xref: /linux/sound/core/control.c (revision 36f353a1ebf88280f58d1ebfe2731251d9159456)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Routines for driver control interface
4  *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
5  */
6 
7 #include <linux/threads.h>
8 #include <linux/interrupt.h>
9 #include <linux/module.h>
10 #include <linux/moduleparam.h>
11 #include <linux/slab.h>
12 #include <linux/vmalloc.h>
13 #include <linux/time.h>
14 #include <linux/mm.h>
15 #include <linux/math64.h>
16 #include <linux/sched/signal.h>
17 #include <sound/core.h>
18 #include <sound/minors.h>
19 #include <sound/info.h>
20 #include <sound/control.h>
21 
22 // Max allocation size for user controls.
23 static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
24 module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
25 MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
26 
27 #define MAX_CONTROL_COUNT	1028
28 
29 struct snd_kctl_ioctl {
30 	struct list_head list;		/* list of all ioctls */
31 	snd_kctl_ioctl_func_t fioctl;
32 };
33 
34 static DECLARE_RWSEM(snd_ioctl_rwsem);
35 static DECLARE_RWSEM(snd_ctl_layer_rwsem);
36 static LIST_HEAD(snd_control_ioctls);
37 #ifdef CONFIG_COMPAT
38 static LIST_HEAD(snd_control_compat_ioctls);
39 #endif
40 static struct snd_ctl_layer_ops *snd_ctl_layer;
41 
42 static int snd_ctl_remove_locked(struct snd_card *card,
43 				 struct snd_kcontrol *kcontrol);
44 
45 static int snd_ctl_open(struct inode *inode, struct file *file)
46 {
47 	struct snd_card *card;
48 	struct snd_ctl_file *ctl;
49 	int i, err;
50 
51 	err = stream_open(inode, file);
52 	if (err < 0)
53 		return err;
54 
55 	card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
56 	if (!card) {
57 		err = -ENODEV;
58 		goto __error1;
59 	}
60 	err = snd_card_file_add(card, file);
61 	if (err < 0) {
62 		err = -ENODEV;
63 		goto __error1;
64 	}
65 	if (!try_module_get(card->module)) {
66 		err = -EFAULT;
67 		goto __error2;
68 	}
69 	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
70 	if (ctl == NULL) {
71 		err = -ENOMEM;
72 		goto __error;
73 	}
74 	INIT_LIST_HEAD(&ctl->events);
75 	init_waitqueue_head(&ctl->change_sleep);
76 	spin_lock_init(&ctl->read_lock);
77 	ctl->card = card;
78 	for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
79 		ctl->preferred_subdevice[i] = -1;
80 	ctl->pid = get_pid(task_pid(current));
81 	file->private_data = ctl;
82 	scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock)
83 		list_add_tail(&ctl->list, &card->ctl_files);
84 	snd_card_unref(card);
85 	return 0;
86 
87       __error:
88 	module_put(card->module);
89       __error2:
90 	snd_card_file_remove(card, file);
91       __error1:
92 	if (card)
93 		snd_card_unref(card);
94       	return err;
95 }
96 
97 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
98 {
99 	struct snd_kctl_event *cread;
100 
101 	guard(spinlock_irqsave)(&ctl->read_lock);
102 	while (!list_empty(&ctl->events)) {
103 		cread = snd_kctl_event(ctl->events.next);
104 		list_del(&cread->list);
105 		kfree(cread);
106 	}
107 }
108 
109 static int snd_ctl_release(struct inode *inode, struct file *file)
110 {
111 	struct snd_card *card;
112 	struct snd_ctl_file *ctl;
113 	struct snd_kcontrol *control;
114 	unsigned int idx;
115 
116 	ctl = file->private_data;
117 	file->private_data = NULL;
118 	card = ctl->card;
119 
120 	scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock)
121 		list_del(&ctl->list);
122 
123 	scoped_guard(rwsem_write, &card->controls_rwsem) {
124 		list_for_each_entry(control, &card->controls, list)
125 			for (idx = 0; idx < control->count; idx++)
126 				if (control->vd[idx].owner == ctl)
127 					control->vd[idx].owner = NULL;
128 	}
129 
130 	snd_fasync_free(ctl->fasync);
131 	snd_ctl_empty_read_queue(ctl);
132 	put_pid(ctl->pid);
133 	kfree(ctl);
134 	module_put(card->module);
135 	snd_card_file_remove(card, file);
136 	return 0;
137 }
138 
139 /**
140  * snd_ctl_notify - Send notification to user-space for a control change
141  * @card: the card to send notification
142  * @mask: the event mask, SNDRV_CTL_EVENT_*
143  * @id: the ctl element id to send notification
144  *
145  * This function adds an event record with the given id and mask, appends
146  * to the list and wakes up the user-space for notification.  This can be
147  * called in the atomic context.
148  */
149 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
150 		    struct snd_ctl_elem_id *id)
151 {
152 	struct snd_ctl_file *ctl;
153 	struct snd_kctl_event *ev;
154 
155 	if (snd_BUG_ON(!card || !id))
156 		return;
157 	if (card->shutdown)
158 		return;
159 
160 	guard(read_lock_irqsave)(&card->ctl_files_rwlock);
161 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
162 	card->mixer_oss_change_count++;
163 #endif
164 	list_for_each_entry(ctl, &card->ctl_files, list) {
165 		if (!ctl->subscribed)
166 			continue;
167 		scoped_guard(spinlock, &ctl->read_lock) {
168 			list_for_each_entry(ev, &ctl->events, list) {
169 				if (ev->id.numid == id->numid) {
170 					ev->mask |= mask;
171 					goto _found;
172 				}
173 			}
174 			ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
175 			if (ev) {
176 				ev->id = *id;
177 				ev->mask = mask;
178 				list_add_tail(&ev->list, &ctl->events);
179 			} else {
180 				dev_err(card->dev, "No memory available to allocate event\n");
181 			}
182 _found:
183 			wake_up(&ctl->change_sleep);
184 		}
185 		snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN);
186 	}
187 }
188 EXPORT_SYMBOL(snd_ctl_notify);
189 
190 /**
191  * snd_ctl_notify_one - Send notification to user-space for a control change
192  * @card: the card to send notification
193  * @mask: the event mask, SNDRV_CTL_EVENT_*
194  * @kctl: the pointer with the control instance
195  * @ioff: the additional offset to the control index
196  *
197  * This function calls snd_ctl_notify() and does additional jobs
198  * like LED state changes.
199  */
200 void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
201 			struct snd_kcontrol *kctl, unsigned int ioff)
202 {
203 	struct snd_ctl_elem_id id = kctl->id;
204 	struct snd_ctl_layer_ops *lops;
205 
206 	id.index += ioff;
207 	id.numid += ioff;
208 	snd_ctl_notify(card, mask, &id);
209 	guard(rwsem_read)(&snd_ctl_layer_rwsem);
210 	for (lops = snd_ctl_layer; lops; lops = lops->next)
211 		lops->lnotify(card, mask, kctl, ioff);
212 }
213 EXPORT_SYMBOL(snd_ctl_notify_one);
214 
215 /**
216  * snd_ctl_new - create a new control instance with some elements
217  * @kctl: the pointer to store new control instance
218  * @count: the number of elements in this control
219  * @access: the default access flags for elements in this control
220  * @file: given when locking these elements
221  *
222  * Allocates a memory object for a new control instance. The instance has
223  * elements as many as the given number (@count). Each element has given
224  * access permissions (@access). Each element is locked when @file is given.
225  *
226  * Return: 0 on success, error code on failure
227  */
228 static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
229 		       unsigned int access, struct snd_ctl_file *file)
230 {
231 	unsigned int idx;
232 
233 	if (count == 0 || count > MAX_CONTROL_COUNT)
234 		return -EINVAL;
235 
236 	*kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
237 	if (!*kctl)
238 		return -ENOMEM;
239 
240 	for (idx = 0; idx < count; idx++) {
241 		(*kctl)->vd[idx].access = access;
242 		(*kctl)->vd[idx].owner = file;
243 	}
244 	(*kctl)->count = count;
245 
246 	return 0;
247 }
248 
249 /**
250  * snd_ctl_new1 - create a control instance from the template
251  * @ncontrol: the initialization record
252  * @private_data: the private data to set
253  *
254  * Allocates a new struct snd_kcontrol instance and initialize from the given
255  * template.  When the access field of ncontrol is 0, it's assumed as
256  * READWRITE access. When the count field is 0, it's assumes as one.
257  *
258  * Return: The pointer of the newly generated instance, or %NULL on failure.
259  */
260 struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
261 				  void *private_data)
262 {
263 	struct snd_kcontrol *kctl;
264 	unsigned int count;
265 	unsigned int access;
266 	int err;
267 
268 	if (snd_BUG_ON(!ncontrol || !ncontrol->info))
269 		return NULL;
270 
271 	count = ncontrol->count;
272 	if (count == 0)
273 		count = 1;
274 
275 	access = ncontrol->access;
276 	if (access == 0)
277 		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
278 	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
279 		   SNDRV_CTL_ELEM_ACCESS_VOLATILE |
280 		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
281 		   SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
282 		   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
283 		   SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
284 		   SNDRV_CTL_ELEM_ACCESS_LED_MASK |
285 		   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
286 
287 	err = snd_ctl_new(&kctl, count, access, NULL);
288 	if (err < 0)
289 		return NULL;
290 
291 	/* The 'numid' member is decided when calling snd_ctl_add(). */
292 	kctl->id.iface = ncontrol->iface;
293 	kctl->id.device = ncontrol->device;
294 	kctl->id.subdevice = ncontrol->subdevice;
295 	if (ncontrol->name) {
296 		strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
297 		if (strcmp(ncontrol->name, kctl->id.name) != 0)
298 			pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
299 				ncontrol->name, kctl->id.name);
300 	}
301 	kctl->id.index = ncontrol->index;
302 
303 	kctl->info = ncontrol->info;
304 	kctl->get = ncontrol->get;
305 	kctl->put = ncontrol->put;
306 	kctl->tlv.p = ncontrol->tlv.p;
307 
308 	kctl->private_value = ncontrol->private_value;
309 	kctl->private_data = private_data;
310 
311 	return kctl;
312 }
313 EXPORT_SYMBOL(snd_ctl_new1);
314 
315 /**
316  * snd_ctl_free_one - release the control instance
317  * @kcontrol: the control instance
318  *
319  * Releases the control instance created via snd_ctl_new()
320  * or snd_ctl_new1().
