1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* uvc_video.c -- USB Video Class driver - Video handling
4	*
5	* Copyright (C) 2005-2010
6	* Laurent Pinchart (laurent.pinchart@ideasonboard.com)
7	*/
8
9	#include <linux/dma-mapping.h>
10	#include <linux/highmem.h>
11	#include <linux/kernel.h>
12	#include <linux/list.h>
13	#include <linux/module.h>
14	#include <linux/slab.h>
15	#include <linux/usb.h>
16	#include <linux/usb/hcd.h>
17	#include <linux/videodev2.h>
18	#include <linux/vmalloc.h>
19	#include <linux/wait.h>
20	#include <linux/atomic.h>
21	#include <linux/unaligned.h>
22
23	#include <media/jpeg.h>
24	#include <media/v4l2-common.h>
25
26	#include "uvcvideo.h"
27
28	/* ------------------------------------------------------------------------
29	* UVC Controls
30	*/
31
32	static int __uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit,
33	u8 intfnum, u8 cs, void *data, u16 size,
34	int timeout)
35	{
36	u8 type = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
37	unsigned int pipe;
38
39	pipe = (query & 0x80) ? usb_rcvctrlpipe(dev->udev, 0)
40	: usb_sndctrlpipe(dev->udev, 0);
41	type |= (query & 0x80) ? USB_DIR_IN : USB_DIR_OUT;
42
43	return usb_control_msg(dev: dev->udev, pipe, request: query, requesttype: type, value: cs << 8,
44	index: unit << 8 | intfnum, data, size, timeout);
45	}
46
47	static const char *uvc_query_name(u8 query)
48	{
49	switch (query) {
50	case UVC_SET_CUR:
51	return "SET_CUR";
52	case UVC_GET_CUR:
53	return "GET_CUR";
54	case UVC_GET_MIN:
55	return "GET_MIN";
56	case UVC_GET_MAX:
57	return "GET_MAX";
58	case UVC_GET_RES:
59	return "GET_RES";
60	case UVC_GET_LEN:
61	return "GET_LEN";
62	case UVC_GET_INFO:
63	return "GET_INFO";
64	case UVC_GET_DEF:
65	return "GET_DEF";
66	default:
67	return "<invalid>";
68	}
69	}
70
71	int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit,
72	u8 intfnum, u8 cs, void *data, u16 size)
73	{
74	int ret;
75	u8 error;
76	u8 tmp;
77
78	ret = __uvc_query_ctrl(dev, query, unit, intfnum, cs, data, size,
79	UVC_CTRL_CONTROL_TIMEOUT);
80	if (likely(ret == size))
81	return 0;
82
83	/*
84	* Some devices return shorter USB control packets than expected if the
85	* returned value can fit in less bytes. Zero all the bytes that the
86	* device has not written.
87	*
88	* This quirk is applied to all controls, regardless of their data type.
89	* Most controls are little-endian integers, in which case the missing
90	* bytes become 0 MSBs. For other data types, a different heuristic
91	* could be implemented if a device is found needing it.
92	*
93	* We exclude UVC_GET_INFO from the quirk. UVC_GET_LEN does not need
94	* to be excluded because its size is always 1.
95	*/
96	if (ret > 0 && query != UVC_GET_INFO) {
97	memset(data + ret, 0, size - ret);
98	dev_warn_once(&dev->udev->dev,
99	"UVC non compliance: %s control %u on unit %u returned %d bytes when we expected %u.\n",
100	uvc_query_name(query), cs, unit, ret, size);
101	return 0;
102	}
103
104	if (ret != -EPIPE) {
105	dev_err(&dev->udev->dev,
106	"Failed to query (%s) UVC control %u on unit %u: %d (exp. %u).\n",
107	uvc_query_name(query), cs, unit, ret, size);
108	return ret < 0 ? ret : -EPIPE;
109	}
110
111	/* Reuse data[0] to request the error code. */
112	tmp = *(u8 *)data;
113
114	ret = __uvc_query_ctrl(dev, UVC_GET_CUR, unit: 0, intfnum,
115	UVC_VC_REQUEST_ERROR_CODE_CONTROL, data, size: 1,
116	UVC_CTRL_CONTROL_TIMEOUT);
117
118	error = *(u8 *)data;
119	*(u8 *)data = tmp;
120
121	if (ret != 1) {
122	dev_err_ratelimited(&dev->udev->dev,
123	"Failed to query (%s) UVC error code control %u on unit %u: %d (exp. 1).\n",
124	uvc_query_name(query), cs, unit, ret);
125	return ret < 0 ? ret : -EPIPE;
126	}
127
128	uvc_dbg(dev, CONTROL, "Control error %u\n", error);
129
130	switch (error) {
131	case 0:
132	/* Cannot happen - we received a STALL */
133	return -EPIPE;
134	case 1: /* Not ready */
135	return -EBUSY;
136	case 2: /* Wrong state */
137	return -EACCES;
138	case 3: /* Power */
139	return -EREMOTE;
140	case 4: /* Out of range */
141	return -ERANGE;
142	case 5: /* Invalid unit */
143	case 6: /* Invalid control */
144	case 7: /* Invalid Request */
145	/*
146	* The firmware has not properly implemented
147	* the control or there has been a HW error.
148	*/
149	return -EIO;
150	case 8: /* Invalid value within range */
151	return -EINVAL;
152	default: /* reserved or unknown */
153	break;
154	}
155
156	return -EPIPE;
157	}
158
159	static const struct usb_device_id elgato_cam_link_4k = {
160	USB_DEVICE(0x0fd9, 0x0066)
161	};
162
163	static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
164	struct uvc_streaming_control *ctrl)
165	{
166	const struct uvc_format *format = NULL;
167	const struct uvc_frame *frame = NULL;
168	unsigned int i;
169
170	/*
171	* The response of the Elgato Cam Link 4K is incorrect: The second byte
172	* contains bFormatIndex (instead of being the second byte of bmHint).
173	* The first byte is always zero. The third byte is always 1.
174	*
175	* The UVC 1.5 class specification defines the first five bits in the
176	* bmHint bitfield. The remaining bits are reserved and should be zero.
177	* Therefore a valid bmHint will be less than 32.
178	*
179	* Latest Elgato Cam Link 4K firmware as of 2021-03-23 needs this fix.
180	* MCU: 20.02.19, FPGA: 67
181	*/
182	if (usb_match_one_id(interface: stream->dev->intf, id: &elgato_cam_link_4k) &&
183	ctrl->bmHint > 255) {
184	u8 corrected_format_index = ctrl->bmHint >> 8;
185
186	uvc_dbg(stream->dev, VIDEO,
187	"Correct USB video probe response from {bmHint: 0x%04x, bFormatIndex: %u} to {bmHint: 0x%04x, bFormatIndex: %u}\n",
188	ctrl->bmHint, ctrl->bFormatIndex,
189	1, corrected_format_index);
190	ctrl->bmHint = 1;
191	ctrl->bFormatIndex = corrected_format_index;
192	}
193
194	for (i = 0; i < stream->nformats; ++i) {
195	if (stream->formats[i].index == ctrl->bFormatIndex) {
196	format = &stream->formats[i];
197	break;
198	}
199	}
200
201	if (format == NULL)
202	return;
203
204	for (i = 0; i < format->nframes; ++i) {
205	if (format->frames[i].bFrameIndex == ctrl->bFrameIndex) {
206	frame = &format->frames[i];
207	break;
208	}
209	}
210
211	if (frame == NULL)
212	return;
213
214	if (!(format->flags & UVC_FMT_FLAG_COMPRESSED) ||
215	(ctrl->dwMaxVideoFrameSize == 0 &&
216	stream->dev->uvc_version < 0x0110))
217	ctrl->dwMaxVideoFrameSize =
218	frame->dwMaxVideoFrameBufferSize;
219
220	/*
221	* The "TOSHIBA Web Camera - 5M" Chicony device (04f2:b50b) seems to
222	* compute the bandwidth on 16 bits and erroneously sign-extend it to
223	* 32 bits, resulting in a huge bandwidth value. Detect and fix that
224	* condition by setting the 16 MSBs to 0 when they're all equal to 1.
225	*/
226	if ((ctrl->dwMaxPayloadTransferSize & 0xffff0000) == 0xffff0000)
227	ctrl->dwMaxPayloadTransferSize &= ~0xffff0000;
228
229	if (!(format->flags & UVC_FMT_FLAG_COMPRESSED) &&
230	stream->dev->quirks & UVC_QUIRK_FIX_BANDWIDTH &&
231	stream->intf->num_altsetting > 1) {
232	u32 interval;
233	u32 bandwidth;
234
235	interval = (ctrl->dwFrameInterval > 100000)
236	? ctrl->dwFrameInterval
237	: frame->dwFrameInterval[0];
238
239	/*
240	* Compute a bandwidth estimation by multiplying the frame
241	* size by the number of video frames per second, divide the
242	* result by the number of USB frames (or micro-frames for
243	* high- and super-speed devices) per second and add the UVC
244	* header size (assumed to be 12 bytes long).
245	*/
246	bandwidth = frame->wWidth * frame->wHeight / 8 * format->bpp;
247	bandwidth *= 10000000 / interval + 1;
248	bandwidth /= 1000;
249	if (stream->dev->udev->speed >= USB_SPEED_HIGH)
250	bandwidth /= 8;
251	bandwidth += 12;
252
253	/*
254	* The bandwidth estimate is too low for many cameras. Don't use
255	* maximum packet sizes lower than 1024 bytes to try and work
256	* around the problem. According to measurements done on two
257	* different camera models, the value is high enough to get most
258	* resolutions working while not preventing two simultaneous
259	* VGA streams at 15 fps.
260	*/
261	bandwidth = max_t(u32, bandwidth, 1024);
262
263	ctrl->dwMaxPayloadTransferSize = bandwidth;
264	}
265	}
266
267	static size_t uvc_video_ctrl_size(struct uvc_streaming *stream)
268	{
269	/*
270	* Return the size of the video probe and commit controls, which depends
271	* on the protocol version.
272	*/
273	if (stream->dev->uvc_version < 0x0110)
274	return 26;
275	else if (stream->dev->uvc_version < 0x0150)
276	return 34;
277	else
278	return 48;
279	}
280
281	static int uvc_get_video_ctrl(struct uvc_streaming *stream,
282	struct uvc_streaming_control *ctrl, int probe, u8 query)
283	{
284	u16 size = uvc_video_ctrl_size(stream);
285	u8 *data;
286	int ret;
287
288	if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) &&
289	query == UVC_GET_DEF)
290	return -EIO;
291
292	data = kmalloc(size, GFP_KERNEL);
293	if (data == NULL)
294	return -ENOMEM;
295
296	ret = __uvc_query_ctrl(dev: stream->dev, query, unit: 0, intfnum: stream->intfnum,
297	cs: probe ? UVC_VS_PROBE_CONTROL : UVC_VS_COMMIT_CONTROL, data,
298	size, timeout: uvc_timeout_param);
299
300	if ((query == UVC_GET_MIN || query == UVC_GET_MAX) && ret == 2) {
301	/*
302	* Some cameras, mostly based on Bison Electronics chipsets,
303	* answer a GET_MIN or GET_MAX request with the wCompQuality
304	* field only.
305	*/
306	uvc_warn_once(stream->dev, UVC_WARN_MINMAX, "UVC non "
307	"compliance - GET_MIN/MAX(PROBE) incorrectly "
308	"supported. Enabling workaround.\n");
309	memset(ctrl, 0, sizeof(*ctrl));
310	ctrl->wCompQuality = le16_to_cpup(p: (__le16 *)data);
311	ret = 0;
312	goto out;
313	} else if (query == UVC_GET_DEF && probe == 1 && ret != size) {
314	/*
315	* Many cameras don't support the GET_DEF request on their
316	* video probe control. Warn once and return, the caller will
317	* fall back to GET_CUR.
