[media] ngene: CXD2099AR Common Interface driver

Driver for the Common Interface Controller CXD2099AR.
Supports the CI of the cineS2 DVB-S2.

For now, data is passed through '/dev/dvb/adapterX/sec0':
- Encrypted data must be written to 'sec0'.
- Decrypted data can be read from 'sec0'.
- Setup the CAM using device 'ca0'.

Signed-off-by: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 files changed, 782 insertions, 31 deletions

diff --git a/drivers/media/dvb/ngene/Makefile b/drivers/media/dvb/ngene/Makefile
index 0608aabb14e..00d12d6c461 100644
--- a/drivers/media/dvb/ngene/Makefile
+++ b/drivers/media/dvb/ngene/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the nGene device driver
 #
 
-ngene-objs := ngene-core.o ngene-i2c.o ngene-cards.o ngene-dvb.o
+ngene-objs := ngene-core.o ngene-i2c.o ngene-cards.o ngene-dvb.o cxd2099.o
 
 obj-$(CONFIG_DVB_NGENE) += ngene.o
 
diff --git a/drivers/media/dvb/ngene/cxd2099.c b/drivers/media/dvb/ngene/cxd2099.c
new file mode 100644
index 00000000000..b49186c74eb
--- /dev/null
+++ b/drivers/media/dvb/ngene/cxd2099.c
@@ -0,0 +1,574 @@
+/*
+ * cxd2099.c: Driver for the CXD2099AR Common Interface Controller
+ *
+ * Copyright (C) 2010 DigitalDevices UG
+ *
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 only, as published by the Free Software Foundation.
+ *
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
+ */
+
+#include <linux/version.h>
+#include <linux/slab.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/wait.h>
+#include <linux/delay.h>
+#include <linux/mutex.h>
+#include <linux/io.h>
+
+#include "cxd2099.h"
+
+#define MAX_BUFFER_SIZE 248
+
+struct cxd {
+	struct dvb_ca_en50221 en;
+
+	struct i2c_adapter *i2c;
+	u8     adr;
+	u8     regs[0x23];
+	u8     lastaddress;
+	u8     clk_reg_f;
+	u8     clk_reg_b;
+	int    mode;
+	u32    bitrate;
+	int    ready;
+	int    dr;
+	int    slot_stat;
+
+	u8     amem[1024];
+	int    amem_read;
+
+	int    cammode;
+	struct mutex lock;
+};
+
+static int i2c_write_reg(struct i2c_adapter *adapter, u8 adr,
+			 u8 reg, u8 data)
+{
+	u8 m[2] = {reg, data};
+	struct i2c_msg msg = {.addr = adr, .flags = 0, .buf = m, .len = 2};
+
+	if (i2c_transfer(adapter, &msg, 1) != 1) {
+		printk(KERN_ERR "Failed to write to I2C register %02x@%02x!\n",
+		       reg, adr);
+		return -1;
+	}
+	return 0;
+}
+
+static int i2c_write(struct i2c_adapter *adapter, u8 adr,
+		     u8 *data, u8 len)
+{
+	struct i2c_msg msg = {.addr = adr, .flags = 0, .buf = data, .len = len};
+
+	if (i2c_transfer(adapter, &msg, 1) != 1) {
+		printk(KERN_ERR "Failed to write to I2C!\n");
+		return -1;
+	}
+	return 0;
+}
+
+static int i2c_read_reg(struct i2c_adapter *adapter, u8 adr,
+			u8 reg, u8 *val)
+{
+	struct i2c_msg msgs[2] = {{.addr = adr, .flags = 0,
+				   .buf = &reg, .len = 1 },
+				  {.addr = adr, .flags = I2C_M_RD,
+				   .buf = val, .len = 1 } };
+
+	if (i2c_transfer(adapter, msgs, 2) != 2) {
+		printk(KERN_ERR "error in i2c_read_reg\n");
+		return -1;
+	}
+	return 0;
+}
+
+static int i2c_read(struct i2c_adapter *adapter, u8 adr,
+		    u8 reg, u8 *data, u8 n)
+{
+	struct i2c_msg msgs[2] = {{.addr = adr, .flags = 0,
+				   .buf = &reg, .len = 1 },
+				  {.addr = adr, .flags = I2C_M_RD,
+				   .buf = data, .len = n } };
+
