1 /*
2  * dvb_demux.c - DVB kernel demux API
3  *
4  * Copyright (C) 2000-2001 Ralph  Metzler <ralph@convergence.de>
5  *		       & Marcus Metzler <marcus@convergence.de>
6  *			 for convergence integrated media GmbH
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU Lesser General Public License
10  * as published by the Free Software Foundation; either version 2.1
11  * of the License, or (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  */
19 
20 #define pr_fmt(fmt) "dvb_demux: " fmt
21 
22 #include <linux/sched/signal.h>
23 #include <linux/spinlock.h>
24 #include <linux/slab.h>
25 #include <linux/vmalloc.h>
26 #include <linux/module.h>
27 #include <linux/poll.h>
28 #include <linux/string.h>
29 #include <linux/crc32.h>
30 #include <linux/uaccess.h>
31 #include <asm/div64.h>
32 
33 #include "dvb_demux.h"
34 
35 static int dvb_demux_tscheck;
36 module_param(dvb_demux_tscheck, int, 0644);
37 MODULE_PARM_DESC(dvb_demux_tscheck,
38 		"enable transport stream continuity and TEI check");
39 
40 static int dvb_demux_speedcheck;
41 module_param(dvb_demux_speedcheck, int, 0644);
42 MODULE_PARM_DESC(dvb_demux_speedcheck,
43 		"enable transport stream speed check");
44 
45 static int dvb_demux_feed_err_pkts = 1;
46 module_param(dvb_demux_feed_err_pkts, int, 0644);
47 MODULE_PARM_DESC(dvb_demux_feed_err_pkts,
48 		 "when set to 0, drop packets with the TEI bit set (1 by default)");
49 
50 #define dprintk(fmt, arg...) \
51 	printk(KERN_DEBUG pr_fmt("%s: " fmt),  __func__, ##arg)
52 
53 #define dprintk_tscheck(x...) do {			\
54 	if (dvb_demux_tscheck && printk_ratelimit())	\
55 		dprintk(x);				\
56 } while (0)
57 
58 /******************************************************************************
59  * static inlined helper functions
60  ******************************************************************************/
61 
62 static inline u16 section_length(const u8 *buf)
63 {
64 	return 3 + ((buf[1] & 0x0f) << 8) + buf[2];
65 }
66 
67 static inline u16 ts_pid(const u8 *buf)
68 {
69 	return ((buf[1] & 0x1f) << 8) + buf[2];
70 }
71 
72 static inline u8 payload(const u8 *tsp)
73 {
74 	if (!(tsp[3] & 0x10))	// no payload?
75 		return 0;
76 
77 	if (tsp[3] & 0x20) {	// adaptation field?
78 		if (tsp[4] > 183)	// corrupted data?
79 			return 0;
80 		else
81 			return 184 - 1 - tsp[4];
82 	}
83 
84 	return 184;
85 }
86 
87 static u32 dvb_dmx_crc32(struct dvb_demux_feed *f, const u8 *src, size_t len)
88 {
89 	return (f->feed.sec.crc_val = crc32_be(f->feed.sec.crc_val, src, len));
90 }
91 
92 static void dvb_dmx_memcopy(struct dvb_demux_feed *f, u8 *d, const u8 *s,
93 			    size_t len)
94 {
95 	memcpy(d, s, len);
96 }
97 
98 /******************************************************************************
99  * Software filter functions
100  ******************************************************************************/
101 
102 static inline int dvb_dmx_swfilter_payload(struct dvb_demux_feed *feed,
103 					   const u8 *buf)
104 {
105 	int count = payload(buf);
106 	int p;
107 #ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
108 	int ccok;
109 	u8 cc;
110 #endif
111 
112 	if (count == 0)
113 		return -1;
114 
115 	p = 188 - count;
116 
117 #ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
118 	cc = buf[3] & 0x0f;
119 	ccok = ((feed->cc + 1) & 0x0f) == cc;
120 	feed->cc = cc;
121 	if (!ccok)
122 		dprintk("missed packet!\n");
123 #endif
124 
125 	if (buf[1] & 0x40)	// PUSI ?
126 		feed->peslen = 0xfffa;
127 
128 	feed->peslen += count;
129 
130 	return feed->cb.ts(&buf[p], count, NULL, 0, &feed->feed.ts);
131 }
132 
133 static int dvb_dmx_swfilter_sectionfilter(struct dvb_demux_feed *feed,
134 					  struct dvb_demux_filter *f)
135 {
136 	u8 neq = 0;
137 	int i;
138 
139 	for (i = 0; i < DVB_DEMUX_MASK_MAX; i++) {
140 		u8 xor = f->filter.filter_value[i] ^ feed->feed.sec.secbuf[i];
141 
142 		if (f->maskandmode[i] & xor)
143 			return 0;
144 
145 		neq |= f->maskandnotmode[i] & xor;
146 	}
147 
148 	if (f->doneq && !neq)
149 		return 0;
150 
151 	return feed->cb.sec(feed->feed.sec.secbuf, feed->feed.sec.seclen,
152 			    NULL, 0, &f->filter);
153 }
154 
155 static inline int dvb_dmx_swfilter_section_feed(struct dvb_demux_feed *feed)
156 {
157 	struct dvb_demux *demux = feed->demux;
158 	struct dvb_demux_filter *f = feed->filter;
159 	struct dmx_section_feed *sec = &feed->feed.sec;
160 	int section_syntax_indicator;
161 
162 	if (!sec->is_filtering)
163 		return 0;
164 
165 	if (!f)
166 		return 0;
167 
168 	if (sec->check_crc) {
169 		section_syntax_indicator = ((sec->secbuf[1] & 0x80) != 0);
170 		if (section_syntax_indicator &&
171 		    demux->check_crc32(feed, sec->secbuf, sec->seclen))
172 			return -1;
173 	}
174 
175 	do {
176 		if (dvb_dmx_swfilter_sectionfilter(feed, f) < 0)
177 			return -1;
178 	} while ((f = f->next) && sec->is_filtering);
179 
180 	sec->seclen = 0;
181 
182 	return 0;
183 }
184 
185 static void dvb_dmx_swfilter_section_new(struct dvb_demux_feed *feed)
186 {
187 	struct dmx_section_feed *sec = &feed->feed.sec;
188 
189 #ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
190 	if (sec->secbufp < sec->tsfeedp) {
191 		int i, n = sec->tsfeedp - sec->secbufp;
192 
193 		/*
194 		 * Section padding is done with 0xff bytes entirely.
