xref: /linux/sound/core/control.c (revision 172cdcaefea5c297fdb3d20b7d5aff60ae4fbce6)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Routines for driver control interface
4  *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
5  */
6 
7 #include <linux/threads.h>
8 #include <linux/interrupt.h>
9 #include <linux/module.h>
10 #include <linux/moduleparam.h>
11 #include <linux/slab.h>
12 #include <linux/vmalloc.h>
13 #include <linux/time.h>
14 #include <linux/mm.h>
15 #include <linux/math64.h>
16 #include <linux/sched/signal.h>
17 #include <sound/core.h>
18 #include <sound/minors.h>
19 #include <sound/info.h>
20 #include <sound/control.h>
21 
22 // Max allocation size for user controls.
23 static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
24 module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
25 MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
26 
27 #define MAX_CONTROL_COUNT	1028
28 
29 struct snd_kctl_ioctl {
30 	struct list_head list;		/* list of all ioctls */
31 	snd_kctl_ioctl_func_t fioctl;
32 };
33 
34 static DECLARE_RWSEM(snd_ioctl_rwsem);
35 static DECLARE_RWSEM(snd_ctl_layer_rwsem);
36 static LIST_HEAD(snd_control_ioctls);
37 #ifdef CONFIG_COMPAT
38 static LIST_HEAD(snd_control_compat_ioctls);
39 #endif
40 static struct snd_ctl_layer_ops *snd_ctl_layer;
41 
42 static int snd_ctl_open(struct inode *inode, struct file *file)
43 {
44 	unsigned long flags;
45 	struct snd_card *card;
46 	struct snd_ctl_file *ctl;
47 	int i, err;
48 
49 	err = stream_open(inode, file);
50 	if (err < 0)
51 		return err;
52 
53 	card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
54 	if (!card) {
55 		err = -ENODEV;
56 		goto __error1;
57 	}
58 	err = snd_card_file_add(card, file);
59 	if (err < 0) {
60 		err = -ENODEV;
61 		goto __error1;
62 	}
63 	if (!try_module_get(card->module)) {
64 		err = -EFAULT;
65 		goto __error2;
66 	}
67 	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
68 	if (ctl == NULL) {
69 		err = -ENOMEM;
70 		goto __error;
71 	}
72 	INIT_LIST_HEAD(&ctl->events);
73 	init_waitqueue_head(&ctl->change_sleep);
74 	spin_lock_init(&ctl->read_lock);
75 	ctl->card = card;
76 	for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
77 		ctl->preferred_subdevice[i] = -1;
78 	ctl->pid = get_pid(task_pid(current));
79 	file->private_data = ctl;
80 	write_lock_irqsave(&card->ctl_files_rwlock, flags);
81 	list_add_tail(&ctl->list, &card->ctl_files);
82 	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
83 	snd_card_unref(card);
84 	return 0;
85 
86       __error:
87 	module_put(card->module);
88       __error2:
89 	snd_card_file_remove(card, file);
90       __error1:
91 	if (card)
92 		snd_card_unref(card);
93       	return err;
94 }
95 
96 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
97 {
98 	unsigned long flags;
99 	struct snd_kctl_event *cread;
100 
101 	spin_lock_irqsave(&ctl->read_lock, flags);
102 	while (!list_empty(&ctl->events)) {
103 		cread = snd_kctl_event(ctl->events.next);
104 		list_del(&cread->list);
105 		kfree(cread);
106 	}
107 	spin_unlock_irqrestore(&ctl->read_lock, flags);
108 }
109 
110 static int snd_ctl_release(struct inode *inode, struct file *file)
111 {
112 	unsigned long flags;
113 	struct snd_card *card;
114 	struct snd_ctl_file *ctl;
115 	struct snd_kcontrol *control;
116 	unsigned int idx;
117 
118 	ctl = file->private_data;
119 	file->private_data = NULL;
120 	card = ctl->card;
121 	write_lock_irqsave(&card->ctl_files_rwlock, flags);
122 	list_del(&ctl->list);
123 	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
124 	down_write(&card->controls_rwsem);
125 	list_for_each_entry(control, &card->controls, list)
126 		for (idx = 0; idx < control->count; idx++)
127 			if (control->vd[idx].owner == ctl)
128 				control->vd[idx].owner = NULL;
129 	up_write(&card->controls_rwsem);
130 	snd_ctl_empty_read_queue(ctl);
131 	put_pid(ctl->pid);
132 	kfree(ctl);
133 	module_put(card->module);
134 	snd_card_file_remove(card, file);
135 	return 0;
136 }
137 
138 /**
139  * snd_ctl_notify - Send notification to user-space for a control change
140  * @card: the card to send notification
141  * @mask: the event mask, SNDRV_CTL_EVENT_*
142  * @id: the ctl element id to send notification
143  *
144  * This function adds an event record with the given id and mask, appends
145  * to the list and wakes up the user-space for notification.  This can be
146  * called in the atomic context.
147  */
148 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
149 		    struct snd_ctl_elem_id *id)
150 {
151 	unsigned long flags;
152 	struct snd_ctl_file *ctl;
153 	struct snd_kctl_event *ev;
154 
155 	if (snd_BUG_ON(!card || !id))
156 		return;
157 	if (card->shutdown)
158 		return;
159 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
160 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
161 	card->mixer_oss_change_count++;
162 #endif
163 	list_for_each_entry(ctl, &card->ctl_files, list) {
164 		if (!ctl->subscribed)
165 			continue;
166 		spin_lock(&ctl->read_lock);
167 		list_for_each_entry(ev, &ctl->events, list) {
168 			if (ev->id.numid == id->numid) {
169 				ev->mask |= mask;
170 				goto _found;
171 			}
172 		}
173 		ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
174 		if (ev) {
175 			ev->id = *id;
176 			ev->mask = mask;
177 			list_add_tail(&ev->list, &ctl->events);
178 		} else {
179 			dev_err(card->dev, "No memory available to allocate event\n");
180 		}
181 	_found:
182 		wake_up(&ctl->change_sleep);
183 		spin_unlock(&ctl->read_lock);
184 		kill_fasync(&ctl->fasync, SIGIO, POLL_IN);
185 	}
186 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
187 }
188 EXPORT_SYMBOL(snd_ctl_notify);
189 
190 /**
191  * snd_ctl_notify_one - Send notification to user-space for a control change
192  * @card: the card to send notification
193  * @mask: the event mask, SNDRV_CTL_EVENT_*
194  * @kctl: the pointer with the control instance
195  * @ioff: the additional offset to the control index
196  *
197  * This function calls snd_ctl_notify() and does additional jobs
198  * like LED state changes.
199  */
200 void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
201 			struct snd_kcontrol *kctl, unsigned int ioff)
202 {
203 	struct snd_ctl_elem_id id = kctl->id;
204 	struct snd_ctl_layer_ops *lops;
205 
206 	id.index += ioff;
207 	id.numid += ioff;
208 	snd_ctl_notify(card, mask, &id);
209 	down_read(&snd_ctl_layer_rwsem);
210 	for (lops = snd_ctl_layer; lops; lops = lops->next)
211 		lops->lnotify(card, mask, kctl, ioff);
212 	up_read(&snd_ctl_layer_rwsem);
213 }
214 EXPORT_SYMBOL(snd_ctl_notify_one);
215 
216 /**
217  * snd_ctl_new - create a new control instance with some elements
218  * @kctl: the pointer to store new control instance
219  * @count: the number of elements in this control
220  * @access: the default access flags for elements in this control
221  * @file: given when locking these elements
222  *
223  * Allocates a memory object for a new control instance. The instance has
224  * elements as many as the given number (@count). Each element has given
225  * access permissions (@access). Each element is locked when @file is given.
226  *
227  * Return: 0 on success, error code on failure
228  */
229 static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
230 		       unsigned int access, struct snd_ctl_file *file)
231 {
232 	unsigned int idx;
233 
234 	if (count == 0 || count > MAX_CONTROL_COUNT)
235 		return -EINVAL;
236 
237 	*kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
238 	if (!*kctl)
239 		return -ENOMEM;
240 
241 	for (idx = 0; idx < count; idx++) {
242 		(*kctl)->vd[idx].access = access;
243 		(*kctl)->vd[idx].owner = file;
244 	}
245 	(*kctl)->count = count;
246 
247 	return 0;
248 }
249 
250 /**
251  * snd_ctl_new1 - create a control instance from the template
252  * @ncontrol: the initialization record
253  * @private_data: the private data to set
254  *
255  * Allocates a new struct snd_kcontrol instance and initialize from the given
256  * template.  When the access field of ncontrol is 0, it's assumed as
257  * READWRITE access. When the count field is 0, it's assumes as one.
258  *
259  * Return: The pointer of the newly generated instance, or %NULL on failure.
