Avoid beyond bounds copy while caching ACL
[zen-stable.git] / drivers / media / video / gspca / kinect.c
blobe8e8f2fe9166efc3a9b717e2f9bb458f995f042d
1 /*
2 * kinect sensor device camera, gspca driver
4 * Copyright (C) 2011 Antonio Ospite <ospite@studenti.unina.it>
6 * Based on the OpenKinect project and libfreenect
7 * http://openkinect.org/wiki/Init_Analysis
9 * Special thanks to Steven Toth and kernellabs.com for sponsoring a Kinect
10 * sensor device which I tested the driver on.
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
27 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
29 #define MODULE_NAME "kinect"
31 #include "gspca.h"
33 #define CTRL_TIMEOUT 500
35 MODULE_AUTHOR("Antonio Ospite <ospite@studenti.unina.it>");
36 MODULE_DESCRIPTION("GSPCA/Kinect Sensor Device USB Camera Driver");
37 MODULE_LICENSE("GPL");
39 struct pkt_hdr {
40 uint8_t magic[2];
41 uint8_t pad;
42 uint8_t flag;
43 uint8_t unk1;
44 uint8_t seq;
45 uint8_t unk2;
46 uint8_t unk3;
47 uint32_t timestamp;
50 struct cam_hdr {
51 uint8_t magic[2];
52 uint16_t len;
53 uint16_t cmd;
54 uint16_t tag;
57 /* specific webcam descriptor */
58 struct sd {
59 struct gspca_dev gspca_dev; /* !! must be the first item */
60 uint16_t cam_tag; /* a sequence number for packets */
61 uint8_t stream_flag; /* to identify different stream types */
62 uint8_t obuf[0x400]; /* output buffer for control commands */
63 uint8_t ibuf[0x200]; /* input buffer for control commands */
66 /* V4L2 controls supported by the driver */
67 /* controls prototypes here */
69 static const struct ctrl sd_ctrls[] = {
72 #define MODE_640x480 0x0001
73 #define MODE_640x488 0x0002
74 #define MODE_1280x1024 0x0004
76 #define FORMAT_BAYER 0x0010
77 #define FORMAT_UYVY 0x0020
78 #define FORMAT_Y10B 0x0040
80 #define FPS_HIGH 0x0100
82 static const struct v4l2_pix_format video_camera_mode[] = {
83 {640, 480, V4L2_PIX_FMT_SGRBG8, V4L2_FIELD_NONE,
84 .bytesperline = 640,
85 .sizeimage = 640 * 480,
86 .colorspace = V4L2_COLORSPACE_SRGB,
87 .priv = MODE_640x480 | FORMAT_BAYER | FPS_HIGH},
88 {640, 480, V4L2_PIX_FMT_UYVY, V4L2_FIELD_NONE,
89 .bytesperline = 640 * 2,
90 .sizeimage = 640 * 480 * 2,
91 .colorspace = V4L2_COLORSPACE_SRGB,
92 .priv = MODE_640x480 | FORMAT_UYVY},
93 {1280, 1024, V4L2_PIX_FMT_SGRBG8, V4L2_FIELD_NONE,
94 .bytesperline = 1280,
95 .sizeimage = 1280 * 1024,
96 .colorspace = V4L2_COLORSPACE_SRGB,
97 .priv = MODE_1280x1024 | FORMAT_BAYER},
98 {640, 488, V4L2_PIX_FMT_Y10BPACK, V4L2_FIELD_NONE,
99 .bytesperline = 640 * 10 / 8,
100 .sizeimage = 640 * 488 * 10 / 8,
101 .colorspace = V4L2_COLORSPACE_SRGB,
102 .priv = MODE_640x488 | FORMAT_Y10B | FPS_HIGH},
103 {1280, 1024, V4L2_PIX_FMT_Y10BPACK, V4L2_FIELD_NONE,
104 .bytesperline = 1280 * 10 / 8,
105 .sizeimage = 1280 * 1024 * 10 / 8,
106 .colorspace = V4L2_COLORSPACE_SRGB,
107 .priv = MODE_1280x1024 | FORMAT_Y10B},
110 static int kinect_write(struct usb_device *udev, uint8_t *data,
111 uint16_t wLength)
113 return usb_control_msg(udev,
114 usb_sndctrlpipe(udev, 0),
115 0x00,
116 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
117 0, 0, data, wLength, CTRL_TIMEOUT);
120 static int kinect_read(struct usb_device *udev, uint8_t *data, uint16_t wLength)
122 return usb_control_msg(udev,
123 usb_rcvctrlpipe(udev, 0),
124 0x00,
125 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
126 0, 0, data, wLength, CTRL_TIMEOUT);
129 static int send_cmd(struct gspca_dev *gspca_dev, uint16_t cmd, void *cmdbuf,
130 unsigned int cmd_len, void *replybuf, unsigned int reply_len)
132 struct sd *sd = (struct sd *) gspca_dev;
133 struct usb_device *udev = gspca_dev->dev;
134 int res, actual_len;
135 uint8_t *obuf = sd->obuf;
136 uint8_t *ibuf = sd->ibuf;
137 struct cam_hdr *chdr = (void *)obuf;
138 struct cam_hdr *rhdr = (void *)ibuf;
140 if (cmd_len & 1 || cmd_len > (0x400 - sizeof(*chdr))) {
141 pr_err("send_cmd: Invalid command length (0x%x)\n", cmd_len);
142 return -1;
145 chdr->magic[0] = 0x47;
