2 * xusb: Generic USB test program
3 * Copyright © 2009-2012 Pete Batard <pete@akeo.ie>
4 * Contributions to Mass Storage by Alan Stern.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
32 #define snprintf _snprintf
33 #define putenv _putenv
36 // Future versions of libusb will use usb_interface instead of interface
37 // in libusb_config_descriptor => catter for that
38 #define usb_interface interface
41 static bool binary_dump = false;
42 static bool extra_info = false;
43 static bool force_device_request = false; // For WCID descriptor queries
44 static const char* binary_name = NULL;
46 static inline void msleep(int msecs)
51 const struct timespec ts = { msecs / 1000, (msecs % 1000) * 1000000L };
56 static void perr(char const *format, ...)
60 va_start (args, format);
61 vfprintf(stderr, format, args);
65 #define ERR_EXIT(errcode) do { perr(" %s\n", libusb_strerror((enum libusb_error)errcode)); return -1; } while (0)
66 #define CALL_CHECK(fcall) do { int _r=fcall; if (_r < 0) ERR_EXIT(_r); } while (0)
67 #define CALL_CHECK_CLOSE(fcall, hdl) do { int _r=fcall; if (_r < 0) { libusb_close(hdl); ERR_EXIT(_r); } } while (0)
68 #define B(x) (((x)!=0)?1:0)
69 #define be_to_int32(buf) (((buf)[0]<<24)|((buf)[1]<<16)|((buf)[2]<<8)|(buf)[3])
72 #define REQUEST_SENSE_LENGTH 0x12
73 #define INQUIRY_LENGTH 0x24
74 #define READ_CAPACITY_LENGTH 0x08
76 // HID Class-Specific Requests values. See section 7.2 of the HID specifications
77 #define HID_GET_REPORT 0x01
78 #define HID_GET_IDLE 0x02
79 #define HID_GET_PROTOCOL 0x03
80 #define HID_SET_REPORT 0x09
81 #define HID_SET_IDLE 0x0A
82 #define HID_SET_PROTOCOL 0x0B
83 #define HID_REPORT_TYPE_INPUT 0x01
84 #define HID_REPORT_TYPE_OUTPUT 0x02
85 #define HID_REPORT_TYPE_FEATURE 0x03
87 // Mass Storage Requests values. See section 3 of the Bulk-Only Mass Storage Class specifications
88 #define BOMS_RESET 0xFF
89 #define BOMS_GET_MAX_LUN 0xFE
91 // Microsoft OS Descriptor
92 #define MS_OS_DESC_STRING_INDEX 0xEE
93 #define MS_OS_DESC_STRING_LENGTH 0x12
94 #define MS_OS_DESC_VENDOR_CODE_OFFSET 0x10
95 static const uint8_t ms_os_desc_string[] = {
96 MS_OS_DESC_STRING_LENGTH,
98 'M', 0, 'S', 0, 'F', 0, 'T', 0, '1', 0, '0', 0, '0', 0,
101 // Section 5.1: Command Block Wrapper (CBW)
102 struct command_block_wrapper {
103 uint8_t dCBWSignature[4];
105 uint32_t dCBWDataTransferLength;
108 uint8_t bCBWCBLength;
112 // Section 5.2: Command Status Wrapper (CSW)
113 struct command_status_wrapper {
114 uint8_t dCSWSignature[4];
116 uint32_t dCSWDataResidue;
120 static const uint8_t cdb_length[256] = {
121 // 0 1 2 3 4 5 6 7 8 9 A B C D E F
122 06,06,06,06,06,06,06,06,06,06,06,06,06,06,06,06, // 0
123 06,06,06,06,06,06,06,06,06,06,06,06,06,06,06,06, // 1
124 10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10, // 2
125 10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10, // 3
126 10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10, // 4
127 10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10, // 5
128 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00, // 6
129 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00, // 7
130 16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16, // 8
131 16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16, // 9
132 12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12, // A
133 12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12, // B
134 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00, // C
135 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00, // D
136 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00, // E
137 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00, // F
140 static enum test_type {
147 static uint16_t VID, PID;
149 static void display_buffer_hex(unsigned char *buffer, unsigned size)
153 for (i=0; i<size; i+=16) {
154 printf("\n %08x ", i);
155 for(j=0,k=0; k<16; j++,k++) {
157 printf("%02x", buffer[i+j]);
164 for(j=0,k=0; k<16; j++,k++) {
166 if ((buffer[i+j] < 32) || (buffer[i+j] > 126)) {
169 printf("%c", buffer[i+j]);
177 static char* uuid_to_string(const uint8_t* uuid)
179 static char uuid_string[40];
180 if (uuid == NULL) return NULL;
181 snprintf(uuid_string, sizeof(uuid_string),
182 "{%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x}",
183 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5], uuid[6], uuid[7],
184 uuid[8], uuid[9], uuid[10], uuid[11], uuid[12], uuid[13], uuid[14], uuid[15]);
188 // The PS3 Controller is really a HID device that got its HID Report Descriptors
190 static int display_ps3_status(libusb_device_handle *handle)
192 uint8_t input_report[49];
193 uint8_t master_bt_address[8];
194 uint8_t device_bt_address[18];
196 // Get the controller's bluetooth address of its master device
197 CALL_CHECK(libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_CLASS|LIBUSB_RECIPIENT_INTERFACE,
198 HID_GET_REPORT, 0x03f5, 0, master_bt_address, sizeof(master_bt_address), 100));
199 printf("\nMaster's bluetooth address: %02X:%02X:%02X:%02X:%02X:%02X\n", master_bt_address[2], master_bt_address[3],
