Loading...
Note: File does not exist in v3.1.
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * V4L2 controls framework uAPI implementation:
4 *
5 * Copyright (C) 2010-2021 Hans Verkuil <hverkuil-cisco@xs4all.nl>
6 */
7
8#define pr_fmt(fmt) "v4l2-ctrls: " fmt
9
10#include <linux/export.h>
11#include <linux/mm.h>
12#include <linux/slab.h>
13#include <media/v4l2-ctrls.h>
14#include <media/v4l2-dev.h>
15#include <media/v4l2-device.h>
16#include <media/v4l2-event.h>
17#include <media/v4l2-ioctl.h>
18
19#include "v4l2-ctrls-priv.h"
20
21/* Internal temporary helper struct, one for each v4l2_ext_control */
22struct v4l2_ctrl_helper {
23 /* Pointer to the control reference of the master control */
24 struct v4l2_ctrl_ref *mref;
25 /* The control ref corresponding to the v4l2_ext_control ID field. */
26 struct v4l2_ctrl_ref *ref;
27 /*
28 * v4l2_ext_control index of the next control belonging to the
29 * same cluster, or 0 if there isn't any.
30 */
31 u32 next;
32};
33
34/*
35 * Helper functions to copy control payload data from kernel space to
36 * user space and vice versa.
37 */
38
39/* Helper function: copy the given control value back to the caller */
40static int ptr_to_user(struct v4l2_ext_control *c,
41 struct v4l2_ctrl *ctrl,
42 union v4l2_ctrl_ptr ptr)
43{
44 u32 len;
45
46 if (ctrl->is_ptr && !ctrl->is_string)
47 return copy_to_user(c->ptr, ptr.p_const, c->size) ?
48 -EFAULT : 0;
49
50 switch (ctrl->type) {
51 case V4L2_CTRL_TYPE_STRING:
52 len = strlen(ptr.p_char);
53 if (c->size < len + 1) {
54 c->size = ctrl->elem_size;
55 return -ENOSPC;
56 }
57 return copy_to_user(c->string, ptr.p_char, len + 1) ?
58 -EFAULT : 0;
59 case V4L2_CTRL_TYPE_INTEGER64:
60 c->value64 = *ptr.p_s64;
61 break;
62 default:
63 c->value = *ptr.p_s32;
64 break;
65 }
66 return 0;
67}
68
69/* Helper function: copy the current control value back to the caller */
70static int cur_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
71{
72 return ptr_to_user(c, ctrl, ctrl->p_cur);
73}
74
75/* Helper function: copy the new control value back to the caller */
76static int new_to_user(struct v4l2_ext_control *c,
77 struct v4l2_ctrl *ctrl)
78{
79 return ptr_to_user(c, ctrl, ctrl->p_new);
80}
81
82/* Helper function: copy the request value back to the caller */
83static int req_to_user(struct v4l2_ext_control *c,
84 struct v4l2_ctrl_ref *ref)
85{
86 return ptr_to_user(c, ref->ctrl, ref->p_req);
87}
88
89/* Helper function: copy the initial control value back to the caller */
90static int def_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
91{
92 ctrl->type_ops->init(ctrl, 0, ctrl->p_new);
93
94 return ptr_to_user(c, ctrl, ctrl->p_new);
95}
96
97/* Helper function: copy the caller-provider value as the new control value */
98static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
99{
100 int ret;
101 u32 size;
102
103 ctrl->is_new = 0;
104 if (ctrl->is_dyn_array &&
105 c->size > ctrl->p_array_alloc_elems * ctrl->elem_size) {
106 void *old = ctrl->p_array;
107 void *tmp = kvzalloc(2 * c->size, GFP_KERNEL);
108
109 if (!tmp)
110 return -ENOMEM;
111 memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size);
112 memcpy(tmp + c->size, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size);
113 ctrl->p_new.p = tmp;
114 ctrl->p_cur.p = tmp + c->size;
115 ctrl->p_array = tmp;
116 ctrl->p_array_alloc_elems = c->size / ctrl->elem_size;
117 kvfree(old);
118 }
119
120 if (ctrl->is_ptr && !ctrl->is_string) {
121 unsigned int elems = c->size / ctrl->elem_size;
122
123 if (copy_from_user(ctrl->p_new.p, c->ptr, c->size))
124 return -EFAULT;
125 ctrl->is_new = 1;
126 if (ctrl->is_dyn_array)
127 ctrl->new_elems = elems;
128 else if (ctrl->is_array)
129 ctrl->type_ops->init(ctrl, elems, ctrl->p_new);
130 return 0;
131 }
132
133 switch (ctrl->type) {
134 case V4L2_CTRL_TYPE_INTEGER64:
135 *ctrl->p_new.p_s64 = c->value64;
136 break;
137 case V4L2_CTRL_TYPE_STRING:
138 size = c->size;
139 if (size == 0)
140 return -ERANGE;
141 if (size > ctrl->maximum + 1)
142 size = ctrl->maximum + 1;
143 ret = copy_from_user(ctrl->p_new.p_char, c->string, size) ? -EFAULT : 0;
144 if (!ret) {
145 char last = ctrl->p_new.p_char[size - 1];
146
147 ctrl->p_new.p_char[size - 1] = 0;
148 /*
149 * If the string was longer than ctrl->maximum,
150 * then return an error.
151 */
152 if (strlen(ctrl->p_new.p_char) == ctrl->maximum && last)
153 return -ERANGE;
154 ctrl->is_new = 1;
155 }
156 return ret;
157 default:
158 *ctrl->p_new.p_s32 = c->value;
159 break;
160 }
161 ctrl->is_new = 1;
162 return 0;
163}
164
165/*
166 * VIDIOC_G/TRY/S_EXT_CTRLS implementation
167 */
168
169/*
170 * Some general notes on the atomic requirements of VIDIOC_G/TRY/S_EXT_CTRLS:
171 *
172 * It is not a fully atomic operation, just best-effort only. After all, if
173 * multiple controls have to be set through multiple i2c writes (for example)
174 * then some initial writes may succeed while others fail. Thus leaving the
175 * system in an inconsistent state. The question is how much effort you are
176 * willing to spend on trying to make something atomic that really isn't.