146 chdr->magic[1] = 0x4d;
147 chdr->cmd = cpu_to_le16(cmd);
148 chdr->tag = cpu_to_le16(sd->cam_tag);
149 chdr->len = cpu_to_le16(cmd_len / 2);
151 memcpy(obuf+sizeof(*chdr), cmdbuf, cmd_len);
153 res = kinect_write(udev, obuf, cmd_len + sizeof(*chdr));
154 PDEBUG(D_USBO, "Control cmd=%04x tag=%04x len=%04x: %d", cmd,
155 sd->cam_tag, cmd_len, res);
156 if (res < 0) {
157 pr_err("send_cmd: Output control transfer failed (%d)\n", res);
158 return res;
161 do {
162 actual_len = kinect_read(udev, ibuf, 0x200);
163 } while (actual_len == 0);
164 PDEBUG(D_USBO, "Control reply: %d", res);
165 if (actual_len < sizeof(*rhdr)) {
166 pr_err("send_cmd: Input control transfer failed (%d)\n", res);
167 return res;
169 actual_len -= sizeof(*rhdr);
171 if (rhdr->magic[0] != 0x52 || rhdr->magic[1] != 0x42) {
172 pr_err("send_cmd: Bad magic %02x %02x\n",
173 rhdr->magic[0], rhdr->magic[1]);
174 return -1;
176 if (rhdr->cmd != chdr->cmd) {
177 pr_err("send_cmd: Bad cmd %02x != %02x\n",
178 rhdr->cmd, chdr->cmd);
179 return -1;
181 if (rhdr->tag != chdr->tag) {
182 pr_err("send_cmd: Bad tag %04x != %04x\n",
183 rhdr->tag, chdr->tag);
184 return -1;
186 if (cpu_to_le16(rhdr->len) != (actual_len/2)) {
187 pr_err("send_cmd: Bad len %04x != %04x\n",
188 cpu_to_le16(rhdr->len), (int)(actual_len/2));
189 return -1;
192 if (actual_len > reply_len) {
193 pr_warn("send_cmd: Data buffer is %d bytes long, but got %d bytes\n",
194 reply_len, actual_len);
195 memcpy(replybuf, ibuf+sizeof(*rhdr), reply_len);
196 } else {
197 memcpy(replybuf, ibuf+sizeof(*rhdr), actual_len);
200 sd->cam_tag++;
202 return actual_len;
205 static int write_register(struct gspca_dev *gspca_dev, uint16_t reg,
206 uint16_t data)
208 uint16_t reply[2];
209 uint16_t cmd[2];
210 int res;
212 cmd[0] = cpu_to_le16(reg);
213 cmd[1] = cpu_to_le16(data);
215 PDEBUG(D_USBO, "Write Reg 0x%04x <= 0x%02x", reg, data);
216 res = send_cmd(gspca_dev, 0x03, cmd, 4, reply, 4);
217 if (res < 0)
218 return res;
219 if (res != 2) {
220 pr_warn("send_cmd returned %d [%04x %04x], 0000 expected\n",
221 res, reply[0], reply[1]);
223 return 0;
226 /* this function is called at probe time */
227 static int sd_config(struct gspca_dev *gspca_dev,
228 const struct usb_device_id *id)
230 struct sd *sd = (struct sd *) gspca_dev;
231 struct cam *cam;
233 sd->cam_tag = 0;
235 /* Only video stream is supported for now,
236 * which has stream flag = 0x80 */
237 sd->stream_flag = 0x80;
239 cam = &gspca_dev->cam;
241 cam->cam_mode = video_camera_mode;
242 cam->nmodes = ARRAY_SIZE(video_camera_mode);
244 #if 0
245 /* Setting those values is not needed for video stream */
246 cam->npkt = 15;
247 gspca_dev->pkt_size = 960 * 2;
248 #endif
250 return 0;
253 /* this function is called at probe and resume time */
254 static int sd_init(struct gspca_dev *gspca_dev)
256 PDEBUG(D_PROBE, "Kinect Camera device.");
258 return 0;
261 static int sd_start(struct gspca_dev *gspca_dev)
263 int mode;
264 uint8_t fmt_reg, fmt_val;
265 uint8_t res_reg, res_val;
266 uint8_t fps_reg, fps_val;
267 uint8_t mode_val;
269 mode = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
271 if (mode & FORMAT_Y10B) {
272 fmt_reg = 0x19;
273 res_reg = 0x1a;
274 fps_reg = 0x1b;
275 mode_val = 0x03;
276 } else {
277 fmt_reg = 0x0c;
278 res_reg = 0x0d;
279 fps_reg = 0x0e;
280 mode_val = 0x01;
283 /* format */
284 if (mode & FORMAT_UYVY)
285 fmt_val = 0x05;
286 else
287 fmt_val = 0x00;
289 if (mode & MODE_1280x1024)
290 res_val = 0x02;
291 else
292 res_val = 0x01;
294 if (mode & FPS_HIGH)
295 fps_val = 0x1e;
296 else
297 fps_val = 0x0f;
300 /* turn off IR-reset function */
301 write_register(gspca_dev, 0x105, 0x00);
303 /* Reset video stream */
304 write_register(gspca_dev, 0x05, 0x00);
306 /* Due to some ridiculous condition in the firmware, we have to start
307 * and stop the depth stream before the camera will hand us 1280x1024
308 * IR. This is a stupid workaround, but we've yet to find a better
309 * solution.
