cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

control.c (61629B)


      1// SPDX-License-Identifier: GPL-2.0-or-later
      2/*
      3 *  Routines for driver control interface
      4 *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
      5 */
      6
      7#include <linux/threads.h>
      8#include <linux/interrupt.h>
      9#include <linux/module.h>
     10#include <linux/moduleparam.h>
     11#include <linux/slab.h>
     12#include <linux/vmalloc.h>
     13#include <linux/time.h>
     14#include <linux/mm.h>
     15#include <linux/math64.h>
     16#include <linux/sched/signal.h>
     17#include <sound/core.h>
     18#include <sound/minors.h>
     19#include <sound/info.h>
     20#include <sound/control.h>
     21
     22// Max allocation size for user controls.
     23static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
     24module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
     25MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
     26
     27#define MAX_CONTROL_COUNT	1028
     28
     29struct snd_kctl_ioctl {
     30	struct list_head list;		/* list of all ioctls */
     31	snd_kctl_ioctl_func_t fioctl;
     32};
     33
     34static DECLARE_RWSEM(snd_ioctl_rwsem);
     35static DECLARE_RWSEM(snd_ctl_layer_rwsem);
     36static LIST_HEAD(snd_control_ioctls);
     37#ifdef CONFIG_COMPAT
     38static LIST_HEAD(snd_control_compat_ioctls);
     39#endif
     40static struct snd_ctl_layer_ops *snd_ctl_layer;
     41
     42static int snd_ctl_open(struct inode *inode, struct file *file)
     43{
     44	unsigned long flags;
     45	struct snd_card *card;
     46	struct snd_ctl_file *ctl;
     47	int i, err;
     48
     49	err = stream_open(inode, file);
     50	if (err < 0)
     51		return err;
     52
     53	card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
     54	if (!card) {
     55		err = -ENODEV;
     56		goto __error1;
     57	}
     58	err = snd_card_file_add(card, file);
     59	if (err < 0) {
     60		err = -ENODEV;
     61		goto __error1;
     62	}
     63	if (!try_module_get(card->module)) {
     64		err = -EFAULT;
     65		goto __error2;
     66	}
     67	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
     68	if (ctl == NULL) {
     69		err = -ENOMEM;
     70		goto __error;
     71	}
     72	INIT_LIST_HEAD(&ctl->events);
     73	init_waitqueue_head(&ctl->change_sleep);
     74	spin_lock_init(&ctl->read_lock);
     75	ctl->card = card;
     76	for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
     77		ctl->preferred_subdevice[i] = -1;
     78	ctl->pid = get_pid(task_pid(current));
     79	file->private_data = ctl;
     80	write_lock_irqsave(&card->ctl_files_rwlock, flags);
     81	list_add_tail(&ctl->list, &card->ctl_files);
     82	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
     83	snd_card_unref(card);
     84	return 0;
     85
     86      __error:
     87	module_put(card->module);
     88      __error2:
     89	snd_card_file_remove(card, file);
     90      __error1:
     91	if (card)
     92		snd_card_unref(card);
     93      	return err;
     94}
     95
     96static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
     97{
     98	unsigned long flags;
     99	struct snd_kctl_event *cread;
    100
    101	spin_lock_irqsave(&ctl->read_lock, flags);
    102	while (!list_empty(&ctl->events)) {
    103		cread = snd_kctl_event(ctl->events.next);
    104		list_del(&cread->list);
    105		kfree(cread);
    106	}
    107	spin_unlock_irqrestore(&ctl->read_lock, flags);
    108}
    109
    110static int snd_ctl_release(struct inode *inode, struct file *file)
    111{
    112	unsigned long flags;
    113	struct snd_card *card;
    114	struct snd_ctl_file *ctl;
    115	struct snd_kcontrol *control;
    116	unsigned int idx;
    117
    118	ctl = file->private_data;
    119	file->private_data = NULL;
    120	card = ctl->card;
    121	write_lock_irqsave(&card->ctl_files_rwlock, flags);
    122	list_del(&ctl->list);
    123	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
    124	down_write(&card->controls_rwsem);
    125	list_for_each_entry(control, &card->controls, list)
    126		for (idx = 0; idx < control->count; idx++)
    127			if (control->vd[idx].owner == ctl)
    128				control->vd[idx].owner = NULL;
    129	up_write(&card->controls_rwsem);
    130	snd_ctl_empty_read_queue(ctl);
    131	put_pid(ctl->pid);
    132	kfree(ctl);
    133	module_put(card->module);
    134	snd_card_file_remove(card, file);
    135	return 0;
    136}
    137
    138/**
    139 * snd_ctl_notify - Send notification to user-space for a control change
    140 * @card: the card to send notification
    141 * @mask: the event mask, SNDRV_CTL_EVENT_*
    142 * @id: the ctl element id to send notification
    143 *
    144 * This function adds an event record with the given id and mask, appends
    145 * to the list and wakes up the user-space for notification.  This can be
    146 * called in the atomic context.
    147 */
    148void snd_ctl_notify(struct snd_card *card, unsigned int mask,
    149		    struct snd_ctl_elem_id *id)
    150{
    151	unsigned long flags;
    152	struct snd_ctl_file *ctl;
    153	struct snd_kctl_event *ev;
    154
    155	if (snd_BUG_ON(!card || !id))
    156		return;
    157	if (card->shutdown)
    158		return;
    159	read_lock_irqsave(&card->ctl_files_rwlock, flags);
    160#if IS_ENABLED(CONFIG_SND_MIXER_OSS)
    161	card->mixer_oss_change_count++;
    162#endif
    163	list_for_each_entry(ctl, &card->ctl_files, list) {
    164		if (!ctl->subscribed)
    165			continue;
    166		spin_lock(&ctl->read_lock);
    167		list_for_each_entry(ev, &ctl->events, list) {
    168			if (ev->id.numid == id->numid) {
    169				ev->mask |= mask;
    170				goto _found;
    171			}
    172		}
    173		ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
    174		if (ev) {
    175			ev->id = *id;
    176			ev->mask = mask;
    177			list_add_tail(&ev->list, &ctl->events);
    178		} else {
    179			dev_err(card->dev, "No memory available to allocate event\n");
    180		}
    181	_found:
    182		wake_up(&ctl->change_sleep);
    183		spin_unlock(&ctl->read_lock);
    184		kill_fasync(&ctl->fasync, SIGIO, POLL_IN);
    185	}
    186	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
    187}
    188EXPORT_SYMBOL(snd_ctl_notify);
    189
    190/**
    191 * snd_ctl_notify_one - Send notification to user-space for a control change
    192 * @card: the card to send notification
    193 * @mask: the event mask, SNDRV_CTL_EVENT_*
    194 * @kctl: the pointer with the control instance
    195 * @ioff: the additional offset to the control index
    196 *
    197 * This function calls snd_ctl_notify() and does additional jobs
    198 * like LED state changes.
    199 */
    200void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
    201			struct snd_kcontrol *kctl, unsigned int ioff)
    202{
    203	struct snd_ctl_elem_id id = kctl->id;
    204	struct snd_ctl_layer_ops *lops;
    205
    206	id.index += ioff;
    207	id.numid += ioff;
    208	snd_ctl_notify(card, mask, &id);
    209	down_read(&snd_ctl_layer_rwsem);
    210	for (lops = snd_ctl_layer; lops; lops = lops->next)
    211		lops->lnotify(card, mask, kctl, ioff);
    212	up_read(&snd_ctl_layer_rwsem);
    213}
    214EXPORT_SYMBOL(snd_ctl_notify_one);
    215
    216/**
    217 * snd_ctl_new - create a new control instance with some elements
    218 * @kctl: the pointer to store new control instance
    219 * @count: the number of elements in this control
    220 * @access: the default access flags for elements in this control
    221 * @file: given when locking these elements
    222 *
    223 * Allocates a memory object for a new control instance. The instance has
    224 * elements as many as the given number (@count). Each element has given
    225 * access permissions (@access). Each element is locked when @file is given.
    226 *
    227 * Return: 0 on success, error code on failure
    228 */
    229static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
    230		       unsigned int access, struct snd_ctl_file *file)
    231{
    232	unsigned int idx;
    233
    234	if (count == 0 || count > MAX_CONTROL_COUNT)
    235		return -EINVAL;
    236
    237	*kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
    238	if (!*kctl)
    239		return -ENOMEM;
    240
    241	for (idx = 0; idx < count; idx++) {
    242		(*kctl)->vd[idx].access = access;
    243		(*kctl)->vd[idx].owner = file;
    244	}
    245	(*kctl)->count = count;
    246
    247	return 0;
    248}
    249
    250/**
    251 * snd_ctl_new1 - create a control instance from the template
    252 * @ncontrol: the initialization record
    253 * @private_data: the private data to set
    254 *
    255 * Allocates a new struct snd_kcontrol instance and initialize from the given
    256 * template.  When the access field of ncontrol is 0, it's assumed as
    257 * READWRITE access. When the count field is 0, it's assumes as one.
    258 *
    259 * Return: The pointer of the newly generated instance, or %NULL on failure.
