[PATCH 0/5] fix buggy mxl5007t register read

[PATCH 0/5] fix buggy mxl5007t register read

[Antti Palosaari]

Current MxL5007t driver implements repeated start condition (badly)
whilst device uses stop before read operation.

I added "use_broken_read_reg_intentionally" config option to avoid
regressions as I don't have all devices to test / fix.

Antti Palosaari (5):
  mxl5007t: fix buggy register read
  af9015: fix I2C adapter read (without REPEATED STOP)
  af9015: do not use buggy mxl5007t read reg
  af9035: implement I2C adapter read operation
  af9035: do not use buggy mxl5007t read reg

 drivers/media/tuners/mxl5007t.c             | 56 ++++++++++++++++++++++++++++-
 drivers/media/tuners/mxl5007t.h             |  7 ++++
 drivers/media/usb/au0828/au0828-dvb.c       |  1 +
 drivers/media/usb/dvb-usb-v2/af9015.c       |  2 +-
 drivers/media/usb/dvb-usb-v2/af9035.c       | 22 ++++++++++--
 drivers/media/usb/dvb-usb/dib0700_devices.c |  1 +
 6 files changed, 85 insertions(+), 4 deletions(-)

-- 
1.7.11.7

[PATCH 1/5] mxl5007t: fix buggy register read

[Antti Palosaari]

Chip uses WRITE + STOP + READ + STOP sequence for I2C register read.
Driver was using REPEATED START condition which makes it failing if
I2C adapter was implemented correctly.

Add use_broken_read_reg_intentionally option to keep old buggy
implantation as there is buggy I2C adapter implementation relying
that bug...

Signed-off-by: Antti Palosaari <crope@iki.fi>
---
 drivers/media/tuners/mxl5007t.c             | 56 ++++++++++++++++++++++++++++-
 drivers/media/tuners/mxl5007t.h             |  7 ++++
 drivers/media/usb/au0828/au0828-dvb.c       |  1 +
 drivers/media/usb/dvb-usb-v2/af9015.c       |  1 +
 drivers/media/usb/dvb-usb-v2/af9035.c       |  2 ++
 drivers/media/usb/dvb-usb/dib0700_devices.c |  1 +
 6 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/drivers/media/tuners/mxl5007t.c b/drivers/media/tuners/mxl5007t.c
index 69e453e..36605ea 100644
--- a/drivers/media/tuners/mxl5007t.c
+++ b/drivers/media/tuners/mxl5007t.c
@@ -156,6 +156,7 @@ struct mxl5007t_state {
 	struct tuner_i2c_props i2c_props;
 
 	struct mutex lock;
+	struct mutex i2c_lock;
 
 	struct mxl5007t_config *config;
 
@@ -490,7 +491,8 @@ static int mxl5007t_write_regs(struct mxl5007t_state *state,
 	return ret;
 }
 
-static int mxl5007t_read_reg(struct mxl5007t_state *state, u8 reg, u8 *val)
+/* XXX: bad implementation for avoiding regressions */
+static int mxl5007t_read_reg_bad(struct mxl5007t_state *state, u8 reg, u8 *val)
 {
 	u8 buf[2] = { 0xfb, reg };
 	struct i2c_msg msg[] = {
@@ -509,6 +511,57 @@ static int mxl5007t_read_reg(struct mxl5007t_state *state, u8 reg, u8 *val)
 	return 0;
 }
 
+/* chip uses I2C write + read with STOP condition */
+static int mxl5007t_read_reg_good(struct mxl5007t_state *state, u8 reg, u8 *val)
+{
+	int ret;
+	u8 buf[2] = { 0xfb, reg };
+	struct i2c_msg msg1[] = {
+		{
+			.addr = state->i2c_props.addr,
+			.flags = 0,
+			.buf = buf,
+			.len = 2,
+		},
+	};
+	struct i2c_msg msg2[] = {
+		{
+			.addr = state->i2c_props.addr,
+			.flags = I2C_M_RD,
+			.buf = val,
+			.len = 1,
+		},
+	};
+
+	mutex_lock(&state->i2c_lock);
+
+	ret = i2c_transfer(state->i2c_props.adap, msg1, 1);
+	if (ret != 1) {
+		mxl_err("failed!");
+		ret = -EREMOTEIO;
+		goto fail;
+	}
+
+	ret = i2c_transfer(state->i2c_props.adap, msg2, 1);
+	if (ret != 1) {
+		mxl_err("failed!");
+		ret = -EREMOTEIO;
+		goto fail;
+	}
+fail:
+	mutex_unlock(&state->i2c_lock);
+
+	return ret;
+}
+
+static int mxl5007t_read_reg(struct mxl5007t_state *state, u8 reg, u8 *val)
+{
+	if (state->config->use_broken_read_reg_intentionally)
+		return mxl5007t_read_reg_bad(state, reg, val);
+	else
+		return mxl5007t_read_reg_good(state, reg, val);
+}
+
 static int mxl5007t_soft_reset(struct mxl5007t_state *state)
 {
 	u8 d = 0xff;
@@ -883,6 +936,7 @@ struct dvb_frontend *mxl5007t_attach(struct dvb_frontend *fe,
 		state->config = cfg;
 