318	*/
319	uvc_warn_once(stream->dev, UVC_WARN_PROBE_DEF, "UVC non "
320	"compliance - GET_DEF(PROBE) not supported. "
321	"Enabling workaround.\n");
322	ret = -EIO;
323	goto out;
324	} else if (ret != size) {
325	dev_err(&stream->intf->dev,
326	"Failed to query (%s) UVC %s control : %d (exp. %u).\n",
327	uvc_query_name(query), probe ? "probe" : "commit",
328	ret, size);
329	ret = (ret == -EPROTO) ? -EPROTO : -EIO;
330	goto out;
331	}
332
333	ctrl->bmHint = le16_to_cpup(p: (__le16 *)&data[0]);
334	ctrl->bFormatIndex = data[2];
335	ctrl->bFrameIndex = data[3];
336	ctrl->dwFrameInterval = le32_to_cpup(p: (__le32 *)&data[4]);
337	ctrl->wKeyFrameRate = le16_to_cpup(p: (__le16 *)&data[8]);
338	ctrl->wPFrameRate = le16_to_cpup(p: (__le16 *)&data[10]);
339	ctrl->wCompQuality = le16_to_cpup(p: (__le16 *)&data[12]);
340	ctrl->wCompWindowSize = le16_to_cpup(p: (__le16 *)&data[14]);
341	ctrl->wDelay = le16_to_cpup(p: (__le16 *)&data[16]);
342	ctrl->dwMaxVideoFrameSize = get_unaligned_le32(p: &data[18]);
343	ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(p: &data[22]);
344
345	if (size >= 34) {
346	ctrl->dwClockFrequency = get_unaligned_le32(p: &data[26]);
347	ctrl->bmFramingInfo = data[30];
348	ctrl->bPreferedVersion = data[31];
349	ctrl->bMinVersion = data[32];
350	ctrl->bMaxVersion = data[33];
351	} else {
352	ctrl->dwClockFrequency = stream->dev->clock_frequency;
353	ctrl->bmFramingInfo = 0;
354	ctrl->bPreferedVersion = 0;
355	ctrl->bMinVersion = 0;
356	ctrl->bMaxVersion = 0;
357	}
358
359	/*
360	* Some broken devices return null or wrong dwMaxVideoFrameSize and
361	* dwMaxPayloadTransferSize fields. Try to get the value from the
362	* format and frame descriptors.
363	*/
364	uvc_fixup_video_ctrl(stream, ctrl);
365	ret = 0;
366
367	out:
368	kfree(objp: data);
369	return ret;
370	}
371
372	static int uvc_set_video_ctrl(struct uvc_streaming *stream,
373	struct uvc_streaming_control *ctrl, int probe)
374	{
375	u16 size = uvc_video_ctrl_size(stream);
376	u8 *data;
377	int ret;
378
379	data = kzalloc(size, GFP_KERNEL);
380	if (data == NULL)
381	return -ENOMEM;
382
383	*(__le16 *)&data[0] = cpu_to_le16(ctrl->bmHint);
384	data[2] = ctrl->bFormatIndex;
385	data[3] = ctrl->bFrameIndex;
386	*(__le32 *)&data[4] = cpu_to_le32(ctrl->dwFrameInterval);
387	*(__le16 *)&data[8] = cpu_to_le16(ctrl->wKeyFrameRate);
388	*(__le16 *)&data[10] = cpu_to_le16(ctrl->wPFrameRate);
389	*(__le16 *)&data[12] = cpu_to_le16(ctrl->wCompQuality);
390	*(__le16 *)&data[14] = cpu_to_le16(ctrl->wCompWindowSize);
391	*(__le16 *)&data[16] = cpu_to_le16(ctrl->wDelay);
392	put_unaligned_le32(val: ctrl->dwMaxVideoFrameSize, p: &data[18]);
393	put_unaligned_le32(val: ctrl->dwMaxPayloadTransferSize, p: &data[22]);
394
395	if (size >= 34) {
396	put_unaligned_le32(val: ctrl->dwClockFrequency, p: &data[26]);
397	data[30] = ctrl->bmFramingInfo;
398	data[31] = ctrl->bPreferedVersion;
399	data[32] = ctrl->bMinVersion;
400	data[33] = ctrl->bMaxVersion;
401	}
402
403	ret = __uvc_query_ctrl(dev: stream->dev, UVC_SET_CUR, unit: 0, intfnum: stream->intfnum,
404	cs: probe ? UVC_VS_PROBE_CONTROL : UVC_VS_COMMIT_CONTROL, data,
405	size, timeout: uvc_timeout_param);
406	if (ret != size) {
407	dev_err(&stream->intf->dev,
408	"Failed to set UVC %s control : %d (exp. %u).\n",
409	probe ? "probe" : "commit", ret, size);
410	ret = -EIO;
411	}
412
413	kfree(objp: data);
414	return ret;
415	}
416
417	int uvc_probe_video(struct uvc_streaming *stream,
418	struct uvc_streaming_control *probe)
419	{
420	struct uvc_streaming_control probe_min, probe_max;
421	unsigned int i;
422	int ret;
423
424	/*
425	* Perform probing. The device should adjust the requested values
426	* according to its capabilities. However, some devices, namely the
427	* first generation UVC Logitech webcams, don't implement the Video
428	* Probe control properly, and just return the needed bandwidth. For
429	* that reason, if the needed bandwidth exceeds the maximum available
430	* bandwidth, try to lower the quality.
431	*/
432	ret = uvc_set_video_ctrl(stream, ctrl: probe, probe: 1);
433	if (ret < 0)
434	goto done;
435
436	/* Get the minimum and maximum values for compression settings. */
437	if (!(stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX)) {
438	ret = uvc_get_video_ctrl(stream, ctrl: &probe_min, probe: 1, UVC_GET_MIN);
439	if (ret < 0)
440	goto done;
441	ret = uvc_get_video_ctrl(stream, ctrl: &probe_max, probe: 1, UVC_GET_MAX);
442	if (ret < 0)
443	goto done;
444
445	probe->wCompQuality = probe_max.wCompQuality;
446	}
447
448	for (i = 0; i < 2; ++i) {
449	ret = uvc_set_video_ctrl(stream, ctrl: probe, probe: 1);
450	if (ret < 0)
451	goto done;
452	ret = uvc_get_video_ctrl(stream, ctrl: probe, probe: 1, UVC_GET_CUR);
453	if (ret < 0)
454	goto done;
455
456	if (stream->intf->num_altsetting == 1)
457	break;
458
459	if (probe->dwMaxPayloadTransferSize <= stream->maxpsize)
460	break;
461
462	if (stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX) {
463	ret = -ENOSPC;
464	goto done;
465	}
466
467	/* TODO: negotiate compression parameters */
468	probe->wKeyFrameRate = probe_min.wKeyFrameRate;
469	probe->wPFrameRate = probe_min.wPFrameRate;
470	probe->wCompQuality = probe_max.wCompQuality;
471	probe->wCompWindowSize = probe_min.wCompWindowSize;
472	}
473
474	done:
475	return ret;
476	}
477
478	static int uvc_commit_video(struct uvc_streaming *stream,
479	struct uvc_streaming_control *probe)
480	{
481	return uvc_set_video_ctrl(stream, ctrl: probe, probe: 0);
482	}
483
484	/* -----------------------------------------------------------------------------
485	* Clocks and timestamps
486	*/
487
488	static inline ktime_t uvc_video_get_time(void)
489	{
490	if (uvc_clock_param == CLOCK_MONOTONIC)
491	return ktime_get();
492	else
493	return ktime_get_real();
494	}
495
496	static void uvc_video_clock_add_sample(struct uvc_clock *clock,
497	const struct uvc_clock_sample *sample)
498	{
499	unsigned long flags;
500
501	/*
502	* If we write new data on the position where we had the last
503	* overflow, remove the overflow pointer. There is no SOF overflow
504	* in the whole circular buffer.
505	*/
506	if (clock->head == clock->last_sof_overflow)
507	clock->last_sof_overflow = -1;
508
509	spin_lock_irqsave(&clock->lock, flags);
510
511	if (clock->count > 0 && clock->last_sof > sample->dev_sof) {
512	/*
513	* Remove data from the circular buffer that is older than the
514	* last SOF overflow. We only support one SOF overflow per
515	* circular buffer.
516	*/
517	if (clock->last_sof_overflow != -1)
518	clock->count = (clock->head - clock->last_sof_overflow
519	+ clock->size) % clock->size;
520	clock->last_sof_overflow = clock->head;
521	}
522
523	/* Add sample. */
524	clock->samples[clock->head] = *sample;
525	clock->head = (clock->head + 1) % clock->size;
526	clock->count = min(clock->count + 1, clock->size);
527
528	spin_unlock_irqrestore(lock: &clock->lock, flags);
529	}
530
531	static void
532	uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
533	const u8 *data, int len)
534	{
535	struct uvc_clock_sample sample;
536	unsigned int header_size;
537	bool has_pts = false;
538	bool has_scr = false;
539
540	switch (data[1] & (UVC_STREAM_PTS | UVC_STREAM_SCR)) {
541	case UVC_STREAM_PTS | UVC_STREAM_SCR:
542	header_size = 12;
543	has_pts = true;
544	has_scr = true;
545	break;
546	case UVC_STREAM_PTS:
547	header_size = 6;
548	has_pts = true;
549	break;
550	case UVC_STREAM_SCR:
551	header_size = 8;
552	has_scr = true;
553	break;
554	default:
555	header_size = 2;
556	break;
557	}
558
559	/* Check for invalid headers. */
560	if (len < header_size)
561	return;
562
563	/*
564	* Extract the timestamps:
565	*
566	* - store the frame PTS in the buffer structure
567	* - if the SCR field is present, retrieve the host SOF counter and
568	* kernel timestamps and store them with the SCR STC and SOF fields
569	* in the ring buffer
570	*/
571	if (has_pts && buf != NULL)
572	buf->pts = get_unaligned_le32(p: &data[2]);
573
574	if (!has_scr)
575	return;
576
577	/*
578	* To limit the amount of data, drop SCRs with an SOF identical to the
579	* previous one. This filtering is also needed to support UVC 1.5, where
580	* all the data packets of the same frame contains the same SOF. In that
581	* case only the first one will match the host_sof.
582	*/
583	sample.dev_sof = get_unaligned_le16(p: &data[header_size - 2]);
584	if (sample.dev_sof == stream->clock.last_sof)
585	return;
586
587	sample.dev_stc = get_unaligned_le32(p: &data[header_size - 6]);
588
589	/*
590	* STC (Source Time Clock) is the clock used by the camera. The UVC 1.5
591	* standard states that it "must be captured when the first video data
592	* of a video frame is put on the USB bus". This is generally understood
593	* as requiring devices to clear the payload header's SCR bit before
594	* the first packet containing video data.
595	*
596	* Most vendors follow that interpretation, but some (namely SunplusIT
597	* on some devices) always set the `UVC_STREAM_SCR` bit, fill the SCR
598	* field with 0's,and expect that the driver only processes the SCR if
599	* there is data in the packet.
600	*
601	* Ignore all the hardware timestamp information if we haven't received
602	* any data for this frame yet, the packet contains no data, and both
603	* STC and SOF are zero. This heuristics should be safe on compliant
604	* devices. This should be safe with compliant devices, as in the very
605	* unlikely case where a UVC 1.1 device would send timing information
606	* only before the first packet containing data, and both STC and SOF
607	* happen to be zero for a particular frame, we would only miss one
608	* clock sample from many and the clock recovery algorithm wouldn't
609	* suffer from this condition.
610	*/
611	if (buf && buf->bytesused == 0 && len == header_size &&
612	sample.dev_stc == 0 && sample.dev_sof == 0)
613	return;
614
615	sample.host_sof = usb_get_current_frame_number(usb_dev: stream->dev->udev);
616
617	/*
618	* On some devices, like the Logitech C922, the device SOF does not run
619	* at a stable rate of 1kHz. For those devices use the host SOF instead.
