USB3: Get Configuration is trying to return a 93 byte descriptor but meet CRC error

jack_mao · ‎05-25-2025

Customer: MCCI

Platform: i.MX8MP EVK

MCCI have got USB2 on Zephyr working with the IMX8MPlus and are debugging USB3. They got the phy working, but now they are seeing a strange DMA problem (only on USB3).

Get Configuration is trying to return a 93 byte descriptor. They set up the TRB (just as for USB2) and the XDCI starts it’s thing. But instead of sending 93 bytes, it sends only 32 bytes, with a CRC error (evidently because it thought something went wrong fetching the data). Something indeed went wrong, because the last 8 bytes of the 32 bytes are corrupt (compared to the memory buffer). (They’re just wrong – no obvious relationship…) AXI is 64 bits, so possibly the last beat went wrong in some way. Buffer is in DDR at an address that ends in ... F0 (so it’s 16 byte, not 32-byte, aligned).

MCCI is using the Cortex M7 to run this, in case that matters.

Code is shared for USB2 and USB3 path in this area, so MCCI is pretty sure they’re flushing the cache, etc.

Do you have any suggestion?

jason_he · ‎05-26-2025

@jack_mao

I think we haven't supported dwc3 driver in our release code.

Could you please show me the version of zephyr, and the details how to setup the project?

chaehee · ‎05-27-2025

I am using Zephyr v3.7 branch. You are right. This version doesn't support USB on the imx8mp-evk by default. So, I created dwc3 USB device driver to support USB device mode.

Here is current problem when PC is enumerating USB device (imx8mp-evk USB port 0) with super speed connection. High speed connection is working fine, and PC enumerates USB device successfully.

I capture USB bus trace, and I found USB device controller sent corrupted data for the GET_CONFIGURATION_DESCRIPTOR command. I can see below USB bus capture. The dwc3 sent 32 bytes data but data length is 93 bytes.

I dumped actual configuration descriptor data. You can find data in the bus trace is not matched with actual data.

u-boot=> md.b 802048f0 60
802048f0: 09 02 5d 00 02 01 00 c0 1f 08 0b 00 02 02 02 00 ..].............
80204900: 00 09 04 00 00 01 02 02 00 00 05 24 00 10 01 05 ...........$....
80204910: 24 01 00 01 04 24 02 02 05 24 06 00 01 07 05 81 $....$...$......
80204920: 03 10 00 07 06 30 00 00 10 00 09 04 01 00 02 0a .....0..........
80204930: 00 00 00 07 05 82 02 00 04 00 06 30 0f 00 00 00 ...........0....
80204940: 07 05 01 02 00 04 00 06 30 0f 00 00 00 00 00 00 ........0.......
u-boot=>

Let me know if you need more information. For example, dump registers.

I also created a ticket (Re: imx8mp-evk USB PHY initialization - NXP Community). Can you take a look this ticket if you have time?

jason_he · ‎05-27-2025

@chaehee

1, Could you please try to make the buffer addr 2K-aligned or 4K-aligned?

2, Do you receive any err event from irq? and check the status of related TRBs?

chaehee · ‎05-28-2025

I used 2K and 4K aligned buffer, but both are not working.

Below is 2K aligned buffer: buffer address is 80200800.

[00:00:18.673,000] <inf> udc_xdci: super speed
[00:00:18.673,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:18.678,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:18.778,000] <inf> udc_xdci: SETUP: 00 05 2b 00 00 00 00 00
[00:00:18.778,000] <inf> udc_xdci: (80) TRB[0x80401a70]=00000000 00000000 00000000 00000833
[00:00:18.779,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:18.779,000] <inf> udc_xdci: SETUP: 80 06 00 01 00 00 12 00
[00:00:18.779,000] <inf> udc_xdci: (80) TRB[0x80401a70]=80200800 00000000 00000012 00000853
[00:00:18.779,000] <inf> udc_xdci: (00) TRB[0x80401260]=80204ab0 00000000 00000000 00000c43
[00:00:18.779,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:18.782,000] <inf> udc_xdci: SETUP: 80 06 00 02 00 00 ff 00
[00:00:18.782,000] <inf> udc_xdci: (80) TRB[0x80401a70]=80200800 00000000 0000005d 00000853
[00:00:24.296,000] <inf> udc_xdci: SS inactive DCTL=80f00000, disconnect
[00:00:24.384,000] <inf> udc_xdci: super speed

Below is 4K aligned buffer: buffer address is 80201000.

