Re: AVerMedia HD Volar (A867) AF9035 + MXL5007T driver issues

[Jose Alberto Reguero <jareguero@telefonica.net>]

I have the problem with a avermedia twinstart.
07ca:0825
With first hardware revision the read works, but second hardware revision read don’t work.

Jose Alberto

El 09/04/2016 19:38, Alessandro Radicati <alessandro@radicati.net> escribió:
>
> On Sat, Apr 9, 2016 at 7:07 PM, Antti Palosaari <crope@iki.fi> wrote: 
> > 
> > 
> > On 04/09/2016 07:11 PM, Alessandro Radicati wrote: 
> >> 
> >> On Sat, Apr 9, 2016 at 4:25 PM, Antti Palosaari <crope@iki.fi> wrote: 
> >>> 
> >>> On 04/09/2016 11:13 AM, Alessandro Radicati wrote: 
> >>>> 
> >>>> 
> >>>> On Sat, Apr 9, 2016 at 4:17 AM, Antti Palosaari <crope@iki.fi> wrote: 
> >>>>> 
> >>>>> 
> >>>>> On 04/09/2016 04:52 AM, Alessandro Radicati wrote: 
> >>>>>> 
> >>>>>> 
> >>>>>> 
> >>>>>> On Sat, Apr 9, 2016 at 3:22 AM, Antti Palosaari <crope@iki.fi> wrote: 
> >>>>>>> 
> >>>>>>> 
> >>>>>>> 
> >>>>>>> Here is patches to test: 
> >>>>>>> http://git.linuxtv.org/anttip/media_tree.git/log/?h=af9035 
> >>>>>>> 
> >>>>>> 
> >>>>>> I've done this already in my testing, and it works for getting a 
> >>>>>> correct chip_id response, but only because it's avoiding the issue 
> >>>>>> with the write/read case in the af9035 driver.  Don't have an 
> >>>>>> af9015... perhaps there's a similar issue with that code or we are 
> >>>>>> dealing with two separate issues since af9035 never does a repeated 
> >>>>>> start? 
> >>>>> 
> >>>>> 
> >>>>> 
> >>>>> 
> >>>>> I am pretty sure mxl5007t requires stop between read and write. Usually 
> >>>>> chips are not caring too much if it is repeated start or not, whilst 
> >>>>> datasheets are often register read is S Wr S Rw P. 
> >>>>> 
> >>>>> Even af9035 i2c adapter implementation implements repeated start wrong, 
> >>>>> I 
> >>>> 
> >>>> 
> >>>> 
> >>>> Where does the assumption that CMD_I2C_RD should issue a repeated 
> >>>> start sequence come from?  From the datasheet?  Maybe it was never 
> >>>> intended as repeated start.  Perhaps if there is another stick  with 
> >>>> mxl5007t and a chip that does repeated start, we can put this to bed. 
> >>> 
> >>> 
> >>> 
> >>> Assumption was coming from it just does it as a single USB transaction. 
> >>> Datasheet says there is no repeated start. And kernel I2C API says all 
> >>> messages send using single i2c_transfer() should be send with repeated 
> >>> start, so now it is violating it, but that's not the biggest problem... 
> >>> 
> >> 
> >> Unfortunately there is no way around that problem, but at least it 
> >> means that you can reduce the whole function to just read and write 
> >> since at the I2C level nothing changes. 
> >> 
> >>>>> would not like to add anymore hacks there. It is currently ugly and 
> >>>>> complex 
> >>>> 
> >>>> 
> >>>> 
> >>>> Bugfix != hack.  Don't see how putting the register address in the 
> >>>> address fields is a hack (perhaps semantics around the fact that 0xFB 
> >>>> is not really part of the address?); this is the only and intended way 
> >>>> to use that command for write/read. 
> >>> 
> >>> 
> >>> 
> >>> I did bunch of testing and find it is really wrong. Dumped out registers 
> >>> from some tuner chips and those seems to be mostly off by one. 
