OSDev.org

Ethin wrote:Suffering a bit of a problem (and the USB trace events aren't very helpful in QEMU). I do the following but each time I do, I get a USB stall:

Read two (2) bytes from the descriptor to get its length and descriptor type (called n)
Read n bytes to read the full descriptor header
read n[total length] to read the descriptor header and all descriptors that follow

Ethin wrote:So I'm quite confused as to what I'm doing wrong here. Ideas/thoughts?

• If your SETUP token is not exactly 8 bytes long
• If the length given in the SETUP packet exceeds 4kB
• If you have an IN DATA token in the SETUP data phase that doesn't have the USB_DIR_IN bit set (I think that might be your problem)
• If you have an IN DATA token while not in the SETUP data phase or ack phase
• If you have a DATA OUT token in the SETUP data phase that has the USB_DIR_IN bit set
• If you have a DATA OUT token in the wrong SETUP state (as above)
• If you have a parameter SETUP packet (whatever that is) with too large a size in the setup packet
• If you have a token with unknown type (neither SETUP nor IN nor OUT)

nullplan wrote:

Ethin wrote:Suffering a bit of a problem (and the USB trace events aren't very helpful in QEMU). I do the following but each time I do, I get a USB stall:

Read two (2) bytes from the descriptor to get its length and descriptor type (called n)
Read n bytes to read the full descriptor header
read n[total length] to read the descriptor header and all descriptors that follow

Why the three stages? I have often seen people read a descriptor in two stages, but that first one seems unnecessary. You should be able to just read the first eight bytes of the descriptor, then verify the header information holds up, then transfer all of it. You are already assuming that the header is at least seven bytes long, so it is not that big of a leap.

Ethin wrote:So I'm quite confused as to what I'm doing wrong here. Ideas/thoughts?

So I looked at the QEMU source code. -3 is the error code for a stall, obviously. And the error code USB_RET_STALL appears 81 times in the source code. Here are the places I could find in the main device core:

• If your SETUP token is not exactly 8 bytes long
• If the length given in the SETUP packet exceeds 4kB
• If you have an IN DATA token in the SETUP data phase that doesn't have the USB_DIR_IN bit set (I think that might be your problem)
• If you have an IN DATA token while not in the SETUP data phase or ack phase
• If you have a DATA OUT token in the SETUP data phase that has the USB_DIR_IN bit set
• If you have a DATA OUT token in the wrong SETUP state (as above)
• If you have a parameter SETUP packet (whatever that is) with too large a size in the setup packet
• If you have a token with unknown type (neither SETUP nor IN nor OUT)

There are others: for audio devices if you try to get or set unknown attributes in the mixer, or set them beyond their limits, or if you try to send audio data while the audio interface is still turned off. And still others for other kinds of devices, but you are not there yet. For now, try to set USB_DIR_IN in the RequestType and see if that changes anything.

    UINT8* Header = 0;
        status = st->BootServices->AllocatePool(EfiBootServicesData, 65536, (void*)&Header);
    if (EFI_ERROR(status))
      goto failed;

    EFI_USB_DEVICE_REQUEST req = {0};
    req.RequestType = (USB_DEV_GET_DESCRIPTOR_REQ_TYPE | USB_REQ_TYPE_CLASS | USB_ENDPOINT_DIR_IN);
    req.Request = USB_REQ_GET_DESCRIPTOR;
    req.Value = (0x24 << 8);
    req.Index = interfaceDescriptor.InterfaceNumber;
    req.Length = 2;
    status = UsbIo->UsbControlTransfer(UsbIo, &req, EfiUsbDataIn, PcdGet32 (PcdUsbTransferTimeoutValue), &Header, req.Length, &UsbStatus);
    if (EFI_ERROR(status)) {
      st->BootServices->FreePool(Header);
      goto failed;
}
  req.Length = (Header[6] << 8) | Header[5];
    status = UsbIo->UsbControlTransfer(UsbIo, &req, EfiUsbDataIn, PcdGet32 (PcdUsbTransferTimeoutValue), &Header, req.Length, &UsbStatus);
    if (EFI_ERROR(status)) {
      st->BootServices->FreePool(Header);
      goto failed;
    }

nullplan wrote:So here's a question: Isn't GET_DESCRIPTOR a standard request? Even if you are asking for a class specific descriptor?

