1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * FireDTV driver (formerly known as FireSAT)
4 *
5 * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
6 * Copyright (C) 2008 Ben Backx <ben@bbackx.com>
7 * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
8 */
9
10#include <linux/bug.h>
11#include <linux/crc32.h>
12#include <linux/delay.h>
13#include <linux/device.h>
14#include <linux/jiffies.h>
15#include <linux/kernel.h>
16#include <linux/moduleparam.h>
17#include <linux/mutex.h>
18#include <linux/string.h>
19#include <linux/stringify.h>
20#include <linux/wait.h>
21#include <linux/workqueue.h>
22
23#include <media/dvb_frontend.h>
24
25#include "firedtv.h"
26
27#define FCP_COMMAND_REGISTER		0xfffff0000b00ULL
28
29#define AVC_CTYPE_CONTROL		0x0
30#define AVC_CTYPE_STATUS		0x1
31#define AVC_CTYPE_NOTIFY		0x3
32
33#define AVC_RESPONSE_ACCEPTED		0x9
34#define AVC_RESPONSE_STABLE		0xc
35#define AVC_RESPONSE_CHANGED		0xd
36#define AVC_RESPONSE_INTERIM		0xf
37
38#define AVC_SUBUNIT_TYPE_TUNER		(0x05 << 3)
39#define AVC_SUBUNIT_TYPE_UNIT		(0x1f << 3)
40
41#define AVC_OPCODE_VENDOR		0x00
42#define AVC_OPCODE_READ_DESCRIPTOR	0x09
43#define AVC_OPCODE_DSIT			0xc8
44#define AVC_OPCODE_DSD			0xcb
45
46#define DESCRIPTOR_TUNER_STATUS		0x80
47#define DESCRIPTOR_SUBUNIT_IDENTIFIER	0x00
48
49#define SFE_VENDOR_DE_COMPANYID_0	0x00 /* OUI of Digital Everywhere */
50#define SFE_VENDOR_DE_COMPANYID_1	0x12
51#define SFE_VENDOR_DE_COMPANYID_2	0x87
52
53#define SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL 0x0a
54#define SFE_VENDOR_OPCODE_LNB_CONTROL		0x52
55#define SFE_VENDOR_OPCODE_TUNE_QPSK		0x58 /* for DVB-S */
56
57#define SFE_VENDOR_OPCODE_GET_FIRMWARE_VERSION	0x00
58#define SFE_VENDOR_OPCODE_HOST2CA		0x56
59#define SFE_VENDOR_OPCODE_CA2HOST		0x57
60#define SFE_VENDOR_OPCODE_CISTATUS		0x59
61#define SFE_VENDOR_OPCODE_TUNE_QPSK2		0x60 /* for DVB-S2 */
62
63#define SFE_VENDOR_TAG_CA_RESET			0x00
64#define SFE_VENDOR_TAG_CA_APPLICATION_INFO	0x01
65#define SFE_VENDOR_TAG_CA_PMT			0x02
66#define SFE_VENDOR_TAG_CA_DATE_TIME		0x04
67#define SFE_VENDOR_TAG_CA_MMI			0x05
68#define SFE_VENDOR_TAG_CA_ENTER_MENU		0x07
69
70#define EN50221_LIST_MANAGEMENT_ONLY	0x03
71#define EN50221_TAG_APP_INFO		0x9f8021
72#define EN50221_TAG_CA_INFO		0x9f8031
73
74struct avc_command_frame {
75	u8 ctype;
76	u8 subunit;
77	u8 opcode;
78	u8 operand[509];
79};
80
81struct avc_response_frame {
82	u8 response;
83	u8 subunit;
84	u8 opcode;
85	u8 operand[509];
86};
87
88#define LAST_OPERAND (509 - 1)
89
90static inline void clear_operands(struct avc_command_frame *c, int from, int to)
91{
92	memset(&c->operand[from], 0, to - from + 1);
93}
94
95static void pad_operands(struct avc_command_frame *c, int from)
96{
97	int to = ALIGN(from, 4);
98
99	if (from <= to && to <= LAST_OPERAND)
100		clear_operands(c, from, to);
101}
102
103#define AVC_DEBUG_READ_DESCRIPTOR              0x0001
104#define AVC_DEBUG_DSIT                         0x0002
105#define AVC_DEBUG_DSD                          0x0004
106#define AVC_DEBUG_REGISTER_REMOTE_CONTROL      0x0008
107#define AVC_DEBUG_LNB_CONTROL                  0x0010
108#define AVC_DEBUG_TUNE_QPSK                    0x0020
109#define AVC_DEBUG_TUNE_QPSK2                   0x0040
110#define AVC_DEBUG_HOST2CA                      0x0080
111#define AVC_DEBUG_CA2HOST                      0x0100
112#define AVC_DEBUG_APPLICATION_PMT              0x4000
113#define AVC_DEBUG_FCP_PAYLOADS                 0x8000
114
115static int avc_debug;
116module_param_named(debug, avc_debug, int, 0644);
117MODULE_PARM_DESC(debug, "Verbose logging (none = 0"
118	", FCP subactions"
119	": READ DESCRIPTOR = "		__stringify(AVC_DEBUG_READ_DESCRIPTOR)
120	", DSIT = "			__stringify(AVC_DEBUG_DSIT)
121	", REGISTER_REMOTE_CONTROL = "	__stringify(AVC_DEBUG_REGISTER_REMOTE_CONTROL)
122	", LNB CONTROL = "		__stringify(AVC_DEBUG_LNB_CONTROL)
123	", TUNE QPSK = "		__stringify(AVC_DEBUG_TUNE_QPSK)
124	", TUNE QPSK2 = "		__stringify(AVC_DEBUG_TUNE_QPSK2)
125	", HOST2CA = "			__stringify(AVC_DEBUG_HOST2CA)
126	", CA2HOST = "			__stringify(AVC_DEBUG_CA2HOST)
127	"; Application sent PMT = "	__stringify(AVC_DEBUG_APPLICATION_PMT)
128	", FCP payloads = "		__stringify(AVC_DEBUG_FCP_PAYLOADS)
129	", or a combination, or all = -1)");
130
131/*
132 * This is a workaround since there is no vendor specific command to retrieve
133 * ca_info using AVC. If this parameter is not used, ca_system_id will be
134 * filled with application_manufacturer from ca_app_info.
135 * Digital Everywhere have said that adding ca_info is on their TODO list.
136 */
137static unsigned int num_fake_ca_system_ids;
138static int fake_ca_system_ids[4] = { -1, -1, -1, -1 };
139module_param_array(fake_ca_system_ids, int, &num_fake_ca_system_ids, 0644);
140MODULE_PARM_DESC(fake_ca_system_ids, "If your CAM application manufacturer "
141		 "does not have the same ca_system_id as your CAS, you can "
142		 "override what ca_system_ids are presented to the "
143		 "application by setting this field to an array of ids.");
144
145static const char *debug_fcp_ctype(unsigned int ctype)
146{
147	static const char *ctypes[] = {
148		[0x0] = "CONTROL",		[0x1] = "STATUS",
149		[0x2] = "SPECIFIC INQUIRY",	[0x3] = "NOTIFY",
150		[0x4] = "GENERAL INQUIRY",	[0x8] = "NOT IMPLEMENTED",
151		[0x9] = "ACCEPTED",		[0xa] = "REJECTED",
152		[0xb] = "IN TRANSITION",	[0xc] = "IMPLEMENTED/STABLE",
153		[0xd] = "CHANGED",		[0xf] = "INTERIM",
154	};
155	const char *ret = ctype < ARRAY_SIZE(ctypes) ? ctypes[ctype] : NULL;
156
157	return ret ? ret : "?";
158}
159
160static const char *debug_fcp_opcode(unsigned int opcode,
161				    const u8 *data, int length)
162{
163	switch (opcode) {
164	case AVC_OPCODE_VENDOR:
165		break;
166	case AVC_OPCODE_READ_DESCRIPTOR:
167		return avc_debug & AVC_DEBUG_READ_DESCRIPTOR ?
