This document explains the Cable Association (cba) between a MS Windows host and a IOGear HUB [1] using the WiMedia application [2]. The logs analized here have been generated by a usb sniffer, usbsnoop [3]. This analysis was made to clarify the cable association specification. It’s the result of one day’s work by me and my friend Alex.
The analized log can be downloaded here: usbsnoop-iogear-dwa.log
According to the specifications something like that should happen:
Our analisys is divided into blocks. Each block has a usb control message. They are:
- Association information
- Host information
- Association request
- Second association request
- Setting association request
ASSOCIATION INFORMATION
Our first usb_message_control is a request of information association [4].
[12 ms] >>> URB 5 going down >>> -- URB_FUNCTION_CLASS_INTERFACE: TransferFlags = 00000001 (USBD_TRANSFER_DIRECTION_IN, ~USBD_SHORT_TRANSFER_OK) TransferBufferLength = 00000100 TransferBuffer = 897ffd48 TransferBufferMDL = 00000000 UrbLink = 00000000 RequestTypeReservedBits = 00000001 Request = 00000001 Value = 00000000 Index = 00000000 [12 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896c8008, Context=897bd968, IRQL=2 [12 ms] <<< URB 5 coming back <<< -- URB_FUNCTION_CONTROL_TRANSFER: PipeHandle = 89923990 TransferFlags = 0000000b (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK) TransferBufferLength = 00000019 TransferBuffer = 897ffd48 TransferBufferMDL = 8a37b4c000000000: 19 00 02 00 00 01 00 01 00 00 00 00 00 00 00 0200000010: 00 01 00 01 00 6c 00 00 00UrbLink = 00000000 SetupPacket = 00000000: a1 01 00 00 00 00 00 01
These colored bytes represent:
| Request: | |
| 00000001 | Represent a CBAF GET_ASSOCIATION_INFORMATION request |
| Response: | |
| 19 00 | The full size of this structurre (including this two bytes), in this case 25 (0×19) bytes |
| 02 | Number of association requests, in this case: 2. See the arrays bellow |
| 02 00 | Fixed value for this kind of association |
| Association Requests Array: | |
| First array element: | |
| 01 | Index value. 01 in this case |
| 00 | Reserved byte… |
| 01 00 | Certified Wireless USB should have value: 0×1 in this field. |
| 00 00 | 00 00 == RetriveHostInfo, in this case the host should send its CHID value to the device, should happend before the AssociateWUSB, as happend here. |
| 00 00 00 00 | Represent the size of the association type, zero in this case. |
| Last array element: | |
| 02 | Index of the array, 02 in this case |
| 00 | Reserved byte… |
| 01 00 | Certified Wireless USB should have value: 0×1 in this field. |
| 01 00 | 00 01 == AssociateWUSB, in this case the host will generate a response that contains the CC and return it to the device as the RetriveHostInfo it is mandatory in the association |
| 6c 00 00 00 | Association type info size, in this case 108 bytes. |
In this block we have a GET_ASSICIATION_INFORMATION [4] request with an ASSOCIATION_INFORMATION [5] anwser. This ASSOCIATION_INFORMATION are composed by two ASSOCIATION_REQUEST [6], one is a RetriveHostInfo request and the another one is AssociateWUSB [7].
HOST INFORMATION
As a response of our first usb_message_control request, bellow is the host info.
