[Qemu-devel] Another question regarding hcd-ohci

[BALATON Zoltan]

Hello,

I got further with the USB driver for OpenBIOS but there's a part I don't 
understand. When configuring the keyboard it tries to get the HID 
descriptor to find out the keyboard layout from the country code (even 
though it only supports us layout so I can just skip all this for now).

The descriptor is defined in hw/usb/dev-hid.c here:

    167 static const USBDescIface desc_iface_keyboard = {
    168     .bInterfaceNumber              = 0,
    169     .bNumEndpoints                 = 1,
    170     .bInterfaceClass               = USB_CLASS_HID,
    171     .bInterfaceSubClass            = 0x01, /* boot */
    172     .bInterfaceProtocol            = 0x01, /* keyboard */
    173     .ndesc                         = 1,
    174     .descs = (USBDescOther[]) {
    175         {
    176             /* HID descriptor */
    177             .data = (uint8_t[]) {
    178                 0x09,          /*  u8  bLength */
    179                 USB_DT_HID,    /*  u8  bDescriptorType */
    180                 0x11, 0x01,    /*  u16 HID_class */
    181                 0x00,          /*  u8  country_code */
    182                 0x01,          /*  u8  num_descriptors */
    183                 USB_DT_REPORT, /*  u8  type: Report */
    184                 0x3f, 0,       /*  u16 len */
    185             },
    186         },
    187     },

To query the above HID descriptor the driver sends this packet:

ED @ 0x07c9b8c0 fa=1 en=0 d=3 s=0 k=0 f=0 mps=8 h=0 c=0
  head=0x07c9b840 tailp=0x07c9b8a0 next=0x00000000
 TD @ 0x07c9b840 8 of 8 bytes setup r=0 cbp=0x07df75f8 be=0x07df75ff
  data: 81 06 00 21 00 00 08 00

Which is generated with these parameters:

bmRequestType = (device_to_host, standard_type, iface_recp)
bRequest = GET_DESCRIPTOR
wValue = (0x21, 0)

thus I think it sends it as an InterfaceRequest and results in:

status=-3
usb-ohci: got STALL
> > HALTED!
> > getting descriptor size (type 21) failed

the code in hw/usb/dev-hid.c:usb_hid_handle_control() only checks for 0x22 
for InterfaceRequests here (by the way there's a #define for this number 
earlier in this file which is not used here):

    458     switch (request) {
    459         /* hid specific requests */
    460     case InterfaceRequest | USB_REQ_GET_DESCRIPTOR:
    461         switch (value >> 8) {
--> 462         case 0x22:
    463             if (hs->kind == HID_MOUSE) {
    464                 memcpy(data, qemu_mouse_hid_report_descriptor,
    465                        sizeof(qemu_mouse_hid_report_descriptor));

and only accepts DeviceRequests in hw/usb/desc.c:usb_desc_handle_control() 
that is called before the above:

    733     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
    734         ret = usb_desc_get_descriptor(dev, p, value, data, length);
    735         break;

What am I missing? Is the driver erroneously sending an incorrect request 
or should the emulation handle this case as well?

Regards,
BALATON Zoltan