v4l2-ctrls-api.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * V4L2 controls framework uAPI implementation:
   4 *
   5 * Copyright (C) 2010-2021  Hans Verkuil <hverkuil@kernel.org>
   6 */
   7
   8#define pr_fmt(fmt) "v4l2-ctrls: " fmt
   9
  10#include <linux/export.h>
  11#include <linux/mm.h>
  12#include <linux/slab.h>
  13#include <media/v4l2-ctrls.h>
  14#include <media/v4l2-dev.h>
  15#include <media/v4l2-device.h>
  16#include <media/v4l2-event.h>
  17#include <media/v4l2-ioctl.h>
  18
  19#include "v4l2-ctrls-priv.h"
  20
  21/* Internal temporary helper struct, one for each v4l2_ext_control */
  22struct v4l2_ctrl_helper {
  23	/* Pointer to the control reference of the master control */
  24	struct v4l2_ctrl_ref *mref;
  25	/* The control ref corresponding to the v4l2_ext_control ID field. */
  26	struct v4l2_ctrl_ref *ref;
  27	/*
  28	 * v4l2_ext_control index of the next control belonging to the
  29	 * same cluster, or 0 if there isn't any.
  30	 */
  31	u32 next;
  32};
  33
  34/*
  35 * Helper functions to copy control payload data from kernel space to
  36 * user space and vice versa.
  37 */
  38
  39/* Helper function: copy the given control value back to the caller */
  40static int ptr_to_user(struct v4l2_ext_control *c,
  41		       struct v4l2_ctrl *ctrl,
  42		       union v4l2_ctrl_ptr ptr)
  43{
  44	u32 len;
  45
  46	if (ctrl->is_ptr && !ctrl->is_string)
  47		return copy_to_user(c->ptr, ptr.p_const, c->size) ?
  48		       -EFAULT : 0;
  49
  50	switch (ctrl->type) {
  51	case V4L2_CTRL_TYPE_STRING:
  52		len = strlen(ptr.p_char);
  53		if (c->size < len + 1) {
  54			c->size = ctrl->elem_size;
  55			return -ENOSPC;
  56		}
  57		return copy_to_user(c->string, ptr.p_char, len + 1) ?
  58		       -EFAULT : 0;
  59	case V4L2_CTRL_TYPE_INTEGER64:
  60		c->value64 = *ptr.p_s64;
  61		break;
  62	default:
  63		c->value = *ptr.p_s32;
  64		break;
  65	}
  66	return 0;
  67}
  68
  69/* Helper function: copy the current control value back to the caller */
  70static int cur_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
  71{
  72	return ptr_to_user(c, ctrl, ctrl->p_cur);
  73}
  74
  75/* Helper function: copy the new control value back to the caller */
  76static int new_to_user(struct v4l2_ext_control *c,
  77		       struct v4l2_ctrl *ctrl)
  78{
  79	return ptr_to_user(c, ctrl, ctrl->p_new);
  80}
  81
  82/* Helper function: copy the request value back to the caller */
  83static int req_to_user(struct v4l2_ext_control *c,
  84		       struct v4l2_ctrl_ref *ref)
  85{
  86	return ptr_to_user(c, ref->ctrl, ref->p_req);
  87}
  88
  89/* Helper function: copy the initial control value back to the caller */
  90static int def_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
  91{
  92	ctrl->type_ops->init(ctrl, 0, ctrl->p_new);
  93
  94	return ptr_to_user(c, ctrl, ctrl->p_new);
  95}
  96
  97/* Helper function: copy the minimum control value back to the caller */
  98static int min_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
  99{
 100	ctrl->type_ops->minimum(ctrl, 0, ctrl->p_new);
 101
 102	return ptr_to_user(c, ctrl, ctrl->p_new);
 103}
 104
 105/* Helper function: copy the maximum control value back to the caller */
 106static int max_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
 107{
 108	ctrl->type_ops->maximum(ctrl, 0, ctrl->p_new);
 109
 110	return ptr_to_user(c, ctrl, ctrl->p_new);
 111}
 112
 113/* Helper function: copy the caller-provider value as the new control value */
 114static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
 115{
 116	int ret;
 117	u32 size;
 118
 119	ctrl->is_new = 0;
 120	if (ctrl->is_dyn_array &&
 121	    c->size > ctrl->p_array_alloc_elems * ctrl->elem_size) {
 122		void *old = ctrl->p_array;
 123		void *tmp = kvzalloc(2 * c->size, GFP_KERNEL);
 124
 125		if (!tmp)
 126			return -ENOMEM;
 127		memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size);
 128		memcpy(tmp + c->size, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size);
 129		ctrl->p_new.p = tmp;
 130		ctrl->p_cur.p = tmp + c->size;
 131		ctrl->p_array = tmp;
 132		ctrl->p_array_alloc_elems = c->size / ctrl->elem_size;
 133		kvfree(old);
 134	}
 135
 136	if (ctrl->is_ptr && !ctrl->is_string) {
 137		unsigned int elems = c->size / ctrl->elem_size;
 138
 139		if (copy_from_user(ctrl->p_new.p, c->ptr, c->size))
 140			return -EFAULT;
 141		ctrl->is_new = 1;
 142		if (ctrl->is_dyn_array)
 143			ctrl->new_elems = elems;
 144		else if (ctrl->is_array)
 145			ctrl->type_ops->init(ctrl, elems, ctrl->p_new);
 146		return 0;
 147	}
 148
 149	switch (ctrl->type) {
 150	case V4L2_CTRL_TYPE_INTEGER64:
 151		*ctrl->p_new.p_s64 = c->value64;
 152		break;
 153	case V4L2_CTRL_TYPE_STRING:
 154		size = c->size;
 155		if (size == 0)
 156			return -ERANGE;
 157		if (size > ctrl->maximum + 1)
 158			size = ctrl->maximum + 1;
 159		ret = copy_from_user(ctrl->p_new.p_char, c->string, size) ? -EFAULT : 0;
 160		if (!ret) {
 161			char last = ctrl->p_new.p_char[size - 1];
 162
 163			ctrl->p_new.p_char[size - 1] = 0;
 164			/*
 165			 * If the string was longer than ctrl->maximum,
 166			 * then return an error.
