1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *  Routines for driver control interface
   4 *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
   5 */
   6
   7#include <linux/threads.h>
   8#include <linux/interrupt.h>
   9#include <linux/module.h>
  10#include <linux/moduleparam.h>
  11#include <linux/slab.h>
  12#include <linux/vmalloc.h>
  13#include <linux/time.h>
  14#include <linux/mm.h>
  15#include <linux/math64.h>
  16#include <linux/sched/signal.h>
  17#include <sound/core.h>
  18#include <sound/minors.h>
  19#include <sound/info.h>
  20#include <sound/control.h>
  21
  22// Max allocation size for user controls.
  23static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
  24module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
  25MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
  26
  27#define MAX_CONTROL_COUNT	1028
  28
  29struct snd_kctl_ioctl {
  30	struct list_head list;		/* list of all ioctls */
  31	snd_kctl_ioctl_func_t fioctl;
  32};
  33
  34static DECLARE_RWSEM(snd_ioctl_rwsem);
  35static DECLARE_RWSEM(snd_ctl_layer_rwsem);
  36static LIST_HEAD(snd_control_ioctls);
  37#ifdef CONFIG_COMPAT
  38static LIST_HEAD(snd_control_compat_ioctls);
  39#endif
  40static struct snd_ctl_layer_ops *snd_ctl_layer;
  41
  42static int snd_ctl_remove_locked(struct snd_card *card,
  43				 struct snd_kcontrol *kcontrol);
  44
  45static int snd_ctl_open(struct inode *inode, struct file *file)
  46{
 
  47	struct snd_card *card;
  48	struct snd_ctl_file *ctl;
  49	int i, err;
  50
  51	err = stream_open(inode, file);
  52	if (err < 0)
  53		return err;
  54
  55	card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
  56	if (!card) {
  57		err = -ENODEV;
  58		goto __error1;
  59	}
  60	err = snd_card_file_add(card, file);
  61	if (err < 0) {
  62		err = -ENODEV;
  63		goto __error1;
  64	}
  65	if (!try_module_get(card->module)) {
  66		err = -EFAULT;
  67		goto __error2;
  68	}
  69	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
  70	if (ctl == NULL) {
  71		err = -ENOMEM;
  72		goto __error;
  73	}
  74	INIT_LIST_HEAD(&ctl->events);
  75	init_waitqueue_head(&ctl->change_sleep);
  76	spin_lock_init(&ctl->read_lock);
  77	ctl->card = card;
  78	for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
  79		ctl->preferred_subdevice[i] = -1;
  80	ctl->pid = get_pid(task_pid(current));
  81	file->private_data = ctl;
  82	scoped_guard(write_lock_irqsave, &card->controls_rwlock)
  83		list_add_tail(&ctl->list, &card->ctl_files);
  84	snd_card_unref(card);
  85	return 0;
  86
  87      __error:
  88	module_put(card->module);
  89      __error2:
  90	snd_card_file_remove(card, file);
  91      __error1:
  92	if (card)
  93		snd_card_unref(card);
  94      	return err;
  95}
  96
  97static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
  98{
 
  99	struct snd_kctl_event *cread;
 100
 101	guard(spinlock_irqsave)(&ctl->read_lock);
 102	while (!list_empty(&ctl->events)) {
 103		cread = snd_kctl_event(ctl->events.next);
 104		list_del(&cread->list);
 105		kfree(cread);
 106	}
 
 107}
 108
 109static int snd_ctl_release(struct inode *inode, struct file *file)
 110{
 
 111	struct snd_card *card;
 112	struct snd_ctl_file *ctl;
 113	struct snd_kcontrol *control;
 114	unsigned int idx;
 115
 116	ctl = file->private_data;
 117	file->private_data = NULL;
 118	card = ctl->card;
 119
 120	scoped_guard(write_lock_irqsave, &card->controls_rwlock)
 121		list_del(&ctl->list);
 122
 123	scoped_guard(rwsem_write, &card->controls_rwsem) {
 124		list_for_each_entry(control, &card->controls, list)
 125			for (idx = 0; idx < control->count; idx++)
 126				if (control->vd[idx].owner == ctl)
 127					control->vd[idx].owner = NULL;
 128	}
 129
 130	snd_fasync_free(ctl->fasync);
 131	snd_ctl_empty_read_queue(ctl);
 132	put_pid(ctl->pid);
 133	kfree(ctl);
 134	module_put(card->module);
 135	snd_card_file_remove(card, file);
 136	return 0;
 137}
 138
 139/**
 140 * snd_ctl_notify - Send notification to user-space for a control change
 141 * @card: the card to send notification
 142 * @mask: the event mask, SNDRV_CTL_EVENT_*
 143 * @id: the ctl element id to send notification
 144 *
 145 * This function adds an event record with the given id and mask, appends
 146 * to the list and wakes up the user-space for notification.  This can be
 147 * called in the atomic context.
 148 */
 149void snd_ctl_notify(struct snd_card *card, unsigned int mask,
 150		    struct snd_ctl_elem_id *id)
 151{
 
 152	struct snd_ctl_file *ctl;
 153	struct snd_kctl_event *ev;
 154
 155	if (snd_BUG_ON(!card || !id))
 156		return;
 157	if (card->shutdown)
 158		return;
 159
 160	guard(read_lock_irqsave)(&card->controls_rwlock);
 161#if IS_ENABLED(CONFIG_SND_MIXER_OSS)
 162	card->mixer_oss_change_count++;
 163#endif
 164	list_for_each_entry(ctl, &card->ctl_files, list) {
 165		if (!ctl->subscribed)
 166			continue;
 167		scoped_guard(spinlock, &ctl->read_lock) {
 168			list_for_each_entry(ev, &ctl->events, list) {
 169				if (ev->id.numid == id->numid) {
 170					ev->mask |= mask;
 171					goto _found;
 172				}
 173			}
 174			ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
 175			if (ev) {
 176				ev->id = *id;
 177				ev->mask = mask;
 178				list_add_tail(&ev->list, &ctl->events);
 179			} else {
 180				dev_err(card->dev, "No memory available to allocate event\n");
 181			}
 182_found:
 183			wake_up(&ctl->change_sleep);
 184		}
 185		snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN);
 
 
 
 
 
 
 
 
 
 
 
 186	}
 
 187}
 188EXPORT_SYMBOL(snd_ctl_notify);
 189
 190/**
 191 * snd_ctl_notify_one - Send notification to user-space for a control change
 192 * @card: the card to send notification
 193 * @mask: the event mask, SNDRV_CTL_EVENT_*
 194 * @kctl: the pointer with the control instance
 195 * @ioff: the additional offset to the control index
 196 *
 197 * This function calls snd_ctl_notify() and does additional jobs
 198 * like LED state changes.
 199 */
 200void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
 201			struct snd_kcontrol *kctl, unsigned int ioff)
 202{
 203	struct snd_ctl_elem_id id = kctl->id;
 204	struct snd_ctl_layer_ops *lops;
 205
 206	id.index += ioff;
 207	id.numid += ioff;
 208	snd_ctl_notify(card, mask, &id);
 209	guard(rwsem_read)(&snd_ctl_layer_rwsem);
 210	for (lops = snd_ctl_layer; lops; lops = lops->next)
 211		lops->lnotify(card, mask, kctl, ioff);
 212}
 213EXPORT_SYMBOL(snd_ctl_notify_one);
 214
 215/**
 216 * snd_ctl_new - create a new control instance with some elements
 217 * @kctl: the pointer to store new control instance
 218 * @count: the number of elements in this control
 219 * @access: the default access flags for elements in this control
 220 * @file: given when locking these elements
 221 *
 222 * Allocates a memory object for a new control instance. The instance has
 223 * elements as many as the given number (@count). Each element has given
 224 * access permissions (@access). Each element is locked when @file is given.
 225 *
 226 * Return: 0 on success, error code on failure
 227 */
 228static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
 229		       unsigned int access, struct snd_ctl_file *file)
 230{
 
 231	unsigned int idx;
 
 
 
 232
 233	if (count == 0 || count > MAX_CONTROL_COUNT)
 234		return -EINVAL;
 235
 236	*kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
 237	if (!*kctl)
 238		return -ENOMEM;
 239
 240	(*kctl)->count = count;
 241	for (idx = 0; idx < count; idx++) {
 242		(*kctl)->vd[idx].access = access;
 243		(*kctl)->vd[idx].owner = file;
 244	}
 245
 246	return 0;
 
 
 247}
 248
 249/**
 250 * snd_ctl_new1 - create a control instance from the template
 251 * @ncontrol: the initialization record
 252 * @private_data: the private data to set
 253 *
 254 * Allocates a new struct snd_kcontrol instance and initialize from the given
 255 * template.  When the access field of ncontrol is 0, it's assumed as
 256 * READWRITE access. When the count field is 0, it's assumes as one.
 257 *
 258 * Return: The pointer of the newly generated instance, or %NULL on failure.
 259 */
 260struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
 261				  void *private_data)
 262{
 263	struct snd_kcontrol *kctl;
 264	unsigned int count;
 265	unsigned int access;
 266	int err;
 267
 268	if (snd_BUG_ON(!ncontrol || !ncontrol->info))
 269		return NULL;
 270
 271	count = ncontrol->count;
 272	if (count == 0)
 273		count = 1;
 274
 275	access = ncontrol->access;
 276	if (access == 0)
 277		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
 278	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
 279		   SNDRV_CTL_ELEM_ACCESS_VOLATILE |
 280		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
 281		   SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
 282		   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
 283		   SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
 284		   SNDRV_CTL_ELEM_ACCESS_LED_MASK |
 285		   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
 286
 287	err = snd_ctl_new(&kctl, count, access, NULL);
 288	if (err < 0)
 289		return NULL;
 290
 291	/* The 'numid' member is decided when calling snd_ctl_add(). */
 292	kctl->id.iface = ncontrol->iface;
 293	kctl->id.device = ncontrol->device;
 294	kctl->id.subdevice = ncontrol->subdevice;
 295	if (ncontrol->name) {
 296		strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
 297		if (strcmp(ncontrol->name, kctl->id.name) != 0)
 298			pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
 299				ncontrol->name, kctl->id.name);
 300	}
 301	kctl->id.index = ncontrol->index;
 302
 303	kctl->info = ncontrol->info;
 304	kctl->get = ncontrol->get;
 305	kctl->put = ncontrol->put;
 306	kctl->tlv.p = ncontrol->tlv.p;
 307
 308	kctl->private_value = ncontrol->private_value;
 309	kctl->private_data = private_data;
 310
 311	return kctl;
 
