1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* Routines for driver control interface
4	* Copyright (c) by Jaroslav Kysela <perex@perex.cz>
5	*/
6
7	#include <linux/threads.h>
8	#include <linux/interrupt.h>
9	#include <linux/module.h>
10	#include <linux/moduleparam.h>
11	#include <linux/slab.h>
12	#include <linux/vmalloc.h>
13	#include <linux/time.h>
14	#include <linux/mm.h>
15	#include <linux/math64.h>
16	#include <linux/sched/signal.h>
17	#include <sound/core.h>
18	#include <sound/minors.h>
19	#include <sound/info.h>
20	#include <sound/control.h>
21
22	// Max allocation size for user controls.
23	static int max_user_ctl_alloc_size = 8 * 1024 * 1024;
24	module_param_named(max_user_ctl_alloc_size, max_user_ctl_alloc_size, int, 0444);
25	MODULE_PARM_DESC(max_user_ctl_alloc_size, "Max allocation size for user controls");
26
27	#define MAX_CONTROL_COUNT 1028
28
29	struct snd_kctl_ioctl {
30	struct list_head list; /* list of all ioctls */
31	snd_kctl_ioctl_func_t fioctl;
32	};
33
34	static DECLARE_RWSEM(snd_ioctl_rwsem);
35	static DECLARE_RWSEM(snd_ctl_layer_rwsem);
36	static LIST_HEAD(snd_control_ioctls);
37	#ifdef CONFIG_COMPAT
38	static LIST_HEAD(snd_control_compat_ioctls);
39	#endif
40	static struct snd_ctl_layer_ops *snd_ctl_layer;
41
42	static int snd_ctl_remove_locked(struct snd_card *card,
43	struct snd_kcontrol *kcontrol);
44
45	static int snd_ctl_open(struct inode *inode, struct file *file)
46	{
47	struct snd_card *card;
48	struct snd_ctl_file *ctl;
49	int i, err;
50
51	err = stream_open(inode, filp: file);
52	if (err < 0)
53	return err;
54
55	card = snd_lookup_minor_data(minor: iminor(inode), type: SNDRV_DEVICE_TYPE_CONTROL);
56	if (!card) {
57	err = -ENODEV;
58	goto __error1;
59	}
60	err = snd_card_file_add(card, file);
61	if (err < 0) {
62	err = -ENODEV;
63	goto __error1;
64	}
65	if (!try_module_get(module: card->module)) {
66	err = -EFAULT;
67	goto __error2;
68	}
69	ctl = kzalloc(size: sizeof(*ctl), GFP_KERNEL);
70	if (ctl == NULL) {
71	err = -ENOMEM;
72	goto __error;
73	}
74	INIT_LIST_HEAD(list: &ctl->events);
75	init_waitqueue_head(&ctl->change_sleep);
76	spin_lock_init(&ctl->read_lock);
77	ctl->card = card;
78	for (i = 0; i < SND_CTL_SUBDEV_ITEMS; i++)
79	ctl->preferred_subdevice[i] = -1;
80	ctl->pid = get_pid(pid: task_pid(current));
81	file->private_data = ctl;
82	scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock)
83	list_add_tail(new: &ctl->list, head: &card->ctl_files);
84	snd_card_unref(card);
85	return 0;
86
87	__error:
88	module_put(module: card->module);
89	__error2:
90	snd_card_file_remove(card, file);
91	__error1:
92	if (card)
93	snd_card_unref(card);
94	return err;
95	}
96
97	static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
98	{
99	struct snd_kctl_event *cread;
100
101	guard(spinlock_irqsave)(l: &ctl->read_lock);
102	while (!list_empty(head: &ctl->events)) {
103	cread = snd_kctl_event(ctl->events.next);
104	list_del(entry: &cread->list);
105	kfree(objp: cread);
106	}
107	}
108
109	static int snd_ctl_release(struct inode *inode, struct file *file)
110	{
111	struct snd_card *card;
112	struct snd_ctl_file *ctl;
113	struct snd_kcontrol *control;
114	unsigned int idx;
115
116	ctl = file->private_data;
117	file->private_data = NULL;
118	card = ctl->card;
119
120	scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock)
121	list_del(entry: &ctl->list);
122
123	scoped_guard(rwsem_write, &card->controls_rwsem) {
124	list_for_each_entry(control, &card->controls, list)
125	for (idx = 0; idx < control->count; idx++)
126	if (control->vd[idx].owner == ctl)
127	control->vd[idx].owner = NULL;
128	}
129
130	snd_fasync_free(fasync: ctl->fasync);
131	snd_ctl_empty_read_queue(ctl);
132	put_pid(pid: ctl->pid);
133	kfree(objp: ctl);
134	module_put(module: card->module);
135	snd_card_file_remove(card, file);
136	return 0;
137	}
138
139	/**
140	* snd_ctl_notify - Send notification to user-space for a control change
141	* @card: the card to send notification
142	* @mask: the event mask, SNDRV_CTL_EVENT_*
143	* @id: the ctl element id to send notification
144	*
145	* This function adds an event record with the given id and mask, appends
146	* to the list and wakes up the user-space for notification. This can be
147	* called in the atomic context.
148	*/
149	void snd_ctl_notify(struct snd_card *card, unsigned int mask,
150	struct snd_ctl_elem_id *id)
151	{
152	struct snd_ctl_file *ctl;
153	struct snd_kctl_event *ev;
154
155	if (snd_BUG_ON(!card || !id))
156	return;
157	if (card->shutdown)
158	return;
159
160	guard(read_lock_irqsave)(l: &card->ctl_files_rwlock);
161	#if IS_ENABLED(CONFIG_SND_MIXER_OSS)
162	card->mixer_oss_change_count++;
163	#endif
164	list_for_each_entry(ctl, &card->ctl_files, list) {
165	if (!ctl->subscribed)
166	continue;
167	scoped_guard(spinlock, &ctl->read_lock) {
168	list_for_each_entry(ev, &ctl->events, list) {
169	if (ev->id.numid == id->numid) {
170	ev->mask |= mask;
171	goto _found;
172	}
173	}
174	ev = kzalloc(size: sizeof(*ev), GFP_ATOMIC);
175	if (ev) {
176	ev->id = *id;
177	ev->mask = mask;
178	list_add_tail(new: &ev->list, head: &ctl->events);
179	} else {
180	dev_err(card->dev, "No memory available to allocate event\n");
181	}
182	_found:
183	wake_up(&ctl->change_sleep);
184	}
185	snd_kill_fasync(fasync: ctl->fasync, SIGIO, POLL_IN);
186	}
187	}
188	EXPORT_SYMBOL(snd_ctl_notify);
189
190	/**
191	* snd_ctl_notify_one - Send notification to user-space for a control change
192	* @card: the card to send notification
193	* @mask: the event mask, SNDRV_CTL_EVENT_*
194	* @kctl: the pointer with the control instance
195	* @ioff: the additional offset to the control index
196	*
197	* This function calls snd_ctl_notify() and does additional jobs
198	* like LED state changes.
199	*/
200	void snd_ctl_notify_one(struct snd_card *card, unsigned int mask,
201	struct snd_kcontrol *kctl, unsigned int ioff)
202	{
203	struct snd_ctl_elem_id id = kctl->id;
204	struct snd_ctl_layer_ops *lops;
205
206	id.index += ioff;
207	id.numid += ioff;
208	snd_ctl_notify(card, mask, &id);
209	guard(rwsem_read)(T: &snd_ctl_layer_rwsem);
210	for (lops = snd_ctl_layer; lops; lops = lops->next)
211	lops->lnotify(card, mask, kctl, ioff);
212	}
213	EXPORT_SYMBOL(snd_ctl_notify_one);
214
215	/**
216	* snd_ctl_new - create a new control instance with some elements
217	* @kctl: the pointer to store new control instance
218	* @count: the number of elements in this control
219	* @access: the default access flags for elements in this control
220	* @file: given when locking these elements
221	*
222	* Allocates a memory object for a new control instance. The instance has
223	* elements as many as the given number (@count). Each element has given
224	* access permissions (@access). Each element is locked when @file is given.
225	*
226	* Return: 0 on success, error code on failure
227	*/
228	static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
229	unsigned int access, struct snd_ctl_file *file)
230	{
231	unsigned int idx;
232
233	if (count == 0 || count > MAX_CONTROL_COUNT)
234	return -EINVAL;
235
236	*kctl = kzalloc(struct_size(*kctl, vd, count), GFP_KERNEL);
237	if (!*kctl)
238	return -ENOMEM;
239
240	for (idx = 0; idx < count; idx++) {
241	(*kctl)->vd[idx].access = access;
242	(*kctl)->vd[idx].owner = file;
243	}
244	(*kctl)->count = count;
245
246	return 0;
247	}
248
249	/**
250	* snd_ctl_new1 - create a control instance from the template
251	* @ncontrol: the initialization record
252	* @private_data: the private data to set
253	*
254	* Allocates a new struct snd_kcontrol instance and initialize from the given
255	* template. When the access field of ncontrol is 0, it's assumed as
256	* READWRITE access. When the count field is 0, it's assumes as one.
257	*
258	* Return: The pointer of the newly generated instance, or %NULL on failure.
259	*/
260	struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
261	void *private_data)
262	{
263	struct snd_kcontrol *kctl;
264	unsigned int count;
265	unsigned int access;
266	int err;
267
268	if (snd_BUG_ON(!ncontrol || !ncontrol->info))
269	return NULL;
270
271	count = ncontrol->count;
272	if (count == 0)
273	count = 1;
274
275	access = ncontrol->access;
276	if (access == 0)
277	access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
278	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
279	SNDRV_CTL_ELEM_ACCESS_VOLATILE |
280	SNDRV_CTL_ELEM_ACCESS_INACTIVE |
281	SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE |
282	SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND |
283	SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK |
284	SNDRV_CTL_ELEM_ACCESS_LED_MASK |
285	SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK);
286
287	err = snd_ctl_new(kctl: &kctl, count, access, NULL);
288	if (err < 0)
289	return NULL;
290
291	/* The 'numid' member is decided when calling snd_ctl_add(). */
292	kctl->id.iface = ncontrol->iface;
293	kctl->id.device = ncontrol->device;
294	kctl->id.subdevice = ncontrol->subdevice;
295	if (ncontrol->name) {
296	strscpy(kctl->id.name, ncontrol->name, sizeof(kctl->id.name));
297	if (strcmp(ncontrol->name, kctl->id.name) != 0)
298	pr_warn("ALSA: Control name '%s' truncated to '%s'\n",
299	ncontrol->name, kctl->id.name);
300	}
301	kctl->id.index = ncontrol->index;
302
303	kctl->info = ncontrol->info;
304	kctl->get = ncontrol->get;
305	kctl->put = ncontrol->put;
306	kctl->tlv.p = ncontrol->tlv.p;
307
308	kctl->private_value = ncontrol->private_value;
309	kctl->private_data = private_data;
310
311	return kctl;
312	}
313	EXPORT_SYMBOL(snd_ctl_new1);
314
315	/**
316	* snd_ctl_free_one - release the control instance
317	* @kcontrol: the control instance
318	*
319	* Releases the control instance created via snd_ctl_new()
320	* or snd_ctl_new1().
