Avoid beyond bounds copy while caching ACL
[zen-stable.git] / drivers / media / video / gspca / sq905c.c
blobae783634712f4196a4751fe678d5370e65b5e2a0
1 /*
2 * SQ905C subdriver
4 * Copyright (C) 2009 Theodore Kilgore
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23 * This driver uses work done in
24 * libgphoto2/camlibs/digigr8, Copyright (C) Theodore Kilgore.
26 * This driver has also used as a base the sq905c driver
27 * and may contain code fragments from it.
30 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32 #define MODULE_NAME "sq905c"
34 #include <linux/workqueue.h>
35 #include <linux/slab.h>
36 #include "gspca.h"
38 MODULE_AUTHOR("Theodore Kilgore <kilgota@auburn.edu>");
39 MODULE_DESCRIPTION("GSPCA/SQ905C USB Camera Driver");
40 MODULE_LICENSE("GPL");
42 /* Default timeouts, in ms */
43 #define SQ905C_CMD_TIMEOUT 500
44 #define SQ905C_DATA_TIMEOUT 1000
46 /* Maximum transfer size to use. */
47 #define SQ905C_MAX_TRANSFER 0x8000
49 #define FRAME_HEADER_LEN 0x50
51 /* Commands. These go in the "value" slot. */
52 #define SQ905C_CLEAR 0xa0 /* clear everything */
53 #define SQ905C_GET_ID 0x14f4 /* Read version number */
54 #define SQ905C_CAPTURE_LOW 0xa040 /* Starts capture at 160x120 */
55 #define SQ905C_CAPTURE_MED 0x1440 /* Starts capture at 320x240 */
56 #define SQ905C_CAPTURE_HI 0x2840 /* Starts capture at 320x240 */
58 /* For capture, this must go in the "index" slot. */
59 #define SQ905C_CAPTURE_INDEX 0x110f
61 /* Structure to hold all of our device specific stuff */
62 struct sd {
63 struct gspca_dev gspca_dev; /* !! must be the first item */
64 const struct v4l2_pix_format *cap_mode;
65 /* Driver stuff */
66 struct work_struct work_struct;
67 struct workqueue_struct *work_thread;
71 * Most of these cameras will do 640x480 and 320x240. 160x120 works
72 * in theory but gives very poor output. Therefore, not supported.
73 * The 0x2770:0x9050 cameras have max resolution of 320x240.
75 static struct v4l2_pix_format sq905c_mode[] = {
76 { 320, 240, V4L2_PIX_FMT_SQ905C, V4L2_FIELD_NONE,
77 .bytesperline = 320,
78 .sizeimage = 320 * 240,
79 .colorspace = V4L2_COLORSPACE_SRGB,
80 .priv = 0},
81 { 640, 480, V4L2_PIX_FMT_SQ905C, V4L2_FIELD_NONE,
82 .bytesperline = 640,
83 .sizeimage = 640 * 480,
84 .colorspace = V4L2_COLORSPACE_SRGB,
85 .priv = 0}
88 /* Send a command to the camera. */
89 static int sq905c_command(struct gspca_dev *gspca_dev, u16 command, u16 index)
91 int ret;
93 ret = usb_control_msg(gspca_dev->dev,
94 usb_sndctrlpipe(gspca_dev->dev, 0),
95 USB_REQ_SYNCH_FRAME, /* request */
96 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
97 command, index, NULL, 0,
98 SQ905C_CMD_TIMEOUT);
99 if (ret < 0) {
100 pr_err("%s: usb_control_msg failed (%d)\n", __func__, ret);
101 return ret;
104 return 0;
107 static int sq905c_read(struct gspca_dev *gspca_dev, u16 command, u16 index,
108 int size)
110 int ret;
112 ret = usb_control_msg(gspca_dev->dev,
113 usb_rcvctrlpipe(gspca_dev->dev, 0),
114 USB_REQ_SYNCH_FRAME, /* request */
115 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
116 command, index, gspca_dev->usb_buf, size,
117 SQ905C_CMD_TIMEOUT);
118 if (ret < 0) {
119 pr_err("%s: usb_control_msg failed (%d)\n", __func__, ret);
120 return ret;
123 return 0;
126 /* This function is called as a workqueue function and runs whenever the camera
127 * is streaming data. Because it is a workqueue function it is allowed to sleep
128 * so we can use synchronous USB calls. To avoid possible collisions with other
129 * threads attempting to use the camera's USB interface the gspca usb_lock is
130 * used when performing the one USB control operation inside the workqueue,
131 * which tells the camera to close the stream. In practice the only thing
132 * which needs to be protected against is the usb_set_interface call that
133 * gspca makes during stream_off. Otherwise the camera doesn't provide any
134 * controls that the user could try to change.
