]> git.openfabrics.org - ~shefty/rdma-dev.git/blob - sound/core/control.c
ALSA: prevent heap corruption in snd_ctl_new()
[~shefty/rdma-dev.git] / sound / core / control.c
1 /*
2  *  Routines for driver control interface
3  *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
4  *
5  *
6  *   This program is free software; you can redistribute it and/or modify
7  *   it under the terms of the GNU General Public License as published by
8  *   the Free Software Foundation; either version 2 of the License, or
9  *   (at your option) any later version.
10  *
11  *   This program is distributed in the hope that it will be useful,
12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *   GNU General Public License for more details.
15  *
16  *   You should have received a copy of the GNU General Public License
17  *   along with this program; if not, write to the Free Software
18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
19  *
20  */
21
22 #include <linux/threads.h>
23 #include <linux/interrupt.h>
24 #include <linux/slab.h>
25 #include <linux/vmalloc.h>
26 #include <linux/time.h>
27 #include <sound/core.h>
28 #include <sound/minors.h>
29 #include <sound/info.h>
30 #include <sound/control.h>
31
32 /* max number of user-defined controls */
33 #define MAX_USER_CONTROLS       32
34 #define MAX_CONTROL_COUNT       1028
35
36 struct snd_kctl_ioctl {
37         struct list_head list;          /* list of all ioctls */
38         snd_kctl_ioctl_func_t fioctl;
39 };
40
41 static DECLARE_RWSEM(snd_ioctl_rwsem);
42 static LIST_HEAD(snd_control_ioctls);
43 #ifdef CONFIG_COMPAT
44 static LIST_HEAD(snd_control_compat_ioctls);
45 #endif
46
47 static int snd_ctl_open(struct inode *inode, struct file *file)
48 {
49         unsigned long flags;
50         struct snd_card *card;
51         struct snd_ctl_file *ctl;
52         int err;
53
54         err = nonseekable_open(inode, file);
55         if (err < 0)
56                 return err;
57
58         card = snd_lookup_minor_data(iminor(inode), SNDRV_DEVICE_TYPE_CONTROL);
59         if (!card) {
60                 err = -ENODEV;
61                 goto __error1;
62         }
63         err = snd_card_file_add(card, file);
64         if (err < 0) {
65                 err = -ENODEV;
66                 goto __error1;
67         }
68         if (!try_module_get(card->module)) {
69                 err = -EFAULT;
70                 goto __error2;
71         }
72         ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
73         if (ctl == NULL) {
74                 err = -ENOMEM;
75                 goto __error;
76         }
77         INIT_LIST_HEAD(&ctl->events);
78         init_waitqueue_head(&ctl->change_sleep);
79         spin_lock_init(&ctl->read_lock);
80         ctl->card = card;
81         ctl->prefer_pcm_subdevice = -1;
82         ctl->prefer_rawmidi_subdevice = -1;
83         ctl->pid = get_pid(task_pid(current));
84         file->private_data = ctl;
85         write_lock_irqsave(&card->ctl_files_rwlock, flags);
86         list_add_tail(&ctl->list, &card->ctl_files);
87         write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
88         return 0;
89
90       __error:
91         module_put(card->module);
92       __error2:
93         snd_card_file_remove(card, file);
94       __error1:
95         return err;
96 }
97
98 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
99 {
100         unsigned long flags;
101         struct snd_kctl_event *cread;
102         
103         spin_lock_irqsave(&ctl->read_lock, flags);
104         while (!list_empty(&ctl->events)) {
105                 cread = snd_kctl_event(ctl->events.next);
106                 list_del(&cread->list);
107                 kfree(cread);
108         }
109         spin_unlock_irqrestore(&ctl->read_lock, flags);
110 }
111
112 static int snd_ctl_release(struct inode *inode, struct file *file)
113 {
114         unsigned long flags;
115         struct snd_card *card;
116         struct snd_ctl_file *ctl;
117         struct snd_kcontrol *control;
118         unsigned int idx;
119
120         ctl = file->private_data;
121         file->private_data = NULL;
122         card = ctl->card;
123         write_lock_irqsave(&card->ctl_files_rwlock, flags);
124         list_del(&ctl->list);
125         write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
126         down_write(&card->controls_rwsem);
127         list_for_each_entry(control, &card->controls, list)
128                 for (idx = 0; idx < control->count; idx++)
129                         if (control->vd[idx].owner == ctl)
130                                 control->vd[idx].owner = NULL;
131         up_write(&card->controls_rwsem);
132         snd_ctl_empty_read_queue(ctl);
133         put_pid(ctl->pid);
134         kfree(ctl);
135         module_put(card->module);
136         snd_card_file_remove(card, file);
137         return 0;
138 }
139
140 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
141                     struct snd_ctl_elem_id *id)
142 {
143         unsigned long flags;
144         struct snd_ctl_file *ctl;
145         struct snd_kctl_event *ev;
146         
147         if (snd_BUG_ON(!card || !id))
148                 return;
149         read_lock(&card->ctl_files_rwlock);
150 #if defined(CONFIG_SND_MIXER_OSS) || defined(CONFIG_SND_MIXER_OSS_MODULE)
151         card->mixer_oss_change_count++;
152 #endif
153         list_for_each_entry(ctl, &card->ctl_files, list) {
154                 if (!ctl->subscribed)
155                         continue;
156                 spin_lock_irqsave(&ctl->read_lock, flags);
157                 list_for_each_entry(ev, &ctl->events, list) {
158                         if (ev->id.numid == id->numid) {
159                                 ev->mask |= mask;
160                                 goto _found;
161                         }
162                 }
163                 ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
164                 if (ev) {
165                         ev->id = *id;
166                         ev->mask = mask;
167                         list_add_tail(&ev->list, &ctl->events);
168                 } else {
169                         snd_printk(KERN_ERR "No memory available to allocate event\n");
170                 }
171         _found:
172                 wake_up(&ctl->change_sleep);
173                 spin_unlock_irqrestore(&ctl->read_lock, flags);
174                 kill_fasync(&ctl->fasync, SIGIO, POLL_IN);
175         }
176         read_unlock(&card->ctl_files_rwlock);
177 }
178
179 EXPORT_SYMBOL(snd_ctl_notify);
180
181 /**
182  * snd_ctl_new - create a control instance from the template
183  * @control: the control template
184  * @access: the default control access
185  *
186  * Allocates a new struct snd_kcontrol instance and copies the given template 
187  * to the new instance. It does not copy volatile data (access).
188  *
189  * Returns the pointer of the new instance, or NULL on failure.