321	* Don't call this after the control was added to the card.
322	*/
323	void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
324	{
325	if (kcontrol) {
326	if (kcontrol->private_free)
327	kcontrol->private_free(kcontrol);
328	kfree(objp: kcontrol);
329	}
330	}
331	EXPORT_SYMBOL(snd_ctl_free_one);
332
333	static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
334	unsigned int count)
335	{
336	struct snd_kcontrol *kctl;
337
338	/* Make sure that the ids assigned to the control do not wrap around */
339	if (card->last_numid >= UINT_MAX - count)
340	card->last_numid = 0;
341
342	list_for_each_entry(kctl, &card->controls, list) {
343	if (kctl->id.numid < card->last_numid + 1 + count &&
344	kctl->id.numid + kctl->count > card->last_numid + 1) {
345	card->last_numid = kctl->id.numid + kctl->count - 1;
346	return true;
347	}
348	}
349	return false;
350	}
351
352	static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
353	{
354	unsigned int iter = 100000;
355
356	while (snd_ctl_remove_numid_conflict(card, count)) {
357	if (--iter == 0) {
358	/* this situation is very unlikely */
359	dev_err(card->dev, "unable to allocate new control numid\n");
360	return -ENOMEM;
361	}
362	}
363	return 0;
364	}
365
366	/* check whether the given id is contained in the given kctl */
367	static bool elem_id_matches(const struct snd_kcontrol *kctl,
368	const struct snd_ctl_elem_id *id)
369	{
370	return kctl->id.iface == id->iface &&
371	kctl->id.device == id->device &&
372	kctl->id.subdevice == id->subdevice &&
373	!strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)) &&
374	kctl->id.index <= id->index &&
375	kctl->id.index + kctl->count > id->index;
376	}
377
378	#ifdef CONFIG_SND_CTL_FAST_LOOKUP
379	/* Compute a hash key for the corresponding ctl id
380	* It's for the name lookup, hence the numid is excluded.
381	* The hash key is bound in LONG_MAX to be used for Xarray key.
382	*/
383	#define MULTIPLIER 37
384	static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id)
385	{
386	int i;
387	unsigned long h;
388
389	h = id->iface;
390	h = MULTIPLIER * h + id->device;
391	h = MULTIPLIER * h + id->subdevice;
392	for (i = 0; i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN && id->name[i]; i++)
393	h = MULTIPLIER * h + id->name[i];
394	h = MULTIPLIER * h + id->index;
395	h &= LONG_MAX;
396	return h;
397	}
398
399	/* add hash entries to numid and ctl xarray tables */
400	static void add_hash_entries(struct snd_card *card,
401	struct snd_kcontrol *kcontrol)
402	{
403	struct snd_ctl_elem_id id = kcontrol->id;
404	int i;
405
406	xa_store_range(&card->ctl_numids, first: kcontrol->id.numid,
407	last: kcontrol->id.numid + kcontrol->count - 1,
408	entry: kcontrol, GFP_KERNEL);
409
410	for (i = 0; i < kcontrol->count; i++) {
411	id.index = kcontrol->id.index + i;
412	if (xa_insert(xa: &card->ctl_hash, index: get_ctl_id_hash(id: &id),
413	entry: kcontrol, GFP_KERNEL)) {
414	/* skip hash for this entry, noting we had collision */
415	card->ctl_hash_collision = true;
416	dev_dbg(card->dev, "ctl_hash collision %d:%s:%d\n",
417	id.iface, id.name, id.index);
418	}
419	}
420	}
421
422	/* remove hash entries that have been added */
423	static void remove_hash_entries(struct snd_card *card,
424	struct snd_kcontrol *kcontrol)
425	{
426	struct snd_ctl_elem_id id = kcontrol->id;
427	struct snd_kcontrol *matched;
428	unsigned long h;
429	int i;
430
431	for (i = 0; i < kcontrol->count; i++) {
432	xa_erase(&card->ctl_numids, index: id.numid);
433	h = get_ctl_id_hash(id: &id);
434	matched = xa_load(&card->ctl_hash, index: h);
435	if (matched && (matched == kcontrol ||
436	elem_id_matches(kctl: matched, id: &id)))
437	xa_erase(&card->ctl_hash, index: h);
438	id.index++;
439	id.numid++;
440	}
441	}
442	#else /* CONFIG_SND_CTL_FAST_LOOKUP */
443	static inline void add_hash_entries(struct snd_card *card,
444	struct snd_kcontrol *kcontrol)
445	{
446	}
447	static inline void remove_hash_entries(struct snd_card *card,
448	struct snd_kcontrol *kcontrol)
449	{
450	}
451	#endif /* CONFIG_SND_CTL_FAST_LOOKUP */
452
453	enum snd_ctl_add_mode {
454	CTL_ADD_EXCLUSIVE, CTL_REPLACE, CTL_ADD_ON_REPLACE,
455	};
456
457	/* add/replace a new kcontrol object; call with card->controls_rwsem locked */
458	static int __snd_ctl_add_replace(struct snd_card *card,
459	struct snd_kcontrol *kcontrol,
460	enum snd_ctl_add_mode mode)
461	{
462	struct snd_ctl_elem_id id;
463	unsigned int idx;
464	struct snd_kcontrol *old;
465	int err;
466
467	lockdep_assert_held_write(&card->controls_rwsem);
468
469	id = kcontrol->id;
470	if (id.index > UINT_MAX - kcontrol->count)
471	return -EINVAL;
472
473	old = snd_ctl_find_id_locked(card, id: &id);
474	if (!old) {
475	if (mode == CTL_REPLACE)
476	return -EINVAL;
477	} else {
478	if (mode == CTL_ADD_EXCLUSIVE) {
479	dev_err(card->dev,
480	"control %i:%i:%i:%s:%i is already present\n",
481	id.iface, id.device, id.subdevice, id.name,
482	id.index);
483	return -EBUSY;
484	}
485
486	err = snd_ctl_remove_locked(card, kcontrol: old);
487	if (err < 0)
488	return err;
489	}
490
491	if (snd_ctl_find_hole(card, count: kcontrol->count) < 0)
492	return -ENOMEM;
493
494	list_add_tail(new: &kcontrol->list, head: &card->controls);
495	card->controls_count += kcontrol->count;
496	kcontrol->id.numid = card->last_numid + 1;
497	card->last_numid += kcontrol->count;
498
499	add_hash_entries(card, kcontrol);
500
501	for (idx = 0; idx < kcontrol->count; idx++)
502	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_ADD, kcontrol, idx);
503
504	return 0;
505	}
506
507	static int snd_ctl_add_replace(struct snd_card *card,
508	struct snd_kcontrol *kcontrol,
509	enum snd_ctl_add_mode mode)
510	{
511	int err = -EINVAL;
512
513	if (! kcontrol)
514	return err;
515	if (snd_BUG_ON(!card || !kcontrol->info))
516	goto error;
517
518	scoped_guard(rwsem_write, &card->controls_rwsem)
519	err = __snd_ctl_add_replace(card, kcontrol, mode);
520
521	if (err < 0)
522	goto error;
523	return 0;
524
525	error:
526	snd_ctl_free_one(kcontrol);
527	return err;
528	}
529
530	/**
531	* snd_ctl_add - add the control instance to the card
532	* @card: the card instance
533	* @kcontrol: the control instance to add
534	*
535	* Adds the control instance created via snd_ctl_new() or
536	* snd_ctl_new1() to the given card. Assigns also an unique
537	* numid used for fast search.
538	*
539	* It frees automatically the control which cannot be added.
540	*
541	* Return: Zero if successful, or a negative error code on failure.
542	*
543	*/
544	int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
545	{
546	return snd_ctl_add_replace(card, kcontrol, mode: CTL_ADD_EXCLUSIVE);
547	}
548	EXPORT_SYMBOL(snd_ctl_add);
549
550	/**
551	* snd_ctl_replace - replace the control instance of the card
552	* @card: the card instance
553	* @kcontrol: the control instance to replace
554	* @add_on_replace: add the control if not already added
555	*
556	* Replaces the given control. If the given control does not exist
557	* and the add_on_replace flag is set, the control is added. If the
558	* control exists, it is destroyed first.
559	*
560	* It frees automatically the control which cannot be added or replaced.
561	*
562	* Return: Zero if successful, or a negative error code on failure.
563	*/
564	int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
565	bool add_on_replace)
566	{
567	return snd_ctl_add_replace(card, kcontrol,
568	mode: add_on_replace ? CTL_ADD_ON_REPLACE : CTL_REPLACE);
569	}
570	EXPORT_SYMBOL(snd_ctl_replace);
571
572	static int __snd_ctl_remove(struct snd_card *card,
573	struct snd_kcontrol *kcontrol,
574	bool remove_hash)
575	{
576	unsigned int idx;
577
578	lockdep_assert_held_write(&card->controls_rwsem);
579
580	if (snd_BUG_ON(!card || !kcontrol))
581	return -EINVAL;
582	list_del(entry: &kcontrol->list);
583
584	if (remove_hash)
585	remove_hash_entries(card, kcontrol);
586
587	card->controls_count -= kcontrol->count;
588	for (idx = 0; idx < kcontrol->count; idx++)
589	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
590	snd_ctl_free_one(kcontrol);
591	return 0;
592	}
593
594	static inline int snd_ctl_remove_locked(struct snd_card *card,
595	struct snd_kcontrol *kcontrol)
596	{
597	return __snd_ctl_remove(card, kcontrol, remove_hash: true);
598	}
599
600	/**
601	* snd_ctl_remove - remove the control from the card and release it
602	* @card: the card instance
603	* @kcontrol: the control instance to remove
604	*
605	* Removes the control from the card and then releases the instance.
606	* You don't need to call snd_ctl_free_one().
607	*
608	* Return: 0 if successful, or a negative error code on failure.
609	*
610	* Note that this function takes card->controls_rwsem lock internally.
611	*/
612	int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
613	{
614	guard(rwsem_write)(T: &card->controls_rwsem);
615	return snd_ctl_remove_locked(card, kcontrol);
616	}
617	EXPORT_SYMBOL(snd_ctl_remove);
618
619	/**
620	* snd_ctl_remove_id - remove the control of the given id and release it
621	* @card: the card instance
622	* @id: the control id to remove
623	*
624	* Finds the control instance with the given id, removes it from the
625	* card list and releases it.
626	*
627	* Return: 0 if successful, or a negative error code on failure.
