Avoid beyond bounds copy while caching ACL
[zen-stable.git] / drivers / media / dvb / frontends / zl10353.c
blobac7237891374f68456d3c687c4924b11f04b654b
1 /*
2 * Driver for Zarlink DVB-T ZL10353 demodulator
4 * Copyright (C) 2006, 2007 Christopher Pascoe <c.pascoe@itee.uq.edu.au>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/delay.h>
26 #include <linux/string.h>
27 #include <linux/slab.h>
28 #include <asm/div64.h>
30 #include "dvb_frontend.h"
31 #include "zl10353_priv.h"
32 #include "zl10353.h"
34 struct zl10353_state {
35 struct i2c_adapter *i2c;
36 struct dvb_frontend frontend;
38 struct zl10353_config config;
40 u32 bandwidth;
41 u32 ucblocks;
42 u32 frequency;
45 static int debug;
46 #define dprintk(args...) \
47 do { \
48 if (debug) printk(KERN_DEBUG "zl10353: " args); \
49 } while (0)
51 static int debug_regs;
53 static int zl10353_single_write(struct dvb_frontend *fe, u8 reg, u8 val)
55 struct zl10353_state *state = fe->demodulator_priv;
56 u8 buf[2] = { reg, val };
57 struct i2c_msg msg = { .addr = state->config.demod_address, .flags = 0,
58 .buf = buf, .len = 2 };
59 int err = i2c_transfer(state->i2c, &msg, 1);
60 if (err != 1) {
61 printk("zl10353: write to reg %x failed (err = %d)!\n", reg, err);
62 return err;
64 return 0;
67 static int zl10353_write(struct dvb_frontend *fe, const u8 ibuf[], int ilen)
69 int err, i;
70 for (i = 0; i < ilen - 1; i++)
71 if ((err = zl10353_single_write(fe, ibuf[0] + i, ibuf[i + 1])))
72 return err;
74 return 0;
77 static int zl10353_read_register(struct zl10353_state *state, u8 reg)
79 int ret;
80 u8 b0[1] = { reg };
81 u8 b1[1] = { 0 };
82 struct i2c_msg msg[2] = { { .addr = state->config.demod_address,
83 .flags = 0,
84 .buf = b0, .len = 1 },
85 { .addr = state->config.demod_address,
86 .flags = I2C_M_RD,
87 .buf = b1, .len = 1 } };
89 ret = i2c_transfer(state->i2c, msg, 2);
91 if (ret != 2) {
92 printk("%s: readreg error (reg=%d, ret==%i)\n",
93 __func__, reg, ret);
94 return ret;
97 return b1[0];
100 static void zl10353_dump_regs(struct dvb_frontend *fe)
102 struct zl10353_state *state = fe->demodulator_priv;
103 int ret;
104 u8 reg;
106 /* Dump all registers. */
107 for (reg = 0; ; reg++) {
108 if (reg % 16 == 0) {
109 if (reg)
110 printk(KERN_CONT "\n");
111 printk(KERN_DEBUG "%02x:", reg);
113 ret = zl10353_read_register(state, reg);
114 if (ret >= 0)
115 printk(KERN_CONT " %02x", (u8)ret);
116 else
117 printk(KERN_CONT " --");
118 if (reg == 0xff)
119 break;
121 printk(KERN_CONT "\n");
124 static void zl10353_calc_nominal_rate(struct dvb_frontend *fe,
125 u32 bandwidth,
126 u16 *nominal_rate)
128 struct zl10353_state *state = fe->demodulator_priv;
129 u32 adc_clock = 450560; /* 45.056 MHz */
130 u64 value;
131 u8 bw = bandwidth / 1000000;
133 if (state->config.adc_clock)
134 adc_clock = state->config.adc_clock;
136 value = (u64)10 * (1 << 23) / 7 * 125;
137 value = (bw * value) + adc_clock / 2;
138 do_div(value, adc_clock);
139 *nominal_rate = value;
141 dprintk("%s: bw %d, adc_clock %d => 0x%x\n",
142 __func__, bw, adc_clock, *nominal_rate);
145 static void zl10353_calc_input_freq(struct dvb_frontend *fe,
146 u16 *input_freq)
148 struct zl10353_state *state = fe->demodulator_priv;
149 u32 adc_clock = 450560; /* 45.056 MHz */
150 int if2 = 361667; /* 36.1667 MHz */
151 int ife;
152 u64 value;