177 *
178 * From the point of view of an application the main requirement is that
179 * when you call VIDIOC_S_EXT_CTRLS and some values are invalid then an
180 * error should be returned without actually affecting any controls.
181 *
182 * If all the values are correct, then it is acceptable to just give up
183 * in case of low-level errors.
184 *
185 * It is important though that the application can tell when only a partial
186 * configuration was done. The way we do that is through the error_idx field
187 * of struct v4l2_ext_controls: if that is equal to the count field then no
188 * controls were affected. Otherwise all controls before that index were
189 * successful in performing their 'get' or 'set' operation, the control at
190 * the given index failed, and you don't know what happened with the controls
191 * after the failed one. Since if they were part of a control cluster they
192 * could have been successfully processed (if a cluster member was encountered
193 * at index < error_idx), they could have failed (if a cluster member was at
194 * error_idx), or they may not have been processed yet (if the first cluster
195 * member appeared after error_idx).
196 *
197 * It is all fairly theoretical, though. In practice all you can do is to
198 * bail out. If error_idx == count, then it is an application bug. If
199 * error_idx < count then it is only an application bug if the error code was
200 * EBUSY. That usually means that something started streaming just when you
201 * tried to set the controls. In all other cases it is a driver/hardware
202 * problem and all you can do is to retry or bail out.
203 *
204 * Note that these rules do not apply to VIDIOC_TRY_EXT_CTRLS: since that
205 * never modifies controls the error_idx is just set to whatever control
206 * has an invalid value.
207 */
208
209/*
210 * Prepare for the extended g/s/try functions.
211 * Find the controls in the control array and do some basic checks.
212 */
213static int prepare_ext_ctrls(struct v4l2_ctrl_handler *hdl,
214 struct v4l2_ext_controls *cs,
215 struct v4l2_ctrl_helper *helpers,
216 struct video_device *vdev,
217 bool get)
218{
219 struct v4l2_ctrl_helper *h;
220 bool have_clusters = false;
221 u32 i;
222
223 for (i = 0, h = helpers; i < cs->count; i++, h++) {
224 struct v4l2_ext_control *c = &cs->controls[i];
225 struct v4l2_ctrl_ref *ref;
226 struct v4l2_ctrl *ctrl;
227 u32 id = c->id & V4L2_CTRL_ID_MASK;
228
229 cs->error_idx = i;
230
231 if (cs->which &&
232 cs->which != V4L2_CTRL_WHICH_DEF_VAL &&
233 cs->which != V4L2_CTRL_WHICH_REQUEST_VAL &&
234 V4L2_CTRL_ID2WHICH(id) != cs->which) {
235 dprintk(vdev,
236 "invalid which 0x%x or control id 0x%x\n",
237 cs->which, id);
238 return -EINVAL;
239 }
240
241 /*
242 * Old-style private controls are not allowed for
243 * extended controls.
244 */
245 if (id >= V4L2_CID_PRIVATE_BASE) {
246 dprintk(vdev,
247 "old-style private controls not allowed\n");
248 return -EINVAL;
249 }
250 ref = find_ref_lock(hdl, id);
251 if (!ref) {
252 dprintk(vdev, "cannot find control id 0x%x\n", id);
253 return -EINVAL;
254 }
255 h->ref = ref;
256 ctrl = ref->ctrl;
257 if (ctrl->flags & V4L2_CTRL_FLAG_DISABLED) {
258 dprintk(vdev, "control id 0x%x is disabled\n", id);
259 return -EINVAL;
260 }
261
262 if (ctrl->cluster[0]->ncontrols > 1)
263 have_clusters = true;
264 if (ctrl->cluster[0] != ctrl)
265 ref = find_ref_lock(hdl, ctrl->cluster[0]->id);
266 if (ctrl->is_dyn_array) {
267 unsigned int max_size = ctrl->dims[0] * ctrl->elem_size;
268 unsigned int tot_size = ctrl->elem_size;
269
270 if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
271 tot_size *= ref->p_req_elems;
272 else
273 tot_size *= ctrl->elems;
274
275 c->size = ctrl->elem_size * (c->size / ctrl->elem_size);
276 if (get) {
277 if (c->size < tot_size) {
278 c->size = tot_size;
279 return -ENOSPC;
280 }
281 c->size = tot_size;
282 } else {
283 if (c->size > max_size) {
284 c->size = max_size;
285 return -ENOSPC;
286 }
287 if (!c->size)
288 return -EFAULT;
289 }
290 } else if (ctrl->is_ptr && !ctrl->is_string) {
291 unsigned int tot_size = ctrl->elems * ctrl->elem_size;
292
293 if (c->size < tot_size) {
294 /*
295 * In the get case the application first
296 * queries to obtain the size of the control.
297 */
298 if (get) {
299 c->size = tot_size;
300 return -ENOSPC;
301 }
302 dprintk(vdev,
303 "pointer control id 0x%x size too small, %d bytes but %d bytes needed\n",
304 id, c->size, tot_size);
305 return -EFAULT;
306 }
307 c->size = tot_size;
308 }
309 /* Store the ref to the master control of the cluster */
310 h->mref = ref;
311 /*
312 * Initially set next to 0, meaning that there is no other
313 * control in this helper array belonging to the same
314 * cluster.
315 */
316 h->next = 0;
317 }
318
319 /*
320 * We are done if there were no controls that belong to a multi-
321 * control cluster.
322 */
323 if (!have_clusters)
324 return 0;
325
326 /*
327 * The code below figures out in O(n) time which controls in the list
328 * belong to the same cluster.