321  * Don't call this after the control was added to the card.
322  */
323 void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
324 {
325 	if (kcontrol) {
326 		if (kcontrol->private_free)
327 			kcontrol->private_free(kcontrol);
328 		kfree(kcontrol);
329 	}
330 }
331 EXPORT_SYMBOL(snd_ctl_free_one);
332 
333 static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
334 					  unsigned int count)
335 {
336 	struct snd_kcontrol *kctl;
337 
338 	/* Make sure that the ids assigned to the control do not wrap around */
339 	if (card->last_numid >= UINT_MAX - count)
340 		card->last_numid = 0;
341 
342 	list_for_each_entry(kctl, &card->controls, list) {
343 		if (kctl->id.numid < card->last_numid + 1 + count &&
344 		    kctl->id.numid + kctl->count > card->last_numid + 1) {
345 		    	card->last_numid = kctl->id.numid + kctl->count - 1;
346 			return true;
347 		}
348 	}
349 	return false;
350 }
351 
352 static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
353 {
354 	unsigned int iter = 100000;
355 
356 	while (snd_ctl_remove_numid_conflict(card, count)) {
357 		if (--iter == 0) {
358 			/* this situation is very unlikely */
359 			dev_err(card->dev, "unable to allocate new control numid\n");
360 			return -ENOMEM;
361 		}
362 	}
363 	return 0;
364 }
365 
366 /* check whether the given id is contained in the given kctl */
367 static bool elem_id_matches(const struct snd_kcontrol *kctl,
368 			    const struct snd_ctl_elem_id *id)
369 {
370 	return kctl->id.iface == id->iface &&
371 		kctl->id.device == id->device &&
372 		kctl->id.subdevice == id->subdevice &&
373 		!strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)) &&
374 		kctl->id.index <= id->index &&
375 		kctl->id.index + kctl->count > id->index;
376 }
377 
378 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
379 /* Compute a hash key for the corresponding ctl id
380  * It's for the name lookup, hence the numid is excluded.
381  * The hash key is bound in LONG_MAX to be used for Xarray key.
382  */
383 #define MULTIPLIER	37
384 static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id)
385 {
386 	int i;
387 	unsigned long h;
388 
389 	h = id->iface;
390 	h = MULTIPLIER * h + id->device;
391 	h = MULTIPLIER * h + id->subdevice;
392 	for (i = 0; i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN && id->name[i]; i++)
393 		h = MULTIPLIER * h + id->name[i];
394 	h = MULTIPLIER * h + id->index;
395 	h &= LONG_MAX;
396 	return h;
397 }
398 
399 /* add hash entries to numid and ctl xarray tables */
400 static void add_hash_entries(struct snd_card *card,
401 			     struct snd_kcontrol *kcontrol)
402 {
403 	struct snd_ctl_elem_id id = kcontrol->id;
404 	int i;
405 
406 	xa_store_range(&card->ctl_numids, kcontrol->id.numid,
407 		       kcontrol->id.numid + kcontrol->count - 1,
408 		       kcontrol, GFP_KERNEL);
409 
410 	for (i = 0; i < kcontrol->count; i++) {
411 		id.index = kcontrol->id.index + i;
412 		if (xa_insert(&card->ctl_hash, get_ctl_id_hash(&id),
413 			      kcontrol, GFP_KERNEL)) {
414 			/* skip hash for this entry, noting we had collision */
415 			card->ctl_hash_collision = true;
416 			dev_dbg(card->dev, "ctl_hash collision %d:%s:%d\n",
417 				id.iface, id.name, id.index);
418 		}
419 	}
420 }
421 
422 /* remove hash entries that have been added */
423 static void remove_hash_entries(struct snd_card *card,
424 				struct snd_kcontrol *kcontrol)
425 {
426 	struct snd_ctl_elem_id id = kcontrol->id;
427 	struct snd_kcontrol *matched;
428 	unsigned long h;
429 	int i;
430 
431 	for (i = 0; i < kcontrol->count; i++) {
432 		xa_erase(&card->ctl_numids, id.numid);
433 		h = get_ctl_id_hash(&id);
434 		matched = xa_load(&card->ctl_hash, h);
435 		if (matched && (matched == kcontrol ||
436 				elem_id_matches(matched, &id)))
437 			xa_erase(&card->ctl_hash, h);
438 		id.index++;
439 		id.numid++;
440 	}
441 }
442 #else /* CONFIG_SND_CTL_FAST_LOOKUP */
443 static inline void add_hash_entries(struct snd_card *card,
444 				    struct snd_kcontrol *kcontrol)
445 {
446 }
447 static inline void remove_hash_entries(struct snd_card *card,
448 				       struct snd_kcontrol *kcontrol)
449 {
450 }
451 #endif /* CONFIG_SND_CTL_FAST_LOOKUP */
452 
453 enum snd_ctl_add_mode {
454 	CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
455 };
456 
457 /* add/replace a new kcontrol object; call with card->controls_rwsem locked */
458 static int __snd_ctl_add_replace(struct snd_card *card,
459 				 struct snd_kcontrol *kcontrol,
460 				 enum snd_ctl_add_mode mode)
461 {
462 	struct snd_ctl_elem_id id;
463 	unsigned int idx;
464 	struct snd_kcontrol *old;
465 	int err;
466 
467 	lockdep_assert_held_write(&card->controls_rwsem);
468 
469 	id = kcontrol->id;
470 	if (id.index > UINT_MAX - kcontrol->count)
471 		return -EINVAL;
472 
473 	old = snd_ctl_find_id_locked(card, &id);
474 	if (!old) {
475 		if (mode == CTL_REPLACE)
476 			return -EINVAL;
477 	} else {
478 		if (mode == CTL_ADD_EXCLUSIVE) {
479 			dev_err(card->dev,
480 				"control %i:%i:%i:%s:%i is already present\n",
481 				id.iface, id.device, id.subdevice, id.name,
482 				id.index);
483 			return -EBUSY;
484 		}
485 
486 		err = snd_ctl_remove_locked(card, old);
487 		if (err < 0)
488 			return err;
489 	}
490 
491 	if (snd_ctl_find_hole(card, kcontrol->count) < 0)
492 		return -ENOMEM;
493 
494 	list_add_tail(&kcontrol->list, &card->controls);
495 	card->controls_count += kcontrol->count;
496 	kcontrol->id.numid = card->last_numid + 1;
497 	card->last_numid += kcontrol->count;
498 
499 	add_hash_entries(card, kcontrol);
500 
501 	for (idx = 0; idx < kcontrol->count; idx++)
502 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
503 
504 	return 0;
505 }
506 
507 static int snd_ctl_add_replace(struct snd_card *card,
508 			       struct snd_kcontrol *kcontrol,
509 			       enum snd_ctl_add_mode mode)
510 {
511 	int err = -EINVAL;
512 
513 	if (! kcontrol)
514 		return err;
515 	if (snd_BUG_ON(!card || !kcontrol->info))
516 		goto error;
517 
518 	scoped_guard(rwsem_write, &card->controls_rwsem)
519 		err = __snd_ctl_add_replace(card, kcontrol, mode);
520 
521 	if (err < 0)
522 		goto error;
523 	return 0;
524 
525  error:
526 	snd_ctl_free_one(kcontrol);
527 	return err;
528 }
529 
530 /**
531  * snd_ctl_add - add the control instance to the card
532  * @card: the card instance
533  * @kcontrol: the control instance to add
534  *
535  * Adds the control instance created via snd_ctl_new() or
536  * snd_ctl_new1() to the given card. Assigns also an unique
537  * numid used for fast search.
538  *
539  * It frees automatically the control which cannot be added.
540  *
541  * Return: Zero if successful, or a negative error code on failure.
542  *
543  */
544 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
545 {
546 	return snd_ctl_add_replace(card, kcontrol, CTL_ADD_EXCLUSIVE);
547 }
548 EXPORT_SYMBOL(snd_ctl_add);
549 
550 /**
551  * snd_ctl_replace - replace the control instance of the card
552  * @card: the card instance
553  * @kcontrol: the control instance to replace
554  * @add_on_replace: add the control if not already added
555  *
556  * Replaces the given control.  If the given control does not exist
557  * and the add_on_replace flag is set, the control is added.  If the
558  * control exists, it is destroyed first.
559  *
560  * It frees automatically the control which cannot be added or replaced.
561  *
562  * Return: Zero if successful, or a negative error code on failure.
563  */
564 int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
565 		    bool add_on_replace)
566 {
567 	return snd_ctl_add_replace(card, kcontrol,
568 				   add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
569 }
570 EXPORT_SYMBOL(snd_ctl_replace);
571 
572 static int __snd_ctl_remove(struct snd_card *card,
573 			    struct snd_kcontrol *kcontrol,
574 			    bool remove_hash)
575 {
576 	unsigned int idx;
577 
578 	lockdep_assert_held_write(&card->controls_rwsem);
579 
580 	if (snd_BUG_ON(!card || !kcontrol))
581 		return -EINVAL;
582 	list_del(&kcontrol->list);
583 
584 	if (remove_hash)
585 		remove_hash_entries(card, kcontrol);
586 
587 	card->controls_count -= kcontrol->count;
588 	for (idx = 0; idx < kcontrol->count; idx++)
589 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
590 	snd_ctl_free_one(kcontrol);
591 	return 0;
592 }
593 
594 static inline int snd_ctl_remove_locked(struct snd_card *card,
595 					struct snd_kcontrol *kcontrol)
596 {
597 	return __snd_ctl_remove(card, kcontrol, true);
598 }
599 
600 /**
601  * snd_ctl_remove - remove the control from the card and release it
602  * @card: the card instance
603  * @kcontrol: the control instance to remove
604  *
605  * Removes the control from the card and then releases the instance.
606  * You don't need to call snd_ctl_free_one().
607  *
608  * Return: 0 if successful, or a negative error code on failure.
609  *
610  * Note that this function takes card->controls_rwsem lock internally.
611  */
612 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
613 {
614 	guard(rwsem_write)(&card->controls_rwsem);
615 	return snd_ctl_remove_locked(card, kcontrol);
616 }
617 EXPORT_SYMBOL(snd_ctl_remove);
618 
619 /**
620  * snd_ctl_remove_id - remove the control of the given id and release it
621  * @card: the card instance
622  * @id: the control id to remove
623  *
624  * Finds the control instance with the given id, removes it from the
625  * card list and releases it.