136 static void sq905c_dostream(struct work_struct *work)
138 struct sd *dev = container_of(work, struct sd, work_struct);
139 struct gspca_dev *gspca_dev = &dev->gspca_dev;
140 int bytes_left; /* bytes remaining in current frame. */
141 int data_len; /* size to use for the next read. */
142 int act_len;
143 int packet_type;
144 int ret;
145 u8 *buffer;
147 buffer = kmalloc(SQ905C_MAX_TRANSFER, GFP_KERNEL | GFP_DMA);
148 if (!buffer) {
149 pr_err("Couldn't allocate USB buffer\n");
150 goto quit_stream;
153 while (gspca_dev->present && gspca_dev->streaming) {
154 /* Request the header, which tells the size to download */
155 ret = usb_bulk_msg(gspca_dev->dev,
156 usb_rcvbulkpipe(gspca_dev->dev, 0x81),
157 buffer, FRAME_HEADER_LEN, &act_len,
158 SQ905C_DATA_TIMEOUT);
159 PDEBUG(D_STREAM,
160 "Got %d bytes out of %d for header",
161 act_len, FRAME_HEADER_LEN);
162 if (ret < 0 || act_len < FRAME_HEADER_LEN)
163 goto quit_stream;
164 /* size is read from 4 bytes starting 0x40, little endian */
165 bytes_left = buffer[0x40]|(buffer[0x41]<<8)|(buffer[0x42]<<16)
166 |(buffer[0x43]<<24);
167 PDEBUG(D_STREAM, "bytes_left = 0x%x", bytes_left);
168 /* We keep the header. It has other information, too. */
169 packet_type = FIRST_PACKET;
170 gspca_frame_add(gspca_dev, packet_type,
171 buffer, FRAME_HEADER_LEN);
172 while (bytes_left > 0 && gspca_dev->present) {
173 data_len = bytes_left > SQ905C_MAX_TRANSFER ?
174 SQ905C_MAX_TRANSFER : bytes_left;
175 ret = usb_bulk_msg(gspca_dev->dev,
176 usb_rcvbulkpipe(gspca_dev->dev, 0x81),
177 buffer, data_len, &act_len,
178 SQ905C_DATA_TIMEOUT);
179 if (ret < 0 || act_len < data_len)
180 goto quit_stream;
181 PDEBUG(D_STREAM,
182 "Got %d bytes out of %d for frame",
183 data_len, bytes_left);
184 bytes_left -= data_len;
185 if (bytes_left == 0)
186 packet_type = LAST_PACKET;
187 else
188 packet_type = INTER_PACKET;
189 gspca_frame_add(gspca_dev, packet_type,
190 buffer, data_len);
193 quit_stream:
194 if (gspca_dev->present) {
195 mutex_lock(&gspca_dev->usb_lock);
196 sq905c_command(gspca_dev, SQ905C_CLEAR, 0);
197 mutex_unlock(&gspca_dev->usb_lock);
199 kfree(buffer);
202 /* This function is called at probe time just before sd_init */
203 static int sd_config(struct gspca_dev *gspca_dev,
204 const struct usb_device_id *id)
206 struct cam *cam = &gspca_dev->cam;
207 struct sd *dev = (struct sd *) gspca_dev;
208 int ret;
210 PDEBUG(D_PROBE,
211 "SQ9050 camera detected"
212 " (vid/pid 0x%04X:0x%04X)", id->idVendor, id->idProduct);
214 ret = sq905c_command(gspca_dev, SQ905C_GET_ID, 0);
215 if (ret < 0) {
216 PDEBUG(D_ERR, "Get version command failed");
217 return ret;
220 ret = sq905c_read(gspca_dev, 0xf5, 0, 20);
221 if (ret < 0) {
222 PDEBUG(D_ERR, "Reading version command failed");
223 return ret;
225 /* Note we leave out the usb id and the manufacturing date */
226 PDEBUG(D_PROBE,
227 "SQ9050 ID string: %02x - %02x %02x %02x %02x %02x %02x",
228 gspca_dev->usb_buf[3],
229 gspca_dev->usb_buf[14], gspca_dev->usb_buf[15],
