Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220818125027.1131-1-yongsuyoo0215@gmail.com>
 <CANXPkT4KL9KxvgjaJO058zg8nb00qaiPfDFKEaQ42g6v18XvKA@mail.gmail.com>
 <CANXPkT4hB4AEKk_=piESRTxToBsoKCpaq8vvjP05o3CX6QX4_g@mail.gmail.com> <CANXPkT4pzpEKMXuBShAeWfA80g5UigodrVZc+EBDnTLrHjnpyA@mail.gmail.com>
In-Reply-To: <CANXPkT4pzpEKMXuBShAeWfA80g5UigodrVZc+EBDnTLrHjnpyA@mail.gmail.com>
From:   YongSu Yoo <yongsuyoo0215@gmail.com>
Date:   Fri, 2 Dec 2022 00:35:51 +0900
Message-ID: <CANXPkT74VPmFuGjTH+_=ycvoLni5GZDuf5mbo_ACdexp57oHxA@mail.gmail.com>
Subject: Re: [PATCH] media: dvb_ca_en50221: A bug is fixed for size write
To:     mchehab@kernel.org, linux-media@vger.kernel.org,
        linux-kernel@vger.kernel.org, yongsu.yoo@lge.com,
        =?UTF-8?B?7Jyg7Jqp7IiY?= <yongsuyoo0215@gmail.com>,
        Hans Petter Selasky <hps@selasky.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Dear All
It has been a long time since this patch was created.
Can you share how this patch is going ?

2022=EB=85=84 10=EC=9B=94 14=EC=9D=BC (=EA=B8=88) =EC=98=A4=ED=9B=84 10:41,=
 =EC=9C=A0=EC=9A=A9=EC=88=98 <yongsuyoo0215@gmail.com>=EB=8B=98=EC=9D=B4 =
=EC=9E=91=EC=84=B1:
>
> Dear All
> Can you share how this patch is going ?
>
> 2022=EB=85=84 9=EC=9B=94 15=EC=9D=BC (=EB=AA=A9) =EC=98=A4=ED=9B=84 5:47,=
 =EC=9C=A0=EC=9A=A9=EC=88=98 <yongsuyoo0215@gmail.com>=EB=8B=98=EC=9D=B4 =
=EC=9E=91=EC=84=B1:
> >
> > Dear All
> > Can you share how this patch is going ?
> >
> > 2022=EB=85=84 8=EC=9B=94 31=EC=9D=BC (=EC=88=98) =EC=98=A4=ED=9B=84 10:=
43, =EC=9C=A0=EC=9A=A9=EC=88=98 <yongsuyoo0215@gmail.com>=EB=8B=98=EC=9D=B4=
 =EC=9E=91=EC=84=B1:
> > >
> > > Dear All
> > > Can you share how this patch is going ?
> > >
> > > 2022=EB=85=84 8=EC=9B=94 18=EC=9D=BC (=EB=AA=A9) =EC=98=A4=ED=9B=84 9=
:50, YongSu Yoo <yongsuyoo0215@gmail.com>=EB=8B=98=EC=9D=B4 =EC=9E=91=EC=84=
=B1:
> > > >
> > > > Signed-off-by:Yongsu Yoo <yongsuyoo0215@gmail.com>
> > > >
> > > > The function of "dvb_ca_en50221_write_data" at source/drivers/media
> > > > /dvb-core/dvb_ca_en50221.c is used for two cases.
> > > > The first case is for writing APDU data in the function of
> > > > "dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/
> > > > dvb_ca_en50221.c.
> > > > The second case is for writing the host link buf size on the
> > > > Command Register in the function of "dvb_ca_en50221_link_init"
> > > > at source/drivers/media/dvb-core/dvb_ca_en50221.c.
> > > > In the second case, there exists a bug like followings.
> > > > In the function of the "dvb_ca_en50221_link_init",
> > > > after a TV host calculates the host link buf_size,
> > > > the TV host writes the calculated host link buf_size on the
> > > > Size Register.
> > > > Accroding to the en50221 Spec (the page 60 of
> > > > https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf),
> > > > before this writing operation, the "SW(CMDREG_SW)" flag in the
> > > > Command Register should be set. We can see this setting operation
> > > > in the function of the "dvb_ca_en50221_link_init" like below.
> > > > ...
> > > >         if ((ret =3D ca->pub->write_cam_control(ca->pub, slot,
> > > > CTRLIF_COMMAND, IRQEN | CMDREG_SW)) !=3D 0)
> > > >                 return ret;
> > > > ...