+	if (i2c_transfer(adapter, msgs, 2) != 2) {
+		printk(KERN_ERR "error in i2c_read\n");
+		return -1;
+	}
+	return 0;
+}
+
+static int read_block(struct cxd *ci, u8 adr, u8 *data, u8 n)
+{
+	int status;
+
+	status = i2c_write_reg(ci->i2c, ci->adr, 0, adr);
+	if (!status) {
+		ci->lastaddress = adr;
+		status = i2c_read(ci->i2c, ci->adr, 1, data, n);
+	}
+	return status;
+}
+
+static int read_reg(struct cxd *ci, u8 reg, u8 *val)
+{
+	return read_block(ci, reg, val, 1);
+}
+
+
+static int read_pccard(struct cxd *ci, u16 address, u8 *data, u8 n)
+{
+	int status;
+	u8 addr[3] = { 2, address&0xff, address>>8 };
+
+	status = i2c_write(ci->i2c, ci->adr, addr, 3);
+	if (!status)
+		status = i2c_read(ci->i2c, ci->adr, 3, data, n);
+	return status;
+}
+
+static int write_pccard(struct cxd *ci, u16 address, u8 *data, u8 n)
+{
+	int status;
+	u8 addr[3] = { 2, address&0xff, address>>8 };
+
+	status = i2c_write(ci->i2c, ci->adr, addr, 3);
+	if (!status) {
+		u8 buf[256] = {3};
+		memcpy(buf+1, data, n);
+		status = i2c_write(ci->i2c, ci->adr, buf, n+1);
+	}
+	return status;
+}
+
+static int read_io(struct cxd *ci, u16 address, u8 *val)
+{
+	int status;
+	u8 addr[3] = { 2, address&0xff, address>>8 };
+
+	status = i2c_write(ci->i2c, ci->adr, addr, 3);
+	if (!status)
+		status = i2c_read(ci->i2c, ci->adr, 3, val, 1);
+	return status;
+}
+
+static int write_io(struct cxd *ci, u16 address, u8 val)
+{
+	int status;
+	u8 addr[3] = { 2, address&0xff, address>>8 };
+	u8 buf[2] = { 3, val };
+
+	status = i2c_write(ci->i2c, ci->adr, addr, 3);
+	if (!status)
+		status = i2c_write(ci->i2c, ci->adr, buf, 2);
+
+	return status;
+}
+
+
+static int write_regm(struct cxd *ci, u8 reg, u8 val, u8 mask)
+{
+	int status;
+
+	status = i2c_write_reg(ci->i2c, ci->adr, 0, reg);
+	if (!status && reg >= 6 && reg <= 8 && mask != 0xff)
+		status = i2c_read_reg(ci->i2c, ci->adr, 1, &ci->regs[reg]);
+	ci->regs[reg] = (ci->regs[reg]&(~mask))|val;
+	if (!status) {
+		ci->lastaddress = reg;
+		status = i2c_write_reg(ci->i2c, ci->adr, 1, ci->regs[reg]);
+	}
+	if (reg == 0x20)
+		ci->regs[reg] &= 0x7f;
+	return status;
+}
+
+static int write_reg(struct cxd *ci, u8 reg, u8 val)
+{
+	return write_regm(ci, reg, val, 0xff);
+}
+
+#ifdef BUFFER_MODE
+static int write_block(struct cxd *ci, u8 adr, u8 *data, int n)
+{
+	int status;
+	u8 buf[256] = {1};
+
+	status = i2c_write_reg(ci->i2c, ci->adr, 0, adr);
+	if (!status) {
+		ci->lastaddress = adr;
+		memcpy(buf+1, data, n);
+		status = i2c_write(ci->i2c, ci->adr, buf, n+1);
+	}
+	return status;
+}
+#endif
+
+static void set_mode(struct cxd *ci, int mode)
+{
+	if (mode == ci->mode)
+		return;
+
+	switch (mode) {
+	case 0x00: /* IO mem */
+		write_regm(ci, 0x06, 0x00, 0x07);
+		break;
+	case 0x01: /* ATT mem */
+		write_regm(ci, 0x06, 0x02, 0x07);
+		break;
+	default:
+		break;
+	}
+	ci->mode = mode;
+}
+
+static void cam_mode(struct cxd *ci, int mode)
+{
+	if (mode == ci->cammode)
+		return;
+
+	switch (mode) {
+	case 0x00:
+		write_regm(ci, 0x20, 0x80, 0x80);
+		break;
+	case 0x01:
+		printk(KERN_INFO "enable cam buffer mode\n");
+		/* write_reg(ci, 0x0d, 0x00); */
+		/* write_reg(ci, 0x0e, 0x01); */
+		write_regm(ci, 0x08, 0x40, 0x40);
+		/* read_reg(ci, 0x12, &dummy); */
+		write_regm(ci, 0x08, 0x80, 0x80);
+		break;