620	* In the tests performed so far, this improves the timestamp precision.
621	* This is probably explained by a small packet handling jitter from the
622	* host, but the exact reason hasn't been fully determined.
623	*/
624	if (stream->dev->quirks & UVC_QUIRK_INVALID_DEVICE_SOF)
625	sample.dev_sof = sample.host_sof;
626
627	sample.host_time = uvc_video_get_time();
628
629	/*
630	* The UVC specification allows device implementations that can't obtain
631	* the USB frame number to keep their own frame counters as long as they
632	* match the size and frequency of the frame number associated with USB
633	* SOF tokens. The SOF values sent by such devices differ from the USB
634	* SOF tokens by a fixed offset that needs to be estimated and accounted
635	* for to make timestamp recovery as accurate as possible.
636	*
637	* The offset is estimated the first time a device SOF value is received
638	* as the difference between the host and device SOF values. As the two
639	* SOF values can differ slightly due to transmission delays, consider
640	* that the offset is null if the difference is not higher than 10 ms
641	* (negative differences can not happen and are thus considered as an
642	* offset). The video commit control wDelay field should be used to
643	* compute a dynamic threshold instead of using a fixed 10 ms value, but
644	* devices don't report reliable wDelay values.
645	*
646	* See uvc_video_clock_host_sof() for an explanation regarding why only
647	* the 8 LSBs of the delta are kept.
648	*/
649	if (stream->clock.sof_offset == (u16)-1) {
650	u16 delta_sof = (sample.host_sof - sample.dev_sof) & 255;
651	if (delta_sof >= 10)
652	stream->clock.sof_offset = delta_sof;
653	else
654	stream->clock.sof_offset = 0;
655	}
656
657	sample.dev_sof = (sample.dev_sof + stream->clock.sof_offset) & 2047;
658	uvc_video_clock_add_sample(clock: &stream->clock, sample: &sample);
659	stream->clock.last_sof = sample.dev_sof;
660	}
661
662	static void uvc_video_clock_reset(struct uvc_clock *clock)
663	{
664	clock->head = 0;
665	clock->count = 0;
666	clock->last_sof = -1;
667	clock->last_sof_overflow = -1;
668	clock->sof_offset = -1;
669	}
670
671	static int uvc_video_clock_init(struct uvc_clock *clock)
672	{
673	spin_lock_init(&clock->lock);
674	clock->size = 32;
675
676	clock->samples = kmalloc_array(clock->size, sizeof(*clock->samples),
677	GFP_KERNEL);
678	if (clock->samples == NULL)
679	return -ENOMEM;
680
681	uvc_video_clock_reset(clock);
682
683	return 0;
684	}
685
686	static void uvc_video_clock_cleanup(struct uvc_clock *clock)
687	{
688	kfree(objp: clock->samples);
689	clock->samples = NULL;
690	}
691
692	/*
693	* uvc_video_clock_host_sof - Return the host SOF value for a clock sample
694	*
695	* Host SOF counters reported by usb_get_current_frame_number() usually don't
696	* cover the whole 11-bits SOF range (0-2047) but are limited to the HCI frame
697	* schedule window. They can be limited to 8, 9 or 10 bits depending on the host
698	* controller and its configuration.
699	*
700	* We thus need to recover the SOF value corresponding to the host frame number.
701	* As the device and host frame numbers are sampled in a short interval, the
702	* difference between their values should be equal to a small delta plus an
703	* integer multiple of 256 caused by the host frame number limited precision.
704	*
705	* To obtain the recovered host SOF value, compute the small delta by masking
706	* the high bits of the host frame counter and device SOF difference and add it
707	* to the device SOF value.
708	*/
709	static u16 uvc_video_clock_host_sof(const struct uvc_clock_sample *sample)
710	{
711	/* The delta value can be negative. */
712	s8 delta_sof;
713
714	delta_sof = (sample->host_sof - sample->dev_sof) & 255;
715
716	return (sample->dev_sof + delta_sof) & 2047;
717	}
718
719	/*
720	* uvc_video_clock_update - Update the buffer timestamp
721	*
722	* This function converts the buffer PTS timestamp to the host clock domain by
723	* going through the USB SOF clock domain and stores the result in the V4L2
724	* buffer timestamp field.
725	*
726	* The relationship between the device clock and the host clock isn't known.
727	* However, the device and the host share the common USB SOF clock which can be
728	* used to recover that relationship.
729	*
730	* The relationship between the device clock and the USB SOF clock is considered
731	* to be linear over the clock samples sliding window and is given by
732	*
733	* SOF = m * PTS + p
734	*
735	* Several methods to compute the slope (m) and intercept (p) can be used. As
736	* the clock drift should be small compared to the sliding window size, we
737	* assume that the line that goes through the points at both ends of the window
738	* is a good approximation. Naming those points P1 and P2, we get
739	*
740	* SOF = (SOF2 - SOF1) / (STC2 - STC1) * PTS
741	* + (SOF1 * STC2 - SOF2 * STC1) / (STC2 - STC1)
742	*
743	* or
744	*
745	* SOF = ((SOF2 - SOF1) * PTS + SOF1 * STC2 - SOF2 * STC1) / (STC2 - STC1) (1)
746	*
747	* to avoid losing precision in the division. Similarly, the host timestamp is
748	* computed with
749	*
750	* TS = ((TS2 - TS1) * SOF + TS1 * SOF2 - TS2 * SOF1) / (SOF2 - SOF1) (2)
751	*
752	* SOF values are coded on 11 bits by USB. We extend their precision with 16
753	* decimal bits, leading to a 11.16 coding.
754	*
755	* TODO: To avoid surprises with device clock values, PTS/STC timestamps should
756	* be normalized using the nominal device clock frequency reported through the
757	* UVC descriptors.
758	*
759	* Both the PTS/STC and SOF counters roll over, after a fixed but device
760	* specific amount of time for PTS/STC and after 2048ms for SOF. As long as the
761	* sliding window size is smaller than the rollover period, differences computed
762	* on unsigned integers will produce the correct result. However, the p term in
763	* the linear relations will be miscomputed.
764	*
765	* To fix the issue, we subtract a constant from the PTS and STC values to bring
766	* PTS to half the 32 bit STC range. The sliding window STC values then fit into
767	* the 32 bit range without any rollover.
768	*
769	* Similarly, we add 2048 to the device SOF values to make sure that the SOF
770	* computed by (1) will never be smaller than 0. This offset is then compensated
771	* by adding 2048 to the SOF values used in (2). However, this doesn't prevent
772	* rollovers between (1) and (2): the SOF value computed by (1) can be slightly
773	* lower than 4096, and the host SOF counters can have rolled over to 2048. This
774	* case is handled by subtracting 2048 from the SOF value if it exceeds the host
775	* SOF value at the end of the sliding window.
776	*
777	* Finally we subtract a constant from the host timestamps to bring the first
778	* timestamp of the sliding window to 1s.
779	*/
780	void uvc_video_clock_update(struct uvc_streaming *stream,
781	struct vb2_v4l2_buffer *vbuf,
782	struct uvc_buffer *buf)
783	{
784	struct uvc_clock *clock = &stream->clock;
785	struct uvc_clock_sample *first;
786	struct uvc_clock_sample *last;
787	unsigned long flags;
788	u64 timestamp;
789	u32 delta_stc;
790	u32 y1;
791	u32 x1, x2;
792	u32 mean;
793	u32 sof;
794	u64 y, y2;
795
796	if (!uvc_hw_timestamps_param)
797	return;
798
799	/*
800	* We will get called from __vb2_queue_cancel() if there are buffers
801	* done but not dequeued by the user, but the sample array has already
802	* been released at that time. Just bail out in that case.
803	*/
804	if (!clock->samples)
805	return;
806
807	spin_lock_irqsave(&clock->lock, flags);
808
809	if (clock->count < 2)
810	goto done;
811
812	first = &clock->samples[(clock->head - clock->count + clock->size) % clock->size];
813	last = &clock->samples[(clock->head - 1 + clock->size) % clock->size];
814
815	/* First step, PTS to SOF conversion. */
816	delta_stc = buf->pts - (1UL << 31);
817	x1 = first->dev_stc - delta_stc;
818	x2 = last->dev_stc - delta_stc;
819	if (x1 == x2)
820	goto done;
821
822	y1 = (first->dev_sof + 2048) << 16;
823	y2 = (last->dev_sof + 2048) << 16;
824	if (y2 < y1)
825	y2 += 2048 << 16;
826
827	/*
828	* Have at least 1/4 of a second of timestamps before we
829	* try to do any calculation. Otherwise we do not have enough
830	* precision. This value was determined by running Android CTS
831	* on different devices.
832	*
833	* dev_sof runs at 1KHz, and we have a fixed point precision of
834	* 16 bits.
835	*/
836	if ((y2 - y1) < ((1000 / 4) << 16))
837	goto done;
838
839	y = (u64)(y2 - y1) * (1ULL << 31) + (u64)y1 * (u64)x2
840	- (u64)y2 * (u64)x1;
841	y = div_u64(dividend: y, divisor: x2 - x1);
842
843	sof = y;
844
845	uvc_dbg(stream->dev, CLOCK,
846	"%s: PTS %u y %llu.%06llu SOF %u.%06llu (x1 %u x2 %u y1 %u y2 %llu SOF offset %u)\n",
847	stream->dev->name, buf->pts,
848	y >> 16, div_u64((y & 0xffff) * 1000000, 65536),
849	sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
850	x1, x2, y1, y2, clock->sof_offset);
851
852	/* Second step, SOF to host clock conversion. */
853	x1 = (uvc_video_clock_host_sof(sample: first) + 2048) << 16;
854	x2 = (uvc_video_clock_host_sof(sample: last) + 2048) << 16;
855	if (x2 < x1)
856	x2 += 2048 << 16;
857	if (x1 == x2)
858	goto done;
859
860	y1 = NSEC_PER_SEC;
861	y2 = ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1;
862
863	/*
864	* Interpolated and host SOF timestamps can wrap around at slightly
865	* different times. Handle this by adding or removing 2048 to or from
866	* the computed SOF value to keep it close to the SOF samples mean
867	* value.
868	*/
869	mean = (x1 + x2) / 2;
870	if (mean - (1024 << 16) > sof)
871	sof += 2048 << 16;
872	else if (sof > mean + (1024 << 16))
873	sof -= 2048 << 16;
874
875	y = (u64)(y2 - y1) * (u64)sof + (u64)y1 * (u64)x2
876	- (u64)y2 * (u64)x1;
877	y = div_u64(dividend: y, divisor: x2 - x1);
878
879	timestamp = ktime_to_ns(kt: first->host_time) + y - y1;
880
881	uvc_dbg(stream->dev, CLOCK,
882	"%s: SOF %u.%06llu y %llu ts %llu buf ts %llu (x1 %u/%u/%u x2 %u/%u/%u y1 %u y2 %llu)\n",
883	stream->dev->name,
884	sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
885	y, timestamp, vbuf->vb2_buf.timestamp,
886	x1, first->host_sof, first->dev_sof,
887	x2, last->host_sof, last->dev_sof, y1, y2);
888
889	/* Update the V4L2 buffer. */
890	vbuf->vb2_buf.timestamp = timestamp;
891
892	done:
893	spin_unlock_irqrestore(lock: &clock->lock, flags);
894	}
895
896	/* ------------------------------------------------------------------------
897	* Stream statistics
898	*/
899
900	static void uvc_video_stats_decode(struct uvc_streaming *stream,
901	const u8 *data, int len)
902	{
903	unsigned int header_size;
904	bool has_pts = false;
905	bool has_scr = false;
906	u16 scr_sof;
907	u32 scr_stc;
908	u32 pts;
909
910	if (stream->stats.stream.nb_frames == 0 &&
911	stream->stats.frame.nb_packets == 0)
912	stream->stats.stream.start_ts = ktime_get();
913
914	switch (data[1] & (UVC_STREAM_PTS | UVC_STREAM_SCR)) {
915	case UVC_STREAM_PTS | UVC_STREAM_SCR:
916	header_size = 12;
917	has_pts = true;
918	has_scr = true;
919	break;
920	case UVC_STREAM_PTS:
921	header_size = 6;
922	has_pts = true;
923	break;
924	case UVC_STREAM_SCR:
925	header_size = 8;
926	has_scr = true;
927	break;
928	default:
929	header_size = 2;
930	break;
931	}
932
933	/* Check for invalid headers. */
934	if (len < header_size || data[0] < header_size) {
935	stream->stats.frame.nb_invalid++;
936	return;
937	}
938
939	/* Extract the timestamps. */
940	if (has_pts)
941	pts = get_unaligned_le32(p: &data[2]);
942
943	if (has_scr) {
944	scr_stc = get_unaligned_le32(p: &data[header_size - 6]);
945	scr_sof = get_unaligned_le16(p: &data[header_size - 2]);
946	}
947
948	/* Is PTS constant through the whole frame ? */
949	if (has_pts && stream->stats.frame.nb_pts) {
950	if (stream->stats.frame.pts != pts) {
951	stream->stats.frame.nb_pts_diffs++;
952	stream->stats.frame.last_pts_diff =
953	stream->stats.frame.nb_packets;
954	}
955	}
956
957	if (has_pts) {
958	stream->stats.frame.nb_pts++;
959	stream->stats.frame.pts = pts;
960	}
961
962	/*
963	* Do all frames have a PTS in their first non-empty packet, or before
964	* their first empty packet ?
