xref: /linux/drivers/media/usb/uvc/uvc_ctrl.c (revision bba2c3615bd6cfee7456d1130f2e6b01b3f4e9ba)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *      uvc_ctrl.c  --  USB Video Class driver - Controls
4  *
5  *      Copyright (C) 2005-2010
6  *          Laurent Pinchart (laurent.pinchart@ideasonboard.com)
7  */
8 
9 #include <asm/barrier.h>
10 #include <linux/bitops.h>
11 #include <linux/kernel.h>
12 #include <linux/list.h>
13 #include <linux/module.h>
14 #include <linux/slab.h>
15 #include <linux/uaccess.h>
16 #include <linux/usb.h>
17 #include <linux/usb/uvc.h>
18 #include <linux/videodev2.h>
19 #include <linux/vmalloc.h>
20 #include <linux/wait.h>
21 #include <linux/workqueue.h>
22 #include <linux/atomic.h>
23 #include <media/v4l2-ctrls.h>
24 
25 #include "uvcvideo.h"
26 
27 #define UVC_CTRL_DATA_CURRENT	0
28 #define UVC_CTRL_DATA_BACKUP	1
29 #define UVC_CTRL_DATA_MIN	2
30 #define UVC_CTRL_DATA_MAX	3
31 #define UVC_CTRL_DATA_RES	4
32 #define UVC_CTRL_DATA_DEF	5
33 #define UVC_CTRL_DATA_LAST	6
34 
35 /* ------------------------------------------------------------------------
36  * Controls
37  */
38 
39 static const struct uvc_control_info uvc_ctrls[] = {
40 	{
41 		.entity		= UVC_GUID_UVC_PROCESSING,
42 		.selector	= UVC_PU_BRIGHTNESS_CONTROL,
43 		.index		= 0,
44 		.size		= 2,
45 		.flags		= UVC_CTRL_FLAG_SET_CUR
46 				| UVC_CTRL_FLAG_GET_RANGE
47 				| UVC_CTRL_FLAG_RESTORE,
48 	},
49 	{
50 		.entity		= UVC_GUID_UVC_PROCESSING,
51 		.selector	= UVC_PU_CONTRAST_CONTROL,
52 		.index		= 1,
53 		.size		= 2,
54 		.flags		= UVC_CTRL_FLAG_SET_CUR
55 				| UVC_CTRL_FLAG_GET_RANGE
56 				| UVC_CTRL_FLAG_RESTORE,
57 	},
58 	{
59 		.entity		= UVC_GUID_UVC_PROCESSING,
60 		.selector	= UVC_PU_HUE_CONTROL,
61 		.index		= 2,
62 		.size		= 2,
63 		.flags		= UVC_CTRL_FLAG_SET_CUR
64 				| UVC_CTRL_FLAG_GET_RANGE
65 				| UVC_CTRL_FLAG_RESTORE
66 				| UVC_CTRL_FLAG_AUTO_UPDATE,
67 	},
68 	{
69 		.entity		= UVC_GUID_UVC_PROCESSING,
70 		.selector	= UVC_PU_SATURATION_CONTROL,
71 		.index		= 3,
72 		.size		= 2,
73 		.flags		= UVC_CTRL_FLAG_SET_CUR
74 				| UVC_CTRL_FLAG_GET_RANGE
75 				| UVC_CTRL_FLAG_RESTORE,
76 	},
77 	{
78 		.entity		= UVC_GUID_UVC_PROCESSING,
79 		.selector	= UVC_PU_SHARPNESS_CONTROL,
80 		.index		= 4,
81 		.size		= 2,
82 		.flags		= UVC_CTRL_FLAG_SET_CUR
83 				| UVC_CTRL_FLAG_GET_RANGE
84 				| UVC_CTRL_FLAG_RESTORE,
85 	},
86 	{
87 		.entity		= UVC_GUID_UVC_PROCESSING,
88 		.selector	= UVC_PU_GAMMA_CONTROL,
89 		.index		= 5,
90 		.size		= 2,
91 		.flags		= UVC_CTRL_FLAG_SET_CUR
92 				| UVC_CTRL_FLAG_GET_RANGE
93 				| UVC_CTRL_FLAG_RESTORE,
94 	},
95 	{
96 		.entity		= UVC_GUID_UVC_PROCESSING,
97 		.selector	= UVC_PU_WHITE_BALANCE_TEMPERATURE_CONTROL,
98 		.index		= 6,
99 		.size		= 2,
100 		.flags		= UVC_CTRL_FLAG_SET_CUR
101 				| UVC_CTRL_FLAG_GET_RANGE
102 				| UVC_CTRL_FLAG_RESTORE
103 				| UVC_CTRL_FLAG_AUTO_UPDATE,
104 	},
105 	{
106 		.entity		= UVC_GUID_UVC_PROCESSING,
107 		.selector	= UVC_PU_WHITE_BALANCE_COMPONENT_CONTROL,
108 		.index		= 7,
109 		.size		= 4,
110 		.flags		= UVC_CTRL_FLAG_SET_CUR
111 				| UVC_CTRL_FLAG_GET_RANGE
112 				| UVC_CTRL_FLAG_RESTORE
113 				| UVC_CTRL_FLAG_AUTO_UPDATE,
114 	},
115 	{
116 		.entity		= UVC_GUID_UVC_PROCESSING,
117 		.selector	= UVC_PU_BACKLIGHT_COMPENSATION_CONTROL,
118 		.index		= 8,
119 		.size		= 2,
120 		.flags		= UVC_CTRL_FLAG_SET_CUR
121 				| UVC_CTRL_FLAG_GET_RANGE
122 				| UVC_CTRL_FLAG_RESTORE,
123 	},
124 	{
125 		.entity		= UVC_GUID_UVC_PROCESSING,
126 		.selector	= UVC_PU_GAIN_CONTROL,
127 		.index		= 9,
128 		.size		= 2,
129 		.flags		= UVC_CTRL_FLAG_SET_CUR
130 				| UVC_CTRL_FLAG_GET_RANGE
131 				| UVC_CTRL_FLAG_RESTORE,
132 	},
133 	{
134 		.entity		= UVC_GUID_UVC_PROCESSING,
135 		.selector	= UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
136 		.index		= 10,
137 		.size		= 1,
138 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
139 				| UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_RESTORE,
140 	},
141 	{
142 		.entity		= UVC_GUID_UVC_PROCESSING,
143 		.selector	= UVC_PU_HUE_AUTO_CONTROL,
144 		.index		= 11,
145 		.size		= 1,
146 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
147 				| UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_RESTORE,
148 	},
149 	{
150 		.entity		= UVC_GUID_UVC_PROCESSING,
151 		.selector	= UVC_PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL,
152 		.index		= 12,
153 		.size		= 1,
154 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
155 				| UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_RESTORE,
156 	},
157 	{
158 		.entity		= UVC_GUID_UVC_PROCESSING,
159 		.selector	= UVC_PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL,
160 		.index		= 13,
161 		.size		= 1,
162 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
163 				| UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_RESTORE,
164 	},
165 	{
166 		.entity		= UVC_GUID_UVC_PROCESSING,
167 		.selector	= UVC_PU_DIGITAL_MULTIPLIER_CONTROL,
168 		.index		= 14,
169 		.size		= 2,
170 		.flags		= UVC_CTRL_FLAG_SET_CUR
171 				| UVC_CTRL_FLAG_GET_RANGE
172 				| UVC_CTRL_FLAG_RESTORE,
173 	},
174 	{
175 		.entity		= UVC_GUID_UVC_PROCESSING,
176 		.selector	= UVC_PU_DIGITAL_MULTIPLIER_LIMIT_CONTROL,
177 		.index		= 15,
178 		.size		= 2,
179 		.flags		= UVC_CTRL_FLAG_SET_CUR
180 				| UVC_CTRL_FLAG_GET_RANGE
181 				| UVC_CTRL_FLAG_RESTORE,
182 	},
183 	{
184 		.entity		= UVC_GUID_UVC_PROCESSING,
185 		.selector	= UVC_PU_ANALOG_VIDEO_STANDARD_CONTROL,
186 		.index		= 16,
187 		.size		= 1,
188 		.flags		= UVC_CTRL_FLAG_GET_CUR,
189 	},
190 	{
191 		.entity		= UVC_GUID_UVC_PROCESSING,
192 		.selector	= UVC_PU_ANALOG_LOCK_STATUS_CONTROL,
193 		.index		= 17,
194 		.size		= 1,
195 		.flags		= UVC_CTRL_FLAG_GET_CUR,
196 	},
197 	{
198 		.entity		= UVC_GUID_UVC_CAMERA,
199 		.selector	= UVC_CT_SCANNING_MODE_CONTROL,
200 		.index		= 0,
201 		.size		= 1,
202 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
203 				| UVC_CTRL_FLAG_RESTORE,
204 	},
205 	{
206 		.entity		= UVC_GUID_UVC_CAMERA,
207 		.selector	= UVC_CT_AE_MODE_CONTROL,
208 		.index		= 1,
209 		.size		= 1,
210 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
211 				| UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_GET_RES
212 				| UVC_CTRL_FLAG_RESTORE,
213 	},
214 	{
215 		.entity		= UVC_GUID_UVC_CAMERA,
216 		.selector	= UVC_CT_AE_PRIORITY_CONTROL,
217 		.index		= 2,
218 		.size		= 1,
219 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
220 				| UVC_CTRL_FLAG_RESTORE,
221 	},
222 	{
223 		.entity		= UVC_GUID_UVC_CAMERA,
224 		.selector	= UVC_CT_EXPOSURE_TIME_ABSOLUTE_CONTROL,
225 		.index		= 3,
226 		.size		= 4,
227 		.flags		= UVC_CTRL_FLAG_SET_CUR
228 				| UVC_CTRL_FLAG_GET_RANGE
229 				| UVC_CTRL_FLAG_RESTORE
230 				| UVC_CTRL_FLAG_AUTO_UPDATE,
231 	},
232 	{
233 		.entity		= UVC_GUID_UVC_CAMERA,
234 		.selector	= UVC_CT_EXPOSURE_TIME_RELATIVE_CONTROL,
235 		.index		= 4,
236 		.size		= 1,
237 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_RESTORE,
238 	},
239 	{
240 		.entity		= UVC_GUID_UVC_CAMERA,
241 		.selector	= UVC_CT_FOCUS_ABSOLUTE_CONTROL,
242 		.index		= 5,
243 		.size		= 2,
244 		.flags		= UVC_CTRL_FLAG_SET_CUR
245 				| UVC_CTRL_FLAG_GET_RANGE
246 				| UVC_CTRL_FLAG_RESTORE
247 				| UVC_CTRL_FLAG_AUTO_UPDATE,
248 	},
249 	{
250 		.entity		= UVC_GUID_UVC_CAMERA,
251 		.selector	= UVC_CT_FOCUS_RELATIVE_CONTROL,
252 		.index		= 6,
253 		.size		= 2,
254 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_MIN
255 				| UVC_CTRL_FLAG_GET_MAX | UVC_CTRL_FLAG_GET_RES
256 				| UVC_CTRL_FLAG_GET_DEF
257 				| UVC_CTRL_FLAG_AUTO_UPDATE,
258 	},
259 	{
260 		.entity		= UVC_GUID_UVC_CAMERA,
261 		.selector	= UVC_CT_IRIS_ABSOLUTE_CONTROL,
262 		.index		= 7,
263 		.size		= 2,
264 		.flags		= UVC_CTRL_FLAG_SET_CUR
265 				| UVC_CTRL_FLAG_GET_RANGE
266 				| UVC_CTRL_FLAG_RESTORE
267 				| UVC_CTRL_FLAG_AUTO_UPDATE,
268 	},
269 	{
270 		.entity		= UVC_GUID_UVC_CAMERA,
271 		.selector	= UVC_CT_IRIS_RELATIVE_CONTROL,
272 		.index		= 8,
273 		.size		= 1,
274 		.flags		= UVC_CTRL_FLAG_SET_CUR
275 				| UVC_CTRL_FLAG_AUTO_UPDATE,
276 	},
277 	{
278 		.entity		= UVC_GUID_UVC_CAMERA,
279 		.selector	= UVC_CT_ZOOM_ABSOLUTE_CONTROL,
280 		.index		= 9,
281 		.size		= 2,
282 		.flags		= UVC_CTRL_FLAG_SET_CUR
283 				| UVC_CTRL_FLAG_GET_RANGE
284 				| UVC_CTRL_FLAG_RESTORE
285 				| UVC_CTRL_FLAG_AUTO_UPDATE,
286 	},
287 	{
288 		.entity		= UVC_GUID_UVC_CAMERA,
289 		.selector	= UVC_CT_ZOOM_RELATIVE_CONTROL,
290 		.index		= 10,
291 		.size		= 3,
292 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_MIN
293 				| UVC_CTRL_FLAG_GET_MAX | UVC_CTRL_FLAG_GET_RES
294 				| UVC_CTRL_FLAG_GET_DEF
295 				| UVC_CTRL_FLAG_AUTO_UPDATE,
296 	},
297 	{
298 		.entity		= UVC_GUID_UVC_CAMERA,
299 		.selector	= UVC_CT_PANTILT_ABSOLUTE_CONTROL,
300 		.index		= 11,
301 		.size		= 8,
302 		.flags		= UVC_CTRL_FLAG_SET_CUR
303 				| UVC_CTRL_FLAG_GET_RANGE
304 				| UVC_CTRL_FLAG_RESTORE
305 				| UVC_CTRL_FLAG_AUTO_UPDATE,
306 	},
307 	{
308 		.entity		= UVC_GUID_UVC_CAMERA,
309 		.selector	= UVC_CT_PANTILT_RELATIVE_CONTROL,
310 		.index		= 12,
311 		.size		= 4,
312 		.flags		= UVC_CTRL_FLAG_SET_CUR
313 				| UVC_CTRL_FLAG_GET_RANGE
314 				| UVC_CTRL_FLAG_AUTO_UPDATE,
315 	},
316 	{
317 		.entity		= UVC_GUID_UVC_CAMERA,
318 		.selector	= UVC_CT_ROLL_ABSOLUTE_CONTROL,
319 		.index		= 13,
320 		.size		= 2,
321 		.flags		= UVC_CTRL_FLAG_SET_CUR
322 				| UVC_CTRL_FLAG_GET_RANGE
323 				| UVC_CTRL_FLAG_RESTORE
324 				| UVC_CTRL_FLAG_AUTO_UPDATE,
325 	},
326 	{
327 		.entity		= UVC_GUID_UVC_CAMERA,
328 		.selector	= UVC_CT_ROLL_RELATIVE_CONTROL,
329 		.index		= 14,
330 		.size		= 2,
331 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_MIN
332 				| UVC_CTRL_FLAG_GET_MAX | UVC_CTRL_FLAG_GET_RES
333 				| UVC_CTRL_FLAG_GET_DEF
334 				| UVC_CTRL_FLAG_AUTO_UPDATE,
335 	},
336 	{
337 		.entity		= UVC_GUID_UVC_CAMERA,
338 		.selector	= UVC_CT_FOCUS_AUTO_CONTROL,
339 		.index		= 17,
340 		.size		= 1,
341 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
342 				| UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_RESTORE,
343 	},
344 	{
345 		.entity		= UVC_GUID_UVC_CAMERA,
346 		.selector	= UVC_CT_PRIVACY_CONTROL,
347 		.index		= 18,
348 		.size		= 1,
349 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
350 				| UVC_CTRL_FLAG_RESTORE
351 				| UVC_CTRL_FLAG_AUTO_UPDATE,
352 	},
353 	{
354 		.entity		= UVC_GUID_EXT_GPIO_CONTROLLER,
355 		.selector	= UVC_CT_PRIVACY_CONTROL,
356 		.index		= 0,
357 		.size		= 1,
358 		.flags		= UVC_CTRL_FLAG_GET_CUR
359 				| UVC_CTRL_FLAG_AUTO_UPDATE,
360 	},
361 	/*
362 	 * UVC_CTRL_FLAG_AUTO_UPDATE is needed because the RoI may get updated
363 	 * by sensors.
364 	 * "This RoI should be the same as specified in most recent SET_CUR
365 	 * except in the case where the ‘Auto Detect and Track’ and/or
366 	 * ‘Image Stabilization’ bit have been set."
367 	 * 4.2.2.1.20 Digital Region of Interest (ROI) Control
368 	 */
369 	{
370 		.entity		= UVC_GUID_UVC_CAMERA,
371 		.selector	= UVC_CT_REGION_OF_INTEREST_CONTROL,
372 		.index		= 21,
373 		.size		= 10,
374 		.flags		= UVC_CTRL_FLAG_SET_CUR | UVC_CTRL_FLAG_GET_CUR
375 				| UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX
376 				| UVC_CTRL_FLAG_GET_DEF
377 				| UVC_CTRL_FLAG_AUTO_UPDATE,
378 	},
379 	{
380 		.entity		= UVC_GUID_CHROMEOS_XU,
381 		.selector	= UVC_CROSXU_CONTROL_IQ_PROFILE,
382 		.index		= 3,
383 		.size		= 1,
384 		.flags		= UVC_CTRL_FLAG_SET_CUR
385 				| UVC_CTRL_FLAG_GET_RANGE
386 				| UVC_CTRL_FLAG_RESTORE,
387 	},
388 	/*
389 	 * Allows the control of pan/tilt motor movements for camera models
390 	 * that support mechanical pan/tilt.
391 	 *
392 	 * Bits 0 to 15 control pan, bits 16 to 31 control tilt.
393 	 * The unit of the pan/tilt values is 1/64th of a degree and the
394 	 * resolution is 1 degree.
395 	 */
396 	{
397 		.entity         = UVC_GUID_LOGITECH_MOTOR_CONTROL_V1,
398 		.selector       = 1,
399 		.index          = 0,
400 		.size           = 4,
401 		.flags          = UVC_CTRL_FLAG_GET_DEF
402 				| UVC_CTRL_FLAG_GET_MAX
403 				| UVC_CTRL_FLAG_GET_MIN
404 				| UVC_CTRL_FLAG_SET_CUR,
405 	},
406 	/*
407 	 * Reset the pan/tilt motors to their original position for camera
408 	 * models that support mechanical pan/tilt.
409 	 *
410 	 * Setting bit 0 resets the pan position.
411 	 * Setting bit 1 resets the tilt position.
412 	 *
413 	 * Both bits can be set at the same time to reset both, pan and tilt,
414 	 * at the same time.