200 master_bt_address[4], master_bt_address[5], master_bt_address[6], master_bt_address[7]);
202 // Get the controller's bluetooth address
203 CALL_CHECK(libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_CLASS|LIBUSB_RECIPIENT_INTERFACE,
204 HID_GET_REPORT, 0x03f2, 0, device_bt_address, sizeof(device_bt_address), 100));
205 printf("\nMaster's bluetooth address: %02X:%02X:%02X:%02X:%02X:%02X\n", device_bt_address[4], device_bt_address[5],
206 device_bt_address[6], device_bt_address[7], device_bt_address[8], device_bt_address[9]);
208 // Get the status of the controller's buttons via its HID report
209 printf("\nReading PS3 Input Report...\n");
210 CALL_CHECK(libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_CLASS|LIBUSB_RECIPIENT_INTERFACE,
211 HID_GET_REPORT, (HID_REPORT_TYPE_INPUT<<8)|0x01, 0, input_report, sizeof(input_report), 1000));
212 switch(input_report[2]){ /** Direction pad plus start, select, and joystick buttons */
214 printf("\tSELECT pressed\n");
217 printf("\tLEFT 3 pressed\n");
220 printf("\tRIGHT 3 pressed\n");
223 printf("\tSTART presed\n");
226 printf("\tUP pressed\n");
229 printf("\tRIGHT pressed\n");
232 printf("\tDOWN pressed\n");
235 printf("\tLEFT pressed\n");
238 switch(input_report[3]){ /** Shapes plus top right and left buttons */
240 printf("\tLEFT 2 pressed\n");
243 printf("\tRIGHT 2 pressed\n");
246 printf("\tLEFT 1 pressed\n");
249 printf("\tRIGHT 1 presed\n");
252 printf("\tTRIANGLE pressed\n");
255 printf("\tCIRCLE pressed\n");
258 printf("\tCROSS pressed\n");
261 printf("\tSQUARE pressed\n");
264 printf("\tPS button: %d\n", input_report[4]);
265 printf("\tLeft Analog (X,Y): (%d,%d)\n", input_report[6], input_report[7]);
266 printf("\tRight Analog (X,Y): (%d,%d)\n", input_report[8], input_report[9]);
267 printf("\tL2 Value: %d\tR2 Value: %d\n", input_report[18], input_report[19]);
268 printf("\tL1 Value: %d\tR1 Value: %d\n", input_report[20], input_report[21]);
269 printf("\tRoll (x axis): %d Yaw (y axis): %d Pitch (z axis) %d\n",
270 //(((input_report[42] + 128) % 256) - 128),
271 (int8_t)(input_report[42]),
272 (int8_t)(input_report[44]),
273 (int8_t)(input_report[46]));
274 printf("\tAcceleration: %d\n\n", (int8_t)(input_report[48]));
277 // The XBOX Controller is really a HID device that got its HID Report Descriptors
278 // removed by Microsoft.
279 // Input/Output reports described at http://euc.jp/periphs/xbox-controller.ja.html
280 static int display_xbox_status(libusb_device_handle *handle)
282 uint8_t input_report[20];
283 printf("\nReading XBox Input Report...\n");
284 CALL_CHECK(libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_CLASS|LIBUSB_RECIPIENT_INTERFACE,
285 HID_GET_REPORT, (HID_REPORT_TYPE_INPUT<<8)|0x00, 0, input_report, 20, 1000));
286 printf(" D-pad: %02X\n", input_report[2]&0x0F);
287 printf(" Start:%d, Back:%d, Left Stick Press:%d, Right Stick Press:%d\n", B(input_report[2]&0x10), B(input_report[2]&0x20),
288 B(input_report[2]&0x40), B(input_report[2]&0x80));
289 // A, B, X, Y, Black, White are pressure sensitive
290 printf(" A:%d, B:%d, X:%d, Y:%d, White:%d, Black:%d\n", input_report[4], input_report[5],
291 input_report[6], input_report[7], input_report[9], input_report[8]);
292 printf(" Left Trigger: %d, Right Trigger: %d\n", input_report[10], input_report[11]);
293 printf(" Left Analog (X,Y): (%d,%d)\n", (int16_t)((input_report[13]<<8)|input_report[12]),
294 (int16_t)((input_report[15]<<8)|input_report[14]));
295 printf(" Right Analog (X,Y): (%d,%d)\n", (int16_t)((input_report[17]<<8)|input_report[16]),
296 (int16_t)((input_report[19]<<8)|input_report[18]));
300 static int set_xbox_actuators(libusb_device_handle *handle, uint8_t left, uint8_t right)
302 uint8_t output_report[6];
304 printf("\nWriting XBox Controller Output Report...\n");
306 memset(output_report, 0, sizeof(output_report));
307 output_report[1] = sizeof(output_report);
308 output_report[3] = left;
309 output_report[5] = right;
311 CALL_CHECK(libusb_control_transfer(handle, LIBUSB_ENDPOINT_OUT|LIBUSB_REQUEST_TYPE_CLASS|LIBUSB_RECIPIENT_INTERFACE,
312 HID_SET_REPORT, (HID_REPORT_TYPE_OUTPUT<<8)|0x00, 0, output_report, 06, 1000));
316 static int send_mass_storage_command(libusb_device_handle *handle, uint8_t endpoint, uint8_t lun,
317 uint8_t *cdb, uint8_t direction, int data_length, uint32_t *ret_tag)
319 static uint32_t tag = 1;
322 struct command_block_wrapper cbw;
328 if (endpoint & LIBUSB_ENDPOINT_IN) {
329 perr("send_mass_storage_command: cannot send command on IN endpoint\n");
333 cdb_len = cdb_length[cdb[0]];
334 if ((cdb_len == 0) || (cdb_len > sizeof(cbw.CBWCB))) {
335 perr("send_mass_storage_command: don't know how to handle this command (%02X, length %d)\n",
340 memset(&cbw, 0, sizeof(cbw));
341 cbw.dCBWSignature[0] = 'U';
342 cbw.dCBWSignature[1] = 'S';
343 cbw.dCBWSignature[2] = 'B';
344 cbw.dCBWSignature[3] = 'C';
347 cbw.dCBWDataTransferLength = data_length;
348 cbw.bmCBWFlags = direction;
350 // Subclass is 1 or 6 => cdb_len
351 cbw.bCBWCBLength = cdb_len;
352 memcpy(cbw.CBWCB, cdb, cdb_len);
356 // The transfer length must always be exactly 31 bytes.
