1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * V4L2 controls framework uAPI implementation: 4 * 5 * Copyright (C) 2010-2021 Hans Verkuil <hverkuil-cisco@xs4all.nl> 6 */ 7 8 #define pr_fmt(fmt) "v4l2-ctrls: " fmt 9 10 #include <linux/export.h> 11 #include <linux/mm.h> 12 #include <linux/slab.h> 13 #include <media/v4l2-ctrls.h> 14 #include <media/v4l2-dev.h> 15 #include <media/v4l2-device.h> 16 #include <media/v4l2-event.h> 17 #include <media/v4l2-ioctl.h> 18 19 #include "v4l2-ctrls-priv.h" 20 21 /* Internal temporary helper struct, one for each v4l2_ext_control */ 22 struct v4l2_ctrl_helper { 23 /* Pointer to the control reference of the master control */ 24 struct v4l2_ctrl_ref *mref; 25 /* The control ref corresponding to the v4l2_ext_control ID field. */ 26 struct v4l2_ctrl_ref *ref; 27 /* 28 * v4l2_ext_control index of the next control belonging to the 29 * same cluster, or 0 if there isn't any. 30 */ 31 u32 next; 32 }; 33 34 /* 35 * Helper functions to copy control payload data from kernel space to 36 * user space and vice versa. 37 */ 38 39 /* Helper function: copy the given control value back to the caller */ 40 static int ptr_to_user(struct v4l2_ext_control *c, 41 struct v4l2_ctrl *ctrl, 42 union v4l2_ctrl_ptr ptr) 43 { 44 u32 len; 45 46 if (ctrl->is_ptr && !ctrl->is_string) 47 return copy_to_user(c->ptr, ptr.p_const, c->size) ? 48 -EFAULT : 0; 49 50 switch (ctrl->type) { 51 case V4L2_CTRL_TYPE_STRING: 52 len = strlen(ptr.p_char); 53 if (c->size < len + 1) { 54 c->size = ctrl->elem_size; 55 return -ENOSPC; 56 } 57 return copy_to_user(c->string, ptr.p_char, len + 1) ? 58 -EFAULT : 0; 59 case V4L2_CTRL_TYPE_INTEGER64: 60 c->value64 = *ptr.p_s64; 61 break; 62 default: 63 c->value = *ptr.p_s32; 64 break; 65 } 66 return 0; 67 } 68 69 /* Helper function: copy the current control value back to the caller */ 70 static int cur_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl) 71 { 72 return ptr_to_user(c, ctrl, ctrl->p_cur); 73 } 74 75 /* Helper function: copy the new control value back to the caller */ 76 static int new_to_user(struct v4l2_ext_control *c, 77 struct v4l2_ctrl *ctrl) 78 { 79 return ptr_to_user(c, ctrl, ctrl->p_new); 80 } 81 82 /* Helper function: copy the request value back to the caller */ 83 static int req_to_user(struct v4l2_ext_control *c, 84 struct v4l2_ctrl_ref *ref) 85 { 86 return ptr_to_user(c, ref->ctrl, ref->p_req); 87 } 88 89 /* Helper function: copy the initial control value back to the caller */ 90 static int def_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl) 91 { 92 int idx; 93 94 for (idx = 0; idx < ctrl->elems; idx++) 95 ctrl->type_ops->init(ctrl, idx, ctrl->p_new); 96 97 return ptr_to_user(c, ctrl, ctrl->p_new); 98 } 99 100 /* Helper function: copy the caller-provider value as the new control value */ 101 static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl) 102 { 103 int ret; 104 u32 size; 105 106 ctrl->is_new = 0; 107 if (ctrl->is_dyn_array && 108 c->size > ctrl->p_dyn_alloc_elems * ctrl->elem_size) { 109 void *old = ctrl->p_dyn; 110 void *tmp = kvzalloc(2 * c->size, GFP_KERNEL); 111 112 if (!tmp) 113 return -ENOMEM; 114 memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size); 115 memcpy(tmp + c->size, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size); 116 ctrl->p_new.p = tmp; 117 ctrl->p_cur.p = tmp + c->size; 118 ctrl->p_dyn = tmp; 119 ctrl->p_dyn_alloc_elems = c->size / ctrl->elem_size; 120 kvfree(old); 121 } 122 123 if (ctrl->is_ptr && !ctrl->is_string) { 124 unsigned int elems = c->size / ctrl->elem_size; 125 unsigned int idx; 126 127 if (copy_from_user(ctrl->p_new.p, c->ptr, c->size)) 128 return -EFAULT; 129 ctrl->is_new = 1; 130 if (ctrl->is_dyn_array) 131 ctrl->new_elems = elems; 132 else if (ctrl->is_array) 133 for (idx = elems; idx < ctrl->elems; idx++) 134 ctrl->type_ops->init(ctrl, idx, ctrl->p_new); 135 return 0; 136 } 137 138 switch (ctrl->type) { 139 case V4L2_CTRL_TYPE_INTEGER64: 140 *ctrl->p_new.p_s64 = c->value64; 141 break; 142 case V4L2_CTRL_TYPE_STRING: 143 size = c->size; 144 if (size == 0) 145 return -ERANGE; 146 if (size > ctrl->maximum + 1) 147 size = ctrl->maximum + 1; 148 ret = copy_from_user(ctrl->p_new.p_char, c->string, size) ? -EFAULT : 0; 149 if (!ret) { 150 char last = ctrl->p_new.p_char[size - 1]; 151 152 ctrl->p_new.p_char[size - 1] = 0; 153 /* 154 * If the string was longer than ctrl->maximum, 155 * then return an error. 