168				"ReadDescriptor" : NULL;
169	case AVC_OPCODE_DSIT:
170		return avc_debug & AVC_DEBUG_DSIT ?
171				"DirectSelectInfo.Type" : NULL;
172	case AVC_OPCODE_DSD:
173		return avc_debug & AVC_DEBUG_DSD ? "DirectSelectData" : NULL;
174	default:
175		return "Unknown";
176	}
177
178	if (length < 7 ||
179	    data[3] != SFE_VENDOR_DE_COMPANYID_0 ||
180	    data[4] != SFE_VENDOR_DE_COMPANYID_1 ||
181	    data[5] != SFE_VENDOR_DE_COMPANYID_2)
182		return "Vendor/Unknown";
183
184	switch (data[6]) {
185	case SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL:
186		return avc_debug & AVC_DEBUG_REGISTER_REMOTE_CONTROL ?
187				"RegisterRC" : NULL;
188	case SFE_VENDOR_OPCODE_LNB_CONTROL:
189		return avc_debug & AVC_DEBUG_LNB_CONTROL ? "LNBControl" : NULL;
190	case SFE_VENDOR_OPCODE_TUNE_QPSK:
191		return avc_debug & AVC_DEBUG_TUNE_QPSK ? "TuneQPSK" : NULL;
192	case SFE_VENDOR_OPCODE_TUNE_QPSK2:
193		return avc_debug & AVC_DEBUG_TUNE_QPSK2 ? "TuneQPSK2" : NULL;
194	case SFE_VENDOR_OPCODE_HOST2CA:
195		return avc_debug & AVC_DEBUG_HOST2CA ? "Host2CA" : NULL;
196	case SFE_VENDOR_OPCODE_CA2HOST:
197		return avc_debug & AVC_DEBUG_CA2HOST ? "CA2Host" : NULL;
198	}
199	return "Vendor/Unknown";
200}
201
202static void debug_fcp(const u8 *data, int length)
203{
204	unsigned int subunit_type, subunit_id, opcode;
205	const char *op, *prefix;
206
207	prefix       = data[0] > 7 ? "FCP <- " : "FCP -> ";
208	subunit_type = data[1] >> 3;
209	subunit_id   = data[1] & 7;
210	opcode       = subunit_type == 0x1e || subunit_id == 5 ? ~0 : data[2];
211	op           = debug_fcp_opcode(opcode, data, length);
212
213	if (op) {
214		printk(KERN_INFO "%ssu=%x.%x l=%d: %-8s - %s\n",
215		       prefix, subunit_type, subunit_id, length,
216		       debug_fcp_ctype(data[0]), op);
217		if (avc_debug & AVC_DEBUG_FCP_PAYLOADS)
218			print_hex_dump(KERN_INFO, prefix, DUMP_PREFIX_NONE,
219				       16, 1, data, length, false);
220	}
221}
222
223static void debug_pmt(char *msg, int length)
224{
225	printk(KERN_INFO "APP PMT -> l=%d\n", length);
226	print_hex_dump(KERN_INFO, "APP PMT -> ", DUMP_PREFIX_NONE,
227		       16, 1, msg, length, false);
228}
229
230static int avc_write(struct firedtv *fdtv)
231{
232	int err, retry;
233
234	fdtv->avc_reply_received = false;
235
236	for (retry = 0; retry < 6; retry++) {
237		if (unlikely(avc_debug))
238			debug_fcp(fdtv->avc_data, fdtv->avc_data_length);
239
240		err = fdtv_write(fdtv, FCP_COMMAND_REGISTER,
241				 fdtv->avc_data, fdtv->avc_data_length);
242		if (err) {
243			dev_err(fdtv->device, "FCP command write failed\n");
244
245			return err;
246		}
247
248		/*
249		 * AV/C specs say that answers should be sent within 150 ms.
250		 * Time out after 200 ms.
251		 */
252		if (wait_event_timeout(fdtv->avc_wait,
253				       fdtv->avc_reply_received,
254				       msecs_to_jiffies(200)) != 0)
255			return 0;
256	}
257	dev_err(fdtv->device, "FCP response timed out\n");
258
259	return -ETIMEDOUT;
260}
261
262static bool is_register_rc(struct avc_response_frame *r)
263{
264	return r->opcode     == AVC_OPCODE_VENDOR &&
265	       r->operand[0] == SFE_VENDOR_DE_COMPANYID_0 &&
266	       r->operand[1] == SFE_VENDOR_DE_COMPANYID_1 &&
267	       r->operand[2] == SFE_VENDOR_DE_COMPANYID_2 &&
268	       r->operand[3] == SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL;
269}
270
271int avc_recv(struct firedtv *fdtv, void *data, size_t length)
272{
273	struct avc_response_frame *r = data;
274
275	if (unlikely(avc_debug))
276		debug_fcp(data, length);
277
278	if (length >= 8 && is_register_rc(r)) {
279		switch (r->response) {
280		case AVC_RESPONSE_CHANGED:
281			fdtv_handle_rc(fdtv, r->operand[4] << 8 | r->operand[5]);
282			schedule_work(&fdtv->remote_ctrl_work);
283			break;
284		case AVC_RESPONSE_INTERIM:
285			if (is_register_rc((void *)fdtv->avc_data))
286				goto wake;
287			break;
288		default:
289			dev_info(fdtv->device,
290				 "remote control result = %d\n", r->response);
291		}
292		return 0;
293	}
294
295	if (fdtv->avc_reply_received) {
296		dev_err(fdtv->device, "out-of-order AVC response, ignored\n");
297		return -EIO;
298	}
299
300	memcpy(fdtv->avc_data, data, length);
301	fdtv->avc_data_length = length;
302wake:
303	fdtv->avc_reply_received = true;
304	wake_up(&fdtv->avc_wait);
305
306	return 0;
307}
308
309static int add_pid_filter(struct firedtv *fdtv, u8 *operand)
310{
311	int i, n, pos = 1;
312
313	for (i = 0, n = 0; i < 16; i++) {
314		if (test_bit(i, &fdtv->channel_active)) {
315			operand[pos++] = 0x13; /* flowfunction relay */
316			operand[pos++] = 0x80; /* dsd_sel_spec_valid_flags -> PID */
317			operand[pos++] = (fdtv->channel_pid[i] >> 8) & 0x1f;
318			operand[pos++] = fdtv->channel_pid[i] & 0xff;
319			operand[pos++] = 0x00; /* tableID */
320			operand[pos++] = 0x00; /* filter_length */
321			n++;
322		}
323	}
324	operand[0] = n;
325
326	return pos;
327}
328
329/*
330 * tuning command for setting the relative LNB frequency
331 * (not supported by the AVC standard)
332 */
333static int avc_tuner_tuneqpsk(struct firedtv *fdtv,
334			      struct dtv_frontend_properties *p)
335{
336	struct avc_command_frame *c = (void *)fdtv->avc_data;
337
338	c->opcode = AVC_OPCODE_VENDOR;
339
340	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
341	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
342	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
343	if (fdtv->type == FIREDTV_DVB_S2)
344		c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK2;
345	else
346		c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
347
348	c->operand[4] = (p->frequency >> 24) & 0xff;
349	c->operand[5] = (p->frequency >> 16) & 0xff;
350	c->operand[6] = (p->frequency >> 8) & 0xff;
351	c->operand[7] = p->frequency & 0xff;
352
353	c->operand[8] = ((p->symbol_rate / 1000) >> 8) & 0xff;