329 */
330
331 /* This has to be done with the handler lock taken. */
332 mutex_lock(hdl->lock);
333
334 /* First zero the helper field in the master control references */
335 for (i = 0; i < cs->count; i++)
336 helpers[i].mref->helper = NULL;
337 for (i = 0, h = helpers; i < cs->count; i++, h++) {
338 struct v4l2_ctrl_ref *mref = h->mref;
339
340 /*
341 * If the mref->helper is set, then it points to an earlier
342 * helper that belongs to the same cluster.
343 */
344 if (mref->helper) {
345 /*
346 * Set the next field of mref->helper to the current
347 * index: this means that the earlier helper now
348 * points to the next helper in the same cluster.
349 */
350 mref->helper->next = i;
351 /*
352 * mref should be set only for the first helper in the
353 * cluster, clear the others.
354 */
355 h->mref = NULL;
356 }
357 /* Point the mref helper to the current helper struct. */
358 mref->helper = h;
359 }
360 mutex_unlock(hdl->lock);
361 return 0;
362}
363
364/*
365 * Handles the corner case where cs->count == 0. It checks whether the
366 * specified control class exists. If that class ID is 0, then it checks
367 * whether there are any controls at all.
368 */
369static int class_check(struct v4l2_ctrl_handler *hdl, u32 which)
370{
371 if (which == 0 || which == V4L2_CTRL_WHICH_DEF_VAL ||
372 which == V4L2_CTRL_WHICH_REQUEST_VAL)
373 return 0;
374 return find_ref_lock(hdl, which | 1) ? 0 : -EINVAL;
375}
376
377/*
378 * Get extended controls. Allocates the helpers array if needed.
379 *
380 * Note that v4l2_g_ext_ctrls_common() with 'which' set to
381 * V4L2_CTRL_WHICH_REQUEST_VAL is only called if the request was
382 * completed, and in that case p_req_valid is true for all controls.
383 */
384int v4l2_g_ext_ctrls_common(struct v4l2_ctrl_handler *hdl,
385 struct v4l2_ext_controls *cs,
386 struct video_device *vdev)
387{
388 struct v4l2_ctrl_helper helper[4];
389 struct v4l2_ctrl_helper *helpers = helper;
390 int ret;
391 int i, j;
392 bool is_default, is_request;
393
394 is_default = (cs->which == V4L2_CTRL_WHICH_DEF_VAL);
395 is_request = (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL);
396
397 cs->error_idx = cs->count;
398 cs->which = V4L2_CTRL_ID2WHICH(cs->which);
399
400 if (!hdl)
401 return -EINVAL;
402
403 if (cs->count == 0)
404 return class_check(hdl, cs->which);
405
406 if (cs->count > ARRAY_SIZE(helper)) {
407 helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
408 GFP_KERNEL);
409 if (!helpers)
410 return -ENOMEM;
411 }
412
413 ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, true);
414 cs->error_idx = cs->count;
415
416 for (i = 0; !ret && i < cs->count; i++)
417 if (helpers[i].ref->ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
418 ret = -EACCES;
419
420 for (i = 0; !ret && i < cs->count; i++) {
421 struct v4l2_ctrl *master;
422 bool is_volatile = false;
423 u32 idx = i;
424
425 if (!helpers[i].mref)
426 continue;
427
428 master = helpers[i].mref->ctrl;
429 cs->error_idx = i;
430
431 v4l2_ctrl_lock(master);
432
433 /*
434 * g_volatile_ctrl will update the new control values.
435 * This makes no sense for V4L2_CTRL_WHICH_DEF_VAL and
436 * V4L2_CTRL_WHICH_REQUEST_VAL. In the case of requests
437 * it is v4l2_ctrl_request_complete() that copies the
438 * volatile controls at the time of request completion
439 * to the request, so you don't want to do that again.
440 */
441 if (!is_default && !is_request &&
442 ((master->flags & V4L2_CTRL_FLAG_VOLATILE) ||
443 (master->has_volatiles && !is_cur_manual(master)))) {
444 for (j = 0; j < master->ncontrols; j++)
445 cur_to_new(master->cluster[j]);
446 ret = call_op(master, g_volatile_ctrl);
447 is_volatile = true;
448 }
449
450 if (ret) {
451 v4l2_ctrl_unlock(master);
452 break;
453 }
454
455 /*
456 * Copy the default value (if is_default is true), the
457 * request value (if is_request is true and p_req is valid),
458 * the new volatile value (if is_volatile is true) or the
459 * current value.
460 */
461 do {
462 struct v4l2_ctrl_ref *ref = helpers[idx].ref;
463
464 if (is_default)
465 ret = def_to_user(cs->controls + idx, ref->ctrl);
466 else if (is_request && ref->p_req_array_enomem)
467 ret = -ENOMEM;
468 else if (is_request && ref->p_req_valid)
469 ret = req_to_user(cs->controls + idx, ref);
470 else if (is_volatile)
471 ret = new_to_user(cs->controls + idx, ref->ctrl);
472 else
473 ret = cur_to_user(cs->controls + idx, ref->ctrl);
474 idx = helpers[idx].next;
475 } while (!ret && idx);
476
477 v4l2_ctrl_unlock(master);
478 }
479
480 if (cs->count > ARRAY_SIZE(helper))
481 kvfree(helpers);
482 return ret;
483}
484
485int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct video_device *vdev,
486 struct media_device *mdev, struct v4l2_ext_controls *cs)
487{
488 if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
489 return v4l2_g_ext_ctrls_request(hdl, vdev, mdev, cs);
490
491 return v4l2_g_ext_ctrls_common(hdl, cs, vdev);
492}
493EXPORT_SYMBOL(v4l2_g_ext_ctrls);
494
495/* Validate a new control */
496static int validate_new(const struct v4l2_ctrl *ctrl, union v4l2_ctrl_ptr p_new)
497{
498 return ctrl->type_ops->validate(ctrl, p_new);
499}
500
501/* Validate controls. */
502static int validate_ctrls(struct v4l2_ext_controls *cs,
503 struct v4l2_ctrl_helper *helpers,
504 struct video_device *vdev,
505 bool set)
506{
507 unsigned int i;
508 int ret = 0;
509
510 cs->error_idx = cs->count;
511 for (i = 0; i < cs->count; i++) {
512 struct v4l2_ctrl *ctrl = helpers[i].ref->ctrl;
513 union v4l2_ctrl_ptr p_new;
514
515 cs->error_idx = i;
516
517 if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY) {
518 dprintk(vdev,
519 "control id 0x%x is read-only\n",
520 ctrl->id);
521 return -EACCES;
522 }
523 /*
524 * This test is also done in try_set_control_cluster() which
525 * is called in atomic context, so that has the final say,
526 * but it makes sense to do an up-front check as well. Once
527 * an error occurs in try_set_control_cluster() some other
528 * controls may have been set already and we want to do a
529 * best-effort to avoid that.
