diff options
Diffstat (limited to 'sys/linux')
| -rw-r--r-- | sys/linux/test/vusb_lan78xx | 72 | ||||
| -rw-r--r-- | sys/linux/test/vusb_rtl8150 | 25 | ||||
| -rw-r--r-- | sys/linux/test/vusb_sierra_net | 21 | ||||
| -rw-r--r-- | sys/linux/vusb.txt | 172 | ||||
| -rw-r--r-- | sys/linux/vusb.txt.const | 19 |
5 files changed, 309 insertions, 0 deletions
diff --git a/sys/linux/test/vusb_lan78xx b/sys/linux/test/vusb_lan78xx new file mode 100644 index 000000000..461ff4825 --- /dev/null +++ b/sys/linux/test/vusb_lan78xx @@ -0,0 +1,72 @@ +# This seed helps syzkaller to reliably pass the probe() checks for lan78xx driver. +# As some CTRL requests occur during the probe, a few syz_usb_control_io() calls may +# be in a weird order or even duplicate. + +# TODO: currently, probe does not succeed completely. Most likely, it stems from the fact that +# the abundance of expected CTRL requests *during* probe is not something syzkaller can handle at the moment. +# Timing is essential among other things. This should be mitigated by a separate syz_usb_connect pseudo-call +# that deals with such requests without syz_usb_control_io. + +# Ensure that we pass driver-specific basic usb interface and endpoint checks during initial probe() stages. + +r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x0, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x81, 0x2, 0x200, 0x0, 0x0, 0x0, ""}, {0x9, 0x5, 0x2, 0x2, 0x200, 0x0, 0x0, 0x0, ""}, {0x9, 0x5, 0x83, 0x3, 0x40, 0x1, 0x0, 0x0, ""}}}}}}]}}, 0x0) + +# This is where the fun begins. +# Functions like lan78xx_bind() and lan78xx_phy_init() in lan78xx_probe() utilize ~50 CTRL requests, both directions, during probe. + +# Write to INT_EP_CTL register in lan78xx_setup_irq_domain(). + +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x20, 0x11, 0x0, ""}, 0x0, 0x0, 0x0, 0x0, 0x0}) + +# Write to HW_CFG register in lan78xx_reset(). + +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000600)={0x40, 0x11, 0x0, ""}, 0x0, 0x0, 0x0, 0x0, 0x0}) + +# Read from HW_CFG register. + +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) + +# Write to HW_CFG register. + +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000f00)={0x34, &(0x7f0000000cc0)={0x40, 0x10, 0x0, ""}, 0x0, 0x0, 0x0, 0x0, 0x0}) + +# Write to RX_ADDRL and RX_ADDRH registers in lan78xx_init_mac_address(). + +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001240)={0x34, &(0x7f0000001080)={0x0, 0x6, 0x0, ""}, 0x0, 0x0, 0x0, 0x0, 0x0}) +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001500)={0x20, 0x18, 0x1, ')'}, 0x0, 0x0, 0x0, 0x0, 0x0}) + +# Read from MAF_LO(0) and MAF_HI(0) registers. + +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) + +# Write to ID_REV register, back in lan78xx_reset(). + +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002180)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) + +# Write and read to/from USB_CFG0 register. + +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000500)={0x0, 0x7, 0x0, ""}, 0x0, 0x0, 0x0, 0x0, 0x0}) +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) + +# Write to USB_CFG1 register in lan78xx_init_ltm(). + +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002540)={0x34, &(0x7f0000002340)={0x0, 0xf, 0x0, ""}, 0x0, 0x0, 0x0, 0x0, 0x0}) + +# Read from 6 registers (LTM_BELT_IDLE0 etc.) in a row. + +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) + +# Read from BURST_CAP and BULK_IN_DLY registers in lan78xx_reset(). + +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) +syz_usb_control_io$lan78xx(r0, 0x0, 0x0) + +# Write to HW_CFG