[00:00:08.094,000] <inf> udc_xdci: super speed
[00:00:08.094,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:08.099,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:08.200,000] <inf> udc_xdci: SETUP: 00 05 2f 00 00 00 00 00
[00:00:08.200,000] <inf> udc_xdci: (80) TRB[0x80401a70]=00000000 00000000 00000000 00000833
[00:00:08.200,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:08.200,000] <inf> udc_xdci: SETUP: 80 06 00 01 00 00 12 00
[00:00:08.201,000] <inf> udc_xdci: (80) TRB[0x80401a70]=80201000 00000000 00000012 00000853
[00:00:08.201,000] <inf> udc_xdci: (00) TRB[0x80401260]=802052b0 00000000 00000000 00000c43
[00:00:08.201,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:08.203,000] <inf> udc_xdci: SETUP: 80 06 00 02 00 00 ff 00
[00:00:08.204,000] <inf> udc_xdci: (80) TRB[0x80401a70]=80201000 00000000 0000005d 00000853
[00:00:13.717,000] <inf> udc_xdci: SS inactive DCTL=80f00000, disconnect
[00:00:13.805,000] <inf> udc_xdci: super speed

There is no endpoint error event from dwc3 core after start control IN transfer. It received command complete event after start control IN transfer. It means USB controller (dwc3) is processing control IN transfer.

chaehee · ‎05-28-2025

I added event TRB dump for your reference. At the end of log, you can find endpoint transfer command completion event after start transfer control IN data. So, there is no endpoint error event from dwc3.

[00:00:08.298,000] <inf> udc_xdci: xdci event=00150301 1
[00:00:08.299,000] <inf> udc_xdci: xdci event=00170301 1
[00:00:08.417,000] <inf> udc_xdci: xdci event=00000101 1
[00:00:08.417,000] <inf> udc_xdci: super speed
[00:00:08.417,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:08.417,000] <inf> udc_xdci: xdci event=060001c0 1
[00:00:08.421,000] <inf> udc_xdci: xdci event=00000201 1
[00:00:08.421,000] <inf> udc_xdci: xdci event=080001c0 1
[00:00:08.422,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:08.422,000] <inf> udc_xdci: xdci event=060001c0 1
[00:00:08.523,000] <inf> udc_xdci: xdci event=0000c040 2
[00:00:08.523,000] <inf> udc_xdci: SETUP: 00 05 27 00 00 00 00 00
[00:00:08.523,000] <inf> udc_xdci: xdci event=000020c2 1
[00:00:08.523,000] <inf> udc_xdci: (80) TRB[0x80401a70]=00000000 00000000 00000000 00000833
[00:00:08.523,000] <inf> udc_xdci: xdci event=060101c2 2
[00:00:08.523,000] <inf> udc_xdci: xdci event=0000c042 1
[00:00:08.523,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:08.523,000] <inf> udc_xdci: xdci event=060001c0 1
[00:00:08.523,000] <inf> udc_xdci: xdci event=0000c040 2
[00:00:08.523,000] <inf> udc_xdci: SETUP: 80 06 00 01 00 00 12 00
[00:00:08.523,000] <inf> udc_xdci: xdci event=000010c2 1
[00:00:08.524,000] <inf> udc_xdci: (80) TRB[0x80401a70]=80201000 00000000 00000012 00000853
[00:00:08.524,000] <inf> udc_xdci: xdci event=060101c2 3
[00:00:08.524,000] <inf> udc_xdci: xdci event=0000c042 2
[00:00:08.524,000] <inf> udc_xdci: xdci event=000020c0 1
[00:00:08.524,000] <inf> udc_xdci: (00) TRB[0x80401260]=802052b0 00000000 00000000 00000c43
[00:00:08.524,000] <inf> udc_xdci: xdci event=060001c0 1
[00:00:08.524,000] <inf> udc_xdci: xdci event=0000c040 1
[00:00:08.524,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:08.524,000] <inf> udc_xdci: xdci event=060001c0 1
[00:00:08.529,000] <inf> udc_xdci: xdci event=0000c040 2
[00:00:08.530,000] <inf> udc_xdci: SETUP: 80 06 00 02 00 00 ff 00
[00:00:08.530,000] <inf> udc_xdci: xdci event=000010c2 1
[00:00:08.530,000] <inf> udc_xdci: (80) TRB[0x80401a70]=80201000 00000000 0000005d 00000853
[00:00:08.530,000] <inf> udc_xdci: xdci event=060101c2 1
[00:00:14.041,000] <inf> udc_xdci: xdci event=00160301 1
[00:00:14.041,000] <inf> udc_xdci: SS inactive DCTL=80f00000, disconnect

