Re: [PATCH 0/4] usb: usbtmc: fix undersized high-speed bulk packets on xHCI

[Michal Pecio <michal.pecio@gmail.com>]

On Tue, 20 Oct 2026 20:33:17 +0200, Nicolai Buchwitz wrote:
> On 20.10.2026 18:42, Michal Pecio wrote:
> > But SDM4065A is apparently pretty modern (2025) gear marketed for
> > "automatic production lines", so it's odd that it has such issues.
> > Has anyone looked if the same out-of-spec descriptor shows up on
> > Windows or (don't laught at my optimism) consulted vendor support?  
> 
> Not yet, but I'll check on Windows. The vendor(s) don't really seem to
> care about the bug (surprise!). It is known for quite a while and even
> not fixed with the latest 2026 firmware for the siglent. This makes me
> assume that either most of the professional users a) use Windows or b)
> use the lan interface (which we do for most of the stations).

It's worth trying, because sporadically we see devices which enumerate
differently on Windows and on Linux for some stupid reason. Although I
have a feeling that this won't be one of those times.

> > Maybe Windows xHCI driver tries to enable out-of-spec maxpacket?
> > We could do that too, though IIRC not all controllers are happy,
> > so a SW workaround may be unavoidable.  
> 
> Did some quick tests and it looks good so far. If the usb maintainers
> can agree on making it less restrictive (/ compliant) it would save
> lots of efforts and the quirk would be down to the ZLP patch. In my
> tests all three devices worked with
> 
> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index 8a8636279e844..c4306482874eb 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -1505,7 +1505,9 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
>                  err_count = 3;
>          /* HS bulk max packet should be 512, FS bulk supports 8, 16, 32 or 64 */
>          if (usb_endpoint_xfer_bulk(&ep->desc)) {
> -               if (udev->speed == USB_SPEED_HIGH)
> +               if (udev->speed == USB_SPEED_HIGH && max_packet != 512)
> +                       xhci_warn(xhci, "EXPERIMENT: keeping HS bulk maxp %u\n", max_packet);
> +               else if (udev->speed == USB_SPEED_HIGH)
>                          max_packet = 512;
>                  if (udev->speed == USB_SPEED_FULL) {
>                          max_packet = rounddown_pow_of_two(max_packet);
> 
> So this looks like the better fix. How would we want it gated, a USB
> core quirk flag per device, or per controller?

[Cc Mathias]

Good question. Do you need this fixed in stable?

Depending on regression risk maybe we could get away with no quirk
flag at all. That's what ehci and dwc2 seem to do, which means that
hopefully no device specifies illegal packet size while using 512.

Other possible risk is some device doesn't truly care (no transfer
is ever large enough to matter) and works with 512, but setting its
requested packet size (needlessly) breaks some xHCI controller.

Such devices seem not very likely to exist, though more likely than
the former kind, so I will try to test whether such xHCI breakage is
possible. Preliminary results are encouraging: although several of
my HCs reject packet size of 1024 or corrupt data, 64 is accepted by
all but one. I haven't checked for corruption yet.

I will also see if I can figure out what Windows does in such case,
because doing the same thing as Windows may be the safest bet.

> >> The Rigols still have one issue I can't work around. They split
> >> replies over 500 bytes into several transfers, and a follow-on
> >> transfer that ends exactly on a packet boundary never arrives. Raw
> >> libusb shows the same, so I guess it's another firmware bug. Should
> >> be fine for most use cases though.  
> > 
> > What exactly is the sequence of URBs you see vs would want to see?  
> 
> The Rigols split anything over 500 bytes into two transfers:
> 
>    REQUEST_DEV_DEP_MSG_IN #1
>    IN: 8 x 64 bytes (12 byte header + 500 data), then a ZLP
>    REQUEST_DEV_DEP_MSG_IN #2
>    IN: header + the rest
> 
> That works fine, unless the second transfer happens to end exactly on
> a 64 byte boundary (e.g. 640 bytes). Then the device just never
> answers request #2 and the first IN times out. I also tried leaving
> the ZLP from #1 pending until after request #2. That fixes the
> boundary case, but then the device randomly ignores request #2
> instead (roughly 1 in 5). Raw libusb behaves the same, also with
> maxpacket 64 in xHCI, so I'm pretty sure it's just another firmware
> bug. What I'd want to see is simply the second transfer arriving :)

Doesn't look like any obvious xHCI problem to me. Did it also happen
with those USB2 controllers that you used previously?

Regards,
Michal