626  *
627  * Return: 0 if successful, or a negative error code on failure.
628  */
629 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
630 {
631 	struct snd_kcontrol *kctl;
632 
633 	guard(rwsem_write)(&card->controls_rwsem);
634 	kctl = snd_ctl_find_id_locked(card, id);
635 	if (kctl == NULL)
636 		return -ENOENT;
637 	return snd_ctl_remove_locked(card, kctl);
638 }
639 EXPORT_SYMBOL(snd_ctl_remove_id);
640 
641 /**
642  * snd_ctl_remove_user_ctl - remove and release the unlocked user control
643  * @file: active control handle
644  * @id: the control id to remove
645  *
646  * Finds the control instance with the given id, removes it from the
647  * card list and releases it.
648  *
649  * Return: 0 if successful, or a negative error code on failure.
650  */
651 static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
652 				   struct snd_ctl_elem_id *id)
653 {
654 	struct snd_card *card = file->card;
655 	struct snd_kcontrol *kctl;
656 	int idx;
657 
658 	guard(rwsem_write)(&card->controls_rwsem);
659 	kctl = snd_ctl_find_id_locked(card, id);
660 	if (kctl == NULL)
661 		return -ENOENT;
662 	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER))
663 		return -EINVAL;
664 	for (idx = 0; idx < kctl->count; idx++)
665 		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file)
666 			return -EBUSY;
667 	return snd_ctl_remove_locked(card, kctl);
668 }
669 
670 /**
671  * snd_ctl_activate_id - activate/inactivate the control of the given id
672  * @card: the card instance
673  * @id: the control id to activate/inactivate
674  * @active: non-zero to activate
675  *
676  * Finds the control instance with the given id, and activate or
677  * inactivate the control together with notification, if changed.
678  * The given ID data is filled with full information.
679  *
680  * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
681  */
682 int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
683 			int active)
684 {
685 	struct snd_kcontrol *kctl;
686 	struct snd_kcontrol_volatile *vd;
687 	unsigned int index_offset;
688 	int ret;
689 
690 	down_write(&card->controls_rwsem);
691 	kctl = snd_ctl_find_id_locked(card, id);
692 	if (kctl == NULL) {
693 		ret = -ENOENT;
694 		goto unlock;
695 	}
696 	index_offset = snd_ctl_get_ioff(kctl, id);
697 	vd = &kctl->vd[index_offset];
698 	ret = 0;
699 	if (active) {
700 		if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
701 			goto unlock;
702 		vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
703 	} else {
704 		if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
705 			goto unlock;
706 		vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
707 	}
708 	snd_ctl_build_ioff(id, kctl, index_offset);
709 	downgrade_write(&card->controls_rwsem);
710 	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
711 	up_read(&card->controls_rwsem);
712 	return 1;
713 
714  unlock:
715 	up_write(&card->controls_rwsem);
716 	return ret;
717 }
718 EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
719 
720 /**
721  * snd_ctl_rename_id - replace the id of a control on the card
722  * @card: the card instance
723  * @src_id: the old id
724  * @dst_id: the new id
725  *
726  * Finds the control with the old id from the card, and replaces the
727  * id with the new one.
728  *
729  * The function tries to keep the already assigned numid while replacing
730  * the rest.
731  *
732  * Note that this function should be used only in the card initialization
733  * phase.  Calling after the card instantiation may cause issues with
734  * user-space expecting persistent numids.
735  *
736  * Return: Zero if successful, or a negative error code on failure.
737  */
738 int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
739 		      struct snd_ctl_elem_id *dst_id)
740 {
741 	struct snd_kcontrol *kctl;
742 	int saved_numid;
743 
744 	guard(rwsem_write)(&card->controls_rwsem);
745 	kctl = snd_ctl_find_id_locked(card, src_id);
746 	if (kctl == NULL)
747 		return -ENOENT;
748 	saved_numid = kctl->id.numid;
749 	remove_hash_entries(card, kctl);
750 	kctl->id = *dst_id;
751 	kctl->id.numid = saved_numid;
752 	add_hash_entries(card, kctl);
753 	return 0;
754 }
755 EXPORT_SYMBOL(snd_ctl_rename_id);
756 
757 /**
758  * snd_ctl_rename - rename the control on the card
759  * @card: the card instance
760  * @kctl: the control to rename
761  * @name: the new name
762  *
763  * Renames the specified control on the card to the new name.
764  *
765  * Note that this function takes card->controls_rwsem lock internally.
766  */
767 void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
768 		    const char *name)
769 {
770 	guard(rwsem_write)(&card->controls_rwsem);
771 	remove_hash_entries(card, kctl);
772 
773 	if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
774 		pr_warn("ALSA: Renamed control new name '%s' truncated to '%s'\n",
775 			name, kctl->id.name);
776 
777 	add_hash_entries(card, kctl);
778 }
779 EXPORT_SYMBOL(snd_ctl_rename);
780 
781 #ifndef CONFIG_SND_CTL_FAST_LOOKUP
782 static struct snd_kcontrol *
783 snd_ctl_find_numid_slow(struct snd_card *card, unsigned int numid)
784 {
785 	struct snd_kcontrol *kctl;
786 
787 	list_for_each_entry(kctl, &card->controls, list) {
788 		if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
789 			return kctl;
790 	}
791 	return NULL;
792 }
793 #endif /* !CONFIG_SND_CTL_FAST_LOOKUP */
794 
795 /**
796  * snd_ctl_find_numid_locked - find the control instance with the given number-id
797  * @card: the card instance
798  * @numid: the number-id to search
799  *
800  * Finds the control instance with the given number-id from the card.
801  *
802  * The caller must down card->controls_rwsem before calling this function
803  * (if the race condition can happen).
804  *
805  * Return: The pointer of the instance if found, or %NULL if not.
806  */
807 struct snd_kcontrol *
808 snd_ctl_find_numid_locked(struct snd_card *card, unsigned int numid)
809 {
810 	if (snd_BUG_ON(!card || !numid))
811 		return NULL;
812 	lockdep_assert_held(&card->controls_rwsem);
813 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
814 	return xa_load(&card->ctl_numids, numid);
815 #else
816 	return snd_ctl_find_numid_slow(card, numid);
817 #endif
818 }
819 EXPORT_SYMBOL(snd_ctl_find_numid_locked);
820 
821 /**
822  * snd_ctl_find_numid - find the control instance with the given number-id
823  * @card: the card instance
824  * @numid: the number-id to search
825  *
826  * Finds the control instance with the given number-id from the card.
827  *
828  * Return: The pointer of the instance if found, or %NULL if not.
829  *
830  * Note that this function takes card->controls_rwsem lock internally.
831  */
832 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card,
833 					unsigned int numid)
834 {
835 	guard(rwsem_read)(&card->controls_rwsem);
836 	return snd_ctl_find_numid_locked(card, numid);
837 }
838 EXPORT_SYMBOL(snd_ctl_find_numid);
839 
840 /**
841  * snd_ctl_find_id_locked - find the control instance with the given id
842  * @card: the card instance
843  * @id: the id to search
844  *
845  * Finds the control instance with the given id from the card.
846  *
847  * The caller must down card->controls_rwsem before calling this function
848  * (if the race condition can happen).
849  *
850  * Return: The pointer of the instance if found, or %NULL if not.
851  */
852 struct snd_kcontrol *snd_ctl_find_id_locked(struct snd_card *card,
853 					    const struct snd_ctl_elem_id *id)
854 {
855 	struct snd_kcontrol *kctl;
856 
857 	if (snd_BUG_ON(!card || !id))
858 		return NULL;
859 	lockdep_assert_held(&card->controls_rwsem);
860 	if (id->numid != 0)
861 		return snd_ctl_find_numid_locked(card, id->numid);
862 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
863 	kctl = xa_load(&card->ctl_hash, get_ctl_id_hash(id));
864 	if (kctl && elem_id_matches(kctl, id))
865 		return kctl;
866 	if (!card->ctl_hash_collision)
867 		return NULL; /* we can rely on only hash table */
868 #endif
869 	/* no matching in hash table - try all as the last resort */
870 	list_for_each_entry(kctl, &card->controls, list)
871 		if (elem_id_matches(kctl, id))
872 			return kctl;
873 
874 	return NULL;
875 }
876 EXPORT_SYMBOL(snd_ctl_find_id_locked);
877 
878 /**
879  * snd_ctl_find_id - find the control instance with the given id
880  * @card: the card instance
881  * @id: the id to search
882  *
883  * Finds the control instance with the given id from the card.
884  *
885  * Return: The pointer of the instance if found, or %NULL if not.
886  *
887  * Note that this function takes card->controls_rwsem lock internally.
