V4L/DVB (12823): tm6000: Uses another method for handling incomplete packets

This requires a little more memory, and some memcpy to work, but the logic is
simpler than the previous method.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

drivers/staging/tm6000/tm6000-regs.h

@@ -77,7 +77,6 @@
  * Define TV Master TM5600/TM6000 URB message codes and length
  */
 
-#define TM6000_URB_MSG_LEN 180
 enum {
 	TM6000_URB_MSG_VIDEO=1,
 	TM6000_URB_MSG_AUDIO,

drivers/staging/tm6000/tm6000-usb-isoc.h

@@ -19,6 +19,8 @@
 
 #include <linux/videodev2.h>
 
+#define TM6000_URB_MSG_LEN 180
+
 struct usb_isoc_ctl {
 		/* max packet size of isoc transaction */
 	int				max_pkt_size;
@@ -32,16 +34,16 @@ struct usb_isoc_ctl {
 		/* transfer buffers for isoc transfer */
 	char				**transfer_buffer;
 
-		/* Last buffer command and region */
-	u8				cmd;
-	int				pos, size, pktsize;
+		/* Last buffer control */
+	int				pending;
+	int				pos;
 
 		/* Last field: ODD or EVEN? */
 	int				field;
 
 		/* Stores incomplete commands */
-	u32				tmp_buf;
-	int				tmp_buf_len;
+	u8				tbuf[TM6000_URB_MSG_LEN+4];
+	size_t				len;
 
 		/* Stores already requested buffers */
 	struct tm6000_buffer    	*buf;

drivers/staging/tm6000/tm6000-video.c

@@ -215,8 +215,6 @@ static int copy_packet (struct urb *urb, u32 header, u8 **ptr, u8 *endp,
 	 */
 	unsigned int linewidth=(*buf)->vb.width<<1;
 
-
-	if (!dev->isoc_ctl.cmd) {
 	c=(header>>24) & 0xff;
 
 	/* split the header fields */
@@ -294,13 +292,6 @@ static int copy_packet (struct urb *urb, u32 header, u8 **ptr, u8 *endp,
 	last_line=line;
 
 	pktsize = TM6000_URB_MSG_LEN;
-	} else {
-		/* Continue the last copy */
-		cmd = dev->isoc_ctl.cmd;
-		size= dev->isoc_ctl.size;
-		pos = dev->isoc_ctl.pos;
-		pktsize = dev->isoc_ctl.pktsize;
-	}
 
 	cpysize=(endp-(*ptr)>size)?size:endp-(*ptr);
 
@@ -325,19 +316,7 @@ printk ("%ld: cmd=%s, size=%d\n", jiffies,
 						tm6000_msg_type[cmd],size);
 		}
 	}
-	if (cpysize<size) {
-		/* End of URB packet, but cmd processing is not
-		 * complete. Preserve the state for a next packet
-		 */
-		dev->isoc_ctl.pos = pos+cpysize;
-		dev->isoc_ctl.size= size-cpysize;
-		dev->isoc_ctl.cmd = cmd;
-		dev->isoc_ctl.pktsize = pktsize-cpysize;
 	(*ptr)+=cpysize;
-	} else {
-		dev->isoc_ctl.cmd = 0;
-		(*ptr)+=pktsize;
-	}
 
 	return rc;
 }
@@ -347,57 +326,73 @@ static int copy_streams(u8 *data, u8 *out_p, unsigned long len,
 {
 	struct tm6000_dmaqueue  *dma_q = urb->context;
 	struct tm6000_core *dev= container_of(dma_q,struct tm6000_core,vidq);
-	u8 *ptr=data, *endp=data+len;
+	u8 *ptr, *endp;
 	unsigned long header=0;
-	int rc=0;
+	int rc=0, size;
 
