sound/core/control.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *  Routines for driver control interface
   4  *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
   5  */
   6
   7 #include <linux/threads.h>
   8 #include <linux/interrupt.h>
   9 #include <linux/module.h>
  10 #include <linux/moduleparam.h>
  11 #include <linux/slab.h>
  12 #include <linux/vmalloc.h>
  13 #include <linux/time.h>
  14 #include <linux/mm.h>
  15 #include <linux/math64.h>
  16 #include <linux/sched/signal.h>
  17 #include <sound/core.h>
  18 #include <sound/minors.h>
  19 #include <sound/info.h>
  20 #include <sound/control.h>
  21
  22 // Max allocation size for user controls.
  23 static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
  24 module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
  25 MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
  26
  27 #define MAX_CONTROL_COUNT       1028
  28
  29 struct snd_kctl_ioctl {
  30         struct list_head list;          /* list of all ioctls */
  31         snd_kctl_ioctl_func_t fioctl;
  32 };
  33
  34 static DECLARE_RWSEM(snd_ioctl_rwsem);
  35 static DECLARE_RWSEM(snd_ctl_layer_rwsem);
  36 static LIST_HEAD(snd_control_ioctls);
  37 #ifdef CONFIG_COMPAT
  38 static LIST_HEAD(snd_control_compat_ioctls);
  39 #endif
  40 static struct snd_ctl_layer_ops *snd_ctl_layer;
  41
  42 static int snd_ctl_remove_locked(struct snd_card *card,
  43                                  struct snd_kcontrol *kcontrol);
  44
  45 static int snd_ctl_open(struct inode *inode, struct file *file)
  46 {
  47         struct snd_card *card;
  48         struct snd_ctl_file *ctl;
  49         int i, err;
  50
  51         err = stream_open(inode, file);
  52         if (err < 0)
  53                 return err;
  54
  55         card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
  56         if (!card) {
  57                 err = -ENODEV;
  58                 goto __error1;
  59         }
  60         err = snd_card_file_add(card, file);
  61         if (err < 0) {
  62                 err = -ENODEV;
  63                 goto __error1;
  64         }
  65         if (!try_module_get(card->module)) {
  66                 err = -EFAULT;
  67                 goto __error2;
  68         }
  69         ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
  70         if (ctl == NULL) {
  71                 err = -ENOMEM;
  72                 goto __error;
  73         }
  74         INIT_LIST_HEAD(&ctl->events);
  75         init_waitqueue_head(&ctl->change_sleep);
  76         spin_lock_init(&ctl->read_lock);
  77         ctl->card = card;
  78         for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
  79                 ctl->preferred_subdevice[i] = -1;
  80         ctl->pid = get_pid(task_pid(current));
  81         file->private_data = ctl;
  82         scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock)
  83                 list_add_tail(&ctl->list, &card->ctl_files);
  84         snd_card_unref(card);
  85         return 0;
  86
  87       __error:
  88         module_put(card->module);
  89       __error2:
  90         snd_card_file_remove(card, file);
  91       __error1:
  92         if (card)
  93                 snd_card_unref(card);
  94         return err;
  95 }
  96
  97 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
  98 {
  99         struct snd_kctl_event *cread;
 100
 101         guard(spinlock_irqsave)(&ctl->read_lock);
 102         while (!list_empty(&ctl->events)) {
 103                 cread = snd_kctl_event(ctl->events.next);
 104                 list_del(&cread->list);
 105                 kfree(cread);
 106         }
 107 }
 108
 109 static int snd_ctl_release(struct inode *inode, struct file *file)
 110 {
 111         struct snd_card *card;
 112         struct snd_ctl_file *ctl;
 113         struct snd_kcontrol *control;
 114         unsigned int idx;
 115
 116         ctl = file->private_data;
 117         file->private_data = NULL;
 118         card = ctl->card;
 119
 120         scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock)
 121                 list_del(&ctl->list);
 122
 123         scoped_guard(rwsem_write, &card->controls_rwsem) {
 124                 list_for_each_entry(control, &card->controls, list)
 125                         for (idx = 0; idx < control->count; idx++)
 126                                 if (control->vd[idx].owner == ctl)
 127                                         control->vd[idx].owner = NULL;
 128         }
 129
 130         snd_fasync_free(ctl->fasync);
 131         snd_ctl_empty_read_queue(ctl);
 132         put_pid(ctl->pid);
 133         kfree(ctl);
 134         module_put(card->module);
 135         snd_card_file_remove(card, file);
 136         return 0;
 137 }
 138
 139 /**
 140  * snd_ctl_notify - Send notification to user-space for a control change
 141  * @card: the card to send notification
 142  * @mask: the event mask, SNDRV_CTL_EVENT_*
 143  * @id: the ctl element id to send notification
 144  *
 145  * This function adds an event record with the given id and mask, appends
 146  * to the list and wakes up the user-space for notification.  This can be
 147  * called in the atomic context.
 148  */
 149 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
 150                     struct snd_ctl_elem_id *id)
 151 {
 152         struct snd_ctl_file *ctl;
 153         struct snd_kctl_event *ev;
 154
 155         if (snd_BUG_ON(!card || !id))
 156                 return;
 157         if (card->shutdown)
 158                 return;
 159
 160         guard(read_lock_irqsave)(&card->ctl_files_rwlock);
 161 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
 162         card->mixer_oss_change_count++;
 163 #endif
 164         list_for_each_entry(ctl, &card->ctl_files, list) {
 165                 if (!ctl->subscribed)
 166                         continue;
 167                 scoped_guard(spinlock, &ctl->read_lock) {
 168                         list_for_each_entry(ev, &ctl->events, list) {
 169                                 if (ev->id.numid == id->numid) {
 170                                         ev->mask |= mask;
 171                                         goto _found;
 172                                 }
 173                         }
 174                         ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
 175                         if (ev) {
 176                                 ev->id = *id;
 177                                 ev->mask = mask;
 178                                 list_add_tail(&ev->list, &ctl->events);
 179                         } else {
 180                                 dev_err(card->dev, "No memory available to allocate event\n");
 181                         }
 182 _found:
 183                         wake_up(&ctl->change_sleep);
 184                 }
 185                 snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN);
 186         }
 187 }
 188 EXPORT_SYMBOL(snd_ctl_notify);
 189
 190 /**
 191  * snd_ctl_notify_one - Send notification to user-space for a control change
 192  * @card: the card to send notification
 193  * @mask: the event mask, SNDRV_CTL_EVENT_*
 194  * @kctl: the pointer with the control instance
 195  * @ioff: the additional offset to the control index
 196  *
 197  * This function calls snd_ctl_notify() and does additional jobs
 198  * like LED state changes.
 199  */
 200 void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
 201                         struct snd_kcontrol *kctl, unsigned int ioff)
 202 {
 203         struct snd_ctl_elem_id id = kctl->id;
 204         struct snd_ctl_layer_ops *lops;
 205
 206         id.index += ioff;
 207         id.numid += ioff;
 208         snd_ctl_notify(card, mask, &id);
 209         guard(rwsem_read)(&snd_ctl_layer_rwsem);
 210         for (lops = snd_ctl_layer; lops; lops = lops->next)
 211                 lops->lnotify(card, mask, kctl, ioff);
 212 }
 213 EXPORT_SYMBOL(snd_ctl_notify_one);
 214
 215 /**
 216  * snd_ctl_new - create a new control instance with some elements
 217  * @kctl: the pointer to store new control instance
 218  * @count: the number of elements in this control
 219  * @access: the default access flags for elements in this control
 220  * @file: given when locking these elements
 221  *
 222  * Allocates a memory object for a new control instance. The instance has
 223  * elements as many as the given number (@count). Each element has given
 224  * access permissions (@access). Each element is locked when @file is given.
 225  *
 226  * Return: 0 on success, error code on failure
 227  */
 228 static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
 229                        unsigned int access, struct snd_ctl_file *file)
 230 {
 231         unsigned int idx;
 232
 233         if (count == 0 || count > MAX_CONTROL_COUNT)
 234                 return -EINVAL;
 235
 236         *kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
 237         if (!*kctl)
 238                 return -ENOMEM;
 239
 240         for (idx = 0; idx < count; idx++) {
 241                 (*kctl)->vd[idx].access = access;
 242                 (*kctl)->vd[idx].owner = file;
 243         }
 244         (*kctl)->count = count;
 245
 246         return 0;
 247 }
 248
 249 /**
 250  * snd_ctl_new1 - create a control instance from the template
 251  * @ncontrol: the initialization record
 252  * @private_data: the private data to set
 253  *
 254  * Allocates a new struct snd_kcontrol instance and initialize from the given
 255  * template.  When the access field of ncontrol is 0, it's assumed as
 256  * READWRITE access. When the count field is 0, it's assumes as one.
 257  *
 258  * Return: The pointer of the newly generated instance, or %NULL on failure.
 259  */
 260 struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
 261                                   void *private_data)
 262 {
 263         struct snd_kcontrol *kctl;
 264         unsigned int count;
 265         unsigned int access;
 266         int err;
 267
 268         if (snd_BUG_ON(!ncontrol || !ncontrol->info))
 269                 return NULL;
 270
 271         count = ncontrol->count;
 272         if (count == 0)
 273                 count = 1;
 274
 275         access = ncontrol->access;
 276         if (access == 0)
 277                 access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
 278         access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
 279                    SNDRV_CTL_ELEM_ACCESS_VOLATILE |
 280                    SNDRV_CTL_ELEM_ACCESS_INACTIVE |
 281                    SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
 282                    SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
 283                    SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
 284                    SNDRV_CTL_ELEM_ACCESS_LED_MASK |
 285                    SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
 286
 287         err = snd_ctl_new(&kctl, count, access, NULL);
 288         if (err < 0)
 289                 return NULL;
 290
 291         /* The 'numid' member is decided when calling snd_ctl_add(). */
 292         kctl->id.iface = ncontrol->iface;
 293         kctl->id.device = ncontrol->device;
 294         kctl->id.subdevice = ncontrol->subdevice;
 295         if (ncontrol->name) {
 296                 strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
 297                 if (strcmp(ncontrol->name, kctl->id.name) != 0)
 298                         pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
 299                                 ncontrol->name, kctl->id.name);
 300         }
 301         kctl->id.index = ncontrol->index;
 302
 303         kctl->info = ncontrol->info;
 304         kctl->get = ncontrol->get;
 305         kctl->put = ncontrol->put;
 306         kctl->tlv.p = ncontrol->tlv.p;
 307
 308         kctl->private_value = ncontrol->private_value;
 309         kctl->private_data = private_data;
 310
 311         return kctl;
 312 }
 313 EXPORT_SYMBOL(snd_ctl_new1);
 314
 315 /**
 316  * snd_ctl_free_one - release the control instance
 317  * @kcontrol: the control instance
 318  *
 319  * Releases the control instance created via snd_ctl_new()
 320  * or snd_ctl_new1().
