V4L/DVB (12341): zl10353 and qt1010: fix stack corruption bug
[linux-2.6/linux-2.6-openrd.git] / drivers / media / dvb / frontends / zl10353.c
blob66f5c1fb3074e60e13d481b558d2403803e9d5eb
1 /*
2 * Driver for Zarlink DVB-T ZL10353 demodulator
4 * Copyright (C) 2006, 2007 Christopher Pascoe <c.pascoe@itee.uq.edu.au>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/delay.h>
26 #include <linux/string.h>
27 #include <linux/slab.h>
28 #include <asm/div64.h>
30 #include "dvb_frontend.h"
31 #include "zl10353_priv.h"
32 #include "zl10353.h"
34 struct zl10353_state {
35 struct i2c_adapter *i2c;
36 struct dvb_frontend frontend;
38 struct zl10353_config config;
40 enum fe_bandwidth bandwidth;
43 static int debug;
44 #define dprintk(args...) \
45 do { \
46 if (debug) printk(KERN_DEBUG "zl10353: " args); \
47 } while (0)
49 static int debug_regs;
51 static int zl10353_single_write(struct dvb_frontend *fe, u8 reg, u8 val)
53 struct zl10353_state *state = fe->demodulator_priv;
54 u8 buf[2] = { reg, val };
55 struct i2c_msg msg = { .addr = state->config.demod_address, .flags = 0,
56 .buf = buf, .len = 2 };
57 int err = i2c_transfer(state->i2c, &msg, 1);
58 if (err != 1) {
59 printk("zl10353: write to reg %x failed (err = %d)!\n", reg, err);
60 return err;
62 return 0;
65 static int zl10353_write(struct dvb_frontend *fe, u8 *ibuf, int ilen)
67 int err, i;
68 for (i = 0; i < ilen - 1; i++)
69 if ((err = zl10353_single_write(fe, ibuf[0] + i, ibuf[i + 1])))
70 return err;
72 return 0;
75 static int zl10353_read_register(struct zl10353_state *state, u8 reg)
77 int ret;
78 u8 b0[1] = { reg };
79 u8 b1[1] = { 0 };
80 struct i2c_msg msg[2] = { { .addr = state->config.demod_address,
81 .flags = 0,
82 .buf = b0, .len = 1 },
83 { .addr = state->config.demod_address,
84 .flags = I2C_M_RD,
85 .buf = b1, .len = 1 } };
87 ret = i2c_transfer(state->i2c, msg, 2);
89 if (ret != 2) {
90 printk("%s: readreg error (reg=%d, ret==%i)\n",
91 __func__, reg, ret);
92 return ret;
95 return b1[0];
98 static void zl10353_dump_regs(struct dvb_frontend *fe)
100 struct zl10353_state *state = fe->demodulator_priv;
101 int ret;
102 u8 reg;
104 /* Dump all registers. */
105 for (reg = 0; ; reg++) {
106 if (reg % 16 == 0) {
107 if (reg)
108 printk(KERN_CONT "\n");
109 printk(KERN_DEBUG "%02x:", reg);
111 ret = zl10353_read_register(state, reg);
112 if (ret >= 0)
113 printk(KERN_CONT " %02x", (u8)ret);
114 else
115 printk(KERN_CONT " --");
116 if (reg == 0xff)
117 break;
119 printk(KERN_CONT "\n");
122 static void zl10353_calc_nominal_rate(struct dvb_frontend *fe,
123 enum fe_bandwidth bandwidth,
124 u16 *nominal_rate)
126 struct zl10353_state *state = fe->demodulator_priv;
127 u32 adc_clock = 450560; /* 45.056 MHz */
128 u64 value;
129 u8 bw;
131 if (state->config.adc_clock)
132 adc_clock = state->config.adc_clock;
134 switch (bandwidth) {
135 case BANDWIDTH_6_MHZ:
136 bw = 6;
137 break;
138 case BANDWIDTH_7_MHZ:
139 bw = 7;
140 break;
141 case BANDWIDTH_8_MHZ:
142 default:
143 bw = 8;
144 break;
147 value = (u64)10 * (1 << 23) / 7 * 125;
148 value = (bw * value) + adc_clock / 2;
149 do_div(value, adc_clock);
150 *nominal_rate = value;
152 dprintk("%s: bw %d, adc_clock %d => 0x%x\n",
153 __func__, bw, adc_clock, *nominal_rate);
156 static void zl10353_calc_input_freq(struct dvb_frontend *fe,
157 u16 *input_freq)
159 struct zl10353_state *state = fe->demodulator_priv;
