Avoid beyond bounds copy while caching ACL
[zen-stable.git] / drivers / media / dvb / dvb-usb / dvb-usb-firmware.c
blob733a7ff7b207819bcd05f2a816388fa21e9f69b5
1 /* dvb-usb-firmware.c is part of the DVB USB library.
3 * Copyright (C) 2004-6 Patrick Boettcher (patrick.boettcher@desy.de)
4 * see dvb-usb-init.c for copyright information.
6 * This file contains functions for downloading the firmware to Cypress FX 1 and 2 based devices.
8 * FIXME: This part does actually not belong to dvb-usb, but to the usb-subsystem.
9 */
10 #include "dvb-usb-common.h"
12 #include <linux/usb.h>
14 struct usb_cypress_controller {
15 int id;
16 const char *name; /* name of the usb controller */
17 u16 cpu_cs_register; /* needs to be restarted, when the firmware has been downloaded. */
20 static struct usb_cypress_controller cypress[] = {
21 { .id = DEVICE_SPECIFIC, .name = "Device specific", .cpu_cs_register = 0 },
22 { .id = CYPRESS_AN2135, .name = "Cypress AN2135", .cpu_cs_register = 0x7f92 },
23 { .id = CYPRESS_AN2235, .name = "Cypress AN2235", .cpu_cs_register = 0x7f92 },
24 { .id = CYPRESS_FX2, .name = "Cypress FX2", .cpu_cs_register = 0xe600 },
28 * load a firmware packet to the device
30 static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 len)
32 return usb_control_msg(udev, usb_sndctrlpipe(udev,0),
33 0xa0, USB_TYPE_VENDOR, addr, 0x00, data, len, 5000);
36 int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
38 struct hexline hx;
39 u8 reset;
40 int ret,pos=0;
42 /* stop the CPU */
43 reset = 1;
44 if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
45 err("could not stop the USB controller CPU.");
47 while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) {
48 deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk);
49 ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len);
51 if (ret != hx.len) {
52 err("error while transferring firmware "
53 "(transferred size: %d, block size: %d)",
54 ret,hx.len);
55 ret = -EINVAL;
56 break;
59 if (ret < 0) {
60 err("firmware download failed at %d with %d",pos,ret);
61 return ret;
64 if (ret == 0) {
65 /* restart the CPU */
66 reset = 0;
67 if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
68 err("could not restart the USB controller CPU.");
69 ret = -EINVAL;
71 } else
72 ret = -EIO;
74 return ret;
76 EXPORT_SYMBOL(usb_cypress_load_firmware);
78 int dvb_usb_download_firmware(struct usb_device *udev, struct dvb_usb_device_properties *props)
80 int ret;
81 const struct firmware *fw = NULL;
83 if ((ret = request_firmware(&fw, props->firmware, &udev->dev)) != 0) {
84 err("did not find the firmware file. (%s) "
85 "Please see linux/Documentation/dvb/ for more details on firmware-problems. (%d)",
86 props->firmware,ret);
87 return ret;
90 info("downloading firmware from file '%s'",props->firmware);
92 switch (props->usb_ctrl) {
93 case CYPRESS_AN2135:
94 case CYPRESS_AN2235:
95 case CYPRESS_FX2:
96 ret = usb_cypress_load_firmware(udev, fw, props->usb_ctrl);
97 break;
98 case DEVICE_SPECIFIC:
99 if (props->download_firmware)
100 ret = props->download_firmware(udev,fw);
101 else {
102 err("BUG: driver didn't specified a download_firmware-callback, although it claims to have a DEVICE_SPECIFIC one.");
103 ret = -EINVAL;
105 break;
106 default:
107 ret = -EINVAL;
108 break;
111 release_firmware(fw);
112 return ret;
115 int dvb_usb_get_hexline(const struct firmware *fw, struct hexline *hx,
116 int *pos)
118 u8 *b = (u8 *) &fw->data[*pos];
119 int data_offs = 4;
120 if (*pos >= fw->size)
121 return 0;
123 memset(hx,0,sizeof(struct hexline));
125 hx->len = b[0];
127 if ((*pos + hx->len + 4) >= fw->size)
128 return -EINVAL;
130 hx->addr = b[1] | (b[2] << 8);
131 hx->type = b[3];
133 if (hx->type == 0x04) {
134 /* b[4] and b[5] are the Extended linear address record data field */
135 hx->addr |= (b[4] << 24) | (b[5] << 16);
136 /* hx->len -= 2;
137 data_offs += 2; */
139 memcpy(hx->data,&b[data_offs],hx->len);
140 hx->chk = b[hx->len + data_offs];
142 *pos += hx->len + 5;
144 return *pos;
146 EXPORT_SYMBOL(dvb_usb_get_hexline);