357 r = libusb_bulk_transfer(handle, endpoint, (unsigned char*)&cbw, 31, &size, 1000);
358 if (r == LIBUSB_ERROR_PIPE) {
359 libusb_clear_halt(handle, endpoint);
362 } while ((r == LIBUSB_ERROR_PIPE) && (i<RETRY_MAX));
363 if (r != LIBUSB_SUCCESS) {
364 perr(" send_mass_storage_command: %s\n", libusb_strerror((enum libusb_error)r));
368 printf(" sent %d CDB bytes\n", cdb_len);
372 static int get_mass_storage_status(libusb_device_handle *handle, uint8_t endpoint, uint32_t expected_tag)
375 struct command_status_wrapper csw;
377 // The device is allowed to STALL this transfer. If it does, you have to
378 // clear the stall and try again.
381 r = libusb_bulk_transfer(handle, endpoint, (unsigned char*)&csw, 13, &size, 1000);
382 if (r == LIBUSB_ERROR_PIPE) {
383 libusb_clear_halt(handle, endpoint);
386 } while ((r == LIBUSB_ERROR_PIPE) && (i<RETRY_MAX));
387 if (r != LIBUSB_SUCCESS) {
388 perr(" get_mass_storage_status: %s\n", libusb_strerror((enum libusb_error)r));
392 perr(" get_mass_storage_status: received %d bytes (expected 13)\n", size);
395 if (csw.dCSWTag != expected_tag) {
396 perr(" get_mass_storage_status: mismatched tags (expected %08X, received %08X)\n",
397 expected_tag, csw.dCSWTag);
400 // For this test, we ignore the dCSWSignature check for validity...
401 printf(" Mass Storage Status: %02X (%s)\n", csw.bCSWStatus, csw.bCSWStatus?"FAILED":"Success");
402 if (csw.dCSWTag != expected_tag)
404 if (csw.bCSWStatus) {
405 // REQUEST SENSE is appropriate only if bCSWStatus is 1, meaning that the
406 // command failed somehow. Larger values (2 in particular) mean that
407 // the command couldn't be understood.
408 if (csw.bCSWStatus == 1)
409 return -2; // request Get Sense
414 // In theory we also should check dCSWDataResidue. But lots of devices
419 static void get_sense(libusb_device_handle *handle, uint8_t endpoint_in, uint8_t endpoint_out)
421 uint8_t cdb[16]; // SCSI Command Descriptor Block
423 uint32_t expected_tag;
428 printf("Request Sense:\n");
429 memset(sense, 0, sizeof(sense));
430 memset(cdb, 0, sizeof(cdb));
431 cdb[0] = 0x03; // Request Sense
432 cdb[4] = REQUEST_SENSE_LENGTH;
434 send_mass_storage_command(handle, endpoint_out, 0, cdb, LIBUSB_ENDPOINT_IN, REQUEST_SENSE_LENGTH, &expected_tag);
435 rc = libusb_bulk_transfer(handle, endpoint_in, (unsigned char*)&sense, REQUEST_SENSE_LENGTH, &size, 1000);
438 printf("libusb_bulk_transfer failed: %s\n", libusb_error_name(rc));
441 printf(" received %d bytes\n", size);
443 if ((sense[0] != 0x70) && (sense[0] != 0x71)) {
444 perr(" ERROR No sense data\n");
446 perr(" ERROR Sense: %02X %02X %02X\n", sense[2]&0x0F, sense[12], sense[13]);
448 // Strictly speaking, the get_mass_storage_status() call should come
449 // before these perr() lines. If the status is nonzero then we must
450 // assume there's no data in the buffer. For xusb it doesn't matter.
