Sunday, March 23, 2008

WUSB Cable Association

This document explains the Cable Association (cba) between a MS Windows host and a IOGear HUB [1] using the WiMedia application [2]. The logs analyzed here have been generated by a usb sniffer, usbsnoop [3]. This analysis was made to clarify the cable association specification. It’s the result of one day's work by me and my friend Alex.

According to the specifications something like that should happens:



Our analysis is divided into blocks. Each block has a USB control message. They are:

ASSOCIATION INFORMATION

Our first usb_message_control is a request of information association [4].

[12 ms]  >>>  URB 5 going down  >>>
-- URB_FUNCTION_CLASS_INTERFACE:
  TransferFlags          = 00000001 (USBD_TRANSFER_DIRECTION_IN, ~USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 00000100
  TransferBuffer       = 897ffd48
  TransferBufferMDL    = 00000000
  UrbLink                 = 00000000
  RequestTypeReservedBits = 00000001
  Request                 = 00000001
  Value                   = 00000000
  Index                   = 00000000
[12 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896c8008, Context=897bd968, IRQL=2
[12 ms]  <<<  URB 5 coming back  <<<
-- URB_FUNCTION_CONTROL_TRANSFER:
  PipeHandle           = 89923990
  TransferFlags        = 0000000b (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 00000019
  TransferBuffer       = 897ffd48
  TransferBufferMDL    = 8a37b4c0
  UrbLink = 00000000
  SetupPacket = 00000000: a1 01 00 00 00 00 00 01

00000000: 19 00 02 00 00 01 00 01 00 00 00 00 00 00 00 02

00000010: 00 01 00 01 00 6c 00 00 00



These colored bytes represent:

Request:
00000001Represent a CBAF GET_ASSOCIATION_INFORMATION request
Response:
19 00The full size of this structurre (including this two bytes), in this case 25 (0×19) bytes
02Number of association requests, in this case: 2. See the arrays bellow
02 00Fixed value for this kind of association
Association Requests Array:
First array element:
01Index value. 01 in this case
00Reserved byte…
01 00Certified Wireless USB should have value: 0×1 in this field.
00 0000 00 == RetriveHostInfo, in this case the host should send its CHID value to the device, should happend before the AssociateWUSB, as happend here.
00 00 00 00Represent the size of the association type, zero in this case.
Last array element:
02Index of the array, 02 in this case
00Reserved byte…
01 00Certified Wireless USB should have value: 0×1 in this field.
01 0000 01 == AssociateWUSB, in this case the host will generate a response that contains the CC and return it to the device as the RetriveHostInfo it is mandatory in the association
6c 00 00 00Association type info size, in this case 108 bytes.


In this block we have a GET_ASSICIATION_INFORMATION [4] request with an ASSOCIATION_INFORMATION [5] anwser. This ASSOCIATION_INFORMATION are composed by two ASSOCIATION_REQUEST [6], one is a RetriveHostInfo request and the another one is AssociateWUSB [7].


HOST INFORMATION

As a response of our first usb_message_control request, bellow is the host info.
[12 ms]  >>>  URB 6 going down  >>>
-- URB_FUNCTION_CLASS_INTERFACE:
  TransferFlags          = 00000000 (USBD_TRANSFER_DIRECTION_OUT, ~USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 00000054
  TransferBuffer       = 8a365268
  TransferBufferMDL    = 00000000
  UrbLink              = 00000000
  RequestTypeReservedBits = 00000001
  Request                 = 00000003
  Value                   = 00000101
  Index                   = 00000000 [12 ms]
UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896c8008, Context=89b253a8, IRQL=2 [12 ms]
URB 6 coming back
<<< 
-- URB_FUNCTION_CONTROL_TRANSFER:
PipeHandle = 89923990
TransferFlags = 0000000a (USBD_TRANSFER_DIRECTION_OUT, USBD_SHORT_TRANSFER_OK)
TransferBufferLength = 00000054
TransferBuffer = 8a365268
TransferBufferMDL = 8a37b4c0
UrbLink = 00000000
SetupPacket = 00000000: 21 03 01 01 00 00 54 00

00000000: 00 00 02 00 01 00 01 00 02 00 00 00 00 10 10 00
00000010: 13 c7 31 42 52 44 30 30 32 30 30 30 c4 9a d5 70
00000020: 08 00 02 00 10 33 0c 00 2a 00 57 00 69 00 43 00
00000030: 65 00 6e 00 74 00 65 00 72 00 20 00 57 00 69 00
00000040: 72 00 65 00 6c 00 65 00 73 00 73 00 20 00 55 00
00000050: 53 00 42 00


