xref: /linux/drivers/media/v4l2-core/v4l2-ctrls-core.c (revision 90d32e92011eaae8e70a9169b4e7acf4ca8f9d3a)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * V4L2 controls framework core implementation.
4  *
5  * Copyright (C) 2010-2021  Hans Verkuil <hverkuil-cisco@xs4all.nl>
6  */
7 
8 #include <linux/export.h>
9 #include <linux/mm.h>
10 #include <linux/slab.h>
11 #include <media/v4l2-ctrls.h>
12 #include <media/v4l2-event.h>
13 #include <media/v4l2-fwnode.h>
14 
15 #include "v4l2-ctrls-priv.h"
16 
17 static const union v4l2_ctrl_ptr ptr_null;
18 
19 static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl,
20 		       u32 changes)
21 {
22 	memset(ev, 0, sizeof(*ev));
23 	ev->type = V4L2_EVENT_CTRL;
24 	ev->id = ctrl->id;
25 	ev->u.ctrl.changes = changes;
26 	ev->u.ctrl.type = ctrl->type;
27 	ev->u.ctrl.flags = user_flags(ctrl);
28 	if (ctrl->is_ptr)
29 		ev->u.ctrl.value64 = 0;
30 	else
31 		ev->u.ctrl.value64 = *ctrl->p_cur.p_s64;
32 	ev->u.ctrl.minimum = ctrl->minimum;
33 	ev->u.ctrl.maximum = ctrl->maximum;
34 	if (ctrl->type == V4L2_CTRL_TYPE_MENU
35 	    || ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
36 		ev->u.ctrl.step = 1;
37 	else
38 		ev->u.ctrl.step = ctrl->step;
39 	ev->u.ctrl.default_value = ctrl->default_value;
40 }
41 
42 void send_initial_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl)
43 {
44 	struct v4l2_event ev;
45 	u32 changes = V4L2_EVENT_CTRL_CH_FLAGS;
46 
47 	if (!(ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY))
48 		changes |= V4L2_EVENT_CTRL_CH_VALUE;
49 	fill_event(&ev, ctrl, changes);
50 	v4l2_event_queue_fh(fh, &ev);
51 }
52 
53 void send_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 changes)
54 {
55 	struct v4l2_event ev;
56 	struct v4l2_subscribed_event *sev;
57 
58 	if (list_empty(&ctrl->ev_subs))
59 		return;
60 	fill_event(&ev, ctrl, changes);
61 
62 	list_for_each_entry(sev, &ctrl->ev_subs, node)
63 		if (sev->fh != fh ||
64 		    (sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK))
65 			v4l2_event_queue_fh(sev->fh, &ev);
66 }
67 
68 bool v4l2_ctrl_type_op_equal(const struct v4l2_ctrl *ctrl,
69 			     union v4l2_ctrl_ptr ptr1, union v4l2_ctrl_ptr ptr2)
70 {
71 	unsigned int i;
72 
73 	switch (ctrl->type) {
74 	case V4L2_CTRL_TYPE_BUTTON:
75 		return false;
76 	case V4L2_CTRL_TYPE_STRING:
77 		for (i = 0; i < ctrl->elems; i++) {
78 			unsigned int idx = i * ctrl->elem_size;
79 
80 			/* strings are always 0-terminated */
81 			if (strcmp(ptr1.p_char + idx, ptr2.p_char + idx))
82 				return false;
83 		}
84 		return true;
85 	default:
86 		return !memcmp(ptr1.p_const, ptr2.p_const,
87 			       ctrl->elems * ctrl->elem_size);
88 	}
89 }
90 EXPORT_SYMBOL(v4l2_ctrl_type_op_equal);
91 
92 /* Default intra MPEG-2 quantisation coefficients, from the specification. */
93 static const u8 mpeg2_intra_quant_matrix[64] = {
94 	8,  16, 16, 19, 16, 19, 22, 22,
95 	22, 22, 22, 22, 26, 24, 26, 27,
96 	27, 27, 26, 26, 26, 26, 27, 27,
97 	27, 29, 29, 29, 34, 34, 34, 29,
98 	29, 29, 27, 27, 29, 29, 32, 32,
99 	34, 34, 37, 38, 37, 35, 35, 34,
100 	35, 38, 38, 40, 40, 40, 48, 48,
101 	46, 46, 56, 56, 58, 69, 69, 83
102 };
103 
104 static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
105 			      union v4l2_ctrl_ptr ptr)
106 {
107 	struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
108 	struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
109 	struct v4l2_ctrl_mpeg2_quantisation *p_mpeg2_quant;
110 	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
111 	struct v4l2_ctrl_vp9_frame *p_vp9_frame;
112 	struct v4l2_ctrl_fwht_params *p_fwht_params;
113 	struct v4l2_ctrl_h264_scaling_matrix *p_h264_scaling_matrix;
114 	struct v4l2_ctrl_av1_sequence *p_av1_sequence;
115 	void *p = ptr.p + idx * ctrl->elem_size;
116 
117 	if (ctrl->p_def.p_const)
118 		memcpy(p, ctrl->p_def.p_const, ctrl->elem_size);
119 	else
120 		memset(p, 0, ctrl->elem_size);
121 
122 	switch ((u32)ctrl->type) {
123 	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
124 		p_mpeg2_sequence = p;
125 
126 		/* 4:2:0 */
127 		p_mpeg2_sequence->chroma_format = 1;
128 		break;
129 	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
130 		p_mpeg2_picture = p;
131 
132 		/* interlaced top field */
133 		p_mpeg2_picture->picture_structure = V4L2_MPEG2_PIC_TOP_FIELD;
134 		p_mpeg2_picture->picture_coding_type =
135 					V4L2_MPEG2_PIC_CODING_TYPE_I;
136 		break;
137 	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
138 		p_mpeg2_quant = p;
139 
140 		memcpy(p_mpeg2_quant->intra_quantiser_matrix,
141 		       mpeg2_intra_quant_matrix,
142 		       ARRAY_SIZE(mpeg2_intra_quant_matrix));
143 		/*
144 		 * The default non-intra MPEG-2 quantisation
145 		 * coefficients are all 16, as per the specification.
146 		 */
147 		memset(p_mpeg2_quant->non_intra_quantiser_matrix, 16,
148 		       sizeof(p_mpeg2_quant->non_intra_quantiser_matrix));
149 		break;
150 	case V4L2_CTRL_TYPE_VP8_FRAME:
151 		p_vp8_frame = p;
152 		p_vp8_frame->num_dct_parts = 1;
153 		break;
154 	case V4L2_CTRL_TYPE_VP9_FRAME:
155 		p_vp9_frame = p;
156 		p_vp9_frame->profile = 0;
157 		p_vp9_frame->bit_depth = 8;
158 		p_vp9_frame->flags |= V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
159 			V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING;
160 		break;
161 	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
162 		p_av1_sequence = p;
163 		p_av1_sequence->bit_depth = 8;
164 		break;
165 	case V4L2_CTRL_TYPE_FWHT_PARAMS:
166 		p_fwht_params = p;
167 		p_fwht_params->version = V4L2_FWHT_VERSION;
168 		p_fwht_params->width = 1280;
169 		p_fwht_params->height = 720;
170 		p_fwht_params->flags = V4L2_FWHT_FL_PIXENC_YUV |
171 			(2 << V4L2_FWHT_FL_COMPONENTS_NUM_OFFSET);
172 		break;
173 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
174 		p_h264_scaling_matrix = p;
175 		/*
176 		 * The default (flat) H.264 scaling matrix when none are
177 		 * specified in the bitstream, this is according to formulas
178 		 *  (7-8) and (7-9) of the specification.
179 		 */
180 		memset(p_h264_scaling_matrix, 16, sizeof(*p_h264_scaling_matrix));
181 		break;
182 	}
183 }
184 
185 void v4l2_ctrl_type_op_init(const struct v4l2_ctrl *ctrl, u32 from_idx,
186 			    union v4l2_ctrl_ptr ptr)
187 {
188 	unsigned int i;
189 	u32 tot_elems = ctrl->elems;
190 	u32 elems = tot_elems - from_idx;
191 
192 	if (from_idx >= tot_elems)
193 		return;
194 
195 	switch (ctrl->type) {
196 	case V4L2_CTRL_TYPE_STRING:
197 		for (i = from_idx; i < tot_elems; i++) {
198 			unsigned int offset = i * ctrl->elem_size;
199 
200 			memset(ptr.p_char + offset, ' ', ctrl->minimum);
201 			ptr.p_char[offset + ctrl->minimum] = '\0';
202 		}
203 		break;
204 	case V4L2_CTRL_TYPE_INTEGER64:
205 		if (ctrl->default_value) {
206 			for (i = from_idx; i < tot_elems; i++)
207 				ptr.p_s64[i] = ctrl->default_value;
208 		} else {
209 			memset(ptr.p_s64 + from_idx, 0, elems * sizeof(s64));
210 		}
211 		break;
212 	case V4L2_CTRL_TYPE_INTEGER:
213 	case V4L2_CTRL_TYPE_INTEGER_MENU:
214 	case V4L2_CTRL_TYPE_MENU:
215 	case V4L2_CTRL_TYPE_BITMASK:
216 	case V4L2_CTRL_TYPE_BOOLEAN:
217 		if (ctrl->default_value) {
218 			for (i = from_idx; i < tot_elems; i++)
219 				ptr.p_s32[i] = ctrl->default_value;
220 		} else {
221 			memset(ptr.p_s32 + from_idx, 0, elems * sizeof(s32));
222 		}
223 		break;
224 	case V4L2_CTRL_TYPE_BUTTON:
225 	case V4L2_CTRL_TYPE_CTRL_CLASS:
226 		memset(ptr.p_s32 + from_idx, 0, elems * sizeof(s32));
227 		break;
228 	case V4L2_CTRL_TYPE_U8:
229 		memset(ptr.p_u8 + from_idx, ctrl->default_value, elems);
230 		break;
231 	case V4L2_CTRL_TYPE_U16:
232 		if (ctrl->default_value) {
233 			for (i = from_idx; i < tot_elems; i++)
234 				ptr.p_u16[i] = ctrl->default_value;
235 		} else {
236 			memset(ptr.p_u16 + from_idx, 0, elems * sizeof(u16));
237 		}
238 		break;
239 	case V4L2_CTRL_TYPE_U32:
240 		if (ctrl->default_value) {
241 			for (i = from_idx; i < tot_elems; i++)
242 				ptr.p_u32[i] = ctrl->default_value;
243 		} else {
244 			memset(ptr.p_u32 + from_idx, 0, elems * sizeof(u32));
245 		}
246 		break;
247 	default:
248 		for (i = from_idx; i < tot_elems; i++)
249 			std_init_compound(ctrl, i, ptr);
250 		break;
251 	}
252 }
253 EXPORT_SYMBOL(v4l2_ctrl_type_op_init);
254 
255 void v4l2_ctrl_type_op_log(const struct v4l2_ctrl *ctrl)
256 {
257 	union v4l2_ctrl_ptr ptr = ctrl->p_cur;
258 
259 	if (ctrl->is_array) {
260 		unsigned i;
261 
262 		for (i = 0; i < ctrl->nr_of_dims; i++)
263 			pr_cont("[%u]", ctrl->dims[i]);
264 		pr_cont(" ");
265 	}
266 
267 	switch (ctrl->type) {
268 	case V4L2_CTRL_TYPE_INTEGER:
269 		pr_cont("%d", *ptr.p_s32);
270 		break;
271 	case V4L2_CTRL_TYPE_BOOLEAN:
272 		pr_cont("%s", *ptr.p_s32 ? "true" : "false");
273 		break;
274 	case V4L2_CTRL_TYPE_MENU:
275 		pr_cont("%s", ctrl->qmenu[*ptr.p_s32]);
276 		break;
277 	case V4L2_CTRL_TYPE_INTEGER_MENU:
278 		pr_cont("%lld", ctrl->qmenu_int[*ptr.p_s32]);
279 		break;
280 	case V4L2_CTRL_TYPE_BITMASK:
281 		pr_cont("0x%08x", *ptr.p_s32);
282 		break;
283 	case V4L2_CTRL_TYPE_INTEGER64:
284 		pr_cont("%lld", *ptr.p_s64);
285 		break;
286 	case V4L2_CTRL_TYPE_STRING:
287 		pr_cont("%s", ptr.p_char);
288 		break;
289 	case V4L2_CTRL_TYPE_U8:
290 		pr_cont("%u", (unsigned)*ptr.p_u8);
291 		break;
292 	case V4L2_CTRL_TYPE_U16:
293 		pr_cont("%u", (unsigned)*ptr.p_u16);
294 		break;
295 	case V4L2_CTRL_TYPE_U32:
296 		pr_cont("%u", (unsigned)*ptr.p_u32);
297 		break;
298 	case V4L2_CTRL_TYPE_AREA:
299 		pr_cont("%ux%u", ptr.p_area->width, ptr.p_area->height);
300 		break;
301 	case V4L2_CTRL_TYPE_H264_SPS:
302 		pr_cont("H264_SPS");
303 		break;
304 	case V4L2_CTRL_TYPE_H264_PPS:
305 		pr_cont("H264_PPS");
306 		break;
307 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
308 		pr_cont("H264_SCALING_MATRIX");
309 		break;
310 	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
311 		pr_cont("H264_SLICE_PARAMS");
312 		break;
313 	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
314 		pr_cont("H264_DECODE_PARAMS");
315 		break;
316 	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
317 		pr_cont("H264_PRED_WEIGHTS");
318 		break;
319 	case V4L2_CTRL_TYPE_FWHT_PARAMS:
320 		pr_cont("FWHT_PARAMS");
321 		break;
322 	case V4L2_CTRL_TYPE_VP8_FRAME:
323 		pr_cont("VP8_FRAME");
324 		break;
325 	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
326 		pr_cont("HDR10_CLL_INFO");
327 		break;
328 	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
329 		pr_cont("HDR10_MASTERING_DISPLAY");
330 		break;
331 	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
332 		pr_cont("MPEG2_QUANTISATION");
333 		break;
334 	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
335 		pr_cont("MPEG2_SEQUENCE");
336 		break;
337 	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
338 		pr_cont("MPEG2_PICTURE");
339 		break;
340 	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
341 		pr_cont("VP9_COMPRESSED_HDR");
342 		break;
343 	case V4L2_CTRL_TYPE_VP9_FRAME:
344 		pr_cont("VP9_FRAME");
345 		break;
346 	case V4L2_CTRL_TYPE_HEVC_SPS:
347 		pr_cont("HEVC_SPS");
348 		break;
349 	case V4L2_CTRL_TYPE_HEVC_PPS:
350 		pr_cont("HEVC_PPS");
351 		break;
352 	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
353 		pr_cont("HEVC_SLICE_PARAMS");
354 		break;
355 	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
356 		pr_cont("HEVC_SCALING_MATRIX");
357 		break;
358 	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
359 		pr_cont("HEVC_DECODE_PARAMS");
360 		break;
361 	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
362 		pr_cont("AV1_SEQUENCE");
363 		break;
364 	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
365 		pr_cont("AV1_TILE_GROUP_ENTRY");
366 		break;
367 	case V4L2_CTRL_TYPE_AV1_FRAME:
368 		pr_cont("AV1_FRAME");
369 		break;
370 	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
371 		pr_cont("AV1_FILM_GRAIN");
372 		break;
373 
374 	default:
375 		pr_cont("unknown type %d", ctrl->type);
376 		break;
377 	}
378 }
379 EXPORT_SYMBOL(v4l2_ctrl_type_op_log);
380 
381 /*
382  * Round towards the closest legal value. Be careful when we are
383  * close to the maximum range of the control type to prevent
384  * wrap-arounds.
