
893 { 0xa8, 0x05, 0x0f },
894 { 0xa8, 0x65, 0xf0 },
895 { 0xa6, 0xa0, 0xf0 },
896 { 0x9d, 0x50, 0xfc },
897 { 0x9e, 0x20, 0xe0 },
898 { 0xa3, 0x1c, 0x7c },
899 { 0xd5, 0x03, 0x03 },
902 /* firmware status */
903 ret = tda10071_rd_reg(priv, 0x51, &tmp);
904 if (ret)
905 goto error;
907 if (!tmp) {
908 /* warm state - wake up device from sleep */
909 priv->warm = 1;
911 for (i = 0; i < ARRAY_SIZE(tab); i++) {
912 ret = tda10071_wr_reg_mask(priv, tab[i].reg,
913 tab[i].val, tab[i].mask);
914 if (ret)
915 goto error;
918 cmd.args[0x00] = CMD_SET_SLEEP_MODE;
919 cmd.args[0x01] = 0;
920 cmd.args[0x02] = 0;
921 cmd.len = 0x03;
922 ret = tda10071_cmd_execute(priv, &cmd);
923 if (ret)
924 goto error;
925 } else {
926 /* cold state - try to download firmware */
927 priv->warm = 0;
929 /* request the firmware, this will block and timeout */
930 ret = request_firmware(&fw, fw_file, priv->i2c->dev.parent);
931 if (ret) {
932 err("did not find the firmware file. (%s) "
933 "Please see linux/Documentation/dvb/ for more" \
934 " details on firmware-problems. (%d)",
935 fw_file, ret);
936 goto error;
939 /* init */
940 for (i = 0; i < ARRAY_SIZE(tab2); i++) {
941 ret = tda10071_wr_reg_mask(priv, tab2[i].reg,
942 tab2[i].val, tab2[i].mask);
943 if (ret)
944 goto error_release_firmware;
947 /* download firmware */
948 ret = tda10071_wr_reg(priv, 0xe0, 0x7f);
949 if (ret)
950 goto error_release_firmware;
952 ret = tda10071_wr_reg(priv, 0xf7, 0x81);
953 if (ret)
954 goto error_release_firmware;
956 ret = tda10071_wr_reg(priv, 0xf8, 0x00);
957 if (ret)
958 goto error_release_firmware;
960 ret = tda10071_wr_reg(priv, 0xf9, 0x00);
961 if (ret)
962 goto error_release_firmware;
964 info("found a '%s' in cold state, will try to load a firmware",
965 tda10071_ops.info.name);
967 info("downloading firmware from file '%s'", fw_file);
969 /* do not download last byte */
970 fw_size = fw->size - 1;
972 for (remaining = fw_size; remaining > 0;
973 remaining -= (priv->cfg.i2c_wr_max - 1)) {
974 len = remaining;
975 if (len > (priv->cfg.i2c_wr_max - 1))
976 len = (priv->cfg.i2c_wr_max - 1);
978 ret = tda10071_wr_regs(priv, 0xfa,
979 (u8 *) &fw->data[fw_size - remaining], len);
980 if (ret) {
981 err("firmware download failed=%d", ret);
982 if (ret)
983 goto error_release_firmware;
986 release_firmware(fw);
988 ret = tda10071_wr_reg(priv, 0xf7, 0x0c);
989 if (ret)
990 goto error;
992 ret = tda10071_wr_reg(priv, 0xe0, 0x00);
993 if (ret)
994 goto error;
996 /* wait firmware start */
997 msleep(250);
999 /* firmware status */
1000 ret = tda10071_rd_reg(priv, 0x51, &tmp);
1001 if (ret)
1002 goto error;
1004 if (tmp) {
1005 info("firmware did not run");
1006 ret = -EFAULT;
1007 goto error;
1008 } else {
1009 priv->warm = 1;
1012 cmd.args[0x00] = CMD_GET_FW_VERSION;
1013 cmd.len = 0x01;
1014 ret = tda10071_cmd_execute(priv, &cmd);
1015 if (ret)
1016 goto error;
1018 ret = tda10071_rd_regs(priv, cmd.len, buf, 4);
1019 if (ret)
1020 goto error;
1022 info("firmware version %d.%d.%d.%d",
1023 buf[0], buf[1], buf[2], buf[3]);
