drivers/media/v4l2-core/v4l2-ctrls-core.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * V4L2 controls framework core implementation.
   4  *
   5  * Copyright (C) 2010-2021  Hans Verkuil <hverkuil-cisco@xs4all.nl>
   6  */
   7
   8 #include <linux/export.h>
   9 #include <linux/mm.h>
  10 #include <linux/slab.h>
  11 #include <media/v4l2-ctrls.h>
  12 #include <media/v4l2-event.h>
  13 #include <media/v4l2-fwnode.h>
  14
  15 #include "v4l2-ctrls-priv.h"
  16
  17 static const union v4l2_ctrl_ptr ptr_null;
  18
  19 static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl,
  20                        u32 changes)
  21 {
  22         memset(ev, 0, sizeof(*ev));
  23         ev->type = V4L2_EVENT_CTRL;
  24         ev->id = ctrl->id;
  25         ev->u.ctrl.changes = changes;
  26         ev->u.ctrl.type = ctrl->type;
  27         ev->u.ctrl.flags = user_flags(ctrl);
  28         if (ctrl->is_ptr)
  29                 ev->u.ctrl.value64 = 0;
  30         else
  31                 ev->u.ctrl.value64 = *ctrl->p_cur.p_s64;
  32         ev->u.ctrl.minimum = ctrl->minimum;
  33         ev->u.ctrl.maximum = ctrl->maximum;
  34         if (ctrl->type == V4L2_CTRL_TYPE_MENU
  35             || ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
  36                 ev->u.ctrl.step = 1;
  37         else
  38                 ev->u.ctrl.step = ctrl->step;
  39         ev->u.ctrl.default_value = ctrl->default_value;
  40 }
  41
  42 void send_initial_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl)
  43 {
  44         struct v4l2_event ev;
  45         u32 changes = V4L2_EVENT_CTRL_CH_FLAGS;
  46
  47         if (!(ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY))
  48                 changes |= V4L2_EVENT_CTRL_CH_VALUE;
  49         fill_event(&ev, ctrl, changes);
  50         v4l2_event_queue_fh(fh, &ev);
  51 }
  52
  53 void send_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 changes)
  54 {
  55         struct v4l2_event ev;
  56         struct v4l2_subscribed_event *sev;
  57
  58         if (list_empty(&ctrl->ev_subs))
  59                 return;
  60         fill_event(&ev, ctrl, changes);
  61
  62         list_for_each_entry(sev, &ctrl->ev_subs, node)
  63                 if (sev->fh != fh ||
  64                     (sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK))
  65                         v4l2_event_queue_fh(sev->fh, &ev);
  66 }
  67
  68 bool v4l2_ctrl_type_op_equal(const struct v4l2_ctrl *ctrl,
  69                              union v4l2_ctrl_ptr ptr1, union v4l2_ctrl_ptr ptr2)
  70 {
  71         unsigned int i;
  72
  73         switch (ctrl->type) {
  74         case V4L2_CTRL_TYPE_BUTTON:
  75                 return false;
  76         case V4L2_CTRL_TYPE_STRING:
  77                 for (i = 0; i < ctrl->elems; i++) {
  78                         unsigned int idx = i * ctrl->elem_size;
  79
  80                         /* strings are always 0-terminated */
  81                         if (strcmp(ptr1.p_char + idx, ptr2.p_char + idx))
  82                                 return false;
  83                 }
  84                 return true;
  85         default:
  86                 return !memcmp(ptr1.p_const, ptr2.p_const,
  87                                ctrl->elems * ctrl->elem_size);
  88         }
  89 }
  90 EXPORT_SYMBOL(v4l2_ctrl_type_op_equal);
  91
  92 /* Default intra MPEG-2 quantisation coefficients, from the specification. */
  93 static const u8 mpeg2_intra_quant_matrix[64] = {
  94         8,  16, 16, 19, 16, 19, 22, 22,
  95         22, 22, 22, 22, 26, 24, 26, 27,
  96         27, 27, 26, 26, 26, 26, 27, 27,
  97         27, 29, 29, 29, 34, 34, 34, 29,
  98         29, 29, 27, 27, 29, 29, 32, 32,
  99         34, 34, 37, 38, 37, 35, 35, 34,
 100         35, 38, 38, 40, 40, 40, 48, 48,
 101         46, 46, 56, 56, 58, 69, 69, 83
 102 };
 103
 104 static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 105                               union v4l2_ctrl_ptr ptr)
 106 {
 107         struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
 108         struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
 109         struct v4l2_ctrl_mpeg2_quantisation *p_mpeg2_quant;
 110         struct v4l2_ctrl_vp8_frame *p_vp8_frame;
 111         struct v4l2_ctrl_vp9_frame *p_vp9_frame;
 112         struct v4l2_ctrl_fwht_params *p_fwht_params;
 113         struct v4l2_ctrl_h264_scaling_matrix *p_h264_scaling_matrix;
 114         struct v4l2_ctrl_av1_sequence *p_av1_sequence;
 115         void *p = ptr.p + idx * ctrl->elem_size;
 116
 117         if (ctrl->p_def.p_const)
 118                 memcpy(p, ctrl->p_def.p_const, ctrl->elem_size);
 119         else
 120                 memset(p, 0, ctrl->elem_size);
 121
 122         switch ((u32)ctrl->type) {
 123         case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
 124                 p_mpeg2_sequence = p;
 125
 126                 /* 4:2:0 */
 127                 p_mpeg2_sequence->chroma_format = 1;
 128                 break;
 129         case V4L2_CTRL_TYPE_MPEG2_PICTURE:
 130                 p_mpeg2_picture = p;
 131
 132                 /* interlaced top field */
 133                 p_mpeg2_picture->picture_structure = V4L2_MPEG2_PIC_TOP_FIELD;
 134                 p_mpeg2_picture->picture_coding_type =
 135                                         V4L2_MPEG2_PIC_CODING_TYPE_I;
 136                 break;
 137         case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
 138                 p_mpeg2_quant = p;
 139
 140                 memcpy(p_mpeg2_quant->intra_quantiser_matrix,
 141                        mpeg2_intra_quant_matrix,
 142                        ARRAY_SIZE(mpeg2_intra_quant_matrix));
 143                 /*
 144                  * The default non-intra MPEG-2 quantisation
 145                  * coefficients are all 16, as per the specification.
 146                  */
 147                 memset(p_mpeg2_quant->non_intra_quantiser_matrix, 16,
 148                        sizeof(p_mpeg2_quant->non_intra_quantiser_matrix));
 149                 break;
 150         case V4L2_CTRL_TYPE_VP8_FRAME:
 151                 p_vp8_frame = p;
 152                 p_vp8_frame->num_dct_parts = 1;
 153                 break;
 154         case V4L2_CTRL_TYPE_VP9_FRAME:
 155                 p_vp9_frame = p;
 156                 p_vp9_frame->profile = 0;
 157                 p_vp9_frame->bit_depth = 8;
 158                 p_vp9_frame->flags |= V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
 159                         V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING;
 160                 break;
 161         case V4L2_CTRL_TYPE_AV1_SEQUENCE:
 162                 p_av1_sequence = p;
 163                 p_av1_sequence->bit_depth = 8;
 164                 break;
 165         case V4L2_CTRL_TYPE_FWHT_PARAMS:
 166                 p_fwht_params = p;
 167                 p_fwht_params->version = V4L2_FWHT_VERSION;
 168                 p_fwht_params->width = 1280;
 169                 p_fwht_params->height = 720;
 170                 p_fwht_params->flags = V4L2_FWHT_FL_PIXENC_YUV |
 171                         (2 << V4L2_FWHT_FL_COMPONENTS_NUM_OFFSET);
 172                 break;
 173         case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
 174                 p_h264_scaling_matrix = p;
 175                 /*
 176                  * The default (flat) H.264 scaling matrix when none are
 177                  * specified in the bitstream, this is according to formulas
 178                  *  (7-8) and (7-9) of the specification.
 179                  */
 180                 memset(p_h264_scaling_matrix, 16, sizeof(*p_h264_scaling_matrix));
 181                 break;
 182         }
 183 }
 184
 185 void v4l2_ctrl_type_op_init(const struct v4l2_ctrl *ctrl, u32 from_idx,
 186                             union v4l2_ctrl_ptr ptr)
 187 {
 188         unsigned int i;
 189         u32 tot_elems = ctrl->elems;
 190         u32 elems = tot_elems - from_idx;
 191
 192         if (from_idx >= tot_elems)
 193                 return;
 194
 195         switch (ctrl->type) {
 196         case V4L2_CTRL_TYPE_STRING:
 197                 for (i = from_idx; i < tot_elems; i++) {
 198                         unsigned int offset = i * ctrl->elem_size;
 199
 200                         memset(ptr.p_char + offset, ' ', ctrl->minimum);
 201                         ptr.p_char[offset + ctrl->minimum] = '\0';
 202                 }
 203                 break;
 204         case V4L2_CTRL_TYPE_INTEGER64:
 205                 if (ctrl->default_value) {
 206                         for (i = from_idx; i < tot_elems; i++)
 207                                 ptr.p_s64[i] = ctrl->default_value;
 208                 } else {
 209                         memset(ptr.p_s64 + from_idx, 0, elems * sizeof(s64));
 210                 }
 211                 break;
 212         case V4L2_CTRL_TYPE_INTEGER:
 213         case V4L2_CTRL_TYPE_INTEGER_MENU:
 214         case V4L2_CTRL_TYPE_MENU:
 215         case V4L2_CTRL_TYPE_BITMASK:
 216         case V4L2_CTRL_TYPE_BOOLEAN:
 217                 if (ctrl->default_value) {
 218                         for (i = from_idx; i < tot_elems; i++)
 219                                 ptr.p_s32[i] = ctrl->default_value;
 220                 } else {
 221                         memset(ptr.p_s32 + from_idx, 0, elems * sizeof(s32));
 222                 }
 223                 break;
 224         case V4L2_CTRL_TYPE_BUTTON:
 225         case V4L2_CTRL_TYPE_CTRL_CLASS:
 226                 memset(ptr.p_s32 + from_idx, 0, elems * sizeof(s32));
 227                 break;
 228         case V4L2_CTRL_TYPE_U8:
 229                 memset(ptr.p_u8 + from_idx, ctrl->default_value, elems);
 230                 break;
 231         case V4L2_CTRL_TYPE_U16:
 232                 if (ctrl->default_value) {
 233                         for (i = from_idx; i < tot_elems; i++)
 234                                 ptr.p_u16[i] = ctrl->default_value;
 235                 } else {
 236                         memset(ptr.p_u16 + from_idx, 0, elems * sizeof(u16));
 237                 }
 238                 break;
 239         case V4L2_CTRL_TYPE_U32:
 240                 if (ctrl->default_value) {
 241                         for (i = from_idx; i < tot_elems; i++)
 242                                 ptr.p_u32[i] = ctrl->default_value;
 243                 } else {
 244                         memset(ptr.p_u32 + from_idx, 0, elems * sizeof(u32));
 245                 }
 246                 break;
 247         default:
 248                 for (i = from_idx; i < tot_elems; i++)
 249                         std_init_compound(ctrl, i, ptr);
 250                 break;
 251         }
 252 }
 253 EXPORT_SYMBOL(v4l2_ctrl_type_op_init);
 254
 255 void v4l2_ctrl_type_op_log(const struct v4l2_ctrl *ctrl)
 256 {
 257         union v4l2_ctrl_ptr ptr = ctrl->p_cur;
 258
 259         if (ctrl->is_array) {
 260                 unsigned i;
 261
 262                 for (i = 0; i < ctrl->nr_of_dims; i++)
 263                         pr_cont("[%u]", ctrl->dims[i]);
 264                 pr_cont(" ");
 265         }
 266
 267         switch (ctrl->type) {
 268         case V4L2_CTRL_TYPE_INTEGER:
 269                 pr_cont("%d", *ptr.p_s32);
 270                 break;
 271         case V4L2_CTRL_TYPE_BOOLEAN:
 272                 pr_cont("%s", *ptr.p_s32 ? "true" : "false");
 273                 break;
 274         case V4L2_CTRL_TYPE_MENU:
 275                 pr_cont("%s", ctrl->qmenu[*ptr.p_s32]);
 276                 break;
 277         case V4L2_CTRL_TYPE_INTEGER_MENU:
 278                 pr_cont("%lld", ctrl->qmenu_int[*ptr.p_s32]);
 279                 break;
 280         case V4L2_CTRL_TYPE_BITMASK:
 281                 pr_cont("0x%08x", *ptr.p_s32);
 282                 break;
 283         case V4L2_CTRL_TYPE_INTEGER64:
 284                 pr_cont("%lld", *ptr.p_s64);
 285                 break;
 286         case V4L2_CTRL_TYPE_STRING:
 287                 pr_cont("%s", ptr.p_char);
 288                 break;
 289         case V4L2_CTRL_TYPE_U8:
 290                 pr_cont("%u", (unsigned)*ptr.p_u8);
 291                 break;
 292         case V4L2_CTRL_TYPE_U16:
 293                 pr_cont("%u", (unsigned)*ptr.p_u16);
 294                 break;
 295         case V4L2_CTRL_TYPE_U32:
 296                 pr_cont("%u", (unsigned)*ptr.p_u32);
 297                 break;
 298         case V4L2_CTRL_TYPE_H264_SPS:
 299                 pr_cont("H264_SPS");
 300                 break;
 301         case V4L2_CTRL_TYPE_H264_PPS:
 302                 pr_cont("H264_PPS");
 303                 break;
 304         case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
 305                 pr_cont("H264_SCALING_MATRIX");
 306                 break;
 307         case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
 308                 pr_cont("H264_SLICE_PARAMS");
 309                 break;
 310         case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
 311                 pr_cont("H264_DECODE_PARAMS");
 312                 break;
 313         case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
 314                 pr_cont("H264_PRED_WEIGHTS");
 315                 break;
 316         case V4L2_CTRL_TYPE_FWHT_PARAMS:
 317                 pr_cont("FWHT_PARAMS");
 318                 break;
 319         case V4L2_CTRL_TYPE_VP8_FRAME:
 320                 pr_cont("VP8_FRAME");
 321                 break;
 322         case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
 323                 pr_cont("HDR10_CLL_INFO");
 324                 break;
 325         case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
 326                 pr_cont("HDR10_MASTERING_DISPLAY");
 327                 break;
 328         case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
 329                 pr_cont("MPEG2_QUANTISATION");
 330                 break;
 331         case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
 332                 pr_cont("MPEG2_SEQUENCE");
 333                 break;
 334         case V4L2_CTRL_TYPE_MPEG2_PICTURE:
 335                 pr_cont("MPEG2_PICTURE");
 336                 break;
 337         case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
 338                 pr_cont("VP9_COMPRESSED_HDR");
 339                 break;
 340         case V4L2_CTRL_TYPE_VP9_FRAME:
 341                 pr_cont("VP9_FRAME");
 342                 break;
 343         case V4L2_CTRL_TYPE_HEVC_SPS:
 344                 pr_cont("HEVC_SPS");
 345                 break;
 346         case V4L2_CTRL_TYPE_HEVC_PPS:
 347                 pr_cont("HEVC_PPS");
 348                 break;
 349         case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
 350                 pr_cont("HEVC_SLICE_PARAMS");
 351                 break;
 352         case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
 353                 pr_cont("HEVC_SCALING_MATRIX");
 354                 break;
 355         case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
 356                 pr_cont("HEVC_DECODE_PARAMS");
 357                 break;
 358         case V4L2_CTRL_TYPE_AV1_SEQUENCE:
 359                 pr_cont("AV1_SEQUENCE");
 360                 break;
 361         case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
 362                 pr_cont("AV1_TILE_GROUP_ENTRY");
 363                 break;
 364         case V4L2_CTRL_TYPE_AV1_FRAME:
 365                 pr_cont("AV1_FRAME");
 366                 break;
 367         case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
 368                 pr_cont("AV1_FILM_GRAIN");
 369                 break;
 370
 371         default:
 372                 pr_cont("unknown type %d", ctrl->type);
 373                 break;
 374         }
 375 }
 376 EXPORT_SYMBOL(v4l2_ctrl_type_op_log);
 377
 378 /*
 379  * Round towards the closest legal value. Be careful when we are
 380  * close to the maximum range of the control type to prevent
 381  * wrap-arounds.
