1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Routines for driver control interface
4  *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
5  */
6 
7 #include <linux/threads.h>
8 #include <linux/interrupt.h>
9 #include <linux/module.h>
10 #include <linux/moduleparam.h>
11 #include <linux/slab.h>
12 #include <linux/vmalloc.h>
13 #include <linux/time.h>
14 #include <linux/mm.h>
15 #include <linux/math64.h>
16 #include <linux/sched/signal.h>
17 #include <sound/core.h>
18 #include <sound/minors.h>
19 #include <sound/info.h>
20 #include <sound/control.h>
21 
22 // Max allocation size for user controls.
23 static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
24 module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
25 MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
26 
27 #define MAX_CONTROL_COUNT	1028
28 
29 struct snd_kctl_ioctl {
30 	struct list_head list;		/* list of all ioctls */
31 	snd_kctl_ioctl_func_t fioctl;
32 };
33 
34 static DECLARE_RWSEM(snd_ioctl_rwsem);
35 static DECLARE_RWSEM(snd_ctl_layer_rwsem);
36 static LIST_HEAD(snd_control_ioctls);
37 #ifdef CONFIG_COMPAT
38 static LIST_HEAD(snd_control_compat_ioctls);
39 #endif
40 static struct snd_ctl_layer_ops *snd_ctl_layer;
41 
snd_ctl_open(struct inode * inode,struct file * file)42 static int snd_ctl_open(struct inode *inode, struct file *file)
43 {
44 	unsigned long flags;
45 	struct snd_card *card;
46 	struct snd_ctl_file *ctl;
47 	int i, err;
48 
49 	err = stream_open(inode, file);
50 	if (err < 0)
51 		return err;
52 
53 	card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
54 	if (!card) {
55 		err = -ENODEV;
56 		goto __error1;
57 	}
58 	err = snd_card_file_add(card, file);
59 	if (err < 0) {
60 		err = -ENODEV;
61 		goto __error1;
62 	}
63 	if (!try_module_get(card->module)) {
64 		err = -EFAULT;
65 		goto __error2;
66 	}
67 	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
68 	if (ctl == NULL) {
69 		err = -ENOMEM;
70 		goto __error;
71 	}
72 	INIT_LIST_HEAD(&ctl->events);
73 	init_waitqueue_head(&ctl->change_sleep);
74 	spin_lock_init(&ctl->read_lock);
75 	ctl->card = card;
76 	for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
77 		ctl->preferred_subdevice[i] = -1;
78 	ctl->pid = get_pid(task_pid(current));
79 	file->private_data = ctl;
80 	write_lock_irqsave(&card->ctl_files_rwlock, flags);
81 	list_add_tail(&ctl->list, &card->ctl_files);
82 	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
83 	snd_card_unref(card);
84 	return 0;
85 
86       __error:
87 	module_put(card->module);
88       __error2:
89 	snd_card_file_remove(card, file);
90       __error1:
91 	if (card)
92 		snd_card_unref(card);
93       	return err;
94 }
95 
snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)96 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
97 {
98 	unsigned long flags;
99 	struct snd_kctl_event *cread;
100 
101 	spin_lock_irqsave(&ctl->read_lock, flags);
102 	while (!list_empty(&ctl->events)) {
103 		cread = snd_kctl_event(ctl->events.next);
104 		list_del(&cread->list);
105 		kfree(cread);
106 	}
107 	spin_unlock_irqrestore(&ctl->read_lock, flags);
108 }
109 
snd_ctl_release(struct inode * inode,struct file * file)110 static int snd_ctl_release(struct inode *inode, struct file *file)
111 {
112 	unsigned long flags;
113 	struct snd_card *card;
114 	struct snd_ctl_file *ctl;
115 	struct snd_kcontrol *control;
116 	unsigned int idx;
117 
118 	ctl = file->private_data;
119 	file->private_data = NULL;
120 	card = ctl->card;
121 	write_lock_irqsave(&card->ctl_files_rwlock, flags);
122 	list_del(&ctl->list);
123 	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
124 	down_write(&card->controls_rwsem);
125 	list_for_each_entry(control, &card->controls, list)
126 		for (idx = 0; idx < control->count; idx++)
127 			if (control->vd[idx].owner == ctl)
128 				control->vd[idx].owner = NULL;
129 	up_write(&card->controls_rwsem);
130 	snd_fasync_free(ctl->fasync);
131 	snd_ctl_empty_read_queue(ctl);
132 	put_pid(ctl->pid);
133 	kfree(ctl);
134 	module_put(card->module);
135 	snd_card_file_remove(card, file);
136 	return 0;
137 }
138 
139 /**
140  * snd_ctl_notify - Send notification to user-space for a control change
141  * @card: the card to send notification
142  * @mask: the event mask, SNDRV_CTL_EVENT_*
143  * @id: the ctl element id to send notification
144  *
145  * This function adds an event record with the given id and mask, appends
146  * to the list and wakes up the user-space for notification.  This can be
147  * called in the atomic context.
148  */
snd_ctl_notify(struct snd_card * card,unsigned int mask,struct snd_ctl_elem_id * id)149 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
150 		    struct snd_ctl_elem_id *id)
151 {
152 	unsigned long flags;
153 	struct snd_ctl_file *ctl;
154 	struct snd_kctl_event *ev;
155 
156 	if (snd_BUG_ON(!card || !id))
157 		return;
158 	if (card->shutdown)
159 		return;
160 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
161 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
162 	card->mixer_oss_change_count++;
163 #endif
164 	list_for_each_entry(ctl, &card->ctl_files, list) {
165 		if (!ctl->subscribed)
166 			continue;
167 		spin_lock(&ctl->read_lock);
168 		list_for_each_entry(ev, &ctl->events, list) {
169 			if (ev->id.numid == id->numid) {
170 				ev->mask |= mask;
171 				goto _found;
172 			}
173 		}
174 		ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
175 		if (ev) {
176 			ev->id = *id;
177 			ev->mask = mask;
178 			list_add_tail(&ev->list, &ctl->events);
179 		} else {
180 			dev_err(card->dev, "No memory available to allocate event\n");
181 		}
182 	_found:
183 		wake_up(&ctl->change_sleep);
184 		spin_unlock(&ctl->read_lock);
185 		snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN);
186 	}
187 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
188 }
189 EXPORT_SYMBOL(snd_ctl_notify);
190 
191 /**
192  * snd_ctl_notify_one - Send notification to user-space for a control change
193  * @card: the card to send notification
194  * @mask: the event mask, SNDRV_CTL_EVENT_*
195  * @kctl: the pointer with the control instance
196  * @ioff: the additional offset to the control index
197  *
198  * This function calls snd_ctl_notify() and does additional jobs
199  * like LED state changes.
200  */
snd_ctl_notify_one(struct snd_card * card,unsigned int mask,struct snd_kcontrol * kctl,unsigned int ioff)201 void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
202 			struct snd_kcontrol *kctl, unsigned int ioff)
203 {
204 	struct snd_ctl_elem_id id = kctl->id;
205 	struct snd_ctl_layer_ops *lops;
206 
207 	id.index += ioff;
208 	id.numid += ioff;
209 	snd_ctl_notify(card, mask, &id);
210 	down_read(&snd_ctl_layer_rwsem);
211 	for (lops = snd_ctl_layer; lops; lops = lops->next)
212 		lops->lnotify(card, mask, kctl, ioff);
213 	up_read(&snd_ctl_layer_rwsem);
214 }
215 EXPORT_SYMBOL(snd_ctl_notify_one);
216 
217 /**
218  * snd_ctl_new - create a new control instance with some elements
219  * @kctl: the pointer to store new control instance
220  * @count: the number of elements in this control
221  * @access: the default access flags for elements in this control
222  * @file: given when locking these elements
223  *
224  * Allocates a memory object for a new control instance. The instance has
225  * elements as many as the given number (@count). Each element has given
226  * access permissions (@access). Each element is locked when @file is given.
227  *
228  * Return: 0 on success, error code on failure
229  */
snd_ctl_new(struct snd_kcontrol ** kctl,unsigned int count,unsigned int access,struct snd_ctl_file * file)230 static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
231 		       unsigned int access, struct snd_ctl_file *file)
232 {
233 	unsigned int idx;
234 
235 	if (count == 0 || count > MAX_CONTROL_COUNT)
236 		return -EINVAL;
237 
238 	*kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
239 	if (!*kctl)
240 		return -ENOMEM;
241 
242 	for (idx = 0; idx < count; idx++) {
243 		(*kctl)->vd[idx].access = access;
244 		(*kctl)->vd[idx].owner = file;
245 	}
246 	(*kctl)->count = count;
247 
248 	return 0;
249 }
250 
251 /**
252  * snd_ctl_new1 - create a control instance from the template
253  * @ncontrol: the initialization record
254  * @private_data: the private data to set
255  *
256  * Allocates a new struct snd_kcontrol instance and initialize from the given
257  * template.  When the access field of ncontrol is 0, it's assumed as
258  * READWRITE access. When the count field is 0, it's assumes as one.
259  *
260  * Return: The pointer of the newly generated instance, or %NULL on failure.
261  */
snd_ctl_new1(const struct snd_kcontrol_new * ncontrol,void * private_data)262 struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
263 				  void *private_data)
264 {
265 	struct snd_kcontrol *kctl;
266 	unsigned int count;
267 	unsigned int access;
268 	int err;
269 
270 	if (snd_BUG_ON(!ncontrol || !ncontrol->info))
271 		return NULL;
272 
273 	count = ncontrol->count;
274 	if (count == 0)
275 		count = 1;
276 
277 	access = ncontrol->access;
278 	if (access == 0)
279 		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
280 	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
281 		   SNDRV_CTL_ELEM_ACCESS_VOLATILE |
282 		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
283 		   SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
284 		   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
285 		   SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
286 		   SNDRV_CTL_ELEM_ACCESS_LED_MASK |
287 		   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
288 
289 	err = snd_ctl_new(&kctl, count, access, NULL);
290 	if (err < 0)
291 		return NULL;
292 
293 	/* The 'numid' member is decided when calling snd_ctl_add(). */
294 	kctl->id.iface = ncontrol->iface;
295 	kctl->id.device = ncontrol->device;
296 	kctl->id.subdevice = ncontrol->subdevice;
297 	if (ncontrol->name) {
298 		strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
299 		if (strcmp(ncontrol->name, kctl->id.name) != 0)
300 			pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
301 				ncontrol->name, kctl->id.name);
302 	}
303 	kctl->id.index = ncontrol->index;
304 
305 	kctl->info = ncontrol->info;
306 	kctl->get = ncontrol->get;
307 	kctl->put = ncontrol->put;
308 	kctl->tlv.p = ncontrol->tlv.p;
309 
310 	kctl->private_value = ncontrol->private_value;
311 	kctl->private_data = private_data;
312 
313 	return kctl;
314 }
315 EXPORT_SYMBOL(snd_ctl_new1);
316 
317 /**
318  * snd_ctl_free_one - release the control instance
319  * @kcontrol: the control instance
320  *
321  * Releases the control instance created via snd_ctl_new()
322  * or snd_ctl_new1().
323  * Don't call this after the control was added to the card.