 167			 */
 168			if (strlen(ctrl->p_new.p_char) == ctrl->maximum && last)
 169				return -ERANGE;
 170			ctrl->is_new = 1;
 171		}
 172		return ret;
 173	default:
 174		*ctrl->p_new.p_s32 = c->value;
 175		break;
 176	}
 177	ctrl->is_new = 1;
 178	return 0;
 179}
 180
 181/*
 182 * VIDIOC_G/TRY/S_EXT_CTRLS implementation
 183 */
 184
 185/*
 186 * Some general notes on the atomic requirements of VIDIOC_G/TRY/S_EXT_CTRLS:
 187 *
 188 * It is not a fully atomic operation, just best-effort only. After all, if
 189 * multiple controls have to be set through multiple i2c writes (for example)
 190 * then some initial writes may succeed while others fail. Thus leaving the
 191 * system in an inconsistent state. The question is how much effort you are
 192 * willing to spend on trying to make something atomic that really isn't.
 193 *
 194 * From the point of view of an application the main requirement is that
 195 * when you call VIDIOC_S_EXT_CTRLS and some values are invalid then an
 196 * error should be returned without actually affecting any controls.
 197 *
 198 * If all the values are correct, then it is acceptable to just give up
 199 * in case of low-level errors.
 200 *
 201 * It is important though that the application can tell when only a partial
 202 * configuration was done. The way we do that is through the error_idx field
 203 * of struct v4l2_ext_controls: if that is equal to the count field then no
 204 * controls were affected. Otherwise all controls before that index were
 205 * successful in performing their 'get' or 'set' operation, the control at
 206 * the given index failed, and you don't know what happened with the controls
 207 * after the failed one. Since if they were part of a control cluster they
 208 * could have been successfully processed (if a cluster member was encountered
 209 * at index < error_idx), they could have failed (if a cluster member was at
 210 * error_idx), or they may not have been processed yet (if the first cluster
 211 * member appeared after error_idx).
 212 *
 213 * It is all fairly theoretical, though. In practice all you can do is to
 214 * bail out. If error_idx == count, then it is an application bug. If
 215 * error_idx < count then it is only an application bug if the error code was
 216 * EBUSY. That usually means that something started streaming just when you
 217 * tried to set the controls. In all other cases it is a driver/hardware
 218 * problem and all you can do is to retry or bail out.
 219 *
 220 * Note that these rules do not apply to VIDIOC_TRY_EXT_CTRLS: since that
 221 * never modifies controls the error_idx is just set to whatever control
 222 * has an invalid value.
 223 */
 224
 225/*
 226 * Prepare for the extended g/s/try functions.
 227 * Find the controls in the control array and do some basic checks.
 228 */
 229static int prepare_ext_ctrls(struct v4l2_ctrl_handler *hdl,
 230			     struct v4l2_ext_controls *cs,
 231			     struct v4l2_ctrl_helper *helpers,
 232			     struct video_device *vdev,
 233			     bool get)
 234{
 235	struct v4l2_ctrl_helper *h;
 236	bool have_clusters = false;
 237	u32 i;
 238
 239	for (i = 0, h = helpers; i < cs->count; i++, h++) {
 240		struct v4l2_ext_control *c = &cs->controls[i];
 241		struct v4l2_ctrl_ref *ref;
 242		struct v4l2_ctrl *ctrl;
 243		u32 id = c->id & V4L2_CTRL_ID_MASK;
 244
 245		cs->error_idx = i;
 246
 247		if (cs->which &&
 248		    (cs->which < V4L2_CTRL_WHICH_DEF_VAL ||
 249		     cs->which > V4L2_CTRL_WHICH_MAX_VAL) &&
 250		    V4L2_CTRL_ID2WHICH(id) != cs->which) {
 251			dprintk(vdev,
 252				"invalid which 0x%x or control id 0x%x\n",
 253				cs->which, id);
 254			return -EINVAL;
 255		}
 256
 257		/*
 258		 * Old-style private controls are not allowed for
 259		 * extended controls.
 260		 */
 261		if (id >= V4L2_CID_PRIVATE_BASE) {
 262			dprintk(vdev,
 263				"old-style private controls not allowed\n");
 264			return -EINVAL;
 265		}
 266		ref = find_ref_lock(hdl, id);
 267		if (!ref) {
 268			dprintk(vdev, "cannot find control id 0x%x\n", id);
 269			return -EINVAL;
 270		}
 271		h->ref = ref;
 272		ctrl = ref->ctrl;
 273		if (ctrl->flags & V4L2_CTRL_FLAG_DISABLED) {
 274			dprintk(vdev, "control id 0x%x is disabled\n", id);
 275			return -EINVAL;
 276		}
 277
 278		if (!(ctrl->flags & V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX) &&
 279		    (cs->which == V4L2_CTRL_WHICH_MIN_VAL ||
 280		     cs->which == V4L2_CTRL_WHICH_MAX_VAL)) {
 281			dprintk(vdev,
 282				"invalid which 0x%x or control id 0x%x\n",
 283				cs->which, id);
 284			return -EINVAL;
 285		}
 286
 287		if (ctrl->cluster[0]->ncontrols > 1)
 288			have_clusters = true;
 289		if (ctrl->cluster[0] != ctrl)
 290			ref = find_ref_lock(hdl, ctrl->cluster[0]->id);
 291		if (ctrl->is_dyn_array) {
 292			unsigned int max_size = ctrl->dims[0] * ctrl->elem_size;
 293			unsigned int tot_size = ctrl->elem_size;
 294
 295			if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
 296				tot_size *= ref->p_req_elems;
 297			else
 298				tot_size *= ctrl->elems;
 299
 300			c->size = ctrl->elem_size * (c->size / ctrl->elem_size);
 301			if (get) {
 302				if (c->size < tot_size) {
 303					c->size = tot_size;
 304					return -ENOSPC;
 305				}
 306				c->size = tot_size;
 307			} else {
 308				if (c->size > max_size) {
 309					c->size = max_size;
 310					return -ENOSPC;
 311				}
 312				if (!c->size)
 313					return -EFAULT;
 314			}
 315		} else if (ctrl->is_ptr && !ctrl->is_string) {
 316			unsigned int tot_size = ctrl->elems * ctrl->elem_size;
 317
 318			if (c->size < tot_size) {
 319				/*
 320				 * In the get case the application first
 321				 * queries to obtain the size of the control.
 322				 */
 323				if (get) {
 324					c->size = tot_size;
 325					return -ENOSPC;
 326				}
 327				dprintk(vdev,
 328					"pointer control id 0x%x size too small, %d bytes but %d bytes needed\n",
 329					id, c->size, tot_size);
 330				return -EFAULT;
 331			}
 332			c->size = tot_size;
 333		}
 334		/* Store the ref to the master control of the cluster */
 335		h->mref = ref;
 336		/*
 337		 * Initially set next to 0, meaning that there is no other
 338		 * control in this helper array belonging to the same
 339		 * cluster.
