[PATCH v2 1/2] staging: media: av7110: fix corrupted BER reporting in sp8870

[PATCH v2 1/2] staging: media: av7110: fix corrupted BER reporting in sp8870

[Punnay Sharma]

In sp8870_read_ber(), the 14-bit Bit Error Rate (BER) is assembled by
reading two I2C registers: 0xC08 (lower 6 bits) and 0xC07 (upper 8 bits).

The current implementation masks the lower bits via `tmp = ret & 0x3F;`
but subsequently overwrites `tmp` entirely when processing the upper
bits using a direct assignment (`tmp = ret << 6;`). This logical error
causes the lower 6 bits of the BER hardware metric to be silently
discarded.

Fix this by using a bitwise OR (`tmp |= ret << 6;`) to correctly merge
the MSB and LSB payloads before returning the metric to the DVB core.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
---
 drivers/staging/media/av7110/sp8870.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
index 29fb4934c..77bebf2c7 100644
--- a/drivers/staging/media/av7110/sp8870.c
+++ b/drivers/staging/media/av7110/sp8870.c
@@ -401,7 +401,7 @@ static int sp8870_read_ber(struct dvb_frontend *fe, u32 *ber)
 	if (ret < 0)
 		return -EIO;
 
-	tmp = ret << 6;
+	tmp |= ret << 6;
 	if (tmp >= 0x3FFF0)
 		tmp = ~0;
 
-- 
2.55.0

[PATCH v2 2/2] staging: media: av7110: fix sp8870 initialization failure state

[Punnay Sharma]

The SP8870 DVB frontend driver prematurely flags the device as
initialized at the very beginning of the sp8870_init() routine, prior
to requesting the firmware (dvb-fe-sp8870.fw) and executing the I2C
upload sequence.

If request_firmware() times out or sp8870_firmware_upload() encounters
an I2C bus error, the function aborts and returns -EIO. However,
because `state->initialised` is already set to 1, all subsequent
invocations of `fe->ops.init()` by the DVB core will immediately return
0 (success) without attempting to load the firmware again. This leaves
the demodulator microcontroller halted and the frontend permanently dead
until the module is forcibly reloaded.

Relocate the `state->initialised = 1` assignment to the end of
sp8870_init(), ensuring the flag is only set after the firmware is
successfully uploaded and the system controller is actually restarted.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
---
 drivers/staging/media/av7110/sp8870.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
index 77bebf2c7..be62933ce 100644
--- a/drivers/staging/media/av7110/sp8870.c
+++ b/drivers/staging/media/av7110/sp8870.c
@@ -315,7 +315,6 @@ static int sp8870_init(struct dvb_frontend *fe)
 	sp8870_wake_up(state);
 	if (state->initialised)
 		return 0;
-	state->initialised = 1;
 
 	dprintk("initialising frontend...\n");
 
@@ -353,6 +352,8 @@ static int sp8870_init(struct dvb_frontend *fe)
 	sp8870_writereg(state, 0x0D00, 0x010);
 	sp8870_writereg(state, 0x0D01, 0x000);
 
+	state->initialised = 1;
+
 	return 0;
 }
 
-- 
2.55.0

Re: [PATCH v2 1/2] staging: media: av7110: fix corrupted BER reporting in sp8870

[Dan Carpenter]

On Sat, Aug 08, 2026 at 12:04:42AM +0530, Punnay Sharma wrote:
> In sp8870_read_ber(), the 14-bit Bit Error Rate (BER) is assembled by
> reading two I2C registers: 0xC08 (lower 6 bits) and 0xC07 (upper 8 bits).
> 
> The current implementation masks the lower bits via `tmp = ret & 0x3F;`
> but subsequently overwrites `tmp` entirely when processing the upper
> bits using a direct assignment (`tmp = ret << 6;`). This logical error
> causes the lower 6 bits of the BER hardware metric to be silently
> discarded.
> 
> Fix this by using a bitwise OR (`tmp |= ret << 6;`) to correctly merge
> the MSB and LSB payloads before returning the metric to the DVB core.

AI uses a lot of really unnecessary words to say something very simple.
It explains the obvious stuff in detail and ignores the important bits.
It should be something like:

  Checker tools complain that the "tmp = ret & 0x3F;" assignment is
  never used.  It's probably supposed to be ORed.  I don't have the
  hardware so this is untested.

> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

The fact that no one has complained in 21 years, probably means it's
not a real bug.  I generally ignore these ancient things.

> Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
> ---

There are a bunch of rules for sending a v2 patch.
https://staticthinking.wordpress.com/2022/07/27/how-to-send-a-v2-patch/

Don't resend the same day.  Add a note to say what changed etc.

regards,
dan carpenter

Re: [PATCH v2 1/2] staging: media: av7110: fix corrupted BER reporting in sp8870

[Greg KH]

On Sat, Aug 08, 2026 at 12:04:42AM +0530, Punnay Sharma wrote:
> In sp8870_read_ber(), the 14-bit Bit Error Rate (BER) is assembled by
> reading two I2C registers: 0xC08 (lower 6 bits) and 0xC07 (upper 8 bits).
> 
> The current implementation masks the lower bits via `tmp = ret & 0x3F;`
> but subsequently overwrites `tmp` entirely when processing the upper
> bits using a direct assignment (`tmp = ret << 6;`). This logical error
> causes the lower 6 bits of the BER hardware metric to be silently
> discarded.
> 
> Fix this by using a bitwise OR (`tmp |= ret << 6;`) to correctly merge
> the MSB and LSB payloads before returning the metric to the DVB core.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
> ---
>  drivers/staging/media/av7110/sp8870.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
> index 29fb4934c..77bebf2c7 100644
> --- a/drivers/staging/media/av7110/sp8870.c
> +++ b/drivers/staging/media/av7110/sp8870.c
> @@ -401,7 +401,7 @@ static int sp8870_read_ber(struct dvb_frontend *fe, u32 *ber)
>  	if (ret < 0)
>  		return -EIO;
>  
> -	tmp = ret << 6;
> +	tmp |= ret << 6;
>  	if (tmp >= 0x3FFF0)
>  		tmp = ~0;
>  
> -- 
> 2.55.0
> 
> 

Did you forget the Assisted-by: tag?