V4L/DVB (8352): gspca: Buffers for USB exchanges cannot be in the stack.

gspca:    Protect dq_callback() against simultaneous USB exchanges.
          Temporary buffer for USB exchanges added in the device struct.
(all)     Use a temporary buffer for all USB exchanges.
Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

drivers/media/video/gspca/gspca.c

@@ -1347,9 +1347,11 @@ static int frame_wait(struct gspca_dev *gspca_dev,
 		gspca_dev->fr_i,
 		gspca_dev->fr_o);
 
-	if (gspca_dev->sd_desc->dq_callback)
+	if (gspca_dev->sd_desc->dq_callback) {
+		mutex_lock(&gspca_dev->usb_lock);
 		gspca_dev->sd_desc->dq_callback(gspca_dev);
-
+		mutex_unlock(&gspca_dev->usb_lock);
+	}
 	return j;
 }
 

drivers/media/video/gspca/gspca.h

@@ -125,6 +125,7 @@ struct gspca_dev {
 	struct cam cam;				/* device information */
 	const struct sd_desc *sd_desc;		/* subdriver description */
 
+	__u8 usb_buf[8];			/* buffer for USB exchanges */
 	struct urb *urb[MAX_NURBS];
 
 	__u8 *frbuf;				/* buffer for nframes */

drivers/media/video/gspca/mars.c

@@ -24,8 +24,8 @@
 #include "gspca.h"
 #include "jpeg.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/Mars USB Camera Driver");
@@ -83,39 +83,53 @@ enum {
 	REG_HW_MI_63,
 	REG_HW_MI_64,
 	REG_HW_MI_F1 = 0xf1,
-	ATTR_TOTAL_MI_REG = 242
+	ATTR_TOTAL_MI_REG = 0xf2
 };
 
-static int pcam_reg_write(struct usb_device *dev,
-			  __u16 index, __u8 *value, int len)
+/* the bytes to write are in gspca_dev->usb_buf */
+static int reg_w(struct gspca_dev *gspca_dev,
+		 __u16 index, int len)
 {
 	int rc;
 
-	rc = usb_control_msg(dev,
-			 usb_sndbulkpipe(dev, 4),
+	rc = usb_control_msg(gspca_dev->dev,
+			 usb_sndbulkpipe(gspca_dev->dev, 4),
 			 0x12,
-/*		?? 0xc8 = USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_??? !? */
-			 0xc8,
+			 0xc8,		/* ?? */
 			 0,		/* value */
-			 index, value, len, 500);
+			 index, gspca_dev->usb_buf, len, 500);
 	if (rc < 0)
 		PDEBUG(D_ERR, "reg write [%02x] error %d", index, rc);
 	return rc;
 }
 
-static void MISensor_BulkWrite(struct usb_device *dev,
-				unsigned short *pch,
-				char Address)
+static int reg_w_buf(struct gspca_dev *gspca_dev,
+			__u16 index, __u8 *buf, int len)
 {
-	__u8 data[6];
+	int rc;
+
+	rc = usb_control_msg(gspca_dev->dev,
+			 usb_sndbulkpipe(gspca_dev->dev, 4),
+			 0x12,
+			 0xc8,		/* ?? */
+			 0,		/* value */
+			 index, buf, len, 500);
+	if (rc < 0)
+		PDEBUG(D_ERR, "reg write [%02x] error %d", index, rc);
+	return rc;
+}
 
-	data[0] = 0x1f;
-	data[1] = 0;			/* control byte */
-	data[2] = Address;
-	data[3] = *pch >> 8;		/* high byte */
-	data[4] = *pch;			/* low byte */
+static void bulk_w(struct gspca_dev *gspca_dev,
+		   __u16 *pch,
+		   __u16 Address)
+{
+	gspca_dev->usb_buf[0] = 0x1f;
+	gspca_dev->usb_buf[1] = 0;			/* control byte */
+	gspca_dev->usb_buf[2] = Address;
+	gspca_dev->usb_buf[3] = *pch >> 8;		/* high byte */
+	gspca_dev->usb_buf[4] = *pch;			/* low byte */
 
-	pcam_reg_write(dev, Address, data, 5);
+	reg_w(gspca_dev, Address, 5);
 }
 
 /* this function is called at probe time */
@@ -142,33 +156,30 @@ static int sd_open(struct gspca_dev *gspca_dev)
 
 static void sd_start(struct gspca_dev *gspca_dev)
 {
-	struct usb_device *dev = gspca_dev->dev;
 	int err_code;
-	__u8 data[12];
-	__u16 MI_buf[242];
+	__u8 *data;
+	__u16 *MI_buf;
 	int h_size, v_size;
 	int intpipe;
-/*	struct usb_device *dev = pcam->dev; */
-
-	memset(data, 0, sizeof data);
-	memset(MI_buf, 0, sizeof MI_buf);
 
 	PDEBUG(D_STREAM, "camera start, iface %d, alt 8", gspca_dev->iface);
-	if (usb_set_interface(dev, gspca_dev->iface, 8) < 0) {
+	if (usb_set_interface(gspca_dev->dev, gspca_dev->iface, 8) < 0) {
 		PDEBUG(D_ERR|D_STREAM, "Set packet size: set interface error");
 		return;
 	}
 
+	data = gspca_dev->usb_buf;
 	data[0] = 0x01;		/* address */
 	data[1] = 0x01;
 
-	err_code = pcam_reg_write(dev, data[0], data, 2);
+	err_code = reg_w(gspca_dev, data[0], 2);
 	if (err_code < 0)
 		return;
 
 	/*
 	   Initialize the MR97113 chip register
 	 */
+	data = kmalloc(16, GFP_KERNEL);
 	data[0] = 0x00;		/* address */
 	data[1] = 0x0c | 0x01;	/* reg 0 */
 	data[2] = 0x01;		/* reg 1 */
@@ -181,34 +192,34 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	data[6] = 4;		/* reg 5, H start */
 	data[7] = 0xc0;		/* reg 6, gamma 1.5 */
 	data[8] = 3;		/* reg 7, V start */
-/*	if(h_size == 320 ) */
+/*	if (h_size == 320 ) */
 /*		data[9]= 0x56;	 * reg 8, 24MHz, 2:1 scale down */
 /*	else */
 	data[9] = 0x52;		/* reg 8, 24MHz, no scale down */
 	data[10] = 0x5d;	/* reg 9, I2C device address
 				 *	[for PAS5101 (0x40)] [for MI (0x5d)] */
 
-	err_code = pcam_reg_write(dev, data[0], data, 11);
+	err_code = reg_w_buf(gspca_dev, data[0], data, 11);
+	kfree(data);
 	if (err_code < 0)
 		return;
 
+	data = gspca_dev->usb_buf;
 	data[0] = 0x23;		/* address */
 	data[1] = 0x09;		/* reg 35, append frame header */
 
-	err_code = pcam_reg_write(dev, data[0], data, 2);
-	if (err_code < 0) {
-		PDEBUG(D_ERR, "Register write failed");
+	err_code = reg_w(gspca_dev, data[0], 2);
+	if (err_code < 0)
 		return;
-	}
 
