Avoid beyond bounds copy while caching ACL
[zen-stable.git] / drivers / media / video / gspca / vicam.c
blob911152e169d6d43c4a42dd47fffa0542dd1e96f9
1 /*
2 * gspca ViCam subdriver
4 * Copyright (C) 2011 Hans de Goede <hdegoede@redhat.com>
6 * Based on the usbvideo vicam driver, which is:
8 * Copyright (c) 2002 Joe Burks (jburks@wavicle.org),
9 * Christopher L Cheney (ccheney@cheney.cx),
10 * Pavel Machek (pavel@ucw.cz),
11 * John Tyner (jtyner@cs.ucr.edu),
12 * Monroe Williams (monroe@pobox.com)
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
26 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
29 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
31 #define MODULE_NAME "vicam"
32 #define HEADER_SIZE 64
34 #include <linux/workqueue.h>
35 #include <linux/slab.h>
36 #include <linux/firmware.h>
37 #include <linux/ihex.h>
38 #include "gspca.h"
40 MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
41 MODULE_DESCRIPTION("GSPCA ViCam USB Camera Driver");
42 MODULE_LICENSE("GPL");
44 enum e_ctrl {
45 GAIN,
46 EXPOSURE,
47 NCTRL /* number of controls */
50 struct sd {
51 struct gspca_dev gspca_dev; /* !! must be the first item */
52 struct work_struct work_struct;
53 struct workqueue_struct *work_thread;
54 struct gspca_ctrl ctrls[NCTRL];
57 /* The vicam sensor has a resolution of 512 x 244, with I believe square
58 pixels, but this is forced to a 4:3 ratio by optics. So it has
59 non square pixels :( */
60 static struct v4l2_pix_format vicam_mode[] = {
61 { 256, 122, V4L2_PIX_FMT_SGRBG8, V4L2_FIELD_NONE,
62 .bytesperline = 256,
63 .sizeimage = 256 * 122,
64 .colorspace = V4L2_COLORSPACE_SRGB,},
65 /* 2 modes with somewhat more square pixels */
66 { 256, 200, V4L2_PIX_FMT_SGRBG8, V4L2_FIELD_NONE,
67 .bytesperline = 256,
68 .sizeimage = 256 * 200,
69 .colorspace = V4L2_COLORSPACE_SRGB,},
70 { 256, 240, V4L2_PIX_FMT_SGRBG8, V4L2_FIELD_NONE,
71 .bytesperline = 256,
72 .sizeimage = 256 * 240,
73 .colorspace = V4L2_COLORSPACE_SRGB,},
74 #if 0 /* This mode has extremely non square pixels, testing use only */
75 { 512, 122, V4L2_PIX_FMT_SGRBG8, V4L2_FIELD_NONE,
76 .bytesperline = 512,
77 .sizeimage = 512 * 122,
78 .colorspace = V4L2_COLORSPACE_SRGB,},
79 #endif
80 { 512, 244, V4L2_PIX_FMT_SGRBG8, V4L2_FIELD_NONE,
81 .bytesperline = 512,
82 .sizeimage = 512 * 244,
83 .colorspace = V4L2_COLORSPACE_SRGB,},
86 static const struct ctrl sd_ctrls[] = {
87 [GAIN] = {
89 .id = V4L2_CID_GAIN,
90 .type = V4L2_CTRL_TYPE_INTEGER,
91 .name = "Gain",
92 .minimum = 0,
93 .maximum = 255,
94 .step = 1,
95 .default_value = 200,
98 [EXPOSURE] = {
100 .id = V4L2_CID_EXPOSURE,
101 .type = V4L2_CTRL_TYPE_INTEGER,
102 .name = "Exposure",
103 .minimum = 0,
104 .maximum = 2047,
105 .step = 1,
106 .default_value = 256,
111 static int vicam_control_msg(struct gspca_dev *gspca_dev, u8 request,
112 u16 value, u16 index, u8 *data, u16 len)
114 int ret;
116 ret = usb_control_msg(gspca_dev->dev,
117 usb_sndctrlpipe(gspca_dev->dev, 0),
118 request,
119 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
120 value, index, data, len, 1000);
121 if (ret < 0)
122 pr_err("control msg req %02X error %d\n", request, ret);
124 return ret;
127 static int vicam_set_camera_power(struct gspca_dev *gspca_dev, int state)
129 int ret;
131 ret = vicam_control_msg(gspca_dev, 0x50, state, 0, NULL, 0);
132 if (ret < 0)
133 return ret;
135 if (state)
136 ret = vicam_control_msg(gspca_dev, 0x55, 1, 0, NULL, 0);
138 return ret;
142 * request and read a block of data - see warning on vicam_command.
