?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Avoid beyond bounds copy while caching ACL
[zen-stable.git] / drivers / media / video / gspca / stv06xx / stv06xx.c
blob91d99b4cc57bf69afca371e70e0b5527abd1625d
1 /*
2 * Copyright (c) 2001 Jean-Fredric Clere, Nikolas Zimmermann, Georg Acher
3 * Mark Cave-Ayland, Carlo E Prelz, Dick Streefland
4 * Copyright (c) 2002, 2003 Tuukka Toivonen
5 * Copyright (c) 2008 Erik Andrén
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 *
21 * P/N 861037: Sensor HDCS1000 ASIC STV0600
22 * P/N 861050-0010: Sensor HDCS1000 ASIC STV0600
23 * P/N 861050-0020: Sensor Photobit PB100 ASIC STV0600-1 - QuickCam Express
24 * P/N 861055: Sensor ST VV6410 ASIC STV0610 - LEGO cam
25 * P/N 861075-0040: Sensor HDCS1000 ASIC
26 * P/N 961179-0700: Sensor ST VV6410 ASIC STV0602 - Dexxa WebCam USB
27 * P/N 861040-0000: Sensor ST VV6410 ASIC STV0610 - QuickCam Web
28 */
29
30 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
31
32 #include <linux/input.h>
33 #include "stv06xx_sensor.h"
34
35 MODULE_AUTHOR("Erik Andrén");
36 MODULE_DESCRIPTION("STV06XX USB Camera Driver");
37 MODULE_LICENSE("GPL");
38
39 static bool dump_bridge;
40 static bool dump_sensor;
41
42 int stv06xx_write_bridge(struct sd *sd, u16 address, u16 i2c_data)
43 {
44 int err;
45 struct usb_device *udev = sd->gspca_dev.dev;
46 __u8 *buf = sd->gspca_dev.usb_buf;
47 u8 len = (i2c_data > 0xff) ? 2 : 1;
48
49 buf[0] = i2c_data & 0xff;
50 buf[1] = (i2c_data >> 8) & 0xff;
51
52 err = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
53 0x04, 0x40, address, 0, buf, len,
54 STV06XX_URB_MSG_TIMEOUT);
55
56 PDEBUG(D_CONF, "Written 0x%x to address 0x%x, status: %d",
57 i2c_data, address, err);
58
59 return (err < 0) ? err : 0;
60 }
61
62 int stv06xx_read_bridge(struct sd *sd, u16 address, u8 *i2c_data)
63 {
64 int err;
65 struct usb_device *udev = sd->gspca_dev.dev;
66 __u8 *buf = sd->gspca_dev.usb_buf;
67
68 err = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
69 0x04, 0xc0, address, 0, buf, 1,
70 STV06XX_URB_MSG_TIMEOUT);
71
72 *i2c_data = buf[0];
73
74 PDEBUG(D_CONF, "Reading 0x%x from address 0x%x, status %d",
75 *i2c_data, address, err);
76
77 return (err < 0) ? err : 0;
78 }
79
80 /* Wraps the normal write sensor bytes / words functions for writing a
81 single value */
82 int stv06xx_write_sensor(struct sd *sd, u8 address, u16 value)
83 {
84 if (sd->sensor->i2c_len == 2) {
85 u16 data[2] = { address, value };
86 return stv06xx_write_sensor_words(sd, data, 1);
87 } else {
88 u8 data[2] = { address, value };
89 return stv06xx_write_sensor_bytes(sd, data, 1);
90 }
91 }
92
93 static int stv06xx_write_sensor_finish(struct sd *sd)
94 {
95 int err = 0;
96
97 if (sd->bridge == BRIDGE_STV610) {
98 struct usb_device *udev = sd->gspca_dev.dev;
99 __u8 *buf = sd->gspca_dev.usb_buf;
100
101 buf[0] = 0;
102 err = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
103 0x04, 0x40, 0x1704, 0, buf, 1,
104 STV06XX_URB_MSG_TIMEOUT);
105 }
106
107 return (err < 0) ? err : 0;
108 }
109
110 int stv06xx_write_sensor_bytes(struct sd *sd, const u8 *data, u8 len)
111 {
112 int err, i, j;
113 struct usb_device *udev = sd->gspca_dev.dev;
114 __u8 *buf = sd->gspca_dev.usb_buf;
115
116 PDEBUG(D_CONF, "I2C: Command buffer contains %d entries", len);
117 for (i = 0; i < len;) {
118 /* Build the command buffer */
119 memset(buf, 0, I2C_BUFFER_LENGTH);
120 for (j = 0; j < I2C_MAX_BYTES && i < len; j++, i++) {
121 buf[j] = data[2*i];
122 buf[0x10 + j] = data[2*i+1];
123 PDEBUG(D_CONF, "I2C: Writing 0x%02x to reg 0x%02x",
124 data[2*i+1], data[2*i]);
125 }
126 buf[0x20] = sd->sensor->i2c_addr;
127 buf[0x21] = j - 1; /* Number of commands to send - 1 */
128 buf[0x22] = I2C_WRITE_CMD;
129 err = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
130 0x04, 0x40, 0x0400, 0, buf,
131 I2C_BUFFER_LENGTH,
132 STV06XX_URB_MSG_TIMEOUT);
133 if (err < 0)
134 return err;
135 }
136 return stv06xx_write_sensor_finish(sd);
137 }
138
139 int stv06xx_write_sensor_words(struct sd *sd, const u16 *data, u8 len)
140 {
141 int err, i, j;
142 struct usb_device *udev = sd->gspca_dev.dev;
143 __u8 *buf = sd->gspca_dev.usb_buf;
144
145 PDEBUG(D_CONF, "I2C: Command buffer contains %d entries", len);
146
147 for (i = 0; i < len;) {
148 /* Build the command buffer */
149 memset(buf, 0, I2C_BUFFER_LENGTH);
150 for (j = 0; j < I2C_MAX_WORDS && i < len; j++, i++) {
151 buf[j] = data[2*i];
152 buf[0x10 + j * 2] = data[2*i+1];
153 buf[0x10 + j * 2 + 1] = data[2*i+1] >> 8;
154 PDEBUG(D_CONF, "I2C: Writing 0x%04x to reg 0x%02x",
155 data[2*i+1], data[2*i]);
156 }
157 buf[0x20] = sd->sensor->i2c_addr;
158 buf[0x21] = j - 1; /* Number of commands to send - 1 */
159 buf[0x22] = I2C_WRITE_CMD;
160 err = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
161 0x04, 0x40, 0x0400, 0, buf,
162 I2C_BUFFER_LENGTH,
163 STV06XX_URB_MSG_TIMEOUT);
164 if (err < 0)
165 return err;
166 }
167 return stv06xx_write_sensor_finish(sd);
168 }
169
170 int stv06xx_read_sensor(struct sd *sd, const u8 address, u16 *value)
171 {
172 int err;
173 struct usb_device *udev = sd->gspca_dev.dev;
174 __u8 *buf = sd->gspca_dev.usb_buf;
175
176 err = stv06xx_write_bridge(sd, STV_I2C_FLUSH, sd->sensor->i2c_flush);
177 if (err < 0)
178 return err;
179
180 /* Clear mem */
181 memset(buf, 0, I2C_BUFFER_LENGTH);
182
183 buf[0] = address;
184 buf[0x20] = sd->sensor->i2c_addr;
185 buf[0x21] = 0;
186
187 /* Read I2C register */
188 buf[0x22] = I2C_READ_CMD;
189
190 err = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
191 0x04, 0x40, 0x1400, 0, buf, I2C_BUFFER_LENGTH,
192 STV06XX_URB_MSG_TIMEOUT);
193 if (err < 0) {
194 pr_err("I2C: Read error writing address: %d\n", err);
195 return err;
196 }
197
198 err = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
199 0x04, 0xc0, 0x1410, 0, buf, sd->sensor->i2c_len,
200 STV06XX_URB_MSG_TIMEOUT);
201 if (sd->sensor->i2c_len == 2)
202 *value = buf[0] | (buf[1] << 8);
203 else
204 *value = buf[0];
205
206 PDEBUG(D_CONF, "I2C: Read 0x%x from address 0x%x, status: %d",
207 *value, address, err);
208
209 return (err < 0) ? err : 0;
210 }
211
212 /* Dumps all bridge registers */
213 static void stv06xx_dump_bridge(struct sd *sd)
214 {
215 int i;
216 u8 data, buf;
217
218 pr_info("Dumping all stv06xx bridge registers\n");
219 for (i = 0x1400; i < 0x160f; i++) {
220 stv06xx_read_bridge(sd, i, &data);
221
222 pr_info("Read 0x%x from address 0x%x\n", data, i);
223 }
224
225 pr_info("Testing stv06xx bridge registers for writability\n");
226 for (i = 0x1400; i < 0x160f; i++) {
227 stv06xx_read_bridge(sd, i, &data);
228 buf = data;
229
230 stv06xx_write_bridge(sd, i, 0xff);
231 stv06xx_read_bridge(sd, i, &data);
232 if (data == 0xff)
233 pr_info("Register 0x%x is read/write\n", i);
234 else if (data != buf)
235 pr_info("Register 0x%x is read/write, but only partially\n",
236 i);
237 else
238 pr_info("Register 0x%x is read-only\n", i);
239
240 stv06xx_write_bridge(sd, i, buf);
241 }
242 }
243
244 /* this function is called at probe and resume time */
245 static int stv06xx_init(struct gspca_dev *gspca_dev)
246 {