154 if (state->config.adc_clock)
155 adc_clock = state->config.adc_clock;
156 if (state->config.if2)
157 if2 = state->config.if2;
159 if (adc_clock >= if2 * 2)
160 ife = if2;
161 else {
162 ife = adc_clock - (if2 % adc_clock);
163 if (ife > adc_clock / 2)
164 ife = adc_clock - ife;
166 value = (u64)65536 * ife + adc_clock / 2;
167 do_div(value, adc_clock);
168 *input_freq = -value;
170 dprintk("%s: if2 %d, ife %d, adc_clock %d => %d / 0x%x\n",
171 __func__, if2, ife, adc_clock, -(int)value, *input_freq);
174 static int zl10353_sleep(struct dvb_frontend *fe)
176 static u8 zl10353_softdown[] = { 0x50, 0x0C, 0x44 };
178 zl10353_write(fe, zl10353_softdown, sizeof(zl10353_softdown));
179 return 0;
182 static int zl10353_set_parameters(struct dvb_frontend *fe)
184 struct dtv_frontend_properties *c = &fe->dtv_property_cache;
185 struct zl10353_state *state = fe->demodulator_priv;
186 u16 nominal_rate, input_freq;
187 u8 pllbuf[6] = { 0x67 }, acq_ctl = 0;
188 u16 tps = 0;
190 state->frequency = c->frequency;
192 zl10353_single_write(fe, RESET, 0x80);
193 udelay(200);
194 zl10353_single_write(fe, 0xEA, 0x01);
195 udelay(200);
196 zl10353_single_write(fe, 0xEA, 0x00);
198 zl10353_single_write(fe, AGC_TARGET, 0x28);
200 if (c->transmission_mode != TRANSMISSION_MODE_AUTO)
201 acq_ctl |= (1 << 0);
202 if (c->guard_interval != GUARD_INTERVAL_AUTO)
203 acq_ctl |= (1 << 1);
204 zl10353_single_write(fe, ACQ_CTL, acq_ctl);
206 switch (c->bandwidth_hz) {
207 case 6000000:
208 /* These are extrapolated from the 7 and 8MHz values */
209 zl10353_single_write(fe, MCLK_RATIO, 0x97);
210 zl10353_single_write(fe, 0x64, 0x34);
211 zl10353_single_write(fe, 0xcc, 0xdd);
212 break;
213 case 7000000:
214 zl10353_single_write(fe, MCLK_RATIO, 0x86);
215 zl10353_single_write(fe, 0x64, 0x35);
216 zl10353_single_write(fe, 0xcc, 0x73);
217 break;
218 default:
219 c->bandwidth_hz = 8000000;
220 /* fall though */
221 case 8000000:
222 zl10353_single_write(fe, MCLK_RATIO, 0x75);
223 zl10353_single_write(fe, 0x64, 0x36);
224 zl10353_single_write(fe, 0xcc, 0x73);
227 zl10353_calc_nominal_rate(fe, c->bandwidth_hz, &nominal_rate);
228 zl10353_single_write(fe, TRL_NOMINAL_RATE_1, msb(nominal_rate));
229 zl10353_single_write(fe, TRL_NOMINAL_RATE_0, lsb(nominal_rate));
230 state->bandwidth = c->bandwidth_hz;
232 zl10353_calc_input_freq(fe, &input_freq);
233 zl10353_single_write(fe, INPUT_FREQ_1, msb(input_freq));
234 zl10353_single_write(fe, INPUT_FREQ_0, lsb(input_freq));
236 /* Hint at TPS settings */
237 switch (c->code_rate_HP) {
238 case FEC_2_3:
239 tps |= (1 << 7);
240 break;
241 case FEC_3_4:
242 tps |= (2 << 7);
243 break;
244 case FEC_5_6:
245 tps |= (3 << 7);
246 break;
247 case FEC_7_8:
248 tps |= (4 << 7);
249 break;
250 case FEC_1_2:
251 case FEC_AUTO:
252 break;
253 default:
254 return -EINVAL;
257 switch (c->code_rate_LP) {
258 case FEC_2_3:
259 tps |= (1 << 4);
260 break;
261 case FEC_3_4:
262 tps |= (2 << 4);
263 break;
264 case FEC_5_6:
265 tps |= (3 << 4);
266 break;
267 case FEC_7_8:
268 tps |= (4 << 4);
269 break;
270 case FEC_1_2:
271 case FEC_AUTO:
272 break;
273 case FEC_NONE:
274 if (c->hierarchy == HIERARCHY_AUTO ||
275 c->hierarchy == HIERARCHY_NONE)
276 break;
277 default:
278 return -EINVAL;
281 switch (c->modulation) {
282 case QPSK:
283 break;
284 case QAM_AUTO:
285 case QAM_16:
286 tps |= (1 << 13);