 321  * Don't call this after the control was added to the card.
 322  */
 323 void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
 324 {
 325         if (kcontrol) {
 326                 if (kcontrol->private_free)
 327                         kcontrol->private_free(kcontrol);
 328                 kfree(kcontrol);
 329         }
 330 }
 331 EXPORT_SYMBOL(snd_ctl_free_one);
 332
 333 static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
 334                                           unsigned int count)
 335 {
 336         struct snd_kcontrol *kctl;
 337
 338         /* Make sure that the ids assigned to the control do not wrap around */
 339         if (card->last_numid >= UINT_MAX - count)
 340                 card->last_numid = 0;
 341
 342         list_for_each_entry(kctl, &card->controls, list) {
 343                 if (kctl->id.numid < card->last_numid + 1 + count &&
 344                     kctl->id.numid + kctl->count > card->last_numid + 1) {
 345                         card->last_numid = kctl->id.numid + kctl->count - 1;
 346                         return true;
 347                 }
 348         }
 349         return false;
 350 }
 351
 352 static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
 353 {
 354         unsigned int iter = 100000;
 355
 356         while (snd_ctl_remove_numid_conflict(card, count)) {
 357                 if (--iter == 0) {
 358                         /* this situation is very unlikely */
 359                         dev_err(card->dev, "unable to allocate new control numid\n");
 360                         return -ENOMEM;
 361                 }
 362         }
 363         return 0;
 364 }
 365
 366 /* check whether the given id is contained in the given kctl */
 367 static bool elem_id_matches(const struct snd_kcontrol *kctl,
 368                             const struct snd_ctl_elem_id *id)
 369 {
 370         return kctl->id.iface == id->iface &&
 371                 kctl->id.device == id->device &&
 372                 kctl->id.subdevice == id->subdevice &&
 373                 !strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)) &&
 374                 kctl->id.index <= id->index &&
 375                 kctl->id.index + kctl->count > id->index;
 376 }
 377
 378 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
 379 /* Compute a hash key for the corresponding ctl id
 380  * It's for the name lookup, hence the numid is excluded.
 381  * The hash key is bound in LONG_MAX to be used for Xarray key.
 382  */
 383 #define MULTIPLIER      37
 384 static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id)
 385 {
 386         int i;
 387         unsigned long h;
 388
 389         h = id->iface;
 390         h = MULTIPLIER * h + id->device;
 391         h = MULTIPLIER * h + id->subdevice;
 392         for (i = 0; i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN && id->name[i]; i++)
 393                 h = MULTIPLIER * h + id->name[i];
 394         h = MULTIPLIER * h + id->index;
 395         h &= LONG_MAX;
 396         return h;
 397 }
 398
 399 /* add hash entries to numid and ctl xarray tables */
 400 static void add_hash_entries(struct snd_card *card,
 401                              struct snd_kcontrol *kcontrol)
 402 {
 403         struct snd_ctl_elem_id id = kcontrol->id;
 404         int i;
 405
 406         xa_store_range(&card->ctl_numids, kcontrol->id.numid,
 407                        kcontrol->id.numid + kcontrol->count - 1,
 408                        kcontrol, GFP_KERNEL);
 409
 410         for (i = 0; i < kcontrol->count; i++) {
 411                 id.index = kcontrol->id.index + i;
 412                 if (xa_insert(&card->ctl_hash, get_ctl_id_hash(&id),
 413                               kcontrol, GFP_KERNEL)) {
 414                         /* skip hash for this entry, noting we had collision */
 415                         card->ctl_hash_collision = true;
 416                         dev_dbg(card->dev, "ctl_hash collision %d:%s:%d\n",
 417                                 id.iface, id.name, id.index);
 418                 }
 419         }
 420 }
 421
 422 /* remove hash entries that have been added */
 423 static void remove_hash_entries(struct snd_card *card,
 424                                 struct snd_kcontrol *kcontrol)
 425 {
 426         struct snd_ctl_elem_id id = kcontrol->id;
 427         struct snd_kcontrol *matched;
 428         unsigned long h;
 429         int i;
 430
 431         for (i = 0; i < kcontrol->count; i++) {
 432                 xa_erase(&card->ctl_numids, id.numid);
 433                 h = get_ctl_id_hash(&id);
 434                 matched = xa_load(&card->ctl_hash, h);
 435                 if (matched && (matched == kcontrol ||
 436                                 elem_id_matches(matched, &id)))
 437                         xa_erase(&card->ctl_hash, h);
 438                 id.index++;
 439                 id.numid++;
 440         }
 441 }
 442 #else /* CONFIG_SND_CTL_FAST_LOOKUP */
 443 static inline void add_hash_entries(struct snd_card *card,
 444                                     struct snd_kcontrol *kcontrol)
 445 {
 446 }
 447 static inline void remove_hash_entries(struct snd_card *card,
 448                                        struct snd_kcontrol *kcontrol)
 449 {
 450 }
 451 #endif /* CONFIG_SND_CTL_FAST_LOOKUP */
 452
 453 enum snd_ctl_add_mode {
 454         CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
 455 };
 456
 457 /* add/replace a new kcontrol object; call with card->controls_rwsem locked */
 458 static int __snd_ctl_add_replace(struct snd_card *card,
 459                                  struct snd_kcontrol *kcontrol,
 460                                  enum snd_ctl_add_mode mode)
 461 {
 462         struct snd_ctl_elem_id id;
 463         unsigned int idx;
 464         struct snd_kcontrol *old;
 465         int err;
 466
 467         lockdep_assert_held_write(&card->controls_rwsem);
 468
 469         id = kcontrol->id;
 470         if (id.index > UINT_MAX - kcontrol->count)
 471                 return -EINVAL;
 472
 473         old = snd_ctl_find_id_locked(card, &id);
 474         if (!old) {
 475                 if (mode == CTL_REPLACE)
 476                         return -EINVAL;
 477         } else {
 478                 if (mode == CTL_ADD_EXCLUSIVE) {
 479                         dev_err(card->dev,
 480                                 "control %i:%i:%i:%s:%i is already present\n",
 481                                 id.iface, id.device, id.subdevice, id.name,
 482                                 id.index);
 483                         return -EBUSY;
 484                 }
 485
 486                 err = snd_ctl_remove_locked(card, old);
 487                 if (err < 0)
 488                         return err;
 489         }
 490
 491         if (snd_ctl_find_hole(card, kcontrol->count) < 0)
 492                 return -ENOMEM;
 493
 494         list_add_tail(&kcontrol->list, &card->controls);
 495         card->controls_count += kcontrol->count;
 496         kcontrol->id.numid = card->last_numid + 1;
 497         card->last_numid += kcontrol->count;
 498
 499         add_hash_entries(card, kcontrol);
 500
 501         for (idx = 0; idx < kcontrol->count; idx++)
 502                 snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
 503
 504         return 0;
 505 }
 506
 507 static int snd_ctl_add_replace(struct snd_card *card,
 508                                struct snd_kcontrol *kcontrol,
 509                                enum snd_ctl_add_mode mode)
 510 {
 511         int err = -EINVAL;
 512
 513         if (! kcontrol)
 514                 return err;
 515         if (snd_BUG_ON(!card || !kcontrol->info))
 516                 goto error;
 517
 518         scoped_guard(rwsem_write, &card->controls_rwsem)
 519                 err = __snd_ctl_add_replace(card, kcontrol, mode);
 520
 521         if (err < 0)
 522                 goto error;
 523         return 0;
 524
 525  error:
 526         snd_ctl_free_one(kcontrol);
 527         return err;
 528 }
 529
 530 /**
 531  * snd_ctl_add - add the control instance to the card
 532  * @card: the card instance
 533  * @kcontrol: the control instance to add
 534  *
 535  * Adds the control instance created via snd_ctl_new() or
 536  * snd_ctl_new1() to the given card. Assigns also an unique
 537  * numid used for fast search.
 538  *
 539  * It frees automatically the control which cannot be added.
 540  *
 541  * Return: Zero if successful, or a negative error code on failure.
 542  *
 543  */
 544 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
 545 {
 546         return snd_ctl_add_replace(card, kcontrol, CTL_ADD_EXCLUSIVE);
 547 }
 548 EXPORT_SYMBOL(snd_ctl_add);
 549
 550 /**
 551  * snd_ctl_replace - replace the control instance of the card
 552  * @card: the card instance
 553  * @kcontrol: the control instance to replace
 554  * @add_on_replace: add the control if not already added
 555  *
 556  * Replaces the given control.  If the given control does not exist
 557  * and the add_on_replace flag is set, the control is added.  If the
 558  * control exists, it is destroyed first.
 559  *
 560  * It frees automatically the control which cannot be added or replaced.
 561  *
 562  * Return: Zero if successful, or a negative error code on failure.
 563  */
 564 int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
 565                     bool add_on_replace)
 566 {
 567         return snd_ctl_add_replace(card, kcontrol,
 568                                    add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
 569 }
 570 EXPORT_SYMBOL(snd_ctl_replace);
 571
 572 static int __snd_ctl_remove(struct snd_card *card,
 573                             struct snd_kcontrol *kcontrol,
 574                             bool remove_hash)
 575 {
 576         unsigned int idx;
 577
 578         lockdep_assert_held_write(&card->controls_rwsem);
 579
 580         if (snd_BUG_ON(!card || !kcontrol))
 581                 return -EINVAL;
 582         list_del(&kcontrol->list);
 583
 584         if (remove_hash)
 585                 remove_hash_entries(card, kcontrol);
 586
 587         card->controls_count -= kcontrol->count;
 588         for (idx = 0; idx < kcontrol->count; idx++)
 589                 snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
 590         snd_ctl_free_one(kcontrol);
 591         return 0;
 592 }
 593
 594 static inline int snd_ctl_remove_locked(struct snd_card *card,
 595                                         struct snd_kcontrol *kcontrol)
 596 {
 597         return __snd_ctl_remove(card, kcontrol, true);
 598 }
 599
 600 /**
 601  * snd_ctl_remove - remove the control from the card and release it
 602  * @card: the card instance
 603  * @kcontrol: the control instance to remove
 604  *
 605  * Removes the control from the card and then releases the instance.
 606  * You don't need to call snd_ctl_free_one().
 607  *
 608  * Return: 0 if successful, or a negative error code on failure.
 609  *
 610  * Note that this function takes card->controls_rwsem lock internally.
 611  */
 612 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
 613 {
 614         guard(rwsem_write)(&card->controls_rwsem);
 615         return snd_ctl_remove_locked(card, kcontrol);
 616 }
 617 EXPORT_SYMBOL(snd_ctl_remove);
 618
 619 /**
 620  * snd_ctl_remove_id - remove the control of the given id and release it
 621  * @card: the card instance
 622  * @id: the control id to remove
 623  *
 624  * Finds the control instance with the given id, removes it from the
 625  * card list and releases it.
 626  *
 627  * Return: 0 if successful, or a negative error code on failure.
 628  */
 629 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
 630 {
 631         struct snd_kcontrol *kctl;
 632
 633         guard(rwsem_write)(&card->controls_rwsem);
 634         kctl = snd_ctl_find_id_locked(card, id);
 635         if (kctl == NULL)
 636                 return -ENOENT;
 637         return snd_ctl_remove_locked(card, kctl);
 638 }
 639 EXPORT_SYMBOL(snd_ctl_remove_id);
 640
 641 /**
 642  * snd_ctl_remove_user_ctl - remove and release the unlocked user control
 643  * @file: active control handle
 644  * @id: the control id to remove
 645  *
 646  * Finds the control instance with the given id, removes it from the
 647  * card list and releases it.
 648  *
 649  * Return: 0 if successful, or a negative error code on failure.
 650  */
 651 static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
 652                                    struct snd_ctl_elem_id *id)
 653 {
 654         struct snd_card *card = file->card;
 655         struct snd_kcontrol *kctl;
 656         int idx;
 657
 658         guard(rwsem_write)(&card->controls_rwsem);
 659         kctl = snd_ctl_find_id_locked(card, id);
 660         if (kctl == NULL)
 661                 return -ENOENT;
 662         if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER))
 663                 return -EINVAL;
 664         for (idx = 0; idx < kctl->count; idx++)
 665                 if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file)
 666                         return -EBUSY;
 667         return snd_ctl_remove_locked(card, kctl);
 668 }
 669
 670 /**
 671  * snd_ctl_activate_id - activate/inactivate the control of the given id
 672  * @card: the card instance
 673  * @id: the control id to activate/inactivate
 674  * @active: non-zero to activate
 675  *
 676  * Finds the control instance with the given id, and activate or
 677  * inactivate the control together with notification, if changed.
 678  * The given ID data is filled with full information.
 679  *
 680  * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
 681  */
 682 int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
 683                         int active)
 684 {
 685         struct snd_kcontrol *kctl;
 686         struct snd_kcontrol_volatile *vd;
 687         unsigned int index_offset;
 688         int ret;
 689
 690         down_write(&card->controls_rwsem);
 691         kctl = snd_ctl_find_id_locked(card, id);
 692         if (kctl == NULL) {
 693                 ret = -ENOENT;
 694                 goto unlock;
 695         }
 696         index_offset = snd_ctl_get_ioff(kctl, id);
 697         vd = &kctl->vd[index_offset];
 698         ret = 0;
 699         if (active) {
 700                 if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
 701                         goto unlock;
 702                 vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
 703         } else {
 704                 if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
 705                         goto unlock;
 706                 vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
 707         }
 708         snd_ctl_build_ioff(id, kctl, index_offset);
 709         downgrade_write(&card->controls_rwsem);
 710         snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
 711         up_read(&card->controls_rwsem);
 712         return 1;
 713
 714  unlock:
 715         up_write(&card->controls_rwsem);
 716         return ret;
 717 }
 718 EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
 719
 720 /**
 721  * snd_ctl_rename_id - replace the id of a control on the card
 722  * @card: the card instance
 723  * @src_id: the old id
 724  * @dst_id: the new id
 725  *
 726  * Finds the control with the old id from the card, and replaces the
 727  * id with the new one.
 728  *
 729  * The function tries to keep the already assigned numid while replacing
 730  * the rest.
 731  *
 732  * Note that this function should be used only in the card initialization
 733  * phase.  Calling after the card instantiation may cause issues with
 734  * user-space expecting persistent numids.
 735  *
 736  * Return: Zero if successful, or a negative error code on failure.
 737  */
 738 int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
 739                       struct snd_ctl_elem_id *dst_id)
 740 {
 741         struct snd_kcontrol *kctl;
 742         int saved_numid;
 743
 744         guard(rwsem_write)(&card->controls_rwsem);
 745         kctl = snd_ctl_find_id_locked(card, src_id);
 746         if (kctl == NULL)
 747                 return -ENOENT;
 748         saved_numid = kctl->id.numid;
 749         remove_hash_entries(card, kctl);
 750         kctl->id = *dst_id;
 751         kctl->id.numid = saved_numid;
 752         add_hash_entries(card, kctl);
 753         return 0;
 754 }
 755 EXPORT_SYMBOL(snd_ctl_rename_id);
 756
 757 /**
 758  * snd_ctl_rename - rename the control on the card
 759  * @card: the card instance
 760  * @kctl: the control to rename
 761  * @name: the new name
 762  *
 763  * Renames the specified control on the card to the new name.
 764  *
 765  * Note that this function takes card->controls_rwsem lock internally.
 766  */
 767 void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
 768                     const char *name)
 769 {
 770         guard(rwsem_write)(&card->controls_rwsem);
 771         remove_hash_entries(card, kctl);
 772
 773         if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
 774                 pr_warn("ALSA: Renamed control new name '%s' truncated to '%s'\n",
 775                         name, kctl->id.name);
 776
 777         add_hash_entries(card, kctl);
 778 }
 779 EXPORT_SYMBOL(snd_ctl_rename);
 780
 781 #ifndef CONFIG_SND_CTL_FAST_LOOKUP
 782 static struct snd_kcontrol *
 783 snd_ctl_find_numid_slow(struct snd_card *card, unsigned int numid)
 784 {
 785         struct snd_kcontrol *kctl;
 786
 787         list_for_each_entry(kctl, &card->controls, list) {
 788                 if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
 789                         return kctl;
 790         }
 791         return NULL;
 792 }
 793 #endif /* !CONFIG_SND_CTL_FAST_LOOKUP */
 794
 795 /**
 796  * snd_ctl_find_numid_locked - find the control instance with the given number-id
 797  * @card: the card instance
 798  * @numid: the number-id to search
 799  *
 800  * Finds the control instance with the given number-id from the card.
 801  *
 802  * The caller must down card->controls_rwsem before calling this function
 803  * (if the race condition can happen).
 804  *
 805  * Return: The pointer of the instance if found, or %NULL if not.
 806  */
 807 struct snd_kcontrol *
 808 snd_ctl_find_numid_locked(struct snd_card *card, unsigned int numid)
 809 {
 810         if (snd_BUG_ON(!card || !numid))
 811                 return NULL;
 812         lockdep_assert_held(&card->controls_rwsem);
 813 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
 814         return xa_load(&card->ctl_numids, numid);
 815 #else
 816         return snd_ctl_find_numid_slow(card, numid);
 817 #endif
 818 }
 819 EXPORT_SYMBOL(snd_ctl_find_numid_locked);
 820
 821 /**
 822  * snd_ctl_find_numid - find the control instance with the given number-id
 823  * @card: the card instance
 824  * @numid: the number-id to search
 825  *
 826  * Finds the control instance with the given number-id from the card.
 827  *
 828  * Return: The pointer of the instance if found, or %NULL if not.
 829  *
 830  * Note that this function takes card->controls_rwsem lock internally.
 831  */
 832 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card,
 833                                         unsigned int numid)
 834 {
 835         guard(rwsem_read)(&card->controls_rwsem);
 836         return snd_ctl_find_numid_locked(card, numid);
 837 }
 838 EXPORT_SYMBOL(snd_ctl_find_numid);
 839
 840 /**
 841  * snd_ctl_find_id_locked - find the control instance with the given id
 842  * @card: the card instance
 843  * @id: the id to search
 844  *
 845  * Finds the control instance with the given id from the card.
 846  *
 847  * The caller must down card->controls_rwsem before calling this function
 848  * (if the race condition can happen).
 849  *
 850  * Return: The pointer of the instance if found, or %NULL if not.
 851  */
 852 struct snd_kcontrol *snd_ctl_find_id_locked(struct snd_card *card,
 853                                             const struct snd_ctl_elem_id *id)
 854 {
 855         struct snd_kcontrol *kctl;
 856
 857         if (snd_BUG_ON(!card || !id))
 858                 return NULL;
 859         lockdep_assert_held(&card->controls_rwsem);
 860         if (id->numid != 0)
 861                 return snd_ctl_find_numid_locked(card, id->numid);
 862 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
 863         kctl = xa_load(&card->ctl_hash, get_ctl_id_hash(id));
 864         if (kctl && elem_id_matches(kctl, id))
 865                 return kctl;
 866         if (!card->ctl_hash_collision)
 867                 return NULL; /* we can rely on only hash table */
 868 #endif
 869         /* no matching in hash table - try all as the last resort */
 870         list_for_each_entry(kctl, &card->controls, list)
 871                 if (elem_id_matches(kctl, id))
 872                         return kctl;
 873
 874         return NULL;
 875 }
 876 EXPORT_SYMBOL(snd_ctl_find_id_locked);
 877
 878 /**
 879  * snd_ctl_find_id - find the control instance with the given id
 880  * @card: the card instance
 881  * @id: the id to search
 882  *
 883  * Finds the control instance with the given id from the card.
 884  *
 885  * Return: The pointer of the instance if found, or %NULL if not.
 886  *
 887  * Note that this function takes card->controls_rwsem lock internally.
 888  */
 889 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
 890                                      const struct snd_ctl_elem_id *id)
 891 {
 892         guard(rwsem_read)(&card->controls_rwsem);
 893         return snd_ctl_find_id_locked(card, id);
 894 }
 895 EXPORT_SYMBOL(snd_ctl_find_id);
 896
 897 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
 898                              unsigned int cmd, void __user *arg)
 899 {
 900         struct snd_ctl_card_info *info __free(kfree) = NULL;
 901
 902         info = kzalloc(sizeof(*info), GFP_KERNEL);
 903         if (! info)
 904                 return -ENOMEM;
 905         scoped_guard(rwsem_read, &snd_ioctl_rwsem) {
 906                 info->card = card->number;
 907                 strscpy(info->id, card->id, sizeof(info->id));
 908                 strscpy(info->driver, card->driver, sizeof(info->driver));
 909                 strscpy(info->name, card->shortname, sizeof(info->name));
 910                 strscpy(info->longname, card->longname, sizeof(info->longname));
 911                 strscpy(info->mixername, card->mixername, sizeof(info->mixername));
 912                 strscpy(info->components, card->components, sizeof(info->components));
 913         }
 914         if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info)))
 915                 return -EFAULT;
 916         return 0;
 917 }
 918
 919 static int snd_ctl_elem_list(struct snd_card *card,
 920                              struct snd_ctl_elem_list *list)
 921 {
 922         struct snd_kcontrol *kctl;
 923         struct snd_ctl_elem_id id;
 924         unsigned int offset, space, jidx;
 925
 926         offset = list->offset;
 927         space = list->space;
 928
 929         guard(rwsem_read)(&card->controls_rwsem);
 930         list->count = card->controls_count;
 931         list->used = 0;
 932         if (!space)
 933                 return 0;
 934         list_for_each_entry(kctl, &card->controls, list) {
 935                 if (offset >= kctl->count) {
 936                         offset -= kctl->count;
 937                         continue;
 938                 }
 939                 for (jidx = offset; jidx < kctl->count; jidx++) {
 940                         snd_ctl_build_ioff(&id, kctl, jidx);
 941                         if (copy_to_user(list->pids + list->used, &id, sizeof(id)))
 942                                 return -EFAULT;
 943                         list->used++;
 944                         if (!--space)
 945                                 return 0;
 946                 }
 947                 offset = 0;
 948         }
 949         return 0;
 950 }
 951
 952 static int snd_ctl_elem_list_user(struct snd_card *card,
 953                                   struct snd_ctl_elem_list __user *_list)
 954 {
 955         struct snd_ctl_elem_list list;
 956         int err;
 957
 958         if (copy_from_user(&list, _list, sizeof(list)))
 959                 return -EFAULT;
 960         err = snd_ctl_elem_list(card, &list);
 961         if (err)
 962                 return err;
 963         if (copy_to_user(_list, &list, sizeof(list)))
 964                 return -EFAULT;
 965
 966         return 0;
 967 }
 968
 969 /* Check whether the given kctl info is valid */
 970 static int snd_ctl_check_elem_info(struct snd_card *card,
 971                                    const struct snd_ctl_elem_info *info)
 972 {
 973         static const unsigned int max_value_counts[] = {
 974                 [SNDRV_CTL_ELEM_TYPE_BOOLEAN]   = 128,
 975                 [SNDRV_CTL_ELEM_TYPE_INTEGER]   = 128,
 976                 [SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
 977                 [SNDRV_CTL_ELEM_TYPE_BYTES]     = 512,
 978                 [SNDRV_CTL_ELEM_TYPE_IEC958]    = 1,
 979                 [SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
 980         };
 981
 982         if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
 983             info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
 984                 if (card)
 985                         dev_err(card->dev,
 986                                 "control %i:%i:%i:%s:%i: invalid type %d\n",
 987                                 info->id.iface, info->id.device,
 988                                 info->id.subdevice, info->id.name,
 989                                 info->id.index, info->type);
 990                 return -EINVAL;
 991         }
 992         if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
 993             info->value.enumerated.items == 0) {
 994                 if (card)
 995                         dev_err(card->dev,
 996                                 "control %i:%i:%i:%s:%i: zero enum items\n",
 997                                 info->id.iface, info->id.device,
 998                                 info->id.subdevice, info->id.name,
 999                                 info->id.index);
1000                 return -EINVAL;
1001         }
1002         if (info->count > max_value_counts[info->type]) {
1003                 if (card)
1004                         dev_err(card->dev,
1005                                 "control %i:%i:%i:%s:%i: invalid count %d\n",
1006                                 info->id.iface, info->id.device,
1007                                 info->id.subdevice, info->id.name,
1008                                 info->id.index, info->count);
1009                 return -EINVAL;
1010         }
1011
1012         return 0;
1013 }
1014
1015 /* The capacity of struct snd_ctl_elem_value.value.*/
1016 static const unsigned int value_sizes[] = {
1017         [SNDRV_CTL_ELEM_TYPE_BOOLEAN]   = sizeof(long),
1018         [SNDRV_CTL_ELEM_TYPE_INTEGER]   = sizeof(long),
1019         [SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
1020         [SNDRV_CTL_ELEM_TYPE_BYTES]     = sizeof(unsigned char),
1021         [SNDRV_CTL_ELEM_TYPE_IEC958]    = sizeof(struct snd_aes_iec958),
1022         [SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
1023 };
1024
1025 /* fill the remaining snd_ctl_elem_value data with the given pattern */
1026 static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
1027                                       struct snd_ctl_elem_info *info,
1028                                       u32 pattern)
1029 {
1030         size_t offset = value_sizes[info->type] * info->count;
1031
1032         offset = DIV_ROUND_UP(offset, sizeof(u32));
1033         memset32((u32 *)control->value.bytes.data + offset, pattern,
1034                  sizeof(control->value) / sizeof(u32) - offset);
1035 }
1036
1037 /* check whether the given integer ctl value is valid */
1038 static int sanity_check_int_value(struct snd_card *card,
1039                                   const struct snd_ctl_elem_value *control,
1040                                   const struct snd_ctl_elem_info *info,
1041                                   int i, bool print_error)
1042 {
1043         long long lval, lmin, lmax, lstep;
1044         u64 rem;
1045
1046         switch (info->type) {
1047         default:
1048         case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1049                 lval = control->value.integer.value[i];
1050                 lmin = 0;
1051                 lmax = 1;
1052                 lstep = 0;
1053                 break;
1054         case SNDRV_CTL_ELEM_TYPE_INTEGER:
1055                 lval = control->value.integer.value[i];
1056                 lmin = info->value.integer.min;
1057                 lmax = info->value.integer.max;
1058                 lstep = info->value.integer.step;
1059                 break;
1060         case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1061                 lval = control->value.integer64.value[i];
1062                 lmin = info->value.integer64.min;
1063                 lmax = info->value.integer64.max;
1064                 lstep = info->value.integer64.step;
1065                 break;
1066         case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1067                 lval = control->value.enumerated.item[i];
1068                 lmin = 0;
1069                 lmax = info->value.enumerated.items - 1;
1070                 lstep = 0;
1071                 break;
1072         }
1073
1074         if (lval < lmin || lval > lmax) {
1075                 if (print_error)
1076                         dev_err(card->dev,
1077                                 "control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
1078                                 control->id.iface, control->id.device,
1079                                 control->id.subdevice, control->id.name,
1080                                 control->id.index, lval, lmin, lmax, i);
1081                 return -EINVAL;
1082         }
1083         if (lstep) {
1084                 div64_u64_rem(lval, lstep, &rem);
1085                 if (rem) {
1086                         if (print_error)
1087                                 dev_err(card->dev,
1088                                         "control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
1089                                         control->id.iface, control->id.device,
1090                                         control->id.subdevice, control->id.name,
1091                                         control->id.index, lval, lstep, i);
1092                         return -EINVAL;
1093                 }
1094         }
1095
1096         return 0;
1097 }
1098
1099 /* check whether the all input values are valid for the given elem value */
1100 static int sanity_check_input_values(struct snd_card *card,
1101                                      const struct snd_ctl_elem_value *control,
1102                                      const struct snd_ctl_elem_info *info,
1103                                      bool print_error)
1104 {
1105         int i, ret;
1106
1107         switch (info->type) {
1108         case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1109         case SNDRV_CTL_ELEM_TYPE_INTEGER:
1110         case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1111         case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1112                 for (i = 0; i < info->count; i++) {
1113                         ret = sanity_check_int_value(card, control, info, i,
1114                                                      print_error);
1115                         if (ret < 0)
1116                                 return ret;
1117                 }
1118                 break;
1119         default:
1120                 break;
1121         }
1122
1123         return 0;
1124 }
1125
1126 /* perform sanity checks to the given snd_ctl_elem_value object */
1127 static int sanity_check_elem_value(struct snd_card *card,
1128                                    const struct snd_ctl_elem_value *control,
1129                                    const struct snd_ctl_elem_info *info,
1130                                    u32 pattern)
1131 {
1132         size_t offset;
1133         int ret;
1134         u32 *p;
1135
1136         ret = sanity_check_input_values(card, control, info, true);
1137         if (ret < 0)
1138                 return ret;
1139
1140         /* check whether the remaining area kept untouched */
1141         offset = value_sizes[info->type] * info->count;
1142         offset = DIV_ROUND_UP(offset, sizeof(u32));
1143         p = (u32 *)control->value.bytes.data + offset;
1144         for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
1145                 if (*p != pattern) {
1146                         ret = -EINVAL;
1147                         break;
1148                 }
1149                 *p = 0; /* clear the checked area */
1150         }
1151
1152         return ret;
1153 }
1154
1155 static int __snd_ctl_elem_info(struct snd_card *card,
1156                                struct snd_kcontrol *kctl,
1157                                struct snd_ctl_elem_info *info,
1158                                struct snd_ctl_file *ctl)
1159 {
1160         struct snd_kcontrol_volatile *vd;
1161         unsigned int index_offset;
1162         int result;
1163
1164 #ifdef CONFIG_SND_DEBUG
1165         info->access = 0;
1166 #endif
1167         result = snd_power_ref_and_wait(card);
1168         if (!result)
1169                 result = kctl->info(kctl, info);
1170         snd_power_unref(card);
1171         if (result >= 0) {
1172                 snd_BUG_ON(info->access);
1173                 index_offset = snd_ctl_get_ioff(kctl, &info->id);
1174                 vd = &kctl->vd[index_offset];
1175                 snd_ctl_build_ioff(&info->id, kctl, index_offset);
1176                 info->access = vd->access;
1177                 if (vd->owner) {
1178                         info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
1179                         if (vd->owner == ctl)
1180                                 info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
1181                         info->owner = pid_vnr(vd->owner->pid);
1182                 } else {
1183                         info->owner = -1;
1184                 }
1185                 if (!snd_ctl_skip_validation(info) &&
1186                     snd_ctl_check_elem_info(card, info) < 0)
1187                         result = -EINVAL;
1188         }
1189         return result;
1190 }
1191
1192 static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
1193                              struct snd_ctl_elem_info *info)
1194 {
1195         struct snd_card *card = ctl->card;
1196         struct snd_kcontrol *kctl;
1197
1198         guard(rwsem_read)(&card->controls_rwsem);
1199         kctl = snd_ctl_find_id_locked(card, &info->id);
1200         if (!kctl)
1201                 return -ENOENT;
1202         return __snd_ctl_elem_info(card, kctl, info, ctl);
1203 }
1204
1205 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
1206                                   struct snd_ctl_elem_info __user *_info)
1207 {
1208         struct snd_ctl_elem_info info;
1209         int result;
1210
1211         if (copy_from_user(&info, _info, sizeof(info)))
1212                 return -EFAULT;
1213         result = snd_ctl_elem_info(ctl, &info);
1214         if (result < 0)
1215                 return result;
1216         /* drop internal access flags */
1217         info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
1218                          SNDRV_CTL_ELEM_ACCESS_LED_MASK);
1219         if (copy_to_user(_info, &info, sizeof(info)))
1220                 return -EFAULT;
1221         return result;
1222 }
1223
1224 static int snd_ctl_elem_read(struct snd_card *card,
1225                              struct snd_ctl_elem_value *control)
1226 {
1227         struct snd_kcontrol *kctl;
1228         struct snd_kcontrol_volatile *vd;
1229         unsigned int index_offset;
1230         struct snd_ctl_elem_info info;
1231         const u32 pattern = 0xdeadbeef;
1232         int ret;
1233
1234         guard(rwsem_read)(&card->controls_rwsem);
1235         kctl = snd_ctl_find_id_locked(card, &control->id);
1236         if (!kctl)
1237                 return -ENOENT;
1238
1239         index_offset = snd_ctl_get_ioff(kctl, &control->id);
1240         vd = &kctl->vd[index_offset];
1241         if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || !kctl->get)
1242                 return -EPERM;
1243
1244         snd_ctl_build_ioff(&control->id, kctl, index_offset);
1245
1246 #ifdef CONFIG_SND_CTL_DEBUG
1247         /* info is needed only for validation */
1248         memset(&info, 0, sizeof(info));
1249         info.id = control->id;
1250         ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
1251         if (ret < 0)
1252                 return ret;
1253 #endif
1254
1255         if (!snd_ctl_skip_validation(&info))
1256                 fill_remaining_elem_value(control, &info, pattern);
1257         ret = snd_power_ref_and_wait(card);
1258         if (!ret)
1259                 ret = kctl->get(kctl, control);
1260         snd_power_unref(card);
1261         if (ret < 0)
1262                 return ret;
1263         if (!snd_ctl_skip_validation(&info) &&
1264             sanity_check_elem_value(card, control, &info, pattern) < 0) {
1265                 dev_err(card->dev,
1266                         "control %i:%i:%i:%s:%i: access overflow\n",
1267                         control->id.iface, control->id.device,
1268                         control->id.subdevice, control->id.name,
1269                         control->id.index);
1270                 return -EINVAL;
1271         }
1272         return 0;
1273 }
1274
1275 static int snd_ctl_elem_read_user(struct snd_card *card,
1276                                   struct snd_ctl_elem_value __user *_control)
1277 {
1278         struct snd_ctl_elem_value *control __free(kfree) = NULL;
1279         int result;
1280
1281         control = memdup_user(_control, sizeof(*control));
1282         if (IS_ERR(control))
1283                 return PTR_ERR(no_free_ptr(control));
1284
1285         result = snd_ctl_elem_read(card, control);
1286         if (result < 0)
1287                 return result;
1288
1289         if (copy_to_user(_control, control, sizeof(*control)))
1290                 return -EFAULT;
1291         return result;
1292 }
1293
1294 static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
1295                               struct snd_ctl_elem_value *control)
1296 {
1297         struct snd_kcontrol *kctl;
1298         struct snd_kcontrol_volatile *vd;
1299         unsigned int index_offset;
1300         int result;
1301
1302         down_write(&card->controls_rwsem);
1303         kctl = snd_ctl_find_id_locked(card, &control->id);
1304         if (kctl == NULL) {
1305                 up_write(&card->controls_rwsem);
1306                 return -ENOENT;
1307         }
1308
1309         index_offset = snd_ctl_get_ioff(kctl, &control->id);
1310         vd = &kctl->vd[index_offset];
1311         if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
1312             (file && vd->owner && vd->owner != file)) {
1313                 up_write(&card->controls_rwsem);
1314                 return -EPERM;
1315         }
1316
1317         snd_ctl_build_ioff(&control->id, kctl, index_offset);
1318         result = snd_power_ref_and_wait(card);
1319         /* validate input values */
1320         if (IS_ENABLED(CONFIG_SND_CTL_INPUT_VALIDATION) && !result) {
1321                 struct snd_ctl_elem_info info;
1322
1323                 memset(&info, 0, sizeof(info));
1324                 info.id = control->id;
1325                 result = __snd_ctl_elem_info(card, kctl, &info, NULL);
1326                 if (!result)
1327                         result = sanity_check_input_values(card, control, &info,
1328                                                            false);
1329         }
1330         if (!result)
1331                 result = kctl->put(kctl, control);
1332         snd_power_unref(card);
1333         if (result < 0) {
1334                 up_write(&card->controls_rwsem);
1335                 return result;
1336         }
1337
1338         if (result > 0) {
1339                 downgrade_write(&card->controls_rwsem);
1340                 snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
1341                 up_read(&card->controls_rwsem);
1342         } else {
1343                 up_write(&card->controls_rwsem);
1344         }
1345
1346         return 0;
1347 }
1348
1349 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
1350                                    struct snd_ctl_elem_value __user *_control)
1351 {
1352         struct snd_ctl_elem_value *control __free(kfree) = NULL;
1353         struct snd_card *card;
1354         int result;
1355
1356         control = memdup_user(_control, sizeof(*control));
1357         if (IS_ERR(control))
1358                 return PTR_ERR(no_free_ptr(control));
1359
1360         card = file->card;
1361         result = snd_ctl_elem_write(card, file, control);
1362         if (result < 0)
1363                 return result;
1364
1365         if (copy_to_user(_control, control, sizeof(*control)))
1366                 return -EFAULT;
1367         return result;
1368 }
1369
1370 static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1371                              struct snd_ctl_elem_id __user *_id)
1372 {
1373         struct snd_card *card = file->card;
1374         struct snd_ctl_elem_id id;
1375         struct snd_kcontrol *kctl;
1376         struct snd_kcontrol_volatile *vd;
1377
1378         if (copy_from_user(&id, _id, sizeof(id)))
1379                 return -EFAULT;
1380         guard(rwsem_write)(&card->controls_rwsem);
1381         kctl = snd_ctl_find_id_locked(card, &id);
1382         if (!kctl)
1383                 return -ENOENT;
1384         vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1385         if (vd->owner)
1386                 return -EBUSY;
1387         vd->owner = file;
1388         return 0;
1389 }
1390
1391 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1392                                struct snd_ctl_elem_id __user *_id)
1393 {
1394         struct snd_card *card = file->card;
1395         struct snd_ctl_elem_id id;
1396         struct snd_kcontrol *kctl;
1397         struct snd_kcontrol_volatile *vd;
1398
1399         if (copy_from_user(&id, _id, sizeof(id)))
1400                 return -EFAULT;
1401         guard(rwsem_write)(&card->controls_rwsem);
1402         kctl = snd_ctl_find_id_locked(card, &id);
1403         if (!kctl)
1404                 return -ENOENT;
1405         vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1406         if (!vd->owner)
1407                 return -EINVAL;
1408         if (vd->owner != file)
1409                 return -EPERM;
1410         vd->owner = NULL;
1411         return 0;
1412 }
1413
1414 struct user_element {
1415         struct snd_ctl_elem_info info;
1416         struct snd_card *card;
1417         char *elem_data;                /* element data */
1418         unsigned long elem_data_size;   /* size of element data in bytes */
1419         void *tlv_data;                 /* TLV data */
1420         unsigned long tlv_data_size;    /* TLV data size */
1421         void *priv_data;                /* private data (like strings for enumerated type) */
1422 };
1423
1424 // check whether the addition (in bytes) of user ctl element may overflow the limit.
1425 static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
1426 {
1427         return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
1428 }
1429
1430 static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1431                                   struct snd_ctl_elem_info *uinfo)
1432 {
1433         struct user_element *ue = kcontrol->private_data;
1434         unsigned int offset;
1435
1436         offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1437         *uinfo = ue->info;
1438         snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1439
1440         return 0;
1441 }
1442
1443 static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1444                                        struct snd_ctl_elem_info *uinfo)
1445 {
1446         struct user_element *ue = kcontrol->private_data;
1447         const char *names;
1448         unsigned int item;
1449         unsigned int offset;
1450
1451         item = uinfo->value.enumerated.item;
1452
1453         offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1454         *uinfo = ue->info;
1455         snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1456
1457         item = min(item, uinfo->value.enumerated.items - 1);
1458         uinfo->value.enumerated.item = item;
1459
1460         names = ue->priv_data;
1461         for (; item > 0; --item)
1462                 names += strlen(names) + 1;
1463         strcpy(uinfo->value.enumerated.name, names);
1464
1465         return 0;
1466 }
1467
1468 static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1469                                  struct snd_ctl_elem_value *ucontrol)
1470 {
1471         struct user_element *ue = kcontrol->private_data;
1472         unsigned int size = ue->elem_data_size;
1473         char *src = ue->elem_data +
1474                         snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1475
1476         memcpy(&ucontrol->value, src, size);
1477         return 0;
1478 }
1479
1480 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1481                                  struct snd_ctl_elem_value *ucontrol)
1482 {
1483         int change;
1484         struct user_element *ue = kcontrol->private_data;
1485         unsigned int size = ue->elem_data_size;
1486         char *dst = ue->elem_data +
1487                         snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1488
1489         change = memcmp(&ucontrol->value, dst, size) != 0;
1490         if (change)
1491                 memcpy(dst, &ucontrol->value, size);
1492         return change;
1493 }
1494
1495 /* called in controls_rwsem write lock */
1496 static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1497                             unsigned int size)
1498 {
1499         struct user_element *ue = kctl->private_data;
1500         unsigned int *container;
1501         unsigned int mask = 0;
1502         int i;
1503         int change;
1504
1505         lockdep_assert_held_write(&ue->card->controls_rwsem);
1506
1507         if (size > 1024 * 128)  /* sane value */
1508                 return -EINVAL;
1509
1510         // does the TLV size change cause overflow?
1511         if (check_user_elem_overflow(ue->card, (ssize_t)(size - ue->tlv_data_size)))
1512                 return -ENOMEM;
1513
1514         container = vmemdup_user(buf, size);
1515         if (IS_ERR(container))
1516                 return PTR_ERR(container);
1517
1518         change = ue->tlv_data_size != size;
1519         if (!change)
1520                 change = memcmp(ue->tlv_data, container, size) != 0;
1521         if (!change) {
1522                 kvfree(container);
1523                 return 0;
1524         }
1525
1526         if (ue->tlv_data == NULL) {
1527                 /* Now TLV data is available. */
1528                 for (i = 0; i < kctl->count; ++i)
1529                         kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
1530                 mask = SNDRV_CTL_EVENT_MASK_INFO;
1531         } else {
1532                 ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1533                 ue->tlv_data_size = 0;
1534                 kvfree(ue->tlv_data);
1535         }
1536
1537         ue->tlv_data = container;
1538         ue->tlv_data_size = size;
1539         // decremented at private_free.
1540         ue->card->user_ctl_alloc_size += size;
1541
1542         mask |= SNDRV_CTL_EVENT_MASK_TLV;
1543         for (i = 0; i < kctl->count; ++i)
1544                 snd_ctl_notify_one(ue->card, mask, kctl, i);
1545
1546         return change;
1547 }
1548
1549 static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1550                          unsigned int size)
1551 {
1552         struct user_element *ue = kctl->private_data;
1553
1554         if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
1555                 return -ENXIO;
1556
1557         if (size < ue->tlv_data_size)
1558                 return -ENOSPC;
1559
1560         if (copy_to_user(buf, ue->tlv_data, ue->tlv_data_size))
1561                 return -EFAULT;
1562
1563         return 0;
1564 }
1565
1566 static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
1567                                  unsigned int size, unsigned int __user *buf)
1568 {
1569         if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
1570                 return replace_user_tlv(kctl, buf, size);
1571         else
1572                 return read_user_tlv(kctl, buf, size);
1573 }
1574
1575 /* called in controls_rwsem write lock */
1576 static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1577 {
1578         char *names, *p;
1579         size_t buf_len, name_len;
1580         unsigned int i;
1581         const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1582
1583         lockdep_assert_held_write(&ue->card->controls_rwsem);
1584
1585         buf_len = ue->info.value.enumerated.names_length;
1586         if (buf_len > 64 * 1024)
1587                 return -EINVAL;
1588
1589         if (check_user_elem_overflow(ue->card, buf_len))
1590                 return -ENOMEM;
1591         names = vmemdup_user((const void __user *)user_ptrval, buf_len);
1592         if (IS_ERR(names))
1593                 return PTR_ERR(names);
1594
1595         /* check that there are enough valid names */
1596         p = names;
1597         for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1598                 name_len = strnlen(p, buf_len);
1599                 if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1600                         kvfree(names);
1601                         return -EINVAL;
1602                 }
1603                 p += name_len + 1;
1604                 buf_len -= name_len + 1;
1605         }
1606
1607         ue->priv_data = names;
1608         ue->info.value.enumerated.names_ptr = 0;
1609         // increment the allocation size; decremented again at private_free.
1610         ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
1611
1612         return 0;
1613 }
1614
1615 static size_t compute_user_elem_size(size_t size, unsigned int count)
1616 {
1617         return sizeof(struct user_element) + size * count;
1618 }
1619
1620 static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1621 {
1622         struct user_element *ue = kcontrol->private_data;
1623
1624         // decrement the allocation size.
1625         ue->card->user_ctl_alloc_size -= compute_user_elem_size(ue->elem_data_size, kcontrol->count);
1626         ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1627         if (ue->priv_data)
1628                 ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
1629
1630         kvfree(ue->tlv_data);
1631         kvfree(ue->priv_data);
1632         kfree(ue);
1633 }
1634
1635 static int snd_ctl_elem_add(struct snd_ctl_file *file,
1636                             struct snd_ctl_elem_info *info, int replace)
1637 {
1638         struct snd_card *card = file->card;
1639         struct snd_kcontrol *kctl;
1640         unsigned int count;
1641         unsigned int access;
1642         long private_size;
1643         size_t alloc_size;
1644         struct user_element *ue;
1645         unsigned int offset;
1646         int err;
1647
1648         if (!*info->id.name)
1649                 return -EINVAL;
1650         if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
1651                 return -EINVAL;
1652
1653         /* Delete a control to replace them if needed. */
1654         if (replace) {
1655                 info->id.numid = 0;
1656                 err = snd_ctl_remove_user_ctl(file, &info->id);
1657                 if (err)
1658                         return err;
1659         }
1660
1661         /* Check the number of elements for this userspace control. */
1662         count = info->owner;
1663         if (count == 0)
1664                 count = 1;
1665
1666         /* Arrange access permissions if needed. */
1667         access = info->access;
1668         if (access == 0)
1669                 access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1670         access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1671                    SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1672                    SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
1673
1674         /* In initial state, nothing is available as TLV container. */
1675         if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1676                 access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1677         access |= SNDRV_CTL_ELEM_ACCESS_USER;
1678
1679         /*
1680          * Check information and calculate the size of data specific to
1681          * this userspace control.
1682          */
1683         /* pass NULL to card for suppressing error messages */
1684         err = snd_ctl_check_elem_info(NULL, info);
1685         if (err < 0)
1686                 return err;
1687         /* user-space control doesn't allow zero-size data */
1688         if (info->count < 1)
1689                 return -EINVAL;
1690         private_size = value_sizes[info->type] * info->count;
1691         alloc_size = compute_user_elem_size(private_size, count);
1692
1693         guard(rwsem_write)(&card->controls_rwsem);
1694         if (check_user_elem_overflow(card, alloc_size))
1695                 return -ENOMEM;
1696
1697         /*
1698          * Keep memory object for this userspace control. After passing this
1699          * code block, the instance should be freed by snd_ctl_free_one().
1700          *
1701          * Note that these elements in this control are locked.
1702          */
1703         err = snd_ctl_new(&kctl, count, access, file);
1704         if (err < 0)
1705                 return err;
1706         memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1707         ue = kzalloc(alloc_size, GFP_KERNEL);
1708         if (!ue) {
1709                 kfree(kctl);
1710                 return -ENOMEM;
1711         }
1712         kctl->private_data = ue;
1713         kctl->private_free = snd_ctl_elem_user_free;
1714
1715         // increment the allocated size; decremented again at private_free.
1716         card->user_ctl_alloc_size += alloc_size;
1717
1718         /* Set private data for this userspace control. */
1719         ue->card = card;
1720         ue->info = *info;
1721         ue->info.access = 0;
1722         ue->elem_data = (char *)ue + sizeof(*ue);
1723         ue->elem_data_size = private_size;
1724         if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1725                 err = snd_ctl_elem_init_enum_names(ue);
1726                 if (err < 0) {
1727                         snd_ctl_free_one(kctl);
1728                         return err;
1729                 }
1730         }
1731
1732         /* Set callback functions. */
1733         if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1734                 kctl->info = snd_ctl_elem_user_enum_info;
1735         else
1736                 kctl->info = snd_ctl_elem_user_info;
1737         if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1738                 kctl->get = snd_ctl_elem_user_get;
1739         if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1740                 kctl->put = snd_ctl_elem_user_put;
1741         if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1742                 kctl->tlv.c = snd_ctl_elem_user_tlv;
1743
1744         /* This function manage to free the instance on failure. */
1745         err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
1746         if (err < 0) {
1747                 snd_ctl_free_one(kctl);
1748                 return err;
1749         }
1750         offset = snd_ctl_get_ioff(kctl, &info->id);
1751         snd_ctl_build_ioff(&info->id, kctl, offset);
1752         /*
1753          * Here we cannot fill any field for the number of elements added by
1754          * this operation because there're no specific fields. The usage of
1755          * 'owner' field for this purpose may cause any bugs to userspace
1756          * applications because the field originally means PID of a process
1757          * which locks the element.