260  */
261 struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
262 				  void *private_data)
263 {
264 	struct snd_kcontrol *kctl;
265 	unsigned int count;
266 	unsigned int access;
267 	int err;
268 
269 	if (snd_BUG_ON(!ncontrol || !ncontrol->info))
270 		return NULL;
271 
272 	count = ncontrol->count;
273 	if (count == 0)
274 		count = 1;
275 
276 	access = ncontrol->access;
277 	if (access == 0)
278 		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
279 	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
280 		   SNDRV_CTL_ELEM_ACCESS_VOLATILE |
281 		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
282 		   SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
283 		   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
284 		   SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
285 		   SNDRV_CTL_ELEM_ACCESS_LED_MASK |
286 		   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
287 
288 	err = snd_ctl_new(&kctl, count, access, NULL);
289 	if (err < 0)
290 		return NULL;
291 
292 	/* The 'numid' member is decided when calling snd_ctl_add(). */
293 	kctl->id.iface = ncontrol->iface;
294 	kctl->id.device = ncontrol->device;
295 	kctl->id.subdevice = ncontrol->subdevice;
296 	if (ncontrol->name) {
297 		strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
298 		if (strcmp(ncontrol->name, kctl->id.name) != 0)
299 			pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
300 				ncontrol->name, kctl->id.name);
301 	}
302 	kctl->id.index = ncontrol->index;
303 
304 	kctl->info = ncontrol->info;
305 	kctl->get = ncontrol->get;
306 	kctl->put = ncontrol->put;
307 	kctl->tlv.p = ncontrol->tlv.p;
308 
309 	kctl->private_value = ncontrol->private_value;
310 	kctl->private_data = private_data;
311 
312 	return kctl;
313 }
314 EXPORT_SYMBOL(snd_ctl_new1);
315 
316 /**
317  * snd_ctl_free_one - release the control instance
318  * @kcontrol: the control instance
319  *
320  * Releases the control instance created via snd_ctl_new()
321  * or snd_ctl_new1().
322  * Don't call this after the control was added to the card.
323  */
324 void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
325 {
326 	if (kcontrol) {
327 		if (kcontrol->private_free)
328 			kcontrol->private_free(kcontrol);
329 		kfree(kcontrol);
330 	}
331 }
332 EXPORT_SYMBOL(snd_ctl_free_one);
333 
334 static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
335 					  unsigned int count)
336 {
337 	struct snd_kcontrol *kctl;
338 
339 	/* Make sure that the ids assigned to the control do not wrap around */
340 	if (card->last_numid >= UINT_MAX - count)
341 		card->last_numid = 0;
342 
343 	list_for_each_entry(kctl, &card->controls, list) {
344 		if (kctl->id.numid < card->last_numid + 1 + count &&
345 		    kctl->id.numid + kctl->count > card->last_numid + 1) {
346 		    	card->last_numid = kctl->id.numid + kctl->count - 1;
347 			return true;
348 		}
349 	}
350 	return false;
351 }
352 
353 static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
354 {
355 	unsigned int iter = 100000;
356 
357 	while (snd_ctl_remove_numid_conflict(card, count)) {
358 		if (--iter == 0) {
359 			/* this situation is very unlikely */
360 			dev_err(card->dev, "unable to allocate new control numid\n");
361 			return -ENOMEM;
362 		}
363 	}
364 	return 0;
365 }
366 
367 enum snd_ctl_add_mode {
368 	CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
369 };
370 
371 /* add/replace a new kcontrol object; call with card->controls_rwsem locked */
372 static int __snd_ctl_add_replace(struct snd_card *card,
373 				 struct snd_kcontrol *kcontrol,
374 				 enum snd_ctl_add_mode mode)
375 {
376 	struct snd_ctl_elem_id id;
377 	unsigned int idx;
378 	struct snd_kcontrol *old;
379 	int err;
380 
381 	id = kcontrol->id;
382 	if (id.index > UINT_MAX - kcontrol->count)
383 		return -EINVAL;
384 
385 	old = snd_ctl_find_id(card, &id);
386 	if (!old) {
387 		if (mode == CTL_REPLACE)
388 			return -EINVAL;
389 	} else {
390 		if (mode == CTL_ADD_EXCLUSIVE) {
391 			dev_err(card->dev,
392 				"control %i:%i:%i:%s:%i is already present\n",
393 				id.iface, id.device, id.subdevice, id.name,
394 				id.index);
395 			return -EBUSY;
396 		}
397 
398 		err = snd_ctl_remove(card, old);
399 		if (err < 0)
400 			return err;
401 	}
402 
403 	if (snd_ctl_find_hole(card, kcontrol->count) < 0)
404 		return -ENOMEM;
405 
406 	list_add_tail(&kcontrol->list, &card->controls);
407 	card->controls_count += kcontrol->count;
408 	kcontrol->id.numid = card->last_numid + 1;
409 	card->last_numid += kcontrol->count;
410 
411 	for (idx = 0; idx < kcontrol->count; idx++)
412 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
413 
414 	return 0;
415 }
416 
417 static int snd_ctl_add_replace(struct snd_card *card,
418 			       struct snd_kcontrol *kcontrol,
419 			       enum snd_ctl_add_mode mode)
420 {
421 	int err = -EINVAL;
422 
423 	if (! kcontrol)
424 		return err;
425 	if (snd_BUG_ON(!card || !kcontrol->info))
426 		goto error;
427 
428 	down_write(&card->controls_rwsem);
429 	err = __snd_ctl_add_replace(card, kcontrol, mode);
430 	up_write(&card->controls_rwsem);
431 	if (err < 0)
432 		goto error;
433 	return 0;
434 
435  error:
436 	snd_ctl_free_one(kcontrol);
437 	return err;
438 }
439 
440 /**
441  * snd_ctl_add - add the control instance to the card
442  * @card: the card instance
443  * @kcontrol: the control instance to add
444  *
445  * Adds the control instance created via snd_ctl_new() or
446  * snd_ctl_new1() to the given card. Assigns also an unique
447  * numid used for fast search.
448  *
449  * It frees automatically the control which cannot be added.
450  *
451  * Return: Zero if successful, or a negative error code on failure.
452  *
453  */
454 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
455 {
456 	return snd_ctl_add_replace(card, kcontrol, CTL_ADD_EXCLUSIVE);
457 }
458 EXPORT_SYMBOL(snd_ctl_add);
459 
460 /**
461  * snd_ctl_replace - replace the control instance of the card
462  * @card: the card instance
463  * @kcontrol: the control instance to replace
464  * @add_on_replace: add the control if not already added
465  *
466  * Replaces the given control.  If the given control does not exist
467  * and the add_on_replace flag is set, the control is added.  If the
468  * control exists, it is destroyed first.
469  *
470  * It frees automatically the control which cannot be added or replaced.
471  *
472  * Return: Zero if successful, or a negative error code on failure.
473  */
474 int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
475 		    bool add_on_replace)
476 {
477 	return snd_ctl_add_replace(card, kcontrol,
478 				   add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
479 }
480 EXPORT_SYMBOL(snd_ctl_replace);
481 
482 /**
483  * snd_ctl_remove - remove the control from the card and release it
484  * @card: the card instance
485  * @kcontrol: the control instance to remove
486  *
487  * Removes the control from the card and then releases the instance.
488  * You don't need to call snd_ctl_free_one(). You must be in
489  * the write lock - down_write(&card->controls_rwsem).
490  *
491  * Return: 0 if successful, or a negative error code on failure.
492  */
493 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
494 {
495 	unsigned int idx;
496 
497 	if (snd_BUG_ON(!card || !kcontrol))
498 		return -EINVAL;
499 	list_del(&kcontrol->list);
500 	card->controls_count -= kcontrol->count;
501 	for (idx = 0; idx < kcontrol->count; idx++)
502 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
503 	snd_ctl_free_one(kcontrol);
504 	return 0;
505 }
506 EXPORT_SYMBOL(snd_ctl_remove);
507 
508 /**
509  * snd_ctl_remove_id - remove the control of the given id and release it
510  * @card: the card instance
511  * @id: the control id to remove
512  *
513  * Finds the control instance with the given id, removes it from the
514  * card list and releases it.
515  *
516  * Return: 0 if successful, or a negative error code on failure.
517  */
518 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
519 {
520 	struct snd_kcontrol *kctl;
521 	int ret;
522 
523 	down_write(&card->controls_rwsem);
524 	kctl = snd_ctl_find_id(card, id);
525 	if (kctl == NULL) {
526 		up_write(&card->controls_rwsem);
527 		return -ENOENT;
528 	}
529 	ret = snd_ctl_remove(card, kctl);
530 	up_write(&card->controls_rwsem);
531 	return ret;
532 }
533 EXPORT_SYMBOL(snd_ctl_remove_id);
534 
535 /**
536  * snd_ctl_remove_user_ctl - remove and release the unlocked user control
537  * @file: active control handle
538  * @id: the control id to remove
539  *
540  * Finds the control instance with the given id, removes it from the
541  * card list and releases it.
542  *
543  * Return: 0 if successful, or a negative error code on failure.
544  */
545 static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
546 				   struct snd_ctl_elem_id *id)
547 {
548 	struct snd_card *card = file->card;
549 	struct snd_kcontrol *kctl;
550 	int idx, ret;
551 
552 	down_write(&card->controls_rwsem);
553 	kctl = snd_ctl_find_id(card, id);
554 	if (kctl == NULL) {
555 		ret = -ENOENT;
556 		goto error;
557 	}
558 	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
559 		ret = -EINVAL;
560 		goto error;
561 	}
562 	for (idx = 0; idx < kctl->count; idx++)
563 		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
564 			ret = -EBUSY;
565 			goto error;
566 		}
567 	ret = snd_ctl_remove(card, kctl);
568 error:
569 	up_write(&card->controls_rwsem);
570 	return ret;
571 }
572 
573 /**
574  * snd_ctl_activate_id - activate/inactivate the control of the given id
575  * @card: the card instance
576  * @id: the control id to activate/inactivate
577  * @active: non-zero to activate
578  *
579  * Finds the control instance with the given id, and activate or
580  * inactivate the control together with notification, if changed.