415 	 */
416 	{
417 		.entity         = UVC_GUID_LOGITECH_MOTOR_CONTROL_V1,
418 		.selector       = 2,
419 		.index          = 1,
420 		.size           = 1,
421 		.flags          = UVC_CTRL_FLAG_GET_DEF
422 				| UVC_CTRL_FLAG_GET_MAX
423 				| UVC_CTRL_FLAG_GET_MIN
424 				| UVC_CTRL_FLAG_SET_CUR,
425 	},
426 	/*
427 	 * Allows the control of focus motor movements for camera models that
428 	 * support mechanical focus.
429 	 *
430 	 * Bits 0 to 7 allow selection of the desired lens position.
431 	 * There are no physical units, instead, the focus range is spread over
432 	 * 256 logical units with 0 representing infinity focus and 255 being
433 	 * macro focus.
434 	 */
435 	{
436 		.entity         = UVC_GUID_LOGITECH_MOTOR_CONTROL_V1,
437 		.selector       = 3,
438 		.index          = 2,
439 		.size           = 6,
440 		.flags          = UVC_CTRL_FLAG_GET_CUR
441 				| UVC_CTRL_FLAG_GET_DEF
442 				| UVC_CTRL_FLAG_GET_MAX
443 				| UVC_CTRL_FLAG_GET_MIN
444 				| UVC_CTRL_FLAG_SET_CUR,
445 	},
446 	/*
447 	 * Allows the control of pan/tilt motor movements for camera models
448 	 * that support mechanical pan/tilt.
449 	 *
450 	 * Bits 0 to 15 control pan, bits 16 to 31 control tilt.
451 	 */
452 	{
453 		.entity         = UVC_GUID_LOGITECH_PERIPHERAL,
454 		.selector       = 1,
455 		.index          = 0,
456 		.size           = 4,
457 		.flags          = UVC_CTRL_FLAG_GET_DEF
458 				| UVC_CTRL_FLAG_GET_MAX
459 				| UVC_CTRL_FLAG_GET_MIN
460 				| UVC_CTRL_FLAG_GET_RES
461 				| UVC_CTRL_FLAG_SET_CUR,
462 	},
463 	/*
464 	 * Reset the pan/tilt motors to their original position for camera
465 	 * models that support mechanical pan/tilt.
466 	 *
467 	 * Setting bit 0 resets the pan position.
468 	 * Setting bit 1 resets the tilt position.
469 	 */
470 	{
471 		.entity         = UVC_GUID_LOGITECH_PERIPHERAL,
472 		.selector       = 2,
473 		.index          = 1,
474 		.size           = 1,
475 		.flags          = UVC_CTRL_FLAG_GET_DEF
476 				| UVC_CTRL_FLAG_GET_MAX
477 				| UVC_CTRL_FLAG_GET_MIN
478 				| UVC_CTRL_FLAG_GET_RES
479 				| UVC_CTRL_FLAG_SET_CUR,
480 	},
481 };
482 
483 static const u32 uvc_control_classes[] = {
484 	V4L2_CID_CAMERA_CLASS,
485 	V4L2_CID_USER_CLASS,
486 };
487 
488 static const int exposure_auto_mapping[] = { 2, 1, 4, 8 };
489 static const int cros_colorfx_mapping[] = {
490 	1,	/* V4L2_COLORFX_NONE */
491 	-1,	/* V4L2_COLORFX_BW */
492 	-1,	/* V4L2_COLORFX_SEPIA */
493 	-1,	/* V4L2_COLORFX_NEGATIVE */
494 	-1,	/* V4L2_COLORFX_EMBOSS */
495 	-1,	/* V4L2_COLORFX_SKETCH */
496 	-1,	/* V4L2_COLORFX_SKY_BLUE */
497 	-1,	/* V4L2_COLORFX_GRASS_GREEN */
498 	-1,	/* V4L2_COLORFX_SKIN_WHITEN */
499 	0,	/* V4L2_COLORFX_VIVID */
500 };
501 
502 
503 static bool uvc_ctrl_mapping_is_compound(struct uvc_control_mapping *mapping)
504 {
505 	return mapping->v4l2_type >= V4L2_CTRL_COMPOUND_TYPES;
506 }
507 
508 static s32 uvc_mapping_get_s32(struct uvc_control_mapping *mapping,
509 			       u8 query, const void *data_in)
510 {
511 	s32 data_out = 0;
512 
513 	mapping->get(mapping, query, data_in, sizeof(data_out), &data_out);
514 
515 	return data_out;
516 }
517 
518 static void uvc_mapping_set_s32(struct uvc_control_mapping *mapping,
519 				s32 data_in, void *data_out)
520 {
521 	mapping->set(mapping, sizeof(data_in), &data_in, data_out);
522 }
523 
524 /*
525  * This function translates the V4L2 menu index @idx, as exposed to userspace as
526  * the V4L2 control value, to the corresponding UVC control value used by the
527  * device. The custom menu_mapping in the control @mapping is used when
528  * available, otherwise the function assumes that the V4L2 and UVC values are
529  * identical.
530  *
531  * For controls of type UVC_CTRL_DATA_TYPE_BITMASK, the UVC control value is
532  * expressed as a bitmask and is thus guaranteed to have a single bit set.
533  *
534  * The function returns -EINVAL if the V4L2 menu index @idx isn't valid for the
535  * control, which includes all controls whose type isn't UVC_CTRL_DATA_TYPE_ENUM
536  * or UVC_CTRL_DATA_TYPE_BITMASK.
537  */
538 static int uvc_mapping_get_menu_value(const struct uvc_control_mapping *mapping,
539 				      u32 idx)
540 {
541 	if (!test_bit(idx, &mapping->menu_mask))
542 		return -EINVAL;
543 
544 	if (mapping->menu_mapping)
545 		return mapping->menu_mapping[idx];
546 
547 	return idx;
548 }
549 
550 static const char *
551 uvc_mapping_get_menu_name(const struct uvc_control_mapping *mapping, u32 idx)
552 {
553 	if (!test_bit(idx, &mapping->menu_mask))
554 		return NULL;
555 
556 	if (mapping->menu_names)
557 		return mapping->menu_names[idx];
558 
559 	return v4l2_ctrl_get_menu(mapping->id)[idx];
560 }
561 
562 static int uvc_ctrl_get_zoom(struct uvc_control_mapping *mapping, u8 query,
563 			     const void *uvc_in, size_t v4l2_size,
564 			     void *v4l2_out)
565 {
566 	u8 value = ((u8 *)uvc_in)[2];
567 	s8 sign = ((s8 *)uvc_in)[0];
568 	s32 *out = v4l2_out;
569 
570 	if (WARN_ON(v4l2_size != sizeof(s32)))
571 		return -EINVAL;
572 
573 	switch (query) {
574 	case UVC_GET_CUR:
575 		*out = (sign == 0) ? 0 : (sign > 0 ? value : -value);
576 		return 0;
577 
578 	case UVC_GET_MIN:
579 		/* Not used, we use -UVC_GET_MAX */
580 	case UVC_GET_MAX:
581 	case UVC_GET_RES:
582 	case UVC_GET_DEF:
583 	default:
584 		*out = value;
585 		return 0;
586 	}
587 }
588 
589 static int uvc_ctrl_set_zoom(struct uvc_control_mapping *mapping,
590 			     size_t v4l2_size, const void *v4l2_in,
591 			     void *uvc_out)
592 {
593 	u8 *out = uvc_out;
594 	s32 value;
595 
596 	if (WARN_ON(v4l2_size != sizeof(s32)))
597 		return -EINVAL;
598 
599 	value = *(u32 *)v4l2_in;
600 	out[0] = value == 0 ? 0 : (value > 0) ? 1 : 0xff;
601 	out[2] = min_t(int, abs(value), 0xff);
602 
603 	return 0;
604 }
605 
606 static int uvc_ctrl_get_rel_speed(struct uvc_control_mapping *mapping,
607 				  u8 query, const void *uvc_in,
608 				  size_t v4l2_size, void *v4l2_out)
609 {
610 	unsigned int first = mapping->offset / 8;
611 	u8 value = ((u8 *)uvc_in)[first + 1];
612 	s8 sign = ((s8 *)uvc_in)[first];
613 	s32 *out = v4l2_out;
614 
615 	if (WARN_ON(v4l2_size != sizeof(s32)))
616 		return -EINVAL;
617 
618 	switch (query) {
619 	case UVC_GET_CUR:
620 		*out = (sign == 0) ? 0 : (sign > 0 ? value : -value);
621 		return 0;
622 	case UVC_GET_MIN:
623 		/* Not used, we use -UVC_GET_MAX */
624 	case UVC_GET_MAX:
625 	case UVC_GET_RES:
626 	case UVC_GET_DEF:
627 	default:
628 		*out = value;
629 		return 0;
630 	}
631 }
632 
633 static int uvc_ctrl_set_rel_speed(struct uvc_control_mapping *mapping,
634 				  size_t v4l2_size, const void *v4l2_in,
635 				  void *uvc_out)
636 {
637 	unsigned int first = mapping->offset / 8;
638 	u8 *out = uvc_out;
639 	s32 value;
640 
641 	if (WARN_ON(v4l2_size != sizeof(s32)))
642 		return -EINVAL;
643 
644 	value = *(u32 *)v4l2_in;
645 	out[first] = value == 0 ? 0 : (value > 0) ? 1 : 0xff;
646 	out[first + 1] = min_t(int, abs(value), 0xff);
647 
648 	return 0;
649 }
650 
651 static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = {
652 	.id		= V4L2_CID_POWER_LINE_FREQUENCY,
653 	.entity		= UVC_GUID_UVC_PROCESSING,
654 	.selector	= UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
655 	.size		= 2,
656 	.offset		= 0,
657 	.v4l2_type	= V4L2_CTRL_TYPE_MENU,
658 	.data_type	= UVC_CTRL_DATA_TYPE_ENUM,
659 	.menu_mask	= GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ,
660 				  V4L2_CID_POWER_LINE_FREQUENCY_50HZ),
661 };
662 
663 static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc11 = {
664 	.id		= V4L2_CID_POWER_LINE_FREQUENCY,
665 	.entity		= UVC_GUID_UVC_PROCESSING,
666 	.selector	= UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
667 	.size		= 2,
668 	.offset		= 0,
669 	.v4l2_type	= V4L2_CTRL_TYPE_MENU,
670 	.data_type	= UVC_CTRL_DATA_TYPE_ENUM,
671 	.menu_mask	= GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ,
672 				  V4L2_CID_POWER_LINE_FREQUENCY_DISABLED),
673 };
674 
675 static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc15 = {
676 	.id		= V4L2_CID_POWER_LINE_FREQUENCY,
677 	.entity		= UVC_GUID_UVC_PROCESSING,
678 	.selector	= UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
679 	.size		= 2,
680 	.offset		= 0,
681 	.v4l2_type	= V4L2_CTRL_TYPE_MENU,
682 	.data_type	= UVC_CTRL_DATA_TYPE_ENUM,
683 	.menu_mask	= GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO,
684 				  V4L2_CID_POWER_LINE_FREQUENCY_DISABLED),
685 };
686 
687 static const struct uvc_control_mapping *uvc_ctrl_filter_plf_mapping(
688 	struct uvc_video_chain *chain, struct uvc_control *ctrl)
689 {
690 	const struct uvc_control_mapping *out_mapping =
691 					&uvc_ctrl_power_line_mapping_uvc11;
692 	u8 *buf __free(kfree) = NULL;
693 	u8 init_val;
694 	int ret;
695 
696 	buf = kmalloc_obj(*buf);
697 	if (!buf)
698 		return NULL;
699 
700 	/* Save the current PLF value, so we can restore it. */
701 	ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, ctrl->entity->id,
702 			     chain->dev->intfnum, ctrl->info.selector,
703 			     buf, sizeof(*buf));
704 	/* If we cannot read the control skip it. */
705 	if (ret)
706 		return NULL;
707 	init_val = *buf;
708 
709 	/* If PLF value cannot be set to off, it is limited. */
710 	*buf = V4L2_CID_POWER_LINE_FREQUENCY_DISABLED;
711 	ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, ctrl->entity->id,
712 			     chain->dev->intfnum, ctrl->info.selector,
713 			     buf, sizeof(*buf));
714 	if (ret)
715 		return &uvc_ctrl_power_line_mapping_limited;
716 
717 	/* UVC 1.1 does not define auto, we can exit. */
718 	if (chain->dev->uvc_version < 0x150)
719 		goto end;
720 
721 	/* Check if the device supports auto. */
722 	*buf = V4L2_CID_POWER_LINE_FREQUENCY_AUTO;
723 	ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, ctrl->entity->id,
724 			     chain->dev->intfnum, ctrl->info.selector,
725 			     buf, sizeof(*buf));
726 	if (!ret)
727 		out_mapping = &uvc_ctrl_power_line_mapping_uvc15;
728 
729 end:
730 	/* Restore initial value and add mapping. */
731 	*buf = init_val;
732 	uvc_query_ctrl(chain->dev, UVC_SET_CUR, ctrl->entity->id,
733 		       chain->dev->intfnum, ctrl->info.selector,
734 		       buf, sizeof(*buf));
735 
736 	return out_mapping;
737 }
738 
739 static int uvc_get_rect(struct uvc_control_mapping *mapping, u8 query,
740 			const void *uvc_in, size_t v4l2_size, void *v4l2_out)
741 {
742 	const struct uvc_rect *uvc_rect = uvc_in;
743 	struct v4l2_rect *v4l2_rect = v4l2_out;
744 
745 	if (WARN_ON(v4l2_size != sizeof(struct v4l2_rect)))
746 		return -EINVAL;
747 
748 	if (uvc_rect->left > uvc_rect->right ||
749 	    uvc_rect->top > uvc_rect->bottom)
750 		return -EIO;
751 
752 	v4l2_rect->top = uvc_rect->top;
753 	v4l2_rect->left = uvc_rect->left;
754 	v4l2_rect->height = uvc_rect->bottom - uvc_rect->top + 1;
755 	v4l2_rect->width = uvc_rect->right - uvc_rect->left + 1;
756 
757 	return 0;
758 }
759 
760 static int uvc_set_rect(struct uvc_control_mapping *mapping, size_t v4l2_size,
761 			const void *v4l2_in, void *uvc_out)
762 {
763 	struct uvc_rect *uvc_rect = uvc_out;
764 	const struct v4l2_rect *v4l2_rect = v4l2_in;
765 
766 	if (WARN_ON(v4l2_size != sizeof(struct v4l2_rect)))
767 		return -EINVAL;
768 
769 	uvc_rect->top = min(0xffff, v4l2_rect->top);
770 	uvc_rect->left = min(0xffff, v4l2_rect->left);
771 	uvc_rect->bottom = min(0xffff, v4l2_rect->top + v4l2_rect->height - 1);
772 	uvc_rect->right = min(0xffff, v4l2_rect->left + v4l2_rect->width - 1);
773 
774 	return 0;
775 }
776 
777 static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
778 	{
779 		.id		= V4L2_CID_BRIGHTNESS,
780 		.entity		= UVC_GUID_UVC_PROCESSING,
781 		.selector	= UVC_PU_BRIGHTNESS_CONTROL,
782 		.size		= 16,
783 		.offset		= 0,
784 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
785 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
786 	},
787 	{
788 		.id		= V4L2_CID_CONTRAST,
789 		.entity		= UVC_GUID_UVC_PROCESSING,
790 		.selector	= UVC_PU_CONTRAST_CONTROL,
791 		.size		= 16,
792 		.offset		= 0,
793 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
794 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
795 	},
796 	{
797 		.id		= V4L2_CID_HUE,
798 		.entity		= UVC_GUID_UVC_PROCESSING,
799 		.selector	= UVC_PU_HUE_CONTROL,
800 		.size		= 16,
801 		.offset		= 0,
802 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
803 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
804 		.master_id	= V4L2_CID_HUE_AUTO,
805 		.master_manual	= 0,
806 	},
807 	{
808 		.id		= V4L2_CID_SATURATION,
809 		.entity		= UVC_GUID_UVC_PROCESSING,
810 		.selector	= UVC_PU_SATURATION_CONTROL,
811 		.size		= 16,
812 		.offset		= 0,
813 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
814 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
815 	},
816 	{
817 		.id		= V4L2_CID_SHARPNESS,
818 		.entity		= UVC_GUID_UVC_PROCESSING,
819 		.selector	= UVC_PU_SHARPNESS_CONTROL,
820 		.size		= 16,
821 		.offset		= 0,
822 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
823 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
824 	},
825 	{
826 		.id		= V4L2_CID_GAMMA,
827 		.entity		= UVC_GUID_UVC_PROCESSING,
828 		.selector	= UVC_PU_GAMMA_CONTROL,
829 		.size		= 16,
830 		.offset		= 0,
831 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
832 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
833 	},
834 	{
835 		.id		= V4L2_CID_BACKLIGHT_COMPENSATION,
836 		.entity		= UVC_GUID_UVC_PROCESSING,
837 		.selector	= UVC_PU_BACKLIGHT_COMPENSATION_CONTROL,
838 		.size		= 16,
839 		.offset		= 0,
840 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
841 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
842 	},
843 	{
844 		.id		= V4L2_CID_GAIN,
845 		.entity		= UVC_GUID_UVC_PROCESSING,
846 		.selector	= UVC_PU_GAIN_CONTROL,
847 		.size		= 16,
848 		.offset		= 0,
849 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
850 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
851 	},
852 	{
853 		.id		= V4L2_CID_HUE_AUTO,
854 		.entity		= UVC_GUID_UVC_PROCESSING,
855 		.selector	= UVC_PU_HUE_AUTO_CONTROL,
856 		.size		= 1,
857 		.offset		= 0,
858 		.v4l2_type	= V4L2_CTRL_TYPE_BOOLEAN,
859 		.data_type	= UVC_CTRL_DATA_TYPE_BOOLEAN,
860 		.slave_ids	= { V4L2_CID_HUE, },
861 	},
862 	{
863 		.id		= V4L2_CID_EXPOSURE_AUTO,
864 		.entity		= UVC_GUID_UVC_CAMERA,
865 		.selector	= UVC_CT_AE_MODE_CONTROL,
866 		.size		= 4,