247 struct sd *sd = (struct sd *) gspca_dev;
248 int err;
249
250 PDEBUG(D_PROBE, "Initializing camera");
251
252 /* Let the usb init settle for a bit
253 before performing the initialization */
254 msleep(250);
255
256 err = sd->sensor->init(sd);
257
258 if (dump_sensor && sd->sensor->dump)
259 sd->sensor->dump(sd);
260
261 return (err < 0) ? err : 0;
262 }
263
264 /* Start the camera */
265 static int stv06xx_start(struct gspca_dev *gspca_dev)
266 {
267 struct sd *sd = (struct sd *) gspca_dev;
268 struct usb_host_interface *alt;
269 struct usb_interface *intf;
270 int err, packet_size;
271
272 intf = usb_ifnum_to_if(sd->gspca_dev.dev, sd->gspca_dev.iface);
273 alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt);
274 if (!alt) {
275 PDEBUG(D_ERR, "Couldn't get altsetting");
276 return -EIO;
277 }
278
279 packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
280 err = stv06xx_write_bridge(sd, STV_ISO_SIZE_L, packet_size);
281 if (err < 0)
282 return err;
283
284 /* Prepare the sensor for start */
285 err = sd->sensor->start(sd);
286 if (err < 0)
287 goto out;
288
289 /* Start isochronous streaming */
290 err = stv06xx_write_bridge(sd, STV_ISO_ENABLE, 1);
291
292 out:
293 if (err < 0)
294 PDEBUG(D_STREAM, "Starting stream failed");
295 else
296 PDEBUG(D_STREAM, "Started streaming");
297
298 return (err < 0) ? err : 0;
299 }
300
301 static int stv06xx_isoc_init(struct gspca_dev *gspca_dev)
302 {
303 struct usb_host_interface *alt;
304 struct sd *sd = (struct sd *) gspca_dev;
305
306 /* Start isoc bandwidth "negotiation" at max isoc bandwidth */
307 alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
308 alt->endpoint[0].desc.wMaxPacketSize =
309 cpu_to_le16(sd->sensor->max_packet_size[gspca_dev->curr_mode]);
310
311 return 0;
312 }
313
314 static int stv06xx_isoc_nego(struct gspca_dev *gspca_dev)
315 {
316 int ret, packet_size, min_packet_size;
317 struct usb_host_interface *alt;
318 struct sd *sd = (struct sd *) gspca_dev;
319
320 alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
321 packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
322 min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode];
323 if (packet_size <= min_packet_size)
324 return -EIO;
325
326 packet_size -= 100;
327 if (packet_size < min_packet_size)
328 packet_size = min_packet_size;
329 alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(packet_size);
330
331 ret = usb_set_interface(gspca_dev->dev, gspca_dev->iface, 1);
332 if (ret < 0)
333 PDEBUG(D_ERR|D_STREAM, "set alt 1 err %d", ret);
334
335 return ret;
336 }
337
338 static void stv06xx_stopN(struct gspca_dev *gspca_dev)
339 {
340 int err;
341 struct sd *sd = (struct sd *) gspca_dev;
342
343 /* stop ISO-streaming */
344 err = stv06xx_write_bridge(sd, STV_ISO_ENABLE, 0);
345 if (err < 0)
346 goto out;
347
348 err = sd->sensor->stop(sd);
349
350 out:
351 if (err < 0)
352 PDEBUG(D_STREAM, "Failed to stop stream");
353 else
354 PDEBUG(D_STREAM, "Stopped streaming");
355 }
356
357 /*
358 * Analyse an USB packet of the data stream and store it appropriately.
359 * Each packet contains an integral number of chunks. Each chunk has
360 * 2-bytes identification, followed by 2-bytes that describe the chunk
361 * length. Known/guessed chunk identifications are:
362 * 8001/8005/C001/C005 - Begin new frame
363 * 8002/8006/C002/C006 - End frame
364 * 0200/4200 - Contains actual image data, bayer or compressed
365 * 0005 - 11 bytes of unknown data
366 * 0100 - 2 bytes of unknown data
367 * The 0005 and 0100 chunks seem to appear only in compressed stream.
