1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * V4L2 controls framework core implementation.
4  *
5  * Copyright (C) 2010-2021  Hans Verkuil <hverkuil-cisco@xs4all.nl>
6  */
7 
8 #include <linux/export.h>
9 #include <linux/mm.h>
10 #include <linux/slab.h>
11 #include <media/v4l2-ctrls.h>
12 #include <media/v4l2-event.h>
13 #include <media/v4l2-fwnode.h>
14 
15 #include "v4l2-ctrls-priv.h"
16 
17 static const union v4l2_ctrl_ptr ptr_null;
18 
19 static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl,
20 		       u32 changes)
21 {
22 	memset(ev, 0, sizeof(*ev));
23 	ev->type = V4L2_EVENT_CTRL;
24 	ev->id = ctrl->id;
25 	ev->u.ctrl.changes = changes;
26 	ev->u.ctrl.type = ctrl->type;
27 	ev->u.ctrl.flags = user_flags(ctrl);
28 	if (ctrl->is_ptr)
29 		ev->u.ctrl.value64 = 0;
30 	else
31 		ev->u.ctrl.value64 = *ctrl->p_cur.p_s64;
32 	ev->u.ctrl.minimum = ctrl->minimum;
33 	ev->u.ctrl.maximum = ctrl->maximum;
34 	if (ctrl->type == V4L2_CTRL_TYPE_MENU
35 	    || ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
36 		ev->u.ctrl.step = 1;
37 	else
38 		ev->u.ctrl.step = ctrl->step;
39 	ev->u.ctrl.default_value = ctrl->default_value;
40 }
41 
42 void send_initial_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl)
43 {
44 	struct v4l2_event ev;
45 	u32 changes = V4L2_EVENT_CTRL_CH_FLAGS;
46 
47 	if (!(ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY))
48 		changes |= V4L2_EVENT_CTRL_CH_VALUE;
49 	fill_event(&ev, ctrl, changes);
50 	v4l2_event_queue_fh(fh, &ev);
51 }
52 
53 void send_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 changes)
54 {
55 	struct v4l2_event ev;
56 	struct v4l2_subscribed_event *sev;
57 
58 	if (list_empty(&ctrl->ev_subs))
59 		return;
60 	fill_event(&ev, ctrl, changes);
61 
62 	list_for_each_entry(sev, &ctrl->ev_subs, node)
63 		if (sev->fh != fh ||
64 		    (sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK))
65 			v4l2_event_queue_fh(sev->fh, &ev);
66 }
67 
68 static bool std_equal(const struct v4l2_ctrl *ctrl, u32 idx,
69 		      union v4l2_ctrl_ptr ptr1,
70 		      union v4l2_ctrl_ptr ptr2)
71 {
72 	switch (ctrl->type) {
73 	case V4L2_CTRL_TYPE_BUTTON:
74 		return false;
75 	case V4L2_CTRL_TYPE_STRING:
76 		idx *= ctrl->elem_size;
77 		/* strings are always 0-terminated */
78 		return !strcmp(ptr1.p_char + idx, ptr2.p_char + idx);
79 	case V4L2_CTRL_TYPE_INTEGER64:
80 		return ptr1.p_s64[idx] == ptr2.p_s64[idx];
81 	case V4L2_CTRL_TYPE_U8:
82 		return ptr1.p_u8[idx] == ptr2.p_u8[idx];
83 	case V4L2_CTRL_TYPE_U16:
84 		return ptr1.p_u16[idx] == ptr2.p_u16[idx];
85 	case V4L2_CTRL_TYPE_U32:
86 		return ptr1.p_u32[idx] == ptr2.p_u32[idx];
87 	default:
88 		if (ctrl->is_int)
89 			return ptr1.p_s32[idx] == ptr2.p_s32[idx];
90 		idx *= ctrl->elem_size;
91 		return !memcmp(ptr1.p_const + idx, ptr2.p_const + idx,
92 			       ctrl->elem_size);
93 	}
94 }
95 
96 /* Default intra MPEG-2 quantisation coefficients, from the specification. */
97 static const u8 mpeg2_intra_quant_matrix[64] = {
98 	8,  16, 16, 19, 16, 19, 22, 22,
99 	22, 22, 22, 22, 26, 24, 26, 27,
100 	27, 27, 26, 26, 26, 26, 27, 27,
101 	27, 29, 29, 29, 34, 34, 34, 29,
102 	29, 29, 27, 27, 29, 29, 32, 32,
103 	34, 34, 37, 38, 37, 35, 35, 34,
104 	35, 38, 38, 40, 40, 40, 48, 48,
105 	46, 46, 56, 56, 58, 69, 69, 83
106 };
107 
108 static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
109 			      union v4l2_ctrl_ptr ptr)
110 {
111 	struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
112 	struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
113 	struct v4l2_ctrl_mpeg2_quantisation *p_mpeg2_quant;
114 	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
115 	struct v4l2_ctrl_vp9_frame *p_vp9_frame;
116 	struct v4l2_ctrl_fwht_params *p_fwht_params;
117 	struct v4l2_ctrl_h264_scaling_matrix *p_h264_scaling_matrix;
118 	void *p = ptr.p + idx * ctrl->elem_size;
119 
120 	if (ctrl->p_def.p_const)
121 		memcpy(p, ctrl->p_def.p_const, ctrl->elem_size);
122 	else
123 		memset(p, 0, ctrl->elem_size);
124 
125 	switch ((u32)ctrl->type) {
126 	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
127 		p_mpeg2_sequence = p;
128 
129 		/* 4:2:0 */
130 		p_mpeg2_sequence->chroma_format = 1;
131 		break;
132 	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
133 		p_mpeg2_picture = p;
134 
135 		/* interlaced top field */
136 		p_mpeg2_picture->picture_structure = V4L2_MPEG2_PIC_TOP_FIELD;
137 		p_mpeg2_picture->picture_coding_type =
138 					V4L2_MPEG2_PIC_CODING_TYPE_I;
139 		break;
140 	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
141 		p_mpeg2_quant = p;
142 
143 		memcpy(p_mpeg2_quant->intra_quantiser_matrix,
144 		       mpeg2_intra_quant_matrix,
145 		       ARRAY_SIZE(mpeg2_intra_quant_matrix));
146 		/*
147 		 * The default non-intra MPEG-2 quantisation
148 		 * coefficients are all 16, as per the specification.
149 		 */
150 		memset(p_mpeg2_quant->non_intra_quantiser_matrix, 16,
151 		       sizeof(p_mpeg2_quant->non_intra_quantiser_matrix));
152 		break;
153 	case V4L2_CTRL_TYPE_VP8_FRAME:
154 		p_vp8_frame = p;
155 		p_vp8_frame->num_dct_parts = 1;
156 		break;
157 	case V4L2_CTRL_TYPE_VP9_FRAME:
158 		p_vp9_frame = p;
159 		p_vp9_frame->profile = 0;
160 		p_vp9_frame->bit_depth = 8;
161 		p_vp9_frame->flags |= V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
162 			V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING;
163 		break;
164 	case V4L2_CTRL_TYPE_FWHT_PARAMS:
165 		p_fwht_params = p;
166 		p_fwht_params->version = V4L2_FWHT_VERSION;
167 		p_fwht_params->width = 1280;
168 		p_fwht_params->height = 720;
169 		p_fwht_params->flags = V4L2_FWHT_FL_PIXENC_YUV |
170 			(2 << V4L2_FWHT_FL_COMPONENTS_NUM_OFFSET);
171 		break;
172 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
173 		p_h264_scaling_matrix = p;
174 		/*
175 		 * The default (flat) H.264 scaling matrix when none are
176 		 * specified in the bitstream, this is according to formulas
177 		 *  (7-8) and (7-9) of the specification.
178 		 */
179 		memset(p_h264_scaling_matrix, 16, sizeof(*p_h264_scaling_matrix));
180 		break;
181 	}
182 }
183 
184 static void std_init(const struct v4l2_ctrl *ctrl, u32 idx,
185 		     union v4l2_ctrl_ptr ptr)
186 {
187 	switch (ctrl->type) {
188 	case V4L2_CTRL_TYPE_STRING:
189 		idx *= ctrl->elem_size;
190 		memset(ptr.p_char + idx, ' ', ctrl->minimum);
191 		ptr.p_char[idx + ctrl->minimum] = '\0';
192 		break;
193 	case V4L2_CTRL_TYPE_INTEGER64:
194 		ptr.p_s64[idx] = ctrl->default_value;
195 		break;
196 	case V4L2_CTRL_TYPE_INTEGER:
197 	case V4L2_CTRL_TYPE_INTEGER_MENU:
198 	case V4L2_CTRL_TYPE_MENU:
199 	case V4L2_CTRL_TYPE_BITMASK:
200 	case V4L2_CTRL_TYPE_BOOLEAN:
201 		ptr.p_s32[idx] = ctrl->default_value;
202 		break;
203 	case V4L2_CTRL_TYPE_BUTTON:
204 	case V4L2_CTRL_TYPE_CTRL_CLASS:
205 		ptr.p_s32[idx] = 0;
206 		break;
207 	case V4L2_CTRL_TYPE_U8:
208 		ptr.p_u8[idx] = ctrl->default_value;
209 		break;
210 	case V4L2_CTRL_TYPE_U16:
211 		ptr.p_u16[idx] = ctrl->default_value;
212 		break;
213 	case V4L2_CTRL_TYPE_U32:
214 		ptr.p_u32[idx] = ctrl->default_value;
215 		break;
216 	default:
217 		std_init_compound(ctrl, idx, ptr);
218 		break;
219 	}
220 }
221 
222 static void std_log(const struct v4l2_ctrl *ctrl)
223 {
224 	union v4l2_ctrl_ptr ptr = ctrl->p_cur;
225 
226 	if (ctrl->is_array) {
227 		unsigned i;
228 
229 		for (i = 0; i < ctrl->nr_of_dims; i++)
230 			pr_cont("[%u]", ctrl->dims[i]);
231 		pr_cont(" ");
232 	}
233 
234 	switch (ctrl->type) {
235 	case V4L2_CTRL_TYPE_INTEGER:
236 		pr_cont("%d", *ptr.p_s32);
237 		break;
238 	case V4L2_CTRL_TYPE_BOOLEAN:
239 		pr_cont("%s", *ptr.p_s32 ? "true" : "false");
240 		break;
241 	case V4L2_CTRL_TYPE_MENU:
242 		pr_cont("%s", ctrl->qmenu[*ptr.p_s32]);
243 		break;
244 	case V4L2_CTRL_TYPE_INTEGER_MENU:
245 		pr_cont("%lld", ctrl->qmenu_int[*ptr.p_s32]);
246 		break;
247 	case V4L2_CTRL_TYPE_BITMASK:
248 		pr_cont("0x%08x", *ptr.p_s32);
249 		break;
250 	case V4L2_CTRL_TYPE_INTEGER64:
251 		pr_cont("%lld", *ptr.p_s64);
252 		break;
253 	case V4L2_CTRL_TYPE_STRING:
254 		pr_cont("%s", ptr.p_char);
255 		break;
256 	case V4L2_CTRL_TYPE_U8:
257 		pr_cont("%u", (unsigned)*ptr.p_u8);
258 		break;
259 	case V4L2_CTRL_TYPE_U16:
260 		pr_cont("%u", (unsigned)*ptr.p_u16);
261 		break;
262 	case V4L2_CTRL_TYPE_U32:
263 		pr_cont("%u", (unsigned)*ptr.p_u32);
264 		break;
265 	case V4L2_CTRL_TYPE_H264_SPS:
266 		pr_cont("H264_SPS");
267 		break;
268 	case V4L2_CTRL_TYPE_H264_PPS:
269 		pr_cont("H264_PPS");
270 		break;
271 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
272 		pr_cont("H264_SCALING_MATRIX");
273 		break;
274 	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
275 		pr_cont("H264_SLICE_PARAMS");
276 		break;
277 	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
278 		pr_cont("H264_DECODE_PARAMS");
279 		break;
280 	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
281 		pr_cont("H264_PRED_WEIGHTS");
282 		break;
283 	case V4L2_CTRL_TYPE_FWHT_PARAMS:
284 		pr_cont("FWHT_PARAMS");
285 		break;
286 	case V4L2_CTRL_TYPE_VP8_FRAME:
287 		pr_cont("VP8_FRAME");
288 		break;
289 	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
290 		pr_cont("HDR10_CLL_INFO");
291 		break;
292 	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
293 		pr_cont("HDR10_MASTERING_DISPLAY");
294 		break;
295 	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
296 		pr_cont("MPEG2_QUANTISATION");
297 		break;
298 	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
299 		pr_cont("MPEG2_SEQUENCE");
300 		break;
301 	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
302 		pr_cont("MPEG2_PICTURE");
303 		break;
304 	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
305 		pr_cont("VP9_COMPRESSED_HDR");
306 		break;
307 	case V4L2_CTRL_TYPE_VP9_FRAME:
308 		pr_cont("VP9_FRAME");
309 		break;
310 	default:
311 		pr_cont("unknown type %d", ctrl->type);
312 		break;
313 	}
314 }
315 
316 /*
317  * Round towards the closest legal value. Be careful when we are
318  * close to the maximum range of the control type to prevent
319  * wrap-arounds.