190  */
191 static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control,
192                                         unsigned int access)
193 {
194         struct snd_kcontrol *kctl;
195         unsigned int idx;
196         
197         if (snd_BUG_ON(!control || !control->count))
198                 return NULL;
199
200         if (control->count > MAX_CONTROL_COUNT)
201                 return NULL;
202
203         kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
204         if (kctl == NULL) {
205                 snd_printk(KERN_ERR "Cannot allocate control instance\n");
206                 return NULL;
207         }
208         *kctl = *control;
209         for (idx = 0; idx < kctl->count; idx++)
210                 kctl->vd[idx].access = access;
211         return kctl;
212 }
213
214 /**
215  * snd_ctl_new1 - create a control instance from the template
216  * @ncontrol: the initialization record
217  * @private_data: the private data to set
218  *
219  * Allocates a new struct snd_kcontrol instance and initialize from the given 
220  * template.  When the access field of ncontrol is 0, it's assumed as
221  * READWRITE access. When the count field is 0, it's assumes as one.
222  *
223  * Returns the pointer of the newly generated instance, or NULL on failure.
224  */
225 struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol,
226                                   void *private_data)
227 {
228         struct snd_kcontrol kctl;
229         unsigned int access;
230         
231         if (snd_BUG_ON(!ncontrol || !ncontrol->info))
232                 return NULL;
233         memset(&kctl, 0, sizeof(kctl));
234         kctl.id.iface = ncontrol->iface;
235         kctl.id.device = ncontrol->device;
236         kctl.id.subdevice = ncontrol->subdevice;
237         if (ncontrol->name) {
238                 strlcpy(kctl.id.name, ncontrol->name, sizeof(kctl.id.name));
239                 if (strcmp(ncontrol->name, kctl.id.name) != 0)
240                         snd_printk(KERN_WARNING
241                                    "Control name '%s' truncated to '%s'\n",
242                                    ncontrol->name, kctl.id.name);
243         }
244         kctl.id.index = ncontrol->index;
245         kctl.count = ncontrol->count ? ncontrol->count : 1;
246         access = ncontrol->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
247                  (ncontrol->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
248                                       SNDRV_CTL_ELEM_ACCESS_INACTIVE|
249                                       SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE|
250                                       SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND|
251                                       SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK));
252         kctl.info = ncontrol->info;
253         kctl.get = ncontrol->get;
254         kctl.put = ncontrol->put;
255         kctl.tlv.p = ncontrol->tlv.p;
256         kctl.private_value = ncontrol->private_value;
257         kctl.private_data = private_data;
258         return snd_ctl_new(&kctl, access);
259 }
260
261 EXPORT_SYMBOL(snd_ctl_new1);
262
263 /**
264  * snd_ctl_free_one - release the control instance
265  * @kcontrol: the control instance
266  *
267  * Releases the control instance created via snd_ctl_new()
268  * or snd_ctl_new1().
269  * Don't call this after the control was added to the card.
270  */
271 void snd_ctl_free_one(struct snd_kcontrol *kcontrol)
272 {
273         if (kcontrol) {
274                 if (kcontrol->private_free)
275                         kcontrol->private_free(kcontrol);
276                 kfree(kcontrol);
277         }
278 }
279
280 EXPORT_SYMBOL(snd_ctl_free_one);
281
282 static unsigned int snd_ctl_hole_check(struct snd_card *card,
283                                        unsigned int count)
284 {
285         struct snd_kcontrol *kctl;
286
287         list_for_each_entry(kctl, &card->controls, list) {
288                 if ((kctl->id.numid <= card->last_numid &&
289                      kctl->id.numid + kctl->count > card->last_numid) ||
290                     (kctl->id.numid <= card->last_numid + count - 1 &&
291                      kctl->id.numid + kctl->count > card->last_numid + count - 1))
292                         return card->last_numid = kctl->id.numid + kctl->count - 1;
293         }
294         return card->last_numid;
295 }
296
297 static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
298 {
299         unsigned int last_numid, iter = 100000;
300
301         last_numid = card->last_numid;
302         while (last_numid != snd_ctl_hole_check(card, count)) {
303                 if (--iter == 0) {
304                         /* this situation is very unlikely */
305                         snd_printk(KERN_ERR "unable to allocate new control numid\n");
306                         return -ENOMEM;
307                 }
308                 last_numid = card->last_numid;
309         }
310         return 0;
311 }
312
313 /**
314  * snd_ctl_add - add the control instance to the card
315  * @card: the card instance
316  * @kcontrol: the control instance to add
317  *
318  * Adds the control instance created via snd_ctl_new() or
319  * snd_ctl_new1() to the given card. Assigns also an unique
320  * numid used for fast search.
321  *
322  * Returns zero if successful, or a negative error code on failure.
323  *
324  * It frees automatically the control which cannot be added.
325  */
326 int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
327 {
328         struct snd_ctl_elem_id id;
329         unsigned int idx;
330         int err = -EINVAL;
331
332         if (! kcontrol)
333                 return err;
334         if (snd_BUG_ON(!card || !kcontrol->info))
335                 goto error;
336         id = kcontrol->id;
337         down_write(&card->controls_rwsem);
338         if (snd_ctl_find_id(card, &id)) {
339                 up_write(&card->controls_rwsem);
340                 snd_printd(KERN_ERR "control %i:%i:%i:%s:%i is already present\n",
341                                         id.iface,
342                                         id.device,
343                                         id.subdevice,
344                                         id.name,
345                                         id.index);
346                 err = -EBUSY;
347                 goto error;
348         }
349         if (snd_ctl_find_hole(card, kcontrol->count) < 0) {
350                 up_write(&card->controls_rwsem);
351                 err = -ENOMEM;
352                 goto error;
353         }
354         list_add_tail(&kcontrol->list, &card->controls);
355         card->controls_count += kcontrol->count;
356         kcontrol->id.numid = card->last_numid + 1;
357         card->last_numid += kcontrol->count;
358         up_write(&card->controls_rwsem);
359         for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
360                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
361         return 0;
362
363  error:
364         snd_ctl_free_one(kcontrol);
365         return err;
366 }
367
368 EXPORT_SYMBOL(snd_ctl_add);
369
370 /**
371  * snd_ctl_remove - remove the control from the card and release it
372  * @card: the card instance
373  * @kcontrol: the control instance to remove
374  *
375  * Removes the control from the card and then releases the instance.
376  * You don't need to call snd_ctl_free_one(). You must be in
377  * the write lock - down_write(&card->controls_rwsem).
378  * 
379  * Returns 0 if successful, or a negative error code on failure.