-	data[0] = 0x3C;		/* address */
-/*	if (pcam->width == 1280) */
+	data[0] = 0x3c;		/* address */
+/*	if (gspca_dev->width == 1280) */
 /*		data[1] = 200;	 * reg 60, pc-cam frame size
 				 *	(unit: 4KB) 800KB */
 /*	else */
 	data[1] = 50;		/* 50 reg 60, pc-cam frame size
 				 *	(unit: 4KB) 200KB */
-	err_code = pcam_reg_write(dev, data[0], data, 2);
+	err_code = reg_w(gspca_dev, data[0], 2);
 	if (err_code < 0)
 		return;
 
@@ -250,19 +261,20 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	/* auto dark-gain */
 	data[0] = 0x5e;		/* address */
 
-	err_code = pcam_reg_write(dev, data[0], data, 6);
+	err_code = reg_w(gspca_dev, data[0], 6);
 	if (err_code < 0)
 		return;
 
 	data[0] = 0x67;
 	data[1] = 0x13;		/* reg 103, first pixel B, disable sharpness */
-	err_code = pcam_reg_write(dev, data[0], data, 2);
+	err_code = reg_w(gspca_dev, data[0], 2);
 	if (err_code < 0)
 		return;
 
 	/*
 	 * initialize the value of MI sensor...
 	 */
+	MI_buf = kzalloc(ATTR_TOTAL_MI_REG * sizeof *MI_buf, GFP_KERNEL);
 	MI_buf[REG_HW_MI_1] = 0x000a;
 	MI_buf[REG_HW_MI_2] = 0x000c;
 	MI_buf[REG_HW_MI_3] = 0x0405;
@@ -304,48 +316,48 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	}
 	MI_buf[0x20] = 0x1104;
 
-	MISensor_BulkWrite(dev, MI_buf + 1, 1);
-	MISensor_BulkWrite(dev, MI_buf + 2, 2);
-	MISensor_BulkWrite(dev, MI_buf + 3, 3);
-	MISensor_BulkWrite(dev, MI_buf + 4, 4);
-	MISensor_BulkWrite(dev, MI_buf + 5, 5);
-	MISensor_BulkWrite(dev, MI_buf + 6, 6);
-	MISensor_BulkWrite(dev, MI_buf + 7, 7);
-	MISensor_BulkWrite(dev, MI_buf + 9, 9);
-	MISensor_BulkWrite(dev, MI_buf + 0x0b, 0x0b);
-	MISensor_BulkWrite(dev, MI_buf + 0x0c, 0x0c);
-	MISensor_BulkWrite(dev, MI_buf + 0x0d, 0x0d);
-	MISensor_BulkWrite(dev, MI_buf + 0x1e, 0x1e);
-	MISensor_BulkWrite(dev, MI_buf + 0x20, 0x20);
-	MISensor_BulkWrite(dev, MI_buf + 0x2b, 0x2b);
-	MISensor_BulkWrite(dev, MI_buf + 0x2c, 0x2c);
-	MISensor_BulkWrite(dev, MI_buf + 0x2d, 0x2d);
-	MISensor_BulkWrite(dev, MI_buf + 0x2e, 0x2e);
-	MISensor_BulkWrite(dev, MI_buf + 0x35, 0x35);
-	MISensor_BulkWrite(dev, MI_buf + 0x5f, 0x5f);
-	MISensor_BulkWrite(dev, MI_buf + 0x60, 0x60);
-	MISensor_BulkWrite(dev, MI_buf + 0x61, 0x61);
-	MISensor_BulkWrite(dev, MI_buf + 0x62, 0x62);
-	MISensor_BulkWrite(dev, MI_buf + 0x63, 0x63);
-	MISensor_BulkWrite(dev, MI_buf + 0x64, 0x64);
-	MISensor_BulkWrite(dev, MI_buf + 0xf1, 0xf1);
-
-	intpipe = usb_sndintpipe(dev, 0);
-	err_code = usb_clear_halt(dev, intpipe);
+	bulk_w(gspca_dev, MI_buf + 1, 1);
+	bulk_w(gspca_dev, MI_buf + 2, 2);
+	bulk_w(gspca_dev, MI_buf + 3, 3);
+	bulk_w(gspca_dev, MI_buf + 4, 4);
+	bulk_w(gspca_dev, MI_buf + 5, 5);
+	bulk_w(gspca_dev, MI_buf + 6, 6);
+	bulk_w(gspca_dev, MI_buf + 7, 7);
+	bulk_w(gspca_dev, MI_buf + 9, 9);
+	bulk_w(gspca_dev, MI_buf + 0x0b, 0x0b);
+	bulk_w(gspca_dev, MI_buf + 0x0c, 0x0c);
+	bulk_w(gspca_dev, MI_buf + 0x0d, 0x0d);
+	bulk_w(gspca_dev, MI_buf + 0x1e, 0x1e);
+	bulk_w(gspca_dev, MI_buf + 0x20, 0x20);
+	bulk_w(gspca_dev, MI_buf + 0x2b, 0x2b);
+	bulk_w(gspca_dev, MI_buf + 0x2c, 0x2c);
+	bulk_w(gspca_dev, MI_buf + 0x2d, 0x2d);
+	bulk_w(gspca_dev, MI_buf + 0x2e, 0x2e);
+	bulk_w(gspca_dev, MI_buf + 0x35, 0x35);
+	bulk_w(gspca_dev, MI_buf + 0x5f, 0x5f);
+	bulk_w(gspca_dev, MI_buf + 0x60, 0x60);
+	bulk_w(gspca_dev, MI_buf + 0x61, 0x61);
+	bulk_w(gspca_dev, MI_buf + 0x62, 0x62);
+	bulk_w(gspca_dev, MI_buf + 0x63, 0x63);
+	bulk_w(gspca_dev, MI_buf + 0x64, 0x64);
+	bulk_w(gspca_dev, MI_buf + 0xf1, 0xf1);
+	kfree(MI_buf);
+
+	intpipe = usb_sndintpipe(gspca_dev->dev, 0);
+	err_code = usb_clear_halt(gspca_dev->dev, intpipe);
 
 	data[0] = 0x00;
 	data[1] = 0x4d;		/* ISOC transfering enable... */
-	pcam_reg_write(dev, data[0], data, 2);
+	reg_w(gspca_dev, data[0], 2);
 }
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
 	int result;
-	__u8 data[2];
 
-	data[0] = 1;
-	data[1] = 0;
-	result = pcam_reg_write(gspca_dev->dev, data[0], data, 2);
+	gspca_dev->usb_buf[0] = 1;
+	gspca_dev->usb_buf[1] = 0;
+	result = reg_w(gspca_dev, gspca_dev->usb_buf[0], 2);
 	if (result < 0)
 		PDEBUG(D_ERR, "Camera Stop failed");
 }

drivers/media/video/gspca/ov519.c

@@ -24,8 +24,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Jean-Francois Moine <http://moinejf.free.fr>");
 MODULE_DESCRIPTION("OV519 USB Camera Driver");
@@ -282,15 +282,14 @@ static unsigned char ov7670_abs_to_sm(unsigned char v)
 static int reg_w(struct sd *sd, __u16 index, __u8 value)
 {
 	int ret;
-	__u8 data;
 
