ALSA: control: Don't access controls outside of protected regions
[pandora-kernel.git] / sound / core / control.c
1 /*
2  *  Routines for driver control interface
3  *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
4  *
5  *
6  *   This program is free software; you can redistribute it and/or modify
7  *   it under the terms of the GNU General Public License as published by
8  *   the Free Software Foundation; either version 2 of the License, or
9  *   (at your option) any later version.
10  *
11  *   This program is distributed in the hope that it will be useful,
12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *   GNU General Public License for more details.
15  *
16  *   You should have received a copy of the GNU General Public License
17  *   along with this program; if not, write to the Free Software
18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
19  *
20  */
21
22 #include <linux/threads.h>
23 #include <linux/interrupt.h>
24 #include <linux/module.h>
25 #include <linux/slab.h>
26 #include <linux/vmalloc.h>
27 #include <linux/time.h>
28 #include <sound/core.h>
29 #include <sound/minors.h>
30 #include <sound/info.h>
31 #include <sound/control.h>
32
33 /* max number of user-defined controls */
34 #define MAX_USER_CONTROLS       32
35 #define MAX_CONTROL_COUNT       1028
36
37 struct snd_kctl_ioctl {
38         struct list_head list;          /* list of all ioctls */
39         snd_kctl_ioctl_func_t fioctl;
40 };
41
42 static DECLARE_RWSEM(snd_ioctl_rwsem);
43 static LIST_HEAD(snd_control_ioctls);
44 #ifdef CONFIG_COMPAT
45 static LIST_HEAD(snd_control_compat_ioctls);
46 #endif
47
48 static int snd_ctl_open(struct inode *inode, struct file *file)
49 {
50         unsigned long flags;
51         struct snd_card *card;
52         struct snd_ctl_file *ctl;
53         int err;
54
55         err = nonseekable_open(inode, file);
56         if (err < 0)
57                 return err;
58
59         card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
60         if (!card) {
61                 err = -ENODEV;
62                 goto __error1;
63         }
64         err = snd_card_file_add(card, file);
65         if (err < 0) {
66                 err = -ENODEV;
67                 goto __error1;
68         }
69         if (!try_module_get(card->module)) {
70                 err = -EFAULT;
71                 goto __error2;
72         }
73         ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
74         if (ctl == NULL) {
75                 err = -ENOMEM;
76                 goto __error;
77         }
78         INIT_LIST_HEAD(&ctl->events);
79         init_waitqueue_head(&ctl->change_sleep);
80         spin_lock_init(&ctl->read_lock);
81         ctl->card = card;
82         ctl->prefer_pcm_subdevice = -1;
83         ctl->prefer_rawmidi_subdevice = -1;
84         ctl->pid = get_pid(task_pid(current));
85         file->private_data = ctl;
86         write_lock_irqsave(&card->ctl_files_rwlock, flags);
87         list_add_tail(&ctl->list, &card->ctl_files);
88         write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
89         snd_card_unref(card);
90         return 0;
91
92       __error:
93         module_put(card->module);
94       __error2:
95         snd_card_file_remove(card, file);
96       __error1:
97         if (card)
98                 snd_card_unref(card);
99         return err;
100 }
101
102 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
103 {
104         unsigned long flags;
105         struct snd_kctl_event *cread;
106         
107         spin_lock_irqsave(&ctl->read_lock, flags);
108         while (!list_empty(&ctl->events)) {
109                 cread = snd_kctl_event(ctl->events.next);
110                 list_del(&cread->list);
111                 kfree(cread);
112         }
113         spin_unlock_irqrestore(&ctl->read_lock, flags);
114 }
115
116 static int snd_ctl_release(struct inode *inode, struct file *file)
117 {
118         unsigned long flags;
119         struct snd_card *card;
120         struct snd_ctl_file *ctl;
121         struct snd_kcontrol *control;
122         unsigned int idx;
123
124         ctl = file->private_data;
125         file->private_data = NULL;
126         card = ctl->card;
127         write_lock_irqsave(&card->ctl_files_rwlock, flags);
128         list_del(&ctl->list);
129         write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
130         down_write(&card->controls_rwsem);
131         list_for_each_entry(control, &card->controls, list)
132                 for (idx = 0; idx < control->count; idx++)
133                         if (control->vd[idx].owner == ctl)
134                                 control->vd[idx].owner = NULL;
135         up_write(&card->controls_rwsem);
136         snd_ctl_empty_read_queue(ctl);
137         put_pid(ctl->pid);
138         kfree(ctl);
139         module_put(card->module);
140         snd_card_file_remove(card, file);
141         return 0;
142 }
143
144 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
145                     struct snd_ctl_elem_id *id)
146 {
147         unsigned long flags;
148         struct snd_ctl_file *ctl;
149         struct snd_kctl_event *ev;
150         
151         if (snd_BUG_ON(!card || !id))
152                 return;
153         read_lock(&card->ctl_files_rwlock);
154 #if defined(CONFIG_SND_MIXER_OSS) || defined(CONFIG_SND_MIXER_OSS_MODULE)
155         card->mixer_oss_change_count++;
156 #endif
157         list_for_each_entry(ctl, &card->ctl_files, list) {
158                 if (!ctl->subscribed)
159                         continue;
160                 spin_lock_irqsave(&ctl->read_lock, flags);
161                 list_for_each_entry(ev, &ctl->events, list) {
162                         if (ev->id.numid == id->numid) {
163                                 ev->mask |= mask;
164                                 goto _found;
165                         }
166                 }
167                 ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
168                 if (ev) {
169                         ev->id = *id;
170                         ev->mask = mask;
171                         list_add_tail(&ev->list, &ctl->events);
172                 } else {
173                         snd_printk(KERN_ERR "No memory available to allocate event\n");
174                 }
175         _found:
176                 wake_up(&ctl->change_sleep);
177                 spin_unlock_irqrestore(&ctl->read_lock, flags);
178                 kill_fasync(&ctl->fasync, SIGIO, POLL_IN);
179         }
180         read_unlock(&card->ctl_files_rwlock);
181 }
182
183 EXPORT_SYMBOL(snd_ctl_notify);
184
185 /**
186  * snd_ctl_new - create a control instance from the template
187  * @control: the control template
188  * @access: the default control access
189  *
190  * Allocates a new struct snd_kcontrol instance and copies the given template 
191  * to the new instance. It does not copy volatile data (access).
192  *
193  * Returns the pointer of the new instance, or NULL on failure.
194  */
195 static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control,
196                                         unsigned int access)
197 {
198         struct snd_kcontrol *kctl;
199         unsigned int idx;
200         
201         if (snd_BUG_ON(!control || !control->count))
202                 return NULL;
203
204         if (control->count > MAX_CONTROL_COUNT)
205                 return NULL;
206
207         kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
208         if (kctl == NULL) {
209                 snd_printk(KERN_ERR "Cannot allocate control instance\n");
210                 return NULL;
211         }
212         *kctl = *control;
213         for (idx = 0; idx < kctl->count; idx++)
214                 kctl->vd[idx].access = access;
215         return kctl;
216 }
217
218 /**
219  * snd_ctl_new1 - create a control instance from the template
220  * @ncontrol: the initialization record
221  * @private_data: the private data to set
222  *
223  * Allocates a new struct snd_kcontrol instance and initialize from the given 
224  * template.  When the access field of ncontrol is 0, it's assumed as
225  * READWRITE access. When the count field is 0, it's assumes as one.