380  */
381 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
382 {
383         struct snd_ctl_elem_id id;
384         unsigned int idx;
385
386         if (snd_BUG_ON(!card || !kcontrol))
387                 return -EINVAL;
388         list_del(&kcontrol->list);
389         card->controls_count -= kcontrol->count;
390         id = kcontrol->id;
391         for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
392                 snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_REMOVE, &id);
393         snd_ctl_free_one(kcontrol);
394         return 0;
395 }
396
397 EXPORT_SYMBOL(snd_ctl_remove);
398
399 /**
400  * snd_ctl_remove_id - remove the control of the given id and release it
401  * @card: the card instance
402  * @id: the control id to remove
403  *
404  * Finds the control instance with the given id, removes it from the
405  * card list and releases it.
406  * 
407  * Returns 0 if successful, or a negative error code on failure.
408  */
409 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
410 {
411         struct snd_kcontrol *kctl;
412         int ret;
413
414         down_write(&card->controls_rwsem);
415         kctl = snd_ctl_find_id(card, id);
416         if (kctl == NULL) {
417                 up_write(&card->controls_rwsem);
418                 return -ENOENT;
419         }
420         ret = snd_ctl_remove(card, kctl);
421         up_write(&card->controls_rwsem);
422         return ret;
423 }
424
425 EXPORT_SYMBOL(snd_ctl_remove_id);
426
427 /**
428  * snd_ctl_remove_user_ctl - remove and release the unlocked user control
429  * @file: active control handle
430  * @id: the control id to remove
431  *
432  * Finds the control instance with the given id, removes it from the
433  * card list and releases it.
434  * 
435  * Returns 0 if successful, or a negative error code on failure.
436  */
437 static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
438                                    struct snd_ctl_elem_id *id)
439 {
440         struct snd_card *card = file->card;
441         struct snd_kcontrol *kctl;
442         int idx, ret;
443
444         down_write(&card->controls_rwsem);
445         kctl = snd_ctl_find_id(card, id);
446         if (kctl == NULL) {
447                 ret = -ENOENT;
448                 goto error;
449         }
450         if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
451                 ret = -EINVAL;
452                 goto error;
453         }
454         for (idx = 0; idx < kctl->count; idx++)
455                 if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
456                         ret = -EBUSY;
457                         goto error;
458                 }
459         ret = snd_ctl_remove(card, kctl);
460         if (ret < 0)
461                 goto error;
462         card->user_ctl_count--;
463 error:
464         up_write(&card->controls_rwsem);
465         return ret;
466 }
467
468 /**
469  * snd_ctl_rename_id - replace the id of a control on the card
470  * @card: the card instance
471  * @src_id: the old id
472  * @dst_id: the new id
473  *
474  * Finds the control with the old id from the card, and replaces the
475  * id with the new one.
476  *
477  * Returns zero if successful, or a negative error code on failure.
478  */
479 int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
480                       struct snd_ctl_elem_id *dst_id)
481 {
482         struct snd_kcontrol *kctl;
483
484         down_write(&card->controls_rwsem);
485         kctl = snd_ctl_find_id(card, src_id);
486         if (kctl == NULL) {
487                 up_write(&card->controls_rwsem);
488                 return -ENOENT;
489         }
490         kctl->id = *dst_id;
491         kctl->id.numid = card->last_numid + 1;
492         card->last_numid += kctl->count;
493         up_write(&card->controls_rwsem);
494         return 0;
495 }
496
497 EXPORT_SYMBOL(snd_ctl_rename_id);
498
499 /**
500  * snd_ctl_find_numid - find the control instance with the given number-id
501  * @card: the card instance
502  * @numid: the number-id to search
503  *
504  * Finds the control instance with the given number-id from the card.
505  *
506  * Returns the pointer of the instance if found, or NULL if not.
507  *
508  * The caller must down card->controls_rwsem before calling this function
509  * (if the race condition can happen).
510  */
511 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card, unsigned int numid)
512 {
513         struct snd_kcontrol *kctl;
514
515         if (snd_BUG_ON(!card || !numid))
516                 return NULL;
517         list_for_each_entry(kctl, &card->controls, list) {
518                 if (kctl->id.numid <= numid && kctl->id.numid + kctl->count > numid)
519                         return kctl;
520         }
521         return NULL;
522 }
523
524 EXPORT_SYMBOL(snd_ctl_find_numid);
525
526 /**
527  * snd_ctl_find_id - find the control instance with the given id
528  * @card: the card instance
529  * @id: the id to search
530  *
531  * Finds the control instance with the given id from the card.
532  *
533  * Returns the pointer of the instance if found, or NULL if not.
534  *
535  * The caller must down card->controls_rwsem before calling this function
536  * (if the race condition can happen).