385  */
386 #define ROUND_TO_RANGE(val, offset_type, ctrl)			\
387 ({								\
388 	offset_type offset;					\
389 	if ((ctrl)->maximum >= 0 &&				\
390 	    val >= (ctrl)->maximum - (s32)((ctrl)->step / 2))	\
391 		val = (ctrl)->maximum;				\
392 	else							\
393 		val += (s32)((ctrl)->step / 2);			\
394 	val = clamp_t(typeof(val), val,				\
395 		      (ctrl)->minimum, (ctrl)->maximum);	\
396 	offset = (val) - (ctrl)->minimum;			\
397 	offset = (ctrl)->step * (offset / (u32)(ctrl)->step);	\
398 	val = (ctrl)->minimum + offset;				\
399 	0;							\
400 })
401 
402 /* Validate a new control */
403 
404 #define zero_padding(s) \
405 	memset(&(s).padding, 0, sizeof((s).padding))
406 #define zero_reserved(s) \
407 	memset(&(s).reserved, 0, sizeof((s).reserved))
408 
409 static int
410 validate_vp9_lf_params(struct v4l2_vp9_loop_filter *lf)
411 {
412 	unsigned int i;
413 
414 	if (lf->flags & ~(V4L2_VP9_LOOP_FILTER_FLAG_DELTA_ENABLED |
415 			  V4L2_VP9_LOOP_FILTER_FLAG_DELTA_UPDATE))
416 		return -EINVAL;
417 
418 	/* That all values are in the accepted range. */
419 	if (lf->level > GENMASK(5, 0))
420 		return -EINVAL;
421 
422 	if (lf->sharpness > GENMASK(2, 0))
423 		return -EINVAL;
424 
425 	for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++)
426 		if (lf->ref_deltas[i] < -63 || lf->ref_deltas[i] > 63)
427 			return -EINVAL;
428 
429 	for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++)
430 		if (lf->mode_deltas[i] < -63 || lf->mode_deltas[i] > 63)
431 			return -EINVAL;
432 
433 	zero_reserved(*lf);
434 	return 0;
435 }
436 
437 static int
438 validate_vp9_quant_params(struct v4l2_vp9_quantization *quant)
439 {
440 	if (quant->delta_q_y_dc < -15 || quant->delta_q_y_dc > 15 ||
441 	    quant->delta_q_uv_dc < -15 || quant->delta_q_uv_dc > 15 ||
442 	    quant->delta_q_uv_ac < -15 || quant->delta_q_uv_ac > 15)
443 		return -EINVAL;
444 
445 	zero_reserved(*quant);
446 	return 0;
447 }
448 
449 static int
450 validate_vp9_seg_params(struct v4l2_vp9_segmentation *seg)
451 {
452 	unsigned int i, j;
453 
454 	if (seg->flags & ~(V4L2_VP9_SEGMENTATION_FLAG_ENABLED |
455 			   V4L2_VP9_SEGMENTATION_FLAG_UPDATE_MAP |
456 			   V4L2_VP9_SEGMENTATION_FLAG_TEMPORAL_UPDATE |
457 			   V4L2_VP9_SEGMENTATION_FLAG_UPDATE_DATA |
458 			   V4L2_VP9_SEGMENTATION_FLAG_ABS_OR_DELTA_UPDATE))
459 		return -EINVAL;
460 
461 	for (i = 0; i < ARRAY_SIZE(seg->feature_enabled); i++) {
462 		if (seg->feature_enabled[i] &
463 		    ~V4L2_VP9_SEGMENT_FEATURE_ENABLED_MASK)
464 			return -EINVAL;
465 	}
466 
467 	for (i = 0; i < ARRAY_SIZE(seg->feature_data); i++) {
468 		static const int range[] = { 255, 63, 3, 0 };
469 
470 		for (j = 0; j < ARRAY_SIZE(seg->feature_data[j]); j++) {
471 			if (seg->feature_data[i][j] < -range[j] ||
472 			    seg->feature_data[i][j] > range[j])
473 				return -EINVAL;
474 		}
475 	}
476 
477 	zero_reserved(*seg);
478 	return 0;
479 }
480 
481 static int
482 validate_vp9_compressed_hdr(struct v4l2_ctrl_vp9_compressed_hdr *hdr)
483 {
484 	if (hdr->tx_mode > V4L2_VP9_TX_MODE_SELECT)
485 		return -EINVAL;
486 
487 	return 0;
488 }
489 
490 static int
491 validate_vp9_frame(struct v4l2_ctrl_vp9_frame *frame)
492 {
493 	int ret;
494 
495 	/* Make sure we're not passed invalid flags. */
496 	if (frame->flags & ~(V4L2_VP9_FRAME_FLAG_KEY_FRAME |
497 		  V4L2_VP9_FRAME_FLAG_SHOW_FRAME |
498 		  V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT |
499 		  V4L2_VP9_FRAME_FLAG_INTRA_ONLY |
500 		  V4L2_VP9_FRAME_FLAG_ALLOW_HIGH_PREC_MV |
501 		  V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX |
502 		  V4L2_VP9_FRAME_FLAG_PARALLEL_DEC_MODE |
503 		  V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
504 		  V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING |
505 		  V4L2_VP9_FRAME_FLAG_COLOR_RANGE_FULL_SWING))
506 		return -EINVAL;
507 
508 	if (frame->flags & V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT &&
509 	    frame->flags & V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX)
510 		return -EINVAL;
511 
512 	if (frame->profile > V4L2_VP9_PROFILE_MAX)
513 		return -EINVAL;
514 
515 	if (frame->reset_frame_context > V4L2_VP9_RESET_FRAME_CTX_ALL)
516 		return -EINVAL;
517 
518 	if (frame->frame_context_idx >= V4L2_VP9_NUM_FRAME_CTX)
519 		return -EINVAL;
520 
521 	/*
522 	 * Profiles 0 and 1 only support 8-bit depth, profiles 2 and 3 only 10
523 	 * and 12 bit depths.
524 	 */
525 	if ((frame->profile < 2 && frame->bit_depth != 8) ||
526 	    (frame->profile >= 2 &&
527 	     (frame->bit_depth != 10 && frame->bit_depth != 12)))
528 		return -EINVAL;
529 
530 	/* Profile 0 and 2 only accept YUV 4:2:0. */
531 	if ((frame->profile == 0 || frame->profile == 2) &&
532 	    (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
533 	     !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
534 		return -EINVAL;
535 
536 	/* Profile 1 and 3 only accept YUV 4:2:2, 4:4:0 and 4:4:4. */
537 	if ((frame->profile == 1 || frame->profile == 3) &&
538 	    ((frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) &&
539 	     (frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
540 		return -EINVAL;
541 
542 	if (frame->interpolation_filter > V4L2_VP9_INTERP_FILTER_SWITCHABLE)
543 		return -EINVAL;
544 
545 	/*
546 	 * According to the spec, tile_cols_log2 shall be less than or equal
547 	 * to 6.
548 	 */
549 	if (frame->tile_cols_log2 > 6)
550 		return -EINVAL;
551 
552 	if (frame->reference_mode > V4L2_VP9_REFERENCE_MODE_SELECT)
553 		return -EINVAL;
554 
555 	ret = validate_vp9_lf_params(&frame->lf);
556 	if (ret)
557 		return ret;
558 
559 	ret = validate_vp9_quant_params(&frame->quant);
560 	if (ret)
561 		return ret;
562 
563 	ret = validate_vp9_seg_params(&frame->seg);
564 	if (ret)
565 		return ret;
566 
567 	zero_reserved(*frame);
568 	return 0;
569 }
570 
571 static int validate_av1_quantization(struct v4l2_av1_quantization *q)
572 {
573 	if (q->flags > GENMASK(2, 0))
574 		return -EINVAL;
575 
576 	if (q->delta_q_y_dc < -64 || q->delta_q_y_dc > 63 ||
577 	    q->delta_q_u_dc < -64 || q->delta_q_u_dc > 63 ||
578 	    q->delta_q_v_dc < -64 || q->delta_q_v_dc > 63 ||
579 	    q->delta_q_u_ac < -64 || q->delta_q_u_ac > 63 ||
580 	    q->delta_q_v_ac < -64 || q->delta_q_v_ac > 63 ||
581 	    q->delta_q_res > GENMASK(1, 0))
582 		return -EINVAL;
583 
584 	if (q->qm_y > GENMASK(3, 0) ||
585 	    q->qm_u > GENMASK(3, 0) ||
586 	    q->qm_v > GENMASK(3, 0))
587 		return -EINVAL;
588 
589 	return 0;
590 }
591 
592 static int validate_av1_segmentation(struct v4l2_av1_segmentation *s)
593 {
594 	u32 i;
595 	u32 j;
596 
597 	if (s->flags > GENMASK(4, 0))
598 		return -EINVAL;
599 
600 	for (i = 0; i < ARRAY_SIZE(s->feature_data); i++) {
601 		static const int segmentation_feature_signed[] = { 1, 1, 1, 1, 1, 0, 0, 0 };
602 		static const int segmentation_feature_max[] = { 255, 63, 63, 63, 63, 7, 0, 0};
603 
604 		for (j = 0; j < ARRAY_SIZE(s->feature_data[j]); j++) {
605 			s32 limit = segmentation_feature_max[j];
606 
607 			if (segmentation_feature_signed[j]) {
608 				if (s->feature_data[i][j] < -limit ||
609 				    s->feature_data[i][j] > limit)
610 					return -EINVAL;
611 			} else {
612 				if (s->feature_data[i][j] < 0 || s->feature_data[i][j] > limit)
613 					return -EINVAL;
614 			}
615 		}
616 	}
617 
618 	return 0;
619 }
620 
621 static int validate_av1_loop_filter(struct v4l2_av1_loop_filter *lf)
622 {
623 	u32 i;
624 
625 	if (lf->flags > GENMASK(3, 0))
626 		return -EINVAL;
627 
628 	for (i = 0; i < ARRAY_SIZE(lf->level); i++) {
629 		if (lf->level[i] > GENMASK(5, 0))
630 			return -EINVAL;
631 	}
632 
633 	if (lf->sharpness > GENMASK(2, 0))
634 		return -EINVAL;
635 
636 	for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++) {
637 		if (lf->ref_deltas[i] < -64 || lf->ref_deltas[i] > 63)
638 			return -EINVAL;
639 	}
640 
641 	for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++) {
642 		if (lf->mode_deltas[i] < -64 || lf->mode_deltas[i] > 63)
643 			return -EINVAL;
644 	}
645 
646 	return 0;
647 }
648 
649 static int validate_av1_cdef(struct v4l2_av1_cdef *cdef)
650 {
651 	u32 i;
652 
653 	if (cdef->damping_minus_3 > GENMASK(1, 0) ||
654 	    cdef->bits > GENMASK(1, 0))
655 		return -EINVAL;
656 
657 	for (i = 0; i < 1 << cdef->bits; i++) {
658 		if (cdef->y_pri_strength[i] > GENMASK(3, 0) ||
659 		    cdef->y_sec_strength[i] > 4 ||
660 		    cdef->uv_pri_strength[i] > GENMASK(3, 0) ||
661 		    cdef->uv_sec_strength[i] > 4)
662 			return -EINVAL;
663 	}
664 
665 	return 0;
666 }
667 
668 static int validate_av1_loop_restauration(struct v4l2_av1_loop_restoration *lr)
