xref: /linux/sound/core/control.c (revision 6beeaf48db6c548fcfc2ad32739d33af2fef3a5b)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Routines for driver control interface
4  *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
5  */
6 
7 #include <linux/threads.h>
8 #include <linux/interrupt.h>
9 #include <linux/module.h>
10 #include <linux/moduleparam.h>
11 #include <linux/slab.h>
12 #include <linux/vmalloc.h>
13 #include <linux/time.h>
14 #include <linux/mm.h>
15 #include <linux/math64.h>
16 #include <linux/sched/signal.h>
17 #include <sound/core.h>
18 #include <sound/minors.h>
19 #include <sound/info.h>
20 #include <sound/control.h>
21 
22 // Max allocation size for user controls.
23 static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
24 module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
25 MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
26 
27 #define MAX_CONTROL_COUNT	1028
28 
29 struct snd_kctl_ioctl {
30 	struct list_head list;		/* list of all ioctls */
31 	snd_kctl_ioctl_func_t fioctl;
32 };
33 
34 static DECLARE_RWSEM(snd_ioctl_rwsem);
35 static DECLARE_RWSEM(snd_ctl_layer_rwsem);
36 static LIST_HEAD(snd_control_ioctls);
37 #ifdef CONFIG_COMPAT
38 static LIST_HEAD(snd_control_compat_ioctls);
39 #endif
40 static struct snd_ctl_layer_ops *snd_ctl_layer;
41 
42 static int snd_ctl_open(struct inode *inode, struct file *file)
43 {
44 	unsigned long flags;
45 	struct snd_card *card;
46 	struct snd_ctl_file *ctl;
47 	int i, err;
48 
49 	err = stream_open(inode, file);
50 	if (err < 0)
51 		return err;
52 
53 	card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
54 	if (!card) {
55 		err = -ENODEV;
56 		goto __error1;
57 	}
58 	err = snd_card_file_add(card, file);
59 	if (err < 0) {
60 		err = -ENODEV;
61 		goto __error1;
62 	}
63 	if (!try_module_get(card->module)) {
64 		err = -EFAULT;
65 		goto __error2;
66 	}
67 	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
68 	if (ctl == NULL) {
69 		err = -ENOMEM;
70 		goto __error;
71 	}
72 	INIT_LIST_HEAD(&ctl->events);
73 	init_waitqueue_head(&ctl->change_sleep);
74 	spin_lock_init(&ctl->read_lock);
75 	ctl->card = card;
76 	for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
77 		ctl->preferred_subdevice[i] = -1;
78 	ctl->pid = get_pid(task_pid(current));
79 	file->private_data = ctl;
80 	write_lock_irqsave(&card->ctl_files_rwlock, flags);
81 	list_add_tail(&ctl->list, &card->ctl_files);
82 	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
83 	snd_card_unref(card);
84 	return 0;
85 
86       __error:
87 	module_put(card->module);
88       __error2:
89 	snd_card_file_remove(card, file);
90       __error1:
91 	if (card)
92 		snd_card_unref(card);
93       	return err;
94 }
95 
96 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
97 {
98 	unsigned long flags;
99 	struct snd_kctl_event *cread;
100 
101 	spin_lock_irqsave(&ctl->read_lock, flags);
102 	while (!list_empty(&ctl->events)) {
103 		cread = snd_kctl_event(ctl->events.next);
104 		list_del(&cread->list);
105 		kfree(cread);
106 	}
107 	spin_unlock_irqrestore(&ctl->read_lock, flags);
108 }
109 
110 static int snd_ctl_release(struct inode *inode, struct file *file)
111 {
112 	unsigned long flags;
113 	struct snd_card *card;
114 	struct snd_ctl_file *ctl;
115 	struct snd_kcontrol *control;
116 	unsigned int idx;
117 
118 	ctl = file->private_data;
119 	file->private_data = NULL;
120 	card = ctl->card;
121 	write_lock_irqsave(&card->ctl_files_rwlock, flags);
122 	list_del(&ctl->list);
123 	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
124 	down_write(&card->controls_rwsem);
125 	list_for_each_entry(control, &card->controls, list)
126 		for (idx = 0; idx < control->count; idx++)
127 			if (control->vd[idx].owner == ctl)
128 				control->vd[idx].owner = NULL;
129 	up_write(&card->controls_rwsem);
130 	snd_ctl_empty_read_queue(ctl);
131 	put_pid(ctl->pid);
132 	kfree(ctl);
133 	module_put(card->module);
134 	snd_card_file_remove(card, file);
135 	return 0;
136 }
137 
138 /**
139  * snd_ctl_notify - Send notification to user-space for a control change
140  * @card: the card to send notification
141  * @mask: the event mask, SNDRV_CTL_EVENT_*
142  * @id: the ctl element id to send notification
143  *
144  * This function adds an event record with the given id and mask, appends
145  * to the list and wakes up the user-space for notification.  This can be
146  * called in the atomic context.
147  */
148 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
149 		    struct snd_ctl_elem_id *id)
150 {
151 	unsigned long flags;
152 	struct snd_ctl_file *ctl;
153 	struct snd_kctl_event *ev;
154 
155 	if (snd_BUG_ON(!card || !id))
156 		return;
157 	if (card->shutdown)
158 		return;
159 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
160 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
161 	card->mixer_oss_change_count++;
162 #endif
163 	list_for_each_entry(ctl, &card->ctl_files, list) {
164 		if (!ctl->subscribed)
165 			continue;
166 		spin_lock(&ctl->read_lock);
167 		list_for_each_entry(ev, &ctl->events, list) {
168 			if (ev->id.numid == id->numid) {
169 				ev->mask |= mask;
170 				goto _found;
171 			}
172 		}
173 		ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
174 		if (ev) {
175 			ev->id = *id;
176 			ev->mask = mask;
177 			list_add_tail(&ev->list, &ctl->events);
178 		} else {
179 			dev_err(card->dev, "No memory available to allocate event\n");
180 		}
181 	_found:
182 		wake_up(&ctl->change_sleep);
183 		spin_unlock(&ctl->read_lock);
184 		kill_fasync(&ctl->fasync, SIGIO, POLL_IN);
185 	}
186 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
187 }
188 EXPORT_SYMBOL(snd_ctl_notify);
189 
190 /**
191  * snd_ctl_notify_one - Send notification to user-space for a control change
192  * @card: the card to send notification
193  * @mask: the event mask, SNDRV_CTL_EVENT_*
194  * @kctl: the pointer with the control instance
195  * @ioff: the additional offset to the control index
196  *
197  * This function calls snd_ctl_notify() and does additional jobs
198  * like LED state changes.
199  */
200 void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
201 			struct snd_kcontrol *kctl, unsigned int ioff)
202 {
203 	struct snd_ctl_elem_id id = kctl->id;
204 	struct snd_ctl_layer_ops *lops;
205 
206 	id.index += ioff;
207 	id.numid += ioff;
208 	snd_ctl_notify(card, mask, &id);
209 	down_read(&snd_ctl_layer_rwsem);
210 	for (lops = snd_ctl_layer; lops; lops = lops->next)
211 		lops->lnotify(card, mask, kctl, ioff);
212 	up_read(&snd_ctl_layer_rwsem);
213 }
214 EXPORT_SYMBOL(snd_ctl_notify_one);
215 
216 /**
217  * snd_ctl_new - create a new control instance with some elements
218  * @kctl: the pointer to store new control instance
219  * @count: the number of elements in this control
220  * @access: the default access flags for elements in this control
221  * @file: given when locking these elements
222  *
223  * Allocates a memory object for a new control instance. The instance has
224  * elements as many as the given number (@count). Each element has given
225  * access permissions (@access). Each element is locked when @file is given.
226  *
227  * Return: 0 on success, error code on failure
228  */
229 static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
230 		       unsigned int access, struct snd_ctl_file *file)
231 {
232 	unsigned int idx;
233 
234 	if (count == 0 || count > MAX_CONTROL_COUNT)
235 		return -EINVAL;
236 
237 	*kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
238 	if (!*kctl)
239 		return -ENOMEM;
240 
241 	for (idx = 0; idx < count; idx++) {
242 		(*kctl)->vd[idx].access = access;
243 		(*kctl)->vd[idx].owner = file;
244 	}
245 	(*kctl)->count = count;
246 
247 	return 0;
248 }
249 
250 /**
251  * snd_ctl_new1 - create a control instance from the template
252  * @ncontrol: the initialization record
253  * @private_data: the private data to set
254  *
255  * Allocates a new struct snd_kcontrol instance and initialize from the given
256  * template.  When the access field of ncontrol is 0, it's assumed as
257  * READWRITE access. When the count field is 0, it's assumes as one.
258  *
259  * Return: The pointer of the newly generated instance, or %NULL on failure.
