[PATCH] usb: core: Remove unused SuperSpeed EP0 maxpacket handling

[PATCH] usb: core: Remove unused SuperSpeed EP0 maxpacket handling

[Michal Pecio]

512 is the only control endpoint max packet size defined by USB 3,
encoded logarithmically as 9 in the 8-bit bMaxPacketSize0 field.

Up to v6.5 in 2023, core assumed 512 and ignored the descriptor,
but now it tries to decode and use it. One (emulated) device was
found to specify 8, see commit c78c3644b772 ("usb: Fix regression
caused by invalid ep0 maxpacket in virtual SuperSpeed device").

Thankfully, xhci_setup_addressable_virt_dev() always initializes
EP 0 packet size to 512 and xhci_check_[ep0]_maxpacket() has never
been called on SuperSpeed endpoints, which means that none of this
has any effect and 512 works for all devices ever supported. The
regression was caused by core refusing to enumerate bogus devices.

Drop pointless calculations and correct misleading logs, because
we don't actually use out of spec packet sizes. Moreover, some HCs
(NEC/Renesas, old AMD) reject them, though others don't and there
is some effect - enumeration fails with -EOVERFLOW or -EPROTO.

But those effects are only seen when patching xhci-hcd; altering
ep0.desc does nothing, even after the usb_ep0_reinit() call.

Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
---

By the way, xhci-hcd only updates max packet size at full-speed,
which means that the high-speed workaround doesn't work either.

Renesas does accept high-speed overrides, this time Etron doesn't.

Whether any of that works correctly with actual devices with unusual
packet size, and whether they really need a workaround (unlikely if
all their descriptors are shorter than bMaxPacketSize0) is unknown.

 drivers/usb/core/hub.c | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 5262e11c12cd..d9409943f388 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5143,22 +5143,14 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
 
 	/*
 	 * Check the ep0 maxpacket guess and correct it if necessary.
-	 * maxp0 is the value stored in the device descriptor;
-	 * i is the value it encodes (logarithmic for SuperSpeed or greater).
 	 */
 	i = maxp0;
-	if (udev->speed >= USB_SPEED_SUPER) {
-		if (maxp0 <= 16)
-			i = 1 << maxp0;
-		else
-			i = 0;		/* Invalid */
-	}
 	if (usb_endpoint_maxp(&udev->ep0.desc) == i) {
 		;	/* Initial ep0 maxpacket guess is right */
-	} else if (((udev->speed == USB_SPEED_FULL ||
-				udev->speed == USB_SPEED_HIGH) &&
-			(i == 8 || i == 16 || i == 32 || i == 64)) ||
-			(udev->speed >= USB_SPEED_SUPER && i > 0)) {
+	} else if (udev->speed >= USB_SPEED_SUPER && i == 9) {
+		;	/* Logarithmic encoding of 512 */
+	} else if ((udev->speed == USB_SPEED_FULL || udev->speed == USB_SPEED_HIGH)
+			&& (i == 8 || i == 16 || i == 32 || i == 64)) {
 		/* Initial guess is wrong; use the descriptor's value */
 		if (udev->speed == USB_SPEED_FULL)
 			dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
@@ -5169,8 +5161,11 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
 	} else {
 		/* Initial guess is wrong and descriptor's value is invalid */
 		dev_err(&udev->dev, "Invalid ep0 maxpacket: %d\n", maxp0);
-		retval = -EMSGSIZE;
-		goto fail;
+		if (udev->speed < USB_SPEED_SUPER) {
+			retval = -EMSGSIZE;
+			goto fail;
+		}
+		/* else: bogus USB 3.0 descriptors exist, we use 512 anyway */
 	}
 
 	descr = usb_get_device_descriptor(udev);
-- 
2.48.1

Re: [PATCH] usb: core: Remove unused SuperSpeed EP0 maxpacket handling

[Alan Stern]

On Mon, Aug 10, 2026 at 08:12:12AM +0200, Michal Pecio wrote:
> 512 is the only control endpoint max packet size defined by USB 3,
> encoded logarithmically as 9 in the 8-bit bMaxPacketSize0 field.
> 
> Up to v6.5 in 2023, core assumed 512 and ignored the descriptor,
> but now it tries to decode and use it. One (emulated) device was
> found to specify 8, see commit c78c3644b772 ("usb: Fix regression
> caused by invalid ep0 maxpacket in virtual SuperSpeed device").
> 
> Thankfully, xhci_setup_addressable_virt_dev() always initializes
> EP 0 packet size to 512 and xhci_check_[ep0]_maxpacket() has never
> been called on SuperSpeed endpoints, which means that none of this
> has any effect and 512 works for all devices ever supported. The
> regression was caused by core refusing to enumerate bogus devices.
> 
> Drop pointless calculations and correct misleading logs, because
> we don't actually use out of spec packet sizes. Moreover, some HCs
> (NEC/Renesas, old AMD) reject them, though others don't and there
> is some effect - enumeration fails with -EOVERFLOW or -EPROTO.
> 
> But those effects are only seen when patching xhci-hcd; altering
> ep0.desc does nothing, even after the usb_ep0_reinit() call.
> 
> Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
> ---
> 
> By the way, xhci-hcd only updates max packet size at full-speed,
> which means that the high-speed workaround doesn't work either.
> 
> Renesas does accept high-speed overrides, this time Etron doesn't.
> 
> Whether any of that works correctly with actual devices with unusual
> packet size, and whether they really need a workaround (unlikely if
> all their descriptors are shorter than bMaxPacketSize0) is unknown.
> 
>  drivers/usb/core/hub.c | 23 +++++++++--------------
>  1 file changed, 9 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
> index 5262e11c12cd..d9409943f388 100644
> --- a/drivers/usb/core/hub.c
> +++ b/drivers/usb/core/hub.c
> @@ -5143,22 +5143,14 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
>  
>  	/*
>  	 * Check the ep0 maxpacket guess and correct it if necessary.
> -	 * maxp0 is the value stored in the device descriptor;
> -	 * i is the value it encodes (logarithmic for SuperSpeed or greater).
>  	 */

Nit: Since this is now a one-line comment, it should be written as:

	/* Check the ep0 maxpacket guess and correct it if necessary. */

Alan Stern