226  *
227  * Returns the pointer of the newly generated instance, or NULL on failure.
228  */
229 struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
230                                   void *private_data)
231 {
232         struct snd_kcontrol kctl;
233         unsigned int access;
234         
235         if (snd_BUG_ON(!ncontrol || !ncontrol->info))
236                 return NULL;
237         memset(&kctl, 0, sizeof(kctl));
238         kctl.id.iface = ncontrol->iface;
239         kctl.id.device = ncontrol->device;
240         kctl.id.subdevice = ncontrol->subdevice;
241         if (ncontrol->name) {
242                 strlcpy(kctl.id.name, ncontrol->name, sizeof(kctl.id.name));
243                 if (strcmp(ncontrol->name, kctl.id.name) != 0)
244                         snd_printk(KERN_WARNING
245                                    "Control name '%s' truncated to '%s'\n",
246                                    ncontrol->name, kctl.id.name);
247         }
248         kctl.id.index = ncontrol->index;
249         kctl.count = ncontrol->count ? ncontrol->count : 1;
250         access = ncontrol->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
251                  (ncontrol->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
252                                       SNDRV_CTL_ELEM_ACCESS_INACTIVE|
253                                       SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE|
254                                       SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND|
255                                       SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK));
256         kctl.info = ncontrol->info;
257         kctl.get = ncontrol->get;
258         kctl.put = ncontrol->put;
259         kctl.tlv.p = ncontrol->tlv.p;
260         kctl.private_value = ncontrol->private_value;
261         kctl.private_data = private_data;
262         return snd_ctl_new(&kctl, access);
263 }
264
265 EXPORT_SYMBOL(snd_ctl_new1);
266
267 /**
268  * snd_ctl_free_one - release the control instance
269  * @kcontrol: the control instance
270  *
271  * Releases the control instance created via snd_ctl_new()
272  * or snd_ctl_new1().
273  * Don't call this after the control was added to the card.
274  */
275 void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
276 {
277         if (kcontrol) {
278                 if (kcontrol->private_free)
279                         kcontrol->private_free(kcontrol);
280                 kfree(kcontrol);
281         }
282 }
283
284 EXPORT_SYMBOL(snd_ctl_free_one);
285
286 static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
287                                           unsigned int count)
288 {
289         struct snd_kcontrol *kctl;
290
291         list_for_each_entry(kctl, &card->controls, list) {
292                 if (kctl->id.numid < card->last_numid + 1 + count &&
293                     kctl->id.numid + kctl->count > card->last_numid + 1) {
294                         card->last_numid = kctl->id.numid + kctl->count - 1;
295                         return true;
296                 }
297         }
298         return false;
299 }
300
301 static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
302 {
303         unsigned int iter = 100000;
304
305         while (snd_ctl_remove_numid_conflict(card, count)) {
306                 if (--iter == 0) {
307                         /* this situation is very unlikely */
308                         snd_printk(KERN_ERR "unable to allocate new control numid\n");
309                         return -ENOMEM;
310                 }
311         }
312         return 0;
313 }
314
315 /**
316  * snd_ctl_add - add the control instance to the card
317  * @card: the card instance
318  * @kcontrol: the control instance to add
319  *
320  * Adds the control instance created via snd_ctl_new() or
321  * snd_ctl_new1() to the given card. Assigns also an unique
322  * numid used for fast search.
323  *
324  * Returns zero if successful, or a negative error code on failure.
325  *
326  * It frees automatically the control which cannot be added.
327  */
328 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
329 {
330         struct snd_ctl_elem_id id;
331         unsigned int idx;
332         unsigned int count;
333         int err = -EINVAL;
334
335         if (! kcontrol)
336                 return err;
337         if (snd_BUG_ON(!card || !kcontrol->info))
338                 goto error;
339         id = kcontrol->id;
340         down_write(&card->controls_rwsem);
341         if (snd_ctl_find_id(card, &id)) {
342                 up_write(&card->controls_rwsem);
343                 snd_printd(KERN_ERR "control %i:%i:%i:%s:%i is already present\n",
344                                         id.iface,
345                                         id.device,
346                                         id.subdevice,
347                                         id.name,
348                                         id.index);
349                 err = -EBUSY;
350                 goto error;
351         }
352         if (snd_ctl_find_hole(card, kcontrol->count) < 0) {
353                 up_write(&card->controls_rwsem);
354                 err = -ENOMEM;
355                 goto error;
356         }
357         list_add_tail(&kcontrol->list, &card->controls);
358         card->controls_count += kcontrol->count;
359         kcontrol->id.numid = card->last_numid + 1;
360         card->last_numid += kcontrol->count;
361         count = kcontrol->count;
362         up_write(&card->controls_rwsem);
363         for (idx = 0; idx < count; idx++, id.index++, id.numid++)
364                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
365         return 0;
366
367  error:
368         snd_ctl_free_one(kcontrol);
369         return err;
370 }
371
372 EXPORT_SYMBOL(snd_ctl_add);
373
374 /**
375  * snd_ctl_replace - replace the control instance of the card
376  * @card: the card instance
377  * @kcontrol: the control instance to replace
378  * @add_on_replace: add the control if not already added
379  *
380  * Replaces the given control.  If the given control does not exist
381  * and the add_on_replace flag is set, the control is added.  If the
382  * control exists, it is destroyed first.
383  *
384  * Returns zero if successful, or a negative error code on failure.
385  *
386  * It frees automatically the control which cannot be added or replaced.
387  */
388 int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
389                     bool add_on_replace)
390 {
391         struct snd_ctl_elem_id id;
392         unsigned int count;
393         unsigned int idx;
394         struct snd_kcontrol *old;
395         int ret;
396
397         if (!kcontrol)
398                 return -EINVAL;
399         if (snd_BUG_ON(!card || !kcontrol->info)) {
400                 ret = -EINVAL;
401                 goto error;
402         }
403         id = kcontrol->id;
404         down_write(&card->controls_rwsem);
405         old = snd_ctl_find_id(card, &id);
406         if (!old) {
407                 if (add_on_replace)
408                         goto add;
409                 up_write(&card->controls_rwsem);
410                 ret = -EINVAL;
411                 goto error;
412         }
413         ret = snd_ctl_remove(card, old);
414         if (ret < 0) {
415                 up_write(&card->controls_rwsem);
416                 goto error;
417         }
418 add:
419         if (snd_ctl_find_hole(card, kcontrol->count) < 0) {
420                 up_write(&card->controls_rwsem);
421                 ret = -ENOMEM;
422                 goto error;
423         }
424         list_add_tail(&kcontrol->list, &card->controls);
425         card->controls_count += kcontrol->count;
426         kcontrol->id.numid = card->last_numid + 1;
427         card->last_numid += kcontrol->count;
428         count = kcontrol->count;
429         up_write(&card->controls_rwsem);
430         for (idx = 0; idx < count; idx++, id.index++, id.numid++)
431                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
432         return 0;
433
434 error:
435         snd_ctl_free_one(kcontrol);
436         return ret;
437 }
438 EXPORT_SYMBOL(snd_ctl_replace);
439
440 /**
441  * snd_ctl_remove - remove the control from the card and release it
442  * @card: the card instance
443  * @kcontrol: the control instance to remove
444  *
445  * Removes the control from the card and then releases the instance.
