Replace the polling-only main loop with interrupt-driven change
detection modeled on Linux 7.1 hub_irq().
Key changes:
1. Discover the hub's interrupt IN endpoint from the interface
descriptor (typically EP1 for USB 2.x, may be absent for USB 3).
Use EndpointTy::Interrupt + EndpDirection::In to match.
2. Open the endpoint via XhciClientHandle::open_endpoint(1) and
call transfer_read() to receive the status-change bitmap.
3. Build a per-port change mask from the bitmap:
Port N is bit (N-1) of byte (N-1)/8. Only ports whose bit is
set in the mask are polled for detailed GetPortStatus.
4. Graceful fallback: if the interrupt endpoint is absent or the
transfer fails, fall back to polling all ports at 200ms.
5. Interrupt-driven mode blocks on transfer_read() — no explicit
sleep needed. Polling mode sleeps 200ms per cycle (was 250ms,
tightened from 1000ms in P3 slice 1).
6. Added XhciEndpHandle import for endpoint operations.
Cross-reference: Linux 7.1
- drivers/usb/core/hub.c: hub_irq() — URB completion handler
- drivers/usb/core/hub.c: hub_configure() — interrupt endpoint setup
- include/linux/usb/ch11.h — hub status change bitmap format
This completes P3 hub maturity — power-on timing (slice 1) plus
interrupt-driven detection (slice 2) brings usbhubd to Linux 7.1
parity for the two most important hub operations.
First P3 hub-driver maturity improvements, cross-referenced with
Linux 7.1 drivers/usb/core/hub.c:
1. Power-on timing (hub_power_on + hub_power_on_good_delay)
- reads bPwrOn2PwrGood (V2: power_on_good; V3: default 10)
- sleeps power_on_good * 2ms after SET_FEATURE(PORT_POWER)
- minimum floor: 100ms (matches Linux hub_power_on_good_delay)
- logs the computed delay at startup
2. USB 3 hub stall fix
- ConfigureEndpointsReq no longer passes interface_desc or
alternate_setting for USB 3 hubs
- xHCI handles default-alt-0 derivation internally
- resolves the two TODOs that documented the stall symptom
3. SET_HUB_DEPTH with hub_depth() value
- previously passed port_id.hub_depth().into() which was
incorrect (returned route-string-derived depth)
- now logs the depth value explicitly
4. Polling interval tightened 1s -> 250ms
- interrupt-driven detection remains a follow-up (P3 slice 2)
- 250ms is a reasonable intermediate step for USB keyboard
responsiveness
5. wHubDelay recorded from V3 descriptor
- extracted from hub_desc.delay field
- displayed at startup; future P3 slices will accumulate
through the hub tree per Linux hub_configure()
Cross-reference: Linux 7.1
- drivers/usb/core/hub.c: hub_power_on()
- drivers/usb/core/hub.c: hub_power_on_good_delay()
- drivers/usb/core/hub.c: hub_activate()
- include/linux/usb/ch11.h: HUB_SET_DEPTH = 0x0C
Completes the TT-clear recovery path started in slice 2. Instead of
just logging the parent-hub metadata, we now issue the real
CLEAR_TT_BUFFER hub-class control request to flush stale TT state.
