1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * V4L2 controls framework core implementation.
4 *
5 * Copyright (C) 2010-2021  Hans Verkuil <hverkuil-cisco@xs4all.nl>
6 */
7
8#include <linux/export.h>
9#include <linux/mm.h>
10#include <linux/slab.h>
11#include <media/v4l2-ctrls.h>
12#include <media/v4l2-event.h>
13#include <media/v4l2-fwnode.h>
14
15#include "v4l2-ctrls-priv.h"
16
17static const union v4l2_ctrl_ptr ptr_null;
18
19static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl,
20		       u32 changes)
21{
22	memset(ev, 0, sizeof(*ev));
23	ev->type = V4L2_EVENT_CTRL;
24	ev->id = ctrl->id;
25	ev->u.ctrl.changes = changes;
26	ev->u.ctrl.type = ctrl->type;
27	ev->u.ctrl.flags = user_flags(ctrl);
28	if (ctrl->is_ptr)
29		ev->u.ctrl.value64 = 0;
30	else
31		ev->u.ctrl.value64 = *ctrl->p_cur.p_s64;
32	ev->u.ctrl.minimum = ctrl->minimum;
33	ev->u.ctrl.maximum = ctrl->maximum;
34	if (ctrl->type == V4L2_CTRL_TYPE_MENU
35	    || ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
36		ev->u.ctrl.step = 1;
37	else
38		ev->u.ctrl.step = ctrl->step;
39	ev->u.ctrl.default_value = ctrl->default_value;
40}
41
42void send_initial_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl)
43{
44	struct v4l2_event ev;
45	u32 changes = V4L2_EVENT_CTRL_CH_FLAGS;
46
47	if (!(ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY))
48		changes |= V4L2_EVENT_CTRL_CH_VALUE;
49	fill_event(&ev, ctrl, changes);
50	v4l2_event_queue_fh(fh, &ev);
51}
52
53void send_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 changes)
54{
55	struct v4l2_event ev;
56	struct v4l2_subscribed_event *sev;
57
58	if (list_empty(&ctrl->ev_subs))
59		return;
60	fill_event(&ev, ctrl, changes);
61
62	list_for_each_entry(sev, &ctrl->ev_subs, node)
63		if (sev->fh != fh ||
64		    (sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK))
65			v4l2_event_queue_fh(sev->fh, &ev);
66}
67
68bool v4l2_ctrl_type_op_equal(const struct v4l2_ctrl *ctrl,
69			     union v4l2_ctrl_ptr ptr1, union v4l2_ctrl_ptr ptr2)
70{
71	unsigned int i;
72
73	switch (ctrl->type) {
74	case V4L2_CTRL_TYPE_BUTTON:
75		return false;
76	case V4L2_CTRL_TYPE_STRING:
77		for (i = 0; i < ctrl->elems; i++) {
78			unsigned int idx = i * ctrl->elem_size;
79
80			/* strings are always 0-terminated */
81			if (strcmp(ptr1.p_char + idx, ptr2.p_char + idx))
82				return false;
83		}
84		return true;
85	default:
86		return !memcmp(ptr1.p_const, ptr2.p_const,
87			       ctrl->elems * ctrl->elem_size);
88	}
89}
90EXPORT_SYMBOL(v4l2_ctrl_type_op_equal);
91
92/* Default intra MPEG-2 quantisation coefficients, from the specification. */
93static const u8 mpeg2_intra_quant_matrix[64] = {
94	8,  16, 16, 19, 16, 19, 22, 22,
95	22, 22, 22, 22, 26, 24, 26, 27,
96	27, 27, 26, 26, 26, 26, 27, 27,
97	27, 29, 29, 29, 34, 34, 34, 29,
98	29, 29, 27, 27, 29, 29, 32, 32,
99	34, 34, 37, 38, 37, 35, 35, 34,
100	35, 38, 38, 40, 40, 40, 48, 48,
101	46, 46, 56, 56, 58, 69, 69, 83
102};
103
104static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
105			      union v4l2_ctrl_ptr ptr)
106{
107	struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
108	struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
109	struct v4l2_ctrl_mpeg2_quantisation *p_mpeg2_quant;
110	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
111	struct v4l2_ctrl_vp9_frame *p_vp9_frame;
112	struct v4l2_ctrl_fwht_params *p_fwht_params;
113	struct v4l2_ctrl_h264_scaling_matrix *p_h264_scaling_matrix;
114	struct v4l2_ctrl_av1_sequence *p_av1_sequence;
115	void *p = ptr.p + idx * ctrl->elem_size;
116
117	if (ctrl->p_def.p_const)
118		memcpy(p, ctrl->p_def.p_const, ctrl->elem_size);
119	else
120		memset(p, 0, ctrl->elem_size);
121
122	switch ((u32)ctrl->type) {
123	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
124		p_mpeg2_sequence = p;
125
126		/* 4:2:0 */
127		p_mpeg2_sequence->chroma_format = 1;
128		break;
129	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
130		p_mpeg2_picture = p;
131
132		/* interlaced top field */
133		p_mpeg2_picture->picture_structure = V4L2_MPEG2_PIC_TOP_FIELD;
134		p_mpeg2_picture->picture_coding_type =
135					V4L2_MPEG2_PIC_CODING_TYPE_I;
136		break;
137	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
138		p_mpeg2_quant = p;
139
140		memcpy(p_mpeg2_quant->intra_quantiser_matrix,
141		       mpeg2_intra_quant_matrix,
142		       ARRAY_SIZE(mpeg2_intra_quant_matrix));
143		/*
144		 * The default non-intra MPEG-2 quantisation
145		 * coefficients are all 16, as per the specification.
146		 */
147		memset(p_mpeg2_quant->non_intra_quantiser_matrix, 16,
148		       sizeof(p_mpeg2_quant->non_intra_quantiser_matrix));
149		break;
150	case V4L2_CTRL_TYPE_VP8_FRAME:
151		p_vp8_frame = p;
152		p_vp8_frame->num_dct_parts = 1;
153		break;
154	case V4L2_CTRL_TYPE_VP9_FRAME:
155		p_vp9_frame = p;
156		p_vp9_frame->profile = 0;
157		p_vp9_frame->bit_depth = 8;
158		p_vp9_frame->flags |= V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
159			V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING;
160		break;
161	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
162		p_av1_sequence = p;
163		p_av1_sequence->bit_depth = 8;
164		break;
165	case V4L2_CTRL_TYPE_FWHT_PARAMS:
166		p_fwht_params = p;
167		p_fwht_params->version = V4L2_FWHT_VERSION;
168		p_fwht_params->width = 1280;
169		p_fwht_params->height = 720;
170		p_fwht_params->flags = V4L2_FWHT_FL_PIXENC_YUV |
171			(2 << V4L2_FWHT_FL_COMPONENTS_NUM_OFFSET);
172		break;
173	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
174		p_h264_scaling_matrix = p;
175		/*
176		 * The default (flat) H.264 scaling matrix when none are
177		 * specified in the bitstream, this is according to formulas
178		 *  (7-8) and (7-9) of the specification.
179		 */
180		memset(p_h264_scaling_matrix, 16, sizeof(*p_h264_scaling_matrix));
181		break;
182	}
183}
184
185void v4l2_ctrl_type_op_init(const struct v4l2_ctrl *ctrl, u32 from_idx,
186			    union v4l2_ctrl_ptr ptr)
187{
188	unsigned int i;
189	u32 tot_elems = ctrl->elems;
190	u32 elems = tot_elems - from_idx;
191
192	if (from_idx >= tot_elems)
193		return;
194
195	switch (ctrl->type) {
196	case V4L2_CTRL_TYPE_STRING:
197		for (i = from_idx; i < tot_elems; i++) {
198			unsigned int offset = i * ctrl->elem_size;
199
200			memset(ptr.p_char + offset, ' ', ctrl->minimum);
201			ptr.p_char[offset + ctrl->minimum] = '\0';
202		}
203		break;
204	case V4L2_CTRL_TYPE_INTEGER64:
205		if (ctrl->default_value) {
206			for (i = from_idx; i < tot_elems; i++)
207				ptr.p_s64[i] = ctrl->default_value;
208		} else {
209			memset(ptr.p_s64 + from_idx, 0, elems * sizeof(s64));
210		}
211		break;
212	case V4L2_CTRL_TYPE_INTEGER:
213	case V4L2_CTRL_TYPE_INTEGER_MENU:
214	case V4L2_CTRL_TYPE_MENU:
215	case V4L2_CTRL_TYPE_BITMASK:
216	case V4L2_CTRL_TYPE_BOOLEAN:
217		if (ctrl->default_value) {
218			for (i = from_idx; i < tot_elems; i++)
219				ptr.p_s32[i] = ctrl->default_value;
220		} else {
221			memset(ptr.p_s32 + from_idx, 0, elems * sizeof(s32));
222		}
223		break;
224	case V4L2_CTRL_TYPE_BUTTON:
225	case V4L2_CTRL_TYPE_CTRL_CLASS:
226		memset(ptr.p_s32 + from_idx, 0, elems * sizeof(s32));
227		break;
228	case V4L2_CTRL_TYPE_U8:
229		memset(ptr.p_u8 + from_idx, ctrl->default_value, elems);
230		break;
231	case V4L2_CTRL_TYPE_U16:
232		if (ctrl->default_value) {
233			for (i = from_idx; i < tot_elems; i++)
234				ptr.p_u16[i] = ctrl->default_value;
235		} else {
236			memset(ptr.p_u16 + from_idx, 0, elems * sizeof(u16));
237		}
238		break;
239	case V4L2_CTRL_TYPE_U32:
240		if (ctrl->default_value) {
241			for (i = from_idx; i < tot_elems; i++)
242				ptr.p_u32[i] = ctrl->default_value;
243		} else {
244			memset(ptr.p_u32 + from_idx, 0, elems * sizeof(u32));
245		}
246		break;
247	default:
248		for (i = from_idx; i < tot_elems; i++)
249			std_init_compound(ctrl, i, ptr);
250		break;
251	}
252}
253EXPORT_SYMBOL(v4l2_ctrl_type_op_init);
254
255void v4l2_ctrl_type_op_log(const struct v4l2_ctrl *ctrl)
256{
257	union v4l2_ctrl_ptr ptr = ctrl->p_cur;
258
259	if (ctrl->is_array) {
260		unsigned i;
261
262		for (i = 0; i < ctrl->nr_of_dims; i++)
263			pr_cont("[%u]", ctrl->dims[i]);
264		pr_cont(" ");
265	}
266
267	switch (ctrl->type) {
268	case V4L2_CTRL_TYPE_INTEGER:
269		pr_cont("%d", *ptr.p_s32);
270		break;
271	case V4L2_CTRL_TYPE_BOOLEAN:
272		pr_cont("%s", *ptr.p_s32 ? "true" : "false");
273		break;
274	case V4L2_CTRL_TYPE_MENU:
275		pr_cont("%s", ctrl->qmenu[*ptr.p_s32]);
276		break;
277	case V4L2_CTRL_TYPE_INTEGER_MENU:
278		pr_cont("%lld", ctrl->qmenu_int[*ptr.p_s32]);
279		break;
280	case V4L2_CTRL_TYPE_BITMASK:
281		pr_cont("0x%08x", *ptr.p_s32);
282		break;
283	case V4L2_CTRL_TYPE_INTEGER64:
284		pr_cont("%lld", *ptr.p_s64);
285		break;
286	case V4L2_CTRL_TYPE_STRING:
287		pr_cont("%s", ptr.p_char);
288		break;
289	case V4L2_CTRL_TYPE_U8:
290		pr_cont("%u", (unsigned)*ptr.p_u8);
291		break;
292	case V4L2_CTRL_TYPE_U16:
293		pr_cont("%u", (unsigned)*ptr.p_u16);
294		break;
295	case V4L2_CTRL_TYPE_U32:
296		pr_cont("%u", (unsigned)*ptr.p_u32);
297		break;
298	case V4L2_CTRL_TYPE_H264_SPS:
299		pr_cont("H264_SPS");
300		break;
301	case V4L2_CTRL_TYPE_H264_PPS:
302		pr_cont("H264_PPS");
303		break;
304	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
305		pr_cont("H264_SCALING_MATRIX");
306		break;
307	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
308		pr_cont("H264_SLICE_PARAMS");
309		break;
310	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
311		pr_cont("H264_DECODE_PARAMS");
312		break;
313	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
314		pr_cont("H264_PRED_WEIGHTS");
315		break;
316	case V4L2_CTRL_TYPE_FWHT_PARAMS:
317		pr_cont("FWHT_PARAMS");
318		break;
319	case V4L2_CTRL_TYPE_VP8_FRAME:
320		pr_cont("VP8_FRAME");
321		break;
322	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
323		pr_cont("HDR10_CLL_INFO");
324		break;
325	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
326		pr_cont("HDR10_MASTERING_DISPLAY");
327		break;
328	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
329		pr_cont("MPEG2_QUANTISATION");
330		break;
331	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
332		pr_cont("MPEG2_SEQUENCE");
333		break;
334	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
335		pr_cont("MPEG2_PICTURE");
336		break;
337	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
338		pr_cont("VP9_COMPRESSED_HDR");
339		break;
340	case V4L2_CTRL_TYPE_VP9_FRAME:
341		pr_cont("VP9_FRAME");
342		break;
343	case V4L2_CTRL_TYPE_HEVC_SPS:
344		pr_cont("HEVC_SPS");
345		break;
346	case V4L2_CTRL_TYPE_HEVC_PPS:
347		pr_cont("HEVC_PPS");
348		break;
349	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
350		pr_cont("HEVC_SLICE_PARAMS");
351		break;
352	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
353		pr_cont("HEVC_SCALING_MATRIX");
354		break;
355	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
356		pr_cont("HEVC_DECODE_PARAMS");
357		break;
358	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
359		pr_cont("AV1_SEQUENCE");
360		break;
361	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
362		pr_cont("AV1_TILE_GROUP_ENTRY");
363		break;
364	case V4L2_CTRL_TYPE_AV1_FRAME:
365		pr_cont("AV1_FRAME");
366		break;
367	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
368		pr_cont("AV1_FILM_GRAIN");
369		break;
370
371	default:
372		pr_cont("unknown type %d", ctrl->type);
373		break;
374	}
375}
376EXPORT_SYMBOL(v4l2_ctrl_type_op_log);
377
378/*
379 * Round towards the closest legal value. Be careful when we are
380 * close to the maximum range of the control type to prevent
381 * wrap-arounds.