324  */
snd_ctl_free_one(struct snd_kcontrol * kcontrol)325 void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
326 {
327 	if (kcontrol) {
328 		if (kcontrol->private_free)
329 			kcontrol->private_free(kcontrol);
330 		kfree(kcontrol);
331 	}
332 }
333 EXPORT_SYMBOL(snd_ctl_free_one);
334 
snd_ctl_remove_numid_conflict(struct snd_card * card,unsigned int count)335 static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
336 					  unsigned int count)
337 {
338 	struct snd_kcontrol *kctl;
339 
340 	/* Make sure that the ids assigned to the control do not wrap around */
341 	if (card->last_numid >= UINT_MAX - count)
342 		card->last_numid = 0;
343 
344 	list_for_each_entry(kctl, &card->controls, list) {
345 		if (kctl->id.numid < card->last_numid + 1 + count &&
346 		    kctl->id.numid + kctl->count > card->last_numid + 1) {
347 		    	card->last_numid = kctl->id.numid + kctl->count - 1;
348 			return true;
349 		}
350 	}
351 	return false;
352 }
353 
snd_ctl_find_hole(struct snd_card * card,unsigned int count)354 static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
355 {
356 	unsigned int iter = 100000;
357 
358 	while (snd_ctl_remove_numid_conflict(card, count)) {
359 		if (--iter == 0) {
360 			/* this situation is very unlikely */
361 			dev_err(card->dev, "unable to allocate new control numid\n");
362 			return -ENOMEM;
363 		}
364 	}
365 	return 0;
366 }
367 
368 /* check whether the given id is contained in the given kctl */
elem_id_matches(const struct snd_kcontrol * kctl,const struct snd_ctl_elem_id * id)369 static bool elem_id_matches(const struct snd_kcontrol *kctl,
370 			    const struct snd_ctl_elem_id *id)
371 {
372 	return kctl->id.iface == id->iface &&
373 		kctl->id.device == id->device &&
374 		kctl->id.subdevice == id->subdevice &&
375 		!strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)) &&
376 		kctl->id.index <= id->index &&
377 		kctl->id.index + kctl->count > id->index;
378 }
379 
380 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
381 /* Compute a hash key for the corresponding ctl id
382  * It's for the name lookup, hence the numid is excluded.
383  * The hash key is bound in LONG_MAX to be used for Xarray key.
384  */
385 #define MULTIPLIER	37
get_ctl_id_hash(const struct snd_ctl_elem_id * id)386 static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id)
387 {
388 	int i;
389 	unsigned long h;
390 
391 	h = id->iface;
392 	h = MULTIPLIER * h + id->device;
393 	h = MULTIPLIER * h + id->subdevice;
394 	for (i = 0; i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN && id->name[i]; i++)
395 		h = MULTIPLIER * h + id->name[i];
396 	h = MULTIPLIER * h + id->index;
397 	h &= LONG_MAX;
398 	return h;
399 }
400 
401 /* add hash entries to numid and ctl xarray tables */
add_hash_entries(struct snd_card * card,struct snd_kcontrol * kcontrol)402 static void add_hash_entries(struct snd_card *card,
403 			     struct snd_kcontrol *kcontrol)
404 {
405 	struct snd_ctl_elem_id id = kcontrol->id;
406 	int i;
407 
408 	xa_store_range(&card->ctl_numids, kcontrol->id.numid,
409 		       kcontrol->id.numid + kcontrol->count - 1,
410 		       kcontrol, GFP_KERNEL);
411 
412 	for (i = 0; i < kcontrol->count; i++) {
413 		id.index = kcontrol->id.index + i;
414 		if (xa_insert(&card->ctl_hash, get_ctl_id_hash(&id),
415 			      kcontrol, GFP_KERNEL)) {
416 			/* skip hash for this entry, noting we had collision */
417 			card->ctl_hash_collision = true;
418 			dev_dbg(card->dev, "ctl_hash collision %d:%s:%d\n",
419 				id.iface, id.name, id.index);
420 		}
421 	}
422 }
423 
424 /* remove hash entries that have been added */
remove_hash_entries(struct snd_card * card,struct snd_kcontrol * kcontrol)425 static void remove_hash_entries(struct snd_card *card,
426 				struct snd_kcontrol *kcontrol)
427 {
428 	struct snd_ctl_elem_id id = kcontrol->id;
429 	struct snd_kcontrol *matched;
430 	unsigned long h;
431 	int i;
432 
433 	for (i = 0; i < kcontrol->count; i++) {
434 		xa_erase(&card->ctl_numids, id.numid);
435 		h = get_ctl_id_hash(&id);
436 		matched = xa_load(&card->ctl_hash, h);
437 		if (matched && (matched == kcontrol ||
438 				elem_id_matches(matched, &id)))
439 			xa_erase(&card->ctl_hash, h);
440 		id.index++;
441 		id.numid++;
442 	}
443 }
444 #else /* CONFIG_SND_CTL_FAST_LOOKUP */
add_hash_entries(struct snd_card * card,struct snd_kcontrol * kcontrol)445 static inline void add_hash_entries(struct snd_card *card,
446 				    struct snd_kcontrol *kcontrol)
447 {
448 }
remove_hash_entries(struct snd_card * card,struct snd_kcontrol * kcontrol)449 static inline void remove_hash_entries(struct snd_card *card,
450 				       struct snd_kcontrol *kcontrol)
451 {
452 }
453 #endif /* CONFIG_SND_CTL_FAST_LOOKUP */
454 
455 enum snd_ctl_add_mode {
456 	CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
457 };
458 
459 /* add/replace a new kcontrol object; call with card->controls_rwsem locked */
__snd_ctl_add_replace(struct snd_card * card,struct snd_kcontrol * kcontrol,enum snd_ctl_add_mode mode)460 static int __snd_ctl_add_replace(struct snd_card *card,
461 				 struct snd_kcontrol *kcontrol,
462 				 enum snd_ctl_add_mode mode)
463 {
464 	struct snd_ctl_elem_id id;
465 	unsigned int idx;
466 	struct snd_kcontrol *old;
467 	int err;
468 
469 	id = kcontrol->id;
470 	if (id.index > UINT_MAX - kcontrol->count)
471 		return -EINVAL;
472 
473 	old = snd_ctl_find_id(card, &id);
474 	if (!old) {
475 		if (mode == CTL_REPLACE)
476 			return -EINVAL;
477 	} else {
478 		if (mode == CTL_ADD_EXCLUSIVE) {
479 			dev_err(card->dev,
480 				"control %i:%i:%i:%s:%i is already present\n",
481 				id.iface, id.device, id.subdevice, id.name,
482 				id.index);
483 			return -EBUSY;
484 		}
485 
486 		err = snd_ctl_remove(card, old);
487 		if (err < 0)
488 			return err;
489 	}
490 
491 	if (snd_ctl_find_hole(card, kcontrol->count) < 0)
492 		return -ENOMEM;
493 
494 	list_add_tail(&kcontrol->list, &card->controls);
495 	card->controls_count += kcontrol->count;
496 	kcontrol->id.numid = card->last_numid + 1;
497 	card->last_numid += kcontrol->count;
498 
499 	add_hash_entries(card, kcontrol);
500 
501 	for (idx = 0; idx < kcontrol->count; idx++)
502 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
503 
504 	return 0;
505 }
506 
snd_ctl_add_replace(struct snd_card * card,struct snd_kcontrol * kcontrol,enum snd_ctl_add_mode mode)507 static int snd_ctl_add_replace(struct snd_card *card,
508 			       struct snd_kcontrol *kcontrol,
509 			       enum snd_ctl_add_mode mode)
510 {
511 	int err = -EINVAL;
512 
513 	if (! kcontrol)
514 		return err;
515 	if (snd_BUG_ON(!card || !kcontrol->info))
516 		goto error;
517 
518 	down_write(&card->controls_rwsem);
519 	err = __snd_ctl_add_replace(card, kcontrol, mode);
520 	up_write(&card->controls_rwsem);
521 	if (err < 0)
522 		goto error;
523 	return 0;
524 
525  error:
526 	snd_ctl_free_one(kcontrol);
527 	return err;
528 }
529 
530 /**
531  * snd_ctl_add - add the control instance to the card
532  * @card: the card instance
533  * @kcontrol: the control instance to add
534  *
535  * Adds the control instance created via snd_ctl_new() or
536  * snd_ctl_new1() to the given card. Assigns also an unique
537  * numid used for fast search.
538  *
539  * It frees automatically the control which cannot be added.
540  *
541  * Return: Zero if successful, or a negative error code on failure.
542  *
543  */
snd_ctl_add(struct snd_card * card,struct snd_kcontrol * kcontrol)544 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
545 {
546 	return snd_ctl_add_replace(card, kcontrol, CTL_ADD_EXCLUSIVE);
547 }
548 EXPORT_SYMBOL(snd_ctl_add);
549 
550 /**
551  * snd_ctl_replace - replace the control instance of the card
552  * @card: the card instance
553  * @kcontrol: the control instance to replace
554  * @add_on_replace: add the control if not already added
555  *
556  * Replaces the given control.  If the given control does not exist
557  * and the add_on_replace flag is set, the control is added.  If the
558  * control exists, it is destroyed first.
559  *
560  * It frees automatically the control which cannot be added or replaced.
561  *
562  * Return: Zero if successful, or a negative error code on failure.
563  */
snd_ctl_replace(struct snd_card * card,struct snd_kcontrol * kcontrol,bool add_on_replace)564 int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
565 		    bool add_on_replace)
566 {
567 	return snd_ctl_add_replace(card, kcontrol,
568 				   add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
569 }
570 EXPORT_SYMBOL(snd_ctl_replace);
571 
__snd_ctl_remove(struct snd_card * card,struct snd_kcontrol * kcontrol,bool remove_hash)572 static int __snd_ctl_remove(struct snd_card *card,
573 			    struct snd_kcontrol *kcontrol,
574 			    bool remove_hash)
575 {
576 	unsigned int idx;
577 
578 	if (snd_BUG_ON(!card || !kcontrol))
579 		return -EINVAL;
580 	list_del(&kcontrol->list);
581 
582 	if (remove_hash)
583 		remove_hash_entries(card, kcontrol);
584 
585 	card->controls_count -= kcontrol->count;
586 	for (idx = 0; idx < kcontrol->count; idx++)
587 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
588 	snd_ctl_free_one(kcontrol);
589 	return 0;
590 }
591 
592 /**
593  * snd_ctl_remove - remove the control from the card and release it
594  * @card: the card instance
595  * @kcontrol: the control instance to remove
596  *
597  * Removes the control from the card and then releases the instance.
598  * You don't need to call snd_ctl_free_one(). You must be in
599  * the write lock - down_write(&card->controls_rwsem).
600  *
601  * Return: 0 if successful, or a negative error code on failure.
602  */
snd_ctl_remove(struct snd_card * card,struct snd_kcontrol * kcontrol)603 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
604 {
605 	return __snd_ctl_remove(card, kcontrol, true);
606 }
607 EXPORT_SYMBOL(snd_ctl_remove);
608 
609 /**
610  * snd_ctl_remove_id - remove the control of the given id and release it
611  * @card: the card instance
612  * @id: the control id to remove
613  *
614  * Finds the control instance with the given id, removes it from the
615  * card list and releases it.
616  *
617  * Return: 0 if successful, or a negative error code on failure.
