From 3e5b79282a66a33a8cefc1f8584923819ff97eda Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Mar 2026 19:43:46 +0000
Subject: net: upgrade net_lwip_webserver to separate FS/HS descriptors and add
 bInterval to TUD_CDC_NCM_DESCRIPTOR

Co-authored-by: HiFiPhile <4375114+HiFiPhile@users.noreply.github.com>
Agent-Logs-Url: https://github.com/hathach/tinyusb/sessions/e212b526-e279-4a83-88bf-a742df293165
---
 src/device/usbd.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'src')

diff --git a/src/device/usbd.h b/src/device/usbd.h
index d3a6dccbb..93fb588df 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1026,9 +1026,9 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 // Length of template descriptor
 #define TUD_CDC_NCM_DESC_LEN  (8+9+5+5+13+6+7+9+9+7+7)
 
-// CDC-ECM Descriptor Template
-// Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size.
-#define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize) \
+// CDC-NCM Descriptor Template
+// Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), size, max segment size, EP notification bInterval.
+#define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize, _ep_notif_interval) \
   /* Interface Association */\
   8, TUSB_DESC_INTERFACE_ASSOCIATION, _itfnum, 2, TUSB_CLASS_CDC, CDC_COMM_SUBCLASS_NETWORK_CONTROL_MODEL, 0, 0,\
   /* CDC Control Interface */\
@@ -1042,7 +1042,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   /* CDC-NCM Functional Descriptor */\
   6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), 0, \
   /* Endpoint Notification */\
-  7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), 50,\
+  7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), _ep_notif_interval,\
   /* CDC Data Interface (default inactive) */\
   9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum)+1), 0, 0, TUSB_CLASS_CDC_DATA, 0, NCM_DATA_PROTOCOL_NETWORK_TRANSFER_BLOCK, 0,\
   /* CDC Data Interface (alternative active) */\
-- 
cgit v1.3.1


From ebeb495bd0cc3deb1758c6fcf79739ae5eac543d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Mar 2026 19:54:27 +0000
Subject: net: remove CFG_TUD_NET_ENDPOINT_SIZE, manage ZLP based on real speed
 in drivers

Co-authored-by: HiFiPhile <4375114+HiFiPhile@users.noreply.github.com>
Agent-Logs-Url: https://github.com/hathach/tinyusb/sessions/5d355974-2223-4071-8d14-b6d4ac1fd030
---
 hw/mcu/st/cmsis_device_f4        | 1 +
 hw/mcu/st/stm32f4xx_hal_driver   | 1 +
 lib/CMSIS_5                      | 1 +
 lib/FreeRTOS-Kernel              | 1 +
 lib/lwip                         | 1 +
 lib/threadx                      | 1 +
 src/class/net/ecm_rndis_device.c | 4 ++--
 src/class/net/ncm_device.c       | 2 +-
 src/class/net/net_device.h       | 3 ---
 tools/linkermap                  | 1 +
 tools/uf2                        | 1 +
 11 files changed, 11 insertions(+), 6 deletions(-)
 create mode 160000 hw/mcu/st/cmsis_device_f4
 create mode 160000 hw/mcu/st/stm32f4xx_hal_driver
 create mode 160000 lib/CMSIS_5
 create mode 160000 lib/FreeRTOS-Kernel
 create mode 160000 lib/lwip
 create mode 160000 lib/threadx
 create mode 160000 tools/linkermap
 create mode 160000 tools/uf2

(limited to 'src')

diff --git a/hw/mcu/st/cmsis_device_f4 b/hw/mcu/st/cmsis_device_f4
new file mode 160000
index 000000000..3c77349ce
--- /dev/null
+++ b/hw/mcu/st/cmsis_device_f4
@@ -0,0 +1 @@
+Subproject commit 3c77349ce04c8af401454cc51f85ea9a50e34fc1
diff --git a/hw/mcu/st/stm32f4xx_hal_driver b/hw/mcu/st/stm32f4xx_hal_driver
new file mode 160000
index 000000000..b6f0ed382
--- /dev/null
+++ b/hw/mcu/st/stm32f4xx_hal_driver
@@ -0,0 +1 @@
+Subproject commit b6f0ed3829f3829eb358a2e7417d80bba1a42db7
diff --git a/lib/CMSIS_5 b/lib/CMSIS_5
new file mode 160000
index 000000000..2b7495b85
--- /dev/null
+++ b/lib/CMSIS_5
@@ -0,0 +1 @@
+Subproject commit 2b7495b8535bdcb306dac29b9ded4cfb679d7e5c
diff --git a/lib/FreeRTOS-Kernel b/lib/FreeRTOS-Kernel
new file mode 160000
index 000000000..cc0e0707c
--- /dev/null
+++ b/lib/FreeRTOS-Kernel
@@ -0,0 +1 @@
+Subproject commit cc0e0707c0c748713485b870bb980852b210877f
diff --git a/lib/lwip b/lib/lwip
new file mode 160000
index 000000000..159e31b68
--- /dev/null
+++ b/lib/lwip
@@ -0,0 +1 @@
+Subproject commit 159e31b689577dbf69cf0683bbaffbd71fa5ee10
diff --git a/lib/threadx b/lib/threadx
new file mode 160000
index 000000000..4b6e8100d
--- /dev/null
+++ b/lib/threadx
@@ -0,0 +1 @@
+Subproject commit 4b6e8100d932a3a67b34c6eb17f84f3bffb9e2ae
diff --git a/src/class/net/ecm_rndis_device.c b/src/class/net/ecm_rndis_device.c
index eaa82c187..773c495ed 100644
--- a/src/class/net/ecm_rndis_device.c
+++ b/src/class/net/ecm_rndis_device.c
@@ -356,8 +356,8 @@ bool netd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_
   /* data transmission finished */
   if (ep_addr == _netd_itf.ep_in) {
     /* TinyUSB requires the class driver to implement ZLP (since ZLP usage is class-specific) */
-
-    if (xferred_bytes && (0 == (xferred_bytes % CFG_TUD_NET_ENDPOINT_SIZE))) {
+    uint16_t const ep_size = (tud_speed_get() == TUSB_SPEED_HIGH) ? 512 : 64;
+    if (xferred_bytes && (0 == (xferred_bytes % ep_size))) {
       do_in_xfer(NULL, 0); /* a ZLP is needed */
     } else {
       /* we're finally finished */
diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 405e4467b..4f75dc478 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -340,7 +340,7 @@ static xmit_ntb_t *xmit_get_next_ready_ntb(void) {
 static bool xmit_insert_required_zlp(uint8_t rhport, uint32_t xferred_bytes) {
   TU_LOG_DRV("xmit_insert_required_zlp(%d,%ld)\n", rhport, xferred_bytes);
 
-  if (xferred_bytes == 0 || xferred_bytes % CFG_TUD_NET_ENDPOINT_SIZE != 0) {
+  if (xferred_bytes == 0 || xferred_bytes % (tud_speed_get() == TUSB_SPEED_HIGH ? 512 : 64) != 0) {
     return false;
   }
 
diff --git a/src/class/net/net_device.h b/src/class/net/net_device.h
index 96c03fd61..849f8a2f9 100644
--- a/src/class/net/net_device.h
+++ b/src/class/net/net_device.h
@@ -35,9 +35,6 @@
 #error "Cannot enable both ECM_RNDIS and NCM network drivers"
 #endif
 
-/* declared here, NOT in usb_descriptors.c, so that the driver can intelligently ZLP as needed */
-#define CFG_TUD_NET_ENDPOINT_SIZE (TUD_OPT_HIGH_SPEED ? 512 : 64)
-
 /* Maximum Transmission Unit (in bytes) of the network, including Ethernet header */
 #ifndef CFG_TUD_NET_MTU
 #define CFG_TUD_NET_MTU           1514
diff --git a/tools/linkermap b/tools/linkermap
new file mode 160000
index 000000000..8e1f440fa
--- /dev/null
+++ b/tools/linkermap
@@ -0,0 +1 @@
+Subproject commit 8e1f440fa15c567aceb5aa0d14f6d18c329cc67f
diff --git a/tools/uf2 b/tools/uf2
new file mode 160000
index 000000000..c594542b2
--- /dev/null
+++ b/tools/uf2
@@ -0,0 +1 @@
+Subproject commit c594542b2faa01cc33a2b97c9fbebc38549df80a
-- 
cgit v1.3.1


From c843e5e2a76302eabc2228c42ffecd2a242443cb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Mar 2026 19:59:29 +0000
Subject: net: cache ep_size in local variable in ncm_device.c
 xmit_insert_required_zlp

Co-authored-by: HiFiPhile <4375114+HiFiPhile@users.noreply.github.com>
Agent-Logs-Url: https://github.com/hathach/tinyusb/sessions/5d355974-2223-4071-8d14-b6d4ac1fd030
---
 src/class/net/ncm_device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 4f75dc478..cf32514ba 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -340,7 +340,8 @@ static xmit_ntb_t *xmit_get_next_ready_ntb(void) {
 static bool xmit_insert_required_zlp(uint8_t rhport, uint32_t xferred_bytes) {
   TU_LOG_DRV("xmit_insert_required_zlp(%d,%ld)\n", rhport, xferred_bytes);
 
-  if (xferred_bytes == 0 || xferred_bytes % (tud_speed_get() == TUSB_SPEED_HIGH ? 512 : 64) != 0) {
+  uint16_t const ep_size = (tud_speed_get() == TUSB_SPEED_HIGH) ? 512 : 64;
+  if (xferred_bytes == 0 || xferred_bytes % ep_size != 0) {
     return false;
   }
 
-- 
cgit v1.3.1


From f494d3517fe21ecd7259cd8a90d2c6709edd0e90 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Mar 2026 20:06:52 +0000
Subject: net: save actual ep_size from descriptor in netd_open instead of
 hardcoding 64/512

Co-authored-by: HiFiPhile <4375114+HiFiPhile@users.noreply.github.com>
Agent-Logs-Url: https://github.com/hathach/tinyusb/sessions/4c20b579-db28-4643-b062-81881adcf6c1
---
 src/class/net/ecm_rndis_device.c | 7 +++++--
 src/class/net/ncm_device.c       | 4 +++-
 2 files changed, 8 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/class/net/ecm_rndis_device.c b/src/class/net/ecm_rndis_device.c
index 773c495ed..d4c2ebf9a 100644
--- a/src/class/net/ecm_rndis_device.c
+++ b/src/class/net/ecm_rndis_device.c
@@ -51,6 +51,7 @@ typedef struct {
   uint8_t ep_notif;
   uint8_t ep_in;
   uint8_t ep_out;
+  uint16_t ep_size;     // bulk endpoint max packet size (IN and OUT assumed equal)
 
   bool ecm_mode;
 
@@ -176,6 +177,9 @@ uint16_t netd_open(uint8_t rhport, tusb_desc_interface_t const * itf_desc, uint1
   // Pair of endpoints
   TU_ASSERT(TUSB_DESC_ENDPOINT == tu_desc_type(p_desc), 0);
 
+  // Save the actual bulk endpoint size (IN and OUT assumed equal)
+  _netd_itf.ep_size = tu_edpt_packet_size((tusb_desc_endpoint_t const *) p_desc);
+
   if (_netd_itf.ecm_mode) {
     // ECM by default is in-active, save the endpoint attribute
     // to open later when received setInterface
@@ -356,8 +360,7 @@ bool netd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_
   /* data transmission finished */
   if (ep_addr == _netd_itf.ep_in) {
     /* TinyUSB requires the class driver to implement ZLP (since ZLP usage is class-specific) */
-    uint16_t const ep_size = (tud_speed_get() == TUSB_SPEED_HIGH) ? 512 : 64;
-    if (xferred_bytes && (0 == (xferred_bytes % ep_size))) {
+    if (xferred_bytes && (0 == (xferred_bytes % _netd_itf.ep_size))) {
       do_in_xfer(NULL, 0); /* a ZLP is needed */
     } else {
       /* we're finally finished */
diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index cf32514ba..fe33d0247 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -83,6 +83,7 @@ typedef struct {
   uint8_t itf_num;      // interface number
   uint8_t itf_data_alt; // ==0 -> no endpoints, i.e. no network traffic, ==1 -> normal operation with two endpoints (spec, chapter 5.3)
   uint8_t rhport;       // storage of \a rhport because some callbacks are done without it
+  uint16_t ep_size;     // bulk endpoint max packet size (IN and OUT assumed equal)
 
   // recv handling
   recv_ntb_t *recv_free_ntb[RECV_NTB_N];                // free list of recv NTBs
@@ -340,7 +341,7 @@ static xmit_ntb_t *xmit_get_next_ready_ntb(void) {
 static bool xmit_insert_required_zlp(uint8_t rhport, uint32_t xferred_bytes) {
   TU_LOG_DRV("xmit_insert_required_zlp(%d,%ld)\n", rhport, xferred_bytes);
 
-  uint16_t const ep_size = (tud_speed_get() == TUSB_SPEED_HIGH) ? 512 : 64;
+  uint16_t const ep_size = ncm_interface.ep_size;
   if (xferred_bytes == 0 || xferred_bytes % ep_size != 0) {
     return false;
   }
@@ -906,6 +907,7 @@ uint16_t netd_open(uint8_t rhport, tusb_desc_interface_t const *itf_desc, uint16
   // a TUSB_DESC_ENDPOINT (actually two) must follow, open these endpoints
   TU_ASSERT(tu_desc_type(p_desc) == TUSB_DESC_ENDPOINT, 0);
   TU_ASSERT(usbd_open_edpt_pair(rhport, p_desc, 2, TUSB_XFER_BULK, &ncm_interface.ep_out, &ncm_interface.ep_in));
+  ncm_interface.ep_size = tu_edpt_packet_size((tusb_desc_endpoint_t const *) p_desc);
   drv_len += 2 * sizeof(tusb_desc_endpoint_t);
 
   return drv_len;
-- 
cgit v1.3.1


From 9c49c0eb215057885ae0aec46172778b9cf9b9a5 Mon Sep 17 00:00:00 2001
From: Hakan Lindestaf <hakan@lindestaf.com>
Date: Wed, 22 Apr 2026 17:48:07 -0500
Subject: midi host: raise default RX FIFO above EP size, document drain
 requirement

Follow-up to #3239. tuh_midi_stream_read terminates on cable-number
transitions, leaving residue in the FIFO. With the default RX FIFO
sized equal to one bulk packet, the next bulk IN transfer fails to
queue and the driver silently stops receiving. Raising the default
to 2x bulk gives single-call apps a full packet of headroom and
documents the drain-loop expectation.

Reproduced with Akai LPD8 mk1 (VID 09E8 PID 0075) on STM32H753 DWC2
host; fixed with this patch. See #3613 for full repro + captures.
---
 src/class/midi/midi_host.h | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi_host.h b/src/class/midi/midi_host.h
index b9ab0130d..4eefed4ba 100644
--- a/src/class/midi/midi_host.h
+++ b/src/class/midi/midi_host.h
@@ -38,11 +38,16 @@ extern "C" {
 // Class Driver Configuration
 //--------------------------------------------------------------------+
 #ifndef CFG_TUH_MIDI_RX_BUFSIZE
-  #define CFG_TUH_MIDI_RX_BUFSIZE TUH_EPSIZE_BULK_MAX
+  // Default sized to 2x the bulk endpoint to absorb residue left in the FIFO
+  // when tuh_midi_stream_read() stops early on a cable-number transition.
+  // Sizing this equal to the endpoint packet size (the historical default)
+  // can cause the next bulk IN transfer to fail to queue silently, wedging
+  // the stream. See the drain-loop note on tuh_midi_stream_read() below.
+  #define CFG_TUH_MIDI_RX_BUFSIZE (2 * TUH_EPSIZE_BULK_MAX)
 #endif
 
 #ifndef CFG_TUH_MIDI_TX_BUFSIZE
-  #define CFG_TUH_MIDI_TX_BUFSIZE TUH_EPSIZE_BULK_MAX
+  #define CFG_TUH_MIDI_TX_BUFSIZE (2 * TUH_EPSIZE_BULK_MAX)
 #endif
 
 #ifndef CFG_TUH_MIDI_EP_BUFSIZE
@@ -150,6 +155,13 @@ uint32_t tuh_midi_stream_write(uint8_t idx, uint8_t cable_num, const uint8_t *p_
 // Note that this function ignores the CIN field of the MIDI packet
 // because a number of commercial devices out there do not encode
 // it properly.
+//
+// NOTE: this function terminates when it encounters an event whose cable
+// number differs from the one being returned. Applications should invoke
+// it in a loop until it returns 0 (or until tuh_midi_read_available()
+// returns 0) to guarantee the stream FIFO is fully drained per callback.
+// Leaving bytes in the FIFO across callbacks can prevent subsequent bulk
+// IN transfers from landing.
 uint32_t tuh_midi_stream_read(uint8_t idx, uint8_t *p_cable_num, uint8_t *p_buffer, uint16_t bufsize);
 
 #endif
-- 
cgit v1.3.1


From d24cf89e4896ee959c034818bd4ecb6210714042 Mon Sep 17 00:00:00 2001
From: Hakan Lindestaf <hakan@lindestaf.com>
Date: Wed, 22 Apr 2026 23:32:05 +0000
Subject: Revert MIDI TX buffer size definition

---
 src/class/midi/midi_host.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/class/midi/midi_host.h b/src/class/midi/midi_host.h
index 4eefed4ba..000d815c4 100644
--- a/src/class/midi/midi_host.h
+++ b/src/class/midi/midi_host.h
@@ -47,7 +47,7 @@ extern "C" {
 #endif
 
 #ifndef CFG_TUH_MIDI_TX_BUFSIZE
-  #define CFG_TUH_MIDI_TX_BUFSIZE (2 * TUH_EPSIZE_BULK_MAX)
+  #define CFG_TUH_MIDI_TX_BUFSIZE TUH_EPSIZE_BULK_MAX
 #endif
 
 #ifndef CFG_TUH_MIDI_EP_BUFSIZE
-- 
cgit v1.3.1


From 0649b18b2e8b2e76b38f6280796ba48a51882eac Mon Sep 17 00:00:00 2001
From: nminaylov <nm29719@gmail.com>
Date: Fri, 24 Apr 2026 22:39:02 +0300
Subject: NCM packet filter support

---
 src/class/net/ncm_device.c | 5 +++++
 src/device/usbd.h          | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 405e4467b..a1ad9b205 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -997,6 +997,11 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
           tud_control_xfer(rhport, request, (void *) (uintptr_t) &ntb_parameters, sizeof(ntb_parameters));
         } break;
 
+        case NCM_SET_ETHERNET_PACKET_FILTER: {
+          tud_control_xfer(rhport, request, NULL, 0);
+        } break;            
+          
+
           // unsupported request
         default:
           return false;
diff --git a/src/device/usbd.h b/src/device/usbd.h
index d3a6dccbb..45beb7c4c 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1040,7 +1040,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   /* CDC-NCM Functional Descriptor */\
   13, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_ETHERNET_NETWORKING, _mac_stridx, 0, 0, 0, 0, U16_TO_U8S_LE(_maxsegmentsize), U16_TO_U8S_LE(0), 0, \
   /* CDC-NCM Functional Descriptor */\
-  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), 0, \
+  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), 0x01, \
   /* Endpoint Notification */\
   7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), 50,\
   /* CDC Data Interface (default inactive) */\
-- 
cgit v1.3.1


From 2cdd98104ece869f3a5eda3dd9c2b02f5b4c318d Mon Sep 17 00:00:00 2001
From: nminaylov <nm29719@gmail.com>
Date: Mon, 27 Apr 2026 14:40:18 +0300
Subject: NCM caps enum

---
 src/class/net/ncm_device.c |  3 +--
 src/class/net/net_device.h | 10 ++++++++++
 src/device/usbd.h          |  5 ++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index a1ad9b205..83e8bffab 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -999,8 +999,7 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
 
         case NCM_SET_ETHERNET_PACKET_FILTER: {
           tud_control_xfer(rhport, request, NULL, 0);
-        } break;            
-          
+        } break;
 
           // unsupported request
         default:
diff --git a/src/class/net/net_device.h b/src/class/net/net_device.h
index 96c03fd61..61ff6b2d6 100644
--- a/src/class/net/net_device.h
+++ b/src/class/net/net_device.h
@@ -50,6 +50,16 @@ typedef enum
   NCM_DATA_PROTOCOL_NETWORK_TRANSFER_BLOCK = 0x01
 } ncm_data_interface_protocol_code_t;
 
+// Table 5.2 bmNetworkCapabilities bits
+typedef enum {
+  NCM_NETWORK_CAPS_NONE              = 0x00,
+  NCM_NETWORK_CAPS_ETH_FILTER        = (1 << 0),
+  NCM_NETWORK_CAPS_NET_ADDRESS       = (1 << 1),
+  NCM_NETWORK_CAPS_ENCAP_COMMAND     = (1 << 2),
+  NCM_NETWORK_CAPS_MAX_DATAGRAM_SIZE = (1 << 3),
+  NCM_NETWORK_CAPS_CRC_MODE          = (1 << 4),
+  NCM_NETWORK_CAPS_NTB_INPUT_SIZE    = (1 << 5)
+} ncm_network_capabilities_t;
 
 #ifdef __cplusplus
  extern "C" {
diff --git a/src/device/usbd.h b/src/device/usbd.h
index 45beb7c4c..96144350e 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1023,6 +1023,9 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 // CDC-NCM Descriptor Templates
 //--------------------------------------------------------------------+
 
+// NCM Capabilities, bitmap of NCM_NETWORK_CAPS_* bits.
+#define TUD_CDC_NCM_CAPS (NCM_NETWORK_CAPS_ETH_FILTER)
+
 // Length of template descriptor
 #define TUD_CDC_NCM_DESC_LEN  (8+9+5+5+13+6+7+9+9+7+7)
 
@@ -1040,7 +1043,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   /* CDC-NCM Functional Descriptor */\
   13, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_ETHERNET_NETWORKING, _mac_stridx, 0, 0, 0, 0, U16_TO_U8S_LE(_maxsegmentsize), U16_TO_U8S_LE(0), 0, \
   /* CDC-NCM Functional Descriptor */\
-  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), 0x01, \
+  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), TUD_CDC_NCM_CAPS, \
   /* Endpoint Notification */\
   7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), 50,\
   /* CDC Data Interface (default inactive) */\
-- 
cgit v1.3.1


From 7258db344e99398a5e10f4c65b24d38c6b94b92b Mon Sep 17 00:00:00 2001
From: mickabrig7 <mickaelgarabello7@gmail.com>
Date: Tue, 28 Apr 2026 12:24:00 +0900
Subject: fix(dcd_ch32_usbfs): fix dropped bulk OUT packets by properly
 re-arming EP_RX_CTRL state

---
 src/portable/wch/dcd_ch32_usbfs.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index 5cd25e33e..39c1cfb4a 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -118,6 +118,9 @@ static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
 
     if (ep == 0) {
       EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
+    } else {
+      EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) |
+                       (xfer->valid ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK);
     }
   }
 }
@@ -312,6 +315,8 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t t
 
   if (dir == TUSB_DIR_IN) {
     update_in(rhport, ep, true);
+  } else {
+    EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) | USBFS_EP_R_RES_ACK;
   }
   return true;
 }
-- 
cgit v1.3.1


From 9d3ad336bfad062fa1e6f6d63feb97a9851cc9e1 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Wed, 29 Apr 2026 17:27:59 +0700
Subject: deprecated `usbd_control.c` and merge its functionality into `usbd.c`

---
 hw/bsp/rp2040/family.cmake    |   1 -
 src/CMakeLists.txt            |   1 -
 src/device/usbd.c             | 173 ++++++++++++++++++++++++++++++++++--
 src/device/usbd_control.c     | 199 ++----------------------------------------
 src/tinyusb.mk                |   1 -
 test/fuzz/rules.mk            |   1 -
 test/unit-test/CMakeLists.txt |   4 +-
 7 files changed, 172 insertions(+), 208 deletions(-)

(limited to 'src')

diff --git a/hw/bsp/rp2040/family.cmake b/hw/bsp/rp2040/family.cmake
index 6e88b9fa1..075582554 100644
--- a/hw/bsp/rp2040/family.cmake
+++ b/hw/bsp/rp2040/family.cmake
@@ -93,7 +93,6 @@ target_sources(tinyusb_device_base INTERFACE
 		${TOP}/src/portable/raspberrypi/rp2040/dcd_rp2040.c
 		${TOP}/src/portable/raspberrypi/rp2040/rp2040_usb.c
 		${TOP}/src/device/usbd.c
-		${TOP}/src/device/usbd_control.c
 		${TOP}/src/class/audio/audio_device.c
 		${TOP}/src/class/cdc/cdc_device.c
 		${TOP}/src/class/dfu/dfu_device.c
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 00f466007..c7a5184c5 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -8,7 +8,6 @@ function(tinyusb_sources_get OUTPUT_VAR)
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/common/tusb_fifo.c
     # device
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/device/usbd.c
-    ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/device/usbd_control.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/audio/audio_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/cdc/cdc_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/dfu/dfu_device.c
diff --git a/src/device/usbd.c b/src/device/usbd.c
index da0ffb4c6..acf808bf6 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -419,11 +419,10 @@ static bool process_test_mode_cb(uint8_t rhport, uint8_t stage, tusb_control_req
 }
 #endif
 
-// from usbd_control.c
-void usbd_control_reset(void);
-void usbd_control_set_request(tusb_control_request_t const *request);
-void usbd_control_set_complete_callback( usbd_control_xfer_cb_t fp );
-bool usbd_control_xfer_cb (uint8_t rhport, uint8_t ep_addr, xfer_result_t event, uint32_t xferred_bytes);
+// Control Endpoint
+static void usbd_control_reset(void);
+static void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp);
+static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
 
 //--------------------------------------------------------------------+
 // Weak stubs: invoked if no strong implementation is available
@@ -808,6 +807,157 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
   }
 }
 
+//--------------------------------------------------------------------+
+// Control Endpoint
+//--------------------------------------------------------------------+
+
+// Weak hook: invoked when the control transfer's status stage completes
+TU_ATTR_WEAK void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_request_t* request) {
+  (void) rhport;
+  (void) request;
+}
+
+typedef struct {
+  tusb_control_request_t request;
+  uint8_t* buffer;
+  uint16_t data_len;
+  uint16_t total_xferred;
+  usbd_control_xfer_cb_t complete_cb;
+} usbd_control_xfer_t;
+
+static usbd_control_xfer_t _ctrl_xfer;
+
+CFG_TUD_MEM_SECTION static struct {
+  TUD_EPBUF_DEF(buf, CFG_TUD_ENDPOINT0_BUFSIZE);
+} _ctrl_epbuf;
+
+uint8_t* usbd_get_ctrl_buf(void) {
+  return _ctrl_epbuf.buf;
+}
+
+// Endpoint used for the Status stage of a control transfer.
+// Per USB 2.0 §9.3.1, when wLength == 0 the Direction bit is ignored and the Status
+// stage is always IN. Otherwise the Status stage is opposite of the Data stage direction.
+TU_ATTR_ALWAYS_INLINE static inline uint8_t status_stage_ep(const tusb_control_request_t* request) {
+  return (request->wLength != 0 && request->bmRequestType_bit.direction) ? TU_EP0_OUT : TU_EP0_IN;
+}
+
+// Queue ZLP status transaction
+TU_ATTR_ALWAYS_INLINE static inline bool status_stage_xact(uint8_t rhport, uint8_t ep_status) {
+  return usbd_edpt_xfer(rhport, ep_status, NULL, 0, false);
+}
+
+// Queue a transaction in Data Stage. Each transaction has up to Endpoint0's max
+// packet size. This function can also transfer a zero-length packet.
+static bool data_stage_xact(uint8_t rhport) {
+  const uint16_t xact_len = tu_min16(_ctrl_xfer.data_len - _ctrl_xfer.total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
+  uint8_t ep_addr = TU_EP0_OUT;
+
+  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_IN) {
+    ep_addr = TU_EP0_IN;
+    if (0u != xact_len && _ctrl_xfer.buffer != _ctrl_epbuf.buf) {
+      TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, _ctrl_xfer.buffer, xact_len));
+    }
+  }
+
+  return usbd_edpt_xfer(rhport, ep_addr, xact_len ? _ctrl_epbuf.buf : NULL, xact_len, false);
+}
+
+// Status phase
+bool tud_control_status(uint8_t rhport, const tusb_control_request_t* request) {
+  // _ctrl_xfer fields are pre-initialized at process_control_request entry
+  (void) request;
+  return status_stage_xact(rhport, status_stage_ep(&_ctrl_xfer.request));
+}
+
+// Transmit data to/from the control endpoint. If wLength is zero, a status packet is sent instead.
+bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, void* buffer, uint16_t len) {
+  // _ctrl_xfer.request and reset fields are pre-initialized at process_control_request entry
+  (void) request;
+  _ctrl_xfer.buffer = (uint8_t*) buffer;
+  _ctrl_xfer.data_len = tu_min16(len, _ctrl_xfer.request.wLength);
+
+  if (_ctrl_xfer.request.wLength > 0U) {
+    if (_ctrl_xfer.data_len > 0U) {
+      TU_ASSERT(buffer);
+    }
+    TU_ASSERT(data_stage_xact(rhport));
+  } else {
+    // wLength == 0: Status stage is always IN per USB 2.0 §9.3.1
+    TU_ASSERT(status_stage_xact(rhport, TU_EP0_IN));
+  }
+
+  return true;
+}
+
+static void usbd_control_reset(void) {
+  tu_varclr(&_ctrl_xfer);
+}
+
+static void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp) {
+  _ctrl_xfer.complete_cb = fp;
+}
+
+// Callback when a transaction completes on the DATA stage or Status stage of EP0
+static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
+  (void) result;
+
+  // Status Stage complete: ep_addr matches the resolved Status stage endpoint
+  uint8_t const ep_status = status_stage_ep(&_ctrl_xfer.request);
+  if (ep_addr == ep_status) {
+    TU_ASSERT(0 == xferred_bytes);
+
+    // invoke optional dcd hook if available
+    dcd_edpt0_status_complete(rhport, &_ctrl_xfer.request);
+
+    if (NULL != _ctrl_xfer.complete_cb) {
+      // TODO refactor with usbd_driver_print_control_complete_name
+      _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_ACK, &_ctrl_xfer.request);
+    }
+
+    return true;
+  }
+
+  // Data stage progress
+  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
+    TU_VERIFY(_ctrl_xfer.buffer);
+    if (_ctrl_xfer.buffer != _ctrl_epbuf.buf) {
+      memcpy(_ctrl_xfer.buffer, _ctrl_epbuf.buf, xferred_bytes);
+    }
+    TU_LOG_MEM(CFG_TUD_LOG_LEVEL, _ctrl_xfer.buffer, xferred_bytes, 2);
+  }
+
+  _ctrl_xfer.total_xferred += (uint16_t) xferred_bytes;
+  _ctrl_xfer.buffer += xferred_bytes;
+
+  // Data Stage complete when wLength reached or short packet (incl. ZLP) seen
+  if ((_ctrl_xfer.request.wLength == _ctrl_xfer.total_xferred) ||
+      (xferred_bytes < CFG_TUD_ENDPOINT0_BUFSIZE)) {
+    bool is_ok = true;
+
+    if (NULL != _ctrl_xfer.complete_cb) {
+      #if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
+      usbd_driver_print_control_complete_name(_ctrl_xfer.complete_cb);
+      #endif
+      // Callback can still stall control in status phase, e.g. OUT data doesn't make sense
+      is_ok = _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_DATA, &_ctrl_xfer.request);
+    }
+
+    if (is_ok) {
+      TU_ASSERT(status_stage_xact(rhport, ep_status));
+    } else {
+      // Stall both IN and OUT control endpoint
+      dcd_edpt_stall(rhport, TU_EP0_OUT);
+      dcd_edpt_stall(rhport, TU_EP0_IN);
+    }
+  } else {
+    // More data to transfer
+    TU_ASSERT(data_stage_xact(rhport));
+  }
+
+  return true;
+}
+
 //--------------------------------------------------------------------+
 // Control Request Parser & Handling
 //--------------------------------------------------------------------+
@@ -822,7 +972,14 @@ static bool invoke_class_control(uint8_t rhport, usbd_class_driver_t const * dri
 // This handles the actual request and its response.
 // Returns false if unable to complete the request, causing caller to stall control endpoints.
 static bool process_control_request(uint8_t rhport, tusb_control_request_t const * p_request) {
-  usbd_control_set_complete_callback(NULL);
+  // Initialize control transfer state for this request. The request copy must be
+  // visible to usbd_control_xfer_cb when the (asynchronous) status ZLP completes,
+  // since the SETUP packet event has already gone out of scope by then.
+  _ctrl_xfer.request = *p_request;
+  _ctrl_xfer.buffer = NULL;
+  _ctrl_xfer.total_xferred = 0;
+  _ctrl_xfer.data_len = 0;
+  _ctrl_xfer.complete_cb = NULL;
   TU_ASSERT(p_request->bmRequestType_bit.type < TUSB_REQ_TYPE_INVALID);
 
   // Vendor request
@@ -865,9 +1022,9 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
           // Depending on mcu, status phase could be sent either before or after changing device address,
           // or even require stack to not response with status at all
           // Therefore DCD must take full responsibility to response and include zlp status packet if needed.
-          usbd_control_set_request(p_request); // set request since DCD has no access to tud_control_status() API
+          // _ctrl_xfer.request was already populated at process_control_request() entry, so the
+          // status ZLP that the DCD queues will be recognized by usbd_control_xfer_cb().
           dcd_set_address(rhport, (uint8_t) p_request->wValue);
-          // skip tud_control_status()
           _usbd_dev.addressed = 1;
         break;
 
diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c
index b14d08a9c..38dcc6a82 100644
--- a/src/device/usbd_control.c
+++ b/src/device/usbd_control.c
@@ -24,197 +24,8 @@
  * This file is part of the TinyUSB stack.
  */
 
