Some architectures have a execution mode to execute programs for derived architectures. Linux system supports the execution mode. For this purpose, system call compatibility layer is available to manage ABI differences of the architectures; e.g. adoption different data model (ILP32/LP64) and size/alignment of machine types.

In ALSA control interface, there're some structures which have different layout depending on the ABIs. To absorb the difference, ALSA control core has an I/O compatibility layer. Tasks of this layer are summarized as: 1. convert structure layout from program ABI to native ABI 2. process I/O request with structure layout of native ABI 3. convert structure layout from native ABI to program ABI

Current implementation of this layer is not enough structured for the above processing. This commit adds a consistent way to handle the above tasks.

Actual implementation of the tasks differs depending on the structures. This commit adds a local framework for handlers tothe tasks. A handler includes below members: - cmd: a command of ioctl(2) on program ABI. The 'size' field is used to distinguish compat I/O requests from native I/O requests, and allocate data buffer. - deserialize: for task 1. - func: for task 2. - serialize: for task 3. - orig_cmd: a command of ioctl(2) on native ABI. The 'size' field is used to allocate an alternative buffer.

The handlers are processed in a callback of 'struct file_operations.compat_ioctl'. In this callback, two buffers are allocated/deallocated for safe conversion of layout between program/native ABI.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control_compat.c | 97 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 74 insertions(+), 23 deletions(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index a848836a5de0..dec89717d8e3 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -443,11 +443,25 @@ enum { #endif /* CONFIG_X86_X32 */ };

-static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) +static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, + unsigned long arg) { + static const struct { + unsigned int cmd; + int (*deserialize)(struct snd_ctl_file *ctl_file, void *dst, + void *src); + int (*func)(struct snd_ctl_file *ctl_file, void *buf); + int (*serialize)(struct snd_ctl_file *ctl_file, void *dst, + void *src); + unsigned int orig_cmd; + } handlers[] = { + { 0, NULL, NULL, NULL, 0, }, + }; struct snd_ctl_file *ctl; - struct snd_kctl_ioctl *p; void __user *argp = compat_ptr(arg); + void *buf, *data; + unsigned int size; + int i; int err;

ctl = file->private_data; @@ -455,18 +469,6 @@ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, uns return -ENXIO;

switch (cmd) { - case SNDRV_CTL_IOCTL_PVERSION: - case SNDRV_CTL_IOCTL_CARD_INFO: - case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS: - case SNDRV_CTL_IOCTL_POWER: - case SNDRV_CTL_IOCTL_POWER_STATE: - case SNDRV_CTL_IOCTL_ELEM_LOCK: - case SNDRV_CTL_IOCTL_ELEM_UNLOCK: - case SNDRV_CTL_IOCTL_ELEM_REMOVE: - case SNDRV_CTL_IOCTL_TLV_READ: - case SNDRV_CTL_IOCTL_TLV_WRITE: - case SNDRV_CTL_IOCTL_TLV_COMMAND: - return snd_ctl_ioctl(file, cmd, (unsigned long)argp); case SNDRV_CTL_IOCTL_ELEM_LIST32: return snd_ctl_elem_list_compat(ctl->card, argp); case SNDRV_CTL_IOCTL_ELEM_INFO32: @@ -487,16 +489,65 @@ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, uns #endif /* CONFIG_X86_X32 */ }

- down_read(&snd_ioctl_rwsem); - list_for_each_entry(p, &snd_control_compat_ioctls, list) { - if (p->fioctl) { - err = p->fioctl(ctl->card, ctl, cmd, arg); - if (err != -ENOIOCTLCMD) { - up_read(&snd_ioctl_rwsem); - return err; + for (i = 0; i < ARRAY_SIZE(handlers); ++i) { + if (handlers[i].cmd == cmd) + break; + } + if (i == ARRAY_SIZE(handlers)) { + struct snd_kctl_ioctl *p; + + down_read(&snd_ioctl_rwsem); + list_for_each_entry(p, &snd_control_compat_ioctls, list) { + if (p->fioctl) { + err = p->fioctl(ctl->card, ctl, cmd, arg); + if (err != -ENOIOCTLCMD) { + up_read(&snd_ioctl_rwsem); + return err; + } } } + up_read(&snd_ioctl_rwsem); + + return snd_ctl_ioctl(file, cmd, (unsigned long)compat_ptr(arg)); + } + + /* Allocate a buffer to convert layout of structure for native ABI. */ + buf = kzalloc(_IOC_SIZE(handlers[i].orig_cmd), GFP_KERNEL); + if (!buf) + return -ENOMEM; + + /* Allocate an alternative buffer to copy from/to user space. */ + size = _IOC_SIZE(handlers[i].cmd); + data = kzalloc(size, GFP_KERNEL); + if (!data) { + kfree(buf); + return -ENOMEM; + } + + if (handlers[i].cmd & IOC_IN) { + if (copy_from_user(data, compat_ptr(arg), size)) { + err = -EFAULT; + goto end; + } } - up_read(&snd_ioctl_rwsem); - return -ENOIOCTLCMD; + + err = handlers[i].deserialize(ctl, buf, data); + if (err < 0) + goto end; + + err = handlers[i].func(ctl, buf); + if (err < 0) + goto end; + + err = handlers[i].serialize(ctl, data, buf); + if (err >= 0) { + if (handlers[i].cmd & IOC_OUT) { + if (copy_to_user(compat_ptr(arg), data, size)) + err = -EFAULT; + } + } +end: + kfree(data); + kfree(buf); + return err; }

A 'snd_ctl_elem_info' structure includes a member of 'integer long' type. A machine type for the type is known to have different size and alignment between System V ABIs for architectures which adopts 'ILP32' or 'LP64' data model.