581  * The given ID data is filled with full information.
582  *
583  * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
584  */
585 int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
586 			int active)
587 {
588 	struct snd_kcontrol *kctl;
589 	struct snd_kcontrol_volatile *vd;
590 	unsigned int index_offset;
591 	int ret;
592 
593 	down_write(&card->controls_rwsem);
594 	kctl = snd_ctl_find_id(card, id);
595 	if (kctl == NULL) {
596 		ret = -ENOENT;
597 		goto unlock;
598 	}
599 	index_offset = snd_ctl_get_ioff(kctl, id);
600 	vd = &kctl->vd[index_offset];
601 	ret = 0;
602 	if (active) {
603 		if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
604 			goto unlock;
605 		vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
606 	} else {
607 		if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
608 			goto unlock;
609 		vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
610 	}
611 	snd_ctl_build_ioff(id, kctl, index_offset);
612 	downgrade_write(&card->controls_rwsem);
613 	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
614 	up_read(&card->controls_rwsem);
615 	return 1;
616 
617  unlock:
618 	up_write(&card->controls_rwsem);
619 	return ret;
620 }
621 EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
622 
623 /**
624  * snd_ctl_rename_id - replace the id of a control on the card
625  * @card: the card instance
626  * @src_id: the old id
627  * @dst_id: the new id
628  *
629  * Finds the control with the old id from the card, and replaces the
630  * id with the new one.
631  *
632  * Return: Zero if successful, or a negative error code on failure.
633  */
634 int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
635 		      struct snd_ctl_elem_id *dst_id)
636 {
637 	struct snd_kcontrol *kctl;
638 
639 	down_write(&card->controls_rwsem);
640 	kctl = snd_ctl_find_id(card, src_id);
641 	if (kctl == NULL) {
642 		up_write(&card->controls_rwsem);
643 		return -ENOENT;
644 	}
645 	kctl->id = *dst_id;
646 	kctl->id.numid = card->last_numid + 1;
647 	card->last_numid += kctl->count;
648 	up_write(&card->controls_rwsem);
649 	return 0;
650 }
651 EXPORT_SYMBOL(snd_ctl_rename_id);
652 
653 /**
654  * snd_ctl_find_numid - find the control instance with the given number-id
655  * @card: the card instance
656  * @numid: the number-id to search
657  *
658  * Finds the control instance with the given number-id from the card.
659  *
660  * The caller must down card->controls_rwsem before calling this function
661  * (if the race condition can happen).
662  *
663  * Return: The pointer of the instance if found, or %NULL if not.
664  *
665  */
666 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card, unsigned int numid)
667 {
668 	struct snd_kcontrol *kctl;
669 
670 	if (snd_BUG_ON(!card || !numid))
671 		return NULL;
672 	list_for_each_entry(kctl, &card->controls, list) {
673 		if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
674 			return kctl;
675 	}
676 	return NULL;
677 }
678 EXPORT_SYMBOL(snd_ctl_find_numid);
679 
680 /**
681  * snd_ctl_find_id - find the control instance with the given id
682  * @card: the card instance
683  * @id: the id to search
684  *
685  * Finds the control instance with the given id from the card.
686  *
687  * The caller must down card->controls_rwsem before calling this function
688  * (if the race condition can happen).
689  *
690  * Return: The pointer of the instance if found, or %NULL if not.
691  *
692  */
693 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
694 				     struct snd_ctl_elem_id *id)
695 {
696 	struct snd_kcontrol *kctl;
697 
698 	if (snd_BUG_ON(!card || !id))
699 		return NULL;
700 	if (id->numid != 0)
701 		return snd_ctl_find_numid(card, id->numid);
702 	list_for_each_entry(kctl, &card->controls, list) {
703 		if (kctl->id.iface != id->iface)
704 			continue;
705 		if (kctl->id.device != id->device)
706 			continue;
707 		if (kctl->id.subdevice != id->subdevice)
708 			continue;
709 		if (strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)))
710 			continue;
711 		if (kctl->id.index > id->index)
712 			continue;
713 		if (kctl->id.index + kctl->count <= id->index)
714 			continue;
715 		return kctl;
716 	}
717 	return NULL;
718 }
719 EXPORT_SYMBOL(snd_ctl_find_id);
720 
721 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
722 			     unsigned int cmd, void __user *arg)
723 {
724 	struct snd_ctl_card_info *info;
725 
726 	info = kzalloc(sizeof(*info), GFP_KERNEL);
727 	if (! info)
728 		return -ENOMEM;
729 	down_read(&snd_ioctl_rwsem);
730 	info->card = card->number;
731 	strscpy(info->id, card->id, sizeof(info->id));
732 	strscpy(info->driver, card->driver, sizeof(info->driver));
733 	strscpy(info->name, card->shortname, sizeof(info->name));
734 	strscpy(info->longname, card->longname, sizeof(info->longname));
735 	strscpy(info->mixername, card->mixername, sizeof(info->mixername));
736 	strscpy(info->components, card->components, sizeof(info->components));
737 	up_read(&snd_ioctl_rwsem);
738 	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
739 		kfree(info);
740 		return -EFAULT;
741 	}
742 	kfree(info);
743 	return 0;
744 }
745 
746 static int snd_ctl_elem_list(struct snd_card *card,
747 			     struct snd_ctl_elem_list *list)
748 {
749 	struct snd_kcontrol *kctl;
750 	struct snd_ctl_elem_id id;
751 	unsigned int offset, space, jidx;
752 	int err = 0;
753 
754 	offset = list->offset;
755 	space = list->space;
756 
757 	down_read(&card->controls_rwsem);
758 	list->count = card->controls_count;
759 	list->used = 0;
760 	if (space > 0) {
761 		list_for_each_entry(kctl, &card->controls, list) {
762 			if (offset >= kctl->count) {
763 				offset -= kctl->count;
764 				continue;
765 			}
766 			for (jidx = offset; jidx < kctl->count; jidx++) {
767 				snd_ctl_build_ioff(&id, kctl, jidx);
768 				if (copy_to_user(list->pids + list->used, &id,
769 						 sizeof(id))) {
770 					err = -EFAULT;
771 					goto out;
772 				}
773 				list->used++;
774 				if (!--space)
775 					goto out;
776 			}
777 			offset = 0;
778 		}
779 	}
780  out:
781 	up_read(&card->controls_rwsem);
782 	return err;
783 }
784 
785 static int snd_ctl_elem_list_user(struct snd_card *card,
786 				  struct snd_ctl_elem_list __user *_list)
787 {
788 	struct snd_ctl_elem_list list;
789 	int err;
790 
791 	if (copy_from_user(&list, _list, sizeof(list)))
792 		return -EFAULT;
793 	err = snd_ctl_elem_list(card, &list);
794 	if (err)
795 		return err;
796 	if (copy_to_user(_list, &list, sizeof(list)))
797 		return -EFAULT;
798 
799 	return 0;
800 }
801 
802 /* Check whether the given kctl info is valid */
803 static int snd_ctl_check_elem_info(struct snd_card *card,
804 				   const struct snd_ctl_elem_info *info)
805 {
806 	static const unsigned int max_value_counts[] = {
807 		[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= 128,
808 		[SNDRV_CTL_ELEM_TYPE_INTEGER]	= 128,
809 		[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
810 		[SNDRV_CTL_ELEM_TYPE_BYTES]	= 512,
811 		[SNDRV_CTL_ELEM_TYPE_IEC958]	= 1,
812 		[SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
813 	};
814 
815 	if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
816 	    info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
817 		if (card)
818 			dev_err(card->dev,
819 				"control %i:%i:%i:%s:%i: invalid type %d\n",
820 				info->id.iface, info->id.device,
821 				info->id.subdevice, info->id.name,
822 				info->id.index, info->type);
823 		return -EINVAL;
824 	}
825 	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
826 	    info->value.enumerated.items == 0) {
827 		if (card)
828 			dev_err(card->dev,
829 				"control %i:%i:%i:%s:%i: zero enum items\n",
830 				info->id.iface, info->id.device,
831 				info->id.subdevice, info->id.name,
832 				info->id.index);
833 		return -EINVAL;
834 	}
835 	if (info->count > max_value_counts[info->type]) {
836 		if (card)
837 			dev_err(card->dev,
838 				"control %i:%i:%i:%s:%i: invalid count %d\n",
839 				info->id.iface, info->id.device,
840 				info->id.subdevice, info->id.name,
841 				info->id.index, info->count);
842 		return -EINVAL;
843 	}
844 
845 	return 0;
846 }
847 
848 /* The capacity of struct snd_ctl_elem_value.value.*/
849 static const unsigned int value_sizes[] = {
850 	[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= sizeof(long),
851 	[SNDRV_CTL_ELEM_TYPE_INTEGER]	= sizeof(long),
852 	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
853 	[SNDRV_CTL_ELEM_TYPE_BYTES]	= sizeof(unsigned char),
854 	[SNDRV_CTL_ELEM_TYPE_IEC958]	= sizeof(struct snd_aes_iec958),
855 	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
856 };
857 
858 #ifdef CONFIG_SND_CTL_VALIDATION
859 /* fill the remaining snd_ctl_elem_value data with the given pattern */
860 static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
861 				      struct snd_ctl_elem_info *info,
862 				      u32 pattern)
863 {
864 	size_t offset = value_sizes[info->type] * info->count;
865 
866 	offset = DIV_ROUND_UP(offset, sizeof(u32));
867 	memset32((u32 *)control->value.bytes.data + offset, pattern,