628	*/
629	int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
630	{
631	struct snd_kcontrol *kctl;
632
633	guard(rwsem_write)(T: &card->controls_rwsem);
634	kctl = snd_ctl_find_id_locked(card, id);
635	if (kctl == NULL)
636	return -ENOENT;
637	return snd_ctl_remove_locked(card, kcontrol: kctl);
638	}
639	EXPORT_SYMBOL(snd_ctl_remove_id);
640
641	/**
642	* snd_ctl_remove_user_ctl - remove and release the unlocked user control
643	* @file: active control handle
644	* @id: the control id to remove
645	*
646	* Finds the control instance with the given id, removes it from the
647	* card list and releases it.
648	*
649	* Return: 0 if successful, or a negative error code on failure.
650	*/
651	static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
652	struct snd_ctl_elem_id *id)
653	{
654	struct snd_card *card = file->card;
655	struct snd_kcontrol *kctl;
656	int idx;
657
658	guard(rwsem_write)(T: &card->controls_rwsem);
659	kctl = snd_ctl_find_id_locked(card, id);
660	if (kctl == NULL)
661	return -ENOENT;
662	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER))
663	return -EINVAL;
664	for (idx = 0; idx < kctl->count; idx++)
665	if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file)
666	return -EBUSY;
667	return snd_ctl_remove_locked(card, kcontrol: kctl);
668	}
669
670	/**
671	* snd_ctl_activate_id - activate/inactivate the control of the given id
672	* @card: the card instance
673	* @id: the control id to activate/inactivate
674	* @active: non-zero to activate
675	*
676	* Finds the control instance with the given id, and activate or
677	* inactivate the control together with notification, if changed.
678	* The given ID data is filled with full information.
679	*
680	* Return: 0 if unchanged, 1 if changed, or a negative error code on failure.
681	*/
682	int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
683	int active)
684	{
685	struct snd_kcontrol *kctl;
686	struct snd_kcontrol_volatile *vd;
687	unsigned int index_offset;
688	int ret;
689
690	down_write(sem: &card->controls_rwsem);
691	kctl = snd_ctl_find_id_locked(card, id);
692	if (kctl == NULL) {
693	ret = -ENOENT;
694	goto unlock;
695	}
696	index_offset = snd_ctl_get_ioff(kctl, id);
697	vd = &kctl->vd[index_offset];
698	ret = 0;
699	if (active) {
700	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
701	goto unlock;
702	vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
703	} else {
704	if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
705	goto unlock;
706	vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
707	}
708	snd_ctl_build_ioff(dst_id: id, src_kctl: kctl, offset: index_offset);
709	downgrade_write(sem: &card->controls_rwsem);
710	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_INFO, kctl, index_offset);
711	up_read(sem: &card->controls_rwsem);
712	return 1;
713
714	unlock:
715	up_write(sem: &card->controls_rwsem);
716	return ret;
717	}
718	EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
719
720	/**
721	* snd_ctl_rename_id - replace the id of a control on the card
722	* @card: the card instance
723	* @src_id: the old id
724	* @dst_id: the new id
725	*
726	* Finds the control with the old id from the card, and replaces the
727	* id with the new one.
728	*
729	* The function tries to keep the already assigned numid while replacing
730	* the rest.
731	*
732	* Note that this function should be used only in the card initialization
733	* phase. Calling after the card instantiation may cause issues with
734	* user-space expecting persistent numids.
735	*
736	* Return: Zero if successful, or a negative error code on failure.
737	*/
738	int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
739	struct snd_ctl_elem_id *dst_id)
740	{
741	struct snd_kcontrol *kctl;
742	int saved_numid;
743
744	guard(rwsem_write)(T: &card->controls_rwsem);
745	kctl = snd_ctl_find_id_locked(card, id: src_id);
746	if (kctl == NULL)
747	return -ENOENT;
748	saved_numid = kctl->id.numid;
749	remove_hash_entries(card, kcontrol: kctl);
750	kctl->id = *dst_id;
751	kctl->id.numid = saved_numid;
752	add_hash_entries(card, kcontrol: kctl);
753	return 0;
754	}
755	EXPORT_SYMBOL(snd_ctl_rename_id);
756
757	/**
758	* snd_ctl_rename - rename the control on the card
759	* @card: the card instance
760	* @kctl: the control to rename
761	* @name: the new name
762	*
763	* Renames the specified control on the card to the new name.
764	*
765	* Note that this function takes card->controls_rwsem lock internally.
766	*/
767	void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
768	const char *name)
769	{
770	guard(rwsem_write)(T: &card->controls_rwsem);
771	remove_hash_entries(card, kcontrol: kctl);
772
773	if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
774	pr_warn("ALSA: Renamed control new name '%s' truncated to '%s'\n",
775	name, kctl->id.name);
776
777	add_hash_entries(card, kcontrol: kctl);
778	}
779	EXPORT_SYMBOL(snd_ctl_rename);
780
781	#ifndef CONFIG_SND_CTL_FAST_LOOKUP
782	static struct snd_kcontrol *
783	snd_ctl_find_numid_slow(struct snd_card *card, unsigned int numid)
784	{
785	struct snd_kcontrol *kctl;
786
787	list_for_each_entry(kctl, &card->controls, list) {
788	if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
789	return kctl;
790	}
791	return NULL;
792	}
793	#endif /* !CONFIG_SND_CTL_FAST_LOOKUP */
794
795	/**
796	* snd_ctl_find_numid_locked - find the control instance with the given number-id
797	* @card: the card instance
798	* @numid: the number-id to search
799	*
800	* Finds the control instance with the given number-id from the card.
801	*
802	* The caller must down card->controls_rwsem before calling this function
803	* (if the race condition can happen).
804	*
805	* Return: The pointer of the instance if found, or %NULL if not.
806	*/
807	struct snd_kcontrol *
808	snd_ctl_find_numid_locked(struct snd_card *card, unsigned int numid)
809	{
810	if (snd_BUG_ON(!card || !numid))
811	return NULL;
812	lockdep_assert_held(&card->controls_rwsem);
813	#ifdef CONFIG_SND_CTL_FAST_LOOKUP
814	return xa_load(&card->ctl_numids, index: numid);
815	#else
816	return snd_ctl_find_numid_slow(card, numid);
817	#endif
818	}
819	EXPORT_SYMBOL(snd_ctl_find_numid_locked);
820
821	/**
822	* snd_ctl_find_numid - find the control instance with the given number-id
823	* @card: the card instance
824	* @numid: the number-id to search
825	*
826	* Finds the control instance with the given number-id from the card.
827	*
828	* Return: The pointer of the instance if found, or %NULL if not.
829	*
830	* Note that this function takes card->controls_rwsem lock internally.
831	*/
832	struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card,
833	unsigned int numid)
834	{
835	guard(rwsem_read)(T: &card->controls_rwsem);
836	return snd_ctl_find_numid_locked(card, numid);
837	}
838	EXPORT_SYMBOL(snd_ctl_find_numid);
839
840	/**
841	* snd_ctl_find_id_locked - find the control instance with the given id
842	* @card: the card instance
843	* @id: the id to search
844	*
845	* Finds the control instance with the given id from the card.
846	*
847	* The caller must down card->controls_rwsem before calling this function
848	* (if the race condition can happen).
849	*
850	* Return: The pointer of the instance if found, or %NULL if not.
851	*/
852	struct snd_kcontrol *snd_ctl_find_id_locked(struct snd_card *card,
853	const struct snd_ctl_elem_id *id)
854	{
855	struct snd_kcontrol *kctl;
856
857	if (snd_BUG_ON(!card || !id))
858	return NULL;
859	lockdep_assert_held(&card->controls_rwsem);
860	if (id->numid != 0)
861	return snd_ctl_find_numid_locked(card, id->numid);
862	#ifdef CONFIG_SND_CTL_FAST_LOOKUP
863	kctl = xa_load(&card->ctl_hash, index: get_ctl_id_hash(id));
864	if (kctl && elem_id_matches(kctl, id))
865	return kctl;
866	if (!card->ctl_hash_collision)
867	return NULL; /* we can rely on only hash table */
868	#endif
869	/* no matching in hash table - try all as the last resort */
870	list_for_each_entry(kctl, &card->controls, list)
871	if (elem_id_matches(kctl, id))
872	return kctl;
873
874	return NULL;
875	}
876	EXPORT_SYMBOL(snd_ctl_find_id_locked);
877
878	/**
879	* snd_ctl_find_id - find the control instance with the given id
880	* @card: the card instance
881	* @id: the id to search
882	*
883	* Finds the control instance with the given id from the card.
884	*
885	* Return: The pointer of the instance if found, or %NULL if not.
886	*
887	* Note that this function takes card->controls_rwsem lock internally.
