v4l2-ctrls-core.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * V4L2 controls framework core implementation.
   4 *
   5 * Copyright (C) 2010-2021  Hans Verkuil <hverkuil@kernel.org>
   6 */
   7
   8#include <linux/export.h>
   9#include <linux/mm.h>
  10#include <linux/slab.h>
  11#include <media/v4l2-ctrls.h>
  12#include <media/v4l2-event.h>
  13#include <media/v4l2-fwnode.h>
  14
  15#include "v4l2-ctrls-priv.h"
  16
  17static const union v4l2_ctrl_ptr ptr_null;
  18
  19static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl,
  20		       u32 changes)
  21{
  22	memset(ev, 0, sizeof(*ev));
  23	ev->type = V4L2_EVENT_CTRL;
  24	ev->id = ctrl->id;
  25	ev->u.ctrl.changes = changes;
  26	ev->u.ctrl.type = ctrl->type;
  27	ev->u.ctrl.flags = user_flags(ctrl);
  28	if (ctrl->is_ptr)
  29		ev->u.ctrl.value64 = 0;
  30	else
  31		ev->u.ctrl.value64 = *ctrl->p_cur.p_s64;
  32	ev->u.ctrl.minimum = ctrl->minimum;
  33	ev->u.ctrl.maximum = ctrl->maximum;
  34	if (ctrl->type == V4L2_CTRL_TYPE_MENU
  35	    || ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
  36		ev->u.ctrl.step = 1;
  37	else
  38		ev->u.ctrl.step = ctrl->step;
  39	ev->u.ctrl.default_value = ctrl->default_value;
  40}
  41
  42void send_initial_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl)
  43{
  44	struct v4l2_event ev;
  45	u32 changes = V4L2_EVENT_CTRL_CH_FLAGS;
  46
  47	if (!(ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY))
  48		changes |= V4L2_EVENT_CTRL_CH_VALUE;
  49	fill_event(&ev, ctrl, changes);
  50	v4l2_event_queue_fh(fh, &ev);
  51}
  52
  53void send_event(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 changes)
  54{
  55	struct v4l2_event ev;
  56	struct v4l2_subscribed_event *sev;
  57
  58	if (list_empty(&ctrl->ev_subs))
  59		return;
  60	fill_event(&ev, ctrl, changes);
  61
  62	list_for_each_entry(sev, &ctrl->ev_subs, node)
  63		if (sev->fh != fh ||
  64		    (sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK))
  65			v4l2_event_queue_fh(sev->fh, &ev);
  66}
  67
  68bool v4l2_ctrl_type_op_equal(const struct v4l2_ctrl *ctrl,
  69			     union v4l2_ctrl_ptr ptr1, union v4l2_ctrl_ptr ptr2)
  70{
  71	unsigned int i;
  72
  73	switch (ctrl->type) {
  74	case V4L2_CTRL_TYPE_BUTTON:
  75		return false;
  76	case V4L2_CTRL_TYPE_STRING:
  77		for (i = 0; i < ctrl->elems; i++) {
  78			unsigned int idx = i * ctrl->elem_size;
  79
  80			/* strings are always 0-terminated */
  81			if (strcmp(ptr1.p_char + idx, ptr2.p_char + idx))
  82				return false;
  83		}
  84		return true;
  85	default:
  86		return !memcmp(ptr1.p_const, ptr2.p_const,
  87			       ctrl->elems * ctrl->elem_size);
  88	}
  89}
  90EXPORT_SYMBOL(v4l2_ctrl_type_op_equal);
  91
  92/* Default intra MPEG-2 quantisation coefficients, from the specification. */
  93static const u8 mpeg2_intra_quant_matrix[64] = {
  94	8,  16, 16, 19, 16, 19, 22, 22,
  95	22, 22, 22, 22, 26, 24, 26, 27,
  96	27, 27, 26, 26, 26, 26, 27, 27,
  97	27, 29, 29, 29, 34, 34, 34, 29,
  98	29, 29, 27, 27, 29, 29, 32, 32,
  99	34, 34, 37, 38, 37, 35, 35, 34,
 100	35, 38, 38, 40, 40, 40, 48, 48,
 101	46, 46, 56, 56, 58, 69, 69, 83
 102};
 103
 104static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 105			      union v4l2_ctrl_ptr ptr)
 106{
 107	struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
 108	struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
 109	struct v4l2_ctrl_mpeg2_quantisation *p_mpeg2_quant;
 110	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
 111	struct v4l2_ctrl_vp9_frame *p_vp9_frame;
 112	struct v4l2_ctrl_fwht_params *p_fwht_params;
 113	struct v4l2_ctrl_h264_scaling_matrix *p_h264_scaling_matrix;
 114	struct v4l2_ctrl_av1_sequence *p_av1_sequence;
 115	void *p = ptr.p + idx * ctrl->elem_size;
 116
 117	if (ctrl->p_def.p_const)
 118		memcpy(p, ctrl->p_def.p_const, ctrl->elem_size);
 119	else
 120		memset(p, 0, ctrl->elem_size);
 121
 122	switch ((u32)ctrl->type) {
 123	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
 124		p_mpeg2_sequence = p;
 125
 126		/* 4:2:0 */
 127		p_mpeg2_sequence->chroma_format = 1;
 128		break;
 129	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
 130		p_mpeg2_picture = p;
 131
 132		/* interlaced top field */
 133		p_mpeg2_picture->picture_structure = V4L2_MPEG2_PIC_TOP_FIELD;
 134		p_mpeg2_picture->picture_coding_type =
 135					V4L2_MPEG2_PIC_CODING_TYPE_I;
 136		break;
 137	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
 138		p_mpeg2_quant = p;
 139
 140		memcpy(p_mpeg2_quant->intra_quantiser_matrix,
 141		       mpeg2_intra_quant_matrix,
 142		       ARRAY_SIZE(mpeg2_intra_quant_matrix));
 143		/*
 144		 * The default non-intra MPEG-2 quantisation
 145		 * coefficients are all 16, as per the specification.
 146		 */
 147		memset(p_mpeg2_quant->non_intra_quantiser_matrix, 16,
 148		       sizeof(p_mpeg2_quant->non_intra_quantiser_matrix));
 149		break;
 150	case V4L2_CTRL_TYPE_VP8_FRAME:
 151		p_vp8_frame = p;
 152		p_vp8_frame->num_dct_parts = 1;
 153		break;
 154	case V4L2_CTRL_TYPE_VP9_FRAME:
 155		p_vp9_frame = p;
 156		p_vp9_frame->profile = 0;
 157		p_vp9_frame->bit_depth = 8;
 158		p_vp9_frame->flags |= V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
 159			V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING;
 160		break;
 161	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
 162		p_av1_sequence = p;
 163		/*
 164		 * The initial profile is 0 which only allows YUV 420 subsampled
 165		 * data. Set the subsampling flags accordingly.
 166		 */
 167		p_av1_sequence->bit_depth = 8;
 168		p_av1_sequence->flags |= V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_X |
 169					 V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_Y;
 170		break;
 171	case V4L2_CTRL_TYPE_FWHT_PARAMS:
 172		p_fwht_params = p;
 173		p_fwht_params->version = V4L2_FWHT_VERSION;
 174		p_fwht_params->width = 1280;
 175		p_fwht_params->height = 720;
 176		p_fwht_params->flags = V4L2_FWHT_FL_PIXENC_YUV |
 177			(2 << V4L2_FWHT_FL_COMPONENTS_NUM_OFFSET);
 178		break;
 179	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
 180		p_h264_scaling_matrix = p;
 181		/*
 182		 * The default (flat) H.264 scaling matrix when none are
 183		 * specified in the bitstream, this is according to formulas
 184		 *  (7-8) and (7-9) of the specification.
 185		 */
 186		memset(p_h264_scaling_matrix, 16, sizeof(*p_h264_scaling_matrix));
 187		break;
 188	}
 189}
 190
 191static void std_min_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 192			     union v4l2_ctrl_ptr ptr)
 193{
 194	void *p = ptr.p + idx * ctrl->elem_size;
 195
 196	if (ctrl->p_min.p_const)
 197		memcpy(p, ctrl->p_min.p_const, ctrl->elem_size);
 198	else
 199		memset(p, 0, ctrl->elem_size);
 200}
 201
 202static void std_max_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 203			     union v4l2_ctrl_ptr ptr)
 204{
 205	void *p = ptr.p + idx * ctrl->elem_size;
 206
 207	if (ctrl->p_max.p_const)
 208		memcpy(p, ctrl->p_max.p_const, ctrl->elem_size);
 209	else
 210		memset(p, 0, ctrl->elem_size);
 211}
 212
 213static void __v4l2_ctrl_type_op_init(const struct v4l2_ctrl *ctrl, u32 from_idx,
 214				     u32 which, union v4l2_ctrl_ptr ptr)
 215{
 216	unsigned int i;
 217	u32 tot_elems = ctrl->elems;
 218	u32 elems = tot_elems - from_idx;
 219	s64 value;
 220
 221	switch (which) {
 222	case V4L2_CTRL_WHICH_DEF_VAL:
 223		value = ctrl->default_value;
 224		break;
 225	case V4L2_CTRL_WHICH_MAX_VAL:
 226		value = ctrl->maximum;
 227		break;
 228	case V4L2_CTRL_WHICH_MIN_VAL:
 229		value = ctrl->minimum;
 230		break;
 231	default:
 232		return;
 233	}
 234
 235	switch (ctrl->type) {
 236	case V4L2_CTRL_TYPE_STRING:
 237		if (which == V4L2_CTRL_WHICH_DEF_VAL)
 238			value = ctrl->minimum;
 239
 240		for (i = from_idx; i < tot_elems; i++) {
 241			unsigned int offset = i * ctrl->elem_size;
 242
 243			memset(ptr.p_char + offset, ' ', value);
 244			ptr.p_char[offset + value] = '\0';
 245		}
 246		break;
 247	case V4L2_CTRL_TYPE_INTEGER64:
 248		if (value) {
 249			for (i = from_idx; i < tot_elems; i++)
 250				ptr.p_s64[i] = value;
 251		} else {
 252			memset(ptr.p_s64 + from_idx, 0, elems * sizeof(s64));
 253		}
 254		break;
 255	case V4L2_CTRL_TYPE_INTEGER:
 256	case V4L2_CTRL_TYPE_INTEGER_MENU:
 257	case V4L2_CTRL_TYPE_MENU:
 258	case V4L2_CTRL_TYPE_BITMASK:
 259	case V4L2_CTRL_TYPE_BOOLEAN:
 260		if (value) {
 261			for (i = from_idx; i < tot_elems; i++)
 262				ptr.p_s32[i] = value;
 263		} else {
 264			memset(ptr.p_s32 + from_idx, 0, elems * sizeof(s32));
 265		}
 266		break;
 267	case V4L2_CTRL_TYPE_BUTTON:
 268	case V4L2_CTRL_TYPE_CTRL_CLASS:
 269		memset(ptr.p_s32 + from_idx, 0, elems * sizeof(s32));
 270		break;
 271	case V4L2_CTRL_TYPE_U8:
 272		memset(ptr.p_u8 + from_idx, value, elems);
 273		break;
 274	case V4L2_CTRL_TYPE_U16:
 275		if (value) {
 276			for (i = from_idx; i < tot_elems; i++)
 277				ptr.p_u16[i] = value;
 278		} else {
 279			memset(ptr.p_u16 + from_idx, 0, elems * sizeof(u16));
 280		}
 281		break;
 282	case V4L2_CTRL_TYPE_U32:
 283		if (value) {
 284			for (i = from_idx; i < tot_elems; i++)
 285				ptr.p_u32[i] = value;
 286		} else {
 287			memset(ptr.p_u32 + from_idx, 0, elems * sizeof(u32));
 288		}
 289		break;
 290	default:
 291		for (i = from_idx; i < tot_elems; i++) {
 292			switch (which) {
 293			case V4L2_CTRL_WHICH_DEF_VAL:
 294				std_init_compound(ctrl, i, ptr);
 295				break;
 296			case V4L2_CTRL_WHICH_MAX_VAL:
 297				std_max_compound(ctrl, i, ptr);
 298				break;
 299			case V4L2_CTRL_WHICH_MIN_VAL:
 300				std_min_compound(ctrl, i, ptr);
 301				break;
 302			}
 303		}
 304		break;
 305	}
 306}
 307
 308void v4l2_ctrl_type_op_init(const struct v4l2_ctrl *ctrl, u32 from_idx,
 309			    union v4l2_ctrl_ptr ptr)
 310{
 311	__v4l2_ctrl_type_op_init(ctrl, from_idx, V4L2_CTRL_WHICH_DEF_VAL, ptr);
 312}
 313EXPORT_SYMBOL(v4l2_ctrl_type_op_init);
 314
 315static void v4l2_ctrl_type_op_minimum(const struct v4l2_ctrl *ctrl,
 316				      u32 from_idx, union v4l2_ctrl_ptr ptr)
 317{
 318	__v4l2_ctrl_type_op_init(ctrl, from_idx, V4L2_CTRL_WHICH_MIN_VAL, ptr);
 319}
 320
 321static void v4l2_ctrl_type_op_maximum(const struct v4l2_ctrl *ctrl,
 322				      u32 from_idx, union v4l2_ctrl_ptr ptr)
 323{
 324	__v4l2_ctrl_type_op_init(ctrl, from_idx, V4L2_CTRL_WHICH_MAX_VAL, ptr);
 325}
 326
 327void v4l2_ctrl_type_op_log(const struct v4l2_ctrl *ctrl)
 328{
 329	union v4l2_ctrl_ptr ptr = ctrl->p_cur;
 330
 331	if (ctrl->is_array) {
 332		unsigned i;
 333
 334		for (i = 0; i < ctrl->nr_of_dims; i++)
 335			pr_cont("[%u]", ctrl->dims[i]);
 336		pr_cont(" ");
 337	}
 338
 339	switch (ctrl->type) {
 340	case V4L2_CTRL_TYPE_INTEGER:
 341		pr_cont("%d", *ptr.p_s32);
 342		break;
 343	case V4L2_CTRL_TYPE_BOOLEAN:
 344		pr_cont("%s", *ptr.p_s32 ? "true" : "false");
 345		break;
 346	case V4L2_CTRL_TYPE_MENU:
 347		pr_cont("%s", ctrl->qmenu[*ptr.p_s32]);
 348		break;
 349	case V4L2_CTRL_TYPE_INTEGER_MENU:
 350		pr_cont("%lld", ctrl->qmenu_int[*ptr.p_s32]);
 351		break;
 352	case V4L2_CTRL_TYPE_BITMASK:
 353		pr_cont("0x%08x", *ptr.p_s32);
 354		break;
 355	case V4L2_CTRL_TYPE_INTEGER64:
 356		pr_cont("%lld", *ptr.p_s64);
 357		break;
 358	case V4L2_CTRL_TYPE_STRING:
 359		pr_cont("%s", ptr.p_char);
 360		break;
 361	case V4L2_CTRL_TYPE_U8:
 362		pr_cont("%u", (unsigned)*ptr.p_u8);
 363		break;
 364	case V4L2_CTRL_TYPE_U16:
 365		pr_cont("%u", (unsigned)*ptr.p_u16);
 366		break;
 367	case V4L2_CTRL_TYPE_U32:
 368		pr_cont("%u", (unsigned)*ptr.p_u32);
 369		break;
 370	case V4L2_CTRL_TYPE_AREA:
 371		pr_cont("%ux%u", ptr.p_area->width, ptr.p_area->height);
 372		break;
 373	case V4L2_CTRL_TYPE_H264_SPS:
 374		pr_cont("H264_SPS");
 375		break;
 376	case V4L2_CTRL_TYPE_H264_PPS:
 377		pr_cont("H264_PPS");
 378		break;
 379	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
 380		pr_cont("H264_SCALING_MATRIX");
 381		break;
 382	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
 383		pr_cont("H264_SLICE_PARAMS");
 384		break;
 385	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
 386		pr_cont("H264_DECODE_PARAMS");
 387		break;
 388	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
 389		pr_cont("H264_PRED_WEIGHTS");
 390		break;
 391	case V4L2_CTRL_TYPE_FWHT_PARAMS:
 392		pr_cont("FWHT_PARAMS");
 393		break;
 394	case V4L2_CTRL_TYPE_VP8_FRAME:
 395		pr_cont("VP8_FRAME");
 396		break;
 397	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
 398		pr_cont("HDR10_CLL_INFO");
 399		break;
 400	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
 401		pr_cont("HDR10_MASTERING_DISPLAY");
 402		break;
 403	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
 404		pr_cont("MPEG2_QUANTISATION");
 405		break;
 406	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
 407		pr_cont("MPEG2_SEQUENCE");
 408		break;
 409	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
 410		pr_cont("MPEG2_PICTURE");
 411		break;
 412	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
 413		pr_cont("VP9_COMPRESSED_HDR");
 414		break;
 415	case V4L2_CTRL_TYPE_VP9_FRAME:
 416		pr_cont("VP9_FRAME");
 417		break;
 418	case V4L2_CTRL_TYPE_HEVC_SPS:
 419		pr_cont("HEVC_SPS");
 420		break;
 421	case V4L2_CTRL_TYPE_HEVC_PPS:
 422		pr_cont("HEVC_PPS");
 423		break;
 424	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
 425		pr_cont("HEVC_SLICE_PARAMS");
 426		break;
 427	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
 428		pr_cont("HEVC_SCALING_MATRIX");
 429		break;
 430	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
 431		pr_cont("HEVC_DECODE_PARAMS");
 432		break;
 433	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
 434		pr_cont("AV1_SEQUENCE");
 435		break;
 436	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
 437		pr_cont("AV1_TILE_GROUP_ENTRY");
 438		break;
 439	case V4L2_CTRL_TYPE_AV1_FRAME:
 440		pr_cont("AV1_FRAME");
 441		break;
 442	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
 443		pr_cont("AV1_FILM_GRAIN");
 444		break;
 445	case V4L2_CTRL_TYPE_RECT:
 446		pr_cont("(%d,%d)/%ux%u",
 447			ptr.p_rect->left, ptr.p_rect->top,
 448			ptr.p_rect->width, ptr.p_rect->height);
 449		break;
 450	default:
 451		pr_cont("unknown type %d", ctrl->type);
 452		break;
 453	}
 454}
 455EXPORT_SYMBOL(v4l2_ctrl_type_op_log);
 456
 457/*
 458 * Round towards the closest legal value. Be careful when we are
 459 * close to the maximum range of the control type to prevent
 460 * wrap-arounds.