-	data = value;
+	sd->gspca_dev.usb_buf[0] = value;
 	ret = usb_control_msg(sd->gspca_dev.dev,
 			usb_sndctrlpipe(sd->gspca_dev.dev, 0),
 			1,			/* REQ_IO (ov518/519) */
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0, index,
-			&data, 1, 500);
+			sd->gspca_dev.usb_buf, 1, 500);
 	if (ret < 0)
 		PDEBUG(D_ERR, "Write reg [%02x] %02x failed", index, value);
 	return ret;
@@ -301,16 +300,15 @@ static int reg_w(struct sd *sd, __u16 index, __u8 value)
 static int reg_r(struct sd *sd, __u16 index)
 {
 	int ret;
-	__u8 data;
 
 	ret = usb_control_msg(sd->gspca_dev.dev,
 			usb_rcvctrlpipe(sd->gspca_dev.dev, 0),
 			1,			/* REQ_IO */
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			0, index, &data, 1, 500);
+			0, index, sd->gspca_dev.usb_buf, 1, 500);
 
 	if (ret >= 0)
-		ret = data;
+		ret = sd->gspca_dev.usb_buf[0];
 	else
 		PDEBUG(D_ERR, "Read reg [0x%02x] failed", index);
 	return ret;
@@ -321,16 +319,15 @@ static int reg_r8(struct sd *sd,
 		  __u16 index)
 {
 	int ret;
-	__u8 buf[8];
 
 	ret = usb_control_msg(sd->gspca_dev.dev,
 			usb_rcvctrlpipe(sd->gspca_dev.dev, 0),
 			1,			/* REQ_IO */
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			0, index, &buf[0], 8, 500);
+			0, index, sd->gspca_dev.usb_buf, 8, 500);
 
 	if (ret >= 0)
-		ret = buf[0];
+		ret = sd->gspca_dev.usb_buf[0];
 	else
 		PDEBUG(D_ERR, "Read reg 8 [0x%02x] failed", index);
 	return ret;

drivers/media/video/gspca/pac207.c

@@ -27,8 +27,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Hans de Goede <j.w.r.degoede@hhs.nl>");
 MODULE_DESCRIPTION("Pixart PAC207");
@@ -187,18 +187,18 @@ static const __u8 PacReg72[] = { 0x00, 0x00, 0x36, 0x00 };
 static const unsigned char pac207_sof_marker[5] =
 		{ 0xff, 0xff, 0x00, 0xff, 0x96 };
 
-int pac207_write_regs(struct gspca_dev *gspca_dev, u16 index,
+static int pac207_write_regs(struct gspca_dev *gspca_dev, u16 index,
 	const u8 *buffer, u16 length)
 {
 	struct usb_device *udev = gspca_dev->dev;
 	int err;
-	u8 kbuf[8];
 
-	memcpy(kbuf, buffer, length);
+	memcpy(gspca_dev->usb_buf, buffer, length);
 
 	err = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x01,
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-			0x00, index, kbuf, length, PAC207_CTRL_TIMEOUT);
+			0x00, index,
+			gspca_dev->usb_buf, length, PAC207_CTRL_TIMEOUT);
 	if (err < 0)
 		PDEBUG(D_ERR,
 			"Failed to write registers to index 0x%04X, error %d)",
@@ -227,12 +227,12 @@ int pac207_write_reg(struct gspca_dev *gspca_dev, u16 index, u16 value)
 int pac207_read_reg(struct gspca_dev *gspca_dev, u16 index)
 {
 	struct usb_device *udev = gspca_dev->dev;
-	u8 buff;
 	int res;
 
 	res = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x00,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-			0x00, index, &buff, 1, PAC207_CTRL_TIMEOUT);
+			0x00, index,
+			gspca_dev->usb_buf, 1, PAC207_CTRL_TIMEOUT);
 	if (res < 0) {
 		PDEBUG(D_ERR,
 			"Failed to read a register (index 0x%04X, error %d)",
@@ -240,10 +240,9 @@ int pac207_read_reg(struct gspca_dev *gspca_dev, u16 index)
 		return res;
 	}
 
-	return buff;
+	return gspca_dev->usb_buf[0];
 }
 
-
 /* this function is called at probe time */
 static int sd_config(struct gspca_dev *gspca_dev,
 			const struct usb_device_id *id)

drivers/media/video/gspca/spca501.c

@@ -23,8 +23,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/SPCA501 USB Camera Driver");
@@ -1826,28 +1826,27 @@ static int reg_write(struct usb_device *dev,
 }
 
 /* returns: negative is error, pos or zero is data */
-static int reg_read(struct usb_device *dev,
+static int reg_read(struct gspca_dev *gspca_dev,
 			__u16 req,	/* bRequest */
 			__u16 index,	/* wIndex */
 			__u16 length)	/* wLength (1 or 2 only) */
 {
 	int ret;
-	__u8 buf[2];
 
-	buf[1] = 0;
-	ret = usb_control_msg(dev,
-			usb_rcvctrlpipe(dev, 0),
+	gspca_dev->usb_buf[1] = 0;
+	ret = usb_control_msg(gspca_dev->dev,
+			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			req,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0,		/* value */
 			index,
-			buf, length,
+			gspca_dev->usb_buf, length,
 			500);			/* timeout */
 	if (ret < 0) {
 		PDEBUG(D_ERR, "reg_read err %d", ret);
 		return -1;
 	}
-	return (buf[1] << 8) + buf[0];
+	return (gspca_dev->usb_buf[1] << 8) + gspca_dev->usb_buf[0];
 }
 
 static int write_vector(struct gspca_dev *gspca_dev,
@@ -1883,7 +1882,7 @@ static void getbrightness(struct gspca_dev *gspca_dev)
 	struct sd *sd = (struct sd *) gspca_dev;
 	__u16 brightness;
 
-	brightness = reg_read(gspca_dev->dev, SPCA501_REG_CCDSP, 0x11, 2);
+	brightness = reg_read(gspca_dev, SPCA501_REG_CCDSP, 0x11, 2);
 	sd->brightness = brightness << 1;
 }
 
@@ -1913,8 +1912,8 @@ static void getcolors(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
-	sd->colors = reg_read(gspca_dev->dev, SPCA501_REG_CCDSP, 0x0c, 2);
-/*	sd->hue = (reg_read(gspca_dev->dev, SPCA501_REG_CCDSP, 0x13, */
+	sd->colors = reg_read(gspca_dev, SPCA501_REG_CCDSP, 0x0c, 2);
+/*	sd->hue = (reg_read(gspca_dev, SPCA501_REG_CCDSP, 0x13, */
 /*			2) & 0xFF) << 8; */
 }
 

drivers/media/video/gspca/spca505.c

@@ -23,8 +23,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/SPCA505 USB Camera Driver");
@@ -593,29 +593,27 @@ static int reg_write(struct usb_device *dev,
 }
 
 /* returns: negative is error, pos or zero is data */
-static int reg_read(struct usb_device *dev,
+static int reg_read(struct gspca_dev *gspca_dev,
 			__u16 reg,	/* bRequest */
 			__u16 index,	/* wIndex */
 			__u16 length)	/* wLength (1 or 2 only) */
 {
 	int ret;
-	__u8 buf[4];
 
