V4L/DVB (8207): uvcvideo: Fix a buffer overflow in format descriptor parsing
[deliverable/linux.git] / drivers / media / video / uvc / uvc_video.c
CommitLineData
c0efd232
LP
1/*
2 * uvc_video.c -- USB Video Class driver - Video handling
3 *
4 * Copyright (C) 2005-2008
5 * Laurent Pinchart (laurent.pinchart@skynet.be)
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 */
13
14#include <linux/kernel.h>
15#include <linux/version.h>
16#include <linux/list.h>
17#include <linux/module.h>
18#include <linux/usb.h>
19#include <linux/videodev2.h>
20#include <linux/vmalloc.h>
21#include <linux/wait.h>
22#include <asm/atomic.h>
23#include <asm/unaligned.h>
24
25#include <media/v4l2-common.h>
26
27#include "uvcvideo.h"
28
29/* ------------------------------------------------------------------------
30 * UVC Controls
31 */
32
33static int __uvc_query_ctrl(struct uvc_device *dev, __u8 query, __u8 unit,
34 __u8 intfnum, __u8 cs, void *data, __u16 size,
35 int timeout)
36{
37 __u8 type = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
38 unsigned int pipe;
39 int ret;
40
41 pipe = (query & 0x80) ? usb_rcvctrlpipe(dev->udev, 0)
42 : usb_sndctrlpipe(dev->udev, 0);
43 type |= (query & 0x80) ? USB_DIR_IN : USB_DIR_OUT;
44
45 ret = usb_control_msg(dev->udev, pipe, query, type, cs << 8,
46 unit << 8 | intfnum, data, size, timeout);
47
48 if (ret != size) {
49 uvc_printk(KERN_ERR, "Failed to query (%u) UVC control %u "
50 "(unit %u) : %d (exp. %u).\n", query, cs, unit, ret,
51 size);
52 return -EIO;
53 }
54
55 return 0;
56}
57
58int uvc_query_ctrl(struct uvc_device *dev, __u8 query, __u8 unit,
59 __u8 intfnum, __u8 cs, void *data, __u16 size)
60{
61 return __uvc_query_ctrl(dev, query, unit, intfnum, cs, data, size,
62 UVC_CTRL_CONTROL_TIMEOUT);
63}
64
65static void uvc_fixup_buffer_size(struct uvc_video_device *video,
66 struct uvc_streaming_control *ctrl)
67{
68 struct uvc_format *format;
69 struct uvc_frame *frame;
70
71 if (ctrl->bFormatIndex <= 0 ||
72 ctrl->bFormatIndex > video->streaming->nformats)
73 return;
74
75 format = &video->streaming->format[ctrl->bFormatIndex - 1];
76
77 if (ctrl->bFrameIndex <= 0 ||
78 ctrl->bFrameIndex > format->nframes)
79 return;
80
81 frame = &format->frame[ctrl->bFrameIndex - 1];
82
83 if (!(format->flags & UVC_FMT_FLAG_COMPRESSED) ||
84 (ctrl->dwMaxVideoFrameSize == 0 &&
85 video->dev->uvc_version < 0x0110))
86 ctrl->dwMaxVideoFrameSize =
87 frame->dwMaxVideoFrameBufferSize;
88}
89
90static int uvc_get_video_ctrl(struct uvc_video_device *video,
91 struct uvc_streaming_control *ctrl, int probe, __u8 query)
92{
93 __u8 data[34];
94 __u8 size;
95 int ret;
96
97 size = video->dev->uvc_version >= 0x0110 ? 34 : 26;
98 ret = __uvc_query_ctrl(video->dev, query, 0, video->streaming->intfnum,
99 probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, &data, size,
100 UVC_CTRL_STREAMING_TIMEOUT);
101
102 if (ret < 0)
103 return ret;
104
105 ctrl->bmHint = le16_to_cpup((__le16 *)&data[0]);
106 ctrl->bFormatIndex = data[2];
107 ctrl->bFrameIndex = data[3];
108 ctrl->dwFrameInterval = le32_to_cpup((__le32 *)&data[4]);
109 ctrl->wKeyFrameRate = le16_to_cpup((__le16 *)&data[8]);
110 ctrl->wPFrameRate = le16_to_cpup((__le16 *)&data[10]);
111 ctrl->wCompQuality = le16_to_cpup((__le16 *)&data[12]);
112 ctrl->wCompWindowSize = le16_to_cpup((__le16 *)&data[14]);
113 ctrl->wDelay = le16_to_cpup((__le16 *)&data[16]);
114 ctrl->dwMaxVideoFrameSize =
115 le32_to_cpu(get_unaligned((__le32 *)&data[18]));
116 ctrl->dwMaxPayloadTransferSize =
117 le32_to_cpu(get_unaligned((__le32 *)&data[22]));
118
119 if (size == 34) {
120 ctrl->dwClockFrequency =
121 le32_to_cpu(get_unaligned((__le32 *)&data[26]));
122 ctrl->bmFramingInfo = data[30];
123 ctrl->bPreferedVersion = data[31];
124 ctrl->bMinVersion = data[32];
125 ctrl->bMaxVersion = data[33];
126 } else {
127 ctrl->dwClockFrequency = video->dev->clock_frequency;
128 ctrl->bmFramingInfo = 0;
129 ctrl->bPreferedVersion = 0;
130 ctrl->bMinVersion = 0;
131 ctrl->bMaxVersion = 0;
132 }
133
134 /* Some broken devices return a null or wrong dwMaxVideoFrameSize.
