Merge branch 'master' into fork/atoktoto/midihost

# Conflicts:
#	hw/bsp/rp2040/family.cmake
#	src/class/midi/midi.h
#	src/class/midi/midi_device.c
#	src/device/usbd_control.c
#	src/host/hcd.h
#	src/host/usbh.c
#	src/host/usbh.h

23 files changed, 965 insertions, 659 deletions

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 2958d3b12..d00ee78bd 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -54,21 +54,21 @@ body:
         Exact steps in chronological order, details should be specific e.g if you use a command/script to test with, please post it as well.
         1. Go to '...'
         2. Click on '....'
-        3. See error      
+        3. See error
     validations:
       required: true
 
   - type: textarea
     attributes:
-      label: Debug Log as txt file
+      label: Debug Log as txt file (LOG/CFG_TUSB_DEBUG=2)
       placeholder: |
         Attach your debug log txt file here, where the issue occurred, best with comments to explain the actual events.
-        
-        Note1: Please DO NOT paste your lengthy log contents here since it hurts the readibility.
-        Note2: To enable logging, add `LOG=3` to to the make command if building with stock examples or set `CFG_TUSB_DEBUG=3` in your tusb_config.h. 
+
+        Note1: Please DO NOT paste your lengthy log contents here since it hurts the readability.
+        Note2: To enable logging, add `LOG=2` to to the make command if building with stock examples or set `CFG_TUSB_DEBUG=2` in your tusb_config.h.
         More information can be found at [example's readme](https://github.com/hathach/tinyusb/blob/master/docs/getting_started.md)
     validations:
-      required: false
+      required: true
 
   - type: textarea
     attributes:
diff --git a/.github/actions/get_deps/action.yml b/.github/actions/get_deps/action.yml
new file mode 100644
index 000000000..ae9e7bbef
--- /dev/null
+++ b/.github/actions/get_deps/action.yml
@@ -0,0 +1,29 @@
+name: Get dependencies
+
+inputs:
+  arg:
+    description: 'Arguments to get_deps.py'
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout pico-sdk for rp2040
+      if: contains(inputs.arg, 'rp2040') || contains(inputs.arg, 'raspberry_pi_pico')
+      uses: actions/checkout@v4
+      with:
+        repository: raspberrypi/pico-sdk
+        ref: master
+        path: pico-sdk
+
+    - name: Linux dependencies
+      if: runner.os == 'Linux'
+      run: |
+        sudo apt install -y ninja-build
+      shell: bash
+
+    - name: Get Dependencies
+      run: |
+        python3 tools/get_deps.py ${{ inputs.arg }}
+        echo "PICO_SDK_PATH=${{ github.workspace }}/pico-sdk" >> $GITHUB_ENV
+      shell: bash
diff --git a/.github/actions/setup_toolchain/action.yml b/.github/actions/setup_toolchain/action.yml
new file mode 100644
index 000000000..8305daa24
--- /dev/null
+++ b/.github/actions/setup_toolchain/action.yml
@@ -0,0 +1,68 @@
+name: Setup Toolchain
+
+inputs:
+  toolchain:
+    description: 'Toolchain name'
+    required: true
+
+outputs:
+  build_option:
+    description: 'Build option for the toolchain e.g --toolchain clang'
+    value: ${{ steps.set-toolchain-option.outputs.build_option }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install ARM GCC
+      if: inputs.toolchain == 'arm-gcc'
+      uses: carlosperate/arm-none-eabi-gcc-action@v1
+      with:
+        release: '13.2.Rel1'
+
+    - name: Pull ESP-IDF docker
+      if: inputs.toolchain == 'esp-idf'
+      uses: ./.github/actions/setup_toolchain/espressif
+      with:
+        toolchain: ${{ inputs.toolchain }}
+
+    - name: Get Toolchain URL
+      if: >-
+        inputs.toolchain != 'arm-gcc' &&
+        inputs.toolchain != 'arm-iar' &&
+        inputs.toolchain != 'esp-idf'
+      id: set-toolchain-url
+      run: |
+        TOOLCHAIN_JSON='{
+          "aarch64-gcc": "https://developer.arm.com/-/media/Files/downloads/gnu-a/10.3-2021.07/binrel/gcc-arm-10.3-2021.07-x86_64-aarch64-none-elf.tar.xz",
+          "arm-clang": "https://github.com/ARM-software/LLVM-embedded-toolchain-for-Arm/releases/download/release-19.1.1/LLVM-ET-Arm-19.1.1-Linux-x86_64.tar.xz",
+          "msp430-gcc": "http://software-dl.ti.com/msp430/msp430_public_sw/mcu/msp430/MSPGCC/9_2_0_0/export/msp430-gcc-9.2.0.50_linux64.tar.bz2",
+          "riscv-gcc": "https://github.com/xpack-dev-tools/riscv-none-elf-gcc-xpack/releases/download/v13.2.0-2/xpack-riscv-none-elf-gcc-13.2.0-2-linux-x64.tar.gz",
+          "rx-gcc": "https://github.com/hathach/rx_device/releases/download/0.0.1/gcc-8.3.0.202411-GNURX-ELF.run"
+        }'
+        TOOLCHAIN_URL=$(echo $TOOLCHAIN_JSON | jq -r '.["${{ inputs.toolchain }}"]')
+        echo "toolchain_url=$TOOLCHAIN_URL"
+        echo "toolchain_url=$TOOLCHAIN_URL" >> $GITHUB_OUTPUT
+      shell: bash
+
+    - name: Download Toolchain
+      if: >-
+        inputs.toolchain != 'arm-gcc' &&
+        inputs.toolchain != 'arm-iar' &&
+        inputs.toolchain != 'esp-idf'
+      uses: ./.github/actions/setup_toolchain/download
+      with:
+        toolchain: ${{ inputs.toolchain }}
+        toolchain_url: ${{ steps.set-toolchain-url.outputs.toolchain_url }}
+
+    - name: Set toolchain option
+      id: set-toolchain-option
+      run: |
+          BUILD_OPTION=""
+          if [[ "${{ inputs.toolchain }}" == *"clang"* ]]; then
+            BUILD_OPTION="--toolchain clang"
+          elif [[ "${{ inputs.toolchain }}" == "arm-iar" ]]; then
+            BUILD_OPTION="--toolchain iar"
+          fi
+          echo "build_option=$BUILD_OPTION"
+          echo "build_option=$BUILD_OPTION" >> $GITHUB_OUTPUT
+      shell: bash
diff --git a/.github/actions/setup_toolchain/download/action.yml b/.github/actions/setup_toolchain/download/action.yml
new file mode 100644
index 000000000..813197208
--- /dev/null
+++ b/.github/actions/setup_toolchain/download/action.yml
@@ -0,0 +1,39 @@
+name: Download Toolchain
+
+inputs:
+  toolchain:
+    description: 'Toolchain name'
+    required: true
+  toolchain_url:
+    description: 'Toolchain URL'
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Cache Toolchain
+      if: ${{ !startsWith(inputs.toolchain_url, 'https://github.com') }}
+      uses: actions/cache@v4
+      id: cache-toolchain-download
+      with:
+        path: ~/cache/${{ inputs.toolchain }}
+        key: ${{ runner.os }}-${{ inputs.toolchain }}-${{ inputs.toolchain_url }}
+
+    - name: Install Toolchain
+      if: steps.cache-toolchain-download.outputs.cache-hit != 'true'
+      run: |
+        mkdir -p ~/cache/${{ inputs.toolchain }}
+        wget --progress=dot:giga ${{ inputs.toolchain_url }} -O toolchain.tar.gz
+        if [[ ${{ inputs.toolchain }} == rx-gcc ]]; then
+          mv toolchain.tar.gz toolchain.run
+          chmod +x toolchain.run
+          ./toolchain.run -p ~/cache/${{ inputs.toolchain }}/gnurx -y
+        else
+          tar -C ~/cache/${{ inputs.toolchain }} -xaf toolchain.tar.gz
+        fi
+      shell: bash
+
+    - name: Set Toolchain Path
+      run: |
+        echo >> $GITHUB_PATH `echo ~/cache/${{ inputs.toolchain }}/*/bin`
+      shell: bash
diff --git a/.github/actions/setup_toolchain/espressif/action.yml b/.github/actions/setup_toolchain/espressif/action.yml
new file mode 100644
index 000000000..b50ffd41d
--- /dev/null
+++ b/.github/actions/setup_toolchain/espressif/action.yml
@@ -0,0 +1,48 @@
+name: Setup ESP-IDF Toolchain
+
+inputs:
+  toolchain:
+    description: 'Toolchain name'
+    required: true
+  toolchain_version:
+    description: 'Toolchain version'
+    required: false
+    default: 'v5.3.2'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set DOCKER_ESP_IDF
+      run: |
+        DOCKER_ESP_IDF=$HOME/cache/${{ inputs.toolchain }}/docker_image.tar
+        echo "DOCKER_ESP_IDF=$DOCKER_ESP_IDF" >> $GITHUB_ENV
+      shell: bash
+
+    - name: Cache Docker Image
+      uses: actions/cache@v4
+      id: cache-toolchain-espressif
+      with:
+        path: ${{ env.DOCKER_ESP_IDF }}
+        key: ${{ inputs.toolchain }}-${{ inputs.toolchain_version }}
+
+    - name: Pull and Save Docker Image
+      if: steps.cache-toolchain-espressif.outputs.cache-hit != 'true'
+      run: |
+        docker pull espressif/idf:${{ inputs.toolchain_version }}
+        mkdir -p $(dirname $DOCKER_ESP_IDF)
+        docker save -o $DOCKER_ESP_IDF espressif/idf:${{ inputs.toolchain_version }}
+        du -sh $DOCKER_ESP_IDF
+      shell: bash
+
+    - name: Load Docker Image
+      if: steps.cache-toolchain-espressif.outputs.cache-hit == 'true'
+      run: |
+        du -sh $DOCKER_ESP_IDF
+        docker load --input $DOCKER_ESP_IDF
+      shell: bash
+
+    - name: Tag Local Image
+      run: |
+        docker tag espressif/idf:${{ inputs.toolchain_version }} espressif/idf:tinyusb
+        docker images
+      shell: bash
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 000000000..547763bd8
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,164 @@
+name: Build
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - 'src/**'
+      - 'examples/**'
+      - 'lib/**'
+      - 'hw/**'
+      - 'tools/get_deps.py'
+      - 'tools/build.py'
+      - '.github/actions/**'
+      - '.github/workflows/build.yml'
+      - '.github/workflows/build_util.yml'
+      - '.github/workflows/ci_set_matrix.py'
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'examples/**'
+      - 'lib/**'
+      - 'hw/**'
+      - 'tools/get_deps.py'
+      - 'tools/build.py'
+      - '.github/actions/**'
+      - '.github/workflows/build.yml'
+      - '.github/workflows/build_util.yml'
+      - '.github/workflows/ci_set_matrix.py'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  set-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      json: ${{ steps.set-matrix-json.outputs.matrix }}
+    steps:
+      - name: Checkout TinyUSB
+        uses: actions/checkout@v4
+
+      - name: Generate matrix json
+        id: set-matrix-json
+        run: |
+          MATRIX_JSON=$(python .github/workflows/ci_set_matrix.py)
+          echo "matrix=$MATRIX_JSON"
+          echo "matrix=$MATRIX_JSON" >> $GITHUB_OUTPUT
+
+  # ---------------------------------------
+  # Build CMake
+  # ---------------------------------------
+  cmake:
+    needs: set-matrix
+    uses: ./.github/workflows/build_util.yml
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain:
+          # - 'arm-clang' is built by circle-ci in PR
+          - 'aarch64-gcc'
+          - 'arm-gcc'
+          - 'msp430-gcc'
+          - 'riscv-gcc'
+    with:
+      build-system: 'cmake'
+      toolchain: ${{ matrix.toolchain }}
+      build-args: ${{ toJSON(fromJSON(needs.set-matrix.outputs.json)[matrix.toolchain]) }}
+      one-per-family: ${{ github.event_name == 'push' }}
+
+  # ---------------------------------------
+  # Build Make (built by circle-ci in PR, only build on push here)
+  # ---------------------------------------
+  make:
+    if: github.event_name == 'push'
+    needs: set-matrix
+    uses: ./.github/workflows/build_util.yml
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain:
+          # 'arm-clang'
+          - 'arm-gcc'
+          - 'aarch64-gcc'
+          - 'msp430-gcc'
+          - 'riscv-gcc'
+          - 'rx-gcc'
+          - 'esp-idf' # build-system is ignored
+    with:
+      build-system: 'make'
+      toolchain: ${{ matrix.toolchain }}
+      build-args: ${{ toJSON(fromJSON(needs.set-matrix.outputs.json)[matrix.toolchain]) }}
+      one-per-family: true
+
+  # ---------------------------------------
+  # Build Make on Windows/MacOS
+  # ---------------------------------------
+  make-os:
+    if: github.event_name == 'pull_request'
+    uses: ./.github/workflows/build_util.yml
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+    with:
+      os: ${{ matrix.os }}
+      build-system: 'make'
+      toolchain: 'arm-gcc'
+      build-args: '["stm32h7"]'
+      one-per-family: true
+
+  # ---------------------------------------
+  # Build IAR on HFP self-hosted
+  # Since IAR Token secret is not passed to forked PR, only build on PR from the same repo
+  # ---------------------------------------
+  arm-iar:
+    if: github.repository_owner == 'hathach' && github.event_name == 'push'
+    needs: set-matrix
+    runs-on: [self-hosted, Linux, X64, hifiphile]
+    env:
+      BUILD_ARGS: ${{ join(fromJSON(needs.set-matrix.outputs.json)['arm-iar'], ' ') }}
+      IAR_LMS_CLOUD_URL: ${{ vars.IAR_LMS_CLOUD_URL }}
+      IAR_LMS_BEARER_TOKEN: ${{ secrets.IAR_LMS_BEARER_TOKEN }}
+    steps:
+      - name: Clean workspace
+        run: |
+          echo "Cleaning up previous run"
+          rm -rf "${{ github.workspace }}"
+          mkdir -p "${{ github.workspace }}"
+
+      - name: Toolchain version
+        run: |
+          echo IAR_LMS_CLOUD_URL=$IAR_LMS_CLOUD_URL
+          iccarm --version
+
+      - name: Checkout TinyUSB
+        uses: actions/checkout@v4
+
+      - name: Get Dependencies
+        run: python3 tools/get_deps.py $BUILD_ARGS
+
+      - name: Build
+        run: python3 tools/build.py --one-per-family --toolchain iar $BUILD_ARGS
+
+  # ---------------------------------------
+  # Zephyr
+  # ---------------------------------------
+  zephyr:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout TinyUSB
+        uses: actions/checkout@v4
+
+      - name: Setup Zephyr project
+        uses: zephyrproject-rtos/action-zephyr-setup@v1
+        with:
+          app-path: examples
+          toolchains: arm-zephyr-eabi
+
+      - name: Build
+        run: |
+          west build -b pca10056 -d examples/device/cdc_msc/build examples/device/cdc_msc -- -DRTOS=zephyr
+          west build -b pca10056 -d examples/device/msc_dual_lun/build examples/device/msc_dual_lun -- -DRTOS=zephyr
diff --git a/.github/workflows/build_aarch64.yml b/.github/workflows/build_aarch64.yml
deleted file mode 100644
index af26f33f2..000000000
--- a/.github/workflows/build_aarch64.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-name: Build AArch64
-
-on:
-  pull_request:
-  push:
-  release:
-    types:
-      - created
-
-jobs:
-  # ---------------------------------------
-  # Build AARCH64 family
-  # ---------------------------------------
-  build-arm:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        family:
-        # Alphabetical order
-        - 'broadcom_64bit'
-    steps:
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.x'
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Checkout common submodules in lib
-      run: git submodule update --init lib/FreeRTOS-Kernel lib/lwip lib/sct_neopixel
-
-    - name: Checkout hathach/linkermap
-      uses: actions/checkout@v3
-      with:
-         repository: hathach/linkermap
-         path: linkermap
-
-    - name: Set Toolchain URL
-      run: echo >> $GITHUB_ENV TOOLCHAIN_URL=https://developer.arm.com/-/media/Files/downloads/gnu-a/10.3-2021.07/binrel/gcc-arm-10.3-2021.07-x86_64-aarch64-none-elf.tar.xz
-
-    - name: Cache Toolchain
-      uses: actions/cache@v3
-      id: cache-toolchain
-      with:
-        path: ~/cache/
-        key: ${{ runner.os }}-21-11-02-${{ env.TOOLCHAIN_URL }}
-
-    - name: Install Toolchain
-      if: steps.cache-toolchain.outputs.cache-hit != 'true'
-      run: |
-        mkdir -p ~/cache/toolchain
-        wget --progress=dot:mega $TOOLCHAIN_URL -O toolchain.tar.gz
-        tar -C ~/cache/toolchain -xaf toolchain.tar.gz
-
-    - name: Set Toolchain Path
-      run: echo >> $GITHUB_PATH `echo ~/cache/toolchain/*/bin`
-
-    - name: Get Dependencies
-      run: python3 tools/get_dependencies.py ${{ matrix.family }}
-
-    - name: Build
-      run: python3 tools/build_family.py ${{ matrix.family }}
-
-    - name: Linker Map
-      run: |
-        pip install linkermap/
-        for ex in `ls -d examples/device/*/`; do \
-          find ${ex} -name *.map -print -quit | \
-          xargs -I % sh -c 'echo "::group::%"; linkermap -v %; echo "::endgroup::"'; \
-        done
diff --git a/.github/workflows/build_arm.yml b/.github/workflows/build_arm.yml
deleted file mode 100644
index 369048fc6..000000000
--- a/.github/workflows/build_arm.yml
+++ /dev/null
@@ -1,226 +0,0 @@
-name: Build ARM
-
-on:
-  pull_request:
-  push:
-  release:
-    types:
-      - created
-
-jobs:
-  # ---------------------------------------
-  # Unit testing with Ceedling
-  # ---------------------------------------
-  unit-test:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Setup Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: '2.7'
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Unit Tests
-      run: |
-        # Install Ceedling
-        gem install ceedling
-        cd test
-        ceedling test:all
-
-  # ---------------------------------------
-  # Build ARM family
-  # ---------------------------------------
-  build-arm:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        family:
-        # Alphabetical order
-        - 'broadcom_32bit'
-        - 'imxrt'
-        - 'lpc15'
-        - 'lpc18'
-        - 'lpc54'
-        - 'lpc55'
-        - 'mm32'
-        - 'msp432e4'
-        - 'nrf'
-        - 'rp2040'
-        - 'samd11'
-        - 'samd21'
-        - 'samd51'
-        - 'saml2x'
-        - 'stm32f0'
-        - 'stm32f1'
-        - 'stm32f4'
-        - 'stm32f7'
-        - 'stm32g4'
-        - 'stm32h7'
-        - 'stm32l4'
-        - 'stm32wb'
-        - 'tm4c123'
-        - 'xmc4000'
-    steps:
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.x'
-
-    - name: Install ARM GCC
-      uses: carlosperate/arm-none-eabi-gcc-action@v1
-      with:
-        release: '11.2-2022.02'
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Checkout common submodules in lib
-      run: git submodule update --init lib/FreeRTOS-Kernel lib/lwip lib/sct_neopixel
-
-    - name: Checkout hathach/linkermap
-      uses: actions/checkout@v3
-      with:
-         repository: hathach/linkermap
-         path: linkermap
-
-    - name: Checkout pico-sdk for rp2040
-      if: matrix.family == 'rp2040'
-      run: |
-        git clone --depth 1 -b develop https://github.com/raspberrypi/pico-sdk ~/pico-sdk
-        echo >> $GITHUB_ENV PICO_SDK_PATH=~/pico-sdk
-
-    - name: Get Dependencies
-      run: python3 tools/get_dependencies.py ${{ matrix.family }}
-
-    - name: Build
-      run: python3 tools/build_family.py ${{ matrix.family }}
-
-    - name: Linker Map
-      run: |
-        pip install linkermap/
-        # find -quit to only print linkermap of 1 board per example
-        for ex in `ls -d examples/*/*/`
-        do
-          find ${ex} -name *.map -print -quit | xargs -I % sh -c 'echo "::group::%"; linkermap -v %; echo "::endgroup::"'
-        done
-
-    # Following steps are for Hardware Test with self-hosted
-
-    - name: Prepare Artifacts