 
 
 
 
 312}
 
 313EXPORT_SYMBOL(snd_ctl_new1);
 314
 315/**
 316 * snd_ctl_free_one - release the control instance
 317 * @kcontrol: the control instance
 318 *
 319 * Releases the control instance created via snd_ctl_new()
 320 * or snd_ctl_new1().
 321 * Don't call this after the control was added to the card.
 322 */
 323void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
 324{
 325	if (kcontrol) {
 326		if (kcontrol->private_free)
 327			kcontrol->private_free(kcontrol);
 328		kfree(kcontrol);
 329	}
 330}
 
 331EXPORT_SYMBOL(snd_ctl_free_one);
 332
 333static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
 334					  unsigned int count)
 335{
 336	struct snd_kcontrol *kctl;
 337
 338	/* Make sure that the ids assigned to the control do not wrap around */
 339	if (card->last_numid >= UINT_MAX - count)
 340		card->last_numid = 0;
 341
 342	list_for_each_entry(kctl, &card->controls, list) {
 343		if (kctl->id.numid < card->last_numid + 1 + count &&
 344		    kctl->id.numid + kctl->count > card->last_numid + 1) {
 345		    	card->last_numid = kctl->id.numid + kctl->count - 1;
 346			return true;
 347		}
 348	}
 349	return false;
 350}
 351
 352static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
 353{
 354	unsigned int iter = 100000;
 355
 356	while (snd_ctl_remove_numid_conflict(card, count)) {
 357		if (--iter == 0) {
 358			/* this situation is very unlikely */
 359			dev_err(card->dev, "unable to allocate new control numid\n");
 360			return -ENOMEM;
 361		}
 362	}
 363	return 0;
 364}
 365
 366/* check whether the given id is contained in the given kctl */
 367static bool elem_id_matches(const struct snd_kcontrol *kctl,
 368			    const struct snd_ctl_elem_id *id)
 369{
 370	return kctl->id.iface == id->iface &&
 371		kctl->id.device == id->device &&
 372		kctl->id.subdevice == id->subdevice &&
 373		!strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)) &&
 374		kctl->id.index <= id->index &&
 375		kctl->id.index + kctl->count > id->index;
 376}
 377
 378#ifdef CONFIG_SND_CTL_FAST_LOOKUP
 379/* Compute a hash key for the corresponding ctl id
 380 * It's for the name lookup, hence the numid is excluded.
 381 * The hash key is bound in LONG_MAX to be used for Xarray key.
 382 */
 383#define MULTIPLIER	37
 384static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id)
 385{
 386	int i;
 387	unsigned long h;
 388
 389	h = id->iface;
 390	h = MULTIPLIER * h + id->device;
 391	h = MULTIPLIER * h + id->subdevice;
 392	for (i = 0; i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN && id->name[i]; i++)
 393		h = MULTIPLIER * h + id->name[i];
 394	h = MULTIPLIER * h + id->index;
 395	h &= LONG_MAX;
 396	return h;
 397}
 398
 399/* add hash entries to numid and ctl xarray tables */
 400static void add_hash_entries(struct snd_card *card,
 401			     struct snd_kcontrol *kcontrol)
 402{
 403	struct snd_ctl_elem_id id = kcontrol->id;
 404	int i;
 405
 406	xa_store_range(&card->ctl_numids, kcontrol->id.numid,
 407		       kcontrol->id.numid + kcontrol->count - 1,
 408		       kcontrol, GFP_KERNEL);
 409
 410	for (i = 0; i < kcontrol->count; i++) {
 411		id.index = kcontrol->id.index + i;
 412		if (xa_insert(&card->ctl_hash, get_ctl_id_hash(&id),
 413			      kcontrol, GFP_KERNEL)) {
 414			/* skip hash for this entry, noting we had collision */
 415			card->ctl_hash_collision = true;
 416			dev_dbg(card->dev, "ctl_hash collision %d:%s:%d\n",
 417				id.iface, id.name, id.index);
 418		}
 419	}
 420}
 421
 422/* remove hash entries that have been added */
 423static void remove_hash_entries(struct snd_card *card,
 424				struct snd_kcontrol *kcontrol)
 425{
 426	struct snd_ctl_elem_id id = kcontrol->id;
 427	struct snd_kcontrol *matched;
 428	unsigned long h;
 429	int i;
 430
 431	for (i = 0; i < kcontrol->count; i++) {
 432		xa_erase(&card->ctl_numids, id.numid);
 433		h = get_ctl_id_hash(&id);
 434		matched = xa_load(&card->ctl_hash, h);
 435		if (matched && (matched == kcontrol ||
 436				elem_id_matches(matched, &id)))
 437			xa_erase(&card->ctl_hash, h);
 438		id.index++;
 439		id.numid++;
 440	}
 441}
 442#else /* CONFIG_SND_CTL_FAST_LOOKUP */
 443static inline void add_hash_entries(struct snd_card *card,
 444				    struct snd_kcontrol *kcontrol)
 445{
 446}
 447static inline void remove_hash_entries(struct snd_card *card,
 448				       struct snd_kcontrol *kcontrol)
 449{
 450}
 451#endif /* CONFIG_SND_CTL_FAST_LOOKUP */
 452
 453enum snd_ctl_add_mode {
 454	CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
 455};
 456
 457/* add/replace a new kcontrol object; call with card->controls_rwsem locked */
 458static int __snd_ctl_add_replace(struct snd_card *card,
 459				 struct snd_kcontrol *kcontrol,
 460				 enum snd_ctl_add_mode mode)
 461{
 462	struct snd_ctl_elem_id id;
 463	unsigned int idx;
 464	struct snd_kcontrol *old;
 465	int err;
 466
 467	lockdep_assert_held_write(&card->controls_rwsem);
 468
 469	id = kcontrol->id;
 470	if (id.index > UINT_MAX - kcontrol->count)
 471		return -EINVAL;
 472
 473	old = snd_ctl_find_id(card, &id);
 474	if (!old) {
 475		if (mode == CTL_REPLACE)
 476			return -EINVAL;
 477	} else {
 478		if (mode == CTL_ADD_EXCLUSIVE) {
 479			dev_err(card->dev,
 480				"control %i:%i:%i:%s:%i is already present\n",
 481				id.iface, id.device, id.subdevice, id.name,
 482				id.index);
 483			return -EBUSY;
 484		}
 485
 486		err = snd_ctl_remove_locked(card, old);
 487		if (err < 0)
 488			return err;
 489	}
 490
 491	if (snd_ctl_find_hole(card, kcontrol->count) < 0)
 492		return -ENOMEM;
 493
 494	scoped_guard(write_lock_irq, &card->controls_rwlock) {
 495		list_add_tail(&kcontrol->list, &card->controls);
 496		card->controls_count += kcontrol->count;
 497		kcontrol->id.numid = card->last_numid + 1;
 498		card->last_numid += kcontrol->count;
 499	}
 500
 501	add_hash_entries(card, kcontrol);
 502
 503	for (idx = 0; idx < kcontrol->count; idx++)
 504		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
 505
 506	return 0;
 507}
 508
 509static int snd_ctl_add_replace(struct snd_card *card,
 510			       struct snd_kcontrol *kcontrol,
 511			       enum snd_ctl_add_mode mode)
 512{
 513	int err = -EINVAL;
 514
 515	if (! kcontrol)
 516		return err;
 517	if (snd_BUG_ON(!card || !kcontrol->info))
 518		goto error;
 519
 520	scoped_guard(rwsem_write, &card->controls_rwsem)
 521		err = __snd_ctl_add_replace(card, kcontrol, mode);
 522
 523	if (err < 0)
 
 
 
 
 
 
 
 
 
 
 
 524		goto error;
 
 
 
 
 
 
 
 
 525	return 0;
 526
 527 error:
 528	snd_ctl_free_one(kcontrol);
 529	return err;
 530}
 531
 532/**
 533 * snd_ctl_add - add the control instance to the card
 534 * @card: the card instance
 535 * @kcontrol: the control instance to add
 536 *
 537 * Adds the control instance created via snd_ctl_new() or
 538 * snd_ctl_new1() to the given card. Assigns also an unique
 539 * numid used for fast search.
 540 *
 541 * It frees automatically the control which cannot be added.
 542 *
 543 * Return: Zero if successful, or a negative error code on failure.
 544 *
 545 */
 546int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
 547{
 548	return snd_ctl_add_replace(card, kcontrol, CTL_ADD_EXCLUSIVE);
 549}
 550EXPORT_SYMBOL(snd_ctl_add);
 551
 552/**
 553 * snd_ctl_replace - replace the control instance of the card
 554 * @card: the card instance
 555 * @kcontrol: the control instance to replace
 556 * @add_on_replace: add the control if not already added
 557 *
 558 * Replaces the given control.  If the given control does not exist
 559 * and the add_on_replace flag is set, the control is added.  If the
 560 * control exists, it is destroyed first.
 561 *
 562 * It frees automatically the control which cannot be added or replaced.
 563 *
 564 * Return: Zero if successful, or a negative error code on failure.
 565 */
 566int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
 567		    bool add_on_replace)
 568{
 569	return snd_ctl_add_replace(card, kcontrol,
 570				   add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
 571}
 572EXPORT_SYMBOL(snd_ctl_replace);
 573
 574static int __snd_ctl_remove(struct snd_card *card,
 575			    struct snd_kcontrol *kcontrol,
 576			    bool remove_hash)
 577{
 578	unsigned int idx;
 
