1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * V4L2 controls framework uAPI implementation:
4  *
5  * Copyright (C) 2010-2021  Hans Verkuil <hverkuil-cisco@xs4all.nl>
6  */
7 
8 #define pr_fmt(fmt) "v4l2-ctrls: " fmt
9 
10 #include <linux/export.h>
11 #include <linux/mm.h>
12 #include <linux/slab.h>
13 #include <media/v4l2-ctrls.h>
14 #include <media/v4l2-dev.h>
15 #include <media/v4l2-device.h>
16 #include <media/v4l2-event.h>
17 #include <media/v4l2-ioctl.h>
18 
19 #include "v4l2-ctrls-priv.h"
20 
21 /* Internal temporary helper struct, one for each v4l2_ext_control */
22 struct v4l2_ctrl_helper {
23 	/* Pointer to the control reference of the master control */
24 	struct v4l2_ctrl_ref *mref;
25 	/* The control ref corresponding to the v4l2_ext_control ID field. */
26 	struct v4l2_ctrl_ref *ref;
27 	/*
28 	 * v4l2_ext_control index of the next control belonging to the
29 	 * same cluster, or 0 if there isn't any.
30 	 */
31 	u32 next;
32 };
33 
34 /*
35  * Helper functions to copy control payload data from kernel space to
36  * user space and vice versa.
37  */
38 
39 /* Helper function: copy the given control value back to the caller */
40 static int ptr_to_user(struct v4l2_ext_control *c,
41 		       struct v4l2_ctrl *ctrl,
42 		       union v4l2_ctrl_ptr ptr)
43 {
44 	u32 len;
45 
46 	if (ctrl->is_ptr && !ctrl->is_string)
47 		return copy_to_user(c->ptr, ptr.p_const, c->size) ?
48 		       -EFAULT : 0;
49 
50 	switch (ctrl->type) {
51 	case V4L2_CTRL_TYPE_STRING:
52 		len = strlen(ptr.p_char);
53 		if (c->size < len + 1) {
54 			c->size = ctrl->elem_size;
55 			return -ENOSPC;
56 		}
57 		return copy_to_user(c->string, ptr.p_char, len + 1) ?
58 		       -EFAULT : 0;
59 	case V4L2_CTRL_TYPE_INTEGER64:
60 		c->value64 = *ptr.p_s64;
61 		break;
62 	default:
63 		c->value = *ptr.p_s32;
64 		break;
65 	}
66 	return 0;
67 }
68 
69 /* Helper function: copy the current control value back to the caller */
70 static int cur_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
71 {
72 	return ptr_to_user(c, ctrl, ctrl->p_cur);
73 }
74 
75 /* Helper function: copy the new control value back to the caller */
76 static int new_to_user(struct v4l2_ext_control *c,
77 		       struct v4l2_ctrl *ctrl)
78 {
79 	return ptr_to_user(c, ctrl, ctrl->p_new);
80 }
81 
82 /* Helper function: copy the request value back to the caller */
83 static int req_to_user(struct v4l2_ext_control *c,
84 		       struct v4l2_ctrl_ref *ref)
85 {
86 	return ptr_to_user(c, ref->ctrl, ref->p_req);
87 }
88 
89 /* Helper function: copy the initial control value back to the caller */
90 static int def_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
91 {
92 	ctrl->type_ops->init(ctrl, 0, ctrl->p_new);
93 
94 	return ptr_to_user(c, ctrl, ctrl->p_new);
95 }
96 
97 /* Helper function: copy the caller-provider value as the new control value */
98 static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
99 {
100 	int ret;
101 	u32 size;
102 
103 	ctrl->is_new = 0;
104 	if (ctrl->is_dyn_array &&
105 	    c->size > ctrl->p_array_alloc_elems * ctrl->elem_size) {
106 		void *old = ctrl->p_array;
107 		void *tmp = kvzalloc(2 * c->size, GFP_KERNEL);
108 
109 		if (!tmp)
110 			return -ENOMEM;
111 		memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size);
112 		memcpy(tmp + c->size, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size);
113 		ctrl->p_new.p = tmp;
114 		ctrl->p_cur.p = tmp + c->size;
115 		ctrl->p_array = tmp;
116 		ctrl->p_array_alloc_elems = c->size / ctrl->elem_size;
117 		kvfree(old);
118 	}
119 
120 	if (ctrl->is_ptr && !ctrl->is_string) {
121 		unsigned int elems = c->size / ctrl->elem_size;
122 
123 		if (copy_from_user(ctrl->p_new.p, c->ptr, c->size))
124 			return -EFAULT;
125 		ctrl->is_new = 1;
126 		if (ctrl->is_dyn_array)
127 			ctrl->new_elems = elems;
128 		else if (ctrl->is_array)
129 			ctrl->type_ops->init(ctrl, elems, ctrl->p_new);
130 		return 0;
131 	}
132 
133 	switch (ctrl->type) {
134 	case V4L2_CTRL_TYPE_INTEGER64:
135 		*ctrl->p_new.p_s64 = c->value64;
136 		break;
137 	case V4L2_CTRL_TYPE_STRING:
138 		size = c->size;
139 		if (size == 0)
140 			return -ERANGE;
141 		if (size > ctrl->maximum + 1)
142 			size = ctrl->maximum + 1;
143 		ret = copy_from_user(ctrl->p_new.p_char, c->string, size) ? -EFAULT : 0;
144 		if (!ret) {
145 			char last = ctrl->p_new.p_char[size - 1];
146 
147 			ctrl->p_new.p_char[size - 1] = 0;
148 			/*
149 			 * If the string was longer than ctrl->maximum,
150 			 * then return an error.
151 			 */
152 			if (strlen(ctrl->p_new.p_char) == ctrl->maximum && last)
153 				return -ERANGE;
154 		}
155 		return ret;
156 	default:
157 		*ctrl->p_new.p_s32 = c->value;
158 		break;
159 	}
160 	ctrl->is_new = 1;
161 	return 0;
162 }
163 
164 /*
165  * VIDIOC_G/TRY/S_EXT_CTRLS implementation
166  */
167 
168 /*
169  * Some general notes on the atomic requirements of VIDIOC_G/TRY/S_EXT_CTRLS:
170  *
171  * It is not a fully atomic operation, just best-effort only. After all, if
172  * multiple controls have to be set through multiple i2c writes (for example)
173  * then some initial writes may succeed while others fail. Thus leaving the
174  * system in an inconsistent state. The question is how much effort you are
175  * willing to spend on trying to make something atomic that really isn't.