868 		 sizeof(control->value) / sizeof(u32) - offset);
869 }
870 
871 /* check whether the given integer ctl value is valid */
872 static int sanity_check_int_value(struct snd_card *card,
873 				  const struct snd_ctl_elem_value *control,
874 				  const struct snd_ctl_elem_info *info,
875 				  int i)
876 {
877 	long long lval, lmin, lmax, lstep;
878 	u64 rem;
879 
880 	switch (info->type) {
881 	default:
882 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
883 		lval = control->value.integer.value[i];
884 		lmin = 0;
885 		lmax = 1;
886 		lstep = 0;
887 		break;
888 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
889 		lval = control->value.integer.value[i];
890 		lmin = info->value.integer.min;
891 		lmax = info->value.integer.max;
892 		lstep = info->value.integer.step;
893 		break;
894 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
895 		lval = control->value.integer64.value[i];
896 		lmin = info->value.integer64.min;
897 		lmax = info->value.integer64.max;
898 		lstep = info->value.integer64.step;
899 		break;
900 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
901 		lval = control->value.enumerated.item[i];
902 		lmin = 0;
903 		lmax = info->value.enumerated.items - 1;
904 		lstep = 0;
905 		break;
906 	}
907 
908 	if (lval < lmin || lval > lmax) {
909 		dev_err(card->dev,
910 			"control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
911 			control->id.iface, control->id.device,
912 			control->id.subdevice, control->id.name,
913 			control->id.index, lval, lmin, lmax, i);
914 		return -EINVAL;
915 	}
916 	if (lstep) {
917 		div64_u64_rem(lval, lstep, &rem);
918 		if (rem) {
919 			dev_err(card->dev,
920 				"control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
921 				control->id.iface, control->id.device,
922 				control->id.subdevice, control->id.name,
923 				control->id.index, lval, lstep, i);
924 			return -EINVAL;
925 		}
926 	}
927 
928 	return 0;
929 }
930 
931 /* perform sanity checks to the given snd_ctl_elem_value object */
932 static int sanity_check_elem_value(struct snd_card *card,
933 				   const struct snd_ctl_elem_value *control,
934 				   const struct snd_ctl_elem_info *info,
935 				   u32 pattern)
936 {
937 	size_t offset;
938 	int i, ret = 0;
939 	u32 *p;
940 
941 	switch (info->type) {
942 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
943 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
944 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
945 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
946 		for (i = 0; i < info->count; i++) {
947 			ret = sanity_check_int_value(card, control, info, i);
948 			if (ret < 0)
949 				return ret;
950 		}
951 		break;
952 	default:
953 		break;
954 	}
955 
956 	/* check whether the remaining area kept untouched */
957 	offset = value_sizes[info->type] * info->count;
958 	offset = DIV_ROUND_UP(offset, sizeof(u32));
959 	p = (u32 *)control->value.bytes.data + offset;
960 	for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
961 		if (*p != pattern) {
962 			ret = -EINVAL;
963 			break;
964 		}
965 		*p = 0; /* clear the checked area */
966 	}
967 
968 	return ret;
969 }
970 #else
971 static inline void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
972 					     struct snd_ctl_elem_info *info,
973 					     u32 pattern)
974 {
975 }
976 
977 static inline int sanity_check_elem_value(struct snd_card *card,
978 					  struct snd_ctl_elem_value *control,
979 					  struct snd_ctl_elem_info *info,
980 					  u32 pattern)
981 {
982 	return 0;
983 }
984 #endif
985 
986 static int __snd_ctl_elem_info(struct snd_card *card,
987 			       struct snd_kcontrol *kctl,
988 			       struct snd_ctl_elem_info *info,
989 			       struct snd_ctl_file *ctl)
990 {
991 	struct snd_kcontrol_volatile *vd;
992 	unsigned int index_offset;
993 	int result;
994 
995 #ifdef CONFIG_SND_DEBUG
996 	info->access = 0;
997 #endif
998 	result = kctl->info(kctl, info);
999 	if (result >= 0) {
1000 		snd_BUG_ON(info->access);
1001 		index_offset = snd_ctl_get_ioff(kctl, &info->id);
1002 		vd = &kctl->vd[index_offset];
1003 		snd_ctl_build_ioff(&info->id, kctl, index_offset);
1004 		info->access = vd->access;
1005 		if (vd->owner) {
1006 			info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
1007 			if (vd->owner == ctl)
1008 				info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
1009 			info->owner = pid_vnr(vd->owner->pid);
1010 		} else {
1011 			info->owner = -1;
1012 		}
1013 		if (!snd_ctl_skip_validation(info) &&
1014 		    snd_ctl_check_elem_info(card, info) < 0)
1015 			result = -EINVAL;
1016 	}
1017 	return result;
1018 }
1019 
1020 static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
1021 			     struct snd_ctl_elem_info *info)
1022 {
1023 	struct snd_card *card = ctl->card;
1024 	struct snd_kcontrol *kctl;
1025 	int result;
1026 
1027 	down_read(&card->controls_rwsem);
1028 	kctl = snd_ctl_find_id(card, &info->id);
1029 	if (kctl == NULL)
1030 		result = -ENOENT;
1031 	else
1032 		result = __snd_ctl_elem_info(card, kctl, info, ctl);
1033 	up_read(&card->controls_rwsem);
1034 	return result;
1035 }
1036 
1037 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
1038 				  struct snd_ctl_elem_info __user *_info)
1039 {
1040 	struct snd_ctl_elem_info info;
1041 	int result;
1042 
1043 	if (copy_from_user(&info, _info, sizeof(info)))
1044 		return -EFAULT;
1045 	result = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0);
1046 	if (result < 0)
1047 		return result;
1048 	result = snd_ctl_elem_info(ctl, &info);
1049 	if (result < 0)
1050 		return result;
1051 	/* drop internal access flags */
1052 	info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
1053 			 SNDRV_CTL_ELEM_ACCESS_LED_MASK);
1054 	if (copy_to_user(_info, &info, sizeof(info)))
1055 		return -EFAULT;
1056 	return result;
1057 }
1058 
1059 static int snd_ctl_elem_read(struct snd_card *card,
1060 			     struct snd_ctl_elem_value *control)
1061 {
1062 	struct snd_kcontrol *kctl;
1063 	struct snd_kcontrol_volatile *vd;
1064 	unsigned int index_offset;
1065 	struct snd_ctl_elem_info info;
1066 	const u32 pattern = 0xdeadbeef;
1067 	int ret;
1068 
1069 	kctl = snd_ctl_find_id(card, &control->id);
1070 	if (kctl == NULL)
1071 		return -ENOENT;
1072 
1073 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1074 	vd = &kctl->vd[index_offset];
1075 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL)
1076 		return -EPERM;
1077 
1078 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1079 
1080 #ifdef CONFIG_SND_CTL_VALIDATION
1081 	/* info is needed only for validation */
1082 	memset(&info, 0, sizeof(info));
1083 	info.id = control->id;
1084 	ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
1085 	if (ret < 0)
1086 		return ret;
1087 #endif
1088 
1089 	if (!snd_ctl_skip_validation(&info))
1090 		fill_remaining_elem_value(control, &info, pattern);
1091 	ret = kctl->get(kctl, control);
1092 	if (ret < 0)
1093 		return ret;
1094 	if (!snd_ctl_skip_validation(&info) &&
1095 	    sanity_check_elem_value(card, control, &info, pattern) < 0) {
1096 		dev_err(card->dev,
1097 			"control %i:%i:%i:%s:%i: access overflow\n",
1098 			control->id.iface, control->id.device,
1099 			control->id.subdevice, control->id.name,
1100 			control->id.index);
1101 		return -EINVAL;
1102 	}
1103 	return ret;
1104 }
1105 
1106 static int snd_ctl_elem_read_user(struct snd_card *card,
1107 				  struct snd_ctl_elem_value __user *_control)
1108 {
1109 	struct snd_ctl_elem_value *control;
1110 	int result;
1111 
1112 	control = memdup_user(_control, sizeof(*control));
1113 	if (IS_ERR(control))
1114 		return PTR_ERR(control);
1115 
1116 	result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
1117 	if (result < 0)
1118 		goto error;
1119 
1120 	down_read(&card->controls_rwsem);
1121 	result = snd_ctl_elem_read(card, control);
1122 	up_read(&card->controls_rwsem);
1123 	if (result < 0)
1124 		goto error;
1125 
1126 	if (copy_to_user(_control, control, sizeof(*control)))
1127 		result = -EFAULT;
1128  error:
1129 	kfree(control);
1130 	return result;
1131 }
1132 
1133 static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
1134 			      struct snd_ctl_elem_value *control)
1135 {
1136 	struct snd_kcontrol *kctl;
1137 	struct snd_kcontrol_volatile *vd;
1138 	unsigned int index_offset;
1139 	int result;
1140 
1141 	down_write(&card->controls_rwsem);
1142 	kctl = snd_ctl_find_id(card, &control->id);
1143 	if (kctl == NULL) {
1144 		up_write(&card->controls_rwsem);
1145 		return -ENOENT;
1146 	}
1147 
1148 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1149 	vd = &kctl->vd[index_offset];
1150 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
1151 	    (file && vd->owner && vd->owner != file)) {
1152 		up_write(&card->controls_rwsem);
1153 		return -EPERM;
1154 	}
1155 
1156 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1157 	result = kctl->put(kctl, control);
1158 	if (result < 0) {
1159 		up_write(&card->controls_rwsem);
1160 		return result;
1161 	}
1162 
