From 954bd312f9108e0f4583e8a71c874abc5e8916c8 Mon Sep 17 00:00:00 2001 From: m00nbsd <42475391+m00nbsd@users.noreply.github.com> Date: Fri, 29 May 2020 20:11:50 +0200 Subject: sys/netbsd: improve vusb.txt --- sys/netbsd/vusb.txt | 1309 ++++++++++++++++++++++++++++++++++++++++++- sys/netbsd/vusb_amd64.const | 294 ++++++++++ 2 files changed, 1601 insertions(+), 2 deletions(-) create mode 100644 sys/netbsd/vusb_amd64.const (limited to 'sys') diff --git a/sys/netbsd/vusb.txt b/sys/netbsd/vusb.txt index 866b8ceeb..8a7982405 100644 --- a/sys/netbsd/vusb.txt +++ b/sys/netbsd/vusb.txt @@ -1,11 +1,1316 @@ -# Copyright 2020 syzkaller project authors. All rights reserved. +# Copyright 2019 syzkaller project authors. All rights reserved. # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. +# General redefinitions, taken from the Linux headers. + +# ch9.h +define USB_DIR_OUT 0 +define USB_DIR_IN 0x80 +define USB_TYPE_MASK (0x03 << 5) +define USB_TYPE_STANDARD (0x00 << 5) +define USB_TYPE_CLASS (0x01 << 5) +define USB_TYPE_VENDOR (0x02 << 5) +define USB_TYPE_RESERVED (0x03 << 5) +define USB_DT_DEVICE 0x01 +define USB_DT_CONFIG 0x02 +define USB_DT_STRING 0x03 +define USB_DT_INTERFACE 0x04 +define USB_DT_ENDPOINT 0x05 +define USB_DT_DEVICE_QUALIFIER 0x06 +define USB_DT_OTHER_SPEED_CONFIG 0x07 +define USB_DT_INTERFACE_POWER 0x08 +define USB_DT_OTG 0x09 +define USB_DT_DEBUG 0x0a +define USB_DT_INTERFACE_ASSOCIATION 0x0b +define USB_DT_SECURITY 0x0c +define USB_DT_KEY 0x0d +define USB_DT_ENCRYPTION_TYPE 0x0e +define USB_DT_BOS 0x0f +define USB_DT_DEVICE_CAPABILITY 0x10 +define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 +define USB_DT_WIRE_ADAPTER 0x21 +define USB_DT_RPIPE 0x22 +define USB_DT_CS_RADIO_CONTROL 0x23 +define USB_DT_PIPE_USAGE 0x24 +define USB_DT_SS_ENDPOINT_COMP 0x30 +define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 +define USB_DT_CS_DEVICE (USB_TYPE_CLASS | USB_DT_DEVICE) +define USB_DT_CS_CONFIG (USB_TYPE_CLASS | USB_DT_CONFIG) +define USB_DT_CS_STRING (USB_TYPE_CLASS | USB_DT_STRING) +define USB_DT_CS_INTERFACE (USB_TYPE_CLASS | USB_DT_INTERFACE) +define USB_DT_CS_ENDPOINT (USB_TYPE_CLASS | USB_DT_ENDPOINT) +define USB_CLASS_PER_INTERFACE 0 +define USB_CLASS_AUDIO 1 +define USB_CLASS_COMM 2 +define USB_CLASS_HID 3 +define USB_CLASS_PHYSICAL 5 +define USB_CLASS_STILL_IMAGE 6 +define USB_CLASS_PRINTER 7 +define USB_CLASS_MASS_STORAGE 8 +define USB_CLASS_HUB 9 +define USB_CLASS_CDC_DATA 0x0a +define USB_CLASS_CSCID 0x0b +define USB_CLASS_CONTENT_SEC 0x0d +define USB_CLASS_VIDEO 0x0e +define USB_CLASS_WIRELESS_CONTROLLER 0xe0 +define USB_CLASS_MISC 0xef +define USB_CLASS_APP_SPEC 0xfe +define USB_CLASS_VENDOR_SPEC 0xff +define USB_SUBCLASS_VENDOR_SPEC 0xff +define USB_ENDPOINT_NUMBER_MASK 0x0f +define USB_ENDPOINT_DIR_MASK 0x80 +define USB_ENDPOINT_XFERTYPE_MASK 0x03 +define USB_ENDPOINT_XFER_CONTROL 0 +define USB_ENDPOINT_XFER_ISOC 1 +define USB_ENDPOINT_XFER_BULK 2 +define USB_ENDPOINT_XFER_INT 3 +define USB_ENDPOINT_MAX_ADJUSTABLE 0x80 +define USB_ENDPOINT_MAXP_MASK 0x07ff +define USB_EP_MAXP_MULT_SHIFT 11 +define USB_EP_MAXP_MULT_MASK (3 << USB_EP_MAXP_MULT_SHIFT) +define USB_ENDPOINT_INTRTYPE 0x30 +define USB_ENDPOINT_INTR_PERIODIC (0 << 4) +define USB_ENDPOINT_INTR_NOTIFICATION (1 << 4) +define USB_ENDPOINT_SYNCTYPE 0x0c +define USB_ENDPOINT_SYNC_NONE (0 << 2) +define USB_ENDPOINT_SYNC_ASYNC (1 << 2) +define USB_ENDPOINT_SYNC_ADAPTIVE (2 << 2) +define USB_ENDPOINT_SYNC_SYNC (3 << 2) +define USB_ENDPOINT_USAGE_MASK 0x30 +define USB_ENDPOINT_USAGE_DATA 0x00 +define USB_ENDPOINT_USAGE_FEEDBACK 0x10 +define USB_ENDPOINT_USAGE_IMPLICIT_FB 0x20 + +# hid.h +define USB_INTERFACE_CLASS_HID 3 +define USB_INTERFACE_SUBCLASS_BOOT 1 +define USB_INTERFACE_PROTOCOL_KEYBOARD 1 +define USB_INTERFACE_PROTOCOL_MOUSE 2 +define HID_REQ_GET_REPORT 0x01 +define HID_REQ_GET_IDLE 0x02 +define HID_REQ_GET_PROTOCOL 0x03 +define HID_REQ_SET_REPORT 0x09 +define HID_REQ_SET_IDLE 0x0A +define HID_REQ_SET_PROTOCOL 0x0B +define HID_DT_HID (USB_TYPE_CLASS | 0x01) +define HID_DT_REPORT (USB_TYPE_CLASS | 0x02) +define HID_DT_PHYSICAL (USB_TYPE_CLASS | 0x03) +define HID_MAX_DESCRIPTOR_SIZE 4096 + +# cdc.h +define USB_CDC_HEADER_TYPE 0x00 +define USB_CDC_CALL_MANAGEMENT_TYPE 0x01 +define USB_CDC_ACM_TYPE 0x02 +define USB_CDC_UNION_TYPE 0x06 +define USB_CDC_COUNTRY_TYPE 0x07 +define USB_CDC_NETWORK_TERMINAL_TYPE 0x0a +define USB_CDC_ETHERNET_TYPE 0x0f +define USB_CDC_WHCM_TYPE 0x11 +define USB_CDC_MDLM_TYPE 0x12 +define USB_CDC_MDLM_DETAIL_TYPE 0x13 +define USB_CDC_DMM_TYPE 0x14 +define USB_CDC_OBEX_TYPE 0x15 +define USB_CDC_NCM_TYPE 0x1a +define USB_CDC_MBIM_TYPE 0x1b +define USB_CDC_MBIM_EXTENDED_TYPE 0x1c +define USB_CDC_PROTO_NONE 0 + +# ------------------------------------------------------------------------------ + # This is a special fd for USB fuzzing and should only be used with syz_usb_* pseudo-syscalls. # We don't inherit it from the fd resource, to discourage syzkaller calling raw ioctls on it. resource fd_usb[int32]: -1 # These are generic pseudo-syscalls for emulating arbitrary USB devices. # They are mostly targeted to cover the enumeration process. -syz_usb_connect(speed intptr, dev_len len[dev], dev buffer[in], conn_descs buffer[in]) fd_usb (timeout[3000], prog_timeout[3000]) +syz_usb_connect(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb (timeout[3000], prog_timeout[3000]) syz_usb_disconnect(fd fd_usb) (timeout[300]) + +define USB_SPEED_UNKNOWN 1 +define USB_SPEED_LOW 2 +define USB_SPEED_FULL 3 +define USB_SPEED_HIGH 4 +define USB_SPEED_WIRELESS 5 +define USB_SPEED_SUPER 6 +define USB_SPEED_SUPER_PLUS 7 +usb_device_speed = USB_SPEED_UNKNOWN, USB_SPEED_LOW, USB_SPEED_FULL, USB_SPEED_HIGH, USB_SPEED_WIRELESS, USB_SPEED_SUPER, USB_SPEED_SUPER_PLUS + +# TODO: consider patching idVendor and idProduct for all class specific descriptions in Go code to cover more drivers. +# TODO: custom syz_usb_ep_write() descriptions for all class specific descriptions. +# TODO: consider adding custom vusb_connect_descriptors definitions to all class specific descriptions. + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +define USB_DT_DEVICE_SIZE 18 +type usb_device_descriptor_verbose_t[USB, CLASS, SUBCLASS, PROTOCOL, PACKET, VENDOR, PRODUCT, DEVICE, CFS] { + bLength const[USB_DT_DEVICE_SIZE, int8] + bDescriptorType const[USB_DT_DEVICE, int8] + + bcdUSB USB + bDeviceClass const[CLASS, int8] + bDeviceSubClass const[SUBCLASS, int8] + bDeviceProtocol const[PROTOCOL, int8] + bMaxPacketSize0 PACKET + idVendor const[VENDOR, int16] + idProduct const[PRODUCT, int16] + bcdDevice const[DEVICE, int16] + iManufacturer const[1, int8] + iProduct const[2, int8] + iSerialNumber const[3, int8] + bNumConfigurations len[configs, int8] + + configs CFS +} [packed] + +type usb_device_descriptor_t[CLASS, SUBCLASS, PROTOCOL, VENDOR, PRODUCT, DEVICE, CFS] usb_device_descriptor_verbose_t[flags[usb_versions, int16], CLASS, SUBCLASS, PROTOCOL, flags[usb_device_max_packet_sizes, int8], VENDOR, PRODUCT, DEVICE, CFS] + +usb_versions = 0x110, 0x200, 0x201, 0x250, 0x300, 0x310 + +# https://elixir.bootlin.com/linux/v5.1.7/source/drivers/usb/core/hub.c#L4661 +usb_device_max_packet_sizes = 8, 16, 32, 64, 255 + +define USB_DT_CONFIG_SIZE 9 +type usb_config_descriptor_verbose_t[NUM, IFSNUM, ICONFIG, ATTRS, POWER, IFS] { + bLength const[USB_DT_CONFIG_SIZE, int8] + bDescriptorType const[USB_DT_CONFIG, int8] + + wTotalLength len[parent, int16] + bNumInterfaces IFSNUM + bConfigurationValue NUM + iConfiguration ICONFIG + bmAttributes ATTRS + bMaxPower POWER + + interfaces IFS +} [packed] + +type usb_config_descriptor_t[NUM, IFSNUM, IFS] usb_config_descriptor_verbose_t[NUM, IFSNUM, int8, flags[usb_config_attributes, int8], int8, IFS] +type usb_config_descriptor_ifaces_array_t[NUM, IFS] usb_config_descriptor_t[NUM, len[interfaces, int8], IFS] + +define USB_DT_INTERFACE_SIZE 9 +type usb_interface_descriptor_verbose_t[IFNUM, ALTNUM, EPSNUM, CLASS, SUBCLASS, PROTOCOL, IIF, EXTRA, EPS] { + bLength const[USB_DT_INTERFACE_SIZE, int8] + bDescriptorType const[USB_DT_INTERFACE, int8] + + bInterfaceNumber IFNUM + bAlternateSetting ALTNUM + bNumEndpoints EPSNUM + bInterfaceClass CLASS + bInterfaceSubClass SUBCLASS + bInterfaceProtocol PROTOCOL + iInterface IIF + + extra EXTRA + endpoints EPS +} [packed] + +type usb_interface_descriptor_t[IFNUM, ALTNUM, EPSNUM, CLASS, SUBCLASS, PROTOCOL, EXTRA, EPS] usb_interface_descriptor_verbose_t[IFNUM, ALTNUM, EPSNUM, CLASS, SUBCLASS, PROTOCOL, int8, EXTRA, EPS] +type usb_interface_descriptor_eps_array_t[IFNUM, ALTNUM, CLASS, SUBCLASS, PROTOCOL, EXTRA, EPS] usb_interface_descriptor_t[IFNUM, ALTNUM, len[endpoints, int8], CLASS, SUBCLASS, PROTOCOL, EXTRA, EPS] +type usb_interface_descriptor_fixed_t[IFNUM, ALTNUM, EPSNUM, CLASS, SUBCLASS, PROTOCOL, EXTRA, EPS] usb_interface_descriptor_verbose_t[const[IFNUM, int8], const[ALTNUM, int8], const[EPSNUM, int8], const[CLASS, int8], const[SUBCLASS, int8], const[PROTOCOL, int8], const[0, int8], EXTRA, EPS] + +# TODO: non-audio endpoints have USB_DT_ENDPOINT_SIZE. +define USB_DT_ENDPOINT_AUDIO_SIZE 9 +type usb_endpoint_descriptor_verbose_t[ADDR, ATTRS, PACKET, INTERVAL, REFRESH, SYNCH, EXTRA] { + bLength const[USB_DT_ENDPOINT_AUDIO_SIZE, int8] + bDescriptorType const[USB_DT_ENDPOINT, int8] + + bEndpointAddress ADDR + bmAttributes ATTRS + wMaxPacketSize PACKET + bInterval INTERVAL + + bRefresh REFRESH + bSynchAddress SYNCH + + extra EXTRA +} [packed] + +type usb_endpoint_descriptor_t[ADDR, ATTRS, EXTRA] usb_endpoint_descriptor_verbose_t[ADDR, ATTRS, flags[usb_endpoint_max_packet_sizes, int16], int8, int8, int8, EXTRA] + +# TODO: dummy driver has complex requirements for packet sizes, account for those: +# https://elixir.bootlin.com/linux/v5.3.6/source/drivers/usb/gadget/udc/dummy_hcd.c#L497 +usb_endpoint_max_packet_sizes = 8, 16, 32, 64, 512, 1023, 1024 + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# Generic USB device, configuration, interface and endpoint descriptors. + +# We only support one configuration per device. +# bDeviceClass, bDeviceSubClass, bDeviceProtocol, idVendor, idProduct +# and bcdDevice are patched by Go code, see sys/linux/init_vusb.go. +usb_device_descriptor { + inner usb_device_descriptor_t[0, 0, 0, 0, 0, 0, array[usb_config_descriptor, 1]] +} [packed] + +usb_config_descriptor { + inner usb_config_descriptor_ifaces_array_t[int8, array[usb_interface_descriptor, 1:4]] +} [packed] + +define USB_CONFIG_ATT_ONE (1 << 7) +define USB_CONFIG_ATT_SELFPOWER (1 << 6) +define USB_CONFIG_ATT_WAKEUP (1 << 5) +define USB_CONFIG_ATT_BATTERY (1 << 4) +usb_config_attributes = USB_CONFIG_ATT_ONE, USB_CONFIG_ATT_SELFPOWER, USB_CONFIG_ATT_WAKEUP, USB_CONFIG_ATT_BATTERY + +# bInterfaceNumber, bInterfaceClass, bInterfaceSubClass and bInterfaceProtocol +# are patched by Go code, see sys/linux/init_vusb.go. +usb_interface_descriptor { + inner usb_interface_descriptor_eps_array_t[int8, int8, const[0, int8], const[0, int8], const[0, int8], array[usb_interface_extra_descriptor, 0:2], array[usb_endpoint_descriptor, 0:16]] +} [packed] + +usb_endpoint_descriptor { + inner usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], flags[usb_endpoint_attributes, int8], array[usb_endpoint_extra_descriptor, 0:2]] +} [packed] + +usb_endpoint_addresses = 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, USB_DIR_OUT, USB_DIR_IN + +usb_endpoint_attributes = USB_ENDPOINT_XFER_CONTROL, USB_ENDPOINT_XFER_ISOC, USB_ENDPOINT_XFER_BULK, USB_ENDPOINT_XFER_INT, USB_ENDPOINT_INTR_PERIODIC, USB_ENDPOINT_INTR_NOTIFICATION, USB_ENDPOINT_SYNC_NONE, USB_ENDPOINT_SYNC_ASYNC, USB_ENDPOINT_SYNC_ADAPTIVE, USB_ENDPOINT_SYNC_SYNC, USB_ENDPOINT_USAGE_DATA, USB_ENDPOINT_USAGE_FEEDBACK, USB_ENDPOINT_USAGE_FEEDBACK + +vusb_connect_descriptors { + qual_len len[qual, int32] + qual ptr[in, usb_qualifier_descriptor] + bos_len len[bos, int32] + bos ptr[in, usb_bos_descriptor] + strs_len len[strs, int32] + strs array[vusb_connect_string_descriptor] +} [packed] + +vusb_connect_string_descriptor { + len len[str, int32] + str ptr[in, usb_string_descriptor] +} [packed] + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# USB descriptors requested by the kernel before the SET_CONFIGURATION request. + +# TODO: figure out when is the USB_DT_OTG descriptor used. +# TODO: figure out when is the USB_DT_INTERFACE_ASSOCIATION descriptor used. +# TODO: figure out when is the USB_DT_BOS descriptor used. + +type usb_string_descriptor_t[DATA] { + bLength len[parent, int8] + bDescriptorType const[USB_DT_STRING, int8] + + data DATA +} [packed] + +usb_string_descriptor [ + lang_id usb_string_descriptor_t[flags[usb_lang_ids, int16]] + string usb_string_descriptor_t[array[int8, 0:256]] +] [varlen] + +usb_lang_ids = 0x436, 0x41c, 0x401, 0x801, 0xc01, 0x1001, 0x1401, 0x1801, 0x1c01, 0x2001, 0x2401, 0x2801, 0x2c01, 0x3001, 0x3401, 0x3801, 0x3c01, 0x4001, 0x42b, 0x44d, 0x42c, 0x82c, 0x42d, 0x423, 0x445, 0x402, 0x455, 0x403, 0x404, 0x804, 0xc04, 0x1004, 0x1404, 0x41a, 0x405, 0x406, 0x413, 0x813, 0x409, 0x809, 0xc09, 0x1009, 0x1409, 0x1809, 0x1c09, 0x2009, 0x2409, 0x2809, 0x2c09, 0x3009, 0x3409, 0x425, 0x438, 0x429, 0x40b, 0x40c, 0x80c, 0xc0c, 0x100c, 0x140c, 0x180c, 0x437, 0x407, 0x807, 0xc07, 0x1007, 0x1407, 0x408, 0x447, 0x40d, 0x439, 0x40e, 0x40f, 0x421, 0x410, 0x810, 0x411, 0x44b, 0x860, 0x43f, 0x457, 0x412, 0x812, 0x426, 0x427, 0x827, 0x42f, 0x43e, 0x83e, 0x44c, 0x458, 0x44e, 0x861, 0x414, 0x814, 0x448, 0x415, 0x416, 0x816, 0x446, 0x418, 0x419, 0x44f, 0xc1a, 0x81a, 0x459, 0x41b, 0x424, 0x40a, 0x80a, 0xc0a, 0x100a, 0x140a, 0x180a, 0x1c0a, 0x200a, 0x240a, 0x280a, 0x2c0a, 0x300a, 0x340a, 0x380a, 0x3c0a, 0x400a, 0x440a, 0x480a, 0x4c0a, 0x500a, 0x430, 0x441, 0x41d, 0x81d, 0x449, 0x444, 0x44a, 0x41e, 0x41f, 0x422, 0x420, 0x820, 0x443, 0x843, 0x42a, 0x4ff, 0xf0ff, 0xf4ff, 0xf8ff, 0xfcff + +usb_qualifier_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_DEVICE_QUALIFIER, int8] + + bcdUSB flags[usb_versions, int16] + bDeviceClass int8 + bDeviceSubClass int8 + bDeviceProtocol int8 + bMaxPacketSize0 flags[usb_device_max_packet_sizes, int8] + bNumConfigurations int8 + bRESERVED const[0, int8] +} [packed] + +define USB_DT_BOS_SIZE 5 + +usb_bos_descriptor { + bLength const[USB_DT_BOS_SIZE, int8] + bDescriptorType const[USB_DT_BOS, int8] + + wTotalLength