From 3e5b79282a66a33a8cefc1f8584923819ff97eda Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Mar 2026 19:43:46 +0000
Subject: net: upgrade net_lwip_webserver to separate FS/HS descriptors and add
 bInterval to TUD_CDC_NCM_DESCRIPTOR

Co-authored-by: HiFiPhile <4375114+HiFiPhile@users.noreply.github.com>
Agent-Logs-Url: https://github.com/hathach/tinyusb/sessions/e212b526-e279-4a83-88bf-a742df293165
---
 src/device/usbd.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'src/device')

diff --git a/src/device/usbd.h b/src/device/usbd.h
index d3a6dccbb..93fb588df 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1026,9 +1026,9 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 // Length of template descriptor
 #define TUD_CDC_NCM_DESC_LEN  (8+9+5+5+13+6+7+9+9+7+7)
 
-// CDC-ECM Descriptor Template
-// Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size.
-#define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize) \
+// CDC-NCM Descriptor Template
+// Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), size, max segment size, EP notification bInterval.
+#define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize, _ep_notif_interval) \
   /* Interface Association */\
   8, TUSB_DESC_INTERFACE_ASSOCIATION, _itfnum, 2, TUSB_CLASS_CDC, CDC_COMM_SUBCLASS_NETWORK_CONTROL_MODEL, 0, 0,\
   /* CDC Control Interface */\
@@ -1042,7 +1042,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   /* CDC-NCM Functional Descriptor */\
   6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), 0, \
   /* Endpoint Notification */\
-  7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), 50,\
+  7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), _ep_notif_interval,\
   /* CDC Data Interface (default inactive) */\
   9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum)+1), 0, 0, TUSB_CLASS_CDC_DATA, 0, NCM_DATA_PROTOCOL_NETWORK_TRANSFER_BLOCK, 0,\
   /* CDC Data Interface (alternative active) */\
-- 
cgit v1.3.1


From 34aded88edd5b1403bb35b531985953502a0faab Mon Sep 17 00:00:00 2001
From: Fan DANG <i@dang.fan>
Date: Mon, 13 Apr 2026 08:56:36 +0800
Subject: fix(device): big-endian host support for SETUP packet handling

1. Add TU_LITTLE_ENDIAN_BITFIELD / TU_BIG_ENDIAN_BITFIELD macros in
tusb_compiler.h (GCC and IAR), following Linux kernel style.

2. Update bmAttributes (tusb_desc_endpoint_t) and bmRequestType_bit
(tusb_control_request_t) in tusb_types.h to use these macros with explicit
#error fallback if undefined.

3. Add tu_le16toh() conversion in dcd_event_setup_received() for
wValue/wIndex/wLength.

Tested on CIU98320B (big-endian ARM Cortex-M, full-speed HID keyboard).
---
 src/common/tusb_compiler.h |  4 ++++
 src/common/tusb_types.h    | 17 +++++++++++++++++
 src/device/dcd.h           |  5 +++++
 3 files changed, 26 insertions(+)

(limited to 'src/device')

diff --git a/src/common/tusb_compiler.h b/src/common/tusb_compiler.h
index f20834cea..e66bcc5ea 100644
--- a/src/common/tusb_compiler.h
+++ b/src/common/tusb_compiler.h
@@ -167,8 +167,10 @@
 // For TI ARM compiler, __BYTE_ORDER__ is not defined for MSP430 but still LE
   #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ || defined(__MSP430__)
     #define TU_BYTE_ORDER TU_LITTLE_ENDIAN
+    #define TU_LITTLE_ENDIAN_BITFIELD
   #else
     #define TU_BYTE_ORDER TU_BIG_ENDIAN
+    #define TU_BIG_ENDIAN_BITFIELD
   #endif
 
   // Unfortunately XC16 doesn't provide builtins for 32bit endian conversion
@@ -212,8 +214,10 @@
   // Endian conversion use well-known host to network (big endian) naming
   #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
     #define TU_BYTE_ORDER TU_LITTLE_ENDIAN
+    #define TU_LITTLE_ENDIAN_BITFIELD
   #else
     #define TU_BYTE_ORDER TU_BIG_ENDIAN
+    #define TU_BIG_ENDIAN_BITFIELD
   #endif
 
   #define TU_BSWAP16(u16) (__iar_builtin_REV16(u16))
diff --git a/src/common/tusb_types.h b/src/common/tusb_types.h
index a18f9feb7..b02e90eae 100644
--- a/src/common/tusb_types.h
+++ b/src/common/tusb_types.h
@@ -409,10 +409,19 @@ typedef struct TU_ATTR_PACKED {
   uint8_t  bEndpointAddress ; // The address of the endpoint
 
   struct TU_ATTR_PACKED {
+#if defined(TU_LITTLE_ENDIAN_BITFIELD)
     uint8_t xfer  : 2;        // Control, ISO, Bulk, Interrupt
     uint8_t sync  : 2;        // None, Asynchronous, Adaptive, Synchronous
     uint8_t usage : 2;        // Data, Feedback, Implicit feedback
     uint8_t       : 2;
+#elif defined(TU_BIG_ENDIAN_BITFIELD)
+    uint8_t       : 2;
+    uint8_t usage : 2;
+    uint8_t sync  : 2;
+    uint8_t xfer  : 2;
+#else
+  #error "Please define TU_LITTLE_ENDIAN_BITFIELD or TU_BIG_ENDIAN_BITFIELD"
+#endif
   } bmAttributes;
 
   uint16_t wMaxPacketSize   ; // Bit 10..0 : max packet size, bit 12..11 additional transaction per highspeed micro-frame
@@ -522,9 +531,17 @@ typedef struct TU_ATTR_PACKED {
 typedef struct TU_ATTR_PACKED {
   union {
     struct TU_ATTR_PACKED {
+#if defined(TU_LITTLE_ENDIAN_BITFIELD)
       uint8_t recipient :  5; ///< Recipient type tusb_request_recipient_t.
       uint8_t type      :  2; ///< Request type tusb_request_type_t.
       uint8_t direction :  1; ///< Direction type. tusb_dir_t
+#elif defined(TU_BIG_ENDIAN_BITFIELD)
+      uint8_t direction :  1; ///< Direction type. tusb_dir_t
+      uint8_t type      :  2; ///< Request type tusb_request_type_t.
+      uint8_t recipient :  5; ///< Recipient type tusb_request_recipient_t.
+#else
+  #error "Please define TU_LITTLE_ENDIAN_BITFIELD or TU_BIG_ENDIAN_BITFIELD"
+#endif
     } bmRequestType_bit;
 
     uint8_t bmRequestType;
diff --git a/src/device/dcd.h b/src/device/dcd.h
index 850c37bc2..f861eb258 100644
--- a/src/device/dcd.h
+++ b/src/device/dcd.h
@@ -219,6 +219,11 @@ TU_ATTR_ALWAYS_INLINE static inline void dcd_event_setup_received(uint8_t rhport
   event.rhport = rhport;
   event.event_id = DCD_EVENT_SETUP_RECEIVED;
   (void) memcpy(&event.setup_received, setup, sizeof(tusb_control_request_t));
+  // USB wire format is little-endian. Convert multi-byte fields to host byte order
+  // so the stack always sees correct values regardless of CPU endianness.
+  event.setup_received.wValue  = tu_le16toh(event.setup_received.wValue);
+  event.setup_received.wIndex  = tu_le16toh(event.setup_received.wIndex);
+  event.setup_received.wLength = tu_le16toh(event.setup_received.wLength);
   dcd_event_handler(&event, in_isr);
 }
 
-- 
cgit v1.3.1


From 5939831f17272571911d089508b458f496a4cc62 Mon Sep 17 00:00:00 2001
From: Fan DANG <i@dang.fan>
Date: Fri, 17 Apr 2026 18:39:56 +0800
Subject: remove duplicated tu_le16toh since we have converted the endian when
 setup.

---
 examples/device/audio_test_multi_rate/src/main.c | 2 +-
 examples/device/cdc_uac2/src/uac2_app.c          | 8 ++++----
 examples/device/uac2_headset/src/main.c          | 8 ++++----
 examples/device/uac2_speaker_fb/src/main.c       | 8 ++++----
 src/class/mtp/mtp_device.c                       | 2 +-
 src/common/tusb_compiler.h                       | 2 ++
 src/device/usbd.c                                | 2 +-
 7 files changed, 17 insertions(+), 15 deletions(-)

(limited to 'src/device')

diff --git a/examples/device/audio_test_multi_rate/src/main.c b/examples/device/audio_test_multi_rate/src/main.c
index 952176997..a86beb415 100644
--- a/examples/device/audio_test_multi_rate/src/main.c
+++ b/examples/device/audio_test_multi_rate/src/main.c
@@ -532,7 +532,7 @@ static bool audio20_get_req_entity(uint8_t rhport, tusb_control_request_t const
 bool tud_audio_set_itf_cb(uint8_t rhport, tusb_control_request_t const *p_request) {
   (void) rhport;
   //uint8_t const itf = tu_u16_low(tu_le16toh(p_request->wIndex));
-  uint8_t const alt = tu_u16_low(tu_le16toh(p_request->wValue));
+  uint8_t const alt = tu_u16_low(p_request->wValue);
 
   // Clear buffer when streaming format is changed
   if (alt != 0) {
diff --git a/examples/device/cdc_uac2/src/uac2_app.c b/examples/device/cdc_uac2/src/uac2_app.c
index 7760c402b..6e9d1d9e3 100644
--- a/examples/device/cdc_uac2/src/uac2_app.c
+++ b/examples/device/cdc_uac2/src/uac2_app.c
@@ -263,8 +263,8 @@ bool tud_audio_set_itf_close_ep_cb(uint8_t rhport, tusb_control_request_t const
 {
   (void)rhport;
 
-  uint8_t const itf = tu_u16_low(tu_le16toh(p_request->wIndex));
-  uint8_t const alt = tu_u16_low(tu_le16toh(p_request->wValue));
+  uint8_t const itf = tu_u16_low(p_request->wIndex);
+  uint8_t const alt = tu_u16_low(p_request->wValue);
 
   if (ITF_NUM_AUDIO_STREAMING_SPK == itf && alt == 0) {
     // Audio streaming stop
@@ -277,8 +277,8 @@ bool tud_audio_set_itf_close_ep_cb(uint8_t rhport, tusb_control_request_t const
 bool tud_audio_set_itf_cb(uint8_t rhport, tusb_control_request_t const * p_request)
 {
   (void)rhport;
-  uint8_t const itf = tu_u16_low(tu_le16toh(p_request->wIndex));
-  uint8_t const alt = tu_u16_low(tu_le16toh(p_request->wValue));
+  uint8_t const itf = tu_u16_low(p_request->wIndex);
+  uint8_t const alt = tu_u16_low(p_request->wValue);
 
   TU_LOG2("Set interface %d alt %d\r\n", itf, alt);
   if (ITF_NUM_AUDIO_STREAMING_SPK == itf && alt != 0) {
diff --git a/examples/device/uac2_headset/src/main.c b/examples/device/uac2_headset/src/main.c
index 0ea63d8f7..779e927bc 100644
--- a/examples/device/uac2_headset/src/main.c
+++ b/examples/device/uac2_headset/src/main.c
@@ -522,8 +522,8 @@ bool tud_audio_set_req_entity_cb(uint8_t rhport, tusb_control_request_t const *p
 bool tud_audio_set_itf_close_ep_cb(uint8_t rhport, tusb_control_request_t const *p_request) {
   (void) rhport;
 
-  uint8_t const itf = tu_u16_low(tu_le16toh(p_request->wIndex));
-  uint8_t const alt = tu_u16_low(tu_le16toh(p_request->wValue));
+  uint8_t const itf = tu_u16_low(p_request->wIndex);
+  uint8_t const alt = tu_u16_low(p_request->wValue);
 
   if (ITF_NUM_AUDIO_STREAMING_SPK == itf && alt == 0) {
     blink_interval_ms = BLINK_MOUNTED;
@@ -534,8 +534,8 @@ bool tud_audio_set_itf_close_ep_cb(uint8_t rhport, tusb_control_request_t const
 
 bool tud_audio_set_itf_cb(uint8_t rhport, tusb_control_request_t const *p_request) {
   (void) rhport;
-  uint8_t const itf = tu_u16_low(tu_le16toh(p_request->wIndex));
-  uint8_t const alt = tu_u16_low(tu_le16toh(p_request->wValue));
+  uint8_t const itf = tu_u16_low(p_request->wIndex);
+  uint8_t const alt = tu_u16_low(p_request->wValue);
 
   TU_LOG2("Set interface %d alt %d\r\n", itf, alt);
   if (ITF_NUM_AUDIO_STREAMING_SPK == itf && alt != 0) {
diff --git a/examples/device/uac2_speaker_fb/src/main.c b/examples/device/uac2_speaker_fb/src/main.c
index c3e97bb28..402642162 100644
--- a/examples/device/uac2_speaker_fb/src/main.c
+++ b/examples/device/uac2_speaker_fb/src/main.c
@@ -457,8 +457,8 @@ static bool audio20_set_req_entity(tusb_control_request_t const *p_request, uint
 
 bool tud_audio_set_itf_cb(uint8_t rhport, tusb_control_request_t const *p_request) {
   (void) rhport;
-  uint8_t const itf = tu_u16_low(tu_le16toh(p_request->wIndex));
-  uint8_t const alt = tu_u16_low(tu_le16toh(p_request->wValue));
+  uint8_t const itf = tu_u16_low(p_request->wIndex);
+  uint8_t const alt = tu_u16_low(p_request->wValue);
 
   TU_LOG2("Set interface %d alt %d\r\n", itf, alt);
   if (ITF_NUM_AUDIO_STREAMING == itf && alt != 0)
@@ -531,8 +531,8 @@ bool tud_audio_get_req_entity_cb(uint8_t rhport, tusb_control_request_t const *p
 bool tud_audio_set_itf_close_ep_cb(uint8_t rhport, tusb_control_request_t const *p_request) {
   (void) rhport;
 
-  uint8_t const itf = tu_u16_low(tu_le16toh(p_request->wIndex));
-  uint8_t const alt = tu_u16_low(tu_le16toh(p_request->wValue));
+  uint8_t const itf = tu_u16_low(p_request->wIndex);
+  uint8_t const alt = tu_u16_low(p_request->wValue);
 
   if (ITF_NUM_AUDIO_STREAMING == itf && alt == 0) {
     blink_interval_ms = BLINK_MOUNTED;
diff --git a/src/class/mtp/mtp_device.c b/src/class/mtp/mtp_device.c
index 59096e476..0da984f4a 100644
--- a/src/class/mtp/mtp_device.c
+++ b/src/class/mtp/mtp_device.c
@@ -321,7 +321,7 @@ bool mtpd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
     .session_id = p_mtp->session_id,
     .request = request,
     .buf = p_mtp->control_buf,
-    .bufsize = tu_le16toh(request->wLength),
+    .bufsize = request->wLength,
   };
 
   switch (request->bRequest) {
diff --git a/src/common/tusb_compiler.h b/src/common/tusb_compiler.h
index 4ed14dcfb..a8971c3df 100644
--- a/src/common/tusb_compiler.h
+++ b/src/common/tusb_compiler.h
@@ -246,8 +246,10 @@
   // Endian conversion use well-known host to network (big endian) naming
   #if defined(__LIT)
     #define TU_BYTE_ORDER TU_LITTLE_ENDIAN
+    #define TU_BITFIELD_ORDER TU_BITFIELD_LE
   #else
     #define TU_BYTE_ORDER TU_BIG_ENDIAN
+    #define TU_BITFIELD_ORDER TU_BITFIELD_BE
   #endif
 
   #define TU_BSWAP16(u16) ((unsigned short)_builtin_revw((unsigned long)u16))
diff --git a/src/device/usbd.c b/src/device/usbd.c
index 3c14175f6..da0ffb4c6 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -1212,7 +1212,7 @@ static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const
       TU_LOG_USBD(" String[%u]\r\n", desc_index);
 
       // String Descriptor always uses the desc set from user
-      uint8_t const* desc_str = (uint8_t const*) tud_descriptor_string_cb(desc_index, tu_le16toh(p_request->wIndex));
+      uint8_t const* desc_str = (uint8_t const*) tud_descriptor_string_cb(desc_index, p_request->wIndex);
       TU_VERIFY(desc_str);
 
       // first byte of descriptor is its size
-- 
cgit v1.3.1


From 8a63f9c57ee29bd34367c347663e86fe432a0a37 Mon Sep 17 00:00:00 2001
From: akari <akari@akari.tv>
Date: Fri, 24 Apr 2026 09:43:13 +0800
Subject: fix zero wLength request in control request

---
 src/device/usbd_control.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'src/device')

diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c
index 87593d4a7..1ec9b4649 100644
--- a/src/device/usbd_control.c
+++ b/src/device/usbd_control.c
@@ -73,6 +73,10 @@ uint8_t* usbd_get_ctrl_buf(void) {
 
 // Queue ZLP status transaction
 static inline bool status_stage_xact(uint8_t rhport, const tusb_control_request_t* request) {
+  // Always use EDPT_CTRL_IN when control request wLength is zero
+  if (request->wLength==0) {
+    return usbd_edpt_xfer(rhport, EDPT_CTRL_IN, NULL, 0, false);
+  }
   // Opposite to endpoint in Data Phase
   const uint8_t ep_addr = request->bmRequestType_bit.direction ? EDPT_CTRL_OUT : EDPT_CTRL_IN;
   return usbd_edpt_xfer(rhport, ep_addr, NULL, 0, false);
@@ -157,7 +161,9 @@ bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result,
   (void) result;
 
   // Endpoint Address is opposite to direction bit, this is Status Stage complete event
-  if (tu_edpt_dir(ep_addr) != _ctrl_xfer.request.bmRequestType_bit.direction) {
+  // Control request with zero wLength and IN direction also is Status Stage complete event
+  if ((tu_edpt_dir(ep_addr) != _ctrl_xfer.request.bmRequestType_bit.direction)||
+      (_ctrl_xfer.request.wLength==0&&_ctrl_xfer.request.bmRequestType_bit.direction==TUSB_DIR_IN)) {
     TU_ASSERT(0 == xferred_bytes);
 
     // invoke optional dcd hook if available
-- 
cgit v1.3.1


From 0649b18b2e8b2e76b38f6280796ba48a51882eac Mon Sep 17 00:00:00 2001
From: nminaylov <nm29719@gmail.com>
Date: Fri, 24 Apr 2026 22:39:02 +0300
Subject: NCM packet filter support

---
 src/class/net/ncm_device.c | 5 +++++
 src/device/usbd.h          | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

(limited to 'src/device')

diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 405e4467b..a1ad9b205 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -997,6 +997,11 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
           tud_control_xfer(rhport, request, (void *) (uintptr_t) &ntb_parameters, sizeof(ntb_parameters));
         } break;
 
+        case NCM_SET_ETHERNET_PACKET_FILTER: {
+          tud_control_xfer(rhport, request, NULL, 0);
+        } break;            
+          
+
           // unsupported request
         default:
           return false;
diff --git a/src/device/usbd.h b/src/device/usbd.h
index d3a6dccbb..45beb7c4c 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1040,7 +1040,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   /* CDC-NCM Functional Descriptor */\
   13, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_ETHERNET_NETWORKING, _mac_stridx, 0, 0, 0, 0, U16_TO_U8S_LE(_maxsegmentsize), U16_TO_U8S_LE(0), 0, \
   /* CDC-NCM Functional Descriptor */\
-  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), 0, \
+  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), 0x01, \
   /* Endpoint Notification */\
   7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), 50,\
   /* CDC Data Interface (default inactive) */\
-- 
cgit v1.3.1


From 0e4869a729ce32b157a60ae5730abf6f5802381b Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Sat, 25 Apr 2026 14:41:08 +0700
Subject: clean up

---
 src/common/tusb_types.h             |  6 +++
 src/device/usbd_control.c           | 14 ++----
 src/portable/mentor/musb/dcd_musb.c | 95 +++++++++++++++----------------------
 3 files changed, 50 insertions(+), 65 deletions(-)

(limited to 'src/device')

diff --git a/src/common/tusb_types.h b/src/common/tusb_types.h
index 806997866..36e72967c 100644
--- a/src/common/tusb_types.h
+++ b/src/common/tusb_types.h
@@ -321,6 +321,12 @@ enum {
   TUSB_INDEX_INVALID_8 = 0xFF
 };
 
+enum {
+ TU_EP0_OUT = 0x00,
+ TU_EP0_IN = 0x80
+};
+
+
 //--------------------------------------------------------------------+
 //
 //--------------------------------------------------------------------+
diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c
index 87593d4a7..49ecd0f16 100644
--- a/src/device/usbd_control.c
+++ b/src/device/usbd_control.c
@@ -44,10 +44,6 @@ TU_ATTR_WEAK void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_r
 // MACRO CONSTANT TYPEDEF
 //--------------------------------------------------------------------+
 
-enum {
-  EDPT_CTRL_OUT = 0x00,
-  EDPT_CTRL_IN = 0x80
-};
 
 typedef struct {
   tusb_control_request_t request;
@@ -74,7 +70,7 @@ uint8_t* usbd_get_ctrl_buf(void) {
 // Queue ZLP status transaction
 static inline bool status_stage_xact(uint8_t rhport, const tusb_control_request_t* request) {
   // Opposite to endpoint in Data Phase
-  const uint8_t ep_addr = request->bmRequestType_bit.direction ? EDPT_CTRL_OUT : EDPT_CTRL_IN;
+  const uint8_t ep_addr = request->bmRequestType_bit.direction ? TU_EP0_OUT : TU_EP0_IN;
   return usbd_edpt_xfer(rhport, ep_addr, NULL, 0, false);
 }
 
@@ -93,10 +89,10 @@ bool tud_control_status(uint8_t rhport, const tusb_control_request_t* request) {
 // This function can also transfer an zero-length packet
 static bool data_stage_xact(uint8_t rhport) {
   const uint16_t xact_len = tu_min16(_ctrl_xfer.data_len - _ctrl_xfer.total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
-  uint8_t ep_addr = EDPT_CTRL_OUT;
+  uint8_t ep_addr = TU_EP0_OUT;
 
   if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_IN) {
-    ep_addr = EDPT_CTRL_IN;
+    ep_addr = TU_EP0_IN;
     if (0u != xact_len && _ctrl_xfer.buffer != _ctrl_epbuf.buf) {
       TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, _ctrl_xfer.buffer, xact_len));
     }
@@ -203,8 +199,8 @@ bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result,
       TU_ASSERT(status_stage_xact(rhport, &_ctrl_xfer.request));
     } else {
       // Stall both IN and OUT control endpoint
-      dcd_edpt_stall(rhport, EDPT_CTRL_OUT);
-      dcd_edpt_stall(rhport, EDPT_CTRL_IN);
+      dcd_edpt_stall(rhport, TU_EP0_OUT);
+      dcd_edpt_stall(rhport, TU_EP0_IN);
     }
   } else {
     // More data to transfer
diff --git a/src/portable/mentor/musb/dcd_musb.c b/src/portable/mentor/musb/dcd_musb.c
index 4ef10168f..66fa86c77 100644
--- a/src/portable/mentor/musb/dcd_musb.c
+++ b/src/portable/mentor/musb/dcd_musb.c
@@ -70,40 +70,32 @@ typedef struct {
 // Pipe array layout (N = TUP_DCD_ENDPOINT_MAX):
 //   [0] : EP0 (shared between IN/OUT control stages)
 // One-direction-only IPs (CFG_TUD_ENDPOINT_ONE_DIRECTION_ONLY=1):
-//   [1 .. n-1] : EP1..n-1 (single slot per endpoint)
+//   [1..N-1] : EP1..N-1 (single slot per endpoint)
 // Bidirectional-capable IPs:
-//   [1 .. N-1  ] : EP OUT
-//   [N .. 2*N-2] : EP IN
+//   [1..N-1  ] : EP OUT
+//   [N..2*N-2] : EP IN
 #if CFG_TUD_ENDPOINT_ONE_DIRECTION_ONLY
   #define MUSB_PIPE_COUNT TUP_DCD_ENDPOINT_MAX
 #else
   #define MUSB_PIPE_COUNT (2u * TUP_DCD_ENDPOINT_MAX - 1u)
 #endif
 
-// EP0 control-transfer phase (§21.1.4). The phase is set from the SETUP
-// packet's direction/wLength when the SETUP IRQ fires, and drives what each
-// subsequent IRQ or edpt0_xfer call is allowed to do.
 enum {
-  EP0_STATE_IDLE = 0,    // no active control transfer
-  EP0_STATE_TX,          // DATA IN stage  (Read req data; STATUS-OUT-ZLP absorbed here too)
-  EP0_STATE_RX,          // DATA OUT stage (Write req data)
-  EP0_STATE_STATUS_IN,   // STATUS IN — device sends IN-ZLP to host; awaits send-ACK IRQ
-  EP0_STATE_STATUS_OUT,
-  EP0_STATE_STATUS_OUT_REQUESTED,
-  EP0_STATE_STATUS_OUT_SENT
+  EP0_STATE_IDLE = 0,             // no active control transfer
+  EP0_STATE_DATA,                 // DATA stage (IN or OUT — direction implied by CSR/dir)
+  EP0_STATE_STATUS_IN,            // STATUS IN — device sends IN-ZLP; awaits send-ACK IRQ
+  EP0_STATE_STATUS_OUT,           // post-DATAEND, neither edpt0_xfer(STATUS OUT) nor confirmation IRQ has happened yet
+  EP0_STATE_STATUS_OUT_REQUESTED, // edpt0_xfer(STATUS OUT) was called first; awaiting confirmation IRQ to fire complete
+  EP0_STATE_STATUS_OUT_SENT,      // confirmation IRQ arrived first; awaiting edpt0_xfer(STATUS OUT) to fire complete
 };
 
 typedef struct {
-  uint16_t remaining_ctrl; /* The number of bytes remaining in data stage of control transfer. */
+  uint16_t ep0_remain_datalen; /* The number of bytes remaining in data stage of control transfer. */
   uint8_t ep0_state;
   uint8_t pending_addr;  // new USB address latched by dcd_set_address, applied when STATUS IN completes
   pipe_state_t pipe[MUSB_PIPE_COUNT];
 } dcd_data_t;
 
-// EP0 control-transfer state is held by usbd_control.c (request, total_xferred,
-// data_len). dcd tracks phase in _dcd.ep0_state. The SETUP packet is drained
-// into a local in process_ep0 and dispatched upstream — never cached here.
-
 static dcd_data_t _dcd;
 