1024 info("found a '%s' in warm state.", tda10071_ops.info.name);
1026 ret = tda10071_rd_regs(priv, 0x81, buf, 2);
1027 if (ret)
1028 goto error;
1030 cmd.args[0x00] = CMD_DEMOD_INIT;
1031 cmd.args[0x01] = ((priv->cfg.xtal / 1000) >> 8) & 0xff;
1032 cmd.args[0x02] = ((priv->cfg.xtal / 1000) >> 0) & 0xff;
1033 cmd.args[0x03] = buf[0];
1034 cmd.args[0x04] = buf[1];
1035 cmd.args[0x05] = priv->cfg.pll_multiplier;
1036 cmd.args[0x06] = priv->cfg.spec_inv;
1037 cmd.args[0x07] = 0x00;
1038 cmd.len = 0x08;
1039 ret = tda10071_cmd_execute(priv, &cmd);
1040 if (ret)
1041 goto error;
1043 cmd.args[0x00] = CMD_TUNER_INIT;
1044 cmd.args[0x01] = 0x00;
1045 cmd.args[0x02] = 0x00;
1046 cmd.args[0x03] = 0x00;
1047 cmd.args[0x04] = 0x00;
1048 cmd.args[0x05] = 0x14;
1049 cmd.args[0x06] = 0x00;
1050 cmd.args[0x07] = 0x03;
1051 cmd.args[0x08] = 0x02;
1052 cmd.args[0x09] = 0x02;
1053 cmd.args[0x0a] = 0x00;
1054 cmd.args[0x0b] = 0x00;
1055 cmd.args[0x0c] = 0x00;
1056 cmd.args[0x0d] = 0x00;
1057 cmd.args[0x0e] = 0x00;
1058 cmd.len = 0x0f;
1059 ret = tda10071_cmd_execute(priv, &cmd);
1060 if (ret)
1061 goto error;
1063 cmd.args[0x00] = CMD_MPEG_CONFIG;
1064 cmd.args[0x01] = 0;
1065 cmd.args[0x02] = priv->cfg.ts_mode;
1066 cmd.args[0x03] = 0x00;
1067 cmd.args[0x04] = 0x04;
1068 cmd.args[0x05] = 0x00;
1069 cmd.len = 0x06;
1070 ret = tda10071_cmd_execute(priv, &cmd);
1071 if (ret)
1072 goto error;
1074 ret = tda10071_wr_reg_mask(priv, 0xf0, 0x01, 0x01);
1075 if (ret)
1076 goto error;
1078 cmd.args[0x00] = CMD_LNB_CONFIG;
1079 cmd.args[0x01] = 0;
1080 cmd.args[0x02] = 150;
1081 cmd.args[0x03] = 3;
1082 cmd.args[0x04] = 22;
1083 cmd.args[0x05] = 1;
1084 cmd.args[0x06] = 1;
1085 cmd.args[0x07] = 30;
1086 cmd.args[0x08] = 30;
1087 cmd.args[0x09] = 30;
1088 cmd.args[0x0a] = 30;
1089 cmd.len = 0x0b;
1090 ret = tda10071_cmd_execute(priv, &cmd);
1091 if (ret)
1092 goto error;
1094 cmd.args[0x00] = CMD_BER_CONTROL;
1095 cmd.args[0x01] = 0;
1096 cmd.args[0x02] = 14;
1097 cmd.args[0x03] = 14;
1098 cmd.len = 0x04;
1099 ret = tda10071_cmd_execute(priv, &cmd);
1100 if (ret)
1101 goto error;
1104 return ret;
1105 error_release_firmware:
1106 release_firmware(fw);
1107 error:
1108 dbg("%s: failed=%d", __func__, ret);
1109 return ret;
1112 static int tda10071_sleep(struct dvb_frontend *fe)
1114 struct tda10071_priv *priv = fe->demodulator_priv;
1115 struct tda10071_cmd cmd;
1116 int ret, i;
1117 struct tda10071_reg_val_mask tab[] = {
1118 { 0xcd, 0x07, 0x07 },
1119 { 0x80, 0x02, 0x02 },
1120 { 0xcd, 0xc0, 0xc0 },
1121 { 0xce, 0x1b, 0x1b },
1122 { 0x9d, 0x01, 0x01 },
1123 { 0x9d, 0x02, 0x02 },
1124 { 0x9e, 0x01, 0x01 },
1125 { 0x87, 0x80, 0x80 },
1126 { 0xce, 0x08, 0x08 },
1127 { 0xce, 0x10, 0x10 },
1130 if (!priv->warm) {
1131 ret = -EFAULT;
1132 goto error;
1135 cmd.args[0x00] = CMD_SET_SLEEP_MODE;
1136 cmd.args[0x01] = 0;
1137 cmd.args[0x02] = 1;
1138 cmd.len = 0x03;
1139 ret = tda10071_cmd_execute(priv, &cmd);
1140 if (ret)
1141 goto error;
1143 for (i = 0; i < ARRAY_SIZE(tab); i++) {
1144 ret = tda10071_wr_reg_mask(priv, tab[i].reg, tab[i].val,
