uvcvideo: Fix integer overflow in uvc_ioctl_ctrl_map()
[pandora-kernel.git] / drivers / media / video / uvc / uvc_v4l2.c
1 /*
2  *      uvc_v4l2.c  --  USB Video Class driver - V4L2 API
3  *
4  *      Copyright (C) 2005-2010
5  *          Laurent Pinchart (laurent.pinchart@ideasonboard.com)
6  *
7  *      This program is free software; you can redistribute it and/or modify
8  *      it under the terms of the GNU General Public License as published by
9  *      the Free Software Foundation; either version 2 of the License, or
10  *      (at your option) any later version.
11  *
12  */
13
14 #include <linux/kernel.h>
15 #include <linux/version.h>
16 #include <linux/list.h>
17 #include <linux/module.h>
18 #include <linux/slab.h>
19 #include <linux/usb.h>
20 #include <linux/videodev2.h>
21 #include <linux/vmalloc.h>
22 #include <linux/mm.h>
23 #include <linux/wait.h>
24 #include <linux/atomic.h>
25
26 #include <media/v4l2-common.h>
27 #include <media/v4l2-ioctl.h>
28
29 #include "uvcvideo.h"
30
31 /* ------------------------------------------------------------------------
32  * UVC ioctls
33  */
34 static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
35         struct uvc_xu_control_mapping *xmap)
36 {
37         struct uvc_control_mapping *map;
38         unsigned int size;
39         int ret;
40
41         map = kzalloc(sizeof *map, GFP_KERNEL);
42         if (map == NULL)
43                 return -ENOMEM;
44
45         map->id = xmap->id;
46         memcpy(map->name, xmap->name, sizeof map->name);
47         memcpy(map->entity, xmap->entity, sizeof map->entity);
48         map->selector = xmap->selector;
49         map->size = xmap->size;
50         map->offset = xmap->offset;
51         map->v4l2_type = xmap->v4l2_type;
52         map->data_type = xmap->data_type;
53
54         switch (xmap->v4l2_type) {
55         case V4L2_CTRL_TYPE_INTEGER:
56         case V4L2_CTRL_TYPE_BOOLEAN:
57         case V4L2_CTRL_TYPE_BUTTON:
58                 break;
59
60         case V4L2_CTRL_TYPE_MENU:
61                 /* Prevent excessive memory consumption, as well as integer
62                  * overflows.
63                  */
64                 if (xmap->menu_count == 0 ||
65                     xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
66                         ret = -EINVAL;
67                         goto done;
68                 }
69
70                 size = xmap->menu_count * sizeof(*map->menu_info);
71                 map->menu_info = kmalloc(size, GFP_KERNEL);
72                 if (map->menu_info == NULL) {
73                         ret = -ENOMEM;
74                         goto done;
75                 }
76
77                 if (copy_from_user(map->menu_info, xmap->menu_info, size)) {
78                         ret = -EFAULT;
79                         goto done;
80                 }
81
82                 map->menu_count = xmap->menu_count;
83                 break;
84
85         default:
86                 uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type "
87                           "%u.\n", xmap->v4l2_type);
88                 ret = -ENOTTY;
89                 goto done;
90         }
91
92         ret = uvc_ctrl_add_mapping(chain, map);
93
94 done:
95         kfree(map->menu_info);
96         kfree(map);
97
98         return ret;
99 }
100
101 /* ------------------------------------------------------------------------
102  * V4L2 interface
103  */
104
105 /*
106  * Find the frame interval closest to the requested frame interval for the
107  * given frame format and size. This should be done by the device as part of
108  * the Video Probe and Commit negotiation, but some hardware don't implement
109  * that feature.
