cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

uvc_video.c (64293B)


      1// SPDX-License-Identifier: GPL-2.0-or-later
      2/*
      3 *      uvc_video.c  --  USB Video Class driver - Video handling
      4 *
      5 *      Copyright (C) 2005-2010
      6 *          Laurent Pinchart (laurent.pinchart@ideasonboard.com)
      7 */
      8
      9#include <linux/dma-mapping.h>
     10#include <linux/highmem.h>
     11#include <linux/kernel.h>
     12#include <linux/list.h>
     13#include <linux/module.h>
     14#include <linux/slab.h>
     15#include <linux/usb.h>
     16#include <linux/usb/hcd.h>
     17#include <linux/videodev2.h>
     18#include <linux/vmalloc.h>
     19#include <linux/wait.h>
     20#include <linux/atomic.h>
     21#include <asm/unaligned.h>
     22
     23#include <media/v4l2-common.h>
     24
     25#include "uvcvideo.h"
     26
     27/* ------------------------------------------------------------------------
     28 * UVC Controls
     29 */
     30
     31static int __uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit,
     32			u8 intfnum, u8 cs, void *data, u16 size,
     33			int timeout)
     34{
     35	u8 type = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
     36	unsigned int pipe;
     37
     38	pipe = (query & 0x80) ? usb_rcvctrlpipe(dev->udev, 0)
     39			      : usb_sndctrlpipe(dev->udev, 0);
     40	type |= (query & 0x80) ? USB_DIR_IN : USB_DIR_OUT;
     41
     42	return usb_control_msg(dev->udev, pipe, query, type, cs << 8,
     43			unit << 8 | intfnum, data, size, timeout);
     44}
     45
     46static const char *uvc_query_name(u8 query)
     47{
     48	switch (query) {
     49	case UVC_SET_CUR:
     50		return "SET_CUR";
     51	case UVC_GET_CUR:
     52		return "GET_CUR";
     53	case UVC_GET_MIN:
     54		return "GET_MIN";
     55	case UVC_GET_MAX:
     56		return "GET_MAX";
     57	case UVC_GET_RES:
     58		return "GET_RES";
     59	case UVC_GET_LEN:
     60		return "GET_LEN";
     61	case UVC_GET_INFO:
     62		return "GET_INFO";
     63	case UVC_GET_DEF:
     64		return "GET_DEF";
     65	default:
     66		return "<invalid>";
     67	}
     68}
     69
     70int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit,
     71			u8 intfnum, u8 cs, void *data, u16 size)
     72{
     73	int ret;
     74	u8 error;
     75	u8 tmp;
     76
     77	ret = __uvc_query_ctrl(dev, query, unit, intfnum, cs, data, size,
     78				UVC_CTRL_CONTROL_TIMEOUT);
     79	if (likely(ret == size))
     80		return 0;
     81
     82	dev_err(&dev->udev->dev,
     83		"Failed to query (%s) UVC control %u on unit %u: %d (exp. %u).\n",
     84		uvc_query_name(query), cs, unit, ret, size);
     85
     86	if (ret != -EPIPE)
     87		return ret;
     88
     89	tmp = *(u8 *)data;
     90
     91	ret = __uvc_query_ctrl(dev, UVC_GET_CUR, 0, intfnum,
     92			       UVC_VC_REQUEST_ERROR_CODE_CONTROL, data, 1,
     93			       UVC_CTRL_CONTROL_TIMEOUT);
     94
     95	error = *(u8 *)data;
     96	*(u8 *)data = tmp;
     97
     98	if (ret != 1)
     99		return ret < 0 ? ret : -EPIPE;
    100
    101	uvc_dbg(dev, CONTROL, "Control error %u\n", error);
    102
    103	switch (error) {
    104	case 0:
    105		/* Cannot happen - we received a STALL */
    106		return -EPIPE;
    107	case 1: /* Not ready */
    108		return -EBUSY;
    109	case 2: /* Wrong state */
    110		return -EILSEQ;
    111	case 3: /* Power */
    112		return -EREMOTE;
    113	case 4: /* Out of range */
    114		return -ERANGE;
    115	case 5: /* Invalid unit */
    116	case 6: /* Invalid control */
    117	case 7: /* Invalid Request */
    118		/*
    119		 * The firmware has not properly implemented
    120		 * the control or there has been a HW error.
    121		 */
    122		return -EIO;
    123	case 8: /* Invalid value within range */
    124		return -EINVAL;
    125	default: /* reserved or unknown */
    126		break;
    127	}
    128
    129	return -EPIPE;
    130}
    131
    132static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
    133	struct uvc_streaming_control *ctrl)
    134{
    135	static const struct usb_device_id elgato_cam_link_4k = {
    136		USB_DEVICE(0x0fd9, 0x0066)
    137	};
    138	struct uvc_format *format = NULL;
    139	struct uvc_frame *frame = NULL;
    140	unsigned int i;
    141
    142	/*
    143	 * The response of the Elgato Cam Link 4K is incorrect: The second byte
    144	 * contains bFormatIndex (instead of being the second byte of bmHint).
    145	 * The first byte is always zero. The third byte is always 1.
    146	 *
    147	 * The UVC 1.5 class specification defines the first five bits in the
    148	 * bmHint bitfield. The remaining bits are reserved and should be zero.
    149	 * Therefore a valid bmHint will be less than 32.
    150	 *
    151	 * Latest Elgato Cam Link 4K firmware as of 2021-03-23 needs this fix.
    152	 * MCU: 20.02.19, FPGA: 67
    153	 */
    154	if (usb_match_one_id(stream->dev->intf, &elgato_cam_link_4k) &&
    155	    ctrl->bmHint > 255) {
    156		u8 corrected_format_index = ctrl->bmHint >> 8;
    157
    158		uvc_dbg(stream->dev, VIDEO,
    159			"Correct USB video probe response from {bmHint: 0x%04x, bFormatIndex: %u} to {bmHint: 0x%04x, bFormatIndex: %u}\n",
    160			ctrl->bmHint, ctrl->bFormatIndex,
    161			1, corrected_format_index);
    162		ctrl->bmHint = 1;
    163		ctrl->bFormatIndex = corrected_format_index;
    164	}
    165
    166	for (i = 0; i < stream->nformats; ++i) {
    167		if (stream->format[i].index == ctrl->bFormatIndex) {
    168			format = &stream->format[i];
    169			break;
    170		}
    171	}
    172
    173	if (format == NULL)
    174		return;
    175
    176	for (i = 0; i < format->nframes; ++i) {
    177		if (format->frame[i].bFrameIndex == ctrl->bFrameIndex) {
    178			frame = &format->frame[i];
    179			break;
    180		}
    181	}
    182
    183	if (frame == NULL)
    184		return;
    185
    186	if (!(format->flags & UVC_FMT_FLAG_COMPRESSED) ||
    187	     (ctrl->dwMaxVideoFrameSize == 0 &&
    188	      stream->dev->uvc_version < 0x0110))
    189		ctrl->dwMaxVideoFrameSize =
    190			frame->dwMaxVideoFrameBufferSize;
    191
    192	/* The "TOSHIBA Web Camera - 5M" Chicony device (04f2:b50b) seems to
    193	 * compute the bandwidth on 16 bits and erroneously sign-extend it to
    194	 * 32 bits, resulting in a huge bandwidth value. Detect and fix that
    195	 * condition by setting the 16 MSBs to 0 when they're all equal to 1.
    196	 */
    197	if ((ctrl->dwMaxPayloadTransferSize & 0xffff0000) == 0xffff0000)
    198		ctrl->dwMaxPayloadTransferSize &= ~0xffff0000;
    199
    200	if (!(format->flags & UVC_FMT_FLAG_COMPRESSED) &&
    201	    stream->dev->quirks & UVC_QUIRK_FIX_BANDWIDTH &&
    202	    stream->intf->num_altsetting > 1) {
    203		u32 interval;
    204		u32 bandwidth;
    205
    206		interval = (ctrl->dwFrameInterval > 100000)
    207			 ? ctrl->dwFrameInterval
    208			 : frame->dwFrameInterval[0];
    209
    210		/* Compute a bandwidth estimation by multiplying the frame
    211		 * size by the number of video frames per second, divide the
    212		 * result by the number of USB frames (or micro-frames for
    213		 * high-speed devices) per second and add the UVC header size
    214		 * (assumed to be 12 bytes long).
    215		 */
    216		bandwidth = frame->wWidth * frame->wHeight / 8 * format->bpp;
    217		bandwidth *= 10000000 / interval + 1;
    218		bandwidth /= 1000;
    219		if (stream->dev->udev->speed == USB_SPEED_HIGH)
    220			bandwidth /= 8;
    221		bandwidth += 12;
    222
    223		/* The bandwidth estimate is too low for many cameras. Don't use
    224		 * maximum packet sizes lower than 1024 bytes to try and work
    225		 * around the problem. According to measurements done on two
    226		 * different camera models, the value is high enough to get most
    227		 * resolutions working while not preventing two simultaneous
    228		 * VGA streams at 15 fps.
    229		 */
    230		bandwidth = max_t(u32, bandwidth, 1024);
    231
    232		ctrl->dwMaxPayloadTransferSize = bandwidth;
    233	}
    234}
    235
    236static size_t uvc_video_ctrl_size(struct uvc_streaming *stream)
    237{
    238	/*
    239	 * Return the size of the video probe and commit controls, which depends
    240	 * on the protocol version.
    241	 */
    242	if (stream->dev->uvc_version < 0x0110)
    243		return 26;
    244	else if (stream->dev->uvc_version < 0x0150)
    245		return 34;
    246	else
    247		return 48;
    248}
    249
    250static int uvc_get_video_ctrl(struct uvc_streaming *stream,
    251	struct uvc_streaming_control *ctrl, int probe, u8 query)
    252{
    253	u16 size = uvc_video_ctrl_size(stream);
    254	u8 *data;
    255	int ret;
    256
    257	if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) &&
    258			query == UVC_GET_DEF)
    259		return -EIO;
    260
    261	data = kmalloc(size, GFP_KERNEL);
    262	if (data == NULL)
    263		return -ENOMEM;
    264
    265	ret = __uvc_query_ctrl(stream->dev, query, 0, stream->intfnum,
    266		probe ? UVC_VS_PROBE_CONTROL : UVC_VS_COMMIT_CONTROL, data,
    267		size, uvc_timeout_param);
    268
    269	if ((query == UVC_GET_MIN || query == UVC_GET_MAX) && ret == 2) {
    270		/* Some cameras, mostly based on Bison Electronics chipsets,
    271		 * answer a GET_MIN or GET_MAX request with the wCompQuality
    272		 * field only.
    273		 */
    274		uvc_warn_once(stream->dev, UVC_WARN_MINMAX, "UVC non "
    275			"compliance - GET_MIN/MAX(PROBE) incorrectly "
    276			"supported. Enabling workaround.\n");
    277		memset(ctrl, 0, sizeof(*ctrl));
    278		ctrl->wCompQuality = le16_to_cpup((__le16 *)data);
    279		ret = 0;
    280		goto out;
    281	} else if (query == UVC_GET_DEF && probe == 1 && ret != size) {
    282		/* Many cameras don't support the GET_DEF request on their
    283		 * video probe control. Warn once and return, the caller will
    284		 * fall back to GET_CUR.