+	default:
+		break;
+	}
+	ci->cammode = mode;
+}
+
+
+
+#define CHK_ERROR(s) if ((status = s)) break
+
+static int init(struct cxd *ci)
+{
+	int status;
+
+	mutex_lock(&ci->lock);
+	ci->mode = -1;
+	do {
+		CHK_ERROR(write_reg(ci, 0x00, 0x00));
+		CHK_ERROR(write_reg(ci, 0x01, 0x00));
+		CHK_ERROR(write_reg(ci, 0x02, 0x10));
+		CHK_ERROR(write_reg(ci, 0x03, 0x00));
+		CHK_ERROR(write_reg(ci, 0x05, 0xFF));
+		CHK_ERROR(write_reg(ci, 0x06, 0x1F));
+		CHK_ERROR(write_reg(ci, 0x07, 0x1F));
+		CHK_ERROR(write_reg(ci, 0x08, 0x28));
+		CHK_ERROR(write_reg(ci, 0x14, 0x20));
+
+		CHK_ERROR(write_reg(ci, 0x09, 0x4D)); /* Input Mode C, BYPass Serial, TIVAL = low, MSB */
+		CHK_ERROR(write_reg(ci, 0x0A, 0xA7)); /* TOSTRT = 8, Mode B (gated clock), falling Edge, Serial, POL=HIGH, MSB */
+
+		/* Sync detector */
+		CHK_ERROR(write_reg(ci, 0x0B, 0x33));
+		CHK_ERROR(write_reg(ci, 0x0C, 0x33));
+
+		CHK_ERROR(write_regm(ci, 0x14, 0x00, 0x0F));
+		CHK_ERROR(write_reg(ci, 0x15, ci->clk_reg_b));
+		CHK_ERROR(write_regm(ci, 0x16, 0x00, 0x0F));
+		CHK_ERROR(write_reg(ci, 0x17, ci->clk_reg_f));
+
+		CHK_ERROR(write_reg(ci, 0x20, 0x28)); /* Integer Divider, Falling Edge, Internal Sync, */
+		CHK_ERROR(write_reg(ci, 0x21, 0x00)); /* MCLKI = TICLK/8 */
+		CHK_ERROR(write_reg(ci, 0x22, 0x07)); /* MCLKI = TICLK/8 */
+
+
+		CHK_ERROR(write_regm(ci, 0x20, 0x80, 0x80)); /* Reset CAM state machine */
+
+		CHK_ERROR(write_regm(ci, 0x03, 0x02, 02));  /* Enable IREQA Interrupt */
+		CHK_ERROR(write_reg(ci, 0x01, 0x04));  /* Enable CD Interrupt */
+		CHK_ERROR(write_reg(ci, 0x00, 0x31));  /* Enable TS1,Hot Swap,Slot A */
+		CHK_ERROR(write_regm(ci, 0x09, 0x08, 0x08));  /* Put TS in bypass */
+		ci->cammode = -1;
+#ifdef BUFFER_MODE
+		cam_mode(ci, 0);
+#endif
+	} while (0);
+	mutex_unlock(&ci->lock);
+
+	return 0;
+}
+
+
+static int read_attribute_mem(struct dvb_ca_en50221 *ca,
+			      int slot, int address)
+{
+	struct cxd *ci = ca->data;
+	u8 val;
+	mutex_lock(&ci->lock);
+	set_mode(ci, 1);
+	read_pccard(ci, address, &val, 1);
+	mutex_unlock(&ci->lock);
+	return val;
+}
+
+
+static int write_attribute_mem(struct dvb_ca_en50221 *ca, int slot,
+			       int address, u8 value)
+{
+	struct cxd *ci = ca->data;
+
+	mutex_lock(&ci->lock);
+	set_mode(ci, 1);
+	write_pccard(ci, address, &value, 1);
+	mutex_unlock(&ci->lock);
+	return 0;
+}
+
+static int read_cam_control(struct dvb_ca_en50221 *ca,
+			    int slot, u8 address)
+{
+	struct cxd *ci = ca->data;
+	u8 val;
+
+	mutex_lock(&ci->lock);
+	set_mode(ci, 0);
+	read_io(ci, address, &val);
+	mutex_unlock(&ci->lock);
+	return val;
+}
+
+static int write_cam_control(struct dvb_ca_en50221 *ca, int slot,
+			     u8 address, u8 value)
+{
+	struct cxd *ci = ca->data;
+
+	mutex_lock(&ci->lock);
+	set_mode(ci, 0);
+	write_io(ci, address, value);
+	mutex_unlock(&ci->lock);
+	return 0;
+}
+
+static int slot_reset(struct dvb_ca_en50221 *ca, int slot)
+{
+	struct cxd *ci = ca->data;
+
+	mutex_lock(&ci->lock);
+	cam_mode(ci, 0);
+	write_reg(ci, 0x00, 0x21);
+	write_reg(ci, 0x06, 0x1F);
+	write_reg(ci, 0x00, 0x31);
+	write_regm(ci, 0x20, 0x80, 0x80);
+	write_reg(ci, 0x03, 0x02);
+	ci->ready = 0;
+	ci->mode = -1;
+	{
+		int i;
+		for (i = 0; i < 100; i++) {
+			msleep(10);
+			if (ci->ready)