-#include "tusb_option.h"
-
-#if CFG_TUD_ENABLED
-
-#include "dcd.h"
-#include "tusb.h"
-#include "device/usbd_pvt.h"
-
-//--------------------------------------------------------------------+
-// Callback weak stubs (called if application does not provide)
-//--------------------------------------------------------------------+
-TU_ATTR_WEAK void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_request_t* request) {
-  (void) rhport;
-  (void) request;
-}
-
-//--------------------------------------------------------------------+
-// MACRO CONSTANT TYPEDEF
-//--------------------------------------------------------------------+
-
-
-typedef struct {
-  tusb_control_request_t request;
-  uint8_t* buffer;
-  uint16_t data_len;
-  uint16_t total_xferred;
-  usbd_control_xfer_cb_t complete_cb;
-} usbd_control_xfer_t;
-
-static usbd_control_xfer_t _ctrl_xfer;
-
-CFG_TUD_MEM_SECTION static struct {
-  TUD_EPBUF_DEF(buf, CFG_TUD_ENDPOINT0_BUFSIZE);
-} _ctrl_epbuf;
-
-uint8_t* usbd_get_ctrl_buf(void) {
-  return _ctrl_epbuf.buf;
-}
-
-//--------------------------------------------------------------------+
-// Application API
-//--------------------------------------------------------------------+
-
-// Endpoint used for the Status stage of a control transfer.
-// Per USB 2.0 §9.3.1, when wLength == 0 the Direction bit is ignored and the Status stage
-// is always IN. Otherwise the Status stage is opposite to the Data stage direction.
-TU_ATTR_ALWAYS_INLINE static inline uint8_t status_stage_ep(const tusb_control_request_t* request) {
-  return (request->wLength != 0 && request->bmRequestType_bit.direction) ? TU_EP0_OUT : TU_EP0_IN;
-}
-
-// Queue ZLP status transaction
-TU_ATTR_ALWAYS_INLINE static inline  bool status_stage_xact(uint8_t rhport, uint8_t ep_status) {
-  return usbd_edpt_xfer(rhport, ep_status, NULL, 0, false);
-}
-
-// Status phase
-bool tud_control_status(uint8_t rhport, const tusb_control_request_t* request) {
-  _ctrl_xfer.request = (*request);
-  _ctrl_xfer.buffer = NULL;
-  _ctrl_xfer.total_xferred = 0;
-  _ctrl_xfer.data_len = 0;
-
-  return status_stage_xact(rhport, status_stage_ep(request));
-}
-
-// Queue a transaction in Data Stage
-// Each transaction has up to Endpoint0's max packet size.
-// This function can also transfer an zero-length packet
-static bool data_stage_xact(uint8_t rhport) {
-  const uint16_t xact_len = tu_min16(_ctrl_xfer.data_len - _ctrl_xfer.total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
-  uint8_t ep_addr = TU_EP0_OUT;
-
-  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_IN) {
-    ep_addr = TU_EP0_IN;
-    if (0u != xact_len && _ctrl_xfer.buffer != _ctrl_epbuf.buf) {
-      TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, _ctrl_xfer.buffer, xact_len));
-    }
-  }
-
-  return usbd_edpt_xfer(rhport, ep_addr, xact_len ? _ctrl_epbuf.buf : NULL, xact_len, false);
-}
-
-// Transmit data to/from the control endpoint.
-// If the request's wLength is zero, a status packet is sent instead.
-bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, void* buffer, uint16_t len) {
-  _ctrl_xfer.request = (*request);
-  _ctrl_xfer.buffer = (uint8_t*) buffer;
-  _ctrl_xfer.total_xferred = 0U;
-  _ctrl_xfer.data_len = tu_min16(len, request->wLength);
-
-  if (request->wLength > 0U) {
-    if (_ctrl_xfer.data_len > 0U) {
-      TU_ASSERT(buffer);
-    }
-    TU_ASSERT(data_stage_xact(rhport));
-  } else {
-    TU_ASSERT(status_stage_xact(rhport, TU_EP0_IN));
-  }
-
-  return true;
-}
-
-//--------------------------------------------------------------------+
-// USBD API
-//--------------------------------------------------------------------+
-void usbd_control_reset(void);
-void usbd_control_set_request(const tusb_control_request_t* request);
-void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp);
-bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
-
-void usbd_control_reset(void) {
-  tu_varclr(&_ctrl_xfer);
-}
-
-// Set complete callback
-void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp) {
-  _ctrl_xfer.complete_cb = fp;
-}
-
-// for dcd_set_address where DCD is responsible for status response
-void usbd_control_set_request(const tusb_control_request_t* request) {
-  _ctrl_xfer.request = (*request);
-  _ctrl_xfer.buffer = NULL;
-  _ctrl_xfer.total_xferred = 0;
-  _ctrl_xfer.data_len = 0;
-}
-
-// callback when a transaction complete on
-// - DATA stage of control endpoint or
-// - Status stage
-bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
-  (void) result;
-
-  // Status Stage complete: endpoint matches the Status stage endpoint
-  uint8_t const ep_status = status_stage_ep(&_ctrl_xfer.request);
-  if (ep_addr == ep_status) {
-    TU_ASSERT(0 == xferred_bytes);
-
-    // invoke optional dcd hook if available
-    dcd_edpt0_status_complete(rhport, &_ctrl_xfer.request);
-
-    if (NULL != _ctrl_xfer.complete_cb) {
-      // TODO refactor with usbd_driver_print_control_complete_name
-      _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_ACK, &_ctrl_xfer.request);
-    }
-
-    return true;
-  }
-
-  // Data stage complete
-  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
-    TU_VERIFY(_ctrl_xfer.buffer);
-    if (_ctrl_xfer.buffer != _ctrl_epbuf.buf) {
-      memcpy(_ctrl_xfer.buffer, _ctrl_epbuf.buf, xferred_bytes);
-    }
-    TU_LOG_MEM(CFG_TUD_LOG_LEVEL, _ctrl_xfer.buffer, xferred_bytes, 2);
-  }
-
-  _ctrl_xfer.total_xferred += (uint16_t) xferred_bytes;
-  _ctrl_xfer.buffer += xferred_bytes;
-
-  // Data Stage is complete when all request's length are transferred or
-  // a short packet is sent including zero-length packet.
-  if ((_ctrl_xfer.request.wLength == _ctrl_xfer.total_xferred) ||
-      (xferred_bytes < CFG_TUD_ENDPOINT0_BUFSIZE)) {
-    // DATA stage is complete
-    bool is_ok = true;
-
-    // invoke complete callback if set
-    // callback can still stall control in status phase e.g out data does not make sense
-    if (NULL != _ctrl_xfer.complete_cb) {
-      #if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
-      usbd_driver_print_control_complete_name(_ctrl_xfer.complete_cb);
-      #endif
-
-      is_ok = _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_DATA, &_ctrl_xfer.request);
-    }
-
-    if (is_ok) {
-      TU_ASSERT(status_stage_xact(rhport, ep_status));
-    } else {
-      // Stall both IN and OUT control endpoint
-      dcd_edpt_stall(rhport, TU_EP0_OUT);
-      dcd_edpt_stall(rhport, TU_EP0_IN);
-    }
-  } else {
-    // More data to transfer
-    TU_ASSERT(data_stage_xact(rhport));
-  }
-
-  return true;
-}
-
-#endif
+// The usbd control function that used to live in this file has been merged
+// into src/device/usbd.c. This translation unit is intentionally empty and is
+// kept only so external/vendor build systems that still reference the path
+// keep resolving. Drop usbd_control.c from your build to silence the warning.
+#warning "src/device/usbd_control.c is deprecated and now empty; remove it from your build (its content lives in src/device/usbd.c)."
diff --git a/src/tinyusb.mk b/src/tinyusb.mk
index 169098016..e3ef35dcf 100644
--- a/src/tinyusb.mk
+++ b/src/tinyusb.mk
@@ -3,7 +3,6 @@ TINYUSB_SRC_C += \
 	src/tusb.c \
 	src/common/tusb_fifo.c \
 	src/device/usbd.c \
-	src/device/usbd_control.c \
 	src/typec/usbc.c \
 	src/class/audio/audio_device.c \
 	src/class/cdc/cdc_device.c \
diff --git a/test/fuzz/rules.mk b/test/fuzz/rules.mk
index 329dcce11..c14330312 100644
--- a/test/fuzz/rules.mk
+++ b/test/fuzz/rules.mk
@@ -23,7 +23,6 @@ SRC_C += \
 	src/tusb.c \
 	src/common/tusb_fifo.c \
 	src/device/usbd.c \
-	src/device/usbd_control.c \
 	src/class/audio/audio_device.c \
 	src/class/cdc/cdc_device.c \
 	src/class/dfu/dfu_device.c \
diff --git a/test/unit-test/CMakeLists.txt b/test/unit-test/CMakeLists.txt
index b44a91d57..a33af4563 100644
--- a/test/unit-test/CMakeLists.txt
+++ b/test/unit-test/CMakeLists.txt
@@ -117,14 +117,14 @@ add_ceedling_test(
 add_ceedling_test(
   test_usbd
   ${CEEDLING_WORKDIR}/test/device/usbd/test_usbd.c
-  "${CEEDLING_WORKDIR}/../../src/tusb.c;${CEEDLING_WORKDIR}/../../src/device/usbd.c;${CEEDLING_WORKDIR}/../../src/device/usbd_control.c;${CEEDLING_WORKDIR}/../../src/common/tusb_fifo.c"
+  "${CEEDLING_WORKDIR}/../../src/tusb.c;${CEEDLING_WORKDIR}/../../src/device/usbd.c;${CEEDLING_WORKDIR}/../../src/common/tusb_fifo.c"
   "${CEEDLING_BUILD_DIR}/test/mocks/test_usbd/mock_dcd.c;${CEEDLING_BUILD_DIR}/test/mocks/test_usbd/mock_msc_device.c"
   )
 
 add_ceedling_test(
   test_msc_device
   ${CEEDLING_WORKDIR}/test/device/msc/test_msc_device.c
-  "${CEEDLING_WORKDIR}/../../src/tusb.c;${CEEDLING_WORKDIR}/../../src/device/usbd.c;${CEEDLING_WORKDIR}/../../src/device/usbd_control.c;${CEEDLING_WORKDIR}/../../src/class/msc/msc_device.c;${CEEDLING_WORKDIR}/../../src/common/tusb_fifo.c"
+  "${CEEDLING_WORKDIR}/../../src/tusb.c;${CEEDLING_WORKDIR}/../../src/device/usbd.c;${CEEDLING_WORKDIR}/../../src/class/msc/msc_device.c;${CEEDLING_WORKDIR}/../../src/common/tusb_fifo.c"
   "${CEEDLING_BUILD_DIR}/test/mocks/test_msc_device/mock_dcd.c"
   )
 
-- 
cgit v1.3.1


From 7cfa0d1b970b6e276e0eca3eee2de43aa3b7c443 Mon Sep 17 00:00:00 2001
From: Zixun LI <admin@hifiphile.com>
Date: Thu, 30 Apr 2026 14:56:13 +0200
Subject: add packet filter callback

Co-authored-by: Copilot <copilot@github.com>
Signed-off-by: Zixun LI <admin@hifiphile.com>
---
 src/class/net/ecm_rndis_device.c | 8 ++++++++
 src/class/net/ncm_device.c       | 8 ++++++++
 src/class/net/net_device.h       | 3 +++
 3 files changed, 19 insertions(+)

(limited to 'src')

diff --git a/src/class/net/ecm_rndis_device.c b/src/class/net/ecm_rndis_device.c
index eaa82c187..5464fe25d 100644
--- a/src/class/net/ecm_rndis_device.c
+++ b/src/class/net/ecm_rndis_device.c
@@ -81,6 +81,13 @@ CFG_TUD_MEM_SECTION static netd_epbuf_t _netd_epbuf;
 static bool can_xmit;
 static bool ecm_link_is_up = true;  // Store link state for ECM mode
 
+//--------------------------------------------------------------------+
+// Weak stubs: invoked if no strong implementation is available
+//--------------------------------------------------------------------+
+TU_ATTR_WEAK void tud_network_set_packet_filter_cb(uint16_t packet_filter) {
+  (void) packet_filter;
+}
+
 void tud_network_recv_renew(void) {
   usbd_edpt_xfer(0, _netd_itf.ep_out, _netd_epbuf.rx, NETD_PACKET_SIZE, false);
 }
@@ -285,6 +292,7 @@ bool netd_control_xfer_cb (uint8_t rhport, uint8_t stage, tusb_control_request_t
         if (_netd_itf.ecm_mode) {
           /* the only required CDC-ECM Management Element Request is SetEthernetPacketFilter */
           if (0x43 /* SET_ETHERNET_PACKET_FILTER */ == request->bRequest) {
+            tud_network_set_packet_filter_cb(request->wValue);
             tud_control_xfer(rhport, request, NULL, 0);
             // Only send connection notification if link is up
             if (ecm_link_is_up) {
diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 83e8bffab..85895361f 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -138,6 +138,13 @@ typedef struct {
 static ncm_interface_t ncm_interface;
 CFG_TUD_MEM_SECTION static ncm_epbuf_t ncm_epbuf;
 
+//--------------------------------------------------------------------+
+// Weak stubs: invoked if no strong implementation is available
+//--------------------------------------------------------------------+
+TU_ATTR_WEAK void tud_network_set_packet_filter_cb(uint16_t packet_filter) {
+  (void) packet_filter;
+}
+
 /**
  * This is the NTB parameter structure
  *
@@ -998,6 +1005,7 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
         } break;
 
         case NCM_SET_ETHERNET_PACKET_FILTER: {
+          tud_network_set_packet_filter_cb(request->wValue);
           tud_control_xfer(rhport, request, NULL, 0);
         } break;
 
diff --git a/src/class/net/net_device.h b/src/class/net/net_device.h
index 61ff6b2d6..e0d235ebe 100644
--- a/src/class/net/net_device.h
+++ b/src/class/net/net_device.h
@@ -106,6 +106,9 @@ extern uint8_t tud_network_mac_address[6];
 
 //------------- NCM -------------//
 
+// Optional callback: informs the application about host requested packet filter bits
+void tud_network_set_packet_filter_cb(uint16_t packet_filter);
+
 // Set the network link state (up/down) and notify the host
 void tud_network_link_state(uint8_t rhport, bool is_up);
 
-- 
cgit v1.3.1


From 2931121b072cd49d4a144359da422980d9bf017a Mon Sep 17 00:00:00 2001
From: Zixun LI <admin@hifiphile.com>
Date: Thu, 30 Apr 2026 15:03:09 +0200
Subject: refactor capability

Signed-off-by: Zixun LI <admin@hifiphile.com>
---
 examples/device/net_lwip_webserver/src/usb_descriptors.c | 6 +++---
 src/device/usbd.h                                        | 9 +++------
 2 files changed, 6 insertions(+), 9 deletions(-)

(limited to 'src')

diff --git a/examples/device/net_lwip_webserver/src/usb_descriptors.c b/examples/device/net_lwip_webserver/src/usb_descriptors.c
index c976cb62b..b194b9c5a 100644
--- a/examples/device/net_lwip_webserver/src/usb_descriptors.c
+++ b/examples/device/net_lwip_webserver/src/usb_descriptors.c
@@ -162,9 +162,9 @@ static uint8_t const ncm_configuration[] = {
   TUD_CONFIG_DESCRIPTOR(CONFIG_ID_NCM + 1, ITF_NUM_TOTAL, 0, NCM_CONFIG_TOTAL_LEN, 0, 100),
 
   // Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size.
-  TUD_CDC_NCM_DESCRIPTOR(
-      ITF_NUM_CDC, STRID_INTERFACE, STRID_MAC, EPNUM_NET_NOTIF, 64, EPNUM_NET_OUT, EPNUM_NET_IN,
-      CFG_TUD_NET_ENDPOINT_SIZE, CFG_TUD_NET_MTU),
+  TUD_CDC_NCM_DESCRIPTOR(ITF_NUM_CDC, STRID_INTERFACE, STRID_MAC,
+      EPNUM_NET_NOTIF, 64, EPNUM_NET_OUT, EPNUM_NET_IN, CFG_TUD_NET_ENDPOINT_SIZE,
+      CFG_TUD_NET_MTU, NCM_NETWORK_CAPS_ETH_FILTER),
 };
 
 #endif
diff --git a/src/device/usbd.h b/src/device/usbd.h
index 96144350e..a960e2c79 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1023,15 +1023,12 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 // CDC-NCM Descriptor Templates
 //--------------------------------------------------------------------+
 
-// NCM Capabilities, bitmap of NCM_NETWORK_CAPS_* bits.
-#define TUD_CDC_NCM_CAPS (NCM_NETWORK_CAPS_ETH_FILTER)
-
 // Length of template descriptor
 #define TUD_CDC_NCM_DESC_LEN  (8+9+5+5+13+6+7+9+9+7+7)
 
 // CDC-ECM Descriptor Template
-// Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size.
-#define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize) \
+// Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size, capability.
+#define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize, _capability) \
   /* Interface Association */\
   8, TUSB_DESC_INTERFACE_ASSOCIATION, _itfnum, 2, TUSB_CLASS_CDC, CDC_COMM_SUBCLASS_NETWORK_CONTROL_MODEL, 0, 0,\
   /* CDC Control Interface */\
@@ -1043,7 +1040,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   /* CDC-NCM Functional Descriptor */\
   13, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_ETHERNET_NETWORKING, _mac_stridx, 0, 0, 0, 0, U16_TO_U8S_LE(_maxsegmentsize), U16_TO_U8S_LE(0), 0, \
   /* CDC-NCM Functional Descriptor */\
-  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), TUD_CDC_NCM_CAPS, \
+  6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), _capability, \
   /* Endpoint Notification */\
   7, TUSB_DESC_ENDPOINT, _ep_notif, TUSB_XFER_INTERRUPT, U16_TO_U8S_LE(_ep_notif_size), 50,\
   /* CDC Data Interface (default inactive) */\
-- 
cgit v1.3.1


From ddb81076a4f7c38b0958a97d76aa072180902b6f Mon Sep 17 00:00:00 2001
From: Elwin Huang <elwin@asiarf.com>
Date: Wed, 29 Apr 2026 11:07:44 +0800
Subject: ncm: Implement SetNtbInputSize request

According to NCM standard 7.2.7, the device should tell the host its maximum size of NTB. Implement SetNtbInputSize according to it.
Without this commit, some OS may failed to enumerate the NCM device (e.g., IOS 26).

Signed-off-by: Elwin Huang <elwin@asiarf.com>
---
 src/class/net/ncm_device.c | 82 +++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 74 insertions(+), 8 deletions(-)

(limited to 'src')

diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 85895361f..7240c50aa 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -118,6 +118,16 @@ typedef struct {
   bool notification_xmit_is_running;                    // notification is currently transmitted
   bool link_is_up;                                      // current link state
 
+  // host-configured transmit limits
+  uint32_t xmit_max_ntb_size;                           // maximum NTB size device may send
+  uint16_t xmit_max_datagrams;                          // maximum datagrams per NTB device may send
+  uint8_t ntb_input_size_len;                           // last SET_NTB_INPUT_SIZE wLength
+  struct {
+    uint32_t dwNtbInMaxSize;
+    uint16_t wNtbInMaxDatagrams;
+    uint16_t wReserved;
+  } ntb_input_size;
+
   // misc
   bool tud_network_recv_renew_active;                   // tud_network_recv_renew() is active (avoid recursive invocations)
   bool tud_network_recv_renew_process_again;            // tud_network_recv_renew() should process again
@@ -415,10 +425,14 @@ static bool xmit_requested_datagram_fits_into_current_ntb(uint16_t datagram_size
   if (ncm_interface.xmit_glue_ntb == NULL) {
     return false;
   }
-  if (ncm_interface.xmit_glue_ntb_datagram_ndx >= CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB) {
+  uint16_t max_datagrams = ncm_interface.xmit_max_datagrams;
+  if (max_datagrams == 0) {
+    max_datagrams = CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB;
+  }
+  if (ncm_interface.xmit_glue_ntb_datagram_ndx >= max_datagrams) {
     return false;
   }
-  if (ncm_interface.xmit_glue_ntb->nth.wBlockLength + datagram_size + XMIT_ALIGN_OFFSET(datagram_size) > CFG_TUD_NCM_IN_NTB_MAX_SIZE) {
+  if (ncm_interface.xmit_glue_ntb->nth.wBlockLength + datagram_size + XMIT_ALIGN_OFFSET(datagram_size) > ncm_interface.xmit_max_ntb_size) {
     return false;
   }
   return true;
@@ -715,7 +729,7 @@ static void recv_transfer_datagram_to_glue_logic(void) {
 bool tud_network_can_xmit(uint16_t size) {
   TU_LOG_DRV("tud_network_can_xmit(%d)\n", size);
 
-  TU_ASSERT(size <= CFG_TUD_NCM_IN_NTB_MAX_SIZE - (sizeof(nth16_t) + sizeof(ndp16_t) + 2 * sizeof(ndp16_datagram_t)), false);
+  TU_ASSERT(size <= ncm_interface.xmit_max_ntb_size - (sizeof(nth16_t) + sizeof(ndp16_t) + 2 * sizeof(ndp16_datagram_t)), false);
 
   if (xmit_requested_datagram_fits_into_current_ntb(size) || xmit_setup_next_glue_ntb()) {
     // -> everything is fine
@@ -835,6 +849,9 @@ void netd_init(void) {
 
   memset(&ncm_interface, 0, sizeof(ncm_interface));
 
+  ncm_interface.xmit_max_ntb_size = CFG_TUD_NCM_IN_NTB_MAX_SIZE;
+  ncm_interface.xmit_max_datagrams = CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB;
+
   for (int i = 0; i < XMIT_NTB_N; ++i) {
     ncm_interface.xmit_free_ntb[i] = &ncm_epbuf.xmit[i].ntb;
   }
@@ -961,12 +978,12 @@ bool netd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_
  * At startup transmission of notification packets are done here.
  */
 bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t const *request) {
-  if (stage != CONTROL_STAGE_SETUP) {
-    return true;
-  }
 
   switch (request->bmRequestType_bit.type) {
     case TUSB_REQ_TYPE_STANDARD:
+      if (stage != CONTROL_STAGE_SETUP) {
+        return true;
+      }
 
       switch (request->bRequest) {
         case TUSB_REQ_GET_INTERFACE: {
@@ -1000,21 +1017,70 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
       TU_VERIFY(ncm_interface.itf_num == request->wIndex, false);
       switch (request->bRequest) {
         case NCM_GET_NTB_PARAMETERS: {
+          if (stage != CONTROL_STAGE_SETUP) {
+            return true;
+          }
           // transfer NTB parameters to host.
           tud_control_xfer(rhport, request, (void *) (uintptr_t) &ntb_parameters, sizeof(ntb_parameters));
         } break;
 
         case NCM_SET_ETHERNET_PACKET_FILTER: {
+          if (stage != CONTROL_STAGE_SETUP) {
+            return true;
+          }
           tud_network_set_packet_filter_cb(request->wValue);
           tud_control_xfer(rhport, request, NULL, 0);
         } break;
 
-          // unsupported request
+        case NCM_SET_NTB_INPUT_SIZE: {
+          if (stage == CONTROL_STAGE_SETUP) {
+            if (request->wLength != 4 && request->wLength != 8) {
+              return false;
+            }
+
+            ncm_interface.ntb_input_size_len = (uint8_t) request->wLength;
+            memset(&ncm_interface.ntb_input_size, 0, sizeof(ncm_interface.ntb_input_size));
+
+            // wLength == 8 -> the NTB Input Size Structure
+            // wLength == 4 -> dwNtbInMaxSize field of the NTB Input Size Structure.
+            if (request->wLength == 4) {
+              tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size.dwNtbInMaxSize, 4);
+            } else {
+              tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size, 8);
+            }
+          } else if (stage == CONTROL_STAGE_ACK) {
+            uint32_t requested_size = ncm_interface.ntb_input_size.dwNtbInMaxSize;
+            uint16_t requested_datagrams = 0;
+            uint32_t min_ntb_size = 2048u;
+            uint32_t new_ntb_size = 0;
+            uint16_t new_datagrams = 0;
+
+            if (requested_size < min_ntb_size || requested_size > CFG_TUD_NCM_IN_NTB_MAX_SIZE) {
+              return false;
+            }
+            new_ntb_size = requested_size;
+
+            if (ncm_interface.ntb_input_size_len == 8) {
+              requested_datagrams = ncm_interface.ntb_input_size.wNtbInMaxDatagrams;
+            }
+
+            if (requested_datagrams > CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB) {
+              return false;
+            }
+            new_datagrams = requested_datagrams;
+
+            ncm_interface.xmit_max_ntb_size = new_ntb_size;
+            ncm_interface.xmit_max_datagrams = new_datagrams;
+          }
+        } break;
+
+        // unsupported request
         default:
           return false;
       }
       break;
-      // unsupported request
+
+    // unsupported request
     default:
       return false;
   }
-- 
cgit v1.3.1


From 8db6084acac03acc1b98721f78d22587968ed5b2 Mon Sep 17 00:00:00 2001
From: Zixun LI <admin@hifiphile.com>
Date: Thu, 30 Apr 2026 15:56:23 +0200
Subject: ncm: implement GetNtbInputSize request

Signed-off-by: HiFiPHile <admin@hifiphile.com>
---
 .../net_lwip_webserver/src/usb_descriptors.c       |  2 +-
 src/class/net/ncm.h                                | 14 ++++
 src/class/net/ncm_device.c                         | 87 +++++++++++-----------
 src/device/usbd.h                                  |  8 +-
 4 files changed, 62 insertions(+), 49 deletions(-)

(limited to 'src')

diff --git a/examples/device/net_lwip_webserver/src/usb_descriptors.c b/examples/device/net_lwip_webserver/src/usb_descriptors.c
index b194b9c5a..0c6c11611 100644
--- a/examples/device/net_lwip_webserver/src/usb_descriptors.c
+++ b/examples/device/net_lwip_webserver/src/usb_descriptors.c
@@ -164,7 +164,7 @@ static uint8_t const ncm_configuration[] = {
   // Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size.
   TUD_CDC_NCM_DESCRIPTOR(ITF_NUM_CDC, STRID_INTERFACE, STRID_MAC,
       EPNUM_NET_NOTIF, 64, EPNUM_NET_OUT, EPNUM_NET_IN, CFG_TUD_NET_ENDPOINT_SIZE,
-      CFG_TUD_NET_MTU, NCM_NETWORK_CAPS_ETH_FILTER),
+      CFG_TUD_NET_MTU, (uint8_t)((uint8_t)NCM_NETWORK_CAPS_ETH_FILTER | (uint8_t)NCM_NETWORK_CAPS_NTB_INPUT_SIZE)),
 };
 
 #endif
diff --git a/src/class/net/ncm.h b/src/class/net/ncm.h
index 8989fe0b4..27ff89b72 100644
--- a/src/class/net/ncm.h
+++ b/src/class/net/ncm.h
@@ -161,4 +161,18 @@ typedef struct {
   uint32_t uplink;
 } ncm_notify_t;
 
+typedef struct TU_ATTR_PACKED {
+  uint8_t bFunctionLength;
+  uint8_t bDescriptorType;
+  uint8_t bDescriptorSubType;
+  uint16_t bcdNcmVersion;
+  uint8_t bmCapabilities;
+} tusb_desc_cdc_ncm_func_t;
+
+typedef struct TU_ATTR_PACKED {
+  uint32_t dwNtbInMaxSize;
+  uint16_t wNtbInMaxDatagrams;
+  uint16_t wReserved;
+} ncm_ntb_input_size_t;
+
 #endif
diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 7240c50aa..e16b0523f 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -119,14 +119,10 @@ typedef struct {
   bool link_is_up;                                      // current link state
 
   // host-configured transmit limits
-  uint32_t xmit_max_ntb_size;                           // maximum NTB size device may send
+  uint8_t bm_capabilities;
+  uint16_t xmit_max_ntb_size;                           // maximum NTB size device may send
   uint16_t xmit_max_datagrams;                          // maximum datagrams per NTB device may send
-  uint8_t ntb_input_size_len;                           // last SET_NTB_INPUT_SIZE wLength
-  struct {
-    uint32_t dwNtbInMaxSize;
-    uint16_t wNtbInMaxDatagrams;
-    uint16_t wReserved;
-  } ntb_input_size;
+  ncm_ntb_input_size_t ntb_input_size;
 
   // misc
   bool tud_network_recv_renew_active;                   // tud_network_recv_renew() is active (avoid recursive invocations)
@@ -425,14 +421,10 @@ static bool xmit_requested_datagram_fits_into_current_ntb(uint16_t datagram_size
   if (ncm_interface.xmit_glue_ntb == NULL) {
     return false;
   }
-  uint16_t max_datagrams = ncm_interface.xmit_max_datagrams;
-  if (max_datagrams == 0) {
-    max_datagrams = CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB;
-  }
-  if (ncm_interface.xmit_glue_ntb_datagram_ndx >= max_datagrams) {
+  if (ncm_interface.xmit_glue_ntb_datagram_ndx >= ncm_interface.xmit_max_datagrams) {
     return false;
   }
-  if (ncm_interface.xmit_glue_ntb->nth.wBlockLength + datagram_size + XMIT_ALIGN_OFFSET(datagram_size) > ncm_interface.xmit_max_ntb_size) {
+  if (ncm_interface.xmit_glue_ntb->nth.wBlockLength + datagram_size + (uint32_t)XMIT_ALIGN_OFFSET(datagram_size) > (uint32_t)ncm_interface.xmit_max_ntb_size) {
     return false;
   }
   return true;
@@ -902,10 +894,14 @@ uint16_t netd_open(uint8_t rhport, tusb_desc_interface_t const *itf_desc, uint16
 
   ncm_interface.itf_num = itf_desc->bInterfaceNumber;// management interface
 
-  // skip the two first entries and the following TUSB_DESC_CS_INTERFACE entries
   uint16_t drv_len = sizeof(tusb_desc_interface_t);
   uint8_t const *p_desc = tu_desc_next(itf_desc);
   while (tu_desc_type(p_desc) == TUSB_DESC_CS_INTERFACE && drv_len <= max_len) {
+    if (tu_desc_subtype(p_desc) == CDC_FUNC_DESC_NCM) {
+      TU_ASSERT(tu_desc_len(p_desc) >= sizeof(tusb_desc_cdc_ncm_func_t), 0);
+      tusb_desc_cdc_ncm_func_t const *ncm_func = (tusb_desc_cdc_ncm_func_t const *) p_desc;
+      ncm_interface.bm_capabilities = ncm_func->bmCapabilities;
+    }
     drv_len += tu_desc_len(p_desc);
     p_desc = tu_desc_next(p_desc);
   }
@@ -1028,49 +1024,52 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
           if (stage != CONTROL_STAGE_SETUP) {
             return true;
           }
+
+          TU_VERIFY(ncm_interface.bm_capabilities & NCM_NETWORK_CAPS_ETH_FILTER, false);
           tud_network_set_packet_filter_cb(request->wValue);
           tud_control_xfer(rhport, request, NULL, 0);
         } break;
 
-        case NCM_SET_NTB_INPUT_SIZE: {
-          if (stage == CONTROL_STAGE_SETUP) {
-            if (request->wLength != 4 && request->wLength != 8) {
-              return false;
-            }
+        case NCM_GET_NTB_INPUT_SIZE: {
+          if (stage != CONTROL_STAGE_SETUP) {
+            return true;
+          }
 
-            ncm_interface.ntb_input_size_len = (uint8_t) request->wLength;
-            memset(&ncm_interface.ntb_input_size, 0, sizeof(ncm_interface.ntb_input_size));
+          TU_VERIFY(request->wLength >=4, false);
 
-            // wLength == 8 -> the NTB Input Size Structure
-            // wLength == 4 -> dwNtbInMaxSize field of the NTB Input Size Structure.
-            if (request->wLength == 4) {
-              tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size.dwNtbInMaxSize, 4);
-            } else {
-              tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size, 8);
-            }
-          } else if (stage == CONTROL_STAGE_ACK) {
-            uint32_t requested_size = ncm_interface.ntb_input_size.dwNtbInMaxSize;
-            uint16_t requested_datagrams = 0;
-            uint32_t min_ntb_size = 2048u;
-            uint32_t new_ntb_size = 0;
-            uint16_t new_datagrams = 0;
+          uint8_t resp_len = (request->wLength >= 8 && (ncm_interface.bm_capabilities & NCM_NETWORK_CAPS_NTB_INPUT_SIZE)) ? 8 : 4;
 
-            if (requested_size < min_ntb_size || requested_size > CFG_TUD_NCM_IN_NTB_MAX_SIZE) {
-              return false;
-            }
-            new_ntb_size = requested_size;
+          ncm_ntb_input_size_t ntb_input_size = {
+            .dwNtbInMaxSize = ncm_interface.xmit_max_ntb_size,
+            .wNtbInMaxDatagrams = ncm_interface.xmit_max_datagrams
+          };
+          tud_control_xfer(rhport, request, &ntb_input_size, resp_len);
+        } break;
 
-            if (ncm_interface.ntb_input_size_len == 8) {
-              requested_datagrams = ncm_interface.ntb_input_size.wNtbInMaxDatagrams;
+        case NCM_SET_NTB_INPUT_SIZE: {
+          if (stage == CONTROL_STAGE_SETUP) {
+            /* wLength == 8 -> the NTB Input Size Structure (if NCM_NETWORK_CAPS_NTB_INPUT_SIZE is set)
+               wLength == 4 -> dwNtbInMaxSize field of the NTB Input Size Structure. */
+            TU_VERIFY(request->wLength == 4 || request->wLength == 8, false);
+            if (request->wLength == 8) {
+              TU_VERIFY(ncm_interface.bm_capabilities & NCM_NETWORK_CAPS_NTB_INPUT_SIZE, false);
             }
 
-            if (requested_datagrams > CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB) {
+            tu_memclr(&ncm_interface.ntb_input_size, sizeof(ncm_interface.ntb_input_size));
+            tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size, request->wLength);
+          } else if (stage == CONTROL_STAGE_ACK) {
+            /* CDC-NCM 1.0 Table 6-4, up to NTB16 size */
+            const uint32_t requested_size = ncm_interface.ntb_input_size.dwNtbInMaxSize;
+            if (requested_size < 2048u || requested_size > 65535u) {
               return false;
             }
-            new_datagrams = requested_datagrams;
+            ncm_interface.xmit_max_ntb_size = tu_min16(requested_size, CFG_TUD_NCM_IN_NTB_MAX_SIZE);
 
-            ncm_interface.xmit_max_ntb_size = new_ntb_size;
-            ncm_interface.xmit_max_datagrams = new_datagrams;
+            if (ncm_interface.ntb_input_size.wNtbInMaxDatagrams == 0 || ncm_interface.ntb_input_size.wNtbInMaxDatagrams > CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB) {
+              ncm_interface.xmit_max_datagrams = CFG_TUD_NCM_IN_MAX_DATAGRAMS_PER_NTB;
+            } else {
+              ncm_interface.xmit_max_datagrams = ncm_interface.ntb_input_size.wNtbInMaxDatagrams;
+            }
           }
         } break;
 
diff --git a/src/device/usbd.h b/src/device/usbd.h
index a960e2c79..5a21c7039 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -1026,18 +1026,18 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 // Length of template descriptor
 #define TUD_CDC_NCM_DESC_LEN  (8+9+5+5+13+6+7+9+9+7+7)
 
-// CDC-ECM Descriptor Template
+// CDC-NCM Descriptor Template
 // Interface number, description string index, MAC address string index, EP notification address and size, EP data address (out, in), and size, max segment size, capability.
 #define TUD_CDC_NCM_DESCRIPTOR(_itfnum, _desc_stridx, _mac_stridx, _ep_notif, _ep_notif_size, _epout, _epin, _epsize, _maxsegmentsize, _capability) \
   /* Interface Association */\
   8, TUSB_DESC_INTERFACE_ASSOCIATION, _itfnum, 2, TUSB_CLASS_CDC, CDC_COMM_SUBCLASS_NETWORK_CONTROL_MODEL, 0, 0,\
   /* CDC Control Interface */\
   9, TUSB_DESC_INTERFACE, _itfnum, 0, 1, TUSB_CLASS_CDC, CDC_COMM_SUBCLASS_NETWORK_CONTROL_MODEL, 0, _desc_stridx,\
-  /* CDC-NCM Header */\
+  /* CDC Header */\
   5, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_HEADER, U16_TO_U8S_LE(0x0110),\
-  /* CDC-NCM Union */\
+  /* CDC Union */\
   5, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_UNION, _itfnum, (uint8_t)((_itfnum) + 1),\
-  /* CDC-NCM Functional Descriptor */\
+  /* CDC Ethernet Networking Descriptor */\
   13, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_ETHERNET_NETWORKING, _mac_stridx, 0, 0, 0, 0, U16_TO_U8S_LE(_maxsegmentsize), U16_TO_U8S_LE(0), 0, \
   /* CDC-NCM Functional Descriptor */\
   6, TUSB_DESC_CS_INTERFACE, CDC_FUNC_DESC_NCM, U16_TO_U8S_LE(0x0100), _capability, \
-- 
cgit v1.3.1


From eb66712196b54ff5dcf39df020fb0cad72e853d0 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Wed, 29 Apr 2026 22:23:32 +0700
Subject: refactor `usbd.c`: centralize control transfer state management into
 `_usbd_dev` structure and remove `usbd_control_reset`

---
 src/device/usbd.c         | 146 +++++++++++++++++++---------------------------
 src/device/usbd_control.c |  31 ----------
 2 files changed, 61 insertions(+), 116 deletions(-)
 delete mode 100644 src/device/usbd_control.c

(limited to 'src')

diff --git a/src/device/usbd.c b/src/device/usbd.c
index acf808bf6..49c8851de 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -115,7 +115,20 @@ TU_ATTR_WEAK bool dcd_dcache_clean_invalidate(const void* addr, uint32_t data_si
 //--------------------------------------------------------------------+
 // Device Data
 //--------------------------------------------------------------------+
+
+// Per-control-transfer state: populated at process_setup_received() entry,
+// consumed asynchronously by usbd_control_xfer_cb() when the EP0 transfer completes.
+typedef struct {
+  tusb_control_request_t request;
+  uint8_t* buffer;
+  uint16_t data_len;
+  uint16_t total_xferred;
+  usbd_control_xfer_cb_t complete_cb;
+} usbd_control_xfer_t;
+
 typedef struct {
+  usbd_control_xfer_t ctrl_xfer;
+
   // Note: these may share an enum state
   volatile uint8_t connected;
   volatile uint8_t addressed;
@@ -142,6 +155,10 @@ typedef struct {
 static usbd_device_t    _usbd_dev;
 static volatile uint8_t _usbd_queued_setup;
 
+CFG_TUD_MEM_SECTION static struct {
+  TUD_EPBUF_DEF(buf, CFG_TUD_ENDPOINT0_BUFSIZE);
+} _ctrl_epbuf;
+
 //--------------------------------------------------------------------+
 // Class Driver
 //--------------------------------------------------------------------+
@@ -405,7 +422,7 @@ TU_ATTR_ALWAYS_INLINE static inline bool queue_event(dcd_event_t const * event,
 //--------------------------------------------------------------------+
 // Prototypes
 //--------------------------------------------------------------------+
-static bool process_control_request(uint8_t rhport, tusb_control_request_t const * p_request);
+static bool process_setup_received(uint8_t rhport, tusb_control_request_t const * p_request);
 static bool process_set_config(uint8_t rhport, uint8_t cfg_num);
 static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const * p_request);
 
@@ -420,8 +437,6 @@ static bool process_test_mode_cb(uint8_t rhport, uint8_t stage, tusb_control_req
 #endif
 
 // Control Endpoint
-static void usbd_control_reset(void);
-static void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp);
 static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
 
 //--------------------------------------------------------------------+
@@ -458,17 +473,6 @@ static char const *const _usbd_event_str[DCD_EVENT_COUNT] = {
     "Func Call"
 };
 
-// for usbd_control to print the name of control complete driver
-void usbd_driver_print_control_complete_name(usbd_control_xfer_cb_t callback) {
-  for (uint8_t i = 0; i < TOTAL_DRIVER_COUNT; i++) {
-    usbd_class_driver_t const* driver = get_driver(i);
-    if (driver && driver->control_xfer_cb == callback) {
-      TU_LOG_USBD("%s control complete\r\n", driver->name);
-      return;
-    }
-  }
-}
-
 #endif
 