135 * Try to get the value from the format and frame descriptor.
136 */
137 uvc_fixup_buffer_size(video, ctrl);
138
139 return 0;
140}
141
142int uvc_set_video_ctrl(struct uvc_video_device *video,
143 struct uvc_streaming_control *ctrl, int probe)
144{
145 __u8 data[34];
146 __u8 size;
147
148 size = video->dev->uvc_version >= 0x0110 ? 34 : 26;
149 memset(data, 0, sizeof data);
150
151 *(__le16 *)&data[0] = cpu_to_le16(ctrl->bmHint);
152 data[2] = ctrl->bFormatIndex;
153 data[3] = ctrl->bFrameIndex;
154 *(__le32 *)&data[4] = cpu_to_le32(ctrl->dwFrameInterval);
155 *(__le16 *)&data[8] = cpu_to_le16(ctrl->wKeyFrameRate);
156 *(__le16 *)&data[10] = cpu_to_le16(ctrl->wPFrameRate);
157 *(__le16 *)&data[12] = cpu_to_le16(ctrl->wCompQuality);
158 *(__le16 *)&data[14] = cpu_to_le16(ctrl->wCompWindowSize);
159 *(__le16 *)&data[16] = cpu_to_le16(ctrl->wDelay);
160 /* Note: Some of the fields below are not required for IN devices (see
161 * UVC spec, 4.3.1.1), but we still copy them in case support for OUT
162 * devices is added in the future. */
163 put_unaligned(cpu_to_le32(ctrl->dwMaxVideoFrameSize),
164 (__le32 *)&data[18]);
165 put_unaligned(cpu_to_le32(ctrl->dwMaxPayloadTransferSize),
166 (__le32 *)&data[22]);
167
168 if (size == 34) {
169 put_unaligned(cpu_to_le32(ctrl->dwClockFrequency),
170 (__le32 *)&data[26]);
171 data[30] = ctrl->bmFramingInfo;
172 data[31] = ctrl->bPreferedVersion;
173 data[32] = ctrl->bMinVersion;
174 data[33] = ctrl->bMaxVersion;
175 }
176
177 return __uvc_query_ctrl(video->dev, SET_CUR, 0,
178 video->streaming->intfnum,
179 probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, &data, size,
180 UVC_CTRL_STREAMING_TIMEOUT);
181}
182
183int uvc_probe_video(struct uvc_video_device *video,
184 struct uvc_streaming_control *probe)
185{
186 struct uvc_streaming_control probe_min, probe_max;
187 __u16 bandwidth;
188 unsigned int i;
189 int ret;
190
191 mutex_lock(&video->streaming->mutex);
192
193 /* Perform probing. The device should adjust the requested values
194 * according to its capabilities. However, some devices, namely the
195 * first generation UVC Logitech webcams, don't implement the Video
196 * Probe control properly, and just return the needed bandwidth. For
197 * that reason, if the needed bandwidth exceeds the maximum available
198 * bandwidth, try to lower the quality.