618  */
snd_ctl_remove_id(struct snd_card * card,struct snd_ctl_elem_id * id)619 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
620 {
621 	struct snd_kcontrol *kctl;
622 	int ret;
623 
624 	down_write(&card->controls_rwsem);
625 	kctl = snd_ctl_find_id(card, id);
626 	if (kctl == NULL) {
627 		up_write(&card->controls_rwsem);
628 		return -ENOENT;
629 	}
630 	ret = snd_ctl_remove(card, kctl);
631 	up_write(&card->controls_rwsem);
632 	return ret;
633 }
634 EXPORT_SYMBOL(snd_ctl_remove_id);
635 
636 /**
637  * snd_ctl_remove_user_ctl - remove and release the unlocked user control
638  * @file: active control handle
639  * @id: the control id to remove
640  *
641  * Finds the control instance with the given id, removes it from the
642  * card list and releases it.
643  *
644  * Return: 0 if successful, or a negative error code on failure.
645  */
snd_ctl_remove_user_ctl(struct snd_ctl_file * file,struct snd_ctl_elem_id * id)646 static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
647 				   struct snd_ctl_elem_id *id)
648 {
649 	struct snd_card *card = file->card;
650 	struct snd_kcontrol *kctl;
651 	int idx, ret;
652 
653 	down_write(&card->controls_rwsem);
654 	kctl = snd_ctl_find_id(card, id);
655 	if (kctl == NULL) {
656 		ret = -ENOENT;
657 		goto error;
658 	}
659 	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
660 		ret = -EINVAL;
661 		goto error;
662 	}
663 	for (idx = 0; idx < kctl->count; idx++)
664 		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
665 			ret = -EBUSY;
666 			goto error;
667 		}
668 	ret = snd_ctl_remove(card, kctl);
669 error:
670 	up_write(&card->controls_rwsem);
671 	return ret;
672 }
673 
674 /**
675  * snd_ctl_activate_id - activate/inactivate the control of the given id
676  * @card: the card instance
677  * @id: the control id to activate/inactivate
678  * @active: non-zero to activate
679  *
680  * Finds the control instance with the given id, and activate or
681  * inactivate the control together with notification, if changed.
682  * The given ID data is filled with full information.
683  *
684  * Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
685  */
snd_ctl_activate_id(struct snd_card * card,struct snd_ctl_elem_id * id,int active)686 int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
687 			int active)
688 {
689 	struct snd_kcontrol *kctl;
690 	struct snd_kcontrol_volatile *vd;
691 	unsigned int index_offset;
692 	int ret;
693 
694 	down_write(&card->controls_rwsem);
695 	kctl = snd_ctl_find_id(card, id);
696 	if (kctl == NULL) {
697 		ret = -ENOENT;
698 		goto unlock;
699 	}
700 	index_offset = snd_ctl_get_ioff(kctl, id);
701 	vd = &kctl->vd[index_offset];
702 	ret = 0;
703 	if (active) {
704 		if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
705 			goto unlock;
706 		vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
707 	} else {
708 		if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
709 			goto unlock;
710 		vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
711 	}
712 	snd_ctl_build_ioff(id, kctl, index_offset);
713 	downgrade_write(&card->controls_rwsem);
714 	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
715 	up_read(&card->controls_rwsem);
716 	return 1;
717 
718  unlock:
719 	up_write(&card->controls_rwsem);
720 	return ret;
721 }
722 EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
723 
724 /**
725  * snd_ctl_rename_id - replace the id of a control on the card
726  * @card: the card instance
727  * @src_id: the old id
728  * @dst_id: the new id
729  *
730  * Finds the control with the old id from the card, and replaces the
731  * id with the new one.
732  *
733  * Return: Zero if successful, or a negative error code on failure.
734  */
snd_ctl_rename_id(struct snd_card * card,struct snd_ctl_elem_id * src_id,struct snd_ctl_elem_id * dst_id)735 int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
736 		      struct snd_ctl_elem_id *dst_id)
737 {
738 	struct snd_kcontrol *kctl;
739 
740 	down_write(&card->controls_rwsem);
741 	kctl = snd_ctl_find_id(card, src_id);
742 	if (kctl == NULL) {
743 		up_write(&card->controls_rwsem);
744 		return -ENOENT;
745 	}
746 	remove_hash_entries(card, kctl);
747 	kctl->id = *dst_id;
748 	kctl->id.numid = card->last_numid + 1;
749 	card->last_numid += kctl->count;
750 	add_hash_entries(card, kctl);
751 	up_write(&card->controls_rwsem);
752 	return 0;
753 }
754 EXPORT_SYMBOL(snd_ctl_rename_id);
755 
756 /**
757  * snd_ctl_rename - rename the control on the card
758  * @card: the card instance
759  * @kctl: the control to rename
760  * @name: the new name
761  *
762  * Renames the specified control on the card to the new name.
763  *
764  * Make sure to take the control write lock - down_write(&card->controls_rwsem).
765  */
snd_ctl_rename(struct snd_card * card,struct snd_kcontrol * kctl,const char * name)766 void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
767 		    const char *name)
768 {
769 	remove_hash_entries(card, kctl);
770 
771 	if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
772 		pr_warn("ALSA: Renamed control new name '%s' truncated to '%s'\n",
773 			name, kctl->id.name);
774 
775 	add_hash_entries(card, kctl);
776 }
777 EXPORT_SYMBOL(snd_ctl_rename);
778 
779 #ifndef CONFIG_SND_CTL_FAST_LOOKUP
780 static struct snd_kcontrol *
snd_ctl_find_numid_slow(struct snd_card * card,unsigned int numid)781 snd_ctl_find_numid_slow(struct snd_card *card, unsigned int numid)
782 {
783 	struct snd_kcontrol *kctl;
784 
785 	list_for_each_entry(kctl, &card->controls, list) {
786 		if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
787 			return kctl;
788 	}
789 	return NULL;
790 }
791 #endif /* !CONFIG_SND_CTL_FAST_LOOKUP */
792 
793 /**
794  * snd_ctl_find_numid - find the control instance with the given number-id
795  * @card: the card instance
796  * @numid: the number-id to search
797  *
798  * Finds the control instance with the given number-id from the card.
799  *
800  * The caller must down card->controls_rwsem before calling this function
801  * (if the race condition can happen).
802  *
803  * Return: The pointer of the instance if found, or %NULL if not.
804  *
805  */
snd_ctl_find_numid(struct snd_card * card,unsigned int numid)806 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card, unsigned int numid)
807 {
808 	if (snd_BUG_ON(!card || !numid))
809 		return NULL;
810 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
811 	return xa_load(&card->ctl_numids, numid);
812 #else
813 	return snd_ctl_find_numid_slow(card, numid);
814 #endif
815 }
816 EXPORT_SYMBOL(snd_ctl_find_numid);
817 
818 /**
819  * snd_ctl_find_id - find the control instance with the given id
820  * @card: the card instance
821  * @id: the id to search
822  *
823  * Finds the control instance with the given id from the card.
824  *
825  * The caller must down card->controls_rwsem before calling this function
826  * (if the race condition can happen).
827  *
828  * Return: The pointer of the instance if found, or %NULL if not.
829  *
830  */
snd_ctl_find_id(struct snd_card * card,struct snd_ctl_elem_id * id)831 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
832 				     struct snd_ctl_elem_id *id)
833 {
834 	struct snd_kcontrol *kctl;
835 
836 	if (snd_BUG_ON(!card || !id))
837 		return NULL;
838 	if (id->numid != 0)
839 		return snd_ctl_find_numid(card, id->numid);
840 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
841 	kctl = xa_load(&card->ctl_hash, get_ctl_id_hash(id));
842 	if (kctl && elem_id_matches(kctl, id))
843 		return kctl;
844 	if (!card->ctl_hash_collision)
845 		return NULL; /* we can rely on only hash table */
846 #endif
847 	/* no matching in hash table - try all as the last resort */
848 	list_for_each_entry(kctl, &card->controls, list)
849 		if (elem_id_matches(kctl, id))
850 			return kctl;
851 
852 	return NULL;
853 }
854 EXPORT_SYMBOL(snd_ctl_find_id);
855 
snd_ctl_card_info(struct snd_card * card,struct snd_ctl_file * ctl,unsigned int cmd,void __user * arg)856 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
857 			     unsigned int cmd, void __user *arg)
858 {
859 	struct snd_ctl_card_info *info;
860 
861 	info = kzalloc(sizeof(*info), GFP_KERNEL);
862 	if (! info)
863 		return -ENOMEM;
864 	down_read(&snd_ioctl_rwsem);
865 	info->card = card->number;
866 	strscpy(info->id, card->id, sizeof(info->id));
867 	strscpy(info->driver, card->driver, sizeof(info->driver));
868 	strscpy(info->name, card->shortname, sizeof(info->name));
869 	strscpy(info->longname, card->longname, sizeof(info->longname));
870 	strscpy(info->mixername, card->mixername, sizeof(info->mixername));
871 	strscpy(info->components, card->components, sizeof(info->components));
872 	up_read(&snd_ioctl_rwsem);
873 	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
874 		kfree(info);
875 		return -EFAULT;
876 	}
877 	kfree(info);
878 	return 0;
879 }
880 
snd_ctl_elem_list(struct snd_card * card,struct snd_ctl_elem_list * list)881 static int snd_ctl_elem_list(struct snd_card *card,
882 			     struct snd_ctl_elem_list *list)
883 {
884 	struct snd_kcontrol *kctl;
885 	struct snd_ctl_elem_id id;
886 	unsigned int offset, space, jidx;
887 	int err = 0;
888 
889 	offset = list->offset;
890 	space = list->space;
891 
892 	down_read(&card->controls_rwsem);
893 	list->count = card->controls_count;
894 	list->used = 0;
895 	if (space > 0) {
896 		list_for_each_entry(kctl, &card->controls, list) {
897 			if (offset >= kctl->count) {
898 				offset -= kctl->count;
899 				continue;
900 			}
901 			for (jidx = offset; jidx < kctl->count; jidx++) {
902 				snd_ctl_build_ioff(&id, kctl, jidx);
903 				if (copy_to_user(list->pids + list->used, &id,
904 						 sizeof(id))) {
905 					err = -EFAULT;
906 					goto out;
907 				}
908 				list->used++;
909 				if (!--space)
910 					goto out;
911 			}
912 			offset = 0;
913 		}
914 	}
915  out:
916 	up_read(&card->controls_rwsem);
917 	return err;
918 }
919 
snd_ctl_elem_list_user(struct snd_card * card,struct snd_ctl_elem_list __user * _list)920 static int snd_ctl_elem_list_user(struct snd_card *card,
921 				  struct snd_ctl_elem_list __user *_list)
922 {
923 	struct snd_ctl_elem_list list;
924 	int err;
925 
926 	if (copy_from_user(&list, _list, sizeof(list)))
927 		return -EFAULT;
928 	err = snd_ctl_elem_list(card, &list);
929 	if (err)
930 		return err;