 //--------------------------------------------------------------------+
@@ -608,9 +612,7 @@ bool tud_deinit(uint8_t rhport) {
     }
   }
 
-  // Clear device data
-  tu_varclr(&_usbd_dev);
-  usbd_control_reset();
+  tu_varclr(&_usbd_dev); // Clear device data
 
   // Deinit device queue & task
   osal_queue_delete(_usbd_q);
@@ -645,7 +647,6 @@ static void configuration_reset(uint8_t rhport) {
 
 static void usbd_reset(uint8_t rhport) {
   configuration_reset(rhport);
-  usbd_control_reset();
 }
 
 bool tud_task_event_ready(void) {
@@ -731,7 +732,7 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
         _usbd_dev.ep_status[0][TUSB_DIR_IN].claimed = 0;
 
         // Process control request
-        if (!process_control_request(event.rhport, &event.setup_received)) {
+        if (!process_setup_received(event.rhport, &event.setup_received)) {
           TU_LOG_USBD("  Stall EP0\r\n");
           // Failed -> stall both control endpoint IN and OUT
           dcd_edpt_stall(event.rhport, 0);
@@ -817,20 +818,6 @@ TU_ATTR_WEAK void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_r
   (void) request;
 }
 
-typedef struct {
-  tusb_control_request_t request;
-  uint8_t* buffer;
-  uint16_t data_len;
-  uint16_t total_xferred;
-  usbd_control_xfer_cb_t complete_cb;
-} usbd_control_xfer_t;
-
-static usbd_control_xfer_t _ctrl_xfer;
-
-CFG_TUD_MEM_SECTION static struct {
-  TUD_EPBUF_DEF(buf, CFG_TUD_ENDPOINT0_BUFSIZE);
-} _ctrl_epbuf;
-
 uint8_t* usbd_get_ctrl_buf(void) {
   return _ctrl_epbuf.buf;
 }
@@ -850,13 +837,14 @@ TU_ATTR_ALWAYS_INLINE static inline bool status_stage_xact(uint8_t rhport, uint8
 // Queue a transaction in Data Stage. Each transaction has up to Endpoint0's max
 // packet size. This function can also transfer a zero-length packet.
 static bool data_stage_xact(uint8_t rhport) {
-  const uint16_t xact_len = tu_min16(_ctrl_xfer.data_len - _ctrl_xfer.total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
+  usbd_control_xfer_t* const ctrl_xfer = &_usbd_dev.ctrl_xfer;
+  const uint16_t xact_len = tu_min16(ctrl_xfer->data_len - ctrl_xfer->total_xferred, CFG_TUD_ENDPOINT0_BUFSIZE);
   uint8_t ep_addr = TU_EP0_OUT;
 
-  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_IN) {
+  if (ctrl_xfer->request.bmRequestType_bit.direction == TUSB_DIR_IN) {
     ep_addr = TU_EP0_IN;
-    if (0u != xact_len && _ctrl_xfer.buffer != _ctrl_epbuf.buf) {
-      TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, _ctrl_xfer.buffer, xact_len));
+    if (0u != xact_len && ctrl_xfer->buffer != _ctrl_epbuf.buf) {
+      TU_VERIFY(0 == tu_memcpy_s(_ctrl_epbuf.buf, CFG_TUD_ENDPOINT0_BUFSIZE, ctrl_xfer->buffer, xact_len));
     }
   }
 
@@ -865,20 +853,21 @@ static bool data_stage_xact(uint8_t rhport) {
 
 // Status phase
 bool tud_control_status(uint8_t rhport, const tusb_control_request_t* request) {
-  // _ctrl_xfer fields are pre-initialized at process_control_request entry
+  // _usbd_dev.ctrl_xfer fields are pre-initialized at process_setup_received entry
   (void) request;
-  return status_stage_xact(rhport, status_stage_ep(&_ctrl_xfer.request));
+  return status_stage_xact(rhport, status_stage_ep(&_usbd_dev.ctrl_xfer.request));
 }
 
 // Transmit data to/from the control endpoint. If wLength is zero, a status packet is sent instead.
 bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, void* buffer, uint16_t len) {
-  // _ctrl_xfer.request and reset fields are pre-initialized at process_control_request entry
+  // _usbd_dev.ctrl_xfer.request and reset fields are pre-initialized at process_setup_received entry
   (void) request;
-  _ctrl_xfer.buffer = (uint8_t*) buffer;
-  _ctrl_xfer.data_len = tu_min16(len, _ctrl_xfer.request.wLength);
+  usbd_control_xfer_t* const ctrl_xfer = &_usbd_dev.ctrl_xfer;
+  ctrl_xfer->buffer = (uint8_t*) buffer;
+  ctrl_xfer->data_len = tu_min16(len, ctrl_xfer->request.wLength);
 
-  if (_ctrl_xfer.request.wLength > 0U) {
-    if (_ctrl_xfer.data_len > 0U) {
+  if (ctrl_xfer->request.wLength > 0U) {
+    if (ctrl_xfer->data_len > 0U) {
       TU_ASSERT(buffer);
     }
     TU_ASSERT(data_stage_xact(rhport));
@@ -890,57 +879,46 @@ bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, voi
   return true;
 }
 
-static void usbd_control_reset(void) {
-  tu_varclr(&_ctrl_xfer);
-}
-
-static void usbd_control_set_complete_callback(usbd_control_xfer_cb_t fp) {
-  _ctrl_xfer.complete_cb = fp;
-}
-
 // Callback when a transaction completes on the DATA stage or Status stage of EP0
 static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
   (void) result;
+  usbd_control_xfer_t* const ctrl_xfer = &_usbd_dev.ctrl_xfer;
 
   // Status Stage complete: ep_addr matches the resolved Status stage endpoint
-  uint8_t const ep_status = status_stage_ep(&_ctrl_xfer.request);
+  uint8_t const ep_status = status_stage_ep(&ctrl_xfer->request);
   if (ep_addr == ep_status) {
     TU_ASSERT(0 == xferred_bytes);
 
     // invoke optional dcd hook if available
-    dcd_edpt0_status_complete(rhport, &_ctrl_xfer.request);
+    dcd_edpt0_status_complete(rhport, &ctrl_xfer->request);
 
-    if (NULL != _ctrl_xfer.complete_cb) {
-      // TODO refactor with usbd_driver_print_control_complete_name
-      _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_ACK, &_ctrl_xfer.request);
+    if (NULL != ctrl_xfer->complete_cb) {
+      ctrl_xfer->complete_cb(rhport, CONTROL_STAGE_ACK, &ctrl_xfer->request);
     }
 
     return true;
   }
 
   // Data stage progress
-  if (_ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
-    TU_VERIFY(_ctrl_xfer.buffer);
-    if (_ctrl_xfer.buffer != _ctrl_epbuf.buf) {
-      memcpy(_ctrl_xfer.buffer, _ctrl_epbuf.buf, xferred_bytes);
+  if (ctrl_xfer->request.bmRequestType_bit.direction == TUSB_DIR_OUT) {
+    TU_VERIFY(ctrl_xfer->buffer);
+    if (ctrl_xfer->buffer != _ctrl_epbuf.buf) {
+      memcpy(ctrl_xfer->buffer, _ctrl_epbuf.buf, xferred_bytes);
     }
-    TU_LOG_MEM(CFG_TUD_LOG_LEVEL, _ctrl_xfer.buffer, xferred_bytes, 2);
+    TU_LOG_MEM(CFG_TUD_LOG_LEVEL, ctrl_xfer->buffer, xferred_bytes, 2);
   }
 
-  _ctrl_xfer.total_xferred += (uint16_t) xferred_bytes;
-  _ctrl_xfer.buffer += xferred_bytes;
+  ctrl_xfer->total_xferred += (uint16_t) xferred_bytes;
+  ctrl_xfer->buffer += xferred_bytes;
 
   // Data Stage complete when wLength reached or short packet (incl. ZLP) seen
-  if ((_ctrl_xfer.request.wLength == _ctrl_xfer.total_xferred) ||
+  if ((ctrl_xfer->request.wLength == ctrl_xfer->total_xferred) ||
       (xferred_bytes < CFG_TUD_ENDPOINT0_BUFSIZE)) {
     bool is_ok = true;
 
-    if (NULL != _ctrl_xfer.complete_cb) {
-      #if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
-      usbd_driver_print_control_complete_name(_ctrl_xfer.complete_cb);
-      #endif
+    if (NULL != ctrl_xfer->complete_cb) {
       // Callback can still stall control in status phase, e.g. OUT data doesn't make sense
-      is_ok = _ctrl_xfer.complete_cb(rhport, CONTROL_STAGE_DATA, &_ctrl_xfer.request);
+      is_ok = ctrl_xfer->complete_cb(rhport, CONTROL_STAGE_DATA, &ctrl_xfer->request);
     }
 
     if (is_ok) {
@@ -964,27 +942,28 @@ static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t
 
 // Helper to invoke class driver control request handler
 static bool invoke_class_control(uint8_t rhport, usbd_class_driver_t const * driver, tusb_control_request_t const * request) {
-  usbd_control_set_complete_callback(driver->control_xfer_cb);
+  _usbd_dev.ctrl_xfer.complete_cb = driver->control_xfer_cb;
   TU_LOG_USBD("  %s control request\r\n", driver->name);
   return driver->control_xfer_cb(rhport, CONTROL_STAGE_SETUP, request);
 }
 
 // This handles the actual request and its response.
 // Returns false if unable to complete the request, causing caller to stall control endpoints.
-static bool process_control_request(uint8_t rhport, tusb_control_request_t const * p_request) {
+static bool process_setup_received(uint8_t rhport, tusb_control_request_t const * p_request) {
   // Initialize control transfer state for this request. The request copy must be
   // visible to usbd_control_xfer_cb when the (asynchronous) status ZLP completes,
   // since the SETUP packet event has already gone out of scope by then.
-  _ctrl_xfer.request = *p_request;
-  _ctrl_xfer.buffer = NULL;
-  _ctrl_xfer.total_xferred = 0;
-  _ctrl_xfer.data_len = 0;
-  _ctrl_xfer.complete_cb = NULL;
+  usbd_control_xfer_t* const ctrl_xfer = &_usbd_dev.ctrl_xfer;
+  ctrl_xfer->request = *p_request;
+  ctrl_xfer->buffer = NULL;
+  ctrl_xfer->total_xferred = 0;
+  ctrl_xfer->data_len = 0;
+  ctrl_xfer->complete_cb = NULL;
   TU_ASSERT(p_request->bmRequestType_bit.type < TUSB_REQ_TYPE_INVALID);
 
   // Vendor request
   if ( p_request->bmRequestType_bit.type == TUSB_REQ_TYPE_VENDOR ) {
-    usbd_control_set_complete_callback(tud_vendor_control_xfer_cb);
+    ctrl_xfer->complete_cb = tud_vendor_control_xfer_cb;
     return tud_vendor_control_xfer_cb(rhport, CONTROL_STAGE_SETUP, p_request);
   }
 
@@ -1022,8 +1001,6 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
           // Depending on mcu, status phase could be sent either before or after changing device address,
           // or even require stack to not response with status at all
           // Therefore DCD must take full responsibility to response and include zlp status packet if needed.
-          // _ctrl_xfer.request was already populated at process_control_request() entry, so the
-          // status ZLP that the DCD queues will be recognized by usbd_control_xfer_cb().
           dcd_set_address(rhport, (uint8_t) p_request->wValue);
           _usbd_dev.addressed = 1;
         break;
@@ -1092,7 +1069,7 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
               uint8_t const selector = tu_u16_high(p_request->wIndex);
               TU_VERIFY(TUSB_FEATURE_TEST_J <= selector && selector <= TUSB_FEATURE_TEST_FORCE_ENABLE);
 
-              usbd_control_set_complete_callback(process_test_mode_cb);
+              ctrl_xfer->complete_cb = process_test_mode_cb;
               tud_control_status(rhport, p_request);
               break;
             }
@@ -1161,7 +1138,7 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
         TU_VERIFY(TUSB_REQ_TYPE_STANDARD == p_request->bmRequestType_bit.type);
 
         // Clear complete callback if driver set since it can also stall the request.
-        usbd_control_set_complete_callback(NULL);
+        ctrl_xfer->complete_cb = NULL;
 
         switch (p_request->bRequest) { //-V2520
           case TUSB_REQ_GET_INTERFACE: {
@@ -1219,7 +1196,7 @@ static bool process_control_request(uint8_t rhport, tusb_control_request_t const
               // STD request must always be ACKed regardless of driver returned value
               // Also clear complete callback if driver set since it can also stall the request.
               (void) invoke_class_control(rhport, driver, p_request);
-              usbd_control_set_complete_callback(NULL);
+              ctrl_xfer->complete_cb = NULL;
 
               // skip ZLP status if driver already did that
               if (!_usbd_dev.ep_status[0][TUSB_DIR_IN].busy) {
@@ -1301,8 +1278,7 @@ static bool process_set_config(uint8_t rhport, uint8_t cfg_num) {
 }
 
 // return descriptor's buffer and update desc_len
-static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const * p_request)
-{
+static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const * p_request) {
   tusb_desc_type_t const desc_type = (tusb_desc_type_t) tu_u16_high(p_request->wValue);
   uint8_t const desc_index = tu_u16_low( p_request->wValue );
 
diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c
deleted file mode 100644
index 38dcc6a82..000000000
--- a/src/device/usbd_control.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * The MIT License (MIT)
- *
- * Copyright (c) 2019 Ha Thach (tinyusb.org)
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- *
- * This file is part of the TinyUSB stack.
- */
-
-// The usbd control function that used to live in this file has been merged
-// into src/device/usbd.c. This translation unit is intentionally empty and is
-// kept only so external/vendor build systems that still reference the path
-// keep resolving. Drop usbd_control.c from your build to silence the warning.
-#warning "src/device/usbd_control.c is deprecated and now empty; remove it from your build (its content lives in src/device/usbd.c)."
-- 
cgit v1.3.1


From 25ddb7ff0cfd361b733dadd3bb5307fdb94b6dc1 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 4 May 2026 09:22:11 +0700
Subject: minor clean up

---
 .../net_lwip_webserver/src/usb_descriptors.c       | 42 ++++++++++++++--------
 src/class/net/ecm_rndis_device.c                   |  4 +--
 src/class/net/ncm_device.c                         |  2 +-
 3 files changed, 30 insertions(+), 18 deletions(-)

(limited to 'src')

diff --git a/examples/device/net_lwip_webserver/src/usb_descriptors.c b/examples/device/net_lwip_webserver/src/usb_descriptors.c
index 1aa223eb9..a7e48c79b 100644
--- a/examples/device/net_lwip_webserver/src/usb_descriptors.c
+++ b/examples/device/net_lwip_webserver/src/usb_descriptors.c
@@ -221,45 +221,57 @@ static uint8_t const ncm_hs_configuration[] = {
 
 #endif
 
-// Configuration array: RNDIS and CDC-ECM
+// NCM work with all latest OS i.e macos 10.10+, windows 10+, and Linux.
+// For older system Configuration array of RNDIS and CDC-ECM may be needed for better compatibility.
 // - Windows only works with RNDIS
 // - MacOS only works with CDC-ECM
 // - Linux will work on both
-static const uint8_t *const configuration_fs_arr[CONFIG_ID_COUNT] = {
 #if CFG_TUD_ECM_RNDIS
+
+static const uint8_t *const configuration_fs_arr[CONFIG_ID_COUNT] = {
   [CONFIG_ID_RNDIS] = rndis_fs_configuration,
   [CONFIG_ID_ECM]   = ecm_fs_configuration
-#else
-  [CONFIG_ID_NCM] = ncm_fs_configuration
-#endif
 };
 
 #if TUD_OPT_HIGH_SPEED
 static const uint8_t *const configuration_hs_arr[CONFIG_ID_COUNT] = {
-#if CFG_TUD_ECM_RNDIS
   [CONFIG_ID_RNDIS] = rndis_hs_configuration,
   [CONFIG_ID_ECM]   = ecm_hs_configuration
-#else
-  [CONFIG_ID_NCM] = ncm_hs_configuration
-#endif
 };
 
 // Size array for each configuration
 static const uint16_t configuration_sz_arr[CONFIG_ID_COUNT] = {
-#if CFG_TUD_ECM_RNDIS
   [CONFIG_ID_RNDIS] = MAIN_CONFIG_TOTAL_LEN,
   [CONFIG_ID_ECM]   = ALT_CONFIG_TOTAL_LEN
+};
+
+// Scratch buffer for other speed configuration (sized to hold the largest config)
+#define MAX_CONFIG_TOTAL_LEN TU_MAX(MAIN_CONFIG_TOTAL_LEN, ALT_CONFIG_TOTAL_LEN)
+#endif
+
 #else
+
+static const uint8_t *const configuration_fs_arr[CONFIG_ID_COUNT] = {
+  [CONFIG_ID_NCM] = ncm_fs_configuration
+};
+
+#if TUD_OPT_HIGH_SPEED
+static const uint8_t *const configuration_hs_arr[CONFIG_ID_COUNT] = {
+  [CONFIG_ID_NCM] = ncm_hs_configuration
+};
+
+// Size array for each configuration
+static const uint16_t configuration_sz_arr[CONFIG_ID_COUNT] = {
   [CONFIG_ID_NCM] = NCM_CONFIG_TOTAL_LEN
-#endif
 };
 
 // Scratch buffer for other speed configuration (sized to hold the largest config)
-#if CFG_TUD_ECM_RNDIS
-  #define MAX_CONFIG_TOTAL_LEN TU_MAX(MAIN_CONFIG_TOTAL_LEN, ALT_CONFIG_TOTAL_LEN)
-#else
-  #define MAX_CONFIG_TOTAL_LEN NCM_CONFIG_TOTAL_LEN
+#define MAX_CONFIG_TOTAL_LEN NCM_CONFIG_TOTAL_LEN
 #endif
+
+#endif
+
+#if TUD_OPT_HIGH_SPEED
 static uint8_t desc_other_speed_config[MAX_CONFIG_TOTAL_LEN];
 
 // device qualifier: device descriptor fields that differ at other speed
diff --git a/src/class/net/ecm_rndis_device.c b/src/class/net/ecm_rndis_device.c
index 52c4f7f87..b27cac3ea 100644
--- a/src/class/net/ecm_rndis_device.c
+++ b/src/class/net/ecm_rndis_device.c
@@ -48,10 +48,10 @@ typedef struct {
   uint8_t itf_num;      // Index number of Management Interface, +1 for Data Interface
   uint8_t itf_data_alt; // Alternate setting of Data Interface. 0 : inactive, 1 : active
 
-  uint8_t ep_notif;
   uint8_t ep_in;
   uint8_t ep_out;
   uint16_t ep_size;     // bulk endpoint max packet size (IN and OUT assumed equal)
+  uint8_t ep_notif;
 
   bool ecm_mode;
 
@@ -361,7 +361,7 @@ bool netd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_
   /* data transmission finished */
   if (ep_addr == _netd_itf.ep_in) {
     /* TinyUSB requires the class driver to implement ZLP (since ZLP usage is class-specific) */
-    if (xferred_bytes && (0 == (xferred_bytes % _netd_itf.ep_size))) {
+    if (xferred_bytes > 0 && 0 == (xferred_bytes & (_netd_itf.ep_size-1))) {
       do_in_xfer(NULL, 0); /* a ZLP is needed */
     } else {
       /* we're finally finished */
diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index fe33d0247..1327dbaf2 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -342,7 +342,7 @@ static bool xmit_insert_required_zlp(uint8_t rhport, uint32_t xferred_bytes) {
   TU_LOG_DRV("xmit_insert_required_zlp(%d,%ld)\n", rhport, xferred_bytes);
 
   uint16_t const ep_size = ncm_interface.ep_size;
-  if (xferred_bytes == 0 || xferred_bytes % ep_size != 0) {
+  if (xferred_bytes == 0 || (xferred_bytes & (ep_size-1)) != 0) {
     return false;
   }
 
-- 
cgit v1.3.1


From a5e9ce5fbb300702d04c47c7c06436396912d3d6 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 4 May 2026 10:29:29 +0700
Subject: refactor `usbd.c`: extract `process_std_device_request` for clarity

---
 src/device/usbd.c | 223 +++++++++++++++++++++++++++---------------------------
 1 file changed, 113 insertions(+), 110 deletions(-)

(limited to 'src')

diff --git a/src/device/usbd.c b/src/device/usbd.c
index 49c8851de..291319709 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -422,6 +422,7 @@ TU_ATTR_ALWAYS_INLINE static inline bool queue_event(dcd_event_t const * event,
 //--------------------------------------------------------------------+
 // Prototypes
 //--------------------------------------------------------------------+
+static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
 static bool process_setup_received(uint8_t rhport, tusb_control_request_t const * p_request);
 static bool process_set_config(uint8_t rhport, uint8_t cfg_num);
 static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const * p_request);
@@ -436,9 +437,6 @@ static bool process_test_mode_cb(uint8_t rhport, uint8_t stage, tusb_control_req
 }
 #endif
 
-// Control Endpoint
-static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
-
 //--------------------------------------------------------------------+
 // Weak stubs: invoked if no strong implementation is available
 //--------------------------------------------------------------------+
@@ -947,6 +945,117 @@ static bool invoke_class_control(uint8_t rhport, usbd_class_driver_t const * dri
   return driver->control_xfer_cb(rhport, CONTROL_STAGE_SETUP, request);
 }
 
+// Process a standard request to the device recipient (extracted from
+// process_setup_received for readability; GCC chooses to inline it).
+static bool process_std_device_request(uint8_t rhport, tusb_control_request_t const * p_request) {
+  switch (p_request->bRequest) { //-V2520
+    case TUSB_REQ_SET_ADDRESS:
+      // Depending on mcu, status phase could be sent either before or after changing device address,
+      // or even require stack to not response with status at all
+      // Therefore DCD must take full responsibility to response and include zlp status packet if needed.
+      dcd_set_address(rhport, (uint8_t) p_request->wValue);
+      _usbd_dev.addressed = 1;
+      return true;
+
+    case TUSB_REQ_GET_CONFIGURATION: {
+      uint8_t cfg_num = _usbd_dev.cfg_num;
+      tud_control_xfer(rhport, p_request, &cfg_num, 1);
+      return true;
+    }
+
+    case TUSB_REQ_SET_CONFIGURATION: {
+      uint8_t const cfg_num = (uint8_t) p_request->wValue;
+
+      // Only process if new configure is different
+      if (_usbd_dev.cfg_num != cfg_num) {
+        if (_usbd_dev.cfg_num != 0) {
+          // already configured: need to clear all endpoints and driver first
+          TU_LOG_USBD("  Clear current Configuration (%u) before switching\r\n", _usbd_dev.cfg_num);
+
+          dcd_sof_enable(rhport, false);
+          dcd_edpt_close_all(rhport);
+
+          // close all drivers and current configured state except bus speed
+          const uint8_t speed = _usbd_dev.speed;
+          configuration_reset(rhport);
+
+          _usbd_dev.speed = speed; // restore speed
+        }
+
+        _usbd_dev.cfg_num = cfg_num;
+
+        // Handle the new configuration
+        if (cfg_num == 0) {
+          tud_umount_cb();
+        } else {
+          if (!process_set_config(rhport, cfg_num)) {
+            _usbd_dev.cfg_num = 0;
+            TU_ASSERT(false);
+          }
+          tud_mount_cb();
+        }
+      }
+
+      tud_control_status(rhport, p_request);
+      return true;
+    }
+
+    case TUSB_REQ_GET_DESCRIPTOR:
+      return process_get_descriptor(rhport, p_request);
+
+    case TUSB_REQ_SET_FEATURE:
+      switch (p_request->wValue) { //-V2520
+        case TUSB_REQ_FEATURE_REMOTE_WAKEUP:
+          TU_LOG_USBD("    Enable Remote Wakeup\r\n");
+          // Host may enable remote wake up before suspending especially HID device
+          _usbd_dev.remote_wakeup_en = 1;
+          tud_control_status(rhport, p_request);
+          return true;
+
+        #if CFG_TUD_TEST_MODE
+        case TUSB_REQ_FEATURE_TEST_MODE: {
+          // Only handle the test mode if supported and valid
+          TU_VERIFY(0 == tu_u16_low(p_request->wIndex));
+
+          uint8_t const selector = tu_u16_high(p_request->wIndex);
+          TU_VERIFY(TUSB_FEATURE_TEST_J <= selector && selector <= TUSB_FEATURE_TEST_FORCE_ENABLE);
+
+          _usbd_dev.ctrl_xfer.complete_cb = process_test_mode_cb;
+          tud_control_status(rhport, p_request);
+          return true;
+        }
+        #endif
+
+        // Stall unsupported feature selector
+        default: return false;
+      }
+
+    case TUSB_REQ_CLEAR_FEATURE:
+      // Only support remote wakeup for device feature
+      TU_VERIFY(TUSB_REQ_FEATURE_REMOTE_WAKEUP == p_request->wValue);
+      TU_LOG_USBD("    Disable Remote Wakeup\r\n");
+
+      // Host may disable remote wake up after resuming
+      _usbd_dev.remote_wakeup_en = 0;
+      tud_control_status(rhport, p_request);
+      return true;
+
+    case TUSB_REQ_GET_STATUS: {
+      // Device status bit mask
+      // - Bit 0: Self Powered TODO must invoke callback to get actual status
+      // - Bit 1: Remote Wakeup enabled
+      uint16_t status = (uint16_t) _usbd_dev.dev_state_bm;
+      tud_control_xfer(rhport, p_request, &status, 2);
+      return true;
+    }
+
+    default:
+      TU_BREAKPOINT();
+      return false;
+  }
+}
+
+
 // This handles the actual request and its response.
 // Returns false if unable to complete the request, causing caller to stall control endpoints.
 static bool process_setup_received(uint8_t rhport, tusb_control_request_t const * p_request) {
@@ -996,113 +1105,7 @@ static bool process_setup_received(uint8_t rhport, tusb_control_request_t const
         return false;
       }
 
-      switch (p_request->bRequest) { //-V2520
-        case TUSB_REQ_SET_ADDRESS:
-          // Depending on mcu, status phase could be sent either before or after changing device address,
-          // or even require stack to not response with status at all
-          // Therefore DCD must take full responsibility to response and include zlp status packet if needed.
-          dcd_set_address(rhport, (uint8_t) p_request->wValue);
-          _usbd_dev.addressed = 1;
-        break;
-
-        case TUSB_REQ_GET_CONFIGURATION: {
-          uint8_t cfg_num = _usbd_dev.cfg_num;
-          tud_control_xfer(rhport, p_request, &cfg_num, 1);
-        }
-        break;
-
-        case TUSB_REQ_SET_CONFIGURATION: {
-          uint8_t const cfg_num = (uint8_t) p_request->wValue;
-
-          // Only process if new configure is different
-          if (_usbd_dev.cfg_num != cfg_num) {
-            if (_usbd_dev.cfg_num != 0) {
-              // already configured: need to clear all endpoints and driver first
-              TU_LOG_USBD("  Clear current Configuration (%u) before switching\r\n", _usbd_dev.cfg_num);
-
-              dcd_sof_enable(rhport, false);
-              dcd_edpt_close_all(rhport);
-
-              // close all drivers and current configured state except bus speed
-              const uint8_t speed = _usbd_dev.speed;
-              configuration_reset(rhport);
-
-              _usbd_dev.speed = speed; // restore speed
-            }
-
-            _usbd_dev.cfg_num = cfg_num;
-
-            // Handle the new configuration
-            if (cfg_num == 0) {
-              tud_umount_cb();
-            } else {
-              if (!process_set_config(rhport, cfg_num)) {
-                _usbd_dev.cfg_num = 0;
-                TU_ASSERT(false);
-              }
-              tud_mount_cb();
-            }
-          }
-
-          tud_control_status(rhport, p_request);
-        }
-        break;
-
-        case TUSB_REQ_GET_DESCRIPTOR:
-          TU_VERIFY(process_get_descriptor(rhport, p_request));
-        break;
-
-        case TUSB_REQ_SET_FEATURE:
-          switch(p_request->wValue) { //-V2520
-            case TUSB_REQ_FEATURE_REMOTE_WAKEUP:
-              TU_LOG_USBD("    Enable Remote Wakeup\r\n");
-              // Host may enable remote wake up before suspending especially HID device
-              _usbd_dev.remote_wakeup_en = 1;
-              tud_control_status(rhport, p_request);
-              break;
-
-            #if CFG_TUD_TEST_MODE
-            case TUSB_REQ_FEATURE_TEST_MODE: {
-              // Only handle the test mode if supported and valid
-              TU_VERIFY(0 == tu_u16_low(p_request->wIndex));
-
-              uint8_t const selector = tu_u16_high(p_request->wIndex);
-              TU_VERIFY(TUSB_FEATURE_TEST_J <= selector && selector <= TUSB_FEATURE_TEST_FORCE_ENABLE);
-
-              ctrl_xfer->complete_cb = process_test_mode_cb;
-              tud_control_status(rhport, p_request);
-              break;
-            }
-            #endif
-
-            // Stall unsupported feature selector
-            default: return false;
-          }
-        break;
-
-        case TUSB_REQ_CLEAR_FEATURE:
-          // Only support remote wakeup for device feature
-          TU_VERIFY(TUSB_REQ_FEATURE_REMOTE_WAKEUP == p_request->wValue);
-          TU_LOG_USBD("    Disable Remote Wakeup\r\n");
-
-          // Host may disable remote wake up after resuming
-          _usbd_dev.remote_wakeup_en = 0;
-          tud_control_status(rhport, p_request);
-          break;
-
-        case TUSB_REQ_GET_STATUS: {
-          // Device status bit mask
-          // - Bit 0: Self Powered TODO must invoke callback to get actual status
-          // - Bit 1: Remote Wakeup enabled
-          uint16_t status = (uint16_t)_usbd_dev.dev_state_bm;
-          tud_control_xfer(rhport, p_request, &status, 2);
-          break;
-        }
-
-        // Unknown/Unsupported request
-        default: TU_BREAKPOINT(); return false;
-      }
-    break;
+      return process_std_device_request(rhport, p_request);
 
     //------------- Class/Interface Specific Request -------------//
     case TUSB_REQ_RCPT_INTERFACE: {
-- 
cgit v1.3.1


From 9d68ed65f7200f155f01416b332c5e9f2340a8b2 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 4 May 2026 11:19:26 +0700
Subject: refactor: replace `tu_edpt_state_t` struct with `uint8_t` and update
 all endpoint state handling methods and accesses

---
 src/class/printer/printer_device.c |  1 -
 src/common/tusb_private.h          | 19 ++++------
 src/device/usbd.c                  | 72 ++++++++++++++++----------------------
 src/host/usbh.c                    | 23 ++++++------
 src/tusb.c                         | 15 ++++----
 5 files changed, 54 insertions(+), 76 deletions(-)

(limited to 'src')

diff --git a/src/class/printer/printer_device.c b/src/class/printer/printer_device.c
index d2dc9b163..158455fc9 100644
--- a/src/class/printer/printer_device.c
+++ b/src/class/printer/printer_device.c
@@ -41,7 +41,6 @@ typedef struct {
   uint8_t itf_num;
 
   /*------------- From this point, data is not cleared by bus reset -------------*/
-
   tu_edpt_stream_t rx_stream;
   tu_edpt_stream_t tx_stream;
 
diff --git a/src/common/tusb_private.h b/src/common/tusb_private.h
index 91d213755..a31bf7b03 100644
--- a/src/common/tusb_private.h
+++ b/src/common/tusb_private.h
@@ -46,17 +46,10 @@ extern tusb_role_t _tusb_rhport_role[TUP_USBIP_CONTROLLER_NUM];
 // Endpoint
 //--------------------------------------------------------------------+
 
-enum {
- TU_EDPT_STATE_BUSY    = 0x01,
- TU_EDPT_STATE_STALLED = 0x02,
- TU_EDPT_STATE_CLAIMED = 0x04,
-};
-
-typedef struct TU_ATTR_PACKED {
-  volatile uint8_t busy    : 1;
-  volatile uint8_t stalled : 1;
-  volatile uint8_t claimed : 1;
-} tu_edpt_state_t;
+// Endpoint state bits — manipulate the bare uint8_t with these masks.
+#define TU_EDPT_STATE_BUSY    0x01u
+#define TU_EDPT_STATE_STALLED 0x02u
+#define TU_EDPT_STATE_CLAIMED 0x04u
 
 typedef struct {
   uint8_t  hwid;    // device: rhport, host: daddr
@@ -92,10 +85,10 @@ bool tu_bind_driver_to_ep_itf(uint8_t driver_id, uint8_t ep2drv[][2], uint8_t it
                               const uint8_t *p_desc, uint16_t desc_len);
 
 // Claim an endpoint with provided mutex
-bool tu_edpt_claim(tu_edpt_state_t* ep_state, osal_mutex_t mutex);
+bool tu_edpt_claim(volatile uint8_t* ep_state, osal_mutex_t mutex);
 
 // Release an endpoint with provided mutex
-bool tu_edpt_release(tu_edpt_state_t* ep_state, osal_mutex_t mutex);
+bool tu_edpt_release(volatile uint8_t* ep_state, osal_mutex_t mutex);
 
 //--------------------------------------------------------------------+
 // Endpoint Stream
diff --git a/src/device/usbd.c b/src/device/usbd.c
index 291319709..f8ec51762 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -149,7 +149,7 @@ typedef struct {
   uint8_t itf2drv[CFG_TUD_INTERFACE_MAX];   // map interface number to driver (0xff is invalid)
   uint8_t ep2drv[CFG_TUD_ENDPPOINT_MAX][2]; // map endpoint to driver ( 0xff is invalid ), can use only 4-bit each
 
-  tu_edpt_state_t ep_status[CFG_TUD_ENDPPOINT_MAX][2];
+  volatile uint8_t ep_status[CFG_TUD_ENDPPOINT_MAX][2];
 } usbd_device_t;
 
 static usbd_device_t    _usbd_dev;
@@ -711,7 +711,9 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
         break;
 
       case DCD_EVENT_SETUP_RECEIVED:
-        TU_ASSERT(_usbd_queued_setup > 0,);
+        if (_usbd_queued_setup == 0) {
+          break;
+        }
         _usbd_queued_setup--;
         TU_LOG_BUF(CFG_TUD_LOG_LEVEL, &event.setup_received, 8);
         if (_usbd_queued_setup != 0) {
@@ -723,18 +725,16 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
         // But it is easier to set it every time instead of wasting time to check then set
         _usbd_dev.connected = 1;
 
-        // mark both in & out control as free
-        _usbd_dev.ep_status[0][TUSB_DIR_OUT].busy = 0;
-        _usbd_dev.ep_status[0][TUSB_DIR_OUT].claimed = 0;
-        _usbd_dev.ep_status[0][TUSB_DIR_IN].busy = 0;
-        _usbd_dev.ep_status[0][TUSB_DIR_IN].claimed = 0;
+        // reset ep state
+        _usbd_dev.ep_status[0][TUSB_DIR_OUT] = 0;
+        _usbd_dev.ep_status[0][TUSB_DIR_IN] = 0;
 
         // Process control request
         if (!process_setup_received(event.rhport, &event.setup_received)) {
           TU_LOG_USBD("  Stall EP0\r\n");
           // Failed -> stall both control endpoint IN and OUT
-          dcd_edpt_stall(event.rhport, 0);
-          dcd_edpt_stall(event.rhport, 0 | TUSB_DIR_IN_MASK);
+          dcd_edpt_stall(event.rhport, TU_EP0_OUT);
+          dcd_edpt_stall(event.rhport, TU_EP0_IN);
         }
         break;
 
@@ -746,8 +746,8 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
 
         TU_LOG_USBD("on EP %02X with %u bytes\r\n", ep_addr, (unsigned int) event.xfer_complete.len);
 
-        _usbd_dev.ep_status[epnum][ep_dir].busy = 0;
-        _usbd_dev.ep_status[epnum][ep_dir].claimed = 0;
+        // Clear busy + claimed
+        _usbd_dev.ep_status[epnum][ep_dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
 
         if (0 == epnum) {
           usbd_control_xfer_cb(event.rhport, ep_addr, (xfer_result_t) event.xfer_complete.result, event.xfer_complete.len);
@@ -1202,7 +1202,7 @@ static bool process_setup_received(uint8_t rhport, tusb_control_request_t const
               ctrl_xfer->complete_cb = NULL;
 
               // skip ZLP status if driver already did that
-              if (!_usbd_dev.ep_status[0][TUSB_DIR_IN].busy) {
+              if (!(_usbd_dev.ep_status[0][TUSB_DIR_IN] & TU_EDPT_STATE_BUSY)) {
                 tud_control_status(rhport, p_request);
               }
             }
@@ -1441,15 +1441,15 @@ TU_ATTR_FAST_FUNC void dcd_event_handler(dcd_event_t const* event, bool in_isr)
         usbd_class_driver_t const* driver = get_driver(_usbd_dev.ep2drv[epnum][ep_dir]);
 
         if (driver && driver->xfer_isr) {
-          _usbd_dev.ep_status[epnum][ep_dir].busy = 0;
-          _usbd_dev.ep_status[epnum][ep_dir].claimed = 0;
+          // Clear busy + claimed
+          _usbd_dev.ep_status[epnum][ep_dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
 
           send = !driver->xfer_isr(event->rhport, ep_addr, (xfer_result_t) event->xfer_complete.result, event->xfer_complete.len);
 