 		mutex_init(&state->lock);
+		mutex_init(&state->i2c_lock);
 
 		if (fe->ops.i2c_gate_ctrl)
 			fe->ops.i2c_gate_ctrl(fe, 1);
diff --git a/drivers/media/tuners/mxl5007t.h b/drivers/media/tuners/mxl5007t.h
index 37b0942..728779b 100644
--- a/drivers/media/tuners/mxl5007t.h
+++ b/drivers/media/tuners/mxl5007t.h
@@ -75,6 +75,13 @@ struct mxl5007t_config {
 	unsigned int invert_if:1;
 	unsigned int loop_thru_enable:1;
 	unsigned int clk_out_enable:1;
+	/*
+	 * XXX: This should not be used. Defined for avoiding regressions.
+	 * Remove use of that option after device is tested to be working with
+	 * correct implementation.
+	 * MxL5007t does not use I2C REPEATED START condition for register read.
+	 */
+	unsigned int use_broken_read_reg_intentionally:1;
 };
 
 #if IS_ENABLED(CONFIG_MEDIA_TUNER_MXL5007T)
diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c
index 9a6f156..7d32a0c 100644
--- a/drivers/media/usb/au0828/au0828-dvb.c
+++ b/drivers/media/usb/au0828/au0828-dvb.c
@@ -95,6 +95,7 @@ static struct xc5000_config hauppauge_xc5000c_config = {
 static struct mxl5007t_config mxl5007t_hvr950q_config = {
 	.xtal_freq_hz = MxL_XTAL_24_MHZ,
 	.if_freq_hz = MxL_IF_6_MHZ,
+	.use_broken_read_reg_intentionally = 1,
 };
 
 static struct tda18271_config hauppauge_woodbury_tunerconfig = {
diff --git a/drivers/media/usb/dvb-usb-v2/af9015.c b/drivers/media/usb/dvb-usb-v2/af9015.c
index d556042..b943304 100644
--- a/drivers/media/usb/dvb-usb-v2/af9015.c
+++ b/drivers/media/usb/dvb-usb-v2/af9015.c
@@ -931,6 +931,7 @@ static struct tda18218_config af9015_tda18218_config = {
 static struct mxl5007t_config af9015_mxl5007t_config = {
 	.xtal_freq_hz = MxL_XTAL_24_MHZ,
 	.if_freq_hz = MxL_IF_4_57_MHZ,
+	.use_broken_read_reg_intentionally = 1,
 };
 
 static int af9015_tuner_attach(struct dvb_usb_adapter *adap)
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index b638fc1..b7e7135 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -947,6 +947,7 @@ static struct mxl5007t_config af9035_mxl5007t_config[] = {
 		.loop_thru_enable = 0,
 		.clk_out_enable = 0,
 		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
+		.use_broken_read_reg_intentionally = 1,
 	}, {
 		.xtal_freq_hz = MxL_XTAL_24_MHZ,
 		.if_freq_hz = MxL_IF_4_57_MHZ,
@@ -954,6 +955,7 @@ static struct mxl5007t_config af9035_mxl5007t_config[] = {
 		.loop_thru_enable = 1,
 		.clk_out_enable = 1,
 		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
+		.use_broken_read_reg_intentionally = 1,
 	}
 };
 
diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
index 1179842..c58c6ea 100644
--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
@@ -3433,6 +3433,7 @@ static struct mxl5007t_config hcw_mxl5007t_config = {
 	.xtal_freq_hz = MxL_XTAL_25_MHZ,
 	.if_freq_hz = MxL_IF_6_MHZ,
 	.invert_if = 1,
+	.use_broken_read_reg_intentionally = 1,
 };
 