382 */
383#define ROUND_TO_RANGE(val, offset_type, ctrl)			\
384({								\
385	offset_type offset;					\
386	if ((ctrl)->maximum >= 0 &&				\
387	    val >= (ctrl)->maximum - (s32)((ctrl)->step / 2))	\
388		val = (ctrl)->maximum;				\
389	else							\
390		val += (s32)((ctrl)->step / 2);			\
391	val = clamp_t(typeof(val), val,				\
392		      (ctrl)->minimum, (ctrl)->maximum);	\
393	offset = (val) - (ctrl)->minimum;			\
394	offset = (ctrl)->step * (offset / (u32)(ctrl)->step);	\
395	val = (ctrl)->minimum + offset;				\
396	0;							\
397})
398
399/* Validate a new control */
400
401#define zero_padding(s) \
402	memset(&(s).padding, 0, sizeof((s).padding))
403#define zero_reserved(s) \
404	memset(&(s).reserved, 0, sizeof((s).reserved))
405
406static int
407validate_vp9_lf_params(struct v4l2_vp9_loop_filter *lf)
408{
409	unsigned int i;
410
411	if (lf->flags & ~(V4L2_VP9_LOOP_FILTER_FLAG_DELTA_ENABLED |
412			  V4L2_VP9_LOOP_FILTER_FLAG_DELTA_UPDATE))
413		return -EINVAL;
414
415	/* That all values are in the accepted range. */
416	if (lf->level > GENMASK(5, 0))
417		return -EINVAL;
418
419	if (lf->sharpness > GENMASK(2, 0))
420		return -EINVAL;
421
422	for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++)
423		if (lf->ref_deltas[i] < -63 || lf->ref_deltas[i] > 63)
424			return -EINVAL;
425
426	for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++)
427		if (lf->mode_deltas[i] < -63 || lf->mode_deltas[i] > 63)
428			return -EINVAL;
429
430	zero_reserved(*lf);
431	return 0;
432}
433
434static int
435validate_vp9_quant_params(struct v4l2_vp9_quantization *quant)
436{
437	if (quant->delta_q_y_dc < -15 || quant->delta_q_y_dc > 15 ||
438	    quant->delta_q_uv_dc < -15 || quant->delta_q_uv_dc > 15 ||
439	    quant->delta_q_uv_ac < -15 || quant->delta_q_uv_ac > 15)
440		return -EINVAL;
441
442	zero_reserved(*quant);
443	return 0;
444}
445
446static int
447validate_vp9_seg_params(struct v4l2_vp9_segmentation *seg)
448{
449	unsigned int i, j;
450
451	if (seg->flags & ~(V4L2_VP9_SEGMENTATION_FLAG_ENABLED |
452			   V4L2_VP9_SEGMENTATION_FLAG_UPDATE_MAP |
453			   V4L2_VP9_SEGMENTATION_FLAG_TEMPORAL_UPDATE |
454			   V4L2_VP9_SEGMENTATION_FLAG_UPDATE_DATA |
455			   V4L2_VP9_SEGMENTATION_FLAG_ABS_OR_DELTA_UPDATE))
456		return -EINVAL;
457
458	for (i = 0; i < ARRAY_SIZE(seg->feature_enabled); i++) {
459		if (seg->feature_enabled[i] &
460		    ~V4L2_VP9_SEGMENT_FEATURE_ENABLED_MASK)
461			return -EINVAL;
462	}
463
464	for (i = 0; i < ARRAY_SIZE(seg->feature_data); i++) {
465		static const int range[] = { 255, 63, 3, 0 };
466
467		for (j = 0; j < ARRAY_SIZE(seg->feature_data[j]); j++) {
468			if (seg->feature_data[i][j] < -range[j] ||
469			    seg->feature_data[i][j] > range[j])
470				return -EINVAL;
471		}
472	}
473
474	zero_reserved(*seg);
475	return 0;
476}
477
478static int
479validate_vp9_compressed_hdr(struct v4l2_ctrl_vp9_compressed_hdr *hdr)
480{
481	if (hdr->tx_mode > V4L2_VP9_TX_MODE_SELECT)
482		return -EINVAL;
483
484	return 0;
485}
486
487static int
488validate_vp9_frame(struct v4l2_ctrl_vp9_frame *frame)
489{
490	int ret;
491
492	/* Make sure we're not passed invalid flags. */
493	if (frame->flags & ~(V4L2_VP9_FRAME_FLAG_KEY_FRAME |
494		  V4L2_VP9_FRAME_FLAG_SHOW_FRAME |
495		  V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT |
496		  V4L2_VP9_FRAME_FLAG_INTRA_ONLY |
497		  V4L2_VP9_FRAME_FLAG_ALLOW_HIGH_PREC_MV |
498		  V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX |
499		  V4L2_VP9_FRAME_FLAG_PARALLEL_DEC_MODE |
500		  V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
501		  V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING |
502		  V4L2_VP9_FRAME_FLAG_COLOR_RANGE_FULL_SWING))
503		return -EINVAL;
504
505	if (frame->flags & V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT &&
506	    frame->flags & V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX)
507		return -EINVAL;
508
509	if (frame->profile > V4L2_VP9_PROFILE_MAX)
510		return -EINVAL;
511
512	if (frame->reset_frame_context > V4L2_VP9_RESET_FRAME_CTX_ALL)
513		return -EINVAL;
514
515	if (frame->frame_context_idx >= V4L2_VP9_NUM_FRAME_CTX)
516		return -EINVAL;
517
518	/*
519	 * Profiles 0 and 1 only support 8-bit depth, profiles 2 and 3 only 10
520	 * and 12 bit depths.
521	 */
522	if ((frame->profile < 2 && frame->bit_depth != 8) ||
523	    (frame->profile >= 2 &&
524	     (frame->bit_depth != 10 && frame->bit_depth != 12)))
525		return -EINVAL;
526
527	/* Profile 0 and 2 only accept YUV 4:2:0. */
528	if ((frame->profile == 0 || frame->profile == 2) &&
529	    (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
530	     !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
531		return -EINVAL;
532
533	/* Profile 1 and 3 only accept YUV 4:2:2, 4:4:0 and 4:4:4. */
534	if ((frame->profile == 1 || frame->profile == 3) &&
535	    ((frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) &&
536	     (frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
537		return -EINVAL;
538
539	if (frame->interpolation_filter > V4L2_VP9_INTERP_FILTER_SWITCHABLE)
540		return -EINVAL;
541
542	/*
543	 * According to the spec, tile_cols_log2 shall be less than or equal
544	 * to 6.
545	 */
546	if (frame->tile_cols_log2 > 6)
547		return -EINVAL;
548
549	if (frame->reference_mode > V4L2_VP9_REFERENCE_MODE_SELECT)
550		return -EINVAL;
551
552	ret = validate_vp9_lf_params(&frame->lf);
553	if (ret)
554		return ret;
555
556	ret = validate_vp9_quant_params(&frame->quant);
557	if (ret)
558		return ret;
559
560	ret = validate_vp9_seg_params(&frame->seg);
561	if (ret)
562		return ret;
563
564	zero_reserved(*frame);
565	return 0;
566}
567
568static int validate_av1_quantization(struct v4l2_av1_quantization *q)
569{
570	if (q->flags > GENMASK(2, 0))
571		return -EINVAL;
572
573	if (q->delta_q_y_dc < -64 || q->delta_q_y_dc > 63 ||
574	    q->delta_q_u_dc < -64 || q->delta_q_u_dc > 63 ||
575	    q->delta_q_v_dc < -64 || q->delta_q_v_dc > 63 ||
576	    q->delta_q_u_ac < -64 || q->delta_q_u_ac > 63 ||
577	    q->delta_q_v_ac < -64 || q->delta_q_v_ac > 63 ||
578	    q->delta_q_res > GENMASK(1, 0))
579		return -EINVAL;
580
581	if (q->qm_y > GENMASK(3, 0) ||
582	    q->qm_u > GENMASK(3, 0) ||
583	    q->qm_v > GENMASK(3, 0))
584		return -EINVAL;
585
586	return 0;
587}
588
589static int validate_av1_segmentation(struct v4l2_av1_segmentation *s)
590{
591	u32 i;
592	u32 j;
593
594	if (s->flags > GENMASK(4, 0))
595		return -EINVAL;
596
597	for (i = 0; i < ARRAY_SIZE(s->feature_data); i++) {
598		static const int segmentation_feature_signed[] = { 1, 1, 1, 1, 1, 0, 0, 0 };
599		static const int segmentation_feature_max[] = { 255, 63, 63, 63, 63, 7, 0, 0};
600
601		for (j = 0; j < ARRAY_SIZE(s->feature_data[j]); j++) {
602			s32 limit = segmentation_feature_max[j];
603
604			if (segmentation_feature_signed[j]) {
605				if (s->feature_data[i][j] < -limit ||
606				    s->feature_data[i][j] > limit)
607					return -EINVAL;
608			} else {
609				if (s->feature_data[i][j] < 0 || s->feature_data[i][j] > limit)
610					return -EINVAL;
611			}
612		}
613	}
614
615	return 0;
616}
617
618static int validate_av1_loop_filter(struct v4l2_av1_loop_filter *lf)
619{
620	u32 i;
621
622	if (lf->flags > GENMASK(3, 0))
623		return -EINVAL;
624
625	for (i = 0; i < ARRAY_SIZE(lf->level); i++) {
626		if (lf->level[i] > GENMASK(5, 0))
627			return -EINVAL;
628	}
629
630	if (lf->sharpness > GENMASK(2, 0))
631		return -EINVAL;
632
633	for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++) {
634		if (lf->ref_deltas[i] < -64 || lf->ref_deltas[i] > 63)
635			return -EINVAL;
636	}
637
638	for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++) {
639		if (lf->mode_deltas[i] < -64 || lf->mode_deltas[i] > 63)
640			return -EINVAL;
641	}
642
643	return 0;
644}
645
646static int validate_av1_cdef(struct v4l2_av1_cdef *cdef)
647{
648	u32 i;
649
650	if (cdef->damping_minus_3 > GENMASK(1, 0) ||
651	    cdef->bits > GENMASK(1, 0))
652		return -EINVAL;
653
654	for (i = 0; i < 1 << cdef->bits; i++) {
655		if (cdef->y_pri_strength[i] > GENMASK(3, 0) ||
656		    cdef->y_sec_strength[i] > 4 ||
657		    cdef->uv_pri_strength[i] > GENMASK(3, 0) ||
658		    cdef->uv_sec_strength[i] > 4)
659			return -EINVAL;
660	}
661
662	return 0;
663}
664
665static int validate_av1_loop_restauration(struct v4l2_av1_loop_restoration *lr)
666{