311 * Thanks to Drew Fisher for figuring this out.
313 if (mode & (FORMAT_Y10B | MODE_1280x1024)) {
314 write_register(gspca_dev, 0x13, 0x01);
315 write_register(gspca_dev, 0x14, 0x1e);
316 write_register(gspca_dev, 0x06, 0x02);
317 write_register(gspca_dev, 0x06, 0x00);
320 write_register(gspca_dev, fmt_reg, fmt_val);
321 write_register(gspca_dev, res_reg, res_val);
322 write_register(gspca_dev, fps_reg, fps_val);
324 /* Start video stream */
325 write_register(gspca_dev, 0x05, mode_val);
327 /* disable Hflip */
328 write_register(gspca_dev, 0x47, 0x00);
330 return 0;
333 static void sd_stopN(struct gspca_dev *gspca_dev)
335 /* reset video stream */
336 write_register(gspca_dev, 0x05, 0x00);
339 static void sd_pkt_scan(struct gspca_dev *gspca_dev, u8 *__data, int len)
341 struct sd *sd = (struct sd *) gspca_dev;
343 struct pkt_hdr *hdr = (void *)__data;
344 uint8_t *data = __data + sizeof(*hdr);
345 int datalen = len - sizeof(*hdr);
347 uint8_t sof = sd->stream_flag | 1;
348 uint8_t mof = sd->stream_flag | 2;
349 uint8_t eof = sd->stream_flag | 5;
351 if (len < 12)
352 return;
354 if (hdr->magic[0] != 'R' || hdr->magic[1] != 'B') {
355 pr_warn("[Stream %02x] Invalid magic %02x%02x\n",
356 sd->stream_flag, hdr->magic[0], hdr->magic[1]);
357 return;
360 if (hdr->flag == sof)
361 gspca_frame_add(gspca_dev, FIRST_PACKET, data, datalen);
363 else if (hdr->flag == mof)
364 gspca_frame_add(gspca_dev, INTER_PACKET, data, datalen);
366 else if (hdr->flag == eof)
367 gspca_frame_add(gspca_dev, LAST_PACKET, data, datalen);
369 else
370 pr_warn("Packet type not recognized...\n");
373 /* sub-driver description */
374 static const struct sd_desc sd_desc = {
375 .name = MODULE_NAME,
376 .ctrls = sd_ctrls,
377 .nctrls = ARRAY_SIZE(sd_ctrls),
378 .config = sd_config,
379 .init = sd_init,
380 .start = sd_start,
381 .stopN = sd_stopN,
382 .pkt_scan = sd_pkt_scan,
384 .querymenu = sd_querymenu,
385 .get_streamparm = sd_get_streamparm,
386 .set_streamparm = sd_set_streamparm,
390 /* -- module initialisation -- */
391 static const struct usb_device_id device_table[] = {
392 {USB_DEVICE(0x045e, 0x02ae)},
396 MODULE_DEVICE_TABLE(usb, device_table);
398 /* -- device connect -- */
399 static int sd_probe(struct usb_interface *intf, const struct usb_device_id *id)
401 return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
402 THIS_MODULE);
405 static struct usb_driver sd_driver = {
406 .name = MODULE_NAME,
407 .id_table = device_table,
408 .probe = sd_probe,
409 .disconnect = gspca_disconnect,
410 #ifdef CONFIG_PM
411 .suspend = gspca_suspend,
412 .resume = gspca_resume,
413 #endif
416 module_usb_driver(sd_driver);