446  * You don't need to call snd_ctl_free_one(). You must be in
447  * the write lock - down_write(&card->controls_rwsem).
448  * 
449  * Returns 0 if successful, or a negative error code on failure.
450  */
451 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
452 {
453         struct snd_ctl_elem_id id;
454         unsigned int idx;
455
456         if (snd_BUG_ON(!card || !kcontrol))
457                 return -EINVAL;
458         list_del(&kcontrol->list);
459         card->controls_count -= kcontrol->count;
460         id = kcontrol->id;
461         for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
462                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_REMOVE, &id);
463         snd_ctl_free_one(kcontrol);
464         return 0;
465 }
466
467 EXPORT_SYMBOL(snd_ctl_remove);
468
469 /**
470  * snd_ctl_remove_id - remove the control of the given id and release it
471  * @card: the card instance
472  * @id: the control id to remove
473  *
474  * Finds the control instance with the given id, removes it from the
475  * card list and releases it.
476  * 
477  * Returns 0 if successful, or a negative error code on failure.
478  */
479 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
480 {
481         struct snd_kcontrol *kctl;
482         int ret;
483
484         down_write(&card->controls_rwsem);
485         kctl = snd_ctl_find_id(card, id);
486         if (kctl == NULL) {
487                 up_write(&card->controls_rwsem);
488                 return -ENOENT;
489         }
490         ret = snd_ctl_remove(card, kctl);
491         up_write(&card->controls_rwsem);
492         return ret;
493 }
494
495 EXPORT_SYMBOL(snd_ctl_remove_id);
496
497 /**
498  * snd_ctl_remove_user_ctl - remove and release the unlocked user control
499  * @file: active control handle
500  * @id: the control id to remove
501  *
502  * Finds the control instance with the given id, removes it from the
503  * card list and releases it.
504  * 
505  * Returns 0 if successful, or a negative error code on failure.
506  */
507 static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
508                                    struct snd_ctl_elem_id *id)
509 {
510         struct snd_card *card = file->card;
511         struct snd_kcontrol *kctl;
512         int idx, ret;
513
514         down_write(&card->controls_rwsem);
515         kctl = snd_ctl_find_id(card, id);
516         if (kctl == NULL) {
517                 ret = -ENOENT;
518                 goto error;
519         }
520         if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
521                 ret = -EINVAL;
522                 goto error;
523         }
524         for (idx = 0; idx < kctl->count; idx++)
525                 if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
526                         ret = -EBUSY;
527                         goto error;
528                 }
529         ret = snd_ctl_remove(card, kctl);
530         if (ret < 0)
531                 goto error;
532         card->user_ctl_count--;
533 error:
534         up_write(&card->controls_rwsem);
535         return ret;
536 }
537
538 /**
539  * snd_ctl_activate_id - activate/inactivate the control of the given id
540  * @card: the card instance
541  * @id: the control id to activate/inactivate
542  * @active: non-zero to activate
543  *
544  * Finds the control instance with the given id, and activate or
545  * inactivate the control together with notification, if changed.
546  *
547  * Returns 0 if unchanged, 1 if changed, or a negative error code on failure.
548  */
549 int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id,
550                         int active)
551 {
552         struct snd_kcontrol *kctl;
553         struct snd_kcontrol_volatile *vd;
554         unsigned int index_offset;
555         int ret;
556
557         down_write(&card->controls_rwsem);
558         kctl = snd_ctl_find_id(card, id);
559         if (kctl == NULL) {
560                 ret = -ENOENT;
561                 goto unlock;
562         }
563         index_offset = snd_ctl_get_ioff(kctl, &kctl->id);
564         vd = &kctl->vd[index_offset];
565         ret = 0;
566         if (active) {
567                 if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE))
568                         goto unlock;
569                 vd->access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
570         } else {
571                 if (vd->access & SNDRV_CTL_ELEM_ACCESS_INACTIVE)
572                         goto unlock;
573                 vd->access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
574         }
575         ret = 1;
576  unlock:
577         up_write(&card->controls_rwsem);
578         if (ret > 0)
579                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_INFO, id);
580         return ret;
581 }
582 EXPORT_SYMBOL_GPL(snd_ctl_activate_id);
583
584 /**
585  * snd_ctl_rename_id - replace the id of a control on the card
586  * @card: the card instance
587  * @src_id: the old id
588  * @dst_id: the new id
589  *
590  * Finds the control with the old id from the card, and replaces the
591  * id with the new one.
592  *
593  * Returns zero if successful, or a negative error code on failure.
594  */
595 int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
596                       struct snd_ctl_elem_id *dst_id)
597 {
598         struct snd_kcontrol *kctl;
599
600         down_write(&card->controls_rwsem);
601         kctl = snd_ctl_find_id(card, src_id);
602         if (kctl == NULL) {
603                 up_write(&card->controls_rwsem);
604                 return -ENOENT;
605         }
606         kctl->id = *dst_id;
607         kctl->id.numid = card->last_numid + 1;
608         card->last_numid += kctl->count;
609         up_write(&card->controls_rwsem);
610         return 0;
611 }
612
613 EXPORT_SYMBOL(snd_ctl_rename_id);
614
615 /**
616  * snd_ctl_find_numid - find the control instance with the given number-id
617  * @card: the card instance
618  * @numid: the number-id to search
619  *
620  * Finds the control instance with the given number-id from the card.
621  *
622  * Returns the pointer of the instance if found, or NULL if not.
623  *
624  * The caller must down card->controls_rwsem before calling this function
625  * (if the race condition can happen).
626  */
627 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card, unsigned int numid)
628 {
629         struct snd_kcontrol *kctl;
630
631         if (snd_BUG_ON(!card || !numid))
632                 return NULL;
633         list_for_each_entry(kctl, &card->controls, list) {
634                 if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
635                         return kctl;
636         }
637         return NULL;
638 }
639
640 EXPORT_SYMBOL(snd_ctl_find_numid);
641
642 /**
643  * snd_ctl_find_id - find the control instance with the given id
644  * @card: the card instance
645  * @id: the id to search
646  *
647  * Finds the control instance with the given id from the card.
648  *
649  * Returns the pointer of the instance if found, or NULL if not.
650  *
651  * The caller must down card->controls_rwsem before calling this function
652  * (if the race condition can happen).
653  */
654 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
655                                      struct snd_ctl_elem_id *id)
656 {
657         struct snd_kcontrol *kctl;
658
659         if (snd_BUG_ON(!card || !id))
660                 return NULL;
661         if (id->numid != 0)
662                 return snd_ctl_find_numid(card, id->numid);
663         list_for_each_entry(kctl, &card->controls, list) {
664                 if (kctl->id.iface != id->iface)
665                         continue;
666                 if (kctl->id.device != id->device)
667                         continue;
668                 if (kctl->id.subdevice != id->subdevice)
669                         continue;
670                 if (strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)))
671                         continue;
672                 if (kctl->id.index > id->index)
673                         continue;
674                 if (kctl->id.index + kctl->count <= id->index)
675                         continue;
676                 return kctl;
677         }
678         return NULL;
679 }
680
681 EXPORT_SYMBOL(snd_ctl_find_id);
682
683 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
684                              unsigned int cmd, void __user *arg)
685 {
686         struct snd_ctl_card_info *info;
687
688         info = kzalloc(sizeof(*info), GFP_KERNEL);
689         if (! info)
690                 return -ENOMEM;
691         down_read(&snd_ioctl_rwsem);
692         info->card = card->number;
693         strlcpy(info->id, card->id, sizeof(info->id));
694         strlcpy(info->driver, card->driver, sizeof(info->driver));
695         strlcpy(info->name, card->shortname, sizeof(info->name));
696         strlcpy(info->longname, card->longname, sizeof(info->longname));
697         strlcpy(info->mixername, card->mixername, sizeof(info->mixername));
698         strlcpy(info->components, card->components, sizeof(info->components));
699         up_read(&snd_ioctl_rwsem);
700         if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
701                 kfree(info);
702                 return -EFAULT;
703         }
704         kfree(info);
705         return 0;
706 }
707
708 static int snd_ctl_elem_list(struct snd_card *card,
709                              struct snd_ctl_elem_list __user *_list)
710 {
711         struct list_head *plist;
712         struct snd_ctl_elem_list list;
713         struct snd_kcontrol *kctl;
714         struct snd_ctl_elem_id *dst, *id;
715         unsigned int offset, space, jidx;
716         
717         if (copy_from_user(&list, _list, sizeof(list)))
718                 return -EFAULT;
719         offset = list.offset;
720         space = list.space;
721         /* try limit maximum space */
722         if (space > 16384)
723                 return -ENOMEM;
724         if (space > 0) {
725                 /* allocate temporary buffer for atomic operation */
726                 dst = vmalloc(space * sizeof(struct snd_ctl_elem_id));
727                 if (dst == NULL)
728                         return -ENOMEM;
729                 down_read(&card->controls_rwsem);
730                 list.count = card->controls_count;
731                 plist = card->controls.next;
732                 while (plist != &card->controls) {
733                         if (offset == 0)
734                                 break;
735                         kctl = snd_kcontrol(plist);
736                         if (offset < kctl->count)
737                                 break;
738                         offset -= kctl->count;
739                         plist = plist->next;
740                 }
741                 list.used = 0;
742                 id = dst;
743                 while (space > 0 && plist != &card->controls) {
744                         kctl = snd_kcontrol(plist);
745                         for (jidx = offset; space > 0 && jidx < kctl->count; jidx++) {
746                                 snd_ctl_build_ioff(id, kctl, jidx);
747                                 id++;
748                                 space--;
749                                 list.used++;
750                         }
751                         plist = plist->next;
752                         offset = 0;
753                 }
754                 up_read(&card->controls_rwsem);
755                 if (list.used > 0 &&
756                     copy_to_user(list.pids, dst,
757                                  list.used * sizeof(struct snd_ctl_elem_id))) {
758                         vfree(dst);
759                         return -EFAULT;
760                 }
761                 vfree(dst);
762         } else {
763                 down_read(&card->controls_rwsem);
764                 list.count = card->controls_count;
765                 up_read(&card->controls_rwsem);
766         }
767         if (copy_to_user(_list, &list, sizeof(list)))
768                 return -EFAULT;
769         return 0;
770 }
771
772 static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
773                              struct snd_ctl_elem_info *info)
774 {
775         struct snd_card *card = ctl->card;
776         struct snd_kcontrol *kctl;
777         struct snd_kcontrol_volatile *vd;
778         unsigned int index_offset;
779         int result;
780         
781         down_read(&card->controls_rwsem);
782         kctl = snd_ctl_find_id(card, &info->id);
783         if (kctl == NULL) {
784                 up_read(&card->controls_rwsem);
785                 return -ENOENT;
786         }
787 #ifdef CONFIG_SND_DEBUG
788         info->access = 0;
789 #endif
790         result = kctl->info(kctl, info);
791         if (result >= 0) {
792                 snd_BUG_ON(info->access);
793                 index_offset = snd_ctl_get_ioff(kctl, &info->id);
794                 vd = &kctl->vd[index_offset];
795                 snd_ctl_build_ioff(&info->id, kctl, index_offset);
796                 info->access = vd->access;
797                 if (vd->owner) {
798                         info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
799                         if (vd->owner == ctl)
800                                 info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
801                         info->owner = pid_vnr(vd->owner->pid);
802                 } else {
803                         info->owner = -1;
804                 }
805         }
806         up_read(&card->controls_rwsem);
807         return result;
808 }
809
810 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
811                                   struct snd_ctl_elem_info __user *_info)
812 {
813         struct snd_ctl_elem_info info;
814         int result;
815
816         if (copy_from_user(&info, _info, sizeof(info)))
817                 return -EFAULT;
818         snd_power_lock(ctl->card);
819         result = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0);
820         if (result >= 0)
821                 result = snd_ctl_elem_info(ctl, &info);
822         snd_power_unlock(ctl->card);
823         if (result >= 0)
824                 if (copy_to_user(_info, &info, sizeof(info)))
825                         return -EFAULT;
826         return result;
827 }
828
829 static int snd_ctl_elem_read(struct snd_card *card,
830                              struct snd_ctl_elem_value *control)
831 {
832         struct snd_kcontrol *kctl;
833         struct snd_kcontrol_volatile *vd;
834         unsigned int index_offset;
835         int result;
836
837         down_read(&card->controls_rwsem);
838         kctl = snd_ctl_find_id(card, &control->id);
839         if (kctl == NULL) {
840                 result = -ENOENT;
841         } else {
842                 index_offset = snd_ctl_get_ioff(kctl, &control->id);
843                 vd = &kctl->vd[index_offset];
844                 if ((vd->access & SNDRV_CTL_ELEM_ACCESS_READ) &&
845                     kctl->get != NULL) {
846                         snd_ctl_build_ioff(&control->id, kctl, index_offset);
847                         result = kctl->get(kctl, control);
848                 } else
849                         result = -EPERM;
850         }
851         up_read(&card->controls_rwsem);
852         return result;
853 }
854
855 static int snd_ctl_elem_read_user(struct snd_card *card,
856                                   struct snd_ctl_elem_value __user *_control)
857 {
858         struct snd_ctl_elem_value *control;
859         int result;
860
861         control = memdup_user(_control, sizeof(*control));
862         if (IS_ERR(control))