-	buf[1] = 0;
-	ret = usb_control_msg(dev,
-			usb_rcvctrlpipe(dev, 0),
+	gspca_dev->usb_buf[1] = 0;
+	ret = usb_control_msg(gspca_dev->dev,
+			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			reg,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			(__u16) 0,		/* value */
 			(__u16) index,
-			buf,
-			length,
+			gspca_dev->usb_buf, length,
 			500);			/* timeout */
 	if (ret < 0) {
 		PDEBUG(D_ERR, "reg_read err %d", ret);
 		return -1;
 	}
-	return (buf[1] << 8) + buf[0];
+	return (gspca_dev->usb_buf[1] << 8) + gspca_dev->usb_buf[0];
 }
 
 static int write_vector(struct gspca_dev *gspca_dev,
@@ -697,7 +695,7 @@ static int sd_open(struct gspca_dev *gspca_dev)
 		write_vector(gspca_dev, spca505b_open_data_ccd);
 	else
 		write_vector(gspca_dev, spca505_open_data_ccd);
-	ret = reg_read(gspca_dev->dev, 6, 0x16, 2);
+	ret = reg_read(gspca_dev, 6, 0x16, 2);
 
 	if (ret < 0) {
 		PDEBUG(D_ERR|D_STREAM,
@@ -874,8 +872,8 @@ static void getbrightness(struct gspca_dev *gspca_dev)
 	struct sd *sd = (struct sd *) gspca_dev;
 
 	sd->brightness = 255
-		- ((reg_read(gspca_dev->dev, 5, 0x01, 1) >> 2)
-			+ (reg_read(gspca_dev->dev, 5, 0x0, 1) << 6));
+		- ((reg_read(gspca_dev, 5, 0x01, 1) >> 2)
+			+ (reg_read(gspca_dev, 5, 0x0, 1) << 6));
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)

drivers/media/video/gspca/spca506.c

@@ -25,8 +25,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/SPCA506 USB Camera Driver");
@@ -153,17 +153,18 @@ static struct v4l2_pix_format vga_mode[] = {
 #define SAA7113_hue 0x0d	/* defaults 0x00 */
 #define SAA7113_I2C_BASE_WRITE 0x4a
 
-static void reg_r(struct usb_device *dev,
+/* read 'len' bytes to gspca_dev->usb_buf */
+static void reg_r(struct gspca_dev *gspca_dev,
 		  __u16 req,
 		  __u16 index,
-		  __u8 *buffer, __u16 length)
+		  __u16 length)
 {
-	usb_control_msg(dev,
-			usb_rcvctrlpipe(dev, 0),
+	usb_control_msg(gspca_dev->dev,
+			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			req,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0,		/* value */
-			index, buffer, length,
+			index, gspca_dev->usb_buf, length,
 			500);
 }
 
@@ -189,13 +190,12 @@ static void spca506_WriteI2c(struct gspca_dev *gspca_dev, __u16 valeur,
 			     __u16 reg)
 {
 	int retry = 60;
-	__u8 Data[2];
 
 	reg_w(gspca_dev->dev, 0x07, reg, 0x0001);
 	reg_w(gspca_dev->dev, 0x07, valeur, 0x0000);
 	while (retry--) {
-		reg_r(gspca_dev->dev, 0x07, 0x0003, Data, 2);
-		if ((Data[0] | Data[1]) == 0x00)
+		reg_r(gspca_dev, 0x07, 0x0003, 2);
+		if ((gspca_dev->usb_buf[0] | gspca_dev->usb_buf[1]) == 0x00)
 			break;
 	}
 }
@@ -203,21 +203,19 @@ static void spca506_WriteI2c(struct gspca_dev *gspca_dev, __u16 valeur,
 static int spca506_ReadI2c(struct gspca_dev *gspca_dev, __u16 reg)
 {
 	int retry = 60;
-	__u8 Data[2];
-	__u8 value;
 
 	reg_w(gspca_dev->dev, 0x07, SAA7113_I2C_BASE_WRITE, 0x0004);
 	reg_w(gspca_dev->dev, 0x07, reg, 0x0001);
 	reg_w(gspca_dev->dev, 0x07, 0x01, 0x0002);
 	while (--retry) {
-		reg_r(gspca_dev->dev, 0x07, 0x0003, Data, 2);
-		if ((Data[0] | Data[1]) == 0x00)
+		reg_r(gspca_dev, 0x07, 0x0003, 2);
+		if ((gspca_dev->usb_buf[0] | gspca_dev->usb_buf[1]) == 0x00)
 			break;
 	}
 	if (retry == 0)
 		return -1;
-	reg_r(gspca_dev->dev, 0x07, 0x0000, &value, 1);
-	return value;
+	reg_r(gspca_dev, 0x07, 0x0000, 1);
+	return gspca_dev->usb_buf[0];
 }
 
 static void spca506_SetNormeInput(struct gspca_dev *gspca_dev,
@@ -437,7 +435,6 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	struct usb_device *dev = gspca_dev->dev;
 	__u16 norme;
 	__u16 channel;
-	__u8 Data[2];
 
 	/**************************************/
 	reg_w(dev, 0x03, 0x00, 0x0004);
@@ -555,8 +552,8 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	/* compress setting and size */
 	/* set i2c luma */
 	reg_w(dev, 0x02, 0x01, 0x0000);
-	reg_w(dev, 0x03, 0x12, 0x000);
-	reg_r(dev, 0x04, 0x0001, Data, 2);
+	reg_w(dev, 0x03, 0x12, 0x0000);
+	reg_r(gspca_dev, 0x04, 0x0001, 2);
 	PDEBUG(D_STREAM, "webcam started");
 	spca506_GetNormeInput(gspca_dev, &norme, &channel);
 	spca506_SetNormeInput(gspca_dev, norme, channel);

drivers/media/video/gspca/spca508.c

@@ -22,8 +22,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/SPCA508 USB Camera Driver");
@@ -1433,26 +1433,26 @@ static int reg_write(struct usb_device *dev,
 
 /* read 1 byte */
 /* returns: negative is error, pos or zero is data */
-static int reg_read(struct usb_device *dev,
+static int reg_read(struct gspca_dev *gspca_dev,
 			__u16 index)	/* wIndex */
 {
 	int ret;
-	__u8 data;
 
-	ret = usb_control_msg(dev,
-			usb_rcvctrlpipe(dev, 0),
+	ret = usb_control_msg(gspca_dev->dev,
+			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			0,			/* register */
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			(__u16) 0,		/* value */
+			0,		/* value */
 			index,
-			&data, 1,
+			gspca_dev->usb_buf, 1,
 			500);			/* timeout */
-	PDEBUG(D_USBI, "reg read i:%04x --> %02x", index, data);
+	PDEBUG(D_USBI, "reg read i:%04x --> %02x",
+		index, gspca_dev->usb_buf[0]);
 	if (ret < 0) {
 		PDEBUG(D_ERR|D_USBI, "reg_read err %d", ret);
 		return ret;
 	}
-	return data;
+	return gspca_dev->usb_buf[0];
 }
 
 static int write_vector(struct gspca_dev *gspca_dev,
@@ -1475,15 +1475,12 @@ static int sd_config(struct gspca_dev *gspca_dev,
 			const struct usb_device_id *id)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	struct cam *cam;
-	__u16 vendor;
 	__u16 product;
 	int data1, data2;
 
-	vendor = id->idVendor;
 	product = id->idProduct;
-	switch (vendor) {
+	switch (id->idVendor) {
 	case 0x0130:		/* Clone webcam */
 /*		switch (product) { */
 /*		case 0x0130: */
@@ -1535,15 +1532,15 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	 * prove that we can communicate with the device.  This works, which
 	 * confirms at we are communicating properly and that the device
 	 * is a 508. */
-	data1 = reg_read(dev, 0x8104);
-	data2 = reg_read(dev, 0x8105);
+	data1 = reg_read(gspca_dev, 0x8104);
+	data2 = reg_read(gspca_dev, 0x8105);
 	PDEBUG(D_PROBE, "Webcam Vendor ID: 0x%02x%02x", data2, data1);
 