667	if (lr->lr_unit_shift > 3 || lr->lr_uv_shift > 1)
668		return -EINVAL;
669
670	return 0;
671}
672
673static int validate_av1_film_grain(struct v4l2_ctrl_av1_film_grain *fg)
674{
675	u32 i;
676
677	if (fg->flags > GENMASK(4, 0))
678		return -EINVAL;
679
680	if (fg->film_grain_params_ref_idx > GENMASK(2, 0) ||
681	    fg->num_y_points > 14 ||
682	    fg->num_cb_points > 10 ||
683	    fg->num_cr_points > GENMASK(3, 0) ||
684	    fg->grain_scaling_minus_8 > GENMASK(1, 0) ||
685	    fg->ar_coeff_lag > GENMASK(1, 0) ||
686	    fg->ar_coeff_shift_minus_6 > GENMASK(1, 0) ||
687	    fg->grain_scale_shift > GENMASK(1, 0))
688		return -EINVAL;
689
690	if (!(fg->flags & V4L2_AV1_FILM_GRAIN_FLAG_APPLY_GRAIN))
691		return 0;
692
693	for (i = 1; i < fg->num_y_points; i++)
694		if (fg->point_y_value[i] <= fg->point_y_value[i - 1])
695			return -EINVAL;
696
697	for (i = 1; i < fg->num_cb_points; i++)
698		if (fg->point_cb_value[i] <= fg->point_cb_value[i - 1])
699			return -EINVAL;
700
701	for (i = 1; i < fg->num_cr_points; i++)
702		if (fg->point_cr_value[i] <= fg->point_cr_value[i - 1])
703			return -EINVAL;
704
705	return 0;
706}
707
708static int validate_av1_frame(struct v4l2_ctrl_av1_frame *f)
709{
710	int ret = 0;
711
712	ret = validate_av1_quantization(&f->quantization);
713	if (ret)
714		return ret;
715	ret = validate_av1_segmentation(&f->segmentation);
716	if (ret)
717		return ret;
718	ret = validate_av1_loop_filter(&f->loop_filter);
719	if (ret)
720		return ret;
721	ret = validate_av1_cdef(&f->cdef);
722	if (ret)
723		return ret;
724	ret = validate_av1_loop_restauration(&f->loop_restoration);
725	if (ret)
726		return ret;
727
728	if (f->flags &
729	~(V4L2_AV1_FRAME_FLAG_SHOW_FRAME |
730	  V4L2_AV1_FRAME_FLAG_SHOWABLE_FRAME |
731	  V4L2_AV1_FRAME_FLAG_ERROR_RESILIENT_MODE |
732	  V4L2_AV1_FRAME_FLAG_DISABLE_CDF_UPDATE |
733	  V4L2_AV1_FRAME_FLAG_ALLOW_SCREEN_CONTENT_TOOLS |
734	  V4L2_AV1_FRAME_FLAG_FORCE_INTEGER_MV |
735	  V4L2_AV1_FRAME_FLAG_ALLOW_INTRABC |
736	  V4L2_AV1_FRAME_FLAG_USE_SUPERRES |
737	  V4L2_AV1_FRAME_FLAG_ALLOW_HIGH_PRECISION_MV |
738	  V4L2_AV1_FRAME_FLAG_IS_MOTION_MODE_SWITCHABLE |
739	  V4L2_AV1_FRAME_FLAG_USE_REF_FRAME_MVS |
740	  V4L2_AV1_FRAME_FLAG_DISABLE_FRAME_END_UPDATE_CDF |
741	  V4L2_AV1_FRAME_FLAG_ALLOW_WARPED_MOTION |
742	  V4L2_AV1_FRAME_FLAG_REFERENCE_SELECT |
743	  V4L2_AV1_FRAME_FLAG_REDUCED_TX_SET |
744	  V4L2_AV1_FRAME_FLAG_SKIP_MODE_ALLOWED |
745	  V4L2_AV1_FRAME_FLAG_SKIP_MODE_PRESENT |
746	  V4L2_AV1_FRAME_FLAG_FRAME_SIZE_OVERRIDE |
747	  V4L2_AV1_FRAME_FLAG_BUFFER_REMOVAL_TIME_PRESENT |
748	  V4L2_AV1_FRAME_FLAG_FRAME_REFS_SHORT_SIGNALING))
749		return -EINVAL;
750
751	if (f->superres_denom > GENMASK(2, 0) + 9)
752		return -EINVAL;
753
754	return 0;
755}
756
757static int validate_av1_sequence(struct v4l2_ctrl_av1_sequence *s)
758{
759	if (s->flags &
760	~(V4L2_AV1_SEQUENCE_FLAG_STILL_PICTURE |
761	 V4L2_AV1_SEQUENCE_FLAG_USE_128X128_SUPERBLOCK |
762	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_FILTER_INTRA |
763	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_INTRA_EDGE_FILTER |
764	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_INTERINTRA_COMPOUND |
765	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_MASKED_COMPOUND |
766	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_WARPED_MOTION |
767	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_DUAL_FILTER |
768	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_ORDER_HINT |
769	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_JNT_COMP |
770	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_REF_FRAME_MVS |
771	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_SUPERRES |
772	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_CDEF |
773	 V4L2_AV1_SEQUENCE_FLAG_ENABLE_RESTORATION |
774	 V4L2_AV1_SEQUENCE_FLAG_MONO_CHROME |
775	 V4L2_AV1_SEQUENCE_FLAG_COLOR_RANGE |
776	 V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_X |
777	 V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_Y |
778	 V4L2_AV1_SEQUENCE_FLAG_FILM_GRAIN_PARAMS_PRESENT |
779	 V4L2_AV1_SEQUENCE_FLAG_SEPARATE_UV_DELTA_Q))
780		return -EINVAL;
781
782	if (s->seq_profile == 1 && s->flags & V4L2_AV1_SEQUENCE_FLAG_MONO_CHROME)
783		return -EINVAL;
784
785	/* reserved */
786	if (s->seq_profile > 2)
787		return -EINVAL;
788
789	/* TODO: PROFILES */
790	return 0;
791}
792
793/*
794 * Compound controls validation requires setting unused fields/flags to zero
795 * in order to properly detect unchanged controls with v4l2_ctrl_type_op_equal's
796 * memcmp.
797 */
798static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
799				 union v4l2_ctrl_ptr ptr)
800{
801	struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
802	struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
803	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
804	struct v4l2_ctrl_fwht_params *p_fwht_params;
805	struct v4l2_ctrl_h264_sps *p_h264_sps;
806	struct v4l2_ctrl_h264_pps *p_h264_pps;
807	struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weights;
808	struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;
809	struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;
810	struct v4l2_ctrl_hevc_sps *p_hevc_sps;
811	struct v4l2_ctrl_hevc_pps *p_hevc_pps;
812	struct v4l2_ctrl_hdr10_mastering_display *p_hdr10_mastering;
813	struct v4l2_ctrl_hevc_decode_params *p_hevc_decode_params;
814	struct v4l2_area *area;
815	void *p = ptr.p + idx * ctrl->elem_size;
816	unsigned int i;
817
818	switch ((u32)ctrl->type) {
819	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
820		p_mpeg2_sequence = p;
821
822		switch (p_mpeg2_sequence->chroma_format) {
823		case 1: /* 4:2:0 */
824		case 2: /* 4:2:2 */
825		case 3: /* 4:4:4 */
826			break;
827		default:
828			return -EINVAL;
829		}
830		break;
831
832	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
833		p_mpeg2_picture = p;
834
835		switch (p_mpeg2_picture->intra_dc_precision) {
836		case 0: /* 8 bits */
837		case 1: /* 9 bits */
838		case 2: /* 10 bits */
839		case 3: /* 11 bits */
840			break;
841		default:
842			return -EINVAL;
843		}
844
845		switch (p_mpeg2_picture->picture_structure) {
846		case V4L2_MPEG2_PIC_TOP_FIELD:
847		case V4L2_MPEG2_PIC_BOTTOM_FIELD:
848		case V4L2_MPEG2_PIC_FRAME:
849			break;
850		default:
851			return -EINVAL;
852		}
853
854		switch (p_mpeg2_picture->picture_coding_type) {
855		case V4L2_MPEG2_PIC_CODING_TYPE_I:
856		case V4L2_MPEG2_PIC_CODING_TYPE_P:
857		case V4L2_MPEG2_PIC_CODING_TYPE_B:
858			break;
859		default:
860			return -EINVAL;
861		}
862		zero_reserved(*p_mpeg2_picture);
863		break;
864
865	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
866		break;
867
868	case V4L2_CTRL_TYPE_FWHT_PARAMS:
869		p_fwht_params = p;
870		if (p_fwht_params->version < V4L2_FWHT_VERSION)
871			return -EINVAL;
872		if (!p_fwht_params->width || !p_fwht_params->height)
873			return -EINVAL;
874		break;
875
876	case V4L2_CTRL_TYPE_H264_SPS:
877		p_h264_sps = p;
878
879		/* Some syntax elements are only conditionally valid */
880		if (p_h264_sps->pic_order_cnt_type != 0) {
881			p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 = 0;
882		} else if (p_h264_sps->pic_order_cnt_type != 1) {
883			p_h264_sps->num_ref_frames_in_pic_order_cnt_cycle = 0;
884			p_h264_sps->offset_for_non_ref_pic = 0;
885			p_h264_sps->offset_for_top_to_bottom_field = 0;
886			memset(&p_h264_sps->offset_for_ref_frame, 0,
887			       sizeof(p_h264_sps->offset_for_ref_frame));
888		}
889
890		if (!V4L2_H264_SPS_HAS_CHROMA_FORMAT(p_h264_sps)) {
891			p_h264_sps->chroma_format_idc = 1;
892			p_h264_sps->bit_depth_luma_minus8 = 0;
893			p_h264_sps->bit_depth_chroma_minus8 = 0;
894
895			p_h264_sps->flags &=
896				~V4L2_H264_SPS_FLAG_QPPRIME_Y_ZERO_TRANSFORM_BYPASS;
897
898			if (p_h264_sps->chroma_format_idc < 3)
899				p_h264_sps->flags &=
900					~V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE;
901		}
902
903		if (p_h264_sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY)
904			p_h264_sps->flags &=
905				~V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD;
906
907		/*
908		 * Chroma 4:2:2 format require at least High 4:2:2 profile.
909		 *
910		 * The H264 specification and well-known parser implementations
911		 * use profile-idc values directly, as that is clearer and
912		 * less ambiguous. We do the same here.
