1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *  Routines for driver control interface
   4 *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
   5 */
   6
   7#include <linux/threads.h>
   8#include <linux/interrupt.h>
   9#include <linux/module.h>
  10#include <linux/moduleparam.h>
  11#include <linux/slab.h>
  12#include <linux/vmalloc.h>
  13#include <linux/time.h>
  14#include <linux/mm.h>
  15#include <linux/math64.h>
  16#include <linux/sched/signal.h>
  17#include <sound/core.h>
  18#include <sound/minors.h>
  19#include <sound/info.h>
  20#include <sound/control.h>
  21
  22// Max allocation size for user controls.
  23static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
  24module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
  25MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
  26
  27#define MAX_CONTROL_COUNT	1028
  28
  29struct snd_kctl_ioctl {
  30	struct list_head list;		/* list of all ioctls */
  31	snd_kctl_ioctl_func_t fioctl;
  32};
  33
  34static DECLARE_RWSEM(snd_ioctl_rwsem);
  35static DECLARE_RWSEM(snd_ctl_layer_rwsem);
  36static LIST_HEAD(snd_control_ioctls);
  37#ifdef CONFIG_COMPAT
  38static LIST_HEAD(snd_control_compat_ioctls);
  39#endif
  40static struct snd_ctl_layer_ops *snd_ctl_layer;
  41
  42static int snd_ctl_open(struct inode *inode, struct file *file)
  43{
  44	unsigned long flags;
  45	struct snd_card *card;
  46	struct snd_ctl_file *ctl;
  47	int i, err;
  48
  49	err = stream_open(inode, file);
  50	if (err < 0)
  51		return err;
  52
  53	card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
  54	if (!card) {
  55		err = -ENODEV;
  56		goto __error1;
  57	}
  58	err = snd_card_file_add(card, file);
  59	if (err < 0) {
  60		err = -ENODEV;
  61		goto __error1;
  62	}
  63	if (!try_module_get(card->module)) {
  64		err = -EFAULT;
  65		goto __error2;
  66	}
  67	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
  68	if (ctl == NULL) {
  69		err = -ENOMEM;
  70		goto __error;
  71	}
  72	INIT_LIST_HEAD(&ctl->events);
  73	init_waitqueue_head(&ctl->change_sleep);
  74	spin_lock_init(&ctl->read_lock);
  75	ctl->card = card;
  76	for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
  77		ctl->preferred_subdevice[i] = -1;
  78	ctl->pid = get_pid(task_pid(current));
  79	file->private_data = ctl;
  80	write_lock_irqsave(&card->ctl_files_rwlock, flags);
  81	list_add_tail(&ctl->list, &card->ctl_files);
  82	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
  83	snd_card_unref(card);
  84	return 0;
  85
  86      __error:
  87	module_put(card->module);
  88      __error2:
  89	snd_card_file_remove(card, file);
  90      __error1:
  91	if (card)
  92		snd_card_unref(card);
  93      	return err;
  94}
  95
  96static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
  97{
  98	unsigned long flags;
  99	struct snd_kctl_event *cread;
 100
 101	spin_lock_irqsave(&ctl->read_lock, flags);
 102	while (!list_empty(&ctl->events)) {
 103		cread = snd_kctl_event(ctl->events.next);
 104		list_del(&cread->list);
 105		kfree(cread);
 106	}
 107	spin_unlock_irqrestore(&ctl->read_lock, flags);
 108}
 109
 110static int snd_ctl_release(struct inode *inode, struct file *file)
 111{
 112	unsigned long flags;
 113	struct snd_card *card;
 114	struct snd_ctl_file *ctl;
 115	struct snd_kcontrol *control;
 116	unsigned int idx;
 117
 118	ctl = file->private_data;
 119	file->private_data = NULL;
 120	card = ctl->card;
 121	write_lock_irqsave(&card->ctl_files_rwlock, flags);
 122	list_del(&ctl->list);
 123	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
 124	down_write(&card->controls_rwsem);
 125	list_for_each_entry(control, &card->controls, list)
 126		for (idx = 0; idx < control->count; idx++)
 127			if (control->vd[idx].owner == ctl)
 128				control->vd[idx].owner = NULL;
 129	up_write(&card->controls_rwsem);
 130	snd_fasync_free(ctl->fasync);
 131	snd_ctl_empty_read_queue(ctl);
 132	put_pid(ctl->pid);
 133	kfree(ctl);
 134	module_put(card->module);
 135	snd_card_file_remove(card, file);
 136	return 0;
 137}
 138
 139/**
 140 * snd_ctl_notify - Send notification to user-space for a control change
 141 * @card: the card to send notification
 142 * @mask: the event mask, SNDRV_CTL_EVENT_*
 143 * @id: the ctl element id to send notification
 144 *
 145 * This function adds an event record with the given id and mask, appends
 146 * to the list and wakes up the user-space for notification.  This can be
 147 * called in the atomic context.
 148 */
 149void snd_ctl_notify(struct snd_card *card, unsigned int mask,
 150		    struct snd_ctl_elem_id *id)
 151{
 152	unsigned long flags;
 153	struct snd_ctl_file *ctl;
 154	struct snd_kctl_event *ev;
 155
 156	if (snd_BUG_ON(!card || !id))
 157		return;
 158	if (card->shutdown)
 159		return;
 160	read_lock_irqsave(&card->ctl_files_rwlock, flags);
 161#if IS_ENABLED(CONFIG_SND_MIXER_OSS)
 162	card->mixer_oss_change_count++;
 163#endif
 164	list_for_each_entry(ctl, &card->ctl_files, list) {
 165		if (!ctl->subscribed)
 166			continue;
 167		spin_lock(&ctl->read_lock);
 168		list_for_each_entry(ev, &ctl->events, list) {
 169			if (ev->id.numid == id->numid) {
 170				ev->mask |= mask;
 171				goto _found;
 172			}
 173		}
 174		ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
 175		if (ev) {
 176			ev->id = *id;
 177			ev->mask = mask;
 178			list_add_tail(&ev->list, &ctl->events);
 179		} else {
 180			dev_err(card->dev, "No memory available to allocate event\n");
 181		}
 182	_found:
 183		wake_up(&ctl->change_sleep);
 184		spin_unlock(&ctl->read_lock);
 185		snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN);
 186	}
 187	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
 188}
 189EXPORT_SYMBOL(snd_ctl_notify);
 190
 191/**
 192 * snd_ctl_notify_one - Send notification to user-space for a control change
 193 * @card: the card to send notification
 194 * @mask: the event mask, SNDRV_CTL_EVENT_*
 195 * @kctl: the pointer with the control instance
 196 * @ioff: the additional offset to the control index
 197 *
 198 * This function calls snd_ctl_notify() and does additional jobs
 199 * like LED state changes.
 200 */
 201void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
 202			struct snd_kcontrol *kctl, unsigned int ioff)
 203{
 204	struct snd_ctl_elem_id id = kctl->id;
 205	struct snd_ctl_layer_ops *lops;
 206
 207	id.index += ioff;
 208	id.numid += ioff;
 209	snd_ctl_notify(card, mask, &id);
 210	down_read(&snd_ctl_layer_rwsem);
 211	for (lops = snd_ctl_layer; lops; lops = lops->next)
 212		lops->lnotify(card, mask, kctl, ioff);
 213	up_read(&snd_ctl_layer_rwsem);
 214}
 215EXPORT_SYMBOL(snd_ctl_notify_one);
 216
 217/**
 218 * snd_ctl_new - create a new control instance with some elements
 219 * @kctl: the pointer to store new control instance
 220 * @count: the number of elements in this control
 221 * @access: the default access flags for elements in this control
 222 * @file: given when locking these elements
 223 *
 224 * Allocates a memory object for a new control instance. The instance has
 225 * elements as many as the given number (@count). Each element has given
 226 * access permissions (@access). Each element is locked when @file is given.
 227 *
 228 * Return: 0 on success, error code on failure
 229 */
 230static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
 231		       unsigned int access, struct snd_ctl_file *file)
 232{
 233	unsigned int idx;
 234
 235	if (count == 0 || count > MAX_CONTROL_COUNT)
 236		return -EINVAL;
 237
 238	*kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
 239	if (!*kctl)
 240		return -ENOMEM;
 241
 242	for (idx = 0; idx < count; idx++) {
 243		(*kctl)->vd[idx].access = access;
 244		(*kctl)->vd[idx].owner = file;
 245	}
 246	(*kctl)->count = count;
 247
 248	return 0;
 249}
 250
 251/**
 252 * snd_ctl_new1 - create a control instance from the template
 253 * @ncontrol: the initialization record
 254 * @private_data: the private data to set
 255 *
 256 * Allocates a new struct snd_kcontrol instance and initialize from the given
 257 * template.  When the access field of ncontrol is 0, it's assumed as
 258 * READWRITE access. When the count field is 0, it's assumes as one.
 259 *
 260 * Return: The pointer of the newly generated instance, or %NULL on failure.
 261 */
 262struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
 263				  void *private_data)
 264{
 265	struct snd_kcontrol *kctl;
 266	unsigned int count;
 267	unsigned int access;
 268	int err;
 269
 270	if (snd_BUG_ON(!ncontrol || !ncontrol->info))
 271		return NULL;
 272
 273	count = ncontrol->count;
 274	if (count == 0)
 275		count = 1;
 276
 277	access = ncontrol->access;
 278	if (access == 0)
 279		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
 280	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
 281		   SNDRV_CTL_ELEM_ACCESS_VOLATILE |
 282		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
 283		   SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
 284		   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
 285		   SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
 286		   SNDRV_CTL_ELEM_ACCESS_LED_MASK |
 287		   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
 288
 289	err = snd_ctl_new(&kctl, count, access, NULL);
 290	if (err < 0)
 291		return NULL;
 292
 293	/* The 'numid' member is decided when calling snd_ctl_add(). */
 294	kctl->id.iface = ncontrol->iface;
 295	kctl->id.device = ncontrol->device;
 296	kctl->id.subdevice = ncontrol->subdevice;
 297	if (ncontrol->name) {
