/*
 * eqfuzz.c — pass-2 adversarial harness for sys/dev/sound/pcm/feeder_eq.c
 * (GLM 5.3 re-audit). Compiles the REAL, UNMODIFIED feeder_eq.c in userland
 * (the file is written to allow exactly this) and drives:
 *
 *   T1 generated-table sanity (feed_eq_preamp/coefficient table sizes)
 *   T2 feed_eq_scan_preamp_arg: exhaustive grid + 300k-string fuzz; every
 *      accepted value must map (after the sysctl clamp to +-PREAMP_MAX) to an
 *      in-range feed_eq_preamp index via FEEDEQ_PREAMP2IDX
 *   T3 feed_eq_set full boundary sweep (channels/rate/treble/bass/preamp/state)
 *   T4 feed_eq_feed + biquad soak: every biquad format x channels 1..8 x
 *      all 19 preamp entries x all 19x19 gain pairs, extreme sample patterns,
 *      unaligned counts, partial/zero source returns
 *   T5 feed_eq_init/free churn (leak check via LSan at exit)
 *
 * Build: cc -O1 -g -fsanitize=address,undefined -o eqfuzz eqfuzz.c
 */
#include "eqshim.h"

/* pull in the file under audit, verbatim */
#include "feeder_eq.c"

int eqshim_canary_hit;
const char *eqshim_canary_where = "none";

/* metadata snapshot: fields that no feed must ever modify */
struct eqmeta {
	uintptr_t coeff, biquad;
	uint32_t channels, rate, align;
	int32_t preamp;
	int state;
	int tgain, bgain;
};

static struct eqmeta
snap(struct feed_eq_info *i)
{
	struct eqmeta m;
	m.coeff = (uintptr_t)i->coeff;
	m.biquad = (uintptr_t)i->biquad;
	m.channels = i->channels;
	m.rate = i->rate;
	m.align = i->align;
	m.preamp = i->preamp;
	m.state = i->state;
	m.tgain = i->treble.gain;
	m.bgain = i->bass.gain;
	return (m);
}

static int
verify(struct feed_eq_info *i, struct eqmeta *m)
{
	struct eqmeta now = snap(i);

	kfree_canary_check(i, sizeof(*i));
	if (eqshim_canary_hit)
		return (-1);
	return (memcmp(&now, m, sizeof(now)));
}

/* ---------------- source-feeder shim ---------------- */
static uint32_t src_remaining;
static uint32_t src_pattern;	/* 0=zero 1=max 2=min 3=square 4=prng 5=ramp */
static uint32_t src_partial;	/* return count-partial (0 = exact) */
static uint32_t prng_state = 0x12345678u;

static uint32_t
prng(void)
{
	prng_state ^= prng_state << 13;
	prng_state ^= prng_state >> 17;
	prng_state ^= prng_state << 5;
	return (prng_state);
}

static void
fill_pattern(uint8_t *b, uint32_t bytes)
{
	uint32_t i;
	int32_t v;

	for (i = 0; i + 4 <= bytes; i += 4) {
		switch (src_pattern) {
		case 0: v = 0; break;
		case 1: v = INT32_MAX; break;
		case 2: v = INT32_MIN; break;
		case 3: v = ((i >> 2) & 1) ? INT32_MAX : INT32_MIN; break;
		case 4: v = (int32_t)prng(); break;
		default: v = (int32_t)(i << 8); break;
		}
		memcpy(b + i, &v, 4);
	}
	for (; i < bytes; i++)
		b[i] = (uint8_t)prng();
}

uint32_t
eqshim_source_feed(struct pcm_feeder *f, struct pcm_channel *c, uint8_t *b,
    uint32_t count, void *src)
{
	uint32_t give = count;

	(void)f; (void)c; (void)src;
	if (give > src_remaining)
		give = src_remaining;
	if (src_partial != 0 && give > src_partial)
		give = src_partial;
	fill_pattern(b, give);
	src_remaining -= give;
	return (give);
}

int
eqshim_set(struct pcm_feeder *f, int what, int value)
{
	/* the only feeder in the harness is feeder_eq */
	return (feed_eq_set(f, what, value));
}

/* ---------------- assertions ---------------- */
static unsigned long ncheck, nfail;
static void
chk(int cond, const char *what, long a, long b)
{
	ncheck++;
	if (!cond) {
		nfail++;
		printf("FAIL: %s (%ld vs %ld)\n", what, a, b);
	}
}