-      if: matrix.family == 'rp2040' && github.repository_owner == 'hathach'
-      run: find examples/ -name "*.elf" -exec mv {} . \;
-
-    - name: Upload Artifacts for Hardware Test
-      if: matrix.family == 'rp2040' && github.repository_owner == 'hathach'
-      uses: actions/upload-artifact@v3
-      with:
-        name: ${{ matrix.family }}
-        path: |
-          *.elf
-
-  # ---------------------------------------
-  # Build all no-family (orphaned) boards
-  # disable this workflow since it is often failed randomly
-  # ---------------------------------------
-  build-board:
-    runs-on: ubuntu-latest
-    if: false
-    strategy:
-      fail-fast: false
-      matrix:
-        example:
-        # Alphabetical order, a group of 4
-        - 'device/audio_test device/board_test device/cdc_dual_ports device/cdc_msc'
-        - 'device/cdc_msc_freertos device/dfu_runtime device/hid_composite device/hid_composite_freertos'
-        - 'device/hid_generic_inout device/hid_multiple_interface device/midi_test device/msc_dual_lun'
-        - 'device/net_lwip_webserver'
-        - 'device/uac2_headset device/usbtmc device/webusb_serial host/cdc_msc_hid'
-
-    steps:
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.x'
-
-    - name: Install ARM GCC
-      uses: carlosperate/arm-none-eabi-gcc-action@v1
-      with:
-        release: '11.2-2022.02'
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Checkout common submodules in lib
-      run: git submodule update --init lib/FreeRTOS-Kernel lib/lwip
-
-    - name: Build
-      run: python3 tools/build_board.py ${{ matrix.example }}
-
-  # ---------------------------------------
-  # Hardware in the loop (HIL)
-  # Current self-hosted instance is running on an RPI4 with
-  # - pico + pico-probe connected via USB
-  # - pico-probe is /dev/ttyACM0
-  # ---------------------------------------
-  hw-rp2040-test:
-    # Limit the run to only hathach due to limited resource on RPI4
-    if: github.repository_owner == 'hathach'
-    needs: build-arm
-    runs-on: [self-hosted, Linux, ARM64, rp2040]
-
-    steps:
-    - name: Clean workspace
-      run: |
-        echo "Cleaning up previous run"
-        rm -rf "${{ github.workspace }}"
-        mkdir -p "${{ github.workspace }}"
-
-    - name: Download rp2040 Artifacts
-      uses: actions/download-artifact@v3
-      with:
-        name: rp2040
-
-    - name: Create flash.sh
-      run: |
-        echo > flash.sh 'cmdout=$(openocd -f "interface/picoprobe.cfg" -f "target/rp2040.cfg" -c "program $1 reset exit")'
-        echo >> flash.sh 'if (( $? )) ; then echo $cmdout ; fi'
-        chmod +x flash.sh
-
-    - name: Test cdc_dual_ports
-      run: |
-        ./flash.sh cdc_dual_ports.elf
-        while (! ([ -e /dev/ttyACM1 ] && [ -e /dev/ttyACM2 ])) && [ $SECONDS -le 5 ]; do :; done
-        test -e /dev/ttyACM1 && echo "ttyACM1 exists"
-        test -e /dev/ttyACM2 && echo "ttyACM2 exists"
-
-    - name: Test cdc_msc
-      run: |
-        ./flash.sh cdc_msc.elf
-        readme='/media/pi/TinyUSB MSC/README.TXT'
-        while (! ([ -e /dev/ttyACM1 ] && [ -f "$readme" ])) && [ $SECONDS -le 5 ]; do :; done
-        test -e /dev/ttyACM1 && echo "ttyACM1 exists"
-        test -f "$readme" && echo "$readme exists"
-        cat "$readme"
-
-    - name: Test dfu
-      run: |
-        ./flash.sh dfu.elf
-        while (! (dfu-util -l | grep "Found DFU")) && [ $SECONDS -le 5 ]; do :; done
-        dfu-util -d cafe -a 0 -U dfu0
-        dfu-util -d cafe -a 1 -U dfu1
-        grep "TinyUSB DFU! - Partition 0" dfu0
-        grep "TinyUSB DFU! - Partition 1" dfu1
-
-    - name: Test dfu_runtime
-      run: |
-        ./flash.sh dfu_runtime.elf
-        while (! (dfu-util -l | grep "Found Runtime")) && [ $SECONDS -le 5 ]; do :; done
-
-#    - name: Test hid_boot_interface
-#      run: |
-#        ./flash.sh hid_boot_interface.elf
-#        while (! (dfu-util -l | grep "Found Runtime")) && [ $SECONDS -le 5 ]; do :; done
-
diff --git a/.github/workflows/build_esp.yml b/.github/workflows/build_esp.yml
deleted file mode 100644
index 51d91de49..000000000
--- a/.github/workflows/build_esp.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: Build ESP
-
-on:
-  pull_request:
-  push:
-  release:
-    types:
-      - created
-
-jobs:
-  build-esp:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        board:
-        # Alphabetical order
-        # ESP32-S2
-        - 'espressif_saola_1'
-        # ESP32-S3
-        #- 'espressif_s3_devkitm'
-        # S3 compile error with "dangerous relocation: call8: call target out of range: memcpy"
-
-    steps:
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.x'
-
-    - name: Pull ESP-IDF docker
-      run: docker pull espressif/idf:latest
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Checkout hathach/linkermap
-      uses: actions/checkout@v3
-      with:
-         repository: hathach/linkermap
-         path: linkermap
-
-    - name: Build
-      run: docker run --rm -v $PWD:/project -w /project espressif/idf:latest python3 tools/build_esp32sx.py ${{ matrix.board }}
-
-    - name: Linker Map
-      run: |
-        pip install linkermap/
-        # find -quit to only print linkermap of 1 board per example
-        for ex in `ls -d examples/device/*/`
-        do
-          find ${ex} -maxdepth 3 -name *.map -print -quit | xargs -I % sh -c 'echo "::group::%"; linkermap -v %; echo "::endgroup::"'
-        done
diff --git a/.github/workflows/build_msp430.yml b/.github/workflows/build_msp430.yml
deleted file mode 100644
index 1ef25a6a0..000000000
--- a/.github/workflows/build_msp430.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Build MSP430
-
-on:
-  pull_request:
-  push:
-  release:
-    types:
-      - created
-
-jobs:  
-  build-msp430:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        family:
-        # Alphabetical order
-        - 'msp430'
-
-    steps:
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.x'
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Checkout common submodules in lib
-      run: git submodule update --init lib/FreeRTOS-Kernel lib/lwip
-
-    - name: Checkout hathach/linkermap
-      uses: actions/checkout@v3
-      with:
-         repository: hathach/linkermap
-         path: linkermap