 298		strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
 299		if (strcmp(ncontrol->name, kctl->id.name) != 0)
 300			pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
 301				ncontrol->name, kctl->id.name);
 302	}
 303	kctl->id.index = ncontrol->index;
 304
 305	kctl->info = ncontrol->info;
 306	kctl->get = ncontrol->get;
 307	kctl->put = ncontrol->put;
 308	kctl->tlv.p = ncontrol->tlv.p;
 309
 310	kctl->private_value = ncontrol->private_value;
 311	kctl->private_data = private_data;
 312
 313	return kctl;
 314}
 315EXPORT_SYMBOL(snd_ctl_new1);
 316
 317/**
 318 * snd_ctl_free_one - release the control instance
 319 * @kcontrol: the control instance
 320 *
 321 * Releases the control instance created via snd_ctl_new()
 322 * or snd_ctl_new1().
 323 * Don't call this after the control was added to the card.
 324 */
 325void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
 326{
 327	if (kcontrol) {
 328		if (kcontrol->private_free)
 329			kcontrol->private_free(kcontrol);
 330		kfree(kcontrol);
 331	}
 332}
 333EXPORT_SYMBOL(snd_ctl_free_one);
 334
 335static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
 336					  unsigned int count)
 337{
 338	struct snd_kcontrol *kctl;
 339
 340	/* Make sure that the ids assigned to the control do not wrap around */
 341	if (card->last_numid >= UINT_MAX - count)
 342		card->last_numid = 0;
 343
 344	list_for_each_entry(kctl, &card->controls, list) {
 345		if (kctl->id.numid < card->last_numid + 1 + count &&
 346		    kctl->id.numid + kctl->count > card->last_numid + 1) {
 347		    	card->last_numid = kctl->id.numid + kctl->count - 1;
 348			return true;
 349		}
 350	}
 351	return false;
 352}
 353
 354static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
 355{
 356	unsigned int iter = 100000;
 357
 358	while (snd_ctl_remove_numid_conflict(card, count)) {
 359		if (--iter == 0) {
 360			/* this situation is very unlikely */
 361			dev_err(card->dev, "unable to allocate new control numid\n");
 362			return -ENOMEM;
 363		}
 364	}
 365	return 0;
 366}
 367
 368/* check whether the given id is contained in the given kctl */
 369static bool elem_id_matches(const struct snd_kcontrol *kctl,
 370			    const struct snd_ctl_elem_id *id)
 371{
 372	return kctl->id.iface == id->iface &&
 373		kctl->id.device == id->device &&
 374		kctl->id.subdevice == id->subdevice &&
 375		!strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)) &&
 376		kctl->id.index <= id->index &&
 377		kctl->id.index + kctl->count > id->index;
 378}
 379
 380#ifdef CONFIG_SND_CTL_FAST_LOOKUP
 381/* Compute a hash key for the corresponding ctl id
 382 * It's for the name lookup, hence the numid is excluded.
 383 * The hash key is bound in LONG_MAX to be used for Xarray key.
 384 */
 385#define MULTIPLIER	37
 386static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id)
 387{
 388	int i;
 389	unsigned long h;
 390
 391	h = id->iface;
 392	h = MULTIPLIER * h + id->device;
 393	h = MULTIPLIER * h + id->subdevice;
 394	for (i = 0; i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN && id->name[i]; i++)
 395		h = MULTIPLIER * h + id->name[i];
 396	h = MULTIPLIER * h + id->index;
 397	h &= LONG_MAX;
 398	return h;
 399}
 400
 401/* add hash entries to numid and ctl xarray tables */
 402static void add_hash_entries(struct snd_card *card,
 403			     struct snd_kcontrol *kcontrol)
 404{
 405	struct snd_ctl_elem_id id = kcontrol->id;
 406	int i;
 407
 408	xa_store_range(&card->ctl_numids, kcontrol->id.numid,
 409		       kcontrol->id.numid + kcontrol->count - 1,
 410		       kcontrol, GFP_KERNEL);
 411
 412	for (i = 0; i < kcontrol->count; i++) {
 413		id.index = kcontrol->id.index + i;
 414		if (xa_insert(&card->ctl_hash, get_ctl_id_hash(&id),
 415			      kcontrol, GFP_KERNEL)) {
 416			/* skip hash for this entry, noting we had collision */
 417			card->ctl_hash_collision = true;
 418			dev_dbg(card->dev, "ctl_hash collision %d:%s:%d\n",
 419				id.iface, id.name, id.index);
 420		}
 421	}
 422}
 423
 424/* remove hash entries that have been added */
 425static void remove_hash_entries(struct snd_card *card,
 426				struct snd_kcontrol *kcontrol)
 427{
 428	struct snd_ctl_elem_id id = kcontrol->id;
 429	struct snd_kcontrol *matched;
 430	unsigned long h;
 431	int i;
 432
 433	for (i = 0; i < kcontrol->count; i++) {
 434		xa_erase(&card->ctl_numids, id.numid);
 435		h = get_ctl_id_hash(&id);
 436		matched = xa_load(&card->ctl_hash, h);
 437		if (matched && (matched == kcontrol ||
 438				elem_id_matches(matched, &id)))
 439			xa_erase(&card->ctl_hash, h);
 440		id.index++;
 441		id.numid++;
 442	}
 443}
 444#else /* CONFIG_SND_CTL_FAST_LOOKUP */
 445static inline void add_hash_entries(struct snd_card *card,
 446				    struct snd_kcontrol *kcontrol)
 447{
 448}
 449static inline void remove_hash_entries(struct snd_card *card,
 450				       struct snd_kcontrol *kcontrol)
 451{
 452}
 453#endif /* CONFIG_SND_CTL_FAST_LOOKUP */
 454
 455enum snd_ctl_add_mode {
 456	CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
 457};
 458
 459/* add/replace a new kcontrol object; call with card->controls_rwsem locked */
 460static int __snd_ctl_add_replace(struct snd_card *card,
 461				 struct snd_kcontrol *kcontrol,
 462				 enum snd_ctl_add_mode mode)
 463{
 464	struct snd_ctl_elem_id id;
 465	unsigned int idx;
 466	struct snd_kcontrol *old;
 467	int err;
 468
 469	id = kcontrol->id;
 470	if (id.index > UINT_MAX - kcontrol->count)
 471		return -EINVAL;
 472
 473	old = snd_ctl_find_id(card, &id);
 474	if (!old) {
 475		if (mode == CTL_REPLACE)
 476			return -EINVAL;
 477	} else {
 478		if (mode == CTL_ADD_EXCLUSIVE) {
 479			dev_err(card->dev,
 480				"control %i:%i:%i:%s:%i is already present\n",
 481				id.iface, id.device, id.subdevice, id.name,
 482				id.index);
 483			return -EBUSY;
 484		}
 485
 486		err = snd_ctl_remove(card, old);
 487		if (err < 0)
 488			return err;
 489	}
 490
 491	if (snd_ctl_find_hole(card, kcontrol->count) < 0)
 492		return -ENOMEM;
 493
 494	list_add_tail(&kcontrol->list, &card->controls);
 495	card->controls_count += kcontrol->count;
 496	kcontrol->id.numid = card->last_numid + 1;
 497	card->last_numid += kcontrol->count;
 498
 499	add_hash_entries(card, kcontrol);
 500
 501	for (idx = 0; idx < kcontrol->count; idx++)
 502		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
 503
 504	return 0;
 505}
 506
 507static int snd_ctl_add_replace(struct snd_card *card,
 508			       struct snd_kcontrol *kcontrol,
 509			       enum snd_ctl_add_mode mode)
 510{
 511	int err = -EINVAL;
 512
 513	if (! kcontrol)
 514		return err;
 515	if (snd_BUG_ON(!card || !kcontrol->info))
 516		goto error;
 517
 518	down_write(&card->controls_rwsem);
 519	err = __snd_ctl_add_replace(card, kcontrol, mode);
 520	up_write(&card->controls_rwsem);
 521	if (err < 0)
 522		goto error;
 523	return 0;
 524
 525 error:
 526	snd_ctl_free_one(kcontrol);
 527	return err;
 528}
 529
 530/**
 531 * snd_ctl_add - add the control instance to the card
 532 * @card: the card instance
 533 * @kcontrol: the control instance to add
 534 *
 535 * Adds the control instance created via snd_ctl_new() or
 536 * snd_ctl_new1() to the given card. Assigns also an unique
 537 * numid used for fast search.
 538 *
 539 * It frees automatically the control which cannot be added.
 540 *
 541 * Return: Zero if successful, or a negative error code on failure.
 542 *
 543 */
 544int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
 545{
 546	return snd_ctl_add_replace(card, kcontrol, CTL_ADD_EXCLUSIVE);
 547}
 548EXPORT_SYMBOL(snd_ctl_add);
 549
 550/**
 551 * snd_ctl_replace - replace the control instance of the card
 552 * @card: the card instance
 553 * @kcontrol: the control instance to replace
 554 * @add_on_replace: add the control if not already added
 555 *
 556 * Replaces the given control.  If the given control does not exist
 557 * and the add_on_replace flag is set, the control is added.  If the
 558 * control exists, it is destroyed first.
 559 *
 560 * It frees automatically the control which cannot be added or replaced.
 561 *
 562 * Return: Zero if successful, or a negative error code on failure.
 563 */
 564int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
 565		    bool add_on_replace)
 566{
 567	return snd_ctl_add_replace(card, kcontrol,
 568				   add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
 569}
 570EXPORT_SYMBOL(snd_ctl_replace);
 571
 572static int __snd_ctl_remove(struct snd_card *card,
 573			    struct snd_kcontrol *kcontrol,
 574			    bool remove_hash)
 575{
 576	unsigned int idx;
 577
 578	if (snd_BUG_ON(!card || !kcontrol))
 579		return -EINVAL;
 580	list_del(&kcontrol->list);
 581
 582	if (remove_hash)
 583		remove_hash_entries(card, kcontrol);
 584
 585	card->controls_count -= kcontrol->count;
 586	for (idx = 0; idx < kcontrol->count; idx++)
 587		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
 588	snd_ctl_free_one(kcontrol);
 589	return 0;
 590}
 591
 592/**
 593 * snd_ctl_remove - remove the control from the card and release it
 594 * @card: the card instance
 595 * @kcontrol: the control instance to remove
 596 *
 597 * Removes the control from the card and then releases the instance.
 598 * You don't need to call snd_ctl_free_one(). You must be in
 599 * the write lock - down_write(&card->controls_rwsem).
 600 *
 601 * Return: 0 if successful, or a negative error code on failure.
 602 */
 603int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
 604{
 605	return __snd_ctl_remove(card, kcontrol, true);
 
