1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * V4L2 controls framework uAPI implementation:
4  *
5  * Copyright (C) 2010-2021  Hans Verkuil <hverkuil-cisco@xs4all.nl>
6  */
7 
8 #define pr_fmt(fmt) "v4l2-ctrls: " fmt
9 
10 #include <linux/export.h>
11 #include <linux/mm.h>
12 #include <linux/slab.h>
13 #include <media/v4l2-ctrls.h>
14 #include <media/v4l2-dev.h>
15 #include <media/v4l2-device.h>
16 #include <media/v4l2-event.h>
17 #include <media/v4l2-ioctl.h>
18 
19 #include "v4l2-ctrls-priv.h"
20 
21 /* Internal temporary helper struct, one for each v4l2_ext_control */
22 struct v4l2_ctrl_helper {
23 	/* Pointer to the control reference of the master control */
24 	struct v4l2_ctrl_ref *mref;
25 	/* The control ref corresponding to the v4l2_ext_control ID field. */
26 	struct v4l2_ctrl_ref *ref;
27 	/*
28 	 * v4l2_ext_control index of the next control belonging to the
29 	 * same cluster, or 0 if there isn't any.
30 	 */
31 	u32 next;
32 };
33 
34 /*
35  * Helper functions to copy control payload data from kernel space to
36  * user space and vice versa.
37  */
38 
39 /* Helper function: copy the given control value back to the caller */
ptr_to_user(struct v4l2_ext_control * c,struct v4l2_ctrl * ctrl,union v4l2_ctrl_ptr ptr)40 static int ptr_to_user(struct v4l2_ext_control *c,
41 		       struct v4l2_ctrl *ctrl,
42 		       union v4l2_ctrl_ptr ptr)
43 {
44 	u32 len;
45 
46 	if (ctrl->is_ptr && !ctrl->is_string)
47 		return copy_to_user(c->ptr, ptr.p_const, c->size) ?
48 		       -EFAULT : 0;
49 
50 	switch (ctrl->type) {
51 	case V4L2_CTRL_TYPE_STRING:
52 		len = strlen(ptr.p_char);
53 		if (c->size < len + 1) {
54 			c->size = ctrl->elem_size;
55 			return -ENOSPC;
56 		}
57 		return copy_to_user(c->string, ptr.p_char, len + 1) ?
58 		       -EFAULT : 0;
59 	case V4L2_CTRL_TYPE_INTEGER64:
60 		c->value64 = *ptr.p_s64;
61 		break;
62 	default:
63 		c->value = *ptr.p_s32;
64 		break;
65 	}
66 	return 0;
67 }
68 
69 /* Helper function: copy the current control value back to the caller */
cur_to_user(struct v4l2_ext_control * c,struct v4l2_ctrl * ctrl)70 static int cur_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
71 {
72 	return ptr_to_user(c, ctrl, ctrl->p_cur);
73 }
74 
75 /* Helper function: copy the new control value back to the caller */
new_to_user(struct v4l2_ext_control * c,struct v4l2_ctrl * ctrl)76 static int new_to_user(struct v4l2_ext_control *c,
77 		       struct v4l2_ctrl *ctrl)
78 {
79 	return ptr_to_user(c, ctrl, ctrl->p_new);
80 }
81 
82 /* Helper function: copy the request value back to the caller */
req_to_user(struct v4l2_ext_control * c,struct v4l2_ctrl_ref * ref)83 static int req_to_user(struct v4l2_ext_control *c,
84 		       struct v4l2_ctrl_ref *ref)
85 {
86 	return ptr_to_user(c, ref->ctrl, ref->p_req);
87 }
88 
89 /* Helper function: copy the initial control value back to the caller */
def_to_user(struct v4l2_ext_control * c,struct v4l2_ctrl * ctrl)90 static int def_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
91 {
92 	int idx;
93 
94 	for (idx = 0; idx < ctrl->elems; idx++)
95 		ctrl->type_ops->init(ctrl, idx, ctrl->p_new);
96 
97 	return ptr_to_user(c, ctrl, ctrl->p_new);
98 }
99 
100 /* Helper function: copy the caller-provider value to the given control value */
user_to_ptr(struct v4l2_ext_control * c,struct v4l2_ctrl * ctrl,union v4l2_ctrl_ptr ptr)101 static int user_to_ptr(struct v4l2_ext_control *c,
102 		       struct v4l2_ctrl *ctrl,
103 		       union v4l2_ctrl_ptr ptr)
104 {
105 	int ret;
106 	u32 size;
107 
108 	ctrl->is_new = 1;
109 	if (ctrl->is_ptr && !ctrl->is_string) {
110 		unsigned int idx;
111 
112 		ret = copy_from_user(ptr.p, c->ptr, c->size) ? -EFAULT : 0;
113 		if (ret || !ctrl->is_array)
114 			return ret;
115 		for (idx = c->size / ctrl->elem_size; idx < ctrl->elems; idx++)
116 			ctrl->type_ops->init(ctrl, idx, ptr);
117 		return 0;
118 	}
119 
120 	switch (ctrl->type) {
121 	case V4L2_CTRL_TYPE_INTEGER64:
122 		*ptr.p_s64 = c->value64;
123 		break;
124 	case V4L2_CTRL_TYPE_STRING:
125 		size = c->size;
126 		if (size == 0)
127 			return -ERANGE;
128 		if (size > ctrl->maximum + 1)
129 			size = ctrl->maximum + 1;
130 		ret = copy_from_user(ptr.p_char, c->string, size) ? -EFAULT : 0;
131 		if (!ret) {
132 			char last = ptr.p_char[size - 1];
133 
134 			ptr.p_char[size - 1] = 0;
135 			/*
136 			 * If the string was longer than ctrl->maximum,
137 			 * then return an error.
138 			 */
139 			if (strlen(ptr.p_char) == ctrl->maximum && last)
140 				return -ERANGE;
141 		}
142 		return ret;
143 	default:
144 		*ptr.p_s32 = c->value;
145 		break;
146 	}
147 	return 0;
148 }
149 
150 /* Helper function: copy the caller-provider value as the new control value */
user_to_new(struct v4l2_ext_control * c,struct v4l2_ctrl * ctrl)151 static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
152 {
153 	return user_to_ptr(c, ctrl, ctrl->p_new);
154 }
155 
156 /*
157  * VIDIOC_G/TRY/S_EXT_CTRLS implementation
158  */
159 
160 /*
161  * Some general notes on the atomic requirements of VIDIOC_G/TRY/S_EXT_CTRLS:
162  *
163  * It is not a fully atomic operation, just best-effort only. After all, if
164  * multiple controls have to be set through multiple i2c writes (for example)
165  * then some initial writes may succeed while others fail. Thus leaving the
166  * system in an inconsistent state. The question is how much effort you are
167  * willing to spend on trying to make something atomic that really isn't.