863                 return PTR_ERR(control);
864
865         snd_power_lock(card);
866         result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
867         if (result >= 0)
868                 result = snd_ctl_elem_read(card, control);
869         snd_power_unlock(card);
870         if (result >= 0)
871                 if (copy_to_user(_control, control, sizeof(*control)))
872                         result = -EFAULT;
873         kfree(control);
874         return result;
875 }
876
877 static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
878                               struct snd_ctl_elem_value *control)
879 {
880         struct snd_kcontrol *kctl;
881         struct snd_kcontrol_volatile *vd;
882         unsigned int index_offset;
883         int result;
884
885         down_read(&card->controls_rwsem);
886         kctl = snd_ctl_find_id(card, &control->id);
887         if (kctl == NULL) {
888                 result = -ENOENT;
889         } else {
890                 index_offset = snd_ctl_get_ioff(kctl, &control->id);
891                 vd = &kctl->vd[index_offset];
892                 if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) ||
893                     kctl->put == NULL ||
894                     (file && vd->owner && vd->owner != file)) {
895                         result = -EPERM;
896                 } else {
897                         snd_ctl_build_ioff(&control->id, kctl, index_offset);
898                         result = kctl->put(kctl, control);
899                 }
900                 if (result > 0) {
901                         struct snd_ctl_elem_id id = control->id;
902                         up_read(&card->controls_rwsem);
903                         snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id);
904                         return 0;
905                 }
906         }
907         up_read(&card->controls_rwsem);
908         return result;
909 }
910
911 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
912                                    struct snd_ctl_elem_value __user *_control)
913 {
914         struct snd_ctl_elem_value *control;
915         struct snd_card *card;
916         int result;
917
918         control = memdup_user(_control, sizeof(*control));
919         if (IS_ERR(control))
920                 return PTR_ERR(control);
921
922         card = file->card;
923         snd_power_lock(card);
924         result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
925         if (result >= 0)
926                 result = snd_ctl_elem_write(card, file, control);
927         snd_power_unlock(card);
928         if (result >= 0)
929                 if (copy_to_user(_control, control, sizeof(*control)))
930                         result = -EFAULT;
931         kfree(control);
932         return result;
933 }
934
935 static int snd_ctl_elem_lock(struct snd_ctl_file *file,
936                              struct snd_ctl_elem_id __user *_id)
937 {
938         struct snd_card *card = file->card;
939         struct snd_ctl_elem_id id;
940         struct snd_kcontrol *kctl;
941         struct snd_kcontrol_volatile *vd;
942         int result;
943         
944         if (copy_from_user(&id, _id, sizeof(id)))
945                 return -EFAULT;
946         down_write(&card->controls_rwsem);
947         kctl = snd_ctl_find_id(card, &id);
948         if (kctl == NULL) {
949                 result = -ENOENT;
950         } else {
951                 vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
952                 if (vd->owner != NULL)
953                         result = -EBUSY;
954                 else {
955                         vd->owner = file;
956                         result = 0;
957                 }
958         }
959         up_write(&card->controls_rwsem);
960         return result;
961 }
962
963 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
964                                struct snd_ctl_elem_id __user *_id)
965 {
966         struct snd_card *card = file->card;
967         struct snd_ctl_elem_id id;
968         struct snd_kcontrol *kctl;
969         struct snd_kcontrol_volatile *vd;
970         int result;
971         
972         if (copy_from_user(&id, _id, sizeof(id)))
973                 return -EFAULT;
974         down_write(&card->controls_rwsem);
975         kctl = snd_ctl_find_id(card, &id);
976         if (kctl == NULL) {
977                 result = -ENOENT;
978         } else {
979                 vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
980                 if (vd->owner == NULL)
981                         result = -EINVAL;
982                 else if (vd->owner != file)
983                         result = -EPERM;
984                 else {
985                         vd->owner = NULL;
986                         result = 0;
987                 }
988         }
989         up_write(&card->controls_rwsem);
990         return result;
991 }
992
993 struct user_element {
994         struct snd_ctl_elem_info info;
995         struct snd_card *card;
996         void *elem_data;                /* element data */
997         unsigned long elem_data_size;   /* size of element data in bytes */
998         void *tlv_data;                 /* TLV data */
999         unsigned long tlv_data_size;    /* TLV data size */
1000         void *priv_data;                /* private data (like strings for enumerated type) */
1001 };
1002
1003 static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
1004                                   struct snd_ctl_elem_info *uinfo)
1005 {
1006         struct user_element *ue = kcontrol->private_data;
1007
1008         *uinfo = ue->info;
1009         return 0;
1010 }
1011
1012 static int snd_ctl_elem_user_enum_info(struct snd_kcontrol *kcontrol,
1013                                        struct snd_ctl_elem_info *uinfo)
1014 {
1015         struct user_element *ue = kcontrol->private_data;
1016         const char *names;
1017         unsigned int item;
1018
1019         item = uinfo->value.enumerated.item;
1020
1021         *uinfo = ue->info;
1022
1023         item = min(item, uinfo->value.enumerated.items - 1);
1024         uinfo->value.enumerated.item = item;
1025
1026         names = ue->priv_data;
1027         for (; item > 0; --item)
1028                 names += strlen(names) + 1;
1029         strcpy(uinfo->value.enumerated.name, names);
1030
1031         return 0;
1032 }
1033
1034 static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
1035                                  struct snd_ctl_elem_value *ucontrol)
1036 {
1037         struct user_element *ue = kcontrol->private_data;
1038
1039         mutex_lock(&ue->card->user_ctl_lock);
1040         memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size);
1041         mutex_unlock(&ue->card->user_ctl_lock);
1042         return 0;
1043 }
1044
1045 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
1046                                  struct snd_ctl_elem_value *ucontrol)
1047 {
1048         int change;
1049         struct user_element *ue = kcontrol->private_data;
1050
1051         mutex_lock(&ue->card->user_ctl_lock);
1052         change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0;
1053         if (change)
1054                 memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size);
1055         mutex_unlock(&ue->card->user_ctl_lock);
1056         return change;
1057 }
1058
1059 static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
1060                                  int op_flag,
1061                                  unsigned int size,
1062                                  unsigned int __user *tlv)
1063 {
1064         struct user_element *ue = kcontrol->private_data;
1065         int change = 0;
1066         void *new_data;
1067
1068         if (op_flag > 0) {
1069                 if (size > 1024 * 128)  /* sane value */
1070                         return -EINVAL;
1071
1072                 new_data = memdup_user(tlv, size);
1073                 if (IS_ERR(new_data))
1074                         return PTR_ERR(new_data);
1075                 mutex_lock(&ue->card->user_ctl_lock);
1076                 change = ue->tlv_data_size != size;
1077                 if (!change)
1078                         change = memcmp(ue->tlv_data, new_data, size);
1079                 kfree(ue->tlv_data);
1080                 ue->tlv_data = new_data;
1081                 ue->tlv_data_size = size;
1082                 mutex_unlock(&ue->card->user_ctl_lock);
1083         } else {
1084                 int ret = 0;
1085
1086                 mutex_lock(&ue->card->user_ctl_lock);