888  */
889 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
890 				     const struct snd_ctl_elem_id *id)
891 {
892 	guard(rwsem_read)(&card->controls_rwsem);
893 	return snd_ctl_find_id_locked(card, id);
894 }
895 EXPORT_SYMBOL(snd_ctl_find_id);
896 
897 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
898 			     unsigned int cmd, void __user *arg)
899 {
900 	struct snd_ctl_card_info *info __free(kfree) = NULL;
901 
902 	info = kzalloc(sizeof(*info), GFP_KERNEL);
903 	if (! info)
904 		return -ENOMEM;
905 	scoped_guard(rwsem_read, &snd_ioctl_rwsem) {
906 		info->card = card->number;
907 		strscpy(info->id, card->id, sizeof(info->id));
908 		strscpy(info->driver, card->driver, sizeof(info->driver));
909 		strscpy(info->name, card->shortname, sizeof(info->name));
910 		strscpy(info->longname, card->longname, sizeof(info->longname));
911 		strscpy(info->mixername, card->mixername, sizeof(info->mixername));
912 		strscpy(info->components, card->components, sizeof(info->components));
913 	}
914 	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info)))
915 		return -EFAULT;
916 	return 0;
917 }
918 
919 static int snd_ctl_elem_list(struct snd_card *card,
920 			     struct snd_ctl_elem_list *list)
921 {
922 	struct snd_kcontrol *kctl;
923 	struct snd_ctl_elem_id id;
924 	unsigned int offset, space, jidx;
925 
926 	offset = list->offset;
927 	space = list->space;
928 
929 	guard(rwsem_read)(&card->controls_rwsem);
930 	list->count = card->controls_count;
931 	list->used = 0;
932 	if (!space)
933 		return 0;
934 	list_for_each_entry(kctl, &card->controls, list) {
935 		if (offset >= kctl->count) {
936 			offset -= kctl->count;
937 			continue;
938 		}
939 		for (jidx = offset; jidx < kctl->count; jidx++) {
940 			snd_ctl_build_ioff(&id, kctl, jidx);
941 			if (copy_to_user(list->pids + list->used, &id, sizeof(id)))
942 				return -EFAULT;
943 			list->used++;
944 			if (!--space)
945 				return 0;
946 		}
947 		offset = 0;
948 	}
949 	return 0;
950 }
951 
952 static int snd_ctl_elem_list_user(struct snd_card *card,
953 				  struct snd_ctl_elem_list __user *_list)
954 {
955 	struct snd_ctl_elem_list list;
956 	int err;
957 
958 	if (copy_from_user(&list, _list, sizeof(list)))
959 		return -EFAULT;
960 	err = snd_ctl_elem_list(card, &list);
961 	if (err)
962 		return err;
963 	if (copy_to_user(_list, &list, sizeof(list)))
964 		return -EFAULT;
965 
966 	return 0;
967 }
968 
969 /* Check whether the given kctl info is valid */
970 static int snd_ctl_check_elem_info(struct snd_card *card,
971 				   const struct snd_ctl_elem_info *info)
972 {
973 	static const unsigned int max_value_counts[] = {
974 		[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= 128,
975 		[SNDRV_CTL_ELEM_TYPE_INTEGER]	= 128,
976 		[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
977 		[SNDRV_CTL_ELEM_TYPE_BYTES]	= 512,
978 		[SNDRV_CTL_ELEM_TYPE_IEC958]	= 1,
979 		[SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
980 	};
981 
982 	if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
983 	    info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
984 		if (card)
985 			dev_err(card->dev,
986 				"control %i:%i:%i:%s:%i: invalid type %d\n",
987 				info->id.iface, info->id.device,
988 				info->id.subdevice, info->id.name,
989 				info->id.index, info->type);
990 		return -EINVAL;
991 	}
992 	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
993 	    info->value.enumerated.items == 0) {
994 		if (card)
995 			dev_err(card->dev,
996 				"control %i:%i:%i:%s:%i: zero enum items\n",
997 				info->id.iface, info->id.device,
998 				info->id.subdevice, info->id.name,
999 				info->id.index);
1000 		return -EINVAL;
1001 	}
1002 	if (info->count > max_value_counts[info->type]) {
1003 		if (card)
1004 			dev_err(card->dev,
1005 				"control %i:%i:%i:%s:%i: invalid count %d\n",
1006 				info->id.iface, info->id.device,
1007 				info->id.subdevice, info->id.name,
1008 				info->id.index, info->count);
1009 		return -EINVAL;
1010 	}
1011 
1012 	return 0;
1013 }
1014 
1015 /* The capacity of struct snd_ctl_elem_value.value.*/
1016 static const unsigned int value_sizes[] = {
1017 	[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= sizeof(long),
1018 	[SNDRV_CTL_ELEM_TYPE_INTEGER]	= sizeof(long),
1019 	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
1020 	[SNDRV_CTL_ELEM_TYPE_BYTES]	= sizeof(unsigned char),
1021 	[SNDRV_CTL_ELEM_TYPE_IEC958]	= sizeof(struct snd_aes_iec958),
1022 	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
1023 };
1024 
1025 /* fill the remaining snd_ctl_elem_value data with the given pattern */
1026 static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
1027 				      struct snd_ctl_elem_info *info,
1028 				      u32 pattern)
1029 {
1030 	size_t offset = value_sizes[info->type] * info->count;
1031 
1032 	offset = DIV_ROUND_UP(offset, sizeof(u32));
1033 	memset32((u32 *)control->value.bytes.data + offset, pattern,
1034 		 sizeof(control->value) / sizeof(u32) - offset);
1035 }
1036 
1037 /* check whether the given integer ctl value is valid */
1038 static int sanity_check_int_value(struct snd_card *card,
1039 				  const struct snd_ctl_elem_value *control,
1040 				  const struct snd_ctl_elem_info *info,
1041 				  int i, bool print_error)
1042 {
1043 	long long lval, lmin, lmax, lstep;
1044 	u64 rem;
1045 
1046 	switch (info->type) {
1047 	default:
1048 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1049 		lval = control->value.integer.value[i];
1050 		lmin = 0;
1051 		lmax = 1;
1052 		lstep = 0;
1053 		break;
1054 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1055 		lval = control->value.integer.value[i];
1056 		lmin = info->value.integer.min;
1057 		lmax = info->value.integer.max;
1058 		lstep = info->value.integer.step;
1059 		break;
1060 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1061 		lval = control->value.integer64.value[i];
1062 		lmin = info->value.integer64.min;
1063 		lmax = info->value.integer64.max;
1064 		lstep = info->value.integer64.step;
1065 		break;
1066 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1067 		lval = control->value.enumerated.item[i];
1068 		lmin = 0;
1069 		lmax = info->value.enumerated.items - 1;
1070 		lstep = 0;
1071 		break;
1072 	}
1073 
1074 	if (lval < lmin || lval > lmax) {
1075 		if (print_error)
1076 			dev_err(card->dev,
1077 				"control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
1078 				control->id.iface, control->id.device,
1079 				control->id.subdevice, control->id.name,
1080 				control->id.index, lval, lmin, lmax, i);
1081 		return -EINVAL;
1082 	}
1083 	if (lstep) {
1084 		div64_u64_rem(lval, lstep, &rem);
1085 		if (rem) {
1086 			if (print_error)
1087 				dev_err(card->dev,
1088 					"control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
1089 					control->id.iface, control->id.device,
1090 					control->id.subdevice, control->id.name,
1091 					control->id.index, lval, lstep, i);
1092 			return -EINVAL;
1093 		}
1094 	}
1095 
1096 	return 0;
1097 }
1098 
1099 /* check whether the all input values are valid for the given elem value */
1100 static int sanity_check_input_values(struct snd_card *card,
1101 				     const struct snd_ctl_elem_value *control,
1102 				     const struct snd_ctl_elem_info *info,
1103 				     bool print_error)
1104 {
1105 	int i, ret;
1106 
1107 	switch (info->type) {
1108 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1109 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1110 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1111 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1112 		for (i = 0; i < info->count; i++) {
1113 			ret = sanity_check_int_value(card, control, info, i,
1114 						     print_error);
1115 			if (ret < 0)
1116 				return ret;
1117 		}
1118 		break;
1119 	default:
1120 		break;
1121 	}
1122 
1123 	return 0;
1124 }
1125 
1126 /* perform sanity checks to the given snd_ctl_elem_value object */
1127 static int sanity_check_elem_value(struct snd_card *card,
1128 				   const struct snd_ctl_elem_value *control,
1129 				   const struct snd_ctl_elem_info *info,
1130 				   u32 pattern)
1131 {
1132 	size_t offset;
1133 	int ret;
1134 	u32 *p;
1135 
1136 	ret = sanity_check_input_values(card, control, info, true);
1137 	if (ret < 0)
1138 		return ret;
1139 
1140 	/* check whether the remaining area kept untouched */
1141 	offset = value_sizes[info->type] * info->count;
1142 	offset = DIV_ROUND_UP(offset, sizeof(u32));
1143 	p = (u32 *)control->value.bytes.data + offset;
1144 	for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
1145 		if (*p != pattern) {
1146 			ret = -EINVAL;
1147 			break;
1148 		}
1149 		*p = 0; /* clear the checked area */
1150 	}
1151 
1152 	return ret;
1153 }
1154 
1155 static int __snd_ctl_elem_info(struct snd_card *card,
1156 			       struct snd_kcontrol *kctl,
1157 			       struct snd_ctl_elem_info *info,
1158 			       struct snd_ctl_file *ctl)
1159 {
1160 	struct snd_kcontrol_volatile *vd;
1161 	unsigned int index_offset;
1162 	int result;
1163 
1164 #ifdef CONFIG_SND_DEBUG
1165 	info->access = 0;
1166 #endif
1167 	result = snd_power_ref_and_wait(card);
1168 	if (!result)
1169 		result = kctl->info(kctl, info);
1170 	snd_power_unref(card);
1171 	if (result >= 0) {
1172 		snd_BUG_ON(info->access);
1173 		index_offset = snd_ctl_get_ioff(kctl, &info->id);
1174 		vd = &kctl->vd[index_offset];
1175 		snd_ctl_build_ioff(&info->id, kctl, index_offset);
1176 		info->access = vd->access;
1177 		if (vd->owner) {
1178 			info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
1179 			if (vd->owner == ctl)
1180 				info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
1181 			info->owner = pid_vnr(vd->owner->pid);
1182 		} else {
1183 			info->owner = -1;
1184 		}
1185 		if (!snd_ctl_skip_validation(info) &&
1186 		    snd_ctl_check_elem_info(card, info) < 0)
1187 			result = -EINVAL;
1188 	}
1189 	return result;
1190 }
1191 
1192 static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
1193 			     struct snd_ctl_elem_info *info)
1194 {
1195 	struct snd_card *card = ctl->card;
1196 	struct snd_kcontrol *kctl;
1197 
1198 	guard(rwsem_read)(&card->controls_rwsem);
1199 	kctl = snd_ctl_find_id_locked(card, &info->id);
1200 	if (!kctl)
1201 		return -ENOENT;
1202 	return __snd_ctl_elem_info(card, kctl, info, ctl);
1203 }
1204 
1205 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