931 	if (copy_to_user(_list, &list, sizeof(list)))
932 		return -EFAULT;
933 
934 	return 0;
935 }
936 
937 /* Check whether the given kctl info is valid */
snd_ctl_check_elem_info(struct snd_card * card,const struct snd_ctl_elem_info * info)938 static int snd_ctl_check_elem_info(struct snd_card *card,
939 				   const struct snd_ctl_elem_info *info)
940 {
941 	static const unsigned int max_value_counts[] = {
942 		[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= 128,
943 		[SNDRV_CTL_ELEM_TYPE_INTEGER]	= 128,
944 		[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
945 		[SNDRV_CTL_ELEM_TYPE_BYTES]	= 512,
946 		[SNDRV_CTL_ELEM_TYPE_IEC958]	= 1,
947 		[SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
948 	};
949 
950 	if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
951 	    info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
952 		if (card)
953 			dev_err(card->dev,
954 				"control %i:%i:%i:%s:%i: invalid type %d\n",
955 				info->id.iface, info->id.device,
956 				info->id.subdevice, info->id.name,
957 				info->id.index, info->type);
958 		return -EINVAL;
959 	}
960 	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
961 	    info->value.enumerated.items == 0) {
962 		if (card)
963 			dev_err(card->dev,
964 				"control %i:%i:%i:%s:%i: zero enum items\n",
965 				info->id.iface, info->id.device,
966 				info->id.subdevice, info->id.name,
967 				info->id.index);
968 		return -EINVAL;
969 	}
970 	if (info->count > max_value_counts[info->type]) {
971 		if (card)
972 			dev_err(card->dev,
973 				"control %i:%i:%i:%s:%i: invalid count %d\n",
974 				info->id.iface, info->id.device,
975 				info->id.subdevice, info->id.name,
976 				info->id.index, info->count);
977 		return -EINVAL;
978 	}
979 
980 	return 0;
981 }
982 
983 /* The capacity of struct snd_ctl_elem_value.value.*/
984 static const unsigned int value_sizes[] = {
985 	[SNDRV_CTL_ELEM_TYPE_BOOLEAN]	= sizeof(long),
986 	[SNDRV_CTL_ELEM_TYPE_INTEGER]	= sizeof(long),
987 	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
988 	[SNDRV_CTL_ELEM_TYPE_BYTES]	= sizeof(unsigned char),
989 	[SNDRV_CTL_ELEM_TYPE_IEC958]	= sizeof(struct snd_aes_iec958),
990 	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
991 };
992 
993 /* fill the remaining snd_ctl_elem_value data with the given pattern */
fill_remaining_elem_value(struct snd_ctl_elem_value * control,struct snd_ctl_elem_info * info,u32 pattern)994 static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
995 				      struct snd_ctl_elem_info *info,
996 				      u32 pattern)
997 {
998 	size_t offset = value_sizes[info->type] * info->count;
999 
1000 	offset = DIV_ROUND_UP(offset, sizeof(u32));
1001 	memset32((u32 *)control->value.bytes.data + offset, pattern,
1002 		 sizeof(control->value) / sizeof(u32) - offset);
1003 }
1004 
1005 /* check whether the given integer ctl value is valid */
sanity_check_int_value(struct snd_card * card,const struct snd_ctl_elem_value * control,const struct snd_ctl_elem_info * info,int i,bool print_error)1006 static int sanity_check_int_value(struct snd_card *card,
1007 				  const struct snd_ctl_elem_value *control,
1008 				  const struct snd_ctl_elem_info *info,
1009 				  int i, bool print_error)
1010 {
1011 	long long lval, lmin, lmax, lstep;
1012 	u64 rem;
1013 
1014 	switch (info->type) {
1015 	default:
1016 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1017 		lval = control->value.integer.value[i];
1018 		lmin = 0;
1019 		lmax = 1;
1020 		lstep = 0;
1021 		break;
1022 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1023 		lval = control->value.integer.value[i];
1024 		lmin = info->value.integer.min;
1025 		lmax = info->value.integer.max;
1026 		lstep = info->value.integer.step;
1027 		break;
1028 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1029 		lval = control->value.integer64.value[i];
1030 		lmin = info->value.integer64.min;
1031 		lmax = info->value.integer64.max;
1032 		lstep = info->value.integer64.step;
1033 		break;
1034 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1035 		lval = control->value.enumerated.item[i];
1036 		lmin = 0;
1037 		lmax = info->value.enumerated.items - 1;
1038 		lstep = 0;
1039 		break;
1040 	}
1041 
1042 	if (lval < lmin || lval > lmax) {
1043 		if (print_error)
1044 			dev_err(card->dev,
1045 				"control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
1046 				control->id.iface, control->id.device,
1047 				control->id.subdevice, control->id.name,
1048 				control->id.index, lval, lmin, lmax, i);
1049 		return -EINVAL;
1050 	}
1051 	if (lstep) {
1052 		div64_u64_rem(lval, lstep, &rem);
1053 		if (rem) {
1054 			if (print_error)
1055 				dev_err(card->dev,
1056 					"control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
1057 					control->id.iface, control->id.device,
1058 					control->id.subdevice, control->id.name,
1059 					control->id.index, lval, lstep, i);
1060 			return -EINVAL;
1061 		}
1062 	}
1063 
1064 	return 0;
1065 }
1066 
1067 /* check whether the all input values are valid for the given elem value */
sanity_check_input_values(struct snd_card * card,const struct snd_ctl_elem_value * control,const struct snd_ctl_elem_info * info,bool print_error)1068 static int sanity_check_input_values(struct snd_card *card,
1069 				     const struct snd_ctl_elem_value *control,
1070 				     const struct snd_ctl_elem_info *info,
1071 				     bool print_error)
1072 {
1073 	int i, ret;
1074 
1075 	switch (info->type) {
1076 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1077 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1078 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1079 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1080 		for (i = 0; i < info->count; i++) {
1081 			ret = sanity_check_int_value(card, control, info, i,
1082 						     print_error);
1083 			if (ret < 0)
1084 				return ret;
1085 		}
1086 		break;
1087 	default:
1088 		break;
1089 	}
1090 
1091 	return 0;
1092 }
1093 
1094 /* perform sanity checks to the given snd_ctl_elem_value object */
sanity_check_elem_value(struct snd_card * card,const struct snd_ctl_elem_value * control,const struct snd_ctl_elem_info * info,u32 pattern)1095 static int sanity_check_elem_value(struct snd_card *card,
1096 				   const struct snd_ctl_elem_value *control,
1097 				   const struct snd_ctl_elem_info *info,
1098 				   u32 pattern)
1099 {
1100 	size_t offset;
1101 	int ret;
1102 	u32 *p;
1103 
1104 	ret = sanity_check_input_values(card, control, info, true);
1105 	if (ret < 0)
1106 		return ret;
1107 
1108 	/* check whether the remaining area kept untouched */
1109 	offset = value_sizes[info->type] * info->count;
1110 	offset = DIV_ROUND_UP(offset, sizeof(u32));
1111 	p = (u32 *)control->value.bytes.data + offset;
1112 	for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
1113 		if (*p != pattern) {
1114 			ret = -EINVAL;
1115 			break;
1116 		}
1117 		*p = 0; /* clear the checked area */
1118 	}
1119 
1120 	return ret;
1121 }
1122 
__snd_ctl_elem_info(struct snd_card * card,struct snd_kcontrol * kctl,struct snd_ctl_elem_info * info,struct snd_ctl_file * ctl)1123 static int __snd_ctl_elem_info(struct snd_card *card,
1124 			       struct snd_kcontrol *kctl,
1125 			       struct snd_ctl_elem_info *info,
1126 			       struct snd_ctl_file *ctl)
1127 {
1128 	struct snd_kcontrol_volatile *vd;
1129 	unsigned int index_offset;
1130 	int result;
1131 
1132 #ifdef CONFIG_SND_DEBUG
1133 	info->access = 0;
1134 #endif
1135 	result = snd_power_ref_and_wait(card);
1136 	if (!result)
1137 		result = kctl->info(kctl, info);
1138 	snd_power_unref(card);
1139 	if (result >= 0) {
1140 		snd_BUG_ON(info->access);
1141 		index_offset = snd_ctl_get_ioff(kctl, &info->id);
1142 		vd = &kctl->vd[index_offset];
1143 		snd_ctl_build_ioff(&info->id, kctl, index_offset);
1144 		info->access = vd->access;
1145 		if (vd->owner) {
1146 			info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
1147 			if (vd->owner == ctl)
1148 				info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
1149 			info->owner = pid_vnr(vd->owner->pid);
1150 		} else {
1151 			info->owner = -1;
1152 		}
1153 		if (!snd_ctl_skip_validation(info) &&
1154 		    snd_ctl_check_elem_info(card, info) < 0)
1155 			result = -EINVAL;
1156 	}
1157 	return result;
1158 }
1159 
snd_ctl_elem_info(struct snd_ctl_file * ctl,struct snd_ctl_elem_info * info)1160 static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
1161 			     struct snd_ctl_elem_info *info)
1162 {
1163 	struct snd_card *card = ctl->card;
1164 	struct snd_kcontrol *kctl;
1165 	int result;
1166 
1167 	down_read(&card->controls_rwsem);
1168 	kctl = snd_ctl_find_id(card, &info->id);
1169 	if (kctl == NULL)
1170 		result = -ENOENT;
1171 	else
1172 		result = __snd_ctl_elem_info(card, kctl, info, ctl);
1173 	up_read(&card->controls_rwsem);
1174 	return result;
1175 }
1176 
snd_ctl_elem_info_user(struct snd_ctl_file * ctl,struct snd_ctl_elem_info __user * _info)1177 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
1178 				  struct snd_ctl_elem_info __user *_info)
1179 {
1180 	struct snd_ctl_elem_info info;
1181 	int result;
1182 
1183 	if (copy_from_user(&info, _info, sizeof(info)))
1184 		return -EFAULT;
1185 	result = snd_ctl_elem_info(ctl, &info);
1186 	if (result < 0)
1187 		return result;
1188 	/* drop internal access flags */
1189 	info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
1190 			 SNDRV_CTL_ELEM_ACCESS_LED_MASK);
1191 	if (copy_to_user(_info, &info, sizeof(info)))
1192 		return -EFAULT;
1193 	return result;
1194 }
1195 
snd_ctl_elem_read(struct snd_card * card,struct snd_ctl_elem_value * control)1196 static int snd_ctl_elem_read(struct snd_card *card,
1197 			     struct snd_ctl_elem_value *control)
1198 {
1199 	struct snd_kcontrol *kctl;
1200 	struct snd_kcontrol_volatile *vd;
1201 	unsigned int index_offset;
1202 	struct snd_ctl_elem_info info;
1203 	const u32 pattern = 0xdeadbeef;
1204 	int ret;
1205 
1206 	down_read(&card->controls_rwsem);
1207 	kctl = snd_ctl_find_id(card, &control->id);
1208 	if (kctl == NULL) {
1209 		ret = -ENOENT;
1210 		goto unlock;
1211 	}
1212 
1213 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1214 	vd = &kctl->vd[index_offset];
1215 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) {
1216 		ret = -EPERM;
1217 		goto unlock;
1218 	}
1219 
1220 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1221 
