From owner-freebsd-usb@FreeBSD.ORG Thu Jan 29 12:42:26 2015 Return-Path: Delivered-To: freebsd-usb@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 79EA2FD4 for ; Thu, 29 Jan 2015 12:42:26 +0000 (UTC) Received: from smtp.mei.co.jp (smtp.mei.co.jp [133.183.100.20]) by mx1.freebsd.org (Postfix) with ESMTP id 1B0DF31E for ; Thu, 29 Jan 2015 12:42:25 +0000 (UTC) Received: from mail-gw.jp.panasonic.com ([157.8.1.157]) by smtp.mei.co.jp (8.12.11.20060614/3.7W/kc-maile14) with ESMTP id t0TCPosl018615 for ; Thu, 29 Jan 2015 21:25:50 +0900 (JST) Received: from epochmail.jp.panasonic.com ([157.8.1.130]) by mail.jp.panasonic.com (8.11.6p2/3.7W/kc-maili12) with ESMTP id t0TCPpo22269 for ; Thu, 29 Jan 2015 21:25:51 +0900 Received: by epochmail.jp.panasonic.com (8.12.11.20060308/3.7W/lomi13) id t0TCPpPw003613; Thu, 29 Jan 2015 21:25:51 +0900 Received: from localhost by lomi13.jp.panasonic.com (8.12.11.20060308/3.7W) with ESMTP id t0TCPpPK003601; Thu, 29 Jan 2015 21:25:51 +0900 Date: Thu, 29 Jan 2015 21:25:50 +0900 (JST) Message-Id: <20150129.212550.434561541001871867.okuno.kohji@jp.panasonic.com> To: freebsd-usb@freebsd.org Subject: [Bug?] Control Transfers in xHCI From: Kohji Okuno Organization: Panasonic Corporation X-Mailer: Mew version 6.6 on Emacs 24.4 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-usb@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: FreeBSD support for USB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Jan 2015 12:42:26 -0000 Hi HPS, I found a bug in xHCI device driver. Acording to extensible-host-controler-interface-usb-xhci.pdf:"3.2.9 Control Transfers"... A Data Stage TD consists of a Data Stage TRB followed by zero or more Normal TRBs. If the data is not physically contiguous, Normal TRBs may be chained to the Data Stage TRB. But, in the current imprementation, when two or more TRBs are needed, the device driver set XHCI_TRB_TYPE_DATA_STAGE to all TRBs. This is the violation of the spec. In my minor xHCI, I encountered strange bubble error in a control transfer. After I changed as the following, I succeeded its control transfer. Would you check the following (****)? Best Regards, Kohji Okuno 1785 /* check wLength */ 1786 if (td->td_trb[0].qwTrb0 & 1787 htole64(XHCI_TRB_0_WLENGTH_MASK)) { 1788 if (td->td_trb[0].qwTrb0 & 1789 htole64(XHCI_TRB_0_DIR_IN_MASK)) 1790 dword |= XHCI_TRB_3_TRT_IN; 1791 else 1792 dword |= XHCI_TRB_3_TRT_OUT; 1793 } 1794 1795 td->td_trb[0].dwTrb3 = htole32(dword); 1796 #ifdef USB_DEBUG 1797 xhci_dump_trb(&td->td_trb[x]); 1798 #endif **** #if 1 /* my patch begin */ **** if (temp->trb_type == XHCI_TRB_TYPE_DATA_STAGE){ **** temp->trb_type = XHCI_TRB_TYPE_NORMAL; **** } **** #endif /* my patch end */ 1799 x++;