199 */
200 if ((ret = uvc_set_video_ctrl(video, probe, 1)) < 0)
201 goto done;
202
203 /* Get the minimum and maximum values for compression settings. */
204 if (!(video->dev->quirks & UVC_QUIRK_PROBE_MINMAX)) {
205 ret = uvc_get_video_ctrl(video, &probe_min, 1, GET_MIN);
206 if (ret < 0)
207 goto done;
208 ret = uvc_get_video_ctrl(video, &probe_max, 1, GET_MAX);
209 if (ret < 0)
210 goto done;
211
212 probe->wCompQuality = probe_max.wCompQuality;
213 }
214
215 for (i = 0; i < 2; ++i) {
216 if ((ret = uvc_set_video_ctrl(video, probe, 1)) < 0 ||
217 (ret = uvc_get_video_ctrl(video, probe, 1, GET_CUR)) < 0)
218 goto done;
219
220 if (video->streaming->intf->num_altsetting == 1)
221 break;
222
223 bandwidth = probe->dwMaxPayloadTransferSize;
224 if (bandwidth <= video->streaming->maxpsize)
225 break;
226
227 if (video->dev->quirks & UVC_QUIRK_PROBE_MINMAX) {
228 ret = -ENOSPC;
229 goto done;
230 }
231
232 /* TODO: negotiate compression parameters */
233 probe->wKeyFrameRate = probe_min.wKeyFrameRate;
234 probe->wPFrameRate = probe_min.wPFrameRate;
235 probe->wCompQuality = probe_max.wCompQuality;
236 probe->wCompWindowSize = probe_min.wCompWindowSize;
237 }
238
239done:
240 mutex_unlock(&video->streaming->mutex);
241 return ret;
242}
243
244/* ------------------------------------------------------------------------
245 * Video codecs
246 */
247
248/* Values for bmHeaderInfo (Video and Still Image Payload Headers, 2.4.3.3) */
249#define UVC_STREAM_EOH (1 << 7)
250#define UVC_STREAM_ERR (1 << 6)
251#define UVC_STREAM_STI (1 << 5)
252#define UVC_STREAM_RES (1 << 4)
253#define UVC_STREAM_SCR (1 << 3)
254#define UVC_STREAM_PTS (1 << 2)
255#define UVC_STREAM_EOF (1 << 1)
256#define UVC_STREAM_FID (1 << 0)
257
258/* Video payload decoding is handled by uvc_video_decode_start(),
259 * uvc_video_decode_data() and uvc_video_decode_end().
260 *
261 * uvc_video_decode_start is called with URB data at the start of a bulk or
262 * isochronous payload. It processes header data and returns the header size
263 * in bytes if successful. If an error occurs, it returns a negative error
264 * code. The following error codes have special meanings.
265 *
266 * - EAGAIN informs the caller that the current video buffer should be marked
267 * as done, and that the function should be called again with the same data
268 * and a new video buffer. This is used when end of frame conditions can be
269 * reliably detected at the beginning of the next frame only.
270 *
271 * If an error other than -EAGAIN is returned, the caller will drop the current
272 * payload. No call to uvc_video_decode_data and uvc_video_decode_end will be
273 * made until the next payload. -ENODATA can be used to drop the current
274 * payload if no other error code is appropriate.
275 *
276 * uvc_video_decode_data is called for every URB with URB data. It copies the
277 * data to the video buffer.
278 *
279 * uvc_video_decode_end is called with header data at the end of a bulk or
280 * isochronous payload. It performs any additional header data processing and
281 * returns 0 or a negative error code if an error occured. As header data have
282 * already been processed by uvc_video_decode_start, this functions isn't
283 * required to perform sanity checks a second time.
284 *
285 * For isochronous transfers where a payload is always transfered in a single
286 * URB, the three functions will be called in a row.
287 *
288 * To let the decoder process header data and update its internal state even
289 * when no video buffer is available, uvc_video_decode_start must be prepared
290 * to be called with a NULL buf parameter. uvc_video_decode_data and
291 * uvc_video_decode_end will never be called with a NULL buffer.
292 */
293static int uvc_video_decode_start(struct uvc_video_device *video,
294 struct uvc_buffer *buf, const __u8 *data, int len)
295{
296 __u8 fid;
297
298 /* Sanity checks:
299 * - packet must be at least 2 bytes long
300 * - bHeaderLength value must be at least 2 bytes (see above)
301 * - bHeaderLength value can't be larger than the packet size.
302 */
303 if (len < 2 || data[0] < 2 || data[0] > len)
304 return -EINVAL;
305
306 /* Skip payloads marked with the error bit ("error frames"). */
307 if (data[1] & UVC_STREAM_ERR) {
308 uvc_trace(UVC_TRACE_FRAME, "Dropping payload (error bit "
309 "set).\n");
310 return -ENODATA;
311 }
312
313 fid = data[1] & UVC_STREAM_FID;
314
315 /* Store the payload FID bit and return immediately when the buffer is
316 * NULL.