#define NPREAMP	((int)(sizeof(feed_eq_preamp) / sizeof(feed_eq_preamp[0])))

/* ---------------- T1: tables ---------------- */
static void
t1_tables(void)
{
	chk(NPREAMP == FEEDEQ_LEVELS, "preamp table size == FEEDEQ_LEVELS",
	    NPREAMP, FEEDEQ_LEVELS);
	chk(FEEDEQ_TAB_SIZE == 6, "rate table size", FEEDEQ_TAB_SIZE, 6);
	/* every coefficient table pointer must be a 19-entry block: all rates */
	for (int i = 0; i < FEEDEQ_TAB_SIZE; i++) {
		chk(feed_eq_tab[i].rate >= FEEDEQ_RATE_MIN &&
		    feed_eq_tab[i].rate <= FEEDEQ_RATE_MAX, "tab rate in range",
		    feed_eq_tab[i].rate, 0);
		chk(feed_eq_tab[i].coeff != NULL, "coeff non-null", i, 0);
	}
	/* preamp mul/shift sane: mul > 0, shift in [0,31] */
	for (int i = 0; i < NPREAMP; i++) {
		chk(feed_eq_preamp[i].mul > 0, "preamp mul > 0", i,
		    feed_eq_preamp[i].mul);
		chk(feed_eq_preamp[i].shift >= 0 &&
		    feed_eq_preamp[i].shift <= 31, "preamp shift range", i,
		    feed_eq_preamp[i].shift);
	}
}

/* ---------------- T2: scan_preamp ---------------- */
static int
idx_of(int v)		/* apply the sysctl clamp, then PREAMP2IDX */
{
	if (v < FEEDEQ_PREAMP_MIN)
		v = FEEDEQ_PREAMP_MIN;
	if (v > FEEDEQ_PREAMP_MAX)
		v = FEEDEQ_PREAMP_MAX;
	return (FEEDEQ_PREAMP2IDX(v));
}

static unsigned long nvalid_scan;

static void
scan_check(const char *s)
{
	int32_t v = feed_eq_scan_preamp_arg(s);
	int idx;

	if (v == FEEDEQ_PREAMP_INVALID)
		return;
	nvalid_scan++;
	/* raw scan output must be a plausible IF2PREAMP magnitude */
	chk(v >= -(FEEDEQ_PREAMP_IMAX * 16 + 15) - 1 &&
	    v <= (FEEDEQ_PREAMP_IMAX * 16 + 15) + 1,
	    "scan magnitude sane", v, 0);
	idx = idx_of((int)v);
	chk(idx >= 0 && idx < NPREAMP, "scan->preamp idx in range", idx, v);
}

static void
t2_scan(void)
{
	char s[64];
	int i, f, dB;
	static const char *signs[] = { "", "-", "+" };

	/* exhaustive i x f x dB x sign grid */
	for (i = -200; i <= 200; i++) {
		for (f = -1; f <= 12; f++) {
			for (dB = 0; dB <= 1; dB++) {
				for (size_t sg = 0; sg < 3; sg++) {
					if (f < 0)
						snprintf(s, sizeof(s),
						    "%s%d%s", signs[sg], i,
						    dB ? "dB" : "");
					else
						snprintf(s, sizeof(s),
						    "%s%d.%d%s", signs[sg], i,
						    f, dB ? "dB" : "");
					scan_check(s);
				}
			}
		}
	}

	/* adversarial literals */
	const char *lit[] = {
		"", ".", "-", "+", ".5", "-.", "0.", "0.0dB", "dB", "0.0 db",
		"00.0", "0.00", "1.2.3", "1..2", "--1", "++1", "-+1", "1-",
		"192.0dB", "-192.0dB", "193.0dB", "99999999999999999999.9dB",
		"-99999999999999999999", "0.9999999999dB", "2147483647",
		"-2147483648", "1e3", "0x10", " 1", "1 ", "\t1.1", "1.1d",
		"1.1db", "1.1DB", "1.1Db", "0.0DB", "9.9dB", "-9.9dB",
		"10.0dB", "-10.0dB", "0.10dB", "1.10dB", "6.0dB", "-6.0dB",
		NULL
	};
	for (int k = 0; lit[k] != NULL; k++)
		scan_check(lit[k]);