1206 				  struct snd_ctl_elem_info __user *_info)
1207 {
1208 	struct snd_ctl_elem_info info;
1209 	int result;
1210 
1211 	if (copy_from_user(&info, _info, sizeof(info)))
1212 		return -EFAULT;
1213 	result = snd_ctl_elem_info(ctl, &info);
1214 	if (result < 0)
1215 		return result;
1216 	/* drop internal access flags */
1217 	info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
1218 			 SNDRV_CTL_ELEM_ACCESS_LED_MASK);
1219 	if (copy_to_user(_info, &info, sizeof(info)))
1220 		return -EFAULT;
1221 	return result;
1222 }
1223 
1224 static int snd_ctl_elem_read(struct snd_card *card,
1225 			     struct snd_ctl_elem_value *control)
1226 {
1227 	struct snd_kcontrol *kctl;
1228 	struct snd_kcontrol_volatile *vd;
1229 	unsigned int index_offset;
1230 	struct snd_ctl_elem_info info;
1231 	const u32 pattern = 0xdeadbeef;
1232 	int ret;
1233 
1234 	guard(rwsem_read)(&card->controls_rwsem);
1235 	kctl = snd_ctl_find_id_locked(card, &control->id);
1236 	if (!kctl)
1237 		return -ENOENT;
1238 
1239 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1240 	vd = &kctl->vd[index_offset];
1241 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || !kctl->get)
1242 		return -EPERM;
1243 
1244 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1245 
1246 #ifdef CONFIG_SND_CTL_DEBUG
1247 	/* info is needed only for validation */
1248 	memset(&info, 0, sizeof(info));
1249 	info.id = control->id;
1250 	ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
1251 	if (ret < 0)
1252 		return ret;
1253 #endif
1254 
1255 	if (!snd_ctl_skip_validation(&info))
1256 		fill_remaining_elem_value(control, &info, pattern);
1257 	ret = snd_power_ref_and_wait(card);
1258 	if (!ret)
1259 		ret = kctl->get(kctl, control);
1260 	snd_power_unref(card);
1261 	if (ret < 0)
1262 		return ret;
1263 	if (!snd_ctl_skip_validation(&info) &&
1264 	    sanity_check_elem_value(card, control, &info, pattern) < 0) {
1265 		dev_err(card->dev,
1266 			"control %i:%i:%i:%s:%i: access overflow\n",
1267 			control->id.iface, control->id.device,
1268 			control->id.subdevice, control->id.name,
1269 			control->id.index);
1270 		return -EINVAL;
1271 	}
1272 	return 0;
1273 }
1274 
1275 static int snd_ctl_elem_read_user(struct snd_card *card,
1276 				  struct snd_ctl_elem_value __user *_control)
1277 {
1278 	struct snd_ctl_elem_value *control;
1279 	int result;
1280 
1281 	control = memdup_user(_control, sizeof(*control));
1282 	if (IS_ERR(control))
1283 		return PTR_ERR(control);
1284 
1285 	result = snd_ctl_elem_read(card, control);
1286 	if (result < 0)
1287 		return result;
1288 
1289 	if (copy_to_user(_control, control, sizeof(*control)))
1290 		return -EFAULT;
1291 	return result;
1292 }
1293 
1294 static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
1295 			      struct snd_ctl_elem_value *control)
1296 {
1297 	struct snd_kcontrol *kctl;
1298 	struct snd_kcontrol_volatile *vd;
1299 	unsigned int index_offset;
1300 	int result;
1301 
1302 	down_write(&card->controls_rwsem);
1303 	kctl = snd_ctl_find_id_locked(card, &control->id);
1304 	if (kctl == NULL) {
1305 		up_write(&card->controls_rwsem);
1306 		return -ENOENT;
1307 	}
1308 
1309 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1310 	vd = &kctl->vd[index_offset];
1311 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
1312 	    (file && vd->owner && vd->owner != file)) {
1313 		up_write(&card->controls_rwsem);
1314 		return -EPERM;
1315 	}
1316 
1317 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1318 	result = snd_power_ref_and_wait(card);
1319 	/* validate input values */
1320 	if (IS_ENABLED(CONFIG_SND_CTL_INPUT_VALIDATION) && !result) {
1321 		struct snd_ctl_elem_info info;
1322 
1323 		memset(&info, 0, sizeof(info));
1324 		info.id = control->id;
1325 		result = __snd_ctl_elem_info(card, kctl, &info, NULL);
1326 		if (!result)
1327 			result = sanity_check_input_values(card, control, &info,
1328 							   false);
1329 	}
1330 	if (!result)
1331 		result = kctl->put(kctl, control);
1332 	snd_power_unref(card);
1333 	if (result < 0) {
1334 		up_write(&card->controls_rwsem);
1335 		return result;
1336 	}
1337 
1338 	if (result > 0) {
1339 		downgrade_write(&card->controls_rwsem);
1340 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
1341 		up_read(&card->controls_rwsem);
1342 	} else {
1343 		up_write(&card->controls_rwsem);
1344 	}
1345 
1346 	return 0;
1347 }
1348 
1349 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
1350 				   struct snd_ctl_elem_value __user *_control)
1351 {
1352 	struct snd_ctl_elem_value *control __free(kfree) = NULL;
1353 	struct snd_card *card;
1354 	int result;
1355 
1356 	control = memdup_user(_control, sizeof(*control));
1357 	if (IS_ERR(control))
1358 		return PTR_ERR(no_free_ptr(control));
1359 
1360 	card = file->card;
1361 	result = snd_ctl_elem_write(card, file, control);
1362 	if (result < 0)
1363 		return result;
1364 
1365 	if (copy_to_user(_control, control, sizeof(*control)))
1366 		return -EFAULT;
1367 	return result;
1368 }
1369 
1370 static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1371 			     struct snd_ctl_elem_id __user *_id)
1372 {
1373 	struct snd_card *card = file->card;
1374 	struct snd_ctl_elem_id id;
1375 	struct snd_kcontrol *kctl;
1376 	struct snd_kcontrol_volatile *vd;
1377 
1378 	if (copy_from_user(&id, _id, sizeof(id)))
1379 		return -EFAULT;
1380 	guard(rwsem_write)(&card->controls_rwsem);
1381 	kctl = snd_ctl_find_id_locked(card, &id);
1382 	if (!kctl)
1383 		return -ENOENT;
1384 	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1385 	if (vd->owner)
1386 		return -EBUSY;
1387 	vd->owner = file;
1388 	return 0;
1389 }
1390 
1391 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1392 			       struct snd_ctl_elem_id __user *_id)
1393 {
1394 	struct snd_card *card = file->card;
1395 	struct snd_ctl_elem_id id;
1396 	struct snd_kcontrol *kctl;
1397 	struct snd_kcontrol_volatile *vd;
1398 
1399 	if (copy_from_user(&id, _id, sizeof(id)))
1400 		return -EFAULT;
1401 	guard(rwsem_write)(&card->controls_rwsem);
1402 	kctl = snd_ctl_find_id_locked(card, &id);
1403 	if (!kctl)
1404 		return -ENOENT;
1405 	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1406 	if (!vd->owner)
1407 		return -EINVAL;
1408 	if (vd->owner != file)
1409 		return -EPERM;
1410 	vd->owner = NULL;
1411 	return 0;
1412 }
1413 
1414 struct user_element {
1415 	struct snd_ctl_elem_info info;
1416 	struct snd_card *card;
1417 	char *elem_data;		/* element data */
1418 	unsigned long elem_data_size;	/* size of element data in bytes */
1419 	void *tlv_data;			/* TLV data */
1420 	unsigned long tlv_data_size;	/* TLV data size */
1421 	void *priv_data;		/* private data (like strings for enumerated type) */
1422 };
1423 
1424 // check whether the addition (in bytes) of user ctl element may overflow the limit.
1425 static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
1426 {
1427 	return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
1428 }
1429 
1430 static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1431 				  struct snd_ctl_elem_info *uinfo)
1432 {
1433 	struct user_element *ue = kcontrol->private_data;
1434 	unsigned int offset;
1435 
1436 	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1437 	*uinfo = ue->info;
1438 	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1439 
1440 	return 0;
1441 }
1442 
1443 static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1444 				       struct snd_ctl_elem_info *uinfo)
1445 {
1446 	struct user_element *ue = kcontrol->private_data;
1447 	const char *names;
1448 	unsigned int item;
1449 	unsigned int offset;
1450 
1451 	item = uinfo->value.enumerated.item;
1452 
1453 	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1454 	*uinfo = ue->info;
1455 	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1456 
1457 	item = min(item, uinfo->value.enumerated.items - 1);
1458 	uinfo->value.enumerated.item = item;
1459 
1460 	names = ue->priv_data;
1461 	for (; item > 0; --item)
1462 		names += strlen(names) + 1;
1463 	strcpy(uinfo->value.enumerated.name, names);
1464 
1465 	return 0;
1466 }
1467 
1468 static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1469 				 struct snd_ctl_elem_value *ucontrol)
1470 {
1471 	struct user_element *ue = kcontrol->private_data;
1472 	unsigned int size = ue->elem_data_size;
1473 	char *src = ue->elem_data +
1474 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1475 
1476 	memcpy(&ucontrol->value, src, size);
1477 	return 0;
1478 }
1479 
1480 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1481 				 struct snd_ctl_elem_value *ucontrol)
1482 {
1483 	int change;
1484 	struct user_element *ue = kcontrol->private_data;
1485 	unsigned int size = ue->elem_data_size;
1486 	char *dst = ue->elem_data +
1487 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1488 
1489 	change = memcmp(&ucontrol->value, dst, size) != 0;
1490 	if (change)
1491 		memcpy(dst, &ucontrol->value, size);
1492 	return change;
1493 }
1494 
1495 /* called in controls_rwsem write lock */
1496 static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1497 			    unsigned int size)
1498 {
1499 	struct user_element *ue = kctl->private_data;
1500 	unsigned int *container;
1501 	unsigned int mask = 0;
1502 	int i;
1503 	int change;
1504 
1505 	lockdep_assert_held_write(&ue->card->controls_rwsem);
1506 
1507 	if (size > 1024 * 128)	/* sane value */
1508 		return -EINVAL;
1509 
1510 	// does the TLV size change cause overflow?
1511 	if (check_user_elem_overflow(ue->card, (ssize_t)(size - ue->tlv_data_size)))
1512 		return -ENOMEM;
1513 
1514 	container = vmemdup_user(buf, size);
1515 	if (IS_ERR(container))
1516 		return PTR_ERR(container);
1517 
1518 	change = ue->tlv_data_size != size;
1519 	if (!change)
1520 		change = memcmp(ue->tlv_data, container, size) != 0;
1521 	if (!change) {
1522 		kvfree(container);
1523 		return 0;
1524 	}
1525 
1526 	if (ue->tlv_data == NULL) {
1527 		/* Now TLV data is available. */
1528 		for (i = 0; i < kctl->count; ++i)
1529 			kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
1530 		mask = SNDRV_CTL_EVENT_MASK_INFO;
1531 	} else {
1532 		ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1533 		ue->tlv_data_size = 0;
1534 		kvfree(ue->tlv_data);
1535 	}
1536 
1537 	ue->tlv_data = container;
1538 	ue->tlv_data_size = size;
1539 	// decremented at private_free.