176  *
177  * From the point of view of an application the main requirement is that
178  * when you call VIDIOC_S_EXT_CTRLS and some values are invalid then an
179  * error should be returned without actually affecting any controls.
180  *
181  * If all the values are correct, then it is acceptable to just give up
182  * in case of low-level errors.
183  *
184  * It is important though that the application can tell when only a partial
185  * configuration was done. The way we do that is through the error_idx field
186  * of struct v4l2_ext_controls: if that is equal to the count field then no
187  * controls were affected. Otherwise all controls before that index were
188  * successful in performing their 'get' or 'set' operation, the control at
189  * the given index failed, and you don't know what happened with the controls
190  * after the failed one. Since if they were part of a control cluster they
191  * could have been successfully processed (if a cluster member was encountered
192  * at index < error_idx), they could have failed (if a cluster member was at
193  * error_idx), or they may not have been processed yet (if the first cluster
194  * member appeared after error_idx).
195  *
196  * It is all fairly theoretical, though. In practice all you can do is to
197  * bail out. If error_idx == count, then it is an application bug. If
198  * error_idx < count then it is only an application bug if the error code was
199  * EBUSY. That usually means that something started streaming just when you
200  * tried to set the controls. In all other cases it is a driver/hardware
201  * problem and all you can do is to retry or bail out.
202  *
203  * Note that these rules do not apply to VIDIOC_TRY_EXT_CTRLS: since that
204  * never modifies controls the error_idx is just set to whatever control
205  * has an invalid value.
206  */
207 
208 /*
209  * Prepare for the extended g/s/try functions.
210  * Find the controls in the control array and do some basic checks.
211  */
212 static int prepare_ext_ctrls(struct v4l2_ctrl_handler *hdl,
213 			     struct v4l2_ext_controls *cs,
214 			     struct v4l2_ctrl_helper *helpers,
215 			     struct video_device *vdev,
216 			     bool get)
217 {
218 	struct v4l2_ctrl_helper *h;
219 	bool have_clusters = false;
220 	u32 i;
221 
222 	for (i = 0, h = helpers; i < cs->count; i++, h++) {
223 		struct v4l2_ext_control *c = &cs->controls[i];
224 		struct v4l2_ctrl_ref *ref;
225 		struct v4l2_ctrl *ctrl;
226 		u32 id = c->id & V4L2_CTRL_ID_MASK;
227 
228 		cs->error_idx = i;
229 
230 		if (cs->which &&
231 		    cs->which != V4L2_CTRL_WHICH_DEF_VAL &&
232 		    cs->which != V4L2_CTRL_WHICH_REQUEST_VAL &&
233 		    V4L2_CTRL_ID2WHICH(id) != cs->which) {
234 			dprintk(vdev,
235 				"invalid which 0x%x or control id 0x%x\n",
236 				cs->which, id);
237 			return -EINVAL;
238 		}
239 
240 		/*
241 		 * Old-style private controls are not allowed for
242 		 * extended controls.
243 		 */
244 		if (id >= V4L2_CID_PRIVATE_BASE) {
245 			dprintk(vdev,
246 				"old-style private controls not allowed\n");
247 			return -EINVAL;
248 		}
249 		ref = find_ref_lock(hdl, id);
250 		if (!ref) {
251 			dprintk(vdev, "cannot find control id 0x%x\n", id);
252 			return -EINVAL;
253 		}
254 		h->ref = ref;
255 		ctrl = ref->ctrl;
256 		if (ctrl->flags & V4L2_CTRL_FLAG_DISABLED) {
257 			dprintk(vdev, "control id 0x%x is disabled\n", id);
258 			return -EINVAL;
259 		}
260 
261 		if (ctrl->cluster[0]->ncontrols > 1)
262 			have_clusters = true;
263 		if (ctrl->cluster[0] != ctrl)
264 			ref = find_ref_lock(hdl, ctrl->cluster[0]->id);
265 		if (ctrl->is_dyn_array) {
266 			unsigned int max_size = ctrl->dims[0] * ctrl->elem_size;
267 			unsigned int tot_size = ctrl->elem_size;
268 
269 			if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
270 				tot_size *= ref->p_req_elems;
271 			else
272 				tot_size *= ctrl->elems;
273 
274 			c->size = ctrl->elem_size * (c->size / ctrl->elem_size);
275 			if (get) {
276 				if (c->size < tot_size) {
277 					c->size = tot_size;
278 					return -ENOSPC;
279 				}
280 				c->size = tot_size;
281 			} else {
282 				if (c->size > max_size) {
283 					c->size = max_size;
284 					return -ENOSPC;
285 				}
286 				if (!c->size)
287 					return -EFAULT;
288 			}
289 		} else if (ctrl->is_ptr && !ctrl->is_string) {
290 			unsigned int tot_size = ctrl->elems * ctrl->elem_size;
291 
292 			if (c->size < tot_size) {
293 				/*
294 				 * In the get case the application first
295 				 * queries to obtain the size of the control.
296 				 */
297 				if (get) {
298 					c->size = tot_size;
299 					return -ENOSPC;
300 				}
301 				dprintk(vdev,
302 					"pointer control id 0x%x size too small, %d bytes but %d bytes needed\n",
303 					id, c->size, tot_size);
304 				return -EFAULT;
305 			}
306 			c->size = tot_size;
307 		}
308 		/* Store the ref to the master control of the cluster */
309 		h->mref = ref;
310 		/*
311 		 * Initially set next to 0, meaning that there is no other
312 		 * control in this helper array belonging to the same
313 		 * cluster.
314 		 */
315 		h->next = 0;
316 	}
317 
318 	/*
319 	 * We are done if there were no controls that belong to a multi-
320 	 * control cluster.
321 	 */
322 	if (!have_clusters)
323 		return 0;
324 
325 	/*
326 	 * The code below figures out in O(n) time which controls in the list
327 	 * belong to the same cluster.
