/* * DF-5555 — structural verification harness for * sys/bus/u4b/template/usb_template_audio.c (pass 2) * * build.sh extracts the ENTIRE body of the audited file (from the `enum` * at line 58 through the end of audio_get_string_desc at line 396) into * audio_body.inc, so every table, callback and byte below is literally the * audited production code, not a transcription. * * The harness then: * * (1) replays, byte-for-byte, the descriptor-generation algorithm of * usb_make_raw_desc() (sys/bus/u4b/template/usb_template.c:127-174) * — including its CDC union / CDC call-management / IAD patching — * into a heap buffer using the same interface numbering walk as * usb_make_interface_desc() (usb_template.c:307-314,379) and the * same raw-desc scan order (iface ppRawDesc first, then endpoint * ppRawDesc, usb_template.c:318-338 / :209-215), then diffs every * generated descriptor against its authored source table: the * "<-- CORRUPTED" bytes are exactly what a USB host would read; * (2) checks the structural invariants the template core trusts: * S1 raw[0] (bLength) == sizeof(table) for all 22 raw descriptor * tables (usb_make_raw_desc memcpy's raw[0] bytes: a lie here * is an OOB read of static kernel data into the generated * config, which a hostile USB host can read back over EP0 — * clamped only by wLength, usb_handle_request.c:744-748); * S2 every NULL-terminated pointer table (9 of them) carries its * terminator and has no interior NULL hole (early-truncation * class); * S3 USB_MAKE_STRING_DESC objects are self-sized * (bLength == sizeof(struct) == 2 + bData bytes, bData even; * tr_valid uses len = buf[0], usb_template.c:1199-1203); * S4 audio_get_string_desc() returns non-NULL exactly for index 0 * (LANG, any lang_id) and indexes 1..4 @ lang 0x0409, NULL for * every other (index,lang) pair reachable from EP0 * (usb_template.c:1184-1187 -> 1086-1109; audio.c:386-395); * S5 no vendor/HID surface: usb_template_audio.getVendorDesc == * NULL, so the core's fallback returns NULL for every stalled * request (usb_template.c:1050-1060); getStringDesc wired; * S6 interface numbers hardcoded INSIDE raw descriptors match the * core's numbering walk: AC header bInCollection == 2 and * baInterfaceNr == {1,2} == the walk's AudioStreaming iface * numbers, and wTotalLength(0x00a9) == sum of the 16 * AC-interface CS_INTERFACE descriptor lengths; * S7 endpoint speed tables in-bounds and nonzero for FULL/HIGH; * LOW/VARIABLE/SUPER -> mps==0 -> core fails closed * (usb_template.c:221-229); * S8 audio graph integrity: every bSourceID/bTerminalLink / * mixer+selector source pin referenced inside the AudioControl * interface resolves to a unit/terminal ID defined by the same * interface (the bytes the CDC-union misfire would corrupt are * exactly these bUnitID/bSourceID fields). * * Exit code 0 = all structural checks pass. The CORRUPTED lines of (1) * are the finding: they always print (deterministic) and are not FAILs. */ #include #include #include #include /* ---- minimal shim of the kernel USB headers the body needs ---------- */ typedef uint8_t uByte; typedef uint16_t uWord; #define UDESC_STRING 0x03 #define UDESC_CS_INTERFACE 0x24 /* usb.h:205 */ #define UDESC_CS_ENDPOINT 0x25 /* usb.h:206 */ #define UDESC_IFACE_ASSOC 0x0B /* usb.h:199 */ #define UDESCSUB_CDC_CM 1 /* usb_cdc.h:38 */ #define UDESCSUB_CDC_UNION 6 /* usb_cdc.h:43 */ #define UE_DIR_IN 0x80 #define UE_DIR_OUT 0x00 #define UE_ISOCHRONOUS 0x01 /* usb.h:532 */ #define UE_ISO_ADAPT 0x08 /* usb.h:540 */ #define UE_ADDR 0x0f #define UC_BUS_POWERED 0x80 /* usb.h:382 */ #define UDCLASS_COMM 0x02 /* usb.h:360 */ #define USB_TEMPLATE_VENDOR 0x0001 enum { USB_SPEED_VARIABLE, USB_SPEED_LOW, USB_SPEED_FULL, USB_SPEED_HIGH, USB_SPEED_SUPER }; #define USB_SPEED_MAX (USB_SPEED_SUPER + 1) struct usb_string_lang { uByte bLength; uByte bDescriptorType; uByte bData[2]; } __attribute__((packed)); /* the real one lives in usb_core.c — same content, checked in S3 */ static const struct usb_string_lang usb_string_lang_en = { sizeof(usb_string_lang_en), UDESC_STRING, { 0x09, 0x04 } }; /* usb.h, verbatim modulo __packed spelling */ #define USB_MAKE_STRING_DESC(m,name) \ static const struct { \ uByte bLength; \ uByte bDescriptorType; \ uByte bData[sizeof((uint8_t []){m})]; \ } __attribute__((packed)) name = { \ .bLength = sizeof(name), \ .bDescriptorType = UDESC_STRING, \ .bData = { m }, \ } struct usb_device_request { uByte bmRequestType; uByte bRequest; uByte wValue[2]; uByte wIndex[2]; uWord wLength; } __attribute__((packed)); typedef const void *(usb_temp_get_string_desc_t)(uint16_t, uint8_t); typedef const void *(usb_temp_get_vendor_desc_t)( const struct usb_device_request *, uint16_t *); /* field-for-field identical to usb_template.h (pointers verbatim) */ struct usb_temp_packet_size { uint16_t mps[USB_SPEED_MAX]; }; struct usb_temp_interval { uint8_t bInterval[USB_SPEED_MAX]; }; struct usb_temp_endpoint_desc { const void **ppRawDesc; const struct usb_temp_packet_size *pPacketSize; const struct usb_temp_interval *pIntervals; uint8_t bEndpointAddress, bmAttributes; }; struct usb_temp_interface_desc { const void **ppRawDesc; const struct usb_temp_endpoint_desc **ppEndpoints; uint8_t bInterfaceClass, bInterfaceSubClass, bInterfaceProtocol; uint8_t iInterface, isAltInterface; }; struct usb_temp_config_desc { const struct usb_temp_interface_desc **ppIfaceDesc; uint8_t bmAttributes, bMaxPower, iConfiguration; }; struct usb_temp_device_desc { usb_temp_get_string_desc_t *getStringDesc; usb_temp_get_vendor_desc_t *getVendorDesc; const struct usb_temp_config_desc **ppConfigDesc; uint16_t idVendor, idProduct, bcdDevice; uint8_t bDeviceClass, bDeviceSubClass, bDeviceProtocol; uint8_t iManufacturer, iProduct, iSerialNumber; }; /* ---- the audited file's body, extracted verbatim by build.sh -------- */ #include "audio_body.inc" /* ---- (1) faithful two-pass replay of the raw-desc generator ---------- */ static int fails; #define CHECK(cond, ...) do { \ if (cond) { printf("PASS " __VA_ARGS__); printf("\n"); } \ else { printf("FAIL " __VA_ARGS__); printf("\n"); fails++;; } \ } while (0) /* exactly the guards of usb_template.c:135-137 / :150-151 / :162-164 */ static int classify(const uint8_t *raw, uint8_t iface_class) { int collide = 0; #ifdef FIX_CLASSGATE /* proposed fix.diff: only renumber CDC descriptors inside CDC * (class 0x02) / CDC-data (class 0x0a) interfaces — audio * CS_INTERFACE descriptors (class 0x01) are left untouched */ if ((iface_class != 0x02) && (iface_class != 0x0a)) return (0); #endif if ((raw[0] >= 