913		 */
914		if (p_h264_sps->profile_idc < 122 &&
915		    p_h264_sps->chroma_format_idc > 1)
916			return -EINVAL;
917		/* Chroma 4:4:4 format require at least High 4:2:2 profile */
918		if (p_h264_sps->profile_idc < 244 &&
919		    p_h264_sps->chroma_format_idc > 2)
920			return -EINVAL;
921		if (p_h264_sps->chroma_format_idc > 3)
922			return -EINVAL;
923
924		if (p_h264_sps->bit_depth_luma_minus8 > 6)
925			return -EINVAL;
926		if (p_h264_sps->bit_depth_chroma_minus8 > 6)
927			return -EINVAL;
928		if (p_h264_sps->log2_max_frame_num_minus4 > 12)
929			return -EINVAL;
930		if (p_h264_sps->pic_order_cnt_type > 2)
931			return -EINVAL;
932		if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
933			return -EINVAL;
934		if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)
935			return -EINVAL;
936		break;
937
938	case V4L2_CTRL_TYPE_H264_PPS:
939		p_h264_pps = p;
940
941		if (p_h264_pps->num_slice_groups_minus1 > 7)
942			return -EINVAL;
943		if (p_h264_pps->num_ref_idx_l0_default_active_minus1 >
944		    (V4L2_H264_REF_LIST_LEN - 1))
945			return -EINVAL;
946		if (p_h264_pps->num_ref_idx_l1_default_active_minus1 >
947		    (V4L2_H264_REF_LIST_LEN - 1))
948			return -EINVAL;
949		if (p_h264_pps->weighted_bipred_idc > 2)
950			return -EINVAL;
951		/*
952		 * pic_init_qp_minus26 shall be in the range of
953		 * -(26 + QpBdOffset_y) to +25, inclusive,
954		 *  where QpBdOffset_y is 6 * bit_depth_luma_minus8
955		 */
956		if (p_h264_pps->pic_init_qp_minus26 < -62 ||
957		    p_h264_pps->pic_init_qp_minus26 > 25)
958			return -EINVAL;
959		if (p_h264_pps->pic_init_qs_minus26 < -26 ||
960		    p_h264_pps->pic_init_qs_minus26 > 25)
961			return -EINVAL;
962		if (p_h264_pps->chroma_qp_index_offset < -12 ||
963		    p_h264_pps->chroma_qp_index_offset > 12)
964			return -EINVAL;
965		if (p_h264_pps->second_chroma_qp_index_offset < -12 ||
966		    p_h264_pps->second_chroma_qp_index_offset > 12)
967			return -EINVAL;
968		break;
969
970	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
971		break;
972
973	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
974		p_h264_pred_weights = p;
975
976		if (p_h264_pred_weights->luma_log2_weight_denom > 7)
977			return -EINVAL;
978		if (p_h264_pred_weights->chroma_log2_weight_denom > 7)
979			return -EINVAL;
980		break;
981
982	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
983		p_h264_slice_params = p;
984
985		if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
986			p_h264_slice_params->flags &=
987				~V4L2_H264_SLICE_FLAG_DIRECT_SPATIAL_MV_PRED;
988
989		if (p_h264_slice_params->colour_plane_id > 2)
990			return -EINVAL;
991		if (p_h264_slice_params->cabac_init_idc > 2)
992			return -EINVAL;
993		if (p_h264_slice_params->disable_deblocking_filter_idc > 2)
994			return -EINVAL;
995		if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||
996		    p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)
997			return -EINVAL;
998		if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||
999		    p_h264_slice_params->slice_beta_offset_div2 > 6)
1000			return -EINVAL;
1001
1002		if (p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_I ||
1003		    p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_SI)
1004			p_h264_slice_params->num_ref_idx_l0_active_minus1 = 0;
1005		if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
1006			p_h264_slice_params->num_ref_idx_l1_active_minus1 = 0;
1007
1008		if (p_h264_slice_params->num_ref_idx_l0_active_minus1 >
1009		    (V4L2_H264_REF_LIST_LEN - 1))
1010			return -EINVAL;
1011		if (p_h264_slice_params->num_ref_idx_l1_active_minus1 >
1012		    (V4L2_H264_REF_LIST_LEN - 1))
1013			return -EINVAL;
1014		zero_reserved(*p_h264_slice_params);
1015		break;
1016
1017	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1018		p_h264_dec_params = p;
1019
1020		if (p_h264_dec_params->nal_ref_idc > 3)
1021			return -EINVAL;
1022		for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {
1023			struct v4l2_h264_dpb_entry *dpb_entry =
1024				&p_h264_dec_params->dpb[i];
1025
1026			zero_reserved(*dpb_entry);
1027		}
1028		zero_reserved(*p_h264_dec_params);
1029		break;
1030
1031	case V4L2_CTRL_TYPE_VP8_FRAME:
1032		p_vp8_frame = p;
1033
1034		switch (p_vp8_frame->num_dct_parts) {
1035		case 1:
1036		case 2:
1037		case 4:
1038		case 8:
1039			break;
1040		default:
1041			return -EINVAL;
1042		}
1043		zero_padding(p_vp8_frame->segment);
1044		zero_padding(p_vp8_frame->lf);
1045		zero_padding(p_vp8_frame->quant);
1046		zero_padding(p_vp8_frame->entropy);
1047		zero_padding(p_vp8_frame->coder_state);
1048		break;
1049
1050	case V4L2_CTRL_TYPE_HEVC_SPS:
1051		p_hevc_sps = p;
1052
1053		if (!(p_hevc_sps->flags & V4L2_HEVC_SPS_FLAG_PCM_ENABLED)) {
1054			p_hevc_sps->pcm_sample_bit_depth_luma_minus1 = 0;
1055			p_hevc_sps->pcm_sample_bit_depth_chroma_minus1 = 0;
1056			p_hevc_sps->log2_min_pcm_luma_coding_block_size_minus3 = 0;
1057			p_hevc_sps->log2_diff_max_min_pcm_luma_coding_block_size = 0;
1058		}
1059
1060		if (!(p_hevc_sps->flags &
1061		      V4L2_HEVC_SPS_FLAG_LONG_TERM_REF_PICS_PRESENT))
1062			p_hevc_sps->num_long_term_ref_pics_sps = 0;
1063		break;
1064
1065	case V4L2_CTRL_TYPE_HEVC_PPS:
1066		p_hevc_pps = p;
1067
1068		if (!(p_hevc_pps->flags &
1069		      V4L2_HEVC_PPS_FLAG_CU_QP_DELTA_ENABLED))
1070			p_hevc_pps->diff_cu_qp_delta_depth = 0;
1071
1072		if (!(p_hevc_pps->flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED)) {
1073			p_hevc_pps->num_tile_columns_minus1 = 0;
1074			p_hevc_pps->num_tile_rows_minus1 = 0;
1075			memset(&p_hevc_pps->column_width_minus1, 0,
1076			       sizeof(p_hevc_pps->column_width_minus1));
1077			memset(&p_hevc_pps->row_height_minus1, 0,
1078			       sizeof(p_hevc_pps->row_height_minus1));
1079
1080			p_hevc_pps->flags &=
1081				~V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED;
1082		}
1083
1084		if (p_hevc_pps->flags &
1085		    V4L2_HEVC_PPS_FLAG_PPS_DISABLE_DEBLOCKING_FILTER) {
1086			p_hevc_pps->pps_beta_offset_div2 = 0;
1087			p_hevc_pps->pps_tc_offset_div2 = 0;
1088		}
1089		break;
1090
1091	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
1092		p_hevc_decode_params = p;
1093
1094		if (p_hevc_decode_params->num_active_dpb_entries >
1095		    V4L2_HEVC_DPB_ENTRIES_NUM_MAX)
1096			return -EINVAL;
1097		break;
1098
1099	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
1100		break;
1101
1102	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
1103		break;
1104
1105	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
1106		p_hdr10_mastering = p;
1107
1108		for (i = 0; i < 3; ++i) {
1109			if (p_hdr10_mastering->display_primaries_x[i] <
1110				V4L2_HDR10_MASTERING_PRIMARIES_X_LOW ||
1111			    p_hdr10_mastering->display_primaries_x[i] >
1112				V4L2_HDR10_MASTERING_PRIMARIES_X_HIGH ||
1113			    p_hdr10_mastering->display_primaries_y[i] <
1114				V4L2_HDR10_MASTERING_PRIMARIES_Y_LOW ||
1115			    p_hdr10_mastering->display_primaries_y[i] >
1116				V4L2_HDR10_MASTERING_PRIMARIES_Y_HIGH)
1117				return -EINVAL;
1118		}
1119
1120		if (p_hdr10_mastering->white_point_x <
1121			V4L2_HDR10_MASTERING_WHITE_POINT_X_LOW ||
1122		    p_hdr10_mastering->white_point_x >
1123			V4L2_HDR10_MASTERING_WHITE_POINT_X_HIGH ||
1124		    p_hdr10_mastering->white_point_y <
1125			V4L2_HDR10_MASTERING_WHITE_POINT_Y_LOW ||
1126		    p_hdr10_mastering->white_point_y >
1127			V4L2_HDR10_MASTERING_WHITE_POINT_Y_HIGH)
1128			return -EINVAL;
1129
1130		if (p_hdr10_mastering->max_display_mastering_luminance <
1131			V4L2_HDR10_MASTERING_MAX_LUMA_LOW ||
1132		    p_hdr10_mastering->max_display_mastering_luminance >
1133			V4L2_HDR10_MASTERING_MAX_LUMA_HIGH ||
1134		    p_hdr10_mastering->min_display_mastering_luminance <
1135			V4L2_HDR10_MASTERING_MIN_LUMA_LOW ||
1136		    p_hdr10_mastering->min_display_mastering_luminance >
1137			V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
1138			return -EINVAL;
1139
1140		/* The following restriction comes from ITU-T Rec. H.265 spec */
1141		if (p_hdr10_mastering->max_display_mastering_luminance ==
1142			V4L2_HDR10_MASTERING_MAX_LUMA_LOW &&
1143		    p_hdr10_mastering->min_display_mastering_luminance ==
1144			V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
1145			return -EINVAL;
1146
1147		break;
1148
1149	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
1150		break;
1151
1152	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
1153		return validate_vp9_compressed_hdr(p);
1154
1155	case V4L2_CTRL_TYPE_VP9_FRAME:
1156		return validate_vp9_frame(p);
1157	case V4L2_CTRL_TYPE_AV1_FRAME:
1158		return validate_av1_frame(p);
1159	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
1160		return validate_av1_sequence(p);
1161	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
1162		break;
1163	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
1164		return validate_av1_film_grain(p);
1165
1166	case V4L2_CTRL_TYPE_AREA:
1167		area = p;
1168		if (!area->width || !area->height)
1169			return -EINVAL;
1170		break;
1171
1172	default:
1173		return -EINVAL;
1174	}
1175
1176	return 0;
1177}
1178
1179static int std_validate_elem(const struct v4l2_ctrl *ctrl, u32 idx,
1180			     union v4l2_ctrl_ptr ptr)
1181{
1182	size_t len;
1183	u64 offset;
1184	s64 val;
1185
1186	switch ((u32)ctrl->type) {
1187	case V4L2_CTRL_TYPE_INTEGER:
1188		return ROUND_TO_RANGE(ptr.p_s32[idx], u32, ctrl);
1189	case V4L2_CTRL_TYPE_INTEGER64:
1190		/*
1191		 * We can't use the ROUND_TO_RANGE define here due to
1192		 * the u64 divide that needs special care.
1193		 */
1194		val = ptr.p_s64[idx];
1195		if (ctrl->maximum >= 0 && val >= ctrl->maximum - (s64)(ctrl->step / 2))
1196			val = ctrl->maximum;
1197		else
1198			val += (s64)(ctrl->step / 2);
1199		val = clamp_t(s64, val, ctrl->minimum, ctrl->maximum);
1200		offset = val - ctrl->minimum;
1201		do_div(offset, ctrl->step);
1202		ptr.p_s64[idx] = ctrl->minimum + offset * ctrl->step;
1203		return 0;
1204	case V4L2_CTRL_TYPE_U8:
1205		return ROUND_TO_RANGE(ptr.p_u8[idx], u8, ctrl);
1206	case V4L2_CTRL_TYPE_U16:
1207		return ROUND_TO_RANGE(ptr.p_u16[idx], u16, ctrl);
1208	case V4L2_CTRL_TYPE_U32:
1209		return ROUND_TO_RANGE(ptr.p_u32[idx], u32, ctrl);
1210
1211	case V4L2_CTRL_TYPE_BOOLEAN:
1212		ptr.p_s32[idx] = !!ptr.p_s32[idx];
1213		return 0;
1214
1215	case V4L2_CTRL_TYPE_MENU:
1216	case V4L2_CTRL_TYPE_INTEGER_MENU:
1217		if (ptr.p_s32[idx] < ctrl->minimum || ptr.p_s32[idx] > ctrl->maximum)
1218			return -ERANGE;
1219		if (ptr.p_s32[idx] < BITS_PER_LONG_LONG &&
1220		    (ctrl->menu_skip_mask & BIT_ULL(ptr.p_s32[idx])))
1221			return -EINVAL;
1222		if (ctrl->type == V4L2_CTRL_TYPE_MENU &&
1223		    ctrl->qmenu[ptr.p_s32[idx]][0] == '\0')
1224			return -EINVAL;
1225		return 0;
1226
1227	case V4L2_CTRL_TYPE_BITMASK:
1228		ptr.p_s32[idx] &= ctrl->maximum;
1229		return 0;
1230
1231	case V4L2_CTRL_TYPE_BUTTON:
1232	case V4L2_CTRL_TYPE_CTRL_CLASS:
1233		ptr.p_s32[idx] = 0;
1234		return 0;
1235
1236	case V4L2_CTRL_TYPE_STRING:
1237		idx *= ctrl->elem_size;
1238		len = strlen(ptr.p_char + idx);
1239		if (len < ctrl->minimum)
1240			return -ERANGE;
1241		if ((len - (u32)ctrl->minimum) % (u32)ctrl->step)
1242			return -ERANGE;
1243		return 0;
1244
1245	default:
1246		return std_validate_compound(ctrl, idx, ptr);
1247	}
1248}
1249
1250int v4l2_ctrl_type_op_validate(const struct v4l2_ctrl *ctrl,
1251			       union v4l2_ctrl_ptr ptr)
1252{
1253	unsigned int i;
1254	int ret = 0;
1255
1256	switch ((u32)ctrl->type) {
1257	case V4L2_CTRL_TYPE_U8:
1258		if (ctrl->maximum == 0xff && ctrl->minimum == 0 && ctrl->step == 1)
1259			return 0;
1260		break;
1261	case V4L2_CTRL_TYPE_U16:
1262		if (ctrl->maximum == 0xffff && ctrl->minimum == 0 && ctrl->step == 1)
1263			return 0;
1264		break;
1265	case V4L2_CTRL_TYPE_U32:
1266		if (ctrl->maximum == 0xffffffff && ctrl->minimum == 0 && ctrl->step == 1)
1267			return 0;
1268		break;
1269
1270	case V4L2_CTRL_TYPE_BUTTON:
1271	case V4L2_CTRL_TYPE_CTRL_CLASS:
1272		memset(ptr.p_s32, 0, ctrl->new_elems * sizeof(s32));
1273		return 0;
1274	}
1275
1276	for (i = 0; !ret && i < ctrl->new_elems; i++)
1277		ret = std_validate_elem(ctrl, i, ptr);
1278	return ret;
1279}
1280EXPORT_SYMBOL(v4l2_ctrl_type_op_validate);
1281
1282static const struct v4l2_ctrl_type_ops std_type_ops = {
1283	.equal = v4l2_ctrl_type_op_equal,
1284	.init = v4l2_ctrl_type_op_init,
1285	.log = v4l2_ctrl_type_op_log,
1286	.validate = v4l2_ctrl_type_op_validate,
1287};
1288
1289void v4l2_ctrl_notify(struct v4l2_ctrl *ctrl, v4l2_ctrl_notify_fnc notify, void *priv)
1290{
1291	if (!ctrl)
1292		return;
1293	if (!notify) {
1294		ctrl->call_notify = 0;
1295		return;
1296	}
1297	if (WARN_ON(ctrl->handler->notify && ctrl->handler->notify != notify))
1298		return;
1299	ctrl->handler->notify = notify;
1300	ctrl->handler->notify_priv = priv;
1301	ctrl->call_notify = 1;
1302}
1303EXPORT_SYMBOL(v4l2_ctrl_notify);
1304
1305/* Copy the one value to another. */
1306static void ptr_to_ptr(struct v4l2_ctrl *ctrl,
1307		       union v4l2_ctrl_ptr from, union v4l2_ctrl_ptr to,
1308		       unsigned int elems)
1309{
1310	if (ctrl == NULL)
1311		return;
1312	memcpy(to.p, from.p_const, elems * ctrl->elem_size);
1313}
1314
1315/* Copy the new value to the current value. */
1316void new_to_cur(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
1317{
1318	bool changed;
1319
1320	if (ctrl == NULL)
1321		return;
1322
1323	/* has_changed is set by cluster_changed */
1324	changed = ctrl->has_changed;
1325	if (changed) {
1326		if (ctrl->is_dyn_array)
1327			ctrl->elems = ctrl->new_elems;
1328		ptr_to_ptr(ctrl, ctrl->p_new, ctrl->p_cur, ctrl->elems);
1329	}
1330
1331	if (ch_flags & V4L2_EVENT_CTRL_CH_FLAGS) {
1332		/* Note: CH_FLAGS is only set for auto clusters. */
1333		ctrl->flags &=
1334			~(V4L2_CTRL_FLAG_INACTIVE | V4L2_CTRL_FLAG_VOLATILE);
1335		if (!is_cur_manual(ctrl->cluster[0])) {
1336			ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
1337			if (ctrl->cluster[0]->has_volatiles)
1338				ctrl->flags |= V4L2_CTRL_FLAG_VOLATILE;
1339		}
1340		fh = NULL;
1341	}
1342	if (changed || ch_flags) {
1343		/* If a control was changed that was not one of the controls
1344		   modified by the application, then send the event to all. */
1345		if (!ctrl->is_new)
1346			fh = NULL;
1347		send_event(fh, ctrl,
1348			(changed ? V4L2_EVENT_CTRL_CH_VALUE : 0) | ch_flags);
1349		if (ctrl->call_notify && changed && ctrl->handler->notify)
1350			ctrl->handler->notify(ctrl, ctrl->handler->notify_priv);
1351	}
1352}
1353
1354/* Copy the current value to the new value */
1355void cur_to_new(struct v4l2_ctrl *ctrl)
1356{
1357	if (ctrl == NULL)
1358		return;
1359	if (ctrl->is_dyn_array)
1360		ctrl->new_elems = ctrl->elems;
1361	ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new, ctrl->new_elems);
1362}
1363
1364static bool req_alloc_array(struct v4l2_ctrl_ref *ref, u32 elems)
1365{
1366	void *tmp;
1367
1368	if (elems == ref->p_req_array_alloc_elems)
1369		return true;
1370	if (ref->ctrl->is_dyn_array &&
1371	    elems < ref->p_req_array_alloc_elems)
1372		return true;
1373
1374	tmp = kvmalloc(elems * ref->ctrl->elem_size, GFP_KERNEL);
1375
1376	if (!tmp) {
1377		ref->p_req_array_enomem = true;
1378		return false;
1379	}
1380	ref->p_req_array_enomem = false;
1381	kvfree(ref->p_req.p);
1382	ref->p_req.p = tmp;
1383	ref->p_req_array_alloc_elems = elems;
1384	return true;
1385}
1386
1387/* Copy the new value to the request value */
1388void new_to_req(struct v4l2_ctrl_ref *ref)
1389{
1390	struct v4l2_ctrl *ctrl;
1391
1392	if (!ref)
1393		return;
1394
1395	ctrl = ref->ctrl;
1396	if (ctrl->is_array && !req_alloc_array(ref, ctrl->new_elems))
1397		return;
1398
1399	ref->p_req_elems = ctrl->new_elems;
1400	ptr_to_ptr(ctrl, ctrl->p_new, ref->p_req, ref->p_req_elems);
1401	ref->p_req_valid = true;
1402}
1403
1404/* Copy the current value to the request value */
1405void cur_to_req(struct v4l2_ctrl_ref *ref)
1406{
1407	struct v4l2_ctrl *ctrl;
1408
1409	if (!ref)
1410		return;
1411
1412	ctrl = ref->ctrl;
1413	if (ctrl->is_array && !req_alloc_array(ref, ctrl->elems))
1414		return;
1415
1416	ref->p_req_elems = ctrl->elems;
1417	ptr_to_ptr(ctrl, ctrl->p_cur, ref->p_req, ctrl->elems);
1418	ref->p_req_valid = true;
1419}
1420
1421/* Copy the request value to the new value */
1422int req_to_new(struct v4l2_ctrl_ref *ref)
1423{
1424	struct v4l2_ctrl *ctrl;
1425
1426	if (!ref)
1427		return 0;
1428
1429	ctrl = ref->ctrl;
1430
1431	/*
1432	 * This control was never set in the request, so just use the current
1433	 * value.
1434	 */
1435	if (!ref->p_req_valid) {
1436		if (ctrl->is_dyn_array)
1437			ctrl->new_elems = ctrl->elems;
1438		ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new, ctrl->new_elems);
1439		return 0;
1440	}
1441
1442	/* Not an array, so just copy the request value */
1443	if (!ctrl->is_array) {
1444		ptr_to_ptr(ctrl, ref->p_req, ctrl->p_new, ctrl->new_elems);
1445		return 0;
1446	}
1447
1448	/* Sanity check, should never happen */
1449	if (WARN_ON(!ref->p_req_array_alloc_elems))
1450		return -ENOMEM;
1451
1452	if (!ctrl->is_dyn_array &&
1453	    ref->p_req_elems != ctrl->p_array_alloc_elems)
1454		return -ENOMEM;
1455
1456	/*
1457	 * Check if the number of elements in the request is more than the
1458	 * elements in ctrl->p_array. If so, attempt to realloc ctrl->p_array.
1459	 * Note that p_array is allocated with twice the number of elements
1460	 * in the dynamic array since it has to store both the current and
1461	 * new value of such a control.
1462	 */
1463	if (ref->p_req_elems > ctrl->p_array_alloc_elems) {
1464		unsigned int sz = ref->p_req_elems * ctrl->elem_size;
1465		void *old = ctrl->p_array;
1466		void *tmp = kvzalloc(2 * sz, GFP_KERNEL);
1467
1468		if (!tmp)
1469			return -ENOMEM;
1470		memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size);
1471		memcpy(tmp + sz, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size);
1472		ctrl->p_new.p = tmp;
1473		ctrl->p_cur.p = tmp + sz;
1474		ctrl->p_array = tmp;
1475		ctrl->p_array_alloc_elems = ref->p_req_elems;
1476		kvfree(old);
1477	}
1478
1479	ctrl->new_elems = ref->p_req_elems;
1480	ptr_to_ptr(ctrl, ref->p_req, ctrl->p_new, ctrl->new_elems);
1481	return 0;
1482}
1483
1484/* Control range checking */
1485int check_range(enum v4l2_ctrl_type type,
1486		s64 min, s64 max, u64 step, s64 def)
1487{
1488	switch (type) {
1489	case V4L2_CTRL_TYPE_BOOLEAN:
1490		if (step != 1 || max > 1 || min < 0)
1491			return -ERANGE;
1492		fallthrough;
1493	case V4L2_CTRL_TYPE_U8:
1494	case V4L2_CTRL_TYPE_U16:
1495	case V4L2_CTRL_TYPE_U32:
1496	case V4L2_CTRL_TYPE_INTEGER:
1497	case V4L2_CTRL_TYPE_INTEGER64:
1498		if (step == 0 || min > max || def < min || def > max)
1499			return -ERANGE;
1500		return 0;
1501	case V4L2_CTRL_TYPE_BITMASK:
1502		if (step || min || !max || (def & ~max))
1503			return -ERANGE;
1504		return 0;
1505	case V4L2_CTRL_TYPE_MENU:
1506	case V4L2_CTRL_TYPE_INTEGER_MENU:
1507		if (min > max || def < min || def > max ||
1508		    min < 0 || (step && max >= BITS_PER_LONG_LONG))
1509			return -ERANGE;
1510		/* Note: step == menu_skip_mask for menu controls.
1511		   So here we check if the default value is masked out. */
1512		if (def < BITS_PER_LONG_LONG && (step & BIT_ULL(def)))
1513			return -EINVAL;
1514		return 0;
1515	case V4L2_CTRL_TYPE_STRING:
1516		if (min > max || min < 0 || step < 1 || def)
1517			return -ERANGE;
1518		return 0;
1519	default:
1520		return 0;
1521	}
1522}
1523
1524/* Set the handler's error code if it wasn't set earlier already */
1525static inline int handler_set_err(struct v4l2_ctrl_handler *hdl, int err)
1526{
1527	if (hdl->error == 0)
1528		hdl->error = err;
1529	return err;
1530}
1531
1532/* Initialize the handler */
1533int v4l2_ctrl_handler_init_class(struct v4l2_ctrl_handler *hdl,
1534				 unsigned nr_of_controls_hint,
1535				 struct lock_class_key *key, const char *name)
1536{
1537	mutex_init(&hdl->_lock);
1538	hdl->lock = &hdl->_lock;
1539	lockdep_set_class_and_name(hdl->lock, key, name);
1540	INIT_LIST_HEAD(&hdl->ctrls);
1541	INIT_LIST_HEAD(&hdl->ctrl_refs);
1542	hdl->nr_of_buckets = 1 + nr_of_controls_hint / 8;
1543	hdl->buckets = kvcalloc(hdl->nr_of_buckets, sizeof(hdl->buckets[0]),
1544				GFP_KERNEL);
1545	hdl->error = hdl->buckets ? 0 : -ENOMEM;
1546	v4l2_ctrl_handler_init_request(hdl);
1547	return hdl->error;
1548}
1549EXPORT_SYMBOL(v4l2_ctrl_handler_init_class);
1550
1551/* Free all controls and control refs */
1552void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl)
1553{
1554	struct v4l2_ctrl_ref *ref, *next_ref;
1555	struct v4l2_ctrl *ctrl, *next_ctrl;
1556	struct v4l2_subscribed_event *sev, *next_sev;
1557
1558	if (hdl == NULL || hdl->buckets == NULL)
1559		return;
1560
1561	v4l2_ctrl_handler_free_request(hdl);
1562
1563	mutex_lock(hdl->lock);
1564	/* Free all nodes */
1565	list_for_each_entry_safe(ref, next_ref, &hdl->ctrl_refs, node) {
1566		list_del(&ref->node);
1567		if (ref->p_req_array_alloc_elems)
1568			kvfree(ref->p_req.p);
1569		kfree(ref);
1570	}
1571	/* Free all controls owned by the handler */
1572	list_for_each_entry_safe(ctrl, next_ctrl, &hdl->ctrls, node) {
1573		list_del(&ctrl->node);
1574		list_for_each_entry_safe(sev, next_sev, &ctrl->ev_subs, node)
1575			list_del(&sev->node);
1576		kvfree(ctrl->p_array);
1577		kvfree(ctrl);
1578	}
1579	kvfree(hdl->buckets);
1580	hdl->buckets = NULL;
1581	hdl->cached = NULL;
1582	hdl->error = 0;
1583	mutex_unlock(hdl->lock);
1584	mutex_destroy(&hdl->_lock);
1585}
1586EXPORT_SYMBOL(v4l2_ctrl_handler_free);
1587
1588/* For backwards compatibility: V4L2_CID_PRIVATE_BASE should no longer
1589   be used except in G_CTRL, S_CTRL, QUERYCTRL and QUERYMENU when dealing
1590   with applications that do not use the NEXT_CTRL flag.