    285		 */
    286		uvc_warn_once(stream->dev, UVC_WARN_PROBE_DEF, "UVC non "
    287			"compliance - GET_DEF(PROBE) not supported. "
    288			"Enabling workaround.\n");
    289		ret = -EIO;
    290		goto out;
    291	} else if (ret != size) {
    292		dev_err(&stream->intf->dev,
    293			"Failed to query (%u) UVC %s control : %d (exp. %u).\n",
    294			query, probe ? "probe" : "commit", ret, size);
    295		ret = -EIO;
    296		goto out;
    297	}
    298
    299	ctrl->bmHint = le16_to_cpup((__le16 *)&data[0]);
    300	ctrl->bFormatIndex = data[2];
    301	ctrl->bFrameIndex = data[3];
    302	ctrl->dwFrameInterval = le32_to_cpup((__le32 *)&data[4]);
    303	ctrl->wKeyFrameRate = le16_to_cpup((__le16 *)&data[8]);
    304	ctrl->wPFrameRate = le16_to_cpup((__le16 *)&data[10]);
    305	ctrl->wCompQuality = le16_to_cpup((__le16 *)&data[12]);
    306	ctrl->wCompWindowSize = le16_to_cpup((__le16 *)&data[14]);
    307	ctrl->wDelay = le16_to_cpup((__le16 *)&data[16]);
    308	ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]);
    309	ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]);
    310
    311	if (size >= 34) {
    312		ctrl->dwClockFrequency = get_unaligned_le32(&data[26]);
    313		ctrl->bmFramingInfo = data[30];
    314		ctrl->bPreferedVersion = data[31];
    315		ctrl->bMinVersion = data[32];
    316		ctrl->bMaxVersion = data[33];
    317	} else {
    318		ctrl->dwClockFrequency = stream->dev->clock_frequency;
    319		ctrl->bmFramingInfo = 0;
    320		ctrl->bPreferedVersion = 0;
    321		ctrl->bMinVersion = 0;
    322		ctrl->bMaxVersion = 0;
    323	}
    324
    325	/* Some broken devices return null or wrong dwMaxVideoFrameSize and
    326	 * dwMaxPayloadTransferSize fields. Try to get the value from the
    327	 * format and frame descriptors.
    328	 */
    329	uvc_fixup_video_ctrl(stream, ctrl);
    330	ret = 0;
    331
    332out:
    333	kfree(data);
    334	return ret;
    335}
    336
    337static int uvc_set_video_ctrl(struct uvc_streaming *stream,
    338	struct uvc_streaming_control *ctrl, int probe)
    339{
    340	u16 size = uvc_video_ctrl_size(stream);
    341	u8 *data;
    342	int ret;
    343
    344	data = kzalloc(size, GFP_KERNEL);
    345	if (data == NULL)
    346		return -ENOMEM;
    347
    348	*(__le16 *)&data[0] = cpu_to_le16(ctrl->bmHint);
    349	data[2] = ctrl->bFormatIndex;
    350	data[3] = ctrl->bFrameIndex;
    351	*(__le32 *)&data[4] = cpu_to_le32(ctrl->dwFrameInterval);
    352	*(__le16 *)&data[8] = cpu_to_le16(ctrl->wKeyFrameRate);
    353	*(__le16 *)&data[10] = cpu_to_le16(ctrl->wPFrameRate);
    354	*(__le16 *)&data[12] = cpu_to_le16(ctrl->wCompQuality);
    355	*(__le16 *)&data[14] = cpu_to_le16(ctrl->wCompWindowSize);
    356	*(__le16 *)&data[16] = cpu_to_le16(ctrl->wDelay);
    357	put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
    358	put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
    359
    360	if (size >= 34) {
    361		put_unaligned_le32(ctrl->dwClockFrequency, &data[26]);
    362		data[30] = ctrl->bmFramingInfo;
    363		data[31] = ctrl->bPreferedVersion;
    364		data[32] = ctrl->bMinVersion;
    365		data[33] = ctrl->bMaxVersion;
    366	}
    367
    368	ret = __uvc_query_ctrl(stream->dev, UVC_SET_CUR, 0, stream->intfnum,
    369		probe ? UVC_VS_PROBE_CONTROL : UVC_VS_COMMIT_CONTROL, data,
    370		size, uvc_timeout_param);
    371	if (ret != size) {
    372		dev_err(&stream->intf->dev,
    373			"Failed to set UVC %s control : %d (exp. %u).\n",
    374			probe ? "probe" : "commit", ret, size);
    375		ret = -EIO;
    376	}
    377
    378	kfree(data);
    379	return ret;
    380}
    381
    382int uvc_probe_video(struct uvc_streaming *stream,
    383	struct uvc_streaming_control *probe)
    384{
    385	struct uvc_streaming_control probe_min, probe_max;
    386	unsigned int i;
    387	int ret;
    388
    389	/* Perform probing. The device should adjust the requested values
    390	 * according to its capabilities. However, some devices, namely the
    391	 * first generation UVC Logitech webcams, don't implement the Video
    392	 * Probe control properly, and just return the needed bandwidth. For
    393	 * that reason, if the needed bandwidth exceeds the maximum available
    394	 * bandwidth, try to lower the quality.
    395	 */
    396	ret = uvc_set_video_ctrl(stream, probe, 1);
    397	if (ret < 0)
    398		goto done;
    399
    400	/* Get the minimum and maximum values for compression settings. */
    401	if (!(stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX)) {
    402		ret = uvc_get_video_ctrl(stream, &probe_min, 1, UVC_GET_MIN);
    403		if (ret < 0)
    404			goto done;
    405		ret = uvc_get_video_ctrl(stream, &probe_max, 1, UVC_GET_MAX);
    406		if (ret < 0)
    407			goto done;
    408
    409		probe->wCompQuality = probe_max.wCompQuality;
    410	}
    411
    412	for (i = 0; i < 2; ++i) {
    413		ret = uvc_set_video_ctrl(stream, probe, 1);
    414		if (ret < 0)
    415			goto done;
    416		ret = uvc_get_video_ctrl(stream, probe, 1, UVC_GET_CUR);
    417		if (ret < 0)
    418			goto done;
    419
    420		if (stream->intf->num_altsetting == 1)
    421			break;
    422
    423		if (probe->dwMaxPayloadTransferSize <= stream->maxpsize)
    424			break;
    425
    426		if (stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX) {
    427			ret = -ENOSPC;
    428			goto done;
    429		}
    430
    431		/* TODO: negotiate compression parameters */
    432		probe->wKeyFrameRate = probe_min.wKeyFrameRate;
    433		probe->wPFrameRate = probe_min.wPFrameRate;
    434		probe->wCompQuality = probe_max.wCompQuality;
    435		probe->wCompWindowSize = probe_min.wCompWindowSize;
    436	}
    437
    438done:
    439	return ret;
    440}
    441
    442static int uvc_commit_video(struct uvc_streaming *stream,
    443			    struct uvc_streaming_control *probe)
    444{
    445	return uvc_set_video_ctrl(stream, probe, 0);
    446}
    447
    448/* -----------------------------------------------------------------------------
    449 * Clocks and timestamps
    450 */
    451
    452static inline ktime_t uvc_video_get_time(void)
    453{
    454	if (uvc_clock_param == CLOCK_MONOTONIC)
    455		return ktime_get();
    456	else
    457		return ktime_get_real();
    458}
    459
    460static void
    461uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
    462		       const u8 *data, int len)
    463{
    464	struct uvc_clock_sample *sample;
    465	unsigned int header_size;
    466	bool has_pts = false;
    467	bool has_scr = false;
    468	unsigned long flags;
    469	ktime_t time;
    470	u16 host_sof;
    471	u16 dev_sof;
    472
    473	switch (data[1] & (UVC_STREAM_PTS | UVC_STREAM_SCR)) {
    474	case UVC_STREAM_PTS | UVC_STREAM_SCR:
    475		header_size = 12;
    476		has_pts = true;
    477		has_scr = true;
    478		break;
    479	case UVC_STREAM_PTS:
    480		header_size = 6;
    481		has_pts = true;
    482		break;
    483	case UVC_STREAM_SCR:
    484		header_size = 8;
    485		has_scr = true;
    486		break;
    487	default:
    488		header_size = 2;
    489		break;
    490	}
    491
    492	/* Check for invalid headers. */
    493	if (len < header_size)
    494		return;
    495
    496	/* Extract the timestamps:
    497	 *
    498	 * - store the frame PTS in the buffer structure
    499	 * - if the SCR field is present, retrieve the host SOF counter and
    500	 *   kernel timestamps and store them with the SCR STC and SOF fields
    501	 *   in the ring buffer
    502	 */
    503	if (has_pts && buf != NULL)
    504		buf->pts = get_unaligned_le32(&data[2]);
    505
    506	if (!has_scr)
    507		return;
    508
    509	/* To limit the amount of data, drop SCRs with an SOF identical to the
    510	 * previous one.
    511	 */
    512	dev_sof = get_unaligned_le16(&data[header_size - 2]);
    513	if (dev_sof == stream->clock.last_sof)
    514		return;
    515
    516	stream->clock.last_sof = dev_sof;
    517
    518	host_sof = usb_get_current_frame_number(stream->dev->udev);
    519	time = uvc_video_get_time();
    520
    521	/* The UVC specification allows device implementations that can't obtain
    522	 * the USB frame number to keep their own frame counters as long as they
    523	 * match the size and frequency of the frame number associated with USB
    524	 * SOF tokens. The SOF values sent by such devices differ from the USB
    525	 * SOF tokens by a fixed offset that needs to be estimated and accounted
    526	 * for to make timestamp recovery as accurate as possible.
    527	 *
    528	 * The offset is estimated the first time a device SOF value is received
    529	 * as the difference between the host and device SOF values. As the two
    530	 * SOF values can differ slightly due to transmission delays, consider
    531	 * that the offset is null if the difference is not higher than 10 ms
    532	 * (negative differences can not happen and are thus considered as an
    533	 * offset). The video commit control wDelay field should be used to
    534	 * compute a dynamic threshold instead of using a fixed 10 ms value, but
    535	 * devices don't report reliable wDelay values.
    536	 *
    537	 * See uvc_video_clock_host_sof() for an explanation regarding why only
    538	 * the 8 LSBs of the delta are kept.
    539	 */
    540	if (stream->clock.sof_offset == (u16)-1) {
    541		u16 delta_sof = (host_sof - dev_sof) & 255;
    542		if (delta_sof >= 10)
    543			stream->clock.sof_offset = delta_sof;
    544		else
    545			stream->clock.sof_offset = 0;
    546	}
    547
    548	dev_sof = (dev_sof + stream->clock.sof_offset) & 2047;
    549
    550	spin_lock_irqsave(&stream->clock.lock, flags);
    551
    552	sample = &stream->clock.samples[stream->clock.head];
    553	sample->dev_stc = get_unaligned_le32(&data[header_size - 6]);
    554	sample->dev_sof = dev_sof;
    555	sample->host_sof = host_sof;
    556	sample->host_time = time;
    557
    558	/* Update the sliding window head and count. */
    559	stream->clock.head = (stream->clock.head + 1) % stream->clock.size;
    560
    561	if (stream->clock.count < stream->clock.size)
    562		stream->clock.count++;
    563
    564	spin_unlock_irqrestore(&stream->clock.lock, flags);
    565}
    566
    567static void uvc_video_clock_reset(struct uvc_streaming *stream)
    568{
    569	struct uvc_clock *clock = &stream->clock;
    570
    571	clock->head = 0;
    572	clock->count = 0;
    573	clock->last_sof = -1;
    574	clock->sof_offset = -1;
    575}
    576
    577static int uvc_video_clock_init(struct uvc_streaming *stream)
    578{
    579	struct uvc_clock *clock = &stream->clock;
    580
    581	spin_lock_init(&clock->lock);
    582	clock->size = 32;
    583
    584	clock->samples = kmalloc_array(clock->size, sizeof(*clock->samples),
    585				       GFP_KERNEL);
    586	if (clock->samples == NULL)
    587		return -ENOMEM;
    588
    589	uvc_video_clock_reset(stream);
    590
    591	return 0;
    592}
    593
    594static void uvc_video_clock_cleanup(struct uvc_streaming *stream)
    595{
    596	kfree(stream->clock.samples);
    597	stream->clock.samples = NULL;
    598}
    599
    600/*
    601 * uvc_video_clock_host_sof - Return the host SOF value for a clock sample
    602 *
    603 * Host SOF counters reported by usb_get_current_frame_number() usually don't
    604 * cover the whole 11-bits SOF range (0-2047) but are limited to the HCI frame
    605 * schedule window. They can be limited to 8, 9 or 10 bits depending on the host
    606 * controller and its configuration.
