drivers/media/v4l2-core/v4l2-ctrls-api.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * V4L2 controls framework uAPI implementation:
   4  *
   5  * Copyright (C) 2010-2021  Hans Verkuil <[email protected]>
   6  */
   7
   8 #define pr_fmt(fmt) "v4l2-ctrls: " fmt
   9
  10 #include <linux/export.h>
  11 #include <linux/mm.h>
  12 #include <linux/slab.h>
  13 #include <media/v4l2-ctrls.h>
  14 #include <media/v4l2-dev.h>
  15 #include <media/v4l2-device.h>
  16 #include <media/v4l2-event.h>
  17 #include <media/v4l2-ioctl.h>
  18
  19 #include "v4l2-ctrls-priv.h"
  20
  21 /* Internal temporary helper struct, one for each v4l2_ext_control */
  22 struct v4l2_ctrl_helper {
  23         /* Pointer to the control reference of the master control */
  24         struct v4l2_ctrl_ref *mref;
  25         /* The control ref corresponding to the v4l2_ext_control ID field. */
  26         struct v4l2_ctrl_ref *ref;
  27         /*
  28          * v4l2_ext_control index of the next control belonging to the
  29          * same cluster, or 0 if there isn't any.
  30          */
  31         u32 next;
  32 };
  33
  34 /*
  35  * Helper functions to copy control payload data from kernel space to
  36  * user space and vice versa.
  37  */
  38
  39 /* Helper function: copy the given control value back to the caller */
  40 static int ptr_to_user(struct v4l2_ext_control *c,
  41                        struct v4l2_ctrl *ctrl,
  42                        union v4l2_ctrl_ptr ptr)
  43 {
  44         u32 len;
  45
  46         if (ctrl->is_ptr && !ctrl->is_string)
  47                 return copy_to_user(c->ptr, ptr.p_const, c->size) ?
  48                        -EFAULT : 0;
  49
  50         switch (ctrl->type) {
  51         case V4L2_CTRL_TYPE_STRING:
  52                 len = strlen(ptr.p_char);
  53                 if (c->size < len + 1) {
  54                         c->size = ctrl->elem_size;
  55                         return -ENOSPC;
  56                 }
  57                 return copy_to_user(c->string, ptr.p_char, len + 1) ?
  58                        -EFAULT : 0;
  59         case V4L2_CTRL_TYPE_INTEGER64:
  60                 c->value64 = *ptr.p_s64;
  61                 break;
  62         default:
  63                 c->value = *ptr.p_s32;
  64                 break;
  65         }
  66         return 0;
  67 }
  68
  69 /* Helper function: copy the current control value back to the caller */
  70 static int cur_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
  71 {
  72         return ptr_to_user(c, ctrl, ctrl->p_cur);
  73 }
  74
  75 /* Helper function: copy the new control value back to the caller */
  76 static int new_to_user(struct v4l2_ext_control *c,
  77                        struct v4l2_ctrl *ctrl)
  78 {
  79         return ptr_to_user(c, ctrl, ctrl->p_new);
  80 }
  81
  82 /* Helper function: copy the request value back to the caller */
  83 static int req_to_user(struct v4l2_ext_control *c,
  84                        struct v4l2_ctrl_ref *ref)
  85 {
  86         return ptr_to_user(c, ref->ctrl, ref->p_req);
  87 }
  88
  89 /* Helper function: copy the initial control value back to the caller */
  90 static int def_to_user(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
  91 {
  92         int idx;
  93
  94         for (idx = 0; idx < ctrl->elems; idx++)
  95                 ctrl->type_ops->init(ctrl, idx, ctrl->p_new);
  96
  97         return ptr_to_user(c, ctrl, ctrl->p_new);
  98 }
  99
 100 /* Helper function: copy the caller-provider value as the new control value */
 101 static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
 102 {
 103         int ret;
 104         u32 size;
 105
 106         ctrl->is_new = 0;
 107         if (ctrl->is_dyn_array &&
 108             c->size > ctrl->p_dyn_alloc_elems * ctrl->elem_size) {
 109                 void *old = ctrl->p_dyn;
 110                 void *tmp = kvzalloc(2 * c->size, GFP_KERNEL);
 111
 112                 if (!tmp)
 113                         return -ENOMEM;
 114                 memcpy(tmp, ctrl->p_new.p, ctrl->elems * ctrl->elem_size);
 115                 memcpy(tmp + c->size, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size);
 116                 ctrl->p_new.p = tmp;
 117                 ctrl->p_cur.p = tmp + c->size;
 118                 ctrl->p_dyn = tmp;
 119                 ctrl->p_dyn_alloc_elems = c->size / ctrl->elem_size;
 120                 kvfree(old);
 121         }
 122
 123         if (ctrl->is_ptr && !ctrl->is_string) {
 124                 unsigned int elems = c->size / ctrl->elem_size;
 125                 unsigned int idx;
 126
 127                 if (copy_from_user(ctrl->p_new.p, c->ptr, c->size))
 128                         return -EFAULT;
 129                 ctrl->is_new = 1;
 130                 if (ctrl->is_dyn_array)
 131                         ctrl->new_elems = elems;
 132                 else if (ctrl->is_array)
 133                         for (idx = elems; idx < ctrl->elems; idx++)
 134                                 ctrl->type_ops->init(ctrl, idx, ctrl->p_new);
 135                 return 0;
 136         }
 137
 138         switch (ctrl->type) {
 139         case V4L2_CTRL_TYPE_INTEGER64:
 140                 *ctrl->p_new.p_s64 = c->value64;
 141                 break;
 142         case V4L2_CTRL_TYPE_STRING:
 143                 size = c->size;
 144                 if (size == 0)
 145                         return -ERANGE;
 146                 if (size > ctrl->maximum + 1)
 147                         size = ctrl->maximum + 1;
 148                 ret = copy_from_user(ctrl->p_new.p_char, c->string, size) ? -EFAULT : 0;
 149                 if (!ret) {
 150                         char last = ctrl->p_new.p_char[size - 1];
 151
 152                         ctrl->p_new.p_char[size - 1] = 0;
 153                         /*
 154                          * If the string was longer than ctrl->maximum,
 155                          * then return an error.