    260 */
    261struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
    262				  void *private_data)
    263{
    264	struct snd_kcontrol *kctl;
    265	unsigned int count;
    266	unsigned int access;
    267	int err;
    268
    269	if (snd_BUG_ON(!ncontrol || !ncontrol->info))
    270		return NULL;
    271
    272	count = ncontrol->count;
    273	if (count == 0)
    274		count = 1;
    275
    276	access = ncontrol->access;
    277	if (access == 0)
    278		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
    279	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
    280		   SNDRV_CTL_ELEM_ACCESS_VOLATILE |
    281		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
    282		   SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
    283		   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
    284		   SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
    285		   SNDRV_CTL_ELEM_ACCESS_LED_MASK |
    286		   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
    287
    288	err = snd_ctl_new(&kctl, count, access, NULL);
    289	if (err < 0)
    290		return NULL;
    291
    292	/* The 'numid' member is decided when calling snd_ctl_add(). */
    293	kctl->id.iface = ncontrol->iface;
    294	kctl->id.device = ncontrol->device;
    295	kctl->id.subdevice = ncontrol->subdevice;
    296	if (ncontrol->name) {
    297		strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
    298		if (strcmp(ncontrol->name, kctl->id.name) != 0)
    299			pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
    300				ncontrol->name, kctl->id.name);
    301	}
    302	kctl->id.index = ncontrol->index;
    303
    304	kctl->info = ncontrol->info;
    305	kctl->get = ncontrol->get;
    306	kctl->put = ncontrol->put;
    307	kctl->tlv.p = ncontrol->tlv.p;
    308
    309	kctl->private_value = ncontrol->private_value;
    310	kctl->private_data = private_data;
    311
    312	return kctl;
    313}
    314EXPORT_SYMBOL(snd_ctl_new1);
    315
    316/**
    317 * snd_ctl_free_one - release the control instance
    318 * @kcontrol: the control instance
    319 *
    320 * Releases the control instance created via snd_ctl_new()
    321 * or snd_ctl_new1().
    322 * Don't call this after the control was added to the card.
    323 */
    324void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
    325{
    326	if (kcontrol) {
    327		if (kcontrol->private_free)
    328			kcontrol->private_free(kcontrol);
    329		kfree(kcontrol);
    330	}
    331}
    332EXPORT_SYMBOL(snd_ctl_free_one);
    333
    334static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
    335					  unsigned int count)
    336{
    337	struct snd_kcontrol *kctl;
    338
    339	/* Make sure that the ids assigned to the control do not wrap around */
    340	if (card->last_numid >= UINT_MAX - count)
    341		card->last_numid = 0;
    342
    343	list_for_each_entry(kctl, &card->controls, list) {
    344		if (kctl->id.numid < card->last_numid + 1 + count &&
    345		    kctl->id.numid + kctl->count > card->last_numid + 1) {
    346		    	card->last_numid = kctl->id.numid + kctl->count - 1;
    347			return true;
    348		}
    349	}
    350	return false;
    351}
    352
    353static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
    354{
    355	unsigned int iter = 100000;
    356
    357	while (snd_ctl_remove_numid_conflict(card, count)) {
    358		if (--iter == 0) {
    359			/* this situation is very unlikely */
    360			dev_err(card->dev, "unable to allocate new control numid\n");
    361			return -ENOMEM;
    362		}
    363	}
    364	return 0;
    365}
    366
    367enum snd_ctl_add_mode {
    368	CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
    369};
    370
    371/* add/replace a new kcontrol object; call with card->controls_rwsem locked */
    372static int __snd_ctl_add_replace(struct snd_card *card,
    373				 struct snd_kcontrol *kcontrol,
    374				 enum snd_ctl_add_mode mode)
    375{
    376	struct snd_ctl_elem_id id;
    377	unsigned int idx;
    378	struct snd_kcontrol *old;
    379	int err;
    380
    381	id = kcontrol->id;
    382	if (id.index > UINT_MAX - kcontrol->count)
    383		return -EINVAL;
    384
    385	old = snd_ctl_find_id(card, &id);
    386	if (!old) {
    387		if (mode == CTL_REPLACE)
    388			return -EINVAL;
    389	} else {
    390		if (mode == CTL_ADD_EXCLUSIVE) {
    391			dev_err(card->dev,
    392				"control %i:%i:%i:%s:%i is already present\n",
    393				id.iface, id.device, id.subdevice, id.name,
    394				id.index);
    395			return -EBUSY;
    396		}
    397
    398		err = snd_ctl_remove(card, old);
    399		if (err < 0)
    400			return err;
    401	}
    402
    403	if (snd_ctl_find_hole(card, kcontrol->count) < 0)
    404		return -ENOMEM;
    405
    406	list_add_tail(&kcontrol->list, &card->controls);
    407	card->controls_count += kcontrol->count;
    408	kcontrol->id.numid = card->last_numid + 1;
    409	card->last_numid += kcontrol->count;
    410
    411	for (idx = 0; idx < kcontrol->count; idx++)
    412		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
    413
    414	return 0;
    415}
    416
    417static int snd_ctl_add_replace(struct snd_card *card,
    418			       struct snd_kcontrol *kcontrol,
    419			       enum snd_ctl_add_mode mode)
    420{
    421	int err = -EINVAL;
    422
    423	if (! kcontrol)
    424		return err;
    425	if (snd_BUG_ON(!card || !kcontrol->info))
    426		goto error;
    427
    428	down_write(&card->controls_rwsem);
    429	err = __snd_ctl_add_replace(card, kcontrol, mode);
    430	up_write(&card->controls_rwsem);
    431	if (err < 0)
    432		goto error;
    433	return 0;
    434
    435 error:
    436	snd_ctl_free_one(kcontrol);
    437	return err;
    438}
    439
    440/**
    441 * snd_ctl_add - add the control instance to the card
    442 * @card: the card instance
    443 * @kcontrol: the control instance to add
    444 *
    445 * Adds the control instance created via snd_ctl_new() or
    446 * snd_ctl_new1() to the given card. Assigns also an unique
    447 * numid used for fast search.
    448 *
    449 * It frees automatically the control which cannot be added.
    450 *
    451 * Return: Zero if successful, or a negative error code on failure.
    452 *
    453 */
    454int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
    455{
    456	return snd_ctl_add_replace(card, kcontrol, CTL_ADD_EXCLUSIVE);
    457}
    458EXPORT_SYMBOL(snd_ctl_add);
    459
    460/**
    461 * snd_ctl_replace - replace the control instance of the card
    462 * @card: the card instance
    463 * @kcontrol: the control instance to replace
    464 * @add_on_replace: add the control if not already added
    465 *
    466 * Replaces the given control.  If the given control does not exist
    467 * and the add_on_replace flag is set, the control is added.  If the
    468 * control exists, it is destroyed first.
    469 *
    470 * It frees automatically the control which cannot be added or replaced.
    471 *
    472 * Return: Zero if successful, or a negative error code on failure.
    473 */
    474int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
    475		    bool add_on_replace)
    476{
    477	return snd_ctl_add_replace(card, kcontrol,
    478				   add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
    479}
    480EXPORT_SYMBOL(snd_ctl_replace);
    481
    482/**
    483 * snd_ctl_remove - remove the control from the card and release it
    484 * @card: the card instance
    485 * @kcontrol: the control instance to remove
    486 *
    487 * Removes the control from the card and then releases the instance.
    488 * You don't need to call snd_ctl_free_one(). You must be in
    489 * the write lock - down_write(&card->controls_rwsem).
    490 *
    491 * Return: 0 if successful, or a negative error code on failure.
    492 */
    493int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
    494{
    495	unsigned int idx;
    496
    497	if (snd_BUG_ON(!card || !kcontrol))
    498		return -EINVAL;
    499	list_del(&kcontrol->list);
    500	card->controls_count -= kcontrol->count;
    501	for (idx = 0; idx < kcontrol->count; idx++)
    502		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
    503	snd_ctl_free_one(kcontrol);
    504	return 0;
    505}
    506EXPORT_SYMBOL(snd_ctl_remove);
    507
    508/**
    509 * snd_ctl_remove_id - remove the control of the given id and release it
    510 * @card: the card instance
    511 * @id: the control id to remove
    512 *
    513 * Finds the control instance with the given id, removes it from the
    514 * card list and releases it.
    515 *
    516 * Return: 0 if successful, or a negative error code on failure.
    517 */
    518int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
    519{
    520	struct snd_kcontrol *kctl;
    521	int ret;
    522
    523	down_write(&card->controls_rwsem);
    524	kctl = snd_ctl_find_id(card, id);
    525	if (kctl == NULL) {
    526		up_write(&card->controls_rwsem);
    527		return -ENOENT;
    528	}
    529	ret = snd_ctl_remove(card, kctl);
    530	up_write(&card->controls_rwsem);
    531	return ret;
    532}
    533EXPORT_SYMBOL(snd_ctl_remove_id);
    534
    535/**
    536 * snd_ctl_remove_user_ctl - remove and release the unlocked user control
    537 * @file: active control handle
    538 * @id: the control id to remove
    539 *
    540 * Finds the control instance with the given id, removes it from the
    541 * card list and releases it.
    542 *
    543 * Return: 0 if successful, or a negative error code on failure.
    544 */
    545static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
    546				   struct snd_ctl_elem_id *id)
    547{
    548	struct snd_card *card = file->card;
    549	struct snd_kcontrol *kctl;
    550	int idx, ret;
    551
    552	down_write(&card->controls_rwsem);
    553	kctl = snd_ctl_find_id(card, id);
    554	if (kctl == NULL) {
    555		ret = -ENOENT;
    556		goto error;
    557	}
    558	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
    559		ret = -EINVAL;
    560		goto error;
    561	}
    562	for (idx = 0; idx < kctl->count; idx++)
    563		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
    564			ret = -EBUSY;
    565			goto error;
    566		}
    567	ret = snd_ctl_remove(card, kctl);
    568error:
    569	up_write(&card->controls_rwsem);
    570	return ret;
    571}
    572
    573/**
    574 * snd_ctl_activate_id - activate/inactivate the control of the given id
    575 * @card: the card instance
    576 * @id: the control id to activate/inactivate
    577 * @active: non-zero to activate
    578 *
    579 * Finds the control instance with the given id, and activate or
    580 * inactivate the control together with notification, if changed.
    581 * The given ID data is filled with full information.