669 {
670 	if (lr->lr_unit_shift > 3 || lr->lr_uv_shift > 1)
671 		return -EINVAL;
672 
673 	return 0;
674 }
675 
676 static int validate_av1_film_grain(struct v4l2_ctrl_av1_film_grain *fg)
677 {
678 	u32 i;
679 
680 	if (fg->flags > GENMASK(4, 0))
681 		return -EINVAL;
682 
683 	if (fg->film_grain_params_ref_idx > GENMASK(2, 0) ||
684 	    fg->num_y_points > 14 ||
685 	    fg->num_cb_points > 10 ||
686 	    fg->num_cr_points > GENMASK(3, 0) ||
687 	    fg->grain_scaling_minus_8 > GENMASK(1, 0) ||
688 	    fg->ar_coeff_lag > GENMASK(1, 0) ||
689 	    fg->ar_coeff_shift_minus_6 > GENMASK(1, 0) ||
690 	    fg->grain_scale_shift > GENMASK(1, 0))
691 		return -EINVAL;
692 
693 	if (!(fg->flags & V4L2_AV1_FILM_GRAIN_FLAG_APPLY_GRAIN))
694 		return 0;
695 
696 	for (i = 1; i < fg->num_y_points; i++)
697 		if (fg->point_y_value[i] <= fg->point_y_value[i - 1])
698 			return -EINVAL;
699 
700 	for (i = 1; i < fg->num_cb_points; i++)
701 		if (fg->point_cb_value[i] <= fg->point_cb_value[i - 1])
702 			return -EINVAL;
703 
704 	for (i = 1; i < fg->num_cr_points; i++)
705 		if (fg->point_cr_value[i] <= fg->point_cr_value[i - 1])
706 			return -EINVAL;
707 
708 	return 0;
709 }
710 
711 static int validate_av1_frame(struct v4l2_ctrl_av1_frame *f)
712 {
713 	int ret = 0;
714 
715 	ret = validate_av1_quantization(&f->quantization);
716 	if (ret)
717 		return ret;
718 	ret = validate_av1_segmentation(&f->segmentation);
719 	if (ret)
720 		return ret;
721 	ret = validate_av1_loop_filter(&f->loop_filter);
722 	if (ret)
723 		return ret;
724 	ret = validate_av1_cdef(&f->cdef);
725 	if (ret)
726 		return ret;
727 	ret = validate_av1_loop_restauration(&f->loop_restoration);
728 	if (ret)
729 		return ret;
730 
731 	if (f->flags &
732 	~(V4L2_AV1_FRAME_FLAG_SHOW_FRAME |
733 	  V4L2_AV1_FRAME_FLAG_SHOWABLE_FRAME |
734 	  V4L2_AV1_FRAME_FLAG_ERROR_RESILIENT_MODE |
735 	  V4L2_AV1_FRAME_FLAG_DISABLE_CDF_UPDATE |
736 	  V4L2_AV1_FRAME_FLAG_ALLOW_SCREEN_CONTENT_TOOLS |
737 	  V4L2_AV1_FRAME_FLAG_FORCE_INTEGER_MV |
738 	  V4L2_AV1_FRAME_FLAG_ALLOW_INTRABC |
739 	  V4L2_AV1_FRAME_FLAG_USE_SUPERRES |
740 	  V4L2_AV1_FRAME_FLAG_ALLOW_HIGH_PRECISION_MV |
741 	  V4L2_AV1_FRAME_FLAG_IS_MOTION_MODE_SWITCHABLE |
742 	  V4L2_AV1_FRAME_FLAG_USE_REF_FRAME_MVS |
743 	  V4L2_AV1_FRAME_FLAG_DISABLE_FRAME_END_UPDATE_CDF |
744 	  V4L2_AV1_FRAME_FLAG_ALLOW_WARPED_MOTION |
745 	  V4L2_AV1_FRAME_FLAG_REFERENCE_SELECT |
746 	  V4L2_AV1_FRAME_FLAG_REDUCED_TX_SET |
747 	  V4L2_AV1_FRAME_FLAG_SKIP_MODE_ALLOWED |
748 	  V4L2_AV1_FRAME_FLAG_SKIP_MODE_PRESENT |
749 	  V4L2_AV1_FRAME_FLAG_FRAME_SIZE_OVERRIDE |
750 	  V4L2_AV1_FRAME_FLAG_BUFFER_REMOVAL_TIME_PRESENT |
751 	  V4L2_AV1_FRAME_FLAG_FRAME_REFS_SHORT_SIGNALING))
752 		return -EINVAL;
753 
754 	if (f->superres_denom > GENMASK(2, 0) + 9)
755 		return -EINVAL;
756 
757 	return 0;
758 }
759 
760 static int validate_av1_sequence(struct v4l2_ctrl_av1_sequence *s)
761 {
762 	if (s->flags &
763 	~(V4L2_AV1_SEQUENCE_FLAG_STILL_PICTURE |
764 	 V4L2_AV1_SEQUENCE_FLAG_USE_128X128_SUPERBLOCK |
765 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_FILTER_INTRA |
766 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_INTRA_EDGE_FILTER |
767 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_INTERINTRA_COMPOUND |
768 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_MASKED_COMPOUND |
769 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_WARPED_MOTION |
770 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_DUAL_FILTER |
771 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_ORDER_HINT |
772 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_JNT_COMP |
773 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_REF_FRAME_MVS |
774 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_SUPERRES |
775 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_CDEF |
776 	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_RESTORATION |
777 	 V4L2_AV1_SEQUENCE_FLAG_MONO_CHROME |
778 	 V4L2_AV1_SEQUENCE_FLAG_COLOR_RANGE |
779 	 V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_X |
780 	 V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_Y |
781 	 V4L2_AV1_SEQUENCE_FLAG_FILM_GRAIN_PARAMS_PRESENT |
782 	 V4L2_AV1_SEQUENCE_FLAG_SEPARATE_UV_DELTA_Q))
783 		return -EINVAL;
784 
785 	if (s->seq_profile == 1 && s->flags & V4L2_AV1_SEQUENCE_FLAG_MONO_CHROME)
786 		return -EINVAL;
787 
788 	/* reserved */
789 	if (s->seq_profile > 2)
790 		return -EINVAL;
791 
792 	/* TODO: PROFILES */
793 	return 0;
794 }
795 
796 /*
797  * Compound controls validation requires setting unused fields/flags to zero
798  * in order to properly detect unchanged controls with v4l2_ctrl_type_op_equal's
799  * memcmp.
800  */
801 static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
802 				 union v4l2_ctrl_ptr ptr)
803 {
804 	struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
805 	struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
806 	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
807 	struct v4l2_ctrl_fwht_params *p_fwht_params;
808 	struct v4l2_ctrl_h264_sps *p_h264_sps;
809 	struct v4l2_ctrl_h264_pps *p_h264_pps;
810 	struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weights;
811 	struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;
812 	struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;
813 	struct v4l2_ctrl_hevc_sps *p_hevc_sps;
814 	struct v4l2_ctrl_hevc_pps *p_hevc_pps;
815 	struct v4l2_ctrl_hdr10_mastering_display *p_hdr10_mastering;
816 	struct v4l2_ctrl_hevc_decode_params *p_hevc_decode_params;
817 	struct v4l2_area *area;
818 	void *p = ptr.p + idx * ctrl->elem_size;
819 	unsigned int i;
820 
821 	switch ((u32)ctrl->type) {
822 	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
823 		p_mpeg2_sequence = p;
824 
825 		switch (p_mpeg2_sequence->chroma_format) {
826 		case 1: /* 4:2:0 */
827 		case 2: /* 4:2:2 */
828 		case 3: /* 4:4:4 */
829 			break;
830 		default:
831 			return -EINVAL;
832 		}
833 		break;
834 
835 	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
836 		p_mpeg2_picture = p;
837 
838 		switch (p_mpeg2_picture->intra_dc_precision) {
839 		case 0: /* 8 bits */
840 		case 1: /* 9 bits */
841 		case 2: /* 10 bits */
842 		case 3: /* 11 bits */
843 			break;
844 		default:
845 			return -EINVAL;
846 		}
847 
848 		switch (p_mpeg2_picture->picture_structure) {
849 		case V4L2_MPEG2_PIC_TOP_FIELD:
850 		case V4L2_MPEG2_PIC_BOTTOM_FIELD:
851 		case V4L2_MPEG2_PIC_FRAME:
852 			break;
853 		default:
854 			return -EINVAL;
855 		}
856 
857 		switch (p_mpeg2_picture->picture_coding_type) {
858 		case V4L2_MPEG2_PIC_CODING_TYPE_I:
859 		case V4L2_MPEG2_PIC_CODING_TYPE_P:
860 		case V4L2_MPEG2_PIC_CODING_TYPE_B:
861 			break;
862 		default:
863 			return -EINVAL;
864 		}
865 		zero_reserved(*p_mpeg2_picture);
866 		break;
867 
868 	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
869 		break;
870 
871 	case V4L2_CTRL_TYPE_FWHT_PARAMS:
872 		p_fwht_params = p;
873 		if (p_fwht_params->version < V4L2_FWHT_VERSION)
874 			return -EINVAL;
875 		if (!p_fwht_params->width || !p_fwht_params->height)
876 			return -EINVAL;
877 		break;
878 
879 	case V4L2_CTRL_TYPE_H264_SPS:
880 		p_h264_sps = p;
881 
882 		/* Some syntax elements are only conditionally valid */
883 		if (p_h264_sps->pic_order_cnt_type != 0) {
884 			p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 = 0;
885 		} else if (p_h264_sps->pic_order_cnt_type != 1) {
886 			p_h264_sps->num_ref_frames_in_pic_order_cnt_cycle = 0;
887 			p_h264_sps->offset_for_non_ref_pic = 0;
888 			p_h264_sps->offset_for_top_to_bottom_field = 0;
889 			memset(&p_h264_sps->offset_for_ref_frame, 0,
890 			       sizeof(p_h264_sps->offset_for_ref_frame));
891 		}
892 
893 		if (!V4L2_H264_SPS_HAS_CHROMA_FORMAT(p_h264_sps)) {
894 			p_h264_sps->chroma_format_idc = 1;
895 			p_h264_sps->bit_depth_luma_minus8 = 0;
896 			p_h264_sps->bit_depth_chroma_minus8 = 0;
897 
898 			p_h264_sps->flags &=
899 				~V4L2_H264_SPS_FLAG_QPPRIME_Y_ZERO_TRANSFORM_BYPASS;
900 
901 			if (p_h264_sps->chroma_format_idc < 3)
902 				p_h264_sps->flags &=
903 					~V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE;
904 		}
905 
906 		if (p_h264_sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY)
907 			p_h264_sps->flags &=
908 				~V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD;
909 
910 		/*
911 		 * Chroma 4:2:2 format require at least High 4:2:2 profile.
912 		 *
913 		 * The H264 specification and well-known parser implementations
914 		 * use profile-idc values directly, as that is clearer and
915 		 * less ambiguous. We do the same here.