110  */
111 static __u32 uvc_try_frame_interval(struct uvc_frame *frame, __u32 interval)
112 {
113         unsigned int i;
114
115         if (frame->bFrameIntervalType) {
116                 __u32 best = -1, dist;
117
118                 for (i = 0; i < frame->bFrameIntervalType; ++i) {
119                         dist = interval > frame->dwFrameInterval[i]
120                              ? interval - frame->dwFrameInterval[i]
121                              : frame->dwFrameInterval[i] - interval;
122
123                         if (dist > best)
124                                 break;
125
126                         best = dist;
127                 }
128
129                 interval = frame->dwFrameInterval[i-1];
130         } else {
131                 const __u32 min = frame->dwFrameInterval[0];
132                 const __u32 max = frame->dwFrameInterval[1];
133                 const __u32 step = frame->dwFrameInterval[2];
134
135                 interval = min + (interval - min + step/2) / step * step;
136                 if (interval > max)
137                         interval = max;
138         }
139
140         return interval;
141 }
142
143 static int uvc_v4l2_try_format(struct uvc_streaming *stream,
144         struct v4l2_format *fmt, struct uvc_streaming_control *probe,
145         struct uvc_format **uvc_format, struct uvc_frame **uvc_frame)
146 {
147         struct uvc_format *format = NULL;
148         struct uvc_frame *frame = NULL;
149         __u16 rw, rh;
150         unsigned int d, maxd;
151         unsigned int i;
152         __u32 interval;
153         int ret = 0;
154         __u8 *fcc;
155
156         if (fmt->type != stream->type)
157                 return -EINVAL;
158
159         fcc = (__u8 *)&fmt->fmt.pix.pixelformat;
160         uvc_trace(UVC_TRACE_FORMAT, "Trying format 0x%08x (%c%c%c%c): %ux%u.\n",
161                         fmt->fmt.pix.pixelformat,
162                         fcc[0], fcc[1], fcc[2], fcc[3],
163                         fmt->fmt.pix.width, fmt->fmt.pix.height);
164
165         /* Check if the hardware supports the requested format. */
166         for (i = 0; i < stream->nformats; ++i) {
167                 format = &stream->format[i];
168                 if (format->fcc == fmt->fmt.pix.pixelformat)
169                         break;
170         }
171
172         if (format == NULL || format->fcc != fmt->fmt.pix.pixelformat) {
173                 uvc_trace(UVC_TRACE_FORMAT, "Unsupported format 0x%08x.\n",
174                                 fmt->fmt.pix.pixelformat);
175                 return -EINVAL;
176         }
177
178         /* Find the closest image size. The distance between image sizes is
179          * the size in pixels of the non-overlapping regions between the
180          * requested size and the frame-specified size.
181          */
182         rw = fmt->fmt.pix.width;
183         rh = fmt->fmt.pix.height;
184         maxd = (unsigned int)-1;
185
186         for (i = 0; i < format->nframes; ++i) {
187                 __u16 w = format->frame[i].wWidth;
188                 __u16 h = format->frame[i].wHeight;
189
190                 d = min(w, rw) * min(h, rh);
191                 d = w*h + rw*rh - 2*d;
192                 if (d < maxd) {
193                         maxd = d;
194                         frame = &format->frame[i];
195                 }
196
197                 if (maxd == 0)
198                         break;
199         }
200
201         if (frame == NULL) {
202                 uvc_trace(UVC_TRACE_FORMAT, "Unsupported size %ux%u.\n",
203                                 fmt->fmt.pix.width, fmt->fmt.pix.height);
204                 return -EINVAL;
205         }
206
207         /* Use the default frame interval. */
208         interval = frame->dwDefaultFrameInterval;
209         uvc_trace(UVC_TRACE_FORMAT, "Using default frame interval %u.%u us "
210                 "(%u.%u fps).\n", interval/10, interval%10, 10000000/interval,
211                 (100000000/interval)%10);
212
213         /* Set the format index, frame index and frame interval. */
214         memset(probe, 0, sizeof *probe);
215         probe->bmHint = 1;      /* dwFrameInterval */
216         probe->bFormatIndex = format->index;
217         probe->bFrameIndex = frame->bFrameIndex;
218         probe->dwFrameInterval = uvc_try_frame_interval(frame, interval);
219         /* Some webcams stall the probe control set request when the
220          * dwMaxVideoFrameSize field is set to zero. The UVC specification
221          * clearly states that the field is read-only from the host, so this
222          * is a webcam bug. Set dwMaxVideoFrameSize to the value reported by
223          * the webcam to work around the problem.
224          *
225          * The workaround could probably be enabled for all webcams, so the
226          * quirk can be removed if needed. It's currently useful to detect
227          * webcam bugs and fix them before they hit the market (providing
228          * developers test their webcams with the Linux driver as well as with
229          * the Windows driver).
