From a8824655730763ff6a0092fd65cee4ea54d785ab Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 12 Nov 2026 18:01:40 +0000 Subject: [PATCH] fix(usb): a configuration of 9 bytes or less is refused, and a cut one is said (#170, #171) After the configuration descriptor's first 9 bytes the event loop asked for min(wTotalLength, 128) whatever it was. A wTotalLength of 9 or less was then asked for again as "short" -- for ever, that slot never leaving enumeration (#170); 0 also issued a zero-length data stage. A set longer than the 128-byte buffer was cut without a word, its later interfaces never seen (#171). The decision is usb_config_request_length() (moved out of the event loop, then fixed): 9 or less is 0 -- "xhci: a configuration of N bytes has no interface -- not used", and nothing more is asked; longer than the buffer is cut and said -- "xhci: config of N bytes cut to 128 -- rest unseen" (at most 53 characters). The buffer stays 128 bytes; its size is #171's to rule. kernel/tests/test_usb_config.c, seen to fail first against the decision as it was (10 failures: wTotalLength 1 to 9 asked for again, the cut unsaid), now 20 checks, 0 failures. Both runs in logs/20261112-180140/kernel-tests/. Built for amd64, aarch64 and riscv64; the boots come with the protocol. #171's other box, a composite device on the SER5, is Captain Bob's. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm --- kernel/include/starkernel/usb_config.h | 5 +++++ kernel/src/usb/usb_config.c | 12 ++++++++++++ kernel/src/usb/xhci.c | 11 ++++++++++- kernel/tests/test_usb_config.c | 13 +++++++++++++ .../kernel-tests/test_usb_config.log | 3 +++ 5 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 logs/20261112-180140/kernel-tests/test_usb_config.log diff --git a/kernel/include/starkernel/usb_config.h b/kernel/include/starkernel/usb_config.h index d39cacc4..4f38b027 100644 --- a/kernel/include/starkernel/usb_config.h +++ b/kernel/include/starkernel/usb_config.h @@ -32,4 +32,9 @@ typedef struct { * a descriptor with bLength 0 ends the walk. Never reads past `len`. */ void usb_config_parse(const uint8_t *desc, uint16_t len, usb_config_t *out); +/* After the configuration descriptor's first 9 bytes: how many bytes of the whole set to ask + * for, given its wTotalLength and the buffer's size `cap` -- 0 when wTotalLength is 9 or less (the + * device is not used: #170); *cut set to 1 when the set is longer than the buffer (#171). */ +uint16_t usb_config_request_length(uint16_t total, uint16_t cap, int *cut); + #endif diff --git a/kernel/src/usb/usb_config.c b/kernel/src/usb/usb_config.c index c83e3694..524ef1d2 100644 --- a/kernel/src/usb/usb_config.c +++ b/kernel/src/usb/usb_config.c @@ -10,6 +10,18 @@ #include "starkernel/xhci.h" #include +/* The event loop asked for min(wTotalLength, cap) whatever it was. A wTotalLength of 9 or less was + * then asked for again as "short" (xhci_ep0_get_config_descriptor: length <= 9), for ever (#170), + * and a set longer than the buffer was cut without a word (#171). Now: 9 or less is refused (0), + * and a cut is said. */ +uint16_t usb_config_request_length(uint16_t total, uint16_t cap, int *cut) +{ + *cut = 0; + if (total <= 9u) return 0; /* no room for anything after the Configuration descriptor */ + if (total > cap) { *cut = 1; return cap; } + return total; +} + static uint16_t le16(const uint8_t *p) { return (uint16_t)(p[0] | ((uint16_t)p[1] << 8)); } void usb_config_parse(const uint8_t *desc, uint16_t len, usb_config_t *out) diff --git a/kernel/src/usb/xhci.c b/kernel/src/usb/xhci.c index 764e35e3..def9a5c0 100644 --- a/kernel/src/usb/xhci.c +++ b/kernel/src/usb/xhci.c @@ -2214,10 +2214,19 @@ static void xhci_poll_one(xhci_dev_t *dev) case XHCI_XFER_CONFIG_DESC_SHORT: { uint16_t total_len = (uint16_t)(xms->config_descriptor[USB_CONFIG_OFF_TOTAL_LENGTH] | ((uint16_t)xms->config_descriptor[USB_CONFIG_OFF_TOTAL_LENGTH + 1] << 8)); + int cut; + uint16_t want = usb_config_request_length(total_len, (uint16_t)sizeof(xms->config_descriptor), &cut); xms->config_total_length = total_len; xhci_log_hex32("xhci: config wTotalLength=", total_len); + if (want == 0) { /* #170: it would be asked for again, for ever */ + log_message(LOG_WARN, "xhci: a configuration of %u bytes has no interface -- not used", (unsigned)total_len); + break; + } + if (cut) /* #171: interfaces past the buffer are not seen */ + log_message(LOG_WARN, "xhci: config of %u bytes cut to %u -- rest unseen", + (unsigned)total_len, (unsigned)want); xms->next_action = XHCI_NEXT_ACTION_GET_CONFIG_DESC; - xms->next_action_length = total_len; + xms->next_action_length = want; break; } case XHCI_XFER_CONFIG_DESC_FULL: { diff --git a/kernel/tests/test_usb_config.c b/kernel/tests/test_usb_config.c index ebf49f7c..507808a1 100644 --- a/kernel/tests/test_usb_config.c +++ b/kernel/tests/test_usb_config.c @@ -69,5 +69,18 @@ int main(void) usb_config_parse(set, 16, &c); CHECK(c.kind == USB_CONFIG_NO_INTERFACE, "an interface cut before its protocol byte: none found (kind %d)", c.kind); + /* #170: after the first 9 bytes, the set is asked for again in full -- a wTotalLength that is + * no longer than those 9 bytes would be asked for again, as "short", for ever */ + { + int cut = -1; + uint16_t k; + for (k = 0; k <= 9; k++) + CHECK(usb_config_request_length(k, 128, &cut) == 0, "#170: wTotalLength %u: refused (0), not asked for again", k); + CHECK(usb_config_request_length(32, 128, &cut) == 32 && cut == 0, "a BOT stick's 32 bytes: asked for whole, not cut"); + CHECK(usb_config_request_length(128, 128, &cut) == 128 && cut == 0, "exactly the buffer: whole, not cut"); + /* #171: longer than the buffer -- cut, and said to be */ + CHECK(usb_config_request_length(300, 128, &cut) == 128 && cut == 1, "#171: 300 bytes into 128: 128 asked for, and cut (%d) said", cut); + } + return DONE(); } diff --git a/logs/20261112-180140/kernel-tests/test_usb_config.log b/logs/20261112-180140/kernel-tests/test_usb_config.log new file mode 100644 index 00000000..8a62eed0 --- /dev/null +++ b/logs/20261112-180140/kernel-tests/test_usb_config.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2e631449867c4085fec2c7f5ce1cb18270de796e64aa31b173aa7ef6db987c52 +size 652