1222 #ifdef CONFIG_SND_CTL_DEBUG
1223 	/* info is needed only for validation */
1224 	memset(&info, 0, sizeof(info));
1225 	info.id = control->id;
1226 	ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
1227 	if (ret < 0)
1228 		goto unlock;
1229 #endif
1230 
1231 	if (!snd_ctl_skip_validation(&info))
1232 		fill_remaining_elem_value(control, &info, pattern);
1233 	ret = snd_power_ref_and_wait(card);
1234 	if (!ret)
1235 		ret = kctl->get(kctl, control);
1236 	snd_power_unref(card);
1237 	if (ret < 0)
1238 		goto unlock;
1239 	if (!snd_ctl_skip_validation(&info) &&
1240 	    sanity_check_elem_value(card, control, &info, pattern) < 0) {
1241 		dev_err(card->dev,
1242 			"control %i:%i:%i:%s:%i: access overflow\n",
1243 			control->id.iface, control->id.device,
1244 			control->id.subdevice, control->id.name,
1245 			control->id.index);
1246 		ret = -EINVAL;
1247 		goto unlock;
1248 	}
1249 unlock:
1250 	up_read(&card->controls_rwsem);
1251 	return ret;
1252 }
1253 
snd_ctl_elem_read_user(struct snd_card * card,struct snd_ctl_elem_value __user * _control)1254 static int snd_ctl_elem_read_user(struct snd_card *card,
1255 				  struct snd_ctl_elem_value __user *_control)
1256 {
1257 	struct snd_ctl_elem_value *control;
1258 	int result;
1259 
1260 	control = memdup_user(_control, sizeof(*control));
1261 	if (IS_ERR(control))
1262 		return PTR_ERR(control);
1263 
1264 	result = snd_ctl_elem_read(card, control);
1265 	if (result < 0)
1266 		goto error;
1267 
1268 	if (copy_to_user(_control, control, sizeof(*control)))
1269 		result = -EFAULT;
1270  error:
1271 	kfree(control);
1272 	return result;
1273 }
1274 
snd_ctl_elem_write(struct snd_card * card,struct snd_ctl_file * file,struct snd_ctl_elem_value * control)1275 static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
1276 			      struct snd_ctl_elem_value *control)
1277 {
1278 	struct snd_kcontrol *kctl;
1279 	struct snd_kcontrol_volatile *vd;
1280 	unsigned int index_offset;
1281 	int result;
1282 
1283 	down_write(&card->controls_rwsem);
1284 	kctl = snd_ctl_find_id(card, &control->id);
1285 	if (kctl == NULL) {
1286 		up_write(&card->controls_rwsem);
1287 		return -ENOENT;
1288 	}
1289 
1290 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
1291 	vd = &kctl->vd[index_offset];
1292 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
1293 	    (file && vd->owner && vd->owner != file)) {
1294 		up_write(&card->controls_rwsem);
1295 		return -EPERM;
1296 	}
1297 
1298 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
1299 	result = snd_power_ref_and_wait(card);
1300 	/* validate input values */
1301 	if (IS_ENABLED(CONFIG_SND_CTL_INPUT_VALIDATION) && !result) {
1302 		struct snd_ctl_elem_info info;
1303 
1304 		memset(&info, 0, sizeof(info));
1305 		info.id = control->id;
1306 		result = __snd_ctl_elem_info(card, kctl, &info, NULL);
1307 		if (!result)
1308 			result = sanity_check_input_values(card, control, &info,
1309 							   false);
1310 	}
1311 	if (!result)
1312 		result = kctl->put(kctl, control);
1313 	snd_power_unref(card);
1314 	if (result < 0) {
1315 		up_write(&card->controls_rwsem);
1316 		return result;
1317 	}
1318 
1319 	if (result > 0) {
1320 		downgrade_write(&card->controls_rwsem);
1321 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
1322 		up_read(&card->controls_rwsem);
1323 	} else {
1324 		up_write(&card->controls_rwsem);
1325 	}
1326 
1327 	return 0;
1328 }
1329 
snd_ctl_elem_write_user(struct snd_ctl_file * file,struct snd_ctl_elem_value __user * _control)1330 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
1331 				   struct snd_ctl_elem_value __user *_control)
1332 {
1333 	struct snd_ctl_elem_value *control;
1334 	struct snd_card *card;
1335 	int result;
1336 
1337 	control = memdup_user(_control, sizeof(*control));
1338 	if (IS_ERR(control))
1339 		return PTR_ERR(control);
1340 
1341 	card = file->card;
1342 	result = snd_ctl_elem_write(card, file, control);
1343 	if (result < 0)
1344 		goto error;
1345 
1346 	if (copy_to_user(_control, control, sizeof(*control)))
1347 		result = -EFAULT;
1348  error:
1349 	kfree(control);
1350 	return result;
1351 }
1352 
snd_ctl_elem_lock(struct snd_ctl_file * file,struct snd_ctl_elem_id __user * _id)1353 static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1354 			     struct snd_ctl_elem_id __user *_id)
1355 {
1356 	struct snd_card *card = file->card;
1357 	struct snd_ctl_elem_id id;
1358 	struct snd_kcontrol *kctl;
1359 	struct snd_kcontrol_volatile *vd;
1360 	int result;
1361 
1362 	if (copy_from_user(&id, _id, sizeof(id)))
1363 		return -EFAULT;
1364 	down_write(&card->controls_rwsem);
1365 	kctl = snd_ctl_find_id(card, &id);
1366 	if (kctl == NULL) {
1367 		result = -ENOENT;
1368 	} else {
1369 		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1370 		if (vd->owner != NULL)
1371 			result = -EBUSY;
1372 		else {
1373 			vd->owner = file;
1374 			result = 0;
1375 		}
1376 	}
1377 	up_write(&card->controls_rwsem);
1378 	return result;
1379 }
1380 
snd_ctl_elem_unlock(struct snd_ctl_file * file,struct snd_ctl_elem_id __user * _id)1381 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1382 			       struct snd_ctl_elem_id __user *_id)
1383 {
1384 	struct snd_card *card = file->card;
1385 	struct snd_ctl_elem_id id;
1386 	struct snd_kcontrol *kctl;
1387 	struct snd_kcontrol_volatile *vd;
1388 	int result;
1389 
1390 	if (copy_from_user(&id, _id, sizeof(id)))
1391 		return -EFAULT;
1392 	down_write(&card->controls_rwsem);
1393 	kctl = snd_ctl_find_id(card, &id);
1394 	if (kctl == NULL) {
1395 		result = -ENOENT;
1396 	} else {
1397 		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1398 		if (vd->owner == NULL)
1399 			result = -EINVAL;
1400 		else if (vd->owner != file)
1401 			result = -EPERM;
1402 		else {
1403 			vd->owner = NULL;
1404 			result = 0;
1405 		}
1406 	}
1407 	up_write(&card->controls_rwsem);
1408 	return result;
1409 }
1410 
1411 struct user_element {
1412 	struct snd_ctl_elem_info info;
1413 	struct snd_card *card;
1414 	char *elem_data;		/* element data */
1415 	unsigned long elem_data_size;	/* size of element data in bytes */
1416 	void *tlv_data;			/* TLV data */
1417 	unsigned long tlv_data_size;	/* TLV data size */
1418 	void *priv_data;		/* private data (like strings for enumerated type) */
1419 };
1420 
1421 // check whether the addition (in bytes) of user ctl element may overflow the limit.
check_user_elem_overflow(struct snd_card * card,ssize_t add)1422 static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
1423 {
1424 	return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
1425 }
1426 
snd_ctl_elem_user_info(struct snd_kcontrol * kcontrol,struct snd_ctl_elem_info * uinfo)1427 static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1428 				  struct snd_ctl_elem_info *uinfo)
1429 {
1430 	struct user_element *ue = kcontrol->private_data;
1431 	unsigned int offset;
1432 
1433 	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1434 	*uinfo = ue->info;
1435 	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1436 
1437 	return 0;
1438 }
1439 
snd_ctl_elem_user_enum_info(struct snd_kcontrol * kcontrol,struct snd_ctl_elem_info * uinfo)1440 static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1441 				       struct snd_ctl_elem_info *uinfo)
1442 {
1443 	struct user_element *ue = kcontrol->private_data;
1444 	const char *names;
1445 	unsigned int item;
1446 	unsigned int offset;
1447 
1448 	item = uinfo->value.enumerated.item;
1449 
1450 	offset = snd_ctl_get_ioff(kcontrol, &uinfo->id);
1451 	*uinfo = ue->info;
1452 	snd_ctl_build_ioff(&uinfo->id, kcontrol, offset);
1453 
1454 	item = min(item, uinfo->value.enumerated.items - 1);
1455 	uinfo->value.enumerated.item = item;
1456 
1457 	names = ue->priv_data;
1458 	for (; item > 0; --item)
1459 		names += strlen(names) + 1;
1460 	strcpy(uinfo->value.enumerated.name, names);
1461 
1462 	return 0;
1463 }
1464 
snd_ctl_elem_user_get(struct snd_kcontrol * kcontrol,struct snd_ctl_elem_value * ucontrol)1465 static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1466 				 struct snd_ctl_elem_value *ucontrol)
1467 {
1468 	struct user_element *ue = kcontrol->private_data;
1469 	unsigned int size = ue->elem_data_size;
1470 	char *src = ue->elem_data +
1471 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1472 
1473 	memcpy(&ucontrol->value, src, size);
1474 	return 0;
1475 }
1476 
snd_ctl_elem_user_put(struct snd_kcontrol * kcontrol,struct snd_ctl_elem_value * ucontrol)1477 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1478 				 struct snd_ctl_elem_value *ucontrol)
1479 {
1480 	int change;
1481 	struct user_element *ue = kcontrol->private_data;
1482 	unsigned int size = ue->elem_data_size;
1483 	char *dst = ue->elem_data +
1484 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
1485 
1486 	change = memcmp(&ucontrol->value, dst, size) != 0;
1487 	if (change)
1488 		memcpy(dst, &ucontrol->value, size);
1489 	return change;
1490 }
1491 
1492 /* called in controls_rwsem write lock */
replace_user_tlv(struct snd_kcontrol * kctl,unsigned int __user * buf,unsigned int size)1493 static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1494 			    unsigned int size)
1495 {
1496 	struct user_element *ue = kctl->private_data;
1497 	unsigned int *container;
1498 	unsigned int mask = 0;
1499 	int i;
1500 	int change;
1501 
1502 	if (size > 1024 * 128)	/* sane value */
1503 		return -EINVAL;
1504 
1505 	// does the TLV size change cause overflow?
1506 	if (check_user_elem_overflow(ue->card, (ssize_t)(size - ue->tlv_data_size)))
1507 		return -ENOMEM;
1508 
1509 	container = vmemdup_user(buf, size);
1510 	if (IS_ERR(container))
1511 		return PTR_ERR(container);
1512 
1513 	change = ue->tlv_data_size != size;
1514 	if (!change)
1515 		change = memcmp(ue->tlv_data, container, size) != 0;
1516 	if (!change) {
1517 		kvfree(container);
1518 		return 0;
1519 	}
1520 
1521 	if (ue->tlv_data == NULL) {
1522 		/* Now TLV data is available. */
1523 		for (i = 0; i < kctl->count; ++i)
1524 			kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
1525 		mask = SNDRV_CTL_EVENT_MASK_INFO;
1526 	} else {
1527 		ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1528 		ue->tlv_data_size = 0;
1529 		kvfree(ue->tlv_data);
1530 	}
1531 
1532 	ue->tlv_data = container;
1533 	ue->tlv_data_size = size;
1534 	// decremented at private_free.