195 		 * Due to speed reasons, we won't check all of them
196 		 * but just first and last.
197 		 */
198 		if (sec->secbuf[0] != 0xff || sec->secbuf[n - 1] != 0xff) {
199 			dprintk("dvb_demux.c section ts padding loss: %d/%d\n",
200 			       n, sec->tsfeedp);
201 			dprintk("dvb_demux.c pad data:");
202 			for (i = 0; i < n; i++)
203 				pr_cont(" %02x", sec->secbuf[i]);
204 			pr_cont("\n");
205 		}
206 	}
207 #endif
208 
209 	sec->tsfeedp = sec->secbufp = sec->seclen = 0;
210 	sec->secbuf = sec->secbuf_base;
211 }
212 
213 /*
214  * Losless Section Demux 1.4.1 by Emard
215  * Valsecchi Patrick:
216  *  - middle of section A  (no PUSI)
217  *  - end of section A and start of section B
218  *    (with PUSI pointing to the start of the second section)
219  *
220  *  In this case, without feed->pusi_seen you'll receive a garbage section
221  *  consisting of the end of section A. Basically because tsfeedp
222  *  is incemented and the use=0 condition is not raised
223  *  when the second packet arrives.
224  *
225  * Fix:
226  * when demux is started, let feed->pusi_seen = 0 to
227  * prevent initial feeding of garbage from the end of
228  * previous section. When you for the first time see PUSI=1
229  * then set feed->pusi_seen = 1
230  */
231 static int dvb_dmx_swfilter_section_copy_dump(struct dvb_demux_feed *feed,
232 					      const u8 *buf, u8 len)
233 {
234 	struct dvb_demux *demux = feed->demux;
235 	struct dmx_section_feed *sec = &feed->feed.sec;
236 	u16 limit, seclen, n;
237 
238 	if (sec->tsfeedp >= DMX_MAX_SECFEED_SIZE)
239 		return 0;
240 
241 	if (sec->tsfeedp + len > DMX_MAX_SECFEED_SIZE) {
242 #ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
243 		dprintk("dvb_demux.c section buffer full loss: %d/%d\n",
244 		       sec->tsfeedp + len - DMX_MAX_SECFEED_SIZE,
245 		       DMX_MAX_SECFEED_SIZE);
246 #endif
247 		len = DMX_MAX_SECFEED_SIZE - sec->tsfeedp;
248 	}
249 
250 	if (len <= 0)
251 		return 0;
252 
253 	demux->memcopy(feed, sec->secbuf_base + sec->tsfeedp, buf, len);
254 	sec->tsfeedp += len;
255 
256 	/*
257 	 * Dump all the sections we can find in the data (Emard)
258 	 */
259 	limit = sec->tsfeedp;
260 	if (limit > DMX_MAX_SECFEED_SIZE)
261 		return -1;	/* internal error should never happen */
262 
263 	/* to be sure always set secbuf */
264 	sec->secbuf = sec->secbuf_base + sec->secbufp;
265 
266 	for (n = 0; sec->secbufp + 2 < limit; n++) {
267 		seclen = section_length(sec->secbuf);
268 		if (seclen <= 0 || seclen > DMX_MAX_SECTION_SIZE
269 		    || seclen + sec->secbufp > limit)
270 			return 0;
271 		sec->seclen = seclen;
272 		sec->crc_val = ~0;
273 		/* dump [secbuf .. secbuf+seclen) */
274 		if (feed->pusi_seen)
275 			dvb_dmx_swfilter_section_feed(feed);
276 #ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
277 		else
278 			dprintk("dvb_demux.c pusi not seen, discarding section data\n");
279 #endif
280 		sec->secbufp += seclen;	/* secbufp and secbuf moving together is */
281 		sec->secbuf += seclen;	/* redundant but saves pointer arithmetic */
282 	}
283 
284 	return 0;
285 }
286 
287 static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed,
288 					   const u8 *buf)
289 {
290 	u8 p, count;
291 	int ccok, dc_i = 0;
292 	u8 cc;
293 
294 	count = payload(buf);
295 
296 	if (count == 0)		/* count == 0 if no payload or out of range */
297 		return -1;
298 
299 	p = 188 - count;	/* payload start */
300 
301 	cc = buf[3] & 0x0f;
302 	ccok = ((feed->cc + 1) & 0x0f) == cc;
303 	feed->cc = cc;
304 
305 	if (buf[3] & 0x20) {
306 		/* adaption field present, check for discontinuity_indicator */
307 		if ((buf[4] > 0) && (buf[5] & 0x80))
308 			dc_i = 1;
309 	}
310 
311 	if (!ccok || dc_i) {
312 #ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
313 		dprintk("dvb_demux.c discontinuity detected %d bytes lost\n",
314 			count);
315 		/*
316 		 * those bytes under sume circumstances will again be reported
317 		 * in the following dvb_dmx_swfilter_section_new
318 		 */
319 #endif
320 		/*
321 		 * Discontinuity detected. Reset pusi_seen = 0 to
322 		 * stop feeding of suspicious data until next PUSI=1 arrives
323 		 */
324 		feed->pusi_seen = 0;
325 		dvb_dmx_swfilter_section_new(feed);
326 	}
327 
328 	if (buf[1] & 0x40) {
329 		/* PUSI=1 (is set), section boundary is here */
330 		if (count > 1 && buf[p] < count) {
331 			const u8 *before = &buf[p + 1];
332 			u8 before_len = buf[p];
333 			const u8 *after = &before[before_len];
