[media] ngene: CXD2099AR Common Interface driver

Driver for the Common Interface Controller CXD2099AR.
Supports the CI of the cineS2 DVB-S2.

For now, data is passed through '/dev/dvb/adapterX/sec0':
- Encrypted data must be written to 'sec0'.
- Decrypted data can be read from 'sec0'.
- Setup the CAM using device 'ca0'.

Signed-off-by: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 files changed, 782 insertions, 31 deletions

diff --git a/drivers/media/dvb/ngene/Makefile b/drivers/media/dvb/ngene/Makefile
index 0608aabb14ee..00d12d6c4618 100644
--- a/drivers/media/dvb/ngene/Makefile
+++ b/drivers/media/dvb/ngene/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the nGene device driver
 #
 
-ngene-objs := ngene-core.o ngene-i2c.o ngene-cards.o ngene-dvb.o
+ngene-objs := ngene-core.o ngene-i2c.o ngene-cards.o ngene-dvb.o cxd2099.o
 
 obj-$(CONFIG_DVB_NGENE) += ngene.o
 
diff --git a/drivers/media/dvb/ngene/cxd2099.c b/drivers/media/dvb/ngene/cxd2099.c
new file mode 100644
index 000000000000..b49186c74eb3
--- /dev/null
+++ b/drivers/media/dvb/ngene/cxd2099.c
@@ -0,0 +1,574 @@
+/*
+ * cxd2099.c: Driver for the CXD2099AR Common Interface Controller
+ *
+ * Copyright (C) 2010 DigitalDevices UG
+ *
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 only, as published by the Free Software Foundation.
+ *
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
+ */
+
+#include <linux/version.h>
+#include <linux/slab.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/wait.h>
+#include <linux/delay.h>
+#include <linux/mutex.h>
+#include <linux/io.h>
+
+#include "cxd2099.h"
+
+#define MAX_BUFFER_SIZE 248
+
+struct cxd {
+        struct dvb_ca_en50221 en;
+
+        struct i2c_adapter *i2c;
+        u8     adr;
+        u8     regs[0x23];
+        u8     lastaddress;
+        u8     clk_reg_f;
+        u8     clk_reg_b;
+        int    mode;
+        u32    bitrate;
+        int    ready;
+        int    dr;
+        int    slot_stat;
+
+        u8     amem[1024];
+        int    amem_read;
+
+        int    cammode;
+        struct mutex lock;
+};
+
+static int i2c_write_reg(struct i2c_adapter *adapter, u8 adr,
+                         u8 reg, u8 data)
+{
+        u8 m[2] = {reg, data};
+        struct i2c_msg msg = {.addr = adr, .flags = 0, .buf = m, .len = 2};
+
+        if (i2c_transfer(adapter, &msg, 1) != 1) {
+                printk(KERN_ERR "Failed to write to I2C register %02x@%02x!\n",
+                       reg, adr);
+                return -1;
+        }
+        return 0;
+}
+
+static int i2c_write(struct i2c_adapter *adapter, u8 adr,
+                     u8 *data, u8 len)
+{
+        struct i2c_msg msg = {.addr = adr, .flags = 0, .buf = data, .len = len};
+
+        if (i2c_transfer(adapter, &msg, 1) != 1) {
+                printk(KERN_ERR "Failed to write to I2C!\n");
+                return -1;
+        }
+        return 0;
+}
+
+static int i2c_read_reg(struct i2c_adapter *adapter, u8 adr,
+                        u8 reg, u8 *val)
+{
+        struct i2c_msg msgs[2] = {{.addr = adr, .flags = 0,
+                                   .buf = &reg, .len = 1 },
+                                  {.addr = adr, .flags = I2C_M_RD,
+                                   .buf = val, .len = 1 } };
+
+        if (i2c_transfer(adapter, msgs, 2) != 2) {
+                printk(KERN_ERR "error in i2c_read_reg\n");
+                return -1;
+        }
+        return 0;
+}
+
+static int i2c_read(struct i2c_adapter *adapter, u8 adr,
+                    u8 reg, u8 *data, u8 n)
+{
+        struct i2c_msg msgs[2] = {{.addr = adr, .flags = 0,
+                                   .buf = &reg, .len = 1 },
+                                  {.addr = adr, .flags = I2C_M_RD,
+                                   .buf = data, .len = n } };
+
+        if (i2c_transfer(adapter, msgs, 2) != 2) {
+                printk(KERN_ERR "error in i2c_read\n");
+                return -1;
+        }
+        return 0;
+}
+
+static int read_block(struct cxd *ci, u8 adr, u8 *data, u8 n)