 TU_ATTR_ALWAYS_INLINE static inline pipe_state_t* pipe_get(uint8_t epnum, tusb_dir_t epdir) {
@@ -377,21 +369,18 @@ static bool edpt0_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t *buffer, uint16_
   const unsigned dir_in = tu_edpt_dir(ep_addr);
 
   switch (_dcd.ep0_state) {
-    case EP0_STATE_TX:
-    case EP0_STATE_RX: {
-      TU_ASSERT(dir_in ? _dcd.ep0_state == EP0_STATE_TX : _dcd.ep0_state == EP0_STATE_RX);
-      volatile void *fifo_ptr = &musb_regs->fifo[0];
+    case EP0_STATE_DATA: {
       if (dir_in) {
-        // DATA IN: load FIFO, set TXRDY. Add DATAEND for a short packet (ends
-        // the data stage per USB short-packet rule).
-        tu_hwfifo_write(fifo_ptr, buffer, total_bytes, NULL);
+        // DATA IN: load FIFO, set TXRDY. Add DATAEND on the last chunk
+        // (ep0_remain_datalen == 0 after this load) to end the data stage.
+        tu_hwfifo_write(&musb_regs->fifo[0], buffer, total_bytes, NULL);
         pipe0->buf = buffer + total_bytes;
         pipe0->length = total_bytes;
         pipe0->remaining = 0;
 
-        _dcd.remaining_ctrl -= total_bytes;
-        if (_dcd.remaining_ctrl == 0) {
-          ep_csr->csr0l = MUSB_CSRL0_TXRDY | MUSB_CSRL0_DATAEND; // last packet, also set DATAEND to end the data stage
+        _dcd.ep0_remain_datalen -= total_bytes;
+        if (_dcd.ep0_remain_datalen == 0) {
+          ep_csr->csr0l = MUSB_CSRL0_TXRDY | MUSB_CSRL0_DATAEND;
         } else {
           ep_csr->csr0l = MUSB_CSRL0_TXRDY;
         }
@@ -427,9 +416,7 @@ static bool edpt0_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t *buffer, uint16_
   return true;
 }
 
-// 21.1.5: endpoint 0 service routine as peripheral. Drives the IDLE /
-// IDLE / TX / RX / STATUS machine; direction on each IRQ is
-// implied by the state.
+// 21.1.5: endpoint 0 service routine as peripheral
 static void process_ep0(uint8_t rhport) {
   musb_regs_t* musb_regs = MUSB_REGS(rhport);
   musb_ep_csr_t* ep_csr = get_ep_csr(musb_regs, 0);
@@ -465,41 +452,35 @@ static void process_ep0(uint8_t rhport) {
         setup_packet.u32[0] = musb_regs->fifo[0];
         setup_packet.u32[1] = musb_regs->fifo[0];
 
-        _dcd.remaining_ctrl = setup_packet.req.wLength;
+        _dcd.ep0_remain_datalen = setup_packet.req.wLength;
 
-        // Pick the next phase directly from the SETUP packet: Read → TX,
-        // Write → RX, zero-data → STATUS_IN. For Read, also ack SETUP's RXRDY
-        // now so the host can start IN tokens immediately; Write/zero-data
-        // leave it set so HW NAKs OUT tokens until edpt0_xfer clears it.
         if (setup_packet.req.wLength == 0) {
           _dcd.ep0_state = EP0_STATE_STATUS_IN;
-        } else if (tu_edpt_dir(setup_packet.req.bmRequestType)) {
-          _dcd.ep0_state = EP0_STATE_TX;
-          ep_csr->csr0l  = MUSB_CSRL0_RXRDYC;
         } else {
-          _dcd.ep0_state = EP0_STATE_RX;
+          _dcd.ep0_state = EP0_STATE_DATA;
+          // If OUT (rx) direction, let edpt0_xfer() clear RXRDY when it's ready to receive data.
+          if (setup_packet.req.bmRequestType & TUSB_DIR_IN_MASK) {
+            ep_csr->csr0l = MUSB_CSRL0_RXRDYC;
+          }
         }
         dcd_event_setup_received(rhport, (const uint8_t *)&setup_packet.req, true);
         break;
 
-      case EP0_STATE_RX: {
-        /* DATA OUT: drain armed buffer, complete. Stay in RX — usbd posts
-         * edpt0_xfer(STATUS IN) next which transitions us to STATUS_IN. */
-        const uint16_t len = tu_min16(tu_min16(pipe0->remaining, 64), count0);
+      case EP0_STATE_DATA: {
+        const uint16_t len = tu_min16(pipe0->remaining, count0);
         if (len) {
           tu_hwfifo_read(&musb_regs->fifo[0], pipe0->buf, len, NULL);
           pipe0->remaining -= len;
-          _dcd.remaining_ctrl -= len;
+          _dcd.ep0_remain_datalen -= len;
         }
 
-        if (_dcd.remaining_ctrl == 0) {
-          // last packet, leave it RXRDYC to edpt0_xfer()
+        if (_dcd.ep0_remain_datalen == 0) {
+          // last packet: change state and leave RXRDY for edpt0_xfer(STATUS IN) to ack
           _dcd.ep0_state = EP0_STATE_STATUS_IN;
         } else {
           ep_csr->csr0l = MUSB_CSRL0_RXRDYC;
         }
-        dcd_event_xfer_complete(rhport, tu_edpt_addr(0, TUSB_DIR_OUT), pipe0->length - pipe0->remaining,
-                                XFER_RESULT_SUCCESS, true);
+        dcd_event_xfer_complete(rhport, TU_EP0_OUT, len, XFER_RESULT_SUCCESS, true);
         break;
       }
 
@@ -513,12 +494,14 @@ static void process_ep0(uint8_t rhport) {
  * - completion of sending any length packet TxPktRdy clear
  * - or status stage is complete (ZLP) after DataEnd is set */
   switch (_dcd.ep0_state) {
-    case EP0_STATE_TX:
-      if (_dcd.remaining_ctrl == 0) {
-        // last packet
+    case EP0_STATE_DATA:
+      // csrl == 0 in DATA state = TXRDY just cleared, i.e. a DATA IN packet was successfully sent. If the just-sent
+      // packet was the last (DATAEND was set when ep0_remain_datalen hit zero), transition
+      // to STATUS_OUT to await the host's STATUS-OUT ZLP confirmation IRQ.
+      if (_dcd.ep0_remain_datalen == 0) {
         _dcd.ep0_state = EP0_STATE_STATUS_OUT;
       }
-      dcd_event_xfer_complete(rhport, 0x80, pipe0->length, XFER_RESULT_SUCCESS, true);
+      dcd_event_xfer_complete(rhport, TU_EP0_IN, pipe0->length, XFER_RESULT_SUCCESS, true);
       break;
 
     case EP0_STATE_STATUS_OUT:
@@ -528,7 +511,7 @@ static void process_ep0(uint8_t rhport) {
 
     case EP0_STATE_STATUS_OUT_REQUESTED:
       _dcd.ep0_state = EP0_STATE_IDLE;
-      dcd_event_xfer_complete(rhport, 0, 0, XFER_RESULT_SUCCESS, true);
+      dcd_event_xfer_complete(rhport, TU_EP0_OUT, 0, XFER_RESULT_SUCCESS, true);
       break;
 
     case EP0_STATE_STATUS_IN:
@@ -537,7 +520,7 @@ static void process_ep0(uint8_t rhport) {
         _dcd.pending_addr = 0;
       }
       _dcd.ep0_state = EP0_STATE_IDLE;
-      dcd_event_xfer_complete(rhport, 0x80, 0, XFER_RESULT_SUCCESS, true);
+      dcd_event_xfer_complete(rhport, TU_EP0_IN, 0, XFER_RESULT_SUCCESS, true);
       break;
 
     default: break;
@@ -833,7 +816,7 @@ void dcd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
   musb_ep_csr_t* ep_csr = get_ep_csr(musb_regs, epn);
 
   if (0 == epn) {
-    if (!ep_addr) { /* Ignore EP80 */
+    if (ep_addr == TU_EP0_OUT) { /* Ignore EP0 OUT */
       _dcd.ep0_state = EP0_STATE_IDLE;
       pipe_state_t* pipe0 = pipe_get(0, TUSB_DIR_OUT);
       pipe0->buf = NULL;
-- 
cgit v1.3.1


From d3107be360b45c4b8dbc223dcc5e5f57b582c5ff Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Fri, 24 Apr 2026 12:04:56 +0700
Subject: usbd_control: consolidate status stage ep selection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract the "which endpoint is the Status stage on" rule into a single
TU_ATTR_ALWAYS_INLINE helper, and use it from both status_stage_xact()
and the completion callback. Replaces the two-operand wLength/direction
check with a direct endpoint-match comparison, matching the first
operand's pattern.

Per USB 2.0 §9.3.1, when wLength == 0 the bmRequestType Direction bit
is ignored and the Status stage is always IN; otherwise the Status
stage is opposite to the Data stage direction.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/device/usbd_control.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

(limited to 'src/device')

diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c
index 1ec9b4649..b5dae7d59 100644
--- a/src/device/usbd_control.c
+++ b/src/device/usbd_control.c
@@ -71,15 +71,17 @@ uint8_t* usbd_get_ctrl_buf(void) {
 // Application API
 //--------------------------------------------------------------------+
 
+// Endpoint used for the Status stage of a control transfer.
+// Per USB 2.0 §9.3.1, when wLength == 0 the Direction bit is ignored and the Status stage
+// is always IN. Otherwise the Status stage is opposite to the Data stage direction.
+TU_ATTR_ALWAYS_INLINE static inline uint8_t status_stage_ep(const tusb_control_request_t* request) {
+  if (request->wLength == 0) return EDPT_CTRL_IN;
+  return request->bmRequestType_bit.direction ? EDPT_CTRL_OUT : EDPT_CTRL_IN;
+}
+
 // Queue ZLP status transaction
-static inline bool status_stage_xact(uint8_t rhport, const tusb_control_request_t* request) {
-  // Always use EDPT_CTRL_IN when control request wLength is zero
-  if (request->wLength==0) {
-    return usbd_edpt_xfer(rhport, EDPT_CTRL_IN, NULL, 0, false);
-  }
-  // Opposite to endpoint in Data Phase
-  const uint8_t ep_addr = request->bmRequestType_bit.direction ? EDPT_CTRL_OUT : EDPT_CTRL_IN;
-  return usbd_edpt_xfer(rhport, ep_addr, NULL, 0, false);
+TU_ATTR_ALWAYS_INLINE static inline bool status_stage_xact(uint8_t rhport, const tusb_control_request_t* request) {
+  return usbd_edpt_xfer(rhport, status_stage_ep(request), NULL, 0, false);
 }
 
 // Status phase
@@ -160,10 +162,8 @@ void usbd_control_set_request(const tusb_control_request_t* request) {
 bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
   (void) result;
 
-  // Endpoint Address is opposite to direction bit, this is Status Stage complete event
-  // Control request with zero wLength and IN direction also is Status Stage complete event
-  if ((tu_edpt_dir(ep_addr) != _ctrl_xfer.request.bmRequestType_bit.direction)||
-      (_ctrl_xfer.request.wLength==0&&_ctrl_xfer.request.bmRequestType_bit.direction==TUSB_DIR_IN)) {
+  // Status Stage complete: callback endpoint matches the Status stage endpoint
+  if (ep_addr == status_stage_ep(&_ctrl_xfer.request)) {
     TU_ASSERT(0 == xferred_bytes);
 
     // invoke optional dcd hook if available
-- 
cgit v1.3.1


From 2cdd98104ece869f3a5eda3dd9c2b02f5b4c318d Mon Sep 17 00:00:00 2001
From: nminaylov <nm29719@gmail.com>
Date: Mon, 27 Apr 2026 14:40:18 +0300
Subject: NCM caps enum

---
 src/class/net/ncm_device.c |  3 +--
 src/class/net/net_device.h | 10 ++++++++++
 src/device/usbd.h          |  5 ++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

(limited to 'src/device')

diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index a1ad9b205..83e8bffab 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -999,8 +999,7 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
 
         case NCM_SET_ETHERNET_PACKET_FILTER: {
           tud_control_xfer(rhport, request, NULL, 0);
-        } break;            
-          
+        } break;
 
           // unsupported request
         default:
diff --git a/src/class/net/net_device.h b/src/class/net/net_device.h
index 96c03fd61..61ff6b2d6 100644
--- a/src/class/net/net_device.h
+++ b/src/class/net/net_device.h
@@ -50,6 +50,16 @@ typedef enum
   NCM_DATA_PROTOCOL_NETWORK_TRANSFER_BLOCK = 0x01
 } ncm_data_interface_protocol_code_t;
 
+// Table 5.2 bmNetworkCapabilities bits
+typedef enum {
+  NCM_NETWORK_CAPS_NONE              = 0x00,
+  NCM_NETWORK_CAPS_ETH_FILTER        = (1 << 0),
+  NCM_NETWORK_CAPS_NET_ADDRESS       = (1 << 1),
+  NCM_NETWORK_CAPS_ENCAP_COMMAND     = (1 << 2),
+  NCM_NETWORK_CAPS_MAX_DATAGRAM_SIZE = (1 << 3),
+  NCM_NETWORK_CAPS_CRC_MODE          = (1 << 4),
+  NCM_NETWORK_CAPS_NTB_INPUT_SIZE    = (1 << 5)
+} ncm_network_capabilities_t;
 
 #ifdef __cplusplus
  extern "C" {
diff --git a/src/device/usbd.h b/src/device/usbd.h
index 45beb7c4c..96144350e 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1023,6 +1023,9 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 // CDC-NCM Descriptor Templates
 //--------------------------------------------------------------------+
 
+// NCM Capabilities, bitmap of NCM_NETWORK_CAPS_* bits.
+#define TUD_CDC_NCM_CAPS (NCM_NETWORK_CAPS_ETH_FILTER)
+
 // Length of template descriptor
 #define TUD_CDC_NCM_DESC_LEN  (8+9+5+5+13+6+7+9+9+7+7)
 
@@ -1040,7 +1043,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   /* CDC-NCM Functional Descriptor */\
   13, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_ETHERNET_NETWORKING, _mac_stridx, 0, 0, 0, 0, U16_TO_U8S_LE(_maxsegmentsize), U16_TO_U8S_LE(0), 0, \
   /* CDC-NCM Functional Descriptor */\
-  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), 0x01, \
+  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), TUD_CDC_NCM_CAPS, \
   /* Endpoint Notification */\
   7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), 50,\
   /* CDC Data Interface (default inactive) */\
-- 
cgit v1.3.1


From d529c5321f474ccdd80ccb6fdcfb732abb1b7a45 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Wed, 29 Apr 2026 14:46:13 +0700
Subject: clean up

---
 src/device/usbd_control.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

(limited to 'src/device')

diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c
index 58b78ff53..b14d08a9c 100644
--- a/src/device/usbd_control.c
+++ b/src/device/usbd_control.c
@@ -71,13 +71,12 @@ uint8_t* usbd_get_ctrl_buf(void) {
 // Per USB 2.0 §9.3.1, when wLength == 0 the Direction bit is ignored and the Status stage
 // is always IN. Otherwise the Status stage is opposite to the Data stage direction.
 TU_ATTR_ALWAYS_INLINE static inline uint8_t status_stage_ep(const tusb_control_request_t* request) {
-  if (request->wLength == 0) return TU_EP0_IN;
-  return request->bmRequestType_bit.direction ? TU_EP0_OUT : TU_EP0_IN;
+  return (request->wLength != 0 && request->bmRequestType_bit.direction) ? TU_EP0_OUT : TU_EP0_IN;
 }
 
 // Queue ZLP status transaction
-TU_ATTR_ALWAYS_INLINE static inline bool status_stage_xact(uint8_t rhport, const tusb_control_request_t* request) {
-  return usbd_edpt_xfer(rhport, status_stage_ep(request), NULL, 0, false);
+TU_ATTR_ALWAYS_INLINE static inline  bool status_stage_xact(uint8_t rhport, uint8_t ep_status) {
+  return usbd_edpt_xfer(rhport, ep_status, NULL, 0, false);
 }
 
 // Status phase
@@ -87,7 +86,7 @@ bool tud_control_status(uint8_t rhport, const tusb_control_request_t* request) {
   _ctrl_xfer.total_xferred = 0;
   _ctrl_xfer.data_len = 0;
 
-  return status_stage_xact(rhport, request);
+  return status_stage_xact(rhport, status_stage_ep(request));
 }
 
 // Queue a transaction in Data Stage
@@ -121,7 +120,7 @@ bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, voi
     }
     TU_ASSERT(data_stage_xact(rhport));
   } else {
-    TU_ASSERT(status_stage_xact(rhport, request));
+    TU_ASSERT(status_stage_xact(rhport, TU_EP0_IN));
   }
 
   return true;
@@ -158,8 +157,9 @@ void usbd_control_set_request(const tusb_control_request_t* request) {
 bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
   (void) result;
 
-  // Status Stage complete: callback endpoint matches the Status stage endpoint
-  if (ep_addr == status_stage_ep(&_ctrl_xfer.request)) {
+  // Status Stage complete: endpoint matches the Status stage endpoint
+  uint8_t const ep_status = status_stage_ep(&_ctrl_xfer.request);
+  if (ep_addr == ep_status) {
     TU_ASSERT(0 == xferred_bytes);
 
     // invoke optional dcd hook if available
@@ -173,6 +173,7 @@ bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result,
     return true;
   }
 
+  // Data stage complete
   if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
     TU_VERIFY(_ctrl_xfer.buffer);
     if (_ctrl_xfer.buffer != _ctrl_epbuf.buf) {
@@ -202,7 +203,7 @@ bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result,
     }
 
     if (is_ok) {
-      TU_ASSERT(status_stage_xact(rhport, &_ctrl_xfer.request));
+      TU_ASSERT(status_stage_xact(rhport, ep_status));
     } else {
       // Stall both IN and OUT control endpoint
       dcd_edpt_stall(rhport, TU_EP0_OUT);
-- 
cgit v1.3.1


From 9d3ad336bfad062fa1e6f6d63feb97a9851cc9e1 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Wed, 29 Apr 2026 17:27:59 +0700
Subject: deprecated `usbd_control.c` and merge its functionality into `usbd.c`

---
 hw/bsp/rp2040/family.cmake    |   1 -
 src/CMakeLists.txt            |   1 -
 src/device/usbd.c             | 173 ++++++++++++++++++++++++++++++++++--
 src/device/usbd_control.c     | 199 ++----------------------------------------
 src/tinyusb.mk                |   1 -
 test/fuzz/rules.mk            |   1 -
 test/unit-test/CMakeLists.txt |   4 +-
 7 files changed, 172 insertions(+), 208 deletions(-)

(limited to 'src/device')

diff --git a/hw/bsp/rp2040/family.cmake b/hw/bsp/rp2040/family.cmake
index 6e88b9fa1..075582554 100644
--- a/hw/bsp/rp2040/family.cmake
+++ b/hw/bsp/rp2040/family.cmake
@@ -93,7 +93,6 @@ target_sources(tinyusb_device_base INTERFACE
 		${TOP}/src/portable/raspberrypi/rp2040/dcd_rp2040.c
 		${TOP}/src/portable/raspberrypi/rp2040/rp2040_usb.c
 		${TOP}/src/device/usbd.c
-		${TOP}/src/device/usbd_control.c
 		${TOP}/src/class/audio/audio_device.c
 		${TOP}/src/class/cdc/cdc_device.c
 		${TOP}/src/class/dfu/dfu_device.c
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 00f466007..c7a5184c5 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -8,7 +8,6 @@ function(tinyusb_sources_get OUTPUT_VAR)
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/common/tusb_fifo.c
     # device
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/device/usbd.c
-    ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/device/usbd_control.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/audio/audio_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/cdc/cdc_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/dfu/dfu_device.c
diff --git a/src/device/usbd.c b/src/device/usbd.c
index da0ffb4c6..acf808bf6 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -419,11 +419,10 @@ static bool process_test_mode_cb(uint8_t rhport, uint8_t stage, tusb_control_req
 }
 #endif
 
-// from usbd_control.c
-void usbd_control_reset(void);
-void usbd_control_set_request(tusb_control_request_t const *request);
-void usbd_control_set_complete_callback( usbd_control_xfer_cb_t fp );
-bool usbd_control_xfer_cb (uint8_t rhport, uint8_t ep_addr, xfer_result_t event, uint32_t xferred_bytes);
+// Control Endpoint
+static void usbd_control_reset(void);
+static void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp);
+static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
 
 //--------------------------------------------------------------------+
 // Weak stubs: invoked if no strong implementation is available
@@ -808,6 +807,157 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
   }
 }
 
+//--------------------------------------------------------------------+
+// Control Endpoint
+//--------------------------------------------------------------------+
+
+// Weak hook: invoked when the control transfer's status stage completes
+TU_ATTR_WEAK void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_request_t* request) {
+  (void) rhport;
+  (void) request;
+}
+
+typedef struct {
+  tusb_control_request_t request;
+  uint8_t* buffer;
+  uint16_t data_len;
+  uint16_t total_xferred;
+  usbd_control_xfer_cb_t complete_cb;
+} usbd_control_xfer_t;
+
+static usbd_control_xfer_t _ctrl_xfer;
+
+CFG_TUD_MEM_SECTION static struct {
+  TUD_EPBUF_DEF(buf, CFG_TUD_ENDPOINT0_BUFSIZE);
+} _ctrl_epbuf;
+
+uint8_t* usbd_get_ctrl_buf(void) {
+  return _ctrl_epbuf.buf;
+}
+
+// Endpoint used for the Status stage of a control transfer.
+// Per USB 2.0 §9.3.1, when wLength == 0 the Direction bit is ignored and the Status
+// stage is always IN. Otherwise the Status stage is opposite of the Data stage direction.
+TU_ATTR_ALWAYS_INLINE static inline uint8_t status_stage_ep(const tusb_control_request_t* request) {
+  return (request->wLength != 0 && request->bmRequestType_bit.direction) ? TU_EP0_OUT : TU_EP0_IN;
+}
+
+// Queue ZLP status transaction
+TU_ATTR_ALWAYS_INLINE static inline bool status_stage_xact(uint8_t rhport, uint8_t ep_status) {
+  return usbd_edpt_xfer(rhport, ep_status, NULL, 0, false);
+}
+
+// Queue a transaction in Data Stage. Each transaction has up to Endpoint0's max
+// packet size. This function can also transfer a zero-length packet.
+static bool data_stage_xact(uint8_t rhport) {
+  const uint16_t xact_len = tu_min16(_ctrl_xfer.data_len - _ctrl_xfer.total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
+  uint8_t ep_addr = TU_EP0_OUT;
+
+  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_IN) {
+    ep_addr = TU_EP0_IN;
+    if (0u != xact_len && _ctrl_xfer.buffer != _ctrl_epbuf.buf) {
+      TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, _ctrl_xfer.buffer, xact_len));
+    }
+  }
+
+  return usbd_edpt_xfer(rhport, ep_addr, xact_len ? _ctrl_epbuf.buf : NULL, xact_len, false);
+}
+
+// Status phase
+bool tud_control_status(uint8_t rhport, const tusb_control_request_t* request) {
+  // _ctrl_xfer fields are pre-initialized at process_control_request entry
+  (void) request;
+  return status_stage_xact(rhport, status_stage_ep(&_ctrl_xfer.request));
+}
+
+// Transmit data to/from the control endpoint. If wLength is zero, a status packet is sent instead.
+bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, void* buffer, uint16_t len) {
+  // _ctrl_xfer.request and reset fields are pre-initialized at process_control_request entry
+  (void) request;
+  _ctrl_xfer.buffer = (uint8_t*) buffer;
+  _ctrl_xfer.data_len = tu_min16(len, _ctrl_xfer.request.wLength);
+
+  if (_ctrl_xfer.request.wLength > 0U) {
+    if (_ctrl_xfer.data_len > 0U) {
+      TU_ASSERT(buffer);
+    }
+    TU_ASSERT(data_stage_xact(rhport));
+  } else {
+    // wLength == 0: Status stage is always IN per USB 2.0 §9.3.1
+    TU_ASSERT(status_stage_xact(rhport, TU_EP0_IN));
+  }
+
+  return true;
+}
+
+static void usbd_control_reset(void) {
+  tu_varclr(&_ctrl_xfer);
+}
+
+static void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp) {
+  _ctrl_xfer.complete_cb = fp;
+}
+
+// Callback when a transaction completes on the DATA stage or Status stage of EP0
+static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
+  (void) result;
+
+  // Status Stage complete: ep_addr matches the resolved Status stage endpoint
+  uint8_t const ep_status = status_stage_ep(&_ctrl_xfer.request);
+  if (ep_addr == ep_status) {
+    TU_ASSERT(0 == xferred_bytes);
+
+    // invoke optional dcd hook if available
+    dcd_edpt0_status_complete(rhport, &_ctrl_xfer.request);
+
+    if (NULL != _ctrl_xfer.complete_cb) {
+      // TODO refactor with usbd_driver_print_control_complete_name
+      _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_ACK, &_ctrl_xfer.request);
+    }
+
+    return true;
+  }
+
+  // Data stage progress
+  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
+    TU_VERIFY(_ctrl_xfer.buffer);
+    if (_ctrl_xfer.buffer != _ctrl_epbuf.buf) {
+      memcpy(_ctrl_xfer.buffer, _ctrl_epbuf.buf, xferred_bytes);
+    }
+    TU_LOG_MEM(CFG_TUD_LOG_LEVEL, _ctrl_xfer.buffer, xferred_bytes, 2);
+  }
+
+  _ctrl_xfer.total_xferred += (uint16_t) xferred_bytes;
+  _ctrl_xfer.buffer += xferred_bytes;
+
+  // Data Stage complete when wLength reached or short packet (incl. ZLP) seen
+  if ((_ctrl_xfer.request.wLength == _ctrl_xfer.total_xferred) ||
+      (xferred_bytes < CFG_TUD_ENDPOINT0_BUFSIZE)) {
+    bool is_ok = true;
+
+    if (NULL != _ctrl_xfer.complete_cb) {
+      #if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
+      usbd_driver_print_control_complete_name(_ctrl_xfer.complete_cb);
+      #endif
+      // Callback can still stall control in status phase, e.g. OUT data doesn't make sense
+      is_ok = _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_DATA, &_ctrl_xfer.request);
+    }
+
+    if (is_ok) {
+      TU_ASSERT(status_stage_xact(rhport, ep_status));
+    } else {
+      // Stall both IN and OUT control endpoint
+      dcd_edpt_stall(rhport, TU_EP0_OUT);
+      dcd_edpt_stall(rhport, TU_EP0_IN);
+    }
+  } else {
+    // More data to transfer
+    TU_ASSERT(data_stage_xact(rhport));
+  }
+
+  return true;
+}
+
 //--------------------------------------------------------------------+
 // Control Request Parser & Handling
 //--------------------------------------------------------------------+
@@ -822,7 +972,14 @@ static bool invoke_class_control(uint8_t rhport, usbd_class_driver_t const * dri
 // This handles the actual request and its response.
 // Returns false if unable to complete the request, causing caller to stall control endpoints.
 static bool process_control_request(uint8_t rhport, tusb_control_request_t const * p_request) {
-  usbd_control_set_complete_callback(NULL);
+  // Initialize control transfer state for this request. The request copy must be
+  // visible to usbd_control_xfer_cb when the (asynchronous) status ZLP completes,
+  // since the SETUP packet event has already gone out of scope by then.
+  _ctrl_xfer.request = *p_request;
+  _ctrl_xfer.buffer = NULL;
+  _ctrl_xfer.total_xferred = 0;
+  _ctrl_xfer.data_len = 0;
+  _ctrl_xfer.complete_cb = NULL;
   TU_ASSERT(p_request->bmRequestType_bit.type < TUSB_REQ_TYPE_INVALID);
 