230          */
231         mutex_lock(&stream->mutex);
232         if (stream->dev->quirks & UVC_QUIRK_PROBE_EXTRAFIELDS)
233                 probe->dwMaxVideoFrameSize =
234                         stream->ctrl.dwMaxVideoFrameSize;
235
236         /* Probe the device. */
237         ret = uvc_probe_video(stream, probe);
238         mutex_unlock(&stream->mutex);
239         if (ret < 0)
240                 goto done;
241
242         fmt->fmt.pix.width = frame->wWidth;
243         fmt->fmt.pix.height = frame->wHeight;
244         fmt->fmt.pix.field = V4L2_FIELD_NONE;
245         fmt->fmt.pix.bytesperline = format->bpp * frame->wWidth / 8;
246         fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize;
247         fmt->fmt.pix.colorspace = format->colorspace;
248         fmt->fmt.pix.priv = 0;
249
250         if (uvc_format != NULL)
251                 *uvc_format = format;
252         if (uvc_frame != NULL)
253                 *uvc_frame = frame;
254
255 done:
256         return ret;
257 }
258
259 static int uvc_v4l2_get_format(struct uvc_streaming *stream,
260         struct v4l2_format *fmt)
261 {
262         struct uvc_format *format;
263         struct uvc_frame *frame;
264         int ret = 0;
265
266         if (fmt->type != stream->type)
267                 return -EINVAL;
268
269         mutex_lock(&stream->mutex);
270         format = stream->cur_format;
271         frame = stream->cur_frame;
272
273         if (format == NULL || frame == NULL) {
274                 ret = -EINVAL;
275                 goto done;
276         }
277
278         fmt->fmt.pix.pixelformat = format->fcc;
279         fmt->fmt.pix.width = frame->wWidth;
280         fmt->fmt.pix.height = frame->wHeight;
281         fmt->fmt.pix.field = V4L2_FIELD_NONE;
282         fmt->fmt.pix.bytesperline = format->bpp * frame->wWidth / 8;
283         fmt->fmt.pix.sizeimage = stream->ctrl.dwMaxVideoFrameSize;
284         fmt->fmt.pix.colorspace = format->colorspace;
285         fmt->fmt.pix.priv = 0;
286
287 done:
288         mutex_unlock(&stream->mutex);
289         return ret;
290 }
291
292 static int uvc_v4l2_set_format(struct uvc_streaming *stream,
293         struct v4l2_format *fmt)
294 {
295         struct uvc_streaming_control probe;
296         struct uvc_format *format;
297         struct uvc_frame *frame;
298         int ret;
299
300         if (fmt->type != stream->type)
301                 return -EINVAL;
302
303         ret = uvc_v4l2_try_format(stream, fmt, &probe, &format, &frame);
304         if (ret < 0)
305                 return ret;
306
307         mutex_lock(&stream->mutex);
308
309         if (uvc_queue_allocated(&stream->queue)) {
310                 ret = -EBUSY;
311                 goto done;
312         }
313
314         memcpy(&stream->ctrl, &probe, sizeof probe);
315         stream->cur_format = format;
316         stream->cur_frame = frame;
317
318 done:
319         mutex_unlock(&stream->mutex);
320         return ret;
321 }
322
323 static int uvc_v4l2_get_streamparm(struct uvc_streaming *stream,
324                 struct v4l2_streamparm *parm)
325 {
326         uint32_t numerator, denominator;
327
328         if (parm->type != stream->type)
329                 return -EINVAL;
330
331         mutex_lock(&stream->mutex);
332         numerator = stream->ctrl.dwFrameInterval;
333         mutex_unlock(&stream->mutex);
334
335         denominator = 10000000;
336         uvc_simplify_fraction(&numerator, &denominator, 8, 333);
337
338         memset(parm, 0, sizeof *parm);
339         parm->type = stream->type;
340
341         if (stream->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
342                 parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME;
343                 parm->parm.capture.capturemode = 0;
344                 parm->parm.capture.timeperframe.numerator = numerator;
345                 parm->parm.capture.timeperframe.denominator = denominator;
346                 parm->parm.capture.extendedmode = 0;
347                 parm->parm.capture.readbuffers = 0;
348         } else {
349                 parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
350                 parm->parm.output.outputmode = 0;
351                 parm->parm.output.timeperframe.numerator = numerator;
352                 parm->parm.output.timeperframe.denominator = denominator;
353         }
354
355         return 0;
356 }
357
358 static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream,
359                 struct v4l2_streamparm *parm)
360 {
361         struct uvc_streaming_control probe;
362         struct v4l2_fract timeperframe;
363         uint32_t interval;
364         int ret;
365
366         if (parm->type != stream->type)
367                 return -EINVAL;
368
369         if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
370                 timeperframe = parm->parm.capture.timeperframe;
371         else
372                 timeperframe = parm->parm.output.timeperframe;
373
374         interval = uvc_fraction_to_interval(timeperframe.numerator,
375                 timeperframe.denominator);
376         uvc_trace(UVC_TRACE_FORMAT, "Setting frame interval to %u/%u (%u).\n",
377                 timeperframe.numerator, timeperframe.denominator, interval);
378
379         mutex_lock(&stream->mutex);
380
381         if (uvc_queue_streaming(&stream->queue)) {
382                 mutex_unlock(&stream->mutex);
383                 return -EBUSY;
384         }
385
386         memcpy(&probe, &stream->ctrl, sizeof probe);
387         probe.dwFrameInterval =
388                 uvc_try_frame_interval(stream->cur_frame, interval);
389
390         /* Probe the device with the new settings. */
391         ret = uvc_probe_video(stream, &probe);
392         if (ret < 0) {
393                 mutex_unlock(&stream->mutex);
394                 return ret;
395         }
396
397         memcpy(&stream->ctrl, &probe, sizeof probe);
398         mutex_unlock(&stream->mutex);
399
400         /* Return the actual frame period. */
401         timeperframe.numerator = probe.dwFrameInterval;
402         timeperframe.denominator = 10000000;
403         uvc_simplify_fraction(&timeperframe.numerator,
404                 &timeperframe.denominator, 8, 333);
405
406         if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
407                 parm->parm.capture.timeperframe = timeperframe;
408         else
409                 parm->parm.output.timeperframe = timeperframe;
410
411         return 0;
412 }
413
414 /* ------------------------------------------------------------------------
415  * Privilege management
416  */
417
418 /*
419  * Privilege management is the multiple-open implementation basis. The current
420  * implementation is completely transparent for the end-user and doesn't
421  * require explicit use of the VIDIOC_G_PRIORITY and VIDIOC_S_PRIORITY ioctls.