 156                          */
 157                         if (strlen(ctrl->p_new.p_char) == ctrl->maximum && last)
 158                                 return -ERANGE;
 159                 }
 160                 return ret;
 161         default:
 162                 *ctrl->p_new.p_s32 = c->value;
 163                 break;
 164         }
 165         ctrl->is_new = 1;
 166         return 0;
 167 }
 168
 169 /*
 170  * VIDIOC_G/TRY/S_EXT_CTRLS implementation
 171  */
 172
 173 /*
 174  * Some general notes on the atomic requirements of VIDIOC_G/TRY/S_EXT_CTRLS:
 175  *
 176  * It is not a fully atomic operation, just best-effort only. After all, if
 177  * multiple controls have to be set through multiple i2c writes (for example)
 178  * then some initial writes may succeed while others fail. Thus leaving the
 179  * system in an inconsistent state. The question is how much effort you are
 180  * willing to spend on trying to make something atomic that really isn't.
 181  *
 182  * From the point of view of an application the main requirement is that
 183  * when you call VIDIOC_S_EXT_CTRLS and some values are invalid then an
 184  * error should be returned without actually affecting any controls.
 185  *
 186  * If all the values are correct, then it is acceptable to just give up
 187  * in case of low-level errors.
 188  *
 189  * It is important though that the application can tell when only a partial
 190  * configuration was done. The way we do that is through the error_idx field
 191  * of struct v4l2_ext_controls: if that is equal to the count field then no
 192  * controls were affected. Otherwise all controls before that index were
 193  * successful in performing their 'get' or 'set' operation, the control at
 194  * the given index failed, and you don't know what happened with the controls
 195  * after the failed one. Since if they were part of a control cluster they
 196  * could have been successfully processed (if a cluster member was encountered
 197  * at index < error_idx), they could have failed (if a cluster member was at
 198  * error_idx), or they may not have been processed yet (if the first cluster
 199  * member appeared after error_idx).
 200  *
 201  * It is all fairly theoretical, though. In practice all you can do is to
 202  * bail out. If error_idx == count, then it is an application bug. If
 203  * error_idx < count then it is only an application bug if the error code was
 204  * EBUSY. That usually means that something started streaming just when you
 205  * tried to set the controls. In all other cases it is a driver/hardware
 206  * problem and all you can do is to retry or bail out.
 207  *
 208  * Note that these rules do not apply to VIDIOC_TRY_EXT_CTRLS: since that
 209  * never modifies controls the error_idx is just set to whatever control
 210  * has an invalid value.
 211  */
 212
 213 /*
 214  * Prepare for the extended g/s/try functions.
 215  * Find the controls in the control array and do some basic checks.
 216  */
 217 static int prepare_ext_ctrls(struct v4l2_ctrl_handler *hdl,
 218                              struct v4l2_ext_controls *cs,
 219                              struct v4l2_ctrl_helper *helpers,
 220                              struct video_device *vdev,
 221                              bool get)
 222 {
 223         struct v4l2_ctrl_helper *h;
 224         bool have_clusters = false;
 225         u32 i;
 226
 227         for (i = 0, h = helpers; i < cs->count; i++, h++) {
 228                 struct v4l2_ext_control *c = &cs->controls[i];
 229                 struct v4l2_ctrl_ref *ref;
 230                 struct v4l2_ctrl *ctrl;
 231                 u32 id = c->id & V4L2_CTRL_ID_MASK;
 232
 233                 cs->error_idx = i;
 234
 235                 if (cs->which &&
 236                     cs->which != V4L2_CTRL_WHICH_DEF_VAL &&
 237                     cs->which != V4L2_CTRL_WHICH_REQUEST_VAL &&
 238                     V4L2_CTRL_ID2WHICH(id) != cs->which) {
 239                         dprintk(vdev,
 240                                 "invalid which 0x%x or control id 0x%x\n",
 241                                 cs->which, id);
 242                         return -EINVAL;
 243                 }
 244
 245                 /*
 246                  * Old-style private controls are not allowed for
 247                  * extended controls.
 248                  */
 249                 if (id >= V4L2_CID_PRIVATE_BASE) {
 250                         dprintk(vdev,
 251                                 "old-style private controls not allowed\n");
 252                         return -EINVAL;
 253                 }
 254                 ref = find_ref_lock(hdl, id);
 255                 if (!ref) {
 256                         dprintk(vdev, "cannot find control id 0x%x\n", id);
 257                         return -EINVAL;
 258                 }
 259                 h->ref = ref;
 260                 ctrl = ref->ctrl;
 261                 if (ctrl->flags & V4L2_CTRL_FLAG_DISABLED) {
 262                         dprintk(vdev, "control id 0x%x is disabled\n", id);
 263                         return -EINVAL;
 264                 }
 265
 266                 if (ctrl->cluster[0]->ncontrols > 1)
 267                         have_clusters = true;
 268                 if (ctrl->cluster[0] != ctrl)
 269                         ref = find_ref_lock(hdl, ctrl->cluster[0]->id);
 270                 if (ctrl->is_dyn_array) {
 271                         unsigned int max_size = ctrl->dims[0] * ctrl->elem_size;
 272                         unsigned int tot_size = ctrl->elem_size;
 273
 274                         if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
 275                                 tot_size *= ref->p_req_elems;
 276                         else
 277                                 tot_size *= ctrl->elems;
 278
 279                         c->size = ctrl->elem_size * (c->size / ctrl->elem_size);
 280                         if (get) {
 281                                 if (c->size < tot_size) {
 282                                         c->size = tot_size;
 283                                         return -ENOSPC;
 284                                 }
 285                                 c->size = tot_size;
 286                         } else {
 287                                 if (c->size > max_size) {
 288                                         c->size = max_size;
 289                                         return -ENOSPC;
 290                                 }
 291                                 if (!c->size)
 292                                         return -EFAULT;
 293                         }
 294                 } else if (ctrl->is_ptr && !ctrl->is_string) {
 295                         unsigned int tot_size = ctrl->elems * ctrl->elem_size;
 296
 297                         if (c->size < tot_size) {
 298                                 /*
 299                                  * In the get case the application first
 300                                  * queries to obtain the size of the control.