916 		 */
917 		if (p_h264_sps->profile_idc < 122 &&
918 		    p_h264_sps->chroma_format_idc > 1)
919 			return -EINVAL;
920 		/* Chroma 4:4:4 format require at least High 4:2:2 profile */
921 		if (p_h264_sps->profile_idc < 244 &&
922 		    p_h264_sps->chroma_format_idc > 2)
923 			return -EINVAL;
924 		if (p_h264_sps->chroma_format_idc > 3)
925 			return -EINVAL;
926 
927 		if (p_h264_sps->bit_depth_luma_minus8 > 6)
928 			return -EINVAL;
929 		if (p_h264_sps->bit_depth_chroma_minus8 > 6)
930 			return -EINVAL;
931 		if (p_h264_sps->log2_max_frame_num_minus4 > 12)
932 			return -EINVAL;
933 		if (p_h264_sps->pic_order_cnt_type > 2)
934 			return -EINVAL;
935 		if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
936 			return -EINVAL;
937 		if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)
938 			return -EINVAL;
939 		break;
940 
941 	case V4L2_CTRL_TYPE_H264_PPS:
942 		p_h264_pps = p;
943 
944 		if (p_h264_pps->num_slice_groups_minus1 > 7)
945 			return -EINVAL;
946 		if (p_h264_pps->num_ref_idx_l0_default_active_minus1 >
947 		    (V4L2_H264_REF_LIST_LEN - 1))
948 			return -EINVAL;
949 		if (p_h264_pps->num_ref_idx_l1_default_active_minus1 >
950 		    (V4L2_H264_REF_LIST_LEN - 1))
951 			return -EINVAL;
952 		if (p_h264_pps->weighted_bipred_idc > 2)
953 			return -EINVAL;
954 		/*
955 		 * pic_init_qp_minus26 shall be in the range of
956 		 * -(26 + QpBdOffset_y) to +25, inclusive,
957 		 *  where QpBdOffset_y is 6 * bit_depth_luma_minus8
958 		 */
959 		if (p_h264_pps->pic_init_qp_minus26 < -62 ||
960 		    p_h264_pps->pic_init_qp_minus26 > 25)
961 			return -EINVAL;
962 		if (p_h264_pps->pic_init_qs_minus26 < -26 ||
963 		    p_h264_pps->pic_init_qs_minus26 > 25)
964 			return -EINVAL;
965 		if (p_h264_pps->chroma_qp_index_offset < -12 ||
966 		    p_h264_pps->chroma_qp_index_offset > 12)
967 			return -EINVAL;
968 		if (p_h264_pps->second_chroma_qp_index_offset < -12 ||
969 		    p_h264_pps->second_chroma_qp_index_offset > 12)
970 			return -EINVAL;
971 		break;
972 
973 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
974 		break;
975 
976 	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
977 		p_h264_pred_weights = p;
978 
979 		if (p_h264_pred_weights->luma_log2_weight_denom > 7)
980 			return -EINVAL;
981 		if (p_h264_pred_weights->chroma_log2_weight_denom > 7)
982 			return -EINVAL;
983 		break;
984 
985 	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
986 		p_h264_slice_params = p;
987 
988 		if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
989 			p_h264_slice_params->flags &=
990 				~V4L2_H264_SLICE_FLAG_DIRECT_SPATIAL_MV_PRED;
991 
992 		if (p_h264_slice_params->colour_plane_id > 2)
993 			return -EINVAL;
994 		if (p_h264_slice_params->cabac_init_idc > 2)
995 			return -EINVAL;
996 		if (p_h264_slice_params->disable_deblocking_filter_idc > 2)
997 			return -EINVAL;
998 		if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||
999 		    p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)
1000 			return -EINVAL;
1001 		if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||
1002 		    p_h264_slice_params->slice_beta_offset_div2 > 6)
1003 			return -EINVAL;
1004 
1005 		if (p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_I ||
1006 		    p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_SI)
1007 			p_h264_slice_params->num_ref_idx_l0_active_minus1 = 0;
1008 		if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
1009 			p_h264_slice_params->num_ref_idx_l1_active_minus1 = 0;
1010 
1011 		if (p_h264_slice_params->num_ref_idx_l0_active_minus1 >
1012 		    (V4L2_H264_REF_LIST_LEN - 1))
1013 			return -EINVAL;
1014 		if (p_h264_slice_params->num_ref_idx_l1_active_minus1 >
1015 		    (V4L2_H264_REF_LIST_LEN - 1))
1016 			return -EINVAL;
1017 		zero_reserved(*p_h264_slice_params);
1018 		break;
1019 
1020 	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1021 		p_h264_dec_params = p;
1022 
1023 		if (p_h264_dec_params->nal_ref_idc > 3)
1024 			return -EINVAL;
1025 		for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {
1026 			struct v4l2_h264_dpb_entry *dpb_entry =
1027 				&p_h264_dec_params->dpb[i];
1028 
1029 			zero_reserved(*dpb_entry);
1030 		}
1031 		zero_reserved(*p_h264_dec_params);
1032 		break;
1033 
1034 	case V4L2_CTRL_TYPE_VP8_FRAME:
1035 		p_vp8_frame = p;
1036 
1037 		switch (p_vp8_frame->num_dct_parts) {
1038 		case 1:
1039 		case 2:
1040 		case 4:
1041 		case 8:
1042 			break;
1043 		default:
1044 			return -EINVAL;
1045 		}
1046 		zero_padding(p_vp8_frame->segment);
1047 		zero_padding(p_vp8_frame->lf);
1048 		zero_padding(p_vp8_frame->quant);
1049 		zero_padding(p_vp8_frame->entropy);
1050 		zero_padding(p_vp8_frame->coder_state);
1051 		break;
1052 
1053 	case V4L2_CTRL_TYPE_HEVC_SPS:
1054 		p_hevc_sps = p;
1055 
1056 		if (!(p_hevc_sps->flags & V4L2_HEVC_SPS_FLAG_PCM_ENABLED)) {
1057 			p_hevc_sps->pcm_sample_bit_depth_luma_minus1 = 0;
1058 			p_hevc_sps->pcm_sample_bit_depth_chroma_minus1 = 0;
1059 			p_hevc_sps->log2_min_pcm_luma_coding_block_size_minus3 = 0;
1060 			p_hevc_sps->log2_diff_max_min_pcm_luma_coding_block_size = 0;
1061 		}
1062 
1063 		if (!(p_hevc_sps->flags &
1064 		      V4L2_HEVC_SPS_FLAG_LONG_TERM_REF_PICS_PRESENT))
1065 			p_hevc_sps->num_long_term_ref_pics_sps = 0;
1066 		break;
1067 
1068 	case V4L2_CTRL_TYPE_HEVC_PPS:
1069 		p_hevc_pps = p;
1070 
1071 		if (!(p_hevc_pps->flags &
1072 		      V4L2_HEVC_PPS_FLAG_CU_QP_DELTA_ENABLED))
1073 			p_hevc_pps->diff_cu_qp_delta_depth = 0;
1074 
1075 		if (!(p_hevc_pps->flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED)) {
1076 			p_hevc_pps->num_tile_columns_minus1 = 0;
1077 			p_hevc_pps->num_tile_rows_minus1 = 0;
1078 			memset(&p_hevc_pps->column_width_minus1, 0,
1079 			       sizeof(p_hevc_pps->column_width_minus1));
1080 			memset(&p_hevc_pps->row_height_minus1, 0,
1081 			       sizeof(p_hevc_pps->row_height_minus1));
1082 
1083 			p_hevc_pps->flags &=
1084 				~V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED;
1085 		}
1086 
1087 		if (p_hevc_pps->flags &
1088 		    V4L2_HEVC_PPS_FLAG_PPS_DISABLE_DEBLOCKING_FILTER) {
1089 			p_hevc_pps->pps_beta_offset_div2 = 0;
1090 			p_hevc_pps->pps_tc_offset_div2 = 0;
1091 		}
1092 		break;
1093 
1094 	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
1095 		p_hevc_decode_params = p;
1096 
1097 		if (p_hevc_decode_params->num_active_dpb_entries >
1098 		    V4L2_HEVC_DPB_ENTRIES_NUM_MAX)
1099 			return -EINVAL;
1100 		break;
1101 
1102 	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
1103 		break;
1104 
1105 	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
1106 		break;
1107 
1108 	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
1109 		p_hdr10_mastering = p;
1110 
1111 		for (i = 0; i < 3; ++i) {
1112 			if (p_hdr10_mastering->display_primaries_x[i] <
1113 				V4L2_HDR10_MASTERING_PRIMARIES_X_LOW ||
1114 			    p_hdr10_mastering->display_primaries_x[i] >
1115 				V4L2_HDR10_MASTERING_PRIMARIES_X_HIGH ||
1116 			    p_hdr10_mastering->display_primaries_y[i] <
1117 				V4L2_HDR10_MASTERING_PRIMARIES_Y_LOW ||
1118 			    p_hdr10_mastering->display_primaries_y[i] >
1119 				V4L2_HDR10_MASTERING_PRIMARIES_Y_HIGH)
1120 				return -EINVAL;
1121 		}
1122 
1123 		if (p_hdr10_mastering->white_point_x <
1124 			V4L2_HDR10_MASTERING_WHITE_POINT_X_LOW ||
1125 		    p_hdr10_mastering->white_point_x >
1126 			V4L2_HDR10_MASTERING_WHITE_POINT_X_HIGH ||
1127 		    p_hdr10_mastering->white_point_y <
1128 			V4L2_HDR10_MASTERING_WHITE_POINT_Y_LOW ||
1129 		    p_hdr10_mastering->white_point_y >
1130 			V4L2_HDR10_MASTERING_WHITE_POINT_Y_HIGH)
1131 			return -EINVAL;
1132 
1133 		if (p_hdr10_mastering->max_display_mastering_luminance <
1134 			V4L2_HDR10_MASTERING_MAX_LUMA_LOW ||
1135 		    p_hdr10_mastering->max_display_mastering_luminance >
1136 			V4L2_HDR10_MASTERING_MAX_LUMA_HIGH ||
1137 		    p_hdr10_mastering->min_display_mastering_luminance <
1138 			V4L2_HDR10_MASTERING_MIN_LUMA_LOW ||
1139 		    p_hdr10_mastering->min_display_mastering_luminance >
1140 			V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
1141 			return -EINVAL;
1142 
1143 		/* The following restriction comes from ITU-T Rec. H.265 spec */
1144 		if (p_hdr10_mastering->max_display_mastering_luminance ==
1145 			V4L2_HDR10_MASTERING_MAX_LUMA_LOW &&
1146 		    p_hdr10_mastering->min_display_mastering_luminance ==
1147 			V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
1148 			return -EINVAL;
1149 
1150 		break;
1151 
1152 	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
1153 		break;
1154 
1155 	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
1156 		return validate_vp9_compressed_hdr(p);
1157 
1158 	case V4L2_CTRL_TYPE_VP9_FRAME:
1159 		return validate_vp9_frame(p);
1160 	case V4L2_CTRL_TYPE_AV1_FRAME:
1161 		return validate_av1_frame(p);
1162 	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
1163 		return validate_av1_sequence(p);
1164 	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
1165 		break;
1166 	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
1167 		return validate_av1_film_grain(p);
1168 
1169 	case V4L2_CTRL_TYPE_AREA:
1170 		area = p;
1171 		if (!area->width || !area->height)
1172 			return -EINVAL;
1173 		break;
1174 
1175 	default:
1176 		return -EINVAL;
1177 	}
1178 
1179 	return 0;
1180 }
1181 
1182 static int std_validate_elem(const struct v4l2_ctrl *ctrl, u32 idx,
1183 			     union v4l2_ctrl_ptr ptr)
1184 {
1185 	size_t len;
1186 	u64 offset;
1187 	s64 val;
1188 
1189 	switch ((u32)ctrl->type) {
1190 	case V4L2_CTRL_TYPE_INTEGER:
1191 		return ROUND_TO_RANGE(ptr.p_s32[idx], u32, ctrl);
1192 	case V4L2_CTRL_TYPE_INTEGER64:
1193 		/*
1194 		 * We can't use the ROUND_TO_RANGE define here due to
1195 		 * the u64 divide that needs special care.
1196 		 */
1197 		val = ptr.p_s64[idx];
1198 		if (ctrl->maximum >= 0 && val >= ctrl->maximum - (s64)(ctrl->step / 2))
1199 			val = ctrl->maximum;
1200 		else
1201 			val += (s64)(ctrl->step / 2);
1202 		val = clamp_t(s64, val, ctrl->minimum, ctrl->maximum);
1203 		offset = val - ctrl->minimum;
1204 		do_div(offset, ctrl->step);
1205 		ptr.p_s64[idx] = ctrl->minimum + offset * ctrl->step;
1206 		return 0;
1207 	case V4L2_CTRL_TYPE_U8:
1208 		return ROUND_TO_RANGE(ptr.p_u8[idx], u8, ctrl);
1209 	case V4L2_CTRL_TYPE_U16:
1210 		return ROUND_TO_RANGE(ptr.p_u16[idx], u16, ctrl);
1211 	case V4L2_CTRL_TYPE_U32:
1212 		return ROUND_TO_RANGE(ptr.p_u32[idx], u32, ctrl);
1213 
1214 	case V4L2_CTRL_TYPE_BOOLEAN:
1215 		ptr.p_s32[idx] = !!ptr.p_s32[idx];
1216 		return 0;
1217 
1218 	case V4L2_CTRL_TYPE_MENU:
1219 	case V4L2_CTRL_TYPE_INTEGER_MENU:
1220 		if (ptr.p_s32[idx] < ctrl->minimum || ptr.p_s32[idx] > ctrl->maximum)
1221 			return -ERANGE;
1222 		if (ptr.p_s32[idx] < BITS_PER_LONG_LONG &&
1223 		    (ctrl->menu_skip_mask & BIT_ULL(ptr.p_s32[idx])))
1224 			return -EINVAL;
1225 		if (ctrl->type == V4L2_CTRL_TYPE_MENU &&
1226 		    ctrl->qmenu[ptr.p_s32[idx]][0] == '\0')
1227 			return -EINVAL;
1228 		return 0;
1229 
1230 	case V4L2_CTRL_TYPE_BITMASK:
1231 		ptr.p_s32[idx] &= ctrl->maximum;
1232 		return 0;
1233 
1234 	case V4L2_CTRL_TYPE_BUTTON:
1235 	case V4L2_CTRL_TYPE_CTRL_CLASS:
1236 		ptr.p_s32[idx] = 0;
1237 		return 0;
1238 
1239 	case V4L2_CTRL_TYPE_STRING:
1240 		idx *= ctrl->elem_size;
1241 		len = strlen(ptr.p_char + idx);
1242 		if (len < ctrl->minimum)
1243 			return -ERANGE;
1244 		if ((len - (u32)ctrl->minimum) % (u32)ctrl->step)
1245 			return -ERANGE;
1246 		return 0;
1247 
1248 	default:
1249 		return std_validate_compound(ctrl, idx, ptr);
1250 	}
1251 }
1252 
1253 int v4l2_ctrl_type_op_validate(const struct v4l2_ctrl *ctrl,
1254 			       union v4l2_ctrl_ptr ptr)
1255 {
1256 	unsigned int i;
1257 	int ret = 0;
1258 
1259 	switch ((u32)ctrl->type) {
1260 	case V4L2_CTRL_TYPE_U8:
1261 		if (ctrl->maximum == 0xff && ctrl->minimum == 0 && ctrl->step == 1)
1262 			return 0;
1263 		break;
1264 	case V4L2_CTRL_TYPE_U16:
1265 		if (ctrl->maximum == 0xffff && ctrl->minimum == 0 && ctrl->step == 1)
1266 			return 0;
1267 		break;
1268 	case V4L2_CTRL_TYPE_U32:
1269 		if (ctrl->maximum == 0xffffffff && ctrl->minimum == 0 && ctrl->step == 1)
1270 			return 0;
1271 		break;
1272 
1273 	case V4L2_CTRL_TYPE_BUTTON:
1274 	case V4L2_CTRL_TYPE_CTRL_CLASS:
1275 		memset(ptr.p_s32, 0, ctrl->new_elems * sizeof(s32));
1276 		return 0;
1277 	}
1278 
1279 	for (i = 0; !ret && i < ctrl->new_elems; i++)
1280 		ret = std_validate_elem(ctrl, i, ptr);
1281 	return ret;
1282 }
1283 EXPORT_SYMBOL(v4l2_ctrl_type_op_validate);
1284 
1285 static const struct v4l2_ctrl_type_ops std_type_ops = {
1286 	.equal = v4l2_ctrl_type_op_equal,
1287 	.init = v4l2_ctrl_type_op_init,
1288 	.log = v4l2_ctrl_type_op_log,
1289 	.validate = v4l2_ctrl_type_op_validate,
1290 };
1291 
1292 void v4l2_ctrl_notify(struct v4l2_ctrl *ctrl, v4l2_ctrl_notify_fnc notify, void *priv)
1293 {
1294 	if (!ctrl)
1295 		return;
1296 	if (!notify) {
1297 		ctrl->call_notify = 0;
1298 		return;
1299 	}
1300 	if (WARN_ON(ctrl->handler->notify && ctrl->handler->notify != notify))
1301 		return;
1302 	ctrl->handler->notify = notify;
1303 	ctrl->handler->notify_priv = priv;
1304 	ctrl->call_notify = 1;
1305 }
1306 EXPORT_SYMBOL(v4l2_ctrl_notify);
1307 
1308 /* Copy the one value to another. */
1309 static void ptr_to_ptr(struct v4l2_ctrl *ctrl,
1310 		       union v4l2_ctrl_ptr from, union v4l2_ctrl_ptr to,
1311 		       unsigned int elems)
1312 {
1313 	if (ctrl == NULL)
1314 		return;
1315 	memcpy(to.p, from.p_const, elems * ctrl->elem_size);
1316 }
1317 
1318 /* Copy the new value to the current value. */
1319 void new_to_cur(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
1320 {
1321 	bool changed;
1322 
1323 	if (ctrl == NULL)
1324 		return;
1325 
1326 	/* has_changed is set by cluster_changed */
1327 	changed = ctrl->has_changed;
1328 	if (changed) {
1329 		if (ctrl->is_dyn_array)
1330 			ctrl->elems = ctrl->new_elems;
1331 		ptr_to_ptr(ctrl, ctrl->p_new, ctrl->p_cur, ctrl->elems);
1332 	}
1333 
1334 	if (ch_flags & V4L2_EVENT_CTRL_CH_FLAGS) {
1335 		/* Note: CH_FLAGS is only set for auto clusters. */
1336 		ctrl->flags &=
1337 			~(V4L2_CTRL_FLAG_INACTIVE | V4L2_CTRL_FLAG_VOLATILE);
1338 		if (!is_cur_manual(ctrl->cluster[0])) {
1339 			ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
1340 			if (ctrl->cluster[0]->has_volatiles)
1341 				ctrl->flags |= V4L2_CTRL_FLAG_VOLATILE;
1342 		}
1343 		fh = NULL;
1344 	}
1345 	if (changed || ch_flags) {
1346 		/* If a control was changed that was not one of the controls
1347 		   modified by the application, then send the event to all. */
1348 		if (!ctrl->is_new)
1349 			fh = NULL;
1350 		send_event(fh, ctrl,
1351 			(changed ? V4L2_EVENT_CTRL_CH_VALUE : 0) | ch_flags);
1352 		if (ctrl->call_notify && changed && ctrl->handler->notify)
1353 			ctrl->handler->notify(ctrl, ctrl->handler->notify_priv);
1354 	}
1355 }
1356 
1357 /* Copy the current value to the new value */
1358 void cur_to_new(struct v4l2_ctrl *ctrl)
1359 {
1360 	if (ctrl == NULL)
1361 		return;
1362 	if (ctrl->is_dyn_array)
1363 		ctrl->new_elems = ctrl->elems;
1364 	ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new, ctrl->new_elems);
1365 }
1366 
1367 static bool req_alloc_array(struct v4l2_ctrl_ref *ref, u32 elems)
1368 {
1369 	void *tmp;
1370 
1371 	if (elems == ref->p_req_array_alloc_elems)
1372 		return true;
1373 	if (ref->ctrl->is_dyn_array &&
1374 	    elems < ref->p_req_array_alloc_elems)
1375 		return true;
1376 
1377 	tmp = kvmalloc(elems * ref->ctrl->elem_size, GFP_KERNEL);
1378 
1379 	if (!tmp) {
1380 		ref->p_req_array_enomem = true;
1381 		return false;
1382 	}
1383 	ref->p_req_array_enomem = false;
1384 	kvfree(ref->p_req.p);
1385 	ref->p_req.p = tmp;
1386 	ref->p_req_array_alloc_elems = elems;
1387 	return true;
1388 }
1389 
1390 /* Copy the new value to the request value */
1391 void new_to_req(struct v4l2_ctrl_ref *ref)
1392 {
1393 	struct v4l2_ctrl *ctrl;
1394 
1395 	if (!ref)
1396 		return;
1397 
1398 	ctrl = ref->ctrl;
1399 	if (ctrl->is_array && !req_alloc_array(ref, ctrl->new_elems))
1400 		return;
1401 
1402 	ref->p_req_elems = ctrl->new_elems;
1403 	ptr_to_ptr(ctrl, ctrl->p_new, ref->p_req, ref->p_req_elems);
1404 	ref->p_req_valid = true;
1405 }
1406 
1407 /* Copy the current value to the request value */
1408 void cur_to_req(struct v4l2_ctrl_ref *ref)
1409 {
1410 	struct v4l2_ctrl *ctrl;
1411 
1412 	if (!ref)
1413 		return;
1414 
1415 	ctrl = ref->ctrl;
1416 	if (ctrl->is_array && !req_alloc_array(ref, ctrl->elems))
1417 		return;
1418 
1419 	ref->p_req_elems = ctrl->elems;
1420 	ptr_to_ptr(ctrl, ctrl->p_cur, ref->p_req, ctrl->elems);
1421 	ref->p_req_valid = true;
1422 }
1423 
1424 /* Copy the request value to the new value */
1425 int req_to_new(struct v4l2_ctrl_ref *ref)
1426 {
1427 	struct v4l2_ctrl *ctrl;
1428 
1429 	if (!ref)
1430 		return 0;
1431 
1432 	ctrl = ref->ctrl;
1433 
1434 	/*
1435 	 * This control was never set in the request, so just use the current
1436 	 * value.
1437 	 */
1438 	if (!ref->p_req_valid) {
1439 		if (ctrl->is_dyn_array)
1440 			ctrl->new_elems = ctrl->elems;
1441 		ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new, ctrl->new_elems);
1442 		return 0;
1443 	}
1444 
1445 	/* Not an array, so just copy the request value */
1446 	if (!ctrl->is_array) {
1447 		ptr_to_ptr(ctrl, ref->p_req, ctrl->p_new, ctrl->new_elems);
1448 		return 0;
1449 	}
1450 
1451 	/* Sanity check, should never happen */
1452 	if (WARN_ON(!ref->p_req_array_alloc_elems))
1453 		return -ENOMEM;
1454 
1455 	if (!ctrl->is_dyn_array &&
1456 	    ref->p_req_elems != ctrl->p_array_alloc_elems)
1457 		return -ENOMEM;
1458 
1459 	/*
1460 	 * Check if the number of elements in the request is more than the
1461 	 * elements in ctrl->p_array. If so, attempt to realloc ctrl->p_array.
1462 	 * Note that p_array is allocated with twice the number of elements
1463 	 * in the dynamic array since it has to store both the current and
1464 	 * new value of such a control.
1465 	 */
1466 	if (ref->p_req_elems > ctrl->p_array_alloc_elems) {
1467 		unsigned int sz = ref->p_req_elems * ctrl->elem_size;
1468 		void *old = ctrl->p_array;
1469 		void *tmp = kvzalloc(2 * sz, GFP_KERNEL);
1470 
1471 		if (!tmp)
1472 			return -ENOMEM;
1473 		memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size);
1474 		memcpy(tmp + sz, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size);
1475 		ctrl->p_new.p = tmp;
1476 		ctrl->p_cur.p = tmp + sz;
1477 		ctrl->p_array = tmp;
1478 		ctrl->p_array_alloc_elems = ref->p_req_elems;
1479 		kvfree(old);
1480 	}
1481 
1482 	ctrl->new_elems = ref->p_req_elems;
1483 	ptr_to_ptr(ctrl, ref->p_req, ctrl->p_new, ctrl->new_elems);
1484 	return 0;
1485 }
1486 
1487 /* Control range checking */
1488 int check_range(enum v4l2_ctrl_type type,
1489 		s64 min, s64 max, u64 step, s64 def)
1490 {
1491 	switch (type) {
1492 	case V4L2_CTRL_TYPE_BOOLEAN:
1493 		if (step != 1 || max > 1 || min < 0)
1494 			return -ERANGE;
1495 		fallthrough;
1496 	case V4L2_CTRL_TYPE_U8:
1497 	case V4L2_CTRL_TYPE_U16:
1498 	case V4L2_CTRL_TYPE_U32:
1499 	case V4L2_CTRL_TYPE_INTEGER:
1500 	case V4L2_CTRL_TYPE_INTEGER64:
1501 		if (step == 0 || min > max || def < min || def > max)
1502 			return -ERANGE;
1503 		return 0;
1504 	case V4L2_CTRL_TYPE_BITMASK:
1505 		if (step || min || !max || (def & ~max))
1506 			return -ERANGE;
1507 		return 0;
1508 	case V4L2_CTRL_TYPE_MENU:
1509 	case V4L2_CTRL_TYPE_INTEGER_MENU:
1510 		if (min > max || def < min || def > max ||
1511 		    min < 0 || (step && max >= BITS_PER_LONG_LONG))
1512 			return -ERANGE;
1513 		/* Note: step == menu_skip_mask for menu controls.
1514 		   So here we check if the default value is masked out. */
1515 		if (def < BITS_PER_LONG_LONG && (step & BIT_ULL(def)))
1516 			return -EINVAL;
1517 		return 0;
1518 	case V4L2_CTRL_TYPE_STRING:
1519 		if (min > max || min < 0 || step < 1 || def)
1520 			return -ERANGE;
1521 		return 0;
1522 	default:
1523 		return 0;
1524 	}
1525 }
1526 
1527 /* Set the handler's error code if it wasn't set earlier already */
1528 static inline int handler_set_err(struct v4l2_ctrl_handler *hdl, int err)
1529 {
1530 	if (hdl->error == 0)
1531 		hdl->error = err;
1532 	return err;
1533 }
1534 
1535 /* Initialize the handler */
1536 int v4l2_ctrl_handler_init_class(struct v4l2_ctrl_handler *hdl,
1537 				 unsigned nr_of_controls_hint,
1538 				 struct lock_class_key *key, const char *name)
1539 {
1540 	mutex_init(&hdl->_lock);
1541 	hdl->lock = &hdl->_lock;
1542 	lockdep_set_class_and_name(hdl->lock, key, name);
1543 	INIT_LIST_HEAD(&hdl->ctrls);
1544 	INIT_LIST_HEAD(&hdl->ctrl_refs);
1545 	hdl->nr_of_buckets = 1 + nr_of_controls_hint / 8;
1546 	hdl->buckets = kvcalloc(hdl->nr_of_buckets, sizeof(hdl->buckets[0]),
1547 				GFP_KERNEL);
1548 	hdl->error = hdl->buckets ? 0 : -ENOMEM;
1549 	v4l2_ctrl_handler_init_request(hdl);
1550 	return hdl->error;
1551 }
1552 EXPORT_SYMBOL(v4l2_ctrl_handler_init_class);
1553 
1554 /* Free all controls and control refs */
1555 void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl)
1556 {
1557 	struct v4l2_ctrl_ref *ref, *next_ref;
1558 	struct v4l2_ctrl *ctrl, *next_ctrl;
1559 	struct v4l2_subscribed_event *sev, *next_sev;
1560 
1561 	if (hdl == NULL || hdl->buckets == NULL)
1562 		return;
1563 
1564 	v4l2_ctrl_handler_free_request(hdl);
1565 
1566 	mutex_lock(hdl->lock);
1567 	/* Free all nodes */
1568 	list_for_each_entry_safe(ref, next_ref, &hdl->ctrl_refs, node) {
1569 		list_del(&ref->node);
1570 		if (ref->p_req_array_alloc_elems)
1571 			kvfree(ref->p_req.p);
1572 		kfree(ref);
1573 	}
1574 	/* Free all controls owned by the handler */
1575 	list_for_each_entry_safe(ctrl, next_ctrl, &hdl->ctrls, node) {
1576 		list_del(&ctrl->node);
1577 		list_for_each_entry_safe(sev, next_sev, &ctrl->ev_subs, node)
1578 			list_del(&sev->node);
1579 		kvfree(ctrl->p_array);
1580 		kvfree(ctrl);
1581 	}
1582 	kvfree(hdl->buckets);
1583 	hdl->buckets = NULL;
1584 	hdl->cached = NULL;
1585 	hdl->error = 0;
1586 	mutex_unlock(hdl->lock);
1587 	mutex_destroy(&hdl->_lock);
1588 }
1589 EXPORT_SYMBOL(v4l2_ctrl_handler_free);
1590 
1591 /* For backwards compatibility: V4L2_CID_PRIVATE_BASE should no longer
1592    be used except in G_CTRL, S_CTRL, QUERYCTRL and QUERYMENU when dealing
1593    with applications that do not use the NEXT_CTRL flag.
