GNU Linux-libre 4.9.337-gnu1
[releases.git] / sound / core / control.c
1 /*
2  *  Routines for driver control interface
3  *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
4  *
5  *
6  *   This program is free software; you can redistribute it and/or modify
7  *   it under the terms of the GNU General Public License as published by
8  *   the Free Software Foundation; either version 2 of the License, or
9  *   (at your option) any later version.
10  *
11  *   This program is distributed in the hope that it will be useful,
12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *   GNU General Public License for more details.
15  *
16  *   You should have received a copy of the GNU General Public License
17  *   along with this program; if not, write to the Free Software
18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
19  *
20  */
21
22 #include <linux/threads.h>
23 #include <linux/interrupt.h>
24 #include <linux/module.h>
25 #include <linux/slab.h>
26 #include <linux/vmalloc.h>
27 #include <linux/time.h>
28 #include <sound/core.h>
29 #include <sound/minors.h>
30 #include <sound/info.h>
31 #include <sound/control.h>
32
33 /* max number of user-defined controls */
34 #define MAX_USER_CONTROLS       32
35 #define MAX_CONTROL_COUNT       1028
36
37 struct snd_kctl_ioctl {
38         struct list_head list;          /* list of all ioctls */
39         snd_kctl_ioctl_func_t fioctl;
40 };
41
42 static DECLARE_RWSEM(snd_ioctl_rwsem);
43 static LIST_HEAD(snd_control_ioctls);
44 #ifdef CONFIG_COMPAT
45 static LIST_HEAD(snd_control_compat_ioctls);
46 #endif
47
48 static int snd_ctl_open(struct inode *inode, struct file *file)
49 {
50         unsigned long flags;
51         struct snd_card *card;
52         struct snd_ctl_file *ctl;
53         int i, err;
54
55         err = nonseekable_open(inode, file);
56         if (err < 0)
57                 return err;
58
59         card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
60         if (!card) {
61                 err = -ENODEV;
62                 goto __error1;
63         }
64         err = snd_card_file_add(card, file);
65         if (err < 0) {
66                 err = -ENODEV;
67                 goto __error1;
68         }
69         if (!try_module_get(card->module)) {
70                 err = -EFAULT;
71                 goto __error2;
72         }
73         ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
74         if (ctl == NULL) {
75                 err = -ENOMEM;
76                 goto __error;
77         }
78         INIT_LIST_HEAD(&ctl->events);
79         init_waitqueue_head(&ctl->change_sleep);
80         spin_lock_init(&ctl->read_lock);
81         ctl->card = card;
82         for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
83                 ctl->preferred_subdevice[i] = -1;
84         ctl->pid = get_pid(task_pid(current));
85         file->private_data = ctl;
86         write_lock_irqsave(&card->ctl_files_rwlock, flags);
87         list_add_tail(&ctl->list, &card->ctl_files);
88         write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
89         snd_card_unref(card);
90         return 0;
91
92       __error:
93         module_put(card->module);
94       __error2:
95         snd_card_file_remove(card, file);
96       __error1:
97         if (card)
98                 snd_card_unref(card);
99         return err;
100 }
101
102 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
103 {
104         unsigned long flags;
105         struct snd_kctl_event *cread;
106         
107         spin_lock_irqsave(&ctl->read_lock, flags);
108         while (!list_empty(&ctl->events)) {
109                 cread = snd_kctl_event(ctl->events.next);
110                 list_del(&cread->list);
111                 kfree(cread);
112         }
113         spin_unlock_irqrestore(&ctl->read_lock, flags);
114 }
115
116 static int snd_ctl_release(struct inode *inode, struct file *file)
117 {
118         unsigned long flags;
119         struct snd_card *card;
120         struct snd_ctl_file *ctl;
121         struct snd_kcontrol *control;
122         unsigned int idx;
123
124         ctl = file->private_data;
125         file->private_data = NULL;
126         card = ctl->card;
127         write_lock_irqsave(&card->ctl_files_rwlock, flags);
128         list_del(&ctl->list);
129         write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
130         down_write(&card->controls_rwsem);
131         list_for_each_entry(control, &card->controls, list)
132                 for (idx = 0; idx < control->count; idx++)
133                         if (control->vd[idx].owner == ctl)
134                                 control->vd[idx].owner = NULL;
135         up_write(&card->controls_rwsem);
136         snd_ctl_empty_read_queue(ctl);
137         put_pid(ctl->pid);
138         kfree(ctl);
139         module_put(card->module);
140         snd_card_file_remove(card, file);
141         return 0;
142 }
143
144 /**
145  * snd_ctl_notify - Send notification to user-space for a control change
146  * @card: the card to send notification
147  * @mask: the event mask, SNDRV_CTL_EVENT_*
148  * @id: the ctl element id to send notification
149  *
150  * This function adds an event record with the given id and mask, appends
151  * to the list and wakes up the user-space for notification.  This can be
152  * called in the atomic context.
153  */
154 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
155                     struct snd_ctl_elem_id *id)
156 {
157         unsigned long flags;
158         struct snd_ctl_file *ctl;
159         struct snd_kctl_event *ev;
160         
161         if (snd_BUG_ON(!card || !id))
162                 return;
163         if (card->shutdown)
164                 return;
165         read_lock(&card->ctl_files_rwlock);
166 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
167         card->mixer_oss_change_count++;
168 #endif
169         list_for_each_entry(ctl, &card->ctl_files, list) {
170                 if (!ctl->subscribed)
171                         continue;
172                 spin_lock_irqsave(&ctl->read_lock, flags);
173                 list_for_each_entry(ev, &ctl->events, list) {
174                         if (ev->id.numid == id->numid) {
175                                 ev->mask |= mask;
176                                 goto _found;
177                         }
178                 }
179                 ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
180                 if (ev) {
181                         ev->id = *id;
182                         ev->mask = mask;
183                         list_add_tail(&ev->list, &ctl->events);
184                 } else {
185                         dev_err(card->dev, "No memory available to allocate event\n");
186                 }
187         _found:
188                 wake_up(&ctl->change_sleep);
189                 spin_unlock_irqrestore(&ctl->read_lock, flags);
190                 kill_fasync(&ctl->fasync, SIGIO, POLL_IN);
191         }
192         read_unlock(&card->ctl_files_rwlock);
193 }
194 EXPORT_SYMBOL(snd_ctl_notify);
195
196 /**
197  * snd_ctl_new - create a new control instance with some elements
198  * @kctl: the pointer to store new control instance
199  * @count: the number of elements in this control
200  * @access: the default access flags for elements in this control
201  * @file: given when locking these elements
202  *
203  * Allocates a memory object for a new control instance. The instance has
204  * elements as many as the given number (@count). Each element has given
205  * access permissions (@access). Each element is locked when @file is given.
206  *
207  * Return: 0 on success, error code on failure
208  */
209 static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
210                        unsigned int access, struct snd_ctl_file *file)
211 {
212         unsigned int size;
213         unsigned int idx;
214         
215         if (count == 0 || count > MAX_CONTROL_COUNT)
216                 return -EINVAL;
217
218         size  = sizeof(struct snd_kcontrol);
219         size += sizeof(struct snd_kcontrol_volatile) * count;
220
221         *kctl = kzalloc(size, GFP_KERNEL);
222         if (!*kctl)
223                 return -ENOMEM;
224
225         for (idx = 0; idx < count; idx++) {
226                 (*kctl)->vd[idx].access = access;
227                 (*kctl)->vd[idx].owner = file;
228         }
229         (*kctl)->count = count;
230
231         return 0;
232 }
233
234 /**
235  * snd_ctl_new1 - create a control instance from the template
236  * @ncontrol: the initialization record
237  * @private_data: the private data to set
238  *
239  * Allocates a new struct snd_kcontrol instance and initialize from the given 
240  * template.  When the access field of ncontrol is 0, it's assumed as
241  * READWRITE access. When the count field is 0, it's assumes as one.
