Fix sparse warnings about PCM format assignment regarding the strong
typed snd_pcm_format_t:
  sound/drivers/aloop.c:352:45: warning: restricted snd_pcm_format_t degrades to integer
  sound/drivers/aloop.c:355:39: warning: incorrect type in assignment (different base types)
  sound/drivers/aloop.c:355:39:    expected unsigned int format
  sound/drivers/aloop.c:355:39:    got restricted snd_pcm_format_t [usertype] format
  sound/drivers/aloop.c:1435:34: warning: incorrect type in assignment (different base types)
  sound/drivers/aloop.c:1435:34:    expected long max
  sound/drivers/aloop.c:1435:34:    got restricted snd_pcm_format_t [usertype]
  sound/drivers/aloop.c:1565:39: warning: incorrect type in assignment (different base types)
  sound/drivers/aloop.c:1565:39:    expected unsigned int format
  sound/drivers/aloop.c:1565:39:    got restricted snd_pcm_format_t [usertype]

Some code in this driver assigns an integer value to snd_pcm_format_t
via control API, and they need to be with the explicit cast.

No functional changes, just sparse warning fixes.

Link: https://lore.kernel.org/r/20200206163945.6797-2-tiwai@suse.deSigned-off-by: NTakashi Iwai <tiwai@suse.de>

Most of snd_kcontrol_new definitions are read-only and passed as-is.
Let's declare them as const for further optimization.
Constify snd_kcontrol_new items

There should be no functional changes by this patch.

Link: https://lore.kernel.org/r/20200103081714.9560-34-tiwai@suse.deSigned-off-by: NTakashi Iwai <tiwai@suse.de>

Since timespec is not year 2038 safe on 32bit system, and we need to
convert all timespec variables to timespec64 type for sound subsystem.

This patch is used to do preparation for following patches, that will
convert all structures defined in uapi/sound/asound.h to use 64-bit
time_t.
Signed-off-by: NBaolin Wang <baolin.wang@linaro.org>
Signed-off-by: NArnd Bergmann <arnd@arndb.de>

PCM core deals the empty ioctl field now as default(*).
Let's kill the redundant lines.

(*) commit fc033cbf ("ALSA: pcm: Allow NULL ioctl ops")

Link: https://lore.kernel.org/r/20191210061145.24641-5-tiwai@suse.deSigned-off-by: NTakashi Iwai <tiwai@suse.de>

Clean up the driver with the new managed buffer allocation API.
The hw_params callback became superfluous and got dropped.

Link: https://lore.kernel.org/r/20191209094943.14984-5-tiwai@suse.deSigned-off-by: NTakashi Iwai <tiwai@suse.de>

Static analysis tools (cppcheck and PVS Studio) report an error
in loopback_snd_timer_period_elapsed() regarding dpcm_play pointer
dereference earlier than its null-check. And although this is a result
of a formal check, and the pointer correctness is also protected
by having a corresponding bit set in the "running" mask, re-ordering
of the lines can imake the code even formally correct and eliminate
those static analysis error reports.

Fixes: 26c53379 ("ALSA: aloop: Support selection of snd_timer instead of jiffies")
Reported-by: NEugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191127110622.26105-1-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

loopback_snd_timer_close_cable() function waits until all
scheduled tasklets are completed, but the timer is closed after that
and can generate more event callbacks, scheduling new tasklets,
that will not be synchronized with cable closing.
Move tasklet_kill() call to be executed after snd_timer_close()
call to avoid such case.

Fixes: 26c53379 ("ALSA: aloop: Support selection of snd_timer instead of jiffies")
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191122175218.17187-2-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

loopback_parse_timer_id() uses snd_card_ref(), that can lock on mutex,
also snd_timer_instance_new() uses non-atomic allocation, that can sleep.
So, both functions can not be called from loopback_snd_timer_open()
with cable->lock spinlock locked.

Moreover, most part of loopback_snd_timer_open() function body works
when the opposite stream of the same cable does not yet exist, and
the current stream is not yet completely open and can't be running,
so existing locking of loopback->cable_lock mutex is enough to protect
from conflicts with simultaneous opening or closing.
Locking of cable->lock spinlock is not needed in this case.

Fixes: 26c53379 ("ALSA: aloop: Support selection of snd_timer instead of jiffies")
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191122175218.17187-1-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

Show and change sound card timer source with read-write info
file in proc filesystem. Initial string can still be set as
module parameter.

The timer source string value can be changed at any time,
but it is latched by PCM substream open callback (the first one
for a particular cable). At this point it is actually used, that
is the string is parsed, and the timer is looked up and opened.