317 */
318 if (buf == NULL) {
319 video->last_fid = fid;
320 return -ENODATA;
321 }
322
323 /* Synchronize to the input stream by waiting for the FID bit to be
324 * toggled when the the buffer state is not UVC_BUF_STATE_ACTIVE.
325 * queue->last_fid is initialized to -1, so the first isochronous
326 * frame will always be in sync.
327 *
328 * If the device doesn't toggle the FID bit, invert video->last_fid
329 * when the EOF bit is set to force synchronisation on the next packet.
330 */
331 if (buf->state != UVC_BUF_STATE_ACTIVE) {
332 if (fid == video->last_fid) {
333 uvc_trace(UVC_TRACE_FRAME, "Dropping payload (out of "
334 "sync).\n");
335 if ((video->dev->quirks & UVC_QUIRK_STREAM_NO_FID) &&
336 (data[1] & UVC_STREAM_EOF))
337 video->last_fid ^= UVC_STREAM_FID;
338 return -ENODATA;
339 }
340
341 /* TODO: Handle PTS and SCR. */
342 buf->state = UVC_BUF_STATE_ACTIVE;
343 }
344
345 /* Mark the buffer as done if we're at the beginning of a new frame.
346 * End of frame detection is better implemented by checking the EOF
347 * bit (FID bit toggling is delayed by one frame compared to the EOF
348 * bit), but some devices don't set the bit at end of frame (and the
349 * last payload can be lost anyway). We thus must check if the FID has
350 * been toggled.
351 *
352 * queue->last_fid is initialized to -1, so the first isochronous
353 * frame will never trigger an end of frame detection.
354 *
355 * Empty buffers (bytesused == 0) don't trigger end of frame detection
356 * as it doesn't make sense to return an empty buffer. This also
357 * avoids detecting and of frame conditions at FID toggling if the
358 * previous payload had the EOF bit set.
359 */
360 if (fid != video->last_fid && buf->buf.bytesused != 0) {
361 uvc_trace(UVC_TRACE_FRAME, "Frame complete (FID bit "
362 "toggled).\n");
363 buf->state = UVC_BUF_STATE_DONE;
364 return -EAGAIN;
365 }
366
367 video->last_fid = fid;
368
369 return data[0];
370}
371
372static void uvc_video_decode_data(struct uvc_video_device *video,
373 struct uvc_buffer *buf, const __u8 *data, int len)
374{
375 struct uvc_video_queue *queue = &video->queue;
376 unsigned int maxlen, nbytes;
377 void *mem;
378
379 if (len <= 0)
380 return;
381
382 /* Copy the video data to the buffer. */
383 maxlen = buf->buf.length - buf->buf.bytesused;
384 mem = queue->mem + buf->buf.m.offset + buf->buf.bytesused;
385 nbytes = min((unsigned int)len, maxlen);
386 memcpy(mem, data, nbytes);
387 buf->buf.bytesused += nbytes;
388
389 /* Complete the current frame if the buffer size was exceeded. */
390 if (len > maxlen) {
391 uvc_trace(UVC_TRACE_FRAME, "Frame complete (overflow).\n");
392 buf->state = UVC_BUF_STATE_DONE;
393 }
394}
395
396static void uvc_video_decode_end(struct uvc_video_device *video,
397 struct uvc_buffer *buf, const __u8 *data, int len)
398{
399 /* Mark the buffer as done if the EOF marker is set. */
400 if (data[1] & UVC_STREAM_EOF && buf->buf.bytesused != 0) {
401 uvc_trace(UVC_TRACE_FRAME, "Frame complete (EOF found).\n");
402 if (data[0] == len)
403 uvc_trace(UVC_TRACE_FRAME, "EOF in empty payload.\n");
404 buf->state = UVC_BUF_STATE_DONE;
405 if (video->dev->quirks & UVC_QUIRK_STREAM_NO_FID)
406 video->last_fid ^= UVC_STREAM_FID;
407 }
408}
409
410/* ------------------------------------------------------------------------
411 * URB handling
412 */
413
414/*
415 * Completion handler for video URBs.