156 */ 157 if (strlen(ctrl->p_new.p_char) == ctrl->maximum && last) 158 return -ERANGE; 159 } 160 return ret; 161 default: 162 *ctrl->p_new.p_s32 = c->value; 163 break; 164 } 165 ctrl->is_new = 1; 166 return 0; 167 } 168 169 /* 170 * VIDIOC_G/TRY/S_EXT_CTRLS implementation 171 */ 172 173 /* 174 * Some general notes on the atomic requirements of VIDIOC_G/TRY/S_EXT_CTRLS: 175 * 176 * It is not a fully atomic operation, just best-effort only. After all, if 177 * multiple controls have to be set through multiple i2c writes (for example) 178 * then some initial writes may succeed while others fail. Thus leaving the 179 * system in an inconsistent state. The question is how much effort you are 180 * willing to spend on trying to make something atomic that really isn't. 181 * 182 * From the point of view of an application the main requirement is that 183 * when you call VIDIOC_S_EXT_CTRLS and some values are invalid then an 184 * error should be returned without actually affecting any controls. 185 * 186 * If all the values are correct, then it is acceptable to just give up 187 * in case of low-level errors. 188 * 189 * It is important though that the application can tell when only a partial 190 * configuration was done. The way we do that is through the error_idx field 191 * of struct v4l2_ext_controls: if that is equal to the count field then no 192 * controls were affected. Otherwise all controls before that index were 193 * successful in performing their 'get' or 'set' operation, the control at 194 * the given index failed, and you don't know what happened with the controls 195 * after the failed one. Since if they were part of a control cluster they 196 * could have been successfully processed (if a cluster member was encountered 197 * at index < error_idx), they could have failed (if a cluster member was at 198 * error_idx), or they may not have been processed yet (if the first cluster 199 * member appeared after error_idx). 200 * 201 * It is all fairly theoretical, though. In practice all you can do is to 202 * bail out. If error_idx == count, then it is an application bug. If 203 * error_idx < count then it is only an application bug if the error code was 204 * EBUSY. That usually means that something started streaming just when you 205 * tried to set the controls. In all other cases it is a driver/hardware 206 * problem and all you can do is to retry or bail out. 207 * 208 * Note that these rules do not apply to VIDIOC_TRY_EXT_CTRLS: since that 209 * never modifies controls the error_idx is just set to whatever control 210 * has an invalid value. 211 */ 212 213 /* 214 * Prepare for the extended g/s/try functions. 215 * Find the controls in the control array and do some basic checks. 216 */ 217 static int prepare_ext_ctrls(struct v4l2_ctrl_handler *hdl, 218 struct v4l2_ext_controls *cs, 219 struct v4l2_ctrl_helper *helpers, 220 struct video_device *vdev, 221 bool get) 222 { 223 struct v4l2_ctrl_helper *h; 224 bool have_clusters = false; 225 u32 i; 226 227 for (i = 0, h = helpers; i < cs->count; i++, h++) { 228 struct v4l2_ext_control *c = &cs->controls[i]; 229 struct v4l2_ctrl_ref *ref; 230 struct v4l2_ctrl *ctrl; 231 u32 id = c->id & V4L2_CTRL_ID_MASK; 232 233 cs->error_idx = i; 234 235 if (cs->which && 236 cs->which != V4L2_CTRL_WHICH_DEF_VAL && 237 cs->which != V4L2_CTRL_WHICH_REQUEST_VAL && 238 V4L2_CTRL_ID2WHICH(id) != cs->which) { 239 dprintk(vdev, 240 "invalid which 0x%x or control id 0x%x\n", 241 cs->which, id); 242 return -EINVAL; 243 } 244 245 /* 246 * Old-style private controls are not allowed for 247 * extended controls. 248 */ 249 if (id >= V4L2_CID_PRIVATE_BASE) { 250 dprintk(vdev, 251 "old-style private controls not allowed\n"); 252 return -EINVAL; 253 } 254 ref = find_ref_lock(hdl, id); 255 if (!ref) { 256 dprintk(vdev, "cannot find control id 0x%x\n", id); 257 return -EINVAL; 258 } 259 h->ref = ref; 260 ctrl = ref->ctrl; 261 if (ctrl->flags & V4L2_CTRL_FLAG_DISABLED) { 262 dprintk(vdev, "control id 0x%x is disabled\n", id); 263 return -EINVAL; 264 } 265 266 if (ctrl->cluster[0]->ncontrols > 1) 267 have_clusters = true; 268 if (ctrl->cluster[0] != ctrl) 269 ref = find_ref_lock(hdl, ctrl->cluster[0]->id); 270 if (ctrl->is_dyn_array) { 271 unsigned int max_size = ctrl->dims[0] * ctrl->elem_size; 272 unsigned int tot_size = ctrl->elem_size; 273 274 if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL) 275 tot_size *= ref->p_req_elems; 276 else 277 tot_size *= ctrl->elems; 278 279 c->size = ctrl->elem_size * (c->size / ctrl->elem_size); 280 if (get) { 281 if (c->size < tot_size) { 282 c->size = tot_size; 283 return -ENOSPC; 284 } 285 c->size = tot_size; 286 } else { 287 if (c->size > max_size) { 288 c->size = max_size; 289 return -ENOSPC; 290 } 291 if (!c->size) 292 return -EFAULT; 293 } 294 } else if (ctrl->is_ptr && !ctrl->is_string) { 295 unsigned int tot_size = ctrl->elems * ctrl->elem_size; 296 297 if (c->size < tot_size) { 298 /* 299 * In the get case the application first 300 * queries to obtain the size of the control. 