[12 ms] >>> URB 6 going down >>> -- URB_FUNCTION_CLASS_INTERFACE: TransferFlags = 00000000 (USBD_TRANSFER_DIRECTION_OUT, ~USBD_SHORT_TRANSFER_OK) TransferBufferLength = 00000054 TransferBuffer = 8a365268 TransferBufferMDL = 0000000000000000: 00 00 02 00 01 00 01 00 02 00 00 00 00 10 10 00 00000010: 13 c7 31 42 52 44 30 30 32 30 30 30 c4 9a d5 70 00000020: 08 00 02 00 10 33 0c 00 2a 00 57 00 69 00 43 00 00000030: 65 00 6e 00 74 00 65 00 72 00 20 00 57 00 69 00 00000040: 72 00 65 00 6c 00 65 00 73 00 73 00 20 00 55 00 00000050: 53 00 42 00 UrbLink = 00000000 RequestTypeReservedBits = 00000001 Request = 00000003 Value = 00000101 Index = 00000000 [12 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896c8008, Context=89b253a8, IRQL=2 [12 ms] <<< URB 6 coming back <<< -- URB_FUNCTION_CONTROL_TRANSFER: PipeHandle = 89923990 TransferFlags = 0000000a (USBD_TRANSFER_DIRECTION_OUT, USBD_SHORT_TRANSFER_OK) TransferBufferLength = 00000054 TransferBuffer = 8a365268 TransferBufferMDL = 8a37b4c0 UrbLink = 00000000 SetupPacket = 00000000: 21 03 01 01 00 00 54 00These colored bytes represent:
USB Control Message: 00000003 SET_ASSOCIATION_RESPONSE 00 00 02 00 01 00 Association type id as expected, this values are filled with the values of the last request. Attribute id: 0x0, Attribute length: 0x2 and data 0x1. 01 00 02 00 00 00 Association sub type id. 13 c7 31 42 52 44 30 30 32 30 30 30 c4 9a d5 70 CHID¹. 08 00 02 00 10 33 Lang ID, Unicode language id code used in the next field. 0c 00 2a 00 57 00 69 00 43 00 65 00 6e 00 74 00 65 00 72 00 20 00 57 00 69 00 72 00 65 00 6c 00 65 00 73 00 73 00 20 00 55 00 53 00 42 00 Host friendly name, in unicode form. In this case: "WiCenter Wireless USB" ( \x57\x69\x43\x65\x6e\x74\x65\x72\x20\x57\x69\x72\x65\x6c\x65\x73\x73\x20\x55\x53\x42 )
This is block is structured as a HOST_INFO [8]. Its request is SET_ASSOCIATION_RESPONSE.
Back to top
ASSOCIATION REQUEST
As requested at the first data exchange, this is the information about the device:[12 ms] >>> URB 7 going down >>> -- URB_FUNCTION_CLASS_INTERFACE: TransferFlags = 00000003 (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK) TransferBufferLength = 0000002c TransferBuffer = 8a4c50a8 TransferBufferMDL = 00000000 UrbLink = 00000000 RequestTypeReservedBits = 00000001 Request = 00000002 Value = 00000200 Index = 00000000 [13 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896c8008, Context=8a3c0f58, IRQL=2 [13 ms] <<< URB 7 coming back <<< -- URB_FUNCTION_CONTROL_TRANSFER: PipeHandle = 89923990 TransferFlags = 0000000b (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK) TransferBufferLength = 0000002c TransferBuffer = 8a4c50a8 TransferBufferMDL = 8a37b4c0 00000000: 02 00 04 00 6c 00 00 00 01 10 10 00 2a 5e 70 14 00000010: ab 74 ec 49 e1 59 15 03 ee f6 f9 6c 04 10 02 00 00000020: 01 00 08 00 02 00 09 04 0b 00 40 00 UrbLink = 00000000 SetupPacket = 00000000: a1 02 00 02 00 00 2c 00These colored bytes represent:
Request: 00000002 GET_ASSOCIATION_REQUEST Response: 02 00 04 00 6c 00 00 00 Size of this structure. 0x2 represents the attribute type id and 0x4 represents the attribute length. 108 bytes in this case 01 10 10 00 2a 5e 70 14 ab 74 ec 49 e1 59 15 03 ee f6 f9 6c CDID 04 10 02 00 01 00 The last 4 bytes is the band group. See section 7.4.1 of WUSB specification 08 00 02 00 09 04 Language ID, used by the next field. 0b 00 40 00 Device friendly name, in unicode format.
This block contains the information about the device, it exchange information about the device id, supported band groups and device friendly name [9].