 301                                  */
 302                                 if (get) {
 303                                         c->size = tot_size;
 304                                         return -ENOSPC;
 305                                 }
 306                                 dprintk(vdev,
 307                                         "pointer control id 0x%x size too small, %d bytes but %d bytes needed\n",
 308                                         id, c->size, tot_size);
 309                                 return -EFAULT;
 310                         }
 311                         c->size = tot_size;
 312                 }
 313                 /* Store the ref to the master control of the cluster */
 314                 h->mref = ref;
 315                 /*
 316                  * Initially set next to 0, meaning that there is no other
 317                  * control in this helper array belonging to the same
 318                  * cluster.
 319                  */
 320                 h->next = 0;
 321         }
 322
 323         /*
 324          * We are done if there were no controls that belong to a multi-
 325          * control cluster.
 326          */
 327         if (!have_clusters)
 328                 return 0;
 329
 330         /*
 331          * The code below figures out in O(n) time which controls in the list
 332          * belong to the same cluster.
 333          */
 334
 335         /* This has to be done with the handler lock taken. */
 336         mutex_lock(hdl->lock);
 337
 338         /* First zero the helper field in the master control references */
 339         for (i = 0; i < cs->count; i++)
 340                 helpers[i].mref->helper = NULL;
 341         for (i = 0, h = helpers; i < cs->count; i++, h++) {
 342                 struct v4l2_ctrl_ref *mref = h->mref;
 343
 344                 /*
 345                  * If the mref->helper is set, then it points to an earlier
 346                  * helper that belongs to the same cluster.
 347                  */
 348                 if (mref->helper) {
 349                         /*
 350                          * Set the next field of mref->helper to the current
 351                          * index: this means that the earlier helper now
 352                          * points to the next helper in the same cluster.
 353                          */
 354                         mref->helper->next = i;
 355                         /*
 356                          * mref should be set only for the first helper in the
 357                          * cluster, clear the others.
 358                          */
 359                         h->mref = NULL;
 360                 }
 361                 /* Point the mref helper to the current helper struct. */
 362                 mref->helper = h;
 363         }
 364         mutex_unlock(hdl->lock);
 365         return 0;
 366 }
 367
 368 /*
 369  * Handles the corner case where cs->count == 0. It checks whether the
 370  * specified control class exists. If that class ID is 0, then it checks
 371  * whether there are any controls at all.
 372  */
 373 static int class_check(struct v4l2_ctrl_handler *hdl, u32 which)
 374 {
 375         if (which == 0 || which == V4L2_CTRL_WHICH_DEF_VAL ||
 376             which == V4L2_CTRL_WHICH_REQUEST_VAL)
 377                 return 0;
 378         return find_ref_lock(hdl, which | 1) ? 0 : -EINVAL;
 379 }
 380
 381 /*
 382  * Get extended controls. Allocates the helpers array if needed.
 383  *
 384  * Note that v4l2_g_ext_ctrls_common() with 'which' set to
 385  * V4L2_CTRL_WHICH_REQUEST_VAL is only called if the request was
 386  * completed, and in that case p_req_valid is true for all controls.
 387  */
 388 int v4l2_g_ext_ctrls_common(struct v4l2_ctrl_handler *hdl,
 389                             struct v4l2_ext_controls *cs,
 390                             struct video_device *vdev)
 391 {
 392         struct v4l2_ctrl_helper helper[4];
 393         struct v4l2_ctrl_helper *helpers = helper;
 394         int ret;
 395         int i, j;
 396         bool is_default, is_request;
 397
 398         is_default = (cs->which == V4L2_CTRL_WHICH_DEF_VAL);
 399         is_request = (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL);
 400
 401         cs->error_idx = cs->count;
 402         cs->which = V4L2_CTRL_ID2WHICH(cs->which);
 403
 404         if (!hdl)
 405                 return -EINVAL;
 406
 407         if (cs->count == 0)
 408                 return class_check(hdl, cs->which);
 409
 410         if (cs->count > ARRAY_SIZE(helper)) {
 411                 helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
 412                                          GFP_KERNEL);
 413                 if (!helpers)
 414                         return -ENOMEM;
 415         }
 416
 417         ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, true);
 418         cs->error_idx = cs->count;
 419
 420         for (i = 0; !ret && i < cs->count; i++)
 421                 if (helpers[i].ref->ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
 422                         ret = -EACCES;
 423
 424         for (i = 0; !ret && i < cs->count; i++) {
 425                 struct v4l2_ctrl *master;
 426                 bool is_volatile = false;
 427                 u32 idx = i;
 428
 429                 if (!helpers[i].mref)
 430                         continue;
 431
 432                 master = helpers[i].mref->ctrl;
 433                 cs->error_idx = i;
 434
 435                 v4l2_ctrl_lock(master);
 436
 437                 /*
 438                  * g_volatile_ctrl will update the new control values.
 439                  * This makes no sense for V4L2_CTRL_WHICH_DEF_VAL and
 440                  * V4L2_CTRL_WHICH_REQUEST_VAL. In the case of requests
 441                  * it is v4l2_ctrl_request_complete() that copies the
 442                  * volatile controls at the time of request completion
 443                  * to the request, so you don't want to do that again.
 444                  */
 445                 if (!is_default && !is_request &&
 446                     ((master->flags & V4L2_CTRL_FLAG_VOLATILE) ||
 447                     (master->has_volatiles && !is_cur_manual(master)))) {
 448                         for (j = 0; j < master->ncontrols; j++)
 449                                 cur_to_new(master->cluster[j]);
 450                         ret = call_op(master, g_volatile_ctrl);
 451                         is_volatile = true;
 452                 }
 453
 454                 if (ret) {
 455                         v4l2_ctrl_unlock(master);
 456                         break;
 457                 }
 458
 459                 /*
 460                  * Copy the default value (if is_default is true), the
 461                  * request value (if is_request is true and p_req is valid),
 462                  * the new volatile value (if is_volatile is true) or the
 463                  * current value.