320  */
321 #define ROUND_TO_RANGE(val, offset_type, ctrl)			\
322 ({								\
323 	offset_type offset;					\
324 	if ((ctrl)->maximum >= 0 &&				\
325 	    val >= (ctrl)->maximum - (s32)((ctrl)->step / 2))	\
326 		val = (ctrl)->maximum;				\
327 	else							\
328 		val += (s32)((ctrl)->step / 2);			\
329 	val = clamp_t(typeof(val), val,				\
330 		      (ctrl)->minimum, (ctrl)->maximum);	\
331 	offset = (val) - (ctrl)->minimum;			\
332 	offset = (ctrl)->step * (offset / (u32)(ctrl)->step);	\
333 	val = (ctrl)->minimum + offset;				\
334 	0;							\
335 })
336 
337 /* Validate a new control */
338 
339 #define zero_padding(s) \
340 	memset(&(s).padding, 0, sizeof((s).padding))
341 #define zero_reserved(s) \
342 	memset(&(s).reserved, 0, sizeof((s).reserved))
343 
344 static int
345 validate_vp9_lf_params(struct v4l2_vp9_loop_filter *lf)
346 {
347 	unsigned int i;
348 
349 	if (lf->flags & ~(V4L2_VP9_LOOP_FILTER_FLAG_DELTA_ENABLED |
350 			  V4L2_VP9_LOOP_FILTER_FLAG_DELTA_UPDATE))
351 		return -EINVAL;
352 
353 	/* That all values are in the accepted range. */
354 	if (lf->level > GENMASK(5, 0))
355 		return -EINVAL;
356 
357 	if (lf->sharpness > GENMASK(2, 0))
358 		return -EINVAL;
359 
360 	for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++)
361 		if (lf->ref_deltas[i] < -63 || lf->ref_deltas[i] > 63)
362 			return -EINVAL;
363 
364 	for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++)
365 		if (lf->mode_deltas[i] < -63 || lf->mode_deltas[i] > 63)
366 			return -EINVAL;
367 
368 	zero_reserved(*lf);
369 	return 0;
370 }
371 
372 static int
373 validate_vp9_quant_params(struct v4l2_vp9_quantization *quant)
374 {
375 	if (quant->delta_q_y_dc < -15 || quant->delta_q_y_dc > 15 ||
376 	    quant->delta_q_uv_dc < -15 || quant->delta_q_uv_dc > 15 ||
377 	    quant->delta_q_uv_ac < -15 || quant->delta_q_uv_ac > 15)
378 		return -EINVAL;
379 
380 	zero_reserved(*quant);
381 	return 0;
382 }
383 
384 static int
385 validate_vp9_seg_params(struct v4l2_vp9_segmentation *seg)
386 {
387 	unsigned int i, j;
388 
389 	if (seg->flags & ~(V4L2_VP9_SEGMENTATION_FLAG_ENABLED |
390 			   V4L2_VP9_SEGMENTATION_FLAG_UPDATE_MAP |
391 			   V4L2_VP9_SEGMENTATION_FLAG_TEMPORAL_UPDATE |
392 			   V4L2_VP9_SEGMENTATION_FLAG_UPDATE_DATA |
393 			   V4L2_VP9_SEGMENTATION_FLAG_ABS_OR_DELTA_UPDATE))
394 		return -EINVAL;
395 
396 	for (i = 0; i < ARRAY_SIZE(seg->feature_enabled); i++) {
397 		if (seg->feature_enabled[i] &
398 		    ~V4L2_VP9_SEGMENT_FEATURE_ENABLED_MASK)
399 			return -EINVAL;
400 	}
401 
402 	for (i = 0; i < ARRAY_SIZE(seg->feature_data); i++) {
403 		static const int range[] = { 255, 63, 3, 0 };
404 
405 		for (j = 0; j < ARRAY_SIZE(seg->feature_data[j]); j++) {
406 			if (seg->feature_data[i][j] < -range[j] ||
407 			    seg->feature_data[i][j] > range[j])
408 				return -EINVAL;
409 		}
410 	}
411 
412 	zero_reserved(*seg);
413 	return 0;
414 }
415 
416 static int
417 validate_vp9_compressed_hdr(struct v4l2_ctrl_vp9_compressed_hdr *hdr)
418 {
419 	if (hdr->tx_mode > V4L2_VP9_TX_MODE_SELECT)
420 		return -EINVAL;
421 
422 	return 0;
423 }
424 
425 static int
426 validate_vp9_frame(struct v4l2_ctrl_vp9_frame *frame)
427 {
428 	int ret;
429 
430 	/* Make sure we're not passed invalid flags. */
431 	if (frame->flags & ~(V4L2_VP9_FRAME_FLAG_KEY_FRAME |
432 		  V4L2_VP9_FRAME_FLAG_SHOW_FRAME |
433 		  V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT |
434 		  V4L2_VP9_FRAME_FLAG_INTRA_ONLY |
435 		  V4L2_VP9_FRAME_FLAG_ALLOW_HIGH_PREC_MV |
436 		  V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX |
437 		  V4L2_VP9_FRAME_FLAG_PARALLEL_DEC_MODE |
438 		  V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
439 		  V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING |
440 		  V4L2_VP9_FRAME_FLAG_COLOR_RANGE_FULL_SWING))
441 		return -EINVAL;
442 
443 	if (frame->flags & V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT &&
444 	    frame->flags & V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX)
445 		return -EINVAL;
446 
447 	if (frame->profile > V4L2_VP9_PROFILE_MAX)
448 		return -EINVAL;
449 
450 	if (frame->reset_frame_context > V4L2_VP9_RESET_FRAME_CTX_ALL)
451 		return -EINVAL;
452 
453 	if (frame->frame_context_idx >= V4L2_VP9_NUM_FRAME_CTX)
454 		return -EINVAL;
455 
456 	/*
457 	 * Profiles 0 and 1 only support 8-bit depth, profiles 2 and 3 only 10
458 	 * and 12 bit depths.
459 	 */
460 	if ((frame->profile < 2 && frame->bit_depth != 8) ||
461 	    (frame->profile >= 2 &&
462 	     (frame->bit_depth != 10 && frame->bit_depth != 12)))
463 		return -EINVAL;
464 
465 	/* Profile 0 and 2 only accept YUV 4:2:0. */
466 	if ((frame->profile == 0 || frame->profile == 2) &&
467 	    (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
468 	     !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
469 		return -EINVAL;
470 
471 	/* Profile 1 and 3 only accept YUV 4:2:2, 4:4:0 and 4:4:4. */
472 	if ((frame->profile == 1 || frame->profile == 3) &&
473 	    ((frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) &&
474 	     (frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
475 		return -EINVAL;
476 
477 	if (frame->interpolation_filter > V4L2_VP9_INTERP_FILTER_SWITCHABLE)
478 		return -EINVAL;
479 
480 	/*
481 	 * According to the spec, tile_cols_log2 shall be less than or equal
482 	 * to 6.
483 	 */
484 	if (frame->tile_cols_log2 > 6)
485 		return -EINVAL;
486 
487 	if (frame->reference_mode > V4L2_VP9_REFERENCE_MODE_SELECT)
488 		return -EINVAL;
489 
490 	ret = validate_vp9_lf_params(&frame->lf);
491 	if (ret)
492 		return ret;
493 
494 	ret = validate_vp9_quant_params(&frame->quant);
495 	if (ret)
496 		return ret;
497 
498 	ret = validate_vp9_seg_params(&frame->seg);
499 	if (ret)
500 		return ret;
501 
502 	zero_reserved(*frame);
503 	return 0;
504 }
505 
506 /*
507  * Compound controls validation requires setting unused fields/flags to zero
508  * in order to properly detect unchanged controls with std_equal's memcmp.
