tinyusb.git/examples/device/mtp, branch claude/mtp-data-phase-fixes

examples/mtp: clamp SendObject writes to the declared object size

2026-08-17T05:11:53Z

fs_send_object() copied every received payload to f->data using only the running offset, so a host sending more data than its SendObjectInfo declared wrote past the object and overflowed fs_buf. Clamp each copy to what remains of f->size.

class/mtp: correct data phase completion and transaction recovery

2026-08-17T05:11:53Z

The data-out phase ended before its terminating ZLP and before the application had seen the final payload, and several transaction states had no way back to idle. Reworked as one state machine: - Add MTP_PHASE_DATA_COMPLETE, entered once the data phase has fully finished - for an exact buffer-multiple data-out, only after the host's terminating ZLP - and deliver tud_mtp_data_complete_cb() from there. tud_mtp_response_send() now refuses while the phase is still MTP_PHASE_DATA: ep_out still owes the host a read at that point and re-arming it for a new command would race that read. - Arm the terminating-ZLP read before handing the final payload to the application, as the IN path already does. The 0-length read passes a NULL buffer so the payload is untouched, and claiming ep_out first means a late tud_mtp_data_receive() fails its own claim instead of breaking the driver's next step. - Honor the documented negative return of tud_mtp_data_xfer_cb() and tud_mtp_data_complete_cb() by entering MTP_PHASE_ERROR, which stalls both endpoints. This is the application's way out of a data phase now that a response cannot be sent from one. Their weak stubs return 0 so an application that does not implement them is unaffected. - Take total_len from the container header the host sends on the first OUT packet. The application can only set it up front when it knows the size (SendObject); SendObjectInfo cannot, so total_len kept the 12-byte header default and the phase ended on the first packet. - Reject a runt or misdirected container in both the command and data phases: a short packet was matched against stale buffer contents, and the failed TU_VERIFY left ep_out neither armed nor stalled. The first data-out packet previously underflowed payload_bytes instead. - Restore the previous phase when tud_mtp_data_send()/_receive() cannot claim their endpoint, so the application's fallback response is not refused by a phase the driver never actually entered. - Re-arm ep_out after MTP_REQ_CANCEL of a data phase, and defer the new-command read when ep_out is still busy with the ZLP read of an abandoned transaction: usbd_edpt_xfer() asserts on a busy endpoint, so MTP_REQ_RESET could not recover. The MTP example follows the same contract: a handler error raised mid data phase (fs_send_object_info validates the received ObjectInfo, so STORE_FULL and INVALID_PARENT_OBJECT can only be raised there) is kept and answered from tud_mtp_data_complete_cb() once the phase completes.