    582 *
    583 * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
    584 */
    585int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
    586			int active)
    587{
    588	struct snd_kcontrol *kctl;
    589	struct snd_kcontrol_volatile *vd;
    590	unsigned int index_offset;
    591	int ret;
    592
    593	down_write(&card->controls_rwsem);
    594	kctl = snd_ctl_find_id(card, id);
    595	if (kctl == NULL) {
    596		ret = -ENOENT;
    597		goto unlock;
    598	}
    599	index_offset = snd_ctl_get_ioff(kctl, id);
    600	vd = &kctl->vd[index_offset];
    601	ret = 0;
    602	if (active) {
    603		if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
    604			goto unlock;
    605		vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
    606	} else {
    607		if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
    608			goto unlock;
    609		vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
    610	}
    611	snd_ctl_build_ioff(id, kctl, index_offset);
    612	downgrade_write(&card->controls_rwsem);
    613	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
    614	up_read(&card->controls_rwsem);
    615	return 1;
    616
    617 unlock:
    618	up_write(&card->controls_rwsem);
    619	return ret;
    620}
    621EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
    622
    623/**
    624 * snd_ctl_rename_id - replace the id of a control on the card
    625 * @card: the card instance
    626 * @src_id: the old id
    627 * @dst_id: the new id
    628 *
    629 * Finds the control with the old id from the card, and replaces the
    630 * id with the new one.
    631 *
    632 * Return: Zero if successful, or a negative error code on failure.
    633 */
    634int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
    635		      struct snd_ctl_elem_id *dst_id)
    636{
    637	struct snd_kcontrol *kctl;
    638
    639	down_write(&card->controls_rwsem);
    640	kctl = snd_ctl_find_id(card, src_id);
    641	if (kctl == NULL) {
    642		up_write(&card->controls_rwsem);
    643		return -ENOENT;
    644	}
    645	kctl->id = *dst_id;
    646	kctl->id.numid = card->last_numid + 1;
    647	card->last_numid += kctl->count;
    648	up_write(&card->controls_rwsem);
    649	return 0;
    650}
    651EXPORT_SYMBOL(snd_ctl_rename_id);
    652
    653/**
    654 * snd_ctl_find_numid - find the control instance with the given number-id
    655 * @card: the card instance
    656 * @numid: the number-id to search
    657 *
    658 * Finds the control instance with the given number-id from the card.
    659 *
    660 * The caller must down card->controls_rwsem before calling this function
    661 * (if the race condition can happen).
    662 *
    663 * Return: The pointer of the instance if found, or %NULL if not.
    664 *
    665 */
    666struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card, unsigned int numid)
    667{
    668	struct snd_kcontrol *kctl;
    669
    670	if (snd_BUG_ON(!card || !numid))
    671		return NULL;
    672	list_for_each_entry(kctl, &card->controls, list) {
    673		if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
    674			return kctl;
    675	}
    676	return NULL;
    677}
    678EXPORT_SYMBOL(snd_ctl_find_numid);
    679
    680/**
    681 * snd_ctl_find_id - find the control instance with the given id
    682 * @card: the card instance
    683 * @id: the id to search
    684 *
    685 * Finds the control instance with the given id from the card.
    686 *
    687 * The caller must down card->controls_rwsem before calling this function
    688 * (if the race condition can happen).
    689 *
    690 * Return: The pointer of the instance if found, or %NULL if not.
    691 *
    692 */
    693struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
    694				     struct snd_ctl_elem_id *id)
    695{
    696	struct snd_kcontrol *kctl;
    697
    698	if (snd_BUG_ON(!card || !id))
    699		return NULL;
    700	if (id->numid != 0)
    701		return snd_ctl_find_numid(card, id->numid);
    702	list_for_each_entry(kctl, &card->controls, list) {
    703		if (kctl->id.iface != id->iface)
    704			continue;
    705		if (kctl->id.device != id->device)
    706			continue;
    707		if (kctl->id.subdevice != id->subdevice)
    708			continue;
    709		if (strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)))
    710			continue;
    711		if (kctl->id.index > id->index)
    712			continue;
    713		if (kctl->id.index + kctl->count <= id->index)
    714			continue;
    715		return kctl;
    716	}
    717	return NULL;
    718}
    719EXPORT_SYMBOL(snd_ctl_find_id);
    720
    721static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
    722			     unsigned int cmd, void __user *arg)
    723{
    724	struct snd_ctl_card_info *info;
    725
    726	info = kzalloc(sizeof(*info), GFP_KERNEL);
    727	if (! info)
    728		return -ENOMEM;
    729	down_read(&snd_ioctl_rwsem);
    730	info->card = card->number;
    731	strscpy(info->id, card->id, sizeof(info->id));
    732	strscpy(info->driver, card->driver, sizeof(info->driver));
    733	strscpy(info->name, card->shortname, sizeof(info->name));
    734	strscpy(info->longname, card->longname, sizeof(info->longname));
    735	strscpy(info->mixername, card->mixername, sizeof(info->mixername));
    736	strscpy(info->components, card->components, sizeof(info->components));
    737	up_read(&snd_ioctl_rwsem);
    738	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
    739		kfree(info);
    740		return -EFAULT;
    741	}
    742	kfree(info);
    743	return 0;
    744}
    745
    746static int snd_ctl_elem_list(struct snd_card *card,
    747			     struct snd_ctl_elem_list *list)
    748{
    749	struct snd_kcontrol *kctl;
    750	struct snd_ctl_elem_id id;
    751	unsigned int offset, space, jidx;
    752	int err = 0;
    753
    754	offset = list->offset;
    755	space = list->space;
    756
    757	down_read(&card->controls_rwsem);
    758	list->count = card->controls_count;
    759	list->used = 0;
    760	if (space > 0) {
    761		list_for_each_entry(kctl, &card->controls, list) {
    762			if (offset >= kctl->count) {
    763				offset -= kctl->count;
    764				continue;
    765			}
    766			for (jidx = offset; jidx < kctl->count; jidx++) {
    767				snd_ctl_build_ioff(&id, kctl, jidx);
    768				if (copy_to_user(list->pids + list->used, &id,
    769						 sizeof(id))) {
    770					err = -EFAULT;
    771					goto out;
    772				}
    773				list->used++;
    774				if (!--space)
    775					goto out;
    776			}
    777			offset = 0;
    778		}
    779	}
    780 out:
    781	up_read(&card->controls_rwsem);
    782	return err;
    783}
    784
    785static int snd_ctl_elem_list_user(struct snd_card *card,
    786				  struct snd_ctl_elem_list __user *_list)
    787{
    788	struct snd_ctl_elem_list list;
    789	int err;
    790
    791	if (copy_from_user(&list, _list, sizeof(list)))
    792		return -EFAULT;
    793	err = snd_ctl_elem_list(card, &list);
    794	if (err)
    795		return err;
    796	if (copy_to_user(_list, &list, sizeof(list)))
    797		return -EFAULT;
    798
    799	return 0;
    800}
    801
    802/* Check whether the given kctl info is valid */
    803static int snd_ctl_check_elem_info(struct snd_card *card,
    804				   const struct snd_ctl_elem_info *info)
    805{
    806	static const unsigned int max_value_counts[] = {
    807		[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= 128,
    808		[SNDRV_CTL_ELEM_TYPE_INTEGER]	= 128,
    809		[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
    810		[SNDRV_CTL_ELEM_TYPE_BYTES]	= 512,
    811		[SNDRV_CTL_ELEM_TYPE_IEC958]	= 1,
    812		[SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
    813	};
    814
    815	if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
    816	    info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
    817		if (card)
    818			dev_err(card->dev,
    819				"control %i:%i:%i:%s:%i: invalid type %d\n",
    820				info->id.iface, info->id.device,
    821				info->id.subdevice, info->id.name,
    822				info->id.index, info->type);
    823		return -EINVAL;
    824	}
    825	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
    826	    info->value.enumerated.items == 0) {
    827		if (card)
    828			dev_err(card->dev,
    829				"control %i:%i:%i:%s:%i: zero enum items\n",
    830				info->id.iface, info->id.device,
    831				info->id.subdevice, info->id.name,
    832				info->id.index);
    833		return -EINVAL;
    834	}
    835	if (info->count > max_value_counts[info->type]) {
    836		if (card)
    837			dev_err(card->dev,
    838				"control %i:%i:%i:%s:%i: invalid count %d\n",
    839				info->id.iface, info->id.device,
    840				info->id.subdevice, info->id.name,
    841				info->id.index, info->count);
    842		return -EINVAL;
    843	}
    844
    845	return 0;
    846}
    847
    848/* The capacity of struct snd_ctl_elem_value.value.*/
    849static const unsigned int value_sizes[] = {
    850	[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= sizeof(long),
    851	[SNDRV_CTL_ELEM_TYPE_INTEGER]	= sizeof(long),
    852	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
    853	[SNDRV_CTL_ELEM_TYPE_BYTES]	= sizeof(unsigned char),
    854	[SNDRV_CTL_ELEM_TYPE_IEC958]	= sizeof(struct snd_aes_iec958),
    855	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
    856};
    857
    858#ifdef CONFIG_SND_CTL_VALIDATION
    859/* fill the remaining snd_ctl_elem_value data with the given pattern */
    860static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
    861				      struct snd_ctl_elem_info *info,
    862				      u32 pattern)
    863{
    864	size_t offset = value_sizes[info->type] * info->count;