 464                  */
 465                 do {
 466                         struct v4l2_ctrl_ref *ref = helpers[idx].ref;
 467
 468                         if (is_default)
 469                                 ret = def_to_user(cs->controls + idx, ref->ctrl);
 470                         else if (is_request && ref->p_req_dyn_enomem)
 471                                 ret = -ENOMEM;
 472                         else if (is_request && ref->p_req_valid)
 473                                 ret = req_to_user(cs->controls + idx, ref);
 474                         else if (is_volatile)
 475                                 ret = new_to_user(cs->controls + idx, ref->ctrl);
 476                         else
 477                                 ret = cur_to_user(cs->controls + idx, ref->ctrl);
 478                         idx = helpers[idx].next;
 479                 } while (!ret && idx);
 480
 481                 v4l2_ctrl_unlock(master);
 482         }
 483
 484         if (cs->count > ARRAY_SIZE(helper))
 485                 kvfree(helpers);
 486         return ret;
 487 }
 488
 489 int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct video_device *vdev,
 490                      struct media_device *mdev, struct v4l2_ext_controls *cs)
 491 {
 492         if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
 493                 return v4l2_g_ext_ctrls_request(hdl, vdev, mdev, cs);
 494
 495         return v4l2_g_ext_ctrls_common(hdl, cs, vdev);
 496 }
 497 EXPORT_SYMBOL(v4l2_g_ext_ctrls);
 498
 499 /* Validate a new control */
 500 static int validate_new(const struct v4l2_ctrl *ctrl, union v4l2_ctrl_ptr p_new)
 501 {
 502         unsigned int idx;
 503         int err = 0;
 504
 505         for (idx = 0; !err && idx < ctrl->new_elems; idx++)
 506                 err = ctrl->type_ops->validate(ctrl, idx, p_new);
 507         return err;
 508 }
 509
 510 /* Validate controls. */
 511 static int validate_ctrls(struct v4l2_ext_controls *cs,
 512                           struct v4l2_ctrl_helper *helpers,
 513                           struct video_device *vdev,
 514                           bool set)
 515 {
 516         unsigned int i;
 517         int ret = 0;
 518
 519         cs->error_idx = cs->count;
 520         for (i = 0; i < cs->count; i++) {
 521                 struct v4l2_ctrl *ctrl = helpers[i].ref->ctrl;
 522                 union v4l2_ctrl_ptr p_new;
 523
 524                 cs->error_idx = i;
 525
 526                 if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY) {
 527                         dprintk(vdev,
 528                                 "control id 0x%x is read-only\n",
 529                                 ctrl->id);
 530                         return -EACCES;
 531                 }
 532                 /*
 533                  * This test is also done in try_set_control_cluster() which
 534                  * is called in atomic context, so that has the final say,
 535                  * but it makes sense to do an up-front check as well. Once
 536                  * an error occurs in try_set_control_cluster() some other
 537                  * controls may have been set already and we want to do a
 538                  * best-effort to avoid that.
 539                  */
 540                 if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED)) {
 541                         dprintk(vdev,
 542                                 "control id 0x%x is grabbed, cannot set\n",
 543                                 ctrl->id);
 544                         return -EBUSY;
 545                 }
 546                 /*
 547                  * Skip validation for now if the payload needs to be copied
 548                  * from userspace into kernelspace. We'll validate those later.
 549                  */
 550                 if (ctrl->is_ptr)
 551                         continue;
 552                 if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
 553                         p_new.p_s64 = &cs->controls[i].value64;
 554                 else
 555                         p_new.p_s32 = &cs->controls[i].value;
 556                 ret = validate_new(ctrl, p_new);
 557                 if (ret)
 558                         return ret;
 559         }
 560         return 0;
 561 }
 562
 563 /* Try or try-and-set controls */
 564 int try_set_ext_ctrls_common(struct v4l2_fh *fh,
 565                              struct v4l2_ctrl_handler *hdl,
 566                              struct v4l2_ext_controls *cs,
 567                              struct video_device *vdev, bool set)
 568 {
 569         struct v4l2_ctrl_helper helper[4];
 570         struct v4l2_ctrl_helper *helpers = helper;
 571         unsigned int i, j;
 572         int ret;
 573
 574         cs->error_idx = cs->count;
 575
 576         /* Default value cannot be changed */
 577         if (cs->which == V4L2_CTRL_WHICH_DEF_VAL) {
 578                 dprintk(vdev, "%s: cannot change default value\n",
 579                         video_device_node_name(vdev));
 580                 return -EINVAL;
 581         }
 582
 583         cs->which = V4L2_CTRL_ID2WHICH(cs->which);
 584
 585         if (!hdl) {
 586                 dprintk(vdev, "%s: invalid null control handler\n",
 587                         video_device_node_name(vdev));
 588                 return -EINVAL;
 589         }
 590
 591         if (cs->count == 0)
 592                 return class_check(hdl, cs->which);
 593
 594         if (cs->count > ARRAY_SIZE(helper)) {
 595                 helpers = kvmalloc_array(cs->count, sizeof(helper[0]),
 596                                          GFP_KERNEL);
 597                 if (!helpers)
 598                         return -ENOMEM;
 599         }
 600         ret = prepare_ext_ctrls(hdl, cs, helpers, vdev, false);
 601         if (!ret)
 602                 ret = validate_ctrls(cs, helpers, vdev, set);
 603         if (ret && set)
 604                 cs->error_idx = cs->count;
 605         for (i = 0; !ret && i < cs->count; i++) {
 606                 struct v4l2_ctrl *master;
 607                 u32 idx = i;
 608
 609                 if (!helpers[i].mref)
 610                         continue;
 611
 612                 cs->error_idx = i;
 613                 master = helpers[i].mref->ctrl;
 614                 v4l2_ctrl_lock(master);
 615
 616                 /* Reset the 'is_new' flags of the cluster */
 617                 for (j = 0; j < master->ncontrols; j++)
 618                         if (master->cluster[j])
 619                                 master->cluster[j]->is_new = 0;
 620
 621                 /*
 622                  * For volatile autoclusters that are currently in auto mode
 623                  * we need to discover if it will be set to manual mode.
 624                  * If so, then we have to copy the current volatile values
 625                  * first since those will become the new manual values (which
 626                  * may be overwritten by explicit new values from this set
 627                  * of controls).
 628                  */
 629                 if (master->is_auto && master->has_volatiles &&
 630                     !is_cur_manual(master)) {
 631                         /* Pick an initial non-manual value */
 632                         s32 new_auto_val = master->manual_mode_value + 1;
 633                         u32 tmp_idx = idx;
 634
 635                         do {
 636                                 /*
 637                                  * Check if the auto control is part of the
 638                                  * list, and remember the new value.
