From d0d87d98f6d480ebf2b3b27d85a391780f0976f3 Mon Sep 17 00:00:00 2001 From: hathach Date: Fri, 1 Nov 2019 18:03:43 +0700 Subject: add assert to prevent div by zero --- src/class/msc/msc_device.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'src/class') diff --git a/src/class/msc/msc_device.c b/src/class/msc/msc_device.c index a77282ed5..115ca1432 100644 --- a/src/class/msc/msc_device.c +++ b/src/class/msc/msc_device.c @@ -583,10 +583,14 @@ static void proc_read10_cmd(uint8_t rhport, mscd_interface_t* p_msc) msc_cbw_t const * p_cbw = &p_msc->cbw; msc_csw_t * p_csw = &p_msc->csw; - uint16_t const block_sz = p_cbw->total_bytes / rdwr10_get_blockcount(p_cbw->command); + uint16_t const block_cnt = rdwr10_get_blockcount(p_cbw->command); + TU_ASSERT(block_cnt, ); // prevent div by zero + + uint16_t const block_sz = p_cbw->total_bytes / block_cnt; + TU_ASSERT(block_sz, ); // prevent div by zero // Adjust lba with transferred bytes - uint32_t const lba = rdwr10_get_lba(p_cbw->command) + (p_msc->xferred_len / block_sz); + uint32_t lba = rdwr10_get_lba(p_cbw->command) + (p_msc->xferred_len / block_sz); // remaining bytes capped at class buffer int32_t nbytes = (int32_t) tu_min32(sizeof(_mscd_buf), p_cbw->total_bytes-p_msc->xferred_len); -- cgit v1.3.1 From 79fbc0b23c9b83b7f8fdbc8a06d9a4e5d3690066 Mon Sep 17 00:00:00 2001 From: hathach Date: Fri, 1 Nov 2019 18:43:18 +0700 Subject: wait for scsi status complete before queueing for next scsi command fix #207 --- src/class/msc/msc_device.c | 45 +++++++++++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 18 deletions(-) (limited to 'src/class') diff --git a/src/class/msc/msc_device.c b/src/class/msc/msc_device.c index 115ca1432..88db1ffd8 100644 --- a/src/class/msc/msc_device.c +++ b/src/class/msc/msc_device.c @@ -533,7 +533,18 @@ bool mscd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t event, uint32_t } break; - case MSC_STAGE_STATUS: break; // processed immediately after this switch + case MSC_STAGE_STATUS: + // Wait for the command status wrapper complete event + if( (ep_addr == p_msc->ep_in) && (xferred_bytes == sizeof(msc_csw_t)) ) + { + // Move to default CMD stage + p_msc->stage = MSC_STAGE_CMD; + + // Queue for the next CBW + TU_ASSERT( usbd_edpt_xfer(rhport, p_msc->ep_out, (uint8_t*) &p_msc->cbw, sizeof(msc_cbw_t)) ); + } + break; + default : break; } @@ -543,32 +554,30 @@ bool mscd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t event, uint32_t if ( usbd_edpt_stalled(rhport, p_msc->ep_in) || usbd_edpt_stalled(rhport, p_msc->ep_out) ) { // simulate an transfer complete with adjusted parameters --> this driver callback will fired again + // and response with status phase after halted endpoints are cleared. + // note: use ep_out to prevent confusing with STATUS complete dcd_event_xfer_complete(rhport, p_msc->ep_out, 0, XFER_RESULT_SUCCESS, false); } else { - // Move to default CMD stage when sending status - p_msc->stage = MSC_STAGE_CMD; - // Send SCSI Status - TU_ASSERT( usbd_edpt_xfer(rhport, p_msc->ep_in , (uint8_t*) &p_msc->csw, sizeof(msc_csw_t)) ); + TU_ASSERT(usbd_edpt_xfer(rhport, p_msc->ep_in , (uint8_t*) &p_msc->csw, sizeof(msc_csw_t))); // Invoke complete callback if defined - if ( SCSI_CMD_READ_10 == p_cbw->command[0]) - { - if ( tud_msc_read10_complete_cb ) tud_msc_read10_complete_cb(p_cbw->lun); - } - else if ( SCSI_CMD_WRITE_10 == p_cbw->command[0] ) - { - if ( tud_msc_write10_complete_cb ) tud_msc_write10_complete_cb(p_cbw->lun); - } - else + switch(p_cbw->command[0]) { - if ( tud_msc_scsi_complete_cb ) tud_msc_scsi_complete_cb(p_cbw->lun, p_cbw->command); - } + case SCSI_CMD_READ_10: + if ( tud_msc_read10_complete_cb ) tud_msc_read10_complete_cb(p_cbw->lun); + break; + + case SCSI_CMD_WRITE_10: + if ( tud_msc_write10_complete_cb ) tud_msc_write10_complete_cb(p_cbw->lun); + break; - // Queue for the next CBW - TU_ASSERT( usbd_edpt_xfer(rhport, p_msc->ep_out, (uint8_t*) &p_msc->cbw, sizeof(msc_cbw_t)) ); + default: + if ( tud_msc_scsi_complete_cb ) tud_msc_scsi_complete_cb(p_cbw->lun, p_cbw->command); + break; + } } } -- cgit v1.3.1 From fc86a308f6435752c9a6413e9a9d92f17783acf9 Mon Sep 17 00:00:00 2001 From: hathach Date: Tue, 5 Nov 2019 11:45:02 +0700 Subject: clean up --- src/class/msc/msc_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/class') diff --git a/src/class/msc/msc_device.c b/src/class/msc/msc_device.c index 88db1ffd8..cec76b110 100644 --- a/src/class/msc/msc_device.c +++ b/src/class/msc/msc_device.c @@ -599,7 +599,7 @@ static void proc_read10_cmd(uint8_t rhport, mscd_interface_t* p_msc) TU_ASSERT(block_sz, ); // prevent div by zero // Adjust lba with transferred bytes - uint32_t lba = rdwr10_get_lba(p_cbw->command) + (p_msc->xferred_len / block_sz); + uint32_t const lba = rdwr10_get_lba(p_cbw->command) + (p_msc->xferred_len / block_sz); // remaining bytes capped at class buffer int32_t nbytes = (int32_t) tu_min32(sizeof(_mscd_buf), p_cbw->total_bytes-p_msc->xferred_len); -- cgit v1.3.1