Page MenuHomeFreeBSD
Differential D57146

xhci: Do not drop and add bits in xhci
ClosedPublic
Actions

Authored by aokblast on May 21 2026, 1:42 PM.
Tags
Referenced Files
F170680398: D57146.id.diff
Sun, Sep 6, 12:08 AM
Unknown Object (File)
Fri, Sep 4, 5:52 PM
Unknown Object (File)
Fri, Sep 4, 5:26 PM
Unknown Object (File)
Thu, Sep 3, 8:57 AM
Unknown Object (File)
Tue, Sep 1, 8:55 PM
Unknown Object (File)
Tue, Sep 1, 2:19 PM
Unknown Object (File)
Tue, Sep 1, 8:40 AM
Unknown Object (File)
Fri, Aug 28, 11:37 AM
View All 67 Files
Subscribers
imp
oh

Details

Reviewers
adrian
tomek_cedro.info
Commits
rG2cf3e6b554b7: xhci: Do not drop and add bits in xhci
rGdf2d5780bf6b: xhci: Do not drop and add bits in xhci
rG28d85db46b48: xhci: Do not drop and add bits in xhci
Summary

Drop and Add bits reset the data toggle for high-speed devices in XHCI.
The toggle bit represents the sequence number in USB 2.0 transfers. However,
a device can only recognize that the toggle bit has been reset while in
the HALT state. As a result, the host and device toggle values may
become mismatched, causing xHCI to reject the packet. This issue was
observed while testing the EZ-USB FX2 device.

The transfer may then return to the original value after a
bi-directional TD because the toggle field is only one bit wide. This
explains the reson that we can only receive packets bi-transfer in some
case. Therefore, we do not reset the toggle bit here.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

aokblast created this revision.May 21 2026, 1:42 PM
Herald added a subscriber: imp. · View Herald TranscriptMay 21 2026, 1:42 PM
aokblast requested review of this revision.May 21 2026, 1:42 PM
Harbormaster completed remote builds in B73310: Diff 178313.May 21 2026, 1:42 PM
aokblast added a reviewer: adrian.May 21 2026, 1:43 PM
aokblast mentioned this in D52166: bhyve: implement single USB device passthrough support.May 21 2026, 1:52 PM
aokblast added a reviewer: tomek_cedro.info.May 21 2026, 2:02 PM
adrian added a project: USB.May 21 2026, 2:39 PM
adrian accepted this revision.May 21 2026, 2:42 PM

This looks fine, is there somewhere in the XHCI specification you can reference for drop bit handling? It'd be good to have a comment there.

Nice catch!

This revision is now accepted and ready to land.May 21 2026, 2:42 PM
aokblast added a comment.May 21 2026, 2:47 PM
In D57146#1309625, @adrian wrote:

This looks fine, is there somewhere in the XHCI specification you can reference for drop bit handling? It'd be good to have a comment there.

Nice catch!

This is a Note in xHCI spec 4.6.8:

The Reset Endpoint Command may only be issued to endpoints in the Halted
state. If software wishes to reset the Data Toggle or Sequence Number of an
endpoint that isn't in the Halted state, then software may issue a Configure
Endpoint Command with the Drop and Add bits set for the target endpoint
that is in the Stopped state or Running but Idle state.

I will attach this in the comment tomorrow, thanks!:)

adrian added a comment.May 21 2026, 2:48 PM
In D57146#1309632, @aokblast wrote:
In D57146#1309625, @adrian wrote:

This looks fine, is there somewhere in the XHCI specification you can reference for drop bit handling? It'd be good to have a comment there.

Nice catch!

This is a Note in xHCI spec 4.6.8:

The Reset Endpoint Command may only be issued to endpoints in the Halted
state. If software wishes to reset the Data Toggle or Sequence Number of an
endpoint that isn't in the Halted state, then software may issue a Configure
Endpoint Command with the Drop and Add bits set for the target endpoint
that is in the Stopped state or Running but Idle state.

I will attach this in the comment tomorrow, thanks!:)

Perfect! Thanks.

Closed by commit rG28d85db46b48: xhci: Do not drop and add bits in xhci (authored by aokblast). · Explain WhyMay 22 2026, 7:41 AM
This revision was automatically updated to reflect the committed changes.
aokblast added a commit: rG28d85db46b48: xhci: Do not drop and add bits in xhci.
aokblast added a commit: rGdf2d5780bf6b: xhci: Do not drop and add bits in xhci.Jun 23 2026, 8:53 PM
aokblast added a commit: rG2cf3e6b554b7: xhci: Do not drop and add bits in xhci.Jun 23 2026, 8:57 PM
oh added a subscriber: oh.Mon, Aug 24, 5:20 PM

This commit make cheap USB memory key to not attach - see below.
The commit works with Samsung memory keys.
Maybe this is correct and the necessary change to get the cheap noname USB memory keys to work needs to be done in some other place.