+				break;
+		}
+	}
+	mutex_unlock(&ci->lock);
+	/* msleep(500); */
+	return 0;
+}
+
+static int slot_shutdown(struct dvb_ca_en50221 *ca, int slot)
+{
+	struct cxd *ci = ca->data;
+
+	printk(KERN_INFO "slot_shutdown\n");
+	mutex_lock(&ci->lock);
+	/* write_regm(ci, 0x09, 0x08, 0x08); */
+	write_regm(ci, 0x20, 0x80, 0x80);
+	write_regm(ci, 0x06, 0x07, 0x07);
+	ci->mode = -1;
+	mutex_unlock(&ci->lock);
+	return 0; /* shutdown(ci); */
+}
+
+static int slot_ts_enable(struct dvb_ca_en50221 *ca, int slot)
+{
+	struct cxd *ci = ca->data;
+
+	mutex_lock(&ci->lock);
+	write_regm(ci, 0x09, 0x00, 0x08);
+	set_mode(ci, 0);
+#ifdef BUFFER_MODE
+	cam_mode(ci, 1);
+#endif
+	mutex_unlock(&ci->lock);
+	return 0;
+}
+
+
+static int campoll(struct cxd *ci)
+{
+	u8 istat;
+
+	read_reg(ci, 0x04, &istat);
+	if (!istat)
+		return 0;
+	write_reg(ci, 0x05, istat);
+
+	if (istat&0x40) {
+		ci->dr = 1;
+		printk(KERN_INFO "DR\n");
+	}
+	if (istat&0x20)
+		printk(KERN_INFO "WC\n");
+
+	if (istat&2) {
+		u8 slotstat;
+
+		read_reg(ci, 0x01, &slotstat);
+		if (!(2&slotstat)) {
+			if (!ci->slot_stat) {
+				ci->slot_stat |= DVB_CA_EN50221_POLL_CAM_PRESENT;
+				write_regm(ci, 0x03, 0x08, 0x08);
+			}
+
+		} else {
+			if (ci->slot_stat) {
+				ci->slot_stat = 0;
+				write_regm(ci, 0x03, 0x00, 0x08);
+				printk(KERN_INFO "NO CAM\n");
+				ci->ready = 0;
+			}
+		}
+		if (istat&8 && ci->slot_stat == DVB_CA_EN50221_POLL_CAM_PRESENT) {
+			ci->ready = 1;
+			ci->slot_stat |= DVB_CA_EN50221_POLL_CAM_READY;
+			printk(KERN_INFO "READY\n");
+		}
+	}
+	return 0;
+}
+
+
+static int poll_slot_status(struct dvb_ca_en50221 *ca, int slot, int open)
+{
+	struct cxd *ci = ca->data;
+	u8 slotstat;
+
+	mutex_lock(&ci->lock);
+	campoll(ci);
+	read_reg(ci, 0x01, &slotstat);
+	mutex_unlock(&ci->lock);
+
+	return ci->slot_stat;
+}
+
+#ifdef BUFFER_MODE
+static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount)
+{
+	struct cxd *ci = ca->data;
+	u8 msb, lsb;
+	u16 len;
+
+	mutex_lock(&ci->lock);
+	campoll(ci);
+	mutex_unlock(&ci->lock);
+
+	printk(KERN_INFO "read_data\n");
+	if (!ci->dr)
+		return 0;
+
+	mutex_lock(&ci->lock);
+	read_reg(ci, 0x0f, &msb);
+	read_reg(ci, 0x10, &lsb);
+	len = (msb<<8)|lsb;
+	read_block(ci, 0x12, ebuf, len);
+	ci->dr = 0;
+	mutex_unlock(&ci->lock);
+
+	return len;
+}
+
+static int write_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount)
+{
+	struct cxd *ci = ca->data;
+
+	mutex_lock(&ci->lock);
+	printk(KERN_INFO "write_data %d\n", ecount);
+	write_reg(ci, 0x0d, ecount>>8);
+	write_reg(ci, 0x0e, ecount&0xff);
+	write_block(ci, 0x11, ebuf, ecount);
+	mutex_unlock(&ci->lock);
+	return ecount;
+}
+#endif
+
+static struct dvb_ca_en50221 en_templ = {
+	.read_attribute_mem  = read_attribute_mem,
+	.write_attribute_mem = write_attribute_mem,
+	.read_cam_control    = read_cam_control,
+	.write_cam_control   = write_cam_control,
+	.slot_reset          = slot_reset,
+	.slot_shutdown       = slot_shutdown,
+	.slot_ts_enable      = slot_ts_enable,
+	.poll_slot_status    = poll_slot_status,
+#ifdef BUFFER_MODE
+	.read_data           = read_data,
+	.write_data          = write_data,
+#endif
+
+};
+
+struct dvb_ca_en50221 *cxd2099_attach(u8 adr, void *priv,
+				      struct i2c_adapter *i2c)
+{
+	struct cxd *ci = 0;