334 			u8 after_len = count - 1 - before_len;
335 
336 			dvb_dmx_swfilter_section_copy_dump(feed, before,
337 							   before_len);
338 			/* before start of new section, set pusi_seen = 1 */
339 			feed->pusi_seen = 1;
340 			dvb_dmx_swfilter_section_new(feed);
341 			dvb_dmx_swfilter_section_copy_dump(feed, after,
342 							   after_len);
343 		}
344 #ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
345 		else if (count > 0)
346 			dprintk("dvb_demux.c PUSI=1 but %d bytes lost\n",
347 				count);
348 #endif
349 	} else {
350 		/* PUSI=0 (is not set), no section boundary */
351 		dvb_dmx_swfilter_section_copy_dump(feed, &buf[p], count);
352 	}
353 
354 	return 0;
355 }
356 
357 static inline void dvb_dmx_swfilter_packet_type(struct dvb_demux_feed *feed,
358 						const u8 *buf)
359 {
360 	switch (feed->type) {
361 	case DMX_TYPE_TS:
362 		if (!feed->feed.ts.is_filtering)
363 			break;
364 		if (feed->ts_type & TS_PACKET) {
365 			if (feed->ts_type & TS_PAYLOAD_ONLY)
366 				dvb_dmx_swfilter_payload(feed, buf);
367 			else
368 				feed->cb.ts(buf, 188, NULL, 0, &feed->feed.ts);
369 		}
370 		if (feed->ts_type & TS_DECODER)
371 			if (feed->demux->write_to_decoder)
372 				feed->demux->write_to_decoder(feed, buf, 188);
373 		break;
374 
375 	case DMX_TYPE_SEC:
376 		if (!feed->feed.sec.is_filtering)
377 			break;
378 		if (dvb_dmx_swfilter_section_packet(feed, buf) < 0)
379 			feed->feed.sec.seclen = feed->feed.sec.secbufp = 0;
380 		break;
381 
382 	default:
383 		break;
384 	}
385 }
386 
387 #define DVR_FEED(f)							\
388 	(((f)->type == DMX_TYPE_TS) &&					\
389 	((f)->feed.ts.is_filtering) &&					\
390 	(((f)->ts_type & (TS_PACKET | TS_DEMUX)) == TS_PACKET))
391 
392 static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
393 {
394 	struct dvb_demux_feed *feed;
395 	u16 pid = ts_pid(buf);
396 	int dvr_done = 0;
397 
398 	if (dvb_demux_speedcheck) {
399 		ktime_t cur_time;
400 		u64 speed_bytes, speed_timedelta;
401 
402 		demux->speed_pkts_cnt++;
403 
404 		/* show speed every SPEED_PKTS_INTERVAL packets */
405 		if (!(demux->speed_pkts_cnt % SPEED_PKTS_INTERVAL)) {
406 			cur_time = ktime_get();
407 
408 			if (ktime_to_ns(demux->speed_last_time) != 0) {
409 				speed_bytes = (u64)demux->speed_pkts_cnt
410 					* 188 * 8;
411 				/* convert to 1024 basis */
412 				speed_bytes = 1000 * div64_u64(speed_bytes,
413 						1024);
414 				speed_timedelta = ktime_ms_delta(cur_time,
415 							demux->speed_last_time);
416 				dprintk("TS speed %llu Kbits/sec \n",
417 					div64_u64(speed_bytes,
418 						  speed_timedelta));
419 			}
420 
421 			demux->speed_last_time = cur_time;
422 			demux->speed_pkts_cnt = 0;
423 		}
424 	}
425 
426 	if (buf[1] & 0x80) {
427 		dprintk_tscheck("TEI detected. PID=0x%x data1=0x%x\n",
428 				pid, buf[1]);
429 		/* data in this packet can't be trusted - drop it unless
430 		 * module option dvb_demux_feed_err_pkts is set */
431 		if (!dvb_demux_feed_err_pkts)
432 			return;
433 	} else /* if TEI bit is set, pid may be wrong- skip pkt counter */
434 		if (demux->cnt_storage && dvb_demux_tscheck) {
435 			/* check pkt counter */
436 			if (pid < MAX_PID) {
437 				if (buf[3] & 0x10)
438 					demux->cnt_storage[pid] =
439 						(demux->cnt_storage[pid] + 1) & 0xf;
440 
441 				if ((buf[3] & 0xf) != demux->cnt_storage[pid]) {
442 					dprintk_tscheck("TS packet counter mismatch. PID=0x%x expected 0x%x got 0x%x\n",
443 						pid, demux->cnt_storage[pid],
444 						buf[3] & 0xf);
445 					demux->cnt_storage[pid] = buf[3] & 0xf;
446 				}
447 			}
448 			/* end check */
449 		}
450 
451 	list_for_each_entry(feed, &demux->feed_list, list_head) {
452 		if ((feed->pid != pid) && (feed->pid != 0x2000))
453 			continue;
454 
455 		/* copy each packet only once to the dvr device, even
456 		 * if a PID is in multiple filters (e.g. video + PCR) */
457 		if ((DVR_FEED(feed)) && (dvr_done++))
458 			continue;
459 
460 		if (feed->pid == pid)
461 			dvb_dmx_swfilter_packet_type(feed, buf);
462 		else if (feed->pid == 0x2000)
463 			feed->cb.ts(buf, 188, NULL, 0, &feed->feed.ts);
464 	}
465 }
466 
467 void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
468 			      size_t count)
469 {
470 	unsigned long flags;
471 
472 	spin_lock_irqsave(&demux->lock, flags);
473 
474 	while (count--) {
475 		if (buf[0] == 0x47)
476 			dvb_dmx_swfilter_packet(demux, buf);
477 		buf += 188;
478 	}
479 
480 	spin_unlock_irqrestore(&demux->lock, flags);
481 }
