staging: bcm2835-audio: Simplify callback structure for write data

The device sends data to the audio devices by sending a message with
the data through VC04_SERVICES/VCHIQ.  This message contains a
callback pointer that is always filled in with the same function.
This is prone to corruption issues.

Instead fill the callback fields with a fixed cookie value to perforam
some validation on the message response and call the handler function
directly instead of through the callback pointer.

Signed-off-by: Michael Zoran <mzoran@crowfest.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/bcm2835-audio/bcm2835-pcm.c
index 2c3bf63..d2d9f9b 100644 (file)
--- a/drivers/staging/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/bcm2835-audio/bcm2835-pcm.c
@@ -61,9 +61,8 @@ static void snd_bcm2835_playback_free(struct snd_pcm_runtime *runtime)
        runtime->private_data = NULL;
 }
 
-static irqreturn_t bcm2835_playback_fifo_irq(int irq, void *dev_id)
+void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream)
 {
-       struct bcm2835_alsa_stream *alsa_stream = dev_id;
        unsigned int consumed = 0;
        int new_period = 0;
 
@@ -103,8 +102,6 @@ static irqreturn_t bcm2835_playback_fifo_irq(int irq, void *dev_id)
                audio_warning(" unexpected NULL substream\n");
        }
        audio_info(" .. OUT\n");
-
-       return IRQ_HANDLED;
 }
 
 /* open callback */
@@ -164,10 +161,6 @@ static int snd_bcm2835_playback_open_generic(
        sema_init(&alsa_stream->control_sem, 0);
        spin_lock_init(&alsa_stream->lock);
 
-       /* Enabled in start trigger, called on each "fifo irq" after that */
-       alsa_stream->enable_fifo_irq = 0;
-       alsa_stream->fifo_irq_handler = bcm2835_playback_fifo_irq;
-
        err = bcm2835_audio_open(alsa_stream);
        if (err) {
                kfree(alsa_stream);

diff --git a/drivers/staging/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/bcm2835-audio/bcm2835-vchiq.c
index af70c27..e8fd9c7 100644 (file)
--- a/drivers/staging/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/bcm2835-audio/bcm2835-vchiq.c
@@ -100,6 +100,11 @@ bcm2835_vchi_msg_queue(VCHI_SERVICE_HANDLE_T handle,
                              size);
 }
 
+static const u32 BCM2835_AUDIO_WRITE_COOKIE1 = ('B' << 24 | 'C' << 16 ||
+                                               'M' << 8  | 'A');
+static const u32 BCM2835_AUDIO_WRITE_COOKIE2 = ('D' << 24 | 'A' << 16 ||
+                                               'T' << 8  | 'A');
+
 struct bcm2835_audio_work {
        struct work_struct my_work;
        struct bcm2835_alsa_stream *alsa_stream;
@@ -248,21 +253,18 @@ static void audio_vchi_callback(void *param,
                complete(&instance->msg_avail_comp);
        } else if (m.type == VC_AUDIO_MSG_TYPE_COMPLETE) {
                struct bcm2835_alsa_stream *alsa_stream = instance->alsa_stream;
-#if defined(CONFIG_64BIT)
-               irq_handler_t callback =
-                       (irq_handler_t) (((unsigned long) m.u.complete.callbackl) |
-                       ((unsigned long) m.u.complete.callbackh << 32));
-#else
-               irq_handler_t callback = (irq_handler_t) m.u.complete.callback;
-#endif
                LOG_DBG(" .. instance=%p, m.type=VC_AUDIO_MSG_TYPE_COMPLETE, complete=%d\n",
                        instance, m.u.complete.count);
-               if (alsa_stream && callback) {
-                       atomic_add(m.u.complete.count, &alsa_stream->retrieved);
-                       callback(0, alsa_stream);
+               if (m.u.complete.cookie1 != BCM2835_AUDIO_WRITE_COOKIE1 ||
+                   m.u.complete.cookie2 != BCM2835_AUDIO_WRITE_COOKIE2)
+                       LOG_ERR(" .. response is corrupt\n");
+               else if (alsa_stream) {
+                       atomic_add(m.u.complete.count,
+                                  &alsa_stream->retrieved);
+                       bcm2835_playback_fifo(alsa_stream);
                } else {
-                       LOG_ERR(" .. unexpected alsa_stream=%p, callback=%p\n",
-                               alsa_stream, callback);
+                       LOG_ERR(" .. unexpected alsa_stream=%p\n",
+                               alsa_stream);
                }
        } else {
                LOG_ERR(" .. unexpected m.type=%d\n", m.type);
@@ -815,13 +817,8 @@ int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
        m.u.write.count = count;
        // old version uses bulk, new version uses control
        m.u.write.max_packet = instance->peer_version < 2 || force_bulk ? 0 : 4000;
-#if defined(CONFIG_64BIT)
-       m.u.write.callbackl = (u32) (((unsigned long) alsa_stream->fifo_irq_handler)&0xFFFFFFFF);
-       m.u.write.callbackh = (u32) ((((unsigned long) alsa_stream->fifo_irq_handler) >> 32)&0xFFFFFFFF);
-#else
-       m.u.write.callback = alsa_stream->fifo_irq_handler;
-       m.u.write.cookie = alsa_stream;
-#endif
+       m.u.write.cookie1 = BCM2835_AUDIO_WRITE_COOKIE1;
+       m.u.write.cookie2 = BCM2835_AUDIO_WRITE_COOKIE2;
        m.u.write.silence = src == NULL;
 