416 */
417static void uvc_video_decode_isoc(struct urb *urb,
418 struct uvc_video_device *video, struct uvc_buffer *buf)
419{
420 u8 *mem;
421 int ret, i;
422
423 for (i = 0; i < urb->number_of_packets; ++i) {
424 if (urb->iso_frame_desc[i].status < 0) {
425 uvc_trace(UVC_TRACE_FRAME, "USB isochronous frame "
426 "lost (%d).\n", urb->iso_frame_desc[i].status);
427 continue;
428 }
429
430 /* Decode the payload header. */
431 mem = urb->transfer_buffer + urb->iso_frame_desc[i].offset;
432 do {
433 ret = uvc_video_decode_start(video, buf, mem,
434 urb->iso_frame_desc[i].actual_length);
435 if (ret == -EAGAIN)
436 buf = uvc_queue_next_buffer(&video->queue, buf);
437 } while (ret == -EAGAIN);
438
439 if (ret < 0)
440 continue;
441
442 /* Decode the payload data. */
443 uvc_video_decode_data(video, buf, mem + ret,
444 urb->iso_frame_desc[i].actual_length - ret);
445
446 /* Process the header again. */
447 uvc_video_decode_end(video, buf, mem, ret);
448
449 if (buf->state == UVC_BUF_STATE_DONE ||
450 buf->state == UVC_BUF_STATE_ERROR)
451 buf = uvc_queue_next_buffer(&video->queue, buf);
452 }
453}
454
455static void uvc_video_decode_bulk(struct urb *urb,
456 struct uvc_video_device *video, struct uvc_buffer *buf)
457{
458 u8 *mem;
459 int len, ret;
460
461 mem = urb->transfer_buffer;
462 len = urb->actual_length;
463 video->bulk.payload_size += len;
464
465 /* If the URB is the first of its payload, decode and save the
466 * header.
467 */
468 if (video->bulk.header_size == 0) {
469 do {
470 ret = uvc_video_decode_start(video, buf, mem, len);
471 if (ret == -EAGAIN)
472 buf = uvc_queue_next_buffer(&video->queue, buf);
473 } while (ret == -EAGAIN);
474
475 /* If an error occured skip the rest of the payload. */
476 if (ret < 0 || buf == NULL) {
477 video->bulk.skip_payload = 1;
478 return;
479 }
480
481 video->bulk.header_size = ret;
482 memcpy(video->bulk.header, mem, video->bulk.header_size);
483
484 mem += ret;
485 len -= ret;
486 }
487
488 /* The buffer queue might have been cancelled while a bulk transfer
489 * was in progress, so we can reach here with buf equal to NULL. Make
490 * sure buf is never dereferenced if NULL.
491 */
492
493 /* Process video data. */
494 if (!video->bulk.skip_payload && buf != NULL)
495 uvc_video_decode_data(video, buf, mem, len);
496
497 /* Detect the payload end by a URB smaller than the maximum size (or
498 * a payload size equal to the maximum) and process the header again.
499 */
500 if (urb->actual_length < urb->transfer_buffer_length ||
501 video->bulk.payload_size >= video->bulk.max_payload_size) {
502 if (!video->bulk.skip_payload && buf != NULL) {
503 uvc_video_decode_end(video, buf, video->bulk.header,
504 video->bulk.header_size);
505 if (buf->state == UVC_BUF_STATE_DONE ||
506 buf->state == UVC_BUF_STATE_ERROR)
507 buf = uvc_queue_next_buffer(&video->queue, buf);
508 }
509
510 video->bulk.header_size = 0;
511 video->bulk.skip_payload = 0;
512 video->bulk.payload_size = 0;
513 }
514}
515
516static void uvc_video_complete(struct urb *urb)
517{
518 struct uvc_video_device *video = urb->context;
519 struct uvc_video_queue *queue = &video->queue;
520 struct uvc_buffer *buf = NULL;
521 unsigned long flags;
522 int ret;
523
524 switch (urb->status) {
525 case 0:
526 break;
527
528 default:
529 uvc_printk(KERN_WARNING, "Non-zero status (%d) in video "
530 "completion handler.\n", urb->status);
531
532 case -ENOENT: /* usb_kill_urb() called. */
533 if (video->frozen)
534 return;
535
536 case -ECONNRESET: /* usb_unlink_urb() called. */
537 case -ESHUTDOWN: /* The endpoint is being disabled. */
538 uvc_queue_cancel(queue, urb->status == -ESHUTDOWN);
539 return;
540 }
541
542 spin_lock_irqsave(&queue->irqlock, flags);
543 if (!list_empty(&queue->irqqueue))
544 buf = list_first_entry(&queue->irqqueue, struct uvc_buffer,
545 queue);
546 spin_unlock_irqrestore(&queue->irqlock, flags);
547
548 video->decode(urb, video, buf);
549
550 if ((ret = usb_submit_urb(urb, GFP_ATOMIC)) < 0) {
551 uvc_printk(KERN_ERR, "Failed to resubmit video URB (%d).\n",
552 ret);
553 }
554}
555
556/*
557 * Uninitialize isochronous/bulk URBs and free transfer buffers.