509  */
510 static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
511 				 union v4l2_ctrl_ptr ptr)
512 {
513 	struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
514 	struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
515 	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
516 	struct v4l2_ctrl_fwht_params *p_fwht_params;
517 	struct v4l2_ctrl_h264_sps *p_h264_sps;
518 	struct v4l2_ctrl_h264_pps *p_h264_pps;
519 	struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weights;
520 	struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;
521 	struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;
522 	struct v4l2_ctrl_hevc_sps *p_hevc_sps;
523 	struct v4l2_ctrl_hevc_pps *p_hevc_pps;
524 	struct v4l2_ctrl_hevc_slice_params *p_hevc_slice_params;
525 	struct v4l2_ctrl_hdr10_mastering_display *p_hdr10_mastering;
526 	struct v4l2_ctrl_hevc_decode_params *p_hevc_decode_params;
527 	struct v4l2_area *area;
528 	void *p = ptr.p + idx * ctrl->elem_size;
529 	unsigned int i;
530 
531 	switch ((u32)ctrl->type) {
532 	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
533 		p_mpeg2_sequence = p;
534 
535 		switch (p_mpeg2_sequence->chroma_format) {
536 		case 1: /* 4:2:0 */
537 		case 2: /* 4:2:2 */
538 		case 3: /* 4:4:4 */
539 			break;
540 		default:
541 			return -EINVAL;
542 		}
543 		break;
544 
545 	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
546 		p_mpeg2_picture = p;
547 
548 		switch (p_mpeg2_picture->intra_dc_precision) {
549 		case 0: /* 8 bits */
550 		case 1: /* 9 bits */
551 		case 2: /* 10 bits */
552 		case 3: /* 11 bits */
553 			break;
554 		default:
555 			return -EINVAL;
556 		}
557 
558 		switch (p_mpeg2_picture->picture_structure) {
559 		case V4L2_MPEG2_PIC_TOP_FIELD:
560 		case V4L2_MPEG2_PIC_BOTTOM_FIELD:
561 		case V4L2_MPEG2_PIC_FRAME:
562 			break;
563 		default:
564 			return -EINVAL;
565 		}
566 
567 		switch (p_mpeg2_picture->picture_coding_type) {
568 		case V4L2_MPEG2_PIC_CODING_TYPE_I:
569 		case V4L2_MPEG2_PIC_CODING_TYPE_P:
570 		case V4L2_MPEG2_PIC_CODING_TYPE_B:
571 			break;
572 		default:
573 			return -EINVAL;
574 		}
575 		zero_reserved(*p_mpeg2_picture);
576 		break;
577 
578 	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
579 		break;
580 
581 	case V4L2_CTRL_TYPE_FWHT_PARAMS:
582 		p_fwht_params = p;
583 		if (p_fwht_params->version < V4L2_FWHT_VERSION)
584 			return -EINVAL;
585 		if (!p_fwht_params->width || !p_fwht_params->height)
586 			return -EINVAL;
587 		break;
588 
589 	case V4L2_CTRL_TYPE_H264_SPS:
590 		p_h264_sps = p;
591 
592 		/* Some syntax elements are only conditionally valid */
593 		if (p_h264_sps->pic_order_cnt_type != 0) {
594 			p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 = 0;
595 		} else if (p_h264_sps->pic_order_cnt_type != 1) {
596 			p_h264_sps->num_ref_frames_in_pic_order_cnt_cycle = 0;
597 			p_h264_sps->offset_for_non_ref_pic = 0;
598 			p_h264_sps->offset_for_top_to_bottom_field = 0;
599 			memset(&p_h264_sps->offset_for_ref_frame, 0,
600 			       sizeof(p_h264_sps->offset_for_ref_frame));
601 		}
602 
603 		if (!V4L2_H264_SPS_HAS_CHROMA_FORMAT(p_h264_sps)) {
604 			p_h264_sps->chroma_format_idc = 1;
605 			p_h264_sps->bit_depth_luma_minus8 = 0;
606 			p_h264_sps->bit_depth_chroma_minus8 = 0;
607 
608 			p_h264_sps->flags &=
609 				~V4L2_H264_SPS_FLAG_QPPRIME_Y_ZERO_TRANSFORM_BYPASS;
610 
611 			if (p_h264_sps->chroma_format_idc < 3)
612 				p_h264_sps->flags &=
613 					~V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE;
614 		}
615 
616 		if (p_h264_sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY)
617 			p_h264_sps->flags &=
618 				~V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD;
619 
620 		/*
621 		 * Chroma 4:2:2 format require at least High 4:2:2 profile.
622 		 *
623 		 * The H264 specification and well-known parser implementations
624 		 * use profile-idc values directly, as that is clearer and
625 		 * less ambiguous. We do the same here.
626 		 */
627 		if (p_h264_sps->profile_idc < 122 &&
628 		    p_h264_sps->chroma_format_idc > 1)
629 			return -EINVAL;
630 		/* Chroma 4:4:4 format require at least High 4:2:2 profile */
631 		if (p_h264_sps->profile_idc < 244 &&
632 		    p_h264_sps->chroma_format_idc > 2)
633 			return -EINVAL;
634 		if (p_h264_sps->chroma_format_idc > 3)
635 			return -EINVAL;
636 
637 		if (p_h264_sps->bit_depth_luma_minus8 > 6)
638 			return -EINVAL;
639 		if (p_h264_sps->bit_depth_chroma_minus8 > 6)
640 			return -EINVAL;
641 		if (p_h264_sps->log2_max_frame_num_minus4 > 12)
642 			return -EINVAL;
643 		if (p_h264_sps->pic_order_cnt_type > 2)
644 			return -EINVAL;
645 		if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
646 			return -EINVAL;
647 		if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)
648 			return -EINVAL;
649 		break;
650 
651 	case V4L2_CTRL_TYPE_H264_PPS:
652 		p_h264_pps = p;
653 
654 		if (p_h264_pps->num_slice_groups_minus1 > 7)
655 			return -EINVAL;
656 		if (p_h264_pps->num_ref_idx_l0_default_active_minus1 >
657 		    (V4L2_H264_REF_LIST_LEN - 1))
658 			return -EINVAL;
659 		if (p_h264_pps->num_ref_idx_l1_default_active_minus1 >
660 		    (V4L2_H264_REF_LIST_LEN - 1))
661 			return -EINVAL;
662 		if (p_h264_pps->weighted_bipred_idc > 2)
663 			return -EINVAL;
664 		/*
665 		 * pic_init_qp_minus26 shall be in the range of
666 		 * -(26 + QpBdOffset_y) to +25, inclusive,
667 		 *  where QpBdOffset_y is 6 * bit_depth_luma_minus8
668 		 */
669 		if (p_h264_pps->pic_init_qp_minus26 < -62 ||
670 		    p_h264_pps->pic_init_qp_minus26 > 25)
671 			return -EINVAL;
672 		if (p_h264_pps->pic_init_qs_minus26 < -26 ||
673 		    p_h264_pps->pic_init_qs_minus26 > 25)
674 			return -EINVAL;
675 		if (p_h264_pps->chroma_qp_index_offset < -12 ||
676 		    p_h264_pps->chroma_qp_index_offset > 12)
677 			return -EINVAL;
678 		if (p_h264_pps->second_chroma_qp_index_offset < -12 ||
679 		    p_h264_pps->second_chroma_qp_index_offset > 12)
680 			return -EINVAL;
681 		break;
682 
683 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
684 		break;
685 
686 	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
687 		p_h264_pred_weights = p;
688 
689 		if (p_h264_pred_weights->luma_log2_weight_denom > 7)
690 			return -EINVAL;
691 		if (p_h264_pred_weights->chroma_log2_weight_denom > 7)
692 			return -EINVAL;
693 		break;
694 
695 	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
696 		p_h264_slice_params = p;
697 
698 		if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
699 			p_h264_slice_params->flags &=
700 				~V4L2_H264_SLICE_FLAG_DIRECT_SPATIAL_MV_PRED;
701 
702 		if (p_h264_slice_params->colour_plane_id > 2)
703 			return -EINVAL;
704 		if (p_h264_slice_params->cabac_init_idc > 2)
705 			return -EINVAL;
706 		if (p_h264_slice_params->disable_deblocking_filter_idc > 2)
707 			return -EINVAL;
708 		if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||
709 		    p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)
710 			return -EINVAL;
711 		if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||
712 		    p_h264_slice_params->slice_beta_offset_div2 > 6)
713 			return -EINVAL;
714 
715 		if (p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_I ||
716 		    p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_SI)
717 			p_h264_slice_params->num_ref_idx_l0_active_minus1 = 0;
718 		if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
719 			p_h264_slice_params->num_ref_idx_l1_active_minus1 = 0;
720 
721 		if (p_h264_slice_params->num_ref_idx_l0_active_minus1 >
722 		    (V4L2_H264_REF_LIST_LEN - 1))
723 			return -EINVAL;
724 		if (p_h264_slice_params->num_ref_idx_l1_active_minus1 >
725 		    (V4L2_H264_REF_LIST_LEN - 1))
726 			return -EINVAL;
727 		zero_reserved(*p_h264_slice_params);
728 		break;
729 
730 	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
731 		p_h264_dec_params = p;
732 
733 		if (p_h264_dec_params->nal_ref_idc > 3)
734 			return -EINVAL;
735 		for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {
736 			struct v4l2_h264_dpb_entry *dpb_entry =
737 				&p_h264_dec_params->dpb[i];
738 
739 			zero_reserved(*dpb_entry);
740 		}
741 		zero_reserved(*p_h264_dec_params);
742 		break;
743 
744 	case V4L2_CTRL_TYPE_VP8_FRAME:
745 		p_vp8_frame = p;
746 
747 		switch (p_vp8_frame->num_dct_parts) {
748 		case 1:
749 		case 2:
750 		case 4:
751 		case 8:
752 			break;
753 		default:
754 			return -EINVAL;
755 		}
756 		zero_padding(p_vp8_frame->segment);
757 		zero_padding(p_vp8_frame->lf);
758 		zero_padding(p_vp8_frame->quant);
759 		zero_padding(p_vp8_frame->entropy);
760 		zero_padding(p_vp8_frame->coder_state);
761 		break;
762 
763 	case V4L2_CTRL_TYPE_HEVC_SPS:
764 		p_hevc_sps = p;
765 
766 		if (!(p_hevc_sps->flags & V4L2_HEVC_SPS_FLAG_PCM_ENABLED)) {
767 			p_hevc_sps->pcm_sample_bit_depth_luma_minus1 = 0;
768 			p_hevc_sps->pcm_sample_bit_depth_chroma_minus1 = 0;
769 			p_hevc_sps->log2_min_pcm_luma_coding_block_size_minus3 = 0;
770 			p_hevc_sps->log2_diff_max_min_pcm_luma_coding_block_size = 0;
771 		}
772 
773 		if (!(p_hevc_sps->flags &
774 		      V4L2_HEVC_SPS_FLAG_LONG_TERM_REF_PICS_PRESENT))
775 			p_hevc_sps->num_long_term_ref_pics_sps = 0;
776 		break;
777 
778 	case V4L2_CTRL_TYPE_HEVC_PPS:
779 		p_hevc_pps = p;
780 
781 		if (!(p_hevc_pps->flags &
782 		      V4L2_HEVC_PPS_FLAG_CU_QP_DELTA_ENABLED))
783 			p_hevc_pps->diff_cu_qp_delta_depth = 0;
784 
785 		if (!(p_hevc_pps->flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED)) {
786 			p_hevc_pps->num_tile_columns_minus1 = 0;
787 			p_hevc_pps->num_tile_rows_minus1 = 0;
788 			memset(&p_hevc_pps->column_width_minus1, 0,
789 			       sizeof(p_hevc_pps->column_width_minus1));