260  */
261 struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
262 				  void *private_data)
263 {
264 	struct snd_kcontrol *kctl;
265 	unsigned int count;
266 	unsigned int access;
267 	int err;
268 
269 	if (snd_BUG_ON(!ncontrol || !ncontrol->info))
270 		return NULL;
271 
272 	count = ncontrol->count;
273 	if (count == 0)
274 		count = 1;
275 
276 	access = ncontrol->access;
277 	if (access == 0)
278 		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
279 	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
280 		   SNDRV_CTL_ELEM_ACCESS_VOLATILE |
281 		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
282 		   SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
283 		   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
284 		   SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
285 		   SNDRV_CTL_ELEM_ACCESS_LED_MASK |
286 		   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
287 
288 	err = snd_ctl_new(&kctl, count, access, NULL);
289 	if (err < 0)
290 		return NULL;
291 
292 	/* The 'numid' member is decided when calling snd_ctl_add(). */
293 	kctl->id.iface = ncontrol->iface;
294 	kctl->id.device = ncontrol->device;
295 	kctl->id.subdevice = ncontrol->subdevice;
296 	if (ncontrol->name) {
297 		strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
298 		if (strcmp(ncontrol->name, kctl->id.name) != 0)
299 			pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
300 				ncontrol->name, kctl->id.name);
301 	}
302 	kctl->id.index = ncontrol->index;
303 
304 	kctl->info = ncontrol->info;
305 	kctl->get = ncontrol->get;
306 	kctl->put = ncontrol->put;
307 	kctl->tlv.p = ncontrol->tlv.p;
308 
309 	kctl->private_value = ncontrol->private_value;
310 	kctl->private_data = private_data;
311 
312 	return kctl;
313 }
314 EXPORT_SYMBOL(snd_ctl_new1);
315 
316 /**
317  * snd_ctl_free_one - release the control instance
318  * @kcontrol: the control instance
319  *
320  * Releases the control instance created via snd_ctl_new()
321  * or snd_ctl_new1().
322  * Don't call this after the control was added to the card.
323  */
324 void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
325 {
326 	if (kcontrol) {
327 		if (kcontrol->private_free)
328 			kcontrol->private_free(kcontrol);
329 		kfree(kcontrol);
330 	}
331 }
332 EXPORT_SYMBOL(snd_ctl_free_one);
333 
334 static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
335 					  unsigned int count)
336 {
337 	struct snd_kcontrol *kctl;
338 
339 	/* Make sure that the ids assigned to the control do not wrap around */
340 	if (card->last_numid >= UINT_MAX - count)
341 		card->last_numid = 0;
342 
343 	list_for_each_entry(kctl, &card->controls, list) {
344 		if (kctl->id.numid < card->last_numid + 1 + count &&
345 		    kctl->id.numid + kctl->count > card->last_numid + 1) {
346 		    	card->last_numid = kctl->id.numid + kctl->count - 1;
347 			return true;
348 		}
349 	}
350 	return false;
351 }
352 
353 static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
354 {
355 	unsigned int iter = 100000;
356 
357 	while (snd_ctl_remove_numid_conflict(card, count)) {
358 		if (--iter == 0) {
359 			/* this situation is very unlikely */
360 			dev_err(card->dev, "unable to allocate new control numid\n");
361 			return -ENOMEM;
362 		}
363 	}
364 	return 0;
365 }
366 
367 enum snd_ctl_add_mode {
368 	CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
369 };
370 
371 /* add/replace a new kcontrol object; call with card->controls_rwsem locked */
372 static int __snd_ctl_add_replace(struct snd_card *card,
373 				 struct snd_kcontrol *kcontrol,
374 				 enum snd_ctl_add_mode mode)
375 {
376 	struct snd_ctl_elem_id id;
377 	unsigned int idx;
378 	struct snd_kcontrol *old;
379 	int err;
380 
381 	id = kcontrol->id;
382 	if (id.index > UINT_MAX - kcontrol->count)
383 		return -EINVAL;
384 
385 	old = snd_ctl_find_id(card, &id);
386 	if (!old) {
387 		if (mode == CTL_REPLACE)
388 			return -EINVAL;
389 	} else {
390 		if (mode == CTL_ADD_EXCLUSIVE) {
391 			dev_err(card->dev,
392 				"control %i:%i:%i:%s:%i is already present\n",
393 				id.iface, id.device, id.subdevice, id.name,
394 				id.index);
395 			return -EBUSY;
396 		}
397 
398 		err = snd_ctl_remove(card, old);
399 		if (err < 0)
400 			return err;
401 	}
402 
403 	if (snd_ctl_find_hole(card, kcontrol->count) < 0)
404 		return -ENOMEM;
405 
406 	list_add_tail(&kcontrol->list, &card->controls);
407 	card->controls_count += kcontrol->count;
408 	kcontrol->id.numid = card->last_numid + 1;
409 	card->last_numid += kcontrol->count;
410 
411 	for (idx = 0; idx < kcontrol->count; idx++)
412 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
413 
414 	return 0;
415 }
416 
417 static int snd_ctl_add_replace(struct snd_card *card,
418 			       struct snd_kcontrol *kcontrol,
419 			       enum snd_ctl_add_mode mode)
420 {
421 	int err = -EINVAL;
422 
423 	if (! kcontrol)
424 		return err;
425 	if (snd_BUG_ON(!card || !kcontrol->info))
426 		goto error;
427 
428 	down_write(&card->controls_rwsem);
429 	err = __snd_ctl_add_replace(card, kcontrol, mode);
430 	up_write(&card->controls_rwsem);
431 	if (err < 0)
432 		goto error;
433 	return 0;
434 
435  error:
436 	snd_ctl_free_one(kcontrol);
437 	return err;
438 }
439 
440 /**
441  * snd_ctl_add - add the control instance to the card
442  * @card: the card instance
443  * @kcontrol: the control instance to add
444  *
445  * Adds the control instance created via snd_ctl_new() or
446  * snd_ctl_new1() to the given card. Assigns also an unique
447  * numid used for fast search.
448  *
449  * It frees automatically the control which cannot be added.
450  *
451  * Return: Zero if successful, or a negative error code on failure.
452  *
453  */
454 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
455 {
456 	return snd_ctl_add_replace(card, kcontrol, CTL_ADD_EXCLUSIVE);
457 }
458 EXPORT_SYMBOL(snd_ctl_add);
459 
460 /**
461  * snd_ctl_replace - replace the control instance of the card
462  * @card: the card instance
463  * @kcontrol: the control instance to replace
464  * @add_on_replace: add the control if not already added
465  *
466  * Replaces the given control.  If the given control does not exist
467  * and the add_on_replace flag is set, the control is added.  If the
468  * control exists, it is destroyed first.
469  *
470  * It frees automatically the control which cannot be added or replaced.
471  *
472  * Return: Zero if successful, or a negative error code on failure.
473  */
474 int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
475 		    bool add_on_replace)
476 {
477 	return snd_ctl_add_replace(card, kcontrol,
478 				   add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
479 }
480 EXPORT_SYMBOL(snd_ctl_replace);
481 
482 /**
483  * snd_ctl_remove - remove the control from the card and release it
484  * @card: the card instance
485  * @kcontrol: the control instance to remove
486  *
487  * Removes the control from the card and then releases the instance.
488  * You don't need to call snd_ctl_free_one(). You must be in
489  * the write lock - down_write(&card->controls_rwsem).
490  *
491  * Return: 0 if successful, or a negative error code on failure.
492  */
493 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
494 {
495 	unsigned int idx;
496 
497 	if (snd_BUG_ON(!card || !kcontrol))
498 		return -EINVAL;
499 	list_del(&kcontrol->list);
500 	card->controls_count -= kcontrol->count;
501 	for (idx = 0; idx < kcontrol->count; idx++)
502 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
503 	snd_ctl_free_one(kcontrol);
504 	return 0;
505 }
506 EXPORT_SYMBOL(snd_ctl_remove);
507 
508 /**
509  * snd_ctl_remove_id - remove the control of the given id and release it
510  * @card: the card instance
511  * @id: the control id to remove
512  *
513  * Finds the control instance with the given id, removes it from the
514  * card list and releases it.
515  *
516  * Return: 0 if successful, or a negative error code on failure.
517  */
518 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
519 {
520 	struct snd_kcontrol *kctl;
521 	int ret;
522 
523 	down_write(&card->controls_rwsem);
524 	kctl = snd_ctl_find_id(card, id);
525 	if (kctl == NULL) {
526 		up_write(&card->controls_rwsem);
527 		return -ENOENT;
528 	}
529 	ret = snd_ctl_remove(card, kctl);
530 	up_write(&card->controls_rwsem);
531 	return ret;
532 }
533 EXPORT_SYMBOL(snd_ctl_remove_id);
534 
535 /**
536  * snd_ctl_remove_user_ctl - remove and release the unlocked user control
537  * @file: active control handle
538  * @id: the control id to remove
539  *
540  * Finds the control instance with the given id, removes it from the
541  * card list and releases it.
542  *
543  * Return: 0 if successful, or a negative error code on failure.
544  */
545 static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
546 				   struct snd_ctl_elem_id *id)
547 {
548 	struct snd_card *card = file->card;
549 	struct snd_kcontrol *kctl;
550 	int idx, ret;
551 
552 	down_write(&card->controls_rwsem);
553 	kctl = snd_ctl_find_id(card, id);
554 	if (kctl == NULL) {
555 		ret = -ENOENT;
556 		goto error;
557 	}
558 	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
559 		ret = -EINVAL;
560 		goto error;
561 	}
562 	for (idx = 0; idx < kctl->count; idx++)
563 		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
564 			ret = -EBUSY;
565 			goto error;
566 		}
567 	ret = snd_ctl_remove(card, kctl);
568 error:
569 	up_write(&card->controls_rwsem);
570 	return ret;
571 }
572 
573 /**
574  * snd_ctl_activate_id - activate/inactivate the control of the given id
575  * @card: the card instance
576  * @id: the control id to activate/inactivate
577  * @active: non-zero to activate
578  *
579  * Finds the control instance with the given id, and activate or
580  * inactivate the control together with notification, if changed.
581  * The given ID data is filled with full information.