451 get_mass_storage_status(handle, endpoint_in, expected_tag);
454 // Mass Storage device to test bulk transfers (non destructive test)
455 static int test_mass_storage(libusb_device_handle *handle, uint8_t endpoint_in, uint8_t endpoint_out)
459 uint32_t expected_tag;
460 uint32_t i, max_lba, block_size;
462 uint8_t cdb[16]; // SCSI Command Descriptor Block
464 char vid[9], pid[9], rev[5];
468 printf("Reading Max LUN:\n");
469 r = libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_CLASS|LIBUSB_RECIPIENT_INTERFACE,
470 BOMS_GET_MAX_LUN, 0, 0, &lun, 1, 1000);
471 // Some devices send a STALL instead of the actual value.
472 // In such cases we should set lun to 0.
476 perr(" Failed: %s", libusb_strerror((enum libusb_error)r));
478 printf(" Max LUN = %d\n", lun);
481 printf("Sending Inquiry:\n");
482 memset(buffer, 0, sizeof(buffer));
483 memset(cdb, 0, sizeof(cdb));
484 cdb[0] = 0x12; // Inquiry
485 cdb[4] = INQUIRY_LENGTH;
487 send_mass_storage_command(handle, endpoint_out, lun, cdb, LIBUSB_ENDPOINT_IN, INQUIRY_LENGTH, &expected_tag);
488 CALL_CHECK(libusb_bulk_transfer(handle, endpoint_in, (unsigned char*)&buffer, INQUIRY_LENGTH, &size, 1000));
489 printf(" received %d bytes\n", size);
490 // The following strings are not zero terminated
491 for (i=0; i<8; i++) {
492 vid[i] = buffer[8+i];
493 pid[i] = buffer[16+i];
494 rev[i/2] = buffer[32+i/2]; // instead of another loop
499 printf(" VID:PID:REV \"%8s\":\"%8s\":\"%4s\"\n", vid, pid, rev);
500 if (get_mass_storage_status(handle, endpoint_in, expected_tag) == -2) {
501 get_sense(handle, endpoint_in, endpoint_out);
505 printf("Reading Capacity:\n");
506 memset(buffer, 0, sizeof(buffer));
507 memset(cdb, 0, sizeof(cdb));
508 cdb[0] = 0x25; // Read Capacity
510 send_mass_storage_command(handle, endpoint_out, lun, cdb, LIBUSB_ENDPOINT_IN, READ_CAPACITY_LENGTH, &expected_tag);
511 CALL_CHECK(libusb_bulk_transfer(handle, endpoint_in, (unsigned char*)&buffer, READ_CAPACITY_LENGTH, &size, 1000));
512 printf(" received %d bytes\n", size);
513 max_lba = be_to_int32(&buffer[0]);
514 block_size = be_to_int32(&buffer[4]);
515 device_size = ((double)(max_lba+1))*block_size/(1024*1024*1024);
516 printf(" Max LBA: %08X, Block Size: %08X (%.2f GB)\n", max_lba, block_size, device_size);
517 if (get_mass_storage_status(handle, endpoint_in, expected_tag) == -2) {
518 get_sense(handle, endpoint_in, endpoint_out);
521 // coverity[tainted_data]
522 data = (unsigned char*) calloc(1, block_size);
524 perr(" unable to allocate data buffer\n");
529 printf("Attempting to read %u bytes:\n", block_size);
530 memset(cdb, 0, sizeof(cdb));
532 cdb[0] = 0x28; // Read(10)
533 cdb[8] = 0x01; // 1 block
535 send_mass_storage_command(handle, endpoint_out, lun, cdb, LIBUSB_ENDPOINT_IN, block_size, &expected_tag);
536 libusb_bulk_transfer(handle, endpoint_in, data, block_size, &size, 5000);
537 printf(" READ: received %d bytes\n", size);
538 if (get_mass_storage_status(handle, endpoint_in, expected_tag) == -2) {
539 get_sense(handle, endpoint_in, endpoint_out);
541 display_buffer_hex(data, size);
542 if ((binary_dump) && ((fd = fopen(binary_name, "w")) != NULL)) {
543 if (fwrite(data, 1, (size_t)size, fd) != (unsigned int)size) {
544 perr(" unable to write binary data\n");
555 static int get_hid_record_size(uint8_t *hid_report_descriptor, int size, int type)
559 int record_size[3] = {0, 0, 0};
560 int nb_bits = 0, nb_items = 0;
561 bool found_record_marker;
563 found_record_marker = false;
564 for (i = hid_report_descriptor[0]+1; i < size; i += offset) {
565 offset = (hid_report_descriptor[i]&0x03) + 1;
568 switch (hid_report_descriptor[i] & 0xFC) {
569 case 0x74: // bitsize
570 nb_bits = hid_report_descriptor[i+1];
574 for (j=1; j<offset; j++) {
575 nb_items = ((uint32_t)hid_report_descriptor[i+j]) << (8*(j-1));
579 found_record_marker = true;
583 found_record_marker = true;
586 case 0xb0: // feature