790 			memset(&p_hevc_pps->row_height_minus1, 0,
791 			       sizeof(p_hevc_pps->row_height_minus1));
792 
793 			p_hevc_pps->flags &=
794 				~V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED;
795 		}
796 
797 		if (p_hevc_pps->flags &
798 		    V4L2_HEVC_PPS_FLAG_PPS_DISABLE_DEBLOCKING_FILTER) {
799 			p_hevc_pps->pps_beta_offset_div2 = 0;
800 			p_hevc_pps->pps_tc_offset_div2 = 0;
801 		}
802 
803 		zero_padding(*p_hevc_pps);
804 		break;
805 
806 	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
807 		p_hevc_decode_params = p;
808 
809 		if (p_hevc_decode_params->num_active_dpb_entries >
810 		    V4L2_HEVC_DPB_ENTRIES_NUM_MAX)
811 			return -EINVAL;
812 
813 		for (i = 0; i < p_hevc_decode_params->num_active_dpb_entries;
814 		     i++) {
815 			struct v4l2_hevc_dpb_entry *dpb_entry =
816 				&p_hevc_decode_params->dpb[i];
817 
818 			zero_padding(*dpb_entry);
819 		}
820 		break;
821 
822 	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
823 		p_hevc_slice_params = p;
824 
825 		zero_padding(p_hevc_slice_params->pred_weight_table);
826 		zero_padding(*p_hevc_slice_params);
827 		break;
828 
829 	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
830 		break;
831 
832 	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
833 		p_hdr10_mastering = p;
834 
835 		for (i = 0; i < 3; ++i) {
836 			if (p_hdr10_mastering->display_primaries_x[i] <
837 				V4L2_HDR10_MASTERING_PRIMARIES_X_LOW ||
838 			    p_hdr10_mastering->display_primaries_x[i] >
839 				V4L2_HDR10_MASTERING_PRIMARIES_X_HIGH ||
840 			    p_hdr10_mastering->display_primaries_y[i] <
841 				V4L2_HDR10_MASTERING_PRIMARIES_Y_LOW ||
842 			    p_hdr10_mastering->display_primaries_y[i] >
843 				V4L2_HDR10_MASTERING_PRIMARIES_Y_HIGH)
844 				return -EINVAL;
845 		}
846 
847 		if (p_hdr10_mastering->white_point_x <
848 			V4L2_HDR10_MASTERING_WHITE_POINT_X_LOW ||
849 		    p_hdr10_mastering->white_point_x >
850 			V4L2_HDR10_MASTERING_WHITE_POINT_X_HIGH ||
851 		    p_hdr10_mastering->white_point_y <
852 			V4L2_HDR10_MASTERING_WHITE_POINT_Y_LOW ||
853 		    p_hdr10_mastering->white_point_y >
854 			V4L2_HDR10_MASTERING_WHITE_POINT_Y_HIGH)
855 			return -EINVAL;
856 
857 		if (p_hdr10_mastering->max_display_mastering_luminance <
858 			V4L2_HDR10_MASTERING_MAX_LUMA_LOW ||
859 		    p_hdr10_mastering->max_display_mastering_luminance >
860 			V4L2_HDR10_MASTERING_MAX_LUMA_HIGH ||
861 		    p_hdr10_mastering->min_display_mastering_luminance <
862 			V4L2_HDR10_MASTERING_MIN_LUMA_LOW ||
863 		    p_hdr10_mastering->min_display_mastering_luminance >
864 			V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
865 			return -EINVAL;
866 
867 		/* The following restriction comes from ITU-T Rec. H.265 spec */
868 		if (p_hdr10_mastering->max_display_mastering_luminance ==
869 			V4L2_HDR10_MASTERING_MAX_LUMA_LOW &&
870 		    p_hdr10_mastering->min_display_mastering_luminance ==
871 			V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
872 			return -EINVAL;
873 
874 		break;
875 
876 	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
877 		break;
878 
879 	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
880 		return validate_vp9_compressed_hdr(p);
881 
882 	case V4L2_CTRL_TYPE_VP9_FRAME:
883 		return validate_vp9_frame(p);
884 
885 	case V4L2_CTRL_TYPE_AREA:
886 		area = p;
887 		if (!area->width || !area->height)
888 			return -EINVAL;
889 		break;
890 
891 	default:
892 		return -EINVAL;
893 	}
894 
895 	return 0;
896 }
897 
898 static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
899 			union v4l2_ctrl_ptr ptr)
900 {
901 	size_t len;
902 	u64 offset;
903 	s64 val;
904 
905 	switch ((u32)ctrl->type) {
906 	case V4L2_CTRL_TYPE_INTEGER:
907 		return ROUND_TO_RANGE(ptr.p_s32[idx], u32, ctrl);
908 	case V4L2_CTRL_TYPE_INTEGER64:
909 		/*
910 		 * We can't use the ROUND_TO_RANGE define here due to
911 		 * the u64 divide that needs special care.
912 		 */
913 		val = ptr.p_s64[idx];
914 		if (ctrl->maximum >= 0 && val >= ctrl->maximum - (s64)(ctrl->step / 2))
915 			val = ctrl->maximum;
916 		else
917 			val += (s64)(ctrl->step / 2);
918 		val = clamp_t(s64, val, ctrl->minimum, ctrl->maximum);
919 		offset = val - ctrl->minimum;
920 		do_div(offset, ctrl->step);
921 		ptr.p_s64[idx] = ctrl->minimum + offset * ctrl->step;
922 		return 0;
923 	case V4L2_CTRL_TYPE_U8:
924 		return ROUND_TO_RANGE(ptr.p_u8[idx], u8, ctrl);
925 	case V4L2_CTRL_TYPE_U16:
926 		return ROUND_TO_RANGE(ptr.p_u16[idx], u16, ctrl);
927 	case V4L2_CTRL_TYPE_U32:
928 		return ROUND_TO_RANGE(ptr.p_u32[idx], u32, ctrl);
929 
930 	case V4L2_CTRL_TYPE_BOOLEAN:
931 		ptr.p_s32[idx] = !!ptr.p_s32[idx];
932 		return 0;
933 
934 	case V4L2_CTRL_TYPE_MENU:
935 	case V4L2_CTRL_TYPE_INTEGER_MENU:
936 		if (ptr.p_s32[idx] < ctrl->minimum || ptr.p_s32[idx] > ctrl->maximum)
937 			return -ERANGE;
938 		if (ptr.p_s32[idx] < BITS_PER_LONG_LONG &&
939 		    (ctrl->menu_skip_mask & BIT_ULL(ptr.p_s32[idx])))
940 			return -EINVAL;
941 		if (ctrl->type == V4L2_CTRL_TYPE_MENU &&
942 		    ctrl->qmenu[ptr.p_s32[idx]][0] == '\0')
943 			return -EINVAL;
944 		return 0;
945 
946 	case V4L2_CTRL_TYPE_BITMASK:
947 		ptr.p_s32[idx] &= ctrl->maximum;
948 		return 0;
949 
950 	case V4L2_CTRL_TYPE_BUTTON:
951 	case V4L2_CTRL_TYPE_CTRL_CLASS:
952 		ptr.p_s32[idx] = 0;
953 		return 0;
954 
955 	case V4L2_CTRL_TYPE_STRING:
956 		idx *= ctrl->elem_size;
957 		len = strlen(ptr.p_char + idx);
958 		if (len < ctrl->minimum)
959 			return -ERANGE;
960 		if ((len - (u32)ctrl->minimum) % (u32)ctrl->step)
961 			return -ERANGE;
962 		return 0;
963 
964 	default:
965 		return std_validate_compound(ctrl, idx, ptr);
966 	}
967 }
968 
969 static const struct v4l2_ctrl_type_ops std_type_ops = {
970 	.equal = std_equal,
971 	.init = std_init,
972 	.log = std_log,
973 	.validate = std_validate,
974 };
975 
976 void v4l2_ctrl_notify(struct v4l2_ctrl *ctrl, v4l2_ctrl_notify_fnc notify, void *priv)
977 {
978 	if (!ctrl)
979 		return;
980 	if (!notify) {
981 		ctrl->call_notify = 0;
982 		return;
983 	}
984 	if (WARN_ON(ctrl->handler->notify && ctrl->handler->notify != notify))
985 		return;
986 	ctrl->handler->notify = notify;
987 	ctrl->handler->notify_priv = priv;
988 	ctrl->call_notify = 1;
989 }
990 EXPORT_SYMBOL(v4l2_ctrl_notify);
991 
992 /* Copy the one value to another. */
993 static void ptr_to_ptr(struct v4l2_ctrl *ctrl,
994 		       union v4l2_ctrl_ptr from, union v4l2_ctrl_ptr to)
995 {
996 	if (ctrl == NULL)
997 		return;
998 	memcpy(to.p, from.p_const, ctrl->elems * ctrl->elem_size);
999 }
1000 
1001 /* Copy the new value to the current value. */
1002 void new_to_cur(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
1003 {
1004 	bool changed;
1005 
1006 	if (ctrl == NULL)
1007 		return;
1008 
1009 	/* has_changed is set by cluster_changed */
1010 	changed = ctrl->has_changed;
1011 	if (changed)
1012 		ptr_to_ptr(ctrl, ctrl->p_new, ctrl->p_cur);
1013 
1014 	if (ch_flags & V4L2_EVENT_CTRL_CH_FLAGS) {
1015 		/* Note: CH_FLAGS is only set for auto clusters. */
1016 		ctrl->flags &=
1017 			~(V4L2_CTRL_FLAG_INACTIVE | V4L2_CTRL_FLAG_VOLATILE);
1018 		if (!is_cur_manual(ctrl->cluster[0])) {
1019 			ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
1020 			if (ctrl->cluster[0]->has_volatiles)
1021 				ctrl->flags |= V4L2_CTRL_FLAG_VOLATILE;
1022 		}
1023 		fh = NULL;
1024 	}
1025 	if (changed || ch_flags) {
1026 		/* If a control was changed that was not one of the controls
1027 		   modified by the application, then send the event to all. */
1028 		if (!ctrl->is_new)
1029 			fh = NULL;
1030 		send_event(fh, ctrl,
1031 			(changed ? V4L2_EVENT_CTRL_CH_VALUE : 0) | ch_flags);
1032 		if (ctrl->call_notify && changed && ctrl->handler->notify)
1033 			ctrl->handler->notify(ctrl, ctrl->handler->notify_priv);
1034 	}
1035 }
1036 
1037 /* Copy the current value to the new value */
1038 void cur_to_new(struct v4l2_ctrl *ctrl)
1039 {
1040 	if (ctrl == NULL)
1041 		return;
1042 	ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new);
1043 }
1044 
1045 /* Copy the new value to the request value */
1046 void new_to_req(struct v4l2_ctrl_ref *ref)
1047 {
1048 	if (!ref)
1049 		return;
1050 	ptr_to_ptr(ref->ctrl, ref->ctrl->p_new, ref->p_req);
1051 	ref->valid_p_req = true;
1052 }
1053 
1054 /* Copy the current value to the request value */
1055 void cur_to_req(struct v4l2_ctrl_ref *ref)
1056 {
1057 	if (!ref)
1058 		return;
1059 	ptr_to_ptr(ref->ctrl, ref->ctrl->p_cur, ref->p_req);
1060 	ref->valid_p_req = true;
1061 }
1062 
1063 /* Copy the request value to the new value */
1064 void req_to_new(struct v4l2_ctrl_ref *ref)
1065 {
1066 	if (!ref)
1067 		return;
1068 	if (ref->valid_p_req)
1069 		ptr_to_ptr(ref->ctrl, ref->p_req, ref->ctrl->p_new);
1070 	else
1071 		ptr_to_ptr(ref->ctrl, ref->ctrl->p_cur, ref->ctrl->p_new);
1072 }
1073 
1074 /* Control range checking */
1075 int check_range(enum v4l2_ctrl_type type,
1076 		s64 min, s64 max, u64 step, s64 def)
1077 {
1078 	switch (type) {
1079 	case V4L2_CTRL_TYPE_BOOLEAN:
1080 		if (step != 1 || max > 1 || min < 0)
1081 			return -ERANGE;
1082 		fallthrough;
1083 	case V4L2_CTRL_TYPE_U8:
1084 	case V4L2_CTRL_TYPE_U16:
1085 	case V4L2_CTRL_TYPE_U32:
1086 	case V4L2_CTRL_TYPE_INTEGER:
1087 	case V4L2_CTRL_TYPE_INTEGER64:
1088 		if (step == 0 || min > max || def < min || def > max)
1089 			return -ERANGE;
1090 		return 0;
1091 	case V4L2_CTRL_TYPE_BITMASK:
1092 		if (step || min || !max || (def & ~max))
1093 			return -ERANGE;
1094 		return 0;
1095 	case V4L2_CTRL_TYPE_MENU:
1096 	case V4L2_CTRL_TYPE_INTEGER_MENU:
1097 		if (min > max || def < min || def > max)
1098 			return -ERANGE;
1099 		/* Note: step == menu_skip_mask for menu controls.