 461 */
 462#define ROUND_TO_RANGE(val, offset_type, ctrl)			\
 463({								\
 464	offset_type offset;					\
 465	if ((ctrl)->maximum >= 0 &&				\
 466	    val >= (ctrl)->maximum - (s32)((ctrl)->step / 2))	\
 467		val = (ctrl)->maximum;				\
 468	else							\
 469		val += (s32)((ctrl)->step / 2);			\
 470	val = clamp_t(typeof(val), val,				\
 471		      (ctrl)->minimum, (ctrl)->maximum);	\
 472	offset = (val) - (ctrl)->minimum;			\
 473	offset = (ctrl)->step * (offset / (u32)(ctrl)->step);	\
 474	val = (ctrl)->minimum + offset;				\
 475	0;							\
 476})
 477
 478/* Validate a new control */
 479
 480#define zero_padding(s) \
 481	memset(&(s).padding, 0, sizeof((s).padding))
 482#define zero_reserved(s) \
 483	memset(&(s).reserved, 0, sizeof((s).reserved))
 484
 485static int
 486validate_vp9_lf_params(struct v4l2_vp9_loop_filter *lf)
 487{
 488	unsigned int i;
 489
 490	if (lf->flags & ~(V4L2_VP9_LOOP_FILTER_FLAG_DELTA_ENABLED |
 491			  V4L2_VP9_LOOP_FILTER_FLAG_DELTA_UPDATE))
 492		return -EINVAL;
 493
 494	/* That all values are in the accepted range. */
 495	if (lf->level > GENMASK(5, 0))
 496		return -EINVAL;
 497
 498	if (lf->sharpness > GENMASK(2, 0))
 499		return -EINVAL;
 500
 501	for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++)
 502		if (lf->ref_deltas[i] < -63 || lf->ref_deltas[i] > 63)
 503			return -EINVAL;
 504
 505	for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++)
 506		if (lf->mode_deltas[i] < -63 || lf->mode_deltas[i] > 63)
 507			return -EINVAL;
 508
 509	zero_reserved(*lf);
 510	return 0;
 511}
 512
 513static int
 514validate_vp9_quant_params(struct v4l2_vp9_quantization *quant)
 515{
 516	if (quant->delta_q_y_dc < -15 || quant->delta_q_y_dc > 15 ||
 517	    quant->delta_q_uv_dc < -15 || quant->delta_q_uv_dc > 15 ||
 518	    quant->delta_q_uv_ac < -15 || quant->delta_q_uv_ac > 15)
 519		return -EINVAL;
 520
 521	zero_reserved(*quant);
 522	return 0;
 523}
 524
 525static int
 526validate_vp9_seg_params(struct v4l2_vp9_segmentation *seg)
 527{
 528	unsigned int i, j;
 529
 530	if (seg->flags & ~(V4L2_VP9_SEGMENTATION_FLAG_ENABLED |
 531			   V4L2_VP9_SEGMENTATION_FLAG_UPDATE_MAP |
 532			   V4L2_VP9_SEGMENTATION_FLAG_TEMPORAL_UPDATE |
 533			   V4L2_VP9_SEGMENTATION_FLAG_UPDATE_DATA |
 534			   V4L2_VP9_SEGMENTATION_FLAG_ABS_OR_DELTA_UPDATE))
 535		return -EINVAL;
 536
 537	for (i = 0; i < ARRAY_SIZE(seg->feature_enabled); i++) {
 538		if (seg->feature_enabled[i] &
 539		    ~V4L2_VP9_SEGMENT_FEATURE_ENABLED_MASK)
 540			return -EINVAL;
 541	}
 542
 543	for (i = 0; i < ARRAY_SIZE(seg->feature_data); i++) {
 544		static const int range[] = { 255, 63, 3, 0 };
 545
 546		for (j = 0; j < ARRAY_SIZE(seg->feature_data[j]); j++) {
 547			if (seg->feature_data[i][j] < -range[j] ||
 548			    seg->feature_data[i][j] > range[j])
 549				return -EINVAL;
 550		}
 551	}
 552
 553	zero_reserved(*seg);
 554	return 0;
 555}
 556
 557static int
 558validate_vp9_compressed_hdr(struct v4l2_ctrl_vp9_compressed_hdr *hdr)
 559{
 560	if (hdr->tx_mode > V4L2_VP9_TX_MODE_SELECT)
 561		return -EINVAL;
 562
 563	return 0;
 564}
 565
 566static int
 567validate_vp9_frame(struct v4l2_ctrl_vp9_frame *frame)
 568{
 569	int ret;
 570
 571	/* Make sure we're not passed invalid flags. */
 572	if (frame->flags & ~(V4L2_VP9_FRAME_FLAG_KEY_FRAME |
 573		  V4L2_VP9_FRAME_FLAG_SHOW_FRAME |
 574		  V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT |
 575		  V4L2_VP9_FRAME_FLAG_INTRA_ONLY |
 576		  V4L2_VP9_FRAME_FLAG_ALLOW_HIGH_PREC_MV |
 577		  V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX |
 578		  V4L2_VP9_FRAME_FLAG_PARALLEL_DEC_MODE |
 579		  V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING |
 580		  V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING |
 581		  V4L2_VP9_FRAME_FLAG_COLOR_RANGE_FULL_SWING))
 582		return -EINVAL;
 583
 584	if (frame->flags & V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT &&
 585	    frame->flags & V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX)
 586		return -EINVAL;
 587
 588	if (frame->profile > V4L2_VP9_PROFILE_MAX)
 589		return -EINVAL;
 590
 591	if (frame->reset_frame_context > V4L2_VP9_RESET_FRAME_CTX_ALL)
 592		return -EINVAL;
 593
 594	if (frame->frame_context_idx >= V4L2_VP9_NUM_FRAME_CTX)
 595		return -EINVAL;
 596
 597	/*
 598	 * Profiles 0 and 1 only support 8-bit depth, profiles 2 and 3 only 10
 599	 * and 12 bit depths.
 600	 */
 601	if ((frame->profile < 2 && frame->bit_depth != 8) ||
 602	    (frame->profile >= 2 &&
 603	     (frame->bit_depth != 10 && frame->bit_depth != 12)))
 604		return -EINVAL;
 605
 606	/* Profile 0 and 2 only accept YUV 4:2:0. */
 607	if ((frame->profile == 0 || frame->profile == 2) &&
 608	    (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
 609	     !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
 610		return -EINVAL;
 611
 612	/* Profile 1 and 3 only accept YUV 4:2:2, 4:4:0 and 4:4:4. */
 613	if ((frame->profile == 1 || frame->profile == 3) &&
 614	    ((frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) &&
 615	     (frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)))
 616		return -EINVAL;
 617
 618	if (frame->interpolation_filter > V4L2_VP9_INTERP_FILTER_SWITCHABLE)
 619		return -EINVAL;
 620
 621	/*
 622	 * According to the spec, tile_cols_log2 shall be less than or equal
 623	 * to 6.