 639                                  */
 640                                 if (helpers[tmp_idx].ref->ctrl == master)
 641                                         new_auto_val = cs->controls[tmp_idx].value;
 642                                 tmp_idx = helpers[tmp_idx].next;
 643                         } while (tmp_idx);
 644                         /*
 645                          * If the new value == the manual value, then copy
 646                          * the current volatile values.
 647                          */
 648                         if (new_auto_val == master->manual_mode_value)
 649                                 update_from_auto_cluster(master);
 650                 }
 651
 652                 /*
 653                  * Copy the new caller-supplied control values.
 654                  * user_to_new() sets 'is_new' to 1.
 655                  */
 656                 do {
 657                         struct v4l2_ctrl *ctrl = helpers[idx].ref->ctrl;
 658
 659                         ret = user_to_new(cs->controls + idx, ctrl);
 660                         if (!ret && ctrl->is_ptr) {
 661                                 ret = validate_new(ctrl, ctrl->p_new);
 662                                 if (ret)
 663                                         dprintk(vdev,
 664                                                 "failed to validate control %s (%d)\n",
 665                                                 v4l2_ctrl_get_name(ctrl->id), ret);
 666                         }
 667                         idx = helpers[idx].next;
 668                 } while (!ret && idx);
 669
 670                 if (!ret)
 671                         ret = try_or_set_cluster(fh, master,
 672                                                  !hdl->req_obj.req && set, 0);
 673                 if (!ret && hdl->req_obj.req && set) {
 674                         for (j = 0; j < master->ncontrols; j++) {
 675                                 struct v4l2_ctrl_ref *ref =
 676                                         find_ref(hdl, master->cluster[j]->id);
 677
 678                                 new_to_req(ref);
 679                         }
 680                 }
 681
 682                 /* Copy the new values back to userspace. */
 683                 if (!ret) {
 684                         idx = i;
 685                         do {
 686                                 ret = new_to_user(cs->controls + idx,
 687                                                   helpers[idx].ref->ctrl);
 688                                 idx = helpers[idx].next;
 689                         } while (!ret && idx);
 690                 }
 691                 v4l2_ctrl_unlock(master);
 692         }
 693
 694         if (cs->count > ARRAY_SIZE(helper))
 695                 kvfree(helpers);
 696         return ret;
 697 }
 698
 699 static int try_set_ext_ctrls(struct v4l2_fh *fh,
 700                              struct v4l2_ctrl_handler *hdl,
 701                              struct video_device *vdev,
 702                              struct media_device *mdev,
 703                              struct v4l2_ext_controls *cs, bool set)
 704 {
 705         int ret;
 706
 707         if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL)
 708                 return try_set_ext_ctrls_request(fh, hdl, vdev, mdev, cs, set);
 709
 710         ret = try_set_ext_ctrls_common(fh, hdl, cs, vdev, set);
 711         if (ret)
 712                 dprintk(vdev,
 713                         "%s: try_set_ext_ctrls_common failed (%d)\n",
 714                         video_device_node_name(vdev), ret);
 715
 716         return ret;
 717 }
 718
 719 int v4l2_try_ext_ctrls(struct v4l2_ctrl_handler *hdl,
 720                        struct video_device *vdev,
 721                        struct media_device *mdev,
 722                        struct v4l2_ext_controls *cs)
 723 {
 724         return try_set_ext_ctrls(NULL, hdl, vdev, mdev, cs, false);
 725 }
 726 EXPORT_SYMBOL(v4l2_try_ext_ctrls);
 727
 728 int v4l2_s_ext_ctrls(struct v4l2_fh *fh,
 729                      struct v4l2_ctrl_handler *hdl,
 730                      struct video_device *vdev,
 731                      struct media_device *mdev,
 732                      struct v4l2_ext_controls *cs)
 733 {
 734         return try_set_ext_ctrls(fh, hdl, vdev, mdev, cs, true);
 735 }
 736 EXPORT_SYMBOL(v4l2_s_ext_ctrls);
 737
 738 /*
 739  * VIDIOC_G/S_CTRL implementation
 740  */
 741
 742 /* Helper function to get a single control */
 743 static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c)
 744 {
 745         struct v4l2_ctrl *master = ctrl->cluster[0];
 746         int ret = 0;
 747         int i;
 748
 749         /* Compound controls are not supported. The new_to_user() and
 750          * cur_to_user() calls below would need to be modified not to access
 751          * userspace memory when called from get_ctrl().
 752          */
 753         if (!ctrl->is_int && ctrl->type != V4L2_CTRL_TYPE_INTEGER64)
 754                 return -EINVAL;
 755
 756         if (ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
 757                 return -EACCES;
 758
 759         v4l2_ctrl_lock(master);
 760         /* g_volatile_ctrl will update the current control values */
 761         if (ctrl->flags & V4L2_CTRL_FLAG_VOLATILE) {
 762                 for (i = 0; i < master->ncontrols; i++)
 763                         cur_to_new(master->cluster[i]);
 764                 ret = call_op(master, g_volatile_ctrl);
 765                 new_to_user(c, ctrl);
 766         } else {
 767                 cur_to_user(c, ctrl);
 768         }
 769         v4l2_ctrl_unlock(master);
 770         return ret;
 771 }
 772
 773 int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_control *control)
 774 {
 775         struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
 776         struct v4l2_ext_control c;
 777         int ret;
 778
 779         if (!ctrl || !ctrl->is_int)
 780                 return -EINVAL;
 781         ret = get_ctrl(ctrl, &c);
 782         control->value = c.value;
 783         return ret;
 784 }
 785 EXPORT_SYMBOL(v4l2_g_ctrl);
 786
 787 /* Helper function for VIDIOC_S_CTRL compatibility */
 788 static int set_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, u32 ch_flags)
 789 {
 790         struct v4l2_ctrl *master = ctrl->cluster[0];
 791         int ret;
 792         int i;
 793
 794         /* Reset the 'is_new' flags of the cluster */
 795         for (i = 0; i < master->ncontrols; i++)
 796                 if (master->cluster[i])
 797                         master->cluster[i]->is_new = 0;
 798
 799         ret = validate_new(ctrl, ctrl->p_new);
 800         if (ret)
 801                 return ret;
 802
 803         /*
 804          * For autoclusters with volatiles that are switched from auto to
 805          * manual mode we have to update the current volatile values since
 806          * those will become the initial manual values after such a switch.