 382  */
 383 #define ROUND_TO_RANGE(val, offset_type, ctrl)                  \
 384 ({                                                              \
 385         offset_type offset;                                     \
 386         if ((ctrl)->maximum >= 0 &&                             \
 387             val >= (ctrl)->maximum - (s32)((ctrl)->step / 2))   \
 388                 val = (ctrl)->maximum;                          \
 389         else                                                    \
 390                 val += (s32)((ctrl)->step / 2);                 \
 391         val = clamp_t(typeof(val), val,                         \
 392                       (ctrl)->minimum, (ctrl)->maximum);        \
 393         offset = (val) - (ctrl)->minimum;                       \
 394         offset = (ctrl)->step * (offset / (u32)(ctrl)->step);   \
 395         val = (ctrl)->minimum + offset;                         \
 396         0;                                                      \
 397 })
 398
 399 /* Validate a new control */
 400
 401 #define zero_padding(s) \
 402         memset(&(s).padding, 0, sizeof((s).padding))
 403 #define zero_reserved(s) \
 404         memset(&(s).reserved, 0, sizeof((s).reserved))
 405
 406 static int
 407 validate_vp9_lf_params(struct v4l2_vp9_loop_filter *lf)
 408 {
 409         unsigned int i;
 410
 411         if (lf->flags & ~(V4L2_VP9_LOOP_FILTER_FLAG_DELTA_ENABLED |
 412                           V4L2_VP9_LOOP_FILTER_FLAG_DELTA_UPDATE))
 413                 return -EINVAL;
 414
 415         /* That all values are in the accepted range. */
 416         if (lf->level > GENMASK(5, 0))
 417                 return -EINVAL;
 418
 419         if (lf->sharpness > GENMASK(2, 0))
 420                 return -EINVAL;
 421
 422         for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++)
 423                 if (lf->ref_deltas[i] < -63 || lf->ref_deltas[i] > 63)
 424                         return -EINVAL;
 425
 426         for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++)
 427                 if (lf->mode_deltas[i] < -63 || lf->mode_deltas[i] > 63)
 428                         return -EINVAL;
 429
 430         zero_reserved(*lf);
 431         return 0;
 432 }
 433
 434 static int
 435 validate_vp9_quant_params(struct v4l2_vp9_quantization *quant)
 436 {
 437         if (quant->delta_q_y_dc < -15 || quant->delta_q_y_dc > 15 ||
 438             quant->delta_q_uv_dc < -15 || quant->delta_q_uv_dc > 15 ||
 439             quant->delta_q_uv_ac < -15 || quant->delta_q_uv_ac > 15)
 440                 return -EINVAL;
 441
 442         zero_reserved(*quant);
 443         return 0;
 444 }
 445
 446 static int
 447 validate_vp9_seg_params(struct v4l2_vp9_segmentation *seg)
 448 {
 449         unsigned int i, j;
 450
 451         if (seg->flags & ~(V4L2_VP9_SEGMENTATION_FLAG_ENABLED |
 452                            V4L2_VP9_SEGMENTATION_FLAG_UPDATE_MAP |
 453                            V4L2_VP9_SEGMENTATION_FLAG_TEMPORAL_UPDATE |
 454                            V4L2_VP9_SEGMENTATION_FLAG_UPDATE_DATA |
 455                            V4L2_VP9_SEGMENTATION_FLAG_ABS_OR_DELTA_UPDATE))
 456                 return -EINVAL;
 457
 458         for (i = 0; i < ARRAY_SIZE(seg->feature_enabled); i++) {
 459                 if (seg->feature_enabled[i] &
 460                     ~V4L2_VP9_SEGMENT_FEATURE_ENABLED_MASK)
 461                         return -EINVAL;
 462         }
 463
 464         for (i = 0; i < ARRAY_SIZE(seg->feature_data); i++) {
 465                 static const int range[] = { 255, 63, 3, 0 };
 466
 467                 for (j = 0; j < ARRAY_SIZE(seg->feature_data[j]); j++) {
 468                         if (seg->feature_data[i][j] < -range[j] ||
 469                             seg->feature_data[i][j] > range[j])
 470                                 return -EINVAL;
 471                 }
 472         }
 473
 474         zero_reserved(*seg);
 475         return 0;
 476 }
 477
 478 static int
 479 validate_vp9_compressed_hdr(struct v4l2_ctrl_vp9_compressed_hdr *hdr)
 480 {
 481         if (hdr->tx_mode > V4L2_VP9_TX_MODE_SELECT)
 482                 return -EINVAL;
 483
 484         return 0;
 485 }
 486
 487 static int
 488 validate_vp9_frame(struct v4l2_ctrl_vp9_frame *frame)
 489 {
 490         int ret;
 491
 492         /* Make sure we're not passed invalid flags. */
 493         if (frame->flags & ~(V4L2_VP9_FRAME_FLAG_KEY_FRAME |
 494                   V4L2_VP9_FRAME_FLAG_SHOW_FRAME |
 495                   V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT |
 496                   V4L2_VP9_FRAME_FLAG_INTRA_ONLY |
 497                   V4L2_VP9_FRAME_FLAG_ALLOW_HIGH_PREC_MV |
 498                   V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX |
 499                   V4L2_VP9_FRAME_FLAG_PARALLEL_DEC_MODE |
 500                   V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
 501                   V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING |
 502                   V4L2_VP9_FRAME_FLAG_COLOR_RANGE_FULL_SWING))
 503                 return -EINVAL;
 504
 505         if (frame->flags & V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT &&
 506             frame->flags & V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX)
 507                 return -EINVAL;
 508
 509         if (frame->profile > V4L2_VP9_PROFILE_MAX)
 510                 return -EINVAL;
 511
 512         if (frame->reset_frame_context > V4L2_VP9_RESET_FRAME_CTX_ALL)
 513                 return -EINVAL;
 514
 515         if (frame->frame_context_idx >= V4L2_VP9_NUM_FRAME_CTX)
 516                 return -EINVAL;
 517
 518         /*
 519          * Profiles 0 and 1 only support 8-bit depth, profiles 2 and 3 only 10
 520          * and 12 bit depths.
 521          */
 522         if ((frame->profile < 2 && frame->bit_depth != 8) ||
 523             (frame->profile >= 2 &&
 524              (frame->bit_depth != 10 && frame->bit_depth != 12)))
 525                 return -EINVAL;
 526
 527         /* Profile 0 and 2 only accept YUV 4:2:0. */
 528         if ((frame->profile == 0 || frame->profile == 2) &&
 529             (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
 530              !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
 531                 return -EINVAL;
 532
 533         /* Profile 1 and 3 only accept YUV 4:2:2, 4:4:0 and 4:4:4. */
 534         if ((frame->profile == 1 || frame->profile == 3) &&
 535             ((frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) &&
 536              (frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
 537                 return -EINVAL;
 538
 539         if (frame->interpolation_filter > V4L2_VP9_INTERP_FILTER_SWITCHABLE)
 540                 return -EINVAL;
 541
 542         /*
 543          * According to the spec, tile_cols_log2 shall be less than or equal
 544          * to 6.