 624	 */
 625	if (frame->tile_cols_log2 > 6)
 626		return -EINVAL;
 627
 628	if (frame->reference_mode > V4L2_VP9_REFERENCE_MODE_SELECT)
 629		return -EINVAL;
 630
 631	ret = validate_vp9_lf_params(&frame->lf);
 632	if (ret)
 633		return ret;
 634
 635	ret = validate_vp9_quant_params(&frame->quant);
 636	if (ret)
 637		return ret;
 638
 639	ret = validate_vp9_seg_params(&frame->seg);
 640	if (ret)
 641		return ret;
 642
 643	zero_reserved(*frame);
 644	return 0;
 645}
 646
 647static int validate_av1_quantization(struct v4l2_av1_quantization *q)
 648{
 649	if (q->flags > GENMASK(2, 0))
 650		return -EINVAL;
 651
 652	if (q->delta_q_y_dc < -64 || q->delta_q_y_dc > 63 ||
 653	    q->delta_q_u_dc < -64 || q->delta_q_u_dc > 63 ||
 654	    q->delta_q_v_dc < -64 || q->delta_q_v_dc > 63 ||
 655	    q->delta_q_u_ac < -64 || q->delta_q_u_ac > 63 ||
 656	    q->delta_q_v_ac < -64 || q->delta_q_v_ac > 63 ||
 657	    q->delta_q_res > GENMASK(1, 0))
 658		return -EINVAL;
 659
 660	if (q->qm_y > GENMASK(3, 0) ||
 661	    q->qm_u > GENMASK(3, 0) ||
 662	    q->qm_v > GENMASK(3, 0))
 663		return -EINVAL;
 664
 665	return 0;
 666}
 667
 668static int validate_av1_segmentation(struct v4l2_av1_segmentation *s)
 669{
 670	u32 i;
 671	u32 j;
 672
 673	if (s->flags > GENMASK(4, 0))
 674		return -EINVAL;
 675
 676	for (i = 0; i < ARRAY_SIZE(s->feature_data); i++) {
 677		static const int segmentation_feature_signed[] = { 1, 1, 1, 1, 1, 0, 0, 0 };
 678		static const int segmentation_feature_max[] = { 255, 63, 63, 63, 63, 7, 0, 0};
 679
 680		for (j = 0; j < ARRAY_SIZE(s->feature_data[j]); j++) {
 681			s32 limit = segmentation_feature_max[j];
 682
 683			if (segmentation_feature_signed[j]) {
 684				if (s->feature_data[i][j] < -limit ||
 685				    s->feature_data[i][j] > limit)
 686					return -EINVAL;
 687			} else {
 688				if (s->feature_data[i][j] < 0 || s->feature_data[i][j] > limit)
 689					return -EINVAL;
 690			}
 691		}
 692	}
 693
 694	return 0;
 695}
 696
 697static int validate_av1_loop_filter(struct v4l2_av1_loop_filter *lf)
 698{
 699	u32 i;
 700
 701	if (lf->flags > GENMASK(3, 0))
 702		return -EINVAL;
 703
 704	for (i = 0; i < ARRAY_SIZE(lf->level); i++) {
 705		if (lf->level[i] > GENMASK(5, 0))
 706			return -EINVAL;
 707	}
 708
 709	if (lf->sharpness > GENMASK(2, 0))
 710		return -EINVAL;
 711
 712	for (i = 0; i < ARRAY_SIZE(lf->ref_deltas); i++) {
 713		if (lf->ref_deltas[i] < -64 || lf->ref_deltas[i] > 63)
 714			return -EINVAL;
 715	}
 716
 717	for (i = 0; i < ARRAY_SIZE(lf->mode_deltas); i++) {
 718		if (lf->mode_deltas[i] < -64 || lf->mode_deltas[i] > 63)
 719			return -EINVAL;
 720	}
 721
 722	return 0;
 723}
 724
 725static int validate_av1_cdef(struct v4l2_av1_cdef *cdef)
 726{
 727	u32 i;
 728
 729	if (cdef->damping_minus_3 > GENMASK(1, 0) ||
 730	    cdef->bits > GENMASK(1, 0))
 731		return -EINVAL;
 732
 733	for (i = 0; i < 1 << cdef->bits; i++) {
 734		if (cdef->y_pri_strength[i] > GENMASK(3, 0) ||
 735		    cdef->y_sec_strength[i] > 4 ||
 736		    cdef->uv_pri_strength[i] > GENMASK(3, 0) ||
 737		    cdef->uv_sec_strength[i] > 4)
 738			return -EINVAL;
 739	}
 740
 741	return 0;
 742}
 743
 744static int validate_av1_loop_restauration(struct v4l2_av1_loop_restoration *lr)
 745{
 746	if (lr->lr_unit_shift > 3 || lr->lr_uv_shift > 1)
 747		return -EINVAL;
 748
 749	return 0;
 750}
 751
 752static int validate_av1_film_grain(struct v4l2_ctrl_av1_film_grain *fg)
 753{
 754	u32 i;
 755
 756	if (fg->flags > GENMASK(4, 0))
 757		return -EINVAL;
 758
 759	if (fg->film_grain_params_ref_idx > GENMASK(2, 0) ||
 760	    fg->num_y_points > 14 ||
 761	    fg->num_cb_points > 10 ||
 762	    fg->num_cr_points > GENMASK(3, 0) ||
 763	    fg->grain_scaling_minus_8 > GENMASK(1, 0) ||
 764	    fg->ar_coeff_lag > GENMASK(1, 0) ||
 765	    fg->ar_coeff_shift_minus_6 > GENMASK(1, 0) ||
 766	    fg->grain_scale_shift > GENMASK(1, 0))
 767		return -EINVAL;
 768
 769	if (!(fg->flags & V4L2_AV1_FILM_GRAIN_FLAG_APPLY_GRAIN))
 770		return 0;
 771
 772	for (i = 1; i < fg->num_y_points; i++)
 773		if (fg->point_y_value[i] <= fg->point_y_value[i - 1])
 774			return -EINVAL;
 775
 776	for (i = 1; i < fg->num_cb_points; i++)
 777		if (fg->point_cb_value[i] <= fg->point_cb_value[i - 1])
 778			return -EINVAL;
 779
 780	for (i = 1; i < fg->num_cr_points; i++)
 781		if (fg->point_cr_value[i] <= fg->point_cr_value[i - 1])
 782			return -EINVAL;
 783
 784	return 0;
 785}
 786
 787static int validate_av1_frame(struct v4l2_ctrl_av1_frame *f)
 788{
 789	int ret = 0;
 790
 791	ret = validate_av1_quantization(&f->quantization);
 792	if (ret)
 793		return ret;
 794	ret = validate_av1_segmentation(&f->segmentation);
 795	if (ret)
 796		return ret;
 797	ret = validate_av1_loop_filter(&f->loop_filter);
 798	if (ret)
 799		return ret;
 800	ret = validate_av1_cdef(&f->cdef);
 801	if (ret)
 802		return ret;
 803	ret = validate_av1_loop_restauration(&f->loop_restoration);
 804	if (ret)
 805		return ret;
 806
 807	if (f->flags &
 808	~(V4L2_AV1_FRAME_FLAG_SHOW_FRAME |
 809	  V4L2_AV1_FRAME_FLAG_SHOWABLE_FRAME |
 810	  V4L2_AV1_FRAME_FLAG_ERROR_RESILIENT_MODE |
 811	  V4L2_AV1_FRAME_FLAG_DISABLE_CDF_UPDATE |
 812	  V4L2_AV1_FRAME_FLAG_ALLOW_SCREEN_CONTENT_TOOLS |
 813	  V4L2_AV1_FRAME_FLAG_FORCE_INTEGER_MV |
 814	  V4L2_AV1_FRAME_FLAG_ALLOW_INTRABC |
 815	  V4L2_AV1_FRAME_FLAG_USE_SUPERRES |
 816	  V4L2_AV1_FRAME_FLAG_ALLOW_HIGH_PRECISION_MV |
 817	  V4L2_AV1_FRAME_FLAG_IS_MOTION_MODE_SWITCHABLE |
 818	  V4L2_AV1_FRAME_FLAG_USE_REF_FRAME_MVS |
 819	  V4L2_AV1_FRAME_FLAG_DISABLE_FRAME_END_UPDATE_CDF |
 820	  V4L2_AV1_FRAME_FLAG_ALLOW_WARPED_MOTION |
 821	  V4L2_AV1_FRAME_FLAG_REFERENCE_SELECT |
 822	  V4L2_AV1_FRAME_FLAG_REDUCED_TX_SET |
 823	  V4L2_AV1_FRAME_FLAG_SKIP_MODE_ALLOWED |
 824	  V4L2_AV1_FRAME_FLAG_SKIP_MODE_PRESENT |
 825	  V4L2_AV1_FRAME_FLAG_FRAME_SIZE_OVERRIDE |
 826	  V4L2_AV1_FRAME_FLAG_BUFFER_REMOVAL_TIME_PRESENT |
 827	  V4L2_AV1_FRAME_FLAG_FRAME_REFS_SHORT_SIGNALING))
 828		return -EINVAL;
 829
 830	if (f->superres_denom > GENMASK(2, 0) + 9)
 831		return -EINVAL;
 832
 833	return 0;
 834}
 835
 836/**
 837 * validate_av1_sequence - validate AV1 sequence header fields
 838 * @s: control struct from userspace
 839 *
 840 * Implements AV1 spec §5.5.2 color_config() checks that are
 841 * possible with the current v4l2_ctrl_av1_sequence definition.
 842 *
 843 * TODO: extend validation once additional fields such as
 844 *       color_primaries, transfer_characteristics,
 845 *       matrix_coefficients, and chroma_sample_position
 846 *       are added to the uAPI.
 847 *
 848 * Returns 0 if valid, -EINVAL otherwise.
 849 */
 850static int validate_av1_sequence(struct v4l2_ctrl_av1_sequence *s)
 851{
 852	const bool mono  = s->flags & V4L2_AV1_SEQUENCE_FLAG_MONO_CHROME;
 853	const bool sx    = s->flags & V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_X;
 854	const bool sy    = s->flags & V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_Y;
 855	const bool uv_dq = s->flags & V4L2_AV1_SEQUENCE_FLAG_SEPARATE_UV_DELTA_Q;
 856
 857	/* 1. Reject unknown flags */
 858	if (s->flags &
 859	    ~(V4L2_AV1_SEQUENCE_FLAG_STILL_PICTURE |
 860	      V4L2_AV1_SEQUENCE_FLAG_USE_128X128_SUPERBLOCK |
 861	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_FILTER_INTRA |
 862	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_INTRA_EDGE_FILTER |
 863	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_INTERINTRA_COMPOUND |
 864	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_MASKED_COMPOUND |
 865	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_WARPED_MOTION |
 866	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_DUAL_FILTER |
 867	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_ORDER_HINT |
 868	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_JNT_COMP |
 869	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_REF_FRAME_MVS |
 870	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_SUPERRES |
 871	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_CDEF |
 872	      V4L2_AV1_SEQUENCE_FLAG_ENABLE_RESTORATION |
 873	      V4L2_AV1_SEQUENCE_FLAG_MONO_CHROME |
 874	      V4L2_AV1_SEQUENCE_FLAG_COLOR_RANGE |
 875	      V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_X |
 876	      V4L2_AV1_SEQUENCE_FLAG_SUBSAMPLING_Y |
 877	      V4L2_AV1_SEQUENCE_FLAG_FILM_GRAIN_PARAMS_PRESENT |
 878	      V4L2_AV1_SEQUENCE_FLAG_SEPARATE_UV_DELTA_Q))
 879		return -EINVAL;
 880
 881	/* 2. Profile range */
 882	if (s->seq_profile > 2)
 883		return -EINVAL;
 884
 885	/* 3. Monochrome shortcut */
 886	if (mono) {
 887		/* Profile 1 forbids monochrome */
 888		if (s->seq_profile == 1)
 889			return -EINVAL;
 890
 891		/* Mono → subsampling must look like 4:0:0: sx=1, sy=1 */
 892		if (!sx || !sy)
 893			return -EINVAL;
 894
 895		/* separate_uv_delta_q must be 0 */
 896		if (uv_dq)
 897			return -EINVAL;
 898
 899		return 0;
 900	}
 901
 902	/* 4. Profile-specific rules */
 903	switch (s->seq_profile) {
 904	case 0:
 905		/* Profile 0: only 8/10-bit, subsampling=4:2:0 (sx=1, sy=1) */
 906		if (s->bit_depth != 8 && s->bit_depth != 10)
 907			return -EINVAL;
 908		if (!(sx && sy))
 909			return -EINVAL;
 910		break;
 911
 912	case 1:
 913		/* Profile 1: only 8/10-bit, subsampling=4:4:4 (sx=0, sy=0) */
 914		if (s->bit_depth != 8 && s->bit_depth != 10)
 915			return -EINVAL;
 916		if (sx || sy)
 917			return -EINVAL;
 918		break;
 919
 920	case 2:
 921		/* Profile 2: 8/10/12-bit allowed */
 922		if (s->bit_depth != 8 && s->bit_depth != 10 &&
 923		    s->bit_depth != 12)
 924			return -EINVAL;
 925
 926		if (s->bit_depth == 12) {
 927			if (!sx) {
 928				/* 4:4:4 → sy must be 0 */
 929				if (sy)
 930					return -EINVAL;
 931			} else {
 932				/* sx=1 → sy=0 (4:2:2) or sy=1 (4:2:0) */
 933				if (sy != 0 && sy != 1)
 934					return -EINVAL;
 935			}
 936		} else {
 937			/* 8/10-bit → only 4:2:2 allowed (sx=1, sy=0) */
 938			if (!(sx && !sy))
 939				return -EINVAL;
 940		}
 941		break;
 942	}
 943
 944	return 0;
 945}
 946
 947/*
 948 * Compound controls validation requires setting unused fields/flags to zero
 949 * in order to properly detect unchanged controls with v4l2_ctrl_type_op_equal's
 950 * memcmp.
 951 */
 952static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 953				 union v4l2_ctrl_ptr ptr)
 954{
 955	struct v4l2_ctrl_mpeg2_sequence *p_mpeg2_sequence;
 956	struct v4l2_ctrl_mpeg2_picture *p_mpeg2_picture;
 957	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
 958	struct v4l2_ctrl_fwht_params *p_fwht_params;
 959	struct v4l2_ctrl_h264_sps *p_h264_sps;
 960	struct v4l2_ctrl_h264_pps *p_h264_pps;
 961	struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weights;
 962	struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;
 963	struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;
 964	struct v4l2_ctrl_hevc_sps *p_hevc_sps;
 965	struct v4l2_ctrl_hevc_pps *p_hevc_pps;
 966	struct v4l2_ctrl_hdr10_mastering_display *p_hdr10_mastering;
 967	struct v4l2_ctrl_hevc_decode_params *p_hevc_decode_params;
 968	struct v4l2_area *area;
 969	struct v4l2_rect *rect;
 970	void *p = ptr.p + idx * ctrl->elem_size;
 971	unsigned int i;
 972
 973	switch ((u32)ctrl->type) {
 974	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
 975		p_mpeg2_sequence = p;
 976
 977		switch (p_mpeg2_sequence->chroma_format) {
 978		case 1: /* 4:2:0 */
 979		case 2: /* 4:2:2 */
 980		case 3: /* 4:4:4 */
 981			break;
 982		default:
 983			return -EINVAL;
 984		}
 985		break;
 986
 987	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
 988		p_mpeg2_picture = p;
 989
 990		switch (p_mpeg2_picture->intra_dc_precision) {
 991		case 0: /* 8 bits */
 992		case 1: /* 9 bits */
 993		case 2: /* 10 bits */
 994		case 3: /* 11 bits */
 995			break;
 996		default:
 997			return -EINVAL;
 998		}
 999
1000		switch (p_mpeg2_picture->picture_structure) {
1001		case V4L2_MPEG2_PIC_TOP_FIELD:
1002		case V4L2_MPEG2_PIC_BOTTOM_FIELD:
1003		case V4L2_MPEG2_PIC_FRAME:
1004			break;
1005		default:
1006			return -EINVAL;
1007		}
1008
1009		switch (p_mpeg2_picture->picture_coding_type) {
1010		case V4L2_MPEG2_PIC_CODING_TYPE_I:
1011		case V4L2_MPEG2_PIC_CODING_TYPE_P:
1012		case V4L2_MPEG2_PIC_CODING_TYPE_B:
1013			break;
1014		default:
1015			return -EINVAL;
1016		}
1017		zero_reserved(*p_mpeg2_picture);
1018		break;
1019
1020	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
1021		break;
1022
1023	case V4L2_CTRL_TYPE_FWHT_PARAMS:
1024		p_fwht_params = p;
1025		if (p_fwht_params->version < V4L2_FWHT_VERSION)
1026			return -EINVAL;
1027		if (!p_fwht_params->width || !p_fwht_params->height)
1028			return -EINVAL;
1029		break;
1030
1031	case V4L2_CTRL_TYPE_H264_SPS:
1032		p_h264_sps = p;
1033
1034		/* Some syntax elements are only conditionally valid */
1035		if (p_h264_sps->pic_order_cnt_type != 0) {
1036			p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 = 0;
1037		} else if (p_h264_sps->pic_order_cnt_type != 1) {
1038			p_h264_sps->num_ref_frames_in_pic_order_cnt_cycle = 0;
1039			p_h264_sps->offset_for_non_ref_pic = 0;
1040			p_h264_sps->offset_for_top_to_bottom_field = 0;
1041			memset(&p_h264_sps->offset_for_ref_frame, 0,
1042			       sizeof(p_h264_sps->offset_for_ref_frame));
1043		}
1044
1045		if (!V4L2_H264_SPS_HAS_CHROMA_FORMAT(p_h264_sps)) {
1046			p_h264_sps->chroma_format_idc = 1;
1047			p_h264_sps->bit_depth_luma_minus8 = 0;
1048			p_h264_sps->bit_depth_chroma_minus8 = 0;
1049
1050			p_h264_sps->flags &=
1051				~V4L2_H264_SPS_FLAG_QPPRIME_Y_ZERO_TRANSFORM_BYPASS;
1052		}
1053
1054		if (p_h264_sps->chroma_format_idc < 3)
1055			p_h264_sps->flags &=
1056				~V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE;
1057
1058		if (p_h264_sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY)
1059			p_h264_sps->flags &=
1060				~V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD;
1061
1062		/*
1063		 * Chroma 4:2:2 format require at least High 4:2:2 profile.