len[parent, int16] + bNumDeviceCaps len[caps, int8] + + caps array[usb_dev_cap, 0:6] +} [packed] + +usb_dev_cap [ + generic usb_generic_cap_descriptor + wireless usb_wireless_cap_descriptor + ext_cap usb_ext_cap_descriptor + ss_cap usb_ss_cap_descriptor + ss_container_id usb_ss_container_id_descriptor + ssp_cap usb_ssp_cap_descriptor + ptm_cap usb_ptm_cap_descriptor +] [varlen] + +usb_generic_cap_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_DEVICE_CAPABILITY, int8] + bDevCapabilityType flags[usb_capability_types, int8] + + data array[int8, 0:256] +} [packed] + +define USB_CAP_TYPE_WIRELESS_USB 1 +define USB_CAP_TYPE_EXT 2 +define USB_SS_CAP_TYPE 3 +define USB_SSP_CAP_TYPE 0xa +define CONTAINER_ID_TYPE 4 +define USB_PTM_CAP_TYPE 0xb +usb_capability_types = USB_CAP_TYPE_WIRELESS_USB, USB_CAP_TYPE_EXT, USB_SS_CAP_TYPE, USB_SSP_CAP_TYPE, CONTAINER_ID_TYPE, USB_PTM_CAP_TYPE + +usb_wireless_cap_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_DEVICE_CAPABILITY, int8] + bDevCapabilityType const[USB_CAP_TYPE_WIRELESS_USB, int8] + + bmAttributes flags[usb_wireless_cap_attributes, int8] + wPHYRates flags[usb_wireless_cap_phyrates, int16] + bmTFITXPowerInfo int8 + bmFFITXPowerInfo int8 + bmBandGroup int16 + bReserved int8 +} [packed] + +define USB_WIRELESS_P2P_DRD (1 << 1) +define USB_WIRELESS_BEACON_MASK (3 << 2) +define USB_WIRELESS_BEACON_SELF (1 << 2) +define USB_WIRELESS_BEACON_DIRECTED (2 << 2) +define USB_WIRELESS_BEACON_NONE (3 << 2) +usb_wireless_cap_attributes = USB_WIRELESS_P2P_DRD, USB_WIRELESS_BEACON_MASK, USB_WIRELESS_BEACON_SELF, USB_WIRELESS_BEACON_DIRECTED, USB_WIRELESS_BEACON_NONE + +define USB_WIRELESS_PHY_53 (1 << 0) +define USB_WIRELESS_PHY_80 (1 << 1) +define USB_WIRELESS_PHY_107 (1 << 2) +define USB_WIRELESS_PHY_160 (1 << 3) +define USB_WIRELESS_PHY_200 (1 << 4) +define USB_WIRELESS_PHY_320 (1 << 5) +define USB_WIRELESS_PHY_400 (1 << 6) +define USB_WIRELESS_PHY_480 (1 << 7) +usb_wireless_cap_phyrates = USB_WIRELESS_PHY_53, USB_WIRELESS_PHY_80, USB_WIRELESS_PHY_107, USB_WIRELESS_PHY_160, USB_WIRELESS_PHY_200, USB_WIRELESS_PHY_320, USB_WIRELESS_PHY_400, USB_WIRELESS_PHY_480 + +usb_ext_cap_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_DEVICE_CAPABILITY, int8] + bDevCapabilityType const[USB_CAP_TYPE_EXT, int8] + + bmAttributes1 flags[usb_ext_cap_attributes, int32:8] + bmAttributes2 int32:4 + bmAttributes3 int32:4 + bmAttributes4 int32:16 +} [packed] + +define USB_LPM_SUPPORT (1 << 1) +define USB_BESL_SUPPORT (1 << 2) +define USB_BESL_BASELINE_VALID (1 << 3) +define USB_BESL_DEEP_VALID (1 << 4) +usb_ext_cap_attributes = USB_LPM_SUPPORT, USB_BESL_SUPPORT, USB_BESL_BASELINE_VALID, USB_BESL_DEEP_VALID + +usb_ss_cap_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_DEVICE_CAPABILITY, int8] + bDevCapabilityType const[USB_SS_CAP_TYPE, int8] + + bmAttributes flags[usb_ss_cap_attributes, int8] + wSpeedSupported flags[usb_ss_cap_speed, int16] + bFunctionalitySupport int8 + bU1devExitLat int8 + bU2DevExitLat int16 +} [packed] + +define USB_LTM_SUPPORT (1 << 1) +usb_ss_cap_attributes = USB_LTM_SUPPORT + +define USB_LOW_SPEED_OPERATION (1) +define USB_FULL_SPEED_OPERATION (1 << 1) +define USB_HIGH_SPEED_OPERATION (1 << 2) +define USB_5GBPS_OPERATION (1 << 3) +usb_ss_cap_speed = USB_LOW_SPEED_OPERATION, USB_FULL_SPEED_OPERATION, USB_HIGH_SPEED_OPERATION, USB_5GBPS_OPERATION + +usb_ss_container_id_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_DEVICE_CAPABILITY, int8] + bDevCapabilityType const[CONTAINER_ID_TYPE, int8] + + bReserved int8 + ContainerID array[int8, 16] +} [packed] + +usb_ssp_cap_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_DEVICE_CAPABILITY, int8] + bDevCapabilityType const[USB_SSP_CAP_TYPE, int8] + + bReserved int8 + bmAttributesSublinkSpeeds len[bmSublinkSpeedAttr, int32:5] + bmAttributesSpeedIDs int32:27 + wFunctionalitySupport flags[usb_ssp_cap_funcs, int16] + wReserved int16 + bmSublinkSpeedAttr array[flags[usb_ssp_cap_sublink_speeds, int32], 0:6] +} [packed] + +define USB_SSP_MIN_SUBLINK_SPEED_ATTRIBUTE_ID (0xf) +define USB_SSP_MIN_RX_LANE_COUNT (0xf << 8) +define USB_SSP_MIN_TX_LANE_COUNT (0xf << 12) +usb_ssp_cap_funcs = USB_SSP_MIN_SUBLINK_SPEED_ATTRIBUTE_ID, USB_SSP_MIN_RX_LANE_COUNT, USB_SSP_MIN_TX_LANE_COUNT + +define USB_SSP_SUBLINK_SPEED_SSID (0xf) +define USB_SSP_SUBLINK_SPEED_LSE (0x3 << 4) +define USB_SSP_SUBLINK_SPEED_ST (0x3 << 6) +define USB_SSP_SUBLINK_SPEED_RSVD (0x3f << 8) +define USB_SSP_SUBLINK_SPEED_LP (0x3 << 14) +define USB_SSP_SUBLINK_SPEED_LSM (0xff << 16) +usb_ssp_cap_sublink_speeds = USB_SSP_SUBLINK_SPEED_SSID, USB_SSP_SUBLINK_SPEED_LSE, USB_SSP_SUBLINK_SPEED_ST, USB_SSP_SUBLINK_SPEED_RSVD, USB_SSP_SUBLINK_SPEED_LP, USB_SSP_SUBLINK_SPEED_LSM + +usb_ptm_cap_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_DEVICE_CAPABILITY, int8] + bDevCapabilityType const[USB_PTM_CAP_TYPE, int8] +} [packed] + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# Extra USB descriptors that come after an interface or an endpoint descriptor. + +# TODO: consider removing class specific descriptors here for described classes. +usb_interface_extra_descriptor [ + generic usb_generic_descriptor + hid_hid usb_hid_descriptor_hid + cdc_ecm usb_cdc_header_ecm + cdc_ncm usb_cdc_header_ncm + uac_control uac_control_iface_extra_descriptors + uac_as uac_as_iface_extra_descriptors +] [varlen] + +usb_endpoint_extra_descriptor [ + generic usb_generic_descriptor + uac_iso uac_iso_endpoint_descriptor +] [varlen] + +usb_generic_descriptor { + bLength len[parent, int8] + bDescriptorType flags[usb_descriptor_types, int8] + + data array[int8, 0:256] +} [packed] + +usb_descriptor_types = USB_DT_DEVICE, USB_DT_CONFIG, USB_DT_STRING, USB_DT_INTERFACE, USB_DT_ENDPOINT, USB_DT_DEVICE_QUALIFIER, USB_DT_OTHER_SPEED_CONFIG, USB_DT_INTERFACE_POWER, USB_DT_OTG, USB_DT_DEBUG, USB_DT_INTERFACE_ASSOCIATION, USB_DT_SECURITY, USB_DT_KEY, USB_DT_ENCRYPTION_TYPE, USB_DT_BOS, USB_DT_DEVICE_CAPABILITY, USB_DT_WIRELESS_ENDPOINT_COMP, USB_DT_WIRE_ADAPTER, USB_DT_RPIPE, USB_DT_CS_RADIO_CONTROL, USB_DT_PIPE_USAGE, USB_DT_SS_ENDPOINT_COMP, USB_DT_SSP_ISOC_ENDPOINT_COMP, HID_DT_HID, HID_DT_REPORT, HID_DT_PHYSICAL + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# USB descriptors requested after the SET_CONFIGURATION request. + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# Replies to USB control requests requested after the SET_CONFIGURATION request. + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# HID device class specific descriptions. +# https://www.usb.org/sites/default/files/documents/hid1_11.pdf +# https://elixir.bootlin.com/linux/latest/source/drivers/hid/usbhid/hid-core.c +# https://elixir.bootlin.com/linux/latest/source/drivers/hid/hid-core.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/hid.