-
-    - name: Set Toolchain URL
-      run: echo >> $GITHUB_ENV TOOLCHAIN_URL=http://software-dl.ti.com/msp430/msp430_public_sw/mcu/msp430/MSPGCC/9_2_0_0/export/msp430-gcc-9.2.0.50_linux64.tar.bz2
-
-    - name: Cache Toolchain
-      uses: actions/cache@v3
-      id: cache-toolchain
-      with:
-        path: ~/cache/
-        key: ${{ runner.os }}-21-03-04-${{ env.TOOLCHAIN_URL }}
-
-    - name: Install Toolchain
-      if: steps.cache-toolchain.outputs.cache-hit != 'true'
-      run: |
-        mkdir -p ~/cache/toolchain
-        wget --progress=dot:mega $TOOLCHAIN_URL -O toolchain.tar.bz2
-        tar -C ~/cache/toolchain -xaf toolchain.tar.bz2
-
-    - name: Set Toolchain Path
-      run: echo >> $GITHUB_PATH `echo ~/cache/toolchain/*/bin`
-
-    - name: Get Dependencies
-      run: python3 tools/get_dependencies.py ${{ matrix.family }}
-
-    - name: Build
-      run: python3 tools/build_family.py ${{ matrix.family }}
-
-    - name: Linker Map
-      run: |
-        pip install linkermap/
-        # find -quit to only print linkermap of 1 board per example
-        for ex in `ls -d examples/device/*/`
-        do
-          find ${ex} -name *.map -print -quit | xargs -I % sh -c 'echo "::group::%"; linkermap -v %; echo "::endgroup::"'
-        done
diff --git a/.github/workflows/build_renesas.yml b/.github/workflows/build_renesas.yml
deleted file mode 100644
index 2e272c832..000000000
--- a/.github/workflows/build_renesas.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Build Renesas
-
-on:
-  pull_request:
-  push:
-  release:
-    types:
-      - created
-
-jobs:
-  build-rx:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        family:
-        # Alphabetical order
-        - 'rx'
-    steps:
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.x'
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Checkout common submodules in lib
-      run: git submodule update --init lib/FreeRTOS-Kernel lib/lwip
-
-    - name: Checkout hathach/linkermap
-      uses: actions/checkout@v3
-      with:
-         repository: hathach/linkermap
-         path: linkermap
-
-    - name: Set Toolchain URL
-      run: echo >> $GITHUB_ENV TOOLCHAIN_URL=http://gcc-renesas.com/downloads/get.php?f=rx/8.3.0.202004-gnurx/gcc-8.3.0.202004-GNURX-ELF.run
-
-    - name: Cache Toolchain
-      uses: actions/cache@v3
-      id: cache-toolchain
-      with:
-        path: ~/cache/
-        key: ${{ runner.os }}-21-03-30-${{ env.TOOLCHAIN_URL }}
-
-    - name: Install Toolchain
-      if: steps.cache-toolchain.outputs.cache-hit != 'true'
-      run: |
-        mkdir -p ~/cache/toolchain/gnurx
-        wget --progress=dot:mega $TOOLCHAIN_URL -O toolchain.run
-        chmod +x toolchain.run
-        ./toolchain.run -p ~/cache/toolchain/gnurx -y
-
-    - name: Set Toolchain Path
-      run: echo >> $GITHUB_PATH `echo ~/cache/toolchain/*/bin`
-
-    - name: Get Dependencies
-      run: python3 tools/get_dependencies.py ${{ matrix.family }}
-
-    - name: Build
-      run: python3 tools/build_family.py ${{ matrix.family }}
-
-    - name: Linker Map
-      run: |
-        pip install linkermap/
-        # find -quit to only print linkermap of 1 board per example
-        for ex in `ls -d examples/device/*/`
-        do
-          find ${ex} -name *.map -print -quit | xargs -I % sh -c 'echo "::group::%"; linkermap -v %; echo "::endgroup::"'
-        done
diff --git a/.github/workflows/build_riscv.yml b/.github/workflows/build_riscv.yml
deleted file mode 100644
index 61c1c60c5..000000000
--- a/.github/workflows/build_riscv.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Build RISC-V
-
-on:
-  pull_request:
-  push:
-  release:
-    types:
-      - created
-
-jobs:
-  build-riscv:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        family:
-        # Alphabetical order
-        - 'fomu'
-        - 'gd32vf103'
-    steps:
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.x'
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Checkout common submodules in lib
-      run: git submodule update --init lib/FreeRTOS-Kernel lib/lwip
-
-    - name: Checkout hathach/linkermap
-      uses: actions/checkout@v3
-      with:
-         repository: hathach/linkermap
-         path: linkermap
-
-    - name: Set Toolchain URL
-      run: echo >> $GITHUB_ENV TOOLCHAIN_URL=https://github.com/xpack-dev-tools/riscv-none-embed-gcc-xpack/releases/download/v10.1.0-1.1/xpack-riscv-none-embed-gcc-10.1.0-1.1-linux-x64.tar.gz
-
-    - name: Cache Toolchain
-      uses: actions/cache@v3
-      id: cache-toolchain
-      with:
-        path: ~/cache/
-        key: ${{ runner.os }}-21-03-04-${{ env.TOOLCHAIN_URL }}
-
-    - name: Install Toolchain
-      if: steps.cache-toolchain.outputs.cache-hit != 'true'
-      run: |
-        mkdir -p ~/cache/toolchain
-        wget --progress=dot:mega $TOOLCHAIN_URL -O toolchain.tar.gz
-        tar -C ~/cache/toolchain -xaf toolchain.tar.gz
-
-    - name: Set Toolchain Path
-      run: echo >> $GITHUB_PATH `echo ~/cache/toolchain/*/bin`
-
-    - name: Get Dependencies
-      run: python3 tools/get_dependencies.py ${{ matrix.family }}
-
-    - name: Build
-      run: python3 tools/build_family.py ${{ matrix.family }}
-
-    - name: Linker Map
-      run: |
-        pip install linkermap/
-        # find -quit to only print linkermap of 1 board per example
-        for ex in `ls -d examples/device/*/`
-        do
-          find ${ex} -name *.map -print -quit | xargs -I % sh -c 'echo "::group::%"; linkermap -v %; echo "::endgroup::"'
-        done
diff --git a/.github/workflows/build_util.yml b/.github/workflows/build_util.yml
new file mode 100644
index 000000000..2de68c6f3
--- /dev/null
+++ b/.github/workflows/build_util.yml
@@ -0,0 +1,81 @@
+name: Reusable build util
+
+on:
+  workflow_call:
+    inputs:
+      build-system:
+        required: true
+        type: string
+      toolchain:
+        required: true
+        type: string
+      build-args:
+        required: true
+        type: string
+      one-per-family:
+        required: false
+        default: false
+        type: boolean
+      upload-artifacts:
+        required: false
+        default: false
+        type: boolean
+      os:
+        required: false
+        type: string