-	data1 = reg_read(dev, 0x8106);
-	data2 = reg_read(dev, 0x8107);
+	data1 = reg_read(gspca_dev, 0x8106);
+	data2 = reg_read(gspca_dev, 0x8107);
 	PDEBUG(D_PROBE, "Webcam Product ID: 0x%02x%02x", data2, data1);
 
-	data1 = reg_read(dev, 0x8621);
+	data1 = reg_read(gspca_dev, 0x8621);
 	PDEBUG(D_PROBE, "Window 1 average luminance: %d", data1);
 
 	cam = &gspca_dev->cam;
@@ -1711,7 +1708,7 @@ static void getbrightness(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
-	sd->brightness = reg_read(gspca_dev->dev, 0x8651);
+	sd->brightness = reg_read(gspca_dev, 0x8651);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)

drivers/media/video/gspca/spca561.c

@@ -24,8 +24,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/SPCA561 USB Camera Driver");
@@ -177,27 +177,28 @@ static void write_vector(struct gspca_dev *gspca_dev,
 	}
 }
 
-static void reg_r(struct usb_device *dev,
-		  __u16 index, __u8 *buffer, __u16 length)
+/* read 'len' bytes to gspca_dev->usb_buf */
+static void reg_r(struct gspca_dev *gspca_dev,
+		  __u16 index, __u16 length)
 {
-	usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+	usb_control_msg(gspca_dev->dev,
+			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			0,			/* request */
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0,			/* value */
-			index, buffer, length, 500);
+			index, gspca_dev->usb_buf, length, 500);
 }
 
-static void reg_w_buf(struct usb_device *dev,
+static void reg_w_buf(struct gspca_dev *gspca_dev,
 		      __u16 index, const __u8 *buffer, __u16 len)
 {
-	__u8 tmpbuf[8];
-
-	memcpy(tmpbuf, buffer, len);
-	usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+	memcpy(gspca_dev->usb_buf, buffer, len);
+	usb_control_msg(gspca_dev->dev,
+			usb_sndctrlpipe(gspca_dev->dev, 0),
 			0,			/* request */
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0,			/* value */
-			index, tmpbuf, len, 500);
+			index, gspca_dev->usb_buf, len, 500);
 }
 
 static void i2c_init(struct gspca_dev *gspca_dev, __u8 mode)
@@ -211,7 +212,6 @@ static void i2c_write(struct gspca_dev *gspca_dev, __u16 valeur, __u16 reg)
 	int retry = 60;
 	__u8 DataLow;
 	__u8 DataHight;
-	__u8 Data;
 
 	DataLow = valeur;
 	DataHight = valeur >> 8;
@@ -219,8 +219,8 @@ static void i2c_write(struct gspca_dev *gspca_dev, __u16 valeur, __u16 reg)
 	reg_w_val(gspca_dev->dev, DataLow, 0x8805);
 	reg_w_val(gspca_dev->dev, DataHight, 0x8800);
 	while (retry--) {
-		reg_r(gspca_dev->dev, 0x8803, &Data, 1);
-		if (!Data)
+		reg_r(gspca_dev, 0x8803, 1);
+		if (!gspca_dev->usb_buf[0])
 			break;
 	}
 }
@@ -230,20 +230,21 @@ static int i2c_read(struct gspca_dev *gspca_dev, __u16 reg, __u8 mode)
 	int retry = 60;
 	__u8 value;
 	__u8 vallsb;
-	__u8 Data;
 
 	reg_w_val(gspca_dev->dev, 0x92, 0x8804);
 	reg_w_val(gspca_dev->dev, reg, 0x8801);
 	reg_w_val(gspca_dev->dev, (mode | 0x01), 0x8802);
 	while (retry--) {
-		reg_r(gspca_dev->dev, 0x8803, &Data, 1);
-		if (!Data)
+		reg_r(gspca_dev, 0x8803, 1);
+		if (!gspca_dev->usb_buf)
 			break;
 	}
 	if (retry == 0)
 		return -1;
-	reg_r(gspca_dev->dev, 0x8800, &value, 1);
-	reg_r(gspca_dev->dev, 0x8805, &vallsb, 1);
+	reg_r(gspca_dev, 0x8800, 1);
+	value = gspca_dev->usb_buf[0];
+	reg_r(gspca_dev, 0x8805, 1);
+	vallsb = gspca_dev->usb_buf[0];
 	return ((int) value << 8) | vallsb;
 }
 
@@ -541,7 +542,7 @@ static void sensor_mapwrite(struct gspca_dev *gspca_dev,
 	while (sensormap[i][0]) {
 		usbval[0] = sensormap[i][1];
 		usbval[1] = sensormap[i][1] >> 8;
-		reg_w_buf(gspca_dev->dev, sensormap[i][0], usbval, 2);
+		reg_w_buf(gspca_dev, sensormap[i][0], usbval, 2);
 		i++;
 	}
 }
@@ -559,7 +560,6 @@ static int sd_config(struct gspca_dev *gspca_dev,
 		     const struct usb_device_id *id)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	struct cam *cam;
 	__u16 vendor, product;
 	__u8 data1, data2;
@@ -568,11 +568,15 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	 * prove that we can communicate with the device.  This works, which
 	 * confirms at we are communicating properly and that the device
 	 * is a 561. */
-	reg_r(dev, 0x8104, &data1, 1);
-	reg_r(dev, 0x8105, &data2, 1);
+	reg_r(gspca_dev, 0x8104, 1);
+	data1 = gspca_dev->usb_buf[0];
+	reg_r(gspca_dev, 0x8105, 1);
+	data2 = gspca_dev->usb_buf[0];
 	vendor = (data2 << 8) | data1;
-	reg_r(dev, 0x8106, &data1, 1);
-	reg_r(dev, 0x8107, &data2, 1);
+	reg_r(gspca_dev, 0x8106, 1);
+	data1 = gspca_dev->usb_buf[0];
+	reg_r(gspca_dev, 0x8107, 1);
+	data2 = gspca_dev->usb_buf[0];
 	product = (data2 << 8) | data1;
 	if (vendor != id->idVendor || product != id->idProduct) {
 		PDEBUG(D_PROBE, "Bad vendor / product from device");
@@ -656,8 +660,8 @@ static void setcontrast(struct gspca_dev *gspca_dev)
 		Reg8391[0] = expotimes & 0xff;	/* exposure */
 		Reg8391[1] = 0x18 | (expotimes >> 8);
 		Reg8391[2] = sd->brightness;	/* gain */
-		reg_w_buf(dev, 0x8391, Reg8391, 8);
-		reg_w_buf(dev, 0x8390, Reg8391, 8);
+		reg_w_buf(gspca_dev, 0x8391, Reg8391, 8);
+		reg_w_buf(gspca_dev, 0x8390, Reg8391, 8);
 		break;
 	    }
 	}
@@ -714,10 +718,11 @@ static void sd_start(struct gspca_dev *gspca_dev)
 			 * is sufficient to push raw frames at ~20fps */
 			reg_w_val(dev, 0x8500, mode);
 		}		/* -- qq@kuku.eu.org */
-		reg_w_buf(dev, 0x8307, Reg8307, 2);
-		reg_w_val(dev, 0x8700, Clck);	/* 0x8f 0x85 0x27 clock */
-		reg_w_val(dev, 0x8112, 0x1e | 0x20);
-		reg_w_val(dev, 0x850b, 0x03);
+		reg_w_buf(gspca_dev, 0x8307, Reg8307, 2);
+		reg_w_val(gspca_dev->dev, 0x8700, Clck);
+						/* 0x8f 0x85 0x27 clock */
+		reg_w_val(gspca_dev->dev, 0x8112, 0x1e | 0x20);
+		reg_w_val(gspca_dev->dev, 0x850b, 0x03);
 		setcontrast(gspca_dev);
 		break;
 	}
@@ -752,10 +757,14 @@ static void setautogain(struct gspca_dev *gspca_dev)
 