482 
483 EXPORT_SYMBOL(dvb_dmx_swfilter_packets);
484 
485 static inline int find_next_packet(const u8 *buf, int pos, size_t count,
486 				   const int pktsize)
487 {
488 	int start = pos, lost;
489 
490 	while (pos < count) {
491 		if (buf[pos] == 0x47 ||
492 		    (pktsize == 204 && buf[pos] == 0xB8))
493 			break;
494 		pos++;
495 	}
496 
497 	lost = pos - start;
498 	if (lost) {
499 		/* This garbage is part of a valid packet? */
500 		int backtrack = pos - pktsize;
501 		if (backtrack >= 0 && (buf[backtrack] == 0x47 ||
502 		    (pktsize == 204 && buf[backtrack] == 0xB8)))
503 			return backtrack;
504 	}
505 
506 	return pos;
507 }
508 
509 /* Filter all pktsize= 188 or 204 sized packets and skip garbage. */
510 static inline void _dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf,
511 		size_t count, const int pktsize)
512 {
513 	int p = 0, i, j;
514 	const u8 *q;
515 	unsigned long flags;
516 
517 	spin_lock_irqsave(&demux->lock, flags);
518 
519 	if (demux->tsbufp) { /* tsbuf[0] is now 0x47. */
520 		i = demux->tsbufp;
521 		j = pktsize - i;
522 		if (count < j) {
523 			memcpy(&demux->tsbuf[i], buf, count);
524 			demux->tsbufp += count;
525 			goto bailout;
526 		}
527 		memcpy(&demux->tsbuf[i], buf, j);
528 		if (demux->tsbuf[0] == 0x47) /* double check */
529 			dvb_dmx_swfilter_packet(demux, demux->tsbuf);
530 		demux->tsbufp = 0;
531 		p += j;
532 	}
533 
534 	while (1) {
535 		p = find_next_packet(buf, p, count, pktsize);
536 		if (p >= count)
537 			break;
538 		if (count - p < pktsize)
539 			break;
540 
541 		q = &buf[p];
542 
543 		if (pktsize == 204 && (*q == 0xB8)) {
544 			memcpy(demux->tsbuf, q, 188);
545 			demux->tsbuf[0] = 0x47;
546 			q = demux->tsbuf;
547 		}
548 		dvb_dmx_swfilter_packet(demux, q);
549 		p += pktsize;
550 	}
551 
552 	i = count - p;
553 	if (i) {
554 		memcpy(demux->tsbuf, &buf[p], i);
555 		demux->tsbufp = i;
556 		if (pktsize == 204 && demux->tsbuf[0] == 0xB8)
557 			demux->tsbuf[0] = 0x47;
558 	}
559 
560 bailout:
561 	spin_unlock_irqrestore(&demux->lock, flags);
562 }
563 
564 void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
565 {
566 	_dvb_dmx_swfilter(demux, buf, count, 188);
567 }
568 EXPORT_SYMBOL(dvb_dmx_swfilter);
569 
570 void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
571 {
572 	_dvb_dmx_swfilter(demux, buf, count, 204);
573 }
574 EXPORT_SYMBOL(dvb_dmx_swfilter_204);
575 
576 void dvb_dmx_swfilter_raw(struct dvb_demux *demux, const u8 *buf, size_t count)
577 {
578 	unsigned long flags;
579 
580 	spin_lock_irqsave(&demux->lock, flags);
581 
582 	demux->feed->cb.ts(buf, count, NULL, 0, &demux->feed->feed.ts);
583 
584 	spin_unlock_irqrestore(&demux->lock, flags);
585 }
586 EXPORT_SYMBOL(dvb_dmx_swfilter_raw);
587 
588 static struct dvb_demux_filter *dvb_dmx_filter_alloc(struct dvb_demux *demux)
589 {
590 	int i;
591 
592 	for (i = 0; i < demux->filternum; i++)
593 		if (demux->filter[i].state == DMX_STATE_FREE)
594 			break;
595 
596 	if (i == demux->filternum)
597 		return NULL;
598 
599 	demux->filter[i].state = DMX_STATE_ALLOCATED;
600 
601 	return &demux->filter[i];
602 }
603 
604 static struct dvb_demux_feed *dvb_dmx_feed_alloc(struct dvb_demux *demux)
605 {
606 	int i;
607 
608 	for (i = 0; i < demux->feednum; i++)
609 		if (demux->feed[i].state == DMX_STATE_FREE)
610 			break;
611 
612 	if (i == demux->feednum)
613 		return NULL;
614 
615 	demux->feed[i].state = DMX_STATE_ALLOCATED;
616 
617 	return &demux->feed[i];
618 }
619 
620 static int dvb_demux_feed_find(struct dvb_demux_feed *feed)
621 {
622 	struct dvb_demux_feed *entry;
623 
624 	list_for_each_entry(entry, &feed->demux->feed_list, list_head)
625 		if (entry == feed)
626 			return 1;
627 
628 	return 0;
629 }
630 
631 static void dvb_demux_feed_add(struct dvb_demux_feed *feed)
632 {
633 	spin_lock_irq(&feed->demux->lock);
634 	if (dvb_demux_feed_find(feed)) {
635 		pr_err("%s: feed already in list (type=%x state=%x pid=%x)\n",
636 		       __func__, feed->type, feed->state, feed->pid);
637 		goto out;
638 	}
639 
640 	list_add(&feed->list_head, &feed->demux->feed_list);
641 out:
642 	spin_unlock_irq(&feed->demux->lock);
643 }
644 
645 static void dvb_demux_feed_del(struct dvb_demux_feed *feed)
646 {
647 	spin_lock_irq(&feed->demux->lock);
648 	if (!(dvb_demux_feed_find(feed))) {
649 		pr_err("%s: feed not in list (type=%x state=%x pid=%x)\n",
650 		       __func__, feed->type, feed->state, feed->pid);
651 		goto out;
652 	}