 /* TIGER-ATSC map:
-- 
1.7.11.7

Re: [PATCH 1/5] mxl5007t: fix buggy register read

[Devin Heitmueller]

On Tue, Apr 9, 2013 at 7:53 PM, Antti Palosaari <crope@iki.fi> wrote:
> Chip uses WRITE + STOP + READ + STOP sequence for I2C register read.
> Driver was using REPEATED START condition which makes it failing if
> I2C adapter was implemented correctly.
>
> Add use_broken_read_reg_intentionally option to keep old buggy
> implantation as there is buggy I2C adapter implementation relying
> that bug...
>
> Signed-off-by: Antti Palosaari <crope@iki.fi>

Hi Antti,

The existing code actually looks fine.  This is actually how most
devices do register reads.

Further, it *should* be done in a single call to i2c_transfer() or
else you won't hold the lock and you will create a race condition.

This sounds more like it's a bug in the i2c master rather than the 5007 driver.

Do you have i2c bus traces that clearly show that this was the cause
of the issue?  If we need to define something as "broken" behavior, at
first glance it looks like the way *you're* proposing is the broken
behavior - presumably to work around a bug in the i2c master not
properly supporting repeated start.

Also, any reason you didn't put Mike into the cc: for this (since he
owns the driver)?

Devin

-- 
Devin J. Heitmueller - Kernel Labs
http://www.kernellabs.com

Re: [PATCH 1/5] mxl5007t: fix buggy register read

[Antti Palosaari]

On 04/10/2013 03:20 AM, Devin Heitmueller wrote:
> On Tue, Apr 9, 2013 at 7:53 PM, Antti Palosaari <crope@iki.fi> wrote:
>> Chip uses WRITE + STOP + READ + STOP sequence for I2C register read.
>> Driver was using REPEATED START condition which makes it failing if
>> I2C adapter was implemented correctly.
>>
>> Add use_broken_read_reg_intentionally option to keep old buggy
>> implantation as there is buggy I2C adapter implementation relying
>> that bug...
>>
>> Signed-off-by: Antti Palosaari <crope@iki.fi>
>
> Hi Antti,
>
> The existing code actually looks fine.  This is actually how most
> devices do register reads.

Yes, most devices do that, but not all!
MxL5007t has a special register for setting register to read. Look the 
code and you could see it easily. It was over year ago I fixed it...

> Further, it *should* be done in a single call to i2c_transfer() or
> else you won't hold the lock and you will create a race condition.

No. That's why I added new lock. Single i2c_transfer() means all 
messages are done using repeated START condition.

> This sounds more like it's a bug in the i2c master rather than the 5007 driver.

No.

> Do you have i2c bus traces that clearly show that this was the cause
> of the issue?  If we need to define something as "broken" behavior, at
> first glance it looks like the way *you're* proposing is the broken
> behavior - presumably to work around a bug in the i2c master not
> properly supporting repeated start.

Yes and no. I made own Cypress FX2 firmware and saw initially that issue 
then. Also, as you could see looking the following patches I ensured / 
confirmed issue using two different I2C adapters (AF9015 and AF9035). So 
I have totally 3 working adapters to prove it (which are broken without 
that patch)!

> Also, any reason you didn't put Mike into the cc: for this (since he
> owns the driver)?

you added :)

> Devin

regards
Antti

-- 
http://palosaari.fi/

Re: [PATCH 1/5] mxl5007t: fix buggy register read

[Devin Heitmueller]

On Tue, Apr 9, 2013 at 8:45 PM, Antti Palosaari <crope@iki.fi> wrote:
> Yes, most devices do that, but not all!
> MxL5007t has a special register for setting register to read. Look the code
> and you could see it easily. It was over year ago I fixed it...

That sounds kind of insane, but I haven't looked at the datasheets and
if Mike Ack'd it, then so be it.

>> Further, it *should* be done in a single call to i2c_transfer() or
>> else you won't hold the lock and you will create a race condition.
>
>
> No. That's why I added new lock. Single i2c_transfer() means all messages
> are done using repeated START condition.