530 */
531 if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)) {
532 dprintk(vdev,
533 "control id 0x%x is grabbed, cannot set\n",
534 ctrl->id);
535 return -EBUSY;
536 }
537 /*
538 * Skip validation for now if the payload needs to be copied
539 * from userspace into kernelspace. We'll validate those later.
540 */
541 if (ctrl->is_ptr)
542 continue;
543 if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
544 p_new.p_s64 = &cs->controls[i].value64;
545 else
546 p_new.p_s32 = &cs->controls[i].value;
547 ret = validate_new(ctrl, p_new);
548 if (ret)
549 return ret;
550 }
551 return 0;
552}
553
554/* Try or try-and-set controls */
555int try_set_ext_ctrls_common(struct v4l2_fh *fh,
556 struct v4l2_ctrl_handler *hdl,
557 struct v4l2_ext_controls *cs,
558 struct video_device *vdev, bool set)
559{
560 struct v4l2_ctrl_helper helper[4];
561 struct v4l2_ctrl_helper *helpers = helper;
562 unsigned int i, j;
563 int ret;
564
565 cs->error_idx = cs->count;
566
567 /* Default value cannot be changed */
568 if (cs->which == V4L2_CTRL_WHICH_DEF_VAL) {
569 dprintk(vdev, "%s: cannot change default value\n",
570 video_device_node_name(vdev));
571 return -EINVAL;
572 }
573
574 cs->which = V4L2_CTRL_ID2WHICH(cs->which);
575
576 if (!hdl) {
577 dprintk(vdev, "%s: invalid null control handler\n",
578 video_device_node_name(vdev));
579 return -EINVAL;
580 }
581
582 if (cs->count == 0)
583 return class_check(hdl, cs->which);
584
585 if (cs->count > ARRAY_SIZE(helper)) {
586 helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
587 GFP_KERNEL);
588 if (!helpers)
589 return -ENOMEM;
590 }
591 ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, false);
592 if (!ret)
593 ret = validate_ctrls(cs, helpers, vdev, set);
594 if (ret && set)
595 cs->error_idx = cs->count;
596 for (i = 0; !ret && i < cs->count; i++) {
597 struct v4l2_ctrl *master;
598 u32 idx = i;
599
600 if (!helpers[i].mref)
601 continue;
602
603 cs->error_idx = i;
604 master = helpers[i].mref->ctrl;
605 v4l2_ctrl_lock(master);
606
607 /* Reset the 'is_new' flags of the cluster */
608 for (j = 0; j < master->ncontrols; j++)
609 if (master->cluster[j])
610 master->cluster[j]->is_new = 0;
611
612 /*
613 * For volatile autoclusters that are currently in auto mode
614 * we need to discover if it will be set to manual mode.
615 * If so, then we have to copy the current volatile values
616 * first since those will become the new manual values (which
617 * may be overwritten by explicit new values from this set
618 * of controls).
619 */
620 if (master->is_auto && master->has_volatiles &&
621 !is_cur_manual(master)) {
622 /* Pick an initial non-manual value */
623 s32 new_auto_val = master->manual_mode_value + 1;
624 u32 tmp_idx = idx;
625
626 do {
627 /*
628 * Check if the auto control is part of the
629 * list, and remember the new value.
630 */
631 if (helpers[tmp_idx].ref->ctrl == master)
632 new_auto_val = cs->controls[tmp_idx].value;
633 tmp_idx = helpers[tmp_idx].next;
634 } while (tmp_idx);
635 /*
636 * If the new value == the manual value, then copy
637 * the current volatile values.
638 */
639 if (new_auto_val == master->manual_mode_value)
640 update_from_auto_cluster(master);
641 }
642
643 /*
644 * Copy the new caller-supplied control values.
645 * user_to_new() sets 'is_new' to 1.