   // Vendor request
@@ -865,9 +1022,9 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
           // Depending on mcu, status phase could be sent either before or after changing device address,
           // or even require stack to not response with status at all
           // Therefore DCD must take full responsibility to response and include zlp status packet if needed.
-          usbd_control_set_request(p_request); // set request since DCD has no access to tud_control_status() API
+          // _ctrl_xfer.request was already populated at process_control_request() entry, so the
+          // status ZLP that the DCD queues will be recognized by usbd_control_xfer_cb().
           dcd_set_address(rhport, (uint8_t) p_request->wValue);
-          // skip tud_control_status()
           _usbd_dev.addressed = 1;
         break;
 
diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c
index b14d08a9c..38dcc6a82 100644
--- a/src/device/usbd_control.c
+++ b/src/device/usbd_control.c
@@ -24,197 +24,8 @@
  * This file is part of the TinyUSB stack.
  */
 
-#include "tusb_option.h"
-
-#if CFG_TUD_ENABLED
-
-#include "dcd.h"
-#include "tusb.h"
-#include "device/usbd_pvt.h"
-
-//--------------------------------------------------------------------+
-// Callback weak stubs (called if application does not provide)
-//--------------------------------------------------------------------+
-TU_ATTR_WEAK void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_request_t* request) {
-  (void) rhport;
-  (void) request;
-}
-
-//--------------------------------------------------------------------+
-// MACRO CONSTANT TYPEDEF
-//--------------------------------------------------------------------+
-
-
-typedef struct {
-  tusb_control_request_t request;
-  uint8_t* buffer;
-  uint16_t data_len;
-  uint16_t total_xferred;
-  usbd_control_xfer_cb_t complete_cb;
-} usbd_control_xfer_t;
-
-static usbd_control_xfer_t _ctrl_xfer;
-
-CFG_TUD_MEM_SECTION static struct {
-  TUD_EPBUF_DEF(buf, CFG_TUD_ENDPOINT0_BUFSIZE);
-} _ctrl_epbuf;
-
-uint8_t* usbd_get_ctrl_buf(void) {
-  return _ctrl_epbuf.buf;
-}
-
-//--------------------------------------------------------------------+
-// Application API
-//--------------------------------------------------------------------+
-
-// Endpoint used for the Status stage of a control transfer.
-// Per USB 2.0 §9.3.1, when wLength == 0 the Direction bit is ignored and the Status stage
-// is always IN. Otherwise the Status stage is opposite to the Data stage direction.
-TU_ATTR_ALWAYS_INLINE static inline uint8_t status_stage_ep(const tusb_control_request_t* request) {
-  return (request->wLength != 0 && request->bmRequestType_bit.direction) ? TU_EP0_OUT : TU_EP0_IN;
-}
-
-// Queue ZLP status transaction
-TU_ATTR_ALWAYS_INLINE static inline  bool status_stage_xact(uint8_t rhport, uint8_t ep_status) {
-  return usbd_edpt_xfer(rhport, ep_status, NULL, 0, false);
-}
-
-// Status phase
-bool tud_control_status(uint8_t rhport, const tusb_control_request_t* request) {
-  _ctrl_xfer.request = (*request);
-  _ctrl_xfer.buffer = NULL;
-  _ctrl_xfer.total_xferred = 0;
-  _ctrl_xfer.data_len = 0;
-
-  return status_stage_xact(rhport, status_stage_ep(request));
-}
-
-// Queue a transaction in Data Stage
-// Each transaction has up to Endpoint0's max packet size.
-// This function can also transfer an zero-length packet
-static bool data_stage_xact(uint8_t rhport) {
-  const uint16_t xact_len = tu_min16(_ctrl_xfer.data_len - _ctrl_xfer.total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
-  uint8_t ep_addr = TU_EP0_OUT;
-
-  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_IN) {
-    ep_addr = TU_EP0_IN;
-    if (0u != xact_len && _ctrl_xfer.buffer != _ctrl_epbuf.buf) {
-      TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, _ctrl_xfer.buffer, xact_len));
-    }
-  }
-
-  return usbd_edpt_xfer(rhport, ep_addr, xact_len ? _ctrl_epbuf.buf : NULL, xact_len, false);
-}
-
-// Transmit data to/from the control endpoint.
-// If the request's wLength is zero, a status packet is sent instead.
-bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, void* buffer, uint16_t len) {
-  _ctrl_xfer.request = (*request);
-  _ctrl_xfer.buffer = (uint8_t*) buffer;
-  _ctrl_xfer.total_xferred = 0U;
-  _ctrl_xfer.data_len = tu_min16(len, request->wLength);
-
-  if (request->wLength > 0U) {
-    if (_ctrl_xfer.data_len > 0U) {
-      TU_ASSERT(buffer);
-    }
-    TU_ASSERT(data_stage_xact(rhport));
-  } else {
-    TU_ASSERT(status_stage_xact(rhport, TU_EP0_IN));
-  }
-
-  return true;
-}
-
-//--------------------------------------------------------------------+
-// USBD API
-//--------------------------------------------------------------------+
-void usbd_control_reset(void);
-void usbd_control_set_request(const tusb_control_request_t* request);
-void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp);
-bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
-
-void usbd_control_reset(void) {
-  tu_varclr(&_ctrl_xfer);
-}
-
-// Set complete callback
-void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp) {
-  _ctrl_xfer.complete_cb = fp;
-}
-
-// for dcd_set_address where DCD is responsible for status response
-void usbd_control_set_request(const tusb_control_request_t* request) {
-  _ctrl_xfer.request = (*request);
-  _ctrl_xfer.buffer = NULL;
-  _ctrl_xfer.total_xferred = 0;
-  _ctrl_xfer.data_len = 0;
-}
-
-// callback when a transaction complete on
-// - DATA stage of control endpoint or
-// - Status stage
-bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
-  (void) result;
-
-  // Status Stage complete: endpoint matches the Status stage endpoint
-  uint8_t const ep_status = status_stage_ep(&_ctrl_xfer.request);
-  if (ep_addr == ep_status) {
-    TU_ASSERT(0 == xferred_bytes);
-
-    // invoke optional dcd hook if available
-    dcd_edpt0_status_complete(rhport, &_ctrl_xfer.request);
-
-    if (NULL != _ctrl_xfer.complete_cb) {
-      // TODO refactor with usbd_driver_print_control_complete_name
-      _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_ACK, &_ctrl_xfer.request);
-    }
-
-    return true;
-  }
-
-  // Data stage complete
-  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
-    TU_VERIFY(_ctrl_xfer.buffer);
-    if (_ctrl_xfer.buffer != _ctrl_epbuf.buf) {
-      memcpy(_ctrl_xfer.buffer, _ctrl_epbuf.buf, xferred_bytes);
-    }
-    TU_LOG_MEM(CFG_TUD_LOG_LEVEL, _ctrl_xfer.buffer, xferred_bytes, 2);
-  }
-
-  _ctrl_xfer.total_xferred += (uint16_t) xferred_bytes;
-  _ctrl_xfer.buffer += xferred_bytes;
-
-  // Data Stage is complete when all request's length are transferred or
-  // a short packet is sent including zero-length packet.
-  if ((_ctrl_xfer.request.wLength == _ctrl_xfer.total_xferred) ||
-      (xferred_bytes < CFG_TUD_ENDPOINT0_BUFSIZE)) {
-    // DATA stage is complete
-    bool is_ok = true;
-
-    // invoke complete callback if set
-    // callback can still stall control in status phase e.g out data does not make sense
-    if (NULL != _ctrl_xfer.complete_cb) {
-      #if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
-      usbd_driver_print_control_complete_name(_ctrl_xfer.complete_cb);
-      #endif
-
-      is_ok = _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_DATA, &_ctrl_xfer.request);
-    }
-
-    if (is_ok) {
-      TU_ASSERT(status_stage_xact(rhport, ep_status));
-    } else {
-      // Stall both IN and OUT control endpoint
-      dcd_edpt_stall(rhport, TU_EP0_OUT);
-      dcd_edpt_stall(rhport, TU_EP0_IN);
-    }
-  } else {
-    // More data to transfer
-    TU_ASSERT(data_stage_xact(rhport));
-  }
-
-  return true;
-}
-
-#endif
+// The usbd control function that used to live in this file has been merged
+// into src/device/usbd.c. This translation unit is intentionally empty and is
+// kept only so external/vendor build systems that still reference the path
+// keep resolving. Drop usbd_control.c from your build to silence the warning.
+#warning "src/device/usbd_control.c is deprecated and now empty; remove it from your build (its content lives in src/device/usbd.c)."
diff --git a/src/tinyusb.mk b/src/tinyusb.mk
index 169098016..e3ef35dcf 100644
--- a/src/tinyusb.mk
+++ b/src/tinyusb.mk
@@ -3,7 +3,6 @@ TINYUSB_SRC_C += \
 	src/tusb.c \
 	src/common/tusb_fifo.c \
 	src/device/usbd.c \
-	src/device/usbd_control.c \
 	src/typec/usbc.c \
 	src/class/audio/audio_device.c \
 	src/class/cdc/cdc_device.c \
diff --git a/test/fuzz/rules.mk b/test/fuzz/rules.mk
index 329dcce11..c14330312 100644
--- a/test/fuzz/rules.mk
+++ b/test/fuzz/rules.mk
@@ -23,7 +23,6 @@ SRC_C += \
 	src/tusb.c \
 	src/common/tusb_fifo.c \
 	src/device/usbd.c \
-	src/device/usbd_control.c \
 	src/class/audio/audio_device.c \
 	src/class/cdc/cdc_device.c \
 	src/class/dfu/dfu_device.c \
diff --git a/test/unit-test/CMakeLists.txt b/test/unit-test/CMakeLists.txt
index b44a91d57..a33af4563 100644
--- a/test/unit-test/CMakeLists.txt
+++ b/test/unit-test/CMakeLists.txt
@@ -117,14 +117,14 @@ add_ceedling_test(
 add_ceedling_test(
   test_usbd
   ${CEEDLING_WORKDIR}/test/device/usbd/test_usbd.c
-  "${CEEDLING_WORKDIR}/../../src/tusb.c;${CEEDLING_WORKDIR}/../../src/device/usbd.c;${CEEDLING_WORKDIR}/../../src/device/usbd_control.c;${CEEDLING_WORKDIR}/../../src/common/tusb_fifo.c"
+  "${CEEDLING_WORKDIR}/../../src/tusb.c;${CEEDLING_WORKDIR}/../../src/device/usbd.c;${CEEDLING_WORKDIR}/../../src/common/tusb_fifo.c"
   "${CEEDLING_BUILD_DIR}/test/mocks/test_usbd/mock_dcd.c;${CEEDLING_BUILD_DIR}/test/mocks/test_usbd/mock_msc_device.c"
   )
 
 add_ceedling_test(
   test_msc_device
   ${CEEDLING_WORKDIR}/test/device/msc/test_msc_device.c
-  "${CEEDLING_WORKDIR}/../../src/tusb.c;${CEEDLING_WORKDIR}/../../src/device/usbd.c;${CEEDLING_WORKDIR}/../../src/device/usbd_control.c;${CEEDLING_WORKDIR}/../../src/class/msc/msc_device.c;${CEEDLING_WORKDIR}/../../src/common/tusb_fifo.c"
+  "${CEEDLING_WORKDIR}/../../src/tusb.c;${CEEDLING_WORKDIR}/../../src/device/usbd.c;${CEEDLING_WORKDIR}/../../src/class/msc/msc_device.c;${CEEDLING_WORKDIR}/../../src/common/tusb_fifo.c"
   "${CEEDLING_BUILD_DIR}/test/mocks/test_msc_device/mock_dcd.c"
   )
 
-- 
cgit v1.3.1


From 2931121b072cd49d4a144359da422980d9bf017a Mon Sep 17 00:00:00 2001
From: Zixun LI <admin@hifiphile.com>
Date: Thu, 30 Apr 2026 15:03:09 +0200
Subject: refactor capability

Signed-off-by: Zixun LI <admin@hifiphile.com>
---
 examples/device/net_lwip_webserver/src/usb_descriptors.c | 6 +++---
 src/device/usbd.h                                        | 9 +++------
 2 files changed, 6 insertions(+), 9 deletions(-)

(limited to 'src/device')

diff --git a/examples/device/net_lwip_webserver/src/usb_descriptors.c b/examples/device/net_lwip_webserver/src/usb_descriptors.c
index c976cb62b..b194b9c5a 100644
--- a/examples/device/net_lwip_webserver/src/usb_descriptors.c
+++ b/examples/device/net_lwip_webserver/src/usb_descriptors.c
@@ -162,9 +162,9 @@ static uint8_t const ncm_configuration[] = {
   TUD_CONFIG_DESCRIPTOR(CONFIG_ID_NCM + 1, ITF_NUM_TOTAL, 0, NCM_CONFIG_TOTAL_LEN, 0, 100),
 
   // Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size.
-  TUD_CDC_NCM_DESCRIPTOR(
-      ITF_NUM_CDC, STRID_INTERFACE, STRID_MAC, EPNUM_NET_NOTIF, 64, EPNUM_NET_OUT, EPNUM_NET_IN,
-      CFG_TUD_NET_ENDPOINT_SIZE, CFG_TUD_NET_MTU),
+  TUD_CDC_NCM_DESCRIPTOR(ITF_NUM_CDC, STRID_INTERFACE, STRID_MAC,
+      EPNUM_NET_NOTIF, 64, EPNUM_NET_OUT, EPNUM_NET_IN, CFG_TUD_NET_ENDPOINT_SIZE,
+      CFG_TUD_NET_MTU, NCM_NETWORK_CAPS_ETH_FILTER),
 };
 
 #endif
diff --git a/src/device/usbd.h b/src/device/usbd.h
index 96144350e..a960e2c79 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1023,15 +1023,12 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 // CDC-NCM Descriptor Templates
 //--------------------------------------------------------------------+
 
-// NCM Capabilities, bitmap of NCM_NETWORK_CAPS_* bits.
-#define TUD_CDC_NCM_CAPS (NCM_NETWORK_CAPS_ETH_FILTER)
-
 // Length of template descriptor
 #define TUD_CDC_NCM_DESC_LEN  (8+9+5+5+13+6+7+9+9+7+7)
 
 // CDC-ECM Descriptor Template
-// Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size.
-#define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize) \
+// Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size, capability.
+#define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize, _capability) \
   /* Interface Association */\
   8, TUSB_DESC_INTERFACE_ASSOCIATION, _itfnum, 2, TUSB_CLASS_CDC, CDC_COMM_SUBCLASS_NETWORK_CONTROL_MODEL, 0, 0,\
   /* CDC Control Interface */\
@@ -1043,7 +1040,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   /* CDC-NCM Functional Descriptor */\
   13, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_ETHERNET_NETWORKING, _mac_stridx, 0, 0, 0, 0, U16_TO_U8S_LE(_maxsegmentsize), U16_TO_U8S_LE(0), 0, \
   /* CDC-NCM Functional Descriptor */\
-  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), TUD_CDC_NCM_CAPS, \
+  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), _capability, \
   /* Endpoint Notification */\
   7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), 50,\
   /* CDC Data Interface (default inactive) */\
-- 
cgit v1.3.1


From 8db6084acac03acc1b98721f78d22587968ed5b2 Mon Sep 17 00:00:00 2001
From: Zixun LI <admin@hifiphile.com>
Date: Thu, 30 Apr 2026 15:56:23 +0200
Subject: ncm: implement GetNtbInputSize request

Signed-off-by: HiFiPHile <admin@hifiphile.com>
---
 .../net_lwip_webserver/src/usb_descriptors.c       |  2 +-
 src/class/net/ncm.h                                | 14 ++++
 src/class/net/ncm_device.c                         | 87 +++++++++++-----------
 src/device/usbd.h                                  |  8 +-
 4 files changed, 62 insertions(+), 49 deletions(-)

(limited to 'src/device')

diff --git a/examples/device/net_lwip_webserver/src/usb_descriptors.c b/examples/device/net_lwip_webserver/src/usb_descriptors.c
index b194b9c5a..0c6c11611 100644
--- a/examples/device/net_lwip_webserver/src/usb_descriptors.c
+++ b/examples/device/net_lwip_webserver/src/usb_descriptors.c
@@ -164,7 +164,7 @@ static uint8_t const ncm_configuration[] = {
   // Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size.
   TUD_CDC_NCM_DESCRIPTOR(ITF_NUM_CDC, STRID_INTERFACE, STRID_MAC,
       EPNUM_NET_NOTIF, 64, EPNUM_NET_OUT, EPNUM_NET_IN, CFG_TUD_NET_ENDPOINT_SIZE,
-      CFG_TUD_NET_MTU, NCM_NETWORK_CAPS_ETH_FILTER),
+      CFG_TUD_NET_MTU, (uint8_t)((uint8_t)NCM_NETWORK_CAPS_ETH_FILTER | (uint8_t)NCM_NETWORK_CAPS_NTB_INPUT_SIZE)),
 };
 
 #endif
diff --git a/src/class/net/ncm.h b/src/class/net/ncm.h
index 8989fe0b4..27ff89b72 100644
--- a/src/class/net/ncm.h
+++ b/src/class/net/ncm.h
@@ -161,4 +161,18 @@ typedef struct {
   uint32_t uplink;
 } ncm_notify_t;
 
+typedef struct TU_ATTR_PACKED {
+  uint8_t bFunctionLength;
+  uint8_t bDescriptorType;
+  uint8_t bDescriptorSubType;
+  uint16_t bcdNcmVersion;
+  uint8_t bmCapabilities;
+} tusb_desc_cdc_ncm_func_t;
+
+typedef struct TU_ATTR_PACKED {
+  uint32_t dwNtbInMaxSize;
+  uint16_t wNtbInMaxDatagrams;
+  uint16_t wReserved;
+} ncm_ntb_input_size_t;
+
 #endif
diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 7240c50aa..e16b0523f 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -119,14 +119,10 @@ typedef struct {
   bool link_is_up;                                      // current link state
 
   // host-configured transmit limits
-  uint32_t xmit_max_ntb_size;                           // maximum NTB size device may send
+  uint8_t bm_capabilities;
+  uint16_t xmit_max_ntb_size;                           // maximum NTB size device may send
   uint16_t xmit_max_datagrams;                          // maximum datagrams per NTB device may send
-  uint8_t ntb_input_size_len;                           // last SET_NTB_INPUT_SIZE wLength
-  struct {
-    uint32_t dwNtbInMaxSize;
-    uint16_t wNtbInMaxDatagrams;
-    uint16_t wReserved;
-  } ntb_input_size;
+  ncm_ntb_input_size_t ntb_input_size;
 
   // misc
   bool tud_network_recv_renew_active;                   // tud_network_recv_renew() is active (avoid recursive invocations)
@@ -425,14 +421,10 @@ static bool xmit_requested_datagram_fits_into_current_ntb(uint16_t datagram_size
   if (ncm_interface.xmit_glue_ntb == NULL) {
     return false;
   }
-  uint16_t max_datagrams = ncm_interface.xmit_max_datagrams;
-  if (max_datagrams == 0) {
-    max_datagrams = CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB;
-  }
-  if (ncm_interface.xmit_glue_ntb_datagram_ndx >= max_datagrams) {
+  if (ncm_interface.xmit_glue_ntb_datagram_ndx >= ncm_interface.xmit_max_datagrams) {
     return false;
   }
-  if (ncm_interface.xmit_glue_ntb->nth.wBlockLength + datagram_size + XMIT_ALIGN_OFFSET(datagram_size) > ncm_interface.xmit_max_ntb_size) {
+  if (ncm_interface.xmit_glue_ntb->nth.wBlockLength + datagram_size + (uint32_t)XMIT_ALIGN_OFFSET(datagram_size) > (uint32_t)ncm_interface.xmit_max_ntb_size) {
     return false;
   }
   return true;
@@ -902,10 +894,14 @@ uint16_t netd_open(uint8_t rhport, tusb_desc_interface_t const *itf_desc, uint16
 
   ncm_interface.itf_num = itf_desc->bInterfaceNumber;// management interface
 
-  // skip the two first entries and the following TUSB_DESC_CS_INTERFACE entries
   uint16_t drv_len = sizeof(tusb_desc_interface_t);
   uint8_t const *p_desc = tu_desc_next(itf_desc);
   while (tu_desc_type(p_desc) == TUSB_DESC_CS_INTERFACE && drv_len <= max_len) {
+    if (tu_desc_subtype(p_desc) == CDC_FUNC_DESC_NCM) {
+      TU_ASSERT(tu_desc_len(p_desc) >= sizeof(tusb_desc_cdc_ncm_func_t), 0);
+      tusb_desc_cdc_ncm_func_t const *ncm_func = (tusb_desc_cdc_ncm_func_t const *) p_desc;
+      ncm_interface.bm_capabilities = ncm_func->bmCapabilities;
+    }
     drv_len += tu_desc_len(p_desc);
     p_desc = tu_desc_next(p_desc);
   }
@@ -1028,49 +1024,52 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
           if (stage != CONTROL_STAGE_SETUP) {
             return true;
           }
+
+          TU_VERIFY(ncm_interface.bm_capabilities & NCM_NETWORK_CAPS_ETH_FILTER, false);
           tud_network_set_packet_filter_cb(request->wValue);
           tud_control_xfer(rhport, request, NULL, 0);
         } break;
 
-        case NCM_SET_NTB_INPUT_SIZE: {
-          if (stage == CONTROL_STAGE_SETUP) {
-            if (request->wLength != 4 && request->wLength != 8) {
-              return false;
-            }
+        case NCM_GET_NTB_INPUT_SIZE: {
+          if (stage != CONTROL_STAGE_SETUP) {
+            return true;
+          }
 
-            ncm_interface.ntb_input_size_len = (uint8_t) request->wLength;
-            memset(&ncm_interface.ntb_input_size, 0, sizeof(ncm_interface.ntb_input_size));
+          TU_VERIFY(request->wLength >=4, false);
 
-            // wLength == 8 -> the NTB Input Size Structure
-            // wLength == 4 -> dwNtbInMaxSize field of the NTB Input Size Structure.
-            if (request->wLength == 4) {
-              tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size.dwNtbInMaxSize, 4);
-            } else {
-              tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size, 8);
-            }
-          } else if (stage == CONTROL_STAGE_ACK) {
-            uint32_t requested_size = ncm_interface.ntb_input_size.dwNtbInMaxSize;
-            uint16_t requested_datagrams = 0;
-            uint32_t min_ntb_size = 2048u;
-            uint32_t new_ntb_size = 0;
-            uint16_t new_datagrams = 0;
+          uint8_t resp_len = (request->wLength >= 8 && (ncm_interface.bm_capabilities & NCM_NETWORK_CAPS_NTB_INPUT_SIZE)) ? 8 : 4;
 
-            if (requested_size < min_ntb_size || requested_size > CFG_TUD_NCM_IN_NTB_MAX_SIZE) {
-              return false;
-            }
-            new_ntb_size = requested_size;
+          ncm_ntb_input_size_t ntb_input_size = {
+            .dwNtbInMaxSize = ncm_interface.xmit_max_ntb_size,
+            .wNtbInMaxDatagrams = ncm_interface.xmit_max_datagrams
+          };
+          tud_control_xfer(rhport, request, &ntb_input_size, resp_len);
+        } break;
 
-            if (ncm_interface.ntb_input_size_len == 8) {
-              requested_datagrams = ncm_interface.ntb_input_size.wNtbInMaxDatagrams;
+        case NCM_SET_NTB_INPUT_SIZE: {
+          if (stage == CONTROL_STAGE_SETUP) {
+            /* wLength == 8 -> the NTB Input Size Structure (if NCM_NETWORK_CAPS_NTB_INPUT_SIZE is set)
+               wLength == 4 -> dwNtbInMaxSize field of the NTB Input Size Structure. */
+            TU_VERIFY(request->wLength == 4 || request->wLength == 8, false);
+            if (request->wLength == 8) {
+              TU_VERIFY(ncm_interface.bm_capabilities & NCM_NETWORK_CAPS_NTB_INPUT_SIZE, false);
             }
 
-            if (requested_datagrams > CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB) {
+            tu_memclr(&ncm_interface.ntb_input_size, sizeof(ncm_interface.ntb_input_size));
+            tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size, request->wLength);
+          } else if (stage == CONTROL_STAGE_ACK) {
+            /* CDC-NCM 1.0 Table 6-4, up to NTB16 size */
+            const uint32_t requested_size = ncm_interface.ntb_input_size.dwNtbInMaxSize;
+            if (requested_size < 2048u || requested_size > 65535u) {
               return false;
             }
-            new_datagrams = requested_datagrams;
+            ncm_interface.xmit_max_ntb_size = tu_min16(requested_size, CFG_TUD_NCM_IN_NTB_MAX_SIZE);
 
-            ncm_interface.xmit_max_ntb_size = new_ntb_size;
-            ncm_interface.xmit_max_datagrams = new_datagrams;
+            if (ncm_interface.ntb_input_size.wNtbInMaxDatagrams == 0 || ncm_interface.ntb_input_size.wNtbInMaxDatagrams > CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB) {
+              ncm_interface.xmit_max_datagrams = CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB;
+            } else {
+              ncm_interface.xmit_max_datagrams = ncm_interface.ntb_input_size.wNtbInMaxDatagrams;
+            }
           }
         } break;
 
diff --git a/src/device/usbd.h b/src/device/usbd.h
index a960e2c79..5a21c7039 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1026,18 +1026,18 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 // Length of template descriptor
 #define TUD_CDC_NCM_DESC_LEN  (8+9+5+5+13+6+7+9+9+7+7)
 