168  *
169  * From the point of view of an application the main requirement is that
170  * when you call VIDIOC_S_EXT_CTRLS and some values are invalid then an
171  * error should be returned without actually affecting any controls.
172  *
173  * If all the values are correct, then it is acceptable to just give up
174  * in case of low-level errors.
175  *
176  * It is important though that the application can tell when only a partial
177  * configuration was done. The way we do that is through the error_idx field
178  * of struct v4l2_ext_controls: if that is equal to the count field then no
179  * controls were affected. Otherwise all controls before that index were
180  * successful in performing their 'get' or 'set' operation, the control at
181  * the given index failed, and you don't know what happened with the controls
182  * after the failed one. Since if they were part of a control cluster they
183  * could have been successfully processed (if a cluster member was encountered
184  * at index < error_idx), they could have failed (if a cluster member was at
185  * error_idx), or they may not have been processed yet (if the first cluster
186  * member appeared after error_idx).
187  *
188  * It is all fairly theoretical, though. In practice all you can do is to
189  * bail out. If error_idx == count, then it is an application bug. If
190  * error_idx < count then it is only an application bug if the error code was
191  * EBUSY. That usually means that something started streaming just when you
192  * tried to set the controls. In all other cases it is a driver/hardware
193  * problem and all you can do is to retry or bail out.
194  *
195  * Note that these rules do not apply to VIDIOC_TRY_EXT_CTRLS: since that
196  * never modifies controls the error_idx is just set to whatever control
197  * has an invalid value.
198  */
199 
200 /*
201  * Prepare for the extended g/s/try functions.
202  * Find the controls in the control array and do some basic checks.
203  */
prepare_ext_ctrls(struct v4l2_ctrl_handler * hdl,struct v4l2_ext_controls * cs,struct v4l2_ctrl_helper * helpers,struct video_device * vdev,bool get)204 static int prepare_ext_ctrls(struct v4l2_ctrl_handler *hdl,
205 			     struct v4l2_ext_controls *cs,
206 			     struct v4l2_ctrl_helper *helpers,
207 			     struct video_device *vdev,
208 			     bool get)
209 {
210 	struct v4l2_ctrl_helper *h;
211 	bool have_clusters = false;
212 	u32 i;
213 
214 	for (i = 0, h = helpers; i < cs->count; i++, h++) {
215 		struct v4l2_ext_control *c = &cs->controls[i];
216 		struct v4l2_ctrl_ref *ref;
217 		struct v4l2_ctrl *ctrl;
218 		u32 id = c->id & V4L2_CTRL_ID_MASK;
219 
220 		cs->error_idx = i;
221 
222 		if (cs->which &&
223 		    cs->which != V4L2_CTRL_WHICH_DEF_VAL &&
224 		    cs->which != V4L2_CTRL_WHICH_REQUEST_VAL &&
225 		    V4L2_CTRL_ID2WHICH(id) != cs->which) {
226 			dprintk(vdev,
227 				"invalid which 0x%x or control id 0x%x\n",
228 				cs->which, id);
229 			return -EINVAL;
230 		}
231 
232 		/*
233 		 * Old-style private controls are not allowed for
234 		 * extended controls.
235 		 */
236 		if (id >= V4L2_CID_PRIVATE_BASE) {
237 			dprintk(vdev,
238 				"old-style private controls not allowed\n");
239 			return -EINVAL;
240 		}
241 		ref = find_ref_lock(hdl, id);
242 		if (!ref) {
243 			dprintk(vdev, "cannot find control id 0x%x\n", id);
244 			return -EINVAL;
245 		}
246 		h->ref = ref;
247 		ctrl = ref->ctrl;
248 		if (ctrl->flags & V4L2_CTRL_FLAG_DISABLED) {
249 			dprintk(vdev, "control id 0x%x is disabled\n", id);
250 			return -EINVAL;
251 		}
252 
253 		if (ctrl->cluster[0]->ncontrols > 1)
254 			have_clusters = true;
255 		if (ctrl->cluster[0] != ctrl)
256 			ref = find_ref_lock(hdl, ctrl->cluster[0]->id);
257 		if (ctrl->is_ptr && !ctrl->is_string) {
258 			unsigned int tot_size = ctrl->elems * ctrl->elem_size;
259 
260 			if (c->size < tot_size) {
261 				/*
262 				 * In the get case the application first
263 				 * queries to obtain the size of the control.
264 				 */
265 				if (get) {
266 					c->size = tot_size;
267 					return -ENOSPC;
268 				}
269 				dprintk(vdev,
270 					"pointer control id 0x%x size too small, %d bytes but %d bytes needed\n",
271 					id, c->size, tot_size);
272 				return -EFAULT;
273 			}
274 			c->size = tot_size;
275 		}
276 		/* Store the ref to the master control of the cluster */
277 		h->mref = ref;
278 		/*
279 		 * Initially set next to 0, meaning that there is no other
280 		 * control in this helper array belonging to the same
281 		 * cluster.
282 		 */
283 		h->next = 0;
284 	}
285 
286 	/*
287 	 * We are done if there were no controls that belong to a multi-
288 	 * control cluster.
289 	 */
290 	if (!have_clusters)
291 		return 0;
292 
293 	/*
294 	 * The code below figures out in O(n) time which controls in the list
295 	 * belong to the same cluster.
296 	 */
297 
298 	/* This has to be done with the handler lock taken. */
299 	mutex_lock(hdl->lock);
300 
301 	/* First zero the helper field in the master control references */
302 	for (i = 0; i < cs->count; i++)
303 		helpers[i].mref->helper = NULL;
304 	for (i = 0, h = helpers; i < cs->count; i++, h++) {
305 		struct v4l2_ctrl_ref *mref = h->mref;
306 
307 		/*
308 		 * If the mref->helper is set, then it points to an earlier
309 		 * helper that belongs to the same cluster.