653 
654 	list_del(&feed->list_head);
655 out:
656 	spin_unlock_irq(&feed->demux->lock);
657 }
658 
659 static int dmx_ts_feed_set(struct dmx_ts_feed *ts_feed, u16 pid, int ts_type,
660 			   enum dmx_ts_pes pes_type, ktime_t timeout)
661 {
662 	struct dvb_demux_feed *feed = (struct dvb_demux_feed *)ts_feed;
663 	struct dvb_demux *demux = feed->demux;
664 
665 	if (pid > DMX_MAX_PID)
666 		return -EINVAL;
667 
668 	if (mutex_lock_interruptible(&demux->mutex))
669 		return -ERESTARTSYS;
670 
671 	if (ts_type & TS_DECODER) {
672 		if (pes_type >= DMX_PES_OTHER) {
673 			mutex_unlock(&demux->mutex);
674 			return -EINVAL;
675 		}
676 
677 		if (demux->pesfilter[pes_type] &&
678 		    demux->pesfilter[pes_type] != feed) {
679 			mutex_unlock(&demux->mutex);
680 			return -EINVAL;
681 		}
682 
683 		demux->pesfilter[pes_type] = feed;
684 		demux->pids[pes_type] = pid;
685 	}
686 
687 	dvb_demux_feed_add(feed);
688 
689 	feed->pid = pid;
690 	feed->timeout = timeout;
691 	feed->ts_type = ts_type;
692 	feed->pes_type = pes_type;
693 
694 	feed->state = DMX_STATE_READY;
695 	mutex_unlock(&demux->mutex);
696 
697 	return 0;
698 }
699 
700 static int dmx_ts_feed_start_filtering(struct dmx_ts_feed *ts_feed)
701 {
702 	struct dvb_demux_feed *feed = (struct dvb_demux_feed *)ts_feed;
703 	struct dvb_demux *demux = feed->demux;
704 	int ret;
705 
706 	if (mutex_lock_interruptible(&demux->mutex))
707 		return -ERESTARTSYS;
708 
709 	if (feed->state != DMX_STATE_READY || feed->type != DMX_TYPE_TS) {
710 		mutex_unlock(&demux->mutex);
711 		return -EINVAL;
712 	}
713 
714 	if (!demux->start_feed) {
715 		mutex_unlock(&demux->mutex);
716 		return -ENODEV;
717 	}
718 
719 	if ((ret = demux->start_feed(feed)) < 0) {
720 		mutex_unlock(&demux->mutex);
721 		return ret;
722 	}
723 
724 	spin_lock_irq(&demux->lock);
725 	ts_feed->is_filtering = 1;
726 	feed->state = DMX_STATE_GO;
727 	spin_unlock_irq(&demux->lock);
728 	mutex_unlock(&demux->mutex);
729 
730 	return 0;
731 }
732 
733 static int dmx_ts_feed_stop_filtering(struct dmx_ts_feed *ts_feed)
734 {
735 	struct dvb_demux_feed *feed = (struct dvb_demux_feed *)ts_feed;
736 	struct dvb_demux *demux = feed->demux;
737 	int ret;
738 
739 	mutex_lock(&demux->mutex);
740 
741 	if (feed->state < DMX_STATE_GO) {
742 		mutex_unlock(&demux->mutex);
743 		return -EINVAL;
744 	}
745 
746 	if (!demux->stop_feed) {
747 		mutex_unlock(&demux->mutex);
748 		return -ENODEV;
749 	}
750 
751 	ret = demux->stop_feed(feed);
752 
753 	spin_lock_irq(&demux->lock);
754 	ts_feed->is_filtering = 0;
755 	feed->state = DMX_STATE_ALLOCATED;
756 	spin_unlock_irq(&demux->lock);
757 	mutex_unlock(&demux->mutex);
758 
759 	return ret;
760 }
761 
762 static int dvbdmx_allocate_ts_feed(struct dmx_demux *dmx,
763 				   struct dmx_ts_feed **ts_feed,
764 				   dmx_ts_cb callback)
765 {
766 	struct dvb_demux *demux = (struct dvb_demux *)dmx;
767 	struct dvb_demux_feed *feed;
768 
769 	if (mutex_lock_interruptible(&demux->mutex))
770 		return -ERESTARTSYS;
771 
772 	if (!(feed = dvb_dmx_feed_alloc(demux))) {
773 		mutex_unlock(&demux->mutex);
774 		return -EBUSY;
775 	}
776 
777 	feed->type = DMX_TYPE_TS;
778 	feed->cb.ts = callback;
779 	feed->demux = demux;
780 	feed->pid = 0xffff;
781 	feed->peslen = 0xfffa;
782 
783 	(*ts_feed) = &feed->feed.ts;
784 	(*ts_feed)->parent = dmx;
785 	(*ts_feed)->priv = NULL;
786 	(*ts_feed)->is_filtering = 0;
787 	(*ts_feed)->start_filtering = dmx_ts_feed_start_filtering;
788 	(*ts_feed)->stop_filtering = dmx_ts_feed_stop_filtering;
789 	(*ts_feed)->set = dmx_ts_feed_set;
790 
791 	if (!(feed->filter = dvb_dmx_filter_alloc(demux))) {
792 		feed->state = DMX_STATE_FREE;
793 		mutex_unlock(&demux->mutex);
794 		return -EBUSY;
795 	}
796 
797 	feed->filter->type = DMX_TYPE_TS;
798 	feed->filter->feed = feed;
799 	feed->filter->state = DMX_STATE_READY;
800 
801 	mutex_unlock(&demux->mutex);
802 
803 	return 0;
804 }
805 
806 static int dvbdmx_release_ts_feed(struct dmx_demux *dmx,
807 				  struct dmx_ts_feed *ts_feed)
808 {
809 	struct dvb_demux *demux = (struct dvb_demux *)dmx;
810 	struct dvb_demux_feed *feed = (struct dvb_demux_feed *)ts_feed;
811 
812 	mutex_lock(&demux->mutex);
813 
814 	if (feed->state == DMX_STATE_FREE) {
815 		mutex_unlock(&demux->mutex);
816 		return -EINVAL;
817 	}
818 
819 	feed->state = DMX_STATE_FREE;
820 	feed->filter->state = DMX_STATE_FREE;
821 
822 	dvb_demux_feed_del(feed);
823 
824 	feed->pid = 0xffff;
825 
