Unnamed repository; edit this file 'description' to name the repository. http://cgit.235523.xyz/tinyusb.git/atom/src/portable/nordic?h=0.16.0 2023-06-16T07:17:25Z 2023-06-16T07:17:25Z hathach thach@tinyusb.org 2023-06-16T07:17:25Z urn:sha1:a7f330fa94b7a39858f6d770737451b51f061c25 2023-03-17T09:12:49Z hathach thach@tinyusb.org 2023-03-17T09:12:49Z urn:sha1:3623ba1884ddff23e9b64766cb6dd032f1425846 temporarily disable codespell 2023-03-10T07:22:43Z Jerzy Kasenberg jerzy.kasenberg@codecoup.pl 2023-03-09T13:00:37Z urn:sha1:f0ddf8d10f7d58592d2ebb60025b227c8047114d For incoming ISO OUT packets it was possible to start DMA from endpoint to RAM before transfer was started resulting in unrelated memory corruption. This is scenario that causes memory corruption: - ISO OUT packet is received - Packet is transferred by DMA to transfer buffer - xfer->started is cleared and xfer->buffer is updated as it is in every case - Application takes to long to handle it (it happens when debugger is connected breakpoint is hit slowing down software). - Next ISO OUT packet arrives At this point there was no check if transfer was started and packet was copied by DMA to location beyond previous data, possibly overwriting unrelated memory. This solves the issue by checking that transfer was started and there is buffer ready for incoming packet. 2022-12-04T12:44:01Z hathach thach@tinyusb.org 2022-12-04T11:51:52Z urn:sha1:43b255f413e08b9e567a23b24701efbdaebcb824 2022-09-13T06:11:56Z Jerzy Kasenberg jerzy.kasenberg@codecoup.pl 2022-09-13T06:10:58Z urn:sha1:3133cacc6ab699244617039462f5c3870e16d835 ISO packet size is up to 1023 for full speed device. Upon completion of ISO reception, reported length of incoming packet was truncated to one byte only. This results in incorrect data stream for higher bit rates 48 samples * 4 bytes per sample * 2 channels = 384 bytes of data and 128 was reported. There is no change in logic extending xact_len to uint16_t fixes the issue. 2022-08-26T06:10:15Z Jerzy Kasenberg jerzy.kasenberg@codecoup.pl 2022-08-26T06:01:06Z urn:sha1:5e3cfe7b5784ee94a4914b36232d28ce96cf18f2 Field started (regardind transfer) was only cleaed when transfer was finished. For audio devices set interface is called many times. When there is no audio (silence) set interface requests zero lenght bandwithd that in turn calls dcd_edpt_close(). When endpoint is closed due to set interface request transfer should not longer be started since it will block next start transfer with assert. This just sets 'started' to false when endpoint is closed. 2022-06-02T15:23:35Z Jerzy Kasenberg jerzy.kasenberg@gmail.com 2022-06-01T19:50:15Z urn:sha1:8b37aa157911ff2cd470d090bb2e276ca57f5af4 There were two problems: - dma_running flag could be checked in USB interrupt (not set yet) then higher priority interrupt could start transfer, check dma_running (not set yet) set it to true start DMA; then when USB interrupt continues it starts another DMA that is not allowed - when DMA is started some registers can't be safely accessed, read can yield invalid values (SIZE.EPOUT, SIZE.EPISO) current implementation could start DMA for one OUT endpoint then check that another endpoint also has data and while DMA was not started right away, SIZE.EPOUT was copied already to MAXCNT register. Later on when DMA was started not all data was read from endpoint due to incorrect DMA size previously set. To prevent both cases dma_running is changed in atomic way. Only code that actually set this value to true starts DMA, code that tried and had dma_running flag already set simply defers DMA start to USB task. This eliminates also need to have mutex that was there to limit access to dma_running flag to one task only. transfer also now has started flag that is set only after dcd_edpt_xfer() sets up total_len and actua_len. Previously USB interrupt was disabled when total_len and actual_len were setup to prevent race condition when data arrived to ednpoint before transfer was setup was finished. 2022-03-07T16:05:05Z hathach thach@tinyusb.org 2022-03-07T16:05:05Z urn:sha1:606f932d92322a71960f51148ecc91eaf29bf507 2022-02-25T11:35:21Z hathach thach@tinyusb.org 2022-02-23T14:46:40Z urn:sha1:d10326cb4e0f48a05bc39c6f51b7b0fb29427cc9 TUSB_OPT_DEVICE_ENABLED still usable for backward compatible 2022-01-19T08:48:04Z Jerzy Kasenberg jerzy.kasenberg@codecoup.pl 2022-01-14T08:44:38Z urn:sha1:36b6ed8ff9035ad0c2e75de92e08799dc3a4b7ed When two tasks entered dcd_edpt_xfer() it was possible that first disabled interrupt to setup total_len and actual_len but second task for another endpoint enabled interrupt between total_len and actual_len resulting in race condition with interrupt, hence mutex is added on top of interrupt being blocked.