965	*/
966	if (stream->stats.frame.size == 0) {
967	if (len > header_size)
968	stream->stats.frame.has_initial_pts = has_pts;
969	if (len == header_size && has_pts)
970	stream->stats.frame.has_early_pts = true;
971	}
972
973	/* Do the SCR.STC and SCR.SOF fields vary through the frame ? */
974	if (has_scr && stream->stats.frame.nb_scr) {
975	if (stream->stats.frame.scr_stc != scr_stc)
976	stream->stats.frame.nb_scr_diffs++;
977	}
978
979	if (has_scr) {
980	/* Expand the SOF counter to 32 bits and store its value. */
981	if (stream->stats.stream.nb_frames > 0 ||
982	stream->stats.frame.nb_scr > 0)
983	stream->stats.stream.scr_sof_count +=
984	(scr_sof - stream->stats.stream.scr_sof) % 2048;
985	stream->stats.stream.scr_sof = scr_sof;
986
987	stream->stats.frame.nb_scr++;
988	stream->stats.frame.scr_stc = scr_stc;
989	stream->stats.frame.scr_sof = scr_sof;
990
991	if (scr_sof < stream->stats.stream.min_sof)
992	stream->stats.stream.min_sof = scr_sof;
993	if (scr_sof > stream->stats.stream.max_sof)
994	stream->stats.stream.max_sof = scr_sof;
995	}
996
997	/* Record the first non-empty packet number. */
998	if (stream->stats.frame.size == 0 && len > header_size)
999	stream->stats.frame.first_data = stream->stats.frame.nb_packets;
1000
1001	/* Update the frame size. */
1002	stream->stats.frame.size += len - header_size;
1003
1004	/* Update the packets counters. */
1005	stream->stats.frame.nb_packets++;
1006	if (len <= header_size)
1007	stream->stats.frame.nb_empty++;
1008
1009	if (data[1] & UVC_STREAM_ERR)
1010	stream->stats.frame.nb_errors++;
1011	}
1012
1013	static void uvc_video_stats_update(struct uvc_streaming *stream)
1014	{
1015	struct uvc_stats_frame *frame = &stream->stats.frame;
1016
1017	uvc_dbg(stream->dev, STATS,
1018	"frame %u stats: %u/%u/%u packets, %u/%u/%u pts (%searly %sinitial), %u/%u scr, last pts/stc/sof %u/%u/%u\n",
1019	stream->sequence, frame->first_data,
1020	frame->nb_packets - frame->nb_empty, frame->nb_packets,
1021	frame->nb_pts_diffs, frame->last_pts_diff, frame->nb_pts,
1022	frame->has_early_pts ? "" : "!",
1023	frame->has_initial_pts ? "" : "!",
1024	frame->nb_scr_diffs, frame->nb_scr,
1025	frame->pts, frame->scr_stc, frame->scr_sof);
1026
1027	stream->stats.stream.nb_frames++;
1028	stream->stats.stream.nb_packets += stream->stats.frame.nb_packets;
1029	stream->stats.stream.nb_empty += stream->stats.frame.nb_empty;
1030	stream->stats.stream.nb_errors += stream->stats.frame.nb_errors;
1031	stream->stats.stream.nb_invalid += stream->stats.frame.nb_invalid;
1032
1033	if (frame->has_early_pts)
1034	stream->stats.stream.nb_pts_early++;
1035	if (frame->has_initial_pts)
1036	stream->stats.stream.nb_pts_initial++;
1037	if (frame->last_pts_diff <= frame->first_data)
1038	stream->stats.stream.nb_pts_constant++;
1039	if (frame->nb_scr >= frame->nb_packets - frame->nb_empty)
1040	stream->stats.stream.nb_scr_count_ok++;
1041	if (frame->nb_scr_diffs + 1 == frame->nb_scr)
1042	stream->stats.stream.nb_scr_diffs_ok++;
1043
1044	memset(&stream->stats.frame, 0, sizeof(stream->stats.frame));
1045	}
1046
1047	size_t uvc_video_stats_dump(struct uvc_streaming *stream, char *buf,
1048	size_t size)
1049	{
1050	unsigned int scr_sof_freq;
1051	unsigned int duration;
1052	size_t count = 0;
1053
1054	/*
1055	* Compute the SCR.SOF frequency estimate. At the nominal 1kHz SOF
1056	* frequency this will not overflow before more than 1h.
1057	*/
1058	duration = ktime_ms_delta(later: stream->stats.stream.stop_ts,
1059	earlier: stream->stats.stream.start_ts);
1060	if (duration != 0)
1061	scr_sof_freq = stream->stats.stream.scr_sof_count * 1000
1062	/ duration;
1063	else
1064	scr_sof_freq = 0;
1065
1066	count += scnprintf(buf: buf + count, size: size - count,
1067	fmt: "frames: %u\npackets: %u\nempty: %u\n"
1068	"errors: %u\ninvalid: %u\n",
1069	stream->stats.stream.nb_frames,
1070	stream->stats.stream.nb_packets,
1071	stream->stats.stream.nb_empty,
1072	stream->stats.stream.nb_errors,
1073	stream->stats.stream.nb_invalid);
1074	count += scnprintf(buf: buf + count, size: size - count,
1075	fmt: "pts: %u early, %u initial, %u ok\n",
1076	stream->stats.stream.nb_pts_early,
1077	stream->stats.stream.nb_pts_initial,
1078	stream->stats.stream.nb_pts_constant);
1079	count += scnprintf(buf: buf + count, size: size - count,
1080	fmt: "scr: %u count ok, %u diff ok\n",
1081	stream->stats.stream.nb_scr_count_ok,
1082	stream->stats.stream.nb_scr_diffs_ok);
1083	count += scnprintf(buf: buf + count, size: size - count,
1084	fmt: "sof: %u <= sof <= %u, freq %u.%03u kHz\n",
1085	stream->stats.stream.min_sof,
1086	stream->stats.stream.max_sof,
1087	scr_sof_freq / 1000, scr_sof_freq % 1000);
1088
1089	return count;
1090	}
1091
1092	static void uvc_video_stats_start(struct uvc_streaming *stream)
1093	{
1094	memset(&stream->stats, 0, sizeof(stream->stats));
1095	stream->stats.stream.min_sof = 2048;
1096	}
1097
1098	static void uvc_video_stats_stop(struct uvc_streaming *stream)
1099	{
1100	stream->stats.stream.stop_ts = ktime_get();
1101	}
1102
1103	/* ------------------------------------------------------------------------
1104	* Video codecs
1105	*/
1106
1107	/*
1108	* Video payload decoding is handled by uvc_video_decode_start(),
1109	* uvc_video_decode_data() and uvc_video_decode_end().
1110	*
1111	* uvc_video_decode_start is called with URB data at the start of a bulk or
1112	* isochronous payload. It processes header data and returns the header size
1113	* in bytes if successful. If an error occurs, it returns a negative error
1114	* code. The following error codes have special meanings.
1115	*
1116	* - EAGAIN informs the caller that the current video buffer should be marked
1117	* as done, and that the function should be called again with the same data
1118	* and a new video buffer. This is used when end of frame conditions can be
1119	* reliably detected at the beginning of the next frame only.
1120	*
1121	* If an error other than -EAGAIN is returned, the caller will drop the current
1122	* payload. No call to uvc_video_decode_data and uvc_video_decode_end will be
1123	* made until the next payload. -ENODATA can be used to drop the current
1124	* payload if no other error code is appropriate.
1125	*
1126	* uvc_video_decode_data is called for every URB with URB data. It copies the
1127	* data to the video buffer.
1128	*
1129	* uvc_video_decode_end is called with header data at the end of a bulk or
1130	* isochronous payload. It performs any additional header data processing and
1131	* returns 0 or a negative error code if an error occurred. As header data have
1132	* already been processed by uvc_video_decode_start, this functions isn't
1133	* required to perform sanity checks a second time.
1134	*
1135	* For isochronous transfers where a payload is always transferred in a single
1136	* URB, the three functions will be called in a row.
1137	*
1138	* To let the decoder process header data and update its internal state even
1139	* when no video buffer is available, uvc_video_decode_start must be prepared
1140	* to be called with a NULL buf parameter. uvc_video_decode_data and
1141	* uvc_video_decode_end will never be called with a NULL buffer.
1142	*/
1143	static int uvc_video_decode_start(struct uvc_streaming *stream,
1144	struct uvc_buffer *buf, const u8 *data, int len)
1145	{
1146	u8 header_len;
1147	u8 fid;
1148
1149	/*
1150	* Sanity checks:
1151	* - packet must be at least 2 bytes long
1152	* - bHeaderLength value must be at least 2 bytes (see above)
1153	* - bHeaderLength value can't be larger than the packet size.
1154	*/
1155	if (len < 2 || data[0] < 2 || data[0] > len) {
1156	stream->stats.frame.nb_invalid++;
1157	return -EINVAL;
1158	}
1159
1160	header_len = data[0];
1161	fid = data[1] & UVC_STREAM_FID;
1162
1163	/*
1164	* Increase the sequence number regardless of any buffer states, so
1165	* that discontinuous sequence numbers always indicate lost frames.
1166	*/
1167	if (stream->last_fid != fid) {
1168	stream->sequence++;
1169	if (stream->sequence)
1170	uvc_video_stats_update(stream);
1171	}
1172
1173	uvc_video_clock_decode(stream, buf, data, len);
1174	uvc_video_stats_decode(stream, data, len);
1175
1176	/*
1177	* Store the payload FID bit and return immediately when the buffer is
1178	* NULL.
1179	*/
1180	if (buf == NULL) {
1181	stream->last_fid = fid;
1182	return -ENODATA;
1183	}
1184
1185	/* Mark the buffer as bad if the error bit is set. */
1186	if (data[1] & UVC_STREAM_ERR) {
1187	uvc_dbg(stream->dev, FRAME,
1188	"Marking buffer as bad (error bit set)\n");
1189	buf->error = 1;
1190	}
1191
1192	/*
1193	* Synchronize to the input stream by waiting for the FID bit to be
1194	* toggled when the buffer state is not UVC_BUF_STATE_ACTIVE.
1195	* stream->last_fid is initialized to -1, so the first isochronous
1196	* frame will always be in sync.
1197	*
1198	* If the device doesn't toggle the FID bit, invert stream->last_fid
1199	* when the EOF bit is set to force synchronisation on the next packet.