287 break;
288 case QAM_64:
289 tps |= (2 << 13);
290 break;
291 default:
292 return -EINVAL;
295 switch (c->transmission_mode) {
296 case TRANSMISSION_MODE_2K:
297 case TRANSMISSION_MODE_AUTO:
298 break;
299 case TRANSMISSION_MODE_8K:
300 tps |= (1 << 0);
301 break;
302 default:
303 return -EINVAL;
306 switch (c->guard_interval) {
307 case GUARD_INTERVAL_1_32:
308 case GUARD_INTERVAL_AUTO:
309 break;
310 case GUARD_INTERVAL_1_16:
311 tps |= (1 << 2);
312 break;
313 case GUARD_INTERVAL_1_8:
314 tps |= (2 << 2);
315 break;
316 case GUARD_INTERVAL_1_4:
317 tps |= (3 << 2);
318 break;
319 default:
320 return -EINVAL;
323 switch (c->hierarchy) {
324 case HIERARCHY_AUTO:
325 case HIERARCHY_NONE:
326 break;
327 case HIERARCHY_1:
328 tps |= (1 << 10);
329 break;
330 case HIERARCHY_2:
331 tps |= (2 << 10);
332 break;
333 case HIERARCHY_4:
334 tps |= (3 << 10);
335 break;
336 default:
337 return -EINVAL;
340 zl10353_single_write(fe, TPS_GIVEN_1, msb(tps));
341 zl10353_single_write(fe, TPS_GIVEN_0, lsb(tps));
343 if (fe->ops.i2c_gate_ctrl)
344 fe->ops.i2c_gate_ctrl(fe, 0);
347 * If there is no tuner attached to the secondary I2C bus, we call
348 * set_params to program a potential tuner attached somewhere else.
349 * Otherwise, we update the PLL registers via calc_regs.
351 if (state->config.no_tuner) {
352 if (fe->ops.tuner_ops.set_params) {
353 fe->ops.tuner_ops.set_params(fe);
354 if (fe->ops.i2c_gate_ctrl)
355 fe->ops.i2c_gate_ctrl(fe, 0);
357 } else if (fe->ops.tuner_ops.calc_regs) {
358 fe->ops.tuner_ops.calc_regs(fe, pllbuf + 1, 5);
359 pllbuf[1] <<= 1;
360 zl10353_write(fe, pllbuf, sizeof(pllbuf));
363 zl10353_single_write(fe, 0x5F, 0x13);
365 /* If no attached tuner or invalid PLL registers, just start the FSM. */
366 if (state->config.no_tuner || fe->ops.tuner_ops.calc_regs == NULL)
367 zl10353_single_write(fe, FSM_GO, 0x01);
368 else
369 zl10353_single_write(fe, TUNER_GO, 0x01);
371 return 0;
374 static int zl10353_get_parameters(struct dvb_frontend *fe)
376 struct dtv_frontend_properties *c = &fe->dtv_property_cache;
377 struct zl10353_state *state = fe->demodulator_priv;
378 int s6, s9;
379 u16 tps;
380 static const u8 tps_fec_to_api[8] = {
381 FEC_1_2,
382 FEC_2_3,
383 FEC_3_4,
384 FEC_5_6,
385 FEC_7_8,
386 FEC_AUTO,
387 FEC_AUTO,
388 FEC_AUTO
391 s6 = zl10353_read_register(state, STATUS_6);
392 s9 = zl10353_read_register(state, STATUS_9);
393 if (s6 < 0 || s9 < 0)
394 return -EREMOTEIO;
395 if ((s6 & (1 << 5)) == 0 || (s9 & (1 << 4)) == 0)
396 return -EINVAL; /* no FE or TPS lock */
398 tps = zl10353_read_register(state, TPS_RECEIVED_1) << 8 |
399 zl10353_read_register(state, TPS_RECEIVED_0);
401 c->code_rate_HP = tps_fec_to_api[(tps >> 7) & 7];
402 c->code_rate_LP = tps_fec_to_api[(tps >> 4) & 7];
404 switch ((tps >> 13) & 3) {
405 case 0:
406 c->modulation = QPSK;
407 break;
408 case 1:
409 c->modulation = QAM_16;
410 break;
411 case 2:
412 c->modulation = QAM_64;
413 break;
414 default:
415 c->modulation = QAM_AUTO;
416 break;
419 c->transmission_mode = (tps & 0x01) ? TRANSMISSION_MODE_8K :
420 TRANSMISSION_MODE_2K;
422 switch ((tps >> 2) & 3) {
423 case 0:
424 c->guard_interval = GUARD_INTERVAL_1_32;
425 break;
426 case 1:
427 c->guard_interval = GUARD_INTERVAL_1_16;
428 break;
429 case 2:
430 c->guard_interval = GUARD_INTERVAL_1_8;
431 break;