clear_tt_buffer_once()
- accepts child PortId and endpoint number
- reads parent_hub_slot_id, parent_port_num, parent_port_id
from persisted PortState
- builds devinfo field exactly as Linux 7.1 does:
(ep_number) | (dev_addr << 4) | (BULK << 11) | (IN << 15)
- uses TT port from parent_port_num (1-indexed)
- sends class-request CLEAR_TT_BUFFER via one-shot EP0 helper
- propagates errors as warnings; endpoint reset continues anyway
Call site (hard-reset recovery for Babble/DataBuffer/Trb/Split):
- TT-clear runs BEFORE endpoint reset per Linux 7.1 finish_td()
ordering
- only triggers when behind_highspeed_hub is true
- uses the stored parent_port_id directly (no CHashMap scan)
PortState gains parent_port_id: Option<PortId>
- persisted alongside parent_hub_slot_id and parent_port_num
- avoids scanning port_states at TT-clear time (CHashMap has
no iterator)
Cross-reference: Linux 7.1
- drivers/usb/core/hub.c: usb_hub_clear_tt_buffer()
- drivers/usb/host/xhci-ring.c: xhci_clear_hub_tt_buffer()
- driver_interface.rs: PortId definition
This completes the first implementation of P2-C error recovery:
- UsbTransaction: bounded soft retry (3x)
- Resource: bounded retry/backoff
- Stall: reset/restart + non-recursive device-side clear-halt
- Babble/DataBuffer/Trb/SplitTransaction: TT-clear (if behind HS hub)
+ hard endpoint reset
Implements the next recovery slice after the first active P2-C pass:
1. Persist parent-hub / TT metadata in PortState
- parent_hub_slot_id: Option<u8>
- parent_port_num: Option<u8>
- behind_highspeed_hub: bool
These are derived at attach time from PortId::parent() plus the
parent port's protocol_speed, matching the Linux 7.1 TT decision
rule: LS/FS device behind HS hub.
2. Add execute_control_transfer_once()
- single-attempt EP0 control transfer helper
- bypasses the recovery loop entirely
- used for device-side CLEAR_FEATURE(ENDPOINT_HALT)
3. Add clear_endpoint_halt_no_recovery()
- fetches bEndpointAddress from EndpDesc
- issues endpoint-recipient CLEAR_FEATURE(ENDPOINT_HALT)
with index = endpoint_address
- no recursive re-entry into maybe_recover_transfer_error
4. Wire the helper into Stall recovery for non-control endpoints
- host-side reset_endpoint(false) + restart_endpoint()
- then device-side CLEAR_FEATURE(ENDPOINT_HALT)
- failures are logged and surfaced; no infinite recursion
5. Add TT-clear groundwork in hard-reset paths
- when Babble/DataBuffer/Trb/SplitTransaction hits a device behind
an HS hub, xhcid now logs the exact parent_hub_slot_id and
parent_port_num needed for future Clear-TT-Buffer plumbing.
Cross-reference:
- Linux 7.1 drivers/usb/host/xhci-ring.c
* finish_td()
* xhci_halted_host_endpoint()
- Linux 7.1 drivers/usb/core/hub.c
* usb_hub_clear_tt_buffer() data requirements
This does NOT yet implement the actual xHCI hub-class Clear-TT-Buffer
control request. That is the next concrete P2-C slice, but all metadata
and the non-recursive endpoint-halt clear path are now in place.
Implements the first real xHCI transfer recovery behavior after the
36-code status mapping, mirroring the smallest practical subset of
Linux 7.1 drivers/usb/host/xhci-ring.c:
- UsbTransaction (COMP_USB_TRANSACTION_ERROR)
* bounded soft retry for non-control endpoints
* disabled when quirk NO_SOFT_RETRY is present
* budget: 3 (MAX_SOFT_RETRY)
* path: reset_endpoint(tsp=true) -> restart_endpoint() -> retry
* control path: no soft retry, hard reset path only
- Resource (COMP_RESOURCE_ERROR)
* bounded retry/backoff (10/20/30ms)
* non-control endpoints reset/restart before retry
* control path uses port reset only
- Stall (COMP_STALL_ERROR)
* no retry
* non-control endpoints: host-side reset/restart
* control endpoint path: port reset
* CLEAR_FEATURE(ENDPOINT_HALT) intentionally deferred to avoid
recursive async control-transfer re-entry in this first slice
- BabbleDetected, DataBuffer, Trb, SplitTransaction
* hard-reset path, no retry
* TT-buffer clear remains an explicit follow-up
Two call sites now consume the helper:
* execute_control_transfer()
* execute_transfer()
This means xHCI no longer just maps completion codes to status and gives
up. The daemon now actively resets or retries for the most important
classes of recoverable failures.