1594 
1595    We just find the n-th private user control. It's O(N), but that should not
1596    be an issue in this particular case. */
1597 static struct v4l2_ctrl_ref *find_private_ref(
1598 		struct v4l2_ctrl_handler *hdl, u32 id)
1599 {
1600 	struct v4l2_ctrl_ref *ref;
1601 
1602 	id -= V4L2_CID_PRIVATE_BASE;
1603 	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1604 		/* Search for private user controls that are compatible with
1605 		   VIDIOC_G/S_CTRL. */
1606 		if (V4L2_CTRL_ID2WHICH(ref->ctrl->id) == V4L2_CTRL_CLASS_USER &&
1607 		    V4L2_CTRL_DRIVER_PRIV(ref->ctrl->id)) {
1608 			if (!ref->ctrl->is_int)
1609 				continue;
1610 			if (id == 0)
1611 				return ref;
1612 			id--;
1613 		}
1614 	}
1615 	return NULL;
1616 }
1617 
1618 /* Find a control with the given ID. */
1619 struct v4l2_ctrl_ref *find_ref(struct v4l2_ctrl_handler *hdl, u32 id)
1620 {
1621 	struct v4l2_ctrl_ref *ref;
1622 	int bucket;
1623 
1624 	id &= V4L2_CTRL_ID_MASK;
1625 
1626 	/* Old-style private controls need special handling */
1627 	if (id >= V4L2_CID_PRIVATE_BASE)
1628 		return find_private_ref(hdl, id);
1629 	bucket = id % hdl->nr_of_buckets;
1630 
1631 	/* Simple optimization: cache the last control found */
1632 	if (hdl->cached && hdl->cached->ctrl->id == id)
1633 		return hdl->cached;
1634 
1635 	/* Not in cache, search the hash */
1636 	ref = hdl->buckets ? hdl->buckets[bucket] : NULL;
1637 	while (ref && ref->ctrl->id != id)
1638 		ref = ref->next;
1639 
1640 	if (ref)
1641 		hdl->cached = ref; /* cache it! */
1642 	return ref;
1643 }
1644 
1645 /* Find a control with the given ID. Take the handler's lock first. */
1646 struct v4l2_ctrl_ref *find_ref_lock(struct v4l2_ctrl_handler *hdl, u32 id)
1647 {
1648 	struct v4l2_ctrl_ref *ref = NULL;
1649 
1650 	if (hdl) {
1651 		mutex_lock(hdl->lock);
1652 		ref = find_ref(hdl, id);
1653 		mutex_unlock(hdl->lock);
1654 	}
1655 	return ref;
1656 }
1657 
1658 /* Find a control with the given ID. */
1659 struct v4l2_ctrl *v4l2_ctrl_find(struct v4l2_ctrl_handler *hdl, u32 id)
1660 {
1661 	struct v4l2_ctrl_ref *ref = find_ref_lock(hdl, id);
1662 
1663 	return ref ? ref->ctrl : NULL;
1664 }
1665 EXPORT_SYMBOL(v4l2_ctrl_find);
1666 
1667 /* Allocate a new v4l2_ctrl_ref and hook it into the handler. */
1668 int handler_new_ref(struct v4l2_ctrl_handler *hdl,
1669 		    struct v4l2_ctrl *ctrl,
1670 		    struct v4l2_ctrl_ref **ctrl_ref,
1671 		    bool from_other_dev, bool allocate_req)
1672 {
1673 	struct v4l2_ctrl_ref *ref;
1674 	struct v4l2_ctrl_ref *new_ref;
1675 	u32 id = ctrl->id;
1676 	u32 class_ctrl = V4L2_CTRL_ID2WHICH(id) | 1;
1677 	int bucket = id % hdl->nr_of_buckets;	/* which bucket to use */
1678 	unsigned int size_extra_req = 0;
1679 
1680 	if (ctrl_ref)
1681 		*ctrl_ref = NULL;
1682 
1683 	/*
1684 	 * Automatically add the control class if it is not yet present and
1685 	 * the new control is not a compound control.
1686 	 */
1687 	if (ctrl->type < V4L2_CTRL_COMPOUND_TYPES &&
1688 	    id != class_ctrl && find_ref_lock(hdl, class_ctrl) == NULL)
1689 		if (!v4l2_ctrl_new_std(hdl, NULL, class_ctrl, 0, 0, 0, 0))
1690 			return hdl->error;
1691 
1692 	if (hdl->error)
1693 		return hdl->error;
1694 
1695 	if (allocate_req && !ctrl->is_array)
1696 		size_extra_req = ctrl->elems * ctrl->elem_size;
1697 	new_ref = kzalloc(sizeof(*new_ref) + size_extra_req, GFP_KERNEL);
1698 	if (!new_ref)
1699 		return handler_set_err(hdl, -ENOMEM);
1700 	new_ref->ctrl = ctrl;
1701 	new_ref->from_other_dev = from_other_dev;
1702 	if (size_extra_req)
1703 		new_ref->p_req.p = &new_ref[1];
1704 
1705 	INIT_LIST_HEAD(&new_ref->node);
1706 
1707 	mutex_lock(hdl->lock);
1708 
1709 	/* Add immediately at the end of the list if the list is empty, or if
1710 	   the last element in the list has a lower ID.
1711 	   This ensures that when elements are added in ascending order the
1712 	   insertion is an O(1) operation. */
1713 	if (list_empty(&hdl->ctrl_refs) || id > node2id(hdl->ctrl_refs.prev)) {
1714 		list_add_tail(&new_ref->node, &hdl->ctrl_refs);
1715 		goto insert_in_hash;
1716 	}
1717 
1718 	/* Find insert position in sorted list */
1719 	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1720 		if (ref->ctrl->id < id)
1721 			continue;
1722 		/* Don't add duplicates */
1723 		if (ref->ctrl->id == id) {
1724 			kfree(new_ref);
1725 			goto unlock;
1726 		}
1727 		list_add(&new_ref->node, ref->node.prev);
1728 		break;
1729 	}
1730 
1731 insert_in_hash:
1732 	/* Insert the control node in the hash */
1733 	new_ref->next = hdl->buckets[bucket];
1734 	hdl->buckets[bucket] = new_ref;
1735 	if (ctrl_ref)
1736 		*ctrl_ref = new_ref;
1737 	if (ctrl->handler == hdl) {
1738 		/* By default each control starts in a cluster of its own.
1739 		 * new_ref->ctrl is basically a cluster array with one
1740 		 * element, so that's perfect to use as the cluster pointer.
1741 		 * But only do this for the handler that owns the control.
1742 		 */
1743 		ctrl->cluster = &new_ref->ctrl;
1744 		ctrl->ncontrols = 1;
1745 	}
1746 
1747 unlock:
1748 	mutex_unlock(hdl->lock);
1749 	return 0;
1750 }
1751 
1752 /* Add a new control */
1753 static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl,
1754 			const struct v4l2_ctrl_ops *ops,
1755 			const struct v4l2_ctrl_type_ops *type_ops,
1756 			u32 id, const char *name, enum v4l2_ctrl_type type,
1757 			s64 min, s64 max, u64 step, s64 def,
1758 			const u32 dims[V4L2_CTRL_MAX_DIMS], u32 elem_size,
1759 			u32 flags, const char * const *qmenu,
1760 			const s64 *qmenu_int, const union v4l2_ctrl_ptr p_def,
1761 			void *priv)
1762 {
1763 	struct v4l2_ctrl *ctrl;
1764 	unsigned sz_extra;
1765 	unsigned nr_of_dims = 0;
1766 	unsigned elems = 1;
1767 	bool is_array;
1768 	unsigned tot_ctrl_size;
1769 	void *data;
1770 	int err;
1771 
1772 	if (hdl->error)
1773 		return NULL;
1774 
1775 	while (dims && dims[nr_of_dims]) {
1776 		elems *= dims[nr_of_dims];
1777 		nr_of_dims++;
1778 		if (nr_of_dims == V4L2_CTRL_MAX_DIMS)
1779 			break;
1780 	}
1781 	is_array = nr_of_dims > 0;
1782 
1783 	/* Prefill elem_size for all types handled by std_type_ops */
1784 	switch ((u32)type) {
1785 	case V4L2_CTRL_TYPE_INTEGER64:
1786 		elem_size = sizeof(s64);
1787 		break;
1788 	case V4L2_CTRL_TYPE_STRING:
1789 		elem_size = max + 1;
1790 		break;
1791 	case V4L2_CTRL_TYPE_U8:
1792 		elem_size = sizeof(u8);
1793 		break;
1794 	case V4L2_CTRL_TYPE_U16:
1795 		elem_size = sizeof(u16);
1796 		break;
1797 	case V4L2_CTRL_TYPE_U32:
1798 		elem_size = sizeof(u32);
1799 		break;
1800 	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
1801 		elem_size = sizeof(struct v4l2_ctrl_mpeg2_sequence);
1802 		break;
1803 	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
1804 		elem_size = sizeof(struct v4l2_ctrl_mpeg2_picture);
1805 		break;
1806 	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
1807 		elem_size = sizeof(struct v4l2_ctrl_mpeg2_quantisation);
1808 		break;
1809 	case V4L2_CTRL_TYPE_FWHT_PARAMS:
1810 		elem_size = sizeof(struct v4l2_ctrl_fwht_params);
1811 		break;
1812 	case V4L2_CTRL_TYPE_H264_SPS:
1813 		elem_size = sizeof(struct v4l2_ctrl_h264_sps);
1814 		break;
1815 	case V4L2_CTRL_TYPE_H264_PPS:
1816 		elem_size = sizeof(struct v4l2_ctrl_h264_pps);
1817 		break;
1818 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
1819 		elem_size = sizeof(struct v4l2_ctrl_h264_scaling_matrix);
1820 		break;
1821 	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
1822 		elem_size = sizeof(struct v4l2_ctrl_h264_slice_params);
1823 		break;
1824 	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1825 		elem_size = sizeof(struct v4l2_ctrl_h264_decode_params);
1826 		break;
1827 	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
1828 		elem_size = sizeof(struct v4l2_ctrl_h264_pred_weights);
1829 		break;
1830 	case V4L2_CTRL_TYPE_VP8_FRAME:
1831 		elem_size = sizeof(struct v4l2_ctrl_vp8_frame);
1832 		break;
1833 	case V4L2_CTRL_TYPE_HEVC_SPS:
1834 		elem_size = sizeof(struct v4l2_ctrl_hevc_sps);
1835 		break;
1836 	case V4L2_CTRL_TYPE_HEVC_PPS:
1837 		elem_size = sizeof(struct v4l2_ctrl_hevc_pps);
1838 		break;
1839 	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
1840 		elem_size = sizeof(struct v4l2_ctrl_hevc_slice_params);
1841 		break;
1842 	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
1843 		elem_size = sizeof(struct v4l2_ctrl_hevc_scaling_matrix);
1844 		break;
1845 	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
1846 		elem_size = sizeof(struct v4l2_ctrl_hevc_decode_params);
1847 		break;
1848 	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
1849 		elem_size = sizeof(struct v4l2_ctrl_hdr10_cll_info);
1850 		break;
1851 	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
1852 		elem_size = sizeof(struct v4l2_ctrl_hdr10_mastering_display);
1853 		break;
1854 	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
1855 		elem_size = sizeof(struct v4l2_ctrl_vp9_compressed_hdr);
1856 		break;
1857 	case V4L2_CTRL_TYPE_VP9_FRAME:
1858 		elem_size = sizeof(struct v4l2_ctrl_vp9_frame);
1859 		break;
1860 	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
1861 		elem_size = sizeof(struct v4l2_ctrl_av1_sequence);
1862 		break;
1863 	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
1864 		elem_size = sizeof(struct v4l2_ctrl_av1_tile_group_entry);
1865 		break;
1866 	case V4L2_CTRL_TYPE_AV1_FRAME:
1867 		elem_size = sizeof(struct v4l2_ctrl_av1_frame);
1868 		break;
1869 	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
1870 		elem_size = sizeof(struct v4l2_ctrl_av1_film_grain);
1871 		break;
1872 	case V4L2_CTRL_TYPE_AREA:
1873 		elem_size = sizeof(struct v4l2_area);
1874 		break;
1875 	default:
1876 		if (type < V4L2_CTRL_COMPOUND_TYPES)
1877 			elem_size = sizeof(s32);
1878 		break;
1879 	}
1880 
1881 	/* Sanity checks */
1882 	if (id == 0 || name == NULL || !elem_size ||
1883 	    id >= V4L2_CID_PRIVATE_BASE ||
1884 	    (type == V4L2_CTRL_TYPE_MENU && qmenu == NULL) ||
1885 	    (type == V4L2_CTRL_TYPE_INTEGER_MENU && qmenu_int == NULL)) {
1886 		handler_set_err(hdl, -ERANGE);
1887 		return NULL;
1888 	}
1889 	err = check_range(type, min, max, step, def);
1890 	if (err) {
1891 		handler_set_err(hdl, err);
1892 		return NULL;
1893 	}
1894 	if (is_array &&
1895 	    (type == V4L2_CTRL_TYPE_BUTTON ||
1896 	     type == V4L2_CTRL_TYPE_CTRL_CLASS)) {
1897 		handler_set_err(hdl, -EINVAL);
1898 		return NULL;
1899 	}
1900 	if (flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY) {
1901 		/*
1902 		 * For now only support this for one-dimensional arrays only.
1903 		 *
1904 		 * This can be relaxed in the future, but this will
1905 		 * require more effort.