-// CDC-ECM Descriptor Template
+// CDC-NCM Descriptor Template
 // Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size, capability.
 #define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize, _capability) \
   /* Interface Association */\
   8, TUSB_DESC_INTERFACE_ASSOCIATION, _itfnum, 2, TUSB_CLASS_CDC, CDC_COMM_SUBCLASS_NETWORK_CONTROL_MODEL, 0, 0,\
   /* CDC Control Interface */\
   9, TUSB_DESC_INTERFACE, _itfnum, 0, 1, TUSB_CLASS_CDC, CDC_COMM_SUBCLASS_NETWORK_CONTROL_MODEL, 0, _desc_stridx,\
-  /* CDC-NCM Header */\
+  /* CDC Header */\
   5, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_HEADER, U16_TO_U8S_LE(0x0110),\
-  /* CDC-NCM Union */\
+  /* CDC Union */\
   5, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_UNION, _itfnum, (uint8_t)((_itfnum) + 1),\
-  /* CDC-NCM Functional Descriptor */\
+  /* CDC Ethernet Networking Descriptor */\
   13, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_ETHERNET_NETWORKING, _mac_stridx, 0, 0, 0, 0, U16_TO_U8S_LE(_maxsegmentsize), U16_TO_U8S_LE(0), 0, \
   /* CDC-NCM Functional Descriptor */\
   6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), _capability, \
-- 
cgit v1.3.1


From eb66712196b54ff5dcf39df020fb0cad72e853d0 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Wed, 29 Apr 2026 22:23:32 +0700
Subject: refactor `usbd.c`: centralize control transfer state management into
 `_usbd_dev` structure and remove `usbd_control_reset`

---
 src/device/usbd.c         | 146 +++++++++++++++++++---------------------------
 src/device/usbd_control.c |  31 ----------
 2 files changed, 61 insertions(+), 116 deletions(-)
 delete mode 100644 src/device/usbd_control.c

(limited to 'src/device')

diff --git a/src/device/usbd.c b/src/device/usbd.c
index acf808bf6..49c8851de 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -115,7 +115,20 @@ TU_ATTR_WEAK bool dcd_dcache_clean_invalidate(const void* addr, uint32_t data_si
 //--------------------------------------------------------------------+
 // Device Data
 //--------------------------------------------------------------------+
+
+// Per-control-transfer state: populated at process_setup_received() entry,
+// consumed asynchronously by usbd_control_xfer_cb() when the EP0 transfer completes.
+typedef struct {
+  tusb_control_request_t request;
+  uint8_t* buffer;
+  uint16_t data_len;
+  uint16_t total_xferred;
+  usbd_control_xfer_cb_t complete_cb;
+} usbd_control_xfer_t;
+
 typedef struct {
+  usbd_control_xfer_t ctrl_xfer;
+
   // Note: these may share an enum state
   volatile uint8_t connected;
   volatile uint8_t addressed;
@@ -142,6 +155,10 @@ typedef struct {
 static usbd_device_t    _usbd_dev;
 static volatile uint8_t _usbd_queued_setup;
 
+CFG_TUD_MEM_SECTION static struct {
+  TUD_EPBUF_DEF(buf, CFG_TUD_ENDPOINT0_BUFSIZE);
+} _ctrl_epbuf;
+
 //--------------------------------------------------------------------+
 // Class Driver
 //--------------------------------------------------------------------+
@@ -405,7 +422,7 @@ TU_ATTR_ALWAYS_INLINE static inline bool queue_event(dcd_event_t const * event,
 //--------------------------------------------------------------------+
 // Prototypes
 //--------------------------------------------------------------------+
-static bool process_control_request(uint8_t rhport, tusb_control_request_t const * p_request);
+static bool process_setup_received(uint8_t rhport, tusb_control_request_t const * p_request);
 static bool process_set_config(uint8_t rhport, uint8_t cfg_num);
 static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const * p_request);
 
@@ -420,8 +437,6 @@ static bool process_test_mode_cb(uint8_t rhport, uint8_t stage, tusb_control_req
 #endif
 
 // Control Endpoint
-static void usbd_control_reset(void);
-static void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp);
 static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
 
 //--------------------------------------------------------------------+
@@ -458,17 +473,6 @@ static char const *const _usbd_event_str[DCD_EVENT_COUNT] = {
     "Func Call"
 };
 
-// for usbd_control to print the name of control complete driver
-void usbd_driver_print_control_complete_name(usbd_control_xfer_cb_t callback) {
-  for (uint8_t i = 0; i < TOTAL_DRIVER_COUNT; i++) {
-    usbd_class_driver_t const* driver = get_driver(i);
-    if (driver && driver->control_xfer_cb == callback) {
-      TU_LOG_USBD("%s control complete\r\n", driver->name);
-      return;
-    }
-  }
-}
-
 #endif
 
 //--------------------------------------------------------------------+
@@ -608,9 +612,7 @@ bool tud_deinit(uint8_t rhport) {
     }
   }
 
-  // Clear device data
-  tu_varclr(&_usbd_dev);
-  usbd_control_reset();
+  tu_varclr(&_usbd_dev); // Clear device data
 
   // Deinit device queue & task
   osal_queue_delete(_usbd_q);
@@ -645,7 +647,6 @@ static void configuration_reset(uint8_t rhport) {
 
 static void usbd_reset(uint8_t rhport) {
   configuration_reset(rhport);
-  usbd_control_reset();
 }
 
 bool tud_task_event_ready(void) {
@@ -731,7 +732,7 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
         _usbd_dev.ep_status[0][TUSB_DIR_IN].claimed = 0;
 
         // Process control request
-        if (!process_control_request(event.rhport, &event.setup_received)) {
+        if (!process_setup_received(event.rhport, &event.setup_received)) {
           TU_LOG_USBD("  Stall EP0\r\n");
           // Failed -> stall both control endpoint IN and OUT
           dcd_edpt_stall(event.rhport, 0);
@@ -817,20 +818,6 @@ TU_ATTR_WEAK void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_r
   (void) request;
 }
 
-typedef struct {
-  tusb_control_request_t request;
-  uint8_t* buffer;
-  uint16_t data_len;
-  uint16_t total_xferred;
-  usbd_control_xfer_cb_t complete_cb;
-} usbd_control_xfer_t;
-
-static usbd_control_xfer_t _ctrl_xfer;
-
-CFG_TUD_MEM_SECTION static struct {
-  TUD_EPBUF_DEF(buf, CFG_TUD_ENDPOINT0_BUFSIZE);
-} _ctrl_epbuf;
-
 uint8_t* usbd_get_ctrl_buf(void) {
   return _ctrl_epbuf.buf;
 }
@@ -850,13 +837,14 @@ TU_ATTR_ALWAYS_INLINE static inline bool status_stage_xact(uint8_t rhport, uint8
 // Queue a transaction in Data Stage. Each transaction has up to Endpoint0's max
 // packet size. This function can also transfer a zero-length packet.
 static bool data_stage_xact(uint8_t rhport) {
-  const uint16_t xact_len = tu_min16(_ctrl_xfer.data_len - _ctrl_xfer.total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
+  usbd_control_xfer_t* const ctrl_xfer = &_usbd_dev.ctrl_xfer;
+  const uint16_t xact_len = tu_min16(ctrl_xfer->data_len - ctrl_xfer->total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
   uint8_t ep_addr = TU_EP0_OUT;
 
-  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_IN) {
+  if (ctrl_xfer->request.bmRequestType_bit.direction == TUSB_DIR_IN) {
     ep_addr = TU_EP0_IN;
-    if (0u != xact_len && _ctrl_xfer.buffer != _ctrl_epbuf.buf) {
-      TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, _ctrl_xfer.buffer, xact_len));
+    if (0u != xact_len && ctrl_xfer->buffer != _ctrl_epbuf.buf) {
+      TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, ctrl_xfer->buffer, xact_len));
     }
   }
 
@@ -865,20 +853,21 @@ static bool data_stage_xact(uint8_t rhport) {
 
 // Status phase
 bool tud_control_status(uint8_t rhport, const tusb_control_request_t* request) {
-  // _ctrl_xfer fields are pre-initialized at process_control_request entry
+  // _usbd_dev.ctrl_xfer fields are pre-initialized at process_setup_received entry
   (void) request;
-  return status_stage_xact(rhport, status_stage_ep(&_ctrl_xfer.request));
+  return status_stage_xact(rhport, status_stage_ep(&_usbd_dev.ctrl_xfer.request));
 }
 
 // Transmit data to/from the control endpoint. If wLength is zero, a status packet is sent instead.
 bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, void* buffer, uint16_t len) {
-  // _ctrl_xfer.request and reset fields are pre-initialized at process_control_request entry
+  // _usbd_dev.ctrl_xfer.request and reset fields are pre-initialized at process_setup_received entry
   (void) request;
-  _ctrl_xfer.buffer = (uint8_t*) buffer;
-  _ctrl_xfer.data_len = tu_min16(len, _ctrl_xfer.request.wLength);
+  usbd_control_xfer_t* const ctrl_xfer = &_usbd_dev.ctrl_xfer;
+  ctrl_xfer->buffer = (uint8_t*) buffer;
+  ctrl_xfer->data_len = tu_min16(len, ctrl_xfer->request.wLength);
 
-  if (_ctrl_xfer.request.wLength > 0U) {
-    if (_ctrl_xfer.data_len > 0U) {
+  if (ctrl_xfer->request.wLength > 0U) {
+    if (ctrl_xfer->data_len > 0U) {
       TU_ASSERT(buffer);
     }
     TU_ASSERT(data_stage_xact(rhport));
@@ -890,57 +879,46 @@ bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, voi
   return true;
 }
 
-static void usbd_control_reset(void) {
-  tu_varclr(&_ctrl_xfer);
-}
-
-static void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp) {
-  _ctrl_xfer.complete_cb = fp;
-}
-
 // Callback when a transaction completes on the DATA stage or Status stage of EP0
 static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
   (void) result;
+  usbd_control_xfer_t* const ctrl_xfer = &_usbd_dev.ctrl_xfer;
 
   // Status Stage complete: ep_addr matches the resolved Status stage endpoint
-  uint8_t const ep_status = status_stage_ep(&_ctrl_xfer.request);
+  uint8_t const ep_status = status_stage_ep(&ctrl_xfer->request);
   if (ep_addr == ep_status) {
     TU_ASSERT(0 == xferred_bytes);
 
     // invoke optional dcd hook if available
-    dcd_edpt0_status_complete(rhport, &_ctrl_xfer.request);
+    dcd_edpt0_status_complete(rhport, &ctrl_xfer->request);
 
-    if (NULL != _ctrl_xfer.complete_cb) {
-      // TODO refactor with usbd_driver_print_control_complete_name
-      _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_ACK, &_ctrl_xfer.request);
+    if (NULL != ctrl_xfer->complete_cb) {
+      ctrl_xfer->complete_cb(rhport, CONTROL_STAGE_ACK, &ctrl_xfer->request);
     }
 
     return true;
   }
 
   // Data stage progress
-  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
-    TU_VERIFY(_ctrl_xfer.buffer);
-    if (_ctrl_xfer.buffer != _ctrl_epbuf.buf) {
-      memcpy(_ctrl_xfer.buffer, _ctrl_epbuf.buf, xferred_bytes);
+  if (ctrl_xfer->request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
+    TU_VERIFY(ctrl_xfer->buffer);
+    if (ctrl_xfer->buffer != _ctrl_epbuf.buf) {
+      memcpy(ctrl_xfer->buffer, _ctrl_epbuf.buf, xferred_bytes);
     }
-    TU_LOG_MEM(CFG_TUD_LOG_LEVEL, _ctrl_xfer.buffer, xferred_bytes, 2);
+    TU_LOG_MEM(CFG_TUD_LOG_LEVEL, ctrl_xfer->buffer, xferred_bytes, 2);
   }
 
-  _ctrl_xfer.total_xferred += (uint16_t) xferred_bytes;
-  _ctrl_xfer.buffer += xferred_bytes;
+  ctrl_xfer->total_xferred += (uint16_t) xferred_bytes;
+  ctrl_xfer->buffer += xferred_bytes;
 
   // Data Stage complete when wLength reached or short packet (incl. ZLP) seen
-  if ((_ctrl_xfer.request.wLength == _ctrl_xfer.total_xferred) ||
+  if ((ctrl_xfer->request.wLength == ctrl_xfer->total_xferred) ||
       (xferred_bytes < CFG_TUD_ENDPOINT0_BUFSIZE)) {
     bool is_ok = true;
 
-    if (NULL != _ctrl_xfer.complete_cb) {
-      #if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
-      usbd_driver_print_control_complete_name(_ctrl_xfer.complete_cb);
-      #endif
+    if (NULL != ctrl_xfer->complete_cb) {
       // Callback can still stall control in status phase, e.g. OUT data doesn't make sense
-      is_ok = _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_DATA, &_ctrl_xfer.request);
+      is_ok = ctrl_xfer->complete_cb(rhport, CONTROL_STAGE_DATA, &ctrl_xfer->request);
     }
 
     if (is_ok) {
@@ -964,27 +942,28 @@ static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t
 
 // Helper to invoke class driver control request handler
 static bool invoke_class_control(uint8_t rhport, usbd_class_driver_t const * driver, tusb_control_request_t const * request) {
-  usbd_control_set_complete_callback(driver->control_xfer_cb);
+  _usbd_dev.ctrl_xfer.complete_cb = driver->control_xfer_cb;
   TU_LOG_USBD("  %s control request\r\n", driver->name);
   return driver->control_xfer_cb(rhport, CONTROL_STAGE_SETUP, request);
 }
 
 // This handles the actual request and its response.
 // Returns false if unable to complete the request, causing caller to stall control endpoints.
-static bool process_control_request(uint8_t rhport, tusb_control_request_t const * p_request) {
+static bool process_setup_received(uint8_t rhport, tusb_control_request_t const * p_request) {
   // Initialize control transfer state for this request. The request copy must be
   // visible to usbd_control_xfer_cb when the (asynchronous) status ZLP completes,
   // since the SETUP packet event has already gone out of scope by then.
-  _ctrl_xfer.request = *p_request;
-  _ctrl_xfer.buffer = NULL;
-  _ctrl_xfer.total_xferred = 0;
-  _ctrl_xfer.data_len = 0;
-  _ctrl_xfer.complete_cb = NULL;
+  usbd_control_xfer_t* const ctrl_xfer = &_usbd_dev.ctrl_xfer;
+  ctrl_xfer->request = *p_request;
+  ctrl_xfer->buffer = NULL;
+  ctrl_xfer->total_xferred = 0;
+  ctrl_xfer->data_len = 0;
+  ctrl_xfer->complete_cb = NULL;
   TU_ASSERT(p_request->bmRequestType_bit.type < TUSB_REQ_TYPE_INVALID);
 
   // Vendor request
   if ( p_request->bmRequestType_bit.type == TUSB_REQ_TYPE_VENDOR ) {
-    usbd_control_set_complete_callback(tud_vendor_control_xfer_cb);
+    ctrl_xfer->complete_cb = tud_vendor_control_xfer_cb;
     return tud_vendor_control_xfer_cb(rhport, CONTROL_STAGE_SETUP, p_request);
   }
 
@@ -1022,8 +1001,6 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
           // Depending on mcu, status phase could be sent either before or after changing device address,
           // or even require stack to not response with status at all
           // Therefore DCD must take full responsibility to response and include zlp status packet if needed.
-          // _ctrl_xfer.request was already populated at process_control_request() entry, so the
-          // status ZLP that the DCD queues will be recognized by usbd_control_xfer_cb().
           dcd_set_address(rhport, (uint8_t) p_request->wValue);
           _usbd_dev.addressed = 1;
         break;
@@ -1092,7 +1069,7 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
               uint8_t const selector = tu_u16_high(p_request->wIndex);
               TU_VERIFY(TUSB_FEATURE_TEST_J <= selector && selector <= TUSB_FEATURE_TEST_FORCE_ENABLE);
 
-              usbd_control_set_complete_callback(process_test_mode_cb);
+              ctrl_xfer->complete_cb = process_test_mode_cb;
               tud_control_status(rhport, p_request);
               break;
             }
@@ -1161,7 +1138,7 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
         TU_VERIFY(TUSB_REQ_TYPE_STANDARD == p_request->bmRequestType_bit.type);
 
         // Clear complete callback if driver set since it can also stall the request.
-        usbd_control_set_complete_callback(NULL);
+        ctrl_xfer->complete_cb = NULL;
 
         switch (p_request->bRequest) { //-V2520
           case TUSB_REQ_GET_INTERFACE: {
@@ -1219,7 +1196,7 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
               // STD request must always be ACKed regardless of driver returned value
               // Also clear complete callback if driver set since it can also stall the request.
               (void) invoke_class_control(rhport, driver, p_request);
-              usbd_control_set_complete_callback(NULL);
+              ctrl_xfer->complete_cb = NULL;
 
               // skip ZLP status if driver already did that
               if (!_usbd_dev.ep_status[0][TUSB_DIR_IN].busy) {
@@ -1301,8 +1278,7 @@ static bool process_set_config(uint8_t rhport, uint8_t cfg_num) {
 }
 
 // return descriptor's buffer and update desc_len
-static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const * p_request)
-{
+static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const * p_request) {
   tusb_desc_type_t const desc_type = (tusb_desc_type_t) tu_u16_high(p_request->wValue);
   uint8_t const desc_index = tu_u16_low( p_request->wValue );
 
diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c
deleted file mode 100644
index 38dcc6a82..000000000
--- a/src/device/usbd_control.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * The MIT License (MIT)
- *
- * Copyright (c) 2019 Ha Thach (tinyusb.org)
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- *
- * This file is part of the TinyUSB stack.
- */
-
-// The usbd control function that used to live in this file has been merged
-// into src/device/usbd.c. This translation unit is intentionally empty and is
-// kept only so external/vendor build systems that still reference the path
-// keep resolving. Drop usbd_control.c from your build to silence the warning.
-#warning "src/device/usbd_control.c is deprecated and now empty; remove it from your build (its content lives in src/device/usbd.c)."
-- 
cgit v1.3.1


From a5e9ce5fbb300702d04c47c7c06436396912d3d6 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 4 May 2026 10:29:29 +0700
Subject: refactor `usbd.c`: extract `process_std_device_request` for clarity

---
 src/device/usbd.c | 223 +++++++++++++++++++++++++++---------------------------
 1 file changed, 113 insertions(+), 110 deletions(-)

(limited to 'src/device')

diff --git a/src/device/usbd.c b/src/device/usbd.c
index 49c8851de..291319709 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -422,6 +422,7 @@ TU_ATTR_ALWAYS_INLINE static inline bool queue_event(dcd_event_t const * event,
 //--------------------------------------------------------------------+
 // Prototypes
 //--------------------------------------------------------------------+
+static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
 static bool process_setup_received(uint8_t rhport, tusb_control_request_t const * p_request);
 static bool process_set_config(uint8_t rhport, uint8_t cfg_num);
 static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const * p_request);
@@ -436,9 +437,6 @@ static bool process_test_mode_cb(uint8_t rhport, uint8_t stage, tusb_control_req
 }
 #endif
 
-// Control Endpoint
-static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
-
 //--------------------------------------------------------------------+
 // Weak stubs: invoked if no strong implementation is available
 //--------------------------------------------------------------------+
@@ -947,6 +945,117 @@ static bool invoke_class_control(uint8_t rhport, usbd_class_driver_t const * dri
   return driver->control_xfer_cb(rhport, CONTROL_STAGE_SETUP, request);
 }
 
+// Process a standard request to the device recipient (extracted from
+// process_setup_received for readability; GCC chooses to inline it).
+static bool process_std_device_request(uint8_t rhport, tusb_control_request_t const * p_request) {
+  switch (p_request->bRequest) { //-V2520
+    case TUSB_REQ_SET_ADDRESS:
+      // Depending on mcu, status phase could be sent either before or after changing device address,
+      // or even require stack to not response with status at all
+      // Therefore DCD must take full responsibility to response and include zlp status packet if needed.
+      dcd_set_address(rhport, (uint8_t) p_request->wValue);
+      _usbd_dev.addressed = 1;
+      return true;
+
+    case TUSB_REQ_GET_CONFIGURATION: {
+      uint8_t cfg_num = _usbd_dev.cfg_num;
+      tud_control_xfer(rhport, p_request, &cfg_num, 1);
+      return true;
+    }
+
+    case TUSB_REQ_SET_CONFIGURATION: {
+      uint8_t const cfg_num = (uint8_t) p_request->wValue;
+
+      // Only process if new configure is different
+      if (_usbd_dev.cfg_num != cfg_num) {
+        if (_usbd_dev.cfg_num != 0) {
+          // already configured: need to clear all endpoints and driver first
+          TU_LOG_USBD("  Clear current Configuration (%u) before switching\r\n", _usbd_dev.cfg_num);
+
+          dcd_sof_enable(rhport, false);
+          dcd_edpt_close_all(rhport);
+
+          // close all drivers and current configured state except bus speed
+          const uint8_t speed = _usbd_dev.speed;
+          configuration_reset(rhport);
+
+          _usbd_dev.speed = speed; // restore speed
+        }
+
+        _usbd_dev.cfg_num = cfg_num;
+
+        // Handle the new configuration
+        if (cfg_num == 0) {
+          tud_umount_cb();
+        } else {
+          if (!process_set_config(rhport, cfg_num)) {
+            _usbd_dev.cfg_num = 0;
+            TU_ASSERT(false);
+          }
+          tud_mount_cb();
+        }
+      }
+
+      tud_control_status(rhport, p_request);
+      return true;
+    }
+
+    case TUSB_REQ_GET_DESCRIPTOR:
+      return process_get_descriptor(rhport, p_request);
+
+    case TUSB_REQ_SET_FEATURE:
+      switch (p_request->wValue) { //-V2520
+        case TUSB_REQ_FEATURE_REMOTE_WAKEUP:
+          TU_LOG_USBD("    Enable Remote Wakeup\r\n");
+          // Host may enable remote wake up before suspending especially HID device
+          _usbd_dev.remote_wakeup_en = 1;
+          tud_control_status(rhport, p_request);
+          return true;
+
+        #if CFG_TUD_TEST_MODE
+        case TUSB_REQ_FEATURE_TEST_MODE: {
+          // Only handle the test mode if supported and valid
+          TU_VERIFY(0 == tu_u16_low(p_request->wIndex));
+
+          uint8_t const selector = tu_u16_high(p_request->wIndex);
+          TU_VERIFY(TUSB_FEATURE_TEST_J <= selector && selector <= TUSB_FEATURE_TEST_FORCE_ENABLE);
+
+          _usbd_dev.ctrl_xfer.complete_cb = process_test_mode_cb;
+          tud_control_status(rhport, p_request);
+          return true;
+        }
+        #endif
+
+        // Stall unsupported feature selector
+        default: return false;
+      }
+
+    case TUSB_REQ_CLEAR_FEATURE:
+      // Only support remote wakeup for device feature
+      TU_VERIFY(TUSB_REQ_FEATURE_REMOTE_WAKEUP == p_request->wValue);
+      TU_LOG_USBD("    Disable Remote Wakeup\r\n");
+
+      // Host may disable remote wake up after resuming
+      _usbd_dev.remote_wakeup_en = 0;
+      tud_control_status(rhport, p_request);
+      return true;
+
+    case TUSB_REQ_GET_STATUS: {
+      // Device status bit mask
+      // - Bit 0: Self Powered TODO must invoke callback to get actual status
+      // - Bit 1: Remote Wakeup enabled
+      uint16_t status = (uint16_t) _usbd_dev.dev_state_bm;
+      tud_control_xfer(rhport, p_request, &status, 2);
+      return true;
+    }
+
+    default:
+      TU_BREAKPOINT();
+      return false;
+  }
+}
+
+
 // This handles the actual request and its response.
 // Returns false if unable to complete the request, causing caller to stall control endpoints.
 static bool process_setup_received(uint8_t rhport, tusb_control_request_t const * p_request) {
@@ -996,113 +1105,7 @@ static bool process_setup_received(uint8_t rhport, tusb_control_request_t const
         return false;
       }
 
-      switch (p_request->bRequest) { //-V2520
-        case TUSB_REQ_SET_ADDRESS:
-          // Depending on mcu, status phase could be sent either before or after changing device address,
-          // or even require stack to not response with status at all
-          // Therefore DCD must take full responsibility to response and include zlp status packet if needed.
-          dcd_set_address(rhport, (uint8_t) p_request->wValue);
-          _usbd_dev.addressed = 1;
-        break;
-
-        case TUSB_REQ_GET_CONFIGURATION: {
-          uint8_t cfg_num = _usbd_dev.cfg_num;
-          tud_control_xfer(rhport, p_request, &cfg_num, 1);
-        }
-        break;
-
-        case TUSB_REQ_SET_CONFIGURATION: {
-          uint8_t const cfg_num = (uint8_t) p_request->wValue;
-
-          // Only process if new configure is different
-          if (_usbd_dev.cfg_num != cfg_num) {
-            if (_usbd_dev.cfg_num != 0) {
-              // already configured: need to clear all endpoints and driver first
-              TU_LOG_USBD("  Clear current Configuration (%u) before switching\r\n", _usbd_dev.cfg_num);
-
-              dcd_sof_enable(rhport, false);
-              dcd_edpt_close_all(rhport);
-
-              // close all drivers and current configured state except bus speed
-              const uint8_t speed = _usbd_dev.speed;
-              configuration_reset(rhport);
-
-              _usbd_dev.speed = speed; // restore speed
-            }
-
-            _usbd_dev.cfg_num = cfg_num;
-
-            // Handle the new configuration
-            if (cfg_num == 0) {
-              tud_umount_cb();
-            } else {
-              if (!process_set_config(rhport, cfg_num)) {
-                _usbd_dev.cfg_num = 0;
-                TU_ASSERT(false);
-              }
-              tud_mount_cb();
-            }
-          }
-
-          tud_control_status(rhport, p_request);
-        }
-        break;
-
-        case TUSB_REQ_GET_DESCRIPTOR:
-          TU_VERIFY(process_get_descriptor(rhport, p_request));
-        break;
-
-        case TUSB_REQ_SET_FEATURE:
-          switch(p_request->wValue) { //-V2520
-            case TUSB_REQ_FEATURE_REMOTE_WAKEUP:
-              TU_LOG_USBD("    Enable Remote Wakeup\r\n");
-              // Host may enable remote wake up before suspending especially HID device
-              _usbd_dev.remote_wakeup_en = 1;
-              tud_control_status(rhport, p_request);
-              break;
-
-            #if CFG_TUD_TEST_MODE
-            case TUSB_REQ_FEATURE_TEST_MODE: {
-              // Only handle the test mode if supported and valid
-              TU_VERIFY(0 == tu_u16_low(p_request->wIndex));
-
-              uint8_t const selector = tu_u16_high(p_request->wIndex);
-              TU_VERIFY(TUSB_FEATURE_TEST_J <= selector && selector <= TUSB_FEATURE_TEST_FORCE_ENABLE);
-
-              ctrl_xfer->complete_cb = process_test_mode_cb;
-              tud_control_status(rhport, p_request);
-              break;
-            }
-            #endif
-
-            // Stall unsupported feature selector
-            default: return false;
-          }
-        break;
-
-        case TUSB_REQ_CLEAR_FEATURE:
-          // Only support remote wakeup for device feature
-          TU_VERIFY(TUSB_REQ_FEATURE_REMOTE_WAKEUP == p_request->wValue);
-          TU_LOG_USBD("    Disable Remote Wakeup\r\n");
-
-          // Host may disable remote wake up after resuming
-          _usbd_dev.remote_wakeup_en = 0;
-          tud_control_status(rhport, p_request);
-          break;
-
-        case TUSB_REQ_GET_STATUS: {
-          // Device status bit mask
-          // - Bit 0: Self Powered TODO must invoke callback to get actual status
-          // - Bit 1: Remote Wakeup enabled
-          uint16_t status = (uint16_t)_usbd_dev.dev_state_bm;
-          tud_control_xfer(rhport, p_request, &status, 2);
-          break;
-        }
-
-        // Unknown/Unsupported request
-        default: TU_BREAKPOINT(); return false;
-      }
-    break;
+      return process_std_device_request(rhport, p_request);
 