354	c->operand[9] = (p->symbol_rate / 1000) & 0xff;
355
356	switch (p->fec_inner) {
357	case FEC_1_2:	c->operand[10] = 0x1; break;
358	case FEC_2_3:	c->operand[10] = 0x2; break;
359	case FEC_3_4:	c->operand[10] = 0x3; break;
360	case FEC_5_6:	c->operand[10] = 0x4; break;
361	case FEC_7_8:	c->operand[10] = 0x5; break;
362	case FEC_4_5:
363	case FEC_8_9:
364	case FEC_AUTO:
365	default:	c->operand[10] = 0x0;
366	}
367
368	if (fdtv->voltage == 0xff)
369		c->operand[11] = 0xff;
370	else if (fdtv->voltage == SEC_VOLTAGE_18) /* polarisation */
371		c->operand[11] = 0;
372	else
373		c->operand[11] = 1;
374
375	if (fdtv->tone == 0xff)
376		c->operand[12] = 0xff;
377	else if (fdtv->tone == SEC_TONE_ON) /* band */
378		c->operand[12] = 1;
379	else
380		c->operand[12] = 0;
381
382	if (fdtv->type == FIREDTV_DVB_S2) {
383		if (fdtv->fe.dtv_property_cache.delivery_system == SYS_DVBS2) {
384			switch (fdtv->fe.dtv_property_cache.modulation) {
385			case QAM_16:		c->operand[13] = 0x1; break;
386			case QPSK:		c->operand[13] = 0x2; break;
387			case PSK_8:		c->operand[13] = 0x3; break;
388			default:		c->operand[13] = 0x2; break;
389			}
390			switch (fdtv->fe.dtv_property_cache.rolloff) {
391			case ROLLOFF_35:	c->operand[14] = 0x2; break;
392			case ROLLOFF_20:	c->operand[14] = 0x0; break;
393			case ROLLOFF_25:	c->operand[14] = 0x1; break;
394			case ROLLOFF_AUTO:
395			default:		c->operand[14] = 0x2; break;
396			/* case ROLLOFF_NONE:	c->operand[14] = 0xff; break; */
397			}
398			switch (fdtv->fe.dtv_property_cache.pilot) {
399			case PILOT_AUTO:	c->operand[15] = 0x0; break;
400			case PILOT_OFF:		c->operand[15] = 0x0; break;
401			case PILOT_ON:		c->operand[15] = 0x1; break;
402			}
403		} else {
404			c->operand[13] = 0x1;  /* auto modulation */
405			c->operand[14] = 0xff; /* disable rolloff */
406			c->operand[15] = 0xff; /* disable pilot */
407		}
408		return 16;
409	} else {
410		return 13;
411	}
412}
413
414static int avc_tuner_dsd_dvb_c(struct firedtv *fdtv,
415			       struct dtv_frontend_properties *p)
416{
417	struct avc_command_frame *c = (void *)fdtv->avc_data;
418
419	c->opcode = AVC_OPCODE_DSD;
420
421	c->operand[0] = 0;    /* source plug */
422	c->operand[1] = 0xd2; /* subfunction replace */
423	c->operand[2] = 0x20; /* system id = DVB */
424	c->operand[3] = 0x00; /* antenna number */
425	c->operand[4] = 0x11; /* system_specific_multiplex selection_length */
426
427	/* multiplex_valid_flags, high byte */
428	c->operand[5] =   0 << 7 /* reserved */
429			| 0 << 6 /* Polarisation */
430			| 0 << 5 /* Orbital_Pos */
431			| 1 << 4 /* Frequency */
432			| 1 << 3 /* Symbol_Rate */
433			| 0 << 2 /* FEC_outer */
434			| (p->fec_inner  != FEC_AUTO ? 1 << 1 : 0)
435			| (p->modulation != QAM_AUTO ? 1 << 0 : 0);
436
437	/* multiplex_valid_flags, low byte */
438	c->operand[6] =   0 << 7 /* NetworkID */
439			| 0 << 0 /* reserved */ ;
440
441	c->operand[7]  = 0x00;
442	c->operand[8]  = 0x00;
443	c->operand[9]  = 0x00;
444	c->operand[10] = 0x00;
445
446	c->operand[11] = (((p->frequency / 4000) >> 16) & 0xff) | (2 << 6);
447	c->operand[12] = ((p->frequency / 4000) >> 8) & 0xff;
448	c->operand[13] = (p->frequency / 4000) & 0xff;
449	c->operand[14] = ((p->symbol_rate / 1000) >> 12) & 0xff;
450	c->operand[15] = ((p->symbol_rate / 1000) >> 4) & 0xff;
451	c->operand[16] = ((p->symbol_rate / 1000) << 4) & 0xf0;
452	c->operand[17] = 0x00;
453
454	switch (p->fec_inner) {
455	case FEC_1_2:	c->operand[18] = 0x1; break;
456	case FEC_2_3:	c->operand[18] = 0x2; break;
457	case FEC_3_4:	c->operand[18] = 0x3; break;
458	case FEC_5_6:	c->operand[18] = 0x4; break;
459	case FEC_7_8:	c->operand[18] = 0x5; break;
460	case FEC_8_9:	c->operand[18] = 0x6; break;
461	case FEC_4_5:	c->operand[18] = 0x8; break;
462	case FEC_AUTO:
463	default:	c->operand[18] = 0x0;
464	}
465
466	switch (p->modulation) {
467	case QAM_16:	c->operand[19] = 0x08; break;
468	case QAM_32:	c->operand[19] = 0x10; break;
469	case QAM_64:	c->operand[19] = 0x18; break;
470	case QAM_128:	c->operand[19] = 0x20; break;
471	case QAM_256:	c->operand[19] = 0x28; break;
472	case QAM_AUTO:
473	default:	c->operand[19] = 0x00;
474	}
475
476	c->operand[20] = 0x00;
477	c->operand[21] = 0x00;
478
479	return 22 + add_pid_filter(fdtv, &c->operand[22]);
480}
481
482static int avc_tuner_dsd_dvb_t(struct firedtv *fdtv,
483			       struct dtv_frontend_properties *p)
484{
485	struct avc_command_frame *c = (void *)fdtv->avc_data;
486
487	c->opcode = AVC_OPCODE_DSD;
488
489	c->operand[0] = 0;    /* source plug */
490	c->operand[1] = 0xd2; /* subfunction replace */
491	c->operand[2] = 0x20; /* system id = DVB */
492	c->operand[3] = 0x00; /* antenna number */
493	c->operand[4] = 0x0c; /* system_specific_multiplex selection_length */
494
495	/* multiplex_valid_flags, high byte */
496	c->operand[5] =
497	      0 << 7 /* reserved */
498	    | 1 << 6 /* CenterFrequency */
499	    | (p->bandwidth_hz != 0        ? 1 << 5 : 0)
500	    | (p->modulation  != QAM_AUTO              ? 1 << 4 : 0)
501	    | (p->hierarchy != HIERARCHY_AUTO ? 1 << 3 : 0)
502	    | (p->code_rate_HP   != FEC_AUTO              ? 1 << 2 : 0)
503	    | (p->code_rate_LP   != FEC_AUTO              ? 1 << 1 : 0)
504	    | (p->guard_interval != GUARD_INTERVAL_AUTO   ? 1 << 0 : 0);
505
506	/* multiplex_valid_flags, low byte */
507	c->operand[6] =
508	      0 << 7 /* NetworkID */
509	    | (p->transmission_mode != TRANSMISSION_MODE_AUTO ? 1 << 6 : 0)
510	    | 0 << 5 /* OtherFrequencyFlag */
511	    | 0 << 0 /* reserved */ ;
512
513	c->operand[7]  = 0x0;
514	c->operand[8]  = (p->frequency / 10) >> 24;
515	c->operand[9]  = ((p->frequency / 10) >> 16) & 0xff;
516	c->operand[10] = ((p->frequency / 10) >>  8) & 0xff;
517	c->operand[11] = (p->frequency / 10) & 0xff;
518
519	switch (p->bandwidth_hz) {
520	case 7000000:	c->operand[12] = 0x20; break;