646 */
647 do {
648 struct v4l2_ctrl *ctrl = helpers[idx].ref->ctrl;
649
650 ret = user_to_new(cs->controls + idx, ctrl);
651 if (!ret && ctrl->is_ptr) {
652 ret = validate_new(ctrl, ctrl->p_new);
653 if (ret)
654 dprintk(vdev,
655 "failed to validate control %s (%d)\n",
656 v4l2_ctrl_get_name(ctrl->id), ret);
657 }
658 idx = helpers[idx].next;
659 } while (!ret && idx);
660
661 if (!ret)
662 ret = try_or_set_cluster(fh, master,
663 !hdl->req_obj.req && set, 0);
664 if (!ret && hdl->req_obj.req && set) {
665 for (j = 0; j < master->ncontrols; j++) {
666 struct v4l2_ctrl_ref *ref =
667 find_ref(hdl, master->cluster[j]->id);
668
669 new_to_req(ref);
670 }
671 }
672
673 /* Copy the new values back to userspace. */
674 if (!ret) {
675 idx = i;
676 do {
677 ret = new_to_user(cs->controls + idx,
678 helpers[idx].ref->ctrl);
679 idx = helpers[idx].next;
680 } while (!ret && idx);
681 }
682 v4l2_ctrl_unlock(master);
683 }
684
685 if (cs->count > ARRAY_SIZE(helper))
686 kvfree(helpers);
687 return ret;
688}
689
690static int try_set_ext_ctrls(struct v4l2_fh *fh,
691 struct v4l2_ctrl_handler *hdl,
692 struct video_device *vdev,
693 struct media_device *mdev,
694 struct v4l2_ext_controls *cs, bool set)
695{
696 int ret;
697
698 if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
699 return try_set_ext_ctrls_request(fh, hdl, vdev, mdev, cs, set);
700
701 ret = try_set_ext_ctrls_common(fh, hdl, cs, vdev, set);
702 if (ret)
703 dprintk(vdev,
704 "%s: try_set_ext_ctrls_common failed (%d)\n",
705 video_device_node_name(vdev), ret);
706
707 return ret;
708}
709
710int v4l2_try_ext_ctrls(struct v4l2_ctrl_handler *hdl,
711 struct video_device *vdev,
712 struct media_device *mdev,
713 struct v4l2_ext_controls *cs)
714{
715 return try_set_ext_ctrls(NULL, hdl, vdev, mdev, cs, false);
716}
717EXPORT_SYMBOL(v4l2_try_ext_ctrls);
718
719int v4l2_s_ext_ctrls(struct v4l2_fh *fh,
720 struct v4l2_ctrl_handler *hdl,
721 struct video_device *vdev,
722 struct media_device *mdev,
723 struct v4l2_ext_controls *cs)
724{
725 return try_set_ext_ctrls(fh, hdl, vdev, mdev, cs, true);
726}
727EXPORT_SYMBOL(v4l2_s_ext_ctrls);
728
729/*
730 * VIDIOC_G/S_CTRL implementation
731 */
732
733/* Helper function to get a single control */
734static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c)
735{
736 struct v4l2_ctrl *master = ctrl->cluster[0];
737 int ret = 0;
738 int i;
739
740 /* Compound controls are not supported. The new_to_user() and
741 * cur_to_user() calls below would need to be modified not to access
742 * userspace memory when called from get_ctrl().
743 */
744 if (!ctrl->is_int && ctrl->type != V4L2_CTRL_TYPE_INTEGER64)
745 return -EINVAL;
746
747 if (ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
748 return -EACCES;
749
750 v4l2_ctrl_lock(master);
751 /* g_volatile_ctrl will update the current control values */
752 if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
753 for (i = 0; i < master->ncontrols; i++)
754 cur_to_new(master->cluster[i]);
755 ret = call_op(master, g_volatile_ctrl);
756 if (!ret)
757 ret = new_to_user(c, ctrl);
758 } else {
759 ret = cur_to_user(c, ctrl);
760 }
761 v4l2_ctrl_unlock(master);
762 return ret;
763}
764
765int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_control *control)
766{
767 struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
768 struct v4l2_ext_control c;
769 int ret;
770
771 if (!ctrl || !ctrl->is_int)
772 return -EINVAL;
773 ret = get_ctrl(ctrl, &c);
774
775 if (!ret)
776 control->value = c.value;
777
778 return ret;
779}
780EXPORT_SYMBOL(v4l2_g_ctrl);
781
782/* Helper function for VIDIOC_S_CTRL compatibility */
783static int set_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
784{
785 struct v4l2_ctrl *master = ctrl->cluster[0];
786 int ret;
787 int i;
788
789 /* Reset the 'is_new' flags of the cluster */
790 for (i = 0; i < master->ncontrols; i++)
791 if (master->cluster[i])
792 master->cluster[i]->is_new = 0;
793
794 ret = validate_new(ctrl, ctrl->p_new);
795 if (ret)
796 return ret;
797
798 /*
799 * For autoclusters with volatiles that are switched from auto to
800 * manual mode we have to update the current volatile values since
801 * those will become the initial manual values after such a switch.
802 */
803 if (master->is_auto && master->has_volatiles && ctrl == master &&
804 !is_cur_manual(master) && ctrl->val == master->manual_mode_value)
805 update_from_auto_cluster(master);
806
807 ctrl->is_new = 1;
808 return try_or_set_cluster(fh, master, true, ch_flags);
809}
810
811/* Helper function for VIDIOC_S_CTRL compatibility */
812static int set_ctrl_lock(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl,
813 struct v4l2_ext_control *c)
814{
815 int ret;
816
817 v4l2_ctrl_lock(ctrl);
818 ret = user_to_new(c, ctrl);
819 if (!ret)
820 ret = set_ctrl(fh, ctrl, 0);
821 if (!ret)
822 ret = cur_to_user(c, ctrl);
823 v4l2_ctrl_unlock(ctrl);
824 return ret;
825}
826
827int v4l2_s_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl_handler *hdl,
828 struct v4l2_control *control)
829{
830 struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
831 struct v4l2_ext_control c = { control->id };
832 int ret;
833
834 if (!ctrl || !ctrl->is_int)
835 return -EINVAL;
836
837 if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
838 return -EACCES;
839
840 c.value = control->value;
841 ret = set_ctrl_lock(fh, ctrl, &c);
842 control->value = c.value;
843 return ret;
844}
845EXPORT_SYMBOL(v4l2_s_ctrl);
846
847/*
848 * Helper functions for drivers to get/set controls.
