[PATCH] usb: xhci: keep the transaction count out of Max Packet Size

[PATCH] usb: xhci: keep the transaction count out of Max Packet Size

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

Bits 12:11 of wMaxPacketSize hold the number of additional transactions
per microframe of high-speed isochronous and interrupt endpoints.
xhci_get_endpoint_max_burst() already programs them as Max Burst Size,
but xhci_set_configuration() copies them into Max Packet Size as well,
so a high-bandwidth endpoint ends up with a Max Packet Size beyond the
1024 bytes a high-speed endpoint can have.

Mask them off, like Linux does since commit f94e0186312b ("USB: xhci:
Bandwidth allocation support"), with the mask fixed to cover bit 10 in
commit dc07c91b9b40 ("xHCI: fix wMaxPacketSize mask").

Fixes: 105b2eabd55a ("usb: Add U-Boot xhci driver")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 drivers/usb/host/xhci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 661dc0dde0b8..1bb1758ac25d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -574,8 +574,8 @@ static int xhci_set_configuration(struct usb_device *udev)
 
 		ep_ctx[ep_index]->ep_info2 = cpu_to_le32(EP_TYPE(ep_type));
 		ep_ctx[ep_index]->ep_info2 |=
-			cpu_to_le32(MAX_PACKET
-			(get_unaligned(&endpt_desc->wMaxPacketSize)));
+			cpu_to_le32(MAX_PACKET(get_unaligned(&endpt_desc->wMaxPacketSize) &
+					       USB_ENDPOINT_MAXP_MASK));
 
 		/* Allow 3 retries for everything but isoc, set CErr = 3 */
 		if (!usb_endpoint_xfer_isoc(endpt_desc))
-- 
2.47.3

Re: [PATCH] usb: xhci: keep the transaction count out of Max Packet Size

[Sascha Hauer]

On Sun, 08 Nov 2026 09:46:48 +0100, Ahmad Fatoum wrote:
> Bits 12:11 of wMaxPacketSize hold the number of additional transactions
> per microframe of high-speed isochronous and interrupt endpoints.
> xhci_get_endpoint_max_burst() already programs them as Max Burst Size,
> but xhci_set_configuration() copies them into Max Packet Size as well,
> so a high-bandwidth endpoint ends up with a Max Packet Size beyond the
> 1024 bytes a high-speed endpoint can have.
> 
> [...]

Applied, thanks!

[1/1] usb: xhci: keep the transaction count out of Max Packet Size
      https://git.pengutronix.de/cgit/barebox/commit/?id=2c9589d5238c (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>

[PATCH] usb: xhci: keep the transaction count out of Max Packet Size

[Ahmad Fatoum]

Bits 12:11 of wMaxPacketSize hold the number of additional transactions
per microframe of high-speed isochronous and interrupt endpoints.
xhci_get_endpoint_max_burst() already programs them as Max Burst Size,
but xhci_set_configuration() copies them into Max Packet Size as well,
so a high-bandwidth endpoint ends up with a Max Packet Size beyond the
1024 bytes a high-speed endpoint can have.

Mask them off, like Linux does since commit f94e0186312b ("USB: xhci:
Bandwidth allocation support"), with the mask fixed to cover bit 10 in
commit dc07c91b9b40 ("xHCI: fix wMaxPacketSize mask").

Fixes: 105b2eabd55a ("usb: Add U-Boot xhci driver")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 drivers/usb/host/xhci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 661dc0dde0b8..1bb1758ac25d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -574,8 +574,8 @@ static int xhci_set_configuration(struct usb_device *udev)
 
 		ep_ctx[ep_index]->ep_info2 = cpu_to_le32(EP_TYPE(ep_type));
 		ep_ctx[ep_index]->ep_info2 |=
-			cpu_to_le32(MAX_PACKET
-			(get_unaligned(&endpt_desc->wMaxPacketSize)));
+			cpu_to_le32(MAX_PACKET(get_unaligned(&endpt_desc->wMaxPacketSize) &
+					       USB_ENDPOINT_MAXP_MASK));
 
 		/* Allow 3 retries for everything but isoc, set CErr = 3 */
 		if (!usb_endpoint_xfer_isoc(endpt_desc))
-- 
2.47.3