Skip to content

Commit c048e1c

Browse files
SeanHowsonAdvCofdesbiensCopilot
authored
Implemented a bugfix for control transfer requests parsing (#218)
* No longer using request_value to get request type. * Removal of shift. * Fix GET/SET_DESCRIPTOR routing for class-defined descriptor types When a host sends GET_DESCRIPTOR or SET_DESCRIPTOR with bmRequestType set to STANDARD but requests a class-defined descriptor type (e.g. HID Report 0x22 or Physical 0x23), the request must be routed to the class layer rather than handled as a standard USB request. Per USB HID 1.11 section 7.1.1, HID stacks legitimately issue GET_DESCRIPTOR with bmRequestType=STANDARD | INTERFACE | IN for class descriptors. The previous fix (checking request_type != STANDARD) broke this path: (0x81 & 0x60) == 0x00 was seen as standard and the request would be stalled. The new condition explicitly checks: 1. request is GET_DESCRIPTOR or SET_DESCRIPTOR 2. bmRequestType type field is STANDARD 3. bDescriptorType (high byte of wValue) is in the USB-IF class-reserved range 0x21..0x2F Requests with bmRequestType already set to CLASS or VENDOR, and standard descriptors (bDescriptorType < 0x21, e.g. BOS 0x0F) or vendor descriptors (>= 0x40), are left unchanged and follow their normal dispatch path. Also fix (UINT) to (ULONG) cast, matching the declared type of request_type. Suggested-by: ABOUSTM <https://github.com/ABOUSTM> --------- Co-authored-by: Frédéric Desbiens <frederic.desbiens@eclipse-foundation.org> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 0fbb145 commit c048e1c

1 file changed

Lines changed: 13 additions & 4 deletions

File tree

common/core/src/ux_device_stack_control_request_process.c

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -109,13 +109,22 @@ ULONG application_data_length;
109109
request_index = _ux_utility_short_get(transfer_request -> ux_slave_transfer_request_setup + UX_SETUP_INDEX);
110110
request_length = _ux_utility_short_get(transfer_request -> ux_slave_transfer_request_setup + UX_SETUP_LENGTH);
111111

112-
/* Filter for GET_DESCRIPTOR/SET_DESCRIPTOR commands. If the descriptor to be returned is not a standard descriptor,
113-
treat the command as a CLASS command. */
114-
if ((request == UX_GET_DESCRIPTOR || request == UX_SET_DESCRIPTOR) && (((request_value >> 8) & UX_REQUEST_TYPE) != UX_REQUEST_TYPE_STANDARD))
112+
/* Per USB HID 1.11 section 7.1.1, GET_DESCRIPTOR/SET_DESCRIPTOR for a
113+
class-defined descriptor type (e.g. HID Report 0x22, Physical 0x23)
114+
may arrive with bmRequestType set to STANDARD rather than CLASS.
115+
Detect this via the high byte of wValue (bDescriptorType): USB-IF
116+
allocates 0x21..0x2F to class-defined descriptors, so re-route any
117+
such request to the class layer. Standard descriptors (< 0x21,
118+
including BOS 0x0F) and vendor descriptors (>= 0x40) are left
119+
unchanged. */
120+
if ((request == UX_GET_DESCRIPTOR || request == UX_SET_DESCRIPTOR) &&
121+
((request_type & UX_REQUEST_TYPE) == UX_REQUEST_TYPE_STANDARD) &&
122+
(((request_value >> 8) & 0xFFu) >= 0x21u) &&
123+
(((request_value >> 8) & 0xFFu) <= 0x2Fu))
115124
{
116125

117126
/* This request is to be handled by the class layer. */
118-
request_type &= (UINT)~UX_REQUEST_TYPE;
127+
request_type &= (ULONG)~UX_REQUEST_TYPE;
119128
request_type |= UX_REQUEST_TYPE_CLASS;
120129
}
121130

0 commit comments

Comments
 (0)