All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: Clemens Ladisch <clemens@ladisch.de>,
	Takashi Iwai <tiwai@suse.de>, Jiri Slaby <jslaby@suse.cz>
Subject: [patch added to the 3.12 stable tree] ALSA: usb-audio: work around CH345 input SysEx corruption
Date: Tue,  5 Jan 2016 16:28:46 +0100	[thread overview]
Message-ID: <1452007726-3747-45-git-send-email-jslaby@suse.cz> (raw)
In-Reply-To: <1452007726-3747-1-git-send-email-jslaby@suse.cz>

From: Clemens Ladisch <clemens@ladisch.de>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit a91e627e3f0ed820b11d86cdc04df38f65f33a70 upstream.

One of the many faults of the QinHeng CH345 USB MIDI interface chip is
that it does not handle received SysEx messages correctly -- every second
event packet has a wrong code index number, which is the one from the last
seen message, instead of 4.  For example, the two messages "FE F0 01 02 03
04 05 06 07 08 09 0A 0B 0C 0D 0E F7" result in the following event
packets:

correct:       CH345:
0F FE 00 00    0F FE 00 00
04 F0 01 02    04 F0 01 02
04 03 04 05    0F 03 04 05
04 06 07 08    04 06 07 08
04 09 0A 0B    0F 09 0A 0B
04 0C 0D 0E    04 0C 0D 0E
05 F7 00 00    05 F7 00 00

A class-compliant driver must interpret an event packet with CIN 15 as
having a single data byte, so the other two bytes would be ignored.  The
message received by the host would then be missing two bytes out of six;
in this example, "F0 01 02 03 06 07 08 09 0C 0D 0E F7".

These corrupted SysEx event packages contain only data bytes, while the
CH345 uses event packets with a correct CIN value only for messages with
a status byte, so it is possible to distinguish between these two cases by
checking for the presence of this status byte.

(Other bugs in the CH345's input handling, such as the corruption resulting
from running status, cannot be worked around.)

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 sound/usb/midi.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index 966051f530bd..9123fc518f07 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -174,6 +174,8 @@ struct snd_usb_midi_in_endpoint {
 		u8 running_status_length;
 	} ports[0x10];
 	u8 seen_f5;
+	bool in_sysex;
+	u8 last_cin;
 	u8 error_resubmit;
 	int current_port;
 };
@@ -465,6 +467,39 @@ static void snd_usbmidi_maudio_broken_running_status_input(
 }
 
 /*
+ * QinHeng CH345 is buggy: every second packet inside a SysEx has not CIN 4
+ * but the previously seen CIN, but still with three data bytes.
+ */
+static void ch345_broken_sysex_input(struct snd_usb_midi_in_endpoint *ep,
+				     uint8_t *buffer, int buffer_length)
+{
+	unsigned int i, cin, length;
+
+	for (i = 0; i + 3 < buffer_length; i += 4) {
+		if (buffer[i] == 0 && i > 0)
+			break;
+		cin = buffer[i] & 0x0f;
+		if (ep->in_sysex &&
+		    cin == ep->last_cin &&
+		    (buffer[i + 1 + (cin == 0x6)] & 0x80) == 0)
+			cin = 0x4;
+#if 0
+		if (buffer[i + 1] == 0x90) {
+			/*
+			 * Either a corrupted running status or a real note-on
+			 * message; impossible to detect reliably.
+			 */
+		}
+#endif
+		length = snd_usbmidi_cin_length[cin];
+		snd_usbmidi_input_data(ep, 0, &buffer[i + 1], length);
+		ep->in_sysex = cin == 0x4;
+		if (!ep->in_sysex)
+			ep->last_cin = cin;
+	}
+}
+
+/*
  * CME protocol: like the standard protocol, but SysEx commands are sent as a
  * single USB packet preceded by a 0x0F byte.
  */
@@ -650,6 +685,12 @@ static struct usb_protocol_ops snd_usbmidi_cme_ops = {
 	.output_packet = snd_usbmidi_output_standard_packet,
 };
 