587 found_record_marker = true;
590 case 0xC0: // end of collection
597 if (found_record_marker) {
598 found_record_marker = false;
599 record_size[j] += nb_items*nb_bits;
602 if ((type < HID_REPORT_TYPE_INPUT) || (type > HID_REPORT_TYPE_FEATURE)) {
605 return (record_size[type - HID_REPORT_TYPE_INPUT]+7)/8;
609 static int test_hid(libusb_device_handle *handle, uint8_t endpoint_in)
611 int r, size, descriptor_size;
612 uint8_t hid_report_descriptor[256];
613 uint8_t *report_buffer;
616 printf("\nReading HID Report Descriptors:\n");
617 descriptor_size = libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_STANDARD|LIBUSB_RECIPIENT_INTERFACE,
618 LIBUSB_REQUEST_GET_DESCRIPTOR, LIBUSB_DT_REPORT<<8, 0, hid_report_descriptor, sizeof(hid_report_descriptor), 1000);
619 if (descriptor_size < 0) {
623 display_buffer_hex(hid_report_descriptor, descriptor_size);
624 if ((binary_dump) && ((fd = fopen(binary_name, "w")) != NULL)) {
625 if (fwrite(hid_report_descriptor, 1, descriptor_size, fd) != (size_t)descriptor_size) {
626 printf(" Error writing descriptor to file\n");
631 size = get_hid_record_size(hid_report_descriptor, descriptor_size, HID_REPORT_TYPE_FEATURE);
633 printf("\nSkipping Feature Report readout (None detected)\n");
635 report_buffer = (uint8_t*) calloc(size, 1);
636 if (report_buffer == NULL) {
640 printf("\nReading Feature Report (length %d)...\n", size);
641 r = libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_CLASS|LIBUSB_RECIPIENT_INTERFACE,
642 HID_GET_REPORT, (HID_REPORT_TYPE_FEATURE<<8)|0, 0, report_buffer, (uint16_t)size, 5000);
644 display_buffer_hex(report_buffer, size);
647 case LIBUSB_ERROR_NOT_FOUND:
648 printf(" No Feature Report available for this device\n");
650 case LIBUSB_ERROR_PIPE:
651 printf(" Detected stall - resetting pipe...\n");
652 libusb_clear_halt(handle, 0);
655 printf(" Error: %s\n", libusb_strerror((enum libusb_error)r));
662 size = get_hid_record_size(hid_report_descriptor, descriptor_size, HID_REPORT_TYPE_INPUT);
664 printf("\nSkipping Input Report readout (None detected)\n");
666 report_buffer = (uint8_t*) calloc(size, 1);
667 if (report_buffer == NULL) {
671 printf("\nReading Input Report (length %d)...\n", size);
672 r = libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_CLASS|LIBUSB_RECIPIENT_INTERFACE,
673 HID_GET_REPORT, (HID_REPORT_TYPE_INPUT<<8)|0x00, 0, report_buffer, (uint16_t)size, 5000);
675 display_buffer_hex(report_buffer, size);
678 case LIBUSB_ERROR_TIMEOUT:
679 printf(" Timeout! Please make sure you act on the device within the 5 seconds allocated...\n");
681 case LIBUSB_ERROR_PIPE:
682 printf(" Detected stall - resetting pipe...\n");
683 libusb_clear_halt(handle, 0);
686 printf(" Error: %s\n", libusb_strerror((enum libusb_error)r));
691 // Attempt a bulk read from endpoint 0 (this should just return a raw input report)
692 printf("\nTesting interrupt read using endpoint %02X...\n", endpoint_in);
693 r = libusb_interrupt_transfer(handle, endpoint_in, report_buffer, size, &size, 5000);
695 display_buffer_hex(report_buffer, size);
697 printf(" %s\n", libusb_strerror((enum libusb_error)r));
705 // Read the MS WinUSB Feature Descriptors, that are used on Windows 8 for automated driver installation
706 static void read_ms_winsub_feature_descriptors(libusb_device_handle *handle, uint8_t bRequest, int iface_number)
708 #define MAX_OS_FD_LENGTH 256
710 uint8_t os_desc[MAX_OS_FD_LENGTH];
712 void* le_type_punning_IS_fine;
717 uint16_t header_size;
719 {"Extended Compat ID", LIBUSB_RECIPIENT_DEVICE, 0x0004, 0x10},
720 {"Extended Properties", LIBUSB_RECIPIENT_INTERFACE, 0x0005, 0x0A}
723 if (iface_number < 0) return;
724 // WinUSB has a limitation that forces wIndex to the interface number when issuing
725 // an Interface Request. To work around that, we can force a Device Request for
726 // the Extended Properties, assuming the device answers both equally.