register. + +syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000840)={0x0, 0x0, 0x0, ""}, 0x0, 0x0, 0x0, 0x0, 0x0}) diff --git a/sys/linux/test/vusb_rtl8150 b/sys/linux/test/vusb_rtl8150 new file mode 100644 index 000000000..6f8accf7c --- /dev/null +++ b/sys/linux/test/vusb_rtl8150 @@ -0,0 +1,25 @@ +# This seed helps syzkaller to reliably pass the probe() checks for rtl8150 driver. +# As some CTRL requests occur during the probe, a few syz_usb_control_io() calls may +# be in a weird order or even duplicate. + +# Ensure that we pass driver-specific basic usb interface and endpoint checks during initial probe() stages. + +r0 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x80, 0x0, {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4, ""}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e, ""}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8, ""}}}}}}]}}, 0x0) + +# During probe, rtl8150_reset() requires reading/writing registers via usb_control_msg(), see: +# https://elixir.bootlin.com/linux/v6.16/source/drivers/net/usb/rtl8150.c#L316 + +# The timing of dealing with CTRL requests is very awkward. So as not to fail dealing with registers, these calls come in. +# They are not directly related to rtl8150 code itself yet seem to be making that the next calls below run on time. +# TODO: figure out the circumstances fully and consider switching to sleep/nanosleep instead. + +syz_usb_control_io$rtl8150(r0, &(0x7f0000000580)={0x14, 0x0, &(0x7f0000000480)={0x0, 0x3, 0x3, @lang_id={0x0, 0x3, 0x0}}}, 0x0) +syz_usb_control_io$rtl8150(r0, &(0x7f0000002980)={0x14, 0x0, &(0x7f00000028c0)={0x0, 0x3, 0x3, @lang_id={0x0, 0x3, 0x0}}}, 0x0) + +# Receive a request via set_registers(). + +syz_usb_control_io$rtl8150(r0, 0x0, 0x0) + +# Send a request via get_registers(). Sent data should make the while{} loop in rtl8150_reset() stop early. + +syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000004280)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004240)={0x40, 0x5, 0x2, "2bd8"}}) diff --git a/sys/linux/test/vusb_sierra_net b/sys/linux/test/vusb_sierra_net new file mode 100644 index 000000000..482f7619f --- /dev/null +++ b/sys/linux/test/vusb_sierra_net @@ -0,0 +1,21 @@ +# This seed helps syzkaller to reliably pass the probe() checks for sierra_net driver. +# As some CTRL requests occur during the probe, a few syz_usb_control_io() calls may +# be in a weird order or even duplicate. + +# Ensure that we pass driver-specific basic usb interface and endpoint checks during initial probe() stages. + +r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe, ""}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3, ""}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32, ""}}}}}}]}}, 0x0) + +# To pass the probe, at the minumum one has to make the crafted device write to the driver in sierra_net_get_fw_attr(), see: +# https://elixir.bootlin.com/linux/v6.16/source/drivers/net/usb/sierra_net.c#L636 +# Technically, there are other CTRL requests, such as the ones in sierra_net_dosync() - however, they are allowed to fail, so we can ignore them. + +# Seemingly, this call is only here to keep the timing right. +# TODO: fix the expected delay with sleep/nanosleep. + +syz_usb_control_io$sierra_net(r0, 0x0, 0x0) + +# Send a CTRL request to driver concerning firmware data. See: +# https://elixir.bootlin.com/linux/v6.16/source/drivers/net/usb/sierra_net.c#L743 + +syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x20, 0x21, 0x8, {0x8, 0x11, "e4ff14eca81f"}}, 0x0}, 0x0) diff --git a/sys/linux/vusb.txt b/sys/linux/vusb.txt index da0f1dc45..217552ac7 100644 --- a/sys/linux/vusb.txt +++ b/sys/linux/vusb.txt @@ -1438,3 +1438,175 @@ htc_frame_flags = HTC_FLAGS_RECV_TRAILER # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# Assorted driver-specific descriptions of generic syz_* calls' variants. + +# Generic calls such as syz_usb_connect() and syz_usb_control_io() should be enough +# (in theory) to emulate a proper device and finish driver probes without a hitch. +# However, there are cases when syzkaller fails to come up with correct inputs to achieve it. +# Use fixed descriptors to quickly pass through probe() to access select drivers' post-probe functionality. + +# It is important to note that, one way or another, drivers in question require multiple control requests +# between a driver and a device processed during probe(). Descriptions below do not deal with specific +# CTRL requests as such (except for basic information included in vusb_responses_XXX). Instead, rely on +# seeds, created both manually and with syzkaller's help. For examples, see sys/linux/test/vusb_XXX. + +# Common constants for endpoint descriptors. +define USB_ENDPOINT_BULK_ATTR (USB_ENDPOINT_XFER_BULK) +define USB_ENDPOINT_INT_ATTR (USB_ENDPOINT_XFER_INT) + +define USB_FIXED_ENDPOINT_BULK_IN_ADDR (1 | USB_DIR_IN) +define USB_FIXED_ENDPOINT_BULK_OUT_ADDR (2) +define USB_FIXED_ENDPOINT_INT_IN_ADDR (3 | USB_DIR_IN) + +define USB_RECIP_DEVICE 0x00 + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# rtl8150 driver specific descriptions. + +resource fd_usb_rtl8150[fd_usb] + +syz_usb_connect$rtl8150(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_rtl8150], conn_descs const[0]) fd_usb_rtl8150 (timeout[3000], prog_timeout[3000], remote_cover) +syz_usb_control_io$rtl8150(fd fd_usb_rtl8150, descs ptr[in, vusb_descriptors_rtl8150], resps ptr[in, vusb_responses_rtl8150]) (timeout[300], remote_cover) + +usb_device_descriptor_rtl8150 { + inner usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0xbda, 0x8150, 0, array[usb_config_descriptor_rtl8150, 1]] +} [packed] + +usb_config_descriptor_rtl8150 { + inner usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_rtl8150] +} [packed] + +usb_interface_descriptor_rtl8150 { + iface usb_interface_descriptor_fixed_t[0, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_rtl8150] +} [packed] + +usb_endpoint_descriptors_rtl8150 { + bulk_in usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_IN_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void] + bulk_out usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_OUT_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void] + int_in usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_INT_IN_ADDR, USB_ENDPOINT_INT_ATTR, 64, 1, void] +} [packed] + +vusb_descriptors_rtl8150 { + len len[parent, int32] + generic ptr[in, vusb_descriptor_generic] + + USB_DT_STRING ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]] +} [packed] + +vusb_responses_rtl8150 { + len len[parent, int32] + generic ptr[in, vusb_response_generic] + + USB_REQ_GET_INTERFACE ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]] + USB_REQ_GET_CONFIGURATION ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]] + + RTL8150_REQ_GET_REGS ptr[in, vusb_response_t[RTL8150_REQT_READ, RTL8150_REQ_GET_REGS, array[int8, 0:6]]] + RTL8150_REQ_SET_REGS ptr[in, vusb_response_t[RTL8150_REQT_WRITE, RTL8150_REQ_SET_REGS, array[int8, 0:6]]] +} [packed] + +define RTL8150_REQ_GET_REGS 0x05 +define RTL8150_REQ_SET_REGS 0x05 +define RTL8150_REQT_READ 0xc0 +define RTL8150_REQT_WRITE 0x40 + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# sierra_net driver specific descriptions. + +resource