 
 579
 580	lockdep_assert_held_write(&card->controls_rwsem);
 581
 582	if (snd_BUG_ON(!card || !kcontrol))
 583		return -EINVAL;
 584
 585	if (remove_hash)
 586		remove_hash_entries(card, kcontrol);
 587
 588	scoped_guard(write_lock_irq, &card->controls_rwlock) {
 589		list_del(&kcontrol->list);
 590		card->controls_count -= kcontrol->count;
 591	}
 592
 593	for (idx = 0; idx < kcontrol->count; idx++)
 594		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
 595	snd_ctl_free_one(kcontrol);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 596	return 0;
 597}
 598
 599static inline int snd_ctl_remove_locked(struct snd_card *card,
 600					struct snd_kcontrol *kcontrol)
 601{
 602	return __snd_ctl_remove(card, kcontrol, true);
 603}
 
 604
 605/**
 606 * snd_ctl_remove - remove the control from the card and release it
 607 * @card: the card instance
 608 * @kcontrol: the control instance to remove
 609 *
 610 * Removes the control from the card and then releases the instance.
 611 * You don't need to call snd_ctl_free_one().
 612 * Passing NULL to @kcontrol argument is allowed as noop.
 613 *
 614 * Return: 0 if successful, or a negative error code on failure.
 615 *
 616 * Note that this function takes card->controls_rwsem lock internally.
 617 */
 618int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
 619{
 620	if (!kcontrol)
 621		return 0;
 622	guard(rwsem_write)(&card->controls_rwsem);
 623	return snd_ctl_remove_locked(card, kcontrol);
 
 
 
 
 
 
 
 
 624}
 
 625EXPORT_SYMBOL(snd_ctl_remove);
 626
 627/**
 628 * snd_ctl_remove_id - remove the control of the given id and release it
 629 * @card: the card instance
 630 * @id: the control id to remove
 631 *
 632 * Finds the control instance with the given id, removes it from the
 633 * card list and releases it.
 634 *
 635 * Return: 0 if successful, or a negative error code on failure.
 636 */
 637int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
 638{
 639	struct snd_kcontrol *kctl;
 
 640
 641	guard(rwsem_write)(&card->controls_rwsem);
 642	kctl = snd_ctl_find_id(card, id);
 643	if (kctl == NULL)
 
 644		return -ENOENT;
 645	return snd_ctl_remove_locked(card, kctl);
 
 
 
 646}
 
 647EXPORT_SYMBOL(snd_ctl_remove_id);
 648
 649/**
 650 * snd_ctl_remove_user_ctl - remove and release the unlocked user control
 651 * @file: active control handle
 652 * @id: the control id to remove
 653 *
 654 * Finds the control instance with the given id, removes it from the
 655 * card list and releases it.
 656 *
 657 * Return: 0 if successful, or a negative error code on failure.
 658 */
 659static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
 660				   struct snd_ctl_elem_id *id)
 661{
 662	struct snd_card *card = file->card;
 663	struct snd_kcontrol *kctl;
 664	int idx;
 665
 666	guard(rwsem_write)(&card->controls_rwsem);
 667	kctl = snd_ctl_find_id(card, id);
 668	if (kctl == NULL)
 669		return -ENOENT;
 670	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER))
 671		return -EINVAL;
 
 
 
 
 672	for (idx = 0; idx < kctl->count; idx++)
 673		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file)
 674			return -EBUSY;
 675	return snd_ctl_remove_locked(card, kctl);
 
 
 
 
 
 
 
 
 676}
 677
 678/**
 679 * snd_ctl_activate_id - activate/inactivate the control of the given id
 680 * @card: the card instance
 681 * @id: the control id to activate/inactivate
 682 * @active: non-zero to activate
 683 *
 684 * Finds the control instance with the given id, and activate or
 685 * inactivate the control together with notification, if changed.
 686 * The given ID data is filled with full information.
 687 *
 688 * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
 689 */
 690int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
 691			int active)
 692{
 693	struct snd_kcontrol *kctl;
 694	struct snd_kcontrol_volatile *vd;
 695	unsigned int index_offset;
 696	int ret;
 697
 698	down_write(&card->controls_rwsem);
 699	kctl = snd_ctl_find_id(card, id);
 700	if (kctl == NULL) {
 701		ret = -ENOENT;
 702		goto unlock;
 703	}
 704	index_offset = snd_ctl_get_ioff(kctl, id);
 705	vd = &kctl->vd[index_offset];
 706	ret = 0;
 707	if (active) {
 708		if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
 709			goto unlock;
 710		vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
 711	} else {
 712		if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
 713			goto unlock;
 714		vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
 715	}
 716	snd_ctl_build_ioff(id, kctl, index_offset);
 717	downgrade_write(&card->controls_rwsem);
 718	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
 719	up_read(&card->controls_rwsem);
 720	return 1;
 721
 722 unlock:
 723	up_write(&card->controls_rwsem);
 
 
 724	return ret;
 725}
 726EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
 727
 728/**
 729 * snd_ctl_rename_id - replace the id of a control on the card
 730 * @card: the card instance
 731 * @src_id: the old id
 732 * @dst_id: the new id
 733 *
 734 * Finds the control with the old id from the card, and replaces the
 735 * id with the new one.
 736 *
 737 * The function tries to keep the already assigned numid while replacing
 738 * the rest.
 739 *
 740 * Note that this function should be used only in the card initialization
 741 * phase.  Calling after the card instantiation may cause issues with
 742 * user-space expecting persistent numids.
 743 *
 744 * Return: Zero if successful, or a negative error code on failure.
 745 */
 746int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
 747		      struct snd_ctl_elem_id *dst_id)
 748{
 749	struct snd_kcontrol *kctl;
 750	int saved_numid;
 751
 752	guard(rwsem_write)(&card->controls_rwsem);
 753	kctl = snd_ctl_find_id(card, src_id);
 754	if (kctl == NULL)
 
 755		return -ENOENT;
 756	saved_numid = kctl->id.numid;
 757	remove_hash_entries(card, kctl);
 758	kctl->id = *dst_id;
 759	kctl->id.numid = saved_numid;
 760	add_hash_entries(card, kctl);
 
 761	return 0;
 762}
 
 763EXPORT_SYMBOL(snd_ctl_rename_id);
 764
 765/**
 766 * snd_ctl_rename - rename the control on the card
 767 * @card: the card instance
 768 * @kctl: the control to rename
 769 * @name: the new name
 770 *
 771 * Renames the specified control on the card to the new name.
 
 
 772 *
 773 * Note that this function takes card->controls_rwsem lock internally.
 
 774 */
 775void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
 776		    const char *name)
 777{
 778	guard(rwsem_write)(&card->controls_rwsem);
 779	remove_hash_entries(card, kctl);
 780
 781	if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
 782		pr_warn("ALSA: Renamed control new name '%s' truncated to '%s'\n",
 783			name, kctl->id.name);
 784
 785	add_hash_entries(card, kctl);
 786}
 787EXPORT_SYMBOL(snd_ctl_rename);
 788
 789#ifndef CONFIG_SND_CTL_FAST_LOOKUP
 790static struct snd_kcontrol *
 791snd_ctl_find_numid_slow(struct snd_card *card, unsigned int numid)
 792{
 793	struct snd_kcontrol *kctl;
 794
 795	guard(read_lock_irqsave)(&card->controls_rwlock);
 
 796	list_for_each_entry(kctl, &card->controls, list) {
 797		if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
 798			return kctl;
 799	}
 800	return NULL;
 801}
 802#endif /* !CONFIG_SND_CTL_FAST_LOOKUP */
 803
 804/**
 805 * snd_ctl_find_numid - find the control instance with the given number-id
 806 * @card: the card instance
 807 * @numid: the number-id to search
 808 *
 809 * Finds the control instance with the given number-id from the card.
 810 *
 811 * Return: The pointer of the instance if found, or %NULL if not.
 812 *
 813 * Note that this function takes card->controls_rwlock lock internally.
 814 */
 815struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card,
 816					unsigned int numid)
 817{
 818	if (snd_BUG_ON(!card || !numid))
 819		return NULL;
 820
 821#ifdef CONFIG_SND_CTL_FAST_LOOKUP
 822	return xa_load(&card->ctl_numids, numid);
 823#else
 824	return snd_ctl_find_numid_slow(card, numid);
 825#endif
 826}
 827EXPORT_SYMBOL(snd_ctl_find_numid);
 828
 829/**
 830 * snd_ctl_find_id - find the control instance with the given id
 831 * @card: the card instance
 832 * @id: the id to search
 833 *
 834 * Finds the control instance with the given id from the card.
 835 *
 836 * Return: The pointer of the instance if found, or %NULL if not.
 837 *
 838 * Note that this function takes card->controls_rwlock lock internally.
 
 839 */
 840struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
 841				     const struct snd_ctl_elem_id *id)
 842{
 843	struct snd_kcontrol *kctl;
 844
 845	if (snd_BUG_ON(!card || !id))
 846		return NULL;
 847
 848	if (id->numid != 0)
 849		return snd_ctl_find_numid(card, id->numid);
 850#ifdef CONFIG_SND_CTL_FAST_LOOKUP
 851	kctl = xa_load(&card->ctl_hash, get_ctl_id_hash(id));
 852	if (kctl && elem_id_matches(kctl, id))
 
 
 
 
 
 
 
 
 
 
 853		return kctl;
 854	if (!card->ctl_hash_collision)
 855		return NULL; /* we can rely on only hash table */
 856#endif
 857	/* no matching in hash table - try all as the last resort */
 858	guard(read_lock_irqsave)(&card->controls_rwlock);
 859	list_for_each_entry(kctl, &card->controls, list)
 860		if (elem_id_matches(kctl, id))
 861			return kctl;
 862
 863	return NULL;
 864}
 
 865EXPORT_SYMBOL(snd_ctl_find_id);
 866
 867static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
 868			     unsigned int cmd, void __user *arg)
 869{
 870	struct snd_ctl_card_info *info __free(kfree) = NULL;
 871
 872	info = kzalloc(sizeof(*info), GFP_KERNEL);
 873	if (! info)
 874		return -ENOMEM;
 875	scoped_guard(rwsem_read, &snd_ioctl_rwsem) {
 876		info->card = card->number;
 877		strscpy(info->id, card->id, sizeof(info->id));
 878		strscpy(info->driver, card->driver, sizeof(info->driver));
 879		strscpy(info->name, card->shortname, sizeof(info->name));
 880		strscpy(info->longname, card->longname, sizeof(info->longname));
 881		strscpy(info->mixername, card->mixername, sizeof(info->mixername));
 882		strscpy(info->components, card->components, sizeof(info->components));
 883	}
 884	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info)))
 