727 if (force_device_request)
728 os_fd[1].recipient = LIBUSB_RECIPIENT_DEVICE;
730 for (i=0; i<2; i++) {
731 printf("\nReading %s OS Feature Descriptor (wIndex = 0x%04d):\n", os_fd[i].desc, os_fd[i].index);
733 // Read the header part
734 r = libusb_control_transfer(handle, (uint8_t)(LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_VENDOR|os_fd[i].recipient),
735 bRequest, (uint16_t)(((iface_number)<< 8)|0x00), os_fd[i].index, os_desc, os_fd[i].header_size, 1000);
736 if (r < os_fd[i].header_size) {
737 perr(" Failed: %s", (r<0)?libusb_strerror((enum libusb_error)r):"header size is too small");
740 le_type_punning_IS_fine = (void*)os_desc;
741 length = *((uint32_t*)le_type_punning_IS_fine);
742 if (length > MAX_OS_FD_LENGTH) {
743 length = MAX_OS_FD_LENGTH;
746 // Read the full feature descriptor
747 r = libusb_control_transfer(handle, (uint8_t)(LIBUSB_ENDPOINT_IN|LIBUSB_REQUEST_TYPE_VENDOR|os_fd[i].recipient),
748 bRequest, (uint16_t)(((iface_number)<< 8)|0x00), os_fd[i].index, os_desc, (uint16_t)length, 1000);
750 perr(" Failed: %s", libusb_strerror((enum libusb_error)r));
753 display_buffer_hex(os_desc, r);
758 static void print_device_cap(struct libusb_bos_dev_capability_descriptor *dev_cap)
760 switch(dev_cap->bDevCapabilityType) {
761 case LIBUSB_BT_USB_2_0_EXTENSION: {
762 struct libusb_usb_2_0_extension_descriptor *usb_2_0_ext = NULL;
763 libusb_get_usb_2_0_extension_descriptor(NULL, dev_cap, &usb_2_0_ext);
765 printf(" USB 2.0 extension:\n");
766 printf(" attributes : %02X\n", usb_2_0_ext->bmAttributes);
767 libusb_free_usb_2_0_extension_descriptor(usb_2_0_ext);
771 case LIBUSB_BT_SS_USB_DEVICE_CAPABILITY: {
772 struct libusb_ss_usb_device_capability_descriptor *ss_usb_device_cap = NULL;
773 libusb_get_ss_usb_device_capability_descriptor(NULL, dev_cap, &ss_usb_device_cap);
774 if (ss_usb_device_cap) {
775 printf(" USB 3.0 capabilities:\n");
776 printf(" attributes : %02X\n", ss_usb_device_cap->bmAttributes);
777 printf(" supported speeds : %04X\n", ss_usb_device_cap->wSpeedSupported);
778 printf(" supported functionality: %02X\n", ss_usb_device_cap->bFunctionalitySupport);
779 libusb_free_ss_usb_device_capability_descriptor(ss_usb_device_cap);
783 case LIBUSB_BT_CONTAINER_ID: {
784 struct libusb_container_id_descriptor *container_id = NULL;
785 libusb_get_container_id_descriptor(NULL, dev_cap, &container_id);
787 printf(" Container ID:\n %s\n", uuid_to_string(container_id->ContainerID));
788 libusb_free_container_id_descriptor(container_id);
793 printf(" Unknown BOS device capability %02x:\n", dev_cap->bDevCapabilityType);
797 static int test_device(uint16_t vid, uint16_t pid)
799 libusb_device_handle *handle;
801 uint8_t bus, port_path[8];
802 struct libusb_bos_descriptor *bos_desc;
803 struct libusb_config_descriptor *conf_desc;
804 const struct libusb_endpoint_descriptor *endpoint;
806 int iface, nb_ifaces, first_iface = -1;
807 struct libusb_device_descriptor dev_desc;
808 const char* const speed_name[6] = { "Unknown", "1.5 Mbit/s (USB LowSpeed)", "12 Mbit/s (USB FullSpeed)",
809 "480 Mbit/s (USB HighSpeed)", "5000 Mbit/s (USB SuperSpeed)", "10000 Mbit/s (USB SuperSpeedPlus)" };
811 uint8_t string_index[3]; // indexes of the string descriptors
812 uint8_t endpoint_in = 0, endpoint_out = 0; // default IN and OUT endpoints
814 printf("Opening device %04X:%04X...\n", vid, pid);
815 handle = libusb_open_device_with_vid_pid(NULL, vid, pid);
817 if (handle == NULL) {
822 dev = libusb_get_device(handle);
823 bus = libusb_get_bus_number(dev);
825 r = libusb_get_port_numbers(dev, port_path, sizeof(port_path));
827 printf("\nDevice properties:\n");
828 printf(" bus number: %d\n", bus);
829 printf(" port path: %d", port_path[0]);
830 for (i=1; i<r; i++) {
831 printf("->%d", port_path[i]);
833 printf(" (from root hub)\n");
835 r = libusb_get_device_speed(dev);
836 if ((r<0) || (r>5)) r=0;
837 printf(" speed: %s\n", speed_name[r]);
840 printf("\nReading device descriptor:\n");
841 CALL_CHECK_CLOSE(libusb_get_device_descriptor(dev, &dev_desc), handle);
842 printf(" length: %d\n", dev_desc.bLength);
843 printf(" device class: %d\n", dev_desc.bDeviceClass);
844 printf(" S/N: %d\n", dev_desc.iSerialNumber);
845 printf(" VID:PID: %04X:%04X\n", dev_desc.idVendor, dev_desc.idProduct);
846 printf(" bcdDevice: %04X\n", dev_desc.bcdDevice);
847 printf(" iMan:iProd:iSer: %d:%d:%d\n", dev_desc.iManufacturer, dev_desc.iProduct, dev_desc.iSerialNumber);