This commit adds a pair of serializer and deserializer to convert data between different layout of the structure on the ABIs.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control_compat.c | 94 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 3bd04ef5d221..7ebae996804a 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -105,6 +105,100 @@ static int serialize_to_elem_list_32(struct snd_ctl_file *ctl_file, void *dst, return 0; }

+/* + * In this structure, '.value' member includes double-word (= 64 bits) member + * ('.integer64'). System V ABI for i386 architecture adopts different byte + * alignment for this type (4 bytes) than the ones in the other architectures + * (8 bytes). Fortunately, the total size of '.id', '.type', '.access', '.count' + * and '.owner' is multiples of 8, and there's no issue for offset of the + * '.value' member. + */ +struct snd_ctl_elem_info_32 { + struct snd_ctl_elem_id id; + s32 type; + u32 access; + u32 count; + s32 owner; + union { + struct { + s32 min; /* long on ILP32. */ + s32 max; /* long on ILP32. */ + s32 step; /* long on ILP32. */ + } integer; + struct { + u64 min; + u64 max; + u64 step; + } integer64; + struct { + u32 items; + u32 item; + s8 name[64]; + u64 names_ptr; + u32 names_length; + } enumerated; + u8 reserved[128]; + } value; + u16 dimen[4]; + u8 reserved[64 - 4 * sizeof(u16)]; +} __packed; + +static int deserialize_from_elem_info_32(struct snd_ctl_file *ctl_file, + void *dst, void *src) +{ + struct snd_ctl_elem_info *data = dst; + struct snd_ctl_elem_info_32 *data32 = src; + + data->id = data32->id; + data->type = data32->type; + data->access = data32->access; + data->count = data32->count; + data->owner = data32->owner; + + if (data->type == SNDRV_CTL_ELEM_TYPE_INTEGER) { + data->value.integer.min = (s64)data32->value.integer.min; + data->value.integer.max = (s64)data32->value.integer.max; + data->value.integer.step = (s64)data32->value.integer.step; + /* Drop the rest of this field. */ + } else { + /* Copy whole space of this field. */ + memcpy(&data->value, &data32->value, sizeof(data->value)); + } + + memcpy(&data->dimen, &data32->dimen, sizeof(data->dimen)); + memcpy(&data->reserved, &data32->reserved, sizeof(data->reserved)); + + return 0; +} + +static int serialize_to_elem_info_32(struct snd_ctl_file *ctl_file, void *dst, + void *src) +{ + struct snd_ctl_elem_info_32 *data32 = dst; + struct snd_ctl_elem_info *data = src; + + data32->id = data->id; + data32->type = data->type; + data32->access = data->access; + data32->count = data->count; + data32->owner = data->owner; + + if (data->type == SNDRV_CTL_ELEM_TYPE_INTEGER) { + data32->value.integer.min = (s32)data->value.integer.min; + data32->value.integer.max = (s32)data->value.integer.max; + data32->value.integer.step = (s32)data->value.integer.step; + /* Drop rest of this field. */ + } else { + /* Copy whole space of this field. */ + memcpy(&data32->value, &data->value, sizeof(data32->value)); + } + + memcpy(&data32->dimen, &data->dimen, sizeof(data32->dimen)); + memcpy(&data32->reserved, &data->reserved, sizeof(data32->reserved)); + + return 0; +} + struct snd_ctl_elem_list32 { u32 offset; u32 space;

A previous commit adds serializer/deserializer of 'snd_ctl_elem_value' structure for System V ABIs to modern 32 bit architectures. However, i386 is an exception because it has 4 bytes alignment for double-word machine type. This brings different 'internal padding' to the structure from the one on ABIs for modern 32 bit architectures.

This commit adds a pair of serializer and deserializer to convert data between different layout of the structure on the ABIs. To describe layout of the structure for i386 ABI on LP64 ABI, bitfield is used for the internal padding, and 'packed' attribute is used as a hint for compilers to native padding convention.

The serializer/deserializer are useless on non-Intel architectures. For this case, '__maybe_unused' is added as a hint to compilers for optimization.

Reference: System V application binary interface Intel386 architecture processor supplenent, draft copy of forth edition (1997, The Santa Cruz Operation, Inc. and AT&T) Reference: System V application binary interface AMD64 architecture processor supplement (with LP64 and ILP32 programming models) draft version 0.99.8 (2017, H.J. Lu, Michael Matz, Milind Girkar, Jan Hubicka, Andreas Jaeger and Mark Mitchell) Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control_compat.c | 89 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 5c0e82afe400..5dfb31a22470 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -308,6 +308,95 @@ static int __maybe_unused serialize_to_elem_value_32( return 0; }

+/* + * Unlikw any System V ABI for 32 bit architecture, ABI for i386 architecture has + * different alignment (4 bytes) for double-word type. Thus offset of '.value' + * member is multiples of 4 bytes. + */ +struct snd_ctl_elem_value_i386 { + struct snd_ctl_elem_id id; + u32 indirect:1; + u32 padding:31; /* For 4 bytes alignment of '.value'. */ + union { + s32 integer[128]; /* long on ILP32. */ + u8 data[512]; + s64 integer64[64]; + } value; + struct { + s32 tv_sec; /* long on ILP32. */ + s32 tv_nsec; /* long on ILP32. */ + } tstamp; + u8 reserved[128 - sizeof(s32) - sizeof(s32)]; +} __packed; + +static int __maybe_unused deserialize_from_elem_value_i386( + struct snd_ctl_file *ctl_file, void *dst, void *src) +{ + struct snd_ctl_elem_value *data = dst; + struct snd_ctl_elem_value_i386 *datai386 = src; + snd_ctl_elem_type_t type; + int err; + + err = get_type(ctl_file, &datai386->id, &type); + if (err < 0) + return err; + + data->id = datai386->id; + data->indirect = datai386->indirect; + + if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || + type == SNDRV_CTL_ELEM_TYPE_INTEGER) { + int i; + for (i = 0; i < 128; ++i) { + data->value.integer.value[i] = + (s64)datai386->value.integer[i]; + } + /* Drop rest of this field. */ + } else { + /* Copy whole space of this field. */ + memcpy(&data->value, &datai386->value, sizeof(data->value)); + } + + data->tstamp.tv_sec = (s64)datai386->tstamp.tv_sec; + data->tstamp.tv_nsec = (s64)datai386->tstamp.tv_nsec; + + return 0; +} + +static int __maybe_unused serialize_to_elem_value_i386( + struct snd_ctl_file *ctl_file, void *dst, void *src) +{ + struct snd_ctl_elem_value_i386 *datai386 = dst; + struct snd_ctl_elem_value *data = src; + snd_ctl_elem_type_t type; + int err; + + err = get_type(ctl_file, &data->id, &type); + if (err < 0) + return err; + + datai386->id = data->id; + datai386->indirect = data->indirect; + + if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || + type == SNDRV_CTL_ELEM_TYPE_INTEGER) { + int i; + for (i = 0; i < 128; ++i) { + datai386->value.integer[i] = + (s32)data->value.integer.value[i]; + } + /* Drop rest of this field. */ + } else { + /* Copy whole space of this field. */ + memcpy(&datai386->value, &data->value, sizeof(datai386->value)); + } + + datai386->tstamp.tv_sec = (s32)data->tstamp.tv_sec; + datai386->tstamp.tv_nsec = (s32)data->tstamp.tv_nsec; + + return 0; +} + struct snd_ctl_elem_list32 { u32 offset; u32 space;