    607 *
    608 * We thus need to recover the SOF value corresponding to the host frame number.
    609 * As the device and host frame numbers are sampled in a short interval, the
    610 * difference between their values should be equal to a small delta plus an
    611 * integer multiple of 256 caused by the host frame number limited precision.
    612 *
    613 * To obtain the recovered host SOF value, compute the small delta by masking
    614 * the high bits of the host frame counter and device SOF difference and add it
    615 * to the device SOF value.
    616 */
    617static u16 uvc_video_clock_host_sof(const struct uvc_clock_sample *sample)
    618{
    619	/* The delta value can be negative. */
    620	s8 delta_sof;
    621
    622	delta_sof = (sample->host_sof - sample->dev_sof) & 255;
    623
    624	return (sample->dev_sof + delta_sof) & 2047;
    625}
    626
    627/*
    628 * uvc_video_clock_update - Update the buffer timestamp
    629 *
    630 * This function converts the buffer PTS timestamp to the host clock domain by
    631 * going through the USB SOF clock domain and stores the result in the V4L2
    632 * buffer timestamp field.
    633 *
    634 * The relationship between the device clock and the host clock isn't known.
    635 * However, the device and the host share the common USB SOF clock which can be
    636 * used to recover that relationship.
    637 *
    638 * The relationship between the device clock and the USB SOF clock is considered
    639 * to be linear over the clock samples sliding window and is given by
    640 *
    641 * SOF = m * PTS + p
    642 *
    643 * Several methods to compute the slope (m) and intercept (p) can be used. As
    644 * the clock drift should be small compared to the sliding window size, we
    645 * assume that the line that goes through the points at both ends of the window
    646 * is a good approximation. Naming those points P1 and P2, we get
    647 *
    648 * SOF = (SOF2 - SOF1) / (STC2 - STC1) * PTS
    649 *     + (SOF1 * STC2 - SOF2 * STC1) / (STC2 - STC1)
    650 *
    651 * or
    652 *
    653 * SOF = ((SOF2 - SOF1) * PTS + SOF1 * STC2 - SOF2 * STC1) / (STC2 - STC1)   (1)
    654 *
    655 * to avoid losing precision in the division. Similarly, the host timestamp is
    656 * computed with
    657 *
    658 * TS = ((TS2 - TS1) * SOF + TS1 * SOF2 - TS2 * SOF1) / (SOF2 - SOF1)	     (2)
    659 *
    660 * SOF values are coded on 11 bits by USB. We extend their precision with 16
    661 * decimal bits, leading to a 11.16 coding.
    662 *
    663 * TODO: To avoid surprises with device clock values, PTS/STC timestamps should
    664 * be normalized using the nominal device clock frequency reported through the
    665 * UVC descriptors.
    666 *
    667 * Both the PTS/STC and SOF counters roll over, after a fixed but device
    668 * specific amount of time for PTS/STC and after 2048ms for SOF. As long as the
    669 * sliding window size is smaller than the rollover period, differences computed
    670 * on unsigned integers will produce the correct result. However, the p term in
    671 * the linear relations will be miscomputed.
    672 *
    673 * To fix the issue, we subtract a constant from the PTS and STC values to bring
    674 * PTS to half the 32 bit STC range. The sliding window STC values then fit into
    675 * the 32 bit range without any rollover.
    676 *
    677 * Similarly, we add 2048 to the device SOF values to make sure that the SOF
    678 * computed by (1) will never be smaller than 0. This offset is then compensated
    679 * by adding 2048 to the SOF values used in (2). However, this doesn't prevent
    680 * rollovers between (1) and (2): the SOF value computed by (1) can be slightly
    681 * lower than 4096, and the host SOF counters can have rolled over to 2048. This
    682 * case is handled by subtracting 2048 from the SOF value if it exceeds the host
    683 * SOF value at the end of the sliding window.
    684 *
    685 * Finally we subtract a constant from the host timestamps to bring the first
    686 * timestamp of the sliding window to 1s.
    687 */
    688void uvc_video_clock_update(struct uvc_streaming *stream,
    689			    struct vb2_v4l2_buffer *vbuf,
    690			    struct uvc_buffer *buf)
    691{
    692	struct uvc_clock *clock = &stream->clock;
    693	struct uvc_clock_sample *first;
    694	struct uvc_clock_sample *last;
    695	unsigned long flags;
    696	u64 timestamp;
    697	u32 delta_stc;
    698	u32 y1, y2;
    699	u32 x1, x2;
    700	u32 mean;
    701	u32 sof;
    702	u64 y;
    703
    704	if (!uvc_hw_timestamps_param)
    705		return;
    706
    707	/*
    708	 * We will get called from __vb2_queue_cancel() if there are buffers
    709	 * done but not dequeued by the user, but the sample array has already
    710	 * been released at that time. Just bail out in that case.
    711	 */
    712	if (!clock->samples)
    713		return;
    714
    715	spin_lock_irqsave(&clock->lock, flags);
    716
    717	if (clock->count < clock->size)
    718		goto done;
    719
    720	first = &clock->samples[clock->head];
    721	last = &clock->samples[(clock->head - 1) % clock->size];
    722
    723	/* First step, PTS to SOF conversion. */
    724	delta_stc = buf->pts - (1UL << 31);
    725	x1 = first->dev_stc - delta_stc;
    726	x2 = last->dev_stc - delta_stc;
    727	if (x1 == x2)
    728		goto done;
    729
    730	y1 = (first->dev_sof + 2048) << 16;
    731	y2 = (last->dev_sof + 2048) << 16;
    732	if (y2 < y1)
    733		y2 += 2048 << 16;
    734
    735	y = (u64)(y2 - y1) * (1ULL << 31) + (u64)y1 * (u64)x2
    736	  - (u64)y2 * (u64)x1;
    737	y = div_u64(y, x2 - x1);
    738
    739	sof = y;
    740
    741	uvc_dbg(stream->dev, CLOCK,
    742		"%s: PTS %u y %llu.%06llu SOF %u.%06llu (x1 %u x2 %u y1 %u y2 %u SOF offset %u)\n",
    743		stream->dev->name, buf->pts,
    744		y >> 16, div_u64((y & 0xffff) * 1000000, 65536),
    745		sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
    746		x1, x2, y1, y2, clock->sof_offset);
    747
    748	/* Second step, SOF to host clock conversion. */
    749	x1 = (uvc_video_clock_host_sof(first) + 2048) << 16;
    750	x2 = (uvc_video_clock_host_sof(last) + 2048) << 16;
    751	if (x2 < x1)
    752		x2 += 2048 << 16;
    753	if (x1 == x2)
    754		goto done;
    755
    756	y1 = NSEC_PER_SEC;
    757	y2 = (u32)ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1;
    758
    759	/* Interpolated and host SOF timestamps can wrap around at slightly
    760	 * different times. Handle this by adding or removing 2048 to or from
    761	 * the computed SOF value to keep it close to the SOF samples mean
    762	 * value.
    763	 */
    764	mean = (x1 + x2) / 2;
    765	if (mean - (1024 << 16) > sof)
    766		sof += 2048 << 16;
    767	else if (sof > mean + (1024 << 16))
    768		sof -= 2048 << 16;
    769
    770	y = (u64)(y2 - y1) * (u64)sof + (u64)y1 * (u64)x2
    771	  - (u64)y2 * (u64)x1;
    772	y = div_u64(y, x2 - x1);
    773
    774	timestamp = ktime_to_ns(first->host_time) + y - y1;
    775
    776	uvc_dbg(stream->dev, CLOCK,
    777		"%s: SOF %u.%06llu y %llu ts %llu buf ts %llu (x1 %u/%u/%u x2 %u/%u/%u y1 %u y2 %u)\n",
    778		stream->dev->name,
    779		sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
    780		y, timestamp, vbuf->vb2_buf.timestamp,
    781		x1, first->host_sof, first->dev_sof,
    782		x2, last->host_sof, last->dev_sof, y1, y2);
    783
    784	/* Update the V4L2 buffer. */
    785	vbuf->vb2_buf.timestamp = timestamp;
    786
    787done:
    788	spin_unlock_irqrestore(&clock->lock, flags);
    789}
    790
    791/* ------------------------------------------------------------------------
    792 * Stream statistics
    793 */
    794
    795static void uvc_video_stats_decode(struct uvc_streaming *stream,
    796		const u8 *data, int len)
    797{
    798	unsigned int header_size;
    799	bool has_pts = false;
    800	bool has_scr = false;
    801	u16 scr_sof;
    802	u32 scr_stc;
    803	u32 pts;
    804
    805	if (stream->stats.stream.nb_frames == 0 &&
    806	    stream->stats.frame.nb_packets == 0)
    807		stream->stats.stream.start_ts = ktime_get();
    808
    809	switch (data[1] & (UVC_STREAM_PTS | UVC_STREAM_SCR)) {
    810	case UVC_STREAM_PTS | UVC_STREAM_SCR:
    811		header_size = 12;
    812		has_pts = true;
    813		has_scr = true;
    814		break;
    815	case UVC_STREAM_PTS:
    816		header_size = 6;
    817		has_pts = true;
    818		break;
    819	case UVC_STREAM_SCR:
    820		header_size = 8;
    821		has_scr = true;
    822		break;
    823	default:
    824		header_size = 2;
    825		break;
    826	}
    827
    828	/* Check for invalid headers. */
    829	if (len < header_size || data[0] < header_size) {
    830		stream->stats.frame.nb_invalid++;
    831		return;
    832	}
    833
    834	/* Extract the timestamps. */
    835	if (has_pts)
    836		pts = get_unaligned_le32(&data[2]);
    837
    838	if (has_scr) {
    839		scr_stc = get_unaligned_le32(&data[header_size - 6]);
    840		scr_sof = get_unaligned_le16(&data[header_size - 2]);
    841	}
    842
    843	/* Is PTS constant through the whole frame ? */
    844	if (has_pts && stream->stats.frame.nb_pts) {
    845		if (stream->stats.frame.pts != pts) {
    846			stream->stats.frame.nb_pts_diffs++;
    847			stream->stats.frame.last_pts_diff =
    848				stream->stats.frame.nb_packets;
    849		}
    850	}
    851
    852	if (has_pts) {
    853		stream->stats.frame.nb_pts++;
    854		stream->stats.frame.pts = pts;
    855	}
    856
    857	/* Do all frames have a PTS in their first non-empty packet, or before
    858	 * their first empty packet ?