1100 		   So here we check if the default value is masked out. */
1101 		if (step && ((1 << def) & step))
1102 			return -EINVAL;
1103 		return 0;
1104 	case V4L2_CTRL_TYPE_STRING:
1105 		if (min > max || min < 0 || step < 1 || def)
1106 			return -ERANGE;
1107 		return 0;
1108 	default:
1109 		return 0;
1110 	}
1111 }
1112 
1113 /* Validate a new control */
1114 int validate_new(const struct v4l2_ctrl *ctrl, union v4l2_ctrl_ptr p_new)
1115 {
1116 	unsigned idx;
1117 	int err = 0;
1118 
1119 	for (idx = 0; !err && idx < ctrl->elems; idx++)
1120 		err = ctrl->type_ops->validate(ctrl, idx, p_new);
1121 	return err;
1122 }
1123 
1124 /* Set the handler's error code if it wasn't set earlier already */
1125 static inline int handler_set_err(struct v4l2_ctrl_handler *hdl, int err)
1126 {
1127 	if (hdl->error == 0)
1128 		hdl->error = err;
1129 	return err;
1130 }
1131 
1132 /* Initialize the handler */
1133 int v4l2_ctrl_handler_init_class(struct v4l2_ctrl_handler *hdl,
1134 				 unsigned nr_of_controls_hint,
1135 				 struct lock_class_key *key, const char *name)
1136 {
1137 	mutex_init(&hdl->_lock);
1138 	hdl->lock = &hdl->_lock;
1139 	lockdep_set_class_and_name(hdl->lock, key, name);
1140 	INIT_LIST_HEAD(&hdl->ctrls);
1141 	INIT_LIST_HEAD(&hdl->ctrl_refs);
1142 	hdl->nr_of_buckets = 1 + nr_of_controls_hint / 8;
1143 	hdl->buckets = kvcalloc(hdl->nr_of_buckets, sizeof(hdl->buckets[0]),
1144 				GFP_KERNEL);
1145 	hdl->error = hdl->buckets ? 0 : -ENOMEM;
1146 	v4l2_ctrl_handler_init_request(hdl);
1147 	return hdl->error;
1148 }
1149 EXPORT_SYMBOL(v4l2_ctrl_handler_init_class);
1150 
1151 /* Free all controls and control refs */
1152 void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl)
1153 {
1154 	struct v4l2_ctrl_ref *ref, *next_ref;
1155 	struct v4l2_ctrl *ctrl, *next_ctrl;
1156 	struct v4l2_subscribed_event *sev, *next_sev;
1157 
1158 	if (hdl == NULL || hdl->buckets == NULL)
1159 		return;
1160 
1161 	v4l2_ctrl_handler_free_request(hdl);
1162 
1163 	mutex_lock(hdl->lock);
1164 	/* Free all nodes */
1165 	list_for_each_entry_safe(ref, next_ref, &hdl->ctrl_refs, node) {
1166 		list_del(&ref->node);
1167 		kfree(ref);
1168 	}
1169 	/* Free all controls owned by the handler */
1170 	list_for_each_entry_safe(ctrl, next_ctrl, &hdl->ctrls, node) {
1171 		list_del(&ctrl->node);
1172 		list_for_each_entry_safe(sev, next_sev, &ctrl->ev_subs, node)
1173 			list_del(&sev->node);
1174 		kvfree(ctrl);
1175 	}
1176 	kvfree(hdl->buckets);
1177 	hdl->buckets = NULL;
1178 	hdl->cached = NULL;
1179 	hdl->error = 0;
1180 	mutex_unlock(hdl->lock);
1181 	mutex_destroy(&hdl->_lock);
1182 }
1183 EXPORT_SYMBOL(v4l2_ctrl_handler_free);
1184 
1185 /* For backwards compatibility: V4L2_CID_PRIVATE_BASE should no longer
1186    be used except in G_CTRL, S_CTRL, QUERYCTRL and QUERYMENU when dealing
1187    with applications that do not use the NEXT_CTRL flag.
1188 
1189    We just find the n-th private user control. It's O(N), but that should not
1190    be an issue in this particular case. */
1191 static struct v4l2_ctrl_ref *find_private_ref(
1192 		struct v4l2_ctrl_handler *hdl, u32 id)
1193 {
1194 	struct v4l2_ctrl_ref *ref;
1195 
1196 	id -= V4L2_CID_PRIVATE_BASE;
1197 	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1198 		/* Search for private user controls that are compatible with
1199 		   VIDIOC_G/S_CTRL. */
1200 		if (V4L2_CTRL_ID2WHICH(ref->ctrl->id) == V4L2_CTRL_CLASS_USER &&
1201 		    V4L2_CTRL_DRIVER_PRIV(ref->ctrl->id)) {
1202 			if (!ref->ctrl->is_int)
1203 				continue;
1204 			if (id == 0)
1205 				return ref;
1206 			id--;
1207 		}
1208 	}
1209 	return NULL;
1210 }
1211 
1212 /* Find a control with the given ID. */
1213 struct v4l2_ctrl_ref *find_ref(struct v4l2_ctrl_handler *hdl, u32 id)
1214 {
1215 	struct v4l2_ctrl_ref *ref;
1216 	int bucket;
1217 
1218 	id &= V4L2_CTRL_ID_MASK;
1219 
1220 	/* Old-style private controls need special handling */
1221 	if (id >= V4L2_CID_PRIVATE_BASE)
1222 		return find_private_ref(hdl, id);
1223 	bucket = id % hdl->nr_of_buckets;
1224 
1225 	/* Simple optimization: cache the last control found */
1226 	if (hdl->cached && hdl->cached->ctrl->id == id)
1227 		return hdl->cached;
1228 
1229 	/* Not in cache, search the hash */
1230 	ref = hdl->buckets ? hdl->buckets[bucket] : NULL;
1231 	while (ref && ref->ctrl->id != id)
1232 		ref = ref->next;
1233 
1234 	if (ref)
1235 		hdl->cached = ref; /* cache it! */
1236 	return ref;
1237 }
1238 
1239 /* Find a control with the given ID. Take the handler's lock first. */
1240 struct v4l2_ctrl_ref *find_ref_lock(struct v4l2_ctrl_handler *hdl, u32 id)
1241 {
1242 	struct v4l2_ctrl_ref *ref = NULL;
1243 
1244 	if (hdl) {
1245 		mutex_lock(hdl->lock);
1246 		ref = find_ref(hdl, id);
1247 		mutex_unlock(hdl->lock);
1248 	}
1249 	return ref;
1250 }
1251 
1252 /* Find a control with the given ID. */
1253 struct v4l2_ctrl *v4l2_ctrl_find(struct v4l2_ctrl_handler *hdl, u32 id)
1254 {
1255 	struct v4l2_ctrl_ref *ref = find_ref_lock(hdl, id);
1256 
1257 	return ref ? ref->ctrl : NULL;
1258 }
1259 EXPORT_SYMBOL(v4l2_ctrl_find);
1260 
1261 /* Allocate a new v4l2_ctrl_ref and hook it into the handler. */
1262 int handler_new_ref(struct v4l2_ctrl_handler *hdl,
1263 		    struct v4l2_ctrl *ctrl,
1264 		    struct v4l2_ctrl_ref **ctrl_ref,
1265 		    bool from_other_dev, bool allocate_req)
1266 {
1267 	struct v4l2_ctrl_ref *ref;
1268 	struct v4l2_ctrl_ref *new_ref;
1269 	u32 id = ctrl->id;
1270 	u32 class_ctrl = V4L2_CTRL_ID2WHICH(id) | 1;
1271 	int bucket = id % hdl->nr_of_buckets;	/* which bucket to use */
1272 	unsigned int size_extra_req = 0;
1273 
1274 	if (ctrl_ref)
1275 		*ctrl_ref = NULL;
1276 
1277 	/*
1278 	 * Automatically add the control class if it is not yet present and
1279 	 * the new control is not a compound control.
1280 	 */
1281 	if (ctrl->type < V4L2_CTRL_COMPOUND_TYPES &&
1282 	    id != class_ctrl && find_ref_lock(hdl, class_ctrl) == NULL)
1283 		if (!v4l2_ctrl_new_std(hdl, NULL, class_ctrl, 0, 0, 0, 0))
1284 			return hdl->error;
1285 
1286 	if (hdl->error)
1287 		return hdl->error;
1288 
1289 	if (allocate_req)
1290 		size_extra_req = ctrl->elems * ctrl->elem_size;
1291 	new_ref = kzalloc(sizeof(*new_ref) + size_extra_req, GFP_KERNEL);
1292 	if (!new_ref)
1293 		return handler_set_err(hdl, -ENOMEM);
1294 	new_ref->ctrl = ctrl;
1295 	new_ref->from_other_dev = from_other_dev;
1296 	if (size_extra_req)
1297 		new_ref->p_req.p = &new_ref[1];
1298 
1299 	INIT_LIST_HEAD(&new_ref->node);
1300 
1301 	mutex_lock(hdl->lock);
1302 
1303 	/* Add immediately at the end of the list if the list is empty, or if
1304 	   the last element in the list has a lower ID.
1305 	   This ensures that when elements are added in ascending order the
1306 	   insertion is an O(1) operation. */
1307 	if (list_empty(&hdl->ctrl_refs) || id > node2id(hdl->ctrl_refs.prev)) {
1308 		list_add_tail(&new_ref->node, &hdl->ctrl_refs);
1309 		goto insert_in_hash;
1310 	}
1311 
1312 	/* Find insert position in sorted list */
1313 	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1314 		if (ref->ctrl->id < id)
1315 			continue;
1316 		/* Don't add duplicates */
1317 		if (ref->ctrl->id == id) {
1318 			kfree(new_ref);
1319 			goto unlock;
1320 		}
1321 		list_add(&new_ref->node, ref->node.prev);
1322 		break;
1323 	}
1324 
1325 insert_in_hash:
1326 	/* Insert the control node in the hash */
1327 	new_ref->next = hdl->buckets[bucket];
1328 	hdl->buckets[bucket] = new_ref;
1329 	if (ctrl_ref)
1330 		*ctrl_ref = new_ref;
1331 	if (ctrl->handler == hdl) {
1332 		/* By default each control starts in a cluster of its own.