 885		return -EFAULT;
 
 
 886	return 0;
 887}
 888
 889static int snd_ctl_elem_list(struct snd_card *card,
 890			     struct snd_ctl_elem_list *list)
 891{
 
 
 892	struct snd_kcontrol *kctl;
 893	struct snd_ctl_elem_id id;
 894	unsigned int offset, space, jidx;
 895
 896	offset = list->offset;
 897	space = list->space;
 898
 899	guard(rwsem_read)(&card->controls_rwsem);
 900	list->count = card->controls_count;
 901	list->used = 0;
 902	if (!space)
 903		return 0;
 904	list_for_each_entry(kctl, &card->controls, list) {
 905		if (offset >= kctl->count) {
 
 
 
 
 
 
 
 
 
 
 
 906			offset -= kctl->count;
 907			continue;
 
 
 
 
 
 
 
 
 
 
 
 
 
 908		}
 909		for (jidx = offset; jidx < kctl->count; jidx++) {
 910			snd_ctl_build_ioff(&id, kctl, jidx);
 911			if (copy_to_user(list->pids + list->used, &id, sizeof(id)))
 912				return -EFAULT;
 913			list->used++;
 914			if (!--space)
 915				return 0;
 916		}
 917		offset = 0;
 
 
 
 
 918	}
 919	return 0;
 920}
 921
 922static int snd_ctl_elem_list_user(struct snd_card *card,
 923				  struct snd_ctl_elem_list __user *_list)
 924{
 925	struct snd_ctl_elem_list list;
 926	int err;
 927
 928	if (copy_from_user(&list, _list, sizeof(list)))
 929		return -EFAULT;
 930	err = snd_ctl_elem_list(card, &list);
 931	if (err)
 932		return err;
 933	if (copy_to_user(_list, &list, sizeof(list)))
 934		return -EFAULT;
 935
 936	return 0;
 937}
 938
 939/* Check whether the given kctl info is valid */
 940static int snd_ctl_check_elem_info(struct snd_card *card,
 941				   const struct snd_ctl_elem_info *info)
 942{
 943	static const unsigned int max_value_counts[] = {
 944		[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= 128,
 945		[SNDRV_CTL_ELEM_TYPE_INTEGER]	= 128,
 946		[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
 947		[SNDRV_CTL_ELEM_TYPE_BYTES]	= 512,
 948		[SNDRV_CTL_ELEM_TYPE_IEC958]	= 1,
 949		[SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
 950	};
 951
 952	if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
 953	    info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
 954		if (card)
 955			dev_err(card->dev,
 956				"control %i:%i:%i:%s:%i: invalid type %d\n",
 957				info->id.iface, info->id.device,
 958				info->id.subdevice, info->id.name,
 959				info->id.index, info->type);
 960		return -EINVAL;
 961	}
 962	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
 963	    info->value.enumerated.items == 0) {
 964		if (card)
 965			dev_err(card->dev,
 966				"control %i:%i:%i:%s:%i: zero enum items\n",
 967				info->id.iface, info->id.device,
 968				info->id.subdevice, info->id.name,
 969				info->id.index);
 970		return -EINVAL;
 971	}
 972	if (info->count > max_value_counts[info->type]) {
 973		if (card)
 974			dev_err(card->dev,
 975				"control %i:%i:%i:%s:%i: invalid count %d\n",
 976				info->id.iface, info->id.device,
 977				info->id.subdevice, info->id.name,
 978				info->id.index, info->count);
 979		return -EINVAL;
 980	}
 981
 982	return 0;
 983}
 984
 985/* The capacity of struct snd_ctl_elem_value.value.*/
 986static const unsigned int value_sizes[] = {
 987	[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= sizeof(long),
 988	[SNDRV_CTL_ELEM_TYPE_INTEGER]	= sizeof(long),
 989	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
 990	[SNDRV_CTL_ELEM_TYPE_BYTES]	= sizeof(unsigned char),
 991	[SNDRV_CTL_ELEM_TYPE_IEC958]	= sizeof(struct snd_aes_iec958),
 992	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
 993};
 994
 995/* fill the remaining snd_ctl_elem_value data with the given pattern */
 996static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
 997				      struct snd_ctl_elem_info *info,
 998				      u32 pattern)
 999{
1000	size_t offset = value_sizes[info->type] * info->count;
1001
1002	offset = DIV_ROUND_UP(offset, sizeof(u32));
1003	memset32((u32 *)control->value.bytes.data + offset, pattern,
1004		 sizeof(control->value) / sizeof(u32) - offset);
1005}
1006
1007/* check whether the given integer ctl value is valid */
1008static int sanity_check_int_value(struct snd_card *card,
1009				  const struct snd_ctl_elem_value *control,
1010				  const struct snd_ctl_elem_info *info,
1011				  int i, bool print_error)
1012{
1013	long long lval, lmin, lmax, lstep;
1014	u64 rem;
1015
1016	switch (info->type) {
1017	default:
1018	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1019		lval = control->value.integer.value[i];
1020		lmin = 0;
1021		lmax = 1;
1022		lstep = 0;
1023		break;
1024	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1025		lval = control->value.integer.value[i];
1026		lmin = info->value.integer.min;
1027		lmax = info->value.integer.max;
1028		lstep = info->value.integer.step;
1029		break;
1030	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1031		lval = control->value.integer64.value[i];
1032		lmin = info->value.integer64.min;
1033		lmax = info->value.integer64.max;
1034		lstep = info->value.integer64.step;
1035		break;
1036	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1037		lval = control->value.enumerated.item[i];
1038		lmin = 0;
1039		lmax = info->value.enumerated.items - 1;
1040		lstep = 0;
1041		break;
1042	}
1043
1044	if (lval < lmin || lval > lmax) {
1045		if (print_error)
1046			dev_err(card->dev,
1047				"control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
1048				control->id.iface, control->id.device,
1049				control->id.subdevice, control->id.name,
1050				control->id.index, lval, lmin, lmax, i);
1051		return -EINVAL;
1052	}
1053	if (lstep) {
1054		div64_u64_rem(lval, lstep, &rem);
1055		if (rem) {
1056			if (print_error)
1057				dev_err(card->dev,
1058					"control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
1059					control->id.iface, control->id.device,
1060					control->id.subdevice, control->id.name,
1061					control->id.index, lval, lstep, i);
1062			return -EINVAL;
1063		}
1064	}
1065
1066	return 0;
1067}
1068
1069/* check whether the all input values are valid for the given elem value */
1070static int sanity_check_input_values(struct snd_card *card,
1071				     const struct snd_ctl_elem_value *control,
1072				     const struct snd_ctl_elem_info *info,
1073				     bool print_error)
1074{
1075	int i, ret;
1076
1077	switch (info->type) {
1078	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1079	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1080	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1081	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1082		for (i = 0; i < info->count; i++) {
1083			ret = sanity_check_int_value(card, control, info, i,
1084						     print_error);
1085			if (ret < 0)
1086				return ret;
1087		}
1088		break;
1089	default:
1090		break;
1091	}
1092
1093	return 0;
1094}
1095
1096/* perform sanity checks to the given snd_ctl_elem_value object */
1097static int sanity_check_elem_value(struct snd_card *card,
1098				   const struct snd_ctl_elem_value *control,
1099				   const struct snd_ctl_elem_info *info,
1100				   u32 pattern)
1101{
1102	size_t offset;
1103	int ret;
1104	u32 *p;
1105
1106	ret = sanity_check_input_values(card, control, info, true);
1107	if (ret < 0)
1108		return ret;
1109
1110	/* check whether the remaining area kept untouched */
1111	offset = value_sizes[info->type] * info->count;
1112	offset = DIV_ROUND_UP(offset, sizeof(u32));
1113	p = (u32 *)control->value.bytes.data + offset;
1114	for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
1115		if (*p != pattern) {
1116			ret = -EINVAL;
1117			break;
1118		}
1119		*p = 0; /* clear the checked area */
1120	}
1121
1122	return ret;
1123}
1124
1125static int __snd_ctl_elem_info(struct snd_card *card,
1126			       struct snd_kcontrol *kctl,
1127			       struct snd_ctl_elem_info *info,
1128			       struct snd_ctl_file *ctl)
1129{
 
 
1130	struct snd_kcontrol_volatile *vd;
1131	unsigned int index_offset;
1132	int result;
1133
 
 
 
 
 
 
1134#ifdef CONFIG_SND_DEBUG
1135	info->access = 0;
1136#endif
1137	result = kctl->info(kctl, info);
1138	if (result >= 0) {
1139		snd_BUG_ON(info->access);
1140		index_offset = snd_ctl_get_ioff(kctl, &info->id);
1141		vd = &kctl->vd[index_offset];
1142		snd_ctl_build_ioff(&info->id, kctl, index_offset);
1143		info->access = vd->access;
1144		if (vd->owner) {
1145			info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
1146			if (vd->owner == ctl)
1147				info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
1148			info->owner = pid_vnr(vd->owner->pid);
1149		} else {
1150			info->owner = -1;
1151		}
1152		if (!snd_ctl_skip_validation(info) &&
1153		    snd_ctl_check_elem_info(card, info) < 0)
1154			result = -EINVAL;
1155	}
 
