[linux-dvb] b2c2 skystar usb driver

[Patrick Boettcher <patrick.boettcher@desy.de>]

Hi list,

Today I received the mentioned device on loan by Luca Bertagnolio.

After doing some reverse-engineering I now want to ask for some opinions.
Probably skystar2 experts/developers can help at best, but any other
help is welcome as well :).

To read/write the device parameters, control messages are exchanged via
the control endpoint (0) of the USB connection.

Every USB transfer consists basically of a buffer, an endpoint (address)
and a direction. In case of a control transfer, the buffer is divided in
two parts, a setup packet and a data paket.

In case of the b2c2 usb device the setup packet is filled with
information, where the data (from the data buffer) has to be written. I.e.
Setup packet contains i2c adresses, registers, data len.

Now the big question is: what is what? I was a little bit overwhelmed when
I saw the buffers and up to now (after 2 hours of interpreting) I wasn't
yet able to figure out which byte means what. I hope maybe the skystar2.c
authors can jump in and find some hints.

It is clear that the stv0299 demod is in use, so a lot of work is already
done.

Some rev-eng examples:

Reading the mac-address and setting it, this is also done in skystar2.c,
but it seems to differ (at least the adresses):

(all numbers are in hex)

reading the mac address (usb):
setup packet: c0 05 00 f0 00 83 20 00
data: c2 b2 01 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 d0 d7 30 6f ee
01 b7 00 00 00 00 00 00 00 00

I already figured out:
setup packet[0]: c0 = usb reading (40 = usb writing)
setup packet[1]: 05 = eeprom ???
setup packet[2]: 00 = position to read from eeprom
setup packet[6]: 20 = length of data buffer
setup packet[7]: 00 = it is always 0

Lucky I am, the mac address is printed outside of the box:
00 d0 d7 30 6f ee

As the skystar.c, the usb device is also writing the mac address to the
MAC address filter.

setup packet[0]: 40 = usb writing
setup packet[1]: 0a = something ???
setup packet[2]: 46 = first 4 values of the mac
setup packet[3-5]: 00
setup packet[6]: 04 = length of data
data: 00 d0 d7 30

second part of the MAC
setup packet[2]: 47 = last 2 values of the mac
data: 6f ee 00 00


example 2: activating pll transfer and writing to it:
This makes it clear that really the stv0299 is in use.

setpack: 40 11 10 01 05 68 01 00     data: b5
setpack: 40 11 10 01 1d 61 03 00     data: b0 84 08
setpack: c0 11 10 03 05 68 01 00     data: 35

Ok, this were some more descriptive examples, the complete log of a plugin
in windows can be found on http://www.wi-bw.tfh-wildau.de/~pboettch/b2c2

Parse.pl is a script which tries to make the buffers a little bit
readable.

I invite everyone to join the reverse-engineering-process. I will try to
report every progress.

Thanks in advance for any hints you will find ;),
Patrick.

--
  Mail: patrick.boettcher@desy.de
  WWW:  http://www.wi-bw.tfh-wildau.de/~pboettch/