1540 	ue->card->user_ctl_alloc_size += size;
1541 
1542 	mask |= SNDRV_CTL_EVENT_MASK_TLV;
1543 	for (i = 0; i < kctl->count; ++i)
1544 		snd_ctl_notify_one(ue->card, mask, kctl, i);
1545 
1546 	return change;
1547 }
1548 
1549 static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1550 			 unsigned int size)
1551 {
1552 	struct user_element *ue = kctl->private_data;
1553 
1554 	if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
1555 		return -ENXIO;
1556 
1557 	if (size < ue->tlv_data_size)
1558 		return -ENOSPC;
1559 
1560 	if (copy_to_user(buf, ue->tlv_data, ue->tlv_data_size))
1561 		return -EFAULT;
1562 
1563 	return 0;
1564 }
1565 
1566 static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
1567 				 unsigned int size, unsigned int __user *buf)
1568 {
1569 	if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
1570 		return replace_user_tlv(kctl, buf, size);
1571 	else
1572 		return read_user_tlv(kctl, buf, size);
1573 }
1574 
1575 /* called in controls_rwsem write lock */
1576 static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1577 {
1578 	char *names, *p;
1579 	size_t buf_len, name_len;
1580 	unsigned int i;
1581 	const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1582 
1583 	lockdep_assert_held_write(&ue->card->controls_rwsem);
1584 
1585 	buf_len = ue->info.value.enumerated.names_length;
1586 	if (buf_len > 64 * 1024)
1587 		return -EINVAL;
1588 
1589 	if (check_user_elem_overflow(ue->card, buf_len))
1590 		return -ENOMEM;
1591 	names = vmemdup_user((const void __user *)user_ptrval, buf_len);
1592 	if (IS_ERR(names))
1593 		return PTR_ERR(names);
1594 
1595 	/* check that there are enough valid names */
1596 	p = names;
1597 	for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1598 		name_len = strnlen(p, buf_len);
1599 		if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1600 			kvfree(names);
1601 			return -EINVAL;
1602 		}
1603 		p += name_len + 1;
1604 		buf_len -= name_len + 1;
1605 	}
1606 
1607 	ue->priv_data = names;
1608 	ue->info.value.enumerated.names_ptr = 0;
1609 	// increment the allocation size; decremented again at private_free.
1610 	ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
1611 
1612 	return 0;
1613 }
1614 
1615 static size_t compute_user_elem_size(size_t size, unsigned int count)
1616 {
1617 	return sizeof(struct user_element) + size * count;
1618 }
1619 
1620 static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1621 {
1622 	struct user_element *ue = kcontrol->private_data;
1623 
1624 	// decrement the allocation size.
1625 	ue->card->user_ctl_alloc_size -= compute_user_elem_size(ue->elem_data_size, kcontrol->count);
1626 	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1627 	if (ue->priv_data)
1628 		ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
1629 
1630 	kvfree(ue->tlv_data);
1631 	kvfree(ue->priv_data);
1632 	kfree(ue);
1633 }
1634 
1635 static int snd_ctl_elem_add(struct snd_ctl_file *file,
1636 			    struct snd_ctl_elem_info *info, int replace)
1637 {
1638 	struct snd_card *card = file->card;
1639 	struct snd_kcontrol *kctl;
1640 	unsigned int count;
1641 	unsigned int access;
1642 	long private_size;
1643 	size_t alloc_size;
1644 	struct user_element *ue;
1645 	unsigned int offset;
1646 	int err;
1647 
1648 	if (!*info->id.name)
1649 		return -EINVAL;
1650 	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
1651 		return -EINVAL;
1652 
1653 	/* Delete a control to replace them if needed. */
1654 	if (replace) {
1655 		info->id.numid = 0;
1656 		err = snd_ctl_remove_user_ctl(file, &info->id);
1657 		if (err)
1658 			return err;
1659 	}
1660 
1661 	/* Check the number of elements for this userspace control. */
1662 	count = info->owner;
1663 	if (count == 0)
1664 		count = 1;
1665 
1666 	/* Arrange access permissions if needed. */
1667 	access = info->access;
1668 	if (access == 0)
1669 		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1670 	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1671 		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1672 		   SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
1673 
1674 	/* In initial state, nothing is available as TLV container. */
1675 	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1676 		access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1677 	access |= SNDRV_CTL_ELEM_ACCESS_USER;
1678 
1679 	/*
1680 	 * Check information and calculate the size of data specific to
1681 	 * this userspace control.
1682 	 */
1683 	/* pass NULL to card for suppressing error messages */
1684 	err = snd_ctl_check_elem_info(NULL, info);
1685 	if (err < 0)
1686 		return err;
1687 	/* user-space control doesn't allow zero-size data */
1688 	if (info->count < 1)
1689 		return -EINVAL;
1690 	private_size = value_sizes[info->type] * info->count;
1691 	alloc_size = compute_user_elem_size(private_size, count);
1692 
1693 	guard(rwsem_write)(&card->controls_rwsem);
1694 	if (check_user_elem_overflow(card, alloc_size))
1695 		return -ENOMEM;
1696 
1697 	/*
1698 	 * Keep memory object for this userspace control. After passing this
1699 	 * code block, the instance should be freed by snd_ctl_free_one().
1700 	 *
1701 	 * Note that these elements in this control are locked.
1702 	 */
1703 	err = snd_ctl_new(&kctl, count, access, file);
1704 	if (err < 0)
1705 		return err;
1706 	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1707 	ue = kzalloc(alloc_size, GFP_KERNEL);
1708 	if (!ue) {
1709 		kfree(kctl);
1710 		return -ENOMEM;
1711 	}
1712 	kctl->private_data = ue;
1713 	kctl->private_free = snd_ctl_elem_user_free;
1714 
1715 	// increment the allocated size; decremented again at private_free.
1716 	card->user_ctl_alloc_size += alloc_size;
1717 
1718 	/* Set private data for this userspace control. */
1719 	ue->card = card;
1720 	ue->info = *info;
1721 	ue->info.access = 0;
1722 	ue->elem_data = (char *)ue + sizeof(*ue);
1723 	ue->elem_data_size = private_size;
1724 	if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1725 		err = snd_ctl_elem_init_enum_names(ue);
1726 		if (err < 0) {
1727 			snd_ctl_free_one(kctl);
1728 			return err;
1729 		}
1730 	}
1731 
1732 	/* Set callback functions. */
1733 	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1734 		kctl->info = snd_ctl_elem_user_enum_info;
1735 	else
1736 		kctl->info = snd_ctl_elem_user_info;
1737 	if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1738 		kctl->get = snd_ctl_elem_user_get;
1739 	if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1740 		kctl->put = snd_ctl_elem_user_put;
1741 	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1742 		kctl->tlv.c = snd_ctl_elem_user_tlv;
1743 
1744 	/* This function manage to free the instance on failure. */
1745 	err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
1746 	if (err < 0) {
1747 		snd_ctl_free_one(kctl);
1748 		return err;
1749 	}
1750 	offset = snd_ctl_get_ioff(kctl, &info->id);
1751 	snd_ctl_build_ioff(&info->id, kctl, offset);
1752 	/*
1753 	 * Here we cannot fill any field for the number of elements added by
1754 	 * this operation because there're no specific fields. The usage of
1755 	 * 'owner' field for this purpose may cause any bugs to userspace
1756 	 * applications because the field originally means PID of a process
1757 	 * which locks the element.