 340		 */
 341		h->next = 0;
 342	}
 343
 344	/*
 345	 * We are done if there were no controls that belong to a multi-
 346	 * control cluster.
 347	 */
 348	if (!have_clusters)
 349		return 0;
 350
 351	/*
 352	 * The code below figures out in O(n) time which controls in the list
 353	 * belong to the same cluster.
 354	 */
 355
 356	/* This has to be done with the handler lock taken. */
 357	mutex_lock(hdl->lock);
 358
 359	/* First zero the helper field in the master control references */
 360	for (i = 0; i < cs->count; i++)
 361		helpers[i].mref->helper = NULL;
 362	for (i = 0, h = helpers; i < cs->count; i++, h++) {
 363		struct v4l2_ctrl_ref *mref = h->mref;
 364
 365		/*
 366		 * If the mref->helper is set, then it points to an earlier
 367		 * helper that belongs to the same cluster.
 368		 */
 369		if (mref->helper) {
 370			/*
 371			 * Set the next field of mref->helper to the current
 372			 * index: this means that the earlier helper now
 373			 * points to the next helper in the same cluster.
 374			 */
 375			mref->helper->next = i;
 376			/*
 377			 * mref should be set only for the first helper in the
 378			 * cluster, clear the others.
 379			 */
 380			h->mref = NULL;
 381		}
 382		/* Point the mref helper to the current helper struct. */
 383		mref->helper = h;
 384	}
 385	mutex_unlock(hdl->lock);
 386	return 0;
 387}
 388
 389/*
 390 * Handles the corner case where cs->count == 0. It checks whether the
 391 * specified control class exists. If that class ID is 0, then it checks
 392 * whether there are any controls at all.
 393 */
 394static int class_check(struct v4l2_ctrl_handler *hdl, u32 which)
 395{
 396	if (which == 0 || (which >= V4L2_CTRL_WHICH_DEF_VAL &&
 397			   which <= V4L2_CTRL_WHICH_MAX_VAL))
 398		return 0;
 399	return find_ref_lock(hdl, which | 1) ? 0 : -EINVAL;
 400}
 401
 402/*
 403 * Get extended controls. Allocates the helpers array if needed.
 404 *
 405 * Note that v4l2_g_ext_ctrls_common() with 'which' set to
 406 * V4L2_CTRL_WHICH_REQUEST_VAL is only called if the request was
 407 * completed, and in that case p_req_valid is true for all controls.
 408 */
 409int v4l2_g_ext_ctrls_common(struct v4l2_ctrl_handler *hdl,
 410			    struct v4l2_ext_controls *cs,
 411			    struct video_device *vdev)
 412{
 413	struct v4l2_ctrl_helper helper[4];
 414	struct v4l2_ctrl_helper *helpers = helper;
 415	int ret;
 416	int i, j;
 417	bool is_default, is_request, is_min, is_max;
 418
 419	is_default = (cs->which == V4L2_CTRL_WHICH_DEF_VAL);
 420	is_request = (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL);
 421	is_min = (cs->which == V4L2_CTRL_WHICH_MIN_VAL);
 422	is_max = (cs->which == V4L2_CTRL_WHICH_MAX_VAL);
 423
 424	cs->error_idx = cs->count;
 425	cs->which = V4L2_CTRL_ID2WHICH(cs->which);
 426
 427	if (!hdl)
 428		return -EINVAL;
 429
 430	if (cs->count == 0)
 431		return class_check(hdl, cs->which);
 432
 433	if (cs->count > ARRAY_SIZE(helper)) {
 434		helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
 435					 GFP_KERNEL);
 436		if (!helpers)
 437			return -ENOMEM;
 438	}
 439
 440	ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, true);
 441	cs->error_idx = cs->count;
 442
 443	for (i = 0; !ret && i < cs->count; i++)
 444		if (helpers[i].ref->ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
 445			ret = -EACCES;
 446
 447	for (i = 0; !ret && i < cs->count; i++) {
 448		struct v4l2_ctrl *master;
 449		bool is_volatile = false;
 450		u32 idx = i;
 451
 452		if (!helpers[i].mref)
 453			continue;
 454
 455		master = helpers[i].mref->ctrl;
 456		cs->error_idx = i;
 457
 458		v4l2_ctrl_lock(master);
 459
 460		/*
 461		 * g_volatile_ctrl will update the new control values.
 462		 * This makes no sense for V4L2_CTRL_WHICH_DEF_VAL,
 463		 * V4L2_CTRL_WHICH_MIN_VAL, V4L2_CTRL_WHICH_MAX_VAL and
 464		 * V4L2_CTRL_WHICH_REQUEST_VAL. In the case of requests
 465		 * it is v4l2_ctrl_request_complete() that copies the
 466		 * volatile controls at the time of request completion
 467		 * to the request, so you don't want to do that again.
 468		 */
 469		if (!is_default && !is_request && !is_min && !is_max &&
 470		    ((master->flags & V4L2_CTRL_FLAG_VOLATILE) ||
 471		    (master->has_volatiles && !is_cur_manual(master)))) {
 472			for (j = 0; j < master->ncontrols; j++)
 473				cur_to_new(master->cluster[j]);
 474			ret = call_op(master, g_volatile_ctrl);
 475			is_volatile = true;
 476		}
 477
 478		if (ret) {
 479			v4l2_ctrl_unlock(master);
 480			break;
 481		}
 482
 483		/*
 484		 * Copy the default value (if is_default is true), the
 485		 * request value (if is_request is true and p_req is valid),
 486		 * the new volatile value (if is_volatile is true) or the
 487		 * current value.