301 */ 302 if (get) { 303 c->size = tot_size; 304 return -ENOSPC; 305 } 306 dprintk(vdev, 307 "pointer control id 0x%x size too small, %d bytes but %d bytes needed\n", 308 id, c->size, tot_size); 309 return -EFAULT; 310 } 311 c->size = tot_size; 312 } 313 /* Store the ref to the master control of the cluster */ 314 h->mref = ref; 315 /* 316 * Initially set next to 0, meaning that there is no other 317 * control in this helper array belonging to the same 318 * cluster. 319 */ 320 h->next = 0; 321 } 322 323 /* 324 * We are done if there were no controls that belong to a multi- 325 * control cluster. 326 */ 327 if (!have_clusters) 328 return 0; 329 330 /* 331 * The code below figures out in O(n) time which controls in the list 332 * belong to the same cluster. 333 */ 334 335 /* This has to be done with the handler lock taken. */ 336 mutex_lock(hdl->lock); 337 338 /* First zero the helper field in the master control references */ 339 for (i = 0; i < cs->count; i++) 340 helpers[i].mref->helper = NULL; 341 for (i = 0, h = helpers; i < cs->count; i++, h++) { 342 struct v4l2_ctrl_ref *mref = h->mref; 343 344 /* 345 * If the mref->helper is set, then it points to an earlier 346 * helper that belongs to the same cluster. 347 */ 348 if (mref->helper) { 349 /* 350 * Set the next field of mref->helper to the current 351 * index: this means that the earlier helper now 352 * points to the next helper in the same cluster. 353 */ 354 mref->helper->next = i; 355 /* 356 * mref should be set only for the first helper in the 357 * cluster, clear the others. 358 */ 359 h->mref = NULL; 360 } 361 /* Point the mref helper to the current helper struct. */ 362 mref->helper = h; 363 } 364 mutex_unlock(hdl->lock); 365 return 0; 366 } 367 368 /* 369 * Handles the corner case where cs->count == 0. It checks whether the 370 * specified control class exists. If that class ID is 0, then it checks 371 * whether there are any controls at all. 372 */ 373 static int class_check(struct v4l2_ctrl_handler *hdl, u32 which) 374 { 375 if (which == 0 || which == V4L2_CTRL_WHICH_DEF_VAL || 376 which == V4L2_CTRL_WHICH_REQUEST_VAL) 377 return 0; 378 return find_ref_lock(hdl, which | 1) ? 0 : -EINVAL; 379 } 380 381 /* 382 * Get extended controls. Allocates the helpers array if needed. 383 * 384 * Note that v4l2_g_ext_ctrls_common() with 'which' set to 385 * V4L2_CTRL_WHICH_REQUEST_VAL is only called if the request was 386 * completed, and in that case p_req_valid is true for all controls. 387 */ 388 int v4l2_g_ext_ctrls_common(struct v4l2_ctrl_handler *hdl, 389 struct v4l2_ext_controls *cs, 390 struct video_device *vdev) 391 { 392 struct v4l2_ctrl_helper helper[4]; 393 struct v4l2_ctrl_helper *helpers = helper; 394 int ret; 395 int i, j; 396 bool is_default, is_request; 397 398 is_default = (cs->which == V4L2_CTRL_WHICH_DEF_VAL); 399 is_request = (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL); 400 401 cs->error_idx = cs->count; 402 cs->which = V4L2_CTRL_ID2WHICH(cs->which); 403 404 if (!hdl) 405 return -EINVAL; 406 407 if (cs->count == 0) 408 return class_check(hdl, cs->which); 409 410 if (cs->count > ARRAY_SIZE(helper)) { 411 helpers = kvmalloc_array(cs->count, sizeof(helper[0]), 412 GFP_KERNEL); 413 if (!helpers) 414 return -ENOMEM; 415 } 416 417 ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, true); 418 cs->error_idx = cs->count; 419 420 for (i = 0; !ret && i < cs->count; i++) 421 if (helpers[i].ref->ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY) 422 ret = -EACCES; 423 424 for (i = 0; !ret && i < cs->count; i++) { 425 struct v4l2_ctrl *master; 426 bool is_volatile = false; 427 u32 idx = i; 428 429 if (!helpers[i].mref) 430 continue; 431 432 master = helpers[i].mref->ctrl; 433 cs->error_idx = i; 434 435 v4l2_ctrl_lock(master); 436 437 /* 438 * g_volatile_ctrl will update the new control values. 439 * This makes no sense for V4L2_CTRL_WHICH_DEF_VAL and 440 * V4L2_CTRL_WHICH_REQUEST_VAL. In the case of requests 441 * it is v4l2_ctrl_request_complete() that copies the 442 * volatile controls at the time of request completion 443 * to the request, so you don't want to do that again. 444 */ 445 if (!is_default && !is_request && 446 ((master->flags & V4L2_CTRL_FLAG_VOLATILE) || 447 (master->has_volatiles && !is_cur_manual(master)))) { 448 for (j = 0; j < master->ncontrols; j++) 449 cur_to_new(master->cluster[j]); 450 ret = call_op(master, g_volatile_ctrl); 451 is_volatile = true; 452 } 453 454 if (ret) { 455 v4l2_ctrl_unlock(master); 456 break; 457 } 458 459 /* 460 * Copy the default value (if is_default is true), the 461 * request value (if is_request is true and p_req is valid), 462 * the new volatile value (if is_volatile is true) or the 463 * current value. 