537  */
538 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
539                                      struct snd_ctl_elem_id *id)
540 {
541         struct snd_kcontrol *kctl;
542
543         if (snd_BUG_ON(!card || !id))
544                 return NULL;
545         if (id->numid != 0)
546                 return snd_ctl_find_numid(card, id->numid);
547         list_for_each_entry(kctl, &card->controls, list) {
548                 if (kctl->id.iface != id->iface)
549                         continue;
550                 if (kctl->id.device != id->device)
551                         continue;
552                 if (kctl->id.subdevice != id->subdevice)
553                         continue;
554                 if (strncmp(kctl->id.name, id->name, sizeof(kctl->id.name)))
555                         continue;
556                 if (kctl->id.index > id->index)
557                         continue;
558                 if (kctl->id.index + kctl->count <= id->index)
559                         continue;
560                 return kctl;
561         }
562         return NULL;
563 }
564
565 EXPORT_SYMBOL(snd_ctl_find_id);
566
567 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
568                              unsigned int cmd, void __user *arg)
569 {
570         struct snd_ctl_card_info *info;
571
572         info = kzalloc(sizeof(*info), GFP_KERNEL);
573         if (! info)
574                 return -ENOMEM;
575         down_read(&snd_ioctl_rwsem);
576         info->card = card->number;
577         strlcpy(info->id, card->id, sizeof(info->id));
578         strlcpy(info->driver, card->driver, sizeof(info->driver));
579         strlcpy(info->name, card->shortname, sizeof(info->name));
580         strlcpy(info->longname, card->longname, sizeof(info->longname));
581         strlcpy(info->mixername, card->mixername, sizeof(info->mixername));
582         strlcpy(info->components, card->components, sizeof(info->components));
583         up_read(&snd_ioctl_rwsem);
584         if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
585                 kfree(info);
586                 return -EFAULT;
587         }
588         kfree(info);
589         return 0;
590 }
591
592 static int snd_ctl_elem_list(struct snd_card *card,
593                              struct snd_ctl_elem_list __user *_list)
594 {
595         struct list_head *plist;
596         struct snd_ctl_elem_list list;
597         struct snd_kcontrol *kctl;
598         struct snd_ctl_elem_id *dst, *id;
599         unsigned int offset, space, first, jidx;
600         
601         if (copy_from_user(&list, _list, sizeof(list)))
602                 return -EFAULT;
603         offset = list.offset;
604         space = list.space;
605         first = 0;
606         /* try limit maximum space */
607         if (space > 16384)
608                 return -ENOMEM;
609         if (space > 0) {
610                 /* allocate temporary buffer for atomic operation */
611                 dst = vmalloc(space * sizeof(struct snd_ctl_elem_id));
612                 if (dst == NULL)
613                         return -ENOMEM;
614                 down_read(&card->controls_rwsem);
615                 list.count = card->controls_count;
616                 plist = card->controls.next;
617                 while (plist != &card->controls) {
618                         if (offset == 0)
619                                 break;
620                         kctl = snd_kcontrol(plist);
621                         if (offset < kctl->count)
622                                 break;
623                         offset -= kctl->count;
624                         plist = plist->next;
625                 }
626                 list.used = 0;
627                 id = dst;
628                 while (space > 0 && plist != &card->controls) {
629                         kctl = snd_kcontrol(plist);
630                         for (jidx = offset; space > 0 && jidx < kctl->count; jidx++) {
631                                 snd_ctl_build_ioff(id, kctl, jidx);
632                                 id++;
633                                 space--;
634                                 list.used++;
635                         }
636                         plist = plist->next;
637                         offset = 0;
638                 }
639                 up_read(&card->controls_rwsem);
640                 if (list.used > 0 &&
641                     copy_to_user(list.pids, dst,
642                                  list.used * sizeof(struct snd_ctl_elem_id))) {
643                         vfree(dst);
644                         return -EFAULT;
645                 }
646                 vfree(dst);
647         } else {
648                 down_read(&card->controls_rwsem);
649                 list.count = card->controls_count;
650                 up_read(&card->controls_rwsem);
651         }
652         if (copy_to_user(_list, &list, sizeof(list)))
653                 return -EFAULT;
654         return 0;
655 }
656
657 static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
658                              struct snd_ctl_elem_info *info)
659 {
660         struct snd_card *card = ctl->card;
661         struct snd_kcontrol *kctl;
662         struct snd_kcontrol_volatile *vd;
663         unsigned int index_offset;
664         int result;
665         
666         down_read(&card->controls_rwsem);
667         kctl = snd_ctl_find_id(card, &info->id);
668         if (kctl == NULL) {
669                 up_read(&card->controls_rwsem);
670                 return -ENOENT;
671         }
672 #ifdef CONFIG_SND_DEBUG
673         info->access = 0;
674 #endif
675         result = kctl->info(kctl, info);
676         if (result >= 0) {
677                 snd_BUG_ON(info->access);
678                 index_offset = snd_ctl_get_ioff(kctl, &info->id);
679                 vd = &kctl->vd[index_offset];
680                 snd_ctl_build_ioff(&info->id, kctl, index_offset);
681                 info->access = vd->access;
682                 if (vd->owner) {
683                         info->access |= SNDRV_CTL_ELEM_ACCESS_LOCK;
684                         if (vd->owner == ctl)
685                                 info->access |= SNDRV_CTL_ELEM_ACCESS_OWNER;
686                         info->owner = pid_vnr(vd->owner->pid);
687                 } else {
688                         info->owner = -1;
689                 }
690         }
691         up_read(&card->controls_rwsem);
692         return result;
693 }
694
695 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
696                                   struct snd_ctl_elem_info __user *_info)
697 {
698         struct snd_ctl_elem_info info;
699         int result;
700
701         if (copy_from_user(&info, _info, sizeof(info)))
702                 return -EFAULT;
703         snd_power_lock(ctl->card);
704         result = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0);
705         if (result >= 0)
706                 result = snd_ctl_elem_info(ctl, &info);
707         snd_power_unlock(ctl->card);
708         if (result >= 0)
709                 if (copy_to_user(_info, &info, sizeof(info)))
710                         return -EFAULT;
711         return result;
712 }
713
714 static int snd_ctl_elem_read(struct snd_card *card,
715                              struct snd_ctl_elem_value *control)
716 {
717         struct snd_kcontrol *kctl;
718         struct snd_kcontrol_volatile *vd;
719         unsigned int index_offset;
720         int result;
721
722         down_read(&card->controls_rwsem);
723         kctl = snd_ctl_find_id(card, &control->id);
724         if (kctl == NULL) {
725                 result = -ENOENT;
726         } else {
727                 index_offset = snd_ctl_get_ioff(kctl, &control->id);
728                 vd = &kctl->vd[index_offset];
729                 if ((vd->access & SNDRV_CTL_ELEM_ACCESS_READ) &&
730                     kctl->get != NULL) {
731                         snd_ctl_build_ioff(&control->id, kctl, index_offset);