1156	return result;
1157}
1158
1159static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
1160			     struct snd_ctl_elem_info *info)
1161{
1162	struct snd_card *card = ctl->card;
1163	struct snd_kcontrol *kctl;
1164
1165	guard(rwsem_read)(&card->controls_rwsem);
1166	kctl = snd_ctl_find_id(card, &info->id);
1167	if (!kctl)
1168		return -ENOENT;
1169	return __snd_ctl_elem_info(card, kctl, info, ctl);
1170}
1171
1172static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
1173				  struct snd_ctl_elem_info __user *_info)
1174{
1175	struct snd_card *card = ctl->card;
1176	struct snd_ctl_elem_info info;
1177	int result;
1178
1179	if (copy_from_user(&info, _info, sizeof(info)))
1180		return -EFAULT;
1181	result = snd_power_ref_and_wait(card);
1182	if (result)
1183		return result;
1184	result = snd_ctl_elem_info(ctl, &info);
1185	snd_power_unref(card);
1186	if (result < 0)
1187		return result;
1188	/* drop internal access flags */
1189	info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
1190			 SNDRV_CTL_ELEM_ACCESS_LED_MASK);
1191	if (copy_to_user(_info, &info, sizeof(info)))
1192		return -EFAULT;
1193	return result;
1194}
1195
1196static int snd_ctl_elem_read(struct snd_card *card,
1197			     struct snd_ctl_elem_value *control)
1198{
1199	struct snd_kcontrol *kctl;
1200	struct snd_kcontrol_volatile *vd;
1201	unsigned int index_offset;
1202	struct snd_ctl_elem_info info;
1203	const u32 pattern = 0xdeadbeef;
1204	int ret;
1205
1206	guard(rwsem_read)(&card->controls_rwsem);
1207	kctl = snd_ctl_find_id(card, &control->id);
1208	if (!kctl)
1209		return -ENOENT;
1210
1211	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1212	vd = &kctl->vd[index_offset];
1213	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || !kctl->get)
1214		return -EPERM;
1215
1216	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1217
1218#ifdef CONFIG_SND_CTL_DEBUG
1219	/* info is needed only for validation */
1220	memset(&info, 0, sizeof(info));
1221	info.id = control->id;
1222	ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
1223	if (ret < 0)
1224		return ret;
1225#endif
1226
1227	if (!snd_ctl_skip_validation(&info))
1228		fill_remaining_elem_value(control, &info, pattern);
1229	ret = kctl->get(kctl, control);
1230	if (ret < 0)
1231		return ret;
1232	if (!snd_ctl_skip_validation(&info) &&
1233	    sanity_check_elem_value(card, control, &info, pattern) < 0) {
1234		dev_err(card->dev,
1235			"control %i:%i:%i:%s:%i: access overflow\n",
1236			control->id.iface, control->id.device,
1237			control->id.subdevice, control->id.name,
1238			control->id.index);
1239		return -EINVAL;
1240	}
1241	return 0;
 
1242}
1243
1244static int snd_ctl_elem_read_user(struct snd_card *card,
1245				  struct snd_ctl_elem_value __user *_control)
1246{
1247	struct snd_ctl_elem_value *control __free(kfree) = NULL;
1248	int result;
1249
1250	control = memdup_user(_control, sizeof(*control));
1251	if (IS_ERR(control))
1252		return PTR_ERR(control);
1253
1254	result = snd_power_ref_and_wait(card);
1255	if (result)
1256		return result;
1257	result = snd_ctl_elem_read(card, control);
1258	snd_power_unref(card);
1259	if (result < 0)
1260		return result;
1261
1262	if (copy_to_user(_control, control, sizeof(*control)))
1263		return -EFAULT;
1264	return result;
1265}
1266
1267static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
1268			      struct snd_ctl_elem_value *control)
1269{
1270	struct snd_kcontrol *kctl;
1271	struct snd_kcontrol_volatile *vd;
1272	unsigned int index_offset;
1273	int result = 0;
1274
1275	down_write(&card->controls_rwsem);
1276	kctl = snd_ctl_find_id(card, &control->id);
1277	if (kctl == NULL) {
1278		up_write(&card->controls_rwsem);
1279		return -ENOENT;
1280	}
1281
1282	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1283	vd = &kctl->vd[index_offset];
1284	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
1285	    (file && vd->owner && vd->owner != file)) {
1286		up_write(&card->controls_rwsem);
1287		return -EPERM;
1288	}
1289
1290	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1291	/* validate input values */
1292	if (IS_ENABLED(CONFIG_SND_CTL_INPUT_VALIDATION)) {
1293		struct snd_ctl_elem_info info;
1294
1295		memset(&info, 0, sizeof(info));
1296		info.id = control->id;
1297		result = __snd_ctl_elem_info(card, kctl, &info, NULL);
1298		if (!result)
1299			result = sanity_check_input_values(card, control, &info,
1300							   false);
1301	}
1302	if (!result)
1303		result = kctl->put(kctl, control);
1304	if (result < 0) {
1305		up_write(&card->controls_rwsem);
1306		return result;
1307	}
1308
1309	if (result > 0) {
1310		downgrade_write(&card->controls_rwsem);
1311		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
1312		up_read(&card->controls_rwsem);
1313	} else {
1314		up_write(&card->controls_rwsem);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1315	}
1316
1317	return 0;
1318}
1319
1320static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
1321				   struct snd_ctl_elem_value __user *_control)
1322{
1323	struct snd_ctl_elem_value *control __free(kfree) = NULL;
1324	struct snd_card *card;
1325	int result;
1326
1327	control = memdup_user(_control, sizeof(*control));
1328	if (IS_ERR(control))
1329		return PTR_ERR(control);
1330
1331	card = file->card;
1332	result = snd_power_ref_and_wait(card);
1333	if (result < 0)
1334		return result;
1335	result = snd_ctl_elem_write(card, file, control);
1336	snd_power_unref(card);
1337	if (result < 0)
1338		return result;
1339
1340	if (copy_to_user(_control, control, sizeof(*control)))
1341		return -EFAULT;
1342	return result;
1343}
1344
1345static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1346			     struct snd_ctl_elem_id __user *_id)
1347{
1348	struct snd_card *card = file->card;
1349	struct snd_ctl_elem_id id;
1350	struct snd_kcontrol *kctl;
1351	struct snd_kcontrol_volatile *vd;
1352
 
1353	if (copy_from_user(&id, _id, sizeof(id)))
1354		return -EFAULT;
1355	guard(rwsem_write)(&card->controls_rwsem);
1356	kctl = snd_ctl_find_id(card, &id);
1357	if (!kctl)
1358		return -ENOENT;
1359	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1360	if (vd->owner)
1361		return -EBUSY;
1362	vd->owner = file;
1363	return 0;
 
 
 
 
 
 
1364}
1365
1366static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1367			       struct snd_ctl_elem_id __user *_id)
1368{
1369	struct snd_card *card = file->card;
1370	struct snd_ctl_elem_id id;
1371	struct snd_kcontrol *kctl;
1372	struct snd_kcontrol_volatile *vd;
1373
 
1374	if (copy_from_user(&id, _id, sizeof(id)))
1375		return -EFAULT;
1376	guard(rwsem_write)(&card->controls_rwsem);
1377	kctl = snd_ctl_find_id(card, &id);
1378	if (!kctl)
1379		return -ENOENT;
1380	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1381	if (!vd->owner)
1382		return -EINVAL;
1383	if (vd->owner != file)
1384		return -EPERM;
1385	vd->owner = NULL;
1386	return 0;
 
 
 
 
 
 
1387}
1388
1389struct user_element {
1390	struct snd_ctl_elem_info info;
1391	struct snd_card *card;
1392	char *elem_data;		/* element data */
1393	unsigned long elem_data_size;	/* size of element data in bytes */
1394	void *tlv_data;			/* TLV data */
1395	unsigned long tlv_data_size;	/* TLV data size */
1396	void *priv_data;		/* private data (like strings for enumerated type) */
 
1397};
1398
1399// check whether the addition (in bytes) of user ctl element may overflow the limit.
1400static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
1401{
1402	return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
1403}
1404
1405static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1406				  struct snd_ctl_elem_info *uinfo)
1407{
1408	struct user_element *ue = kcontrol->private_data;
1409	unsigned int offset;
1410
1411	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1412	*uinfo = ue->info;
1413	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1414
1415	return 0;
1416}
1417
1418static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1419				       struct snd_ctl_elem_info *uinfo)
1420{
1421	struct user_element *ue = kcontrol->private_data;
1422	const char *names;
1423	unsigned int item;
1424	unsigned int offset;
1425
1426	item = uinfo->value.enumerated.item;
1427
1428	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1429	*uinfo = ue->info;
1430	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1431
1432	item = min(item, uinfo->value.enumerated.items - 1);
1433	uinfo->value.enumerated.item = item;
1434
1435	names = ue->priv_data;
1436	for (; item > 0; --item)
1437		names += strlen(names) + 1;
1438	strcpy(uinfo->value.enumerated.name, names);
1439
1440	return 0;
1441}
1442
1443static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1444				 struct snd_ctl_elem_value *ucontrol)
1445{
1446	struct user_element *ue = kcontrol->private_data;
1447	unsigned int size = ue->elem_data_size;
1448	char *src = ue->elem_data +
1449			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1450
1451	memcpy(&ucontrol->value, src, size);
1452	return 0;
1453}
1454
1455static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1456				 struct snd_ctl_elem_value *ucontrol)
1457{
1458	int err, change;
1459	struct user_element *ue = kcontrol->private_data;
1460	unsigned int size = ue->elem_data_size;
1461	char *dst = ue->elem_data +
1462			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1463
1464	err = sanity_check_input_values(ue->card, ucontrol, &ue->info, false);
1465	if (err < 0)
1466		return err;
1467
1468	change = memcmp(&ucontrol->value, dst, size) != 0;
1469	if (change)
1470		memcpy(dst, &ucontrol->value, size);
1471	return change;
1472}
1473
1474/* called in controls_rwsem write lock */
1475static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1476			    unsigned int size)
1477{
1478	struct user_element *ue = kctl->private_data;
1479	unsigned int *container;
1480	unsigned int mask = 0;
1481	int i;
1482	int change;
1483
1484	lockdep_assert_held_write(&ue->card->controls_rwsem);
1485
1486	if (size > 1024 * 128)	/* sane value */
1487		return -EINVAL;
1488
1489	// does the TLV size change cause overflow?
1490	if (check_user_elem_overflow(ue->card, (ssize_t)(size - ue->tlv_data_size)))
1491		return -ENOMEM;
1492
1493	container = vmemdup_user(buf, size);
1494	if (IS_ERR(container))
1495		return PTR_ERR(container);
1496
1497	change = ue->tlv_data_size != size;
1498	if (!change)
1499		change = memcmp(ue->tlv_data, container, size) != 0;
1500	if (!change) {
1501		kvfree(container);
1502		return 0;
1503	}
1504
1505	if (ue->tlv_data == NULL) {
1506		/* Now TLV data is available. */
1507		for (i = 0; i < kctl->count; ++i)
1508			kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
1509		mask = SNDRV_CTL_EVENT_MASK_INFO;
 