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_hid.c + +# Connected HID devices are known to create the following /dev/ files: +# /dev/hidraw#, /dev/usb/hiddev# and /dev/input/event#. + +resource fd_usb_hid[fd_usb] + +syz_usb_connect$hid(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_hid], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_hid (timeout[3000], prog_timeout[3000]) + +# idVendor and idProduct are patched by Go code, see sys/linux/init_vusb.go. +usb_device_descriptor_hid { + inner usb_device_descriptor_t[0, 0, 0, 0, 0, 64, array[usb_config_descriptor_hid, 1]] +} [packed] + +usb_config_descriptor_hid { + inner usb_config_descriptor_ifaces_array_t[const[1, int8], array[usb_interface_descriptor_hid, 1]] +} [packed] + +usb_interface_descriptor_hid { + inner usb_interface_descriptor_t[const[0, int8], int8, int8[1:2], const[USB_CLASS_HID, int8], const[USB_INTERFACE_SUBCLASS_BOOT, int8], flags[usb_hid_protocols, int8], usb_hid_descriptor_hid, usb_endpoint_descriptors_hid] +} [packed] + +usb_hid_protocols = USB_INTERFACE_PROTOCOL_KEYBOARD, USB_INTERFACE_PROTOCOL_MOUSE + +usb_endpoint_descriptors_hid { + in usb_endpoint_descriptor_hid_in + out array[usb_endpoint_descriptor_hid_out, 0:1] +} [packed] + +usb_endpoint_descriptor_hid_in { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_HID_IN_ADDRESS, int8], const[USB_ENDPOINT_HID_ATTRIBUTES, int8], void] +} [packed] + +usb_endpoint_descriptor_hid_out { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_HID_OUT_ADDRESS, int8], const[USB_ENDPOINT_HID_ATTRIBUTES, int8], void] +} [packed] + +define USB_ENDPOINT_HID_ATTRIBUTES (USB_ENDPOINT_XFER_INT) +define USB_ENDPOINT_HID_IN_ADDRESS (1 | USB_DIR_IN) +define USB_ENDPOINT_HID_OUT_ADDRESS (2) + +# USB HID specifications allows for multiple report and physical descriptors +# to be present, but I don't see any support for them in the Linux kernel, +# except for a single report descriptor. +usb_hid_descriptor_hid { + bLength len[parent, int8] + bDescriptorType const[HID_DT_HID, int8] + + bcdHID int16 + bCountryCode int8 + bNumDescriptors const[1, int8] + + report_desc usb_hid_class_descriptor_report +} [packed] + +usb_hid_class_descriptor_report { + bDescriptorType const[HID_DT_REPORT, int8] + wDescriptorLength int16[0:HID_MAX_DESCRIPTOR_SIZE] +} [packed] + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# PRINTER device class specific descriptions. +# https://www.usb.org/sites/default/files/usbprint11a021811.pdf +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/class/usblp.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/printer.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_printer.c + +# Connected PRINTER devices are known to create the following /dev/ files: +# /dev/usb/lp#. +# TODO: write descriptions for those. + +# drivers/usb/class/usblp.c +define USBLP_REQ_GET_ID 0x00 +define USBLP_REQ_GET_STATUS 0x01 +define USBLP_REQ_RESET 0x02 +define USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST 0x00 +define USBLP_FIRST_PROTOCOL 1 +define USBLP_LAST_PROTOCOL 3 + +resource fd_usb_printer[fd_usb] + +syz_usb_connect$printer(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_printer], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_printer (timeout[3000], prog_timeout[3000]) + +usb_device_descriptor_printer { + inner usb_device_descriptor_t[0, 0, 0, 0x525, 0xa4a8, 64, array[usb_config_descriptor_printer, 1]] +} [packed] + +usb_config_descriptor_printer { + inner usb_config_descriptor_ifaces_array_t[const[1, int8], array[usb_interface_descriptor_printer, 1]] +} [packed] + +usb_interface_descriptor_printer { + inner usb_interface_descriptor_t[const[0, int8], int8, int8[1:2], const[USB_CLASS_PRINTER, int8], const[1, int8], int8[USBLP_FIRST_PROTOCOL:USBLP_LAST_PROTOCOL], void, usb_endpoint_descriptors_printer] +} [packed] + +usb_endpoint_descriptors_printer { + in usb_endpoint_descriptor_printer_out + out array[usb_endpoint_descriptor_printer_in, 0:1] +} [packed] + +usb_endpoint_descriptor_printer_out { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_PRINTER_OUT_ADDRESS, int8], const[USB_ENDPOINT_PRINTER_ATTRIBUTES, int8], void] +} [packed] + +usb_endpoint_descriptor_printer_in { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_PRINTER_IN_ADDRESS, int8], const[USB_ENDPOINT_PRINTER_ATTRIBUTES, int8], void] +} [packed] + +define USB_ENDPOINT_PRINTER_ATTRIBUTES (USB_ENDPOINT_XFER_BULK) +define USB_ENDPOINT_PRINTER_OUT_ADDRESS (1) +define USB_ENDPOINT_PRINTER_IN_ADDRESS (2 | USB_DIR_IN) + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# CDC ECM (Ethernet) device class specific descriptions. +# https://www.usb.org/document-library/class-definitions-communication-devices-12 +# https://elixir.bootlin.com/linux/latest/source/drivers/net/usb/cdc_ether.c +# https://elixir.bootlin.com/linux/latest/source/drivers/net/usb/usbnet.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/ether.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_ecm.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/u_ether.c + +# Connected CDC ECM devices are known to create usbN network interfaces. +# TODO: write descriptions for those. + +resource fd_usb_cdc_ecm[fd_usb] + +syz_usb_connect$cdc_ecm(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_cdc_ecm], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_cdc_ecm (timeout[3000], prog_timeout[3000]) + +usb_device_descriptor_cdc_ecm { + inner usb_device_descriptor_t[USB_CLASS_COMM, 0, 0, 0x525, 0xa4a1, 64, array[usb_config_descriptor_cdc_ecm, 1]] +} [packed] + +usb_config_descriptor_cdc_ecm { + inner usb_config_descriptor_ifaces_array_t[const[1, int8], array[usb_interface_descriptor_cdc_ecm, 1]] +} [packed] + +define USB_CDC_SUBCLASS_ACM 0x02 +define USB_CDC_SUBCLASS_ETHERNET 0x06 +define USB_CDC_SUBCLASS_WHCM 0x08 +define USB_CDC_SUBCLASS_DMM 0x09 +define USB_CDC_SUBCLASS_MDLM 0x0a +define USB_CDC_SUBCLASS_OBEX 0x0b +define USB_CDC_SUBCLASS_EEM 0x0c +define USB_CDC_SUBCLASS_NCM 0x0d +define USB_CDC_SUBCLASS_MBIM 0x0e + +# Per specification CDC ECM devices have two interfaces (control and data), +# but here we're merging them into one for simplicity since Linux supports that. +usb_interface_descriptor_cdc_ecm { + inner usb_interface_descriptor_t[const[0, int8], int8, int8[2:3], const[USB_CLASS_COMM, int8], const[USB_CDC_SUBCLASS_ETHERNET, int8], const[USB_CDC_PROTO_NONE, int8], usb_cdc_header_ecm, usb_endpoint_descriptors_cdc_ecm] +} [packed] + +usb_endpoint_descriptors_cdc_ecm { + notify array[usb_endpoint_descriptor_cdc_ecm_notify, 0:1] + in usb_endpoint_descriptor_cdc_ecm_in + out usb_endpoint_descriptor_cdc_ecm_out +} [packed] + +usb_endpoint_descriptor_cdc_ecm_notify { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_CDC_ECM_NOTIFY_ADDRESS, int8], const[USB_ENDPOINT_CDC_ECM_NOTIFY_ATTRIBUTES, int8], void] +} [packed] + +usb_endpoint_descriptor_cdc_ecm_in { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_CDC_ECM_IN_ADDRESS, int8], const[USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES, int8], void] +} [packed] + +usb_endpoint_descriptor_cdc_ecm_out { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_CDC_ECM_OUT_ADDRESS, int8], const[USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES, int8], void] +} [packed] + +define USB_ENDPOINT_CDC_ECM_NOTIFY_ATTRIBUTES (USB_ENDPOINT_XFER_INT) +define USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES (USB_ENDPOINT_XFER_BULK) +define USB_ENDPOINT_CDC_ECM_NOTIFY_ADDRESS (1 | USB_DIR_IN) +define USB_ENDPOINT_CDC_ECM_IN_ADDRESS (2 | USB_DIR_IN) +define USB_ENDPOINT_CDC_ECM_OUT_ADDRESS (3) + +# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/usb/core/message.c#L2137 +# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/net/usb/cdc_ether.c#L155 +usb_cdc_header_ecm { + union usb_cdc_union_desc_t[0, 0] + header usb_cdc_header_desc + ether usb_cdc_ether_desc + + other array[usb_cdc_header_ecm_other, 0:6] +} [packed] + +usb_cdc_header_ecm_other [ + call_mgmt usb_cdc_call_mgmt_descriptor + acm usb_cdc_acm_descriptor + country_functional usb_cdc_country_functional_desc + network_terminal usb_cdc_network_terminal_desc + dmm usb_cdc_dmm_desc + mdlm usb_cdc_mdlm_desc + mdlm_detail usb_cdc_mdlm_detail_desc + obex usb_cdc_obex_desc + ncm usb_cdc_ncm_desc + mbim usb_cdc_mbim_desc + mbim_extended usb_cdc_mbim_extended_desc +] [varlen] + +usb_cdc_header_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_HEADER_TYPE, int8] + + bcdCDC int16 +} [packed] + +usb_cdc_call_mgmt_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_CALL_MANAGEMENT_TYPE, int8] + + bmCapabilities flags[usb_cdc_call_mgmt_caps, int8] + bDataInterface int8 +} [packed] + +define USB_CDC_CALL_MGMT_CAP_CALL_MGMT 0x01 +define USB_CDC_CALL_MGMT_CAP_DATA_INTF 0x02 +usb_cdc_call_mgmt_caps = USB_CDC_CALL_MGMT_CAP_CALL_MGMT, USB_CDC_CALL_MGMT_CAP_DATA_INTF + +usb_cdc_acm_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_ACM_TYPE, int8] + + bmCapabilities flags[usb_cdc_acm_caps, int8] +} [packed] + +define USB_CDC_COMM_FEATURE 0x01 +define USB_CDC_CAP_LINE 0x02 +define USB_CDC_CAP_BRK 0x04 +define USB_CDC_CAP_NOTIFY 0x08 +usb_cdc_acm_caps = USB_CDC_COMM_FEATURE, USB_CDC_CAP_LINE, USB_CDC_CAP_BRK, USB_CDC_CAP_NOTIFY + +type usb_cdc_union_desc_t[MASTER, SLAVE] { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_UNION_TYPE, int8] + + bMasterInterface0 const[MASTER, int8] + bSlaveInterface0 const[SLAVE, int8] + slave_interfaces array[int8, 0:6] +} [packed] + +usb_cdc_country_functional_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_COUNTRY_TYPE, int8] + + iCountryCodeRelDate int8 + wCountyCode0 int16 + country_codes array[int16, 0:6] +} [packed] + +usb_cdc_network_terminal_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_NETWORK_TERMINAL_TYPE, int8] + + bEntityId int8 + iName int8 + bChannelIndex int8 + bPhysicalInterface int8 +} [packed] + +usb_cdc_ether_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_ETHERNET_TYPE, int8] + + iMACAddress const[1, int8] + bmEthernetStatistics int32 + wMaxSegmentSize int16 + wNumberMCFilters int16 + bNumberPowerFilters int8 +} [packed] + +usb_cdc_dmm_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_DMM_TYPE, int8] + + bcdVersion int16 + wMaxCommand int16 +} [packed] + +usb_cdc_mdlm_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_MDLM_TYPE, int8] + + bcdVersion int16 + bGUID usb_cdc_ecm_mbm_guid +} [packed] + +# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/net/usb/cdc_ether.c#L61 +usb_cdc_ecm_mbm_guid { + id0 const[0x14f5e048ba817a3, int64] + id1 const[0x2a397ecbffc007a6, int64] +} [packed] + +usb_cdc_mdlm_detail_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_MDLM_DETAIL_TYPE, int8] + + bGuidDescriptorType int8 + bDetailData array[int8, 0:256] +} [packed] + +usb_cdc_obex_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_OBEX_TYPE, int8] + + bcdVersion int16 +} [packed] + +usb_cdc_ncm_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_NCM_TYPE, int8] + + bcdNcmVersion int16 + bmNetworkCapabilities flags[usb_cdc_ncm_ncaps, int8] +} [packed] + +define USB_CDC_NCM_NCAP_ETH_FILTER (1 << 0) +define USB_CDC_NCM_NCAP_NET_ADDRESS (1 << 1) +define USB_CDC_NCM_NCAP_ENCAP_COMMAND (1 << 2) +define USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE (1 << 3) +define USB_CDC_NCM_NCAP_CRC_MODE (1 << 4) +define USB_CDC_NCM_NCAP_NTB_INPUT_SIZE (1 << 5) +usb_cdc_ncm_ncaps = USB_CDC_NCM_NCAP_ETH_FILTER, USB_CDC_NCM_NCAP_NET_ADDRESS, USB_CDC_NCM_NCAP_ENCAP_COMMAND, USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE, USB_CDC_NCM_NCAP_CRC_MODE, USB_CDC_NCM_NCAP_NTB_INPUT_SIZE + +usb_cdc_mbim_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_MBIM_TYPE, int8] + + bcdMBIMVersion int16 + wMaxControlMessage int16 + bNumberFilters int8 + bMaxFilterSize int8 + wMaxSegmentSize int16 + bmNetworkCapabilities int8 +} [packed] + +usb_cdc_mbim_extended_desc { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[USB_CDC_MBIM_EXTENDED_TYPE, int8] + + bcdMBIMExtendedVersion int16 + bMaxOutstandingCommandMessages int8 + wMTU int16 +} [packed] + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# CDC NCM class specific descriptions. +# CDC NCM is based on CDC ECM, so some of the descriptions are reused. +# https://www.usb.org/document-library/network-control-model-devices-specification-v10-and-errata-and-adopters-agreement +# https://elixir.bootlin.com/linux/latest/source/drivers/net/usb/cdc_ncm.c +# https://elixir.bootlin.com/linux/latest/source/drivers/net/usb/usbnet.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/ncm.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_ncm.c + +resource fd_usb_cdc_ncm[fd_usb] + +syz_usb_connect$cdc_ncm(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_cdc_ncm], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_cdc_ncm (timeout[3000], prog_timeout[3000]) + +usb_device_descriptor_cdc_ncm { + inner usb_device_descriptor_t[USB_CLASS_COMM, 0, 0, 0x525, 0xa4a1, 64, array[usb_config_descriptor_cdc_ncm, 1]] +} [packed] + +usb_config_descriptor_cdc_ncm { + inner usb_config_descriptor_t[const[1, int8], const[2, int8], usb_interface_descriptors_cdc_ncm] +} [packed] + +define CDC_NCM_COMM_ALTSETTING_NCM 0 +define CDC_NCM_DATA_ALTSETTING_NCM 1 + +usb_interface_descriptors_cdc_ncm { + control usb_interface_descriptor_fixed_t[0, CDC_NCM_COMM_ALTSETTING_NCM, 1, USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE, usb_cdc_header_ncm, usb_endpoint_descriptor_cdc_ecm_notify] + data_nop usb_interface_descriptor_fixed_t[1, 0, 0, USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE, void, void] + data usb_interface_descriptor_fixed_t[1, CDC_NCM_DATA_ALTSETTING_NCM, 2, USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE, void, usb_endpoint_descriptors_cdc_ncm_data] +} [packed] + +usb_endpoint_descriptors_cdc_ncm_data { + in usb_endpoint_descriptor_cdc_ecm_in + out usb_endpoint_descriptor_cdc_ecm_out +} [packed] + +# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/usb/core/message.c#L2137 +# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/net/usb/cdc_ncm.c#L798 +usb_cdc_header_ncm { + union usb_cdc_union_desc_t[0, 1] + header usb_cdc_header_desc + ether usb_cdc_ether_desc + ncm usb_cdc_ncm_desc + + other array[usb_cdc_header_ncm_other, 0:6] +} [packed] + +usb_cdc_header_ncm_other [ + call_mgmt usb_cdc_call_mgmt_descriptor + acm usb_cdc_acm_descriptor + country_functional usb_cdc_country_functional_desc + network_terminal usb_cdc_network_terminal_desc + dmm usb_cdc_dmm_desc + mdlm usb_cdc_mdlm_desc + mdlm_detail usb_cdc_mdlm_detail_desc + obex usb_cdc_obex_desc + mbim usb_cdc_mbim_desc + mbim_extended