	/* random fuzz: grammar mix */
	const char *alpha = "0123456789.+-dD bB\x01\xff";
	for (int n = 0; n < 300000; n++) {
		size_t len = prng() % 12;
		for (size_t k = 0; k < len; k++)
			s[k] = alpha[prng() % (sizeof(alpha) - 1)];
		s[len] = '\0';
		scan_check(s);
	}

	/* PREAMP2IDX directly over the entire accepted clamp domain */
	for (int v = FEEDEQ_PREAMP_MIN; v <= FEEDEQ_PREAMP_MAX; v++) {
		int idx = FEEDEQ_PREAMP2IDX(v);
		chk(idx >= 0 && idx < NPREAMP, "PREAMP2IDX in range for every "
		    "in-band v", idx, v);
	}

	printf("T2: %lu valid scans accepted, all -> in-range idx\n",
	    nvalid_scan);
}

/* ---------------- T3: feed_eq_set sweep ---------------- */
static void
mkfeeder(struct pcm_feeder *f, struct pcm_feederdesc *d, uint32_t afmt)
{
	memset(f, 0, sizeof(*f));
	memset(d, 0, sizeof(*d));
	d->type = FEEDER_EQ;
	d->in = d->out = afmt;
	f->desc = d;
	chk(feed_eq_init(f) == 0, "feed_eq_init ok", afmt, 0);
}

static void
t3_set(void)
{
	struct pcm_feeder f;
	struct pcm_feederdesc d;
	struct feed_eq_info *info;
	static const int ch[] = { -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 16, 64,
				  0x7fffffff, -2147483648 };
	static const int rates[] = { -1, 0, 1, 44099, 44100, 44101, 46050,
	    46051, 47999, 48000, 88200, 96000, 176400, 191999, 192000, 192001,
    2016000, 0x7fffffff, -2147483648 };
	static const int tones[] = { -1, 0, 1, 49, 50, 51, 99, 100, 101, 127,
				     0x7fffffff, -2147483648 };
	static const int preamps[] = { -2147483648, -1000, -145, -144, -143,
	    -17, -16, -15, -1, 0, 1, 15, 16, 17, 143, 144, 145, 1000,
	    0x7fffffff };
	static const int states[] = { -1, 0, 1, 2, 3, 6, 7, 8, 9, 255,
				      0x7fffffff };

	mkfeeder(&f, &d, SND_FORMAT(AFMT_S16_LE, 2, 0));
	info = f.data;
	chk(info->channels == 2, "init channels", info->channels, 2);
	chk(info->preamp == FEEDEQ_PREAMP2IDX(FEEDEQ_PREAMP_DEFAULT),
	    "init preamp", info->preamp, 0);

	for (size_t k = 0; k < sizeof(ch) / sizeof(ch[0]); k++) {
		int r = feed_eq_set(&f, FEEDEQ_CHANNELS, ch[k]);
		chk((ch[k] >= 1 && ch[k] <= 8) ? r == 0 : r == EINVAL,
		    "FEEDEQ_CHANNELS bounds", ch[k], r);
		if (r == 0)
			chk(info->channels == (uint32_t)ch[k], "channels set",
			    info->channels, ch[k]);
	}
	for (size_t k = 0; k < sizeof(rates) / sizeof(rates[0]); k++) {
		int r = feed_eq_set(&f, FEEDEQ_RATE, rates[k]);
		int expect = feeder_eq_validrate((uint32_t)rates[k]) ? 0 : EINVAL;
		chk(r == expect, "FEEDEQ_RATE valid/invalid", rates[k], r);
		if (r == 0)
			chk(info->coeff != NULL, "coeff set after rate", 0, 0);
	}
	for (size_t k = 0; k < sizeof(tones) / sizeof(tones[0]); k++) {
		int r = feed_eq_set(&f, FEEDEQ_TREBLE, tones[k]);
		chk((tones[k] >= 0 && tones[k] <= 100) ? r == 0 : r == EINVAL,
		    "FEEDEQ_TREBLE bounds", tones[k], r);
		if (r == 0)
			chk(info->treble.gain >= 0 &&
			    info->treble.gain < FEEDEQ_LEVELS,
			    "treble gain idx", info->treble.gain, tones[k]);
		r = feed_eq_set(&f, FEEDEQ_BASS, tones[k]);
		chk((tones[k] >= 0 && tones[k] <= 100) ? r == 0 : r == EINVAL,
		    "FEEDEQ_BASS bounds", tones[k], r);
	}
	for (size_t k = 0; k < sizeof(preamps) / sizeof(preamps[0]); k++) {
		int r = feed_eq_set(&f, FEEDEQ_PREAMP, preamps[k]);
		int v = preamps[k];
		chk((v >= FEEDEQ_PREAMP_MIN && v <= FEEDEQ_PREAMP_MAX) ?
		    r == 0 : r == EINVAL, "FEEDEQ_PREAMP bounds", v, r);
		if (r == 0) {
			chk(info->preamp >= 0 && info->preamp < NPREAMP,
			    "preamp idx in range", info->preamp, v);
			chk(FEEDEQ_PREAMP2IDX(v) == info->preamp,
			    "preamp idx matches macro", info->preamp, v);
		}
	}
	for (size_t k = 0; k < sizeof(states) / sizeof(states[0]); k++) {
		int v = states[k];
		int r = feed_eq_set(&f, FEEDEQ_STATE, v);
		int ok = (v == FEEDEQ_DISABLE || v == FEEDEQ_ENABLE ||
		    v == FEEDEQ_BYPASS);
		chk(ok ? r == 0 : r == EINVAL, "FEEDEQ_STATE bounds", v, r);
	}
	/* unknown op */
	chk(feed_eq_set(&f, 12345, 0) == EINVAL, "unknown set op", 0, 0);

