[libhid-discuss] Trying to repair a program using libhid to configure an Ultimarc Joystick

[Andrew Silverman]

Interesting.  I just captured some USB traffic of the manufacturer's tool uploading the data on Windows and the traffic looks pretty straightforward.

Everything is sent as a control setup packet, so I don't know where this idea came from that it needs to be written to endpoint 3 like the manufacturer was telling me :-/.  In each setup packet, the request type is 21 (Class_Interface, if I'm not mistaken), and the request is always 9 (Configure), but then the Value and Index don't make a lot of sense (0x200 and 0x2, respectively?)

Each control setup packet seems to also send 4 bytes of actual data, matching the format shown in the comments of the Linux application (Starts with 0x50, 0x09, and goes on from there.)  

Now I just need to figure out how to match that USB traffic from the Linux app.  Given what I see here, it still seems like sending control messages (albeit perhaps shorter ones, i.e. 4 bytes at a time rather than 32?) might be the right way to go.

-----Original Message-----
From: Xiaofan Chen [mailto:xiaofanc at gmail.com] 
Sent: Tuesday, March 24, 2015 9:59 PM
To: Andrew Silverman
Cc: libhid-discuss at lists.alioth.debian.org
Subject: Re: [libhid-discuss] Trying to repair a program using libhid to configure an Ultimarc Joystick

On Wed, Mar 25, 2015 at 12:12 PM, Andrew Silverman <andrewsi at microsoft.com> wrote:
> What I don't really understand is the 0x43/0xC3 bytes for requesttype 
> and the E9/EA/EB values in request. (Assuming that I am correctly 
> understanding those param mappings in the existing calls to 
> usb_control_msg, anyway.) I can't seem to find anything in the 
> description of USB control messages that makes those values make sense.

The requests from 0x40 to 0x43 (and 0x80 to 0x83) are specifically defined as "vendor" messages, where the vendor can assign any meaning they want.

So you have to carry out reverse engineering to try to understand.

Ref: USB 2.0 Specification Chapter 9.
http://www.usb.org/developers/docs/usb20_docs/


9.3 USB Device Requests

All USB devices respond to requests from the host on the device’s Default Control Pipe. These requests are made using control transfers. The request and the request’s parameters are sent to the device in the Setup packet.
The host is responsible for establishing the values passed in the fields listed in Table 9-2. EverySetup packet has eight bytes.

Table 9-2. Format of Setup Data

Offset: 0
Field: bmRequestType
Size: 1
Value: Bitmap

Characteristics of request:
D7: Data transfer direction
0 = Host-to-device
1 = Device-to-host
D6...5: Type
0 = Standard
1 = Class
2 = Vendor
3 = Reserved
D4...0: Recipient
0 = Device
1 = Interface
2 = Endpoint
3 = Other
4...31 = Reserved


--
Xiaofan