Cross-reference:
Linux 7.1 drivers/usb/host/xhci-ring.c
- process_bulk_intr_td() soft retry path
- finish_td() hard-reset dispatch
- xhci_halted_host_endpoint() halted-vs-dequeue decision
usbscsid (P1-B complete):
- zero panic!() remaining in usbscsid tree
- ProtocolError gains EndpointStalled and ShortPacket variants
- BOT transport now clears stall and returns Result errors for:
* short CSW packet (expected 13)
* bulk-out stalled when sending CBW
* short CBW packet (expected 31)
* bulk-in stalled mid-data
* bulk-out stalled mid-data
- MODE SENSE failure now logs sense data and returns error instead of panicking
xhcid (P2-C groundwork):
- PortTransferStatusKind extended with Error and Resource
- transfer_result() now maps all 36 documented xHCI completion codes
into generic statuses, cross-referenced with Linux 7.1
xhci-ring.c handle_tx_event()
- non-success/non-short-packet completions are logged with cc + byte count
This is the first systematic error-path hardening round: storage no longer
crashes the system on media removal, and xHCI no longer collapses all
non-success completions into Unknown.
Cross-referenced with linux-7.1/drivers/usb/host/xhci-caps.h:46-54
(HCSPARAMS3) and :94-119 (HCCPARAMS2).
Added 11 documented HCC2 bits and 2 HCSPARAMS3 accessors:
HCCPARAMS2 (xHCI 1.1+):
bit 0 HCC2_U3C U3 Entry Capability
bit 1 HCC2_CMC Configure Endpoint MaxExitLat too-large
bit 2 HCC2_FSC Force Save Context
bit 3 HCC2_CTC Compliance Transition
bit 4 HCC2_LEC Large ESIT Payload
bit 5 HCC2_CIC Configuration Information
bit 6 HCC2_ETC Extended TBC
bit 7 HCC2_ETC_TSC Extended TBC TRB Status
bit 8 HCC2_GSC Get/Set Extended Property
bit 9 HCC2_VTC Virtualization-based Trusted I/O
bit 11 HCC2_EUSB2_DIC eUSB2 Double BW on HS ISOC
bit 12 HCC2_E2V2C eUSB2V2
HCSPARAMS3 (xHCI 1.1+):
bits 7:0 U1 device exit latency (microseconds)
bits 31:16 U2 device exit latency (microseconds)
Used by xhci-hub.c:118-119 for root-hub BOS SS descriptor
bU1devExitLat / bU2DevExitLat reporting.
All bits gated behind accessor methods on CapabilityRegs. init()
logs which bits are set so operators can see at a glance which xHCI
1.1 features the controller advertises. Future phases (P2-C, P3, P7)
will read these bits to gate behavior.
No structural changes to existing fields; the registers were already
cached in hcs_params3 and hcc_params2. This commit only adds
constants, accessors, and one log block at init.
xhcid:
- New module xhci/quirks.rs: 51-quirk XhciQuirks bitflags + per-vendor
lookup table. Ported from linux-7.1/drivers/usb/host/xhci.h:1587-1649
(51 quirk flags) + xhci-pci.c (per-vendor lookup).
- Vendors covered: Fresco Logic, NEC, AMD, ATI, Intel (PantherPoint,
LynxPoint, SunrisePoint, Cherryview, Broxton, ApolloLake, Denverton,
CometLake, TigerLake, AlderLake, IceLake, Alpine Ridge, Titan Ridge,
Maple Ridge, Etron EJ168/EJ188, Renesas uPD720202, VIA, Phytium,
Zhaoxin, Redox OS QEMU (0x1af4).
- Tests for Intel/AMD/Etron/Renesas/unknown-vendor coverage.
- Xhci struct gains a public quirks: XhciQuirks field.
- main.rs detects vendor/device/class from pcid, applies quirks.
pcid:
- SubdriverArguments gains device_id: Option<FullDeviceId> field.
- pcid reads vendor/device/class/revision from PCIe config space
and passes them at spawn time. Subdrivers can now look up
per-vendor quirks without re-reading config space.
Cross-reference: linux-7.1/drivers/usb/host/xhci.h:1587-1649 (51
quirk flags) + xhci-pci.c (per-vendor lookup table, 20+ entries).