 	switch (sd->chip_revision) {
 	case Rev072A:
-		reg_r(gspca_dev->dev, 0x8621, &Gr, 1);
-		reg_r(gspca_dev->dev, 0x8622, &R, 1);
-		reg_r(gspca_dev->dev, 0x8623, &B, 1);
-		reg_r(gspca_dev->dev, 0x8624, &Gb, 1);
+		reg_r(gspca_dev, 0x8621, 1);
+		Gr = gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8622, 1);
+		R = gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8623, 1);
+		B = gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8624, 1);
+		Gb = gspca_dev->usb_buf[0];
 		y = (77 * R + 75 * (Gr + Gb) + 29 * B) >> 8;
 		/* u= (128*B-(43*(Gr+Gb+R))) >> 8; */
 		/* v= (128*R-(53*(Gr+Gb))-21*B) >> 8; */
@@ -867,20 +876,19 @@ static void setbrightness(struct gspca_dev *gspca_dev)
 static void getbrightness(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	__u8 value;
 	__u16 tot;
 
 	switch (sd->chip_revision) {
 	case Rev072A:
 		tot = 0;
-		reg_r(gspca_dev->dev, 0x8611, &value, 1);
-		tot += value;
-		reg_r(gspca_dev->dev, 0x8612, &value, 1);
-		tot += value;
-		reg_r(gspca_dev->dev, 0x8613, &value, 1);
-		tot += value;
-		reg_r(gspca_dev->dev, 0x8614, &value, 1);
-		tot += value;
+		reg_r(gspca_dev, 0x8611, 1);
+		tot += gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8612, 1);
+		tot += gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8613, 1);
+		tot += gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8614, 1);
+		tot += gspca_dev->usb_buf[0];
 		sd->brightness = tot >> 2;
 		break;
 	default:
@@ -893,20 +901,19 @@ static void getbrightness(struct gspca_dev *gspca_dev)
 static void getcontrast(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	__u8 value;
 	__u16 tot;
 
 	switch (sd->chip_revision) {
 	case Rev072A:
 		tot = 0;
-		reg_r(gspca_dev->dev, 0x8651, &value, 1);
-		tot += value;
-		reg_r(gspca_dev->dev, 0x8652, &value, 1);
-		tot += value;
-		reg_r(gspca_dev->dev, 0x8653, &value, 1);
-		tot += value;
-		reg_r(gspca_dev->dev, 0x8654, &value, 1);
-		tot += value;
+		reg_r(gspca_dev, 0x8651, 1);
+		tot += gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8652, 1);
+		tot += gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8653, 1);
+		tot += gspca_dev->usb_buf[0];
+		reg_r(gspca_dev, 0x8654, 1);
+		tot += gspca_dev->usb_buf[0];
 		sd->contrast = tot << 6;
 		break;
 	default:

drivers/media/video/gspca/stk014.c

@@ -23,8 +23,8 @@
 #include "gspca.h"
 #include "jpeg.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Jean-Francois Moine <http://moinejf.free.fr>");
 MODULE_DESCRIPTION("Syntek DV4000 (STK014) USB Camera Driver");
@@ -127,7 +127,7 @@ static struct v4l2_pix_format vga_mode[] = {
 
 /* -- read a register -- */
 static int reg_r(struct gspca_dev *gspca_dev,
-			__u16 index, __u8 *buf)
+			__u16 index)
 {
 	struct usb_device *dev = gspca_dev->dev;
 	int ret;
@@ -137,11 +137,13 @@ static int reg_r(struct gspca_dev *gspca_dev,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0x00,
 			index,
-			buf, 1,
+			gspca_dev->usb_buf, 1,
 			500);
-	if (ret < 0)
+	if (ret < 0) {
 		PDEBUG(D_ERR, "reg_r err %d", ret);
 		return ret;
+	}
+	return gspca_dev->usb_buf[0];
 }
 
 /* -- write a register -- */
@@ -164,58 +166,55 @@ static int reg_w(struct gspca_dev *gspca_dev,
 	return ret;
 }
 
-/* -- get a value -- */
+/* -- get a bulk value (4 bytes) -- */
 static int rcv_val(struct gspca_dev *gspca_dev,
-			int ads,
-			int len)
+			int ads)
 {
 	struct usb_device *dev = gspca_dev->dev;
 	int alen, ret;
-	unsigned char bulk_buf[4];
 
 	reg_w(gspca_dev, 0x634, (ads >> 16) & 0xff);
 	reg_w(gspca_dev, 0x635, (ads >> 8) & 0xff);
 	reg_w(gspca_dev, 0x636, ads & 0xff);
 	reg_w(gspca_dev, 0x637, 0);
-	reg_w(gspca_dev, 0x638, len & 0xff);
-	reg_w(gspca_dev, 0x639, len >> 8);
+	reg_w(gspca_dev, 0x638, 4);	/* len & 0xff */
+	reg_w(gspca_dev, 0x639, 0);	/* len >> 8 */
 	reg_w(gspca_dev, 0x63a, 0);
 	reg_w(gspca_dev, 0x63b, 0);
 	reg_w(gspca_dev, 0x630, 5);
-	if (len > sizeof bulk_buf)
-		return -1;
 	ret = usb_bulk_msg(dev,
 			usb_rcvbulkpipe(dev, 5),
-			bulk_buf,
-			len,
+			gspca_dev->usb_buf,
+			4,		/* length */
 			&alen,
 			500);		/* timeout in milliseconds */
 	return ret;
 }
 
-/* -- send a value -- */
+/* -- send a bulk value -- */
 static int snd_val(struct gspca_dev *gspca_dev,
 			int ads,
 			unsigned int val)
 {
 	struct usb_device *dev = gspca_dev->dev;
 	int alen, ret;
-	__u8 value, seq;
-	unsigned char bulk_buf[4];
+	__u8 seq = 0;
 