1145 tab[i].mask);
1146 if (ret)
1147 goto error;
1150 return ret;
1151 error:
1152 dbg("%s: failed=%d", __func__, ret);
1153 return ret;
1156 static int tda10071_get_tune_settings(struct dvb_frontend *fe,
1157 struct dvb_frontend_tune_settings *s)
1159 s->min_delay_ms = 8000;
1160 s->step_size = 0;
1161 s->max_drift = 0;
1163 return 0;
1166 static void tda10071_release(struct dvb_frontend *fe)
1168 struct tda10071_priv *priv = fe->demodulator_priv;
1169 kfree(priv);
1172 struct dvb_frontend *tda10071_attach(const struct tda10071_config *config,
1173 struct i2c_adapter *i2c)
1175 int ret;
1176 struct tda10071_priv *priv = NULL;
1177 u8 tmp;
1179 /* allocate memory for the internal priv */
1180 priv = kzalloc(sizeof(struct tda10071_priv), GFP_KERNEL);
1181 if (priv == NULL) {
1182 ret = -ENOMEM;
1183 goto error;
1186 /* setup the priv */
1187 priv->i2c = i2c;
1188 memcpy(&priv->cfg, config, sizeof(struct tda10071_config));
1190 /* chip ID */
1191 ret = tda10071_rd_reg(priv, 0xff, &tmp);
1192 if (ret || tmp != 0x0f)
1193 goto error;
1195 /* chip type */
1196 ret = tda10071_rd_reg(priv, 0xdd, &tmp);
1197 if (ret || tmp != 0x00)
1198 goto error;
1200 /* chip version */
1201 ret = tda10071_rd_reg(priv, 0xfe, &tmp);
1202 if (ret || tmp != 0x01)
1203 goto error;
1205 /* create dvb_frontend */
1206 memcpy(&priv->fe.ops, &tda10071_ops, sizeof(struct dvb_frontend_ops));
1207 priv->fe.demodulator_priv = priv;
1209 return &priv->fe;
1210 error:
1211 dbg("%s: failed=%d", __func__, ret);
1212 kfree(priv);
1213 return NULL;
1215 EXPORT_SYMBOL(tda10071_attach);
1217 static struct dvb_frontend_ops tda10071_ops = {
1218 .delsys = { SYS_DVBS, SYS_DVBS2 },
1219 .info = {
1220 .name = "NXP TDA10071",
1221 .frequency_min = 950000,
1222 .frequency_max = 2150000,
1223 .frequency_tolerance = 5000,
1224 .symbol_rate_min = 1000000,
1225 .symbol_rate_max = 45000000,
1226 .caps = FE_CAN_INVERSION_AUTO |
1227 FE_CAN_FEC_1_2 |
1228 FE_CAN_FEC_2_3 |
1229 FE_CAN_FEC_3_4 |
1230 FE_CAN_FEC_4_5 |
1231 FE_CAN_FEC_5_6 |
1232 FE_CAN_FEC_6_7 |
1233 FE_CAN_FEC_7_8 |
1234 FE_CAN_FEC_8_9 |
1235 FE_CAN_FEC_AUTO |
1236 FE_CAN_QPSK |
1237 FE_CAN_RECOVER |
1238 FE_CAN_2G_MODULATION
1241 .release = tda10071_release,
1243 .get_tune_settings = tda10071_get_tune_settings,
1245 .init = tda10071_init,
1246 .sleep = tda10071_sleep,
1248 .set_frontend = tda10071_set_frontend,
1249 .get_frontend = tda10071_get_frontend,
1251 .read_status = tda10071_read_status,
1252 .read_snr = tda10071_read_snr,
1253 .read_signal_strength = tda10071_read_signal_strength,
1254 .read_ber = tda10071_read_ber,
1255 .read_ucblocks = tda10071_read_ucblocks,
1257 .diseqc_send_master_cmd = tda10071_diseqc_send_master_cmd,
1258 .diseqc_recv_slave_reply = tda10071_diseqc_recv_slave_reply,
1259 .diseqc_send_burst = tda10071_diseqc_send_burst,
1261 .set_tone = tda10071_set_tone,
1262 .set_voltage = tda10071_set_voltage,
1265 MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
1266 MODULE_DESCRIPTION("NXP TDA10071 DVB-S/S2 demodulator driver");
1267 MODULE_LICENSE("GPL");