No need to add a new lock to your bridge driver.  You can just use
__i2c_transfer() and i2c_lock_adapter(state->i2c).  That's what
they're doing in the drx-k driver for just such cases where they need
the lock to span multiple calls to i2c_transfer().

>
>> This sounds more like it's a bug in the i2c master rather than the 5007
>> driver.
>
>
> No.
>
>
>> Do you have i2c bus traces that clearly show that this was the cause
>> of the issue?  If we need to define something as "broken" behavior, at
>> first glance it looks like the way *you're* proposing is the broken
>> behavior - presumably to work around a bug in the i2c master not
>> properly supporting repeated start.
>
>
> Yes and no. I made own Cypress FX2 firmware and saw initially that issue
> then. Also, as you could see looking the following patches I ensured /
> confirmed issue using two different I2C adapters (AF9015 and AF9035). So I
> have totally 3 working adapters to prove it (which are broken without that
> patch)!

The whole think sounds screwed up, and without a real i2c trace of the
bus we'll never know.  That said, I'm not really in a position to
dispute it given I don't have any devices with the chip in question.

I would suggest renaming the configuration value to something less
controversial, such as "use_repeated_start_for_reads" and avoid using
terms like broken where it's not clear that's actually the case.

Devin

-- 
Devin J. Heitmueller - Kernel Labs
http://www.kernellabs.com

Re: [PATCH 1/5] mxl5007t: fix buggy register read

[Antti Palosaari]

On 04/10/2013 04:38 AM, Devin Heitmueller wrote:
> On Tue, Apr 9, 2013 at 8:45 PM, Antti Palosaari <crope@iki.fi> wrote:
>> Yes, most devices do that, but not all!
>> MxL5007t has a special register for setting register to read. Look the code
>> and you could see it easily. It was over year ago I fixed it...
>
> That sounds kind of insane, but I haven't looked at the datasheets and
> if Mike Ack'd it, then so be it.
>
>>> Further, it *should* be done in a single call to i2c_transfer() or
>>> else you won't hold the lock and you will create a race condition.
>>
>>
>> No. That's why I added new lock. Single i2c_transfer() means all messages
>> are done using repeated START condition.
>
> No need to add a new lock to your bridge driver.  You can just use
> __i2c_transfer() and i2c_lock_adapter(state->i2c).  That's what
> they're doing in the drx-k driver for just such cases where they need
> the lock to span multiple calls to i2c_transfer().

Thanks for the tip. It could be cleaner way to do it like that and 
likely I will change it after quick check.

I don't need to lock whole adapter, only unsure there is none changing 
"register to read" value (stored to special register) before I read it. 
So I have to ensure I could do normal writes without a unneeded waiting 
- even those happens just between that two phase read.

>>> This sounds more like it's a bug in the i2c master rather than the 5007
>>> driver.
>>
>>
>> No.
>>
>>
>>> Do you have i2c bus traces that clearly show that this was the cause
>>> of the issue?  If we need to define something as "broken" behavior, at
>>> first glance it looks like the way *you're* proposing is the broken
>>> behavior - presumably to work around a bug in the i2c master not
>>> properly supporting repeated start.
>>
>>
>> Yes and no. I made own Cypress FX2 firmware and saw initially that issue
>> then. Also, as you could see looking the following patches I ensured /
>> confirmed issue using two different I2C adapters (AF9015 and AF9035). So I
>> have totally 3 working adapters to prove it (which are broken without that
>> patch)!
>
> The whole think sounds screwed up, and without a real i2c trace of the
> bus we'll never know.  That said, I'm not really in a position to
> dispute it given I don't have any devices with the chip in question.
>
> I would suggest renaming the configuration value to something less
> controversial, such as "use_repeated_start_for_reads" and avoid using
> terms like broken where it's not clear that's actually the case.

It is 100% clearly broken :-] And MxL5007t will not reply correct value. 
It returns 0x3f for chip ID. I didn't tested it, but quite good theory 
is that there is some other than chip id reg to set special register 
when that happens.