867 		.offset		= 0,
868 		.v4l2_type	= V4L2_CTRL_TYPE_MENU,
869 		.data_type	= UVC_CTRL_DATA_TYPE_BITMASK,
870 		.menu_mapping	= exposure_auto_mapping,
871 		.menu_mask	= GENMASK(V4L2_EXPOSURE_APERTURE_PRIORITY,
872 					  V4L2_EXPOSURE_AUTO),
873 		.slave_ids	= { V4L2_CID_EXPOSURE_ABSOLUTE, },
874 	},
875 	{
876 		.id		= V4L2_CID_EXPOSURE_AUTO_PRIORITY,
877 		.entity		= UVC_GUID_UVC_CAMERA,
878 		.selector	= UVC_CT_AE_PRIORITY_CONTROL,
879 		.size		= 1,
880 		.offset		= 0,
881 		.v4l2_type	= V4L2_CTRL_TYPE_BOOLEAN,
882 		.data_type	= UVC_CTRL_DATA_TYPE_BOOLEAN,
883 	},
884 	{
885 		.id		= V4L2_CID_EXPOSURE_ABSOLUTE,
886 		.entity		= UVC_GUID_UVC_CAMERA,
887 		.selector	= UVC_CT_EXPOSURE_TIME_ABSOLUTE_CONTROL,
888 		.size		= 32,
889 		.offset		= 0,
890 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
891 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
892 		.master_id	= V4L2_CID_EXPOSURE_AUTO,
893 		.master_manual	= V4L2_EXPOSURE_MANUAL,
894 	},
895 	{
896 		.id		= V4L2_CID_AUTO_WHITE_BALANCE,
897 		.entity		= UVC_GUID_UVC_PROCESSING,
898 		.selector	= UVC_PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL,
899 		.size		= 1,
900 		.offset		= 0,
901 		.v4l2_type	= V4L2_CTRL_TYPE_BOOLEAN,
902 		.data_type	= UVC_CTRL_DATA_TYPE_BOOLEAN,
903 		.slave_ids	= { V4L2_CID_WHITE_BALANCE_TEMPERATURE, },
904 	},
905 	{
906 		.id		= V4L2_CID_WHITE_BALANCE_TEMPERATURE,
907 		.entity		= UVC_GUID_UVC_PROCESSING,
908 		.selector	= UVC_PU_WHITE_BALANCE_TEMPERATURE_CONTROL,
909 		.size		= 16,
910 		.offset		= 0,
911 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
912 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
913 		.master_id	= V4L2_CID_AUTO_WHITE_BALANCE,
914 		.master_manual	= 0,
915 	},
916 	{
917 		.id		= V4L2_CID_AUTO_WHITE_BALANCE,
918 		.entity		= UVC_GUID_UVC_PROCESSING,
919 		.selector	= UVC_PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL,
920 		.size		= 1,
921 		.offset		= 0,
922 		.v4l2_type	= V4L2_CTRL_TYPE_BOOLEAN,
923 		.data_type	= UVC_CTRL_DATA_TYPE_BOOLEAN,
924 		.slave_ids	= { V4L2_CID_BLUE_BALANCE,
925 				    V4L2_CID_RED_BALANCE },
926 	},
927 	{
928 		.id		= V4L2_CID_BLUE_BALANCE,
929 		.entity		= UVC_GUID_UVC_PROCESSING,
930 		.selector	= UVC_PU_WHITE_BALANCE_COMPONENT_CONTROL,
931 		.size		= 16,
932 		.offset		= 0,
933 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
934 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
935 		.master_id	= V4L2_CID_AUTO_WHITE_BALANCE,
936 		.master_manual	= 0,
937 	},
938 	{
939 		.id		= V4L2_CID_RED_BALANCE,
940 		.entity		= UVC_GUID_UVC_PROCESSING,
941 		.selector	= UVC_PU_WHITE_BALANCE_COMPONENT_CONTROL,
942 		.size		= 16,
943 		.offset		= 16,
944 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
945 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
946 		.master_id	= V4L2_CID_AUTO_WHITE_BALANCE,
947 		.master_manual	= 0,
948 	},
949 	{
950 		.id		= V4L2_CID_FOCUS_ABSOLUTE,
951 		.entity		= UVC_GUID_UVC_CAMERA,
952 		.selector	= UVC_CT_FOCUS_ABSOLUTE_CONTROL,
953 		.size		= 16,
954 		.offset		= 0,
955 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
956 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
957 		.master_id	= V4L2_CID_FOCUS_AUTO,
958 		.master_manual	= 0,
959 	},
960 	{
961 		.id		= V4L2_CID_FOCUS_AUTO,
962 		.entity		= UVC_GUID_UVC_CAMERA,
963 		.selector	= UVC_CT_FOCUS_AUTO_CONTROL,
964 		.size		= 1,
965 		.offset		= 0,
966 		.v4l2_type	= V4L2_CTRL_TYPE_BOOLEAN,
967 		.data_type	= UVC_CTRL_DATA_TYPE_BOOLEAN,
968 		.slave_ids	= { V4L2_CID_FOCUS_ABSOLUTE, },
969 	},
970 	{
971 		.id		= V4L2_CID_IRIS_ABSOLUTE,
972 		.entity		= UVC_GUID_UVC_CAMERA,
973 		.selector	= UVC_CT_IRIS_ABSOLUTE_CONTROL,
974 		.size		= 16,
975 		.offset		= 0,
976 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
977 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
978 	},
979 	{
980 		.id		= V4L2_CID_IRIS_RELATIVE,
981 		.entity		= UVC_GUID_UVC_CAMERA,
982 		.selector	= UVC_CT_IRIS_RELATIVE_CONTROL,
983 		.size		= 8,
984 		.offset		= 0,
985 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
986 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
987 	},
988 	{
989 		.id		= V4L2_CID_ZOOM_ABSOLUTE,
990 		.entity		= UVC_GUID_UVC_CAMERA,
991 		.selector	= UVC_CT_ZOOM_ABSOLUTE_CONTROL,
992 		.size		= 16,
993 		.offset		= 0,
994 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
995 		.data_type	= UVC_CTRL_DATA_TYPE_UNSIGNED,
996 	},
997 	{
998 		.id		= V4L2_CID_ZOOM_CONTINUOUS,
999 		.entity		= UVC_GUID_UVC_CAMERA,
1000 		.selector	= UVC_CT_ZOOM_RELATIVE_CONTROL,
1001 		.size		= 0,
1002 		.offset		= 0,
1003 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
1004 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
1005 		.get		= uvc_ctrl_get_zoom,
1006 		.set		= uvc_ctrl_set_zoom,
1007 	},
1008 	{
1009 		.id		= V4L2_CID_PAN_ABSOLUTE,
1010 		.entity		= UVC_GUID_UVC_CAMERA,
1011 		.selector	= UVC_CT_PANTILT_ABSOLUTE_CONTROL,
1012 		.size		= 32,
1013 		.offset		= 0,
1014 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
1015 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
1016 	},
1017 	{
1018 		.id		= V4L2_CID_TILT_ABSOLUTE,
1019 		.entity		= UVC_GUID_UVC_CAMERA,
1020 		.selector	= UVC_CT_PANTILT_ABSOLUTE_CONTROL,
1021 		.size		= 32,
1022 		.offset		= 32,
1023 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
1024 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
1025 	},
1026 	{
1027 		.id		= V4L2_CID_PAN_SPEED,
1028 		.entity		= UVC_GUID_UVC_CAMERA,
1029 		.selector	= UVC_CT_PANTILT_RELATIVE_CONTROL,
1030 		.size		= 16,
1031 		.offset		= 0,
1032 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
1033 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
1034 		.get		= uvc_ctrl_get_rel_speed,
1035 		.set		= uvc_ctrl_set_rel_speed,
1036 	},
1037 	{
1038 		.id		= V4L2_CID_TILT_SPEED,
1039 		.entity		= UVC_GUID_UVC_CAMERA,
1040 		.selector	= UVC_CT_PANTILT_RELATIVE_CONTROL,
1041 		.size		= 16,
1042 		.offset		= 16,
1043 		.v4l2_type	= V4L2_CTRL_TYPE_INTEGER,
1044 		.data_type	= UVC_CTRL_DATA_TYPE_SIGNED,
1045 		.get		= uvc_ctrl_get_rel_speed,
1046 		.set		= uvc_ctrl_set_rel_speed,
1047 	},
1048 	{
1049 		.id		= V4L2_CID_PRIVACY,
1050 		.entity		= UVC_GUID_UVC_CAMERA,
1051 		.selector	= UVC_CT_PRIVACY_CONTROL,
1052 		.size		= 1,
1053 		.offset		= 0,
1054 		.v4l2_type	= V4L2_CTRL_TYPE_BOOLEAN,
1055 		.data_type	= UVC_CTRL_DATA_TYPE_BOOLEAN,
1056 	},
1057 	{
1058 		.id		= V4L2_CID_PRIVACY,
1059 		.entity		= UVC_GUID_EXT_GPIO_CONTROLLER,
1060 		.selector	= UVC_CT_PRIVACY_CONTROL,
1061 		.size		= 1,
1062 		.offset		= 0,
1063 		.v4l2_type	= V4L2_CTRL_TYPE_BOOLEAN,
1064 		.data_type	= UVC_CTRL_DATA_TYPE_BOOLEAN,
1065 	},
1066 	{
1067 		.entity		= UVC_GUID_UVC_PROCESSING,
1068 		.selector	= UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
1069 		.filter_mapping	= uvc_ctrl_filter_plf_mapping,
1070 	},
1071 	{
1072 		.id		= V4L2_CID_UVC_REGION_OF_INTEREST_RECT,
1073 		.entity		= UVC_GUID_UVC_CAMERA,
1074 		.selector	= UVC_CT_REGION_OF_INTEREST_CONTROL,
1075 		.size		= sizeof(struct uvc_rect) * 8,
1076 		.offset		= 0,
1077 		.v4l2_type	= V4L2_CTRL_TYPE_RECT,
1078 		.data_type	= UVC_CTRL_DATA_TYPE_RECT,
1079 		.get		= uvc_get_rect,
1080 		.set		= uvc_set_rect,
1081 		.name		= "Region of Interest Rectangle",
1082 	},
1083 	{
1084 		.id		= V4L2_CID_UVC_REGION_OF_INTEREST_AUTO,
1085 		.entity		= UVC_GUID_UVC_CAMERA,
1086 		.selector	= UVC_CT_REGION_OF_INTEREST_CONTROL,
1087 		.size		= 16,
1088 		.offset		= 64,
1089 		.v4l2_type	= V4L2_CTRL_TYPE_BITMASK,
1090 		.data_type	= UVC_CTRL_DATA_TYPE_BITMASK,
1091 		.name		= "Region of Interest Auto Ctrls",
1092 	},
1093 	{
1094 		.id		= V4L2_CID_COLORFX,
1095 		.entity		= UVC_GUID_CHROMEOS_XU,
1096 		.selector	= UVC_CROSXU_CONTROL_IQ_PROFILE,
1097 		.size		= 8,
1098 		.offset		= 0,
1099 		.v4l2_type	= V4L2_CTRL_TYPE_MENU,
1100 		.data_type	= UVC_CTRL_DATA_TYPE_ENUM,
1101 		.menu_mapping	= cros_colorfx_mapping,
1102 		.menu_mask	= BIT(V4L2_COLORFX_VIVID) |
1103 				  BIT(V4L2_COLORFX_NONE),
1104 	},
1105 	{
1106 		.id             = V4L2_CID_PAN_RELATIVE,
1107 		.entity         = UVC_GUID_LOGITECH_MOTOR_CONTROL_V1,
1108 		.selector       = 1,
1109 		.size           = 16,
1110 		.offset         = 0,
1111 		.v4l2_type      = V4L2_CTRL_TYPE_INTEGER,
1112 		.data_type      = UVC_CTRL_DATA_TYPE_SIGNED,
1113 	},
1114 	{
1115 		.id             = V4L2_CID_TILT_RELATIVE,
1116 		.entity         = UVC_GUID_LOGITECH_MOTOR_CONTROL_V1,
1117 		.selector       = 1,
1118 		.size           = 16,
1119 		.offset         = 16,
1120 		.v4l2_type      = V4L2_CTRL_TYPE_INTEGER,
1121 		.data_type      = UVC_CTRL_DATA_TYPE_SIGNED,
1122 	},
1123 	{
1124 		.id             = V4L2_CID_PAN_RESET,
1125 		.entity         = UVC_GUID_LOGITECH_MOTOR_CONTROL_V1,
1126 		.selector       = 2,
1127 		.size           = 1,
1128 		.offset         = 0,
1129 		.v4l2_type      = V4L2_CTRL_TYPE_BUTTON,
1130 		.data_type      = UVC_CTRL_DATA_TYPE_UNSIGNED,
1131 	},
1132 	{
1133 		.id             = V4L2_CID_TILT_RESET,
1134 		.entity         = UVC_GUID_LOGITECH_MOTOR_CONTROL_V1,
1135 		.selector       = 2,
1136 		.size           = 1,
1137 		.offset         = 1,
1138 		.v4l2_type      = V4L2_CTRL_TYPE_BUTTON,
1139 		.data_type      = UVC_CTRL_DATA_TYPE_UNSIGNED,
1140 	},
1141 	{
1142 		.id             = V4L2_CID_PAN_RELATIVE,
1143 		.entity         = UVC_GUID_LOGITECH_PERIPHERAL,
1144 		.selector       = 1,
1145 		.size           = 16,
1146 		.offset         = 0,
1147 		.v4l2_type      = V4L2_CTRL_TYPE_INTEGER,
1148 		.data_type      = UVC_CTRL_DATA_TYPE_SIGNED,
1149 	},
1150 	{
1151 		.id             = V4L2_CID_TILT_RELATIVE,
1152 		.entity         = UVC_GUID_LOGITECH_PERIPHERAL,
1153 		.selector       = 1,
1154 		.size           = 16,
1155 		.offset         = 16,
1156 		.v4l2_type      = V4L2_CTRL_TYPE_INTEGER,
1157 		.data_type      = UVC_CTRL_DATA_TYPE_SIGNED,
1158 	},
1159 	{
1160 		.id             = V4L2_CID_PAN_RESET,
1161 		.entity         = UVC_GUID_LOGITECH_PERIPHERAL,
1162 		.selector       = 2,
1163 		.size           = 1,
1164 		.offset         = 0,
1165 		.v4l2_type      = V4L2_CTRL_TYPE_BUTTON,
1166 		.data_type      = UVC_CTRL_DATA_TYPE_UNSIGNED,
1167 	},
1168 	{
1169 		.id             = V4L2_CID_TILT_RESET,
1170 		.entity         = UVC_GUID_LOGITECH_PERIPHERAL,
1171 		.selector       = 2,
1172 		.size           = 1,
1173 		.offset         = 1,
1174 		.v4l2_type      = V4L2_CTRL_TYPE_BUTTON,
1175 		.data_type      = UVC_CTRL_DATA_TYPE_UNSIGNED,
1176 	},
1177 	{
1178 		.id             = V4L2_CID_FOCUS_ABSOLUTE,
1179 		.entity         = UVC_GUID_LOGITECH_MOTOR_CONTROL_V1,
1180 		.selector       = 3,
1181 		.size           = 8,
1182 		.offset         = 0,
1183 		.v4l2_type      = V4L2_CTRL_TYPE_INTEGER,
1184 		.data_type      = UVC_CTRL_DATA_TYPE_UNSIGNED,
1185 	},
1186 };
1187 
1188 /* ------------------------------------------------------------------------
1189  * Utility functions
1190  */
1191 
1192 static inline u8 *uvc_ctrl_data(struct uvc_control *ctrl, int id)
1193 {
1194 	return ctrl->uvc_data + id * ctrl->info.size;
1195 }
1196 
1197 static inline int uvc_test_bit(const u8 *data, int bit)
1198 {
1199 	return (data[bit >> 3] >> (bit & 7)) & 1;
1200 }
1201 
1202 static inline void uvc_clear_bit(u8 *data, int bit)
1203 {
1204 	data[bit >> 3] &= ~(1 << (bit & 7));
1205 }
1206 
1207 static s32 uvc_menu_to_v4l2_menu(struct uvc_control_mapping *mapping, s32 val)
1208 {
1209 	unsigned int i;
1210 
1211 	for (i = 0; BIT(i) <= mapping->menu_mask; ++i) {
1212 		u32 menu_value;
1213 
1214 		if (!test_bit(i, &mapping->menu_mask))
1215 			continue;
1216 
1217 		menu_value = uvc_mapping_get_menu_value(mapping, i);
1218 
1219 		if (menu_value == val)
1220 			return i;
1221 	}
1222 
1223 	return val;
1224 }
1225 
1226 /*
1227  * Extract the bit string specified by mapping->offset and mapping->size
1228  * from the little-endian data stored at 'data' and return the result as
1229  * a signed 32bit integer. Sign extension will be performed if the mapping
1230  * references a signed data type.
1231  */
1232 static int uvc_get_le_value(struct uvc_control_mapping *mapping,
1233 			    u8 query, const void *uvc_in, size_t v4l2_size,
1234 			    void *v4l2_out)
1235 {
1236 	int offset = mapping->offset;
1237 	int bits = mapping->size;
1238 	const u8 *data = uvc_in;
1239 	s32 *out = v4l2_out;
1240 	s32 value = 0;
1241 	u8 mask;
1242 
1243 	if (WARN_ON(v4l2_size != sizeof(s32)))
1244 		return -EINVAL;
1245 
1246 	data += offset / 8;
1247 	offset &= 7;
1248 	mask = ((1LL << bits) - 1) << offset;
1249 
1250 	while (1) {
1251 		u8 byte = *data & mask;
1252 		value |= offset > 0 ? (byte >> offset) : (byte << (-offset));
1253 		bits -= 8 - max(offset, 0);
1254 		if (bits <= 0)
1255 			break;
1256 
1257 		offset -= 8;
1258 		mask = (1 << bits) - 1;
1259 		data++;
1260 	}
1261 
1262 	/* Sign-extend the value if needed. */
1263 	if (mapping->data_type == UVC_CTRL_DATA_TYPE_SIGNED)
1264 		value |= -(value & (1 << (mapping->size - 1)));
1265 
1266 	/* If it is a menu, convert from uvc to v4l2. */
1267 	if (mapping->v4l2_type != V4L2_CTRL_TYPE_MENU) {
1268 		*out = value;
1269 		return 0;
1270 	}
1271 
1272 	switch (query) {
1273 	case UVC_GET_CUR:
1274 	case UVC_GET_DEF:
1275 		*out = uvc_menu_to_v4l2_menu(mapping, value);
1276 		return 0;
1277 	}
1278 
1279 	*out = value;
1280 	return 0;
1281 }
1282 
1283 /*
1284  * Set the bit string specified by mapping->offset and mapping->size
1285  * in the little-endian data stored at 'data' to the value 'value'.
1286  */
1287 static int uvc_set_le_value(struct uvc_control_mapping *mapping,
1288 			    size_t v4l2_size, const void *v4l2_in,
1289 			    void *uvc_out)
1290 {
1291 	int offset = mapping->offset;
1292 	int bits = mapping->size;
1293 	u8 *data = uvc_out;
1294 	s32 value;
1295 	u8 mask;
1296 
1297 	if (WARN_ON(v4l2_size != sizeof(s32)))
1298 		return -EINVAL;
1299 
1300 	value = *(s32 *)v4l2_in;
1301 
1302 	switch (mapping->v4l2_type) {
1303 	case V4L2_CTRL_TYPE_MENU:
1304 		value = uvc_mapping_get_menu_value(mapping, value);
1305 		break;
1306 	case V4L2_CTRL_TYPE_BUTTON:
1307 		/*
1308 		 * According to the v4l2 spec, writing any value to a button
1309 		 * control should result in the action belonging to the button
1310 		 * control being triggered. UVC devices however want to see a 1
1311 		 * written -> override value.
