Project

General

Profile

Actions

Bug #3318

closed

out of boundaries get description during USB initialisation

Added by tsaitgaist almost 6 years ago. Updated almost 6 years ago.

Status:
Resolved
Priority:
Low
Assignee:
Category:
-
Target version:
-
Start date:
06/04/2018
Due date:
% Done:

0%

Spec Reference:

Description

while booting, during USB initialization, the host will ask to get description 238.
this description does not exist (only 0-10 exist), which causes USB to stall and SIMtrace to restart.

Serial log output (trace level 4):

-W- Sta 0x888A8 [0] -W- _ 
R0=20002561, R1=00000001, R2=00006100, R3=200024f4, R12=00000000
LR[R14]=00408edb, PC[R15]=00405814, PSR=61000200
BFAR=e000ed38, CFSR=01000000, HFSR=40000000
DFSR=00000000, AFSR=01000000, SHCSR=00000000
FORCED UNALIGNED 

=============================================================================
SIMtrace2 firmware 0.3.37-f79a-dirty (C) 2010-2016 by Harald Welte           
=============================================================================
-I- Chip ID: 0x28900960 (Ext 0x00000000)                                     
-I- Serial Nr. 44203120-4e433138-33303331-37313032
-I- Reset Cause: 0x2                              
-I- cfg 1           
-I- USB init...
USBD_Init      
USBD_Inited
Std gDesc Dev Std sAddr SetAddr(24) Std gDesc Dev Std gDesc Qua -W- Sta 0x888A8 [0] -W- _ Std gDesc Qua -W- Sta 0x888A8 [0] -W- _ Std gDesc Qua -W- Sta 0x8880C [0] -W- _ Std gDesc Cfg Std gDesc Cfg Std gDesc Cfg Std gDesc Cfg Std gDesc Cfg Std gDesc Cfg Std gDesc Str0 Std gDesc Str2 Std gDesc Str1 Std sCfg SetCfg(2) cfgChanged2 Std gDesc Str4 Std gDesc Str4 -I- calling configure of all configurations...
-I- Sniffer config
-I- cfg 2         
-I- calling init of config 2...
+++++ Configure PIOs           
Std gDesc Str0 Std gDesc Str3 Std gDesc Str0 Std gDesc Str4 Std gDesc Str0 Std gDesc Str7 Std gDesc Str238 -W- Sta 0x888A8 [0] -W- _ 
R0=20002561, R1=00000001, R2=00006100, R3=200024f4, R12=00000000
LR[R14]=00408edb, PC[R15]=00405814, PSR=61000200
BFAR=e000ed38, CFSR=01000000, HFSR=40000000
DFSR=00000000, AFSR=01000000, SHCSR=00000000
FORCED UNALIGNED 

=============================================================================
SIMtrace2 firmware 0.3.37-f79a-dirty (C) 2010-2016 by Harald Welte           
=============================================================================
-I- Chip ID: 0x28900960 (Ext 0x00000000)                                     

the error occurs at "Str238".
The code handling this error is at atmel_softpack_libraries/usb/device/core/USBDDriver.c GetDescriptor:


        case USBGenericDescriptor_STRING:
            TRACE_INFO_WP("Str%d ", indexRDesc);

            /* Check if descriptor exists */

            if (indexRDesc >= numStrings) {

                USBD_Stall(0);
            }

indexRDesc is 238 (the requested description) while numStrings is 11 (from usb_strings files).
this causes USBD_Stall, leading to a USB device reset (i.e. reboot).

The wireshark trace (simtrace2-get_description_238.pcapng.gz) confirms description 238 (0xee) is requested (packet 47 and 93).

The value 0xee (description id) is not present elsewhere in the trace, and lsusb doesn't mention it (see file).

I don't know why the host requests description 238.


Files

lsusb.txt lsusb.txt 9.27 KB tsaitgaist, 06/04/2018 01:59 PM
simtrace2-get_description_238.pcapng.gz simtrace2-get_description_238.pcapng.gz 1.94 KB tsaitgaist, 06/04/2018 02:01 PM
Actions #1

Updated by tsaitgaist almost 6 years ago

note: SIMtrace will reboot until the host stops asking for description 238, which it does after a couple of tries.

Actions #2

Updated by tsaitgaist almost 6 years ago

  • Status changed from New to Resolved

requesting string description 0xee is not a bug, it's a feature used by Microsoft Windows to further identify the USB device.
An overview of the technique is explained here: https://blogs.msdn.microsoft.com/usbcoreblog/2009/10/30/how-does-usb-stack-enumerate-a-device/
The full technique is described here: https://msdn.microsoft.com/en-us/windows/hardware/gg463179.aspx
I am not sure why Linux does it, and I did not have any other USB device for which this happens.

The solution is to respond to this request with an empty packet, instead of stalling.
Not sure if sending an empty string would be better.
The fix is in commit https://git.osmocom.org/simtrace2/commit/?h=kredon/simtrace&id=7f4f8983dd9cbb734fb30c6af70baab5daa75880

Actions

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)