 488		 */
 489		do {
 490			struct v4l2_ctrl_ref *ref = helpers[idx].ref;
 491
 492			if (is_default)
 493				ret = def_to_user(cs->controls + idx, ref->ctrl);
 494			else if (is_request && ref->p_req_array_enomem)
 495				ret = -ENOMEM;
 496			else if (is_request && ref->p_req_valid)
 497				ret = req_to_user(cs->controls + idx, ref);
 498			else if (is_min)
 499				ret = min_to_user(cs->controls + idx, ref->ctrl);
 500			else if (is_max)
 501				ret = max_to_user(cs->controls + idx, ref->ctrl);
 502			else if (is_volatile)
 503				ret = new_to_user(cs->controls + idx, ref->ctrl);
 504			else
 505				ret = cur_to_user(cs->controls + idx, ref->ctrl);
 506			idx = helpers[idx].next;
 507		} while (!ret && idx);
 508
 509		v4l2_ctrl_unlock(master);
 510	}
 511
 512	if (cs->count > ARRAY_SIZE(helper))
 513		kvfree(helpers);
 514	return ret;
 515}
 516
 517int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct video_device *vdev,
 518		     struct media_device *mdev, struct v4l2_ext_controls *cs)
 519{
 520	if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
 521		return v4l2_g_ext_ctrls_request(hdl, vdev, mdev, cs);
 522
 523	return v4l2_g_ext_ctrls_common(hdl, cs, vdev);
 524}
 525EXPORT_SYMBOL(v4l2_g_ext_ctrls);
 526
 527/* Validate a new control */
 528static int validate_new(const struct v4l2_ctrl *ctrl, union v4l2_ctrl_ptr p_new)
 529{
 530	return ctrl->type_ops->validate(ctrl, p_new);
 531}
 532
 533/* Validate controls. */
 534static int validate_ctrls(struct v4l2_ext_controls *cs,
 535			  struct v4l2_ctrl_helper *helpers,
 536			  struct video_device *vdev,
 537			  bool set)
 538{
 539	unsigned int i;
 540	int ret = 0;
 541
 542	cs->error_idx = cs->count;
 543	for (i = 0; i < cs->count; i++) {
 544		struct v4l2_ctrl *ctrl = helpers[i].ref->ctrl;
 545		union v4l2_ctrl_ptr p_new;
 546
 547		cs->error_idx = i;
 548
 549		if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY) {
 550			dprintk(vdev,
 551				"control id 0x%x is read-only\n",
 552				ctrl->id);
 553			return -EACCES;
 554		}
 555		/*
 556		 * This test is also done in try_set_control_cluster() which
 557		 * is called in atomic context, so that has the final say,
 558		 * but it makes sense to do an up-front check as well. Once
 559		 * an error occurs in try_set_control_cluster() some other
 560		 * controls may have been set already and we want to do a
 561		 * best-effort to avoid that.
 562		 */
 563		if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)) {
 564			dprintk(vdev,
 565				"control id 0x%x is grabbed, cannot set\n",
 566				ctrl->id);
 567			return -EBUSY;
 568		}
 569		/*
 570		 * Skip validation for now if the payload needs to be copied
 571		 * from userspace into kernelspace. We'll validate those later.
 572		 */
 573		if (ctrl->is_ptr)
 574			continue;
 575		if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
 576			p_new.p_s64 = &cs->controls[i].value64;
 577		else
 578			p_new.p_s32 = &cs->controls[i].value;
 579		ret = validate_new(ctrl, p_new);
 580		if (ret)
 581			return ret;
 582	}
 583	return 0;
 584}
 585
 586/* Try or try-and-set controls */
 587int try_set_ext_ctrls_common(struct v4l2_fh *fh,
 588			     struct v4l2_ctrl_handler *hdl,
 589			     struct v4l2_ext_controls *cs,
 590			     struct video_device *vdev, bool set)
 591{
 592	struct v4l2_ctrl_helper helper[4];
 593	struct v4l2_ctrl_helper *helpers = helper;
 594	unsigned int i, j;
 595	int ret;
 596
 597	cs->error_idx = cs->count;
 598
 599	/* Default/minimum/maximum values cannot be changed */
 600	if (cs->which == V4L2_CTRL_WHICH_DEF_VAL ||
 601	    cs->which == V4L2_CTRL_WHICH_MIN_VAL ||
 602	    cs->which == V4L2_CTRL_WHICH_MAX_VAL) {
 603		dprintk(vdev, "%s: cannot change default/min/max value\n",
 604			video_device_node_name(vdev));
 605		return -EINVAL;
 606	}
 607
 608	cs->which = V4L2_CTRL_ID2WHICH(cs->which);
 609
 610	if (!hdl) {
 611		dprintk(vdev, "%s: invalid null control handler\n",
 612			video_device_node_name(vdev));
 613		return -EINVAL;
 614	}
 615
 616	if (cs->count == 0)
 617		return class_check(hdl, cs->which);
 618
 619	if (cs->count > ARRAY_SIZE(helper)) {
 620		helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
 621					 GFP_KERNEL);
 622		if (!helpers)
 623			return -ENOMEM;
 624	}
 625	ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, false);
 626	if (!ret)
 627		ret = validate_ctrls(cs, helpers, vdev, set);
 628	if (ret && set)
 629		cs->error_idx = cs->count;
 630	for (i = 0; !ret && i < cs->count; i++) {
 631		struct v4l2_ctrl *master;
 632		u32 idx = i;
 633
 634		if (!helpers[i].mref)
 635			continue;
 636
 637		cs->error_idx = i;
 638		master = helpers[i].mref->ctrl;
 639		v4l2_ctrl_lock(master);
 640
 641		/* Reset the 'is_new' flags of the cluster */
 642		for (j = 0; j < master->ncontrols; j++)
 643			if (master->cluster[j])
 644				master->cluster[j]->is_new = 0;
 645
 646		/*
 647		 * For volatile autoclusters that are currently in auto mode
 648		 * we need to discover if it will be set to manual mode.
 649		 * If so, then we have to copy the current volatile values
 650		 * first since those will become the new manual values (which
 651		 * may be overwritten by explicit new values from this set
 652		 * of controls).
 653		 */
 654		if (master->is_auto && master->has_volatiles &&
 655		    !is_cur_manual(master)) {
 656			/* Pick an initial non-manual value */
 657			s32 new_auto_val = master->manual_mode_value + 1;
 658			u32 tmp_idx = idx;
 659
 660			do {
 661				/*
 662				 * Check if the auto control is part of the
 663				 * list, and remember the new value.
 664				 */
 665				if (helpers[tmp_idx].ref->ctrl == master)
 666					new_auto_val = cs->controls[tmp_idx].value;
 667				tmp_idx = helpers[tmp_idx].next;
 668			} while (tmp_idx);
 669			/*
 670			 * If the new value == the manual value, then copy
 671			 * the current volatile values.
 672			 */
 673			if (new_auto_val == master->manual_mode_value)
 674				update_from_auto_cluster(master);
 675		}
 676
 677		/*
 678		 * Copy the new caller-supplied control values.
 679		 * user_to_new() sets 'is_new' to 1.