242  *
243  * Return: The pointer of the newly generated instance, or %NULL on failure.
244  */
245 struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
246                                   void *private_data)
247 {
248         struct snd_kcontrol *kctl;
249         unsigned int count;
250         unsigned int access;
251         int err;
252         
253         if (snd_BUG_ON(!ncontrol || !ncontrol->info))
254                 return NULL;
255
256         count = ncontrol->count;
257         if (count == 0)
258                 count = 1;
259
260         access = ncontrol->access;
261         if (access == 0)
262                 access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
263         access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
264                    SNDRV_CTL_ELEM_ACCESS_VOLATILE |
265                    SNDRV_CTL_ELEM_ACCESS_INACTIVE |
266                    SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
267                    SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
268                    SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK);
269
270         err = snd_ctl_new(&kctl, count, access, NULL);
271         if (err < 0)
272                 return NULL;
273
274         /* The 'numid' member is decided when calling snd_ctl_add(). */
275         kctl->id.iface = ncontrol->iface;
276         kctl->id.device = ncontrol->device;
277         kctl->id.subdevice = ncontrol->subdevice;
278         if (ncontrol->name) {
279                 strlcpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
280                 if (strcmp(ncontrol->name, kctl->id.name) != 0)
281                         pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
282                                 ncontrol->name, kctl->id.name);
283         }
284         kctl->id.index = ncontrol->index;
285
286         kctl->info = ncontrol->info;
287         kctl->get = ncontrol->get;
288         kctl->put = ncontrol->put;
289         kctl->tlv.p = ncontrol->tlv.p;
290
291         kctl->private_value = ncontrol->private_value;
292         kctl->private_data = private_data;
293
294         return kctl;
295 }
296 EXPORT_SYMBOL(snd_ctl_new1);
297
298 /**
299  * snd_ctl_free_one - release the control instance
300  * @kcontrol: the control instance
301  *
302  * Releases the control instance created via snd_ctl_new()
303  * or snd_ctl_new1().
304  * Don't call this after the control was added to the card.
305  */
306 void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
307 {
308         if (kcontrol) {
309                 if (kcontrol->private_free)
310                         kcontrol->private_free(kcontrol);
311                 kfree(kcontrol);
312         }
313 }
314 EXPORT_SYMBOL(snd_ctl_free_one);
315
316 static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
317                                           unsigned int count)
318 {
319         struct snd_kcontrol *kctl;
320
321         /* Make sure that the ids assigned to the control do not wrap around */
322         if (card->last_numid >= UINT_MAX - count)
323                 card->last_numid = 0;
324
325         list_for_each_entry(kctl, &card->controls, list) {
326                 if (kctl->id.numid < card->last_numid + 1 + count &&
327                     kctl->id.numid + kctl->count > card->last_numid + 1) {
328                         card->last_numid = kctl->id.numid + kctl->count - 1;
329                         return true;
330                 }
331         }
332         return false;
333 }
334
335 static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
336 {
337         unsigned int iter = 100000;
338
339         while (snd_ctl_remove_numid_conflict(card, count)) {
340                 if (--iter == 0) {
341                         /* this situation is very unlikely */
342                         dev_err(card->dev, "unable to allocate new control numid\n");
343                         return -ENOMEM;
344                 }
345         }
346         return 0;
347 }
348
349 /* add a new kcontrol object; call with card->controls_rwsem locked */
350 static int __snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
351 {
352         struct snd_ctl_elem_id id;
353         unsigned int idx;
354         unsigned int count;
355
356         id = kcontrol->id;
357         if (id.index > UINT_MAX - kcontrol->count)
358                 return -EINVAL;
359
360         if (snd_ctl_find_id(card, &id)) {
361                 dev_err(card->dev,
362                         "control %i:%i:%i:%s:%i is already present\n",
363                         id.iface, id.device, id.subdevice, id.name, id.index);
364                 return -EBUSY;
365         }
366
367         if (snd_ctl_find_hole(card, kcontrol->count) < 0)
368                 return -ENOMEM;
369
370         list_add_tail(&kcontrol->list, &card->controls);
371         card->controls_count += kcontrol->count;
372         kcontrol->id.numid = card->last_numid + 1;
373         card->last_numid += kcontrol->count;
374
375         id = kcontrol->id;
376         count = kcontrol->count;
377         for (idx = 0; idx < count; idx++, id.index++, id.numid++)
378                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
379
380         return 0;
381 }
382
383 /**
384  * snd_ctl_add - add the control instance to the card
385  * @card: the card instance
386  * @kcontrol: the control instance to add
387  *
388  * Adds the control instance created via snd_ctl_new() or
389  * snd_ctl_new1() to the given card. Assigns also an unique
390  * numid used for fast search.
391  *
392  * It frees automatically the control which cannot be added.
393  *
394  * Return: Zero if successful, or a negative error code on failure.
395  *
396  */
397 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
398 {
399         int err = -EINVAL;
400
401         if (! kcontrol)
402                 return err;
403         if (snd_BUG_ON(!card || !kcontrol->info))
404                 goto error;
405
406         down_write(&card->controls_rwsem);
407         err = __snd_ctl_add(card, kcontrol);
408         up_write(&card->controls_rwsem);
409         if (err < 0)
410                 goto error;
411         return 0;
412
413  error:
414         snd_ctl_free_one(kcontrol);
415         return err;
416 }
417 EXPORT_SYMBOL(snd_ctl_add);
418
419 /**
420  * snd_ctl_replace - replace the control instance of the card
421  * @card: the card instance
422  * @kcontrol: the control instance to replace
423  * @add_on_replace: add the control if not already added
424  *
425  * Replaces the given control.  If the given control does not exist
426  * and the add_on_replace flag is set, the control is added.  If the
427  * control exists, it is destroyed first.
428  *
429  * It frees automatically the control which cannot be added or replaced.
430  *
431  * Return: Zero if successful, or a negative error code on failure.
432  */
433 int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
434                     bool add_on_replace)
435 {
436         struct snd_ctl_elem_id id;
437         unsigned int count;
438         unsigned int idx;
439         struct snd_kcontrol *old;
440         int ret;
441
442         if (!kcontrol)
443                 return -EINVAL;
444         if (snd_BUG_ON(!card || !kcontrol->info)) {
445                 ret = -EINVAL;
446                 goto error;
447         }
448         id = kcontrol->id;
449         down_write(&card->controls_rwsem);
450         old = snd_ctl_find_id(card, &id);
451         if (!old) {
452                 if (add_on_replace)
453                         goto add;
454                 up_write(&card->controls_rwsem);
455                 ret = -EINVAL;
456                 goto error;
457         }
458         ret = snd_ctl_remove(card, old);
459         if (ret < 0) {
460                 up_write(&card->controls_rwsem);
461                 goto error;
462         }
463 add:
464         if (snd_ctl_find_hole(card, kcontrol->count) < 0) {
465                 up_write(&card->controls_rwsem);
466                 ret = -ENOMEM;
467                 goto error;
468         }
469         list_add_tail(&kcontrol->list, &card->controls);
470         card->controls_count += kcontrol->count;
471         kcontrol->id.numid = card->last_numid + 1;
472         card->last_numid += kcontrol->count;
473         id = kcontrol->id;
474         count = kcontrol->count;
475         up_write(&card->controls_rwsem);
476         for (idx = 0; idx < count; idx++, id.index++, id.numid++)
477                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
478         return 0;
479
480 error:
481         snd_ctl_free_one(kcontrol);
482         return ret;
483 }
484 EXPORT_SYMBOL(snd_ctl_replace);
485
486 /**
487  * snd_ctl_remove - remove the control from the card and release it
488  * @card: the card instance
489  * @kcontrol: the control instance to remove
490  *
491  * Removes the control from the card and then releases the instance.
492  * You don't need to call snd_ctl_free_one(). You must be in
493  * the write lock - down_write(&card->controls_rwsem).
494  *
495  * Return: 0 if successful, or a negative error code on failure.
496  */
497 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
498 {
499         struct snd_ctl_elem_id id;
500         unsigned int idx;
501
502         if (snd_BUG_ON(!card || !kcontrol))
503                 return -EINVAL;
504         list_del(&kcontrol->list);
505         card->controls_count -= kcontrol->count;
506         id = kcontrol->id;
507         for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
508                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_REMOVE, &id);
509         snd_ctl_free_one(kcontrol);
510         return 0;
511 }
512 EXPORT_SYMBOL(snd_ctl_remove);
513
514 /**
515  * snd_ctl_remove_id - remove the control of the given id and release it
516  * @card: the card instance
517  * @id: the control id to remove
518  *
519  * Finds the control instance with the given id, removes it from the
520  * card list and releases it.
521  *
522  * Return: 0 if successful, or a negative error code on failure.
523  */
524 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
525 {
526         struct snd_kcontrol *kctl;
527         int ret;
528
529         down_write(&card->controls_rwsem);
530         kctl = snd_ctl_find_id(card, id);
531         if (kctl == NULL) {
532                 up_write(&card->controls_rwsem);
533                 return -ENOENT;
534         }
535         ret = snd_ctl_remove(card, kctl);
536         up_write(&card->controls_rwsem);
537         return ret;
538 }
539 EXPORT_SYMBOL(snd_ctl_remove_id);
540
541 /**
542  * snd_ctl_remove_user_ctl - remove and release the unlocked user control
543  * @file: active control handle
544  * @id: the control id to remove
545  *
546  * Finds the control instance with the given id, removes it from the
547  * card list and releases it.
548  *
549  * Return: 0 if successful, or a negative error code on failure.
550  */
551 static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
552                                    struct snd_ctl_elem_id *id)
553 {
554         struct snd_card *card = file->card;
555         struct snd_kcontrol *kctl;
556         int idx, ret;
557
558         down_write(&card->controls_rwsem);
559         kctl = snd_ctl_find_id(card, id);
560         if (kctl == NULL) {
561                 ret = -ENOENT;
562                 goto error;
563         }
564         if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
565                 ret = -EINVAL;
566                 goto error;
567         }
568         for (idx = 0; idx < kctl->count; idx++)
569                 if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
570                         ret = -EBUSY;
571                         goto error;
572                 }
573         ret = snd_ctl_remove(card, kctl);
574         if (ret < 0)
575                 goto error;
576         card->user_ctl_count--;
577 error:
578         up_write(&card->controls_rwsem);
579         return ret;
580 }
581
582 /**
583  * snd_ctl_activate_id - activate/inactivate the control of the given id
584  * @card: the card instance
585  * @id: the control id to activate/inactivate
586  * @active: non-zero to activate
587  *
588  * Finds the control instance with the given id, and activate or
589  * inactivate the control together with notification, if changed.
590  * The given ID data is filled with full information.
591  *
592  * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
593  */
594 int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
595                         int active)
596 {
597         struct snd_kcontrol *kctl;
598         struct snd_kcontrol_volatile *vd;
599         unsigned int index_offset;
600         int ret;
601
602         down_write(&card->controls_rwsem);
603         kctl = snd_ctl_find_id(card, id);
604         if (kctl == NULL) {
605                 ret = -ENOENT;
606                 goto unlock;
607         }
608         index_offset = snd_ctl_get_ioff(kctl, id);
609         vd = &kctl->vd[index_offset];
610         ret = 0;
611         if (active) {
612                 if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
613                         goto unlock;
614                 vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
615         } else {
616                 if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
617                         goto unlock;
618                 vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
619         }
620         snd_ctl_build_ioff(id, kctl, index_offset);
621         ret = 1;
622  unlock:
623         up_write(&card->controls_rwsem);
624         if (ret > 0)
625                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_INFO, id);
626         return ret;
627 }
628 EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
629
630 /**
631  * snd_ctl_rename_id - replace the id of a control on the card
632  * @card: the card instance
633  * @src_id: the old id
634  * @dst_id: the new id
635  *
636  * Finds the control with the old id from the card, and replaces the
637  * id with the new one.
638  *
639  * Return: Zero if successful, or a negative error code on failure.
640  */
641 int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
642                       struct snd_ctl_elem_id *dst_id)
643 {
644         struct snd_kcontrol *kctl;
645
646         down_write(&card->controls_rwsem);
647         kctl = snd_ctl_find_id(card, src_id);
648         if (kctl == NULL) {
649                 up_write(&card->controls_rwsem);
650                 return -ENOENT;
651         }
652         kctl->id = *dst_id;
653         kctl->id.numid = card->last_numid + 1;
654         card->last_numid += kctl->count;
655         up_write(&card->controls_rwsem);
656         return 0;
657 }
658 EXPORT_SYMBOL(snd_ctl_rename_id);
659
660 /**
661  * snd_ctl_find_numid - find the control instance with the given number-id
662  * @card: the card instance
663  * @numid: the number-id to search
664  *
665  * Finds the control instance with the given number-id from the card.
666  *
667  * The caller must down card->controls_rwsem before calling this function
668  * (if the race condition can happen).
669  *
670  * Return: The pointer of the instance if found, or %NULL if not.
671  *
672  */
673 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card, unsigned int numid)
674 {
675         struct snd_kcontrol *kctl;
676
677         if (snd_BUG_ON(!card || !numid))
678                 return NULL;
679         list_for_each_entry(kctl, &card->controls, list) {
680                 if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
681                         return kctl;
682         }
683         return NULL;
684 }
685 EXPORT_SYMBOL(snd_ctl_find_numid);
686
687 /**
688  * snd_ctl_find_id - find the control instance with the given id
689  * @card: the card instance
690  * @id: the id to search
691  *
692  * Finds the control instance with the given id from the card.
693  *
694  * The caller must down card->controls_rwsem before calling this function
695  * (if the race condition can happen).
696  *
697  * Return: The pointer of the instance if found, or %NULL if not.
698  *
699  */
700 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
701                                      struct snd_ctl_elem_id *id)
702 {
703         struct snd_kcontrol *kctl;
704
705         if (snd_BUG_ON(!card || !id))
706                 return NULL;
707         if (id->numid != 0)
708                 return snd_ctl_find_numid(card, id->numid);
709         list_for_each_entry(kctl, &card->controls, list) {
710                 if (kctl->id.iface != id->iface)
711                         continue;
712                 if (kctl->id.device != id->device)
713                         continue;
714                 if (kctl->id.subdevice != id->subdevice)
715                         continue;
716                 if (strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)))
717                         continue;
718                 if (kctl->id.index > id->index)
719                         continue;
720                 if (kctl->id.index + kctl->count <= id->index)
721                         continue;
722                 return kctl;
723         }
724         return NULL;
725 }
726 EXPORT_SYMBOL(snd_ctl_find_id);
727
728 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
729                              unsigned int cmd, void __user *arg)
730 {
731         struct snd_ctl_card_info *info;
732
733         info = kzalloc(sizeof(*info), GFP_KERNEL);
734         if (! info)
735                 return -ENOMEM;
736         down_read(&snd_ioctl_rwsem);
737         info->card = card->number;
738         strlcpy(info->id, card->id, sizeof(info->id));
739         strlcpy(info->driver, card->driver, sizeof(info->driver));
740         strlcpy(info->name, card->shortname, sizeof(info->name));
741         strlcpy(info->longname, card->longname, sizeof(info->longname));
742         strlcpy(info->mixername, card->mixername, sizeof(info->mixername));
743         strlcpy(info->components, card->components, sizeof(info->components));
744         up_read(&snd_ioctl_rwsem);
745         if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
746                 kfree(info);
747                 return -EFAULT;
748         }
749         kfree(info);
750         return 0;
751 }
752
753 static int snd_ctl_elem_list(struct snd_card *card,
754                              struct snd_ctl_elem_list __user *_list)
755 {
756         struct list_head *plist;
757         struct snd_ctl_elem_list list;
758         struct snd_kcontrol *kctl;
759         struct snd_ctl_elem_id *dst, *id;
760         unsigned int offset, space, jidx;
761         
762         if (copy_from_user(&list, _list, sizeof(list)))
763                 return -EFAULT;
764         offset = list.offset;
765         space = list.space;
766         /* try limit maximum space */
767         if (space > 16384)
768                 return -ENOMEM;
769         if (space > 0) {
770                 /* allocate temporary buffer for atomic operation */
771                 dst = vmalloc(space * sizeof(struct snd_ctl_elem_id));
772                 if (dst == NULL)
773                         return -ENOMEM;
774                 down_read(&card->controls_rwsem);
775                 list.count = card->controls_count;
776                 plist = card->controls.next;
777                 while (plist != &card->controls) {
778                         if (offset == 0)
779                                 break;
780                         kctl = snd_kcontrol(plist);
781                         if (offset < kctl->count)
782                                 break;
783                         offset -= kctl->count;
784                         plist = plist->next;
785                 }
786                 list.used = 0;
787                 id = dst;
788                 while (space > 0 && plist != &card->controls) {
789                         kctl = snd_kcontrol(plist);
790                         for (jidx = offset; space > 0 && jidx < kctl->count; jidx++) {
791                                 snd_ctl_build_ioff(id, kctl, jidx);
792                                 id++;
793                                 space--;
794                                 list.used++;
795                         }
796                         plist = plist->next;
797                         offset = 0;
798                 }
799                 up_read(&card->controls_rwsem);
800                 if (list.used > 0 &&
801                     copy_to_user(list.pids, dst,
802                                  list.used * sizeof(struct snd_ctl_elem_id))) {
803                         vfree(dst);
804                         return -EFAULT;
805                 }
806                 vfree(dst);
807         } else {
808                 down_read(&card->controls_rwsem);
809                 list.count = card->controls_count;
810                 up_read(&card->controls_rwsem);
811         }
812         if (copy_to_user(_list, &list, sizeof(list)))
813                 return -EFAULT;
814         return 0;
815 }
816
817 static bool validate_element_member_dimension(struct snd_ctl_elem_info *info)
818 {
819         unsigned int members;
820         unsigned int i;
821
822         if (info->dimen.d[0] == 0)
823                 return true;
824
825         members = 1;
826         for (i = 0; i < ARRAY_SIZE(info->dimen.d); ++i) {
827                 if (info->dimen.d[i] == 0)
828                         break;
829                 members *= info->dimen.d[i];
830
831                 /*
832                  * info->count should be validated in advance, to guarantee
833                  * calculation soundness.
834                  */
835                 if (members > info->count)
836                         return false;
837         }
838
839         for (++i; i < ARRAY_SIZE(info->dimen.d); ++i) {
840                 if (info->dimen.d[i] > 0)
841                         return false;
842         }
843
844         return members == info->count;
845 }
846
847 static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
848                              struct snd_ctl_elem_info *info)
849 {
850         struct snd_card *card = ctl->card;
851         struct snd_kcontrol *kctl;
852         struct snd_kcontrol_volatile *vd;
853         unsigned int index_offset;
854         int result;
855         
856         down_read(&card->controls_rwsem);
857         kctl = snd_ctl_find_id(card, &info->id);
858         if (kctl == NULL) {
859                 up_read(&card->controls_rwsem);
860                 return -ENOENT;
861         }
862 #ifdef CONFIG_SND_DEBUG
863         info->access = 0;
864 #endif
865         result = kctl->info(kctl, info);
866         if (result >= 0) {
867                 snd_BUG_ON(info->access);
868                 index_offset = snd_ctl_get_ioff(kctl, &info->id);
869                 vd = &kctl->vd[index_offset];
870                 snd_ctl_build_ioff(&info->id, kctl, index_offset);
871                 info->access = vd->access;
872                 if (vd->owner) {
873                         info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
874                         if (vd->owner == ctl)
875                                 info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
876                         info->owner = pid_vnr(vd->owner->pid);
877                 } else {
878                         info->owner = -1;
879                 }
880         }
881         up_read(&card->controls_rwsem);
882         return result;
883 }
884
885 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
886                                   struct snd_ctl_elem_info __user *_info)
887 {
888         struct snd_ctl_elem_info info;
889         int result;
890
891         if (copy_from_user(&info, _info, sizeof(info)))
892                 return -EFAULT;
893         snd_power_lock(ctl->card);
894         result = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0);
895         if (result >= 0)
896                 result = snd_ctl_elem_info(ctl, &info);
897         snd_power_unlock(ctl->card);
898         if (result >= 0)
899                 if (copy_to_user(_info, &info, sizeof(info)))
900                         return -EFAULT;
901         return result;
902 }
903
904 static int snd_ctl_elem_read(struct snd_card *card,
905                              struct snd_ctl_elem_value *control)
906 {
907         struct snd_kcontrol *kctl;
908         struct snd_kcontrol_volatile *vd;
909         unsigned int index_offset;
910         int result;
911
912         down_read(&card->controls_rwsem);
913         kctl = snd_ctl_find_id(card, &control->id);
914         if (kctl == NULL) {
915                 result = -ENOENT;
916         } else {
917                 index_offset = snd_ctl_get_ioff(kctl, &control->id);
918                 vd = &kctl->vd[index_offset];
919                 if ((vd->access & SNDRV_CTL_ELEM_ACCESS_READ) &&
920                     kctl->get != NULL) {
921                         snd_ctl_build_ioff(&control->id, kctl, index_offset);
922                         result = kctl->get(kctl, control);
923                 } else
924                         result = -EPERM;
925         }
926         up_read(&card->controls_rwsem);
927         return result;
928 }
929
930 static int snd_ctl_elem_read_user(struct snd_card *card,
931                                   struct snd_ctl_elem_value __user *_control)
932 {
933         struct snd_ctl_elem_value *control;
934         int result;
935
936         control = memdup_user(_control, sizeof(*control));
937         if (IS_ERR(control))
938                 return PTR_ERR(control);
939
940         snd_power_lock(card);
941         result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
942         if (result >= 0)
943                 result = snd_ctl_elem_read(card, control);
944         snd_power_unlock(card);
945         if (result >= 0)
946                 if (copy_to_user(_control, control, sizeof(*control)))
947                         result = -EFAULT;
948         kfree(control);
949         return result;
950 }
951
952 static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
953                               struct snd_ctl_elem_value *control)
954 {
955         struct snd_kcontrol *kctl;
956         struct snd_kcontrol_volatile *vd;
957         unsigned int index_offset;
958         int result;
959
960         down_read(&card->controls_rwsem);
961         kctl = snd_ctl_find_id(card, &control->id);
962         if (kctl == NULL) {
963                 result = -ENOENT;
964         } else {
965                 index_offset = snd_ctl_get_ioff(kctl, &control->id);
966                 vd = &kctl->vd[index_offset];
967                 if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) ||
968                     kctl->put == NULL ||
969                     (file && vd->owner && vd->owner != file)) {
970                         result = -EPERM;
971                 } else {
972                         snd_ctl_build_ioff(&control->id, kctl, index_offset);
973                         result = kctl->put(kctl, control);
974                 }
975                 if (result > 0) {
976                         struct snd_ctl_elem_id id = control->id;
977                         up_read(&card->controls_rwsem);
978                         snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id);
979                         return 0;
980                 }
981         }
982         up_read(&card->controls_rwsem);
983         return result;
984 }
985
986 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
987                                    struct snd_ctl_elem_value __user *_control)
988 {
989         struct snd_ctl_elem_value *control;
990         struct snd_card *card;
991         int result;
992
993         control = memdup_user(_control, sizeof(*control));
994         if (IS_ERR(control))
995                 return PTR_ERR(control);
996
997         card = file->card;
998         snd_power_lock(card);
999         result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
1000         if (result >= 0)
1001                 result = snd_ctl_elem_write(card, file, control);
1002         snd_power_unlock(card);
1003         if (result >= 0)
1004                 if (copy_to_user(_control, control, sizeof(*control)))
1005                         result = -EFAULT;
1006         kfree(control);
1007         return result;
1008 }
1009
1010 static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1011                              struct snd_ctl_elem_id __user *_id)
1012 {
1013         struct snd_card *card = file->card;
1014         struct snd_ctl_elem_id id;
1015         struct snd_kcontrol *kctl;
1016         struct snd_kcontrol_volatile *vd;
1017         int result;
1018         
1019         if (copy_from_user(&id, _id, sizeof(id)))
1020                 return -EFAULT;
1021         down_write(&card->controls_rwsem);
1022         kctl = snd_ctl_find_id(card, &id);
1023         if (kctl == NULL) {
1024                 result = -ENOENT;
1025         } else {
1026                 vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1027                 if (vd->owner != NULL)
1028                         result = -EBUSY;
1029                 else {
1030                         vd->owner = file;
1031                         result = 0;
1032                 }
1033         }
1034         up_write(&card->controls_rwsem);
1035         return result;
1036 }
1037
1038 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1039                                struct snd_ctl_elem_id __user *_id)
1040 {
1041         struct snd_card *card = file->card;
1042         struct snd_ctl_elem_id id;
1043         struct snd_kcontrol *kctl;
1044         struct snd_kcontrol_volatile *vd;
1045         int result;
1046         
1047         if (copy_from_user(&id, _id, sizeof(id)))
1048                 return -EFAULT;
1049         down_write(&card->controls_rwsem);
1050         kctl = snd_ctl_find_id(card, &id);
1051         if (kctl == NULL) {
1052                 result = -ENOENT;
1053         } else {
1054                 vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1055                 if (vd->owner == NULL)
1056                         result = -EINVAL;
1057                 else if (vd->owner != file)
1058                         result = -EPERM;
1059                 else {
1060                         vd->owner = NULL;
1061                         result = 0;
1062                 }
1063         }
1064         up_write(&card->controls_rwsem);
1065         return result;
1066 }
1067
1068 struct user_element {
1069         struct snd_ctl_elem_info info;
1070         struct snd_card *card;
1071         char *elem_data;                /* element data */
1072         unsigned long elem_data_size;   /* size of element data in bytes */
1073         void *tlv_data;                 /* TLV data */
1074         unsigned long tlv_data_size;    /* TLV data size */
1075         void *priv_data;                /* private data (like strings for enumerated type) */
1076 };
1077
1078 static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1079                                   struct snd_ctl_elem_info *uinfo)
1080 {
1081         struct user_element *ue = kcontrol->private_data;
1082         unsigned int offset;
1083
1084         offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1085         *uinfo = ue->info;
1086         snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1087
1088         return 0;
1089 }
1090
1091 static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1092                                        struct snd_ctl_elem_info *uinfo)
1093 {
1094         struct user_element *ue = kcontrol->private_data;
1095         const char *names;
1096         unsigned int item;
1097         unsigned int offset;
1098
1099         item = uinfo->value.enumerated.item;
1100
1101         offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1102         *uinfo = ue->info;
1103         snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1104
1105         item = min(item, uinfo->value.enumerated.items - 1);
1106         uinfo->value.enumerated.item = item;
1107
1108         names = ue->priv_data;
1109         for (; item > 0; --item)
1110                 names += strlen(names) + 1;
1111         strcpy(uinfo->value.enumerated.name, names);
1112
1113         return 0;
1114 }
1115
1116 static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1117                                  struct snd_ctl_elem_value *ucontrol)
1118 {
1119         struct user_element *ue = kcontrol->private_data;
1120         unsigned int size = ue->elem_data_size;
1121         char *src = ue->elem_data +
1122                         snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1123
1124         mutex_lock(&ue->card->user_ctl_lock);
1125         memcpy(&ucontrol->value, src, size);
1126         mutex_unlock(&ue->card->user_ctl_lock);
1127         return 0;
1128 }
1129
1130 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1131                                  struct snd_ctl_elem_value *ucontrol)
1132 {
1133         int change;
1134         struct user_element *ue = kcontrol->private_data;
1135         unsigned int size = ue->elem_data_size;
1136         char *dst = ue->elem_data +
1137                         snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1138
1139         mutex_lock(&ue->card->user_ctl_lock);
1140         change = memcmp(&ucontrol->value, dst, size) != 0;
1141         if (change)
1142                 memcpy(dst, &ucontrol->value, size);
1143         mutex_unlock(&ue->card->user_ctl_lock);
1144         return change;
1145 }
1146
1147 static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
1148                                  int op_flag,
1149                                  unsigned int size,
1150                                  unsigned int __user *tlv)
1151 {
1152         struct user_element *ue = kcontrol->private_data;
1153         int change = 0;
1154         void *new_data;
1155
1156         if (op_flag == SNDRV_CTL_TLV_OP_WRITE) {
1157                 if (size > 1024 * 128)  /* sane value */
1158                         return -EINVAL;
1159
1160                 new_data = memdup_user(tlv, size);
1161                 if (IS_ERR(new_data))
1162                         return PTR_ERR(new_data);
1163                 mutex_lock(&ue->card->user_ctl_lock);
1164                 change = ue->tlv_data_size != size;
1165                 if (!change)
1166                         change = memcmp(ue->tlv_data, new_data, size) != 0;
1167                 kfree(ue->tlv_data);
1168                 ue->tlv_data = new_data;
1169                 ue->tlv_data_size = size;
1170                 mutex_unlock(&ue->card->user_ctl_lock);
1171         } else {
1172                 int ret = 0;
1173
1174                 mutex_lock(&ue->card->user_ctl_lock);
1175                 if (!ue->tlv_data_size || !ue->tlv_data) {
1176                         ret = -ENXIO;
1177                         goto err_unlock;
1178                 }
1179                 if (size < ue->tlv_data_size) {
1180                         ret = -ENOSPC;
1181                         goto err_unlock;
1182                 }
1183                 if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size))
1184                         ret = -EFAULT;
1185 err_unlock:
1186                 mutex_unlock(&ue->card->user_ctl_lock);
1187                 if (ret)
1188                         return ret;
1189         }
1190         return change;
1191 }
1192
1193 static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1194 {
1195         char *names, *p;
1196         size_t buf_len, name_len;
1197         unsigned int i;
1198         const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1199
1200         if (ue->info.value.enumerated.names_length > 64 * 1024)
1201                 return -EINVAL;
1202
1203         names = memdup_user((const void __user *)user_ptrval,
1204                 ue->info.value.enumerated.names_length);
1205         if (IS_ERR(names))
1206                 return PTR_ERR(names);
1207
1208         /* check that there are enough valid names */
1209         buf_len = ue->info.value.enumerated.names_length;
1210         p = names;
1211         for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1212                 name_len = strnlen(p, buf_len);
1213                 if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1214                         kfree(names);
1215                         return -EINVAL;
1216                 }
1217                 p += name_len + 1;
1218                 buf_len -= name_len + 1;
1219         }
1220
1221         ue->priv_data = names;
1222         ue->info.value.enumerated.names_ptr = 0;
1223
1224         return 0;
1225 }
1226
1227 static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1228 {
1229         struct user_element *ue = kcontrol->private_data;
1230
1231         kfree(ue->tlv_data);
1232         kfree(ue->priv_data);
1233         kfree(ue);
1234 }
1235
1236 static int snd_ctl_elem_add(struct snd_ctl_file *file,
1237                             struct snd_ctl_elem_info *info, int replace)
1238 {
1239         /* The capacity of struct snd_ctl_elem_value.value.*/
1240         static const unsigned int value_sizes[] = {
1241                 [SNDRV_CTL_ELEM_TYPE_BOOLEAN]   = sizeof(long),
1242                 [SNDRV_CTL_ELEM_TYPE_INTEGER]   = sizeof(long),
1243                 [SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
1244                 [SNDRV_CTL_ELEM_TYPE_BYTES]     = sizeof(unsigned char),
1245                 [SNDRV_CTL_ELEM_TYPE_IEC958]    = sizeof(struct snd_aes_iec958),
1246                 [SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
1247         };
1248         static const unsigned int max_value_counts[] = {
1249                 [SNDRV_CTL_ELEM_TYPE_BOOLEAN]   = 128,
1250                 [SNDRV_CTL_ELEM_TYPE_INTEGER]   = 128,
1251                 [SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
1252                 [SNDRV_CTL_ELEM_TYPE_BYTES]     = 512,
1253                 [SNDRV_CTL_ELEM_TYPE_IEC958]    = 1,
1254                 [SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
1255         };
1256         struct snd_card *card = file->card;
1257         struct snd_kcontrol *kctl;
1258         unsigned int count;
1259         unsigned int access;
1260         long private_size;
1261         struct user_element *ue;
1262         unsigned int offset;
1263         int err;
1264
1265         if (!*info->id.name)
1266                 return -EINVAL;
1267         if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
1268                 return -EINVAL;
1269
1270         /* Delete a control to replace them if needed. */
1271         if (replace) {
1272                 info->id.numid = 0;
1273                 err = snd_ctl_remove_user_ctl(file, &info->id);
1274                 if (err)
1275                         return err;
1276         }
1277
1278         /*
1279          * The number of userspace controls are counted control by control,
1280          * not element by element.
1281          */
1282         if (card->user_ctl_count + 1 > MAX_USER_CONTROLS)
1283                 return -ENOMEM;
1284
1285         /* Check the number of elements for this userspace control. */
1286         count = info->owner;
1287         if (count == 0)
1288                 count = 1;
1289
1290         /* Arrange access permissions if needed. */
1291         access = info->access;
1292         if (access == 0)
1293                 access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1294         access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1295                    SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1296                    SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE);
1297         if (access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE)
1298                 access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1299         access |= SNDRV_CTL_ELEM_ACCESS_USER;
1300
1301         /*
1302          * Check information and calculate the size of data specific to
1303          * this userspace control.
1304          */
1305         if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
1306             info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64)
1307                 return -EINVAL;
1308         if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
1309             info->value.enumerated.items == 0)
1310                 return -EINVAL;
1311         if (info->count < 1 ||
1312             info->count > max_value_counts[info->type])
1313                 return -EINVAL;
1314         if (!validate_element_member_dimension(info))
1315                 return -EINVAL;
1316         private_size = value_sizes[info->type] * info->count;
1317
1318         /*
1319          * Keep memory object for this userspace control. After passing this
1320          * code block, the instance should be freed by snd_ctl_free_one().
1321          *
1322          * Note that these elements in this control are locked.
1323          */
1324         err = snd_ctl_new(&kctl, count, access, file);
1325         if (err < 0)
1326                 return err;
1327         memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1328         kctl->private_data = kzalloc(sizeof(struct user_element) + private_size * count,
1329                                      GFP_KERNEL);
1330         if (kctl->private_data == NULL) {
1331                 kfree(kctl);
1332                 return -ENOMEM;
1333         }
1334         kctl->private_free = snd_ctl_elem_user_free;
1335
1336         /* Set private data for this userspace control. */
1337         ue = (struct user_element *)kctl->private_data;
1338         ue->card = card;
1339         ue->info = *info;
1340         ue->info.access = 0;
1341         ue->elem_data = (char *)ue + sizeof(*ue);
1342         ue->elem_data_size = private_size;
1343         if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1344                 err = snd_ctl_elem_init_enum_names(ue);
1345                 if (err < 0) {
1346                         snd_ctl_free_one(kctl);
1347                         return err;
1348                 }
1349         }
1350
1351         /* Set callback functions. */
1352         if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1353                 kctl->info = snd_ctl_elem_user_enum_info;
1354         else
1355                 kctl->info = snd_ctl_elem_user_info;
1356         if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1357                 kctl->get = snd_ctl_elem_user_get;
1358         if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1359                 kctl->put = snd_ctl_elem_user_put;
1360         if (access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE)
1361                 kctl->tlv.c = snd_ctl_elem_user_tlv;
1362
1363         /* This function manage to free the instance on failure. */
1364         down_write(&card->controls_rwsem);
1365         err = __snd_ctl_add(card, kctl);
1366         if (err < 0) {
1367                 snd_ctl_free_one(kctl);
1368                 goto unlock;
1369         }
1370         offset = snd_ctl_get_ioff(kctl, &info->id);
1371         snd_ctl_build_ioff(&info->id, kctl, offset);
1372         /*
1373          * Here we cannot fill any field for the number of elements added by
1374          * this operation because there're no specific fields. The usage of
1375          * 'owner' field for this purpose may cause any bugs to userspace
1376          * applications because the field originally means PID of a process
1377          * which locks the element.
1378          */
1379
1380         card->user_ctl_count++;
1381
1382  unlock:
1383         up_write(&card->controls_rwsem);
1384         return err;
1385 }
1386
1387 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1388                                  struct snd_ctl_elem_info __user *_info, int replace)
1389 {
1390         struct snd_ctl_elem_info info;
1391         int err;
1392
1393         if (copy_from_user(&info, _info, sizeof(info)))
1394                 return -EFAULT;
1395         err = snd_ctl_elem_add(file, &info, replace);
1396         if (err < 0)
1397                 return err;
1398         if (copy_to_user(_info, &info, sizeof(info))) {
1399                 snd_ctl_remove_user_ctl(file, &info.id);
1400                 return -EFAULT;
1401         }
1402
1403         return 0;
1404 }
1405
1406 static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1407                                struct snd_ctl_elem_id __user *_id)
1408 {
1409         struct snd_ctl_elem_id id;
1410
1411         if (copy_from_user(&id, _id, sizeof(id)))
1412                 return -EFAULT;
1413         return snd_ctl_remove_user_ctl(file, &id);
1414 }
1415
1416 static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1417 {
1418         int subscribe;
1419         if (get_user(subscribe, ptr))
1420                 return -EFAULT;
1421         if (subscribe < 0) {
1422                 subscribe = file->subscribed;
1423                 if (put_user(subscribe, ptr))
1424                         return -EFAULT;
1425                 return 0;
1426         }
1427         if (subscribe) {
1428                 file->subscribed = 1;
1429                 return 0;
1430         } else if (file->subscribed) {
1431                 snd_ctl_empty_read_queue(file);
1432                 file->subscribed = 0;
1433         }
1434         return 0;
1435 }
1436
1437 static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1438                              struct snd_ctl_tlv __user *_tlv,
1439                              int op_flag)
1440 {
1441         struct snd_card *card = file->card;
1442         struct snd_ctl_tlv tlv;
1443         struct snd_kcontrol *kctl;
1444         struct snd_kcontrol_volatile *vd;
1445         unsigned int len;
1446         int err = 0;
1447
1448         if (copy_from_user(&tlv, _tlv, sizeof(tlv)))
1449                 return -EFAULT;
1450         if (tlv.length < sizeof(unsigned int) * 2)
1451                 return -EINVAL;
1452         if (!tlv.numid)
1453                 return -EINVAL;
1454         down_read(&card->controls_rwsem);
1455         kctl = snd_ctl_find_numid(card, tlv.numid);
1456         if (kctl == NULL) {
1457                 err = -ENOENT;
1458                 goto __kctl_end;
1459         }
1460         if (kctl->tlv.p == NULL) {
1461                 err = -ENXIO;
1462                 goto __kctl_end;
1463         }
1464         vd = &kctl->vd[tlv.numid - kctl->id.numid];
1465         if ((op_flag == SNDRV_CTL_TLV_OP_READ &&
1466              (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ) == 0) ||
1467             (op_flag == SNDRV_CTL_TLV_OP_WRITE &&
1468              (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE) == 0) ||
1469             (op_flag == SNDRV_CTL_TLV_OP_CMD &&
1470              (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND) == 0)) {
1471                 err = -ENXIO;
1472                 goto __kctl_end;
1473         }
1474         if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1475                 if (vd->owner != NULL && vd->owner != file) {
1476                         err = -EPERM;
1477                         goto __kctl_end;
1478                 }
1479                 err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv);
1480                 if (err > 0) {
1481                         struct snd_ctl_elem_id id = kctl->id;
1482                         up_read(&card->controls_rwsem);
1483                         snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id);
1484                         return 0;
1485                 }
1486         } else {
1487                 if (op_flag != SNDRV_CTL_TLV_OP_READ) {
1488                         err = -ENXIO;
1489                         goto __kctl_end;
1490                 }
1491                 len = kctl->tlv.p[1] + 2 * sizeof(unsigned int);
1492                 if (tlv.length < len) {
1493                         err = -ENOMEM;
1494                         goto __kctl_end;
1495                 }
1496                 if (copy_to_user(_tlv->tlv, kctl->tlv.p, len))
1497                         err = -EFAULT;
1498         }
1499       __kctl_end:
1500         up_read(&card->controls_rwsem);
1501         return err;
1502 }
1503
1504 static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1505 {
1506         struct snd_ctl_file *ctl;
1507         struct snd_card *card;
1508         struct snd_kctl_ioctl *p;
1509         void __user *argp = (void __user *)arg;
1510         int __user *ip = argp;
1511         int err;
1512
1513         ctl = file->private_data;
1514         card = ctl->card;
1515         if (snd_BUG_ON(!card))
1516                 return -ENXIO;
1517         switch (cmd) {
1518         case SNDRV_CTL_IOCTL_PVERSION:
1519                 return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1520         case SNDRV_CTL_IOCTL_CARD_INFO:
1521                 return snd_ctl_card_info(card, ctl, cmd, argp);
1522         case SNDRV_CTL_IOCTL_ELEM_LIST:
1523                 return snd_ctl_elem_list(card, argp);
1524         case SNDRV_CTL_IOCTL_ELEM_INFO:
1525                 return snd_ctl_elem_info_user(ctl, argp);
1526         case SNDRV_CTL_IOCTL_ELEM_READ:
1527                 return snd_ctl_elem_read_user(card, argp);
1528         case SNDRV_CTL_IOCTL_ELEM_WRITE:
1529                 return snd_ctl_elem_write_user(ctl, argp);
1530         case SNDRV_CTL_IOCTL_ELEM_LOCK:
1531                 return snd_ctl_elem_lock(ctl, argp);
1532         case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1533                 return snd_ctl_elem_unlock(ctl, argp);
1534         case SNDRV_CTL_IOCTL_ELEM_ADD:
1535                 return snd_ctl_elem_add_user(ctl, argp, 0);
1536         case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1537                 return snd_ctl_elem_add_user(ctl, argp, 1);
1538         case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1539                 return snd_ctl_elem_remove(ctl, argp);
1540         case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1541                 return snd_ctl_subscribe_events(ctl, ip);
1542         case SNDRV_CTL_IOCTL_TLV_READ:
1543                 return snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
1544         case SNDRV_CTL_IOCTL_TLV_WRITE:
1545                 return snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
1546         case SNDRV_CTL_IOCTL_TLV_COMMAND:
1547                 return snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
1548         case SNDRV_CTL_IOCTL_POWER:
1549                 return -ENOPROTOOPT;
1550         case SNDRV_CTL_IOCTL_POWER_STATE:
1551 #ifdef CONFIG_PM
1552                 return put_user(card->power_state, ip) ? -EFAULT : 0;
1553 #else
1554                 return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1555 #endif
1556         }
1557         down_read(&snd_ioctl_rwsem);
1558         list_for_each_entry(p, &snd_control_ioctls, list) {
1559                 err = p->fioctl(card, ctl, cmd, arg);
1560                 if (err != -ENOIOCTLCMD) {
1561                         up_read(&snd_ioctl_rwsem);
1562                         return err;
1563                 }
1564         }
1565         up_read(&snd_ioctl_rwsem);
1566         dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
1567         return -ENOTTY;
1568 }
1569
1570 static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1571                             size_t count, loff_t * offset)
1572 {
1573         struct snd_ctl_file *ctl;
1574         int err = 0;
1575         ssize_t result = 0;
1576
1577         ctl = file->private_data;
1578         if (snd_BUG_ON(!ctl || !ctl->card))
1579                 return -ENXIO;
1580         if (!ctl->subscribed)
1581                 return -EBADFD;
1582         if (count < sizeof(struct snd_ctl_event))
1583                 return -EINVAL;
1584         spin_lock_irq(&ctl->read_lock);
1585         while (count >= sizeof(struct snd_ctl_event)) {
1586                 struct snd_ctl_event ev;
1587                 struct snd_kctl_event *kev;
1588                 while (list_empty(&ctl->events)) {
1589                         wait_queue_t wait;
1590                         if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
1591                                 err = -EAGAIN;
1592                                 goto __end_lock;
1593                         }
1594                         init_waitqueue_entry(&wait, current);
1595                         add_wait_queue(&ctl->change_sleep, &wait);
1596                         set_current_state(TASK_INTERRUPTIBLE);
1597                         spin_unlock_irq(&ctl->read_lock);
1598                         schedule();
1599                         remove_wait_queue(&ctl->change_sleep, &wait);
1600                         if (ctl->card->shutdown)
1601                                 return -ENODEV;
1602                         if (signal_pending(current))
1603                                 return -ERESTARTSYS;
1604                         spin_lock_irq(&ctl->read_lock);
1605                 }
1606                 kev = snd_kctl_event(ctl->events.next);
1607                 ev.type = SNDRV_CTL_EVENT_ELEM;
1608                 ev.data.elem.mask = kev->mask;
1609                 ev.data.elem.id = kev->id;
1610                 list_del(&kev->list);
1611                 spin_unlock_irq(&ctl->read_lock);
1612                 kfree(kev);
1613                 if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
1614                         err = -EFAULT;
1615                         goto __end;
1616                 }
1617                 spin_lock_irq(&ctl->read_lock);
1618                 buffer += sizeof(struct snd_ctl_event);
1619                 count -= sizeof(struct snd_ctl_event);
1620                 result += sizeof(struct snd_ctl_event);
1621         }
1622       __end_lock:
1623         spin_unlock_irq(&ctl->read_lock);
1624       __end:
1625         return result > 0 ? result : err;
1626 }
1627
1628 static unsigned int snd_ctl_poll(struct file *file, poll_table * wait)
1629 {
1630         unsigned int mask;
1631         struct snd_ctl_file *ctl;
1632
1633         ctl = file->private_data;
1634         if (!ctl->subscribed)
1635                 return 0;
1636         poll_wait(file, &ctl->change_sleep, wait);
1637
1638         mask = 0;
1639         if (!list_empty(&ctl->events))
1640                 mask |= POLLIN | POLLRDNORM;
1641
1642         return mask;
1643 }
1644
1645 /*
1646  * register the device-specific control-ioctls.
1647  * called from each device manager like pcm.c, hwdep.c, etc.
1648  */
1649 static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
1650 {
1651         struct snd_kctl_ioctl *pn;
1652
1653         pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
1654         if (pn == NULL)
1655                 return -ENOMEM;
1656         pn->fioctl = fcn;
1657         down_write(&snd_ioctl_rwsem);
1658         list_add_tail(&pn->list, lists);
1659         up_write(&snd_ioctl_rwsem);
1660         return 0;
1661 }
1662
1663 /**
1664  * snd_ctl_register_ioctl - register the device-specific control-ioctls
1665  * @fcn: ioctl callback function
1666  *
1667  * called from each device manager like pcm.c, hwdep.c, etc.
1668  */
1669 int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
1670 {
1671         return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
1672 }
1673 EXPORT_SYMBOL(snd_ctl_register_ioctl);
1674
1675 #ifdef CONFIG_COMPAT
1676 /**
1677  * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
1678  * control-ioctls
1679  * @fcn: ioctl callback function
1680  */
1681 int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1682 {
1683         return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
1684 }
1685 EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
1686 #endif
1687
1688 /*
1689  * de-register the device-specific control-ioctls.
1690  */
1691 static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
1692                                      struct list_head *lists)
1693 {
1694         struct snd_kctl_ioctl *p;
1695
1696         if (snd_BUG_ON(!fcn))
1697                 return -EINVAL;
1698         down_write(&snd_ioctl_rwsem);
1699         list_for_each_entry(p, lists, list) {
1700                 if (p->fioctl == fcn) {
1701                         list_del(&p->list);
1702                         up_write(&snd_ioctl_rwsem);
1703                         kfree(p);
1704                         return 0;
1705                 }
1706         }
1707         up_write(&snd_ioctl_rwsem);
1708         snd_BUG();
1709         return -EINVAL;
1710 }
1711
1712 /**
1713  * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
1714  * @fcn: ioctl callback function to unregister
1715  */
1716 int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
1717 {
1718         return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
1719 }
1720 EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
1721
1722 #ifdef CONFIG_COMPAT
1723 /**
1724  * snd_ctl_unregister_ioctl - de-register the device-specific compat 32bit
1725  * control-ioctls
1726  * @fcn: ioctl callback function to unregister
1727  */
1728 int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1729 {
1730         return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
1731 }
1732 EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
1733 #endif
1734
1735 static int snd_ctl_fasync(int fd, struct file * file, int on)
1736 {
1737         struct snd_ctl_file *ctl;
1738
1739         ctl = file->private_data;
1740         return fasync_helper(fd, file, on, &ctl->fasync);
1741 }
1742
1743 /* return the preferred subdevice number if already assigned;
1744  * otherwise return -1
1745  */
1746 int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
1747 {
1748         struct snd_ctl_file *kctl;
1749         int subdevice = -1;
1750
1751         read_lock(&card->ctl_files_rwlock);
1752         list_for_each_entry(kctl, &card->ctl_files, list) {
1753                 if (kctl->pid == task_pid(current)) {
1754                         subdevice = kctl->preferred_subdevice[type];
1755                         if (subdevice != -1)
1756                                 break;
1757                 }
1758         }
1759         read_unlock(&card->ctl_files_rwlock);
1760         return subdevice;
1761 }
1762 EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
1763
1764 /*
1765  * ioctl32 compat
1766  */
1767 #ifdef CONFIG_COMPAT
1768 #include "control_compat.c"
1769 #else
1770 #define snd_ctl_ioctl_compat    NULL
1771 #endif
1772
1773 /*
1774  *  INIT PART
1775  */
1776
1777 static const struct file_operations snd_ctl_f_ops =
1778 {
1779         .owner =        THIS_MODULE,
1780         .read =         snd_ctl_read,
1781         .open =         snd_ctl_open,
1782         .release =      snd_ctl_release,
1783         .llseek =       no_llseek,
1784         .poll =         snd_ctl_poll,
1785         .unlocked_ioctl =       snd_ctl_ioctl,
1786         .compat_ioctl = snd_ctl_ioctl_compat,
1787         .fasync =       snd_ctl_fasync,
1788 };
1789
1790 /*
1791  * registration of the control device
1792  */
1793 static int snd_ctl_dev_register(struct snd_device *device)
1794 {
1795         struct snd_card *card = device->device_data;
1796
1797         return snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
1798                                    &snd_ctl_f_ops, card, &card->ctl_dev);
1799 }
1800
1801 /*
1802  * disconnection of the control device
1803  */
1804 static int snd_ctl_dev_disconnect(struct snd_device *device)
1805 {
1806         struct snd_card *card = device->device_data;
1807         struct snd_ctl_file *ctl;
1808
1809         read_lock(&card->ctl_files_rwlock);
1810         list_for_each_entry(ctl, &card->ctl_files, list) {
1811                 wake_up(&ctl->change_sleep);
1812                 kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
1813         }
1814         read_unlock(&card->ctl_files_rwlock);
1815
1816         return snd_unregister_device(&card->ctl_dev);
1817 }
1818
1819 /*
1820  * free all controls
1821  */
1822 static int snd_ctl_dev_free(struct snd_device *device)
1823 {
1824         struct snd_card *card = device->device_data;
1825         struct snd_kcontrol *control;
1826
1827         down_write(&card->controls_rwsem);
1828         while (!list_empty(&card->controls)) {
1829                 control = snd_kcontrol(card->controls.next);
1830                 snd_ctl_remove(card, control);
1831         }
1832         up_write(&card->controls_rwsem);
1833         put_device(&card->ctl_dev);
1834         return 0;
1835 }
1836
1837 /*
1838  * create control core:
1839  * called from init.c
1840  */
1841 int snd_ctl_create(struct snd_card *card)
1842 {
1843         static struct snd_device_ops ops = {
1844                 .dev_free = snd_ctl_dev_free,
1845                 .dev_register = snd_ctl_dev_register,
1846                 .dev_disconnect = snd_ctl_dev_disconnect,
1847         };
1848         int err;
1849
1850         if (snd_BUG_ON(!card))
1851                 return -ENXIO;
1852         if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
1853                 return -ENXIO;
1854
1855         snd_device_initialize(&card->ctl_dev, card);
1856         dev_set_name(&card->ctl_dev, "controlC%d", card->number);
1857
1858         err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
1859         if (err < 0)
1860                 put_device(&card->ctl_dev);
1861         return err;
1862 }
1863
1864 /*
1865  * Frequently used control callbacks/helpers
1866  */
1867
1868 /**
1869  * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
1870  * callback with a mono channel
1871  * @kcontrol: the kcontrol instance
1872  * @uinfo: info to store
1873  *
1874  * This is a function that can be used as info callback for a standard
1875  * boolean control with a single mono channel.
1876  */
1877 int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
1878                               struct snd_ctl_elem_info *uinfo)
1879 {
1880         uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
1881         uinfo->count = 1;
1882         uinfo->value.integer.min = 0;
1883         uinfo->value.integer.max = 1;
1884         return 0;
1885 }
1886 EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
1887
1888 /**
1889  * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
1890  * callback with stereo two channels
1891  * @kcontrol: the kcontrol instance
1892  * @uinfo: info to store
1893  *
1894  * This is a function that can be used as info callback for a standard
1895  * boolean control with stereo two channels.
1896  */
1897 int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
1898                                 struct snd_ctl_elem_info *uinfo)
1899 {
1900         uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
1901         uinfo->count = 2;
1902         uinfo->value.integer.min = 0;
1903         uinfo->value.integer.max = 1;
1904         return 0;
1905 }
1906 EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
1907
1908 /**
1909  * snd_ctl_enum_info - fills the info structure for an enumerated control
1910  * @info: the structure to be filled
1911  * @channels: the number of the control's channels; often one
1912  * @items: the number of control values; also the size of @names
1913  * @names: an array containing the names of all control values
1914  *
1915  * Sets all required fields in @info to their appropriate values.
1916  * If the control's accessibility is not the default (readable and writable),
1917  * the caller has to fill @info->access.
1918  *
1919  * Return: Zero.
1920  */
1921 int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
1922                       unsigned int items, const char *const names[])
1923 {
1924         info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
1925         info->count = channels;
1926         info->value.enumerated.items = items;
1927         if (!items)
1928                 return 0;
1929         if (info->value.enumerated.item >= items)
1930                 info->value.enumerated.item = items - 1;
1931         WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
1932              "ALSA: too long item name '%s'\n",
1933              names[info->value.enumerated.item]);
1934         strlcpy(info->value.enumerated.name,
1935                 names[info->value.enumerated.item],
1936                 sizeof(info->value.enumerated.name));
1937         return 0;
1938 }
1939 EXPORT_SYMBOL(snd_ctl_enum_info);