When investigating compatibility layer, several functions for native ABI are called by the layer. A 'snd_ctl_elem_list()' is such a function, while it cannot receive a second argument for data on kernel space. This will bring a future inconvenience in integration of the layer.

This commit adds a helper function to allocate memory object on kernel space for the argument.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control.c | 41 ++++++++++++++++++++++++++++------------- sound/core/control_compat.c | 2 +- 2 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/sound/core/control.c b/sound/core/control.c index 8baee922a400..ad4d27c681c4 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -745,22 +745,19 @@ static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl, }

static int snd_ctl_elem_list(struct snd_ctl_file *ctl_file, - struct snd_ctl_elem_list __user *_list) + struct snd_ctl_elem_list *list) { - struct snd_ctl_elem_list list; struct snd_kcontrol *kctl; struct snd_ctl_elem_id id; unsigned int offset, space, jidx; int err = 0; - if (copy_from_user(&list, _list, sizeof(list))) - return -EFAULT; - offset = list.offset; - space = list.space; + offset = list->offset; + space = list->space;

down_read(&ctl_file->card->controls_rwsem); - list.count = ctl_file->card->controls_count; - list.used = 0; + list->count = ctl_file->card->controls_count; + list->used = 0; if (space > 0) { list_for_each_entry(kctl, &ctl_file->card->controls, list) { if (offset >= kctl->count) { @@ -769,12 +766,12 @@ static int snd_ctl_elem_list(struct snd_ctl_file *ctl_file, } for (jidx = offset; jidx < kctl->count; jidx++) { snd_ctl_build_ioff(&id, kctl, jidx); - if (copy_to_user(list.pids + list.used, &id, + if (copy_to_user(list->pids + list->used, &id, sizeof(id))) { err = -EFAULT; goto out; } - list.used++; + list->used++; if (!--space) goto out; } @@ -783,8 +780,26 @@ static int snd_ctl_elem_list(struct snd_ctl_file *ctl_file, } out: up_read(&ctl_file->card->controls_rwsem); - if (!err && copy_to_user(_list, &list, sizeof(list))) - err = -EFAULT; + return err; +} + +static int snd_ctl_elem_list_user(struct snd_ctl_file *ctl_file, + void __user *arg) +{ + struct snd_ctl_elem_list *list; + int err; + + list = memdup_user(arg, sizeof(*list)); + if (IS_ERR(list)) + return PTR_ERR(list); + + err = snd_ctl_elem_list(ctl_file, list); + if (err >= 0) { + if (copy_to_user(arg, list, sizeof(*list))) + err = -EFAULT; + } + + kfree(list); return err; }

@@ -1552,7 +1567,7 @@ static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg case SNDRV_CTL_IOCTL_CARD_INFO: return snd_ctl_card_info(card, ctl, cmd, argp); case SNDRV_CTL_IOCTL_ELEM_LIST: - return snd_ctl_elem_list(ctl, argp); + return snd_ctl_elem_list_user(ctl, argp); case SNDRV_CTL_IOCTL_ELEM_INFO: return snd_ctl_elem_info_user(ctl, argp); case SNDRV_CTL_IOCTL_ELEM_READ: diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 3594bd41750e..8a4c58c0cf3b 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -422,7 +422,7 @@ static int snd_ctl_elem_list_compat(struct snd_ctl_file *ctl_file, if (get_user(ptr, &data32->pids) || put_user(compat_ptr(ptr), &data->pids)) return -EFAULT; - err = snd_ctl_elem_list(ctl_file, data); + err = snd_ctl_elem_list_user(ctl_file, data); if (err < 0) return err; /* copy the result */

When handling I/O request for ELEM_INFO, 'snd_power_wait()' function is used before a call of 'snd_ctl_elem_info()' function. This is perhaps due to performing I/O operation to actual devices. The same thing is done by helper functions for native/compat ABI, and they can be unified.

This commit moves these duplicated codes into the callee function.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control.c | 7 ++++--- sound/core/control_compat.c | 3 --- 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/sound/core/control.c b/sound/core/control.c index ad4d27c681c4..91966b190b8b 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -842,6 +842,10 @@ static int snd_ctl_elem_info(struct snd_ctl_file *ctl, unsigned int index_offset; int result; + result = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0); + if (result < 0) + return result; + down_read(&card->controls_rwsem); kctl = snd_ctl_find_id(card, &info->id); if (kctl == NULL) { @@ -879,9 +883,6 @@ static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,

if (copy_from_user(&info, _info, sizeof(info))) return -EFAULT; - result = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0); - if (result < 0) - return result; result = snd_ctl_elem_info(ctl, &info); if (result < 0) return result; diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index f0559ed785e0..e6169b2bc6b3 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -489,9 +489,6 @@ static int snd_ctl_elem_info_compat(struct snd_ctl_file *ctl, if (get_user(data->value.enumerated.item, &data32->value.enumerated.item)) goto error;

- err = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0); - if (err < 0) - goto error; err = snd_ctl_elem_info(ctl, data); if (err < 0) goto error;

When handling I/O request for ELEM_WRITE, 'snd_power_wait()' function is used before a call of 'snd_ctl_elem_write()' function. This is perhaps due to performing I/O operation to actual devices. The same thing is done by helper functions for native/compat ABI, and they can be unified.