558 */
559static void uvc_uninit_video(struct uvc_video_device *video)
560{
561 struct urb *urb;
562 unsigned int i;
563
564 for (i = 0; i < UVC_URBS; ++i) {
565 if ((urb = video->urb[i]) == NULL)
566 continue;
567
568 usb_kill_urb(urb);
569 /* urb->transfer_buffer_length is not touched by USB core, so
570 * we can use it here as the buffer length.
571 */
572 if (video->urb_buffer[i]) {
573 usb_buffer_free(video->dev->udev,
574 urb->transfer_buffer_length,
575 video->urb_buffer[i], urb->transfer_dma);
576 video->urb_buffer[i] = NULL;
577 }
578
579 usb_free_urb(urb);
580 video->urb[i] = NULL;
581 }
582}
583
584/*
585 * Initialize isochronous URBs and allocate transfer buffers. The packet size
586 * is given by the endpoint.
587 */
588static int uvc_init_video_isoc(struct uvc_video_device *video,
589 struct usb_host_endpoint *ep)
590{
591 struct urb *urb;
592 unsigned int npackets, i, j;
593 __u16 psize;
594 __u32 size;
595
596 /* Compute the number of isochronous packets to allocate by dividing
597 * the maximum video frame size by the packet size. Limit the result
598 * to UVC_MAX_ISO_PACKETS.
599 */
600 psize = le16_to_cpu(ep->desc.wMaxPacketSize);
601 psize = (psize & 0x07ff) * (1 + ((psize >> 11) & 3));
602
603 size = video->streaming->ctrl.dwMaxVideoFrameSize;
604 if (size > UVC_MAX_FRAME_SIZE)
605 return -EINVAL;
606
607 npackets = (size + psize - 1) / psize;
608 if (npackets > UVC_MAX_ISO_PACKETS)
609 npackets = UVC_MAX_ISO_PACKETS;
610
611 size = npackets * psize;
612
613 for (i = 0; i < UVC_URBS; ++i) {
614 urb = usb_alloc_urb(npackets, GFP_KERNEL);
615 if (urb == NULL) {
616 uvc_uninit_video(video);
617 return -ENOMEM;
618 }
619
620 video->urb_buffer[i] = usb_buffer_alloc(video->dev->udev,
621 size, GFP_KERNEL, &urb->transfer_dma);
622 if (video->urb_buffer[i] == NULL) {
623 usb_free_urb(urb);
624 uvc_uninit_video(video);
625 return -ENOMEM;
626 }
627
628 urb->dev = video->dev->udev;
629 urb->context = video;
630 urb->pipe = usb_rcvisocpipe(video->dev->udev,
631 ep->desc.bEndpointAddress);
632 urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
633 urb->interval = ep->desc.bInterval;
634 urb->transfer_buffer = video->urb_buffer[i];
635 urb->complete = uvc_video_complete;
636 urb->number_of_packets = npackets;
637 urb->transfer_buffer_length = size;
638
639 for (j = 0; j < npackets; ++j) {
640 urb->iso_frame_desc[j].offset = j * psize;
641 urb->iso_frame_desc[j].length = psize;
642 }
643
644 video->urb[i] = urb;
645 }
646
647 return 0;
648}
649
650/*
651 * Initialize bulk URBs and allocate transfer buffers. The packet size is
652 * given by the endpoint.
653 */
654static int uvc_init_video_bulk(struct uvc_video_device *video,
655 struct usb_host_endpoint *ep)
656{
657 struct urb *urb;
658 unsigned int pipe, i;
659 __u16 psize;
660 __u32 size;
661
662 /* Compute the bulk URB size. Some devices set the maximum payload
663 * size to a value too high for memory-constrained devices. We must
664 * then transfer the payload accross multiple URBs. To be consistant
665 * with isochronous mode, allocate maximum UVC_MAX_ISO_PACKETS per bulk
666 * URB.