1064		 *
1065		 * The H264 specification and well-known parser implementations
1066		 * use profile-idc values directly, as that is clearer and
1067		 * less ambiguous. We do the same here.
1068		 */
1069		if (p_h264_sps->profile_idc < 122 &&
1070		    p_h264_sps->chroma_format_idc > 1)
1071			return -EINVAL;
1072		/* Chroma 4:4:4 format require at least High 4:2:2 profile */
1073		if (p_h264_sps->profile_idc < 244 &&
1074		    p_h264_sps->chroma_format_idc > 2)
1075			return -EINVAL;
1076		if (p_h264_sps->chroma_format_idc > 3)
1077			return -EINVAL;
1078
1079		if (p_h264_sps->bit_depth_luma_minus8 > 6)
1080			return -EINVAL;
1081		if (p_h264_sps->bit_depth_chroma_minus8 > 6)
1082			return -EINVAL;
1083		if (p_h264_sps->log2_max_frame_num_minus4 > 12)
1084			return -EINVAL;
1085		if (p_h264_sps->pic_order_cnt_type > 2)
1086			return -EINVAL;
1087		if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
1088			return -EINVAL;
1089		if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)
1090			return -EINVAL;
1091		break;
1092
1093	case V4L2_CTRL_TYPE_H264_PPS:
1094		p_h264_pps = p;
1095
1096		if (p_h264_pps->num_slice_groups_minus1 > 7)
1097			return -EINVAL;
1098		if (p_h264_pps->num_ref_idx_l0_default_active_minus1 >
1099		    (V4L2_H264_REF_LIST_LEN - 1))
1100			return -EINVAL;
1101		if (p_h264_pps->num_ref_idx_l1_default_active_minus1 >
1102		    (V4L2_H264_REF_LIST_LEN - 1))
1103			return -EINVAL;
1104		if (p_h264_pps->weighted_bipred_idc > 2)
1105			return -EINVAL;
1106		/*
1107		 * pic_init_qp_minus26 shall be in the range of
1108		 * -(26 + QpBdOffset_y) to +25, inclusive,
1109		 *  where QpBdOffset_y is 6 * bit_depth_luma_minus8
1110		 */
1111		if (p_h264_pps->pic_init_qp_minus26 < -62 ||
1112		    p_h264_pps->pic_init_qp_minus26 > 25)
1113			return -EINVAL;
1114		if (p_h264_pps->pic_init_qs_minus26 < -26 ||
1115		    p_h264_pps->pic_init_qs_minus26 > 25)
1116			return -EINVAL;
1117		if (p_h264_pps->chroma_qp_index_offset < -12 ||
1118		    p_h264_pps->chroma_qp_index_offset > 12)
1119			return -EINVAL;
1120		if (p_h264_pps->second_chroma_qp_index_offset < -12 ||
1121		    p_h264_pps->second_chroma_qp_index_offset > 12)
1122			return -EINVAL;
1123		break;
1124
1125	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
1126		break;
1127
1128	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
1129		p_h264_pred_weights = p;
1130
1131		if (p_h264_pred_weights->luma_log2_weight_denom > 7)
1132			return -EINVAL;
1133		if (p_h264_pred_weights->chroma_log2_weight_denom > 7)
1134			return -EINVAL;
1135		break;
1136
1137	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
1138		p_h264_slice_params = p;
1139
1140		if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
1141			p_h264_slice_params->flags &=
1142				~V4L2_H264_SLICE_FLAG_DIRECT_SPATIAL_MV_PRED;
1143
1144		if (p_h264_slice_params->colour_plane_id > 2)
1145			return -EINVAL;
1146		if (p_h264_slice_params->cabac_init_idc > 2)
1147			return -EINVAL;
1148		if (p_h264_slice_params->disable_deblocking_filter_idc > 2)
1149			return -EINVAL;
1150		if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||
1151		    p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)
1152			return -EINVAL;
1153		if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||
1154		    p_h264_slice_params->slice_beta_offset_div2 > 6)
1155			return -EINVAL;
1156
1157		if (p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_I ||
1158		    p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_SI)
1159			p_h264_slice_params->num_ref_idx_l0_active_minus1 = 0;
1160		if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
1161			p_h264_slice_params->num_ref_idx_l1_active_minus1 = 0;
1162
1163		if (p_h264_slice_params->num_ref_idx_l0_active_minus1 >
1164		    (V4L2_H264_REF_LIST_LEN - 1))
1165			return -EINVAL;
1166		if (p_h264_slice_params->num_ref_idx_l1_active_minus1 >
1167		    (V4L2_H264_REF_LIST_LEN - 1))
1168			return -EINVAL;
1169		zero_reserved(*p_h264_slice_params);
1170		break;
1171
1172	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1173		p_h264_dec_params = p;
1174
1175		if (p_h264_dec_params->nal_ref_idc > 3)
1176			return -EINVAL;
1177		for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {
1178			struct v4l2_h264_dpb_entry *dpb_entry =
1179				&p_h264_dec_params->dpb[i];
1180
1181			zero_reserved(*dpb_entry);
1182		}
1183		zero_reserved(*p_h264_dec_params);
1184		break;
1185
1186	case V4L2_CTRL_TYPE_VP8_FRAME:
1187		p_vp8_frame = p;
1188
1189		switch (p_vp8_frame->num_dct_parts) {
1190		case 1:
1191		case 2:
1192		case 4:
1193		case 8:
1194			break;
1195		default:
1196			return -EINVAL;
1197		}
1198		zero_padding(p_vp8_frame->segment);
1199		zero_padding(p_vp8_frame->lf);
1200		zero_padding(p_vp8_frame->quant);
1201		zero_padding(p_vp8_frame->entropy);
1202		zero_padding(p_vp8_frame->coder_state);
1203		break;
1204
1205	case V4L2_CTRL_TYPE_HEVC_SPS:
1206		p_hevc_sps = p;
1207
1208		if (!(p_hevc_sps->flags & V4L2_HEVC_SPS_FLAG_PCM_ENABLED)) {
1209			p_hevc_sps->pcm_sample_bit_depth_luma_minus1 = 0;
1210			p_hevc_sps->pcm_sample_bit_depth_chroma_minus1 = 0;
1211			p_hevc_sps->log2_min_pcm_luma_coding_block_size_minus3 = 0;
1212			p_hevc_sps->log2_diff_max_min_pcm_luma_coding_block_size = 0;
1213		}
1214
1215		if (!(p_hevc_sps->flags &
1216		      V4L2_HEVC_SPS_FLAG_LONG_TERM_REF_PICS_PRESENT))
1217			p_hevc_sps->num_long_term_ref_pics_sps = 0;
1218		break;
1219
1220	case V4L2_CTRL_TYPE_HEVC_PPS:
1221		p_hevc_pps = p;
1222
1223		if (!(p_hevc_pps->flags &
1224		      V4L2_HEVC_PPS_FLAG_CU_QP_DELTA_ENABLED))
1225			p_hevc_pps->diff_cu_qp_delta_depth = 0;
1226
1227		if (!(p_hevc_pps->flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED)) {
1228			p_hevc_pps->num_tile_columns_minus1 = 0;
1229			p_hevc_pps->num_tile_rows_minus1 = 0;
1230			memset(&p_hevc_pps->column_width_minus1, 0,
1231			       sizeof(p_hevc_pps->column_width_minus1));
1232			memset(&p_hevc_pps->row_height_minus1, 0,
1233			       sizeof(p_hevc_pps->row_height_minus1));
1234
1235			p_hevc_pps->flags &=
1236				~V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED;
1237		}
1238
1239		if (p_hevc_pps->flags &
1240		    V4L2_HEVC_PPS_FLAG_PPS_DISABLE_DEBLOCKING_FILTER) {
1241			p_hevc_pps->pps_beta_offset_div2 = 0;
1242			p_hevc_pps->pps_tc_offset_div2 = 0;
1243		}
1244		break;
1245
1246	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
1247		p_hevc_decode_params = p;
1248
1249		if (p_hevc_decode_params->num_active_dpb_entries >
1250		    V4L2_HEVC_DPB_ENTRIES_NUM_MAX)
1251			return -EINVAL;
1252		break;
1253
1254	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
1255		break;
1256
1257	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
1258		break;
1259
1260	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
1261		p_hdr10_mastering = p;
1262
1263		for (i = 0; i < 3; ++i) {
1264			if (p_hdr10_mastering->display_primaries_x[i] <
1265				V4L2_HDR10_MASTERING_PRIMARIES_X_LOW ||
1266			    p_hdr10_mastering->display_primaries_x[i] >
1267				V4L2_HDR10_MASTERING_PRIMARIES_X_HIGH ||
1268			    p_hdr10_mastering->display_primaries_y[i] <
1269				V4L2_HDR10_MASTERING_PRIMARIES_Y_LOW ||
1270			    p_hdr10_mastering->display_primaries_y[i] >
1271				V4L2_HDR10_MASTERING_PRIMARIES_Y_HIGH)
1272				return -EINVAL;
1273		}
1274
1275		if (p_hdr10_mastering->white_point_x <
1276			V4L2_HDR10_MASTERING_WHITE_POINT_X_LOW ||
1277		    p_hdr10_mastering->white_point_x >
1278			V4L2_HDR10_MASTERING_WHITE_POINT_X_HIGH ||
1279		    p_hdr10_mastering->white_point_y <
1280			V4L2_HDR10_MASTERING_WHITE_POINT_Y_LOW ||
1281		    p_hdr10_mastering->white_point_y >
1282			V4L2_HDR10_MASTERING_WHITE_POINT_Y_HIGH)
1283			return -EINVAL;
1284
1285		if (p_hdr10_mastering->max_display_mastering_luminance <
1286			V4L2_HDR10_MASTERING_MAX_LUMA_LOW ||
1287		    p_hdr10_mastering->max_display_mastering_luminance >
1288			V4L2_HDR10_MASTERING_MAX_LUMA_HIGH ||
1289		    p_hdr10_mastering->min_display_mastering_luminance <
1290			V4L2_HDR10_MASTERING_MIN_LUMA_LOW ||
1291		    p_hdr10_mastering->min_display_mastering_luminance >
1292			V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
1293			return -EINVAL;
1294
1295		/* The following restriction comes from ITU-T Rec. H.265 spec */
1296		if (p_hdr10_mastering->max_display_mastering_luminance ==
1297			V4L2_HDR10_MASTERING_MAX_LUMA_LOW &&
1298		    p_hdr10_mastering->min_display_mastering_luminance ==
1299			V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
1300			return -EINVAL;
1301
1302		break;
1303
1304	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
1305		break;
1306
1307	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
1308		return validate_vp9_compressed_hdr(p);
1309
1310	case V4L2_CTRL_TYPE_VP9_FRAME:
1311		return validate_vp9_frame(p);
1312	case V4L2_CTRL_TYPE_AV1_FRAME:
1313		return validate_av1_frame(p);
1314	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
1315		return validate_av1_sequence(p);
1316	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
1317		break;
1318	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
1319		return validate_av1_film_grain(p);
1320
1321	case V4L2_CTRL_TYPE_AREA:
1322		area = p;
1323		if (!area->width || !area->height)
1324			return -EINVAL;
1325		break;
1326
1327	case V4L2_CTRL_TYPE_RECT:
1328		rect = p;
1329		if (!rect->width || !rect->height)
1330			return -EINVAL;
1331		break;
1332
1333	default:
1334		return -EINVAL;
1335	}
1336
1337	return 0;
1338}
1339
1340static int std_validate_elem(const struct v4l2_ctrl *ctrl, u32 idx,
1341			     union v4l2_ctrl_ptr ptr)
1342{
1343	size_t len;
1344	u64 offset;
1345	s64 val;
1346
1347	switch ((u32)ctrl->type) {
1348	case V4L2_CTRL_TYPE_INTEGER:
1349		return ROUND_TO_RANGE(ptr.p_s32[idx], u32, ctrl);
1350	case V4L2_CTRL_TYPE_INTEGER64:
1351		/*
1352		 * We can't use the ROUND_TO_RANGE define here due to
1353		 * the u64 divide that needs special care.