1333 		 * new_ref->ctrl is basically a cluster array with one
1334 		 * element, so that's perfect to use as the cluster pointer.
1335 		 * But only do this for the handler that owns the control.
1336 		 */
1337 		ctrl->cluster = &new_ref->ctrl;
1338 		ctrl->ncontrols = 1;
1339 	}
1340 
1341 unlock:
1342 	mutex_unlock(hdl->lock);
1343 	return 0;
1344 }
1345 
1346 /* Add a new control */
1347 static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl,
1348 			const struct v4l2_ctrl_ops *ops,
1349 			const struct v4l2_ctrl_type_ops *type_ops,
1350 			u32 id, const char *name, enum v4l2_ctrl_type type,
1351 			s64 min, s64 max, u64 step, s64 def,
1352 			const u32 dims[V4L2_CTRL_MAX_DIMS], u32 elem_size,
1353 			u32 flags, const char * const *qmenu,
1354 			const s64 *qmenu_int, const union v4l2_ctrl_ptr p_def,
1355 			void *priv)
1356 {
1357 	struct v4l2_ctrl *ctrl;
1358 	unsigned sz_extra;
1359 	unsigned nr_of_dims = 0;
1360 	unsigned elems = 1;
1361 	bool is_array;
1362 	unsigned tot_ctrl_size;
1363 	unsigned idx;
1364 	void *data;
1365 	int err;
1366 
1367 	if (hdl->error)
1368 		return NULL;
1369 
1370 	while (dims && dims[nr_of_dims]) {
1371 		elems *= dims[nr_of_dims];
1372 		nr_of_dims++;
1373 		if (nr_of_dims == V4L2_CTRL_MAX_DIMS)
1374 			break;
1375 	}
1376 	is_array = nr_of_dims > 0;
1377 
1378 	/* Prefill elem_size for all types handled by std_type_ops */
1379 	switch ((u32)type) {
1380 	case V4L2_CTRL_TYPE_INTEGER64:
1381 		elem_size = sizeof(s64);
1382 		break;
1383 	case V4L2_CTRL_TYPE_STRING:
1384 		elem_size = max + 1;
1385 		break;
1386 	case V4L2_CTRL_TYPE_U8:
1387 		elem_size = sizeof(u8);
1388 		break;
1389 	case V4L2_CTRL_TYPE_U16:
1390 		elem_size = sizeof(u16);
1391 		break;
1392 	case V4L2_CTRL_TYPE_U32:
1393 		elem_size = sizeof(u32);
1394 		break;
1395 	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
1396 		elem_size = sizeof(struct v4l2_ctrl_mpeg2_sequence);
1397 		break;
1398 	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
1399 		elem_size = sizeof(struct v4l2_ctrl_mpeg2_picture);
1400 		break;
1401 	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
1402 		elem_size = sizeof(struct v4l2_ctrl_mpeg2_quantisation);
1403 		break;
1404 	case V4L2_CTRL_TYPE_FWHT_PARAMS:
1405 		elem_size = sizeof(struct v4l2_ctrl_fwht_params);
1406 		break;
1407 	case V4L2_CTRL_TYPE_H264_SPS:
1408 		elem_size = sizeof(struct v4l2_ctrl_h264_sps);
1409 		break;
1410 	case V4L2_CTRL_TYPE_H264_PPS:
1411 		elem_size = sizeof(struct v4l2_ctrl_h264_pps);
1412 		break;
1413 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
1414 		elem_size = sizeof(struct v4l2_ctrl_h264_scaling_matrix);
1415 		break;
1416 	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
1417 		elem_size = sizeof(struct v4l2_ctrl_h264_slice_params);
1418 		break;
1419 	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1420 		elem_size = sizeof(struct v4l2_ctrl_h264_decode_params);
1421 		break;
1422 	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
1423 		elem_size = sizeof(struct v4l2_ctrl_h264_pred_weights);
1424 		break;
1425 	case V4L2_CTRL_TYPE_VP8_FRAME:
1426 		elem_size = sizeof(struct v4l2_ctrl_vp8_frame);
1427 		break;
1428 	case V4L2_CTRL_TYPE_HEVC_SPS:
1429 		elem_size = sizeof(struct v4l2_ctrl_hevc_sps);
1430 		break;
1431 	case V4L2_CTRL_TYPE_HEVC_PPS:
1432 		elem_size = sizeof(struct v4l2_ctrl_hevc_pps);
1433 		break;
1434 	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
1435 		elem_size = sizeof(struct v4l2_ctrl_hevc_slice_params);
1436 		break;
1437 	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
1438 		elem_size = sizeof(struct v4l2_ctrl_hevc_scaling_matrix);
1439 		break;
1440 	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
1441 		elem_size = sizeof(struct v4l2_ctrl_hevc_decode_params);
1442 		break;
1443 	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
1444 		elem_size = sizeof(struct v4l2_ctrl_hdr10_cll_info);
1445 		break;
1446 	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
1447 		elem_size = sizeof(struct v4l2_ctrl_hdr10_mastering_display);
1448 		break;
1449 	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
1450 		elem_size = sizeof(struct v4l2_ctrl_vp9_compressed_hdr);
1451 		break;
1452 	case V4L2_CTRL_TYPE_VP9_FRAME:
1453 		elem_size = sizeof(struct v4l2_ctrl_vp9_frame);
1454 		break;
1455 	case V4L2_CTRL_TYPE_AREA:
1456 		elem_size = sizeof(struct v4l2_area);
1457 		break;
1458 	default:
1459 		if (type < V4L2_CTRL_COMPOUND_TYPES)
1460 			elem_size = sizeof(s32);
1461 		break;
1462 	}
1463 	tot_ctrl_size = elem_size * elems;
1464 
1465 	/* Sanity checks */
1466 	if (id == 0 || name == NULL || !elem_size ||
1467 	    id >= V4L2_CID_PRIVATE_BASE ||
1468 	    (type == V4L2_CTRL_TYPE_MENU && qmenu == NULL) ||
1469 	    (type == V4L2_CTRL_TYPE_INTEGER_MENU && qmenu_int == NULL)) {
1470 		handler_set_err(hdl, -ERANGE);
1471 		return NULL;
1472 	}
1473 	err = check_range(type, min, max, step, def);
1474 	if (err) {
1475 		handler_set_err(hdl, err);
1476 		return NULL;
1477 	}
1478 	if (is_array &&
1479 	    (type == V4L2_CTRL_TYPE_BUTTON ||
1480 	     type == V4L2_CTRL_TYPE_CTRL_CLASS)) {
1481 		handler_set_err(hdl, -EINVAL);
1482 		return NULL;
1483 	}
1484 
1485 	sz_extra = 0;
1486 	if (type == V4L2_CTRL_TYPE_BUTTON)
1487 		flags |= V4L2_CTRL_FLAG_WRITE_ONLY |
1488 			V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
1489 	else if (type == V4L2_CTRL_TYPE_CTRL_CLASS)
1490 		flags |= V4L2_CTRL_FLAG_READ_ONLY;
1491 	else if (type == V4L2_CTRL_TYPE_INTEGER64 ||
1492 		 type == V4L2_CTRL_TYPE_STRING ||
1493 		 type >= V4L2_CTRL_COMPOUND_TYPES ||
1494 		 is_array)
1495 		sz_extra += 2 * tot_ctrl_size;
1496 
1497 	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const)
1498 		sz_extra += elem_size;
1499 
1500 	ctrl = kvzalloc(sizeof(*ctrl) + sz_extra, GFP_KERNEL);
1501 	if (ctrl == NULL) {
1502 		handler_set_err(hdl, -ENOMEM);
1503 		return NULL;
1504 	}
1505 
1506 	INIT_LIST_HEAD(&ctrl->node);
1507 	INIT_LIST_HEAD(&ctrl->ev_subs);
1508 	ctrl->handler = hdl;
1509 	ctrl->ops = ops;
1510 	ctrl->type_ops = type_ops ? type_ops : &std_type_ops;
1511 	ctrl->id = id;
1512 	ctrl->name = name;
1513 	ctrl->type = type;
1514 	ctrl->flags = flags;
1515 	ctrl->minimum = min;
1516 	ctrl->maximum = max;
1517 	ctrl->step = step;
1518 	ctrl->default_value = def;
1519 	ctrl->is_string = !is_array && type == V4L2_CTRL_TYPE_STRING;
1520 	ctrl->is_ptr = is_array || type >= V4L2_CTRL_COMPOUND_TYPES || ctrl->is_string;
1521 	ctrl->is_int = !ctrl->is_ptr && type != V4L2_CTRL_TYPE_INTEGER64;
1522 	ctrl->is_array = is_array;
1523 	ctrl->elems = elems;
1524 	ctrl->nr_of_dims = nr_of_dims;
1525 	if (nr_of_dims)
1526 		memcpy(ctrl->dims, dims, nr_of_dims * sizeof(dims[0]));
1527 	ctrl->elem_size = elem_size;
1528 	if (type == V4L2_CTRL_TYPE_MENU)
1529 		ctrl->qmenu = qmenu;
1530 	else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
1531 		ctrl->qmenu_int = qmenu_int;
1532 	ctrl->priv = priv;
1533 	ctrl->cur.val = ctrl->val = def;
1534 	data = &ctrl[1];
1535 
1536 	if (!ctrl->is_int) {
1537 		ctrl->p_new.p = data;
1538 		ctrl->p_cur.p = data + tot_ctrl_size;
1539 	} else {
1540 		ctrl->p_new.p = &ctrl->val;
1541 		ctrl->p_cur.p = &ctrl->cur.val;
1542 	}
1543 
1544 	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const) {
1545 		ctrl->p_def.p = ctrl->p_cur.p + tot_ctrl_size;
1546 		memcpy(ctrl->p_def.p, p_def.p_const, elem_size);
1547 	}
1548 
1549 	for (idx = 0; idx < elems; idx++) {
1550 		ctrl->type_ops->init(ctrl, idx, ctrl->p_cur);
1551 		ctrl->type_ops->init(ctrl, idx, ctrl->p_new);
1552 	}
1553 
1554 	if (handler_new_ref(hdl, ctrl, NULL, false, false)) {
1555 		kvfree(ctrl);
1556 		return NULL;
1557 	}
1558 	mutex_lock(hdl->lock);
1559 	list_add_tail(&ctrl->node, &hdl->ctrls);
1560 	mutex_unlock(hdl->lock);
1561 	return ctrl;
1562 }
1563 
1564 struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
1565 			const struct v4l2_ctrl_config *cfg, void *priv)
1566 {
1567 	bool is_menu;
1568 	struct v4l2_ctrl *ctrl;
1569 	const char *name = cfg->name;
1570 	const char * const *qmenu = cfg->qmenu;
1571 	const s64 *qmenu_int = cfg->qmenu_int;
1572 	enum v4l2_ctrl_type type = cfg->type;
1573 	u32 flags = cfg->flags;
1574 	s64 min = cfg->min;
1575 	s64 max = cfg->max;
1576 	u64 step = cfg->step;
1577 	s64 def = cfg->def;
1578 
1579 	if (name == NULL)
1580 		v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
1581 								&def, &flags);
1582 
1583 	is_menu = (type == V4L2_CTRL_TYPE_MENU ||
1584 		   type == V4L2_CTRL_TYPE_INTEGER_MENU);
1585 	if (is_menu)
1586 		WARN_ON(step);
1587 	else
1588 		WARN_ON(cfg->menu_skip_mask);
1589 	if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
1590 		qmenu = v4l2_ctrl_get_menu(cfg->id);
1591 	} else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