The timer source is set for a loopback card (the same as initial
setting by module parameter), but every cable uses the value,
current at the moment of open.

Setting the value to empty string switches the timer to jiffies.
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191120174955.6410-8-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

to do synchronous audio forwarding between hardware sound card and aloop
devices. Such an audio route could look like the following:
Sound card -> Loopback application -> ALSA loop device -> arecord

In this case the loopback device should use the sound timer of the sound
card. Without this patch the loopback application has to implement an
adaptive sample rate converter to align the different clocks of the
different ALSA devices.

The used timer can be selected by referring to a sound card, its device
and subdevice, when loading the module:
  $ modprobe snd_aloop enable=1 timer_source=[<card>[.<dev>[.<subdev>]]]
<card> is the name (id) of the sound card or a card number.
<dev> and <subdev> are device and subdevice numbers (defaults are 0).
Empty string as a value of timer_source= parameter enables previous
functionality (using jiffies timer).
Signed-off-by: NTimo Wischer <twischer@de.adit-jv.com>
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191120174955.6410-7-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

so all functions can use the same.
Signed-off-by: NTimo Wischer <twischer@de.adit-jv.com>
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191120174955.6410-6-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

This commit does not change the behaviour. It only separates the jiffies
timer specific implementation from the generic part.
Signed-off-by: NTimo Wischer <twischer@de.adit-jv.com>
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191120174955.6410-5-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

This commit only refactors the implementation. It does not change the
behaviour.
It is required to support other timers (e.g sound timer).
Signed-off-by: NTimo Wischer <twischer@de.adit-jv.com>
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191120174955.6410-4-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

This is required for additional timer implementations which could detect
errors and want to throw them.
Signed-off-by: NTimo Wischer <twischer@de.adit-jv.com>
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191120174955.6410-3-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

Describe the unit of the variables used to calculate the hw pointer
depending on jiffies ticks.
Signed-off-by: NTimo Wischer <twischer@de.adit-jv.com>
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Link: https://lore.kernel.org/r/20191120174955.6410-2-andrew_gabbasov@mentor.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page
                  mapping in the default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-10-tiwai@suse.deSigned-off-by: NTakashi Iwai <tiwai@suse.de>

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version this program is distributed in the
  hope that it will be useful but without any warranty without even
  the implied warranty of merchantability or fitness for a particular
  purpose see the gnu general public license for more details you
  should have received a copy of the gnu general public license along
  with this program if not write to the free software foundation inc
  59 temple place suite 330 boston ma 02111 1307 usa

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 1334 file(s).
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Reviewed-by: NAllison Randal <allison@lohutok.net>
Reviewed-by: NRichard Fontana <rfontana@redhat.com>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.deSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently snd_aloop supports only S16 and S32 audio sample formats. With
this patch the S24 formats are also supported.
Signed-off-by: NTimo Wischer <twischer@de.adit-jv.com>
Reviewed-by: NJaroslav Kysela <perex@perex.cz>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Simplify the proc fs creation code with new helper functions,
snd_card_ro_proc_new() and snd_card_rw_proc_new().
Just a code refactoring and no functional changes.
Reviewed-by: NJaroslav Kysela <perex@perex.cz>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The call of snd_pcm_suspend_all() & co became superfluous since we
call it in the PCM PM ops.  Let's remove them.
Reviewed-by: NJaroslav Kysela <perex@perex.cz>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

snd_pcm_lib_mmap_vmalloc() was supposed to be implemented with
somewhat special for vmalloc handling, but in the end, this turned to
just the default handler, i.e. NULL.  As the situation has never
changed over decades, let's rip it off.
Reviewed-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The PCM ops defined for playback and capture are identical.  Just use
the single one for both.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Some control API callbacks in aloop driver are too lazy to take the
loopback->cable_lock and it results in possible races of cable access
while it's being freed.  It eventually lead to a UAF, as reported by
fuzzer recently.

This patch covers such control API callbacks and add the proper mutex
locks.
Reported-by: NDaeRyong Jeong <threeearcat@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Show paused ALSA aloop device as inactive, i.e. the control
"PCM Slave Active" set as false. Notification sent upon state change.

This makes it possible for client capturing from aloop device to know if
data is expected. Without it the client expects data even if playback
is paused.
Signed-off-by: NRobert Rosengren <robert.rosengren@axis.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

In loopback_open() and loopback_close(), we assign and release the
substream object to the corresponding cable in a racy way.  It's
neither locked nor done in the right position.  The open callback
assigns the substream before its preparation finishes, hence the other
side of the cable may pick it up, which may lead to the invalid memory
access.