1906 		 */
1907 		if (nr_of_dims != 1) {
1908 			handler_set_err(hdl, -EINVAL);
1909 			return NULL;
1910 		}
1911 		/* Start with just 1 element */
1912 		elems = 1;
1913 	}
1914 
1915 	tot_ctrl_size = elem_size * elems;
1916 	sz_extra = 0;
1917 	if (type == V4L2_CTRL_TYPE_BUTTON)
1918 		flags |= V4L2_CTRL_FLAG_WRITE_ONLY |
1919 			V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
1920 	else if (type == V4L2_CTRL_TYPE_CTRL_CLASS)
1921 		flags |= V4L2_CTRL_FLAG_READ_ONLY;
1922 	else if (!is_array &&
1923 		 (type == V4L2_CTRL_TYPE_INTEGER64 ||
1924 		  type == V4L2_CTRL_TYPE_STRING ||
1925 		  type >= V4L2_CTRL_COMPOUND_TYPES))
1926 		sz_extra += 2 * tot_ctrl_size;
1927 
1928 	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const)
1929 		sz_extra += elem_size;
1930 
1931 	ctrl = kvzalloc(sizeof(*ctrl) + sz_extra, GFP_KERNEL);
1932 	if (ctrl == NULL) {
1933 		handler_set_err(hdl, -ENOMEM);
1934 		return NULL;
1935 	}
1936 
1937 	INIT_LIST_HEAD(&ctrl->node);
1938 	INIT_LIST_HEAD(&ctrl->ev_subs);
1939 	ctrl->handler = hdl;
1940 	ctrl->ops = ops;
1941 	ctrl->type_ops = type_ops ? type_ops : &std_type_ops;
1942 	ctrl->id = id;
1943 	ctrl->name = name;
1944 	ctrl->type = type;
1945 	ctrl->flags = flags;
1946 	ctrl->minimum = min;
1947 	ctrl->maximum = max;
1948 	ctrl->step = step;
1949 	ctrl->default_value = def;
1950 	ctrl->is_string = !is_array && type == V4L2_CTRL_TYPE_STRING;
1951 	ctrl->is_ptr = is_array || type >= V4L2_CTRL_COMPOUND_TYPES || ctrl->is_string;
1952 	ctrl->is_int = !ctrl->is_ptr && type != V4L2_CTRL_TYPE_INTEGER64;
1953 	ctrl->is_array = is_array;
1954 	ctrl->is_dyn_array = !!(flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY);
1955 	ctrl->elems = elems;
1956 	ctrl->new_elems = elems;
1957 	ctrl->nr_of_dims = nr_of_dims;
1958 	if (nr_of_dims)
1959 		memcpy(ctrl->dims, dims, nr_of_dims * sizeof(dims[0]));
1960 	ctrl->elem_size = elem_size;
1961 	if (type == V4L2_CTRL_TYPE_MENU)
1962 		ctrl->qmenu = qmenu;
1963 	else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
1964 		ctrl->qmenu_int = qmenu_int;
1965 	ctrl->priv = priv;
1966 	ctrl->cur.val = ctrl->val = def;
1967 	data = &ctrl[1];
1968 
1969 	if (ctrl->is_array) {
1970 		ctrl->p_array_alloc_elems = elems;
1971 		ctrl->p_array = kvzalloc(2 * elems * elem_size, GFP_KERNEL);
1972 		if (!ctrl->p_array) {
1973 			kvfree(ctrl);
1974 			return NULL;
1975 		}
1976 		data = ctrl->p_array;
1977 	}
1978 
1979 	if (!ctrl->is_int) {
1980 		ctrl->p_new.p = data;
1981 		ctrl->p_cur.p = data + tot_ctrl_size;
1982 	} else {
1983 		ctrl->p_new.p = &ctrl->val;
1984 		ctrl->p_cur.p = &ctrl->cur.val;
1985 	}
1986 
1987 	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const) {
1988 		if (ctrl->is_array)
1989 			ctrl->p_def.p = &ctrl[1];
1990 		else
1991 			ctrl->p_def.p = ctrl->p_cur.p + tot_ctrl_size;
1992 		memcpy(ctrl->p_def.p, p_def.p_const, elem_size);
1993 	}
1994 
1995 	ctrl->type_ops->init(ctrl, 0, ctrl->p_cur);
1996 	cur_to_new(ctrl);
1997 
1998 	if (handler_new_ref(hdl, ctrl, NULL, false, false)) {
1999 		kvfree(ctrl->p_array);
2000 		kvfree(ctrl);
2001 		return NULL;
2002 	}
2003 	mutex_lock(hdl->lock);
2004 	list_add_tail(&ctrl->node, &hdl->ctrls);
2005 	mutex_unlock(hdl->lock);
2006 	return ctrl;
2007 }
2008 
2009 struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
2010 			const struct v4l2_ctrl_config *cfg, void *priv)
2011 {
2012 	bool is_menu;
2013 	struct v4l2_ctrl *ctrl;
2014 	const char *name = cfg->name;
2015 	const char * const *qmenu = cfg->qmenu;
2016 	const s64 *qmenu_int = cfg->qmenu_int;
2017 	enum v4l2_ctrl_type type = cfg->type;
2018 	u32 flags = cfg->flags;
2019 	s64 min = cfg->min;
2020 	s64 max = cfg->max;
2021 	u64 step = cfg->step;
2022 	s64 def = cfg->def;
2023 
2024 	if (name == NULL)
2025 		v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
2026 								&def, &flags);
2027 
2028 	is_menu = (type == V4L2_CTRL_TYPE_MENU ||
2029 		   type == V4L2_CTRL_TYPE_INTEGER_MENU);
2030 	if (is_menu)
2031 		WARN_ON(step);
2032 	else
2033 		WARN_ON(cfg->menu_skip_mask);
2034 	if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
2035 		qmenu = v4l2_ctrl_get_menu(cfg->id);
2036 	} else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
2037 		handler_set_err(hdl, -EINVAL);
2038 		return NULL;
2039 	}
2040 
2041 	ctrl = v4l2_ctrl_new(hdl, cfg->ops, cfg->type_ops, cfg->id, name,
2042 			type, min, max,
2043 			is_menu ? cfg->menu_skip_mask : step, def,
2044 			cfg->dims, cfg->elem_size,
2045 			flags, qmenu, qmenu_int, cfg->p_def, priv);
2046 	if (ctrl)
2047 		ctrl->is_private = cfg->is_private;
2048 	return ctrl;
2049 }
2050 EXPORT_SYMBOL(v4l2_ctrl_new_custom);
2051 
2052 /* Helper function for standard non-menu controls */
2053 struct v4l2_ctrl *v4l2_ctrl_new_std(struct v4l2_ctrl_handler *hdl,
2054 			const struct v4l2_ctrl_ops *ops,
2055 			u32 id, s64 min, s64 max, u64 step, s64 def)
2056 {
2057 	const char *name;
2058 	enum v4l2_ctrl_type type;
2059 	u32 flags;
2060 
2061 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2062 	if (type == V4L2_CTRL_TYPE_MENU ||
2063 	    type == V4L2_CTRL_TYPE_INTEGER_MENU ||
2064 	    type >= V4L2_CTRL_COMPOUND_TYPES) {
2065 		handler_set_err(hdl, -EINVAL);
2066 		return NULL;
2067 	}
2068 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2069 			     min, max, step, def, NULL, 0,
2070 			     flags, NULL, NULL, ptr_null, NULL);
2071 }
2072 EXPORT_SYMBOL(v4l2_ctrl_new_std);
2073 
2074 /* Helper function for standard menu controls */
2075 struct v4l2_ctrl *v4l2_ctrl_new_std_menu(struct v4l2_ctrl_handler *hdl,
2076 			const struct v4l2_ctrl_ops *ops,
2077 			u32 id, u8 _max, u64 mask, u8 _def)
2078 {
2079 	const char * const *qmenu = NULL;
2080 	const s64 *qmenu_int = NULL;
2081 	unsigned int qmenu_int_len = 0;
2082 	const char *name;
2083 	enum v4l2_ctrl_type type;
2084 	s64 min;
2085 	s64 max = _max;
2086 	s64 def = _def;
2087 	u64 step;
2088 	u32 flags;
2089 
2090 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2091 
2092 	if (type == V4L2_CTRL_TYPE_MENU)
2093 		qmenu = v4l2_ctrl_get_menu(id);
2094 	else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
2095 		qmenu_int = v4l2_ctrl_get_int_menu(id, &qmenu_int_len);
2096 
2097 	if ((!qmenu && !qmenu_int) || (qmenu_int && max >= qmenu_int_len)) {
2098 		handler_set_err(hdl, -EINVAL);
2099 		return NULL;
2100 	}
2101 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2102 			     0, max, mask, def, NULL, 0,
2103 			     flags, qmenu, qmenu_int, ptr_null, NULL);
2104 }
2105 EXPORT_SYMBOL(v4l2_ctrl_new_std_menu);
2106 
2107 /* Helper function for standard menu controls with driver defined menu */
2108 struct v4l2_ctrl *v4l2_ctrl_new_std_menu_items(struct v4l2_ctrl_handler *hdl,
2109 			const struct v4l2_ctrl_ops *ops, u32 id, u8 _max,
2110 			u64 mask, u8 _def, const char * const *qmenu)
2111 {
2112 	enum v4l2_ctrl_type type;
2113 	const char *name;
2114 	u32 flags;
2115 	u64 step;
2116 	s64 min;
2117 	s64 max = _max;
2118 	s64 def = _def;
2119 
2120 	/* v4l2_ctrl_new_std_menu_items() should only be called for
2121 	 * standard controls without a standard menu.
2122 	 */
2123 	if (v4l2_ctrl_get_menu(id)) {
2124 		handler_set_err(hdl, -EINVAL);
2125 		return NULL;
2126 	}
2127 
2128 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2129 	if (type != V4L2_CTRL_TYPE_MENU || qmenu == NULL) {
2130 		handler_set_err(hdl, -EINVAL);
2131 		return NULL;
2132 	}
2133 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2134 			     0, max, mask, def, NULL, 0,
2135 			     flags, qmenu, NULL, ptr_null, NULL);
2136 
2137 }
2138 EXPORT_SYMBOL(v4l2_ctrl_new_std_menu_items);
2139 
2140 /* Helper function for standard compound controls */
2141 struct v4l2_ctrl *v4l2_ctrl_new_std_compound(struct v4l2_ctrl_handler *hdl,
2142 				const struct v4l2_ctrl_ops *ops, u32 id,
2143 				const union v4l2_ctrl_ptr p_def)
2144 {
2145 	const char *name;
2146 	enum v4l2_ctrl_type type;
2147 	u32 flags;
2148 	s64 min, max, step, def;
2149 
2150 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2151 	if (type < V4L2_CTRL_COMPOUND_TYPES) {
2152 		handler_set_err(hdl, -EINVAL);
2153 		return NULL;
2154 	}
2155 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2156 			     min, max, step, def, NULL, 0,
2157 			     flags, NULL, NULL, p_def, NULL);
2158 }
2159 EXPORT_SYMBOL(v4l2_ctrl_new_std_compound);
2160 
2161 /* Helper function for standard integer menu controls */
2162 struct v4l2_ctrl *v4l2_ctrl_new_int_menu(struct v4l2_ctrl_handler *hdl,
2163 			const struct v4l2_ctrl_ops *ops,
2164 			u32 id, u8 _max, u8 _def, const s64 *qmenu_int)
2165 {
2166 	const char *name;
2167 	enum v4l2_ctrl_type type;
2168 	s64 min;
2169 	u64 step;
2170 	s64 max = _max;
2171 	s64 def = _def;
2172 	u32 flags;
2173 
2174 	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2175 	if (type != V4L2_CTRL_TYPE_INTEGER_MENU) {
2176 		handler_set_err(hdl, -EINVAL);
2177 		return NULL;
2178 	}
2179 	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2180 			     0, max, 0, def, NULL, 0,
2181 			     flags, NULL, qmenu_int, ptr_null, NULL);
2182 }
2183 EXPORT_SYMBOL(v4l2_ctrl_new_int_menu);
2184 
2185 /* Add the controls from another handler to our own. */
2186 int v4l2_ctrl_add_handler(struct v4l2_ctrl_handler *hdl,
2187 			  struct v4l2_ctrl_handler *add,
2188 			  bool (*filter)(const struct v4l2_ctrl *ctrl),
2189 			  bool from_other_dev)
2190 {
2191 	struct v4l2_ctrl_ref *ref;
2192 	int ret = 0;
2193 
2194 	/* Do nothing if either handler is NULL or if they are the same */
2195 	if (!hdl || !add || hdl == add)
2196 		return 0;
2197 	if (hdl->error)
2198 		return hdl->error;
2199 	mutex_lock(add->lock);
2200 	list_for_each_entry(ref, &add->ctrl_refs, node) {
2201 		struct v4l2_ctrl *ctrl = ref->ctrl;
2202 
2203 		/* Skip handler-private controls. */
2204 		if (ctrl->is_private)
2205 			continue;
2206 		/* And control classes */
2207 		if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2208 			continue;
2209 		/* Filter any unwanted controls */
2210 		if (filter && !filter(ctrl))
2211 			continue;
2212 		ret = handler_new_ref(hdl, ctrl, NULL, from_other_dev, false);
2213 		if (ret)
2214 			break;
2215 	}
2216 	mutex_unlock(add->lock);
2217 	return ret;
2218 }
2219 EXPORT_SYMBOL(v4l2_ctrl_add_handler);
2220 
2221 bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl)
2222 {
2223 	if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_TX)
2224 		return true;
2225 	if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_RX)
2226 		return true;
2227 	switch (ctrl->id) {
2228 	case V4L2_CID_AUDIO_MUTE:
2229 	case V4L2_CID_AUDIO_VOLUME:
2230 	case V4L2_CID_AUDIO_BALANCE:
2231 	case V4L2_CID_AUDIO_BASS:
2232 	case V4L2_CID_AUDIO_TREBLE:
2233 	case V4L2_CID_AUDIO_LOUDNESS:
2234 		return true;
2235 	default:
2236 		break;
2237 	}
2238 	return false;
2239 }
2240 EXPORT_SYMBOL(v4l2_ctrl_radio_filter);
2241 
2242 /* Cluster controls */
2243 void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
2244 {
2245 	bool has_volatiles = false;
2246 	int i;
2247 
2248 	/* The first control is the master control and it must not be NULL */
2249 	if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
2250 		return;
2251 
2252 	for (i = 0; i < ncontrols; i++) {
2253 		if (controls[i]) {
2254 			controls[i]->cluster = controls;
2255 			controls[i]->ncontrols = ncontrols;
2256 			if (controls[i]->flags & V4L2_CTRL_FLAG_VOLATILE)
2257 				has_volatiles = true;
2258 		}
2259 	}
2260 	controls[0]->has_volatiles = has_volatiles;
2261 }
2262 EXPORT_SYMBOL(v4l2_ctrl_cluster);
2263 
2264 void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
2265 			    u8 manual_val, bool set_volatile)
2266 {
2267 	struct v4l2_ctrl *master = controls[0];
2268 	u32 flag = 0;
2269 	int i;
2270 
2271 	v4l2_ctrl_cluster(ncontrols, controls);
2272 	WARN_ON(ncontrols <= 1);
2273 	WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
2274 	WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
2275 	master->is_auto = true;
2276 	master->has_volatiles = set_volatile;
2277 	master->manual_mode_value = manual_val;
2278 	master->flags |= V4L2_CTRL_FLAG_UPDATE;
2279 
2280 	if (!is_cur_manual(master))
2281 		flag = V4L2_CTRL_FLAG_INACTIVE |
2282 			(set_volatile ? V4L2_CTRL_FLAG_VOLATILE : 0);
2283 
2284 	for (i = 1; i < ncontrols; i++)
2285 		if (controls[i])
2286 			controls[i]->flags |= flag;
2287 }
2288 EXPORT_SYMBOL(v4l2_ctrl_auto_cluster);
2289 
2290 /*
2291  * Obtain the current volatile values of an autocluster and mark them
2292  * as new.