           // xfer_isr() is deferred to xfer_cb(), revert busy/claimed status
           if (send) {
-            _usbd_dev.ep_status[epnum][ep_dir].busy = 1;
-            _usbd_dev.ep_status[epnum][ep_dir].claimed = 1;
+            // set busy + claimed
+            _usbd_dev.ep_status[epnum][ep_dir] |= (TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
           }
         }
       }
@@ -1539,9 +1539,7 @@ bool usbd_edpt_claim(uint8_t rhport, uint8_t ep_addr) {
 
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
-  tu_edpt_state_t* ep_state = &_usbd_dev.ep_status[epnum][dir];
-
-  return tu_edpt_claim(ep_state, _usbd_mutex);
+  return tu_edpt_claim(&_usbd_dev.ep_status[epnum][dir], _usbd_mutex);
 }
 
 bool usbd_edpt_release(uint8_t rhport, uint8_t ep_addr) {
@@ -1549,9 +1547,7 @@ bool usbd_edpt_release(uint8_t rhport, uint8_t ep_addr) {
 
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
-  tu_edpt_state_t* ep_state = &_usbd_dev.ep_status[epnum][dir];
-
-  return tu_edpt_release(ep_state, _usbd_mutex);
+  return tu_edpt_release(&_usbd_dev.ep_status[epnum][dir], _usbd_mutex);
 }
 
 bool usbd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t* buffer, uint16_t total_bytes, bool is_isr) {
@@ -1571,18 +1567,17 @@ bool usbd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t* buffer, uint16_t t
 #endif
 
   // Attempt to transfer on a busy endpoint, sound like an race condition !
-  TU_ASSERT(_usbd_dev.ep_status[epnum][dir].busy == 0);
+  TU_ASSERT((_usbd_dev.ep_status[epnum][dir] & TU_EDPT_STATE_BUSY) == 0);
 
   // Set busy first since the actual transfer can be complete before dcd_edpt_xfer()
   // could return and USBD task can preempt and clear the busy
-  _usbd_dev.ep_status[epnum][dir].busy = 1;
+  _usbd_dev.ep_status[epnum][dir] |= TU_EDPT_STATE_BUSY;
 
   if (dcd_edpt_xfer(rhport, ep_addr, buffer, total_bytes, is_isr)) {
     return true;
   } else {
     // DCD error, mark endpoint as ready to allow next transfer
-    _usbd_dev.ep_status[epnum][dir].busy = 0;
-    _usbd_dev.ep_status[epnum][dir].claimed = 0;
+    _usbd_dev.ep_status[epnum][dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
     TU_LOG_USBD("FAILED\r\n");
     TU_BREAKPOINT();
     return false;
@@ -1603,19 +1598,18 @@ bool usbd_edpt_xfer_fifo(uint8_t rhport, uint8_t ep_addr, tu_fifo_t* ff, uint16_
   TU_LOG_USBD("  Queue FIFO EP %02X with %u bytes ... ", ep_addr, total_bytes);
 
   // Attempt to transfer on a busy endpoint, sound like a race condition !
-  TU_ASSERT(_usbd_dev.ep_status[epnum][dir].busy == 0);
+  TU_ASSERT((_usbd_dev.ep_status[epnum][dir] & TU_EDPT_STATE_BUSY) == 0);
 
   // Set busy first since the actual transfer can be complete before dcd_edpt_xfer() could return
   // and usbd task can preempt and clear the busy
-  _usbd_dev.ep_status[epnum][dir].busy = 1;
+  _usbd_dev.ep_status[epnum][dir] |= TU_EDPT_STATE_BUSY;
 
   if (dcd_edpt_xfer_fifo(rhport, ep_addr, ff, total_bytes, is_isr)) {
     TU_LOG_USBD("OK\r\n");
     return true;
   } else {
     // DCD error, mark endpoint as ready to allow next transfer
-    _usbd_dev.ep_status[epnum][dir].busy = 0;
-    _usbd_dev.ep_status[epnum][dir].claimed = 0;
+    _usbd_dev.ep_status[epnum][dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
     TU_LOG_USBD("failed\r\n");
     TU_BREAKPOINT();
     return false;
@@ -1636,7 +1630,7 @@ bool usbd_edpt_busy(uint8_t rhport, uint8_t ep_addr) {
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
 
-  return _usbd_dev.ep_status[epnum][dir].busy;
+  return (_usbd_dev.ep_status[epnum][dir] & TU_EDPT_STATE_BUSY) != 0;
 }
 
 void usbd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
@@ -1648,8 +1642,7 @@ void usbd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
   // only stalled if currently cleared
   TU_LOG_USBD("    Stall EP %02X\r\n", ep_addr);
   dcd_edpt_stall(rhport, ep_addr);
-  _usbd_dev.ep_status[epnum][dir].stalled = 1;
-  _usbd_dev.ep_status[epnum][dir].busy = 1;
+  _usbd_dev.ep_status[epnum][dir] |= (TU_EDPT_STATE_STALLED | TU_EDPT_STATE_BUSY);
 }
 
 void usbd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
@@ -1661,8 +1654,7 @@ void usbd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
   // only clear if currently stalled
   TU_LOG_USBD("    Clear Stall EP %02X\r\n", ep_addr);
   dcd_edpt_clear_stall(rhport, ep_addr);
-  _usbd_dev.ep_status[epnum][dir].stalled = 0;
-  _usbd_dev.ep_status[epnum][dir].busy = 0;
+  _usbd_dev.ep_status[epnum][dir] &= (uint8_t) ~(TU_EDPT_STATE_STALLED | TU_EDPT_STATE_BUSY);
 }
 
 bool usbd_edpt_stalled(uint8_t rhport, uint8_t ep_addr) {
@@ -1671,7 +1663,7 @@ bool usbd_edpt_stalled(uint8_t rhport, uint8_t ep_addr) {
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
 
-  return _usbd_dev.ep_status[epnum][dir].stalled;
+  return (_usbd_dev.ep_status[epnum][dir] & TU_EDPT_STATE_STALLED) != 0;
 }
 
 /**
@@ -1691,9 +1683,7 @@ void usbd_edpt_close(uint8_t rhport, uint8_t ep_addr) {
   uint8_t const dir = tu_edpt_dir(ep_addr);
 
   dcd_edpt_close(rhport, ep_addr);
-  _usbd_dev.ep_status[epnum][dir].stalled = 0;
-  _usbd_dev.ep_status[epnum][dir].busy = 0;
-  _usbd_dev.ep_status[epnum][dir].claimed = 0;
+  _usbd_dev.ep_status[epnum][dir] = 0;
 #endif
 
   return;
@@ -1738,9 +1728,7 @@ bool usbd_edpt_iso_activate(uint8_t rhport, tusb_desc_endpoint_t const* desc_ep)
   TU_ASSERT(epnum < CFG_TUD_ENDPPOINT_MAX);
   TU_ASSERT(tu_edpt_validate(desc_ep, (tusb_speed_t)_usbd_dev.speed));
 
-  _usbd_dev.ep_status[epnum][dir].stalled = 0;
-  _usbd_dev.ep_status[epnum][dir].busy = 0;
-  _usbd_dev.ep_status[epnum][dir].claimed = 0;
+  _usbd_dev.ep_status[epnum][dir] = 0;
   return dcd_edpt_iso_activate(rhport, desc_ep);
 #else
   (void) rhport; (void) desc_ep;
diff --git a/src/host/usbh.c b/src/host/usbh.c
index 8f80800e9..490724b02 100644
--- a/src/host/usbh.c
+++ b/src/host/usbh.c
@@ -140,7 +140,7 @@ typedef struct {
   uint8_t itf2drv[CFG_TUH_INTERFACE_MAX];  // map interface number to driver (0xff is invalid)
   uint8_t ep2drv[CFG_TUH_ENDPOINT_MAX][2]; // map endpoint to driver ( 0xff is invalid ), can use only 4-bit each
 
-  tu_edpt_state_t ep_status[CFG_TUH_ENDPOINT_MAX][2];
+  volatile uint8_t ep_status[CFG_TUH_ENDPOINT_MAX][2];
 
 #if CFG_TUH_API_EDPT_XFER
   // TODO array can be CFG_TUH_ENDPOINT_MAX-1
@@ -744,8 +744,8 @@ void tuh_task_ext(uint32_t timeout_ms, bool in_isr) {
           usbh_device_t* dev = get_device(event.dev_addr);
           TU_VERIFY(dev && dev->connected,);
 
-          dev->ep_status[epnum][ep_dir].busy = 0;
-          dev->ep_status[epnum][ep_dir].claimed = 0;
+          // clear busy and claimed
+          dev->ep_status[epnum][ep_dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
 
           if (0 == epnum) {
             usbh_control_xfer_cb(event.dev_addr, ep_addr, (xfer_result_t) event.xfer_complete.result, event.xfer_complete.len);
@@ -1016,10 +1016,10 @@ bool tuh_edpt_abort_xfer(uint8_t daddr, uint8_t ep_addr) {
     usbh_device_t* dev = get_device(daddr);
     TU_VERIFY(dev);
 
-    TU_VERIFY(dev->ep_status[epnum][dir].busy); // non-control skip if not busy
+    TU_VERIFY(dev->ep_status[epnum][dir] & TU_EDPT_STATE_BUSY); // non-control skip if not busy
     // abort then mark as ready and release endpoint
     hcd_edpt_abort_xfer(dev->bus_info.rhport, daddr, ep_addr);
-    dev->ep_status[epnum][dir].busy = false;
+    dev->ep_status[epnum][dir] &= (uint8_t) ~TU_EDPT_STATE_BUSY; // clear busy
     tu_edpt_release(&dev->ep_status[epnum][dir], _usbh_mutex);
   }
 
@@ -1110,16 +1110,16 @@ bool usbh_edpt_xfer_with_callback(uint8_t dev_addr, uint8_t ep_addr, uint8_t* bu
 
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
-  tu_edpt_state_t* ep_state = &dev->ep_status[epnum][dir];
+  volatile uint8_t* ep_state = &dev->ep_status[epnum][dir];
 
   TU_LOG_USBH("  Queue EP %02X with %u bytes ... \r\n", ep_addr, total_bytes);
 
   // Attempt to transfer on a busy endpoint, sound like an race condition !
-  TU_ASSERT(ep_state->busy == 0);
+  TU_ASSERT((*ep_state & TU_EDPT_STATE_BUSY) == 0);
 
   // Set busy first since the actual transfer can be complete before hcd_edpt_xfer()
   // could return and USBH task can preempt and clear the busy
-  ep_state->busy = 1;
+  *ep_state |= TU_EDPT_STATE_BUSY;
 
 #if CFG_TUH_API_EDPT_XFER
   dev->ep_callback[epnum][dir].complete_cb = complete_cb;
@@ -1130,9 +1130,8 @@ bool usbh_edpt_xfer_with_callback(uint8_t dev_addr, uint8_t ep_addr, uint8_t* bu
     TU_LOG_USBH("OK\r\n");
     return true;
   } else {
-    // HCD error, mark endpoint as ready to allow next transfer
-    ep_state->busy = 0;
-    ep_state->claimed = 0;
+    // HCD error, clear busy and claimed to allow next transfer
+    *ep_state &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
     TU_LOG1("Failed\r\n");
 //    TU_BREAKPOINT();
     return false;
@@ -1178,7 +1177,7 @@ bool usbh_edpt_busy(uint8_t dev_addr, uint8_t ep_addr) {
   uint8_t const epnum = tu_edpt_number(ep_addr);
   uint8_t const dir = tu_edpt_dir(ep_addr);
 
-  return dev->ep_status[epnum][dir].busy;
+  return (dev->ep_status[epnum][dir] & TU_EDPT_STATE_BUSY) != 0;
 }
 
 //--------------------------------------------------------------------+
diff --git a/src/tusb.c b/src/tusb.c
index 5e4422e41..5d656fb8c 100644
--- a/src/tusb.c
+++ b/src/tusb.c
@@ -224,32 +224,31 @@ uint8_t const* tu_desc_find3(uint8_t const* desc, uint8_t const* end, uint8_t by
 // Endpoint Helper for both Host and Device stack
 //--------------------------------------------------------------------+
 
-bool tu_edpt_claim(tu_edpt_state_t* ep_state, osal_mutex_t mutex) {
+bool tu_edpt_claim(volatile uint8_t* ep_state, osal_mutex_t mutex) {
   (void) mutex;
 
   // pre-check to help reducing mutex lock
-  TU_VERIFY(ep_state->busy == 0);
-  TU_VERIFY(ep_state->claimed == 0);
+  TU_VERIFY((*ep_state & (TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED)) == 0);
   (void) osal_mutex_lock(mutex, OSAL_TIMEOUT_WAIT_FOREVER);
 
   // can only claim the endpoint if it is not busy and not claimed yet.
-  bool const available = (ep_state->busy == 0) && (ep_state->claimed == 0);
+  bool const available = (*ep_state & (TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED)) == 0;
   if (available) {
-    ep_state->claimed = 1;
+    *ep_state |= TU_EDPT_STATE_CLAIMED;
   }
 
   (void) osal_mutex_unlock(mutex);
   return available;
 }
 
-bool tu_edpt_release(tu_edpt_state_t* ep_state, osal_mutex_t mutex) {
+bool tu_edpt_release(volatile uint8_t* ep_state, osal_mutex_t mutex) {
   (void) mutex;
   (void) osal_mutex_lock(mutex, OSAL_TIMEOUT_WAIT_FOREVER);
 
   // can only release the endpoint if it is claimed and not busy
-  bool const ret = (ep_state->claimed == 1) && (ep_state->busy == 0);
+  bool const ret = (*ep_state & (TU_EDPT_STATE_CLAIMED | TU_EDPT_STATE_BUSY)) == TU_EDPT_STATE_CLAIMED;
   if (ret) {
-    ep_state->claimed = 0;
+    *ep_state &= (uint8_t) ~TU_EDPT_STATE_CLAIMED;
   }
 
   (void) osal_mutex_unlock(mutex);
-- 
cgit v1.3.1


From e954302c103b4fc6870c6914945e6da1f62f6423 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 4 May 2026 13:39:39 +0700
Subject: fix usbd control to support wLength hack

---
 src/device/usbd.c     | 17 ++++++++---------
 src/device/usbd_pvt.h |  4 ----
 2 files changed, 8 insertions(+), 13 deletions(-)

(limited to 'src')

diff --git a/src/device/usbd.c b/src/device/usbd.c
index f8ec51762..0e58f70bf 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -945,8 +945,7 @@ static bool invoke_class_control(uint8_t rhport, usbd_class_driver_t const * dri
   return driver->control_xfer_cb(rhport, CONTROL_STAGE_SETUP, request);
 }
 
-// Process a standard request to the device recipient (extracted from
-// process_setup_received for readability; GCC chooses to inline it).
+// Process a standard request to the device recipient.
 static bool process_std_device_request(uint8_t rhport, tusb_control_request_t const * p_request) {
   switch (p_request->bRequest) { //-V2520
     case TUSB_REQ_SET_ADDRESS:
@@ -1068,6 +1067,8 @@ static bool process_setup_received(uint8_t rhport, tusb_control_request_t const
   ctrl_xfer->total_xferred = 0;
   ctrl_xfer->data_len = 0;
   ctrl_xfer->complete_cb = NULL;
+
+  p_request = &ctrl_xfer->request; // re-direct request pointer to internal copy (modifiable for hacking)
   TU_ASSERT(p_request->bmRequestType_bit.type < TUSB_REQ_TYPE_INVALID);
 
   // Vendor request
@@ -1289,20 +1290,18 @@ static bool process_get_descriptor(uint8_t rhport, tusb_control_request_t const
     case TUSB_DESC_DEVICE: {
       TU_LOG_USBD(" Device\r\n");
 
-      void* desc_device = (void*) (uintptr_t) tud_descriptor_device_cb();
+      void *desc_device = (void *)(uintptr_t)tud_descriptor_device_cb();
       TU_ASSERT(desc_device);
 
       // Only response with exactly 1 Packet if: not addressed and host requested more data than device descriptor has.
       // This only happens with the very first get device descriptor and EP0 size = 8 or 16.
       if ((CFG_TUD_ENDPOINT0_SIZE < sizeof(tusb_desc_device_t)) && !_usbd_dev.addressed &&
-          ((tusb_control_request_t const*) p_request)->wLength > sizeof(tusb_desc_device_t)) {
+          p_request->wLength > sizeof(tusb_desc_device_t)) {
         // Hack here: we modify the request length to prevent usbd_control response with zlp
         // since we are responding with 1 packet & less data than wLength.
-        tusb_control_request_t mod_request = *p_request;
-        mod_request.wLength = CFG_TUD_ENDPOINT0_SIZE;
-
-        return tud_control_xfer(rhport, &mod_request, desc_device, CFG_TUD_ENDPOINT0_SIZE);
-      }else {
+        ((tusb_control_request_t *)(uintptr_t)p_request)->wLength = CFG_TUD_ENDPOINT0_SIZE;
+        return tud_control_xfer(rhport, p_request, desc_device, CFG_TUD_ENDPOINT0_SIZE);
+      } else {
         return tud_control_xfer(rhport, p_request, desc_device, sizeof(tusb_desc_device_t));
       }
     }
diff --git a/src/device/usbd_pvt.h b/src/device/usbd_pvt.h
index 5f11ea481..be778f9af 100644
--- a/src/device/usbd_pvt.h
+++ b/src/device/usbd_pvt.h
@@ -130,10 +130,6 @@ void usbd_sof_enable(uint8_t rhport, sof_consumer_t consumer, bool en);
 bool usbd_open_edpt_pair(uint8_t rhport, uint8_t const* p_desc, uint8_t ep_count, uint8_t xfer_type, uint8_t* ep_out, uint8_t* ep_in);
 void usbd_defer_func(osal_task_func_t func, void *param, bool in_isr);
 
-#if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
-void usbd_driver_print_control_complete_name(usbd_control_xfer_cb_t callback);
-#endif
-
 #ifdef __cplusplus
  }
 #endif
-- 
cgit v1.3.1


From 77258a35ef2dcddef4f62bc51d31b9beef3b46d2 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 4 May 2026 19:42:28 +0700
Subject: add default implementation for tuh_hid_report_received_cb()

---
 src/class/hid/hid_host.c | 33 ++++++++++-----------------------
 src/class/hid/hid_host.h |  2 +-
 2 files changed, 11 insertions(+), 24 deletions(-)

(limited to 'src')

diff --git a/src/class/hid/hid_host.c b/src/class/hid/hid_host.c
index 7935b84d3..fc7704258 100644
--- a/src/class/hid/hid_host.c
+++ b/src/class/hid/hid_host.c
@@ -74,44 +74,31 @@ static uint8_t _hidh_default_protocol = HID_PROTOCOL_BOOT;
 // Weak stubs: invoked if no strong implementation is available
 //--------------------------------------------------------------------+
 TU_ATTR_WEAK void tuh_hid_mount_cb(uint8_t dev_addr, uint8_t idx, uint8_t const* report_desc, uint16_t desc_len) {
-  (void) dev_addr;
-  (void) idx;
-  (void) report_desc;
-  (void) desc_len;
+  (void) dev_addr; (void) idx; (void) report_desc; (void) desc_len;
 }
 
 TU_ATTR_WEAK void tuh_hid_umount_cb(uint8_t dev_addr, uint8_t idx) {
-  (void) dev_addr;
-  (void) idx;
+  (void) dev_addr; (void) idx;
+}
+
+TU_ATTR_WEAK void tuh_hid_report_received_cb(uint8_t dev_addr, uint8_t idx, const uint8_t *report, uint16_t len) {
+  (void) dev_addr; (void) idx; (void) report; (void) len;
 }
 
 TU_ATTR_WEAK void tuh_hid_report_sent_cb(uint8_t dev_addr, uint8_t idx, uint8_t const* report, uint16_t len) {
-  (void) dev_addr;
-  (void) idx;
-  (void) report;
-  (void) len;
+  (void) dev_addr; (void) idx; (void) report; (void) len;
 }
 
 TU_ATTR_WEAK void tuh_hid_get_report_complete_cb(uint8_t dev_addr, uint8_t idx, uint8_t report_id, uint8_t report_type, uint16_t len) {
-  (void) dev_addr;
-  (void) idx;
-  (void) report_id;
-  (void) report_type;
-  (void) len;
+  (void) dev_addr; (void) idx; (void) report_id; (void) report_type; (void) len;
 }
 
 TU_ATTR_WEAK void tuh_hid_set_report_complete_cb(uint8_t dev_addr, uint8_t idx, uint8_t report_id, uint8_t report_type, uint16_t len) {
-  (void) dev_addr;
-  (void) idx;
-  (void) report_id;
-  (void) report_type;
-  (void) len;
+  (void) dev_addr; (void) idx; (void) report_id; (void) report_type; (void) len;
 }
 
 TU_ATTR_WEAK void tuh_hid_set_protocol_complete_cb(uint8_t dev_addr, uint8_t idx, uint8_t protocol) {
-  (void) dev_addr;
-  (void) idx;
-  (void) protocol;
+  (void) dev_addr; (void) idx; (void) protocol;
 }
 
 //--------------------------------------------------------------------+
diff --git a/src/class/hid/hid_host.h b/src/class/hid/hid_host.h
index 922848fc2..95ba859ad 100644
--- a/src/class/hid/hid_host.h
+++ b/src/class/hid/hid_host.h
@@ -140,7 +140,7 @@ bool tuh_hid_send_ready(uint8_t dev_addr, uint8_t idx);
 bool tuh_hid_send_report(uint8_t dev_addr, uint8_t idx, uint8_t report_id, const void *report, uint16_t len);
 
 //--------------------------------------------------------------------+
-// Callbacks (Weak is optional)
+// Callbacks (optional)
 //--------------------------------------------------------------------+
 
 // Invoked when device with hid interface is mounted
-- 
cgit v1.3.1


From 17d24b397f772fb475b2be6c387c3023664df0a6 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Mon, 4 May 2026 20:10:58 +0200
Subject: hcd/dwc2: fix txfifo full check

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/synopsys/dwc2/hcd_dwc2.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/hcd_dwc2.c b/src/portable/synopsys/dwc2/hcd_dwc2.c
index 6098d6eaa..9ea5f33c5 100644
--- a/src/portable/synopsys/dwc2/hcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/hcd_dwc2.c
@@ -903,9 +903,6 @@ static void handle_rxflvl_irq(uint8_t rhport) {
 
 // return true if there is still pending data and need more ISR
 static bool handle_txfifo_empty(dwc2_regs_t* dwc2, bool is_periodic) {
-  // Use period txsts for both p/np to get request queue space available (1-bit difference, it is small enough)
-  const dwc2_hptxsts_t txsts = {.value = (is_periodic ? dwc2->hptxsts : dwc2->hnptxsts)};
-
   const uint8_t max_channel = dwc2_channel_count(dwc2);
   for (uint8_t ch_id = 0; ch_id < max_channel; ch_id++) {
     dwc2_channel_t* channel = &dwc2->channel[ch_id];
@@ -923,6 +920,8 @@ static bool handle_txfifo_empty(dwc2_regs_t* dwc2, bool is_periodic) {
 
         // skip if there is not enough space in FIFO and RequestQueue.
         // Packet's last word written to FIFO will trigger a request queue
+        // Use period txsts for both p/np to get request queue space available (1-bit difference, it is small enough)
+        const dwc2_hptxsts_t txsts = {.value = (is_periodic ? dwc2->hptxsts : dwc2->hnptxsts)};
         if ((xact_bytes > (txsts.fifo_available << 2)) || (txsts.req_queue_available == 0)) {
           return true;
         }
-- 
cgit v1.3.1


From e557f94c721871246ee7ac0761d74e5f8794300f Mon Sep 17 00:00:00 2001
From: Zixun LI <admin@hifiphile.com>
Date: Thu, 7 May 2026 11:17:57 +0200
Subject: revert RX buffer size as it's not related to issue

Even if CFG_TUH_MIDI_RX_BUFSIZE=100*TUH_EPSIZE_BULK_MAX, calling tuh_midi_stream_read without a loop  can return only one 4-byte packet and preventing subsequent transfer.

Signed-off-by: Zixun LI <admin@hifiphile.com>
---
 src/class/midi/midi_host.h | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi_host.h b/src/class/midi/midi_host.h
index 000d815c4..8fdfd8966 100644
--- a/src/class/midi/midi_host.h
+++ b/src/class/midi/midi_host.h
@@ -38,12 +38,7 @@ extern "C" {
 // Class Driver Configuration
 //--------------------------------------------------------------------+
 #ifndef CFG_TUH_MIDI_RX_BUFSIZE
-  // Default sized to 2x the bulk endpoint to absorb residue left in the FIFO
-  // when tuh_midi_stream_read() stops early on a cable-number transition.
-  // Sizing this equal to the endpoint packet size (the historical default)
-  // can cause the next bulk IN transfer to fail to queue silently, wedging
-  // the stream. See the drain-loop note on tuh_midi_stream_read() below.
-  #define CFG_TUH_MIDI_RX_BUFSIZE (2 * TUH_EPSIZE_BULK_MAX)
+  #define CFG_TUH_MIDI_RX_BUFSIZE TUH_EPSIZE_BULK_MAX
 #endif
 
 #ifndef CFG_TUH_MIDI_TX_BUFSIZE
-- 
cgit v1.3.1


From 2471cbc28618971974fcbbb019a37cf5892253e2 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 8 May 2026 13:53:09 +0200
Subject: fixup

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/class/net/ncm_device.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 336d8ad3e..a78e472c2 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -1028,7 +1028,9 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
             return true;
           }
 
-          TU_VERIFY(ncm_interface.bm_capabilities & NCM_NETWORK_CAPS_ETH_FILTER, false);
+          // Some hosts issue this request even if ETH_FILTER is not advertised,
+          // see https://bugzilla.kernel.org/show_bug.cgi?id=217290
+
           tud_network_set_packet_filter_cb(request->wValue);
           tud_control_xfer(rhport, request, NULL, 0);
         } break;
@@ -1060,7 +1062,7 @@ bool netd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t
 
             tu_memclr(&ncm_interface.ntb_input_size, sizeof(ncm_interface.ntb_input_size));
             tud_control_xfer(rhport, request, &ncm_interface.ntb_input_size, request->wLength);
-          } else if (stage == CONTROL_STAGE_ACK) {
+          } else if (stage == CONTROL_STAGE_DATA) {
             /* CDC-NCM 1.0 Table 6-4, up to NTB16 size */
             const uint32_t requested_size = ncm_interface.ntb_input_size.dwNtbInMaxSize;
             if (requested_size < 2048u || requested_size > 65535u) {
-- 
cgit v1.3.1


From 6af4ee2c50da68a9bca276b69fccbacf96e2b3ce Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Fri, 8 May 2026 21:27:53 +0700
Subject: nrf5x: request HFCLK in USB_EVT_READY to fix post-SoftDevice deadlock

USB_EVT_DETECTED runs hfclk_enable() which, when SoftDevice is not yet
enabled, starts HFXO via direct CLOCK register access. After
sd_softdevice_enable() takes over CLOCK, HFXO is physically off again
and SD's HFCLK reference count is 0.

If USB_EVT_READY is fired post-SD (e.g. on nRF52 via Bluefruit's
usb_softdevice_post_enable() when the pre-SD nrfx_power READY callback
didn't get to run before nrfx_power was uninited), the wait loop
'while (!hfclk_running()) {}' calls sd_clock_hfclk_is_running() which
returns false forever -> deadlock that blocks both USB enumeration and
any further app code on the calling thread.

Call hfclk_enable() right before the wait so HFCLK is requested in
whichever context (SD or direct) is current. hfclk_enable() is
idempotent.

Reproduces reliably with bleuart on Feather nRF52840 Express flashed
via JLink: chip wedges in sd_clock_hfclk_is_running SVC, no USB
enumeration, no BLE advertising. With the fix, USB enumerates and BLE
advertises as expected.
---
 src/portable/nordic/nrf5x/dcd_nrf5x.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'src')

diff --git a/src/portable/nordic/nrf5x/dcd_nrf5x.c b/src/portable/nordic/nrf5x/dcd_nrf5x.c
index 6ed5fde8e..befbaa338 100644
--- a/src/portable/nordic/nrf5x/dcd_nrf5x.c
+++ b/src/portable/nordic/nrf5x/dcd_nrf5x.c
@@ -1049,6 +1049,12 @@ void tusb_hal_nrf_power_event(uint32_t event) {
         NVIC_EnableIRQ(USBD_IRQn);
       }
 
+      // Ensure HFCLK is requested in the current context. The hfclk_enable() in
+      // USB_EVT_DETECTED may have been pre-SoftDevice. After Softdevice is
+      // enabled, HFXO is physically off again. So any caller that fires
+      // USB_EVT_READY post-SD would hang here.
+      hfclk_enable();
+
       // Wait for HFCLK
       while (!hfclk_running()) {}
 
-- 
cgit v1.3.1


From cfdab2564fa5735f0a7d5653aa6eb5388456028e Mon Sep 17 00:00:00 2001
From: Alex-Schaefer <81265029+Alex-Schaefer@users.noreply.github.com>
Date: Sat, 9 May 2026 09:10:47 +0200
Subject: dwc2: preserve EP0 status completion before SETUP

On STM32 DWC2, SETUP phase done and EP0 OUT transfer complete can be
reported together. Processing SETUP first can overwrite control state
before the previous zero-length OUT status stage is acknowledged, which
causes DFU DNLOAD/GETSTATUS traffic to lose the status ACK and stall.

Queue the EP0 OUT zero-length transfer completion before queuing the
SETUP event when the endpoint has no pending OUT data and total_len is
zero. This keeps TinyUSB control-transfer ordering intact for the
combined interrupt case.
---
 src/portable/synopsys/dwc2/dcd_dwc2.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 30e24a9ad..9b8f44df8 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -946,7 +946,17 @@ static void handle_rxflvl_irq(uint8_t rhport) {
 }
 
 static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepint_bm) {
+  xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
+  const bool ep0_status_complete_before_setup = (epnum == 0) && doepint_bm.setup_phase_done &&
+                                                doepint_bm.xfer_complete &&
+                                                (_dcd_data.ep0_pending[TUSB_DIR_OUT] == 0) &&
+                                                (xfer->total_len == 0);
+
   if (doepint_bm.setup_phase_done) {
+    if (ep0_status_complete_before_setup) {
+      dcd_event_xfer_complete(rhport, epnum, 0, XFER_RESULT_SUCCESS, true);
+    }
+
     // Cleanup previous pending EP0 IN transfer if any
     dwc2_dep_t* epin0 = &DWC2_REG(rhport)->epin[0];
     if (edpt_is_enabled(epin0)) {
@@ -962,7 +972,6 @@ static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doe
     // Note: even though (xfer_complete + status_phase_rx) is for buffered DMA only, for STM32L47x (dwc2 v3.00a) they
     // can is set when GRXSTS_PKTSTS_SETUP_RX is popped therefore they can bet set before/together with setup_phase_done
     if (!doepint_bm.status_phase_rx && !doepint_bm.setup_packet_rx) {
-      xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
       if ((epnum == 0) && _dcd_data.ep0_pending[TUSB_DIR_OUT]) {
         // EP0 can only handle one packet, Schedule another packet to be received.
         edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
@@ -1005,8 +1014,17 @@ static void handle_epin_slave(uint8_t rhport, uint8_t epnum, dwc2_diepint_t diep
 #if CFG_TUD_DWC2_DMA_ENABLE
 static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepint_bm) {
   dwc2_regs_t* dwc2 = DWC2_REG(rhport);
+  xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
+  const bool ep0_status_complete_before_setup = (epnum == 0) && doepint_bm.setup_phase_done &&
+                                                doepint_bm.xfer_complete &&
+                                                (_dcd_data.ep0_pending[TUSB_DIR_OUT] == 0) &&
+                                                (xfer->total_len == 0);
 
   if (doepint_bm.setup_phase_done) {
+    if (ep0_status_complete_before_setup) {
+      dcd_event_xfer_complete(rhport, epnum, 0, XFER_RESULT_SUCCESS, true);
+    }
+
     // Cleanup previous pending EP0 IN transfer if any
     dwc2_dep_t* epin0 = &DWC2_REG(rhport)->epin[0];
     if (edpt_is_enabled(epin0)) {
@@ -1028,7 +1046,6 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
         edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
       } else {
         dwc2_dep_t* epout = &dwc2->epout[epnum];
-        xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
 
         // determine actual received bytes
         const dwc2_ep_tsize_t tsiz = {.value = epout->tsiz};
-- 
cgit v1.3.1


From 16bc0548dc0793404a5885aa90d78100b604c227 Mon Sep 17 00:00:00 2001
From: Alex-Schaefer <81265029+Alex-Schaefer@users.noreply.github.com>
Date: Sat, 9 May 2026 11:14:00 +0200
Subject: dwc2: guard EP0 status completion with armed ZLP state

Track when an EP0 OUT zero-length transfer is actually armed and require that state before synthesizing a status-stage completion ahead of a co-reported SETUP event.

This preserves the validated status-before-SETUP ordering fix while avoiding stale zero-length state from producing spurious EP0 OUT completions.
---
 src/portable/synopsys/dwc2/dcd_dwc2.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 9b8f44df8..72beb1b80 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -62,6 +62,7 @@ static xfer_ctl_t xfer_status[DWC2_EP_MAX][2];
 typedef struct {
   // EP0 transfers are limited to 1 packet - larger sizes has to be split
   uint16_t ep0_pending[2];  // Index determines direction as tusb_dir_t type
+  bool ep0_out_zlp_armed;   // EP0 OUT ZLP transfer is armed and waiting for completion
   uint16_t dfifo_top;      // top free location in DFIFO in words
 
   // Number of IN endpoints active
@@ -665,6 +666,9 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t* buffer, uint16_t to
     // EP0 can only handle one packet
     if (epnum == 0) {
       _dcd_data.ep0_pending[dir] = total_bytes;
+      if (dir == TUSB_DIR_OUT) {
+        _dcd_data.ep0_out_zlp_armed = (total_bytes == 0);
+      }
     }
 
     // Schedule packets to be sent within interrupt
@@ -744,6 +748,9 @@ static void handle_bus_reset(uint8_t rhport) {
 
   tu_memclr(xfer_status, sizeof(xfer_status));
 
+  _dcd_data.ep0_pending[TUSB_DIR_OUT] = 0;
+  _dcd_data.ep0_pending[TUSB_DIR_IN] = 0;
+  _dcd_data.ep0_out_zlp_armed = false;
   _dcd_data.sof_en = false;
   _dcd_data.allocated_epin_count = 0;
 
@@ -949,12 +956,16 @@ static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doe
   xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
   const bool ep0_status_complete_before_setup = (epnum == 0) && doepint_bm.setup_phase_done &&
                                                 doepint_bm.xfer_complete &&
+                                                _dcd_data.ep0_out_zlp_armed &&
                                                 (_dcd_data.ep0_pending[TUSB_DIR_OUT] == 0) &&
                                                 (xfer->total_len == 0);
 
   if (doepint_bm.setup_phase_done) {
     if (ep0_status_complete_before_setup) {
+      _dcd_data.ep0_out_zlp_armed = false;
       dcd_event_xfer_complete(rhport, epnum, 0, XFER_RESULT_SUCCESS, true);
+    } else if (epnum == 0) {
+      _dcd_data.ep0_out_zlp_armed = false;
     }
 
     // Cleanup previous pending EP0 IN transfer if any
@@ -976,6 +987,9 @@ static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doe
         // EP0 can only handle one packet, Schedule another packet to be received.
         edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
       } else {
+        if (epnum == 0) {
+          _dcd_data.ep0_out_zlp_armed = false;
+        }
         dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
       }
     }
@@ -1017,12 +1031,16 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
   xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
   const bool ep0_status_complete_before_setup = (epnum == 0) && doepint_bm.setup_phase_done &&
                                                 doepint_bm.xfer_complete &&
+                                                _dcd_data.ep0_out_zlp_armed &&
                                                 (_dcd_data.ep0_pending[TUSB_DIR_OUT] == 0) &&
                                                 (xfer->total_len == 0);
 
   if (doepint_bm.setup_phase_done) {
     if (ep0_status_complete_before_setup) {
+      _dcd_data.ep0_out_zlp_armed = false;
       dcd_event_xfer_complete(rhport, epnum, 0, XFER_RESULT_SUCCESS, true);
+    } else if (epnum == 0) {
+      _dcd_data.ep0_out_zlp_armed = false;
     }
 
     // Cleanup previous pending EP0 IN transfer if any
@@ -1058,6 +1076,9 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
           dma_setup_prepare(rhport);
         }
 
+        if (epnum == 0) {
+          _dcd_data.ep0_out_zlp_armed = false;
+        }
         dcd_dcache_invalidate(xfer->buffer, xfer->total_len);
         dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
       }
-- 
cgit v1.3.1


From bc8ce76ae800b312b4d3ef591cc42e8726e68d7f Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Tue, 24 Mar 2026 23:37:48 -0300
Subject: feat: add MIDI 2.0 Device class driver (USB-MIDI 2.0)

Add native USB-MIDI 2.0 Device class driver to TinyUSB. Implements the
USB-MIDI 2.0 specification with both Alt Setting 0 (MIDI 1.0 fallback)
and Alt Setting 1 (UMP native) descriptor support.