1591
1592   We just find the n-th private user control. It's O(N), but that should not
1593   be an issue in this particular case. */
1594static struct v4l2_ctrl_ref *find_private_ref(
1595		struct v4l2_ctrl_handler *hdl, u32 id)
1596{
1597	struct v4l2_ctrl_ref *ref;
1598
1599	id -= V4L2_CID_PRIVATE_BASE;
1600	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1601		/* Search for private user controls that are compatible with
1602		   VIDIOC_G/S_CTRL. */
1603		if (V4L2_CTRL_ID2WHICH(ref->ctrl->id) == V4L2_CTRL_CLASS_USER &&
1604		    V4L2_CTRL_DRIVER_PRIV(ref->ctrl->id)) {
1605			if (!ref->ctrl->is_int)
1606				continue;
1607			if (id == 0)
1608				return ref;
1609			id--;
1610		}
1611	}
1612	return NULL;
1613}
1614
1615/* Find a control with the given ID. */
1616struct v4l2_ctrl_ref *find_ref(struct v4l2_ctrl_handler *hdl, u32 id)
1617{
1618	struct v4l2_ctrl_ref *ref;
1619	int bucket;
1620
1621	id &= V4L2_CTRL_ID_MASK;
1622
1623	/* Old-style private controls need special handling */
1624	if (id >= V4L2_CID_PRIVATE_BASE)
1625		return find_private_ref(hdl, id);
1626	bucket = id % hdl->nr_of_buckets;
1627
1628	/* Simple optimization: cache the last control found */
1629	if (hdl->cached && hdl->cached->ctrl->id == id)
1630		return hdl->cached;
1631
1632	/* Not in cache, search the hash */
1633	ref = hdl->buckets ? hdl->buckets[bucket] : NULL;
1634	while (ref && ref->ctrl->id != id)
1635		ref = ref->next;
1636
1637	if (ref)
1638		hdl->cached = ref; /* cache it! */
1639	return ref;
1640}
1641
1642/* Find a control with the given ID. Take the handler's lock first. */
1643struct v4l2_ctrl_ref *find_ref_lock(struct v4l2_ctrl_handler *hdl, u32 id)
1644{
1645	struct v4l2_ctrl_ref *ref = NULL;
1646
1647	if (hdl) {
1648		mutex_lock(hdl->lock);
1649		ref = find_ref(hdl, id);
1650		mutex_unlock(hdl->lock);
1651	}
1652	return ref;
1653}
1654
1655/* Find a control with the given ID. */
1656struct v4l2_ctrl *v4l2_ctrl_find(struct v4l2_ctrl_handler *hdl, u32 id)
1657{
1658	struct v4l2_ctrl_ref *ref = find_ref_lock(hdl, id);
1659
1660	return ref ? ref->ctrl : NULL;
1661}
1662EXPORT_SYMBOL(v4l2_ctrl_find);
1663
1664/* Allocate a new v4l2_ctrl_ref and hook it into the handler. */
1665int handler_new_ref(struct v4l2_ctrl_handler *hdl,
1666		    struct v4l2_ctrl *ctrl,
1667		    struct v4l2_ctrl_ref **ctrl_ref,
1668		    bool from_other_dev, bool allocate_req)
1669{
1670	struct v4l2_ctrl_ref *ref;
1671	struct v4l2_ctrl_ref *new_ref;
1672	u32 id = ctrl->id;
1673	u32 class_ctrl = V4L2_CTRL_ID2WHICH(id) | 1;
1674	int bucket = id % hdl->nr_of_buckets;	/* which bucket to use */
1675	unsigned int size_extra_req = 0;
1676
1677	if (ctrl_ref)
1678		*ctrl_ref = NULL;
1679
1680	/*
1681	 * Automatically add the control class if it is not yet present and
1682	 * the new control is not a compound control.
1683	 */
1684	if (ctrl->type < V4L2_CTRL_COMPOUND_TYPES &&
1685	    id != class_ctrl && find_ref_lock(hdl, class_ctrl) == NULL)
1686		if (!v4l2_ctrl_new_std(hdl, NULL, class_ctrl, 0, 0, 0, 0))
1687			return hdl->error;
1688
1689	if (hdl->error)
1690		return hdl->error;
1691
1692	if (allocate_req && !ctrl->is_array)
1693		size_extra_req = ctrl->elems * ctrl->elem_size;
1694	new_ref = kzalloc(sizeof(*new_ref) + size_extra_req, GFP_KERNEL);
1695	if (!new_ref)
1696		return handler_set_err(hdl, -ENOMEM);
1697	new_ref->ctrl = ctrl;
1698	new_ref->from_other_dev = from_other_dev;
1699	if (size_extra_req)
1700		new_ref->p_req.p = &new_ref[1];
1701
1702	INIT_LIST_HEAD(&new_ref->node);
1703
1704	mutex_lock(hdl->lock);
1705
1706	/* Add immediately at the end of the list if the list is empty, or if
1707	   the last element in the list has a lower ID.
1708	   This ensures that when elements are added in ascending order the
1709	   insertion is an O(1) operation. */
1710	if (list_empty(&hdl->ctrl_refs) || id > node2id(hdl->ctrl_refs.prev)) {
1711		list_add_tail(&new_ref->node, &hdl->ctrl_refs);
1712		goto insert_in_hash;
1713	}
1714
1715	/* Find insert position in sorted list */
1716	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1717		if (ref->ctrl->id < id)
1718			continue;
1719		/* Don't add duplicates */
1720		if (ref->ctrl->id == id) {
1721			kfree(new_ref);
1722			goto unlock;
1723		}
1724		list_add(&new_ref->node, ref->node.prev);
1725		break;
1726	}
1727
1728insert_in_hash:
1729	/* Insert the control node in the hash */
1730	new_ref->next = hdl->buckets[bucket];
1731	hdl->buckets[bucket] = new_ref;
1732	if (ctrl_ref)
1733		*ctrl_ref = new_ref;
1734	if (ctrl->handler == hdl) {
1735		/* By default each control starts in a cluster of its own.
1736		 * new_ref->ctrl is basically a cluster array with one
1737		 * element, so that's perfect to use as the cluster pointer.
1738		 * But only do this for the handler that owns the control.
1739		 */
1740		ctrl->cluster = &new_ref->ctrl;
1741		ctrl->ncontrols = 1;
1742	}
1743
1744unlock:
1745	mutex_unlock(hdl->lock);
1746	return 0;
1747}
1748
1749/* Add a new control */
1750static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl,
1751			const struct v4l2_ctrl_ops *ops,
1752			const struct v4l2_ctrl_type_ops *type_ops,
1753			u32 id, const char *name, enum v4l2_ctrl_type type,
1754			s64 min, s64 max, u64 step, s64 def,
1755			const u32 dims[V4L2_CTRL_MAX_DIMS], u32 elem_size,
1756			u32 flags, const char * const *qmenu,
1757			const s64 *qmenu_int, const union v4l2_ctrl_ptr p_def,
1758			void *priv)
1759{
1760	struct v4l2_ctrl *ctrl;
1761	unsigned sz_extra;
1762	unsigned nr_of_dims = 0;
1763	unsigned elems = 1;
1764	bool is_array;
1765	unsigned tot_ctrl_size;
1766	void *data;
1767	int err;
1768
1769	if (hdl->error)
1770		return NULL;
1771
1772	while (dims && dims[nr_of_dims]) {
1773		elems *= dims[nr_of_dims];
1774		nr_of_dims++;
1775		if (nr_of_dims == V4L2_CTRL_MAX_DIMS)
1776			break;
1777	}
1778	is_array = nr_of_dims > 0;
1779
1780	/* Prefill elem_size for all types handled by std_type_ops */
1781	switch ((u32)type) {
1782	case V4L2_CTRL_TYPE_INTEGER64:
1783		elem_size = sizeof(s64);
1784		break;
1785	case V4L2_CTRL_TYPE_STRING:
1786		elem_size = max + 1;
1787		break;
1788	case V4L2_CTRL_TYPE_U8:
1789		elem_size = sizeof(u8);
1790		break;
1791	case V4L2_CTRL_TYPE_U16:
1792		elem_size = sizeof(u16);
1793		break;
1794	case V4L2_CTRL_TYPE_U32:
1795		elem_size = sizeof(u32);
1796		break;
1797	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
1798		elem_size = sizeof(struct v4l2_ctrl_mpeg2_sequence);
1799		break;
1800	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
1801		elem_size = sizeof(struct v4l2_ctrl_mpeg2_picture);
1802		break;
1803	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
1804		elem_size = sizeof(struct v4l2_ctrl_mpeg2_quantisation);
1805		break;
1806	case V4L2_CTRL_TYPE_FWHT_PARAMS:
1807		elem_size = sizeof(struct v4l2_ctrl_fwht_params);
1808		break;
1809	case V4L2_CTRL_TYPE_H264_SPS:
1810		elem_size = sizeof(struct v4l2_ctrl_h264_sps);
1811		break;
1812	case V4L2_CTRL_TYPE_H264_PPS:
1813		elem_size = sizeof(struct v4l2_ctrl_h264_pps);
1814		break;
1815	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
1816		elem_size = sizeof(struct v4l2_ctrl_h264_scaling_matrix);
1817		break;
1818	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
1819		elem_size = sizeof(struct v4l2_ctrl_h264_slice_params);
1820		break;
1821	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1822		elem_size = sizeof(struct v4l2_ctrl_h264_decode_params);
1823		break;
1824	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
1825		elem_size = sizeof(struct v4l2_ctrl_h264_pred_weights);
1826		break;
1827	case V4L2_CTRL_TYPE_VP8_FRAME:
1828		elem_size = sizeof(struct v4l2_ctrl_vp8_frame);
1829		break;
1830	case V4L2_CTRL_TYPE_HEVC_SPS:
1831		elem_size = sizeof(struct v4l2_ctrl_hevc_sps);
1832		break;
1833	case V4L2_CTRL_TYPE_HEVC_PPS:
1834		elem_size = sizeof(struct v4l2_ctrl_hevc_pps);
1835		break;
1836	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
1837		elem_size = sizeof(struct v4l2_ctrl_hevc_slice_params);
1838		break;
1839	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
1840		elem_size = sizeof(struct v4l2_ctrl_hevc_scaling_matrix);
1841		break;
1842	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
1843		elem_size = sizeof(struct v4l2_ctrl_hevc_decode_params);
1844		break;
1845	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
1846		elem_size = sizeof(struct v4l2_ctrl_hdr10_cll_info);
1847		break;
1848	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
1849		elem_size = sizeof(struct v4l2_ctrl_hdr10_mastering_display);
1850		break;
1851	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
1852		elem_size = sizeof(struct v4l2_ctrl_vp9_compressed_hdr);
1853		break;
1854	case V4L2_CTRL_TYPE_VP9_FRAME:
1855		elem_size = sizeof(struct v4l2_ctrl_vp9_frame);
1856		break;
1857	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
1858		elem_size = sizeof(struct v4l2_ctrl_av1_sequence);
1859		break;
1860	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
1861		elem_size = sizeof(struct v4l2_ctrl_av1_tile_group_entry);
1862		break;
1863	case V4L2_CTRL_TYPE_AV1_FRAME:
1864		elem_size = sizeof(struct v4l2_ctrl_av1_frame);
1865		break;
1866	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
1867		elem_size = sizeof(struct v4l2_ctrl_av1_film_grain);
1868		break;
1869	case V4L2_CTRL_TYPE_AREA:
1870		elem_size = sizeof(struct v4l2_area);
1871		break;
1872	default:
1873		if (type < V4L2_CTRL_COMPOUND_TYPES)
1874			elem_size = sizeof(s32);
1875		break;
1876	}
1877
1878	/* Sanity checks */
1879	if (id == 0 || name == NULL || !elem_size ||
1880	    id >= V4L2_CID_PRIVATE_BASE ||
1881	    (type == V4L2_CTRL_TYPE_MENU && qmenu == NULL) ||
1882	    (type == V4L2_CTRL_TYPE_INTEGER_MENU && qmenu_int == NULL)) {
1883		handler_set_err(hdl, -ERANGE);
1884		return NULL;
1885	}
1886	err = check_range(type, min, max, step, def);
1887	if (err) {
1888		handler_set_err(hdl, err);
1889		return NULL;
1890	}
1891	if (is_array &&
1892	    (type == V4L2_CTRL_TYPE_BUTTON ||
1893	     type == V4L2_CTRL_TYPE_CTRL_CLASS)) {
1894		handler_set_err(hdl, -EINVAL);
1895		return NULL;
1896	}
1897	if (flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY) {
1898		/*
1899		 * For now only support this for one-dimensional arrays only.
1900		 *
1901		 * This can be relaxed in the future, but this will
1902		 * require more effort.