I've read a bit more in the QEMU source code. It appears that GET_DESCRIPTOR is always a standard device request. So you must set the request type to USB_DIR_IN | USB_RECIP_DEVICE | USB_TYPE_STANDARD. I suspect that is already done in USB_DEV_GET_DESCRIPTOR_REQ_TYPE. So the USB_REQ_TYPE_CLASS is definitely wrong. It appears to be the case that you must get the entire configuration descriptor, and then parse that one bytewise, rather than ask for descriptor type 0x24 directly. So

Code: Select all

req.RequestType = USB_DEV_GET_DESCRIPTOR_REQ_TYPE;
req.Request = USB_REQ_GET_DESCRIPTOR;
req.Value = USB_DT_CONFIG;
req.Index = 0; /* I have never seen a USB device with more than one configuration. */
req.Length = 9; /* At least get the full config descriptor */
status = UsbIo->UsbControlTransfer(UsbIo, &req, EfiUsbDataIn, PcdGet32 (PcdUsbTransferTimeoutValue), &Header, req.Length, &UsbStatus);
/* handle error */
req.Length = Header[2] | Header[3] << 8;
status = UsbIo->UsbControlTransfer(UsbIo, &req, EfiUsbDataIn, PcdGet32 (PcdUsbTransferTimeoutValue), &Header, req.Length, &UsbStatus);

That ought to get you the whole config descriptor, including all interface descriptors and their special descriptors.

    EFI_USB_DEVICE_REQUEST req = {0};
    req.RequestType = USB_DEV_GET_DESCRIPTOR_REQ_TYPE;
    req.Request = USB_REQ_GET_DESCRIPTOR;
    req.Value = USB_DESC_TYPE_CONFIG;
    req.Index = 0;
    req.Length = 9;
    status = UsbIo->UsbControlTransfer(UsbIo, &req, EfiUsbDataIn, PcdGet32 (PcdUsbTransferTimeoutValue), &Header, req.Length, &UsbStatus);
    if (EFI_ERROR(status)) {
      st->BootServices->FreePool(Header);
      goto failed;
}
  req.Length = Header[2] | Header[3] << 8;
    status = UsbIo->UsbControlTransfer(UsbIo, &req, EfiUsbDataIn, PcdGet32 (PcdUsbTransferTimeoutValue), &Header, req.Length, &UsbStatus);
    if (EFI_ERROR(status)) {
      st->BootServices->FreePool(Header);
      goto failed;
    }
    UINTN DescriptorPosition = 0;
    for (UINTN i = 0; i < 0xFFFF; ++i) {
      if (Header[i] == 0x24 && Header[i + 1] == 0x01) {
        DescriptorPosition = i - 1;
        break;
      }
    }
    if (DescriptorPosition == 0) {
      status = EFI_NOT_FOUND;
      goto failed;
    }
      Print(L"Length is %d, total length is %d, total length of interface descriptor is %d, USB ADC version is %04x, %d interfaces in collection\n", Header[DescriptorPosition], req.Length, Header[DescriptorPosition + 3] | Header[DescriptorPosition + 4] << 8, Header[DescriptorPosition + 5] | Header[DescriptorPosition + 6] << 8, Header[DescriptorPosition + 7]);

usb_desc_get_descriptor: 1 unknown type 0 (len 9)

/**
  Get the descriptor of the specified USB device.

  Submit a USB get descriptor request for the USB device specified by UsbIo, Value,
  and Index, and return the descriptor in the buffer specified by Descriptor.
  The status of the transfer is returned in Status.
  If UsbIo is NULL, then ASSERT().
  If Descriptor is NULL, then ASSERT().
  If Status is NULL, then ASSERT().

  @param  UsbIo             A pointer to the USB I/O Protocol instance for the specific USB target.
  @param  Value             The device request value.
  @param  Index             The device request index.
  @param  DescriptorLength  The size, in bytes, of Descriptor.
  @param  Descriptor        A pointer to the descriptor buffer to get.
  @param  Status            A pointer to the status of the transfer.

  @retval EFI_SUCCESS           The request executed successfully.
  @retval EFI_OUT_OF_RESOURCES  The request could not be completed because the
                                buffer specified by DescriptorLength and Descriptor
                                is not large enough to hold the result of the request.
  @retval EFI_TIMEOUT           A timeout occurred executing the request.
  @retval EFI_DEVICE_ERROR      The request failed due to a device error. The transfer
                                status is returned in Status.