888	*/
889	struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
890	const struct snd_ctl_elem_id *id)
891	{
892	guard(rwsem_read)(T: &card->controls_rwsem);
893	return snd_ctl_find_id_locked(card, id);
894	}
895	EXPORT_SYMBOL(snd_ctl_find_id);
896
897	static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
898	unsigned int cmd, void __user *arg)
899	{
900	struct snd_ctl_card_info *info __free(kfree) = NULL;
901
902	info = kzalloc(size: sizeof(*info), GFP_KERNEL);
903	if (! info)
904	return -ENOMEM;
905	scoped_guard(rwsem_read, &snd_ioctl_rwsem) {
906	info->card = card->number;
907	strscpy(info->id, card->id, sizeof(info->id));
908	strscpy(info->driver, card->driver, sizeof(info->driver));
909	strscpy(info->name, card->shortname, sizeof(info->name));
910	strscpy(info->longname, card->longname, sizeof(info->longname));
911	strscpy(info->mixername, card->mixername, sizeof(info->mixername));
912	strscpy(info->components, card->components, sizeof(info->components));
913	}
914	if (copy_to_user(to: arg, from: info, n: sizeof(struct snd_ctl_card_info)))
915	return -EFAULT;
916	return 0;
917	}
918
919	static int snd_ctl_elem_list(struct snd_card *card,
920	struct snd_ctl_elem_list *list)
921	{
922	struct snd_kcontrol *kctl;
923	struct snd_ctl_elem_id id;
924	unsigned int offset, space, jidx;
925
926	offset = list->offset;
927	space = list->space;
928
929	guard(rwsem_read)(T: &card->controls_rwsem);
930	list->count = card->controls_count;
931	list->used = 0;
932	if (!space)
933	return 0;
934	list_for_each_entry(kctl, &card->controls, list) {
935	if (offset >= kctl->count) {
936	offset -= kctl->count;
937	continue;
938	}
939	for (jidx = offset; jidx < kctl->count; jidx++) {
940	snd_ctl_build_ioff(dst_id: &id, src_kctl: kctl, offset: jidx);
941	if (copy_to_user(to: list->pids + list->used, from: &id, n: sizeof(id)))
942	return -EFAULT;
943	list->used++;
944	if (!--space)
945	return 0;
946	}
947	offset = 0;
948	}
949	return 0;
950	}
951
952	static int snd_ctl_elem_list_user(struct snd_card *card,
953	struct snd_ctl_elem_list __user *_list)
954	{
955	struct snd_ctl_elem_list list;
956	int err;
957
958	if (copy_from_user(to: &list, from: _list, n: sizeof(list)))
959	return -EFAULT;
960	err = snd_ctl_elem_list(card, list: &list);
961	if (err)
962	return err;
963	if (copy_to_user(to: _list, from: &list, n: sizeof(list)))
964	return -EFAULT;
965
966	return 0;
967	}
968
969	/* Check whether the given kctl info is valid */
970	static int snd_ctl_check_elem_info(struct snd_card *card,
971	const struct snd_ctl_elem_info *info)
972	{
973	static const unsigned int max_value_counts[] = {
974	[SNDRV_CTL_ELEM_TYPE_BOOLEAN] = 128,
975	[SNDRV_CTL_ELEM_TYPE_INTEGER] = 128,
976	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = 128,
977	[SNDRV_CTL_ELEM_TYPE_BYTES] = 512,
978	[SNDRV_CTL_ELEM_TYPE_IEC958] = 1,
979	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = 64,
980	};
981
982	if (info->type < SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
983	info->type > SNDRV_CTL_ELEM_TYPE_INTEGER64) {
984	if (card)
985	dev_err(card->dev,
986	"control %i:%i:%i:%s:%i: invalid type %d\n",
987	info->id.iface, info->id.device,
988	info->id.subdevice, info->id.name,
989	info->id.index, info->type);
990	return -EINVAL;
991	}
992	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED &&
993	info->value.enumerated.items == 0) {
994	if (card)
995	dev_err(card->dev,
996	"control %i:%i:%i:%s:%i: zero enum items\n",
997	info->id.iface, info->id.device,
998	info->id.subdevice, info->id.name,
999	info->id.index);
1000	return -EINVAL;
1001	}
1002	if (info->count > max_value_counts[info->type]) {
1003	if (card)
1004	dev_err(card->dev,
1005	"control %i:%i:%i:%s:%i: invalid count %d\n",
1006	info->id.iface, info->id.device,
1007	info->id.subdevice, info->id.name,
1008	info->id.index, info->count);
1009	return -EINVAL;
1010	}
1011
1012	return 0;
1013	}
1014
1015	/* The capacity of struct snd_ctl_elem_value.value.*/
1016	static const unsigned int value_sizes[] = {
1017	[SNDRV_CTL_ELEM_TYPE_BOOLEAN] = sizeof(long),
1018	[SNDRV_CTL_ELEM_TYPE_INTEGER] = sizeof(long),
1019	[SNDRV_CTL_ELEM_TYPE_ENUMERATED] = sizeof(unsigned int),
1020	[SNDRV_CTL_ELEM_TYPE_BYTES] = sizeof(unsigned char),
1021	[SNDRV_CTL_ELEM_TYPE_IEC958] = sizeof(struct snd_aes_iec958),
1022	[SNDRV_CTL_ELEM_TYPE_INTEGER64] = sizeof(long long),
1023	};
1024
1025	/* fill the remaining snd_ctl_elem_value data with the given pattern */
1026	static void fill_remaining_elem_value(struct snd_ctl_elem_value *control,
1027	struct snd_ctl_elem_info *info,
1028	u32 pattern)
1029	{
1030	size_t offset = value_sizes[info->type] * info->count;
1031
1032	offset = DIV_ROUND_UP(offset, sizeof(u32));
1033	memset32(s: (u32 *)control->value.bytes.data + offset, v: pattern,
1034	n: sizeof(control->value) / sizeof(u32) - offset);
1035	}
1036
1037	/* check whether the given integer ctl value is valid */
1038	static int sanity_check_int_value(struct snd_card *card,
1039	const struct snd_ctl_elem_value *control,
1040	const struct snd_ctl_elem_info *info,
1041	int i, bool print_error)
1042	{
1043	long long lval, lmin, lmax, lstep;
1044	u64 rem;
1045
1046	switch (info->type) {
1047	default:
1048	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1049	lval = control->value.integer.value[i];
1050	lmin = 0;
1051	lmax = 1;
1052	lstep = 0;
1053	break;
1054	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1055	lval = control->value.integer.value[i];
1056	lmin = info->value.integer.min;
1057	lmax = info->value.integer.max;
1058	lstep = info->value.integer.step;
1059	break;
1060	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1061	lval = control->value.integer64.value[i];
1062	lmin = info->value.integer64.min;
1063	lmax = info->value.integer64.max;
1064	lstep = info->value.integer64.step;
1065	break;
1066	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1067	lval = control->value.enumerated.item[i];
1068	lmin = 0;
1069	lmax = info->value.enumerated.items - 1;
1070	lstep = 0;
1071	break;
1072	}
1073
1074	if (lval < lmin || lval > lmax) {
1075	if (print_error)
1076	dev_err(card->dev,
1077	"control %i:%i:%i:%s:%i: value out of range %lld (%lld/%lld) at count %i\n",
1078	control->id.iface, control->id.device,
1079	control->id.subdevice, control->id.name,
1080	control->id.index, lval, lmin, lmax, i);
1081	return -EINVAL;
1082	}
1083	if (lstep) {
1084	div64_u64_rem(dividend: lval, divisor: lstep, remainder: &rem);
1085	if (rem) {
1086	if (print_error)
1087	dev_err(card->dev,
1088	"control %i:%i:%i:%s:%i: unaligned value %lld (step %lld) at count %i\n",
1089	control->id.iface, control->id.device,
1090	control->id.subdevice, control->id.name,
1091	control->id.index, lval, lstep, i);
1092	return -EINVAL;
1093	}
1094	}
1095
1096	return 0;
1097	}
1098
1099	/* check whether the all input values are valid for the given elem value */
1100	static int sanity_check_input_values(struct snd_card *card,
1101	const struct snd_ctl_elem_value *control,
1102	const struct snd_ctl_elem_info *info,
1103	bool print_error)
1104	{
1105	int i, ret;
1106
1107	switch (info->type) {
1108	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1109	case SNDRV_CTL_ELEM_TYPE_INTEGER:
1110	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1111	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1112	for (i = 0; i < info->count; i++) {
1113	ret = sanity_check_int_value(card, control, info, i,
1114	print_error);
1115	if (ret < 0)
1116	return ret;
1117	}
1118	break;
1119	default:
1120	break;
1121	}
1122
1123	return 0;
1124	}
1125
1126	/* perform sanity checks to the given snd_ctl_elem_value object */
1127	static int sanity_check_elem_value(struct snd_card *card,
1128	const struct snd_ctl_elem_value *control,
1129	const struct snd_ctl_elem_info *info,
1130	u32 pattern)
1131	{
1132	size_t offset;
1133	int ret;
1134	u32 *p;
1135
1136	ret = sanity_check_input_values(card, control, info, print_error: true);
1137	if (ret < 0)
1138	return ret;
1139
1140	/* check whether the remaining area kept untouched */
1141	offset = value_sizes[info->type] * info->count;
1142	offset = DIV_ROUND_UP(offset, sizeof(u32));
1143	p = (u32 *)control->value.bytes.data + offset;
1144	for (; offset < sizeof(control->value) / sizeof(u32); offset++, p++) {
1145	if (*p != pattern) {
1146	ret = -EINVAL;
1147	break;
1148	}
1149	*p = 0; /* clear the checked area */
1150	}
1151
1152	return ret;
1153	}
1154
1155	static int __snd_ctl_elem_info(struct snd_card *card,
1156	struct snd_kcontrol *kctl,
1157	struct snd_ctl_elem_info *info,
1158	struct snd_ctl_file *ctl)
1159	{
1160	struct snd_kcontrol_volatile *vd;
1161	unsigned int index_offset;
1162	int result;
1163
1164	#ifdef CONFIG_SND_DEBUG
1165	info->access = 0;
1166	#endif
1167	result = snd_power_ref_and_wait(card);
1168	if (!result)
1169	result = kctl->info(kctl, info);
1170	snd_power_unref(card);
1171	if (result >= 0) {
1172	snd_BUG_ON(info->access);
1173	index_offset = snd_ctl_get_ioff(kctl, id: &info->id);
1174	vd = &kctl->vd[index_offset];
1175	snd_ctl_build_ioff(dst_id: &info->id, src_kctl: kctl, offset: index_offset);
1176	info->access = vd->access;
1177	if (vd->owner) {
1178	info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
1179	if (vd->owner == ctl)
1180	info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
1181	info->owner = pid_vnr(pid: vd->owner->pid);
1182	} else {
1183	info->owner = -1;
1184	}
1185	if (!snd_ctl_skip_validation(info) &&
1186	snd_ctl_check_elem_info(card, info) < 0)
1187	result = -EINVAL;
1188	}
1189	return result;
1190	}
1191
1192	static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
1193	struct snd_ctl_elem_info *info)
1194	{
1195	struct snd_card *card = ctl->card;
1196	struct snd_kcontrol *kctl;
1197
1198	guard(rwsem_read)(T: &card->controls_rwsem);
1199	kctl = snd_ctl_find_id_locked(card, &info->id);
1200	if (!kctl)
1201	return -ENOENT;
1202	return __snd_ctl_elem_info(card, kctl, info, ctl);
1203	}
1204
1205	static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
1206	struct snd_ctl_elem_info __user *_info)
1207	{
1208	struct snd_ctl_elem_info info;
1209	int result;
1210
1211	if (copy_from_user(to: &info, from: _info, n: sizeof(info)))
1212	return -EFAULT;