    865
    866	offset = DIV_ROUND_UP(offset, sizeof(u32));
    867	memset32((u32 *)control->value.bytes.data + offset, pattern,
    868		 sizeof(control->value) / sizeof(u32) - offset);
    869}
    870
    871/* check whether the given integer ctl value is valid */
    872static int sanity_check_int_value(struct snd_card *card,
    873				  const struct snd_ctl_elem_value *control,
    874				  const struct snd_ctl_elem_info *info,
    875				  int i)
    876{
    877	long long lval, lmin, lmax, lstep;
    878	u64 rem;
    879
    880	switch (info->type) {
    881	default:
    882	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
    883		lval = control->value.integer.value[i];
    884		lmin = 0;
    885		lmax = 1;
    886		lstep = 0;
    887		break;
    888	case SNDRV_CTL_ELEM_TYPE_INTEGER:
    889		lval = control->value.integer.value[i];
    890		lmin = info->value.integer.min;
    891		lmax = info->value.integer.max;
    892		lstep = info->value.integer.step;
    893		break;
    894	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
    895		lval = control->value.integer64.value[i];
    896		lmin = info->value.integer64.min;
    897		lmax = info->value.integer64.max;
    898		lstep = info->value.integer64.step;
    899		break;
    900	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
    901		lval = control->value.enumerated.item[i];
    902		lmin = 0;
    903		lmax = info->value.enumerated.items - 1;
    904		lstep = 0;
    905		break;
    906	}
    907
    908	if (lval < lmin || lval > lmax) {
    909		dev_err(card->dev,
    910			"control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
    911			control->id.iface, control->id.device,
    912			control->id.subdevice, control->id.name,
    913			control->id.index, lval, lmin, lmax, i);
    914		return -EINVAL;
    915	}
    916	if (lstep) {
    917		div64_u64_rem(lval, lstep, &rem);
    918		if (rem) {
    919			dev_err(card->dev,
    920				"control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
    921				control->id.iface, control->id.device,
    922				control->id.subdevice, control->id.name,
    923				control->id.index, lval, lstep, i);
    924			return -EINVAL;
    925		}
    926	}
    927
    928	return 0;
    929}
    930
    931/* perform sanity checks to the given snd_ctl_elem_value object */
    932static int sanity_check_elem_value(struct snd_card *card,
    933				   const struct snd_ctl_elem_value *control,
    934				   const struct snd_ctl_elem_info *info,
    935				   u32 pattern)
    936{
    937	size_t offset;
    938	int i, ret = 0;
    939	u32 *p;
    940
    941	switch (info->type) {
    942	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
    943	case SNDRV_CTL_ELEM_TYPE_INTEGER:
    944	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
    945	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
    946		for (i = 0; i < info->count; i++) {
    947			ret = sanity_check_int_value(card, control, info, i);
    948			if (ret < 0)
    949				return ret;
    950		}
    951		break;
    952	default:
    953		break;
    954	}
    955
    956	/* check whether the remaining area kept untouched */
    957	offset = value_sizes[info->type] * info->count;
    958	offset = DIV_ROUND_UP(offset, sizeof(u32));
    959	p = (u32 *)control->value.bytes.data + offset;
    960	for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
    961		if (*p != pattern) {
    962			ret = -EINVAL;
    963			break;
    964		}
    965		*p = 0; /* clear the checked area */
    966	}
    967
    968	return ret;
    969}
    970#else
    971static inline void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
    972					     struct snd_ctl_elem_info *info,
    973					     u32 pattern)
    974{
    975}
    976
    977static inline int sanity_check_elem_value(struct snd_card *card,
    978					  struct snd_ctl_elem_value *control,
    979					  struct snd_ctl_elem_info *info,
    980					  u32 pattern)
    981{
    982	return 0;
    983}
    984#endif
    985
    986static int __snd_ctl_elem_info(struct snd_card *card,
    987			       struct snd_kcontrol *kctl,
    988			       struct snd_ctl_elem_info *info,
    989			       struct snd_ctl_file *ctl)
    990{
    991	struct snd_kcontrol_volatile *vd;
    992	unsigned int index_offset;
    993	int result;
    994
    995#ifdef CONFIG_SND_DEBUG
    996	info->access = 0;
    997#endif
    998	result = snd_power_ref_and_wait(card);
    999	if (!result)
   1000		result = kctl->info(kctl, info);
   1001	snd_power_unref(card);
   1002	if (result >= 0) {
   1003		snd_BUG_ON(info->access);
   1004		index_offset = snd_ctl_get_ioff(kctl, &info->id);
   1005		vd = &kctl->vd[index_offset];
   1006		snd_ctl_build_ioff(&info->id, kctl, index_offset);
   1007		info->access = vd->access;
   1008		if (vd->owner) {
   1009			info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
   1010			if (vd->owner == ctl)
   1011				info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
   1012			info->owner = pid_vnr(vd->owner->pid);
   1013		} else {
   1014			info->owner = -1;
   1015		}
   1016		if (!snd_ctl_skip_validation(info) &&
   1017		    snd_ctl_check_elem_info(card, info) < 0)
   1018			result = -EINVAL;
   1019	}
   1020	return result;
   1021}
   1022
   1023static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
   1024			     struct snd_ctl_elem_info *info)
   1025{
   1026	struct snd_card *card = ctl->card;
   1027	struct snd_kcontrol *kctl;
   1028	int result;
   1029
   1030	down_read(&card->controls_rwsem);
   1031	kctl = snd_ctl_find_id(card, &info->id);
   1032	if (kctl == NULL)
   1033		result = -ENOENT;
   1034	else
   1035		result = __snd_ctl_elem_info(card, kctl, info, ctl);
   1036	up_read(&card->controls_rwsem);
   1037	return result;
   1038}
   1039
   1040static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
   1041				  struct snd_ctl_elem_info __user *_info)
   1042{
   1043	struct snd_ctl_elem_info info;
   1044	int result;
   1045
   1046	if (copy_from_user(&info, _info, sizeof(info)))
   1047		return -EFAULT;
   1048	result = snd_ctl_elem_info(ctl, &info);
   1049	if (result < 0)
   1050		return result;
   1051	/* drop internal access flags */
   1052	info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
   1053			 SNDRV_CTL_ELEM_ACCESS_LED_MASK);
   1054	if (copy_to_user(_info, &info, sizeof(info)))
   1055		return -EFAULT;
   1056	return result;
   1057}
   1058
   1059static int snd_ctl_elem_read(struct snd_card *card,
   1060			     struct snd_ctl_elem_value *control)
   1061{
   1062	struct snd_kcontrol *kctl;
   1063	struct snd_kcontrol_volatile *vd;
   1064	unsigned int index_offset;
   1065	struct snd_ctl_elem_info info;
   1066	const u32 pattern = 0xdeadbeef;
   1067	int ret;
   1068
   1069	kctl = snd_ctl_find_id(card, &control->id);
   1070	if (kctl == NULL)
   1071		return -ENOENT;
   1072
   1073	index_offset = snd_ctl_get_ioff(kctl, &control->id);
   1074	vd = &kctl->vd[index_offset];
   1075	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL)
   1076		return -EPERM;
   1077
   1078	snd_ctl_build_ioff(&control->id, kctl, index_offset);
   1079
   1080#ifdef CONFIG_SND_CTL_VALIDATION
   1081	/* info is needed only for validation */
   1082	memset(&info, 0, sizeof(info));
   1083	info.id = control->id;
   1084	ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
   1085	if (ret < 0)
   1086		return ret;
   1087#endif
   1088
   1089	if (!snd_ctl_skip_validation(&info))
   1090		fill_remaining_elem_value(control, &info, pattern);
   1091	ret = snd_power_ref_and_wait(card);
   1092	if (!ret)
   1093		ret = kctl->get(kctl, control);
   1094	snd_power_unref(card);
   1095	if (ret < 0)
   1096		return ret;
   1097	if (!snd_ctl_skip_validation(&info) &&
   1098	    sanity_check_elem_value(card, control, &info, pattern) < 0) {
   1099		dev_err(card->dev,
   1100			"control %i:%i:%i:%s:%i: access overflow\n",
   1101			control->id.iface, control->id.device,
   1102			control->id.subdevice, control->id.name,
   1103			control->id.index);
   1104		return -EINVAL;
   1105	}
   1106	return ret;
   1107}
   1108
   1109static int snd_ctl_elem_read_user(struct snd_card *card,
   1110				  struct snd_ctl_elem_value __user *_control)
   1111{
   1112	struct snd_ctl_elem_value *control;
   1113	int result;
   1114
   1115	control = memdup_user(_control, sizeof(*control));
   1116	if (IS_ERR(control))
   1117		return PTR_ERR(control);
   1118
   1119	down_read(&card->controls_rwsem);
   1120	result = snd_ctl_elem_read(card, control);
   1121	up_read(&card->controls_rwsem);
   1122	if (result < 0)
   1123		goto error;
   1124
   1125	if (copy_to_user(_control, control, sizeof(*control)))
   1126		result = -EFAULT;
   1127 error:
   1128	kfree(control);
   1129	return result;
   1130}
   1131
   1132static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
   1133			      struct snd_ctl_elem_value *control)
   1134{
   1135	struct snd_kcontrol *kctl;
   1136	struct snd_kcontrol_volatile *vd;
   1137	unsigned int index_offset;
   1138	int result;
   1139
   1140	down_write(&card->controls_rwsem);
   1141	kctl = snd_ctl_find_id(card, &control->id);
   1142	if (kctl == NULL) {
   1143		up_write(&card->controls_rwsem);
   1144		return -ENOENT;
   1145	}
   1146
   1147	index_offset = snd_ctl_get_ioff(kctl, &control->id);
   1148	vd = &kctl->vd[index_offset];
   1149	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
   1150	    (file && vd->owner && vd->owner != file)) {
   1151		up_write(&card->controls_rwsem);
   1152		return -EPERM;
   1153	}
   1154
   1155	snd_ctl_build_ioff(&control->id, kctl, index_offset);
   1156	result = snd_power_ref_and_wait(card);
   1157	if (!result)
