Hi,
I am seeing crashes in our XHCI implementation based on a Designware USB 3.1 core. One thing I noticed is that this core sets the PAE bit in the HCCparams. The result of this is that when there is a short packet and there are two TDs, then when PAE is set there will be two responses with the second one being success. I'm still not sure if the length field I'm seeing is correct or not, but it appears that neither Linux nor U-Boot can handle HCs with the PAE bit set. See the eXtendable Host Controller Interface 1.1 sections 4.10.1.1 and 5.3.6.
With short packets with the PAE bit set with to TRBs I get two responses when the data fits in the first TRB. The first event TRB contains a short packet response with the length set to the amount of space within the first TRB that is actually used. The second TRB event is a success completion code, as is described in section 4.10.1.1.1.
Personally I find this PAE bit a major pain in the arse that causes more trouble than it's worth.
-Aaron