582  *
583  * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
584  */
585 int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
586 			int active)
587 {
588 	struct snd_kcontrol *kctl;
589 	struct snd_kcontrol_volatile *vd;
590 	unsigned int index_offset;
591 	int ret;
592 
593 	down_write(&card->controls_rwsem);
594 	kctl = snd_ctl_find_id(card, id);
595 	if (kctl == NULL) {
596 		ret = -ENOENT;
597 		goto unlock;
598 	}
599 	index_offset = snd_ctl_get_ioff(kctl, id);
600 	vd = &kctl->vd[index_offset];
601 	ret = 0;
602 	if (active) {
603 		if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
604 			goto unlock;
605 		vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
606 	} else {
607 		if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
608 			goto unlock;
609 		vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
610 	}
611 	snd_ctl_build_ioff(id, kctl, index_offset);
612 	downgrade_write(&card->controls_rwsem);
613 	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
614 	up_read(&card->controls_rwsem);
615 	return 1;
616 
617  unlock:
618 	up_write(&card->controls_rwsem);
619 	return ret;
620 }
621 EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
622 
623 /**
624  * snd_ctl_rename_id - replace the id of a control on the card
625  * @card: the card instance
626  * @src_id: the old id
627  * @dst_id: the new id
628  *
629  * Finds the control with the old id from the card, and replaces the
630  * id with the new one.
631  *
632  * Return: Zero if successful, or a negative error code on failure.
633  */
634 int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
635 		      struct snd_ctl_elem_id *dst_id)
636 {
637 	struct snd_kcontrol *kctl;
638 
639 	down_write(&card->controls_rwsem);
640 	kctl = snd_ctl_find_id(card, src_id);
641 	if (kctl == NULL) {
642 		up_write(&card->controls_rwsem);
643 		return -ENOENT;
644 	}
645 	kctl->id = *dst_id;
646 	kctl->id.numid = card->last_numid + 1;
647 	card->last_numid += kctl->count;
648 	up_write(&card->controls_rwsem);
649 	return 0;
650 }
651 EXPORT_SYMBOL(snd_ctl_rename_id);
652 
653 /**
654  * snd_ctl_find_numid - find the control instance with the given number-id
655  * @card: the card instance
656  * @numid: the number-id to search
657  *
658  * Finds the control instance with the given number-id from the card.
659  *
660  * The caller must down card->controls_rwsem before calling this function
661  * (if the race condition can happen).
662  *
663  * Return: The pointer of the instance if found, or %NULL if not.
664  *
665  */
666 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card, unsigned int numid)
667 {
668 	struct snd_kcontrol *kctl;
669 
670 	if (snd_BUG_ON(!card || !numid))
671 		return NULL;
672 	list_for_each_entry(kctl, &card->controls, list) {
673 		if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
674 			return kctl;
675 	}
676 	return NULL;
677 }
678 EXPORT_SYMBOL(snd_ctl_find_numid);
679 
680 /**
681  * snd_ctl_find_id - find the control instance with the given id
682  * @card: the card instance
683  * @id: the id to search
684  *
685  * Finds the control instance with the given id from the card.
686  *
687  * The caller must down card->controls_rwsem before calling this function
688  * (if the race condition can happen).
689  *
690  * Return: The pointer of the instance if found, or %NULL if not.
691  *
692  */
693 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
694 				     struct snd_ctl_elem_id *id)
695 {
696 	struct snd_kcontrol *kctl;
697 
698 	if (snd_BUG_ON(!card || !id))
699 		return NULL;
700 	if (id->numid != 0)
701 		return snd_ctl_find_numid(card, id->numid);
702 	list_for_each_entry(kctl, &card->controls, list) {
703 		if (kctl->id.iface != id->iface)
704 			continue;
705 		if (kctl->id.device != id->device)
706 			continue;
707 		if (kctl->id.subdevice != id->subdevice)
708 			continue;
709 		if (strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)))
710 			continue;
711 		if (kctl->id.index > id->index)
712 			continue;
713 		if (kctl->id.index + kctl->count <= id->index)
714 			continue;
715 		return kctl;
716 	}
717 	return NULL;
718 }
719 EXPORT_SYMBOL(snd_ctl_find_id);
720 
721 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
722 			     unsigned int cmd, void __user *arg)
723 {
724 	struct snd_ctl_card_info *info;
725 
726 	info = kzalloc(sizeof(*info), GFP_KERNEL);
727 	if (! info)
728 		return -ENOMEM;
729 	down_read(&snd_ioctl_rwsem);
730 	info->card = card->number;
731 	strscpy(info->id, card->id, sizeof(info->id));
732 	strscpy(info->driver, card->driver, sizeof(info->driver));
733 	strscpy(info->name, card->shortname, sizeof(info->name));
734 	strscpy(info->longname, card->longname, sizeof(info->longname));
735 	strscpy(info->mixername, card->mixername, sizeof(info->mixername));
736 	strscpy(info->components, card->components, sizeof(info->components));
737 	up_read(&snd_ioctl_rwsem);
738 	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
739 		kfree(info);
740 		return -EFAULT;
741 	}
742 	kfree(info);
743 	return 0;
744 }
745 
746 static int snd_ctl_elem_list(struct snd_card *card,
747 			     struct snd_ctl_elem_list *list)
748 {
749 	struct snd_kcontrol *kctl;
750 	struct snd_ctl_elem_id id;
751 	unsigned int offset, space, jidx;
752 	int err = 0;
753 
754 	offset = list->offset;
755 	space = list->space;
756 
757 	down_read(&card->controls_rwsem);
758 	list->count = card->controls_count;
759 	list->used = 0;
760 	if (space > 0) {
761 		list_for_each_entry(kctl, &card->controls, list) {
762 			if (offset >= kctl->count) {
763 				offset -= kctl->count;
764 				continue;
765 			}
766 			for (jidx = offset; jidx < kctl->count; jidx++) {
767 				snd_ctl_build_ioff(&id, kctl, jidx);
768 				if (copy_to_user(list->pids + list->used, &id,
769 						 sizeof(id))) {
770 					err = -EFAULT;
771 					goto out;
772 				}
773 				list->used++;
774 				if (!--space)
775 					goto out;
776 			}
777 			offset = 0;
778 		}
779 	}
780  out:
781 	up_read(&card->controls_rwsem);
782 	return err;
783 }
784 
785 static int snd_ctl_elem_list_user(struct snd_card *card,
786 				  struct snd_ctl_elem_list __user *_list)
787 {
788 	struct snd_ctl_elem_list list;
789 	int err;
790 
791 	if (copy_from_user(&list, _list, sizeof(list)))
792 		return -EFAULT;
793 	err = snd_ctl_elem_list(card, &list);
794 	if (err)
795 		return err;
796 	if (copy_to_user(_list, &list, sizeof(list)))
797 		return -EFAULT;
798 
799 	return 0;
800 }
801 
802 /* Check whether the given kctl info is valid */
803 static int snd_ctl_check_elem_info(struct snd_card *card,
804 				   const struct snd_ctl_elem_info *info)
805 {
806 	static const unsigned int max_value_counts[] = {
807 		[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= 128,
808 		[SNDRV_CTL_ELEM_TYPE_INTEGER]	= 128,
809 		[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
810 		[SNDRV_CTL_ELEM_TYPE_BYTES]	= 512,
811 		[SNDRV_CTL_ELEM_TYPE_IEC958]	= 1,
812 		[SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
813 	};
814 
815 	if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
816 	    info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
817 		if (card)
818 			dev_err(card->dev,
819 				"control %i:%i:%i:%s:%i: invalid type %d\n",
820 				info->id.iface, info->id.device,
821 				info->id.subdevice, info->id.name,
822 				info->id.index, info->type);
823 		return -EINVAL;
824 	}
825 	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
826 	    info->value.enumerated.items == 0) {
827 		if (card)
828 			dev_err(card->dev,
829 				"control %i:%i:%i:%s:%i: zero enum items\n",
830 				info->id.iface, info->id.device,
831 				info->id.subdevice, info->id.name,
832 				info->id.index);
833 		return -EINVAL;
834 	}
835 	if (info->count > max_value_counts[info->type]) {
836 		if (card)
837 			dev_err(card->dev,
838 				"control %i:%i:%i:%s:%i: invalid count %d\n",
839 				info->id.iface, info->id.device,
840 				info->id.subdevice, info->id.name,
841 				info->id.index, info->count);
842 		return -EINVAL;
843 	}
844 
845 	return 0;
846 }
847 
848 /* The capacity of struct snd_ctl_elem_value.value.*/
849 static const unsigned int value_sizes[] = {
850 	[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= sizeof(long),
851 	[SNDRV_CTL_ELEM_TYPE_INTEGER]	= sizeof(long),
852 	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
853 	[SNDRV_CTL_ELEM_TYPE_BYTES]	= sizeof(unsigned char),
854 	[SNDRV_CTL_ELEM_TYPE_IEC958]	= sizeof(struct snd_aes_iec958),
855 	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
856 };
857 
858 #ifdef CONFIG_SND_CTL_VALIDATION
859 /* fill the remaining snd_ctl_elem_value data with the given pattern */
860 static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
861 				      struct snd_ctl_elem_info *info,
862 				      u32 pattern)
863 {
864 	size_t offset = value_sizes[info->type] * info->count;
865 
866 	offset = DIV_ROUND_UP(offset, sizeof(u32));
867 	memset32((u32 *)control->value.bytes.data + offset, pattern,