 
 
 
 
 
 
 
 
 606}
 607EXPORT_SYMBOL(snd_ctl_remove);
 608
 609/**
 610 * snd_ctl_remove_id - remove the control of the given id and release it
 611 * @card: the card instance
 612 * @id: the control id to remove
 613 *
 614 * Finds the control instance with the given id, removes it from the
 615 * card list and releases it.
 616 *
 617 * Return: 0 if successful, or a negative error code on failure.
 618 */
 619int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
 620{
 621	struct snd_kcontrol *kctl;
 622	int ret;
 623
 624	down_write(&card->controls_rwsem);
 625	kctl = snd_ctl_find_id(card, id);
 626	if (kctl == NULL) {
 627		up_write(&card->controls_rwsem);
 628		return -ENOENT;
 629	}
 630	ret = snd_ctl_remove(card, kctl);
 631	up_write(&card->controls_rwsem);
 632	return ret;
 633}
 634EXPORT_SYMBOL(snd_ctl_remove_id);
 635
 636/**
 637 * snd_ctl_remove_user_ctl - remove and release the unlocked user control
 638 * @file: active control handle
 639 * @id: the control id to remove
 640 *
 641 * Finds the control instance with the given id, removes it from the
 642 * card list and releases it.
 643 *
 644 * Return: 0 if successful, or a negative error code on failure.
 645 */
 646static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
 647				   struct snd_ctl_elem_id *id)
 648{
 649	struct snd_card *card = file->card;
 650	struct snd_kcontrol *kctl;
 651	int idx, ret;
 652
 653	down_write(&card->controls_rwsem);
 654	kctl = snd_ctl_find_id(card, id);
 655	if (kctl == NULL) {
 656		ret = -ENOENT;
 657		goto error;
 658	}
 659	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
 660		ret = -EINVAL;
 661		goto error;
 662	}
 663	for (idx = 0; idx < kctl->count; idx++)
 664		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
 665			ret = -EBUSY;
 666			goto error;
 667		}
 668	ret = snd_ctl_remove(card, kctl);
 669error:
 670	up_write(&card->controls_rwsem);
 671	return ret;
 672}
 673
 674/**
 675 * snd_ctl_activate_id - activate/inactivate the control of the given id
 676 * @card: the card instance
 677 * @id: the control id to activate/inactivate
 678 * @active: non-zero to activate
 679 *
 680 * Finds the control instance with the given id, and activate or
 681 * inactivate the control together with notification, if changed.
 682 * The given ID data is filled with full information.
 683 *
 684 * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
 685 */
 686int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
 687			int active)
 688{
 689	struct snd_kcontrol *kctl;
 690	struct snd_kcontrol_volatile *vd;
 691	unsigned int index_offset;
 692	int ret;
 693
 694	down_write(&card->controls_rwsem);
 695	kctl = snd_ctl_find_id(card, id);
 696	if (kctl == NULL) {
 697		ret = -ENOENT;
 698		goto unlock;
 699	}
 700	index_offset = snd_ctl_get_ioff(kctl, id);
 701	vd = &kctl->vd[index_offset];
 702	ret = 0;
 703	if (active) {
 704		if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
 705			goto unlock;
 706		vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
 707	} else {
 708		if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
 709			goto unlock;
 710		vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
 711	}
 712	snd_ctl_build_ioff(id, kctl, index_offset);
 713	downgrade_write(&card->controls_rwsem);
 714	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
 715	up_read(&card->controls_rwsem);
 716	return 1;
 717
 718 unlock:
 719	up_write(&card->controls_rwsem);
 720	return ret;
 721}
 722EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
 723
 724/**
 725 * snd_ctl_rename_id - replace the id of a control on the card
 726 * @card: the card instance
 727 * @src_id: the old id
 728 * @dst_id: the new id
 729 *
 730 * Finds the control with the old id from the card, and replaces the
 731 * id with the new one.
 732 *
 733 * Return: Zero if successful, or a negative error code on failure.
 734 */
 735int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
 736		      struct snd_ctl_elem_id *dst_id)
 737{
 738	struct snd_kcontrol *kctl;
 739
 740	down_write(&card->controls_rwsem);
 741	kctl = snd_ctl_find_id(card, src_id);
 742	if (kctl == NULL) {
 743		up_write(&card->controls_rwsem);
 744		return -ENOENT;
 745	}
 746	remove_hash_entries(card, kctl);
 747	kctl->id = *dst_id;
 748	kctl->id.numid = card->last_numid + 1;
 749	card->last_numid += kctl->count;
 750	add_hash_entries(card, kctl);
 751	up_write(&card->controls_rwsem);
 752	return 0;
 753}
 754EXPORT_SYMBOL(snd_ctl_rename_id);
 755
 756/**
 757 * snd_ctl_rename - rename the control on the card
 758 * @card: the card instance
 759 * @kctl: the control to rename
 760 * @name: the new name
 761 *
 762 * Renames the specified control on the card to the new name.
 763 *
 764 * Make sure to take the control write lock - down_write(&card->controls_rwsem).
 765 */
 766void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
 767		    const char *name)
 768{
 769	remove_hash_entries(card, kctl);
 770
 771	if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
 772		pr_warn("ALSA: Renamed control new name '%s' truncated to '%s'\n",
 773			name, kctl->id.name);
 774
 775	add_hash_entries(card, kctl);
 776}
 777EXPORT_SYMBOL(snd_ctl_rename);
 778
 779#ifndef CONFIG_SND_CTL_FAST_LOOKUP
 780static struct snd_kcontrol *
 781snd_ctl_find_numid_slow(struct snd_card *card, unsigned int numid)
 782{
 783	struct snd_kcontrol *kctl;
 784
 785	list_for_each_entry(kctl, &card->controls, list) {
 786		if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
 787			return kctl;
 788	}
 789	return NULL;
 790}
 791#endif /* !CONFIG_SND_CTL_FAST_LOOKUP */
 792
 793/**
 794 * snd_ctl_find_numid - find the control instance with the given number-id
 795 * @card: the card instance
 796 * @numid: the number-id to search
 797 *
 798 * Finds the control instance with the given number-id from the card.
 799 *
 800 * The caller must down card->controls_rwsem before calling this function
 801 * (if the race condition can happen).
 802 *
 803 * Return: The pointer of the instance if found, or %NULL if not.
 804 *
 805 */
 806struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card, unsigned int numid)
 807{
 
 
 808	if (snd_BUG_ON(!card || !numid))
 809		return NULL;
 810#ifdef CONFIG_SND_CTL_FAST_LOOKUP
 811	return xa_load(&card->ctl_numids, numid);
 812#else
 813	return snd_ctl_find_numid_slow(card, numid);
 814#endif
 815}
 816EXPORT_SYMBOL(snd_ctl_find_numid);
 817
 818/**
 819 * snd_ctl_find_id - find the control instance with the given id
 820 * @card: the card instance
 821 * @id: the id to search
 822 *
 823 * Finds the control instance with the given id from the card.
 824 *
 825 * The caller must down card->controls_rwsem before calling this function
 826 * (if the race condition can happen).
 827 *
 828 * Return: The pointer of the instance if found, or %NULL if not.
 829 *
 830 */
 831struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
 832				     struct snd_ctl_elem_id *id)
 833{
 834	struct snd_kcontrol *kctl;
 835
 836	if (snd_BUG_ON(!card || !id))
 837		return NULL;
 838	if (id->numid != 0)
 839		return snd_ctl_find_numid(card, id->numid);
 840#ifdef CONFIG_SND_CTL_FAST_LOOKUP
 841	kctl = xa_load(&card->ctl_hash, get_ctl_id_hash(id));
 842	if (kctl && elem_id_matches(kctl, id))
 
 
 
 
 
 
 
 
 
