[Bug?] Control Transfers in xHCI
Kohji Okuno
okuno.kohji at jp.panasonic.com
Thu Jan 29 12:42:26 UTC 2015
Hi HPS,
I found a bug in xHCI device driver.
Acording to extensible-host-controler-interface-usb-xhci.pdf:"3.2.9
Control Transfers"...
A Data Stage TD consists of a Data Stage TRB followed by zero or more
Normal TRBs. If the data is not physically contiguous, Normal TRBs may
be chained to the Data Stage TRB.
But, in the current imprementation, when two or more TRBs are needed,
the device driver set XHCI_TRB_TYPE_DATA_STAGE to all TRBs.
This is the violation of the spec.
In my minor xHCI, I encountered strange bubble error in a control
transfer. After I changed as the following, I succeeded its control
transfer.
Would you check the following (****)?
Best Regards,
Kohji Okuno
1785 /* check wLength */
1786 if (td->td_trb[0].qwTrb0 &
1787 htole64(XHCI_TRB_0_WLENGTH_MASK)) {
1788 if (td->td_trb[0].qwTrb0 &
1789 htole64(XHCI_TRB_0_DIR_IN_MASK))
1790 dword |= XHCI_TRB_3_TRT_IN;
1791 else
1792 dword |= XHCI_TRB_3_TRT_OUT;
1793 }
1794
1795 td->td_trb[0].dwTrb3 = htole32(dword);
1796 #ifdef USB_DEBUG
1797 xhci_dump_trb(&td->td_trb[x]);
1798 #endif
**** #if 1 /* my patch begin */
**** if (temp->trb_type == XHCI_TRB_TYPE_DATA_STAGE){
**** temp->trb_type = XHCI_TRB_TYPE_NORMAL;
**** }
**** #endif /* my patch end */
1799 x++;
More information about the freebsd-usb
mailing list