849 */
850
851s32 v4l2_ctrl_g_ctrl(struct v4l2_ctrl *ctrl)
852{
853 struct v4l2_ext_control c;
854
855 /* It's a driver bug if this happens. */
856 if (WARN_ON(!ctrl->is_int))
857 return 0;
858 c.value = 0;
859 get_ctrl(ctrl, &c);
860 return c.value;
861}
862EXPORT_SYMBOL(v4l2_ctrl_g_ctrl);
863
864s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl)
865{
866 struct v4l2_ext_control c;
867
868 /* It's a driver bug if this happens. */
869 if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
870 return 0;
871 c.value64 = 0;
872 get_ctrl(ctrl, &c);
873 return c.value64;
874}
875EXPORT_SYMBOL(v4l2_ctrl_g_ctrl_int64);
876
877int __v4l2_ctrl_s_ctrl(struct v4l2_ctrl *ctrl, s32 val)
878{
879 lockdep_assert_held(ctrl->handler->lock);
880
881 /* It's a driver bug if this happens. */
882 if (WARN_ON(!ctrl->is_int))
883 return -EINVAL;
884 ctrl->val = val;
885 return set_ctrl(NULL, ctrl, 0);
886}
887EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl);
888
889int __v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl *ctrl, s64 val)
890{
891 lockdep_assert_held(ctrl->handler->lock);
892
893 /* It's a driver bug if this happens. */
894 if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
895 return -EINVAL;
896 *ctrl->p_new.p_s64 = val;
897 return set_ctrl(NULL, ctrl, 0);
898}
899EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_int64);
900
901int __v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl *ctrl, const char *s)
902{
903 lockdep_assert_held(ctrl->handler->lock);
904
905 /* It's a driver bug if this happens. */
906 if (WARN_ON(ctrl->type != V4L2_CTRL_TYPE_STRING))
907 return -EINVAL;
908 strscpy(ctrl->p_new.p_char, s, ctrl->maximum + 1);
909 return set_ctrl(NULL, ctrl, 0);
910}
911EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_string);
912
913int __v4l2_ctrl_s_ctrl_compound(struct v4l2_ctrl *ctrl,
914 enum v4l2_ctrl_type type, const void *p)
915{
916 lockdep_assert_held(ctrl->handler->lock);
917
918 /* It's a driver bug if this happens. */
919 if (WARN_ON(ctrl->type != type))
920 return -EINVAL;
921 /* Setting dynamic arrays is not (yet?) supported. */
922 if (WARN_ON(ctrl->is_dyn_array))
923 return -EINVAL;
924 memcpy(ctrl->p_new.p, p, ctrl->elems * ctrl->elem_size);
925 return set_ctrl(NULL, ctrl, 0);
926}
927EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_compound);
928
929/*
930 * Modify the range of a control.
931 */
932int __v4l2_ctrl_modify_range(struct v4l2_ctrl *ctrl,
933 s64 min, s64 max, u64 step, s64 def)
934{
935 bool value_changed;
936 bool range_changed = false;
937 int ret;
938
939 lockdep_assert_held(ctrl->handler->lock);
940
941 switch (ctrl->type) {
942 case V4L2_CTRL_TYPE_INTEGER:
943 case V4L2_CTRL_TYPE_INTEGER64:
944 case V4L2_CTRL_TYPE_BOOLEAN:
945 case V4L2_CTRL_TYPE_MENU:
946 case V4L2_CTRL_TYPE_INTEGER_MENU:
947 case V4L2_CTRL_TYPE_BITMASK:
948 case V4L2_CTRL_TYPE_U8:
949 case V4L2_CTRL_TYPE_U16:
950 case V4L2_CTRL_TYPE_U32:
951 if (ctrl->is_array)
952 return -EINVAL;
953 ret = check_range(ctrl->type, min, max, step, def);
954 if (ret)
955 return ret;
956 break;
957 default:
958 return -EINVAL;
959 }
960 if (ctrl->minimum != min || ctrl->maximum != max ||
961 ctrl->step != step || ctrl->default_value != def) {
962 range_changed = true;
963 ctrl->minimum = min;
964 ctrl->maximum = max;
965 ctrl->step = step;
966 ctrl->default_value = def;
967 }
968 cur_to_new(ctrl);
969 if (validate_new(ctrl, ctrl->p_new)) {
970 if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
971 *ctrl->p_new.p_s64 = def;
972 else
973 *ctrl->p_new.p_s32 = def;
974 }
975
976 if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
977 value_changed = *ctrl->p_new.p_s64 != *ctrl->p_cur.p_s64;
978 else
979 value_changed = *ctrl->p_new.p_s32 != *ctrl->p_cur.p_s32;
980 if (value_changed)
981 ret = set_ctrl(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
982 else if (range_changed)
983 send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
984 return ret;
985}
986EXPORT_SYMBOL(__v4l2_ctrl_modify_range);
987
988int __v4l2_ctrl_modify_dimensions(struct v4l2_ctrl *ctrl,
989 u32 dims[V4L2_CTRL_MAX_DIMS])
990{
991 unsigned int elems = 1;
992 unsigned int i;
993 void *p_array;
994
995 lockdep_assert_held(ctrl->handler->lock);
996
997 if (!ctrl->is_array || ctrl->is_dyn_array)
998 return -EINVAL;
999
1000 for (i = 0; i < ctrl->nr_of_dims; i++)
1001 elems *= dims[i];
1002 if (elems == 0)
1003 return -EINVAL;