+	u32 bitrate = 62000000;
+	u8 val;
+
+	if (i2c_read_reg(i2c, adr, 0, &val) < 0) {
+		printk(KERN_ERR "No CXD2099 detected at %02x\n", adr);
+		return 0;
+	}
+
+	ci = kmalloc(sizeof(struct cxd), GFP_KERNEL);
+	if (!ci)
+		return 0;
+	memset(ci, 0, sizeof(*ci));
+
+	mutex_init(&ci->lock);
+	ci->i2c = i2c;
+	ci->adr = adr;
+	ci->lastaddress = 0xff;
+	ci->clk_reg_b = 0x4a;
+	ci->clk_reg_f = 0x1b;
+	ci->bitrate = bitrate;
+
+	memcpy(&ci->en, &en_templ, sizeof(en_templ));
+	ci->en.data = ci;
+	init(ci);
+	printk(KERN_INFO "Attached CXD2099AR at %02x\n", ci->adr);
+	return &ci->en;
+}
+EXPORT_SYMBOL(cxd2099_attach);
+
+MODULE_DESCRIPTION("cxd2099");
+MODULE_AUTHOR("Ralph Metzler <rjkm@metzlerbros.de>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/ngene/cxd2099.h b/drivers/media/dvb/ngene/cxd2099.h
new file mode 100644
index 00000000000..f71b807e8bb
--- /dev/null
+++ b/drivers/media/dvb/ngene/cxd2099.h
@@ -0,0 +1,32 @@
+/*
+ * cxd2099.h: Driver for the CXD2099AR Common Interface Controller
+ *
+ * Copyright (C) 2010 DigitalDevices UG
+ *
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 only, as published by the Free Software Foundation.
+ *
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
+ */
+
+#ifndef _CXD2099_H_
+#define _CXD2099_H_
+
+#include <dvb_ca_en50221.h>
+
+struct dvb_ca_en50221 *cxd2099_attach(u8 adr, void *priv, struct i2c_adapter *i2c);
+
+#endif
diff --git a/drivers/media/dvb/ngene/ngene-cards.c b/drivers/media/dvb/ngene/ngene-cards.c
index fc93d1064d4..93e6f9e954c 100644
--- a/drivers/media/dvb/ngene/ngene-cards.c
+++ b/drivers/media/dvb/ngene/ngene-cards.c
@@ -317,7 +317,8 @@ static struct ngene_info ngene_info_satixS2v2 = {
 static struct ngene_info ngene_info_cineS2v5 = {
 	.type		= NGENE_SIDEWINDER,
 	.name		= "Linux4Media cineS2 DVB-S2 Twin Tuner (v5)",
-	.io_type	= {NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN},
+	.io_type	= {NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN,
+			   NGENE_IO_TSOUT},
 	.demod_attach	= {demod_attach_stv0900, demod_attach_stv0900, cineS2_probe, cineS2_probe},
 	.tuner_attach	= {tuner_attach_stv6110, tuner_attach_stv6110, tuner_attach_stv6110, tuner_attach_stv6110},
 	.fe_config	= {&fe_cineS2, &fe_cineS2, &fe_cineS2_2, &fe_cineS2_2},
@@ -332,7 +333,8 @@ static struct ngene_info ngene_info_cineS2v5 = {
 static struct ngene_info ngene_info_duoFlexS2 = {
 	.type           = NGENE_SIDEWINDER,
 	.name           = "Digital Devices DuoFlex S2 miniPCIe",
-	.io_type        = {NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN},
+	.io_type        = {NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN,
+			   NGENE_IO_TSOUT},
 	.demod_attach   = {cineS2_probe, cineS2_probe, cineS2_probe, cineS2_probe},
 	.tuner_attach   = {tuner_attach_stv6110, tuner_attach_stv6110, tuner_attach_stv6110, tuner_attach_stv6110},
 	.fe_config      = {&fe_cineS2, &fe_cineS2, &fe_cineS2_2, &fe_cineS2_2},
diff --git a/drivers/media/dvb/ngene/ngene-core.c b/drivers/media/dvb/ngene/ngene-core.c
index 831b7586e88..deaf72aab05 100644
--- a/drivers/media/dvb/ngene/ngene-core.c
+++ b/drivers/media/dvb/ngene/ngene-core.c
@@ -45,7 +45,6 @@ static int one_adapter = 1;
 module_param(one_adapter, int, 0444);
 MODULE_PARM_DESC(one_adapter, "Use only one adapter.");
 