826 	if (feed->ts_type & TS_DECODER && feed->pes_type < DMX_PES_OTHER)
827 		demux->pesfilter[feed->pes_type] = NULL;
828 
829 	mutex_unlock(&demux->mutex);
830 	return 0;
831 }
832 
833 /******************************************************************************
834  * dmx_section_feed API calls
835  ******************************************************************************/
836 
837 static int dmx_section_feed_allocate_filter(struct dmx_section_feed *feed,
838 					    struct dmx_section_filter **filter)
839 {
840 	struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
841 	struct dvb_demux *dvbdemux = dvbdmxfeed->demux;
842 	struct dvb_demux_filter *dvbdmxfilter;
843 
844 	if (mutex_lock_interruptible(&dvbdemux->mutex))
845 		return -ERESTARTSYS;
846 
847 	dvbdmxfilter = dvb_dmx_filter_alloc(dvbdemux);
848 	if (!dvbdmxfilter) {
849 		mutex_unlock(&dvbdemux->mutex);
850 		return -EBUSY;
851 	}
852 
853 	spin_lock_irq(&dvbdemux->lock);
854 	*filter = &dvbdmxfilter->filter;
855 	(*filter)->parent = feed;
856 	(*filter)->priv = NULL;
857 	dvbdmxfilter->feed = dvbdmxfeed;
858 	dvbdmxfilter->type = DMX_TYPE_SEC;
859 	dvbdmxfilter->state = DMX_STATE_READY;
860 	dvbdmxfilter->next = dvbdmxfeed->filter;
861 	dvbdmxfeed->filter = dvbdmxfilter;
862 	spin_unlock_irq(&dvbdemux->lock);
863 
864 	mutex_unlock(&dvbdemux->mutex);
865 	return 0;
866 }
867 
868 static int dmx_section_feed_set(struct dmx_section_feed *feed,
869 				u16 pid, int check_crc)
870 {
871 	struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
872 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
873 
874 	if (pid > 0x1fff)
875 		return -EINVAL;
876 
877 	if (mutex_lock_interruptible(&dvbdmx->mutex))
878 		return -ERESTARTSYS;
879 
880 	dvb_demux_feed_add(dvbdmxfeed);
881 
882 	dvbdmxfeed->pid = pid;
883 	dvbdmxfeed->feed.sec.check_crc = check_crc;
884 
885 	dvbdmxfeed->state = DMX_STATE_READY;
886 	mutex_unlock(&dvbdmx->mutex);
887 	return 0;
888 }
889 
890 static void prepare_secfilters(struct dvb_demux_feed *dvbdmxfeed)
891 {
892 	int i;
893 	struct dvb_demux_filter *f;
894 	struct dmx_section_filter *sf;
895 	u8 mask, mode, doneq;
896 
897 	if (!(f = dvbdmxfeed->filter))
898 		return;
899 	do {
900 		sf = &f->filter;
901 		doneq = 0;
902 		for (i = 0; i < DVB_DEMUX_MASK_MAX; i++) {
903 			mode = sf->filter_mode[i];
904 			mask = sf->filter_mask[i];
905 			f->maskandmode[i] = mask & mode;
906 			doneq |= f->maskandnotmode[i] = mask & ~mode;
907 		}
908 		f->doneq = doneq ? 1 : 0;
909 	} while ((f = f->next));
910 }
911 
912 static int dmx_section_feed_start_filtering(struct dmx_section_feed *feed)
913 {
914 	struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
915 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
916 	int ret;
917 
918 	if (mutex_lock_interruptible(&dvbdmx->mutex))
919 		return -ERESTARTSYS;
920 
921 	if (feed->is_filtering) {
922 		mutex_unlock(&dvbdmx->mutex);
923 		return -EBUSY;
924 	}
925 
926 	if (!dvbdmxfeed->filter) {
927 		mutex_unlock(&dvbdmx->mutex);
928 		return -EINVAL;
929 	}
930 
931 	dvbdmxfeed->feed.sec.tsfeedp = 0;
932 	dvbdmxfeed->feed.sec.secbuf = dvbdmxfeed->feed.sec.secbuf_base;
933 	dvbdmxfeed->feed.sec.secbufp = 0;
934 	dvbdmxfeed->feed.sec.seclen = 0;
935 
936 	if (!dvbdmx->start_feed) {
937 		mutex_unlock(&dvbdmx->mutex);
938 		return -ENODEV;
939 	}
940 
941 	prepare_secfilters(dvbdmxfeed);
942 
943 	if ((ret = dvbdmx->start_feed(dvbdmxfeed)) < 0) {
944 		mutex_unlock(&dvbdmx->mutex);
945 		return ret;
946 	}
947 
948 	spin_lock_irq(&dvbdmx->lock);
949 	feed->is_filtering = 1;
950 	dvbdmxfeed->state = DMX_STATE_GO;
951 	spin_unlock_irq(&dvbdmx->lock);
952 
953 	mutex_unlock(&dvbdmx->mutex);
954 	return 0;
955 }
956 
957 static int dmx_section_feed_stop_filtering(struct dmx_section_feed *feed)
958 {
959 	struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
960 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
961 	int ret;
962 
963 	mutex_lock(&dvbdmx->mutex);
964 
965 	if (!dvbdmx->stop_feed) {
966 		mutex_unlock(&dvbdmx->mutex);
967 		return -ENODEV;
968 	}
969 
970 	ret = dvbdmx->stop_feed(dvbdmxfeed);
971 
972 	spin_lock_irq(&dvbdmx->lock);
973 	dvbdmxfeed->state = DMX_STATE_READY;
974 	feed->is_filtering = 0;
975 	spin_unlock_irq(&dvbdmx->lock);
976 
977 	mutex_unlock(&dvbdmx->mutex);
978 	return ret;
979 }
980 
981 static int dmx_section_feed_release_filter(struct dmx_section_feed *feed,
982 					   struct dmx_section_filter *filter)