jason_he · ‎05-29-2025

@chaehee

1, Did the issue always happen when getting configuration? Is the 32-byte data always the same? I just want to exclude the electrical problem.

2, 0x060101c2 means EP0IN EPCmdCmplt. Did you send any End Transfer command?

3, Could you please double check the TRB status after 0x060101c2 event? Since some bits may be updated by HW.

chaehee · ‎05-30-2025

@jason_he,

1. Yes, it always happens. For your reference, I attached USB bus trace file.

2. The event 0x060101c2 is command completion event for start transfer command. It is not for the end transfer. It means dwc3 core accepts start transfer command and starting data transfer.

3. I already checked transfer TRB status when received link state change event. There is no change in the TRB -- still hardware owns TRB and no status update.

jason_he · ‎06-03-2025

@chaehee

3, Do you mean all the 4 DWORDs are not updated (including HWO bit) after EPCmdCmplt event?

4, we have no dwc3 driver for zephyr. or could you please share yours?

terrillmoore · ‎06-03-2025

Yes, we can get you source code. The best way is to get you git access to our Zephyr dev repository on our corporate gitlab. For that, we need an email address so we can send an invitation. Can you provide an email address? I'll send you a private message in this community with my email address.

Thanks,
--Terry

terrillmoore · ‎06-04-2025

@jason_he, to get you the code, we need to have your email address. Please confirm that you've received the private message I sent. Thanks!

jason_he · ‎06-05-2025

@terrillmoore

jason.he_1@nxp.com

terrillmoore · ‎06-05-2025

Thanks, Jason. I've sent information on how to access the code to your email.

chaehee · ‎06-03-2025

Hi @jason_he,

3. I added TRB dump when it receives link state change event.

[00:00:31.363,000] <inf> udc_xdci: SETUP: 80 06 00 01 00 00 12 00
[00:00:31.363,000] <inf> udc_xdci: xdci event=000010c2 1
[00:00:31.364,000] <inf> udc_xdci: (80) TRB[0x80401a70]=802048f0 00000000 00000012 00000853
[00:00:31.364,000] <inf> udc_xdci: xdci event=060101c2 3
[00:00:31.364,000] <inf> udc_xdci: xdci event=0000c042 2
[00:00:31.364,000] <inf> udc_xdci: xdci event=000020c0 1
[00:00:31.364,000] <inf> udc_xdci: (00) TRB[0x80401260]=80204860 00000000 00000000 00000c43
[00:00:31.364,000] <inf> udc_xdci: xdci event=060001c0 1
[00:00:31.364,000] <inf> udc_xdci: xdci event=0000c040 1
[00:00:31.364,000] <inf> udc_xdci: (00) TRB[0x80401260]=80401260 00000000 00000008 00000823
[00:00:31.364,000] <inf> udc_xdci: xdci event=060001c0 1
[00:00:31.373,000] <inf> udc_xdci: xdci event=0000c040 2
[00:00:31.373,000] <inf> udc_xdci: SETUP: 80 06 00 02 00 00 ff 00
[00:00:31.373,000] <inf> udc_xdci: xdci event=000010c2 1
[00:00:31.373,000] <inf> udc_xdci: (80) TRB[0x80401a70]=802048f0 00000000 0000005d 00000853  <-- TRB dump before sending start transfer command
[00:00:31.373,000] <inf> udc_xdci: xdci event=060101c2 1   <-- command complete event for start transfer
[00:00:36.889,000] <inf> udc_xdci: xdci event=00160301 1   <-- later, gets link state change event (link state is inactive)
[00:00:36.889,000] <inf> udc_xdci: SS inactive DCTL=80f00000, disconnect
[00:00:36.889,000] <inf> udc_xdci: (80) TRB[0x80401a70]=802048f0 00000000 0000005d 00000853  <-- TRB dump, exactly same as above.