     //------------- Class/Interface Specific Request -------------//
     case TUSB_REQ_RCPT_INTERFACE: {
-- 
cgit v1.3.1


From 9d68ed65f7200f155f01416b332c5e9f2340a8b2 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 4 May 2026 11:19:26 +0700
Subject: refactor: replace `tu_edpt_state_t` struct with `uint8_t` and update
 all endpoint state handling methods and accesses

---
 src/class/printer/printer_device.c |  1 -
 src/common/tusb_private.h          | 19 ++++------
 src/device/usbd.c                  | 72 ++++++++++++++++----------------------
 src/host/usbh.c                    | 23 ++++++------
 src/tusb.c                         | 15 ++++----
 5 files changed, 54 insertions(+), 76 deletions(-)

(limited to 'src/device')

diff --git a/src/class/printer/printer_device.c b/src/class/printer/printer_device.c
index d2dc9b163..158455fc9 100644
--- a/src/class/printer/printer_device.c
+++ b/src/class/printer/printer_device.c
@@ -41,7 +41,6 @@ typedef struct {
   uint8_t itf_num;
 
   /*------------- From this point, data is not cleared by bus reset -------------*/
-
   tu_edpt_stream_t rx_stream;
   tu_edpt_stream_t tx_stream;
 
diff --git a/src/common/tusb_private.h b/src/common/tusb_private.h
index 91d213755..a31bf7b03 100644
--- a/src/common/tusb_private.h
+++ b/src/common/tusb_private.h
@@ -46,17 +46,10 @@ extern tusb_role_t _tusb_rhport_role[TUP_USBIP_CONTROLLER_NUM];
 // Endpoint
 //--------------------------------------------------------------------+
 
-enum {
- TU_EDPT_STATE_BUSY    = 0x01,
- TU_EDPT_STATE_STALLED = 0x02,
- TU_EDPT_STATE_CLAIMED = 0x04,
-};
-
-typedef struct TU_ATTR_PACKED {
-  volatile uint8_t busy    : 1;
-  volatile uint8_t stalled : 1;
-  volatile uint8_t claimed : 1;
-} tu_edpt_state_t;
+// Endpoint state bits — manipulate the bare uint8_t with these masks.
+#define TU_EDPT_STATE_BUSY    0x01u
+#define TU_EDPT_STATE_STALLED 0x02u
+#define TU_EDPT_STATE_CLAIMED 0x04u
 
 typedef struct {
   uint8_t  hwid;    // device: rhport, host: daddr
@@ -92,10 +85,10 @@ bool tu_bind_driver_to_ep_itf(uint8_t driver_id, uint8_t ep2drv[][2], uint8_t it
                               const uint8_t *p_desc, uint16_t desc_len);
 
 // Claim an endpoint with provided mutex
-bool tu_edpt_claim(tu_edpt_state_t* ep_state, osal_mutex_t mutex);
+bool tu_edpt_claim(volatile uint8_t* ep_state, osal_mutex_t mutex);
 
 // Release an endpoint with provided mutex
-bool tu_edpt_release(tu_edpt_state_t* ep_state, osal_mutex_t mutex);
+bool tu_edpt_release(volatile uint8_t* ep_state, osal_mutex_t mutex);
 
 //--------------------------------------------------------------------+
 // Endpoint Stream
diff --git a/src/device/usbd.c b/src/device/usbd.c
index 291319709..f8ec51762 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -149,7 +149,7 @@ typedef struct {
   uint8_t itf2drv[CFG_TUD_INTERFACE_MAX];   // map interface number to driver (0xff is invalid)
   uint8_t ep2drv[CFG_TUD_ENDPPOINT_MAX][2]; // map endpoint to driver ( 0xff is invalid ), can use only 4-bit each
 
-  tu_edpt_state_t ep_status[CFG_TUD_ENDPPOINT_MAX][2];
+  volatile uint8_t ep_status[CFG_TUD_ENDPPOINT_MAX][2];
 } usbd_device_t;
 
 static usbd_device_t    _usbd_dev;
@@ -711,7 +711,9 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
         break;
 
       case DCD_EVENT_SETUP_RECEIVED:
-        TU_ASSERT(_usbd_queued_setup > 0,);
+        if (_usbd_queued_setup == 0) {
+          break;
+        }
         _usbd_queued_setup--;
         TU_LOG_BUF(CFG_TUD_LOG_LEVEL, &event.setup_received, 8);
         if (_usbd_queued_setup != 0) {
@@ -723,18 +725,16 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
         // But it is easier to set it every time instead of wasting time to check then set
         _usbd_dev.connected = 1;
 
-        // mark both in & out control as free
-        _usbd_dev.ep_status[0][TUSB_DIR_OUT].busy = 0;
-        _usbd_dev.ep_status[0][TUSB_DIR_OUT].claimed = 0;
-        _usbd_dev.ep_status[0][TUSB_DIR_IN].busy = 0;
-        _usbd_dev.ep_status[0][TUSB_DIR_IN].claimed = 0;
+        // reset ep state
+        _usbd_dev.ep_status[0][TUSB_DIR_OUT] = 0;
+        _usbd_dev.ep_status[0][TUSB_DIR_IN] = 0;
 
         // Process control request
         if (!process_setup_received(event.rhport, &event.setup_received)) {
           TU_LOG_USBD("  Stall EP0\r\n");
           // Failed -> stall both control endpoint IN and OUT
-          dcd_edpt_stall(event.rhport, 0);
-          dcd_edpt_stall(event.rhport, 0 | TUSB_DIR_IN_MASK);
+          dcd_edpt_stall(event.rhport, TU_EP0_OUT);
+          dcd_edpt_stall(event.rhport, TU_EP0_IN);
         }
         break;
 
@@ -746,8 +746,8 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
 
         TU_LOG_USBD("on EP %02X with %u bytes\r\n", ep_addr, (unsigned int) event.xfer_complete.len);
 
-        _usbd_dev.ep_status[epnum][ep_dir].busy = 0;
-        _usbd_dev.ep_status[epnum][ep_dir].claimed = 0;
+        // Clear busy + claimed
+        _usbd_dev.ep_status[epnum][ep_dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
 
         if (0 == epnum) {
           usbd_control_xfer_cb(event.rhport, ep_addr, (xfer_result_t) event.xfer_complete.result, event.xfer_complete.len);
@@ -1202,7 +1202,7 @@ static bool process_setup_received(uint8_t rhport, tusb_control_request_t const
               ctrl_xfer->complete_cb = NULL;
 
               // skip ZLP status if driver already did that
-              if (!_usbd_dev.ep_status[0][TUSB_DIR_IN].busy) {
+              if (!(_usbd_dev.ep_status[0][TUSB_DIR_IN] & TU_EDPT_STATE_BUSY)) {
                 tud_control_status(rhport, p_request);
               }
             }
@@ -1441,15 +1441,15 @@ TU_ATTR_FAST_FUNC void dcd_event_handler(dcd_event_t const* event, bool in_isr)
         usbd_class_driver_t const* driver = get_driver(_usbd_dev.ep2drv[epnum][ep_dir]);
 
         if (driver && driver->xfer_isr) {
-          _usbd_dev.ep_status[epnum][ep_dir].busy = 0;
-          _usbd_dev.ep_status[epnum][ep_dir].claimed = 0;
+          // Clear busy + claimed
+          _usbd_dev.ep_status[epnum][ep_dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
 
           send = !driver->xfer_isr(event->rhport, ep_addr, (xfer_result_t) event->xfer_complete.result, event->xfer_complete.len);
 
           // xfer_isr() is deferred to xfer_cb(), revert busy/claimed status
           if (send) {
-            _usbd_dev.ep_status[epnum][ep_dir].busy = 1;
-            _usbd_dev.ep_status[epnum][ep_dir].claimed = 1;
+            // set busy + claimed
+            _usbd_dev.ep_status[epnum][ep_dir] |= (TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
           }
         }
       }
@@ -1539,9 +1539,7 @@ bool usbd_edpt_claim(uint8_t rhport, uint8_t ep_addr) {
 
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
-  tu_edpt_state_t* ep_state = &_usbd_dev.ep_status[epnum][dir];
-
-  return tu_edpt_claim(ep_state, _usbd_mutex);
+  return tu_edpt_claim(&_usbd_dev.ep_status[epnum][dir], _usbd_mutex);
 }
 
 bool usbd_edpt_release(uint8_t rhport, uint8_t ep_addr) {
@@ -1549,9 +1547,7 @@ bool usbd_edpt_release(uint8_t rhport, uint8_t ep_addr) {
 
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
-  tu_edpt_state_t* ep_state = &_usbd_dev.ep_status[epnum][dir];
-
-  return tu_edpt_release(ep_state, _usbd_mutex);
+  return tu_edpt_release(&_usbd_dev.ep_status[epnum][dir], _usbd_mutex);
 }
 
 bool usbd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t* buffer, uint16_t total_bytes, bool is_isr) {
@@ -1571,18 +1567,17 @@ bool usbd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t* buffer, uint16_t t
 #endif
 
   // Attempt to transfer on a busy endpoint, sound like an race condition !
-  TU_ASSERT(_usbd_dev.ep_status[epnum][dir].busy == 0);
+  TU_ASSERT((_usbd_dev.ep_status[epnum][dir] & TU_EDPT_STATE_BUSY) == 0);
 
   // Set busy first since the actual transfer can be complete before dcd_edpt_xfer()
   // could return and USBD task can preempt and clear the busy
-  _usbd_dev.ep_status[epnum][dir].busy = 1;
+  _usbd_dev.ep_status[epnum][dir] |= TU_EDPT_STATE_BUSY;
 
   if (dcd_edpt_xfer(rhport, ep_addr, buffer, total_bytes, is_isr)) {
     return true;
   } else {
     // DCD error, mark endpoint as ready to allow next transfer
-    _usbd_dev.ep_status[epnum][dir].busy = 0;
-    _usbd_dev.ep_status[epnum][dir].claimed = 0;
+    _usbd_dev.ep_status[epnum][dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
     TU_LOG_USBD("FAILED\r\n");
     TU_BREAKPOINT();
     return false;
@@ -1603,19 +1598,18 @@ bool usbd_edpt_xfer_fifo(uint8_t rhport, uint8_t ep_addr, tu_fifo_t* ff, uint16_
   TU_LOG_USBD("  Queue FIFO EP %02X with %u bytes ... ", ep_addr, total_bytes);
 
   // Attempt to transfer on a busy endpoint, sound like a race condition !
-  TU_ASSERT(_usbd_dev.ep_status[epnum][dir].busy == 0);
+  TU_ASSERT((_usbd_dev.ep_status[epnum][dir] & TU_EDPT_STATE_BUSY) == 0);
 
   // Set busy first since the actual transfer can be complete before dcd_edpt_xfer() could return
   // and usbd task can preempt and clear the busy
-  _usbd_dev.ep_status[epnum][dir].busy = 1;
+  _usbd_dev.ep_status[epnum][dir] |= TU_EDPT_STATE_BUSY;
 
   if (dcd_edpt_xfer_fifo(rhport, ep_addr, ff, total_bytes, is_isr)) {
     TU_LOG_USBD("OK\r\n");
     return true;
   } else {
     // DCD error, mark endpoint as ready to allow next transfer
-    _usbd_dev.ep_status[epnum][dir].busy = 0;
-    _usbd_dev.ep_status[epnum][dir].claimed = 0;
+    _usbd_dev.ep_status[epnum][dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
     TU_LOG_USBD("failed\r\n");
     TU_BREAKPOINT();
     return false;
@@ -1636,7 +1630,7 @@ bool usbd_edpt_busy(uint8_t rhport, uint8_t ep_addr) {
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
 
-  return _usbd_dev.ep_status[epnum][dir].busy;
+  return (_usbd_dev.ep_status[epnum][dir] & TU_EDPT_STATE_BUSY) != 0;
 }
 
 void usbd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
@@ -1648,8 +1642,7 @@ void usbd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
   // only stalled if currently cleared
   TU_LOG_USBD("    Stall EP %02X\r\n", ep_addr);
   dcd_edpt_stall(rhport, ep_addr);
-  _usbd_dev.ep_status[epnum][dir].stalled = 1;
-  _usbd_dev.ep_status[epnum][dir].busy = 1;
+  _usbd_dev.ep_status[epnum][dir] |= (TU_EDPT_STATE_STALLED | TU_EDPT_STATE_BUSY);
 }
 
 void usbd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
@@ -1661,8 +1654,7 @@ void usbd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
   // only clear if currently stalled
   TU_LOG_USBD("    Clear Stall EP %02X\r\n", ep_addr);
   dcd_edpt_clear_stall(rhport, ep_addr);
-  _usbd_dev.ep_status[epnum][dir].stalled = 0;
-  _usbd_dev.ep_status[epnum][dir].busy = 0;
+  _usbd_dev.ep_status[epnum][dir] &= (uint8_t) ~(TU_EDPT_STATE_STALLED | TU_EDPT_STATE_BUSY);
 }
 
 bool usbd_edpt_stalled(uint8_t rhport, uint8_t ep_addr) {
@@ -1671,7 +1663,7 @@ bool usbd_edpt_stalled(uint8_t rhport, uint8_t ep_addr) {
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
 
-  return _usbd_dev.ep_status[epnum][dir].stalled;
+  return (_usbd_dev.ep_status[epnum][dir] & TU_EDPT_STATE_STALLED) != 0;
 }
 
 /**
@@ -1691,9 +1683,7 @@ void usbd_edpt_close(uint8_t rhport, uint8_t ep_addr) {
   uint8_t const dir = tu_edpt_dir(ep_addr);
 
   dcd_edpt_close(rhport, ep_addr);
-  _usbd_dev.ep_status[epnum][dir].stalled = 0;
-  _usbd_dev.ep_status[epnum][dir].busy = 0;
-  _usbd_dev.ep_status[epnum][dir].claimed = 0;
+  _usbd_dev.ep_status[epnum][dir] = 0;
 #endif
 
   return;
@@ -1738,9 +1728,7 @@ bool usbd_edpt_iso_activate(uint8_t rhport, tusb_desc_endpoint_t const* desc_ep)
   TU_ASSERT(epnum < CFG_TUD_ENDPPOINT_MAX);
   TU_ASSERT(tu_edpt_validate(desc_ep, (tusb_speed_t)_usbd_dev.speed));
 
-  _usbd_dev.ep_status[epnum][dir].stalled = 0;
-  _usbd_dev.ep_status[epnum][dir].busy = 0;
-  _usbd_dev.ep_status[epnum][dir].claimed = 0;
+  _usbd_dev.ep_status[epnum][dir] = 0;
   return dcd_edpt_iso_activate(rhport, desc_ep);
 #else
   (void) rhport; (void) desc_ep;
diff --git a/src/host/usbh.c b/src/host/usbh.c
index 8f80800e9..490724b02 100644
--- a/src/host/usbh.c
+++ b/src/host/usbh.c
@@ -140,7 +140,7 @@ typedef struct {
   uint8_t itf2drv[CFG_TUH_INTERFACE_MAX];  // map interface number to driver (0xff is invalid)
   uint8_t ep2drv[CFG_TUH_ENDPOINT_MAX][2]; // map endpoint to driver ( 0xff is invalid ), can use only 4-bit each
 
-  tu_edpt_state_t ep_status[CFG_TUH_ENDPOINT_MAX][2];
+  volatile uint8_t ep_status[CFG_TUH_ENDPOINT_MAX][2];
 
 #if CFG_TUH_API_EDPT_XFER
   // TODO array can be CFG_TUH_ENDPOINT_MAX-1
@@ -744,8 +744,8 @@ void tuh_task_ext(uint32_t timeout_ms, bool in_isr) {
           usbh_device_t* dev = get_device(event.dev_addr);
           TU_VERIFY(dev && dev->connected,);
 
-          dev->ep_status[epnum][ep_dir].busy = 0;
-          dev->ep_status[epnum][ep_dir].claimed = 0;
+          // clear busy and claimed
+          dev->ep_status[epnum][ep_dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
 
           if (0 == epnum) {
             usbh_control_xfer_cb(event.dev_addr, ep_addr, (xfer_result_t) event.xfer_complete.result, event.xfer_complete.len);
@@ -1016,10 +1016,10 @@ bool tuh_edpt_abort_xfer(uint8_t daddr, uint8_t ep_addr) {
     usbh_device_t* dev = get_device(daddr);
     TU_VERIFY(dev);
 
-    TU_VERIFY(dev->ep_status[epnum][dir].busy); // non-control skip if not busy
+    TU_VERIFY(dev->ep_status[epnum][dir] & TU_EDPT_STATE_BUSY); // non-control skip if not busy
     // abort then mark as ready and release endpoint
     hcd_edpt_abort_xfer(dev->bus_info.rhport, daddr, ep_addr);
-    dev->ep_status[epnum][dir].busy = false;
+    dev->ep_status[epnum][dir] &= (uint8_t) ~TU_EDPT_STATE_BUSY; // clear busy
     tu_edpt_release(&dev->ep_status[epnum][dir], _usbh_mutex);
   }
 
@@ -1110,16 +1110,16 @@ bool usbh_edpt_xfer_with_callback(uint8_t dev_addr, uint8_t ep_addr, uint8_t* bu
 
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
-  tu_edpt_state_t* ep_state = &dev->ep_status[epnum][dir];
+  volatile uint8_t* ep_state = &dev->ep_status[epnum][dir];
 
   TU_LOG_USBH("  Queue EP %02X with %u bytes ... \r\n", ep_addr, total_bytes);
 
   // Attempt to transfer on a busy endpoint, sound like an race condition !
-  TU_ASSERT(ep_state->busy == 0);
+  TU_ASSERT((*ep_state & TU_EDPT_STATE_BUSY) == 0);
 
   // Set busy first since the actual transfer can be complete before hcd_edpt_xfer()
   // could return and USBH task can preempt and clear the busy
-  ep_state->busy = 1;
+  *ep_state |= TU_EDPT_STATE_BUSY;
 
 #if CFG_TUH_API_EDPT_XFER
   dev->ep_callback[epnum][dir].complete_cb = complete_cb;
@@ -1130,9 +1130,8 @@ bool usbh_edpt_xfer_with_callback(uint8_t dev_addr, uint8_t ep_addr, uint8_t* bu
     TU_LOG_USBH("OK\r\n");
     return true;
   } else {
-    // HCD error, mark endpoint as ready to allow next transfer
-    ep_state->busy = 0;
-    ep_state->claimed = 0;
+    // HCD error, clear busy and claimed to allow next transfer
+    *ep_state &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
     TU_LOG1("Failed\r\n");
 //    TU_BREAKPOINT();
     return false;
@@ -1178,7 +1177,7 @@ bool usbh_edpt_busy(uint8_t dev_addr, uint8_t ep_addr) {
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
 
-  return dev->ep_status[epnum][dir].busy;
+  return (dev->ep_status[epnum][dir] & TU_EDPT_STATE_BUSY) != 0;
 }
 
 //--------------------------------------------------------------------+
diff --git a/src/tusb.c b/src/tusb.c
index 5e4422e41..5d656fb8c 100644
--- a/src/tusb.c
+++ b/src/tusb.c
@@ -224,32 +224,31 @@ uint8_t const* tu_desc_find3(uint8_t const* desc, uint8_t const* end, uint8_t by
 // Endpoint Helper for both Host and Device stack
 //--------------------------------------------------------------------+
 
-bool tu_edpt_claim(tu_edpt_state_t* ep_state, osal_mutex_t mutex) {
+bool tu_edpt_claim(volatile uint8_t* ep_state, osal_mutex_t mutex) {
   (void) mutex;
 
   // pre-check to help reducing mutex lock
-  TU_VERIFY(ep_state->busy == 0);
-  TU_VERIFY(ep_state->claimed == 0);
+  TU_VERIFY((*ep_state & (TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED)) == 0);
   (void) osal_mutex_lock(mutex, OSAL_TIMEOUT_WAIT_FOREVER);
 
   // can only claim the endpoint if it is not busy and not claimed yet.
-  bool const available = (ep_state->busy == 0) && (ep_state->claimed == 0);
+  bool const available = (*ep_state & (TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED)) == 0;
   if (available) {
-    ep_state->claimed = 1;
+    *ep_state |= TU_EDPT_STATE_CLAIMED;
   }
 
   (void) osal_mutex_unlock(mutex);
   return available;
 }
 
-bool tu_edpt_release(tu_edpt_state_t* ep_state, osal_mutex_t mutex) {
+bool tu_edpt_release(volatile uint8_t* ep_state, osal_mutex_t mutex) {
   (void) mutex;
   (void) osal_mutex_lock(mutex, OSAL_TIMEOUT_WAIT_FOREVER);
 
   // can only release the endpoint if it is claimed and not busy
-  bool const ret = (ep_state->claimed == 1) && (ep_state->busy == 0);
+  bool const ret = (*ep_state & (TU_EDPT_STATE_CLAIMED | TU_EDPT_STATE_BUSY)) == TU_EDPT_STATE_CLAIMED;
   if (ret) {
-    ep_state->claimed = 0;
+    *ep_state &= (uint8_t) ~TU_EDPT_STATE_CLAIMED;
   }
 
   (void) osal_mutex_unlock(mutex);
-- 
cgit v1.3.1


From e954302c103b4fc6870c6914945e6da1f62f6423 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 4 May 2026 13:39:39 +0700
Subject: fix usbd control to support wLength hack

---
 src/device/usbd.c     | 17 ++++++++---------
 src/device/usbd_pvt.h |  4 ----
 2 files changed, 8 insertions(+), 13 deletions(-)

(limited to 'src/device')

diff --git a/src/device/usbd.c b/src/device/usbd.c
index f8ec51762..0e58f70bf 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -945,8 +945,7 @@ static bool invoke_class_control(uint8_t rhport, usbd_class_driver_t const * dri
   return driver->control_xfer_cb(rhport, CONTROL_STAGE_SETUP, request);
 }
 
-// Process a standard request to the device recipient (extracted from
-// process_setup_received for readability; GCC chooses to inline it).
+// Process a standard request to the device recipient.
 static bool process_std_device_request(uint8_t rhport, tusb_control_request_t const * p_request) {
   switch (p_request->bRequest) { //-V2520
     case TUSB_REQ_SET_ADDRESS:
@@ -1068,6 +1067,8 @@ static bool process_setup_received(uint8_t rhport, tusb_control_request_t const
   ctrl_xfer->total_xferred = 0;
   ctrl_xfer->data_len = 0;
   ctrl_xfer->complete_cb = NULL;
+
+  p_request = &ctrl_xfer->request; // re-direct request pointer to internal copy (modifiable for hacking)
   TU_ASSERT(p_request->bmRequestType_bit.type < TUSB_REQ_TYPE_INVALID);
 
   // Vendor request
@@ -1289,20 +1290,18 @@ static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const
     case TUSB_DESC_DEVICE: {
       TU_LOG_USBD(" Device\r\n");
 
-      void* desc_device = (void*) (uintptr_t) tud_descriptor_device_cb();
+      void *desc_device = (void *)(uintptr_t)tud_descriptor_device_cb();
       TU_ASSERT(desc_device);
 
       // Only response with exactly 1 Packet if: not addressed and host requested more data than device descriptor has.
       // This only happens with the very first get device descriptor and EP0 size = 8 or 16.
       if ((CFG_TUD_ENDPOINT0_SIZE < sizeof(tusb_desc_device_t)) && !_usbd_dev.addressed &&
-          ((tusb_control_request_t const*) p_request)->wLength > sizeof(tusb_desc_device_t)) {
+          p_request->wLength > sizeof(tusb_desc_device_t)) {
         // Hack here: we modify the request length to prevent usbd_control response with zlp
         // since we are responding with 1 packet & less data than wLength.
-        tusb_control_request_t mod_request = *p_request;
-        mod_request.wLength = CFG_TUD_ENDPOINT0_SIZE;
-
-        return tud_control_xfer(rhport, &mod_request, desc_device, CFG_TUD_ENDPOINT0_SIZE);
-      }else {
+        ((tusb_control_request_t *)(uintptr_t)p_request)->wLength = CFG_TUD_ENDPOINT0_SIZE;
+        return tud_control_xfer(rhport, p_request, desc_device, CFG_TUD_ENDPOINT0_SIZE);
+      } else {
         return tud_control_xfer(rhport, p_request, desc_device, sizeof(tusb_desc_device_t));
       }
     }
diff --git a/src/device/usbd_pvt.h b/src/device/usbd_pvt.h
index 5f11ea481..be778f9af 100644
--- a/src/device/usbd_pvt.h
+++ b/src/device/usbd_pvt.h
@@ -130,10 +130,6 @@ void usbd_sof_enable(uint8_t rhport, sof_consumer_t consumer, bool en);
 bool usbd_open_edpt_pair(uint8_t rhport, uint8_t const* p_desc, uint8_t ep_count, uint8_t xfer_type, uint8_t* ep_out, uint8_t* ep_in);
 void usbd_defer_func(osal_task_func_t func, void *param, bool in_isr);
 
-#if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
-void usbd_driver_print_control_complete_name(usbd_control_xfer_cb_t callback);
-#endif
-
 #ifdef __cplusplus
  }
 #endif
-- 
cgit v1.3.1


From bc8ce76ae800b312b4d3ef591cc42e8726e68d7f Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Tue, 24 Mar 2026 23:37:48 -0300
Subject: feat: add MIDI 2.0 Device class driver (USB-MIDI 2.0)

Add native USB-MIDI 2.0 Device class driver to TinyUSB. Implements the
USB-MIDI 2.0 specification with both Alt Setting 0 (MIDI 1.0 fallback)
and Alt Setting 1 (UMP native) descriptor support.