1312 		 */
1313 		value = -1;
1314 		break;
1315 	default:
1316 		break;
1317 	}
1318 
1319 	data += offset / 8;
1320 	offset &= 7;
1321 
1322 	for (; bits > 0; data++) {
1323 		mask = ((1LL << bits) - 1) << offset;
1324 		*data = (*data & ~mask) | ((value << offset) & mask);
1325 		value >>= offset ? offset : 8;
1326 		bits -= 8 - offset;
1327 		offset = 0;
1328 	}
1329 
1330 	return 0;
1331 }
1332 
1333 /* ------------------------------------------------------------------------
1334  * Terminal and unit management
1335  */
1336 
1337 static int uvc_entity_match_guid(const struct uvc_entity *entity,
1338 				 const u8 guid[16])
1339 {
1340 	return memcmp(entity->guid, guid, sizeof(entity->guid)) == 0;
1341 }
1342 
1343 /* ------------------------------------------------------------------------
1344  * UVC Controls
1345  */
1346 
1347 static void __uvc_find_control(struct uvc_entity *entity, u32 v4l2_id,
1348 	struct uvc_control_mapping **mapping, struct uvc_control **control,
1349 	int next, int next_compound)
1350 {
1351 	struct uvc_control *ctrl;
1352 	struct uvc_control_mapping *map;
1353 	unsigned int i;
1354 
1355 	if (entity == NULL)
1356 		return;
1357 
1358 	for (i = 0; i < entity->ncontrols; ++i) {
1359 		ctrl = &entity->controls[i];
1360 		if (!ctrl->initialized)
1361 			continue;
1362 
1363 		list_for_each_entry(map, &ctrl->info.mappings, list) {
1364 			if (map->id == v4l2_id && !next && !next_compound) {
1365 				*control = ctrl;
1366 				*mapping = map;
1367 				return;
1368 			}
1369 
1370 			if ((*mapping == NULL || (*mapping)->id > map->id) &&
1371 			    (map->id > v4l2_id) &&
1372 			    (uvc_ctrl_mapping_is_compound(map) ?
1373 			     next_compound : next)) {
1374 				*control = ctrl;
1375 				*mapping = map;
1376 			}
1377 		}
1378 	}
1379 }
1380 
1381 static struct uvc_control *uvc_find_control(struct uvc_video_chain *chain,
1382 	u32 v4l2_id, struct uvc_control_mapping **mapping)
1383 {
1384 	struct uvc_control *ctrl = NULL;
1385 	struct uvc_entity *entity;
1386 	int next = v4l2_id & V4L2_CTRL_FLAG_NEXT_CTRL;
1387 	int next_compound = v4l2_id & V4L2_CTRL_FLAG_NEXT_COMPOUND;
1388 
1389 	*mapping = NULL;
1390 
1391 	/* Mask the query flags. */
1392 	v4l2_id &= V4L2_CTRL_ID_MASK;
1393 
1394 	/* Find the control. */
1395 	list_for_each_entry(entity, &chain->entities, chain) {
1396 		__uvc_find_control(entity, v4l2_id, mapping, &ctrl, next,
1397 				   next_compound);
1398 		if (ctrl && !next && !next_compound)
1399 			return ctrl;
1400 	}
1401 
1402 	if (!ctrl && !next && !next_compound)
1403 		uvc_dbg(chain->dev, CONTROL, "Control 0x%08x not found\n",
1404 			v4l2_id);
1405 
1406 	return ctrl;
1407 }
1408 
1409 static int uvc_ctrl_populate_cache(struct uvc_video_chain *chain,
1410 	struct uvc_control *ctrl)
1411 {
1412 	int ret;
1413 
1414 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_DEF) {
1415 		ret = uvc_query_ctrl(chain->dev, UVC_GET_DEF, ctrl->entity->id,
1416 				     chain->dev->intfnum, ctrl->info.selector,
1417 				     uvc_ctrl_data(ctrl, UVC_CTRL_DATA_DEF),
1418 				     ctrl->info.size);
1419 		if (ret < 0)
1420 			return ret;
1421 	}
1422 
1423 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_MIN) {
1424 		ret = uvc_query_ctrl(chain->dev, UVC_GET_MIN, ctrl->entity->id,
1425 				     chain->dev->intfnum, ctrl->info.selector,
1426 				     uvc_ctrl_data(ctrl, UVC_CTRL_DATA_MIN),
1427 				     ctrl->info.size);
1428 		if (ret < 0)
1429 			return ret;
1430 	}
1431 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_MAX) {
1432 		ret = uvc_query_ctrl(chain->dev, UVC_GET_MAX, ctrl->entity->id,
1433 				     chain->dev->intfnum, ctrl->info.selector,
1434 				     uvc_ctrl_data(ctrl, UVC_CTRL_DATA_MAX),
1435 				     ctrl->info.size);
1436 		if (ret < 0)
1437 			return ret;
1438 	}
1439 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_RES) {
1440 		ret = uvc_query_ctrl(chain->dev, UVC_GET_RES, ctrl->entity->id,
1441 				     chain->dev->intfnum, ctrl->info.selector,
1442 				     uvc_ctrl_data(ctrl, UVC_CTRL_DATA_RES),
1443 				     ctrl->info.size);
1444 		if (ret < 0) {
1445 			if (UVC_ENTITY_TYPE(ctrl->entity) !=
1446 			    UVC_VC_EXTENSION_UNIT)
1447 				return ret;
1448 
1449 			/*
1450 			 * GET_RES is mandatory for XU controls, but some
1451 			 * cameras still choke on it. Ignore errors and set the
1452 			 * resolution value to zero.
1453 			 */
1454 			uvc_warn_once(chain->dev, UVC_WARN_XU_GET_RES,
1455 				      "UVC non compliance - GET_RES failed on "
1456 				      "an XU control. Enabling workaround.\n");
1457 			memset(uvc_ctrl_data(ctrl, UVC_CTRL_DATA_RES), 0,
1458 			       ctrl->info.size);
1459 		}
1460 	}
1461 
1462 	ctrl->cached = 1;
1463 	return 0;
1464 }
1465 
1466 static int __uvc_ctrl_load_cur(struct uvc_video_chain *chain,
1467 			       struct uvc_control *ctrl)
1468 {
1469 	u8 *data;
1470 	int ret;
1471 
1472 	if (ctrl->loaded)
1473 		return 0;
1474 
1475 	data = uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT);
1476 
1477 	if ((ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) == 0) {
1478 		memset(data, 0, ctrl->info.size);
1479 		ctrl->loaded = 1;
1480 
1481 		return 0;
1482 	}
1483 
1484 	if (ctrl->entity->get_cur)
1485 		ret = ctrl->entity->get_cur(chain->dev, ctrl->entity,
1486 					    ctrl->info.selector, data,
1487 					    ctrl->info.size);
1488 	else
1489 		ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR,
1490 				     ctrl->entity->id, chain->dev->intfnum,
1491 				     ctrl->info.selector, data,
1492 				     ctrl->info.size);
1493 
1494 	if (ret < 0)
1495 		return ret;
1496 
1497 	ctrl->loaded = 1;
1498 
1499 	return ret;
1500 }
1501 
1502 static int __uvc_ctrl_get(struct uvc_video_chain *chain,
1503 			  struct uvc_control *ctrl,
1504 			  struct uvc_control_mapping *mapping,
1505 			  s32 *value)
1506 {
1507 	int ret;
1508 
1509 	if ((ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) == 0)
1510 		return -EACCES;
1511 
1512 	ret = __uvc_ctrl_load_cur(chain, ctrl);
1513 	if (ret < 0)
1514 		return ret;
1515 
1516 	*value = uvc_mapping_get_s32(mapping, UVC_GET_CUR,
1517 				     uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT));
1518 
1519 	return 0;
1520 }
1521 
1522 static int __uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
1523 				  u32 found_id)
1524 {
1525 	bool find_next = req_id &
1526 		(V4L2_CTRL_FLAG_NEXT_CTRL | V4L2_CTRL_FLAG_NEXT_COMPOUND);
1527 	unsigned int i;
1528 
1529 	req_id &= V4L2_CTRL_ID_MASK;
1530 
1531 	for (i = 0; i < ARRAY_SIZE(uvc_control_classes); i++) {
1532 		if (!(chain->ctrl_class_bitmap & BIT(i)))
1533 			continue;
1534 		if (!find_next) {
1535 			if (uvc_control_classes[i] == req_id)
1536 				return i;
1537 			continue;
1538 		}
1539 		if (uvc_control_classes[i] > req_id &&
1540 		    uvc_control_classes[i] < found_id)
1541 			return i;
1542 	}
1543 
1544 	return -ENODEV;
1545 }
1546 
1547 static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
1548 				u32 found_id,
1549 				struct v4l2_query_ext_ctrl *v4l2_ctrl)
1550 {
1551 	int idx;
1552 
1553 	idx = __uvc_query_v4l2_class(chain, req_id, found_id);
1554 	if (idx < 0)
1555 		return -ENODEV;
1556 
1557 	memset(v4l2_ctrl, 0, sizeof(*v4l2_ctrl));
1558 	v4l2_ctrl->id = uvc_control_classes[idx];
1559 	strscpy(v4l2_ctrl->name, v4l2_ctrl_get_name(v4l2_ctrl->id),
1560 		sizeof(v4l2_ctrl->name));
1561 	v4l2_ctrl->type = V4L2_CTRL_TYPE_CTRL_CLASS;
1562 	v4l2_ctrl->flags = V4L2_CTRL_FLAG_WRITE_ONLY
1563 			 | V4L2_CTRL_FLAG_READ_ONLY;
1564 	return 0;
1565 }
1566 
1567 static bool uvc_ctrl_is_readable(u32 which, struct uvc_control *ctrl,
1568 				 struct uvc_control_mapping *mapping)
1569 {
1570 	if (which == V4L2_CTRL_WHICH_CUR_VAL)
1571 		return !!(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR);
1572 
1573 	if (which == V4L2_CTRL_WHICH_DEF_VAL)
1574 		return !!(ctrl->info.flags & UVC_CTRL_FLAG_GET_DEF);
1575 
1576 	/* Types with implicit boundaries. */
1577 	switch (mapping->v4l2_type) {
1578 	case V4L2_CTRL_TYPE_MENU:
1579 	case V4L2_CTRL_TYPE_BOOLEAN:
1580 	case V4L2_CTRL_TYPE_BUTTON:
1581 		return true;
1582 	case V4L2_CTRL_TYPE_BITMASK:
1583 		return (ctrl->info.flags & UVC_CTRL_FLAG_GET_RES) ||
1584 			(ctrl->info.flags & UVC_CTRL_FLAG_GET_MAX);
1585 	default:
1586 		break;
1587 	}
1588 
1589 	if (which == V4L2_CTRL_WHICH_MIN_VAL)
1590 		return !!(ctrl->info.flags & UVC_CTRL_FLAG_GET_MIN);
1591 
1592 	if (which == V4L2_CTRL_WHICH_MAX_VAL)
1593 		return !!(ctrl->info.flags & UVC_CTRL_FLAG_GET_MAX);
1594 
1595 	return false;
1596 }
1597 
1598 /*
1599  * Check if control @v4l2_id can be accessed by the given control @ioctl
1600  * (VIDIOC_G_EXT_CTRLS, VIDIOC_TRY_EXT_CTRLS or VIDIOC_S_EXT_CTRLS).
1601  *
1602  * For set operations on slave controls, check if the master's value is set to
1603  * manual, either in the others controls set in the same ioctl call, or from
1604  * the master's current value. This catches VIDIOC_S_EXT_CTRLS calls that set
1605  * both the master and slave control, such as for instance setting
1606  * auto_exposure=1, exposure_time_absolute=251.
1607  */
1608 int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
1609 			   const struct v4l2_ext_controls *ctrls, u32 which,
1610 			   unsigned long ioctl)
1611 {
1612 	struct uvc_control_mapping *master_map = NULL;
1613 	struct uvc_control *master_ctrl = NULL;
1614 	struct uvc_control_mapping *mapping;
1615 	struct uvc_control *ctrl;
1616 	s32 val;
1617 	int ret;
1618 	int i;
1619 	/*
1620 	 * There is no need to check the ioctl, all the ioctls except
1621 	 * VIDIOC_G_EXT_CTRLS use which=V4L2_CTRL_WHICH_CUR_VAL.
1622 	 */
1623 	bool is_which_min_max = which == V4L2_CTRL_WHICH_MIN_VAL ||
1624 				which == V4L2_CTRL_WHICH_MAX_VAL;
1625 
1626 	if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0)
1627 		return is_which_min_max ? -EINVAL : -EACCES;
1628 
1629 	ctrl = uvc_find_control(chain, v4l2_id, &mapping);
1630 	if (!ctrl)
1631 		return -EINVAL;
1632 
1633 	if ((!(ctrl->info.flags & UVC_CTRL_FLAG_GET_MIN) ||
1634 	     !(ctrl->info.flags & UVC_CTRL_FLAG_GET_MAX)) && is_which_min_max)
1635 		return -EINVAL;
1636 
1637 	if (ioctl == VIDIOC_G_EXT_CTRLS)
1638 		return uvc_ctrl_is_readable(ctrls->which, ctrl, mapping);
1639 
1640 	if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR))
1641 		return -EACCES;
1642 
1643 	if (ioctl != VIDIOC_S_EXT_CTRLS || !mapping->master_id)
1644 		return 0;
1645 
1646 	/*
1647 	 * Iterate backwards in cases where the master control is accessed
1648 	 * multiple times in the same ioctl. We want the last value.
1649 	 */
1650 	for (i = ctrls->count - 1; i >= 0; i--) {
1651 		if (ctrls->controls[i].id == mapping->master_id)
1652 			return ctrls->controls[i].value ==
1653 					mapping->master_manual ? 0 : -EACCES;
1654 	}
1655 
1656 	__uvc_find_control(ctrl->entity, mapping->master_id, &master_map,
1657 			   &master_ctrl, 0, 0);
1658 
1659 	if (!master_ctrl || !(master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR))
1660 		return 0;
1661 	if (WARN_ON(uvc_ctrl_mapping_is_compound(master_map)))
1662 		return -EIO;
1663 
1664 	ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val);
1665 	if (ret >= 0 && val != mapping->master_manual)
1666 		return -EACCES;
1667 
1668 	return 0;
1669 }
1670 
1671 static const char *uvc_map_get_name(const struct uvc_control_mapping *map)
1672 {
1673 	const char *name;
1674 
1675 	if (map->name)
1676 		return map->name;
1677 
1678 	name = v4l2_ctrl_get_name(map->id);
1679 	if (name)
1680 		return name;
1681 
1682 	return "Unknown Control";
1683 }
1684 
1685 static u32 uvc_get_ctrl_bitmap(struct uvc_control *ctrl,
1686 			       struct uvc_control_mapping *mapping)
1687 {
1688 	/*
1689 	 * Some controls, like CT_AE_MODE_CONTROL, use GET_RES to represent
1690 	 * the number of bits supported. Those controls do not list GET_MAX
1691 	 * as supported.
1692 	 */
1693 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_RES)
1694 		return uvc_mapping_get_s32(mapping, UVC_GET_RES,
1695 					   uvc_ctrl_data(ctrl, UVC_CTRL_DATA_RES));
1696 
1697 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_MAX)
1698 		return uvc_mapping_get_s32(mapping, UVC_GET_MAX,
1699 					   uvc_ctrl_data(ctrl, UVC_CTRL_DATA_MAX));
1700 
1701 	return ~0;
1702 }
1703 
1704 static bool uvc_ctrl_is_relative_ptz(__u32 ctrl_id)
1705 {
1706 	switch (ctrl_id) {
1707 	case V4L2_CID_ZOOM_CONTINUOUS:
1708 	case V4L2_CID_PAN_SPEED:
1709 	case V4L2_CID_TILT_SPEED:
1710 		return true;
1711 	}
1712 	return false;
1713 }
1714 
1715 /*
1716  * Maximum retry count to avoid spurious errors with controls. Increasing this
1717  * value does no seem to produce better results in the tested hardware.
1718  */
1719 #define MAX_QUERY_RETRIES 2
1720 
1721 static int __uvc_queryctrl_boundaries(struct uvc_video_chain *chain,
1722 				      struct uvc_control *ctrl,
1723 				      struct uvc_control_mapping *mapping,
1724 				      struct v4l2_query_ext_ctrl *v4l2_ctrl)
1725 {
1726 	if (!ctrl->cached) {
1727 		unsigned int retries;
1728 		int ret;
1729 
1730 		for (retries = 0; retries < MAX_QUERY_RETRIES; retries++) {
1731 			ret = uvc_ctrl_populate_cache(chain, ctrl);
1732 			if (ret != -EIO)
1733 				break;
1734 		}
1735 
1736 		if (ret)
1737 			return ret;
1738 	}
1739 
1740 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_DEF) {
1741 		v4l2_ctrl->default_value = uvc_mapping_get_s32(mapping,
1742 				UVC_GET_DEF, uvc_ctrl_data(ctrl, UVC_CTRL_DATA_DEF));
1743 	}
1744 
1745 	switch (mapping->v4l2_type) {
1746 	case V4L2_CTRL_TYPE_MENU:
1747 		v4l2_ctrl->minimum = ffs(mapping->menu_mask) - 1;
1748 		v4l2_ctrl->maximum = fls(mapping->menu_mask) - 1;
1749 		v4l2_ctrl->step = 1;
1750 		return 0;
1751 
1752 	case V4L2_CTRL_TYPE_BOOLEAN:
1753 		v4l2_ctrl->minimum = 0;
1754 		v4l2_ctrl->maximum = 1;
1755 		v4l2_ctrl->step = 1;
1756 		return 0;
1757 
1758 	case V4L2_CTRL_TYPE_BUTTON:
1759 		v4l2_ctrl->minimum = 0;
1760 		v4l2_ctrl->maximum = 0;
1761 		v4l2_ctrl->step = 0;
1762 		return 0;
1763 
1764 	case V4L2_CTRL_TYPE_BITMASK:
1765 		v4l2_ctrl->minimum = 0;
1766 		v4l2_ctrl->maximum = uvc_get_ctrl_bitmap(ctrl, mapping);
1767 		v4l2_ctrl->step = 0;
1768 		return 0;
1769 
1770 	default:
1771 		break;
1772 	}
1773 
1774 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_MAX)
1775 		v4l2_ctrl->maximum = uvc_mapping_get_s32(mapping, UVC_GET_MAX,
1776 				uvc_ctrl_data(ctrl, UVC_CTRL_DATA_MAX));
1777 	else
1778 		v4l2_ctrl->maximum = 0;
1779 
1780 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_MIN) {
1781 		/*
1782 		 * For relative PTZ controls, UVC_GET_MIN for
1783 		 * b(Pan|Tilt|Zoom)Speed returns the minimum speed of the
1784 		 * movement in direction specified in the sign field.