    859	 */
    860	if (stream->stats.frame.size == 0) {
    861		if (len > header_size)
    862			stream->stats.frame.has_initial_pts = has_pts;
    863		if (len == header_size && has_pts)
    864			stream->stats.frame.has_early_pts = true;
    865	}
    866
    867	/* Do the SCR.STC and SCR.SOF fields vary through the frame ? */
    868	if (has_scr && stream->stats.frame.nb_scr) {
    869		if (stream->stats.frame.scr_stc != scr_stc)
    870			stream->stats.frame.nb_scr_diffs++;
    871	}
    872
    873	if (has_scr) {
    874		/* Expand the SOF counter to 32 bits and store its value. */
    875		if (stream->stats.stream.nb_frames > 0 ||
    876		    stream->stats.frame.nb_scr > 0)
    877			stream->stats.stream.scr_sof_count +=
    878				(scr_sof - stream->stats.stream.scr_sof) % 2048;
    879		stream->stats.stream.scr_sof = scr_sof;
    880
    881		stream->stats.frame.nb_scr++;
    882		stream->stats.frame.scr_stc = scr_stc;
    883		stream->stats.frame.scr_sof = scr_sof;
    884
    885		if (scr_sof < stream->stats.stream.min_sof)
    886			stream->stats.stream.min_sof = scr_sof;
    887		if (scr_sof > stream->stats.stream.max_sof)
    888			stream->stats.stream.max_sof = scr_sof;
    889	}
    890
    891	/* Record the first non-empty packet number. */
    892	if (stream->stats.frame.size == 0 && len > header_size)
    893		stream->stats.frame.first_data = stream->stats.frame.nb_packets;
    894
    895	/* Update the frame size. */
    896	stream->stats.frame.size += len - header_size;
    897
    898	/* Update the packets counters. */
    899	stream->stats.frame.nb_packets++;
    900	if (len <= header_size)
    901		stream->stats.frame.nb_empty++;
    902
    903	if (data[1] & UVC_STREAM_ERR)
    904		stream->stats.frame.nb_errors++;
    905}
    906
    907static void uvc_video_stats_update(struct uvc_streaming *stream)
    908{
    909	struct uvc_stats_frame *frame = &stream->stats.frame;
    910
    911	uvc_dbg(stream->dev, STATS,
    912		"frame %u stats: %u/%u/%u packets, %u/%u/%u pts (%searly %sinitial), %u/%u scr, last pts/stc/sof %u/%u/%u\n",
    913		stream->sequence, frame->first_data,
    914		frame->nb_packets - frame->nb_empty, frame->nb_packets,
    915		frame->nb_pts_diffs, frame->last_pts_diff, frame->nb_pts,
    916		frame->has_early_pts ? "" : "!",
    917		frame->has_initial_pts ? "" : "!",
    918		frame->nb_scr_diffs, frame->nb_scr,
    919		frame->pts, frame->scr_stc, frame->scr_sof);
    920
    921	stream->stats.stream.nb_frames++;
    922	stream->stats.stream.nb_packets += stream->stats.frame.nb_packets;
    923	stream->stats.stream.nb_empty += stream->stats.frame.nb_empty;
    924	stream->stats.stream.nb_errors += stream->stats.frame.nb_errors;
    925	stream->stats.stream.nb_invalid += stream->stats.frame.nb_invalid;
    926
    927	if (frame->has_early_pts)
    928		stream->stats.stream.nb_pts_early++;
    929	if (frame->has_initial_pts)
    930		stream->stats.stream.nb_pts_initial++;
    931	if (frame->last_pts_diff <= frame->first_data)
    932		stream->stats.stream.nb_pts_constant++;
    933	if (frame->nb_scr >= frame->nb_packets - frame->nb_empty)
    934		stream->stats.stream.nb_scr_count_ok++;
    935	if (frame->nb_scr_diffs + 1 == frame->nb_scr)
    936		stream->stats.stream.nb_scr_diffs_ok++;
    937
    938	memset(&stream->stats.frame, 0, sizeof(stream->stats.frame));
    939}
    940
    941size_t uvc_video_stats_dump(struct uvc_streaming *stream, char *buf,
    942			    size_t size)
    943{
    944	unsigned int scr_sof_freq;
    945	unsigned int duration;
    946	size_t count = 0;
    947
    948	/* Compute the SCR.SOF frequency estimate. At the nominal 1kHz SOF
    949	 * frequency this will not overflow before more than 1h.
    950	 */
    951	duration = ktime_ms_delta(stream->stats.stream.stop_ts,
    952				  stream->stats.stream.start_ts);
    953	if (duration != 0)
    954		scr_sof_freq = stream->stats.stream.scr_sof_count * 1000
    955			     / duration;
    956	else
    957		scr_sof_freq = 0;
    958
    959	count += scnprintf(buf + count, size - count,
    960			   "frames:  %u\npackets: %u\nempty:   %u\n"
    961			   "errors:  %u\ninvalid: %u\n",
    962			   stream->stats.stream.nb_frames,
    963			   stream->stats.stream.nb_packets,
    964			   stream->stats.stream.nb_empty,
    965			   stream->stats.stream.nb_errors,
    966			   stream->stats.stream.nb_invalid);
    967	count += scnprintf(buf + count, size - count,
    968			   "pts: %u early, %u initial, %u ok\n",
    969			   stream->stats.stream.nb_pts_early,
    970			   stream->stats.stream.nb_pts_initial,
    971			   stream->stats.stream.nb_pts_constant);
    972	count += scnprintf(buf + count, size - count,
    973			   "scr: %u count ok, %u diff ok\n",
    974			   stream->stats.stream.nb_scr_count_ok,
    975			   stream->stats.stream.nb_scr_diffs_ok);
    976	count += scnprintf(buf + count, size - count,
    977			   "sof: %u <= sof <= %u, freq %u.%03u kHz\n",
    978			   stream->stats.stream.min_sof,
    979			   stream->stats.stream.max_sof,
    980			   scr_sof_freq / 1000, scr_sof_freq % 1000);
    981
    982	return count;
    983}
    984
    985static void uvc_video_stats_start(struct uvc_streaming *stream)
    986{
    987	memset(&stream->stats, 0, sizeof(stream->stats));
    988	stream->stats.stream.min_sof = 2048;
    989}
    990
    991static void uvc_video_stats_stop(struct uvc_streaming *stream)
    992{
    993	stream->stats.stream.stop_ts = ktime_get();
    994}
    995
    996/* ------------------------------------------------------------------------
    997 * Video codecs
    998 */
    999
   1000/* Video payload decoding is handled by uvc_video_decode_start(),
   1001 * uvc_video_decode_data() and uvc_video_decode_end().
   1002 *
   1003 * uvc_video_decode_start is called with URB data at the start of a bulk or
   1004 * isochronous payload. It processes header data and returns the header size
   1005 * in bytes if successful. If an error occurs, it returns a negative error
   1006 * code. The following error codes have special meanings.
   1007 *
   1008 * - EAGAIN informs the caller that the current video buffer should be marked
   1009 *   as done, and that the function should be called again with the same data
   1010 *   and a new video buffer. This is used when end of frame conditions can be
   1011 *   reliably detected at the beginning of the next frame only.
   1012 *
   1013 * If an error other than -EAGAIN is returned, the caller will drop the current
   1014 * payload. No call to uvc_video_decode_data and uvc_video_decode_end will be
   1015 * made until the next payload. -ENODATA can be used to drop the current
   1016 * payload if no other error code is appropriate.
   1017 *
   1018 * uvc_video_decode_data is called for every URB with URB data. It copies the
   1019 * data to the video buffer.
   1020 *
   1021 * uvc_video_decode_end is called with header data at the end of a bulk or
   1022 * isochronous payload. It performs any additional header data processing and
   1023 * returns 0 or a negative error code if an error occurred. As header data have
   1024 * already been processed by uvc_video_decode_start, this functions isn't
   1025 * required to perform sanity checks a second time.
   1026 *
   1027 * For isochronous transfers where a payload is always transferred in a single
   1028 * URB, the three functions will be called in a row.
   1029 *
   1030 * To let the decoder process header data and update its internal state even
   1031 * when no video buffer is available, uvc_video_decode_start must be prepared
   1032 * to be called with a NULL buf parameter. uvc_video_decode_data and
   1033 * uvc_video_decode_end will never be called with a NULL buffer.
   1034 */
   1035static int uvc_video_decode_start(struct uvc_streaming *stream,
   1036		struct uvc_buffer *buf, const u8 *data, int len)
   1037{
   1038	u8 fid;
   1039
   1040	/* Sanity checks:
   1041	 * - packet must be at least 2 bytes long
   1042	 * - bHeaderLength value must be at least 2 bytes (see above)
   1043	 * - bHeaderLength value can't be larger than the packet size.
   1044	 */
   1045	if (len < 2 || data[0] < 2 || data[0] > len) {
   1046		stream->stats.frame.nb_invalid++;
   1047		return -EINVAL;
   1048	}
   1049
   1050	fid = data[1] & UVC_STREAM_FID;
   1051
   1052	/* Increase the sequence number regardless of any buffer states, so
   1053	 * that discontinuous sequence numbers always indicate lost frames.
   1054	 */
   1055	if (stream->last_fid != fid) {
   1056		stream->sequence++;
   1057		if (stream->sequence)
   1058			uvc_video_stats_update(stream);
   1059	}
   1060
   1061	uvc_video_clock_decode(stream, buf, data, len);
   1062	uvc_video_stats_decode(stream, data, len);
   1063
   1064	/* Store the payload FID bit and return immediately when the buffer is
   1065	 * NULL.
   1066	 */
   1067	if (buf == NULL) {
   1068		stream->last_fid = fid;
   1069		return -ENODATA;
   1070	}
   1071
   1072	/* Mark the buffer as bad if the error bit is set. */
   1073	if (data[1] & UVC_STREAM_ERR) {
   1074		uvc_dbg(stream->dev, FRAME,
   1075			"Marking buffer as bad (error bit set)\n");
   1076		buf->error = 1;
   1077	}
   1078
   1079	/* Synchronize to the input stream by waiting for the FID bit to be
   1080	 * toggled when the the buffer state is not UVC_BUF_STATE_ACTIVE.
   1081	 * stream->last_fid is initialized to -1, so the first isochronous
   1082	 * frame will always be in sync.
   1083	 *
   1084	 * If the device doesn't toggle the FID bit, invert stream->last_fid
   1085	 * when the EOF bit is set to force synchronisation on the next packet.
   1086	 */
   1087	if (buf->state != UVC_BUF_STATE_ACTIVE) {
   1088		if (fid == stream->last_fid) {
   1089			uvc_dbg(stream->dev, FRAME,
   1090				"Dropping payload (out of sync)\n");
   1091			if ((stream->dev->quirks & UVC_QUIRK_STREAM_NO_FID) &&
   1092			    (data[1] & UVC_STREAM_EOF))
   1093				stream->last_fid ^= UVC_STREAM_FID;
   1094			return -ENODATA;
   1095		}
   1096
   1097		buf->buf.field = V4L2_FIELD_NONE;
   1098		buf->buf.sequence = stream->sequence;
   1099		buf->buf.vb2_buf.timestamp = ktime_to_ns(uvc_video_get_time());
   1100
   1101		/* TODO: Handle PTS and SCR. */
   1102		buf->state = UVC_BUF_STATE_ACTIVE;
   1103	}
   1104
   1105	/* Mark the buffer as done if we're at the beginning of a new frame.