160 u32 adc_clock = 450560; /* 45.056 MHz */
161 int if2 = 361667; /* 36.1667 MHz */
162 int ife;
163 u64 value;
165 if (state->config.adc_clock)
166 adc_clock = state->config.adc_clock;
167 if (state->config.if2)
168 if2 = state->config.if2;
170 if (adc_clock >= if2 * 2)
171 ife = if2;
172 else {
173 ife = adc_clock - (if2 % adc_clock);
174 if (ife > adc_clock / 2)
175 ife = adc_clock - ife;
177 value = (u64)65536 * ife + adc_clock / 2;
178 do_div(value, adc_clock);
179 *input_freq = -value;
181 dprintk("%s: if2 %d, ife %d, adc_clock %d => %d / 0x%x\n",
182 __func__, if2, ife, adc_clock, -(int)value, *input_freq);
185 static int zl10353_sleep(struct dvb_frontend *fe)
187 static u8 zl10353_softdown[] = { 0x50, 0x0C, 0x44 };
189 zl10353_write(fe, zl10353_softdown, sizeof(zl10353_softdown));
190 return 0;
193 static int zl10353_set_parameters(struct dvb_frontend *fe,
194 struct dvb_frontend_parameters *param)
196 struct zl10353_state *state = fe->demodulator_priv;
197 u16 nominal_rate, input_freq;
198 u8 pllbuf[6] = { 0x67 }, acq_ctl = 0;
199 u16 tps = 0;
200 struct dvb_ofdm_parameters *op = &param->u.ofdm;
202 zl10353_single_write(fe, RESET, 0x80);
203 udelay(200);
204 zl10353_single_write(fe, 0xEA, 0x01);
205 udelay(200);
206 zl10353_single_write(fe, 0xEA, 0x00);
208 zl10353_single_write(fe, AGC_TARGET, 0x28);
210 if (op->transmission_mode != TRANSMISSION_MODE_AUTO)
211 acq_ctl |= (1 << 0);
212 if (op->guard_interval != GUARD_INTERVAL_AUTO)
213 acq_ctl |= (1 << 1);
214 zl10353_single_write(fe, ACQ_CTL, acq_ctl);
216 switch (op->bandwidth) {
217 case BANDWIDTH_6_MHZ:
218 /* These are extrapolated from the 7 and 8MHz values */
219 zl10353_single_write(fe, MCLK_RATIO, 0x97);
220 zl10353_single_write(fe, 0x64, 0x34);
221 zl10353_single_write(fe, 0xcc, 0xdd);
222 break;
223 case BANDWIDTH_7_MHZ:
224 zl10353_single_write(fe, MCLK_RATIO, 0x86);
225 zl10353_single_write(fe, 0x64, 0x35);
226 zl10353_single_write(fe, 0xcc, 0x73);
227 break;
228 case BANDWIDTH_8_MHZ:
229 default:
230 zl10353_single_write(fe, MCLK_RATIO, 0x75);
231 zl10353_single_write(fe, 0x64, 0x36);
232 zl10353_single_write(fe, 0xcc, 0x73);
235 zl10353_calc_nominal_rate(fe, op->bandwidth, &nominal_rate);
236 zl10353_single_write(fe, TRL_NOMINAL_RATE_1, msb(nominal_rate));
237 zl10353_single_write(fe, TRL_NOMINAL_RATE_0, lsb(nominal_rate));
238 state->bandwidth = op->bandwidth;
240 zl10353_calc_input_freq(fe, &input_freq);
241 zl10353_single_write(fe, INPUT_FREQ_1, msb(input_freq));
242 zl10353_single_write(fe, INPUT_FREQ_0, lsb(input_freq));
244 /* Hint at TPS settings */
245 switch (op->code_rate_HP) {
246 case FEC_2_3:
247 tps |= (1 << 7);
248 break;
249 case FEC_3_4:
250 tps |= (2 << 7);
251 break;
252 case FEC_5_6:
253 tps |= (3 << 7);
254 break;
255 case FEC_7_8:
256 tps |= (4 << 7);
257 break;
258 case FEC_1_2:
259 case FEC_AUTO:
260 break;
261 default:
262 return -EINVAL;
265 switch (op->code_rate_LP) {
266 case FEC_2_3:
267 tps |= (1 << 4);
268 break;
269 case FEC_3_4:
270 tps |= (2 << 4);
271 break;
272 case FEC_5_6:
273 tps |= (3 << 4);
274 break;
275 case FEC_7_8:
276 tps |= (4 << 4);
277 break;
278 case FEC_1_2:
279 case FEC_AUTO:
280 break;
281 case FEC_NONE:
282 if (op->hierarchy_information == HIERARCHY_AUTO ||
283 op->hierarchy_information == HIERARCHY_NONE)
284 break;
285 default:
286 return -EINVAL;
289 switch (op->constellation) {