464 */ 465 do { 466 struct v4l2_ctrl_ref *ref = helpers[idx].ref; 467 468 if (is_default) 469 ret = def_to_user(cs->controls + idx, ref->ctrl); 470 else if (is_request && ref->p_req_dyn_enomem) 471 ret = -ENOMEM; 472 else if (is_request && ref->p_req_valid) 473 ret = req_to_user(cs->controls + idx, ref); 474 else if (is_volatile) 475 ret = new_to_user(cs->controls + idx, ref->ctrl); 476 else 477 ret = cur_to_user(cs->controls + idx, ref->ctrl); 478 idx = helpers[idx].next; 479 } while (!ret && idx); 480 481 v4l2_ctrl_unlock(master); 482 } 483 484 if (cs->count > ARRAY_SIZE(helper)) 485 kvfree(helpers); 486 return ret; 487 } 488 489 int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct video_device *vdev, 490 struct media_device *mdev, struct v4l2_ext_controls *cs) 491 { 492 if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL) 493 return v4l2_g_ext_ctrls_request(hdl, vdev, mdev, cs); 494 495 return v4l2_g_ext_ctrls_common(hdl, cs, vdev); 496 } 497 EXPORT_SYMBOL(v4l2_g_ext_ctrls); 498 499 /* Validate a new control */ 500 static int validate_new(const struct v4l2_ctrl *ctrl, union v4l2_ctrl_ptr p_new) 501 { 502 unsigned int idx; 503 int err = 0; 504 505 for (idx = 0; !err && idx < ctrl->new_elems; idx++) 506 err = ctrl->type_ops->validate(ctrl, idx, p_new); 507 return err; 508 } 509 510 /* Validate controls. */ 511 static int validate_ctrls(struct v4l2_ext_controls *cs, 512 struct v4l2_ctrl_helper *helpers, 513 struct video_device *vdev, 514 bool set) 515 { 516 unsigned int i; 517 int ret = 0; 518 519 cs->error_idx = cs->count; 520 for (i = 0; i < cs->count; i++) { 521 struct v4l2_ctrl *ctrl = helpers[i].ref->ctrl; 522 union v4l2_ctrl_ptr p_new; 523 524 cs->error_idx = i; 525 526 if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY) { 527 dprintk(vdev, 528 "control id 0x%x is read-only\n", 529 ctrl->id); 530 return -EACCES; 531 } 532 /* 533 * This test is also done in try_set_control_cluster() which 534 * is called in atomic context, so that has the final say, 535 * but it makes sense to do an up-front check as well. Once 536 * an error occurs in try_set_control_cluster() some other 537 * controls may have been set already and we want to do a 538 * best-effort to avoid that. 539 */ 540 if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)) { 541 dprintk(vdev, 542 "control id 0x%x is grabbed, cannot set\n", 543 ctrl->id); 544 return -EBUSY; 545 } 546 /* 547 * Skip validation for now if the payload needs to be copied 548 * from userspace into kernelspace. We'll validate those later. 549 */ 550 if (ctrl->is_ptr) 551 continue; 552 if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64) 553 p_new.p_s64 = &cs->controls[i].value64; 554 else 555 p_new.p_s32 = &cs->controls[i].value; 556 ret = validate_new(ctrl, p_new); 557 if (ret) 558 return ret; 559 } 560 return 0; 561 } 562 563 /* Try or try-and-set controls */ 564 int try_set_ext_ctrls_common(struct v4l2_fh *fh, 565 struct v4l2_ctrl_handler *hdl, 566 struct v4l2_ext_controls *cs, 567 struct video_device *vdev, bool set) 568 { 569 struct v4l2_ctrl_helper helper[4]; 570 struct v4l2_ctrl_helper *helpers = helper; 571 unsigned int i, j; 572 int ret; 573 574 cs->error_idx = cs->count; 575 576 /* Default value cannot be changed */ 577 if (cs->which == V4L2_CTRL_WHICH_DEF_VAL) { 578 dprintk(vdev, "%s: cannot change default value\n", 579 video_device_node_name(vdev)); 580 return -EINVAL; 581 } 582 583 cs->which = V4L2_CTRL_ID2WHICH(cs->which); 584 585 if (!hdl) { 586 dprintk(vdev, "%s: invalid null control handler\n", 587 video_device_node_name(vdev)); 588 return -EINVAL; 589 } 590 591 if (cs->count == 0) 592 return class_check(hdl, cs->which); 593 594 if (cs->count > ARRAY_SIZE(helper)) { 595 helpers = kvmalloc_array(cs->count, sizeof(helper[0]), 596 GFP_KERNEL); 597 if (!helpers) 598 return -ENOMEM; 599 } 600 ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, false); 601 if (!ret) 602 ret = validate_ctrls(cs, helpers, vdev, set); 603 if (ret && set) 604 cs->error_idx = cs->count; 605 for (i = 0; !ret && i < cs->count; i++) { 606 struct v4l2_ctrl *master; 607 u32 idx = i; 608 609 if (!helpers[i].mref) 610 continue; 611 612 cs->error_idx = i; 613 master = helpers[i].mref->ctrl; 614 v4l2_ctrl_lock(master); 615 616 /* Reset the 'is_new' flags of the cluster */ 617 for (j = 0; j < master->ncontrols; j++) 618 if (master->cluster[j]) 619 master->cluster[j]->is_new = 0; 620 621 /* 622 * For volatile autoclusters that are currently in auto mode 623 * we need to discover if it will be set to manual mode. 624 * If so, then we have to copy the current volatile values 625 * first since those will become the new manual values (which 626 * may be overwritten by explicit new values from this set 627 * of controls). 