	feed_eq_free(&f);
	chk(f.data == NULL, "free NULLs data", 0, 0);
	chk(eqshim_canary_hit == 0, "t3 no canary hit", 0, 0);
}

/* ---------------- T4: biquad / feed soak ---------------- */
#define MAXB (65536 + 64)

static void
t4_soak(void)
{
	struct pcm_feeder f;
	struct pcm_feederdesc d;
	struct feed_eq_info *info;
	static uint8_t buf[MAXB] __attribute__((aligned(16)));
	static const uint32_t fmts[] = { AFMT_S16_LE, AFMT_S32_LE };
	static const uint32_t counts[] = { 1, 2, 3, 4, 5, 7, 8, 15, 16, 17,
	    31, 32, 33, 63, 64, 48, 96, 100, 253, 4095, 4096, 65535, 65536 };
	/* NB: >65536 (SND_FXDIV_MAX) is out of the kernel's precondition:
	   sndbuf_feed caps every feed at FXROUND(65536, align). */
	int tre, bas, pa, st, pat, ci;
	uint32_t fi, ch;
	unsigned long feeds = 0;

	for (fi = 0; fi < sizeof(fmts) / sizeof(fmts[0]); fi++) {
		for (ch = 1; ch <= 8; ch++) {
			uint32_t afmt = SND_FORMAT(fmts[fi], ch, 0);
			mkfeeder(&f, &d, afmt);
			info = f.data;

			for (pa = 0; pa < NPREAMP; pa++) {
				/* set preamp via raw index-equivalent value:
				   walk the exact IF2PREAMP values the sysctl
				   can produce, covering all table rows by
				   direct index selection */
				int v = (pa <= 9) ? -((9 - pa) << 4) :
				    ((pa - 9) << 4);
				chk(feed_eq_set(&f, FEEDEQ_PREAMP, v) == 0,
				    "soak preamp set", v, pa);
				chk((int)info->preamp == pa, "soak preamp idx",
				    info->preamp, pa);

				for (tre = 0; tre < FEEDEQ_LEVELS; tre += 3) {
					for (bas = 0; bas < FEEDEQ_LEVELS;
					    bas += 2) {
						feed_eq_set(&f, FEEDEQ_TREBLE,
						    (tre * 100) / 19 > 100 ?
						    100 : (tre * 100) / 19);
						feed_eq_set(&f, FEEDEQ_BASS,
						    (bas * 100) / 19 > 100 ?
						    100 : (bas * 100) / 19);
				for (st = 0; st < 3; st++) {
					int sv = st == 0 ? FEEDEQ_DISABLE :
					    (st == 1 ? FEEDEQ_ENABLE :
					    FEEDEQ_BYPASS);
					feed_eq_set(&f, FEEDEQ_STATE, sv);
				for (pat = 0; pat < 6; pat++) {
				for (ci = 0; ci < (int)(sizeof(counts) /
				    sizeof(counts[0])); ci++) {
					uint32_t cnt = counts[ci];
					uint32_t align = info->align;
					struct eqmeta m;

