• YongSu Yoo's avatar
    media: dvb_ca_en50221: fix a size write bug · a4315e5b
    YongSu Yoo authored
    The function of "dvb_ca_en50221_write_data" at source/drivers/media
    /dvb-core/dvb_ca_en50221.c is used for two cases.
    The first case is for writing APDU data in the function of
    "dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/
    dvb_ca_en50221.c.
    The second case is for writing the host link buf size on the
    Command Register in the function of "dvb_ca_en50221_link_init"
    at source/drivers/media/dvb-core/dvb_ca_en50221.c.
    In the second case, there exists a bug like following.
    In the function of the "dvb_ca_en50221_link_init",
    after a TV host calculates the host link buf_size,
    the TV host writes the calculated host link buf_size on the
    Size Register.
    Accroding to the en50221 Spec (the page 60 of
    https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf),
    before this writing operation, the "SW(CMDREG_SW)" flag in the
    Command Register should be set. We can see this setting operation
    in the function of the "dvb_ca_en50221_link_init" like below.
    ...
    	if ((ret = ca->pub->write_cam_control(ca->pub, slot,
    CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0)
    		return ret;
    ...
    But, after that, the real writing operation is implemented using
    the function of the "dvb_ca_en50221_write_data" in the function of
    "dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data"
    includes the function of "ca->pub->write_cam_control",
    and the function of the "ca->pub->write_cam_control" in the
    function of the "dvb_ca_en50221_wrte_data" does not include
    "CMDREG_SW" flag like below.
    ...
    	if ((status = ca->pub->write_cam_control(ca->pub, slot,
    CTRLIF_COMMAND, IRQEN | CMDREG_HC)) != 0)
    ...
    In the above source code, we can see only the "IRQEN | CMDREG_HC",
    but we cannot see the "CMDREG_SW".
    The "CMDREG_SW" flag which was set in the function of the
    "dvb_ca_en50221_link_init" was rollbacked by the follwoing function
    of the "dvb_ca_en50221_write_data".
    This is a bug. and this bug causes that the calculated host link buf_size
    is not properly written in the CI module.
    Through this patch, we fix this bug.
    
    Link: https://lore.kernel.org/linux-media/20220818125027.1131-1-yongsuyoo0215@gmail.comSigned-off-by: default avatarYongSu Yoo <yongsuyoo0215@gmail.com>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
    a4315e5b
dvb_ca_en50221.c 47 KB