This commit moves these duplicated codes into the callee function.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control.c | 31 +++++++++++++++---------------- sound/core/control_compat.c | 3 --- 2 files changed, 15 insertions(+), 19 deletions(-)

diff --git a/sound/core/control.c b/sound/core/control.c index 2b5921e9f111..8d158a49467d 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -954,27 +954,33 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, unsigned int index_offset; int result;

- kctl = snd_ctl_find_id(card, &control->id); - if (kctl == NULL) - return -ENOENT; + result = snd_power_wait(file->card, SNDRV_CTL_POWER_D0); + if (result < 0) + return result; + + down_write(&file->card->controls_rwsem); + kctl = snd_ctl_find_id(file->card, &control->id); + if (kctl == NULL) { + result = -ENOENT; + goto end; + }

index_offset = snd_ctl_get_ioff(kctl, &control->id); vd = &kctl->vd[index_offset]; if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL || (file && vd->owner && vd->owner != file)) { - return -EPERM; + result = -EPERM; + goto end; }

snd_ctl_build_ioff(&control->id, kctl, index_offset); result = kctl->put(kctl, control); - if (result < 0) - return result; - if (result > 0) { struct snd_ctl_elem_id id = control->id; - snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id); + snd_ctl_notify(file->card, SNDRV_CTL_EVENT_MASK_VALUE, &id); } - +end: + up_write(&file->card->controls_rwsem); return 0; }

@@ -989,14 +995,7 @@ static int snd_ctl_elem_write_user(struct snd_ctl_file *file, if (IS_ERR(control)) return PTR_ERR(control);

- card = file->card; - result = snd_power_wait(card, SNDRV_CTL_POWER_D0); - if (result < 0) - goto error; - - down_write(&card->controls_rwsem); result = snd_ctl_elem_write(card, file, control); - up_write(&card->controls_rwsem); if (result < 0) goto error;

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index b887cda28d30..b3f0be74ba0f 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -713,9 +713,6 @@ static int ctl_elem_write_user(struct snd_ctl_file *file, if (err < 0) goto error;

- err = snd_power_wait(card, SNDRV_CTL_POWER_D0); - if (err < 0) - goto error; err = snd_ctl_elem_write(card, file, data); if (err < 0) goto error;

When investigating compatibility layer, several functions for native ABI are called by the layer. A 'snd_ctl_elem_write()' is such a function, while it's prototype is not similar to the others. This will bring a future inconvenience in integration of the layer.

This commit changes its prototype to get a first argument for data of 'struct snd_ctl_file' type.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control.c | 19 +++++++++---------- sound/core/control_compat.c | 6 +++--- 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/sound/core/control.c b/sound/core/control.c index 4cb950e310bf..c7b43f3f069b 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -949,7 +949,7 @@ static int snd_ctl_elem_read_user(struct snd_card *card, return result; }

-static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, +static int snd_ctl_elem_write(struct snd_ctl_file *ctl_file, struct snd_ctl_elem_value *control) { struct snd_kcontrol *kctl; @@ -957,12 +957,12 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, unsigned int index_offset; int result;

- result = snd_power_wait(file->card, SNDRV_CTL_POWER_D0); + result = snd_power_wait(ctl_file->card, SNDRV_CTL_POWER_D0); if (result < 0) return result;

- down_write(&file->card->controls_rwsem); - kctl = snd_ctl_find_id(file->card, &control->id); + down_write(&ctl_file->card->controls_rwsem); + kctl = snd_ctl_find_id(ctl_file->card, &control->id); if (kctl == NULL) { result = -ENOENT; goto end; @@ -971,7 +971,7 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, index_offset = snd_ctl_get_ioff(kctl, &control->id); vd = &kctl->vd[index_offset]; if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_WRITE) || kctl->put == NULL || - (file && vd->owner && vd->owner != file)) { + (ctl_file && vd->owner && vd->owner != ctl_file)) { result = -EPERM; goto end; } @@ -980,25 +980,24 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, result = kctl->put(kctl, control); if (result > 0) { struct snd_ctl_elem_id id = control->id; - snd_ctl_notify(file->card, SNDRV_CTL_EVENT_MASK_VALUE, &id); + snd_ctl_notify(ctl_file->card, SNDRV_CTL_EVENT_MASK_VALUE, &id); } end: - up_write(&file->card->controls_rwsem); + up_write(&ctl_file->card->controls_rwsem); return 0; }

-static int snd_ctl_elem_write_user(struct snd_ctl_file *file, +static int snd_ctl_elem_write_user(struct snd_ctl_file *ctl_file, struct snd_ctl_elem_value __user *_control) { struct snd_ctl_elem_value *control; - struct snd_card *card; int result;

control = memdup_user(_control, sizeof(*control)); if (IS_ERR(control)) return PTR_ERR(control);

- result = snd_ctl_elem_write(card, file, control); + result = snd_ctl_elem_write(ctl_file, control); if (result < 0) goto error;

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index b3f0be74ba0f..11e0966f86bb 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -697,11 +697,11 @@ static int ctl_elem_read_user(struct snd_card *card, return err; }

-static int ctl_elem_write_user(struct snd_ctl_file *file, +static int ctl_elem_write_user(struct snd_ctl_file *ctl_file, void __user *userdata, void __user *valuep) { struct snd_ctl_elem_value *data; - struct snd_card *card = file->card; + struct snd_card *card = ctl_file->card; int err, type, count;

data = kzalloc(sizeof(*data), GFP_KERNEL); @@ -713,7 +713,7 @@ static int ctl_elem_write_user(struct snd_ctl_file *file, if (err < 0) goto error;

- err = snd_ctl_elem_write(card, file, data); + err = snd_ctl_elem_write(ctl_file, data); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count);

In current implementation, for I/O request of ELEM_ADD/ELEM_REPLACE, kernel stack is used to copy 'struct snd_ctl_elem_info' data. However, the size of this structure is a bit big and usage of kernel stack is not preferable.