Driver features:
- UMP (Universal MIDI Packet) read/write with atomic message framing
- Protocol negotiation: Endpoint Discovery, Config Request/Notify,
  Function Block Discovery (embedded in driver)
- Group Terminal Block descriptor via GET_DESCRIPTOR
- Alt Setting switch handler with endpoint re-arm
- Static allocation, no dynamic memory, ISR-safe

Build system:
- Register midi2d_* in usbd.c driver table
- Add TUD_MIDI2_DESCRIPTOR macros to usbd.h
- Add config defaults (CFG_TUD_MIDI2_*) to tusb_option.h
- Add midi2_ump_word_count() to midi.h (shared by Device and Host)
- Add midi2_device.c/h to family.cmake and CMakeLists.txt
- Add midi2_device.h include to tusb.h

All changes guarded by #if CFG_TUD_MIDI2 (default 0). Zero impact on
existing drivers and examples.

Tested: Raspberry Pi Pico (RP2040), Linux ALSA, Windows MIDI Services
---
 hw/bsp/rp2040/family.cmake    |   2 +
 src/CMakeLists.txt            |   2 +
 src/class/midi/midi.h         |  18 ++
 src/class/midi/midi2_device.c | 604 ++++++++++++++++++++++++++++++++++++++++++
 src/class/midi/midi2_device.h | 125 +++++++++
 src/device/usbd.c             |  14 +
 src/device/usbd.h             |  37 +++
 src/tusb.h                    |   8 +
 src/tusb_option.h             |  52 ++++
 9 files changed, 862 insertions(+)
 create mode 100644 src/class/midi/midi2_device.c
 create mode 100644 src/class/midi/midi2_device.h

(limited to 'src/device')

diff --git a/hw/bsp/rp2040/family.cmake b/hw/bsp/rp2040/family.cmake
index 075582554..aab9a4fae 100644
--- a/hw/bsp/rp2040/family.cmake
+++ b/hw/bsp/rp2040/family.cmake
@@ -99,6 +99,7 @@ target_sources(tinyusb_device_base INTERFACE
 		${TOP}/src/class/dfu/dfu_rt_device.c
 		${TOP}/src/class/hid/hid_device.c
 		${TOP}/src/class/midi/midi_device.c
+		${TOP}/src/class/midi/midi2_device.c
 		${TOP}/src/class/msc/msc_device.c
 		${TOP}/src/class/mtp/mtp_device.c
 		${TOP}/src/class/net/ecm_rndis_device.c
@@ -121,6 +122,7 @@ target_sources(tinyusb_host_base INTERFACE
 		${TOP}/src/class/cdc/cdc_host.c
 		${TOP}/src/class/hid/hid_host.c
 		${TOP}/src/class/midi/midi_host.c
+		${TOP}/src/class/midi/midi2_host.c
 		${TOP}/src/class/msc/msc_host.c
 		${TOP}/src/class/vendor/vendor_host.c
 		)
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index c7a5184c5..b3e05f60f 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -14,6 +14,7 @@ function(tinyusb_sources_get OUTPUT_VAR)
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/dfu/dfu_rt_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/hid/hid_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi_device.c
+    ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi2_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/msc/msc_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/mtp/mtp_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/net/ecm_rndis_device.c
@@ -28,6 +29,7 @@ function(tinyusb_sources_get OUTPUT_VAR)
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/cdc/cdc_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/hid/hid_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi_host.c
+    ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi2_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/msc/msc_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/vendor/vendor_host.c
     # typec
diff --git a/src/class/midi/midi.h b/src/class/midi/midi.h
index cd67640e4..8121ec016 100644
--- a/src/class/midi/midi.h
+++ b/src/class/midi/midi.h
@@ -185,6 +185,24 @@ typedef midi_desc_cs_endpoint_n_t(1) midi_desc_cs_endpoint_1jack_t;
 
 TU_VERIFY_STATIC(sizeof(midi_desc_cs_endpoint_1jack_t) == 4+1, "size is not correct");
 
+//--------------------------------------------------------------------+
+// MIDI 2.0 UMP Helpers
+//--------------------------------------------------------------------+
+
+// Return the number of 32-bit words for a UMP message given its Message Type
+static inline uint8_t midi2_ump_word_count(uint8_t mt) {
+  switch (mt) {
+    case 0x0: case 0x1: case 0x2: case 0x6: case 0x7:
+      return 1;
+    case 0x3: case 0x4: case 0x8: case 0x9: case 0xA:
+      return 2;
+    case 0xB: case 0xC:
+      return 3;
+    default: // 0x5, 0xD, 0xE, 0xF
+      return 4;
+  }
+}
+
 //--------------------------------------------------------------------+
 // For Internal Driver Use
 //--------------------------------------------------------------------+
diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
new file mode 100644
index 000000000..9363aac11
--- /dev/null
+++ b/src/class/midi/midi2_device.c
@@ -0,0 +1,604 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2026 Saulo Verissimo
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * This file is part of the TinyUSB stack.
+ */
+
+#include "tusb_option.h"
+
+#if CFG_TUD_ENABLED && CFG_TUD_MIDI2
+
+#include <string.h>
+
+#include "device/usbd.h"
+#include "device/usbd_pvt.h"
+#include "midi2_device.h"
+
+//--------------------------------------------------------------------+
+// Weak stubs
+//--------------------------------------------------------------------+
+TU_ATTR_WEAK void tud_midi2_rx_cb(uint8_t itf) { (void) itf; }
+TU_ATTR_WEAK void tud_midi2_set_itf_cb(uint8_t itf, uint8_t alt) { (void) itf; (void) alt; }
+TU_ATTR_WEAK bool tud_midi2_get_req_itf_cb(uint8_t rhport, const tusb_control_request_t* request) {
+  (void) rhport; (void) request; return false;
+}
+
+//--------------------------------------------------------------------+
+// UMP Stream Message Constants
+//--------------------------------------------------------------------+
+// UMP Message Type for Stream messages (bits 31:28)
+enum {
+  MT_STREAM                 = 0x0F,
+};
+
+// UMP Stream Status values (10-bit, bits 25:16)
+enum {
+  STREAM_ENDPOINT_DISCOVERY = 0x000,
+  STREAM_ENDPOINT_INFO      = 0x001,
+  STREAM_EP_NAME            = 0x003,
+  STREAM_PROD_INSTANCE_ID   = 0x004,
+  STREAM_CONFIG_REQUEST     = 0x005,
+  STREAM_CONFIG_NOTIFY      = 0x006,
+  STREAM_FB_DISCOVERY       = 0x010,
+  STREAM_FB_INFO            = 0x011,
+};
+
+// MIDI Protocol values (per USB-MIDI 2.0 spec)
+enum {
+  MIDI_PROTOCOL_MIDI1       = 0x01,
+  MIDI_PROTOCOL_MIDI2       = 0x02,
+};
+
+enum {
+  UMP_VER_MAJOR = 1,
+  UMP_VER_MINOR = 1,
+};
+
+// Group Terminal Block descriptor types (USB-MIDI 2.0)
+enum {
+  MIDI2_CS_GRP_TRM_BLOCK      = 0x26,
+  MIDI2_GRP_TRM_BLOCK_HEADER  = 0x01,
+  MIDI2_GRP_TRM_BLOCK_ENTRY   = 0x02,
+};
+
+//--------------------------------------------------------------------+
+// MACRO CONSTANT TYPEDEF
+//--------------------------------------------------------------------+
+typedef struct {
+  uint8_t rhport;
+  uint8_t itf_num;
+  uint8_t alt_setting;
+  uint8_t protocol;
+  bool    negotiated;
+
+  /*------------- From this point, data is not cleared by bus reset -------------*/
+  struct {
+    tu_edpt_stream_t tx;
+    tu_edpt_stream_t rx;
+
+    uint8_t rx_ff_buf[CFG_TUD_MIDI2_RX_BUFSIZE];
+    uint8_t tx_ff_buf[CFG_TUD_MIDI2_TX_BUFSIZE];
+  } ep_stream;
+} midi2d_interface_t;
+
+TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_GROUPS >= 1 && CFG_TUD_MIDI2_NUM_GROUPS <= 16,
+                 "CFG_TUD_MIDI2_NUM_GROUPS must be 1..16");
+TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS >= 1 && CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS <= 32,
+                 "CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS must be 1..32");
+
+#define ITF_MEM_RESET_SIZE offsetof(midi2d_interface_t, ep_stream)
+
+static midi2d_interface_t _midi2d_itf[CFG_TUD_MIDI2];
+
+#if CFG_TUD_EDPT_DEDICATED_HWFIFO == 0
+typedef struct {
+  TUD_EPBUF_DEF(epin, CFG_TUD_MIDI2_TX_EPSIZE);
+  TUD_EPBUF_DEF(epout, CFG_TUD_MIDI2_RX_EPSIZE);
+} midi2d_epbuf_t;
+
+CFG_TUD_MEM_SECTION static midi2d_epbuf_t _midi2d_epbuf[CFG_TUD_MIDI2];
+#endif
+
+// Default Group Terminal Block descriptor (USB-MIDI 2.0 spec, Table 5-5/5-6)
+static const uint8_t _default_gtb_desc[] = {
+  // GTB Header (5 bytes)
+  5,                                        // bLength
+  MIDI2_CS_GRP_TRM_BLOCK,                   // bDescriptorType
+  MIDI2_GRP_TRM_BLOCK_HEADER,               // bDescriptorSubtype
+  U16_TO_U8S_LE(18),                        // wTotalLength (5 + 13 = 18)
+
+  // GTB Entry (13 bytes)
+  13,                                       // bLength
+  MIDI2_CS_GRP_TRM_BLOCK,                   // bDescriptorType
+  MIDI2_GRP_TRM_BLOCK_ENTRY,                // bDescriptorSubtype
+  1,                                        // bGrpTrmBlkID
+  0x00,                                     // bGrpTrmBlkType: bidirectional
+  0x00,                                     // nGroupTrm: first group (0)
+  CFG_TUD_MIDI2_NUM_GROUPS,                 // nNumGroupTrm
+  0,                                        // iBlockItem: no string
+  0x00,                                     // bMIDIProtocol: unknown/not fixed
+  0, 0,                                     // wMaxInputBandwidth: unknown
+  0, 0                                      // wMaxOutputBandwidth: unknown
+};
+
+//--------------------------------------------------------------------+
+// Protocol Negotiation
+//--------------------------------------------------------------------+
+static void _nego_send_ump(midi2d_interface_t* p_midi, const uint32_t* words, uint8_t count) {
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  if (!tu_edpt_stream_is_opened(ep_tx)) return;
+  if (tu_edpt_stream_write_available(ep_tx) < count * 4) return;
+  tu_edpt_stream_write(ep_tx, words, count * 4);
+  tu_edpt_stream_write_xfer(ep_tx);
+}
+
+static void _nego_send_endpoint_info(midi2d_interface_t* p_midi) {
+  uint32_t msg[4] = {0};
+  msg[0] = ((uint32_t) MT_STREAM << 28)
+         | ((uint32_t) STREAM_ENDPOINT_INFO << 16)
+         | ((uint32_t) UMP_VER_MAJOR << 8)
+         | (uint32_t) UMP_VER_MINOR;
+  msg[1] = (1u << 31)  // Static Function Blocks flag
+         | ((uint32_t)(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS & 0x7F) << 24)
+         | (1u << 9)   // MIDI 2.0 Protocol capability
+         | (1u << 8);  // MIDI 1.0 Protocol capability
+  _nego_send_ump(p_midi, msg, 4);
+}
+
+static void _nego_send_stream_text(midi2d_interface_t* p_midi, uint16_t status, const char* str) {
+  if (!str || str[0] == '\0') return;
+
+  uint16_t total_len = (uint16_t) strlen(str);
+  uint16_t offset = 0;
+
+  while (offset < total_len) {
+    uint16_t remaining = total_len - offset;
+    uint8_t n = (uint8_t)((remaining > 14) ? 14 : remaining);
+    bool is_first = (offset == 0);
+    bool is_last  = (remaining <= 14);
+
+    uint8_t form;
+    if (is_first && is_last) form = 0;
+    else if (is_first)       form = 1;
+    else if (is_last)        form = 3;
+    else                     form = 2;
+
+    uint32_t msg[4] = {0};
+    msg[0] = ((uint32_t) MT_STREAM << 28)
+           | ((uint32_t) form << 26)
+           | ((uint32_t) status << 16);
+
+    const char* p = str + offset;
+    if (n > 0) msg[0] |= ((uint32_t)(uint8_t) p[0] << 8);
+    if (n > 1) msg[0] |= (uint32_t)(uint8_t) p[1];
+    for (uint8_t i = 2; i < n; i++) {
+      uint8_t word_idx = (uint8_t)(1 + (i - 2) / 4);
+      uint8_t shift    = (uint8_t)(24 - ((i - 2) % 4) * 8);
+      msg[word_idx] |= ((uint32_t)(uint8_t) p[i] << shift);
+    }
+
+    _nego_send_ump(p_midi, msg, 4);
+    offset += n;
+  }
+}
+
+static void _nego_send_config_notify(midi2d_interface_t* p_midi, uint8_t protocol) {
+  uint32_t msg[4] = {0};
+  msg[0] = ((uint32_t) MT_STREAM << 28)
+         | ((uint32_t) STREAM_CONFIG_NOTIFY << 16)
+         | ((uint32_t) protocol << 8);
+  _nego_send_ump(p_midi, msg, 4);
+}
+
+static void _nego_send_fb_info(midi2d_interface_t* p_midi, uint8_t fb_idx) {
+  uint32_t msg[4] = {0};
+  msg[0] = ((uint32_t) MT_STREAM << 28)
+         | ((uint32_t) STREAM_FB_INFO << 16)
+         | (1u << 15)
+         | ((uint32_t) fb_idx << 8)
+         | 0x02;  // bDirection: bidirectional
+  msg[1] = ((uint32_t) 0 << 24)  // bFirstGroup
+         | ((uint32_t) CFG_TUD_MIDI2_NUM_GROUPS << 16);
+  _nego_send_ump(p_midi, msg, 4);
+}
+
+static void _nego_handle_stream_msg(midi2d_interface_t* p_midi, const uint32_t* words) {
+  uint16_t status = (words[0] >> 16) & 0x3FF;
+
+  switch (status) {
+    case STREAM_ENDPOINT_DISCOVERY:
+      _nego_send_endpoint_info(p_midi);
+      _nego_send_stream_text(p_midi, STREAM_EP_NAME, CFG_TUD_MIDI2_EP_NAME);
+      _nego_send_stream_text(p_midi, STREAM_PROD_INSTANCE_ID, CFG_TUD_MIDI2_PRODUCT_ID);
+      break;
+
+    case STREAM_CONFIG_REQUEST: {
+      uint8_t req_proto = (words[0] >> 8) & 0xFF;
+      if (req_proto == MIDI_PROTOCOL_MIDI1 || req_proto == MIDI_PROTOCOL_MIDI2) {
+        p_midi->protocol = req_proto;
+      }
+      _nego_send_config_notify(p_midi, p_midi->protocol);
+      p_midi->negotiated = true;
+      break;
+    }
+
+    case STREAM_FB_DISCOVERY: {
+      uint8_t fb_idx = (words[0] >> 8) & 0xFF;
+      if (fb_idx == 0xFF) {
+        for (uint8_t f = 0; f < CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS; f++) {
+          _nego_send_fb_info(p_midi, f);
+        }
+      } else if (fb_idx < CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS) {
+        _nego_send_fb_info(p_midi, fb_idx);
+      }
+      break;
+    }
+
+    default:
+      break;
+  }
+}
+
+static void _nego_process_rx(midi2d_interface_t* p_midi) {
+  tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
+  uint8_t first_byte;
+
+  while (tu_edpt_stream_peek(ep_rx, &first_byte)) {
+    uint8_t mt = (first_byte >> 4) & 0x0F;
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+    uint32_t pkt_bytes = (uint32_t)pkt_words * 4;
+
+    if (mt != MT_STREAM) break;
+    if (tu_edpt_stream_read_available(ep_rx) < pkt_bytes) break;
+
+    uint32_t buf[4] = {0};
+    tu_edpt_stream_read(ep_rx, buf, pkt_bytes);
+    _nego_handle_stream_msg(p_midi, buf);
+  }
+}
+
+//--------------------------------------------------------------------+
+// READ API
+//--------------------------------------------------------------------+
+bool tud_midi2_n_mounted(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  return tu_edpt_stream_is_opened(&p_midi->ep_stream.tx) &&
+         tu_edpt_stream_is_opened(&p_midi->ep_stream.rx);
+}
+
+uint32_t tud_midi2_n_available(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  return tu_edpt_stream_read_available(&p_midi->ep_stream.rx) / 4;
+}
+
+uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2 && words != NULL && max_words > 0, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
+
+  uint32_t total_read = 0;
+  while (total_read < max_words) {
+    uint8_t first_byte;
+    if (!tu_edpt_stream_peek(ep_rx, &first_byte)) break;
+
+    uint8_t mt = (first_byte >> 4) & 0x0F;
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+
+    if (total_read + pkt_words > max_words) break;
+    if (tu_edpt_stream_read_available(ep_rx) < (uint32_t)pkt_words * 4) break;
+
+    tu_edpt_stream_read(ep_rx, &words[total_read], pkt_words * 4);
+    total_read += pkt_words;
+  }
+
+  return total_read;
+}
+
+bool tud_midi2_n_packet_read(uint8_t itf, uint8_t packet[4]) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  return 4 == tu_edpt_stream_read(&p_midi->ep_stream.rx, packet, 4);
+}
+
+//--------------------------------------------------------------------+
+// WRITE API
+//--------------------------------------------------------------------+
+uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t count) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2 && words != NULL && count > 0, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  TU_VERIFY(tu_edpt_stream_is_opened(ep_tx), 0);
+
+  uint32_t written = 0;
+  while (written < count) {
+    uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F);
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+
+    if (written + pkt_words > count) break;
+    if (tu_edpt_stream_write_available(ep_tx) < pkt_words * 4) break;
+
+    tu_edpt_stream_write(ep_tx, &words[written], pkt_words * 4);
+    written += pkt_words;
+  }
+
+  (void) tu_edpt_stream_write_xfer(ep_tx);
+  return written;
+}
+
+bool tud_midi2_n_packet_write(uint8_t itf, const uint8_t packet[4]) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  TU_VERIFY(tu_edpt_stream_is_opened(ep_tx), false);
+  TU_VERIFY(tu_edpt_stream_write_available(ep_tx) >= 4, false);
+  TU_VERIFY(tu_edpt_stream_write(ep_tx, packet, 4) > 0, false);
+  (void) tu_edpt_stream_write_xfer(ep_tx);
+  return true;
+}
+
+//--------------------------------------------------------------------+
+// STATE GETTERS
+//--------------------------------------------------------------------+
+uint8_t tud_midi2_n_alt_setting(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, 0);
+  return _midi2d_itf[itf].alt_setting;
+}
+
+bool tud_midi2_n_negotiated(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+  return _midi2d_itf[itf].negotiated;
+}
+
+uint8_t tud_midi2_n_protocol(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, 0);
+  return _midi2d_itf[itf].protocol;
+}
+
+//--------------------------------------------------------------------+
+// USBD Driver API
+//--------------------------------------------------------------------+
+void midi2d_init(void) {
+  tu_memclr(_midi2d_itf, sizeof(_midi2d_itf));
+  for (uint8_t i = 0; i < CFG_TUD_MIDI2; i++) {
+    midi2d_interface_t* p_midi = &_midi2d_itf[i];
+    p_midi->protocol = MIDI_PROTOCOL_MIDI2;
+
+  #if CFG_TUD_EDPT_DEDICATED_HWFIFO
+    uint8_t* epout_buf = NULL;
+    uint8_t* epin_buf  = NULL;
+  #else
+    midi2d_epbuf_t* p_epbuf = &_midi2d_epbuf[i];
+    uint8_t* epout_buf = p_epbuf->epout;
+    uint8_t* epin_buf  = p_epbuf->epin;
+  #endif
+
+    tu_edpt_stream_init(&p_midi->ep_stream.rx, false, false, false,
+                        p_midi->ep_stream.rx_ff_buf, CFG_TUD_MIDI2_RX_BUFSIZE, epout_buf);
+    tu_edpt_stream_init(&p_midi->ep_stream.tx, false, true, false,
+                        p_midi->ep_stream.tx_ff_buf, CFG_TUD_MIDI2_TX_BUFSIZE, epin_buf);
+  }
+}
+
+bool midi2d_deinit(void) {
+  for (uint8_t i = 0; i < CFG_TUD_MIDI2; i++) {
+    midi2d_interface_t* p_midi = &_midi2d_itf[i];
+    tu_edpt_stream_deinit(&p_midi->ep_stream.rx);
+    tu_edpt_stream_deinit(&p_midi->ep_stream.tx);
+  }
+  return true;
+}
+
+void midi2d_reset(uint8_t rhport) {
+  (void) rhport;
+  for (uint8_t i = 0; i < CFG_TUD_MIDI2; i++) {
+    midi2d_interface_t* p_midi = &_midi2d_itf[i];
+    tu_memclr(p_midi, ITF_MEM_RESET_SIZE);
+
+    tu_edpt_stream_clear(&p_midi->ep_stream.rx);
+    tu_edpt_stream_close(&p_midi->ep_stream.rx);
+
+    tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+    tu_edpt_stream_close(&p_midi->ep_stream.tx);
+  }
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t find_midi2_itf(uint8_t ep_addr) {
+  for (uint8_t idx = 0; idx < CFG_TUD_MIDI2; idx++) {
+    const midi2d_interface_t* p_midi = &_midi2d_itf[idx];
+    if (ep_addr == p_midi->ep_stream.rx.ep_addr || ep_addr == p_midi->ep_stream.tx.ep_addr) {
+      return idx;
+    }
+  }
+  return TUSB_INDEX_INVALID_8;
+}
+
+static uint8_t find_midi2_itf_by_num(uint8_t itf_num) {
+  for (uint8_t idx = 0; idx < CFG_TUD_MIDI2; idx++) {
+    if (_midi2d_itf[idx].itf_num == itf_num) return idx;
+  }
+  return TUSB_INDEX_INVALID_8;
+}
+
+uint16_t midi2d_open(uint8_t rhport, const tusb_desc_interface_t* desc_itf, uint16_t max_len) {
+  const uint8_t* p_desc   = (const uint8_t*) desc_itf;
+  const uint8_t* desc_end = p_desc + max_len;
+
+  // 1st Interface: Audio Control v1 (optional)
+  if (TUSB_CLASS_AUDIO               == desc_itf->bInterfaceClass    &&
+      AUDIO_SUBCLASS_CONTROL         == desc_itf->bInterfaceSubClass &&
+      AUDIO_FUNC_PROTOCOL_CODE_UNDEF == desc_itf->bInterfaceProtocol) {
+    p_desc = tu_desc_next(desc_itf);
+    while (tu_desc_in_bounds(p_desc, desc_end) && TUSB_DESC_CS_INTERFACE == tu_desc_type(p_desc)) {
+      p_desc = tu_desc_next(p_desc);
+    }
+  }
+
+  // 2nd Interface: MIDI Streaming
+  TU_VERIFY(TUSB_DESC_INTERFACE == tu_desc_type(p_desc), 0);
+  const tusb_desc_interface_t* desc_midi = (const tusb_desc_interface_t*) p_desc;
+
+  TU_VERIFY(TUSB_CLASS_AUDIO              == desc_midi->bInterfaceClass &&
+            AUDIO_SUBCLASS_MIDI_STREAMING == desc_midi->bInterfaceSubClass &&
+            AUDIO_FUNC_PROTOCOL_CODE_UNDEF == desc_midi->bInterfaceProtocol,
+            0);
+
+  uint8_t idx = find_midi2_itf(0);
+  TU_ASSERT(idx < CFG_TUD_MIDI2, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[idx];
+
+  p_midi->rhport      = rhport;
+  p_midi->itf_num     = desc_midi->bInterfaceNumber;
+  p_midi->alt_setting = 0;
+  p_midi->protocol    = MIDI_PROTOCOL_MIDI2;
+  p_midi->negotiated  = false;
+
+  p_desc = tu_desc_next(p_desc);
+
+  // Skip class-specific descriptors
+  while (tu_desc_in_bounds(p_desc, desc_end) && TUSB_DESC_CS_INTERFACE == tu_desc_type(p_desc)) {
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  // Find and open endpoint descriptors
+  uint8_t found_ep = 0;
+  while ((found_ep < desc_midi->bNumEndpoints) && tu_desc_in_bounds(p_desc, desc_end)) {
+    if (TUSB_DESC_ENDPOINT == tu_desc_type(p_desc)) {
+      const tusb_desc_endpoint_t* desc_ep = (const tusb_desc_endpoint_t*) p_desc;
+      TU_ASSERT(usbd_edpt_open(rhport, desc_ep), 0);
+      const uint8_t ep_addr = desc_ep->bEndpointAddress;
+
+      if (tu_edpt_dir(ep_addr) == TUSB_DIR_IN) {
+        tu_edpt_stream_open(&p_midi->ep_stream.tx, rhport, desc_ep, CFG_TUD_MIDI2_TX_EPSIZE);
+        tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+      } else {
+        tu_edpt_stream_open(&p_midi->ep_stream.rx, rhport, desc_ep, tu_edpt_packet_size(desc_ep));
+        tu_edpt_stream_clear(&p_midi->ep_stream.rx);
+        TU_ASSERT(tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx) > 0, 0);
+      }
+
+      found_ep++;
+    }
+
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  // Skip remaining descriptors (alt setting 1, CS endpoints, GTB)
+  while (tu_desc_in_bounds(p_desc, desc_end)) {
+    uint8_t dtype = tu_desc_type(p_desc);
+    if (dtype != TUSB_DESC_CS_INTERFACE && dtype != TUSB_DESC_CS_ENDPOINT &&
+        dtype != TUSB_DESC_INTERFACE && dtype != TUSB_DESC_ENDPOINT) {
+      break;
+    }
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  return (uint16_t)(p_desc - (const uint8_t*) desc_itf);
+}
+
+bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_request_t* request) {
+  TU_LOG2("MIDI2 ctrl: stage=%u bRequest=0x%02X wValue=0x%04X wIndex=0x%04X wLength=%u\r\n",
+          stage, request->bRequest, request->wValue, request->wIndex, request->wLength);
+
+  if (stage != CONTROL_STAGE_SETUP) return true;
+
+  switch (request->bRequest) {
+    case TUSB_REQ_SET_INTERFACE: {
+      uint8_t itf_num = tu_u16_low(request->wIndex);
+      uint8_t alt     = tu_u16_low(request->wValue);
+
+      uint8_t idx = find_midi2_itf_by_num(itf_num);
+      if (idx >= CFG_TUD_MIDI2) return false;
+
+      midi2d_interface_t* p_midi = &_midi2d_itf[idx];
+      p_midi->alt_setting = alt;
+
+      tu_edpt_stream_clear(&p_midi->ep_stream.rx);
+      tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+
+      if (alt == 1) {
+        p_midi->negotiated = false;
+        p_midi->protocol   = MIDI_PROTOCOL_MIDI2;
+      }
+
+      // Re-arm RX endpoint for receiving data after alt setting change
+      tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx);
+
+      tud_midi2_set_itf_cb(idx, alt);
+      tud_control_status(rhport, request);
+      return true;
+    }
+
+    case TUSB_REQ_GET_DESCRIPTOR: {
+      // wValue: descriptor type (high) | index (low)
+      // 0x26 = CS_GRP_TRM_BLOCK, index 0x01
+      if (request->wValue == ((uint16_t)MIDI2_CS_GRP_TRM_BLOCK << 8 | 0x01)) {
+        if (tud_midi2_get_req_itf_cb(rhport, request)) return true;
+
+        uint16_t len = request->wLength;
+        if (len > sizeof(_default_gtb_desc)) {
+          len = sizeof(_default_gtb_desc);
+        }
+        tud_control_xfer(rhport, request, (void*)(uintptr_t) _default_gtb_desc, len);
+        return true;
+      }
+      return false;
+    }
+
+    default:
+      return false;
+  }
+}
+
+bool midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
+  (void) rhport;
+
+  uint8_t idx = find_midi2_itf(ep_addr);
+  TU_ASSERT(idx < CFG_TUD_MIDI2);
+  midi2d_interface_t* p_midi = &_midi2d_itf[idx];
+
+  tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+
+  if (ep_addr == ep_rx->ep_addr) {
+    if (result == XFER_RESULT_SUCCESS) {
+      tu_edpt_stream_read_xfer_complete(ep_rx, xferred_bytes);
+      if (p_midi->alt_setting == 1) {
+        _nego_process_rx(p_midi);
+      }
+      tud_midi2_rx_cb(idx);
+    }
+    tu_edpt_stream_read_xfer(ep_rx);
+  } else if (ep_addr == ep_tx->ep_addr && result == XFER_RESULT_SUCCESS) {
+    if (0 == tu_edpt_stream_write_xfer(ep_tx)) {
+      (void) tu_edpt_stream_write_zlp_if_needed(ep_tx, xferred_bytes);
+    }
+  } else {
+    return false;
+  }
+
+  return true;
+}
+
+#endif
diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
new file mode 100644
index 000000000..dac1f0124
--- /dev/null
+++ b/src/class/midi/midi2_device.h
@@ -0,0 +1,125 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2026 Saulo Verissimo
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * This file is part of the TinyUSB stack.
+ */
+
+#ifndef TUSB_MIDI2_DEVICE_H_
+#define TUSB_MIDI2_DEVICE_H_
+
+#include "class/audio/audio.h"
+#include "midi.h"
+
+//--------------------------------------------------------------------+
+// Class Driver Configuration
+//--------------------------------------------------------------------+
+
+// Config defaults are in tusb_option.h:
+//   CFG_TUD_MIDI2_RX_EPSIZE, CFG_TUD_MIDI2_TX_EPSIZE,
+//   CFG_TUD_MIDI2_RX_BUFSIZE, CFG_TUD_MIDI2_TX_BUFSIZE,
+//   CFG_TUD_MIDI2_NUM_GROUPS, CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS,
+//   CFG_TUD_MIDI2_EP_NAME, CFG_TUD_MIDI2_PRODUCT_ID
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+//--------------------------------------------------------------------+
+// Application Callback API (weak, optional)
+//--------------------------------------------------------------------+
+void tud_midi2_rx_cb(uint8_t itf);
+void tud_midi2_set_itf_cb(uint8_t itf, uint8_t alt);
+bool tud_midi2_get_req_itf_cb(uint8_t rhport, const tusb_control_request_t* request);
+
+//--------------------------------------------------------------------+
+// Application API (Multiple Interfaces)
+//--------------------------------------------------------------------+
+
+bool     tud_midi2_n_mounted(uint8_t itf);
+uint32_t tud_midi2_n_available(uint8_t itf);
+uint8_t  tud_midi2_n_alt_setting(uint8_t itf);
+bool     tud_midi2_n_negotiated(uint8_t itf);
+uint8_t  tud_midi2_n_protocol(uint8_t itf);
+
+uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words);
+uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t count);
+
+bool     tud_midi2_n_packet_read(uint8_t itf, uint8_t packet[4]);
+bool     tud_midi2_n_packet_write(uint8_t itf, const uint8_t packet[4]);
+
+//--------------------------------------------------------------------+
+// Application API (Single Interface)
+//--------------------------------------------------------------------+
+TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_mounted(void) {
+  return tud_midi2_n_mounted(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint32_t tud_midi2_available(void) {
+  return tud_midi2_n_available(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t tud_midi2_alt_setting(void) {
+  return tud_midi2_n_alt_setting(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_negotiated(void) {
+  return tud_midi2_n_negotiated(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t tud_midi2_protocol(void) {
+  return tud_midi2_n_protocol(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint32_t
+tud_midi2_ump_read(uint32_t* words, uint32_t max_words) {
+  return tud_midi2_n_ump_read(0, words, max_words);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint32_t
+tud_midi2_ump_write(const uint32_t* words, uint32_t count) {
+  return tud_midi2_n_ump_write(0, words, count);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_packet_read(uint8_t packet[4]) {
+  return tud_midi2_n_packet_read(0, packet);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_packet_write(const uint8_t packet[4]) {
+  return tud_midi2_n_packet_write(0, packet);
+}
+
+//--------------------------------------------------------------------+
+// Internal Class Driver API
+//--------------------------------------------------------------------+
+void     midi2d_init(void);
+bool     midi2d_deinit(void);
+void     midi2d_reset(uint8_t rhport);
+uint16_t midi2d_open(uint8_t rhport, const tusb_desc_interface_t* itf_desc, uint16_t max_len);
+bool     midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_request_t* request);
+bool     midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/device/usbd.c b/src/device/usbd.c
index 0e58f70bf..55ad330c1 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -254,6 +254,20 @@ static const usbd_class_driver_t _usbd_driver[] = {
     },
     #endif
 