fd_usb_sierra_net[fd_usb] + +syz_usb_connect$sierra_net(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_sierra_net], conn_descs const[0]) fd_usb_sierra_net (timeout[3000], prog_timeout[3000], remote_cover) +syz_usb_control_io$sierra_net(fd fd_usb_sierra_net, descs ptr[in, vusb_descriptors_sierra_net], resps ptr[in, vusb_responses_sierra_net]) (timeout[300], remote_cover) + +usb_device_descriptor_sierra_net { + inner usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0x1199, 0x68a3, 0, array[usb_config_descriptor_sierra_net, 1]] +} [packed] + +usb_config_descriptor_sierra_net { + inner usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_sierra_net] +} [packed] + +usb_interface_descriptor_sierra_net { + iface usb_interface_descriptor_fixed_t[7, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_sierra_net] +} [packed] + +# sierra_net driver does not expect fixed ep addresses, so refrain from being too specific here. +# As long as we ensure there are 3 endpoints, 2 bulk and 1 int, syzkaller should figure it out. +usb_endpoint_descriptors_sierra_net { + bulk_in usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_BULK_ATTR, int8], void] + bulk_out usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_BULK_ATTR, int8], void] + status usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_INT_ATTR, int8], void] +} [packed] + +vusb_descriptors_sierra_net { + len len[parent, int32] + generic ptr[in, vusb_descriptor_generic] + + USB_DT_STRING ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]] +} [packed] + +vusb_responses_sierra_net { + len len[parent, int32] + generic ptr[in, vusb_response_generic] + + USB_CDC_GET_ENCAPSULATED_RESPONSE ptr[in, vusb_response_t[SIERRA_CMD_TYPE_IN, USB_CDC_GET_ENCAPSULATED_RESPONSE, array[int8, 1024]]] + USB_CDC_SEND_ENCAPSULATED_COMMANDT ptr[in, vusb_response_t[SIERRA_CMD_TYPE_OUT, USB_CDC_SEND_ENCAPSULATED_COMMAND, array[int8, 0:4]]] +} [packed] + +define SIERRA_CMD_TYPE_IN (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) +define SIERRA_CMD_TYPE_OUT (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +# lan78xx driver specific descriptions. +# While these syz_* variants noticably help with the probe() process, they are not enough. +# This is due to a high number of control requests expected between the driver and the device. + +include <drivers/net/usb/smsc95xx.h> + +resource fd_usb_lan78xx[fd_usb] + +syz_usb_connect$lan78xx(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_lan78xx], conn_descs const[0]) fd_usb_lan78xx (timeout[3000], prog_timeout[3000], remote_cover) +syz_usb_control_io$lan78xx(fd fd_usb_lan78xx, descs ptr[in, vusb_descriptors_lan78xx], resps ptr[in, vusb_responses_lan78xx]) (timeout[300], remote_cover) + +usb_device_descriptor_lan78xx { + inner usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0x424, 0x7850, 0, array[usb_config_descriptor_lan78xx, 1]] +} [packed] + +usb_config_descriptor_lan78xx { + inner usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_lan78xx] +} [packed] + +usb_interface_descriptor_lan78xx { + iface usb_interface_descriptor_fixed_t[0, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_lan78xx] +} [packed] + +usb_endpoint_descriptors_lan78xx { + bulk_in usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_IN_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void] + bulk_out usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_OUT_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void] + int_in usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_INT_IN_ADDR, USB_ENDPOINT_INT_ATTR, 64, 