1354		 */
1355		val = ptr.p_s64[idx];
1356		if (ctrl->maximum >= 0 && val >= ctrl->maximum - (s64)(ctrl->step / 2))
1357			val = ctrl->maximum;
1358		else
1359			val += (s64)(ctrl->step / 2);
1360		val = clamp_t(s64, val, ctrl->minimum, ctrl->maximum);
1361		offset = val - ctrl->minimum;
1362		do_div(offset, ctrl->step);
1363		ptr.p_s64[idx] = ctrl->minimum + offset * ctrl->step;
1364		return 0;
1365	case V4L2_CTRL_TYPE_U8:
1366		return ROUND_TO_RANGE(ptr.p_u8[idx], u8, ctrl);
1367	case V4L2_CTRL_TYPE_U16:
1368		return ROUND_TO_RANGE(ptr.p_u16[idx], u16, ctrl);
1369	case V4L2_CTRL_TYPE_U32:
1370		return ROUND_TO_RANGE(ptr.p_u32[idx], u32, ctrl);
1371
1372	case V4L2_CTRL_TYPE_BOOLEAN:
1373		ptr.p_s32[idx] = !!ptr.p_s32[idx];
1374		return 0;
1375
1376	case V4L2_CTRL_TYPE_MENU:
1377	case V4L2_CTRL_TYPE_INTEGER_MENU:
1378		if (ptr.p_s32[idx] < ctrl->minimum || ptr.p_s32[idx] > ctrl->maximum)
1379			return -ERANGE;
1380		if (ptr.p_s32[idx] < BITS_PER_LONG_LONG &&
1381		    (ctrl->menu_skip_mask & BIT_ULL(ptr.p_s32[idx])))
1382			return -EINVAL;
1383		if (ctrl->type == V4L2_CTRL_TYPE_MENU &&
1384		    ctrl->qmenu[ptr.p_s32[idx]][0] == '\0')
1385			return -EINVAL;
1386		return 0;
1387
1388	case V4L2_CTRL_TYPE_BITMASK:
1389		ptr.p_s32[idx] &= ctrl->maximum;
1390		return 0;
1391
1392	case V4L2_CTRL_TYPE_BUTTON:
1393	case V4L2_CTRL_TYPE_CTRL_CLASS:
1394		ptr.p_s32[idx] = 0;
1395		return 0;
1396
1397	case V4L2_CTRL_TYPE_STRING:
1398		idx *= ctrl->elem_size;
1399		len = strlen(ptr.p_char + idx);
1400		if (len < ctrl->minimum)
1401			return -ERANGE;
1402		if ((len - (u32)ctrl->minimum) % (u32)ctrl->step)
1403			return -ERANGE;
1404		return 0;
1405
1406	default:
1407		return std_validate_compound(ctrl, idx, ptr);
1408	}
1409}
1410
1411int v4l2_ctrl_type_op_validate(const struct v4l2_ctrl *ctrl,
1412			       union v4l2_ctrl_ptr ptr)
1413{
1414	unsigned int i;
1415	int ret = 0;
1416
1417	switch ((u32)ctrl->type) {
1418	case V4L2_CTRL_TYPE_U8:
1419		if (ctrl->maximum == 0xff && ctrl->minimum == 0 && ctrl->step == 1)
1420			return 0;
1421		break;
1422	case V4L2_CTRL_TYPE_U16:
1423		if (ctrl->maximum == 0xffff && ctrl->minimum == 0 && ctrl->step == 1)
1424			return 0;
1425		break;
1426	case V4L2_CTRL_TYPE_U32:
1427		if (ctrl->maximum == 0xffffffff && ctrl->minimum == 0 && ctrl->step == 1)
1428			return 0;
1429		break;
1430
1431	case V4L2_CTRL_TYPE_BUTTON:
1432	case V4L2_CTRL_TYPE_CTRL_CLASS:
1433		memset(ptr.p_s32, 0, ctrl->new_elems * sizeof(s32));
1434		return 0;
1435	}
1436
1437	for (i = 0; !ret && i < ctrl->new_elems; i++)
1438		ret = std_validate_elem(ctrl, i, ptr);
1439	return ret;
1440}
1441EXPORT_SYMBOL(v4l2_ctrl_type_op_validate);
1442
1443static const struct v4l2_ctrl_type_ops std_type_ops = {
1444	.equal = v4l2_ctrl_type_op_equal,
1445	.init = v4l2_ctrl_type_op_init,
1446	.minimum = v4l2_ctrl_type_op_minimum,
1447	.maximum = v4l2_ctrl_type_op_maximum,
1448	.log = v4l2_ctrl_type_op_log,
1449	.validate = v4l2_ctrl_type_op_validate,
1450};
1451
1452void v4l2_ctrl_notify(struct v4l2_ctrl *ctrl, v4l2_ctrl_notify_fnc notify, void *priv)
1453{
1454	if (!ctrl)
1455		return;
1456	if (!notify) {
1457		ctrl->call_notify = 0;
1458		return;
1459	}
1460	if (WARN_ON(ctrl->handler->notify && ctrl->handler->notify != notify))
1461		return;
1462	ctrl->handler->notify = notify;
1463	ctrl->handler->notify_priv = priv;
1464	ctrl->call_notify = 1;
1465}
1466EXPORT_SYMBOL(v4l2_ctrl_notify);
1467
1468/* Copy the one value to another. */
1469static void ptr_to_ptr(struct v4l2_ctrl *ctrl,
1470		       union v4l2_ctrl_ptr from, union v4l2_ctrl_ptr to,
1471		       unsigned int elems)
1472{
1473	if (ctrl == NULL)
1474		return;
1475	memcpy(to.p, from.p_const, elems * ctrl->elem_size);
1476}
1477
1478/* Copy the new value to the current value. */
1479void new_to_cur(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
1480{
1481	bool changed;
1482
1483	if (ctrl == NULL)
1484		return;
1485
1486	/* has_changed is set by cluster_changed */
1487	changed = ctrl->has_changed;
1488	if (changed) {
1489		if (ctrl->is_dyn_array)
1490			ctrl->elems = ctrl->new_elems;
1491		ptr_to_ptr(ctrl, ctrl->p_new, ctrl->p_cur, ctrl->elems);
1492	}
1493
1494	if (ch_flags & V4L2_EVENT_CTRL_CH_FLAGS) {
1495		/* Note: CH_FLAGS is only set for auto clusters. */
1496		ctrl->flags &=
1497			~(V4L2_CTRL_FLAG_INACTIVE | V4L2_CTRL_FLAG_VOLATILE);
1498		if (!is_cur_manual(ctrl->cluster[0])) {
1499			ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
1500			if (ctrl->cluster[0]->has_volatiles)
1501				ctrl->flags |= V4L2_CTRL_FLAG_VOLATILE;
1502		}
1503		fh = NULL;
1504	}
1505	if (changed || ch_flags) {
1506		/* If a control was changed that was not one of the controls
1507		   modified by the application, then send the event to all. */
1508		if (!ctrl->is_new)
1509			fh = NULL;
1510		send_event(fh, ctrl,
1511			(changed ? V4L2_EVENT_CTRL_CH_VALUE : 0) | ch_flags);
1512		if (ctrl->call_notify && changed && ctrl->handler->notify)
1513			ctrl->handler->notify(ctrl, ctrl->handler->notify_priv);
1514	}
1515}
1516
1517/* Copy the current value to the new value */
1518void cur_to_new(struct v4l2_ctrl *ctrl)
1519{
1520	if (ctrl == NULL)
1521		return;
1522	if (ctrl->is_dyn_array)
1523		ctrl->new_elems = ctrl->elems;
1524	ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new, ctrl->new_elems);
1525}
1526
1527static bool req_alloc_array(struct v4l2_ctrl_ref *ref, u32 elems)
1528{
1529	void *tmp;
1530
1531	if (elems == ref->p_req_array_alloc_elems)
1532		return true;
1533	if (ref->ctrl->is_dyn_array &&
1534	    elems < ref->p_req_array_alloc_elems)
1535		return true;
1536
1537	tmp = kvmalloc(elems * ref->ctrl->elem_size, GFP_KERNEL);
1538
1539	if (!tmp) {
1540		ref->p_req_array_enomem = true;
1541		return false;
1542	}
1543	ref->p_req_array_enomem = false;
1544	kvfree(ref->p_req.p);
1545	ref->p_req.p = tmp;
1546	ref->p_req_array_alloc_elems = elems;
1547	return true;
1548}
1549
1550/* Copy the new value to the request value */
1551void new_to_req(struct v4l2_ctrl_ref *ref)
1552{
1553	struct v4l2_ctrl *ctrl;
1554
1555	if (!ref)
1556		return;
1557
1558	ctrl = ref->ctrl;
1559	if (ctrl->is_array && !req_alloc_array(ref, ctrl->new_elems))
1560		return;
1561
1562	ref->p_req_elems = ctrl->new_elems;
1563	ptr_to_ptr(ctrl, ctrl->p_new, ref->p_req, ref->p_req_elems);
1564	ref->p_req_valid = true;
1565}
1566
1567/* Copy the current value to the request value */
1568void cur_to_req(struct v4l2_ctrl_ref *ref)
1569{
1570	struct v4l2_ctrl *ctrl;
1571
1572	if (!ref)
1573		return;
1574
1575	ctrl = ref->ctrl;
1576	if (ctrl->is_array && !req_alloc_array(ref, ctrl->elems))
1577		return;
1578
1579	ref->p_req_elems = ctrl->elems;
1580	ptr_to_ptr(ctrl, ctrl->p_cur, ref->p_req, ctrl->elems);
1581	ref->p_req_valid = true;
1582}
1583
1584/* Copy the request value to the new value */
1585int req_to_new(struct v4l2_ctrl_ref *ref)
1586{
1587	struct v4l2_ctrl *ctrl;
1588
1589	if (!ref)
1590		return 0;
1591
1592	ctrl = ref->ctrl;
1593
1594	/*
1595	 * This control was never set in the request, so just use the current
1596	 * value.
1597	 */
1598	if (!ref->p_req_valid) {
1599		if (ctrl->is_dyn_array)
1600			ctrl->new_elems = ctrl->elems;
1601		ptr_to_ptr(ctrl, ctrl->p_cur, ctrl->p_new, ctrl->new_elems);
1602		return 0;
1603	}
1604
1605	/* Not an array, so just copy the request value */
1606	if (!ctrl->is_array) {
1607		ptr_to_ptr(ctrl, ref->p_req, ctrl->p_new, ctrl->new_elems);
1608		return 0;
1609	}
1610
1611	/* Sanity check, should never happen */
1612	if (WARN_ON(!ref->p_req_array_alloc_elems))
1613		return -ENOMEM;
1614
1615	if (!ctrl->is_dyn_array &&
1616	    ref->p_req_elems != ctrl->p_array_alloc_elems)
1617		return -ENOMEM;
1618
1619	/*
1620	 * Check if the number of elements in the request is more than the
1621	 * elements in ctrl->p_array. If so, attempt to realloc ctrl->p_array.
1622	 * Note that p_array is allocated with twice the number of elements
1623	 * in the dynamic array since it has to store both the current and
1624	 * new value of such a control.
1625	 */
1626	if (ref->p_req_elems > ctrl->p_array_alloc_elems) {
1627		unsigned int sz = ref->p_req_elems * ctrl->elem_size;
1628		void *old = ctrl->p_array;
1629		void *tmp = kvzalloc(2 * sz, GFP_KERNEL);
1630
1631		if (!tmp)
1632			return -ENOMEM;
1633		memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size);
1634		memcpy(tmp + sz, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size);
1635		ctrl->p_new.p = tmp;
1636		ctrl->p_cur.p = tmp + sz;
1637		ctrl->p_array = tmp;
1638		ctrl->p_array_alloc_elems = ref->p_req_elems;
1639		kvfree(old);
1640	}
1641
1642	ctrl->new_elems = ref->p_req_elems;
1643	ptr_to_ptr(ctrl, ref->p_req, ctrl->p_new, ctrl->new_elems);
1644	return 0;
1645}
1646
1647/* Control range checking */
1648int check_range(enum v4l2_ctrl_type type,
1649		s64 min, s64 max, u64 step, s64 def)
1650{
1651	switch (type) {
1652	case V4L2_CTRL_TYPE_BOOLEAN:
1653		if (step != 1 || max > 1 || min < 0)
1654			return -ERANGE;
1655		fallthrough;
1656	case V4L2_CTRL_TYPE_U8:
1657	case V4L2_CTRL_TYPE_U16:
1658	case V4L2_CTRL_TYPE_U32:
1659	case V4L2_CTRL_TYPE_INTEGER:
1660	case V4L2_CTRL_TYPE_INTEGER64:
1661		if (step == 0 || min > max || def < min || def > max)
1662			return -ERANGE;
1663		return 0;
1664	case V4L2_CTRL_TYPE_BITMASK:
1665		if (step || min || !max || (def & ~max))
1666			return -ERANGE;
1667		return 0;
1668	case V4L2_CTRL_TYPE_MENU:
1669	case V4L2_CTRL_TYPE_INTEGER_MENU:
1670		if (min > max || def < min || def > max ||
1671		    min < 0 || (step && max >= BITS_PER_LONG_LONG))
1672			return -ERANGE;
1673		/* Note: step == menu_skip_mask for menu controls.
1674		   So here we check if the default value is masked out. */
1675		if (def < BITS_PER_LONG_LONG && (step & BIT_ULL(def)))
1676			return -EINVAL;
1677		return 0;
1678	case V4L2_CTRL_TYPE_STRING:
1679		if (min > max || min < 0 || step < 1 || def)
1680			return -ERANGE;
1681		return 0;
1682	default:
1683		return 0;
1684	}
1685}
1686
1687/* Set the handler's error code if it wasn't set earlier already */
1688static inline int handler_set_err(struct v4l2_ctrl_handler *hdl, int err)
1689{
1690	if (hdl->error == 0)
1691		hdl->error = err;
1692	return err;
1693}
1694
1695/* Initialize the handler */
1696int v4l2_ctrl_handler_init_class(struct v4l2_ctrl_handler *hdl,
1697				 unsigned nr_of_controls_hint,
1698				 struct lock_class_key *key, const char *name)
1699{
1700	mutex_init(&hdl->_lock);
1701	hdl->lock = &hdl->_lock;
1702	lockdep_set_class_and_name(hdl->lock, key, name);
1703	INIT_LIST_HEAD(&hdl->ctrls);
1704	INIT_LIST_HEAD(&hdl->ctrl_refs);
1705	hdl->nr_of_buckets = 1 + nr_of_controls_hint / 8;
1706	hdl->buckets = kvcalloc(hdl->nr_of_buckets, sizeof(hdl->buckets[0]),
1707				GFP_KERNEL);
1708	hdl->error = hdl->buckets ? 0 : -ENOMEM;
1709	v4l2_ctrl_handler_init_request(hdl);
1710	return hdl->error;
1711}
1712EXPORT_SYMBOL(v4l2_ctrl_handler_init_class);
1713
1714/* Free all controls and control refs */
1715int v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl)
1716{
1717	struct v4l2_ctrl_ref *ref, *next_ref;
1718	struct v4l2_ctrl *ctrl, *next_ctrl;
1719	struct v4l2_subscribed_event *sev, *next_sev;
1720
1721	if (!hdl)
1722		return 0;
1723
1724	if (!hdl->buckets)
1725		return hdl->error;
1726
1727	v4l2_ctrl_handler_free_request(hdl);
1728
1729	mutex_lock(hdl->lock);
1730	/* Free all nodes */
1731	list_for_each_entry_safe(ref, next_ref, &hdl->ctrl_refs, node) {
1732		list_del(&ref->node);
1733		if (ref->p_req_array_alloc_elems)
1734			kvfree(ref->p_req.p);
1735		kfree(ref);
1736	}
1737	/* Free all controls owned by the handler */
1738	list_for_each_entry_safe(ctrl, next_ctrl, &hdl->ctrls, node) {
1739		list_del(&ctrl->node);
1740		list_for_each_entry_safe(sev, next_sev, &ctrl->ev_subs, node)
1741			list_del(&sev->node);
1742		kvfree(ctrl->p_array);
1743		kvfree(ctrl);
1744	}
1745	kvfree(hdl->buckets);
1746	hdl->buckets = NULL;
1747	hdl->cached = NULL;
1748	mutex_unlock(hdl->lock);
1749	mutex_destroy(&hdl->_lock);
1750
1751	return hdl->error;
1752}
1753EXPORT_SYMBOL(v4l2_ctrl_handler_free);
1754
1755/* For backwards compatibility: V4L2_CID_PRIVATE_BASE should no longer
1756   be used except in G_CTRL, S_CTRL, QUERYCTRL and QUERYMENU when dealing
1757   with applications that do not use the NEXT_CTRL flag.