-
 static int debug;
 module_param(debug, int, 0444);
 MODULE_PARM_DESC(debug, "Print debugging information.");
@@ -476,7 +475,7 @@ static u8 SPDIFConfiguration[10] = {
 
 static u8 TS_I2SConfiguration[4] = { 0x3E, 0x18, 0x00, 0x00 };
 
-static u8 TS_I2SOutConfiguration[4] = { 0x80, 0x20, 0x00, 0x00 };
+static u8 TS_I2SOutConfiguration[4] = { 0x80, 0x04, 0x00, 0x00 };
 
 static u8 ITUDecoderSetup[4][16] = {
 	{0x1c, 0x13, 0x01, 0x68, 0x3d, 0x90, 0x14, 0x20,  /* SDTV */
@@ -749,13 +748,11 @@ void set_transfer(struct ngene_channel *chan, int state)
 		if (chan->mode & NGENE_IO_TSOUT) {
 			chan->pBufferExchange = tsout_exchange;
 			/* 0x66666666 = 50MHz *2^33 /250MHz */
-			chan->AudioDTOValue = 0x66666666;
-			/* set_dto(chan, 38810700+1000); */
-			/* set_dto(chan, 19392658); */
+			chan->AudioDTOValue = 0x80000000;
+			chan->AudioDTOUpdated = 1;
 		}
 		if (chan->mode & NGENE_IO_TSIN)
 			chan->pBufferExchange = tsin_exchange;
-		/* ngwritel(0, 0x9310); */
 		spin_unlock_irq(&chan->state_lock);
 	} else
 		;/* printk(KERN_INFO DEVICE_NAME ": lock=%08x\n",
@@ -1168,6 +1165,7 @@ static void ngene_release_buffers(struct ngene *dev)
 		iounmap(dev->iomem);
 	free_common_buffers(dev);
 	vfree(dev->tsout_buf);
+	vfree(dev->tsin_buf);
 	vfree(dev->ain_buf);
 	vfree(dev->vin_buf);
 	vfree(dev);
@@ -1184,6 +1182,13 @@ static int ngene_get_buffers(struct ngene *dev)
 		dvb_ringbuffer_init(&dev->tsout_rbuf,
 				    dev->tsout_buf, TSOUT_BUF_SIZE);
 	}
+	if (dev->card_info->io_type[2]&NGENE_IO_TSIN) {
+		dev->tsin_buf = vmalloc(TSIN_BUF_SIZE);
+		if (!dev->tsin_buf)
+			return -ENOMEM;
+		dvb_ringbuffer_init(&dev->tsin_rbuf,
+				    dev->tsin_buf, TSIN_BUF_SIZE);
+	}
 	if (dev->card_info->io_type[2] & NGENE_IO_AIN) {
 		dev->ain_buf = vmalloc(AIN_BUF_SIZE);
 		if (!dev->ain_buf)
@@ -1307,6 +1312,35 @@ static void ngene_stop(struct ngene *dev)
 #endif
 }
 
+static int ngene_buffer_config(struct ngene *dev)
+{
+	int stat;
+
+	if (dev->card_info->fw_version >= 17) {
+		u8 tsin12_config[6]   = { 0x60, 0x60, 0x00, 0x00, 0x00, 0x00 };
+		u8 tsin1234_config[6] = { 0x30, 0x30, 0x00, 0x30, 0x30, 0x00 };
+		u8 tsio1235_config[6] = { 0x30, 0x30, 0x00, 0x28, 0x00, 0x38 };
+		u8 *bconf = tsin12_config;
+
+		if (dev->card_info->io_type[2]&NGENE_IO_TSIN &&
+		    dev->card_info->io_type[3]&NGENE_IO_TSIN) {
+			bconf = tsin1234_config;
+			if (dev->card_info->io_type[4]&NGENE_IO_TSOUT &&
+			    dev->ci.en)
+				bconf = tsio1235_config;
+		}
+		stat = ngene_command_config_free_buf(dev, bconf);
+	} else {
+		int bconf = BUFFER_CONFIG_4422;
+
+		if (dev->card_info->io_type[3] == NGENE_IO_TSIN)
+			bconf = BUFFER_CONFIG_3333;
+		stat = ngene_command_config_buf(dev, bconf);
+	}
+	return stat;
+}
+
+
 static int ngene_start(struct ngene *dev)
 {
 	int stat;
@@ -1371,23 +1405,6 @@ static int ngene_start(struct ngene *dev)
 	if (stat < 0)
 		goto fail;
 
-	if (dev->card_info->fw_version >= 17) {
-		u8 tsin4_config[6] = {
-			3072 / 64, 3072 / 64, 0, 3072 / 64, 3072 / 64, 0};
-		u8 default_config[6] = {
-			4096 / 64, 4096 / 64, 0, 2048 / 64, 2048 / 64, 0};
-		u8 *bconf = default_config;
-
-		if (dev->card_info->io_type[3] == NGENE_IO_TSIN)
-			bconf = tsin4_config;
-		dprintk(KERN_DEBUG DEVICE_NAME ": FW 17+ buffer config\n");
-		stat = ngene_command_config_free_buf(dev, bconf);
-	} else {
-		int bconf = BUFFER_CONFIG_4422;
-		if (dev->card_info->io_type[3] == NGENE_IO_TSIN)
-			bconf = BUFFER_CONFIG_3333;
-		stat = ngene_command_config_buf(dev, bconf);
-	}
 	if (!stat)
 		return stat;
 