This commit allocates a memory object on kernel space, instead.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/sound/core/control.c b/sound/core/control.c index 268771ed2939..a321576a6308 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1405,23 +1405,26 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, return 0; }

-static int snd_ctl_elem_add_user(struct snd_ctl_file *file, - struct snd_ctl_elem_info __user *_info, int replace) +static int snd_ctl_elem_add_user(struct snd_ctl_file *ctl_file, + void __user *arg, int replace) { - struct snd_ctl_elem_info info; + struct snd_ctl_elem_info *info; int err;

- if (copy_from_user(&info, _info, sizeof(info))) - return -EFAULT; - err = snd_ctl_elem_add(file, &info, replace); - if (err < 0) - return err; - if (copy_to_user(_info, &info, sizeof(info))) { - snd_ctl_remove_user_ctl(file, &info.id); - return -EFAULT; + info = memdup_user(arg, sizeof(*info)); + if (IS_ERR(info)) + return PTR_ERR(info); + + err = snd_ctl_elem_add(ctl_file, info, replace); + if (err >= 0) { + if (copy_to_user(arg, info, sizeof(*info))) { + snd_ctl_remove_user_ctl(ctl_file, &info->id); + err = -EFAULT; + } }

- return 0; + kfree(info); + return err; }

static int snd_ctl_elem_remove(struct snd_ctl_file *file,

A previous commit adds a helper function for replacement processing. This commit do actual separation from a helper function for addition.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control.c | 34 +++++++++++++++++++++++----------- sound/core/control_compat.c | 5 ++++- 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/sound/core/control.c b/sound/core/control.c index 9e23f84d284d..0aa1f22dcac2 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1256,7 +1256,7 @@ static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol) }

static int snd_ctl_elem_add(struct snd_ctl_file *file, - struct snd_ctl_elem_info *info, int replace) + struct snd_ctl_elem_info *info) { /* The capacity of struct snd_ctl_elem_value.value.*/ static const unsigned int value_sizes[] = { @@ -1289,14 +1289,6 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name)) return -EINVAL;

- /* Delete a control to replace them if needed. */ - if (replace) { - info->id.numid = 0; - err = snd_ctl_remove_user_ctl(file, &info->id); - if (err) - return err; - } - /* * The number of userspace controls are counted control by control, * not element by element. @@ -1415,7 +1407,7 @@ static int snd_ctl_elem_add_user(struct snd_ctl_file *ctl_file, if (IS_ERR(info)) return PTR_ERR(info);

- err = snd_ctl_elem_add(ctl_file, info, 0); + err = snd_ctl_elem_add(ctl_file, info); if (err >= 0) { if (copy_to_user(arg, info, sizeof(*info))) { snd_ctl_remove_user_ctl(ctl_file, &info->id); @@ -1427,6 +1419,26 @@ static int snd_ctl_elem_add_user(struct snd_ctl_file *ctl_file, return err; }

+static int snd_ctl_elem_replace(struct snd_ctl_file *ctl_file, + struct snd_ctl_elem_info *info) +{ + int err; + + if (!*info->id.name) + return -EINVAL; + if (strnlen(info->id.name, sizeof(info->id.name)) >= + sizeof(info->id.name)) + return -EINVAL; + + /* Delete an element set to replace them. */ + info->id.numid = 0; + err = snd_ctl_remove_user_ctl(ctl_file, &info->id); + if (err < 0) + return err; + + return snd_ctl_elem_add(ctl_file, info); +} + static int snd_ctl_elem_replace_user(struct snd_ctl_file *ctl_file, void __user *arg) { @@ -1437,7 +1449,7 @@ static int snd_ctl_elem_replace_user(struct snd_ctl_file *ctl_file, if (IS_ERR(info)) return PTR_ERR(info);

- err = snd_ctl_elem_add(ctl_file, info, 1); + err = snd_ctl_elem_replace(ctl_file, info); if (err >= 0) { if (copy_to_user(arg, info, sizeof(*info))) { snd_ctl_remove_user_ctl(ctl_file, &info->id); diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index d6d1a2bf9542..1cfacea867b6 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -792,7 +792,10 @@ static int snd_ctl_elem_add_compat(struct snd_ctl_file *file, default: break; } - err = snd_ctl_elem_add(file, data, replace); + if (!replace) + err = snd_ctl_elem_add(file, data); + else + err = snd_ctl_elem_replace(file, data); error: kfree(data); return err;

This commit obsoletes old implementation for compat ELEM_INFO operation with a renewal way.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control_compat.c | 80 ++++++++++----------------------------------- 1 file changed, 17 insertions(+), 63 deletions(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 427158b39f5a..499cc459917f 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -431,66 +431,6 @@ struct snd_ctl_elem_info32 { unsigned char reserved[64]; } __attribute__((packed));