1758
1759   We just find the n-th private user control. It's O(N), but that should not
1760   be an issue in this particular case. */
1761static struct v4l2_ctrl_ref *find_private_ref(
1762		struct v4l2_ctrl_handler *hdl, u32 id)
1763{
1764	struct v4l2_ctrl_ref *ref;
1765
1766	id -= V4L2_CID_PRIVATE_BASE;
1767	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1768		/* Search for private user controls that are compatible with
1769		   VIDIOC_G/S_CTRL. */
1770		if (V4L2_CTRL_ID2WHICH(ref->ctrl->id) == V4L2_CTRL_CLASS_USER &&
1771		    V4L2_CTRL_DRIVER_PRIV(ref->ctrl->id)) {
1772			if (!ref->ctrl->is_int)
1773				continue;
1774			if (id == 0)
1775				return ref;
1776			id--;
1777		}
1778	}
1779	return NULL;
1780}
1781
1782/* Find a control with the given ID. */
1783struct v4l2_ctrl_ref *find_ref(struct v4l2_ctrl_handler *hdl, u32 id)
1784{
1785	struct v4l2_ctrl_ref *ref;
1786	int bucket;
1787
1788	id &= V4L2_CTRL_ID_MASK;
1789
1790	/* Old-style private controls need special handling */
1791	if (id >= V4L2_CID_PRIVATE_BASE)
1792		return find_private_ref(hdl, id);
1793	bucket = id % hdl->nr_of_buckets;
1794
1795	/* Simple optimization: cache the last control found */
1796	if (hdl->cached && hdl->cached->ctrl->id == id)
1797		return hdl->cached;
1798
1799	/* Not in cache, search the hash */
1800	ref = hdl->buckets ? hdl->buckets[bucket] : NULL;
1801	while (ref && ref->ctrl->id != id)
1802		ref = ref->next;
1803
1804	if (ref)
1805		hdl->cached = ref; /* cache it! */
1806	return ref;
1807}
1808
1809/* Find a control with the given ID. Take the handler's lock first. */
1810struct v4l2_ctrl_ref *find_ref_lock(struct v4l2_ctrl_handler *hdl, u32 id)
1811{
1812	struct v4l2_ctrl_ref *ref = NULL;
1813
1814	if (hdl) {
1815		mutex_lock(hdl->lock);
1816		ref = find_ref(hdl, id);
1817		mutex_unlock(hdl->lock);
1818	}
1819	return ref;
1820}
1821
1822/* Find a control with the given ID. */
1823struct v4l2_ctrl *v4l2_ctrl_find(struct v4l2_ctrl_handler *hdl, u32 id)
1824{
1825	struct v4l2_ctrl_ref *ref = find_ref_lock(hdl, id);
1826
1827	return ref ? ref->ctrl : NULL;
1828}
1829EXPORT_SYMBOL(v4l2_ctrl_find);
1830
1831/* Allocate a new v4l2_ctrl_ref and hook it into the handler. */
1832int handler_new_ref(struct v4l2_ctrl_handler *hdl,
1833		    struct v4l2_ctrl *ctrl,
1834		    struct v4l2_ctrl_ref **ctrl_ref,
1835		    bool from_other_dev, bool allocate_req)
1836{
1837	struct v4l2_ctrl_ref *ref;
1838	struct v4l2_ctrl_ref *new_ref;
1839	u32 id = ctrl->id;
1840	u32 class_ctrl = V4L2_CTRL_ID2WHICH(id) | 1;
1841	int bucket = id % hdl->nr_of_buckets;	/* which bucket to use */
1842	unsigned int size_extra_req = 0;
1843
1844	if (ctrl_ref)
1845		*ctrl_ref = NULL;
1846
1847	/*
1848	 * Automatically add the control class if it is not yet present and
1849	 * the new control is not a compound control.
1850	 */
1851	if (ctrl->type < V4L2_CTRL_COMPOUND_TYPES &&
1852	    id != class_ctrl && find_ref_lock(hdl, class_ctrl) == NULL)
1853		if (!v4l2_ctrl_new_std(hdl, NULL, class_ctrl, 0, 0, 0, 0))
1854			return hdl->error;
1855
1856	if (hdl->error)
1857		return hdl->error;
1858
1859	if (allocate_req && !ctrl->is_array)
1860		size_extra_req = ctrl->elems * ctrl->elem_size;
1861	new_ref = kzalloc(sizeof(*new_ref) + size_extra_req, GFP_KERNEL);
1862	if (!new_ref)
1863		return handler_set_err(hdl, -ENOMEM);
1864	new_ref->ctrl = ctrl;
1865	new_ref->from_other_dev = from_other_dev;
1866	if (size_extra_req)
1867		new_ref->p_req.p = &new_ref[1];
1868
1869	INIT_LIST_HEAD(&new_ref->node);
1870
1871	mutex_lock(hdl->lock);
1872
1873	/* Add immediately at the end of the list if the list is empty, or if
1874	   the last element in the list has a lower ID.
1875	   This ensures that when elements are added in ascending order the
1876	   insertion is an O(1) operation. */
1877	if (list_empty(&hdl->ctrl_refs) || id > node2id(hdl->ctrl_refs.prev)) {
1878		list_add_tail(&new_ref->node, &hdl->ctrl_refs);
1879		goto insert_in_hash;
1880	}
1881
1882	/* Find insert position in sorted list */
1883	list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1884		if (ref->ctrl->id < id)
1885			continue;
1886		/* Don't add duplicates */
1887		if (ref->ctrl->id == id) {
1888			kfree(new_ref);
1889			goto unlock;
1890		}
1891		list_add(&new_ref->node, ref->node.prev);
1892		break;
1893	}
1894
1895insert_in_hash:
1896	/* Insert the control node in the hash */
1897	new_ref->next = hdl->buckets[bucket];
1898	hdl->buckets[bucket] = new_ref;
1899	if (ctrl_ref)
1900		*ctrl_ref = new_ref;
1901	if (ctrl->handler == hdl) {
1902		/* By default each control starts in a cluster of its own.
1903		 * new_ref->ctrl is basically a cluster array with one
1904		 * element, so that's perfect to use as the cluster pointer.
1905		 * But only do this for the handler that owns the control.
1906		 */
1907		ctrl->cluster = &new_ref->ctrl;
1908		ctrl->ncontrols = 1;
1909	}
1910
1911unlock:
1912	mutex_unlock(hdl->lock);
1913	return 0;
1914}
1915
1916/* Add a new control */
1917static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl,
1918			const struct v4l2_ctrl_ops *ops,
1919			const struct v4l2_ctrl_type_ops *type_ops,
1920			u32 id, const char *name, enum v4l2_ctrl_type type,
1921			s64 min, s64 max, u64 step, s64 def,
1922			const u32 dims[V4L2_CTRL_MAX_DIMS], u32 elem_size,
1923			u32 flags, const char * const *qmenu,
1924			const s64 *qmenu_int,
1925			const union v4l2_ctrl_ptr p_def,
1926			const union v4l2_ctrl_ptr p_min,
1927			const union v4l2_ctrl_ptr p_max,
1928			void *priv)
1929{
1930	struct v4l2_ctrl *ctrl;
1931	unsigned sz_extra;
1932	unsigned nr_of_dims = 0;
1933	unsigned elems = 1;
1934	bool is_array;
1935	unsigned tot_ctrl_size;
1936	void *data;
1937	int err;
1938
1939	if (hdl->error)
1940		return NULL;
1941
1942	while (dims && dims[nr_of_dims]) {
1943		elems *= dims[nr_of_dims];
1944		nr_of_dims++;
1945		if (nr_of_dims == V4L2_CTRL_MAX_DIMS)
1946			break;
1947	}
1948	is_array = nr_of_dims > 0;
1949
1950	/* Prefill elem_size for all types handled by std_type_ops */
1951	switch ((u32)type) {
1952	case V4L2_CTRL_TYPE_INTEGER64:
1953		elem_size = sizeof(s64);
1954		break;
1955	case V4L2_CTRL_TYPE_STRING:
1956		elem_size = max + 1;
1957		break;
1958	case V4L2_CTRL_TYPE_U8:
1959		elem_size = sizeof(u8);
1960		break;
1961	case V4L2_CTRL_TYPE_U16:
1962		elem_size = sizeof(u16);
1963		break;
1964	case V4L2_CTRL_TYPE_U32:
1965		elem_size = sizeof(u32);
1966		break;
1967	case V4L2_CTRL_TYPE_MPEG2_SEQUENCE:
1968		elem_size = sizeof(struct v4l2_ctrl_mpeg2_sequence);
1969		break;
1970	case V4L2_CTRL_TYPE_MPEG2_PICTURE:
1971		elem_size = sizeof(struct v4l2_ctrl_mpeg2_picture);
1972		break;
1973	case V4L2_CTRL_TYPE_MPEG2_QUANTISATION:
1974		elem_size = sizeof(struct v4l2_ctrl_mpeg2_quantisation);
1975		break;
1976	case V4L2_CTRL_TYPE_FWHT_PARAMS:
1977		elem_size = sizeof(struct v4l2_ctrl_fwht_params);
1978		break;
1979	case V4L2_CTRL_TYPE_H264_SPS:
1980		elem_size = sizeof(struct v4l2_ctrl_h264_sps);
1981		break;
1982	case V4L2_CTRL_TYPE_H264_PPS:
1983		elem_size = sizeof(struct v4l2_ctrl_h264_pps);
1984		break;
1985	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
1986		elem_size = sizeof(struct v4l2_ctrl_h264_scaling_matrix);
1987		break;
1988	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
1989		elem_size = sizeof(struct v4l2_ctrl_h264_slice_params);
1990		break;
1991	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
1992		elem_size = sizeof(struct v4l2_ctrl_h264_decode_params);
1993		break;
1994	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
1995		elem_size = sizeof(struct v4l2_ctrl_h264_pred_weights);
1996		break;
1997	case V4L2_CTRL_TYPE_VP8_FRAME:
1998		elem_size = sizeof(struct v4l2_ctrl_vp8_frame);
1999		break;
2000	case V4L2_CTRL_TYPE_HEVC_SPS:
2001		elem_size = sizeof(struct v4l2_ctrl_hevc_sps);
2002		break;
2003	case V4L2_CTRL_TYPE_HEVC_PPS:
2004		elem_size = sizeof(struct v4l2_ctrl_hevc_pps);
2005		break;
2006	case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS:
2007		elem_size = sizeof(struct v4l2_ctrl_hevc_slice_params);
2008		break;
2009	case V4L2_CTRL_TYPE_HEVC_SCALING_MATRIX:
2010		elem_size = sizeof(struct v4l2_ctrl_hevc_scaling_matrix);
2011		break;
2012	case V4L2_CTRL_TYPE_HEVC_DECODE_PARAMS:
2013		elem_size = sizeof(struct v4l2_ctrl_hevc_decode_params);
2014		break;
2015	case V4L2_CTRL_TYPE_HDR10_CLL_INFO:
2016		elem_size = sizeof(struct v4l2_ctrl_hdr10_cll_info);
2017		break;
2018	case V4L2_CTRL_TYPE_HDR10_MASTERING_DISPLAY:
2019		elem_size = sizeof(struct v4l2_ctrl_hdr10_mastering_display);
2020		break;
2021	case V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR:
2022		elem_size = sizeof(struct v4l2_ctrl_vp9_compressed_hdr);
2023		break;
2024	case V4L2_CTRL_TYPE_VP9_FRAME:
2025		elem_size = sizeof(struct v4l2_ctrl_vp9_frame);
2026		break;
2027	case V4L2_CTRL_TYPE_AV1_SEQUENCE:
2028		elem_size = sizeof(struct v4l2_ctrl_av1_sequence);
2029		break;
2030	case V4L2_CTRL_TYPE_AV1_TILE_GROUP_ENTRY:
2031		elem_size = sizeof(struct v4l2_ctrl_av1_tile_group_entry);
2032		break;
2033	case V4L2_CTRL_TYPE_AV1_FRAME:
2034		elem_size = sizeof(struct v4l2_ctrl_av1_frame);
2035		break;
2036	case V4L2_CTRL_TYPE_AV1_FILM_GRAIN:
2037		elem_size = sizeof(struct v4l2_ctrl_av1_film_grain);
2038		break;
2039	case V4L2_CTRL_TYPE_AREA:
2040		elem_size = sizeof(struct v4l2_area);
2041		break;
2042	case V4L2_CTRL_TYPE_RECT:
2043		elem_size = sizeof(struct v4l2_rect);
2044		break;
2045	default:
2046		if (type < V4L2_CTRL_COMPOUND_TYPES)
2047			elem_size = sizeof(s32);
2048		break;
2049	}
2050
2051	if (type < V4L2_CTRL_COMPOUND_TYPES &&
2052	    type != V4L2_CTRL_TYPE_BUTTON &&
2053	    type != V4L2_CTRL_TYPE_CTRL_CLASS &&
2054	    type != V4L2_CTRL_TYPE_STRING)
2055		flags |= V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX;
2056
2057	/* Sanity checks */
2058	if (id == 0 || name == NULL || !elem_size ||
2059	    id >= V4L2_CID_PRIVATE_BASE ||
2060	    (type == V4L2_CTRL_TYPE_MENU && qmenu == NULL) ||
2061	    (type == V4L2_CTRL_TYPE_INTEGER_MENU && qmenu_int == NULL)) {
2062		handler_set_err(hdl, -ERANGE);
2063		return NULL;
2064	}
2065
2066	err = check_range(type, min, max, step, def);
2067	if (err) {
2068		handler_set_err(hdl, err);
2069		return NULL;
2070	}
2071	if (is_array &&
2072	    (type == V4L2_CTRL_TYPE_BUTTON ||
2073	     type == V4L2_CTRL_TYPE_CTRL_CLASS)) {
2074		handler_set_err(hdl, -EINVAL);
2075		return NULL;
2076	}
2077	if (flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY) {
2078		/*
2079		 * For now only support this for one-dimensional arrays only.