 680		 */
 681		do {
 682			struct v4l2_ctrl *ctrl = helpers[idx].ref->ctrl;
 683
 684			ret = user_to_new(cs->controls + idx, ctrl);
 685			if (!ret && ctrl->is_ptr) {
 686				ret = validate_new(ctrl, ctrl->p_new);
 687				if (ret)
 688					dprintk(vdev,
 689						"failed to validate control %s (%d)\n",
 690						v4l2_ctrl_get_name(ctrl->id), ret);
 691			}
 692			idx = helpers[idx].next;
 693		} while (!ret && idx);
 694
 695		if (!ret)
 696			ret = try_or_set_cluster(fh, master,
 697						 !hdl->req_obj.req && set, 0);
 698		if (!ret && hdl->req_obj.req && set) {
 699			for (j = 0; j < master->ncontrols; j++) {
 700				struct v4l2_ctrl_ref *ref =
 701					find_ref(hdl, master->cluster[j]->id);
 702
 703				new_to_req(ref);
 704			}
 705		}
 706
 707		/* Copy the new values back to userspace. */
 708		if (!ret) {
 709			idx = i;
 710			do {
 711				ret = new_to_user(cs->controls + idx,
 712						  helpers[idx].ref->ctrl);
 713				idx = helpers[idx].next;
 714			} while (!ret && idx);
 715		}
 716		v4l2_ctrl_unlock(master);
 717	}
 718
 719	if (cs->count > ARRAY_SIZE(helper))
 720		kvfree(helpers);
 721	return ret;
 722}
 723
 724static int try_set_ext_ctrls(struct v4l2_fh *fh,
 725			     struct v4l2_ctrl_handler *hdl,
 726			     struct video_device *vdev,
 727			     struct media_device *mdev,
 728			     struct v4l2_ext_controls *cs, bool set)
 729{
 730	int ret;
 731
 732	if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
 733		return try_set_ext_ctrls_request(fh, hdl, vdev, mdev, cs, set);
 734
 735	ret = try_set_ext_ctrls_common(fh, hdl, cs, vdev, set);
 736	if (ret)
 737		dprintk(vdev,
 738			"%s: try_set_ext_ctrls_common failed (%d)\n",
 739			video_device_node_name(vdev), ret);
 740
 741	return ret;
 742}
 743
 744int v4l2_try_ext_ctrls(struct v4l2_ctrl_handler *hdl,
 745		       struct video_device *vdev,
 746		       struct media_device *mdev,
 747		       struct v4l2_ext_controls *cs)
 748{
 749	return try_set_ext_ctrls(NULL, hdl, vdev, mdev, cs, false);
 750}
 751EXPORT_SYMBOL(v4l2_try_ext_ctrls);
 752
 753int v4l2_s_ext_ctrls(struct v4l2_fh *fh,
 754		     struct v4l2_ctrl_handler *hdl,
 755		     struct video_device *vdev,
 756		     struct media_device *mdev,
 757		     struct v4l2_ext_controls *cs)
 758{
 759	return try_set_ext_ctrls(fh, hdl, vdev, mdev, cs, true);
 760}
 761EXPORT_SYMBOL(v4l2_s_ext_ctrls);
 762
 763/*
 764 * VIDIOC_G/S_CTRL implementation
 765 */
 766
 767/* Helper function to get a single control */
 768static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c)
 769{
 770	struct v4l2_ctrl *master = ctrl->cluster[0];
 771	int ret = 0;
 772	int i;
 773
 774	/* Compound controls are not supported. The new_to_user() and
 775	 * cur_to_user() calls below would need to be modified not to access
 776	 * userspace memory when called from get_ctrl().
 777	 */
 778	if (!ctrl->is_int && ctrl->type != V4L2_CTRL_TYPE_INTEGER64)
 779		return -EINVAL;
 780
 781	if (ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
 782		return -EACCES;
 783
 784	v4l2_ctrl_lock(master);
 785	/* g_volatile_ctrl will update the current control values */
 786	if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
 787		for (i = 0; i < master->ncontrols; i++)
 788			cur_to_new(master->cluster[i]);
 789		ret = call_op(master, g_volatile_ctrl);
 790		if (!ret)
 791			ret = new_to_user(c, ctrl);
 792	} else {
 793		ret = cur_to_user(c, ctrl);
 794	}
 795	v4l2_ctrl_unlock(master);
 796	return ret;
 797}
 798
 799int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_control *control)
 800{
 801	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
 802	struct v4l2_ext_control c;
 803	int ret;
 804
 805	if (!ctrl || !ctrl->is_int)
 806		return -EINVAL;
 807	ret = get_ctrl(ctrl, &c);
 808
 809	if (!ret)
 810		control->value = c.value;
 811
 812	return ret;
 813}
 814EXPORT_SYMBOL(v4l2_g_ctrl);
 815
 816/* Helper function for VIDIOC_S_CTRL compatibility */
 817static int set_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
 818{
 819	struct v4l2_ctrl *master = ctrl->cluster[0];
 820	int ret;
 821	int i;
 822
 823	/* Reset the 'is_new' flags of the cluster */
 824	for (i = 0; i < master->ncontrols; i++)
 825		if (master->cluster[i])
 826			master->cluster[i]->is_new = 0;
 827
 828	ret = validate_new(ctrl, ctrl->p_new);
 829	if (ret)
 830		return ret;
 831
 832	/*
 833	 * For autoclusters with volatiles that are switched from auto to
 834	 * manual mode we have to update the current volatile values since
 835	 * those will become the initial manual values after such a switch.
 836	 */
 837	if (master->is_auto && master->has_volatiles && ctrl == master &&
 838	    !is_cur_manual(master) && ctrl->val == master->manual_mode_value)
 839		update_from_auto_cluster(master);
 840
 841	ctrl->is_new = 1;
 842	return try_or_set_cluster(fh, master, true, ch_flags);
 843}
 844
 845/* Helper function for VIDIOC_S_CTRL compatibility */
 846static int set_ctrl_lock(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl,
 847			 struct v4l2_ext_control *c)
 848{
 849	int ret;
 850
 851	v4l2_ctrl_lock(ctrl);
 852	ret = user_to_new(c, ctrl);
 853	if (!ret)
 854		ret = set_ctrl(fh, ctrl, 0);
 855	if (!ret)
 856		ret = cur_to_user(c, ctrl);
 857	v4l2_ctrl_unlock(ctrl);
 858	return ret;
 859}
 860
 861int v4l2_s_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl_handler *hdl,
 862		struct v4l2_control *control)
 863{
 864	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
 865	struct v4l2_ext_control c = { control->id };
 866	int ret;
 867
 868	if (!ctrl || !ctrl->is_int)
 869		return -EINVAL;
 870
 871	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
 872		return -EACCES;
 873
 874	c.value = control->value;
 875	ret = set_ctrl_lock(fh, ctrl, &c);
 876	control->value = c.value;
 877	return ret;
 878}
 879EXPORT_SYMBOL(v4l2_s_ctrl);
 880
 881/*
 882 * Helper functions for drivers to get/set controls.