        /* Send the message to the videocore */

diff --git a/drivers/staging/bcm2835-audio/bcm2835.h b/drivers/staging/bcm2835-audio/bcm2835.h
index d333629..36e3ef8 100644 (file)
--- a/drivers/staging/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/bcm2835-audio/bcm2835.h
@@ -137,9 +137,6 @@ struct bcm2835_alsa_stream {
        unsigned int buffer_size;
        unsigned int period_size;
 
-       unsigned int enable_fifo_irq;
-       irq_handler_t fifo_irq_handler;
-
        atomic_t retrieved;
        struct bcm2835_audio_instance *instance;
        struct workqueue_struct *my_wq;
@@ -162,6 +159,7 @@ int bcm2835_audio_set_ctls(struct bcm2835_chip *chip);
 int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
                        unsigned int count,
                        void *src);
+void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream);
 unsigned int bcm2835_audio_retrieve_buffers(struct bcm2835_alsa_stream *alsa_stream);
 void bcm2835_audio_flush_buffers(struct bcm2835_alsa_stream *alsa_stream);
 void bcm2835_audio_flush_playback_buffers(struct bcm2835_alsa_stream *alsa_stream);

diff --git a/drivers/staging/bcm2835-audio/vc_vchi_audioserv_defs.h b/drivers/staging/bcm2835-audio/vc_vchi_audioserv_defs.h
index 2cc81f0..09f07fd 100644 (file)
--- a/drivers/staging/bcm2835-audio/vc_vchi_audioserv_defs.h
+++ b/drivers/staging/bcm2835-audio/vc_vchi_audioserv_defs.h
@@ -74,13 +74,8 @@ struct vc_audio_stop {
 /* configure the write audio samples */
 struct vc_audio_write {
        u32 count; // in bytes
-#if defined(CONFIG_64BIT)
-       u32 callbackl;
-       u32 callbackh;
-#else
-       void *callback;
-       void *cookie;
-#endif
+       u32 cookie1;
+       u32 cookie2;
        s16 silence;
        s16 max_packet;
 };
@@ -93,13 +88,8 @@ struct vc_audio_result {
 /* Generic result for a request (VC->HOST) */
 struct vc_audio_complete {
        s32 count; // Success value
-#if defined(CONFIG_64BIT)
-       u32 callbackl;
-       u32 callbackh;
-#else
-       void *callback;
-       void *cookie;
-#endif
+       u32 cookie1;
+       u32 cookie2;
 };
 
 /* Message header for all messages in HOST->VC direction */