868 		 sizeof(control->value) / sizeof(u32) - offset);
869 }
870 
871 /* check whether the given integer ctl value is valid */
872 static int sanity_check_int_value(struct snd_card *card,
873 				  const struct snd_ctl_elem_value *control,
874 				  const struct snd_ctl_elem_info *info,
875 				  int i)
876 {
877 	long long lval, lmin, lmax, lstep;
878 	u64 rem;
879 
880 	switch (info->type) {
881 	default:
882 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
883 		lval = control->value.integer.value[i];
884 		lmin = 0;
885 		lmax = 1;
886 		lstep = 0;
887 		break;
888 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
889 		lval = control->value.integer.value[i];
890 		lmin = info->value.integer.min;
891 		lmax = info->value.integer.max;
892 		lstep = info->value.integer.step;
893 		break;
894 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
895 		lval = control->value.integer64.value[i];
896 		lmin = info->value.integer64.min;
897 		lmax = info->value.integer64.max;
898 		lstep = info->value.integer64.step;
899 		break;
900 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
901 		lval = control->value.enumerated.item[i];
902 		lmin = 0;
903 		lmax = info->value.enumerated.items - 1;
904 		lstep = 0;
905 		break;
906 	}
907 
908 	if (lval < lmin || lval > lmax) {
909 		dev_err(card->dev,
910 			"control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
911 			control->id.iface, control->id.device,
912 			control->id.subdevice, control->id.name,
913 			control->id.index, lval, lmin, lmax, i);
914 		return -EINVAL;
915 	}
916 	if (lstep) {
917 		div64_u64_rem(lval, lstep, &rem);
918 		if (rem) {
919 			dev_err(card->dev,
920 				"control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
921 				control->id.iface, control->id.device,
922 				control->id.subdevice, control->id.name,
923 				control->id.index, lval, lstep, i);
924 			return -EINVAL;
925 		}
926 	}
927 
928 	return 0;
929 }
930 
931 /* perform sanity checks to the given snd_ctl_elem_value object */
932 static int sanity_check_elem_value(struct snd_card *card,
933 				   const struct snd_ctl_elem_value *control,
934 				   const struct snd_ctl_elem_info *info,
935 				   u32 pattern)
936 {
937 	size_t offset;
938 	int i, ret = 0;
939 	u32 *p;
940 
941 	switch (info->type) {
942 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
943 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
944 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
945 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
946 		for (i = 0; i < info->count; i++) {
947 			ret = sanity_check_int_value(card, control, info, i);
948 			if (ret < 0)
949 				return ret;
950 		}
951 		break;
952 	default:
953 		break;
954 	}
955 
956 	/* check whether the remaining area kept untouched */
957 	offset = value_sizes[info->type] * info->count;
958 	offset = DIV_ROUND_UP(offset, sizeof(u32));
959 	p = (u32 *)control->value.bytes.data + offset;
960 	for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
961 		if (*p != pattern) {
962 			ret = -EINVAL;
963 			break;
964 		}
965 		*p = 0; /* clear the checked area */
966 	}
967 
968 	return ret;
969 }
970 #else
971 static inline void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
972 					     struct snd_ctl_elem_info *info,
973 					     u32 pattern)
974 {
975 }
976 
977 static inline int sanity_check_elem_value(struct snd_card *card,
978 					  struct snd_ctl_elem_value *control,
979 					  struct snd_ctl_elem_info *info,
980 					  u32 pattern)
981 {
982 	return 0;
983 }
984 #endif
985 
986 static int __snd_ctl_elem_info(struct snd_card *card,
987 			       struct snd_kcontrol *kctl,
988 			       struct snd_ctl_elem_info *info,
989 			       struct snd_ctl_file *ctl)
990 {
991 	struct snd_kcontrol_volatile *vd;
992 	unsigned int index_offset;
993 	int result;
994 
995 #ifdef CONFIG_SND_DEBUG
996 	info->access = 0;
997 #endif
998 	result = snd_power_ref_and_wait(card);
999 	if (!result)
1000 		result = kctl->info(kctl, info);
1001 	snd_power_unref(card);
1002 	if (result >= 0) {
1003 		snd_BUG_ON(info->access);
1004 		index_offset = snd_ctl_get_ioff(kctl, &info->id);
1005 		vd = &kctl->vd[index_offset];
1006 		snd_ctl_build_ioff(&info->id, kctl, index_offset);
1007 		info->access = vd->access;
1008 		if (vd->owner) {
1009 			info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
1010 			if (vd->owner == ctl)
1011 				info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
1012 			info->owner = pid_vnr(vd->owner->pid);
1013 		} else {
1014 			info->owner = -1;
1015 		}
1016 		if (!snd_ctl_skip_validation(info) &&
1017 		    snd_ctl_check_elem_info(card, info) < 0)
1018 			result = -EINVAL;
1019 	}
1020 	return result;
1021 }
1022 
1023 static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
1024 			     struct snd_ctl_elem_info *info)
1025 {
1026 	struct snd_card *card = ctl->card;
1027 	struct snd_kcontrol *kctl;
1028 	int result;
1029 
1030 	down_read(&card->controls_rwsem);
1031 	kctl = snd_ctl_find_id(card, &info->id);
1032 	if (kctl == NULL)
1033 		result = -ENOENT;
1034 	else
1035 		result = __snd_ctl_elem_info(card, kctl, info, ctl);
1036 	up_read(&card->controls_rwsem);
1037 	return result;
1038 }
1039 
1040 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
1041 				  struct snd_ctl_elem_info __user *_info)
1042 {
1043 	struct snd_ctl_elem_info info;
1044 	int result;
1045 
1046 	if (copy_from_user(&info, _info, sizeof(info)))
1047 		return -EFAULT;
1048 	result = snd_ctl_elem_info(ctl, &info);
1049 	if (result < 0)
1050 		return result;
1051 	/* drop internal access flags */
1052 	info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
1053 			 SNDRV_CTL_ELEM_ACCESS_LED_MASK);
1054 	if (copy_to_user(_info, &info, sizeof(info)))
1055 		return -EFAULT;
1056 	return result;
1057 }
1058 
1059 static int snd_ctl_elem_read(struct snd_card *card,
1060 			     struct snd_ctl_elem_value *control)
1061 {
1062 	struct snd_kcontrol *kctl;
1063 	struct snd_kcontrol_volatile *vd;
1064 	unsigned int index_offset;
1065 	struct snd_ctl_elem_info info;
1066 	const u32 pattern = 0xdeadbeef;
1067 	int ret;
1068 
1069 	kctl = snd_ctl_find_id(card, &control->id);
1070 	if (kctl == NULL)
1071 		return -ENOENT;
1072 
1073 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1074 	vd = &kctl->vd[index_offset];
1075 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL)
1076 		return -EPERM;
1077 
1078 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1079 
1080 #ifdef CONFIG_SND_CTL_VALIDATION
1081 	/* info is needed only for validation */
1082 	memset(&info, 0, sizeof(info));
1083 	info.id = control->id;
1084 	ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
1085 	if (ret < 0)
1086 		return ret;
1087 #endif
1088 
1089 	if (!snd_ctl_skip_validation(&info))
1090 		fill_remaining_elem_value(control, &info, pattern);
1091 	ret = snd_power_ref_and_wait(card);
1092 	if (!ret)
1093 		ret = kctl->get(kctl, control);
1094 	snd_power_unref(card);
1095 	if (ret < 0)
1096 		return ret;
1097 	if (!snd_ctl_skip_validation(&info) &&
1098 	    sanity_check_elem_value(card, control, &info, pattern) < 0) {
1099 		dev_err(card->dev,
1100 			"control %i:%i:%i:%s:%i: access overflow\n",
1101 			control->id.iface, control->id.device,
1102 			control->id.subdevice, control->id.name,
1103 			control->id.index);
1104 		return -EINVAL;
1105 	}
1106 	return ret;
1107 }
1108 
1109 static int snd_ctl_elem_read_user(struct snd_card *card,
1110 				  struct snd_ctl_elem_value __user *_control)
1111 {
1112 	struct snd_ctl_elem_value *control;
1113 	int result;
1114 
1115 	control = memdup_user(_control, sizeof(*control));
1116 	if (IS_ERR(control))
1117 		return PTR_ERR(control);
1118 
1119 	down_read(&card->controls_rwsem);
1120 	result = snd_ctl_elem_read(card, control);
1121 	up_read(&card->controls_rwsem);
1122 	if (result < 0)
1123 		goto error;
1124 
1125 	if (copy_to_user(_control, control, sizeof(*control)))
1126 		result = -EFAULT;
1127  error:
1128 	kfree(control);
1129 	return result;
1130 }
1131 
1132 static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
1133 			      struct snd_ctl_elem_value *control)
1134 {
1135 	struct snd_kcontrol *kctl;
1136 	struct snd_kcontrol_volatile *vd;
1137 	unsigned int index_offset;
1138 	int result;
1139 
1140 	down_write(&card->controls_rwsem);
1141 	kctl = snd_ctl_find_id(card, &control->id);
1142 	if (kctl == NULL) {
1143 		up_write(&card->controls_rwsem);
1144 		return -ENOENT;
1145 	}
1146 
1147 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1148 	vd = &kctl->vd[index_offset];
1149 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
1150 	    (file && vd->owner && vd->owner != file)) {
1151 		up_write(&card->controls_rwsem);
1152 		return -EPERM;
1153 	}
1154 
1155 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1156 	result = snd_power_ref_and_wait(card);
1157 	if (!result)
1158 		result = kctl->put(kctl, control);
1159 	snd_power_unref(card);
1160 	if (result < 0) {