1758 	 */
1759 	return 0;
1760 }
1761 
1762 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1763 				 struct snd_ctl_elem_info __user *_info, int replace)
1764 {
1765 	struct snd_ctl_elem_info info;
1766 	int err;
1767 
1768 	if (copy_from_user(&info, _info, sizeof(info)))
1769 		return -EFAULT;
1770 	err = snd_ctl_elem_add(file, &info, replace);
1771 	if (err < 0)
1772 		return err;
1773 	if (copy_to_user(_info, &info, sizeof(info))) {
1774 		snd_ctl_remove_user_ctl(file, &info.id);
1775 		return -EFAULT;
1776 	}
1777 
1778 	return 0;
1779 }
1780 
1781 static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1782 			       struct snd_ctl_elem_id __user *_id)
1783 {
1784 	struct snd_ctl_elem_id id;
1785 
1786 	if (copy_from_user(&id, _id, sizeof(id)))
1787 		return -EFAULT;
1788 	return snd_ctl_remove_user_ctl(file, &id);
1789 }
1790 
1791 static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1792 {
1793 	int subscribe;
1794 	if (get_user(subscribe, ptr))
1795 		return -EFAULT;
1796 	if (subscribe < 0) {
1797 		subscribe = file->subscribed;
1798 		if (put_user(subscribe, ptr))
1799 			return -EFAULT;
1800 		return 0;
1801 	}
1802 	if (subscribe) {
1803 		file->subscribed = 1;
1804 		return 0;
1805 	} else if (file->subscribed) {
1806 		snd_ctl_empty_read_queue(file);
1807 		file->subscribed = 0;
1808 	}
1809 	return 0;
1810 }
1811 
1812 static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
1813 			    struct snd_kcontrol *kctl,
1814 			    struct snd_ctl_elem_id *id,
1815 			    unsigned int __user *buf, unsigned int size)
1816 {
1817 	static const struct {
1818 		int op;
1819 		int perm;
1820 	} pairs[] = {
1821 		{SNDRV_CTL_TLV_OP_READ,  SNDRV_CTL_ELEM_ACCESS_TLV_READ},
1822 		{SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
1823 		{SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
1824 	};
1825 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1826 	int i, ret;
1827 
1828 	/* Check support of the request for this element. */
1829 	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
1830 		if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
1831 			break;
1832 	}
1833 	if (i == ARRAY_SIZE(pairs))
1834 		return -ENXIO;
1835 
1836 	if (kctl->tlv.c == NULL)
1837 		return -ENXIO;
1838 
1839 	/* Write and command operations are not allowed for locked element. */
1840 	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
1841 	    vd->owner != NULL && vd->owner != file)
1842 		return -EPERM;
1843 
1844 	ret = snd_power_ref_and_wait(file->card);
1845 	if (!ret)
1846 		ret = kctl->tlv.c(kctl, op_flag, size, buf);
1847 	snd_power_unref(file->card);
1848 	return ret;
1849 }
1850 
1851 static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
1852 			unsigned int __user *buf, unsigned int size)
1853 {
1854 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1855 	unsigned int len;
1856 
1857 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
1858 		return -ENXIO;
1859 
1860 	if (kctl->tlv.p == NULL)
1861 		return -ENXIO;
1862 
1863 	len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
1864 	if (size < len)
1865 		return -ENOMEM;
1866 
1867 	if (copy_to_user(buf, kctl->tlv.p, len))
1868 		return -EFAULT;
1869 
1870 	return 0;
1871 }
1872 
1873 static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1874 			     struct snd_ctl_tlv __user *buf,
1875                              int op_flag)
1876 {
1877 	struct snd_ctl_tlv header;
1878 	unsigned int __user *container;
1879 	unsigned int container_size;
1880 	struct snd_kcontrol *kctl;
1881 	struct snd_ctl_elem_id id;
1882 	struct snd_kcontrol_volatile *vd;
1883 
1884 	lockdep_assert_held(&file->card->controls_rwsem);
1885 
1886 	if (copy_from_user(&header, buf, sizeof(header)))
1887 		return -EFAULT;
1888 
1889 	/* In design of control core, numerical ID starts at 1. */
1890 	if (header.numid == 0)
1891 		return -EINVAL;
1892 
1893 	/* At least, container should include type and length fields.  */
1894 	if (header.length < sizeof(unsigned int) * 2)
1895 		return -EINVAL;
1896 	container_size = header.length;
1897 	container = buf->tlv;
1898 
1899 	kctl = snd_ctl_find_numid_locked(file->card, header.numid);
1900 	if (kctl == NULL)
1901 		return -ENOENT;
1902 
1903 	/* Calculate index of the element in this set. */
1904 	id = kctl->id;
1905 	snd_ctl_build_ioff(&id, kctl, header.numid - id.numid);
1906 	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1907 
1908 	if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1909 		return call_tlv_handler(file, op_flag, kctl, &id, container,
1910 					container_size);
1911 	} else {
1912 		if (op_flag == SNDRV_CTL_TLV_OP_READ) {
1913 			return read_tlv_buf(kctl, &id, container,
1914 					    container_size);
1915 		}
1916 	}
1917 
1918 	/* Not supported. */
1919 	return -ENXIO;
1920 }
1921 
1922 static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1923 {
1924 	struct snd_ctl_file *ctl;
1925 	struct snd_card *card;
1926 	struct snd_kctl_ioctl *p;
1927 	void __user *argp = (void __user *)arg;
1928 	int __user *ip = argp;
1929 	int err;
1930 
1931 	ctl = file->private_data;
1932 	card = ctl->card;
1933 	if (snd_BUG_ON(!card))
1934 		return -ENXIO;
1935 	switch (cmd) {
1936 	case SNDRV_CTL_IOCTL_PVERSION:
1937 		return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1938 	case SNDRV_CTL_IOCTL_CARD_INFO:
1939 		return snd_ctl_card_info(card, ctl, cmd, argp);
1940 	case SNDRV_CTL_IOCTL_ELEM_LIST:
1941 		return snd_ctl_elem_list_user(card, argp);
1942 	case SNDRV_CTL_IOCTL_ELEM_INFO:
1943 		return snd_ctl_elem_info_user(ctl, argp);
1944 	case SNDRV_CTL_IOCTL_ELEM_READ:
1945 		return snd_ctl_elem_read_user(card, argp);
1946 	case SNDRV_CTL_IOCTL_ELEM_WRITE:
1947 		return snd_ctl_elem_write_user(ctl, argp);
1948 	case SNDRV_CTL_IOCTL_ELEM_LOCK:
1949 		return snd_ctl_elem_lock(ctl, argp);
1950 	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1951 		return snd_ctl_elem_unlock(ctl, argp);
1952 	case SNDRV_CTL_IOCTL_ELEM_ADD:
1953 		return snd_ctl_elem_add_user(ctl, argp, 0);
1954 	case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1955 		return snd_ctl_elem_add_user(ctl, argp, 1);
1956 	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1957 		return snd_ctl_elem_remove(ctl, argp);
1958 	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1959 		return snd_ctl_subscribe_events(ctl, ip);
1960 	case SNDRV_CTL_IOCTL_TLV_READ:
1961 		scoped_guard(rwsem_read, &ctl->card->controls_rwsem)
1962 			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
1963 		return err;
1964 	case SNDRV_CTL_IOCTL_TLV_WRITE:
1965 		scoped_guard(rwsem_write, &ctl->card->controls_rwsem)
1966 			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
1967 		return err;
1968 	case SNDRV_CTL_IOCTL_TLV_COMMAND:
1969 		scoped_guard(rwsem_write, &ctl->card->controls_rwsem)
1970 			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
1971 		return err;
1972 	case SNDRV_CTL_IOCTL_POWER:
1973 		return -ENOPROTOOPT;
1974 	case SNDRV_CTL_IOCTL_POWER_STATE:
1975 		return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1976 	}
1977 
1978 	guard(rwsem_read)(&snd_ioctl_rwsem);
1979 	list_for_each_entry(p, &snd_control_ioctls, list) {
1980 		err = p->fioctl(card, ctl, cmd, arg);
1981 		if (err != -ENOIOCTLCMD)
1982 			return err;
1983 	}
1984 	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
1985 	return -ENOTTY;
1986 }
1987 
1988 static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1989 			    size_t count, loff_t * offset)
1990 {
1991 	struct snd_ctl_file *ctl;
1992 	int err = 0;
1993 	ssize_t result = 0;
1994 
1995 	ctl = file->private_data;
1996 	if (snd_BUG_ON(!ctl || !ctl->card))
1997 		return -ENXIO;
1998 	if (!ctl->subscribed)
1999 		return -EBADFD;
2000 	if (count < sizeof(struct snd_ctl_event))
2001 		return -EINVAL;
2002 	spin_lock_irq(&ctl->read_lock);
2003 	while (count >= sizeof(struct snd_ctl_event)) {
2004 		struct snd_ctl_event ev;
2005 		struct snd_kctl_event *kev;
2006 		while (list_empty(&ctl->events)) {
2007 			wait_queue_entry_t wait;
2008 			if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
2009 				err = -EAGAIN;
2010 				goto __end_lock;
2011 			}
2012 			init_waitqueue_entry(&wait, current);
2013 			add_wait_queue(&ctl->change_sleep, &wait);
2014 			set_current_state(TASK_INTERRUPTIBLE);
2015 			spin_unlock_irq(&ctl->read_lock);
2016 			schedule();
2017 			remove_wait_queue(&ctl->change_sleep, &wait);
2018 			if (ctl->card->shutdown)
2019 				return -ENODEV;
2020 			if (signal_pending(current))
2021 				return -ERESTARTSYS;
2022 			spin_lock_irq(&ctl->read_lock);
2023 		}
2024 		kev = snd_kctl_event(ctl->events.next);
2025 		ev.type = SNDRV_CTL_EVENT_ELEM;
2026 		ev.data.elem.mask = kev->mask;
2027 		ev.data.elem.id = kev->id;
2028 		list_del(&kev->list);
2029 		spin_unlock_irq(&ctl->read_lock);
2030 		kfree(kev);
2031 		if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
2032 			err = -EFAULT;
2033 			goto __end;
2034 		}
2035 		spin_lock_irq(&ctl->read_lock);
2036 		buffer += sizeof(struct snd_ctl_event);
2037 		count -= sizeof(struct snd_ctl_event);
2038 		result += sizeof(struct snd_ctl_event);
2039 	}
2040       __end_lock:
2041 	spin_unlock_irq(&ctl->read_lock);
2042       __end:
2043       	return result > 0 ? result : err;
2044 }
2045 
2046 static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
2047 {
2048 	__poll_t mask;
2049 	struct snd_ctl_file *ctl;
2050 
2051 	ctl = file->private_data;
2052 	if (!ctl->subscribed)
2053 		return 0;
2054 	poll_wait(file, &ctl->change_sleep, wait);
2055 
2056 	mask = 0;
2057 	if (!list_empty(&ctl->events))
2058 		mask |= EPOLLIN | EPOLLRDNORM;
2059 
2060 	return mask;
2061 }
2062 
2063 /*
2064  * register the device-specific control-ioctls.
2065  * called from each device manager like pcm.c, hwdep.c, etc.
2066  */
2067 static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
2068 {
2069 	struct snd_kctl_ioctl *pn;
2070 
2071 	pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
2072 	if (pn == NULL)
2073 		return -ENOMEM;
2074 	pn->fioctl = fcn;
2075 	guard(rwsem_write)(&snd_ioctl_rwsem);
2076 	list_add_tail(&pn->list, lists);
2077 	return 0;
2078 }
2079 
2080 /**
2081  * snd_ctl_register_ioctl - register the device-specific control-ioctls
2082  * @fcn: ioctl callback function
2083  *
2084  * called from each device manager like pcm.c, hwdep.c, etc.
2085  *
2086  * Return: zero if successful, or a negative error code
2087  */
2088 int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
2089 {
2090 	return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
2091 }
2092 EXPORT_SYMBOL(snd_ctl_register_ioctl);
2093 
2094 #ifdef CONFIG_COMPAT
2095 /**
2096  * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
2097  * control-ioctls
2098  * @fcn: ioctl callback function
2099  *
2100  * Return: zero if successful, or a negative error code
2101  */
2102 int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2103 {
2104 	return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
2105 }
2106 EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
2107 #endif
2108 
2109 /*
2110  * de-register the device-specific control-ioctls.
