Page 1 of 1

xHCI: 2nd Address Device Cmd TRB failing, Invalid Slot States & USB Addresses

Posted: Tue Sep 22, 2026 4:05 am
by michelCouture
Hello,

I'm writing a baremetal xHCI driver to work with HID devices (just mouse and keyboard, no hubs).
So far it works for the most part, however I have a few questions.

When initializing a device, here's the process:
- Reset port, wait for Port Change Event TRB.
- When received it, send the Enable Slot Command TRB.
- When received, reset the default Interrupter with the Default Event Ring.
- Initialize the Input Slot and Bidirectionnal Endpoints (add Context A0 + A1, no drop context, 1 entry, default speed, connected port, interrupter 0, state 0, allocate a Transfer Ring and set its address).
- Issue first Address Device Command TRB (BSR = 1).
- Retrieve the first 8 bytes from the Device Descriptor
- Change MaxPacketSize value from Control Context if different from default size for given speed, and send an Evaluate Context Command TRB.
- Issue second Address Device Command TRB (BSR = 0).
- Retrieve the full Device Descriptor.
- Read first bytes from Configuration Descriptor then retrieve entire Config + related descriptors.
- Initialize the Endpoint Input Context from the given index from the Endpoint descriptor, and send Configure Endpoint Command TRB.
- Set configuration chosen.
- HID initialization (SET_IDLE for keyboard), and enqueue Normal TRBs on the Endpoint IN Transfer Ring to retrieve HID data.

I'm working on 2 Intel and one TI xHCI controllers. On the Intel controllers, the Second Address Command TRB always fails with a Parameter Error (17U), although I've checked every field from the Input Slot Context and Control Endpoint many times.
A ""fix"" I found was to send a Disable Slot Command TRB for the given slot, and Initialize the device again starting from the Enable Slot Command TRB step.
With this change, the entire initialization is OK and HID data can be retrieved.

After some research, the Intel xHCI always gives the slot 0 when sending the first Enable Slot Command TRB, and then increments it for each subsequent requests, until reaching Max_slots - 1 and going back to Slot 0.
Slot 0 is the one that ALWAYS fails the second Address Device Command TRB. However I couldn't found any mention on Slot 0 having issues on Intel xHCI controllers.
Did somebody else could confirm having similar issues with their Intel controllers?

My second question regards one of the Intel controllers, where randomly, a plugged device will initialize itself successfully, however no Event TRBs are written to the Endpoint Input Event Ring, and no data is retrieve. Simply by unplugging and plugging a device again, this behaviour will happen at some point.

I tried checking Input Context structures for incoherences, and there were similar for the most part.
However Slot State and USB Addresses seem wrong.
Slot State goes from 0U (disabled/enabled) to 1U (default) when sending the first Address Device command TRB.
When the second Address Device Command TRB returns a Parameter Error (17U), Slot is then disabled and a new one is enabled.
From now on, the state from every given Slot afterwards ALWAYS stays at 0U, even though the whole initialization process for the Device is OK.
The same happens for the second device when initialized, all Slot States stay at 0U.
USB Address is never set, it always stays at 0U.

On the TI with less issues, the Slot State & USB Address evolves normally on the first device:
From 0U (Disabled/enabled) to 1U (Default) after first Address Device Command TRB
From 1U (Default) to 2U (Addressed) after second Address Device Command TRB, USB Address device is set.
From 2U (Addressed) to 3U (Configured) after Configure Endpoint command TRB for the Input Context.

However when a second device is plugged, its Slot State Always stays at (0U), as well as the USB Address.

Should I be caring about Slot States or USB Addresses? Or should I ignore both as long as HID data is retrieved?

Thank you for your help. :D

Re: xHCI: 2nd Address Device Cmd TRB failing, Invalid Slot States & USB Addresses

Posted: Tue Sep 22, 2026 6:30 am
by michelCouture
After some search, I found out the given addresses for the Context were incorrect and involved a slight overlapping, after setting it properly with the alignment, USB Address and Slot State properly work for any device.
I also removed the 2nd Address Device Command TRB and have the first one with BSR = 0, and initialization on Slot 0 works properly.
However the random problem with no incoming data after initialization success still can happen on my Intel controller, still searching.

Re: xHCI: 2nd Address Device Cmd TRB failing, Invalid Slot States & USB Addresses

Posted: Wed Sep 23, 2026 2:45 am
by michelCouture
I manage to have working HID devices every time.
By sending a No Op TRB to the Endpoint IN Event Ring after Configure Endpoint Command TRB,
If Event Ring is unable to answer the No Op TRB, it will never answer Normal TRBs for HID data retrieval.

To remove I send a Disable Slot Command TRB, wait for the answer, free the structures and rings, and a Port Reset was needed to avoid USB Transaction Error on the next initialization.

I have no idea what caused the rings not to work but at least the method works.