1161 		up_write(&card->controls_rwsem);
1162 		return result;
1163 	}
1164 
1165 	if (result > 0) {
1166 		downgrade_write(&card->controls_rwsem);
1167 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
1168 		up_read(&card->controls_rwsem);
1169 	} else {
1170 		up_write(&card->controls_rwsem);
1171 	}
1172 
1173 	return 0;
1174 }
1175 
1176 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
1177 				   struct snd_ctl_elem_value __user *_control)
1178 {
1179 	struct snd_ctl_elem_value *control;
1180 	struct snd_card *card;
1181 	int result;
1182 
1183 	control = memdup_user(_control, sizeof(*control));
1184 	if (IS_ERR(control))
1185 		return PTR_ERR(control);
1186 
1187 	card = file->card;
1188 	result = snd_ctl_elem_write(card, file, control);
1189 	if (result < 0)
1190 		goto error;
1191 
1192 	if (copy_to_user(_control, control, sizeof(*control)))
1193 		result = -EFAULT;
1194  error:
1195 	kfree(control);
1196 	return result;
1197 }
1198 
1199 static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1200 			     struct snd_ctl_elem_id __user *_id)
1201 {
1202 	struct snd_card *card = file->card;
1203 	struct snd_ctl_elem_id id;
1204 	struct snd_kcontrol *kctl;
1205 	struct snd_kcontrol_volatile *vd;
1206 	int result;
1207 
1208 	if (copy_from_user(&id, _id, sizeof(id)))
1209 		return -EFAULT;
1210 	down_write(&card->controls_rwsem);
1211 	kctl = snd_ctl_find_id(card, &id);
1212 	if (kctl == NULL) {
1213 		result = -ENOENT;
1214 	} else {
1215 		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1216 		if (vd->owner != NULL)
1217 			result = -EBUSY;
1218 		else {
1219 			vd->owner = file;
1220 			result = 0;
1221 		}
1222 	}
1223 	up_write(&card->controls_rwsem);
1224 	return result;
1225 }
1226 
1227 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1228 			       struct snd_ctl_elem_id __user *_id)
1229 {
1230 	struct snd_card *card = file->card;
1231 	struct snd_ctl_elem_id id;
1232 	struct snd_kcontrol *kctl;
1233 	struct snd_kcontrol_volatile *vd;
1234 	int result;
1235 
1236 	if (copy_from_user(&id, _id, sizeof(id)))
1237 		return -EFAULT;
1238 	down_write(&card->controls_rwsem);
1239 	kctl = snd_ctl_find_id(card, &id);
1240 	if (kctl == NULL) {
1241 		result = -ENOENT;
1242 	} else {
1243 		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1244 		if (vd->owner == NULL)
1245 			result = -EINVAL;
1246 		else if (vd->owner != file)
1247 			result = -EPERM;
1248 		else {
1249 			vd->owner = NULL;
1250 			result = 0;
1251 		}
1252 	}
1253 	up_write(&card->controls_rwsem);
1254 	return result;
1255 }
1256 
1257 struct user_element {
1258 	struct snd_ctl_elem_info info;
1259 	struct snd_card *card;
1260 	char *elem_data;		/* element data */
1261 	unsigned long elem_data_size;	/* size of element data in bytes */
1262 	void *tlv_data;			/* TLV data */
1263 	unsigned long tlv_data_size;	/* TLV data size */
1264 	void *priv_data;		/* private data (like strings for enumerated type) */
1265 };
1266 
1267 // check whether the addition (in bytes) of user ctl element may overflow the limit.
1268 static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
1269 {
1270 	return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
1271 }
1272 
1273 static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1274 				  struct snd_ctl_elem_info *uinfo)
1275 {
1276 	struct user_element *ue = kcontrol->private_data;
1277 	unsigned int offset;
1278 
1279 	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1280 	*uinfo = ue->info;
1281 	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1282 
1283 	return 0;
1284 }
1285 
1286 static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1287 				       struct snd_ctl_elem_info *uinfo)
1288 {
1289 	struct user_element *ue = kcontrol->private_data;
1290 	const char *names;
1291 	unsigned int item;
1292 	unsigned int offset;
1293 
1294 	item = uinfo->value.enumerated.item;
1295 
1296 	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1297 	*uinfo = ue->info;
1298 	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1299 
1300 	item = min(item, uinfo->value.enumerated.items - 1);
1301 	uinfo->value.enumerated.item = item;
1302 
1303 	names = ue->priv_data;
1304 	for (; item > 0; --item)
1305 		names += strlen(names) + 1;
1306 	strcpy(uinfo->value.enumerated.name, names);
1307 
1308 	return 0;
1309 }
1310 
1311 static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1312 				 struct snd_ctl_elem_value *ucontrol)
1313 {
1314 	struct user_element *ue = kcontrol->private_data;
1315 	unsigned int size = ue->elem_data_size;
1316 	char *src = ue->elem_data +
1317 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1318 
1319 	memcpy(&ucontrol->value, src, size);
1320 	return 0;
1321 }
1322 
1323 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1324 				 struct snd_ctl_elem_value *ucontrol)
1325 {
1326 	int change;
1327 	struct user_element *ue = kcontrol->private_data;
1328 	unsigned int size = ue->elem_data_size;
1329 	char *dst = ue->elem_data +
1330 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1331 
1332 	change = memcmp(&ucontrol->value, dst, size) != 0;
1333 	if (change)
1334 		memcpy(dst, &ucontrol->value, size);
1335 	return change;
1336 }
1337 
1338 /* called in controls_rwsem write lock */
1339 static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1340 			    unsigned int size)
1341 {
1342 	struct user_element *ue = kctl->private_data;
1343 	unsigned int *container;
1344 	unsigned int mask = 0;
1345 	int i;
1346 	int change;
1347 
1348 	if (size > 1024 * 128)	/* sane value */
1349 		return -EINVAL;
1350 
1351 	// does the TLV size change cause overflow?
1352 	if (check_user_elem_overflow(ue->card, (ssize_t)(size - ue->tlv_data_size)))
1353 		return -ENOMEM;
1354 
1355 	container = vmemdup_user(buf, size);
1356 	if (IS_ERR(container))
1357 		return PTR_ERR(container);
1358 
1359 	change = ue->tlv_data_size != size;
1360 	if (!change)
1361 		change = memcmp(ue->tlv_data, container, size) != 0;
1362 	if (!change) {
1363 		kvfree(container);
1364 		return 0;
1365 	}
1366 
1367 	if (ue->tlv_data == NULL) {
1368 		/* Now TLV data is available. */
1369 		for (i = 0; i < kctl->count; ++i)
1370 			kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
1371 		mask = SNDRV_CTL_EVENT_MASK_INFO;
1372 	} else {
1373 		ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1374 		ue->tlv_data_size = 0;
1375 		kvfree(ue->tlv_data);
1376 	}
1377 
1378 	ue->tlv_data = container;
1379 	ue->tlv_data_size = size;
1380 	// decremented at private_free.
1381 	ue->card->user_ctl_alloc_size += size;
1382 
1383 	mask |= SNDRV_CTL_EVENT_MASK_TLV;
1384 	for (i = 0; i < kctl->count; ++i)
1385 		snd_ctl_notify_one(ue->card, mask, kctl, i);
1386 
1387 	return change;
1388 }
1389 
1390 static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1391 			 unsigned int size)
1392 {
1393 	struct user_element *ue = kctl->private_data;
1394 
1395 	if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
1396 		return -ENXIO;
1397 
1398 	if (size < ue->tlv_data_size)
1399 		return -ENOSPC;
1400 
1401 	if (copy_to_user(buf, ue->tlv_data, ue->tlv_data_size))
1402 		return -EFAULT;
1403 
1404 	return 0;
1405 }
1406 
1407 static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
1408 				 unsigned int size, unsigned int __user *buf)
1409 {
1410 	if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
1411 		return replace_user_tlv(kctl, buf, size);
1412 	else
1413 		return read_user_tlv(kctl, buf, size);
1414 }
1415 
1416 /* called in controls_rwsem write lock */
1417 static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1418 {
1419 	char *names, *p;
1420 	size_t buf_len, name_len;
1421 	unsigned int i;
1422 	const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1423 
1424 	buf_len = ue->info.value.enumerated.names_length;
1425 	if (buf_len > 64 * 1024)
1426 		return -EINVAL;
1427 
1428 	if (check_user_elem_overflow(ue->card, buf_len))
1429 		return -ENOMEM;
1430 	names = vmemdup_user((const void __user *)user_ptrval, buf_len);
1431 	if (IS_ERR(names))
1432 		return PTR_ERR(names);
1433 
1434 	/* check that there are enough valid names */
1435 	p = names;
1436 	for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1437 		name_len = strnlen(p, buf_len);
1438 		if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1439 			kvfree(names);
1440 			return -EINVAL;
1441 		}
1442 		p += name_len + 1;
1443 		buf_len -= name_len + 1;
1444 	}
1445 
1446 	ue->priv_data = names;
1447 	ue->info.value.enumerated.names_ptr = 0;
1448 	// increment the allocation size; decremented again at private_free.
1449 	ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
1450 
1451 	return 0;
1452 }
1453 
1454 static size_t compute_user_elem_size(size_t size, unsigned int count)
1455 {
1456 	return sizeof(struct user_element) + size * count;
1457 }
1458 
1459 static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1460 {
1461 	struct user_element *ue = kcontrol->private_data;
1462 
1463 	// decrement the allocation size.