I have tested it with 3 devices and there is two devices to left which 
are using that new parameter.

regards
Antti

-- 
http://palosaari.fi/

[PATCH 2/5] af9015: fix I2C adapter read (without REPEATED STOP)

[Antti Palosaari]

Signed-off-by: Antti Palosaari <crope@iki.fi>
---
 drivers/media/usb/dvb-usb-v2/af9015.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/af9015.c b/drivers/media/usb/dvb-usb-v2/af9015.c
index b943304..a523a25 100644
--- a/drivers/media/usb/dvb-usb-v2/af9015.c
+++ b/drivers/media/usb/dvb-usb-v2/af9015.c
@@ -282,7 +282,7 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate.
 			req.i2c_addr = msg[i].addr;
 			req.addr = addr;
 			req.mbox = mbox;
-			req.addr_len = addr_len;
+			req.addr_len = 0;
 			req.data_len = msg[i].len;
 			req.data = &msg[i].buf[0];
 			ret = af9015_ctrl_msg(d, &req);
-- 
1.7.11.7

[PATCH 3/5] af9015: do not use buggy mxl5007t read reg

[Antti Palosaari]

That backward compatibility hack option is no longer needed.

Signed-off-by: Antti Palosaari <crope@iki.fi>
---
 drivers/media/usb/dvb-usb-v2/af9015.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/af9015.c b/drivers/media/usb/dvb-usb-v2/af9015.c
index a523a25..4d2587a 100644
--- a/drivers/media/usb/dvb-usb-v2/af9015.c
+++ b/drivers/media/usb/dvb-usb-v2/af9015.c
@@ -931,7 +931,6 @@ static struct tda18218_config af9015_tda18218_config = {
 static struct mxl5007t_config af9015_mxl5007t_config = {
 	.xtal_freq_hz = MxL_XTAL_24_MHZ,
 	.if_freq_hz = MxL_IF_4_57_MHZ,
-	.use_broken_read_reg_intentionally = 1,
 };
 
 static int af9015_tuner_attach(struct dvb_usb_adapter *adap)
-- 
1.7.11.7

[PATCH 4/5] af9035: implement I2C adapter read operation

[Antti Palosaari]

Signed-off-by: Antti Palosaari <crope@iki.fi>
---
 drivers/media/usb/dvb-usb-v2/af9035.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index b7e7135..6c039eb 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -268,11 +268,29 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
 			memcpy(&buf[5], msg[0].buf, msg[0].len);
 			ret = af9035_ctrl_msg(d, &req);
 		}
+	} else if (num == 1 && (msg[0].flags & I2C_M_RD)) {
+		if (msg[0].len > 40) {
+			/* TODO: correct limits > 40 */
+			ret = -EOPNOTSUPP;
+		} else {
+			/* I2C */
+			u8 buf[5];
+			struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
+					buf, msg[0].len, msg[0].buf };
+			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
+			buf[0] = msg[0].len;
+			buf[1] = msg[0].addr << 1;
+			buf[2] = 0x00; /* reg addr len */
+			buf[3] = 0x00; /* reg addr MSB */
+			buf[4] = 0x00; /* reg addr LSB */
+			ret = af9035_ctrl_msg(d, &req);
+		}
 	} else {
 		/*
-		 * We support only two kind of I2C transactions:
-		 * 1) 1 x read + 1 x write
+		 * We support only three kind of I2C transactions:
+		 * 1) 1 x read + 1 x write (repeated start)
 		 * 2) 1 x write
+		 * 3) 1 x read
 		 */
 		ret = -EOPNOTSUPP;
 	}
-- 
1.7.11.7

[PATCH 5/5] af9035: do not use buggy mxl5007t read reg

[Antti Palosaari]

That backward compatibility hack option is no longer needed.

Signed-off-by: Antti Palosaari <crope@iki.fi>
---
 drivers/media/usb/dvb-usb-v2/af9035.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 6c039eb..cfcf79b 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -965,7 +965,6 @@ static struct mxl5007t_config af9035_mxl5007t_config[] = {
 		.loop_thru_enable = 0,
 		.clk_out_enable = 0,
 		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
-		.use_broken_read_reg_intentionally = 1,
 	}, {
 		.xtal_freq_hz = MxL_XTAL_24_MHZ,
 		.if_freq_hz = MxL_IF_4_57_MHZ,
@@ -973,7 +972,6 @@ static struct mxl5007t_config af9035_mxl5007t_config[] = {
 		.loop_thru_enable = 1,
 		.clk_out_enable = 1,
 		.clk_out_amp = MxL_CLKOUT_AMP_0_94V,
-		.use_broken_read_reg_intentionally = 1,
 	}
 };
 
-- 
1.7.11.7