368 */
369 static void stv06xx_pkt_scan(struct gspca_dev *gspca_dev,
370 u8 *data, /* isoc packet */
371 int len) /* iso packet length */
372 {
373 struct sd *sd = (struct sd *) gspca_dev;
374
375 PDEBUG(D_PACK, "Packet of length %d arrived", len);
376
377 /* A packet may contain several frames
378 loop until the whole packet is reached */
379 while (len) {
380 int id, chunk_len;
381
382 if (len < 4) {
383 PDEBUG(D_PACK, "Packet is smaller than 4 bytes");
384 return;
385 }
386
387 /* Capture the id */
388 id = (data[0] << 8) | data[1];
389
390 /* Capture the chunk length */
391 chunk_len = (data[2] << 8) | data[3];
392 PDEBUG(D_PACK, "Chunk id: %x, length: %d", id, chunk_len);
393
394 data += 4;
395 len -= 4;
396
397 if (len < chunk_len) {
398 PDEBUG(D_ERR, "URB packet length is smaller"
399 " than the specified chunk length");
400 gspca_dev->last_packet_type = DISCARD_PACKET;
401 return;
402 }
403
404 /* First byte seem to be 02=data 2nd byte is unknown??? */
405 if (sd->bridge == BRIDGE_ST6422 && (id & 0xff00) == 0x0200)
406 goto frame_data;
407
408 switch (id) {
409 case 0x0200:
410 case 0x4200:
411 frame_data:
412 PDEBUG(D_PACK, "Frame data packet detected");
413
414 if (sd->to_skip) {
415 int skip = (sd->to_skip < chunk_len) ?
416 sd->to_skip : chunk_len;
417 data += skip;
418 len -= skip;
419 chunk_len -= skip;
420 sd->to_skip -= skip;
421 }
422
423 gspca_frame_add(gspca_dev, INTER_PACKET,
424 data, chunk_len);
425 break;
426
427 case 0x8001:
428 case 0x8005:
429 case 0xc001:
430 case 0xc005:
431 PDEBUG(D_PACK, "Starting new frame");
432
433 /* Create a new frame, chunk length should be zero */
434 gspca_frame_add(gspca_dev, FIRST_PACKET,
435 NULL, 0);
436
437 if (sd->bridge == BRIDGE_ST6422)
438 sd->to_skip = gspca_dev->width * 4;
439
440 if (chunk_len)
441 PDEBUG(D_ERR, "Chunk length is "
442 "non-zero on a SOF");
443 break;
444
445 case 0x8002:
446 case 0x8006:
447 case 0xc002:
448 PDEBUG(D_PACK, "End of frame detected");
449
450 /* Complete the last frame (if any) */
451 gspca_frame_add(gspca_dev, LAST_PACKET,
452 NULL, 0);
453
454 if (chunk_len)
455 PDEBUG(D_ERR, "Chunk length is "
456 "non-zero on a EOF");
457 break;
458
459 case 0x0005:
460 PDEBUG(D_PACK, "Chunk 0x005 detected");
461 /* Unknown chunk with 11 bytes of data,
462 occurs just before end of each frame
463 in compressed mode */
464 break;
465
466 case 0x0100:
467 PDEBUG(D_PACK, "Chunk 0x0100 detected");
468 /* Unknown chunk with 2 bytes of data,
469 occurs 2-3 times per USB interrupt */
470 break;
471 case 0x42ff:
472 PDEBUG(D_PACK, "Chunk 0x42ff detected");
473 /* Special chunk seen sometimes on the ST6422 */
474 break;
475 default:
476 PDEBUG(D_PACK, "Unknown chunk 0x%04x detected", id);
477 /* Unknown chunk */
478 }
479 data += chunk_len;
480 len -= chunk_len;
481 }
482 }
483
484 #if defined(CONFIG_INPUT) || defined(CONFIG_INPUT_MODULE)
485 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
486 u8 *data, /* interrupt packet data */
487 int len) /* interrupt packet length */
488 {
489 int ret = -EINVAL;
490
491 if (len == 1 && data[0] == 0x80) {
492 input_report_key(gspca_dev->input_dev, KEY_CAMERA, 1);
493 input_sync(gspca_dev->input_dev);
494 ret = 0;
495 }
496
497 if (len == 1 && data[0] == 0x88) {
498 input_report_key(gspca_dev->input_dev, KEY_CAMERA, 0);
499 input_sync(gspca_dev->input_dev);
500 ret = 0;
501 }
502
503 return ret;