1464 	ue->card->user_ctl_alloc_size -= compute_user_elem_size(ue->elem_data_size, kcontrol->count);
1465 	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1466 	if (ue->priv_data)
1467 		ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
1468 
1469 	kvfree(ue->tlv_data);
1470 	kvfree(ue->priv_data);
1471 	kfree(ue);
1472 }
1473 
1474 static int snd_ctl_elem_add(struct snd_ctl_file *file,
1475 			    struct snd_ctl_elem_info *info, int replace)
1476 {
1477 	struct snd_card *card = file->card;
1478 	struct snd_kcontrol *kctl;
1479 	unsigned int count;
1480 	unsigned int access;
1481 	long private_size;
1482 	size_t alloc_size;
1483 	struct user_element *ue;
1484 	unsigned int offset;
1485 	int err;
1486 
1487 	if (!*info->id.name)
1488 		return -EINVAL;
1489 	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
1490 		return -EINVAL;
1491 
1492 	/* Delete a control to replace them if needed. */
1493 	if (replace) {
1494 		info->id.numid = 0;
1495 		err = snd_ctl_remove_user_ctl(file, &info->id);
1496 		if (err)
1497 			return err;
1498 	}
1499 
1500 	/* Check the number of elements for this userspace control. */
1501 	count = info->owner;
1502 	if (count == 0)
1503 		count = 1;
1504 
1505 	/* Arrange access permissions if needed. */
1506 	access = info->access;
1507 	if (access == 0)
1508 		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1509 	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1510 		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1511 		   SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
1512 
1513 	/* In initial state, nothing is available as TLV container. */
1514 	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1515 		access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1516 	access |= SNDRV_CTL_ELEM_ACCESS_USER;
1517 
1518 	/*
1519 	 * Check information and calculate the size of data specific to
1520 	 * this userspace control.
1521 	 */
1522 	/* pass NULL to card for suppressing error messages */
1523 	err = snd_ctl_check_elem_info(NULL, info);
1524 	if (err < 0)
1525 		return err;
1526 	/* user-space control doesn't allow zero-size data */
1527 	if (info->count < 1)
1528 		return -EINVAL;
1529 	private_size = value_sizes[info->type] * info->count;
1530 	alloc_size = compute_user_elem_size(private_size, count);
1531 
1532 	down_write(&card->controls_rwsem);
1533 	if (check_user_elem_overflow(card, alloc_size)) {
1534 		err = -ENOMEM;
1535 		goto unlock;
1536 	}
1537 
1538 	/*
1539 	 * Keep memory object for this userspace control. After passing this
1540 	 * code block, the instance should be freed by snd_ctl_free_one().
1541 	 *
1542 	 * Note that these elements in this control are locked.
1543 	 */
1544 	err = snd_ctl_new(&kctl, count, access, file);
1545 	if (err < 0)
1546 		goto unlock;
1547 	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1548 	ue = kzalloc(alloc_size, GFP_KERNEL);
1549 	if (!ue) {
1550 		kfree(kctl);
1551 		err = -ENOMEM;
1552 		goto unlock;
1553 	}
1554 	kctl->private_data = ue;
1555 	kctl->private_free = snd_ctl_elem_user_free;
1556 
1557 	// increment the allocated size; decremented again at private_free.
1558 	card->user_ctl_alloc_size += alloc_size;
1559 
1560 	/* Set private data for this userspace control. */
1561 	ue->card = card;
1562 	ue->info = *info;
1563 	ue->info.access = 0;
1564 	ue->elem_data = (char *)ue + sizeof(*ue);
1565 	ue->elem_data_size = private_size;
1566 	if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1567 		err = snd_ctl_elem_init_enum_names(ue);
1568 		if (err < 0) {
1569 			snd_ctl_free_one(kctl);
1570 			goto unlock;
1571 		}
1572 	}
1573 
1574 	/* Set callback functions. */
1575 	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1576 		kctl->info = snd_ctl_elem_user_enum_info;
1577 	else
1578 		kctl->info = snd_ctl_elem_user_info;
1579 	if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1580 		kctl->get = snd_ctl_elem_user_get;
1581 	if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1582 		kctl->put = snd_ctl_elem_user_put;
1583 	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1584 		kctl->tlv.c = snd_ctl_elem_user_tlv;
1585 
1586 	/* This function manage to free the instance on failure. */
1587 	err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
1588 	if (err < 0) {
1589 		snd_ctl_free_one(kctl);
1590 		goto unlock;
1591 	}
1592 	offset = snd_ctl_get_ioff(kctl, &info->id);
1593 	snd_ctl_build_ioff(&info->id, kctl, offset);
1594 	/*
1595 	 * Here we cannot fill any field for the number of elements added by
1596 	 * this operation because there're no specific fields. The usage of
1597 	 * 'owner' field for this purpose may cause any bugs to userspace
1598 	 * applications because the field originally means PID of a process
1599 	 * which locks the element.
1600 	 */
1601  unlock:
1602 	up_write(&card->controls_rwsem);
1603 	return err;
1604 }
1605 
1606 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1607 				 struct snd_ctl_elem_info __user *_info, int replace)
1608 {
1609 	struct snd_ctl_elem_info info;
1610 	int err;
1611 
1612 	if (copy_from_user(&info, _info, sizeof(info)))
1613 		return -EFAULT;
1614 	err = snd_ctl_elem_add(file, &info, replace);
1615 	if (err < 0)
1616 		return err;
1617 	if (copy_to_user(_info, &info, sizeof(info))) {
1618 		snd_ctl_remove_user_ctl(file, &info.id);
1619 		return -EFAULT;
1620 	}
1621 
1622 	return 0;
1623 }
1624 
1625 static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1626 			       struct snd_ctl_elem_id __user *_id)
1627 {
1628 	struct snd_ctl_elem_id id;
1629 
1630 	if (copy_from_user(&id, _id, sizeof(id)))
1631 		return -EFAULT;
1632 	return snd_ctl_remove_user_ctl(file, &id);
1633 }
1634 
1635 static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1636 {
1637 	int subscribe;
1638 	if (get_user(subscribe, ptr))
1639 		return -EFAULT;
1640 	if (subscribe < 0) {
1641 		subscribe = file->subscribed;
1642 		if (put_user(subscribe, ptr))
1643 			return -EFAULT;
1644 		return 0;
1645 	}
1646 	if (subscribe) {
1647 		file->subscribed = 1;
1648 		return 0;
1649 	} else if (file->subscribed) {
1650 		snd_ctl_empty_read_queue(file);
1651 		file->subscribed = 0;
1652 	}
1653 	return 0;
1654 }
1655 
1656 static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
1657 			    struct snd_kcontrol *kctl,
1658 			    struct snd_ctl_elem_id *id,
1659 			    unsigned int __user *buf, unsigned int size)
1660 {
1661 	static const struct {
1662 		int op;
1663 		int perm;
1664 	} pairs[] = {
1665 		{SNDRV_CTL_TLV_OP_READ,  SNDRV_CTL_ELEM_ACCESS_TLV_READ},
1666 		{SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
1667 		{SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
1668 	};
1669 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1670 	int i, ret;
1671 
1672 	/* Check support of the request for this element. */
1673 	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
1674 		if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
1675 			break;
1676 	}
1677 	if (i == ARRAY_SIZE(pairs))
1678 		return -ENXIO;
1679 
1680 	if (kctl->tlv.c == NULL)
1681 		return -ENXIO;
1682 
1683 	/* Write and command operations are not allowed for locked element. */
1684 	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
1685 	    vd->owner != NULL && vd->owner != file)
1686 		return -EPERM;
1687 
1688 	ret = snd_power_ref_and_wait(file->card);
1689 	if (!ret)
1690 		ret = kctl->tlv.c(kctl, op_flag, size, buf);
1691 	snd_power_unref(file->card);
1692 	return ret;
1693 }
1694 
1695 static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
1696 			unsigned int __user *buf, unsigned int size)
1697 {
1698 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1699 	unsigned int len;
1700 
1701 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
1702 		return -ENXIO;
1703 
1704 	if (kctl->tlv.p == NULL)
1705 		return -ENXIO;
1706 
1707 	len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
1708 	if (size < len)
1709 		return -ENOMEM;
1710 
1711 	if (copy_to_user(buf, kctl->tlv.p, len))
1712 		return -EFAULT;
1713 
1714 	return 0;
1715 }
1716 
1717 static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1718 			     struct snd_ctl_tlv __user *buf,
1719                              int op_flag)
1720 {
1721 	struct snd_ctl_tlv header;
1722 	unsigned int __user *container;
1723 	unsigned int container_size;
1724 	struct snd_kcontrol *kctl;
1725 	struct snd_ctl_elem_id id;
1726 	struct snd_kcontrol_volatile *vd;
1727 
1728 	if (copy_from_user(&header, buf, sizeof(header)))
1729 		return -EFAULT;
1730 
1731 	/* In design of control core, numerical ID starts at 1. */
1732 	if (header.numid == 0)
1733 		return -EINVAL;
1734 
1735 	/* At least, container should include type and length fields.  */
1736 	if (header.length < sizeof(unsigned int) * 2)
1737 		return -EINVAL;
1738 	container_size = header.length;
1739 	container = buf->tlv;
1740 
1741 	kctl = snd_ctl_find_numid(file->card, header.numid);
1742 	if (kctl == NULL)
1743 		return -ENOENT;
1744 
1745 	/* Calculate index of the element in this set. */
1746 	id = kctl->id;
1747 	snd_ctl_build_ioff(&id, kctl, header.numid - id.numid);