1592 		handler_set_err(hdl, -EINVAL);
1593 		return NULL;
1594 	}
1595 
1596 	ctrl = v4l2_ctrl_new(hdl, cfg->ops, cfg->type_ops, cfg->id, name,
1597 			type, min, max,
1598 			is_menu ? cfg->menu_skip_mask : step, def,
1599 			cfg->dims, cfg->elem_size,
1600 			flags, qmenu, qmenu_int, cfg->p_def, priv);
1601 	if (ctrl)
1602 		ctrl->is_private = cfg->is_private;
1603 	return ctrl;
1604 }
1605 EXPORT_SYMBOL(v4l2_ctrl_new_custom);
1606 
1607 /* Helper function for standard non-menu controls */
1608 struct v4l2_ctrl *v4l2_ctrl_new_std(struct v4l2_ctrl_handler *hdl,
1609 			const struct v4l2_ctrl_ops *ops,
1610 			u32 id, s64 min, s64 max, u64 step, s64 def)
1611 {
1612 	const char *name;
1613 	enum v4l2_ctrl_type type;
1614 	u32 flags;
1615 
1616 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
1617 	if (type == V4L2_CTRL_TYPE_MENU ||
1618 	    type == V4L2_CTRL_TYPE_INTEGER_MENU ||
1619 	    type >= V4L2_CTRL_COMPOUND_TYPES) {
1620 		handler_set_err(hdl, -EINVAL);
1621 		return NULL;
1622 	}
1623 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
1624 			     min, max, step, def, NULL, 0,
1625 			     flags, NULL, NULL, ptr_null, NULL);
1626 }
1627 EXPORT_SYMBOL(v4l2_ctrl_new_std);
1628 
1629 /* Helper function for standard menu controls */
1630 struct v4l2_ctrl *v4l2_ctrl_new_std_menu(struct v4l2_ctrl_handler *hdl,
1631 			const struct v4l2_ctrl_ops *ops,
1632 			u32 id, u8 _max, u64 mask, u8 _def)
1633 {
1634 	const char * const *qmenu = NULL;
1635 	const s64 *qmenu_int = NULL;
1636 	unsigned int qmenu_int_len = 0;
1637 	const char *name;
1638 	enum v4l2_ctrl_type type;
1639 	s64 min;
1640 	s64 max = _max;
1641 	s64 def = _def;
1642 	u64 step;
1643 	u32 flags;
1644 
1645 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
1646 
1647 	if (type == V4L2_CTRL_TYPE_MENU)
1648 		qmenu = v4l2_ctrl_get_menu(id);
1649 	else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
1650 		qmenu_int = v4l2_ctrl_get_int_menu(id, &qmenu_int_len);
1651 
1652 	if ((!qmenu && !qmenu_int) || (qmenu_int && max > qmenu_int_len)) {
1653 		handler_set_err(hdl, -EINVAL);
1654 		return NULL;
1655 	}
1656 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
1657 			     0, max, mask, def, NULL, 0,
1658 			     flags, qmenu, qmenu_int, ptr_null, NULL);
1659 }
1660 EXPORT_SYMBOL(v4l2_ctrl_new_std_menu);
1661 
1662 /* Helper function for standard menu controls with driver defined menu */
1663 struct v4l2_ctrl *v4l2_ctrl_new_std_menu_items(struct v4l2_ctrl_handler *hdl,
1664 			const struct v4l2_ctrl_ops *ops, u32 id, u8 _max,
1665 			u64 mask, u8 _def, const char * const *qmenu)
1666 {
1667 	enum v4l2_ctrl_type type;
1668 	const char *name;
1669 	u32 flags;
1670 	u64 step;
1671 	s64 min;
1672 	s64 max = _max;
1673 	s64 def = _def;
1674 
1675 	/* v4l2_ctrl_new_std_menu_items() should only be called for
1676 	 * standard controls without a standard menu.
1677 	 */
1678 	if (v4l2_ctrl_get_menu(id)) {
1679 		handler_set_err(hdl, -EINVAL);
1680 		return NULL;
1681 	}
1682 
1683 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
1684 	if (type != V4L2_CTRL_TYPE_MENU || qmenu == NULL) {
1685 		handler_set_err(hdl, -EINVAL);
1686 		return NULL;
1687 	}
1688 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
1689 			     0, max, mask, def, NULL, 0,
1690 			     flags, qmenu, NULL, ptr_null, NULL);
1691 
1692 }
1693 EXPORT_SYMBOL(v4l2_ctrl_new_std_menu_items);
1694 
1695 /* Helper function for standard compound controls */
1696 struct v4l2_ctrl *v4l2_ctrl_new_std_compound(struct v4l2_ctrl_handler *hdl,
1697 				const struct v4l2_ctrl_ops *ops, u32 id,
1698 				const union v4l2_ctrl_ptr p_def)
1699 {
1700 	const char *name;
1701 	enum v4l2_ctrl_type type;
1702 	u32 flags;
1703 	s64 min, max, step, def;
1704 
1705 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
1706 	if (type < V4L2_CTRL_COMPOUND_TYPES) {
1707 		handler_set_err(hdl, -EINVAL);
1708 		return NULL;
1709 	}
1710 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
1711 			     min, max, step, def, NULL, 0,
1712 			     flags, NULL, NULL, p_def, NULL);
1713 }
1714 EXPORT_SYMBOL(v4l2_ctrl_new_std_compound);
1715 
1716 /* Helper function for standard integer menu controls */
1717 struct v4l2_ctrl *v4l2_ctrl_new_int_menu(struct v4l2_ctrl_handler *hdl,
1718 			const struct v4l2_ctrl_ops *ops,
1719 			u32 id, u8 _max, u8 _def, const s64 *qmenu_int)
1720 {
1721 	const char *name;
1722 	enum v4l2_ctrl_type type;
1723 	s64 min;
1724 	u64 step;
1725 	s64 max = _max;
1726 	s64 def = _def;
1727 	u32 flags;
1728 
1729 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
1730 	if (type != V4L2_CTRL_TYPE_INTEGER_MENU) {
1731 		handler_set_err(hdl, -EINVAL);
1732 		return NULL;
1733 	}
1734 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
1735 			     0, max, 0, def, NULL, 0,
1736 			     flags, NULL, qmenu_int, ptr_null, NULL);
1737 }
1738 EXPORT_SYMBOL(v4l2_ctrl_new_int_menu);
1739 
1740 /* Add the controls from another handler to our own. */
1741 int v4l2_ctrl_add_handler(struct v4l2_ctrl_handler *hdl,
1742 			  struct v4l2_ctrl_handler *add,
1743 			  bool (*filter)(const struct v4l2_ctrl *ctrl),
1744 			  bool from_other_dev)
1745 {
1746 	struct v4l2_ctrl_ref *ref;
1747 	int ret = 0;
1748 
1749 	/* Do nothing if either handler is NULL or if they are the same */
1750 	if (!hdl || !add || hdl == add)
1751 		return 0;
1752 	if (hdl->error)
1753 		return hdl->error;
1754 	mutex_lock(add->lock);
1755 	list_for_each_entry(ref, &add->ctrl_refs, node) {
1756 		struct v4l2_ctrl *ctrl = ref->ctrl;
1757 
1758 		/* Skip handler-private controls. */
1759 		if (ctrl->is_private)
1760 			continue;
1761 		/* And control classes */
1762 		if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
1763 			continue;
1764 		/* Filter any unwanted controls */
1765 		if (filter && !filter(ctrl))
1766 			continue;
1767 		ret = handler_new_ref(hdl, ctrl, NULL, from_other_dev, false);
1768 		if (ret)
1769 			break;
1770 	}
1771 	mutex_unlock(add->lock);
1772 	return ret;
1773 }
1774 EXPORT_SYMBOL(v4l2_ctrl_add_handler);
1775 
1776 bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl)
1777 {
1778 	if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_TX)
1779 		return true;
1780 	if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_RX)
1781 		return true;
1782 	switch (ctrl->id) {
1783 	case V4L2_CID_AUDIO_MUTE:
1784 	case V4L2_CID_AUDIO_VOLUME:
1785 	case V4L2_CID_AUDIO_BALANCE:
1786 	case V4L2_CID_AUDIO_BASS:
1787 	case V4L2_CID_AUDIO_TREBLE:
1788 	case V4L2_CID_AUDIO_LOUDNESS:
1789 		return true;
1790 	default:
1791 		break;
1792 	}
1793 	return false;
1794 }
1795 EXPORT_SYMBOL(v4l2_ctrl_radio_filter);
1796 
1797 /* Cluster controls */
1798 void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
1799 {
1800 	bool has_volatiles = false;
1801 	int i;
1802 
1803 	/* The first control is the master control and it must not be NULL */
1804 	if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
1805 		return;
1806 
1807 	for (i = 0; i < ncontrols; i++) {
1808 		if (controls[i]) {
1809 			controls[i]->cluster = controls;
1810 			controls[i]->ncontrols = ncontrols;
1811 			if (controls[i]->flags & V4L2_CTRL_FLAG_VOLATILE)
1812 				has_volatiles = true;
1813 		}
1814 	}
1815 	controls[0]->has_volatiles = has_volatiles;
1816 }
1817 EXPORT_SYMBOL(v4l2_ctrl_cluster);
1818 
1819 void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
1820 			    u8 manual_val, bool set_volatile)
1821 {
1822 	struct v4l2_ctrl *master = controls[0];
1823 	u32 flag = 0;
1824 	int i;
1825 
1826 	v4l2_ctrl_cluster(ncontrols, controls);
1827 	WARN_ON(ncontrols <= 1);
1828 	WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
1829 	WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
1830 	master->is_auto = true;
1831 	master->has_volatiles = set_volatile;
1832 	master->manual_mode_value = manual_val;
1833 	master->flags |= V4L2_CTRL_FLAG_UPDATE;
1834 
1835 	if (!is_cur_manual(master))
1836 		flag = V4L2_CTRL_FLAG_INACTIVE |
1837 			(set_volatile ? V4L2_CTRL_FLAG_VOLATILE : 0);
1838 
1839 	for (i = 1; i < ncontrols; i++)
1840 		if (controls[i])
1841 			controls[i]->flags |= flag;
1842 }
1843 EXPORT_SYMBOL(v4l2_ctrl_auto_cluster);
1844 
1845 /*
1846  * Obtain the current volatile values of an autocluster and mark them
1847  * as new.
1848  */
1849 void update_from_auto_cluster(struct v4l2_ctrl *master)
1850 {
1851 	int i;
1852 
1853 	for (i = 1; i < master->ncontrols; i++)
1854 		cur_to_new(master->cluster[i]);
1855 	if (!call_op(master, g_volatile_ctrl))
1856 		for (i = 1; i < master->ncontrols; i++)
1857 			if (master->cluster[i])
1858 				master->cluster[i]->is_new = 1;
1859 }
1860 
1861 /*
1862  * Return non-zero if one or more of the controls in the cluster has a new
1863  * value that differs from the current value.