Driver features:
- UMP (Universal MIDI Packet) read/write with atomic message framing
- Protocol negotiation: Endpoint Discovery, Config Request/Notify,
  Function Block Discovery (embedded in driver)
- Group Terminal Block descriptor via GET_DESCRIPTOR
- Alt Setting switch handler with endpoint re-arm
- Static allocation, no dynamic memory, ISR-safe

Build system:
- Register midi2d_* in usbd.c driver table
- Add TUD_MIDI2_DESCRIPTOR macros to usbd.h
- Add config defaults (CFG_TUD_MIDI2_*) to tusb_option.h
- Add midi2_ump_word_count() to midi.h (shared by Device and Host)
- Add midi2_device.c/h to family.cmake and CMakeLists.txt
- Add midi2_device.h include to tusb.h

All changes guarded by #if CFG_TUD_MIDI2 (default 0). Zero impact on
existing drivers and examples.

Tested: Raspberry Pi Pico (RP2040), Linux ALSA, Windows MIDI Services
---
 hw/bsp/rp2040/family.cmake    |   2 +
 src/CMakeLists.txt            |   2 +
 src/class/midi/midi.h         |  18 ++
 src/class/midi/midi2_device.c | 604 ++++++++++++++++++++++++++++++++++++++++++
 src/class/midi/midi2_device.h | 125 +++++++++
 src/device/usbd.c             |  14 +
 src/device/usbd.h             |  37 +++
 src/tusb.h                    |   8 +
 src/tusb_option.h             |  52 ++++
 9 files changed, 862 insertions(+)
 create mode 100644 src/class/midi/midi2_device.c
 create mode 100644 src/class/midi/midi2_device.h

(limited to 'src')

diff --git a/hw/bsp/rp2040/family.cmake b/hw/bsp/rp2040/family.cmake
index 075582554..aab9a4fae 100644
--- a/hw/bsp/rp2040/family.cmake
+++ b/hw/bsp/rp2040/family.cmake
@@ -99,6 +99,7 @@ target_sources(tinyusb_device_base INTERFACE
 		${TOP}/src/class/dfu/dfu_rt_device.c
 		${TOP}/src/class/hid/hid_device.c
 		${TOP}/src/class/midi/midi_device.c
+		${TOP}/src/class/midi/midi2_device.c
 		${TOP}/src/class/msc/msc_device.c
 		${TOP}/src/class/mtp/mtp_device.c
 		${TOP}/src/class/net/ecm_rndis_device.c
@@ -121,6 +122,7 @@ target_sources(tinyusb_host_base INTERFACE
 		${TOP}/src/class/cdc/cdc_host.c
 		${TOP}/src/class/hid/hid_host.c
 		${TOP}/src/class/midi/midi_host.c
+		${TOP}/src/class/midi/midi2_host.c
 		${TOP}/src/class/msc/msc_host.c
 		${TOP}/src/class/vendor/vendor_host.c
 		)
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index c7a5184c5..b3e05f60f 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -14,6 +14,7 @@ function(tinyusb_sources_get OUTPUT_VAR)
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/dfu/dfu_rt_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/hid/hid_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi_device.c
+    ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi2_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/msc/msc_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/mtp/mtp_device.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/net/ecm_rndis_device.c
@@ -28,6 +29,7 @@ function(tinyusb_sources_get OUTPUT_VAR)
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/cdc/cdc_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/hid/hid_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi_host.c
+    ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi2_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/msc/msc_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/vendor/vendor_host.c
     # typec
diff --git a/src/class/midi/midi.h b/src/class/midi/midi.h
index cd67640e4..8121ec016 100644
--- a/src/class/midi/midi.h
+++ b/src/class/midi/midi.h
@@ -185,6 +185,24 @@ typedef midi_desc_cs_endpoint_n_t(1) midi_desc_cs_endpoint_1jack_t;
 
 TU_VERIFY_STATIC(sizeof(midi_desc_cs_endpoint_1jack_t) == 4+1, "size is not correct");
 
+//--------------------------------------------------------------------+
+// MIDI 2.0 UMP Helpers
+//--------------------------------------------------------------------+
+
+// Return the number of 32-bit words for a UMP message given its Message Type
+static inline uint8_t midi2_ump_word_count(uint8_t mt) {
+  switch (mt) {
+    case 0x0: case 0x1: case 0x2: case 0x6: case 0x7:
+      return 1;
+    case 0x3: case 0x4: case 0x8: case 0x9: case 0xA:
+      return 2;
+    case 0xB: case 0xC:
+      return 3;
+    default: // 0x5, 0xD, 0xE, 0xF
+      return 4;
+  }
+}
+
 //--------------------------------------------------------------------+
 // For Internal Driver Use
 //--------------------------------------------------------------------+
diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
new file mode 100644
index 000000000..9363aac11
--- /dev/null
+++ b/src/class/midi/midi2_device.c
@@ -0,0 +1,604 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2026 Saulo Verissimo
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * This file is part of the TinyUSB stack.
+ */
+
+#include "tusb_option.h"
+
+#if CFG_TUD_ENABLED && CFG_TUD_MIDI2
+
+#include <string.h>
+
+#include "device/usbd.h"
+#include "device/usbd_pvt.h"
+#include "midi2_device.h"
+
+//--------------------------------------------------------------------+
+// Weak stubs
+//--------------------------------------------------------------------+
+TU_ATTR_WEAK void tud_midi2_rx_cb(uint8_t itf) { (void) itf; }
+TU_ATTR_WEAK void tud_midi2_set_itf_cb(uint8_t itf, uint8_t alt) { (void) itf; (void) alt; }
+TU_ATTR_WEAK bool tud_midi2_get_req_itf_cb(uint8_t rhport, const tusb_control_request_t* request) {
+  (void) rhport; (void) request; return false;
+}
+
+//--------------------------------------------------------------------+
+// UMP Stream Message Constants
+//--------------------------------------------------------------------+
+// UMP Message Type for Stream messages (bits 31:28)
+enum {
+  MT_STREAM                 = 0x0F,
+};
+
+// UMP Stream Status values (10-bit, bits 25:16)
+enum {
+  STREAM_ENDPOINT_DISCOVERY = 0x000,
+  STREAM_ENDPOINT_INFO      = 0x001,
+  STREAM_EP_NAME            = 0x003,
+  STREAM_PROD_INSTANCE_ID   = 0x004,
+  STREAM_CONFIG_REQUEST     = 0x005,
+  STREAM_CONFIG_NOTIFY      = 0x006,
+  STREAM_FB_DISCOVERY       = 0x010,
+  STREAM_FB_INFO            = 0x011,
+};
+
+// MIDI Protocol values (per USB-MIDI 2.0 spec)
+enum {
+  MIDI_PROTOCOL_MIDI1       = 0x01,
+  MIDI_PROTOCOL_MIDI2       = 0x02,
+};
+
+enum {
+  UMP_VER_MAJOR = 1,
+  UMP_VER_MINOR = 1,
+};
+
+// Group Terminal Block descriptor types (USB-MIDI 2.0)
+enum {
+  MIDI2_CS_GRP_TRM_BLOCK      = 0x26,
+  MIDI2_GRP_TRM_BLOCK_HEADER  = 0x01,
+  MIDI2_GRP_TRM_BLOCK_ENTRY   = 0x02,
+};
+
+//--------------------------------------------------------------------+
+// MACRO CONSTANT TYPEDEF
+//--------------------------------------------------------------------+
+typedef struct {
+  uint8_t rhport;
+  uint8_t itf_num;
+  uint8_t alt_setting;
+  uint8_t protocol;
+  bool    negotiated;
+
+  /*------------- From this point, data is not cleared by bus reset -------------*/
+  struct {
+    tu_edpt_stream_t tx;
+    tu_edpt_stream_t rx;
+
+    uint8_t rx_ff_buf[CFG_TUD_MIDI2_RX_BUFSIZE];
+    uint8_t tx_ff_buf[CFG_TUD_MIDI2_TX_BUFSIZE];
+  } ep_stream;
+} midi2d_interface_t;
+
+TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_GROUPS >= 1 && CFG_TUD_MIDI2_NUM_GROUPS <= 16,
+                 "CFG_TUD_MIDI2_NUM_GROUPS must be 1..16");
+TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS >= 1 && CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS <= 32,
+                 "CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS must be 1..32");
+
+#define ITF_MEM_RESET_SIZE offsetof(midi2d_interface_t, ep_stream)
+
+static midi2d_interface_t _midi2d_itf[CFG_TUD_MIDI2];
+
+#if CFG_TUD_EDPT_DEDICATED_HWFIFO == 0
+typedef struct {
+  TUD_EPBUF_DEF(epin, CFG_TUD_MIDI2_TX_EPSIZE);
+  TUD_EPBUF_DEF(epout, CFG_TUD_MIDI2_RX_EPSIZE);
+} midi2d_epbuf_t;
+
+CFG_TUD_MEM_SECTION static midi2d_epbuf_t _midi2d_epbuf[CFG_TUD_MIDI2];
+#endif
+
+// Default Group Terminal Block descriptor (USB-MIDI 2.0 spec, Table 5-5/5-6)
+static const uint8_t _default_gtb_desc[] = {
+  // GTB Header (5 bytes)
+  5,                                        // bLength
+  MIDI2_CS_GRP_TRM_BLOCK,                   // bDescriptorType
+  MIDI2_GRP_TRM_BLOCK_HEADER,               // bDescriptorSubtype
+  U16_TO_U8S_LE(18),                        // wTotalLength (5 + 13 = 18)
+
+  // GTB Entry (13 bytes)
+  13,                                       // bLength
+  MIDI2_CS_GRP_TRM_BLOCK,                   // bDescriptorType
+  MIDI2_GRP_TRM_BLOCK_ENTRY,                // bDescriptorSubtype
+  1,                                        // bGrpTrmBlkID
+  0x00,                                     // bGrpTrmBlkType: bidirectional
+  0x00,                                     // nGroupTrm: first group (0)
+  CFG_TUD_MIDI2_NUM_GROUPS,                 // nNumGroupTrm
+  0,                                        // iBlockItem: no string
+  0x00,                                     // bMIDIProtocol: unknown/not fixed
+  0, 0,                                     // wMaxInputBandwidth: unknown
+  0, 0                                      // wMaxOutputBandwidth: unknown
+};
+
+//--------------------------------------------------------------------+
+// Protocol Negotiation
+//--------------------------------------------------------------------+
+static void _nego_send_ump(midi2d_interface_t* p_midi, const uint32_t* words, uint8_t count) {
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  if (!tu_edpt_stream_is_opened(ep_tx)) return;
+  if (tu_edpt_stream_write_available(ep_tx) < count * 4) return;
+  tu_edpt_stream_write(ep_tx, words, count * 4);
+  tu_edpt_stream_write_xfer(ep_tx);
+}
+
+static void _nego_send_endpoint_info(midi2d_interface_t* p_midi) {
+  uint32_t msg[4] = {0};
+  msg[0] = ((uint32_t) MT_STREAM << 28)
+         | ((uint32_t) STREAM_ENDPOINT_INFO << 16)
+         | ((uint32_t) UMP_VER_MAJOR << 8)
+         | (uint32_t) UMP_VER_MINOR;
+  msg[1] = (1u << 31)  // Static Function Blocks flag
+         | ((uint32_t)(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS & 0x7F) << 24)
+         | (1u << 9)   // MIDI 2.0 Protocol capability
+         | (1u << 8);  // MIDI 1.0 Protocol capability
+  _nego_send_ump(p_midi, msg, 4);
+}
+
+static void _nego_send_stream_text(midi2d_interface_t* p_midi, uint16_t status, const char* str) {
+  if (!str || str[0] == '\0') return;
+
+  uint16_t total_len = (uint16_t) strlen(str);
+  uint16_t offset = 0;
+
+  while (offset < total_len) {
+    uint16_t remaining = total_len - offset;
+    uint8_t n = (uint8_t)((remaining > 14) ? 14 : remaining);
+    bool is_first = (offset == 0);
+    bool is_last  = (remaining <= 14);
+
+    uint8_t form;
+    if (is_first && is_last) form = 0;
+    else if (is_first)       form = 1;
+    else if (is_last)        form = 3;
+    else                     form = 2;
+
+    uint32_t msg[4] = {0};
+    msg[0] = ((uint32_t) MT_STREAM << 28)
+           | ((uint32_t) form << 26)
+           | ((uint32_t) status << 16);
+
+    const char* p = str + offset;
+    if (n > 0) msg[0] |= ((uint32_t)(uint8_t) p[0] << 8);
+    if (n > 1) msg[0] |= (uint32_t)(uint8_t) p[1];
+    for (uint8_t i = 2; i < n; i++) {
+      uint8_t word_idx = (uint8_t)(1 + (i - 2) / 4);
+      uint8_t shift    = (uint8_t)(24 - ((i - 2) % 4) * 8);
+      msg[word_idx] |= ((uint32_t)(uint8_t) p[i] << shift);
+    }
+
+    _nego_send_ump(p_midi, msg, 4);
+    offset += n;
+  }
+}
+
+static void _nego_send_config_notify(midi2d_interface_t* p_midi, uint8_t protocol) {
+  uint32_t msg[4] = {0};
+  msg[0] = ((uint32_t) MT_STREAM << 28)
+         | ((uint32_t) STREAM_CONFIG_NOTIFY << 16)
+         | ((uint32_t) protocol << 8);
+  _nego_send_ump(p_midi, msg, 4);
+}
+
+static void _nego_send_fb_info(midi2d_interface_t* p_midi, uint8_t fb_idx) {
+  uint32_t msg[4] = {0};
+  msg[0] = ((uint32_t) MT_STREAM << 28)
+         | ((uint32_t) STREAM_FB_INFO << 16)
+         | (1u << 15)
+         | ((uint32_t) fb_idx << 8)
+         | 0x02;  // bDirection: bidirectional
+  msg[1] = ((uint32_t) 0 << 24)  // bFirstGroup
+         | ((uint32_t) CFG_TUD_MIDI2_NUM_GROUPS << 16);
+  _nego_send_ump(p_midi, msg, 4);
+}
+
+static void _nego_handle_stream_msg(midi2d_interface_t* p_midi, const uint32_t* words) {
+  uint16_t status = (words[0] >> 16) & 0x3FF;
+
+  switch (status) {
+    case STREAM_ENDPOINT_DISCOVERY:
+      _nego_send_endpoint_info(p_midi);
+      _nego_send_stream_text(p_midi, STREAM_EP_NAME, CFG_TUD_MIDI2_EP_NAME);
+      _nego_send_stream_text(p_midi, STREAM_PROD_INSTANCE_ID, CFG_TUD_MIDI2_PRODUCT_ID);
+      break;
+
+    case STREAM_CONFIG_REQUEST: {
+      uint8_t req_proto = (words[0] >> 8) & 0xFF;
+      if (req_proto == MIDI_PROTOCOL_MIDI1 || req_proto == MIDI_PROTOCOL_MIDI2) {
+        p_midi->protocol = req_proto;
+      }
+      _nego_send_config_notify(p_midi, p_midi->protocol);
+      p_midi->negotiated = true;
+      break;
+    }
+
+    case STREAM_FB_DISCOVERY: {
+      uint8_t fb_idx = (words[0] >> 8) & 0xFF;
+      if (fb_idx == 0xFF) {
+        for (uint8_t f = 0; f < CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS; f++) {
+          _nego_send_fb_info(p_midi, f);
+        }
+      } else if (fb_idx < CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS) {
+        _nego_send_fb_info(p_midi, fb_idx);
+      }
+      break;
+    }
+
+    default:
+      break;
+  }
+}
+
+static void _nego_process_rx(midi2d_interface_t* p_midi) {
+  tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
+  uint8_t first_byte;
+
+  while (tu_edpt_stream_peek(ep_rx, &first_byte)) {
+    uint8_t mt = (first_byte >> 4) & 0x0F;
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+    uint32_t pkt_bytes = (uint32_t)pkt_words * 4;
+
+    if (mt != MT_STREAM) break;
+    if (tu_edpt_stream_read_available(ep_rx) < pkt_bytes) break;
+
+    uint32_t buf[4] = {0};
+    tu_edpt_stream_read(ep_rx, buf, pkt_bytes);
+    _nego_handle_stream_msg(p_midi, buf);
+  }
+}
+
+//--------------------------------------------------------------------+
+// READ API
+//--------------------------------------------------------------------+
+bool tud_midi2_n_mounted(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  return tu_edpt_stream_is_opened(&p_midi->ep_stream.tx) &&
+         tu_edpt_stream_is_opened(&p_midi->ep_stream.rx);
+}
+
+uint32_t tud_midi2_n_available(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  return tu_edpt_stream_read_available(&p_midi->ep_stream.rx) / 4;
+}
+
+uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2 && words != NULL && max_words > 0, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
+
+  uint32_t total_read = 0;
+  while (total_read < max_words) {
+    uint8_t first_byte;
+    if (!tu_edpt_stream_peek(ep_rx, &first_byte)) break;
+
+    uint8_t mt = (first_byte >> 4) & 0x0F;
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+
+    if (total_read + pkt_words > max_words) break;
+    if (tu_edpt_stream_read_available(ep_rx) < (uint32_t)pkt_words * 4) break;
+
+    tu_edpt_stream_read(ep_rx, &words[total_read], pkt_words * 4);
+    total_read += pkt_words;
+  }
+
+  return total_read;
+}
+
+bool tud_midi2_n_packet_read(uint8_t itf, uint8_t packet[4]) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  return 4 == tu_edpt_stream_read(&p_midi->ep_stream.rx, packet, 4);
+}
+
+//--------------------------------------------------------------------+
+// WRITE API
+//--------------------------------------------------------------------+
+uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t count) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2 && words != NULL && count > 0, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  TU_VERIFY(tu_edpt_stream_is_opened(ep_tx), 0);
+
+  uint32_t written = 0;
+  while (written < count) {
+    uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F);
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+
+    if (written + pkt_words > count) break;
+    if (tu_edpt_stream_write_available(ep_tx) < pkt_words * 4) break;
+
+    tu_edpt_stream_write(ep_tx, &words[written], pkt_words * 4);
+    written += pkt_words;
+  }
+
+  (void) tu_edpt_stream_write_xfer(ep_tx);
+  return written;
+}
+
+bool tud_midi2_n_packet_write(uint8_t itf, const uint8_t packet[4]) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  TU_VERIFY(tu_edpt_stream_is_opened(ep_tx), false);
+  TU_VERIFY(tu_edpt_stream_write_available(ep_tx) >= 4, false);
+  TU_VERIFY(tu_edpt_stream_write(ep_tx, packet, 4) > 0, false);
+  (void) tu_edpt_stream_write_xfer(ep_tx);
+  return true;
+}
+
+//--------------------------------------------------------------------+
+// STATE GETTERS
+//--------------------------------------------------------------------+
+uint8_t tud_midi2_n_alt_setting(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, 0);
+  return _midi2d_itf[itf].alt_setting;
+}
+
+bool tud_midi2_n_negotiated(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+  return _midi2d_itf[itf].negotiated;
+}
+
+uint8_t tud_midi2_n_protocol(uint8_t itf) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2, 0);
+  return _midi2d_itf[itf].protocol;
+}
+
+//--------------------------------------------------------------------+
+// USBD Driver API
+//--------------------------------------------------------------------+
+void midi2d_init(void) {
+  tu_memclr(_midi2d_itf, sizeof(_midi2d_itf));
+  for (uint8_t i = 0; i < CFG_TUD_MIDI2; i++) {
+    midi2d_interface_t* p_midi = &_midi2d_itf[i];
+    p_midi->protocol = MIDI_PROTOCOL_MIDI2;
+
+  #if CFG_TUD_EDPT_DEDICATED_HWFIFO
+    uint8_t* epout_buf = NULL;
+    uint8_t* epin_buf  = NULL;
+  #else
+    midi2d_epbuf_t* p_epbuf = &_midi2d_epbuf[i];
+    uint8_t* epout_buf = p_epbuf->epout;
+    uint8_t* epin_buf  = p_epbuf->epin;
+  #endif
+
+    tu_edpt_stream_init(&p_midi->ep_stream.rx, false, false, false,
+                        p_midi->ep_stream.rx_ff_buf, CFG_TUD_MIDI2_RX_BUFSIZE, epout_buf);
+    tu_edpt_stream_init(&p_midi->ep_stream.tx, false, true, false,
+                        p_midi->ep_stream.tx_ff_buf, CFG_TUD_MIDI2_TX_BUFSIZE, epin_buf);
+  }
+}
+
+bool midi2d_deinit(void) {
+  for (uint8_t i = 0; i < CFG_TUD_MIDI2; i++) {
+    midi2d_interface_t* p_midi = &_midi2d_itf[i];
+    tu_edpt_stream_deinit(&p_midi->ep_stream.rx);
+    tu_edpt_stream_deinit(&p_midi->ep_stream.tx);
+  }
+  return true;
+}
+
+void midi2d_reset(uint8_t rhport) {
+  (void) rhport;
+  for (uint8_t i = 0; i < CFG_TUD_MIDI2; i++) {
+    midi2d_interface_t* p_midi = &_midi2d_itf[i];
+    tu_memclr(p_midi, ITF_MEM_RESET_SIZE);
+
+    tu_edpt_stream_clear(&p_midi->ep_stream.rx);
+    tu_edpt_stream_close(&p_midi->ep_stream.rx);
+
+    tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+    tu_edpt_stream_close(&p_midi->ep_stream.tx);
+  }
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t find_midi2_itf(uint8_t ep_addr) {
+  for (uint8_t idx = 0; idx < CFG_TUD_MIDI2; idx++) {
+    const midi2d_interface_t* p_midi = &_midi2d_itf[idx];
+    if (ep_addr == p_midi->ep_stream.rx.ep_addr || ep_addr == p_midi->ep_stream.tx.ep_addr) {
+      return idx;
+    }
+  }
+  return TUSB_INDEX_INVALID_8;
+}
+
+static uint8_t find_midi2_itf_by_num(uint8_t itf_num) {
+  for (uint8_t idx = 0; idx < CFG_TUD_MIDI2; idx++) {
+    if (_midi2d_itf[idx].itf_num == itf_num) return idx;
+  }
+  return TUSB_INDEX_INVALID_8;
+}
+
+uint16_t midi2d_open(uint8_t rhport, const tusb_desc_interface_t* desc_itf, uint16_t max_len) {
+  const uint8_t* p_desc   = (const uint8_t*) desc_itf;
+  const uint8_t* desc_end = p_desc + max_len;
+
+  // 1st Interface: Audio Control v1 (optional)
+  if (TUSB_CLASS_AUDIO               == desc_itf->bInterfaceClass    &&
+      AUDIO_SUBCLASS_CONTROL         == desc_itf->bInterfaceSubClass &&
+      AUDIO_FUNC_PROTOCOL_CODE_UNDEF == desc_itf->bInterfaceProtocol) {
+    p_desc = tu_desc_next(desc_itf);
+    while (tu_desc_in_bounds(p_desc, desc_end) && TUSB_DESC_CS_INTERFACE == tu_desc_type(p_desc)) {
+      p_desc = tu_desc_next(p_desc);
+    }
+  }
+
+  // 2nd Interface: MIDI Streaming
+  TU_VERIFY(TUSB_DESC_INTERFACE == tu_desc_type(p_desc), 0);
+  const tusb_desc_interface_t* desc_midi = (const tusb_desc_interface_t*) p_desc;
+
+  TU_VERIFY(TUSB_CLASS_AUDIO              == desc_midi->bInterfaceClass &&
+            AUDIO_SUBCLASS_MIDI_STREAMING == desc_midi->bInterfaceSubClass &&
+            AUDIO_FUNC_PROTOCOL_CODE_UNDEF == desc_midi->bInterfaceProtocol,
+            0);
+
+  uint8_t idx = find_midi2_itf(0);
+  TU_ASSERT(idx < CFG_TUD_MIDI2, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[idx];
+
+  p_midi->rhport      = rhport;
+  p_midi->itf_num     = desc_midi->bInterfaceNumber;
+  p_midi->alt_setting = 0;
+  p_midi->protocol    = MIDI_PROTOCOL_MIDI2;
+  p_midi->negotiated  = false;
+
+  p_desc = tu_desc_next(p_desc);
+
+  // Skip class-specific descriptors
+  while (tu_desc_in_bounds(p_desc, desc_end) && TUSB_DESC_CS_INTERFACE == tu_desc_type(p_desc)) {
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  // Find and open endpoint descriptors
+  uint8_t found_ep = 0;
+  while ((found_ep < desc_midi->bNumEndpoints) && tu_desc_in_bounds(p_desc, desc_end)) {
+    if (TUSB_DESC_ENDPOINT == tu_desc_type(p_desc)) {
+      const tusb_desc_endpoint_t* desc_ep = (const tusb_desc_endpoint_t*) p_desc;
+      TU_ASSERT(usbd_edpt_open(rhport, desc_ep), 0);
+      const uint8_t ep_addr = desc_ep->bEndpointAddress;
+
+      if (tu_edpt_dir(ep_addr) == TUSB_DIR_IN) {
+        tu_edpt_stream_open(&p_midi->ep_stream.tx, rhport, desc_ep, CFG_TUD_MIDI2_TX_EPSIZE);
+        tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+      } else {
+        tu_edpt_stream_open(&p_midi->ep_stream.rx, rhport, desc_ep, tu_edpt_packet_size(desc_ep));
+        tu_edpt_stream_clear(&p_midi->ep_stream.rx);
+        TU_ASSERT(tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx) > 0, 0);
+      }
+
+      found_ep++;
+    }
+
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  // Skip remaining descriptors (alt setting 1, CS endpoints, GTB)
+  while (tu_desc_in_bounds(p_desc, desc_end)) {
+    uint8_t dtype = tu_desc_type(p_desc);
+    if (dtype != TUSB_DESC_CS_INTERFACE && dtype != TUSB_DESC_CS_ENDPOINT &&
+        dtype != TUSB_DESC_INTERFACE && dtype != TUSB_DESC_ENDPOINT) {
+      break;
+    }
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  return (uint16_t)(p_desc - (const uint8_t*) desc_itf);
+}
+
+bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_request_t* request) {
+  TU_LOG2("MIDI2 ctrl: stage=%u bRequest=0x%02X wValue=0x%04X wIndex=0x%04X wLength=%u\r\n",
+          stage, request->bRequest, request->wValue, request->wIndex, request->wLength);
+
+  if (stage != CONTROL_STAGE_SETUP) return true;
+
+  switch (request->bRequest) {
+    case TUSB_REQ_SET_INTERFACE: {
+      uint8_t itf_num = tu_u16_low(request->wIndex);
+      uint8_t alt     = tu_u16_low(request->wValue);
+
+      uint8_t idx = find_midi2_itf_by_num(itf_num);
+      if (idx >= CFG_TUD_MIDI2) return false;
+
+      midi2d_interface_t* p_midi = &_midi2d_itf[idx];
+      p_midi->alt_setting = alt;
+
+      tu_edpt_stream_clear(&p_midi->ep_stream.rx);
+      tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+
+      if (alt == 1) {
+        p_midi->negotiated = false;
+        p_midi->protocol   = MIDI_PROTOCOL_MIDI2;
+      }
+
+      // Re-arm RX endpoint for receiving data after alt setting change
+      tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx);
+
+      tud_midi2_set_itf_cb(idx, alt);
+      tud_control_status(rhport, request);
+      return true;
+    }
+
+    case TUSB_REQ_GET_DESCRIPTOR: {
+      // wValue: descriptor type (high) | index (low)
+      // 0x26 = CS_GRP_TRM_BLOCK, index 0x01
+      if (request->wValue == ((uint16_t)MIDI2_CS_GRP_TRM_BLOCK << 8 | 0x01)) {
+        if (tud_midi2_get_req_itf_cb(rhport, request)) return true;
+
+        uint16_t len = request->wLength;
+        if (len > sizeof(_default_gtb_desc)) {
+          len = sizeof(_default_gtb_desc);
+        }
+        tud_control_xfer(rhport, request, (void*)(uintptr_t) _default_gtb_desc, len);
+        return true;
+      }
+      return false;
+    }
+
+    default:
+      return false;
+  }
+}
+
+bool midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
+  (void) rhport;
+
+  uint8_t idx = find_midi2_itf(ep_addr);
+  TU_ASSERT(idx < CFG_TUD_MIDI2);
+  midi2d_interface_t* p_midi = &_midi2d_itf[idx];
+
+  tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+
+  if (ep_addr == ep_rx->ep_addr) {
+    if (result == XFER_RESULT_SUCCESS) {
+      tu_edpt_stream_read_xfer_complete(ep_rx, xferred_bytes);
+      if (p_midi->alt_setting == 1) {
+        _nego_process_rx(p_midi);
+      }
+      tud_midi2_rx_cb(idx);
+    }
+    tu_edpt_stream_read_xfer(ep_rx);
+  } else if (ep_addr == ep_tx->ep_addr && result == XFER_RESULT_SUCCESS) {
+    if (0 == tu_edpt_stream_write_xfer(ep_tx)) {
+      (void) tu_edpt_stream_write_zlp_if_needed(ep_tx, xferred_bytes);
+    }
+  } else {
+    return false;
+  }
+
+  return true;
+}
+
+#endif
diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
new file mode 100644
index 000000000..dac1f0124
--- /dev/null
+++ b/src/class/midi/midi2_device.h
@@ -0,0 +1,125 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2026 Saulo Verissimo
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * This file is part of the TinyUSB stack.
+ */
+
+#ifndef TUSB_MIDI2_DEVICE_H_
+#define TUSB_MIDI2_DEVICE_H_
+
+#include "class/audio/audio.h"
+#include "midi.h"
+
+//--------------------------------------------------------------------+
+// Class Driver Configuration
+//--------------------------------------------------------------------+
+
+// Config defaults are in tusb_option.h:
+//   CFG_TUD_MIDI2_RX_EPSIZE, CFG_TUD_MIDI2_TX_EPSIZE,
+//   CFG_TUD_MIDI2_RX_BUFSIZE, CFG_TUD_MIDI2_TX_BUFSIZE,
+//   CFG_TUD_MIDI2_NUM_GROUPS, CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS,
+//   CFG_TUD_MIDI2_EP_NAME, CFG_TUD_MIDI2_PRODUCT_ID
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+//--------------------------------------------------------------------+
+// Application Callback API (weak, optional)
+//--------------------------------------------------------------------+
+void tud_midi2_rx_cb(uint8_t itf);
+void tud_midi2_set_itf_cb(uint8_t itf, uint8_t alt);
+bool tud_midi2_get_req_itf_cb(uint8_t rhport, const tusb_control_request_t* request);
+
+//--------------------------------------------------------------------+
+// Application API (Multiple Interfaces)
+//--------------------------------------------------------------------+
+
+bool     tud_midi2_n_mounted(uint8_t itf);
+uint32_t tud_midi2_n_available(uint8_t itf);
+uint8_t  tud_midi2_n_alt_setting(uint8_t itf);
+bool     tud_midi2_n_negotiated(uint8_t itf);
+uint8_t  tud_midi2_n_protocol(uint8_t itf);
+
+uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words);
+uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t count);
+
+bool     tud_midi2_n_packet_read(uint8_t itf, uint8_t packet[4]);
+bool     tud_midi2_n_packet_write(uint8_t itf, const uint8_t packet[4]);
+
+//--------------------------------------------------------------------+
+// Application API (Single Interface)
+//--------------------------------------------------------------------+
+TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_mounted(void) {
+  return tud_midi2_n_mounted(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint32_t tud_midi2_available(void) {
+  return tud_midi2_n_available(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t tud_midi2_alt_setting(void) {
+  return tud_midi2_n_alt_setting(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_negotiated(void) {
+  return tud_midi2_n_negotiated(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t tud_midi2_protocol(void) {
+  return tud_midi2_n_protocol(0);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint32_t
+tud_midi2_ump_read(uint32_t* words, uint32_t max_words) {
+  return tud_midi2_n_ump_read(0, words, max_words);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint32_t
+tud_midi2_ump_write(const uint32_t* words, uint32_t count) {
+  return tud_midi2_n_ump_write(0, words, count);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_packet_read(uint8_t packet[4]) {
+  return tud_midi2_n_packet_read(0, packet);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_packet_write(const uint8_t packet[4]) {
+  return tud_midi2_n_packet_write(0, packet);
+}
+
+//--------------------------------------------------------------------+
+// Internal Class Driver API
+//--------------------------------------------------------------------+
+void     midi2d_init(void);
+bool     midi2d_deinit(void);
+void     midi2d_reset(uint8_t rhport);
+uint16_t midi2d_open(uint8_t rhport, const tusb_desc_interface_t* itf_desc, uint16_t max_len);
+bool     midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_request_t* request);
+bool     midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/device/usbd.c b/src/device/usbd.c
index 0e58f70bf..55ad330c1 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -254,6 +254,20 @@ static const usbd_class_driver_t _usbd_driver[] = {
     },
     #endif
 
+    #if CFG_TUD_MIDI2
+    {
+        .name             = DRIVER_NAME("MIDI2"),
+        .init             = midi2d_init,
+        .deinit           = midi2d_deinit,
+        .open             = midi2d_open,
+        .reset            = midi2d_reset,
+        .control_xfer_cb  = midi2d_control_xfer_cb,
+        .xfer_cb          = midi2d_xfer_cb,
+        .xfer_isr         = NULL,
+        .sof              = NULL
+    },
+    #endif
+
     #if CFG_TUD_VENDOR
     {
         .name             = DRIVER_NAME("VENDOR"),
diff --git a/src/device/usbd.h b/src/device/usbd.h
index 473e697ac..af37eff56 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -424,6 +424,43 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   TUD_MIDI_DESC_EP(_epin, _epsize, 1),\
   TUD_MIDI_JACKID_OUT_EMB(1)
 
+//--------------------------------------------------------------------+
+// MIDI 2.0 Descriptor Templates (USB-MIDI 2.0)
+//--------------------------------------------------------------------+
+
+// Alt Setting 1: MS Interface + MS Header (bcdMSC=0x0200)
+#define TUD_MIDI2_DESC_ALT1_HEAD_LEN (9 + 7)
+#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx) \
+  /* MIDI Streaming Interface, Alt Setting 1 */\
+  9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum) + 1), 1, 2, TUSB_CLASS_AUDIO, AUDIO_SUBCLASS_MIDI_STREAMING, AUDIO_FUNC_PROTOCOL_CODE_UNDEF, _stridx,\
+  /* MS Header (MIDI 2.0) */\
+  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(7)
+
+// Alt Setting 1: Standard USB Endpoint (7 bytes) + CS Endpoint (subtype 0x02)
+#define TUD_MIDI2_DESC_ALT1_EP_LEN(_numgtbs) (7 + 4 + (_numgtbs))
+#define TUD_MIDI2_DESC_ALT1_EP(_ep, _epsize, _numgtbs) \
+  7, TUSB_DESC_ENDPOINT, _ep, TUSB_XFER_BULK, U16_TO_U8S_LE(_epsize), 0, \
+  (uint8_t)(4 + (_numgtbs)), TUSB_DESC_CS_ENDPOINT, MIDI_CS_ENDPOINT_GENERAL_2_0, _numgtbs
+
+// Total length: Alt 0 (MIDI 1.0) + Alt 1 (UMP)
+#define TUD_MIDI2_DESC_LEN (TUD_MIDI_DESC_LEN + TUD_MIDI2_DESC_ALT1_HEAD_LEN + TUD_MIDI2_DESC_ALT1_EP_LEN(1) * 2)
+
+// Complete MIDI 2.0 descriptor with both alternate settings (single cable/GTB)
+#define TUD_MIDI2_DESCRIPTOR(_itfnum, _stridx, _epout, _epin, _epsize) \
+  /* Alt Setting 0 (MIDI 1.0) */\
+  TUD_MIDI_DESC_HEAD(_itfnum, _stridx, 1),\
+  TUD_MIDI_DESC_JACK_DESC(1, 0),\
+  TUD_MIDI_DESC_EP(_epout, _epsize, 1),\
+  TUD_MIDI_JACKID_IN_EMB(1),\
+  TUD_MIDI_DESC_EP(_epin, _epsize, 1),\
+  TUD_MIDI_JACKID_OUT_EMB(1),\
+  /* Alt Setting 1 (UMP) */\
+  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx),\
+  TUD_MIDI2_DESC_ALT1_EP(_epout, _epsize, 1),\
+  1, /* bAssoGrpTrmBlkID = 1 */\
+  TUD_MIDI2_DESC_ALT1_EP(_epin, _epsize, 1),\
+  1  /* bAssoGrpTrmBlkID = 1 */
+
 //--------------------------------------------------------------------+
 // Audio Descriptor Templates
 //--------------------------------------------------------------------+
diff --git a/src/tusb.h b/src/tusb.h
index c80c8433c..aa6b461e5 100644
--- a/src/tusb.h
+++ b/src/tusb.h
@@ -63,6 +63,10 @@
     #include "class/midi/midi_host.h"
   #endif
 
+  #if CFG_TUH_MIDI2
+    #include "class/midi/midi2_host.h"
+  #endif
+
   #if CFG_TUH_VENDOR
     #include "class/vendor/vendor_host.h"
   #endif
@@ -108,6 +112,10 @@
     #include "class/midi/midi_device.h"
   #endif
 
+  #if CFG_TUD_MIDI2
+    #include "class/midi/midi2_device.h"
+  #endif
+
   #if CFG_TUD_VENDOR
     #include "class/vendor/vendor_device.h"
   #endif
diff --git a/src/tusb_option.h b/src/tusb_option.h
index 154f8e2a4..4483c2200 100644
--- a/src/tusb_option.h
+++ b/src/tusb_option.h
@@ -646,6 +646,42 @@
   #define CFG_TUD_MIDI            0
 #endif
 
+#ifndef CFG_TUD_MIDI2
+  #define CFG_TUD_MIDI2           0
+#endif
+
+#ifndef CFG_TUD_MIDI2_TX_BUFSIZE
+  #define CFG_TUD_MIDI2_TX_BUFSIZE  256
+#endif
+
+#ifndef CFG_TUD_MIDI2_RX_BUFSIZE
+  #define CFG_TUD_MIDI2_RX_BUFSIZE  256
+#endif
+
+#ifndef CFG_TUD_MIDI2_TX_EPSIZE
+  #define CFG_TUD_MIDI2_TX_EPSIZE   64
+#endif
+
+#ifndef CFG_TUD_MIDI2_RX_EPSIZE
+  #define CFG_TUD_MIDI2_RX_EPSIZE   64
+#endif
+
+#ifndef CFG_TUD_MIDI2_NUM_GROUPS
+  #define CFG_TUD_MIDI2_NUM_GROUPS  1
+#endif
+
+#ifndef CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS
+  #define CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS 1
+#endif
+
+#ifndef CFG_TUD_MIDI2_EP_NAME
+  #define CFG_TUD_MIDI2_EP_NAME     "TinyUSB MIDI 2.0"
+#endif
+
+#ifndef CFG_TUD_MIDI2_PRODUCT_ID
+  #define CFG_TUD_MIDI2_PRODUCT_ID  "TinyUSB-MIDI2"
+#endif
+
 #ifndef CFG_TUD_VENDOR
   #define CFG_TUD_VENDOR          0
 #endif
@@ -815,6 +851,22 @@
   #define CFG_TUH_MIDI   0
 #endif
 
+#ifndef CFG_TUH_MIDI2
+  #define CFG_TUH_MIDI2  0
+#endif
+
+#ifndef CFG_TUH_MIDI2_RX_BUFSIZE
+  #define CFG_TUH_MIDI2_RX_BUFSIZE (4 * TUH_EPSIZE_BULK_MAX)
+#endif
+
+#ifndef CFG_TUH_MIDI2_TX_BUFSIZE
+  #define CFG_TUH_MIDI2_TX_BUFSIZE (4 * TUH_EPSIZE_BULK_MAX)
+#endif
+
+#ifndef CFG_TUH_MIDI2_LOG_LEVEL
+  #define CFG_TUH_MIDI2_LOG_LEVEL CFG_TUH_LOG_LEVEL
+#endif
+
 #ifndef CFG_TUH_MSC
   #define CFG_TUH_MSC    0
 #endif
-- 
cgit v1.3.1


From 7750e51ce1b64bd4d2f0ba6d9671303b96ba80ce Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Tue, 24 Mar 2026 23:38:02 -0300
Subject: feat: add MIDI 2.0 Host class driver (USB-MIDI 2.0)

Add native USB-MIDI 2.0 Host class driver to TinyUSB. Implements
reactive architecture: enumerate, detect MIDI 2.0 capability, inform
application via callbacks.