 
 
 
1510	} else {
1511		ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1512		ue->tlv_data_size = 0;
1513		kvfree(ue->tlv_data);
 
 
 
1514	}
1515
1516	ue->tlv_data = container;
1517	ue->tlv_data_size = size;
1518	// decremented at private_free.
1519	ue->card->user_ctl_alloc_size += size;
1520
1521	mask |= SNDRV_CTL_EVENT_MASK_TLV;
1522	for (i = 0; i < kctl->count; ++i)
1523		snd_ctl_notify_one(ue->card, mask, kctl, i);
1524
1525	return change;
1526}
1527
1528static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1529			 unsigned int size)
1530{
1531	struct user_element *ue = kctl->private_data;
1532
1533	if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
1534		return -ENXIO;
1535
1536	if (size < ue->tlv_data_size)
1537		return -ENOSPC;
1538
1539	if (copy_to_user(buf, ue->tlv_data, ue->tlv_data_size))
1540		return -EFAULT;
1541
1542	return 0;
1543}
1544
1545static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
1546				 unsigned int size, unsigned int __user *buf)
1547{
1548	if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
1549		return replace_user_tlv(kctl, buf, size);
1550	else
1551		return read_user_tlv(kctl, buf, size);
1552}
1553
1554/* called in controls_rwsem write lock */
1555static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1556{
1557	char *names, *p;
1558	size_t buf_len, name_len;
1559	unsigned int i;
1560	const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1561
1562	lockdep_assert_held_write(&ue->card->controls_rwsem);
1563
1564	buf_len = ue->info.value.enumerated.names_length;
1565	if (buf_len > 64 * 1024)
1566		return -EINVAL;
1567
1568	if (check_user_elem_overflow(ue->card, buf_len))
1569		return -ENOMEM;
1570	names = vmemdup_user((const void __user *)user_ptrval, buf_len);
1571	if (IS_ERR(names))
1572		return PTR_ERR(names);
1573
1574	/* check that there are enough valid names */
1575	p = names;
1576	for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1577		name_len = strnlen(p, buf_len);
1578		if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1579			kvfree(names);
1580			return -EINVAL;
1581		}
1582		p += name_len + 1;
1583		buf_len -= name_len + 1;
1584	}
1585
1586	ue->priv_data = names;
1587	ue->info.value.enumerated.names_ptr = 0;
1588	// increment the allocation size; decremented again at private_free.
1589	ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
1590
1591	return 0;
1592}
1593
1594static size_t compute_user_elem_size(size_t size, unsigned int count)
1595{
1596	return sizeof(struct user_element) + size * count;
1597}
1598
1599static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1600{
1601	struct user_element *ue = kcontrol->private_data;
1602
1603	// decrement the allocation size.
1604	ue->card->user_ctl_alloc_size -= compute_user_elem_size(ue->elem_data_size, kcontrol->count);
1605	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1606	if (ue->priv_data)
1607		ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
1608
1609	kvfree(ue->tlv_data);
1610	kvfree(ue->priv_data);
1611	kfree(ue);
1612}
1613
1614static int snd_ctl_elem_add(struct snd_ctl_file *file,
1615			    struct snd_ctl_elem_info *info, int replace)
1616{
1617	struct snd_card *card = file->card;
1618	struct snd_kcontrol *kctl;
1619	unsigned int count;
1620	unsigned int access;
1621	long private_size;
1622	size_t alloc_size;
1623	struct user_element *ue;
1624	unsigned int offset;
1625	int err;
1626
1627	if (!*info->id.name)
1628		return -EINVAL;
1629	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
1630		return -EINVAL;
1631
1632	/* Delete a control to replace them if needed. */
1633	if (replace) {
1634		info->id.numid = 0;
1635		err = snd_ctl_remove_user_ctl(file, &info->id);
1636		if (err)
1637			return err;
 
 
 
 
 
 
 
 
 
 
1638	}
1639
1640	/* Check the number of elements for this userspace control. */
1641	count = info->owner;
1642	if (count == 0)
1643		count = 1;
1644	if (count > MAX_CONTROL_COUNT)
1645		return -EINVAL;
1646
1647	/* Arrange access permissions if needed. */
1648	access = info->access;
1649	if (access == 0)
1650		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1651	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1652		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1653		   SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
1654
1655	/* In initial state, nothing is available as TLV container. */
1656	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1657		access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1658	access |= SNDRV_CTL_ELEM_ACCESS_USER;
1659
1660	/*
1661	 * Check information and calculate the size of data specific to
1662	 * this userspace control.
1663	 */
1664	/* pass NULL to card for suppressing error messages */
1665	err = snd_ctl_check_elem_info(NULL, info);
1666	if (err < 0)
1667		return err;
1668	/* user-space control doesn't allow zero-size data */
1669	if (info->count < 1)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1670		return -EINVAL;
1671	private_size = value_sizes[info->type] * info->count;
1672	alloc_size = compute_user_elem_size(private_size, count);
1673
1674	guard(rwsem_write)(&card->controls_rwsem);
1675	if (check_user_elem_overflow(card, alloc_size))
1676		return -ENOMEM;
1677
1678	/*
1679	 * Keep memory object for this userspace control. After passing this
1680	 * code block, the instance should be freed by snd_ctl_free_one().
1681	 *
1682	 * Note that these elements in this control are locked.
1683	 */
1684	err = snd_ctl_new(&kctl, count, access, file);
1685	if (err < 0)
1686		return err;
1687	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1688	ue = kzalloc(alloc_size, GFP_KERNEL);
1689	if (!ue) {
1690		kfree(kctl);
1691		return -ENOMEM;
1692	}
1693	kctl->private_data = ue;
1694	kctl->private_free = snd_ctl_elem_user_free;
1695
1696	// increment the allocated size; decremented again at private_free.
1697	card->user_ctl_alloc_size += alloc_size;
1698
1699	/* Set private data for this userspace control. */
1700	ue->card = card;
1701	ue->info = *info;
1702	ue->info.access = 0;
1703	ue->elem_data = (char *)ue + sizeof(*ue);
1704	ue->elem_data_size = private_size;
1705	if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1706		err = snd_ctl_elem_init_enum_names(ue);
1707		if (err < 0) {
1708			snd_ctl_free_one(kctl);
1709			return err;
1710		}
1711	}
 
 
 
 
 
 
1712
1713	/* Set callback functions. */
1714	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1715		kctl->info = snd_ctl_elem_user_enum_info;
1716	else
1717		kctl->info = snd_ctl_elem_user_info;
1718	if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1719		kctl->get = snd_ctl_elem_user_get;
1720	if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1721		kctl->put = snd_ctl_elem_user_put;
1722	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1723		kctl->tlv.c = snd_ctl_elem_user_tlv;
1724
1725	/* This function manage to free the instance on failure. */
1726	err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
1727	if (err < 0) {
1728		snd_ctl_free_one(kctl);
1729		return err;
1730	}
1731	offset = snd_ctl_get_ioff(kctl, &info->id);
1732	snd_ctl_build_ioff(&info->id, kctl, offset);
1733	/*
1734	 * Here we cannot fill any field for the number of elements added by
1735	 * this operation because there're no specific fields. The usage of
1736	 * 'owner' field for this purpose may cause any bugs to userspace
1737	 * applications because the field originally means PID of a process
1738	 * which locks the element.
1739	 */
1740	return 0;
1741}
1742
1743static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1744				 struct snd_ctl_elem_info __user *_info, int replace)
1745{
1746	struct snd_ctl_elem_info info;
1747	int err;
1748
1749	if (copy_from_user(&info, _info, sizeof(info)))
1750		return -EFAULT;
1751	err = snd_ctl_elem_add(file, &info, replace);
1752	if (err < 0)
1753		return err;
1754	if (copy_to_user(_info, &info, sizeof(info))) {
1755		snd_ctl_remove_user_ctl(file, &info.id);
1756		return -EFAULT;
1757	}
1758
1759	return 0;
1760}
1761
1762static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1763			       struct snd_ctl_elem_id __user *_id)
1764{
1765	struct snd_ctl_elem_id id;
1766
1767	if (copy_from_user(&id, _id, sizeof(id)))
1768		return -EFAULT;
1769	return snd_ctl_remove_user_ctl(file, &id);
1770}
1771
1772static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1773{
1774	int subscribe;
1775	if (get_user(subscribe, ptr))
1776		return -EFAULT;
1777	if (subscribe < 0) {
1778		subscribe = file->subscribed;
1779		if (put_user(subscribe, ptr))
1780			return -EFAULT;
1781		return 0;
1782	}
1783	if (subscribe) {
1784		file->subscribed = 1;
1785		return 0;
1786	} else if (file->subscribed) {
1787		snd_ctl_empty_read_queue(file);
1788		file->subscribed = 0;
1789	}
1790	return 0;
1791}
1792
1793static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
1794			    struct snd_kcontrol *kctl,
1795			    struct snd_ctl_elem_id *id,
1796			    unsigned int __user *buf, unsigned int size)
1797{
1798	static const struct {
1799		int op;
1800		int perm;
1801	} pairs[] = {
1802		{SNDRV_CTL_TLV_OP_READ,  SNDRV_CTL_ELEM_ACCESS_TLV_READ},
1803		{SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
1804		{SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
1805	};
1806	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1807	int i;
1808
1809	/* Check support of the request for this element. */
1810	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
1811		if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
1812			break;
1813	}
1814	if (i == ARRAY_SIZE(pairs))
1815		return -ENXIO;
1816
1817	if (kctl->tlv.c == NULL)
1818		return -ENXIO;
1819
1820	/* Write and command operations are not allowed for locked element. */
1821	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
1822	    vd->owner != NULL && vd->owner != file)
1823		return -EPERM;
1824
1825	return kctl->tlv.c(kctl, op_flag, size, buf);
1826}
1827
1828static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
1829			unsigned int __user *buf, unsigned int size)
1830{
1831	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1832	unsigned int len;
1833
1834	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
1835		return -ENXIO;
1836
1837	if (kctl->tlv.p == NULL)
1838		return -ENXIO;
1839
1840	len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
1841	if (size < len)
1842		return -ENOMEM;
1843
1844	if (copy_to_user(buf, kctl->tlv.p, len))
1845		return -EFAULT;
1846
1847	return 0;
1848}
1849
1850static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1851			     struct snd_ctl_tlv __user *buf,
1852                             int op_flag)
1853{
1854	struct snd_ctl_tlv header;
1855	unsigned int __user *container;
1856	unsigned int container_size;
1857	struct snd_kcontrol *kctl;
1858	struct snd_ctl_elem_id id;
1859	struct snd_kcontrol_volatile *vd;
 