SECOND ASSOCIATION REQUEST
The same request as above but now the response is complete with the device friendly name.[13 ms] >>> URB 8 going down >>> -- URB_FUNCTION_CLASS_INTERFACE: TransferFlags = 00000003 (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK) TransferBufferLength = 0000006c TransferBuffer = 89ae84c0 TransferBufferMDL = 00000000 UrbLink = 00000000 RequestTypeReservedBits = 00000001 Request = 00000002 Value = 00000200 Index = 00000000 [13 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896c8008, Context=8a573930, IRQL=2 [13 ms] <<< URB 8 coming back <<< -- URB_FUNCTION_CONTROL_TRANSFER: PipeHandle = 89923990 TransferFlags = 0000000b (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK) TransferBufferLength = 0000006c TransferBuffer = 89ae84c0 TransferBufferMDL = 8a37b4c0 00000000: 02 00 04 00 6c 00 00 00 01 10 10 00 2a 5e 70 14 00000010: ab 74 ec 49 e1 59 15 03 ee f6 f9 6c 04 10 02 00 00000020: 01 00 08 00 02 00 09 04 0b 00 40 00 49 00 4f 00 00000030: 47 00 45 00 41 00 52 00 20 00 57 00 55 00 53 00 00000040: 42 00 20 00 48 00 75 00 62 00 00 00 00 00 00 00 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 UrbLink = 00000000 SetupPacket = 00000000: a1 02 00 02 00 00 6c 00These colored bytes represent:
Request: 00000002 GET_ASSOCIATION_REQUEST Response: 02 00 04 00 6c 00 00 00 Size of this structure. 108 bytes in this case 01 10 10 00 2a 5e 70 14 ab 74 ec 49 e1 59 15 03 ee f6 f9 6c CDID 04 10 02 00 01 00 Group band. See section 7.4.1 of WUSB specification. 08 00 02 00 09 04 Language ID, used by the next field. 0b 00 40 00 49 00 4f 00 47 00 45 00 41 00 52 00 20 00 57 00 55 00 53 00 42 00 20 00 48 00 75 00 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Device friendly name, in unicode format. In this case: "IOGEAR WUSB Hub" ( \x49\x4f\x47\x45\x41\x52\x20\x57\x55\x53\x42\x20\x48\x75\x62 ) SETTING ASSOCIATION REQUEST
This block communicates the success of the cable association operation [10]. If the association is not succeded an AssociationStatus (Attr id: 0x4 and Attr length: 0x4) is expected with the reason. The reason should be one of the listed bellow:
- 0x1, Association unsuccessful
- 0x2, Malformated association request
- 0x3, Association type not supported
[10589 ms] >>> URB 9 going down >>> -- URB_FUNCTION_CLASS_INTERFACE: TransferFlags = 00000000 (USBD_TRANSFER_DIRECTION_OUT, ~USBD_SHORT_TRANSFER_OK) TransferBufferLength = 0000004e TransferBuffer = 8a003530 TransferBufferMDL = 00000000 00000000: 00 00 02 00 01 00 01 00 02 00 01 00 02 00 04 00 00000010: 4e 00 00 00 02 10 30 00 13 c7 31 42 52 44 30 30 00000020: 32 30 30 30 c4 9a d5 70 2a 5e 70 14 ab 74 ec 49 00000030: e1 59 15 03 ee f6 f9 6c d7 a6 f4 4c 6d 88 0f be 00000040: b6 0c 25 ef 6f 24 a3 ed 04 10 02 00 01 00 UrbLink = 00000000 RequestTypeReservedBits = 00000001 Request = 00000003 Value = 00000201 Index = 00000000 [10623 ms] UsbSnoop - MyInternalIOCTLCompletion(bab39db0) : fido=00000000, Irp=896f0008, Context=896caa40, IRQL=2 [10623 ms] <<< URB 9 coming back <<< -- URB_FUNCTION_CONTROL_TRANSFER: PipeHandle = 89923990 TransferFlags = 0000000a (USBD_TRANSFER_DIRECTION_OUT, USBD_SHORT_TRANSFER_OK) TransferBufferLength = 0000004e TransferBuffer = 8a003530 TransferBufferMDL = 898aac20 UrbLink = 00000000 SetupPacket = 00000000: 21 03 01 02 00 00 4e 00These colored bytes represent:
Request: 00000003 SET_ASSOCIATION_REQUEST Response: 00 00 02 00 01 00 Association Type ID 01 00 02 00 01 00 Association Sub Type ID 02 00 04 00 4e 00 00 00 Length of this data structure 02 10 30 00 13 c7 31 42 52 44 30 30 32 30 30 30 c4 9a d5 70 2a 5e 70 14 ab 74 ec 49 e1 59 15 03 ee f6 f9 6c d7 a6 f4 4c 6d 88 0f be b6 0c 25 ef 6f 24 a3 ed CC² 04 10 02 00 01 00 Band group
¹ CHID, Conection Host Identify
² CC, Connection Context
[1] http://www.iogear.com/product/GUWH104KIT/
[2] http://www.iogear.com/support/dm/driver/GUWH104KIT#display
[3] http://benoit.papillault.free.fr/usbsnoop/
[4] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-1
[5] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-3
[6] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-4
[7] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-5
[8] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-7
[9] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-8
[10] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-9
[11] Association Models Supplement to the Certified Wireless Universal Serial Bus Specification
Revision 1.0 - Table 4-10