1087                 if (!ue->tlv_data_size || !ue->tlv_data) {
1088                         ret = -ENXIO;
1089                         goto err_unlock;
1090                 }
1091                 if (size < ue->tlv_data_size) {
1092                         ret = -ENOSPC;
1093                         goto err_unlock;
1094                 }
1095                 if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size))
1096                         ret = -EFAULT;
1097 err_unlock:
1098                 mutex_unlock(&ue->card->user_ctl_lock);
1099                 if (ret)
1100                         return ret;
1101         }
1102         return change;
1103 }
1104
1105 static int snd_ctl_elem_init_enum_names(struct user_element *ue)
1106 {
1107         char *names, *p;
1108         size_t buf_len, name_len;
1109         unsigned int i;
1110         const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr;
1111
1112         if (ue->info.value.enumerated.names_length > 64 * 1024)
1113                 return -EINVAL;
1114
1115         names = memdup_user((const void __user *)user_ptrval,
1116                 ue->info.value.enumerated.names_length);
1117         if (IS_ERR(names))
1118                 return PTR_ERR(names);
1119
1120         /* check that there are enough valid names */
1121         buf_len = ue->info.value.enumerated.names_length;
1122         p = names;
1123         for (i = 0; i < ue->info.value.enumerated.items; ++i) {
1124                 name_len = strnlen(p, buf_len);
1125                 if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
1126                         kfree(names);
1127                         return -EINVAL;
1128                 }
1129                 p += name_len + 1;
1130                 buf_len -= name_len + 1;
1131         }
1132
1133         ue->priv_data = names;
1134         ue->info.value.enumerated.names_ptr = 0;
1135
1136         return 0;
1137 }
1138
1139 static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
1140 {
1141         struct user_element *ue = kcontrol->private_data;
1142
1143         kfree(ue->tlv_data);
1144         kfree(ue->priv_data);
1145         kfree(ue);
1146 }
1147
1148 static int snd_ctl_elem_add(struct snd_ctl_file *file,
1149                             struct snd_ctl_elem_info *info, int replace)
1150 {
1151         struct snd_card *card = file->card;
1152         struct snd_kcontrol kctl, *_kctl;
1153         unsigned int access;
1154         long private_size;
1155         struct user_element *ue;
1156         int idx, err;
1157
1158         if (info->count < 1)
1159                 return -EINVAL;
1160         access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
1161                 (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
1162                                  SNDRV_CTL_ELEM_ACCESS_INACTIVE|
1163                                  SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE));
1164         info->id.numid = 0;
1165         memset(&kctl, 0, sizeof(kctl));
1166
1167         if (replace) {
1168                 err = snd_ctl_remove_user_ctl(file, &info->id);
1169                 if (err)
1170                         return err;
1171         }
1172
1173         if (card->user_ctl_count >= MAX_USER_CONTROLS)
1174                 return -ENOMEM;
1175
1176         memcpy(&kctl.id, &info->id, sizeof(info->id));
1177         kctl.count = info->owner ? info->owner : 1;
1178         access |= SNDRV_CTL_ELEM_ACCESS_USER;
1179         if (info->type == SNDRV_CTL_ELEM_TYPE_ENUMERATED)
1180                 kctl.info = snd_ctl_elem_user_enum_info;
1181         else
1182                 kctl.info = snd_ctl_elem_user_info;
1183         if (access & SNDRV_CTL_ELEM_ACCESS_READ)
1184                 kctl.get = snd_ctl_elem_user_get;
1185         if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1186                 kctl.put = snd_ctl_elem_user_put;
1187         if (access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE) {
1188                 kctl.tlv.c = snd_ctl_elem_user_tlv;
1189                 access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1190         }
1191         switch (info->type) {
1192         case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1193         case SNDRV_CTL_ELEM_TYPE_INTEGER:
1194                 private_size = sizeof(long);
1195                 if (info->count > 128)
1196                         return -EINVAL;
1197                 break;
1198         case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1199                 private_size = sizeof(long long);
1200                 if (info->count > 64)
1201                         return -EINVAL;
1202                 break;
1203         case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
1204                 private_size = sizeof(unsigned int);
1205                 if (info->count > 128 || info->value.enumerated.items == 0)
1206                         return -EINVAL;
1207                 break;
1208         case SNDRV_CTL_ELEM_TYPE_BYTES:
1209                 private_size = sizeof(unsigned char);
1210                 if (info->count > 512)
1211                         return -EINVAL;
1212                 break;
1213         case SNDRV_CTL_ELEM_TYPE_IEC958:
1214                 private_size = sizeof(struct snd_aes_iec958);
1215                 if (info->count != 1)
1216                         return -EINVAL;
1217                 break;
1218         default:
1219                 return -EINVAL;
1220         }
1221         private_size *= info->count;
1222         ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
1223         if (ue == NULL)
1224                 return -ENOMEM;
1225         ue->card = card;
1226         ue->info = *info;
1227         ue->info.access = 0;
1228         ue->elem_data = (char *)ue + sizeof(*ue);
1229         ue->elem_data_size = private_size;
1230         if (ue->info.type == SNDRV_CTL_ELEM_TYPE_ENUMERATED) {
1231                 err = snd_ctl_elem_init_enum_names(ue);
1232                 if (err < 0) {
1233                         kfree(ue);
1234                         return err;
1235                 }
1236         }
1237         kctl.private_free = snd_ctl_elem_user_free;
1238         _kctl = snd_ctl_new(&kctl, access);
1239         if (_kctl == NULL) {
1240                 kfree(ue->priv_data);
1241                 kfree(ue);
1242                 return -ENOMEM;
1243         }
1244         _kctl->private_data = ue;
1245         for (idx = 0; idx < _kctl->count; idx++)
1246                 _kctl->vd[idx].owner = file;
1247         err = snd_ctl_add(card, _kctl);
1248         if (err < 0)
1249                 return err;
1250
1251         down_write(&card->controls_rwsem);
1252         card->user_ctl_count++;
1253         up_write(&card->controls_rwsem);
1254
1255         return 0;
1256 }
1257
1258 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1259                                  struct snd_ctl_elem_info __user *_info, int replace)
1260 {
1261         struct snd_ctl_elem_info info;
1262         if (copy_from_user(&info, _info, sizeof(info)))
1263                 return -EFAULT;
1264         return snd_ctl_elem_add(file, &info, replace);
1265 }
1266
1267 static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1268                                struct snd_ctl_elem_id __user *_id)
1269 {
1270         struct snd_ctl_elem_id id;
1271
1272         if (copy_from_user(&id, _id, sizeof(id)))
1273                 return -EFAULT;
1274         return snd_ctl_remove_user_ctl(file, &id);
1275 }
1276
1277 static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1278 {
1279         int subscribe;
1280         if (get_user(subscribe, ptr))
1281                 return -EFAULT;
1282         if (subscribe < 0) {
1283                 subscribe = file->subscribed;
1284                 if (put_user(subscribe, ptr))
1285                         return -EFAULT;
1286                 return 0;
1287         }
1288         if (subscribe) {
1289                 file->subscribed = 1;
1290                 return 0;
1291         } else if (file->subscribed) {
1292                 snd_ctl_empty_read_queue(file);
1293                 file->subscribed = 0;
1294         }
1295         return 0;
1296 }
1297
1298 static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1299                              struct snd_ctl_tlv __user *_tlv,
1300                              int op_flag)
1301 {
1302         struct snd_card *card = file->card;
1303         struct snd_ctl_tlv tlv;
1304         struct snd_kcontrol *kctl;