+        default: 'ubuntu-latest'
+
+jobs:
+  family:
+    runs-on: ${{ inputs.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        arg: ${{ fromJSON(inputs.build-args) }}
+    steps:
+      - name: Checkout TinyUSB
+        uses: actions/checkout@v4
+
+      - name: Setup Toolchain
+        id: setup-toolchain
+        uses: ./.github/actions/setup_toolchain
+        with:
+          toolchain: ${{ inputs.toolchain }}
+
+      - name: Get Dependencies
+        uses: ./.github/actions/get_deps
+        with:
+          arg: ${{ matrix.arg }}
+
+      - name: Set build one-per-family option
+        id: set-one-per-family
+        run: |
+          if [[ "${{ inputs.one-per-family }}" == "true" ]]; then
+            BUILD_OPTION="--one-per-family"
+          fi
+          echo "build_option=$BUILD_OPTION"
+          echo "build_option=$BUILD_OPTION" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Build
+        run: |
+          if [ "${{ inputs.toolchain }}" == "esp-idf" ]; then
+            docker run --rm -v $PWD:/project -w /project espressif/idf:tinyusb python tools/build.py ${{ matrix.arg }}
+          else
+            python tools/build.py -s ${{ inputs.build-system }} ${{ steps.setup-toolchain.outputs.build_option }} ${{ steps.set-one-per-family.outputs.build_option }} ${{ matrix.arg }}
+          fi
+        shell: bash
+
+      - name: Upload Artifacts for Hardware Testing
+        if: ${{ inputs.upload-artifacts }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.arg }}
+          path: |
+            cmake-build/cmake-build-*/*/*/*.elf
+            cmake-build/cmake-build-*/*/*/*.bin
+            cmake-build/cmake-build-*/*/*/*.bin
+            cmake-build/cmake-build-*/*/*/bootloader/bootloader.bin
+            cmake-build/cmake-build-*/*/*/partition_table/partition-table.bin
+            cmake-build/cmake-build-*/*/*/config.env
+            cmake-build/cmake-build-*/*/*/flash_args
diff --git a/.github/workflows/ci_set_matrix.py b/.github/workflows/ci_set_matrix.py
new file mode 100755
index 000000000..410508246
--- /dev/null
+++ b/.github/workflows/ci_set_matrix.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+import json
+
+# toolchain, url
+toolchain_list = [
+    "aarch64-gcc",
+    "arm-clang",
+    "arm-iar",
+    "arm-gcc",
+    "esp-idf",
+    "msp430-gcc",
+    "riscv-gcc",
+    "rx-gcc"
+]
+
+# family: [supported toolchain]
+family_list = {
+    "broadcom_32bit": ["arm-gcc"],
+    "broadcom_64bit": ["aarch64-gcc"],
+    "ch32v10x ch32v20x ch32v307 fomu gd32vf103": ["riscv-gcc"],
+    "da1469x": ["arm-gcc"],
+    "imxrt": ["arm-gcc", "arm-clang"],
+    "kinetis_k kinetis_kl kinetis_k32l2": ["arm-gcc", "arm-clang"],
+    "lpc11 lpc13 lpc15": ["arm-gcc", "arm-clang"],
+    "lpc17 lpc18 lpc40 lpc43": ["arm-gcc", "arm-clang"],
+    "lpc51 lpc54 lpc55": ["arm-gcc", "arm-clang"],
+    "max32650 max32666 max32690 max78002": ["arm-gcc"],
+    "mcx": ["arm-gcc"],
+    "mm32": ["arm-gcc"],
+    "msp430": ["msp430-gcc"],
+    "msp432e4 tm4c": ["arm-gcc"],
+    "nrf": ["arm-gcc", "arm-clang"],
+    "ra": ["arm-gcc"],
+    "rp2040": ["arm-gcc"],
+    "rx": ["rx-gcc"],
+    "samd11 saml2x": ["arm-gcc", "arm-clang"],
+    "samd21": ["arm-gcc", "arm-clang"],
+    "samd5x_e5x samg": ["arm-gcc", "arm-clang"],
+    "stm32c0 stm32f0 stm32f1 stm32f2 stm32f3": ["arm-gcc", "arm-clang", "arm-iar"],
+    "stm32f4": ["arm-gcc", "arm-clang", "arm-iar"],
+    "stm32f7": ["arm-gcc", "arm-clang", "arm-iar"],
+    "stm32g0 stm32g4 stm32h5": ["arm-gcc", "arm-clang", "arm-iar"],
+    "stm32h7": ["arm-gcc", "arm-clang", "arm-iar"],
+    "stm32l0 stm32l4": ["arm-gcc", "arm-clang", "arm-iar"],
+    "stm32u5 stm32wb": ["arm-gcc", "arm-clang", "arm-iar"],
+    "xmc4000": ["arm-gcc"],
+    "-bespressif_kaluga_1": ["esp-idf"],
+    "-bespressif_s3_devkitm": ["esp-idf"],
+    "-bespressif_p4_function_ev": ["esp-idf"],
+}
+
+
+def set_matrix_json():
+    matrix = {}
+    for toolchain in toolchain_list:
+        filtered_families = [family for family, supported_toolchain in family_list.items() if
+                             toolchain in supported_toolchain]
+        matrix[toolchain] = filtered_families
+
+    print(json.dumps(matrix))
+
+
+if __name__ == '__main__':
+    set_matrix_json()
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
new file mode 100644
index 000000000..d7f1fc066
--- /dev/null
+++ b/.github/workflows/cifuzz.yml
@@ -0,0 +1,36 @@
+name: CIFuzz
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '**.c'
+      - '**.cc'
+      - '**.cpp'
+      - '**.cxx'
+      - '**.h'
+jobs:
+ Fuzzing:
+   runs-on: ubuntu-latest
+   steps:
+   - name: Build Fuzzers
+     id: build
+     uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+     with:
+       oss-fuzz-project-name: 'tinyusb'
+       language: c++
+
+   - name: Run Fuzzers
+     uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+     with:
+       oss-fuzz-project-name: 'tinyusb'
+       language: c++
+       fuzz-seconds: 400
+
+   - name: Upload Crash
+     uses: actions/upload-artifact@v4
+     if: failure() && steps.build.outcome == 'success'
+     with:
+       name: artifacts
+       path: ./out/artifacts
diff --git a/.github/workflows/codeql-buildscript.sh b/.github/workflows/codeql-buildscript.sh
new file mode 100644
index 000000000..272b55d22
--- /dev/null
+++ b/.github/workflows/codeql-buildscript.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+FAMILY=stm32l4
+pip install click
+python3 tools/get_deps.py $FAMILY
+python3 tools/build.py -s make $FAMILY
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 000000000..be4c2dd87
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,137 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ 'master' ]
+    paths:
+      - 'src/**'
+      - 'examples/**'
+      - 'lib/**'
+      - 'hw/**'
+      - '.github/workflows/codeql.yml'
+  pull_request:
+    branches: [ 'master' ]
+    paths:
+      - 'src/**'
+      - 'examples/**'
+      - 'lib/**'
+      - 'hw/**'
+      - '.github/workflows/codeql.yml'
+  schedule:
+    - cron: '0 0 * * *'
+
+jobs:
+  analyze:
+    name: Analyze
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners
+    # Consider using larger runners for possible analysis time improvements.
