[PATCH 0/3] media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors.

[PATCH 0/3] media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors.

[Shuah Khan]

This patch series fixes null pointer dereference boot failure as well as
compile errors.

Shuah Khan (3):
  media/drx39xyj: fix pr_dbg undefined compile errors when DJH_DEBUG is
    defined
  media/drx39xyj: remove return that prevents DJH_DEBUG code to run
  media/drx39xyj: fix boot failure due to null pointer dereference

 drivers/media/dvb-frontends/drx39xyj/drxj.c | 31 ++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 12 deletions(-)

-- 
1.8.3.2

[PATCH 1/3] media/drx39xyj: fix pr_dbg undefined compile errors when DJH_DEBUG is defined

[Shuah Khan]

drxj.c fails to compile with the following errors when DJH_DEBUG
is defined.

drivers/media/dvb-frontends/drx39xyj/drxj.c:1567:2: error: implicit declaration of function ‘pr_dbg’ [-Werror=implicit-function-declaration]
  pr_dbg("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
  ^

Signed-off-by: Shuah Khan <shuah.kh@samsung.com>
---
 drivers/media/dvb-frontends/drx39xyj/drxj.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.c b/drivers/media/dvb-frontends/drx39xyj/drxj.c
index ed68c52..a78af4e 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drxj.c
+++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c
@@ -1562,7 +1562,7 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
 		 .flags = I2C_M_RD, .buf = r_data, .len = r_count},
 	};
 
-	pr_dbg("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
+	pr_debug("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
 	       w_dev_addr->i2c_addr, state->i2c, w_count, r_count);
 
 	if (i2c_transfer(state->i2c, msg, 2) != 2) {
@@ -20640,7 +20640,7 @@ static int drx39xxj_set_frontend(struct dvb_frontend *fe)
 	for (i = 0; i < 2000; i++) {
 		fe_status_t status;
 		drx39xxj_read_status(fe, &status);
-		pr_dbg("i=%d status=%d\n", i, status);
+		pr_debug("i=%d status=%d\n", i, status);
 		msleep(100);
 		i += 100;
 	}
@@ -20663,7 +20663,7 @@ static int drx39xxj_i2c_gate_ctrl(struct dvb_frontend *fe, int enable)
 	int result;
 
 #ifdef DJH_DEBUG
-	pr_dbg("i2c gate call: enable=%d state=%d\n", enable,
+	pr_debug("i2c gate call: enable=%d state=%d\n", enable,
 	       state->i2c_gate_open);
 #endif
 
-- 
1.8.3.2

[PATCH 2/3] media/drx39xyj: remove return that prevents DJH_DEBUG code to run

[Shuah Khan]

drxbsp_i2c_write_read() has return that prevents DJH_DEBUG code to run.
Remove it.

Signed-off-by: Shuah Khan <shuah.kh@samsung.com>
---
 drivers/media/dvb-frontends/drx39xyj/drxj.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.c b/drivers/media/dvb-frontends/drx39xyj/drxj.c
index a78af4e..72c541a 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drxj.c
+++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c
@@ -1550,8 +1550,6 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
 		return -EREMOTEIO;
 	}
 
-	return 0;
-
 #ifdef DJH_DEBUG
 	struct drx39xxj_state *state = w_dev_addr->user_data;
 
-- 
1.8.3.2

[PATCH 3/3] media/drx39xyj: fix boot failure due to null pointer dereference

[Shuah Khan]

DJH_DEBUG only code path in drxbsp_i2c_write_read() dereferences
w_dev_addr and subsequently w_dev_addr->user_data->i2c which results
in failure during boot. This patch fixes the null pointer derefence
bug as well as the following compile errors:

  LD      arch/x86/built-in.o
  CC      drivers/media/dvb-frontends/drx39xyj/drxj.o
drivers/media/dvb-frontends/drx39xyj/drxj.c: In function ‘drxbsp_i2c_write_read’:
drivers/media/dvb-frontends/drx39xyj/drxj.c:1558:25: error: redeclaration of ‘state’ with no linkage
  struct drx39xxj_state *state = w_dev_addr->user_data;
                         ^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1512:25: note: previous declaration of ‘state’ was here
  struct drx39xxj_state *state;
                         ^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1558:2: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
  struct drx39xxj_state *state = w_dev_addr->user_data;
  ^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1560:17: error: redeclaration of ‘msg’ with no linkage
  struct i2c_msg msg[2] = {
                 ^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1513:17: note: previous declaration of ‘msg’ was here
  struct i2c_msg msg[2];
                 ^

Signed-off-by: Shuah Khan <shuah.kh@samsung.com>
---
 drivers/media/dvb-frontends/drx39xyj/drxj.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.c b/drivers/media/dvb-frontends/drx39xyj/drxj.c
index 72c541a..585d891 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drxj.c
+++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c
@@ -1551,14 +1551,23 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
 	}
 
 #ifdef DJH_DEBUG
-	struct drx39xxj_state *state = w_dev_addr->user_data;
+	if (w_dev_addr == NULL || r_dev_addr == NULL)
+		return 0;
 
-	struct i2c_msg msg[2] = {
-		{.addr = w_dev_addr->i2c_addr,
-		 .flags = 0, .buf = wData, .len = w_count},
-		{.addr = r_dev_addr->i2c_addr,
-		 .flags = I2C_M_RD, .buf = r_data, .len = r_count},
-	};
+	state = w_dev_addr->user_data;
+
+	if (state->i2c == NULL)
+		return 0;
+
+	msg[0].addr = w_dev_addr->i2c_addr;
+	msg[0].flags = 0;
+	msg[0].buf = wData;
+	msg[0].len = w_count;
+	msg[1].addr = r_dev_addr->i2c_addr;
+	msg[1].flags = I2C_M_RD;
+	msg[1].buf = r_data;
+	msg[1].len = r_count;
+	num_msgs = 2;
 
 	pr_debug("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
 	       w_dev_addr->i2c_addr, state->i2c, w_count, r_count);
-- 
1.8.3.2

Re: [PATCH 0/3] media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors.

[Devin Heitmueller]

On Fri, Feb 28, 2014 at 4:22 PM, Shuah Khan <shuah.kh@samsung.com> wrote:
> This patch series fixes null pointer dereference boot failure as well as
> compile errors.

Seems kind of strange that I wasn't on the CC for this, since I was
the original author of all that code (in fact, DJH are my initials).

Mauro, did you strip off my authorship when you pulled the patches from my tree?

The patches themselves look sane, and I will send a formal Acked-by
once I can get in front of a real computer.

Devin

-- 
Devin J. Heitmueller - Kernel Labs
http://www.kernellabs.com

Re: [PATCH 0/3] media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors.

[Shuah Khan]

On 02/28/2014 05:13 PM, Devin Heitmueller wrote:
> Seems kind of strange that I wasn't on the CC for this, since I was the
> original author of all that code (in fact, DJH are my initials).
>
> Mauro, did you strip off my authorship when you pulled the patches from
> my tree?
>
> The patches themselves look sane, and I will send a formal Acked-by once
> I can get in front of a real computer.
>
> Devin

Thanks for the ack. I will include you on the cc for future patches. I 
am working in Mauro's experimental git and probably that explains why 
get_maintainer.pl just showed linux-media and Mauro.