848 printf(" nb confs: %d\n", dev_desc.bNumConfigurations);
849 // Copy the string descriptors for easier parsing
850 string_index[0] = dev_desc.iManufacturer;
851 string_index[1] = dev_desc.iProduct;
852 string_index[2] = dev_desc.iSerialNumber;
854 printf("\nReading BOS descriptor: ");
855 if (libusb_get_bos_descriptor(handle, &bos_desc) == LIBUSB_SUCCESS) {
856 printf("%d caps\n", bos_desc->bNumDeviceCaps);
857 for (i = 0; i < bos_desc->bNumDeviceCaps; i++)
858 print_device_cap(bos_desc->dev_capability[i]);
859 libusb_free_bos_descriptor(bos_desc);
861 printf("no descriptor\n");
864 printf("\nReading first configuration descriptor:\n");
865 CALL_CHECK_CLOSE(libusb_get_config_descriptor(dev, 0, &conf_desc), handle);
866 printf(" descriptor length: %d\n", conf_desc->bLength);
867 nb_ifaces = conf_desc->bNumInterfaces;
868 printf(" nb interfaces: %d\n", nb_ifaces);
870 first_iface = conf_desc->usb_interface[0].altsetting[0].bInterfaceNumber;
871 for (i=0; i<nb_ifaces; i++) {
872 printf(" interface[%d]: id = %d\n", i,
873 conf_desc->usb_interface[i].altsetting[0].bInterfaceNumber);
874 for (j=0; j<conf_desc->usb_interface[i].num_altsetting; j++) {
875 printf("interface[%d].altsetting[%d]: num endpoints = %d\n",
876 i, j, conf_desc->usb_interface[i].altsetting[j].bNumEndpoints);
877 printf(" Class.SubClass.Protocol: %02X.%02X.%02X\n",
878 conf_desc->usb_interface[i].altsetting[j].bInterfaceClass,
879 conf_desc->usb_interface[i].altsetting[j].bInterfaceSubClass,
880 conf_desc->usb_interface[i].altsetting[j].bInterfaceProtocol);
881 if ( (conf_desc->usb_interface[i].altsetting[j].bInterfaceClass == LIBUSB_CLASS_MASS_STORAGE)
882 && ( (conf_desc->usb_interface[i].altsetting[j].bInterfaceSubClass == 0x01)
883 || (conf_desc->usb_interface[i].altsetting[j].bInterfaceSubClass == 0x06) )
884 && (conf_desc->usb_interface[i].altsetting[j].bInterfaceProtocol == 0x50) ) {
885 // Mass storage devices that can use basic SCSI commands
886 test_mode = USE_SCSI;
888 for (k=0; k<conf_desc->usb_interface[i].altsetting[j].bNumEndpoints; k++) {
889 struct libusb_ss_endpoint_companion_descriptor *ep_comp = NULL;
890 endpoint = &conf_desc->usb_interface[i].altsetting[j].endpoint[k];
891 printf(" endpoint[%d].address: %02X\n", k, endpoint->bEndpointAddress);
892 // Use the first interrupt or bulk IN/OUT endpoints as default for testing
893 if ((endpoint->bmAttributes & LIBUSB_TRANSFER_TYPE_MASK) & (LIBUSB_TRANSFER_TYPE_BULK | LIBUSB_TRANSFER_TYPE_INTERRUPT)) {
894 if (endpoint->bEndpointAddress & LIBUSB_ENDPOINT_IN) {
896 endpoint_in = endpoint->bEndpointAddress;
899 endpoint_out = endpoint->bEndpointAddress;
902 printf(" max packet size: %04X\n", endpoint->wMaxPacketSize);
903 printf(" polling interval: %02X\n", endpoint->bInterval);
904 libusb_get_ss_endpoint_companion_descriptor(NULL, endpoint, &ep_comp);
906 printf(" max burst: %02X (USB 3.0)\n", ep_comp->bMaxBurst);
907 printf(" bytes per interval: %04X (USB 3.0)\n", ep_comp->wBytesPerInterval);
908 libusb_free_ss_endpoint_companion_descriptor(ep_comp);
913 libusb_free_config_descriptor(conf_desc);
915 libusb_set_auto_detach_kernel_driver(handle, 1);
916 for (iface = 0; iface < nb_ifaces; iface++)
918 int ret = libusb_kernel_driver_active(handle, iface);
919 printf("\nKernel driver attached for interface %d: %d\n", iface, ret);
920 printf("\nClaiming interface %d...\n", iface);
921 r = libusb_claim_interface(handle, iface);
922 if (r != LIBUSB_SUCCESS) {
927 printf("\nReading string descriptors:\n");
928 for (i=0; i<3; i++) {
929 if (string_index[i] == 0) {
932 if (libusb_get_string_descriptor_ascii(handle, string_index[i], (unsigned char*)string, sizeof(string)) > 0) {
933 printf(" String (0x%02X): \"%s\"\n", string_index[i], string);
937 printf("\nReading OS string descriptor:");
938 r = libusb_get_string_descriptor(handle, MS_OS_DESC_STRING_INDEX, 0, (unsigned char*)string, MS_OS_DESC_STRING_LENGTH);
939 if (r == MS_OS_DESC_STRING_LENGTH && memcmp(ms_os_desc_string, string, sizeof(ms_os_desc_string)) == 0) {
940 // If this is a Microsoft OS String Descriptor,
941 // attempt to read the WinUSB extended Feature Descriptors
943 read_ms_winsub_feature_descriptors(handle, string[MS_OS_DESC_VENDOR_CODE_OFFSET], first_iface);
945 printf(" no descriptor\n");
950 CALL_CHECK_CLOSE(display_ps3_status(handle), handle);