+{
+        int status;
+
+        status = i2c_write_reg(ci->i2c, ci->adr, 0, adr);
+        if (!status) {
+                ci->lastaddress = adr;
+                status = i2c_read(ci->i2c, ci->adr, 1, data, n);
+        }
+        return status;
+}
+
+static int read_reg(struct cxd *ci, u8 reg, u8 *val)
+{
+        return read_block(ci, reg, val, 1);
+}
+
+
+static int read_pccard(struct cxd *ci, u16 address, u8 *data, u8 n)
+{
+        int status;
+        u8 addr[3] = { 2, address&0xff, address>>8 };
+
+        status = i2c_write(ci->i2c, ci->adr, addr, 3);
+        if (!status)
+                status = i2c_read(ci->i2c, ci->adr, 3, data, n);
+        return status;
+}
+
+static int write_pccard(struct cxd *ci, u16 address, u8 *data, u8 n)
+{
+        int status;
+        u8 addr[3] = { 2, address&0xff, address>>8 };
+
+        status = i2c_write(ci->i2c, ci->adr, addr, 3);
+        if (!status) {
+                u8 buf[256] = {3};
+                memcpy(buf+1, data, n);
+                status = i2c_write(ci->i2c, ci->adr, buf, n+1);
+        }
+        return status;
+}
+
+static int read_io(struct cxd *ci, u16 address, u8 *val)
+{
+        int status;
+        u8 addr[3] = { 2, address&0xff, address>>8 };
+
+        status = i2c_write(ci->i2c, ci->adr, addr, 3);
+        if (!status)
+                status = i2c_read(ci->i2c, ci->adr, 3, val, 1);
+        return status;
+}
+
+static int write_io(struct cxd *ci, u16 address, u8 val)
+{
+        int status;
+        u8 addr[3] = { 2, address&0xff, address>>8 };
+        u8 buf[2] = { 3, val };
+
+        status = i2c_write(ci->i2c, ci->adr, addr, 3);
+        if (!status)
+                status = i2c_write(ci->i2c, ci->adr, buf, 2);
+
+        return status;
+}
+
+
+static int write_regm(struct cxd *ci, u8 reg, u8 val, u8 mask)
+{
+        int status;
+
+        status = i2c_write_reg(ci->i2c, ci->adr, 0, reg);
+        if (!status && reg >= 6 && reg <= 8 && mask != 0xff)
+                status = i2c_read_reg(ci->i2c, ci->adr, 1, &ci->regs[reg]);
+        ci->regs[reg] = (ci->regs[reg]&(~mask))|val;
+        if (!status) {
+                ci->lastaddress = reg;
+                status = i2c_write_reg(ci->i2c, ci->adr, 1, ci->regs[reg]);
+        }
+        if (reg == 0x20)
+                ci->regs[reg] &= 0x7f;
+        return status;
+}
+
+static int write_reg(struct cxd *ci, u8 reg, u8 val)
+{
+        return write_regm(ci, reg, val, 0xff);
+}
+
+#ifdef BUFFER_MODE
+static int write_block(struct cxd *ci, u8 adr, u8 *data, int n)
+{
+        int status;
+        u8 buf[256] = {1};
+
+        status = i2c_write_reg(ci->i2c, ci->adr, 0, adr);
+        if (!status) {
+                ci->lastaddress = adr;
+                memcpy(buf+1, data, n);
+                status = i2c_write(ci->i2c, ci->adr, buf, n+1);
+        }
+        return status;
+}
+#endif
+
+static void set_mode(struct cxd *ci, int mode)
+{
+        if (mode == ci->mode)
+                return;
+
+        switch (mode) {
+        case 0x00: /* IO mem */
+                write_regm(ci, 0x06, 0x00, 0x07);
+                break;
+        case 0x01: /* ATT mem */
+                write_regm(ci, 0x06, 0x02, 0x07);
+                break;
+        default:
+                break;
+        }
+        ci->mode = mode;
+}
+
+static void cam_mode(struct cxd *ci, int mode)
+{
+        if (mode == ci->cammode)
+                return;
+
+        switch (mode) {
+        case 0x00:
+                write_regm(ci, 0x20, 0x80, 0x80);
+                break;
+        case 0x01:
+                printk(KERN_INFO "enable cam buffer mode\n");
+                /* write_reg(ci, 0x0d, 0x00); */
+                /* write_reg(ci, 0x0e, 0x01); */
+                write_regm(ci, 0x08, 0x40, 0x40);
+                /* read_reg(ci, 0x12, &dummy); */
+                write_regm(ci, 0x08, 0x80, 0x80);
+                break;
+        default:
+                break;
+        }
+        ci->cammode = mode;
+}
+
+
+
+#define CHK_ERROR(s) if ((status = s)) break
+
+static int init(struct cxd *ci)
+{
+        int status;
+
+        mutex_lock(&ci->lock);
+        ci->mode = -1;
+        do {
+                CHK_ERROR(write_reg(ci, 0x00, 0x00));
+                CHK_ERROR(write_reg(ci, 0x01, 0x00));
+                CHK_ERROR(write_reg(ci, 0x02, 0x10));
+                CHK_ERROR(write_reg(ci, 0x03, 0x00));
+                CHK_ERROR(write_reg(ci, 0x05, 0xFF));
+                CHK_ERROR(write_reg(ci, 0x06, 0x1F));
+                CHK_ERROR(write_reg(ci, 0x07, 0x1F));
+                CHK_ERROR(write_reg(ci, 0x08, 0x28));
+                CHK_ERROR(write_reg(ci, 0x14, 0x20));
+
+                CHK_ERROR(write_reg(ci, 0x09, 0x4D)); /* Input Mode C, BYPass Serial, TIVAL = low, MSB */
+                CHK_ERROR(write_reg(ci, 0x0A, 0xA7)); /* TOSTRT = 8, Mode B (gated clock), falling Edge, Serial, POL=HIGH, MSB */
+
+                /* Sync detector */
+                CHK_ERROR(write_reg(ci, 0x0B, 0x33));
+                CHK_ERROR(write_reg(ci, 0x0C, 0x33));
+
+                CHK_ERROR(write_regm(ci, 0x14, 0x00, 0x0F));
+                CHK_ERROR(write_reg(ci, 0x15, ci->clk_reg_b));
+                CHK_ERROR(write_regm(ci, 0x16, 0x00, 0x0F));
+                CHK_ERROR(write_reg(ci, 0x17, ci->clk_reg_f));
+
+                CHK_ERROR(write_reg(ci, 0x20, 0x28)); /* Integer Divider, Falling Edge, Internal Sync, */
+                CHK_ERROR(write_reg(ci, 0x21, 0x00)); /* MCLKI = TICLK/8 */
+                CHK_ERROR(write_reg(ci, 0x22, 0x07)); /* MCLKI = TICLK/8 */
+
+
+                CHK_ERROR(write_regm(ci, 0x20, 0x80, 0x80)); /* Reset CAM state machine */
+
+                CHK_ERROR(write_regm(ci, 0x03, 0x02, 02));  /* Enable IREQA Interrupt */
+                CHK_ERROR(write_reg(ci, 0x01, 0x04));  /* Enable CD Interrupt */
+                CHK_ERROR(write_reg(ci, 0x00, 0x31));  /* Enable TS1,Hot Swap,Slot A */
+                CHK_ERROR(write_regm(ci, 0x09, 0x08, 0x08));  /* Put TS in bypass */
+                ci->cammode = -1;
+#ifdef BUFFER_MODE
+                cam_mode(ci, 0);
+#endif
+        } while (0);
+        mutex_unlock(&ci->lock);
+
+        return 0;
+}
+
+
+static int read_attribute_mem(struct dvb_ca_en50221 *ca,
+                              int slot, int address)
+{
+        struct cxd *ci = ca->data;
+        u8 val;
+        mutex_lock(&ci->lock);
+        set_mode(ci, 1);
+        read_pccard(ci, address, &val, 1);
+        mutex_unlock(&ci->lock);
+        return val;
+}
+
+
+static int write_attribute_mem(struct dvb_ca_en50221 *ca, int slot,
+                               int address, u8 value)
+{
+        struct cxd *ci = ca->data;
+
+        mutex_lock(&ci->lock);
+        set_mode(ci, 1);
+        write_pccard(ci, address, &value, 1);
+        mutex_unlock(&ci->lock);
+        return 0;
+}
+
+static int read_cam_control(struct dvb_ca_en50221 *ca,
+                            int slot, u8 address)
+{
+        struct cxd *ci = ca->data;
+        u8 val;
+
+        mutex_lock(&ci->lock);
+        set_mode(ci, 0);
+        read_io(ci, address, &val);
+        mutex_unlock(&ci->lock);
+        return val;
+}
+
+static int write_cam_control(struct dvb_ca_en50221 *ca, int slot,
+                             u8 address, u8 value)
+{
+        struct cxd *ci = ca->data;
+
+        mutex_lock(&ci->lock);
+        set_mode(ci, 0);
+        write_io(ci, address, value);
+        mutex_unlock(&ci->lock);
+        return 0;
+}
+
+static int slot_reset(struct dvb_ca_en50221 *ca, int slot)
+{
+        struct cxd *ci = ca->data;
+
+        mutex_lock(&ci->lock);
+        cam_mode(ci, 0);
+        write_reg(ci, 0x00, 0x21);
+        write_reg(ci, 0x06, 0x1F);
+        write_reg(ci, 0x00, 0x31);
+        write_regm(ci, 0x20, 0x80, 0x80);
+        write_reg(ci, 0x03, 0x02);
+        ci->ready = 0;
+        ci->mode = -1;
+        {
+                int i;
+                for (i = 0; i < 100; i++) {
+                        msleep(10);
+                        if (ci->ready)
+                                break;
+                }
+        }
+        mutex_unlock(&ci->lock);
+        /* msleep(500); */
+        return 0;
+}
+
+static int slot_shutdown(struct dvb_ca_en50221 *ca, int slot)
+{
+        struct cxd *ci = ca->data;
+
+        printk(KERN_INFO "slot_shutdown\n");
+        mutex_lock(&ci->lock);
+        /* write_regm(ci, 0x09, 0x08, 0x08); */
+        write_regm(ci, 0x20, 0x80, 0x80);
+        write_regm(ci, 0x06, 0x07, 0x07);
+        ci->mode = -1;
+        mutex_unlock(&ci->lock);
+        return 0; /* shutdown(ci); */
+}
+
+static int slot_ts_enable(struct dvb_ca_en50221 *ca, int slot)
+{
+        struct cxd *ci = ca->data;
+
+        mutex_lock(&ci->lock);
+        write_regm(ci, 0x09, 0x00, 0x08);
+        set_mode(ci, 0);
+#ifdef BUFFER_MODE
+        cam_mode(ci, 1);
+#endif
+        mutex_unlock(&ci->lock);
+        return 0;
+}
+
+
+static int campoll(struct cxd *ci)
+{
+        u8 istat;
+
+        read_reg(ci, 0x04, &istat);
+        if (!istat)
+                return 0;
+        write_reg(ci, 0x05, istat);
+
+        if (istat&0x40) {
+                ci->dr = 1;
+                printk(KERN_INFO "DR\n");
+        }
+        if (istat&0x20)
+                printk(KERN_INFO "WC\n");
+
+        if (istat&2) {
+                u8 slotstat;
+
+                read_reg(ci, 0x01, &slotstat);
+                if (!(2&slotstat)) {
+                        if (!ci->slot_stat) {
+                                ci->slot_stat |= DVB_CA_EN50221_POLL_CAM_PRESENT;
+                                write_regm(ci, 0x03, 0x08, 0x08);
+                        }
+
+                } else {
+                        if (ci->slot_stat) {
+                                ci->slot_stat = 0;
+                                write_regm(ci, 0x03, 0x00, 0x08);
+                                printk(KERN_INFO "NO CAM\n");
+                                ci->ready = 0;
+                        }
+                }
+                if (istat&8 && ci->slot_stat == DVB_CA_EN50221_POLL_CAM_PRESENT) {
+                        ci->ready = 1;
+                        ci->slot_stat |= DVB_CA_EN50221_POLL_CAM_READY;
+                        printk(KERN_INFO "READY\n");
+                }
+        }
+        return 0;
+}
+
+
+static int poll_slot_status(struct dvb_ca_en50221 *ca, int slot, int open)
+{
+        struct cxd *ci = ca->data;
+        u8 slotstat;
+
+        mutex_lock(&ci->lock);
+        campoll(ci);
+        read_reg(ci, 0x01, &slotstat);
+        mutex_unlock(&ci->lock);
+
+        return ci->slot_stat;
+}
+
+#ifdef BUFFER_MODE
+static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount)
+{
+        struct cxd *ci = ca->data;
+        u8 msb, lsb;
+        u16 len;
+
+        mutex_lock(&ci->lock);
+        campoll(ci);
+        mutex_unlock(&ci->lock);
+
+        printk(KERN_INFO "read_data\n");
+        if (!ci->dr)
+                return 0;
+
+        mutex_lock(&ci->lock);
+        read_reg(ci, 0x0f, &msb);
+        read_reg(ci, 0x10, &lsb);
+        len = (msb<<8)|lsb;
+        read_block(ci, 0x12, ebuf, len);
+        ci->dr = 0;
+        mutex_unlock(&ci->lock);
+
+        return len;
+}
+
+static int write_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount)
+{
+        struct cxd *ci = ca->data;
+
+        mutex_lock(&ci->lock);
+        printk(KERN_INFO "write_data %d\n", ecount);
+        write_reg(ci, 0x0d, ecount>>8);
+        write_reg(ci, 0x0e, ecount&0xff);
+        write_block(ci, 0x11, ebuf, ecount);
+        mutex_unlock(&ci->lock);
+        return ecount;
+}
+#endif
+
+static struct dvb_ca_en50221 en_templ = {
+        .read_attribute_mem  = read_attribute_mem,
+        .write_attribute_mem = write_attribute_mem,
+        .read_cam_control    = read_cam_control,
+        .write_cam_control   = write_cam_control,
+        .slot_reset          = slot_reset,
+        .slot_shutdown       = slot_shutdown,
+        .slot_ts_enable      = slot_ts_enable,
+        .poll_slot_status    = poll_slot_status,
+#ifdef BUFFER_MODE
+        .read_data           = read_data,
+        .write_data          = write_data,
+#endif
+
+};
+
+struct dvb_ca_en50221 *cxd2099_attach(u8 adr, void *priv,
+                                      struct i2c_adapter *i2c)
+{
+        struct cxd *ci = 0;
+        u32 bitrate = 62000000;
+        u8 val;
+
+        if (i2c_read_reg(i2c, adr, 0, &val) < 0) {
+                printk(KERN_ERR "No CXD2099 detected at %02x\n", adr);
+                return 0;
+        }
+
+        ci = kmalloc(sizeof(struct cxd), GFP_KERNEL);
+        if (!ci)
+                return 0;
+        memset(ci, 0, sizeof(*ci));
+
+        mutex_init(&ci->lock);
+        ci->i2c = i2c;
+        ci->adr = adr;
+        ci->lastaddress = 0xff;
+        ci->clk_reg_b = 0x4a;
+        ci->clk_reg_f = 0x1b;
+        ci->bitrate = bitrate;
+
+        memcpy(&ci->en, &en_templ, sizeof(en_templ));
+        ci->en.data = ci;
+        init(ci);
+        printk(KERN_INFO "Attached CXD2099AR at %02x\n", ci->adr);
+        return &ci->en;
+}
+EXPORT_SYMBOL(cxd2099_attach);
+
+MODULE_DESCRIPTION("cxd2099");
+MODULE_AUTHOR("Ralph Metzler <rjkm@metzlerbros.de>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/ngene/cxd2099.h b/drivers/media/dvb/ngene/cxd2099.h
new file mode 100644
index 000000000000..f71b807e8bb7
--- /dev/null
+++ b/drivers/media/dvb/ngene/cxd2099.h
@@ -0,0 +1,32 @@
+/*
+ * cxd2099.h: Driver for the CXD2099AR Common Interface Controller
+ *
+ * Copyright (C) 2010 DigitalDevices UG
+ *
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 only, as published by the Free Software Foundation.
+ *
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
+ */
+
+#ifndef _CXD2099_H_
+#define _CXD2099_H_
+
+#include <dvb_ca_en50221.h>
+
+struct dvb_ca_en50221 *cxd2099_attach(u8 adr, void *priv, struct i2c_adapter *i2c);
+
+#endif
diff --git a/drivers/media/dvb/ngene/ngene-cards.c b/drivers/media/dvb/ngene/ngene-cards.c
index fc93d1064d4e..93e6f9e954ca 100644
--- a/drivers/media/dvb/ngene/ngene-cards.c
+++ b/drivers/media/dvb/ngene/ngene-cards.c
@@ -317,7 +317,8 @@ static struct ngene_info ngene_info_satixS2v2 = {
 static struct ngene_info ngene_info_cineS2v5 = {
         .type           = NGENE_SIDEWINDER,
         .name           = "Linux4Media cineS2 DVB-S2 Twin Tuner (v5)",
-        .io_type        = {NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN},
+        .io_type        = {NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN,
+                           NGENE_IO_TSOUT},
         .demod_attach   = {demod_attach_stv0900, demod_attach_stv0900, cineS2_probe, cineS2_probe},
         .tuner_attach   = {tuner_attach_stv6110, tuner_attach_stv6110, tuner_attach_stv6110, tuner_attach_stv6110},
         .fe_config      = {&fe_cineS2, &fe_cineS2, &fe_cineS2_2, &fe_cineS2_2},
@@ -332,7 +333,8 @@ static struct ngene_info ngene_info_cineS2v5 = {
 static struct ngene_info ngene_info_duoFlexS2 = {
         .type           = NGENE_SIDEWINDER,
         .name           = "Digital Devices DuoFlex S2 miniPCIe",
-        .io_type        = {NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN},
+        .io_type        = {NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN, NGENE_IO_TSIN,
+                           NGENE_IO_TSOUT},
         .demod_attach   = {cineS2_probe, cineS2_probe, cineS2_probe, cineS2_probe},
         .tuner_attach   = {tuner_attach_stv6110, tuner_attach_stv6110, tuner_attach_stv6110, tuner_attach_stv6110},
         .fe_config      = {&fe_cineS2, &fe_cineS2, &fe_cineS2_2, &fe_cineS2_2},
diff --git a/drivers/media/dvb/ngene/ngene-core.c b/drivers/media/dvb/ngene/ngene-core.c
index 831b7586e88f..deaf72aab058 100644
--- a/drivers/media/dvb/ngene/ngene-core.c
+++ b/drivers/media/dvb/ngene/ngene-core.c
@@ -45,7 +45,6 @@ static int one_adapter = 1;
 module_param(one_adapter, int, 0444);
 MODULE_PARM_DESC(one_adapter, "Use only one adapter.");
 
-
 static int debug;
 module_param(debug, int, 0444);
 MODULE_PARM_DESC(debug, "Print debugging information.");
@@ -476,7 +475,7 @@ static u8 SPDIFConfiguration[10] = {
 
 static u8 TS_I2SConfiguration[4] = { 0x3E, 0x18, 0x00, 0x00 };
 
-static u8 TS_I2SOutConfiguration[4] = { 0x80, 0x20, 0x00, 0x00 };
+static u8 TS_I2SOutConfiguration[4] = { 0x80, 0x04, 0x00, 0x00 };
 
 static u8 ITUDecoderSetup[4][16] = {
         {0x1c, 0x13, 0x01, 0x68, 0x3d, 0x90, 0x14, 0x20,  /* SDTV */
@@ -749,13 +748,11 @@ void set_transfer(struct ngene_channel *chan, int state)
                 if (chan->mode & NGENE_IO_TSOUT) {
                         chan->pBufferExchange = tsout_exchange;
                         /* 0x66666666 = 50MHz *2^33 /250MHz */
-                        chan->AudioDTOValue = 0x66666666;
-                        /* set_dto(chan, 38810700+1000); */
-                        /* set_dto(chan, 19392658); */
+                        chan->AudioDTOValue = 0x80000000;
+                        chan->AudioDTOUpdated = 1;
                 }
                 if (chan->mode & NGENE_IO_TSIN)
                         chan->pBufferExchange = tsin_exchange;
-                /* ngwritel(0, 0x9310); */
                 spin_unlock_irq(&chan->state_lock);
         } else
                 ;/* printk(KERN_INFO DEVICE_NAME ": lock=%08x\n",
@@ -1168,6 +1165,7 @@ static void ngene_release_buffers(struct ngene *dev)
                 iounmap(dev->iomem);
         free_common_buffers(dev);
         vfree(dev->tsout_buf);
+        vfree(dev->tsin_buf);
         vfree(dev->ain_buf);
         vfree(dev->vin_buf);
         vfree(dev);
@@ -1184,6 +1182,13 @@ static int ngene_get_buffers(struct ngene *dev)
                 dvb_ringbuffer_init(&dev->tsout_rbuf,
                                     dev->tsout_buf, TSOUT_BUF_SIZE);
         }
+        if (dev->card_info->io_type[2]&NGENE_IO_TSIN) {
+                dev->tsin_buf = vmalloc(TSIN_BUF_SIZE);
+                if (!dev->tsin_buf)
+                        return -ENOMEM;
+                dvb_ringbuffer_init(&dev->tsin_rbuf,
+                                    dev->tsin_buf, TSIN_BUF_SIZE);
+        }
         if (dev->card_info->io_type[2] & NGENE_IO_AIN) {
                 dev->ain_buf = vmalloc(AIN_BUF_SIZE);
                 if (!dev->ain_buf)
@@ -1307,6 +1312,35 @@ static void ngene_stop(struct ngene *dev)
 #endif
 }
 
+static int ngene_buffer_config(struct ngene *dev)
+{
+        int stat;
+
+        if (dev->card_info->fw_version >= 17) {
+                u8 tsin12_config[6]   = { 0x60, 0x60, 0x00, 0x00, 0x00, 0x00 };
+                u8 tsin1234_config[6] = { 0x30, 0x30, 0x00, 0x30, 0x30, 0x00 };
+                u8 tsio1235_config[6] = { 0x30, 0x30, 0x00, 0x28, 0x00, 0x38 };
+                u8 *bconf = tsin12_config;
+
+                if (dev->card_info->io_type[2]&NGENE_IO_TSIN &&
+                    dev->card_info->io_type[3]&NGENE_IO_TSIN) {
+                        bconf = tsin1234_config;
+                        if (dev->card_info->io_type[4]&NGENE_IO_TSOUT &&
+                            dev->ci.en)
+                                bconf = tsio1235_config;
+                }
+                stat = ngene_command_config_free_buf(dev, bconf);
+        } else {
+                int bconf = BUFFER_CONFIG_4422;
+
+                if (dev->card_info->io_type[3] == NGENE_IO_TSIN)
+                        bconf = BUFFER_CONFIG_3333;
+                stat = ngene_command_config_buf(dev, bconf);
+        }
+        return stat;
+}
+
+
 static int ngene_start(struct ngene *dev)
 {
         int stat;
@@ -1371,23 +1405,6 @@ static int ngene_start(struct ngene *dev)
         if (stat < 0)
                 goto fail;
 
-        if (dev->card_info->fw_version >= 17) {
-                u8 tsin4_config[6] = {
-                        3072 / 64, 3072 / 64, 0, 3072 / 64, 3072 / 64, 0};
-                u8 default_config[6] = {
-                        4096 / 64, 4096 / 64, 0, 2048 / 64, 2048 / 64, 0};
-                u8 *bconf = default_config;
-
-                if (dev->card_info->io_type[3] == NGENE_IO_TSIN)
-                        bconf = tsin4_config;
-                dprintk(KERN_DEBUG DEVICE_NAME ": FW 17+ buffer config\n");
-                stat = ngene_command_config_free_buf(dev, bconf);
-        } else {
-                int bconf = BUFFER_CONFIG_4422;
-                if (dev->card_info->io_type[3] == NGENE_IO_TSIN)
-                        bconf = BUFFER_CONFIG_3333;
-                stat = ngene_command_config_buf(dev, bconf);
-        }
         if (!stat)
                 return stat;
 
@@ -1403,9 +1420,6 @@ fail2:
         return stat;
 }
 
-
-
-
 /****************************************************************************/
 /****************************************************************************/
 /****************************************************************************/
@@ -1422,7 +1436,12 @@ static void release_channel(struct ngene_channel *chan)
 
         tasklet_kill(&chan->demux_tasklet);
 
+        if (chan->number >= 2 && chan->number <= 3 && dev->ci.en)
+                return;
+
         if (io & (NGENE_IO_TSIN | NGENE_IO_TSOUT)) {
+                if (chan->ci_dev)
+                        dvb_unregister_device(chan->ci_dev);
                 if (chan->fe) {
                         dvb_unregister_frontend(chan->fe);
                         dvb_frontend_detach(chan->fe);
@@ -1458,6 +1477,9 @@ static int init_channel(struct ngene_channel *chan)
         if (io & (NGENE_IO_TSIN | NGENE_IO_TSOUT)) {
                 if (nr >= STREAM_AUDIOIN1)
                         chan->DataFormatFlags = DF_SWAP32;
+
+                if (nr >= 2 && nr <= 3 && dev->ci.en)
+                        return 0;
                 if (nr == 0 || !one_adapter || dev->first_adapter == NULL) {
                         adapter = &dev->adapter[nr];
                         ret = dvb_register_adapter(adapter, "nGene",
@@ -1478,6 +1500,15 @@ static int init_channel(struct ngene_channel *chan)
                 ret = my_dvb_dmxdev_ts_card_init(&chan->dmxdev, &chan->demux,
                                                  &chan->hw_frontend,
                                                  &chan->mem_frontend, adapter);
+                if (dev->ci.en && (io&NGENE_IO_TSOUT)) {
+                        dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
+                        set_transfer(chan, 1);
+                        set_transfer(&chan->dev->channel[2], 1);
+
+                        dvb_register_device(adapter, &chan->ci_dev,
+                                            &ngene_dvbdev_ci, (void *) chan,
+                                            DVB_DEVICE_SEC);
+                }
         }
 
         if (io & NGENE_IO_TSIN) {
@@ -1525,6 +1556,24 @@ static int init_channels(struct ngene *dev)
         return 0;
 }
 
+static void cxd_attach(struct ngene *dev)
+{
+        struct ngene_ci *ci = &dev->ci;
+
+        ci->en = cxd2099_attach(0x40, dev, &dev->channel[0].i2c_adapter);
+        ci->dev = dev;
+        return;
+}
+
+static void cxd_detach(struct ngene *dev)
+{
+        struct ngene_ci *ci = &dev->ci;
+
+        dvb_ca_en50221_release(ci->en);
+        kfree(ci->en);
+        ci->en = 0;
+}
+
 /****************************************************************************/
 /* device probe/remove calls ************************************************/
 /****************************************************************************/
@@ -1537,6 +1586,8 @@ void __devexit ngene_remove(struct pci_dev *pdev)
         tasklet_kill(&dev->event_tasklet);
         for (i = MAX_STREAM - 1; i >= 0; i--)
                 release_channel(&dev->channel[i]);
+        if (dev->ci.en)
+                cxd_detach(dev);
         ngene_stop(dev);
         ngene_release_buffers(dev);
         pci_set_drvdata(pdev, NULL);
@@ -1572,6 +1623,13 @@ int __devinit ngene_probe(struct pci_dev *pci_dev,
         if (stat < 0)
                 goto fail1;
 
+        cxd_attach(dev);
+
+        stat = ngene_buffer_config(dev);
+        if (stat < 0)
+                goto fail1;
+
+
         dev->i2c_current_bus = -1;
 
         /* Register DVB adapters and devices for both channels */
diff --git a/drivers/media/dvb/ngene/ngene-dvb.c b/drivers/media/dvb/ngene/ngene-dvb.c
index 8bb159370c70..0b4943233166 100644
--- a/drivers/media/dvb/ngene/ngene-dvb.c
+++ b/drivers/media/dvb/ngene/ngene-dvb.c
@@ -47,6 +47,64 @@
 /* COMMAND API interface ****************************************************/
 /****************************************************************************/
 