1785 		 * See in USB Device Class Definition for Video Devices:
1786 		 * 4.2.2.1.13 Zoom (Relative) Control
1787 		 * 4.2.2.1.15 PanTilt (Relative) Control
1788 		 *
1789 		 * For minimum value, use maximum speed but in negative direction.
1790 		 */
1791 		if (uvc_ctrl_is_relative_ptz(v4l2_ctrl->id))
1792 			v4l2_ctrl->minimum = -v4l2_ctrl->maximum;
1793 		else
1794 			v4l2_ctrl->minimum = uvc_mapping_get_s32(mapping,
1795 				UVC_GET_MIN, uvc_ctrl_data(ctrl, UVC_CTRL_DATA_MIN));
1796 	} else {
1797 		v4l2_ctrl->minimum = 0;
1798 	}
1799 
1800 	if (ctrl->info.flags & UVC_CTRL_FLAG_GET_RES)
1801 		v4l2_ctrl->step = uvc_mapping_get_s32(mapping, UVC_GET_RES,
1802 				uvc_ctrl_data(ctrl, UVC_CTRL_DATA_RES));
1803 	else
1804 		v4l2_ctrl->step = 0;
1805 
1806 	return 0;
1807 }
1808 
1809 static size_t uvc_mapping_v4l2_size(struct uvc_control_mapping *mapping)
1810 {
1811 	if (mapping->v4l2_type == V4L2_CTRL_TYPE_RECT)
1812 		return sizeof(struct v4l2_rect);
1813 
1814 	if (uvc_ctrl_mapping_is_compound(mapping))
1815 		return DIV_ROUND_UP(mapping->size, 8);
1816 
1817 	return sizeof(s32);
1818 }
1819 
1820 static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
1821 				 struct uvc_control *ctrl,
1822 				 struct uvc_control_mapping *mapping,
1823 				 struct v4l2_query_ext_ctrl *v4l2_ctrl)
1824 {
1825 	struct uvc_control_mapping *master_map = NULL;
1826 	struct uvc_control *master_ctrl = NULL;
1827 	int ret;
1828 
1829 	memset(v4l2_ctrl, 0, sizeof(*v4l2_ctrl));
1830 	v4l2_ctrl->id = mapping->id;
1831 	v4l2_ctrl->type = mapping->v4l2_type;
1832 	strscpy(v4l2_ctrl->name, uvc_map_get_name(mapping),
1833 		sizeof(v4l2_ctrl->name));
1834 	v4l2_ctrl->flags = 0;
1835 
1836 	if (!(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR))
1837 		v4l2_ctrl->flags |= V4L2_CTRL_FLAG_WRITE_ONLY;
1838 	if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR))
1839 		v4l2_ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
1840 	if ((ctrl->info.flags & UVC_CTRL_FLAG_GET_MAX) &&
1841 	    (ctrl->info.flags & UVC_CTRL_FLAG_GET_MIN))
1842 		v4l2_ctrl->flags |= V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX;
1843 
1844 	if (mapping->master_id)
1845 		__uvc_find_control(ctrl->entity, mapping->master_id,
1846 				   &master_map, &master_ctrl, 0, 0);
1847 	if (master_ctrl && (master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR)) {
1848 		unsigned int retries;
1849 		s32 val;
1850 		int ret;
1851 
1852 		if (WARN_ON(uvc_ctrl_mapping_is_compound(master_map)))
1853 			return -EIO;
1854 
1855 		for (retries = 0; retries < MAX_QUERY_RETRIES; retries++) {
1856 			ret = __uvc_ctrl_get(chain, master_ctrl, master_map,
1857 					     &val);
1858 			if (!ret)
1859 				break;
1860 			if (ret < 0 && ret != -EIO)
1861 				return ret;
1862 		}
1863 
1864 		if (ret == -EIO) {
1865 			dev_warn_ratelimited(&chain->dev->intf->dev,
1866 					     "UVC non compliance: Error %d querying master control %x (%s)\n",
1867 					     ret, master_map->id,
1868 					     uvc_map_get_name(master_map));
1869 		} else {
1870 			if (val != mapping->master_manual)
1871 				v4l2_ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
1872 		}
1873 	}
1874 
1875 	v4l2_ctrl->elem_size = uvc_mapping_v4l2_size(mapping);
1876 	v4l2_ctrl->elems = 1;
1877 
1878 	if (v4l2_ctrl->type >= V4L2_CTRL_COMPOUND_TYPES) {
1879 		v4l2_ctrl->flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
1880 		v4l2_ctrl->default_value = 0;
1881 		v4l2_ctrl->minimum = 0;
1882 		v4l2_ctrl->maximum = 0;
1883 		v4l2_ctrl->step = 0;
1884 		return 0;
1885 	}
1886 
1887 	ret = __uvc_queryctrl_boundaries(chain, ctrl, mapping, v4l2_ctrl);
1888 	if (ret && !mapping->disabled) {
1889 		dev_warn(&chain->dev->intf->dev,
1890 			 "UVC non compliance: permanently disabling control %x (%s), due to error %d\n",
1891 			 mapping->id, uvc_map_get_name(mapping), ret);
1892 		mapping->disabled = true;
1893 	}
1894 
1895 	if (mapping->disabled)
1896 		v4l2_ctrl->flags |= V4L2_CTRL_FLAG_DISABLED;
1897 
1898 	return 0;
1899 }
1900 
1901 int uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
1902 			struct v4l2_query_ext_ctrl *v4l2_ctrl)
1903 {
1904 	struct uvc_control *ctrl;
1905 	struct uvc_control_mapping *mapping;
1906 	int ret;
1907 
1908 	ret = mutex_lock_interruptible(&chain->ctrl_mutex);
1909 	if (ret < 0)
1910 		return -ERESTARTSYS;
1911 
1912 	/* Check if the ctrl is a know class */
1913 	if (!(v4l2_ctrl->id & V4L2_CTRL_FLAG_NEXT_CTRL)) {
1914 		ret = uvc_query_v4l2_class(chain, v4l2_ctrl->id, 0, v4l2_ctrl);
1915 		if (!ret)
1916 			goto done;
1917 	}
1918 
1919 	ctrl = uvc_find_control(chain, v4l2_ctrl->id, &mapping);
1920 	if (ctrl == NULL) {
1921 		ret = -EINVAL;
1922 		goto done;
1923 	}
1924 
1925 	/*
1926 	 * If we're enumerating control with V4L2_CTRL_FLAG_NEXT_CTRL, check if
1927 	 * a class should be inserted between the previous control and the one
1928 	 * we have just found.
1929 	 */
1930 	if (v4l2_ctrl->id & V4L2_CTRL_FLAG_NEXT_CTRL) {
1931 		ret = uvc_query_v4l2_class(chain, v4l2_ctrl->id, mapping->id,
1932 					   v4l2_ctrl);
1933 		if (!ret)
1934 			goto done;
1935 	}
1936 
1937 	ret = __uvc_query_v4l2_ctrl(chain, ctrl, mapping, v4l2_ctrl);
1938 done:
1939 	mutex_unlock(&chain->ctrl_mutex);
1940 	return ret;
1941 }
1942 
1943 /*
1944  * Mapping V4L2 controls to UVC controls can be straightforward if done well.
1945  * Most of the UVC controls exist in V4L2, and can be mapped directly. Some
1946  * must be grouped (for instance the Red Balance, Blue Balance and Do White
1947  * Balance V4L2 controls use the White Balance Component UVC control) or
1948  * otherwise translated. The approach we take here is to use a translation
1949  * table for the controls that can be mapped directly, and handle the others
1950  * manually.
1951  */
1952 int uvc_query_v4l2_menu(struct uvc_video_chain *chain,
1953 	struct v4l2_querymenu *query_menu)
1954 {
1955 	struct uvc_control_mapping *mapping;
1956 	struct uvc_control *ctrl;
1957 	u32 index = query_menu->index;
1958 	u32 id = query_menu->id;
1959 	const char *name;
1960 	int ret;
1961 
1962 	memset(query_menu, 0, sizeof(*query_menu));
1963 	query_menu->id = id;
1964 	query_menu->index = index;
1965 
1966 	if (index >= BITS_PER_TYPE(mapping->menu_mask))
1967 		return -EINVAL;
1968 
1969 	ret = mutex_lock_interruptible(&chain->ctrl_mutex);
1970 	if (ret < 0)
1971 		return -ERESTARTSYS;
1972 
1973 	ctrl = uvc_find_control(chain, query_menu->id, &mapping);
1974 	if (ctrl == NULL || mapping->v4l2_type != V4L2_CTRL_TYPE_MENU) {
1975 		ret = -EINVAL;
1976 		goto done;
1977 	}
1978 
1979 	if (!test_bit(query_menu->index, &mapping->menu_mask)) {
1980 		ret = -EINVAL;
1981 		goto done;
1982 	}
1983 
1984 	if (mapping->data_type == UVC_CTRL_DATA_TYPE_BITMASK) {
1985 		int mask;
1986 
1987 		if (!ctrl->cached) {
1988 			ret = uvc_ctrl_populate_cache(chain, ctrl);
1989 			if (ret < 0)
1990 				goto done;
1991 		}
1992 
1993 		mask = uvc_mapping_get_menu_value(mapping, query_menu->index);
1994 		if (mask < 0) {
1995 			ret = mask;
1996 			goto done;
1997 		}
1998 
1999 		if (!(uvc_get_ctrl_bitmap(ctrl, mapping) & mask)) {
2000 			ret = -EINVAL;
2001 			goto done;
2002 		}
2003 	}
2004 
2005 	name = uvc_mapping_get_menu_name(mapping, query_menu->index);
2006 	if (!name) {
2007 		ret = -EINVAL;
2008 		goto done;
2009 	}
2010 
2011 	strscpy(query_menu->name, name, sizeof(query_menu->name));
2012 
2013 done:
2014 	mutex_unlock(&chain->ctrl_mutex);
2015 	return ret;
2016 }
2017 
2018 /* --------------------------------------------------------------------------
2019  * Ctrl event handling
2020  */
2021 
2022 static void uvc_ctrl_fill_event(struct uvc_video_chain *chain,
2023 	struct v4l2_event *ev,
2024 	struct uvc_control *ctrl,
2025 	struct uvc_control_mapping *mapping,
2026 	s32 value, u32 changes)
2027 {
2028 	struct v4l2_query_ext_ctrl v4l2_ctrl;
2029 
2030 	__uvc_query_v4l2_ctrl(chain, ctrl, mapping, &v4l2_ctrl);
2031 
2032 	memset(ev, 0, sizeof(*ev));
2033 	ev->type = V4L2_EVENT_CTRL;
2034 	ev->id = v4l2_ctrl.id;
2035 	ev->u.ctrl.value = value;
2036 	ev->u.ctrl.changes = changes;
2037 	ev->u.ctrl.type = v4l2_ctrl.type;
2038 	ev->u.ctrl.flags = v4l2_ctrl.flags;
2039 	ev->u.ctrl.minimum = v4l2_ctrl.minimum;
2040 	ev->u.ctrl.maximum = v4l2_ctrl.maximum;
2041 	ev->u.ctrl.step = v4l2_ctrl.step;
2042 	ev->u.ctrl.default_value = v4l2_ctrl.default_value;
2043 }
2044 
2045 /*
2046  * Send control change events to all subscribers for the @ctrl control. By
2047  * default the subscriber that generated the event, as identified by @handle,
2048  * is not notified unless it has set the V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK flag.
2049  * @handle can be NULL for asynchronous events related to auto-update controls,
2050  * in which case all subscribers are notified.
2051  */
2052 static void uvc_ctrl_send_event(struct uvc_video_chain *chain,
2053 	struct uvc_fh *handle, struct uvc_control *ctrl,
2054 	struct uvc_control_mapping *mapping, s32 value, u32 changes)
2055 {
2056 	struct v4l2_fh *originator = handle ? &handle->vfh : NULL;
2057 	struct v4l2_subscribed_event *sev;
2058 	struct v4l2_event ev;
2059 
2060 	if (list_empty(&mapping->ev_subs))
2061 		return;
2062 
2063 	uvc_ctrl_fill_event(chain, &ev, ctrl, mapping, value, changes);
2064 
2065 	list_for_each_entry(sev, &mapping->ev_subs, node) {
2066 		if (sev->fh != originator ||
2067 		    (sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK) ||
2068 		    (changes & V4L2_EVENT_CTRL_CH_FLAGS))
2069 			v4l2_event_queue_fh(sev->fh, &ev);
2070 	}
2071 }
2072 
2073 /*
2074  * Send control change events for the slave of the @master control identified
2075  * by the V4L2 ID @slave_id. The @handle identifies the event subscriber that
2076  * generated the event and may be NULL for auto-update events.
2077  */
2078 static void uvc_ctrl_send_slave_event(struct uvc_video_chain *chain,
2079 	struct uvc_fh *handle, struct uvc_control *master, u32 slave_id)
2080 {
2081 	struct uvc_control_mapping *mapping = NULL;
2082 	struct uvc_control *ctrl = NULL;
2083 	u32 changes = V4L2_EVENT_CTRL_CH_FLAGS;
2084 	s32 val = 0;
2085 
2086 	__uvc_find_control(master->entity, slave_id, &mapping, &ctrl, 0, 0);
2087 	if (ctrl == NULL)
2088 		return;
2089 
2090 	if (uvc_ctrl_mapping_is_compound(mapping) ||
2091 	    __uvc_ctrl_get(chain, ctrl, mapping, &val) == 0)
2092 		changes |= V4L2_EVENT_CTRL_CH_VALUE;
2093 
2094 	uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes);
2095 }
2096 
2097 static int uvc_ctrl_set_handle(struct uvc_control *ctrl, struct uvc_fh *handle)
2098 {
2099 	int ret;
2100 
2101 	lockdep_assert_held(&handle->chain->ctrl_mutex);
2102 
2103 	if (ctrl->handle) {
2104 		dev_warn_ratelimited(&handle->stream->dev->intf->dev,
2105 				     "UVC non compliance: Setting an async control with a pending operation.");
2106 
2107 		if (ctrl->handle == handle)
2108 			return 0;
2109 
2110 		WARN_ON(!ctrl->handle->pending_async_ctrls);
2111 		if (ctrl->handle->pending_async_ctrls)
2112 			ctrl->handle->pending_async_ctrls--;
2113 		ctrl->handle = handle;
2114 		ctrl->handle->pending_async_ctrls++;
2115 		return 0;
2116 	}
2117 
2118 	ret = uvc_pm_get(handle->chain->dev);
2119 	if (ret)
2120 		return ret;
2121 
2122 	ctrl->handle = handle;
2123 	ctrl->handle->pending_async_ctrls++;
2124 	return 0;
2125 }
2126 
2127 static int uvc_ctrl_clear_handle(struct uvc_control *ctrl)
2128 {
2129 	lockdep_assert_held(&ctrl->handle->chain->ctrl_mutex);
2130 
2131 	if (WARN_ON(!ctrl->handle->pending_async_ctrls)) {
2132 		ctrl->handle = NULL;
2133 		return -EINVAL;
2134 	}
2135 
2136 	ctrl->handle->pending_async_ctrls--;
2137 	uvc_pm_put(ctrl->handle->chain->dev);
2138 	ctrl->handle = NULL;
2139 	return 0;
2140 }
2141 
2142 void uvc_ctrl_status_event(struct uvc_video_chain *chain,
2143 			   struct uvc_control *ctrl, const u8 *data)
2144 {
2145 	struct uvc_control_mapping *mapping;
2146 	struct uvc_fh *handle;
2147 	unsigned int i;
2148 
2149 	mutex_lock(&chain->ctrl_mutex);
2150 
2151 	/* Flush the control cache, the data might have changed. */
2152 	ctrl->loaded = 0;
2153 
2154 	handle = ctrl->handle;
2155 	if (handle)
2156 		uvc_ctrl_clear_handle(ctrl);
2157 
2158 	list_for_each_entry(mapping, &ctrl->info.mappings, list) {
2159 		s32 value;
2160 
2161 		if (uvc_ctrl_mapping_is_compound(mapping))
2162 			value = 0;
2163 		else
2164 			value = uvc_mapping_get_s32(mapping, UVC_GET_CUR, data);
2165 
2166 		/*
2167 		 * handle may be NULL here if the device sends auto-update
2168 		 * events without a prior related control set from userspace.
2169 		 */
2170 		for (i = 0; i < ARRAY_SIZE(mapping->slave_ids); ++i) {
2171 			if (!mapping->slave_ids[i])
2172 				break;
2173 
2174 			uvc_ctrl_send_slave_event(chain, handle, ctrl,
2175 						  mapping->slave_ids[i]);
2176 		}
2177 
2178 		uvc_ctrl_send_event(chain, handle, ctrl, mapping, value,
2179 				    V4L2_EVENT_CTRL_CH_VALUE);
2180 	}
2181 
2182 	mutex_unlock(&chain->ctrl_mutex);
2183 }
2184 
2185 static void uvc_ctrl_status_event_work(struct work_struct *work)
2186 {
2187 	struct uvc_device *dev = container_of(work, struct uvc_device,
2188 					      async_ctrl.work);
2189 	struct uvc_ctrl_work *w = &dev->async_ctrl;
2190 	int ret;
2191 
2192 	uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
2193 
2194 	/* The barrier is needed to synchronize with uvc_status_stop(). */
2195 	if (smp_load_acquire(&dev->flush_status))
2196 		return;
2197 
2198 	/* Resubmit the URB. */
2199 	w->urb->interval = dev->int_ep->desc.bInterval;
2200 	ret = usb_submit_urb(w->urb, GFP_KERNEL);
2201 	if (ret < 0)
2202 		dev_err(&dev->intf->dev,
2203 			"Failed to resubmit status URB (%d).\n", ret);
2204 }
2205 
2206 bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain,
2207 				 struct uvc_control *ctrl, const u8 *data)
2208 {
2209 	struct uvc_device *dev = chain->dev;
2210 	struct uvc_ctrl_work *w = &dev->async_ctrl;
2211 
2212 	if (list_empty(&ctrl->info.mappings))
2213 		return false;
2214 
2215 	w->data = data;
2216 	w->urb = urb;
2217 	w->chain = chain;
2218 	w->ctrl = ctrl;
2219 
2220 	schedule_work(&w->work);
2221 
2222 	return true;
2223 }
2224 
2225 static bool uvc_ctrl_xctrls_has_control(const struct v4l2_ext_control *xctrls,
2226 					unsigned int xctrls_count, u32 id)
2227 {
2228 	unsigned int i;
2229 
2230 	for (i = 0; i < xctrls_count; ++i) {
2231 		if (xctrls[i].id == id)
2232 			return true;
2233 	}
2234 
2235 	return false;
2236 }
2237 
2238 static void uvc_ctrl_send_events(struct uvc_fh *handle,
2239 				 struct uvc_entity *entity,
2240 				 const struct v4l2_ext_control *xctrls,
2241 				 unsigned int xctrls_count)
2242 {
2243 	struct uvc_control_mapping *mapping;
2244 	struct uvc_control *ctrl;
2245 	unsigned int i;
2246 	unsigned int j;
2247 
2248 	for (i = 0; i < xctrls_count; ++i) {
2249 		u32 changes = V4L2_EVENT_CTRL_CH_VALUE;
2250 		s32 value;
2251 
2252 		ctrl = uvc_find_control(handle->chain, xctrls[i].id, &mapping);
2253 		if (ctrl->entity != entity)
2254 			continue;
2255 
2256 		if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
2257 			/* Notification will be sent from an Interrupt event. */
2258 			continue;
2259 
2260 		for (j = 0; j < ARRAY_SIZE(mapping->slave_ids); ++j) {
2261 			u32 slave_id = mapping->slave_ids[j];
2262 
2263 			if (!slave_id)
2264 				break;
2265 
2266 			/*
2267 			 * We can skip sending an event for the slave if the
2268 			 * slave is being modified in the same transaction.