8) && /* sizeof(usb_interface_assoc_desc) */ (raw[1] == UDESC_IFACE_ASSOC)) collide = 3; /* IAD branch */ if ((raw[0] >= 5) && /* sizeof(usb_cdc_union_descriptor) */ (raw[1] == UDESC_CS_INTERFACE) && (raw[2] == UDESCSUB_CDC_UNION)) collide = 2; /* CDC union branch */ if ((raw[0] >= 5) && /* sizeof(usb_cdc_cm_descriptor) */ (raw[1] == UDESC_CS_INTERFACE) && (raw[2] == UDESCSUB_CDC_CM)) collide = 1; /* CDC call-management branch */ return (collide); } /* per-descriptor provenance, so the diff can name names */ struct ent { const char *tname; /* source table name */ const uint8_t *src; /* authored bytes */ size_t off; /* offset in generated buffer */ uint8_t ifnum; /* bInterfaceNumber current at generation */ uint8_t iface_class; }; /* resolve a raw table pointer back to its declared name (census) */ static const char * name_of(const uint8_t *p) { struct { const uint8_t *p; const char *n; } tab[] = { { audio_raw_desc_0, "audio_raw_desc_0" }, { audio_raw_desc_1, "audio_raw_desc_1" }, { audio_raw_desc_2, "audio_raw_desc_2" }, { audio_raw_desc_3, "audio_raw_desc_3" }, { audio_raw_desc_4, "audio_raw_desc_4" }, { audio_raw_desc_5, "audio_raw_desc_5" }, { audio_raw_desc_6, "audio_raw_desc_6" }, { audio_raw_desc_7, "audio_raw_desc_7" }, { audio_raw_desc_8, "audio_raw_desc_8" }, { audio_raw_desc_9, "audio_raw_desc_9" }, { audio_raw_desc_10, "audio_raw_desc_10" }, { audio_raw_desc_11, "audio_raw_desc_11" }, { audio_raw_desc_12, "audio_raw_desc_12" }, { audio_raw_desc_13, "audio_raw_desc_13" }, { audio_raw_desc_14, "audio_raw_desc_14" }, { audio_raw_desc_15, "audio_raw_desc_15" }, { audio_raw_desc_20, "audio_raw_desc_20" }, { audio_raw_desc_21, "audio_raw_desc_21" }, { audio_raw_desc_22, "audio_raw_desc_22" }, { audio_raw_desc_30, "audio_raw_desc_30" }, { audio_raw_desc_31, "audio_raw_desc_31" }, { audio_raw_desc_32, "audio_raw_desc_32" }, }; size_t i; for (i = 0; i < sizeof(tab) / sizeof(tab[0]); i++) if (tab[i].p == p) return (tab[i].n); return (""); } static int n_hit; /* census: every predicate hit */ static int n_hit_real; /* hits in nonzero interfaces */ static const char *field_of(const uint8_t *raw, size_t off); static struct ent ents[128]; static int nents; static uint8_t genbuf[4096]; static size_t gensize; /* usb_make_raw_desc() replay: memcpy + CDC/IAD patching, byte-exact */ static void gen_raw_desc(const uint8_t *raw, const char *tname, uint8_t ifnum, uint8_t iface_class) { uint8_t len = raw[0]; uint8_t *dst = genbuf + gensize; int c; memcpy(dst, raw, len); c = classify(raw, iface_class); if (c) { /* full census: every descriptor the CDC heuristic fires on */ n_hit++; n_hit_real += ifnum ? 1 : 0; if (c == 1) printf(" HIT %-19s bLength=%2u type=0x%02x " "subtype=0x%02x in iface %u: CDC-CM patch " "byte[4] (%s) delta=+%u%s\n", name_of(raw), raw[0], raw[1], raw[2], ifnum, field_of(raw, 4), ifnum, ifnum ? " <-- REAL DELTA" : " (zero delta)"); else if (c == 2) printf(" HIT %-19s bLength=%2u type=0x%02x " "subtype=0x%02x in iface %u: CDC-UNION patch " "byte[3]+byte[4] (%s/%s) delta=+%u%s\n", name_of(raw), raw[0], raw[1], raw[2], ifnum, field_of(raw, 3), field_of(raw, 4), ifnum, ifnum ? " <-- REAL DELTA" : " (zero delta)"); else printf(" HIT %-19s bLength=%2u type=0x%02x " "subtype=0x%02x in iface %u: IAD patch " "byte[3] delta=+%u%s\n", name_of(raw), raw[0], raw[1], raw[2], ifnum, ifnum, ifnum ? " <-- REAL DELTA" : " (zero delta)"); } if (c == 2) { /* CDC union: bytes 3,4 += ifnum */ dst[3] += ifnum; dst[4] += ifnum; } else if (c == 1) { /* CDC CM: byte 4 += ifnum */ dst[4] += ifnum; } else if (c == 3) { /* IAD: byte 3 += ifnum */ dst[3] += ifnum; } ents[nents].tname = tname; ents[nents].src = raw; ents[nents].off = gensize; ents[nents].ifnum = ifnum; ents[nents].iface_class = iface_class; nents++; gensize += len; } /* field names for the byte offsets the misfire patches, for the report */ static const char * field_of(const uint8_t *raw, size_t off) { if (raw[1] != UDESC_CS_INTERFACE) return ("?"); switch (raw[2]) { case 0x01: /* AC header (iface 0) / AS_GENERAL (ifaces 1,2) */ if (off == 4) return (raw[0] == 10 ? "bcdADC hi" : "bDelay"); return ("?"); case 0x06: /* feature unit */ if (off == 3) return ("bUnitID"); if (off == 4) return ("bSourceID"); return ("?"); } return ("?"); } static int as_ifnum[8], as_n; /* AS (subclass 2) interface numbers */ static int n_ifaces; /* usb_make_interface_desc() numbering + scan order, verbatim semantics */ static void walk_and_generate(const struct usb_temp_interface_desc **ifs) { const struct usb_temp_interface_desc *tid; const struct usb_temp_endpoint_desc **ted; uint8_t ifnum = 0xFF; /* usb_template.c:379 */ uint8_t alt = 0; int i, j; for (i = 0; (tid = ifs[i]) != NULL; i++) { if (tid->isAltInterface == 0) { alt = 0; ifnum++; n_ifaces++; if (tid->bInterfaceSubClass == 2) as_ifnum[as_n++] = ifnum; } else { alt++; } printf(" iface#%u alt%u class=%u sub=%u proto=%u " "iInterface=%u%s\n", ifnum, alt, tid->bInterfaceClass, tid->bInterfaceSubClass, tid->bInterfaceProtocol, tid->iInterface, tid->isAltInterface ? " (alt)" : ""); /* iface raw descs first (usb_template.c:318-325) */ if (tid->ppRawDesc) { for (j = 0; tid->ppRawDesc[j] != NULL; j++) gen_raw_desc(tid->ppRawDesc[j], "", ifnum, tid->bInterfaceClass); } /* then endpoint raw descs (usb_template.c:332-338,209-215) */ ted = tid->ppEndpoints; if (ted) { for (j = 0; ted[j] != NULL; j++) { const void **rd = ted[j]->ppRawDesc; int k; if (rd) for (k = 0; rd[k] != NULL; k++) gen_raw_desc(rd[k], "", ifnum, tid->bInterfaceClass); } } } } static int n_misfire, n_corrupt; static void diff_generated(void) { int i; size_t k; printf("\n== (1) generated-vs-authored byte diff " "(usb_make_raw_desc replay) ==\n"); for (i = 0; i < nents; i++) { const uint8_t *g = genbuf + ents[i].off; int hit = 0; for (k = 0; k < ents[i].src[0]; k++) { if (g[k] != ents[i].src[k]) { printf(" MISFIRE %s[%d] bLength=%2u " "type=0x%02x subtype=0x%02x in iface %u:" " byte[%zu] (%s) 0x%02x -> 0x%02x%s\n", ents[i].tname, i, ents[i].src[0], ents[i].src[1], ents[i].src[2], ents[i].ifnum, k, field_of(ents[i].src, k), ents[i].src[k], g[k], ents[i].ifnum ? " <-- CORRUPTED" : ""); hit = 1; n_corrupt += ents[i].ifnum ? 