1758          */
1759         return 0;
1760 }
1761
1762 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1763                                  struct snd_ctl_elem_info __user *_info, int replace)
1764 {
1765         struct snd_ctl_elem_info info;
1766         int err;
1767
1768         if (copy_from_user(&info, _info, sizeof(info)))
1769                 return -EFAULT;
1770         err = snd_ctl_elem_add(file, &info, replace);
1771         if (err < 0)
1772                 return err;
1773         if (copy_to_user(_info, &info, sizeof(info))) {
1774                 snd_ctl_remove_user_ctl(file, &info.id);
1775                 return -EFAULT;
1776         }
1777
1778         return 0;
1779 }
1780
1781 static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1782                                struct snd_ctl_elem_id __user *_id)
1783 {
1784         struct snd_ctl_elem_id id;
1785
1786         if (copy_from_user(&id, _id, sizeof(id)))
1787                 return -EFAULT;
1788         return snd_ctl_remove_user_ctl(file, &id);
1789 }
1790
1791 static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1792 {
1793         int subscribe;
1794         if (get_user(subscribe, ptr))
1795                 return -EFAULT;
1796         if (subscribe < 0) {
1797                 subscribe = file->subscribed;
1798                 if (put_user(subscribe, ptr))
1799                         return -EFAULT;
1800                 return 0;
1801         }
1802         if (subscribe) {
1803                 file->subscribed = 1;
1804                 return 0;
1805         } else if (file->subscribed) {
1806                 snd_ctl_empty_read_queue(file);
1807                 file->subscribed = 0;
1808         }
1809         return 0;
1810 }
1811
1812 static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
1813                             struct snd_kcontrol *kctl,
1814                             struct snd_ctl_elem_id *id,
1815                             unsigned int __user *buf, unsigned int size)
1816 {
1817         static const struct {
1818                 int op;
1819                 int perm;
1820         } pairs[] = {
1821                 {SNDRV_CTL_TLV_OP_READ,  SNDRV_CTL_ELEM_ACCESS_TLV_READ},
1822                 {SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
1823                 {SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
1824         };
1825         struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1826         int i, ret;
1827
1828         /* Check support of the request for this element. */
1829         for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
1830                 if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
1831                         break;
1832         }
1833         if (i == ARRAY_SIZE(pairs))
1834                 return -ENXIO;
1835
1836         if (kctl->tlv.c == NULL)
1837                 return -ENXIO;
1838
1839         /* Write and command operations are not allowed for locked element. */
1840         if (op_flag != SNDRV_CTL_TLV_OP_READ &&
1841             vd->owner != NULL && vd->owner != file)
1842                 return -EPERM;
1843
1844         ret = snd_power_ref_and_wait(file->card);
1845         if (!ret)
1846                 ret = kctl->tlv.c(kctl, op_flag, size, buf);
1847         snd_power_unref(file->card);
1848         return ret;
1849 }
1850
1851 static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
1852                         unsigned int __user *buf, unsigned int size)
1853 {
1854         struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1855         unsigned int len;
1856
1857         if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
1858                 return -ENXIO;
1859
1860         if (kctl->tlv.p == NULL)
1861                 return -ENXIO;
1862
1863         len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
1864         if (size < len)
1865                 return -ENOMEM;
1866
1867         if (copy_to_user(buf, kctl->tlv.p, len))
1868                 return -EFAULT;
1869
1870         return 0;
1871 }
1872
1873 static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1874                              struct snd_ctl_tlv __user *buf,
1875                              int op_flag)
1876 {
1877         struct snd_ctl_tlv header;
1878         unsigned int __user *container;
1879         unsigned int container_size;
1880         struct snd_kcontrol *kctl;
1881         struct snd_ctl_elem_id id;
1882         struct snd_kcontrol_volatile *vd;
1883
1884         lockdep_assert_held(&file->card->controls_rwsem);
1885
1886         if (copy_from_user(&header, buf, sizeof(header)))
1887                 return -EFAULT;
1888
1889         /* In design of control core, numerical ID starts at 1. */
1890         if (header.numid == 0)
1891                 return -EINVAL;
1892
1893         /* At least, container should include type and length fields.  */
1894         if (header.length < sizeof(unsigned int) * 2)
1895                 return -EINVAL;
1896         container_size = header.length;
1897         container = buf->tlv;
1898
1899         kctl = snd_ctl_find_numid_locked(file->card, header.numid);
1900         if (kctl == NULL)
1901                 return -ENOENT;
1902
1903         /* Calculate index of the element in this set. */
1904         id = kctl->id;
1905         snd_ctl_build_ioff(&id, kctl, header.numid - id.numid);
1906         vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1907
1908         if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1909                 return call_tlv_handler(file, op_flag, kctl, &id, container,
1910                                         container_size);
1911         } else {
1912                 if (op_flag == SNDRV_CTL_TLV_OP_READ) {
1913                         return read_tlv_buf(kctl, &id, container,
1914                                             container_size);
1915                 }
1916         }
1917
1918         /* Not supported. */
1919         return -ENXIO;
1920 }
1921
1922 static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1923 {
1924         struct snd_ctl_file *ctl;
1925         struct snd_card *card;
1926         struct snd_kctl_ioctl *p;
1927         void __user *argp = (void __user *)arg;
1928         int __user *ip = argp;
1929         int err;
1930
1931         ctl = file->private_data;
1932         card = ctl->card;
1933         if (snd_BUG_ON(!card))
1934                 return -ENXIO;
1935         switch (cmd) {
1936         case SNDRV_CTL_IOCTL_PVERSION:
1937                 return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1938         case SNDRV_CTL_IOCTL_CARD_INFO:
1939                 return snd_ctl_card_info(card, ctl, cmd, argp);
1940         case SNDRV_CTL_IOCTL_ELEM_LIST:
1941                 return snd_ctl_elem_list_user(card, argp);
1942         case SNDRV_CTL_IOCTL_ELEM_INFO:
1943                 return snd_ctl_elem_info_user(ctl, argp);
1944         case SNDRV_CTL_IOCTL_ELEM_READ:
1945                 return snd_ctl_elem_read_user(card, argp);
1946         case SNDRV_CTL_IOCTL_ELEM_WRITE:
1947                 return snd_ctl_elem_write_user(ctl, argp);
1948         case SNDRV_CTL_IOCTL_ELEM_LOCK:
1949                 return snd_ctl_elem_lock(ctl, argp);
1950         case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1951                 return snd_ctl_elem_unlock(ctl, argp);
1952         case SNDRV_CTL_IOCTL_ELEM_ADD:
1953                 return snd_ctl_elem_add_user(ctl, argp, 0);
1954         case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1955                 return snd_ctl_elem_add_user(ctl, argp, 1);
1956         case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1957                 return snd_ctl_elem_remove(ctl, argp);
1958         case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1959                 return snd_ctl_subscribe_events(ctl, ip);
1960         case SNDRV_CTL_IOCTL_TLV_READ:
1961                 scoped_guard(rwsem_read, &ctl->card->controls_rwsem)
1962                         err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
1963                 return err;
1964         case SNDRV_CTL_IOCTL_TLV_WRITE:
1965                 scoped_guard(rwsem_write, &ctl->card->controls_rwsem)
1966                         err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
1967                 return err;
1968         case SNDRV_CTL_IOCTL_TLV_COMMAND:
1969                 scoped_guard(rwsem_write, &ctl->card->controls_rwsem)
1970                         err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
1971                 return err;
1972         case SNDRV_CTL_IOCTL_POWER:
1973                 return -ENOPROTOOPT;
1974         case SNDRV_CTL_IOCTL_POWER_STATE:
1975                 return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1976         }
1977
1978         guard(rwsem_read)(&snd_ioctl_rwsem);
1979         list_for_each_entry(p, &snd_control_ioctls, list) {
1980                 err = p->fioctl(card, ctl, cmd, arg);
1981                 if (err != -ENOIOCTLCMD)
1982                         return err;
1983         }
1984         dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
1985         return -ENOTTY;
1986 }
1987
1988 static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1989                             size_t count, loff_t * offset)
1990 {
1991         struct snd_ctl_file *ctl;
1992         int err = 0;
1993         ssize_t result = 0;
1994
1995         ctl = file->private_data;
1996         if (snd_BUG_ON(!ctl || !ctl->card))
1997                 return -ENXIO;
1998         if (!ctl->subscribed)
1999                 return -EBADFD;
2000         if (count < sizeof(struct snd_ctl_event))
2001                 return -EINVAL;
2002         spin_lock_irq(&ctl->read_lock);
2003         while (count >= sizeof(struct snd_ctl_event)) {
2004                 struct snd_ctl_event ev;
2005                 struct snd_kctl_event *kev;
2006                 while (list_empty(&ctl->events)) {
2007                         wait_queue_entry_t wait;
2008                         if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
2009                                 err = -EAGAIN;
2010                                 goto __end_lock;
2011                         }
2012                         init_waitqueue_entry(&wait, current);
2013                         add_wait_queue(&ctl->change_sleep, &wait);
2014                         set_current_state(TASK_INTERRUPTIBLE);
2015                         spin_unlock_irq(&ctl->read_lock);
2016                         schedule();
2017                         remove_wait_queue(&ctl->change_sleep, &wait);
2018                         if (ctl->card->shutdown)
2019                                 return -ENODEV;
2020                         if (signal_pending(current))
2021                                 return -ERESTARTSYS;
2022                         spin_lock_irq(&ctl->read_lock);
2023                 }
2024                 kev = snd_kctl_event(ctl->events.next);
2025                 ev.type = SNDRV_CTL_EVENT_ELEM;
2026                 ev.data.elem.mask = kev->mask;
2027                 ev.data.elem.id = kev->id;
2028                 list_del(&kev->list);
2029                 spin_unlock_irq(&ctl->read_lock);
2030                 kfree(kev);
2031                 if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
2032                         err = -EFAULT;
2033                         goto __end;
2034                 }
2035                 spin_lock_irq(&ctl->read_lock);
2036                 buffer += sizeof(struct snd_ctl_event);
2037                 count -= sizeof(struct snd_ctl_event);
2038                 result += sizeof(struct snd_ctl_event);
2039         }
2040       __end_lock:
2041         spin_unlock_irq(&ctl->read_lock);
2042       __end:
2043         return result > 0 ? result : err;
2044 }
2045
2046 static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
2047 {
2048         __poll_t mask;
2049         struct snd_ctl_file *ctl;
2050
2051         ctl = file->private_data;
2052         if (!ctl->subscribed)
2053                 return 0;
2054         poll_wait(file, &ctl->change_sleep, wait);
2055
2056         mask = 0;
2057         if (!list_empty(&ctl->events))
2058                 mask |= EPOLLIN | EPOLLRDNORM;
2059
2060         return mask;
2061 }
2062
2063 /*
2064  * register the device-specific control-ioctls.
2065  * called from each device manager like pcm.c, hwdep.c, etc.
2066  */
2067 static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
2068 {
2069         struct snd_kctl_ioctl *pn;
2070
2071         pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
2072         if (pn == NULL)
2073                 return -ENOMEM;
2074         pn->fioctl = fcn;
2075         guard(rwsem_write)(&snd_ioctl_rwsem);
2076         list_add_tail(&pn->list, lists);
2077         return 0;
2078 }
2079
2080 /**
2081  * snd_ctl_register_ioctl - register the device-specific control-ioctls
2082  * @fcn: ioctl callback function
2083  *
2084  * called from each device manager like pcm.c, hwdep.c, etc.
2085  *
2086  * Return: zero if successful, or a negative error code
2087  */
2088 int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
2089 {
2090         return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
2091 }
2092 EXPORT_SYMBOL(snd_ctl_register_ioctl);
2093
2094 #ifdef CONFIG_COMPAT
2095 /**
2096  * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
2097  * control-ioctls
2098  * @fcn: ioctl callback function
2099  *
2100  * Return: zero if successful, or a negative error code
2101  */
2102 int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2103 {
2104         return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
2105 }
2106 EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
2107 #endif
2108
2109 /*
2110  * de-register the device-specific control-ioctls.