usb_cdc_mbim_extended_desc +] [varlen] + +# cdc.h +define USB_CDC_SEND_ENCAPSULATED_COMMAND 0x00 +define USB_CDC_GET_ENCAPSULATED_RESPONSE 0x01 +define USB_CDC_REQ_SET_LINE_CODING 0x20 +define USB_CDC_REQ_GET_LINE_CODING 0x21 +define USB_CDC_REQ_SET_CONTROL_LINE_STATE 0x22 +define USB_CDC_REQ_SEND_BREAK 0x23 +define USB_CDC_SET_ETHERNET_MULTICAST_FILTERS 0x40 +define USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER 0x41 +define USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER 0x42 +define USB_CDC_SET_ETHERNET_PACKET_FILTER 0x43 +define USB_CDC_GET_ETHERNET_STATISTIC 0x44 +define USB_CDC_GET_NTB_PARAMETERS 0x80 +define USB_CDC_GET_NET_ADDRESS 0x81 +define USB_CDC_SET_NET_ADDRESS 0x82 +define USB_CDC_GET_NTB_FORMAT 0x83 +define USB_CDC_SET_NTB_FORMAT 0x84 +define USB_CDC_GET_NTB_INPUT_SIZE 0x85 +define USB_CDC_SET_NTB_INPUT_SIZE 0x86 +define USB_CDC_GET_MAX_DATAGRAM_SIZE 0x87 +define USB_CDC_SET_MAX_DATAGRAM_SIZE 0x88 +define USB_CDC_GET_CRC_MODE 0x89 +define USB_CDC_SET_CRC_MODE 0x8a + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# UAC1 device class specific descriptions. +# https://www.usb.org/sites/default/files/audio10.pdf +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/audio.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_uac1.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_uac1_legacy.c +# https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/usb/audio.h + +# TODO: find out which /dev/ files are created by connected UAC1 devices and add descriptions for those. + +resource fd_usb_uac1[fd_usb] + +syz_usb_connect$uac1(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_uac1], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_uac1 (timeout[3000], prog_timeout[3000]) + +usb_device_descriptor_uac1 { + inner usb_device_descriptor_t[0, 0, 0, 0x1d6b, 0x101, 64, array[usb_config_descriptor_uac1, 1]] +} [packed] + +usb_config_descriptor_uac1 { + inner usb_config_descriptor_t[const[1, int8], const[3, int8], usb_interface_descriptors_uac1] +} [packed] + +# TODO: control interface might have and optional interrupt endpoint. +define USB_SUBCLASS_AUDIOCONTROL 0x01 +define USB_SUBCLASS_AUDIOSTREAMING 0x02 + +usb_interface_descriptors_uac1 { + control usb_interface_descriptor_fixed_t[0, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOCONTROL, 0, uac_control_iface_extra_descriptors, void] + as_out_alt_0 usb_interface_descriptor_fixed_t[1, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, 0, void, void] + as_out_alt_1 usb_interface_descriptor_fixed_t[1, 1, 1, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, 0, uac_as_iface_extra_descriptors, uac_as_out_endpoint_descriptor] + as_in_alt_0 usb_interface_descriptor_fixed_t[2, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, 0, void, void] + as_in_alt_1 usb_interface_descriptor_fixed_t[2, 1, 1, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, 0, uac_as_iface_extra_descriptors, uac_as_in_endpoint_descriptor] +} [packed] + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# UAC uses IDs to make it possible for terminals and units to refer to each other. +# We don't have a way to describe this, so just use a limited number of ids. +type uac_id int8[1:6] + +uac_control_iface_extra_descriptors { + header uac1_ac_header_descriptor_2 + others array[uac_control_iface_extra_descriptor, 0:6] +} [packed] + +uac_as_iface_extra_descriptors { + others array[uac_as_iface_extra_descriptor, 0:6] +} [packed] + +uac_control_iface_extra_descriptor [ + input_terminal uac_input_terminal_descriptor + output_terminal uac1_output_terminal_descriptor + mixer_unit uac_mixer_unit_descriptor + selector_unit uac_selector_unit_descriptor + feature_unit uac_feature_unit_descriptor + processing_unit uac_processing_unit_descriptor + extension_unit uac_extension_unit_descriptor +] [varlen] + +uac_as_iface_extra_descriptor [ + as_header uac1_as_header_descriptor + format_type_i_continuous uac_format_type_i_continuous_descriptor + format_type_i_discrete uac_format_type_i_discrete_descriptor + format_type_ii_discrete uac_format_type_ii_discrete_descriptor +] [varlen] + +define F_AUDIO_NUM_INTERFACES 2 +define UAC_DT_AC_HEADER_LENGTH (8 + F_AUDIO_NUM_INTERFACES) + +define UAC_HEADER 0x01 +define UAC_INPUT_TERMINAL 0x02 +define UAC_OUTPUT_TERMINAL 0x03 +define UAC_MIXER_UNIT 0x04 +define UAC_SELECTOR_UNIT 0x05 +define UAC_FEATURE_UNIT 0x06 +define UAC1_PROCESSING_UNIT 0x07 +define UAC1_EXTENSION_UNIT 0x08 + +uac1_ac_header_descriptor_2 { + bLength const[UAC_DT_AC_HEADER_LENGTH, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_HEADER, int8] + + bcdADC int16 + wTotalLength int8 + bInCollection const[F_AUDIO_NUM_INTERFACES, int8] + +# These must match interfaces numbers. + baInterfaceNr0 const[1, int8] + baInterfaceNr1 const[2, int8] +} [packed] + +uac_input_terminal_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_INPUT_TERMINAL, int8] + + bTerminalID uac_id + wTerminalType flags[uac_input_terminal_types, int16] + bAssocTerminal uac_id + bNrChannels int8 + wChannelConfig int16 + iChannelNames int8 + iTerminal int8 +} [packed] + +define UAC_TERMINAL_UNDEFINED 0x100 +define UAC_TERMINAL_STREAMING 0x101 +define UAC_TERMINAL_VENDOR_SPEC 0x1FF + +define UAC_INPUT_TERMINAL_UNDEFINED 0x200 +define UAC_INPUT_TERMINAL_MICROPHONE 0x201 +define UAC_INPUT_TERMINAL_DESKTOP_MICROPHONE 0x202 +define UAC_INPUT_TERMINAL_PERSONAL_MICROPHONE 0x203 +define UAC_INPUT_TERMINAL_OMNI_DIR_MICROPHONE 0x204 +define UAC_INPUT_TERMINAL_MICROPHONE_ARRAY 0x205 +define UAC_INPUT_TERMINAL_PROC_MICROPHONE_ARRAY 0x206 + +define UAC_OUTPUT_TERMINAL_UNDEFINED 0x300 +define UAC_OUTPUT_TERMINAL_SPEAKER 0x301 +define UAC_OUTPUT_TERMINAL_HEADPHONES 0x302 +define UAC_OUTPUT_TERMINAL_HEAD_MOUNTED_DISPLAY_AUDIO 0x303 +define UAC_OUTPUT_TERMINAL_DESKTOP_SPEAKER 0x304 +define UAC_OUTPUT_TERMINAL_ROOM_SPEAKER 0x305 +define UAC_OUTPUT_TERMINAL_COMMUNICATION_SPEAKER 0x306 +define UAC_OUTPUT_TERMINAL_LOW_FREQ_EFFECTS_SPEAKER 0x307 + +uac_input_terminal_types = UAC_TERMINAL_UNDEFINED, UAC_TERMINAL_STREAMING, UAC_TERMINAL_VENDOR_SPEC, UAC_INPUT_TERMINAL_UNDEFINED, UAC_INPUT_TERMINAL_MICROPHONE, UAC_INPUT_TERMINAL_DESKTOP_MICROPHONE, UAC_INPUT_TERMINAL_PERSONAL_MICROPHONE, UAC_INPUT_TERMINAL_OMNI_DIR_MICROPHONE, UAC_INPUT_TERMINAL_MICROPHONE_ARRAY, UAC_INPUT_TERMINAL_PROC_MICROPHONE_ARRAY + +uac1_output_terminal_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_OUTPUT_TERMINAL, int8] + + bTerminalID uac_id + wTerminalType flags[uac_output_terminal_types, int16] + bAssocTerminal uac_id + bSourceID uac_id + iTerminal int8 +} [packed] + +uac_output_terminal_types = UAC_TERMINAL_UNDEFINED, UAC_TERMINAL_STREAMING, UAC_TERMINAL_VENDOR_SPEC, UAC_OUTPUT_TERMINAL_UNDEFINED, UAC_OUTPUT_TERMINAL_SPEAKER, UAC_OUTPUT_TERMINAL_HEADPHONES, UAC_OUTPUT_TERMINAL_HEAD_MOUNTED_DISPLAY_AUDIO, UAC_OUTPUT_TERMINAL_DESKTOP_SPEAKER, UAC_OUTPUT_TERMINAL_ROOM_SPEAKER, UAC_OUTPUT_TERMINAL_COMMUNICATION_SPEAKER, UAC_OUTPUT_TERMINAL_LOW_FREQ_EFFECTS_SPEAKER + +uac_mixer_unit_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_MIXER_UNIT, int8] + + bUnitID uac_id + bNrInPins int8 + baSourceID