1200	*/
1201	if (buf->state != UVC_BUF_STATE_ACTIVE) {
1202	if (fid == stream->last_fid) {
1203	uvc_dbg(stream->dev, FRAME,
1204	"Dropping payload (out of sync)\n");
1205	if ((stream->dev->quirks & UVC_QUIRK_STREAM_NO_FID) &&
1206	(data[1] & UVC_STREAM_EOF))
1207	stream->last_fid ^= UVC_STREAM_FID;
1208	return -ENODATA;
1209	}
1210
1211	buf->buf.field = V4L2_FIELD_NONE;
1212	buf->buf.sequence = stream->sequence;
1213	buf->buf.vb2_buf.timestamp = ktime_to_ns(kt: uvc_video_get_time());
1214
1215	/* TODO: Handle PTS and SCR. */
1216	buf->state = UVC_BUF_STATE_ACTIVE;
1217	}
1218
1219	/*
1220	* Mark the buffer as done if we're at the beginning of a new frame.
1221	* End of frame detection is better implemented by checking the EOF
1222	* bit (FID bit toggling is delayed by one frame compared to the EOF
1223	* bit), but some devices don't set the bit at end of frame (and the
1224	* last payload can be lost anyway). We thus must check if the FID has
1225	* been toggled.
1226	*
1227	* stream->last_fid is initialized to -1, so the first isochronous
1228	* frame will never trigger an end of frame detection.
1229	*
1230	* Empty buffers (bytesused == 0) don't trigger end of frame detection
1231	* as it doesn't make sense to return an empty buffer. This also
1232	* avoids detecting end of frame conditions at FID toggling if the
1233	* previous payload had the EOF bit set.
1234	*/
1235	if (fid != stream->last_fid && buf->bytesused != 0) {
1236	uvc_dbg(stream->dev, FRAME,
1237	"Frame complete (FID bit toggled)\n");
1238	buf->state = UVC_BUF_STATE_READY;
1239	return -EAGAIN;
1240	}
1241
1242	/*
1243	* Some cameras, when running two parallel streams (one MJPEG alongside
1244	* another non-MJPEG stream), are known to lose the EOF packet for a frame.
1245	* We can detect the end of a frame by checking for a new SOI marker, as
1246	* the SOI always lies on the packet boundary between two frames for
1247	* these devices.
1248	*/
1249	if (stream->dev->quirks & UVC_QUIRK_MJPEG_NO_EOF &&
1250	(stream->cur_format->fcc == V4L2_PIX_FMT_MJPEG ||
1251	stream->cur_format->fcc == V4L2_PIX_FMT_JPEG)) {
1252	const u8 *packet = data + header_len;
1253
1254	if (len >= header_len + 2 &&
1255	packet[0] == 0xff && packet[1] == JPEG_MARKER_SOI &&
1256	buf->bytesused != 0) {
1257	buf->state = UVC_BUF_STATE_READY;
1258	buf->error = 1;
1259	stream->last_fid ^= UVC_STREAM_FID;
1260	return -EAGAIN;
1261	}
1262	}
1263
1264	stream->last_fid = fid;
1265
1266	return header_len;
1267	}
1268
1269	static inline enum dma_data_direction uvc_stream_dir(
1270	struct uvc_streaming *stream)
1271	{
1272	if (stream->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
1273	return DMA_FROM_DEVICE;
1274	else
1275	return DMA_TO_DEVICE;
1276	}
1277
1278	static inline struct device *uvc_stream_to_dmadev(struct uvc_streaming *stream)
1279	{
1280	return bus_to_hcd(bus: stream->dev->udev->bus)->self.sysdev;
1281	}
1282
1283	static int uvc_submit_urb(struct uvc_urb *uvc_urb, gfp_t mem_flags)
1284	{
1285	/* Sync DMA. */
1286	dma_sync_sgtable_for_device(dev: uvc_stream_to_dmadev(stream: uvc_urb->stream),
1287	sgt: uvc_urb->sgt,
1288	dir: uvc_stream_dir(stream: uvc_urb->stream));
1289	return usb_submit_urb(urb: uvc_urb->urb, mem_flags);
1290	}
1291
1292	/*
1293	* uvc_video_decode_data_work: Asynchronous memcpy processing
1294	*
1295	* Copy URB data to video buffers in process context, releasing buffer
1296	* references and requeuing the URB when done.
1297	*/
1298	static void uvc_video_copy_data_work(struct work_struct *work)
1299	{
1300	struct uvc_urb *uvc_urb = container_of(work, struct uvc_urb, work);
1301	unsigned int i;
1302	int ret;
1303
1304	for (i = 0; i < uvc_urb->async_operations; i++) {
1305	struct uvc_copy_op *op = &uvc_urb->copy_operations[i];
1306
1307	memcpy(op->dst, op->src, op->len);
1308
1309	/* Release reference taken on this buffer. */
1310	uvc_queue_buffer_release(buf: op->buf);
1311	}
1312
1313	ret = uvc_submit_urb(uvc_urb, GFP_KERNEL);
1314	if (ret < 0)
1315	dev_err(&uvc_urb->stream->intf->dev,
1316	"Failed to resubmit video URB (%d).\n", ret);
1317	}
1318
1319	static void uvc_video_decode_data(struct uvc_urb *uvc_urb,
1320	struct uvc_buffer *buf, const u8 *data, int len)
1321	{
1322	unsigned int active_op = uvc_urb->async_operations;
1323	struct uvc_copy_op *op = &uvc_urb->copy_operations[active_op];
1324	unsigned int maxlen;
1325
1326	if (len <= 0)
1327	return;
1328
1329	maxlen = buf->length - buf->bytesused;
1330
1331	/* Take a buffer reference for async work. */
1332	kref_get(kref: &buf->ref);
1333
1334	op->buf = buf;
1335	op->src = data;
1336	op->dst = buf->mem + buf->bytesused;
1337	op->len = min_t(unsigned int, len, maxlen);
1338
1339	buf->bytesused += op->len;
1340
1341	/* Complete the current frame if the buffer size was exceeded. */
1342	if (len > maxlen) {
1343	uvc_dbg(uvc_urb->stream->dev, FRAME,
1344	"Frame complete (overflow)\n");
1345	buf->error = 1;
1346	buf->state = UVC_BUF_STATE_READY;
1347	}
1348
1349	uvc_urb->async_operations++;
1350	}
1351
1352	static void uvc_video_decode_end(struct uvc_streaming *stream,
1353	struct uvc_buffer *buf, const u8 *data, int len)
1354	{
1355	/* Mark the buffer as done if the EOF marker is set. */
1356	if (data[1] & UVC_STREAM_EOF && buf->bytesused != 0) {
1357	uvc_dbg(stream->dev, FRAME, "Frame complete (EOF found)\n");
1358	if (data[0] == len)
1359	uvc_dbg(stream->dev, FRAME, "EOF in empty payload\n");
1360	buf->state = UVC_BUF_STATE_READY;
1361	if (stream->dev->quirks & UVC_QUIRK_STREAM_NO_FID)
1362	stream->last_fid ^= UVC_STREAM_FID;
1363	}
1364	}
1365
1366	/*
1367	* Video payload encoding is handled by uvc_video_encode_header() and
1368	* uvc_video_encode_data(). Only bulk transfers are currently supported.
1369	*
1370	* uvc_video_encode_header is called at the start of a payload. It adds header
1371	* data to the transfer buffer and returns the header size. As the only known
1372	* UVC output device transfers a whole frame in a single payload, the EOF bit
1373	* is always set in the header.
1374	*
1375	* uvc_video_encode_data is called for every URB and copies the data from the
1376	* video buffer to the transfer buffer.
1377	*/
1378	static int uvc_video_encode_header(struct uvc_streaming *stream,
1379	struct uvc_buffer *buf, u8 *data, int len)
1380	{
1381	data[0] = 2; /* Header length */
1382	data[1] = UVC_STREAM_EOH | UVC_STREAM_EOF
1383	| (stream->last_fid & UVC_STREAM_FID);
1384	return 2;
1385	}
1386
1387	static int uvc_video_encode_data(struct uvc_streaming *stream,
1388	struct uvc_buffer *buf, u8 *data, int len)
1389	{
1390	struct uvc_video_queue *queue = &stream->queue;
1391	unsigned int nbytes;
1392	void *mem;
1393
1394	/* Copy video data to the URB buffer. */
1395	mem = buf->mem + queue->buf_used;
1396	nbytes = min((unsigned int)len, buf->bytesused - queue->buf_used);
1397	nbytes = min(stream->bulk.max_payload_size - stream->bulk.payload_size,
1398	nbytes);
1399	memcpy(data, mem, nbytes);
1400
1401	queue->buf_used += nbytes;
1402
1403	return nbytes;
1404	}
1405
1406	/* ------------------------------------------------------------------------
1407	* Metadata
1408	*/
1409
1410	/*
1411	* Additionally to the payload headers we also want to provide the user with USB
1412	* Frame Numbers and system time values. The resulting buffer is thus composed
1413	* of blocks, containing a 64-bit timestamp in nanoseconds, a 16-bit USB Frame
1414	* Number, and a copy of the payload header.
1415	*
1416	* Ideally we want to capture all payload headers for each frame. However, their
1417	* number is unknown and unbound. We thus drop headers that contain no vendor
1418	* data and that either contain no SCR value or an SCR value identical to the
1419	* previous header.
1420	*/
1421	static void uvc_video_decode_meta(struct uvc_streaming *stream,
1422	struct uvc_buffer *meta_buf,
1423	const u8 *mem, unsigned int length)
1424	{
1425	struct uvc_meta_buf *meta;
1426	size_t len_std = 2;
1427	bool has_pts, has_scr;
1428	unsigned long flags;
1429	unsigned int sof;
1430	ktime_t time;
1431	const u8 *scr;
1432
1433	if (!meta_buf || length == 2)
1434	return;
1435
1436	if (meta_buf->length - meta_buf->bytesused <
1437	length + sizeof(meta->ns) + sizeof(meta->sof)) {
1438	meta_buf->error = 1;
1439	return;
1440	}
1441
1442	has_pts = mem[1] & UVC_STREAM_PTS;
1443	has_scr = mem[1] & UVC_STREAM_SCR;
1444
1445	if (has_pts) {
1446	len_std += 4;
1447	scr = mem + 6;
1448	} else {
1449	scr = mem + 2;
1450	}
1451
1452	if (has_scr)
1453	len_std += 6;
1454
1455	if (stream->meta.format == V4L2_META_FMT_UVC)
1456	length = len_std;
1457
1458	if (length == len_std && (!has_scr ||
1459	!memcmp(p: scr, q: stream->clock.last_scr, size: 6)))
1460	return;
1461
1462	meta = (struct uvc_meta_buf *)((u8 *)meta_buf->mem + meta_buf->bytesused);
1463	local_irq_save(flags);
1464	time = uvc_video_get_time();
1465	sof = usb_get_current_frame_number(usb_dev: stream->dev->udev);
1466	local_irq_restore(flags);
1467	put_unaligned(ktime_to_ns(time), &meta->ns);
1468	put_unaligned(sof, &meta->sof);
1469
1470	if (has_scr)
1471	memcpy(stream->clock.last_scr, scr, 6);
1472
1473	meta->length = mem[0];
1474	meta->flags = mem[1];
1475	memcpy(meta->buf, &mem[2], length - 2);
1476	meta_buf->bytesused += length + sizeof(meta->ns) + sizeof(meta->sof);
1477
1478	uvc_dbg(stream->dev, FRAME,
1479	"%s(): t-sys %lluns, SOF %u, len %u, flags 0x%x, PTS %u, STC %u frame SOF %u\n",
1480	__func__, ktime_to_ns(time), meta->sof, meta->length,
1481	meta->flags,
1482	has_pts ? *(u32 *)meta->buf : 0,
1483	has_scr ? *(u32 *)scr : 0,
1484	has_scr ? *(u32 *)(scr + 4) & 0x7ff : 0);
1485	}
1486
1487	/* ------------------------------------------------------------------------
1488	* URB handling
1489	*/
1490
1491	/*
1492	* Set error flag for incomplete buffer.