   1158		result = kctl->put(kctl, control);
   1159	snd_power_unref(card);
   1160	if (result < 0) {
   1161		up_write(&card->controls_rwsem);
   1162		return result;
   1163	}
   1164
   1165	if (result > 0) {
   1166		downgrade_write(&card->controls_rwsem);
   1167		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
   1168		up_read(&card->controls_rwsem);
   1169	} else {
   1170		up_write(&card->controls_rwsem);
   1171	}
   1172
   1173	return 0;
   1174}
   1175
   1176static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
   1177				   struct snd_ctl_elem_value __user *_control)
   1178{
   1179	struct snd_ctl_elem_value *control;
   1180	struct snd_card *card;
   1181	int result;
   1182
   1183	control = memdup_user(_control, sizeof(*control));
   1184	if (IS_ERR(control))
   1185		return PTR_ERR(control);
   1186
   1187	card = file->card;
   1188	result = snd_ctl_elem_write(card, file, control);
   1189	if (result < 0)
   1190		goto error;
   1191
   1192	if (copy_to_user(_control, control, sizeof(*control)))
   1193		result = -EFAULT;
   1194 error:
   1195	kfree(control);
   1196	return result;
   1197}
   1198
   1199static int snd_ctl_elem_lock(struct snd_ctl_file *file,
   1200			     struct snd_ctl_elem_id __user *_id)
   1201{
   1202	struct snd_card *card = file->card;
   1203	struct snd_ctl_elem_id id;
   1204	struct snd_kcontrol *kctl;
   1205	struct snd_kcontrol_volatile *vd;
   1206	int result;
   1207
   1208	if (copy_from_user(&id, _id, sizeof(id)))
   1209		return -EFAULT;
   1210	down_write(&card->controls_rwsem);
   1211	kctl = snd_ctl_find_id(card, &id);
   1212	if (kctl == NULL) {
   1213		result = -ENOENT;
   1214	} else {
   1215		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
   1216		if (vd->owner != NULL)
   1217			result = -EBUSY;
   1218		else {
   1219			vd->owner = file;
   1220			result = 0;
   1221		}
   1222	}
   1223	up_write(&card->controls_rwsem);
   1224	return result;
   1225}
   1226
   1227static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
   1228			       struct snd_ctl_elem_id __user *_id)
   1229{
   1230	struct snd_card *card = file->card;
   1231	struct snd_ctl_elem_id id;
   1232	struct snd_kcontrol *kctl;
   1233	struct snd_kcontrol_volatile *vd;
   1234	int result;
   1235
   1236	if (copy_from_user(&id, _id, sizeof(id)))
   1237		return -EFAULT;
   1238	down_write(&card->controls_rwsem);
   1239	kctl = snd_ctl_find_id(card, &id);
   1240	if (kctl == NULL) {
   1241		result = -ENOENT;
   1242	} else {
   1243		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
   1244		if (vd->owner == NULL)
   1245			result = -EINVAL;
   1246		else if (vd->owner != file)
   1247			result = -EPERM;
   1248		else {
   1249			vd->owner = NULL;
   1250			result = 0;
   1251		}
   1252	}
   1253	up_write(&card->controls_rwsem);
   1254	return result;
   1255}
   1256
   1257struct user_element {
   1258	struct snd_ctl_elem_info info;
   1259	struct snd_card *card;
   1260	char *elem_data;		/* element data */
   1261	unsigned long elem_data_size;	/* size of element data in bytes */
   1262	void *tlv_data;			/* TLV data */
   1263	unsigned long tlv_data_size;	/* TLV data size */
   1264	void *priv_data;		/* private data (like strings for enumerated type) */
   1265};
   1266
   1267// check whether the addition (in bytes) of user ctl element may overflow the limit.
   1268static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
   1269{
   1270	return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
   1271}
   1272
   1273static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
   1274				  struct snd_ctl_elem_info *uinfo)
   1275{
   1276	struct user_element *ue = kcontrol->private_data;
   1277	unsigned int offset;
   1278
   1279	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
   1280	*uinfo = ue->info;
   1281	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
   1282
   1283	return 0;
   1284}
   1285
   1286static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
   1287				       struct snd_ctl_elem_info *uinfo)
   1288{
   1289	struct user_element *ue = kcontrol->private_data;
   1290	const char *names;
   1291	unsigned int item;
   1292	unsigned int offset;
   1293
   1294	item = uinfo->value.enumerated.item;
   1295
   1296	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
   1297	*uinfo = ue->info;
   1298	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
   1299
   1300	item = min(item, uinfo->value.enumerated.items - 1);
   1301	uinfo->value.enumerated.item = item;
   1302
   1303	names = ue->priv_data;
   1304	for (; item > 0; --item)
   1305		names += strlen(names) + 1;
   1306	strcpy(uinfo->value.enumerated.name, names);
   1307
   1308	return 0;
   1309}
   1310
   1311static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
   1312				 struct snd_ctl_elem_value *ucontrol)
   1313{
   1314	struct user_element *ue = kcontrol->private_data;
   1315	unsigned int size = ue->elem_data_size;
   1316	char *src = ue->elem_data +
   1317			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
   1318
   1319	memcpy(&ucontrol->value, src, size);
   1320	return 0;
   1321}
   1322
   1323static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
   1324				 struct snd_ctl_elem_value *ucontrol)
   1325{
   1326	int change;
   1327	struct user_element *ue = kcontrol->private_data;
   1328	unsigned int size = ue->elem_data_size;
   1329	char *dst = ue->elem_data +
   1330			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
   1331
   1332	change = memcmp(&ucontrol->value, dst, size) != 0;
   1333	if (change)
   1334		memcpy(dst, &ucontrol->value, size);
   1335	return change;
   1336}
   1337
   1338/* called in controls_rwsem write lock */
   1339static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
   1340			    unsigned int size)
   1341{
   1342	struct user_element *ue = kctl->private_data;
   1343	unsigned int *container;
   1344	unsigned int mask = 0;
   1345	int i;
   1346	int change;
   1347
   1348	if (size > 1024 * 128)	/* sane value */
   1349		return -EINVAL;
   1350
   1351	// does the TLV size change cause overflow?
   1352	if (check_user_elem_overflow(ue->card, (ssize_t)(size - ue->tlv_data_size)))
   1353		return -ENOMEM;
   1354
   1355	container = vmemdup_user(buf, size);
   1356	if (IS_ERR(container))
   1357		return PTR_ERR(container);
   1358
   1359	change = ue->tlv_data_size != size;
   1360	if (!change)
   1361		change = memcmp(ue->tlv_data, container, size) != 0;
   1362	if (!change) {
   1363		kvfree(container);
   1364		return 0;
   1365	}
   1366
   1367	if (ue->tlv_data == NULL) {
   1368		/* Now TLV data is available. */
   1369		for (i = 0; i < kctl->count; ++i)
   1370			kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
   1371		mask = SNDRV_CTL_EVENT_MASK_INFO;
   1372	} else {
   1373		ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
   1374		ue->tlv_data_size = 0;
   1375		kvfree(ue->tlv_data);
   1376	}
   1377
   1378	ue->tlv_data = container;
   1379	ue->tlv_data_size = size;
   1380	// decremented at private_free.
   1381	ue->card->user_ctl_alloc_size += size;
   1382
   1383	mask |= SNDRV_CTL_EVENT_MASK_TLV;
   1384	for (i = 0; i < kctl->count; ++i)
   1385		snd_ctl_notify_one(ue->card, mask, kctl, i);
   1386
   1387	return change;
   1388}
   1389
   1390static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
   1391			 unsigned int size)
   1392{
   1393	struct user_element *ue = kctl->private_data;
   1394
   1395	if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
   1396		return -ENXIO;
   1397
   1398	if (size < ue->tlv_data_size)
   1399		return -ENOSPC;
   1400
   1401	if (copy_to_user(buf, ue->tlv_data, ue->tlv_data_size))
   1402		return -EFAULT;
   1403
   1404	return 0;
   1405}
   1406
   1407static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
   1408				 unsigned int size, unsigned int __user *buf)
   1409{
   1410	if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
   1411		return replace_user_tlv(kctl, buf, size);
   1412	else
   1413		return read_user_tlv(kctl, buf, size);
   1414}
   1415
   1416/* called in controls_rwsem write lock */
   1417static int snd_ctl_elem_init_enum_names(struct user_element *ue)
   1418{
   1419	char *names, *p;
   1420	size_t buf_len, name_len;
   1421	unsigned int i;
   1422	const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
   1423
   1424	buf_len = ue->info.value.enumerated.names_length;
   1425	if (buf_len > 64 * 1024)
   1426		return -EINVAL;
   1427
   1428	if (check_user_elem_overflow(ue->card, buf_len))
   1429		return -ENOMEM;
   1430	names = vmemdup_user((const void __user *)user_ptrval, buf_len);
   1431	if (IS_ERR(names))
   1432		return PTR_ERR(names);
   1433
   1434	/* check that there are enough valid names */
   1435	p = names;
   1436	for (i = 0; i < ue->info.value.enumerated.items; ++i) {
   1437		name_len = strnlen(p, buf_len);
   1438		if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
   1439			kvfree(names);
   1440			return -EINVAL;
   1441		}
   1442		p += name_len + 1;
   1443		buf_len -= name_len + 1;
   1444	}
   1445
   1446	ue->priv_data = names;
   1447	ue->info.value.enumerated.names_ptr = 0;
   1448	// increment the allocation size; decremented again at private_free.
   1449	ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
   1450
   1451	return 0;
   1452}
   1453
   1454static size_t compute_user_elem_size(size_t size, unsigned int count)
   1455{
   1456	return sizeof(struct user_element) + size * count;
   1457}
   1458
   1459static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
   1460{
   1461	struct user_element *ue = kcontrol->private_data;
   1462
   1463	// decrement the allocation size.
