I’m writing an x86_64 OS and testing it on qemu pc. I’m trying to make a very minimal and rough implementation of an xHCI driver, to read from the usb stick I use for booting. I have located the MMIO space of the controller and checked that the values in it are reasonable. Then, I extracted from it some offsets to the various data structures. I start from the assumption that UEFI firmware has already setup the controller and enumerate the USB devices attached to it (which seems to be the case since I can see a valid device context pointer at index 1 of the device context base address array). I checked the state of the endpoints offered by device 1, and found 3 endpoints (as I expected):

Endpoint 1: control in/out

Endpoint 3: bulk IN

Endpoint 4: bulk OUT

The state of all three endpoints is running. After making sure of all of this, I tried creating a transfer ring and queuing a TRB to read 512 bytes from the usb stick. After this I ring the door bell and enter a loop waiting for user input. (I know I should poll the event ring, but I’m just trying to get things working. I think that a big enough delay should give the xHCI enough time to read the data to the buffer). The problem is that when I go to read the data buffer, it is empty. Here is my code:

pub fn read_usb(dcbaap: &DeviceContextBaseAddressArray, db: &mut XhciDoorBell) {
    let dev = unsafe { &mut *(dcbaap.0[1] as *mut DeviceContext) };
    let in_ep = 3;
    let out_ep = 4;

    let in_ep_ctx = &mut dev.0[in_ep];

    let ring = unsafe {
        MEMORY_MAP.lock().as_mut().unwrap().allocate_frame() as *mut TransferRequestBlock
    };
    let buffer = unsafe { MEMORY_MAP.lock().as_mut().unwrap().allocate_frame() };

    unsafe {
        // Normal
        *ring.offset(0) = TransferRequestBlock([
            (buffer & 0xffff_ffff) as u32,
            (buffer >> 32) as u32 & 0xffff_ffff,
            512,
            1 | (1 << 10),
        ]);
        // Enqueue
        *ring.offset(1) = TransferRequestBlock([0, 0, 0, 0]);
    }

    // Update endpoint ctx
    in_ep_ctx.0[2] &= 0xf;
    in_ep_ctx.0[2] |= (ring as u64 & !0xf) as u32;
    in_ep_ctx.0[3] = (ring as u64 >> 32) as u32;

    // Ring door bell
    db.0[1] = 4;
    println!("state: {}", (dev.0[1].0[0]) & 0b111);

    // print
    stdin();
    peek(buffer as *const c_void, 10);
}

Does anybody have an idea what the problem might be? Are my assumptions about the state of the xHCI after exiting boot services wrong? Thanks for the help!