230 gspca_dev->usb_buf[16], gspca_dev->usb_buf[17],
231 gspca_dev->usb_buf[18], gspca_dev->usb_buf[19]);
233 cam->cam_mode = sq905c_mode;
234 cam->nmodes = 2;
235 if (gspca_dev->usb_buf[15] == 0)
236 cam->nmodes = 1;
237 /* We don't use the buffer gspca allocates so make it small. */
238 cam->bulk_size = 32;
239 cam->bulk = 1;
240 INIT_WORK(&dev->work_struct, sq905c_dostream);
241 return 0;
244 /* called on streamoff with alt==0 and on disconnect */
245 /* the usb_lock is held at entry - restore on exit */
246 static void sd_stop0(struct gspca_dev *gspca_dev)
248 struct sd *dev = (struct sd *) gspca_dev;
250 /* wait for the work queue to terminate */
251 mutex_unlock(&gspca_dev->usb_lock);
252 /* This waits for sq905c_dostream to finish */
253 destroy_workqueue(dev->work_thread);
254 dev->work_thread = NULL;
255 mutex_lock(&gspca_dev->usb_lock);
258 /* this function is called at probe and resume time */
259 static int sd_init(struct gspca_dev *gspca_dev)
261 int ret;
263 /* connect to the camera and reset it. */
264 ret = sq905c_command(gspca_dev, SQ905C_CLEAR, 0);
265 return ret;
268 /* Set up for getting frames. */
269 static int sd_start(struct gspca_dev *gspca_dev)
271 struct sd *dev = (struct sd *) gspca_dev;
272 int ret;
274 dev->cap_mode = gspca_dev->cam.cam_mode;
275 /* "Open the shutter" and set size, to start capture */
276 switch (gspca_dev->width) {
277 case 640:
278 PDEBUG(D_STREAM, "Start streaming at high resolution");
279 dev->cap_mode++;
280 ret = sq905c_command(gspca_dev, SQ905C_CAPTURE_HI,
281 SQ905C_CAPTURE_INDEX);
282 break;
283 default: /* 320 */
284 PDEBUG(D_STREAM, "Start streaming at medium resolution");
285 ret = sq905c_command(gspca_dev, SQ905C_CAPTURE_MED,
286 SQ905C_CAPTURE_INDEX);
289 if (ret < 0) {
290 PDEBUG(D_ERR, "Start streaming command failed");
291 return ret;
293 /* Start the workqueue function to do the streaming */
294 dev->work_thread = create_singlethread_workqueue(MODULE_NAME);
295 queue_work(dev->work_thread, &dev->work_struct);
297 return 0;
300 /* Table of supported USB devices */
301 static const struct usb_device_id device_table[] = {
302 {USB_DEVICE(0x2770, 0x905c)},
303 {USB_DEVICE(0x2770, 0x9050)},
304 {USB_DEVICE(0x2770, 0x9051)},
305 {USB_DEVICE(0x2770, 0x9052)},
306 {USB_DEVICE(0x2770, 0x913d)},
310 MODULE_DEVICE_TABLE(usb, device_table);
312 /* sub-driver description */
313 static const struct sd_desc sd_desc = {
314 .name = MODULE_NAME,
315 .config = sd_config,
316 .init = sd_init,
317 .start = sd_start,
318 .stop0 = sd_stop0,
321 /* -- device connect -- */
322 static int sd_probe(struct usb_interface *intf,
323 const struct usb_device_id *id)
325 return gspca_dev_probe(intf, id,
326 &sd_desc,
327 sizeof(struct sd),
328 THIS_MODULE);
331 static struct usb_driver sd_driver = {
332 .name = MODULE_NAME,
333 .id_table = device_table,
334 .probe = sd_probe,
335 .disconnect = gspca_disconnect,
336 #ifdef CONFIG_PM
337 .suspend = gspca_suspend,
338 .resume = gspca_resume,
339 #endif
342 module_usb_driver(sd_driver);