   1106	 * End of frame detection is better implemented by checking the EOF
   1107	 * bit (FID bit toggling is delayed by one frame compared to the EOF
   1108	 * bit), but some devices don't set the bit at end of frame (and the
   1109	 * last payload can be lost anyway). We thus must check if the FID has
   1110	 * been toggled.
   1111	 *
   1112	 * stream->last_fid is initialized to -1, so the first isochronous
   1113	 * frame will never trigger an end of frame detection.
   1114	 *
   1115	 * Empty buffers (bytesused == 0) don't trigger end of frame detection
   1116	 * as it doesn't make sense to return an empty buffer. This also
   1117	 * avoids detecting end of frame conditions at FID toggling if the
   1118	 * previous payload had the EOF bit set.
   1119	 */
   1120	if (fid != stream->last_fid && buf->bytesused != 0) {
   1121		uvc_dbg(stream->dev, FRAME,
   1122			"Frame complete (FID bit toggled)\n");
   1123		buf->state = UVC_BUF_STATE_READY;
   1124		return -EAGAIN;
   1125	}
   1126
   1127	stream->last_fid = fid;
   1128
   1129	return data[0];
   1130}
   1131
   1132static inline enum dma_data_direction uvc_stream_dir(
   1133				struct uvc_streaming *stream)
   1134{
   1135	if (stream->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
   1136		return DMA_FROM_DEVICE;
   1137	else
   1138		return DMA_TO_DEVICE;
   1139}
   1140
   1141static inline struct device *uvc_stream_to_dmadev(struct uvc_streaming *stream)
   1142{
   1143	return bus_to_hcd(stream->dev->udev->bus)->self.sysdev;
   1144}
   1145
   1146static int uvc_submit_urb(struct uvc_urb *uvc_urb, gfp_t mem_flags)
   1147{
   1148	/* Sync DMA. */
   1149	dma_sync_sgtable_for_device(uvc_stream_to_dmadev(uvc_urb->stream),
   1150				    uvc_urb->sgt,
   1151				    uvc_stream_dir(uvc_urb->stream));
   1152	return usb_submit_urb(uvc_urb->urb, mem_flags);
   1153}
   1154
   1155/*
   1156 * uvc_video_decode_data_work: Asynchronous memcpy processing
   1157 *
   1158 * Copy URB data to video buffers in process context, releasing buffer
   1159 * references and requeuing the URB when done.
   1160 */
   1161static void uvc_video_copy_data_work(struct work_struct *work)
   1162{
   1163	struct uvc_urb *uvc_urb = container_of(work, struct uvc_urb, work);
   1164	unsigned int i;
   1165	int ret;
   1166
   1167	for (i = 0; i < uvc_urb->async_operations; i++) {
   1168		struct uvc_copy_op *op = &uvc_urb->copy_operations[i];
   1169
   1170		memcpy(op->dst, op->src, op->len);
   1171
   1172		/* Release reference taken on this buffer. */
   1173		uvc_queue_buffer_release(op->buf);
   1174	}
   1175
   1176	ret = uvc_submit_urb(uvc_urb, GFP_KERNEL);
   1177	if (ret < 0)
   1178		dev_err(&uvc_urb->stream->intf->dev,
   1179			"Failed to resubmit video URB (%d).\n", ret);
   1180}
   1181
   1182static void uvc_video_decode_data(struct uvc_urb *uvc_urb,
   1183		struct uvc_buffer *buf, const u8 *data, int len)
   1184{
   1185	unsigned int active_op = uvc_urb->async_operations;
   1186	struct uvc_copy_op *op = &uvc_urb->copy_operations[active_op];
   1187	unsigned int maxlen;
   1188
   1189	if (len <= 0)
   1190		return;
   1191
   1192	maxlen = buf->length - buf->bytesused;
   1193
   1194	/* Take a buffer reference for async work. */
   1195	kref_get(&buf->ref);
   1196
   1197	op->buf = buf;
   1198	op->src = data;
   1199	op->dst = buf->mem + buf->bytesused;
   1200	op->len = min_t(unsigned int, len, maxlen);
   1201
   1202	buf->bytesused += op->len;
   1203
   1204	/* Complete the current frame if the buffer size was exceeded. */
   1205	if (len > maxlen) {
   1206		uvc_dbg(uvc_urb->stream->dev, FRAME,
   1207			"Frame complete (overflow)\n");
   1208		buf->error = 1;
   1209		buf->state = UVC_BUF_STATE_READY;
   1210	}
   1211
   1212	uvc_urb->async_operations++;
   1213}
   1214
   1215static void uvc_video_decode_end(struct uvc_streaming *stream,
   1216		struct uvc_buffer *buf, const u8 *data, int len)
   1217{
   1218	/* Mark the buffer as done if the EOF marker is set. */
   1219	if (data[1] & UVC_STREAM_EOF && buf->bytesused != 0) {
   1220		uvc_dbg(stream->dev, FRAME, "Frame complete (EOF found)\n");
   1221		if (data[0] == len)
   1222			uvc_dbg(stream->dev, FRAME, "EOF in empty payload\n");
   1223		buf->state = UVC_BUF_STATE_READY;
   1224		if (stream->dev->quirks & UVC_QUIRK_STREAM_NO_FID)
   1225			stream->last_fid ^= UVC_STREAM_FID;
   1226	}
   1227}
   1228
   1229/* Video payload encoding is handled by uvc_video_encode_header() and
   1230 * uvc_video_encode_data(). Only bulk transfers are currently supported.
   1231 *
   1232 * uvc_video_encode_header is called at the start of a payload. It adds header
   1233 * data to the transfer buffer and returns the header size. As the only known
   1234 * UVC output device transfers a whole frame in a single payload, the EOF bit
   1235 * is always set in the header.
   1236 *
   1237 * uvc_video_encode_data is called for every URB and copies the data from the
   1238 * video buffer to the transfer buffer.
   1239 */
   1240static int uvc_video_encode_header(struct uvc_streaming *stream,
   1241		struct uvc_buffer *buf, u8 *data, int len)
   1242{
   1243	data[0] = 2;	/* Header length */
   1244	data[1] = UVC_STREAM_EOH | UVC_STREAM_EOF
   1245		| (stream->last_fid & UVC_STREAM_FID);
   1246	return 2;
   1247}
   1248
   1249static int uvc_video_encode_data(struct uvc_streaming *stream,
   1250		struct uvc_buffer *buf, u8 *data, int len)
   1251{
   1252	struct uvc_video_queue *queue = &stream->queue;
   1253	unsigned int nbytes;
   1254	void *mem;
   1255
   1256	/* Copy video data to the URB buffer. */
   1257	mem = buf->mem + queue->buf_used;
   1258	nbytes = min((unsigned int)len, buf->bytesused - queue->buf_used);
   1259	nbytes = min(stream->bulk.max_payload_size - stream->bulk.payload_size,
   1260			nbytes);
   1261	memcpy(data, mem, nbytes);
   1262
   1263	queue->buf_used += nbytes;
   1264
   1265	return nbytes;
   1266}
   1267
   1268/* ------------------------------------------------------------------------
   1269 * Metadata
   1270 */
   1271
   1272/*
   1273 * Additionally to the payload headers we also want to provide the user with USB
   1274 * Frame Numbers and system time values. The resulting buffer is thus composed
   1275 * of blocks, containing a 64-bit timestamp in  nanoseconds, a 16-bit USB Frame
   1276 * Number, and a copy of the payload header.
   1277 *
   1278 * Ideally we want to capture all payload headers for each frame. However, their
   1279 * number is unknown and unbound. We thus drop headers that contain no vendor
   1280 * data and that either contain no SCR value or an SCR value identical to the
   1281 * previous header.
   1282 */
   1283static void uvc_video_decode_meta(struct uvc_streaming *stream,
   1284				  struct uvc_buffer *meta_buf,
   1285				  const u8 *mem, unsigned int length)
   1286{
   1287	struct uvc_meta_buf *meta;
   1288	size_t len_std = 2;
   1289	bool has_pts, has_scr;
   1290	unsigned long flags;
   1291	unsigned int sof;
   1292	ktime_t time;
   1293	const u8 *scr;
   1294
   1295	if (!meta_buf || length == 2)
   1296		return;
   1297
   1298	if (meta_buf->length - meta_buf->bytesused <
   1299	    length + sizeof(meta->ns) + sizeof(meta->sof)) {
   1300		meta_buf->error = 1;
   1301		return;
   1302	}
   1303
   1304	has_pts = mem[1] & UVC_STREAM_PTS;
   1305	has_scr = mem[1] & UVC_STREAM_SCR;
   1306
   1307	if (has_pts) {
   1308		len_std += 4;
   1309		scr = mem + 6;
   1310	} else {
   1311		scr = mem + 2;
   1312	}
   1313
   1314	if (has_scr)
   1315		len_std += 6;
   1316
   1317	if (stream->meta.format == V4L2_META_FMT_UVC)
   1318		length = len_std;
   1319
   1320	if (length == len_std && (!has_scr ||
   1321				  !memcmp(scr, stream->clock.last_scr, 6)))
   1322		return;
   1323
   1324	meta = (struct uvc_meta_buf *)((u8 *)meta_buf->mem + meta_buf->bytesused);
   1325	local_irq_save(flags);
   1326	time = uvc_video_get_time();
   1327	sof = usb_get_current_frame_number(stream->dev->udev);
   1328	local_irq_restore(flags);
   1329	put_unaligned(ktime_to_ns(time), &meta->ns);
   1330	put_unaligned(sof, &meta->sof);
   1331
   1332	if (has_scr)
   1333		memcpy(stream->clock.last_scr, scr, 6);
   1334
   1335	memcpy(&meta->length, mem, length);
   1336	meta_buf->bytesused += length + sizeof(meta->ns) + sizeof(meta->sof);
   1337
   1338	uvc_dbg(stream->dev, FRAME,
   1339		"%s(): t-sys %lluns, SOF %u, len %u, flags 0x%x, PTS %u, STC %u frame SOF %u\n",
   1340		__func__, ktime_to_ns(time), meta->sof, meta->length,
   1341		meta->flags,
   1342		has_pts ? *(u32 *)meta->buf : 0,
   1343		has_scr ? *(u32 *)scr : 0,
   1344		has_scr ? *(u32 *)(scr + 4) & 0x7ff : 0);
   1345}
   1346
   1347/* ------------------------------------------------------------------------
   1348 * URB handling
   1349 */
   1350
   1351/*
   1352 * Set error flag for incomplete buffer.
   1353 */
   1354static void uvc_video_validate_buffer(const struct uvc_streaming *stream,
   1355				      struct uvc_buffer *buf)
   1356{
   1357	if (stream->ctrl.dwMaxVideoFrameSize != buf->bytesused &&
   1358	    !(stream->cur_format->flags & UVC_FMT_FLAG_COMPRESSED))
   1359		buf->error = 1;
   1360}
   1361
   1362/*
   1363 * Completion handler for video URBs.
