Replace the duplicated per-MCU dispatch in dcd_init/hcd_init and the two
helper flavors (USB_Type access on iMX RT, raw offset 0x90 on LPC18/43)
with one SBUSCFG register field plus a per-header CI_HS_SET_AHB_BURST()
hook, compiled only where defined. The LPC USB0-only policy is now
visible at the macro definition.
Text replies resume instead of dropping their tail packets, which used
to leave a Start/Continue sequence without an End. A new Function Block
Discovery now merges with a pending one instead of replacing it.
Adds the Device Identity Notification with an app callback, MIDI-CI
version and SysEx8 stream count in FB Info, honors the Endpoint
Discovery filter bitmap, and paces discovery replies by TX FIFO room.
A false return from tud_usbtmc_start_bus_read() here does not mean arming
failed: it means the endpoint is already armed, either because the
application re-armed it from its trigger callback or because a transfer is
still queued (usbd_edpt_xfer() reports failure when the endpoint is busy).
Both cases end in STATE_IDLE, so the state cannot disambiguate them either,
and stalling on the result would halt a healthy endpoint.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A single USB488 TRIGGER message left the bulk-OUT endpoint un-armed, so the
host's next bulk-OUT transfer timed out. The trigger itself succeeded
silently, so the failure surfaced on a later, unrelated command; only a
USBTMC device clear recovered it. The bundled examples/device/usbtmc
reproduced this as shipped.
Every other branch of the STATE_IDLE dispatch in usbtmcd_xfer_cb() leaves
the endpoint in a defined state: it either transitions out of STATE_IDLE so
a later tud_usbtmc_start_bus_read() can re-arm it, or it stalls and lets the
CLEAR_FEATURE(ENDPOINT_HALT) handler recover it. USBTMC_MSGID_USB488_TRIGGER
did neither, and because the state stayed STATE_IDLE, even an application
following the contract documented in usbtmc_device.h got a silent no-op from
tud_usbtmc_start_bus_read().
Transition to STATE_NAK so the re-arm can take effect, and stall the
endpoint when trigger is unsupported or the application callback rejects it,
matching the existing handling for messages the driver cannot process. The
callback result is deliberately not wrapped in TU_VERIFY(), which would
return before the stall/re-arm and reintroduce the same hang.
Since the driver now re-arms after a trigger, drop tud_usbtmc_msg_trigger_cb
from the list of callbacks after which the application must do so.
Fixes#3821
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
An XFER_COMPLETE dropped by a full event queue leaves its endpoint's
BUSY|CLAIMED state set forever - the consumer that normally clears it
never sees the event, so usbd_edpt_claim()/usbd_edpt_xfer() fail from
then on and the class never re-arms the endpoint. Clear both flags when
the enqueue fails: the completion is lost either way, but the endpoint
stays usable.
Unit test: arm a bulk endpoint, drop its completion against a full
queue, verify the endpoint can be claimed and re-armed.
Read the 128-bit device UUID from the flash PFR region at 0x0009FC70
(UM11126 rev 2.1, section 48.8) rather than falling back to the fixed
weak default in hw/bsp/board.c.
Verified on lpcxpresso55s69: cdc_msc enumerates with SerialNumber
E059C3E208F9B955B3BA4C5CC7F3D13D, matching the uid already recorded for
that board in test/hil/local.json.
A SETUP counted before a bus reset must not be carried across it: the
consumer would either skip a post-reset SETUP (count drained by the
stale entry) or, if the count leaked high for any other reason, skip
them all. usbd_reset() now zeroes the counter; the consumer already
guards on zero, and any pre-reset SETUP still in the queue is stale by
definition and correctly discarded.
A SETUP arriving while the event queue is full is silently dropped by
queue_event(), but _usbd_queued_setup has already been incremented. The
leaked count makes the event handler skip every subsequent SETUP
("Skipped since there is other SETUP in queue") forever: EP0 stays deaf
until tud_init() while the device otherwise looks alive - enumerated,
endpoints armed. Undo the increment when the enqueue fails.
Unit test: fill the queue so a SETUP is dropped, then verify the next
SETUP still completes a GET_DESCRIPTOR control transfer.
The self-contained net_ncm fuzz harness #includes ncm_device.c and stubs
the usbd symbols it references rather than linking the device stack.
tud_network_link_state() now calls usbd_defer_func(), so add a matching
no-op stub to keep the harness linking.
tud_network_link_state() delivered the NETWORK_CONNECTION notification
edge-triggered and fire-once: if a previous notification was still in
flight, notification_xmit() returned early and the notification for the
new link state was never queued. Because link_is_up is committed before
the send, the host could be left reporting a stale carrier state - e.g.
a permanent NO-CARRIER after a link up. The notification state was also
mutated from both the caller and the notify xfer-completion callback
with no serialisation, so on RTOS ports where tud_network_link_state()
runs in a task other than tud_task() the two could race.
Defer the whole link-state update onto the usbd task, so it can no
longer race the completion callback. A collision with an in-flight
notification is resolved by re-arming notification_xmit_state and
letting the existing completion callback drive it forward on the next
xfer completion, rather than adding a separate pending/retry flag.