1 : 0; } } if (hit) n_misfire++; } printf(" -> census: %d descriptor(s) satisfy the CDC predicate; " "%d in nonzero interfaces (real deltas); byte diff: %d " "descriptor(s) patched, %d byte(s) with nonzero delta " "(CORRUPTED)\n", n_hit, n_hit_real, n_misfire, n_corrupt); } /* ---- structural checks ---------------------------------------------- */ static void check_raw(const char *name, const uint8_t *raw, size_t n) { CHECK(n >= 2 && raw[0] == n, "S1 %s: bLength(0x%02x) == sizeof(table) (%zu) — " "usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds", name, raw ? raw[0] : 0, n); } static void check_table(const char *name, const void **tbl, size_t n) { size_t i; for (i = 0; i < n; i++) { if (tbl[i] == NULL) { CHECK(i == n - 1, "S2 %s: NULL terminator at slot %zu of %zu — " "no interior hole", name, i, n); return; } } CHECK(0, "S2 %s: MISSING NULL terminator (%zu slots)", name, n); } struct sdesc { uByte bLength; uByte bDescriptorType; uByte bData[252]; } __attribute__((packed)); static void check_str(const char *name, const void *p) { const struct sdesc *s = p; CHECK(s->bDescriptorType == UDESC_STRING && s->bLength >= 2 && (s->bLength - 2) % 2 == 0, "S3 %s: bLength=%u type=0x%02x bData=%u bytes (even) — " "self-sized by USB_MAKE_STRING_DESC", name, s->bLength, s->bDescriptorType, s->bLength - 2); } /* S8: audio graph — collect defined IDs, then resolve every reference */ static void check_graph(void) { const void **tbl = audio_raw_iface_0_desc; uint8_t defined[256]; char refd[256][24]; /* first referencer per ID, for messages */ int i, bad = 0; memset(defined, 0, sizeof(defined)); memset(refd, 0, sizeof(refd)); for (i = 0; tbl[i] != NULL; i++) { const uint8_t *r = tbl[i]; if (r[1] == UDESC_CS_INTERFACE && r[0] >= 4) defined[r[3]] = 1; /* every unit/terminal: ID@3 */ } for (i = 0; tbl[i] != NULL; i++) { const uint8_t *r = tbl[i]; int npins = 0, k; if (r[1] != UDESC_CS_INTERFACE || r[0] < 5) continue; switch (r[2]) { case 0x04: /* mixer unit */ case 0x05: /* selector unit */ npins = r[4]; /* baSourceID at 5.. */ for (k = 0; k < npins && 5 + k < r[0]; k++) if (!defined[r[5 + k]]) { printf(" %s: pin %d -> ID 0x%02x " "UNRESOLVED\n", r[2] == 4 ? "mixer" : "selector", k, r[5 + k]); bad++; } break; case 0x06: /* feature unit */ case 0x03: /* output terminal */ if (!defined[r[4]] && r[4] != 0) { printf(" %s ID 0x%02x: bSourceID " "0x%02x UNRESOLVED\n", r[2] == 6 ? "feature" : "output-term", r[3], r[4]); bad++; } break; default: break; } } CHECK(bad == 0, "S8 AC-interface audio graph: every bSourceID/mixer/selector pin " "resolves to a defined unit/terminal ID (%d unresolved)", bad); } int main(void) { const void *p; int idx, bad = 0; const uint16_t LANG = 0x0409; printf("DF-5555 structural table check — usb_template_audio.c\n"); printf("======================================================\n"); printf("\n== interface numbering walk (usb_template.c:307-314,379) ==\n"); walk_and_generate(audio_config_desc.ppIfaceDesc); diff_generated(); printf("\n== structural invariants ==\n"); /* S1: every raw descriptor table (22) */ check_raw("audio_raw_desc_0", audio_raw_desc_0, sizeof(audio_raw_desc_0)); check_raw("audio_raw_desc_1", audio_raw_desc_1, sizeof(audio_raw_desc_1)); check_raw("audio_raw_desc_2", audio_raw_desc_2, sizeof(audio_raw_desc_2)); check_raw("audio_raw_desc_3", audio_raw_desc_3, sizeof(audio_raw_desc_3)); check_raw("audio_raw_desc_4", audio_raw_desc_4, sizeof(audio_raw_desc_4)); check_raw("audio_raw_desc_5", audio_raw_desc_5, sizeof(audio_raw_desc_5)); check_raw("audio_raw_desc_6", audio_raw_desc_6, sizeof(audio_raw_desc_6)); check_raw("audio_raw_desc_7", audio_raw_desc_7, sizeof(audio_raw_desc_7)); check_raw("audio_raw_desc_8", audio_raw_desc_8, sizeof(audio_raw_desc_8)); check_raw("audio_raw_desc_9", audio_raw_desc_9, sizeof(audio_raw_desc_9)); check_raw("audio_raw_desc_10", audio_raw_desc_10, sizeof(audio_raw_desc_10)); check_raw("audio_raw_desc_11", audio_raw_desc_11, sizeof(audio_raw_desc_11)); check_raw("audio_raw_desc_12", audio_raw_desc_12, sizeof(audio_raw_desc_12)); check_raw("audio_raw_desc_13", audio_raw_desc_13, sizeof(audio_raw_desc_13)); check_raw("audio_raw_desc_14", audio_raw_desc_14, sizeof(audio_raw_desc_14)); check_raw("audio_raw_desc_15", audio_raw_desc_15, sizeof(audio_raw_desc_15)); check_raw("audio_raw_desc_20", audio_raw_desc_20, sizeof(audio_raw_desc_20)); check_raw("audio_raw_desc_21", audio_raw_desc_21, sizeof(audio_raw_desc_21)); check_raw("audio_raw_desc_22", audio_raw_desc_22, sizeof(audio_raw_desc_22)); check_raw("audio_raw_desc_30", audio_raw_desc_30, sizeof(audio_raw_desc_30)); check_raw("audio_raw_desc_31", audio_raw_desc_31, sizeof(audio_raw_desc_31)); check_raw("audio_raw_desc_32", audio_raw_desc_32, sizeof(audio_raw_desc_32)); /* S2: every NULL-terminated pointer table (9) */ check_table("audio_raw_iface_0_desc", audio_raw_iface_0_desc, sizeof(audio_raw_iface_0_desc) / sizeof(void *)); check_table("audio_raw_iface_1_desc", audio_raw_iface_1_desc, sizeof(audio_raw_iface_1_desc) / sizeof(void *)); check_table("audio_raw_ep_1_desc", audio_raw_ep_1_desc, sizeof(audio_raw_ep_1_desc) / sizeof(void *)); check_table("audio_raw_iface_2_desc", audio_raw_iface_2_desc, sizeof(audio_raw_iface_2_desc) / sizeof(void *)); check_table("audio_raw_ep_2_desc", audio_raw_ep_2_desc, sizeof(audio_raw_ep_2_desc) / sizeof(void *)); check_table("audio_iface_1_ep", (const void **)(void *)audio_iface_1_ep, sizeof(audio_iface_1_ep) / sizeof(void *)); check_table("audio_iface_2_ep", (const void **)(void *)audio_iface_2_ep, sizeof(audio_iface_2_ep) / sizeof(void *)); check_table("audio_interfaces", (const void **)(void *)audio_interfaces, sizeof(audio_interfaces) / sizeof(void *)); check_table("audio_configs", (const void **)(void *)audio_configs, sizeof(audio_configs) / sizeof(void *)); /* S3: string descriptors self-sized (5) */ check_str("usb_string_lang_en", &usb_string_lang_en); check_str("string_audio_mixer", &string_audio_mixer); check_str("string_audio_record", &string_audio_record); check_str("string_audio_playback", &string_audio_playback); check_str("string_audio_product", &string_audio_product); /* S4: full 256-index sweep of the EP0-reachable callback */ for (idx = 0; idx < 256; idx++) { p = audio_get_string_desc(LANG, (uint8_t)idx); if (idx == 0 || (idx >= 1 && idx < INDEX_AUDIO_MAX)) { if (p == NULL) bad++; } else if (p != NULL) bad++; } CHECK(bad == 0, "S4 audio_get_string_desc(0x0409, idx): non-NULL exactly for " "0..