Re: Question r/e zero byte bulk transfer on musb gadget (causes kernel panic)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 01/11/2014 15:05, Alan Stern wrote:
On Sat, 1 Nov 2014, Breton M. Saunders wrote:

This is required behavior, for example, during the data phase of a
bulk-only mass-storage transfer.  The specification states that under
certain circumstances, the device _must_ send a zero-length packet on
its bulk-IN endpoint.
Hi Alan - thanks for that.  Can I ask: have you got a reference for
that?  It will help when I arrive back in the office on Monday.
I've briefly skimmed the usb mass storage bulk only document (from 1999)
and am looking at usb-msc-0.2.pdf now; but am not finding details on
zero-length transfers on bulk.
So on careful investigation, it turns out I misspoke.

In the 1.0 revision of the Bulk-Only Transport specification (the
filename is probably something like usbmassbulk_10.pdf), the discussion
of case 4 in section 6.7.2 says:

	If the device actually transfers less data than the host
	indicated, then:
		The device may end the transfer with a short packet.
		The device shall STALL the Bulk-In pipe.

Thus, if the device chooses to end the transfer with a short packet,
the packet may need to have length 0 (for case 4).  But the device
isn't required to do this, whereas it _is_ required to STALL the
bulk-IN pipe.

Ironically, many devices in the real world _do_ send a short packet and
_don't_ send a STALL.

Regardless, the principle is clear: Devices _should_ be able to send
0-length packets on bulk endpoints.  See the discussion of short
packets in sections 5.3.2 and 5.8.3 of the USB-2.0 spec.

Hi Alan,

  Thanks again for your help.

I think my understanding of the bulk transfer protocol was incorrectly confused with my previous work on control transfers. It looks like there is no concept of "transfer" vs "transaction" in bulk like there is in control. In bulk, the state machine consists of a single token->data->handshake transition - the only way a "write" system call is terminated is by writing a short packet. Therefore, a short packet being 0 bytes is perfectly legitimate - and therefore, performing a write from userland of zero bytes should also be permitted.

I reckon its off I go debugging MUSB. (Note: I'm stuck using 2.6.37; so the bug I've encountered may not be occurring on newer kernels).

    Cheers,

    -Brett



--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux