1 /*
2  * dvb_ca.c: generic DVB functions for EN50221 CAM interfaces
3  *
4  * Copyright (C) 2004 Andrew de Quincey
5  *
6  * Parts of this file were based on sources as follows:
7  *
8  * Copyright (C) 2003 Ralph Metzler <rjkm@metzlerbros.de>
9  *
10  * based on code:
11  *
12  * Copyright (C) 1999-2002 Ralph  Metzler
13  *                       & Marcus Metzler for convergence integrated media GmbH
14  *
15  * This program is free software; you can redistribute it and/or
16  * modify it under the terms of the GNU General Public License
17  * as published by the Free Software Foundation; either version 2
18  * of the License, or (at your option) any later version.
19  *
20  * This program is distributed in the hope that it will be useful,
21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
23  * GNU General Public License for more details.
24  *
25  * You should have received a copy of the GNU General Public License
26  * along with this program; if not, write to the Free Software
27  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
28  * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
29  */
30 
31 #include <linux/errno.h>
32 #include <linux/slab.h>
33 #include <linux/list.h>
34 #include <linux/module.h>
35 #include <linux/vmalloc.h>
36 #include <linux/delay.h>
37 #include <linux/spinlock.h>
38 #include <linux/sched.h>
39 #include <linux/kthread.h>
40 
41 #include "dvb_ca_en50221.h"
42 #include "dvb_ringbuffer.h"
43 
44 static int dvb_ca_en50221_debug;
45 
46 module_param_named(cam_debug, dvb_ca_en50221_debug, int, 0644);
47 MODULE_PARM_DESC(cam_debug, "enable verbose debug messages");
48 
49 #define dprintk if (dvb_ca_en50221_debug) printk
50 
51 #define INIT_TIMEOUT_SECS 10
52 
53 #define HOST_LINK_BUF_SIZE 0x200
54 
55 #define RX_BUFFER_SIZE 65535
56 
57 #define MAX_RX_PACKETS_PER_ITERATION 10
58 
59 #define CTRLIF_DATA      0
60 #define CTRLIF_COMMAND   1
61 #define CTRLIF_STATUS    1
62 #define CTRLIF_SIZE_LOW  2
63 #define CTRLIF_SIZE_HIGH 3
64 
65 #define CMDREG_HC        1	/* Host control */
66 #define CMDREG_SW        2	/* Size write */
67 #define CMDREG_SR        4	/* Size read */
68 #define CMDREG_RS        8	/* Reset interface */
69 #define CMDREG_FRIE   0x40	/* Enable FR interrupt */
70 #define CMDREG_DAIE   0x80	/* Enable DA interrupt */
71 #define IRQEN (CMDREG_DAIE)
72 
73 #define STATUSREG_RE     1	/* read error */
74 #define STATUSREG_WE     2	/* write error */
75 #define STATUSREG_FR  0x40	/* module free */
76 #define STATUSREG_DA  0x80	/* data available */
77 #define STATUSREG_TXERR (STATUSREG_RE|STATUSREG_WE)	/* general transfer error */
78 
79 
80 #define DVB_CA_SLOTSTATE_NONE           0
81 #define DVB_CA_SLOTSTATE_UNINITIALISED  1
82 #define DVB_CA_SLOTSTATE_RUNNING        2
83 #define DVB_CA_SLOTSTATE_INVALID        3
84 #define DVB_CA_SLOTSTATE_WAITREADY      4
85 #define DVB_CA_SLOTSTATE_VALIDATE       5
86 #define DVB_CA_SLOTSTATE_WAITFR         6
87 #define DVB_CA_SLOTSTATE_LINKINIT       7
88 
89 
90 /* Information on a CA slot */
91 struct dvb_ca_slot {
92 
93 	/* current state of the CAM */
94 	int slot_state;
95 
96 	/* mutex used for serializing access to one CI slot */
97 	struct mutex slot_lock;
98 
99 	/* Number of CAMCHANGES that have occurred since last processing */
100 	atomic_t camchange_count;
101 
102 	/* Type of last CAMCHANGE */
103 	int camchange_type;
104 
105 	/* base address of CAM config */
106 	u32 config_base;
107 
108 	/* value to write into Config Control register */
109 	u8 config_option;
110 
111 	/* if 1, the CAM supports DA IRQs */
112 	u8 da_irq_supported:1;
113 
114 	/* size of the buffer to use when talking to the CAM */
115 	int link_buf_size;
116 
117 	/* buffer for incoming packets */
118 	struct dvb_ringbuffer rx_buffer;
119 
120 	/* timer used during various states of the slot */
121 	unsigned long timeout;
122 };
123 
124 /* Private CA-interface information */
125 struct dvb_ca_private {
126 
127 	/* pointer back to the public data structure */
128 	struct dvb_ca_en50221 *pub;
129 
130 	/* the DVB device */
131 	struct dvb_device *dvbdev;
132 
133 	/* Flags describing the interface (DVB_CA_FLAG_*) */
134 	u32 flags;
135 
136 	/* number of slots supported by this CA interface */
137 	unsigned int slot_count;
138 
139 	/* information on each slot */
140 	struct dvb_ca_slot *slot_info;
141 
142 	/* wait queues for read() and write() operations */
143 	wait_queue_head_t wait_queue;
144 
145 	/* PID of the monitoring thread */
146 	struct task_struct *thread;
147 
148 	/* Flag indicating if the CA device is open */
149 	unsigned int open:1;
150 
151 	/* Flag indicating the thread should wake up now */
152 	unsigned int wakeup:1;
153 
154 	/* Delay the main thread should use */
155 	unsigned long delay;
156 
157 	/* Slot to start looking for data to read from in the next user-space read operation */
158 	int next_read_slot;
159 
160 	/* mutex serializing ioctls */
161 	struct mutex ioctl_mutex;
162 };
163 
164 static void dvb_ca_en50221_thread_wakeup(struct dvb_ca_private *ca);
165 static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * ebuf, int ecount);
166 static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 * ebuf, int ecount);
167 
168 
169 /**
170  * Safely find needle in haystack.
171  *
172  * @param haystack Buffer to look in.
173  * @param hlen Number of bytes in haystack.
174  * @param needle Buffer to find.
175  * @param nlen Number of bytes in needle.
176  * @return Pointer into haystack needle was found at, or NULL if not found.
177  */
178 static char *findstr(char * haystack, int hlen, char * needle, int nlen)
179 {
180 	int i;
181 
182 	if (hlen < nlen)
183 		return NULL;
184 
185 	for (i = 0; i <= hlen - nlen; i++) {
186 		if (!strncmp(haystack + i, needle, nlen))
187 			return haystack + i;
188 	}
189 
190 	return NULL;
191 }
192 
193 
194 
195 /* ******************************************************************************** */
196 /* EN50221 physical interface functions */
197 
198 
199 /**
200  * Check CAM status.
201  */
202 static int dvb_ca_en50221_check_camstatus(struct dvb_ca_private *ca, int slot)
203 {
204 	int slot_status;
205 	int cam_present_now;
206 	int cam_changed;
207 
208 	/* IRQ mode */
209 	if (ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE) {
210 		return (atomic_read(&ca->slot_info[slot].camchange_count) != 0);
211 	}
212 
213 	/* poll mode */
214 	slot_status = ca->pub->poll_slot_status(ca->pub, slot, ca->open);
215 
216 	cam_present_now = (slot_status & DVB_CA_EN50221_POLL_CAM_PRESENT) ? 1 : 0;
217 	cam_changed = (slot_status & DVB_CA_EN50221_POLL_CAM_CHANGED) ? 1 : 0;
218 	if (!cam_changed) {
219 		int cam_present_old = (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_NONE);
220 		cam_changed = (cam_present_now != cam_present_old);
221 	}
222 
223 	if (cam_changed) {
224 		if (!cam_present_now) {
225 			ca->slot_info[slot].camchange_type = DVB_CA_EN50221_CAMCHANGE_REMOVED;
226 		} else {
227 			ca->slot_info[slot].camchange_type = DVB_CA_EN50221_CAMCHANGE_INSERTED;
228 		}
229 		atomic_set(&ca->slot_info[slot].camchange_count, 1);
230 	} else {
231 		if ((ca->slot_info[slot].slot_state == DVB_CA_SLOTSTATE_WAITREADY) &&
232 		    (slot_status & DVB_CA_EN50221_POLL_CAM_READY)) {
233 			// move to validate state if reset is completed
234 			ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_VALIDATE;
235 		}
236 	}
237 
238 	return cam_changed;
239 }
240 
241 
242 /**
243  * Wait for flags to become set on the STATUS register on a CAM interface,
244  * checking for errors and timeout.
245  *
246  * @param ca CA instance.
247  * @param slot Slot on interface.
248  * @param waitfor Flags to wait for.
249  * @param timeout_ms Timeout in milliseconds.
250  *
251  * @return 0 on success, nonzero on error.
252  */
253 static int dvb_ca_en50221_wait_if_status(struct dvb_ca_private *ca, int slot,
254 					 u8 waitfor, int timeout_hz)
255 {
256 	unsigned long timeout;
257 	unsigned long start;
258 
259 	dprintk("%s\n", __func__);
260 
261 	/* loop until timeout elapsed */
262 	start = jiffies;
263 	timeout = jiffies + timeout_hz;
264 	while (1) {
265 		/* read the status and check for error */
266 		int res = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS);
267 		if (res < 0)
268 			return -EIO;
269 
270 		/* if we got the flags, it was successful! */
271 		if (res & waitfor) {
272 			dprintk("%s succeeded timeout:%lu\n", __func__, jiffies - start);
273 			return 0;
274 		}
275 
276 		/* check for timeout */
277 		if (time_after(jiffies, timeout)) {
278 			break;
279 		}
280 
281 		/* wait for a bit */
282 		msleep(1);
283 	}
284 
285 	dprintk("%s failed timeout:%lu\n", __func__, jiffies - start);
286 
287 	/* if we get here, we've timed out */
288 	return -ETIMEDOUT;
289 }
290 
291 
292 /**
293  * Initialise the link layer connection to a CAM.
294  *
295  * @param ca CA instance.
296  * @param slot Slot id.
297  *
298  * @return 0 on success, nonzero on failure.
299  */
300 static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot)
301 {
302 	int ret;
303 	int buf_size;
304 	u8 buf[2];
305 
306 	dprintk("%s\n", __func__);
307 
308 	/* we'll be determining these during this function */
309 	ca->slot_info[slot].da_irq_supported = 0;
310 
311 	/* set the host link buffer size temporarily. it will be overwritten with the
312 	 * real negotiated size later. */
313 	ca->slot_info[slot].link_buf_size = 2;
314 
315 	/* read the buffer size from the CAM */
316 	if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_SR)) != 0)
317 		return ret;
318 	if ((ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_DA, HZ / 10)) != 0)
319 		return ret;
320 	if ((ret = dvb_ca_en50221_read_data(ca, slot, buf, 2)) != 2)
321 		return -EIO;
322 	if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN)) != 0)
323 		return ret;
324 
325 	/* store it, and choose the minimum of our buffer and the CAM's buffer size */
326 	buf_size = (buf[0] << 8) | buf[1];
327 	if (buf_size > HOST_LINK_BUF_SIZE)
328 		buf_size = HOST_LINK_BUF_SIZE;
329 	ca->slot_info[slot].link_buf_size = buf_size;
330 	buf[0] = buf_size >> 8;
331 	buf[1] = buf_size & 0xff;
332 	dprintk("Chosen link buffer size of %i\n", buf_size);
333 
334 	/* write the buffer size to the CAM */
335 	if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0)
336 		return ret;
337 	if ((ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_FR, HZ / 10)) != 0)
338 		return ret;
339 	if ((ret = dvb_ca_en50221_write_data(ca, slot, buf, 2)) != 2)
340 		return -EIO;
341 	if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN)) != 0)
342 		return ret;
343 
344 	/* success */
345 	return 0;
346 }
347 
348 /**
349  * Read a tuple from attribute memory.
350  *
351  * @param ca CA instance.
352  * @param slot Slot id.
353  * @param address Address to read from. Updated.
354  * @param tupleType Tuple id byte. Updated.
355  * @param tupleLength Tuple length. Updated.
356  * @param tuple Dest buffer for tuple (must be 256 bytes). Updated.
357  *
358  * @return 0 on success, nonzero on error.
359  */
360 static int dvb_ca_en50221_read_tuple(struct dvb_ca_private *ca, int slot,
361 				     int *address, int *tupleType, int *tupleLength, u8 * tuple)
362 {
363 	int i;
364 	int _tupleType;
365 	int _tupleLength;
366 	int _address = *address;
367 
368 	/* grab the next tuple length and type */
369 	if ((_tupleType = ca->pub->read_attribute_mem(ca->pub, slot, _address)) < 0)
370 		return _tupleType;
371 	if (_tupleType == 0xff) {
372 		dprintk("END OF CHAIN TUPLE type:0x%x\n", _tupleType);
373 		*address += 2;
374 		*tupleType = _tupleType;
375 		*tupleLength = 0;
376 		return 0;
377 	}
378 	if ((_tupleLength = ca->pub->read_attribute_mem(ca->pub, slot, _address + 2)) < 0)
379 		return _tupleLength;
380 	_address += 4;
381 
382 	dprintk("TUPLE type:0x%x length:%i\n", _tupleType, _tupleLength);
383 
384 	/* read in the whole tuple */
385 	for (i = 0; i < _tupleLength; i++) {
386 		tuple[i] = ca->pub->read_attribute_mem(ca->pub, slot, _address + (i * 2));
387 		dprintk("  0x%02x: 0x%02x %c\n",
388 			i, tuple[i] & 0xff,
389 			((tuple[i] > 31) && (tuple[i] < 127)) ? tuple[i] : '.');
390 	}
391 	_address += (_tupleLength * 2);
392 
393 	// success
394 	*tupleType = _tupleType;
395 	*tupleLength = _tupleLength;
396 	*address = _address;
397 	return 0;
398 }
399 
400 
401 /**
402  * Parse attribute memory of a CAM module, extracting Config register, and checking
403  * it is a DVB CAM module.
404  *
405  * @param ca CA instance.
406  * @param slot Slot id.
407  *
408  * @return 0 on success, <0 on failure.
409  */
410 static int dvb_ca_en50221_parse_attributes(struct dvb_ca_private *ca, int slot)
411 {
412 	int address = 0;
413 	int tupleLength;
414 	int tupleType;
415 	u8 tuple[257];
416 	char *dvb_str;
417 	int rasz;
418 	int status;
419 	int got_cftableentry = 0;
420 	int end_chain = 0;
421 	int i;
422 	u16 manfid = 0;
423 	u16 devid = 0;
424 
425 
426 	// CISTPL_DEVICE_0A
427 	if ((status =
428 	     dvb_ca_en50221_read_tuple(ca, slot, &address, &tupleType, &tupleLength, tuple)) < 0)
429 		return status;
430 	if (tupleType != 0x1D)
431 		return -EINVAL;
432 
433 
434 
435 	// CISTPL_DEVICE_0C
436 	if ((status =
437 	     dvb_ca_en50221_read_tuple(ca, slot, &address, &tupleType, &tupleLength, tuple)) < 0)
438 		return status;
439 	if (tupleType != 0x1C)
440 		return -EINVAL;
441 
442 
443 
444 	// CISTPL_VERS_1
445 	if ((status =
446 	     dvb_ca_en50221_read_tuple(ca, slot, &address, &tupleType, &tupleLength, tuple)) < 0)
447 		return status;
448 	if (tupleType != 0x15)
449 		return -EINVAL;
450 
451 
452 
453 	// CISTPL_MANFID
454 	if ((status = dvb_ca_en50221_read_tuple(ca, slot, &address, &tupleType,
455 						&tupleLength, tuple)) < 0)
456 		return status;
457 	if (tupleType != 0x20)
458 		return -EINVAL;
459 	if (tupleLength != 4)
460 		return -EINVAL;
461 	manfid = (tuple[1] << 8) | tuple[0];
462 	devid = (tuple[3] << 8) | tuple[2];
463 
464 
465 
466 	// CISTPL_CONFIG
467 	if ((status = dvb_ca_en50221_read_tuple(ca, slot, &address, &tupleType,
468 						&tupleLength, tuple)) < 0)
469 		return status;
470 	if (tupleType != 0x1A)
471 		return -EINVAL;
472 	if (tupleLength < 3)
473 		return -EINVAL;
474 
475 	/* extract the configbase */
476 	rasz = tuple[0] & 3;
477 	if (tupleLength < (3 + rasz + 14))
478 		return -EINVAL;
479 	ca->slot_info[slot].config_base = 0;
480 	for (i = 0; i < rasz + 1; i++) {
481 		ca->slot_info[slot].config_base |= (tuple[2 + i] << (8 * i));
482 	}
483 
484 	/* check it contains the correct DVB string */
485 	dvb_str = findstr((char *)tuple, tupleLength, "DVB_CI_V", 8);
486 	if (dvb_str == NULL)
487 		return -EINVAL;
488 	if (tupleLength < ((dvb_str - (char *) tuple) + 12))
489 		return -EINVAL;
490 
491 	/* is it a version we support? */
492 	if (strncmp(dvb_str + 8, "1.00", 4)) {
493 		printk("dvb_ca adapter %d: Unsupported DVB CAM module version %c%c%c%c\n",
494 		       ca->dvbdev->adapter->num, dvb_str[8], dvb_str[9], dvb_str[10], dvb_str[11]);
495 		return -EINVAL;
496 	}
497 
498 	/* process the CFTABLE_ENTRY tuples, and any after those */
499 	while ((!end_chain) && (address < 0x1000)) {
500 		if ((status = dvb_ca_en50221_read_tuple(ca, slot, &address, &tupleType,
501 							&tupleLength, tuple)) < 0)
502 			return status;
503 		switch (tupleType) {
504 		case 0x1B:	// CISTPL_CFTABLE_ENTRY
505 			if (tupleLength < (2 + 11 + 17))
506 				break;
507 
508 			/* if we've already parsed one, just use it */
509 			if (got_cftableentry)
510 				break;
511 
512 			/* get the config option */
513 			ca->slot_info[slot].config_option = tuple[0] & 0x3f;
514 
515 			/* OK, check it contains the correct strings */
516 			if ((findstr((char *)tuple, tupleLength, "DVB_HOST", 8) == NULL) ||
517 			    (findstr((char *)tuple, tupleLength, "DVB_CI_MODULE", 13) == NULL))
518 				break;
519 
520 			got_cftableentry = 1;
521 			break;
522 
523 		case 0x14:	// CISTPL_NO_LINK
524 			break;
525 
526 		case 0xFF:	// CISTPL_END
527 			end_chain = 1;
528 			break;
529 
530 		default:	/* Unknown tuple type - just skip this tuple and move to the next one */
531 			dprintk("dvb_ca: Skipping unknown tuple type:0x%x length:0x%x\n", tupleType,
532 				tupleLength);
533 			break;
534 		}
535 	}
536 
537 	if ((address > 0x1000) || (!got_cftableentry))
538 		return -EINVAL;
539 
540 	dprintk("Valid DVB CAM detected MANID:%x DEVID:%x CONFIGBASE:0x%x CONFIGOPTION:0x%x\n",
541 		manfid, devid, ca->slot_info[slot].config_base, ca->slot_info[slot].config_option);
542 
543 	// success!
544 	return 0;
545 }
546 
547 
548 /**
549  * Set CAM's configoption correctly.
550  *
551  * @param ca CA instance.
552  * @param slot Slot containing the CAM.
553  */
554 static int dvb_ca_en50221_set_configoption(struct dvb_ca_private *ca, int slot)
555 {
556 	int configoption;
557 
558 	dprintk("%s\n", __func__);
559 
560 	/* set the config option */
561 	ca->pub->write_attribute_mem(ca->pub, slot,
562 				     ca->slot_info[slot].config_base,
563 				     ca->slot_info[slot].config_option);
564 
565 	/* check it */
566 	configoption = ca->pub->read_attribute_mem(ca->pub, slot, ca->slot_info[slot].config_base);
567 	dprintk("Set configoption 0x%x, read configoption 0x%x\n",
568 		ca->slot_info[slot].config_option, configoption & 0x3f);
569 
570 	/* fine! */
571 	return 0;
572 
573 }
574 
575 
576 /**
577  * This function talks to an EN50221 CAM control interface. It reads a buffer of
578  * data from the CAM. The data can either be stored in a supplied buffer, or
579  * automatically be added to the slot's rx_buffer.
580  *
581  * @param ca CA instance.
582  * @param slot Slot to read from.
583  * @param ebuf If non-NULL, the data will be written to this buffer. If NULL,
584  * the data will be added into the buffering system as a normal fragment.
585  * @param ecount Size of ebuf. Ignored if ebuf is NULL.
586  *
587  * @return Number of bytes read, or < 0 on error
588  */
589 static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * ebuf, int ecount)
590 {
591 	int bytes_read;
592 	int status;
593 	u8 buf[HOST_LINK_BUF_SIZE];
594 	int i;
595 
596 	dprintk("%s\n", __func__);
597 
598 	/* check if we have space for a link buf in the rx_buffer */
599 	if (ebuf == NULL) {
600 		int buf_free;
601 
602 		if (ca->slot_info[slot].rx_buffer.data == NULL) {
603 			status = -EIO;
604 			goto exit;
605 		}
606 		buf_free = dvb_ringbuffer_free(&ca->slot_info[slot].rx_buffer);
607 
608 		if (buf_free < (ca->slot_info[slot].link_buf_size + DVB_RINGBUFFER_PKTHDRSIZE)) {
609 			status = -EAGAIN;
610 			goto exit;
611 		}
612 	}
613 
614 	/* check if there is data available */
615 	if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
616 		goto exit;
617 	if (!(status & STATUSREG_DA)) {
618 		/* no data */
619 		status = 0;
620 		goto exit;
621 	}
622 
623 	/* read the amount of data */
624 	if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_SIZE_HIGH)) < 0)
625 		goto exit;
626 	bytes_read = status << 8;
627 	if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_SIZE_LOW)) < 0)
628 		goto exit;
629 	bytes_read |= status;
630 
631 	/* check it will fit */
632 	if (ebuf == NULL) {
633 		if (bytes_read > ca->slot_info[slot].link_buf_size) {
634 			printk("dvb_ca adapter %d: CAM tried to send a buffer larger than the link buffer size (%i > %i)!\n",
635 			       ca->dvbdev->adapter->num, bytes_read, ca->slot_info[slot].link_buf_size);
636 			ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_LINKINIT;
637 			status = -EIO;
638 			goto exit;
639 		}
640 		if (bytes_read < 2) {
641 			printk("dvb_ca adapter %d: CAM sent a buffer that was less than 2 bytes!\n",
642 			       ca->dvbdev->adapter->num);
643 			ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_LINKINIT;
644 			status = -EIO;
645 			goto exit;
646 		}
647 	} else {
648 		if (bytes_read > ecount) {
649 			printk("dvb_ca adapter %d: CAM tried to send a buffer larger than the ecount size!\n",
650 			       ca->dvbdev->adapter->num);
651 			status = -EIO;
652 			goto exit;
653 		}
654 	}
655 
656 	/* fill the buffer */
657 	for (i = 0; i < bytes_read; i++) {
658 		/* read byte and check */
659 		if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_DATA)) < 0)
660 			goto exit;
661 
662 		/* OK, store it in the buffer */
663 		buf[i] = status;
664 	}
665 
666 	/* check for read error (RE should now be 0) */
667 	if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
668 		goto exit;
669 	if (status & STATUSREG_RE) {
670 		ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_LINKINIT;
671 		status = -EIO;
672 		goto exit;
673 	}
674 
675 	/* OK, add it to the receive buffer, or copy into external buffer if supplied */
676 	if (ebuf == NULL) {
677 		if (ca->slot_info[slot].rx_buffer.data == NULL) {
678 			status = -EIO;
679 			goto exit;
680 		}
681 		dvb_ringbuffer_pkt_write(&ca->slot_info[slot].rx_buffer, buf, bytes_read);
682 	} else {
683 		memcpy(ebuf, buf, bytes_read);
684 	}
685 
686 	dprintk("Received CA packet for slot %i connection id 0x%x last_frag:%i size:0x%x\n", slot,
687 		buf[0], (buf[1] & 0x80) == 0, bytes_read);
688 
689 	/* wake up readers when a last_fragment is received */
690 	if ((buf[1] & 0x80) == 0x00) {
691 		wake_up_interruptible(&ca->wait_queue);
692 	}
693 	status = bytes_read;
694 
695 exit:
696 	return status;
697 }
698 
699 
700 /**
701  * This function talks to an EN50221 CAM control interface. It writes a buffer of data
702  * to a CAM.
703  *
704  * @param ca CA instance.
705  * @param slot Slot to write to.
706  * @param ebuf The data in this buffer is treated as a complete link-level packet to
707  * be written.
708  * @param count Size of ebuf.
709  *
710  * @return Number of bytes written, or < 0 on error.
711  */
712 static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 * buf, int bytes_write)
713 {
714 	int status;
715 	int i;
716 
717 	dprintk("%s\n", __func__);
718 
719 
720 	/* sanity check */
721 	if (bytes_write > ca->slot_info[slot].link_buf_size)
722 		return -EINVAL;
723 
724 	/* it is possible we are dealing with a single buffer implementation,
725 	   thus if there is data available for read or if there is even a read
726 	   already in progress, we do nothing but awake the kernel thread to
727 	   process the data if necessary. */
728 	if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
729 		goto exitnowrite;
730 	if (status & (STATUSREG_DA | STATUSREG_RE)) {
731 		if (status & STATUSREG_DA)
732 			dvb_ca_en50221_thread_wakeup(ca);
733 
734 		status = -EAGAIN;
735 		goto exitnowrite;
736 	}
737 
738 	/* OK, set HC bit */
739 	if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND,
740 						 IRQEN | CMDREG_HC)) != 0)
741 		goto exit;
742 
743 	/* check if interface is still free */
744 	if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
745 		goto exit;
746 	if (!(status & STATUSREG_FR)) {
747 		/* it wasn't free => try again later */
748 		status = -EAGAIN;
749 		goto exit;
750 	}
751 
752 	/* send the amount of data */
753 	if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_SIZE_HIGH, bytes_write >> 8)) != 0)
754 		goto exit;
755 	if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_SIZE_LOW,
756 						 bytes_write & 0xff)) != 0)
757 		goto exit;
758 
759 	/* send the buffer */
760 	for (i = 0; i < bytes_write; i++) {
761 		if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_DATA, buf[i])) != 0)
762 			goto exit;
763 	}
764 
765 	/* check for write error (WE should now be 0) */
766 	if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
767 		goto exit;
768 	if (status & STATUSREG_WE) {
769 		ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_LINKINIT;
770 		status = -EIO;
771 		goto exit;
772 	}
773 	status = bytes_write;
774 
775 	dprintk("Wrote CA packet for slot %i, connection id 0x%x last_frag:%i size:0x%x\n", slot,
776 		buf[0], (buf[1] & 0x80) == 0, bytes_write);
777 
778 exit:
779 	ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN);
780 
781 exitnowrite:
782 	return status;
783 }
784 EXPORT_SYMBOL(dvb_ca_en50221_camchange_irq);
785 
786 
787 
788 /* ******************************************************************************** */
789 /* EN50221 higher level functions */
790 
791 
792 /**
793  * A CAM has been removed => shut it down.
794  *
795  * @param ca CA instance.
796  * @param slot Slot to shut down.
797  */
798 static int dvb_ca_en50221_slot_shutdown(struct dvb_ca_private *ca, int slot)
799 {
800 	dprintk("%s\n", __func__);
801 
802 	ca->pub->slot_shutdown(ca->pub, slot);
803 	ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_NONE;
804 
805 	/* need to wake up all processes to check if they're now
806 	   trying to write to a defunct CAM */
807 	wake_up_interruptible(&ca->wait_queue);
808 
809 	dprintk("Slot %i shutdown\n", slot);
810 
811 	/* success */
812 	return 0;
813 }
814 EXPORT_SYMBOL(dvb_ca_en50221_camready_irq);
815 
816 
817 /**
818  * A CAMCHANGE IRQ has occurred.
819  *
820  * @param ca CA instance.
821  * @param slot Slot concerned.
822  * @param change_type One of the DVB_CA_CAMCHANGE_* values.
823  */
824 void dvb_ca_en50221_camchange_irq(struct dvb_ca_en50221 *pubca, int slot, int change_type)
825 {
826 	struct dvb_ca_private *ca = pubca->private;
827 
828 	dprintk("CAMCHANGE IRQ slot:%i change_type:%i\n", slot, change_type);
829 
830 	switch (change_type) {
831 	case DVB_CA_EN50221_CAMCHANGE_REMOVED:
832 	case DVB_CA_EN50221_CAMCHANGE_INSERTED:
833 		break;
834 
835 	default:
836 		return;
837 	}
838 
839 	ca->slot_info[slot].camchange_type = change_type;
840 	atomic_inc(&ca->slot_info[slot].camchange_count);
841 	dvb_ca_en50221_thread_wakeup(ca);
842 }
843 EXPORT_SYMBOL(dvb_ca_en50221_frda_irq);
844 
845 
846 /**
847  * A CAMREADY IRQ has occurred.
848  *
849  * @param ca CA instance.
850  * @param slot Slot concerned.
851  */
852 void dvb_ca_en50221_camready_irq(struct dvb_ca_en50221 *pubca, int slot)
853 {
854 	struct dvb_ca_private *ca = pubca->private;
855 
856 	dprintk("CAMREADY IRQ slot:%i\n", slot);
857 
858 	if (ca->slot_info[slot].slot_state == DVB_CA_SLOTSTATE_WAITREADY) {
859 		ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_VALIDATE;
860 		dvb_ca_en50221_thread_wakeup(ca);
861 	}
862 }
863 
864 
865 /**
866  * An FR or DA IRQ has occurred.
867  *
868  * @param ca CA instance.
869  * @param slot Slot concerned.
870  */
871 void dvb_ca_en50221_frda_irq(struct dvb_ca_en50221 *pubca, int slot)
872 {
873 	struct dvb_ca_private *ca = pubca->private;
874 	int flags;
875 
876 	dprintk("FR/DA IRQ slot:%i\n", slot);
877 
878 	switch (ca->slot_info[slot].slot_state) {
879 	case DVB_CA_SLOTSTATE_LINKINIT:
880 		flags = ca->pub->read_cam_control(pubca, slot, CTRLIF_STATUS);
881 		if (flags & STATUSREG_DA) {
882 			dprintk("CAM supports DA IRQ\n");
883 			ca->slot_info[slot].da_irq_supported = 1;
884 		}
885 		break;
886 
887 	case DVB_CA_SLOTSTATE_RUNNING:
888 		if (ca->open)
889 			dvb_ca_en50221_thread_wakeup(ca);
890 		break;
891 	}
892 }
893 
894 
895 
896 /* ******************************************************************************** */
897 /* EN50221 thread functions */
898 
899 /**
900  * Wake up the DVB CA thread
901  *
902  * @param ca CA instance.
903  */
904 static void dvb_ca_en50221_thread_wakeup(struct dvb_ca_private *ca)
905 {
906 
907 	dprintk("%s\n", __func__);
908 
909 	ca->wakeup = 1;
910 	mb();
911 	wake_up_process(ca->thread);
912 }
913 
914 /**
915  * Update the delay used by the thread.
916  *
917  * @param ca CA instance.
918  */
919 static void dvb_ca_en50221_thread_update_delay(struct dvb_ca_private *ca)
920 {
921 	int delay;
922 	int curdelay = 100000000;
923 	int slot;
924 
925 	/* Beware of too high polling frequency, because one polling
926 	 * call might take several hundred milliseconds until timeout!
927 	 */
928 	for (slot = 0; slot < ca->slot_count; slot++) {
929 		switch (ca->slot_info[slot].slot_state) {
930 		default:
931 		case DVB_CA_SLOTSTATE_NONE:
932 			delay = HZ * 60;  /* 60s */
933 			if (!(ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE))
934 				delay = HZ * 5;  /* 5s */
935 			break;
936 		case DVB_CA_SLOTSTATE_INVALID:
937 			delay = HZ * 60;  /* 60s */
938 			if (!(ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE))
939 				delay = HZ / 10;  /* 100ms */
940 			break;
941 
942 		case DVB_CA_SLOTSTATE_UNINITIALISED:
943 		case DVB_CA_SLOTSTATE_WAITREADY:
944 		case DVB_CA_SLOTSTATE_VALIDATE:
945 		case DVB_CA_SLOTSTATE_WAITFR:
946 		case DVB_CA_SLOTSTATE_LINKINIT:
947 			delay = HZ / 10;  /* 100ms */
948 			break;
949 
950 		case DVB_CA_SLOTSTATE_RUNNING:
951 			delay = HZ * 60;  /* 60s */
952 			if (!(ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE))
953 				delay = HZ / 10;  /* 100ms */
954 			if (ca->open) {
955 				if ((!ca->slot_info[slot].da_irq_supported) ||
956 				    (!(ca->flags & DVB_CA_EN50221_FLAG_IRQ_DA)))
957 					delay = HZ / 10;  /* 100ms */
958 			}
959 			break;
960 		}
961 
962 		if (delay < curdelay)
963 			curdelay = delay;
964 	}
965 
966 	ca->delay = curdelay;
967 }
968 
969 
970 
971 /**
972  * Kernel thread which monitors CA slots for CAM changes, and performs data transfers.
973  */
974 static int dvb_ca_en50221_thread(void *data)
975 {
976 	struct dvb_ca_private *ca = data;
977 	int slot;
978 	int flags;
979 	int status;
980 	int pktcount;
981 	void *rxbuf;
982 
983 	dprintk("%s\n", __func__);
984 
985 	/* choose the correct initial delay */
986 	dvb_ca_en50221_thread_update_delay(ca);
987 
988 	/* main loop */
989 	while (!kthread_should_stop()) {
990 		/* sleep for a bit */
991 		if (!ca->wakeup) {
992 			set_current_state(TASK_INTERRUPTIBLE);
993 			schedule_timeout(ca->delay);
994 			if (kthread_should_stop())
995 				return 0;
996 		}
997 		ca->wakeup = 0;
998 
999 		/* go through all the slots processing them */
1000 		for (slot = 0; slot < ca->slot_count; slot++) {
1001 
1002 			mutex_lock(&ca->slot_info[slot].slot_lock);
1003 
1004 			// check the cam status + deal with CAMCHANGEs
1005 			while (dvb_ca_en50221_check_camstatus(ca, slot)) {
1006 				/* clear down an old CI slot if necessary */
1007 				if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_NONE)
1008 					dvb_ca_en50221_slot_shutdown(ca, slot);
1009 
1010 				/* if a CAM is NOW present, initialise it */
1011 				if (ca->slot_info[slot].camchange_type == DVB_CA_EN50221_CAMCHANGE_INSERTED) {
1012 					ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_UNINITIALISED;
1013 				}
1014 
1015 				/* we've handled one CAMCHANGE */
1016 				dvb_ca_en50221_thread_update_delay(ca);
1017 				atomic_dec(&ca->slot_info[slot].camchange_count);
1018 			}
1019 
1020 			// CAM state machine
1021 			switch (ca->slot_info[slot].slot_state) {
1022 			case DVB_CA_SLOTSTATE_NONE:
1023 			case DVB_CA_SLOTSTATE_INVALID:
1024 				// no action needed
1025 				break;
1026 
1027 			case DVB_CA_SLOTSTATE_UNINITIALISED:
1028 				ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_WAITREADY;
1029 				ca->pub->slot_reset(ca->pub, slot);
1030 				ca->slot_info[slot].timeout = jiffies + (INIT_TIMEOUT_SECS * HZ);
1031 				break;
1032 
1033 			case DVB_CA_SLOTSTATE_WAITREADY:
1034 				if (time_after(jiffies, ca->slot_info[slot].timeout)) {
1035 					printk("dvb_ca adaptor %d: PC card did not respond :(\n",
1036 					       ca->dvbdev->adapter->num);
1037 					ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_INVALID;
1038 					dvb_ca_en50221_thread_update_delay(ca);
1039 					break;
1040 				}
1041 				// no other action needed; will automatically change state when ready
1042 				break;
1043 
1044 			case DVB_CA_SLOTSTATE_VALIDATE:
1045 				if (dvb_ca_en50221_parse_attributes(ca, slot) != 0) {
1046 					/* we need this extra check for annoying interfaces like the budget-av */
1047 					if ((!(ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE)) &&
1048 					    (ca->pub->poll_slot_status)) {
1049 						status = ca->pub->poll_slot_status(ca->pub, slot, 0);
1050 						if (!(status & DVB_CA_EN50221_POLL_CAM_PRESENT)) {
1051 							ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_NONE;
1052 							dvb_ca_en50221_thread_update_delay(ca);
1053 							break;
1054 						}
1055 					}
1056 
1057 					printk("dvb_ca adapter %d: Invalid PC card inserted :(\n",
1058 					       ca->dvbdev->adapter->num);
1059 					ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_INVALID;
1060 					dvb_ca_en50221_thread_update_delay(ca);
1061 					break;
1062 				}
1063 				if (dvb_ca_en50221_set_configoption(ca, slot) != 0) {
1064 					printk("dvb_ca adapter %d: Unable to initialise CAM :(\n",
1065 					       ca->dvbdev->adapter->num);
1066 					ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_INVALID;
1067 					dvb_ca_en50221_thread_update_delay(ca);
1068 					break;
1069 				}
1070 				if (ca->pub->write_cam_control(ca->pub, slot,
1071 							       CTRLIF_COMMAND, CMDREG_RS) != 0) {
1072 					printk("dvb_ca adapter %d: Unable to reset CAM IF\n",
1073 					       ca->dvbdev->adapter->num);
1074 					ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_INVALID;
1075 					dvb_ca_en50221_thread_update_delay(ca);
1076 					break;
1077 				}
1078 				dprintk("DVB CAM validated successfully\n");
1079 
1080 				ca->slot_info[slot].timeout = jiffies + (INIT_TIMEOUT_SECS * HZ);
1081 				ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_WAITFR;
1082 				ca->wakeup = 1;
1083 				break;
1084 
1085 			case DVB_CA_SLOTSTATE_WAITFR:
1086 				if (time_after(jiffies, ca->slot_info[slot].timeout)) {
1087 					printk("dvb_ca adapter %d: DVB CAM did not respond :(\n",
1088 					       ca->dvbdev->adapter->num);
1089 					ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_INVALID;
1090 					dvb_ca_en50221_thread_update_delay(ca);
1091 					break;
1092 				}
1093 
1094 				flags = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS);
1095 				if (flags & STATUSREG_FR) {
1096 					ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_LINKINIT;
1097 					ca->wakeup = 1;
1098 				}
1099 				break;
1100 
1101 			case DVB_CA_SLOTSTATE_LINKINIT:
1102 				if (dvb_ca_en50221_link_init(ca, slot) != 0) {
1103 					/* we need this extra check for annoying interfaces like the budget-av */
1104 					if ((!(ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE)) &&
1105 					    (ca->pub->poll_slot_status)) {
1106 						status = ca->pub->poll_slot_status(ca->pub, slot, 0);
1107 						if (!(status & DVB_CA_EN50221_POLL_CAM_PRESENT)) {
1108 							ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_NONE;
1109 							dvb_ca_en50221_thread_update_delay(ca);
1110 							break;
1111 						}
1112 					}
1113 
1114 					printk("dvb_ca adapter %d: DVB CAM link initialisation failed :(\n", ca->dvbdev->adapter->num);
1115 					ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_INVALID;
1116 					dvb_ca_en50221_thread_update_delay(ca);
1117 					break;
1118 				}
1119 
1120 				if (ca->slot_info[slot].rx_buffer.data == NULL) {
1121 					rxbuf = vmalloc(RX_BUFFER_SIZE);
1122 					if (rxbuf == NULL) {
1123 						printk("dvb_ca adapter %d: Unable to allocate CAM rx buffer :(\n", ca->dvbdev->adapter->num);
1124 						ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_INVALID;
1125 						dvb_ca_en50221_thread_update_delay(ca);
1126 						break;
1127 					}
1128 					dvb_ringbuffer_init(&ca->slot_info[slot].rx_buffer, rxbuf, RX_BUFFER_SIZE);
1129 				}
1130 
1131 				ca->pub->slot_ts_enable(ca->pub, slot);
1132 				ca->slot_info[slot].slot_state = DVB_CA_SLOTSTATE_RUNNING;
1133 				dvb_ca_en50221_thread_update_delay(ca);
1134 				printk("dvb_ca adapter %d: DVB CAM detected and initialised successfully\n", ca->dvbdev->adapter->num);
1135 				break;
1136 
1137 			case DVB_CA_SLOTSTATE_RUNNING:
1138 				if (!ca->open)
1139 					break;
1140 
1141 				// poll slots for data
1142 				pktcount = 0;
1143 				while ((status = dvb_ca_en50221_read_data(ca, slot, NULL, 0)) > 0) {
1144 					if (!ca->open)
1145 						break;
1146 
1147 					/* if a CAMCHANGE occurred at some point, do not do any more processing of this slot */
1148 					if (dvb_ca_en50221_check_camstatus(ca, slot)) {
1149 						// we dont want to sleep on the next iteration so we can handle the cam change
1150 						ca->wakeup = 1;
1151 						break;
1152 					}
1153 
1154 					/* check if we've hit our limit this time */
1155 					if (++pktcount >= MAX_RX_PACKETS_PER_ITERATION) {
1156 						// dont sleep; there is likely to be more data to read
1157 						ca->wakeup = 1;
1158 						break;
1159 					}
1160 				}
1161 				break;
1162 			}
1163 
1164 			mutex_unlock(&ca->slot_info[slot].slot_lock);
1165 		}
1166 	}
1167 
1168 	return 0;
1169 }
1170 
1171 
1172 
1173 /* ******************************************************************************** */
1174 /* EN50221 IO interface functions */
1175 
1176 /**
1177  * Real ioctl implementation.
1178  * NOTE: CA_SEND_MSG/CA_GET_MSG ioctls have userspace buffers passed to them.
1179  *
1180  * @param inode Inode concerned.
1181  * @param file File concerned.
1182  * @param cmd IOCTL command.
1183  * @param arg Associated argument.
1184  *
1185  * @return 0 on success, <0 on error.
1186  */
1187 static int dvb_ca_en50221_io_do_ioctl(struct file *file,
1188 				      unsigned int cmd, void *parg)
1189 {
1190 	struct dvb_device *dvbdev = file->private_data;
1191 	struct dvb_ca_private *ca = dvbdev->priv;
1192 	int err = 0;
1193 	int slot;
1194 
1195 	dprintk("%s\n", __func__);
1196 
1197 	if (mutex_lock_interruptible(&ca->ioctl_mutex))
1198 		return -ERESTARTSYS;
1199 
1200 	switch (cmd) {
1201 	case CA_RESET:
1202 		for (slot = 0; slot < ca->slot_count; slot++) {
1203 			mutex_lock(&ca->slot_info[slot].slot_lock);
1204 			if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_NONE) {
1205 				dvb_ca_en50221_slot_shutdown(ca, slot);
1206 				if (ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE)
1207 					dvb_ca_en50221_camchange_irq(ca->pub,
1208 								     slot,
1209 								     DVB_CA_EN50221_CAMCHANGE_INSERTED);
1210 			}
1211 			mutex_unlock(&ca->slot_info[slot].slot_lock);
1212 		}
1213 		ca->next_read_slot = 0;
1214 		dvb_ca_en50221_thread_wakeup(ca);
1215 		break;
1216 
1217 	case CA_GET_CAP: {
1218 		struct ca_caps *caps = parg;
1219 
1220 		caps->slot_num = ca->slot_count;
1221 		caps->slot_type = CA_CI_LINK;
1222 		caps->descr_num = 0;
1223 		caps->descr_type = 0;
1224 		break;
1225 	}
1226 
1227 	case CA_GET_SLOT_INFO: {
1228 		struct ca_slot_info *info = parg;
1229 
1230 		if ((info->num > ca->slot_count) || (info->num < 0)) {
1231 			err = -EINVAL;
1232 			goto out_unlock;
1233 		}
1234 
1235 		info->type = CA_CI_LINK;
1236 		info->flags = 0;
1237 		if ((ca->slot_info[info->num].slot_state != DVB_CA_SLOTSTATE_NONE)
1238 			&& (ca->slot_info[info->num].slot_state != DVB_CA_SLOTSTATE_INVALID)) {
1239 			info->flags = CA_CI_MODULE_PRESENT;
1240 		}
1241 		if (ca->slot_info[info->num].slot_state == DVB_CA_SLOTSTATE_RUNNING) {
1242 			info->flags |= CA_CI_MODULE_READY;
1243 		}
1244 		break;
1245 	}
1246 
1247 	default:
1248 		err = -EINVAL;
1249 		break;
1250 	}
1251 
1252 out_unlock:
1253 	mutex_unlock(&ca->ioctl_mutex);
1254 	return err;
1255 }
1256 
1257 
1258 /**
1259  * Wrapper for ioctl implementation.
1260  *
1261  * @param inode Inode concerned.
1262  * @param file File concerned.
1263  * @param cmd IOCTL command.
1264  * @param arg Associated argument.
1265  *
1266  * @return 0 on success, <0 on error.
1267  */
1268 static long dvb_ca_en50221_io_ioctl(struct file *file,
1269 				    unsigned int cmd, unsigned long arg)
1270 {
1271 	return dvb_usercopy(file, cmd, arg, dvb_ca_en50221_io_do_ioctl);
1272 }
1273 
1274 
1275 /**
1276  * Implementation of write() syscall.
1277  *
1278  * @param file File structure.
1279  * @param buf Source buffer.
1280  * @param count Size of source buffer.
1281  * @param ppos Position in file (ignored).
1282  *
1283  * @return Number of bytes read, or <0 on error.
1284  */
1285 static ssize_t dvb_ca_en50221_io_write(struct file *file,
1286 				       const char __user * buf, size_t count, loff_t * ppos)
1287 {
1288 	struct dvb_device *dvbdev = file->private_data;
1289 	struct dvb_ca_private *ca = dvbdev->priv;
1290 	u8 slot, connection_id;
1291 	int status;
1292 	u8 fragbuf[HOST_LINK_BUF_SIZE];
1293 	int fragpos = 0;
1294 	int fraglen;
1295 	unsigned long timeout;
1296 	int written;
1297 
1298 	dprintk("%s\n", __func__);
1299 
1300 	/* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
1301 	if (count < 2)
1302 		return -EINVAL;
1303 
1304 	/* extract slot & connection id */
1305 	if (copy_from_user(&slot, buf, 1))
1306 		return -EFAULT;
1307 	if (copy_from_user(&connection_id, buf + 1, 1))
1308 		return -EFAULT;
1309 	buf += 2;
1310 	count -= 2;
1311 
1312 	/* check if the slot is actually running */
1313 	if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_RUNNING)
1314 		return -EINVAL;
1315 
1316 	/* fragment the packets & store in the buffer */
1317 	while (fragpos < count) {
1318 		fraglen = ca->slot_info[slot].link_buf_size - 2;
1319 		if (fraglen < 0)
1320 			break;
1321 		if (fraglen > HOST_LINK_BUF_SIZE - 2)
1322 			fraglen = HOST_LINK_BUF_SIZE - 2;
1323 		if ((count - fragpos) < fraglen)
1324 			fraglen = count - fragpos;
1325 
1326 		fragbuf[0] = connection_id;
1327 		fragbuf[1] = ((fragpos + fraglen) < count) ? 0x80 : 0x00;
1328 		status = copy_from_user(fragbuf + 2, buf + fragpos, fraglen);
1329 		if (status) {
1330 			status = -EFAULT;
1331 			goto exit;
1332 		}
1333 
1334 		timeout = jiffies + HZ / 2;
1335 		written = 0;
1336 		while (!time_after(jiffies, timeout)) {
1337 			/* check the CAM hasn't been removed/reset in the meantime */
1338 			if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_RUNNING) {
1339 				status = -EIO;
1340 				goto exit;
1341 			}
1342 
1343 			mutex_lock(&ca->slot_info[slot].slot_lock);
1344 			status = dvb_ca_en50221_write_data(ca, slot, fragbuf, fraglen + 2);
1345 			mutex_unlock(&ca->slot_info[slot].slot_lock);
1346 			if (status == (fraglen + 2)) {
1347 				written = 1;
1348 				break;
1349 			}
1350 			if (status != -EAGAIN)
1351 				goto exit;
1352 
1353 			msleep(1);
1354 		}
1355 		if (!written) {
1356 			status = -EIO;
1357 			goto exit;
1358 		}
1359 
1360 		fragpos += fraglen;
1361 	}
1362 	status = count + 2;
1363 
1364 exit:
1365 	return status;
1366 }
1367 
1368 
1369 /**
1370  * Condition for waking up in dvb_ca_en50221_io_read_condition
1371  */
1372 static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private *ca,
1373 					    int *result, int *_slot)
1374 {
1375 	int slot;
1376 	int slot_count = 0;
1377 	int idx;
1378 	size_t fraglen;
1379 	int connection_id = -1;
1380 	int found = 0;
1381 	u8 hdr[2];
1382 
1383 	slot = ca->next_read_slot;
1384 	while ((slot_count < ca->slot_count) && (!found)) {
1385 		if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_RUNNING)
1386 			goto nextslot;
1387 
1388 		if (ca->slot_info[slot].rx_buffer.data == NULL) {
1389 			return 0;
1390 		}
1391 
1392 		idx = dvb_ringbuffer_pkt_next(&ca->slot_info[slot].rx_buffer, -1, &fraglen);
1393 		while (idx != -1) {
1394 			dvb_ringbuffer_pkt_read(&ca->slot_info[slot].rx_buffer, idx, 0, hdr, 2);
1395 			if (connection_id == -1)
1396 				connection_id = hdr[0];
1397 			if ((hdr[0] == connection_id) && ((hdr[1] & 0x80) == 0)) {
1398 				*_slot = slot;
1399 				found = 1;
1400 				break;
1401 			}
1402 
1403 			idx = dvb_ringbuffer_pkt_next(&ca->slot_info[slot].rx_buffer, idx, &fraglen);
1404 		}
1405 
1406 nextslot:
1407 		slot = (slot + 1) % ca->slot_count;
1408 		slot_count++;
1409 	}
1410 
1411 	ca->next_read_slot = slot;
1412 	return found;
1413 }
1414 
1415 
1416 /**
1417  * Implementation of read() syscall.
1418  *
1419  * @param file File structure.
1420  * @param buf Destination buffer.
1421  * @param count Size of destination buffer.
1422  * @param ppos Position in file (ignored).
1423  *
1424  * @return Number of bytes read, or <0 on error.
1425  */
1426 static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user * buf,
1427 				      size_t count, loff_t * ppos)
1428 {
1429 	struct dvb_device *dvbdev = file->private_data;
1430 	struct dvb_ca_private *ca = dvbdev->priv;
1431 	int status;
1432 	int result = 0;
1433 	u8 hdr[2];
1434 	int slot;
1435 	int connection_id = -1;
1436 	size_t idx, idx2;
1437 	int last_fragment = 0;
1438 	size_t fraglen;
1439 	int pktlen;
1440 	int dispose = 0;
1441 
1442 	dprintk("%s\n", __func__);
1443 
1444 	/* Outgoing packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
1445 	if (count < 2)
1446 		return -EINVAL;
1447 
1448 	/* wait for some data */
1449 	if ((status = dvb_ca_en50221_io_read_condition(ca, &result, &slot)) == 0) {
1450 
1451 		/* if we're in nonblocking mode, exit immediately */
1452 		if (file->f_flags & O_NONBLOCK)
1453 			return -EWOULDBLOCK;
1454 
1455 		/* wait for some data */
1456 		status = wait_event_interruptible(ca->wait_queue,
1457 						  dvb_ca_en50221_io_read_condition
1458 						  (ca, &result, &slot));
1459 	}
1460 	if ((status < 0) || (result < 0)) {
1461 		if (result)
1462 			return result;
1463 		return status;
1464 	}
1465 
1466 	idx = dvb_ringbuffer_pkt_next(&ca->slot_info[slot].rx_buffer, -1, &fraglen);
1467 	pktlen = 2;
1468 	do {
1469 		if (idx == -1) {
1470 			printk("dvb_ca adapter %d: BUG: read packet ended before last_fragment encountered\n", ca->dvbdev->adapter->num);
1471 			status = -EIO;
1472 			goto exit;
1473 		}
1474 
1475 		dvb_ringbuffer_pkt_read(&ca->slot_info[slot].rx_buffer, idx, 0, hdr, 2);
1476 		if (connection_id == -1)
1477 			connection_id = hdr[0];
1478 		if (hdr[0] == connection_id) {
1479 			if (pktlen < count) {
1480 				if ((pktlen + fraglen - 2) > count) {
1481 					fraglen = count - pktlen;
1482 				} else {
1483 					fraglen -= 2;
1484 				}
1485 
1486 				if ((status = dvb_ringbuffer_pkt_read_user(&ca->slot_info[slot].rx_buffer, idx, 2,
1487 								      buf + pktlen, fraglen)) < 0) {
1488 					goto exit;
1489 				}
1490 				pktlen += fraglen;
1491 			}
1492 
1493 			if ((hdr[1] & 0x80) == 0)
1494 				last_fragment = 1;
1495 			dispose = 1;
1496 		}
1497 
1498 		idx2 = dvb_ringbuffer_pkt_next(&ca->slot_info[slot].rx_buffer, idx, &fraglen);
1499 		if (dispose)
1500 			dvb_ringbuffer_pkt_dispose(&ca->slot_info[slot].rx_buffer, idx);
1501 		idx = idx2;
1502 		dispose = 0;
1503 	} while (!last_fragment);
1504 
1505 	hdr[0] = slot;
1506 	hdr[1] = connection_id;
1507 	status = copy_to_user(buf, hdr, 2);
1508 	if (status) {
1509 		status = -EFAULT;
1510 		goto exit;
1511 	}
1512 	status = pktlen;
1513 
1514 exit:
1515 	return status;
1516 }
1517 
1518 
1519 /**
1520  * Implementation of file open syscall.
1521  *
1522  * @param inode Inode concerned.
1523  * @param file File concerned.
1524  *
1525  * @return 0 on success, <0 on failure.
1526  */
1527 static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
1528 {
1529 	struct dvb_device *dvbdev = file->private_data;
1530 	struct dvb_ca_private *ca = dvbdev->priv;
1531 	int err;
1532 	int i;
1533 
1534 	dprintk("%s\n", __func__);
1535 
1536 	if (!try_module_get(ca->pub->owner))
1537 		return -EIO;
1538 
1539 	err = dvb_generic_open(inode, file);
1540 	if (err < 0) {
1541 		module_put(ca->pub->owner);
1542 		return err;
1543 	}
1544 
1545 	for (i = 0; i < ca->slot_count; i++) {
1546 
1547 		if (ca->slot_info[i].slot_state == DVB_CA_SLOTSTATE_RUNNING) {
1548 			if (ca->slot_info[i].rx_buffer.data != NULL) {
1549 				/* it is safe to call this here without locks because
1550 				 * ca->open == 0. Data is not read in this case */
1551 				dvb_ringbuffer_flush(&ca->slot_info[i].rx_buffer);
1552 			}
1553 		}
1554 	}
1555 
1556 	ca->open = 1;
1557 	dvb_ca_en50221_thread_update_delay(ca);
1558 	dvb_ca_en50221_thread_wakeup(ca);
1559 
1560 	return 0;
1561 }
1562 
1563 
1564 /**
1565  * Implementation of file close syscall.