 545          */
 546         if (frame->tile_cols_log2 > 6)
 547                 return -EINVAL;
 548
 549         if (frame->reference_mode > V4L2_VP9_REFERENCE_MODE_SELECT)
 550                 return -EINVAL;
 551
 552         ret = validate_vp9_lf_params(&frame->lf);
 553         if (ret)
 554                 return ret;
 555
 556         ret = validate_vp9_quant_params(&frame->quant);
 557         if (ret)
 558                 return ret;
 559
 560         ret = validate_vp9_seg_params(&frame->seg);
 561         if (ret)
 562                 return ret;
 563
 564         zero_reserved(*frame);
 565         return 0;
 566 }
 567
 568 static int validate_av1_quantization(struct v4l2_av1_quantization *q)
 569 {
 570         if (q->flags > GENMASK(2, 0))
 571                 return -EINVAL;
 572
 573         if (q->delta_q_y_dc < -64 || q->delta_q_y_dc > 63 ||
 574             q->delta_q_u_dc < -64 || q->delta_q_u_dc > 63 ||
 575             q->delta_q_v_dc < -64 || q->delta_q_v_dc > 63 ||
 576             q->delta_q_u_ac < -64 || q->delta_q_u_ac > 63 ||
 577             q->delta_q_v_ac < -64 || q->delta_q_v_ac > 63 ||
 578             q->delta_q_res > GENMASK(1, 0))
 579                 return -EINVAL;
 580
 581         if (q->qm_y > GENMASK(3, 0) ||
 582             q->qm_u > GENMASK(3, 0) ||
 583             q->qm_v > GENMASK(3, 0))
 584                 return -EINVAL;
 585
 586         return 0;
 587 }
 588
 589 static int validate_av1_segmentation(struct v4l2_av1_segmentation *s)
 590 {
 591         u32 i;
 592         u32 j;
 593
 594         if (s->flags > GENMASK(4, 0))
 595                 return -EINVAL;
 596
 597         for (i = 0; i < ARRAY_SIZE(s->feature_data); i++) {
 598                 static const int segmentation_feature_signed[] = { 1, 1, 1, 1, 1, 0, 0, 0 };
 599                 static const int segmentation_feature_max[] = { 255, 63, 63, 63, 63, 7, 0, 0};
 600
 601                 for (j = 0; j < ARRAY_SIZE(s->feature_data[j]); j++) {
 602                         s32 limit = segmentation_feature_max[j];
 603
 604                         if (segmentation_feature_signed[j]) {
 605                                 if (s->feature_data[i][j] < -limit ||
 606                                     s->feature_data[i][j] > limit)
 607                                         return -EINVAL;
 608                         } else {
 609                                 if (s->feature_data[i][j] < 0 || s->feature_data[i][j] > limit)
 610                                         return -EINVAL;
 611                         }
 612                 }
 613         }
 614
 615         return 0;
 616 }
 617
 618 static int validate_av1_loop_filter(struct v4l2_av1_loop_filter *lf)
 619 {
 620         u32 i;
 621
 622         if (lf->flags > GENMASK(3, 0))
 623                 return -EINVAL;
 624
 625         for (i = 0; i < ARRAY_SIZE(lf->level); i++) {
 626                 if (lf->level[i] > GENMASK(5, 0))
 627                         return -EINVAL;
 628         }
 629
 630         if (lf->sharpness > GENMASK(2, 0))
 631                 return -EINVAL;
 632
 633         for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++) {
 634                 if (lf->ref_deltas[i] < -64 || lf->ref_deltas[i] > 63)
 635                         return -EINVAL;
 636         }
 637
 638         for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++) {
 639                 if (lf->mode_deltas[i] < -64 || lf->mode_deltas[i] > 63)
 640                         return -EINVAL;
 641         }
 642
 643         return 0;
 644 }
 645
 646 static int validate_av1_cdef(struct v4l2_av1_cdef *cdef)
 647 {
 648         u32 i;
 649
 650         if (cdef->damping_minus_3 > GENMASK(1, 0) ||
 651             cdef->bits > GENMASK(1, 0))
 652                 return -EINVAL;
 653
 654         for (i = 0; i < 1 << cdef->bits; i++) {
 655                 if (cdef->y_pri_strength[i] > GENMASK(3, 0) ||
 656                     cdef->y_sec_strength[i] > 4 ||
 657                     cdef->uv_pri_strength[i] > GENMASK(3, 0) ||
 658                     cdef->uv_sec_strength[i] > 4)
 659                         return -EINVAL;
 660         }
 661
 662         return 0;
 663 }
 664
 665 static int validate_av1_loop_restauration(struct v4l2_av1_loop_restoration *lr)
 666 {
 667         if (lr->lr_unit_shift > 3 || lr->lr_uv_shift > 1)
 668                 return -EINVAL;
 669
 670         return 0;
 671 }
 672
 673 static int validate_av1_film_grain(struct v4l2_ctrl_av1_film_grain *fg)
 674 {
 675         u32 i;
 676
 677         if (fg->flags > GENMASK(4, 0))
 678                 return -EINVAL;
 679
 680         if (fg->film_grain_params_ref_idx > GENMASK(2, 0) ||
 681             fg->num_y_points > 14 ||
 682             fg->num_cb_points > 10 ||
 683             fg->num_cr_points > GENMASK(3, 0) ||
 684             fg->grain_scaling_minus_8 > GENMASK(1, 0) ||
 685             fg->ar_coeff_lag > GENMASK(1, 0) ||
 686             fg->ar_coeff_shift_minus_6 > GENMASK(1, 0) ||
 687             fg->grain_scale_shift > GENMASK(1, 0))
 688                 return -EINVAL;
 689
 690         if (!(fg->flags & V4L2_AV1_FILM_GRAIN_FLAG_APPLY_GRAIN))
 691                 return 0;
 692
 693         for (i = 1; i < fg->num_y_points; i++)
 694                 if (fg->point_y_value[i] <= fg->point_y_value[i - 1])
 695                         return -EINVAL;
 696
 697         for (i = 1; i < fg->num_cb_points; i++)
 698                 if (fg->point_cb_value[i] <= fg->point_cb_value[i - 1])
 699                         return -EINVAL;
 700
 701         for (i = 1; i < fg->num_cr_points; i++)
 702                 if (fg->point_cr_value[i] <= fg->point_cr_value[i - 1])
 703                         return -EINVAL;
 704
 705         return 0;
 706 }
 707
 708 static int validate_av1_frame(struct v4l2_ctrl_av1_frame *f)
 709 {
 710         int ret = 0;
 711
 712         ret = validate_av1_quantization(&f->quantization);
 713         if (ret)
 714                 return ret;
 715         ret = validate_av1_segmentation(&f->segmentation);
 716         if (ret)
 717                 return ret;
 718         ret = validate_av1_loop_filter(&f->loop_filter);
 719         if (ret)
 720                 return ret;
 721         ret = validate_av1_cdef(&f->cdef);
 722         if (ret)
 723                 return ret;
 724         ret = validate_av1_loop_restauration(&f->loop_restoration);
 725         if (ret)
 726                 return ret;
 727
 728         if (f->flags &
 729         ~(V4L2_AV1_FRAME_FLAG_SHOW_FRAME |
 730           V4L2_AV1_FRAME_FLAG_SHOWABLE_FRAME |
 731           V4L2_AV1_FRAME_FLAG_ERROR_RESILIENT_MODE |
 732           V4L2_AV1_FRAME_FLAG_DISABLE_CDF_UPDATE |
 733           V4L2_AV1_FRAME_FLAG_ALLOW_SCREEN_CONTENT_TOOLS |
 734           V4L2_AV1_FRAME_FLAG_FORCE_INTEGER_MV |
 735           V4L2_AV1_FRAME_FLAG_ALLOW_INTRABC |
 736           V4L2_AV1_FRAME_FLAG_USE_SUPERRES |
 737           V4L2_AV1_FRAME_FLAG_ALLOW_HIGH_PRECISION_MV |
 738           V4L2_AV1_FRAME_FLAG_IS_MOTION_MODE_SWITCHABLE |
 739           V4L2_AV1_FRAME_FLAG_USE_REF_FRAME_MVS |
 740           V4L2_AV1_FRAME_FLAG_DISABLE_FRAME_END_UPDATE_CDF |
 741           V4L2_AV1_FRAME_FLAG_ALLOW_WARPED_MOTION |
 742           V4L2_AV1_FRAME_FLAG_REFERENCE_SELECT |
 743           V4L2_AV1_FRAME_FLAG_REDUCED_TX_SET |
 744           V4L2_AV1_FRAME_FLAG_SKIP_MODE_ALLOWED |
 745           V4L2_AV1_FRAME_FLAG_SKIP_MODE_PRESENT |
 746           V4L2_AV1_FRAME_FLAG_FRAME_SIZE_OVERRIDE |
 747           V4L2_AV1_FRAME_FLAG_BUFFER_REMOVAL_TIME_PRESENT |
 748           V4L2_AV1_FRAME_FLAG_FRAME_REFS_SHORT_SIGNALING))
 749                 return -EINVAL;
 750
 751         if (f->superres_denom > GENMASK(2, 0) + 9)
 752                 return -EINVAL;
 753
 754         return 0;
 755 }
 756
 757 static int validate_av1_sequence(struct v4l2_ctrl_av1_sequence *s)
 758 {
 759         if (s->flags &
 760         ~(V4L2_AV1_SEQUENCE_FLAG_STILL_PICTURE |
 761          V4L2_AV1_SEQUENCE_FLAG_USE_128X128_SUPERBLOCK |
 762          V4L2_AV1_SEQUENCE_FLAG_ENABLE_FILTER_INTRA |
 763          V4L2_AV1_SEQUENCE_FLAG_ENABLE_INTRA_EDGE_FILTER |
 764          V4L2_AV1_SEQUENCE_FLAG_ENABLE_INTERINTRA_COMPOUND |
 765          V4L2_AV1_SEQUENCE_FLAG_ENABLE_MASKED_COMPOUND |
 766          V4L2_AV1_SEQUENCE_FLAG_ENABLE_WARPED_MOTION |
 767          V4L2_AV1_SEQUENCE_FLAG_ENABLE_DUAL_FILTER |
 768          V4L2_AV1_SEQUENCE_FLAG_ENABLE_ORDER_HINT |
 769          V4L2_AV1_SEQUENCE_FLAG_ENABLE_JNT_COMP |
 770          V4L2_AV1_SEQUENCE_FLAG_ENABLE_REF_FRAME_MVS |
 771          V4L2_AV1_SEQUENCE_FLAG_ENABLE_SUPERRES |
 772          V4L2_AV1_SEQUENCE_FLAG_ENABLE_CDEF |
 773          V4L2_AV1_SEQUENCE_FLAG_ENABLE_RESTORATION |
 774          V4L2_AV1_SEQUENCE_FLAG_MONO_CHROME |
 775          V4L2_AV1_SEQUENCE_FLAG_COLOR_RANGE |
 776          V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_X |
 777          V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_Y |
 778          V4L2_AV1_SEQUENCE_FLAG_FILM_GRAIN_PARAMS_PRESENT |
 779          V4L2_AV1_SEQUENCE_FLAG_SEPARATE_UV_DELTA_Q))
 780                 return -EINVAL;
 781
 782         if (s->seq_profile == 1 && s->flags & V4L2_AV1_SEQUENCE_FLAG_MONO_CHROME)
 783                 return -EINVAL;
 784
 785         /* reserved */
 786         if (s->seq_profile > 2)
 787                 return -EINVAL;
 788
 789         /* TODO: PROFILES */
 790         return 0;
 791 }
 792
 793 /*
 794  * Compound controls validation requires setting unused fields/flags to zero
 795  * in order to properly detect unchanged controls with v4l2_ctrl_type_op_equal's
 796  * memcmp.
 797  */
 798 static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 799                                  union v4l2_ctrl_ptr ptr)
 800 {
 801         struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
 802         struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
 803         struct v4l2_ctrl_vp8_frame *p_vp8_frame;
 804         struct v4l2_ctrl_fwht_params *p_fwht_params;
 805         struct v4l2_ctrl_h264_sps *p_h264_sps;
 806         struct v4l2_ctrl_h264_pps *p_h264_pps;
 807         struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weights;
 808         struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;
 809         struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;
 810         struct v4l2_ctrl_hevc_sps *p_hevc_sps;
 811         struct v4l2_ctrl_hevc_pps *p_hevc_pps;
 812         struct v4l2_ctrl_hdr10_mastering_display *p_hdr10_mastering;
 813         struct v4l2_ctrl_hevc_decode_params *p_hevc_decode_params;
 814         struct v4l2_area *area;
 815         void *p = ptr.p + idx * ctrl->elem_size;
 816         unsigned int i;
 817
 818         switch ((u32)ctrl->type) {
 819         case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
 820                 p_mpeg2_sequence = p;
 821
 822                 switch (p_mpeg2_sequence->chroma_format) {
 823                 case 1: /* 4:2:0 */
 824                 case 2: /* 4:2:2 */
 825                 case 3: /* 4:4:4 */
 826                         break;
 827                 default:
 828                         return -EINVAL;
 829                 }
 830                 break;
 831
 832         case V4L2_CTRL_TYPE_MPEG2_PICTURE:
 833                 p_mpeg2_picture = p;
 834
 835                 switch (p_mpeg2_picture->intra_dc_precision) {
 836                 case 0: /* 8 bits */
 837                 case 1: /* 9 bits */
 838                 case 2: /* 10 bits */
 839                 case 3: /* 11 bits */
 840                         break;
 841                 default:
 842                         return -EINVAL;
 843                 }
 844
 845                 switch (p_mpeg2_picture->picture_structure) {
 846                 case V4L2_MPEG2_PIC_TOP_FIELD:
 847                 case V4L2_MPEG2_PIC_BOTTOM_FIELD:
 848                 case V4L2_MPEG2_PIC_FRAME:
 849                         break;
 850                 default:
 851                         return -EINVAL;
 852                 }
 853
 854                 switch (p_mpeg2_picture->picture_coding_type) {
 855                 case V4L2_MPEG2_PIC_CODING_TYPE_I:
 856                 case V4L2_MPEG2_PIC_CODING_TYPE_P:
 857                 case V4L2_MPEG2_PIC_CODING_TYPE_B:
 858                         break;
 859                 default:
 860                         return -EINVAL;
 861                 }
 862                 zero_reserved(*p_mpeg2_picture);
 863                 break;
 864
 865         case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
 866                 break;
 867
 868         case V4L2_CTRL_TYPE_FWHT_PARAMS:
 869                 p_fwht_params = p;
 870                 if (p_fwht_params->version < V4L2_FWHT_VERSION)
 871                         return -EINVAL;
 872                 if (!p_fwht_params->width || !p_fwht_params->height)
 873                         return -EINVAL;
 874                 break;
 875
 876         case V4L2_CTRL_TYPE_H264_SPS:
 877                 p_h264_sps = p;
 878
 879                 /* Some syntax elements are only conditionally valid */
 880                 if (p_h264_sps->pic_order_cnt_type != 0) {
 881                         p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 = 0;
 882                 } else if (p_h264_sps->pic_order_cnt_type != 1) {
 883                         p_h264_sps->num_ref_frames_in_pic_order_cnt_cycle = 0;
 884                         p_h264_sps->offset_for_non_ref_pic = 0;
 885                         p_h264_sps->offset_for_top_to_bottom_field = 0;
 886                         memset(&p_h264_sps->offset_for_ref_frame, 0,
 887                                sizeof(p_h264_sps->offset_for_ref_frame));
 888                 }
 889
 890                 if (!V4L2_H264_SPS_HAS_CHROMA_FORMAT(p_h264_sps)) {
 891                         p_h264_sps->chroma_format_idc = 1;
 892                         p_h264_sps->bit_depth_luma_minus8 = 0;
 893                         p_h264_sps->bit_depth_chroma_minus8 = 0;
 894
 895                         p_h264_sps->flags &=
 896                                 ~V4L2_H264_SPS_FLAG_QPPRIME_Y_ZERO_TRANSFORM_BYPASS;
 897
 898                         if (p_h264_sps->chroma_format_idc < 3)
 899                                 p_h264_sps->flags &=
 900                                         ~V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE;
 901                 }
 902
 903                 if (p_h264_sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY)
 904                         p_h264_sps->flags &=
 905                                 ~V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD;
 906
 907                 /*
 908                  * Chroma 4:2:2 format require at least High 4:2:2 profile.
 909                  *
 910                  * The H264 specification and well-known parser implementations
 911                  * use profile-idc values directly, as that is clearer and
 912                  * less ambiguous. We do the same here.