   1364 */
   1365
   1366static void uvc_video_next_buffers(struct uvc_streaming *stream,
   1367		struct uvc_buffer **video_buf, struct uvc_buffer **meta_buf)
   1368{
   1369	uvc_video_validate_buffer(stream, *video_buf);
   1370
   1371	if (*meta_buf) {
   1372		struct vb2_v4l2_buffer *vb2_meta = &(*meta_buf)->buf;
   1373		const struct vb2_v4l2_buffer *vb2_video = &(*video_buf)->buf;
   1374
   1375		vb2_meta->sequence = vb2_video->sequence;
   1376		vb2_meta->field = vb2_video->field;
   1377		vb2_meta->vb2_buf.timestamp = vb2_video->vb2_buf.timestamp;
   1378
   1379		(*meta_buf)->state = UVC_BUF_STATE_READY;
   1380		if (!(*meta_buf)->error)
   1381			(*meta_buf)->error = (*video_buf)->error;
   1382		*meta_buf = uvc_queue_next_buffer(&stream->meta.queue,
   1383						  *meta_buf);
   1384	}
   1385	*video_buf = uvc_queue_next_buffer(&stream->queue, *video_buf);
   1386}
   1387
   1388static void uvc_video_decode_isoc(struct uvc_urb *uvc_urb,
   1389			struct uvc_buffer *buf, struct uvc_buffer *meta_buf)
   1390{
   1391	struct urb *urb = uvc_urb->urb;
   1392	struct uvc_streaming *stream = uvc_urb->stream;
   1393	u8 *mem;
   1394	int ret, i;
   1395
   1396	for (i = 0; i < urb->number_of_packets; ++i) {
   1397		if (urb->iso_frame_desc[i].status < 0) {
   1398			uvc_dbg(stream->dev, FRAME,
   1399				"USB isochronous frame lost (%d)\n",
   1400				urb->iso_frame_desc[i].status);
   1401			/* Mark the buffer as faulty. */
   1402			if (buf != NULL)
   1403				buf->error = 1;
   1404			continue;
   1405		}
   1406
   1407		/* Decode the payload header. */
   1408		mem = urb->transfer_buffer + urb->iso_frame_desc[i].offset;
   1409		do {
   1410			ret = uvc_video_decode_start(stream, buf, mem,
   1411				urb->iso_frame_desc[i].actual_length);
   1412			if (ret == -EAGAIN)
   1413				uvc_video_next_buffers(stream, &buf, &meta_buf);
   1414		} while (ret == -EAGAIN);
   1415
   1416		if (ret < 0)
   1417			continue;
   1418
   1419		uvc_video_decode_meta(stream, meta_buf, mem, ret);
   1420
   1421		/* Decode the payload data. */
   1422		uvc_video_decode_data(uvc_urb, buf, mem + ret,
   1423			urb->iso_frame_desc[i].actual_length - ret);
   1424
   1425		/* Process the header again. */
   1426		uvc_video_decode_end(stream, buf, mem,
   1427			urb->iso_frame_desc[i].actual_length);
   1428
   1429		if (buf->state == UVC_BUF_STATE_READY)
   1430			uvc_video_next_buffers(stream, &buf, &meta_buf);
   1431	}
   1432}
   1433
   1434static void uvc_video_decode_bulk(struct uvc_urb *uvc_urb,
   1435			struct uvc_buffer *buf, struct uvc_buffer *meta_buf)
   1436{
   1437	struct urb *urb = uvc_urb->urb;
   1438	struct uvc_streaming *stream = uvc_urb->stream;
   1439	u8 *mem;
   1440	int len, ret;
   1441
   1442	/*
   1443	 * Ignore ZLPs if they're not part of a frame, otherwise process them
   1444	 * to trigger the end of payload detection.
   1445	 */
   1446	if (urb->actual_length == 0 && stream->bulk.header_size == 0)
   1447		return;
   1448
   1449	mem = urb->transfer_buffer;
   1450	len = urb->actual_length;
   1451	stream->bulk.payload_size += len;
   1452
   1453	/* If the URB is the first of its payload, decode and save the
   1454	 * header.
   1455	 */
   1456	if (stream->bulk.header_size == 0 && !stream->bulk.skip_payload) {
   1457		do {
   1458			ret = uvc_video_decode_start(stream, buf, mem, len);
   1459			if (ret == -EAGAIN)
   1460				uvc_video_next_buffers(stream, &buf, &meta_buf);
   1461		} while (ret == -EAGAIN);
   1462
   1463		/* If an error occurred skip the rest of the payload. */
   1464		if (ret < 0 || buf == NULL) {
   1465			stream->bulk.skip_payload = 1;
   1466		} else {
   1467			memcpy(stream->bulk.header, mem, ret);
   1468			stream->bulk.header_size = ret;
   1469
   1470			uvc_video_decode_meta(stream, meta_buf, mem, ret);
   1471
   1472			mem += ret;
   1473			len -= ret;
   1474		}
   1475	}
   1476
   1477	/* The buffer queue might have been cancelled while a bulk transfer
   1478	 * was in progress, so we can reach here with buf equal to NULL. Make
   1479	 * sure buf is never dereferenced if NULL.
   1480	 */
   1481
   1482	/* Prepare video data for processing. */
   1483	if (!stream->bulk.skip_payload && buf != NULL)
   1484		uvc_video_decode_data(uvc_urb, buf, mem, len);
   1485
   1486	/* Detect the payload end by a URB smaller than the maximum size (or
   1487	 * a payload size equal to the maximum) and process the header again.
   1488	 */
   1489	if (urb->actual_length < urb->transfer_buffer_length ||
   1490	    stream->bulk.payload_size >= stream->bulk.max_payload_size) {
   1491		if (!stream->bulk.skip_payload && buf != NULL) {
   1492			uvc_video_decode_end(stream, buf, stream->bulk.header,
   1493				stream->bulk.payload_size);
   1494			if (buf->state == UVC_BUF_STATE_READY)
   1495				uvc_video_next_buffers(stream, &buf, &meta_buf);
   1496		}
   1497
   1498		stream->bulk.header_size = 0;
   1499		stream->bulk.skip_payload = 0;
   1500		stream->bulk.payload_size = 0;
   1501	}
   1502}
   1503
   1504static void uvc_video_encode_bulk(struct uvc_urb *uvc_urb,
   1505	struct uvc_buffer *buf, struct uvc_buffer *meta_buf)
   1506{
   1507	struct urb *urb = uvc_urb->urb;
   1508	struct uvc_streaming *stream = uvc_urb->stream;
   1509
   1510	u8 *mem = urb->transfer_buffer;
   1511	int len = stream->urb_size, ret;
   1512
   1513	if (buf == NULL) {
   1514		urb->transfer_buffer_length = 0;
   1515		return;
   1516	}
   1517
   1518	/* If the URB is the first of its payload, add the header. */
   1519	if (stream->bulk.header_size == 0) {
   1520		ret = uvc_video_encode_header(stream, buf, mem, len);
   1521		stream->bulk.header_size = ret;
   1522		stream->bulk.payload_size += ret;
   1523		mem += ret;
   1524		len -= ret;
   1525	}
   1526
   1527	/* Process video data. */
   1528	ret = uvc_video_encode_data(stream, buf, mem, len);
   1529
   1530	stream->bulk.payload_size += ret;
   1531	len -= ret;
   1532
   1533	if (buf->bytesused == stream->queue.buf_used ||
   1534	    stream->bulk.payload_size == stream->bulk.max_payload_size) {
   1535		if (buf->bytesused == stream->queue.buf_used) {
   1536			stream->queue.buf_used = 0;
   1537			buf->state = UVC_BUF_STATE_READY;
   1538			buf->buf.sequence = ++stream->sequence;
   1539			uvc_queue_next_buffer(&stream->queue, buf);
   1540			stream->last_fid ^= UVC_STREAM_FID;
   1541		}
   1542
   1543		stream->bulk.header_size = 0;
   1544		stream->bulk.payload_size = 0;
   1545	}
   1546
   1547	urb->transfer_buffer_length = stream->urb_size - len;
   1548}
   1549
   1550static void uvc_video_complete(struct urb *urb)
   1551{
   1552	struct uvc_urb *uvc_urb = urb->context;
   1553	struct uvc_streaming *stream = uvc_urb->stream;
   1554	struct uvc_video_queue *queue = &stream->queue;
   1555	struct uvc_video_queue *qmeta = &stream->meta.queue;
   1556	struct vb2_queue *vb2_qmeta = stream->meta.vdev.queue;
   1557	struct uvc_buffer *buf = NULL;
   1558	struct uvc_buffer *buf_meta = NULL;
   1559	unsigned long flags;
   1560	int ret;
   1561
   1562	switch (urb->status) {
   1563	case 0:
   1564		break;
   1565
   1566	default:
   1567		dev_warn(&stream->intf->dev,
   1568			 "Non-zero status (%d) in video completion handler.\n",
   1569			 urb->status);
   1570		fallthrough;
   1571	case -ENOENT:		/* usb_poison_urb() called. */
   1572		if (stream->frozen)
   1573			return;
   1574		fallthrough;
   1575	case -ECONNRESET:	/* usb_unlink_urb() called. */
   1576	case -ESHUTDOWN:	/* The endpoint is being disabled. */
   1577		uvc_queue_cancel(queue, urb->status == -ESHUTDOWN);
   1578		if (vb2_qmeta)
   1579			uvc_queue_cancel(qmeta, urb->status == -ESHUTDOWN);
   1580		return;
   1581	}
   1582
   1583	buf = uvc_queue_get_current_buffer(queue);
   1584
   1585	if (vb2_qmeta) {
   1586		spin_lock_irqsave(&qmeta->irqlock, flags);
   1587		if (!list_empty(&qmeta->irqqueue))
   1588			buf_meta = list_first_entry(&qmeta->irqqueue,
   1589						    struct uvc_buffer, queue);
   1590		spin_unlock_irqrestore(&qmeta->irqlock, flags);
   1591	}
   1592
   1593	/* Re-initialise the URB async work. */
   1594	uvc_urb->async_operations = 0;
   1595
   1596	/* Sync DMA and invalidate vmap range. */
   1597	dma_sync_sgtable_for_cpu(uvc_stream_to_dmadev(uvc_urb->stream),
   1598				 uvc_urb->sgt, uvc_stream_dir(stream));
   1599	invalidate_kernel_vmap_range(uvc_urb->buffer,
   1600				     uvc_urb->stream->urb_size);
   1601
   1602	/*
   1603	 * Process the URB headers, and optionally queue expensive memcpy tasks
   1604	 * to be deferred to a work queue.
   1605	 */
   1606	stream->decode(uvc_urb, buf, buf_meta);
   1607
   1608	/* If no async work is needed, resubmit the URB immediately. */
   1609	if (!uvc_urb->async_operations) {
   1610		ret = uvc_submit_urb(uvc_urb, GFP_ATOMIC);
   1611		if (ret < 0)
   1612			dev_err(&stream->intf->dev,
   1613				"Failed to resubmit video URB (%d).\n", ret);
   1614		return;
   1615	}
   1616
   1617	queue_work(stream->async_wq, &uvc_urb->work);
   1618}
   1619
   1620/*
   1621 * Free transfer buffers.