432 case 3:
433 c->guard_interval = GUARD_INTERVAL_1_4;
434 break;
435 default:
436 c->guard_interval = GUARD_INTERVAL_AUTO;
437 break;
440 switch ((tps >> 10) & 7) {
441 case 0:
442 c->hierarchy = HIERARCHY_NONE;
443 break;
444 case 1:
445 c->hierarchy = HIERARCHY_1;
446 break;
447 case 2:
448 c->hierarchy = HIERARCHY_2;
449 break;
450 case 3:
451 c->hierarchy = HIERARCHY_4;
452 break;
453 default:
454 c->hierarchy = HIERARCHY_AUTO;
455 break;
458 c->frequency = state->frequency;
459 c->bandwidth_hz = state->bandwidth;
460 c->inversion = INVERSION_AUTO;
462 return 0;
465 static int zl10353_read_status(struct dvb_frontend *fe, fe_status_t *status)
467 struct zl10353_state *state = fe->demodulator_priv;
468 int s6, s7, s8;
470 if ((s6 = zl10353_read_register(state, STATUS_6)) < 0)
471 return -EREMOTEIO;
472 if ((s7 = zl10353_read_register(state, STATUS_7)) < 0)
473 return -EREMOTEIO;
474 if ((s8 = zl10353_read_register(state, STATUS_8)) < 0)
475 return -EREMOTEIO;
477 *status = 0;
478 if (s6 & (1 << 2))
479 *status |= FE_HAS_CARRIER;
480 if (s6 & (1 << 1))
481 *status |= FE_HAS_VITERBI;
482 if (s6 & (1 << 5))
483 *status |= FE_HAS_LOCK;
484 if (s7 & (1 << 4))
485 *status |= FE_HAS_SYNC;
486 if (s8 & (1 << 6))
487 *status |= FE_HAS_SIGNAL;
489 if ((*status & (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC)) !=
490 (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC))
491 *status &= ~FE_HAS_LOCK;
493 return 0;
496 static int zl10353_read_ber(struct dvb_frontend *fe, u32 *ber)
498 struct zl10353_state *state = fe->demodulator_priv;
500 *ber = zl10353_read_register(state, RS_ERR_CNT_2) << 16 |
501 zl10353_read_register(state, RS_ERR_CNT_1) << 8 |
502 zl10353_read_register(state, RS_ERR_CNT_0);
504 return 0;
507 static int zl10353_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
509 struct zl10353_state *state = fe->demodulator_priv;
511 u16 signal = zl10353_read_register(state, AGC_GAIN_1) << 10 |
512 zl10353_read_register(state, AGC_GAIN_0) << 2 | 3;
514 *strength = ~signal;
516 return 0;
519 static int zl10353_read_snr(struct dvb_frontend *fe, u16 *snr)
521 struct zl10353_state *state = fe->demodulator_priv;
522 u8 _snr;
524 if (debug_regs)
525 zl10353_dump_regs(fe);
527 _snr = zl10353_read_register(state, SNR);
528 *snr = (_snr << 8) | _snr;
530 return 0;
533 static int zl10353_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
535 struct zl10353_state *state = fe->demodulator_priv;
536 u32 ubl = 0;
538 ubl = zl10353_read_register(state, RS_UBC_1) << 8 |
539 zl10353_read_register(state, RS_UBC_0);
541 state->ucblocks += ubl;
542 *ucblocks = state->ucblocks;
544 return 0;
547 static int zl10353_get_tune_settings(struct dvb_frontend *fe,
548 struct dvb_frontend_tune_settings
549 *fe_tune_settings)
551 fe_tune_settings->min_delay_ms = 1000;
552 fe_tune_settings->step_size = 0;
553 fe_tune_settings->max_drift = 0;
555 return 0;
558 static int zl10353_init(struct dvb_frontend *fe)
560 struct zl10353_state *state = fe->demodulator_priv;
561 u8 zl10353_reset_attach[6] = { 0x50, 0x03, 0x64, 0x46, 0x15, 0x0F };
562 int rc = 0;
564 if (debug_regs)
565 zl10353_dump_regs(fe);
566 if (state->config.parallel_ts)
567 zl10353_reset_attach[2] &= ~0x20;
568 if (state->config.clock_ctl_1)
569 zl10353_reset_attach[3] = state->config.clock_ctl_1;
570 if (state->config.pll_0)