 913                  */
 914                 if (p_h264_sps->profile_idc < 122 &&
 915                     p_h264_sps->chroma_format_idc > 1)
 916                         return -EINVAL;
 917                 /* Chroma 4:4:4 format require at least High 4:2:2 profile */
 918                 if (p_h264_sps->profile_idc < 244 &&
 919                     p_h264_sps->chroma_format_idc > 2)
 920                         return -EINVAL;
 921                 if (p_h264_sps->chroma_format_idc > 3)
 922                         return -EINVAL;
 923
 924                 if (p_h264_sps->bit_depth_luma_minus8 > 6)
 925                         return -EINVAL;
 926                 if (p_h264_sps->bit_depth_chroma_minus8 > 6)
 927                         return -EINVAL;
 928                 if (p_h264_sps->log2_max_frame_num_minus4 > 12)
 929                         return -EINVAL;
 930                 if (p_h264_sps->pic_order_cnt_type > 2)
 931                         return -EINVAL;
 932                 if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
 933                         return -EINVAL;
 934                 if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)
 935                         return -EINVAL;
 936                 break;
 937
 938         case V4L2_CTRL_TYPE_H264_PPS:
 939                 p_h264_pps = p;
 940
 941                 if (p_h264_pps->num_slice_groups_minus1 > 7)
 942                         return -EINVAL;
 943                 if (p_h264_pps->num_ref_idx_l0_default_active_minus1 >
 944                     (V4L2_H264_REF_LIST_LEN - 1))
 945                         return -EINVAL;
 946                 if (p_h264_pps->num_ref_idx_l1_default_active_minus1 >
 947                     (V4L2_H264_REF_LIST_LEN - 1))
 948                         return -EINVAL;
 949                 if (p_h264_pps->weighted_bipred_idc > 2)
 950                         return -EINVAL;
 951                 /*
 952                  * pic_init_qp_minus26 shall be in the range of
 953                  * -(26 + QpBdOffset_y) to +25, inclusive,
 954                  *  where QpBdOffset_y is 6 * bit_depth_luma_minus8
 955                  */
 956                 if (p_h264_pps->pic_init_qp_minus26 < -62 ||
 957                     p_h264_pps->pic_init_qp_minus26 > 25)
 958                         return -EINVAL;
 959                 if (p_h264_pps->pic_init_qs_minus26 < -26 ||
 960                     p_h264_pps->pic_init_qs_minus26 > 25)
 961                         return -EINVAL;
 962                 if (p_h264_pps->chroma_qp_index_offset < -12 ||
 963                     p_h264_pps->chroma_qp_index_offset > 12)
 964                         return -EINVAL;
 965                 if (p_h264_pps->second_chroma_qp_index_offset < -12 ||
 966                     p_h264_pps->second_chroma_qp_index_offset > 12)
 967                         return -EINVAL;
 968                 break;
 969
 970         case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
 971                 break;
 972
 973         case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
 974                 p_h264_pred_weights = p;
 975
 976                 if (p_h264_pred_weights->luma_log2_weight_denom > 7)
 977                         return -EINVAL;
 978                 if (p_h264_pred_weights->chroma_log2_weight_denom > 7)
 979                         return -EINVAL;
 980                 break;
 981
 982         case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
 983                 p_h264_slice_params = p;
 984
 985                 if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
 986                         p_h264_slice_params->flags &=
 987                                 ~V4L2_H264_SLICE_FLAG_DIRECT_SPATIAL_MV_PRED;
 988
 989                 if (p_h264_slice_params->colour_plane_id > 2)
 990                         return -EINVAL;
 991                 if (p_h264_slice_params->cabac_init_idc > 2)
 992                         return -EINVAL;
 993                 if (p_h264_slice_params->disable_deblocking_filter_idc > 2)
 994                         return -EINVAL;
 995                 if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||
 996                     p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)
 997                         return -EINVAL;
 998                 if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||
 999                     p_h264_slice_params->slice_beta_offset_div2 > 6)
1000                         return -EINVAL;
1001
1002                 if (p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_I ||
1003                     p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_SI)
1004                         p_h264_slice_params->num_ref_idx_l0_active_minus1 = 0;
1005                 if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
1006                         p_h264_slice_params->num_ref_idx_l1_active_minus1 = 0;
1007
1008                 if (p_h264_slice_params->num_ref_idx_l0_active_minus1 >
1009                     (V4L2_H264_REF_LIST_LEN - 1))
1010                         return -EINVAL;
1011                 if (p_h264_slice_params->num_ref_idx_l1_active_minus1 >
1012                     (V4L2_H264_REF_LIST_LEN - 1))
1013                         return -EINVAL;
1014                 zero_reserved(*p_h264_slice_params);
1015                 break;
1016
1017         case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1018                 p_h264_dec_params = p;
1019
1020                 if (p_h264_dec_params->nal_ref_idc > 3)
1021                         return -EINVAL;
1022                 for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {
1023                         struct v4l2_h264_dpb_entry *dpb_entry =
1024                                 &p_h264_dec_params->dpb[i];
1025
1026                         zero_reserved(*dpb_entry);
1027                 }
1028                 zero_reserved(*p_h264_dec_params);
1029                 break;
1030
1031         case V4L2_CTRL_TYPE_VP8_FRAME:
1032                 p_vp8_frame = p;
1033
1034                 switch (p_vp8_frame->num_dct_parts) {
1035                 case 1:
1036                 case 2:
1037                 case 4:
1038                 case 8:
1039                         break;
1040                 default:
1041                         return -EINVAL;
1042                 }
1043                 zero_padding(p_vp8_frame->segment);
1044                 zero_padding(p_vp8_frame->lf);
1045                 zero_padding(p_vp8_frame->quant);
1046                 zero_padding(p_vp8_frame->entropy);
1047                 zero_padding(p_vp8_frame->coder_state);
1048                 break;
1049
1050         case V4L2_CTRL_TYPE_HEVC_SPS:
1051                 p_hevc_sps = p;
1052
1053                 if (!(p_hevc_sps->flags & V4L2_HEVC_SPS_FLAG_PCM_ENABLED)) {
1054                         p_hevc_sps->pcm_sample_bit_depth_luma_minus1 = 0;
1055                         p_hevc_sps->pcm_sample_bit_depth_chroma_minus1 = 0;
1056                         p_hevc_sps->log2_min_pcm_luma_coding_block_size_minus3 = 0;
1057                         p_hevc_sps->log2_diff_max_min_pcm_luma_coding_block_size = 0;
1058                 }
1059
1060                 if (!(p_hevc_sps->flags &
1061                       V4L2_HEVC_SPS_FLAG_LONG_TERM_REF_PICS_PRESENT))
1062                         p_hevc_sps->num_long_term_ref_pics_sps = 0;
1063                 break;
1064
1065         case V4L2_CTRL_TYPE_HEVC_PPS:
1066                 p_hevc_pps = p;
1067
1068                 if (!(p_hevc_pps->flags &
1069                       V4L2_HEVC_PPS_FLAG_CU_QP_DELTA_ENABLED))
1070                         p_hevc_pps->diff_cu_qp_delta_depth = 0;
1071
1072                 if (!(p_hevc_pps->flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED)) {
1073                         p_hevc_pps->num_tile_columns_minus1 = 0;
1074                         p_hevc_pps->num_tile_rows_minus1 = 0;
1075                         memset(&p_hevc_pps->column_width_minus1, 0,
1076                                sizeof(p_hevc_pps->column_width_minus1));
1077                         memset(&p_hevc_pps->row_height_minus1, 0,
1078                                sizeof(p_hevc_pps->row_height_minus1));
1079
1080                         p_hevc_pps->flags &=
1081                                 ~V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED;
1082                 }
1083
1084                 if (p_hevc_pps->flags &
1085                     V4L2_HEVC_PPS_FLAG_PPS_DISABLE_DEBLOCKING_FILTER) {
1086                         p_hevc_pps->pps_beta_offset_div2 = 0;
1087                         p_hevc_pps->pps_tc_offset_div2 = 0;
1088                 }
1089                 break;
1090
1091         case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
1092                 p_hevc_decode_params = p;
1093
1094                 if (p_hevc_decode_params->num_active_dpb_entries >
1095                     V4L2_HEVC_DPB_ENTRIES_NUM_MAX)
1096                         return -EINVAL;
1097                 break;
1098
1099         case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
1100                 break;
1101
1102         case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
1103                 break;
1104
1105         case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
1106                 p_hdr10_mastering = p;
1107
1108                 for (i = 0; i < 3; ++i) {
1109                         if (p_hdr10_mastering->display_primaries_x[i] <
1110                                 V4L2_HDR10_MASTERING_PRIMARIES_X_LOW ||
1111                             p_hdr10_mastering->display_primaries_x[i] >
1112                                 V4L2_HDR10_MASTERING_PRIMARIES_X_HIGH ||
1113                             p_hdr10_mastering->display_primaries_y[i] <
1114                                 V4L2_HDR10_MASTERING_PRIMARIES_Y_LOW ||
1115                             p_hdr10_mastering->display_primaries_y[i] >
1116                                 V4L2_HDR10_MASTERING_PRIMARIES_Y_HIGH)
1117                                 return -EINVAL;
1118                 }
1119
1120                 if (p_hdr10_mastering->white_point_x <
1121                         V4L2_HDR10_MASTERING_WHITE_POINT_X_LOW ||
1122                     p_hdr10_mastering->white_point_x >
1123                         V4L2_HDR10_MASTERING_WHITE_POINT_X_HIGH ||
1124                     p_hdr10_mastering->white_point_y <
1125                         V4L2_HDR10_MASTERING_WHITE_POINT_Y_LOW ||
1126                     p_hdr10_mastering->white_point_y >
1127                         V4L2_HDR10_MASTERING_WHITE_POINT_Y_HIGH)
1128                         return -EINVAL;
1129
1130                 if (p_hdr10_mastering->max_display_mastering_luminance <
1131                         V4L2_HDR10_MASTERING_MAX_LUMA_LOW ||
1132                     p_hdr10_mastering->max_display_mastering_luminance >
1133                         V4L2_HDR10_MASTERING_MAX_LUMA_HIGH ||
1134                     p_hdr10_mastering->min_display_mastering_luminance <
1135                         V4L2_HDR10_MASTERING_MIN_LUMA_LOW ||
1136                     p_hdr10_mastering->min_display_mastering_luminance >
1137                         V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
1138                         return -EINVAL;
1139
1140                 /* The following restriction comes from ITU-T Rec. H.265 spec */
1141                 if (p_hdr10_mastering->max_display_mastering_luminance ==
1142                         V4L2_HDR10_MASTERING_MAX_LUMA_LOW &&
1143                     p_hdr10_mastering->min_display_mastering_luminance ==
1144                         V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
1145                         return -EINVAL;
1146
1147                 break;
1148
1149         case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
1150                 break;
1151
1152         case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
1153                 return validate_vp9_compressed_hdr(p);
1154
1155         case V4L2_CTRL_TYPE_VP9_FRAME:
1156                 return validate_vp9_frame(p);
1157         case V4L2_CTRL_TYPE_AV1_FRAME:
1158                 return validate_av1_frame(p);
1159         case V4L2_CTRL_TYPE_AV1_SEQUENCE:
1160                 return validate_av1_sequence(p);
1161         case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
1162                 break;
1163         case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
1164                 return validate_av1_film_grain(p);
1165
1166         case V4L2_CTRL_TYPE_AREA:
1167                 area = p;
1168                 if (!area->width || !area->height)
1169                         return -EINVAL;
1170                 break;
1171
1172         default:
1173                 return -EINVAL;
1174         }
1175
1176         return 0;
1177 }
1178
1179 static int std_validate_elem(const struct v4l2_ctrl *ctrl, u32 idx,
1180                              union v4l2_ctrl_ptr ptr)
1181 {
1182         size_t len;
1183         u64 offset;
1184         s64 val;
1185
1186         switch ((u32)ctrl->type) {
1187         case V4L2_CTRL_TYPE_INTEGER:
1188                 return ROUND_TO_RANGE(ptr.p_s32[idx], u32, ctrl);
1189         case V4L2_CTRL_TYPE_INTEGER64:
1190                 /*
1191                  * We can't use the ROUND_TO_RANGE define here due to
1192                  * the u64 divide that needs special care.