-static int snd_ctl_elem_info_compat(struct snd_ctl_file *ctl, - struct snd_ctl_elem_info32 __user *data32) -{ - struct snd_ctl_elem_info *data; - int err; - - data = kzalloc(sizeof(*data), GFP_KERNEL); - if (! data) - return -ENOMEM; - - err = -EFAULT; - /* copy id */ - if (copy_from_user(&data->id, &data32->id, sizeof(data->id))) - goto error; - /* we need to copy the item index. - * hope this doesn't break anything.. - */ - if (get_user(data->value.enumerated.item, &data32->value.enumerated.item)) - goto error; - - err = snd_ctl_elem_info(ctl, data); - if (err < 0) - goto error; - /* restore info to 32bit */ - err = -EFAULT; - /* id, type, access, count */ - if (copy_to_user(&data32->id, &data->id, sizeof(data->id)) || - copy_to_user(&data32->type, &data->type, 3 * sizeof(u32))) - goto error; - if (put_user(data->owner, &data32->owner)) - goto error; - switch (data->type) { - case SNDRV_CTL_ELEM_TYPE_BOOLEAN: - case SNDRV_CTL_ELEM_TYPE_INTEGER: - if (put_user(data->value.integer.min, &data32->value.integer.min) || - put_user(data->value.integer.max, &data32->value.integer.max) || - put_user(data->value.integer.step, &data32->value.integer.step)) - goto error; - break; - case SNDRV_CTL_ELEM_TYPE_INTEGER64: - if (copy_to_user(&data32->value.integer64, - &data->value.integer64, - sizeof(data->value.integer64))) - goto error; - break; - case SNDRV_CTL_ELEM_TYPE_ENUMERATED: - if (copy_to_user(&data32->value.enumerated, - &data->value.enumerated, - sizeof(data->value.enumerated))) - goto error; - break; - default: - break; - } - err = 0; - error: - kfree(data); - return err; -} - /* read / write */ struct snd_ctl_elem_value32 { struct snd_ctl_elem_id id; @@ -771,10 +711,19 @@ static int ctl_compat_ioctl_elem_list_32(struct snd_ctl_file *ctl_file, return snd_ctl_elem_list(ctl_file, list); }

+static int ctl_compat_ioctl_elem_info_32(struct snd_ctl_file *ctl_file, + void *buf) +{ + struct snd_ctl_elem_info *info = buf; + + return snd_ctl_elem_info(ctl_file, info); +} + enum { SNDRV_CTL_IOCTL_ELEM_LIST_32 = _IOWR('U', 0x10, struct snd_ctl_elem_list_32), - SNDRV_CTL_IOCTL_ELEM_INFO32 = _IOWR('U', 0x11, struct snd_ctl_elem_info32), + SNDRV_CTL_IOCTL_ELEM_INFO_32 = + _IOWR('U', 0x11, struct snd_ctl_elem_info_32), SNDRV_CTL_IOCTL_ELEM_READ32 = _IOWR('U', 0x12, struct snd_ctl_elem_value32), SNDRV_CTL_IOCTL_ELEM_WRITE32 = _IOWR('U', 0x13, struct snd_ctl_elem_value32), SNDRV_CTL_IOCTL_ELEM_ADD32 = _IOWR('U', 0x17, struct snd_ctl_elem_info32), @@ -804,6 +753,13 @@ static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, serialize_to_elem_list_32, SNDRV_CTL_IOCTL_ELEM_LIST, }, + { + SNDRV_CTL_IOCTL_ELEM_INFO_32, + deserialize_from_elem_info_32, + ctl_compat_ioctl_elem_info_32, + serialize_to_elem_info_32, + SNDRV_CTL_IOCTL_ELEM_INFO, + }, }; struct snd_ctl_file *ctl; void __user *argp = compat_ptr(arg); @@ -817,8 +773,6 @@ static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, return -ENXIO;

switch (cmd) { - case SNDRV_CTL_IOCTL_ELEM_INFO32: - return snd_ctl_elem_info_compat(ctl, argp); case SNDRV_CTL_IOCTL_ELEM_READ32: return snd_ctl_elem_read_user_compat(ctl, argp); case SNDRV_CTL_IOCTL_ELEM_WRITE32:

This commit obsoletes old implementation for compat ELEM_REPLACE operation with a renewal way.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control_compat.c | 111 ++++++++------------------------------------ 1 file changed, 19 insertions(+), 92 deletions(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 8e2617c6217e..2982423dccd0 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -397,40 +397,6 @@ static int __maybe_unused serialize_to_elem_value_i386( return 0; }

-/* - * control element info - * it uses union, so the things are not easy.. - */ - -struct snd_ctl_elem_info32 { - struct snd_ctl_elem_id id; // the size of struct is same - s32 type; - u32 access; - u32 count; - s32 owner; - union { - struct { - s32 min; - s32 max; - s32 step; - } integer; - struct { - u64 min; - u64 max; - u64 step; - } integer64; - struct { - u32 items; - u32 item; - char name[64]; - u64 names_ptr; - u32 names_length; - } enumerated; - unsigned char reserved[128]; - } value; - unsigned char reserved[64]; -} __attribute__((packed)); - /* read / write */ struct snd_ctl_elem_value32 { struct snd_ctl_elem_id id; @@ -649,60 +615,6 @@ static int snd_ctl_elem_write_user_x32(struct snd_ctl_file *file, } #endif /* CONFIG_X86_X32 */

-/* add or replace a user control */ -static int snd_ctl_elem_add_compat(struct snd_ctl_file *file, - struct snd_ctl_elem_info32 __user *data32, - int replace) -{ - struct snd_ctl_elem_info *data; - int err; - - data = kzalloc(sizeof(*data), GFP_KERNEL); - if (! data) - return -ENOMEM; - - err = -EFAULT; - /* id, type, access, count */ \ - if (copy_from_user(&data->id, &data32->id, sizeof(data->id)) || - copy_from_user(&data->type, &data32->type, 3 * sizeof(u32))) - goto error; - if (get_user(data->owner, &data32->owner) || - get_user(data->type, &data32->type)) - goto error; - switch (data->type) { - case SNDRV_CTL_ELEM_TYPE_BOOLEAN: - case SNDRV_CTL_ELEM_TYPE_INTEGER: - if (get_user(data->value.integer.min, &data32->value.integer.min) || - get_user(data->value.integer.max, &data32->value.integer.max) || - get_user(data->value.integer.step, &data32->value.integer.step)) - goto error; - break; - case SNDRV_CTL_ELEM_TYPE_INTEGER64: - if (copy_from_user(&data->value.integer64, - &data32->value.integer64, - sizeof(data->value.integer64))) - goto error; - break; - case SNDRV_CTL_ELEM_TYPE_ENUMERATED: - if (copy_from_user(&data->value.enumerated, - &data32->value.enumerated, - sizeof(data->value.enumerated))) - goto error; - data->value.enumerated.names_ptr = - (uintptr_t)compat_ptr(data->value.enumerated.names_ptr); - break; - default: - break; - } - if (!replace) - err = snd_ctl_elem_add(file, data); - else - err = snd_ctl_elem_replace(file, data); - error: - kfree(data); - return err; -} - static int ctl_compat_ioctl_elem_list_32(struct snd_ctl_file *ctl_file, void *buf) { @@ -727,6 +639,14 @@ static int ctl_compat_ioctl_elem_add_32(struct snd_ctl_file *ctl_file, return snd_ctl_elem_add(ctl_file, info); }