 
 843		return kctl;
 844	if (!card->ctl_hash_collision)
 845		return NULL; /* we can rely on only hash table */
 846#endif
 847	/* no matching in hash table - try all as the last resort */
 848	list_for_each_entry(kctl, &card->controls, list)
 849		if (elem_id_matches(kctl, id))
 850			return kctl;
 851
 852	return NULL;
 853}
 854EXPORT_SYMBOL(snd_ctl_find_id);
 855
 856static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
 857			     unsigned int cmd, void __user *arg)
 858{
 859	struct snd_ctl_card_info *info;
 860
 861	info = kzalloc(sizeof(*info), GFP_KERNEL);
 862	if (! info)
 863		return -ENOMEM;
 864	down_read(&snd_ioctl_rwsem);
 865	info->card = card->number;
 866	strscpy(info->id, card->id, sizeof(info->id));
 867	strscpy(info->driver, card->driver, sizeof(info->driver));
 868	strscpy(info->name, card->shortname, sizeof(info->name));
 869	strscpy(info->longname, card->longname, sizeof(info->longname));
 870	strscpy(info->mixername, card->mixername, sizeof(info->mixername));
 871	strscpy(info->components, card->components, sizeof(info->components));
 872	up_read(&snd_ioctl_rwsem);
 873	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
 874		kfree(info);
 875		return -EFAULT;
 876	}
 877	kfree(info);
 878	return 0;
 879}
 880
 881static int snd_ctl_elem_list(struct snd_card *card,
 882			     struct snd_ctl_elem_list *list)
 883{
 884	struct snd_kcontrol *kctl;
 885	struct snd_ctl_elem_id id;
 886	unsigned int offset, space, jidx;
 887	int err = 0;
 888
 889	offset = list->offset;
 890	space = list->space;
 891
 892	down_read(&card->controls_rwsem);
 893	list->count = card->controls_count;
 894	list->used = 0;
 895	if (space > 0) {
 896		list_for_each_entry(kctl, &card->controls, list) {
 897			if (offset >= kctl->count) {
 898				offset -= kctl->count;
 899				continue;
 900			}
 901			for (jidx = offset; jidx < kctl->count; jidx++) {
 902				snd_ctl_build_ioff(&id, kctl, jidx);
 903				if (copy_to_user(list->pids + list->used, &id,
 904						 sizeof(id))) {
 905					err = -EFAULT;
 906					goto out;
 907				}
 908				list->used++;
 909				if (!--space)
 910					goto out;
 911			}
 912			offset = 0;
 913		}
 914	}
 915 out:
 916	up_read(&card->controls_rwsem);
 917	return err;
 918}
 919
 920static int snd_ctl_elem_list_user(struct snd_card *card,
 921				  struct snd_ctl_elem_list __user *_list)
 922{
 923	struct snd_ctl_elem_list list;
 924	int err;
 925
 926	if (copy_from_user(&list, _list, sizeof(list)))
 927		return -EFAULT;
 928	err = snd_ctl_elem_list(card, &list);
 929	if (err)
 930		return err;
 931	if (copy_to_user(_list, &list, sizeof(list)))
 932		return -EFAULT;
 933
 934	return 0;
 935}
 936
 937/* Check whether the given kctl info is valid */
 938static int snd_ctl_check_elem_info(struct snd_card *card,
 939				   const struct snd_ctl_elem_info *info)
 940{
 941	static const unsigned int max_value_counts[] = {
 942		[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= 128,
 943		[SNDRV_CTL_ELEM_TYPE_INTEGER]	= 128,
 944		[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
 945		[SNDRV_CTL_ELEM_TYPE_BYTES]	= 512,
 946		[SNDRV_CTL_ELEM_TYPE_IEC958]	= 1,
 947		[SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
 948	};
 949
 950	if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
 951	    info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
 952		if (card)
 953			dev_err(card->dev,
 954				"control %i:%i:%i:%s:%i: invalid type %d\n",
 955				info->id.iface, info->id.device,
 956				info->id.subdevice, info->id.name,
 957				info->id.index, info->type);
 958		return -EINVAL;
 959	}
 960	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
 961	    info->value.enumerated.items == 0) {
 962		if (card)
 963			dev_err(card->dev,
 964				"control %i:%i:%i:%s:%i: zero enum items\n",
 965				info->id.iface, info->id.device,
 966				info->id.subdevice, info->id.name,
 967				info->id.index);
 968		return -EINVAL;
 969	}
 970	if (info->count > max_value_counts[info->type]) {
 971		if (card)
 972			dev_err(card->dev,
 973				"control %i:%i:%i:%s:%i: invalid count %d\n",
 974				info->id.iface, info->id.device,
 975				info->id.subdevice, info->id.name,
 976				info->id.index, info->count);
 977		return -EINVAL;
 978	}
 979
 980	return 0;
 981}
 982
 983/* The capacity of struct snd_ctl_elem_value.value.*/
 984static const unsigned int value_sizes[] = {
 985	[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= sizeof(long),
 986	[SNDRV_CTL_ELEM_TYPE_INTEGER]	= sizeof(long),
 987	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
 988	[SNDRV_CTL_ELEM_TYPE_BYTES]	= sizeof(unsigned char),
 989	[SNDRV_CTL_ELEM_TYPE_IEC958]	= sizeof(struct snd_aes_iec958),
 990	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
 991};
 992
 
 993/* fill the remaining snd_ctl_elem_value data with the given pattern */
 994static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
 995				      struct snd_ctl_elem_info *info,
 996				      u32 pattern)
 997{
 998	size_t offset = value_sizes[info->type] * info->count;
 999
1000	offset = DIV_ROUND_UP(offset, sizeof(u32));
1001	memset32((u32 *)control->value.bytes.data + offset, pattern,
1002		 sizeof(control->value) / sizeof(u32) - offset);
1003}
1004
1005/* check whether the given integer ctl value is valid */
1006static int sanity_check_int_value(struct snd_card *card,
1007				  const struct snd_ctl_elem_value *control,
1008				  const struct snd_ctl_elem_info *info,
1009				  int i, bool print_error)
1010{
1011	long long lval, lmin, lmax, lstep;
1012	u64 rem;
1013
1014	switch (info->type) {
1015	default:
1016	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1017		lval = control->value.integer.value[i];
1018		lmin = 0;
1019		lmax = 1;
1020		lstep = 0;
1021		break;
1022	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1023		lval = control->value.integer.value[i];
1024		lmin = info->value.integer.min;
1025		lmax = info->value.integer.max;
1026		lstep = info->value.integer.step;
1027		break;
1028	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1029		lval = control->value.integer64.value[i];
1030		lmin = info->value.integer64.min;
1031		lmax = info->value.integer64.max;
1032		lstep = info->value.integer64.step;
1033		break;
1034	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1035		lval = control->value.enumerated.item[i];
1036		lmin = 0;
1037		lmax = info->value.enumerated.items - 1;
1038		lstep = 0;
1039		break;
1040	}
1041
1042	if (lval < lmin || lval > lmax) {
1043		if (print_error)
1044			dev_err(card->dev,
1045				"control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
1046				control->id.iface, control->id.device,
1047				control->id.subdevice, control->id.name,
1048				control->id.index, lval, lmin, lmax, i);
1049		return -EINVAL;
1050	}
1051	if (lstep) {
1052		div64_u64_rem(lval, lstep, &rem);
1053		if (rem) {
1054			if (print_error)
1055				dev_err(card->dev,
1056					"control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
1057					control->id.iface, control->id.device,
1058					control->id.subdevice, control->id.name,
1059					control->id.index, lval, lstep, i);
1060			return -EINVAL;
1061		}
1062	}
1063
1064	return 0;
1065}
1066
1067/* check whether the all input values are valid for the given elem value */
1068static int sanity_check_input_values(struct snd_card *card,
1069				     const struct snd_ctl_elem_value *control,
1070				     const struct snd_ctl_elem_info *info,
1071				     bool print_error)
1072{
1073	int i, ret;
 
 
1074
1075	switch (info->type) {
1076	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1077	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1078	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1079	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1080		for (i = 0; i < info->count; i++) {
1081			ret = sanity_check_int_value(card, control, info, i,
1082						     print_error);
1083			if (ret < 0)
1084				return ret;
1085		}
1086		break;
1087	default:
1088		break;
1089	}
1090
1091	return 0;
1092}
1093
1094/* perform sanity checks to the given snd_ctl_elem_value object */
1095static int sanity_check_elem_value(struct snd_card *card,
1096				   const struct snd_ctl_elem_value *control,
1097				   const struct snd_ctl_elem_info *info,
1098				   u32 pattern)
1099{
1100	size_t offset;
1101	int ret;
1102	u32 *p;
1103
1104	ret = sanity_check_input_values(card, control, info, true);
1105	if (ret < 0)
1106		return ret;
1107
1108	/* check whether the remaining area kept untouched */
1109	offset = value_sizes[info->type] * info->count;
1110	offset = DIV_ROUND_UP(offset, sizeof(u32));
1111	p = (u32 *)control->value.bytes.data + offset;
1112	for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
1113		if (*p != pattern) {
1114			ret = -EINVAL;
1115			break;
1116		}
1117		*p = 0; /* clear the checked area */
1118	}
1119
1120	return ret;
1121}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1122
1123static int __snd_ctl_elem_info(struct snd_card *card,
1124			       struct snd_kcontrol *kctl,
1125			       struct snd_ctl_elem_info *info,
1126			       struct snd_ctl_file *ctl)
1127{
1128	struct snd_kcontrol_volatile *vd;
1129	unsigned int index_offset;
1130	int result;
1131
1132#ifdef CONFIG_SND_DEBUG
1133	info->access = 0;
1134#endif
1135	result = snd_power_ref_and_wait(card);
1136	if (!result)
1137		result = kctl->info(kctl, info);
1138	snd_power_unref(card);
1139	if (result >= 0) {
1140		snd_BUG_ON(info->access);
1141		index_offset = snd_ctl_get_ioff(kctl, &info->id);
1142		vd = &kctl->vd[index_offset];
1143		snd_ctl_build_ioff(&info->id, kctl, index_offset);
1144		info->access = vd->access;
1145		if (vd->owner) {
1146			info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
1147			if (vd->owner == ctl)
1148				info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
1149			info->owner = pid_vnr(vd->owner->pid);
1150		} else {
1151			info->owner = -1;
1152		}
1153		if (!snd_ctl_skip_validation(info) &&
1154		    snd_ctl_check_elem_info(card, info) < 0)
1155			result = -EINVAL;
1156	}
1157	return result;
1158}
1159
1160static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
1161			     struct snd_ctl_elem_info *info)
1162{
1163	struct snd_card *card = ctl->card;
1164	struct snd_kcontrol *kctl;
1165	int result;
1166
1167	down_read(&card->controls_rwsem);
1168	kctl = snd_ctl_find_id(card, &info->id);
1169	if (kctl == NULL)
1170		result = -ENOENT;
1171	else
1172		result = __snd_ctl_elem_info(card, kctl, info, ctl);
1173	up_read(&card->controls_rwsem);
1174	return result;
1175}
1176
1177static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
1178				  struct snd_ctl_elem_info __user *_info)
1179{
1180	struct snd_ctl_elem_info info;
1181	int result;
1182
1183	if (copy_from_user(&info, _info, sizeof(info)))
1184		return -EFAULT;
1185	result = snd_ctl_elem_info(ctl, &info);
1186	if (result < 0)
1187		return result;
1188	/* drop internal access flags */
1189	info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
1190			 SNDRV_CTL_ELEM_ACCESS_LED_MASK);
1191	if (copy_to_user(_info, &info, sizeof(info)))
1192		return -EFAULT;
1193	return result;
1194}
1195
1196static int snd_ctl_elem_read(struct snd_card *card,
1197			     struct snd_ctl_elem_value *control)
1198{
1199	struct snd_kcontrol *kctl;
1200	struct snd_kcontrol_volatile *vd;
1201	unsigned int index_offset;
1202	struct snd_ctl_elem_info info;
1203	const u32 pattern = 0xdeadbeef;
1204	int ret;
1205
1206	down_read(&card->controls_rwsem);
1207	kctl = snd_ctl_find_id(card, &control->id);
1208	if (kctl == NULL) {
1209		ret = -ENOENT;
1210		goto unlock;
1211	}
1212
1213	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1214	vd = &kctl->vd[index_offset];
1215	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) {
1216		ret = -EPERM;
1217		goto unlock;
1218	}
1219
1220	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1221
1222#ifdef CONFIG_SND_CTL_DEBUG
1223	/* info is needed only for validation */
1224	memset(&info, 0, sizeof(info));
1225	info.id = control->id;
1226	ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
1227	if (ret < 0)
1228		goto unlock;
1229#endif
1230
1231	if (!snd_ctl_skip_validation(&info))
1232		fill_remaining_elem_value(control, &info, pattern);
1233	ret = snd_power_ref_and_wait(card);
1234	if (!ret)
1235		ret = kctl->get(kctl, control);
1236	snd_power_unref(card);
1237	if (ret < 0)
1238		goto unlock;
1239	if (!snd_ctl_skip_validation(&info) &&
1240	    sanity_check_elem_value(card, control, &info, pattern) < 0) {
1241		dev_err(card->dev,
1242			"control %i:%i:%i:%s:%i: access overflow\n",
1243			control->id.iface, control->id.device,
1244			control->id.subdevice, control->id.name,
1245			control->id.index);
1246		ret = -EINVAL;
1247		goto unlock;
1248	}
1249unlock:
1250	up_read(&card->controls_rwsem);
1251	return ret;
1252}
1253
1254static int snd_ctl_elem_read_user(struct snd_card *card,
1255				  struct snd_ctl_elem_value __user *_control)
1256{
1257	struct snd_ctl_elem_value *control;
1258	int result;
1259
1260	control = memdup_user(_control, sizeof(*control));
1261	if (IS_ERR(control))
1262		return PTR_ERR(control);
1263
 