310 		 */
311 		if (mref->helper) {
312 			/*
313 			 * Set the next field of mref->helper to the current
314 			 * index: this means that the earlier helper now
315 			 * points to the next helper in the same cluster.
316 			 */
317 			mref->helper->next = i;
318 			/*
319 			 * mref should be set only for the first helper in the
320 			 * cluster, clear the others.
321 			 */
322 			h->mref = NULL;
323 		}
324 		/* Point the mref helper to the current helper struct. */
325 		mref->helper = h;
326 	}
327 	mutex_unlock(hdl->lock);
328 	return 0;
329 }
330 
331 /*
332  * Handles the corner case where cs->count == 0. It checks whether the
333  * specified control class exists. If that class ID is 0, then it checks
334  * whether there are any controls at all.
335  */
class_check(struct v4l2_ctrl_handler * hdl,u32 which)336 static int class_check(struct v4l2_ctrl_handler *hdl, u32 which)
337 {
338 	if (which == 0 || which == V4L2_CTRL_WHICH_DEF_VAL ||
339 	    which == V4L2_CTRL_WHICH_REQUEST_VAL)
340 		return 0;
341 	return find_ref_lock(hdl, which | 1) ? 0 : -EINVAL;
342 }
343 
344 /*
345  * Get extended controls. Allocates the helpers array if needed.
346  *
347  * Note that v4l2_g_ext_ctrls_common() with 'which' set to
348  * V4L2_CTRL_WHICH_REQUEST_VAL is only called if the request was
349  * completed, and in that case valid_p_req is true for all controls.
350  */
v4l2_g_ext_ctrls_common(struct v4l2_ctrl_handler * hdl,struct v4l2_ext_controls * cs,struct video_device * vdev)351 int v4l2_g_ext_ctrls_common(struct v4l2_ctrl_handler *hdl,
352 			    struct v4l2_ext_controls *cs,
353 			    struct video_device *vdev)
354 {
355 	struct v4l2_ctrl_helper helper[4];
356 	struct v4l2_ctrl_helper *helpers = helper;
357 	int ret;
358 	int i, j;
359 	bool is_default, is_request;
360 
361 	is_default = (cs->which == V4L2_CTRL_WHICH_DEF_VAL);
362 	is_request = (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL);
363 
364 	cs->error_idx = cs->count;
365 	cs->which = V4L2_CTRL_ID2WHICH(cs->which);
366 
367 	if (!hdl)
368 		return -EINVAL;
369 
370 	if (cs->count == 0)
371 		return class_check(hdl, cs->which);
372 
373 	if (cs->count > ARRAY_SIZE(helper)) {
374 		helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
375 					 GFP_KERNEL);
376 		if (!helpers)
377 			return -ENOMEM;
378 	}
379 
380 	ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, true);
381 	cs->error_idx = cs->count;
382 
383 	for (i = 0; !ret && i < cs->count; i++)
384 		if (helpers[i].ref->ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
385 			ret = -EACCES;
386 
387 	for (i = 0; !ret && i < cs->count; i++) {
388 		struct v4l2_ctrl *master;
389 		bool is_volatile = false;
390 		u32 idx = i;
391 
392 		if (!helpers[i].mref)
393 			continue;
394 
395 		master = helpers[i].mref->ctrl;
396 		cs->error_idx = i;
397 
398 		v4l2_ctrl_lock(master);
399 
400 		/*
401 		 * g_volatile_ctrl will update the new control values.
402 		 * This makes no sense for V4L2_CTRL_WHICH_DEF_VAL and
403 		 * V4L2_CTRL_WHICH_REQUEST_VAL. In the case of requests
404 		 * it is v4l2_ctrl_request_complete() that copies the
405 		 * volatile controls at the time of request completion
406 		 * to the request, so you don't want to do that again.
407 		 */
408 		if (!is_default && !is_request &&
409 		    ((master->flags & V4L2_CTRL_FLAG_VOLATILE) ||
410 		    (master->has_volatiles && !is_cur_manual(master)))) {
411 			for (j = 0; j < master->ncontrols; j++)
412 				cur_to_new(master->cluster[j]);
413 			ret = call_op(master, g_volatile_ctrl);
414 			is_volatile = true;
415 		}
416 
417 		if (ret) {
418 			v4l2_ctrl_unlock(master);
419 			break;
420 		}
421 
422 		/*
423 		 * Copy the default value (if is_default is true), the
424 		 * request value (if is_request is true and p_req is valid),
425 		 * the new volatile value (if is_volatile is true) or the
426 		 * current value.
427 		 */
428 		do {
429 			struct v4l2_ctrl_ref *ref = helpers[idx].ref;
430 
431 			if (is_default)
432 				ret = def_to_user(cs->controls + idx, ref->ctrl);
433 			else if (is_request && ref->valid_p_req)
434 				ret = req_to_user(cs->controls + idx, ref);
435 			else if (is_volatile)
436 				ret = new_to_user(cs->controls + idx, ref->ctrl);
437 			else
438 				ret = cur_to_user(cs->controls + idx, ref->ctrl);
439 			idx = helpers[idx].next;
440 		} while (!ret && idx);
441 
442 		v4l2_ctrl_unlock(master);
443 	}
444 
445 	if (cs->count > ARRAY_SIZE(helper))
446 		kvfree(helpers);
447 	return ret;
448 }
449 
v4l2_g_ext_ctrls(struct v4l2_ctrl_handler * hdl,struct video_device * vdev,struct media_device * mdev,struct v4l2_ext_controls * cs)450 int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct video_device *vdev,
451 		     struct media_device *mdev, struct v4l2_ext_controls *cs)
452 {
453 	if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
454 		return v4l2_g_ext_ctrls_request(hdl, vdev, mdev, cs);
455 
456 	return v4l2_g_ext_ctrls_common(hdl, cs, vdev);
457 }
458 EXPORT_SYMBOL(v4l2_g_ext_ctrls);
459 
460 /* Validate controls. */
validate_ctrls(struct v4l2_ext_controls * cs,struct v4l2_ctrl_helper * helpers,struct video_device * vdev,bool set)461 static int validate_ctrls(struct v4l2_ext_controls *cs,
462 			  struct v4l2_ctrl_helper *helpers,
463 			  struct video_device *vdev,
464 			  bool set)
465 {
466 	unsigned int i;
467 	int ret = 0;
468 
469 	cs->error_idx = cs->count;
470 	for (i = 0; i < cs->count; i++) {
471 		struct v4l2_ctrl *ctrl = helpers[i].ref->ctrl;
472 		union v4l2_ctrl_ptr p_new;
473 
474 		cs->error_idx = i;
475 
476 		if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY) {
477 			dprintk(vdev,
478 				"control id 0x%x is read-only\n",
479 				ctrl->id);
480 			return -EACCES;
481 		}
482 		/*
483 		 * This test is also done in try_set_control_cluster() which
484 		 * is called in atomic context, so that has the final say,
485 		 * but it makes sense to do an up-front check as well. Once
486 		 * an error occurs in try_set_control_cluster() some other
487 		 * controls may have been set already and we want to do a
488 		 * best-effort to avoid that.