-- Shuah

>
> On Feb 28, 2014 4:23 PM, "Shuah Khan" <shuah.kh@samsung.com
> <mailto:shuah.kh@samsung.com>> wrote:
>
>     This patch series fixes null pointer dereference boot failure as well as
>     compile errors.
>
>     Shuah Khan (3):
>        media/drx39xyj: fix pr_dbg undefined compile errors when DJH_DEBUG is
>          defined
>        media/drx39xyj: remove return that prevents DJH_DEBUG code to run
>        media/drx39xyj: fix boot failure due to null pointer dereference
>
>       drivers/media/dvb-frontends/drx39xyj/drxj.c | 31
>     ++++++++++++++++++-----------
>       1 file changed, 19 insertions(+), 12 deletions(-)
>
>     --
>     1.8.3.2
>
>     --
>     To unsubscribe from this list: send the line "unsubscribe
>     linux-media" in
>     the body of a message to majordomo@vger.kernel.org
>     <mailto:majordomo@vger.kernel.org>
>     More majordomo info at http://vger.kernel.org/majordomo-info.html
>


-- 
Shuah Khan
Senior Linux Kernel Developer - Open Source Group
Samsung Research America(Silicon Valley)
shuah.kh@samsung.com | (970) 672-0658

Re: [PATCH 0/3] media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors.

[Mauro Carvalho Chehab]

Hi Devin,

Em Fri, 28 Feb 2014 19:13:16 -0500
Devin Heitmueller <dheitmueller@kernellabs.com> escreveu:

> Seems kind of strange that I wasn't on the CC for this, since I was the
> original author of all that code (in fact, DJH are my initials).
> 
> Mauro, did you strip off my authorship when you pulled the patches from my
> tree?

Thanks for warning me about that!

Not sure what happened there. The original branch were added back in 2012,
with the sole reason to provide a way for Patrick Dickey to catch a few
patches I made on that time with some CodingStyle fixes:
	http://git.linuxtv.org/mchehab/experimental.git/shortlog/refs/heads/drx-j

There, your name was there as an extra weird "Committer" tag on those changesets:
	http://git.linuxtv.org/mchehab/experimental.git/commit/24d5ed7b19cc19f807264d7d4d56ab48e5cab230
	http://git.linuxtv.org/mchehab/experimental.git/commit/0440897f72b9cf82b8f576fae292b0567ad88239

The second one also contained a "Tag: tip" on it. So, I suspect that
something wrong happened when I imported it (either from your tree or
from some email sent by you or by Patrick). Probably, some broken
hg-import scripting.

Anyway, I rebased my tree, fixing those issues, at:
	http://git.linuxtv.org/mchehab/experimental.git/shortlog/refs/heads/drx-j-v3

I also added a credit at the first patch for Patrick's fixes that
I suspect it was merged somehow there, based on the comments he
posted at the mailing list when he sent his 25-patches series:
	https://lwn.net/Articles/467301/

Please let me know if you find any other issues on it. Anyway, I'll post
the patches from my experimental branch at the ML before merging them
upstream, in order to get a proper review.

Before that happen, however, I need to fix a serious bug that is
preventing to watch TV with this frontend, that it is there since the
first patch.

To be sure that this is a driver issue, I tested the driver on
another OS using the original PCTV driver, and it worked.

However, since the first working version of this driver, it
is randomly losing MPEG TS packets.

The bug is intermittent: every time it sets up VSB reception, it loses
different MPEG TS tables. Sometimes, not a single TS packet is received,
but, most of the time, it gets ~ 1/10 of the expected number of packets.

It behaves like letting a hardware PID filtering on some random state,
inspecting the traffic using dvbv5-zap at monitor mode shows just a
small set of the MPEG TS PIDs,  but I'm starting to suspect that it
could be due to something else, like an improper ISOC setting at em28xx
or due to some clock initialized with the wrong value.

I'm even tried to compare what's the original driver is doing with the
Linux one, but the original driver provided by PCTV was compiled using a
different firmware version, so it uses a different drxj_map.h.

I would need to get in hands the drxj_map.h used by PCTV, in order to be
able to properly see what initialization is being done by the PCTV driver
and see what sequence is missing.

I won't be merging this driver upstream while this bug is not fixed.