628 */ 629 if (master->is_auto && master->has_volatiles && 630 !is_cur_manual(master)) { 631 /* Pick an initial non-manual value */ 632 s32 new_auto_val = master->manual_mode_value + 1; 633 u32 tmp_idx = idx; 634 635 do { 636 /* 637 * Check if the auto control is part of the 638 * list, and remember the new value. 639 */ 640 if (helpers[tmp_idx].ref->ctrl == master) 641 new_auto_val = cs->controls[tmp_idx].value; 642 tmp_idx = helpers[tmp_idx].next; 643 } while (tmp_idx); 644 /* 645 * If the new value == the manual value, then copy 646 * the current volatile values. 647 */ 648 if (new_auto_val == master->manual_mode_value) 649 update_from_auto_cluster(master); 650 } 651 652 /* 653 * Copy the new caller-supplied control values. 654 * user_to_new() sets 'is_new' to 1. 655 */ 656 do { 657 struct v4l2_ctrl *ctrl = helpers[idx].ref->ctrl; 658 659 ret = user_to_new(cs->controls + idx, ctrl); 660 if (!ret && ctrl->is_ptr) { 661 ret = validate_new(ctrl, ctrl->p_new); 662 if (ret) 663 dprintk(vdev, 664 "failed to validate control %s (%d)\n", 665 v4l2_ctrl_get_name(ctrl->id), ret); 666 } 667 idx = helpers[idx].next; 668 } while (!ret && idx); 669 670 if (!ret) 671 ret = try_or_set_cluster(fh, master, 672 !hdl->req_obj.req && set, 0); 673 if (!ret && hdl->req_obj.req && set) { 674 for (j = 0; j < master->ncontrols; j++) { 675 struct v4l2_ctrl_ref *ref = 676 find_ref(hdl, master->cluster[j]->id); 677 678 new_to_req(ref); 679 } 680 } 681 682 /* Copy the new values back to userspace. */ 683 if (!ret) { 684 idx = i; 685 do { 686 ret = new_to_user(cs->controls + idx, 687 helpers[idx].ref->ctrl); 688 idx = helpers[idx].next; 689 } while (!ret && idx); 690 } 691 v4l2_ctrl_unlock(master); 692 } 693 694 if (cs->count > ARRAY_SIZE(helper)) 695 kvfree(helpers); 696 return ret; 697 } 698 699 static int try_set_ext_ctrls(struct v4l2_fh *fh, 700 struct v4l2_ctrl_handler *hdl, 701 struct video_device *vdev, 702 struct media_device *mdev, 703 struct v4l2_ext_controls *cs, bool set) 704 { 705 int ret; 706 707 if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL) 708 return try_set_ext_ctrls_request(fh, hdl, vdev, mdev, cs, set); 709 710 ret = try_set_ext_ctrls_common(fh, hdl, cs, vdev, set); 711 if (ret) 712 dprintk(vdev, 713 "%s: try_set_ext_ctrls_common failed (%d)\n", 714 video_device_node_name(vdev), ret); 715 716 return ret; 717 } 718 719 int v4l2_try_ext_ctrls(struct v4l2_ctrl_handler *hdl, 720 struct video_device *vdev, 721 struct media_device *mdev, 722 struct v4l2_ext_controls *cs) 723 { 724 return try_set_ext_ctrls(NULL, hdl, vdev, mdev, cs, false); 725 } 726 EXPORT_SYMBOL(v4l2_try_ext_ctrls); 727 728 int v4l2_s_ext_ctrls(struct v4l2_fh *fh, 729 struct v4l2_ctrl_handler *hdl, 730 struct video_device *vdev, 731 struct media_device *mdev, 732 struct v4l2_ext_controls *cs) 733 { 734 return try_set_ext_ctrls(fh, hdl, vdev, mdev, cs, true); 735 } 736 EXPORT_SYMBOL(v4l2_s_ext_ctrls); 737 738 /* 739 * VIDIOC_G/S_CTRL implementation 740 */ 741 742 /* Helper function to get a single control */ 743 static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c) 744 { 745 struct v4l2_ctrl *master = ctrl->cluster[0]; 746 int ret = 0; 747 int i; 748 749 /* Compound controls are not supported. The new_to_user() and 750 * cur_to_user() calls below would need to be modified not to access 751 * userspace memory when called from get_ctrl(). 752 */ 753 if (!ctrl->is_int && ctrl->type != V4L2_CTRL_TYPE_INTEGER64) 754 return -EINVAL; 755 756 if (ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY) 757 return -EACCES; 758 759 v4l2_ctrl_lock(master); 760 /* g_volatile_ctrl will update the current control values */ 761 if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) { 762 for (i = 0; i < master->ncontrols; i++) 763 cur_to_new(master->cluster[i]); 764 ret = call_op(master, g_volatile_ctrl); 765 new_to_user(c, ctrl); 766 } else { 767 cur_to_user(c, ctrl); 768 } 769 v4l2_ctrl_unlock(master); 770 return ret; 771 } 772 773 int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_control *control) 774 { 775 struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id); 776 struct v4l2_ext_control c; 777 int ret; 778 779 if (!ctrl || !ctrl->is_int) 780 return -EINVAL; 781 ret = get_ctrl(ctrl, &c); 782 control->value = c.value; 783 return ret; 784 } 785 EXPORT_SYMBOL(v4l2_g_ctrl); 786 787 /* Helper function for VIDIOC_S_CTRL compatibility */ 788 static int set_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags) 789 { 790 struct v4l2_ctrl *master = ctrl->cluster[0]; 791 int ret; 792 int i; 793 794 /* Reset the 'is_new' flags of the cluster */ 795 for (i = 0; i < master->ncontrols; i++) 796 if (master->cluster[i]) 797 master->cluster[i]->is_new = 0; 798 799 ret = validate_new(ctrl, ctrl->p_new); 800 if (ret) 801 return ret; 802 803 /* 804 * For autoclusters with volatiles that are switched from auto to 805 * manual mode we have to update the current volatile values since 806 * those will become the initial manual values after such a switch. 