422  * Those ioctls enable finer control on the device (by making possible for a
423  * user to request exclusive access to a device), but are not mature yet.
424  * Switching to the V4L2 priority mechanism might be considered in the future
425  * if this situation changes.
426  *
427  * Each open instance of a UVC device can either be in a privileged or
428  * unprivileged state. Only a single instance can be in a privileged state at
429  * a given time. Trying to perform an operation that requires privileges will
430  * automatically acquire the required privileges if possible, or return -EBUSY
431  * otherwise. Privileges are dismissed when closing the instance or when
432  * freeing the video buffers using VIDIOC_REQBUFS.
433  *
434  * Operations that require privileges are:
435  *
436  * - VIDIOC_S_INPUT
437  * - VIDIOC_S_PARM
438  * - VIDIOC_S_FMT
439  * - VIDIOC_REQBUFS
440  */
441 static int uvc_acquire_privileges(struct uvc_fh *handle)
442 {
443         /* Always succeed if the handle is already privileged. */
444         if (handle->state == UVC_HANDLE_ACTIVE)
445                 return 0;
446
447         /* Check if the device already has a privileged handle. */
448         if (atomic_inc_return(&handle->stream->active) != 1) {
449                 atomic_dec(&handle->stream->active);
450                 return -EBUSY;
451         }
452
453         handle->state = UVC_HANDLE_ACTIVE;
454         return 0;
455 }
456
457 static void uvc_dismiss_privileges(struct uvc_fh *handle)
458 {
459         if (handle->state == UVC_HANDLE_ACTIVE)
460                 atomic_dec(&handle->stream->active);
461
462         handle->state = UVC_HANDLE_PASSIVE;
463 }
464
465 static int uvc_has_privileges(struct uvc_fh *handle)
466 {
467         return handle->state == UVC_HANDLE_ACTIVE;
468 }
469
470 /* ------------------------------------------------------------------------
471  * V4L2 file operations
472  */
473
474 static int uvc_v4l2_open(struct file *file)
475 {
476         struct uvc_streaming *stream;
477         struct uvc_fh *handle;
478         int ret = 0;
479
480         uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_open\n");
481         stream = video_drvdata(file);
482
483         if (stream->dev->state & UVC_DEV_DISCONNECTED)
484                 return -ENODEV;
485
486         ret = usb_autopm_get_interface(stream->dev->intf);
487         if (ret < 0)
488                 return ret;
489
490         /* Create the device handle. */
491         handle = kzalloc(sizeof *handle, GFP_KERNEL);
492         if (handle == NULL) {
493                 usb_autopm_put_interface(stream->dev->intf);
494                 return -ENOMEM;
495         }
496
497         if (atomic_inc_return(&stream->dev->users) == 1) {
498                 ret = uvc_status_start(stream->dev);
499                 if (ret < 0) {
500                         usb_autopm_put_interface(stream->dev->intf);
501                         atomic_dec(&stream->dev->users);
502                         kfree(handle);
503                         return ret;
504                 }
505         }
506
507         handle->chain = stream->chain;
508         handle->stream = stream;
509         handle->state = UVC_HANDLE_PASSIVE;
510         file->private_data = handle;
511
512         return 0;
513 }
514
515 static int uvc_v4l2_release(struct file *file)
516 {
517         struct uvc_fh *handle = file->private_data;
518         struct uvc_streaming *stream = handle->stream;
519
520         uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_release\n");
521
522         /* Only free resources if this is a privileged handle. */
523         if (uvc_has_privileges(handle)) {
524                 uvc_video_enable(stream, 0);
525
526                 if (uvc_free_buffers(&stream->queue) < 0)
527                         uvc_printk(KERN_ERR, "uvc_v4l2_release: Unable to "
528                                         "free buffers.\n");
529         }
530
531         /* Release the file handle. */
532         uvc_dismiss_privileges(handle);
533         kfree(handle);
534         file->private_data = NULL;
535
536         if (atomic_dec_return(&stream->dev->users) == 0)
537                 uvc_status_stop(stream->dev);
538
539         usb_autopm_put_interface(stream->dev->intf);
540         return 0;
541 }
542
543 static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
544 {
545         struct video_device *vdev = video_devdata(file);
546         struct uvc_fh *handle = file->private_data;
547         struct uvc_video_chain *chain = handle->chain;
548         struct uvc_streaming *stream = handle->stream;
549         long ret = 0;
550
551         switch (cmd) {
552         /* Query capabilities */
553         case VIDIOC_QUERYCAP:
554         {
555                 struct v4l2_capability *cap = arg;
556
557                 memset(cap, 0, sizeof *cap);
558                 strlcpy(cap->driver, "uvcvideo", sizeof cap->driver);
559                 strlcpy(cap->card, vdev->name, sizeof cap->card);
560                 usb_make_path(stream->dev->udev,
561                               cap->bus_info, sizeof(cap->bus_info));