 807          */
 808         if (master->is_auto && master->has_volatiles && ctrl == master &&
 809             !is_cur_manual(master) && ctrl->val == master->manual_mode_value)
 810                 update_from_auto_cluster(master);
 811
 812         ctrl->is_new = 1;
 813         return try_or_set_cluster(fh, master, true, ch_flags);
 814 }
 815
 816 /* Helper function for VIDIOC_S_CTRL compatibility */
 817 static int set_ctrl_lock(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl,
 818                          struct v4l2_ext_control *c)
 819 {
 820         int ret;
 821
 822         v4l2_ctrl_lock(ctrl);
 823         user_to_new(c, ctrl);
 824         ret = set_ctrl(fh, ctrl, 0);
 825         if (!ret)
 826                 cur_to_user(c, ctrl);
 827         v4l2_ctrl_unlock(ctrl);
 828         return ret;
 829 }
 830
 831 int v4l2_s_ctrl(struct v4l2_fh *fh, struct v4l2_ctrl_handler *hdl,
 832                 struct v4l2_control *control)
 833 {
 834         struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, control->id);
 835         struct v4l2_ext_control c = { control->id };
 836         int ret;
 837
 838         if (!ctrl || !ctrl->is_int)
 839                 return -EINVAL;
 840
 841         if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
 842                 return -EACCES;
 843
 844         c.value = control->value;
 845         ret = set_ctrl_lock(fh, ctrl, &c);
 846         control->value = c.value;
 847         return ret;
 848 }
 849 EXPORT_SYMBOL(v4l2_s_ctrl);
 850
 851 /*
 852  * Helper functions for drivers to get/set controls.
 853  */
 854
 855 s32 v4l2_ctrl_g_ctrl(struct v4l2_ctrl *ctrl)
 856 {
 857         struct v4l2_ext_control c;
 858
 859         /* It's a driver bug if this happens. */
 860         if (WARN_ON(!ctrl->is_int))
 861                 return 0;
 862         c.value = 0;
 863         get_ctrl(ctrl, &c);
 864         return c.value;
 865 }
 866 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl);
 867
 868 s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl)
 869 {
 870         struct v4l2_ext_control c;
 871
 872         /* It's a driver bug if this happens. */
 873         if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
 874                 return 0;
 875         c.value64 = 0;
 876         get_ctrl(ctrl, &c);
 877         return c.value64;
 878 }
 879 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl_int64);
 880
 881 int __v4l2_ctrl_s_ctrl(struct v4l2_ctrl *ctrl, s32 val)
 882 {
 883         lockdep_assert_held(ctrl->handler->lock);
 884
 885         /* It's a driver bug if this happens. */
 886         if (WARN_ON(!ctrl->is_int))
 887                 return -EINVAL;
 888         ctrl->val = val;
 889         return set_ctrl(NULL, ctrl, 0);
 890 }
 891 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl);
 892
 893 int __v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl *ctrl, s64 val)
 894 {
 895         lockdep_assert_held(ctrl->handler->lock);
 896
 897         /* It's a driver bug if this happens. */
 898         if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64))
 899                 return -EINVAL;
 900         *ctrl->p_new.p_s64 = val;
 901         return set_ctrl(NULL, ctrl, 0);
 902 }
 903 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_int64);
 904
 905 int __v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl *ctrl, const char *s)
 906 {
 907         lockdep_assert_held(ctrl->handler->lock);
 908
 909         /* It's a driver bug if this happens. */
 910         if (WARN_ON(ctrl->type != V4L2_CTRL_TYPE_STRING))
 911                 return -EINVAL;
 912         strscpy(ctrl->p_new.p_char, s, ctrl->maximum + 1);
 913         return set_ctrl(NULL, ctrl, 0);
 914 }
 915 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_string);
 916
 917 int __v4l2_ctrl_s_ctrl_compound(struct v4l2_ctrl *ctrl,
 918                                 enum v4l2_ctrl_type type, const void *p)
 919 {
 920         lockdep_assert_held(ctrl->handler->lock);
 921
 922         /* It's a driver bug if this happens. */
 923         if (WARN_ON(ctrl->type != type))
 924                 return -EINVAL;
 925         /* Setting dynamic arrays is not (yet?) supported. */
 926         if (WARN_ON(ctrl->is_dyn_array))
 927                 return -EINVAL;
 928         memcpy(ctrl->p_new.p, p, ctrl->elems * ctrl->elem_size);
 929         return set_ctrl(NULL, ctrl, 0);
 930 }
 931 EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_compound);
 932
 933 /*
 934  * Modify the range of a control.