1864  */
1865 static int cluster_changed(struct v4l2_ctrl *master)
1866 {
1867 	bool changed = false;
1868 	unsigned int idx;
1869 	int i;
1870 
1871 	for (i = 0; i < master->ncontrols; i++) {
1872 		struct v4l2_ctrl *ctrl = master->cluster[i];
1873 		bool ctrl_changed = false;
1874 
1875 		if (!ctrl)
1876 			continue;
1877 
1878 		if (ctrl->flags & V4L2_CTRL_FLAG_EXECUTE_ON_WRITE) {
1879 			changed = true;
1880 			ctrl_changed = true;
1881 		}
1882 
1883 		/*
1884 		 * Set has_changed to false to avoid generating
1885 		 * the event V4L2_EVENT_CTRL_CH_VALUE
1886 		 */
1887 		if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
1888 			ctrl->has_changed = false;
1889 			continue;
1890 		}
1891 
1892 		for (idx = 0; !ctrl_changed && idx < ctrl->elems; idx++)
1893 			ctrl_changed = !ctrl->type_ops->equal(ctrl, idx,
1894 				ctrl->p_cur, ctrl->p_new);
1895 		ctrl->has_changed = ctrl_changed;
1896 		changed |= ctrl->has_changed;
1897 	}
1898 	return changed;
1899 }
1900 
1901 /*
1902  * Core function that calls try/s_ctrl and ensures that the new value is
1903  * copied to the current value on a set.
1904  * Must be called with ctrl->handler->lock held.
1905  */
1906 int try_or_set_cluster(struct v4l2_fh *fh, struct v4l2_ctrl *master,
1907 		       bool set, u32 ch_flags)
1908 {
1909 	bool update_flag;
1910 	int ret;
1911 	int i;
1912 
1913 	/*
1914 	 * Go through the cluster and either validate the new value or
1915 	 * (if no new value was set), copy the current value to the new
1916 	 * value, ensuring a consistent view for the control ops when
1917 	 * called.
1918 	 */
1919 	for (i = 0; i < master->ncontrols; i++) {
1920 		struct v4l2_ctrl *ctrl = master->cluster[i];
1921 
1922 		if (!ctrl)
1923 			continue;
1924 
1925 		if (!ctrl->is_new) {
1926 			cur_to_new(ctrl);
1927 			continue;
1928 		}
1929 		/*
1930 		 * Check again: it may have changed since the
1931 		 * previous check in try_or_set_ext_ctrls().
1932 		 */
1933 		if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED))
1934 			return -EBUSY;
1935 	}
1936 
1937 	ret = call_op(master, try_ctrl);
1938 
1939 	/* Don't set if there is no change */
1940 	if (ret || !set || !cluster_changed(master))
1941 		return ret;
1942 	ret = call_op(master, s_ctrl);
1943 	if (ret)
1944 		return ret;
1945 
1946 	/* If OK, then make the new values permanent. */
1947 	update_flag = is_cur_manual(master) != is_new_manual(master);
1948 
1949 	for (i = 0; i < master->ncontrols; i++) {
1950 		/*
1951 		 * If we switch from auto to manual mode, and this cluster
1952 		 * contains volatile controls, then all non-master controls
1953 		 * have to be marked as changed. The 'new' value contains
1954 		 * the volatile value (obtained by update_from_auto_cluster),
1955 		 * which now has to become the current value.
1956 		 */
1957 		if (i && update_flag && is_new_manual(master) &&
1958 		    master->has_volatiles && master->cluster[i])
1959 			master->cluster[i]->has_changed = true;
1960 
1961 		new_to_cur(fh, master->cluster[i], ch_flags |
1962 			((update_flag && i > 0) ? V4L2_EVENT_CTRL_CH_FLAGS : 0));
1963 	}
1964 	return 0;
1965 }
1966 
1967 /* Activate/deactivate a control. */
1968 void v4l2_ctrl_activate(struct v4l2_ctrl *ctrl, bool active)
1969 {
1970 	/* invert since the actual flag is called 'inactive' */
1971 	bool inactive = !active;
1972 	bool old;
1973 
1974 	if (ctrl == NULL)
1975 		return;
1976 
1977 	if (inactive)
1978 		/* set V4L2_CTRL_FLAG_INACTIVE */
1979 		old = test_and_set_bit(4, &ctrl->flags);
1980 	else
1981 		/* clear V4L2_CTRL_FLAG_INACTIVE */
1982 		old = test_and_clear_bit(4, &ctrl->flags);
1983 	if (old != inactive)
1984 		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
1985 }
1986 EXPORT_SYMBOL(v4l2_ctrl_activate);
1987 
1988 void __v4l2_ctrl_grab(struct v4l2_ctrl *ctrl, bool grabbed)
1989 {
1990 	bool old;
1991 
1992 	if (ctrl == NULL)
1993 		return;
1994 
1995 	lockdep_assert_held(ctrl->handler->lock);
1996 
1997 	if (grabbed)
1998 		/* set V4L2_CTRL_FLAG_GRABBED */
1999 		old = test_and_set_bit(1, &ctrl->flags);
2000 	else
2001 		/* clear V4L2_CTRL_FLAG_GRABBED */
2002 		old = test_and_clear_bit(1, &ctrl->flags);
2003 	if (old != grabbed)
2004 		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2005 }
2006 EXPORT_SYMBOL(__v4l2_ctrl_grab);
2007 
2008 /* Call s_ctrl for all controls owned by the handler */
2009 int __v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2010 {
2011 	struct v4l2_ctrl *ctrl;
2012 	int ret = 0;
2013 
2014 	if (hdl == NULL)
2015 		return 0;
2016 
2017 	lockdep_assert_held(hdl->lock);
2018 
2019 	list_for_each_entry(ctrl, &hdl->ctrls, node)
2020 		ctrl->done = false;
2021 
2022 	list_for_each_entry(ctrl, &hdl->ctrls, node) {
2023 		struct v4l2_ctrl *master = ctrl->cluster[0];
2024 		int i;
2025 
2026 		/* Skip if this control was already handled by a cluster. */
2027 		/* Skip button controls and read-only controls. */
2028 		if (ctrl->done || ctrl->type == V4L2_CTRL_TYPE_BUTTON ||
2029 		    (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY))
2030 			continue;
2031 
2032 		for (i = 0; i < master->ncontrols; i++) {
2033 			if (master->cluster[i]) {
2034 				cur_to_new(master->cluster[i]);
2035 				master->cluster[i]->is_new = 1;
2036 				master->cluster[i]->done = true;
2037 			}
2038 		}
2039 		ret = call_op(master, s_ctrl);
2040 		if (ret)
2041 			break;
2042 	}
2043 
2044 	return ret;
2045 }
2046 EXPORT_SYMBOL_GPL(__v4l2_ctrl_handler_setup);
2047 
2048 int v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2049 {
2050 	int ret;
2051 
2052 	if (hdl == NULL)
2053 		return 0;
2054 
2055 	mutex_lock(hdl->lock);
2056 	ret = __v4l2_ctrl_handler_setup(hdl);
2057 	mutex_unlock(hdl->lock);
2058 
2059 	return ret;
2060 }
2061 EXPORT_SYMBOL(v4l2_ctrl_handler_setup);
2062 
2063 /* Log the control name and value */
2064 static void log_ctrl(const struct v4l2_ctrl *ctrl,
2065 		     const char *prefix, const char *colon)
2066 {
2067 	if (ctrl->flags & (V4L2_CTRL_FLAG_DISABLED | V4L2_CTRL_FLAG_WRITE_ONLY))
2068 		return;
2069 	if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2070 		return;
2071 
2072 	pr_info("%s%s%s: ", prefix, colon, ctrl->name);
2073 
2074 	ctrl->type_ops->log(ctrl);
2075 
2076 	if (ctrl->flags & (V4L2_CTRL_FLAG_INACTIVE |
2077 			   V4L2_CTRL_FLAG_GRABBED |
2078 			   V4L2_CTRL_FLAG_VOLATILE)) {
2079 		if (ctrl->flags & V4L2_CTRL_FLAG_INACTIVE)
2080 			pr_cont(" inactive");
2081 		if (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)
2082 			pr_cont(" grabbed");
2083 		if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE)
2084 			pr_cont(" volatile");
2085 	}
2086 	pr_cont("\n");
2087 }
2088 
2089 /* Log all controls owned by the handler */
2090 void v4l2_ctrl_handler_log_status(struct v4l2_ctrl_handler *hdl,
2091 				  const char *prefix)
2092 {
2093 	struct v4l2_ctrl *ctrl;
2094 	const char *colon = "";
2095 	int len;
2096 
2097 	if (!hdl)
2098 		return;
2099 	if (!prefix)
2100 		prefix = "";
2101 	len = strlen(prefix);
2102 	if (len && prefix[len - 1] != ' ')
2103 		colon = ": ";
2104 	mutex_lock(hdl->lock);
2105 	list_for_each_entry(ctrl, &hdl->ctrls, node)
2106 		if (!(ctrl->flags & V4L2_CTRL_FLAG_DISABLED))
2107 			log_ctrl(ctrl, prefix, colon);
2108 	mutex_unlock(hdl->lock);
2109 }
2110 EXPORT_SYMBOL(v4l2_ctrl_handler_log_status);
2111 
2112 int v4l2_ctrl_new_fwnode_properties(struct v4l2_ctrl_handler *hdl,
2113 				    const struct v4l2_ctrl_ops *ctrl_ops,
2114 				    const struct v4l2_fwnode_device_properties *p)
2115 {
2116 	if (p->orientation != V4L2_FWNODE_PROPERTY_UNSET) {
2117 		u32 orientation_ctrl;
2118 
2119 		switch (p->orientation) {
2120 		case V4L2_FWNODE_ORIENTATION_FRONT:
2121 			orientation_ctrl = V4L2_CAMERA_ORIENTATION_FRONT;
2122 			break;
2123 		case V4L2_FWNODE_ORIENTATION_BACK:
2124 			orientation_ctrl = V4L2_CAMERA_ORIENTATION_BACK;
2125 			break;
2126 		case V4L2_FWNODE_ORIENTATION_EXTERNAL:
2127 			orientation_ctrl = V4L2_CAMERA_ORIENTATION_EXTERNAL;
2128 			break;
2129 		default:
2130 			return -EINVAL;
2131 		}
2132 		if (!v4l2_ctrl_new_std_menu(hdl, ctrl_ops,
2133 					    V4L2_CID_CAMERA_ORIENTATION,
2134 					    V4L2_CAMERA_ORIENTATION_EXTERNAL, 0,
2135 					    orientation_ctrl))
2136 			return hdl->error;
2137 	}
2138 
2139 	if (p->rotation != V4L2_FWNODE_PROPERTY_UNSET) {
2140 		if (!v4l2_ctrl_new_std(hdl, ctrl_ops,
2141 				       V4L2_CID_CAMERA_SENSOR_ROTATION,
2142 				       p->rotation, p->rotation, 1,
2143 				       p->rotation))
2144 			return hdl->error;
2145 	}
2146 
2147 	return hdl->error;
2148 }
2149 EXPORT_SYMBOL(v4l2_ctrl_new_fwnode_properties);
2150