1213	result = snd_ctl_elem_info(ctl, info: &info);
1214	if (result < 0)
1215	return result;
1216	/* drop internal access flags */
1217	info.access &= ~(SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK|
1218	SNDRV_CTL_ELEM_ACCESS_LED_MASK);
1219	if (copy_to_user(to: _info, from: &info, n: sizeof(info)))
1220	return -EFAULT;
1221	return result;
1222	}
1223
1224	static int snd_ctl_elem_read(struct snd_card *card,
1225	struct snd_ctl_elem_value *control)
1226	{
1227	struct snd_kcontrol *kctl;
1228	struct snd_kcontrol_volatile *vd;
1229	unsigned int index_offset;
1230	struct snd_ctl_elem_info info;
1231	const u32 pattern = 0xdeadbeef;
1232	int ret;
1233
1234	guard(rwsem_read)(T: &card->controls_rwsem);
1235	kctl = snd_ctl_find_id_locked(card, &control->id);
1236	if (!kctl)
1237	return -ENOENT;
1238
1239	index_offset = snd_ctl_get_ioff(kctl, id: &control->id);
1240	vd = &kctl->vd[index_offset];
1241	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || !kctl->get)
1242	return -EPERM;
1243
1244	snd_ctl_build_ioff(dst_id: &control->id, src_kctl: kctl, offset: index_offset);
1245
1246	#ifdef CONFIG_SND_CTL_DEBUG
1247	/* info is needed only for validation */
1248	memset(&info, 0, sizeof(info));
1249	info.id = control->id;
1250	ret = __snd_ctl_elem_info(card, kctl, info: &info, NULL);
1251	if (ret < 0)
1252	return ret;
1253	#endif
1254
1255	if (!snd_ctl_skip_validation(&info))
1256	fill_remaining_elem_value(control, info: &info, pattern);
1257	ret = snd_power_ref_and_wait(card);
1258	if (!ret)
1259	ret = kctl->get(kctl, control);
1260	snd_power_unref(card);
1261	if (ret < 0)
1262	return ret;
1263	if (!snd_ctl_skip_validation(&info) &&
1264	sanity_check_elem_value(card, control, info: &info, pattern) < 0) {
1265	dev_err(card->dev,
1266	"control %i:%i:%i:%s:%i: access overflow\n",
1267	control->id.iface, control->id.device,
1268	control->id.subdevice, control->id.name,
1269	control->id.index);
1270	return -EINVAL;
1271	}
1272	return 0;
1273	}
1274
1275	static int snd_ctl_elem_read_user(struct snd_card *card,
1276	struct snd_ctl_elem_value __user *_control)
1277	{
1278	struct snd_ctl_elem_value *control __free(kfree) = NULL;
1279	int result;
1280
1281	control = memdup_user(_control, sizeof(*control));
1282	if (IS_ERR(ptr: control))
1283	return PTR_ERR(no_free_ptr(control));
1284
1285	result = snd_ctl_elem_read(card, control);
1286	if (result < 0)
1287	return result;
1288
1289	if (copy_to_user(to: _control, from: control, n: sizeof(*control)))
1290	return -EFAULT;
1291	return result;
1292	}
1293
1294	static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
1295	struct snd_ctl_elem_value *control)
1296	{
1297	struct snd_kcontrol *kctl;
1298	struct snd_kcontrol_volatile *vd;
1299	unsigned int index_offset;
1300	int result;
1301
1302	down_write(sem: &card->controls_rwsem);
1303	kctl = snd_ctl_find_id_locked(card, &control->id);
1304	if (kctl == NULL) {
1305	up_write(sem: &card->controls_rwsem);
1306	return -ENOENT;
1307	}
1308
1309	index_offset = snd_ctl_get_ioff(kctl, id: &control->id);
1310	vd = &kctl->vd[index_offset];
1311	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL ||
1312	(file && vd->owner && vd->owner != file)) {
1313	up_write(sem: &card->controls_rwsem);
1314	return -EPERM;
1315	}
1316
1317	snd_ctl_build_ioff(dst_id: &control->id, src_kctl: kctl, offset: index_offset);
1318	result = snd_power_ref_and_wait(card);
1319	/* validate input values */
1320	if (IS_ENABLED(CONFIG_SND_CTL_INPUT_VALIDATION) && !result) {
1321	struct snd_ctl_elem_info info;
1322
1323	memset(&info, 0, sizeof(info));
1324	info.id = control->id;
1325	result = __snd_ctl_elem_info(card, kctl, info: &info, NULL);
1326	if (!result)
1327	result = sanity_check_input_values(card, control, info: &info,
1328	print_error: false);
1329	}
1330	if (!result)
1331	result = kctl->put(kctl, control);
1332	snd_power_unref(card);
1333	if (result < 0) {
1334	up_write(sem: &card->controls_rwsem);
1335	return result;
1336	}
1337
1338	if (result > 0) {
1339	downgrade_write(sem: &card->controls_rwsem);
1340	snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_VALUE, kctl, index_offset);
1341	up_read(sem: &card->controls_rwsem);
1342	} else {
1343	up_write(sem: &card->controls_rwsem);
1344	}
1345
1346	return 0;
1347	}
1348
1349	static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
1350	struct snd_ctl_elem_value __user *_control)
1351	{
1352	struct snd_ctl_elem_value *control __free(kfree) = NULL;
1353	struct snd_card *card;
1354	int result;
1355
1356	control = memdup_user(_control, sizeof(*control));
1357	if (IS_ERR(ptr: control))
1358	return PTR_ERR(no_free_ptr(control));
1359
1360	card = file->card;
1361	result = snd_ctl_elem_write(card, file, control);
1362	if (result < 0)
1363	return result;
1364
1365	if (copy_to_user(to: _control, from: control, n: sizeof(*control)))
1366	return -EFAULT;
1367	return result;
1368	}
1369
1370	static int snd_ctl_elem_lock(struct snd_ctl_file *file,
1371	struct snd_ctl_elem_id __user *_id)
1372	{
1373	struct snd_card *card = file->card;
1374	struct snd_ctl_elem_id id;
1375	struct snd_kcontrol *kctl;
1376	struct snd_kcontrol_volatile *vd;
1377
1378	if (copy_from_user(to: &id, from: _id, n: sizeof(id)))
1379	return -EFAULT;
1380	guard(rwsem_write)(T: &card->controls_rwsem);
1381	kctl = snd_ctl_find_id_locked(card, &id);
1382	if (!kctl)
1383	return -ENOENT;
1384	vd = &kctl->vd[snd_ctl_get_ioff(kctl, id: &id)];
1385	if (vd->owner)
1386	return -EBUSY;
1387	vd->owner = file;
1388	return 0;
1389	}
1390
1391	static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
1392	struct snd_ctl_elem_id __user *_id)
1393	{
1394	struct snd_card *card = file->card;
1395	struct snd_ctl_elem_id id;
1396	struct snd_kcontrol *kctl;
1397	struct snd_kcontrol_volatile *vd;
1398
1399	if (copy_from_user(to: &id, from: _id, n: sizeof(id)))
1400	return -EFAULT;
1401	guard(rwsem_write)(T: &card->controls_rwsem);
1402	kctl = snd_ctl_find_id_locked(card, &id);
1403	if (!kctl)
1404	return -ENOENT;
1405	vd = &kctl->vd[snd_ctl_get_ioff(kctl, id: &id)];
1406	if (!vd->owner)
1407	return -EINVAL;
1408	if (vd->owner != file)
1409	return -EPERM;
1410	vd->owner = NULL;
1411	return 0;
1412	}
1413
1414	struct user_element {
1415	struct snd_ctl_elem_info info;
1416	struct snd_card *card;
1417	char *elem_data; /* element data */
1418	unsigned long elem_data_size; /* size of element data in bytes */
1419	void *tlv_data; /* TLV data */
1420	unsigned long tlv_data_size; /* TLV data size */
1421	void *priv_data; /* private data (like strings for enumerated type) */
1422	};
1423
1424	// check whether the addition (in bytes) of user ctl element may overflow the limit.
1425	static bool check_user_elem_overflow(struct snd_card *card, ssize_t add)
1426	{
1427	return (ssize_t)card->user_ctl_alloc_size + add > max_user_ctl_alloc_size;
1428	}
1429
1430	static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1431	struct snd_ctl_elem_info *uinfo)
1432	{
1433	struct user_element *ue = kcontrol->private_data;
1434	unsigned int offset;
1435
1436	offset = snd_ctl_get_ioff(kctl: kcontrol, id: &uinfo->id);
1437	*uinfo = ue->info;
1438	snd_ctl_build_ioff(dst_id: &uinfo->id, src_kctl: kcontrol, offset);
1439
1440	return 0;
1441	}
1442
1443	static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1444	struct snd_ctl_elem_info *uinfo)
1445	{
1446	struct user_element *ue = kcontrol->private_data;
1447	const char *names;
1448	unsigned int item;
1449	unsigned int offset;
1450
1451	item = uinfo->value.enumerated.item;
1452
1453	offset = snd_ctl_get_ioff(kctl: kcontrol, id: &uinfo->id);
1454	*uinfo = ue->info;
1455	snd_ctl_build_ioff(dst_id: &uinfo->id, src_kctl: kcontrol, offset);
1456
1457	item = min(item, uinfo->value.enumerated.items - 1);
1458	uinfo->value.enumerated.item = item;
1459
1460	names = ue->priv_data;
1461	for (; item > 0; --item)
1462	names += strlen(names) + 1;
1463	strcpy(p: uinfo->value.enumerated.name, q: names);
1464
1465	return 0;
1466	}
1467
1468	static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1469	struct snd_ctl_elem_value *ucontrol)
1470	{
1471	struct user_element *ue = kcontrol->private_data;
1472	unsigned int size = ue->elem_data_size;
1473	char *src = ue->elem_data +
1474	snd_ctl_get_ioff(kctl: kcontrol, id: &ucontrol->id) * size;
1475
1476	memcpy(&ucontrol->value, src, size);
1477	return 0;
1478	}
1479
1480	static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1481	struct snd_ctl_elem_value *ucontrol)
1482	{
1483	int change;
1484	struct user_element *ue = kcontrol->private_data;
1485	unsigned int size = ue->elem_data_size;
1486	char *dst = ue->elem_data +
1487	snd_ctl_get_ioff(kctl: kcontrol, id: &ucontrol->id) * size;
1488
1489	change = memcmp(p: &ucontrol->value, q: dst, size) != 0;
1490	if (change)
1491	memcpy(dst, &ucontrol->value, size);
1492	return change;
1493	}
1494
1495	/* called in controls_rwsem write lock */
1496	static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1497	unsigned int size)
1498	{
1499	struct user_element *ue = kctl->private_data;
1500	unsigned int *container;
1501	unsigned int mask = 0;
1502	int i;
1503	int change;
1504
1505	lockdep_assert_held_write(&ue->card->controls_rwsem);
1506
1507	if (size > 1024 * 128) /* sane value */
1508	return -EINVAL;
1509
1510	// does the TLV size change cause overflow?
1511	if (check_user_elem_overflow(card: ue->card, add: (ssize_t)(size - ue->tlv_data_size)))
1512	return -ENOMEM;
1513
1514	container = vmemdup_user(buf, size);
1515	if (IS_ERR(ptr: container))
1516	return PTR_ERR(ptr: container);
1517
1518	change = ue->tlv_data_size != size;
1519	if (!change)
1520	change = memcmp(p: ue->tlv_data, q: container, size) != 0;
1521	if (!change) {
1522	kvfree(addr: container);
1523	return 0;
1524	}
1525
1526	if (ue->tlv_data == NULL) {
1527	/* Now TLV data is available. */
1528	for (i = 0; i < kctl->count; ++i)
1529	kctl->vd[i].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
1530	mask = SNDRV_CTL_EVENT_MASK_INFO;
1531	} else {
1532	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1533	ue->tlv_data_size = 0;
1534	kvfree(addr: ue->tlv_data);
1535	}
1536
1537	ue->tlv_data = container;
1538	ue->tlv_data_size = size;
1539	// decremented at private_free.
