The USB MIDI 2.0 endpoint parser has the same descriptor walking
pattern as the legacy MIDI parser. It validates bLength against
bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the
remaining bytes in the endpoint-extra scan.
A malformed device can therefore make later baAssoGrpTrmBlkID[] reads
consume bytes past the walked descriptor.
Reject zero-length and overlong descriptors while walking endpoint
extras.
Fixes: ff49d1df79 ("ALSA: usb-audio: USB MIDI 2.0 UMP support")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260507-usb-midi-endpoint-scan-bounds-v1-2-329d7348160e@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
USB MIDI 2.0 suspend saves the endpoint running state, clears it and
kills all endpoint URBs. Resume restores the running state, but only
restarts input endpoints.
For a running output endpoint, this leaves the endpoint marked running
with an empty URB queue. Output transfer progress depends on either the
rawmidi trigger path starting the queue or an output completion refilling
it. After suspend there is no completion left, and output data that
remains queued in the raw UMP or legacy rawmidi buffer can stay stalled
until userspace happens to trigger the stream again.
Restore the saved state with atomic accessors, keep input endpoints
restarted as before, and restart output endpoints that were running before
suspend. Clear the saved suspend state after restoring it.
Fixes: ff49d1df79 ("ALSA: usb-audio: USB MIDI 2.0 UMP support")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260504-usb-midi2-output-resume-v1-1-c089cc8ad3c6@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The USB core already prepares the strings for manufacturer, product
and serial number, and we don't have to extract the string at each
time. Replace the manual usb_string() calls with the corresponding
pointers in struct usb_dev as a code cleanup.
Link: https://patch.msgid.link/20260305130426.975604-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This was done entirely with mindless brute force, using
git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'
to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.
Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.
For the same reason the 'flex' versions will be done as a separate
conversion.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:
Single allocations: kmalloc(sizeof(TYPE), ...)
are replaced with: kmalloc_obj(TYPE, ...)
Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with: kmalloc_objs(TYPE, COUNT, ...)
Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...)
(where TYPE may also be *VAR)
The resulting allocations no longer return "void *", instead returning
"TYPE *".
Signed-off-by: Kees Cook <kees@kernel.org>
This is another code cleanup by replacing the manual mutex or spinlock
with guard() macros. usb_audio_disconnect() is slightly refactored
(split to another function) to apply guard() cleanly, but the rest are
rather straightforward conversions.
No functional changes but only code refactoring.
Link: https://patch.msgid.link/20250811082019.31052-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Replace strcpy() and sprintf() usages in the USB audio drivers with
the safer versions (strscpy() and scnprintf()) with the proper max
size evaluation. Only for safety, no actual behavior change.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250710100727.22653-103-tiwai@suse.de
When a FB is created from a GTB instead of UMP FB Info inquiry, we
missed the update of the corresponding UMP Group attributes.
Export the call of updater and let it be called from the USB driver.
Fixes: 0642a3c5ca ("ALSA: ump: Update substream name from assigned FB names")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20240807092303.1935-5-tiwai@suse.de
When a MIDI 1.0 protocol is specified in a GTB entry while others are
set in MIDI 2.0, it should be seen as a legacy MIDI 1.0 port. Since
recently we allow drivers to set a flag SNDRV_UMP_BLOCK_IS_MIDI1 to a
FB for that purpose. This patch tries to set that flag when the
device shows such a configuration.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20240807092303.1935-4-tiwai@suse.de
It's valid to give different protocols via multiple GTBs; e.g. a MIDI
1.0 port is embedded in a MIDI 2.0 device that talks with MIDI 2.0
protocol. However, the current driver implementation assumes only a
single protocol over the whole Endpoint, and it can't handle such a
scenario.
This patch changes the driver's behavior to parse GTBs to accept
multiple protocols. Instead of switching to the last given protocol,
it adds the protocol capability bits now. Meanwhile, the default
protocol is chosen by the first given protocol in GTBs.
Practically seen, this should be a minor issue, as new devices should
specify the protocols properly via UMP Endpoint Info messages, so this
is rather just covering a corner case.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20240807092303.1935-3-tiwai@suse.de
The allocation and initialization errors at alloc_midi_urbs() that is
called at MIDI 2.0 / UMP device are supposed to be handled at the
caller side by invoking free_midi_urbs(). However, free_midi_urbs()
loops only for ep->num_urbs entries, and since ep->num_entries wasn't
updated yet at the allocation / init error in alloc_midi_urbs(), this
entry won't be released.
The intention of free_midi_urbs() is to release the whole elements, so
change the loop size to NUM_URBS to scan over all elements for fixing
the missed releases.
Also, the call of free_midi_urbs() is missing at
snd_usb_midi_v2_open(). Although it'll be released later at
reopen/close or disconnection, it's better to release immediately at
the error path.