1493	*/
1494	static void uvc_video_validate_buffer(const struct uvc_streaming *stream,
1495	struct uvc_buffer *buf)
1496	{
1497	if (stream->ctrl.dwMaxVideoFrameSize != buf->bytesused &&
1498	!(stream->cur_format->flags & UVC_FMT_FLAG_COMPRESSED))
1499	buf->error = 1;
1500	}
1501
1502	/*
1503	* Completion handler for video URBs.
1504	*/
1505
1506	static void uvc_video_next_buffers(struct uvc_streaming *stream,
1507	struct uvc_buffer **video_buf, struct uvc_buffer **meta_buf)
1508	{
1509	uvc_video_validate_buffer(stream, buf: *video_buf);
1510
1511	if (*meta_buf) {
1512	struct vb2_v4l2_buffer *vb2_meta = &(*meta_buf)->buf;
1513	const struct vb2_v4l2_buffer *vb2_video = &(*video_buf)->buf;
1514
1515	vb2_meta->sequence = vb2_video->sequence;
1516	vb2_meta->field = vb2_video->field;
1517	vb2_meta->vb2_buf.timestamp = vb2_video->vb2_buf.timestamp;
1518
1519	(*meta_buf)->state = UVC_BUF_STATE_READY;
1520	if (!(*meta_buf)->error)
1521	(*meta_buf)->error = (*video_buf)->error;
1522	*meta_buf = uvc_queue_next_buffer(queue: &stream->meta.queue,
1523	buf: *meta_buf);
1524	}
1525	*video_buf = uvc_queue_next_buffer(queue: &stream->queue, buf: *video_buf);
1526	}
1527
1528	static void uvc_video_decode_isoc(struct uvc_urb *uvc_urb,
1529	struct uvc_buffer *buf, struct uvc_buffer *meta_buf)
1530	{
1531	struct urb *urb = uvc_urb->urb;
1532	struct uvc_streaming *stream = uvc_urb->stream;
1533	u8 *mem;
1534	int ret, i;
1535
1536	for (i = 0; i < urb->number_of_packets; ++i) {
1537	if (urb->iso_frame_desc[i].status < 0) {
1538	uvc_dbg(stream->dev, FRAME,
1539	"USB isochronous frame lost (%d)\n",
1540	urb->iso_frame_desc[i].status);
1541	/* Mark the buffer as faulty. */
1542	if (buf != NULL)
1543	buf->error = 1;
1544	continue;
1545	}
1546
1547	/* Decode the payload header. */
1548	mem = urb->transfer_buffer + urb->iso_frame_desc[i].offset;
1549	do {
1550	ret = uvc_video_decode_start(stream, buf, data: mem,
1551	len: urb->iso_frame_desc[i].actual_length);
1552	if (ret == -EAGAIN)
1553	uvc_video_next_buffers(stream, video_buf: &buf, meta_buf: &meta_buf);
1554	} while (ret == -EAGAIN);
1555
1556	if (ret < 0)
1557	continue;
1558
1559	uvc_video_decode_meta(stream, meta_buf, mem, length: ret);
1560
1561	/* Decode the payload data. */
1562	uvc_video_decode_data(uvc_urb, buf, data: mem + ret,
1563	len: urb->iso_frame_desc[i].actual_length - ret);
1564
1565	/* Process the header again. */
1566	uvc_video_decode_end(stream, buf, data: mem,
1567	len: urb->iso_frame_desc[i].actual_length);
1568
1569	if (buf->state == UVC_BUF_STATE_READY)
1570	uvc_video_next_buffers(stream, video_buf: &buf, meta_buf: &meta_buf);
1571	}
1572	}
1573
1574	static void uvc_video_decode_bulk(struct uvc_urb *uvc_urb,
1575	struct uvc_buffer *buf, struct uvc_buffer *meta_buf)
1576	{
1577	struct urb *urb = uvc_urb->urb;
1578	struct uvc_streaming *stream = uvc_urb->stream;
1579	u8 *mem;
1580	int len, ret;
1581
1582	/*
1583	* Ignore ZLPs if they're not part of a frame, otherwise process them
1584	* to trigger the end of payload detection.
1585	*/
1586	if (urb->actual_length == 0 && stream->bulk.header_size == 0)
1587	return;
1588
1589	mem = urb->transfer_buffer;
1590	len = urb->actual_length;
1591	stream->bulk.payload_size += len;
1592
1593	/*
1594	* If the URB is the first of its payload, decode and save the
1595	* header.
1596	*/
1597	if (stream->bulk.header_size == 0 && !stream->bulk.skip_payload) {
1598	do {
1599	ret = uvc_video_decode_start(stream, buf, data: mem, len);
1600	if (ret == -EAGAIN)
1601	uvc_video_next_buffers(stream, video_buf: &buf, meta_buf: &meta_buf);
1602	} while (ret == -EAGAIN);
1603
1604	/* If an error occurred skip the rest of the payload. */
1605	if (ret < 0 || buf == NULL) {
1606	stream->bulk.skip_payload = 1;
1607	} else {
1608	memcpy(stream->bulk.header, mem, ret);
1609	stream->bulk.header_size = ret;
1610
1611	uvc_video_decode_meta(stream, meta_buf, mem, length: ret);
1612
1613	mem += ret;
1614	len -= ret;
1615	}
1616	}
1617
1618	/*
1619	* The buffer queue might have been cancelled while a bulk transfer
1620	* was in progress, so we can reach here with buf equal to NULL. Make
1621	* sure buf is never dereferenced if NULL.
1622	*/
1623
1624	/* Prepare video data for processing. */
1625	if (!stream->bulk.skip_payload && buf != NULL)
1626	uvc_video_decode_data(uvc_urb, buf, data: mem, len);
1627
1628	/*
1629	* Detect the payload end by a URB smaller than the maximum size (or
1630	* a payload size equal to the maximum) and process the header again.
1631	*/
1632	if (urb->actual_length < urb->transfer_buffer_length ||
1633	stream->bulk.payload_size >= stream->bulk.max_payload_size) {
1634	if (!stream->bulk.skip_payload && buf != NULL) {
1635	uvc_video_decode_end(stream, buf, data: stream->bulk.header,
1636	len: stream->bulk.payload_size);
1637	if (buf->state == UVC_BUF_STATE_READY)
1638	uvc_video_next_buffers(stream, video_buf: &buf, meta_buf: &meta_buf);
1639	}
1640
1641	stream->bulk.header_size = 0;
1642	stream->bulk.skip_payload = 0;
1643	stream->bulk.payload_size = 0;
1644	}
1645	}
1646
1647	static void uvc_video_encode_bulk(struct uvc_urb *uvc_urb,
1648	struct uvc_buffer *buf, struct uvc_buffer *meta_buf)
1649	{
1650	struct urb *urb = uvc_urb->urb;
1651	struct uvc_streaming *stream = uvc_urb->stream;
1652
1653	u8 *mem = urb->transfer_buffer;
1654	int len = stream->urb_size, ret;
1655
1656	if (buf == NULL) {
1657	urb->transfer_buffer_length = 0;
1658	return;
1659	}
1660
1661	/* If the URB is the first of its payload, add the header. */
1662	if (stream->bulk.header_size == 0) {
1663	ret = uvc_video_encode_header(stream, buf, data: mem, len);
1664	stream->bulk.header_size = ret;
1665	stream->bulk.payload_size += ret;
1666	mem += ret;
1667	len -= ret;
1668	}
1669
1670	/* Process video data. */
1671	ret = uvc_video_encode_data(stream, buf, data: mem, len);
1672
1673	stream->bulk.payload_size += ret;
1674	len -= ret;
1675
1676	if (buf->bytesused == stream->queue.buf_used ||
1677	stream->bulk.payload_size == stream->bulk.max_payload_size) {
1678	if (buf->bytesused == stream->queue.buf_used) {
1679	stream->queue.buf_used = 0;
1680	buf->state = UVC_BUF_STATE_READY;
1681	buf->buf.sequence = ++stream->sequence;
1682	uvc_queue_next_buffer(queue: &stream->queue, buf);
1683	stream->last_fid ^= UVC_STREAM_FID;
1684	}
1685
1686	stream->bulk.header_size = 0;
1687	stream->bulk.payload_size = 0;
1688	}
1689
1690	urb->transfer_buffer_length = stream->urb_size - len;
1691	}
1692
1693	static void uvc_video_complete(struct urb *urb)
1694	{
1695	struct uvc_urb *uvc_urb = urb->context;
1696	struct uvc_streaming *stream = uvc_urb->stream;
1697	struct uvc_video_queue *queue = &stream->queue;
1698	struct uvc_video_queue *qmeta = &stream->meta.queue;
1699	struct vb2_queue *vb2_qmeta = stream->meta.vdev.queue;
1700	struct uvc_buffer *buf = NULL;
1701	struct uvc_buffer *buf_meta = NULL;
1702	unsigned long flags;
1703	int ret;
1704
1705	switch (urb->status) {
1706	case 0:
1707	break;
1708
1709	default:
1710	dev_warn(&stream->intf->dev,
1711	"Non-zero status (%d) in video completion handler.\n",
1712	urb->status);
1713	fallthrough;
1714	case -ENOENT: /* usb_poison_urb() called. */
1715	if (stream->frozen)
1716	return;
1717	fallthrough;
1718	case -ECONNRESET: /* usb_unlink_urb() called. */
1719	case -ESHUTDOWN: /* The endpoint is being disabled. */
1720	uvc_queue_cancel(queue, disconnect: urb->status == -ESHUTDOWN);
1721	if (vb2_qmeta)
1722	uvc_queue_cancel(queue: qmeta, disconnect: urb->status == -ESHUTDOWN);
1723	return;
1724	}
1725
1726	buf = uvc_queue_get_current_buffer(queue);
1727
1728	if (vb2_qmeta) {
1729	spin_lock_irqsave(&qmeta->irqlock, flags);
1730	if (!list_empty(head: &qmeta->irqqueue))
1731	buf_meta = list_first_entry(&qmeta->irqqueue,
1732	struct uvc_buffer, queue);
1733	spin_unlock_irqrestore(lock: &qmeta->irqlock, flags);
1734	}
1735
1736	/* Re-initialise the URB async work. */
1737	uvc_urb->async_operations = 0;
1738
1739	/* Sync DMA and invalidate vmap range. */
1740	dma_sync_sgtable_for_cpu(dev: uvc_stream_to_dmadev(stream: uvc_urb->stream),
1741	sgt: uvc_urb->sgt, dir: uvc_stream_dir(stream));
1742	invalidate_kernel_vmap_range(vaddr: uvc_urb->buffer,
1743	size: uvc_urb->stream->urb_size);
1744
1745	/*
1746	* Process the URB headers, and optionally queue expensive memcpy tasks
1747	* to be deferred to a work queue.
1748	*/
1749	stream->decode(uvc_urb, buf, buf_meta);
1750
1751	/* If no async work is needed, resubmit the URB immediately. */
1752	if (!uvc_urb->async_operations) {
1753	ret = uvc_submit_urb(uvc_urb, GFP_ATOMIC);
1754	if (ret < 0)
1755	dev_err(&stream->intf->dev,
1756	"Failed to resubmit video URB (%d).\n", ret);
1757	return;
1758	}
1759
1760	queue_work(wq: stream->async_wq, work: &uvc_urb->work);
1761	}
1762
1763	/*
1764	* Free transfer buffers.