1540	ue->card->user_ctl_alloc_size += size;
1541
1542	mask |= SNDRV_CTL_EVENT_MASK_TLV;
1543	for (i = 0; i < kctl->count; ++i)
1544	snd_ctl_notify_one(ue->card, mask, kctl, i);
1545
1546	return change;
1547	}
1548
1549	static int read_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf,
1550	unsigned int size)
1551	{
1552	struct user_element *ue = kctl->private_data;
1553
1554	if (ue->tlv_data_size == 0 || ue->tlv_data == NULL)
1555	return -ENXIO;
1556
1557	if (size < ue->tlv_data_size)
1558	return -ENOSPC;
1559
1560	if (copy_to_user(to: buf, from: ue->tlv_data, n: ue->tlv_data_size))
1561	return -EFAULT;
1562
1563	return 0;
1564	}
1565
1566	static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kctl, int op_flag,
1567	unsigned int size, unsigned int __user *buf)
1568	{
1569	if (op_flag == SNDRV_CTL_TLV_OP_WRITE)
1570	return replace_user_tlv(kctl, buf, size);
1571	else
1572	return read_user_tlv(kctl, buf, size);
1573	}
1574
1575	/* called in controls_rwsem write lock */
1576	static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1577	{
1578	char *names, *p;
1579	size_t buf_len, name_len;
1580	unsigned int i;
1581	const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1582
1583	lockdep_assert_held_write(&ue->card->controls_rwsem);
1584
1585	buf_len = ue->info.value.enumerated.names_length;
1586	if (buf_len > 64 * 1024)
1587	return -EINVAL;
1588
1589	if (check_user_elem_overflow(card: ue->card, add: buf_len))
1590	return -ENOMEM;
1591	names = vmemdup_user((const void __user *)user_ptrval, buf_len);
1592	if (IS_ERR(ptr: names))
1593	return PTR_ERR(ptr: names);
1594
1595	/* check that there are enough valid names */
1596	p = names;
1597	for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1598	name_len = strnlen(p, maxlen: buf_len);
1599	if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1600	kvfree(addr: names);
1601	return -EINVAL;
1602	}
1603	p += name_len + 1;
1604	buf_len -= name_len + 1;
1605	}
1606
1607	ue->priv_data = names;
1608	ue->info.value.enumerated.names_ptr = 0;
1609	// increment the allocation size; decremented again at private_free.
1610	ue->card->user_ctl_alloc_size += ue->info.value.enumerated.names_length;
1611
1612	return 0;
1613	}
1614
1615	static size_t compute_user_elem_size(size_t size, unsigned int count)
1616	{
1617	return sizeof(struct user_element) + size * count;
1618	}
1619
1620	static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1621	{
1622	struct user_element *ue = kcontrol->private_data;
1623
1624	// decrement the allocation size.
1625	ue->card->user_ctl_alloc_size -= compute_user_elem_size(size: ue->elem_data_size, count: kcontrol->count);
1626	ue->card->user_ctl_alloc_size -= ue->tlv_data_size;
1627	if (ue->priv_data)
1628	ue->card->user_ctl_alloc_size -= ue->info.value.enumerated.names_length;
1629
1630	kvfree(addr: ue->tlv_data);
1631	kvfree(addr: ue->priv_data);
1632	kfree(objp: ue);
1633	}
1634
1635	static int snd_ctl_elem_add(struct snd_ctl_file *file,
1636	struct snd_ctl_elem_info *info, int replace)
1637	{
1638	struct snd_card *card = file->card;
1639	struct snd_kcontrol *kctl;
1640	unsigned int count;
1641	unsigned int access;
1642	long private_size;
1643	size_t alloc_size;
1644	struct user_element *ue;
1645	unsigned int offset;
1646	int err;
1647
1648	if (!*info->id.name)
1649	return -EINVAL;
1650	if (strnlen(p: info->id.name, maxlen: sizeof(info->id.name)) >= sizeof(info->id.name))
1651	return -EINVAL;
1652
1653	/* Delete a control to replace them if needed. */
1654	if (replace) {
1655	info->id.numid = 0;
1656	err = snd_ctl_remove_user_ctl(file, id: &info->id);
1657	if (err)
1658	return err;
1659	}
1660
1661	/* Check the number of elements for this userspace control. */
1662	count = info->owner;
1663	if (count == 0)
1664	count = 1;
1665
1666	/* Arrange access permissions if needed. */
1667	access = info->access;
1668	if (access == 0)
1669	access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
1670	access &= (SNDRV_CTL_ELEM_ACCESS_READWRITE |
1671	SNDRV_CTL_ELEM_ACCESS_INACTIVE |
1672	SNDRV_CTL_ELEM_ACCESS_TLV_WRITE);
1673
1674	/* In initial state, nothing is available as TLV container. */
1675	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1676	access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1677	access |= SNDRV_CTL_ELEM_ACCESS_USER;
1678
1679	/*
1680	* Check information and calculate the size of data specific to
1681	* this userspace control.
1682	*/
1683	/* pass NULL to card for suppressing error messages */
1684	err = snd_ctl_check_elem_info(NULL, info);
1685	if (err < 0)
1686	return err;
1687	/* user-space control doesn't allow zero-size data */
1688	if (info->count < 1)
1689	return -EINVAL;
1690	private_size = value_sizes[info->type] * info->count;
1691	alloc_size = compute_user_elem_size(size: private_size, count);
1692
1693	guard(rwsem_write)(T: &card->controls_rwsem);
1694	if (check_user_elem_overflow(card, add: alloc_size))
1695	return -ENOMEM;
1696
1697	/*
1698	* Keep memory object for this userspace control. After passing this
1699	* code block, the instance should be freed by snd_ctl_free_one().
1700	*
1701	* Note that these elements in this control are locked.
1702	*/
1703	err = snd_ctl_new(kctl: &kctl, count, access, file);
1704	if (err < 0)
1705	return err;
1706	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
1707	ue = kzalloc(size: alloc_size, GFP_KERNEL);
1708	if (!ue) {
1709	kfree(objp: kctl);
1710	return -ENOMEM;
1711	}
1712	kctl->private_data = ue;
1713	kctl->private_free = snd_ctl_elem_user_free;
1714
1715	// increment the allocated size; decremented again at private_free.
1716	card->user_ctl_alloc_size += alloc_size;
1717
1718	/* Set private data for this userspace control. */
1719	ue->card = card;
1720	ue->info = *info;
1721	ue->info.access = 0;
1722	ue->elem_data = (char *)ue + sizeof(*ue);
1723	ue->elem_data_size = private_size;
1724	if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1725	err = snd_ctl_elem_init_enum_names(ue);
1726	if (err < 0) {
1727	snd_ctl_free_one(kctl);
1728	return err;
1729	}
1730	}
1731
1732	/* Set callback functions. */
1733	if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1734	kctl->info = snd_ctl_elem_user_enum_info;
1735	else
1736	kctl->info = snd_ctl_elem_user_info;
1737	if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1738	kctl->get = snd_ctl_elem_user_get;
1739	if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1740	kctl->put = snd_ctl_elem_user_put;
1741	if (access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
1742	kctl->tlv.c = snd_ctl_elem_user_tlv;
1743
1744	/* This function manage to free the instance on failure. */
1745	err = __snd_ctl_add_replace(card, kcontrol: kctl, mode: CTL_ADD_EXCLUSIVE);
1746	if (err < 0) {
1747	snd_ctl_free_one(kctl);
1748	return err;
1749	}
1750	offset = snd_ctl_get_ioff(kctl, id: &info->id);
1751	snd_ctl_build_ioff(dst_id: &info->id, src_kctl: kctl, offset);
1752	/*
1753	* Here we cannot fill any field for the number of elements added by
1754	* this operation because there're no specific fields. The usage of
1755	* 'owner' field for this purpose may cause any bugs to userspace
1756	* applications because the field originally means PID of a process
1757	* which locks the element.
1758	*/
1759	return 0;
1760	}
1761
1762	static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1763	struct snd_ctl_elem_info __user *_info, int replace)
1764	{
1765	struct snd_ctl_elem_info info;
1766	int err;
1767
1768	if (copy_from_user(to: &info, from: _info, n: sizeof(info)))
1769	return -EFAULT;
1770	err = snd_ctl_elem_add(file, info: &info, replace);
1771	if (err < 0)
1772	return err;
1773	if (copy_to_user(to: _info, from: &info, n: sizeof(info))) {
1774	snd_ctl_remove_user_ctl(file, id: &info.id);
1775	return -EFAULT;
1776	}
1777
1778	return 0;
1779	}
1780
1781	static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1782	struct snd_ctl_elem_id __user *_id)
1783	{
1784	struct snd_ctl_elem_id id;
1785
1786	if (copy_from_user(to: &id, from: _id, n: sizeof(id)))
1787	return -EFAULT;
1788	return snd_ctl_remove_user_ctl(file, id: &id);
1789	}
1790
1791	static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1792	{
1793	int subscribe;
1794	if (get_user(subscribe, ptr))
1795	return -EFAULT;
1796	if (subscribe < 0) {
1797	subscribe = file->subscribed;
1798	if (put_user(subscribe, ptr))
1799	return -EFAULT;
1800	return 0;
1801	}
1802	if (subscribe) {
1803	file->subscribed = 1;
1804	return 0;
1805	} else if (file->subscribed) {
1806	snd_ctl_empty_read_queue(ctl: file);
1807	file->subscribed = 0;
1808	}
1809	return 0;
1810	}
1811
1812	static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
1813	struct snd_kcontrol *kctl,
1814	struct snd_ctl_elem_id *id,
1815	unsigned int __user *buf, unsigned int size)
1816	{
1817	static const struct {
1818	int op;
1819	int perm;
1820	} pairs[] = {
1821	{SNDRV_CTL_TLV_OP_READ, SNDRV_CTL_ELEM_ACCESS_TLV_READ},
1822	{SNDRV_CTL_TLV_OP_WRITE, SNDRV_CTL_ELEM_ACCESS_TLV_WRITE},
1823	{SNDRV_CTL_TLV_OP_CMD, SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
1824	};
1825	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1826	int i, ret;
1827
1828	/* Check support of the request for this element. */