1004 p_array = kvzalloc(2 * elems * ctrl->elem_size, GFP_KERNEL);
1005 if (!p_array)
1006 return -ENOMEM;
1007 kvfree(ctrl->p_array);
1008 ctrl->p_array_alloc_elems = elems;
1009 ctrl->elems = elems;
1010 ctrl->new_elems = elems;
1011 ctrl->p_array = p_array;
1012 ctrl->p_new.p = p_array;
1013 ctrl->p_cur.p = p_array + elems * ctrl->elem_size;
1014 for (i = 0; i < ctrl->nr_of_dims; i++)
1015 ctrl->dims[i] = dims[i];
1016 ctrl->type_ops->init(ctrl, 0, ctrl->p_cur);
1017 cur_to_new(ctrl);
1018 send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_VALUE |
1019 V4L2_EVENT_CTRL_CH_DIMENSIONS);
1020 return 0;
1021}
1022EXPORT_SYMBOL(__v4l2_ctrl_modify_dimensions);
1023
1024/* Implement VIDIOC_QUERY_EXT_CTRL */
1025int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctrl *qc)
1026{
1027 const unsigned int next_flags = V4L2_CTRL_FLAG_NEXT_CTRL | V4L2_CTRL_FLAG_NEXT_COMPOUND;
1028 u32 id = qc->id & V4L2_CTRL_ID_MASK;
1029 struct v4l2_ctrl_ref *ref;
1030 struct v4l2_ctrl *ctrl;
1031
1032 if (!hdl)
1033 return -EINVAL;
1034
1035 mutex_lock(hdl->lock);
1036
1037 /* Try to find it */
1038 ref = find_ref(hdl, id);
1039
1040 if ((qc->id & next_flags) && !list_empty(&hdl->ctrl_refs)) {
1041 bool is_compound;
1042 /* Match any control that is not hidden */
1043 unsigned int mask = 1;
1044 bool match = false;
1045
1046 if ((qc->id & next_flags) == V4L2_CTRL_FLAG_NEXT_COMPOUND) {
1047 /* Match any hidden control */
1048 match = true;
1049 } else if ((qc->id & next_flags) == next_flags) {
1050 /* Match any control, compound or not */
1051 mask = 0;
1052 }
1053
1054 /* Find the next control with ID > qc->id */
1055
1056 /* Did we reach the end of the control list? */
1057 if (id >= node2id(hdl->ctrl_refs.prev)) {
1058 ref = NULL; /* Yes, so there is no next control */
1059 } else if (ref) {
1060 struct v4l2_ctrl_ref *pos = ref;
1061
1062 /*
1063 * We found a control with the given ID, so just get
1064 * the next valid one in the list.
1065 */
1066 ref = NULL;
1067 list_for_each_entry_continue(pos, &hdl->ctrl_refs, node) {
1068 is_compound = pos->ctrl->is_array ||
1069 pos->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
1070 if (id < pos->ctrl->id &&
1071 (is_compound & mask) == match) {
1072 ref = pos;
1073 break;
1074 }
1075 }
1076 } else {
1077 struct v4l2_ctrl_ref *pos;
1078
1079 /*
1080 * No control with the given ID exists, so start
1081 * searching for the next largest ID. We know there
1082 * is one, otherwise the first 'if' above would have
1083 * been true.
1084 */
1085 list_for_each_entry(pos, &hdl->ctrl_refs, node) {
1086 is_compound = pos->ctrl->is_array ||
1087 pos->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
1088 if (id < pos->ctrl->id &&
1089 (is_compound & mask) == match) {
1090 ref = pos;
1091 break;
1092 }
1093 }
1094 }
1095 }
1096 mutex_unlock(hdl->lock);
1097
1098 if (!ref)
1099 return -EINVAL;
1100
1101 ctrl = ref->ctrl;
1102 memset(qc, 0, sizeof(*qc));
1103 if (id >= V4L2_CID_PRIVATE_BASE)
1104 qc->id = id;
1105 else
1106 qc->id = ctrl->id;
1107 strscpy(qc->name, ctrl->name, sizeof(qc->name));
1108 qc->flags = user_flags(ctrl);
1109 qc->type = ctrl->type;
1110 qc->elem_size = ctrl->elem_size;
1111 qc->elems = ctrl->elems;
1112 qc->nr_of_dims = ctrl->nr_of_dims;
1113 memcpy(qc->dims, ctrl->dims, qc->nr_of_dims * sizeof(qc->dims[0]));
1114 qc->minimum = ctrl->minimum;
1115 qc->maximum = ctrl->maximum;
1116 qc->default_value = ctrl->default_value;
1117 if (ctrl->type == V4L2_CTRL_TYPE_MENU ||
1118 ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
1119 qc->step = 1;
1120 else
1121 qc->step = ctrl->step;
1122 return 0;
1123}
1124EXPORT_SYMBOL(v4l2_query_ext_ctrl);
1125
1126/* Implement VIDIOC_QUERYCTRL */
1127int v4l2_queryctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_queryctrl *qc)
1128{
1129 struct v4l2_query_ext_ctrl qec = { qc->id };
1130 int rc;
1131
1132 rc = v4l2_query_ext_ctrl(hdl, &qec);
1133 if (rc)
1134 return rc;
1135
1136 qc->id = qec.id;
1137 qc->type = qec.type;
1138 qc->flags = qec.flags;
1139 strscpy(qc->name, qec.name, sizeof(qc->name));
1140 switch (qc->type) {
1141 case V4L2_CTRL_TYPE_INTEGER:
1142 case V4L2_CTRL_TYPE_BOOLEAN:
1143 case V4L2_CTRL_TYPE_MENU:
1144 case V4L2_CTRL_TYPE_INTEGER_MENU:
1145 case V4L2_CTRL_TYPE_STRING:
1146 case V4L2_CTRL_TYPE_BITMASK:
1147 qc->minimum = qec.minimum;
1148 qc->maximum = qec.maximum;
1149 qc->step = qec.step;
1150 qc->default_value = qec.default_value;