1, void] +} [packed] + +vusb_descriptors_lan78xx { + len len[parent, int32] + generic ptr[in, vusb_descriptor_generic] + + USB_DT_STRING ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]] +} [packed] + +vusb_responses_lan78xx { + len len[parent, int32] + generic ptr[in, vusb_response_generic] + + USB_REQ_GET_INTERFACE ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]] + USB_REQ_GET_CONFIGURATION ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]] + + USB_VENDOR_REQUEST_READ_REGISTER ptr[in, vusb_response_t[LAN78XX_REG_TYPE_IN, USB_VENDOR_REQUEST_READ_REGISTER, int32]] + USB_VENDOR_REQUEST_WRITE_REGISTER ptr[in, vusb_response_t[LAN78XX_REG_TYPE_OUT, USB_VENDOR_REQUEST_WRITE_REGISTER, int32]] + USB_VENDOR_REQUEST_GET_STATS ptr[in, vusb_response_t[LAN78XX_REG_TYPE_IN, USB_VENDOR_REQUEST_GET_STATS, array[int8, 47]]] +} [packed] + +define LAN78XX_REG_TYPE_IN (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE) +define LAN78XX_REG_TYPE_OUT (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE) diff --git a/sys/linux/vusb.txt.const b/sys/linux/vusb.txt.const index 5eb8cfe6f..b707e8dc4 100644 --- a/sys/linux/vusb.txt.const +++ b/sys/linux/vusb.txt.const @@ -73,6 +73,14 @@ HUB_CHAR_PORTIND = 128 HUB_CHAR_TTTT = 96 HUB_STATUS_LOCAL_POWER = 1 HUB_STATUS_OVERCURRENT = 2 +LAN78XX_REG_TYPE_IN = 192 +LAN78XX_REG_TYPE_OUT = 64 +RTL8150_REQT_READ = 192 +RTL8150_REQT_WRITE = 64 +RTL8150_REQ_GET_REGS = 5 +RTL8150_REQ_SET_REGS = 5 +SIERRA_CMD_TYPE_IN = 161 +SIERRA_CMD_TYPE_OUT = 33 UAC1_EXTENSION_UNIT = 8 UAC1_PROCESSING_UNIT = 7 UAC_AS_GENERAL = 1 @@ -162,6 +170,7 @@ USB_CDC_COUNTRY_TYPE = 7 USB_CDC_DMM_TYPE = 20 USB_CDC_ETHERNET_TYPE = 15 USB_CDC_GET_CRC_MODE = 137 +USB_CDC_GET_ENCAPSULATED_RESPONSE = 1 USB_CDC_GET_MAX_DATAGRAM_SIZE = 135 USB_CDC_GET_NTB_FORMAT = 131 USB_CDC_GET_NTB_INPUT_SIZE = 133 @@ -181,6 +190,7 @@ USB_CDC_NCM_TYPE = 26 USB_CDC_NETWORK_TERMINAL_TYPE = 10 USB_CDC_OBEX_TYPE = 21 USB_CDC_PROTO_NONE = 0 +USB_CDC_SEND_ENCAPSULATED_COMMAND = 0 USB_CDC_SUBCLASS_ETHERNET = 6 USB_CDC_SUBCLASS_NCM = 13 USB_CDC_UNION_TYPE = 6 @@ -235,6 +245,7 @@ USB_ENDPOINT_ATH9K_BULK_OUT_ADDRESS = 1 USB_ENDPOINT_ATH9K_INT_ATTRIBUTES = 3 USB_ENDPOINT_ATH9K_INT_IN_ADDRESS = 131 USB_ENDPOINT_ATH9K_INT_OUT_ADDRESS = 4 +USB_ENDPOINT_BULK_ATTR = 2 USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES = 2 USB_ENDPOINT_CDC_ECM_IN_ADDRESS = 130 USB_ENDPOINT_CDC_ECM_NOTIFY_ADDRESS = 129 @@ -245,6 +256,7 @@ USB_ENDPOINT_HID_IN_ADDRESS = 129 USB_ENDPOINT_HID_OUT_ADDRESS = 2 USB_ENDPOINT_INTR_NOTIFICATION = 16 USB_ENDPOINT_INTR_PERIODIC = 0 +USB_ENDPOINT_INT_ATTR = 3 USB_ENDPOINT_PRINTER_ATTRIBUTES = 2 USB_ENDPOINT_PRINTER_IN_ADDRESS = 130 USB_ENDPOINT_PRINTER_OUT_ADDRESS = 1 @@ -265,6 +277,9 @@ USB_EXT_PORT_STAT_RX_LANES = 3840 USB_EXT_PORT_STAT_RX_SPEED_ID = 15 USB_EXT_PORT_STAT_TX_LANES = 61440 USB_EXT_PORT_STAT_TX_SPEED_ID = 240 +USB_FIXED_ENDPOINT_BULK_IN_ADDR = 129 +USB_FIXED_ENDPOINT_BULK_OUT_ADDR = 2 +USB_FIXED_ENDPOINT_INT_IN_ADDR = 131 USB_FULL_SPEED_OPERATION = 2 USB_HIGH_SPEED_OPERATION = 4 USB_HUB_PORTS_BITS = 4 @@ -297,6 +312,7 @@ USB_PORT_STAT_SPEED_5GBPS = 0 USB_PORT_STAT_SUSPEND = 4 USB_PORT_STAT_TEST = 2048 USB_PTM_CAP_TYPE = 11 +USB_RECIP_DEVICE = 0 USB_REQ_CLEAR_FEATURE = 1 USB_REQ_GET_BATTERY_STATUS = 21 USB_REQ_GET_CONFIGURATION = 8 @@ -366,6 +382,9 @@ USB_SUBCLASS_VENDOR_SPEC = 255 USB_TYPE_CLASS = 32 USB_TYPE_STANDARD = 0 USB_TYPE_VENDOR = 64 +USB_VENDOR_REQUEST_GET_STATS = 162 +USB_VENDOR_REQUEST_READ_REGISTER = 161 +USB_VENDOR_REQUEST_WRITE_REGISTER = 160 USB_WIRELESS_BEACON_DIRECTED = 8 USB_WIRELESS_BEACON_MASK = 12 USB_WIRELESS_BEACON_NONE = 12 |