These colored bytes represent:

USB Control Message:
00000003SET_ASSOCIATION_RESPONSE
00 00 02 00 01 00Association type id as expected, this values are filled with the values of the last request. Attribute id: 0x0, Attribute length: 0x2 and data 0x1.
01 00 02 00 00 00Association sub type id.
13 c7 31 42 52 44 30 30 32 30 30 30 c4 9a d5 70CHID¹.
08 00 02 00 10 33Lang ID, Unicode language id code used in the next field.
0c 00 2a 00 57 00 69 00 43 00 65 00 6e 00 74 00 65 00 72 00 20 00 57 00 69 00 72 00 65 00 6c 00 65 00 73 00 73 00 20 00 55 00 53 00 42 00Host friendly name, in unicode form. In this case: "WiCenter Wireless USB" ( \x57\x69\x43\x65\x6e\x74\x65\x72\x20\x57\x69\x72\x65\x6c\x65\x73\x73\x20\x55\x53\x42 )


This is block is structured as a HOST_INFO [8]. Its request is SET_ASSOCIATION_RESPONSE.


ASSOCIATION REQUEST


As requested at the first data exchange, this is the information about the device:
[12 ms]  >>>  URB 7 going down  >>>
-- URB_FUNCTION_CLASS_INTERFACE:
  TransferFlags          = 00000003 (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 0000002c
  TransferBuffer       = 8a4c50a8
  TransferBufferMDL    = 00000000
  UrbLink                 = 00000000
  RequestTypeReservedBits = 00000001
  Request                 = 00000002
  Value                   = 00000200
  Index                   = 00000000
[13 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896c8008, Context=8a3c0f58, IRQL=2
[13 ms]  <<<  URB 7 coming back  <<<
-- URB_FUNCTION_CONTROL_TRANSFER:
  PipeHandle           = 89923990
  TransferFlags        = 0000000b (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 0000002c
  TransferBuffer       = 8a4c50a8
  TransferBufferMDL    = 8a37b4c0
    00000000: 02 00 04 00 6c 00 00 00 01 10 10 00 2a 5e 70 14
    00000010: ab 74 ec 49 e1 59 15 03 ee f6 f9 6c  04 10 02 00
    00000020: 01 00 08 00 02 00 09 04 0b 00 40 00
  UrbLink              = 00000000
  SetupPacket          =
    00000000: a1 02 00 02 00 00 2c 00

These colored bytes represent:
Request:
00000002GET_ASSOCIATION_REQUEST
Response:
02 00 04 00 6c 00 00 00Size of this structure. 0x2 represents the attribute type id and 0x4 represents the attribute length. 108 bytes in this case
01 10 10 00 2a 5e 70 14 ab 74 ec 49 e1 59 15 03 ee f6 f9 6cCDID
04 10 02 00 01 00The last 4 bytes is the band group. See section 7.4.1 of WUSB specification
08 00 02 00 09 04Language ID, used by the next field.
0b 00 40 00Device friendly name, in unicode format.


This block contains the information about the device, it exchange information about the device id, supported band groups and device friendly name [9].


SECOND ASSOCIATION REQUEST

The same request as above but now the response is complete with the device friendly name.
[13 ms]  >>>  URB 8 going down  >>>
-- URB_FUNCTION_CLASS_INTERFACE:
  TransferFlags          = 00000003 (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 0000006c
  TransferBuffer       = 89ae84c0
  TransferBufferMDL    = 00000000
  UrbLink                 = 00000000
  RequestTypeReservedBits = 00000001
  Request                 = 00000002
  Value                   = 00000200
  Index                   = 00000000
[13 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896c8008, Context=8a573930, IRQL=2
[13 ms]  <<<  URB 8 coming back  <<<
-- URB_FUNCTION_CONTROL_TRANSFER:
  PipeHandle           = 89923990
  TransferFlags        = 0000000b (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 0000006c
  TransferBuffer       = 89ae84c0
  TransferBufferMDL    = 8a37b4c0
    00000000: 02 00 04 00 6c 00 00 00 01 10 10 00 2a 5e 70 14
    00000010: ab 74 ec 49 e1 59 15 03 ee f6 f9 6c 04 10 02 00
    00000020: 01 00 08 00 02 00 09 04 0b 00 40 00 49 00 4f 00
    00000030: 47 00 45 00 41 00 52 00 20 00 57 00 55 00 53 00
    00000040: 42 00 20 00 48 00 75 00 62 00 00 00 00 00 00 00
    00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00000060: 00 00 00 00 00 00 00 00 00 00 00 00
  UrbLink              = 00000000
  SetupPacket          =
    00000000: a1 02 00 02 00 00 6c 00