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'c-cpp' ]
+        # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
+        # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Setup Toolchain
+      uses: ./.github/actions/setup_toolchain
+      with:
+        toolchain: 'arm-gcc'
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+        queries: security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    #- name: Autobuild
+    #  uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    - run: |
+        ./.github/workflows/codeql-buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"
+        upload: false
+      id: step1
+
+    # Filter out rules with low severity or high false positive rate
+    # Also filter out warnings in third-party code
+    - name: Filter out unwanted errors and warnings
+      uses: advanced-security/filter-sarif@v1
+      with:
+        patterns: |
+          -**:cpp/path-injection
+          -**:cpp/world-writable-file-creation
+          -**:cpp/poorly-documented-function
+          -**:cpp/potentially-dangerous-function
+          -**:cpp/use-of-goto
+          -**:cpp/integer-multiplication-cast-to-long
+          -**:cpp/comparison-with-wider-type
+          -**:cpp/leap-year/*
+          -**:cpp/ambiguously-signed-bit-field
+          -**:cpp/suspicious-pointer-scaling
+          -**:cpp/suspicious-pointer-scaling-void
+          -**:cpp/unsigned-comparison-zero
+          -**/third*party/**
+          -**/3rd*party/**
+          -**/external/**
+        input: ${{ steps.step1.outputs.sarif-output }}/cpp.sarif
+        output: ${{ steps.step1.outputs.sarif-output }}/cpp.sarif
+
+    - name: Upload SARIF
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: ${{ steps.step1.outputs.sarif-output }}
+        category: "/language:${{matrix.language}}"
+
+    - name: Archive CodeQL results
+      uses: actions/upload-artifact@v4
+      with:
+        name: codeql-results
+        path: ${{ steps.step1.outputs.sarif-output }}
+        retention-days: 5
diff --git a/.github/workflows/fail_on_error.py b/.github/workflows/fail_on_error.py
new file mode 100755
index 000000000..29791742b
--- /dev/null
+++ b/.github/workflows/fail_on_error.py
@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+
+import json
+import sys
+
+# Return whether SARIF file contains error-level results
+def codeql_sarif_contain_error(filename):
+    with open(filename, 'r') as f:
+        s = json.load(f)
+
+    for run in s.get('runs', []):
+        rules_metadata = run['tool']['driver']['rules']
+        if not rules_metadata:
+            rules_metadata = run['tool']['extensions'][0]['rules']
+
+        for res in run.get('results', []):
+            if 'ruleIndex' in res:
+                rule_index = res['ruleIndex']
+            elif 'rule' in res and 'index' in res['rule']:
+                rule_index = res['rule']['index']
+            else:
+                continue
+            try:
+                rule_level = rules_metadata[rule_index]['defaultConfiguration']['level']
+            except IndexError as e:
+                print(e, rule_index, len(rules_metadata))
+            else:
+                if rule_level == 'error':
+                    return True
+    return False
+
+if __name__ == "__main__":
+    if codeql_sarif_contain_error(sys.argv[1]):
+        sys.exit(1)
diff --git a/.github/workflows/hil_test.yml b/.github/workflows/hil_test.yml
new file mode 100644
index 000000000..c890933ec
--- /dev/null
+++ b/.github/workflows/hil_test.yml
@@ -0,0 +1,130 @@
+name: Hardware Test
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'examples/**'
+      - 'lib/**'
+      - 'hw/**'
+      - 'test/hil/**'
+      - 'tools/get_deps.py'
+      - '.github/actions/**'
+      - '.github/workflows/hil_test.yml'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  HIL_JSON: test/hil/tinyusb.json
+
+jobs:
+  set-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      json: ${{ steps.set-matrix-json.outputs.matrix }}
+    steps:
+      - name: Checkout TinyUSB
+        uses: actions/checkout@v4
+
+      - name: Generate matrix json
+        id: set-matrix-json
+        run: |
+          MATRIX_JSON=$(python test/hil/hil_ci_set_matrix.py ${{ env.HIL_JSON }})
+          echo "matrix=$MATRIX_JSON"
+          echo "matrix=$MATRIX_JSON" >> $GITHUB_OUTPUT
+
+  # ---------------------------------------
+  # Build arm-gcc
+  # ---------------------------------------
+  build:
+    if: github.repository_owner == 'hathach'
+    needs: set-matrix
+    uses: ./.github/workflows/build_util.yml
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain:
+          - 'arm-gcc'
+          - 'esp-idf'
+    with:
+      build-system: 'cmake'
+      toolchain: ${{ matrix.toolchain }}
+      build-args: ${{ toJSON(fromJSON(needs.set-matrix.outputs.json)[matrix.toolchain]) }}
+      one-per-family: true
+      upload-artifacts: true
+
+  # ---------------------------------------
+  # Hardware in the loop (HIL)
+  # self-hosted on local VM, for attached hardware checkout HIL_JSON
+  # ---------------------------------------
+  hil-tinyusb:
+    if: github.repository_owner == 'hathach'
+    needs: build
+    runs-on: [self-hosted, X64, hathach, hardware-in-the-loop]
+    steps:
+      - name: Clean workspace
+        run: |
+          echo "Cleaning up previous run"
+          rm -rf "${{ github.workspace }}"
+          mkdir -p "${{ github.workspace }}"
+
+      - name: Checkout TinyUSB
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: test/hil
+
+      - name: Download Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: cmake-build
+          merge-multiple: true
+
+      - name: Test on actual hardware
+        run: |
+          ls cmake-build/
+          python3 test/hil/hil_test.py ${{ env.HIL_JSON }}
+
+  # ---------------------------------------
+  # Hardware in the loop (HIL)
+  # self-hosted by HFP, build with IAR toolchain, for attached hardware checkout test/hil/hfp.json
+  # Since IAR Token secret is not passed to forked PR, only build on PR from the same repo
+  # ---------------------------------------
+  hil-hfp:
+    if: github.repository_owner == 'hathach' && github.event.pull_request.head.repo.fork == false
+    runs-on: [self-hosted, Linux, X64, hifiphile]
+    env:
+      IAR_LMS_CLOUD_URL: ${{ vars.IAR_LMS_CLOUD_URL }}
+      IAR_LMS_BEARER_TOKEN: ${{ secrets.IAR_LMS_BEARER_TOKEN }}
+    steps:
+      - name: Clean workspace
+        run: |
+          echo "Cleaning up previous run"
+          rm -rf "${{ github.workspace }}"
+          mkdir -p "${{ github.workspace }}"
+
+      - name: Toolchain version
+        run: |
+          echo IAR_LMS_CLOUD_URL=$IAR_LMS_CLOUD_URL
+          iccarm --version
+
+      - name: Checkout TinyUSB
+        uses: actions/checkout@v4
+
+      - name: Get build boards
+        run: |
+          MATRIX_JSON=$(python test/hil/hil_ci_set_matrix.py test/hil/hfp.json)
+          BUILD_ARGS=$(echo $MATRIX_JSON | jq -r '.["arm-gcc"] | join(" ")')
+          echo "BUILD_ARGS=$BUILD_ARGS"
+          echo "BUILD_ARGS=$BUILD_ARGS" >> $GITHUB_ENV
+
+      - name: Get Dependencies
+        run: python3 tools/get_deps.py $BUILD_ARGS
+
+      - name: Build
+        run: python3 tools/build.py --toolchain iar $BUILD_ARGS
+
+      - name: Test on actual hardware (hardware in the loop)
+        run: python3 test/hil/hil_test.py hfp.json
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
new file mode 100644
index 000000000..c3cc59d0d
--- /dev/null
+++ b/.github/workflows/labeler.yml
@@ -0,0 +1,73 @@
+name: Labeler
+
+on:
+  issues:
+    types: [opened]
+  pull_request_target:
+    types: [opened]
+
+jobs:
+  label-priority:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Label New Issue or PR
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            let label = '';
+            let username = '';
+            let issueOrPrNumber = 0;
+
+            if (context.eventName === 'issues') {
+              username = context.payload.issue.user.login;
+              issueOrPrNumber = context.payload.issue.number;
+            } else if (context.eventName === 'pull_request_target') {
+              username = context.payload.pull_request.user.login;
+              issueOrPrNumber = context.payload.pull_request.number;
+            }
+
+            // Check if an Adafruit member
+            try {
+              const adafruitResponse = await github.rest.orgs.checkMembershipForUser({
+                org: 'adafruit',
+                username: username
+              });
+
+              if (adafruitResponse.status === 204) {
+                console.log('Adafruit Member');
+                label = 'Prio Urgent';
+              }
+            } catch (error) {
+              console.log('Not an Adafruit member');
+            }
+
+            // Check if a contributor
+            if (label == '') {
+              try {
+                const collaboratorResponse = await github.rest.repos.checkCollaborator({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  username: username
+                });
+
+                if (collaboratorResponse.status === 204) {
+                  console.log('Contributor');
+                  label = 'Prio Higher';
+                }
+              } catch (error) {
+                console.log('Not a contributor');
+              }
+            }
+
+            if (label !== '') {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issueOrPrNumber,
+                labels: [label]
+              });
+            }
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
new file mode 100644
index 000000000..ed0efd66e
--- /dev/null
+++ b/.github/workflows/pre-commit.yml
@@ -0,0 +1,45 @@
+name: pre-commit
+
+on:
+  workflow_dispatch:
+  push:
+  pull_request:
+    branches: [ master ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Setup Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: '3.0'
+
+    - name: Checkout TinyUSB
+      uses: actions/checkout@v4
+
+    - name: Get Dependencies
+      run: |
+        gem install ceedling
+        #cd test/unit-test
+        #ceedling test:all
+
+    - name: Run pre-commit
+      uses: pre-commit/[email protected]
+
+    - name: Build Fuzzer
+      run: |
+        sudo apt install libc++-dev libc++abi-dev
+        clang --version
+        export CC=clang
+        export CXX=clang++
+        fuzz_harness=$(ls -d test/fuzz/device/*/)
+        for h in $fuzz_harness
+        do
+          make -C $h get-deps
+          make -C $h all
+        done
diff --git a/.github/workflows/test_hardware.yml b/.github/workflows/test_hardware.yml
deleted file mode 100644
index 3ef1fdc56..000000000
--- a/.github/workflows/test_hardware.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-name: Hardware Test
-on:
-  pull_request:
-  push:
-  release:
-    types:
-      - created
-
-# Hardware in the loop (HIL)
-# Current self-hosted instance is running on an EPYC 7232 server hosted by HiFiPhile user
-# - STM32L412 Nucleo with on-board jlink as ttyACM0
-
-jobs:
-  stm32l412nucleo-test:
-    runs-on: [self-hosted, Linux, X64, hifiphile]
-
-    steps:
-    - name: Clean workspace
-      run: |
-        echo "Cleaning up previous run"
-        rm -rf "${{ github.workspace }}"
-        mkdir -p "${{ github.workspace }}"
-
-    - name: Checkout TinyUSB
-      uses: actions/checkout@v3
-
-    - name: Get Dependencies and Build
-      run: |
-        git submodule update --init lib/FreeRTOS-Kernel lib/lwip
-        python3 tools/get_dependencies.py stm32l4
-        python3 tools/build_family.py stm32l4
-
-    - name: Pick-up elf files
-      run: |
-        mkdir stm32l412nucleo/
-        find examples/ -path "*stm32l412nucleo/*.elf" -exec mv {} stm32l412nucleo/ \;
-
-    - name: Create flash.sh
-      run: |
-        echo > flash.sh 'echo halt > flash.jlink'
-        echo >> flash.sh 'echo r >> flash.jlink'
-        echo >> flash.sh 'echo loadfile stm32l412nucleo/$1 >> flash.jlink'
-        echo >> flash.sh 'echo r >> flash.jlink'
-        echo >> flash.sh 'echo go >> flash.jlink'
-        echo >> flash.sh 'echo exit >> flash.jlink'
-        echo >> flash.sh 'cmdout=$(JLinkExe -device stm32l412kb -if swd -JTAGConf -1,-1 -speed auto -NoGui 1 -ExitOnError 1 -CommandFile flash.jlink)'
-        echo >> flash.sh 'if (( $? )) ; then echo $cmdout ; fi'
-        chmod +x flash.sh
-
-    - name: Test cdc_dual_ports
-      run: |
-        ./flash.sh cdc_dual_ports.elf
-        while (! ([ -e /dev/ttyACM1 ] && [ -e /dev/ttyACM2 ])) && [ $SECONDS -le 5 ]; do :; done
-        test -e /dev/ttyACM1 && echo "ttyACM1 exists"
-        test -e /dev/ttyACM2 && echo "ttyACM2 exists"
-
-      # Debian does not auto mount usb drive. skip this test for now
-    - name: Test cdc_msc
-      if: false
-      run: |
-        ./flash.sh cdc_msc.elf
-        readme='/media/pi/TinyUSB MSC/README.TXT'
-        while (! ([ -e /dev/ttyACM1 ] && [ -f "$readme" ])) && [ $SECONDS -le 5 ]; do :; done
-        test -e /dev/ttyACM1 && echo "ttyACM1 exists"
-        test -f "$readme" && echo "$readme exists"
-        cat "$readme"
-
-    - name: Test dfu
-      run: |
-        ./flash.sh dfu.elf
-        while (! (dfu-util -l | grep "Found DFU")) && [ $SECONDS -le 5 ]; do :; done
-        dfu-util -d cafe -a 0 -U dfu0
-        dfu-util -d cafe -a 1 -U dfu1
-        grep "TinyUSB DFU! - Partition 0" dfu0
-        grep "TinyUSB DFU! - Partition 1" dfu1
-
-    - name: Test dfu_runtime
-      run: |
-        ./flash.sh dfu_runtime.elf
-        while (! (dfu-util -l | grep "Found Runtime")) && [ $SECONDS -le 5 ]; do :; done
-
-#    - name: Test hid_boot_interface
-#      run: |
-#        ./flash.sh hid_boot_interface.elf
-#        while (! (dfu-util -l | grep "Found Runtime")) && [ $SECONDS -le 5 ]; do :; done
diff --git a/.github/workflows/trigger.yml b/.github/workflows/trigger.yml
index e434ca238..cf40ac955 100644
--- a/.github/workflows/trigger.yml
+++ b/.github/workflows/trigger.yml
@@ -1,6 +1,7 @@
 name: Trigger Repos
 
 on:
+  workflow_dispatch:
   push:
     branches: master
   release:
@@ -22,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Push to tinyusb_src
       run: |
@@ -43,7 +44,7 @@ jobs:
         if [ -n "$(git status --porcelain)" ]; then
           git add .
           git commit --message "Update from https://github.com/$GITHUB_REPOSITORY/commit/$GITHUB_SHA"
-          git push 
+          git push
         fi
 
     - name: Create tinyusb_src Release
@@ -53,8 +54,7 @@ jobs:
         cd tinyusb_src
         git tag ${{ github.event.release.tag_name }}
         git push origin ${{ github.event.release.tag_name }}
-        
+
         # Send POST reqwuest to release https://docs.github.com/en/rest/reference/repos#create-a-release
-        bb={{ github.event.release.body }}
-        bb=${bb//\n/\\\n}
+        bb="For release note, please checkout https://github.com/hathach/tinyusb/releases/tag/${{ github.event.release.tag_name }}"
         curl -X POST -H "Authorization: token ${{ secrets.API_TOKEN_GITHUB }}" -H "Accept: application/vnd.github.v3+json" --data '{"tag_name": "${{ github.event.release.tag_name }}", "name": "${{ github.event.release.name }}", "body": "$bb", "draft": ${{ github.event.release.draft }}, "prerelease": ${{ github.event.release.prerelease }}}' https://api.github.com/repos/hathach/tinyusb_src/releases