array[int8, 0:6] +} [packed] + +uac_selector_unit_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_SELECTOR_UNIT, int8] + + bUnitID uac_id + bNrInPins int8 + baSourceID array[int8, 0:6] +} [packed] + +uac_feature_unit_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_FEATURE_UNIT, int8] + + bUnitID uac_id + bSourceID uac_id + bControlSize len[bmaControls, int8] + bmaControls array[flags[uac_feature_unit_controls, int16], 1:6] + iFeature int8 +} [packed] + +define UAC_FU_MUTE 0x01 +define UAC_FU_VOLUME 0x02 +define UAC_FU_BASS 0x03 +define UAC_FU_MID 0x04 +define UAC_FU_TREBLE 0x05 +define UAC_FU_GRAPHIC_EQUALIZER 0x06 +define UAC_FU_AUTOMATIC_GAIN 0x07 +define UAC_FU_DELAY 0x08 +define UAC_FU_BASS_BOOST 0x09 +define UAC_FU_LOUDNESS 0x0a +uac_feature_unit_controls = UAC_FU_MUTE, UAC_FU_VOLUME, UAC_FU_BASS, UAC_FU_MID, UAC_FU_TREBLE, UAC_FU_GRAPHIC_EQUALIZER, UAC_FU_AUTOMATIC_GAIN, UAC_FU_DELAY, UAC_FU_BASS_BOOST, UAC_FU_LOUDNESS + +uac_processing_unit_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC1_PROCESSING_UNIT, int8] + + bUnitID uac_id + wProcessType flags[uac_processing_unit_types, int16] + bNrInPins int8 + baSourceID array[int8, 0:6] +} [packed] + +define UAC_PROCESS_UNDEFINED 0x00 +define UAC_PROCESS_UP_DOWNMIX 0x01 +define UAC_PROCESS_DOLBY_PROLOGIC 0x02 +define UAC_PROCESS_STEREO_EXTENDER 0x03 +define UAC_PROCESS_REVERB 0x04 +define UAC_PROCESS_CHORUS 0x05 +define UAC_PROCESS_DYN_RANGE_COMP 0x06 +uac_processing_unit_types = UAC_PROCESS_UNDEFINED, UAC_PROCESS_UP_DOWNMIX, UAC_PROCESS_DOLBY_PROLOGIC, UAC_PROCESS_STEREO_EXTENDER, UAC_PROCESS_REVERB, UAC_PROCESS_CHORUS, UAC_PROCESS_DYN_RANGE_COMP + +uac_extension_unit_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC1_EXTENSION_UNIT, int8] + + bUnitID uac_id + wProcessType int16 + bNrInPins int8 + baSourceID array[int8, 0:6] +} [packed] + +define UAC_AS_GENERAL 0x01 +define UAC_FORMAT_TYPE 0x02 +define UAC_FORMAT_SPECIFIC 0x03 + +uac1_as_header_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_AS_GENERAL, int8] + + bTerminalLink int8 + bDelay int8 + wFormatTag flags[uac_format_types, int16] +} [packed] + +define UAC_FORMAT_TYPE_UNDEFINED 0x0 +define UAC_FORMAT_TYPE_I 0x1 +define UAC_FORMAT_TYPE_II 0x2 +define UAC_FORMAT_TYPE_III 0x3 +define UAC_EXT_FORMAT_TYPE_I 0x81 +define UAC_EXT_FORMAT_TYPE_II 0x82 +define UAC_EXT_FORMAT_TYPE_III 0x83 + +define UAC_FORMAT_TYPE_I_UNDEFINED 0x0 +define UAC_FORMAT_TYPE_I_PCM 0x1 +define UAC_FORMAT_TYPE_I_PCM8 0x2 +define UAC_FORMAT_TYPE_I_IEEE_FLOAT 0x3 +define UAC_FORMAT_TYPE_I_ALAW 0x4 +define UAC_FORMAT_TYPE_I_MULAW 0x5 +define UAC_FORMAT_TYPE_II_MPEG 0x1001 +define UAC_FORMAT_TYPE_II_AC3 0x1002 +uac_format_types = UAC_FORMAT_TYPE_I_UNDEFINED, UAC_FORMAT_TYPE_I_PCM, UAC_FORMAT_TYPE_I_PCM8, UAC_FORMAT_TYPE_I_IEEE_FLOAT, UAC_FORMAT_TYPE_I_ALAW, UAC_FORMAT_TYPE_I_MULAW, UAC_FORMAT_TYPE_II_MPEG, UAC_FORMAT_TYPE_II_AC3 + +uac_format_type_i_continuous_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_FORMAT_TYPE, int8] + + bFormatType const[UAC_FORMAT_TYPE_I, int8] + bNrChannels int8 + bSubframeSize int8[1:4] + bBitResolution int8 + bSamFreqType int8 + tLowerSamFreq array[int8, 0:3] + tUpperSamFreq array[int8, 0:3] +} [packed] + +uac_format_type_i_discrete_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_FORMAT_TYPE, int8] + + bFormatType const[UAC_FORMAT_TYPE_I, int8] + bNrChannels int8 + bSubframeSize int8[1:4] + bBitResolution int8 + bSamFreqType int8 + tSamFreq array[int8, 0:9] +} [packed] + +uac_format_type_ii_discrete_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_INTERFACE, int8] + bDescriptorSubType const[UAC_FORMAT_TYPE, int8] + + bFormatType const[UAC_FORMAT_TYPE_II, int8] + wMaxBitRate int16 + wSamplesPerFrame int16 + bSamFreqType int8 + tSamFreq array[int8, 0:9] +} [packed] + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +uac_as_out_endpoint_descriptor { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_OUT_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac_iso_endpoint_descriptor] +} [packed] + +uac_as_in_endpoint_descriptor { + inner usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_IN_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac_iso_endpoint_descriptor] +} [packed] + +define USB_ENDPOINT_UAC1_AS_OUT_ADDRESS (1 | USB_DIR_OUT) +define USB_ENDPOINT_UAC1_AS_IN_ADDRESS (2 | USB_DIR_IN) +define USB_ENDPOINT_UAC1_AS_ATTRIBUTES (USB_ENDPOINT_SYNC_ADAPTIVE | USB_ENDPOINT_XFER_ISOC) + +define UAC_EP_GENERAL 0x01 + +uac_iso_endpoint_descriptor { + bLength len[parent, int8] + bDescriptorType const[USB_DT_CS_ENDPOINT, int8] + bDescriptorSubType const[UAC_EP_GENERAL, int8] + + bmAttributes flags[uac_iso_ep_attributes, int8] + bLockDelayUnits int8 + wLockDelay int16 +} [packed] + +define UAC_EP_CS_ATTR_SAMPLE_RATE 0x01 +define UAC_EP_CS_ATTR_PITCH_CONTROL 0x02 +define UAC_EP_CS_ATTR_FILL_MAX 0x80 +uac_iso_ep_attributes = UAC_EP_CS_ATTR_SAMPLE_RATE, UAC_EP_CS_ATTR_PITCH_CONTROL, UAC_EP_CS_ATTR_FILL_MAX + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# TODO: describe MIDI, UAC2, UAC3 +# https://www.usb.org/sites/default/files/midi10.pdf +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_midi.c +# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_uac2.c +# https://elixir.bootlin.com/linux/latest/source/include/linux/usb/audio-v2.h + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# ath9k driver specific descriptions. + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # diff --git a/sys/netbsd/vusb_amd64.const b/sys/netbsd/vusb_amd64.const new file mode 100644 index 000000000..1fce6b373 --- /dev/null +++ b/sys/netbsd/vusb_amd64.const @@ -0,0 +1,294 @@ +# AUTOGENERATED FILE +CDC_NCM_COMM_ALTSETTING_NCM = 0 +CDC_NCM_DATA_ALTSETTING_NCM = 1 +CONTAINER_ID_TYPE = 4 +F_AUDIO_NUM_INTERFACES = 2 +HID_DT_HID = 33 +HID_DT_PHYSICAL = 35 +HID_DT_REPORT = 34 +HID_MAX_DESCRIPTOR_SIZE = 4096 +HID_REQ_GET_IDLE = 2 +HID_REQ_GET_PROTOCOL = 3 +HID_REQ_GET_REPORT = 1 +HID_REQ_SET_IDLE = 10 +HID_REQ_SET_PROTOCOL = 11 +HID_REQ_SET_REPORT = 9 +UAC1_EXTENSION_UNIT = 8 +UAC1_PROCESSING_UNIT = 7 +UAC_AS_GENERAL = 1 +UAC_DT_AC_HEADER_LENGTH = 10 +UAC_EP_CS_ATTR_FILL_MAX = 128 +UAC_EP_CS_ATTR_PITCH_CONTROL = 2 +UAC_EP_CS_ATTR_SAMPLE_RATE = 1 +UAC_EP_GENERAL = 1 +UAC_EXT_FORMAT_TYPE_I = 129 +UAC_EXT_FORMAT_TYPE_II = 130 +UAC_EXT_FORMAT_TYPE_III = 131 +UAC_FEATURE_UNIT = 6 +UAC_FORMAT_SPECIFIC = 3 +UAC_FORMAT_TYPE = 2 +UAC_FORMAT_TYPE_I = 1 +UAC_FORMAT_TYPE_II = 2 +UAC_FORMAT_TYPE_III = 3 +UAC_FORMAT_TYPE_II_AC3 = 4098 +UAC_FORMAT_TYPE_II_MPEG = 4097 +UAC_FORMAT_TYPE_I_ALAW = 4 +UAC_FORMAT_TYPE_I_IEEE_FLOAT = 3 +UAC_FORMAT_TYPE_I_MULAW = 5 +UAC_FORMAT_TYPE_I_PCM = 1 +UAC_FORMAT_TYPE_I_PCM8 = 2 +UAC_FORMAT_TYPE_I_UNDEFINED = 0 +UAC_FORMAT_TYPE_UNDEFINED = 0 +UAC_FU_AUTOMATIC_GAIN = 7 +UAC_FU_BASS = 3 +UAC_FU_BASS_BOOST = 9 +UAC_FU_DELAY = 8 +UAC_FU_GRAPHIC_EQUALIZER = 6 +UAC_FU_LOUDNESS = 10 +UAC_FU_MID = 4 +UAC_FU_MUTE = 1 +UAC_FU_TREBLE = 5 +UAC_FU_VOLUME = 2 +UAC_HEADER = 1 +UAC_INPUT_TERMINAL = 2 +UAC_INPUT_TERMINAL_DESKTOP_MICROPHONE = 514 +UAC_INPUT_TERMINAL_MICROPHONE = 513 +UAC_INPUT_TERMINAL_MICROPHONE_ARRAY = 517 +UAC_INPUT_TERMINAL_OMNI_DIR_MICROPHONE = 516 +UAC_INPUT_TERMINAL_PERSONAL_MICROPHONE = 515 +UAC_INPUT_TERMINAL_PROC_MICROPHONE_ARRAY = 518 +UAC_INPUT_TERMINAL_UNDEFINED = 512 +UAC_MIXER_UNIT = 4 +UAC_OUTPUT_TERMINAL = 3 +UAC_OUTPUT_TERMINAL_COMMUNICATION_SPEAKER = 774 +UAC_OUTPUT_TERMINAL_DESKTOP_SPEAKER = 772 +UAC_OUTPUT_TERMINAL_HEADPHONES = 770 +UAC_OUTPUT_TERMINAL_HEAD_MOUNTED_DISPLAY_AUDIO = 771 +UAC_OUTPUT_TERMINAL_LOW_FREQ_EFFECTS_SPEAKER = 775 +UAC_OUTPUT_TERMINAL_ROOM_SPEAKER = 773 +UAC_OUTPUT_TERMINAL_SPEAKER = 769 +UAC_OUTPUT_TERMINAL_UNDEFINED = 768 +UAC_PROCESS_CHORUS = 5 +UAC_PROCESS_DOLBY_PROLOGIC = 2 +UAC_PROCESS_DYN_RANGE_COMP = 6 +UAC_PROCESS_REVERB = 4 +UAC_PROCESS_STEREO_EXTENDER = 3 +UAC_PROCESS_UNDEFINED = 0 +UAC_PROCESS_UP_DOWNMIX = 1 +UAC_SELECTOR_UNIT = 5 +UAC_TERMINAL_STREAMING = 257 +UAC_TERMINAL_UNDEFINED = 256 +UAC_TERMINAL_VENDOR_SPEC = 511 +USBLP_FIRST_PROTOCOL = 1 +USBLP_LAST_PROTOCOL = 3 +USBLP_REQ_GET_ID = 0 +USBLP_REQ_GET_STATUS = 1 +USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST = 0 +USBLP_REQ_RESET = 2 +USB_5GBPS_OPERATION = 8 +USB_BESL_BASELINE_VALID = 8 +USB_BESL_DEEP_VALID = 16 +USB_BESL_SUPPORT = 4 +USB_CAP_TYPE_EXT = 2 +USB_CAP_TYPE_WIRELESS_USB = 1 +USB_CDC_ACM_TYPE = 2 +USB_CDC_CALL_MANAGEMENT_TYPE = 1 +USB_CDC_CALL_MGMT_CAP_CALL_MGMT = 1 +USB_CDC_CALL_MGMT_CAP_DATA_INTF = 2 +USB_CDC_CAP_BRK = 4 +USB_CDC_CAP_LINE = 2 +USB_CDC_CAP_NOTIFY = 8 +USB_CDC_COMM_FEATURE = 1 +USB_CDC_COUNTRY_TYPE = 7 +USB_CDC_DMM_TYPE = 20 +USB_CDC_ETHERNET_TYPE = 15 +USB_CDC_GET_CRC_MODE = 137 +USB_CDC_GET_ENCAPSULATED_RESPONSE = 1 +USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER = 66 +USB_CDC_GET_ETHERNET_STATISTIC = 68 +USB_CDC_GET_MAX_DATAGRAM_SIZE = 135 +USB_CDC_GET_NET_ADDRESS = 129 +USB_CDC_GET_NTB_FORMAT = 131 +USB_CDC_GET_NTB_INPUT_SIZE = 133 +USB_CDC_GET_NTB_PARAMETERS = 128 +USB_CDC_HEADER_TYPE = 0 +USB_CDC_MBIM_EXTENDED_TYPE = 28 +USB_CDC_MBIM_TYPE = 27 +USB_CDC_MDLM_DETAIL_TYPE = 19 +USB_CDC_MDLM_TYPE = 18 +USB_CDC_NCM_NCAP_CRC_MODE = 16 +USB_CDC_NCM_NCAP_ENCAP_COMMAND = 4 +USB_CDC_NCM_NCAP_ETH_FILTER = 1 +USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE = 8 +USB_CDC_NCM_NCAP_NET_ADDRESS = 2 +USB_CDC_NCM_NCAP_NTB_INPUT_SIZE = 32 +USB_CDC_NCM_TYPE = 26 +USB_CDC_NETWORK_TERMINAL_TYPE = 10 +USB_CDC_OBEX_TYPE = 21 +USB_CDC_PROTO_NONE = 0 +USB_CDC_REQ_GET_LINE_CODING = 33 +USB_CDC_REQ_SEND_BREAK = 35 +USB_CDC_REQ_SET_CONTROL_LINE_STATE = 34 +USB_CDC_REQ_SET_LINE_CODING = 32 +USB_CDC_SEND_ENCAPSULATED_COMMAND = 0 +USB_CDC_SET_CRC_MODE = 138 +USB_CDC_SET_ETHERNET_MULTICAST_FILTERS = 64 +USB_CDC_SET_ETHERNET_PACKET_FILTER = 67 +USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER = 65 +USB_CDC_SET_MAX_DATAGRAM_SIZE = 136 +USB_CDC_SET_NET_ADDRESS = 130 +USB_CDC_SET_NTB_FORMAT = 132 +USB_CDC_SET_NTB_INPUT_SIZE = 134 +USB_CDC_SUBCLASS_ACM = 2 +USB_CDC_SUBCLASS_DMM = 9 +USB_CDC_SUBCLASS_EEM = 12 +USB_CDC_SUBCLASS_ETHERNET = 6 +USB_CDC_SUBCLASS_MBIM = 14 +USB_CDC_SUBCLASS_MDLM = 10 +USB_CDC_SUBCLASS_NCM = 13 +USB_CDC_SUBCLASS_OBEX = 11 +USB_CDC_SUBCLASS_WHCM = 8 +USB_CDC_UNION_TYPE = 6 +USB_CDC_WHCM_TYPE = 17 +USB_CLASS_APP_SPEC = 254 +USB_CLASS_AUDIO = 1 +USB_CLASS_CDC_DATA = 10 +USB_CLASS_COMM = 2 +USB_CLASS_CONTENT_SEC = 13 +USB_CLASS_CSCID = 11 +USB_CLASS_HID = 3 +USB_CLASS_HUB = 9 +USB_CLASS_MASS_STORAGE = 8 +USB_CLASS_MISC = 239 +USB_CLASS_PER_INTERFACE = 0 +USB_CLASS_PHYSICAL = 5 +USB_CLASS_PRINTER = 7 +USB_CLASS_STILL_IMAGE = 6 +USB_CLASS_VENDOR_SPEC = 255 +USB_CLASS_VIDEO = 14 +USB_CLASS_WIRELESS_CONTROLLER = 224 +USB_CONFIG_ATT_BATTERY = 16 +USB_CONFIG_ATT_ONE = 128 +USB_CONFIG_ATT_SELFPOWER = 64 +USB_CONFIG_ATT_WAKEUP = 32 +USB_DIR_IN = 128 +USB_DIR_OUT = 0 +USB_DT_BOS = 15 +USB_DT_BOS_SIZE = 5 +USB_DT_CONFIG = 2 +USB_DT_CONFIG_SIZE = 9 +USB_DT_CS_CONFIG = 34 +USB_DT_CS_DEVICE = 33 +USB_DT_CS_ENDPOINT = 37 +USB_DT_CS_INTERFACE = 36 +USB_DT_CS_RADIO_CONTROL = 35 +USB_DT_CS_STRING = 35 +USB_DT_DEBUG = 10 +USB_DT_DEVICE = 1 +USB_DT_DEVICE_CAPABILITY = 16 +USB_DT_DEVICE_QUALIFIER = 6 +USB_DT_DEVICE_SIZE = 18 +USB_DT_ENCRYPTION_TYPE = 14 +USB_DT_ENDPOINT = 5 +USB_DT_ENDPOINT_AUDIO_SIZE = 9 +USB_DT_INTERFACE = 4 +USB_DT_INTERFACE_ASSOCIATION = 11 +USB_DT_INTERFACE_POWER = 8 +USB_DT_INTERFACE_SIZE = 9 +USB_DT_KEY = 13 +USB_DT_OTG = 9 +USB_DT_OTHER_SPEED_CONFIG = 7 +USB_DT_PIPE_USAGE = 36 +USB_DT_RPIPE = 34 +USB_DT_SECURITY = 12 +USB_DT_SSP_ISOC_ENDPOINT_COMP = 49 +USB_DT_SS_ENDPOINT_COMP = 48 +USB_DT_STRING = 3 +USB_DT_WIRELESS_ENDPOINT_COMP = 17 +USB_DT_WIRE_ADAPTER = 33 +USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES = 2 +USB_ENDPOINT_CDC_ECM_IN_ADDRESS = 130 +USB_ENDPOINT_CDC_ECM_NOTIFY_ADDRESS = 129 +USB_ENDPOINT_CDC_ECM_NOTIFY_ATTRIBUTES = 3 +USB_ENDPOINT_CDC_ECM_OUT_ADDRESS = 3 +USB_ENDPOINT_DIR_MASK = 128 +USB_ENDPOINT_HID_ATTRIBUTES = 3 +USB_ENDPOINT_HID_IN_ADDRESS = 129 +USB_ENDPOINT_HID_OUT_ADDRESS = 2 +USB_ENDPOINT_INTRTYPE = 48 +USB_ENDPOINT_INTR_NOTIFICATION = 16 +USB_ENDPOINT_INTR_PERIODIC = 0 +USB_ENDPOINT_MAXP_MASK = 2047 +USB_ENDPOINT_MAX_ADJUSTABLE = 128 +USB_ENDPOINT_NUMBER_MASK = 15 +USB_ENDPOINT_PRINTER_ATTRIBUTES = 2 +USB_ENDPOINT_PRINTER_IN_ADDRESS = 130 +USB_ENDPOINT_PRINTER_OUT_ADDRESS = 1 +USB_ENDPOINT_SYNCTYPE = 12 +USB_ENDPOINT_SYNC_ADAPTIVE = 8 +USB_ENDPOINT_SYNC_ASYNC = 4 +USB_ENDPOINT_SYNC_NONE = 0 +USB_ENDPOINT_SYNC_SYNC = 12 +USB_ENDPOINT_UAC1_AS_ATTRIBUTES = 9 +USB_ENDPOINT_UAC1_AS_IN_ADDRESS = 130 +USB_ENDPOINT_UAC1_AS_OUT_ADDRESS = 1 +USB_ENDPOINT_USAGE_DATA = 0 +USB_ENDPOINT_USAGE_FEEDBACK = 16 +USB_ENDPOINT_USAGE_IMPLICIT_FB = 32 +USB_ENDPOINT_USAGE_MASK = 48 +USB_ENDPOINT_XFERTYPE_MASK = 3 +USB_ENDPOINT_XFER_BULK = 2 +USB_ENDPOINT_XFER_CONTROL = 0 +USB_ENDPOINT_XFER_INT = 3 +USB_ENDPOINT_XFER_ISOC = 1 +USB_EP_MAXP_MULT_MASK = 6144 +USB_EP_MAXP_MULT_SHIFT = 11 +USB_FULL_SPEED_OPERATION = 2 +USB_HIGH_SPEED_OPERATION = 4 +USB_INTERFACE_CLASS_HID = 3 +USB_INTERFACE_PROTOCOL_KEYBOARD = 1 +USB_INTERFACE_PROTOCOL_MOUSE = 2 +USB_INTERFACE_SUBCLASS_BOOT = 1 +USB_LOW_SPEED_OPERATION = 1 +USB_LPM_SUPPORT = 2 +USB_LTM_SUPPORT = 2 +USB_PTM_CAP_TYPE = 11 +USB_SPEED_FULL = 3 +USB_SPEED_HIGH = 4 +USB_SPEED_LOW = 2 +USB_SPEED_SUPER = 6 +USB_SPEED_SUPER_PLUS = 7 +USB_SPEED_UNKNOWN = 1 +USB_SPEED_WIRELESS = 5 +USB_SSP_CAP_TYPE = 10 +USB_SSP_MIN_RX_LANE_COUNT = 3840 +USB_SSP_MIN_SUBLINK_SPEED_ATTRIBUTE_ID = 15 +USB_SSP_MIN_TX_LANE_COUNT = 61440 +USB_SSP_SUBLINK_SPEED_LP = 49152 +USB_SSP_SUBLINK_SPEED_LSE = 48 +USB_SSP_SUBLINK_SPEED_LSM = 16711680 +USB_SSP_SUBLINK_SPEED_RSVD = 16128 +USB_SSP_SUBLINK_SPEED_SSID = 15 +USB_SSP_SUBLINK_SPEED_ST = 192 +USB_SS_CAP_TYPE = 3 +USB_SUBCLASS_AUDIOCONTROL = 1 +USB_SUBCLASS_AUDIOSTREAMING = 2 +USB_SUBCLASS_VENDOR_SPEC = 255 +USB_TYPE_CLASS = 32 +USB_TYPE_MASK = 96 +USB_TYPE_RESERVED = 96 +USB_TYPE_STANDARD = 0 +USB_TYPE_VENDOR = 64 +USB_WIRELESS_BEACON_DIRECTED = 8 +USB_WIRELESS_BEACON_MASK = 12 +USB_WIRELESS_BEACON_NONE = 12 +USB_WIRELESS_BEACON_SELF = 4 +USB_WIRELESS_P2P_DRD = 2 +USB_WIRELESS_PHY_107 = 4 +USB_WIRELESS_PHY_160 = 8 +USB_WIRELESS_PHY_200 = 16 +USB_WIRELESS_PHY_320 = 32 +USB_WIRELESS_PHY_400 = 64 +USB_WIRELESS_PHY_480 = 128 +USB_WIRELESS_PHY_53 = 1 +USB_WIRELESS_PHY_80 = 2 -- cgit mrf-deployment