Driver features:
- Parse both Alt Setting 0 (MIDI 1.0) and Alt Setting 1 (UMP)
- Detect bcdMSC version from descriptor
- Auto-select highest protocol (Alt 1 preferred if available)
- UMP read/write via endpoint streams
- Proper Audio Control interface skip (loop-based, following
  midi_host.c pattern)
- Endpoint open with tuh_edpt_open/tu_edpt_stream_open/clear
- usbh_driver_set_config_complete for USBH state machine
- Handle Audio Control itf_num in set_config gracefully
- 5 weak callback stubs (descriptor, mount, unmount, rx, tx)

Build system:
- Register midih2_* in usbh.c driver table
- Add midi2_host.h include to tusb.h
- Add CFG_TUH_MIDI2_LOG_LEVEL to tusb_option.h

All changes guarded by #if CFG_TUH_MIDI2 (default 0). Zero impact on
existing drivers and examples.

Tested: Waveshare RP2350-USB-A (Host) receiving UMP from Raspberry Pi
Pico (Device) via PIO-USB, board-to-board
---
 src/class/midi/midi2_host.c | 502 ++++++++++++++++++++++++++++++++++++++++++++
 src/class/midi/midi2_host.h |  99 +++++++++
 src/host/usbh.c             |  12 ++
 3 files changed, 613 insertions(+)
 create mode 100644 src/class/midi/midi2_host.c
 create mode 100644 src/class/midi/midi2_host.h

(limited to 'src')

diff --git a/src/class/midi/midi2_host.c b/src/class/midi/midi2_host.c
new file mode 100644
index 000000000..beb441b56
--- /dev/null
+++ b/src/class/midi/midi2_host.c
@@ -0,0 +1,502 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2026 Saulo Verissimo
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * This file is part of the TinyUSB stack.
+ */
+
+#include "tusb_option.h"
+
+#if (CFG_TUH_ENABLED && CFG_TUH_MIDI2)
+
+#include "host/usbh.h"
+#include "host/usbh_pvt.h"
+#include "midi2_host.h"
+
+#define TU_LOG_DRV(...)   TU_LOG(CFG_TUH_MIDI2_LOG_LEVEL, __VA_ARGS__)
+
+//--------------------------------------------------------------------+
+// Weak stubs for application callbacks
+//--------------------------------------------------------------------+
+
+TU_ATTR_WEAK void tuh_midi2_descriptor_cb(uint8_t idx, const tuh_midi2_descriptor_cb_t *desc_cb_data) {
+  (void) idx; (void) desc_cb_data;
+}
+
+TU_ATTR_WEAK void tuh_midi2_mount_cb(uint8_t idx, const tuh_midi2_mount_cb_t *mount_cb_data) {
+  (void) idx; (void) mount_cb_data;
+}
+
+TU_ATTR_WEAK void tuh_midi2_rx_cb(uint8_t idx, uint32_t xferred_bytes) {
+  (void) idx; (void) xferred_bytes;
+}
+
+TU_ATTR_WEAK void tuh_midi2_tx_cb(uint8_t idx, uint32_t xferred_bytes) {
+  (void) idx; (void) xferred_bytes;
+}
+
+TU_ATTR_WEAK void tuh_midi2_umount_cb(uint8_t idx) {
+  (void) idx;
+}
+
+//--------------------------------------------------------------------+
+// Internal structure and state
+//--------------------------------------------------------------------+
+
+typedef struct {
+  uint8_t daddr;
+  uint8_t bInterfaceNumber;
+
+  uint8_t alt_setting_current;
+
+  uint8_t protocol_version;
+  uint8_t bcdMSC_hi, bcdMSC_lo;
+  uint8_t rx_cable_count_alt0;
+  uint8_t tx_cable_count_alt0;
+  uint8_t rx_cable_count_alt1;
+  uint8_t tx_cable_count_alt1;
+
+  struct {
+    tu_edpt_stream_t tx;
+    tu_edpt_stream_t rx;
+
+    uint8_t rx_ff_buf[CFG_TUH_MIDI2_RX_BUFSIZE];
+    uint8_t tx_ff_buf[CFG_TUH_MIDI2_TX_BUFSIZE];
+  } ep_stream;
+
+  bool mounted;
+} midih2_interface_t;
+
+static midih2_interface_t _midi2_host[CFG_TUH_MIDI2];
+
+#if CFG_TUH_EDPT_DEDICATED_HWFIFO == 0
+typedef struct {
+  TUH_EPBUF_DEF(tx, TUH_EPSIZE_BULK_MAX);
+  TUH_EPBUF_DEF(rx, TUH_EPSIZE_BULK_MAX);
+} midih2_epbuf_t;
+
+CFG_TUH_MEM_SECTION static midih2_epbuf_t _midi2_epbuf[CFG_TUH_MIDI2];
+#endif
+
+//--------------------------------------------------------------------+
+// Helper functions
+//--------------------------------------------------------------------+
+
+static inline uint8_t find_new_midi2_index(void) {
+  for (uint8_t idx = 0; idx < CFG_TUH_MIDI2; idx++) {
+    if (_midi2_host[idx].daddr == 0) {
+      return idx;
+    }
+  }
+  return TUSB_INDEX_INVALID_8;
+}
+
+static inline uint8_t get_idx_by_ep_addr(uint8_t daddr, uint8_t ep_addr) {
+  for (uint8_t idx = 0; idx < CFG_TUH_MIDI2; idx++) {
+    const midih2_interface_t *p_midi = &_midi2_host[idx];
+    if ((p_midi->daddr == daddr) &&
+        (ep_addr == p_midi->ep_stream.rx.ep_addr || ep_addr == p_midi->ep_stream.tx.ep_addr)) {
+      return idx;
+    }
+  }
+  return TUSB_INDEX_INVALID_8;
+}
+
+//--------------------------------------------------------------------+
+// Descriptor parsing
+//--------------------------------------------------------------------+
+
+static void midih2_parse_descriptors_alt0(midih2_interface_t *p_midi,
+    const tusb_desc_interface_t *desc_itf, const uint8_t *desc_end) {
+  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass,);
+
+  p_midi->bInterfaceNumber = desc_itf->bInterfaceNumber;
+
+  const uint8_t *p_desc = (const uint8_t *) desc_itf;
+  p_desc = tu_desc_next(p_desc);
+
+  uint8_t rx_cable_count = 0;
+  uint8_t tx_cable_count = 0;
+
+  while (tu_desc_in_bounds(p_desc, desc_end)) {
+    if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
+      break;
+    }
+
+    if (tu_desc_type(p_desc) == TUSB_DESC_ENDPOINT) {
+      const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
+
+      // Open endpoint and stream
+      TU_ASSERT(tuh_edpt_open(p_midi->daddr, p_ep),);
+      if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_IN) {
+        tu_edpt_stream_open(&p_midi->ep_stream.rx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
+        tu_edpt_stream_clear(&p_midi->ep_stream.rx);
+      } else {
+        tu_edpt_stream_open(&p_midi->ep_stream.tx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
+        tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+      }
+
+      p_desc = tu_desc_next(p_desc);
+
+      if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
+        const midi_desc_cs_endpoint_t *p_csep = (const midi_desc_cs_endpoint_t *) p_desc;
+
+        if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
+          tx_cable_count = p_csep->bNumEmbMIDIJack;
+        } else {
+          rx_cable_count = p_csep->bNumEmbMIDIJack;
+        }
+      }
+    }
+
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  p_midi->rx_cable_count_alt0 = rx_cable_count;
+  p_midi->tx_cable_count_alt0 = tx_cable_count;
+}
+
+static void midih2_parse_descriptors_alt1(midih2_interface_t *p_midi,
+    const tusb_desc_interface_t *desc_itf, const uint8_t *desc_end) {
+  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass,);
+  TU_VERIFY(desc_itf->bAlternateSetting == 1,);
+
+  const uint8_t *p_desc = (const uint8_t *) desc_itf;
+  p_desc = tu_desc_next(p_desc);
+
+  uint8_t rx_cable_count = 0;
+  uint8_t tx_cable_count = 0;
+
+  while (tu_desc_in_bounds(p_desc, desc_end)) {
+    if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
+      break;
+    }
+
+    if (tu_desc_type(p_desc) == TUSB_DESC_CS_INTERFACE) {
+      if (tu_desc_subtype(p_desc) == MIDI_CS_INTERFACE_HEADER) {
+        const uint8_t *bcd_ptr = p_desc + 3;
+        p_midi->bcdMSC_lo = bcd_ptr[0];
+        p_midi->bcdMSC_hi = bcd_ptr[1];
+
+        if (p_midi->bcdMSC_hi == 0x02) {
+          p_midi->protocol_version = 1;
+        }
+      }
+    }
+
+    if (tu_desc_type(p_desc) == TUSB_DESC_ENDPOINT) {
+      const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
+      p_desc = tu_desc_next(p_desc);
+
+      if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
+        const midi_desc_cs_endpoint_t *p_csep = (const midi_desc_cs_endpoint_t *) p_desc;
+
+        if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
+          tx_cable_count = p_csep->bNumEmbMIDIJack;
+        } else {
+          rx_cable_count = p_csep->bNumEmbMIDIJack;
+        }
+      }
+    }
+
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  p_midi->rx_cable_count_alt1 = rx_cable_count;
+  p_midi->tx_cable_count_alt1 = tx_cable_count;
+}
+
+//--------------------------------------------------------------------+
+// Auto-selection logic
+//--------------------------------------------------------------------+
+
+static void midih2_auto_select_alt_setting(midih2_interface_t *p_midi) {
+  p_midi->alt_setting_current = 0;
+  if (p_midi->protocol_version == 1) {
+    p_midi->alt_setting_current = 1;
+  }
+}
+
+//--------------------------------------------------------------------+
+// Init/Deinit
+//--------------------------------------------------------------------+
+
+bool midih2_init(void) {
+  tu_memclr(&_midi2_host, sizeof(_midi2_host));
+  for (int inst = 0; inst < CFG_TUH_MIDI2; inst++) {
+    midih2_interface_t *p_midi = &_midi2_host[inst];
+
+  #if CFG_TUH_EDPT_DEDICATED_HWFIFO
+    uint8_t* rx_buf = NULL;
+    uint8_t* tx_buf = NULL;
+  #else
+    uint8_t* rx_buf = _midi2_epbuf[inst].rx;
+    uint8_t* tx_buf = _midi2_epbuf[inst].tx;
+  #endif
+
+    tu_edpt_stream_init(&p_midi->ep_stream.rx, true, false, false,
+      p_midi->ep_stream.rx_ff_buf, CFG_TUH_MIDI2_RX_BUFSIZE, rx_buf);
+    tu_edpt_stream_init(&p_midi->ep_stream.tx, true, true, false,
+      p_midi->ep_stream.tx_ff_buf, CFG_TUH_MIDI2_TX_BUFSIZE, tx_buf);
+  }
+  return true;
+}
+
+bool midih2_deinit(void) {
+  for (size_t i = 0; i < CFG_TUH_MIDI2; i++) {
+    midih2_interface_t* p_midi = &_midi2_host[i];
+    tu_edpt_stream_deinit(&p_midi->ep_stream.rx);
+    tu_edpt_stream_deinit(&p_midi->ep_stream.tx);
+  }
+  return true;
+}
+
+//--------------------------------------------------------------------+
+// Class driver callbacks
+//--------------------------------------------------------------------+
+
+uint16_t midih2_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_interface_t *desc_itf, uint16_t max_len) {
+  (void) rhport;
+
+  TU_VERIFY(TUSB_CLASS_AUDIO == desc_itf->bInterfaceClass, 0);
+
+  // For Alt Setting 1, reuse existing slot for same device+interface
+  uint8_t idx = TUSB_INDEX_INVALID_8;
+  if (desc_itf->bAlternateSetting > 0) {
+    for (uint8_t i = 0; i < CFG_TUH_MIDI2; i++) {
+      if (_midi2_host[i].daddr == dev_addr &&
+          _midi2_host[i].bInterfaceNumber == desc_itf->bInterfaceNumber) {
+        idx = i;
+        break;
+      }
+    }
+  }
+  if (idx == TUSB_INDEX_INVALID_8) {
+    idx = find_new_midi2_index();
+  }
+  TU_VERIFY(idx < CFG_TUH_MIDI2, 0);
+
+  midih2_interface_t *p_midi = &_midi2_host[idx];
+  p_midi->daddr = dev_addr;
+
+  const uint8_t *desc_start = (const uint8_t *) desc_itf;
+  const uint8_t *desc_end = desc_start + max_len;
+
+  // Skip Audio Control interface and any non-MIDI-Streaming descriptors
+  // (following midi_host.c pattern from Ha Thach)
+  if (AUDIO_SUBCLASS_CONTROL == desc_itf->bInterfaceSubClass) {
+    const uint8_t *p_desc = tu_desc_next((const uint8_t *)desc_itf);
+    // Skip CS_INTERFACE header
+    TU_VERIFY(tu_desc_type(p_desc) == TUSB_DESC_CS_INTERFACE, 0);
+    p_desc = tu_desc_next(p_desc);
+    desc_itf = (const tusb_desc_interface_t *) p_desc;
+    // Skip until we find MIDI Streaming interface
+    while (tu_desc_in_bounds(p_desc, desc_end) &&
+           (desc_itf->bDescriptorType != TUSB_DESC_INTERFACE ||
+            (desc_itf->bInterfaceClass == TUSB_CLASS_AUDIO &&
+             desc_itf->bInterfaceSubClass != AUDIO_SUBCLASS_MIDI_STREAMING))) {
+      p_desc = tu_desc_next(p_desc);
+      desc_itf = (const tusb_desc_interface_t *) p_desc;
+    }
+    TU_VERIFY(tu_desc_in_bounds(p_desc, desc_end), 0);
+    TU_VERIFY(TUSB_CLASS_AUDIO == desc_itf->bInterfaceClass, 0);
+  }
+
+  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass, 0);
+
+  TU_LOG_DRV("MIDI2 opening Interface %u Alt %u (addr = %u)\r\n",
+             desc_itf->bInterfaceNumber, desc_itf->bAlternateSetting, dev_addr);
+
+  // Dispatch to appropriate parser based on Alt Setting
+  if (desc_itf->bAlternateSetting == 0) {
+    midih2_parse_descriptors_alt0(p_midi, desc_itf, desc_end);
+  } else if (desc_itf->bAlternateSetting == 1) {
+    midih2_parse_descriptors_alt1(p_midi, desc_itf, desc_end);
+  }
+
+  return max_len;
+}
+
+bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
+  uint8_t idx = 0;
+  for (idx = 0; idx < CFG_TUH_MIDI2; idx++) {
+    if (_midi2_host[idx].daddr == dev_addr && _midi2_host[idx].bInterfaceNumber == itf_num) {
+      break;
+    }
+  }
+
+  if (idx >= CFG_TUH_MIDI2) {
+    // Not our interface (e.g. Audio Control) - pass through to next
+    usbh_driver_set_config_complete(dev_addr, itf_num);
+    return true;
+  }
+
+  midih2_interface_t *p_midi = &_midi2_host[idx];
+
+  // Auto-select alt setting
+  midih2_auto_select_alt_setting(p_midi);
+
+  // Invoke descriptor_cb
+  tuh_midi2_descriptor_cb_t desc_cb = {
+    .protocol_version = p_midi->protocol_version,
+    .bcdMSC_hi = p_midi->bcdMSC_hi,
+    .bcdMSC_lo = p_midi->bcdMSC_lo,
+    .rx_cable_count = (p_midi->alt_setting_current == 0) ?
+                      p_midi->rx_cable_count_alt0 : p_midi->rx_cable_count_alt1,
+    .tx_cable_count = (p_midi->alt_setting_current == 0) ?
+                      p_midi->tx_cable_count_alt0 : p_midi->tx_cable_count_alt1,
+  };
+  tuh_midi2_descriptor_cb(idx, &desc_cb);
+
+  // Mark as mounted
+  TU_LOG_DRV("MIDI2 mounted addr = %u, alt = %u, protocol = %u\r\n",
+             dev_addr, p_midi->alt_setting_current, p_midi->protocol_version);
+  p_midi->mounted = true;
+
+  // Invoke mount_cb
+  tuh_midi2_mount_cb_t mount_cb = {
+    .daddr = p_midi->daddr,
+    .bInterfaceNumber = p_midi->bInterfaceNumber,
+    .protocol_version = p_midi->protocol_version,
+    .alt_setting_active = p_midi->alt_setting_current,
+    .rx_cable_count = desc_cb.rx_cable_count,
+    .tx_cable_count = desc_cb.tx_cable_count,
+  };
+  tuh_midi2_mount_cb(idx, &mount_cb);
+
+  // Prepare RX transfer
+  tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx);
+
+  // Signal USBH that configuration is complete
+  usbh_driver_set_config_complete(dev_addr, itf_num);
+
+  return true;
+}
+
+void midih2_close(uint8_t dev_addr) {
+  for (uint8_t idx = 0; idx < CFG_TUH_MIDI2; idx++) {
+    midih2_interface_t *p_midi = &_midi2_host[idx];
+    if (p_midi->daddr == dev_addr) {
+      TU_LOG_DRV("  MIDI2 close addr = %u index = %u\r\n", dev_addr, idx);
+      tu_edpt_stream_close(&p_midi->ep_stream.rx);
+      tu_edpt_stream_close(&p_midi->ep_stream.tx);
+      tuh_midi2_umount_cb(idx);
+      tu_memclr(p_midi, sizeof(midih2_interface_t));
+    }
+  }
+}
+
+bool midih2_xfer_cb(uint8_t dev_addr, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
+  uint8_t idx = get_idx_by_ep_addr(dev_addr, ep_addr);
+  TU_VERIFY(idx < CFG_TUH_MIDI2);
+
+  midih2_interface_t *p_midi = &_midi2_host[idx];
+
+  if (ep_addr == p_midi->ep_stream.rx.ep_addr) {
+    if (result == XFER_RESULT_SUCCESS && xferred_bytes > 0) {
+      tu_edpt_stream_read_xfer_complete(&p_midi->ep_stream.rx, xferred_bytes);
+      tuh_midi2_rx_cb(idx, xferred_bytes);
+    }
+    tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx);
+  } else if (ep_addr == p_midi->ep_stream.tx.ep_addr) {
+    tuh_midi2_tx_cb(idx, xferred_bytes);
+    if (0 == tu_edpt_stream_write_xfer(&p_midi->ep_stream.tx)) {
+      tu_edpt_stream_write_zlp_if_needed(&p_midi->ep_stream.tx, xferred_bytes);
+    }
+  }
+
+  return true;
+}
+
+//--------------------------------------------------------------------+
+// Public API
+//--------------------------------------------------------------------+
+
+bool tuh_midi2_mounted(uint8_t idx) {
+  TU_VERIFY(idx < CFG_TUH_MIDI2);
+  return _midi2_host[idx].mounted;
+}
+
+uint8_t tuh_midi2_get_protocol_version(uint8_t idx) {
+  TU_VERIFY(idx < CFG_TUH_MIDI2);
+  return _midi2_host[idx].protocol_version;
+}
+
+uint8_t tuh_midi2_get_alt_setting_active(uint8_t idx) {
+  TU_VERIFY(idx < CFG_TUH_MIDI2);
+  return _midi2_host[idx].alt_setting_current;
+}
+
+uint8_t tuh_midi2_get_cable_count(uint8_t idx) {
+  TU_VERIFY(idx < CFG_TUH_MIDI2);
+  return (_midi2_host[idx].alt_setting_current == 0) ?
+         _midi2_host[idx].rx_cable_count_alt0 : _midi2_host[idx].rx_cable_count_alt1;
+}
+
+uint32_t tuh_midi2_ump_read(uint8_t idx, uint32_t* words, uint32_t max_words) {
+  TU_VERIFY(idx < CFG_TUH_MIDI2 && words && max_words);
+
+  midih2_interface_t *p_midi = &_midi2_host[idx];
+  tu_edpt_stream_t *ep_rx = &p_midi->ep_stream.rx;
+
+  uint32_t n_words = 0;
+  for (uint32_t i = 0; i < max_words; i++) {
+    if (tu_edpt_stream_read_available(ep_rx) >= 4) {
+      tu_edpt_stream_read(ep_rx, (uint8_t *) &words[i], 4);
+      n_words++;
+    } else {
+      break;
+    }
+  }
+
+  return n_words;
+}
+
+uint32_t tuh_midi2_ump_write(uint8_t idx, const uint32_t* words, uint32_t count) {
+  TU_VERIFY(idx < CFG_TUH_MIDI2 && words && count);
+
+  midih2_interface_t *p_midi = &_midi2_host[idx];
+  tu_edpt_stream_t *ep_tx = &p_midi->ep_stream.tx;
+
+  uint32_t n_words = 0;
+  for (uint32_t i = 0; i < count; i++) {
+    if (tu_edpt_stream_write_available(ep_tx) >= 4) {
+      tu_edpt_stream_write(ep_tx, (const uint8_t *) &words[i], 4);
+      n_words++;
+    } else {
+      break;
+    }
+  }
+
+  return n_words;
+}
+
+uint32_t tuh_midi2_write_flush(uint8_t idx) {
+  TU_VERIFY(idx < CFG_TUH_MIDI2);
+
+  midih2_interface_t *p_midi = &_midi2_host[idx];
+  tu_edpt_stream_t *ep_tx = &p_midi->ep_stream.tx;
+
+  return tu_edpt_stream_write_xfer(ep_tx);
+}
+
+#endif // CFG_TUH_ENABLED && CFG_TUH_MIDI2
diff --git a/src/class/midi/midi2_host.h b/src/class/midi/midi2_host.h
new file mode 100644
index 000000000..d2de55270
--- /dev/null
+++ b/src/class/midi/midi2_host.h
@@ -0,0 +1,99 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2026 Saulo Verissimo
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * This file is part of the TinyUSB stack.
+ */
+
+#ifndef TUSB_MIDI2_HOST_H_
+#define TUSB_MIDI2_HOST_H_
+
+#include "class/audio/audio.h"
+#include "midi.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+//--------------------------------------------------------------------+
+// Callback Type Definitions
+//--------------------------------------------------------------------+
+
+typedef struct {
+  uint8_t protocol_version;                       // 0 = MIDI 1.0 only, 1 = MIDI 2.0
+  uint8_t bcdMSC_hi, bcdMSC_lo;                   // MIDI version from descriptor
+  uint8_t rx_cable_count;                         // For both alt settings (same for Alt 0 and Alt 1)
+  uint8_t tx_cable_count;
+} tuh_midi2_descriptor_cb_t;
+
+typedef struct {
+  uint8_t daddr;
+  uint8_t bInterfaceNumber;
+  uint8_t protocol_version;                       // 0 = MIDI 1.0, 1 = MIDI 2.0
+  uint8_t alt_setting_active;                     // 0 or 1
+  uint8_t rx_cable_count;
+  uint8_t tx_cable_count;
+} tuh_midi2_mount_cb_t;
+
+//--------------------------------------------------------------------+
+// Application Callback API (weak, optional)
+//--------------------------------------------------------------------+
+
+void tuh_midi2_descriptor_cb(uint8_t idx, const tuh_midi2_descriptor_cb_t *desc_cb_data);
+void tuh_midi2_mount_cb(uint8_t idx, const tuh_midi2_mount_cb_t *mount_cb_data);
+void tuh_midi2_rx_cb(uint8_t idx, uint32_t xferred_bytes);
+void tuh_midi2_tx_cb(uint8_t idx, uint32_t xferred_bytes);
+void tuh_midi2_umount_cb(uint8_t idx);
+
+//--------------------------------------------------------------------+
+// Application API - Query
+//--------------------------------------------------------------------+
+
+bool     tuh_midi2_mounted(uint8_t idx);
+uint8_t  tuh_midi2_get_protocol_version(uint8_t idx);
+uint8_t  tuh_midi2_get_alt_setting_active(uint8_t idx);
+uint8_t  tuh_midi2_get_cable_count(uint8_t idx);
+
+//--------------------------------------------------------------------+
+// Application API - I/O
+//--------------------------------------------------------------------+
+
+uint32_t tuh_midi2_ump_read(uint8_t idx, uint32_t* words, uint32_t max_words);
+uint32_t tuh_midi2_ump_write(uint8_t idx, const uint32_t* words, uint32_t count);
+uint32_t tuh_midi2_write_flush(uint8_t idx);
+
+//--------------------------------------------------------------------+
+// Internal Class Driver API
+//--------------------------------------------------------------------+
+
+bool     midih2_init(void);
+bool     midih2_deinit(void);
+bool     midih2_set_config(uint8_t dev_addr, uint8_t itf_num);
+void     midih2_close(uint8_t dev_addr);
+uint16_t midih2_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_interface_t *desc_itf, uint16_t max_len);
+bool     midih2_xfer_cb(uint8_t dev_addr, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/host/usbh.c b/src/host/usbh.c
index 490724b02..2e3c93c5e 100644
--- a/src/host/usbh.c
+++ b/src/host/usbh.c
@@ -278,6 +278,18 @@ static usbh_class_driver_t const usbh_class_drivers[] = {
   },
   #endif
 
+  #if CFG_TUH_MIDI2
+  {
+      .name       = DRIVER_NAME("MIDI2"),
+      .init       = midih2_init,
+      .deinit     = midih2_deinit,
+      .open       = midih2_open,
+      .set_config = midih2_set_config,
+      .xfer_cb    = midih2_xfer_cb,
+      .close      = midih2_close
+  },
+  #endif
+
   #if CFG_TUH_HUB
   {
       .name       = DRIVER_NAME("HUB"),
-- 
cgit v1.3.1


From fa9edeff9c00ee1fc4ee7ab9938b1a5955a6281a Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Wed, 25 Mar 2026 07:05:56 -0300
Subject: fix: address PR review feedback for MIDI 2.0 drivers

Host driver (midi2_host.c):
- midih2_open() now returns actual parsed length instead of max_len,
  preventing composite device interface conflicts
- Parsers (alt0/alt1) refactored to return const uint8_t* end pointer
  following midi_host.c switch/case pattern
- Alt 1 CS Endpoint now parses MIDI 2.0 layout (bNumGrpTrmBlk at
  offset 3 with MIDI_CS_ENDPOINT_GENERAL_2_0 subtype check) instead
  of reusing MIDI 1.0 struct (bNumEmbMIDIJack)
- midih2_set_config() now issues SET_INTERFACE control request via
  tuh_interface_set() before completing configuration. Falls back to
  alt 0 if SET_INTERFACE fails
- Extracted midih2_set_config_complete() and midih2_set_interface_cb()
  for async SET_INTERFACE handling

Device driver (midi2_device.c):
- midi2d_open() skip loop now checks bInterfaceNumber, stopping at
  interfaces that belong to other functions in composite devices
- SET_INTERFACE handler now rejects alt > 1 (returns false/stall)
- Named constants for GTB descriptor types and MIDI protocol values

Descriptor macros (usbd.h):
- TUD_MIDI2_DESC_ALT1_HEAD: iInterface set to 0 (consistent with
  Alt 0), wTotalLength now uses TUD_MIDI2_DESC_ALT1_CS_LEN to cover
  all Alt 1 class-specific descriptors
- TUD_MIDI2_DESC_ALT1_EP: now accepts GTB ID list via variadic args,
  emitting complete CS endpoint descriptor

Host example:
- CMakeLists.txt restricted to rp2040 family (display.c requires
  Pico SDK headers)
- display.c: null terminator after strncpy in log scroll

Documentation:
- class_drivers.rst updated to reflect SET_INTERFACE behavior and
  auto-select with fallback

Addresses: Codex P1 (#1, #2, #3), Copilot (#4-#9)
---
 docs/reference/class_drivers.rst        |   8 +-
 examples/host/midi2_host/CMakeLists.txt |   3 +-
 examples/host/midi2_host/src/display.c  |   1 +
 src/class/midi/midi2_device.c           |  14 ++-
 src/class/midi/midi2_host.c             | 213 ++++++++++++++++++++------------
 src/device/usbd.h                       |  24 ++--
 6 files changed, 166 insertions(+), 97 deletions(-)

(limited to 'src')

diff --git a/docs/reference/class_drivers.rst b/docs/reference/class_drivers.rst
index 9ed332acb..3ac0d8d4e 100644
--- a/docs/reference/class_drivers.rst
+++ b/docs/reference/class_drivers.rst
@@ -87,7 +87,7 @@ The MIDI 2.0 Host driver enables TinyUSB to enumerate and communicate with USB M
 **Key Features:**
 
 - **Reactive Architecture**: Auto-detects Alt Setting 1 (MIDI 2.0) capability during enumeration
-- **Auto-Selection**: Automatically selects the highest available protocol (MIDI 2.0 preferred)
+- **Auto-Selection**: Automatically selects the highest available protocol and issues SET_INTERFACE to activate Alt Setting 1 when MIDI 2.0 is detected
 - **Transparent Stream Messages**: All data (UMP packets + Stream Messages) flow through callbacks
 - **Memory Safe**: No dynamic allocation, fixed-size instances per device
 
@@ -271,9 +271,9 @@ Architecture
 The MIDI 2.0 Host driver uses a **reactive, callback-driven architecture** that mirrors the proven patterns in TinyUSB's existing device drivers (CDC, HID, etc.):
 
 - **Auto-Detection**: Host automatically detects Alt Setting 1 capability
-- **Auto-Selection**: Selects highest protocol available (MIDI 2.0 preferred)
-- **Application Control**: App makes protocol behavior decisions via callbacks
-- **Transparent I/O**: Stream Messages and UMP packets flow transparently
+- **Auto-Selection**: Selects highest protocol available and issues SET_INTERFACE
+- **Transparent I/O**: Stream Messages and UMP packets flow through callbacks
+- **Callback-Driven**: App receives events via callbacks (descriptor, mount, rx, tx, unmount)
 
 Differences from MIDI 1.0 Host
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
diff --git a/examples/host/midi2_host/CMakeLists.txt b/examples/host/midi2_host/CMakeLists.txt
index 221de7adf..cd70d122a 100644
--- a/examples/host/midi2_host/CMakeLists.txt
+++ b/examples/host/midi2_host/CMakeLists.txt
@@ -6,7 +6,8 @@ project(midi2_host C CXX ASM)
 
 family_initialize_project(${PROJECT_NAME} ${CMAKE_CURRENT_LIST_DIR})
 
-if(FAMILY STREQUAL "espressif")
+# This example requires PIO-USB and Pico SDK (I2C, SSD1306 display)
+if(NOT FAMILY STREQUAL "rp2040")
   return()
 endif()
 
diff --git a/examples/host/midi2_host/src/display.c b/examples/host/midi2_host/src/display.c
index 6d81bcd5c..4745c2961 100644
--- a/examples/host/midi2_host/src/display.c
+++ b/examples/host/midi2_host/src/display.c
@@ -190,6 +190,7 @@ void display_log(const char* text, uint16_t color) {
   if (log_count >= LOG_LINES) {
     for (int i = 0; i < LOG_LINES - 1; i++) {
       strncpy(log_lines[i], log_lines[i + 1], CHARS_PER_LINE);
+      log_lines[i][CHARS_PER_LINE] = '\0';
     }
     log_count = LOG_LINES - 1;
   }
diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 9363aac11..aecbda4c5 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -505,12 +505,19 @@ uint16_t midi2d_open(uint8_t rhport, const tusb_desc_interface_t* desc_itf, uint
   }
 
   // Skip remaining descriptors (alt setting 1, CS endpoints, GTB)
+  // Stop at any interface descriptor that is not our MIDI Streaming alt setting
   while (tu_desc_in_bounds(p_desc, desc_end)) {
     uint8_t dtype = tu_desc_type(p_desc);
-    if (dtype != TUSB_DESC_CS_INTERFACE && dtype != TUSB_DESC_CS_ENDPOINT &&
-        dtype != TUSB_DESC_INTERFACE && dtype != TUSB_DESC_ENDPOINT) {
+
+    if (dtype == TUSB_DESC_INTERFACE) {
+      const tusb_desc_interface_t* next_itf = (const tusb_desc_interface_t*) p_desc;
+      // Continue only if this is an alternate setting of our own interface
+      if (next_itf->bInterfaceNumber != desc_midi->bInterfaceNumber) break;
+    } else if (dtype != TUSB_DESC_CS_INTERFACE && dtype != TUSB_DESC_CS_ENDPOINT &&
+               dtype != TUSB_DESC_ENDPOINT) {
       break;
     }
+
     p_desc = tu_desc_next(p_desc);
   }
 
@@ -528,6 +535,9 @@ bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_re
       uint8_t itf_num = tu_u16_low(request->wIndex);
       uint8_t alt     = tu_u16_low(request->wValue);
 
+      // Only Alt Setting 0 (MIDI 1.0) and 1 (UMP) are valid
+      if (alt > 1) return false;
+
       uint8_t idx = find_midi2_itf_by_num(itf_num);
       if (idx >= CFG_TUD_MIDI2) return false;
 
diff --git a/src/class/midi/midi2_host.c b/src/class/midi/midi2_host.c
index beb441b56..5b9f98f8b 100644
--- a/src/class/midi/midi2_host.c
+++ b/src/class/midi/midi2_host.c
@@ -125,9 +125,10 @@ static inline uint8_t get_idx_by_ep_addr(uint8_t daddr, uint8_t ep_addr) {
 // Descriptor parsing
 //--------------------------------------------------------------------+
 