328 	 */
329 
330 	/* This has to be done with the handler lock taken. */
331 	mutex_lock(hdl->lock);
332 
333 	/* First zero the helper field in the master control references */
334 	for (i = 0; i < cs->count; i++)
335 		helpers[i].mref->helper = NULL;
336 	for (i = 0, h = helpers; i < cs->count; i++, h++) {
337 		struct v4l2_ctrl_ref *mref = h->mref;
338 
339 		/*
340 		 * If the mref->helper is set, then it points to an earlier
341 		 * helper that belongs to the same cluster.
342 		 */
343 		if (mref->helper) {
344 			/*
345 			 * Set the next field of mref->helper to the current
346 			 * index: this means that the earlier helper now
347 			 * points to the next helper in the same cluster.
348 			 */
349 			mref->helper->next = i;
350 			/*
351 			 * mref should be set only for the first helper in the
352 			 * cluster, clear the others.
353 			 */
354 			h->mref = NULL;
355 		}
356 		/* Point the mref helper to the current helper struct. */
357 		mref->helper = h;
358 	}
359 	mutex_unlock(hdl->lock);
360 	return 0;
361 }
362 
363 /*
364  * Handles the corner case where cs->count == 0. It checks whether the
365  * specified control class exists. If that class ID is 0, then it checks
366  * whether there are any controls at all.
367  */
368 static int class_check(struct v4l2_ctrl_handler *hdl, u32 which)
369 {
370 	if (which == 0 || which == V4L2_CTRL_WHICH_DEF_VAL ||
371 	    which == V4L2_CTRL_WHICH_REQUEST_VAL)
372 		return 0;
373 	return find_ref_lock(hdl, which | 1) ? 0 : -EINVAL;
374 }
375 
376 /*
377  * Get extended controls. Allocates the helpers array if needed.
378  *
379  * Note that v4l2_g_ext_ctrls_common() with 'which' set to
380  * V4L2_CTRL_WHICH_REQUEST_VAL is only called if the request was
381  * completed, and in that case p_req_valid is true for all controls.
382  */
383 int v4l2_g_ext_ctrls_common(struct v4l2_ctrl_handler *hdl,
384 			    struct v4l2_ext_controls *cs,
385 			    struct video_device *vdev)
386 {
387 	struct v4l2_ctrl_helper helper[4];
388 	struct v4l2_ctrl_helper *helpers = helper;
389 	int ret;
390 	int i, j;
391 	bool is_default, is_request;
392 
393 	is_default = (cs->which == V4L2_CTRL_WHICH_DEF_VAL);
394 	is_request = (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL);
395 
396 	cs->error_idx = cs->count;
397 	cs->which = V4L2_CTRL_ID2WHICH(cs->which);
398 
399 	if (!hdl)
400 		return -EINVAL;
401 
402 	if (cs->count == 0)
403 		return class_check(hdl, cs->which);
404 
405 	if (cs->count > ARRAY_SIZE(helper)) {
406 		helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
407 					 GFP_KERNEL);
408 		if (!helpers)
409 			return -ENOMEM;
410 	}
411 
412 	ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, true);
413 	cs->error_idx = cs->count;
414 
415 	for (i = 0; !ret && i < cs->count; i++)
416 		if (helpers[i].ref->ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
417 			ret = -EACCES;
418 
419 	for (i = 0; !ret && i < cs->count; i++) {
420 		struct v4l2_ctrl *master;
421 		bool is_volatile = false;
422 		u32 idx = i;
423 
424 		if (!helpers[i].mref)
425 			continue;
426 
427 		master = helpers[i].mref->ctrl;
428 		cs->error_idx = i;
429 
430 		v4l2_ctrl_lock(master);
431 
432 		/*
433 		 * g_volatile_ctrl will update the new control values.
434 		 * This makes no sense for V4L2_CTRL_WHICH_DEF_VAL and
435 		 * V4L2_CTRL_WHICH_REQUEST_VAL. In the case of requests
436 		 * it is v4l2_ctrl_request_complete() that copies the
437 		 * volatile controls at the time of request completion
438 		 * to the request, so you don't want to do that again.
439 		 */
440 		if (!is_default && !is_request &&
441 		    ((master->flags & V4L2_CTRL_FLAG_VOLATILE) ||
442 		    (master->has_volatiles && !is_cur_manual(master)))) {
443 			for (j = 0; j < master->ncontrols; j++)
444 				cur_to_new(master->cluster[j]);
445 			ret = call_op(master, g_volatile_ctrl);
446 			is_volatile = true;
447 		}
448 
449 		if (ret) {
450 			v4l2_ctrl_unlock(master);
451 			break;
452 		}
453 
454 		/*
455 		 * Copy the default value (if is_default is true), the
456 		 * request value (if is_request is true and p_req is valid),
457 		 * the new volatile value (if is_volatile is true) or the
458 		 * current value.
459 		 */
460 		do {
461 			struct v4l2_ctrl_ref *ref = helpers[idx].ref;
462 
463 			if (is_default)
464 				ret = def_to_user(cs->controls + idx, ref->ctrl);
465 			else if (is_request && ref->p_req_array_enomem)
466 				ret = -ENOMEM;
467 			else if (is_request && ref->p_req_valid)
468 				ret = req_to_user(cs->controls + idx, ref);
469 			else if (is_volatile)
470 				ret = new_to_user(cs->controls + idx, ref->ctrl);
471 			else
472 				ret = cur_to_user(cs->controls + idx, ref->ctrl);
473 			idx = helpers[idx].next;
474 		} while (!ret && idx);
475 
476 		v4l2_ctrl_unlock(master);
477 	}
478 
479 	if (cs->count > ARRAY_SIZE(helper))
480 		kvfree(helpers);
481 	return ret;
482 }
483 
484 int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct video_device *vdev,
485 		     struct media_device *mdev, struct v4l2_ext_controls *cs)
486 {
487 	if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
488 		return v4l2_g_ext_ctrls_request(hdl, vdev, mdev, cs);
489 
490 	return v4l2_g_ext_ctrls_common(hdl, cs, vdev);
491 }
492 EXPORT_SYMBOL(v4l2_g_ext_ctrls);
493 
494 /* Validate a new control */
495 static int validate_new(const struct v4l2_ctrl *ctrl, union v4l2_ctrl_ptr p_new)
496 {
497 	return ctrl->type_ops->validate(ctrl, p_new);
498 }
499 
500 /* Validate controls. */
501 static int validate_ctrls(struct v4l2_ext_controls *cs,
502 			  struct v4l2_ctrl_helper *helpers,
503 			  struct video_device *vdev,
504 			  bool set)
505 {
506 	unsigned int i;
507 	int ret = 0;
508 
509 	cs->error_idx = cs->count;
510 	for (i = 0; i < cs->count; i++) {
511 		struct v4l2_ctrl *ctrl = helpers[i].ref->ctrl;
512 		union v4l2_ctrl_ptr p_new;
513 
514 		cs->error_idx = i;
515 
516 		if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY) {
517 			dprintk(vdev,
518 				"control id 0x%x is read-only\n",
519 				ctrl->id);
520 			return -EACCES;
521 		}
522 		/*
523 		 * This test is also done in try_set_control_cluster() which
524 		 * is called in atomic context, so that has the final say,
525 		 * but it makes sense to do an up-front check as well. Once
526 		 * an error occurs in try_set_control_cluster() some other
527 		 * controls may have been set already and we want to do a
528 		 * best-effort to avoid that.