   1464	ue->card->user_ctl_alloc_size -= compute_user_elem_size(ue->elem_data_size, kcontrol->count);
   1465	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
   1466	if (ue->priv_data)
   1467		ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
   1468
   1469	kvfree(ue->tlv_data);
   1470	kvfree(ue->priv_data);
   1471	kfree(ue);
   1472}
   1473
   1474static int snd_ctl_elem_add(struct snd_ctl_file *file,
   1475			    struct snd_ctl_elem_info *info, int replace)
   1476{
   1477	struct snd_card *card = file->card;
   1478	struct snd_kcontrol *kctl;
   1479	unsigned int count;
   1480	unsigned int access;
   1481	long private_size;
   1482	size_t alloc_size;
   1483	struct user_element *ue;
   1484	unsigned int offset;
   1485	int err;
   1486
   1487	if (!*info->id.name)
   1488		return -EINVAL;
   1489	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
   1490		return -EINVAL;
   1491
   1492	/* Delete a control to replace them if needed. */
   1493	if (replace) {
   1494		info->id.numid = 0;
   1495		err = snd_ctl_remove_user_ctl(file, &info->id);
   1496		if (err)
   1497			return err;
   1498	}
   1499
   1500	/* Check the number of elements for this userspace control. */
   1501	count = info->owner;
   1502	if (count == 0)
   1503		count = 1;
   1504
   1505	/* Arrange access permissions if needed. */
   1506	access = info->access;
   1507	if (access == 0)
   1508		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
   1509	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
   1510		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
   1511		   SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
   1512
   1513	/* In initial state, nothing is available as TLV container. */
   1514	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
   1515		access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
   1516	access |= SNDRV_CTL_ELEM_ACCESS_USER;
   1517
   1518	/*
   1519	 * Check information and calculate the size of data specific to
   1520	 * this userspace control.
   1521	 */
   1522	/* pass NULL to card for suppressing error messages */
   1523	err = snd_ctl_check_elem_info(NULL, info);
   1524	if (err < 0)
   1525		return err;
   1526	/* user-space control doesn't allow zero-size data */
   1527	if (info->count < 1)
   1528		return -EINVAL;
   1529	private_size = value_sizes[info->type] * info->count;
   1530	alloc_size = compute_user_elem_size(private_size, count);
   1531
   1532	down_write(&card->controls_rwsem);
   1533	if (check_user_elem_overflow(card, alloc_size)) {
   1534		err = -ENOMEM;
   1535		goto unlock;
   1536	}
   1537
   1538	/*
   1539	 * Keep memory object for this userspace control. After passing this
   1540	 * code block, the instance should be freed by snd_ctl_free_one().
   1541	 *
   1542	 * Note that these elements in this control are locked.
   1543	 */
   1544	err = snd_ctl_new(&kctl, count, access, file);
   1545	if (err < 0)
   1546		goto unlock;
   1547	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
   1548	ue = kzalloc(alloc_size, GFP_KERNEL);
   1549	if (!ue) {
   1550		kfree(kctl);
   1551		err = -ENOMEM;
   1552		goto unlock;
   1553	}
   1554	kctl->private_data = ue;
   1555	kctl->private_free = snd_ctl_elem_user_free;
   1556
   1557	// increment the allocated size; decremented again at private_free.
   1558	card->user_ctl_alloc_size += alloc_size;
   1559
   1560	/* Set private data for this userspace control. */
   1561	ue->card = card;
   1562	ue->info = *info;
   1563	ue->info.access = 0;
   1564	ue->elem_data = (char *)ue + sizeof(*ue);
   1565	ue->elem_data_size = private_size;
   1566	if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
   1567		err = snd_ctl_elem_init_enum_names(ue);
   1568		if (err < 0) {
   1569			snd_ctl_free_one(kctl);
   1570			goto unlock;
   1571		}
   1572	}
   1573
   1574	/* Set callback functions. */
   1575	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
   1576		kctl->info = snd_ctl_elem_user_enum_info;
   1577	else
   1578		kctl->info = snd_ctl_elem_user_info;
   1579	if (access & SNDRV_CTL_ELEM_ACCESS_READ)
   1580		kctl->get = snd_ctl_elem_user_get;
   1581	if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
   1582		kctl->put = snd_ctl_elem_user_put;
   1583	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
   1584		kctl->tlv.c = snd_ctl_elem_user_tlv;
   1585
   1586	/* This function manage to free the instance on failure. */
   1587	err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
   1588	if (err < 0) {
   1589		snd_ctl_free_one(kctl);
   1590		goto unlock;
   1591	}
   1592	offset = snd_ctl_get_ioff(kctl, &info->id);
   1593	snd_ctl_build_ioff(&info->id, kctl, offset);
   1594	/*
   1595	 * Here we cannot fill any field for the number of elements added by
   1596	 * this operation because there're no specific fields. The usage of
   1597	 * 'owner' field for this purpose may cause any bugs to userspace
   1598	 * applications because the field originally means PID of a process
   1599	 * which locks the element.
   1600	 */
   1601 unlock:
   1602	up_write(&card->controls_rwsem);
   1603	return err;
   1604}
   1605
   1606static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
   1607				 struct snd_ctl_elem_info __user *_info, int replace)
   1608{
   1609	struct snd_ctl_elem_info info;
   1610	int err;
   1611
   1612	if (copy_from_user(&info, _info, sizeof(info)))
   1613		return -EFAULT;
   1614	err = snd_ctl_elem_add(file, &info, replace);
   1615	if (err < 0)
   1616		return err;
   1617	if (copy_to_user(_info, &info, sizeof(info))) {
   1618		snd_ctl_remove_user_ctl(file, &info.id);
   1619		return -EFAULT;
   1620	}
   1621
   1622	return 0;
   1623}
   1624
   1625static int snd_ctl_elem_remove(struct snd_ctl_file *file,
   1626			       struct snd_ctl_elem_id __user *_id)
   1627{
   1628	struct snd_ctl_elem_id id;
   1629
   1630	if (copy_from_user(&id, _id, sizeof(id)))
   1631		return -EFAULT;
   1632	return snd_ctl_remove_user_ctl(file, &id);
   1633}
   1634
   1635static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
   1636{
   1637	int subscribe;
   1638	if (get_user(subscribe, ptr))
   1639		return -EFAULT;
   1640	if (subscribe < 0) {
   1641		subscribe = file->subscribed;
   1642		if (put_user(subscribe, ptr))
   1643			return -EFAULT;
   1644		return 0;
   1645	}
   1646	if (subscribe) {
   1647		file->subscribed = 1;
   1648		return 0;
   1649	} else if (file->subscribed) {
   1650		snd_ctl_empty_read_queue(file);
   1651		file->subscribed = 0;
   1652	}
   1653	return 0;
   1654}
   1655
   1656static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
   1657			    struct snd_kcontrol *kctl,
   1658			    struct snd_ctl_elem_id *id,
   1659			    unsigned int __user *buf, unsigned int size)
   1660{
   1661	static const struct {
   1662		int op;
   1663		int perm;
   1664	} pairs[] = {
   1665		{SNDRV_CTL_TLV_OP_READ,  SNDRV_CTL_ELEM_ACCESS_TLV_READ},
   1666		{SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
   1667		{SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
   1668	};
   1669	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
   1670	int i, ret;
   1671
   1672	/* Check support of the request for this element. */
   1673	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
   1674		if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
   1675			break;
   1676	}
   1677	if (i == ARRAY_SIZE(pairs))
   1678		return -ENXIO;
   1679
   1680	if (kctl->tlv.c == NULL)
   1681		return -ENXIO;
   1682
   1683	/* Write and command operations are not allowed for locked element. */
   1684	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
   1685	    vd->owner != NULL && vd->owner != file)
   1686		return -EPERM;
   1687
   1688	ret = snd_power_ref_and_wait(file->card);
   1689	if (!ret)
   1690		ret = kctl->tlv.c(kctl, op_flag, size, buf);
   1691	snd_power_unref(file->card);
   1692	return ret;
   1693}
   1694
   1695static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
   1696			unsigned int __user *buf, unsigned int size)
   1697{
   1698	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
   1699	unsigned int len;
   1700
   1701	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
   1702		return -ENXIO;
   1703
   1704	if (kctl->tlv.p == NULL)
   1705		return -ENXIO;
   1706
   1707	len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
   1708	if (size < len)
   1709		return -ENOMEM;
   1710
   1711	if (copy_to_user(buf, kctl->tlv.p, len))
   1712		return -EFAULT;
   1713
   1714	return 0;
   1715}
   1716
   1717static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
   1718			     struct snd_ctl_tlv __user *buf,
   1719                             int op_flag)
   1720{
   1721	struct snd_ctl_tlv header;
   1722	unsigned int __user *container;
   1723	unsigned int container_size;
   1724	struct snd_kcontrol *kctl;
   1725	struct snd_ctl_elem_id id;
   1726	struct snd_kcontrol_volatile *vd;
   1727
   1728	if (copy_from_user(&header, buf, sizeof(header)))
   1729		return -EFAULT;
   1730
   1731	/* In design of control core, numerical ID starts at 1. */
   1732	if (header.numid == 0)
   1733		return -EINVAL;
   1734
   1735	/* At least, container should include type and length fields.  */
   1736	if (header.length < sizeof(unsigned int) * 2)
   1737		return -EINVAL;
   1738	container_size = header.length;
   1739	container = buf->tlv;
   1740
   1741	kctl = snd_ctl_find_numid(file->card, header.numid);
   1742	if (kctl == NULL)
   1743		return -ENOENT;
   1744
   1745	/* Calculate index of the element in this set. */
   1746	id = kctl->id;
   1747	snd_ctl_build_ioff(&id, kctl, header.numid - id.numid);
   1748	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