732                         result = kctl->get(kctl, control);
733                 } else
734                         result = -EPERM;
735         }
736         up_read(&card->controls_rwsem);
737         return result;
738 }
739
740 static int snd_ctl_elem_read_user(struct snd_card *card,
741                                   struct snd_ctl_elem_value __user *_control)
742 {
743         struct snd_ctl_elem_value *control;
744         int result;
745
746         control = memdup_user(_control, sizeof(*control));
747         if (IS_ERR(control))
748                 return PTR_ERR(control);
749
750         snd_power_lock(card);
751         result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
752         if (result >= 0)
753                 result = snd_ctl_elem_read(card, control);
754         snd_power_unlock(card);
755         if (result >= 0)
756                 if (copy_to_user(_control, control, sizeof(*control)))
757                         result = -EFAULT;
758         kfree(control);
759         return result;
760 }
761
762 static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
763                               struct snd_ctl_elem_value *control)
764 {
765         struct snd_kcontrol *kctl;
766         struct snd_kcontrol_volatile *vd;
767         unsigned int index_offset;
768         int result;
769
770         down_read(&card->controls_rwsem);
771         kctl = snd_ctl_find_id(card, &control->id);
772         if (kctl == NULL) {
773                 result = -ENOENT;
774         } else {
775                 index_offset = snd_ctl_get_ioff(kctl, &control->id);
776                 vd = &kctl->vd[index_offset];
777                 if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) ||
778                     kctl->put == NULL ||
779                     (file && vd->owner && vd->owner != file)) {
780                         result = -EPERM;
781                 } else {
782                         snd_ctl_build_ioff(&control->id, kctl, index_offset);
783                         result = kctl->put(kctl, control);
784                 }
785                 if (result > 0) {
786                         up_read(&card->controls_rwsem);
787                         snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
788                                        &control->id);
789                         return 0;
790                 }
791         }
792         up_read(&card->controls_rwsem);
793         return result;
794 }
795
796 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
797                                    struct snd_ctl_elem_value __user *_control)
798 {
799         struct snd_ctl_elem_value *control;
800         struct snd_card *card;
801         int result;
802
803         control = memdup_user(_control, sizeof(*control));
804         if (IS_ERR(control))
805                 return PTR_ERR(control);
806
807         card = file->card;
808         snd_power_lock(card);
809         result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
810         if (result >= 0)
811                 result = snd_ctl_elem_write(card, file, control);
812         snd_power_unlock(card);
813         if (result >= 0)
814                 if (copy_to_user(_control, control, sizeof(*control)))
815                         result = -EFAULT;
816         kfree(control);
817         return result;
818 }
819
820 static int snd_ctl_elem_lock(struct snd_ctl_file *file,
821                              struct snd_ctl_elem_id __user *_id)
822 {
823         struct snd_card *card = file->card;
824         struct snd_ctl_elem_id id;
825         struct snd_kcontrol *kctl;
826         struct snd_kcontrol_volatile *vd;
827         int result;
828         
829         if (copy_from_user(&id, _id, sizeof(id)))
830                 return -EFAULT;
831         down_write(&card->controls_rwsem);
832         kctl = snd_ctl_find_id(card, &id);
833         if (kctl == NULL) {
834                 result = -ENOENT;
835         } else {
836                 vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
837                 if (vd->owner != NULL)
838                         result = -EBUSY;
839                 else {
840                         vd->owner = file;
841                         result = 0;
842                 }
843         }
844         up_write(&card->controls_rwsem);
845         return result;
846 }
847
848 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
849                                struct snd_ctl_elem_id __user *_id)
850 {
851         struct snd_card *card = file->card;
852         struct snd_ctl_elem_id id;
853         struct snd_kcontrol *kctl;
854         struct snd_kcontrol_volatile *vd;
855         int result;
856         
857         if (copy_from_user(&id, _id, sizeof(id)))
858                 return -EFAULT;
859         down_write(&card->controls_rwsem);
860         kctl = snd_ctl_find_id(card, &id);
861         if (kctl == NULL) {
862                 result = -ENOENT;
863         } else {
864                 vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
865                 if (vd->owner == NULL)
866                         result = -EINVAL;
867                 else if (vd->owner != file)
868                         result = -EPERM;
869                 else {
870                         vd->owner = NULL;
871                         result = 0;
872                 }
873         }
874         up_write(&card->controls_rwsem);
875         return result;
876 }
877
878 struct user_element {
879         struct snd_ctl_elem_info info;
880         void *elem_data;                /* element data */
881         unsigned long elem_data_size;   /* size of element data in bytes */
882         void *tlv_data;                 /* TLV data */
883         unsigned long tlv_data_size;    /* TLV data size */
884         void *priv_data;                /* private data (like strings for enumerated type) */
885         unsigned long priv_data_size;   /* size of private data in bytes */
886 };
887
888 static int snd_ctl_elem_user_info(struct snd_kcontrol *kcontrol,
889                                   struct snd_ctl_elem_info *uinfo)
890 {
891         struct user_element *ue = kcontrol->private_data;
892
893         *uinfo = ue->info;
894         return 0;
895 }
896
897 static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
898                                  struct snd_ctl_elem_value *ucontrol)
899 {
900         struct user_element *ue = kcontrol->private_data;
901
902         memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size);
903         return 0;
904 }
905
906 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
907                                  struct snd_ctl_elem_value *ucontrol)
908 {
909         int change;
910         struct user_element *ue = kcontrol->private_data;
911         
912         change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0;
913         if (change)
914                 memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size);
915         return change;
916 }
917
918 static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
919                                  int op_flag,
920                                  unsigned int size,
921                                  unsigned int __user *tlv)
922 {
923         struct user_element *ue = kcontrol->private_data;
924         int change = 0;
925         void *new_data;
926
927         if (op_flag > 0) {
928                 if (size > 1024 * 128)  /* sane value */
929                         return -EINVAL;
930
931                 new_data = memdup_user(tlv, size);
932                 if (IS_ERR(new_data))
933                         return PTR_ERR(new_data);
934                 change = ue->tlv_data_size != size;
935                 if (!change)
936                         change = memcmp(ue->tlv_data, new_data, size);
937                 kfree(ue->tlv_data);
938                 ue->tlv_data = new_data;
939                 ue->tlv_data_size = size;