   1622 */
   1623static void uvc_free_urb_buffers(struct uvc_streaming *stream)
   1624{
   1625	struct device *dma_dev = uvc_stream_to_dmadev(stream);
   1626	struct uvc_urb *uvc_urb;
   1627
   1628	for_each_uvc_urb(uvc_urb, stream) {
   1629		if (!uvc_urb->buffer)
   1630			continue;
   1631
   1632		dma_vunmap_noncontiguous(dma_dev, uvc_urb->buffer);
   1633		dma_free_noncontiguous(dma_dev, stream->urb_size, uvc_urb->sgt,
   1634				       uvc_stream_dir(stream));
   1635
   1636		uvc_urb->buffer = NULL;
   1637		uvc_urb->sgt = NULL;
   1638	}
   1639
   1640	stream->urb_size = 0;
   1641}
   1642
   1643static bool uvc_alloc_urb_buffer(struct uvc_streaming *stream,
   1644				 struct uvc_urb *uvc_urb, gfp_t gfp_flags)
   1645{
   1646	struct device *dma_dev = uvc_stream_to_dmadev(stream);
   1647
   1648	uvc_urb->sgt = dma_alloc_noncontiguous(dma_dev, stream->urb_size,
   1649					       uvc_stream_dir(stream),
   1650					       gfp_flags, 0);
   1651	if (!uvc_urb->sgt)
   1652		return false;
   1653	uvc_urb->dma = uvc_urb->sgt->sgl->dma_address;
   1654
   1655	uvc_urb->buffer = dma_vmap_noncontiguous(dma_dev, stream->urb_size,
   1656						 uvc_urb->sgt);
   1657	if (!uvc_urb->buffer) {
   1658		dma_free_noncontiguous(dma_dev, stream->urb_size,
   1659				       uvc_urb->sgt,
   1660				       uvc_stream_dir(stream));
   1661		uvc_urb->sgt = NULL;
   1662		return false;
   1663	}
   1664
   1665	return true;
   1666}
   1667
   1668/*
   1669 * Allocate transfer buffers. This function can be called with buffers
   1670 * already allocated when resuming from suspend, in which case it will
   1671 * return without touching the buffers.
   1672 *
   1673 * Limit the buffer size to UVC_MAX_PACKETS bulk/isochronous packets. If the
   1674 * system is too low on memory try successively smaller numbers of packets
   1675 * until allocation succeeds.
   1676 *
   1677 * Return the number of allocated packets on success or 0 when out of memory.
   1678 */
   1679static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
   1680	unsigned int size, unsigned int psize, gfp_t gfp_flags)
   1681{
   1682	unsigned int npackets;
   1683	unsigned int i;
   1684
   1685	/* Buffers are already allocated, bail out. */
   1686	if (stream->urb_size)
   1687		return stream->urb_size / psize;
   1688
   1689	/* Compute the number of packets. Bulk endpoints might transfer UVC
   1690	 * payloads across multiple URBs.
   1691	 */
   1692	npackets = DIV_ROUND_UP(size, psize);
   1693	if (npackets > UVC_MAX_PACKETS)
   1694		npackets = UVC_MAX_PACKETS;
   1695
   1696	/* Retry allocations until one succeed. */
   1697	for (; npackets > 1; npackets /= 2) {
   1698		stream->urb_size = psize * npackets;
   1699
   1700		for (i = 0; i < UVC_URBS; ++i) {
   1701			struct uvc_urb *uvc_urb = &stream->uvc_urb[i];
   1702
   1703			if (!uvc_alloc_urb_buffer(stream, uvc_urb, gfp_flags)) {
   1704				uvc_free_urb_buffers(stream);
   1705				break;
   1706			}
   1707
   1708			uvc_urb->stream = stream;
   1709		}
   1710
   1711		if (i == UVC_URBS) {
   1712			uvc_dbg(stream->dev, VIDEO,
   1713				"Allocated %u URB buffers of %ux%u bytes each\n",
   1714				UVC_URBS, npackets, psize);
   1715			return npackets;
   1716		}
   1717	}
   1718
   1719	uvc_dbg(stream->dev, VIDEO,
   1720		"Failed to allocate URB buffers (%u bytes per packet)\n",
   1721		psize);
   1722	return 0;
   1723}
   1724
   1725/*
   1726 * Uninitialize isochronous/bulk URBs and free transfer buffers.
   1727 */
   1728static void uvc_video_stop_transfer(struct uvc_streaming *stream,
   1729				    int free_buffers)
   1730{
   1731	struct uvc_urb *uvc_urb;
   1732
   1733	uvc_video_stats_stop(stream);
   1734
   1735	/*
   1736	 * We must poison the URBs rather than kill them to ensure that even
   1737	 * after the completion handler returns, any asynchronous workqueues
   1738	 * will be prevented from resubmitting the URBs.
   1739	 */
   1740	for_each_uvc_urb(uvc_urb, stream)
   1741		usb_poison_urb(uvc_urb->urb);
   1742
   1743	flush_workqueue(stream->async_wq);
   1744
   1745	for_each_uvc_urb(uvc_urb, stream) {
   1746		usb_free_urb(uvc_urb->urb);
   1747		uvc_urb->urb = NULL;
   1748	}
   1749
   1750	if (free_buffers)
   1751		uvc_free_urb_buffers(stream);
   1752}
   1753
   1754/*
   1755 * Compute the maximum number of bytes per interval for an endpoint.
   1756 */
   1757u16 uvc_endpoint_max_bpi(struct usb_device *dev, struct usb_host_endpoint *ep)
   1758{
   1759	u16 psize;
   1760
   1761	switch (dev->speed) {
   1762	case USB_SPEED_SUPER:
   1763	case USB_SPEED_SUPER_PLUS:
   1764		return le16_to_cpu(ep->ss_ep_comp.wBytesPerInterval);
   1765	default:
   1766		psize = usb_endpoint_maxp(&ep->desc);
   1767		psize *= usb_endpoint_maxp_mult(&ep->desc);
   1768		return psize;
   1769	}
   1770}
   1771
   1772/*
   1773 * Initialize isochronous URBs and allocate transfer buffers. The packet size
   1774 * is given by the endpoint.
   1775 */
   1776static int uvc_init_video_isoc(struct uvc_streaming *stream,
   1777	struct usb_host_endpoint *ep, gfp_t gfp_flags)
   1778{
   1779	struct urb *urb;
   1780	struct uvc_urb *uvc_urb;
   1781	unsigned int npackets, i;
   1782	u16 psize;
   1783	u32 size;
   1784
   1785	psize = uvc_endpoint_max_bpi(stream->dev->udev, ep);
   1786	size = stream->ctrl.dwMaxVideoFrameSize;
   1787
   1788	npackets = uvc_alloc_urb_buffers(stream, size, psize, gfp_flags);
   1789	if (npackets == 0)
   1790		return -ENOMEM;
   1791
   1792	size = npackets * psize;
   1793
   1794	for_each_uvc_urb(uvc_urb, stream) {
   1795		urb = usb_alloc_urb(npackets, gfp_flags);
   1796		if (urb == NULL) {
   1797			uvc_video_stop_transfer(stream, 1);
   1798			return -ENOMEM;
   1799		}
   1800
   1801		urb->dev = stream->dev->udev;
   1802		urb->context = uvc_urb;
   1803		urb->pipe = usb_rcvisocpipe(stream->dev->udev,
   1804				ep->desc.bEndpointAddress);
   1805		urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
   1806		urb->transfer_dma = uvc_urb->dma;
   1807		urb->interval = ep->desc.bInterval;
   1808		urb->transfer_buffer = uvc_urb->buffer;
   1809		urb->complete = uvc_video_complete;
   1810		urb->number_of_packets = npackets;
   1811		urb->transfer_buffer_length = size;
   1812
   1813		for (i = 0; i < npackets; ++i) {
   1814			urb->iso_frame_desc[i].offset = i * psize;
   1815			urb->iso_frame_desc[i].length = psize;
   1816		}
   1817
   1818		uvc_urb->urb = urb;
   1819	}
   1820
   1821	return 0;
   1822}
   1823
   1824/*
   1825 * Initialize bulk URBs and allocate transfer buffers. The packet size is
   1826 * given by the endpoint.
   1827 */
   1828static int uvc_init_video_bulk(struct uvc_streaming *stream,
   1829	struct usb_host_endpoint *ep, gfp_t gfp_flags)
   1830{
   1831	struct urb *urb;
   1832	struct uvc_urb *uvc_urb;
   1833	unsigned int npackets, pipe;
   1834	u16 psize;
   1835	u32 size;
   1836
   1837	psize = usb_endpoint_maxp(&ep->desc);
   1838	size = stream->ctrl.dwMaxPayloadTransferSize;
   1839	stream->bulk.max_payload_size = size;
   1840
   1841	npackets = uvc_alloc_urb_buffers(stream, size, psize, gfp_flags);
   1842	if (npackets == 0)
   1843		return -ENOMEM;
   1844
   1845	size = npackets * psize;
   1846
   1847	if (usb_endpoint_dir_in(&ep->desc))
   1848		pipe = usb_rcvbulkpipe(stream->dev->udev,
   1849				       ep->desc.bEndpointAddress);
   1850	else
   1851		pipe = usb_sndbulkpipe(stream->dev->udev,
   1852				       ep->desc.bEndpointAddress);
   1853
   1854	if (stream->type == V4L2_BUF_TYPE_VIDEO_OUTPUT)
   1855		size = 0;
   1856
   1857	for_each_uvc_urb(uvc_urb, stream) {
   1858		urb = usb_alloc_urb(0, gfp_flags);
   1859		if (urb == NULL) {
   1860			uvc_video_stop_transfer(stream, 1);
   1861			return -ENOMEM;
   1862		}
   1863
   1864		usb_fill_bulk_urb(urb, stream->dev->udev, pipe,	uvc_urb->buffer,
   1865				  size, uvc_video_complete, uvc_urb);
   1866		urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
   1867		urb->transfer_dma = uvc_urb->dma;
   1868
   1869		uvc_urb->urb = urb;
   1870	}
   1871
   1872	return 0;
   1873}
   1874
   1875/*
   1876 * Initialize isochronous/bulk URBs and allocate transfer buffers.