1264	result = snd_ctl_elem_read(card, control);
 
1265	if (result < 0)
1266		goto error;
1267
1268	if (copy_to_user(_control, control, sizeof(*control)))
1269		result = -EFAULT;
1270 error:
1271	kfree(control);
1272	return result;
1273}
1274
1275static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
1276			      struct snd_ctl_elem_value *control)
1277{
1278	struct snd_kcontrol *kctl;
1279	struct snd_kcontrol_volatile *vd;
1280	unsigned int index_offset;
1281	int result;
1282
1283	down_write(&card->controls_rwsem);
1284	kctl = snd_ctl_find_id(card, &control->id);
1285	if (kctl == NULL) {
1286		up_write(&card->controls_rwsem);
1287		return -ENOENT;
1288	}
1289
1290	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1291	vd = &kctl->vd[index_offset];
1292	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
1293	    (file && vd->owner && vd->owner != file)) {
1294		up_write(&card->controls_rwsem);
1295		return -EPERM;
1296	}
1297
1298	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1299	result = snd_power_ref_and_wait(card);
1300	/* validate input values */
1301	if (IS_ENABLED(CONFIG_SND_CTL_INPUT_VALIDATION) && !result) {
1302		struct snd_ctl_elem_info info;
1303
1304		memset(&info, 0, sizeof(info));
1305		info.id = control->id;
1306		result = __snd_ctl_elem_info(card, kctl, &info, NULL);
1307		if (!result)
1308			result = sanity_check_input_values(card, control, &info,
1309							   false);
1310	}
1311	if (!result)
1312		result = kctl->put(kctl, control);
1313	snd_power_unref(card);
1314	if (result < 0) {
1315		up_write(&card->controls_rwsem);
1316		return result;
1317	}
1318
1319	if (result > 0) {
1320		downgrade_write(&card->controls_rwsem);
1321		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
1322		up_read(&card->controls_rwsem);
1323	} else {
1324		up_write(&card->controls_rwsem);
1325	}
1326
1327	return 0;
1328}
1329
1330static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
1331				   struct snd_ctl_elem_value __user *_control)
1332{
1333	struct snd_ctl_elem_value *control;
1334	struct snd_card *card;
1335	int result;
1336
1337	control = memdup_user(_control, sizeof(*control));
1338	if (IS_ERR(control))
1339		return PTR_ERR(control);
1340
1341	card = file->card;
1342	result = snd_ctl_elem_write(card, file, control);
1343	if (result < 0)
1344		goto error;
1345
1346	if (copy_to_user(_control, control, sizeof(*control)))
1347		result = -EFAULT;
1348 error:
1349	kfree(control);
1350	return result;
1351}
1352
1353static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1354			     struct snd_ctl_elem_id __user *_id)
1355{
1356	struct snd_card *card = file->card;
1357	struct snd_ctl_elem_id id;
1358	struct snd_kcontrol *kctl;
1359	struct snd_kcontrol_volatile *vd;
1360	int result;
1361
1362	if (copy_from_user(&id, _id, sizeof(id)))
1363		return -EFAULT;
1364	down_write(&card->controls_rwsem);
1365	kctl = snd_ctl_find_id(card, &id);
1366	if (kctl == NULL) {
1367		result = -ENOENT;
1368	} else {
1369		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1370		if (vd->owner != NULL)
1371			result = -EBUSY;
1372		else {
1373			vd->owner = file;
1374			result = 0;
1375		}
1376	}
1377	up_write(&card->controls_rwsem);
1378	return result;
1379}
1380
1381static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1382			       struct snd_ctl_elem_id __user *_id)
1383{
1384	struct snd_card *card = file->card;
1385	struct snd_ctl_elem_id id;
1386	struct snd_kcontrol *kctl;
1387	struct snd_kcontrol_volatile *vd;
1388	int result;
1389
1390	if (copy_from_user(&id, _id, sizeof(id)))
1391		return -EFAULT;
1392	down_write(&card->controls_rwsem);
1393	kctl = snd_ctl_find_id(card, &id);
1394	if (kctl == NULL) {
1395		result = -ENOENT;
1396	} else {
1397		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1398		if (vd->owner == NULL)
1399			result = -EINVAL;
1400		else if (vd->owner != file)
1401			result = -EPERM;
1402		else {
1403			vd->owner = NULL;
1404			result = 0;
1405		}
1406	}
1407	up_write(&card->controls_rwsem);
1408	return result;
1409}
1410
1411struct user_element {
1412	struct snd_ctl_elem_info info;
1413	struct snd_card *card;
1414	char *elem_data;		/* element data */
1415	unsigned long elem_data_size;	/* size of element data in bytes */
1416	void *tlv_data;			/* TLV data */
1417	unsigned long tlv_data_size;	/* TLV data size */
1418	void *priv_data;		/* private data (like strings for enumerated type) */
1419};
1420
1421// check whether the addition (in bytes) of user ctl element may overflow the limit.
1422static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
1423{
1424	return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
1425}
1426
1427static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1428				  struct snd_ctl_elem_info *uinfo)
1429{
1430	struct user_element *ue = kcontrol->private_data;
1431	unsigned int offset;
1432
1433	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1434	*uinfo = ue->info;
1435	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1436
1437	return 0;
1438}
1439
1440static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1441				       struct snd_ctl_elem_info *uinfo)
1442{
1443	struct user_element *ue = kcontrol->private_data;
1444	const char *names;
1445	unsigned int item;
1446	unsigned int offset;
1447
1448	item = uinfo->value.enumerated.item;
1449
1450	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1451	*uinfo = ue->info;
1452	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1453
1454	item = min(item, uinfo->value.enumerated.items - 1);
1455	uinfo->value.enumerated.item = item;
1456
1457	names = ue->priv_data;
1458	for (; item > 0; --item)
1459		names += strlen(names) + 1;
1460	strcpy(uinfo->value.enumerated.name, names);
1461
1462	return 0;
1463}
1464
1465static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1466				 struct snd_ctl_elem_value *ucontrol)
1467{
1468	struct user_element *ue = kcontrol->private_data;
1469	unsigned int size = ue->elem_data_size;
1470	char *src = ue->elem_data +
1471			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1472
1473	memcpy(&ucontrol->value, src, size);
1474	return 0;
1475}
1476
1477static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1478				 struct snd_ctl_elem_value *ucontrol)
1479{
1480	int change;
1481	struct user_element *ue = kcontrol->private_data;
1482	unsigned int size = ue->elem_data_size;
1483	char *dst = ue->elem_data +
1484			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1485
1486	change = memcmp(&ucontrol->value, dst, size) != 0;
1487	if (change)
1488		memcpy(dst, &ucontrol->value, size);
1489	return change;
1490}
1491
1492/* called in controls_rwsem write lock */
1493static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1494			    unsigned int size)
1495{
1496	struct user_element *ue = kctl->private_data;
1497	unsigned int *container;
1498	unsigned int mask = 0;
1499	int i;
1500	int change;
1501
1502	if (size > 1024 * 128)	/* sane value */
1503		return -EINVAL;
1504
1505	// does the TLV size change cause overflow?
1506	if (check_user_elem_overflow(ue->card, (ssize_t)(size - ue->tlv_data_size)))
1507		return -ENOMEM;
1508
1509	container = vmemdup_user(buf, size);
1510	if (IS_ERR(container))
1511		return PTR_ERR(container);
1512
1513	change = ue->tlv_data_size != size;
1514	if (!change)
1515		change = memcmp(ue->tlv_data, container, size) != 0;
1516	if (!change) {
1517		kvfree(container);
1518		return 0;
1519	}
1520
1521	if (ue->tlv_data == NULL) {
1522		/* Now TLV data is available. */
1523		for (i = 0; i < kctl->count; ++i)
1524			kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
1525		mask = SNDRV_CTL_EVENT_MASK_INFO;
1526	} else {
1527		ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1528		ue->tlv_data_size = 0;
1529		kvfree(ue->tlv_data);
1530	}
1531
1532	ue->tlv_data = container;
1533	ue->tlv_data_size = size;
1534	// decremented at private_free.
1535	ue->card->user_ctl_alloc_size += size;
1536
1537	mask |= SNDRV_CTL_EVENT_MASK_TLV;
1538	for (i = 0; i < kctl->count; ++i)
1539		snd_ctl_notify_one(ue->card, mask, kctl, i);
1540
1541	return change;
1542}
1543
1544static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1545			 unsigned int size)
1546{
1547	struct user_element *ue = kctl->private_data;
1548
1549	if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
1550		return -ENXIO;
1551
1552	if (size < ue->tlv_data_size)
1553		return -ENOSPC;
1554
1555	if (copy_to_user(buf, ue->tlv_data, ue->tlv_data_size))
1556		return -EFAULT;
1557
1558	return 0;
1559}
1560
1561static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
1562				 unsigned int size, unsigned int __user *buf)
1563{
1564	if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
1565		return replace_user_tlv(kctl, buf, size);
1566	else
1567		return read_user_tlv(kctl, buf, size);
1568}
1569
1570/* called in controls_rwsem write lock */
1571static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1572{
1573	char *names, *p;
1574	size_t buf_len, name_len;
1575	unsigned int i;
1576	const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1577
1578	buf_len = ue->info.value.enumerated.names_length;
1579	if (buf_len > 64 * 1024)
1580		return -EINVAL;
1581