%d, NULL for %d..255 (bound check audio.c:392)", INDEX_AUDIO_MAX - 1, INDEX_AUDIO_MAX); bad = 0; for (idx = 1; idx < INDEX_AUDIO_MAX; idx++) if (audio_get_string_desc(0x0408, (uint8_t)idx) != NULL || audio_get_string_desc(0x0000, (uint8_t)idx) != NULL || audio_get_string_desc(0xFFFF, (uint8_t)idx) != NULL) bad++; CHECK(bad == 0, "S4 non-0x0409 lang_id -> NULL for all non-zero indexes " "(audio.c:389-391)"); CHECK(audio_get_string_desc(0x1234, 0) == &usb_string_lang_en, "S4 index 0 returns LANG table regardless of lang_id " "(USB-spec correct, audio.c:386-388)"); /* S5: no vendor/HID surface at all */ CHECK(usb_template_audio.getVendorDesc == NULL, "S5 usb_template_audio.getVendorDesc == NULL — the core's " "usb_temp_get_vendor_desc() short-circuits to NULL for every " "stalled EP0 request (usb_template.c:1050-1060); no vendor/" "HID descriptor contract exists to violate"); CHECK(usb_template_audio.getStringDesc == &audio_get_string_desc, "S5 getStringDesc wired to audio_get_string_desc " "(usb_template.c:1086-1109)"); CHECK(usb_template_audio.iProduct == INDEX_AUDIO_PRODUCT && usb_template_audio.iManufacturer == 0 && usb_template_audio.iSerialNumber == 0, "S5 device string indexes in-range of the string table " "(iProduct=%u <= INDEX_AUDIO_MAX-1, iMfr/iSer 0)", usb_template_audio.iProduct); /* S6: hardcoded iface numbers inside raw descriptors vs the walk */ { size_t ac_sum = 0; int j; for (j = 0; audio_raw_iface_0_desc[j] != NULL; j++) ac_sum += ((const uint8_t *)audio_raw_iface_0_desc[j])[0]; CHECK(n_ifaces == 3, "S6 numbering walk yields 3 interfaces (bNumInterface = " "bInterfaceNumber+1 = 3, usb_template.c:404)"); CHECK(as_n == 2 && as_ifnum[0] == 1 && as_ifnum[1] == 2, "S6 AudioStreaming (subclass 2) interfaces are #%d,#%d — " "AC header baInterfaceNr must be {1,2}", as_n > 0 ? as_ifnum[0] : -1, as_n > 1 ? as_ifnum[1] : -1); CHECK(audio_raw_desc_0[7] == 2, "S6 AC header bInCollection(%u) == number of AS " "interfaces (2) — audio_raw_desc_0[7]", audio_raw_desc_0[7]); CHECK(audio_raw_desc_0[8] == 1 && audio_raw_desc_0[9] == 2, "S6 AC header baInterfaceNr == {1,2} — the core never " "renumbers these bytes, so they must match the walk " "(audio_raw_desc_0[8..9])"); CHECK((audio_raw_desc_0[5] | (audio_raw_desc_0[6] << 8)) == ac_sum, "S6 AC header wTotalLength(0x%02x%02x = %zu) == sum of " "the %d AC-interface CS_INTERFACE lengths (%zu)", audio_raw_desc_0[6], audio_raw_desc_0[5], (size_t)(audio_raw_desc_0[5] | (audio_raw_desc_0[6] << 8)), j, ac_sum); } /* S7: speed tables */ CHECK(audio_isoc_mps.mps[USB_SPEED_FULL] != 0 && audio_isoc_mps.mps[USB_SPEED_HIGH] != 0 && USB_SPEED_FULL < USB_SPEED_MAX && USB_SPEED_HIGH < USB_SPEED_MAX, "S7 audio_isoc_mps: FULL/HIGH nonzero (0x%x/0x%x) and in-bounds " "of mps[USB_SPEED_MAX]; LOW/VARIABLE/SUPER -> 0 -> core fails " "closed with USB_ERR_INVAL (usb_template.c:221-229)", audio_isoc_mps.mps[USB_SPEED_FULL], audio_isoc_mps.mps[USB_SPEED_HIGH]); CHECK(audio_isoc_interval.bInterval[USB_SPEED_FULL] == 1 && audio_isoc_interval.bInterval[USB_SPEED_HIGH] == 4, "S7 audio_isoc_interval: FULL=1 (1:1), HIGH=4 (1:8) — " "in-bounds of bInterval[USB_SPEED_MAX]"); /* S8: audio graph integrity */ check_graph(); printf("\n======================================================\n"); if (fails == 0) printf("ALL STRUCTURAL CHECKS PASSED (%s)\n", #ifdef FIX_CLASSGATE "FIX_CLASSGATE: CDC patcher gated on CDC interface classes" " -> misfires above must be absent"); #else "file is clean on S1-S8; the CORRUPTED lines above are " "DF-5555: bDelay 3->4 (iface 1, audio_raw_desc_20) and " "1->3 (iface 2, audio_raw_desc_30) are real nonzero " "deltas; seven iface-0 misfires add 0"); #endif else printf("%d STRUCTURAL CHECK(S) FAILED\n", fails); return (fails == 0) ? 0 : 1; }