+    #if CFG_TUD_MIDI2
+    {
+        .name             = DRIVER_NAME("MIDI2"),
+        .init             = midi2d_init,
+        .deinit           = midi2d_deinit,
+        .open             = midi2d_open,
+        .reset            = midi2d_reset,
+        .control_xfer_cb  = midi2d_control_xfer_cb,
+        .xfer_cb          = midi2d_xfer_cb,
+        .xfer_isr         = NULL,
+        .sof              = NULL
+    },
+    #endif
+
     #if CFG_TUD_VENDOR
     {
         .name             = DRIVER_NAME("VENDOR"),
diff --git a/src/device/usbd.h b/src/device/usbd.h
index 473e697ac..af37eff56 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -424,6 +424,43 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   TUD_MIDI_DESC_EP(_epin, _epsize, 1),\
   TUD_MIDI_JACKID_OUT_EMB(1)
 
+//--------------------------------------------------------------------+
+// MIDI 2.0 Descriptor Templates (USB-MIDI 2.0)
+//--------------------------------------------------------------------+
+
+// Alt Setting 1: MS Interface + MS Header (bcdMSC=0x0200)
+#define TUD_MIDI2_DESC_ALT1_HEAD_LEN (9 + 7)
+#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx) \
+  /* MIDI Streaming Interface, Alt Setting 1 */\
+  9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum) + 1), 1, 2, TUSB_CLASS_AUDIO, AUDIO_SUBCLASS_MIDI_STREAMING, AUDIO_FUNC_PROTOCOL_CODE_UNDEF, _stridx,\
+  /* MS Header (MIDI 2.0) */\
+  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(7)
+
+// Alt Setting 1: Standard USB Endpoint (7 bytes) + CS Endpoint (subtype 0x02)
+#define TUD_MIDI2_DESC_ALT1_EP_LEN(_numgtbs) (7 + 4 + (_numgtbs))
+#define TUD_MIDI2_DESC_ALT1_EP(_ep, _epsize, _numgtbs) \
+  7, TUSB_DESC_ENDPOINT, _ep, TUSB_XFER_BULK, U16_TO_U8S_LE(_epsize), 0, \
+  (uint8_t)(4 + (_numgtbs)), TUSB_DESC_CS_ENDPOINT, MIDI_CS_ENDPOINT_GENERAL_2_0, _numgtbs
+
+// Total length: Alt 0 (MIDI 1.0) + Alt 1 (UMP)
+#define TUD_MIDI2_DESC_LEN (TUD_MIDI_DESC_LEN + TUD_MIDI2_DESC_ALT1_HEAD_LEN + TUD_MIDI2_DESC_ALT1_EP_LEN(1) * 2)
+
+// Complete MIDI 2.0 descriptor with both alternate settings (single cable/GTB)
+#define TUD_MIDI2_DESCRIPTOR(_itfnum, _stridx, _epout, _epin, _epsize) \
+  /* Alt Setting 0 (MIDI 1.0) */\
+  TUD_MIDI_DESC_HEAD(_itfnum, _stridx, 1),\
+  TUD_MIDI_DESC_JACK_DESC(1, 0),\
+  TUD_MIDI_DESC_EP(_epout, _epsize, 1),\
+  TUD_MIDI_JACKID_IN_EMB(1),\
+  TUD_MIDI_DESC_EP(_epin, _epsize, 1),\
+  TUD_MIDI_JACKID_OUT_EMB(1),\
+  /* Alt Setting 1 (UMP) */\
+  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx),\
+  TUD_MIDI2_DESC_ALT1_EP(_epout, _epsize, 1),\
+  1, /* bAssoGrpTrmBlkID = 1 */\
+  TUD_MIDI2_DESC_ALT1_EP(_epin, _epsize, 1),\
+  1  /* bAssoGrpTrmBlkID = 1 */
+
 //--------------------------------------------------------------------+
 // Audio Descriptor Templates
 //--------------------------------------------------------------------+
diff --git a/src/tusb.h b/src/tusb.h
index c80c8433c..aa6b461e5 100644
--- a/src/tusb.h
+++ b/src/tusb.h
@@ -63,6 +63,10 @@
     #include "class/midi/midi_host.h"
   #endif
 
+  #if CFG_TUH_MIDI2
+    #include "class/midi/midi2_host.h"
+  #endif
+
   #if CFG_TUH_VENDOR
     #include "class/vendor/vendor_host.h"
   #endif
@@ -108,6 +112,10 @@
     #include "class/midi/midi_device.h"
   #endif
 
+  #if CFG_TUD_MIDI2
+    #include "class/midi/midi2_device.h"
+  #endif
+
   #if CFG_TUD_VENDOR
     #include "class/vendor/vendor_device.h"
   #endif
diff --git a/src/tusb_option.h b/src/tusb_option.h
index 154f8e2a4..4483c2200 100644
--- a/src/tusb_option.h
+++ b/src/tusb_option.h
@@ -646,6 +646,42 @@
   #define CFG_TUD_MIDI            0
 #endif
 
+#ifndef CFG_TUD_MIDI2
+  #define CFG_TUD_MIDI2           0
+#endif
+
+#ifndef CFG_TUD_MIDI2_TX_BUFSIZE
+  #define CFG_TUD_MIDI2_TX_BUFSIZE  256
+#endif
+
+#ifndef CFG_TUD_MIDI2_RX_BUFSIZE
+  #define CFG_TUD_MIDI2_RX_BUFSIZE  256
+#endif
+
+#ifndef CFG_TUD_MIDI2_TX_EPSIZE
+  #define CFG_TUD_MIDI2_TX_EPSIZE   64
+#endif
+
+#ifndef CFG_TUD_MIDI2_RX_EPSIZE
+  #define CFG_TUD_MIDI2_RX_EPSIZE   64
+#endif
+
+#ifndef CFG_TUD_MIDI2_NUM_GROUPS
+  #define CFG_TUD_MIDI2_NUM_GROUPS  1
+#endif
+
+#ifndef CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS
+  #define CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS 1
+#endif
+
+#ifndef CFG_TUD_MIDI2_EP_NAME
+  #define CFG_TUD_MIDI2_EP_NAME     "TinyUSB MIDI 2.0"
+#endif
+
+#ifndef CFG_TUD_MIDI2_PRODUCT_ID
+  #define CFG_TUD_MIDI2_PRODUCT_ID  "TinyUSB-MIDI2"
+#endif
+
 #ifndef CFG_TUD_VENDOR
   #define CFG_TUD_VENDOR          0
 #endif
@@ -815,6 +851,22 @@
   #define CFG_TUH_MIDI   0
 #endif
 
+#ifndef CFG_TUH_MIDI2
+  #define CFG_TUH_MIDI2  0
+#endif
+
+#ifndef CFG_TUH_MIDI2_RX_BUFSIZE
+  #define CFG_TUH_MIDI2_RX_BUFSIZE (4 * TUH_EPSIZE_BULK_MAX)
+#endif
+
+#ifndef CFG_TUH_MIDI2_TX_BUFSIZE
+  #define CFG_TUH_MIDI2_TX_BUFSIZE (4 * TUH_EPSIZE_BULK_MAX)
+#endif
+
+#ifndef CFG_TUH_MIDI2_LOG_LEVEL
+  #define CFG_TUH_MIDI2_LOG_LEVEL CFG_TUH_LOG_LEVEL
+#endif
+
 #ifndef CFG_TUH_MSC
   #define CFG_TUH_MSC    0
 #endif
-- 
cgit v1.3.1


From fa9edeff9c00ee1fc4ee7ab9938b1a5955a6281a Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Wed, 25 Mar 2026 07:05:56 -0300
Subject: fix: address PR review feedback for MIDI 2.0 drivers

Host driver (midi2_host.c):
- midih2_open() now returns actual parsed length instead of max_len,
  preventing composite device interface conflicts
- Parsers (alt0/alt1) refactored to return const uint8_t* end pointer
  following midi_host.c switch/case pattern
- Alt 1 CS Endpoint now parses MIDI 2.0 layout (bNumGrpTrmBlk at
  offset 3 with MIDI_CS_ENDPOINT_GENERAL_2_0 subtype check) instead
  of reusing MIDI 1.0 struct (bNumEmbMIDIJack)
- midih2_set_config() now issues SET_INTERFACE control request via
  tuh_interface_set() before completing configuration. Falls back to
  alt 0 if SET_INTERFACE fails
- Extracted midih2_set_config_complete() and midih2_set_interface_cb()
  for async SET_INTERFACE handling

Device driver (midi2_device.c):
- midi2d_open() skip loop now checks bInterfaceNumber, stopping at
  interfaces that belong to other functions in composite devices
- SET_INTERFACE handler now rejects alt > 1 (returns false/stall)
- Named constants for GTB descriptor types and MIDI protocol values

Descriptor macros (usbd.h):
- TUD_MIDI2_DESC_ALT1_HEAD: iInterface set to 0 (consistent with
  Alt 0), wTotalLength now uses TUD_MIDI2_DESC_ALT1_CS_LEN to cover
  all Alt 1 class-specific descriptors
- TUD_MIDI2_DESC_ALT1_EP: now accepts GTB ID list via variadic args,
  emitting complete CS endpoint descriptor

Host example:
- CMakeLists.txt restricted to rp2040 family (display.c requires
  Pico SDK headers)
- display.c: null terminator after strncpy in log scroll

Documentation:
- class_drivers.rst updated to reflect SET_INTERFACE behavior and
  auto-select with fallback

Addresses: Codex P1 (#1, #2, #3), Copilot (#4-#9)
---
 docs/reference/class_drivers.rst        |   8 +-
 examples/host/midi2_host/CMakeLists.txt |   3 +-
 examples/host/midi2_host/src/display.c  |   1 +
 src/class/midi/midi2_device.c           |  14 ++-
 src/class/midi/midi2_host.c             | 213 ++++++++++++++++++++------------
 src/device/usbd.h                       |  24 ++--
 6 files changed, 166 insertions(+), 97 deletions(-)

(limited to 'src/device')

diff --git a/docs/reference/class_drivers.rst b/docs/reference/class_drivers.rst
index 9ed332acb..3ac0d8d4e 100644
--- a/docs/reference/class_drivers.rst
+++ b/docs/reference/class_drivers.rst
@@ -87,7 +87,7 @@ The MIDI 2.0 Host driver enables TinyUSB to enumerate and communicate with USB M
 **Key Features:**
 
 - **Reactive Architecture**: Auto-detects Alt Setting 1 (MIDI 2.0) capability during enumeration
-- **Auto-Selection**: Automatically selects the highest available protocol (MIDI 2.0 preferred)
+- **Auto-Selection**: Automatically selects the highest available protocol and issues SET_INTERFACE to activate Alt Setting 1 when MIDI 2.0 is detected
 - **Transparent Stream Messages**: All data (UMP packets + Stream Messages) flow through callbacks
 - **Memory Safe**: No dynamic allocation, fixed-size instances per device
 
@@ -271,9 +271,9 @@ Architecture
 The MIDI 2.0 Host driver uses a **reactive, callback-driven architecture** that mirrors the proven patterns in TinyUSB's existing device drivers (CDC, HID, etc.):
 
 - **Auto-Detection**: Host automatically detects Alt Setting 1 capability
-- **Auto-Selection**: Selects highest protocol available (MIDI 2.0 preferred)
-- **Application Control**: App makes protocol behavior decisions via callbacks
-- **Transparent I/O**: Stream Messages and UMP packets flow transparently
+- **Auto-Selection**: Selects highest protocol available and issues SET_INTERFACE
+- **Transparent I/O**: Stream Messages and UMP packets flow through callbacks
+- **Callback-Driven**: App receives events via callbacks (descriptor, mount, rx, tx, unmount)
 
 Differences from MIDI 1.0 Host
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
diff --git a/examples/host/midi2_host/CMakeLists.txt b/examples/host/midi2_host/CMakeLists.txt
index 221de7adf..cd70d122a 100644
--- a/examples/host/midi2_host/CMakeLists.txt
+++ b/examples/host/midi2_host/CMakeLists.txt
@@ -6,7 +6,8 @@ project(midi2_host C CXX ASM)
 
 family_initialize_project(${PROJECT_NAME} ${CMAKE_CURRENT_LIST_DIR})
 
-if(FAMILY STREQUAL "espressif")
+# This example requires PIO-USB and Pico SDK (I2C, SSD1306 display)
+if(NOT FAMILY STREQUAL "rp2040")
   return()
 endif()
 
diff --git a/examples/host/midi2_host/src/display.c b/examples/host/midi2_host/src/display.c
index 6d81bcd5c..4745c2961 100644
--- a/examples/host/midi2_host/src/display.c
+++ b/examples/host/midi2_host/src/display.c
@@ -190,6 +190,7 @@ void display_log(const char* text, uint16_t color) {
   if (log_count >= LOG_LINES) {
     for (int i = 0; i < LOG_LINES - 1; i++) {
       strncpy(log_lines[i], log_lines[i + 1], CHARS_PER_LINE);
+      log_lines[i][CHARS_PER_LINE] = '\0';
     }
     log_count = LOG_LINES - 1;
   }
diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 9363aac11..aecbda4c5 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -505,12 +505,19 @@ uint16_t midi2d_open(uint8_t rhport, const tusb_desc_interface_t* desc_itf, uint
   }
 
   // Skip remaining descriptors (alt setting 1, CS endpoints, GTB)
+  // Stop at any interface descriptor that is not our MIDI Streaming alt setting
   while (tu_desc_in_bounds(p_desc, desc_end)) {
     uint8_t dtype = tu_desc_type(p_desc);
-    if (dtype != TUSB_DESC_CS_INTERFACE && dtype != TUSB_DESC_CS_ENDPOINT &&
-        dtype != TUSB_DESC_INTERFACE && dtype != TUSB_DESC_ENDPOINT) {
+
+    if (dtype == TUSB_DESC_INTERFACE) {
+      const tusb_desc_interface_t* next_itf = (const tusb_desc_interface_t*) p_desc;
+      // Continue only if this is an alternate setting of our own interface
+      if (next_itf->bInterfaceNumber != desc_midi->bInterfaceNumber) break;
+    } else if (dtype != TUSB_DESC_CS_INTERFACE && dtype != TUSB_DESC_CS_ENDPOINT &&
+               dtype != TUSB_DESC_ENDPOINT) {
       break;
     }
+
     p_desc = tu_desc_next(p_desc);
   }
 
@@ -528,6 +535,9 @@ bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_re
       uint8_t itf_num = tu_u16_low(request->wIndex);
       uint8_t alt     = tu_u16_low(request->wValue);
 
+      // Only Alt Setting 0 (MIDI 1.0) and 1 (UMP) are valid
+      if (alt > 1) return false;
+
       uint8_t idx = find_midi2_itf_by_num(itf_num);
       if (idx >= CFG_TUD_MIDI2) return false;
 
diff --git a/src/class/midi/midi2_host.c b/src/class/midi/midi2_host.c
index beb441b56..5b9f98f8b 100644
--- a/src/class/midi/midi2_host.c
+++ b/src/class/midi/midi2_host.c
@@ -125,9 +125,10 @@ static inline uint8_t get_idx_by_ep_addr(uint8_t daddr, uint8_t ep_addr) {
 // Descriptor parsing
 //--------------------------------------------------------------------+
 
-static void midih2_parse_descriptors_alt0(midih2_interface_t *p_midi,
+// Parse Alt Setting 0 (MIDI 1.0) descriptors. Returns pointer past last consumed descriptor.
+static const uint8_t* midih2_parse_descriptors_alt0(midih2_interface_t *p_midi,
     const tusb_desc_interface_t *desc_itf, const uint8_t *desc_end) {
-  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass,);
+  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass, NULL);
 
   p_midi->bInterfaceNumber = desc_itf->bInterfaceNumber;
 
@@ -136,93 +137,113 @@ static void midih2_parse_descriptors_alt0(midih2_interface_t *p_midi,
 
   uint8_t rx_cable_count = 0;
   uint8_t tx_cable_count = 0;
+  bool found_new_interface = false;
 
-  while (tu_desc_in_bounds(p_desc, desc_end)) {
-    if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
-      break;
-    }
-
-    if (tu_desc_type(p_desc) == TUSB_DESC_ENDPOINT) {
-      const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
-
-      // Open endpoint and stream
-      TU_ASSERT(tuh_edpt_open(p_midi->daddr, p_ep),);
-      if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_IN) {
-        tu_edpt_stream_open(&p_midi->ep_stream.rx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
-        tu_edpt_stream_clear(&p_midi->ep_stream.rx);
-      } else {
-        tu_edpt_stream_open(&p_midi->ep_stream.tx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
-        tu_edpt_stream_clear(&p_midi->ep_stream.tx);
-      }
-
-      p_desc = tu_desc_next(p_desc);
+  while (tu_desc_in_bounds(p_desc, desc_end) && !found_new_interface) {
+    switch (tu_desc_type(p_desc)) {
+      case TUSB_DESC_INTERFACE:
+        found_new_interface = true;
+        break;
 
-      if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
-        const midi_desc_cs_endpoint_t *p_csep = (const midi_desc_cs_endpoint_t *) p_desc;
+      case TUSB_DESC_ENDPOINT: {
+        const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
 
-        if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
-          tx_cable_count = p_csep->bNumEmbMIDIJack;
+        TU_ASSERT(tuh_edpt_open(p_midi->daddr, p_ep), NULL);
+        if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_IN) {
+          tu_edpt_stream_open(&p_midi->ep_stream.rx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
+          tu_edpt_stream_clear(&p_midi->ep_stream.rx);
         } else {
-          rx_cable_count = p_csep->bNumEmbMIDIJack;
+          tu_edpt_stream_open(&p_midi->ep_stream.tx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
+          tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+        }
+
+        p_desc = tu_desc_next(p_desc);
+        if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
+          const midi_desc_cs_endpoint_t *p_csep = (const midi_desc_cs_endpoint_t *) p_desc;
+          if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
+            tx_cable_count = p_csep->bNumEmbMIDIJack;
+          } else {
+            rx_cable_count = p_csep->bNumEmbMIDIJack;
+          }
         }
+        break;
       }
+
+      default:
+        break;
     }
 
-    p_desc = tu_desc_next(p_desc);
+    if (!found_new_interface) {
+      p_desc = tu_desc_next(p_desc);
+    }
   }
 
   p_midi->rx_cable_count_alt0 = rx_cable_count;
   p_midi->tx_cable_count_alt0 = tx_cable_count;
+  return p_desc;
 }
 
-static void midih2_parse_descriptors_alt1(midih2_interface_t *p_midi,
+// Parse Alt Setting 1 (MIDI 2.0 UMP) descriptors. Returns pointer past last consumed descriptor.
+static const uint8_t* midih2_parse_descriptors_alt1(midih2_interface_t *p_midi,
     const tusb_desc_interface_t *desc_itf, const uint8_t *desc_end) {
-  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass,);
-  TU_VERIFY(desc_itf->bAlternateSetting == 1,);
+  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass, NULL);
+  TU_VERIFY(desc_itf->bAlternateSetting == 1, NULL);
 
   const uint8_t *p_desc = (const uint8_t *) desc_itf;
   p_desc = tu_desc_next(p_desc);
 
   uint8_t rx_cable_count = 0;
   uint8_t tx_cable_count = 0;
+  bool found_new_interface = false;
 