These colored bytes represent:

Request:
00000002GET_ASSOCIATION_REQUEST
Response:
02 00 04 00 6c 00 00 00Size of this structure. 108 bytes in this case
01 10 10 00 2a 5e 70 14 ab 74 ec 49 e1 59 15 03 ee f6 f9 6cCDID
04 10 02 00 01 00Group band. See section 7.4.1 of WUSB specification.
08 00 02 00 09 04Language ID, used by the next field.
0b 00 40 00 49 00 4f 00 47 00 45 00 41 00 52 00 20 00 57 00 55 00 53 00 42 00 20 00 48 00 75 00 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00Device friendly name, in unicode format. In this case: "IOGEAR WUSB Hub" ( \x49\x4f\x47\x45\x41\x52\x20\x57\x55\x53\x42\x20\x48\x75\x62 )



SETTING ASSOCIATION REQUEST


This block communicates the success of the cable association operation [10]. If the association is not succeded an AssociationStatus (Attr id: 0x4 and Attr length: 0x4) is expected with the reason. The reason should be one of the listed bellow:

  • 0x1, Association unsuccessful
  • 0x2, Malformated association request
  • 0x3, Association type not supported

[10589 ms]  >>>  URB 9 going down  >>>
-- URB_FUNCTION_CLASS_INTERFACE:
  TransferFlags          = 00000000 (USBD_TRANSFER_DIRECTION_OUT, ~USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 0000004e
  TransferBuffer       = 8a003530
  TransferBufferMDL    = 00000000
    00000000: 00 00 02 00 01 00 01 00 02 00 01 00 02 00 04 00
    00000010: 4e 00 00 00 02 10 30 00 13 c7 31 42 52 44 30 30
    00000020: 32 30 30 30 c4 9a d5 70 2a 5e 70 14 ab 74 ec 49
    00000030: e1 59 15 03 ee f6 f9 6c d7 a6 f4 4c 6d 88 0f be
    00000040: b6 0c 25 ef 6f 24 a3 ed 04 10 02 00 01 00
  UrbLink                 = 00000000
  RequestTypeReservedBits = 00000001
  Request                 = 00000003
  Value                   = 00000201
  Index                   = 00000000
[10623 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896f0008, Context=896caa40, IRQL=2
[10623 ms]  <<<  URB 9 coming back  <<<
-- URB_FUNCTION_CONTROL_TRANSFER:
  PipeHandle           = 89923990
  TransferFlags        = 0000000a (USBD_TRANSFER_DIRECTION_OUT, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 0000004e
  TransferBuffer       = 8a003530
  TransferBufferMDL    = 898aac20
  UrbLink              = 00000000
  SetupPacket          =
    00000000: 21 03 01 02 00 00 4e 00

These colored bytes represent:

Request:
00000003SET_ASSOCIATION_REQUEST
Response:
00 00 02 00 01 00Association Type ID
01 00 02 00 01 00Association Sub Type ID
02 00 04 00 4e 00 00 00Length of this data structure
02 10 30 00 13 c7 31 42 52 44 30 30 32 30 30 30 c4 9a d5 70 2a 5e 70 14 ab 74 ec 49 e1 59 15 03 ee f6 f9 6c d7 a6 f4 4c 6d 88 0f be b6 0c 25 ef 6f 24 a3 edCC²
04 10 02 00 01 00Band group




¹ CHID, Conection Host Identify
² CC, Connection Context

[1] http://www.iogear.com/product/GUWH104KIT/
[2] http://www.iogear.com/support/dm/driver/GUWH104KIT#display
[3] http://benoit.papillault.free.fr/usbsnoop/
[4] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-1
[5] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-3
[6] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-4
[7] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-5
[8] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-7
[9] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-8
[10] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-9
[11] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-10

Posted by at
Labels: ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)