667 */
668 psize = le16_to_cpu(ep->desc.wMaxPacketSize) & 0x07ff;
669 size = video->streaming->ctrl.dwMaxPayloadTransferSize;
670 video->bulk.max_payload_size = size;
671 if (size > psize * UVC_MAX_ISO_PACKETS)
672 size = psize * UVC_MAX_ISO_PACKETS;
673
674 pipe = usb_rcvbulkpipe(video->dev->udev, ep->desc.bEndpointAddress);
675
676 for (i = 0; i < UVC_URBS; ++i) {
677 urb = usb_alloc_urb(0, GFP_KERNEL);
678 if (urb == NULL) {
679 uvc_uninit_video(video);
680 return -ENOMEM;
681 }
682
683 video->urb_buffer[i] = usb_buffer_alloc(video->dev->udev,
684 size, GFP_KERNEL, &urb->transfer_dma);
685 if (video->urb_buffer[i] == NULL) {
686 usb_free_urb(urb);
687 uvc_uninit_video(video);
688 return -ENOMEM;
689 }
690
691 usb_fill_bulk_urb(urb, video->dev->udev, pipe,
692 video->urb_buffer[i], size, uvc_video_complete,
693 video);
694 urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
695
696 video->urb[i] = urb;
697 }
698
699 return 0;
700}
701
702/*
703 * Initialize isochronous/bulk URBs and allocate transfer buffers.
704 */
705static int uvc_init_video(struct uvc_video_device *video)
706{
707 struct usb_interface *intf = video->streaming->intf;
708 struct usb_host_interface *alts;
709 struct usb_host_endpoint *ep = NULL;
710 int intfnum = video->streaming->intfnum;
711 unsigned int bandwidth, psize, i;
712 int ret;
713
714 video->last_fid = -1;
715 video->bulk.header_size = 0;
716 video->bulk.skip_payload = 0;
717 video->bulk.payload_size = 0;
718
719 if (intf->num_altsetting > 1) {
720 /* Isochronous endpoint, select the alternate setting. */
721 bandwidth = video->streaming->ctrl.dwMaxPayloadTransferSize;
722
723 if (bandwidth == 0) {
724 uvc_printk(KERN_WARNING, "device %s requested null "
725 "bandwidth, defaulting to lowest.\n",
726 video->vdev->name);
727 bandwidth = 1;
728 }
729
730 for (i = 0; i < intf->num_altsetting; ++i) {
731 alts = &intf->altsetting[i];
732 ep = uvc_find_endpoint(alts,
733 video->streaming->header.bEndpointAddress);
734 if (ep == NULL)
735 continue;
736
737 /* Check if the bandwidth is high enough. */
738 psize = le16_to_cpu(ep->desc.wMaxPacketSize);
739 psize = (psize & 0x07ff) * (1 + ((psize >> 11) & 3));
740 if (psize >= bandwidth)
741 break;
742 }
743
744 if (i >= intf->num_altsetting)
745 return -EIO;
746
747 if ((ret = usb_set_interface(video->dev->udev, intfnum, i)) < 0)
748 return ret;
749
750 ret = uvc_init_video_isoc(video, ep);
751 } else {
752 /* Bulk endpoint, proceed to URB initialization. */
753 ep = uvc_find_endpoint(&intf->altsetting[0],
754 video->streaming->header.bEndpointAddress);
755 if (ep == NULL)
756 return -EIO;
757
758 ret = uvc_init_video_bulk(video, ep);
759 }
760
761 if (ret < 0)
762 return ret;
763
764 /* Submit the URBs. */
765 for (i = 0; i < UVC_URBS; ++i) {
766 if ((ret = usb_submit_urb(video->urb[i], GFP_KERNEL)) < 0) {
767 uvc_printk(KERN_ERR, "Failed to submit URB %u "
768 "(%d).\n", i, ret);
769 uvc_uninit_video(video);
770 return ret;
771 }
772 }
773
774 return 0;
775}
776
777/* --------------------------------------------------------------------------
778 * Suspend/resume
779 */
780
781/*
782 * Stop streaming without disabling the video queue.
783 *
784 * To let userspace applications resume without trouble, we must not touch the
785 * video buffers in any way. We mark the device as frozen to make sure the URB
786 * completion handler won't try to cancel the queue when we kill the URBs.
787 */
788int uvc_video_suspend(struct uvc_video_device *video)
789{
790 if (!uvc_queue_streaming(&video->queue))
791 return 0;
792
793 video->frozen = 1;
794 uvc_uninit_video(video);
795 usb_set_interface(video->dev->udev, video->streaming->intfnum, 0);
796 return 0;
797}
798
799/*
800 * Reconfigure the video interface and restart streaming if it was enable
801 * before suspend.
802 *
803 * If an error occurs, disable the video queue. This will wake all pending
804 * buffers, making sure userspace applications are notified of the problem
805 * instead of waiting forever.