562                 cap->version = LINUX_VERSION_CODE;
563                 if (stream->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
564                         cap->capabilities = V4L2_CAP_VIDEO_CAPTURE
565                                           | V4L2_CAP_STREAMING;
566                 else
567                         cap->capabilities = V4L2_CAP_VIDEO_OUTPUT
568                                           | V4L2_CAP_STREAMING;
569                 break;
570         }
571
572         /* Get, Set & Query control */
573         case VIDIOC_QUERYCTRL:
574                 return uvc_query_v4l2_ctrl(chain, arg);
575
576         case VIDIOC_G_CTRL:
577         {
578                 struct v4l2_control *ctrl = arg;
579                 struct v4l2_ext_control xctrl;
580
581                 memset(&xctrl, 0, sizeof xctrl);
582                 xctrl.id = ctrl->id;
583
584                 ret = uvc_ctrl_begin(chain);
585                 if (ret < 0)
586                         return ret;
587
588                 ret = uvc_ctrl_get(chain, &xctrl);
589                 uvc_ctrl_rollback(chain);
590                 if (ret >= 0)
591                         ctrl->value = xctrl.value;
592                 break;
593         }
594
595         case VIDIOC_S_CTRL:
596         {
597                 struct v4l2_control *ctrl = arg;
598                 struct v4l2_ext_control xctrl;
599
600                 memset(&xctrl, 0, sizeof xctrl);
601                 xctrl.id = ctrl->id;
602                 xctrl.value = ctrl->value;
603
604                 ret = uvc_ctrl_begin(chain);
605                 if (ret < 0)
606                         return ret;
607
608                 ret = uvc_ctrl_set(chain, &xctrl);
609                 if (ret < 0) {
610                         uvc_ctrl_rollback(chain);
611                         return ret;
612                 }
613                 ret = uvc_ctrl_commit(chain);
614                 if (ret == 0)
615                         ctrl->value = xctrl.value;
616                 break;
617         }
618
619         case VIDIOC_QUERYMENU:
620                 return uvc_query_v4l2_menu(chain, arg);
621
622         case VIDIOC_G_EXT_CTRLS:
623         {
624                 struct v4l2_ext_controls *ctrls = arg;
625                 struct v4l2_ext_control *ctrl = ctrls->controls;
626                 unsigned int i;
627
628                 ret = uvc_ctrl_begin(chain);
629                 if (ret < 0)
630                         return ret;
631
632                 for (i = 0; i < ctrls->count; ++ctrl, ++i) {
633                         ret = uvc_ctrl_get(chain, ctrl);
634                         if (ret < 0) {
635                                 uvc_ctrl_rollback(chain);
636                                 ctrls->error_idx = i;
637                                 return ret;
638                         }
639                 }
640                 ctrls->error_idx = 0;
641                 ret = uvc_ctrl_rollback(chain);
642                 break;
643         }
644
645         case VIDIOC_S_EXT_CTRLS:
646         case VIDIOC_TRY_EXT_CTRLS:
647         {
648                 struct v4l2_ext_controls *ctrls = arg;
649                 struct v4l2_ext_control *ctrl = ctrls->controls;
650                 unsigned int i;
651
652                 ret = uvc_ctrl_begin(chain);
653                 if (ret < 0)
654                         return ret;
655
656                 for (i = 0; i < ctrls->count; ++ctrl, ++i) {
657                         ret = uvc_ctrl_set(chain, ctrl);
658                         if (ret < 0) {
659                                 uvc_ctrl_rollback(chain);
660                                 ctrls->error_idx = i;
661                                 return ret;
662                         }
663                 }
664
665                 ctrls->error_idx = 0;
666
667                 if (cmd == VIDIOC_S_EXT_CTRLS)
668                         ret = uvc_ctrl_commit(chain);
669                 else
670                         ret = uvc_ctrl_rollback(chain);
671                 break;
672         }
673
674         /* Get, Set & Enum input */
675         case VIDIOC_ENUMINPUT:
676         {
677                 const struct uvc_entity *selector = chain->selector;
678                 struct v4l2_input *input = arg;
679                 struct uvc_entity *iterm = NULL;
680                 u32 index = input->index;
681                 int pin = 0;
682
683                 if (selector == NULL ||
684                     (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
685                         if (index != 0)
686                                 return -EINVAL;
687                         list_for_each_entry(iterm, &chain->entities, chain) {
688                                 if (UVC_ENTITY_IS_ITERM(iterm))
689                                         break;
690                         }
691                         pin = iterm->id;
692                 } else if (pin < selector->bNrInPins) {
693                         pin = selector->baSourceID[index];
694                         list_for_each_entry(iterm, &chain->entities, chain) {