   1749
   1750	if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
   1751		return call_tlv_handler(file, op_flag, kctl, &id, container,
   1752					container_size);
   1753	} else {
   1754		if (op_flag == SNDRV_CTL_TLV_OP_READ) {
   1755			return read_tlv_buf(kctl, &id, container,
   1756					    container_size);
   1757		}
   1758	}
   1759
   1760	/* Not supported. */
   1761	return -ENXIO;
   1762}
   1763
   1764static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
   1765{
   1766	struct snd_ctl_file *ctl;
   1767	struct snd_card *card;
   1768	struct snd_kctl_ioctl *p;
   1769	void __user *argp = (void __user *)arg;
   1770	int __user *ip = argp;
   1771	int err;
   1772
   1773	ctl = file->private_data;
   1774	card = ctl->card;
   1775	if (snd_BUG_ON(!card))
   1776		return -ENXIO;
   1777	switch (cmd) {
   1778	case SNDRV_CTL_IOCTL_PVERSION:
   1779		return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
   1780	case SNDRV_CTL_IOCTL_CARD_INFO:
   1781		return snd_ctl_card_info(card, ctl, cmd, argp);
   1782	case SNDRV_CTL_IOCTL_ELEM_LIST:
   1783		return snd_ctl_elem_list_user(card, argp);
   1784	case SNDRV_CTL_IOCTL_ELEM_INFO:
   1785		return snd_ctl_elem_info_user(ctl, argp);
   1786	case SNDRV_CTL_IOCTL_ELEM_READ:
   1787		return snd_ctl_elem_read_user(card, argp);
   1788	case SNDRV_CTL_IOCTL_ELEM_WRITE:
   1789		return snd_ctl_elem_write_user(ctl, argp);
   1790	case SNDRV_CTL_IOCTL_ELEM_LOCK:
   1791		return snd_ctl_elem_lock(ctl, argp);
   1792	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
   1793		return snd_ctl_elem_unlock(ctl, argp);
   1794	case SNDRV_CTL_IOCTL_ELEM_ADD:
   1795		return snd_ctl_elem_add_user(ctl, argp, 0);
   1796	case SNDRV_CTL_IOCTL_ELEM_REPLACE:
   1797		return snd_ctl_elem_add_user(ctl, argp, 1);
   1798	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
   1799		return snd_ctl_elem_remove(ctl, argp);
   1800	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
   1801		return snd_ctl_subscribe_events(ctl, ip);
   1802	case SNDRV_CTL_IOCTL_TLV_READ:
   1803		down_read(&ctl->card->controls_rwsem);
   1804		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
   1805		up_read(&ctl->card->controls_rwsem);
   1806		return err;
   1807	case SNDRV_CTL_IOCTL_TLV_WRITE:
   1808		down_write(&ctl->card->controls_rwsem);
   1809		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
   1810		up_write(&ctl->card->controls_rwsem);
   1811		return err;
   1812	case SNDRV_CTL_IOCTL_TLV_COMMAND:
   1813		down_write(&ctl->card->controls_rwsem);
   1814		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
   1815		up_write(&ctl->card->controls_rwsem);
   1816		return err;
   1817	case SNDRV_CTL_IOCTL_POWER:
   1818		return -ENOPROTOOPT;
   1819	case SNDRV_CTL_IOCTL_POWER_STATE:
   1820		return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
   1821	}
   1822	down_read(&snd_ioctl_rwsem);
   1823	list_for_each_entry(p, &snd_control_ioctls, list) {
   1824		err = p->fioctl(card, ctl, cmd, arg);
   1825		if (err != -ENOIOCTLCMD) {
   1826			up_read(&snd_ioctl_rwsem);
   1827			return err;
   1828		}
   1829	}
   1830	up_read(&snd_ioctl_rwsem);
   1831	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
   1832	return -ENOTTY;
   1833}
   1834
   1835static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
   1836			    size_t count, loff_t * offset)
   1837{
   1838	struct snd_ctl_file *ctl;
   1839	int err = 0;
   1840	ssize_t result = 0;
   1841
   1842	ctl = file->private_data;
   1843	if (snd_BUG_ON(!ctl || !ctl->card))
   1844		return -ENXIO;
   1845	if (!ctl->subscribed)
   1846		return -EBADFD;
   1847	if (count < sizeof(struct snd_ctl_event))
   1848		return -EINVAL;
   1849	spin_lock_irq(&ctl->read_lock);
   1850	while (count >= sizeof(struct snd_ctl_event)) {
   1851		struct snd_ctl_event ev;
   1852		struct snd_kctl_event *kev;
   1853		while (list_empty(&ctl->events)) {
   1854			wait_queue_entry_t wait;
   1855			if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
   1856				err = -EAGAIN;
   1857				goto __end_lock;
   1858			}
   1859			init_waitqueue_entry(&wait, current);
   1860			add_wait_queue(&ctl->change_sleep, &wait);
   1861			set_current_state(TASK_INTERRUPTIBLE);
   1862			spin_unlock_irq(&ctl->read_lock);
   1863			schedule();
   1864			remove_wait_queue(&ctl->change_sleep, &wait);
   1865			if (ctl->card->shutdown)
   1866				return -ENODEV;
   1867			if (signal_pending(current))
   1868				return -ERESTARTSYS;
   1869			spin_lock_irq(&ctl->read_lock);
   1870		}
   1871		kev = snd_kctl_event(ctl->events.next);
   1872		ev.type = SNDRV_CTL_EVENT_ELEM;
   1873		ev.data.elem.mask = kev->mask;
   1874		ev.data.elem.id = kev->id;
   1875		list_del(&kev->list);
   1876		spin_unlock_irq(&ctl->read_lock);
   1877		kfree(kev);
   1878		if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
   1879			err = -EFAULT;
   1880			goto __end;
   1881		}
   1882		spin_lock_irq(&ctl->read_lock);
   1883		buffer += sizeof(struct snd_ctl_event);
   1884		count -= sizeof(struct snd_ctl_event);
   1885		result += sizeof(struct snd_ctl_event);
   1886	}
   1887      __end_lock:
   1888	spin_unlock_irq(&ctl->read_lock);
   1889      __end:
   1890      	return result > 0 ? result : err;
   1891}
   1892
   1893static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
   1894{
   1895	__poll_t mask;
   1896	struct snd_ctl_file *ctl;
   1897
   1898	ctl = file->private_data;
   1899	if (!ctl->subscribed)
   1900		return 0;
   1901	poll_wait(file, &ctl->change_sleep, wait);
   1902
   1903	mask = 0;
   1904	if (!list_empty(&ctl->events))
   1905		mask |= EPOLLIN | EPOLLRDNORM;
   1906
   1907	return mask;
   1908}
   1909
   1910/*
   1911 * register the device-specific control-ioctls.
   1912 * called from each device manager like pcm.c, hwdep.c, etc.
   1913 */
   1914static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
   1915{
   1916	struct snd_kctl_ioctl *pn;
   1917
   1918	pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
   1919	if (pn == NULL)
   1920		return -ENOMEM;
   1921	pn->fioctl = fcn;
   1922	down_write(&snd_ioctl_rwsem);
   1923	list_add_tail(&pn->list, lists);
   1924	up_write(&snd_ioctl_rwsem);
   1925	return 0;
   1926}
   1927
   1928/**
   1929 * snd_ctl_register_ioctl - register the device-specific control-ioctls
   1930 * @fcn: ioctl callback function
   1931 *
   1932 * called from each device manager like pcm.c, hwdep.c, etc.
   1933 */
   1934int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
   1935{
   1936	return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
   1937}
   1938EXPORT_SYMBOL(snd_ctl_register_ioctl);
   1939
   1940#ifdef CONFIG_COMPAT
   1941/**
   1942 * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
   1943 * control-ioctls
   1944 * @fcn: ioctl callback function
   1945 */
   1946int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
   1947{
   1948	return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
   1949}
   1950EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
   1951#endif
   1952
   1953/*
   1954 * de-register the device-specific control-ioctls.
   1955 */
   1956static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
   1957				     struct list_head *lists)
   1958{
   1959	struct snd_kctl_ioctl *p;
   1960
   1961	if (snd_BUG_ON(!fcn))
   1962		return -EINVAL;
   1963	down_write(&snd_ioctl_rwsem);
   1964	list_for_each_entry(p, lists, list) {
   1965		if (p->fioctl == fcn) {
   1966			list_del(&p->list);
   1967			up_write(&snd_ioctl_rwsem);
   1968			kfree(p);
   1969			return 0;
   1970		}
   1971	}
   1972	up_write(&snd_ioctl_rwsem);
   1973	snd_BUG();
   1974	return -EINVAL;
   1975}
   1976
   1977/**
   1978 * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
   1979 * @fcn: ioctl callback function to unregister
   1980 */
   1981int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
   1982{
   1983	return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
   1984}
   1985EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
   1986
   1987#ifdef CONFIG_COMPAT
   1988/**
   1989 * snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
   1990 * 32bit control-ioctls
   1991 * @fcn: ioctl callback function to unregister
   1992 */
   1993int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
   1994{
   1995	return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
   1996}
   1997EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
   1998#endif
   1999
   2000static int snd_ctl_fasync(int fd, struct file * file, int on)
   2001{
   2002	struct snd_ctl_file *ctl;
   2003
   2004	ctl = file->private_data;
   2005	return fasync_helper(fd, file, on, &ctl->fasync);
   2006}
   2007
   2008/* return the preferred subdevice number if already assigned;
   2009 * otherwise return -1
   2010 */
   2011int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
   2012{
   2013	struct snd_ctl_file *kctl;
   2014	int subdevice = -1;
   2015	unsigned long flags;
   2016
   2017	read_lock_irqsave(&card->ctl_files_rwlock, flags);
   2018	list_for_each_entry(kctl, &card->ctl_files, list) {
   2019		if (kctl->pid == task_pid(current)) {
   2020			subdevice = kctl->preferred_subdevice[type];
   2021			if (subdevice != -1)
   2022				break;
   2023		}
   2024	}
   2025	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
   2026	return subdevice;
   2027}
   2028EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
   2029
   2030/*
   2031 * ioctl32 compat
   2032 */
   2033#ifdef CONFIG_COMPAT
   2034#include "control_compat.c"
   2035#else
   2036#define snd_ctl_ioctl_compat	NULL
   2037#endif
   2038
   2039/*
   2040 * control layers (audio LED etc.)