1193                  */
1194                 val = ptr.p_s64[idx];
1195                 if (ctrl->maximum >= 0 && val >= ctrl->maximum - (s64)(ctrl->step / 2))
1196                         val = ctrl->maximum;
1197                 else
1198                         val += (s64)(ctrl->step / 2);
1199                 val = clamp_t(s64, val, ctrl->minimum, ctrl->maximum);
1200                 offset = val - ctrl->minimum;
1201                 do_div(offset, ctrl->step);
1202                 ptr.p_s64[idx] = ctrl->minimum + offset * ctrl->step;
1203                 return 0;
1204         case V4L2_CTRL_TYPE_U8:
1205                 return ROUND_TO_RANGE(ptr.p_u8[idx], u8, ctrl);
1206         case V4L2_CTRL_TYPE_U16:
1207                 return ROUND_TO_RANGE(ptr.p_u16[idx], u16, ctrl);
1208         case V4L2_CTRL_TYPE_U32:
1209                 return ROUND_TO_RANGE(ptr.p_u32[idx], u32, ctrl);
1210
1211         case V4L2_CTRL_TYPE_BOOLEAN:
1212                 ptr.p_s32[idx] = !!ptr.p_s32[idx];
1213                 return 0;
1214
1215         case V4L2_CTRL_TYPE_MENU:
1216         case V4L2_CTRL_TYPE_INTEGER_MENU:
1217                 if (ptr.p_s32[idx] < ctrl->minimum || ptr.p_s32[idx] > ctrl->maximum)
1218                         return -ERANGE;
1219                 if (ptr.p_s32[idx] < BITS_PER_LONG_LONG &&
1220                     (ctrl->menu_skip_mask & BIT_ULL(ptr.p_s32[idx])))
1221                         return -EINVAL;
1222                 if (ctrl->type == V4L2_CTRL_TYPE_MENU &&
1223                     ctrl->qmenu[ptr.p_s32[idx]][0] == '\0')
1224                         return -EINVAL;
1225                 return 0;
1226
1227         case V4L2_CTRL_TYPE_BITMASK:
1228                 ptr.p_s32[idx] &= ctrl->maximum;
1229                 return 0;
1230
1231         case V4L2_CTRL_TYPE_BUTTON:
1232         case V4L2_CTRL_TYPE_CTRL_CLASS:
1233                 ptr.p_s32[idx] = 0;
1234                 return 0;
1235
1236         case V4L2_CTRL_TYPE_STRING:
1237                 idx *= ctrl->elem_size;
1238                 len = strlen(ptr.p_char + idx);
1239                 if (len < ctrl->minimum)
1240                         return -ERANGE;
1241                 if ((len - (u32)ctrl->minimum) % (u32)ctrl->step)
1242                         return -ERANGE;
1243                 return 0;
1244
1245         default:
1246                 return std_validate_compound(ctrl, idx, ptr);
1247         }
1248 }
1249
1250 int v4l2_ctrl_type_op_validate(const struct v4l2_ctrl *ctrl,
1251                                union v4l2_ctrl_ptr ptr)
1252 {
1253         unsigned int i;
1254         int ret = 0;
1255
1256         switch ((u32)ctrl->type) {
1257         case V4L2_CTRL_TYPE_U8:
1258                 if (ctrl->maximum == 0xff && ctrl->minimum == 0 && ctrl->step == 1)
1259                         return 0;
1260                 break;
1261         case V4L2_CTRL_TYPE_U16:
1262                 if (ctrl->maximum == 0xffff && ctrl->minimum == 0 && ctrl->step == 1)
1263                         return 0;
1264                 break;
1265         case V4L2_CTRL_TYPE_U32:
1266                 if (ctrl->maximum == 0xffffffff && ctrl->minimum == 0 && ctrl->step == 1)
1267                         return 0;
1268                 break;
1269
1270         case V4L2_CTRL_TYPE_BUTTON:
1271         case V4L2_CTRL_TYPE_CTRL_CLASS:
1272                 memset(ptr.p_s32, 0, ctrl->new_elems * sizeof(s32));
1273                 return 0;
1274         }
1275
1276         for (i = 0; !ret && i < ctrl->new_elems; i++)
1277                 ret = std_validate_elem(ctrl, i, ptr);
1278         return ret;
1279 }
1280 EXPORT_SYMBOL(v4l2_ctrl_type_op_validate);
1281
1282 static const struct v4l2_ctrl_type_ops std_type_ops = {
1283         .equal = v4l2_ctrl_type_op_equal,
1284         .init = v4l2_ctrl_type_op_init,
1285         .log = v4l2_ctrl_type_op_log,
1286         .validate = v4l2_ctrl_type_op_validate,
1287 };
1288
1289 void v4l2_ctrl_notify(struct v4l2_ctrl *ctrl, v4l2_ctrl_notify_fnc notify, void *priv)
1290 {
1291         if (!ctrl)
1292                 return;
1293         if (!notify) {
1294                 ctrl->call_notify = 0;
1295                 return;
1296         }
1297         if (WARN_ON(ctrl->handler->notify && ctrl->handler->notify != notify))
1298                 return;
1299         ctrl->handler->notify = notify;
1300         ctrl->handler->notify_priv = priv;
1301         ctrl->call_notify = 1;
1302 }
1303 EXPORT_SYMBOL(v4l2_ctrl_notify);
1304
1305 /* Copy the one value to another. */
1306 static void ptr_to_ptr(struct v4l2_ctrl *ctrl,
1307                        union v4l2_ctrl_ptr from, union v4l2_ctrl_ptr to,
1308                        unsigned int elems)
1309 {
1310         if (ctrl == NULL)
1311                 return;
1312         memcpy(to.p, from.p_const, elems * ctrl->elem_size);
1313 }
1314
1315 /* Copy the new value to the current value. */
1316 void new_to_cur(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
1317 {
1318         bool changed;
1319
1320         if (ctrl == NULL)
1321                 return;
1322
1323         /* has_changed is set by cluster_changed */
1324         changed = ctrl->has_changed;
1325         if (changed) {
1326                 if (ctrl->is_dyn_array)
1327                         ctrl->elems = ctrl->new_elems;
1328                 ptr_to_ptr(ctrl, ctrl->p_new, ctrl->p_cur, ctrl->elems);
1329         }
1330
1331         if (ch_flags & V4L2_EVENT_CTRL_CH_FLAGS) {
1332                 /* Note: CH_FLAGS is only set for auto clusters. */
1333                 ctrl->flags &=
1334                         ~(V4L2_CTRL_FLAG_INACTIVE | V4L2_CTRL_FLAG_VOLATILE);
1335                 if (!is_cur_manual(ctrl->cluster[0])) {
1336                         ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
1337                         if (ctrl->cluster[0]->has_volatiles)
1338                                 ctrl->flags |= V4L2_CTRL_FLAG_VOLATILE;
1339                 }
1340                 fh = NULL;
1341         }
1342         if (changed || ch_flags) {
1343                 /* If a control was changed that was not one of the controls
1344                    modified by the application, then send the event to all. */
1345                 if (!ctrl->is_new)
1346                         fh = NULL;
1347                 send_event(fh, ctrl,
1348                         (changed ? V4L2_EVENT_CTRL_CH_VALUE : 0) | ch_flags);
1349                 if (ctrl->call_notify && changed && ctrl->handler->notify)
1350                         ctrl->handler->notify(ctrl, ctrl->handler->notify_priv);
1351         }
1352 }
1353
1354 /* Copy the current value to the new value */
1355 void cur_to_new(struct v4l2_ctrl *ctrl)
1356 {
1357         if (ctrl == NULL)
1358                 return;
1359         if (ctrl->is_dyn_array)
1360                 ctrl->new_elems = ctrl->elems;
1361         ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new, ctrl->new_elems);
1362 }
1363
1364 static bool req_alloc_array(struct v4l2_ctrl_ref *ref, u32 elems)
1365 {
1366         void *tmp;
1367
1368         if (elems == ref->p_req_array_alloc_elems)
1369                 return true;
1370         if (ref->ctrl->is_dyn_array &&
1371             elems < ref->p_req_array_alloc_elems)
1372                 return true;
1373
1374         tmp = kvmalloc(elems * ref->ctrl->elem_size, GFP_KERNEL);
1375
1376         if (!tmp) {
1377                 ref->p_req_array_enomem = true;
1378                 return false;
1379         }
1380         ref->p_req_array_enomem = false;
1381         kvfree(ref->p_req.p);
1382         ref->p_req.p = tmp;
1383         ref->p_req_array_alloc_elems = elems;
1384         return true;
1385 }
1386
1387 /* Copy the new value to the request value */
1388 void new_to_req(struct v4l2_ctrl_ref *ref)
1389 {
1390         struct v4l2_ctrl *ctrl;
1391
1392         if (!ref)
1393                 return;
1394
1395         ctrl = ref->ctrl;
1396         if (ctrl->is_array && !req_alloc_array(ref, ctrl->new_elems))
1397                 return;
1398
1399         ref->p_req_elems = ctrl->new_elems;
1400         ptr_to_ptr(ctrl, ctrl->p_new, ref->p_req, ref->p_req_elems);
1401         ref->p_req_valid = true;
1402 }
1403
1404 /* Copy the current value to the request value */
1405 void cur_to_req(struct v4l2_ctrl_ref *ref)
1406 {
1407         struct v4l2_ctrl *ctrl;
1408
1409         if (!ref)
1410                 return;
1411
1412         ctrl = ref->ctrl;
1413         if (ctrl->is_array && !req_alloc_array(ref, ctrl->elems))
1414                 return;
1415
1416         ref->p_req_elems = ctrl->elems;
1417         ptr_to_ptr(ctrl, ctrl->p_cur, ref->p_req, ctrl->elems);
1418         ref->p_req_valid = true;
1419 }
1420
1421 /* Copy the request value to the new value */
1422 int req_to_new(struct v4l2_ctrl_ref *ref)
1423 {
1424         struct v4l2_ctrl *ctrl;
1425
1426         if (!ref)
1427                 return 0;
1428
1429         ctrl = ref->ctrl;
1430
1431         /*
1432          * This control was never set in the request, so just use the current
1433          * value.
1434          */
1435         if (!ref->p_req_valid) {
1436                 if (ctrl->is_dyn_array)
1437                         ctrl->new_elems = ctrl->elems;
1438                 ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new, ctrl->new_elems);
1439                 return 0;
1440         }
1441
1442         /* Not an array, so just copy the request value */
1443         if (!ctrl->is_array) {
1444                 ptr_to_ptr(ctrl, ref->p_req, ctrl->p_new, ctrl->new_elems);
1445                 return 0;
1446         }
1447
1448         /* Sanity check, should never happen */
1449         if (WARN_ON(!ref->p_req_array_alloc_elems))
1450                 return -ENOMEM;
1451
1452         if (!ctrl->is_dyn_array &&
1453             ref->p_req_elems != ctrl->p_array_alloc_elems)
1454                 return -ENOMEM;
1455
1456         /*
1457          * Check if the number of elements in the request is more than the
1458          * elements in ctrl->p_array. If so, attempt to realloc ctrl->p_array.
1459          * Note that p_array is allocated with twice the number of elements
1460          * in the dynamic array since it has to store both the current and
1461          * new value of such a control.
1462          */
1463         if (ref->p_req_elems > ctrl->p_array_alloc_elems) {
1464                 unsigned int sz = ref->p_req_elems * ctrl->elem_size;
1465                 void *old = ctrl->p_array;
1466                 void *tmp = kvzalloc(2 * sz, GFP_KERNEL);
1467
1468                 if (!tmp)
1469                         return -ENOMEM;
1470                 memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size);
1471                 memcpy(tmp + sz, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size);
1472                 ctrl->p_new.p = tmp;
1473                 ctrl->p_cur.p = tmp + sz;
1474                 ctrl->p_array = tmp;
1475                 ctrl->p_array_alloc_elems = ref->p_req_elems;
1476                 kvfree(old);
1477         }
1478
1479         ctrl->new_elems = ref->p_req_elems;
1480         ptr_to_ptr(ctrl, ref->p_req, ctrl->p_new, ctrl->new_elems);
1481         return 0;
1482 }
1483
1484 /* Control range checking */
1485 int check_range(enum v4l2_ctrl_type type,
1486                 s64 min, s64 max, u64 step, s64 def)
1487 {
1488         switch (type) {
1489         case V4L2_CTRL_TYPE_BOOLEAN:
1490                 if (step != 1 || max > 1 || min < 0)
1491                         return -ERANGE;
1492                 fallthrough;
1493         case V4L2_CTRL_TYPE_U8:
1494         case V4L2_CTRL_TYPE_U16:
1495         case V4L2_CTRL_TYPE_U32:
1496         case V4L2_CTRL_TYPE_INTEGER:
1497         case V4L2_CTRL_TYPE_INTEGER64:
1498                 if (step == 0 || min > max || def < min || def > max)
1499                         return -ERANGE;
1500                 return 0;
1501         case V4L2_CTRL_TYPE_BITMASK:
1502                 if (step || min || !max || (def & ~max))
1503                         return -ERANGE;
1504                 return 0;
1505         case V4L2_CTRL_TYPE_MENU:
1506         case V4L2_CTRL_TYPE_INTEGER_MENU:
1507                 if (min > max || def < min || def > max)
1508                         return -ERANGE;
1509                 /* Note: step == menu_skip_mask for menu controls.
1510                    So here we check if the default value is masked out. */
1511                 if (step && ((1 << def) & step))
1512                         return -EINVAL;
1513                 return 0;
1514         case V4L2_CTRL_TYPE_STRING:
1515                 if (min > max || min < 0 || step < 1 || def)
1516                         return -ERANGE;
1517                 return 0;
1518         default:
1519                 return 0;
1520         }
1521 }
1522
1523 /* Set the handler's error code if it wasn't set earlier already */
1524 static inline int handler_set_err(struct v4l2_ctrl_handler *hdl, int err)
1525 {
1526         if (hdl->error == 0)
1527                 hdl->error = err;
1528         return err;
1529 }
1530
1531 /* Initialize the handler */
1532 int v4l2_ctrl_handler_init_class(struct v4l2_ctrl_handler *hdl,
1533                                  unsigned nr_of_controls_hint,
1534                                  struct lock_class_key *key, const char *name)
1535 {
1536         mutex_init(&hdl->_lock);
1537         hdl->lock = &hdl->_lock;
1538         lockdep_set_class_and_name(hdl->lock, key, name);
1539         INIT_LIST_HEAD(&hdl->ctrls);
1540         INIT_LIST_HEAD(&hdl->ctrl_refs);
1541         hdl->nr_of_buckets = 1 + nr_of_controls_hint / 8;
1542         hdl->buckets = kvcalloc(hdl->nr_of_buckets, sizeof(hdl->buckets[0]),
1543                                 GFP_KERNEL);
1544         hdl->error = hdl->buckets ? 0 : -ENOMEM;
1545         v4l2_ctrl_handler_init_request(hdl);
1546         return hdl->error;
1547 }
1548 EXPORT_SYMBOL(v4l2_ctrl_handler_init_class);
1549
1550 /* Free all controls and control refs */
1551 void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl)
1552 {
1553         struct v4l2_ctrl_ref *ref, *next_ref;
1554         struct v4l2_ctrl *ctrl, *next_ctrl;
1555         struct v4l2_subscribed_event *sev, *next_sev;
1556
1557         if (hdl == NULL || hdl->buckets == NULL)
1558                 return;
1559
1560         v4l2_ctrl_handler_free_request(hdl);
1561
1562         mutex_lock(hdl->lock);
1563         /* Free all nodes */
1564         list_for_each_entry_safe(ref, next_ref, &hdl->ctrl_refs, node) {
1565                 list_del(&ref->node);
1566                 if (ref->p_req_array_alloc_elems)
1567                         kvfree(ref->p_req.p);
1568                 kfree(ref);
1569         }
1570         /* Free all controls owned by the handler */
1571         list_for_each_entry_safe(ctrl, next_ctrl, &hdl->ctrls, node) {
1572                 list_del(&ctrl->node);
1573                 list_for_each_entry_safe(sev, next_sev, &ctrl->ev_subs, node)
1574                         list_del(&sev->node);
1575                 kvfree(ctrl->p_array);
1576                 kvfree(ctrl);
1577         }
1578         kvfree(hdl->buckets);
1579         hdl->buckets = NULL;
1580         hdl->cached = NULL;
1581         hdl->error = 0;
1582         mutex_unlock(hdl->lock);
1583         mutex_destroy(&hdl->_lock);
1584 }
1585 EXPORT_SYMBOL(v4l2_ctrl_handler_free);
1586
1587 /* For backwards compatibility: V4L2_CID_PRIVATE_BASE should no longer
1588    be used except in G_CTRL, S_CTRL, QUERYCTRL and QUERYMENU when dealing
1589    with applications that do not use the NEXT_CTRL flag.