144 static int vicam_read_frame(struct gspca_dev *gspca_dev, u8 *data, int size)
146 struct sd *sd = (struct sd *)gspca_dev;
147 int ret, unscaled_height, act_len = 0;
148 u8 *req_data = gspca_dev->usb_buf;
150 memset(req_data, 0, 16);
151 req_data[0] = sd->ctrls[GAIN].val;
152 if (gspca_dev->width == 256)
153 req_data[1] |= 0x01; /* low nibble x-scale */
154 if (gspca_dev->height <= 122) {
155 req_data[1] |= 0x10; /* high nibble y-scale */
156 unscaled_height = gspca_dev->height * 2;
157 } else
158 unscaled_height = gspca_dev->height;
159 req_data[2] = 0x90; /* unknown, does not seem to do anything */
160 if (unscaled_height <= 200)
161 req_data[3] = 0x06; /* vend? */
162 else if (unscaled_height <= 242) /* Yes 242 not 240 */
163 req_data[3] = 0x07; /* vend? */
164 else /* Up to 244 lines with req_data[3] == 0x08 */
165 req_data[3] = 0x08; /* vend? */
167 if (sd->ctrls[EXPOSURE].val < 256) {
168 /* Frame rate maxed out, use partial frame expo time */
169 req_data[4] = 255 - sd->ctrls[EXPOSURE].val;
170 req_data[5] = 0x00;
171 req_data[6] = 0x00;
172 req_data[7] = 0x01;
173 } else {
174 /* Modify frame rate */
175 req_data[4] = 0x00;
176 req_data[5] = 0x00;
177 req_data[6] = sd->ctrls[EXPOSURE].val & 0xFF;
178 req_data[7] = sd->ctrls[EXPOSURE].val >> 8;
180 req_data[8] = ((244 - unscaled_height) / 2) & ~0x01; /* vstart */
181 /* bytes 9-15 do not seem to affect exposure or image quality */
183 mutex_lock(&gspca_dev->usb_lock);
184 ret = vicam_control_msg(gspca_dev, 0x51, 0x80, 0, req_data, 16);
185 mutex_unlock(&gspca_dev->usb_lock);
186 if (ret < 0)
187 return ret;
189 ret = usb_bulk_msg(gspca_dev->dev,
190 usb_rcvbulkpipe(gspca_dev->dev, 0x81),
191 data, size, &act_len, 10000);
192 /* successful, it returns 0, otherwise negative */
193 if (ret < 0 || act_len != size) {
194 pr_err("bulk read fail (%d) len %d/%d\n",
195 ret, act_len, size);
196 return -EIO;
198 return 0;
201 /* This function is called as a workqueue function and runs whenever the camera
202 * is streaming data. Because it is a workqueue function it is allowed to sleep
203 * so we can use synchronous USB calls. To avoid possible collisions with other
204 * threads attempting to use the camera's USB interface we take the gspca
205 * usb_lock when performing USB operations. In practice the only thing we need
206 * to protect against is the usb_set_interface call that gspca makes during
207 * stream_off as the camera doesn't provide any controls that the user could try
208 * to change.