1566  *
1567  * @param inode Inode concerned.
1568  * @param file File concerned.
1569  *
1570  * @return 0 on success, <0 on failure.
1571  */
1572 static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
1573 {
1574 	struct dvb_device *dvbdev = file->private_data;
1575 	struct dvb_ca_private *ca = dvbdev->priv;
1576 	int err;
1577 
1578 	dprintk("%s\n", __func__);
1579 
1580 	/* mark the CA device as closed */
1581 	ca->open = 0;
1582 	dvb_ca_en50221_thread_update_delay(ca);
1583 
1584 	err = dvb_generic_release(inode, file);
1585 
1586 	module_put(ca->pub->owner);
1587 
1588 	return err;
1589 }
1590 
1591 
1592 /**
1593  * Implementation of poll() syscall.
1594  *
1595  * @param file File concerned.
1596  * @param wait poll wait table.
1597  *
1598  * @return Standard poll mask.
1599  */
1600 static unsigned int dvb_ca_en50221_io_poll(struct file *file, poll_table * wait)
1601 {
1602 	struct dvb_device *dvbdev = file->private_data;
1603 	struct dvb_ca_private *ca = dvbdev->priv;
1604 	unsigned int mask = 0;
1605 	int slot;
1606 	int result = 0;
1607 
1608 	dprintk("%s\n", __func__);
1609 
1610 	if (dvb_ca_en50221_io_read_condition(ca, &result, &slot) == 1) {
1611 		mask |= POLLIN;
1612 	}
1613 
1614 	/* if there is something, return now */
1615 	if (mask)
1616 		return mask;
1617 
1618 	/* wait for something to happen */
1619 	poll_wait(file, &ca->wait_queue, wait);
1620 
1621 	if (dvb_ca_en50221_io_read_condition(ca, &result, &slot) == 1) {
1622 		mask |= POLLIN;
1623 	}
1624 
1625 	return mask;
1626 }
1627 EXPORT_SYMBOL(dvb_ca_en50221_init);
1628 
1629 
1630 static const struct file_operations dvb_ca_fops = {
1631 	.owner = THIS_MODULE,
1632 	.read = dvb_ca_en50221_io_read,
1633 	.write = dvb_ca_en50221_io_write,
1634 	.unlocked_ioctl = dvb_ca_en50221_io_ioctl,
1635 	.open = dvb_ca_en50221_io_open,
1636 	.release = dvb_ca_en50221_io_release,
1637 	.poll = dvb_ca_en50221_io_poll,
1638 	.llseek = noop_llseek,
1639 };
1640 
1641 static const struct dvb_device dvbdev_ca = {
1642 	.priv = NULL,
1643 	.users = 1,
1644 	.readers = 1,
1645 	.writers = 1,
1646 #if defined(CONFIG_MEDIA_CONTROLLER_DVB)
1647 	.name = "dvb-ca-en50221",
1648 #endif
1649 	.fops = &dvb_ca_fops,
1650 };
1651 
1652 /* ******************************************************************************** */
1653 /* Initialisation/shutdown functions */
1654 
1655 
1656 /**
1657  * Initialise a new DVB CA EN50221 interface device.
1658  *
1659  * @param dvb_adapter DVB adapter to attach the new CA device to.
1660  * @param ca The dvb_ca instance.
1661  * @param flags Flags describing the CA device (DVB_CA_FLAG_*).
1662  * @param slot_count Number of slots supported.
1663  *
1664  * @return 0 on success, nonzero on failure
1665  */
1666 int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
1667 			struct dvb_ca_en50221 *pubca, int flags, int slot_count)
1668 {
1669 	int ret;
1670 	struct dvb_ca_private *ca = NULL;
1671 	int i;
1672 
1673 	dprintk("%s\n", __func__);
1674 
1675 	if (slot_count < 1)
1676 		return -EINVAL;
1677 
1678 	/* initialise the system data */
1679 	if ((ca = kzalloc(sizeof(struct dvb_ca_private), GFP_KERNEL)) == NULL) {
1680 		ret = -ENOMEM;
1681 		goto exit;
1682 	}
1683 	ca->pub = pubca;
1684 	ca->flags = flags;
1685 	ca->slot_count = slot_count;
1686 	if ((ca->slot_info = kcalloc(slot_count, sizeof(struct dvb_ca_slot), GFP_KERNEL)) == NULL) {
1687 		ret = -ENOMEM;
1688 		goto free_ca;
1689 	}
1690 	init_waitqueue_head(&ca->wait_queue);
1691 	ca->open = 0;
1692 	ca->wakeup = 0;
1693 	ca->next_read_slot = 0;
1694 	pubca->private = ca;
1695 
1696 	/* register the DVB device */
1697 	ret = dvb_register_device(dvb_adapter, &ca->dvbdev, &dvbdev_ca, ca, DVB_DEVICE_CA);
1698 	if (ret)
1699 		goto free_slot_info;
1700 
1701 	/* now initialise each slot */
1702 	for (i = 0; i < slot_count; i++) {
1703 		memset(&ca->slot_info[i], 0, sizeof(struct dvb_ca_slot));
1704 		ca->slot_info[i].slot_state = DVB_CA_SLOTSTATE_NONE;
1705 		atomic_set(&ca->slot_info[i].camchange_count, 0);
1706 		ca->slot_info[i].camchange_type = DVB_CA_EN50221_CAMCHANGE_REMOVED;
1707 		mutex_init(&ca->slot_info[i].slot_lock);
1708 	}
1709 
1710 	mutex_init(&ca->ioctl_mutex);
1711 
1712 	if (signal_pending(current)) {
1713 		ret = -EINTR;
1714 		goto unregister_device;
1715 	}
1716 	mb();
1717 
1718 	/* create a kthread for monitoring this CA device */
1719 	ca->thread = kthread_run(dvb_ca_en50221_thread, ca, "kdvb-ca-%i:%i",
1720 				 ca->dvbdev->adapter->num, ca->dvbdev->id);
1721 	if (IS_ERR(ca->thread)) {
1722 		ret = PTR_ERR(ca->thread);
1723 		printk("dvb_ca_init: failed to start kernel_thread (%d)\n",
1724 			ret);
1725 		goto unregister_device;
1726 	}
1727 	return 0;
1728 
1729 unregister_device:
1730 	dvb_unregister_device(ca->dvbdev);
1731 free_slot_info:
1732 	kfree(ca->slot_info);
1733 free_ca:
1734 	kfree(ca);
1735 exit:
1736 	pubca->private = NULL;
1737 	return ret;
1738 }
1739 EXPORT_SYMBOL(dvb_ca_en50221_release);
1740 
1741 
1742 
1743 /**
1744  * Release a DVB CA EN50221 interface device.
1745  *
1746  * @param ca_dev The dvb_device_t instance for the CA device.
1747  * @param ca The associated dvb_ca instance.
1748  */
1749 void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca)
1750 {
1751 	struct dvb_ca_private *ca = pubca->private;
1752 	int i;
1753 
1754 	dprintk("%s\n", __func__);
1755 
1756 	/* shutdown the thread if there was one */
1757 	kthread_stop(ca->thread);
1758 
1759 	for (i = 0; i < ca->slot_count; i++) {
1760 		dvb_ca_en50221_slot_shutdown(ca, i);
1761 		vfree(ca->slot_info[i].rx_buffer.data);
1762 	}
1763 	kfree(ca->slot_info);
1764 	dvb_unregister_device(ca->dvbdev);
1765 	kfree(ca);
1766 	pubca->private = NULL;
1767 }
1768