940         } else {
941                 if (! ue->tlv_data_size || ! ue->tlv_data)
942                         return -ENXIO;
943                 if (size < ue->tlv_data_size)
944                         return -ENOSPC;
945                 if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size))
946                         return -EFAULT;
947         }
948         return change;
949 }
950
951 static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
952 {
953         struct user_element *ue = kcontrol->private_data;
954         if (ue->tlv_data)
955                 kfree(ue->tlv_data);
956         kfree(ue);
957 }
958
959 static int snd_ctl_elem_add(struct snd_ctl_file *file,
960                             struct snd_ctl_elem_info *info, int replace)
961 {
962         struct snd_card *card = file->card;
963         struct snd_kcontrol kctl, *_kctl;
964         unsigned int access;
965         long private_size;
966         struct user_element *ue;
967         int idx, err;
968         
969         if (card->user_ctl_count >= MAX_USER_CONTROLS)
970                 return -ENOMEM;
971         if (info->count < 1)
972                 return -EINVAL;
973         access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
974                 (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
975                                  SNDRV_CTL_ELEM_ACCESS_INACTIVE|
976                                  SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE));
977         info->id.numid = 0;
978         memset(&kctl, 0, sizeof(kctl));
979         down_write(&card->controls_rwsem);
980         _kctl = snd_ctl_find_id(card, &info->id);
981         err = 0;
982         if (_kctl) {
983                 if (replace)
984                         err = snd_ctl_remove(card, _kctl);
985                 else
986                         err = -EBUSY;
987         } else {
988                 if (replace)
989                         err = -ENOENT;
990         }
991         up_write(&card->controls_rwsem);
992         if (err < 0)
993                 return err;
994         memcpy(&kctl.id, &info->id, sizeof(info->id));
995         kctl.count = info->owner ? info->owner : 1;
996         access |= SNDRV_CTL_ELEM_ACCESS_USER;
997         kctl.info = snd_ctl_elem_user_info;
998         if (access & SNDRV_CTL_ELEM_ACCESS_READ)
999                 kctl.get = snd_ctl_elem_user_get;
1000         if (access & SNDRV_CTL_ELEM_ACCESS_WRITE)
1001                 kctl.put = snd_ctl_elem_user_put;
1002         if (access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE) {
1003                 kctl.tlv.c = snd_ctl_elem_user_tlv;
1004                 access |= SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
1005         }
1006         switch (info->type) {
1007         case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
1008         case SNDRV_CTL_ELEM_TYPE_INTEGER:
1009                 private_size = sizeof(long);
1010                 if (info->count > 128)
1011                         return -EINVAL;
1012                 break;
1013         case SNDRV_CTL_ELEM_TYPE_INTEGER64:
1014                 private_size = sizeof(long long);
1015                 if (info->count > 64)
1016                         return -EINVAL;
1017                 break;
1018         case SNDRV_CTL_ELEM_TYPE_BYTES:
1019                 private_size = sizeof(unsigned char);
1020                 if (info->count > 512)
1021                         return -EINVAL;
1022                 break;
1023         case SNDRV_CTL_ELEM_TYPE_IEC958:
1024                 private_size = sizeof(struct snd_aes_iec958);
1025                 if (info->count != 1)
1026                         return -EINVAL;
1027                 break;
1028         default:
1029                 return -EINVAL;
1030         }
1031         private_size *= info->count;
1032         ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
1033         if (ue == NULL)
1034                 return -ENOMEM;
1035         ue->info = *info;
1036         ue->info.access = 0;
1037         ue->elem_data = (char *)ue + sizeof(*ue);
1038         ue->elem_data_size = private_size;
1039         kctl.private_free = snd_ctl_elem_user_free;
1040         _kctl = snd_ctl_new(&kctl, access);
1041         if (_kctl == NULL) {
1042                 kfree(ue);
1043                 return -ENOMEM;
1044         }
1045         _kctl->private_data = ue;
1046         for (idx = 0; idx < _kctl->count; idx++)
1047                 _kctl->vd[idx].owner = file;
1048         err = snd_ctl_add(card, _kctl);
1049         if (err < 0)
1050                 return err;
1051
1052         down_write(&card->controls_rwsem);
1053         card->user_ctl_count++;
1054         up_write(&card->controls_rwsem);
1055
1056         return 0;
1057 }
1058
1059 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
1060                                  struct snd_ctl_elem_info __user *_info, int replace)
1061 {
1062         struct snd_ctl_elem_info info;
1063         if (copy_from_user(&info, _info, sizeof(info)))
1064                 return -EFAULT;
1065         return snd_ctl_elem_add(file, &info, replace);
1066 }
1067
1068 static int snd_ctl_elem_remove(struct snd_ctl_file *file,
1069                                struct snd_ctl_elem_id __user *_id)
1070 {
1071         struct snd_ctl_elem_id id;
1072
1073         if (copy_from_user(&id, _id, sizeof(id)))
1074                 return -EFAULT;
1075         return snd_ctl_remove_user_ctl(file, &id);
1076 }
1077
1078 static int snd_ctl_subscribe_events(struct snd_ctl_file *file, int __user *ptr)
1079 {
1080         int subscribe;
1081         if (get_user(subscribe, ptr))
1082                 return -EFAULT;
1083         if (subscribe < 0) {
1084                 subscribe = file->subscribed;
1085                 if (put_user(subscribe, ptr))
1086                         return -EFAULT;
1087                 return 0;
1088         }
1089         if (subscribe) {
1090                 file->subscribed = 1;
1091                 return 0;
1092         } else if (file->subscribed) {
1093                 snd_ctl_empty_read_queue(file);
1094                 file->subscribed = 0;
1095         }
1096         return 0;
1097 }
1098
1099 static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1100                              struct snd_ctl_tlv __user *_tlv,
1101                              int op_flag)
1102 {
1103         struct snd_card *card = file->card;
1104         struct snd_ctl_tlv tlv;
1105         struct snd_kcontrol *kctl;
1106         struct snd_kcontrol_volatile *vd;
1107         unsigned int len;
1108         int err = 0;
1109
1110         if (copy_from_user(&tlv, _tlv, sizeof(tlv)))
1111                 return -EFAULT;
1112         if (tlv.length < sizeof(unsigned int) * 2)
1113                 return -EINVAL;
1114         down_read(&card->controls_rwsem);
1115         kctl = snd_ctl_find_numid(card, tlv.numid);
1116         if (kctl == NULL) {
1117                 err = -ENOENT;
1118                 goto __kctl_end;
1119         }
1120         if (kctl->tlv.p == NULL) {
1121                 err = -ENXIO;
1122                 goto __kctl_end;
1123         }
1124         vd = &kctl->vd[tlv.numid - kctl->id.numid];
1125         if ((op_flag == 0 && (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ) == 0) ||
1126             (op_flag > 0 && (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE) == 0) ||
1127             (op_flag < 0 && (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND) == 0)) {
1128                 err = -ENXIO;
1129                 goto __kctl_end;
1130         }
1131         if (vd->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
1132                 if (vd->owner != NULL && vd->owner != file) {
1133                         err = -EPERM;
1134                         goto __kctl_end;
1135                 }
1136                 err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv); 
1137                 if (err > 0) {