1582	if (check_user_elem_overflow(ue->card, buf_len))
1583		return -ENOMEM;
1584	names = vmemdup_user((const void __user *)user_ptrval, buf_len);
1585	if (IS_ERR(names))
1586		return PTR_ERR(names);
1587
1588	/* check that there are enough valid names */
1589	p = names;
1590	for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1591		name_len = strnlen(p, buf_len);
1592		if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1593			kvfree(names);
1594			return -EINVAL;
1595		}
1596		p += name_len + 1;
1597		buf_len -= name_len + 1;
1598	}
1599
1600	ue->priv_data = names;
1601	ue->info.value.enumerated.names_ptr = 0;
1602	// increment the allocation size; decremented again at private_free.
1603	ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
1604
1605	return 0;
1606}
1607
1608static size_t compute_user_elem_size(size_t size, unsigned int count)
1609{
1610	return sizeof(struct user_element) + size * count;
1611}
1612
1613static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1614{
1615	struct user_element *ue = kcontrol->private_data;
1616
1617	// decrement the allocation size.
1618	ue->card->user_ctl_alloc_size -= compute_user_elem_size(ue->elem_data_size, kcontrol->count);
1619	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1620	if (ue->priv_data)
1621		ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
1622
1623	kvfree(ue->tlv_data);
1624	kvfree(ue->priv_data);
1625	kfree(ue);
1626}
1627
1628static int snd_ctl_elem_add(struct snd_ctl_file *file,
1629			    struct snd_ctl_elem_info *info, int replace)
1630{
1631	struct snd_card *card = file->card;
1632	struct snd_kcontrol *kctl;
1633	unsigned int count;
1634	unsigned int access;
1635	long private_size;
1636	size_t alloc_size;
1637	struct user_element *ue;
1638	unsigned int offset;
1639	int err;
1640
1641	if (!*info->id.name)
1642		return -EINVAL;
1643	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
1644		return -EINVAL;
1645
1646	/* Delete a control to replace them if needed. */
1647	if (replace) {
1648		info->id.numid = 0;
1649		err = snd_ctl_remove_user_ctl(file, &info->id);
1650		if (err)
1651			return err;
1652	}
1653
1654	/* Check the number of elements for this userspace control. */
1655	count = info->owner;
1656	if (count == 0)
1657		count = 1;
1658
1659	/* Arrange access permissions if needed. */
1660	access = info->access;
1661	if (access == 0)
1662		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1663	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1664		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1665		   SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
1666
1667	/* In initial state, nothing is available as TLV container. */
1668	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1669		access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1670	access |= SNDRV_CTL_ELEM_ACCESS_USER;
1671
1672	/*
1673	 * Check information and calculate the size of data specific to
1674	 * this userspace control.
1675	 */
1676	/* pass NULL to card for suppressing error messages */
1677	err = snd_ctl_check_elem_info(NULL, info);
1678	if (err < 0)
1679		return err;
1680	/* user-space control doesn't allow zero-size data */
1681	if (info->count < 1)
1682		return -EINVAL;
1683	private_size = value_sizes[info->type] * info->count;
1684	alloc_size = compute_user_elem_size(private_size, count);
1685
1686	down_write(&card->controls_rwsem);
1687	if (check_user_elem_overflow(card, alloc_size)) {
1688		err = -ENOMEM;
1689		goto unlock;
1690	}
1691
1692	/*
1693	 * Keep memory object for this userspace control. After passing this
1694	 * code block, the instance should be freed by snd_ctl_free_one().
1695	 *
1696	 * Note that these elements in this control are locked.
1697	 */
1698	err = snd_ctl_new(&kctl, count, access, file);
1699	if (err < 0)
1700		goto unlock;
1701	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1702	ue = kzalloc(alloc_size, GFP_KERNEL);
1703	if (!ue) {
1704		kfree(kctl);
1705		err = -ENOMEM;
1706		goto unlock;
1707	}
1708	kctl->private_data = ue;
1709	kctl->private_free = snd_ctl_elem_user_free;
1710
1711	// increment the allocated size; decremented again at private_free.
1712	card->user_ctl_alloc_size += alloc_size;
1713
1714	/* Set private data for this userspace control. */
1715	ue->card = card;
1716	ue->info = *info;
1717	ue->info.access = 0;
1718	ue->elem_data = (char *)ue + sizeof(*ue);
1719	ue->elem_data_size = private_size;
1720	if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1721		err = snd_ctl_elem_init_enum_names(ue);
1722		if (err < 0) {
1723			snd_ctl_free_one(kctl);
1724			goto unlock;
1725		}
1726	}
1727
1728	/* Set callback functions. */
1729	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1730		kctl->info = snd_ctl_elem_user_enum_info;
1731	else
1732		kctl->info = snd_ctl_elem_user_info;
1733	if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1734		kctl->get = snd_ctl_elem_user_get;
1735	if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1736		kctl->put = snd_ctl_elem_user_put;
1737	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1738		kctl->tlv.c = snd_ctl_elem_user_tlv;
1739
1740	/* This function manage to free the instance on failure. */
1741	err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
1742	if (err < 0) {
1743		snd_ctl_free_one(kctl);
1744		goto unlock;
1745	}
1746	offset = snd_ctl_get_ioff(kctl, &info->id);
1747	snd_ctl_build_ioff(&info->id, kctl, offset);
1748	/*
1749	 * Here we cannot fill any field for the number of elements added by
1750	 * this operation because there're no specific fields. The usage of
1751	 * 'owner' field for this purpose may cause any bugs to userspace
1752	 * applications because the field originally means PID of a process
1753	 * which locks the element.
1754	 */
1755 unlock:
1756	up_write(&card->controls_rwsem);
1757	return err;
1758}
1759
1760static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1761				 struct snd_ctl_elem_info __user *_info, int replace)
1762{
1763	struct snd_ctl_elem_info info;
1764	int err;
1765
1766	if (copy_from_user(&info, _info, sizeof(info)))
1767		return -EFAULT;
1768	err = snd_ctl_elem_add(file, &info, replace);
1769	if (err < 0)
1770		return err;
1771	if (copy_to_user(_info, &info, sizeof(info))) {
1772		snd_ctl_remove_user_ctl(file, &info.id);
1773		return -EFAULT;
1774	}
1775
1776	return 0;
1777}
1778
1779static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1780			       struct snd_ctl_elem_id __user *_id)
1781{
1782	struct snd_ctl_elem_id id;
1783
1784	if (copy_from_user(&id, _id, sizeof(id)))
1785		return -EFAULT;
1786	return snd_ctl_remove_user_ctl(file, &id);
1787}
1788
1789static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1790{
1791	int subscribe;
1792	if (get_user(subscribe, ptr))
1793		return -EFAULT;
1794	if (subscribe < 0) {
1795		subscribe = file->subscribed;
1796		if (put_user(subscribe, ptr))
1797			return -EFAULT;
1798		return 0;
1799	}
1800	if (subscribe) {
1801		file->subscribed = 1;
1802		return 0;
1803	} else if (file->subscribed) {
1804		snd_ctl_empty_read_queue(file);
1805		file->subscribed = 0;
1806	}
1807	return 0;
1808}
1809
1810static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
1811			    struct snd_kcontrol *kctl,
1812			    struct snd_ctl_elem_id *id,
1813			    unsigned int __user *buf, unsigned int size)
1814{
1815	static const struct {
1816		int op;
1817		int perm;
1818	} pairs[] = {
1819		{SNDRV_CTL_TLV_OP_READ,  SNDRV_CTL_ELEM_ACCESS_TLV_READ},
1820		{SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
1821		{SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
1822	};
1823	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1824	int i, ret;
1825
1826	/* Check support of the request for this element. */
1827	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
1828		if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
1829			break;
1830	}
1831	if (i == ARRAY_SIZE(pairs))
1832		return -ENXIO;
1833
1834	if (kctl->tlv.c == NULL)
1835		return -ENXIO;
1836
1837	/* Write and command operations are not allowed for locked element. */
1838	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
1839	    vd->owner != NULL && vd->owner != file)
1840		return -EPERM;
1841
1842	ret = snd_power_ref_and_wait(file->card);
1843	if (!ret)
1844		ret = kctl->tlv.c(kctl, op_flag, size, buf);
1845	snd_power_unref(file->card);
1846	return ret;
1847}
1848
1849static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
1850			unsigned int __user *buf, unsigned int size)
1851{
1852	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1853	unsigned int len;
1854
1855	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
1856		return -ENXIO;
1857
1858	if (kctl->tlv.p == NULL)
1859		return -ENXIO;
1860
1861	len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
1862	if (size < len)
1863		return -ENOMEM;
1864
1865	if (copy_to_user(buf, kctl->tlv.p, len))
1866		return -EFAULT;
1867
1868	return 0;
1869}
1870
1871static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1872			     struct snd_ctl_tlv __user *buf,
1873                             int op_flag)
1874{
1875	struct snd_ctl_tlv header;
1876	unsigned int __user *container;