A link toggle does not change the link speed, so strictly only the
NETWORK_CONNECTION notification needs (re)sending, but reusing the
existing speed-then-connection state machine keeps the fix on a single,
already-serialised code path.
Closes#3760
The comment above audiod_tx_packet_size() states flow control needs a FIFO
of at least 4*Navg, but the guard tests nominal_size[1] <= fifo_depth * 4 -
true for any FIFO larger than a quarter packet - instead of
nominal_size[1] * 4 <= fifo_depth. As written, flow control engages on
FIFOs far below its own documented minimum, where the depth/2 setpoint sits
within one packet of empty and the packet_size = 0 branch (a zero-length
packet, i.e. an audible 1 ms dropout for audio-class hosts) is reachable
from ordinary scheduling jitter rather than only from gross clock
deviation. With the guard corrected, undersized FIFOs fall back to the
plain min(count, max) path as intended.
test/hil: one openocd flasher, per-board verify and firmware extension
The four WCH boards move to `openocd`, leaving one flasher for all.
`verify` is now a per-board opt-out, not dropped fleet-wide: WCH cannot read flash back
over the WCH-Link sdi transport; the other seven openocd boards can, and say so explicitly.
FLASHER_SUFFIX decides each flasher's extension once — find_firmware returns the full path
and the flashers pass it through, so a build with only the wrong artifact is skipped rather
than failed mid-flash. --skip-flash bypasses the filter.
rescue_openocd() power-on-resets a wedged RP2040/RP2350 via its Rescue DP from the flash
retry; the probe has no reset line.
Drops unused openocd_adi, stflash, wlink_rs and uniflash, parks the unstable ra6m5_ek, and
tests that every roster flasher name dispatches.
hil, ci: scope HIL builds and tests to the boards a PR affects
Add test/hil/hil_select.py, a stdlib-only selector that maps a PR diff to the
rig boards, tests and BSP families a change can affect, and wire it into CI so
pull requests build and run only those. A port change picks its families' boards,
a class change picks the examples enabling that class, and device/host changes
prune the other role. Anything unclassified — infra, an unmapped port, a selector
error — falls back to the full matrix, and push/schedule runs are untouched.
Move the shared example lists to hil_examples.py; 54 hardware-free tests cover
the rules.
test/hil: add board-pool health check, split hil_test into focused modules (#3794)
Add test/hil/hil_pool_check.py: per-board rig health scan — probe presence,
light-example flash (dfu_runtime; device_info + serial check for host-only
boards), uid re-enumeration, safe recovery (probe authorized-toggle, board
reset), verified board_test re-park, USB topology report, and a markdown
summary table. Missing firmware is built on the spot (tools/build.py, idf.py
for espressif, one get_deps retry); row statuses: ok, flash-failed, failed,
locked. Board locks are always respected, never bypassed.
Refactor hil_test.py into hil_lock.py (flock protocol, controller permits,
hold/release/status CLI; replaces board_lock.py) and hil_flash.py (flashers,
find_firmware, run_cmd). Update WCH probe uids and the board roster in
tinyusb.json; add the hil-pool-check skill.
The plan doc records why the fork exists and how each vendor source was
ported; the interim handoff it superseded is dropped.
CLAUDE.md: a new worktree should symlink the dependency dirs to the
primary checkout rather than re-fetching them, replacing a single
symlink only when the branch needs a different dep revision. Also allow
'linke' in codespell - WCH-LinkE is a product name.
bsp, hil: flash with the unified OpenOCD fork
https://github.com/hathach/openocd (branch tinyusb) is mainline plus every
config these boards need: RPi RP2350, ADI max32/max78, the MounRiver WCH
configs, and the wlinke adapter on mainline's riscv target. It is a superset
of the vendor forks, so one 'openocd' covers all boards; -DOPENOCD=/OPENOCD=
still select another, msdk's when MAXIM_PATH is set.
Drops family_flash_openocd_wch and the OPENOCD_WCH pair, dedups
family_flash_openocd_adi, aligns ch583's work area, and points hil at the
flasher's own config instead of generating one per probe.
Verified: HIL green on all four WCH boards and max32666fthr.
test/hil: replace PCI reset with root-port VBUS cycle for D-state recovery
pci-reset was documented as an FLR, but no controller on either rig has FLR, so
it issued a PCIe secondary bus reset on a live, driver-bound xHCI -- halting the
card until the PVE host was power-cycled, and returning success so the caller
could not tell. It destroyed the ci controller twice.
Replace it with root-cycle, which cuts VBUS at the xHCI root port and touches
only the root hub, so it never takes the per-device lock the wedged ioctl holds.
uhubctl needs -S, or its sysfs backend disconnects the child before cutting
power and blocks on that same lock. Success is proven by the device's sysfs
directory inode changing: node existence proves nothing, and devnum is reused
once the per-bus map wraps.
usbtest.py's hang path invokes it, then confirms via /proc that nothing still
holds the device node. Skill scripts now run from the repo; the drifted
/usr/local/sbin copies are deleted.