1138                         up_read(&card->controls_rwsem);
1139                         snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &kctl->id);
1140                         return 0;
1141                 }
1142         } else {
1143                 if (op_flag) {
1144                         err = -ENXIO;
1145                         goto __kctl_end;
1146                 }
1147                 len = kctl->tlv.p[1] + 2 * sizeof(unsigned int);
1148                 if (tlv.length < len) {
1149                         err = -ENOMEM;
1150                         goto __kctl_end;
1151                 }
1152                 if (copy_to_user(_tlv->tlv, kctl->tlv.p, len))
1153                         err = -EFAULT;
1154         }
1155       __kctl_end:
1156         up_read(&card->controls_rwsem);
1157         return err;
1158 }
1159
1160 static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1161 {
1162         struct snd_ctl_file *ctl;
1163         struct snd_card *card;
1164         struct snd_kctl_ioctl *p;
1165         void __user *argp = (void __user *)arg;
1166         int __user *ip = argp;
1167         int err;
1168
1169         ctl = file->private_data;
1170         card = ctl->card;
1171         if (snd_BUG_ON(!card))
1172                 return -ENXIO;
1173         switch (cmd) {
1174         case SNDRV_CTL_IOCTL_PVERSION:
1175                 return put_user(SNDRV_CTL_VERSION, ip) ? -EFAULT : 0;
1176         case SNDRV_CTL_IOCTL_CARD_INFO:
1177                 return snd_ctl_card_info(card, ctl, cmd, argp);
1178         case SNDRV_CTL_IOCTL_ELEM_LIST:
1179                 return snd_ctl_elem_list(card, argp);
1180         case SNDRV_CTL_IOCTL_ELEM_INFO:
1181                 return snd_ctl_elem_info_user(ctl, argp);
1182         case SNDRV_CTL_IOCTL_ELEM_READ:
1183                 return snd_ctl_elem_read_user(card, argp);
1184         case SNDRV_CTL_IOCTL_ELEM_WRITE:
1185                 return snd_ctl_elem_write_user(ctl, argp);
1186         case SNDRV_CTL_IOCTL_ELEM_LOCK:
1187                 return snd_ctl_elem_lock(ctl, argp);
1188         case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
1189                 return snd_ctl_elem_unlock(ctl, argp);
1190         case SNDRV_CTL_IOCTL_ELEM_ADD:
1191                 return snd_ctl_elem_add_user(ctl, argp, 0);
1192         case SNDRV_CTL_IOCTL_ELEM_REPLACE:
1193                 return snd_ctl_elem_add_user(ctl, argp, 1);
1194         case SNDRV_CTL_IOCTL_ELEM_REMOVE:
1195                 return snd_ctl_elem_remove(ctl, argp);
1196         case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
1197                 return snd_ctl_subscribe_events(ctl, ip);
1198         case SNDRV_CTL_IOCTL_TLV_READ:
1199                 return snd_ctl_tlv_ioctl(ctl, argp, 0);
1200         case SNDRV_CTL_IOCTL_TLV_WRITE:
1201                 return snd_ctl_tlv_ioctl(ctl, argp, 1);
1202         case SNDRV_CTL_IOCTL_TLV_COMMAND:
1203                 return snd_ctl_tlv_ioctl(ctl, argp, -1);
1204         case SNDRV_CTL_IOCTL_POWER:
1205                 return -ENOPROTOOPT;
1206         case SNDRV_CTL_IOCTL_POWER_STATE:
1207 #ifdef CONFIG_PM
1208                 return put_user(card->power_state, ip) ? -EFAULT : 0;
1209 #else
1210                 return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
1211 #endif
1212         }
1213         down_read(&snd_ioctl_rwsem);
1214         list_for_each_entry(p, &snd_control_ioctls, list) {
1215                 err = p->fioctl(card, ctl, cmd, arg);
1216                 if (err != -ENOIOCTLCMD) {
1217                         up_read(&snd_ioctl_rwsem);
1218                         return err;
1219                 }
1220         }
1221         up_read(&snd_ioctl_rwsem);
1222         snd_printdd("unknown ioctl = 0x%x\n", cmd);
1223         return -ENOTTY;
1224 }
1225
1226 static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
1227                             size_t count, loff_t * offset)
1228 {
1229         struct snd_ctl_file *ctl;
1230         int err = 0;
1231         ssize_t result = 0;
1232
1233         ctl = file->private_data;
1234         if (snd_BUG_ON(!ctl || !ctl->card))
1235                 return -ENXIO;
1236         if (!ctl->subscribed)
1237                 return -EBADFD;
1238         if (count < sizeof(struct snd_ctl_event))
1239                 return -EINVAL;
1240         spin_lock_irq(&ctl->read_lock);
1241         while (count >= sizeof(struct snd_ctl_event)) {
1242                 struct snd_ctl_event ev;
1243                 struct snd_kctl_event *kev;
1244                 while (list_empty(&ctl->events)) {
1245                         wait_queue_t wait;
1246                         if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
1247                                 err = -EAGAIN;
1248                                 goto __end_lock;
1249                         }
1250                         init_waitqueue_entry(&wait, current);
1251                         add_wait_queue(&ctl->change_sleep, &wait);
1252                         set_current_state(TASK_INTERRUPTIBLE);
1253                         spin_unlock_irq(&ctl->read_lock);
1254                         schedule();
1255                         remove_wait_queue(&ctl->change_sleep, &wait);
1256                         if (signal_pending(current))
1257                                 return -ERESTARTSYS;
1258                         spin_lock_irq(&ctl->read_lock);
1259                 }
1260                 kev = snd_kctl_event(ctl->events.next);
1261                 ev.type = SNDRV_CTL_EVENT_ELEM;
1262                 ev.data.elem.mask = kev->mask;
1263                 ev.data.elem.id = kev->id;
1264                 list_del(&kev->list);
1265                 spin_unlock_irq(&ctl->read_lock);
1266                 kfree(kev);
1267                 if (copy_to_user(buffer, &ev, sizeof(struct snd_ctl_event))) {
1268                         err = -EFAULT;
1269                         goto __end;
1270                 }
1271                 spin_lock_irq(&ctl->read_lock);
1272                 buffer += sizeof(struct snd_ctl_event);
1273                 count -= sizeof(struct snd_ctl_event);
1274                 result += sizeof(struct snd_ctl_event);
1275         }
1276       __end_lock:
1277         spin_unlock_irq(&ctl->read_lock);
1278       __end:
1279         return result > 0 ? result : err;
1280 }
1281
1282 static unsigned int snd_ctl_poll(struct file *file, poll_table * wait)
1283 {
1284         unsigned int mask;
1285         struct snd_ctl_file *ctl;
1286
1287         ctl = file->private_data;
1288         if (!ctl->subscribed)
1289                 return 0;
1290         poll_wait(file, &ctl->change_sleep, wait);
1291
1292         mask = 0;
1293         if (!list_empty(&ctl->events))
1294                 mask |= POLLIN | POLLRDNORM;
1295
1296         return mask;
1297 }
1298
1299 /*
1300  * register the device-specific control-ioctls.
1301  * called from each device manager like pcm.c, hwdep.c, etc.
1302  */
1303 static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *lists)
1304 {
1305         struct snd_kctl_ioctl *pn;
1306
1307         pn = kzalloc(sizeof(struct snd_kctl_ioctl), GFP_KERNEL);
1308         if (pn == NULL)
1309                 return -ENOMEM;
1310         pn->fioctl = fcn;
1311         down_write(&snd_ioctl_rwsem);
1312         list_add_tail(&pn->list, lists);
1313         up_write(&snd_ioctl_rwsem);
1314         return 0;
1315 }
1316
1317 int snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn)
1318 {
1319         return _snd_ctl_register_ioctl(fcn, &snd_control_ioctls);
1320 }
1321
1322 EXPORT_SYMBOL(snd_ctl_register_ioctl);
1323
1324 #ifdef CONFIG_COMPAT
1325 int snd_ctl_register_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1326 {
1327         return _snd_ctl_register_ioctl(fcn, &snd_control_compat_ioctls);
1328 }
1329
1330 EXPORT_SYMBOL(snd_ctl_register_ioctl_compat);
1331 #endif
1332
1333 /*
1334  * de-register the device-specific control-ioctls.