It would help a lot if I could get the original tree you worked with, as
maybe this bug might not be present there. In such case, then the bug is
likely at em28xx side.

Do you still have a copy of your old hg tree? Do you have some contact at
PCTV that could help me either getting a binary driver using the same
version as the one you used here, or getting me the newer drxj_map.h
file?

Thanks,
Mauro

> 
> The patches themselves look sane, and I will send a formal Acked-by once I
> can get in front of a real computer.
> 
> Devin
> On Feb 28, 2014 4:23 PM, "Shuah Khan" <shuah.kh@samsung.com> wrote:
> 
> > This patch series fixes null pointer dereference boot failure as well as
> > compile errors.
> >
> > Shuah Khan (3):
> >   media/drx39xyj: fix pr_dbg undefined compile errors when DJH_DEBUG is
> >     defined
> >   media/drx39xyj: remove return that prevents DJH_DEBUG code to run
> >   media/drx39xyj: fix boot failure due to null pointer dereference
> >
> >  drivers/media/dvb-frontends/drx39xyj/drxj.c | 31
> > ++++++++++++++++++-----------
> >  1 file changed, 19 insertions(+), 12 deletions(-)
> >
> > --
> > 1.8.3.2
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-media" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> >


-- 

Cheers,
Mauro

Re: [PATCH 0/3] media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors.

[Mauro Carvalho Chehab]

Em Sat, 01 Mar 2014 07:57:42 -0300
Mauro Carvalho Chehab <m.chehab@samsung.com> escreveu:

> Hi Devin,
> 
> Em Fri, 28 Feb 2014 19:13:16 -0500
> Devin Heitmueller <dheitmueller@kernellabs.com> escreveu:
> 
> > Seems kind of strange that I wasn't on the CC for this, since I was the
> > original author of all that code (in fact, DJH are my initials).
> > 
> > Mauro, did you strip off my authorship when you pulled the patches from my
> > tree?
> 
> Thanks for warning me about that!
> 
> Not sure what happened there. The original branch were added back in 2012,
> with the sole reason to provide a way for Patrick Dickey to catch a few
> patches I made on that time with some CodingStyle fixes:
> 	http://git.linuxtv.org/mchehab/experimental.git/shortlog/refs/heads/drx-j
> 
> There, your name was there as an extra weird "Committer" tag on those changesets:
> 	http://git.linuxtv.org/mchehab/experimental.git/commit/24d5ed7b19cc19f807264d7d4d56ab48e5cab230
> 	http://git.linuxtv.org/mchehab/experimental.git/commit/0440897f72b9cf82b8f576fae292b0567ad88239
> 
> The second one also contained a "Tag: tip" on it. So, I suspect that
> something wrong happened when I imported it (either from your tree or
> from some email sent by you or by Patrick). Probably, some broken
> hg-import scripting.
> 
> Anyway, I rebased my tree, fixing those issues, at:
> 	http://git.linuxtv.org/mchehab/experimental.git/shortlog/refs/heads/drx-j-v3
> 
> I also added a credit at the first patch for Patrick's fixes that
> I suspect it was merged somehow there, based on the comments he
> posted at the mailing list when he sent his 25-patches series:
> 	https://lwn.net/Articles/467301/
> 
> Please let me know if you find any other issues on it. Anyway, I'll post
> the patches from my experimental branch at the ML before merging them
> upstream, in order to get a proper review.
> 
> Before that happen, however, I need to fix a serious bug that is
> preventing to watch TV with this frontend, that it is there since the
> first patch.
> 
> To be sure that this is a driver issue, I tested the driver on
> another OS using the original PCTV driver, and it worked.
> 
> However, since the first working version of this driver, it
> is randomly losing MPEG TS packets.
> 
> The bug is intermittent: every time it sets up VSB reception, it loses
> different MPEG TS tables. Sometimes, not a single TS packet is received,
> but, most of the time, it gets ~ 1/10 of the expected number of packets.