 935  */
 936 int __v4l2_ctrl_modify_range(struct v4l2_ctrl *ctrl,
 937                              s64 min, s64 max, u64 step, s64 def)
 938 {
 939         bool value_changed;
 940         bool range_changed = false;
 941         int ret;
 942
 943         lockdep_assert_held(ctrl->handler->lock);
 944
 945         switch (ctrl->type) {
 946         case V4L2_CTRL_TYPE_INTEGER:
 947         case V4L2_CTRL_TYPE_INTEGER64:
 948         case V4L2_CTRL_TYPE_BOOLEAN:
 949         case V4L2_CTRL_TYPE_MENU:
 950         case V4L2_CTRL_TYPE_INTEGER_MENU:
 951         case V4L2_CTRL_TYPE_BITMASK:
 952         case V4L2_CTRL_TYPE_U8:
 953         case V4L2_CTRL_TYPE_U16:
 954         case V4L2_CTRL_TYPE_U32:
 955                 if (ctrl->is_array)
 956                         return -EINVAL;
 957                 ret = check_range(ctrl->type, min, max, step, def);
 958                 if (ret)
 959                         return ret;
 960                 break;
 961         default:
 962                 return -EINVAL;
 963         }
 964         if (ctrl->minimum != min || ctrl->maximum != max ||
 965             ctrl->step != step || ctrl->default_value != def) {
 966                 range_changed = true;
 967                 ctrl->minimum = min;
 968                 ctrl->maximum = max;
 969                 ctrl->step = step;
 970                 ctrl->default_value = def;
 971         }
 972         cur_to_new(ctrl);
 973         if (validate_new(ctrl, ctrl->p_new)) {
 974                 if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
 975                         *ctrl->p_new.p_s64 = def;
 976                 else
 977                         *ctrl->p_new.p_s32 = def;
 978         }
 979
 980         if (ctrl->type == V4L2_CTRL_TYPE_INTEGER64)
 981                 value_changed = *ctrl->p_new.p_s64 != *ctrl->p_cur.p_s64;
 982         else
 983                 value_changed = *ctrl->p_new.p_s32 != *ctrl->p_cur.p_s32;
 984         if (value_changed)
 985                 ret = set_ctrl(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
 986         else if (range_changed)
 987                 send_event(NULL, ctrl, V4L2_EVENT_CTRL_CH_RANGE);
 988         return ret;
 989 }
 990 EXPORT_SYMBOL(__v4l2_ctrl_modify_range);
 991
 992 /* Implement VIDIOC_QUERY_EXT_CTRL */
 993 int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctrl *qc)
 994 {
 995         const unsigned int next_flags = V4L2_CTRL_FLAG_NEXT_CTRL | V4L2_CTRL_FLAG_NEXT_COMPOUND;
 996         u32 id = qc->id & V4L2_CTRL_ID_MASK;
 997         struct v4l2_ctrl_ref *ref;
 998         struct v4l2_ctrl *ctrl;
 999
1000         if (!hdl)
1001                 return -EINVAL;
1002
1003         mutex_lock(hdl->lock);
1004
1005         /* Try to find it */
1006         ref = find_ref(hdl, id);
1007
1008         if ((qc->id & next_flags) && !list_empty(&hdl->ctrl_refs)) {
1009                 bool is_compound;
1010                 /* Match any control that is not hidden */
1011                 unsigned int mask = 1;
1012                 bool match = false;
1013
1014                 if ((qc->id & next_flags) == V4L2_CTRL_FLAG_NEXT_COMPOUND) {
1015                         /* Match any hidden control */
1016                         match = true;
1017                 } else if ((qc->id & next_flags) == next_flags) {
1018                         /* Match any control, compound or not */
1019                         mask = 0;
1020                 }
1021
1022                 /* Find the next control with ID > qc->id */
1023
1024                 /* Did we reach the end of the control list? */
1025                 if (id >= node2id(hdl->ctrl_refs.prev)) {
1026                         ref = NULL; /* Yes, so there is no next control */
1027                 } else if (ref) {
1028                         /*
1029                          * We found a control with the given ID, so just get
1030                          * the next valid one in the list.
1031                          */
1032                         list_for_each_entry_continue(ref, &hdl->ctrl_refs, node) {
1033                                 is_compound = ref->ctrl->is_array ||
1034                                         ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
1035                                 if (id < ref->ctrl->id &&
1036                                     (is_compound & mask) == match)
1037                                         break;
1038                         }
1039                         if (&ref->node == &hdl->ctrl_refs)
1040                                 ref = NULL;
1041                 } else {
1042                         /*
1043                          * No control with the given ID exists, so start
1044                          * searching for the next largest ID. We know there
1045                          * is one, otherwise the first 'if' above would have
1046                          * been true.
1047                          */
1048                         list_for_each_entry(ref, &hdl->ctrl_refs, node) {
1049                                 is_compound = ref->ctrl->is_array ||
1050                                         ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
1051                                 if (id < ref->ctrl->id &&
1052                                     (is_compound & mask) == match)
1053                                         break;
1054                         }
1055                         if (&ref->node == &hdl->ctrl_refs)
1056                                 ref = NULL;
1057                 }
1058         }
1059         mutex_unlock(hdl->lock);
1060
1061         if (!ref)
1062                 return -EINVAL;
1063
1064         ctrl = ref->ctrl;
1065         memset(qc, 0, sizeof(*qc));
1066         if (id >= V4L2_CID_PRIVATE_BASE)
1067                 qc->id = id;
1068         else
1069                 qc->id = ctrl->id;
1070         strscpy(qc->name, ctrl->name, sizeof(qc->name));
1071         qc->flags = user_flags(ctrl);
1072         qc->type = ctrl->type;
1073         qc->elem_size = ctrl->elem_size;
1074         qc->elems = ctrl->elems;
1075         qc->nr_of_dims = ctrl->nr_of_dims;
1076         memcpy(qc->dims, ctrl->dims, qc->nr_of_dims * sizeof(qc->dims[0]));
1077         qc->minimum = ctrl->minimum;
1078         qc->maximum = ctrl->maximum;
1079         qc->default_value = ctrl->default_value;
1080         if (ctrl->type == V4L2_CTRL_TYPE_MENU ||
1081             ctrl->type == V4L2_CTRL_TYPE_INTEGER_MENU)
1082                 qc->step = 1;
1083         else
1084                 qc->step = ctrl->step;