1748 	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1749 
1750 	if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1751 		return call_tlv_handler(file, op_flag, kctl, &id, container,
1752 					container_size);
1753 	} else {
1754 		if (op_flag == SNDRV_CTL_TLV_OP_READ) {
1755 			return read_tlv_buf(kctl, &id, container,
1756 					    container_size);
1757 		}
1758 	}
1759 
1760 	/* Not supported. */
1761 	return -ENXIO;
1762 }
1763 
1764 static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1765 {
1766 	struct snd_ctl_file *ctl;
1767 	struct snd_card *card;
1768 	struct snd_kctl_ioctl *p;
1769 	void __user *argp = (void __user *)arg;
1770 	int __user *ip = argp;
1771 	int err;
1772 
1773 	ctl = file->private_data;
1774 	card = ctl->card;
1775 	if (snd_BUG_ON(!card))
1776 		return -ENXIO;
1777 	switch (cmd) {
1778 	case SNDRV_CTL_IOCTL_PVERSION:
1779 		return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1780 	case SNDRV_CTL_IOCTL_CARD_INFO:
1781 		return snd_ctl_card_info(card, ctl, cmd, argp);
1782 	case SNDRV_CTL_IOCTL_ELEM_LIST:
1783 		return snd_ctl_elem_list_user(card, argp);
1784 	case SNDRV_CTL_IOCTL_ELEM_INFO:
1785 		return snd_ctl_elem_info_user(ctl, argp);
1786 	case SNDRV_CTL_IOCTL_ELEM_READ:
1787 		return snd_ctl_elem_read_user(card, argp);
1788 	case SNDRV_CTL_IOCTL_ELEM_WRITE:
1789 		return snd_ctl_elem_write_user(ctl, argp);
1790 	case SNDRV_CTL_IOCTL_ELEM_LOCK:
1791 		return snd_ctl_elem_lock(ctl, argp);
1792 	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1793 		return snd_ctl_elem_unlock(ctl, argp);
1794 	case SNDRV_CTL_IOCTL_ELEM_ADD:
1795 		return snd_ctl_elem_add_user(ctl, argp, 0);
1796 	case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1797 		return snd_ctl_elem_add_user(ctl, argp, 1);
1798 	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1799 		return snd_ctl_elem_remove(ctl, argp);
1800 	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1801 		return snd_ctl_subscribe_events(ctl, ip);
1802 	case SNDRV_CTL_IOCTL_TLV_READ:
1803 		down_read(&ctl->card->controls_rwsem);
1804 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
1805 		up_read(&ctl->card->controls_rwsem);
1806 		return err;
1807 	case SNDRV_CTL_IOCTL_TLV_WRITE:
1808 		down_write(&ctl->card->controls_rwsem);
1809 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
1810 		up_write(&ctl->card->controls_rwsem);
1811 		return err;
1812 	case SNDRV_CTL_IOCTL_TLV_COMMAND:
1813 		down_write(&ctl->card->controls_rwsem);
1814 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
1815 		up_write(&ctl->card->controls_rwsem);
1816 		return err;
1817 	case SNDRV_CTL_IOCTL_POWER:
1818 		return -ENOPROTOOPT;
1819 	case SNDRV_CTL_IOCTL_POWER_STATE:
1820 		return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1821 	}
1822 	down_read(&snd_ioctl_rwsem);
1823 	list_for_each_entry(p, &snd_control_ioctls, list) {
1824 		err = p->fioctl(card, ctl, cmd, arg);
1825 		if (err != -ENOIOCTLCMD) {
1826 			up_read(&snd_ioctl_rwsem);
1827 			return err;
1828 		}
1829 	}
1830 	up_read(&snd_ioctl_rwsem);
1831 	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
1832 	return -ENOTTY;
1833 }
1834 
1835 static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1836 			    size_t count, loff_t * offset)
1837 {
1838 	struct snd_ctl_file *ctl;
1839 	int err = 0;
1840 	ssize_t result = 0;
1841 
1842 	ctl = file->private_data;
1843 	if (snd_BUG_ON(!ctl || !ctl->card))
1844 		return -ENXIO;
1845 	if (!ctl->subscribed)
1846 		return -EBADFD;
1847 	if (count < sizeof(struct snd_ctl_event))
1848 		return -EINVAL;
1849 	spin_lock_irq(&ctl->read_lock);
1850 	while (count >= sizeof(struct snd_ctl_event)) {
1851 		struct snd_ctl_event ev;
1852 		struct snd_kctl_event *kev;
1853 		while (list_empty(&ctl->events)) {
1854 			wait_queue_entry_t wait;
1855 			if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
1856 				err = -EAGAIN;
1857 				goto __end_lock;
1858 			}
1859 			init_waitqueue_entry(&wait, current);
1860 			add_wait_queue(&ctl->change_sleep, &wait);
1861 			set_current_state(TASK_INTERRUPTIBLE);
1862 			spin_unlock_irq(&ctl->read_lock);
1863 			schedule();
1864 			remove_wait_queue(&ctl->change_sleep, &wait);
1865 			if (ctl->card->shutdown)
1866 				return -ENODEV;
1867 			if (signal_pending(current))
1868 				return -ERESTARTSYS;
1869 			spin_lock_irq(&ctl->read_lock);
1870 		}
1871 		kev = snd_kctl_event(ctl->events.next);
1872 		ev.type = SNDRV_CTL_EVENT_ELEM;
1873 		ev.data.elem.mask = kev->mask;
1874 		ev.data.elem.id = kev->id;
1875 		list_del(&kev->list);
1876 		spin_unlock_irq(&ctl->read_lock);
1877 		kfree(kev);
1878 		if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
1879 			err = -EFAULT;
1880 			goto __end;
1881 		}
1882 		spin_lock_irq(&ctl->read_lock);
1883 		buffer += sizeof(struct snd_ctl_event);
1884 		count -= sizeof(struct snd_ctl_event);
1885 		result += sizeof(struct snd_ctl_event);
1886 	}
1887       __end_lock:
1888 	spin_unlock_irq(&ctl->read_lock);
1889       __end:
1890       	return result > 0 ? result : err;
1891 }
1892 
1893 static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
1894 {
1895 	__poll_t mask;
1896 	struct snd_ctl_file *ctl;
1897 
1898 	ctl = file->private_data;
1899 	if (!ctl->subscribed)
1900 		return 0;
1901 	poll_wait(file, &ctl->change_sleep, wait);
1902 
1903 	mask = 0;
1904 	if (!list_empty(&ctl->events))
1905 		mask |= EPOLLIN | EPOLLRDNORM;
1906 
1907 	return mask;
1908 }
1909 
1910 /*
1911  * register the device-specific control-ioctls.
1912  * called from each device manager like pcm.c, hwdep.c, etc.
1913  */
1914 static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
1915 {
1916 	struct snd_kctl_ioctl *pn;
1917 
1918 	pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
1919 	if (pn == NULL)
1920 		return -ENOMEM;
1921 	pn->fioctl = fcn;
1922 	down_write(&snd_ioctl_rwsem);
1923 	list_add_tail(&pn->list, lists);
1924 	up_write(&snd_ioctl_rwsem);
1925 	return 0;
1926 }
1927 
1928 /**
1929  * snd_ctl_register_ioctl - register the device-specific control-ioctls
1930  * @fcn: ioctl callback function
1931  *
1932  * called from each device manager like pcm.c, hwdep.c, etc.
1933  */
1934 int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
1935 {
1936 	return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
1937 }
1938 EXPORT_SYMBOL(snd_ctl_register_ioctl);
1939 
1940 #ifdef CONFIG_COMPAT
1941 /**
1942  * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
1943  * control-ioctls
1944  * @fcn: ioctl callback function
1945  */
1946 int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1947 {
1948 	return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
1949 }
1950 EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
1951 #endif
1952 
1953 /*
1954  * de-register the device-specific control-ioctls.
1955  */
1956 static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
1957 				     struct list_head *lists)
1958 {
1959 	struct snd_kctl_ioctl *p;
1960 
1961 	if (snd_BUG_ON(!fcn))
1962 		return -EINVAL;
1963 	down_write(&snd_ioctl_rwsem);
1964 	list_for_each_entry(p, lists, list) {
1965 		if (p->fioctl == fcn) {
1966 			list_del(&p->list);
1967 			up_write(&snd_ioctl_rwsem);
1968 			kfree(p);
1969 			return 0;
1970 		}
1971 	}
1972 	up_write(&snd_ioctl_rwsem);
1973 	snd_BUG();
1974 	return -EINVAL;
1975 }
1976 
1977 /**
1978  * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
1979  * @fcn: ioctl callback function to unregister
1980  */
1981 int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
1982 {
1983 	return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
1984 }
1985 EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
1986 
1987 #ifdef CONFIG_COMPAT
1988 /**
1989  * snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
1990  * 32bit control-ioctls
1991  * @fcn: ioctl callback function to unregister
1992  */
1993 int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1994 {
1995 	return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
1996 }
1997 EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
1998 #endif
1999 
2000 static int snd_ctl_fasync(int fd, struct file * file, int on)
2001 {
2002 	struct snd_ctl_file *ctl;
2003 
2004 	ctl = file->private_data;
2005 	return fasync_helper(fd, file, on, &ctl->fasync);
2006 }
2007 
2008 /* return the preferred subdevice number if already assigned;
2009  * otherwise return -1
2010  */
2011 int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
2012 {
2013 	struct snd_ctl_file *kctl;
2014 	int subdevice = -1;
2015 	unsigned long flags;
2016 
2017 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
2018 	list_for_each_entry(kctl, &card->ctl_files, list) {
2019 		if (kctl->pid == task_pid(current)) {
2020 			subdevice = kctl->preferred_subdevice[type];
2021 			if (subdevice != -1)
2022 				break;
2023 		}
2024 	}
2025 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
2026 	return subdevice;
2027 }
2028 EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
2029 
2030 /*
2031  * ioctl32 compat
2032  */
2033 #ifdef CONFIG_COMPAT
2034 #include "control_compat.c"
2035 #else
2036 #define snd_ctl_ioctl_compat	NULL
2037 #endif
2038 
2039 /*
2040  * control layers (audio LED etc.)