2269 			 */
2270 			if (uvc_ctrl_xctrls_has_control(xctrls, xctrls_count,
2271 							slave_id))
2272 				continue;
2273 
2274 			uvc_ctrl_send_slave_event(handle->chain, handle, ctrl,
2275 						  slave_id);
2276 		}
2277 
2278 		if (uvc_ctrl_mapping_is_compound(mapping))
2279 			value = 0;
2280 		else
2281 			value = xctrls[i].value;
2282 		/*
2283 		 * If the master is being modified in the same transaction
2284 		 * flags may change too.
2285 		 */
2286 		if (mapping->master_id &&
2287 		    uvc_ctrl_xctrls_has_control(xctrls, xctrls_count,
2288 						mapping->master_id))
2289 			changes |= V4L2_EVENT_CTRL_CH_FLAGS;
2290 
2291 		uvc_ctrl_send_event(handle->chain, handle, ctrl, mapping,
2292 				    value, changes);
2293 	}
2294 }
2295 
2296 static int uvc_ctrl_add_event(struct v4l2_subscribed_event *sev, unsigned elems)
2297 {
2298 	struct uvc_fh *handle = container_of(sev->fh, struct uvc_fh, vfh);
2299 	struct uvc_control_mapping *mapping;
2300 	struct uvc_control *ctrl;
2301 	int ret;
2302 
2303 	ret = mutex_lock_interruptible(&handle->chain->ctrl_mutex);
2304 	if (ret < 0)
2305 		return -ERESTARTSYS;
2306 
2307 	if (__uvc_query_v4l2_class(handle->chain, sev->id, 0) >= 0) {
2308 		ret = 0;
2309 		goto done;
2310 	}
2311 
2312 	ctrl = uvc_find_control(handle->chain, sev->id, &mapping);
2313 	if (ctrl == NULL) {
2314 		ret = -EINVAL;
2315 		goto done;
2316 	}
2317 
2318 	if (sev->flags & V4L2_EVENT_SUB_FL_SEND_INITIAL) {
2319 		struct v4l2_event ev;
2320 		u32 changes = V4L2_EVENT_CTRL_CH_FLAGS;
2321 		s32 val = 0;
2322 
2323 		ret = uvc_pm_get(handle->chain->dev);
2324 		if (ret)
2325 			goto done;
2326 
2327 		if (uvc_ctrl_mapping_is_compound(mapping) ||
2328 		    __uvc_ctrl_get(handle->chain, ctrl, mapping, &val) == 0)
2329 			changes |= V4L2_EVENT_CTRL_CH_VALUE;
2330 
2331 		uvc_ctrl_fill_event(handle->chain, &ev, ctrl, mapping, val,
2332 				    changes);
2333 
2334 		uvc_pm_put(handle->chain->dev);
2335 
2336 		/*
2337 		 * Mark the queue as active, allowing this initial event to be
2338 		 * accepted.
2339 		 */
2340 		sev->elems = elems;
2341 		v4l2_event_queue_fh(sev->fh, &ev);
2342 	}
2343 
2344 	list_add_tail(&sev->node, &mapping->ev_subs);
2345 
2346 done:
2347 	mutex_unlock(&handle->chain->ctrl_mutex);
2348 	return ret;
2349 }
2350 
2351 static void uvc_ctrl_del_event(struct v4l2_subscribed_event *sev)
2352 {
2353 	struct uvc_fh *handle = container_of(sev->fh, struct uvc_fh, vfh);
2354 
2355 	mutex_lock(&handle->chain->ctrl_mutex);
2356 	if (__uvc_query_v4l2_class(handle->chain, sev->id, 0) >= 0)
2357 		goto done;
2358 	list_del(&sev->node);
2359 done:
2360 	mutex_unlock(&handle->chain->ctrl_mutex);
2361 }
2362 
2363 const struct v4l2_subscribed_event_ops uvc_ctrl_sub_ev_ops = {
2364 	.add = uvc_ctrl_add_event,
2365 	.del = uvc_ctrl_del_event,
2366 	.replace = v4l2_ctrl_replace,
2367 	.merge = v4l2_ctrl_merge,
2368 };
2369 
2370 /* --------------------------------------------------------------------------
2371  * Control transactions
2372  *
2373  * To make extended set operations as atomic as the hardware allows, controls
2374  * are handled using begin/commit/rollback operations.
2375  *
2376  * At the beginning of a set request, uvc_ctrl_begin should be called to
2377  * initialize the request. This function acquires the control lock.
2378  *
2379  * When setting a control, the new value is stored in the control data field
2380  * at position UVC_CTRL_DATA_CURRENT. The control is then marked as dirty for
2381  * later processing. If the UVC and V4L2 control sizes differ, the current
2382  * value is loaded from the hardware before storing the new value in the data
2383  * field.
2384  *
2385  * After processing all controls in the transaction, uvc_ctrl_commit or
2386  * uvc_ctrl_rollback must be called to apply the pending changes to the
2387  * hardware or revert them. When applying changes, all controls marked as
2388  * dirty will be modified in the UVC device, and the dirty flag will be
2389  * cleared. When reverting controls, the control data field
2390  * UVC_CTRL_DATA_CURRENT is reverted to its previous value
2391  * (UVC_CTRL_DATA_BACKUP) for all dirty controls. Both functions release the
2392  * control lock.
2393  */
2394 int uvc_ctrl_begin(struct uvc_video_chain *chain)
2395 {
2396 	return mutex_lock_interruptible(&chain->ctrl_mutex) ? -ERESTARTSYS : 0;
2397 }
2398 
2399 /*
2400  * Returns the number of uvc controls that have been correctly set, or a
2401  * negative number if there has been an error.
2402  */
2403 static int uvc_ctrl_commit_entity(struct uvc_device *dev,
2404 				  struct uvc_fh *handle,
2405 				  struct uvc_entity *entity,
2406 				  int rollback,
2407 				  struct uvc_control **err_ctrl)
2408 {
2409 	unsigned int processed_ctrls = 0;
2410 	struct uvc_control *ctrl;
2411 	unsigned int i;
2412 	int ret = 0;
2413 
2414 	if (entity == NULL)
2415 		return 0;
2416 
2417 	for (i = 0; i < entity->ncontrols; ++i) {
2418 		ctrl = &entity->controls[i];
2419 		if (!ctrl->initialized)
2420 			continue;
2421 
2422 		/*
2423 		 * Reset the loaded flag for auto-update controls that were
2424 		 * marked as loaded in uvc_ctrl_get/uvc_ctrl_set to prevent
2425 		 * uvc_ctrl_get from using the cached value, and for write-only
2426 		 * controls to prevent uvc_ctrl_set from setting bits not
2427 		 * explicitly set by the user.
2428 		 */
2429 		if (ctrl->info.flags & UVC_CTRL_FLAG_AUTO_UPDATE ||
2430 		    !(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR))
2431 			ctrl->loaded = 0;
2432 
2433 		if (!ctrl->dirty)
2434 			continue;
2435 
2436 		if (!rollback)
2437 			ret = uvc_query_ctrl(dev, UVC_SET_CUR, ctrl->entity->id,
2438 				dev->intfnum, ctrl->info.selector,
2439 				uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT),
2440 				ctrl->info.size);
2441 
2442 		if (!ret)
2443 			processed_ctrls++;
2444 
2445 		if (rollback || ret < 0)
2446 			memcpy(uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT),
2447 			       uvc_ctrl_data(ctrl, UVC_CTRL_DATA_BACKUP),
2448 			       ctrl->info.size);
2449 
2450 		ctrl->dirty = 0;
2451 
2452 		if (!rollback && handle && !ret &&
2453 		    ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
2454 			ret = uvc_ctrl_set_handle(ctrl, handle);
2455 
2456 		if (ret < 0 && !rollback) {
2457 			if (err_ctrl)
2458 				*err_ctrl = ctrl;
2459 			/*
2460 			 * If we fail to set a control, we need to rollback
2461 			 * the next ones.
2462 			 */
2463 			rollback = 1;
2464 		}
2465 	}
2466 
2467 	if (ret)
2468 		return ret;
2469 
2470 	return processed_ctrls;
2471 }
2472 
2473 static int uvc_ctrl_find_ctrl_idx(struct uvc_entity *entity,
2474 				  struct v4l2_ext_controls *ctrls,
2475 				  struct uvc_control *uvc_control)
2476 {
2477 	struct uvc_control_mapping *mapping = NULL;
2478 	struct uvc_control *ctrl_found = NULL;
2479 	unsigned int i;
2480 
2481 	if (!entity)
2482 		return ctrls->count;
2483 
2484 	for (i = 0; i < ctrls->count; i++) {
2485 		__uvc_find_control(entity, ctrls->controls[i].id, &mapping,
2486 				   &ctrl_found, 0, 0);
2487 		if (uvc_control == ctrl_found)
2488 			return i;
2489 	}
2490 
2491 	return ctrls->count;
2492 }
2493 
2494 int __uvc_ctrl_commit(struct uvc_fh *handle, int rollback,
2495 		      struct v4l2_ext_controls *ctrls)
2496 {
2497 	struct uvc_video_chain *chain = handle->chain;
2498 	struct uvc_control *err_ctrl;
2499 	struct uvc_entity *entity;
2500 	int ret_out = 0;
2501 	int ret;
2502 
2503 	/* Find the control. */
2504 	list_for_each_entry(entity, &chain->entities, chain) {
2505 		ret = uvc_ctrl_commit_entity(chain->dev, handle, entity,
2506 					     rollback, &err_ctrl);
2507 		if (ret < 0) {
2508 			if (ctrls)
2509 				ctrls->error_idx =
2510 					uvc_ctrl_find_ctrl_idx(entity, ctrls,
2511 							       err_ctrl);
2512 			/*
2513 			 * When we fail to commit an entity, we need to
2514 			 * restore the UVC_CTRL_DATA_BACKUP for all the
2515 			 * controls in the other entities, otherwise our cache
2516 			 * and the hardware will be out of sync.
2517 			 */
2518 			rollback = 1;
2519 
2520 			ret_out = ret;
2521 		} else if (ret > 0 && !rollback) {
2522 			uvc_ctrl_send_events(handle, entity,
2523 					     ctrls->controls, ctrls->count);
2524 		}
2525 	}
2526 
2527 	mutex_unlock(&chain->ctrl_mutex);
2528 	return ret_out;
2529 }
2530 
2531 static int uvc_mapping_get_xctrl_compound(struct uvc_video_chain *chain,
2532 					  struct uvc_control *ctrl,
2533 					  struct uvc_control_mapping *mapping,
2534 					  u32 which,
2535 					  struct v4l2_ext_control *xctrl)
2536 {
2537 	u8 *data __free(kfree) = NULL;
2538 	size_t size;
2539 	u8 query;
2540 	int ret;
2541 	int id;
2542 
2543 	switch (which) {
2544 	case V4L2_CTRL_WHICH_CUR_VAL:
2545 		id = UVC_CTRL_DATA_CURRENT;
2546 		query = UVC_GET_CUR;
2547 		break;
2548 	case V4L2_CTRL_WHICH_MIN_VAL:
2549 		id = UVC_CTRL_DATA_MIN;
2550 		query = UVC_GET_MIN;
2551 		break;
2552 	case V4L2_CTRL_WHICH_MAX_VAL:
2553 		id = UVC_CTRL_DATA_MAX;
2554 		query = UVC_GET_MAX;
2555 		break;
2556 	case V4L2_CTRL_WHICH_DEF_VAL:
2557 		id = UVC_CTRL_DATA_DEF;
2558 		query = UVC_GET_DEF;
2559 		break;
2560 	default:
2561 		return -EINVAL;
2562 	}
2563 
2564 	size = uvc_mapping_v4l2_size(mapping);
2565 	if (xctrl->size < size) {
2566 		xctrl->size = size;
2567 		return -ENOSPC;
2568 	}
2569 
2570 	data = kmalloc(size, GFP_KERNEL);
2571 	if (!data)
2572 		return -ENOMEM;
2573 
2574 	if (which == V4L2_CTRL_WHICH_CUR_VAL)
2575 		ret = __uvc_ctrl_load_cur(chain, ctrl);
2576 	else
2577 		ret = uvc_ctrl_populate_cache(chain, ctrl);
2578 
2579 	if (ret < 0)
2580 		return ret;
2581 
2582 	ret = mapping->get(mapping, query, uvc_ctrl_data(ctrl, id), size, data);
2583 	if (ret < 0)
2584 		return ret;
2585 
2586 	/*
2587 	 * v4l2_ext_control does not have enough room to fit a compound control.
2588 	 * Instead, the value is in the user memory at xctrl->ptr. The v4l2
2589 	 * ioctl helper does not copy it for us.
2590 	 */
2591 	return copy_to_user(xctrl->ptr, data, size) ? -EFAULT : 0;
2592 }
2593 
2594 static int uvc_mapping_get_xctrl_std(struct uvc_video_chain *chain,
2595 				     struct uvc_control *ctrl,
2596 				     struct uvc_control_mapping *mapping,
2597 				     u32 which, struct v4l2_ext_control *xctrl)
2598 {
2599 	struct v4l2_query_ext_ctrl qec;
2600 	int ret;
2601 
2602 	switch (which) {
2603 	case V4L2_CTRL_WHICH_CUR_VAL:
2604 		return __uvc_ctrl_get(chain, ctrl, mapping, &xctrl->value);
2605 	case V4L2_CTRL_WHICH_DEF_VAL:
2606 	case V4L2_CTRL_WHICH_MIN_VAL:
2607 	case V4L2_CTRL_WHICH_MAX_VAL:
2608 		break;
2609 	default:
2610 		return -EINVAL;
2611 	}
2612 
2613 	ret = __uvc_queryctrl_boundaries(chain, ctrl, mapping, &qec);
2614 	if (ret < 0)
2615 		return ret;
2616 
2617 	switch (which) {
2618 	case V4L2_CTRL_WHICH_DEF_VAL:
2619 		xctrl->value = qec.default_value;
2620 		break;
2621 	case V4L2_CTRL_WHICH_MIN_VAL:
2622 		xctrl->value = qec.minimum;
2623 		break;
2624 	case V4L2_CTRL_WHICH_MAX_VAL:
2625 		xctrl->value = qec.maximum;
2626 		break;
2627 	}
2628 
2629 	return 0;
2630 }
2631 
2632 static int uvc_mapping_get_xctrl(struct uvc_video_chain *chain,
2633 				 struct uvc_control *ctrl,
2634 				 struct uvc_control_mapping *mapping,
2635 				 u32 which, struct v4l2_ext_control *xctrl)
2636 {
2637 	if (uvc_ctrl_mapping_is_compound(mapping))
2638 		return uvc_mapping_get_xctrl_compound(chain, ctrl, mapping,
2639 						      which, xctrl);
2640 	return uvc_mapping_get_xctrl_std(chain, ctrl, mapping, which, xctrl);
2641 }
2642 
2643 int uvc_ctrl_get(struct uvc_video_chain *chain, u32 which,
2644 		 struct v4l2_ext_control *xctrl)
2645 {
2646 	struct uvc_control *ctrl;
2647 	struct uvc_control_mapping *mapping;
2648 
2649 	if (__uvc_query_v4l2_class(chain, xctrl->id, 0) >= 0)
2650 		return -EACCES;
2651 
2652 	ctrl = uvc_find_control(chain, xctrl->id, &mapping);
2653 	if (!ctrl)
2654 		return -EINVAL;
2655 
2656 	return uvc_mapping_get_xctrl(chain, ctrl, mapping, which, xctrl);
2657 }
2658 
2659 static int uvc_ctrl_clamp(struct uvc_video_chain *chain,
2660 			  struct uvc_control *ctrl,
2661 			  u32 v4l2_id,
2662 			  struct uvc_control_mapping *mapping,
2663 			  s32 *value_in_out)
2664 {
2665 	s32 value = *value_in_out;
2666 	u32 step;
2667 	s32 min;
2668 	s32 max;
2669 	int ret;
2670 
2671 	switch (mapping->v4l2_type) {
2672 	case V4L2_CTRL_TYPE_INTEGER:
2673 		if (!ctrl->cached) {
2674 			ret = uvc_ctrl_populate_cache(chain, ctrl);
2675 			if (ret < 0)
2676 				return ret;
2677 		}
2678 
2679 		max = uvc_mapping_get_s32(mapping, UVC_GET_MAX,
2680 					  uvc_ctrl_data(ctrl, UVC_CTRL_DATA_MAX));
2681 		/*
2682 		 * For relative PTZ controls, UVC_GET_MIN for
2683 		 * b(Pan|Tilt|Zoom)Speed returns the minimum speed of the
2684 		 * movement in direction specified in the sign field.
2685 		 * See in USB Device Class Definition for Video Devices:
2686 		 * 4.2.2.1.13 Zoom (Relative) Control
2687 		 * 4.2.2.1.15 PanTilt (Relative) Control
2688 		 *
2689 		 * For minimum value, use maximum speed but in negative direction.
