Implement I2C filter in pvrusb2 for cx25840

From: Mike Isely <isely@pobox.com>

Insert an I2C transaction filter for the cx25843 chip on new model
24xxx hardware.  This filter attempts to stabilize the part by
limiting how the part can be accessed.  The filter won't allow anyone
to touch the chip until an attempt is made to specifically read the
chip's revision registers.  If that read fails (which can happen if
the chip wedges itself), a warning is logged and the driver is
rendered useless.  If the read succeeds, then the filter deletes
itself and normal access to the part takes place.  This filter should
keep msp3400 away from the chip (a failure scenario which otherwise
frequently ends badly for the kernel, due to suspected misbehaviors
within the msp3400 module).

Signed-off-by: Mike Isely <isely@pobox.com>

2 files changed, 92 insertions, 0 deletions

diff --git a/linux/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/linux/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
index ec6c35b8d..ff18fc548 100644
--- a/linux/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
+++ b/linux/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
@@ -225,6 +225,7 @@ struct pvr2_hdw {
 	struct i2c_adapter i2c_adap;
 	struct i2c_algorithm i2c_algo;
 	pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
+	int i2c_cx25840_hack_state;
 	int i2c_linked;
 	unsigned int i2c_pend_types;    /* Which types of update are needed */
 	unsigned long i2c_pend_mask;    /* Change bits we need to scan */
diff --git a/linux/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c b/linux/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
index e1d3803b3..6d7c909ce 100644
--- a/linux/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
+++ b/linux/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
@@ -182,6 +182,8 @@ int pvr2_i2c_basic_op(struct pvr2_hdw *hdw,
 	}
 }
 
+#ifdef CONFIG_VIDEO_PVRUSB2_24XXX
+
 /* This is a special entry point that is entered if an I2C operation is
    attempted to a wm8775 chip on model 24xxx hardware.  Autodetect of this
    part doesn't work, but we know it is really there.  So let's look for
@@ -196,6 +198,94 @@ static int i2c_hack_wm8775(struct pvr2_hdw *hdw,
 	return pvr2_i2c_basic_op(hdw,i2c_addr,wdata,wlen,rdata,rlen);
 }
 
+/* This is a special entry point that is entered if an I2C operation is
+   attempted to a cx25840 chip on model 24xxx hardware.  This chip can
+   sometimes wedge itself.  Worse still, when this happens msp3400 can
+   falsely detect this part and then the system gets hosed up after msp3400
+   gets confused and dies.  What we want to do here is try to keep msp3400
+   away and also try to notice if the chip is wedged and send a warning to
+   the system log. */
+static int i2c_hack_cx25840(struct pvr2_hdw *hdw,
+			    u8 i2c_addr,u8 *wdata,u16 wlen,u8 *rdata,u16 rlen)
+{
+	int ret;
+	unsigned int subaddr;
+	u8 wbuf[2];
+	int state = hdw->i2c_cx25840_hack_state;
+
+	if (!(rlen || wlen)) {
+		// Probe attempt - always just succeed and don't bother the
+		// hardware (this helps to make the state machine further
+		// down somewhat easier).
+		return 0;
+	}
+
+	/* We're looking for the exact pattern where the revision register
+	   is being read.  The cx25840 module will always look at the
+	   revision register first.  Any other pattern of access therefore
+	   has to be a probe attempt from somebody else so we'll reject it.
+	   Normally we could just let each client just probe the part
+	   anyway, but when the cx25840 is wedged, msp3400 will get a false
+	   positive and that just screws things up... */
+
+	if (wlen == 0) {
+		switch (state) {
+		case 1: subaddr = 0x0100; break;
+		case 2: subaddr = 0x0101; break;
+		default: goto fail;
+		}
+	} else if (wlen == 2) {
+		subaddr = (wdata[0] << 8) | wdata[1];
+		switch (subaddr) {
+		case 0x0100: state = 1; break;
+		case 0x0101: state = 2; break;
+		default: goto fail;
+		}
+	} else {
+		goto fail;
+	}
+	if (!rlen) goto success;
+	state = 0;
+	if (rlen != 1) goto fail;
+
+	/* If we get to here then we have a legitimate read for one of the
+	   two revision bytes, so pass it through. */
+	wbuf[0] = subaddr >> 8;
+	wbuf[1] = subaddr;
+	ret = pvr2_i2c_basic_op(hdw,i2c_addr,wbuf,2,rdata,rlen);
+
+	if ((ret != 0) || (*rdata == 0x04) || (*rdata == 0x0a)) {
+		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+			   "WARNING: Detected a wedged cx25840 chip;"
+			   " the device will not work.");
+		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+			   "WARNING: Try power cycling the pvrusb2 device.");
+		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+			   "WARNING: Disabling further access to the device"
+			   " to prevent other foul-ups.");
+		// This blocks all further communication with the part.
+		hdw->i2c_func[0x44] = 0;
+		pvr2_hdw_render_useless(hdw);
+		goto fail;
+	}
+
+	/* Success!  Now let's just step out of the way and let the cx25840
+	   module do its work normally from now on... */
+	pvr2_trace(PVR2_TRACE_INIT,"cx25840 appears to be OK,"
+		   " dropping its I2C filter");
+	hdw->i2c_func[0x44] = pvr2_i2c_basic_op;
+
+ success:
+	hdw->i2c_cx25840_hack_state = state;
+	return 0;
+
+ fail:
+	hdw->i2c_cx25840_hack_state = state;
+	return -EIO;
+}
+
+#endif /* CONFIG_VIDEO_PVRUSB2_24XXX */
+
 /* This is a very, very limited I2C adapter implementation.  We can only
    support what we actually know will work on the device... */
 static int pvr2_i2c_xfer(struct i2c_adapter *i2c_adap,
@@ -818,6 +908,7 @@ void pvr2_i2c_core_init(struct pvr2_hdw *hdw)
 	// the I2C transfer stack to let things work better.
 	if (hdw->hdw_type == PVR2_HDW_TYPE_24XXX) {
 		hdw->i2c_func[0x1b] = i2c_hack_wm8775;
+		hdw->i2c_func[0x44] = i2c_hack_cx25840;
 	}
 #endif