2080		 *
2081		 * This can be relaxed in the future, but this will
2082		 * require more effort.
2083		 */
2084		if (nr_of_dims != 1) {
2085			handler_set_err(hdl, -EINVAL);
2086			return NULL;
2087		}
2088		/* Start with just 1 element */
2089		elems = 1;
2090	}
2091
2092	tot_ctrl_size = elem_size * elems;
2093	sz_extra = 0;
2094	if (type == V4L2_CTRL_TYPE_BUTTON)
2095		flags |= V4L2_CTRL_FLAG_WRITE_ONLY |
2096			V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
2097	else if (type == V4L2_CTRL_TYPE_CTRL_CLASS)
2098		flags |= V4L2_CTRL_FLAG_READ_ONLY;
2099	else if (!is_array &&
2100		 (type == V4L2_CTRL_TYPE_INTEGER64 ||
2101		  type == V4L2_CTRL_TYPE_STRING ||
2102		  type >= V4L2_CTRL_COMPOUND_TYPES))
2103		sz_extra += 2 * tot_ctrl_size;
2104
2105	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const)
2106		sz_extra += elem_size;
2107	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_min.p_const)
2108		sz_extra += elem_size;
2109	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_max.p_const)
2110		sz_extra += elem_size;
2111
2112	ctrl = kvzalloc(sizeof(*ctrl) + sz_extra, GFP_KERNEL);
2113	if (ctrl == NULL) {
2114		handler_set_err(hdl, -ENOMEM);
2115		return NULL;
2116	}
2117
2118	INIT_LIST_HEAD(&ctrl->node);
2119	INIT_LIST_HEAD(&ctrl->ev_subs);
2120	ctrl->handler = hdl;
2121	ctrl->ops = ops;
2122	ctrl->type_ops = type_ops ? type_ops : &std_type_ops;
2123	ctrl->id = id;
2124	ctrl->name = name;
2125	ctrl->type = type;
2126	ctrl->flags = flags;
2127	ctrl->minimum = min;
2128	ctrl->maximum = max;
2129	ctrl->step = step;
2130	ctrl->default_value = def;
2131	ctrl->is_string = !is_array && type == V4L2_CTRL_TYPE_STRING;
2132	ctrl->is_ptr = is_array || type >= V4L2_CTRL_COMPOUND_TYPES || ctrl->is_string;
2133	ctrl->is_int = !ctrl->is_ptr && type != V4L2_CTRL_TYPE_INTEGER64;
2134	ctrl->is_array = is_array;
2135	ctrl->is_dyn_array = !!(flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY);
2136	ctrl->elems = elems;
2137	ctrl->new_elems = elems;
2138	ctrl->nr_of_dims = nr_of_dims;
2139	if (nr_of_dims)
2140		memcpy(ctrl->dims, dims, nr_of_dims * sizeof(dims[0]));
2141	ctrl->elem_size = elem_size;
2142	if (type == V4L2_CTRL_TYPE_MENU)
2143		ctrl->qmenu = qmenu;
2144	else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
2145		ctrl->qmenu_int = qmenu_int;
2146	ctrl->priv = priv;
2147	ctrl->cur.val = ctrl->val = def;
2148	data = &ctrl[1];
2149
2150	if (ctrl->is_array) {
2151		ctrl->p_array_alloc_elems = elems;
2152		ctrl->p_array = kvzalloc(2 * elems * elem_size, GFP_KERNEL);
2153		if (!ctrl->p_array) {
2154			kvfree(ctrl);
2155			return NULL;
2156		}
2157		data = ctrl->p_array;
2158	}
2159
2160	if (!ctrl->is_int) {
2161		ctrl->p_new.p = data;
2162		ctrl->p_cur.p = data + tot_ctrl_size;
2163	} else {
2164		ctrl->p_new.p = &ctrl->val;
2165		ctrl->p_cur.p = &ctrl->cur.val;
2166	}
2167
2168	if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const) {
2169		if (ctrl->is_array)
2170			ctrl->p_def.p = &ctrl[1];
2171		else
2172			ctrl->p_def.p = ctrl->p_cur.p + tot_ctrl_size;
2173		memcpy(ctrl->p_def.p, p_def.p_const, elem_size);
2174	}
2175
2176	if (flags & V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX) {
2177		void *ptr = ctrl->p_def.p;
2178
2179		if (p_min.p_const) {
2180			ptr += elem_size;
2181			ctrl->p_min.p = ptr;
2182			memcpy(ctrl->p_min.p, p_min.p_const, elem_size);
2183		}
2184
2185		if (p_max.p_const) {
2186			ptr += elem_size;
2187			ctrl->p_max.p = ptr;
2188			memcpy(ctrl->p_max.p, p_max.p_const, elem_size);
2189		}
2190	}
2191
2192	ctrl->type_ops->init(ctrl, 0, ctrl->p_cur);
2193	cur_to_new(ctrl);
2194
2195	if (handler_new_ref(hdl, ctrl, NULL, false, false)) {
2196		kvfree(ctrl->p_array);
2197		kvfree(ctrl);
2198		return NULL;
2199	}
2200	mutex_lock(hdl->lock);
2201	list_add_tail(&ctrl->node, &hdl->ctrls);
2202	mutex_unlock(hdl->lock);
2203	return ctrl;
2204}
2205
2206struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
2207			const struct v4l2_ctrl_config *cfg, void *priv)
2208{
2209	bool is_menu;
2210	struct v4l2_ctrl *ctrl;
2211	const char *name = cfg->name;
2212	const char * const *qmenu = cfg->qmenu;
2213	const s64 *qmenu_int = cfg->qmenu_int;
2214	enum v4l2_ctrl_type type = cfg->type;
2215	u32 flags = cfg->flags;
2216	s64 min = cfg->min;
2217	s64 max = cfg->max;
2218	u64 step = cfg->step;
2219	s64 def = cfg->def;
2220
2221	if (name == NULL)
2222		v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
2223								&def, &flags);
2224
2225	is_menu = (type == V4L2_CTRL_TYPE_MENU ||
2226		   type == V4L2_CTRL_TYPE_INTEGER_MENU);
2227	if (is_menu)
2228		WARN_ON(step);
2229	else
2230		WARN_ON(cfg->menu_skip_mask);
2231	if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
2232		qmenu = v4l2_ctrl_get_menu(cfg->id);
2233	} else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
2234		handler_set_err(hdl, -EINVAL);
2235		return NULL;
2236	}
2237
2238	ctrl = v4l2_ctrl_new(hdl, cfg->ops, cfg->type_ops, cfg->id, name,
2239			type, min, max,
2240			is_menu ? cfg->menu_skip_mask : step, def,
2241			cfg->dims, cfg->elem_size,
2242			flags, qmenu, qmenu_int, cfg->p_def, cfg->p_min,
2243			cfg->p_max, priv);
2244	if (ctrl)
2245		ctrl->is_private = cfg->is_private;
2246	return ctrl;
2247}
2248EXPORT_SYMBOL(v4l2_ctrl_new_custom);
2249
2250/* Helper function for standard non-menu controls */
2251struct v4l2_ctrl *v4l2_ctrl_new_std(struct v4l2_ctrl_handler *hdl,
2252			const struct v4l2_ctrl_ops *ops,
2253			u32 id, s64 min, s64 max, u64 step, s64 def)
2254{
2255	const char *name;
2256	enum v4l2_ctrl_type type;
2257	u32 flags;
2258
2259	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2260	if (type == V4L2_CTRL_TYPE_MENU ||
2261	    type == V4L2_CTRL_TYPE_INTEGER_MENU ||
2262	    type >= V4L2_CTRL_COMPOUND_TYPES) {
2263		handler_set_err(hdl, -EINVAL);
2264		return NULL;
2265	}
2266	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2267			     min, max, step, def, NULL, 0,
2268			     flags, NULL, NULL, ptr_null, ptr_null,
2269			     ptr_null, NULL);
2270}
2271EXPORT_SYMBOL(v4l2_ctrl_new_std);
2272
2273/* Helper function for standard menu controls */
2274struct v4l2_ctrl *v4l2_ctrl_new_std_menu(struct v4l2_ctrl_handler *hdl,
2275			const struct v4l2_ctrl_ops *ops,
2276			u32 id, u8 _max, u64 mask, u8 _def)
2277{
2278	const char * const *qmenu = NULL;
2279	const s64 *qmenu_int = NULL;
2280	unsigned int qmenu_int_len = 0;
2281	const char *name;
2282	enum v4l2_ctrl_type type;
2283	s64 min;
2284	s64 max = _max;
2285	s64 def = _def;
2286	u64 step;
2287	u32 flags;
2288
2289	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2290
2291	if (type == V4L2_CTRL_TYPE_MENU)
2292		qmenu = v4l2_ctrl_get_menu(id);
2293	else if (type == V4L2_CTRL_TYPE_INTEGER_MENU)
2294		qmenu_int = v4l2_ctrl_get_int_menu(id, &qmenu_int_len);
2295
2296	if ((!qmenu && !qmenu_int) || (qmenu_int && max >= qmenu_int_len)) {
2297		handler_set_err(hdl, -EINVAL);
2298		return NULL;
2299	}
2300	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2301			     0, max, mask, def, NULL, 0,
2302			     flags, qmenu, qmenu_int, ptr_null, ptr_null,
2303			     ptr_null, NULL);
2304}
2305EXPORT_SYMBOL(v4l2_ctrl_new_std_menu);
2306
2307/* Helper function for standard menu controls with driver defined menu */
2308struct v4l2_ctrl *v4l2_ctrl_new_std_menu_items(struct v4l2_ctrl_handler *hdl,
2309			const struct v4l2_ctrl_ops *ops, u32 id, u8 _max,
2310			u64 mask, u8 _def, const char * const *qmenu)
2311{
2312	enum v4l2_ctrl_type type;
2313	const char *name;
2314	u32 flags;
2315	u64 step;
2316	s64 min;
2317	s64 max = _max;
2318	s64 def = _def;
2319
2320	/* v4l2_ctrl_new_std_menu_items() should only be called for
2321	 * standard controls without a standard menu.
2322	 */
2323	if (v4l2_ctrl_get_menu(id)) {
2324		handler_set_err(hdl, -EINVAL);
2325		return NULL;
2326	}
2327
2328	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2329	if (type != V4L2_CTRL_TYPE_MENU || qmenu == NULL) {
2330		handler_set_err(hdl, -EINVAL);
2331		return NULL;
2332	}
2333	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2334			     0, max, mask, def, NULL, 0,
2335			     flags, qmenu, NULL, ptr_null, ptr_null,
2336			     ptr_null, NULL);
2337
2338}
2339EXPORT_SYMBOL(v4l2_ctrl_new_std_menu_items);
2340
2341/* Helper function for standard compound controls */
2342struct v4l2_ctrl *v4l2_ctrl_new_std_compound(struct v4l2_ctrl_handler *hdl,
2343				const struct v4l2_ctrl_ops *ops, u32 id,
2344				const union v4l2_ctrl_ptr p_def,
2345				const union v4l2_ctrl_ptr p_min,
2346				const union v4l2_ctrl_ptr p_max)
2347{
2348	const char *name;
2349	enum v4l2_ctrl_type type;
2350	u32 flags;
2351	s64 min, max, step, def;
2352
2353	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2354	if (type < V4L2_CTRL_COMPOUND_TYPES) {
2355		handler_set_err(hdl, -EINVAL);
2356		return NULL;
2357	}
2358	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2359			     min, max, step, def, NULL, 0,
2360			     flags, NULL, NULL, p_def, p_min, p_max, NULL);
2361}
2362EXPORT_SYMBOL(v4l2_ctrl_new_std_compound);
2363
2364/* Helper function for standard integer menu controls */
2365struct v4l2_ctrl *v4l2_ctrl_new_int_menu(struct v4l2_ctrl_handler *hdl,
2366			const struct v4l2_ctrl_ops *ops,
2367			u32 id, u8 _max, u8 _def, const s64 *qmenu_int)
2368{
2369	const char *name;
2370	enum v4l2_ctrl_type type;
2371	s64 min;
2372	u64 step;
2373	s64 max = _max;
2374	s64 def = _def;
2375	u32 flags;
2376
2377	v4l2_ctrl_fill(id, &name, &type, &min, &max, &step, &def, &flags);
2378	if (type != V4L2_CTRL_TYPE_INTEGER_MENU) {
2379		handler_set_err(hdl, -EINVAL);
2380		return NULL;
2381	}
2382	return v4l2_ctrl_new(hdl, ops, NULL, id, name, type,
2383			     0, max, 0, def, NULL, 0,
2384			     flags, NULL, qmenu_int, ptr_null, ptr_null,
2385			     ptr_null, NULL);
2386}
2387EXPORT_SYMBOL(v4l2_ctrl_new_int_menu);
2388
2389/* Add the controls from another handler to our own. */
2390int v4l2_ctrl_add_handler(struct v4l2_ctrl_handler *hdl,
2391			  struct v4l2_ctrl_handler *add,
2392			  bool (*filter)(const struct v4l2_ctrl *ctrl),
2393			  bool from_other_dev)
2394{
2395	struct v4l2_ctrl_ref *ref;
2396	int ret = 0;
2397
2398	/* Do nothing if either handler is NULL or if they are the same */
2399	if (!hdl || !add || hdl == add)
2400		return 0;
2401	if (hdl->error)
2402		return hdl->error;
2403	mutex_lock(add->lock);
2404	list_for_each_entry(ref, &add->ctrl_refs, node) {
2405		struct v4l2_ctrl *ctrl = ref->ctrl;
2406
2407		/* Skip handler-private controls. */
2408		if (ctrl->is_private)
2409			continue;
2410		/* And control classes */
2411		if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2412			continue;
2413		/* Filter any unwanted controls */
2414		if (filter && !filter(ctrl))
2415			continue;
2416		ret = handler_new_ref(hdl, ctrl, NULL, from_other_dev, false);
2417		if (ret)
2418			break;
2419	}
2420	mutex_unlock(add->lock);
2421	return ret;
2422}
2423EXPORT_SYMBOL(v4l2_ctrl_add_handler);
2424
2425bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl)
2426{
2427	if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_TX)
2428		return true;
2429	if (V4L2_CTRL_ID2WHICH(ctrl->id) == V4L2_CTRL_CLASS_FM_RX)
2430		return true;
2431	switch (ctrl->id) {
2432	case V4L2_CID_AUDIO_MUTE:
2433	case V4L2_CID_AUDIO_VOLUME:
2434	case V4L2_CID_AUDIO_BALANCE:
2435	case V4L2_CID_AUDIO_BASS:
2436	case V4L2_CID_AUDIO_TREBLE:
2437	case V4L2_CID_AUDIO_LOUDNESS:
2438		return true;
2439	default:
2440		break;
2441	}
2442	return false;
2443}
2444EXPORT_SYMBOL(v4l2_ctrl_radio_filter);
2445
2446/* Cluster controls */
2447void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
2448{
2449	bool has_volatiles = false;
2450	int i;
2451
2452	/* The first control is the master control and it must not be NULL */
2453	if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
2454		return;
2455
2456	for (i = 0; i < ncontrols; i++) {
2457		if (controls[i]) {
2458			controls[i]->cluster = controls;
2459			controls[i]->ncontrols = ncontrols;
2460			if (controls[i]->flags & V4L2_CTRL_FLAG_VOLATILE)
2461				has_volatiles = true;
2462		}
2463	}
2464	controls[0]->has_volatiles = has_volatiles;
2465}
2466EXPORT_SYMBOL(v4l2_ctrl_cluster);
2467
2468void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
2469			    u8 manual_val, bool set_volatile)
2470{
2471	struct v4l2_ctrl *master = controls[0];
2472	u32 flag = 0;
2473	int i;
2474
2475	v4l2_ctrl_cluster(ncontrols, controls);
2476	WARN_ON(ncontrols <= 1);
2477	WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
2478	WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
2479	master->is_auto = true;
2480	master->has_volatiles = set_volatile;
2481	master->manual_mode_value = manual_val;
2482	master->flags |= V4L2_CTRL_FLAG_UPDATE;
2483
2484	if (!is_cur_manual(master))
2485		flag = V4L2_CTRL_FLAG_INACTIVE |
2486			(set_volatile ? V4L2_CTRL_FLAG_VOLATILE : 0);
2487
2488	for (i = 1; i < ncontrols; i++)
2489		if (controls[i])
2490			controls[i]->flags |= flag;
2491}
2492EXPORT_SYMBOL(v4l2_ctrl_auto_cluster);
2493
2494/*
2495 * Obtain the current volatile values of an autocluster and mark them
2496 * as new.