983 {
984 	struct dvb_demux_filter *dvbdmxfilter = (struct dvb_demux_filter *)filter, *f;
985 	struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
986 	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
987 
988 	mutex_lock(&dvbdmx->mutex);
989 
990 	if (dvbdmxfilter->feed != dvbdmxfeed) {
991 		mutex_unlock(&dvbdmx->mutex);
992 		return -EINVAL;
993 	}
994 
995 	if (feed->is_filtering) {
996 		/* release dvbdmx->mutex as far as it is
997 		   acquired by stop_filtering() itself */
998 		mutex_unlock(&dvbdmx->mutex);
999 		feed->stop_filtering(feed);
1000 		mutex_lock(&dvbdmx->mutex);
1001 	}
1002 
1003 	spin_lock_irq(&dvbdmx->lock);
1004 	f = dvbdmxfeed->filter;
1005 
1006 	if (f == dvbdmxfilter) {
1007 		dvbdmxfeed->filter = dvbdmxfilter->next;
1008 	} else {
1009 		while (f->next != dvbdmxfilter)
1010 			f = f->next;
1011 		f->next = f->next->next;
1012 	}
1013 
1014 	dvbdmxfilter->state = DMX_STATE_FREE;
1015 	spin_unlock_irq(&dvbdmx->lock);
1016 	mutex_unlock(&dvbdmx->mutex);
1017 	return 0;
1018 }
1019 
1020 static int dvbdmx_allocate_section_feed(struct dmx_demux *demux,
1021 					struct dmx_section_feed **feed,
1022 					dmx_section_cb callback)
1023 {
1024 	struct dvb_demux *dvbdmx = (struct dvb_demux *)demux;
1025 	struct dvb_demux_feed *dvbdmxfeed;
1026 
1027 	if (mutex_lock_interruptible(&dvbdmx->mutex))
1028 		return -ERESTARTSYS;
1029 
1030 	if (!(dvbdmxfeed = dvb_dmx_feed_alloc(dvbdmx))) {
1031 		mutex_unlock(&dvbdmx->mutex);
1032 		return -EBUSY;
1033 	}
1034 
1035 	dvbdmxfeed->type = DMX_TYPE_SEC;
1036 	dvbdmxfeed->cb.sec = callback;
1037 	dvbdmxfeed->demux = dvbdmx;
1038 	dvbdmxfeed->pid = 0xffff;
1039 	dvbdmxfeed->feed.sec.secbuf = dvbdmxfeed->feed.sec.secbuf_base;
1040 	dvbdmxfeed->feed.sec.secbufp = dvbdmxfeed->feed.sec.seclen = 0;
1041 	dvbdmxfeed->feed.sec.tsfeedp = 0;
1042 	dvbdmxfeed->filter = NULL;
1043 
1044 	(*feed) = &dvbdmxfeed->feed.sec;
1045 	(*feed)->is_filtering = 0;
1046 	(*feed)->parent = demux;
1047 	(*feed)->priv = NULL;
1048 
1049 	(*feed)->set = dmx_section_feed_set;
1050 	(*feed)->allocate_filter = dmx_section_feed_allocate_filter;
1051 	(*feed)->start_filtering = dmx_section_feed_start_filtering;
1052 	(*feed)->stop_filtering = dmx_section_feed_stop_filtering;
1053 	(*feed)->release_filter = dmx_section_feed_release_filter;
1054 
1055 	mutex_unlock(&dvbdmx->mutex);
1056 	return 0;
1057 }
1058 
1059 static int dvbdmx_release_section_feed(struct dmx_demux *demux,
1060 				       struct dmx_section_feed *feed)
1061 {
1062 	struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
1063 	struct dvb_demux *dvbdmx = (struct dvb_demux *)demux;
1064 
1065 	mutex_lock(&dvbdmx->mutex);
1066 
1067 	if (dvbdmxfeed->state == DMX_STATE_FREE) {
1068 		mutex_unlock(&dvbdmx->mutex);
1069 		return -EINVAL;
1070 	}
1071 	dvbdmxfeed->state = DMX_STATE_FREE;
1072 
1073 	dvb_demux_feed_del(dvbdmxfeed);
1074 
1075 	dvbdmxfeed->pid = 0xffff;
1076 
1077 	mutex_unlock(&dvbdmx->mutex);
1078 	return 0;
1079 }
1080 
1081 /******************************************************************************
1082  * dvb_demux kernel data API calls
1083  ******************************************************************************/
1084 
1085 static int dvbdmx_open(struct dmx_demux *demux)
1086 {
1087 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1088 
1089 	if (dvbdemux->users >= MAX_DVB_DEMUX_USERS)
1090 		return -EUSERS;
1091 
1092 	dvbdemux->users++;
1093 	return 0;
1094 }
1095 
1096 static int dvbdmx_close(struct dmx_demux *demux)
1097 {
1098 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1099 
1100 	if (dvbdemux->users == 0)
1101 		return -ENODEV;
1102 
1103 	dvbdemux->users--;
1104 	//FIXME: release any unneeded resources if users==0
1105 	return 0;
1106 }
1107 
1108 static int dvbdmx_write(struct dmx_demux *demux, const char __user *buf, size_t count)
1109 {
1110 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1111 	void *p;
1112 
1113 	if ((!demux->frontend) || (demux->frontend->source != DMX_MEMORY_FE))
1114 		return -EINVAL;
1115 
1116 	p = memdup_user(buf, count);
1117 	if (IS_ERR(p))
1118 		return PTR_ERR(p);
1119 	if (mutex_lock_interruptible(&dvbdemux->mutex)) {
1120 		kfree(p);
1121 		return -ERESTARTSYS;
1122 	}
1123 	dvb_dmx_swfilter(dvbdemux, p, count);
1124 	kfree(p);
1125 	mutex_unlock(&dvbdemux->mutex);
1126 
1127 	if (signal_pending(current))
1128 		return -EINTR;
1129 	return count;
1130 }
1131 