**/
EFI_STATUS
EFIAPI
UsbGetDescriptor (
  IN  EFI_USB_IO_PROTOCOL     *UsbIo,
  IN  UINT16                  Value,
  IN  UINT16                  Index,
  IN  UINT16                  DescriptorLength,
  OUT VOID                    *Descriptor,
  OUT UINT32                  *Status
  );

Ethin wrote:I get (in the EFI shell) the error:

int usb_desc_get_descriptor(USBDevice *dev, USBPacket *p,
                            int value, uint8_t *dest, size_t len)
{
    bool msos = (dev->flags & (1 << USB_DEV_FLAG_MSOS_DESC_IN_USE));
    const USBDesc *desc = usb_device_get_usb_desc(dev);
    const USBDescDevice *other_dev;
    uint8_t buf[256];
    uint8_t type = value >> 8;
    uint8_t index = value & 0xff;
    int flags, ret = -1;

The wValue field specifies the descriptor type in the high byte (refer to Table 9-6) and the descriptor index in the low byte. The descriptor index is used to select a specific descriptor (only for configuration and string descriptors) when several descriptors of the same type are implemented in a device. For example, a device can implement several configuration descriptors. For other standard descriptors that can be retrieved via a GetDescriptor() request, a descriptor index of zero shall be used. The range of values used for a descriptor index is from 0 to one less than the number of descriptors of that type (excluding string descriptors) implemented by the device.

]The wIndex field specifies the Language ID for string descriptors or is reset to zero for other descriptors. The wLength field specifies the number of bytes to return. If the descriptor is longer than the wLength field, only the initial bytes of the descriptor are returned. If the descriptor is shorter than the wLength field, the device indicates the end of the control transfer by sending a short packet when further data is requested.

The standard request to a device supports four types of descriptors: device, configuration, BOS (Binary device Object Store), and string. As noted in Section 9.2.6.6, a device operating at Gen X speed reports the other speeds it supports via the BOS descri ptor and shall not support the device_qualifier and other_speed_configuration descriptors. A request for a configuration descriptor returns the configuration descriptor, all interface descriptors, endpoint descriptors and endpoint companion descriptors (w hen operating at Gen X speed) for all of the interfaces in a single request. The first interface descriptor follows the configuration descriptor. The endpoint descriptors for the first interface follow the first interface descriptor. In addition, Enhanced SuperSpeed devices shall return Endpoint Companion descriptors for each of the endpoints in that interface to return the endpoint capabilities required for Enhanced SuperSpeed devices, which would not fit inside the existing endpoint descriptor footprint. If there are additional interfaces, their interface descriptor, endpoint descriptors, and endpoint companion descriptors (when operating at Gen X speed) follow the first interface’s endpoint and endpoint companion (when operating at Gen X speed) descriptors.

This specification also defines a flexible and extensible framework for describing and adding device-level capabilities to the set of USB standard specifications. The BOS descriptor (refer to Section 9.6.2) defines a root descriptor that is similar to the configuration descriptor, and is the base descriptor for accessing a family of related descriptors. A host can read a BOS descriptor and learn from the wTotalLength field the entire size of the device-level descriptor set, or it can read in the entire BOS descriptor set of device capabilities. There is no way for a host to read individual device capability descriptors. The entire set can only be accessed via reading the BOS descriptor with a GetDescrip tor() request and using the length reported in the wTotalLength field.

Class-specific and/or vendor-specific descriptors follow the standard descriptors they extend or modify.

All devices shall provide a device descriptor and at least one configuration des criptor. If a device does not support a requested descriptor, it responds with a Request Error.

Default state: This is a valid request when the device is in the Default state.

Address state: This is a valid request when the device is in the Address state .

Configured state: This is a valid request when the device is in the Configured state.

    status = UsbGetDescriptor(UsbIo, interfaceDescriptor.InterfaceNumber | (USB_DESC_TYPE_CONFIG << 8), 0, 9, (void*)&Header, &UsbStatus);
    if (EFI_ERROR(status)) {
      st->BootServices->FreePool(Header);
      goto failed;
}
    status = UsbGetDescriptor(UsbIo, interfaceDescriptor.InterfaceNumber | (USB_DESC_TYPE_CONFIG << 8), 0, Header[2] | Header[3] << 8, (void*)&Header, &UsbStatus);
    if (EFI_ERROR(status)) {
      st->BootServices->FreePool(Header);
      goto failed;
    }