2111  */
2112 static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
2113                                      struct list_head *lists)
2114 {
2115         struct snd_kctl_ioctl *p;
2116
2117         if (snd_BUG_ON(!fcn))
2118                 return -EINVAL;
2119         guard(rwsem_write)(&snd_ioctl_rwsem);
2120         list_for_each_entry(p, lists, list) {
2121                 if (p->fioctl == fcn) {
2122                         list_del(&p->list);
2123                         kfree(p);
2124                         return 0;
2125                 }
2126         }
2127         snd_BUG();
2128         return -EINVAL;
2129 }
2130
2131 /**
2132  * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
2133  * @fcn: ioctl callback function to unregister
2134  *
2135  * Return: zero if successful, or a negative error code
2136  */
2137 int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
2138 {
2139         return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
2140 }
2141 EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
2142
2143 #ifdef CONFIG_COMPAT
2144 /**
2145  * snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
2146  * 32bit control-ioctls
2147  * @fcn: ioctl callback function to unregister
2148  *
2149  * Return: zero if successful, or a negative error code
2150  */
2151 int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2152 {
2153         return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
2154 }
2155 EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
2156 #endif
2157
2158 static int snd_ctl_fasync(int fd, struct file * file, int on)
2159 {
2160         struct snd_ctl_file *ctl;
2161
2162         ctl = file->private_data;
2163         return snd_fasync_helper(fd, file, on, &ctl->fasync);
2164 }
2165
2166 /* return the preferred subdevice number if already assigned;
2167  * otherwise return -1
2168  */
2169 int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
2170 {
2171         struct snd_ctl_file *kctl;
2172         int subdevice = -1;
2173
2174         guard(read_lock_irqsave)(&card->ctl_files_rwlock);
2175         list_for_each_entry(kctl, &card->ctl_files, list) {
2176                 if (kctl->pid == task_pid(current)) {
2177                         subdevice = kctl->preferred_subdevice[type];
2178                         if (subdevice != -1)
2179                                 break;
2180                 }
2181         }
2182         return subdevice;
2183 }
2184 EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
2185
2186 /*
2187  * ioctl32 compat
2188  */
2189 #ifdef CONFIG_COMPAT
2190 #include "control_compat.c"
2191 #else
2192 #define snd_ctl_ioctl_compat    NULL
2193 #endif
2194
2195 /*
2196  * control layers (audio LED etc.)
2197  */
2198
2199 /**
2200  * snd_ctl_request_layer - request to use the layer
2201  * @module_name: Name of the kernel module (NULL == build-in)
2202  *
2203  * Return: zero if successful, or an error code when the module cannot be loaded
2204  */
2205 int snd_ctl_request_layer(const char *module_name)
2206 {
2207         struct snd_ctl_layer_ops *lops;
2208
2209         if (module_name == NULL)
2210                 return 0;
2211         scoped_guard(rwsem_read, &snd_ctl_layer_rwsem) {
2212                 for (lops = snd_ctl_layer; lops; lops = lops->next)
2213                         if (strcmp(lops->module_name, module_name) == 0)
2214                                 return 0;
2215         }
2216         return request_module(module_name);
2217 }
2218 EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
2219
2220 /**
2221  * snd_ctl_register_layer - register new control layer
2222  * @lops: operation structure
2223  *
2224  * The new layer can track all control elements and do additional
2225  * operations on top (like audio LED handling).
2226  */
2227 void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
2228 {
2229         struct snd_card *card;
2230         int card_number;
2231
2232         scoped_guard(rwsem_write, &snd_ctl_layer_rwsem) {
2233                 lops->next = snd_ctl_layer;
2234                 snd_ctl_layer = lops;
2235         }
2236         for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
2237                 card = snd_card_ref(card_number);
2238                 if (card) {
2239                         scoped_guard(rwsem_read, &card->controls_rwsem)
2240                                 lops->lregister(card);
2241                         snd_card_unref(card);
2242                 }
2243         }
2244 }
2245 EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
2246
2247 /**
2248  * snd_ctl_disconnect_layer - disconnect control layer
2249  * @lops: operation structure
2250  *
2251  * It is expected that the information about tracked cards
2252  * is freed before this call (the disconnect callback is
2253  * not called here).
2254  */
2255 void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
2256 {
2257         struct snd_ctl_layer_ops *lops2, *prev_lops2;
2258
2259         guard(rwsem_write)(&snd_ctl_layer_rwsem);
2260         for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
2261                 if (lops2 == lops) {
2262                         if (!prev_lops2)
2263                                 snd_ctl_layer = lops->next;
2264                         else
2265                                 prev_lops2->next = lops->next;
2266                         break;
2267                 }
2268                 prev_lops2 = lops2;
2269         }
2270 }
2271 EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
2272
2273 /*
2274  *  INIT PART
2275  */
2276
2277 static const struct file_operations snd_ctl_f_ops =
2278 {
2279         .owner =        THIS_MODULE,
2280         .read =         snd_ctl_read,
2281         .open =         snd_ctl_open,
2282         .release =      snd_ctl_release,
2283         .llseek =       no_llseek,
2284         .poll =         snd_ctl_poll,
2285         .unlocked_ioctl =       snd_ctl_ioctl,
2286         .compat_ioctl = snd_ctl_ioctl_compat,
2287         .fasync =       snd_ctl_fasync,
2288 };
2289
2290 /* call lops under rwsems; called from snd_ctl_dev_*() below() */
2291 #define call_snd_ctl_lops(_card, _op)                               \
2292         do {                                                        \
2293                 struct snd_ctl_layer_ops *lops;                     \
2294                 guard(rwsem_read)(&(_card)->controls_rwsem);        \
2295                 guard(rwsem_read)(&snd_ctl_layer_rwsem);            \
2296                 for (lops = snd_ctl_layer; lops; lops = lops->next) \
2297                         lops->_op(_card);                           \
2298         } while (0)
2299
2300 /*
2301  * registration of the control device
2302  */
2303 static int snd_ctl_dev_register(struct snd_device *device)
2304 {
2305         struct snd_card *card = device->device_data;
2306         int err;
2307
2308         err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
2309                                   &snd_ctl_f_ops, card, card->ctl_dev);
2310         if (err < 0)
2311                 return err;
2312         call_snd_ctl_lops(card, lregister);
2313         return 0;
2314 }
2315
2316 /*
2317  * disconnection of the control device
2318  */
2319 static int snd_ctl_dev_disconnect(struct snd_device *device)
2320 {
2321         struct snd_card *card = device->device_data;
2322         struct snd_ctl_file *ctl;
2323
2324         scoped_guard(read_lock_irqsave, &card->ctl_files_rwlock) {
2325                 list_for_each_entry(ctl, &card->ctl_files, list) {
2326                         wake_up(&ctl->change_sleep);
2327                         snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
2328                 }
2329         }
2330
2331         call_snd_ctl_lops(card, ldisconnect);
2332         return snd_unregister_device(card->ctl_dev);
2333 }
2334
2335 /*
2336  * free all controls
2337  */
2338 static int snd_ctl_dev_free(struct snd_device *device)
2339 {
2340         struct snd_card *card = device->device_data;
2341         struct snd_kcontrol *control;
2342
2343         scoped_guard(rwsem_write, &card->controls_rwsem) {
2344                 while (!list_empty(&card->controls)) {
2345                         control = snd_kcontrol(card->controls.next);
2346                         __snd_ctl_remove(card, control, false);
2347                 }
2348
2349 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
2350                 xa_destroy(&card->ctl_numids);
2351                 xa_destroy(&card->ctl_hash);
2352 #endif
2353         }
2354         put_device(card->ctl_dev);
2355         return 0;
2356 }
2357
2358 /*
2359  * create control core:
2360  * called from init.c
2361  */
2362 int snd_ctl_create(struct snd_card *card)
2363 {
2364         static const struct snd_device_ops ops = {
2365                 .dev_free = snd_ctl_dev_free,
2366                 .dev_register = snd_ctl_dev_register,
2367                 .dev_disconnect = snd_ctl_dev_disconnect,
2368         };
2369         int err;
2370
2371         if (snd_BUG_ON(!card))
2372                 return -ENXIO;
2373         if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
2374                 return -ENXIO;
2375
2376         err = snd_device_alloc(&card->ctl_dev, card);
2377         if (err < 0)
2378                 return err;
2379         dev_set_name(card->ctl_dev, "controlC%d", card->number);
2380
2381         err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
2382         if (err < 0)
2383                 put_device(card->ctl_dev);
2384         return err;
2385 }
2386
2387 /*
2388  * Frequently used control callbacks/helpers
2389  */
2390
2391 /**
2392  * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
2393  * callback with a mono channel
2394  * @kcontrol: the kcontrol instance
2395  * @uinfo: info to store
2396  *
2397  * This is a function that can be used as info callback for a standard
2398  * boolean control with a single mono channel.
2399  *
2400  * Return: Zero (always successful)
2401  */
2402 int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
2403                               struct snd_ctl_elem_info *uinfo)
2404 {
2405         uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2406         uinfo->count = 1;
2407         uinfo->value.integer.min = 0;
2408         uinfo->value.integer.max = 1;
2409         return 0;
2410 }
2411 EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
2412
2413 /**
2414  * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
2415  * callback with stereo two channels
2416  * @kcontrol: the kcontrol instance
2417  * @uinfo: info to store
2418  *
2419  * This is a function that can be used as info callback for a standard
2420  * boolean control with stereo two channels.
2421  *
2422  * Return: Zero (always successful)
2423  */
2424 int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
2425                                 struct snd_ctl_elem_info *uinfo)
2426 {
2427         uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2428         uinfo->count = 2;
2429         uinfo->value.integer.min = 0;
2430         uinfo->value.integer.max = 1;
2431         return 0;
2432 }
2433 EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
2434
2435 /**
2436  * snd_ctl_enum_info - fills the info structure for an enumerated control
2437  * @info: the structure to be filled
2438  * @channels: the number of the control's channels; often one
2439  * @items: the number of control values; also the size of @names
2440  * @names: an array containing the names of all control values
2441  *
2442  * Sets all required fields in @info to their appropriate values.
2443  * If the control's accessibility is not the default (readable and writable),
2444  * the caller has to fill @info->access.
2445  *
2446  * Return: Zero (always successful)
2447  */
2448 int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
2449                       unsigned int items, const char *const names[])
2450 {
2451         info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
2452         info->count = channels;
2453         info->value.enumerated.items = items;
2454         if (!items)
2455                 return 0;
2456         if (info->value.enumerated.item >= items)
2457                 info->value.enumerated.item = items - 1;
2458         WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
2459              "ALSA: too long item name '%s'\n",
2460              names[info->value.enumerated.item]);
2461         strscpy(info->value.enumerated.name,
2462                 names[info->value.enumerated.item],
2463                 sizeof(info->value.enumerated.name));
2464         return 0;
2465 }
2466 EXPORT_SYMBOL(snd_ctl_enum_info);