1132 static int dvbdmx_add_frontend(struct dmx_demux *demux,
1133 			       struct dmx_frontend *frontend)
1134 {
1135 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1136 	struct list_head *head = &dvbdemux->frontend_list;
1137 
1138 	list_add(&(frontend->connectivity_list), head);
1139 
1140 	return 0;
1141 }
1142 
1143 static int dvbdmx_remove_frontend(struct dmx_demux *demux,
1144 				  struct dmx_frontend *frontend)
1145 {
1146 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1147 	struct list_head *pos, *n, *head = &dvbdemux->frontend_list;
1148 
1149 	list_for_each_safe(pos, n, head) {
1150 		if (DMX_FE_ENTRY(pos) == frontend) {
1151 			list_del(pos);
1152 			return 0;
1153 		}
1154 	}
1155 
1156 	return -ENODEV;
1157 }
1158 
1159 static struct list_head *dvbdmx_get_frontends(struct dmx_demux *demux)
1160 {
1161 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1162 
1163 	if (list_empty(&dvbdemux->frontend_list))
1164 		return NULL;
1165 
1166 	return &dvbdemux->frontend_list;
1167 }
1168 
1169 static int dvbdmx_connect_frontend(struct dmx_demux *demux,
1170 				   struct dmx_frontend *frontend)
1171 {
1172 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1173 
1174 	if (demux->frontend)
1175 		return -EINVAL;
1176 
1177 	mutex_lock(&dvbdemux->mutex);
1178 
1179 	demux->frontend = frontend;
1180 	mutex_unlock(&dvbdemux->mutex);
1181 	return 0;
1182 }
1183 
1184 static int dvbdmx_disconnect_frontend(struct dmx_demux *demux)
1185 {
1186 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1187 
1188 	mutex_lock(&dvbdemux->mutex);
1189 
1190 	demux->frontend = NULL;
1191 	mutex_unlock(&dvbdemux->mutex);
1192 	return 0;
1193 }
1194 
1195 static int dvbdmx_get_pes_pids(struct dmx_demux *demux, u16 * pids)
1196 {
1197 	struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
1198 
1199 	memcpy(pids, dvbdemux->pids, 5 * sizeof(u16));
1200 	return 0;
1201 }
1202 
1203 int dvb_dmx_init(struct dvb_demux *dvbdemux)
1204 {
1205 	int i;
1206 	struct dmx_demux *dmx = &dvbdemux->dmx;
1207 
1208 	dvbdemux->cnt_storage = NULL;
1209 	dvbdemux->users = 0;
1210 	dvbdemux->filter = vmalloc(dvbdemux->filternum * sizeof(struct dvb_demux_filter));
1211 
1212 	if (!dvbdemux->filter)
1213 		return -ENOMEM;
1214 
1215 	dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed));
1216 	if (!dvbdemux->feed) {
1217 		vfree(dvbdemux->filter);
1218 		dvbdemux->filter = NULL;
1219 		return -ENOMEM;
1220 	}
1221 	for (i = 0; i < dvbdemux->filternum; i++) {
1222 		dvbdemux->filter[i].state = DMX_STATE_FREE;
1223 		dvbdemux->filter[i].index = i;
1224 	}
1225 	for (i = 0; i < dvbdemux->feednum; i++) {
1226 		dvbdemux->feed[i].state = DMX_STATE_FREE;
1227 		dvbdemux->feed[i].index = i;
1228 	}
1229 
1230 	dvbdemux->cnt_storage = vmalloc(MAX_PID + 1);
1231 	if (!dvbdemux->cnt_storage)
1232 		pr_warn("Couldn't allocate memory for TS/TEI check. Disabling it\n");
1233 
1234 	INIT_LIST_HEAD(&dvbdemux->frontend_list);
1235 
1236 	for (i = 0; i < DMX_PES_OTHER; i++) {
1237 		dvbdemux->pesfilter[i] = NULL;
1238 		dvbdemux->pids[i] = 0xffff;
1239 	}
1240 
1241 	INIT_LIST_HEAD(&dvbdemux->feed_list);
1242 
1243 	dvbdemux->playing = 0;
1244 	dvbdemux->recording = 0;
1245 	dvbdemux->tsbufp = 0;
1246 
1247 	if (!dvbdemux->check_crc32)
1248 		dvbdemux->check_crc32 = dvb_dmx_crc32;
1249 
1250 	if (!dvbdemux->memcopy)
1251 		dvbdemux->memcopy = dvb_dmx_memcopy;
1252 
1253 	dmx->frontend = NULL;
1254 	dmx->priv = dvbdemux;
1255 	dmx->open = dvbdmx_open;
1256 	dmx->close = dvbdmx_close;
1257 	dmx->write = dvbdmx_write;
1258 	dmx->allocate_ts_feed = dvbdmx_allocate_ts_feed;
1259 	dmx->release_ts_feed = dvbdmx_release_ts_feed;
1260 	dmx->allocate_section_feed = dvbdmx_allocate_section_feed;
1261 	dmx->release_section_feed = dvbdmx_release_section_feed;
1262 
1263 	dmx->add_frontend = dvbdmx_add_frontend;
1264 	dmx->remove_frontend = dvbdmx_remove_frontend;
1265 	dmx->get_frontends = dvbdmx_get_frontends;
1266 	dmx->connect_frontend = dvbdmx_connect_frontend;
1267 	dmx->disconnect_frontend = dvbdmx_disconnect_frontend;
1268 	dmx->get_pes_pids = dvbdmx_get_pes_pids;
1269 
1270 	mutex_init(&dvbdemux->mutex);
1271 	spin_lock_init(&dvbdemux->lock);
1272 
1273 	return 0;
1274 }
1275 
1276 EXPORT_SYMBOL(dvb_dmx_init);
1277 
1278 void dvb_dmx_release(struct dvb_demux *dvbdemux)
1279 {
1280 	vfree(dvbdemux->cnt_storage);
1281 	vfree(dvbdemux->filter);
1282 	vfree(dvbdemux->feed);
1283 }
1284 
1285 EXPORT_SYMBOL(dvb_dmx_release);
1286