1903		 */
1904		if (nr_of_dims != 1) {
1905			handler_set_err(hdl, -EINVAL);
1906			return NULL;
1907		}
1908		/* Start with just 1 element */
1909		elems = 1;
1910	}
1911
1912	tot_ctrl_size = elem_size * elems;
1913	sz_extra = 0;
1914	if (type == V4L2_CTRL_TYPE_BUTTON)
1915		flags |= V4L2_CTRL_FLAG_WRITE_ONLY |
1916			V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
1917	else if (type == V4L2_CTRL_TYPE_CTRL_CLASS)
1918		flags |= V4L2_CTRL_FLAG_READ_ONLY;
1919	else if (!is_array &&
1920		 (type == V4L2_CTRL_TYPE_INTEGER64 ||
1921		  type == V4L2_CTRL_TYPE_STRING ||
1922		  type >= V4L2_CTRL_COMPOUND_TYPES))
1923		sz_extra += 2 * tot_ctrl_size;
1924
1925	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const)
1926		sz_extra += elem_size;
1927
1928	ctrl = kvzalloc(sizeof(*ctrl) + sz_extra, GFP_KERNEL);
1929	if (ctrl == NULL) {
1930		handler_set_err(hdl, -ENOMEM);
1931		return NULL;
1932	}
1933
1934	INIT_LIST_HEAD(&ctrl->node);
1935	INIT_LIST_HEAD(&ctrl->ev_subs);
1936	ctrl->handler = hdl;
1937	ctrl->ops = ops;
1938	ctrl->type_ops = type_ops ? type_ops : &std_type_ops;
1939	ctrl->id = id;
1940	ctrl->name = name;
1941	ctrl->type = type;
1942	ctrl->flags = flags;
1943	ctrl->minimum = min;
1944	ctrl->maximum = max;
1945	ctrl->step = step;
1946	ctrl->default_value = def;
1947	ctrl->is_string = !is_array && type == V4L2_CTRL_TYPE_STRING;
1948	ctrl->is_ptr = is_array || type >= V4L2_CTRL_COMPOUND_TYPES || ctrl->is_string;
1949	ctrl->is_int = !ctrl->is_ptr && type != V4L2_CTRL_TYPE_INTEGER64;
1950	ctrl->is_array = is_array;
1951	ctrl->is_dyn_array = !!(flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY);
1952	ctrl->elems = elems;
1953	ctrl->new_elems = elems;
1954	ctrl->nr_of_dims = nr_of_dims;
1955	if (nr_of_dims)
1956		memcpy(ctrl->dims, dims, nr_of_dims * sizeof(dims[0]));
1957	ctrl->elem_size = elem_size;
1958	if (type == V4L2_CTRL_TYPE_MENU)
1959		ctrl->qmenu = qmenu;
1960	else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
1961		ctrl->qmenu_int = qmenu_int;
1962	ctrl->priv = priv;
1963	ctrl->cur.val = ctrl->val = def;
1964	data = &ctrl[1];
1965
1966	if (ctrl->is_array) {
1967		ctrl->p_array_alloc_elems = elems;
1968		ctrl->p_array = kvzalloc(2 * elems * elem_size, GFP_KERNEL);
1969		if (!ctrl->p_array) {
1970			kvfree(ctrl);
1971			return NULL;
1972		}
1973		data = ctrl->p_array;
1974	}
1975
1976	if (!ctrl->is_int) {
1977		ctrl->p_new.p = data;
1978		ctrl->p_cur.p = data + tot_ctrl_size;
1979	} else {
1980		ctrl->p_new.p = &ctrl->val;
1981		ctrl->p_cur.p = &ctrl->cur.val;
1982	}
1983
1984	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const) {
1985		if (ctrl->is_array)
1986			ctrl->p_def.p = &ctrl[1];
1987		else
1988			ctrl->p_def.p = ctrl->p_cur.p + tot_ctrl_size;
1989		memcpy(ctrl->p_def.p, p_def.p_const, elem_size);
1990	}
1991
1992	ctrl->type_ops->init(ctrl, 0, ctrl->p_cur);
1993	cur_to_new(ctrl);
1994
1995	if (handler_new_ref(hdl, ctrl, NULL, false, false)) {
1996		kvfree(ctrl->p_array);
1997		kvfree(ctrl);
1998		return NULL;
1999	}
2000	mutex_lock(hdl->lock);
2001	list_add_tail(&ctrl->node, &hdl->ctrls);
2002	mutex_unlock(hdl->lock);
2003	return ctrl;
2004}
2005
2006struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
2007			const struct v4l2_ctrl_config *cfg, void *priv)
2008{
2009	bool is_menu;
2010	struct v4l2_ctrl *ctrl;
2011	const char *name = cfg->name;
2012	const char * const *qmenu = cfg->qmenu;
2013	const s64 *qmenu_int = cfg->qmenu_int;
2014	enum v4l2_ctrl_type type = cfg->type;
2015	u32 flags = cfg->flags;
2016	s64 min = cfg->min;
2017	s64 max = cfg->max;
2018	u64 step = cfg->step;
2019	s64 def = cfg->def;
2020
2021	if (name == NULL)
2022		v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
2023								&def, &flags);
2024
2025	is_menu = (type == V4L2_CTRL_TYPE_MENU ||
2026		   type == V4L2_CTRL_TYPE_INTEGER_MENU);
2027	if (is_menu)
2028		WARN_ON(step);
2029	else
2030		WARN_ON(cfg->menu_skip_mask);
2031	if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
2032		qmenu = v4l2_ctrl_get_menu(cfg->id);
2033	} else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
2034		handler_set_err(hdl, -EINVAL);
2035		return NULL;
2036	}
2037
2038	ctrl = v4l2_ctrl_new(hdl, cfg->ops, cfg->type_ops, cfg->id, name,
2039			type, min, max,
2040			is_menu ? cfg->menu_skip_mask : step, def,
2041			cfg->dims, cfg->elem_size,
2042			flags, qmenu, qmenu_int, cfg->p_def, priv);
2043	if (ctrl)
2044		ctrl->is_private = cfg->is_private;
2045	return ctrl;
2046}
2047EXPORT_SYMBOL(v4l2_ctrl_new_custom);
2048
2049/* Helper function for standard non-menu controls */
2050struct v4l2_ctrl *v4l2_ctrl_new_std(struct v4l2_ctrl_handler *hdl,
2051			const struct v4l2_ctrl_ops *ops,
2052			u32 id, s64 min, s64 max, u64 step, s64 def)
2053{
2054	const char *name;
2055	enum v4l2_ctrl_type type;
2056	u32 flags;
2057
2058	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2059	if (type == V4L2_CTRL_TYPE_MENU ||
2060	    type == V4L2_CTRL_TYPE_INTEGER_MENU ||
2061	    type >= V4L2_CTRL_COMPOUND_TYPES) {
2062		handler_set_err(hdl, -EINVAL);
2063		return NULL;
2064	}
2065	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2066			     min, max, step, def, NULL, 0,
2067			     flags, NULL, NULL, ptr_null, NULL);
2068}
2069EXPORT_SYMBOL(v4l2_ctrl_new_std);
2070
2071/* Helper function for standard menu controls */
2072struct v4l2_ctrl *v4l2_ctrl_new_std_menu(struct v4l2_ctrl_handler *hdl,
2073			const struct v4l2_ctrl_ops *ops,
2074			u32 id, u8 _max, u64 mask, u8 _def)
2075{
2076	const char * const *qmenu = NULL;
2077	const s64 *qmenu_int = NULL;
2078	unsigned int qmenu_int_len = 0;
2079	const char *name;
2080	enum v4l2_ctrl_type type;
2081	s64 min;
2082	s64 max = _max;
2083	s64 def = _def;
2084	u64 step;
2085	u32 flags;
2086
2087	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2088
2089	if (type == V4L2_CTRL_TYPE_MENU)
2090		qmenu = v4l2_ctrl_get_menu(id);
2091	else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
2092		qmenu_int = v4l2_ctrl_get_int_menu(id, &qmenu_int_len);
2093
2094	if ((!qmenu && !qmenu_int) || (qmenu_int && max >= qmenu_int_len)) {
2095		handler_set_err(hdl, -EINVAL);
2096		return NULL;
2097	}
2098	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2099			     0, max, mask, def, NULL, 0,
2100			     flags, qmenu, qmenu_int, ptr_null, NULL);
2101}
2102EXPORT_SYMBOL(v4l2_ctrl_new_std_menu);
2103
2104/* Helper function for standard menu controls with driver defined menu */
2105struct v4l2_ctrl *v4l2_ctrl_new_std_menu_items(struct v4l2_ctrl_handler *hdl,
2106			const struct v4l2_ctrl_ops *ops, u32 id, u8 _max,
2107			u64 mask, u8 _def, const char * const *qmenu)
2108{
2109	enum v4l2_ctrl_type type;
2110	const char *name;
2111	u32 flags;
2112	u64 step;
2113	s64 min;
2114	s64 max = _max;
2115	s64 def = _def;
2116
2117	/* v4l2_ctrl_new_std_menu_items() should only be called for
2118	 * standard controls without a standard menu.
2119	 */
2120	if (v4l2_ctrl_get_menu(id)) {
2121		handler_set_err(hdl, -EINVAL);
2122		return NULL;
2123	}
2124
2125	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2126	if (type != V4L2_CTRL_TYPE_MENU || qmenu == NULL) {
2127		handler_set_err(hdl, -EINVAL);
2128		return NULL;
2129	}
2130	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2131			     0, max, mask, def, NULL, 0,
2132			     flags, qmenu, NULL, ptr_null, NULL);
2133
2134}
2135EXPORT_SYMBOL(v4l2_ctrl_new_std_menu_items);
2136
2137/* Helper function for standard compound controls */
2138struct v4l2_ctrl *v4l2_ctrl_new_std_compound(struct v4l2_ctrl_handler *hdl,
2139				const struct v4l2_ctrl_ops *ops, u32 id,
2140				const union v4l2_ctrl_ptr p_def)
2141{
2142	const char *name;
2143	enum v4l2_ctrl_type type;
2144	u32 flags;
2145	s64 min, max, step, def;
2146
2147	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2148	if (type < V4L2_CTRL_COMPOUND_TYPES) {
2149		handler_set_err(hdl, -EINVAL);
2150		return NULL;
2151	}
2152	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2153			     min, max, step, def, NULL, 0,
2154			     flags, NULL, NULL, p_def, NULL);
2155}
2156EXPORT_SYMBOL(v4l2_ctrl_new_std_compound);
2157
2158/* Helper function for standard integer menu controls */
2159struct v4l2_ctrl *v4l2_ctrl_new_int_menu(struct v4l2_ctrl_handler *hdl,
2160			const struct v4l2_ctrl_ops *ops,
2161			u32 id, u8 _max, u8 _def, const s64 *qmenu_int)
2162{
2163	const char *name;
2164	enum v4l2_ctrl_type type;
2165	s64 min;
2166	u64 step;
2167	s64 max = _max;
2168	s64 def = _def;
2169	u32 flags;
2170
2171	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2172	if (type != V4L2_CTRL_TYPE_INTEGER_MENU) {
2173		handler_set_err(hdl, -EINVAL);
2174		return NULL;
2175	}
2176	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2177			     0, max, 0, def, NULL, 0,
2178			     flags, NULL, qmenu_int, ptr_null, NULL);
2179}
2180EXPORT_SYMBOL(v4l2_ctrl_new_int_menu);
2181
2182/* Add the controls from another handler to our own. */
2183int v4l2_ctrl_add_handler(struct v4l2_ctrl_handler *hdl,
2184			  struct v4l2_ctrl_handler *add,
2185			  bool (*filter)(const struct v4l2_ctrl *ctrl),
2186			  bool from_other_dev)
2187{
2188	struct v4l2_ctrl_ref *ref;
2189	int ret = 0;
2190
2191	/* Do nothing if either handler is NULL or if they are the same */
2192	if (!hdl || !add || hdl == add)
2193		return 0;
2194	if (hdl->error)
2195		return hdl->error;
2196	mutex_lock(add->lock);
2197	list_for_each_entry(ref, &add->ctrl_refs, node) {
2198		struct v4l2_ctrl *ctrl = ref->ctrl;
2199
2200		/* Skip handler-private controls. */
2201		if (ctrl->is_private)
2202			continue;
2203		/* And control classes */
2204		if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2205			continue;
2206		/* Filter any unwanted controls */
2207		if (filter && !filter(ctrl))
2208			continue;
2209		ret = handler_new_ref(hdl, ctrl, NULL, from_other_dev, false);
2210		if (ret)
2211			break;
2212	}
2213	mutex_unlock(add->lock);
2214	return ret;
2215}
2216EXPORT_SYMBOL(v4l2_ctrl_add_handler);
2217
2218bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl)
2219{
2220	if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_TX)
2221		return true;
2222	if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_RX)
2223		return true;
2224	switch (ctrl->id) {
2225	case V4L2_CID_AUDIO_MUTE:
2226	case V4L2_CID_AUDIO_VOLUME:
2227	case V4L2_CID_AUDIO_BALANCE:
2228	case V4L2_CID_AUDIO_BASS:
2229	case V4L2_CID_AUDIO_TREBLE:
2230	case V4L2_CID_AUDIO_LOUDNESS:
2231		return true;
2232	default:
2233		break;
2234	}
2235	return false;
2236}
2237EXPORT_SYMBOL(v4l2_ctrl_radio_filter);
2238
2239/* Cluster controls */
2240void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
2241{
2242	bool has_volatiles = false;
2243	int i;
2244
2245	/* The first control is the master control and it must not be NULL */
2246	if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
2247		return;
2248
2249	for (i = 0; i < ncontrols; i++) {
2250		if (controls[i]) {
2251			controls[i]->cluster = controls;
2252			controls[i]->ncontrols = ncontrols;
2253			if (controls[i]->flags & V4L2_CTRL_FLAG_VOLATILE)
2254				has_volatiles = true;
2255		}
2256	}
2257	controls[0]->has_volatiles = has_volatiles;
2258}
2259EXPORT_SYMBOL(v4l2_ctrl_cluster);
2260
2261void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
2262			    u8 manual_val, bool set_volatile)
2263{
2264	struct v4l2_ctrl *master = controls[0];
2265	u32 flag = 0;
2266	int i;
2267
2268	v4l2_ctrl_cluster(ncontrols, controls);
2269	WARN_ON(ncontrols <= 1);
2270	WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
2271	WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
2272	master->is_auto = true;
2273	master->has_volatiles = set_volatile;
2274	master->manual_mode_value = manual_val;
2275	master->flags |= V4L2_CTRL_FLAG_UPDATE;
2276
2277	if (!is_cur_manual(master))
2278		flag = V4L2_CTRL_FLAG_INACTIVE |
2279			(set_volatile ? V4L2_CTRL_FLAG_VOLATILE : 0);
2280
2281	for (i = 1; i < ncontrols; i++)
2282		if (controls[i])
2283			controls[i]->flags |= flag;
2284}
2285EXPORT_SYMBOL(v4l2_ctrl_auto_cluster);
2286
2287/*
2288 * Obtain the current volatile values of an autocluster and mark them
2289 * as new.