2690 		 */
2691 		if (uvc_ctrl_is_relative_ptz(v4l2_id))
2692 			min = -max;
2693 		else
2694 			min = uvc_mapping_get_s32(mapping, UVC_GET_MIN,
2695 					uvc_ctrl_data(ctrl, UVC_CTRL_DATA_MIN));
2696 
2697 		step = uvc_mapping_get_s32(mapping, UVC_GET_RES,
2698 					   uvc_ctrl_data(ctrl, UVC_CTRL_DATA_RES));
2699 		if (step == 0)
2700 			step = 1;
2701 
2702 		value = min + DIV_ROUND_CLOSEST((u32)(value - min), step) * step;
2703 		if (mapping->data_type == UVC_CTRL_DATA_TYPE_SIGNED)
2704 			value = clamp(value, min, max);
2705 		else
2706 			value = clamp_t(u32, value, min, max);
2707 		*value_in_out = value;
2708 		return 0;
2709 
2710 	case V4L2_CTRL_TYPE_BITMASK:
2711 		if (!ctrl->cached) {
2712 			ret = uvc_ctrl_populate_cache(chain, ctrl);
2713 			if (ret < 0)
2714 				return ret;
2715 		}
2716 
2717 		value &= uvc_get_ctrl_bitmap(ctrl, mapping);
2718 		*value_in_out = value;
2719 		return 0;
2720 
2721 	case V4L2_CTRL_TYPE_BOOLEAN:
2722 		*value_in_out = clamp(value, 0, 1);
2723 		return 0;
2724 
2725 	case V4L2_CTRL_TYPE_MENU:
2726 		if (value < (ffs(mapping->menu_mask) - 1) ||
2727 		    value > (fls(mapping->menu_mask) - 1))
2728 			return -ERANGE;
2729 
2730 		if (!test_bit(value, &mapping->menu_mask))
2731 			return -EINVAL;
2732 
2733 		/*
2734 		 * Valid menu indices are reported by the GET_RES request for
2735 		 * UVC controls that support it.
2736 		 */
2737 		if (mapping->data_type == UVC_CTRL_DATA_TYPE_BITMASK) {
2738 			int val = uvc_mapping_get_menu_value(mapping, value);
2739 			if (!ctrl->cached) {
2740 				ret = uvc_ctrl_populate_cache(chain, ctrl);
2741 				if (ret < 0)
2742 					return ret;
2743 			}
2744 
2745 			if (!(uvc_get_ctrl_bitmap(ctrl, mapping) & val))
2746 				return -EINVAL;
2747 		}
2748 		return 0;
2749 
2750 	default:
2751 		return 0;
2752 	}
2753 
2754 	return 0;
2755 }
2756 
2757 static int uvc_mapping_set_xctrl_compound(struct uvc_control *ctrl,
2758 					  struct uvc_control_mapping *mapping,
2759 					  struct v4l2_ext_control *xctrl)
2760 {
2761 	u8 *data __free(kfree) = NULL;
2762 	size_t size = uvc_mapping_v4l2_size(mapping);
2763 
2764 	if (xctrl->size != size)
2765 		return -EINVAL;
2766 
2767 	/*
2768 	 * v4l2_ext_control does not have enough room to fit a compound control.
2769 	 * Instead, the value is in the user memory at xctrl->ptr. The v4l2
2770 	 * ioctl helper does not copy it for us.
2771 	 */
2772 	data = memdup_user(xctrl->ptr, size);
2773 	if (IS_ERR(data))
2774 		return PTR_ERR(data);
2775 
2776 	return mapping->set(mapping, size, data,
2777 			    uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT));
2778 }
2779 
2780 static int uvc_mapping_set_xctrl(struct uvc_control *ctrl,
2781 				 struct uvc_control_mapping *mapping,
2782 				 struct v4l2_ext_control *xctrl)
2783 {
2784 	if (uvc_ctrl_mapping_is_compound(mapping))
2785 		return uvc_mapping_set_xctrl_compound(ctrl, mapping, xctrl);
2786 
2787 	uvc_mapping_set_s32(mapping, xctrl->value,
2788 			    uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT));
2789 	return 0;
2790 }
2791 
2792 int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl)
2793 {
2794 	struct uvc_video_chain *chain = handle->chain;
2795 	struct uvc_control_mapping *mapping;
2796 	struct uvc_control *ctrl;
2797 	int ret;
2798 
2799 	lockdep_assert_held(&chain->ctrl_mutex);
2800 
2801 	if (__uvc_query_v4l2_class(chain, xctrl->id, 0) >= 0)
2802 		return -EACCES;
2803 
2804 	ctrl = uvc_find_control(chain, xctrl->id, &mapping);
2805 	if (!ctrl)
2806 		return -EINVAL;
2807 	if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR))
2808 		return -EACCES;
2809 
2810 	ret = uvc_ctrl_clamp(chain, ctrl, xctrl->id, mapping, &xctrl->value);
2811 	if (ret)
2812 		return ret;
2813 	/*
2814 	 * If the mapping doesn't span the whole UVC control, the current value
2815 	 * needs to be loaded from the device to perform the read-modify-write
2816 	 * operation.
2817 	 */
2818 	if ((ctrl->info.size * 8) != mapping->size) {
2819 		ret = __uvc_ctrl_load_cur(chain, ctrl);
2820 		if (ret < 0)
2821 			return ret;
2822 	}
2823 
2824 	/* Backup the current value in case we need to rollback later. */
2825 	if (!ctrl->dirty) {
2826 		memcpy(uvc_ctrl_data(ctrl, UVC_CTRL_DATA_BACKUP),
2827 		       uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT),
2828 		       ctrl->info.size);
2829 	}
2830 
2831 	ret = uvc_mapping_set_xctrl(ctrl, mapping, xctrl);
2832 	if (ret)
2833 		return ret;
2834 
2835 	ctrl->dirty = 1;
2836 	ctrl->modified = 1;
2837 	return 0;
2838 }
2839 
2840 /* --------------------------------------------------------------------------
2841  * Dynamic controls
2842  */
2843 
2844 /*
2845  * Retrieve flags for a given control
2846  */
2847 static int uvc_ctrl_get_flags(struct uvc_device *dev,
2848 			      const struct uvc_control *ctrl,
2849 			      struct uvc_control_info *info)
2850 {
2851 	u8 *data;
2852 	int ret;
2853 
2854 	data = kmalloc(1, GFP_KERNEL);
2855 	if (data == NULL)
2856 		return -ENOMEM;
2857 
2858 	if (ctrl->entity->get_info)
2859 		ret = ctrl->entity->get_info(dev, ctrl->entity,
2860 					     ctrl->info.selector, data);
2861 	else
2862 		ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id,
2863 				     dev->intfnum, info->selector, data, 1);
2864 
2865 	if (!ret) {
2866 		info->flags &= ~(UVC_CTRL_FLAG_GET_CUR |
2867 				 UVC_CTRL_FLAG_SET_CUR |
2868 				 UVC_CTRL_FLAG_AUTO_UPDATE |
2869 				 UVC_CTRL_FLAG_ASYNCHRONOUS);
2870 
2871 		info->flags |= (data[0] & UVC_CONTROL_CAP_GET ?
2872 				UVC_CTRL_FLAG_GET_CUR : 0)
2873 			    |  (data[0] & UVC_CONTROL_CAP_SET ?
2874 				UVC_CTRL_FLAG_SET_CUR : 0)
2875 			    |  (data[0] & UVC_CONTROL_CAP_AUTOUPDATE ?
2876 				UVC_CTRL_FLAG_AUTO_UPDATE : 0)
2877 			    |  (data[0] & UVC_CONTROL_CAP_ASYNCHRONOUS ?
2878 				UVC_CTRL_FLAG_ASYNCHRONOUS : 0);
2879 	}
2880 
2881 	kfree(data);
2882 	return ret;
2883 }
2884 
2885 static void uvc_ctrl_fixup_xu_info(struct uvc_device *dev,
2886 	const struct uvc_control *ctrl, struct uvc_control_info *info)
2887 {
2888 	struct uvc_ctrl_fixup {
2889 		struct usb_device_id id;
2890 		u8 entity;
2891 		u8 selector;
2892 		u8 flags;
2893 	};
2894 
2895 	static const struct uvc_ctrl_fixup fixups[] = {
2896 		{ { USB_DEVICE(0x046d, 0x08c2) }, 9, 1,
2897 			UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX |
2898 			UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_SET_CUR |
2899 			UVC_CTRL_FLAG_AUTO_UPDATE },
2900 		{ { USB_DEVICE(0x046d, 0x08cc) }, 9, 1,
2901 			UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX |
2902 			UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_SET_CUR |
2903 			UVC_CTRL_FLAG_AUTO_UPDATE },
2904 		{ { USB_DEVICE(0x046d, 0x0994) }, 9, 1,
2905 			UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX |
2906 			UVC_CTRL_FLAG_GET_DEF | UVC_CTRL_FLAG_SET_CUR |
2907 			UVC_CTRL_FLAG_AUTO_UPDATE },
2908 	};
2909 
2910 	unsigned int i;
2911 
2912 	for (i = 0; i < ARRAY_SIZE(fixups); ++i) {
2913 		if (!usb_match_one_id(dev->intf, &fixups[i].id))
2914 			continue;
2915 
2916 		if (fixups[i].entity == ctrl->entity->id &&
2917 		    fixups[i].selector == info->selector) {
2918 			info->flags = fixups[i].flags;
2919 			return;
2920 		}
2921 	}
2922 }
2923 
2924 /*
2925  * Query control information (size and flags) for XU controls.
2926  */
2927 static int uvc_ctrl_fill_xu_info(struct uvc_device *dev,
2928 	const struct uvc_control *ctrl, struct uvc_control_info *info)
2929 {
2930 	u8 *data;
2931 	int ret;
2932 
2933 	data = kmalloc(2, GFP_KERNEL);
2934 	if (data == NULL)
2935 		return -ENOMEM;
2936 
2937 	memcpy(info->entity, ctrl->entity->guid, sizeof(info->entity));
2938 	info->index = ctrl->index;
2939 	info->selector = ctrl->index + 1;
2940 
2941 	/* Query and verify the control length (GET_LEN) */
2942 	ret = uvc_query_ctrl(dev, UVC_GET_LEN, ctrl->entity->id, dev->intfnum,
2943 			     info->selector, data, 2);
2944 	if (ret < 0) {
2945 		uvc_dbg(dev, CONTROL,
2946 			"GET_LEN failed on control %pUl/%u (%d)\n",
2947 			info->entity, info->selector, ret);
2948 		goto done;
2949 	}
2950 
2951 	info->size = le16_to_cpup((__le16 *)data);
2952 
2953 	info->flags = UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX
2954 		    | UVC_CTRL_FLAG_GET_RES | UVC_CTRL_FLAG_GET_DEF;
2955 
2956 	ret = uvc_ctrl_get_flags(dev, ctrl, info);
2957 	if (ret < 0) {
2958 		uvc_dbg(dev, CONTROL,
2959 			"Failed to get flags for control %pUl/%u (%d)\n",
2960 			info->entity, info->selector, ret);
2961 		goto done;
2962 	}
2963 
2964 	uvc_ctrl_fixup_xu_info(dev, ctrl, info);
2965 
2966 	uvc_dbg(dev, CONTROL,
2967 		"XU control %pUl/%u queried: len %u, flags { get %u set %u auto %u }\n",
2968 		info->entity, info->selector, info->size,
2969 		(info->flags & UVC_CTRL_FLAG_GET_CUR) ? 1 : 0,
2970 		(info->flags & UVC_CTRL_FLAG_SET_CUR) ? 1 : 0,
2971 		(info->flags & UVC_CTRL_FLAG_AUTO_UPDATE) ? 1 : 0);
2972 
2973 done:
2974 	kfree(data);
2975 	return ret;
2976 }
2977 
2978 static int uvc_ctrl_add_info(struct uvc_device *dev, struct uvc_control *ctrl,
2979 	const struct uvc_control_info *info);
2980 
2981 static int uvc_ctrl_init_xu_ctrl(struct uvc_device *dev,
2982 	struct uvc_control *ctrl)
2983 {
2984 	struct uvc_control_info info;
2985 	int ret;
2986 
2987 	if (ctrl->initialized)
2988 		return 0;
2989 
2990 	ret = uvc_ctrl_fill_xu_info(dev, ctrl, &info);
2991 	if (ret < 0)
2992 		return ret;
2993 
2994 	ret = uvc_ctrl_add_info(dev, ctrl, &info);
2995 	if (ret < 0)
2996 		uvc_dbg(dev, CONTROL,
2997 			"Failed to initialize control %pUl/%u on device %s entity %u\n",
2998 			info.entity, info.selector, dev->udev->devpath,
2999 			ctrl->entity->id);
3000 
3001 	return ret;
3002 }
3003 
3004 bool uvc_ctrl_is_privacy_control(u8 entity[16], u8 selector)
3005 {
3006 	/*
3007 	 * This list is not exhaustive, it is a best effort to block access to
3008 	 * non documented controls that can affect user's privacy.
3009 	 */
3010 	struct privacy_control {
3011 		u8 entity[16];
3012 		u8 selector;
3013 	} privacy_control[] = {
3014 		{
3015 			.entity = UVC_GUID_LOGITECH_USER_HW_CONTROL_V1,
3016 			.selector = 1,
3017 		},
3018 		{
3019 			.entity = UVC_GUID_LOGITECH_PERIPHERAL,
3020 			.selector = 9,
3021 		},
3022 	};
3023 	int i;
3024 
3025 	for (i = 0; i < ARRAY_SIZE(privacy_control); i++)
3026 		if (!memcmp(entity, privacy_control[i].entity, 16) &&
3027 		    selector == privacy_control[i].selector)
3028 			return true;
3029 
3030 	return false;
3031 }
3032 
3033 int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
3034 	struct uvc_xu_control_query *xqry)
3035 {
3036 	struct uvc_entity *entity, *iter;
3037 	struct uvc_control *ctrl;
3038 	unsigned int i;
3039 	bool found;
3040 	u32 reqflags;
3041 	u16 size;
3042 	u8 *data = NULL;
3043 	int ret;
3044 
3045 	/* Find the extension unit. */
3046 	entity = NULL;
3047 	list_for_each_entry(iter, &chain->entities, chain) {
3048 		if (UVC_ENTITY_TYPE(iter) == UVC_VC_EXTENSION_UNIT &&
3049 		    iter->id == xqry->unit) {
3050 			entity = iter;
3051 			break;
3052 		}
3053 	}
3054 
3055 	if (!entity) {
3056 		uvc_dbg(chain->dev, CONTROL, "Extension unit %u not found\n",
3057 			xqry->unit);
3058 		return -ENOENT;
3059 	}
3060 
3061 	/* Find the control and perform delayed initialization if needed. */
3062 	found = false;
3063 	for (i = 0; i < entity->ncontrols; ++i) {
3064 		ctrl = &entity->controls[i];
3065 		if (ctrl->index == xqry->selector - 1) {
3066 			found = true;
3067 			break;
3068 		}
3069 	}
3070 
3071 	if (!found) {
3072 		uvc_dbg(chain->dev, CONTROL, "Control %pUl/%u not found\n",
3073 			entity->guid, xqry->selector);
3074 		return -ENOENT;
3075 	}
3076 
3077 	if (uvc_ctrl_is_privacy_control(entity->guid, xqry->selector) &&
3078 	    !uvc_allow_privacy_override_param) {
3079 		dev_warn_once(&chain->dev->intf->dev,
3080 			      "Privacy related controls can only be accessed if module parameter allow_privacy_override is true\n");
3081 		uvc_dbg(chain->dev, CONTROL, "Blocking access to privacy related Control %pUl/%u\n",
3082 			entity->guid, xqry->selector);
3083 		return -EACCES;
3084 	}
3085 
3086 	if (mutex_lock_interruptible(&chain->ctrl_mutex))
3087 		return -ERESTARTSYS;
3088 
3089 	ret = uvc_ctrl_init_xu_ctrl(chain->dev, ctrl);
3090 	if (ret < 0) {
3091 		ret = -ENOENT;
3092 		goto done;
3093 	}
3094 
3095 	/* Validate the required buffer size and flags for the request */
3096 	reqflags = 0;
3097 	size = ctrl->info.size;
3098 
3099 	switch (xqry->query) {
3100 	case UVC_GET_CUR:
3101 		reqflags = UVC_CTRL_FLAG_GET_CUR;
3102 		break;
3103 	case UVC_GET_MIN:
3104 		reqflags = UVC_CTRL_FLAG_GET_MIN;
3105 		break;
3106 	case UVC_GET_MAX:
3107 		reqflags = UVC_CTRL_FLAG_GET_MAX;
3108 		break;
3109 	case UVC_GET_DEF:
3110 		reqflags = UVC_CTRL_FLAG_GET_DEF;
3111 		break;
3112 	case UVC_GET_RES:
3113 		reqflags = UVC_CTRL_FLAG_GET_RES;
3114 		break;
3115 	case UVC_SET_CUR:
3116 		reqflags = UVC_CTRL_FLAG_SET_CUR;
3117 		break;
3118 	case UVC_GET_LEN:
3119 		size = 2;
3120 		break;
3121 	case UVC_GET_INFO:
3122 		size = 1;
3123 		break;
3124 	default:
3125 		ret = -EINVAL;
3126 		goto done;
3127 	}
3128 
3129 	if (size != xqry->size) {
3130 		ret = -ENOBUFS;
3131 		goto done;
3132 	}
3133 
3134 	if (reqflags && !(ctrl->info.flags & reqflags)) {
3135 		ret = -EBADRQC;
3136 		goto done;
3137 	}
3138 
3139 	data = kmalloc(size, GFP_KERNEL);
3140 	if (data == NULL) {
3141 		ret = -ENOMEM;
3142 		goto done;
3143 	}
3144 
3145 	if (xqry->query == UVC_SET_CUR &&
3146 	    copy_from_user(data, xqry->data, size)) {
3147 		ret = -EFAULT;
3148 		goto done;
3149 	}
3150 
3151 	ret = uvc_query_ctrl(chain->dev, xqry->query, xqry->unit,
3152 			     chain->dev->intfnum, xqry->selector, data, size);
3153 	if (ret < 0)
3154 		goto done;
3155 
3156 	if (xqry->query != UVC_SET_CUR &&
3157 	    copy_to_user(xqry->data, data, size))
3158 		ret = -EFAULT;
3159 done:
3160 	kfree(data);
3161 	mutex_unlock(&chain->ctrl_mutex);
3162 	return ret;
3163 }
3164 
3165 /* --------------------------------------------------------------------------
3166  * Suspend/resume
3167  */
3168 
3169 /*
3170  * Restore control values after resume, skipping controls that haven't been
3171  * changed.