521	case 8000000:
522	case 6000000:	/* not defined by AVC spec */
523	case 0:
524	default:		c->operand[12] = 0x00;
525	}
526
527	switch (p->modulation) {
528	case QAM_16:	c->operand[13] = 1 << 6; break;
529	case QAM_64:	c->operand[13] = 2 << 6; break;
530	case QPSK:
531	default:	c->operand[13] = 0x00;
532	}
533
534	switch (p->hierarchy) {
535	case HIERARCHY_1:	c->operand[13] |= 1 << 3; break;
536	case HIERARCHY_2:	c->operand[13] |= 2 << 3; break;
537	case HIERARCHY_4:	c->operand[13] |= 3 << 3; break;
538	case HIERARCHY_AUTO:
539	case HIERARCHY_NONE:
540	default:		break;
541	}
542
543	switch (p->code_rate_HP) {
544	case FEC_2_3:	c->operand[13] |= 1; break;
545	case FEC_3_4:	c->operand[13] |= 2; break;
546	case FEC_5_6:	c->operand[13] |= 3; break;
547	case FEC_7_8:	c->operand[13] |= 4; break;
548	case FEC_1_2:
549	default:	break;
550	}
551
552	switch (p->code_rate_LP) {
553	case FEC_2_3:	c->operand[14] = 1 << 5; break;
554	case FEC_3_4:	c->operand[14] = 2 << 5; break;
555	case FEC_5_6:	c->operand[14] = 3 << 5; break;
556	case FEC_7_8:	c->operand[14] = 4 << 5; break;
557	case FEC_1_2:
558	default:	c->operand[14] = 0x00; break;
559	}
560
561	switch (p->guard_interval) {
562	case GUARD_INTERVAL_1_16:	c->operand[14] |= 1 << 3; break;
563	case GUARD_INTERVAL_1_8:	c->operand[14] |= 2 << 3; break;
564	case GUARD_INTERVAL_1_4:	c->operand[14] |= 3 << 3; break;
565	case GUARD_INTERVAL_1_32:
566	case GUARD_INTERVAL_AUTO:
567	default:			break;
568	}
569
570	switch (p->transmission_mode) {
571	case TRANSMISSION_MODE_8K:	c->operand[14] |= 1 << 1; break;
572	case TRANSMISSION_MODE_2K:
573	case TRANSMISSION_MODE_AUTO:
574	default:			break;
575	}
576
577	c->operand[15] = 0x00; /* network_ID[0] */
578	c->operand[16] = 0x00; /* network_ID[1] */
579
580	return 17 + add_pid_filter(fdtv, &c->operand[17]);
581}
582
583int avc_tuner_dsd(struct firedtv *fdtv,
584		  struct dtv_frontend_properties *p)
585{
586	struct avc_command_frame *c = (void *)fdtv->avc_data;
587	int pos, ret;
588
589	mutex_lock(&fdtv->avc_mutex);
590
591	c->ctype   = AVC_CTYPE_CONTROL;
592	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
593
594	switch (fdtv->type) {
595	case FIREDTV_DVB_S:
596	case FIREDTV_DVB_S2: pos = avc_tuner_tuneqpsk(fdtv, p); break;
597	case FIREDTV_DVB_C: pos = avc_tuner_dsd_dvb_c(fdtv, p); break;
598	case FIREDTV_DVB_T: pos = avc_tuner_dsd_dvb_t(fdtv, p); break;
599	default:
600		ret = -EIO;
601		goto unlock;
602	}
603	pad_operands(c, pos);
604
605	fdtv->avc_data_length = ALIGN(3 + pos, 4);
606	ret = avc_write(fdtv);
607#if 0
608	/*
609	 * FIXME:
610	 * u8 *status was an out-parameter of avc_tuner_dsd, unused by caller.
611	 * Check for AVC_RESPONSE_ACCEPTED here instead?
612	 */
613	if (status)
614		*status = r->operand[2];
615#endif
616unlock:
617	mutex_unlock(&fdtv->avc_mutex);
618
619	if (ret == 0)
620		msleep(500);
621
622	return ret;
623}
624
625int avc_tuner_set_pids(struct firedtv *fdtv, unsigned char pidc, u16 pid[])
626{
627	struct avc_command_frame *c = (void *)fdtv->avc_data;
628	int ret, pos, k;
629
630	if (pidc > 16 && pidc != 0xff)
631		return -EINVAL;
632
633	mutex_lock(&fdtv->avc_mutex);
634
635	c->ctype   = AVC_CTYPE_CONTROL;
636	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
637	c->opcode  = AVC_OPCODE_DSD;
638
639	c->operand[0] = 0;	/* source plug */
640	c->operand[1] = 0xd2;	/* subfunction replace */
641	c->operand[2] = 0x20;	/* system id = DVB */
642	c->operand[3] = 0x00;	/* antenna number */
643	c->operand[4] = 0x00;	/* system_specific_multiplex selection_length */
644	c->operand[5] = pidc;	/* Nr_of_dsd_sel_specs */
645
646	pos = 6;
647	if (pidc != 0xff)
648		for (k = 0; k < pidc; k++) {
649			c->operand[pos++] = 0x13; /* flowfunction relay */
650			c->operand[pos++] = 0x80; /* dsd_sel_spec_valid_flags -> PID */
651			c->operand[pos++] = (pid[k] >> 8) & 0x1f;
652			c->operand[pos++] = pid[k] & 0xff;
653			c->operand[pos++] = 0x00; /* tableID */
654			c->operand[pos++] = 0x00; /* filter_length */
655		}
656	pad_operands(c, pos);
657
658	fdtv->avc_data_length = ALIGN(3 + pos, 4);
659	ret = avc_write(fdtv);
660
661	/* FIXME: check response code? */
662
663	mutex_unlock(&fdtv->avc_mutex);
664
665	if (ret == 0)
666		msleep(50);
667
668	return ret;
669}
670
671int avc_tuner_get_ts(struct firedtv *fdtv)
672{
673	struct avc_command_frame *c = (void *)fdtv->avc_data;
674	int ret, sl;
675
676	mutex_lock(&fdtv->avc_mutex);
677
678	c->ctype   = AVC_CTYPE_CONTROL;
679	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
680	c->opcode  = AVC_OPCODE_DSIT;
681
682	sl = fdtv->type == FIREDTV_DVB_T ? 0x0c : 0x11;
683
684	c->operand[0] = 0;	/* source plug */
685	c->operand[1] = 0xd2;	/* subfunction replace */
686	c->operand[2] = 0xff;	/* status */
687	c->operand[3] = 0x20;	/* system id = DVB */
688	c->operand[4] = 0x00;	/* antenna number */
689	c->operand[5] = 0x0;	/* system_specific_search_flags */
690	c->operand[6] = sl;	/* system_specific_multiplex selection_length */
691	/*
692	 * operand[7]: valid_flags[0]
693	 * operand[8]: valid_flags[1]
694	 * operand[7 + sl]: nr_of_dsit_sel_specs (always 0)
695	 */
696	clear_operands(c, 7, 24);
697
698	fdtv->avc_data_length = fdtv->type == FIREDTV_DVB_T ? 24 : 28;
699	ret = avc_write(fdtv);
700
701	/* FIXME: check response code? */
702
703	mutex_unlock(&fdtv->avc_mutex);
704
705	if (ret == 0)
706		msleep(250);
707
708	return ret;
709}
710
711int avc_identify_subunit(struct firedtv *fdtv)
712{
713	struct avc_command_frame *c = (void *)fdtv->avc_data;
714	struct avc_response_frame *r = (void *)fdtv->avc_data;
715	int ret;
716
717	mutex_lock(&fdtv->avc_mutex);
718
719	c->ctype   = AVC_CTYPE_CONTROL;
720	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
721	c->opcode  = AVC_OPCODE_READ_DESCRIPTOR;
722
723	c->operand[0] = DESCRIPTOR_SUBUNIT_IDENTIFIER;
724	c->operand[1] = 0xff;