-static void midih2_parse_descriptors_alt0(midih2_interface_t *p_midi,
+// Parse Alt Setting 0 (MIDI 1.0) descriptors. Returns pointer past last consumed descriptor.
+static const uint8_t* midih2_parse_descriptors_alt0(midih2_interface_t *p_midi,
     const tusb_desc_interface_t *desc_itf, const uint8_t *desc_end) {
-  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass,);
+  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass, NULL);
 
   p_midi->bInterfaceNumber = desc_itf->bInterfaceNumber;
 
@@ -136,93 +137,113 @@ static void midih2_parse_descriptors_alt0(midih2_interface_t *p_midi,
 
   uint8_t rx_cable_count = 0;
   uint8_t tx_cable_count = 0;
+  bool found_new_interface = false;
 
-  while (tu_desc_in_bounds(p_desc, desc_end)) {
-    if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
-      break;
-    }
-
-    if (tu_desc_type(p_desc) == TUSB_DESC_ENDPOINT) {
-      const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
-
-      // Open endpoint and stream
-      TU_ASSERT(tuh_edpt_open(p_midi->daddr, p_ep),);
-      if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_IN) {
-        tu_edpt_stream_open(&p_midi->ep_stream.rx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
-        tu_edpt_stream_clear(&p_midi->ep_stream.rx);
-      } else {
-        tu_edpt_stream_open(&p_midi->ep_stream.tx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
-        tu_edpt_stream_clear(&p_midi->ep_stream.tx);
-      }
-
-      p_desc = tu_desc_next(p_desc);
+  while (tu_desc_in_bounds(p_desc, desc_end) && !found_new_interface) {
+    switch (tu_desc_type(p_desc)) {
+      case TUSB_DESC_INTERFACE:
+        found_new_interface = true;
+        break;
 
-      if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
-        const midi_desc_cs_endpoint_t *p_csep = (const midi_desc_cs_endpoint_t *) p_desc;
+      case TUSB_DESC_ENDPOINT: {
+        const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
 
-        if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
-          tx_cable_count = p_csep->bNumEmbMIDIJack;
+        TU_ASSERT(tuh_edpt_open(p_midi->daddr, p_ep), NULL);
+        if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_IN) {
+          tu_edpt_stream_open(&p_midi->ep_stream.rx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
+          tu_edpt_stream_clear(&p_midi->ep_stream.rx);
         } else {
-          rx_cable_count = p_csep->bNumEmbMIDIJack;
+          tu_edpt_stream_open(&p_midi->ep_stream.tx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
+          tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+        }
+
+        p_desc = tu_desc_next(p_desc);
+        if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
+          const midi_desc_cs_endpoint_t *p_csep = (const midi_desc_cs_endpoint_t *) p_desc;
+          if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
+            tx_cable_count = p_csep->bNumEmbMIDIJack;
+          } else {
+            rx_cable_count = p_csep->bNumEmbMIDIJack;
+          }
         }
+        break;
       }
+
+      default:
+        break;
     }
 
-    p_desc = tu_desc_next(p_desc);
+    if (!found_new_interface) {
+      p_desc = tu_desc_next(p_desc);
+    }
   }
 
   p_midi->rx_cable_count_alt0 = rx_cable_count;
   p_midi->tx_cable_count_alt0 = tx_cable_count;
+  return p_desc;
 }
 
-static void midih2_parse_descriptors_alt1(midih2_interface_t *p_midi,
+// Parse Alt Setting 1 (MIDI 2.0 UMP) descriptors. Returns pointer past last consumed descriptor.
+static const uint8_t* midih2_parse_descriptors_alt1(midih2_interface_t *p_midi,
     const tusb_desc_interface_t *desc_itf, const uint8_t *desc_end) {
-  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass,);
-  TU_VERIFY(desc_itf->bAlternateSetting == 1,);
+  TU_VERIFY(AUDIO_SUBCLASS_MIDI_STREAMING == desc_itf->bInterfaceSubClass, NULL);
+  TU_VERIFY(desc_itf->bAlternateSetting == 1, NULL);
 
   const uint8_t *p_desc = (const uint8_t *) desc_itf;
   p_desc = tu_desc_next(p_desc);
 
   uint8_t rx_cable_count = 0;
   uint8_t tx_cable_count = 0;
+  bool found_new_interface = false;
 
-  while (tu_desc_in_bounds(p_desc, desc_end)) {
-    if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
-      break;
-    }
+  while (tu_desc_in_bounds(p_desc, desc_end) && !found_new_interface) {
+    switch (tu_desc_type(p_desc)) {
+      case TUSB_DESC_INTERFACE:
+        found_new_interface = true;
+        break;
 
-    if (tu_desc_type(p_desc) == TUSB_DESC_CS_INTERFACE) {
-      if (tu_desc_subtype(p_desc) == MIDI_CS_INTERFACE_HEADER) {
-        const uint8_t *bcd_ptr = p_desc + 3;
-        p_midi->bcdMSC_lo = bcd_ptr[0];
-        p_midi->bcdMSC_hi = bcd_ptr[1];
+      case TUSB_DESC_CS_INTERFACE:
+        if (tu_desc_subtype(p_desc) == MIDI_CS_INTERFACE_HEADER) {
+          // bcdMSC at offset 3-4 in CS Interface Header
+          const uint8_t *bcd_ptr = p_desc + 3;
+          p_midi->bcdMSC_lo = bcd_ptr[0];
+          p_midi->bcdMSC_hi = bcd_ptr[1];
+          if (p_midi->bcdMSC_hi == 0x02) {  // bcdMSC 0x0200 = USB-MIDI 2.0
+            p_midi->protocol_version = 1;
+          }
+        }
+        break;
 
-        if (p_midi->bcdMSC_hi == 0x02) {
-          p_midi->protocol_version = 1;
+      case TUSB_DESC_ENDPOINT: {
+        const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
+        p_desc = tu_desc_next(p_desc);
+
+        if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
+          // MIDI 2.0 CS Endpoint General 2.0: bNumGrpTrmBlk at offset 3
+          if (p_desc[0] >= 4 && p_desc[2] == MIDI_CS_ENDPOINT_GENERAL_2_0) {
+            uint8_t num_grp_trm_blk = p_desc[3];
+            if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
+              tx_cable_count = num_grp_trm_blk;
+            } else {
+              rx_cable_count = num_grp_trm_blk;
+            }
+          }
         }
+        break;
       }
+
+      default:
+        break;
     }
 
-    if (tu_desc_type(p_desc) == TUSB_DESC_ENDPOINT) {
-      const tusb_desc_endpoint_t *p_ep = (const tusb_desc_endpoint_t *) p_desc;
+    if (!found_new_interface) {
       p_desc = tu_desc_next(p_desc);
-
-      if (tu_desc_in_bounds(p_desc, desc_end) && tu_desc_type(p_desc) == TUSB_DESC_CS_ENDPOINT) {
-        const midi_desc_cs_endpoint_t *p_csep = (const midi_desc_cs_endpoint_t *) p_desc;
-
-        if (tu_edpt_dir(p_ep->bEndpointAddress) == TUSB_DIR_OUT) {
-          tx_cable_count = p_csep->bNumEmbMIDIJack;
-        } else {
-          rx_cable_count = p_csep->bNumEmbMIDIJack;
-        }
-      }
     }
-
-    p_desc = tu_desc_next(p_desc);
   }
 
   p_midi->rx_cable_count_alt1 = rx_cable_count;
   p_midi->tx_cable_count_alt1 = tx_cable_count;
+  return p_desc;
 }
 
 //--------------------------------------------------------------------+
@@ -327,33 +348,20 @@ uint16_t midih2_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_interface
              desc_itf->bInterfaceNumber, desc_itf->bAlternateSetting, dev_addr);
 
   // Dispatch to appropriate parser based on Alt Setting
+  const uint8_t *p_end = NULL;
   if (desc_itf->bAlternateSetting == 0) {
-    midih2_parse_descriptors_alt0(p_midi, desc_itf, desc_end);
+    p_end = midih2_parse_descriptors_alt0(p_midi, desc_itf, desc_end);
   } else if (desc_itf->bAlternateSetting == 1) {
-    midih2_parse_descriptors_alt1(p_midi, desc_itf, desc_end);
+    p_end = midih2_parse_descriptors_alt1(p_midi, desc_itf, desc_end);
   }
 
-  return max_len;
+  // Return number of bytes consumed (following midi_host.c pattern)
+  uint16_t const parsed_len = (p_end != NULL) ? (uint16_t)(p_end - desc_start) : 0;
+  return parsed_len;
 }
 
-bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
-  uint8_t idx = 0;
-  for (idx = 0; idx < CFG_TUH_MIDI2; idx++) {
-    if (_midi2_host[idx].daddr == dev_addr && _midi2_host[idx].bInterfaceNumber == itf_num) {
-      break;
-    }
-  }
-
-  if (idx >= CFG_TUH_MIDI2) {
-    // Not our interface (e.g. Audio Control) - pass through to next
-    usbh_driver_set_config_complete(dev_addr, itf_num);
-    return true;
-  }
-
-  midih2_interface_t *p_midi = &_midi2_host[idx];
-
-  // Auto-select alt setting
-  midih2_auto_select_alt_setting(p_midi);
+static void midih2_set_config_complete(midih2_interface_t *p_midi, uint8_t idx) {
+  uint8_t dev_addr = p_midi->daddr;
 
   // Invoke descriptor_cb
   tuh_midi2_descriptor_cb_t desc_cb = {
@@ -374,7 +382,7 @@ bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
 
   // Invoke mount_cb
   tuh_midi2_mount_cb_t mount_cb = {
-    .daddr = p_midi->daddr,
+    .daddr = dev_addr,
     .bInterfaceNumber = p_midi->bInterfaceNumber,
     .protocol_version = p_midi->protocol_version,
     .alt_setting_active = p_midi->alt_setting_current,
@@ -387,7 +395,56 @@ bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
   tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx);
 
   // Signal USBH that configuration is complete
-  usbh_driver_set_config_complete(dev_addr, itf_num);
+  usbh_driver_set_config_complete(dev_addr, p_midi->bInterfaceNumber);
+}
+
+static void midih2_set_interface_cb(tuh_xfer_t *xfer) {
+  uint8_t const dev_addr = xfer->daddr;
+  uint8_t const itf_num = (uint8_t) tu_le16toh(xfer->setup->wIndex);
+
+  // Find our interface
+  for (uint8_t idx = 0; idx < CFG_TUH_MIDI2; idx++) {
+    if (_midi2_host[idx].daddr == dev_addr && _midi2_host[idx].bInterfaceNumber == itf_num) {
+      if (xfer->result == XFER_RESULT_SUCCESS) {
+        midih2_set_config_complete(&_midi2_host[idx], idx);
+      } else {
+        // SET_INTERFACE failed, fall back to alt 0
+        TU_LOG_DRV("MIDI2 SET_INTERFACE failed, falling back to alt 0\r\n");
+        _midi2_host[idx].alt_setting_current = 0;
+        midih2_set_config_complete(&_midi2_host[idx], idx);
+      }
+      return;
+    }
+  }
+}
+
+bool midih2_set_config(uint8_t dev_addr, uint8_t itf_num) {
+  uint8_t idx = 0;
+  for (idx = 0; idx < CFG_TUH_MIDI2; idx++) {
+    if (_midi2_host[idx].daddr == dev_addr && _midi2_host[idx].bInterfaceNumber == itf_num) {
+      break;
+    }
+  }
+
+  if (idx >= CFG_TUH_MIDI2) {
+    // Not our interface (e.g. Audio Control) - pass through to next
+    usbh_driver_set_config_complete(dev_addr, itf_num);
+    return true;
+  }
+
+  midih2_interface_t *p_midi = &_midi2_host[idx];
+
+  // Auto-select alt setting
+  midih2_auto_select_alt_setting(p_midi);
+
+  // If MIDI 2.0 detected, issue SET_INTERFACE to activate Alt Setting 1
+  if (p_midi->alt_setting_current == 1) {
+    TU_LOG_DRV("MIDI2 requesting SET_INTERFACE alt 1 for itf %u\r\n", itf_num);
+    TU_ASSERT(tuh_interface_set(dev_addr, itf_num, 1, midih2_set_interface_cb, 0));
+  } else {
+    // MIDI 1.0 only, complete immediately
+    midih2_set_config_complete(p_midi, idx);
+  }
 
   return true;
 }
diff --git a/src/device/usbd.h b/src/device/usbd.h
index af37eff56..a9f4c5f08 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -429,18 +429,20 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 //--------------------------------------------------------------------+
 
 // Alt Setting 1: MS Interface + MS Header (bcdMSC=0x0200)
+// wTotalLength covers MS Header + all CS Endpoint descriptors
+#define TUD_MIDI2_DESC_ALT1_CS_LEN(_numgtbs) (7 + (4 + (_numgtbs)) * 2)
 #define TUD_MIDI2_DESC_ALT1_HEAD_LEN (9 + 7)
-#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx) \
+#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx, _numgtbs) \
   /* MIDI Streaming Interface, Alt Setting 1 */\
-  9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum) + 1), 1, 2, TUSB_CLASS_AUDIO, AUDIO_SUBCLASS_MIDI_STREAMING, AUDIO_FUNC_PROTOCOL_CODE_UNDEF, _stridx,\
-  /* MS Header (MIDI 2.0) */\
-  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(7)
+  9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum) + 1), 1, 2, TUSB_CLASS_AUDIO, AUDIO_SUBCLASS_MIDI_STREAMING, AUDIO_FUNC_PROTOCOL_CODE_UNDEF, 0,\
+  /* MS Header (MIDI 2.0): wTotalLength = header + 2x CS Endpoint */\
+  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(TUD_MIDI2_DESC_ALT1_CS_LEN(_numgtbs))
 
-// Alt Setting 1: Standard USB Endpoint (7 bytes) + CS Endpoint (subtype 0x02)
+// Alt Setting 1: Standard USB Endpoint (7 bytes) + CS Endpoint General 2.0
 #define TUD_MIDI2_DESC_ALT1_EP_LEN(_numgtbs) (7 + 4 + (_numgtbs))
-#define TUD_MIDI2_DESC_ALT1_EP(_ep, _epsize, _numgtbs) \
+#define TUD_MIDI2_DESC_ALT1_EP(_ep, _epsize, _numgtbs, ...) \
   7, TUSB_DESC_ENDPOINT, _ep, TUSB_XFER_BULK, U16_TO_U8S_LE(_epsize), 0, \
-  (uint8_t)(4 + (_numgtbs)), TUSB_DESC_CS_ENDPOINT, MIDI_CS_ENDPOINT_GENERAL_2_0, _numgtbs
+  (uint8_t)(4 + (_numgtbs)), TUSB_DESC_CS_ENDPOINT, MIDI_CS_ENDPOINT_GENERAL_2_0, _numgtbs, ## __VA_ARGS__
 
 // Total length: Alt 0 (MIDI 1.0) + Alt 1 (UMP)
 #define TUD_MIDI2_DESC_LEN (TUD_MIDI_DESC_LEN + TUD_MIDI2_DESC_ALT1_HEAD_LEN + TUD_MIDI2_DESC_ALT1_EP_LEN(1) * 2)
@@ -455,11 +457,9 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   TUD_MIDI_DESC_EP(_epin, _epsize, 1),\
   TUD_MIDI_JACKID_OUT_EMB(1),\
   /* Alt Setting 1 (UMP) */\
-  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx),\
-  TUD_MIDI2_DESC_ALT1_EP(_epout, _epsize, 1),\
-  1, /* bAssoGrpTrmBlkID = 1 */\
-  TUD_MIDI2_DESC_ALT1_EP(_epin, _epsize, 1),\
-  1  /* bAssoGrpTrmBlkID = 1 */
+  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx, 1),\
+  TUD_MIDI2_DESC_ALT1_EP(_epout, _epsize, 1, 1 /* bAssoGrpTrmBlkID */),\
+  TUD_MIDI2_DESC_ALT1_EP(_epin, _epsize, 1, 1 /* bAssoGrpTrmBlkID */)
 
 //--------------------------------------------------------------------+
 // Audio Descriptor Templates
-- 
cgit v1.3.1


From f8a5fc37f3472cb2e3eb584d58e9cf4588dc4329 Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Wed, 25 Mar 2026 07:29:10 -0300
Subject: fix: CI build failures on non-RP2040 platforms

- Use UINT32_C(1) instead of 1u for bit shifts >= 16 in
  midi2_device.c to avoid shift-count-overflow on 16-bit
  platforms (MSP430)
- Add Makefiles for midi2_device and midi2_host examples with
  family guard (skip if FAMILY != rp2040). These examples
  require Pico SDK and board-specific hardware
- Restrict midi2_device CMakeLists.txt to rp2040 family
  (matching midi2_host)
---
 examples/device/midi2_device/CMakeLists.txt |  4 ++--
 examples/device/midi2_device/Makefile       | 27 +++++++++++++++++++++++++++
 examples/host/midi2_host/Makefile           | 27 +++++++++++++++++++++++++++
 src/class/midi/midi2_device.c               |  8 ++++----
 4 files changed, 60 insertions(+), 6 deletions(-)
 create mode 100644 examples/device/midi2_device/Makefile
 create mode 100644 examples/host/midi2_host/Makefile

(limited to 'src')

diff --git a/examples/device/midi2_device/CMakeLists.txt b/examples/device/midi2_device/CMakeLists.txt
index 295af6550..3f4a876c9 100644
--- a/examples/device/midi2_device/CMakeLists.txt
+++ b/examples/device/midi2_device/CMakeLists.txt
@@ -7,8 +7,8 @@ project(midi2_device C CXX ASM)
 # Checks this example is valid for the family and initializes the project
 family_initialize_project(${PROJECT_NAME} ${CMAKE_CURRENT_LIST_DIR})
 
-# Espressif has its own cmake build system
-if(FAMILY STREQUAL "espressif")
+# This example requires RP2040/RP2350 (USB descriptors and config are board-specific)
+if(NOT FAMILY STREQUAL "rp2040")
   return()
 endif()
 
diff --git a/examples/device/midi2_device/Makefile b/examples/device/midi2_device/Makefile
new file mode 100644
index 000000000..09f069c4f
--- /dev/null
+++ b/examples/device/midi2_device/Makefile
@@ -0,0 +1,27 @@
+# This example requires RP2040/RP2350 (USB descriptors and config are board-specific)
+ifeq (,$(findstring rp2040,$(FAMILY)))
+$(info Skipping midi2_device: requires FAMILY=rp2040)
+all:
+	@:
+.DEFAULT:
+	@:
+else
+
+include ../../../hw/bsp/family_support.mk
+
+INC += \
+	src \
+
+# Example source
+EXAMPLE_SOURCE += \
+  src/main.c \
+  src/usb_descriptors.c \
+
+SRC_C += $(addprefix $(EXAMPLE_PATH)/, $(EXAMPLE_SOURCE))
+
+# Suppress pre-existing warning in usbd.c
+CFLAGS_GCC += -Wno-type-limits
+
+include ../../../hw/bsp/family_rules.mk
+
+endif
diff --git a/examples/host/midi2_host/Makefile b/examples/host/midi2_host/Makefile
new file mode 100644
index 000000000..2b4660516
--- /dev/null
+++ b/examples/host/midi2_host/Makefile
@@ -0,0 +1,27 @@
+# This example requires RP2040/RP2350 (PIO-USB, Pico SDK I2C, SSD1306 display)
+ifeq (,$(findstring rp2040,$(FAMILY)))
+$(info Skipping midi2_host: requires FAMILY=rp2040)
+all:
+	@:
+.DEFAULT:
+	@:
+else
+
+include ../../../hw/bsp/family_support.mk
+
+INC += \
+	src \
+
+# Example source
+EXAMPLE_SOURCE += \
+  src/main.c \
+  src/display.c \
+
+SRC_C += $(addprefix $(EXAMPLE_PATH)/, $(EXAMPLE_SOURCE))
+
+# Suppress pre-existing warning
+CFLAGS_GCC += -Wno-type-limits
+
+include ../../../hw/bsp/family_rules.mk
+
+endif
diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index aecbda4c5..0029737ce 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -158,10 +158,10 @@ static void _nego_send_endpoint_info(midi2d_interface_t* p_midi) {
          | ((uint32_t) STREAM_ENDPOINT_INFO << 16)
          | ((uint32_t) UMP_VER_MAJOR << 8)
          | (uint32_t) UMP_VER_MINOR;
-  msg[1] = (1u << 31)  // Static Function Blocks flag
+  msg[1] = (UINT32_C(1) << 31)  // Static Function Blocks flag
          | ((uint32_t)(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS & 0x7F) << 24)
-         | (1u << 9)   // MIDI 2.0 Protocol capability
-         | (1u << 8);  // MIDI 1.0 Protocol capability
+         | (UINT32_C(1) << 9)   // MIDI 2.0 Protocol capability
+         | (UINT32_C(1) << 8);  // MIDI 1.0 Protocol capability
   _nego_send_ump(p_midi, msg, 4);
 }
 
@@ -214,7 +214,7 @@ static void _nego_send_fb_info(midi2d_interface_t* p_midi, uint8_t fb_idx) {
   uint32_t msg[4] = {0};
   msg[0] = ((uint32_t) MT_STREAM << 28)
          | ((uint32_t) STREAM_FB_INFO << 16)
-         | (1u << 15)
+         | (UINT32_C(1) << 15)
          | ((uint32_t) fb_idx << 8)
          | 0x02;  // bDirection: bidirectional
   msg[1] = ((uint32_t) 0 << 24)  // bFirstGroup
-- 
cgit v1.3.1


From 0c68ca8c1de45e24ae022ab58934c6930bad7b4b Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Tue, 21 Apr 2026 20:42:24 -0300
Subject: midi2: align ep_buf allocation with other stream-based classes

Keep the MIDI 2.0 drivers fully self-contained, with no changes to
shared or generic stack code.

Allocate the per-endpoint buffer in both midi2_host and midi2_device,
following the convention used by cdc, midi, vendor, and printer.

The class buffer struct is declared unconditionally and passed to
tu_edpt_stream_init on every init, so the streaming helpers operate
on the same shape across all classes.
---
 src/class/midi/midi2_device.c | 7 -------
 src/class/midi/midi2_host.c   | 7 -------
 2 files changed, 14 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 0029737ce..34e467fc6 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -110,14 +110,12 @@ TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS >= 1 && CFG_TUD_MIDI2_NUM_FUN
 
 static midi2d_interface_t _midi2d_itf[CFG_TUD_MIDI2];
 
-#if CFG_TUD_EDPT_DEDICATED_HWFIFO == 0
 typedef struct {
   TUD_EPBUF_DEF(epin, CFG_TUD_MIDI2_TX_EPSIZE);
   TUD_EPBUF_DEF(epout, CFG_TUD_MIDI2_RX_EPSIZE);
 } midi2d_epbuf_t;
 
 CFG_TUD_MEM_SECTION static midi2d_epbuf_t _midi2d_epbuf[CFG_TUD_MIDI2];
-#endif
 
 // Default Group Terminal Block descriptor (USB-MIDI 2.0 spec, Table 5-5/5-6)
 static const uint8_t _default_gtb_desc[] = {
@@ -385,14 +383,9 @@ void midi2d_init(void) {
     midi2d_interface_t* p_midi = &_midi2d_itf[i];
     p_midi->protocol = MIDI_PROTOCOL_MIDI2;
 
-  #if CFG_TUD_EDPT_DEDICATED_HWFIFO
-    uint8_t* epout_buf = NULL;
-    uint8_t* epin_buf  = NULL;
-  #else
     midi2d_epbuf_t* p_epbuf = &_midi2d_epbuf[i];
     uint8_t* epout_buf = p_epbuf->epout;
     uint8_t* epin_buf  = p_epbuf->epin;
-  #endif
 
     tu_edpt_stream_init(&p_midi->ep_stream.rx, false, false, false,
                         p_midi->ep_stream.rx_ff_buf, CFG_TUD_MIDI2_RX_BUFSIZE, epout_buf);
diff --git a/src/class/midi/midi2_host.c b/src/class/midi/midi2_host.c
index 5b9f98f8b..90d632a8e 100644
--- a/src/class/midi/midi2_host.c
+++ b/src/class/midi/midi2_host.c
@@ -88,14 +88,12 @@ typedef struct {
 
 static midih2_interface_t _midi2_host[CFG_TUH_MIDI2];
 
-#if CFG_TUH_EDPT_DEDICATED_HWFIFO == 0
 typedef struct {
   TUH_EPBUF_DEF(tx, TUH_EPSIZE_BULK_MAX);
   TUH_EPBUF_DEF(rx, TUH_EPSIZE_BULK_MAX);
 } midih2_epbuf_t;
 
 CFG_TUH_MEM_SECTION static midih2_epbuf_t _midi2_epbuf[CFG_TUH_MIDI2];
-#endif
 
 //--------------------------------------------------------------------+
 // Helper functions
@@ -266,13 +264,8 @@ bool midih2_init(void) {
   for (int inst = 0; inst < CFG_TUH_MIDI2; inst++) {
     midih2_interface_t *p_midi = &_midi2_host[inst];
 
-  #if CFG_TUH_EDPT_DEDICATED_HWFIFO
-    uint8_t* rx_buf = NULL;
-    uint8_t* tx_buf = NULL;
-  #else
     uint8_t* rx_buf = _midi2_epbuf[inst].rx;
     uint8_t* tx_buf = _midi2_epbuf[inst].tx;
-  #endif
 
     tu_edpt_stream_init(&p_midi->ep_stream.rx, true, false, false,
       p_midi->ep_stream.rx_ff_buf, CFG_TUH_MIDI2_RX_BUFSIZE, rx_buf);
-- 
cgit v1.3.1


From 97852816e873bf7f91f3a81f093ad08f96179656 Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Wed, 22 Apr 2026 18:04:56 -0300
Subject: midi2: align descriptors with USB-MIDI 2.0 spec

Brings the MIDI 2.0 device driver into full conformance with USB
Device Class Definition for MIDI Devices v2.0 (USB-IF, May 2020).

- Alt 1 MS Interface Header wTotalLength now reports 0x0007 per
  Table 5-2 ("set to match bLength"), replacing the prior 0x0011
  carried over from USB-MIDI 1.0 conventions.
- GET_DESCRIPTOR class request now validates bmRequestType direction,
  type and recipient plus wIndex and wValue high byte per Section 6.
- iBlockItem in the default Group Terminal Block is driven by
  CFG_TUD_MIDI2_BLOCK_STRIDX so applications can attach a UI string
  descriptor to the block per Table 5-6.
- UMP word byte order assumption (little-endian host per Section
  3.2.2) is documented inline so future big-endian ports know where
  to wrap access with tu_htole32 / tu_le32toh.

Validated on RP2040 and ESP32-P4 under Linux kernel 6.17: lsusb -v
reports wTotalLength = 0x0007 on Alt 1 MS Header (raw bytes
07 24 01 00 02 07 00). amidi -l enumerates Group Terminals exposed
via the class-specific GET_DESCRIPTOR response.
---
 src/class/midi/midi2_device.c                      | 47 ++++++++++++++++------
 src/device/usbd.h                                  | 12 +++---
 src/tusb_option.h                                  |  6 +++
 .../test/device/midi2/test_midi2_device.c          |  3 ++
 4 files changed, 49 insertions(+), 19 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 34e467fc6..15daad096 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -43,6 +43,16 @@ TU_ATTR_WEAK bool tud_midi2_get_req_itf_cb(uint8_t rhport, const tusb_control_re
   (void) rhport; (void) request; return false;
 }
 
+//--------------------------------------------------------------------+
+// Byte order note
+//--------------------------------------------------------------------+
+// Per USB-MIDI 2.0 Section 3.2.2, each 32-bit UMP word is transmitted with the
+// least significant byte first. This driver reads and writes UMP words as
+// native uint32_t through tu_edpt_stream_read/write. All TinyUSB targets are
+// little-endian, so the in-memory layout already matches the wire order and no
+// swap is needed. If a big-endian target is ever supported, wrap access with
+// tu_htole32 / tu_le32toh at the buffer boundary.
+
 //--------------------------------------------------------------------+
 // UMP Stream Message Constants
 //--------------------------------------------------------------------+
@@ -133,7 +143,7 @@ static const uint8_t _default_gtb_desc[] = {
   0x00,                                     // bGrpTrmBlkType: bidirectional
   0x00,                                     // nGroupTrm: first group (0)
   CFG_TUD_MIDI2_NUM_GROUPS,                 // nNumGroupTrm
-  0,                                        // iBlockItem: no string
+  CFG_TUD_MIDI2_BLOCK_STRIDX,               // iBlockItem: string descriptor index (0 = none)
   0x00,                                     // bMIDIProtocol: unknown/not fixed
   0, 0,                                     // wMaxInputBandwidth: unknown
   0, 0                                      // wMaxOutputBandwidth: unknown
@@ -554,19 +564,30 @@ bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_re
     }
 
     case TUSB_REQ_GET_DESCRIPTOR: {
-      // wValue: descriptor type (high) | index (low)
-      // 0x26 = CS_GRP_TRM_BLOCK, index 0x01
-      if (request->wValue == ((uint16_t)MIDI2_CS_GRP_TRM_BLOCK << 8 | 0x01)) {
-        if (tud_midi2_get_req_itf_cb(rhport, request)) return true;
-
-        uint16_t len = request->wLength;
-        if (len > sizeof(_default_gtb_desc)) {
-          len = sizeof(_default_gtb_desc);
-        }
-        tud_control_xfer(rhport, request, (void*)(uintptr_t) _default_gtb_desc, len);
-        return true;
+      // USB-MIDI 2.0 Section 6: GTB descriptor retrieval
+      //   bmRequestType = 0x81 (Device-to-Host, Standard, Interface)
+      //   wValue  = CS_GR_TRM_BLOCK (0x26) in high byte, alt setting in low byte
+      //   wIndex  = interface number
+      if (request->bmRequestType_bit.direction != TUSB_DIR_IN) return false;
+      if (request->bmRequestType_bit.type      != TUSB_REQ_TYPE_STANDARD) return false;
+      if (request->bmRequestType_bit.recipient != TUSB_REQ_RCPT_INTERFACE) return false;
+      if (tu_u16_high(request->wValue)         != MIDI2_CS_GRP_TRM_BLOCK) return false;
+
+      uint8_t itf_num = tu_u16_low(request->wIndex);
+      uint8_t idx     = find_midi2_itf_by_num(itf_num);
+      if (idx >= CFG_TUD_MIDI2) return false;
+
+      // Only Alt Setting 1 exposes Group Terminal Block descriptors.
+      if (tu_u16_low(request->wValue) != 0x01) return false;
+
+      if (tud_midi2_get_req_itf_cb(rhport, request)) return true;
+
+      uint16_t len = request->wLength;
+      if (len > sizeof(_default_gtb_desc)) {
+        len = sizeof(_default_gtb_desc);
       }
-      return false;
+      tud_control_xfer(rhport, request, (void*)(uintptr_t) _default_gtb_desc, len);
+      return true;
     }
 
     default:
diff --git a/src/device/usbd.h b/src/device/usbd.h
index a9f4c5f08..abce5a887 100644
--- a/src/device/usbd.h
+++ b/src/device/usbd.h
@@ -429,14 +429,14 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
 //--------------------------------------------------------------------+
 
 // Alt Setting 1: MS Interface + MS Header (bcdMSC=0x0200)
-// wTotalLength covers MS Header + all CS Endpoint descriptors
-#define TUD_MIDI2_DESC_ALT1_CS_LEN(_numgtbs) (7 + (4 + (_numgtbs)) * 2)
+// Per USB-MIDI 2.0 Table 5-2: wTotalLength in the MS Header is not used in 2.0
+// and shall be set to match bLength (= 0x0007) for conformity with USB-MIDI 1.0.
 #define TUD_MIDI2_DESC_ALT1_HEAD_LEN (9 + 7)
-#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx, _numgtbs) \
+#define TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx) \
   /* MIDI Streaming Interface, Alt Setting 1 */\
   9, TUSB_DESC_INTERFACE, (uint8_t)((_itfnum) + 1), 1, 2, TUSB_CLASS_AUDIO, AUDIO_SUBCLASS_MIDI_STREAMING, AUDIO_FUNC_PROTOCOL_CODE_UNDEF, 0,\
-  /* MS Header (MIDI 2.0): wTotalLength = header + 2x CS Endpoint */\
-  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(TUD_MIDI2_DESC_ALT1_CS_LEN(_numgtbs))
+  /* MS Header (MIDI 2.0): wTotalLength = bLength per spec */\
+  7, TUSB_DESC_CS_INTERFACE, MIDI_CS_INTERFACE_HEADER, U16_TO_U8S_LE(0x0200), U16_TO_U8S_LE(0x0007)
 
 // Alt Setting 1: Standard USB Endpoint (7 bytes) + CS Endpoint General 2.0
 #define TUD_MIDI2_DESC_ALT1_EP_LEN(_numgtbs) (7 + 4 + (_numgtbs))
@@ -457,7 +457,7 @@ bool tud_vendor_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_requ
   TUD_MIDI_DESC_EP(_epin, _epsize, 1),\
   TUD_MIDI_JACKID_OUT_EMB(1),\
   /* Alt Setting 1 (UMP) */\
-  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx, 1),\
+  TUD_MIDI2_DESC_ALT1_HEAD(_itfnum, _stridx),\
   TUD_MIDI2_DESC_ALT1_EP(_epout, _epsize, 1, 1 /* bAssoGrpTrmBlkID */),\
   TUD_MIDI2_DESC_ALT1_EP(_epin, _epsize, 1, 1 /* bAssoGrpTrmBlkID */)
 
diff --git a/src/tusb_option.h b/src/tusb_option.h
index 4483c2200..2614110fc 100644
--- a/src/tusb_option.h
+++ b/src/tusb_option.h
@@ -682,6 +682,12 @@
   #define CFG_TUD_MIDI2_PRODUCT_ID  "TinyUSB-MIDI2"
 #endif
 
+// String descriptor index for the Group Terminal Block (iBlockItem, Table 5-6).
+// 0 = no string descriptor (default, spec-allowed).
+#ifndef CFG_TUD_MIDI2_BLOCK_STRIDX
+  #define CFG_TUD_MIDI2_BLOCK_STRIDX 0
+#endif
+
 #ifndef CFG_TUD_VENDOR
   #define CFG_TUD_VENDOR          0
 #endif
diff --git a/test/unit-test/test/device/midi2/test_midi2_device.c b/test/unit-test/test/device/midi2/test_midi2_device.c
index 9d716d93b..1314c2585 100644
--- a/test/unit-test/test/device/midi2/test_midi2_device.c
+++ b/test/unit-test/test/device/midi2/test_midi2_device.c
@@ -147,6 +147,9 @@ void test_midi2_descriptor_bytes(void) {
   TEST_ASSERT_EQUAL(MIDI_CS_INTERFACE_HEADER, desc[ms2_offset + 2]);
   TEST_ASSERT_EQUAL(0x00, desc[ms2_offset + 3]);
   TEST_ASSERT_EQUAL(0x02, desc[ms2_offset + 4]);
+  // USB-MIDI 2.0 Table 5-2: wTotalLength shall match bLength (= 0x0007)
+  TEST_ASSERT_EQUAL(0x07, desc[ms2_offset + 5]);
+  TEST_ASSERT_EQUAL(0x00, desc[ms2_offset + 6]);
 }
 
 void test_midi2_descriptor_alt1_cs_endpoint_subtype(void) {
-- 
cgit v1.3.1


From 1f662779c44dd913f2c26f9bddc4f37ee70f16dc Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Tue, 12 May 2026 19:57:09 +0200
Subject: dcd/dwc2: fix ISO IN endpoint become disabled after incomplete
 transfer

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/synopsys/dwc2/dcd_dwc2.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 30e24a9ad..1d0ef45d2 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -1136,8 +1136,9 @@ static void handle_incomplete_iso_in(uint8_t rhport) {
         }
         epin->diepctl = depctl.value;
       } else {
-        // too many retries, give up
+        // too many retries, give up, but keep endpoint activated
         edpt_disable(rhport, epnum | TUSB_DIR_IN_MASK, false);
+        epin->diepctl |= DIEPCTL_USBAEP;
         dcd_event_xfer_complete(rhport, epnum | TUSB_DIR_IN_MASK, 0, XFER_RESULT_FAILED, true);
       }
     }
-- 
cgit v1.3.1


From 72e09788e46a8ffaaae8009a316915838927af90 Mon Sep 17 00:00:00 2001
From: Boris Dolgov <boris@dolgov.name>
Date: Fri, 15 May 2026 21:28:21 +0200
Subject: rp2040: fix host SET_REPORT (and any OUT-data control xfer) sending
 DATA0 instead of DATA1

hcd_edpt_xfer() previously reset ep->next_pid to 1 only when the control
endpoint direction changed between stages. That handled IN-data control
transfers (e.g. GET_REPORT, GET_DESCRIPTOR) where SETUP is OUT and DATA is
IN, but not OUT-data class requests like SET_REPORT, where SETUP and DATA
are both OUT and the direction-change check is false. ep->next_pid was
left at 0 from hcd_edpt_open(), so the DATA stage went on the wire as
DATA0 when the device expected DATA1. Strict devices (observed: Elgato
Stream Deck) treat this as a protocol violation and disconnect.