2293  */
2294 void update_from_auto_cluster(struct v4l2_ctrl *master)
2295 {
2296 	int i;
2297 
2298 	for (i = 1; i < master->ncontrols; i++)
2299 		cur_to_new(master->cluster[i]);
2300 	if (!call_op(master, g_volatile_ctrl))
2301 		for (i = 1; i < master->ncontrols; i++)
2302 			if (master->cluster[i])
2303 				master->cluster[i]->is_new = 1;
2304 }
2305 
2306 /*
2307  * Return non-zero if one or more of the controls in the cluster has a new
2308  * value that differs from the current value.
2309  */
2310 static int cluster_changed(struct v4l2_ctrl *master)
2311 {
2312 	bool changed = false;
2313 	int i;
2314 
2315 	for (i = 0; i < master->ncontrols; i++) {
2316 		struct v4l2_ctrl *ctrl = master->cluster[i];
2317 		bool ctrl_changed = false;
2318 
2319 		if (!ctrl)
2320 			continue;
2321 
2322 		if (ctrl->flags & V4L2_CTRL_FLAG_EXECUTE_ON_WRITE) {
2323 			changed = true;
2324 			ctrl_changed = true;
2325 		}
2326 
2327 		/*
2328 		 * Set has_changed to false to avoid generating
2329 		 * the event V4L2_EVENT_CTRL_CH_VALUE
2330 		 */
2331 		if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
2332 			ctrl->has_changed = false;
2333 			continue;
2334 		}
2335 
2336 		if (ctrl->elems != ctrl->new_elems)
2337 			ctrl_changed = true;
2338 		if (!ctrl_changed)
2339 			ctrl_changed = !ctrl->type_ops->equal(ctrl,
2340 				ctrl->p_cur, ctrl->p_new);
2341 		ctrl->has_changed = ctrl_changed;
2342 		changed |= ctrl->has_changed;
2343 	}
2344 	return changed;
2345 }
2346 
2347 /*
2348  * Core function that calls try/s_ctrl and ensures that the new value is
2349  * copied to the current value on a set.
2350  * Must be called with ctrl->handler->lock held.
2351  */
2352 int try_or_set_cluster(struct v4l2_fh *fh, struct v4l2_ctrl *master,
2353 		       bool set, u32 ch_flags)
2354 {
2355 	bool update_flag;
2356 	int ret;
2357 	int i;
2358 
2359 	/*
2360 	 * Go through the cluster and either validate the new value or
2361 	 * (if no new value was set), copy the current value to the new
2362 	 * value, ensuring a consistent view for the control ops when
2363 	 * called.
2364 	 */
2365 	for (i = 0; i < master->ncontrols; i++) {
2366 		struct v4l2_ctrl *ctrl = master->cluster[i];
2367 
2368 		if (!ctrl)
2369 			continue;
2370 
2371 		if (!ctrl->is_new) {
2372 			cur_to_new(ctrl);
2373 			continue;
2374 		}
2375 		/*
2376 		 * Check again: it may have changed since the
2377 		 * previous check in try_or_set_ext_ctrls().
2378 		 */
2379 		if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED))
2380 			return -EBUSY;
2381 	}
2382 
2383 	ret = call_op(master, try_ctrl);
2384 
2385 	/* Don't set if there is no change */
2386 	if (ret || !set || !cluster_changed(master))
2387 		return ret;
2388 	ret = call_op(master, s_ctrl);
2389 	if (ret)
2390 		return ret;
2391 
2392 	/* If OK, then make the new values permanent. */
2393 	update_flag = is_cur_manual(master) != is_new_manual(master);
2394 
2395 	for (i = 0; i < master->ncontrols; i++) {
2396 		/*
2397 		 * If we switch from auto to manual mode, and this cluster
2398 		 * contains volatile controls, then all non-master controls
2399 		 * have to be marked as changed. The 'new' value contains
2400 		 * the volatile value (obtained by update_from_auto_cluster),
2401 		 * which now has to become the current value.
2402 		 */
2403 		if (i && update_flag && is_new_manual(master) &&
2404 		    master->has_volatiles && master->cluster[i])
2405 			master->cluster[i]->has_changed = true;
2406 
2407 		new_to_cur(fh, master->cluster[i], ch_flags |
2408 			((update_flag && i > 0) ? V4L2_EVENT_CTRL_CH_FLAGS : 0));
2409 	}
2410 	return 0;
2411 }
2412 
2413 /* Activate/deactivate a control. */
2414 void v4l2_ctrl_activate(struct v4l2_ctrl *ctrl, bool active)
2415 {
2416 	/* invert since the actual flag is called 'inactive' */
2417 	bool inactive = !active;
2418 	bool old;
2419 
2420 	if (ctrl == NULL)
2421 		return;
2422 
2423 	if (inactive)
2424 		/* set V4L2_CTRL_FLAG_INACTIVE */
2425 		old = test_and_set_bit(4, &ctrl->flags);
2426 	else
2427 		/* clear V4L2_CTRL_FLAG_INACTIVE */
2428 		old = test_and_clear_bit(4, &ctrl->flags);
2429 	if (old != inactive)
2430 		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2431 }
2432 EXPORT_SYMBOL(v4l2_ctrl_activate);
2433 
2434 void __v4l2_ctrl_grab(struct v4l2_ctrl *ctrl, bool grabbed)
2435 {
2436 	bool old;
2437 
2438 	if (ctrl == NULL)
2439 		return;
2440 
2441 	lockdep_assert_held(ctrl->handler->lock);
2442 
2443 	if (grabbed)
2444 		/* set V4L2_CTRL_FLAG_GRABBED */
2445 		old = test_and_set_bit(1, &ctrl->flags);
2446 	else
2447 		/* clear V4L2_CTRL_FLAG_GRABBED */
2448 		old = test_and_clear_bit(1, &ctrl->flags);
2449 	if (old != grabbed)
2450 		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2451 }
2452 EXPORT_SYMBOL(__v4l2_ctrl_grab);
2453 
2454 /* Call s_ctrl for all controls owned by the handler */
2455 int __v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2456 {
2457 	struct v4l2_ctrl *ctrl;
2458 	int ret = 0;
2459 
2460 	if (hdl == NULL)
2461 		return 0;
2462 
2463 	lockdep_assert_held(hdl->lock);
2464 
2465 	list_for_each_entry(ctrl, &hdl->ctrls, node)
2466 		ctrl->done = false;
2467 
2468 	list_for_each_entry(ctrl, &hdl->ctrls, node) {
2469 		struct v4l2_ctrl *master = ctrl->cluster[0];
2470 		int i;
2471 
2472 		/* Skip if this control was already handled by a cluster. */
2473 		/* Skip button controls and read-only controls. */
2474 		if (ctrl->done || ctrl->type == V4L2_CTRL_TYPE_BUTTON ||
2475 		    (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY))
2476 			continue;
2477 
2478 		for (i = 0; i < master->ncontrols; i++) {
2479 			if (master->cluster[i]) {
2480 				cur_to_new(master->cluster[i]);
2481 				master->cluster[i]->is_new = 1;
2482 				master->cluster[i]->done = true;
2483 			}
2484 		}
2485 		ret = call_op(master, s_ctrl);
2486 		if (ret)
2487 			break;
2488 	}
2489 
2490 	return ret;
2491 }
2492 EXPORT_SYMBOL_GPL(__v4l2_ctrl_handler_setup);
2493 
2494 int v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2495 {
2496 	int ret;
2497 
2498 	if (hdl == NULL)
2499 		return 0;
2500 
2501 	mutex_lock(hdl->lock);
2502 	ret = __v4l2_ctrl_handler_setup(hdl);
2503 	mutex_unlock(hdl->lock);
2504 
2505 	return ret;
2506 }
2507 EXPORT_SYMBOL(v4l2_ctrl_handler_setup);
2508 
2509 /* Log the control name and value */
2510 static void log_ctrl(const struct v4l2_ctrl *ctrl,
2511 		     const char *prefix, const char *colon)
2512 {
2513 	if (ctrl->flags & (V4L2_CTRL_FLAG_DISABLED | V4L2_CTRL_FLAG_WRITE_ONLY))
2514 		return;
2515 	if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2516 		return;
2517 
2518 	pr_info("%s%s%s: ", prefix, colon, ctrl->name);
2519 
2520 	ctrl->type_ops->log(ctrl);
2521 
2522 	if (ctrl->flags & (V4L2_CTRL_FLAG_INACTIVE |
2523 			   V4L2_CTRL_FLAG_GRABBED |
2524 			   V4L2_CTRL_FLAG_VOLATILE)) {
2525 		if (ctrl->flags & V4L2_CTRL_FLAG_INACTIVE)
2526 			pr_cont(" inactive");
2527 		if (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)
2528 			pr_cont(" grabbed");
2529 		if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE)
2530 			pr_cont(" volatile");
2531 	}
2532 	pr_cont("\n");
2533 }
2534 
2535 /* Log all controls owned by the handler */
2536 void v4l2_ctrl_handler_log_status(struct v4l2_ctrl_handler *hdl,
2537 				  const char *prefix)
2538 {
2539 	struct v4l2_ctrl *ctrl;
2540 	const char *colon = "";
2541 	int len;
2542 
2543 	if (!hdl)
2544 		return;
2545 	if (!prefix)
2546 		prefix = "";
2547 	len = strlen(prefix);
2548 	if (len && prefix[len - 1] != ' ')
2549 		colon = ": ";
2550 	mutex_lock(hdl->lock);
2551 	list_for_each_entry(ctrl, &hdl->ctrls, node)
2552 		if (!(ctrl->flags & V4L2_CTRL_FLAG_DISABLED))
2553 			log_ctrl(ctrl, prefix, colon);
2554 	mutex_unlock(hdl->lock);
2555 }
2556 EXPORT_SYMBOL(v4l2_ctrl_handler_log_status);
2557 
2558 int v4l2_ctrl_new_fwnode_properties(struct v4l2_ctrl_handler *hdl,
2559 				    const struct v4l2_ctrl_ops *ctrl_ops,
2560 				    const struct v4l2_fwnode_device_properties *p)
2561 {
2562 	if (hdl->error)
2563 		return hdl->error;
2564 
2565 	if (p->orientation != V4L2_FWNODE_PROPERTY_UNSET) {
2566 		u32 orientation_ctrl;
2567 
2568 		switch (p->orientation) {
2569 		case V4L2_FWNODE_ORIENTATION_FRONT:
2570 			orientation_ctrl = V4L2_CAMERA_ORIENTATION_FRONT;
2571 			break;
2572 		case V4L2_FWNODE_ORIENTATION_BACK:
2573 			orientation_ctrl = V4L2_CAMERA_ORIENTATION_BACK;
2574 			break;
2575 		case V4L2_FWNODE_ORIENTATION_EXTERNAL:
2576 			orientation_ctrl = V4L2_CAMERA_ORIENTATION_EXTERNAL;
2577 			break;
2578 		default:
2579 			return -EINVAL;
2580 		}
2581 		if (!v4l2_ctrl_new_std_menu(hdl, ctrl_ops,
2582 					    V4L2_CID_CAMERA_ORIENTATION,
2583 					    V4L2_CAMERA_ORIENTATION_EXTERNAL, 0,
2584 					    orientation_ctrl))
2585 			return hdl->error;
2586 	}
2587 
2588 	if (p->rotation != V4L2_FWNODE_PROPERTY_UNSET) {
2589 		if (!v4l2_ctrl_new_std(hdl, ctrl_ops,
2590 				       V4L2_CID_CAMERA_SENSOR_ROTATION,
2591 				       p->rotation, p->rotation, 1,
2592 				       p->rotation))
2593 			return hdl->error;
2594 	}
2595 
2596 	return hdl->error;
2597 }
2598 EXPORT_SYMBOL(v4l2_ctrl_new_fwnode_properties);
2599