529 		 */
530 		if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)) {
531 			dprintk(vdev,
532 				"control id 0x%x is grabbed, cannot set\n",
533 				ctrl->id);
534 			return -EBUSY;
535 		}
536 		/*
537 		 * Skip validation for now if the payload needs to be copied
538 		 * from userspace into kernelspace. We'll validate those later.
539 		 */
540 		if (ctrl->is_ptr)
541 			continue;
542 		if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
543 			p_new.p_s64 = &cs->controls[i].value64;
544 		else
545 			p_new.p_s32 = &cs->controls[i].value;
546 		ret = validate_new(ctrl, p_new);
547 		if (ret)
548 			return ret;
549 	}
550 	return 0;
551 }
552 
553 /* Try or try-and-set controls */
554 int try_set_ext_ctrls_common(struct v4l2_fh *fh,
555 			     struct v4l2_ctrl_handler *hdl,
556 			     struct v4l2_ext_controls *cs,
557 			     struct video_device *vdev, bool set)
558 {
559 	struct v4l2_ctrl_helper helper[4];
560 	struct v4l2_ctrl_helper *helpers = helper;
561 	unsigned int i, j;
562 	int ret;
563 
564 	cs->error_idx = cs->count;
565 
566 	/* Default value cannot be changed */
567 	if (cs->which == V4L2_CTRL_WHICH_DEF_VAL) {
568 		dprintk(vdev, "%s: cannot change default value\n",
569 			video_device_node_name(vdev));
570 		return -EINVAL;
571 	}
572 
573 	cs->which = V4L2_CTRL_ID2WHICH(cs->which);
574 
575 	if (!hdl) {
576 		dprintk(vdev, "%s: invalid null control handler\n",
577 			video_device_node_name(vdev));
578 		return -EINVAL;
579 	}
580 
581 	if (cs->count == 0)
582 		return class_check(hdl, cs->which);
583 
584 	if (cs->count > ARRAY_SIZE(helper)) {
585 		helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
586 					 GFP_KERNEL);
587 		if (!helpers)
588 			return -ENOMEM;
589 	}
590 	ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, false);
591 	if (!ret)
592 		ret = validate_ctrls(cs, helpers, vdev, set);
593 	if (ret && set)
594 		cs->error_idx = cs->count;
595 	for (i = 0; !ret && i < cs->count; i++) {
596 		struct v4l2_ctrl *master;
597 		u32 idx = i;
598 
599 		if (!helpers[i].mref)
600 			continue;
601 
602 		cs->error_idx = i;
603 		master = helpers[i].mref->ctrl;
604 		v4l2_ctrl_lock(master);
605 
606 		/* Reset the 'is_new' flags of the cluster */
607 		for (j = 0; j < master->ncontrols; j++)
608 			if (master->cluster[j])
609 				master->cluster[j]->is_new = 0;
610 
611 		/*
612 		 * For volatile autoclusters that are currently in auto mode
613 		 * we need to discover if it will be set to manual mode.
614 		 * If so, then we have to copy the current volatile values
615 		 * first since those will become the new manual values (which
616 		 * may be overwritten by explicit new values from this set
617 		 * of controls).
618 		 */
619 		if (master->is_auto && master->has_volatiles &&
620 		    !is_cur_manual(master)) {
621 			/* Pick an initial non-manual value */
622 			s32 new_auto_val = master->manual_mode_value + 1;
623 			u32 tmp_idx = idx;
624 
625 			do {
626 				/*
627 				 * Check if the auto control is part of the
628 				 * list, and remember the new value.
629 				 */
630 				if (helpers[tmp_idx].ref->ctrl == master)
631 					new_auto_val = cs->controls[tmp_idx].value;
632 				tmp_idx = helpers[tmp_idx].next;
633 			} while (tmp_idx);
634 			/*
635 			 * If the new value == the manual value, then copy
636 			 * the current volatile values.
637 			 */
638 			if (new_auto_val == master->manual_mode_value)
639 				update_from_auto_cluster(master);
640 		}
641 
642 		/*
643 		 * Copy the new caller-supplied control values.
644 		 * user_to_new() sets 'is_new' to 1.