1535 	ue->card->user_ctl_alloc_size += size;
1536 
1537 	mask |= SNDRV_CTL_EVENT_MASK_TLV;
1538 	for (i = 0; i < kctl->count; ++i)
1539 		snd_ctl_notify_one(ue->card, mask, kctl, i);
1540 
1541 	return change;
1542 }
1543 
read_user_tlv(struct snd_kcontrol * kctl,unsigned int __user * buf,unsigned int size)1544 static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1545 			 unsigned int size)
1546 {
1547 	struct user_element *ue = kctl->private_data;
1548 
1549 	if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
1550 		return -ENXIO;
1551 
1552 	if (size < ue->tlv_data_size)
1553 		return -ENOSPC;
1554 
1555 	if (copy_to_user(buf, ue->tlv_data, ue->tlv_data_size))
1556 		return -EFAULT;
1557 
1558 	return 0;
1559 }
1560 
snd_ctl_elem_user_tlv(struct snd_kcontrol * kctl,int op_flag,unsigned int size,unsigned int __user * buf)1561 static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
1562 				 unsigned int size, unsigned int __user *buf)
1563 {
1564 	if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
1565 		return replace_user_tlv(kctl, buf, size);
1566 	else
1567 		return read_user_tlv(kctl, buf, size);
1568 }
1569 
1570 /* called in controls_rwsem write lock */
snd_ctl_elem_init_enum_names(struct user_element * ue)1571 static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1572 {
1573 	char *names, *p;
1574 	size_t buf_len, name_len;
1575 	unsigned int i;
1576 	const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1577 
1578 	buf_len = ue->info.value.enumerated.names_length;
1579 	if (buf_len > 64 * 1024)
1580 		return -EINVAL;
1581 
1582 	if (check_user_elem_overflow(ue->card, buf_len))
1583 		return -ENOMEM;
1584 	names = vmemdup_user((const void __user *)user_ptrval, buf_len);
1585 	if (IS_ERR(names))
1586 		return PTR_ERR(names);
1587 
1588 	/* check that there are enough valid names */
1589 	p = names;
1590 	for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1591 		name_len = strnlen(p, buf_len);
1592 		if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1593 			kvfree(names);
1594 			return -EINVAL;
1595 		}
1596 		p += name_len + 1;
1597 		buf_len -= name_len + 1;
1598 	}
1599 
1600 	ue->priv_data = names;
1601 	ue->info.value.enumerated.names_ptr = 0;
1602 	// increment the allocation size; decremented again at private_free.
1603 	ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
1604 
1605 	return 0;
1606 }
1607 
compute_user_elem_size(size_t size,unsigned int count)1608 static size_t compute_user_elem_size(size_t size, unsigned int count)
1609 {
1610 	return sizeof(struct user_element) + size * count;
1611 }
1612 
snd_ctl_elem_user_free(struct snd_kcontrol * kcontrol)1613 static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1614 {
1615 	struct user_element *ue = kcontrol->private_data;
1616 
1617 	// decrement the allocation size.
1618 	ue->card->user_ctl_alloc_size -= compute_user_elem_size(ue->elem_data_size, kcontrol->count);
1619 	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1620 	if (ue->priv_data)
1621 		ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
1622 
1623 	kvfree(ue->tlv_data);
1624 	kvfree(ue->priv_data);
1625 	kfree(ue);
1626 }
1627 
snd_ctl_elem_add(struct snd_ctl_file * file,struct snd_ctl_elem_info * info,int replace)1628 static int snd_ctl_elem_add(struct snd_ctl_file *file,
1629 			    struct snd_ctl_elem_info *info, int replace)
1630 {
1631 	struct snd_card *card = file->card;
1632 	struct snd_kcontrol *kctl;
1633 	unsigned int count;
1634 	unsigned int access;
1635 	long private_size;
1636 	size_t alloc_size;
1637 	struct user_element *ue;
1638 	unsigned int offset;
1639 	int err;
1640 
1641 	if (!*info->id.name)
1642 		return -EINVAL;
1643 	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
1644 		return -EINVAL;
1645 
1646 	/* Delete a control to replace them if needed. */
1647 	if (replace) {
1648 		info->id.numid = 0;
1649 		err = snd_ctl_remove_user_ctl(file, &info->id);
1650 		if (err)
1651 			return err;
1652 	}
1653 
1654 	/* Check the number of elements for this userspace control. */
1655 	count = info->owner;
1656 	if (count == 0)
1657 		count = 1;
1658 
1659 	/* Arrange access permissions if needed. */
1660 	access = info->access;
1661 	if (access == 0)
1662 		access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1663 	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1664 		   SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1665 		   SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
1666 
1667 	/* In initial state, nothing is available as TLV container. */
1668 	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1669 		access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1670 	access |= SNDRV_CTL_ELEM_ACCESS_USER;
1671 
1672 	/*
1673 	 * Check information and calculate the size of data specific to
1674 	 * this userspace control.
1675 	 */
1676 	/* pass NULL to card for suppressing error messages */
1677 	err = snd_ctl_check_elem_info(NULL, info);
1678 	if (err < 0)
1679 		return err;
1680 	/* user-space control doesn't allow zero-size data */
1681 	if (info->count < 1)
1682 		return -EINVAL;
1683 	private_size = value_sizes[info->type] * info->count;
1684 	alloc_size = compute_user_elem_size(private_size, count);
1685 
1686 	down_write(&card->controls_rwsem);
1687 	if (check_user_elem_overflow(card, alloc_size)) {
1688 		err = -ENOMEM;
1689 		goto unlock;
1690 	}
1691 
1692 	/*
1693 	 * Keep memory object for this userspace control. After passing this
1694 	 * code block, the instance should be freed by snd_ctl_free_one().
1695 	 *
1696 	 * Note that these elements in this control are locked.
1697 	 */
1698 	err = snd_ctl_new(&kctl, count, access, file);
1699 	if (err < 0)
1700 		goto unlock;
1701 	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1702 	ue = kzalloc(alloc_size, GFP_KERNEL);
1703 	if (!ue) {
1704 		kfree(kctl);
1705 		err = -ENOMEM;
1706 		goto unlock;
1707 	}
1708 	kctl->private_data = ue;
1709 	kctl->private_free = snd_ctl_elem_user_free;
1710 
1711 	// increment the allocated size; decremented again at private_free.
1712 	card->user_ctl_alloc_size += alloc_size;
1713 
1714 	/* Set private data for this userspace control. */
1715 	ue->card = card;
1716 	ue->info = *info;
1717 	ue->info.access = 0;
1718 	ue->elem_data = (char *)ue + sizeof(*ue);
1719 	ue->elem_data_size = private_size;
1720 	if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1721 		err = snd_ctl_elem_init_enum_names(ue);
1722 		if (err < 0) {
1723 			snd_ctl_free_one(kctl);
1724 			goto unlock;
1725 		}
1726 	}
1727 
1728 	/* Set callback functions. */
1729 	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1730 		kctl->info = snd_ctl_elem_user_enum_info;
1731 	else
1732 		kctl->info = snd_ctl_elem_user_info;
1733 	if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1734 		kctl->get = snd_ctl_elem_user_get;
1735 	if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1736 		kctl->put = snd_ctl_elem_user_put;
1737 	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1738 		kctl->tlv.c = snd_ctl_elem_user_tlv;
1739 
1740 	/* This function manage to free the instance on failure. */
1741 	err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
1742 	if (err < 0) {
1743 		snd_ctl_free_one(kctl);
1744 		goto unlock;
1745 	}
1746 	offset = snd_ctl_get_ioff(kctl, &info->id);
1747 	snd_ctl_build_ioff(&info->id, kctl, offset);
1748 	/*
1749 	 * Here we cannot fill any field for the number of elements added by
1750 	 * this operation because there're no specific fields. The usage of
1751 	 * 'owner' field for this purpose may cause any bugs to userspace
1752 	 * applications because the field originally means PID of a process
1753 	 * which locks the element.
1754 	 */
1755  unlock:
1756 	up_write(&card->controls_rwsem);
1757 	return err;
1758 }
1759 
snd_ctl_elem_add_user(struct snd_ctl_file * file,struct snd_ctl_elem_info __user * _info,int replace)1760 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1761 				 struct snd_ctl_elem_info __user *_info, int replace)
1762 {
1763 	struct snd_ctl_elem_info info;
1764 	int err;
1765 
1766 	if (copy_from_user(&info, _info, sizeof(info)))
1767 		return -EFAULT;
1768 	err = snd_ctl_elem_add(file, &info, replace);
1769 	if (err < 0)
1770 		return err;
1771 	if (copy_to_user(_info, &info, sizeof(info))) {
1772 		snd_ctl_remove_user_ctl(file, &info.id);
1773 		return -EFAULT;
1774 	}
1775 
1776 	return 0;
1777 }
1778 
snd_ctl_elem_remove(struct snd_ctl_file * file,struct snd_ctl_elem_id __user * _id)1779 static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1780 			       struct snd_ctl_elem_id __user *_id)
1781 {
1782 	struct snd_ctl_elem_id id;
1783 
1784 	if (copy_from_user(&id, _id, sizeof(id)))
1785 		return -EFAULT;
1786 	return snd_ctl_remove_user_ctl(file, &id);
1787 }
1788 
snd_ctl_subscribe_events(struct snd_ctl_file * file,int __user * ptr)1789 static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1790 {
1791 	int subscribe;
1792 	if (get_user(subscribe, ptr))
1793 		return -EFAULT;
1794 	if (subscribe < 0) {
1795 		subscribe = file->subscribed;
1796 		if (put_user(subscribe, ptr))
1797 			return -EFAULT;
1798 		return 0;
1799 	}
1800 	if (subscribe) {
1801 		file->subscribed = 1;
1802 		return 0;
1803 	} else if (file->subscribed) {
1804 		snd_ctl_empty_read_queue(file);
1805 		file->subscribed = 0;
1806 	}
1807 	return 0;
1808 }
1809 
call_tlv_handler(struct snd_ctl_file * file,int op_flag,struct snd_kcontrol * kctl,struct snd_ctl_elem_id * id,unsigned int __user * buf,unsigned int size)1810 static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
1811 			    struct snd_kcontrol *kctl,
1812 			    struct snd_ctl_elem_id *id,
1813 			    unsigned int __user *buf, unsigned int size)
1814 {
1815 	static const struct {
1816 		int op;
1817 		int perm;
1818 	} pairs[] = {
1819 		{SNDRV_CTL_TLV_OP_READ,  SNDRV_CTL_ELEM_ACCESS_TLV_READ},
1820 		{SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
1821 		{SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