807 */ 808 if (master->is_auto && master->has_volatiles && ctrl == master && 809 !is_cur_manual(master) && ctrl->val == master->manual_mode_value) 810 update_from_auto_cluster(master); 811 812 ctrl->is_new = 1; 813 return try_or_set_cluster(fh, master, true, ch_flags); 814 } 815 816 /* Helper function for VIDIOC_S_CTRL compatibility */ 817 static int set_ctrl_lock(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, 818 struct v4l2_ext_control *c) 819 { 820 int ret; 821 822 v4l2_ctrl_lock(ctrl); 823 user_to_new(c, ctrl); 824 ret = set_ctrl(fh, ctrl, 0); 825 if (!ret) 826 cur_to_user(c, ctrl); 827 v4l2_ctrl_unlock(ctrl); 828 return ret; 829 } 830 831 int v4l2_s_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl_handler *hdl, 832 struct v4l2_control *control) 833 { 834 struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id); 835 struct v4l2_ext_control c = { control->id }; 836 int ret; 837 838 if (!ctrl || !ctrl->is_int) 839 return -EINVAL; 840 841 if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY) 842 return -EACCES; 843 844 c.value = control->value; 845 ret = set_ctrl_lock(fh, ctrl, &c); 846 control->value = c.value; 847 return ret; 848 } 849 EXPORT_SYMBOL(v4l2_s_ctrl); 850 851 /* 852 * Helper functions for drivers to get/set controls. 853 */ 854 855 s32 v4l2_ctrl_g_ctrl(struct v4l2_ctrl *ctrl) 856 { 857 struct v4l2_ext_control c; 858 859 /* It's a driver bug if this happens. */ 860 if (WARN_ON(!ctrl->is_int)) 861 return 0; 862 c.value = 0; 863 get_ctrl(ctrl, &c); 864 return c.value; 865 } 866 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl); 867 868 s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl) 869 { 870 struct v4l2_ext_control c; 871 872 /* It's a driver bug if this happens. */ 873 if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64)) 874 return 0; 875 c.value64 = 0; 876 get_ctrl(ctrl, &c); 877 return c.value64; 878 } 879 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl_int64); 880 881 int __v4l2_ctrl_s_ctrl(struct v4l2_ctrl *ctrl, s32 val) 882 { 883 lockdep_assert_held(ctrl->handler->lock); 884 885 /* It's a driver bug if this happens. */ 886 if (WARN_ON(!ctrl->is_int)) 887 return -EINVAL; 888 ctrl->val = val; 889 return set_ctrl(NULL, ctrl, 0); 890 } 891 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl); 892 893 int __v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl *ctrl, s64 val) 894 { 895 lockdep_assert_held(ctrl->handler->lock); 896 897 /* It's a driver bug if this happens. */ 898 if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64)) 899 return -EINVAL; 900 *ctrl->p_new.p_s64 = val; 901 return set_ctrl(NULL, ctrl, 0); 902 } 903 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_int64); 904 905 int __v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl *ctrl, const char *s) 906 { 907 lockdep_assert_held(ctrl->handler->lock); 908 909 /* It's a driver bug if this happens. */ 910 if (WARN_ON(ctrl->type != V4L2_CTRL_TYPE_STRING)) 911 return -EINVAL; 912 strscpy(ctrl->p_new.p_char, s, ctrl->maximum + 1); 913 return set_ctrl(NULL, ctrl, 0); 914 } 915 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_string); 916 917 int __v4l2_ctrl_s_ctrl_compound(struct v4l2_ctrl *ctrl, 918 enum v4l2_ctrl_type type, const void *p) 919 { 920 lockdep_assert_held(ctrl->handler->lock); 921 922 /* It's a driver bug if this happens. */ 923 if (WARN_ON(ctrl->type != type)) 924 return -EINVAL; 925 /* Setting dynamic arrays is not (yet?) supported. */ 926 if (WARN_ON(ctrl->is_dyn_array)) 927 return -EINVAL; 928 memcpy(ctrl->p_new.p, p, ctrl->elems * ctrl->elem_size); 929 return set_ctrl(NULL, ctrl, 0); 930 } 931 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_compound); 932 933 /* 934 * Modify the range of a control. 