489 		 */
490 		if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)) {
491 			dprintk(vdev,
492 				"control id 0x%x is grabbed, cannot set\n",
493 				ctrl->id);
494 			return -EBUSY;
495 		}
496 		/*
497 		 * Skip validation for now if the payload needs to be copied
498 		 * from userspace into kernelspace. We'll validate those later.
499 		 */
500 		if (ctrl->is_ptr)
501 			continue;
502 		if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
503 			p_new.p_s64 = &cs->controls[i].value64;
504 		else
505 			p_new.p_s32 = &cs->controls[i].value;
506 		ret = validate_new(ctrl, p_new);
507 		if (ret)
508 			return ret;
509 	}
510 	return 0;
511 }
512 
513 /* Try or try-and-set controls */
try_set_ext_ctrls_common(struct v4l2_fh * fh,struct v4l2_ctrl_handler * hdl,struct v4l2_ext_controls * cs,struct video_device * vdev,bool set)514 int try_set_ext_ctrls_common(struct v4l2_fh *fh,
515 			     struct v4l2_ctrl_handler *hdl,
516 			     struct v4l2_ext_controls *cs,
517 			     struct video_device *vdev, bool set)
518 {
519 	struct v4l2_ctrl_helper helper[4];
520 	struct v4l2_ctrl_helper *helpers = helper;
521 	unsigned int i, j;
522 	int ret;
523 
524 	cs->error_idx = cs->count;
525 
526 	/* Default value cannot be changed */
527 	if (cs->which == V4L2_CTRL_WHICH_DEF_VAL) {
528 		dprintk(vdev, "%s: cannot change default value\n",
529 			video_device_node_name(vdev));
530 		return -EINVAL;
531 	}
532 
533 	cs->which = V4L2_CTRL_ID2WHICH(cs->which);
534 
535 	if (!hdl) {
536 		dprintk(vdev, "%s: invalid null control handler\n",
537 			video_device_node_name(vdev));
538 		return -EINVAL;
539 	}
540 
541 	if (cs->count == 0)
542 		return class_check(hdl, cs->which);
543 
544 	if (cs->count > ARRAY_SIZE(helper)) {
545 		helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
546 					 GFP_KERNEL);
547 		if (!helpers)
548 			return -ENOMEM;
549 	}
550 	ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, false);
551 	if (!ret)
552 		ret = validate_ctrls(cs, helpers, vdev, set);
553 	if (ret && set)
554 		cs->error_idx = cs->count;
555 	for (i = 0; !ret && i < cs->count; i++) {
556 		struct v4l2_ctrl *master;
557 		u32 idx = i;
558 
559 		if (!helpers[i].mref)
560 			continue;
561 
562 		cs->error_idx = i;
563 		master = helpers[i].mref->ctrl;
564 		v4l2_ctrl_lock(master);
565 
566 		/* Reset the 'is_new' flags of the cluster */
567 		for (j = 0; j < master->ncontrols; j++)
568 			if (master->cluster[j])
569 				master->cluster[j]->is_new = 0;
570 
571 		/*
572 		 * For volatile autoclusters that are currently in auto mode
573 		 * we need to discover if it will be set to manual mode.
574 		 * If so, then we have to copy the current volatile values
575 		 * first since those will become the new manual values (which
576 		 * may be overwritten by explicit new values from this set
577 		 * of controls).
578 		 */
579 		if (master->is_auto && master->has_volatiles &&
580 		    !is_cur_manual(master)) {
581 			/* Pick an initial non-manual value */
582 			s32 new_auto_val = master->manual_mode_value + 1;
583 			u32 tmp_idx = idx;
584 
585 			do {
586 				/*
587 				 * Check if the auto control is part of the
588 				 * list, and remember the new value.
589 				 */
590 				if (helpers[tmp_idx].ref->ctrl == master)
591 					new_auto_val = cs->controls[tmp_idx].value;
592 				tmp_idx = helpers[tmp_idx].next;
593 			} while (tmp_idx);
594 			/*
595 			 * If the new value == the manual value, then copy
596 			 * the current volatile values.
597 			 */
598 			if (new_auto_val == master->manual_mode_value)
599 				update_from_auto_cluster(master);
600 		}
601 
602 		/*
603 		 * Copy the new caller-supplied control values.
604 		 * user_to_new() sets 'is_new' to 1.