+static ssize_t ts_write(struct file *file, const char *buf,
+                        size_t count, loff_t *ppos)
+{
+        struct dvb_device *dvbdev = file->private_data;
+        struct ngene_channel *chan = dvbdev->priv;
+        struct ngene *dev = chan->dev;
+
+        if (wait_event_interruptible(dev->tsout_rbuf.queue,
+                                     dvb_ringbuffer_free
+                                     (&dev->tsout_rbuf) >= count) < 0)
+                return 0;
+
+        dvb_ringbuffer_write(&dev->tsout_rbuf, buf, count);
+
+        return count;
+}
+
+static ssize_t ts_read(struct file *file, char *buf,
+                       size_t count, loff_t *ppos)
+{
+        struct dvb_device *dvbdev = file->private_data;
+        struct ngene_channel *chan = dvbdev->priv;
+        struct ngene *dev = chan->dev;
+        int left, avail;
+
+        left = count;
+        while (left) {
+                if (wait_event_interruptible(
+                            dev->tsin_rbuf.queue,
+                            dvb_ringbuffer_avail(&dev->tsin_rbuf) > 0) < 0)
+                        return -EAGAIN;
+                avail = dvb_ringbuffer_avail(&dev->tsin_rbuf);
+                if (avail > left)
+                        avail = left;
+                dvb_ringbuffer_read_user(&dev->tsin_rbuf, buf, avail);
+                left -= avail;
+                buf += avail;
+        }
+        return count;
+}
+
+static const struct file_operations ci_fops = {
+        .owner   = THIS_MODULE,
+        .read    = ts_read,
+        .write   = ts_write,
+        .open    = dvb_generic_open,
+        .release = dvb_generic_release,
+};
+
+struct dvb_device ngene_dvbdev_ci = {
+        .priv    = 0,
+        .readers = -1,
+        .writers = -1,
+        .users   = -1,
+        .fops    = &ci_fops,
+};
+
+
 /****************************************************************************/
 /* DVB functions and API interface ******************************************/
 /****************************************************************************/
@@ -63,11 +121,19 @@ static void swap_buffer(u32 *p, u32 len)
 void *tsin_exchange(void *priv, void *buf, u32 len, u32 clock, u32 flags)
 {
         struct ngene_channel *chan = priv;
+        struct ngene *dev = chan->dev;
 
 
+        if (flags & DF_SWAP32)
+                swap_buffer(buf, len);
+        if (dev->ci.en && chan->number == 2) {
+                if (dvb_ringbuffer_free(&dev->tsin_rbuf) > len) {
+                        dvb_ringbuffer_write(&dev->tsin_rbuf, buf, len);
+                        wake_up_interruptible(&dev->tsin_rbuf.queue);
+                }
+                return 0;
+        }
         if (chan->users > 0) {
-                if (flags & DF_SWAP32)
-                        swap_buffer(buf, len);
                 dvb_dmx_swfilter(&chan->demux, buf, len);
         }
         return NULL;
diff --git a/drivers/media/dvb/ngene/ngene.h b/drivers/media/dvb/ngene/ngene.h
index 8fb4200f83f8..f7834066386f 100644
--- a/drivers/media/dvb/ngene/ngene.h
+++ b/drivers/media/dvb/ngene/ngene.h
@@ -36,8 +36,10 @@
 #include "dmxdev.h"
 #include "dvbdev.h"
 #include "dvb_demux.h"
+#include "dvb_ca_en50221.h"
 #include "dvb_frontend.h"
 #include "dvb_ringbuffer.h"
+#include "cxd2099.h"
 
 #define DEVICE_NAME "ngene"
 
@@ -644,6 +646,7 @@ struct ngene_channel {
         struct dmx_frontend   mem_frontend;
         int                   users;
         struct video_device  *v4l_dev;
+        struct dvb_device    *ci_dev;
         struct tasklet_struct demux_tasklet;
 
         struct SBufferHeader *nextBuffer;
@@ -710,6 +713,15 @@ struct ngene_channel {
         int running;
 };
 
+
+struct ngene_ci {
+        struct device         device;
+        struct i2c_adapter    i2c_adapter;
+
+        struct ngene         *dev;
+        struct dvb_ca_en50221 *en;
+};
+
 struct ngene;
 
 typedef void (rx_cb_t)(struct ngene *, u32, u8);
@@ -774,6 +786,10 @@ struct ngene {
 #define TSOUT_BUF_SIZE (512*188*8)
         struct dvb_ringbuffer tsout_rbuf;
 
+        u8                   *tsin_buf;
+#define TSIN_BUF_SIZE (512*188*8)
+        struct dvb_ringbuffer tsin_rbuf;
+
         u8                   *ain_buf;
 #define AIN_BUF_SIZE (128*1024)
         struct dvb_ringbuffer ain_rbuf;
@@ -785,6 +801,8 @@ struct ngene {
 
         unsigned long         exp_val;
         int prev_cmd;
+
+        struct ngene_ci       ci;
 };
 
 struct ngene_info {
@@ -872,6 +890,7 @@ void FillTSBuffer(void *Buffer, int Length, u32 Flags);
 int ngene_i2c_init(struct ngene *dev, int dev_nr);
 
 /* Provided by ngene-dvb.c */
+extern struct dvb_device ngene_dvbdev_ci;
 void *tsout_exchange(void *priv, void *buf, u32 len, u32 clock, u32 flags);
 void *tsin_exchange(void *priv, void *buf, u32 len, u32 clock, u32 flags);
 int ngene_start_feed(struct dvb_demux_feed *dvbdmxfeed);