1829	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
1830	if (op_flag == pairs[i].op && (vd->access & pairs[i].perm))
1831	break;
1832	}
1833	if (i == ARRAY_SIZE(pairs))
1834	return -ENXIO;
1835
1836	if (kctl->tlv.c == NULL)
1837	return -ENXIO;
1838
1839	/* Write and command operations are not allowed for locked element. */
1840	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
1841	vd->owner != NULL && vd->owner != file)
1842	return -EPERM;
1843
1844	ret = snd_power_ref_and_wait(card: file->card);
1845	if (!ret)
1846	ret = kctl->tlv.c(kctl, op_flag, size, buf);
1847	snd_power_unref(card: file->card);
1848	return ret;
1849	}
1850
1851	static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
1852	unsigned int __user *buf, unsigned int size)
1853	{
1854	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
1855	unsigned int len;
1856
1857	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ))
1858	return -ENXIO;
1859
1860	if (kctl->tlv.p == NULL)
1861	return -ENXIO;
1862
1863	len = sizeof(unsigned int) * 2 + kctl->tlv.p[1];
1864	if (size < len)
1865	return -ENOMEM;
1866
1867	if (copy_to_user(to: buf, from: kctl->tlv.p, n: len))
1868	return -EFAULT;
1869
1870	return 0;
1871	}
1872
1873	static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1874	struct snd_ctl_tlv __user *buf,
1875	int op_flag)
1876	{
1877	struct snd_ctl_tlv header;
1878	unsigned int __user *container;
1879	unsigned int container_size;
1880	struct snd_kcontrol *kctl;
1881	struct snd_ctl_elem_id id;
1882	struct snd_kcontrol_volatile *vd;
1883
1884	lockdep_assert_held(&file->card->controls_rwsem);
1885
1886	if (copy_from_user(to: &header, from: buf, n: sizeof(header)))
1887	return -EFAULT;
1888
1889	/* In design of control core, numerical ID starts at 1. */
1890	if (header.numid == 0)
1891	return -EINVAL;
1892
1893	/* At least, container should include type and length fields. */
1894	if (header.length < sizeof(unsigned int) * 2)
1895	return -EINVAL;
1896	container_size = header.length;
1897	container = buf->tlv;
1898
1899	kctl = snd_ctl_find_numid_locked(file->card, header.numid);
1900	if (kctl == NULL)
1901	return -ENOENT;
1902
1903	/* Calculate index of the element in this set. */
1904	id = kctl->id;
1905	snd_ctl_build_ioff(dst_id: &id, src_kctl: kctl, offset: header.numid - id.numid);
1906	vd = &kctl->vd[snd_ctl_get_ioff(kctl, id: &id)];
1907
1908	if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1909	return call_tlv_handler(file, op_flag, kctl, id: &id, buf: container,
1910	size: container_size);
1911	} else {
1912	if (op_flag == SNDRV_CTL_TLV_OP_READ) {
1913	return read_tlv_buf(kctl, id: &id, buf: container,
1914	size: container_size);
1915	}
1916	}
1917
1918	/* Not supported. */
1919	return -ENXIO;
1920	}
1921
1922	static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1923	{
1924	struct snd_ctl_file *ctl;
1925	struct snd_card *card;
1926	struct snd_kctl_ioctl *p;
1927	void __user *argp = (void __user *)arg;
1928	int __user *ip = argp;
1929	int err;
1930
1931	ctl = file->private_data;
1932	card = ctl->card;
1933	if (snd_BUG_ON(!card))
1934	return -ENXIO;
1935	switch (cmd) {
1936	case SNDRV_CTL_IOCTL_PVERSION:
1937	return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1938	case SNDRV_CTL_IOCTL_CARD_INFO:
1939	return snd_ctl_card_info(card, ctl, cmd, arg: argp);
1940	case SNDRV_CTL_IOCTL_ELEM_LIST:
1941	return snd_ctl_elem_list_user(card, list: argp);
1942	case SNDRV_CTL_IOCTL_ELEM_INFO:
1943	return snd_ctl_elem_info_user(ctl, info: argp);
1944	case SNDRV_CTL_IOCTL_ELEM_READ:
1945	return snd_ctl_elem_read_user(card, control: argp);
1946	case SNDRV_CTL_IOCTL_ELEM_WRITE:
1947	return snd_ctl_elem_write_user(file: ctl, control: argp);
1948	case SNDRV_CTL_IOCTL_ELEM_LOCK:
1949	return snd_ctl_elem_lock(file: ctl, id: argp);
1950	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1951	return snd_ctl_elem_unlock(file: ctl, id: argp);
1952	case SNDRV_CTL_IOCTL_ELEM_ADD:
1953	return snd_ctl_elem_add_user(file: ctl, info: argp, replace: 0);
1954	case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1955	return snd_ctl_elem_add_user(file: ctl, info: argp, replace: 1);
1956	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1957	return snd_ctl_elem_remove(file: ctl, id: argp);
1958	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1959	return snd_ctl_subscribe_events(file: ctl, ptr: ip);
1960	case SNDRV_CTL_IOCTL_TLV_READ:
1961	scoped_guard(rwsem_read, &ctl->card->controls_rwsem)
1962	err = snd_ctl_tlv_ioctl(file: ctl, buf: argp, op_flag: SNDRV_CTL_TLV_OP_READ);
1963	return err;
1964	case SNDRV_CTL_IOCTL_TLV_WRITE:
1965	scoped_guard(rwsem_write, &ctl->card->controls_rwsem)
1966	err = snd_ctl_tlv_ioctl(file: ctl, buf: argp, op_flag: SNDRV_CTL_TLV_OP_WRITE);
1967	return err;
1968	case SNDRV_CTL_IOCTL_TLV_COMMAND:
1969	scoped_guard(rwsem_write, &ctl->card->controls_rwsem)
1970	err = snd_ctl_tlv_ioctl(file: ctl, buf: argp, op_flag: SNDRV_CTL_TLV_OP_CMD);
1971	return err;
1972	case SNDRV_CTL_IOCTL_POWER:
1973	return -ENOPROTOOPT;
1974	case SNDRV_CTL_IOCTL_POWER_STATE:
1975	return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1976	}
1977
1978	guard(rwsem_read)(T: &snd_ioctl_rwsem);
1979	list_for_each_entry(p, &snd_control_ioctls, list) {
1980	err = p->fioctl(card, ctl, cmd, arg);
1981	if (err != -ENOIOCTLCMD)
1982	return err;
1983	}
1984	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
1985	return -ENOTTY;
1986	}
1987
1988	static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1989	size_t count, loff_t * offset)
1990	{
1991	struct snd_ctl_file *ctl;
1992	int err = 0;
1993	ssize_t result = 0;
1994
1995	ctl = file->private_data;
1996	if (snd_BUG_ON(!ctl || !ctl->card))
1997	return -ENXIO;
1998	if (!ctl->subscribed)
1999	return -EBADFD;
2000	if (count < sizeof(struct snd_ctl_event))
2001	return -EINVAL;
2002	spin_lock_irq(lock: &ctl->read_lock);
2003	while (count >= sizeof(struct snd_ctl_event)) {
2004	struct snd_ctl_event ev;
2005	struct snd_kctl_event *kev;
2006	while (list_empty(head: &ctl->events)) {
2007	wait_queue_entry_t wait;
2008	if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
2009	err = -EAGAIN;
2010	goto __end_lock;
2011	}
2012	init_waitqueue_entry(wq_entry: &wait, current);
2013	add_wait_queue(wq_head: &ctl->change_sleep, wq_entry: &wait);
2014	set_current_state(TASK_INTERRUPTIBLE);
2015	spin_unlock_irq(lock: &ctl->read_lock);
2016	schedule();
2017	remove_wait_queue(wq_head: &ctl->change_sleep, wq_entry: &wait);
2018	if (ctl->card->shutdown)
2019	return -ENODEV;
2020	if (signal_pending(current))
2021	return -ERESTARTSYS;
2022	spin_lock_irq(lock: &ctl->read_lock);
2023	}
2024	kev = snd_kctl_event(ctl->events.next);
2025	ev.type = SNDRV_CTL_EVENT_ELEM;
2026	ev.data.elem.mask = kev->mask;
2027	ev.data.elem.id = kev->id;
2028	list_del(entry: &kev->list);
2029	spin_unlock_irq(lock: &ctl->read_lock);
2030	kfree(objp: kev);
2031	if (copy_to_user(to: buffer, from: &ev, n: sizeof(struct snd_ctl_event))) {
2032	err = -EFAULT;
2033	goto __end;
2034	}
2035	spin_lock_irq(lock: &ctl->read_lock);
2036	buffer += sizeof(struct snd_ctl_event);
2037	count -= sizeof(struct snd_ctl_event);
2038	result += sizeof(struct snd_ctl_event);
2039	}
2040	__end_lock:
2041	spin_unlock_irq(lock: &ctl->read_lock);
2042	__end:
2043	return result > 0 ? result : err;
2044	}
2045
2046	static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
2047	{
2048	__poll_t mask;
2049	struct snd_ctl_file *ctl;
2050
2051	ctl = file->private_data;
2052	if (!ctl->subscribed)
2053	return 0;
2054	poll_wait(filp: file, wait_address: &ctl->change_sleep, p: wait);
2055
2056	mask = 0;
2057	if (!list_empty(head: &ctl->events))
2058	mask |= EPOLLIN | EPOLLRDNORM;
2059
2060	return mask;
2061	}
2062
2063	/*
2064	* register the device-specific control-ioctls.
2065	* called from each device manager like pcm.c, hwdep.c, etc.
2066	*/
2067	static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
2068	{
2069	struct snd_kctl_ioctl *pn;
2070
2071	pn = kzalloc(size: sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
2072	if (pn == NULL)
2073	return -ENOMEM;
2074	pn->fioctl = fcn;
2075	guard(rwsem_write)(T: &snd_ioctl_rwsem);
2076	list_add_tail(new: &pn->list, head: lists);
2077	return 0;
2078	}
2079
2080	/**
2081	* snd_ctl_register_ioctl - register the device-specific control-ioctls
2082	* @fcn: ioctl callback function
2083	*
2084	* called from each device manager like pcm.c, hwdep.c, etc.
2085	*
2086	* Return: zero if successful, or a negative error code
2087	*/
2088	int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
2089	{
2090	return _snd_ctl_register_ioctl(fcn, lists: &snd_control_ioctls);
2091	}
2092	EXPORT_SYMBOL(snd_ctl_register_ioctl);
2093
2094	#ifdef CONFIG_COMPAT
2095	/**
2096	* snd_ctl_register_ioctl_compat - register the device-specific 32bit compat
2097	* control-ioctls
2098	* @fcn: ioctl callback function
2099	*
2100	* Return: zero if successful, or a negative error code
2101	*/
2102	int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2103	{
2104	return _snd_ctl_register_ioctl(fcn, lists: &snd_control_compat_ioctls);
2105	}
2106	EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
2107	#endif
2108
2109	/*
2110	* de-register the device-specific control-ioctls.
2111	*/
2112	static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
2113	struct list_head *lists)
2114	{
2115	struct snd_kctl_ioctl *p;
2116
2117	if (snd_BUG_ON(!fcn))
2118	return -EINVAL;
2119	guard(rwsem_write)(T: &snd_ioctl_rwsem);
2120	list_for_each_entry(p, lists, list) {
2121	if (p->fioctl == fcn) {
2122	list_del(entry: &p->list);
2123	kfree(objp: p);
2124	return 0;
2125	}
2126	}
2127	snd_BUG();
2128	return -EINVAL;
2129	}
2130
2131	/**
2132	* snd_ctl_unregister_ioctl - de-register the device-specific control-ioctls
2133	* @fcn: ioctl callback function to unregister
2134	*
2135	* Return: zero if successful, or a negative error code
2136	*/
2137	int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
2138	{
2139	return _snd_ctl_unregister_ioctl(fcn, lists: &snd_control_ioctls);
2140	}
2141	EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
2142
2143	#ifdef CONFIG_COMPAT
2144	/**
2145	* snd_ctl_unregister_ioctl_compat - de-register the device-specific compat
2146	* 32bit control-ioctls
2147	* @fcn: ioctl callback function to unregister
2148	*
2149	* Return: zero if successful, or a negative error code
2150	*/
2151	int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
2152	{
2153	return _snd_ctl_unregister_ioctl(fcn, lists: &snd_control_compat_ioctls);
2154	}
2155	EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
2156	#endif
2157
2158	static int snd_ctl_fasync(int fd, struct file * file, int on)
2159	{
2160	struct snd_ctl_file *ctl;
2161
2162	ctl = file->private_data;
2163	return snd_fasync_helper(fd, file, on, fasyncp: &ctl->fasync);
2164	}
2165
2166	/* return the preferred subdevice number if already assigned;
2167	* otherwise return -1
2168	*/
2169	int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)
2170	{
2171	struct snd_ctl_file *kctl;
2172	int subdevice = -1;
2173
2174	guard(read_lock_irqsave)(l: &card->ctl_files_rwlock);
2175	list_for_each_entry(kctl, &card->ctl_files, list) {
2176	if (kctl->pid == task_pid(current)) {
2177	subdevice = kctl->preferred_subdevice[type];
2178	if (subdevice != -1)
2179	break;
2180	}
2181	}
2182	return subdevice;
2183	}
2184	EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
2185
2186	/*
2187	* ioctl32 compat
2188	*/
2189	#ifdef CONFIG_COMPAT
2190	#include "control_compat.c"
2191	#else
2192	#define snd_ctl_ioctl_compat NULL
2193	#endif
2194
2195	/*
2196	* control layers (audio LED etc.)
2197	*/
2198
2199	/**
2200	* snd_ctl_request_layer - request to use the layer
2201	* @module_name: Name of the kernel module (NULL == build-in)
2202	*
2203	* Return: zero if successful, or an error code when the module cannot be loaded
2204	*/
2205	int snd_ctl_request_layer(const char *module_name)
2206	{
2207	struct snd_ctl_layer_ops *lops;
2208
2209	if (module_name == NULL)
2210	return 0;
2211	scoped_guard(rwsem_read, &snd_ctl_layer_rwsem) {
2212	for (lops = snd_ctl_layer; lops; lops = lops->next)
2213	if (strcmp(lops->module_name, module_name) == 0)
2214	return 0;
2215	}
2216	return request_module(module_name);
2217	}
2218	EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
2219
2220	/**
2221	* snd_ctl_register_layer - register new control layer
2222	* @lops: operation structure
2223	*
2224	* The new layer can track all control elements and do additional
2225	* operations on top (like audio LED handling).
2226	*/
2227	void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)
2228	{
2229	struct snd_card *card;
2230	int card_number;
2231
2232	scoped_guard(rwsem_write, &snd_ctl_layer_rwsem) {
2233	lops->next = snd_ctl_layer;
2234	snd_ctl_layer = lops;
2235	}
2236	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
2237	card = snd_card_ref(card: card_number);
2238	if (card) {
2239	scoped_guard(rwsem_read, &card->controls_rwsem)
2240	lops->lregister(card);
2241	snd_card_unref(card);
2242	}
2243	}
2244	}
2245	EXPORT_SYMBOL_GPL(snd_ctl_register_layer);
2246
2247	/**
2248	* snd_ctl_disconnect_layer - disconnect control layer
2249	* @lops: operation structure
2250	*
2251	* It is expected that the information about tracked cards
2252	* is freed before this call (the disconnect callback is
2253	* not called here).
2254	*/
2255	void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops)
2256	{
2257	struct snd_ctl_layer_ops *lops2, *prev_lops2;
2258
2259	guard(rwsem_write)(T: &snd_ctl_layer_rwsem);
2260	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
2261	if (lops2 == lops) {
2262	if (!prev_lops2)
2263	snd_ctl_layer = lops->next;
2264	else
2265	prev_lops2->next = lops->next;
2266	break;
2267	}
2268	prev_lops2 = lops2;
2269	}
2270	}
2271	EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
2272
2273	/*
2274	* INIT PART
2275	*/
2276
2277	static const struct file_operations snd_ctl_f_ops =
2278	{
2279	.owner = THIS_MODULE,
2280	.read = snd_ctl_read,
2281	.open = snd_ctl_open,
2282	.release = snd_ctl_release,
2283	.llseek = no_llseek,
2284	.poll = snd_ctl_poll,
2285	.unlocked_ioctl = snd_ctl_ioctl,
2286	.compat_ioctl = snd_ctl_ioctl_compat,
2287	.fasync = snd_ctl_fasync,
2288	};
2289
2290	/* call lops under rwsems; called from snd_ctl_dev_*() below() */
2291	#define call_snd_ctl_lops(_card, _op) \
2292	do { \
2293	struct snd_ctl_layer_ops *lops; \
2294	guard(rwsem_read)(&(_card)->controls_rwsem); \
2295	guard(rwsem_read)(&snd_ctl_layer_rwsem); \
2296	for (lops = snd_ctl_layer; lops; lops = lops->next) \
2297	lops->_op(_card); \
2298	} while (0)
2299
2300	/*
2301	* registration of the control device
2302	*/
2303	static int snd_ctl_dev_register(struct snd_device *device)
2304	{
2305	struct snd_card *card = device->device_data;
2306	int err;
2307
2308	err = snd_register_device(type: SNDRV_DEVICE_TYPE_CONTROL, card, dev: -1,
2309	f_ops: &snd_ctl_f_ops, private_data: card, device: card->ctl_dev);
2310	if (err < 0)
2311	return err;
2312	call_snd_ctl_lops(card, lregister);
2313	return 0;
2314	}
2315
2316	/*
2317	* disconnection of the control device
2318	*/
2319	static int snd_ctl_dev_disconnect(struct snd_device *device)
2320	{
2321	struct snd_card *card = device->device_data;
2322	struct snd_ctl_file *ctl;
2323
2324	scoped_guard(read_lock_irqsave, &card->ctl_files_rwlock) {
2325	list_for_each_entry(ctl, &card->ctl_files, list) {
2326	wake_up(&ctl->change_sleep);
2327	snd_kill_fasync(fasync: ctl->fasync, SIGIO, POLL_ERR);
2328	}
2329	}
2330
2331	call_snd_ctl_lops(card, ldisconnect);
2332	return snd_unregister_device(dev: card->ctl_dev);
2333	}
2334
2335	/*
2336	* free all controls
2337	*/
2338	static int snd_ctl_dev_free(struct snd_device *device)
2339	{
2340	struct snd_card *card = device->device_data;
2341	struct snd_kcontrol *control;
2342
2343	scoped_guard(rwsem_write, &card->controls_rwsem) {
2344	while (!list_empty(head: &card->controls)) {
2345	control = snd_kcontrol(card->controls.next);
2346	__snd_ctl_remove(card, kcontrol: control, remove_hash: false);
2347	}
2348
2349	#ifdef CONFIG_SND_CTL_FAST_LOOKUP
2350	xa_destroy(&card->ctl_numids);
2351	xa_destroy(&card->ctl_hash);
2352	#endif
2353	}
2354	put_device(dev: card->ctl_dev);
2355	return 0;
2356	}
2357
2358	/*
2359	* create control core:
2360	* called from init.c
2361	*/
2362	int snd_ctl_create(struct snd_card *card)
2363	{
2364	static const struct snd_device_ops ops = {
2365	.dev_free = snd_ctl_dev_free,
2366	.dev_register = snd_ctl_dev_register,
2367	.dev_disconnect = snd_ctl_dev_disconnect,
2368	};
2369	int err;
2370
2371	if (snd_BUG_ON(!card))
2372	return -ENXIO;
2373	if (snd_BUG_ON(card->number < 0 || card->number >= SNDRV_CARDS))
2374	return -ENXIO;
2375
2376	err = snd_device_alloc(dev_p: &card->ctl_dev, card);
2377	if (err < 0)
2378	return err;
2379	dev_set_name(dev: card->ctl_dev, name: "controlC%d", card->number);
2380
2381	err = snd_device_new(card, type: SNDRV_DEV_CONTROL, device_data: card, ops: &ops);
2382	if (err < 0)
2383	put_device(dev: card->ctl_dev);
2384	return err;
2385	}
2386
2387	/*
2388	* Frequently used control callbacks/helpers
2389	*/
2390
2391	/**
2392	* snd_ctl_boolean_mono_info - Helper function for a standard boolean info
2393	* callback with a mono channel
2394	* @kcontrol: the kcontrol instance
2395	* @uinfo: info to store
2396	*
2397	* This is a function that can be used as info callback for a standard
2398	* boolean control with a single mono channel.
2399	*
2400	* Return: Zero (always successful)
2401	*/
2402	int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
2403	struct snd_ctl_elem_info *uinfo)
2404	{
2405	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2406	uinfo->count = 1;
2407	uinfo->value.integer.min = 0;
2408	uinfo->value.integer.max = 1;
2409	return 0;
2410	}
2411	EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
2412
2413	/**
2414	* snd_ctl_boolean_stereo_info - Helper function for a standard boolean info
2415	* callback with stereo two channels
2416	* @kcontrol: the kcontrol instance
2417	* @uinfo: info to store
2418	*
2419	* This is a function that can be used as info callback for a standard
2420	* boolean control with stereo two channels.
2421	*
2422	* Return: Zero (always successful)
2423	*/
2424	int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
2425	struct snd_ctl_elem_info *uinfo)
2426	{
2427	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
2428	uinfo->count = 2;
2429	uinfo->value.integer.min = 0;
2430	uinfo->value.integer.max = 1;
2431	return 0;
2432	}
2433	EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
2434
2435	/**
2436	* snd_ctl_enum_info - fills the info structure for an enumerated control
2437	* @info: the structure to be filled
2438	* @channels: the number of the control's channels; often one
2439	* @items: the number of control values; also the size of @names
2440	* @names: an array containing the names of all control values
2441	*
2442	* Sets all required fields in @info to their appropriate values.
2443	* If the control's accessibility is not the default (readable and writable),
2444	* the caller has to fill @info->access.
2445	*
2446	* Return: Zero (always successful)
2447	*/
2448	int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
2449	unsigned int items, const char *const names[])
2450	{
2451	info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
2452	info->count = channels;
2453	info->value.enumerated.items = items;
2454	if (!items)
2455	return 0;
2456	if (info->value.enumerated.item >= items)
2457	info->value.enumerated.item = items - 1;
2458	WARN(strlen(names[info->value.enumerated.item]) >= sizeof(info->value.enumerated.name),
2459	"ALSA: too long item name '%s'\n",
2460	names[info->value.enumerated.item]);
2461	strscpy(info->value.enumerated.name,
2462	names[info->value.enumerated.item],
2463	sizeof(info->value.enumerated.name));
2464	return 0;
2465	}
2466	EXPORT_SYMBOL(snd_ctl_enum_info);
2467