+static int ctl_compat_ioctl_elem_replace_32(struct snd_ctl_file *ctl_file, + void *buf) +{ + struct snd_ctl_elem_info *info = buf; + + return snd_ctl_elem_replace(ctl_file, info); +} + enum { SNDRV_CTL_IOCTL_ELEM_LIST_32 = _IOWR('U', 0x10, struct snd_ctl_elem_list_32), @@ -736,7 +656,8 @@ enum { SNDRV_CTL_IOCTL_ELEM_WRITE32 = _IOWR('U', 0x13, struct snd_ctl_elem_value32), SNDRV_CTL_IOCTL_ELEM_ADD_32 = _IOWR('U', 0x17, struct snd_ctl_elem_info_32), - SNDRV_CTL_IOCTL_ELEM_REPLACE32 = _IOWR('U', 0x18, struct snd_ctl_elem_info32), + SNDRV_CTL_IOCTL_ELEM_REPLACE_32 = + _IOWR('U', 0x18, struct snd_ctl_elem_info_32), #ifdef CONFIG_X86_X32 SNDRV_CTL_IOCTL_ELEM_READ_X32 = _IOWR('U', 0x12, struct snd_ctl_elem_value_x32), SNDRV_CTL_IOCTL_ELEM_WRITE_X32 = _IOWR('U', 0x13, struct snd_ctl_elem_value_x32), @@ -776,6 +697,13 @@ static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, serialize_to_elem_info_32, SNDRV_CTL_IOCTL_ELEM_ADD, }, + { + SNDRV_CTL_IOCTL_ELEM_REPLACE_32, + deserialize_from_elem_info_32, + ctl_compat_ioctl_elem_replace_32, + serialize_to_elem_info_32, + SNDRV_CTL_IOCTL_ELEM_REPLACE, + }, }; struct snd_ctl_file *ctl; void __user *argp = compat_ptr(arg); @@ -793,8 +721,6 @@ static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, return snd_ctl_elem_read_user_compat(ctl, argp); case SNDRV_CTL_IOCTL_ELEM_WRITE32: return snd_ctl_elem_write_user_compat(ctl, argp); - case SNDRV_CTL_IOCTL_ELEM_REPLACE32: - return snd_ctl_elem_add_compat(ctl, argp, 1); #ifdef CONFIG_X86_X32 case SNDRV_CTL_IOCTL_ELEM_READ_X32: return snd_ctl_elem_read_user_x32(ctl, argp); @@ -862,7 +788,8 @@ static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, }

if (err < 0) { - if (cmd == SNDRV_CTL_IOCTL_ELEM_ADD_32) { + if (cmd == SNDRV_CTL_IOCTL_ELEM_ADD_32 || + cmd == SNDRV_CTL_IOCTL_ELEM_REPLACE_32) { struct snd_ctl_elem_info *info = buf; snd_ctl_remove_user_ctl(ctl, &info->id); }

This commit obsoletes old implementation for compat ELEM_READ/ELEM_WRITE operation for modern 32 bit ABI with a renewal way.

Signed-off-by: Takashi Sakamoto o-takashi@sakamocchi.jp --- sound/core/control_compat.c | 218 ++++---------------------------------------- 1 file changed, 20 insertions(+), 198 deletions(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 430f178aa4d8..bbda8eabf18f 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -397,194 +397,6 @@ static int __maybe_unused serialize_to_elem_value_i386( return 0; }