+static struct usb_protocol_ops snd_usbmidi_ch345_broken_sysex_ops = {
+	.input = ch345_broken_sysex_input,
+	.output = snd_usbmidi_standard_output,
+	.output_packet = snd_usbmidi_output_standard_packet,
+};
+
 /*
  * AKAI MPD16 protocol:
  *
@@ -2292,6 +2333,7 @@ int snd_usbmidi_create(struct snd_card *card,
 		err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints);
 		break;
 	case QUIRK_MIDI_CH345:
+		umidi->usb_protocol_ops = &snd_usbmidi_ch345_broken_sysex_ops;
 		err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints);
 		break;
 	default:
-- 
2.6.4


      parent reply	other threads:[~2016-01-05 15:30 UTC|newest]

Thread overview: 46+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-05 15:28 [patch added to the 3.12 stable tree] ipv6: fix tunnel error handling Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Fix ASID restoration logic Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Fix CACHE immediate offset sign extension Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Uninit VCPU in vcpu_create error path Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] unix: avoid use-after-free in ep_remove_wait_queue Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] packet: do skb_probe_transport_header when we actually have data Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] packet: infer protocol from ethernet header if unset Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] sctp: translate host order to network order when setting a hmacid Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] snmp: Remove duplicate OUTMCAST stat increment Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: qmi_wwan: add XS Stick W100-2 from 4G Systems Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] tcp: md5: fix lockdep annotation Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] tcp: initialize tp->copied_seq in case of cross SYN connection Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: ipmr: fix static mfc/dev leaks on table destruction Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: ip6mr: " Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] broadcom: fix PHY_ID_BCM5481 entry in the id table Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ipv6: distinguish frag queues by device for multicast and link-local packets Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ipv6: add complete rcu protection around np->opt Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net/neighbour: fix crash at dumping device-agnostic proxy entries Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ipv6: sctp: implement sctp_v6_destroy_sock() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: 8426/1: dma-mapping: add missing range check in dma_mmap() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: 8427/1: dma-mapping: add support for offset parameter " Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: common: edma: Fix channel parameter for irq callbacks Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/setup: Extend low identity map to cover whole kernel range Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/setup: Fix low identity map for >= 2GB " Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/cpu: Call verify_cpu() after having entered long mode too Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/cpu: Fix SMAP check in PVOPS environments Jiri Slaby
2016-01-05 15:28 ` Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] mac80211: fix driver RSSI event calculations Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: mvneta: Fix CPU_MAP registers initialisation Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] mwifiex: fix mwifiex_rdeeprom_read() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] staging: rtl8712: Add device ID for Sitecom WLA2100 Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: hidp: fix device disconnect on idle timeout Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add new AR3012 0930:021c id Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add support of AR3012 0cf3:817b device Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] can: sja1000: clear interrupts on start Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] arm64: Fix compat register mappings Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] usblp: do not set TASK_INTERRUPTIBLE before lock Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] usb: musb: core: fix order of arguments to ulpi write callback Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: ti_usb_3410_5052: Add Honeywell HGI80 ID Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: serial: option: add support for Novatel MiFi USB620L Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: option: add XS Stick W100-2 from 4G Systems Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ALSA: usb-audio: add packet size quirk for the Medeli DD305 Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ALSA: usb-audio: prevent CH345 multiport output SysEx corruption Jiri Slaby
2016-01-05 15:28 ` Jiri Slaby [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1452007726-3747-45-git-send-email-jslaby@suse.cz \
    --to=jslaby@suse.cz \
    --cc=clemens@ladisch.de \
    --cc=stable@vger.kernel.org \
    --cc=tiwai@suse.de \
    --subject='Re: [patch added to the 3.12 stable tree] ALSA: usb-audio: work around CH345 input SysEx corruption' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.