1877	unsigned int container_size;
1878	struct snd_kcontrol *kctl;
1879	struct snd_ctl_elem_id id;
1880	struct snd_kcontrol_volatile *vd;
1881
1882	if (copy_from_user(&header, buf, sizeof(header)))
1883		return -EFAULT;
1884
1885	/* In design of control core, numerical ID starts at 1. */
1886	if (header.numid == 0)
1887		return -EINVAL;
1888
1889	/* At least, container should include type and length fields.  */
1890	if (header.length < sizeof(unsigned int) * 2)
1891		return -EINVAL;
1892	container_size = header.length;
1893	container = buf->tlv;
1894
1895	kctl = snd_ctl_find_numid(file->card, header.numid);
1896	if (kctl == NULL)
1897		return -ENOENT;
1898
1899	/* Calculate index of the element in this set. */
1900	id = kctl->id;
1901	snd_ctl_build_ioff(&id, kctl, header.numid - id.numid);
1902	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1903
1904	if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1905		return call_tlv_handler(file, op_flag, kctl, &id, container,
1906					container_size);
1907	} else {
1908		if (op_flag == SNDRV_CTL_TLV_OP_READ) {
1909			return read_tlv_buf(kctl, &id, container,
1910					    container_size);
1911		}
1912	}
1913
1914	/* Not supported. */
1915	return -ENXIO;
1916}
1917
1918static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1919{
1920	struct snd_ctl_file *ctl;
1921	struct snd_card *card;
1922	struct snd_kctl_ioctl *p;
1923	void __user *argp = (void __user *)arg;
1924	int __user *ip = argp;
1925	int err;
1926
1927	ctl = file->private_data;
1928	card = ctl->card;
1929	if (snd_BUG_ON(!card))
1930		return -ENXIO;
1931	switch (cmd) {
1932	case SNDRV_CTL_IOCTL_PVERSION:
1933		return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1934	case SNDRV_CTL_IOCTL_CARD_INFO:
1935		return snd_ctl_card_info(card, ctl, cmd, argp);
1936	case SNDRV_CTL_IOCTL_ELEM_LIST:
1937		return snd_ctl_elem_list_user(card, argp);
1938	case SNDRV_CTL_IOCTL_ELEM_INFO:
1939		return snd_ctl_elem_info_user(ctl, argp);
1940	case SNDRV_CTL_IOCTL_ELEM_READ:
1941		return snd_ctl_elem_read_user(card, argp);
1942	case SNDRV_CTL_IOCTL_ELEM_WRITE:
1943		return snd_ctl_elem_write_user(ctl, argp);
1944	case SNDRV_CTL_IOCTL_ELEM_LOCK:
1945		return snd_ctl_elem_lock(ctl, argp);
1946	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1947		return snd_ctl_elem_unlock(ctl, argp);
1948	case SNDRV_CTL_IOCTL_ELEM_ADD:
1949		return snd_ctl_elem_add_user(ctl, argp, 0);
1950	case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1951		return snd_ctl_elem_add_user(ctl, argp, 1);
1952	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1953		return snd_ctl_elem_remove(ctl, argp);
1954	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1955		return snd_ctl_subscribe_events(ctl, ip);
1956	case SNDRV_CTL_IOCTL_TLV_READ:
1957		down_read(&ctl->card->controls_rwsem);
1958		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
1959		up_read(&ctl->card->controls_rwsem);
1960		return err;
1961	case SNDRV_CTL_IOCTL_TLV_WRITE:
1962		down_write(&ctl->card->controls_rwsem);
1963		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
1964		up_write(&ctl->card->controls_rwsem);
1965		return err;
1966	case SNDRV_CTL_IOCTL_TLV_COMMAND:
1967		down_write(&ctl->card->controls_rwsem);
1968		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
1969		up_write(&ctl->card->controls_rwsem);
1970		return err;
1971	case SNDRV_CTL_IOCTL_POWER:
1972		return -ENOPROTOOPT;
1973	case SNDRV_CTL_IOCTL_POWER_STATE:
1974		return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1975	}
1976	down_read(&snd_ioctl_rwsem);
1977	list_for_each_entry(p, &snd_control_ioctls, list) {
1978		err = p->fioctl(card, ctl, cmd, arg);
1979		if (err != -ENOIOCTLCMD) {
1980			up_read(&snd_ioctl_rwsem);
1981			return err;
1982		}
1983	}
1984	up_read(&snd_ioctl_rwsem);
1985	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
1986	return -ENOTTY;
1987}
1988
1989static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1990			    size_t count, loff_t * offset)
1991{
1992	struct snd_ctl_file *ctl;
1993	int err = 0;
1994	ssize_t result = 0;
1995
1996	ctl = file->private_data;
1997	if (snd_BUG_ON(!ctl || !ctl->card))
1998		return -ENXIO;
1999	if (!ctl->subscribed)
2000		return -EBADFD;
2001	if (count < sizeof(struct snd_ctl_event))
2002		return -EINVAL;
2003	spin_lock_irq(&ctl->read_lock);
2004	while (count >= sizeof(struct snd_ctl_event)) {
2005		struct snd_ctl_event ev;
2006		struct snd_kctl_event *kev;
2007		while (list_empty(&ctl->events)) {
2008			wait_queue_entry_t wait;
2009			if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
2010				err = -EAGAIN;
2011				goto __end_lock;
2012			}
2013			init_waitqueue_entry(&wait, current);
2014			add_wait_queue(&ctl->change_sleep, &wait);
2015			set_current_state(TASK_INTERRUPTIBLE);
2016			spin_unlock_irq(&ctl->read_lock);
2017			schedule();
2018			remove_wait_queue(&ctl->change_sleep, &wait);
2019			if (ctl->card->shutdown)
2020				return -ENODEV;
2021			if (signal_pending(current))
2022				return -ERESTARTSYS;
2023			spin_lock_irq(&ctl->read_lock);
2024		}
2025		kev = snd_kctl_event(ctl->events.next);
2026		ev.type = SNDRV_CTL_EVENT_ELEM;
2027		ev.data.elem.mask = kev->mask;
2028		ev.data.elem.id = kev->id;
2029		list_del(&kev->list);
2030		spin_unlock_irq(&ctl->read_lock);
2031		kfree(kev);
2032		if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
2033			err = -EFAULT;
2034			goto __end;
2035		}
2036		spin_lock_irq(&ctl->read_lock);
2037		buffer += sizeof(struct snd_ctl_event);
2038		count -= sizeof(struct snd_ctl_event);
2039		result += sizeof(struct snd_ctl_event);
2040	}
2041      __end_lock:
2042	spin_unlock_irq(&ctl->read_lock);
2043      __end:
2044      	return result > 0 ? result : err;
2045}
2046
2047static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
2048{
2049	__poll_t mask;
2050	struct snd_ctl_file *ctl;
2051
2052	ctl = file->private_data;
2053	if (!ctl->subscribed)
2054		return 0;
2055	poll_wait(file, &ctl->change_sleep, wait);
2056
2057	mask = 0;
2058	if (!list_empty(&ctl->events))
2059		mask |= EPOLLIN | EPOLLRDNORM;
2060
2061	return mask;
2062}
2063
2064/*
2065 * register the device-specific control-ioctls.
2066 * called from each device manager like pcm.c, hwdep.c, etc.
2067 */
2068static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
2069{
2070	struct snd_kctl_ioctl *pn;
2071
2072	pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
2073	if (pn == NULL)
2074		return -ENOMEM;
2075	pn->fioctl = fcn;
2076	down_write(&snd_ioctl_rwsem);
2077	list_add_tail(&pn->list, lists);
2078	up_write(&snd_ioctl_rwsem);
2079	return 0;
2080}
2081
2082/**
2083 * snd_ctl_register_ioctl - register the device-specific control-ioctls
2084 * @fcn: ioctl callback function
2085 *
2086 * called from each device manager like pcm.c, hwdep.c, etc.
2087 *
2088 * Return: zero if successful, or a negative error code
2089 */
2090int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
2091{
2092	return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
2093}
2094EXPORT_SYMBOL(snd_ctl_register_ioctl);
2095
2096#ifdef CONFIG_COMPAT
2097/**
2098 * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
2099 * control-ioctls
2100 * @fcn: ioctl callback function
2101 *
2102 * Return: zero if successful, or a negative error code
2103 */
2104int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2105{
2106	return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
2107}
2108EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
2109#endif
2110
2111/*
2112 * de-register the device-specific control-ioctls.
2113 */
2114static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
2115				     struct list_head *lists)
2116{
2117	struct snd_kctl_ioctl *p;
2118
2119	if (snd_BUG_ON(!fcn))
2120		return -EINVAL;
2121	down_write(&snd_ioctl_rwsem);
2122	list_for_each_entry(p, lists, list) {
2123		if (p->fioctl == fcn) {
2124			list_del(&p->list);
2125			up_write(&snd_ioctl_rwsem);
2126			kfree(p);
2127			return 0;
2128		}
2129	}
2130	up_write(&snd_ioctl_rwsem);
2131	snd_BUG();
2132	return -EINVAL;
2133}
2134
2135/**
2136 * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
2137 * @fcn: ioctl callback function to unregister
2138 *
2139 * Return: zero if successful, or a negative error code
2140 */
2141int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
2142{
2143	return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
2144}
2145EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
2146
2147#ifdef CONFIG_COMPAT
2148/**
2149 * snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
2150 * 32bit control-ioctls
2151 * @fcn: ioctl callback function to unregister
2152 *
2153 * Return: zero if successful, or a negative error code
2154 */
2155int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2156{
2157	return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
2158}
2159EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
2160#endif
2161
2162static int snd_ctl_fasync(int fd, struct file * file, int on)
2163{
2164	struct snd_ctl_file *ctl;
2165
2166	ctl = file->private_data;
2167	return snd_fasync_helper(fd, file, on, &ctl->fasync);
2168}
2169
2170/* return the preferred subdevice number if already assigned;
2171 * otherwise return -1