This patch addresses these: move the assignment to the end of the open
callback, and wrap with cable->lock for avoiding concurrent accesses.

Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The aloop driver tries to stop the pending timer via timer_del() in
the trigger callback and in the close callback.  The former is
correct, as it's an atomic operation, while the latter expects that
the timer gets really removed and proceeds the resource releases after
that.  But timer_del() doesn't synchronize, hence the running timer
may still access the released resources.

A similar situation can be also seen in the prepare callback after
trigger(STOP) where the prepare tries to re-initialize the things
while a timer is still running.

The problems like the above are seen indirectly in some syzkaller
reports (although it's not 100% clear whether this is the only cause,
as the race condition is quite narrow and not always easy to
trigger).

For addressing these issues, this patch adds the explicit alls of
timer_del_sync() in some places, so that the pending timer is properly
killed / synced.

Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The aloop driver tries to update the hw constraints of the connected
target on the cable of the opened PCM substream.  This is done by
adding the extra hw constraints rules referring to the substream
runtime->hw fields, while the other substream may update the runtime
hw of another side on the fly.

This is, however, racy and may result in the inconsistent values when
both PCM streams perform the prepare concurrently.  One of the reason
is that it overwrites the other's runtime->hw field; which is not only
racy but also broken when it's called before the open of another side
finishes.  And, since the reference to runtime->hw isn't protected,
the concurrent write may give the partial value update and become
inconsistent.

This patch is an attempt to fix and clean up:
- The prepare doesn't change the runtime->hw of other side any longer,
  but only update the cable->hw that is referred commonly.
- The extra rules refer to the loopback_pcm object instead of the
  runtime->hw.  The actual hw is deduced from cable->hw.
- The extra rules take the cable_lock to protect against the race.

Fixes: b1c73fc8 ("ALSA: snd-aloop: Fix hw_params restrictions and checking")
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The extra hw constraint rule for the formats the aloop driver
introduced has a slight flaw, where it doesn't return a positive value
when the mask got changed.  It came from the fact that it's basically
a copy&paste from snd_hw_constraint_mask64().  The original code is
supposed to be a single-shot and it modifies the mask bits only once
and never after, while what we need for aloop is the dynamic hw rule
that limits the mask bits.

This difference results in the inconsistent state, as the hw_refine
doesn't apply the dependencies fully.  The worse and surprisingly
result is that it causes a crash in OSS emulation when multiple
full-duplex reads/writes are performed concurrently (I leave why it
triggers Oops to readers as a homework).

For fixing this, replace a few open-codes with the standard
snd_mask_*() macros.

Reported-by: syzbot+3902b5220e8ca27889ca@syzkaller.appspotmail.com
Fixes: b1c73fc8 ("ALSA: snd-aloop: Fix hw_params restrictions and checking")
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The aloop runtime object and its assignment in the cable are left even
when opening a substream fails.  This doesn't mean any memory leak,
but it still keeps the invalid pointer that may be referred by the
another side of the cable spontaneously, which is a potential Oops
cause.

Clean up the cable assignment and the empty cable upon the error path
properly.

Fixes: 597603d6 ("ALSA: introduce the snd-aloop module for the PCM loopback")
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

snd_pcm_ops are not supposed to change at runtime. All functions
working with snd_pcm_ops provided by <sound/pcm.h> work with
const snd_pcm_ops. So mark the non-const structs as const.
Signed-off-by: NArvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Make these const as they are only used in a copy operation.
Done using Coccinelle.
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Since the compiler can optimize away the unused code, we can reduce
the messy ifdef.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

No functional change, refactoring with the standard helpers.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

A platform_driver does not need to set an owner, it will be populated by the
driver core.
Signed-off-by: NWolfram Sang <wsa@the-dreams.de>

Also remove superfluous snd_card_set_dev() calls.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Commit 0998d063 (device-core: Ensure drvdata = NULL when no
driver is bound) removes the need to set driver data field to
NULL.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Cc: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add a function to handle conversion from snd_pcm_format_t
to bitwise with proper typing.

Change such conversions to use this function and silence sparse
warnings.
Signed-off-by: NEldad Zack <eldad@fogrefinery.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

snd-aloop driver has no proper PM implementation, thus the PM resume
may trigger Oops due to leftover timer instance.  This patch adds the
missing suspend/resume implementation.
Reported-and-tested-by: NEl boulangero <elboulangero@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

CONFIG_HOTPLUG is going away as an option.  As result the __dev*
markings will be going away.

Remove use of __devinit, __devexit_p, __devinitdata, __devinitconst,
and __devexit.
Signed-off-by: NBill Pemberton <wfp5p@virginia.edu>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>