725	c->operand[2] = 0x00;
726	c->operand[3] = 0x00; /* length highbyte */
727	c->operand[4] = 0x08; /* length lowbyte  */
728	c->operand[5] = 0x00; /* offset highbyte */
729	c->operand[6] = 0x0d; /* offset lowbyte  */
730	clear_operands(c, 7, 8); /* padding */
731
732	fdtv->avc_data_length = 12;
733	ret = avc_write(fdtv);
734	if (ret < 0)
735		goto out;
736
737	if ((r->response != AVC_RESPONSE_STABLE &&
738	     r->response != AVC_RESPONSE_ACCEPTED) ||
739	    (r->operand[3] << 8) + r->operand[4] != 8) {
740		dev_err(fdtv->device, "cannot read subunit identifier\n");
741		ret = -EINVAL;
742	}
743out:
744	mutex_unlock(&fdtv->avc_mutex);
745
746	return ret;
747}
748
749#define SIZEOF_ANTENNA_INPUT_INFO 22
750
751int avc_tuner_status(struct firedtv *fdtv, struct firedtv_tuner_status *stat)
752{
753	struct avc_command_frame *c = (void *)fdtv->avc_data;
754	struct avc_response_frame *r = (void *)fdtv->avc_data;
755	int length, ret;
756
757	mutex_lock(&fdtv->avc_mutex);
758
759	c->ctype   = AVC_CTYPE_CONTROL;
760	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
761	c->opcode  = AVC_OPCODE_READ_DESCRIPTOR;
762
763	c->operand[0] = DESCRIPTOR_TUNER_STATUS;
764	c->operand[1] = 0xff;	/* read_result_status */
765	/*
766	 * operand[2]: reserved
767	 * operand[3]: SIZEOF_ANTENNA_INPUT_INFO >> 8
768	 * operand[4]: SIZEOF_ANTENNA_INPUT_INFO & 0xff
769	 */
770	clear_operands(c, 2, 31);
771
772	fdtv->avc_data_length = 12;
773	ret = avc_write(fdtv);
774	if (ret < 0)
775		goto out;
776
777	if (r->response != AVC_RESPONSE_STABLE &&
778	    r->response != AVC_RESPONSE_ACCEPTED) {
779		dev_err(fdtv->device, "cannot read tuner status\n");
780		ret = -EINVAL;
781		goto out;
782	}
783
784	length = r->operand[9];
785	if (r->operand[1] != 0x10 || length != SIZEOF_ANTENNA_INPUT_INFO) {
786		dev_err(fdtv->device, "got invalid tuner status\n");
787		ret = -EINVAL;
788		goto out;
789	}
790
791	stat->active_system		= r->operand[10];
792	stat->searching			= r->operand[11] >> 7 & 1;
793	stat->moving			= r->operand[11] >> 6 & 1;
794	stat->no_rf			= r->operand[11] >> 5 & 1;
795	stat->input			= r->operand[12] >> 7 & 1;
796	stat->selected_antenna		= r->operand[12] & 0x7f;
797	stat->ber			= r->operand[13] << 24 |
798					  r->operand[14] << 16 |
799					  r->operand[15] << 8 |
800					  r->operand[16];
801	stat->signal_strength		= r->operand[17];
802	stat->raster_frequency		= r->operand[18] >> 6 & 2;
803	stat->rf_frequency		= (r->operand[18] & 0x3f) << 16 |
804					  r->operand[19] << 8 |
805					  r->operand[20];
806	stat->man_dep_info_length	= r->operand[21];
807	stat->front_end_error		= r->operand[22] >> 4 & 1;
808	stat->antenna_error		= r->operand[22] >> 3 & 1;
809	stat->front_end_power_status	= r->operand[22] >> 1 & 1;
810	stat->power_supply		= r->operand[22] & 1;
811	stat->carrier_noise_ratio	= r->operand[23] << 8 |
812					  r->operand[24];
813	stat->power_supply_voltage	= r->operand[27];
814	stat->antenna_voltage		= r->operand[28];
815	stat->firewire_bus_voltage	= r->operand[29];
816	stat->ca_mmi			= r->operand[30] & 1;
817	stat->ca_pmt_reply		= r->operand[31] >> 7 & 1;
818	stat->ca_date_time_request	= r->operand[31] >> 6 & 1;
819	stat->ca_application_info	= r->operand[31] >> 5 & 1;
820	stat->ca_module_present_status	= r->operand[31] >> 4 & 1;
821	stat->ca_dvb_flag		= r->operand[31] >> 3 & 1;
822	stat->ca_error_flag		= r->operand[31] >> 2 & 1;
823	stat->ca_initialization_status	= r->operand[31] >> 1 & 1;
824out:
825	mutex_unlock(&fdtv->avc_mutex);
826
827	return ret;
828}
829
830int avc_lnb_control(struct firedtv *fdtv, char voltage, char burst,
831		    char conttone, char nrdiseq,
832		    struct dvb_diseqc_master_cmd *diseqcmd)
833{
834	struct avc_command_frame *c = (void *)fdtv->avc_data;
835	struct avc_response_frame *r = (void *)fdtv->avc_data;
836	int pos, j, k, ret;
837
838	mutex_lock(&fdtv->avc_mutex);
839
840	c->ctype   = AVC_CTYPE_CONTROL;
841	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
842	c->opcode  = AVC_OPCODE_VENDOR;
843
844	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
845	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
846	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
847	c->operand[3] = SFE_VENDOR_OPCODE_LNB_CONTROL;
848	c->operand[4] = voltage;
849	c->operand[5] = nrdiseq;
850
851	pos = 6;
852	for (j = 0; j < nrdiseq; j++) {
853		c->operand[pos++] = diseqcmd[j].msg_len;
854
855		for (k = 0; k < diseqcmd[j].msg_len; k++)
856			c->operand[pos++] = diseqcmd[j].msg[k];
857	}
858	c->operand[pos++] = burst;
859	c->operand[pos++] = conttone;
860	pad_operands(c, pos);
861
862	fdtv->avc_data_length = ALIGN(3 + pos, 4);
863	ret = avc_write(fdtv);
864	if (ret < 0)
865		goto out;
866
867	if (r->response != AVC_RESPONSE_ACCEPTED) {
868		dev_err(fdtv->device, "LNB control failed\n");
869		ret = -EINVAL;
870	}
871out:
872	mutex_unlock(&fdtv->avc_mutex);
873
874	return ret;
875}
876
877int avc_register_remote_control(struct firedtv *fdtv)
878{
879	struct avc_command_frame *c = (void *)fdtv->avc_data;
880	int ret;
881
882	mutex_lock(&fdtv->avc_mutex);
883
884	c->ctype   = AVC_CTYPE_NOTIFY;
885	c->subunit = AVC_SUBUNIT_TYPE_UNIT | 7;
886	c->opcode  = AVC_OPCODE_VENDOR;
887
888	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
889	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
890	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
891	c->operand[3] = SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL;
892	c->operand[4] = 0; /* padding */
893
894	fdtv->avc_data_length = 8;
895	ret = avc_write(fdtv);
896
897	/* FIXME: check response code? */
898
899	mutex_unlock(&fdtv->avc_mutex);
900
901	return ret;
902}
903
904void avc_remote_ctrl_work(struct work_struct *work)
905{
906	struct firedtv *fdtv =
907			container_of(work, struct firedtv, remote_ctrl_work);
908