1822 	};
1823 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1824 	int i, ret;
1825 
1826 	/* Check support of the request for this element. */
1827 	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
1828 		if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
1829 			break;
1830 	}
1831 	if (i == ARRAY_SIZE(pairs))
1832 		return -ENXIO;
1833 
1834 	if (kctl->tlv.c == NULL)
1835 		return -ENXIO;
1836 
1837 	/* Write and command operations are not allowed for locked element. */
1838 	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
1839 	    vd->owner != NULL && vd->owner != file)
1840 		return -EPERM;
1841 
1842 	ret = snd_power_ref_and_wait(file->card);
1843 	if (!ret)
1844 		ret = kctl->tlv.c(kctl, op_flag, size, buf);
1845 	snd_power_unref(file->card);
1846 	return ret;
1847 }
1848 
read_tlv_buf(struct snd_kcontrol * kctl,struct snd_ctl_elem_id * id,unsigned int __user * buf,unsigned int size)1849 static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
1850 			unsigned int __user *buf, unsigned int size)
1851 {
1852 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1853 	unsigned int len;
1854 
1855 	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
1856 		return -ENXIO;
1857 
1858 	if (kctl->tlv.p == NULL)
1859 		return -ENXIO;
1860 
1861 	len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
1862 	if (size < len)
1863 		return -ENOMEM;
1864 
1865 	if (copy_to_user(buf, kctl->tlv.p, len))
1866 		return -EFAULT;
1867 
1868 	return 0;
1869 }
1870 
snd_ctl_tlv_ioctl(struct snd_ctl_file * file,struct snd_ctl_tlv __user * buf,int op_flag)1871 static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1872 			     struct snd_ctl_tlv __user *buf,
1873                              int op_flag)
1874 {
1875 	struct snd_ctl_tlv header;
1876 	unsigned int __user *container;
1877 	unsigned int container_size;
1878 	struct snd_kcontrol *kctl;
1879 	struct snd_ctl_elem_id id;
1880 	struct snd_kcontrol_volatile *vd;
1881 
1882 	if (copy_from_user(&header, buf, sizeof(header)))
1883 		return -EFAULT;
1884 
1885 	/* In design of control core, numerical ID starts at 1. */
1886 	if (header.numid == 0)
1887 		return -EINVAL;
1888 
1889 	/* At least, container should include type and length fields.  */
1890 	if (header.length < sizeof(unsigned int) * 2)
1891 		return -EINVAL;
1892 	container_size = header.length;
1893 	container = buf->tlv;
1894 
1895 	kctl = snd_ctl_find_numid(file->card, header.numid);
1896 	if (kctl == NULL)
1897 		return -ENOENT;
1898 
1899 	/* Calculate index of the element in this set. */
1900 	id = kctl->id;
1901 	snd_ctl_build_ioff(&id, kctl, header.numid - id.numid);
1902 	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
1903 
1904 	if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1905 		return call_tlv_handler(file, op_flag, kctl, &id, container,
1906 					container_size);
1907 	} else {
1908 		if (op_flag == SNDRV_CTL_TLV_OP_READ) {
1909 			return read_tlv_buf(kctl, &id, container,
1910 					    container_size);
1911 		}
1912 	}
1913 
1914 	/* Not supported. */
1915 	return -ENXIO;
1916 }
1917 
snd_ctl_ioctl(struct file * file,unsigned int cmd,unsigned long arg)1918 static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1919 {
1920 	struct snd_ctl_file *ctl;
1921 	struct snd_card *card;
1922 	struct snd_kctl_ioctl *p;
1923 	void __user *argp = (void __user *)arg;
1924 	int __user *ip = argp;
1925 	int err;
1926 
1927 	ctl = file->private_data;
1928 	card = ctl->card;
1929 	if (snd_BUG_ON(!card))
1930 		return -ENXIO;
1931 	switch (cmd) {
1932 	case SNDRV_CTL_IOCTL_PVERSION:
1933 		return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1934 	case SNDRV_CTL_IOCTL_CARD_INFO:
1935 		return snd_ctl_card_info(card, ctl, cmd, argp);
1936 	case SNDRV_CTL_IOCTL_ELEM_LIST:
1937 		return snd_ctl_elem_list_user(card, argp);
1938 	case SNDRV_CTL_IOCTL_ELEM_INFO:
1939 		return snd_ctl_elem_info_user(ctl, argp);
1940 	case SNDRV_CTL_IOCTL_ELEM_READ:
1941 		return snd_ctl_elem_read_user(card, argp);
1942 	case SNDRV_CTL_IOCTL_ELEM_WRITE:
1943 		return snd_ctl_elem_write_user(ctl, argp);
1944 	case SNDRV_CTL_IOCTL_ELEM_LOCK:
1945 		return snd_ctl_elem_lock(ctl, argp);
1946 	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1947 		return snd_ctl_elem_unlock(ctl, argp);
1948 	case SNDRV_CTL_IOCTL_ELEM_ADD:
1949 		return snd_ctl_elem_add_user(ctl, argp, 0);
1950 	case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1951 		return snd_ctl_elem_add_user(ctl, argp, 1);
1952 	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1953 		return snd_ctl_elem_remove(ctl, argp);
1954 	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1955 		return snd_ctl_subscribe_events(ctl, ip);
1956 	case SNDRV_CTL_IOCTL_TLV_READ:
1957 		down_read(&ctl->card->controls_rwsem);
1958 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
1959 		up_read(&ctl->card->controls_rwsem);
1960 		return err;
1961 	case SNDRV_CTL_IOCTL_TLV_WRITE:
1962 		down_write(&ctl->card->controls_rwsem);
1963 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
1964 		up_write(&ctl->card->controls_rwsem);
1965 		return err;
1966 	case SNDRV_CTL_IOCTL_TLV_COMMAND:
1967 		down_write(&ctl->card->controls_rwsem);
1968 		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
1969 		up_write(&ctl->card->controls_rwsem);
1970 		return err;
1971 	case SNDRV_CTL_IOCTL_POWER:
1972 		return -ENOPROTOOPT;
1973 	case SNDRV_CTL_IOCTL_POWER_STATE:
1974 		return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1975 	}
1976 	down_read(&snd_ioctl_rwsem);
1977 	list_for_each_entry(p, &snd_control_ioctls, list) {
1978 		err = p->fioctl(card, ctl, cmd, arg);
1979 		if (err != -ENOIOCTLCMD) {
1980 			up_read(&snd_ioctl_rwsem);
1981 			return err;
1982 		}
1983 	}
1984 	up_read(&snd_ioctl_rwsem);
1985 	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
1986 	return -ENOTTY;
1987 }
1988 
snd_ctl_read(struct file * file,char __user * buffer,size_t count,loff_t * offset)1989 static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1990 			    size_t count, loff_t * offset)
1991 {
1992 	struct snd_ctl_file *ctl;
1993 	int err = 0;
1994 	ssize_t result = 0;
1995 
1996 	ctl = file->private_data;
1997 	if (snd_BUG_ON(!ctl || !ctl->card))
1998 		return -ENXIO;
1999 	if (!ctl->subscribed)
2000 		return -EBADFD;
2001 	if (count < sizeof(struct snd_ctl_event))
2002 		return -EINVAL;
2003 	spin_lock_irq(&ctl->read_lock);
2004 	while (count >= sizeof(struct snd_ctl_event)) {
2005 		struct snd_ctl_event ev;
2006 		struct snd_kctl_event *kev;
2007 		while (list_empty(&ctl->events)) {
2008 			wait_queue_entry_t wait;
2009 			if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
2010 				err = -EAGAIN;
2011 				goto __end_lock;
2012 			}
2013 			init_waitqueue_entry(&wait, current);
2014 			add_wait_queue(&ctl->change_sleep, &wait);
2015 			set_current_state(TASK_INTERRUPTIBLE);
2016 			spin_unlock_irq(&ctl->read_lock);
2017 			schedule();
2018 			remove_wait_queue(&ctl->change_sleep, &wait);
2019 			if (ctl->card->shutdown)
2020 				return -ENODEV;
2021 			if (signal_pending(current))
2022 				return -ERESTARTSYS;
2023 			spin_lock_irq(&ctl->read_lock);
2024 		}
2025 		kev = snd_kctl_event(ctl->events.next);
2026 		ev.type = SNDRV_CTL_EVENT_ELEM;
2027 		ev.data.elem.mask = kev->mask;
2028 		ev.data.elem.id = kev->id;
2029 		list_del(&kev->list);
2030 		spin_unlock_irq(&ctl->read_lock);
2031 		kfree(kev);
2032 		if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
2033 			err = -EFAULT;
2034 			goto __end;
2035 		}
2036 		spin_lock_irq(&ctl->read_lock);
2037 		buffer += sizeof(struct snd_ctl_event);
2038 		count -= sizeof(struct snd_ctl_event);
2039 		result += sizeof(struct snd_ctl_event);
2040 	}
2041       __end_lock:
2042 	spin_unlock_irq(&ctl->read_lock);
2043       __end:
2044       	return result > 0 ? result : err;
2045 }
2046 
snd_ctl_poll(struct file * file,poll_table * wait)2047 static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
2048 {
2049 	__poll_t mask;
2050 	struct snd_ctl_file *ctl;
2051 
2052 	ctl = file->private_data;
2053 	if (!ctl->subscribed)
2054 		return 0;
2055 	poll_wait(file, &ctl->change_sleep, wait);
2056 
2057 	mask = 0;
2058 	if (!list_empty(&ctl->events))
2059 		mask |= EPOLLIN | EPOLLRDNORM;
2060 
2061 	return mask;
2062 }
2063 
2064 /*
2065  * register the device-specific control-ioctls.
2066  * called from each device manager like pcm.c, hwdep.c, etc.
2067  */
_snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn,struct list_head * lists)2068 static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
2069 {
2070 	struct snd_kctl_ioctl *pn;
2071 
2072 	pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
2073 	if (pn == NULL)
2074 		return -ENOMEM;
2075 	pn->fioctl = fcn;
2076 	down_write(&snd_ioctl_rwsem);
2077 	list_add_tail(&pn->list, lists);
2078 	up_write(&snd_ioctl_rwsem);
2079 	return 0;
2080 }
2081 
2082 /**
2083  * snd_ctl_register_ioctl - register the device-specific control-ioctls
2084  * @fcn: ioctl callback function
2085  *
2086  * called from each device manager like pcm.c, hwdep.c, etc.
2087  *
2088  * Return: zero if successful, or a negative error code
2089  */
snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)2090 int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
2091 {
2092 	return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
2093 }
2094 EXPORT_SYMBOL(snd_ctl_register_ioctl);
2095 
2096 #ifdef CONFIG_COMPAT
2097 /**
2098  * snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
2099  * control-ioctls
2100  * @fcn: ioctl callback function
2101  *
2102  * Return: zero if successful, or a negative error code
2103  */
snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)2104 int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2105 {
2106 	return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
2107 }
2108 EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
2109 #endif
2110 
2111 /*
2112  * de-register the device-specific control-ioctls.