Partially found and fixed it with this patch:
	http://git.linuxtv.org/mchehab/experimental.git/commitdiff/5cc6dca273e51494c17df5e488aaf223732edb38

After that, it properly receives data at the right rate (~19Mbps) as
generated by DTA-2111.

However, there are still some weird things happening there... While
the bit rate is ~ 19 Mbps, and adding a printk just before calling
dvb_dmx_swfilter() to print the rate is showing the right bitrate
(The signal generator shows it as 19.392.659 bps):

[86213.084891] em28xx_dvb_urb_data_copy: 19428.672 kbps
[86214.087737] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86215.090586] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86216.093433] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86217.096280] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86218.099126] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86219.101971] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86220.104814] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86221.107659] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86222.110519] em28xx_dvb_urb_data_copy: 19430.176 kbps
[86223.113351] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86224.116200] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86225.119047] em28xx_dvb_urb_data_copy: 19431.680 kbps

Using dvbv5-zap on monitor mode only shows about 6.3 Mbps:

 PID          FREQ         SPEED       TOTAL
05b6      1.33 p/s      2.0 Kbps        2 KB
06a5      4.57 p/s      6.7 Kbps       10 KB
07cf      4.40 p/s      6.5 Kbps        9 KB
0a93   1200.38 p/s   1763.1 Kbps     2651 KB
0f75      2.66 p/s      3.9 Kbps        5 KB
1743      5.49 p/s      8.1 Kbps       12 KB
18c4   1205.04 p/s   1769.9 Kbps     2661 KB
197a      4.65 p/s      6.8 Kbps       10 KB
1c15      4.99 p/s      7.3 Kbps       11 KB
1c68   1286.40 p/s   1889.4 Kbps     2841 KB
1d4b      4.32 p/s      6.3 Kbps        9 KB
1fb2      4.07 p/s      6.0 Kbps        8 KB
1fff      2.33 p/s      3.4 Kbps        5 KB
TOT    4319.15 p/s   6343.7 Kbps     9541 KB


Lock   (0x1f) Signal= 71.00% C/N= 0.42% UCB= 273 postBER= 0

It seems that most of the packets are without the 0x47 sync byte there.

In order to compare with another frontend, this is what it is seen
with WinTV Aero-A (model 72251, rev D3F0):


 PID          FREQ         SPEED       TOTAL
0000     15.87 p/s     23.3 Kbps       29 KB
0010      6.39 p/s      9.4 Kbps       11 KB
0011  11754.82 p/s  17264.9 Kbps    21617 KB
0014    312.27 p/s    458.6 Kbps      574 KB
0015    156.03 p/s    229.2 Kbps      286 KB
001f      1.70 p/s      2.5 Kbps        3 KB
0200    430.07 p/s    631.7 Kbps      790 KB
0630      6.39 p/s      9.4 Kbps       11 KB
1053      7.19 p/s     10.6 Kbps       13 KB
1054      2.40 p/s      3.5 Kbps        4 KB
1055      2.40 p/s      3.5 Kbps        4 KB
1056      1.70 p/s      2.5 Kbps        3 KB
112d      4.79 p/s      7.0 Kbps        8 KB
112e      1.60 p/s      2.3 Kbps        2 KB
112f      1.60 p/s      2.3 Kbps        2 KB
1ffb     14.97 p/s     22.0 Kbps       27 KB
1fff    159.43 p/s    234.2 Kbps      293 KB
TOT   12880.50 p/s  18918.2 Kbps    23688 KB


Lock   (0x1f) Signal= 71.43% C/N= 0.38% UCB= 250 postBER= 0

The net result is that it is impossible to watch TV with PCTV 80e,
as most of the MPEG TS packages got discarded, but it works fine with
WinTV Aero.


So, there's something causing packet corruption there at drx-j.

No sure yet how to fix it.

Regards,
-- 

Cheers,
Mauro