1163 	if (result > 0) {
1164 		downgrade_write(&card->controls_rwsem);
1165 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
1166 		up_read(&card->controls_rwsem);
1167 	} else {
1168 		up_write(&card->controls_rwsem);
1169 	}
1170 
1171 	return 0;
1172 }
1173 
1174 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
1175 				   struct snd_ctl_elem_value __user *_control)
1176 {
1177 	struct snd_ctl_elem_value *control;
1178 	struct snd_card *card;
1179 	int result;
1180 
1181 	control = memdup_user(_control, sizeof(*control));
1182 	if (IS_ERR(control))
1183 		return PTR_ERR(control);
1184 
1185 	card = file->card;
1186 	result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
1187 	if (result < 0)
1188 		goto error;
1189 
1190 	result = snd_ctl_elem_write(card, file, control);
1191 	if (result < 0)
1192 		goto error;
1193 
1194 	if (copy_to_user(_control, control, sizeof(*control)))
1195 		result = -EFAULT;
1196  error:
1197 	kfree(control);
1198 	return result;
1199 }
1200 
1201 static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1202 			     struct snd_ctl_elem_id __user *_id)
1203 {
1204 	struct snd_card *card = file->card;
1205 	struct snd_ctl_elem_id id;
1206 	struct snd_kcontrol *kctl;
1207 	struct snd_kcontrol_volatile *vd;
1208 	int result;
1209 
1210 	if (copy_from_user(&id, _id, sizeof(id)))
1211 		return -EFAULT;
1212 	down_write(&card->controls_rwsem);
1213 	kctl = snd_ctl_find_id(card, &id);
1214 	if (kctl == NULL) {
1215 		result = -ENOENT;
1216 	} else {
1217 		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1218 		if (vd->owner != NULL)
1219 			result = -EBUSY;
1220 		else {
1221 			vd->owner = file;
1222 			result = 0;
1223 		}
1224 	}
1225 	up_write(&card->controls_rwsem);
1226 	return result;
1227 }
1228 
1229 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1230 			       struct snd_ctl_elem_id __user *_id)
1231 {
1232 	struct snd_card *card = file->card;
1233 	struct snd_ctl_elem_id id;
1234 	struct snd_kcontrol *kctl;
1235 	struct snd_kcontrol_volatile *vd;
1236 	int result;
1237 
1238 	if (copy_from_user(&id, _id, sizeof(id)))
1239 		return -EFAULT;
1240 	down_write(&card->controls_rwsem);
1241 	kctl = snd_ctl_find_id(card, &id);
1242 	if (kctl == NULL) {
1243 		result = -ENOENT;
1244 	} else {
1245 		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1246 		if (vd->owner == NULL)
1247 			result = -EINVAL;
1248 		else if (vd->owner != file)
1249 			result = -EPERM;
1250 		else {
1251 			vd->owner = NULL;
1252 			result = 0;
1253 		}
1254 	}
1255 	up_write(&card->controls_rwsem);
1256 	return result;
1257 }
1258 
1259 struct user_element {
1260 	struct snd_ctl_elem_info info;
1261 	struct snd_card *card;
1262 	char *elem_data;		/* element data */
1263 	unsigned long elem_data_size;	/* size of element data in bytes */
1264 	void *tlv_data;			/* TLV data */
1265 	unsigned long tlv_data_size;	/* TLV data size */
1266 	void *priv_data;		/* private data (like strings for enumerated type) */
1267 };
1268 
1269 // check whether the addition (in bytes) of user ctl element may overflow the limit.
1270 static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
1271 {
1272 	return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
1273 }
1274 
1275 static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1276 				  struct snd_ctl_elem_info *uinfo)
1277 {
1278 	struct user_element *ue = kcontrol->private_data;
1279 	unsigned int offset;
1280 
1281 	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1282 	*uinfo = ue->info;
1283 	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1284 
1285 	return 0;
1286 }
1287 
1288 static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1289 				       struct snd_ctl_elem_info *uinfo)
1290 {
1291 	struct user_element *ue = kcontrol->private_data;
1292 	const char *names;
1293 	unsigned int item;
1294 	unsigned int offset;
1295 
1296 	item = uinfo->value.enumerated.item;
1297 
1298 	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1299 	*uinfo = ue->info;
1300 	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1301 
1302 	item = min(item, uinfo->value.enumerated.items - 1);
1303 	uinfo->value.enumerated.item = item;
1304 
1305 	names = ue->priv_data;
1306 	for (; item > 0; --item)
1307 		names += strlen(names) + 1;
1308 	strcpy(uinfo->value.enumerated.name, names);
1309 
1310 	return 0;
1311 }
1312 
1313 static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1314 				 struct snd_ctl_elem_value *ucontrol)
1315 {
1316 	struct user_element *ue = kcontrol->private_data;
1317 	unsigned int size = ue->elem_data_size;
1318 	char *src = ue->elem_data +
1319 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1320 
1321 	memcpy(&ucontrol->value, src, size);
1322 	return 0;
1323 }
1324 
1325 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1326 				 struct snd_ctl_elem_value *ucontrol)
1327 {
1328 	int change;
1329 	struct user_element *ue = kcontrol->private_data;
1330 	unsigned int size = ue->elem_data_size;
1331 	char *dst = ue->elem_data +
1332 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1333 
1334 	change = memcmp(&ucontrol->value, dst, size) != 0;
1335 	if (change)
1336 		memcpy(dst, &ucontrol->value, size);
1337 	return change;
1338 }
1339 
1340 /* called in controls_rwsem write lock */
1341 static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1342 			    unsigned int size)
1343 {
1344 	struct user_element *ue = kctl->private_data;
1345 	unsigned int *container;
1346 	unsigned int mask = 0;
1347 	int i;
1348 	int change;
1349 
1350 	if (size > 1024 * 128)	/* sane value */
1351 		return -EINVAL;
1352 
1353 	// does the TLV size change cause overflow?
1354 	if (check_user_elem_overflow(ue->card, (ssize_t)(size - ue->tlv_data_size)))
1355 		return -ENOMEM;
1356 
1357 	container = vmemdup_user(buf, size);
1358 	if (IS_ERR(container))
1359 		return PTR_ERR(container);
1360 
1361 	change = ue->tlv_data_size != size;
1362 	if (!change)
1363 		change = memcmp(ue->tlv_data, container, size) != 0;
1364 	if (!change) {
1365 		kvfree(container);
1366 		return 0;
1367 	}
1368 
1369 	if (ue->tlv_data == NULL) {
1370 		/* Now TLV data is available. */
1371 		for (i = 0; i < kctl->count; ++i)
1372 			kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
1373 		mask = SNDRV_CTL_EVENT_MASK_INFO;
1374 	} else {
1375 		ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1376 		ue->tlv_data_size = 0;
1377 		kvfree(ue->tlv_data);
1378 	}
1379 
1380 	ue->tlv_data = container;
1381 	ue->tlv_data_size = size;
1382 	// decremented at private_free.
1383 	ue->card->user_ctl_alloc_size += size;
1384 
1385 	mask |= SNDRV_CTL_EVENT_MASK_TLV;
1386 	for (i = 0; i < kctl->count; ++i)
1387 		snd_ctl_notify_one(ue->card, mask, kctl, i);
1388 
1389 	return change;
1390 }
1391 
1392 static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1393 			 unsigned int size)
1394 {
1395 	struct user_element *ue = kctl->private_data;
1396 
1397 	if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
1398 		return -ENXIO;
1399 
1400 	if (size < ue->tlv_data_size)
1401 		return -ENOSPC;
1402 
1403 	if (copy_to_user(buf, ue->tlv_data, ue->tlv_data_size))
1404 		return -EFAULT;
1405 
1406 	return 0;
1407 }
1408 
1409 static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
1410 				 unsigned int size, unsigned int __user *buf)
1411 {
1412 	if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
1413 		return replace_user_tlv(kctl, buf, size);
1414 	else
1415 		return read_user_tlv(kctl, buf, size);
1416 }
1417 
1418 /* called in controls_rwsem write lock */
1419 static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1420 {
1421 	char *names, *p;
1422 	size_t buf_len, name_len;
1423 	unsigned int i;
1424 	const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1425 
1426 	buf_len = ue->info.value.enumerated.names_length;
1427 	if (buf_len > 64 * 1024)
1428 		return -EINVAL;
1429 
1430 	if (check_user_elem_overflow(ue->card, buf_len))
1431 		return -ENOMEM;
1432 	names = vmemdup_user((const void __user *)user_ptrval, buf_len);
1433 	if (IS_ERR(names))
1434 		return PTR_ERR(names);
1435 
1436 	/* check that there are enough valid names */
1437 	p = names;
1438 	for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1439 		name_len = strnlen(p, buf_len);
1440 		if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1441 			kvfree(names);
1442 			return -EINVAL;
1443 		}
1444 		p += name_len + 1;
1445 		buf_len -= name_len + 1;
1446 	}
1447 
1448 	ue->priv_data = names;
1449 	ue->info.value.enumerated.names_ptr = 0;
1450 	// increment the allocation size; decremented again at private_free.
1451 	ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
1452 
1453 	return 0;
1454 }
1455 
1456 static size_t compute_user_elem_size(size_t size, unsigned int count)
1457 {
1458 	return sizeof(struct user_element) + size * count;
1459 }
1460 
1461 static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1462 {
1463 	struct user_element *ue = kcontrol->private_data;
1464 
1465 	// decrement the allocation size.