-	for (ptr=data; ptr<endp;) {
-		if (!dev->isoc_ctl.cmd) {
-			u8 *p=(u8 *)&dev->isoc_ctl.tmp_buf;
-			/* FIXME: This seems very complex
-			 * It just recovers up to 3 bytes of the header that
-			 * might be at the previous packet
-			 */
-			if (dev->isoc_ctl.tmp_buf_len) {
-				while (dev->isoc_ctl.tmp_buf_len) {
-					if ( *(ptr+3-dev->isoc_ctl.tmp_buf_len) == 0x47) {
+	/* Process pending data */
+	if (dev->isoc_ctl.pending) {
+		memcpy(dev->isoc_ctl.tbuf + dev->isoc_ctl.len, ptr,
+		       sizeof(dev->isoc_ctl.tbuf) - dev->isoc_ctl.len);
+
+		/* Seek for sync */
+		endp = dev->isoc_ctl.tbuf + sizeof(dev->isoc_ctl.tbuf);
+		for (ptr = dev->isoc_ctl.tbuf;ptr < endp - 3;ptr++) {
+			if (*(ptr + 3) == 0x47)
 				break;
 		}
-					p++;
-					dev->isoc_ctl.tmp_buf_len--;
-				}
-				if (dev->isoc_ctl.tmp_buf_len) {
-					memcpy (&header,p,
-						dev->isoc_ctl.tmp_buf_len);
-					memcpy (((u8 *)header)+
-						dev->isoc_ctl.tmp_buf,
-						ptr,
-						4-dev->isoc_ctl.tmp_buf_len);
-					ptr+=4-dev->isoc_ctl.tmp_buf_len;
-					goto HEADER;
+		header=*(unsigned long *)ptr;
+		size  = (((header & 0x7e) << 1) - 1) * 4;
+		if(size > TM6000_URB_MSG_LEN)
+			size = TM6000_URB_MSG_LEN;
+
+		if (ptr+3+size >= endp) {
+			printk(KERN_ERR "tm6000: broken data\n");
+			ptr = data;
+			goto process_new_uri;
 		}
+		ptr+=4;
+
+		/* Copy or continue last copy */
+		rc=copy_packet(urb, header, &ptr, endp, out_p, buf);
+		if (rc<0) {
+			buf=NULL;
+			printk(KERN_ERR "tm6000: buffer underrun at %ld\n",
+					jiffies);
+			return rc;
 		}
+		dev->isoc_ctl.pending = 0;
+		ptr = data + (ptr - dev->isoc_ctl.tbuf);
+	} else
+		ptr = data;
+
+process_new_uri:
+	endp = data + len;
+	while (ptr<endp) {
+		if (!dev->isoc_ctl.pending) {
 			/* Seek for sync */
 			for (;ptr<endp-3;ptr++) {
 				if (*(ptr+3)==0x47)
 					break;
 			}
+			header=*(unsigned long *)ptr;
+			size  = (((header & 0x7e)<<1) -1) *4;
+			if(size>TM6000_URB_MSG_LEN)
+				size = TM6000_URB_MSG_LEN;
+
+			if (ptr+3+size >= endp) {
+				int len = endp - ptr;
 
-			if (ptr+3>=endp) {
-				dev->isoc_ctl.tmp_buf_len=endp-ptr;
-				memcpy (&dev->isoc_ctl.tmp_buf,ptr,
-					dev->isoc_ctl.tmp_buf_len);
-				dev->isoc_ctl.cmd=0;
+				memcpy (dev->isoc_ctl.tbuf, ptr, len);
+				dev->isoc_ctl.len = len;
+				dev->isoc_ctl.pending = 1;
 				return rc;
 			}
-
-			/* Get message header */
-			header=*(unsigned long *)ptr;
 			ptr+=4;
 		}
-HEADER:
+
 		/* Copy or continue last copy */
-		rc=copy_packet(urb,header,&ptr,endp,out_p,buf);
+		rc=copy_packet(urb, header, &ptr, endp, out_p, buf);
 		if (rc<0) {
 			buf=NULL;
 			printk(KERN_ERR "tm6000: buffer underrun at %ld\n",