1151 break;
1152 default:
1153 qc->minimum = 0;
1154 qc->maximum = 0;
1155 qc->step = 0;
1156 qc->default_value = 0;
1157 break;
1158 }
1159 return 0;
1160}
1161EXPORT_SYMBOL(v4l2_queryctrl);
1162
1163/* Implement VIDIOC_QUERYMENU */
1164int v4l2_querymenu(struct v4l2_ctrl_handler *hdl, struct v4l2_querymenu *qm)
1165{
1166 struct v4l2_ctrl *ctrl;
1167 u32 i = qm->index;
1168
1169 ctrl = v4l2_ctrl_find(hdl, qm->id);
1170 if (!ctrl)
1171 return -EINVAL;
1172
1173 qm->reserved = 0;
1174 /* Sanity checks */
1175 switch (ctrl->type) {
1176 case V4L2_CTRL_TYPE_MENU:
1177 if (!ctrl->qmenu)
1178 return -EINVAL;
1179 break;
1180 case V4L2_CTRL_TYPE_INTEGER_MENU:
1181 if (!ctrl->qmenu_int)
1182 return -EINVAL;
1183 break;
1184 default:
1185 return -EINVAL;
1186 }
1187
1188 if (i < ctrl->minimum || i > ctrl->maximum)
1189 return -EINVAL;
1190
1191 /* Use mask to see if this menu item should be skipped */
1192 if (i < BITS_PER_LONG_LONG && (ctrl->menu_skip_mask & BIT_ULL(i)))
1193 return -EINVAL;
1194 /* Empty menu items should also be skipped */
1195 if (ctrl->type == V4L2_CTRL_TYPE_MENU) {
1196 if (!ctrl->qmenu[i] || ctrl->qmenu[i][0] == '\0')
1197 return -EINVAL;
1198 strscpy(qm->name, ctrl->qmenu[i], sizeof(qm->name));
1199 } else {
1200 qm->value = ctrl->qmenu_int[i];
1201 }
1202 return 0;
1203}
1204EXPORT_SYMBOL(v4l2_querymenu);
1205
1206/*
1207 * VIDIOC_LOG_STATUS helpers
1208 */
1209
1210int v4l2_ctrl_log_status(struct file *file, void *fh)
1211{
1212 struct video_device *vfd = video_devdata(file);
1213 struct v4l2_fh *vfh = file->private_data;
1214
1215 if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags) && vfd->v4l2_dev)
1216 v4l2_ctrl_handler_log_status(vfh->ctrl_handler,
1217 vfd->v4l2_dev->name);
1218 return 0;
1219}
1220EXPORT_SYMBOL(v4l2_ctrl_log_status);
1221
1222int v4l2_ctrl_subdev_log_status(struct v4l2_subdev *sd)
1223{
1224 v4l2_ctrl_handler_log_status(sd->ctrl_handler, sd->name);
1225 return 0;
1226}
1227EXPORT_SYMBOL(v4l2_ctrl_subdev_log_status);
1228
1229/*
1230 * VIDIOC_(UN)SUBSCRIBE_EVENT implementation
1231 */
1232
1233static int v4l2_ctrl_add_event(struct v4l2_subscribed_event *sev,
1234 unsigned int elems)
1235{
1236 struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1237
1238 if (!ctrl)
1239 return -EINVAL;
1240
1241 v4l2_ctrl_lock(ctrl);
1242 list_add_tail(&sev->node, &ctrl->ev_subs);
1243 if (ctrl->type != V4L2_CTRL_TYPE_CTRL_CLASS &&
1244 (sev->flags & V4L2_EVENT_SUB_FL_SEND_INITIAL))
1245 send_initial_event(sev->fh, ctrl);
1246 v4l2_ctrl_unlock(ctrl);
1247 return 0;
1248}
1249
1250static void v4l2_ctrl_del_event(struct v4l2_subscribed_event *sev)
1251{
1252 struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1253
1254 if (!ctrl)
1255 return;
1256
1257 v4l2_ctrl_lock(ctrl);
1258 list_del(&sev->node);
1259 v4l2_ctrl_unlock(ctrl);
1260}
1261
1262void v4l2_ctrl_replace(struct v4l2_event *old, const struct v4l2_event *new)
1263{
1264 u32 old_changes = old->u.ctrl.changes;
1265
1266 old->u.ctrl = new->u.ctrl;
1267 old->u.ctrl.changes |= old_changes;
1268}
1269EXPORT_SYMBOL(v4l2_ctrl_replace);
1270
1271void v4l2_ctrl_merge(const struct v4l2_event *old, struct v4l2_event *new)
1272{
1273 new->u.ctrl.changes |= old->u.ctrl.changes;
1274}
1275EXPORT_SYMBOL(v4l2_ctrl_merge);
1276
1277const struct v4l2_subscribed_event_ops v4l2_ctrl_sub_ev_ops = {
1278 .add = v4l2_ctrl_add_event,
1279 .del = v4l2_ctrl_del_event,
1280 .replace = v4l2_ctrl_replace,
1281 .merge = v4l2_ctrl_merge,
1282};
1283EXPORT_SYMBOL(v4l2_ctrl_sub_ev_ops);
1284
1285int v4l2_ctrl_subscribe_event(struct v4l2_fh *fh,
1286 const struct v4l2_event_subscription *sub)
1287{
1288 if (sub->type == V4L2_EVENT_CTRL)
1289 return v4l2_event_subscribe(fh, sub, 0, &v4l2_ctrl_sub_ev_ops);
1290 return -EINVAL;
1291}
1292EXPORT_SYMBOL(v4l2_ctrl_subscribe_event);
1293
1294int v4l2_ctrl_subdev_subscribe_event(struct v4l2_subdev *sd, struct v4l2_fh *fh,
1295 struct v4l2_event_subscription *sub)
1296{
1297 if (!sd->ctrl_handler)
1298 return -EINVAL;
1299 return v4l2_ctrl_subscribe_event(fh, sub);
1300}
1301EXPORT_SYMBOL(v4l2_ctrl_subdev_subscribe_event);
1302
1303/*
1304 * poll helper
1305 */
1306__poll_t v4l2_ctrl_poll(struct file *file, struct poll_table_struct *wait)
1307{
1308 struct v4l2_fh *fh = file->private_data;
1309
1310 poll_wait(file, &fh->wait, wait);
1311 if (v4l2_event_pending(fh))
1312 return EPOLLPRI;
1313 return 0;
1314}
1315EXPORT_SYMBOL(v4l2_ctrl_poll);