1466 	ue->card->user_ctl_alloc_size -= compute_user_elem_size(ue->elem_data_size, kcontrol->count);
1467 	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1468 	if (ue->priv_data)
1469 		ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
1470 
1471 	kvfree(ue->tlv_data);
1472 	kvfree(ue->priv_data);
1473 	kfree(ue);
1474 }
1475 
1476 static int snd_ctl_elem_add(struct snd_ctl_file *file,
1477 			    struct snd_ctl_elem_info *info, int replace)
1478 {
1479 	struct snd_card *card = file->card;
1480 	struct snd_kcontrol *kctl;
1481 	unsigned int count;
1482 	unsigned int access;
1483 	long private_size;
1484 	size_t alloc_size;
1485 	struct user_element *ue;
1486 	unsigned int offset;
1487 	int err;
1488 
1489 	if (!*info->id.name)
1490 		return -EINVAL;
1491 	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
1492 		return -EINVAL;
1493 
1494 	/* Delete a control to replace them if needed. */
1495 	if (replace) {
1496 		info->id.numid = 0;
1497 		err = snd_ctl_remove_user_ctl(file, &info->id);
1498 		if (err)
1499 			return err;
1500 	}
1501 
1502 	/* Check the number of elements for this userspace control. */
1503 	count = info->owner;
1504 	if (count == 0)
1505 		count = 1;
1506 
1507 	/* Arrange access permissions if needed. */
1508 	access = info->access;
1509 	if (access == 0)
1510 		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1511 	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1512 		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1513 		   SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
1514 
1515 	/* In initial state, nothing is available as TLV container. */
1516 	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1517 		access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1518 	access |= SNDRV_CTL_ELEM_ACCESS_USER;
1519 
1520 	/*
1521 	 * Check information and calculate the size of data specific to
1522 	 * this userspace control.
1523 	 */
1524 	/* pass NULL to card for suppressing error messages */
1525 	err = snd_ctl_check_elem_info(NULL, info);
1526 	if (err < 0)
1527 		return err;
1528 	/* user-space control doesn't allow zero-size data */
1529 	if (info->count < 1)
1530 		return -EINVAL;
1531 	private_size = value_sizes[info->type] * info->count;
1532 	alloc_size = compute_user_elem_size(private_size, count);
1533 
1534 	down_write(&card->controls_rwsem);
1535 	if (check_user_elem_overflow(card, alloc_size)) {
1536 		err = -ENOMEM;
1537 		goto unlock;
1538 	}
1539 
1540 	/*
1541 	 * Keep memory object for this userspace control. After passing this
1542 	 * code block, the instance should be freed by snd_ctl_free_one().
1543 	 *
1544 	 * Note that these elements in this control are locked.
1545 	 */
1546 	err = snd_ctl_new(&kctl, count, access, file);
1547 	if (err < 0)
1548 		goto unlock;
1549 	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1550 	ue = kzalloc(alloc_size, GFP_KERNEL);
1551 	if (!ue) {
1552 		kfree(kctl);
1553 		err = -ENOMEM;
1554 		goto unlock;
1555 	}
1556 	kctl->private_data = ue;
1557 	kctl->private_free = snd_ctl_elem_user_free;
1558 
1559 	// increment the allocated size; decremented again at private_free.
1560 	card->user_ctl_alloc_size += alloc_size;
1561 
1562 	/* Set private data for this userspace control. */
1563 	ue->card = card;
1564 	ue->info = *info;
1565 	ue->info.access = 0;
1566 	ue->elem_data = (char *)ue + sizeof(*ue);
1567 	ue->elem_data_size = private_size;
1568 	if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1569 		err = snd_ctl_elem_init_enum_names(ue);
1570 		if (err < 0) {
1571 			snd_ctl_free_one(kctl);
1572 			goto unlock;
1573 		}
1574 	}
1575 
1576 	/* Set callback functions. */
1577 	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1578 		kctl->info = snd_ctl_elem_user_enum_info;
1579 	else
1580 		kctl->info = snd_ctl_elem_user_info;
1581 	if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1582 		kctl->get = snd_ctl_elem_user_get;
1583 	if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1584 		kctl->put = snd_ctl_elem_user_put;
1585 	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1586 		kctl->tlv.c = snd_ctl_elem_user_tlv;
1587 
1588 	/* This function manage to free the instance on failure. */
1589 	err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
1590 	if (err < 0) {
1591 		snd_ctl_free_one(kctl);
1592 		goto unlock;
1593 	}
1594 	offset = snd_ctl_get_ioff(kctl, &info->id);
1595 	snd_ctl_build_ioff(&info->id, kctl, offset);
1596 	/*
1597 	 * Here we cannot fill any field for the number of elements added by
1598 	 * this operation because there're no specific fields. The usage of
1599 	 * 'owner' field for this purpose may cause any bugs to userspace
1600 	 * applications because the field originally means PID of a process
1601 	 * which locks the element.
1602 	 */
1603  unlock:
1604 	up_write(&card->controls_rwsem);
1605 	return err;
1606 }
1607 
1608 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1609 				 struct snd_ctl_elem_info __user *_info, int replace)
1610 {
1611 	struct snd_ctl_elem_info info;
1612 	int err;
1613 
1614 	if (copy_from_user(&info, _info, sizeof(info)))
1615 		return -EFAULT;
1616 	err = snd_ctl_elem_add(file, &info, replace);
1617 	if (err < 0)
1618 		return err;
1619 	if (copy_to_user(_info, &info, sizeof(info))) {
1620 		snd_ctl_remove_user_ctl(file, &info.id);
1621 		return -EFAULT;
1622 	}
1623 
1624 	return 0;
1625 }
1626 
1627 static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1628 			       struct snd_ctl_elem_id __user *_id)
1629 {
1630 	struct snd_ctl_elem_id id;
1631 
1632 	if (copy_from_user(&id, _id, sizeof(id)))
1633 		return -EFAULT;
1634 	return snd_ctl_remove_user_ctl(file, &id);
1635 }
1636 
1637 static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1638 {
1639 	int subscribe;
1640 	if (get_user(subscribe, ptr))
1641 		return -EFAULT;
1642 	if (subscribe < 0) {
1643 		subscribe = file->subscribed;
1644 		if (put_user(subscribe, ptr))
1645 			return -EFAULT;
1646 		return 0;
1647 	}
1648 	if (subscribe) {
1649 		file->subscribed = 1;
1650 		return 0;
1651 	} else if (file->subscribed) {
1652 		snd_ctl_empty_read_queue(file);
1653 		file->subscribed = 0;
1654 	}
1655 	return 0;
1656 }
1657 
1658 static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
1659 			    struct snd_kcontrol *kctl,
1660 			    struct snd_ctl_elem_id *id,
1661 			    unsigned int __user *buf, unsigned int size)
1662 {
1663 	static const struct {
1664 		int op;
1665 		int perm;
1666 	} pairs[] = {
1667 		{SNDRV_CTL_TLV_OP_READ,  SNDRV_CTL_ELEM_ACCESS_TLV_READ},
1668 		{SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
1669 		{SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
1670 	};
1671 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1672 	int i;
1673 
1674 	/* Check support of the request for this element. */
1675 	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
1676 		if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
1677 			break;
1678 	}
1679 	if (i == ARRAY_SIZE(pairs))
1680 		return -ENXIO;
1681 
1682 	if (kctl->tlv.c == NULL)
1683 		return -ENXIO;
1684 
1685 	/* Write and command operations are not allowed for locked element. */
1686 	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
1687 	    vd->owner != NULL && vd->owner != file)
1688 		return -EPERM;
1689 
1690 	return kctl->tlv.c(kctl, op_flag, size, buf);
1691 }
1692 
1693 static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
1694 			unsigned int __user *buf, unsigned int size)
1695 {
1696 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1697 	unsigned int len;
1698 
1699 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
1700 		return -ENXIO;
1701 
1702 	if (kctl->tlv.p == NULL)
1703 		return -ENXIO;
1704 
1705 	len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
1706 	if (size < len)
1707 		return -ENOMEM;
1708 
1709 	if (copy_to_user(buf, kctl->tlv.p, len))
1710 		return -EFAULT;
1711 
1712 	return 0;
1713 }
1714 
1715 static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1716 			     struct snd_ctl_tlv __user *buf,
1717                              int op_flag)
1718 {
1719 	struct snd_ctl_tlv header;
1720 	unsigned int __user *container;
1721 	unsigned int container_size;
1722 	struct snd_kcontrol *kctl;
1723 	struct snd_ctl_elem_id id;
1724 	struct snd_kcontrol_volatile *vd;
1725 
1726 	if (copy_from_user(&header, buf, sizeof(header)))
1727 		return -EFAULT;
1728 
1729 	/* In design of control core, numerical ID starts at 1. */
1730 	if (header.numid == 0)
1731 		return -EINVAL;
1732 
1733 	/* At least, container should include type and length fields.  */
1734 	if (header.length < sizeof(unsigned int) * 2)
1735 		return -EINVAL;
1736 	container_size = header.length;
1737 	container = buf->tlv;
1738 
1739 	kctl = snd_ctl_find_numid(file->card, header.numid);
1740 	if (kctl == NULL)
1741 		return -ENOENT;
1742 
1743 	/* Calculate index of the element in this set. */
1744 	id = kctl->id;
1745 	snd_ctl_build_ioff(&id, kctl, header.numid - id.numid);
1746 	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1747 
1748 	if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1749 		return call_tlv_handler(file, op_flag, kctl, &id, container,