953 CALL_CHECK_CLOSE(display_xbox_status(handle), handle);
954 CALL_CHECK_CLOSE(set_xbox_actuators(handle, 128, 222), handle);
956 CALL_CHECK_CLOSE(set_xbox_actuators(handle, 0, 0), handle);
959 test_hid(handle, endpoint_in);
962 CALL_CHECK_CLOSE(test_mass_storage(handle, endpoint_in, endpoint_out), handle);
968 for (iface = 0; iface<nb_ifaces; iface++) {
969 printf("Releasing interface %d...\n", iface);
970 libusb_release_interface(handle, iface);
973 printf("Closing device...\n");
974 libusb_close(handle);
979 int main(int argc, char** argv)
981 static char debug_env_str[] = "LIBUSB_DEBUG=4"; // LIBUSB_LOG_LEVEL_DEBUG
982 bool show_help = false;
983 bool debug_mode = false;
984 const struct libusb_version* version;
987 unsigned tmp_vid, tmp_pid;
988 uint16_t endian_test = 0xBE00;
989 char *error_lang = NULL, *old_dbg_str = NULL, str[256];
991 // Default to generic, expecting VID:PID
994 test_mode = USE_GENERIC;
996 if (((uint8_t*)&endian_test)[0] == 0xBE) {
997 printf("Despite their natural superiority for end users, big endian\n"
998 "CPUs are not supported with this program, sorry.\n");
1003 for (j = 1; j<argc; j++) {
1004 arglen = strlen(argv[j]);
1005 if ( ((argv[j][0] == '-') || (argv[j][0] == '/'))
1006 && (arglen >= 2) ) {
1007 switch(argv[j][1]) {
1015 force_device_request = true;
1018 if ((j+1 >= argc) || (argv[j+1][0] == '-') || (argv[j+1][0] == '/')) {
1019 printf(" Option -b requires a file name\n");
1022 binary_name = argv[++j];
1026 if ((j+1 >= argc) || (argv[j+1][0] == '-') || (argv[j+1][0] == '/')) {
1027 printf(" Option -l requires an ISO 639-1 language parameter\n");
1030 error_lang = argv[++j];
1033 // OLIMEX ARM-USB-TINY JTAG, 2 channel composite device - 2 interfaces
1040 // Generic 2 GB USB Key (SCSI Transparent/Bulk Only) - 1 interface
1046 // The following tests will force VID:PID if already provided
1048 // Sony PS3 Controller - 1 interface
1051 test_mode = USE_PS3;
1054 // Microsoft Sidewinder Precision Pro Joystick - 1 HID interface
1057 test_mode = USE_HID;
1060 // Microsoft XBox Controller Type S - 1 interface
1063 test_mode = USE_XBOX;
1070 for (i=0; i<arglen; i++) {
1071 if (argv[j][i] == ':')
1075 if (sscanf(argv[j], "%x:%x" , &tmp_vid, &tmp_pid) != 2) {
1076 printf(" Please specify VID & PID as \"vid:pid\" in hexadecimal format\n");
1079 VID = (uint16_t)tmp_vid;
1080 PID = (uint16_t)tmp_pid;
1088 if ((show_help) || (argc == 1) || (argc > 7)) {
1089 printf("usage: %s [-h] [-d] [-i] [-k] [-b file] [-l lang] [-j] [-x] [-s] [-p] [-w] [vid:pid]\n", argv[0]);
1090 printf(" -h : display usage\n");
1091 printf(" -d : enable debug output\n");
1092 printf(" -i : print topology and speed info\n");
1093 printf(" -j : test composite FTDI based JTAG device\n");
1094 printf(" -k : test Mass Storage device\n");
1095 printf(" -b file : dump Mass Storage data to file 'file'\n");
1096 printf(" -p : test Sony PS3 SixAxis controller\n");
1097 printf(" -s : test Microsoft Sidewinder Precision Pro (HID)\n");
1098 printf(" -x : test Microsoft XBox Controller Type S\n");
1099 printf(" -l lang : language to report errors in (ISO 639-1)\n");
1100 printf(" -w : force the use of device requests when querying WCID descriptors\n");
1101 printf("If only the vid:pid is provided, xusb attempts to run the most appropriate test\n");
1105 // xusb is commonly used as a debug tool, so it's convenient to have debug output during libusb_init(),
1106 // but since we can't call on libusb_set_option() before libusb_init(), we use the env variable method
1107 old_dbg_str = getenv("LIBUSB_DEBUG");
1109 if (putenv(debug_env_str) != 0)
1110 printf("Unable to set debug level\n");
1113 version = libusb_get_version();
1114 printf("Using libusb v%d.%d.%d.%d\n\n", version->major, version->minor, version->micro, version->nano);
1115 r = libusb_init(NULL);
1119 // If not set externally, and no debug option was given, use info log level
1120 if ((old_dbg_str == NULL) && (!debug_mode))
1121 libusb_set_option(NULL, LIBUSB_OPTION_LOG_LEVEL, LIBUSB_LOG_LEVEL_INFO);
1122 if (error_lang != NULL) {
1123 r = libusb_setlocale(error_lang);
1125 printf("Invalid or unsupported locale '%s': %s\n", error_lang, libusb_strerror((enum libusb_error)r));
1128 test_device(VID, PID);
1133 snprintf(str, sizeof(str), "LIBUSB_DEBUG=%s", (old_dbg_str == NULL)?"":old_dbg_str);
1134 str[sizeof(str) - 1] = 0; // Windows may not NUL terminate the string