605 		 */
606 		do {
607 			struct v4l2_ctrl *ctrl = helpers[idx].ref->ctrl;
608 
609 			ret = user_to_new(cs->controls + idx, ctrl);
610 			if (!ret && ctrl->is_ptr) {
611 				ret = validate_new(ctrl, ctrl->p_new);
612 				if (ret)
613 					dprintk(vdev,
614 						"failed to validate control %s (%d)\n",
615 						v4l2_ctrl_get_name(ctrl->id), ret);
616 			}
617 			idx = helpers[idx].next;
618 		} while (!ret && idx);
619 
620 		if (!ret)
621 			ret = try_or_set_cluster(fh, master,
622 						 !hdl->req_obj.req && set, 0);
623 		if (!ret && hdl->req_obj.req && set) {
624 			for (j = 0; j < master->ncontrols; j++) {
625 				struct v4l2_ctrl_ref *ref =
626 					find_ref(hdl, master->cluster[j]->id);
627 
628 				new_to_req(ref);
629 			}
630 		}
631 
632 		/* Copy the new values back to userspace. */
633 		if (!ret) {
634 			idx = i;
635 			do {
636 				ret = new_to_user(cs->controls + idx,
637 						  helpers[idx].ref->ctrl);
638 				idx = helpers[idx].next;
639 			} while (!ret && idx);
640 		}
641 		v4l2_ctrl_unlock(master);
642 	}
643 
644 	if (cs->count > ARRAY_SIZE(helper))
645 		kvfree(helpers);
646 	return ret;
647 }
648 
try_set_ext_ctrls(struct v4l2_fh * fh,struct v4l2_ctrl_handler * hdl,struct video_device * vdev,struct media_device * mdev,struct v4l2_ext_controls * cs,bool set)649 static int try_set_ext_ctrls(struct v4l2_fh *fh,
650 			     struct v4l2_ctrl_handler *hdl,
651 			     struct video_device *vdev,
652 			     struct media_device *mdev,
653 			     struct v4l2_ext_controls *cs, bool set)
654 {
655 	int ret;
656 
657 	if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
658 		return try_set_ext_ctrls_request(fh, hdl, vdev, mdev, cs, set);
659 
660 	ret = try_set_ext_ctrls_common(fh, hdl, cs, vdev, set);
661 	if (ret)
662 		dprintk(vdev,
663 			"%s: try_set_ext_ctrls_common failed (%d)\n",
664 			video_device_node_name(vdev), ret);
665 
666 	return ret;
667 }
668 
v4l2_try_ext_ctrls(struct v4l2_ctrl_handler * hdl,struct video_device * vdev,struct media_device * mdev,struct v4l2_ext_controls * cs)669 int v4l2_try_ext_ctrls(struct v4l2_ctrl_handler *hdl,
670 		       struct video_device *vdev,
671 		       struct media_device *mdev,
672 		       struct v4l2_ext_controls *cs)
673 {
674 	return try_set_ext_ctrls(NULL, hdl, vdev, mdev, cs, false);
675 }
676 EXPORT_SYMBOL(v4l2_try_ext_ctrls);
677 
v4l2_s_ext_ctrls(struct v4l2_fh * fh,struct v4l2_ctrl_handler * hdl,struct video_device * vdev,struct media_device * mdev,struct v4l2_ext_controls * cs)678 int v4l2_s_ext_ctrls(struct v4l2_fh *fh,
679 		     struct v4l2_ctrl_handler *hdl,
680 		     struct video_device *vdev,
681 		     struct media_device *mdev,
682 		     struct v4l2_ext_controls *cs)
683 {
684 	return try_set_ext_ctrls(fh, hdl, vdev, mdev, cs, true);
685 }
686 EXPORT_SYMBOL(v4l2_s_ext_ctrls);
687 
688 /*
689  * VIDIOC_G/S_CTRL implementation
690  */
691 
692 /* Helper function to get a single control */
get_ctrl(struct v4l2_ctrl * ctrl,struct v4l2_ext_control * c)693 static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c)
694 {
695 	struct v4l2_ctrl *master = ctrl->cluster[0];
696 	int ret = 0;
697 	int i;
698 
699 	/* Compound controls are not supported. The new_to_user() and
700 	 * cur_to_user() calls below would need to be modified not to access
701 	 * userspace memory when called from get_ctrl().
702 	 */
703 	if (!ctrl->is_int && ctrl->type != V4L2_CTRL_TYPE_INTEGER64)
704 		return -EINVAL;
705 
706 	if (ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
707 		return -EACCES;
708 
709 	v4l2_ctrl_lock(master);
710 	/* g_volatile_ctrl will update the current control values */
711 	if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
712 		for (i = 0; i < master->ncontrols; i++)
713 			cur_to_new(master->cluster[i]);
714 		ret = call_op(master, g_volatile_ctrl);
715 		new_to_user(c, ctrl);
716 	} else {
717 		cur_to_user(c, ctrl);
718 	}
719 	v4l2_ctrl_unlock(master);
720 	return ret;
721 }
722 
v4l2_g_ctrl(struct v4l2_ctrl_handler * hdl,struct v4l2_control * control)723 int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_control *control)
724 {
725 	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
726 	struct v4l2_ext_control c;
727 	int ret;
728 
729 	if (!ctrl || !ctrl->is_int)
730 		return -EINVAL;
731 	ret = get_ctrl(ctrl, &c);
732 	control->value = c.value;
733 	return ret;
734 }
735 EXPORT_SYMBOL(v4l2_g_ctrl);
736 
737 /* Helper function for VIDIOC_S_CTRL compatibility */
set_ctrl(struct v4l2_fh * fh,struct v4l2_ctrl * ctrl,u32 ch_flags)738 static int set_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
739 {
740 	struct v4l2_ctrl *master = ctrl->cluster[0];
741 	int ret;
742 	int i;
743 
744 	/* Reset the 'is_new' flags of the cluster */
745 	for (i = 0; i < master->ncontrols; i++)
746 		if (master->cluster[i])
747 			master->cluster[i]->is_new = 0;
748 
749 	ret = validate_new(ctrl, ctrl->p_new);
750 	if (ret)
751 		return ret;
752 
753 	/*
754 	 * For autoclusters with volatiles that are switched from auto to
755 	 * manual mode we have to update the current volatile values since
756 	 * those will become the initial manual values after such a switch.
757 	 */
758 	if (master->is_auto && master->has_volatiles && ctrl == master &&
759 	    !is_cur_manual(master) && ctrl->val == master->manual_mode_value)
760 		update_from_auto_cluster(master);
761 
762 	ctrl->is_new = 1;
763 	return try_or_set_cluster(fh, master, true, ch_flags);
764 }
765 
766 /* Helper function for VIDIOC_S_CTRL compatibility */
set_ctrl_lock(struct v4l2_fh * fh,struct v4l2_ctrl * ctrl,struct v4l2_ext_control * c)767 static int set_ctrl_lock(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl,
768 			 struct v4l2_ext_control *c)
769 {
770 	int ret;
771 
772 	v4l2_ctrl_lock(ctrl);
773 	user_to_new(c, ctrl);
774 	ret = set_ctrl(fh, ctrl, 0);
775 	if (!ret)
776 		cur_to_user(c, ctrl);
777 	v4l2_ctrl_unlock(ctrl);
778 	return ret;
779 }
780 
v4l2_s_ctrl(struct v4l2_fh * fh,struct v4l2_ctrl_handler * hdl,struct v4l2_control * control)781 int v4l2_s_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl_handler *hdl,
782 		struct v4l2_control *control)
783 {
784 	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
785 	struct v4l2_ext_control c = { control->id };
786 	int ret;
787 
788 	if (!ctrl || !ctrl->is_int)
789 		return -EINVAL;
790 
791 	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
792 		return -EACCES;
793 
794 	c.value = control->value;
795 	ret = set_ctrl_lock(fh, ctrl, &c);
796 	control->value = c.value;
797 	return ret;
798 }
799 EXPORT_SYMBOL(v4l2_s_ctrl);
800 
801 /*
802  * Helper functions for drivers to get/set controls.