 	if (ads == 0x003f08) {
-		ret = reg_r(gspca_dev, 0x0704, &value);
+		ret = reg_r(gspca_dev, 0x0704);
 		if (ret < 0)
 			goto ko;
-		ret = reg_r(gspca_dev, 0x0705, &seq);
+		ret = reg_r(gspca_dev, 0x0705);
 		if (ret < 0)
 			goto ko;
-		ret = reg_r(gspca_dev, 0x0650, &value);
+		seq = ret;		/* keep the sequence number */
+		ret = reg_r(gspca_dev, 0x0650);
 		if (ret < 0)
 			goto ko;
 		reg_w(gspca_dev, 0x654, seq);
-	} else
+	} else {
 		reg_w(gspca_dev, 0x654, (ads >> 16) & 0xff);
+	}
 	reg_w(gspca_dev, 0x655, (ads >> 8) & 0xff);
 	reg_w(gspca_dev, 0x656, ads & 0xff);
 	reg_w(gspca_dev, 0x657, 0);
@@ -224,13 +223,13 @@ static int snd_val(struct gspca_dev *gspca_dev,
 	reg_w(gspca_dev, 0x65a, 0);
 	reg_w(gspca_dev, 0x65b, 0);
 	reg_w(gspca_dev, 0x650, 5);
-	bulk_buf[0] = (val >> 24) & 0xff;
-	bulk_buf[1] = (val >> 16) & 0xff;
-	bulk_buf[2] = (val >> 8) & 0xff;
-	bulk_buf[3] = val & 0xff;
+	gspca_dev->usb_buf[0] = val >> 24;
+	gspca_dev->usb_buf[1] = val >> 16;
+	gspca_dev->usb_buf[2] = val >> 8;
+	gspca_dev->usb_buf[3] = val;
 	ret = usb_bulk_msg(dev,
 			usb_sndbulkpipe(dev, 6),
-			bulk_buf,
+			gspca_dev->usb_buf,
 			4,
 			&alen,
 			500);	/* timeout in milliseconds */
@@ -303,7 +302,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	cam->dev_name = (char *) id->driver_info;
 	cam->epaddr = 0x02;
 	gspca_dev->cam.cam_mode = vga_mode;
-	gspca_dev->cam.nmodes = sizeof vga_mode / sizeof vga_mode[0];
+	gspca_dev->cam.nmodes = ARRAY_SIZE(vga_mode);
 	sd->brightness = BRIGHTNESS_DEF;
 	sd->contrast = CONTRAST_DEF;
 	sd->colors = COLOR_DEF;
@@ -314,16 +313,15 @@ static int sd_config(struct gspca_dev *gspca_dev,
 /* this function is called at open time */
 static int sd_open(struct gspca_dev *gspca_dev)
 {
-	__u8 value;
 	int ret;
 
 	/* check if the device responds */
 	usb_set_interface(gspca_dev->dev, gspca_dev->iface, 1);
-	ret = reg_r(gspca_dev, 0x0740, &value);
+	ret = reg_r(gspca_dev, 0x0740);
 	if (ret < 0)
 		return ret;
-	if (value != 0xff) {
-		PDEBUG(D_ERR|D_STREAM, "init reg: 0x%02x", value);
+	if (ret != 0xff) {
+		PDEBUG(D_ERR|D_STREAM, "init reg: 0x%02x", ret);
 		return -1;
 	}
 	return 0;
@@ -332,7 +330,6 @@ static int sd_open(struct gspca_dev *gspca_dev)
 /* -- start the camera -- */
 static void sd_start(struct gspca_dev *gspca_dev)
 {
-	__u8 dum;
 	int ret, value;
 
 	/* work on alternate 1 */
@@ -355,11 +352,11 @@ static void sd_start(struct gspca_dev *gspca_dev)
 			gspca_dev->iface, gspca_dev->alt);
 		goto out;
 	}
-	ret = reg_r(gspca_dev, 0x0630, &dum);
+	ret = reg_r(gspca_dev, 0x0630);
 	if (ret < 0)
 		goto out;
-	rcv_val(gspca_dev, 0x000020, 4);	/* << (value ff ff ff ff) */
-	ret = reg_r(gspca_dev, 0x0650, &dum);
+	rcv_val(gspca_dev, 0x000020);	/* << (value ff ff ff ff) */
+	ret = reg_r(gspca_dev, 0x0650);
 	if (ret < 0)
 		goto out;
 	snd_val(gspca_dev, 0x000020, 0xffffffff);
@@ -389,14 +386,13 @@ static void sd_start(struct gspca_dev *gspca_dev)
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
 	struct usb_device *dev = gspca_dev->dev;
-	__u8 value;
 
 	set_par(gspca_dev, 0x02000000);
 	set_par(gspca_dev, 0x02000000);
 	usb_set_interface(dev, gspca_dev->iface, 1);
-	reg_r(gspca_dev, 0x0630, &value);
-	rcv_val(gspca_dev, 0x000020, 4);	/* << (value ff ff ff ff) */
-	reg_r(gspca_dev, 0x0650, &value);
+	reg_r(gspca_dev, 0x0630);
+	rcv_val(gspca_dev, 0x000020);	/* << (value ff ff ff ff) */
+	reg_r(gspca_dev, 0x0650);
 	snd_val(gspca_dev, 0x000020, 0xffffffff);
 	reg_w(gspca_dev, 0x0620, 0);
 	reg_w(gspca_dev, 0x0630, 0);
@@ -538,10 +534,10 @@ static int sd_querymenu(struct gspca_dev *gspca_dev,
 }
 
 /* sub-driver description */
-static struct sd_desc sd_desc = {
+static const struct sd_desc sd_desc = {
 	.name = MODULE_NAME,
 	.ctrls = sd_ctrls,
-	.nctrls = sizeof sd_ctrls / sizeof sd_ctrls[0],
+	.nctrls = ARRAY_SIZE(sd_ctrls),
 	.config = sd_config,
 	.open = sd_open,
 	.start = sd_start,
@@ -554,7 +550,7 @@ static struct sd_desc sd_desc = {
 
 /* -- module initialisation -- */
 #define DVNM(name) .driver_info = (kernel_ulong_t) name
-static __devinitdata struct usb_device_id device_table[] = {
+static const __devinitdata struct usb_device_id device_table[] = {
 	{USB_DEVICE(0x05e1, 0x0893), DVNM("Syntek DV4000")},
 	{}
 };

drivers/media/video/gspca/vc032x.c

@@ -1227,17 +1227,18 @@ static const struct sensor_info sensor_info_data[] = {
 	{SENSOR_MI1310_SOC, 0x80 | 0x5d, 0x00, 0x143a, 0x24, 0x25, 0x01},
 };
 
-static void reg_r(struct usb_device *dev,
+/* read 'len' bytes in gspca_dev->usb_buf */
+static void reg_r(struct gspca_dev *gspca_dev,
 		  __u16 req,
 		  __u16 index,
-			   __u8 *buffer, __u16 length)
+		  __u16 len)
 {
-	usb_control_msg(dev,
-			usb_rcvctrlpipe(dev, 0),
+	usb_control_msg(gspca_dev->dev,
+			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			req,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			1,			/* value */
-			index, buffer, length,
+			index, gspca_dev->usb_buf, len,
 			500);
 }
 
@@ -1254,55 +1255,55 @@ static void reg_w(struct usb_device *dev,
 			500);
 }
 
-static void vc032x_read_sensor_register(struct usb_device *dev,
+static void read_sensor_register(struct gspca_dev *gspca_dev,
 				__u16 address, __u16 *value)
 {
+	struct usb_device *dev = gspca_dev->dev;
 	__u8 ldata, mdata, hdata;
-	__u8 tmpvalue = 0;
 	int retry = 50;
-	ldata = 0;
-	mdata = 0;
-	hdata = 0;
+
 	*value = 0;
 