571 zl10353_reset_attach[4] = state->config.pll_0;
573 /* Do a "hard" reset if not already done */
574 if (zl10353_read_register(state, 0x50) != zl10353_reset_attach[1] ||
575 zl10353_read_register(state, 0x51) != zl10353_reset_attach[2]) {
576 rc = zl10353_write(fe, zl10353_reset_attach,
577 sizeof(zl10353_reset_attach));
578 if (debug_regs)
579 zl10353_dump_regs(fe);
582 return 0;
585 static int zl10353_i2c_gate_ctrl(struct dvb_frontend* fe, int enable)
587 struct zl10353_state *state = fe->demodulator_priv;
588 u8 val = 0x0a;
590 if (state->config.disable_i2c_gate_ctrl) {
591 /* No tuner attached to the internal I2C bus */
592 /* If set enable I2C bridge, the main I2C bus stopped hardly */
593 return 0;
596 if (enable)
597 val |= 0x10;
599 return zl10353_single_write(fe, 0x62, val);
602 static void zl10353_release(struct dvb_frontend *fe)
604 struct zl10353_state *state = fe->demodulator_priv;
605 kfree(state);
608 static struct dvb_frontend_ops zl10353_ops;
610 struct dvb_frontend *zl10353_attach(const struct zl10353_config *config,
611 struct i2c_adapter *i2c)
613 struct zl10353_state *state = NULL;
614 int id;
616 /* allocate memory for the internal state */
617 state = kzalloc(sizeof(struct zl10353_state), GFP_KERNEL);
618 if (state == NULL)
619 goto error;
621 /* setup the state */
622 state->i2c = i2c;
623 memcpy(&state->config, config, sizeof(struct zl10353_config));
625 /* check if the demod is there */
626 id = zl10353_read_register(state, CHIP_ID);
627 if ((id != ID_ZL10353) && (id != ID_CE6230) && (id != ID_CE6231))
628 goto error;
630 /* create dvb_frontend */
631 memcpy(&state->frontend.ops, &zl10353_ops, sizeof(struct dvb_frontend_ops));
632 state->frontend.demodulator_priv = state;
634 return &state->frontend;
635 error:
636 kfree(state);
637 return NULL;
640 static struct dvb_frontend_ops zl10353_ops = {
641 .delsys = { SYS_DVBT },
642 .info = {
643 .name = "Zarlink ZL10353 DVB-T",
644 .frequency_min = 174000000,
645 .frequency_max = 862000000,
646 .frequency_stepsize = 166667,
647 .frequency_tolerance = 0,
648 .caps = FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 |
649 FE_CAN_FEC_3_4 | FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 |
650 FE_CAN_FEC_AUTO |
651 FE_CAN_QPSK | FE_CAN_QAM_16 | FE_CAN_QAM_64 | FE_CAN_QAM_AUTO |
652 FE_CAN_TRANSMISSION_MODE_AUTO | FE_CAN_GUARD_INTERVAL_AUTO |
653 FE_CAN_HIERARCHY_AUTO | FE_CAN_RECOVER |
654 FE_CAN_MUTE_TS
657 .release = zl10353_release,
659 .init = zl10353_init,
660 .sleep = zl10353_sleep,
661 .i2c_gate_ctrl = zl10353_i2c_gate_ctrl,
662 .write = zl10353_write,
664 .set_frontend = zl10353_set_parameters,
665 .get_frontend = zl10353_get_parameters,
666 .get_tune_settings = zl10353_get_tune_settings,
668 .read_status = zl10353_read_status,
669 .read_ber = zl10353_read_ber,
670 .read_signal_strength = zl10353_read_signal_strength,
671 .read_snr = zl10353_read_snr,
672 .read_ucblocks = zl10353_read_ucblocks,
675 module_param(debug, int, 0644);
676 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
678 module_param(debug_regs, int, 0644);
679 MODULE_PARM_DESC(debug_regs, "Turn on/off frontend register dumps (default:off).");
681 MODULE_DESCRIPTION("Zarlink ZL10353 DVB-T demodulator driver");
682 MODULE_AUTHOR("Chris Pascoe");
683 MODULE_LICENSE("GPL");
685 EXPORT_SYMBOL(zl10353_attach);