@@ -1403,9 +1420,6 @@ fail2:
 	return stat;
 }
 
-
-
-
 /****************************************************************************/
 /****************************************************************************/
 /****************************************************************************/
@@ -1422,7 +1436,12 @@ static void release_channel(struct ngene_channel *chan)
 
 	tasklet_kill(&chan->demux_tasklet);
 
+	if (chan->number >= 2 && chan->number <= 3 && dev->ci.en)
+		return;
+
 	if (io & (NGENE_IO_TSIN | NGENE_IO_TSOUT)) {
+		if (chan->ci_dev)
+			dvb_unregister_device(chan->ci_dev);
 		if (chan->fe) {
 			dvb_unregister_frontend(chan->fe);
 			dvb_frontend_detach(chan->fe);
@@ -1458,6 +1477,9 @@ static int init_channel(struct ngene_channel *chan)
 	if (io & (NGENE_IO_TSIN | NGENE_IO_TSOUT)) {
 		if (nr >= STREAM_AUDIOIN1)
 			chan->DataFormatFlags = DF_SWAP32;
+
+		if (nr >= 2 && nr <= 3 && dev->ci.en)
+			return 0;
 		if (nr == 0 || !one_adapter || dev->first_adapter == NULL) {
 			adapter = &dev->adapter[nr];
 			ret = dvb_register_adapter(adapter, "nGene",
@@ -1478,6 +1500,15 @@ static int init_channel(struct ngene_channel *chan)
 		ret = my_dvb_dmxdev_ts_card_init(&chan->dmxdev, &chan->demux,
 						 &chan->hw_frontend,
 						 &chan->mem_frontend, adapter);
+		if (dev->ci.en && (io&NGENE_IO_TSOUT)) {
+			dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
+			set_transfer(chan, 1);
+			set_transfer(&chan->dev->channel[2], 1);
+
+			dvb_register_device(adapter, &chan->ci_dev,
+					    &ngene_dvbdev_ci, (void *) chan,
+					    DVB_DEVICE_SEC);
+		}
 	}
 
 	if (io & NGENE_IO_TSIN) {
@@ -1525,6 +1556,24 @@ static int init_channels(struct ngene *dev)
 	return 0;
 }
 
+static void cxd_attach(struct ngene *dev)
+{
+	struct ngene_ci *ci = &dev->ci;
+
+	ci->en = cxd2099_attach(0x40, dev, &dev->channel[0].i2c_adapter);
+	ci->dev = dev;
+	return;
+}
+
+static void cxd_detach(struct ngene *dev)
+{
+	struct ngene_ci *ci = &dev->ci;
+
+	dvb_ca_en50221_release(ci->en);
+	kfree(ci->en);
+	ci->en = 0;
+}
+
 /****************************************************************************/
 /* device probe/remove calls ************************************************/
 /****************************************************************************/
@@ -1537,6 +1586,8 @@ void __devexit ngene_remove(struct pci_dev *pdev)
 	tasklet_kill(&dev->event_tasklet);
 	for (i = MAX_STREAM - 1; i >= 0; i--)
 		release_channel(&dev->channel[i]);
+	if (dev->ci.en)
+		cxd_detach(dev);
 	ngene_stop(dev);
 	ngene_release_buffers(dev);
 	pci_set_drvdata(pdev, NULL);
@@ -1572,6 +1623,13 @@ int __devinit ngene_probe(struct pci_dev *pci_dev,
 	if (stat < 0)
 		goto fail1;
 
+	cxd_attach(dev);
+
+	stat = ngene_buffer_config(dev);
+	if (stat < 0)
+		goto fail1;
+
+
 	dev->i2c_current_bus = -1;
 
 	/* Register DVB adapters and devices for both channels */
diff --git a/drivers/media/dvb/ngene/ngene-dvb.c b/drivers/media/dvb/ngene/ngene-dvb.c
index 8bb159370c7..0b494323316 100644
--- a/drivers/media/dvb/ngene/ngene-dvb.c
+++ b/drivers/media/dvb/ngene/ngene-dvb.c
@@ -47,6 +47,64 @@
 /* COMMAND API interface ****************************************************/
 /****************************************************************************/
 