935 */ 936 int __v4l2_ctrl_modify_range(struct v4l2_ctrl *ctrl, 937 s64 min, s64 max, u64 step, s64 def) 938 { 939 bool value_changed; 940 bool range_changed = false; 941 int ret; 942 943 lockdep_assert_held(ctrl->handler->lock); 944 945 switch (ctrl->type) { 946 case V4L2_CTRL_TYPE_INTEGER: 947 case V4L2_CTRL_TYPE_INTEGER64: 948 case V4L2_CTRL_TYPE_BOOLEAN: 949 case V4L2_CTRL_TYPE_MENU: 950 case V4L2_CTRL_TYPE_INTEGER_MENU: 951 case V4L2_CTRL_TYPE_BITMASK: 952 case V4L2_CTRL_TYPE_U8: 953 case V4L2_CTRL_TYPE_U16: 954 case V4L2_CTRL_TYPE_U32: 955 if (ctrl->is_array) 956 return -EINVAL; 957 ret = check_range(ctrl->type, min, max, step, def); 958 if (ret) 959 return ret; 960 break; 961 default: 962 return -EINVAL; 963 } 964 if (ctrl->minimum != min || ctrl->maximum != max || 965 ctrl->step != step || ctrl->default_value != def) { 966 range_changed = true; 967 ctrl->minimum = min; 968 ctrl->maximum = max; 969 ctrl->step = step; 970 ctrl->default_value = def; 971 } 972 cur_to_new(ctrl); 973 if (validate_new(ctrl, ctrl->p_new)) { 974 if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64) 975 *ctrl->p_new.p_s64 = def; 976 else 977 *ctrl->p_new.p_s32 = def; 978 } 979 980 if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64) 981 value_changed = *ctrl->p_new.p_s64 != *ctrl->p_cur.p_s64; 982 else 983 value_changed = *ctrl->p_new.p_s32 != *ctrl->p_cur.p_s32; 984 if (value_changed) 985 ret = set_ctrl(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE); 986 else if (range_changed) 987 send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE); 988 return ret; 989 } 990 EXPORT_SYMBOL(__v4l2_ctrl_modify_range); 991 992 /* Implement VIDIOC_QUERY_EXT_CTRL */ 993 int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctrl *qc) 994 { 995 const unsigned int next_flags = V4L2_CTRL_FLAG_NEXT_CTRL | V4L2_CTRL_FLAG_NEXT_COMPOUND; 996 u32 id = qc->id & V4L2_CTRL_ID_MASK; 997 struct v4l2_ctrl_ref *ref; 998 struct v4l2_ctrl *ctrl; 999 1000 if (!hdl) 1001 return -EINVAL; 1002 1003 mutex_lock(hdl->lock); 1004 1005 /* Try to find it */ 1006 ref = find_ref(hdl, id); 1007 1008 if ((qc->id & next_flags) && !list_empty(&hdl->ctrl_refs)) { 1009 bool is_compound; 1010 /* Match any control that is not hidden */ 1011 unsigned int mask = 1; 1012 bool match = false; 1013 1014 if ((qc->id & next_flags) == V4L2_CTRL_FLAG_NEXT_COMPOUND) { 1015 /* Match any hidden control */ 1016 match = true; 1017 } else if ((qc->id & next_flags) == next_flags) { 1018 /* Match any control, compound or not */ 1019 mask = 0; 1020 } 1021 1022 /* Find the next control with ID > qc->id */ 1023 1024 /* Did we reach the end of the control list? */ 1025 if (id >= node2id(hdl->ctrl_refs.prev)) { 1026 ref = NULL; /* Yes, so there is no next control */ 1027 } else if (ref) { 1028 /* 1029 * We found a control with the given ID, so just get 1030 * the next valid one in the list. 1031 */ 1032 list_for_each_entry_continue(ref, &hdl->ctrl_refs, node) { 1033 is_compound = ref->ctrl->is_array || 1034 ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES; 1035 if (id < ref->ctrl->id && 1036 (is_compound & mask) == match) 1037 break; 1038 } 1039 if (&ref->node == &hdl->ctrl_refs) 1040 ref = NULL; 1041 } else { 1042 /* 1043 * No control with the given ID exists, so start 1044 * searching for the next largest ID. We know there 1045 * is one, otherwise the first 'if' above would have 1046 * been true. 1047 */ 1048 list_for_each_entry(ref, &hdl->ctrl_refs, node) { 1049 is_compound = ref->ctrl->is_array || 1050 ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES; 1051 if (id < ref->ctrl->id && 1052 (is_compound & mask) == match) 1053 break; 1054 } 1055 if (&ref->node == &hdl->ctrl_refs) 1056 ref = NULL; 1057 } 1058 } 1059 mutex_unlock(hdl->lock); 1060 1061 if (!ref) 1062 return -EINVAL; 1063 1064 ctrl = ref->ctrl; 1065 memset(qc, 0, sizeof(*qc)); 1066 if (id >= V4L2_CID_PRIVATE_BASE) 1067 qc->id = id; 1068 else 1069 qc->id = ctrl->id; 1070 strscpy(qc->name, ctrl->name, sizeof(qc->name)); 1071 qc->flags = user_flags(ctrl); 1072 qc->type = ctrl->type; 1073 qc->elem_size = ctrl->elem_size; 1074 qc->elems = ctrl->elems; 1075 qc->nr_of_dims = ctrl->nr_of_dims; 1076 memcpy(qc->dims, ctrl->dims, qc->nr_of_dims * sizeof(qc->dims[0])); 1077 qc->minimum = ctrl->minimum; 1078 qc->maximum = ctrl->maximum; 1079 qc->default_value = ctrl->default_value; 1080 if (ctrl->type == V4L2_CTRL_TYPE_MENU || 1081 ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU) 1082 qc->step = 1; 1083 else 1084 qc->step = ctrl->step; 1085 return 0; 1086 } 1087 EXPORT_SYMBOL(v4l2_query_ext_ctrl); 1088 1089 /* Implement VIDIOC_QUERYCTRL */ 1090 int v4l2_queryctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_queryctrl *qc) 1091 { 1092 struct v4l2_query_ext_ctrl qec = { qc->id }; 1093 int rc; 1094 1095 rc = v4l2_query_ext_ctrl(hdl, &qec); 1096 if (rc) 1097 return rc; 1098 1099 qc->id = qec.id; 1100 qc->type = qec.type; 1101 qc->flags = qec.flags; 1102 strscpy(qc->name, qec.name, sizeof(qc->name)); 1103 switch (qc->type) { 1104 case V4L2_CTRL_TYPE_INTEGER: 1105 case V4L2_CTRL_TYPE_BOOLEAN: 1106 case V4L2_CTRL_TYPE_MENU: 1107 case