803  */
804 
v4l2_ctrl_g_ctrl(struct v4l2_ctrl * ctrl)805 s32 v4l2_ctrl_g_ctrl(struct v4l2_ctrl *ctrl)
806 {
807 	struct v4l2_ext_control c;
808 
809 	/* It's a driver bug if this happens. */
810 	if (WARN_ON(!ctrl->is_int))
811 		return 0;
812 	c.value = 0;
813 	get_ctrl(ctrl, &c);
814 	return c.value;
815 }
816 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl);
817 
v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl * ctrl)818 s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl)
819 {
820 	struct v4l2_ext_control c;
821 
822 	/* It's a driver bug if this happens. */
823 	if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
824 		return 0;
825 	c.value64 = 0;
826 	get_ctrl(ctrl, &c);
827 	return c.value64;
828 }
829 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl_int64);
830 
__v4l2_ctrl_s_ctrl(struct v4l2_ctrl * ctrl,s32 val)831 int __v4l2_ctrl_s_ctrl(struct v4l2_ctrl *ctrl, s32 val)
832 {
833 	lockdep_assert_held(ctrl->handler->lock);
834 
835 	/* It's a driver bug if this happens. */
836 	if (WARN_ON(!ctrl->is_int))
837 		return -EINVAL;
838 	ctrl->val = val;
839 	return set_ctrl(NULL, ctrl, 0);
840 }
841 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl);
842 
__v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl * ctrl,s64 val)843 int __v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl *ctrl, s64 val)
844 {
845 	lockdep_assert_held(ctrl->handler->lock);
846 
847 	/* It's a driver bug if this happens. */
848 	if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
849 		return -EINVAL;
850 	*ctrl->p_new.p_s64 = val;
851 	return set_ctrl(NULL, ctrl, 0);
852 }
853 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_int64);
854 
__v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl * ctrl,const char * s)855 int __v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl *ctrl, const char *s)
856 {
857 	lockdep_assert_held(ctrl->handler->lock);
858 
859 	/* It's a driver bug if this happens. */
860 	if (WARN_ON(ctrl->type != V4L2_CTRL_TYPE_STRING))
861 		return -EINVAL;
862 	strscpy(ctrl->p_new.p_char, s, ctrl->maximum + 1);
863 	return set_ctrl(NULL, ctrl, 0);
864 }
865 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_string);
866 
__v4l2_ctrl_s_ctrl_compound(struct v4l2_ctrl * ctrl,enum v4l2_ctrl_type type,const void * p)867 int __v4l2_ctrl_s_ctrl_compound(struct v4l2_ctrl *ctrl,
868 				enum v4l2_ctrl_type type, const void *p)
869 {
870 	lockdep_assert_held(ctrl->handler->lock);
871 
872 	/* It's a driver bug if this happens. */
873 	if (WARN_ON(ctrl->type != type))
874 		return -EINVAL;
875 	memcpy(ctrl->p_new.p, p, ctrl->elems * ctrl->elem_size);
876 	return set_ctrl(NULL, ctrl, 0);
877 }
878 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_compound);
879 
880 /*
881  * Modify the range of a control.
882  */
__v4l2_ctrl_modify_range(struct v4l2_ctrl * ctrl,s64 min,s64 max,u64 step,s64 def)883 int __v4l2_ctrl_modify_range(struct v4l2_ctrl *ctrl,
884 			     s64 min, s64 max, u64 step, s64 def)
885 {
886 	bool value_changed;
887 	bool range_changed = false;
888 	int ret;
889 
890 	lockdep_assert_held(ctrl->handler->lock);
891 
892 	switch (ctrl->type) {
893 	case V4L2_CTRL_TYPE_INTEGER:
894 	case V4L2_CTRL_TYPE_INTEGER64:
895 	case V4L2_CTRL_TYPE_BOOLEAN:
896 	case V4L2_CTRL_TYPE_MENU:
897 	case V4L2_CTRL_TYPE_INTEGER_MENU:
898 	case V4L2_CTRL_TYPE_BITMASK:
899 	case V4L2_CTRL_TYPE_U8:
900 	case V4L2_CTRL_TYPE_U16:
901 	case V4L2_CTRL_TYPE_U32:
902 		if (ctrl->is_array)
903 			return -EINVAL;
904 		ret = check_range(ctrl->type, min, max, step, def);
905 		if (ret)
906 			return ret;
907 		break;
908 	default:
909 		return -EINVAL;
910 	}
911 	if (ctrl->minimum != min || ctrl->maximum != max ||
912 	    ctrl->step != step || ctrl->default_value != def) {
913 		range_changed = true;
914 		ctrl->minimum = min;
915 		ctrl->maximum = max;
916 		ctrl->step = step;
917 		ctrl->default_value = def;
918 	}
919 	cur_to_new(ctrl);
920 	if (validate_new(ctrl, ctrl->p_new)) {
921 		if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
922 			*ctrl->p_new.p_s64 = def;
923 		else
924 			*ctrl->p_new.p_s32 = def;
925 	}
926 
927 	if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
928 		value_changed = *ctrl->p_new.p_s64 != *ctrl->p_cur.p_s64;
929 	else
930 		value_changed = *ctrl->p_new.p_s32 != *ctrl->p_cur.p_s32;
931 	if (value_changed)
932 		ret = set_ctrl(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
933 	else if (range_changed)
934 		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
935 	return ret;
936 }
937 EXPORT_SYMBOL(__v4l2_ctrl_modify_range);
938 
939 /* Implement VIDIOC_QUERY_EXT_CTRL */
v4l2_query_ext_ctrl(struct v4l2_ctrl_handler * hdl,struct v4l2_query_ext_ctrl * qc)940 int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctrl *qc)
941 {
942 	const unsigned int next_flags = V4L2_CTRL_FLAG_NEXT_CTRL | V4L2_CTRL_FLAG_NEXT_COMPOUND;
943 	u32 id = qc->id & V4L2_CTRL_ID_MASK;
944 	struct v4l2_ctrl_ref *ref;
945 	struct v4l2_ctrl *ctrl;
946 
947 	if (!hdl)
948 		return -EINVAL;
949 
950 	mutex_lock(hdl->lock);
951 
952 	/* Try to find it */
953 	ref = find_ref(hdl, id);
954 
955 	if ((qc->id & next_flags) && !list_empty(&hdl->ctrl_refs)) {
956 		bool is_compound;
957 		/* Match any control that is not hidden */
958 		unsigned int mask = 1;
959 		bool match = false;
960 
961 		if ((qc->id & next_flags) == V4L2_CTRL_FLAG_NEXT_COMPOUND) {
962 			/* Match any hidden control */
963 			match = true;
964 		} else if ((qc->id & next_flags) == next_flags) {
965 			/* Match any control, compound or not */
966 			mask = 0;
967 		}
968 
969 		/* Find the next control with ID > qc->id */
970 
971 		/* Did we reach the end of the control list? */
972 		if (id >= node2id(hdl->ctrl_refs.prev)) {
973 			ref = NULL; /* Yes, so there is no next control */
974 		} else if (ref) {
975 			/*
976 			 * We found a control with the given ID, so just get
977 			 * the next valid one in the list.