695                                 if (!UVC_ENTITY_IS_ITERM(iterm))
696                                         continue;
697                                 if (iterm->id == pin)
698                                         break;
699                         }
700                 }
701
702                 if (iterm == NULL || iterm->id != pin)
703                         return -EINVAL;
704
705                 memset(input, 0, sizeof *input);
706                 input->index = index;
707                 strlcpy(input->name, iterm->name, sizeof input->name);
708                 if (UVC_ENTITY_TYPE(iterm) == UVC_ITT_CAMERA)
709                         input->type = V4L2_INPUT_TYPE_CAMERA;
710                 break;
711         }
712
713         case VIDIOC_G_INPUT:
714         {
715                 u8 input;
716
717                 if (chain->selector == NULL ||
718                     (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
719                         *(int *)arg = 0;
720                         break;
721                 }
722
723                 ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR,
724                         chain->selector->id, chain->dev->intfnum,
725                         UVC_SU_INPUT_SELECT_CONTROL, &input, 1);
726                 if (ret < 0)
727                         return ret;
728
729                 *(int *)arg = input - 1;
730                 break;
731         }
732
733         case VIDIOC_S_INPUT:
734         {
735                 u32 input = *(u32 *)arg + 1;
736
737                 if ((ret = uvc_acquire_privileges(handle)) < 0)
738                         return ret;
739
740                 if (chain->selector == NULL ||
741                     (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
742                         if (input != 1)
743                                 return -EINVAL;
744                         break;
745                 }
746
747                 if (input == 0 || input > chain->selector->bNrInPins)
748                         return -EINVAL;
749
750                 return uvc_query_ctrl(chain->dev, UVC_SET_CUR,
751                         chain->selector->id, chain->dev->intfnum,
752                         UVC_SU_INPUT_SELECT_CONTROL, &input, 1);
753         }
754
755         /* Try, Get, Set & Enum format */
756         case VIDIOC_ENUM_FMT:
757         {
758                 struct v4l2_fmtdesc *fmt = arg;
759                 struct uvc_format *format;
760                 enum v4l2_buf_type type = fmt->type;
761                 __u32 index = fmt->index;
762
763                 if (fmt->type != stream->type ||
764                     fmt->index >= stream->nformats)
765                         return -EINVAL;
766
767                 memset(fmt, 0, sizeof(*fmt));
768                 fmt->index = index;
769                 fmt->type = type;
770
771                 format = &stream->format[fmt->index];
772                 fmt->flags = 0;
773                 if (format->flags & UVC_FMT_FLAG_COMPRESSED)
774                         fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
775                 strlcpy(fmt->description, format->name,
776                         sizeof fmt->description);
777                 fmt->description[sizeof fmt->description - 1] = 0;
778                 fmt->pixelformat = format->fcc;
779                 break;
780         }
781
782         case VIDIOC_TRY_FMT:
783         {
784                 struct uvc_streaming_control probe;
785
786                 return uvc_v4l2_try_format(stream, arg, &probe, NULL, NULL);
787         }
788
789         case VIDIOC_S_FMT:
790                 if ((ret = uvc_acquire_privileges(handle)) < 0)
791                         return ret;
792
793                 return uvc_v4l2_set_format(stream, arg);
794
795         case VIDIOC_G_FMT:
796                 return uvc_v4l2_get_format(stream, arg);
797
798         /* Frame size enumeration */
799         case VIDIOC_ENUM_FRAMESIZES:
800         {
801                 struct v4l2_frmsizeenum *fsize = arg;
802                 struct uvc_format *format = NULL;
803                 struct uvc_frame *frame;
804                 int i;
805
806                 /* Look for the given pixel format */
807                 for (i = 0; i < stream->nformats; i++) {
808                         if (stream->format[i].fcc ==
809                                         fsize->pixel_format) {
810                                 format = &stream->format[i];
811                                 break;
812                         }
813                 }
814                 if (format == NULL)
815                         return -EINVAL;
816
817                 if (fsize->index >= format->nframes)
818                         return -EINVAL;
819
820                 frame = &format->frame[fsize->index];
821                 fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
822                 fsize->discrete.width = frame->wWidth;
823                 fsize->discrete.height = frame->wHeight;
824                 break;
825         }
826
827         /* Frame interval enumeration */
828         case VIDIOC_ENUM_FRAMEINTERVALS:
829         {
830                 struct v4l2_frmivalenum *fival = arg;
831                 struct uvc_format *format = NULL;
832                 struct uvc_frame *frame = NULL;
833                 int i;
834
835                 /* Look for the given pixel format and frame size */
836                 for (i = 0; i < stream->nformats; i++) {
837                         if (stream->format[i].fcc ==
838                                         fival->pixel_format) {
839                                 format = &stream->format[i];
840                                 break;
841                         }
842                 }
843                 if (format == NULL)
844                         return -EINVAL;
845
846                 for (i = 0; i < format->nframes; i++) {
847                         if (format->frame[i].wWidth == fival->width &&
848                             format->frame[i].wHeight == fival->height) {
849                                 frame = &format->frame[i];
850                                 break;
851                         }
852                 }
853                 if (frame == NULL)
854                         return -EINVAL;
855
856                 if (frame->bFrameIntervalType) {
857                         if (fival->index >= frame->bFrameIntervalType)
858                                 return -EINVAL;
859
860                         fival->type = V4L2_FRMIVAL_TYPE_DISCRETE;
861                         fival->discrete.numerator =
862                                 frame->dwFrameInterval[fival->index];
863                         fival->discrete.denominator = 10000000;
864                         uvc_simplify_fraction(&fival->discrete.numerator,
865                                 &fival->discrete.denominator, 8, 333);
866                 } else {
867                         fival->type = V4L2_FRMIVAL_TYPE_STEPWISE;
868                         fival->stepwise.min.numerator =
869                                 frame->dwFrameInterval[0];
870                         fival->stepwise.min.denominator = 10000000;
871                         fival->stepwise.max.numerator =
872                                 frame->dwFrameInterval[1];
873                         fival->stepwise.max.denominator = 10000000;
874                         fival->stepwise.step.numerator =
875                                 frame->dwFrameInterval[2];
876                         fival->stepwise.step.denominator = 10000000;
877                         uvc_simplify_fraction(&fival->stepwise.min.numerator,
878                                 &fival->stepwise.min.denominator, 8, 333);
879                         uvc_simplify_fraction(&fival->stepwise.max.numerator,
880                                 &fival->stepwise.max.denominator, 8, 333);
881                         uvc_simplify_fraction(&fival->stepwise.step.numerator,
882                                 &fival->stepwise.step.denominator, 8, 333);
883                 }
884                 break;
885         }
886
887         /* Get & Set streaming parameters */
888         case VIDIOC_G_PARM:
889                 return uvc_v4l2_get_streamparm(stream, arg);
890
891         case VIDIOC_S_PARM:
892                 if ((ret = uvc_acquire_privileges(handle)) < 0)
893                         return ret;
894
895                 return uvc_v4l2_set_streamparm(stream, arg);
896
897         /* Cropping and scaling */
898         case VIDIOC_CROPCAP:
899         {
900                 struct v4l2_cropcap *ccap = arg;
901
902                 if (ccap->type != stream->type)
903                         return -EINVAL;
904
905                 ccap->bounds.left = 0;
906                 ccap->bounds.top = 0;
907
908                 mutex_lock(&stream->mutex);
909                 ccap->bounds.width = stream->cur_frame->wWidth;
910                 ccap->bounds.height = stream->cur_frame->wHeight;
911                 mutex_unlock(&stream->mutex);
912
913                 ccap->defrect = ccap->bounds;
914
915                 ccap->pixelaspect.numerator = 1;
916                 ccap->pixelaspect.denominator = 1;
917                 break;
918         }
919
920         case VIDIOC_G_CROP:
921         case VIDIOC_S_CROP:
922                 return -EINVAL;
923
924         /* Buffers & streaming */
925         case VIDIOC_REQBUFS:
926         {
927                 struct v4l2_requestbuffers *rb = arg;
928
929                 if (rb->type != stream->type ||
930                     rb->memory != V4L2_MEMORY_MMAP)
931                         return -EINVAL;
932
933                 if ((ret = uvc_acquire_privileges(handle)) < 0)
934                         return ret;
935
936                 mutex_lock(&stream->mutex);
937                 ret = uvc_alloc_buffers(&stream->queue, rb->count,
938                                         stream->ctrl.dwMaxVideoFrameSize);
939                 mutex_unlock(&stream->mutex);
940                 if (ret < 0)
941                         return ret;
942
943                 if (ret == 0)
944                         uvc_dismiss_privileges(handle);
945
946                 rb->count = ret;
947                 ret = 0;