645 		 */
646 		do {
647 			struct v4l2_ctrl *ctrl = helpers[idx].ref->ctrl;
648 
649 			ret = user_to_new(cs->controls + idx, ctrl);
650 			if (!ret && ctrl->is_ptr) {
651 				ret = validate_new(ctrl, ctrl->p_new);
652 				if (ret)
653 					dprintk(vdev,
654 						"failed to validate control %s (%d)\n",
655 						v4l2_ctrl_get_name(ctrl->id), ret);
656 			}
657 			idx = helpers[idx].next;
658 		} while (!ret && idx);
659 
660 		if (!ret)
661 			ret = try_or_set_cluster(fh, master,
662 						 !hdl->req_obj.req && set, 0);
663 		if (!ret && hdl->req_obj.req && set) {
664 			for (j = 0; j < master->ncontrols; j++) {
665 				struct v4l2_ctrl_ref *ref =
666 					find_ref(hdl, master->cluster[j]->id);
667 
668 				new_to_req(ref);
669 			}
670 		}
671 
672 		/* Copy the new values back to userspace. */
673 		if (!ret) {
674 			idx = i;
675 			do {
676 				ret = new_to_user(cs->controls + idx,
677 						  helpers[idx].ref->ctrl);
678 				idx = helpers[idx].next;
679 			} while (!ret && idx);
680 		}
681 		v4l2_ctrl_unlock(master);
682 	}
683 
684 	if (cs->count > ARRAY_SIZE(helper))
685 		kvfree(helpers);
686 	return ret;
687 }
688 
689 static int try_set_ext_ctrls(struct v4l2_fh *fh,
690 			     struct v4l2_ctrl_handler *hdl,
691 			     struct video_device *vdev,
692 			     struct media_device *mdev,
693 			     struct v4l2_ext_controls *cs, bool set)
694 {
695 	int ret;
696 
697 	if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
698 		return try_set_ext_ctrls_request(fh, hdl, vdev, mdev, cs, set);
699 
700 	ret = try_set_ext_ctrls_common(fh, hdl, cs, vdev, set);
701 	if (ret)
702 		dprintk(vdev,
703 			"%s: try_set_ext_ctrls_common failed (%d)\n",
704 			video_device_node_name(vdev), ret);
705 
706 	return ret;
707 }
708 
709 int v4l2_try_ext_ctrls(struct v4l2_ctrl_handler *hdl,
710 		       struct video_device *vdev,
711 		       struct media_device *mdev,
712 		       struct v4l2_ext_controls *cs)
713 {
714 	return try_set_ext_ctrls(NULL, hdl, vdev, mdev, cs, false);
715 }
716 EXPORT_SYMBOL(v4l2_try_ext_ctrls);
717 
718 int v4l2_s_ext_ctrls(struct v4l2_fh *fh,
719 		     struct v4l2_ctrl_handler *hdl,
720 		     struct video_device *vdev,
721 		     struct media_device *mdev,
722 		     struct v4l2_ext_controls *cs)
723 {
724 	return try_set_ext_ctrls(fh, hdl, vdev, mdev, cs, true);
725 }
726 EXPORT_SYMBOL(v4l2_s_ext_ctrls);
727 
728 /*
729  * VIDIOC_G/S_CTRL implementation
730  */
731 
732 /* Helper function to get a single control */
733 static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c)
734 {
735 	struct v4l2_ctrl *master = ctrl->cluster[0];
736 	int ret = 0;
737 	int i;
738 
739 	/* Compound controls are not supported. The new_to_user() and
740 	 * cur_to_user() calls below would need to be modified not to access
741 	 * userspace memory when called from get_ctrl().
742 	 */
743 	if (!ctrl->is_int && ctrl->type != V4L2_CTRL_TYPE_INTEGER64)
744 		return -EINVAL;
745 
746 	if (ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
747 		return -EACCES;
748 
749 	v4l2_ctrl_lock(master);
750 	/* g_volatile_ctrl will update the current control values */
751 	if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
752 		for (i = 0; i < master->ncontrols; i++)
753 			cur_to_new(master->cluster[i]);
754 		ret = call_op(master, g_volatile_ctrl);
755 		new_to_user(c, ctrl);
756 	} else {
757 		cur_to_user(c, ctrl);
758 	}
759 	v4l2_ctrl_unlock(master);
760 	return ret;
761 }
762 
763 int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_control *control)
764 {
765 	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
766 	struct v4l2_ext_control c;
767 	int ret;
768 
769 	if (!ctrl || !ctrl->is_int)
770 		return -EINVAL;
771 	ret = get_ctrl(ctrl, &c);
772 	control->value = c.value;
773 	return ret;
774 }
775 EXPORT_SYMBOL(v4l2_g_ctrl);
776 
777 /* Helper function for VIDIOC_S_CTRL compatibility */
778 static int set_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
779 {
780 	struct v4l2_ctrl *master = ctrl->cluster[0];
781 	int ret;
782 	int i;
783 
784 	/* Reset the 'is_new' flags of the cluster */
785 	for (i = 0; i < master->ncontrols; i++)
786 		if (master->cluster[i])
787 			master->cluster[i]->is_new = 0;
788 
789 	ret = validate_new(ctrl, ctrl->p_new);
790 	if (ret)
791 		return ret;
792 
793 	/*
794 	 * For autoclusters with volatiles that are switched from auto to
795 	 * manual mode we have to update the current volatile values since
796 	 * those will become the initial manual values after such a switch.
797 	 */
798 	if (master->is_auto && master->has_volatiles && ctrl == master &&
799 	    !is_cur_manual(master) && ctrl->val == master->manual_mode_value)
800 		update_from_auto_cluster(master);
801 
802 	ctrl->is_new = 1;
803 	return try_or_set_cluster(fh, master, true, ch_flags);
804 }
805 
806 /* Helper function for VIDIOC_S_CTRL compatibility */
807 static int set_ctrl_lock(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl,
808 			 struct v4l2_ext_control *c)
809 {
810 	int ret;
811 
812 	v4l2_ctrl_lock(ctrl);
813 	user_to_new(c, ctrl);
814 	ret = set_ctrl(fh, ctrl, 0);
815 	if (!ret)
816 		cur_to_user(c, ctrl);
817 	v4l2_ctrl_unlock(ctrl);
818 	return ret;
819 }
820 
821 int v4l2_s_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl_handler *hdl,
822 		struct v4l2_control *control)
823 {
824 	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
825 	struct v4l2_ext_control c = { control->id };
826 	int ret;
827 
828 	if (!ctrl || !ctrl->is_int)
829 		return -EINVAL;
830 
831 	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
832 		return -EACCES;
833 
834 	c.value = control->value;
835 	ret = set_ctrl_lock(fh, ctrl, &c);
836 	control->value = c.value;
837 	return ret;
838 }
839 EXPORT_SYMBOL(v4l2_s_ctrl);
840 
841 /*
842  * Helper functions for drivers to get/set controls.