======= NOT WORKING ====

DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
ugen0.4: <USB Disk 20> at usbus0
umass0 numa-domain 0 on uhub0
umass0: <USB Disk 20, class 0/0, rev 3.20/2.00, addr 5> on usbus0
umass0: SCSI over Bulk-Only; quirks = 0x0
umass0:3:0: Attached to scbus3
XHCI_EPCTX_0_EPSTATE_DISABLED - fallthrough
XHCI_EPCTX_0_EPSTATE_STOPPED
XHCI_EPCTX_0_EPSTATE_DISABLED - fallthrough
XHCI_EPCTX_0_EPSTATE_STOPPED

XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 0

++ Repeat last 3 printout 8 times ++

XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
(da8:umass-sim0:0:0:0): got CAM status 0x444
(da8:umass-sim0:0:0:0): fatal error, failed to attach to device
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
(da8:umass-sim0:0:0:0): MODE SENSE for CACHE page command failed.
(da8:umass-sim0:0:0:0): Mode page 8 missing, disabling SYNCHRONIZE CACHE

REVERT COMMIT

DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
ugen0.4: <USB Disk 20> at usbus0
umass0 numa-domain 0 on uhub2
umass0: <USB Disk 20, class 0/0, rev 3.20/2.00, addr 3> on usbus0
umass0: SCSI over Bulk-Only; quirks = 0x0
umass0:3:0: Attached to scbus3
XHCI_EPCTX_0_EPSTATE_DISABLED break
XHCI_EPCTX_0_EPSTATE_DISABLED break
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
da8 at umass-sim0 bus 0 scbus3 target 0 lun 0
da8: <VendorC ProductCode 2.00> Removable Direct Access SPC-2 SCSI device
da8: Serial Number FC3056EA59044
da8: 400.000MB/s transfers
da8: 30000MB (61440000 512 byte sectors)
da8: quirks=0x2<NO_6_BYTE>
(da8:umass-sim0:0:0:0): CACHE PAGE TOO SHORT data len 3 desc len 0
(da8:umass-sim0:0:0:0): Mode page 8 missing, disabling SYNCHRONIZE CACHE

aokblast added a comment.Tue, Aug 25, 7:25 PM
In D57146#1356729, @oh wrote:

This commit make cheap USB memory key to not attach - see below.
The commit works with Samsung memory keys.
Maybe this is correct and the necessary change to get the cheap noname USB memory keys to work needs to be done in some other place.

======= NOT WORKING ====

DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
ugen0.4: <USB Disk 20> at usbus0
umass0 numa-domain 0 on uhub0
umass0: <USB Disk 20, class 0/0, rev 3.20/2.00, addr 5> on usbus0
umass0: SCSI over Bulk-Only; quirks = 0x0
umass0:3:0: Attached to scbus3
XHCI_EPCTX_0_EPSTATE_DISABLED - fallthrough
XHCI_EPCTX_0_EPSTATE_STOPPED
XHCI_EPCTX_0_EPSTATE_DISABLED - fallthrough
XHCI_EPCTX_0_EPSTATE_STOPPED

XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 0

++ Repeat last 3 printout 8 times ++

XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
(da8:umass-sim0:0:0:0): got CAM status 0x444
(da8:umass-sim0:0:0:0): fatal error, failed to attach to device
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 0
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
(da8:umass-sim0:0:0:0): MODE SENSE for CACHE page command failed.
(da8:umass-sim0:0:0:0): Mode page 8 missing, disabling SYNCHRONIZE CACHE

REVERT COMMIT

DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
ugen0.4: <USB Disk 20> at usbus0
umass0 numa-domain 0 on uhub2
umass0: <USB Disk 20, class 0/0, rev 3.20/2.00, addr 3> on usbus0
umass0: SCSI over Bulk-Only; quirks = 0x0
umass0:3:0: Attached to scbus3
XHCI_EPCTX_0_EPSTATE_DISABLED break
XHCI_EPCTX_0_EPSTATE_DISABLED break
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
XHCI_EPCTX_0_EPSTATE_HALTED err 0 drop 0
XHCI_EPCTX_0_EPSTATE_STOPPED
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
DEFAULT: xhci_cmd_set_tr_dequeue_prt err: 0 drop 1
da8 at umass-sim0 bus 0 scbus3 target 0 lun 0
da8: <VendorC ProductCode 2.00> Removable Direct Access SPC-2 SCSI device
da8: Serial Number FC3056EA59044
da8: 400.000MB/s transfers
da8: 30000MB (61440000 512 byte sectors)
da8: quirks=0x2<NO_6_BYTE>
(da8:umass-sim0:0:0:0): CACHE PAGE TOO SHORT data len 3 desc len 0
(da8:umass-sim0:0:0:0): Mode page 8 missing, disabling SYNCHRONIZE CACHE

Please try https://reviews.freebsd.org/D59186

oh mentioned this in D59186: xhci: Only reset the data toggle value when the USB stack asks for it.Wed, Aug 26, 11:22 AM

Revision Contents
Changeset List

PathSize
sys/
dev/
usb/
controller/
14 lines

Diff 178375

View Options

sys/dev/usb/controller/xhci.c

Loading...