> >>> 
> >>> I think that skeleton is correct way (and it ends about same you did) 
> >>> if (msg[0].len == 0) // probe message, payload 0 
> >>>    buf[0] = msg[0].len; 
> >>>    buf[1] = msg[0].addr << 1; 
> >>>    buf[2] = 0x00; /* reg addr len */ 
> >>>    buf[3] = 0x00; /* reg addr MSB */ 
> >>>    buf[4] = 0x00; /* reg addr LSB */ 
> >>> else if (msg[0].len == 1) 
> >>>    buf[0] = msg[0].len; 
> >>>    buf[1] = msg[0].addr << 1; 
> >>>    buf[2] = 1; /* reg addr len */ 
> >>>    buf[3] = 0x00; /* reg addr MSB */ 
> >>>    buf[4] = msg[0].buf[0]; /* reg addr LSB */ 
> >>> else if (msg[0].len == 2) 
> >>>    buf[0] = msg[0].len; 
> >>>    buf[1] = msg[0].addr << 1; 
> >>>    buf[2] = 2; /* reg addr len */ 
> >>>    buf[3] = msg[0].buf[0]; /* reg addr MSB */ 
> >>>    buf[4] = msg[0].buf[1]; /* reg addr LSB */ 
> >>> else 
> >>>    buf[0] = msg[0].len; 
> >>>    buf[1] = msg[0].addr << 1; 
> >>>    buf[2] = 2; /* reg addr len */ 
> >>>    buf[3] = msg[0].buf[0]; /* reg addr MSB */ 
> >>>    buf[4] = msg[0].buf[1]; /* reg addr LSB */ 
> >>>    memcpy(&buf[5], msg[2].buf, msg[0].len - 2); 
> >>> 
> >> 
> >> Yes, this is the same, except I kept the original behavior when write 
> >> len > 2.  Hence with my patch the I2C bus would only see a read 
> >> transaction.  With the above, you would write the first two bytes and 
> >> ignore the rest, then read.  This may be worse than just doing a read 
> >> because if a future tuner reg read setup/address is > 2 then you may 
> >> get into a strange situation.  If that case needs to be addressed, 
> >> then might as well get rid of the single write/read usb transaction 
> >> and just support write or read. 
> > 
> > 
> > Last else branch should do it - but no idea if it works at all and none of 
> > tuners are using it and it is very unlikely there will never be. 
> > 
> > It is easy to test, but I suspect if you write S Wr[11 11 12 13] P S Rw P it 
> > will return value from register 13 on a case chip supports writing multiple 
> > registers using reg address auto-increment as usually. 
> > 
>
> Point is the USB read command ignores anything in the memcpy, so you 
> cant write more than 2 bytes.  Your example results in S Wr 11 11 P S 
> Rd xx P.  My patch left this with previous behavior so it would just 
> do S Rd xx P. 
>
> > 
> >>>>> as hell. I should be re-written totally in any case. Those tuner I2C 
> >>>>> adapters should be moved to demod. Demod has 1 I2C adapter. USB-bridge 
> >>>>> has 2 
> >>>>> adapters, one for each demod. 
> >>>>> 
> >>>> 
> >>>> Agreed that it can be refactored and improved.  Also to support n 
> >>>> transactions with a simple while loop and only issuing single writes 
> >>>> and reads.  Only downside would be increased USB traffic for 2 
> >>>> commands vs 1 - hence negligible. 
> >>> 
> >>> 
> >>> 
> >>> there is i2c_adapter_quirks nowadays for these adapters which could do 
> >>> only 
> >>> limited set of commands. 
> >>> include/linux/i2c.h 
> >> 
> >> 
> >> Perhaps just supporting write or read can be done with: 
> >> 
> >> struct i2c_adapter_quirks just_rw = { 
> >> .flags=0, 
> >> .max_num_msgs=1, 
> >> .max_write_len=40, 
> >> .max_read_len=40, 
> >> }; 
> >> 
> >> Otherwise as is: 
> >> 
> >> struct i2c_adapter_quirks as_is = { 
> >> .flags=I2C_AQ_COMB_WRITE_THEN_READ, 
> >> .max_num_msgs=2, 
> >> .max_write_len=40, 
> >> .max_read_len=40, 
> >> .max_comb_1st_msg_len=2, 
> >> .max_comb_2nd_msg_len=40, 
> >> }; 
> >> 
> >>> 
> >>> In my understanding that is how those chips are wired: 
> >>> +---------------+     +--------+ 
> >>> | I2C adapter-1 | --> | eeprom | 
> >>> +---------------+     +--------+ 
> >>> +---------------+     +---------+     +---------+ 
> >>> | I2C adapter-2 | --> | demod-1 | --> | tuner-1 | 
> >>> +---------------+     +---------+     +---------+ 
> >>> +---------------+     +---------+     +---------+ 
> >>> | I2C adapter-3 | --> | demod-2 | --> | tuner-2 | 
> >>> +---------------+     +---------+     +---------+ 
> >>> 
> >> 
> >> I just have one demod, but as a clue, the address you provided to set 
> >> the tuner I2C speed is named like this in the OEM linux driver: 
> >> 
> >> p_reg_lnk2ofdm_data_63_56 
> >> 
> >>>>> I have to find out af9015 datasheets and check how it is there. But I 
> >>>>> still 
> >>>>> remember one case where I implemented one FX2 firmware and that same 
> >>>>> issues 
> >>>>> raises there as well. 
> >>>>> 
> >>>>>>> After that both af9015+mxl5007t and af9035+mxl5007t started working. 
> >>>>>>> Earlier 
> >>>>>>> both were returning bogus values for chip id read. 
> >>>>>>> 
> >>>>>>> Also I am interested to known which kind of communication there is 
> >>>>>>> actually 
> >>>>>>> seen on I2C bus? 