2172 */
2173int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
2174{
2175	struct snd_ctl_file *kctl;
2176	int subdevice = -1;
2177	unsigned long flags;
2178
2179	read_lock_irqsave(&card->ctl_files_rwlock, flags);
2180	list_for_each_entry(kctl, &card->ctl_files, list) {
2181		if (kctl->pid == task_pid(current)) {
2182			subdevice = kctl->preferred_subdevice[type];
2183			if (subdevice != -1)
2184				break;
2185		}
2186	}
2187	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
2188	return subdevice;
2189}
2190EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
2191
2192/*
2193 * ioctl32 compat
2194 */
2195#ifdef CONFIG_COMPAT
2196#include "control_compat.c"
2197#else
2198#define snd_ctl_ioctl_compat	NULL
2199#endif
2200
2201/*
2202 * control layers (audio LED etc.)
2203 */
2204
2205/**
2206 * snd_ctl_request_layer - request to use the layer
2207 * @module_name: Name of the kernel module (NULL == build-in)
2208 *
2209 * Return: zero if successful, or an error code when the module cannot be loaded
2210 */
2211int snd_ctl_request_layer(const char *module_name)
2212{
2213	struct snd_ctl_layer_ops *lops;
2214
2215	if (module_name == NULL)
2216		return 0;
2217	down_read(&snd_ctl_layer_rwsem);
2218	for (lops = snd_ctl_layer; lops; lops = lops->next)
2219		if (strcmp(lops->module_name, module_name) == 0)
2220			break;
2221	up_read(&snd_ctl_layer_rwsem);
2222	if (lops)
2223		return 0;
2224	return request_module(module_name);
2225}
2226EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
2227
2228/**
2229 * snd_ctl_register_layer - register new control layer
2230 * @lops: operation structure
2231 *
2232 * The new layer can track all control elements and do additional
2233 * operations on top (like audio LED handling).
2234 */
2235void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
2236{
2237	struct snd_card *card;
2238	int card_number;
2239
2240	down_write(&snd_ctl_layer_rwsem);
2241	lops->next = snd_ctl_layer;
2242	snd_ctl_layer = lops;
2243	up_write(&snd_ctl_layer_rwsem);
2244	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
2245		card = snd_card_ref(card_number);
2246		if (card) {
2247			down_read(&card->controls_rwsem);
2248			lops->lregister(card);
2249			up_read(&card->controls_rwsem);
2250			snd_card_unref(card);
2251		}
2252	}
2253}
2254EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
2255
2256/**
2257 * snd_ctl_disconnect_layer - disconnect control layer
2258 * @lops: operation structure
2259 *
2260 * It is expected that the information about tracked cards
2261 * is freed before this call (the disconnect callback is
2262 * not called here).
2263 */
2264void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
2265{
2266	struct snd_ctl_layer_ops *lops2, *prev_lops2;
2267
2268	down_write(&snd_ctl_layer_rwsem);
2269	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
2270		if (lops2 == lops) {
2271			if (!prev_lops2)
2272				snd_ctl_layer = lops->next;
2273			else
2274				prev_lops2->next = lops->next;
2275			break;
2276		}
2277		prev_lops2 = lops2;
2278	}
2279	up_write(&snd_ctl_layer_rwsem);
2280}
2281EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
2282
2283/*
2284 *  INIT PART
2285 */
2286
2287static const struct file_operations snd_ctl_f_ops =
2288{
2289	.owner =	THIS_MODULE,
2290	.read =		snd_ctl_read,
2291	.open =		snd_ctl_open,
2292	.release =	snd_ctl_release,
2293	.llseek =	no_llseek,
2294	.poll =		snd_ctl_poll,
2295	.unlocked_ioctl =	snd_ctl_ioctl,
2296	.compat_ioctl =	snd_ctl_ioctl_compat,
2297	.fasync =	snd_ctl_fasync,
2298};
2299
2300/*
2301 * registration of the control device
2302 */
2303static int snd_ctl_dev_register(struct snd_device *device)
2304{
2305	struct snd_card *card = device->device_data;
2306	struct snd_ctl_layer_ops *lops;
2307	int err;
2308
2309	err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
2310				  &snd_ctl_f_ops, card, &card->ctl_dev);
2311	if (err < 0)
2312		return err;
2313	down_read(&card->controls_rwsem);
2314	down_read(&snd_ctl_layer_rwsem);
2315	for (lops = snd_ctl_layer; lops; lops = lops->next)
2316		lops->lregister(card);
2317	up_read(&snd_ctl_layer_rwsem);
2318	up_read(&card->controls_rwsem);
2319	return 0;
2320}
2321
2322/*
2323 * disconnection of the control device
2324 */
2325static int snd_ctl_dev_disconnect(struct snd_device *device)
2326{
2327	struct snd_card *card = device->device_data;
2328	struct snd_ctl_file *ctl;
2329	struct snd_ctl_layer_ops *lops;
2330	unsigned long flags;
2331
2332	read_lock_irqsave(&card->ctl_files_rwlock, flags);
2333	list_for_each_entry(ctl, &card->ctl_files, list) {
2334		wake_up(&ctl->change_sleep);
2335		snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
2336	}
2337	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
2338
2339	down_read(&card->controls_rwsem);
2340	down_read(&snd_ctl_layer_rwsem);
2341	for (lops = snd_ctl_layer; lops; lops = lops->next)
2342		lops->ldisconnect(card);
2343	up_read(&snd_ctl_layer_rwsem);
2344	up_read(&card->controls_rwsem);
2345
2346	return snd_unregister_device(&card->ctl_dev);
2347}
2348
2349/*
2350 * free all controls
2351 */
2352static int snd_ctl_dev_free(struct snd_device *device)
2353{
2354	struct snd_card *card = device->device_data;
2355	struct snd_kcontrol *control;
2356
2357	down_write(&card->controls_rwsem);
2358	while (!list_empty(&card->controls)) {
2359		control = snd_kcontrol(card->controls.next);
2360		__snd_ctl_remove(card, control, false);
2361	}
2362
2363#ifdef CONFIG_SND_CTL_FAST_LOOKUP
2364	xa_destroy(&card->ctl_numids);
2365	xa_destroy(&card->ctl_hash);
2366#endif
2367	up_write(&card->controls_rwsem);
2368	put_device(&card->ctl_dev);
2369	return 0;
2370}
2371
2372/*
2373 * create control core:
2374 * called from init.c
2375 */
2376int snd_ctl_create(struct snd_card *card)
2377{
2378	static const struct snd_device_ops ops = {
2379		.dev_free = snd_ctl_dev_free,
2380		.dev_register =	snd_ctl_dev_register,
2381		.dev_disconnect = snd_ctl_dev_disconnect,
2382	};
2383	int err;
2384
2385	if (snd_BUG_ON(!card))
2386		return -ENXIO;
2387	if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
2388		return -ENXIO;
2389
2390	snd_device_initialize(&card->ctl_dev, card);
2391	dev_set_name(&card->ctl_dev, "controlC%d", card->number);
2392
2393	err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
2394	if (err < 0)
2395		put_device(&card->ctl_dev);
2396	return err;
2397}
2398
2399/*
2400 * Frequently used control callbacks/helpers
2401 */
2402
2403/**
2404 * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
2405 * callback with a mono channel
2406 * @kcontrol: the kcontrol instance
2407 * @uinfo: info to store
2408 *
2409 * This is a function that can be used as info callback for a standard
2410 * boolean control with a single mono channel.
2411 *
2412 * Return: Zero (always successful)
2413 */
2414int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
2415			      struct snd_ctl_elem_info *uinfo)
2416{
2417	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2418	uinfo->count = 1;
2419	uinfo->value.integer.min = 0;
2420	uinfo->value.integer.max = 1;
2421	return 0;
2422}
2423EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
2424
2425/**
2426 * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
2427 * callback with stereo two channels
2428 * @kcontrol: the kcontrol instance
2429 * @uinfo: info to store
2430 *
2431 * This is a function that can be used as info callback for a standard
2432 * boolean control with stereo two channels.
2433 *
2434 * Return: Zero (always successful)
2435 */
2436int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
2437				struct snd_ctl_elem_info *uinfo)
2438{
2439	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2440	uinfo->count = 2;
2441	uinfo->value.integer.min = 0;
2442	uinfo->value.integer.max = 1;
2443	return 0;
2444}
2445EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
2446
2447/**
2448 * snd_ctl_enum_info - fills the info structure for an enumerated control
2449 * @info: the structure to be filled
2450 * @channels: the number of the control's channels; often one
2451 * @items: the number of control values; also the size of @names
2452 * @names: an array containing the names of all control values
2453 *
2454 * Sets all required fields in @info to their appropriate values.
2455 * If the control's accessibility is not the default (readable and writable),
2456 * the caller has to fill @info->access.
2457 *
2458 * Return: Zero (always successful)
2459 */
2460int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
2461		      unsigned int items, const char *const names[])
2462{
2463	info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
2464	info->count = channels;
2465	info->value.enumerated.items = items;
2466	if (!items)
2467		return 0;
2468	if (info->value.enumerated.item >= items)
2469		info->value.enumerated.item = items - 1;
2470	WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
2471	     "ALSA: too long item name '%s'\n",
2472	     names[info->value.enumerated.item]);
2473	strscpy(info->value.enumerated.name,
2474		names[info->value.enumerated.item],
2475		sizeof(info->value.enumerated.name));
2476	return 0;
2477}
2478EXPORT_SYMBOL(snd_ctl_enum_info);