1765	*/
1766	static void uvc_free_urb_buffers(struct uvc_streaming *stream)
1767	{
1768	struct device *dma_dev = uvc_stream_to_dmadev(stream);
1769	struct uvc_urb *uvc_urb;
1770
1771	for_each_uvc_urb(uvc_urb, stream) {
1772	if (!uvc_urb->buffer)
1773	continue;
1774
1775	dma_vunmap_noncontiguous(dev: dma_dev, vaddr: uvc_urb->buffer);
1776	dma_free_noncontiguous(dev: dma_dev, size: stream->urb_size, sgt: uvc_urb->sgt,
1777	dir: uvc_stream_dir(stream));
1778
1779	uvc_urb->buffer = NULL;
1780	uvc_urb->sgt = NULL;
1781	}
1782
1783	stream->urb_size = 0;
1784	}
1785
1786	static bool uvc_alloc_urb_buffer(struct uvc_streaming *stream,
1787	struct uvc_urb *uvc_urb, gfp_t gfp_flags)
1788	{
1789	struct device *dma_dev = uvc_stream_to_dmadev(stream);
1790
1791	uvc_urb->sgt = dma_alloc_noncontiguous(dev: dma_dev, size: stream->urb_size,
1792	dir: uvc_stream_dir(stream),
1793	gfp: gfp_flags, attrs: 0);
1794	if (!uvc_urb->sgt)
1795	return false;
1796	uvc_urb->dma = uvc_urb->sgt->sgl->dma_address;
1797
1798	uvc_urb->buffer = dma_vmap_noncontiguous(dev: dma_dev, size: stream->urb_size,
1799	sgt: uvc_urb->sgt);
1800	if (!uvc_urb->buffer) {
1801	dma_free_noncontiguous(dev: dma_dev, size: stream->urb_size,
1802	sgt: uvc_urb->sgt,
1803	dir: uvc_stream_dir(stream));
1804	uvc_urb->sgt = NULL;
1805	return false;
1806	}
1807
1808	return true;
1809	}
1810
1811	/*
1812	* Allocate transfer buffers. This function can be called with buffers
1813	* already allocated when resuming from suspend, in which case it will
1814	* return without touching the buffers.
1815	*
1816	* Limit the buffer size to UVC_MAX_PACKETS bulk/isochronous packets. If the
1817	* system is too low on memory try successively smaller numbers of packets
1818	* until allocation succeeds.
1819	*
1820	* Return the number of allocated packets on success or 0 when out of memory.
1821	*/
1822	static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
1823	unsigned int size, unsigned int psize, gfp_t gfp_flags)
1824	{
1825	unsigned int npackets;
1826	unsigned int i;
1827
1828	/* Buffers are already allocated, bail out. */
1829	if (stream->urb_size)
1830	return stream->urb_size / psize;
1831
1832	/*
1833	* Compute the number of packets. Bulk endpoints might transfer UVC
1834	* payloads across multiple URBs.
1835	*/
1836	npackets = DIV_ROUND_UP(size, psize);
1837	if (npackets > UVC_MAX_PACKETS)
1838	npackets = UVC_MAX_PACKETS;
1839
1840	/* Retry allocations until one succeed. */
1841	for (; npackets > 1; npackets /= 2) {
1842	stream->urb_size = psize * npackets;
1843
1844	for (i = 0; i < UVC_URBS; ++i) {
1845	struct uvc_urb *uvc_urb = &stream->uvc_urb[i];
1846
1847	if (!uvc_alloc_urb_buffer(stream, uvc_urb, gfp_flags)) {
1848	uvc_free_urb_buffers(stream);
1849	break;
1850	}
1851
1852	uvc_urb->stream = stream;
1853	}
1854
1855	if (i == UVC_URBS) {
1856	uvc_dbg(stream->dev, VIDEO,
1857	"Allocated %u URB buffers of %ux%u bytes each\n",
1858	UVC_URBS, npackets, psize);
1859	return npackets;
1860	}
1861	}
1862
1863	uvc_dbg(stream->dev, VIDEO,
1864	"Failed to allocate URB buffers (%u bytes per packet)\n",
1865	psize);
1866	return 0;
1867	}
1868
1869	/*
1870	* Uninitialize isochronous/bulk URBs and free transfer buffers.
1871	*/
1872	static void uvc_video_stop_transfer(struct uvc_streaming *stream,
1873	int free_buffers)
1874	{
1875	struct uvc_urb *uvc_urb;
1876
1877	uvc_video_stats_stop(stream);
1878
1879	/*
1880	* We must poison the URBs rather than kill them to ensure that even
1881	* after the completion handler returns, any asynchronous workqueues
1882	* will be prevented from resubmitting the URBs.
1883	*/
1884	for_each_uvc_urb(uvc_urb, stream)
1885	usb_poison_urb(urb: uvc_urb->urb);
1886
1887	flush_workqueue(stream->async_wq);
1888
1889	for_each_uvc_urb(uvc_urb, stream) {
1890	usb_free_urb(urb: uvc_urb->urb);
1891	uvc_urb->urb = NULL;
1892	}
1893
1894	if (free_buffers)
1895	uvc_free_urb_buffers(stream);
1896	}
1897
1898	/*
1899	* Compute the maximum number of bytes per interval for an endpoint.
1900	*/
1901	u16 uvc_endpoint_max_bpi(struct usb_device *dev, struct usb_host_endpoint *ep)
1902	{
1903	u16 psize;
1904
1905	switch (dev->speed) {
1906	case USB_SPEED_SUPER:
1907	case USB_SPEED_SUPER_PLUS:
1908	return le16_to_cpu(ep->ss_ep_comp.wBytesPerInterval);
1909	default:
1910	psize = usb_endpoint_maxp(epd: &ep->desc);
1911	psize *= usb_endpoint_maxp_mult(epd: &ep->desc);
1912	return psize;
1913	}
1914	}
1915
1916	/*
1917	* Initialize isochronous URBs and allocate transfer buffers. The packet size
1918	* is given by the endpoint.
1919	*/
1920	static int uvc_init_video_isoc(struct uvc_streaming *stream,
1921	struct usb_host_endpoint *ep, gfp_t gfp_flags)
1922	{
1923	struct urb *urb;
1924	struct uvc_urb *uvc_urb;
1925	unsigned int npackets, i;
1926	u16 psize;
1927	u32 size;
1928
1929	psize = uvc_endpoint_max_bpi(dev: stream->dev->udev, ep);
1930	size = stream->ctrl.dwMaxVideoFrameSize;
1931
1932	npackets = uvc_alloc_urb_buffers(stream, size, psize, gfp_flags);
1933	if (npackets == 0)
1934	return -ENOMEM;
1935
1936	size = npackets * psize;
1937
1938	for_each_uvc_urb(uvc_urb, stream) {
1939	urb = usb_alloc_urb(iso_packets: npackets, mem_flags: gfp_flags);
1940	if (urb == NULL) {
1941	uvc_video_stop_transfer(stream, free_buffers: 1);
1942	return -ENOMEM;
1943	}
1944
1945	urb->dev = stream->dev->udev;
1946	urb->context = uvc_urb;
1947	urb->pipe = usb_rcvisocpipe(stream->dev->udev,
1948	ep->desc.bEndpointAddress);
1949	urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1950	urb->transfer_dma = uvc_urb->dma;
1951	urb->interval = ep->desc.bInterval;
1952	urb->transfer_buffer = uvc_urb->buffer;
1953	urb->complete = uvc_video_complete;
1954	urb->number_of_packets = npackets;
1955	urb->transfer_buffer_length = size;
1956
1957	for (i = 0; i < npackets; ++i) {
1958	urb->iso_frame_desc[i].offset = i * psize;
1959	urb->iso_frame_desc[i].length = psize;
1960	}
1961
1962	uvc_urb->urb = urb;
1963	}
1964
1965	return 0;
1966	}
1967
1968	/*
1969	* Initialize bulk URBs and allocate transfer buffers. The packet size is
1970	* given by the endpoint.
1971	*/
1972	static int uvc_init_video_bulk(struct uvc_streaming *stream,
1973	struct usb_host_endpoint *ep, gfp_t gfp_flags)
1974	{
1975	struct urb *urb;
1976	struct uvc_urb *uvc_urb;
1977	unsigned int npackets, pipe;
1978	u16 psize;
1979	u32 size;
1980
1981	psize = usb_endpoint_maxp(epd: &ep->desc);
1982	size = stream->ctrl.dwMaxPayloadTransferSize;
1983	stream->bulk.max_payload_size = size;
1984
1985	npackets = uvc_alloc_urb_buffers(stream, size, psize, gfp_flags);
1986	if (npackets == 0)
1987	return -ENOMEM;
1988
1989	size = npackets * psize;
1990
1991	if (usb_endpoint_dir_in(epd: &ep->desc))
1992	pipe = usb_rcvbulkpipe(stream->dev->udev,
1993	ep->desc.bEndpointAddress);
1994	else
1995	pipe = usb_sndbulkpipe(stream->dev->udev,
1996	ep->desc.bEndpointAddress);
1997
1998	if (stream->type == V4L2_BUF_TYPE_VIDEO_OUTPUT)
1999	size = 0;
2000
2001	for_each_uvc_urb(uvc_urb, stream) {
2002	urb = usb_alloc_urb(iso_packets: 0, mem_flags: gfp_flags);
2003	if (urb == NULL) {
2004	uvc_video_stop_transfer(stream, free_buffers: 1);
2005	return -ENOMEM;
2006	}
2007
2008	usb_fill_bulk_urb(urb, dev: stream->dev->udev, pipe, transfer_buffer: uvc_urb->buffer,
2009	buffer_length: size, complete_fn: uvc_video_complete, context: uvc_urb);
2010	urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
2011	urb->transfer_dma = uvc_urb->dma;
2012
2013	uvc_urb->urb = urb;
2014	}
2015
2016	return 0;
2017	}
2018
2019	/*
2020	* Initialize isochronous/bulk URBs and allocate transfer buffers.
2021	*/
2022	static int uvc_video_start_transfer(struct uvc_streaming *stream,
2023	gfp_t gfp_flags)
2024	{
2025	struct usb_interface *intf = stream->intf;
2026	struct usb_host_endpoint *ep;
2027	struct uvc_urb *uvc_urb;
2028	unsigned int i;
2029	int ret;
2030
2031	stream->sequence = -1;
2032	stream->last_fid = -1;
2033	stream->bulk.header_size = 0;
2034	stream->bulk.skip_payload = 0;
2035	stream->bulk.payload_size = 0;
2036
2037	uvc_video_stats_start(stream);
2038
2039	if (intf->num_altsetting > 1) {
2040	struct usb_host_endpoint *best_ep = NULL;
2041	unsigned int best_psize = UINT_MAX;
2042	unsigned int bandwidth;
2043	unsigned int altsetting;
2044	int intfnum = stream->intfnum;
2045
2046	/* Isochronous endpoint, select the alternate setting. */
2047	bandwidth = stream->ctrl.dwMaxPayloadTransferSize;
2048
2049	if (bandwidth == 0) {
2050	uvc_dbg(stream->dev, VIDEO,
2051	"Device requested null bandwidth, defaulting to lowest\n");
2052	bandwidth = 1;
2053	} else {
2054	uvc_dbg(stream->dev, VIDEO,
2055	"Device requested %u B/frame bandwidth\n",
2056	bandwidth);
2057	}
2058
2059	for (i = 0; i < intf->num_altsetting; ++i) {
2060	struct usb_host_interface *alts;
2061	unsigned int psize;
2062
2063	alts = &intf->altsetting[i];
2064	ep = uvc_find_endpoint(alts,
2065	epaddr: stream->header.bEndpointAddress);
2066	if (ep == NULL)
2067	continue;
2068
2069	/* Check if the bandwidth is high enough. */
2070	psize = uvc_endpoint_max_bpi(dev: stream->dev->udev, ep);
2071	if (psize >= bandwidth && psize < best_psize) {
2072	altsetting = alts->desc.bAlternateSetting;
2073	best_psize = psize;
2074	best_ep = ep;
2075	}
2076	}
2077
2078	if (best_ep == NULL) {
2079	uvc_dbg(stream->dev, VIDEO,
2080	"No fast enough alt setting for requested bandwidth\n");
2081	return -EIO;
2082	}
2083
2084	uvc_dbg(stream->dev, VIDEO,
2085	"Selecting alternate setting %u (%u B/frame bandwidth)\n",
2086	altsetting, best_psize);
2087
2088	/*
2089	* Some devices, namely the Logitech C910 and B910, are unable
2090	* to recover from a USB autosuspend, unless the alternate
2091	* setting of the streaming interface is toggled.