290 case QPSK:
291 break;
292 case QAM_AUTO:
293 case QAM_16:
294 tps |= (1 << 13);
295 break;
296 case QAM_64:
297 tps |= (2 << 13);
298 break;
299 default:
300 return -EINVAL;
303 switch (op->transmission_mode) {
304 case TRANSMISSION_MODE_2K:
305 case TRANSMISSION_MODE_AUTO:
306 break;
307 case TRANSMISSION_MODE_8K:
308 tps |= (1 << 0);
309 break;
310 default:
311 return -EINVAL;
314 switch (op->guard_interval) {
315 case GUARD_INTERVAL_1_32:
316 case GUARD_INTERVAL_AUTO:
317 break;
318 case GUARD_INTERVAL_1_16:
319 tps |= (1 << 2);
320 break;
321 case GUARD_INTERVAL_1_8:
322 tps |= (2 << 2);
323 break;
324 case GUARD_INTERVAL_1_4:
325 tps |= (3 << 2);
326 break;
327 default:
328 return -EINVAL;
331 switch (op->hierarchy_information) {
332 case HIERARCHY_AUTO:
333 case HIERARCHY_NONE:
334 break;
335 case HIERARCHY_1:
336 tps |= (1 << 10);
337 break;
338 case HIERARCHY_2:
339 tps |= (2 << 10);
340 break;
341 case HIERARCHY_4:
342 tps |= (3 << 10);
343 break;
344 default:
345 return -EINVAL;
348 zl10353_single_write(fe, TPS_GIVEN_1, msb(tps));
349 zl10353_single_write(fe, TPS_GIVEN_0, lsb(tps));
351 if (fe->ops.i2c_gate_ctrl)
352 fe->ops.i2c_gate_ctrl(fe, 0);
355 * If there is no tuner attached to the secondary I2C bus, we call
356 * set_params to program a potential tuner attached somewhere else.
357 * Otherwise, we update the PLL registers via calc_regs.
359 if (state->config.no_tuner) {
360 if (fe->ops.tuner_ops.set_params) {
361 fe->ops.tuner_ops.set_params(fe, param);
362 if (fe->ops.i2c_gate_ctrl)
363 fe->ops.i2c_gate_ctrl(fe, 0);
365 } else if (fe->ops.tuner_ops.calc_regs) {
366 fe->ops.tuner_ops.calc_regs(fe, param, pllbuf + 1, 5);
367 pllbuf[1] <<= 1;
368 zl10353_write(fe, pllbuf, sizeof(pllbuf));
371 zl10353_single_write(fe, 0x5F, 0x13);
373 /* If no attached tuner or invalid PLL registers, just start the FSM. */
374 if (state->config.no_tuner || fe->ops.tuner_ops.calc_regs == NULL)
375 zl10353_single_write(fe, FSM_GO, 0x01);
376 else
377 zl10353_single_write(fe, TUNER_GO, 0x01);
379 return 0;
382 static int zl10353_get_parameters(struct dvb_frontend *fe,
383 struct dvb_frontend_parameters *param)
385 struct zl10353_state *state = fe->demodulator_priv;
386 struct dvb_ofdm_parameters *op = &param->u.ofdm;
387 int s6, s9;
388 u16 tps;
389 static const u8 tps_fec_to_api[8] = {
390 FEC_1_2,
391 FEC_2_3,
392 FEC_3_4,
393 FEC_5_6,
394 FEC_7_8,
395 FEC_AUTO,
396 FEC_AUTO,
397 FEC_AUTO
400 s6 = zl10353_read_register(state, STATUS_6);
401 s9 = zl10353_read_register(state, STATUS_9);
402 if (s6 < 0 || s9 < 0)
403 return -EREMOTEIO;
404 if ((s6 & (1 << 5)) == 0 || (s9 & (1 << 4)) == 0)
405 return -EINVAL; /* no FE or TPS lock */
407 tps = zl10353_read_register(state, TPS_RECEIVED_1) << 8 |
408 zl10353_read_register(state, TPS_RECEIVED_0);
410 op->code_rate_HP = tps_fec_to_api[(tps >> 7) & 7];
411 op->code_rate_LP = tps_fec_to_api[(tps >> 4) & 7];
413 switch ((tps >> 13) & 3) {
414 case 0:
415 op->constellation = QPSK;
416 break;
417 case 1:
418 op->constellation = QAM_16;
419 break;
420 case 2:
421 op->constellation = QAM_64;
422 break;
423 default:
424 op->constellation = QAM_AUTO;
425 break;
428 op->transmission_mode = (tps & 0x01) ? TRANSMISSION_MODE_8K :
429 TRANSMISSION_MODE_2K;
431 switch ((tps >> 2) & 3) {
432 case 0:
433 op->guard_interval = GUARD_INTERVAL_1_32;
434 break;
435 case 1:
436 op->guard_interval = GUARD_INTERVAL_1_16;
437 break;
438 case 2:
439 op->guard_interval = GUARD_INTERVAL_1_8;
440 break;
441 case 3:
442 op->guard_interval = GUARD_INTERVAL_1_4;
443 break;
444 default:
445 op->guard_interval = GUARD_INTERVAL_AUTO;
446 break;
449 switch ((tps >> 10) & 7) {
450 case 0:
451 op->hierarchy_information = HIERARCHY_NONE;
452 break;
453 case 1:
454 op->hierarchy_information = HIERARCHY_1;
455 break;
456 case 2:
457 op->hierarchy_information = HIERARCHY_2;
458 break;
459 case 3:
460 op->hierarchy_information = HIERARCHY_4;
461 break;
462 default:
463 op->hierarchy_information = HIERARCHY_AUTO;
464 break;
467 param->frequency = 0;
468 op->bandwidth = state->bandwidth;
469 param->inversion = INVERSION_AUTO;
471 return 0;
474 static int zl10353_read_status(struct dvb_frontend *fe, fe_status_t *status)
476 struct zl10353_state *state = fe->demodulator_priv;
477 int s6, s7, s8;
479 if ((s6 = zl10353_read_register(state, STATUS_6)) < 0)
480 return -EREMOTEIO;
481 if ((s7 = zl10353_read_register(state, STATUS_7)) < 0)
482 return -EREMOTEIO;
483 if ((s8 = zl10353_read_register(state, STATUS_8)) < 0)
484 return -EREMOTEIO;
486 *status = 0;
487 if (s6 & (1 << 2))
488 *status |= FE_HAS_CARRIER;
489 if (s6 & (1 << 1))
490 *status |= FE_HAS_VITERBI;
491 if (s6 & (1 << 5))
492 *status |= FE_HAS_LOCK;
493 if (s7 & (1 << 4))
494 *status |= FE_HAS_SYNC;
495 if (s8 & (1 << 6))
496 *status |= FE_HAS_SIGNAL;
498 if ((*status & (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC)) !=
499 (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC))
500 *status &= ~FE_HAS_LOCK;
502 return 0;
505 static int zl10353_read_ber(struct dvb_frontend *fe, u32 *ber)
507 struct zl10353_state *state = fe->demodulator_priv;
509 *ber = zl10353_read_register(state, RS_ERR_CNT_2) << 16 |
510 zl10353_read_register(state, RS_ERR_CNT_1) << 8 |
511 zl10353_read_register(state, RS_ERR_CNT_0);
513 return 0;
516 static int zl10353_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
518 struct zl10353_state *state = fe->demodulator_priv;
520 u16 signal = zl10353_read_register(state, AGC_GAIN_1) << 10 |
521 zl10353_read_register(state, AGC_GAIN_0) << 2 | 3;
523 *strength = ~signal;
525 return 0;
528 static int zl10353_read_snr(struct dvb_frontend *fe, u16 *snr)
530 struct zl10353_state *state = fe->demodulator_priv;
531 u8 _snr;
533 if (debug_regs)
534 zl10353_dump_regs(fe);
536 _snr = zl10353_read_register(state, SNR);
537 *snr = (_snr << 8) | _snr;
539 return 0;
542 static int zl10353_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
544 struct zl10353_state *state = fe->demodulator_priv;
546 *ucblocks = zl10353_read_register(state, RS_UBC_1) << 8 |
547 zl10353_read_register(state, RS_UBC_0);
549 return 0;
552 static int zl10353_get_tune_settings(struct dvb_frontend *fe,
553 struct dvb_frontend_tune_settings
554 *fe_tune_settings)
556 fe_tune_settings->min_delay_ms = 1000;
557 fe_tune_settings->step_size = 0;
558 fe_tune_settings->max_drift = 0;
560 return 0;
563 static int zl10353_init(struct dvb_frontend *fe)
565 struct zl10353_state *state = fe->demodulator_priv;
566 u8 zl10353_reset_attach[6] = { 0x50, 0x03, 0x64, 0x46, 0x15, 0x0F };
567 int rc = 0;
569 if (debug_regs)
570 zl10353_dump_regs(fe);
571 if (state->config.parallel_ts)
572 zl10353_reset_attach[2] &= ~0x20;
573 if (state->config.clock_ctl_1)
574 zl10353_reset_attach[3] = state->config.clock_ctl_1;