   1877 */
   1878static int uvc_video_start_transfer(struct uvc_streaming *stream,
   1879				    gfp_t gfp_flags)
   1880{
   1881	struct usb_interface *intf = stream->intf;
   1882	struct usb_host_endpoint *ep;
   1883	struct uvc_urb *uvc_urb;
   1884	unsigned int i;
   1885	int ret;
   1886
   1887	stream->sequence = -1;
   1888	stream->last_fid = -1;
   1889	stream->bulk.header_size = 0;
   1890	stream->bulk.skip_payload = 0;
   1891	stream->bulk.payload_size = 0;
   1892
   1893	uvc_video_stats_start(stream);
   1894
   1895	if (intf->num_altsetting > 1) {
   1896		struct usb_host_endpoint *best_ep = NULL;
   1897		unsigned int best_psize = UINT_MAX;
   1898		unsigned int bandwidth;
   1899		unsigned int altsetting;
   1900		int intfnum = stream->intfnum;
   1901
   1902		/* Isochronous endpoint, select the alternate setting. */
   1903		bandwidth = stream->ctrl.dwMaxPayloadTransferSize;
   1904
   1905		if (bandwidth == 0) {
   1906			uvc_dbg(stream->dev, VIDEO,
   1907				"Device requested null bandwidth, defaulting to lowest\n");
   1908			bandwidth = 1;
   1909		} else {
   1910			uvc_dbg(stream->dev, VIDEO,
   1911				"Device requested %u B/frame bandwidth\n",
   1912				bandwidth);
   1913		}
   1914
   1915		for (i = 0; i < intf->num_altsetting; ++i) {
   1916			struct usb_host_interface *alts;
   1917			unsigned int psize;
   1918
   1919			alts = &intf->altsetting[i];
   1920			ep = uvc_find_endpoint(alts,
   1921				stream->header.bEndpointAddress);
   1922			if (ep == NULL)
   1923				continue;
   1924
   1925			/* Check if the bandwidth is high enough. */
   1926			psize = uvc_endpoint_max_bpi(stream->dev->udev, ep);
   1927			if (psize >= bandwidth && psize <= best_psize) {
   1928				altsetting = alts->desc.bAlternateSetting;
   1929				best_psize = psize;
   1930				best_ep = ep;
   1931			}
   1932		}
   1933
   1934		if (best_ep == NULL) {
   1935			uvc_dbg(stream->dev, VIDEO,
   1936				"No fast enough alt setting for requested bandwidth\n");
   1937			return -EIO;
   1938		}
   1939
   1940		uvc_dbg(stream->dev, VIDEO,
   1941			"Selecting alternate setting %u (%u B/frame bandwidth)\n",
   1942			altsetting, best_psize);
   1943
   1944		ret = usb_set_interface(stream->dev->udev, intfnum, altsetting);
   1945		if (ret < 0)
   1946			return ret;
   1947
   1948		ret = uvc_init_video_isoc(stream, best_ep, gfp_flags);
   1949	} else {
   1950		/* Bulk endpoint, proceed to URB initialization. */
   1951		ep = uvc_find_endpoint(&intf->altsetting[0],
   1952				stream->header.bEndpointAddress);
   1953		if (ep == NULL)
   1954			return -EIO;
   1955
   1956		/* Reject broken descriptors. */
   1957		if (usb_endpoint_maxp(&ep->desc) == 0)
   1958			return -EIO;
   1959
   1960		ret = uvc_init_video_bulk(stream, ep, gfp_flags);
   1961	}
   1962
   1963	if (ret < 0)
   1964		return ret;
   1965
   1966	/* Submit the URBs. */
   1967	for_each_uvc_urb(uvc_urb, stream) {
   1968		ret = uvc_submit_urb(uvc_urb, gfp_flags);
   1969		if (ret < 0) {
   1970			dev_err(&stream->intf->dev,
   1971				"Failed to submit URB %u (%d).\n",
   1972				uvc_urb_index(uvc_urb), ret);
   1973			uvc_video_stop_transfer(stream, 1);
   1974			return ret;
   1975		}
   1976	}
   1977
   1978	/* The Logitech C920 temporarily forgets that it should not be adjusting
   1979	 * Exposure Absolute during init so restore controls to stored values.
   1980	 */
   1981	if (stream->dev->quirks & UVC_QUIRK_RESTORE_CTRLS_ON_INIT)
   1982		uvc_ctrl_restore_values(stream->dev);
   1983
   1984	return 0;
   1985}
   1986
   1987/* --------------------------------------------------------------------------
   1988 * Suspend/resume
   1989 */
   1990
   1991/*
   1992 * Stop streaming without disabling the video queue.
   1993 *
   1994 * To let userspace applications resume without trouble, we must not touch the
   1995 * video buffers in any way. We mark the device as frozen to make sure the URB
   1996 * completion handler won't try to cancel the queue when we kill the URBs.
   1997 */
   1998int uvc_video_suspend(struct uvc_streaming *stream)
   1999{
   2000	if (!uvc_queue_streaming(&stream->queue))
   2001		return 0;
   2002
   2003	stream->frozen = 1;
   2004	uvc_video_stop_transfer(stream, 0);
   2005	usb_set_interface(stream->dev->udev, stream->intfnum, 0);
   2006	return 0;
   2007}
   2008
   2009/*
   2010 * Reconfigure the video interface and restart streaming if it was enabled
   2011 * before suspend.
   2012 *
   2013 * If an error occurs, disable the video queue. This will wake all pending
   2014 * buffers, making sure userspace applications are notified of the problem
   2015 * instead of waiting forever.
   2016 */
   2017int uvc_video_resume(struct uvc_streaming *stream, int reset)
   2018{
   2019	int ret;
   2020
   2021	/* If the bus has been reset on resume, set the alternate setting to 0.
   2022	 * This should be the default value, but some devices crash or otherwise
   2023	 * misbehave if they don't receive a SET_INTERFACE request before any
   2024	 * other video control request.
   2025	 */
   2026	if (reset)
   2027		usb_set_interface(stream->dev->udev, stream->intfnum, 0);
   2028
   2029	stream->frozen = 0;
   2030
   2031	uvc_video_clock_reset(stream);
   2032
   2033	if (!uvc_queue_streaming(&stream->queue))
   2034		return 0;
   2035
   2036	ret = uvc_commit_video(stream, &stream->ctrl);
   2037	if (ret < 0)
   2038		return ret;
   2039
   2040	return uvc_video_start_transfer(stream, GFP_NOIO);
   2041}
   2042
   2043/* ------------------------------------------------------------------------
   2044 * Video device
   2045 */
   2046
   2047/*
   2048 * Initialize the UVC video device by switching to alternate setting 0 and
   2049 * retrieve the default format.
   2050 *
   2051 * Some cameras (namely the Fuji Finepix) set the format and frame
   2052 * indexes to zero. The UVC standard doesn't clearly make this a spec
   2053 * violation, so try to silently fix the values if possible.
   2054 *
   2055 * This function is called before registering the device with V4L.
   2056 */
   2057int uvc_video_init(struct uvc_streaming *stream)
   2058{
   2059	struct uvc_streaming_control *probe = &stream->ctrl;
   2060	struct uvc_format *format = NULL;
   2061	struct uvc_frame *frame = NULL;
   2062	struct uvc_urb *uvc_urb;
   2063	unsigned int i;
   2064	int ret;
   2065
   2066	if (stream->nformats == 0) {
   2067		dev_info(&stream->intf->dev,
   2068			 "No supported video formats found.\n");
   2069		return -EINVAL;
   2070	}
   2071
   2072	atomic_set(&stream->active, 0);
   2073
   2074	/* Alternate setting 0 should be the default, yet the XBox Live Vision
   2075	 * Cam (and possibly other devices) crash or otherwise misbehave if
   2076	 * they don't receive a SET_INTERFACE request before any other video
   2077	 * control request.
   2078	 */
   2079	usb_set_interface(stream->dev->udev, stream->intfnum, 0);
   2080
   2081	/* Set the streaming probe control with default streaming parameters
   2082	 * retrieved from the device. Webcams that don't support GET_DEF
   2083	 * requests on the probe control will just keep their current streaming
   2084	 * parameters.
   2085	 */
   2086	if (uvc_get_video_ctrl(stream, probe, 1, UVC_GET_DEF) == 0)
   2087		uvc_set_video_ctrl(stream, probe, 1);
   2088
   2089	/* Initialize the streaming parameters with the probe control current
   2090	 * value. This makes sure SET_CUR requests on the streaming commit
   2091	 * control will always use values retrieved from a successful GET_CUR
   2092	 * request on the probe control, as required by the UVC specification.
   2093	 */
   2094	ret = uvc_get_video_ctrl(stream, probe, 1, UVC_GET_CUR);
   2095	if (ret < 0)
   2096		return ret;
   2097
   2098	/* Check if the default format descriptor exists. Use the first
   2099	 * available format otherwise.
   2100	 */
   2101	for (i = stream->nformats; i > 0; --i) {
   2102		format = &stream->format[i-1];
   2103		if (format->index == probe->bFormatIndex)
   2104			break;
   2105	}
   2106
   2107	if (format->nframes == 0) {
   2108		dev_info(&stream->intf->dev,
   2109			 "No frame descriptor found for the default format.\n");
   2110		return -EINVAL;
   2111	}
   2112
   2113	/* Zero bFrameIndex might be correct. Stream-based formats (including
   2114	 * MPEG-2 TS and DV) do not support frames but have a dummy frame
   2115	 * descriptor with bFrameIndex set to zero. If the default frame
   2116	 * descriptor is not found, use the first available frame.
   2117	 */
   2118	for (i = format->nframes; i > 0; --i) {
   2119		frame = &format->frame[i-1];
   2120		if (frame->bFrameIndex == probe->bFrameIndex)
   2121			break;
   2122	}
   2123
   2124	probe->bFormatIndex = format->index;
   2125	probe->bFrameIndex = frame->bFrameIndex;
   2126
   2127	stream->def_format = format;
   2128	stream->cur_format = format;
   2129	stream->cur_frame = frame;
   2130
   2131	/* Select the video decoding function */
   2132	if (stream->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
   2133		if (stream->dev->quirks & UVC_QUIRK_BUILTIN_ISIGHT)
   2134			stream->decode = uvc_video_decode_isight;
   2135		else if (stream->intf->num_altsetting > 1)
   2136			stream->decode = uvc_video_decode_isoc;
   2137		else
   2138			stream->decode = uvc_video_decode_bulk;
   2139	} else {
   2140		if (stream->intf->num_altsetting == 1)
   2141			stream->decode = uvc_video_encode_bulk;
   2142		else {
   2143			dev_info(&stream->intf->dev,
   2144				 "Isochronous endpoints are not supported for video output devices.\n");
   2145			return -EINVAL;
   2146		}
   2147	}
   2148
   2149	/* Prepare asynchronous work items. */
   2150	for_each_uvc_urb(uvc_urb, stream)
   2151		INIT_WORK(&uvc_urb->work, uvc_video_copy_data_work);
   2152
   2153	return 0;
   2154}
   2155
   2156int uvc_video_start_streaming(struct uvc_streaming *stream)
   2157{
   2158	int ret;
   2159
   2160	ret = uvc_video_clock_init(stream);
   2161	if (ret < 0)
   2162		return ret;
   2163
   2164	/* Commit the streaming parameters. */
   2165	ret = uvc_commit_video(stream, &stream->ctrl);
   2166	if (ret < 0)
   2167		goto error_commit;
   2168
   2169	ret = uvc_video_start_transfer(stream, GFP_KERNEL);
   2170	if (ret < 0)
   2171		goto error_video;
   2172
   2173	return 0;
   2174
   2175error_video:
   2176	usb_set_interface(stream->dev->udev, stream->intfnum, 0);
   2177error_commit:
   2178	uvc_video_clock_cleanup(stream);
   2179
   2180	return ret;
   2181}
   2182
   2183void uvc_video_stop_streaming(struct uvc_streaming *stream)
   2184{
   2185	uvc_video_stop_transfer(stream, 1);
   2186
   2187	if (stream->intf->num_altsetting > 1) {
   2188		usb_set_interface(stream->dev->udev, stream->intfnum, 0);
   2189	} else {
   2190		/* UVC doesn't specify how to inform a bulk-based device
   2191		 * when the video stream is stopped. Windows sends a
   2192		 * CLEAR_FEATURE(HALT) request to the video streaming
   2193		 * bulk endpoint, mimic the same behaviour.
   2194		 */
   2195		unsigned int epnum = stream->header.bEndpointAddress
   2196				   & USB_ENDPOINT_NUMBER_MASK;
   2197		unsigned int dir = stream->header.bEndpointAddress
   2198				 & USB_ENDPOINT_DIR_MASK;
   2199		unsigned int pipe;
   2200
   2201		pipe = usb_sndbulkpipe(stream->dev->udev, epnum) | dir;
   2202		usb_clear_halt(stream->dev->udev, pipe);
   2203	}
   2204
   2205	uvc_video_clock_cleanup(stream);
   2206}