2111  */
2112 static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
2113 				     struct list_head *lists)
2114 {
2115 	struct snd_kctl_ioctl *p;
2116 
2117 	if (snd_BUG_ON(!fcn))
2118 		return -EINVAL;
2119 	guard(rwsem_write)(&snd_ioctl_rwsem);
2120 	list_for_each_entry(p, lists, list) {
2121 		if (p->fioctl == fcn) {
2122 			list_del(&p->list);
2123 			kfree(p);
2124 			return 0;
2125 		}
2126 	}
2127 	snd_BUG();
2128 	return -EINVAL;
2129 }
2130 
2131 /**
2132  * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
2133  * @fcn: ioctl callback function to unregister
2134  *
2135  * Return: zero if successful, or a negative error code
2136  */
2137 int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
2138 {
2139 	return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
2140 }
2141 EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
2142 
2143 #ifdef CONFIG_COMPAT
2144 /**
2145  * snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
2146  * 32bit control-ioctls
2147  * @fcn: ioctl callback function to unregister
2148  *
2149  * Return: zero if successful, or a negative error code
2150  */
2151 int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2152 {
2153 	return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
2154 }
2155 EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
2156 #endif
2157 
2158 static int snd_ctl_fasync(int fd, struct file * file, int on)
2159 {
2160 	struct snd_ctl_file *ctl;
2161 
2162 	ctl = file->private_data;
2163 	return snd_fasync_helper(fd, file, on, &ctl->fasync);
2164 }
2165 
2166 /* return the preferred subdevice number if already assigned;
2167  * otherwise return -1
2168  */
2169 int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
2170 {
2171 	struct snd_ctl_file *kctl;
2172 	int subdevice = -1;
2173 
2174 	guard(read_lock_irqsave)(&card->ctl_files_rwlock);
2175 	list_for_each_entry(kctl, &card->ctl_files, list) {
2176 		if (kctl->pid == task_pid(current)) {
2177 			subdevice = kctl->preferred_subdevice[type];
2178 			if (subdevice != -1)
2179 				break;
2180 		}
2181 	}
2182 	return subdevice;
2183 }
2184 EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
2185 
2186 /*
2187  * ioctl32 compat
2188  */
2189 #ifdef CONFIG_COMPAT
2190 #include "control_compat.c"
2191 #else
2192 #define snd_ctl_ioctl_compat	NULL
2193 #endif
2194 
2195 /*
2196  * control layers (audio LED etc.)
2197  */
2198 
2199 /**
2200  * snd_ctl_request_layer - request to use the layer
2201  * @module_name: Name of the kernel module (NULL == build-in)
2202  *
2203  * Return: zero if successful, or an error code when the module cannot be loaded
2204  */
2205 int snd_ctl_request_layer(const char *module_name)
2206 {
2207 	struct snd_ctl_layer_ops *lops;
2208 
2209 	if (module_name == NULL)
2210 		return 0;
2211 	scoped_guard(rwsem_read, &snd_ctl_layer_rwsem) {
2212 		for (lops = snd_ctl_layer; lops; lops = lops->next)
2213 			if (strcmp(lops->module_name, module_name) == 0)
2214 				return 0;
2215 	}
2216 	return request_module(module_name);
2217 }
2218 EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
2219 
2220 /**
2221  * snd_ctl_register_layer - register new control layer
2222  * @lops: operation structure
2223  *
2224  * The new layer can track all control elements and do additional
2225  * operations on top (like audio LED handling).
2226  */
2227 void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
2228 {
2229 	struct snd_card *card;
2230 	int card_number;
2231 
2232 	scoped_guard(rwsem_write, &snd_ctl_layer_rwsem) {
2233 		lops->next = snd_ctl_layer;
2234 		snd_ctl_layer = lops;
2235 	}
2236 	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
2237 		card = snd_card_ref(card_number);
2238 		if (card) {
2239 			scoped_guard(rwsem_read, &card->controls_rwsem)
2240 				lops->lregister(card);
2241 			snd_card_unref(card);
2242 		}
2243 	}
2244 }
2245 EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
2246 
2247 /**
2248  * snd_ctl_disconnect_layer - disconnect control layer
2249  * @lops: operation structure
2250  *
2251  * It is expected that the information about tracked cards
2252  * is freed before this call (the disconnect callback is
2253  * not called here).
2254  */
2255 void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
2256 {
2257 	struct snd_ctl_layer_ops *lops2, *prev_lops2;
2258 
2259 	guard(rwsem_write)(&snd_ctl_layer_rwsem);
2260 	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
2261 		if (lops2 == lops) {
2262 			if (!prev_lops2)
2263 				snd_ctl_layer = lops->next;
2264 			else
2265 				prev_lops2->next = lops->next;
2266 			break;
2267 		}
2268 		prev_lops2 = lops2;
2269 	}
2270 }
2271 EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
2272 
2273 /*
2274  *  INIT PART
2275  */
2276 
2277 static const struct file_operations snd_ctl_f_ops =
2278 {
2279 	.owner =	THIS_MODULE,
2280 	.read =		snd_ctl_read,
2281 	.open =		snd_ctl_open,
2282 	.release =	snd_ctl_release,
2283 	.llseek =	no_llseek,
2284 	.poll =		snd_ctl_poll,
2285 	.unlocked_ioctl =	snd_ctl_ioctl,
2286 	.compat_ioctl =	snd_ctl_ioctl_compat,
2287 	.fasync =	snd_ctl_fasync,
2288 };
2289 
2290 /* call lops under rwsems; called from snd_ctl_dev_*() below() */
2291 #define call_snd_ctl_lops(_card, _op)				    \
2292 	do {							    \
2293 		struct snd_ctl_layer_ops *lops;			    \
2294 		guard(rwsem_read)(&(_card)->controls_rwsem);	    \
2295 		guard(rwsem_read)(&snd_ctl_layer_rwsem);	    \
2296 		for (lops = snd_ctl_layer; lops; lops = lops->next) \
2297 			lops->_op(_card);			    \
2298 	} while (0)
2299 
2300 /*
2301  * registration of the control device
2302  */
2303 static int snd_ctl_dev_register(struct snd_device *device)
2304 {
2305 	struct snd_card *card = device->device_data;
2306 	int err;
2307 
2308 	err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
2309 				  &snd_ctl_f_ops, card, card->ctl_dev);
2310 	if (err < 0)
2311 		return err;
2312 	call_snd_ctl_lops(card, lregister);
2313 	return 0;
2314 }
2315 
2316 /*
2317  * disconnection of the control device
2318  */
2319 static int snd_ctl_dev_disconnect(struct snd_device *device)
2320 {
2321 	struct snd_card *card = device->device_data;
2322 	struct snd_ctl_file *ctl;
2323 
2324 	scoped_guard(read_lock_irqsave, &card->ctl_files_rwlock) {
2325 		list_for_each_entry(ctl, &card->ctl_files, list) {
2326 			wake_up(&ctl->change_sleep);
2327 			snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
2328 		}
2329 	}
2330 
2331 	call_snd_ctl_lops(card, ldisconnect);
2332 	return snd_unregister_device(card->ctl_dev);
2333 }
2334 
2335 /*
2336  * free all controls
2337  */
2338 static int snd_ctl_dev_free(struct snd_device *device)
2339 {
2340 	struct snd_card *card = device->device_data;
2341 	struct snd_kcontrol *control;
2342 
2343 	scoped_guard(rwsem_write, &card->controls_rwsem) {
2344 		while (!list_empty(&card->controls)) {
2345 			control = snd_kcontrol(card->controls.next);
2346 			__snd_ctl_remove(card, control, false);
2347 		}
2348 
2349 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
2350 		xa_destroy(&card->ctl_numids);
2351 		xa_destroy(&card->ctl_hash);
2352 #endif
2353 	}
2354 	put_device(card->ctl_dev);
2355 	return 0;
2356 }
2357 
2358 /*
2359  * create control core:
2360  * called from init.c
2361  */
2362 int snd_ctl_create(struct snd_card *card)
2363 {
2364 	static const struct snd_device_ops ops = {
2365 		.dev_free = snd_ctl_dev_free,
2366 		.dev_register =	snd_ctl_dev_register,
2367 		.dev_disconnect = snd_ctl_dev_disconnect,
2368 	};
2369 	int err;
2370 
2371 	if (snd_BUG_ON(!card))
2372 		return -ENXIO;
2373 	if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
2374 		return -ENXIO;
2375 
2376 	err = snd_device_alloc(&card->ctl_dev, card);
2377 	if (err < 0)
2378 		return err;
2379 	dev_set_name(card->ctl_dev, "controlC%d", card->number);
2380 
2381 	err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
2382 	if (err < 0)
2383 		put_device(card->ctl_dev);
2384 	return err;
2385 }
2386 
2387 /*
2388  * Frequently used control callbacks/helpers
2389  */
2390 
2391 /**
2392  * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
2393  * callback with a mono channel
2394  * @kcontrol: the kcontrol instance
2395  * @uinfo: info to store
2396  *
2397  * This is a function that can be used as info callback for a standard
2398  * boolean control with a single mono channel.
2399  *
2400  * Return: Zero (always successful)
2401  */
2402 int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
2403 			      struct snd_ctl_elem_info *uinfo)
2404 {
2405 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2406 	uinfo->count = 1;
2407 	uinfo->value.integer.min = 0;
2408 	uinfo->value.integer.max = 1;
2409 	return 0;
2410 }
2411 EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
2412 
2413 /**
2414  * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
2415  * callback with stereo two channels
2416  * @kcontrol: the kcontrol instance
2417  * @uinfo: info to store
2418  *
2419  * This is a function that can be used as info callback for a standard
2420  * boolean control with stereo two channels.
2421  *
2422  * Return: Zero (always successful)
2423  */
2424 int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
2425 				struct snd_ctl_elem_info *uinfo)
2426 {
2427 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2428 	uinfo->count = 2;
2429 	uinfo->value.integer.min = 0;
2430 	uinfo->value.integer.max = 1;
2431 	return 0;
2432 }
2433 EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
2434 
2435 /**
2436  * snd_ctl_enum_info - fills the info structure for an enumerated control
2437  * @info: the structure to be filled
2438  * @channels: the number of the control's channels; often one
2439  * @items: the number of control values; also the size of @names
2440  * @names: an array containing the names of all control values
2441  *
2442  * Sets all required fields in @info to their appropriate values.
2443  * If the control's accessibility is not the default (readable and writable),
2444  * the caller has to fill @info->access.
2445  *
2446  * Return: Zero (always successful)
2447  */
2448 int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
2449 		      unsigned int items, const char *const names[])
2450 {
2451 	info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
2452 	info->count = channels;
2453 	info->value.enumerated.items = items;
2454 	if (!items)
2455 		return 0;
2456 	if (info->value.enumerated.item >= items)
2457 		info->value.enumerated.item = items - 1;
2458 	WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
2459 	     "ALSA: too long item name '%s'\n",
2460 	     names[info->value.enumerated.item]);
2461 	strscpy(info->value.enumerated.name,
2462 		names[info->value.enumerated.item],
2463 		sizeof(info->value.enumerated.name));
2464 	return 0;
2465 }
2466 EXPORT_SYMBOL(snd_ctl_enum_info);
2467