1085         return 0;
1086 }
1087 EXPORT_SYMBOL(v4l2_query_ext_ctrl);
1088
1089 /* Implement VIDIOC_QUERYCTRL */
1090 int v4l2_queryctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_queryctrl *qc)
1091 {
1092         struct v4l2_query_ext_ctrl qec = { qc->id };
1093         int rc;
1094
1095         rc = v4l2_query_ext_ctrl(hdl, &qec);
1096         if (rc)
1097                 return rc;
1098
1099         qc->id = qec.id;
1100         qc->type = qec.type;
1101         qc->flags = qec.flags;
1102         strscpy(qc->name, qec.name, sizeof(qc->name));
1103         switch (qc->type) {
1104         case V4L2_CTRL_TYPE_INTEGER:
1105         case V4L2_CTRL_TYPE_BOOLEAN:
1106         case V4L2_CTRL_TYPE_MENU:
1107         case V4L2_CTRL_TYPE_INTEGER_MENU:
1108         case V4L2_CTRL_TYPE_STRING:
1109         case V4L2_CTRL_TYPE_BITMASK:
1110                 qc->minimum = qec.minimum;
1111                 qc->maximum = qec.maximum;
1112                 qc->step = qec.step;
1113                 qc->default_value = qec.default_value;
1114                 break;
1115         default:
1116                 qc->minimum = 0;
1117                 qc->maximum = 0;
1118                 qc->step = 0;
1119                 qc->default_value = 0;
1120                 break;
1121         }
1122         return 0;
1123 }
1124 EXPORT_SYMBOL(v4l2_queryctrl);
1125
1126 /* Implement VIDIOC_QUERYMENU */
1127 int v4l2_querymenu(struct v4l2_ctrl_handler *hdl, struct v4l2_querymenu *qm)
1128 {
1129         struct v4l2_ctrl *ctrl;
1130         u32 i = qm->index;
1131
1132         ctrl = v4l2_ctrl_find(hdl, qm->id);
1133         if (!ctrl)
1134                 return -EINVAL;
1135
1136         qm->reserved = 0;
1137         /* Sanity checks */
1138         switch (ctrl->type) {
1139         case V4L2_CTRL_TYPE_MENU:
1140                 if (!ctrl->qmenu)
1141                         return -EINVAL;
1142                 break;
1143         case V4L2_CTRL_TYPE_INTEGER_MENU:
1144                 if (!ctrl->qmenu_int)
1145                         return -EINVAL;
1146                 break;
1147         default:
1148                 return -EINVAL;
1149         }
1150
1151         if (i < ctrl->minimum || i > ctrl->maximum)
1152                 return -EINVAL;
1153
1154         /* Use mask to see if this menu item should be skipped */
1155         if (ctrl->menu_skip_mask & (1ULL << i))
1156                 return -EINVAL;
1157         /* Empty menu items should also be skipped */
1158         if (ctrl->type == V4L2_CTRL_TYPE_MENU) {
1159                 if (!ctrl->qmenu[i] || ctrl->qmenu[i][0] == '\0')
1160                         return -EINVAL;
1161                 strscpy(qm->name, ctrl->qmenu[i], sizeof(qm->name));
1162         } else {
1163                 qm->value = ctrl->qmenu_int[i];
1164         }
1165         return 0;
1166 }
1167 EXPORT_SYMBOL(v4l2_querymenu);
1168
1169 /*
1170  * VIDIOC_LOG_STATUS helpers
1171  */
1172
1173 int v4l2_ctrl_log_status(struct file *file, void *fh)
1174 {
1175         struct video_device *vfd = video_devdata(file);
1176         struct v4l2_fh *vfh = file->private_data;
1177
1178         if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags) && vfd->v4l2_dev)
1179                 v4l2_ctrl_handler_log_status(vfh->ctrl_handler,
1180                                              vfd->v4l2_dev->name);
1181         return 0;
1182 }
1183 EXPORT_SYMBOL(v4l2_ctrl_log_status);
1184
1185 int v4l2_ctrl_subdev_log_status(struct v4l2_subdev *sd)
1186 {
1187         v4l2_ctrl_handler_log_status(sd->ctrl_handler, sd->name);
1188         return 0;
1189 }
1190 EXPORT_SYMBOL(v4l2_ctrl_subdev_log_status);
1191
1192 /*
1193  * VIDIOC_(UN)SUBSCRIBE_EVENT implementation
1194  */
1195
1196 static int v4l2_ctrl_add_event(struct v4l2_subscribed_event *sev,
1197                                unsigned int elems)
1198 {
1199         struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1200
1201         if (!ctrl)
1202                 return -EINVAL;
1203
1204         v4l2_ctrl_lock(ctrl);
1205         list_add_tail(&sev->node, &ctrl->ev_subs);
1206         if (ctrl->type != V4L2_CTRL_TYPE_CTRL_CLASS &&
1207             (sev->flags & V4L2_EVENT_SUB_FL_SEND_INITIAL))
1208                 send_initial_event(sev->fh, ctrl);
1209         v4l2_ctrl_unlock(ctrl);
1210         return 0;
1211 }
1212
1213 static void v4l2_ctrl_del_event(struct v4l2_subscribed_event *sev)
1214 {
1215         struct v4l2_ctrl *ctrl = v4l2_ctrl_find(sev->fh->ctrl_handler, sev->id);
1216
1217         if (!ctrl)
1218                 return;
1219
1220         v4l2_ctrl_lock(ctrl);
1221         list_del(&sev->node);
1222         v4l2_ctrl_unlock(ctrl);
1223 }
1224
1225 void v4l2_ctrl_replace(struct v4l2_event *old, const struct v4l2_event *new)
1226 {
1227         u32 old_changes = old->u.ctrl.changes;
1228
1229         old->u.ctrl = new->u.ctrl;
1230         old->u.ctrl.changes |= old_changes;
1231 }
1232 EXPORT_SYMBOL(v4l2_ctrl_replace);
1233
1234 void v4l2_ctrl_merge(const struct v4l2_event *old, struct v4l2_event *new)
1235 {
1236         new->u.ctrl.changes |= old->u.ctrl.changes;
1237 }
1238 EXPORT_SYMBOL(v4l2_ctrl_merge);
1239
1240 const struct v4l2_subscribed_event_ops v4l2_ctrl_sub_ev_ops = {
1241         .add = v4l2_ctrl_add_event,
1242         .del = v4l2_ctrl_del_event,
1243         .replace = v4l2_ctrl_replace,
1244         .merge = v4l2_ctrl_merge,
1245 };
1246 EXPORT_SYMBOL(v4l2_ctrl_sub_ev_ops);
1247
1248 int v4l2_ctrl_subscribe_event(struct v4l2_fh *fh,
1249                               const struct v4l2_event_subscription *sub)
1250 {
1251         if (sub->type == V4L2_EVENT_CTRL)
1252                 return v4l2_event_subscribe(fh, sub, 0, &v4l2_ctrl_sub_ev_ops);
1253         return -EINVAL;
1254 }
1255 EXPORT_SYMBOL(v4l2_ctrl_subscribe_event);
1256
1257 int v4l2_ctrl_subdev_subscribe_event(struct v4l2_subdev *sd, struct v4l2_fh *fh,
1258                                      struct v4l2_event_subscription *sub)
1259 {
1260         if (!sd->ctrl_handler)
1261                 return -EINVAL;
1262         return v4l2_ctrl_subscribe_event(fh, sub);
1263 }
1264 EXPORT_SYMBOL(v4l2_ctrl_subdev_subscribe_event);
1265
1266 /*
1267  * poll helper
1268  */
1269 __poll_t v4l2_ctrl_poll(struct file *file, struct poll_table_struct *wait)
1270 {
1271         struct v4l2_fh *fh = file->private_data;
1272
1273         poll_wait(file, &fh->wait, wait);
1274         if (v4l2_event_pending(fh))
1275                 return EPOLLPRI;
1276         return 0;
1277 }
1278 EXPORT_SYMBOL(v4l2_ctrl_poll);