948                 break;
949         }
950
951         case VIDIOC_QUERYBUF:
952         {
953                 struct v4l2_buffer *buf = arg;
954
955                 if (buf->type != stream->type)
956                         return -EINVAL;
957
958                 if (!uvc_has_privileges(handle))
959                         return -EBUSY;
960
961                 return uvc_query_buffer(&stream->queue, buf);
962         }
963
964         case VIDIOC_QBUF:
965                 if (!uvc_has_privileges(handle))
966                         return -EBUSY;
967
968                 return uvc_queue_buffer(&stream->queue, arg);
969
970         case VIDIOC_DQBUF:
971                 if (!uvc_has_privileges(handle))
972                         return -EBUSY;
973
974                 return uvc_dequeue_buffer(&stream->queue, arg,
975                         file->f_flags & O_NONBLOCK);
976
977         case VIDIOC_STREAMON:
978         {
979                 int *type = arg;
980
981                 if (*type != stream->type)
982                         return -EINVAL;
983
984                 if (!uvc_has_privileges(handle))
985                         return -EBUSY;
986
987                 mutex_lock(&stream->mutex);
988                 ret = uvc_video_enable(stream, 1);
989                 mutex_unlock(&stream->mutex);
990                 if (ret < 0)
991                         return ret;
992                 break;
993         }
994
995         case VIDIOC_STREAMOFF:
996         {
997                 int *type = arg;
998
999                 if (*type != stream->type)
1000                         return -EINVAL;
1001
1002                 if (!uvc_has_privileges(handle))
1003                         return -EBUSY;
1004
1005                 return uvc_video_enable(stream, 0);
1006         }
1007
1008         /* Analog video standards make no sense for digital cameras. */
1009         case VIDIOC_ENUMSTD:
1010         case VIDIOC_QUERYSTD:
1011         case VIDIOC_G_STD:
1012         case VIDIOC_S_STD:
1013
1014         case VIDIOC_OVERLAY:
1015
1016         case VIDIOC_ENUMAUDIO:
1017         case VIDIOC_ENUMAUDOUT:
1018
1019         case VIDIOC_ENUMOUTPUT:
1020                 uvc_trace(UVC_TRACE_IOCTL, "Unsupported ioctl 0x%08x\n", cmd);
1021                 return -EINVAL;
1022
1023         case UVCIOC_CTRL_MAP:
1024                 return uvc_ioctl_ctrl_map(chain, arg);
1025
1026         case UVCIOC_CTRL_QUERY:
1027                 return uvc_xu_ctrl_query(chain, arg);
1028
1029         default:
1030                 uvc_trace(UVC_TRACE_IOCTL, "Unknown ioctl 0x%08x\n", cmd);
1031                 return -EINVAL;
1032         }
1033
1034         return ret;
1035 }
1036
1037 static long uvc_v4l2_ioctl(struct file *file,
1038                      unsigned int cmd, unsigned long arg)
1039 {
1040         if (uvc_trace_param & UVC_TRACE_IOCTL) {
1041                 uvc_printk(KERN_DEBUG, "uvc_v4l2_ioctl(");
1042                 v4l_printk_ioctl(cmd);
1043                 printk(")\n");
1044         }
1045
1046         return video_usercopy(file, cmd, arg, uvc_v4l2_do_ioctl);
1047 }
1048
1049 static ssize_t uvc_v4l2_read(struct file *file, char __user *data,
1050                     size_t count, loff_t *ppos)
1051 {
1052         uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_read: not implemented.\n");
1053         return -EINVAL;
1054 }
1055
1056 static int uvc_v4l2_mmap(struct file *file, struct vm_area_struct *vma)
1057 {
1058         struct uvc_fh *handle = file->private_data;
1059         struct uvc_streaming *stream = handle->stream;
1060
1061         uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_mmap\n");
1062
1063         return uvc_queue_mmap(&stream->queue, vma);
1064 }
1065
1066 static unsigned int uvc_v4l2_poll(struct file *file, poll_table *wait)
1067 {
1068         struct uvc_fh *handle = file->private_data;
1069         struct uvc_streaming *stream = handle->stream;
1070
1071         uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_poll\n");
1072
1073         return uvc_queue_poll(&stream->queue, file, wait);
1074 }
1075
1076 #ifndef CONFIG_MMU
1077 static unsigned long uvc_v4l2_get_unmapped_area(struct file *file,
1078                 unsigned long addr, unsigned long len, unsigned long pgoff,
1079                 unsigned long flags)
1080 {
1081         struct uvc_fh *handle = file->private_data;
1082         struct uvc_streaming *stream = handle->stream;
1083
1084         uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_get_unmapped_area\n");
1085
1086         return uvc_queue_get_unmapped_area(&stream->queue, pgoff);
1087 }
1088 #endif
1089
1090 const struct v4l2_file_operations uvc_fops = {
1091         .owner          = THIS_MODULE,
1092         .open           = uvc_v4l2_open,
1093         .release        = uvc_v4l2_release,
1094         .unlocked_ioctl = uvc_v4l2_ioctl,
1095         .read           = uvc_v4l2_read,
1096         .mmap           = uvc_v4l2_mmap,
1097         .poll           = uvc_v4l2_poll,
1098 #ifndef CONFIG_MMU
1099         .get_unmapped_area = uvc_v4l2_get_unmapped_area,
1100 #endif
1101 };
1102