1590
1591    We just find the n-th private user control. It's O(N), but that should not
1592    be an issue in this particular case. */
1593 static struct v4l2_ctrl_ref *find_private_ref(
1594                 struct v4l2_ctrl_handler *hdl, u32 id)
1595 {
1596         struct v4l2_ctrl_ref *ref;
1597
1598         id -= V4L2_CID_PRIVATE_BASE;
1599         list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1600                 /* Search for private user controls that are compatible with
1601                    VIDIOC_G/S_CTRL. */
1602                 if (V4L2_CTRL_ID2WHICH(ref->ctrl->id) == V4L2_CTRL_CLASS_USER &&
1603                     V4L2_CTRL_DRIVER_PRIV(ref->ctrl->id)) {
1604                         if (!ref->ctrl->is_int)
1605                                 continue;
1606                         if (id == 0)
1607                                 return ref;
1608                         id--;
1609                 }
1610         }
1611         return NULL;
1612 }
1613
1614 /* Find a control with the given ID. */
1615 struct v4l2_ctrl_ref *find_ref(struct v4l2_ctrl_handler *hdl, u32 id)
1616 {
1617         struct v4l2_ctrl_ref *ref;
1618         int bucket;
1619
1620         id &= V4L2_CTRL_ID_MASK;
1621
1622         /* Old-style private controls need special handling */
1623         if (id >= V4L2_CID_PRIVATE_BASE)
1624                 return find_private_ref(hdl, id);
1625         bucket = id % hdl->nr_of_buckets;
1626
1627         /* Simple optimization: cache the last control found */
1628         if (hdl->cached && hdl->cached->ctrl->id == id)
1629                 return hdl->cached;
1630
1631         /* Not in cache, search the hash */
1632         ref = hdl->buckets ? hdl->buckets[bucket] : NULL;
1633         while (ref && ref->ctrl->id != id)
1634                 ref = ref->next;
1635
1636         if (ref)
1637                 hdl->cached = ref; /* cache it! */
1638         return ref;
1639 }
1640
1641 /* Find a control with the given ID. Take the handler's lock first. */
1642 struct v4l2_ctrl_ref *find_ref_lock(struct v4l2_ctrl_handler *hdl, u32 id)
1643 {
1644         struct v4l2_ctrl_ref *ref = NULL;
1645
1646         if (hdl) {
1647                 mutex_lock(hdl->lock);
1648                 ref = find_ref(hdl, id);
1649                 mutex_unlock(hdl->lock);
1650         }
1651         return ref;
1652 }
1653
1654 /* Find a control with the given ID. */
1655 struct v4l2_ctrl *v4l2_ctrl_find(struct v4l2_ctrl_handler *hdl, u32 id)
1656 {
1657         struct v4l2_ctrl_ref *ref = find_ref_lock(hdl, id);
1658
1659         return ref ? ref->ctrl : NULL;
1660 }
1661 EXPORT_SYMBOL(v4l2_ctrl_find);
1662
1663 /* Allocate a new v4l2_ctrl_ref and hook it into the handler. */
1664 int handler_new_ref(struct v4l2_ctrl_handler *hdl,
1665                     struct v4l2_ctrl *ctrl,
1666                     struct v4l2_ctrl_ref **ctrl_ref,
1667                     bool from_other_dev, bool allocate_req)
1668 {
1669         struct v4l2_ctrl_ref *ref;
1670         struct v4l2_ctrl_ref *new_ref;
1671         u32 id = ctrl->id;
1672         u32 class_ctrl = V4L2_CTRL_ID2WHICH(id) | 1;
1673         int bucket = id % hdl->nr_of_buckets;   /* which bucket to use */
1674         unsigned int size_extra_req = 0;
1675
1676         if (ctrl_ref)
1677                 *ctrl_ref = NULL;
1678
1679         /*
1680          * Automatically add the control class if it is not yet present and
1681          * the new control is not a compound control.
1682          */
1683         if (ctrl->type < V4L2_CTRL_COMPOUND_TYPES &&
1684             id != class_ctrl && find_ref_lock(hdl, class_ctrl) == NULL)
1685                 if (!v4l2_ctrl_new_std(hdl, NULL, class_ctrl, 0, 0, 0, 0))
1686                         return hdl->error;
1687
1688         if (hdl->error)
1689                 return hdl->error;
1690
1691         if (allocate_req && !ctrl->is_array)
1692                 size_extra_req = ctrl->elems * ctrl->elem_size;
1693         new_ref = kzalloc(sizeof(*new_ref) + size_extra_req, GFP_KERNEL);
1694         if (!new_ref)
1695                 return handler_set_err(hdl, -ENOMEM);
1696         new_ref->ctrl = ctrl;
1697         new_ref->from_other_dev = from_other_dev;
1698         if (size_extra_req)
1699                 new_ref->p_req.p = &new_ref[1];
1700
1701         INIT_LIST_HEAD(&new_ref->node);
1702
1703         mutex_lock(hdl->lock);
1704
1705         /* Add immediately at the end of the list if the list is empty, or if
1706            the last element in the list has a lower ID.
1707            This ensures that when elements are added in ascending order the
1708            insertion is an O(1) operation. */
1709         if (list_empty(&hdl->ctrl_refs) || id > node2id(hdl->ctrl_refs.prev)) {
1710                 list_add_tail(&new_ref->node, &hdl->ctrl_refs);
1711                 goto insert_in_hash;
1712         }
1713
1714         /* Find insert position in sorted list */
1715         list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1716                 if (ref->ctrl->id < id)
1717                         continue;
1718                 /* Don't add duplicates */
1719                 if (ref->ctrl->id == id) {
1720                         kfree(new_ref);
1721                         goto unlock;
1722                 }
1723                 list_add(&new_ref->node, ref->node.prev);
1724                 break;
1725         }
1726
1727 insert_in_hash:
1728         /* Insert the control node in the hash */
1729         new_ref->next = hdl->buckets[bucket];
1730         hdl->buckets[bucket] = new_ref;
1731         if (ctrl_ref)
1732                 *ctrl_ref = new_ref;
1733         if (ctrl->handler == hdl) {
1734                 /* By default each control starts in a cluster of its own.
1735                  * new_ref->ctrl is basically a cluster array with one
1736                  * element, so that's perfect to use as the cluster pointer.
1737                  * But only do this for the handler that owns the control.
1738                  */
1739                 ctrl->cluster = &new_ref->ctrl;
1740                 ctrl->ncontrols = 1;
1741         }
1742
1743 unlock:
1744         mutex_unlock(hdl->lock);
1745         return 0;
1746 }
1747
1748 /* Add a new control */
1749 static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl,
1750                         const struct v4l2_ctrl_ops *ops,
1751                         const struct v4l2_ctrl_type_ops *type_ops,
1752                         u32 id, const char *name, enum v4l2_ctrl_type type,
1753                         s64 min, s64 max, u64 step, s64 def,
1754                         const u32 dims[V4L2_CTRL_MAX_DIMS], u32 elem_size,
1755                         u32 flags, const char * const *qmenu,
1756                         const s64 *qmenu_int, const union v4l2_ctrl_ptr p_def,
1757                         void *priv)
1758 {
1759         struct v4l2_ctrl *ctrl;
1760         unsigned sz_extra;
1761         unsigned nr_of_dims = 0;
1762         unsigned elems = 1;
1763         bool is_array;
1764         unsigned tot_ctrl_size;
1765         void *data;
1766         int err;
1767
1768         if (hdl->error)
1769                 return NULL;
1770
1771         while (dims && dims[nr_of_dims]) {
1772                 elems *= dims[nr_of_dims];
1773                 nr_of_dims++;
1774                 if (nr_of_dims == V4L2_CTRL_MAX_DIMS)
1775                         break;
1776         }
1777         is_array = nr_of_dims > 0;
1778
1779         /* Prefill elem_size for all types handled by std_type_ops */
1780         switch ((u32)type) {
1781         case V4L2_CTRL_TYPE_INTEGER64:
1782                 elem_size = sizeof(s64);
1783                 break;
1784         case V4L2_CTRL_TYPE_STRING:
1785                 elem_size = max + 1;
1786                 break;
1787         case V4L2_CTRL_TYPE_U8:
1788                 elem_size = sizeof(u8);
1789                 break;
1790         case V4L2_CTRL_TYPE_U16:
1791                 elem_size = sizeof(u16);
1792                 break;
1793         case V4L2_CTRL_TYPE_U32:
1794                 elem_size = sizeof(u32);
1795                 break;
1796         case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
1797                 elem_size = sizeof(struct v4l2_ctrl_mpeg2_sequence);
1798                 break;
1799         case V4L2_CTRL_TYPE_MPEG2_PICTURE:
1800                 elem_size = sizeof(struct v4l2_ctrl_mpeg2_picture);
1801                 break;
1802         case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
1803                 elem_size = sizeof(struct v4l2_ctrl_mpeg2_quantisation);
1804                 break;
1805         case V4L2_CTRL_TYPE_FWHT_PARAMS:
1806                 elem_size = sizeof(struct v4l2_ctrl_fwht_params);
1807                 break;
1808         case V4L2_CTRL_TYPE_H264_SPS:
1809                 elem_size = sizeof(struct v4l2_ctrl_h264_sps);
1810                 break;
1811         case V4L2_CTRL_TYPE_H264_PPS:
1812                 elem_size = sizeof(struct v4l2_ctrl_h264_pps);
1813                 break;
1814         case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
1815                 elem_size = sizeof(struct v4l2_ctrl_h264_scaling_matrix);
1816                 break;
1817         case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
1818                 elem_size = sizeof(struct v4l2_ctrl_h264_slice_params);
1819                 break;
1820         case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1821                 elem_size = sizeof(struct v4l2_ctrl_h264_decode_params);
1822                 break;
1823         case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
1824                 elem_size = sizeof(struct v4l2_ctrl_h264_pred_weights);
1825                 break;
1826         case V4L2_CTRL_TYPE_VP8_FRAME:
1827                 elem_size = sizeof(struct v4l2_ctrl_vp8_frame);
1828                 break;
1829         case V4L2_CTRL_TYPE_HEVC_SPS:
1830                 elem_size = sizeof(struct v4l2_ctrl_hevc_sps);
1831                 break;
1832         case V4L2_CTRL_TYPE_HEVC_PPS:
1833                 elem_size = sizeof(struct v4l2_ctrl_hevc_pps);
1834                 break;
1835         case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
1836                 elem_size = sizeof(struct v4l2_ctrl_hevc_slice_params);
1837                 break;
1838         case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
1839                 elem_size = sizeof(struct v4l2_ctrl_hevc_scaling_matrix);
1840                 break;
1841         case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
1842                 elem_size = sizeof(struct v4l2_ctrl_hevc_decode_params);
1843                 break;
1844         case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
1845                 elem_size = sizeof(struct v4l2_ctrl_hdr10_cll_info);
1846                 break;
1847         case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
1848                 elem_size = sizeof(struct v4l2_ctrl_hdr10_mastering_display);
1849                 break;
1850         case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
1851                 elem_size = sizeof(struct v4l2_ctrl_vp9_compressed_hdr);
1852                 break;
1853         case V4L2_CTRL_TYPE_VP9_FRAME:
1854                 elem_size = sizeof(struct v4l2_ctrl_vp9_frame);
1855                 break;
1856         case V4L2_CTRL_TYPE_AV1_SEQUENCE:
1857                 elem_size = sizeof(struct v4l2_ctrl_av1_sequence);
1858                 break;
1859         case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
1860                 elem_size = sizeof(struct v4l2_ctrl_av1_tile_group_entry);
1861                 break;
1862         case V4L2_CTRL_TYPE_AV1_FRAME:
1863                 elem_size = sizeof(struct v4l2_ctrl_av1_frame);
1864                 break;
1865         case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
1866                 elem_size = sizeof(struct v4l2_ctrl_av1_film_grain);
1867                 break;
1868         case V4L2_CTRL_TYPE_AREA:
1869                 elem_size = sizeof(struct v4l2_area);
1870                 break;
1871         default:
1872                 if (type < V4L2_CTRL_COMPOUND_TYPES)
1873                         elem_size = sizeof(s32);
1874                 break;
1875         }
1876
1877         /* Sanity checks */
1878         if (id == 0 || name == NULL || !elem_size ||
1879             id >= V4L2_CID_PRIVATE_BASE ||
1880             (type == V4L2_CTRL_TYPE_MENU && qmenu == NULL) ||
1881             (type == V4L2_CTRL_TYPE_INTEGER_MENU && qmenu_int == NULL)) {
1882                 handler_set_err(hdl, -ERANGE);
1883                 return NULL;
1884         }
1885         err = check_range(type, min, max, step, def);
1886         if (err) {
1887                 handler_set_err(hdl, err);
1888                 return NULL;
1889         }
1890         if (is_array &&
1891             (type == V4L2_CTRL_TYPE_BUTTON ||
1892              type == V4L2_CTRL_TYPE_CTRL_CLASS)) {
1893                 handler_set_err(hdl, -EINVAL);
1894                 return NULL;
1895         }
1896         if (flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY) {
1897                 /*
1898                  * For now only support this for one-dimensional arrays only.