3172  *
3173  * TODO
3174  * - Don't restore modified controls that are back to their default value.
3175  * - Handle restore order (Auto-Exposure Mode should be restored before
3176  *   Exposure Time).
3177  */
3178 int uvc_ctrl_restore_values(struct uvc_device *dev)
3179 {
3180 	struct uvc_control *ctrl;
3181 	struct uvc_entity *entity;
3182 	unsigned int i;
3183 	int ret;
3184 
3185 	/* Walk the entities list and restore controls when possible. */
3186 	list_for_each_entry(entity, &dev->entities, list) {
3187 
3188 		for (i = 0; i < entity->ncontrols; ++i) {
3189 			ctrl = &entity->controls[i];
3190 
3191 			if (!ctrl->initialized || !ctrl->modified ||
3192 			    (ctrl->info.flags & UVC_CTRL_FLAG_RESTORE) == 0)
3193 				continue;
3194 			uvc_dbg(dev, CONTROL, "restoring control %pUl/%u/%u\n",
3195 				ctrl->info.entity, ctrl->info.index,
3196 				ctrl->info.selector);
3197 			ctrl->dirty = 1;
3198 		}
3199 
3200 		ret = uvc_ctrl_commit_entity(dev, NULL, entity, 0, NULL);
3201 		if (ret < 0)
3202 			return ret;
3203 	}
3204 
3205 	return 0;
3206 }
3207 
3208 /* --------------------------------------------------------------------------
3209  * Control and mapping handling
3210  */
3211 
3212 /*
3213  * Add control information to a given control.
3214  */
3215 static int uvc_ctrl_add_info(struct uvc_device *dev, struct uvc_control *ctrl,
3216 	const struct uvc_control_info *info)
3217 {
3218 	ctrl->info = *info;
3219 	INIT_LIST_HEAD(&ctrl->info.mappings);
3220 
3221 	/* Allocate an array to save control values (cur, def, max, etc.) */
3222 	ctrl->uvc_data = kzalloc(ctrl->info.size * UVC_CTRL_DATA_LAST + 1,
3223 				 GFP_KERNEL);
3224 	if (!ctrl->uvc_data)
3225 		return -ENOMEM;
3226 
3227 	ctrl->initialized = 1;
3228 
3229 	uvc_dbg(dev, CONTROL, "Added control %pUl/%u to device %s entity %u\n",
3230 		ctrl->info.entity, ctrl->info.selector, dev->udev->devpath,
3231 		ctrl->entity->id);
3232 
3233 	return 0;
3234 }
3235 
3236 /*
3237  * Add a control mapping to a given control.
3238  */
3239 static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
3240 	struct uvc_control *ctrl, const struct uvc_control_mapping *mapping)
3241 {
3242 	struct uvc_control_mapping *map;
3243 	unsigned int size;
3244 	unsigned int i;
3245 	int ret;
3246 
3247 	/*
3248 	 * Most mappings come from static kernel data, and need to be duplicated.
3249 	 * Mappings that come from userspace will be unnecessarily duplicated,
3250 	 * this could be optimized.
3251 	 */
3252 	map = kmemdup(mapping, sizeof(*mapping), GFP_KERNEL);
3253 	if (!map)
3254 		return -ENOMEM;
3255 
3256 	map->name = NULL;
3257 	map->menu_names = NULL;
3258 	map->menu_mapping = NULL;
3259 
3260 	/* For UVCIOC_CTRL_MAP custom control */
3261 	if (mapping->name) {
3262 		map->name = kstrdup(mapping->name, GFP_KERNEL);
3263 		if (!map->name)
3264 			goto err_nomem;
3265 	}
3266 
3267 	INIT_LIST_HEAD(&map->ev_subs);
3268 
3269 	if (mapping->menu_mapping && mapping->menu_mask) {
3270 		size = sizeof(mapping->menu_mapping[0])
3271 		       * fls(mapping->menu_mask);
3272 		map->menu_mapping = kmemdup(mapping->menu_mapping, size,
3273 					    GFP_KERNEL);
3274 		if (!map->menu_mapping)
3275 			goto err_nomem;
3276 	}
3277 	if (mapping->menu_names && mapping->menu_mask) {
3278 		size = sizeof(mapping->menu_names[0])
3279 		       * fls(mapping->menu_mask);
3280 		map->menu_names = kmemdup(mapping->menu_names, size,
3281 					  GFP_KERNEL);
3282 		if (!map->menu_names)
3283 			goto err_nomem;
3284 	}
3285 
3286 	if (uvc_ctrl_mapping_is_compound(map))
3287 		if (WARN_ON(!map->set || !map->get)) {
3288 			ret = -EIO;
3289 			goto free_mem;
3290 		}
3291 
3292 	if (map->get == NULL)
3293 		map->get = uvc_get_le_value;
3294 	if (map->set == NULL)
3295 		map->set = uvc_set_le_value;
3296 
3297 	for (i = 0; i < ARRAY_SIZE(uvc_control_classes); i++) {
3298 		if (V4L2_CTRL_ID2WHICH(uvc_control_classes[i]) ==
3299 						V4L2_CTRL_ID2WHICH(map->id)) {
3300 			chain->ctrl_class_bitmap |= BIT(i);
3301 			break;
3302 		}
3303 	}
3304 
3305 	list_add_tail(&map->list, &ctrl->info.mappings);
3306 	uvc_dbg(chain->dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n",
3307 		uvc_map_get_name(map), ctrl->info.entity,
3308 		ctrl->info.selector);
3309 
3310 	return 0;
3311 
3312 err_nomem:
3313 	ret = -ENOMEM;
3314 free_mem:
3315 	kfree(map->menu_names);
3316 	kfree(map->menu_mapping);
3317 	kfree(map->name);
3318 	kfree(map);
3319 	return ret;
3320 }
3321 
3322 int uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
3323 	const struct uvc_control_mapping *mapping)
3324 {
3325 	struct uvc_device *dev = chain->dev;
3326 	struct uvc_control_mapping *map;
3327 	struct uvc_entity *entity;
3328 	struct uvc_control *ctrl;
3329 	int found = 0;
3330 	int ret;
3331 
3332 	if (mapping->id & ~V4L2_CTRL_ID_MASK) {
3333 		uvc_dbg(dev, CONTROL,
3334 			"Can't add mapping '%s', control id 0x%08x is invalid\n",
3335 			uvc_map_get_name(mapping), mapping->id);
3336 		return -EINVAL;
3337 	}
3338 
3339 	/* Search for the matching (GUID/CS) control on the current chain */
3340 	list_for_each_entry(entity, &chain->entities, chain) {
3341 		unsigned int i;
3342 
3343 		if (UVC_ENTITY_TYPE(entity) != UVC_VC_EXTENSION_UNIT ||
3344 		    !uvc_entity_match_guid(entity, mapping->entity))
3345 			continue;
3346 
3347 		for (i = 0; i < entity->ncontrols; ++i) {
3348 			ctrl = &entity->controls[i];
3349 			if (ctrl->index == mapping->selector - 1) {
3350 				found = 1;
3351 				break;
3352 			}
3353 		}
3354 
3355 		if (found)
3356 			break;
3357 	}
3358 	if (!found)
3359 		return -ENOENT;
3360 
3361 	if (mutex_lock_interruptible(&chain->ctrl_mutex))
3362 		return -ERESTARTSYS;
3363 
3364 	/* Perform delayed initialization of XU controls */
3365 	ret = uvc_ctrl_init_xu_ctrl(dev, ctrl);
3366 	if (ret < 0) {
3367 		ret = -ENOENT;
3368 		goto done;
3369 	}
3370 
3371 	/* Validate the user-provided bit-size and offset */
3372 	if (mapping->size > 32 ||
3373 	    mapping->offset + mapping->size > ctrl->info.size * 8) {
3374 		ret = -EINVAL;
3375 		goto done;
3376 	}
3377 
3378 	list_for_each_entry(map, &ctrl->info.mappings, list) {
3379 		if (mapping->id == map->id) {
3380 			uvc_dbg(dev, CONTROL,
3381 				"Can't add mapping '%s', control id 0x%08x already exists\n",
3382 				uvc_map_get_name(mapping), mapping->id);
3383 			ret = -EEXIST;
3384 			goto done;
3385 		}
3386 	}
3387 
3388 	/* Prevent excess memory consumption */
3389 	if (atomic_inc_return(&dev->nmappings) > UVC_MAX_CONTROL_MAPPINGS) {
3390 		atomic_dec(&dev->nmappings);
3391 		uvc_dbg(dev, CONTROL,
3392 			"Can't add mapping '%s', maximum mappings count (%u) exceeded\n",
3393 			uvc_map_get_name(mapping), UVC_MAX_CONTROL_MAPPINGS);
3394 		ret = -ENOMEM;
3395 		goto done;
3396 	}
3397 
3398 	ret = __uvc_ctrl_add_mapping(chain, ctrl, mapping);
3399 	if (ret < 0)
3400 		atomic_dec(&dev->nmappings);
3401 
3402 done:
3403 	mutex_unlock(&chain->ctrl_mutex);
3404 	return ret;
3405 }
3406 
3407 /*
3408  * Prune an entity of its bogus controls using a blacklist. Bogus controls
3409  * are currently the ones that crash the camera or unconditionally return an
3410  * error when queried.
3411  */
3412 static void uvc_ctrl_prune_entity(struct uvc_device *dev,
3413 	struct uvc_entity *entity)
3414 {
3415 	struct uvc_ctrl_blacklist {
3416 		struct usb_device_id id;
3417 		u8 index;
3418 	};
3419 
3420 	static const struct uvc_ctrl_blacklist processing_blacklist[] = {
3421 		{ { USB_DEVICE(0x13d3, 0x509b) }, 9 }, /* Gain */
3422 		{ { USB_DEVICE(0x1c4f, 0x3000) }, 6 }, /* WB Temperature */
3423 		{ { USB_DEVICE(0x5986, 0x0241) }, 2 }, /* Hue */
3424 	};
3425 	static const struct uvc_ctrl_blacklist camera_blacklist[] = {
3426 		{ { USB_DEVICE(0x06f8, 0x3005) }, 9 }, /* Zoom, Absolute */
3427 	};
3428 
3429 	const struct uvc_ctrl_blacklist *blacklist;
3430 	unsigned int size;
3431 	unsigned int count;
3432 	unsigned int i;
3433 	u8 *controls;
3434 
3435 	switch (UVC_ENTITY_TYPE(entity)) {
3436 	case UVC_VC_PROCESSING_UNIT:
3437 		blacklist = processing_blacklist;
3438 		count = ARRAY_SIZE(processing_blacklist);
3439 		controls = entity->processing.bmControls;
3440 		size = entity->processing.bControlSize;
3441 		break;
3442 
3443 	case UVC_ITT_CAMERA:
3444 		blacklist = camera_blacklist;
3445 		count = ARRAY_SIZE(camera_blacklist);
3446 		controls = entity->camera.bmControls;
3447 		size = entity->camera.bControlSize;
3448 		break;
3449 
3450 	default:
3451 		return;
3452 	}
3453 
3454 	for (i = 0; i < count; ++i) {
3455 		if (!usb_match_one_id(dev->intf, &blacklist[i].id))
3456 			continue;
3457 
3458 		if (blacklist[i].index >= 8 * size ||
3459 		    !uvc_test_bit(controls, blacklist[i].index))
3460 			continue;
3461 
3462 		uvc_dbg(dev, CONTROL,
3463 			"%u/%u control is black listed, removing it\n",
3464 			entity->id, blacklist[i].index);
3465 
3466 		uvc_clear_bit(controls, blacklist[i].index);
3467 	}
3468 }
3469 
3470 /*
3471  * Add control information and hardcoded stock control mappings to the given
3472  * device.
3473  */
3474 static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain,
3475 			       struct uvc_control *ctrl)
3476 {
3477 	unsigned int i;
3478 
3479 	for (i = 0; i < ARRAY_SIZE(uvc_ctrls); ++i) {
3480 		const struct uvc_control_info *info = &uvc_ctrls[i];
3481 
3482 		if (uvc_entity_match_guid(ctrl->entity, info->entity) &&
3483 		    ctrl->index == info->index) {
3484 			uvc_ctrl_add_info(chain->dev, ctrl, info);
3485 			/*
3486 			 * Retrieve control flags from the device. Ignore errors
3487 			 * and work with default flag values from the uvc_ctrl
3488 			 * array when the device doesn't properly implement
3489 			 * GET_INFO on standard controls.
3490 			 */
3491 			uvc_ctrl_get_flags(chain->dev, ctrl, &ctrl->info);
3492 			break;
3493 		 }
3494 	}
3495 
3496 	if (!ctrl->initialized)
3497 		return;
3498 
3499 	/* Process common mappings. */
3500 	for (i = 0; i < ARRAY_SIZE(uvc_ctrl_mappings); ++i) {
3501 		const struct uvc_control_mapping *mapping = &uvc_ctrl_mappings[i];
3502 
3503 		if (!uvc_entity_match_guid(ctrl->entity, mapping->entity) ||
3504 		    ctrl->info.selector != mapping->selector)
3505 			continue;
3506 
3507 		/* Let the device provide a custom mapping. */
3508 		if (mapping->filter_mapping) {
3509 			mapping = mapping->filter_mapping(chain, ctrl);
3510 			if (!mapping)
3511 				continue;
3512 		}
3513 
3514 		__uvc_ctrl_add_mapping(chain, ctrl, mapping);
3515 	}
3516 }
3517 
3518 /*
3519  * Initialize device controls.
3520  */
3521 static int uvc_ctrl_init_chain(struct uvc_video_chain *chain)
3522 {
3523 	struct uvc_entity *entity;
3524 	unsigned int i;
3525 
3526 	/* Walk the entities list and instantiate controls */
3527 	list_for_each_entry(entity, &chain->entities, chain) {
3528 		struct uvc_control *ctrl;
3529 		unsigned int bControlSize = 0, ncontrols;
3530 		u8 *bmControls = NULL;
3531 
3532 		if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT) {
3533 			bmControls = entity->extension.bmControls;
3534 			bControlSize = entity->extension.bControlSize;
3535 		} else if (UVC_ENTITY_TYPE(entity) == UVC_VC_PROCESSING_UNIT) {
3536 			bmControls = entity->processing.bmControls;
3537 			bControlSize = entity->processing.bControlSize;
3538 		} else if (UVC_ENTITY_TYPE(entity) == UVC_ITT_CAMERA) {
3539 			bmControls = entity->camera.bmControls;
3540 			bControlSize = entity->camera.bControlSize;
3541 		} else if (UVC_ENTITY_TYPE(entity) == UVC_EXT_GPIO_UNIT) {
3542 			bmControls = entity->gpio.bmControls;
3543 			bControlSize = entity->gpio.bControlSize;
3544 		}
3545 
3546 		/* Remove bogus/blacklisted controls */
3547 		uvc_ctrl_prune_entity(chain->dev, entity);
3548 
3549 		/* Count supported controls and allocate the controls array */
3550 		ncontrols = memweight(bmControls, bControlSize);
3551 		if (ncontrols == 0)
3552 			continue;
3553 
3554 		entity->controls = kzalloc_objs(*ctrl, ncontrols);
3555 		if (entity->controls == NULL)
3556 			return -ENOMEM;
3557 		entity->ncontrols = ncontrols;
3558 
3559 		/* Initialize all supported controls */
3560 		ctrl = entity->controls;
3561 		for (i = 0; i < bControlSize * 8; ++i) {
3562 			if (uvc_test_bit(bmControls, i) == 0)
3563 				continue;
3564 
3565 			ctrl->entity = entity;
3566 			ctrl->index = i;
3567 
3568 			uvc_ctrl_init_ctrl(chain, ctrl);
3569 			ctrl++;
3570 		}
3571 	}
3572 
3573 	return 0;
3574 }
3575 
3576 int uvc_ctrl_init_device(struct uvc_device *dev)
3577 {
3578 	struct uvc_video_chain *chain;
3579 	int ret;
3580 
3581 	INIT_WORK(&dev->async_ctrl.work, uvc_ctrl_status_event_work);
3582 
3583 	list_for_each_entry(chain, &dev->chains, list) {
3584 		ret = uvc_ctrl_init_chain(chain);
3585 		if (ret)
3586 			return ret;
3587 	}
3588 
3589 	return 0;
3590 }
3591 
3592 void uvc_ctrl_cleanup_fh(struct uvc_fh *handle)
3593 {
3594 	struct uvc_entity *entity;
3595 
3596 	guard(mutex)(&handle->chain->ctrl_mutex);
3597 
3598 	if (!handle->pending_async_ctrls)
3599 		return;
3600 
3601 	list_for_each_entry(entity, &handle->chain->dev->entities, list) {
3602 		for (unsigned int i = 0; i < entity->ncontrols; ++i) {
3603 			if (entity->controls[i].handle != handle)
3604 				continue;
3605 			uvc_ctrl_clear_handle(&entity->controls[i]);
3606 		}
3607 	}
3608 
3609 	if (!WARN_ON(handle->pending_async_ctrls))
3610 		return;
3611 
3612 	for (unsigned int i = 0; i < handle->pending_async_ctrls; i++)
3613 		uvc_pm_put(handle->stream->dev);
3614 }
3615 
3616 /*
3617  * Cleanup device controls.
3618  */
3619 static void uvc_ctrl_cleanup_mappings(struct uvc_device *dev,
3620 	struct uvc_control *ctrl)
3621 {
3622 	struct uvc_control_mapping *mapping, *nm;
3623 
3624 	list_for_each_entry_safe(mapping, nm, &ctrl->info.mappings, list) {
3625 		list_del(&mapping->list);
3626 		kfree(mapping->menu_names);
3627 		kfree(mapping->menu_mapping);
3628 		kfree(mapping->name);
3629 		kfree(mapping);
3630 	}
3631 }
3632 
3633 void uvc_ctrl_cleanup_device(struct uvc_device *dev)
3634 {
3635 	struct uvc_entity *entity;
3636 	unsigned int i;
3637 
3638 	/* Can be uninitialized if we are aborting on probe error. */
3639 	if (dev->async_ctrl.work.func)
3640 		cancel_work_sync(&dev->async_ctrl.work);
3641 
3642 	/* Free controls and control mappings for all entities. */
3643 	list_for_each_entry(entity, &dev->entities, list) {
3644 		for (i = 0; i < entity->ncontrols; ++i) {
3645 			struct uvc_control *ctrl = &entity->controls[i];
3646 
3647 			if (!ctrl->initialized)
3648 				continue;
3649 
3650 			uvc_ctrl_cleanup_mappings(dev, ctrl);
3651 			kfree(ctrl->uvc_data);
3652 		}
3653 
3654 		kfree(entity->controls);
3655 	}
3656 }
3657