843  */
844 
845 s32 v4l2_ctrl_g_ctrl(struct v4l2_ctrl *ctrl)
846 {
847 	struct v4l2_ext_control c;
848 
849 	/* It's a driver bug if this happens. */
850 	if (WARN_ON(!ctrl->is_int))
851 		return 0;
852 	c.value = 0;
853 	get_ctrl(ctrl, &c);
854 	return c.value;
855 }
856 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl);
857 
858 s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl)
859 {
860 	struct v4l2_ext_control c;
861 
862 	/* It's a driver bug if this happens. */
863 	if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
864 		return 0;
865 	c.value64 = 0;
866 	get_ctrl(ctrl, &c);
867 	return c.value64;
868 }
869 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl_int64);
870 
871 int __v4l2_ctrl_s_ctrl(struct v4l2_ctrl *ctrl, s32 val)
872 {
873 	lockdep_assert_held(ctrl->handler->lock);
874 
875 	/* It's a driver bug if this happens. */
876 	if (WARN_ON(!ctrl->is_int))
877 		return -EINVAL;
878 	ctrl->val = val;
879 	return set_ctrl(NULL, ctrl, 0);
880 }
881 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl);
882 
883 int __v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl *ctrl, s64 val)
884 {
885 	lockdep_assert_held(ctrl->handler->lock);
886 
887 	/* It's a driver bug if this happens. */
888 	if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
889 		return -EINVAL;
890 	*ctrl->p_new.p_s64 = val;
891 	return set_ctrl(NULL, ctrl, 0);
892 }
893 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_int64);
894 
895 int __v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl *ctrl, const char *s)
896 {
897 	lockdep_assert_held(ctrl->handler->lock);
898 
899 	/* It's a driver bug if this happens. */
900 	if (WARN_ON(ctrl->type != V4L2_CTRL_TYPE_STRING))
901 		return -EINVAL;
902 	strscpy(ctrl->p_new.p_char, s, ctrl->maximum + 1);
903 	return set_ctrl(NULL, ctrl, 0);
904 }
905 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_string);
906 
907 int __v4l2_ctrl_s_ctrl_compound(struct v4l2_ctrl *ctrl,
908 				enum v4l2_ctrl_type type, const void *p)
909 {
910 	lockdep_assert_held(ctrl->handler->lock);
911 
912 	/* It's a driver bug if this happens. */
913 	if (WARN_ON(ctrl->type != type))
914 		return -EINVAL;
915 	/* Setting dynamic arrays is not (yet?) supported. */
916 	if (WARN_ON(ctrl->is_dyn_array))
917 		return -EINVAL;
918 	memcpy(ctrl->p_new.p, p, ctrl->elems * ctrl->elem_size);
919 	return set_ctrl(NULL, ctrl, 0);
920 }
921 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_compound);
922 
923 /*
924  * Modify the range of a control.
925  */
926 int __v4l2_ctrl_modify_range(struct v4l2_ctrl *ctrl,
927 			     s64 min, s64 max, u64 step, s64 def)
928 {
929 	bool value_changed;
930 	bool range_changed = false;
931 	int ret;
932 
933 	lockdep_assert_held(ctrl->handler->lock);
934 
935 	switch (ctrl->type) {
936 	case V4L2_CTRL_TYPE_INTEGER:
937 	case V4L2_CTRL_TYPE_INTEGER64:
938 	case V4L2_CTRL_TYPE_BOOLEAN:
939 	case V4L2_CTRL_TYPE_MENU:
940 	case V4L2_CTRL_TYPE_INTEGER_MENU:
941 	case V4L2_CTRL_TYPE_BITMASK:
942 	case V4L2_CTRL_TYPE_U8:
943 	case V4L2_CTRL_TYPE_U16:
944 	case V4L2_CTRL_TYPE_U32:
945 		if (ctrl->is_array)
946 			return -EINVAL;
947 		ret = check_range(ctrl->type, min, max, step, def);
948 		if (ret)
949 			return ret;
950 		break;
951 	default:
952 		return -EINVAL;
953 	}
954 	if (ctrl->minimum != min || ctrl->maximum != max ||
955 	    ctrl->step != step || ctrl->default_value != def) {
956 		range_changed = true;
957 		ctrl->minimum = min;
958 		ctrl->maximum = max;
959 		ctrl->step = step;
960 		ctrl->default_value = def;
961 	}
962 	cur_to_new(ctrl);
963 	if (validate_new(ctrl, ctrl->p_new)) {
964 		if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
965 			*ctrl->p_new.p_s64 = def;
966 		else
967 			*ctrl->p_new.p_s32 = def;
968 	}
969 
970 	if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
971 		value_changed = *ctrl->p_new.p_s64 != *ctrl->p_cur.p_s64;
972 	else
973 		value_changed = *ctrl->p_new.p_s32 != *ctrl->p_cur.p_s32;
974 	if (value_changed)
975 		ret = set_ctrl(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
976 	else if (range_changed)
977 		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
978 	return ret;
979 }
980 EXPORT_SYMBOL(__v4l2_ctrl_modify_range);
981 
982 int __v4l2_ctrl_modify_dimensions(struct v4l2_ctrl *ctrl,
983 				  u32 dims[V4L2_CTRL_MAX_DIMS])
984 {
985 	unsigned int elems = 1;
986 	unsigned int i;
987 	void *p_array;
988 
989 	lockdep_assert_held(ctrl->handler->lock);
990 
991 	if (!ctrl->is_array || ctrl->is_dyn_array)
992 		return -EINVAL;
993 
994 	for (i = 0; i < ctrl->nr_of_dims; i++)
995 		elems *= dims[i];
996 	if (elems == 0)
997 		return -EINVAL;