1750 					container_size);
1751 	} else {
1752 		if (op_flag == SNDRV_CTL_TLV_OP_READ) {
1753 			return read_tlv_buf(kctl, &id, container,
1754 					    container_size);
1755 		}
1756 	}
1757 
1758 	/* Not supported. */
1759 	return -ENXIO;
1760 }
1761 
1762 static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1763 {
1764 	struct snd_ctl_file *ctl;
1765 	struct snd_card *card;
1766 	struct snd_kctl_ioctl *p;
1767 	void __user *argp = (void __user *)arg;
1768 	int __user *ip = argp;
1769 	int err;
1770 
1771 	ctl = file->private_data;
1772 	card = ctl->card;
1773 	if (snd_BUG_ON(!card))
1774 		return -ENXIO;
1775 	switch (cmd) {
1776 	case SNDRV_CTL_IOCTL_PVERSION:
1777 		return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1778 	case SNDRV_CTL_IOCTL_CARD_INFO:
1779 		return snd_ctl_card_info(card, ctl, cmd, argp);
1780 	case SNDRV_CTL_IOCTL_ELEM_LIST:
1781 		return snd_ctl_elem_list_user(card, argp);
1782 	case SNDRV_CTL_IOCTL_ELEM_INFO:
1783 		return snd_ctl_elem_info_user(ctl, argp);
1784 	case SNDRV_CTL_IOCTL_ELEM_READ:
1785 		return snd_ctl_elem_read_user(card, argp);
1786 	case SNDRV_CTL_IOCTL_ELEM_WRITE:
1787 		return snd_ctl_elem_write_user(ctl, argp);
1788 	case SNDRV_CTL_IOCTL_ELEM_LOCK:
1789 		return snd_ctl_elem_lock(ctl, argp);
1790 	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1791 		return snd_ctl_elem_unlock(ctl, argp);
1792 	case SNDRV_CTL_IOCTL_ELEM_ADD:
1793 		return snd_ctl_elem_add_user(ctl, argp, 0);
1794 	case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1795 		return snd_ctl_elem_add_user(ctl, argp, 1);
1796 	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1797 		return snd_ctl_elem_remove(ctl, argp);
1798 	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1799 		return snd_ctl_subscribe_events(ctl, ip);
1800 	case SNDRV_CTL_IOCTL_TLV_READ:
1801 		down_read(&ctl->card->controls_rwsem);
1802 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
1803 		up_read(&ctl->card->controls_rwsem);
1804 		return err;
1805 	case SNDRV_CTL_IOCTL_TLV_WRITE:
1806 		down_write(&ctl->card->controls_rwsem);
1807 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
1808 		up_write(&ctl->card->controls_rwsem);
1809 		return err;
1810 	case SNDRV_CTL_IOCTL_TLV_COMMAND:
1811 		down_write(&ctl->card->controls_rwsem);
1812 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
1813 		up_write(&ctl->card->controls_rwsem);
1814 		return err;
1815 	case SNDRV_CTL_IOCTL_POWER:
1816 		return -ENOPROTOOPT;
1817 	case SNDRV_CTL_IOCTL_POWER_STATE:
1818 #ifdef CONFIG_PM
1819 		return put_user(card->power_state, ip) ? -EFAULT : 0;
1820 #else
1821 		return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1822 #endif
1823 	}
1824 	down_read(&snd_ioctl_rwsem);
1825 	list_for_each_entry(p, &snd_control_ioctls, list) {
1826 		err = p->fioctl(card, ctl, cmd, arg);
1827 		if (err != -ENOIOCTLCMD) {
1828 			up_read(&snd_ioctl_rwsem);
1829 			return err;
1830 		}
1831 	}
1832 	up_read(&snd_ioctl_rwsem);
1833 	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
1834 	return -ENOTTY;
1835 }
1836 
1837 static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1838 			    size_t count, loff_t * offset)
1839 {
1840 	struct snd_ctl_file *ctl;
1841 	int err = 0;
1842 	ssize_t result = 0;
1843 
1844 	ctl = file->private_data;
1845 	if (snd_BUG_ON(!ctl || !ctl->card))
1846 		return -ENXIO;
1847 	if (!ctl->subscribed)
1848 		return -EBADFD;
1849 	if (count < sizeof(struct snd_ctl_event))
1850 		return -EINVAL;
1851 	spin_lock_irq(&ctl->read_lock);
1852 	while (count >= sizeof(struct snd_ctl_event)) {
1853 		struct snd_ctl_event ev;
1854 		struct snd_kctl_event *kev;
1855 		while (list_empty(&ctl->events)) {
1856 			wait_queue_entry_t wait;
1857 			if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
1858 				err = -EAGAIN;
1859 				goto __end_lock;
1860 			}
1861 			init_waitqueue_entry(&wait, current);
1862 			add_wait_queue(&ctl->change_sleep, &wait);
1863 			set_current_state(TASK_INTERRUPTIBLE);
1864 			spin_unlock_irq(&ctl->read_lock);
1865 			schedule();
1866 			remove_wait_queue(&ctl->change_sleep, &wait);
1867 			if (ctl->card->shutdown)
1868 				return -ENODEV;
1869 			if (signal_pending(current))
1870 				return -ERESTARTSYS;
1871 			spin_lock_irq(&ctl->read_lock);
1872 		}
1873 		kev = snd_kctl_event(ctl->events.next);
1874 		ev.type = SNDRV_CTL_EVENT_ELEM;
1875 		ev.data.elem.mask = kev->mask;
1876 		ev.data.elem.id = kev->id;
1877 		list_del(&kev->list);
1878 		spin_unlock_irq(&ctl->read_lock);
1879 		kfree(kev);
1880 		if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
1881 			err = -EFAULT;
1882 			goto __end;
1883 		}
1884 		spin_lock_irq(&ctl->read_lock);
1885 		buffer += sizeof(struct snd_ctl_event);
1886 		count -= sizeof(struct snd_ctl_event);
1887 		result += sizeof(struct snd_ctl_event);
1888 	}
1889       __end_lock:
1890 	spin_unlock_irq(&ctl->read_lock);
1891       __end:
1892       	return result > 0 ? result : err;
1893 }
1894 
1895 static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
1896 {
1897 	__poll_t mask;
1898 	struct snd_ctl_file *ctl;
1899 
1900 	ctl = file->private_data;
1901 	if (!ctl->subscribed)
1902 		return 0;
1903 	poll_wait(file, &ctl->change_sleep, wait);
1904 
1905 	mask = 0;
1906 	if (!list_empty(&ctl->events))
1907 		mask |= EPOLLIN | EPOLLRDNORM;
1908 
1909 	return mask;
1910 }
1911 
1912 /*
1913  * register the device-specific control-ioctls.
1914  * called from each device manager like pcm.c, hwdep.c, etc.
1915  */
1916 static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
1917 {
1918 	struct snd_kctl_ioctl *pn;
1919 
1920 	pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
1921 	if (pn == NULL)
1922 		return -ENOMEM;
1923 	pn->fioctl = fcn;
1924 	down_write(&snd_ioctl_rwsem);
1925 	list_add_tail(&pn->list, lists);
1926 	up_write(&snd_ioctl_rwsem);
1927 	return 0;
1928 }
1929 
1930 /**
1931  * snd_ctl_register_ioctl - register the device-specific control-ioctls
1932  * @fcn: ioctl callback function
1933  *
1934  * called from each device manager like pcm.c, hwdep.c, etc.
1935  */
1936 int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
1937 {
1938 	return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
1939 }
1940 EXPORT_SYMBOL(snd_ctl_register_ioctl);
1941 
1942 #ifdef CONFIG_COMPAT
1943 /**
1944  * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
1945  * control-ioctls
1946  * @fcn: ioctl callback function
1947  */
1948 int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1949 {
1950 	return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
1951 }
1952 EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
1953 #endif
1954 
1955 /*
1956  * de-register the device-specific control-ioctls.
1957  */
1958 static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
1959 				     struct list_head *lists)
1960 {
1961 	struct snd_kctl_ioctl *p;
1962 
1963 	if (snd_BUG_ON(!fcn))
1964 		return -EINVAL;
1965 	down_write(&snd_ioctl_rwsem);
1966 	list_for_each_entry(p, lists, list) {
1967 		if (p->fioctl == fcn) {
1968 			list_del(&p->list);
1969 			up_write(&snd_ioctl_rwsem);
1970 			kfree(p);
1971 			return 0;
1972 		}
1973 	}
1974 	up_write(&snd_ioctl_rwsem);
1975 	snd_BUG();
1976 	return -EINVAL;
1977 }
1978 
1979 /**
1980  * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
1981  * @fcn: ioctl callback function to unregister
1982  */
1983 int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
1984 {
1985 	return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
1986 }
1987 EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
1988 
1989 #ifdef CONFIG_COMPAT
1990 /**
1991  * snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
1992  * 32bit control-ioctls
1993  * @fcn: ioctl callback function to unregister
1994  */
1995 int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1996 {
1997 	return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
1998 }
1999 EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
2000 #endif
2001 
2002 static int snd_ctl_fasync(int fd, struct file * file, int on)
2003 {
2004 	struct snd_ctl_file *ctl;
2005 
2006 	ctl = file->private_data;
2007 	return fasync_helper(fd, file, on, &ctl->fasync);
2008 }
2009 
2010 /* return the preferred subdevice number if already assigned;
2011  * otherwise return -1
2012  */
2013 int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
2014 {
2015 	struct snd_ctl_file *kctl;
2016 	int subdevice = -1;
2017 	unsigned long flags;
2018 
2019 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
2020 	list_for_each_entry(kctl, &card->ctl_files, list) {
2021 		if (kctl->pid == task_pid(current)) {
2022 			subdevice = kctl->preferred_subdevice[type];
2023 			if (subdevice != -1)
2024 				break;
2025 		}
2026 	}
2027 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
2028 	return subdevice;
2029 }
2030 EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
2031 
2032 /*
2033  * ioctl32 compat
2034  */
2035 #ifdef CONFIG_COMPAT
2036 #include "control_compat.c"
2037 #else
2038 #define snd_ctl_ioctl_compat	NULL
2039 #endif
2040 
2041 /*
2042  * control layers (audio LED etc.)