504 }
505 #endif
506
507 static int stv06xx_config(struct gspca_dev *gspca_dev,
508 const struct usb_device_id *id);
509
510 /* sub-driver description */
511 static const struct sd_desc sd_desc = {
512 .name = MODULE_NAME,
513 .config = stv06xx_config,
514 .init = stv06xx_init,
515 .start = stv06xx_start,
516 .stopN = stv06xx_stopN,
517 .pkt_scan = stv06xx_pkt_scan,
518 .isoc_init = stv06xx_isoc_init,
519 .isoc_nego = stv06xx_isoc_nego,
520 #if defined(CONFIG_INPUT) || defined(CONFIG_INPUT_MODULE)
521 .int_pkt_scan = sd_int_pkt_scan,
522 #endif
523 };
524
525 /* This function is called at probe time */
526 static int stv06xx_config(struct gspca_dev *gspca_dev,
527 const struct usb_device_id *id)
528 {
529 struct sd *sd = (struct sd *) gspca_dev;
530
531 PDEBUG(D_PROBE, "Configuring camera");
532
533 sd->desc = sd_desc;
534 sd->bridge = id->driver_info;
535 gspca_dev->sd_desc = &sd->desc;
536
537 if (dump_bridge)
538 stv06xx_dump_bridge(sd);
539
540 sd->sensor = &stv06xx_sensor_st6422;
541 if (!sd->sensor->probe(sd))
542 return 0;
543
544 sd->sensor = &stv06xx_sensor_vv6410;
545 if (!sd->sensor->probe(sd))
546 return 0;
547
548 sd->sensor = &stv06xx_sensor_hdcs1x00;
549 if (!sd->sensor->probe(sd))
550 return 0;
551
552 sd->sensor = &stv06xx_sensor_hdcs1020;
553 if (!sd->sensor->probe(sd))
554 return 0;
555
556 sd->sensor = &stv06xx_sensor_pb0100;
557 if (!sd->sensor->probe(sd))
558 return 0;
559
560 sd->sensor = NULL;
561 return -ENODEV;
562 }
563
564
565
566 /* -- module initialisation -- */
567 static const struct usb_device_id device_table[] = {
568 /* QuickCam Express */
569 {USB_DEVICE(0x046d, 0x0840), .driver_info = BRIDGE_STV600 },
570 /* LEGO cam / QuickCam Web */
571 {USB_DEVICE(0x046d, 0x0850), .driver_info = BRIDGE_STV610 },
572 /* Dexxa WebCam USB */
573 {USB_DEVICE(0x046d, 0x0870), .driver_info = BRIDGE_STV602 },
574 /* QuickCam Messenger */
575 {USB_DEVICE(0x046D, 0x08F0), .driver_info = BRIDGE_ST6422 },
576 /* QuickCam Communicate */
577 {USB_DEVICE(0x046D, 0x08F5), .driver_info = BRIDGE_ST6422 },
578 /* QuickCam Messenger (new) */
579 {USB_DEVICE(0x046D, 0x08F6), .driver_info = BRIDGE_ST6422 },
580 {}
581 };
582 MODULE_DEVICE_TABLE(usb, device_table);
583
584 /* -- device connect -- */
585 static int sd_probe(struct usb_interface *intf,
586 const struct usb_device_id *id)
587 {
588 PDEBUG(D_PROBE, "Probing for a stv06xx device");
589 return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
590 THIS_MODULE);
591 }
592
593 static void sd_disconnect(struct usb_interface *intf)
594 {
595 struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
596 struct sd *sd = (struct sd *) gspca_dev;
597 PDEBUG(D_PROBE, "Disconnecting the stv06xx device");
598
599 if (sd->sensor->disconnect)
600 sd->sensor->disconnect(sd);
601 gspca_disconnect(intf);
602 }
603
604 static struct usb_driver sd_driver = {
605 .name = MODULE_NAME,
606 .id_table = device_table,
607 .probe = sd_probe,
608 .disconnect = sd_disconnect,
609 #ifdef CONFIG_PM
610 .suspend = gspca_suspend,
611 .resume = gspca_resume,
612 #endif
613 };
614
615 module_usb_driver(sd_driver);
616
617 module_param(dump_bridge, bool, S_IRUGO | S_IWUSR);
618 MODULE_PARM_DESC(dump_bridge, "Dumps all usb bridge registers at startup");
619
620 module_param(dump_sensor, bool, S_IRUGO | S_IWUSR);
621 MODULE_PARM_DESC(dump_sensor, "Dumps all sensor registers at startup");