1899                  *
1900                  * This can be relaxed in the future, but this will
1901                  * require more effort.
1902                  */
1903                 if (nr_of_dims != 1) {
1904                         handler_set_err(hdl, -EINVAL);
1905                         return NULL;
1906                 }
1907                 /* Start with just 1 element */
1908                 elems = 1;
1909         }
1910
1911         tot_ctrl_size = elem_size * elems;
1912         sz_extra = 0;
1913         if (type == V4L2_CTRL_TYPE_BUTTON)
1914                 flags |= V4L2_CTRL_FLAG_WRITE_ONLY |
1915                         V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
1916         else if (type == V4L2_CTRL_TYPE_CTRL_CLASS)
1917                 flags |= V4L2_CTRL_FLAG_READ_ONLY;
1918         else if (!is_array &&
1919                  (type == V4L2_CTRL_TYPE_INTEGER64 ||
1920                   type == V4L2_CTRL_TYPE_STRING ||
1921                   type >= V4L2_CTRL_COMPOUND_TYPES))
1922                 sz_extra += 2 * tot_ctrl_size;
1923
1924         if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const)
1925                 sz_extra += elem_size;
1926
1927         ctrl = kvzalloc(sizeof(*ctrl) + sz_extra, GFP_KERNEL);
1928         if (ctrl == NULL) {
1929                 handler_set_err(hdl, -ENOMEM);
1930                 return NULL;
1931         }
1932
1933         INIT_LIST_HEAD(&ctrl->node);
1934         INIT_LIST_HEAD(&ctrl->ev_subs);
1935         ctrl->handler = hdl;
1936         ctrl->ops = ops;
1937         ctrl->type_ops = type_ops ? type_ops : &std_type_ops;
1938         ctrl->id = id;
1939         ctrl->name = name;
1940         ctrl->type = type;
1941         ctrl->flags = flags;
1942         ctrl->minimum = min;
1943         ctrl->maximum = max;
1944         ctrl->step = step;
1945         ctrl->default_value = def;
1946         ctrl->is_string = !is_array && type == V4L2_CTRL_TYPE_STRING;
1947         ctrl->is_ptr = is_array || type >= V4L2_CTRL_COMPOUND_TYPES || ctrl->is_string;
1948         ctrl->is_int = !ctrl->is_ptr && type != V4L2_CTRL_TYPE_INTEGER64;
1949         ctrl->is_array = is_array;
1950         ctrl->is_dyn_array = !!(flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY);
1951         ctrl->elems = elems;
1952         ctrl->new_elems = elems;
1953         ctrl->nr_of_dims = nr_of_dims;
1954         if (nr_of_dims)
1955                 memcpy(ctrl->dims, dims, nr_of_dims * sizeof(dims[0]));
1956         ctrl->elem_size = elem_size;
1957         if (type == V4L2_CTRL_TYPE_MENU)
1958                 ctrl->qmenu = qmenu;
1959         else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
1960                 ctrl->qmenu_int = qmenu_int;
1961         ctrl->priv = priv;
1962         ctrl->cur.val = ctrl->val = def;
1963         data = &ctrl[1];
1964
1965         if (ctrl->is_array) {
1966                 ctrl->p_array_alloc_elems = elems;
1967                 ctrl->p_array = kvzalloc(2 * elems * elem_size, GFP_KERNEL);
1968                 if (!ctrl->p_array) {
1969                         kvfree(ctrl);
1970                         return NULL;
1971                 }
1972                 data = ctrl->p_array;
1973         }
1974
1975         if (!ctrl->is_int) {
1976                 ctrl->p_new.p = data;
1977                 ctrl->p_cur.p = data + tot_ctrl_size;
1978         } else {
1979                 ctrl->p_new.p = &ctrl->val;
1980                 ctrl->p_cur.p = &ctrl->cur.val;
1981         }
1982
1983         if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const) {
1984                 if (ctrl->is_array)
1985                         ctrl->p_def.p = &ctrl[1];
1986                 else
1987                         ctrl->p_def.p = ctrl->p_cur.p + tot_ctrl_size;
1988                 memcpy(ctrl->p_def.p, p_def.p_const, elem_size);
1989         }
1990
1991         ctrl->type_ops->init(ctrl, 0, ctrl->p_cur);
1992         cur_to_new(ctrl);
1993
1994         if (handler_new_ref(hdl, ctrl, NULL, false, false)) {
1995                 kvfree(ctrl->p_array);
1996                 kvfree(ctrl);
1997                 return NULL;
1998         }
1999         mutex_lock(hdl->lock);
2000         list_add_tail(&ctrl->node, &hdl->ctrls);
2001         mutex_unlock(hdl->lock);
2002         return ctrl;
2003 }
2004
2005 struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
2006                         const struct v4l2_ctrl_config *cfg, void *priv)
2007 {
2008         bool is_menu;
2009         struct v4l2_ctrl *ctrl;
2010         const char *name = cfg->name;
2011         const char * const *qmenu = cfg->qmenu;
2012         const s64 *qmenu_int = cfg->qmenu_int;
2013         enum v4l2_ctrl_type type = cfg->type;
2014         u32 flags = cfg->flags;
2015         s64 min = cfg->min;
2016         s64 max = cfg->max;
2017         u64 step = cfg->step;
2018         s64 def = cfg->def;
2019
2020         if (name == NULL)
2021                 v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
2022                                                                 &def, &flags);
2023
2024         is_menu = (type == V4L2_CTRL_TYPE_MENU ||
2025                    type == V4L2_CTRL_TYPE_INTEGER_MENU);
2026         if (is_menu)
2027                 WARN_ON(step);
2028         else
2029                 WARN_ON(cfg->menu_skip_mask);
2030         if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
2031                 qmenu = v4l2_ctrl_get_menu(cfg->id);
2032         } else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
2033                 handler_set_err(hdl, -EINVAL);
2034                 return NULL;
2035         }
2036
2037         ctrl = v4l2_ctrl_new(hdl, cfg->ops, cfg->type_ops, cfg->id, name,
2038                         type, min, max,
2039                         is_menu ? cfg->menu_skip_mask : step, def,
2040                         cfg->dims, cfg->elem_size,
2041                         flags, qmenu, qmenu_int, cfg->p_def, priv);
2042         if (ctrl)
2043                 ctrl->is_private = cfg->is_private;
2044         return ctrl;
2045 }
2046 EXPORT_SYMBOL(v4l2_ctrl_new_custom);
2047
2048 /* Helper function for standard non-menu controls */
2049 struct v4l2_ctrl *v4l2_ctrl_new_std(struct v4l2_ctrl_handler *hdl,
2050                         const struct v4l2_ctrl_ops *ops,
2051                         u32 id, s64 min, s64 max, u64 step, s64 def)
2052 {
2053         const char *name;
2054         enum v4l2_ctrl_type type;
2055         u32 flags;
2056
2057         v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2058         if (type == V4L2_CTRL_TYPE_MENU ||
2059             type == V4L2_CTRL_TYPE_INTEGER_MENU ||
2060             type >= V4L2_CTRL_COMPOUND_TYPES) {
2061                 handler_set_err(hdl, -EINVAL);
2062                 return NULL;
2063         }
2064         return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2065                              min, max, step, def, NULL, 0,
2066                              flags, NULL, NULL, ptr_null, NULL);
2067 }
2068 EXPORT_SYMBOL(v4l2_ctrl_new_std);
2069
2070 /* Helper function for standard menu controls */
2071 struct v4l2_ctrl *v4l2_ctrl_new_std_menu(struct v4l2_ctrl_handler *hdl,
2072                         const struct v4l2_ctrl_ops *ops,
2073                         u32 id, u8 _max, u64 mask, u8 _def)
2074 {
2075         const char * const *qmenu = NULL;
2076         const s64 *qmenu_int = NULL;
2077         unsigned int qmenu_int_len = 0;
2078         const char *name;
2079         enum v4l2_ctrl_type type;
2080         s64 min;
2081         s64 max = _max;
2082         s64 def = _def;
2083         u64 step;
2084         u32 flags;
2085
2086         v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2087
2088         if (type == V4L2_CTRL_TYPE_MENU)
2089                 qmenu = v4l2_ctrl_get_menu(id);
2090         else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
2091                 qmenu_int = v4l2_ctrl_get_int_menu(id, &qmenu_int_len);
2092
2093         if ((!qmenu && !qmenu_int) || (qmenu_int && max >= qmenu_int_len)) {
2094                 handler_set_err(hdl, -EINVAL);
2095                 return NULL;
2096         }
2097         return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2098                              0, max, mask, def, NULL, 0,
2099                              flags, qmenu, qmenu_int, ptr_null, NULL);
2100 }
2101 EXPORT_SYMBOL(v4l2_ctrl_new_std_menu);
2102
2103 /* Helper function for standard menu controls with driver defined menu */
2104 struct v4l2_ctrl *v4l2_ctrl_new_std_menu_items(struct v4l2_ctrl_handler *hdl,
2105                         const struct v4l2_ctrl_ops *ops, u32 id, u8 _max,
2106                         u64 mask, u8 _def, const char * const *qmenu)
2107 {
2108         enum v4l2_ctrl_type type;
2109         const char *name;
2110         u32 flags;
2111         u64 step;
2112         s64 min;
2113         s64 max = _max;
2114         s64 def = _def;
2115
2116         /* v4l2_ctrl_new_std_menu_items() should only be called for
2117          * standard controls without a standard menu.
2118          */
2119         if (v4l2_ctrl_get_menu(id)) {
2120                 handler_set_err(hdl, -EINVAL);
2121                 return NULL;
2122         }
2123
2124         v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2125         if (type != V4L2_CTRL_TYPE_MENU || qmenu == NULL) {
2126                 handler_set_err(hdl, -EINVAL);
2127                 return NULL;
2128         }
2129         return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2130                              0, max, mask, def, NULL, 0,
2131                              flags, qmenu, NULL, ptr_null, NULL);
2132
2133 }
2134 EXPORT_SYMBOL(v4l2_ctrl_new_std_menu_items);
2135
2136 /* Helper function for standard compound controls */
2137 struct v4l2_ctrl *v4l2_ctrl_new_std_compound(struct v4l2_ctrl_handler *hdl,
2138                                 const struct v4l2_ctrl_ops *ops, u32 id,
2139                                 const union v4l2_ctrl_ptr p_def)
2140 {
2141         const char *name;
2142         enum v4l2_ctrl_type type;
2143         u32 flags;
2144         s64 min, max, step, def;
2145
2146         v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2147         if (type < V4L2_CTRL_COMPOUND_TYPES) {
2148                 handler_set_err(hdl, -EINVAL);
2149                 return NULL;
2150         }
2151         return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2152                              min, max, step, def, NULL, 0,
2153                              flags, NULL, NULL, p_def, NULL);
2154 }
2155 EXPORT_SYMBOL(v4l2_ctrl_new_std_compound);
2156
2157 /* Helper function for standard integer menu controls */
2158 struct v4l2_ctrl *v4l2_ctrl_new_int_menu(struct v4l2_ctrl_handler *hdl,
2159                         const struct v4l2_ctrl_ops *ops,
2160                         u32 id, u8 _max, u8 _def, const s64 *qmenu_int)
2161 {
2162         const char *name;
2163         enum v4l2_ctrl_type type;
2164         s64 min;
2165         u64 step;
2166         s64 max = _max;
2167         s64 def = _def;
2168         u32 flags;
2169
2170         v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2171         if (type != V4L2_CTRL_TYPE_INTEGER_MENU) {
2172                 handler_set_err(hdl, -EINVAL);
2173                 return NULL;
2174         }
2175         return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2176                              0, max, 0, def, NULL, 0,
2177                              flags, NULL, qmenu_int, ptr_null, NULL);
2178 }
2179 EXPORT_SYMBOL(v4l2_ctrl_new_int_menu);
2180
2181 /* Add the controls from another handler to our own. */
2182 int v4l2_ctrl_add_handler(struct v4l2_ctrl_handler *hdl,
2183                           struct v4l2_ctrl_handler *add,
2184                           bool (*filter)(const struct v4l2_ctrl *ctrl),
2185                           bool from_other_dev)
2186 {
2187         struct v4l2_ctrl_ref *ref;
2188         int ret = 0;
2189
2190         /* Do nothing if either handler is NULL or if they are the same */
2191         if (!hdl || !add || hdl == add)
2192                 return 0;
2193         if (hdl->error)
2194                 return hdl->error;
2195         mutex_lock(add->lock);
2196         list_for_each_entry(ref, &add->ctrl_refs, node) {
2197                 struct v4l2_ctrl *ctrl = ref->ctrl;
2198
2199                 /* Skip handler-private controls. */
2200                 if (ctrl->is_private)
2201                         continue;
2202                 /* And control classes */
2203                 if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2204                         continue;
2205                 /* Filter any unwanted controls */
2206                 if (filter && !filter(ctrl))
2207                         continue;
2208                 ret = handler_new_ref(hdl, ctrl, NULL, from_other_dev, false);
2209                 if (ret)
2210                         break;
2211         }
2212         mutex_unlock(add->lock);
2213         return ret;
2214 }
2215 EXPORT_SYMBOL(v4l2_ctrl_add_handler);
2216
2217 bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl)
2218 {
2219         if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_TX)
2220                 return true;
2221         if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_RX)
2222                 return true;
2223         switch (ctrl->id) {
2224         case V4L2_CID_AUDIO_MUTE:
2225         case V4L2_CID_AUDIO_VOLUME:
2226         case V4L2_CID_AUDIO_BALANCE:
2227         case V4L2_CID_AUDIO_BASS:
2228         case V4L2_CID_AUDIO_TREBLE:
2229         case V4L2_CID_AUDIO_LOUDNESS:
2230                 return true;
2231         default:
2232                 break;
2233         }
2234         return false;
2235 }
2236 EXPORT_SYMBOL(v4l2_ctrl_radio_filter);
2237
2238 /* Cluster controls */
2239 void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
2240 {
2241         bool has_volatiles = false;
2242         int i;
2243
2244         /* The first control is the master control and it must not be NULL */
2245         if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
2246                 return;
2247
2248         for (i = 0; i < ncontrols; i++) {
2249                 if (controls[i]) {
2250                         controls[i]->cluster = controls;
2251                         controls[i]->ncontrols = ncontrols;
2252                         if (controls[i]->flags & V4L2_CTRL_FLAG_VOLATILE)
2253                                 has_volatiles = true;
2254                 }
2255         }
2256         controls[0]->has_volatiles = has_volatiles;
2257 }
2258 EXPORT_SYMBOL(v4l2_ctrl_cluster);
2259
2260 void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
2261                             u8 manual_val, bool set_volatile)
2262 {
2263         struct v4l2_ctrl *master = controls[0];
2264         u32 flag = 0;
2265         int i;
2266
2267         v4l2_ctrl_cluster(ncontrols, controls);
2268         WARN_ON(ncontrols <= 1);
2269         WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
2270         WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
2271         master->is_auto = true;
2272         master->has_volatiles = set_volatile;
2273         master->manual_mode_value = manual_val;
2274         master->flags |= V4L2_CTRL_FLAG_UPDATE;
2275
2276         if (!is_cur_manual(master))
2277                 flag = V4L2_CTRL_FLAG_INACTIVE |
2278                         (set_volatile ? V4L2_CTRL_FLAG_VOLATILE : 0);
2279
2280         for (i = 1; i < ncontrols; i++)
2281                 if (controls[i])
2282                         controls[i]->flags |= flag;
2283 }
2284 EXPORT_SYMBOL(v4l2_ctrl_auto_cluster);
2285
2286 /*
2287  * Obtain the current volatile values of an autocluster and mark them
2288  * as new.