4. regarding sharing source code, I will discuss internally and let you know. I attached Zephyr image. So, you can run it on the imx8mp-evk board.

Here is instruction:

Copy zephyr.bin file to SD card

Power on imx8mp-evk

Enter u-boot mode

Run below command on the u-boot

fatload mmc 1:1 0x80000000 zephyr.bin ; dcache flush ; bootaux 0x80000000

Hit any key to stop autoboot: 0
u-boot=>
u-boot=> fatload mmc 1:1 0x80000000 zephyr.bin ; dcache flush ; bootaux 0x80000000
70980 bytes read in 27 ms (2.5 MiB/s)
## Starting auxiliary core stack = 0x80207760, pc = 0x800024E5...
u-boot=>

jason_he · ‎06-06-2025

@chaehee

Could you please share your uboot?

imx-boot-imx8mp-lpddr4-evk-sd.bin-flash_evk from 6.1.36 is used but the log is as follows in both HS and SS.

[00:00:12.098,000] <inf> udc_xdci: xdci event=00000000 1
[00:00:12.098,000] <err> udc_xdci: NULL event, DSTS=001600dc
[00:00:12.197,000] <inf> udc_xdci: xdci event=00000000 2
[00:00:12.197,000] <err> udc_xdci: NULL event, DSTS=00820001

It happened both in zephyr-imx8mp_evk-m7-ddr-20250603a.zip and the binary built from mcci-v3.7-chwon-branch

chaehee · ‎06-06-2025

Hi @jason_he,

I am using original u-boot which comes with imx8mp-evk board. Below is booting information. I don't know how I can share u-boot. Let me know instructions.


U-Boot SPL 2020.04-5.4.70-2.3.2+g185bdaaaf5 (Apr 02 2021 - 17:52:17 +0000)
DDRINFO: start DRAM init
DDRINFO: DRAM rate 4000MTS
DDRINFO:ddrphy calibration done
DDRINFO: ddrmix config done
Normal Boot
Trying to boot from BOOTROM
image offset 0x0, pagesize 0x200, ivt offset 0x0
NOTICE: BL31: v2.2(release):imx_5.4.70_er5-4-g2a2678646
NOTICE: BL31: Built : 17:52:11, Apr 2 2021


U-Boot 2020.04-5.4.70-2.3.2+g185bdaaaf5 (Apr 02 2021 - 17:52:17 +0000)

CPU: i.MX8MP[8] rev1.1 1800 MHz (running at 1200 MHz)
CPU: Commercial temperature grade (0C to 95C) at 35C
Reset cause: POR
Model: NXP i.MX8MPlus LPDDR4 EVK board
DRAM: 6 GiB
TCPC: Vendor ID [0x1fc9], Product ID [0x5110], Addr [I2C2 0x50]
SNK.Power3.0 on CC2
PDO 0: type 0, 5000 mV, 3000 mA [E]
PDO 1: type 0, 9000 mV, 3000 mA []
PDO 2: type 0, 15000 mV, 3000 mA []
PDO 3: type 0, 20000 mV, 2250 mA []
Requesting PDO 3: 20000 mV, 2250 mA
Source accept request
PD source ready!
tcpc_pd_receive_message: Polling ALERT register, TCPC_ALERT_RX_STATUS bit failed, ret = -62
Power supply on USB2
TCPC: Vendor ID [0x1fc9], Product ID [0x5110], Addr [I2C1 0x50]
MMC: FSL_SDHC: 1, FSL_SDHC: 2
Loading Environment from MMC... *** Warning - bad CRC, using default environment