210 static void vicam_dostream(struct work_struct *work)
212 struct sd *sd = container_of(work, struct sd, work_struct);
213 struct gspca_dev *gspca_dev = &sd->gspca_dev;
214 int ret, frame_sz;
215 u8 *buffer;
217 frame_sz = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].sizeimage +
218 HEADER_SIZE;
219 buffer = kmalloc(frame_sz, GFP_KERNEL | GFP_DMA);
220 if (!buffer) {
221 pr_err("Couldn't allocate USB buffer\n");
222 goto exit;
225 while (gspca_dev->present && gspca_dev->streaming) {
226 ret = vicam_read_frame(gspca_dev, buffer, frame_sz);
227 if (ret < 0)
228 break;
230 /* Note the frame header contents seem to be completely
231 constant, they do not change with either image, or
232 settings. So we simply discard it. The frames have
233 a very similar 64 byte footer, which we don't even
234 bother reading from the cam */
235 gspca_frame_add(gspca_dev, FIRST_PACKET,
236 buffer + HEADER_SIZE,
237 frame_sz - HEADER_SIZE);
238 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
240 exit:
241 kfree(buffer);
244 /* This function is called at probe time just before sd_init */
245 static int sd_config(struct gspca_dev *gspca_dev,
246 const struct usb_device_id *id)
248 struct cam *cam = &gspca_dev->cam;
249 struct sd *sd = (struct sd *)gspca_dev;
251 /* We don't use the buffer gspca allocates so make it small. */
252 cam->bulk = 1;
253 cam->bulk_size = 64;
254 cam->cam_mode = vicam_mode;
255 cam->nmodes = ARRAY_SIZE(vicam_mode);
256 cam->ctrls = sd->ctrls;
258 INIT_WORK(&sd->work_struct, vicam_dostream);
260 return 0;
263 /* this function is called at probe and resume time */
264 static int sd_init(struct gspca_dev *gspca_dev)
266 int ret;
267 const struct ihex_binrec *rec;
268 const struct firmware *uninitialized_var(fw);
269 u8 *firmware_buf;
271 ret = request_ihex_firmware(&fw, "vicam/firmware.fw",
272 &gspca_dev->dev->dev);
273 if (ret) {
274 pr_err("Failed to load \"vicam/firmware.fw\": %d\n", ret);
275 return ret;
278 firmware_buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
279 if (!firmware_buf) {
280 ret = -ENOMEM;
281 goto exit;
283 for (rec = (void *)fw->data; rec; rec = ihex_next_binrec(rec)) {
284 memcpy(firmware_buf, rec->data, be16_to_cpu(rec->len));
285 ret = vicam_control_msg(gspca_dev, 0xff, 0, 0, firmware_buf,
286 be16_to_cpu(rec->len));
287 if (ret < 0)
288 break;
291 kfree(firmware_buf);
292 exit:
293 release_firmware(fw);
294 return ret;
297 /* Set up for getting frames. */
298 static int sd_start(struct gspca_dev *gspca_dev)
300 struct sd *sd = (struct sd *)gspca_dev;
301 int ret;
303 ret = vicam_set_camera_power(gspca_dev, 1);
304 if (ret < 0)
305 return ret;
307 /* Start the workqueue function to do the streaming */
308 sd->work_thread = create_singlethread_workqueue(MODULE_NAME);
309 queue_work(sd->work_thread, &sd->work_struct);
311 return 0;
314 /* called on streamoff with alt==0 and on disconnect */
315 /* the usb_lock is held at entry - restore on exit */
316 static void sd_stop0(struct gspca_dev *gspca_dev)
318 struct sd *dev = (struct sd *)gspca_dev;
320 /* wait for the work queue to terminate */
321 mutex_unlock(&gspca_dev->usb_lock);
322 /* This waits for vicam_dostream to finish */
323 destroy_workqueue(dev->work_thread);
324 dev->work_thread = NULL;
325 mutex_lock(&gspca_dev->usb_lock);
327 if (gspca_dev->present)
328 vicam_set_camera_power(gspca_dev, 0);
331 /* Table of supported USB devices */
332 static const struct usb_device_id device_table[] = {
333 {USB_DEVICE(0x04c1, 0x009d)},
334 {USB_DEVICE(0x0602, 0x1001)},
338 MODULE_DEVICE_TABLE(usb, device_table);
340 /* sub-driver description */
341 static const struct sd_desc sd_desc = {
342 .name = MODULE_NAME,
343 .ctrls = sd_ctrls,
344 .nctrls = ARRAY_SIZE(sd_ctrls),
345 .config = sd_config,
346 .init = sd_init,
347 .start = sd_start,
348 .stop0 = sd_stop0,
351 /* -- device connect -- */
352 static int sd_probe(struct usb_interface *intf,
353 const struct usb_device_id *id)
355 return gspca_dev_probe(intf, id,
356 &sd_desc,
357 sizeof(struct sd),
358 THIS_MODULE);
361 static struct usb_driver sd_driver = {
362 .name = MODULE_NAME,
363 .id_table = device_table,
364 .probe = sd_probe,
365 .disconnect = gspca_disconnect,
366 #ifdef CONFIG_PM
367 .suspend = gspca_suspend,
368 .resume = gspca_resume,
369 #endif
372 module_usb_driver(sd_driver);