-	reg_r(dev, 0xa1, 0xb33f, &tmpvalue, 1);
+	reg_r(gspca_dev, 0xa1, 0xb33f, 1);
 	/*PDEBUG(D_PROBE, " I2c Bus Busy Wait  0x%02X ", tmpvalue); */
-	if (!(tmpvalue & 0x02)) {
-		PDEBUG(D_ERR, "I2c Bus Busy Wait %d", tmpvalue & 0x02);
+	if (!(gspca_dev->usb_buf[0] & 0x02)) {
+		PDEBUG(D_ERR, "I2c Bus Busy Wait %d",
+			gspca_dev->usb_buf[0] & 0x02);
 		return;
 	}
 	reg_w(dev, 0xa0, address, 0xb33a);
 	reg_w(dev, 0xa0, 0x02, 0xb339);
 
-	tmpvalue = 0;
-	reg_r(dev, 0xa1, 0xb33b, &tmpvalue, 1);
-	while (retry-- && tmpvalue) {
-		reg_r(dev, 0xa1, 0xb33b, &tmpvalue, 1);
+	reg_r(gspca_dev, 0xa1, 0xb33b, 1);
+	while (retry-- && gspca_dev->usb_buf[0]) {
+		reg_r(gspca_dev, 0xa1, 0xb33b, 1);
 /*		PDEBUG(D_PROBE, "Read again 0xb33b %d", tmpvalue); */
 		msleep(1);
 	}
-	reg_r(dev, 0xa1, 0xb33e, &hdata, 1);
-	reg_r(dev, 0xa1, 0xb33d, &mdata, 1);
-	reg_r(dev, 0xa1, 0xb33c, &ldata, 1);
+	reg_r(gspca_dev, 0xa1, 0xb33e, 1);
+	hdata = gspca_dev->usb_buf[0];
+	reg_r(gspca_dev, 0xa1, 0xb33d, 1);
+	mdata = gspca_dev->usb_buf[0];
+	reg_r(gspca_dev, 0xa1, 0xb33c, 1);
+	ldata = gspca_dev->usb_buf[0];
 	PDEBUG(D_PROBE, "Read Sensor h (0x%02X) m (0x%02X) l (0x%02X)",
 		hdata, mdata, ldata);
-	tmpvalue = 0;
-	reg_r(dev, 0xa1, 0xb334, &tmpvalue, 1);
-	if (tmpvalue == 0x02)
+	reg_r(gspca_dev, 0xa1, 0xb334, 1);
+	if (gspca_dev->usb_buf[0] == 0x02)
 		*value = (ldata << 8) + mdata;
 	else
 		*value = ldata;
 }
+
 static int vc032x_probe_sensor(struct gspca_dev *gspca_dev)
 {
 	struct usb_device *dev = gspca_dev->dev;
 	int i;
-	__u8 data;
 	__u16 value;
 	const struct sensor_info *ptsensor_info;
 
-	reg_r(dev, 0xa1, 0xbfcf, &data, 1);
-	PDEBUG(D_PROBE, "check sensor header %d", data);
+	reg_r(gspca_dev, 0xa1, 0xbfcf, 1);
+	PDEBUG(D_PROBE, "check sensor header %d", gspca_dev->usb_buf[0]);
 	for (i = 0; i < ARRAY_SIZE(sensor_info_data); i++) {
 		ptsensor_info = &sensor_info_data[i];
 		reg_w(dev, 0xa0, 0x02, 0xb334);
@@ -1315,7 +1316,7 @@ static int vc032x_probe_sensor(struct gspca_dev *gspca_dev)
 			"check sensor VC032X -> %d Add -> ox%02X!",
 			i, ptsensor_info->I2cAdd); */
 		reg_w(dev, 0xa0, ptsensor_info->op, 0xb301);
-		vc032x_read_sensor_register(dev, ptsensor_info->IdAdd, &value);
+		read_sensor_register(gspca_dev, ptsensor_info->IdAdd, &value);
 		if (value == ptsensor_info->VpId) {
 /*			PDEBUG(D_PROBE, "find sensor VC032X -> ox%04X!",
 				ptsensor_info->VpId); */
@@ -1325,14 +1326,14 @@ static int vc032x_probe_sensor(struct gspca_dev *gspca_dev)
 	return -1;
 }
 
-static __u8 i2c_write(struct usb_device *dev,
+static __u8 i2c_write(struct gspca_dev *gspca_dev,
 			__u8 reg, const __u8 *val, __u8 size)
 {
-	__u8 retbyte;
+	struct usb_device *dev = gspca_dev->dev;
 
 	if (size > 3 || size < 1)
 		return -EINVAL;
-	reg_r(dev, 0xa1, 0xb33f, &retbyte, 1);
+	reg_r(gspca_dev, 0xa1, 0xb33f, 1);
 	reg_w(dev, 0xa0, size, 0xb334);
 	reg_w(dev, 0xa0, reg, 0xb33a);
 	switch (size) {
@@ -1353,8 +1354,8 @@ static __u8 i2c_write(struct usb_device *dev,
 		return -EINVAL;
 	}
 	reg_w(dev, 0xa0, 0x01, 0xb339);
-	reg_r(dev, 0xa1, 0xb33b, &retbyte, 1);
-	return retbyte == 0;
+	reg_r(gspca_dev, 0xa1, 0xb33b, 1);
+	return gspca_dev->usb_buf[0] == 0;
 }
 
 static void put_tab_to_reg(struct gspca_dev *gspca_dev,
@@ -1382,10 +1383,10 @@ static void usb_exchange(struct gspca_dev *gspca_dev,
 					((data[i][0])<<8) | data[i][1]);
 			break;
 		case 0xaa:			/* i2c op */
-			i2c_write(dev, data[i][1], &data[i][2], 1);
+			i2c_write(gspca_dev, data[i][1], &data[i][2], 1);
 			break;
 		case 0xbb:			/* i2c op */
-			i2c_write(dev, data[i][0], &data[i][1], 2);
+			i2c_write(gspca_dev, data[i][0], &data[i][1], 2);
 			break;
 		case 0xdd:
 			msleep(data[i][2] + 10);
@@ -1417,7 +1418,6 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
 	struct cam *cam;
-	__u8 tmp2[4];
 	int sensor;
 	__u16 product;
 
@@ -1488,10 +1488,10 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	sd->lightfreq = FREQ_DEF;
 
 	if (sd->bridge == BRIDGE_VC0321) {
-		reg_r(dev, 0x8a, 0, tmp2, 3);
+		reg_r(gspca_dev, 0x8a, 0, 3);
 		reg_w(dev, 0x87, 0x00, 0x0f0f);
 
-		reg_r(dev, 0x8b, 0, tmp2, 3);
+		reg_r(gspca_dev, 0x8b, 0, 3);
 		reg_w(dev, 0x88, 0x00, 0x0202);
 	}
 	return 0;
@@ -1525,7 +1525,6 @@ static void setlightfreq(struct gspca_dev *gspca_dev)
 static void sd_start(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-/*	__u8 tmp2; */
 	const __u8 *GammaT = NULL;
 	const __u8 *MatrixT = NULL;
 	int mode;
@@ -1627,7 +1626,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
 		reg_w(gspca_dev->dev, 0xa0, 0x40, 0xb824);
 		*/
 		/* Only works for HV7131R ??
-		reg_r (gspca_dev->dev, 0xa1, 0xb881, &tmp2, 1);
+		reg_r (gspca_dev, 0xa1, 0xb881, 1);
 		reg_w(gspca_dev->dev, 0xa0, 0xfe01, 0xb881);
 		reg_w(gspca_dev->dev, 0xa0, 0x79, 0xb801);
 		*/