909	/* Should it be rescheduled in failure cases? */
910	avc_register_remote_control(fdtv);
911}
912
913#if 0 /* FIXME: unused */
914int avc_tuner_host2ca(struct firedtv *fdtv)
915{
916	struct avc_command_frame *c = (void *)fdtv->avc_data;
917	int ret;
918
919	mutex_lock(&fdtv->avc_mutex);
920
921	c->ctype   = AVC_CTYPE_CONTROL;
922	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
923	c->opcode  = AVC_OPCODE_VENDOR;
924
925	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
926	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
927	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
928	c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
929	c->operand[4] = 0; /* slot */
930	c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
931	clear_operands(c, 6, 8);
932
933	fdtv->avc_data_length = 12;
934	ret = avc_write(fdtv);
935
936	/* FIXME: check response code? */
937
938	mutex_unlock(&fdtv->avc_mutex);
939
940	return ret;
941}
942#endif
943
944static int get_ca_object_pos(struct avc_response_frame *r)
945{
946	int length = 1;
947
948	/* Check length of length field */
949	if (r->operand[7] & 0x80)
950		length = (r->operand[7] & 0x7f) + 1;
951	return length + 7;
952}
953
954static int get_ca_object_length(struct avc_response_frame *r)
955{
956#if 0 /* FIXME: unused */
957	int size = 0;
958	int i;
959
960	if (r->operand[7] & 0x80)
961		for (i = 0; i < (r->operand[7] & 0x7f); i++) {
962			size <<= 8;
963			size += r->operand[8 + i];
964		}
965#endif
966	return r->operand[7];
967}
968
969int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info,
970		    unsigned int *len)
971{
972	struct avc_command_frame *c = (void *)fdtv->avc_data;
973	struct avc_response_frame *r = (void *)fdtv->avc_data;
974	int pos, ret;
975
976	mutex_lock(&fdtv->avc_mutex);
977
978	c->ctype   = AVC_CTYPE_STATUS;
979	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
980	c->opcode  = AVC_OPCODE_VENDOR;
981
982	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
983	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
984	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
985	c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
986	c->operand[4] = 0; /* slot */
987	c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
988	clear_operands(c, 6, LAST_OPERAND);
989
990	fdtv->avc_data_length = 12;
991	ret = avc_write(fdtv);
992	if (ret < 0)
993		goto out;
994
995	/* FIXME: check response code and validate response data */
996
997	pos = get_ca_object_pos(r);
998	app_info[0] = (EN50221_TAG_APP_INFO >> 16) & 0xff;
999	app_info[1] = (EN50221_TAG_APP_INFO >>  8) & 0xff;
1000	app_info[2] = (EN50221_TAG_APP_INFO >>  0) & 0xff;
1001	app_info[3] = 6 + r->operand[pos + 4];
1002	app_info[4] = 0x01;
1003	memcpy(&app_info[5], &r->operand[pos], 5 + r->operand[pos + 4]);
1004	*len = app_info[3] + 4;
1005out:
1006	mutex_unlock(&fdtv->avc_mutex);
1007
1008	return ret;
1009}
1010
1011int avc_ca_info(struct firedtv *fdtv, unsigned char *app_info,
1012		unsigned int *len)
1013{
1014	struct avc_command_frame *c = (void *)fdtv->avc_data;
1015	struct avc_response_frame *r = (void *)fdtv->avc_data;
1016	int i, pos, ret;
1017
1018	mutex_lock(&fdtv->avc_mutex);
1019
1020	c->ctype   = AVC_CTYPE_STATUS;
1021	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
1022	c->opcode  = AVC_OPCODE_VENDOR;
1023
1024	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
1025	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
1026	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
1027	c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
1028	c->operand[4] = 0; /* slot */
1029	c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
1030	clear_operands(c, 6, LAST_OPERAND);
1031
1032	fdtv->avc_data_length = 12;
1033	ret = avc_write(fdtv);
1034	if (ret < 0)
1035		goto out;
1036
1037	/* FIXME: check response code and validate response data */
1038
1039	pos = get_ca_object_pos(r);
1040	app_info[0] = (EN50221_TAG_CA_INFO >> 16) & 0xff;
1041	app_info[1] = (EN50221_TAG_CA_INFO >>  8) & 0xff;
1042	app_info[2] = (EN50221_TAG_CA_INFO >>  0) & 0xff;
1043	if (num_fake_ca_system_ids == 0) {
1044		app_info[3] = 2;
1045		app_info[4] = r->operand[pos + 0];
1046		app_info[5] = r->operand[pos + 1];
1047	} else {
1048		app_info[3] = num_fake_ca_system_ids * 2;
1049		for (i = 0; i < num_fake_ca_system_ids; i++) {
1050			app_info[4 + i * 2] =
1051				(fake_ca_system_ids[i] >> 8) & 0xff;
1052			app_info[5 + i * 2] = fake_ca_system_ids[i] & 0xff;
1053		}
1054	}
1055	*len = app_info[3] + 4;
1056out:
1057	mutex_unlock(&fdtv->avc_mutex);
1058
1059	return ret;
1060}
1061
1062int avc_ca_reset(struct firedtv *fdtv)
1063{
1064	struct avc_command_frame *c = (void *)fdtv->avc_data;
1065	int ret;
1066
1067	mutex_lock(&fdtv->avc_mutex);
1068
1069	c->ctype   = AVC_CTYPE_CONTROL;
1070	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
1071	c->opcode  = AVC_OPCODE_VENDOR;
1072
1073	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
1074	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
1075	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
1076	c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
1077	c->operand[4] = 0; /* slot */
1078	c->operand[5] = SFE_VENDOR_TAG_CA_RESET; /* ca tag */
1079	c->operand[6] = 0; /* more/last */
1080	c->operand[7] = 1; /* length */
1081	c->operand[8] = 0; /* force hardware reset */
1082
1083	fdtv->avc_data_length = 12;
1084	ret = avc_write(fdtv);
1085
1086	/* FIXME: check response code? */
1087
1088	mutex_unlock(&fdtv->avc_mutex);
1089
1090	return ret;
1091}
1092
1093int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
1094{
1095	struct avc_command_frame *c = (void *)fdtv->avc_data;
1096	struct avc_response_frame *r = (void *)fdtv->avc_data;
1097	int list_management;
1098	int program_info_length;
1099	int pmt_cmd_id;
1100	int read_pos;
1101	int write_pos;