978 			 */
979 			list_for_each_entry_continue(ref, &hdl->ctrl_refs, node) {
980 				is_compound = ref->ctrl->is_array ||
981 					ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
982 				if (id < ref->ctrl->id &&
983 				    (is_compound & mask) == match)
984 					break;
985 			}
986 			if (&ref->node == &hdl->ctrl_refs)
987 				ref = NULL;
988 		} else {
989 			/*
990 			 * No control with the given ID exists, so start
991 			 * searching for the next largest ID. We know there
992 			 * is one, otherwise the first 'if' above would have
993 			 * been true.
994 			 */
995 			list_for_each_entry(ref, &hdl->ctrl_refs, node) {
996 				is_compound = ref->ctrl->is_array ||
997 					ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
998 				if (id < ref->ctrl->id &&
999 				    (is_compound & mask) == match)
1000 					break;
1001 			}
1002 			if (&ref->node == &hdl->ctrl_refs)
1003 				ref = NULL;
1004 		}
1005 	}
1006 	mutex_unlock(hdl->lock);
1007 
1008 	if (!ref)
1009 		return -EINVAL;
1010 
1011 	ctrl = ref->ctrl;
1012 	memset(qc, 0, sizeof(*qc));
1013 	if (id >= V4L2_CID_PRIVATE_BASE)
1014 		qc->id = id;
1015 	else
1016 		qc->id = ctrl->id;
1017 	strscpy(qc->name, ctrl->name, sizeof(qc->name));
1018 	qc->flags = user_flags(ctrl);
1019 	qc->type = ctrl->type;
1020 	qc->elem_size = ctrl->elem_size;
1021 	qc->elems = ctrl->elems;
1022 	qc->nr_of_dims = ctrl->nr_of_dims;
1023 	memcpy(qc->dims, ctrl->dims, qc->nr_of_dims * sizeof(qc->dims[0]));
1024 	qc->minimum = ctrl->minimum;
1025 	qc->maximum = ctrl->maximum;
1026 	qc->default_value = ctrl->default_value;
1027 	if (ctrl->type == V4L2_CTRL_TYPE_MENU ||
1028 	    ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
1029 		qc->step = 1;
1030 	else
1031 		qc->step = ctrl->step;
1032 	return 0;
1033 }
1034 EXPORT_SYMBOL(v4l2_query_ext_ctrl);
1035 
1036 /* Implement VIDIOC_QUERYCTRL */
v4l2_queryctrl(struct v4l2_ctrl_handler * hdl,struct v4l2_queryctrl * qc)1037 int v4l2_queryctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_queryctrl *qc)
1038 {
1039 	struct v4l2_query_ext_ctrl qec = { qc->id };
1040 	int rc;
1041 
1042 	rc = v4l2_query_ext_ctrl(hdl, &qec);
1043 	if (rc)
1044 		return rc;
1045 
1046 	qc->id = qec.id;
1047 	qc->type = qec.type;
1048 	qc->flags = qec.flags;
1049 	strscpy(qc->name, qec.name, sizeof(qc->name));
1050 	switch (qc->type) {
1051 	case V4L2_CTRL_TYPE_INTEGER:
1052 	case V4L2_CTRL_TYPE_BOOLEAN:
1053 	case V4L2_CTRL_TYPE_MENU:
1054 	case V4L2_CTRL_TYPE_INTEGER_MENU:
1055 	case V4L2_CTRL_TYPE_STRING:
1056 	case V4L2_CTRL_TYPE_BITMASK:
1057 		qc->minimum = qec.minimum;
1058 		qc->maximum = qec.maximum;
1059 		qc->step = qec.step;
1060 		qc->default_value = qec.default_value;
1061 		break;
1062 	default:
1063 		qc->minimum = 0;
1064 		qc->maximum = 0;
1065 		qc->step = 0;
1066 		qc->default_value = 0;
1067 		break;
1068 	}
1069 	return 0;
1070 }
1071 EXPORT_SYMBOL(v4l2_queryctrl);
1072 
1073 /* Implement VIDIOC_QUERYMENU */
v4l2_querymenu(struct v4l2_ctrl_handler * hdl,struct v4l2_querymenu * qm)1074 int v4l2_querymenu(struct v4l2_ctrl_handler *hdl, struct v4l2_querymenu *qm)
1075 {
1076 	struct v4l2_ctrl *ctrl;
1077 	u32 i = qm->index;
1078 
1079 	ctrl = v4l2_ctrl_find(hdl, qm->id);
1080 	if (!ctrl)
1081 		return -EINVAL;
1082 
1083 	qm->reserved = 0;
1084 	/* Sanity checks */
1085 	switch (ctrl->type) {
1086 	case V4L2_CTRL_TYPE_MENU:
1087 		if (!ctrl->qmenu)
1088 			return -EINVAL;
1089 		break;
1090 	case V4L2_CTRL_TYPE_INTEGER_MENU:
1091 		if (!ctrl->qmenu_int)
1092 			return -EINVAL;
1093 		break;
1094 	default:
1095 		return -EINVAL;
1096 	}
1097 
1098 	if (i < ctrl->minimum || i > ctrl->maximum)
1099 		return -EINVAL;
1100 
1101 	/* Use mask to see if this menu item should be skipped */
1102 	if (ctrl->menu_skip_mask & (1ULL << i))
1103 		return -EINVAL;
1104 	/* Empty menu items should also be skipped */
1105 	if (ctrl->type == V4L2_CTRL_TYPE_MENU) {
1106 		if (!ctrl->qmenu[i] || ctrl->qmenu[i][0] == '\0')
1107 			return -EINVAL;
1108 		strscpy(qm->name, ctrl->qmenu[i], sizeof(qm->name));