test/hil: usbtest fleet enablement, shuffled scheduling, unique PIDs

2026-07-14T06:22:48Z

Pool/config: - record real uids (ra8m1_ek), enable usbtest for espressif s3/p4, then park ra6m5_ek and ra8m1_ek in boards-skip (ra6m5's usbtest/MSC traffic can kill the uPD720201 host on its ROM firmware; ra8m1 USBHS bring-up pending); max32666/nrf54lm20 stay enabled - their MosChip flakiness never wedges - re-enable device/usbtest on HS boards (mimxrt1064, ch32v307) now that uPD720201 firmware 2.0.2.6 fixes the command-ring death; mimxrt1015 stays skipped - its HS battery killed the controller on both ROM and 2.0.2.6 firmware (board-specific); match the moved host-test bundles (f723 <-> rt1064); skip never-passing tests on the new nrf5340dk/nrf54lm20dk boards and the detached pico host bundle, each documented with a comment Host-controller quirk gating in usbtest.py (auto-skip, self-heals on a healthy xHCI): - MosChip MCS9990 EHCI: case 25 (int-OUT never scheduled, FRINDEX bug) and case 11 (unlinked reads complete short/EREMOTEIO) - Renesas uPD720201 xHCI: firmware-gated. The card must run firmware >= 2.0.2.6 (RAM-uploaded - it reverts to ROM on every power cycle): on older firmware the command ring dies under unlink stress (a Configure Endpoint command stops completing; the hub worker deadlocks holding the device lock; only a host power cycle recovers; three boards reproduced it). usbtest.py reads the FW version register (PCI config 0x6c) and refuses to run at all on older firmware - hil_test surfaces that as a failed test with the reason. On current firmware the full 30-case battery runs (validated FS+HS: metro_m4, f723, f723-DMA all 30/30). Scheduling (hil_test.py): - Shuffle each (board, variant)'s test order with a seeded RNG (HIL_SHUFFLE_SEED to replay) so usbtest batteries and flash churn spread across the timeline instead of convoying on one controller. - Per-controller usbtest + flash semaphores: HIL_USBTEST_PARALLEL (default 4) concurrent usbtest batteries and HIL_FLASH_PARALLEL (default 8) concurrent flashes per host controller. Profiled on uPD720201 firmware 2.0.2.6 across 8/1..12/8: wall time falls 22.2/14.3/12.5/10.8 min at usbtest width 1/2/3/4 and plateaus there; zero controller errors everywhere; first battery case failures (leaf-hub bandwidth stretch) appear at 12/8, and flash width 12 only amplifies flasher-hub contention flakes - so 8/4 is the optimum. A separate battery-window flash throttle was profiled and dropped. - Give every example a unique hardcoded USB PID (0x4001-0x4022, usbtest keeps 0x4010) instead of the PID_MAP interface bitmap: different examples now always re-enumerate back-to-back, even on boards whose CPU reset does not drop D+ (WCH CH58x), so the EXAMPLE_PID table and same-PID adjacency reordering in hil_test.py are gone; only the variant-boundary same-example repeat needs a swap. - Report matrix: stable columns with the metric-bearing tests pinned first (usbtest, cdc_msc_throughput, msc_file_explorer[_freertos]), the rest alphabetical. Fail fast: - enum wait budget 8 s on the first attempt, 4 s on retries; dfu waits are deadline-based so dfu-util's own runtime counts against the budget. A device-absent failure now costs ~3-5x a passing test (20-30 s) instead of 10-30x (47-150 s). - CI runs hil_test with --retry 1 and no in-run second pass: a broken fixture fails the job fast instead of holding the self-hosted runner for hours and blocking other PRs' HIL jobs. hil_test still writes the .skip sidecar, so a manual re-run attempt only retests what failed. Review fixes (multi-agent adversarial review of this commit): - tinyusb_win_usbser.inf: the PID rework moved five CDC examples onto even PIDs the INF's odd-only DeviceList never matched (legacy-Windows usbser binding) - appended 0x4006/4008/400a/4020/4022 to both lists. - usbtest example: USBTEST_TIER is now overridable and the descriptors and pumps are tier-conditional, so a board whose DCD cannot serve a tier lowers it instead of skipping the whole example - RA2A1 (RUSB2 with no isochronous pipe) builds at tier 3 via its BOARD_ define; the host battery follows the tier advertised in bcdDevice. Tier-4 output verified byte-identical after the refactor. - dynamic_configuration's second config derived USB_PID + 11 = 0x4018, colliding with net_lwip_webserver - now USB_PID + 0x0100, outside the per-example space. tools/check_example_pids.py (pre-commit hook) enforces PID uniqueness incl. derived and literal idProduct values. - usbtest.py firmware gate: matched by device ID (uPD720201/720202, both use the 0x6c FW register), and an unreadable version (setpci missing/denied) now refuses with its own message instead of masquerading as "firmware 0x00000000"; noted the gate is necessary but not sufficient (board-specific kills stay per-board skips). - hil_test: deadline waits use time.monotonic(); multiprocessing context pinned to fork (raw semaphores in Pool initargs); flash and usbtest permits unified into one fail-closed, exception-safe ctrl_permit (unknown controller takes every slot and logs a warning instead of silently borrowing slot 0); an all-skipped battery reports as skip, not "0/0" failure; slow-body polls (mtp, printer, disk read) go through a shared deadline-based wait_until so their bodies count against the enum budget; throughput's FS detection compares serials case-insensitively like every other walk; a missing MSC read-speed line now fails the host msc_file_explorer test instead of passing with an empty metric. Hardening: - fail fast (15 s) when a driver-registry sysfs write blocks: a wedged device otherwise turns every subsequent battery into an unkillable D-state writer and silently hangs the whole run - usb-recover skill: a VM reboot is not a reliable cure (MosChip hubs latch up across the PCIe reset); full host power cycle is Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01HeF2gZ1M7GWkz6Av4BpKPg

docs: add build-doc tooling and a README for every example

2026-06-29T03:16:25Z

Documentation tooling: - Add the `build-doc` skill and `tools/build_doc.py` wrapper for local Sphinx builds (clean / -W / open). - Enable Markdown (MyST) in conf.py and auto-collect examples/{device,host,dual}/*/README.md into a 3-level Examples nav (Examples > Device/Host/Dual > example), noting each page's source location and normalizing headings to a single H1. - Remove the stale `.claude/commands/build-doc.md`; point the AGENTS.md Documentation section at the skill. Example docs: - Add a README.md for every device/host/dual example: what it does, USB interface table, notable tusb_config.h settings, generic CMake + Make build steps, and how to try it. - Fold each *_freertos variant into its base README, noting the FreeRTOS source path and any RTOS-specific behavior. Generated docs/examples/ output is git-ignored. Builds clean with `sphinx-build -W`. Co-Authored-By: Claude Opus 4.8 (1M context)

Add GetPartialObject to MTP example

2026-05-13T20:27:57Z

Added support for GetPartialObject for better compatibility with Linux file explorers.

replace `TUD_ENDPOINT_ONE_DIRECTION_ONLY` with `CFG_TUD_ENDPOINT_ONE_DIRECTION_ONLY` for improved configuration consistency across examples and core sources

2026-04-21T04:26:51Z

mtp: add sending mtp response if MTP_RESP_OPERATION_NOT_SUPPORTED

2026-03-25T08:43:48Z

replace board_millis() with tusb_time_millis_api()

2026-02-27T17:01:40Z

example/mtp: fix root parent id

2025-12-29T19:54:04Z

Signed-off-by: HiFiPhile

clean up cmake, remove family_get_project_name()

2025-12-19T05:33:42Z