998 	p_array = kvzalloc(2 * elems * ctrl->elem_size, GFP_KERNEL);
999 	if (!p_array)
1000 		return -ENOMEM;
1001 	kvfree(ctrl->p_array);
1002 	ctrl->p_array_alloc_elems = elems;
1003 	ctrl->elems = elems;
1004 	ctrl->new_elems = elems;
1005 	ctrl->p_array = p_array;
1006 	ctrl->p_new.p = p_array;
1007 	ctrl->p_cur.p = p_array + elems * ctrl->elem_size;
1008 	for (i = 0; i < ctrl->nr_of_dims; i++)
1009 		ctrl->dims[i] = dims[i];
1010 	ctrl->type_ops->init(ctrl, 0, ctrl->p_cur);
1011 	cur_to_new(ctrl);
1012 	send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_VALUE |
1013 			       V4L2_EVENT_CTRL_CH_DIMENSIONS);
1014 	return 0;
1015 }
1016 EXPORT_SYMBOL(__v4l2_ctrl_modify_dimensions);
1017 
1018 /* Implement VIDIOC_QUERY_EXT_CTRL */
1019 int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctrl *qc)
1020 {
1021 	const unsigned int next_flags = V4L2_CTRL_FLAG_NEXT_CTRL | V4L2_CTRL_FLAG_NEXT_COMPOUND;
1022 	u32 id = qc->id & V4L2_CTRL_ID_MASK;
1023 	struct v4l2_ctrl_ref *ref;
1024 	struct v4l2_ctrl *ctrl;
1025 
1026 	if (!hdl)
1027 		return -EINVAL;
1028 
1029 	mutex_lock(hdl->lock);
1030 
1031 	/* Try to find it */
1032 	ref = find_ref(hdl, id);
1033 
1034 	if ((qc->id & next_flags) && !list_empty(&hdl->ctrl_refs)) {
1035 		bool is_compound;
1036 		/* Match any control that is not hidden */
1037 		unsigned int mask = 1;
1038 		bool match = false;
1039 
1040 		if ((qc->id & next_flags) == V4L2_CTRL_FLAG_NEXT_COMPOUND) {
1041 			/* Match any hidden control */
1042 			match = true;
1043 		} else if ((qc->id & next_flags) == next_flags) {
1044 			/* Match any control, compound or not */
1045 			mask = 0;
1046 		}
1047 
1048 		/* Find the next control with ID > qc->id */
1049 
1050 		/* Did we reach the end of the control list? */
1051 		if (id >= node2id(hdl->ctrl_refs.prev)) {
1052 			ref = NULL; /* Yes, so there is no next control */
1053 		} else if (ref) {
1054 			/*
1055 			 * We found a control with the given ID, so just get
1056 			 * the next valid one in the list.
1057 			 */
1058 			list_for_each_entry_continue(ref, &hdl->ctrl_refs, node) {
1059 				is_compound = ref->ctrl->is_array ||
1060 					ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
1061 				if (id < ref->ctrl->id &&
1062 				    (is_compound & mask) == match)
1063 					break;
1064 			}
1065 			if (&ref->node == &hdl->ctrl_refs)
1066 				ref = NULL;
1067 		} else {
1068 			/*
1069 			 * No control with the given ID exists, so start
1070 			 * searching for the next largest ID. We know there
1071 			 * is one, otherwise the first 'if' above would have
1072 			 * been true.
1073 			 */
1074 			list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1075 				is_compound = ref->ctrl->is_array ||
1076 					ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
1077 				if (id < ref->ctrl->id &&
1078 				    (is_compound & mask) == match)
1079 					break;
1080 			}
1081 			if (&ref->node == &hdl->ctrl_refs)
1082 				ref = NULL;
1083 		}
1084 	}
1085 	mutex_unlock(hdl->lock);
1086 
1087 	if (!ref)
1088 		return -EINVAL;
1089 
1090 	ctrl = ref->ctrl;
1091 	memset(qc, 0, sizeof(*qc));
1092 	if (id >= V4L2_CID_PRIVATE_BASE)
1093 		qc->id = id;
1094 	else
1095 		qc->id = ctrl->id;
1096 	strscpy(qc->name, ctrl->name, sizeof(qc->name));
1097 	qc->flags = user_flags(ctrl);
1098 	qc->type = ctrl->type;
1099 	qc->elem_size = ctrl->elem_size;
1100 	qc->elems = ctrl->elems;
1101 	qc->nr_of_dims = ctrl->nr_of_dims;
1102 	memcpy(qc->dims, ctrl->dims, qc->nr_of_dims * sizeof(qc->dims[0]));
1103 	qc->minimum = ctrl->minimum;
1104 	qc->maximum = ctrl->maximum;
1105 	qc->default_value = ctrl->default_value;
1106 	if (ctrl->type == V4L2_CTRL_TYPE_MENU ||
1107 	    ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
1108 		qc->step = 1;
1109 	else
1110 		qc->step = ctrl->step;
1111 	return 0;
1112 }
1113 EXPORT_SYMBOL(v4l2_query_ext_ctrl);
1114 
1115 /* Implement VIDIOC_QUERYCTRL */
1116 int v4l2_queryctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_queryctrl *qc)
1117 {
1118 	struct v4l2_query_ext_ctrl qec = { qc->id };
1119 	int rc;
1120 
1121 	rc = v4l2_query_ext_ctrl(hdl, &qec);
1122 	if (rc)
1123 		return rc;
1124 
1125 	qc->id = qec.id;
1126 	qc->type = qec.type;
1127 	qc->flags = qec.flags;
1128 	strscpy(qc->name, qec.name, sizeof(qc->name));
1129 	switch (qc->type) {
1130 	case V4L2_CTRL_TYPE_INTEGER:
1131 	case V4L2_CTRL_TYPE_BOOLEAN:
1132 	case V4L2_CTRL_TYPE_MENU:
1133 	case V4L2_CTRL_TYPE_INTEGER_MENU:
1134 	case V4L2_CTRL_TYPE_STRING:
1135 	case V4L2_CTRL_TYPE_BITMASK:
1136 		qc->minimum = qec.minimum;
1137 		qc->maximum = qec.maximum;
1138 		qc->step = qec.step;
1139 		qc->default_value = qec.default_value;