 883 */
 884
 885s32 v4l2_ctrl_g_ctrl(struct v4l2_ctrl *ctrl)
 886{
 887	struct v4l2_ext_control c;
 888
 889	/* It's a driver bug if this happens. */
 890	if (WARN_ON(!ctrl->is_int))
 891		return 0;
 892	c.value = 0;
 893	get_ctrl(ctrl, &c);
 894	return c.value;
 895}
 896EXPORT_SYMBOL(v4l2_ctrl_g_ctrl);
 897
 898s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl)
 899{
 900	struct v4l2_ext_control c;
 901
 902	/* It's a driver bug if this happens. */
 903	if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
 904		return 0;
 905	c.value64 = 0;
 906	get_ctrl(ctrl, &c);
 907	return c.value64;
 908}
 909EXPORT_SYMBOL(v4l2_ctrl_g_ctrl_int64);
 910
 911int __v4l2_ctrl_s_ctrl(struct v4l2_ctrl *ctrl, s32 val)
 912{
 913	lockdep_assert_held(ctrl->handler->lock);
 914
 915	/* It's a driver bug if this happens. */
 916	if (WARN_ON(!ctrl->is_int))
 917		return -EINVAL;
 918	ctrl->val = val;
 919	return set_ctrl(NULL, ctrl, 0);
 920}
 921EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl);
 922
 923int __v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl *ctrl, s64 val)
 924{
 925	lockdep_assert_held(ctrl->handler->lock);
 926
 927	/* It's a driver bug if this happens. */
 928	if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
 929		return -EINVAL;
 930	*ctrl->p_new.p_s64 = val;
 931	return set_ctrl(NULL, ctrl, 0);
 932}
 933EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_int64);
 934
 935int __v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl *ctrl, const char *s)
 936{
 937	lockdep_assert_held(ctrl->handler->lock);
 938
 939	/* It's a driver bug if this happens. */
 940	if (WARN_ON(ctrl->type != V4L2_CTRL_TYPE_STRING))
 941		return -EINVAL;
 942	strscpy(ctrl->p_new.p_char, s, ctrl->maximum + 1);
 943	return set_ctrl(NULL, ctrl, 0);
 944}
 945EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_string);
 946
 947int __v4l2_ctrl_s_ctrl_compound(struct v4l2_ctrl *ctrl,
 948				enum v4l2_ctrl_type type, const void *p)
 949{
 950	lockdep_assert_held(ctrl->handler->lock);
 951
 952	/* It's a driver bug if this happens. */
 953	if (WARN_ON(ctrl->type != type))
 954		return -EINVAL;
 955	/* Setting dynamic arrays is not (yet?) supported. */
 956	if (WARN_ON(ctrl->is_dyn_array))
 957		return -EINVAL;
 958	memcpy(ctrl->p_new.p, p, ctrl->elems * ctrl->elem_size);
 959	return set_ctrl(NULL, ctrl, 0);
 960}
 961EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_compound);
 962
 963/*
 964 * Modify the range of a control.
 965 */
 966int __v4l2_ctrl_modify_range(struct v4l2_ctrl *ctrl,
 967			     s64 min, s64 max, u64 step, s64 def)
 968{
 969	bool value_changed;
 970	bool range_changed = false;
 971	int ret;
 972
 973	lockdep_assert_held(ctrl->handler->lock);
 974
 975	switch (ctrl->type) {
 976	case V4L2_CTRL_TYPE_INTEGER:
 977	case V4L2_CTRL_TYPE_INTEGER64:
 978	case V4L2_CTRL_TYPE_BOOLEAN:
 979	case V4L2_CTRL_TYPE_MENU:
 980	case V4L2_CTRL_TYPE_INTEGER_MENU:
 981	case V4L2_CTRL_TYPE_BITMASK:
 982	case V4L2_CTRL_TYPE_U8:
 983	case V4L2_CTRL_TYPE_U16:
 984	case V4L2_CTRL_TYPE_U32:
 985		if (ctrl->is_array)
 986			return -EINVAL;
 987		ret = check_range(ctrl->type, min, max, step, def);
 988		if (ret)
 989			return ret;
 990		break;
 991	default:
 992		return -EINVAL;
 993	}
 994	if (ctrl->minimum != min || ctrl->maximum != max ||
 995	    ctrl->step != step || ctrl->default_value != def) {
 996		range_changed = true;
 997		ctrl->minimum = min;
 998		ctrl->maximum = max;
 999		ctrl->step = step;
1000		ctrl->default_value = def;
1001	}
1002	cur_to_new(ctrl);
1003	if (validate_new(ctrl, ctrl->p_new)) {
1004		if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
1005			*ctrl->p_new.p_s64 = def;
1006		else
1007			*ctrl->p_new.p_s32 = def;
1008	}
1009
1010	if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
1011		value_changed = *ctrl->p_new.p_s64 != *ctrl->p_cur.p_s64;
1012	else
1013		value_changed = *ctrl->p_new.p_s32 != *ctrl->p_cur.p_s32;
1014	if (value_changed)
1015		ret = set_ctrl(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
1016	else if (range_changed)
1017		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
1018	return ret;
1019}
1020EXPORT_SYMBOL(__v4l2_ctrl_modify_range);
1021
1022int __v4l2_ctrl_modify_dimensions(struct v4l2_ctrl *ctrl,
1023				  u32 dims[V4L2_CTRL_MAX_DIMS])
1024{
1025	unsigned int elems = 1;
1026	unsigned int i;
1027	void *p_array;
1028
1029	lockdep_assert_held(ctrl->handler->lock);
1030
1031	if (!ctrl->is_array || ctrl->is_dyn_array)
1032		return -EINVAL;
1033
1034	for (i = 0; i < ctrl->nr_of_dims; i++)
1035		elems *= dims[i];
1036	if (elems == 0)
1037		return -EINVAL;