 
1860
1861	lockdep_assert_held(&file->card->controls_rwsem);
1862
1863	if (copy_from_user(&header, buf, sizeof(header)))
1864		return -EFAULT;
1865
1866	/* In design of control core, numerical ID starts at 1. */
1867	if (header.numid == 0)
1868		return -EINVAL;
1869
1870	/* At least, container should include type and length fields.  */
1871	if (header.length < sizeof(unsigned int) * 2)
1872		return -EINVAL;
1873	container_size = header.length;
1874	container = buf->tlv;
1875
1876	kctl = snd_ctl_find_numid(file->card, header.numid);
1877	if (kctl == NULL)
1878		return -ENOENT;
1879
1880	/* Calculate index of the element in this set. */
1881	id = kctl->id;
1882	snd_ctl_build_ioff(&id, kctl, header.numid - id.numid);
1883	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1884
 
1885	if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1886		return call_tlv_handler(file, op_flag, kctl, &id, container,
1887					container_size);
 
 
 
 
 
 
 
 
1888	} else {
1889		if (op_flag == SNDRV_CTL_TLV_OP_READ) {
1890			return read_tlv_buf(kctl, &id, container,
1891					    container_size);
 
 
 
 
 
1892		}
 
 
1893	}
1894
1895	/* Not supported. */
1896	return -ENXIO;
1897}
1898
1899static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1900{
1901	struct snd_ctl_file *ctl;
1902	struct snd_card *card;
1903	struct snd_kctl_ioctl *p;
1904	void __user *argp = (void __user *)arg;
1905	int __user *ip = argp;
1906	int err;
1907
1908	ctl = file->private_data;
1909	card = ctl->card;
1910	if (snd_BUG_ON(!card))
1911		return -ENXIO;
1912	switch (cmd) {
1913	case SNDRV_CTL_IOCTL_PVERSION:
1914		return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1915	case SNDRV_CTL_IOCTL_CARD_INFO:
1916		return snd_ctl_card_info(card, ctl, cmd, argp);
1917	case SNDRV_CTL_IOCTL_ELEM_LIST:
1918		return snd_ctl_elem_list_user(card, argp);
1919	case SNDRV_CTL_IOCTL_ELEM_INFO:
1920		return snd_ctl_elem_info_user(ctl, argp);
1921	case SNDRV_CTL_IOCTL_ELEM_READ:
1922		return snd_ctl_elem_read_user(card, argp);
1923	case SNDRV_CTL_IOCTL_ELEM_WRITE:
1924		return snd_ctl_elem_write_user(ctl, argp);
1925	case SNDRV_CTL_IOCTL_ELEM_LOCK:
1926		return snd_ctl_elem_lock(ctl, argp);
1927	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1928		return snd_ctl_elem_unlock(ctl, argp);
1929	case SNDRV_CTL_IOCTL_ELEM_ADD:
1930		return snd_ctl_elem_add_user(ctl, argp, 0);
1931	case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1932		return snd_ctl_elem_add_user(ctl, argp, 1);
1933	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1934		return snd_ctl_elem_remove(ctl, argp);
1935	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1936		return snd_ctl_subscribe_events(ctl, ip);
1937	case SNDRV_CTL_IOCTL_TLV_READ:
1938		err = snd_power_ref_and_wait(card);
1939		if (err < 0)
1940			return err;
1941		scoped_guard(rwsem_read, &card->controls_rwsem)
1942			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
1943		snd_power_unref(card);
1944		return err;
1945	case SNDRV_CTL_IOCTL_TLV_WRITE:
1946		err = snd_power_ref_and_wait(card);
1947		if (err < 0)
1948			return err;
1949		scoped_guard(rwsem_write, &card->controls_rwsem)
1950			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
1951		snd_power_unref(card);
1952		return err;
1953	case SNDRV_CTL_IOCTL_TLV_COMMAND:
1954		err = snd_power_ref_and_wait(card);
1955		if (err < 0)
1956			return err;
1957		scoped_guard(rwsem_write, &card->controls_rwsem)
1958			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
1959		snd_power_unref(card);
1960		return err;
1961	case SNDRV_CTL_IOCTL_POWER:
1962		return -ENOPROTOOPT;
1963	case SNDRV_CTL_IOCTL_POWER_STATE:
 
 
 
1964		return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
 
1965	}
1966
1967	guard(rwsem_read)(&snd_ioctl_rwsem);
1968	list_for_each_entry(p, &snd_control_ioctls, list) {
1969		err = p->fioctl(card, ctl, cmd, arg);
1970		if (err != -ENOIOCTLCMD)
 
1971			return err;
 
1972	}
1973	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
 
1974	return -ENOTTY;
1975}
1976
1977static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1978			    size_t count, loff_t * offset)
1979{
1980	struct snd_ctl_file *ctl;
1981	int err = 0;
1982	ssize_t result = 0;
1983
1984	ctl = file->private_data;
1985	if (snd_BUG_ON(!ctl || !ctl->card))
1986		return -ENXIO;
1987	if (!ctl->subscribed)
1988		return -EBADFD;
1989	if (count < sizeof(struct snd_ctl_event))
1990		return -EINVAL;
1991	spin_lock_irq(&ctl->read_lock);
1992	while (count >= sizeof(struct snd_ctl_event)) {
1993		struct snd_ctl_event ev;
1994		struct snd_kctl_event *kev;
1995		while (list_empty(&ctl->events)) {
1996			wait_queue_entry_t wait;
1997			if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
1998				err = -EAGAIN;
1999				goto __end_lock;
2000			}
2001			init_waitqueue_entry(&wait, current);
2002			add_wait_queue(&ctl->change_sleep, &wait);
2003			set_current_state(TASK_INTERRUPTIBLE);
2004			spin_unlock_irq(&ctl->read_lock);
2005			schedule();
2006			remove_wait_queue(&ctl->change_sleep, &wait);
2007			if (ctl->card->shutdown)
2008				return -ENODEV;
2009			if (signal_pending(current))
2010				return -ERESTARTSYS;
2011			spin_lock_irq(&ctl->read_lock);
2012		}
2013		kev = snd_kctl_event(ctl->events.next);
2014		ev.type = SNDRV_CTL_EVENT_ELEM;
2015		ev.data.elem.mask = kev->mask;
2016		ev.data.elem.id = kev->id;
2017		list_del(&kev->list);
2018		spin_unlock_irq(&ctl->read_lock);
2019		kfree(kev);
2020		if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
2021			err = -EFAULT;
2022			goto __end;
2023		}
2024		spin_lock_irq(&ctl->read_lock);
2025		buffer += sizeof(struct snd_ctl_event);
2026		count -= sizeof(struct snd_ctl_event);
2027		result += sizeof(struct snd_ctl_event);
2028	}
2029      __end_lock:
2030	spin_unlock_irq(&ctl->read_lock);
2031      __end:
2032      	return result > 0 ? result : err;
2033}
2034
2035static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
2036{
2037	__poll_t mask;
2038	struct snd_ctl_file *ctl;
2039
2040	ctl = file->private_data;
2041	if (!ctl->subscribed)
2042		return 0;
2043	poll_wait(file, &ctl->change_sleep, wait);
2044
2045	mask = 0;
2046	if (!list_empty(&ctl->events))
2047		mask |= EPOLLIN | EPOLLRDNORM;
2048
2049	return mask;
2050}
2051
2052/*
2053 * register the device-specific control-ioctls.
2054 * called from each device manager like pcm.c, hwdep.c, etc.
2055 */
2056static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
2057{
2058	struct snd_kctl_ioctl *pn;
2059
2060	pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
2061	if (pn == NULL)
2062		return -ENOMEM;
2063	pn->fioctl = fcn;
2064	guard(rwsem_write)(&snd_ioctl_rwsem);
2065	list_add_tail(&pn->list, lists);
 
2066	return 0;
2067}
2068
2069/**
2070 * snd_ctl_register_ioctl - register the device-specific control-ioctls
2071 * @fcn: ioctl callback function
2072 *
2073 * called from each device manager like pcm.c, hwdep.c, etc.
2074 *
2075 * Return: zero if successful, or a negative error code
2076 */
2077int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
2078{
2079	return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
2080}
 
2081EXPORT_SYMBOL(snd_ctl_register_ioctl);
2082
2083#ifdef CONFIG_COMPAT
2084/**
2085 * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
2086 * control-ioctls
2087 * @fcn: ioctl callback function
2088 *
2089 * Return: zero if successful, or a negative error code
2090 */
2091int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2092{
2093	return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
2094}
 
2095EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
2096#endif
2097
2098/*
2099 * de-register the device-specific control-ioctls.
2100 */
2101static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
2102				     struct list_head *lists)
2103{
2104	struct snd_kctl_ioctl *p;
2105
2106	if (snd_BUG_ON(!fcn))
2107		return -EINVAL;
2108	guard(rwsem_write)(&snd_ioctl_rwsem);
2109	list_for_each_entry(p, lists, list) {
2110		if (p->fioctl == fcn) {
2111			list_del(&p->list);
 