					if (cnt > MAXB)
						continue;
					src_pattern = (uint32_t)pat;
					src_remaining = cnt;
					src_partial = (pat == 4) ? 7 : 0;
					m = snap(info);
					uint32_t got = feed_eq_feed(&f, NULL,
					    buf, cnt, NULL);
					chk(got <= cnt, "feed <= count",
					    got, cnt);
					/* BYPASS passes raw bytes through */
					if (sv != FEEDEQ_BYPASS)
						chk((got % align) == 0,
						    "feed multiple of align",
						    got, align);
					chk(verify(info, &m) == 0,
					    "feed corrupts no metadata", 0,
					    0);
					chk(eqshim_canary_hit == 0,
					    "feed hits no canary", 0, 0);
					feeds++;
				}
				}
				}
					}
				}
			}
			/* full-rate sweep for this format/ch */
			feed_eq_set(&f, FEEDEQ_STATE, FEEDEQ_ENABLE);
			for (int i = 0; i < FEEDEQ_TAB_SIZE; i++) {
				chk(feed_eq_set(&f, FEEDEQ_RATE,
				    (int)feed_eq_tab[i].rate) == 0,
				    "soak rate", feed_eq_tab[i].rate, 0);
				src_pattern = 3;
				src_remaining = 4096;
				src_partial = 0;
				feed_eq_feed(&f, NULL, buf, 4096, NULL);
			}
			feed_eq_free(&f);
			chk(eqshim_canary_hit == 0, "t4 no canary hit",
			    ch, 0);
		}
	}
	printf("T4: %lu feeds exercised\n", feeds);
}

/* ---------------- T5: init/free churn ---------------- */
static void
t5_churn(void)
{
	struct pcm_feeder f;
	struct pcm_feederdesc d;

	for (uint32_t ch = 1; ch <= 8; ch++) {
		for (int b = 0; b < 2; b++) {
			uint32_t afmt = SND_FORMAT(b ? AFMT_S32_LE :
			    AFMT_S16_LE, ch, 0);
			mkfeeder(&f, &d, afmt);
			feed_eq_free(&f);
		}
	}
	/* init with unsupported format must fail cleanly */
	memset(&f, 0, sizeof(f));
	memset(&d, 0, sizeof(d));
	d.type = FEEDER_EQ;
	d.in = d.out = 0x00000004;	/* AFMT_IMA_ADPCM: no biquad op */
	f.desc = &d;
	chk(feed_eq_init(&f) == EINVAL, "init rejects unsupported fmt", 0, 0);
	chk(f.data == NULL, "failed init leaves no leak", 0, 0);
	/* in != out rejected */
	d.in = AFMT_S16_LE; d.out = AFMT_S32_LE;
	chk(feed_eq_init(&f) == EINVAL, "init rejects in!=out", 0, 0);
}

int
main(int argc, char **argv)
{
	if (argc > 1 && strcmp(argv[1], "oob") == 0) {
		/*
		 * Deliberate demonstration of the missing SND_CHN_MAX guard in
		 * feed_eq_init (feeder_eq.c:362): a 16-channel format flows
		 * straight into info->channels while the tone arrays are
		 * [SND_CHN_MAX=8] (feeder_eq.c:109-115). All kernel-reachable
		 * callers clamp today (dsp.c:1499, mixer.c:260) — this run
		 * proves the consequence if that invariant ever breaks.
		 */
		struct pcm_feeder f;
		struct pcm_feederdesc d;
		struct eqmeta m;

		mkfeeder(&f, &d, SND_FORMAT(AFMT_S16_LE, 16, 0));
		struct feed_eq_info *info = f.data;
		chk(info->channels == 16, "init channels unchecked", 16,
		    (int)info->channels);
		m = snap(info);
		src_pattern = 4; src_remaining = 4096; src_partial = 0;
		feed_eq_feed(&f, NULL, (uint8_t *)malloc(4096), 4096, NULL);
		int bad = verify(info, &m);
		printf("OOB-DEMO: metadata-corruption=%d canary_hit=%d (%s)\n",
		    bad != 0, eqshim_canary_hit, eqshim_canary_where);
		feed_eq_free(&f);
		return (0);
	}

	printf("=== feeder_eq pass-2 harness (real file, canary+checksum) ===\n");
	t1_tables();
	t2_scan();
	t3_set();
	t4_soak();
	t5_churn();
	printf("checks=%lu failures=%lu  -> %s\n", ncheck, nfail,
	    nfail ? "FAILED" : "ALL PASS");
	return (nfail ? 1 : 0);
}