1109 	} else {
1110 		qm->value = ctrl->qmenu_int[i];
1111 	}
1112 	return 0;
1113 }
1114 EXPORT_SYMBOL(v4l2_querymenu);
1115 
1116 /*
1117  * VIDIOC_LOG_STATUS helpers
1118  */
1119 
v4l2_ctrl_log_status(struct file * file,void * fh)1120 int v4l2_ctrl_log_status(struct file *file, void *fh)
1121 {
1122 	struct video_device *vfd = video_devdata(file);
1123 	struct v4l2_fh *vfh = file->private_data;
1124 
1125 	if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags) && vfd->v4l2_dev)
1126 		v4l2_ctrl_handler_log_status(vfh->ctrl_handler,
1127 					     vfd->v4l2_dev->name);
1128 	return 0;
1129 }
1130 EXPORT_SYMBOL(v4l2_ctrl_log_status);
1131 
v4l2_ctrl_subdev_log_status(struct v4l2_subdev * sd)1132 int v4l2_ctrl_subdev_log_status(struct v4l2_subdev *sd)
1133 {
1134 	v4l2_ctrl_handler_log_status(sd->ctrl_handler, sd->name);
1135 	return 0;
1136 }
1137 EXPORT_SYMBOL(v4l2_ctrl_subdev_log_status);
1138 
1139 /*
1140  * VIDIOC_(UN)SUBSCRIBE_EVENT implementation
1141  */
1142 
v4l2_ctrl_add_event(struct v4l2_subscribed_event * sev,unsigned int elems)1143 static int v4l2_ctrl_add_event(struct v4l2_subscribed_event *sev,
1144 			       unsigned int elems)
1145 {
1146 	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1147 
1148 	if (!ctrl)
1149 		return -EINVAL;
1150 
1151 	v4l2_ctrl_lock(ctrl);
1152 	list_add_tail(&sev->node, &ctrl->ev_subs);
1153 	if (ctrl->type != V4L2_CTRL_TYPE_CTRL_CLASS &&
1154 	    (sev->flags & V4L2_EVENT_SUB_FL_SEND_INITIAL))
1155 		send_initial_event(sev->fh, ctrl);
1156 	v4l2_ctrl_unlock(ctrl);
1157 	return 0;
1158 }
1159 
v4l2_ctrl_del_event(struct v4l2_subscribed_event * sev)1160 static void v4l2_ctrl_del_event(struct v4l2_subscribed_event *sev)
1161 {
1162 	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1163 
1164 	if (!ctrl)
1165 		return;
1166 
1167 	v4l2_ctrl_lock(ctrl);
1168 	list_del(&sev->node);
1169 	v4l2_ctrl_unlock(ctrl);
1170 }
1171 
v4l2_ctrl_replace(struct v4l2_event * old,const struct v4l2_event * new)1172 void v4l2_ctrl_replace(struct v4l2_event *old, const struct v4l2_event *new)
1173 {
1174 	u32 old_changes = old->u.ctrl.changes;
1175 
1176 	old->u.ctrl = new->u.ctrl;
1177 	old->u.ctrl.changes |= old_changes;
1178 }
1179 EXPORT_SYMBOL(v4l2_ctrl_replace);
1180 
v4l2_ctrl_merge(const struct v4l2_event * old,struct v4l2_event * new)1181 void v4l2_ctrl_merge(const struct v4l2_event *old, struct v4l2_event *new)
1182 {
1183 	new->u.ctrl.changes |= old->u.ctrl.changes;
1184 }
1185 EXPORT_SYMBOL(v4l2_ctrl_merge);
1186 
1187 const struct v4l2_subscribed_event_ops v4l2_ctrl_sub_ev_ops = {
1188 	.add = v4l2_ctrl_add_event,
1189 	.del = v4l2_ctrl_del_event,
1190 	.replace = v4l2_ctrl_replace,
1191 	.merge = v4l2_ctrl_merge,
1192 };
1193 EXPORT_SYMBOL(v4l2_ctrl_sub_ev_ops);
1194 
v4l2_ctrl_subscribe_event(struct v4l2_fh * fh,const struct v4l2_event_subscription * sub)1195 int v4l2_ctrl_subscribe_event(struct v4l2_fh *fh,
1196 			      const struct v4l2_event_subscription *sub)
1197 {
1198 	if (sub->type == V4L2_EVENT_CTRL)
1199 		return v4l2_event_subscribe(fh, sub, 0, &v4l2_ctrl_sub_ev_ops);
1200 	return -EINVAL;
1201 }
1202 EXPORT_SYMBOL(v4l2_ctrl_subscribe_event);
1203 
v4l2_ctrl_subdev_subscribe_event(struct v4l2_subdev * sd,struct v4l2_fh * fh,struct v4l2_event_subscription * sub)1204 int v4l2_ctrl_subdev_subscribe_event(struct v4l2_subdev *sd, struct v4l2_fh *fh,
1205 				     struct v4l2_event_subscription *sub)
1206 {
1207 	if (!sd->ctrl_handler)
1208 		return -EINVAL;
1209 	return v4l2_ctrl_subscribe_event(fh, sub);
1210 }
1211 EXPORT_SYMBOL(v4l2_ctrl_subdev_subscribe_event);
1212 
1213 /*
1214  * poll helper
1215  */
v4l2_ctrl_poll(struct file * file,struct poll_table_struct * wait)1216 __poll_t v4l2_ctrl_poll(struct file *file, struct poll_table_struct *wait)
1217 {
1218 	struct v4l2_fh *fh = file->private_data;
1219 
1220 	poll_wait(file, &fh->wait, wait);
1221 	if (v4l2_event_pending(fh))
1222 		return EPOLLPRI;
1223 	return 0;
1224 }
1225 EXPORT_SYMBOL(v4l2_ctrl_poll);
1226