1102	int es_info_length;
1103	int crc32_csum;
1104	int ret;
1105
1106	if (unlikely(avc_debug & AVC_DEBUG_APPLICATION_PMT))
1107		debug_pmt(msg, length);
1108
1109	mutex_lock(&fdtv->avc_mutex);
1110
1111	c->ctype   = AVC_CTYPE_CONTROL;
1112	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
1113	c->opcode  = AVC_OPCODE_VENDOR;
1114
1115	if (msg[0] != EN50221_LIST_MANAGEMENT_ONLY) {
1116		dev_info(fdtv->device, "forcing list_management to ONLY\n");
1117		msg[0] = EN50221_LIST_MANAGEMENT_ONLY;
1118	}
1119	/* We take the cmd_id from the programme level only! */
1120	list_management = msg[0];
1121	program_info_length = ((msg[4] & 0x0f) << 8) + msg[5];
1122	if (program_info_length > 0)
1123		program_info_length--; /* Remove pmt_cmd_id */
1124	pmt_cmd_id = msg[6];
1125
1126	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
1127	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
1128	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
1129	c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
1130	c->operand[4] = 0; /* slot */
1131	c->operand[5] = SFE_VENDOR_TAG_CA_PMT; /* ca tag */
1132	c->operand[6] = 0; /* more/last */
1133	/* Use three bytes for length field in case length > 127 */
1134	c->operand[10] = list_management;
1135	c->operand[11] = 0x01; /* pmt_cmd=OK_descramble */
1136
1137	/* TS program map table */
1138
1139	c->operand[12] = 0x02; /* Table id=2 */
1140	c->operand[13] = 0x80; /* Section syntax + length */
1141
1142	c->operand[15] = msg[1]; /* Program number */
1143	c->operand[16] = msg[2];
1144	c->operand[17] = msg[3]; /* Version number and current/next */
1145	c->operand[18] = 0x00; /* Section number=0 */
1146	c->operand[19] = 0x00; /* Last section number=0 */
1147	c->operand[20] = 0x1f; /* PCR_PID=1FFF */
1148	c->operand[21] = 0xff;
1149	c->operand[22] = (program_info_length >> 8); /* Program info length */
1150	c->operand[23] = (program_info_length & 0xff);
1151
1152	/* CA descriptors at programme level */
1153	read_pos = 6;
1154	write_pos = 24;
1155	if (program_info_length > 0) {
1156		pmt_cmd_id = msg[read_pos++];
1157		if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
1158			dev_err(fdtv->device,
1159				"invalid pmt_cmd_id %d\n", pmt_cmd_id);
1160		if (program_info_length > sizeof(c->operand) - 4 - write_pos) {
1161			ret = -EINVAL;
1162			goto out;
1163		}
1164
1165		memcpy(&c->operand[write_pos], &msg[read_pos],
1166		       program_info_length);
1167		read_pos += program_info_length;
1168		write_pos += program_info_length;
1169	}
1170	while (read_pos + 4 < length) {
1171		if (write_pos + 4 >= sizeof(c->operand) - 4) {
1172			ret = -EINVAL;
1173			goto out;
1174		}
1175		c->operand[write_pos++] = msg[read_pos++];
1176		c->operand[write_pos++] = msg[read_pos++];
1177		c->operand[write_pos++] = msg[read_pos++];
1178		es_info_length =
1179			((msg[read_pos] & 0x0f) << 8) + msg[read_pos + 1];
1180		read_pos += 2;
1181		if (es_info_length > 0)
1182			es_info_length--; /* Remove pmt_cmd_id */
1183		c->operand[write_pos++] = es_info_length >> 8;
1184		c->operand[write_pos++] = es_info_length & 0xff;
1185		if (es_info_length > 0) {
1186			if (read_pos >= length) {
1187				ret = -EINVAL;
1188				goto out;
1189			}
1190			pmt_cmd_id = msg[read_pos++];
1191			if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
1192				dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
1193					pmt_cmd_id);
1194
1195			if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
1196			    es_info_length > length - read_pos) {
1197				ret = -EINVAL;
1198				goto out;
1199			}
1200
1201			memcpy(&c->operand[write_pos], &msg[read_pos],
1202			       es_info_length);
1203			read_pos += es_info_length;
1204			write_pos += es_info_length;
1205		}
1206	}
1207	write_pos += 4; /* CRC */
1208
1209	c->operand[7] = 0x82;
1210	c->operand[8] = (write_pos - 10) >> 8;
1211	c->operand[9] = (write_pos - 10) & 0xff;
1212	c->operand[14] = write_pos - 15;
1213
1214	crc32_csum = crc32_be(0, &c->operand[10], c->operand[12] - 1);
1215	c->operand[write_pos - 4] = (crc32_csum >> 24) & 0xff;
1216	c->operand[write_pos - 3] = (crc32_csum >> 16) & 0xff;
1217	c->operand[write_pos - 2] = (crc32_csum >>  8) & 0xff;
1218	c->operand[write_pos - 1] = (crc32_csum >>  0) & 0xff;
1219	pad_operands(c, write_pos);
1220
1221	fdtv->avc_data_length = ALIGN(3 + write_pos, 4);
1222	ret = avc_write(fdtv);
1223	if (ret < 0)
1224		goto out;
1225
1226	if (r->response != AVC_RESPONSE_ACCEPTED) {
1227		dev_err(fdtv->device,
1228			"CA PMT failed with response 0x%x\n", r->response);
1229		ret = -EACCES;
1230	}
1231out:
1232	mutex_unlock(&fdtv->avc_mutex);
1233
1234	return ret;
1235}
1236
1237int avc_ca_get_time_date(struct firedtv *fdtv, int *interval)
1238{
1239	struct avc_command_frame *c = (void *)fdtv->avc_data;
1240	struct avc_response_frame *r = (void *)fdtv->avc_data;
1241	int ret;
1242
1243	mutex_lock(&fdtv->avc_mutex);
1244
1245	c->ctype   = AVC_CTYPE_STATUS;
1246	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
1247	c->opcode  = AVC_OPCODE_VENDOR;
1248
1249	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
1250	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
1251	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
1252	c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
1253	c->operand[4] = 0; /* slot */
1254	c->operand[5] = SFE_VENDOR_TAG_CA_DATE_TIME; /* ca tag */
1255	clear_operands(c, 6, LAST_OPERAND);
1256
1257	fdtv->avc_data_length = 12;
1258	ret = avc_write(fdtv);
1259	if (ret < 0)
1260		goto out;
1261
1262	/* FIXME: check response code and validate response data */
1263
1264	*interval = r->operand[get_ca_object_pos(r)];
1265out:
1266	mutex_unlock(&fdtv->avc_mutex);
1267
1268	return ret;
1269}
1270
1271int avc_ca_enter_menu(struct firedtv *fdtv)
1272{
1273	struct avc_command_frame *c = (void *)fdtv->avc_data;