2113  */
_snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,struct list_head * lists)2114 static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
2115 				     struct list_head *lists)
2116 {
2117 	struct snd_kctl_ioctl *p;
2118 
2119 	if (snd_BUG_ON(!fcn))
2120 		return -EINVAL;
2121 	down_write(&snd_ioctl_rwsem);
2122 	list_for_each_entry(p, lists, list) {
2123 		if (p->fioctl == fcn) {
2124 			list_del(&p->list);
2125 			up_write(&snd_ioctl_rwsem);
2126 			kfree(p);
2127 			return 0;
2128 		}
2129 	}
2130 	up_write(&snd_ioctl_rwsem);
2131 	snd_BUG();
2132 	return -EINVAL;
2133 }
2134 
2135 /**
2136  * snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
2137  * @fcn: ioctl callback function to unregister
2138  *
2139  * Return: zero if successful, or a negative error code
2140  */
snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)2141 int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
2142 {
2143 	return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
2144 }
2145 EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
2146 
2147 #ifdef CONFIG_COMPAT
2148 /**
2149  * snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
2150  * 32bit control-ioctls
2151  * @fcn: ioctl callback function to unregister
2152  *
2153  * Return: zero if successful, or a negative error code
2154  */
snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)2155 int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2156 {
2157 	return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
2158 }
2159 EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
2160 #endif
2161 
snd_ctl_fasync(int fd,struct file * file,int on)2162 static int snd_ctl_fasync(int fd, struct file * file, int on)
2163 {
2164 	struct snd_ctl_file *ctl;
2165 
2166 	ctl = file->private_data;
2167 	return snd_fasync_helper(fd, file, on, &ctl->fasync);
2168 }
2169 
2170 /* return the preferred subdevice number if already assigned;
2171  * otherwise return -1
2172  */
snd_ctl_get_preferred_subdevice(struct snd_card * card,int type)2173 int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
2174 {
2175 	struct snd_ctl_file *kctl;
2176 	int subdevice = -1;
2177 	unsigned long flags;
2178 
2179 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
2180 	list_for_each_entry(kctl, &card->ctl_files, list) {
2181 		if (kctl->pid == task_pid(current)) {
2182 			subdevice = kctl->preferred_subdevice[type];
2183 			if (subdevice != -1)
2184 				break;
2185 		}
2186 	}
2187 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
2188 	return subdevice;
2189 }
2190 EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
2191 
2192 /*
2193  * ioctl32 compat
2194  */
2195 #ifdef CONFIG_COMPAT
2196 #include "control_compat.c"
2197 #else
2198 #define snd_ctl_ioctl_compat	NULL
2199 #endif
2200 
2201 /*
2202  * control layers (audio LED etc.)
2203  */
2204 
2205 /**
2206  * snd_ctl_request_layer - request to use the layer
2207  * @module_name: Name of the kernel module (NULL == build-in)
2208  *
2209  * Return: zero if successful, or an error code when the module cannot be loaded
2210  */
snd_ctl_request_layer(const char * module_name)2211 int snd_ctl_request_layer(const char *module_name)
2212 {
2213 	struct snd_ctl_layer_ops *lops;
2214 
2215 	if (module_name == NULL)
2216 		return 0;
2217 	down_read(&snd_ctl_layer_rwsem);
2218 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2219 		if (strcmp(lops->module_name, module_name) == 0)
2220 			break;
2221 	up_read(&snd_ctl_layer_rwsem);
2222 	if (lops)
2223 		return 0;
2224 	return request_module(module_name);
2225 }
2226 EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
2227 
2228 /**
2229  * snd_ctl_register_layer - register new control layer
2230  * @lops: operation structure
2231  *
2232  * The new layer can track all control elements and do additional
2233  * operations on top (like audio LED handling).
2234  */
snd_ctl_register_layer(struct snd_ctl_layer_ops * lops)2235 void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
2236 {
2237 	struct snd_card *card;
2238 	int card_number;
2239 
2240 	down_write(&snd_ctl_layer_rwsem);
2241 	lops->next = snd_ctl_layer;
2242 	snd_ctl_layer = lops;
2243 	up_write(&snd_ctl_layer_rwsem);
2244 	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
2245 		card = snd_card_ref(card_number);
2246 		if (card) {
2247 			down_read(&card->controls_rwsem);
2248 			lops->lregister(card);
2249 			up_read(&card->controls_rwsem);
2250 			snd_card_unref(card);
2251 		}
2252 	}
2253 }
2254 EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
2255 
2256 /**
2257  * snd_ctl_disconnect_layer - disconnect control layer
2258  * @lops: operation structure
2259  *
2260  * It is expected that the information about tracked cards
2261  * is freed before this call (the disconnect callback is
2262  * not called here).
2263  */
snd_ctl_disconnect_layer(struct snd_ctl_layer_ops * lops)2264 void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
2265 {
2266 	struct snd_ctl_layer_ops *lops2, *prev_lops2;
2267 
2268 	down_write(&snd_ctl_layer_rwsem);
2269 	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
2270 		if (lops2 == lops) {
2271 			if (!prev_lops2)
2272 				snd_ctl_layer = lops->next;
2273 			else
2274 				prev_lops2->next = lops->next;
2275 			break;
2276 		}
2277 		prev_lops2 = lops2;
2278 	}
2279 	up_write(&snd_ctl_layer_rwsem);
2280 }
2281 EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
2282 
2283 /*
2284  *  INIT PART
2285  */
2286 
2287 static const struct file_operations snd_ctl_f_ops =
2288 {
2289 	.owner =	THIS_MODULE,
2290 	.read =		snd_ctl_read,
2291 	.open =		snd_ctl_open,
2292 	.release =	snd_ctl_release,
2293 	.llseek =	no_llseek,
2294 	.poll =		snd_ctl_poll,
2295 	.unlocked_ioctl =	snd_ctl_ioctl,
2296 	.compat_ioctl =	snd_ctl_ioctl_compat,
2297 	.fasync =	snd_ctl_fasync,
2298 };
2299 
2300 /*
2301  * registration of the control device
2302  */
snd_ctl_dev_register(struct snd_device * device)2303 static int snd_ctl_dev_register(struct snd_device *device)
2304 {
2305 	struct snd_card *card = device->device_data;
2306 	struct snd_ctl_layer_ops *lops;
2307 	int err;
2308 
2309 	err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
2310 				  &snd_ctl_f_ops, card, &card->ctl_dev);
2311 	if (err < 0)
2312 		return err;
2313 	down_read(&card->controls_rwsem);
2314 	down_read(&snd_ctl_layer_rwsem);
2315 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2316 		lops->lregister(card);
2317 	up_read(&snd_ctl_layer_rwsem);
2318 	up_read(&card->controls_rwsem);
2319 	return 0;
2320 }
2321 
2322 /*
2323  * disconnection of the control device
2324  */
snd_ctl_dev_disconnect(struct snd_device * device)2325 static int snd_ctl_dev_disconnect(struct snd_device *device)
2326 {
2327 	struct snd_card *card = device->device_data;
2328 	struct snd_ctl_file *ctl;
2329 	struct snd_ctl_layer_ops *lops;
2330 	unsigned long flags;
2331 
2332 	read_lock_irqsave(&card->ctl_files_rwlock, flags);
2333 	list_for_each_entry(ctl, &card->ctl_files, list) {
2334 		wake_up(&ctl->change_sleep);
2335 		snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
2336 	}
2337 	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
2338 
2339 	down_read(&card->controls_rwsem);
2340 	down_read(&snd_ctl_layer_rwsem);
2341 	for (lops = snd_ctl_layer; lops; lops = lops->next)
2342 		lops->ldisconnect(card);
2343 	up_read(&snd_ctl_layer_rwsem);
2344 	up_read(&card->controls_rwsem);
2345 
2346 	return snd_unregister_device(&card->ctl_dev);
2347 }
2348 
2349 /*
2350  * free all controls
2351  */
snd_ctl_dev_free(struct snd_device * device)2352 static int snd_ctl_dev_free(struct snd_device *device)
2353 {
2354 	struct snd_card *card = device->device_data;
2355 	struct snd_kcontrol *control;
2356 
2357 	down_write(&card->controls_rwsem);
2358 	while (!list_empty(&card->controls)) {
2359 		control = snd_kcontrol(card->controls.next);
2360 		__snd_ctl_remove(card, control, false);
2361 	}
2362 
2363 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
2364 	xa_destroy(&card->ctl_numids);
2365 	xa_destroy(&card->ctl_hash);
2366 #endif
2367 	up_write(&card->controls_rwsem);
2368 	put_device(&card->ctl_dev);
2369 	return 0;
2370 }
2371 
2372 /*
2373  * create control core:
2374  * called from init.c
2375  */
snd_ctl_create(struct snd_card * card)2376 int snd_ctl_create(struct snd_card *card)
2377 {
2378 	static const struct snd_device_ops ops = {
2379 		.dev_free = snd_ctl_dev_free,
2380 		.dev_register =	snd_ctl_dev_register,
2381 		.dev_disconnect = snd_ctl_dev_disconnect,
2382 	};
2383 	int err;
2384 
2385 	if (snd_BUG_ON(!card))
2386 		return -ENXIO;
2387 	if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
2388 		return -ENXIO;
2389 
2390 	snd_device_initialize(&card->ctl_dev, card);
2391 	dev_set_name(&card->ctl_dev, "controlC%d", card->number);
2392 
2393 	err = snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
2394 	if (err < 0)
2395 		put_device(&card->ctl_dev);
2396 	return err;
2397 }
2398 
2399 /*
2400  * Frequently used control callbacks/helpers
2401  */
2402 
2403 /**
2404  * snd_ctl_boolean_mono_info - Helper function for a standard boolean info
2405  * callback with a mono channel
2406  * @kcontrol: the kcontrol instance
2407  * @uinfo: info to store
2408  *
2409  * This is a function that can be used as info callback for a standard
2410  * boolean control with a single mono channel.
2411  *
2412  * Return: Zero (always successful)
2413  */
snd_ctl_boolean_mono_info(struct snd_kcontrol * kcontrol,struct snd_ctl_elem_info * uinfo)2414 int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
2415 			      struct snd_ctl_elem_info *uinfo)
2416 {
2417 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2418 	uinfo->count = 1;
2419 	uinfo->value.integer.min = 0;
2420 	uinfo->value.integer.max = 1;
2421 	return 0;
2422 }
2423 EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
2424 
2425 /**
2426  * snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
2427  * callback with stereo two channels
2428  * @kcontrol: the kcontrol instance
2429  * @uinfo: info to store
2430  *
2431  * This is a function that can be used as info callback for a standard
2432  * boolean control with stereo two channels.
2433  *
2434  * Return: Zero (always successful)
2435  */
snd_ctl_boolean_stereo_info(struct snd_kcontrol * kcontrol,struct snd_ctl_elem_info * uinfo)2436 int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
2437 				struct snd_ctl_elem_info *uinfo)
2438 {
2439 	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2440 	uinfo->count = 2;
2441 	uinfo->value.integer.min = 0;
2442 	uinfo->value.integer.max = 1;
2443 	return 0;
2444 }
2445 EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
2446 
2447 /**
2448  * snd_ctl_enum_info - fills the info structure for an enumerated control
2449  * @info: the structure to be filled
2450  * @channels: the number of the control's channels; often one
2451  * @items: the number of control values; also the size of @names
2452  * @names: an array containing the names of all control values
2453  *
2454  * Sets all required fields in @info to their appropriate values.
2455  * If the control's accessibility is not the default (readable and writable),
2456  * the caller has to fill @info->access.
2457  *
2458  * Return: Zero (always successful)
2459  */
snd_ctl_enum_info(struct snd_ctl_elem_info * info,unsigned int channels,unsigned int items,const char * const names[])2460 int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
2461 		      unsigned int items, const char *const names[])
2462 {
2463 	info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
2464 	info->count = channels;
2465 	info->value.enumerated.items = items;
2466 	if (!items)
2467 		return 0;
2468 	if (info->value.enumerated.item >= items)
2469 		info->value.enumerated.item = items - 1;
2470 	WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
2471 	     "ALSA: too long item name '%s'\n",
2472 	     names[info->value.enumerated.item]);
2473 	strscpy(info->value.enumerated.name,
2474 		names[info->value.enumerated.item],
2475 		sizeof(info->value.enumerated.name));
2476 	return 0;
2477 }
2478 EXPORT_SYMBOL(snd_ctl_enum_info);
2479