> > > > But, after that, the real writing operation is implemented using
> > > > the function of the "dvb_ca_en50221_write_data" in the function of
> > > > "dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data"
> > > > includes the function of "ca->pub->write_cam_control",
> > > > and the function of the "ca->pub->write_cam_control" in the
> > > > function of the "dvb_ca_en50221_wrte_data" does not include
> > > > "CMDREG_SW" flag like below.
> > > > ...
> > > >         if ((status =3D ca->pub->write_cam_control(ca->pub, slot,
> > > > CTRLIF_COMMAND, IRQEN | CMDREG_HC)) !=3D 0)
> > > > ...
> > > > In the above source code, we can see only the "IRQEN | CMDREG_HC",
> > > > but we cannot see the "CMDREG_SW".
> > > > The "CMDREG_SW" flag which was set in the function of the
> > > > "dvb_ca_en50221_link_init" was rollbacked by the follwoing function
> > > > of the "dvb_ca_en50221_write_data".
> > > > This is a bug. and this bug causes that the calculated host link bu=
f_size
> > > > is not properly written in the CI module.
> > > > Through this patch, we fix this bug.
> > > > ---
> > > >  drivers/media/dvb-core/dvb_ca_en50221.c | 12 +++++++-----
> > > >  1 file changed, 7 insertions(+), 5 deletions(-)
> > > >
> > > > diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/medi=
a/dvb-core/dvb_ca_en50221.c
> > > > index 15a08d8c69ef..13f249b0a080 100644
> > > > --- a/drivers/media/dvb-core/dvb_ca_en50221.c
> > > > +++ b/drivers/media/dvb-core/dvb_ca_en50221.c
> > > > @@ -187,7 +187,7 @@ static void dvb_ca_en50221_thread_wakeup(struct=
 dvb_ca_private *ca);
> > > >  static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int=
 slot,
> > > >                                     u8 *ebuf, int ecount);
> > > >  static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, in=
t slot,
> > > > -                                    u8 *ebuf, int ecount);
> > > > +                                    u8 *ebuf, int ecount, int size=
_write_flag);
> > > >
> > > >  /**
> > > >   * findstr - Safely find needle in haystack.
> > > > @@ -370,7 +370,7 @@ static int dvb_ca_en50221_link_init(struct dvb_=
ca_private *ca, int slot)
> > > >         ret =3D dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_F=
R, HZ / 10);
> > > >         if (ret)
> > > >                 return ret;
> > > > -       ret =3D dvb_ca_en50221_write_data(ca, slot, buf, 2);
> > > > +       ret =3D dvb_ca_en50221_write_data(ca, slot, buf, 2, CMDREG_=
SW);
> > > >         if (ret !=3D 2)
> > > >                 return -EIO;
> > > >         ret =3D ca->pub->write_cam_control(ca->pub, slot, CTRLIF_CO=
MMAND, IRQEN);
> > > > @@ -778,11 +778,13 @@ static int dvb_ca_en50221_read_data(struct dv=
b_ca_private *ca, int slot,
> > > >   * @buf: The data in this buffer is treated as a complete link-lev=
el packet to
> > > >   *      be written.
> > > >   * @bytes_write: Size of ebuf.
> > > > + * @size_write_flag: A flag on Command Register which says whether=
 the link size
> > > > + * information will be writen or not.
> > > >   *
> > > >   * return: Number of bytes written, or < 0 on error.
> > > >   */
> > > >  static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, in=
t slot,
> > > > -                                    u8 *buf, int bytes_write)
> > > > +                                    u8 *buf, int bytes_write, int =
size_write_flag)
> > > >  {
> > > >         struct dvb_ca_slot *sl =3D &ca->slot_info[slot];
> > > >         int status;
> > > > @@ -817,7 +819,7 @@ static int dvb_ca_en50221_write_data(struct dvb=
_ca_private *ca, int slot,
> > > >
> > > >         /* OK, set HC bit */
> > > >         status =3D ca->pub->write_cam_control(ca->pub, slot, CTRLIF=
_COMMAND,
> > > > -                                           IRQEN | CMDREG_HC);
> > > > +                                           IRQEN | CMDREG_HC | siz=
e_write_flag);
> > > >         if (status)
> > > >                 goto exit;
> > > >
> > > > @@ -1508,7 +1510,7 @@ static ssize_t dvb_ca_en50221_io_write(struct=
 file *file,
> > > >
> > > >                         mutex_lock(&sl->slot_lock);
> > > >                         status =3D dvb_ca_en50221_write_data(ca, sl=
ot, fragbuf,
> > > > -                                                          fraglen =
+ 2);
> > > > +                                                          fraglen =
+ 2, 0);
> > > >                         mutex_unlock(&sl->slot_lock);
> > > >                         if (status =3D=3D (fraglen + 2)) {
> > > >                                 written =3D 1;
> > > > --
> > > > 2.17.1
> > > >