Fixes: ff49d1df79 ("ALSA: usb-audio: USB MIDI 2.0 UMP support")
Reported-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Closes: https://lore.kernel.org/r/fc275ed315b9157952dcf2744ee7bdb78defdb5f.1693746347.git.christophe.jaillet@wanadoo.fr
Link: https://lore.kernel.org/r/20230905054511.20502-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The legacy rawmidi devices are the shadows of the main UMP devices,
hence it's better to initialize them after all UMP Endpoints are
parsed. Then, at the moment the legacy rawmidi is created, we already
know the static flag or the proper EP name string, and we can fill
those information at UMP core side instead of fiddling the attributes
at a later point.
Fixes: ec362b63c4 ("ALSA: usb-audio: Enable the legacy raw MIDI support")
Link: https://lore.kernel.org/r/20230824075108.29958-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
UMP v1.1 spec allows to inform whether the function blocks are static
and not dynamically updated. Add a new flag bit to
snd_ump_endpoint_info to reflect that attribute, too.
The flag is set when a USB MIDI device is still in the old MIDI 2.0
without UMP 1.1 support. Then the driver falls back to GTBs, and they
are supposed to be static-only.
Link: https://lore.kernel.org/r/20230612081054.17200-10-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add a new option to enable/disable the UMP Endpoint probing.
Some firmware seems screwed up when such a new command issued, and
this option allows user to suppress it.
Link: https://lore.kernel.org/r/20230612081054.17200-5-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Try to parse the UMP Endpoint and UMP Function Blocks for building the
topology at first. Only when those are missing (e.g. on an older USB
MIDI 2.0 spec or a unidirectional endpoint), the driver still creates
blocks based on USB group terminal block information as fallback.
Link: https://lore.kernel.org/r/20230612081054.17200-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When parsing Group Terminal Blocks, we overwrote the preferred
protocol and the protocol capabilities silently from the last parsed
GTB. This patch adds the information print indicating the unexpected
overrides instead of silent action.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20230523075358.9672-17-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This is a code refactoring for abstracting the rawmidi access to the
UMP's own helpers. It's a preliminary work for the later code
refactoring of the UMP layer.
Until now, we access to the rawmidi substream directly from the
driver via rawmidi access helpers, but after this change, the driver
is supposed to access via the newly introduced snd_ump_ops and
receive/transmit via snd_ump_receive() and snd_ump_transmit() helpers.
As of this commit, those are merely wrappers for the rawmidi
substream, and no much function change is seen here.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20230523075358.9672-14-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
USB MIDI spec defines the Group Terminal Blocks (GTB) that associate
multiple UMP Groups. Those correspond to snd_ump_block entities in
ALSA UMP abstraction, and now we create those UMP Block objects for
each UMP Endpoint from the parsed GTB information.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20230523075358.9672-13-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A single USB audio device may have multiple interfaces for different
purposes (e.g. audio, MIDI and HID), where the iInterface descriptor
of each interface may contain an own suffix, e.g. "MIDI" for a MIDI
interface. as such a suffix is superfluous as a rawmidi and UMP
Endpoint name, this patch trims the superfluous "MIDI" suffix from the
name string.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20230523075358.9672-12-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
USB descriptor may provide a nicer name for USB interface, and we may
take it as the UMP Endpoint name. The UMP EP name is copied as the
rawmidi name, too.
Also, fill the UMP block product_id field from the iSerialNumber
string of the USB device descriptor as a recommended unique id, too.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20230523075358.9672-11-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch provides a basic support for USB MIDI 2.0. As of this
patch, the driver creates a UMP device per MIDI I/O endpoints, which
serves as a dumb terminal to read/write UMP streams.
A new Kconfig CONFIG_SND_USB_AUDIO_MIDI_V2 manages whether to enable
or disable the MIDI 2.0 support. Also, the driver provides a new
module option, midi2_enable, to allow disabling the MIDI 2.0 at
runtime, too. When MIDI 2.0 support is disabled, the driver tries to
fall back to the already existing MIDI 1.0 device (each MIDI 2.0
device is supposed to provide the MIDI 1.0 interface at the altset
0).
For now, the driver doesn't manage any MIDI-CI or other protocol
setups by itself, but relies on the default protocol given via the
group terminal block descriptors.
The MIDI 1.0 messages on MIDI 2.0 device will be automatically
converted in ALSA sequencer in a later patch. As of this commit, the
driver accepts merely the rawmidi UMP accesses.
The driver builds up the topology in the following way:
- Create an object for each MIDI endpoint belonging to the USB
interface
- Find MIDI EP "pairs" that share the same GTB;
note that MIDI EP is unidirectional, while UMP is (normally)
bidirectional, so two MIDI EPs can form a single UMP EP
- A UMP endpoint object is created for each I/O pair
- For remaining "solo" MIDI EPs, create unidirectional UMP EPs
- Finally, parse GTBs and fill the protocol bits on each UMP
So the driver may support multiple UMP Endpoints in theory, although
most devices are supposed to have a single UMP EP that can contain up
to 16 groups -- which should be large enough.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20230523075358.9672-10-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