575 if (state->config.pll_0)
576 zl10353_reset_attach[4] = state->config.pll_0;
578 /* Do a "hard" reset if not already done */
579 if (zl10353_read_register(state, 0x50) != zl10353_reset_attach[1] ||
580 zl10353_read_register(state, 0x51) != zl10353_reset_attach[2]) {
581 rc = zl10353_write(fe, zl10353_reset_attach,
582 sizeof(zl10353_reset_attach));
583 if (debug_regs)
584 zl10353_dump_regs(fe);
587 return 0;
590 static int zl10353_i2c_gate_ctrl(struct dvb_frontend* fe, int enable)
592 struct zl10353_state *state = fe->demodulator_priv;
593 u8 val = 0x0a;
595 if (state->config.disable_i2c_gate_ctrl) {
596 /* No tuner attached to the internal I2C bus */
597 /* If set enable I2C bridge, the main I2C bus stopped hardly */
598 return 0;
601 if (enable)
602 val |= 0x10;
604 return zl10353_single_write(fe, 0x62, val);
607 static void zl10353_release(struct dvb_frontend *fe)
609 struct zl10353_state *state = fe->demodulator_priv;
610 kfree(state);
613 static struct dvb_frontend_ops zl10353_ops;
615 struct dvb_frontend *zl10353_attach(const struct zl10353_config *config,
616 struct i2c_adapter *i2c)
618 struct zl10353_state *state = NULL;
619 int id;
621 /* allocate memory for the internal state */
622 state = kzalloc(sizeof(struct zl10353_state), GFP_KERNEL);
623 if (state == NULL)
624 goto error;
626 /* setup the state */
627 state->i2c = i2c;
628 memcpy(&state->config, config, sizeof(struct zl10353_config));
630 /* check if the demod is there */
631 id = zl10353_read_register(state, CHIP_ID);
632 if ((id != ID_ZL10353) && (id != ID_CE6230) && (id != ID_CE6231))
633 goto error;
635 /* create dvb_frontend */
636 memcpy(&state->frontend.ops, &zl10353_ops, sizeof(struct dvb_frontend_ops));
637 state->frontend.demodulator_priv = state;
639 return &state->frontend;
640 error:
641 kfree(state);
642 return NULL;
645 static struct dvb_frontend_ops zl10353_ops = {
647 .info = {
648 .name = "Zarlink ZL10353 DVB-T",
649 .type = FE_OFDM,
650 .frequency_min = 174000000,
651 .frequency_max = 862000000,
652 .frequency_stepsize = 166667,
653 .frequency_tolerance = 0,
654 .caps = FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 |
655 FE_CAN_FEC_3_4 | FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 |
656 FE_CAN_FEC_AUTO |
657 FE_CAN_QPSK | FE_CAN_QAM_16 | FE_CAN_QAM_64 | FE_CAN_QAM_AUTO |
658 FE_CAN_TRANSMISSION_MODE_AUTO | FE_CAN_GUARD_INTERVAL_AUTO |
659 FE_CAN_HIERARCHY_AUTO | FE_CAN_RECOVER |
660 FE_CAN_MUTE_TS
663 .release = zl10353_release,
665 .init = zl10353_init,
666 .sleep = zl10353_sleep,
667 .i2c_gate_ctrl = zl10353_i2c_gate_ctrl,
668 .write = zl10353_write,
670 .set_frontend = zl10353_set_parameters,
671 .get_frontend = zl10353_get_parameters,
672 .get_tune_settings = zl10353_get_tune_settings,
674 .read_status = zl10353_read_status,
675 .read_ber = zl10353_read_ber,
676 .read_signal_strength = zl10353_read_signal_strength,
677 .read_snr = zl10353_read_snr,
678 .read_ucblocks = zl10353_read_ucblocks,
681 module_param(debug, int, 0644);
682 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
684 module_param(debug_regs, int, 0644);
685 MODULE_PARM_DESC(debug_regs, "Turn on/off frontend register dumps (default:off).");
687 MODULE_DESCRIPTION("Zarlink ZL10353 DVB-T demodulator driver");
688 MODULE_AUTHOR("Chris Pascoe");
689 MODULE_LICENSE("GPL");
691 EXPORT_SYMBOL(zl10353_attach);