806 */
807int uvc_video_resume(struct uvc_video_device *video)
808{
809 int ret;
810
811 video->frozen = 0;
812
813 if ((ret = uvc_set_video_ctrl(video, &video->streaming->ctrl, 0)) < 0) {
814 uvc_queue_enable(&video->queue, 0);
815 return ret;
816 }
817
818 if (!uvc_queue_streaming(&video->queue))
819 return 0;
820
821 if ((ret = uvc_init_video(video)) < 0)
822 uvc_queue_enable(&video->queue, 0);
823
824 return ret;
825}
826
827/* ------------------------------------------------------------------------
828 * Video device
829 */
830
831/*
832 * Initialize the UVC video device by retrieving the default format and
833 * committing it.
834 *
835 * Some cameras (namely the Fuji Finepix) set the format and frame
836 * indexes to zero. The UVC standard doesn't clearly make this a spec
837 * violation, so try to silently fix the values if possible.
838 *
839 * This function is called before registering the device with V4L.
840 */
841int uvc_video_init(struct uvc_video_device *video)
842{
843 struct uvc_streaming_control *probe = &video->streaming->ctrl;
844 struct uvc_format *format = NULL;
845 struct uvc_frame *frame = NULL;
846 unsigned int i;
847 int ret;
848
849 if (video->streaming->nformats == 0) {
850 uvc_printk(KERN_INFO, "No supported video formats found.\n");
851 return -EINVAL;
852 }
853
854 /* Alternate setting 0 should be the default, yet the XBox Live Vision
855 * Cam (and possibly other devices) crash or otherwise misbehave if
856 * they don't receive a SET_INTERFACE request before any other video
857 * control request.
858 */
859 usb_set_interface(video->dev->udev, video->streaming->intfnum, 0);
860
861 /* Some webcams don't suport GET_DEF request on the probe control. We
862 * fall back to GET_CUR if GET_DEF fails.
863 */
864 if ((ret = uvc_get_video_ctrl(video, probe, 1, GET_DEF)) < 0 &&
865 (ret = uvc_get_video_ctrl(video, probe, 1, GET_CUR)) < 0)
866 return ret;
867
868 /* Check if the default format descriptor exists. Use the first
869 * available format otherwise.
870 */
871 for (i = video->streaming->nformats; i > 0; --i) {
872 format = &video->streaming->format[i-1];
873 if (format->index == probe->bFormatIndex)
874 break;
875 }
876
877 if (format->nframes == 0) {
878 uvc_printk(KERN_INFO, "No frame descriptor found for the "
879 "default format.\n");
880 return -EINVAL;
881 }
882
883 /* Zero bFrameIndex might be correct. Stream-based formats (including
884 * MPEG-2 TS and DV) do not support frames but have a dummy frame
885 * descriptor with bFrameIndex set to zero. If the default frame
886 * descriptor is not found, use the first avalable frame.
887 */
888 for (i = format->nframes; i > 0; --i) {
889 frame = &format->frame[i-1];
890 if (frame->bFrameIndex == probe->bFrameIndex)
891 break;
892 }
893
894 /* Commit the default settings. */
895 probe->bFormatIndex = format->index;
896 probe->bFrameIndex = frame->bFrameIndex;
897 if ((ret = uvc_set_video_ctrl(video, probe, 0)) < 0)
898 return ret;
899
900 video->streaming->cur_format = format;
901 video->streaming->cur_frame = frame;
902 atomic_set(&video->active, 0);
903
904 /* Select the video decoding function */
905 if (video->dev->quirks & UVC_QUIRK_BUILTIN_ISIGHT)
906 video->decode = uvc_video_decode_isight;
907 else if (video->streaming->intf->num_altsetting > 1)
908 video->decode = uvc_video_decode_isoc;
909 else
910 video->decode = uvc_video_decode_bulk;
911
912 return 0;
913}
914
915/*
916 * Enable or disable the video stream.
917 */
918int uvc_video_enable(struct uvc_video_device *video, int enable)
919{
920 int ret;
921
922 if (!enable) {
923 uvc_uninit_video(video);
924 usb_set_interface(video->dev->udev,
925 video->streaming->intfnum, 0);
926 uvc_queue_enable(&video->queue, 0);
927 return 0;
928 }
929
930 if ((ret = uvc_queue_enable(&video->queue, 1)) < 0)
931 return ret;
932
933 return uvc_init_video(video);
934}
This page took 0.068081 seconds and 5 git commands to generate.