2497 */
2498void update_from_auto_cluster(struct v4l2_ctrl *master)
2499{
2500	int i;
2501
2502	for (i = 1; i < master->ncontrols; i++)
2503		cur_to_new(master->cluster[i]);
2504	if (!call_op(master, g_volatile_ctrl))
2505		for (i = 1; i < master->ncontrols; i++)
2506			if (master->cluster[i])
2507				master->cluster[i]->is_new = 1;
2508}
2509
2510/*
2511 * Return non-zero if one or more of the controls in the cluster has a new
2512 * value that differs from the current value.
2513 */
2514static int cluster_changed(struct v4l2_ctrl *master)
2515{
2516	bool changed = false;
2517	int i;
2518
2519	for (i = 0; i < master->ncontrols; i++) {
2520		struct v4l2_ctrl *ctrl = master->cluster[i];
2521		bool ctrl_changed = false;
2522
2523		if (!ctrl)
2524			continue;
2525
2526		if (ctrl->flags & V4L2_CTRL_FLAG_EXECUTE_ON_WRITE) {
2527			changed = true;
2528			ctrl_changed = true;
2529		}
2530
2531		/*
2532		 * Set has_changed to false to avoid generating
2533		 * the event V4L2_EVENT_CTRL_CH_VALUE
2534		 */
2535		if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
2536			ctrl->has_changed = false;
2537			continue;
2538		}
2539
2540		if (ctrl->elems != ctrl->new_elems)
2541			ctrl_changed = true;
2542		if (!ctrl_changed)
2543			ctrl_changed = !ctrl->type_ops->equal(ctrl,
2544				ctrl->p_cur, ctrl->p_new);
2545		ctrl->has_changed = ctrl_changed;
2546		changed |= ctrl->has_changed;
2547	}
2548	return changed;
2549}
2550
2551/*
2552 * Core function that calls try/s_ctrl and ensures that the new value is
2553 * copied to the current value on a set.
2554 * Must be called with ctrl->handler->lock held.
2555 */
2556int try_or_set_cluster(struct v4l2_fh *fh, struct v4l2_ctrl *master,
2557		       bool set, u32 ch_flags)
2558{
2559	bool update_flag;
2560	int ret;
2561	int i;
2562
2563	/*
2564	 * Go through the cluster and either validate the new value or
2565	 * (if no new value was set), copy the current value to the new
2566	 * value, ensuring a consistent view for the control ops when
2567	 * called.
2568	 */
2569	for (i = 0; i < master->ncontrols; i++) {
2570		struct v4l2_ctrl *ctrl = master->cluster[i];
2571
2572		if (!ctrl)
2573			continue;
2574
2575		if (!ctrl->is_new) {
2576			cur_to_new(ctrl);
2577			continue;
2578		}
2579		/*
2580		 * Check again: it may have changed since the
2581		 * previous check in try_or_set_ext_ctrls().
2582		 */
2583		if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED))
2584			return -EBUSY;
2585	}
2586
2587	ret = call_op(master, try_ctrl);
2588
2589	/* Don't set if there is no change */
2590	if (ret || !set || !cluster_changed(master))
2591		return ret;
2592	ret = call_op(master, s_ctrl);
2593	if (ret)
2594		return ret;
2595
2596	/* If OK, then make the new values permanent. */
2597	update_flag = is_cur_manual(master) != is_new_manual(master);
2598
2599	for (i = 0; i < master->ncontrols; i++) {
2600		/*
2601		 * If we switch from auto to manual mode, and this cluster
2602		 * contains volatile controls, then all non-master controls
2603		 * have to be marked as changed. The 'new' value contains
2604		 * the volatile value (obtained by update_from_auto_cluster),
2605		 * which now has to become the current value.
2606		 */
2607		if (i && update_flag && is_new_manual(master) &&
2608		    master->has_volatiles && master->cluster[i])
2609			master->cluster[i]->has_changed = true;
2610
2611		new_to_cur(fh, master->cluster[i], ch_flags |
2612			((update_flag && i > 0) ? V4L2_EVENT_CTRL_CH_FLAGS : 0));
2613	}
2614	return 0;
2615}
2616
2617/* Activate/deactivate a control. */
2618void v4l2_ctrl_activate(struct v4l2_ctrl *ctrl, bool active)
2619{
2620	/* invert since the actual flag is called 'inactive' */
2621	bool inactive = !active;
2622	bool old;
2623
2624	if (ctrl == NULL)
2625		return;
2626
2627	if (inactive)
2628		/* set V4L2_CTRL_FLAG_INACTIVE */
2629		old = test_and_set_bit(4, &ctrl->flags);
2630	else
2631		/* clear V4L2_CTRL_FLAG_INACTIVE */
2632		old = test_and_clear_bit(4, &ctrl->flags);
2633	if (old != inactive)
2634		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2635}
2636EXPORT_SYMBOL(v4l2_ctrl_activate);
2637
2638void __v4l2_ctrl_grab(struct v4l2_ctrl *ctrl, bool grabbed)
2639{
2640	bool old;
2641
2642	if (ctrl == NULL)
2643		return;
2644
2645	lockdep_assert_held(ctrl->handler->lock);
2646
2647	if (grabbed)
2648		/* set V4L2_CTRL_FLAG_GRABBED */
2649		old = test_and_set_bit(1, &ctrl->flags);
2650	else
2651		/* clear V4L2_CTRL_FLAG_GRABBED */
2652		old = test_and_clear_bit(1, &ctrl->flags);
2653	if (old != grabbed)
2654		send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_FLAGS);
2655}
2656EXPORT_SYMBOL(__v4l2_ctrl_grab);
2657
2658/* Call s_ctrl for all controls owned by the handler */
2659int __v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2660{
2661	struct v4l2_ctrl *ctrl;
2662	int ret = 0;
2663
2664	if (hdl == NULL)
2665		return 0;
2666
2667	lockdep_assert_held(hdl->lock);
2668
2669	list_for_each_entry(ctrl, &hdl->ctrls, node)
2670		ctrl->done = false;
2671
2672	list_for_each_entry(ctrl, &hdl->ctrls, node) {
2673		struct v4l2_ctrl *master = ctrl->cluster[0];
2674		int i;
2675
2676		/* Skip if this control was already handled by a cluster. */
2677		/* Skip button controls and read-only controls. */
2678		if (ctrl->done || ctrl->type == V4L2_CTRL_TYPE_BUTTON ||
2679		    (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY))
2680			continue;
2681
2682		for (i = 0; i < master->ncontrols; i++) {
2683			if (master->cluster[i]) {
2684				cur_to_new(master->cluster[i]);
2685				master->cluster[i]->is_new = 1;
2686				master->cluster[i]->done = true;
2687			}
2688		}
2689		ret = call_op(master, s_ctrl);
2690		if (ret)
2691			break;
2692	}
2693
2694	return ret;
2695}
2696EXPORT_SYMBOL_GPL(__v4l2_ctrl_handler_setup);
2697
2698int v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
2699{
2700	int ret;
2701
2702	if (hdl == NULL)
2703		return 0;
2704
2705	mutex_lock(hdl->lock);
2706	ret = __v4l2_ctrl_handler_setup(hdl);
2707	mutex_unlock(hdl->lock);
2708
2709	return ret;
2710}
2711EXPORT_SYMBOL(v4l2_ctrl_handler_setup);
2712
2713/* Log the control name and value */
2714static void log_ctrl(const struct v4l2_ctrl *ctrl,
2715		     const char *prefix, const char *colon)
2716{
2717	if (ctrl->flags & (V4L2_CTRL_FLAG_DISABLED | V4L2_CTRL_FLAG_WRITE_ONLY))
2718		return;
2719	if (ctrl->type == V4L2_CTRL_TYPE_CTRL_CLASS)
2720		return;
2721
2722	pr_info("%s%s%s: ", prefix, colon, ctrl->name);
2723
2724	ctrl->type_ops->log(ctrl);
2725
2726	if (ctrl->flags & (V4L2_CTRL_FLAG_INACTIVE |
2727			   V4L2_CTRL_FLAG_GRABBED |
2728			   V4L2_CTRL_FLAG_VOLATILE)) {
2729		if (ctrl->flags & V4L2_CTRL_FLAG_INACTIVE)
2730			pr_cont(" inactive");
2731		if (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)
2732			pr_cont(" grabbed");
2733		if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE)
2734			pr_cont(" volatile");
2735	}
2736	pr_cont("\n");
2737}
2738
2739/* Log all controls owned by the handler */
2740void v4l2_ctrl_handler_log_status(struct v4l2_ctrl_handler *hdl,
2741				  const char *prefix)
2742{
2743	struct v4l2_ctrl *ctrl;
2744	const char *colon = "";
2745	int len;
2746
2747	if (!hdl)
2748		return;
2749	if (!prefix)
2750		prefix = "";
2751	len = strlen(prefix);
2752	if (len && prefix[len - 1] != ' ')
2753		colon = ": ";
2754	mutex_lock(hdl->lock);
2755	list_for_each_entry(ctrl, &hdl->ctrls, node)
2756		if (!(ctrl->flags & V4L2_CTRL_FLAG_DISABLED))
2757			log_ctrl(ctrl, prefix, colon);
2758	mutex_unlock(hdl->lock);
2759}
2760EXPORT_SYMBOL(v4l2_ctrl_handler_log_status);
2761
2762int v4l2_ctrl_new_fwnode_properties(struct v4l2_ctrl_handler *hdl,
2763				    const struct v4l2_ctrl_ops *ctrl_ops,
2764				    const struct v4l2_fwnode_device_properties *p)
2765{
2766	if (hdl->error)
2767		return hdl->error;
2768
2769	if (p->orientation != V4L2_FWNODE_PROPERTY_UNSET) {
2770		u32 orientation_ctrl;
2771
2772		switch (p->orientation) {
2773		case V4L2_FWNODE_ORIENTATION_FRONT:
2774			orientation_ctrl = V4L2_CAMERA_ORIENTATION_FRONT;
2775			break;
2776		case V4L2_FWNODE_ORIENTATION_BACK:
2777			orientation_ctrl = V4L2_CAMERA_ORIENTATION_BACK;
2778			break;
2779		case V4L2_FWNODE_ORIENTATION_EXTERNAL:
2780			orientation_ctrl = V4L2_CAMERA_ORIENTATION_EXTERNAL;
2781			break;
2782		default:
2783			return -EINVAL;
2784		}
2785		if (!v4l2_ctrl_new_std_menu(hdl, ctrl_ops,
2786					    V4L2_CID_CAMERA_ORIENTATION,
2787					    V4L2_CAMERA_ORIENTATION_EXTERNAL, 0,
2788					    orientation_ctrl))
2789			return hdl->error;
2790	}
2791
2792	if (p->rotation != V4L2_FWNODE_PROPERTY_UNSET) {
2793		if (!v4l2_ctrl_new_std(hdl, ctrl_ops,
2794				       V4L2_CID_CAMERA_SENSOR_ROTATION,
2795				       p->rotation, p->rotation, 1,
2796				       p->rotation))
2797			return hdl->error;
2798	}
2799
2800	return hdl->error;
2801}
2802EXPORT_SYMBOL(v4l2_ctrl_new_fwnode_properties);