2290 */
2291void update_from_auto_cluster(struct v4l2_ctrl *master)
2292{
2293	int i;
2294
2295	for (i = 1; i < master->ncontrols; i++)
2296		cur_to_new(master->cluster[i]);
2297	if (!call_op(master, g_volatile_ctrl))
2298		for (i = 1; i < master->ncontrols; i++)
2299			if (master->cluster[i])
2300				master->cluster[i]->is_new = 1;
2301}
2302
2303/*
2304 * Return non-zero if one or more of the controls in the cluster has a new
2305 * value that differs from the current value.
2306 */
2307static int cluster_changed(struct v4l2_ctrl *master)
2308{
2309	bool changed = false;
2310	int i;
2311
2312	for (i = 0; i < master->ncontrols; i++) {
2313		struct v4l2_ctrl *ctrl = master->cluster[i];
2314		bool ctrl_changed = false;
2315
2316		if (!ctrl)
2317			continue;
2318
2319		if (ctrl->flags & V4L2_CTRL_FLAG_EXECUTE_ON_WRITE) {
2320			changed = true;
2321			ctrl_changed = true;
2322		}
2323
2324		/*
2325		 * Set has_changed to false to avoid generating
2326		 * the event V4L2_EVENT_CTRL_CH_VALUE
2327		 */
2328		if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
2329			ctrl->has_changed = false;
2330			continue;
2331		}
2332
2333		if (ctrl->elems != ctrl->new_elems)
2334			ctrl_changed = true;
2335		if (!ctrl_changed)
2336			ctrl_changed = !ctrl->type_ops->equal(ctrl,
2337				ctrl->p_cur, ctrl->p_new);
2338		ctrl->has_changed = ctrl_changed;
2339		changed |= ctrl->has_changed;
2340	}
2341	return changed;
2342}
2343
2344/*
2345 * Core function that calls try/s_ctrl and ensures that the new value is
2346 * copied to the current value on a set.
2347 * Must be called with ctrl->handler->lock held.
2348 */
2349int try_or_set_cluster(struct v4l2_fh *fh, struct v4l2_ctrl *master,
2350		       bool set, u32 ch_flags)
2351{
2352	bool update_flag;
2353	int ret;
2354	int i;
2355
2356	/*
2357	 * Go through the cluster and either validate the new value or
2358	 * (if no new value was set), copy the current value to the new
2359	 * value, ensuring a consistent view for the control ops when
2360	 * called.
2361	 */
2362	for (i = 0; i < master->ncontrols; i++) {
2363		struct v4l2_ctrl *ctrl = master->cluster[i];
2364
2365		if (!ctrl)
2366			continue;
2367
2368		if (!ctrl->is_new) {
2369			cur_to_new(ctrl);
2370			continue;
2371		}
2372		/*
2373		 * Check again: it may have changed since the
2374		 * previous check in try_or_set_ext_ctrls().
2375		 */
2376		if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED))
2377			return -EBUSY;
2378	}
2379
2380	ret = call_op(master, try_ctrl);
2381
2382	/* Don't set if there is no change */
2383	if (ret || !set || !cluster_changed(master))
2384		return ret;
2385	ret = call_op(master, s_ctrl);
2386	if (ret)
2387		return ret;
2388
2389	/* If OK, then make the new values permanent. */
2390	update_flag = is_cur_manual(master) != is_new_manual(master);
2391
2392	for (i = 0; i < master->ncontrols; i++) {
2393		/*
2394		 * If we switch from auto to manual mode, and this cluster
2395		 * contains volatile controls, then all non-master controls
2396		 * have to be marked as changed. The 'new' value contains
2397		 * the volatile value (obtained by update_from_auto_cluster),
2398		 * which now has to become the current value.
2399		 */
2400		if (i && update_flag && is_new_manual(master) &&
2401		    master->has_volatiles && master->cluster[i])
2402			master->cluster[i]->has_changed = true;
2403
2404		new_to_cur(fh, master->cluster[i], ch_flags |
2405			((update_flag && i > 0) ? V4L2_EVENT_CTRL_CH_FLAGS : 0));
2406	}
2407	return 0;
2408}
2409
2410/* Activate/deactivate a control. */
2411void v4l2_ctrl_activate(struct v4l2_ctrl *ctrl, bool active)
2412{
2413	/* invert since the actual flag is called 'inactive' */
2414	bool inactive = !active;
2415	bool old;
2416
2417	if (ctrl == NULL)
2418		return;
2419
2420	if (inactive)
2421		/* set V4L2_CTRL_FLAG_INACTIVE */
2422		old = test_and_set_bit(4, &ctrl->flags);
2423	else
2424		/* clear V4L2_CTRL_FLAG_INACTIVE */
2425		old = test_and_clear_bit(4, &ctrl->flags);
2426	if (old != inactive)
2427		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2428}
2429EXPORT_SYMBOL(v4l2_ctrl_activate);
2430
2431void __v4l2_ctrl_grab(struct v4l2_ctrl *ctrl, bool grabbed)
2432{
2433	bool old;
2434
2435	if (ctrl == NULL)
2436		return;
2437
2438	lockdep_assert_held(ctrl->handler->lock);
2439
2440	if (grabbed)
2441		/* set V4L2_CTRL_FLAG_GRABBED */
2442		old = test_and_set_bit(1, &ctrl->flags);
2443	else
2444		/* clear V4L2_CTRL_FLAG_GRABBED */
2445		old = test_and_clear_bit(1, &ctrl->flags);
2446	if (old != grabbed)
2447		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2448}
2449EXPORT_SYMBOL(__v4l2_ctrl_grab);
2450
2451/* Call s_ctrl for all controls owned by the handler */
2452int __v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2453{
2454	struct v4l2_ctrl *ctrl;
2455	int ret = 0;
2456
2457	if (hdl == NULL)
2458		return 0;
2459
2460	lockdep_assert_held(hdl->lock);
2461
2462	list_for_each_entry(ctrl, &hdl->ctrls, node)
2463		ctrl->done = false;
2464
2465	list_for_each_entry(ctrl, &hdl->ctrls, node) {
2466		struct v4l2_ctrl *master = ctrl->cluster[0];
2467		int i;
2468
2469		/* Skip if this control was already handled by a cluster. */
2470		/* Skip button controls and read-only controls. */
2471		if (ctrl->done || ctrl->type == V4L2_CTRL_TYPE_BUTTON ||
2472		    (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY))
2473			continue;
2474
2475		for (i = 0; i < master->ncontrols; i++) {
2476			if (master->cluster[i]) {
2477				cur_to_new(master->cluster[i]);
2478				master->cluster[i]->is_new = 1;
2479				master->cluster[i]->done = true;
2480			}
2481		}
2482		ret = call_op(master, s_ctrl);
2483		if (ret)
2484			break;
2485	}
2486
2487	return ret;
2488}
2489EXPORT_SYMBOL_GPL(__v4l2_ctrl_handler_setup);
2490
2491int v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2492{
2493	int ret;
2494
2495	if (hdl == NULL)
2496		return 0;
2497
2498	mutex_lock(hdl->lock);
2499	ret = __v4l2_ctrl_handler_setup(hdl);
2500	mutex_unlock(hdl->lock);
2501
2502	return ret;
2503}
2504EXPORT_SYMBOL(v4l2_ctrl_handler_setup);
2505
2506/* Log the control name and value */
2507static void log_ctrl(const struct v4l2_ctrl_handler *hdl,
2508		     struct v4l2_ctrl *ctrl,
2509		     const char *prefix, const char *colon)
2510{
2511	if (ctrl->flags & (V4L2_CTRL_FLAG_DISABLED | V4L2_CTRL_FLAG_WRITE_ONLY))
2512		return;
2513	if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2514		return;
2515
2516	pr_info("%s%s%s: ", prefix, colon, ctrl->name);
2517
2518	if (ctrl->handler != hdl)
2519		v4l2_ctrl_lock(ctrl);
2520	ctrl->type_ops->log(ctrl);
2521	if (ctrl->handler != hdl)
2522		v4l2_ctrl_unlock(ctrl);
2523
2524	if (ctrl->flags & (V4L2_CTRL_FLAG_INACTIVE |
2525			   V4L2_CTRL_FLAG_GRABBED |
2526			   V4L2_CTRL_FLAG_VOLATILE)) {
2527		if (ctrl->flags & V4L2_CTRL_FLAG_INACTIVE)
2528			pr_cont(" inactive");
2529		if (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)
2530			pr_cont(" grabbed");
2531		if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE)
2532			pr_cont(" volatile");
2533	}
2534	pr_cont("\n");
2535}
2536
2537/* Log all controls owned by the handler */
2538void v4l2_ctrl_handler_log_status(struct v4l2_ctrl_handler *hdl,
2539				  const char *prefix)
2540{
2541	struct v4l2_ctrl_ref *ref;
2542	const char *colon = "";
2543	int len;
2544
2545	if (!hdl)
2546		return;
2547	if (!prefix)
2548		prefix = "";
2549	len = strlen(prefix);
2550	if (len && prefix[len - 1] != ' ')
2551		colon = ": ";
2552	mutex_lock(hdl->lock);
2553	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
2554		if (ref->from_other_dev ||
2555		    (ref->ctrl->flags & V4L2_CTRL_FLAG_DISABLED))
2556			continue;
2557		log_ctrl(hdl, ref->ctrl, prefix, colon);
2558	}
2559	mutex_unlock(hdl->lock);
2560}
2561EXPORT_SYMBOL(v4l2_ctrl_handler_log_status);
2562
2563int v4l2_ctrl_new_fwnode_properties(struct v4l2_ctrl_handler *hdl,
2564				    const struct v4l2_ctrl_ops *ctrl_ops,
2565				    const struct v4l2_fwnode_device_properties *p)
2566{
2567	if (p->orientation != V4L2_FWNODE_PROPERTY_UNSET) {
2568		u32 orientation_ctrl;
2569
2570		switch (p->orientation) {
2571		case V4L2_FWNODE_ORIENTATION_FRONT:
2572			orientation_ctrl = V4L2_CAMERA_ORIENTATION_FRONT;
2573			break;
2574		case V4L2_FWNODE_ORIENTATION_BACK:
2575			orientation_ctrl = V4L2_CAMERA_ORIENTATION_BACK;
2576			break;
2577		case V4L2_FWNODE_ORIENTATION_EXTERNAL:
2578			orientation_ctrl = V4L2_CAMERA_ORIENTATION_EXTERNAL;
2579			break;
2580		default:
2581			return -EINVAL;
2582		}
2583		if (!v4l2_ctrl_new_std_menu(hdl, ctrl_ops,
2584					    V4L2_CID_CAMERA_ORIENTATION,
2585					    V4L2_CAMERA_ORIENTATION_EXTERNAL, 0,
2586					    orientation_ctrl))
2587			return hdl->error;
2588	}
2589
2590	if (p->rotation != V4L2_FWNODE_PROPERTY_UNSET) {
2591		if (!v4l2_ctrl_new_std(hdl, ctrl_ops,
2592				       V4L2_CID_CAMERA_SENSOR_ROTATION,
2593				       p->rotation, p->rotation, 1,
2594				       p->rotation))
2595			return hdl->error;
2596	}
2597
2598	return hdl->error;
2599}
2600EXPORT_SYMBOL(v4l2_ctrl_new_fwnode_properties);
2601