V4L2_CTRL_TYPE_INTEGER_MENU: 1108 case V4L2_CTRL_TYPE_STRING: 1109 case V4L2_CTRL_TYPE_BITMASK: 1110 qc->minimum = qec.minimum; 1111 qc->maximum = qec.maximum; 1112 qc->step = qec.step; 1113 qc->default_value = qec.default_value; 1114 break; 1115 default: 1116 qc->minimum = 0; 1117 qc->maximum = 0; 1118 qc->step = 0; 1119 qc->default_value = 0; 1120 break; 1121 } 1122 return 0; 1123 } 1124 EXPORT_SYMBOL(v4l2_queryctrl); 1125 1126 /* Implement VIDIOC_QUERYMENU */ 1127 int v4l2_querymenu(struct v4l2_ctrl_handler *hdl, struct v4l2_querymenu *qm) 1128 { 1129 struct v4l2_ctrl *ctrl; 1130 u32 i = qm->index; 1131 1132 ctrl = v4l2_ctrl_find(hdl, qm->id); 1133 if (!ctrl) 1134 return -EINVAL; 1135 1136 qm->reserved = 0; 1137 /* Sanity checks */ 1138 switch (ctrl->type) { 1139 case V4L2_CTRL_TYPE_MENU: 1140 if (!ctrl->qmenu) 1141 return -EINVAL; 1142 break; 1143 case V4L2_CTRL_TYPE_INTEGER_MENU: 1144 if (!ctrl->qmenu_int) 1145 return -EINVAL; 1146 break; 1147 default: 1148 return -EINVAL; 1149 } 1150 1151 if (i < ctrl->minimum || i > ctrl->maximum) 1152 return -EINVAL; 1153 1154 /* Use mask to see if this menu item should be skipped */ 1155 if (ctrl->menu_skip_mask & (1ULL << i)) 1156 return -EINVAL; 1157 /* Empty menu items should also be skipped */ 1158 if (ctrl->type == V4L2_CTRL_TYPE_MENU) { 1159 if (!ctrl->qmenu[i] || ctrl->qmenu[i][0] == '\0') 1160 return -EINVAL; 1161 strscpy(qm->name, ctrl->qmenu[i], sizeof(qm->name)); 1162 } else { 1163 qm->value = ctrl->qmenu_int[i]; 1164 } 1165 return 0; 1166 } 1167 EXPORT_SYMBOL(v4l2_querymenu); 1168 1169 /* 1170 * VIDIOC_LOG_STATUS helpers 1171 */ 1172 1173 int v4l2_ctrl_log_status(struct file *file, void *fh) 1174 { 1175 struct video_device *vfd = video_devdata(file); 1176 struct v4l2_fh *vfh = file->private_data; 1177 1178 if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags) && vfd->v4l2_dev) 1179 v4l2_ctrl_handler_log_status(vfh->ctrl_handler, 1180 vfd->v4l2_dev->name); 1181 return 0; 1182 } 1183 EXPORT_SYMBOL(v4l2_ctrl_log_status); 1184 1185 int v4l2_ctrl_subdev_log_status(struct v4l2_subdev *sd) 1186 { 1187 v4l2_ctrl_handler_log_status(sd->ctrl_handler, sd->name); 1188 return 0; 1189 } 1190 EXPORT_SYMBOL(v4l2_ctrl_subdev_log_status); 1191 1192 /* 1193 * VIDIOC_(UN)SUBSCRIBE_EVENT implementation 1194 */ 1195 1196 static int v4l2_ctrl_add_event(struct v4l2_subscribed_event *sev, 1197 unsigned int elems) 1198 { 1199 struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id); 1200 1201 if (!ctrl) 1202 return -EINVAL; 1203 1204 v4l2_ctrl_lock(ctrl); 1205 list_add_tail(&sev->node, &ctrl->ev_subs); 1206 if (ctrl->type != V4L2_CTRL_TYPE_CTRL_CLASS && 1207 (sev->flags & V4L2_EVENT_SUB_FL_SEND_INITIAL)) 1208 send_initial_event(sev->fh, ctrl); 1209 v4l2_ctrl_unlock(ctrl); 1210 return 0; 1211 } 1212 1213 static void v4l2_ctrl_del_event(struct v4l2_subscribed_event *sev) 1214 { 1215 struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id); 1216 1217 if (!ctrl) 1218 return; 1219 1220 v4l2_ctrl_lock(ctrl); 1221 list_del(&sev->node); 1222 v4l2_ctrl_unlock(ctrl); 1223 } 1224 1225 void v4l2_ctrl_replace(struct v4l2_event *old, const struct v4l2_event *new) 1226 { 1227 u32 old_changes = old->u.ctrl.changes; 1228 1229 old->u.ctrl = new->u.ctrl; 1230 old->u.ctrl.changes |= old_changes; 1231 } 1232 EXPORT_SYMBOL(v4l2_ctrl_replace); 1233 1234 void v4l2_ctrl_merge(const struct v4l2_event *old, struct v4l2_event *new) 1235 { 1236 new->u.ctrl.changes |= old->u.ctrl.changes; 1237 } 1238 EXPORT_SYMBOL(v4l2_ctrl_merge); 1239 1240 const struct v4l2_subscribed_event_ops v4l2_ctrl_sub_ev_ops = { 1241 .add = v4l2_ctrl_add_event, 1242 .del = v4l2_ctrl_del_event, 1243 .replace = v4l2_ctrl_replace, 1244 .merge = v4l2_ctrl_merge, 1245 }; 1246 EXPORT_SYMBOL(v4l2_ctrl_sub_ev_ops); 1247 1248 int v4l2_ctrl_subscribe_event(struct v4l2_fh *fh, 1249 const struct v4l2_event_subscription *sub) 1250 { 1251 if (sub->type == V4L2_EVENT_CTRL) 1252 return v4l2_event_subscribe(fh, sub, 0, &v4l2_ctrl_sub_ev_ops); 1253 return -EINVAL; 1254 } 1255 EXPORT_SYMBOL(v4l2_ctrl_subscribe_event); 1256 1257 int v4l2_ctrl_subdev_subscribe_event(struct v4l2_subdev *sd, struct v4l2_fh *fh, 1258 struct v4l2_event_subscription *sub) 1259 { 1260 if (!sd->ctrl_handler) 1261 return -EINVAL; 1262 return v4l2_ctrl_subscribe_event(fh, sub); 1263 } 1264 EXPORT_SYMBOL(v4l2_ctrl_subdev_subscribe_event); 1265 1266 /* 1267 * poll helper 1268 */ 1269 __poll_t v4l2_ctrl_poll(struct file *file, struct poll_table_struct *wait) 1270 { 1271 struct v4l2_fh *fh = file->private_data; 1272 1273 poll_wait(file, &fh->wait, wait); 1274 if (v4l2_event_pending(fh)) 1275 return EPOLLPRI; 1276 return 0; 1277 } 1278 EXPORT_SYMBOL(v4l2_ctrl_poll); 1279