1140 		break;
1141 	default:
1142 		qc->minimum = 0;
1143 		qc->maximum = 0;
1144 		qc->step = 0;
1145 		qc->default_value = 0;
1146 		break;
1147 	}
1148 	return 0;
1149 }
1150 EXPORT_SYMBOL(v4l2_queryctrl);
1151 
1152 /* Implement VIDIOC_QUERYMENU */
1153 int v4l2_querymenu(struct v4l2_ctrl_handler *hdl, struct v4l2_querymenu *qm)
1154 {
1155 	struct v4l2_ctrl *ctrl;
1156 	u32 i = qm->index;
1157 
1158 	ctrl = v4l2_ctrl_find(hdl, qm->id);
1159 	if (!ctrl)
1160 		return -EINVAL;
1161 
1162 	qm->reserved = 0;
1163 	/* Sanity checks */
1164 	switch (ctrl->type) {
1165 	case V4L2_CTRL_TYPE_MENU:
1166 		if (!ctrl->qmenu)
1167 			return -EINVAL;
1168 		break;
1169 	case V4L2_CTRL_TYPE_INTEGER_MENU:
1170 		if (!ctrl->qmenu_int)
1171 			return -EINVAL;
1172 		break;
1173 	default:
1174 		return -EINVAL;
1175 	}
1176 
1177 	if (i < ctrl->minimum || i > ctrl->maximum)
1178 		return -EINVAL;
1179 
1180 	/* Use mask to see if this menu item should be skipped */
1181 	if (ctrl->menu_skip_mask & (1ULL << i))
1182 		return -EINVAL;
1183 	/* Empty menu items should also be skipped */
1184 	if (ctrl->type == V4L2_CTRL_TYPE_MENU) {
1185 		if (!ctrl->qmenu[i] || ctrl->qmenu[i][0] == '\0')
1186 			return -EINVAL;
1187 		strscpy(qm->name, ctrl->qmenu[i], sizeof(qm->name));
1188 	} else {
1189 		qm->value = ctrl->qmenu_int[i];
1190 	}
1191 	return 0;
1192 }
1193 EXPORT_SYMBOL(v4l2_querymenu);
1194 
1195 /*
1196  * VIDIOC_LOG_STATUS helpers
1197  */
1198 
1199 int v4l2_ctrl_log_status(struct file *file, void *fh)
1200 {
1201 	struct video_device *vfd = video_devdata(file);
1202 	struct v4l2_fh *vfh = file->private_data;
1203 
1204 	if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags) && vfd->v4l2_dev)
1205 		v4l2_ctrl_handler_log_status(vfh->ctrl_handler,
1206 					     vfd->v4l2_dev->name);
1207 	return 0;
1208 }
1209 EXPORT_SYMBOL(v4l2_ctrl_log_status);
1210 
1211 int v4l2_ctrl_subdev_log_status(struct v4l2_subdev *sd)
1212 {
1213 	v4l2_ctrl_handler_log_status(sd->ctrl_handler, sd->name);
1214 	return 0;
1215 }
1216 EXPORT_SYMBOL(v4l2_ctrl_subdev_log_status);
1217 
1218 /*
1219  * VIDIOC_(UN)SUBSCRIBE_EVENT implementation
1220  */
1221 
1222 static int v4l2_ctrl_add_event(struct v4l2_subscribed_event *sev,
1223 			       unsigned int elems)
1224 {
1225 	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1226 
1227 	if (!ctrl)
1228 		return -EINVAL;
1229 
1230 	v4l2_ctrl_lock(ctrl);
1231 	list_add_tail(&sev->node, &ctrl->ev_subs);
1232 	if (ctrl->type != V4L2_CTRL_TYPE_CTRL_CLASS &&
1233 	    (sev->flags & V4L2_EVENT_SUB_FL_SEND_INITIAL))
1234 		send_initial_event(sev->fh, ctrl);
1235 	v4l2_ctrl_unlock(ctrl);
1236 	return 0;
1237 }
1238 
1239 static void v4l2_ctrl_del_event(struct v4l2_subscribed_event *sev)
1240 {
1241 	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1242 
1243 	if (!ctrl)
1244 		return;
1245 
1246 	v4l2_ctrl_lock(ctrl);
1247 	list_del(&sev->node);
1248 	v4l2_ctrl_unlock(ctrl);
1249 }
1250 
1251 void v4l2_ctrl_replace(struct v4l2_event *old, const struct v4l2_event *new)
1252 {
1253 	u32 old_changes = old->u.ctrl.changes;
1254 
1255 	old->u.ctrl = new->u.ctrl;
1256 	old->u.ctrl.changes |= old_changes;
1257 }
1258 EXPORT_SYMBOL(v4l2_ctrl_replace);
1259 
1260 void v4l2_ctrl_merge(const struct v4l2_event *old, struct v4l2_event *new)
1261 {
1262 	new->u.ctrl.changes |= old->u.ctrl.changes;
1263 }
1264 EXPORT_SYMBOL(v4l2_ctrl_merge);
1265 
1266 const struct v4l2_subscribed_event_ops v4l2_ctrl_sub_ev_ops = {
1267 	.add = v4l2_ctrl_add_event,
1268 	.del = v4l2_ctrl_del_event,
1269 	.replace = v4l2_ctrl_replace,
1270 	.merge = v4l2_ctrl_merge,
1271 };
1272 EXPORT_SYMBOL(v4l2_ctrl_sub_ev_ops);
1273 
1274 int v4l2_ctrl_subscribe_event(struct v4l2_fh *fh,
1275 			      const struct v4l2_event_subscription *sub)
1276 {
1277 	if (sub->type == V4L2_EVENT_CTRL)
1278 		return v4l2_event_subscribe(fh, sub, 0, &v4l2_ctrl_sub_ev_ops);
1279 	return -EINVAL;
1280 }
1281 EXPORT_SYMBOL(v4l2_ctrl_subscribe_event);
1282 
1283 int v4l2_ctrl_subdev_subscribe_event(struct v4l2_subdev *sd, struct v4l2_fh *fh,
1284 				     struct v4l2_event_subscription *sub)
1285 {
1286 	if (!sd->ctrl_handler)
1287 		return -EINVAL;
1288 	return v4l2_ctrl_subscribe_event(fh, sub);
1289 }
1290 EXPORT_SYMBOL(v4l2_ctrl_subdev_subscribe_event);
1291 
1292 /*
1293  * poll helper
1294  */
1295 __poll_t v4l2_ctrl_poll(struct file *file, struct poll_table_struct *wait)
1296 {
1297 	struct v4l2_fh *fh = file->private_data;
1298 
1299 	poll_wait(file, &fh->wait, wait);
1300 	if (v4l2_event_pending(fh))
1301 		return EPOLLPRI;
1302 	return 0;
1303 }
1304 EXPORT_SYMBOL(v4l2_ctrl_poll);
1305