2092	*/
2093	if (stream->dev->quirks & UVC_QUIRK_WAKE_AUTOSUSPEND) {
2094	usb_set_interface(dev: stream->dev->udev, ifnum: intfnum,
2095	alternate: altsetting);
2096	usb_set_interface(dev: stream->dev->udev, ifnum: intfnum, alternate: 0);
2097	}
2098
2099	ret = usb_set_interface(dev: stream->dev->udev, ifnum: intfnum, alternate: altsetting);
2100	if (ret < 0)
2101	return ret;
2102
2103	ret = uvc_init_video_isoc(stream, ep: best_ep, gfp_flags);
2104	} else {
2105	/* Bulk endpoint, proceed to URB initialization. */
2106	ep = uvc_find_endpoint(alts: &intf->altsetting[0],
2107	epaddr: stream->header.bEndpointAddress);
2108	if (ep == NULL)
2109	return -EIO;
2110
2111	/* Reject broken descriptors. */
2112	if (usb_endpoint_maxp(epd: &ep->desc) == 0)
2113	return -EIO;
2114
2115	ret = uvc_init_video_bulk(stream, ep, gfp_flags);
2116	}
2117
2118	if (ret < 0)
2119	return ret;
2120
2121	/* Submit the URBs. */
2122	for_each_uvc_urb(uvc_urb, stream) {
2123	ret = uvc_submit_urb(uvc_urb, mem_flags: gfp_flags);
2124	if (ret < 0) {
2125	dev_err(&stream->intf->dev,
2126	"Failed to submit URB %u (%d).\n",
2127	uvc_urb_index(uvc_urb), ret);
2128	uvc_video_stop_transfer(stream, free_buffers: 1);
2129	return ret;
2130	}
2131	}
2132
2133	/*
2134	* The Logitech C920 temporarily forgets that it should not be adjusting
2135	* Exposure Absolute during init so restore controls to stored values.
2136	*/
2137	if (stream->dev->quirks & UVC_QUIRK_RESTORE_CTRLS_ON_INIT)
2138	uvc_ctrl_restore_values(dev: stream->dev);
2139
2140	return 0;
2141	}
2142
2143	/* --------------------------------------------------------------------------
2144	* Suspend/resume
2145	*/
2146
2147	/*
2148	* Stop streaming without disabling the video queue.
2149	*
2150	* To let userspace applications resume without trouble, we must not touch the
2151	* video buffers in any way. We mark the device as frozen to make sure the URB
2152	* completion handler won't try to cancel the queue when we kill the URBs.
2153	*/
2154	int uvc_video_suspend(struct uvc_streaming *stream)
2155	{
2156	if (!uvc_queue_streaming(queue: &stream->queue))
2157	return 0;
2158
2159	stream->frozen = 1;
2160	uvc_video_stop_transfer(stream, free_buffers: 0);
2161	usb_set_interface(dev: stream->dev->udev, ifnum: stream->intfnum, alternate: 0);
2162	return 0;
2163	}
2164
2165	/*
2166	* Reconfigure the video interface and restart streaming if it was enabled
2167	* before suspend.
2168	*
2169	* If an error occurs, disable the video queue. This will wake all pending
2170	* buffers, making sure userspace applications are notified of the problem
2171	* instead of waiting forever.
2172	*/
2173	int uvc_video_resume(struct uvc_streaming *stream, int reset)
2174	{
2175	int ret;
2176
2177	/*
2178	* If the bus has been reset on resume, set the alternate setting to 0.
2179	* This should be the default value, but some devices crash or otherwise
2180	* misbehave if they don't receive a SET_INTERFACE request before any
2181	* other video control request.
2182	*/
2183	if (reset)
2184	usb_set_interface(dev: stream->dev->udev, ifnum: stream->intfnum, alternate: 0);
2185
2186	stream->frozen = 0;
2187
2188	uvc_video_clock_reset(clock: &stream->clock);
2189
2190	if (!uvc_queue_streaming(queue: &stream->queue))
2191	return 0;
2192
2193	ret = uvc_commit_video(stream, probe: &stream->ctrl);
2194	if (ret < 0)
2195	return ret;
2196
2197	return uvc_video_start_transfer(stream, GFP_NOIO);
2198	}
2199
2200	/* ------------------------------------------------------------------------
2201	* Video device
2202	*/
2203
2204	/*
2205	* Initialize the UVC video device by switching to alternate setting 0 and
2206	* retrieve the default format.
2207	*
2208	* Some cameras (namely the Fuji Finepix) set the format and frame
2209	* indexes to zero. The UVC standard doesn't clearly make this a spec
2210	* violation, so try to silently fix the values if possible.
2211	*
2212	* This function is called before registering the device with V4L.
2213	*/
2214	int uvc_video_init(struct uvc_streaming *stream)
2215	{
2216	struct uvc_streaming_control *probe = &stream->ctrl;
2217	const struct uvc_format *format = NULL;
2218	const struct uvc_frame *frame = NULL;
2219	struct uvc_urb *uvc_urb;
2220	unsigned int i;
2221	int ret;
2222
2223	if (stream->nformats == 0) {
2224	dev_info(&stream->intf->dev,
2225	"No supported video formats found.\n");
2226	return -EINVAL;
2227	}
2228
2229	atomic_set(v: &stream->active, i: 0);
2230
2231	/*
2232	* Alternate setting 0 should be the default, yet the XBox Live Vision
2233	* Cam (and possibly other devices) crash or otherwise misbehave if
2234	* they don't receive a SET_INTERFACE request before any other video
2235	* control request.
2236	*/
2237	usb_set_interface(dev: stream->dev->udev, ifnum: stream->intfnum, alternate: 0);
2238
2239	/*
2240	* Set the streaming probe control with default streaming parameters
2241	* retrieved from the device. Webcams that don't support GET_DEF
2242	* requests on the probe control will just keep their current streaming
2243	* parameters.
2244	*/
2245	if (uvc_get_video_ctrl(stream, ctrl: probe, probe: 1, UVC_GET_DEF) == 0)
2246	uvc_set_video_ctrl(stream, ctrl: probe, probe: 1);
2247
2248	/*
2249	* Initialize the streaming parameters with the probe control current
2250	* value. This makes sure SET_CUR requests on the streaming commit
2251	* control will always use values retrieved from a successful GET_CUR
2252	* request on the probe control, as required by the UVC specification.
2253	*/
2254	ret = uvc_get_video_ctrl(stream, ctrl: probe, probe: 1, UVC_GET_CUR);
2255
2256	/*
2257	* Elgato Cam Link 4k can be in a stalled state if the resolution of
2258	* the external source has changed while the firmware initializes.
2259	* Once in this state, the device is useless until it receives a
2260	* USB reset. It has even been observed that the stalled state will
2261	* continue even after unplugging the device.
2262	*/
2263	if (ret == -EPROTO &&
2264	usb_match_one_id(interface: stream->dev->intf, id: &elgato_cam_link_4k)) {
2265	dev_err(&stream->intf->dev, "Elgato Cam Link 4K firmware crash detected\n");
2266	dev_err(&stream->intf->dev, "Resetting the device, unplug and replug to recover\n");
2267	usb_reset_device(dev: stream->dev->udev);
2268	}
2269
2270	if (ret < 0)
2271	return ret;
2272
2273	/*
2274	* Check if the default format descriptor exists. Use the first
2275	* available format otherwise.
2276	*/
2277	for (i = stream->nformats; i > 0; --i) {
2278	format = &stream->formats[i-1];
2279	if (format->index == probe->bFormatIndex)
2280	break;
2281	}
2282
2283	if (format->nframes == 0) {
2284	dev_info(&stream->intf->dev,
2285	"No frame descriptor found for the default format.\n");
2286	return -EINVAL;
2287	}
2288
2289	/*
2290	* Zero bFrameIndex might be correct. Stream-based formats (including
2291	* MPEG-2 TS and DV) do not support frames but have a dummy frame
2292	* descriptor with bFrameIndex set to zero. If the default frame
2293	* descriptor is not found, use the first available frame.
2294	*/
2295	for (i = format->nframes; i > 0; --i) {
2296	frame = &format->frames[i-1];
2297	if (frame->bFrameIndex == probe->bFrameIndex)
2298	break;
2299	}
2300
2301	probe->bFormatIndex = format->index;
2302	probe->bFrameIndex = frame->bFrameIndex;
2303
2304	stream->def_format = format;
2305	stream->cur_format = format;
2306	stream->cur_frame = frame;
2307
2308	/* Select the video decoding function */
2309	if (stream->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
2310	if (stream->dev->quirks & UVC_QUIRK_BUILTIN_ISIGHT)
2311	stream->decode = uvc_video_decode_isight;
2312	else if (stream->intf->num_altsetting > 1)
2313	stream->decode = uvc_video_decode_isoc;
2314	else
2315	stream->decode = uvc_video_decode_bulk;
2316	} else {
2317	if (stream->intf->num_altsetting == 1)
2318	stream->decode = uvc_video_encode_bulk;
2319	else {
2320	dev_info(&stream->intf->dev,
2321	"Isochronous endpoints are not supported for video output devices.\n");
2322	return -EINVAL;
2323	}
2324	}
2325
2326	/* Prepare asynchronous work items. */
2327	for_each_uvc_urb(uvc_urb, stream)
2328	INIT_WORK(&uvc_urb->work, uvc_video_copy_data_work);
2329
2330	return 0;
2331	}
2332
2333	int uvc_video_start_streaming(struct uvc_streaming *stream)
2334	{
2335	int ret;
2336
2337	ret = uvc_video_clock_init(clock: &stream->clock);
2338	if (ret < 0)
2339	return ret;
2340
2341	/* Commit the streaming parameters. */
2342	ret = uvc_commit_video(stream, probe: &stream->ctrl);
2343	if (ret < 0)
2344	goto error_commit;
2345
2346	ret = uvc_video_start_transfer(stream, GFP_KERNEL);
2347	if (ret < 0)
2348	goto error_video;
2349
2350	return 0;
2351
2352	error_video:
2353	usb_set_interface(dev: stream->dev->udev, ifnum: stream->intfnum, alternate: 0);
2354	error_commit:
2355	uvc_video_clock_cleanup(clock: &stream->clock);
2356
2357	return ret;
2358	}
2359
2360	void uvc_video_stop_streaming(struct uvc_streaming *stream)
2361	{
2362	uvc_video_stop_transfer(stream, free_buffers: 1);
2363
2364	if (stream->intf->num_altsetting > 1) {
2365	usb_set_interface(dev: stream->dev->udev, ifnum: stream->intfnum, alternate: 0);
2366	} else {
2367	/*
2368	* UVC doesn't specify how to inform a bulk-based device
2369	* when the video stream is stopped. Windows sends a
2370	* CLEAR_FEATURE(HALT) request to the video streaming
2371	* bulk endpoint, mimic the same behaviour.
2372	*/
2373	unsigned int epnum = stream->header.bEndpointAddress
2374	& USB_ENDPOINT_NUMBER_MASK;
2375	unsigned int dir = stream->header.bEndpointAddress
2376	& USB_ENDPOINT_DIR_MASK;
2377	unsigned int pipe;
2378
2379	pipe = usb_sndbulkpipe(stream->dev->udev, epnum) | dir;
2380	usb_clear_halt(dev: stream->dev->udev, pipe);
2381	}
2382
2383	uvc_video_clock_cleanup(clock: &stream->clock);
2384	}
2385