1305         struct snd_kcontrol_volatile *vd;
1306         unsigned int len;
1307         int err = 0;
1308
1309         if (copy_from_user(&tlv, _tlv, sizeof(tlv)))
1310                 return -EFAULT;
1311         if (tlv.length < sizeof(unsigned int) * 2)
1312                 return -EINVAL;
1313         down_read(&card->controls_rwsem);
1314         kctl = snd_ctl_find_numid(card, tlv.numid);
1315         if (kctl == NULL) {
1316                 err = -ENOENT;
1317                 goto __kctl_end;
1318         }
1319         if (kctl->tlv.p == NULL) {
1320                 err = -ENXIO;
1321                 goto __kctl_end;
1322         }
1323         vd = &kctl->vd[tlv.numid - kctl->id.numid];
1324         if ((op_flag == 0 && (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ) == 0) ||
1325             (op_flag > 0 && (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE) == 0) ||
1326             (op_flag < 0 && (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND) == 0)) {
1327                 err = -ENXIO;
1328                 goto __kctl_end;
1329         }
1330         if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1331                 if (vd->owner != NULL && vd->owner != file) {
1332                         err = -EPERM;
1333                         goto __kctl_end;
1334                 }
1335                 err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv); 
1336                 if (err > 0) {
1337                         struct snd_ctl_elem_id id = kctl->id;
1338                         up_read(&card->controls_rwsem);
1339                         snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id);
1340                         return 0;
1341                 }
1342         } else {
1343                 if (op_flag) {
1344                         err = -ENXIO;
1345                         goto __kctl_end;
1346                 }
1347                 len = kctl->tlv.p[1] + 2 * sizeof(unsigned int);
1348                 if (tlv.length < len) {
1349                         err = -ENOMEM;
1350                         goto __kctl_end;
1351                 }
1352                 if (copy_to_user(_tlv->tlv, kctl->tlv.p, len))
1353                         err = -EFAULT;
1354         }
1355       __kctl_end:
1356         up_read(&card->controls_rwsem);
1357         return err;
1358 }
1359
1360 static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1361 {
1362         struct snd_ctl_file *ctl;
1363         struct snd_card *card;
1364         struct snd_kctl_ioctl *p;
1365         void __user *argp = (void __user *)arg;
1366         int __user *ip = argp;
1367         int err;
1368
1369         ctl = file->private_data;
1370         card = ctl->card;
1371         if (snd_BUG_ON(!card))
1372                 return -ENXIO;
1373         switch (cmd) {
1374         case SNDRV_CTL_IOCTL_PVERSION:
1375                 return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1376         case SNDRV_CTL_IOCTL_CARD_INFO:
1377                 return snd_ctl_card_info(card, ctl, cmd, argp);
1378         case SNDRV_CTL_IOCTL_ELEM_LIST:
1379                 return snd_ctl_elem_list(card, argp);
1380         case SNDRV_CTL_IOCTL_ELEM_INFO:
1381                 return snd_ctl_elem_info_user(ctl, argp);
1382         case SNDRV_CTL_IOCTL_ELEM_READ:
1383                 return snd_ctl_elem_read_user(card, argp);
1384         case SNDRV_CTL_IOCTL_ELEM_WRITE:
1385                 return snd_ctl_elem_write_user(ctl, argp);
1386         case SNDRV_CTL_IOCTL_ELEM_LOCK:
1387                 return snd_ctl_elem_lock(ctl, argp);
1388         case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1389                 return snd_ctl_elem_unlock(ctl, argp);
1390         case SNDRV_CTL_IOCTL_ELEM_ADD:
1391                 return snd_ctl_elem_add_user(ctl, argp, 0);
1392         case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1393                 return snd_ctl_elem_add_user(ctl, argp, 1);
1394         case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1395                 return snd_ctl_elem_remove(ctl, argp);
1396         case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1397                 return snd_ctl_subscribe_events(ctl, ip);
1398         case SNDRV_CTL_IOCTL_TLV_READ:
1399                 return snd_ctl_tlv_ioctl(ctl, argp, 0);
1400         case SNDRV_CTL_IOCTL_TLV_WRITE:
1401                 return snd_ctl_tlv_ioctl(ctl, argp, 1);
1402         case SNDRV_CTL_IOCTL_TLV_COMMAND:
1403                 return snd_ctl_tlv_ioctl(ctl, argp, -1);
1404         case SNDRV_CTL_IOCTL_POWER:
1405                 return -ENOPROTOOPT;
1406         case SNDRV_CTL_IOCTL_POWER_STATE:
1407 #ifdef CONFIG_PM
1408                 return put_user(card->power_state, ip) ? -EFAULT : 0;
1409 #else
1410                 return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1411 #endif
1412         }
1413         down_read(&snd_ioctl_rwsem);
1414         list_for_each_entry(p, &snd_control_ioctls, list) {
1415                 err = p->fioctl(card, ctl, cmd, arg);
1416                 if (err != -ENOIOCTLCMD) {
1417                         up_read(&snd_ioctl_rwsem);
1418                         return err;
1419                 }
1420         }
1421         up_read(&snd_ioctl_rwsem);
1422         snd_printdd("unknown ioctl = 0x%x\n", cmd);
1423         return -ENOTTY;
1424 }
1425
1426 static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1427                             size_t count, loff_t * offset)
1428 {
1429         struct snd_ctl_file *ctl;
1430         int err = 0;
1431         ssize_t result = 0;
1432
1433         ctl = file->private_data;
1434         if (snd_BUG_ON(!ctl || !ctl->card))
1435                 return -ENXIO;
1436         if (!ctl->subscribed)
1437                 return -EBADFD;
1438         if (count < sizeof(struct snd_ctl_event))
1439                 return -EINVAL;
1440         spin_lock_irq(&ctl->read_lock);
1441         while (count >= sizeof(struct snd_ctl_event)) {
1442                 struct snd_ctl_event ev;
1443                 struct snd_kctl_event *kev;
1444                 while (list_empty(&ctl->events)) {
1445                         wait_queue_t wait;
1446                         if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
1447                                 err = -EAGAIN;
1448                                 goto __end_lock;
1449                         }
1450                         init_waitqueue_entry(&wait, current);
1451                         add_wait_queue(&ctl->change_sleep, &wait);
1452                         set_current_state(TASK_INTERRUPTIBLE);
1453                         spin_unlock_irq(&ctl->read_lock);
1454                         schedule();
1455                         remove_wait_queue(&ctl->change_sleep, &wait);
1456                         if (ctl->card->shutdown)
1457                                 return -ENODEV;
1458                         if (signal_pending(current))
1459                                 return -ERESTARTSYS;
1460                         spin_lock_irq(&ctl->read_lock);
1461                 }
1462                 kev = snd_kctl_event(ctl->events.next);
1463                 ev.type = SNDRV_CTL_EVENT_ELEM;
1464                 ev.data.elem.mask = kev->mask;
1465                 ev.data.elem.id = kev->id;
1466                 list_del(&kev->list);
1467                 spin_unlock_irq(&ctl->read_lock);
1468                 kfree(kev);
1469                 if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
1470                         err = -EFAULT;
1471                         goto __end;
1472                 }
1473                 spin_lock_irq(&ctl->read_lock);
1474                 buffer += sizeof(struct snd_ctl_event);
1475                 count -= sizeof(struct snd_ctl_event);
1476                 result += sizeof(struct snd_ctl_event);
1477         }
1478       __end_lock:
1479         spin_unlock_irq(&ctl->read_lock);
1480       __end:
1481         return result > 0 ? result : err;
1482 }
1483
1484 static unsigned int snd_ctl_poll(struct file *file, poll_table * wait)
1485 {
1486         unsigned int mask;
1487         struct snd_ctl_file *ctl;
1488
1489         ctl = file->private_data;
1490         if (!ctl->subscribed)
1491                 return 0;
1492         poll_wait(file, &ctl->change_sleep, wait);
1493
1494         mask = 0;
1495         if (!list_empty(&ctl->events))
1496                 mask |= POLLIN | POLLRDNORM;
1497
1498         return mask;
1499 }
1500
1501 /*
1502  * register the device-specific control-ioctls.