1038	p_array = kvzalloc(2 * elems * ctrl->elem_size, GFP_KERNEL);
1039	if (!p_array)
1040		return -ENOMEM;
1041	kvfree(ctrl->p_array);
1042	ctrl->p_array_alloc_elems = elems;
1043	ctrl->elems = elems;
1044	ctrl->new_elems = elems;
1045	ctrl->p_array = p_array;
1046	ctrl->p_new.p = p_array;
1047	ctrl->p_cur.p = p_array + elems * ctrl->elem_size;
1048	for (i = 0; i < ctrl->nr_of_dims; i++)
1049		ctrl->dims[i] = dims[i];
1050	ctrl->type_ops->init(ctrl, 0, ctrl->p_cur);
1051	cur_to_new(ctrl);
1052	send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_VALUE |
1053			       V4L2_EVENT_CTRL_CH_DIMENSIONS);
1054	return 0;
1055}
1056EXPORT_SYMBOL(__v4l2_ctrl_modify_dimensions);
1057
1058/* Implement VIDIOC_QUERY_EXT_CTRL */
1059int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctrl *qc)
1060{
1061	const unsigned int next_flags = V4L2_CTRL_FLAG_NEXT_CTRL | V4L2_CTRL_FLAG_NEXT_COMPOUND;
1062	u32 id = qc->id & V4L2_CTRL_ID_MASK;
1063	struct v4l2_ctrl_ref *ref;
1064	struct v4l2_ctrl *ctrl;
1065
1066	if (!hdl)
1067		return -EINVAL;
1068
1069	mutex_lock(hdl->lock);
1070
1071	/* Try to find it */
1072	ref = find_ref(hdl, id);
1073
1074	if ((qc->id & next_flags) && !list_empty(&hdl->ctrl_refs)) {
1075		bool is_compound;
1076		/* Match any control that is not hidden */
1077		unsigned int mask = 1;
1078		bool match = false;
1079
1080		if ((qc->id & next_flags) == V4L2_CTRL_FLAG_NEXT_COMPOUND) {
1081			/* Match any hidden control */
1082			match = true;
1083		} else if ((qc->id & next_flags) == next_flags) {
1084			/* Match any control, compound or not */
1085			mask = 0;
1086		}
1087
1088		/* Find the next control with ID > qc->id */
1089
1090		/* Did we reach the end of the control list? */
1091		if (id >= node2id(hdl->ctrl_refs.prev)) {
1092			ref = NULL; /* Yes, so there is no next control */
1093		} else if (ref) {
1094			struct v4l2_ctrl_ref *pos = ref;
1095
1096			/*
1097			 * We found a control with the given ID, so just get
1098			 * the next valid one in the list.
1099			 */
1100			ref = NULL;
1101			list_for_each_entry_continue(pos, &hdl->ctrl_refs, node) {
1102				is_compound = pos->ctrl->is_array ||
1103					pos->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
1104				if (id < pos->ctrl->id &&
1105				    (is_compound & mask) == match) {
1106					ref = pos;
1107					break;
1108				}
1109			}
1110		} else {
1111			struct v4l2_ctrl_ref *pos;
1112
1113			/*
1114			 * No control with the given ID exists, so start
1115			 * searching for the next largest ID. We know there
1116			 * is one, otherwise the first 'if' above would have
1117			 * been true.
1118			 */
1119			list_for_each_entry(pos, &hdl->ctrl_refs, node) {
1120				is_compound = pos->ctrl->is_array ||
1121					pos->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
1122				if (id < pos->ctrl->id &&
1123				    (is_compound & mask) == match) {
1124					ref = pos;
1125					break;
1126				}
1127			}
1128		}
1129	}
1130	mutex_unlock(hdl->lock);
1131
1132	if (!ref)
1133		return -EINVAL;
1134
1135	ctrl = ref->ctrl;
1136	memset(qc, 0, sizeof(*qc));
1137	if (id >= V4L2_CID_PRIVATE_BASE)
1138		qc->id = id;
1139	else
1140		qc->id = ctrl->id;
1141	strscpy(qc->name, ctrl->name, sizeof(qc->name));
1142	qc->flags = user_flags(ctrl);
1143	qc->type = ctrl->type;
1144	qc->elem_size = ctrl->elem_size;
1145	qc->elems = ctrl->elems;
1146	qc->nr_of_dims = ctrl->nr_of_dims;
1147	memcpy(qc->dims, ctrl->dims, qc->nr_of_dims * sizeof(qc->dims[0]));
1148	qc->minimum = ctrl->minimum;
1149	qc->maximum = ctrl->maximum;
1150	qc->default_value = ctrl->default_value;
1151	if (ctrl->type == V4L2_CTRL_TYPE_MENU ||
1152	    ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
1153		qc->step = 1;
1154	else
1155		qc->step = ctrl->step;
1156	return 0;
1157}
1158EXPORT_SYMBOL(v4l2_query_ext_ctrl);
1159
1160void v4l2_query_ext_ctrl_to_v4l2_queryctrl(struct v4l2_queryctrl *to,
1161					   const struct v4l2_query_ext_ctrl *from)
1162{
1163	to->id = from->id;
1164	to->type = from->type;
1165	to->flags = from->flags;
1166	strscpy(to->name, from->name, sizeof(to->name));
1167
1168	switch (from->type) {
1169	case V4L2_CTRL_TYPE_INTEGER:
1170	case V4L2_CTRL_TYPE_BOOLEAN:
1171	case V4L2_CTRL_TYPE_MENU:
1172	case V4L2_CTRL_TYPE_INTEGER_MENU:
1173	case V4L2_CTRL_TYPE_STRING:
1174	case V4L2_CTRL_TYPE_BITMASK:
1175		to->minimum = from->minimum;
1176		to->maximum = from->maximum;
1177		to->step = from->step;
1178		to->default_value = from->default_value;
1179		break;
1180	default:
1181		to->minimum = 0;
1182		to->maximum = 0;
1183		to->step = 0;
1184		to->default_value = 0;
1185		break;
1186	}
1187}
1188EXPORT_SYMBOL(v4l2_query_ext_ctrl_to_v4l2_queryctrl);
1189
1190/* Implement VIDIOC_QUERYCTRL */
1191int v4l2_queryctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_queryctrl *qc)
1192{
1193	struct v4l2_query_ext_ctrl qec = { qc->id };
1194	int rc;
1195
1196	rc = v4l2_query_ext_ctrl(hdl, &qec);
1197	if (rc)
1198		return rc;
1199
1200	v4l2_query_ext_ctrl_to_v4l2_queryctrl(qc, &qec);
1201
1202	return 0;
1203}
1204EXPORT_SYMBOL(v4l2_queryctrl);
1205
1206/* Implement VIDIOC_QUERYMENU */
1207int v4l2_querymenu(struct v4l2_ctrl_handler *hdl, struct v4l2_querymenu *qm)
1208{
1209	struct v4l2_ctrl *ctrl;
1210	u32 i = qm->index;
1211
1212	ctrl = v4l2_ctrl_find(hdl, qm->id);
1213	if (!ctrl)
1214		return -EINVAL;
1215
1216	qm->reserved = 0;
1217	/* Sanity checks */
1218	switch (ctrl->type) {
1219	case V4L2_CTRL_TYPE_MENU:
1220		if (!ctrl->qmenu)
1221			return -EINVAL;
1222		break;
1223	case V4L2_CTRL_TYPE_INTEGER_MENU:
1224		if (!ctrl->qmenu_int)
1225			return -EINVAL;
1226		break;
1227	default:
1228		return -EINVAL;
1229	}
1230
1231	if (i < ctrl->minimum || i > ctrl->maximum)
1232		return -EINVAL;
1233
1234	/* Use mask to see if this menu item should be skipped */
1235	if (i < BITS_PER_LONG_LONG && (ctrl->menu_skip_mask & BIT_ULL(i)))
1236		return -EINVAL;
1237	/* Empty menu items should also be skipped */
1238	if (ctrl->type == V4L2_CTRL_TYPE_MENU) {
1239		if (!ctrl->qmenu[i] || ctrl->qmenu[i][0] == '\0')
1240			return -EINVAL;
1241		strscpy(qm->name, ctrl->qmenu[i], sizeof(qm->name));
1242	} else {
1243		qm->value = ctrl->qmenu_int[i];
1244	}
1245	return 0;
1246}
1247EXPORT_SYMBOL(v4l2_querymenu);
1248
1249/*
1250 * VIDIOC_LOG_STATUS helpers
1251 */
1252
1253int v4l2_ctrl_log_status(struct file *file, void *priv)
1254{
1255	struct video_device *vfd = video_devdata(file);
1256
1257	if (vfd->v4l2_dev) {
1258		struct v4l2_fh *vfh = file_to_v4l2_fh(file);
1259
1260		v4l2_ctrl_handler_log_status(vfh->ctrl_handler,
1261					     vfd->v4l2_dev->name);
1262	}
1263
1264	return 0;
1265}
1266EXPORT_SYMBOL(v4l2_ctrl_log_status);
1267
1268int v4l2_ctrl_subdev_log_status(struct v4l2_subdev *sd)
1269{
1270	v4l2_ctrl_handler_log_status(sd->ctrl_handler, sd->name);
1271	return 0;
1272}
1273EXPORT_SYMBOL(v4l2_ctrl_subdev_log_status);
1274
1275/*
1276 * VIDIOC_(UN)SUBSCRIBE_EVENT implementation
1277 */
1278
1279static int v4l2_ctrl_add_event(struct v4l2_subscribed_event *sev,
1280			       unsigned int elems)
1281{
1282	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1283
1284	if (!ctrl)
1285		return -EINVAL;
1286
1287	v4l2_ctrl_lock(ctrl);
1288	list_add_tail(&sev->node, &ctrl->ev_subs);
1289	if (ctrl->type != V4L2_CTRL_TYPE_CTRL_CLASS &&
1290	    (sev->flags & V4L2_EVENT_SUB_FL_SEND_INITIAL))
1291		send_initial_event(sev->fh, ctrl);
1292	v4l2_ctrl_unlock(ctrl);
1293	return 0;
1294}
1295
1296static void v4l2_ctrl_del_event(struct v4l2_subscribed_event *sev)
1297{
1298	struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1299
1300	if (!ctrl)
1301		return;
1302
1303	v4l2_ctrl_lock(ctrl);
1304	list_del(&sev->node);
1305	v4l2_ctrl_unlock(ctrl);
1306}
1307
1308void v4l2_ctrl_replace(struct v4l2_event *old, const struct v4l2_event *new)
1309{
1310	u32 old_changes = old->u.ctrl.changes;
1311
1312	old->u.ctrl = new->u.ctrl;
1313	old->u.ctrl.changes |= old_changes;
1314}
1315EXPORT_SYMBOL(v4l2_ctrl_replace);
1316
1317void v4l2_ctrl_merge(const struct v4l2_event *old, struct v4l2_event *new)
1318{
1319	new->u.ctrl.changes |= old->u.ctrl.changes;
1320}
1321EXPORT_SYMBOL(v4l2_ctrl_merge);
1322
1323const struct v4l2_subscribed_event_ops v4l2_ctrl_sub_ev_ops = {
1324	.add = v4l2_ctrl_add_event,
1325	.del = v4l2_ctrl_del_event,
1326	.replace = v4l2_ctrl_replace,
1327	.merge = v4l2_ctrl_merge,
1328};
1329EXPORT_SYMBOL(v4l2_ctrl_sub_ev_ops);
1330
1331int v4l2_ctrl_subscribe_event(struct v4l2_fh *fh,
1332			      const struct v4l2_event_subscription *sub)
1333{
1334	if (sub->type == V4L2_EVENT_CTRL)
1335		return v4l2_event_subscribe(fh, sub, 0, &v4l2_ctrl_sub_ev_ops);
1336	return -EINVAL;
1337}
1338EXPORT_SYMBOL(v4l2_ctrl_subscribe_event);
1339
1340int v4l2_ctrl_subdev_subscribe_event(struct v4l2_subdev *sd, struct v4l2_fh *fh,
1341				     struct v4l2_event_subscription *sub)
1342{
1343	if (!sd->ctrl_handler)
1344		return -EINVAL;
1345	return v4l2_ctrl_subscribe_event(fh, sub);
1346}
1347EXPORT_SYMBOL(v4l2_ctrl_subdev_subscribe_event);
1348
1349/*
1350 * poll helper
1351 */
1352__poll_t v4l2_ctrl_poll(struct file *file, struct poll_table_struct *wait)
1353{
1354	struct v4l2_fh *fh = file_to_v4l2_fh(file);
1355
1356	poll_wait(file, &fh->wait, wait);
1357	if (v4l2_event_pending(fh))
1358		return EPOLLPRI;
1359	return 0;
1360}
1361EXPORT_SYMBOL(v4l2_ctrl_poll);