1274	int ret;
1275
1276	mutex_lock(&fdtv->avc_mutex);
1277
1278	c->ctype   = AVC_CTYPE_STATUS;
1279	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
1280	c->opcode  = AVC_OPCODE_VENDOR;
1281
1282	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
1283	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
1284	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
1285	c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
1286	c->operand[4] = 0; /* slot */
1287	c->operand[5] = SFE_VENDOR_TAG_CA_ENTER_MENU;
1288	clear_operands(c, 6, 8);
1289
1290	fdtv->avc_data_length = 12;
1291	ret = avc_write(fdtv);
1292
1293	/* FIXME: check response code? */
1294
1295	mutex_unlock(&fdtv->avc_mutex);
1296
1297	return ret;
1298}
1299
1300int avc_ca_get_mmi(struct firedtv *fdtv, char *mmi_object, unsigned int *len)
1301{
1302	struct avc_command_frame *c = (void *)fdtv->avc_data;
1303	struct avc_response_frame *r = (void *)fdtv->avc_data;
1304	int ret;
1305
1306	mutex_lock(&fdtv->avc_mutex);
1307
1308	c->ctype   = AVC_CTYPE_STATUS;
1309	c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
1310	c->opcode  = AVC_OPCODE_VENDOR;
1311
1312	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
1313	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
1314	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
1315	c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
1316	c->operand[4] = 0; /* slot */
1317	c->operand[5] = SFE_VENDOR_TAG_CA_MMI;
1318	clear_operands(c, 6, LAST_OPERAND);
1319
1320	fdtv->avc_data_length = 12;
1321	ret = avc_write(fdtv);
1322	if (ret < 0)
1323		goto out;
1324
1325	/* FIXME: check response code and validate response data */
1326
1327	*len = get_ca_object_length(r);
1328	memcpy(mmi_object, &r->operand[get_ca_object_pos(r)], *len);
1329out:
1330	mutex_unlock(&fdtv->avc_mutex);
1331
1332	return ret;
1333}
1334
1335#define CMP_OUTPUT_PLUG_CONTROL_REG_0	0xfffff0000904ULL
1336
1337static int cmp_read(struct firedtv *fdtv, u64 addr, __be32 *data)
1338{
1339	int ret;
1340
1341	ret = fdtv_read(fdtv, addr, data);
1342	if (ret < 0)
1343		dev_err(fdtv->device, "CMP: read I/O error\n");
1344
1345	return ret;
1346}
1347
1348static int cmp_lock(struct firedtv *fdtv, u64 addr, __be32 data[])
1349{
1350	int ret;
1351
1352	ret = fdtv_lock(fdtv, addr, data);
1353	if (ret < 0)
1354		dev_err(fdtv->device, "CMP: lock I/O error\n");
1355
1356	return ret;
1357}
1358
1359static inline u32 get_opcr(__be32 opcr, u32 mask, u32 shift)
1360{
1361	return (be32_to_cpu(opcr) >> shift) & mask;
1362}
1363
1364static inline void set_opcr(__be32 *opcr, u32 value, u32 mask, u32 shift)
1365{
1366	*opcr &= ~cpu_to_be32(mask << shift);
1367	*opcr |= cpu_to_be32((value & mask) << shift);
1368}
1369
1370#define get_opcr_online(v)		get_opcr((v), 0x1, 31)
1371#define get_opcr_p2p_connections(v)	get_opcr((v), 0x3f, 24)
1372#define get_opcr_channel(v)		get_opcr((v), 0x3f, 16)
1373
1374#define set_opcr_p2p_connections(p, v)	set_opcr((p), (v), 0x3f, 24)
1375#define set_opcr_channel(p, v)		set_opcr((p), (v), 0x3f, 16)
1376#define set_opcr_data_rate(p, v)	set_opcr((p), (v), 0x3, 14)
1377#define set_opcr_overhead_id(p, v)	set_opcr((p), (v), 0xf, 10)
1378
1379int cmp_establish_pp_connection(struct firedtv *fdtv, int plug, int channel)
1380{
1381	__be32 old_opcr, opcr[2];
1382	u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
1383	int attempts = 0;
1384	int ret;
1385
1386	ret = cmp_read(fdtv, opcr_address, opcr);
1387	if (ret < 0)
1388		return ret;
1389
1390repeat:
1391	if (!get_opcr_online(*opcr)) {
1392		dev_err(fdtv->device, "CMP: output offline\n");
1393		return -EBUSY;
1394	}
1395
1396	old_opcr = *opcr;
1397
1398	if (get_opcr_p2p_connections(*opcr)) {
1399		if (get_opcr_channel(*opcr) != channel) {
1400			dev_err(fdtv->device, "CMP: cannot change channel\n");
1401			return -EBUSY;
1402		}
1403		dev_info(fdtv->device, "CMP: overlaying connection\n");
1404
1405		/* We don't allocate isochronous resources. */
1406	} else {
1407		set_opcr_channel(opcr, channel);
1408		set_opcr_data_rate(opcr, 2); /* S400 */
1409
1410		/* FIXME: this is for the worst case - optimize */
1411		set_opcr_overhead_id(opcr, 0);
1412
1413		/* FIXME: allocate isochronous channel and bandwidth at IRM */
1414	}
1415
1416	set_opcr_p2p_connections(opcr, get_opcr_p2p_connections(*opcr) + 1);
1417
1418	opcr[1] = *opcr;
1419	opcr[0] = old_opcr;
1420
1421	ret = cmp_lock(fdtv, opcr_address, opcr);
1422	if (ret < 0)
1423		return ret;
1424
1425	if (old_opcr != *opcr) {
1426		/*
1427		 * FIXME: if old_opcr.P2P_Connections > 0,
1428		 * deallocate isochronous channel and bandwidth at IRM
1429		 */
1430
1431		if (++attempts < 6) /* arbitrary limit */
1432			goto repeat;
1433		return -EBUSY;
1434	}
1435
1436	return 0;
1437}
1438
1439void cmp_break_pp_connection(struct firedtv *fdtv, int plug, int channel)
1440{
1441	__be32 old_opcr, opcr[2];
1442	u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
1443	int attempts = 0;
1444
1445	if (cmp_read(fdtv, opcr_address, opcr) < 0)
1446		return;
1447
1448repeat:
1449	if (!get_opcr_online(*opcr) || !get_opcr_p2p_connections(*opcr) ||
1450	    get_opcr_channel(*opcr) != channel) {
1451		dev_err(fdtv->device, "CMP: no connection to break\n");
1452		return;
1453	}
1454
1455	old_opcr = *opcr;
1456	set_opcr_p2p_connections(opcr, get_opcr_p2p_connections(*opcr) - 1);
1457
1458	opcr[1] = *opcr;
1459	opcr[0] = old_opcr;
1460
1461	if (cmp_lock(fdtv, opcr_address, opcr) < 0)
1462		return;
1463
1464	if (old_opcr != *opcr) {
1465		/*
1466		 * FIXME: if old_opcr.P2P_Connections == 1, i.e. we were last
1467		 * owner, deallocate isochronous channel and bandwidth at IRM
1468		 * if (...)
1469		 *	fdtv->backend->dealloc_resources(fdtv, channel, bw);
1470		 */
1471
1472		if (++attempts < 6) /* arbitrary limit */
1473			goto repeat;
1474	}
1475}
1476