Hi<div><br></div><div>I&#39;m seeing a rather interesting problem with UHCI on Intel US15W and wondered if anyone else had seen anything like this before. I noticed it when I plugged in a USB keyboard, which caused a crash due to something corrupting the stack? it turns out that the stack has been trashed by the UHCI controller via DMA?!</div>
<div><br></div><div>When trying to transmit the 8 byte address setup packet, the hardware doesn&#39;t quite seem to be doing as it&#39;s told. SeaBIOS sets up the UHCI TDs exactly as per the spec - no problems there,</div>
<div><br></div><div>Once the QH element is set, instead of transmitting the 8 bytes as described in the TD, it transmits a full 1023 bytes? (according to the returned TD) UHCI then goes ahead and overwrites another 35 bytes beyond the end of the buffer pointed to by the TD.</div>
<div><br></div><div><div>Here&#39;s the 8 bytes of the setup packet (I&#39;ve set everything after it to 0xFF):</div><div><br></div><div>1fbc1f95: 00 05 01 00 00 00 00 00 ff ff ff</div><div>1fbc1fa0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff</div>
<div>1fbc1fb0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff</div><div>1fbc1fc0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff</div><div>1fbc1fd0: ff ff ff ff ff</div></div><div><br></div><div>Here it is after the UHCI controller has been at it. The only code to execute between these two dumps is this:</div>
<div><br></div><div>pipe-&gt;qh.element = (u32)&amp;tds[0]; (in uhci_control())</div><div><br></div><div><div>1fbc1f95: 00 05 01 00 00 00 00 00 ff ff ff</div><div>1fbc1fa0: bf 00 05 01 00 00 00 00 00 ff ff ff fd 03 00 00</div>
<div>1fbc1fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</div><div>1fbc1fc0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff</div><div>1fbc1fd0: ff ff ff ff ff</div></div><div><br></div><div>TD Chain before:</div><div>
<div>1fbc4870: 84 48 bc 1f 00 00 80 1c 2d 00 e0 00 95 1f bc 1f</div><div>1fbc4880: 01 00 00 00 00 00 80 04 69 00 e8 ff 00 00 00 00</div></div><div><br></div><div>TD Chain after:</div><div><div>1fbc4870: 84 48 bc 1f ff 07 80 1c 2d 00 e0 00 95 1f bc 1f</div>
<div>1fbc4880: 01 00 00 00 00 00 80 04 69 00 e8 ff 00 00 00 00</div></div><div><br></div><div><br></div><div>I&#39;m wondering if I&#39;m not the first person to have seen this. The problem (without detailed debugging) manifests its self exactly as described in this message:</div>
<div><br></div><div><a href="http://comments.gmane.org/gmane.linux.bios/55336">http://comments.gmane.org/gmane.linux.bios/55336</a>
</div><div><br></div><div>Thanks!</div><div>Matt</div>