2041  */
2042 
2043 /**
2044  * snd_ctl_request_layer - request to use the layer
2045  * @module_name: Name of the kernel module (NULL == build-in)
2046  *
2047  * Return an error code when the module cannot be loaded.
2048  */
2049 int snd_ctl_request_layer(const char *module_name)
2050 {
2051 	struct snd_ctl_layer_ops *lops;
2052 
2053 	if (module_name == NULL)
2054 		return 0;
2055 	down_read(&snd_ctl_layer_rwsem);
2056 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2057 		if (strcmp(lops->module_name, module_name) == 0)
2058 			break;
2059 	up_read(&snd_ctl_layer_rwsem);
2060 	if (lops)
2061 		return 0;
2062 	return request_module(module_name);
2063 }
2064 EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
2065 
2066 /**
2067  * snd_ctl_register_layer - register new control layer
2068  * @lops: operation structure
2069  *
2070  * The new layer can track all control elements and do additional
2071  * operations on top (like audio LED handling).
2072  */
2073 void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
2074 {
2075 	struct snd_card *card;
2076 	int card_number;
2077 
2078 	down_write(&snd_ctl_layer_rwsem);
2079 	lops->next = snd_ctl_layer;
2080 	snd_ctl_layer = lops;
2081 	up_write(&snd_ctl_layer_rwsem);
2082 	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
2083 		card = snd_card_ref(card_number);
2084 		if (card) {
2085 			down_read(&card->controls_rwsem);
2086 			lops->lregister(card);
2087 			up_read(&card->controls_rwsem);
2088 			snd_card_unref(card);
2089 		}
2090 	}
2091 }
2092 EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
2093 
2094 /**
2095  * snd_ctl_disconnect_layer - disconnect control layer
2096  * @lops: operation structure
2097  *
2098  * It is expected that the information about tracked cards
2099  * is freed before this call (the disconnect callback is
2100  * not called here).
2101  */
2102 void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
2103 {
2104 	struct snd_ctl_layer_ops *lops2, *prev_lops2;
2105 
2106 	down_write(&snd_ctl_layer_rwsem);
2107 	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
2108 		if (lops2 == lops) {
2109 			if (!prev_lops2)
2110 				snd_ctl_layer = lops->next;
2111 			else
2112 				prev_lops2->next = lops->next;
2113 			break;
2114 		}
2115 		prev_lops2 = lops2;
2116 	}
2117 	up_write(&snd_ctl_layer_rwsem);
2118 }
2119 EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
2120 
2121 /*
2122  *  INIT PART
2123  */
2124 
2125 static const struct file_operations snd_ctl_f_ops =
2126 {
2127 	.owner =	THIS_MODULE,
2128 	.read =		snd_ctl_read,
2129 	.open =		snd_ctl_open,
2130 	.release =	snd_ctl_release,
2131 	.llseek =	no_llseek,
2132 	.poll =		snd_ctl_poll,
2133 	.unlocked_ioctl =	snd_ctl_ioctl,
2134 	.compat_ioctl =	snd_ctl_ioctl_compat,
2135 	.fasync =	snd_ctl_fasync,
2136 };
2137 
2138 /*
2139  * registration of the control device
2140  */
2141 static int snd_ctl_dev_register(struct snd_device *device)
2142 {
2143 	struct snd_card *card = device->device_data;
2144 	struct snd_ctl_layer_ops *lops;
2145 	int err;
2146 
2147 	err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
2148 				  &snd_ctl_f_ops, card, &card->ctl_dev);
2149 	if (err < 0)
2150 		return err;
2151 	down_read(&card->controls_rwsem);
2152 	down_read(&snd_ctl_layer_rwsem);
2153 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2154 		lops->lregister(card);
2155 	up_read(&snd_ctl_layer_rwsem);
2156 	up_read(&card->controls_rwsem);
2157 	return 0;
2158 }
2159 
2160 /*
2161  * disconnection of the control device
2162  */
2163 static int snd_ctl_dev_disconnect(struct snd_device *device)
2164 {
2165 	struct snd_card *card = device->device_data;
2166 	struct snd_ctl_file *ctl;
2167 	struct snd_ctl_layer_ops *lops;
2168 	unsigned long flags;
2169 
2170 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
2171 	list_for_each_entry(ctl, &card->ctl_files, list) {
2172 		wake_up(&ctl->change_sleep);
2173 		kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
2174 	}
2175 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
2176 
2177 	down_read(&card->controls_rwsem);
2178 	down_read(&snd_ctl_layer_rwsem);
2179 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2180 		lops->ldisconnect(card);
2181 	up_read(&snd_ctl_layer_rwsem);
2182 	up_read(&card->controls_rwsem);
2183 
2184 	return snd_unregister_device(&card->ctl_dev);
2185 }
2186 
2187 /*
2188  * free all controls
2189  */
2190 static int snd_ctl_dev_free(struct snd_device *device)
2191 {
2192 	struct snd_card *card = device->device_data;
2193 	struct snd_kcontrol *control;
2194 
2195 	down_write(&card->controls_rwsem);
2196 	while (!list_empty(&card->controls)) {
2197 		control = snd_kcontrol(card->controls.next);
2198 		snd_ctl_remove(card, control);
2199 	}
2200 	up_write(&card->controls_rwsem);
2201 	put_device(&card->ctl_dev);
2202 	return 0;
2203 }
2204 
2205 /*
2206  * create control core:
2207  * called from init.c
2208  */
2209 int snd_ctl_create(struct snd_card *card)
2210 {
2211 	static const struct snd_device_ops ops = {
2212 		.dev_free = snd_ctl_dev_free,
2213 		.dev_register =	snd_ctl_dev_register,
2214 		.dev_disconnect = snd_ctl_dev_disconnect,
2215 	};
2216 	int err;
2217 
2218 	if (snd_BUG_ON(!card))
2219 		return -ENXIO;
2220 	if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
2221 		return -ENXIO;
2222 
2223 	snd_device_initialize(&card->ctl_dev, card);
2224 	dev_set_name(&card->ctl_dev, "controlC%d", card->number);
2225 
2226 	err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
2227 	if (err < 0)
2228 		put_device(&card->ctl_dev);
2229 	return err;
2230 }
2231 
2232 /*
2233  * Frequently used control callbacks/helpers
2234  */
2235 
2236 /**
2237  * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
2238  * callback with a mono channel
2239  * @kcontrol: the kcontrol instance
2240  * @uinfo: info to store
2241  *
2242  * This is a function that can be used as info callback for a standard
2243  * boolean control with a single mono channel.
2244  */
2245 int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
2246 			      struct snd_ctl_elem_info *uinfo)
2247 {
2248 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2249 	uinfo->count = 1;
2250 	uinfo->value.integer.min = 0;
2251 	uinfo->value.integer.max = 1;
2252 	return 0;
2253 }
2254 EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
2255 
2256 /**
2257  * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
2258  * callback with stereo two channels
2259  * @kcontrol: the kcontrol instance
2260  * @uinfo: info to store
2261  *
2262  * This is a function that can be used as info callback for a standard
2263  * boolean control with stereo two channels.
2264  */
2265 int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
2266 				struct snd_ctl_elem_info *uinfo)
2267 {
2268 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2269 	uinfo->count = 2;
2270 	uinfo->value.integer.min = 0;
2271 	uinfo->value.integer.max = 1;
2272 	return 0;
2273 }
2274 EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
2275 
2276 /**
2277  * snd_ctl_enum_info - fills the info structure for an enumerated control
2278  * @info: the structure to be filled
2279  * @channels: the number of the control's channels; often one
2280  * @items: the number of control values; also the size of @names
2281  * @names: an array containing the names of all control values
2282  *
2283  * Sets all required fields in @info to their appropriate values.
2284  * If the control's accessibility is not the default (readable and writable),
2285  * the caller has to fill @info->access.
2286  *
2287  * Return: Zero.
2288  */
2289 int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
2290 		      unsigned int items, const char *const names[])
2291 {
2292 	info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
2293 	info->count = channels;
2294 	info->value.enumerated.items = items;
2295 	if (!items)
2296 		return 0;
2297 	if (info->value.enumerated.item >= items)
2298 		info->value.enumerated.item = items - 1;
2299 	WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
2300 	     "ALSA: too long item name '%s'\n",
2301 	     names[info->value.enumerated.item]);
2302 	strscpy(info->value.enumerated.name,
2303 		names[info->value.enumerated.item],
2304 		sizeof(info->value.enumerated.name));
2305 	return 0;
2306 }
2307 EXPORT_SYMBOL(snd_ctl_enum_info);
2308