> >>>>>> 
> >>>>>> 
> >>>>>> 
> >>>>>> 
> >>>>>> With this or the patch I proposed, you see exactly what you expect on 
> >>>>>> the I2C bus with repeated stops, as detailed in my previous mails. 
> >>>>> 
> >>>>> 
> >>>>> 
> >>>>> 
> >>>>> So it is good? 
> >>>>> 
> >>>> 
> >>>> Yes, I2C looks good. 
> >>>> 
> >>>>>>> If it starts working then have to find out way to fix it properly so 
> >>>>>>> that 
> >>>>>>> any earlier device didn't broke. 
> >>>>>>> 
> >>>>>> 
> >>>>>> I hope that by now I've made abundantly clear that my mxl5007t locks 
> >>>>>> up after *any* read.  It doesn't matter if we are reading the correct 
> >>>>>> register after any of the proposed patches. 
> >>>>> 
> >>>>> 
> >>>>> 
> >>>>> 
> >>>>> So it still locks up after any read after the chip id read? And does 
> >>>>> not 
> >>>>> work then? On my devices I can add multiple mxl5007t_get_chip_id() 
> >>>>> calls 
> >>>>> and 
> >>>>> all are returning correct values. 
> >>>>> 
> >>>>41920172 
> >>>> No, as mentioned before, it locks up at the end of any read command. 
> >>>> Including the chip_id.  The firmware is not aware of the issue and 
> >>>> wont complain until the next I2C transaction. 
> >>> 
> >>> 
> >>> 
> >>> Maybe I2C speed is too fast? 
> >>> I tested with my device it failed when I increased speed to 850kHz. 
> >>> 640kHz 
> >>> was working. I am not sure which is default speed and driver didn't 
> >>> change 
> >>> it. Just try to dropping it to 142kHz (0x12). 
> >>> Speed is calculated using that formula (0x12 in that case is register 
> >>> value): 
> >>> octave:36> 1000000 / (24.4 * 16 * 0x12) 
> >>> ans =  142.304189435337 
> >>> 
> >>> These are related registers: 
> >>> /* I2C master bus 2 clock speed 300k */ 
> >>> ret = af9035_wr_reg(d, 0x00f6a7, 0x07); 
> >>> /* I2C master bus 1,3 clock speed 300k */ 
> >>> ret = af9035_wr_reg(d, 0x00f103, 0x07); 
> >>> 
> >>> Just add some good place before tuner attach like 
> >>> af9035_frontend_attach(). 
> >>> 
> >> 
> >> Found that the default value is 0x00 and results in ~97KHz SCL 
> >> frequency.  Tested up to 0x3C which I measured to ~42KHz, but the bus 
> >> still locks up.  Doesn't seem like speed is the problem. 
> >> 
> >>>>> Could you test what happens if you use that CMD_GENERIC_I2C_WR + 
> >>>>> CMD_GENERIC_I2C_RD ? I suspect it is lower level I2C xfer than those 
> >>>>> CMD_I2C_RD + CMD_I2C_WR, which are likely somehow handled by demod 
> >>>>> core. 
> >>>>> 
> >>>> 
> >>>> I will test, but the issue is either electrical or with the state of 
> >>>> the mxl5007t.  I2C bus looks good from AF9035 side once the bug in the 
> >>>> above is patched. 
> >>> 
> >>> 
> >>> 
> >>> If dropping I2C speed does not help then I cannot imagine any other fix 
> >>> than 
> >>> adding mxl5007t driver option which disables problematic reads *or* add 
> >>> some 
> >>> hack to af9035 i2c adapter implementation which fakes required 
> >>> problematic 
> >>> commands ones that looks "good". 
> >>> 
> >> 
> >> Unless there is a specific state in which the mxl5007t must be in for 
> >> you to issue a read, I really don't know what else could be wrong. 
> >> Would be nice to know if this issue happens with other demods to 
> >> further justify the "no_probe" fix in the mxl5007t driver. 
> > 
> > 
> > For me it works even device is ~same. It could be just some hw issues, too 
> > noisy bus or like that. Maybe different PCB revision. 
> > 
> > My device ID is 07ca:0337, yours different. I think it is best add some 
> > quirk to af9035 i2c-adapter that it looks USB ID and returns fake values to 
> > mxl5007t driver in order to work-around issue. As thumb of rule all device 
> > specifics hacks should be added to interface driver leaving chip drivers 
> > hack free. So add some glue there and that's it. I cannot discover any 
> > better fix currently. 
> > 
>
> Indeed mine is 07ca:a867, will propose a patch. 
> -- 
> To unsubscribe from this list: send the line "unsubscribe linux-media" in 
> the body of a message to majordomo@vger.kernel.org 
> More majordomo info at  http://vger.kernel.org/majordomo-info.html