1503  * called from each device manager like pcm.c, hwdep.c, etc.
1504  */
1505 static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
1506 {
1507         struct snd_kctl_ioctl *pn;
1508
1509         pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
1510         if (pn == NULL)
1511                 return -ENOMEM;
1512         pn->fioctl = fcn;
1513         down_write(&snd_ioctl_rwsem);
1514         list_add_tail(&pn->list, lists);
1515         up_write(&snd_ioctl_rwsem);
1516         return 0;
1517 }
1518
1519 int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
1520 {
1521         return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
1522 }
1523
1524 EXPORT_SYMBOL(snd_ctl_register_ioctl);
1525
1526 #ifdef CONFIG_COMPAT
1527 int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1528 {
1529         return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
1530 }
1531
1532 EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
1533 #endif
1534
1535 /*
1536  * de-register the device-specific control-ioctls.
1537  */
1538 static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
1539                                      struct list_head *lists)
1540 {
1541         struct snd_kctl_ioctl *p;
1542
1543         if (snd_BUG_ON(!fcn))
1544                 return -EINVAL;
1545         down_write(&snd_ioctl_rwsem);
1546         list_for_each_entry(p, lists, list) {
1547                 if (p->fioctl == fcn) {
1548                         list_del(&p->list);
1549                         up_write(&snd_ioctl_rwsem);
1550                         kfree(p);
1551                         return 0;
1552                 }
1553         }
1554         up_write(&snd_ioctl_rwsem);
1555         snd_BUG();
1556         return -EINVAL;
1557 }
1558
1559 int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
1560 {
1561         return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
1562 }
1563
1564 EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
1565
1566 #ifdef CONFIG_COMPAT
1567 int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1568 {
1569         return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
1570 }
1571
1572 EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
1573 #endif
1574
1575 static int snd_ctl_fasync(int fd, struct file * file, int on)
1576 {
1577         struct snd_ctl_file *ctl;
1578
1579         ctl = file->private_data;
1580         return fasync_helper(fd, file, on, &ctl->fasync);
1581 }
1582
1583 /*
1584  * ioctl32 compat
1585  */
1586 #ifdef CONFIG_COMPAT
1587 #include "control_compat.c"
1588 #else
1589 #define snd_ctl_ioctl_compat    NULL
1590 #endif
1591
1592 /*
1593  *  INIT PART
1594  */
1595
1596 static const struct file_operations snd_ctl_f_ops =
1597 {
1598         .owner =        THIS_MODULE,
1599         .read =         snd_ctl_read,
1600         .open =         snd_ctl_open,
1601         .release =      snd_ctl_release,
1602         .llseek =       no_llseek,
1603         .poll =         snd_ctl_poll,
1604         .unlocked_ioctl =       snd_ctl_ioctl,
1605         .compat_ioctl = snd_ctl_ioctl_compat,
1606         .fasync =       snd_ctl_fasync,
1607 };
1608
1609 /*
1610  * registration of the control device
1611  */
1612 static int snd_ctl_dev_register(struct snd_device *device)
1613 {
1614         struct snd_card *card = device->device_data;
1615         int err, cardnum;
1616         char name[16];
1617
1618         if (snd_BUG_ON(!card))
1619                 return -ENXIO;
1620         cardnum = card->number;
1621         if (snd_BUG_ON(cardnum < 0 || cardnum >= SNDRV_CARDS))
1622                 return -ENXIO;
1623         sprintf(name, "controlC%i", cardnum);
1624         if ((err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
1625                                        &snd_ctl_f_ops, card, name)) < 0)
1626                 return err;
1627         return 0;
1628 }
1629
1630 /*
1631  * disconnection of the control device
1632  */
1633 static int snd_ctl_dev_disconnect(struct snd_device *device)
1634 {
1635         struct snd_card *card = device->device_data;
1636         struct snd_ctl_file *ctl;
1637         int err, cardnum;
1638
1639         if (snd_BUG_ON(!card))
1640                 return -ENXIO;
1641         cardnum = card->number;
1642         if (snd_BUG_ON(cardnum < 0 || cardnum >= SNDRV_CARDS))
1643                 return -ENXIO;
1644
1645         read_lock(&card->ctl_files_rwlock);
1646         list_for_each_entry(ctl, &card->ctl_files, list) {
1647                 wake_up(&ctl->change_sleep);
1648                 kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
1649         }
1650         read_unlock(&card->ctl_files_rwlock);
1651
1652         if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL,
1653                                          card, -1)) < 0)
1654                 return err;
1655         return 0;
1656 }
1657
1658 /*
1659  * free all controls
1660  */
1661 static int snd_ctl_dev_free(struct snd_device *device)
1662 {
1663         struct snd_card *card = device->device_data;
1664         struct snd_kcontrol *control;
1665
1666         down_write(&card->controls_rwsem);
1667         while (!list_empty(&card->controls)) {
1668                 control = snd_kcontrol(card->controls.next);
1669                 snd_ctl_remove(card, control);
1670         }
1671         up_write(&card->controls_rwsem);
1672         return 0;
1673 }
1674
1675 /*
1676  * create control core:
1677  * called from init.c
1678  */
1679 int snd_ctl_create(struct snd_card *card)
1680 {
1681         static struct snd_device_ops ops = {
1682                 .dev_free = snd_ctl_dev_free,
1683                 .dev_register = snd_ctl_dev_register,
1684                 .dev_disconnect = snd_ctl_dev_disconnect,
1685         };
1686
1687         if (snd_BUG_ON(!card))
1688                 return -ENXIO;
1689         return snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
1690 }
1691
1692 /*
1693  * Frequently used control callbacks/helpers
1694  */
1695 int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
1696                               struct snd_ctl_elem_info *uinfo)
1697 {
1698         uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
1699         uinfo->count = 1;
1700         uinfo->value.integer.min = 0;
1701         uinfo->value.integer.max = 1;
1702         return 0;
1703 }
1704
1705 EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
1706
1707 int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
1708                                 struct snd_ctl_elem_info *uinfo)
1709 {
1710         uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
1711         uinfo->count = 2;
1712         uinfo->value.integer.min = 0;
1713         uinfo->value.integer.max = 1;
1714         return 0;
1715 }
1716
1717 EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);
1718
1719 /**
1720  * snd_ctl_enum_info - fills the info structure for an enumerated control
1721  * @info: the structure to be filled
1722  * @channels: the number of the control's channels; often one
1723  * @items: the number of control values; also the size of @names
1724  * @names: an array containing the names of all control values
1725  *
1726  * Sets all required fields in @info to their appropriate values.
1727  * If the control's accessibility is not the default (readable and writable),
1728  * the caller has to fill @info->access.
1729  */
1730 int snd_ctl_enum_info(struct snd_ctl_elem_info *info, unsigned int channels,
1731                       unsigned int items, const char *const names[])
1732 {
1733         info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
1734         info->count = channels;
1735         info->value.enumerated.items = items;
1736         if (info->value.enumerated.item >= items)
1737                 info->value.enumerated.item = items - 1;
1738         strlcpy(info->value.enumerated.name,
1739                 names[info->value.enumerated.item],
1740                 sizeof(info->value.enumerated.name));
1741         return 0;
1742 }
1743 EXPORT_SYMBOL(snd_ctl_enum_info);