+static ssize_t ts_write(struct file *file, const char *buf,
+			size_t count, loff_t *ppos)
+{
+	struct dvb_device *dvbdev = file->private_data;
+	struct ngene_channel *chan = dvbdev->priv;
+	struct ngene *dev = chan->dev;
+
+	if (wait_event_interruptible(dev->tsout_rbuf.queue,
+				     dvb_ringbuffer_free
+				     (&dev->tsout_rbuf) >= count) < 0)
+		return 0;
+
+	dvb_ringbuffer_write(&dev->tsout_rbuf, buf, count);
+
+	return count;
+}
+
+static ssize_t ts_read(struct file *file, char *buf,
+		       size_t count, loff_t *ppos)
+{
+	struct dvb_device *dvbdev = file->private_data;
+	struct ngene_channel *chan = dvbdev->priv;
+	struct ngene *dev = chan->dev;
+	int left, avail;
+
+	left = count;
+	while (left) {
+		if (wait_event_interruptible(
+			    dev->tsin_rbuf.queue,
+			    dvb_ringbuffer_avail(&dev->tsin_rbuf) > 0) < 0)
+			return -EAGAIN;
+		avail = dvb_ringbuffer_avail(&dev->tsin_rbuf);
+		if (avail > left)
+			avail = left;
+		dvb_ringbuffer_read_user(&dev->tsin_rbuf, buf, avail);
+		left -= avail;
+		buf += avail;
+	}
+	return count;
+}
+
+static const struct file_operations ci_fops = {
+	.owner   = THIS_MODULE,
+	.read    = ts_read,
+	.write   = ts_write,
+	.open    = dvb_generic_open,
+	.release = dvb_generic_release,
+};
+
+struct dvb_device ngene_dvbdev_ci = {
+	.priv    = 0,
+	.readers = -1,
+	.writers = -1,
+	.users   = -1,
+	.fops    = &ci_fops,
+};
+
+
 /****************************************************************************/
 /* DVB functions and API interface ******************************************/
 /****************************************************************************/
@@ -63,11 +121,19 @@ static void swap_buffer(u32 *p, u32 len)
 void *tsin_exchange(void *priv, void *buf, u32 len, u32 clock, u32 flags)
 {
 	struct ngene_channel *chan = priv;
+	struct ngene *dev = chan->dev;
 
 
+	if (flags & DF_SWAP32)
+		swap_buffer(buf, len);
+	if (dev->ci.en && chan->number == 2) {
+		if (dvb_ringbuffer_free(&dev->tsin_rbuf) > len) {
+			dvb_ringbuffer_write(&dev->tsin_rbuf, buf, len);
+			wake_up_interruptible(&dev->tsin_rbuf.queue);
+		}
+		return 0;
+	}
 	if (chan->users > 0) {
-		if (flags & DF_SWAP32)
-			swap_buffer(buf, len);
 		dvb_dmx_swfilter(&chan->demux, buf, len);
 	}
 	return NULL;
diff --git a/drivers/media/dvb/ngene/ngene.h b/drivers/media/dvb/ngene/ngene.h
index 8fb4200f83f..f7834066386 100644
--- a/drivers/media/dvb/ngene/ngene.h
+++ b/drivers/media/dvb/ngene/ngene.h
@@ -36,8 +36,10 @@
 #include "dmxdev.h"
 #include "dvbdev.h"
 #include "dvb_demux.h"
+#include "dvb_ca_en50221.h"
 #include "dvb_frontend.h"
 #include "dvb_ringbuffer.h"
+#include "cxd2099.h"
 
 #define DEVICE_NAME "ngene"
 
@@ -644,6 +646,7 @@ struct ngene_channel {
 	struct dmx_frontend   mem_frontend;
 	int                   users;
 	struct video_device  *v4l_dev;
+	struct dvb_device    *ci_dev;
 	struct tasklet_struct demux_tasklet;
 
 	struct SBufferHeader *nextBuffer;
@@ -710,6 +713,15 @@ struct ngene_channel {
 	int running;
 };
 
+
+struct ngene_ci {
+	struct device         device;
+	struct i2c_adapter    i2c_adapter;
+
+	struct ngene         *dev;
+	struct dvb_ca_en50221 *en;
+};
+
 struct ngene;
 
 typedef void (rx_cb_t)(struct ngene *, u32, u8);
@@ -774,6 +786,10 @@ struct ngene {
 #define TSOUT_BUF_SIZE (512*188*8)
 	struct dvb_ringbuffer tsout_rbuf;
 
+	u8                   *tsin_buf;
+#define TSIN_BUF_SIZE (512*188*8)
+	struct dvb_ringbuffer tsin_rbuf;
+
 	u8                   *ain_buf;
 #define AIN_BUF_SIZE (128*1024)
 	struct dvb_ringbuffer ain_rbuf;
@@ -785,6 +801,8 @@ struct ngene {
 
 	unsigned long         exp_val;
 	int prev_cmd;
+
+	struct ngene_ci       ci;
 };
 
 struct ngene_info {
@@ -872,6 +890,7 @@ void FillTSBuffer(void *Buffer, int Length, u32 Flags);
 int ngene_i2c_init(struct ngene *dev, int dev_nr);
 
 /* Provided by ngene-dvb.c */
+extern struct dvb_device ngene_dvbdev_ci;
 void *tsout_exchange(void *priv, void *buf, u32 len, u32 clock, u32 flags);
 void *tsin_exchange(void *priv, void *buf, u32 len, u32 clock, u32 flags);
 int ngene_start_feed(struct dvb_demux_feed *dvbdmxfeed);