[*]-Video Link 0Can't find cec device id=0x3c
fail to probe panel device adv7535@3d
fail to get display timings
probe video device failed, ret -19

[0] lcd-controller@32e80000, video
[1] mipi_dsi@32e60000, video_bridge
[2] adv7535@3d, panel
Can't find cec device id=0x3c
fail to probe panel device adv7535@3d
fail to get display timings
probe video device failed, ret -19
In: serial
Out: serial
Err: serial

BuildInfo:
- ATF 2a26786
- U-Boot 2020.04-5.4.70-2.3.2+g185bdaaaf5

switch to partitions #0, OK
mmc2(part 0) is current device
flash target is MMC:2
Net:
Warning: ethernet@30be0000 using MAC address from ROM

Warning: ethernet@30bf0000 using MAC address from ROM
eth0: ethernet@30be0000, eth1: ethernet@30bf0000 [PRIME]
Fastboot: Normal
Normal Boot
Hit any key to stop autoboot: 0
u-boot=>

Regarding your debug log, driver reads event TRB, but event is 0. So, driver can handle event. Did you see this event when connect or disconnect type C cable?

chaehee · ‎06-09-2025

Hi @jason_he,

I can reproduce the NULL event issue with recent version of the u-boot image.

Recent version of u-boot not allowed RDC peripheral write access. So, you should allow peripheral write access as below before run Zephyr image.

u-boot=> mw.l 303d0474 ff
u-boot=> mw.l 303a00e4 2000c ; mw.l 303a01cc 37ffcf ; fatload mmc 1:1 0x80000000 zephyr.bin ; dcache flush ; bootaux 0x80000000

By the way, do you have USB3 working version? If you have working software, you can dump USB related registers and send to me. I want to see HSIO_BLK_CTRL (at 0x32f10000), USB GLUE (at 0x381f0000), and USB device core (at 0x3810c100) registers.

jason_he · ‎06-11-2025

@chaehee

I dumped 0x3810c100~0x3810c640 after Start Transfer cmd of sending Configuration Descriptor. The dump started at 46.695482s

For 0x32f10000 and 0x381f0000. they should be unchanged after USB init. here is the memtool

# /unit_tests/memtool -32 0x32f10100 0x2
E
Reading 0x2 count starting at address 0x32F10100

0x32F10100:  00000000 00001F00

# /unit_tests/memtool -32 0x381F0000 0x2
E
Reading 0x2 count starting at address 0x381F0000

0x381F0000:  0020F003 00000000

# /unit_tests/memtool -32 0x381F0040 6
E
Reading 0x6 count starting at address 0x381F0040

0x381F0040:  00000D54 00000006 00000300 AB95E6EF
0x381F0050:  04309E09 0000007F

Actually. I tried to tune the phy as linux OS but It doesn't work in zephyr.

chaehee · ‎06-11-2025

Hi @jason_he,

Good to know you can reproduce issue.

Can you dump more registers?

1. HSIO_BLK_CTRL

# /unit_tests/memtool -32 0x32f10000 0x10
# /unit_tests/memtool -32 0x32f10100 0x4

2. USB1_GLUE

# /unit_tests/memtool -32 0x381F0000 0x10
# /unit_tests/memtool -32 0x381F0040 0x8

3. DWC3 USB registers

0x3810c100 - 0x3810c2cc

0x3810c300 - 0x3810c32c

0x3810c380 - 0x3810c38c

0x3810c400 - 0x3810c40c

0x3810c600 - 0x3810c63c

0x3810c700 - 0x3810c74c

0x3810c800 - 0x3810c83c

jason_he · ‎06-12-2025

@chaehee

please check the attachment.

memtool is done after USB device is enumerated successfully.
dwc3_readl is done after "Start Transfer" cmd.

I am not sure why 0x32f10000 differ a lot. I need to check it later.

chaehee · ‎06-12-2025

Hi @jason_he,

I changed code to match USB related registers with Linux, and I pushed it.

But it doesn't fix the issue.

Do you have any other suggestions?