-/* read / write */ -struct snd_ctl_elem_value32 { - struct snd_ctl_elem_id id; - unsigned int indirect; /* bit-field causes misalignment */ - union { - s32 integer[128]; - unsigned char data[512]; - s64 integer64[64]; - } value; - unsigned char reserved[128]; -}; - -/* get the value type and count of the control */ -static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id, - int *countp) -{ - struct snd_kcontrol *kctl; - struct snd_ctl_elem_info *info; - int err; - - down_read(&card->controls_rwsem); - kctl = snd_ctl_find_id(card, id); - if (! kctl) { - up_read(&card->controls_rwsem); - return -ENOENT; - } - info = kzalloc(sizeof(*info), GFP_KERNEL); - if (info == NULL) { - up_read(&card->controls_rwsem); - return -ENOMEM; - } - info->id = *id; - err = kctl->info(kctl, info); - up_read(&card->controls_rwsem); - if (err >= 0) { - err = info->type; - *countp = info->count; - } - kfree(info); - return err; -} - -static int get_elem_size(int type, int count) -{ - switch (type) { - case SNDRV_CTL_ELEM_TYPE_INTEGER64: - return sizeof(s64) * count; - case SNDRV_CTL_ELEM_TYPE_ENUMERATED: - return sizeof(int) * count; - case SNDRV_CTL_ELEM_TYPE_BYTES: - return 512; - case SNDRV_CTL_ELEM_TYPE_IEC958: - return sizeof(struct snd_aes_iec958); - default: - return -1; - } -} - -static int copy_ctl_value_from_user(struct snd_card *card, - struct snd_ctl_elem_value *data, - void __user *userdata, - void __user *valuep, - int *typep, int *countp) -{ - struct snd_ctl_elem_value32 __user *data32 = userdata; - int i, type, size; - int uninitialized_var(count); - unsigned int indirect; - - if (copy_from_user(&data->id, &data32->id, sizeof(data->id))) - return -EFAULT; - if (get_user(indirect, &data32->indirect)) - return -EFAULT; - if (indirect) - return -EINVAL; - type = get_ctl_type(card, &data->id, &count); - if (type < 0) - return type; - - if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || - type == SNDRV_CTL_ELEM_TYPE_INTEGER) { - for (i = 0; i < count; i++) { - s32 __user *intp = valuep; - int val; - if (get_user(val, &intp[i])) - return -EFAULT; - data->value.integer.value[i] = val; - } - } else { - size = get_elem_size(type, count); - if (size < 0) { - dev_err(card->dev, "snd_ioctl32_ctl_elem_value: unknown type %d\n", type); - return -EINVAL; - } - if (copy_from_user(data->value.bytes.data, valuep, size)) - return -EFAULT; - } - - *typep = type; - *countp = count; - return 0; -} - -/* restore the value to 32bit */ -static int copy_ctl_value_to_user(void __user *userdata, - void __user *valuep, - struct snd_ctl_elem_value *data, - int type, int count) -{ - int i, size; - - if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || - type == SNDRV_CTL_ELEM_TYPE_INTEGER) { - for (i = 0; i < count; i++) { - s32 __user *intp = valuep; - int val; - val = data->value.integer.value[i]; - if (put_user(val, &intp[i])) - return -EFAULT; - } - } else { - size = get_elem_size(type, count); - if (copy_to_user(valuep, data->value.bytes.data, size)) - return -EFAULT; - } - return 0; -} - -static int ctl_elem_read_user(struct snd_ctl_file *ctl_file, - void __user *userdata, void __user *valuep) -{ - struct snd_ctl_elem_value *data; - int err, type, count; - - data = kzalloc(sizeof(*data), GFP_KERNEL); - if (data == NULL) - return -ENOMEM; - - err = copy_ctl_value_from_user(ctl_file->card, data, userdata, valuep, - &type, &count); - if (err < 0) - goto error; - - err = snd_ctl_elem_read(ctl_file, data); - if (err < 0) - goto error; - err = copy_ctl_value_to_user(userdata, valuep, data, type, count); - error: - kfree(data); - return err; -} - -static int ctl_elem_write_user(struct snd_ctl_file *ctl_file, - void __user *userdata, void __user *valuep) -{ - struct snd_ctl_elem_value *data; - int err, type, count; - - data = kzalloc(sizeof(*data), GFP_KERNEL); - if (data == NULL) - return -ENOMEM; - - err = copy_ctl_value_from_user(ctl_file->card, data, userdata, valuep, - &type, &count); - if (err < 0) - goto error; - - err = snd_ctl_elem_write(ctl_file, data); - if (err < 0) - goto error; - err = copy_ctl_value_to_user(userdata, valuep, data, type, count); - error: - kfree(data); - return err; -} - -static int snd_ctl_elem_read_user_compat(struct snd_ctl_file *ctl_file, - struct snd_ctl_elem_value32 __user *data32) -{ - return ctl_elem_read_user(ctl_file, data32, &data32->value); -} - -static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, - struct snd_ctl_elem_value32 __user *data32) -{ - return ctl_elem_write_user(file, data32, &data32->value); -} - static int ctl_compat_ioctl_elem_list_32(struct snd_ctl_file *ctl_file, void *buf) { @@ -638,12 +450,14 @@ enum { _IOWR('U', 0x10, struct snd_ctl_elem_list_32), SNDRV_CTL_IOCTL_ELEM_INFO_32 = _IOWR('U', 0x11, struct snd_ctl_elem_info_32), - SNDRV_CTL_IOCTL_ELEM_READ32 = _IOWR('U', 0x12, struct snd_ctl_elem_value32), - SNDRV_CTL_IOCTL_ELEM_WRITE32 = _IOWR('U', 0x13, struct snd_ctl_elem_value32), SNDRV_CTL_IOCTL_ELEM_ADD_32 = _IOWR('U', 0x17, struct snd_ctl_elem_info_32), SNDRV_CTL_IOCTL_ELEM_REPLACE_32 = _IOWR('U', 0x18, struct snd_ctl_elem_info_32), + SNDRV_CTL_IOCTL_ELEM_READ_32 = + _IOWR('U', 0x12, struct snd_ctl_elem_value_32), + SNDRV_CTL_IOCTL_ELEM_WRITE_32 = + _IOWR('U', 0x13, struct snd_ctl_elem_value_32), SNDRV_CTL_IOCTL_ELEM_READ_I386 = _IOWR('U', 0x12, struct snd_ctl_elem_value_i386), SNDRV_CTL_IOCTL_ELEM_WRITE_I386 = @@ -690,6 +504,22 @@ static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, serialize_to_elem_info_32, SNDRV_CTL_IOCTL_ELEM_REPLACE, }, +#if !defined(CONFIG_X86_64) || defined(CONFIG_X86_X32) + { + SNDRV_CTL_IOCTL_ELEM_READ_32, + deserialize_from_elem_value_32, + ctl_compat_ioctl_elem_read_32, + serialize_to_elem_value_32, + SNDRV_CTL_IOCTL_ELEM_READ, + }, + { + SNDRV_CTL_IOCTL_ELEM_WRITE_32, + deserialize_from_elem_value_32, + ctl_compat_ioctl_elem_write_32, + serialize_to_elem_value_32, + SNDRV_CTL_IOCTL_ELEM_WRITE, + }, +#endif #ifdef CONFIG_X86_64 { SNDRV_CTL_IOCTL_ELEM_READ_I386, @@ -708,7 +538,6 @@ static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, #endif }; struct snd_ctl_file *ctl; - void __user *argp = compat_ptr(arg); void *buf, *data; unsigned int size; int i; @@ -718,13 +547,6 @@ static long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, if (snd_BUG_ON(!ctl || !ctl->card)) return -ENXIO;

- switch (cmd) { - case SNDRV_CTL_IOCTL_ELEM_READ32: - return snd_ctl_elem_read_user_compat(ctl, argp); - case SNDRV_CTL_IOCTL_ELEM_WRITE32: - return snd_ctl_elem_write_user_compat(ctl, argp); - } - for (i = 0; i < ARRAY_SIZE(handlers); ++i) { if (handlers[i].cmd == cmd) break;