2043  */
2044 
2045 /**
2046  * snd_ctl_request_layer - request to use the layer
2047  * @module_name: Name of the kernel module (NULL == build-in)
2048  *
2049  * Return an error code when the module cannot be loaded.
2050  */
2051 int snd_ctl_request_layer(const char *module_name)
2052 {
2053 	struct snd_ctl_layer_ops *lops;
2054 
2055 	if (module_name == NULL)
2056 		return 0;
2057 	down_read(&snd_ctl_layer_rwsem);
2058 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2059 		if (strcmp(lops->module_name, module_name) == 0)
2060 			break;
2061 	up_read(&snd_ctl_layer_rwsem);
2062 	if (lops)
2063 		return 0;
2064 	return request_module(module_name);
2065 }
2066 EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
2067 
2068 /**
2069  * snd_ctl_register_layer - register new control layer
2070  * @lops: operation structure
2071  *
2072  * The new layer can track all control elements and do additional
2073  * operations on top (like audio LED handling).
2074  */
2075 void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
2076 {
2077 	struct snd_card *card;
2078 	int card_number;
2079 
2080 	down_write(&snd_ctl_layer_rwsem);
2081 	lops->next = snd_ctl_layer;
2082 	snd_ctl_layer = lops;
2083 	up_write(&snd_ctl_layer_rwsem);
2084 	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
2085 		card = snd_card_ref(card_number);
2086 		if (card) {
2087 			down_read(&card->controls_rwsem);
2088 			lops->lregister(card);
2089 			up_read(&card->controls_rwsem);
2090 			snd_card_unref(card);
2091 		}
2092 	}
2093 }
2094 EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
2095 
2096 /**
2097  * snd_ctl_disconnect_layer - disconnect control layer
2098  * @lops: operation structure
2099  *
2100  * It is expected that the information about tracked cards
2101  * is freed before this call (the disconnect callback is
2102  * not called here).
2103  */
2104 void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
2105 {
2106 	struct snd_ctl_layer_ops *lops2, *prev_lops2;
2107 
2108 	down_write(&snd_ctl_layer_rwsem);
2109 	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
2110 		if (lops2 == lops) {
2111 			if (!prev_lops2)
2112 				snd_ctl_layer = lops->next;
2113 			else
2114 				prev_lops2->next = lops->next;
2115 			break;
2116 		}
2117 		prev_lops2 = lops2;
2118 	}
2119 	up_write(&snd_ctl_layer_rwsem);
2120 }
2121 EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
2122 
2123 /*
2124  *  INIT PART
2125  */
2126 
2127 static const struct file_operations snd_ctl_f_ops =
2128 {
2129 	.owner =	THIS_MODULE,
2130 	.read =		snd_ctl_read,
2131 	.open =		snd_ctl_open,
2132 	.release =	snd_ctl_release,
2133 	.llseek =	no_llseek,
2134 	.poll =		snd_ctl_poll,
2135 	.unlocked_ioctl =	snd_ctl_ioctl,
2136 	.compat_ioctl =	snd_ctl_ioctl_compat,
2137 	.fasync =	snd_ctl_fasync,
2138 };
2139 
2140 /*
2141  * registration of the control device
2142  */
2143 static int snd_ctl_dev_register(struct snd_device *device)
2144 {
2145 	struct snd_card *card = device->device_data;
2146 	struct snd_ctl_layer_ops *lops;
2147 	int err;
2148 
2149 	err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
2150 				  &snd_ctl_f_ops, card, &card->ctl_dev);
2151 	if (err < 0)
2152 		return err;
2153 	down_read(&card->controls_rwsem);
2154 	down_read(&snd_ctl_layer_rwsem);
2155 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2156 		lops->lregister(card);
2157 	up_read(&snd_ctl_layer_rwsem);
2158 	up_read(&card->controls_rwsem);
2159 	return 0;
2160 }
2161 
2162 /*
2163  * disconnection of the control device
2164  */
2165 static int snd_ctl_dev_disconnect(struct snd_device *device)
2166 {
2167 	struct snd_card *card = device->device_data;
2168 	struct snd_ctl_file *ctl;
2169 	struct snd_ctl_layer_ops *lops;
2170 	unsigned long flags;
2171 
2172 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
2173 	list_for_each_entry(ctl, &card->ctl_files, list) {
2174 		wake_up(&ctl->change_sleep);
2175 		kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
2176 	}
2177 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
2178 
2179 	down_read(&card->controls_rwsem);
2180 	down_read(&snd_ctl_layer_rwsem);
2181 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2182 		lops->ldisconnect(card);
2183 	up_read(&snd_ctl_layer_rwsem);
2184 	up_read(&card->controls_rwsem);
2185 
2186 	return snd_unregister_device(&card->ctl_dev);
2187 }
2188 
2189 /*
2190  * free all controls
2191  */
2192 static int snd_ctl_dev_free(struct snd_device *device)
2193 {
2194 	struct snd_card *card = device->device_data;
2195 	struct snd_kcontrol *control;
2196 
2197 	down_write(&card->controls_rwsem);
2198 	while (!list_empty(&card->controls)) {
2199 		control = snd_kcontrol(card->controls.next);
2200 		snd_ctl_remove(card, control);
2201 	}
2202 	up_write(&card->controls_rwsem);
2203 	put_device(&card->ctl_dev);
2204 	return 0;
2205 }
2206 
2207 /*
2208  * create control core:
2209  * called from init.c
2210  */
2211 int snd_ctl_create(struct snd_card *card)
2212 {
2213 	static const struct snd_device_ops ops = {
2214 		.dev_free = snd_ctl_dev_free,
2215 		.dev_register =	snd_ctl_dev_register,
2216 		.dev_disconnect = snd_ctl_dev_disconnect,
2217 	};
2218 	int err;
2219 
2220 	if (snd_BUG_ON(!card))
2221 		return -ENXIO;
2222 	if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
2223 		return -ENXIO;
2224 
2225 	snd_device_initialize(&card->ctl_dev, card);
2226 	dev_set_name(&card->ctl_dev, "controlC%d", card->number);
2227 
2228 	err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
2229 	if (err < 0)
2230 		put_device(&card->ctl_dev);
2231 	return err;
2232 }
2233 
2234 /*
2235  * Frequently used control callbacks/helpers
2236  */
2237 
2238 /**
2239  * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
2240  * callback with a mono channel
2241  * @kcontrol: the kcontrol instance
2242  * @uinfo: info to store
2243  *
2244  * This is a function that can be used as info callback for a standard
2245  * boolean control with a single mono channel.
2246  */
2247 int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
2248 			      struct snd_ctl_elem_info *uinfo)
2249 {
2250 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2251 	uinfo->count = 1;
2252 	uinfo->value.integer.min = 0;
2253 	uinfo->value.integer.max = 1;
2254 	return 0;
2255 }
2256 EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
2257 
2258 /**
2259  * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
2260  * callback with stereo two channels
2261  * @kcontrol: the kcontrol instance
2262  * @uinfo: info to store
2263  *
2264  * This is a function that can be used as info callback for a standard
2265  * boolean control with stereo two channels.
2266  */
2267 int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
2268 				struct snd_ctl_elem_info *uinfo)
2269 {
2270 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2271 	uinfo->count = 2;
2272 	uinfo->value.integer.min = 0;
2273 	uinfo->value.integer.max = 1;
2274 	return 0;
2275 }
2276 EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
2277 
2278 /**
2279  * snd_ctl_enum_info - fills the info structure for an enumerated control
2280  * @info: the structure to be filled
2281  * @channels: the number of the control's channels; often one
2282  * @items: the number of control values; also the size of @names
2283  * @names: an array containing the names of all control values
2284  *
2285  * Sets all required fields in @info to their appropriate values.
2286  * If the control's accessibility is not the default (readable and writable),
2287  * the caller has to fill @info->access.
2288  *
2289  * Return: Zero.
2290  */
2291 int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
2292 		      unsigned int items, const char *const names[])
2293 {
2294 	info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
2295 	info->count = channels;
2296 	info->value.enumerated.items = items;
2297 	if (!items)
2298 		return 0;
2299 	if (info->value.enumerated.item >= items)
2300 		info->value.enumerated.item = items - 1;
2301 	WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
2302 	     "ALSA: too long item name '%s'\n",
2303 	     names[info->value.enumerated.item]);
2304 	strscpy(info->value.enumerated.name,
2305 		names[info->value.enumerated.item],
2306 		sizeof(info->value.enumerated.name));
2307 	return 0;
2308 }
2309 EXPORT_SYMBOL(snd_ctl_enum_info);
2310