   2041 */
   2042
   2043/**
   2044 * snd_ctl_request_layer - request to use the layer
   2045 * @module_name: Name of the kernel module (NULL == build-in)
   2046 *
   2047 * Return an error code when the module cannot be loaded.
   2048 */
   2049int snd_ctl_request_layer(const char *module_name)
   2050{
   2051	struct snd_ctl_layer_ops *lops;
   2052
   2053	if (module_name == NULL)
   2054		return 0;
   2055	down_read(&snd_ctl_layer_rwsem);
   2056	for (lops = snd_ctl_layer; lops; lops = lops->next)
   2057		if (strcmp(lops->module_name, module_name) == 0)
   2058			break;
   2059	up_read(&snd_ctl_layer_rwsem);
   2060	if (lops)
   2061		return 0;
   2062	return request_module(module_name);
   2063}
   2064EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
   2065
   2066/**
   2067 * snd_ctl_register_layer - register new control layer
   2068 * @lops: operation structure
   2069 *
   2070 * The new layer can track all control elements and do additional
   2071 * operations on top (like audio LED handling).
   2072 */
   2073void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
   2074{
   2075	struct snd_card *card;
   2076	int card_number;
   2077
   2078	down_write(&snd_ctl_layer_rwsem);
   2079	lops->next = snd_ctl_layer;
   2080	snd_ctl_layer = lops;
   2081	up_write(&snd_ctl_layer_rwsem);
   2082	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
   2083		card = snd_card_ref(card_number);
   2084		if (card) {
   2085			down_read(&card->controls_rwsem);
   2086			lops->lregister(card);
   2087			up_read(&card->controls_rwsem);
   2088			snd_card_unref(card);
   2089		}
   2090	}
   2091}
   2092EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
   2093
   2094/**
   2095 * snd_ctl_disconnect_layer - disconnect control layer
   2096 * @lops: operation structure
   2097 *
   2098 * It is expected that the information about tracked cards
   2099 * is freed before this call (the disconnect callback is
   2100 * not called here).
   2101 */
   2102void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
   2103{
   2104	struct snd_ctl_layer_ops *lops2, *prev_lops2;
   2105
   2106	down_write(&snd_ctl_layer_rwsem);
   2107	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
   2108		if (lops2 == lops) {
   2109			if (!prev_lops2)
   2110				snd_ctl_layer = lops->next;
   2111			else
   2112				prev_lops2->next = lops->next;
   2113			break;
   2114		}
   2115		prev_lops2 = lops2;
   2116	}
   2117	up_write(&snd_ctl_layer_rwsem);
   2118}
   2119EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
   2120
   2121/*
   2122 *  INIT PART
   2123 */
   2124
   2125static const struct file_operations snd_ctl_f_ops =
   2126{
   2127	.owner =	THIS_MODULE,
   2128	.read =		snd_ctl_read,
   2129	.open =		snd_ctl_open,
   2130	.release =	snd_ctl_release,
   2131	.llseek =	no_llseek,
   2132	.poll =		snd_ctl_poll,
   2133	.unlocked_ioctl =	snd_ctl_ioctl,
   2134	.compat_ioctl =	snd_ctl_ioctl_compat,
   2135	.fasync =	snd_ctl_fasync,
   2136};
   2137
   2138/*
   2139 * registration of the control device
   2140 */
   2141static int snd_ctl_dev_register(struct snd_device *device)
   2142{
   2143	struct snd_card *card = device->device_data;
   2144	struct snd_ctl_layer_ops *lops;
   2145	int err;
   2146
   2147	err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
   2148				  &snd_ctl_f_ops, card, &card->ctl_dev);
   2149	if (err < 0)
   2150		return err;
   2151	down_read(&card->controls_rwsem);
   2152	down_read(&snd_ctl_layer_rwsem);
   2153	for (lops = snd_ctl_layer; lops; lops = lops->next)
   2154		lops->lregister(card);
   2155	up_read(&snd_ctl_layer_rwsem);
   2156	up_read(&card->controls_rwsem);
   2157	return 0;
   2158}
   2159
   2160/*
   2161 * disconnection of the control device
   2162 */
   2163static int snd_ctl_dev_disconnect(struct snd_device *device)
   2164{
   2165	struct snd_card *card = device->device_data;
   2166	struct snd_ctl_file *ctl;
   2167	struct snd_ctl_layer_ops *lops;
   2168	unsigned long flags;
   2169
   2170	read_lock_irqsave(&card->ctl_files_rwlock, flags);
   2171	list_for_each_entry(ctl, &card->ctl_files, list) {
   2172		wake_up(&ctl->change_sleep);
   2173		kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
   2174	}
   2175	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
   2176
   2177	down_read(&card->controls_rwsem);
   2178	down_read(&snd_ctl_layer_rwsem);
   2179	for (lops = snd_ctl_layer; lops; lops = lops->next)
   2180		lops->ldisconnect(card);
   2181	up_read(&snd_ctl_layer_rwsem);
   2182	up_read(&card->controls_rwsem);
   2183
   2184	return snd_unregister_device(&card->ctl_dev);
   2185}
   2186
   2187/*
   2188 * free all controls
   2189 */
   2190static int snd_ctl_dev_free(struct snd_device *device)
   2191{
   2192	struct snd_card *card = device->device_data;
   2193	struct snd_kcontrol *control;
   2194
   2195	down_write(&card->controls_rwsem);
   2196	while (!list_empty(&card->controls)) {
   2197		control = snd_kcontrol(card->controls.next);
   2198		snd_ctl_remove(card, control);
   2199	}
   2200	up_write(&card->controls_rwsem);
   2201	put_device(&card->ctl_dev);
   2202	return 0;
   2203}
   2204
   2205/*
   2206 * create control core:
   2207 * called from init.c
   2208 */
   2209int snd_ctl_create(struct snd_card *card)
   2210{
   2211	static const struct snd_device_ops ops = {
   2212		.dev_free = snd_ctl_dev_free,
   2213		.dev_register =	snd_ctl_dev_register,
   2214		.dev_disconnect = snd_ctl_dev_disconnect,
   2215	};
   2216	int err;
   2217
   2218	if (snd_BUG_ON(!card))
   2219		return -ENXIO;
   2220	if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
   2221		return -ENXIO;
   2222
   2223	snd_device_initialize(&card->ctl_dev, card);
   2224	dev_set_name(&card->ctl_dev, "controlC%d", card->number);
   2225
   2226	err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
   2227	if (err < 0)
   2228		put_device(&card->ctl_dev);
   2229	return err;
   2230}
   2231
   2232/*
   2233 * Frequently used control callbacks/helpers
   2234 */
   2235
   2236/**
   2237 * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
   2238 * callback with a mono channel
   2239 * @kcontrol: the kcontrol instance
   2240 * @uinfo: info to store
   2241 *
   2242 * This is a function that can be used as info callback for a standard
   2243 * boolean control with a single mono channel.
   2244 */
   2245int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
   2246			      struct snd_ctl_elem_info *uinfo)
   2247{
   2248	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
   2249	uinfo->count = 1;
   2250	uinfo->value.integer.min = 0;
   2251	uinfo->value.integer.max = 1;
   2252	return 0;
   2253}
   2254EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
   2255
   2256/**
   2257 * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
   2258 * callback with stereo two channels
   2259 * @kcontrol: the kcontrol instance
   2260 * @uinfo: info to store
   2261 *
   2262 * This is a function that can be used as info callback for a standard
   2263 * boolean control with stereo two channels.
   2264 */
   2265int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
   2266				struct snd_ctl_elem_info *uinfo)
   2267{
   2268	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
   2269	uinfo->count = 2;
   2270	uinfo->value.integer.min = 0;
   2271	uinfo->value.integer.max = 1;
   2272	return 0;
   2273}
   2274EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
   2275
   2276/**
   2277 * snd_ctl_enum_info - fills the info structure for an enumerated control
   2278 * @info: the structure to be filled
   2279 * @channels: the number of the control's channels; often one
   2280 * @items: the number of control values; also the size of @names
   2281 * @names: an array containing the names of all control values
   2282 *
   2283 * Sets all required fields in @info to their appropriate values.
   2284 * If the control's accessibility is not the default (readable and writable),
   2285 * the caller has to fill @info->access.
   2286 *
   2287 * Return: Zero.
   2288 */
   2289int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
   2290		      unsigned int items, const char *const names[])
   2291{
   2292	info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
   2293	info->count = channels;
   2294	info->value.enumerated.items = items;
   2295	if (!items)
   2296		return 0;
   2297	if (info->value.enumerated.item >= items)
   2298		info->value.enumerated.item = items - 1;
   2299	WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
   2300	     "ALSA: too long item name '%s'\n",
   2301	     names[info->value.enumerated.item]);
   2302	strscpy(info->value.enumerated.name,
   2303		names[info->value.enumerated.item],
   2304		sizeof(info->value.enumerated.name));
   2305	return 0;
   2306}
   2307EXPORT_SYMBOL(snd_ctl_enum_info);