2112			kfree(p);
2113			return 0;
2114		}
2115	}
 
2116	snd_BUG();
2117	return -EINVAL;
2118}
2119
2120/**
2121 * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
2122 * @fcn: ioctl callback function to unregister
2123 *
2124 * Return: zero if successful, or a negative error code
2125 */
2126int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
2127{
2128	return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
2129}
 
2130EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
2131
2132#ifdef CONFIG_COMPAT
2133/**
2134 * snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
2135 * 32bit control-ioctls
2136 * @fcn: ioctl callback function to unregister
2137 *
2138 * Return: zero if successful, or a negative error code
2139 */
2140int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2141{
2142	return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
2143}
 
2144EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
2145#endif
2146
2147static int snd_ctl_fasync(int fd, struct file * file, int on)
2148{
2149	struct snd_ctl_file *ctl;
2150
2151	ctl = file->private_data;
2152	return snd_fasync_helper(fd, file, on, &ctl->fasync);
2153}
2154
2155/* return the preferred subdevice number if already assigned;
2156 * otherwise return -1
2157 */
2158int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
2159{
2160	struct snd_ctl_file *kctl;
2161	int subdevice = -1;
2162
2163	guard(read_lock_irqsave)(&card->controls_rwlock);
2164	list_for_each_entry(kctl, &card->ctl_files, list) {
2165		if (kctl->pid == task_pid(current)) {
2166			subdevice = kctl->preferred_subdevice[type];
2167			if (subdevice != -1)
2168				break;
2169		}
2170	}
2171	return subdevice;
2172}
2173EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
2174
2175/*
2176 * ioctl32 compat
2177 */
2178#ifdef CONFIG_COMPAT
2179#include "control_compat.c"
2180#else
2181#define snd_ctl_ioctl_compat	NULL
2182#endif
2183
2184/*
2185 * control layers (audio LED etc.)
2186 */
2187
2188/**
2189 * snd_ctl_request_layer - request to use the layer
2190 * @module_name: Name of the kernel module (NULL == build-in)
2191 *
2192 * Return: zero if successful, or an error code when the module cannot be loaded
2193 */
2194int snd_ctl_request_layer(const char *module_name)
2195{
2196	struct snd_ctl_layer_ops *lops;
2197
2198	if (module_name == NULL)
2199		return 0;
2200	scoped_guard(rwsem_read, &snd_ctl_layer_rwsem) {
2201		for (lops = snd_ctl_layer; lops; lops = lops->next)
2202			if (strcmp(lops->module_name, module_name) == 0)
2203				return 0;
2204	}
2205	return request_module(module_name);
2206}
2207EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
2208
2209/**
2210 * snd_ctl_register_layer - register new control layer
2211 * @lops: operation structure
2212 *
2213 * The new layer can track all control elements and do additional
2214 * operations on top (like audio LED handling).
2215 */
2216void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
2217{
2218	struct snd_card *card;
2219	int card_number;
2220
2221	scoped_guard(rwsem_write, &snd_ctl_layer_rwsem) {
2222		lops->next = snd_ctl_layer;
2223		snd_ctl_layer = lops;
2224	}
2225	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
2226		card = snd_card_ref(card_number);
2227		if (card) {
2228			scoped_guard(rwsem_read, &card->controls_rwsem)
2229				lops->lregister(card);
2230			snd_card_unref(card);
2231		}
2232	}
2233}
2234EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
2235
2236/**
2237 * snd_ctl_disconnect_layer - disconnect control layer
2238 * @lops: operation structure
2239 *
2240 * It is expected that the information about tracked cards
2241 * is freed before this call (the disconnect callback is
2242 * not called here).
2243 */
2244void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
2245{
2246	struct snd_ctl_layer_ops *lops2, *prev_lops2;
2247
2248	guard(rwsem_write)(&snd_ctl_layer_rwsem);
2249	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
2250		if (lops2 == lops) {
2251			if (!prev_lops2)
2252				snd_ctl_layer = lops->next;
2253			else
2254				prev_lops2->next = lops->next;
2255			break;
2256		}
2257		prev_lops2 = lops2;
2258	}
2259}
2260EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
2261
2262/*
2263 *  INIT PART
2264 */
2265
2266static const struct file_operations snd_ctl_f_ops =
2267{
2268	.owner =	THIS_MODULE,
2269	.read =		snd_ctl_read,
2270	.open =		snd_ctl_open,
2271	.release =	snd_ctl_release,
 
2272	.poll =		snd_ctl_poll,
2273	.unlocked_ioctl =	snd_ctl_ioctl,
2274	.compat_ioctl =	snd_ctl_ioctl_compat,
2275	.fasync =	snd_ctl_fasync,
2276};
2277
2278/* call lops under rwsems; called from snd_ctl_dev_*() below() */
2279#define call_snd_ctl_lops(_card, _op)				    \
2280	do {							    \
2281		struct snd_ctl_layer_ops *lops;			    \
2282		guard(rwsem_read)(&(_card)->controls_rwsem);	    \
2283		guard(rwsem_read)(&snd_ctl_layer_rwsem);	    \
2284		for (lops = snd_ctl_layer; lops; lops = lops->next) \
2285			lops->_op(_card);			    \
2286	} while (0)
2287
2288/*
2289 * registration of the control device
2290 */
2291static int snd_ctl_dev_register(struct snd_device *device)
2292{
2293	struct snd_card *card = device->device_data;
2294	int err;
 
2295
2296	err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
2297				  &snd_ctl_f_ops, card, card->ctl_dev);
2298	if (err < 0)
 
 
 
 
 
2299		return err;
2300	call_snd_ctl_lops(card, lregister);
2301	return 0;
2302}
2303
2304/*
2305 * disconnection of the control device
2306 */
2307static int snd_ctl_dev_disconnect(struct snd_device *device)
2308{
2309	struct snd_card *card = device->device_data;
2310	struct snd_ctl_file *ctl;
 
2311
2312	scoped_guard(read_lock_irqsave, &card->controls_rwlock) {
2313		list_for_each_entry(ctl, &card->ctl_files, list) {
2314			wake_up(&ctl->change_sleep);
2315			snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
2316		}
 
 
 
 
 
2317	}
 
2318
2319	call_snd_ctl_lops(card, ldisconnect);
2320	return snd_unregister_device(card->ctl_dev);
 
 
2321}
2322
2323/*
2324 * free all controls
2325 */
2326static int snd_ctl_dev_free(struct snd_device *device)
2327{
2328	struct snd_card *card = device->device_data;
2329	struct snd_kcontrol *control;
2330
2331	scoped_guard(rwsem_write, &card->controls_rwsem) {
2332		while (!list_empty(&card->controls)) {
2333			control = snd_kcontrol(card->controls.next);
2334			__snd_ctl_remove(card, control, false);
2335		}
2336
2337#ifdef CONFIG_SND_CTL_FAST_LOOKUP
2338		xa_destroy(&card->ctl_numids);
2339		xa_destroy(&card->ctl_hash);
2340#endif
2341	}
2342	put_device(card->ctl_dev);
2343	return 0;
2344}
2345
2346/*
2347 * create control core:
2348 * called from init.c
2349 */
2350int snd_ctl_create(struct snd_card *card)
2351{
2352	static const struct snd_device_ops ops = {
2353		.dev_free = snd_ctl_dev_free,
2354		.dev_register =	snd_ctl_dev_register,
2355		.dev_disconnect = snd_ctl_dev_disconnect,
2356	};
2357	int err;
2358
2359	if (snd_BUG_ON(!card))
2360		return -ENXIO;
2361	if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
2362		return -ENXIO;
2363
2364	err = snd_device_alloc(&card->ctl_dev, card);
2365	if (err < 0)
2366		return err;
2367	dev_set_name(card->ctl_dev, "controlC%d", card->number);
2368
2369	err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
2370	if (err < 0)
2371		put_device(card->ctl_dev);
2372	return err;
2373}
2374
2375/*
2376 * Frequently used control callbacks/helpers
2377 */
2378
2379/**
2380 * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
2381 * callback with a mono channel
2382 * @kcontrol: the kcontrol instance
2383 * @uinfo: info to store
2384 *
2385 * This is a function that can be used as info callback for a standard
2386 * boolean control with a single mono channel.
2387 *
2388 * Return: Zero (always successful)
2389 */
2390int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
2391			      struct snd_ctl_elem_info *uinfo)
2392{
2393	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2394	uinfo->count = 1;
2395	uinfo->value.integer.min = 0;
2396	uinfo->value.integer.max = 1;
2397	return 0;
2398}
 
2399EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
2400
2401/**
2402 * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
2403 * callback with stereo two channels
2404 * @kcontrol: the kcontrol instance
2405 * @uinfo: info to store
2406 *
2407 * This is a function that can be used as info callback for a standard
2408 * boolean control with stereo two channels.
2409 *
2410 * Return: Zero (always successful)
2411 */
2412int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
2413				struct snd_ctl_elem_info *uinfo)
2414{
2415	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2416	uinfo->count = 2;
2417	uinfo->value.integer.min = 0;
2418	uinfo->value.integer.max = 1;
2419	return 0;
2420}
 
2421EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
2422
2423/**
2424 * snd_ctl_enum_info - fills the info structure for an enumerated control
2425 * @info: the structure to be filled
2426 * @channels: the number of the control's channels; often one
2427 * @items: the number of control values; also the size of @names
2428 * @names: an array containing the names of all control values
2429 *
2430 * Sets all required fields in @info to their appropriate values.
2431 * If the control's accessibility is not the default (readable and writable),
2432 * the caller has to fill @info->access.
2433 *
2434 * Return: Zero (always successful)
2435 */
2436int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
2437		      unsigned int items, const char *const names[])
2438{
2439	info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
2440	info->count = channels;
2441	info->value.enumerated.items = items;
2442	if (!items)
2443		return 0;
2444	if (info->value.enumerated.item >= items)
2445		info->value.enumerated.item = items - 1;
2446	WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
2447	     "ALSA: too long item name '%s'\n",
2448	     names[info->value.enumerated.item]);
2449	strscpy(info->value.enumerated.name,
2450		names[info->value.enumerated.item],
2451		sizeof(info->value.enumerated.name));
2452	return 0;
2453}
2454EXPORT_SYMBOL(snd_ctl_enum_info);