-  while (tu_desc_in_bounds(p_desc, desc_end)) {
-    if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
-      break;
-    }
+  while (tu_desc_in_bounds(p_desc, desc_end) && !found_new_interface) {
+    switch (tu_desc_type(p_desc)) {
+      case TUSB_DESC_INTERFACE:
+        found_new_interface = true;
+        break;
 
-    if (tu_desc_type(p_desc) == TUSB_DESC_CS_INTERFACE) {
-      if (tu_desc_subtype(p_desc) == MIDI_CS_INTERFACE_HEADER) {
-        const uint8_t *bcd_ptr = p_desc + 3;
-        p_midi->bcdMSC_lo = bcd_ptr[0];
-        p_midi->bcdMSC_hi = bcd_ptr[1];
+      case TUSB_DESC_CS_INTERFACE:
+        if (tu_desc_subtype(p_desc) == MIDI_CS_INTERFACE_HEADER) {
+          // bcdMSC at offset 3-4 in CS Interface Header
+          const uint8_t *bcd_ptr = p_desc + 3;
+          p_midi->bcdMSC_lo = bcd_ptr[0];
+          p_midi->bcdMSC_hi = bcd_ptr[1];
+          if (p_midi->bcdMSC_hi == 0x02) {  // bcdMSC 0x0200 = USB-MIDI 2.0
+            p_midi->protocol_version = 1;
+          }
+        }
+        break;
 
-        if (p_midi->bcdMSC_hi == 0x02) {
-          p_midi->protocol_version = 1;
+      case TUSB_DESC_ENDPOINT: {
+        const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
+        p_desc = tu_desc_next(p_desc);
+
+        if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
+          // MIDI 2.0 CS Endpoint General 2.0: bNumGrpTrmBlk at offset 3
+          if (p_desc[0] >= 4 && p_desc[2] == MIDI_CS_ENDPOINT_GENERAL_2_0) {
+            uint8_t num_grp_trm_blk = p_desc[3];
+            if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
+              tx_cable_count = num_grp_trm_blk;
+            } else {
+              rx_cable_count = num_grp_trm_blk;
+            }
+          }
         }
+        break;
       }
+
+      default:
+        break;
     }
 
-    if (tu_desc_type(p_desc) == TUSB_DESC_ENDPOINT) {
-      const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
+    if (!found_new_interface) {
       p_desc = tu_desc_next(p_desc);
-
-      if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
-        const midi_desc_cs_endpoint_t *p_csep = (const midi_desc_cs_endpoint_t *) p_desc;
-
-        if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
-          tx_cable_count = p_csep->bNumEmbMIDIJack;
-        } else {
-          rx_cable_count = p_csep->bNumEmbMIDIJack;
-        }
-      }
     }
-
-    p_desc = tu_desc_next(p_desc);
   }
 
   p_midi->rx_cable_count_alt1 = rx_cable_count;
   p_midi->tx_cable_count_alt1 = tx_cable_count;
+  return p_desc;
 }
 
 //--------------------------------------------------------------------+
@@ -327,33 +348,20 @@ uint16_t midih2_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_interface
              desc_itf->bInterfaceNumber, desc_itf->bAlternateSetting, dev_addr);
 
   // Dispatch to appropriate parser based on Alt Setting
+  const uint8_t *p_end = NULL;
   if (desc_itf->bAlternateSetting == 0) {
-    midih2_parse_descriptors_alt0(p_midi, desc_itf, desc_end);
+    p_end = midih2_parse_descriptors_alt0(p_midi, desc_itf, desc_end);
   } else if (desc_itf->bAlternateSetting == 1) {
-    midih2_parse_descriptors_alt1(p_midi, desc_itf, desc_end);
+    p_end = midih2_parse_descriptors_alt1(p_midi, desc_itf, desc_end);
   }
 
-  return max_len;
+  // Return number of bytes consumed (following midi_host.c pattern)
+  uint16_t const parsed_len = (p_end != NULL) ? (uint16_t)(p_end - desc_start) : 0;
+  return parsed_len;
 }
 
-bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
-  uint8_t idx = 0;
-  for (idx = 0; idx < CFG_TUH_MIDI2; idx++) {
-    if (_midi2_host[idx].daddr == dev_addr && _midi2_host[idx].bInterfaceNumber == itf_num) {
-      break;
-    }
-  }
-
-  if (idx >= CFG_TUH_MIDI2) {
-    // Not our interface (e.g. Audio Control) - pass through to next
-    usbh_driver_set_config_complete(dev_addr, itf_num);
-    return true;
-  }
-
-  midih2_interface_t *p_midi = &_midi2_host[idx];
-
-  // Auto-select alt setting
-  midih2_auto_select_alt_setting(p_midi);
+static void midih2_set_config_complete(midih2_interface_t *p_midi, uint8_t idx) {
+  uint8_t dev_addr = p_midi->daddr;
 
   // Invoke descriptor_cb
   tuh_midi2_descriptor_cb_t desc_cb = {
@@ -374,7 +382,7 @@ bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
 
   // Invoke mount_cb
   tuh_midi2_mount_cb_t mount_cb = {
-    .daddr = p_midi->daddr,
+    .daddr = dev_addr,
     .bInterfaceNumber = p_midi->bInterfaceNumber,
     .protocol_version = p_midi->protocol_version,
     .alt_setting_active = p_midi->alt_setting_current,
@@ -387,7 +395,56 @@ bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
   tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx);
 
   // Signal USBH that configuration is complete
-  usbh_driver_set_config_complete(dev_addr, itf_num);
+  usbh_driver_set_config_complete(dev_addr, p_midi->bInterfaceNumber);
+}
+
+static void midih2_set_interface_cb(tuh_xfer_t *xfer) {
+  uint8_t const dev_addr = xfer->daddr;
+  uint8_t const itf_num = (uint8_t) tu_le16toh(xfer->setup->wIndex);
+
+  // Find our interface
+  for (uint8_t idx = 0; idx < CFG_TUH_MIDI2; idx++) {
+    if (_midi2_host[idx].daddr == dev_addr && _midi2_host[idx].bInterfaceNumber == itf_num) {
+      if (xfer->result == XFER_RESULT_SUCCESS) {
+        midih2_set_config_complete(&_midi2_host[idx], idx);
+      } else {
+        // SET_INTERFACE failed, fall back to alt 0
+        TU_LOG_DRV("MIDI2 SET_INTERFACE failed, falling back to alt 0\r\n");
+        _midi2_host[idx].alt_setting_current = 0;
+        midih2_set_config_complete(&_midi2_host[idx], idx);
+      }
+      return;
+    }
+  }
+}
+
+bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
+  uint8_t idx = 0;
+  for (idx = 0; idx < CFG_TUH_MIDI2; idx++) {
+    if (_midi2_host[idx].daddr == dev_addr && _midi2_host[idx].bInterfaceNumber == itf_num) {
+      break;
+    }
+  }
+
+  if (idx >= CFG_TUH_MIDI2) {
+    // Not our interface (e.g. Audio Control) - pass through to next
+    usbh_driver_set_config_complete(dev_addr, itf_num);
+    return true;
+  }
+
+  midih2_interface_t *p_midi = &_midi2_host[idx];
+
+  // Auto-select alt setting
+  midih2_auto_select_alt_setting(p_midi);
+
+  // If MIDI 2.0 detected, issue SET_INTERFACE to activate Alt Setting 1
+  if (p_midi->alt_setting_current == 1) {
+    TU_LOG_DRV("MIDI2 requesting SET_INTERFACE alt 1 for itf %u\r\n", itf_num);
+    TU_ASSERT(tuh_interface_set(dev_addr, itf_num, 1, midih2_set_interface_cb, 0));
+  } else {
+    // MIDI 1.0 only, complete immediately
+    midih2_set_config_complete(p_midi, idx);
+  }
 
   return true;
 }
diff --git a/src/device/usbd.h b/src/device/usbd.h
index af37eff56..a9f4c5f08 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -429,18 +429,20 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 //--------------------------------------------------------------------+
 
 // Alt Setting 1: MS Interface + MS Header (bcdMSC=0x0200)
+// wTotalLength covers MS Header + all CS Endpoint descriptors
+#define TUD_MIDI2_DESC_ALT1_CS_LEN(_numgtbs) (7 + (4 + (_numgtbs)) * 2)
 #define TUD_MIDI2_DESC_ALT1_HEAD_LEN (9 + 7)
-#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx) \
+#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx, _numgtbs) \
   /* MIDI Streaming Interface, Alt Setting 1 */\
-  9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum) + 1), 1, 2, TUSB_CLASS_AUDIO, AUDIO_SUBCLASS_MIDI_STREAMING, AUDIO_FUNC_PROTOCOL_CODE_UNDEF, _stridx,\
-  /* MS Header (MIDI 2.0) */\
-  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(7)
+  9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum) + 1), 1, 2, TUSB_CLASS_AUDIO, AUDIO_SUBCLASS_MIDI_STREAMING, AUDIO_FUNC_PROTOCOL_CODE_UNDEF, 0,\
+  /* MS Header (MIDI 2.0): wTotalLength = header + 2x CS Endpoint */\
+  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(TUD_MIDI2_DESC_ALT1_CS_LEN(_numgtbs))
 
-// Alt Setting 1: Standard USB Endpoint (7 bytes) + CS Endpoint (subtype 0x02)
+// Alt Setting 1: Standard USB Endpoint (7 bytes) + CS Endpoint General 2.0
 #define TUD_MIDI2_DESC_ALT1_EP_LEN(_numgtbs) (7 + 4 + (_numgtbs))
-#define TUD_MIDI2_DESC_ALT1_EP(_ep, _epsize, _numgtbs) \
+#define TUD_MIDI2_DESC_ALT1_EP(_ep, _epsize, _numgtbs, ...) \
   7, TUSB_DESC_ENDPOINT, _ep, TUSB_XFER_BULK, U16_TO_U8S_LE(_epsize), 0, \
-  (uint8_t)(4 + (_numgtbs)), TUSB_DESC_CS_ENDPOINT, MIDI_CS_ENDPOINT_GENERAL_2_0, _numgtbs
+  (uint8_t)(4 + (_numgtbs)), TUSB_DESC_CS_ENDPOINT, MIDI_CS_ENDPOINT_GENERAL_2_0, _numgtbs, ## __VA_ARGS__
 
 // Total length: Alt 0 (MIDI 1.0) + Alt 1 (UMP)
 #define TUD_MIDI2_DESC_LEN (TUD_MIDI_DESC_LEN + TUD_MIDI2_DESC_ALT1_HEAD_LEN + TUD_MIDI2_DESC_ALT1_EP_LEN(1) * 2)
@@ -455,11 +457,9 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   TUD_MIDI_DESC_EP(_epin, _epsize, 1),\
   TUD_MIDI_JACKID_OUT_EMB(1),\
   /* Alt Setting 1 (UMP) */\
-  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx),\
-  TUD_MIDI2_DESC_ALT1_EP(_epout, _epsize, 1),\
-  1, /* bAssoGrpTrmBlkID = 1 */\
-  TUD_MIDI2_DESC_ALT1_EP(_epin, _epsize, 1),\
-  1  /* bAssoGrpTrmBlkID = 1 */
+  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx, 1),\
+  TUD_MIDI2_DESC_ALT1_EP(_epout, _epsize, 1, 1 /* bAssoGrpTrmBlkID */),\
+  TUD_MIDI2_DESC_ALT1_EP(_epin, _epsize, 1, 1 /* bAssoGrpTrmBlkID */)
 
 //--------------------------------------------------------------------+
 // Audio Descriptor Templates
-- 
cgit v1.3.1


From 97852816e873bf7f91f3a81f093ad08f96179656 Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Wed, 22 Apr 2026 18:04:56 -0300
Subject: midi2: align descriptors with USB-MIDI 2.0 spec

Brings the MIDI 2.0 device driver into full conformance with USB
Device Class Definition for MIDI Devices v2.0 (USB-IF, May 2020).

- Alt 1 MS Interface Header wTotalLength now reports 0x0007 per
  Table 5-2 ("set to match bLength"), replacing the prior 0x0011
  carried over from USB-MIDI 1.0 conventions.
- GET_DESCRIPTOR class request now validates bmRequestType direction,
  type and recipient plus wIndex and wValue high byte per Section 6.
- iBlockItem in the default Group Terminal Block is driven by
  CFG_TUD_MIDI2_BLOCK_STRIDX so applications can attach a UI string
  descriptor to the block per Table 5-6.
- UMP word byte order assumption (little-endian host per Section
  3.2.2) is documented inline so future big-endian ports know where
  to wrap access with tu_htole32 / tu_le32toh.

Validated on RP2040 and ESP32-P4 under Linux kernel 6.17: lsusb -v
reports wTotalLength = 0x0007 on Alt 1 MS Header (raw bytes
07 24 01 00 02 07 00). amidi -l enumerates Group Terminals exposed
via the class-specific GET_DESCRIPTOR response.
---
 src/class/midi/midi2_device.c                      | 47 ++++++++++++++++------
 src/device/usbd.h                                  | 12 +++---
 src/tusb_option.h                                  |  6 +++
 .../test/device/midi2/test_midi2_device.c          |  3 ++
 4 files changed, 49 insertions(+), 19 deletions(-)

(limited to 'src/device')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 34e467fc6..15daad096 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -43,6 +43,16 @@ TU_ATTR_WEAK bool tud_midi2_get_req_itf_cb(uint8_t rhport, const tusb_control_re
   (void) rhport; (void) request; return false;
 }
 
+//--------------------------------------------------------------------+
+// Byte order note
+//--------------------------------------------------------------------+
+// Per USB-MIDI 2.0 Section 3.2.2, each 32-bit UMP word is transmitted with the
+// least significant byte first. This driver reads and writes UMP words as
+// native uint32_t through tu_edpt_stream_read/write. All TinyUSB targets are
+// little-endian, so the in-memory layout already matches the wire order and no
+// swap is needed. If a big-endian target is ever supported, wrap access with
+// tu_htole32 / tu_le32toh at the buffer boundary.
+
 //--------------------------------------------------------------------+
 // UMP Stream Message Constants
 //--------------------------------------------------------------------+
@@ -133,7 +143,7 @@ static const uint8_t _default_gtb_desc[] = {
   0x00,                                     // bGrpTrmBlkType: bidirectional
   0x00,                                     // nGroupTrm: first group (0)
   CFG_TUD_MIDI2_NUM_GROUPS,                 // nNumGroupTrm
-  0,                                        // iBlockItem: no string
+  CFG_TUD_MIDI2_BLOCK_STRIDX,               // iBlockItem: string descriptor index (0 = none)
   0x00,                                     // bMIDIProtocol: unknown/not fixed
   0, 0,                                     // wMaxInputBandwidth: unknown
   0, 0                                      // wMaxOutputBandwidth: unknown
@@ -554,19 +564,30 @@ bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_re
     }
 
     case TUSB_REQ_GET_DESCRIPTOR: {
-      // wValue: descriptor type (high) | index (low)
-      // 0x26 = CS_GRP_TRM_BLOCK, index 0x01
-      if (request->wValue == ((uint16_t)MIDI2_CS_GRP_TRM_BLOCK << 8 | 0x01)) {
-        if (tud_midi2_get_req_itf_cb(rhport, request)) return true;
-
-        uint16_t len = request->wLength;
-        if (len > sizeof(_default_gtb_desc)) {
-          len = sizeof(_default_gtb_desc);
-        }
-        tud_control_xfer(rhport, request, (void*)(uintptr_t) _default_gtb_desc, len);
-        return true;
+      // USB-MIDI 2.0 Section 6: GTB descriptor retrieval
+      //   bmRequestType = 0x81 (Device-to-Host, Standard, Interface)
+      //   wValue  = CS_GR_TRM_BLOCK (0x26) in high byte, alt setting in low byte
+      //   wIndex  = interface number
+      if (request->bmRequestType_bit.direction != TUSB_DIR_IN) return false;
+      if (request->bmRequestType_bit.type      != TUSB_REQ_TYPE_STANDARD) return false;
+      if (request->bmRequestType_bit.recipient != TUSB_REQ_RCPT_INTERFACE) return false;
+      if (tu_u16_high(request->wValue)         != MIDI2_CS_GRP_TRM_BLOCK) return false;
+
+      uint8_t itf_num = tu_u16_low(request->wIndex);
+      uint8_t idx     = find_midi2_itf_by_num(itf_num);
+      if (idx >= CFG_TUD_MIDI2) return false;
+
+      // Only Alt Setting 1 exposes Group Terminal Block descriptors.
+      if (tu_u16_low(request->wValue) != 0x01) return false;
+
+      if (tud_midi2_get_req_itf_cb(rhport, request)) return true;
+
+      uint16_t len = request->wLength;
+      if (len > sizeof(_default_gtb_desc)) {
+        len = sizeof(_default_gtb_desc);
       }
-      return false;
+      tud_control_xfer(rhport, request, (void*)(uintptr_t) _default_gtb_desc, len);
+      return true;
     }
 
     default:
diff --git a/src/device/usbd.h b/src/device/usbd.h
index a9f4c5f08..abce5a887 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -429,14 +429,14 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 //--------------------------------------------------------------------+
 
 // Alt Setting 1: MS Interface + MS Header (bcdMSC=0x0200)
-// wTotalLength covers MS Header + all CS Endpoint descriptors
-#define TUD_MIDI2_DESC_ALT1_CS_LEN(_numgtbs) (7 + (4 + (_numgtbs)) * 2)
+// Per USB-MIDI 2.0 Table 5-2: wTotalLength in the MS Header is not used in 2.0
+// and shall be set to match bLength (= 0x0007) for conformity with USB-MIDI 1.0.
 #define TUD_MIDI2_DESC_ALT1_HEAD_LEN (9 + 7)
-#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx, _numgtbs) \
+#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx) \
   /* MIDI Streaming Interface, Alt Setting 1 */\
   9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum) + 1), 1, 2, TUSB_CLASS_AUDIO, AUDIO_SUBCLASS_MIDI_STREAMING, AUDIO_FUNC_PROTOCOL_CODE_UNDEF, 0,\
-  /* MS Header (MIDI 2.0): wTotalLength = header + 2x CS Endpoint */\
-  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(TUD_MIDI2_DESC_ALT1_CS_LEN(_numgtbs))
+  /* MS Header (MIDI 2.0): wTotalLength = bLength per spec */\
+  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(0x0007)
 
 // Alt Setting 1: Standard USB Endpoint (7 bytes) + CS Endpoint General 2.0
 #define TUD_MIDI2_DESC_ALT1_EP_LEN(_numgtbs) (7 + 4 + (_numgtbs))
@@ -457,7 +457,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   TUD_MIDI_DESC_EP(_epin, _epsize, 1),\
   TUD_MIDI_JACKID_OUT_EMB(1),\
   /* Alt Setting 1 (UMP) */\
-  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx, 1),\
+  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx),\
   TUD_MIDI2_DESC_ALT1_EP(_epout, _epsize, 1, 1 /* bAssoGrpTrmBlkID */),\
   TUD_MIDI2_DESC_ALT1_EP(_epin, _epsize, 1, 1 /* bAssoGrpTrmBlkID */)
 
diff --git a/src/tusb_option.h b/src/tusb_option.h
index 4483c2200..2614110fc 100644
--- a/src/tusb_option.h
+++ b/src/tusb_option.h
@@ -682,6 +682,12 @@
   #define CFG_TUD_MIDI2_PRODUCT_ID  "TinyUSB-MIDI2"
 #endif
 
+// String descriptor index for the Group Terminal Block (iBlockItem, Table 5-6).
+// 0 = no string descriptor (default, spec-allowed).
+#ifndef CFG_TUD_MIDI2_BLOCK_STRIDX
+  #define CFG_TUD_MIDI2_BLOCK_STRIDX 0
+#endif
+
 #ifndef CFG_TUD_VENDOR
   #define CFG_TUD_VENDOR          0
 #endif
diff --git a/test/unit-test/test/device/midi2/test_midi2_device.c b/test/unit-test/test/device/midi2/test_midi2_device.c
index 9d716d93b..1314c2585 100644
--- a/test/unit-test/test/device/midi2/test_midi2_device.c
+++ b/test/unit-test/test/device/midi2/test_midi2_device.c
@@ -147,6 +147,9 @@ void test_midi2_descriptor_bytes(void) {
   TEST_ASSERT_EQUAL(MIDI_CS_INTERFACE_HEADER, desc[ms2_offset + 2]);
   TEST_ASSERT_EQUAL(0x00, desc[ms2_offset + 3]);
   TEST_ASSERT_EQUAL(0x02, desc[ms2_offset + 4]);
+  // USB-MIDI 2.0 Table 5-2: wTotalLength shall match bLength (= 0x0007)
+  TEST_ASSERT_EQUAL(0x07, desc[ms2_offset + 5]);
+  TEST_ASSERT_EQUAL(0x00, desc[ms2_offset + 6]);
 }
 
 void test_midi2_descriptor_alt1_cs_endpoint_subtype(void) {
-- 
cgit v1.3.1


From 7b791916a702c28f8f39e9bfc5eb8455d0942865 Mon Sep 17 00:00:00 2001
From: Ha Thach <thach@tinyusb.org>
Date: Tue, 16 Jun 2026 17:36:17 +0700
Subject: device: clamp EP0 OUT data copy to the control transfer buffer
 (#3705)

* device: clamp EP0 OUT data copy to the control transfer buffer

usbd_control_xfer_cb() copied xferred_bytes from the EP0 bounce buffer
into the requester's buffer with no bound. A non-compliant host that
sends an OUT data packet larger than the control transfer's data_len
(= min(len, wLength), the buffer capacity) would overflow that buffer
and over-count total_xferred. Clamp xferred_bytes to the remaining
buffer space before the memcpy and accounting.
---
 src/device/usbd.c                           |  2 ++
 test/unit-test/test/device/usbd/test_usbd.c | 52 ++++++++++++++++++++++++++++-
 2 files changed, 53 insertions(+), 1 deletion(-)

(limited to 'src/device')

diff --git a/src/device/usbd.c b/src/device/usbd.c
index 55ad330c1..f87b63111 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -914,6 +914,8 @@ static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t
   // Data stage progress
   if (ctrl_xfer->request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
     TU_VERIFY(ctrl_xfer->buffer);
+    // Clamp host overrun to remaining capacity (data_len) so memcpy can't overflow the caller buffer
+    xferred_bytes = tu_min32(xferred_bytes, ctrl_xfer->data_len - ctrl_xfer->total_xferred);
     if (ctrl_xfer->buffer != _ctrl_epbuf.buf) {
       memcpy(ctrl_xfer->buffer, _ctrl_epbuf.buf, xferred_bytes);
     }
diff --git a/test/unit-test/test/device/usbd/test_usbd.c b/test/unit-test/test/device/usbd/test_usbd.c
index 3a2cf3217..7f3c3f5b2 100644
--- a/test/unit-test/test/device/usbd/test_usbd.c
+++ b/test/unit-test/test/device/usbd/test_usbd.c
@@ -29,7 +29,7 @@
 #include "tusb_fifo.h"
 #include "tusb.h"
 #include "usbd.h"
-TEST_SOURCE_FILE("usbd_control.c")
+TEST_SOURCE_FILE("usbd.c")
 
 // Mock File
 #include "mock_dcd.h"
@@ -100,6 +100,16 @@ tusb_control_request_t const req_get_desc_configuration =
   .wLength = 256
 };
 
+// Vendor OUT control request (direction OUT, type Vendor, recipient Device), 8-byte data stage
+tusb_control_request_t const req_vendor_out =
+{
+  .bmRequestType = 0x40,
+  .bRequest = 0x01,
+  .wValue = 0x0000,
+  .wIndex = 0x0000,
+  .wLength = 8
+};
+
 uint8_t const* desc_device;
 uint8_t const* desc_configuration;
 
@@ -120,6 +130,19 @@ uint16_t const* tud_descriptor_string_cb(uint8_t index, uint16_t langid) {
   return NULL;
 }
 
+// Backing buffer for the vendor OUT data stage. Sized to EP0 max packet so an (untested) regression
+// that drops the clamp can't corrupt memory here; the regression is caught by the expectation below.
+static uint8_t vendor_out_buf[CFG_TUD_ENDPOINT0_SIZE];
+
+bool tud_vendor_control_xfer_cb(uint8_t rhport_, uint8_t stage, tusb_control_request_t const* request) {
+  (void) request;
+  if (stage == CONTROL_STAGE_SETUP) {
+    // Offer only an 8-byte capacity even though the data stage may receive a larger packet
+    return tud_control_xfer(rhport_, request, vendor_out_buf, 8);
+  }
+  return true;
+}
+
 void setUp(void) {
   dcd_int_disable_Ignore();
   dcd_int_enable_Ignore();
@@ -246,3 +269,30 @@ void test_usbd_control_in_zlp(void)
 
   tud_task();
 }
+
+//--------------------------------------------------------------------+
+// Control OUT data stage host overrun
+//--------------------------------------------------------------------+
+
+// A non-compliant host sends an OUT data packet larger than the buffer the class offered:
+// wLength = 8, but the DCD reports a full CFG_TUD_ENDPOINT0_SIZE packet. usbd must clamp the
+// copy/accounting to the 8-byte capacity so total_xferred reaches wLength, ends the data stage,
+// and queues the IN status stage. Without the clamp total_xferred overshoots wLength and usbd
+// re-arms an OUT data packet (EDPT_CTRL_OUT) instead, failing the EDPT_CTRL_IN expectation below.
+void test_usbd_control_out_overrun_clamp(void)
+{
+  dcd_event_setup_received(rhport, (uint8_t*) &req_vendor_out, false);
+
+  // Data stage: usbd arms an 8-byte OUT into its internal bounce buffer (buffer ptr is internal)
+  dcd_edpt_xfer_ExpectAndReturn(rhport, EDPT_CTRL_OUT, NULL, 8, false, true);
+  dcd_edpt_xfer_IgnoreArg_buffer();
+  // Host overrun: DCD reports a full max packet, larger than the 8-byte capacity
+  dcd_event_xfer_complete(rhport, EDPT_CTRL_OUT, CFG_TUD_ENDPOINT0_SIZE, XFER_RESULT_SUCCESS, false);
+
+  // Clamp -> total_xferred == wLength -> data stage done -> IN status stage queued
+  dcd_edpt_xfer_ExpectAndReturn(rhport, EDPT_CTRL_IN, NULL, 0, false, true);
+  dcd_event_xfer_complete(rhport, EDPT_CTRL_IN, 0, 0, false);
+  dcd_edpt0_status_complete_ExpectWithArray(rhport, &req_vendor_out, 1);
+
+  tud_task();
+}
-- 
cgit v1.3.1