1335  */
1336 static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,
1337                                      struct list_head *lists)
1338 {
1339         struct snd_kctl_ioctl *p;
1340
1341         if (snd_BUG_ON(!fcn))
1342                 return -EINVAL;
1343         down_write(&snd_ioctl_rwsem);
1344         list_for_each_entry(p, lists, list) {
1345                 if (p->fioctl == fcn) {
1346                         list_del(&p->list);
1347                         up_write(&snd_ioctl_rwsem);
1348                         kfree(p);
1349                         return 0;
1350                 }
1351         }
1352         up_write(&snd_ioctl_rwsem);
1353         snd_BUG();
1354         return -EINVAL;
1355 }
1356
1357 int snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn)
1358 {
1359         return _snd_ctl_unregister_ioctl(fcn, &snd_control_ioctls);
1360 }
1361
1362 EXPORT_SYMBOL(snd_ctl_unregister_ioctl);
1363
1364 #ifdef CONFIG_COMPAT
1365 int snd_ctl_unregister_ioctl_compat(snd_kctl_ioctl_func_t fcn)
1366 {
1367         return _snd_ctl_unregister_ioctl(fcn, &snd_control_compat_ioctls);
1368 }
1369
1370 EXPORT_SYMBOL(snd_ctl_unregister_ioctl_compat);
1371 #endif
1372
1373 static int snd_ctl_fasync(int fd, struct file * file, int on)
1374 {
1375         struct snd_ctl_file *ctl;
1376
1377         ctl = file->private_data;
1378         return fasync_helper(fd, file, on, &ctl->fasync);
1379 }
1380
1381 /*
1382  * ioctl32 compat
1383  */
1384 #ifdef CONFIG_COMPAT
1385 #include "control_compat.c"
1386 #else
1387 #define snd_ctl_ioctl_compat    NULL
1388 #endif
1389
1390 /*
1391  *  INIT PART
1392  */
1393
1394 static const struct file_operations snd_ctl_f_ops =
1395 {
1396         .owner =        THIS_MODULE,
1397         .read =         snd_ctl_read,
1398         .open =         snd_ctl_open,
1399         .release =      snd_ctl_release,
1400         .llseek =       no_llseek,
1401         .poll =         snd_ctl_poll,
1402         .unlocked_ioctl =       snd_ctl_ioctl,
1403         .compat_ioctl = snd_ctl_ioctl_compat,
1404         .fasync =       snd_ctl_fasync,
1405 };
1406
1407 /*
1408  * registration of the control device
1409  */
1410 static int snd_ctl_dev_register(struct snd_device *device)
1411 {
1412         struct snd_card *card = device->device_data;
1413         int err, cardnum;
1414         char name[16];
1415
1416         if (snd_BUG_ON(!card))
1417                 return -ENXIO;
1418         cardnum = card->number;
1419         if (snd_BUG_ON(cardnum < 0 || cardnum >= SNDRV_CARDS))
1420                 return -ENXIO;
1421         sprintf(name, "controlC%i", cardnum);
1422         if ((err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
1423                                        &snd_ctl_f_ops, card, name)) < 0)
1424                 return err;
1425         return 0;
1426 }
1427
1428 /*
1429  * disconnection of the control device
1430  */
1431 static int snd_ctl_dev_disconnect(struct snd_device *device)
1432 {
1433         struct snd_card *card = device->device_data;
1434         struct snd_ctl_file *ctl;
1435         int err, cardnum;
1436
1437         if (snd_BUG_ON(!card))
1438                 return -ENXIO;
1439         cardnum = card->number;
1440         if (snd_BUG_ON(cardnum < 0 || cardnum >= SNDRV_CARDS))
1441                 return -ENXIO;
1442
1443         read_lock(&card->ctl_files_rwlock);
1444         list_for_each_entry(ctl, &card->ctl_files, list) {
1445                 wake_up(&ctl->change_sleep);
1446                 kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
1447         }
1448         read_unlock(&card->ctl_files_rwlock);
1449
1450         if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL,
1451                                          card, -1)) < 0)
1452                 return err;
1453         return 0;
1454 }
1455
1456 /*
1457  * free all controls
1458  */
1459 static int snd_ctl_dev_free(struct snd_device *device)
1460 {
1461         struct snd_card *card = device->device_data;
1462         struct snd_kcontrol *control;
1463
1464         down_write(&card->controls_rwsem);
1465         while (!list_empty(&card->controls)) {
1466                 control = snd_kcontrol(card->controls.next);
1467                 snd_ctl_remove(card, control);
1468         }
1469         up_write(&card->controls_rwsem);
1470         return 0;
1471 }
1472
1473 /*
1474  * create control core:
1475  * called from init.c
1476  */
1477 int snd_ctl_create(struct snd_card *card)
1478 {
1479         static struct snd_device_ops ops = {
1480                 .dev_free = snd_ctl_dev_free,
1481                 .dev_register = snd_ctl_dev_register,
1482                 .dev_disconnect = snd_ctl_dev_disconnect,
1483         };
1484
1485         if (snd_BUG_ON(!card))
1486                 return -ENXIO;
1487         return snd_device_new(card, SNDRV_DEV_CONTROL, card, &ops);
1488 }
1489
1490 /*
1491  * Frequently used control callbacks
1492  */
1493 int snd_ctl_boolean_mono_info(struct snd_kcontrol *kcontrol,
1494                               struct snd_ctl_elem_info *uinfo)
1495 {
1496         uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
1497         uinfo->count = 1;
1498         uinfo->value.integer.min = 0;
1499         uinfo->value.integer.max = 1;
1500         return 0;
1501 }
1502
1503 EXPORT_SYMBOL(snd_ctl_boolean_mono_info);
1504
1505 int snd_ctl_boolean_stereo_info(struct snd_kcontrol *kcontrol,
1506                                 struct snd_ctl_elem_info *uinfo)
1507 {
1508         uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
1509         uinfo->count = 2;
1510         uinfo->value.integer.min = 0;
1511         uinfo->value.integer.max = 1;
1512         return 0;
1513 }
1514
1515 EXPORT_SYMBOL(snd_ctl_boolean_stereo_info);