2289  */
2290 void update_from_auto_cluster(struct v4l2_ctrl *master)
2291 {
2292         int i;
2293
2294         for (i = 1; i < master->ncontrols; i++)
2295                 cur_to_new(master->cluster[i]);
2296         if (!call_op(master, g_volatile_ctrl))
2297                 for (i = 1; i < master->ncontrols; i++)
2298                         if (master->cluster[i])
2299                                 master->cluster[i]->is_new = 1;
2300 }
2301
2302 /*
2303  * Return non-zero if one or more of the controls in the cluster has a new
2304  * value that differs from the current value.
2305  */
2306 static int cluster_changed(struct v4l2_ctrl *master)
2307 {
2308         bool changed = false;
2309         int i;
2310
2311         for (i = 0; i < master->ncontrols; i++) {
2312                 struct v4l2_ctrl *ctrl = master->cluster[i];
2313                 bool ctrl_changed = false;
2314
2315                 if (!ctrl)
2316                         continue;
2317
2318                 if (ctrl->flags & V4L2_CTRL_FLAG_EXECUTE_ON_WRITE) {
2319                         changed = true;
2320                         ctrl_changed = true;
2321                 }
2322
2323                 /*
2324                  * Set has_changed to false to avoid generating
2325                  * the event V4L2_EVENT_CTRL_CH_VALUE
2326                  */
2327                 if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
2328                         ctrl->has_changed = false;
2329                         continue;
2330                 }
2331
2332                 if (ctrl->elems != ctrl->new_elems)
2333                         ctrl_changed = true;
2334                 if (!ctrl_changed)
2335                         ctrl_changed = !ctrl->type_ops->equal(ctrl,
2336                                 ctrl->p_cur, ctrl->p_new);
2337                 ctrl->has_changed = ctrl_changed;
2338                 changed |= ctrl->has_changed;
2339         }
2340         return changed;
2341 }
2342
2343 /*
2344  * Core function that calls try/s_ctrl and ensures that the new value is
2345  * copied to the current value on a set.
2346  * Must be called with ctrl->handler->lock held.
2347  */
2348 int try_or_set_cluster(struct v4l2_fh *fh, struct v4l2_ctrl *master,
2349                        bool set, u32 ch_flags)
2350 {
2351         bool update_flag;
2352         int ret;
2353         int i;
2354
2355         /*
2356          * Go through the cluster and either validate the new value or
2357          * (if no new value was set), copy the current value to the new
2358          * value, ensuring a consistent view for the control ops when
2359          * called.
2360          */
2361         for (i = 0; i < master->ncontrols; i++) {
2362                 struct v4l2_ctrl *ctrl = master->cluster[i];
2363
2364                 if (!ctrl)
2365                         continue;
2366
2367                 if (!ctrl->is_new) {
2368                         cur_to_new(ctrl);
2369                         continue;
2370                 }
2371                 /*
2372                  * Check again: it may have changed since the
2373                  * previous check in try_or_set_ext_ctrls().
2374                  */
2375                 if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED))
2376                         return -EBUSY;
2377         }
2378
2379         ret = call_op(master, try_ctrl);
2380
2381         /* Don't set if there is no change */
2382         if (ret || !set || !cluster_changed(master))
2383                 return ret;
2384         ret = call_op(master, s_ctrl);
2385         if (ret)
2386                 return ret;
2387
2388         /* If OK, then make the new values permanent. */
2389         update_flag = is_cur_manual(master) != is_new_manual(master);
2390
2391         for (i = 0; i < master->ncontrols; i++) {
2392                 /*
2393                  * If we switch from auto to manual mode, and this cluster
2394                  * contains volatile controls, then all non-master controls
2395                  * have to be marked as changed. The 'new' value contains
2396                  * the volatile value (obtained by update_from_auto_cluster),
2397                  * which now has to become the current value.
2398                  */
2399                 if (i && update_flag && is_new_manual(master) &&
2400                     master->has_volatiles && master->cluster[i])
2401                         master->cluster[i]->has_changed = true;
2402
2403                 new_to_cur(fh, master->cluster[i], ch_flags |
2404                         ((update_flag && i > 0) ? V4L2_EVENT_CTRL_CH_FLAGS : 0));
2405         }
2406         return 0;
2407 }
2408
2409 /* Activate/deactivate a control. */
2410 void v4l2_ctrl_activate(struct v4l2_ctrl *ctrl, bool active)
2411 {
2412         /* invert since the actual flag is called 'inactive' */
2413         bool inactive = !active;
2414         bool old;
2415
2416         if (ctrl == NULL)
2417                 return;
2418
2419         if (inactive)
2420                 /* set V4L2_CTRL_FLAG_INACTIVE */
2421                 old = test_and_set_bit(4, &ctrl->flags);
2422         else
2423                 /* clear V4L2_CTRL_FLAG_INACTIVE */
2424                 old = test_and_clear_bit(4, &ctrl->flags);
2425         if (old != inactive)
2426                 send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2427 }
2428 EXPORT_SYMBOL(v4l2_ctrl_activate);
2429
2430 void __v4l2_ctrl_grab(struct v4l2_ctrl *ctrl, bool grabbed)
2431 {
2432         bool old;
2433
2434         if (ctrl == NULL)
2435                 return;
2436
2437         lockdep_assert_held(ctrl->handler->lock);
2438
2439         if (grabbed)
2440                 /* set V4L2_CTRL_FLAG_GRABBED */
2441                 old = test_and_set_bit(1, &ctrl->flags);
2442         else
2443                 /* clear V4L2_CTRL_FLAG_GRABBED */
2444                 old = test_and_clear_bit(1, &ctrl->flags);
2445         if (old != grabbed)
2446                 send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2447 }
2448 EXPORT_SYMBOL(__v4l2_ctrl_grab);
2449
2450 /* Call s_ctrl for all controls owned by the handler */
2451 int __v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2452 {
2453         struct v4l2_ctrl *ctrl;
2454         int ret = 0;
2455
2456         if (hdl == NULL)
2457                 return 0;
2458
2459         lockdep_assert_held(hdl->lock);
2460
2461         list_for_each_entry(ctrl, &hdl->ctrls, node)
2462                 ctrl->done = false;
2463
2464         list_for_each_entry(ctrl, &hdl->ctrls, node) {
2465                 struct v4l2_ctrl *master = ctrl->cluster[0];
2466                 int i;
2467
2468                 /* Skip if this control was already handled by a cluster. */
2469                 /* Skip button controls and read-only controls. */
2470                 if (ctrl->done || ctrl->type == V4L2_CTRL_TYPE_BUTTON ||
2471                     (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY))
2472                         continue;
2473
2474                 for (i = 0; i < master->ncontrols; i++) {
2475                         if (master->cluster[i]) {
2476                                 cur_to_new(master->cluster[i]);
2477                                 master->cluster[i]->is_new = 1;
2478                                 master->cluster[i]->done = true;
2479                         }
2480                 }
2481                 ret = call_op(master, s_ctrl);
2482                 if (ret)
2483                         break;
2484         }
2485
2486         return ret;
2487 }
2488 EXPORT_SYMBOL_GPL(__v4l2_ctrl_handler_setup);
2489
2490 int v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2491 {
2492         int ret;
2493
2494         if (hdl == NULL)
2495                 return 0;
2496
2497         mutex_lock(hdl->lock);
2498         ret = __v4l2_ctrl_handler_setup(hdl);
2499         mutex_unlock(hdl->lock);
2500
2501         return ret;
2502 }
2503 EXPORT_SYMBOL(v4l2_ctrl_handler_setup);
2504
2505 /* Log the control name and value */
2506 static void log_ctrl(const struct v4l2_ctrl *ctrl,
2507                      const char *prefix, const char *colon)
2508 {
2509         if (ctrl->flags & (V4L2_CTRL_FLAG_DISABLED | V4L2_CTRL_FLAG_WRITE_ONLY))
2510                 return;
2511         if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2512                 return;
2513
2514         pr_info("%s%s%s: ", prefix, colon, ctrl->name);
2515
2516         ctrl->type_ops->log(ctrl);
2517
2518         if (ctrl->flags & (V4L2_CTRL_FLAG_INACTIVE |
2519                            V4L2_CTRL_FLAG_GRABBED |
2520                            V4L2_CTRL_FLAG_VOLATILE)) {
2521                 if (ctrl->flags & V4L2_CTRL_FLAG_INACTIVE)
2522                         pr_cont(" inactive");
2523                 if (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)
2524                         pr_cont(" grabbed");
2525                 if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE)
2526                         pr_cont(" volatile");
2527         }
2528         pr_cont("\n");
2529 }
2530
2531 /* Log all controls owned by the handler */
2532 void v4l2_ctrl_handler_log_status(struct v4l2_ctrl_handler *hdl,
2533                                   const char *prefix)
2534 {
2535         struct v4l2_ctrl *ctrl;
2536         const char *colon = "";
2537         int len;
2538
2539         if (!hdl)
2540                 return;
2541         if (!prefix)
2542                 prefix = "";
2543         len = strlen(prefix);
2544         if (len && prefix[len - 1] != ' ')
2545                 colon = ": ";
2546         mutex_lock(hdl->lock);
2547         list_for_each_entry(ctrl, &hdl->ctrls, node)
2548                 if (!(ctrl->flags & V4L2_CTRL_FLAG_DISABLED))
2549                         log_ctrl(ctrl, prefix, colon);
2550         mutex_unlock(hdl->lock);
2551 }
2552 EXPORT_SYMBOL(v4l2_ctrl_handler_log_status);
2553
2554 int v4l2_ctrl_new_fwnode_properties(struct v4l2_ctrl_handler *hdl,
2555                                     const struct v4l2_ctrl_ops *ctrl_ops,
2556                                     const struct v4l2_fwnode_device_properties *p)
2557 {
2558         if (p->orientation != V4L2_FWNODE_PROPERTY_UNSET) {
2559                 u32 orientation_ctrl;
2560
2561                 switch (p->orientation) {
2562                 case V4L2_FWNODE_ORIENTATION_FRONT:
2563                         orientation_ctrl = V4L2_CAMERA_ORIENTATION_FRONT;
2564                         break;
2565                 case V4L2_FWNODE_ORIENTATION_BACK:
2566                         orientation_ctrl = V4L2_CAMERA_ORIENTATION_BACK;
2567                         break;
2568                 case V4L2_FWNODE_ORIENTATION_EXTERNAL:
2569                         orientation_ctrl = V4L2_CAMERA_ORIENTATION_EXTERNAL;
2570                         break;
2571                 default:
2572                         return -EINVAL;
2573                 }
2574                 if (!v4l2_ctrl_new_std_menu(hdl, ctrl_ops,
2575                                             V4L2_CID_CAMERA_ORIENTATION,
2576                                             V4L2_CAMERA_ORIENTATION_EXTERNAL, 0,
2577                                             orientation_ctrl))
2578                         return hdl->error;
2579         }
2580
2581         if (p->rotation != V4L2_FWNODE_PROPERTY_UNSET) {
2582                 if (!v4l2_ctrl_new_std(hdl, ctrl_ops,
2583                                        V4L2_CID_CAMERA_SENSOR_ROTATION,
2584                                        p->rotation, p->rotation, 1,
2585                                        p->rotation))
2586                         return hdl->error;
2587         }
2588
2589         return hdl->error;
2590 }
2591 EXPORT_SYMBOL(v4l2_ctrl_new_fwnode_properties);