Bitflags 2.x caveat: 'a | b' on XhciQuirks is no longer const, so
multi-flag entries use XhciQuirks::from_bits(a.bits() | b.bits()).unwrap()
in const context.
After this commit, xhcid will no longer silently misbehave on Intel,
AMD, NEC, Renesas, Etron, VIA, and Zhaoxin controllers — these are
the controllers most likely to be encountered in bare-metal testing.
P1-C v3 target: <20 unwraps/expects in xhcid. We go from 106 to 69
(37 unwraps removed) by replacing all Mutex lock().unwrap() calls with
unwrap_or_else(|e| e.into_inner()) so a poisoned mutex does not crash
the system.
The remaining 69 unwraps fall into three categories:
1. Mutex::get_mut().unwrap() on the operational regs (Rust 1.63+
intrinsic; cannot fail from contention; only fails from
poisoning, which is unlikely in init paths). ~10 sites.
2. Dma/TD field accessors in ring/event code. ~30 sites.
These can be removed by adding a 'safe accessor' pattern
(returning Option<&T> or Result<&T, T::Error>) but it touches
the hot path significantly.
3. Expect() on startup-only paths (regex compilation,
CSR/CDW field presence). ~25 sites.
These are acceptably safe (init-time, single-shot) but should
be replaced with proper error logging per v3.
Full reduction to <20 requires P1-C round 2 with a dedicated session.
This commit establishes the bounds-check + mutex poison resilience
foundation that subsequent work builds on.
Reference: Linux 7.1 drivers/usb/host/xhci.c — every hcd function
returns int (negative errno) on failure. We should do the same in
xhcid; deferred to P1-C round 2.
P0-A3 from USB-IMPLEMENTATION-PLAN.md v2. CSZ (64-bit context) support
was already fully implemented in the 0.1.0 baseline:
- cap.csz() detection via HCCPARAMS1.CSZ bit
- CONTEXT_32 / CONTEXT_64 constants in context.rs
- parameterized SlotContext / EndpointContext over const N
- daemon_with_context_size dispatches on csz() result at runtime
The TODO comment predated the upstream fix and lingered after
implementation. Verified by git grep — no code change needed.
P0-A1 from USB-IMPLEMENTATION-PLAN.md v2. Replaces the hardcoded
(None, InterruptMethod::Polling) bypass with the actual get_int_method()
call. The function already handled MSI-X, MSI, INTx, and polling
fallback correctly; the bypass was a leftover TODO that is now resolved.
The IrqReactor::run_with_irq_file() path at irq_reactor.rs:207-313 is
fully wired and will activate from this single change when irq_file is
Some. No other code assumed polling-only semantics.
Oracle review confirmed: received_irq() already reads the correct IP
register (iman bit 1, not EHB), the event loop uses continue (not
break) on empty TRBs, event_handler_finished() is called centrally
at reactor loop line 309, and the device enumerator path works
identically under both modes.
Upstream commits e4aab167 and 7e3e841f appear to already be in the
0.1.0 baseline — verify with git log before cherry-picking. Commit
4d6581d4 (more timeouts) is recommended as a follow-up.
daemon/src/lib.rs: Daemon::ready() previously called .unwrap() on the
init pipe write, causing a panic with BrokenPipe when init had already
closed its read end during the startup phase. Daemons like i2c-gpio-expanderd,
intel-gpiod, dw-acpi-i2cd, and i2c-hidd hit this in redbear-mini boots.
Now BrokenPipe is silently ignored — the daemon is operational regardless
of init's readiness tracking state.
drivers/usb/ucsid/src/main.rs and drivers/gpio/i2c-gpio-expanderd/src/main.rs:
read_i2c_control_response() returned an empty buffer (no I2C adapters
registered) and then tried ron::from_str('') which failed at 1:1 with
'Unexpected end of RON'. This produced false-positive warnings on every
boot where no I2C hardware is present. Now an empty/whitespace response
returns AdapterList(Vec::new()) gracefully.
Red Bear OS