Key off "endpoint 0" instead of "direction changed", restoring the
previous behavior. Interrupt/bulk endpoints take the ep->interrupt_num > 0
branch above and never reach this code, so they are unaffected.
---
 src/portable/raspberrypi/rp2040/hcd_rp2040.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/portable/raspberrypi/rp2040/hcd_rp2040.c b/src/portable/raspberrypi/rp2040/hcd_rp2040.c
index 02a4e055e..064834efb 100644
--- a/src/portable/raspberrypi/rp2040/hcd_rp2040.c
+++ b/src/portable/raspberrypi/rp2040/hcd_rp2040.c
@@ -617,10 +617,16 @@ bool hcd_edpt_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr, uint8_t *b
     io_rw_32 *buf_reg = dpram_int_ep_buffer_ctrl(ep->interrupt_num);
     rp2usb_xfer_start(ep, ep_reg, buf_reg, buffer, NULL, buflen);
   } else {
-    // Control endpoint can change direction 0x00 <-> 0x80 when changing stages
-    if (ep_addr != ep->ep_addr) {
+    // Control transfer data and status stages always start with DATA1, regardless of
+    // whether the direction changed since the previous stage. SET_REPORT (and any other
+    // host-to-device class request with an OUT data stage) keeps the same direction
+    // across SETUP -> DATA, so we cannot key off "direction changed" -- we must reset
+    // next_pid every time hcd_edpt_xfer is invoked on ep 0. Without this, the data stage
+    // of SET_REPORT goes out as DATA0 because ep->next_pid is still 0 from hcd_edpt_open(),
+    // which strict devices treat as a protocol violation and disconnect.
+    if (tu_edpt_number(ep_addr) == 0) {
       ep->ep_addr  = ep_addr;
-      ep->next_pid = 1; // data and status stage start with DATA1
+      ep->next_pid = 1;
     }
 
     // If EPX is busy with another transfer, mark as pending
-- 
cgit v1.3.1


From 0af0665ed65ef9574a4c3c2da83c1c502cb713de Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Sat, 16 May 2026 12:59:03 -0300
Subject: midi2: reject UMP read/write API on alt setting 0

Alt 0 carries USB-MIDI 1.0 32-bit Event Packets, not UMP words; calling
the UMP API there would misinterpret the stream. Expose MIDI_PROTOCOL_MIDI1
and MIDI_PROTOCOL_MIDI2 in the public header so applications can branch on
the negotiated protocol.

Ref #3571
---
 src/class/midi/midi2_device.c | 16 ++++++++++------
 src/class/midi/midi2_device.h |  9 +++++++++
 2 files changed, 19 insertions(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 15daad096..f7d338ede 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -73,12 +73,6 @@ enum {
   STREAM_FB_INFO            = 0x011,
 };
 
-// MIDI Protocol values (per USB-MIDI 2.0 spec)
-enum {
-  MIDI_PROTOCOL_MIDI1       = 0x01,
-  MIDI_PROTOCOL_MIDI2       = 0x02,
-};
-
 enum {
   UMP_VER_MAJOR = 1,
   UMP_VER_MINOR = 1,
@@ -304,6 +298,11 @@ uint32_t tud_midi2_n_available(uint8_t itf) {
 uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words) {
   TU_VERIFY(itf < CFG_TUD_MIDI2 && words != NULL && max_words > 0, 0);
   midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+
+  // UMP API is only valid on Alt Setting 1 (USB-MIDI 2.0).
+  // Alt 0 carries USB-MIDI 1.0 32-bit Event Packets, not UMP words.
+  if (p_midi->alt_setting != 1) { return 0; }
+
   tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
 
   uint32_t total_read = 0;
@@ -336,6 +335,11 @@ bool tud_midi2_n_packet_read(uint8_t itf, uint8_t packet[4]) {
 uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t count) {
   TU_VERIFY(itf < CFG_TUD_MIDI2 && words != NULL && count > 0, 0);
   midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+
+  // UMP API is only valid on Alt Setting 1 (USB-MIDI 2.0).
+  // Alt 0 carries USB-MIDI 1.0 32-bit Event Packets, not UMP words.
+  if (p_midi->alt_setting != 1) { return 0; }
+
   tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
   TU_VERIFY(tu_edpt_stream_is_opened(ep_tx), 0);
 
diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
index dac1f0124..8c64729c3 100644
--- a/src/class/midi/midi2_device.h
+++ b/src/class/midi/midi2_device.h
@@ -44,6 +44,15 @@
 extern "C" {
 #endif
 
+//--------------------------------------------------------------------+
+// MIDI Protocol Values (returned by tud_midi2_n_protocol)
+//--------------------------------------------------------------------+
+// Per USB-MIDI 2.0 spec, UMP Stream Configuration messages.
+enum {
+  MIDI_PROTOCOL_MIDI1 = 0x01,
+  MIDI_PROTOCOL_MIDI2 = 0x02,
+};
+
 //--------------------------------------------------------------------+
 // Application Callback API (weak, optional)
 //--------------------------------------------------------------------+
-- 
cgit v1.3.1


From 840f3e0a628e69a2b7fb4136b2dca8ab5b350f83 Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Sat, 16 May 2026 12:59:44 -0300
Subject: midi2: prevent UMP packet split across USB transfers

The edpt_stream auto-flush is byte-oriented and could cut an UMP message
in half when the FIFO reached wMaxPacketSize, corrupting the peer's RX
context. Pre-flush whole packets before writing one that would cross the
boundary on both device (tud_midi2_n_ump_write) and host
(tuh_midi2_ump_write) paths. Host write also becomes packet-aware
instead of word-by-word.

Ref #3571
---
 src/class/midi/midi2_device.c | 13 +++++++++++--
 src/class/midi/midi2_host.c   | 27 +++++++++++++++++++--------
 2 files changed, 30 insertions(+), 10 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index f7d338ede..a005c8e51 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -347,11 +347,20 @@ uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t coun
   while (written < count) {
     uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F);
     uint8_t pkt_words = midi2_ump_word_count(mt);
+    uint32_t pkt_bytes = (uint32_t)pkt_words * 4;
 
     if (written + pkt_words > count) break;
-    if (tu_edpt_stream_write_available(ep_tx) < pkt_words * 4) break;
+    if (tu_edpt_stream_write_available(ep_tx) < pkt_bytes) break;
+
+    // Flush whole packets already queued before adding one that would cross
+    // the wMaxPacketSize boundary. Prevents an UMP message from being split
+    // across two USB transfers, which would corrupt the host RX context.
+    uint16_t ff_count = tu_fifo_count(&ep_tx->ff);
+    if (ff_count > 0 && ff_count + pkt_bytes > ep_tx->mps) {
+      tu_edpt_stream_write_xfer(ep_tx);
+    }
 
-    tu_edpt_stream_write(ep_tx, &words[written], pkt_words * 4);
+    tu_edpt_stream_write(ep_tx, &words[written], pkt_bytes);
     written += pkt_words;
   }
 
diff --git a/src/class/midi/midi2_host.c b/src/class/midi/midi2_host.c
index 90d632a8e..2046fdb67 100644
--- a/src/class/midi/midi2_host.c
+++ b/src/class/midi/midi2_host.c
@@ -527,17 +527,28 @@ uint32_t tuh_midi2_ump_write(uint8_t idx, const uint32_t* words, uint32_t count)
   midih2_interface_t *p_midi = &_midi2_host[idx];
   tu_edpt_stream_t *ep_tx = &p_midi->ep_stream.tx;
 
-  uint32_t n_words = 0;
-  for (uint32_t i = 0; i < count; i++) {
-    if (tu_edpt_stream_write_available(ep_tx) >= 4) {
-      tu_edpt_stream_write(ep_tx, (const uint8_t *) &words[i], 4);
-      n_words++;
-    } else {
-      break;
+  uint32_t written = 0;
+  while (written < count) {
+    uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F);
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+    uint32_t pkt_bytes = (uint32_t)pkt_words * 4;
+
+    if (written + pkt_words > count) break;
+    if (tu_edpt_stream_write_available(ep_tx) < pkt_bytes) break;
+
+    // Flush whole packets already queued before adding one that would cross
+    // the wMaxPacketSize boundary. Prevents an UMP message from being split
+    // across two USB transfers, which would corrupt the peer RX context.
+    uint16_t ff_count = tu_fifo_count(&ep_tx->ff);
+    if (ff_count > 0 && ff_count + pkt_bytes > ep_tx->mps) {
+      tu_edpt_stream_write_xfer(ep_tx);
     }
+
+    tu_edpt_stream_write(ep_tx, (const uint8_t *) &words[written], pkt_bytes);
+    written += pkt_words;
   }
 
-  return n_words;
+  return written;
 }
 
 uint32_t tuh_midi2_write_flush(uint8_t idx) {
-- 
cgit v1.3.1


From 7c214f9d4f47cfadf18fc7e67d15cc22b1bc6f99 Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Sat, 16 May 2026 21:35:21 -0300
Subject: midi2: add sources to TINYUSB_SRC_C, skip family

Make build was missing midi2_device.c/midi2_host.c from
src/tinyusb.mk. Skip stm32h7s3nucleo board which exposes a
pre-existing uninitialized warning in its board.h (board_init2)
under Make+LTO.
---
 examples/device/midi2_device/skip.txt | 1 +
 examples/host/midi2_host/skip.txt     | 1 +
 src/tinyusb.mk                        | 2 ++
 3 files changed, 4 insertions(+)

(limited to 'src')

diff --git a/examples/device/midi2_device/skip.txt b/examples/device/midi2_device/skip.txt
index eadb6e74a..3bc342bff 100644
--- a/examples/device/midi2_device/skip.txt
+++ b/examples/device/midi2_device/skip.txt
@@ -1 +1,2 @@
 mcu:SAMD11
+board:stm32h7s3nucleo
diff --git a/examples/host/midi2_host/skip.txt b/examples/host/midi2_host/skip.txt
index 308796869..ee7ed0fc0 100644
--- a/examples/host/midi2_host/skip.txt
+++ b/examples/host/midi2_host/skip.txt
@@ -1 +1,2 @@
 board:lpcxpresso54114
+board:stm32h7s3nucleo
diff --git a/src/tinyusb.mk b/src/tinyusb.mk
index e3ef35dcf..365043927 100644
--- a/src/tinyusb.mk
+++ b/src/tinyusb.mk
@@ -10,6 +10,7 @@ TINYUSB_SRC_C += \
 	src/class/dfu/dfu_rt_device.c \
 	src/class/hid/hid_device.c \
 	src/class/midi/midi_device.c \
+	src/class/midi/midi2_device.c \
 	src/class/msc/msc_device.c \
 	src/class/mtp/mtp_device.c \
 	src/class/net/ecm_rndis_device.c \
@@ -23,5 +24,6 @@ TINYUSB_SRC_C += \
   src/class/cdc/cdc_host.c \
   src/class/hid/hid_host.c \
   src/class/midi/midi_host.c \
+  src/class/midi/midi2_host.c \
   src/class/msc/msc_host.c \
   src/class/vendor/vendor_host.c \
-- 
cgit v1.3.1


From 3f209e2a00538726992ba908fe905213c78a9f6e Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Sun, 17 May 2026 14:11:53 +0200
Subject: midi2: move config to class header

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/class/midi/midi2_device.h | 43 +++++++++++++++++++++++++++++++++++++++++++
 src/tusb_option.h             | 38 --------------------------------------
 2 files changed, 43 insertions(+), 38 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
index 8c64729c3..b7caf97a3 100644
--- a/src/class/midi/midi2_device.h
+++ b/src/class/midi/midi2_device.h
@@ -44,9 +44,52 @@
 extern "C" {
 #endif
 
+//--------------------------------------------------------------------+
+// Class Driver Configuration
+//--------------------------------------------------------------------+
+
+#ifndef CFG_TUD_MIDI2_TX_BUFSIZE
+  #define CFG_TUD_MIDI2_TX_BUFSIZE  TUD_EPSIZE_BULK_MAX
+#endif
+
+#ifndef CFG_TUD_MIDI2_RX_BUFSIZE
+  #define CFG_TUD_MIDI2_RX_BUFSIZE  TUD_EPSIZE_BULK_MAX
+#endif
+
+#ifndef CFG_TUD_MIDI2_TX_EPSIZE
+  #define CFG_TUD_MIDI2_TX_EPSIZE   TUD_EPSIZE_BULK_MAX
+#endif
+
+#ifndef CFG_TUD_MIDI2_RX_EPSIZE
+  #define CFG_TUD_MIDI2_RX_EPSIZE   TUD_EPSIZE_BULK_MAX
+#endif
+
+#ifndef CFG_TUD_MIDI2_NUM_GROUPS
+  #define CFG_TUD_MIDI2_NUM_GROUPS  1
+#endif
+
+#ifndef CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS
+  #define CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS 1
+#endif
+
+#ifndef CFG_TUD_MIDI2_EP_NAME
+  #define CFG_TUD_MIDI2_EP_NAME     "TinyUSB MIDI 2.0"
+#endif
+
+#ifndef CFG_TUD_MIDI2_PRODUCT_ID
+  #define CFG_TUD_MIDI2_PRODUCT_ID  "TinyUSB-MIDI2"
+#endif
+
+// String descriptor index for the Group Terminal Block (iBlockItem, Table 5-6).
+// 0 = no string descriptor (default, spec-allowed).
+#ifndef CFG_TUD_MIDI2_BLOCK_STRIDX
+  #define CFG_TUD_MIDI2_BLOCK_STRIDX 0
+#endif
+
 //--------------------------------------------------------------------+
 // MIDI Protocol Values (returned by tud_midi2_n_protocol)
 //--------------------------------------------------------------------+
+
 // Per USB-MIDI 2.0 spec, UMP Stream Configuration messages.
 enum {
   MIDI_PROTOCOL_MIDI1 = 0x01,
diff --git a/src/tusb_option.h b/src/tusb_option.h
index 2614110fc..0114b86ee 100644
--- a/src/tusb_option.h
+++ b/src/tusb_option.h
@@ -650,44 +650,6 @@
   #define CFG_TUD_MIDI2           0
 #endif
 
-#ifndef CFG_TUD_MIDI2_TX_BUFSIZE
-  #define CFG_TUD_MIDI2_TX_BUFSIZE  256
-#endif
-
-#ifndef CFG_TUD_MIDI2_RX_BUFSIZE
-  #define CFG_TUD_MIDI2_RX_BUFSIZE  256
-#endif
-
-#ifndef CFG_TUD_MIDI2_TX_EPSIZE
-  #define CFG_TUD_MIDI2_TX_EPSIZE   64
-#endif
-
-#ifndef CFG_TUD_MIDI2_RX_EPSIZE
-  #define CFG_TUD_MIDI2_RX_EPSIZE   64
-#endif
-
-#ifndef CFG_TUD_MIDI2_NUM_GROUPS
-  #define CFG_TUD_MIDI2_NUM_GROUPS  1
-#endif
-
-#ifndef CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS
-  #define CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS 1
-#endif
-
-#ifndef CFG_TUD_MIDI2_EP_NAME
-  #define CFG_TUD_MIDI2_EP_NAME     "TinyUSB MIDI 2.0"
-#endif
-
-#ifndef CFG_TUD_MIDI2_PRODUCT_ID
-  #define CFG_TUD_MIDI2_PRODUCT_ID  "TinyUSB-MIDI2"
-#endif
-
-// String descriptor index for the Group Terminal Block (iBlockItem, Table 5-6).
-// 0 = no string descriptor (default, spec-allowed).
-#ifndef CFG_TUD_MIDI2_BLOCK_STRIDX
-  #define CFG_TUD_MIDI2_BLOCK_STRIDX 0
-#endif
-
 #ifndef CFG_TUD_VENDOR
   #define CFG_TUD_VENDOR          0
 #endif
-- 
cgit v1.3.1


From e00ac15b7f31be28ff888a5220cbde93a61c17f4 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Sun, 17 May 2026 14:35:34 +0200
Subject: midi2: use hwfifo if supported

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/class/midi/midi2_device.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index a005c8e51..360d70967 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -114,12 +114,15 @@ TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS >= 1 && CFG_TUD_MIDI2_NUM_FUN
 
 static midi2d_interface_t _midi2d_itf[CFG_TUD_MIDI2];
 
+// Skip local EP buffer if dedicated hw FIFO is supported
+#if CFG_TUD_EDPT_DEDICATED_HWFIFO == 0
 typedef struct {
   TUD_EPBUF_DEF(epin, CFG_TUD_MIDI2_TX_EPSIZE);
   TUD_EPBUF_DEF(epout, CFG_TUD_MIDI2_RX_EPSIZE);
 } midi2d_epbuf_t;
 
 CFG_TUD_MEM_SECTION static midi2d_epbuf_t _midi2d_epbuf[CFG_TUD_MIDI2];
+#endif
 
 // Default Group Terminal Block descriptor (USB-MIDI 2.0 spec, Table 5-5/5-6)
 static const uint8_t _default_gtb_desc[] = {
@@ -406,9 +409,13 @@ void midi2d_init(void) {
     midi2d_interface_t* p_midi = &_midi2d_itf[i];
     p_midi->protocol = MIDI_PROTOCOL_MIDI2;
 
-    midi2d_epbuf_t* p_epbuf = &_midi2d_epbuf[i];
-    uint8_t* epout_buf = p_epbuf->epout;
-    uint8_t* epin_buf  = p_epbuf->epin;
+  #if CFG_TUD_EDPT_DEDICATED_HWFIFO
+    uint8_t *epout_buf = NULL;
+    uint8_t *epin_buf  = NULL;
+  #else
+    uint8_t *epout_buf = _midi2d_epbuf[i].epout;
+    uint8_t *epin_buf  = _midi2d_epbuf[i].epin;
+  #endif
 
     tu_edpt_stream_init(&p_midi->ep_stream.rx, false, false, false,
                         p_midi->ep_stream.rx_ff_buf, CFG_TUD_MIDI2_RX_BUFSIZE, epout_buf);
-- 
cgit v1.3.1


From 5ac6346dd4980af75973e53dd130e7ee2a9af32d Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Sun, 17 May 2026 11:31:12 -0300
Subject: midi2: peek 4 bytes for MT, restore 256 buffers

MT is in byte 3 of the UMP word in LE memory, not byte 0. Buffers
at mps blocked RX xfer re-arm on partial packets.
---
 src/class/midi/midi2_device.c | 15 +++++++++------
 src/class/midi/midi2_device.h |  4 ++--
 2 files changed, 11 insertions(+), 8 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 360d70967..48cb3d388 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -266,10 +266,12 @@ static void _nego_handle_stream_msg(midi2d_interface_t* p_midi, const uint32_t*
 
 static void _nego_process_rx(midi2d_interface_t* p_midi) {
   tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
-  uint8_t first_byte;
+  uint8_t word_bytes[4];
 
-  while (tu_edpt_stream_peek(ep_rx, &first_byte)) {
-    uint8_t mt = (first_byte >> 4) & 0x0F;
+  while (tu_fifo_peek_n(&ep_rx->ff, word_bytes, 4) == 4) {
+    // UMP words travel LSB-first on the wire and in LE memory, so MT is in
+    // the high nibble of byte 3, not byte 0.
+    uint8_t mt = (word_bytes[3] >> 4) & 0x0F;
     uint8_t pkt_words = midi2_ump_word_count(mt);
     uint32_t pkt_bytes = (uint32_t)pkt_words * 4;
 
@@ -310,10 +312,11 @@ uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words)
 
   uint32_t total_read = 0;
   while (total_read < max_words) {
-    uint8_t first_byte;
-    if (!tu_edpt_stream_peek(ep_rx, &first_byte)) break;
+    uint8_t word_bytes[4];
+    if (tu_fifo_peek_n(&ep_rx->ff, word_bytes, 4) < 4) break;
 
-    uint8_t mt = (first_byte >> 4) & 0x0F;
+    // UMP words travel LSB-first; MT is the high nibble of byte 3, not byte 0.
+    uint8_t mt = (word_bytes[3] >> 4) & 0x0F;
     uint8_t pkt_words = midi2_ump_word_count(mt);
 
     if (total_read + pkt_words > max_words) break;
diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
index b7caf97a3..a1c51f047 100644
--- a/src/class/midi/midi2_device.h
+++ b/src/class/midi/midi2_device.h
@@ -49,11 +49,11 @@ extern "C" {
 //--------------------------------------------------------------------+
 
 #ifndef CFG_TUD_MIDI2_TX_BUFSIZE
-  #define CFG_TUD_MIDI2_TX_BUFSIZE  TUD_EPSIZE_BULK_MAX
+  #define CFG_TUD_MIDI2_TX_BUFSIZE  256
 #endif
 
 #ifndef CFG_TUD_MIDI2_RX_BUFSIZE
-  #define CFG_TUD_MIDI2_RX_BUFSIZE  TUD_EPSIZE_BULK_MAX
+  #define CFG_TUD_MIDI2_RX_BUFSIZE  256
 #endif
 
 #ifndef CFG_TUD_MIDI2_TX_EPSIZE
-- 
cgit v1.3.1


From 4b729bfb9274af44f8edfba2134893a6889cfd03 Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Sun, 17 May 2026 12:19:45 -0300
Subject: midi2: per-interface weak callbacks for UMP Stream config

Lets each instance return different NUM_GROUPS, NUM_FUNCTION_BLOCKS,
EP_NAME and PRODUCT_ID. Defaults fall back to the macros.
---
 src/class/midi/midi2_device.c | 29 +++++++++++++++++++++++------
 src/class/midi/midi2_device.h |  6 ++++++
 2 files changed, 29 insertions(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 48cb3d388..534458a24 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -42,6 +42,18 @@ TU_ATTR_WEAK void tud_midi2_set_itf_cb(uint8_t itf, uint8_t alt) { (void) itf; (
 TU_ATTR_WEAK bool tud_midi2_get_req_itf_cb(uint8_t rhport, const tusb_control_request_t* request) {
   (void) rhport; (void) request; return false;
 }
+TU_ATTR_WEAK uint8_t tud_midi2_num_groups_cb(uint8_t itf) {
+  (void) itf; return CFG_TUD_MIDI2_NUM_GROUPS;
+}
+TU_ATTR_WEAK uint8_t tud_midi2_num_function_blocks_cb(uint8_t itf) {
+  (void) itf; return CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS;
+}
+TU_ATTR_WEAK const char* tud_midi2_ep_name_cb(uint8_t itf) {
+  (void) itf; return CFG_TUD_MIDI2_EP_NAME;
+}
+TU_ATTR_WEAK const char* tud_midi2_product_id_cb(uint8_t itf) {
+  (void) itf; return CFG_TUD_MIDI2_PRODUCT_ID;
+}
 
 //--------------------------------------------------------------------+
 // Byte order note
@@ -114,6 +126,10 @@ TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS >= 1 && CFG_TUD_MIDI2_NUM_FUN
 
 static midi2d_interface_t _midi2d_itf[CFG_TUD_MIDI2];
 
+static inline uint8_t _itf_idx(const midi2d_interface_t* p_midi) {
+  return (uint8_t)(p_midi - _midi2d_itf);
+}
+
 // Skip local EP buffer if dedicated hw FIFO is supported
 #if CFG_TUD_EDPT_DEDICATED_HWFIFO == 0
 typedef struct {
@@ -164,7 +180,7 @@ static void _nego_send_endpoint_info(midi2d_interface_t* p_midi) {
          | ((uint32_t) UMP_VER_MAJOR << 8)
          | (uint32_t) UMP_VER_MINOR;
   msg[1] = (UINT32_C(1) << 31)  // Static Function Blocks flag
-         | ((uint32_t)(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS & 0x7F) << 24)
+         | ((uint32_t)(tud_midi2_num_function_blocks_cb(_itf_idx(p_midi)) & 0x7F) << 24)
          | (UINT32_C(1) << 9)   // MIDI 2.0 Protocol capability
          | (UINT32_C(1) << 8);  // MIDI 1.0 Protocol capability
   _nego_send_ump(p_midi, msg, 4);
@@ -223,7 +239,7 @@ static void _nego_send_fb_info(midi2d_interface_t* p_midi, uint8_t fb_idx) {
          | ((uint32_t) fb_idx << 8)
          | 0x02;  // bDirection: bidirectional
   msg[1] = ((uint32_t) 0 << 24)  // bFirstGroup
-         | ((uint32_t) CFG_TUD_MIDI2_NUM_GROUPS << 16);
+         | ((uint32_t) tud_midi2_num_groups_cb(_itf_idx(p_midi)) << 16);
   _nego_send_ump(p_midi, msg, 4);
 }
 
@@ -233,8 +249,8 @@ static void _nego_handle_stream_msg(midi2d_interface_t* p_midi, const uint32_t*
   switch (status) {
     case STREAM_ENDPOINT_DISCOVERY:
       _nego_send_endpoint_info(p_midi);
-      _nego_send_stream_text(p_midi, STREAM_EP_NAME, CFG_TUD_MIDI2_EP_NAME);
-      _nego_send_stream_text(p_midi, STREAM_PROD_INSTANCE_ID, CFG_TUD_MIDI2_PRODUCT_ID);
+      _nego_send_stream_text(p_midi, STREAM_EP_NAME, tud_midi2_ep_name_cb(_itf_idx(p_midi)));
+      _nego_send_stream_text(p_midi, STREAM_PROD_INSTANCE_ID, tud_midi2_product_id_cb(_itf_idx(p_midi)));
       break;
 
     case STREAM_CONFIG_REQUEST: {
@@ -249,11 +265,12 @@ static void _nego_handle_stream_msg(midi2d_interface_t* p_midi, const uint32_t*
 
     case STREAM_FB_DISCOVERY: {
       uint8_t fb_idx = (words[0] >> 8) & 0xFF;
+      uint8_t fb_count = tud_midi2_num_function_blocks_cb(_itf_idx(p_midi));
       if (fb_idx == 0xFF) {
-        for (uint8_t f = 0; f < CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS; f++) {
+        for (uint8_t f = 0; f < fb_count; f++) {
           _nego_send_fb_info(p_midi, f);
         }
-      } else if (fb_idx < CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS) {
+      } else if (fb_idx < fb_count) {
         _nego_send_fb_info(p_midi, fb_idx);
       }
       break;
diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
index a1c51f047..cb47bdf3c 100644
--- a/src/class/midi/midi2_device.h
+++ b/src/class/midi/midi2_device.h
@@ -103,6 +103,12 @@ void tud_midi2_rx_cb(uint8_t itf);
 void tud_midi2_set_itf_cb(uint8_t itf, uint8_t alt);
 bool tud_midi2_get_req_itf_cb(uint8_t rhport, const tusb_control_request_t* request);
 
+// Per-interface UMP Stream config (override for per-itf values).
+uint8_t     tud_midi2_num_groups_cb(uint8_t itf);
+uint8_t     tud_midi2_num_function_blocks_cb(uint8_t itf);
+const char* tud_midi2_ep_name_cb(uint8_t itf);
+const char* tud_midi2_product_id_cb(uint8_t itf);
+
 //--------------------------------------------------------------------+
 // Application API (Multiple Interfaces)
 //--------------------------------------------------------------------+
-- 
cgit v1.3.1


From 287096f7333aa10b6aaaf75337ccd3de9b06b95d Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Sun, 17 May 2026 13:07:21 -0300
Subject: midi2: scale device buffers with EPSIZE

Match midi2_host pattern. Literal 256 underran HS endpoints (512B).
---
 src/class/midi/midi2_device.h | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
index cb47bdf3c..b0bbd7572 100644
--- a/src/class/midi/midi2_device.h
+++ b/src/class/midi/midi2_device.h
@@ -48,14 +48,6 @@ extern "C" {
 // Class Driver Configuration
 //--------------------------------------------------------------------+
 
-#ifndef CFG_TUD_MIDI2_TX_BUFSIZE
-  #define CFG_TUD_MIDI2_TX_BUFSIZE  256
-#endif
-
-#ifndef CFG_TUD_MIDI2_RX_BUFSIZE
-  #define CFG_TUD_MIDI2_RX_BUFSIZE  256
-#endif
-
 #ifndef CFG_TUD_MIDI2_TX_EPSIZE
   #define CFG_TUD_MIDI2_TX_EPSIZE   TUD_EPSIZE_BULK_MAX
 #endif
@@ -64,6 +56,14 @@ extern "C" {
   #define CFG_TUD_MIDI2_RX_EPSIZE   TUD_EPSIZE_BULK_MAX
 #endif
 
+#ifndef CFG_TUD_MIDI2_TX_BUFSIZE
+  #define CFG_TUD_MIDI2_TX_BUFSIZE  (4 * CFG_TUD_MIDI2_TX_EPSIZE)
+#endif
+
+#ifndef CFG_TUD_MIDI2_RX_BUFSIZE
+  #define CFG_TUD_MIDI2_RX_BUFSIZE  (4 * CFG_TUD_MIDI2_RX_EPSIZE)
+#endif
+
 #ifndef CFG_TUD_MIDI2_NUM_GROUPS
   #define CFG_TUD_MIDI2_NUM_GROUPS  1
 #endif
-- 
cgit v1.3.1


From b31e7cdbbedec4a3286700f3ec24bb63fd7c224f Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Sun, 17 May 2026 19:56:04 -0300
Subject: midi2: drain pattern for RX FIFO

Default RX/TX buffers to EPSIZE for both device and host. Document
drain-in-loop on ump_read; example device callback drains until
empty.
---
 examples/device/midi2_device/src/main.c |  8 +++++++-
 src/class/midi/midi2_device.h           | 12 ++++++++++--
 src/class/midi/midi2_host.h             |  8 ++++++++
 src/tusb_option.h                       |  4 ++--
 4 files changed, 27 insertions(+), 5 deletions(-)

(limited to 'src')

diff --git a/examples/device/midi2_device/src/main.c b/examples/device/midi2_device/src/main.c
index cc918e198..d5f9bae24 100644
--- a/examples/device/midi2_device/src/main.c
+++ b/examples/device/midi2_device/src/main.c
@@ -529,7 +529,13 @@ void send_initial_setup(void);
 //--------------------------------------------------------------------+
 
 void tud_midi2_rx_cb(uint8_t itf) {
-  (void)itf;
+  // Drain the RX FIFO in a loop until empty. Leaving words in the FIFO
+  // across callbacks can prevent subsequent bulk OUT transfers from landing.
+  uint32_t words[8];
+  uint32_t n;
+  while ((n = tud_midi2_n_ump_read(itf, words, TU_ARRAY_SIZE(words))) > 0) {
+    (void) n;
+  }
 }
 
 // Reset playback state and re-send setup when host switches alt setting or
diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
index b0bbd7572..6c29b8ddf 100644
--- a/src/class/midi/midi2_device.h
+++ b/src/class/midi/midi2_device.h
@@ -57,11 +57,11 @@ extern "C" {
 #endif
 
 #ifndef CFG_TUD_MIDI2_TX_BUFSIZE
-  #define CFG_TUD_MIDI2_TX_BUFSIZE  (4 * CFG_TUD_MIDI2_TX_EPSIZE)
+  #define CFG_TUD_MIDI2_TX_BUFSIZE  CFG_TUD_MIDI2_TX_EPSIZE
 #endif
 
 #ifndef CFG_TUD_MIDI2_RX_BUFSIZE
-  #define CFG_TUD_MIDI2_RX_BUFSIZE  (4 * CFG_TUD_MIDI2_RX_EPSIZE)
+  #define CFG_TUD_MIDI2_RX_BUFSIZE  CFG_TUD_MIDI2_RX_EPSIZE
 #endif
 
 #ifndef CFG_TUD_MIDI2_NUM_GROUPS
@@ -119,6 +119,14 @@ uint8_t  tud_midi2_n_alt_setting(uint8_t itf);
 bool     tud_midi2_n_negotiated(uint8_t itf);
 uint8_t  tud_midi2_n_protocol(uint8_t itf);
 
+// Read up to max_words UMP words from the RX FIFO. Returns the number of
+// words actually read (0 if FIFO is empty).
+//
+// NOTE: this function returns when max_words is reached or when the FIFO is
+// empty, whichever comes first. Applications should invoke it in a loop
+// until it returns 0 to guarantee the RX FIFO is fully drained per
+// tud_midi2_rx_cb callback. Leaving words in the FIFO across callbacks can
+// prevent subsequent bulk OUT transfers from landing.
 uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words);
 uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t count);
 
diff --git a/src/class/midi/midi2_host.h b/src/class/midi/midi2_host.h
index d2de55270..47039eb85 100644
--- a/src/class/midi/midi2_host.h
+++ b/src/class/midi/midi2_host.h
@@ -77,6 +77,14 @@ uint8_t  tuh_midi2_get_cable_count(uint8_t idx);
 // Application API - I/O
 //--------------------------------------------------------------------+
 
+// Read up to max_words UMP words from the RX FIFO. Returns the number of
+// words actually read (0 if FIFO is empty).
+//
+// NOTE: this function returns when max_words is reached or when the FIFO is
+// empty, whichever comes first. Applications should invoke it in a loop
+// until it returns 0 to guarantee the RX FIFO is fully drained per
+// tuh_midi2_rx_cb callback. Leaving words in the FIFO across callbacks can
+// prevent subsequent bulk IN transfers from landing.
 uint32_t tuh_midi2_ump_read(uint8_t idx, uint32_t* words, uint32_t max_words);
 uint32_t tuh_midi2_ump_write(uint8_t idx, const uint32_t* words, uint32_t count);
 uint32_t tuh_midi2_write_flush(uint8_t idx);
diff --git a/src/tusb_option.h b/src/tusb_option.h
index 0114b86ee..74eb8cc06 100644
--- a/src/tusb_option.h
+++ b/src/tusb_option.h
@@ -824,11 +824,11 @@
 #endif
 
 #ifndef CFG_TUH_MIDI2_RX_BUFSIZE
-  #define CFG_TUH_MIDI2_RX_BUFSIZE (4 * TUH_EPSIZE_BULK_MAX)
+  #define CFG_TUH_MIDI2_RX_BUFSIZE TUH_EPSIZE_BULK_MAX
 #endif
 
 #ifndef CFG_TUH_MIDI2_TX_BUFSIZE
-  #define CFG_TUH_MIDI2_TX_BUFSIZE (4 * TUH_EPSIZE_BULK_MAX)
+  #define CFG_TUH_MIDI2_TX_BUFSIZE TUH_EPSIZE_BULK_MAX
 #endif
 
 #ifndef CFG_TUH_MIDI2_LOG_LEVEL
-- 
cgit v1.3.1


From aaca323bd34945178e88de51acf67c4d0443a726 Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Mon, 18 May 2026 11:42:34 -0300
Subject: midi2: boundary-aware drain in xfer_cb to keep UMP packets intact

---
 src/class/midi/midi2_device.c | 51 ++++++++++++++++++++++++++++++++++++++++---
 src/class/midi/midi2_host.c   | 42 +++++++++++++++++++++++++++++++++--
 2 files changed, 88 insertions(+), 5 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 534458a24..c61884689 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -635,6 +635,53 @@ bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_re
   }
 }
 
+// Drain whole UMP packets from the TX FIFO into the EP buffer, capped at
+// wMaxPacketSize. Needed when CFG_TUD_MIDI2_TX_BUFSIZE > mps: the FIFO can
+// then hold more bytes than fit in a single USB transfer, and a blind
+// tu_edpt_stream_write_xfer would split a UMP across two transfers.
+static void midi2d_flush_tx_boundary_aware(midi2d_interface_t* p_midi, uint32_t last_xferred) {
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  const uint16_t   mps      = ep_tx->mps;
+  const uint16_t   ff_count = tu_fifo_count(&ep_tx->ff);
+
+  if (ff_count == 0) {
+    (void) tu_edpt_stream_write_zlp_if_needed(ep_tx, last_xferred);
+    return;
+  }
+  if (ff_count <= mps) {
+    // Whole FIFO fits in one transfer; the stream API drain is safe.
+    (void) tu_edpt_stream_write_xfer(ep_tx);
+    return;
+  }
+  if (ep_tx->ep_buf == NULL) {
+    // HWFIFO mode: relies on CFG_TUD_MIDI2_TX_BUFSIZE <= mps for UMP integrity.
+    (void) tu_edpt_stream_write_xfer(ep_tx);
+    return;
+  }
+
+  // ff_count > mps and a local EP buffer is available: drain only whole UMP
+  // packets up to mps to preserve packet boundaries on the USB wire.
+  uint8_t  word_bytes[4];
+  uint8_t* buf   = ep_tx->ep_buf;
+  uint16_t bytes = 0;
+  while (bytes < mps) {
+    if (tu_fifo_count(&ep_tx->ff) < 4) break;
+    if (4 != tu_fifo_peek_n(&ep_tx->ff, word_bytes, 4)) break;
+    uint8_t  mt        = (uint8_t)((word_bytes[3] >> 4) & 0x0F);
+    uint8_t  pkt_words = midi2_ump_word_count(mt);
+    uint16_t pkt_bytes = (uint16_t)(pkt_words * 4);
+    if (tu_fifo_count(&ep_tx->ff) < pkt_bytes) break;
+    if (bytes + pkt_bytes > mps) break;
+    tu_fifo_read_n(&ep_tx->ff, buf + bytes, pkt_bytes);
+    bytes = (uint16_t)(bytes + pkt_bytes);
+  }
+  if (bytes == 0) return;
+  if (!usbd_edpt_claim(p_midi->rhport, ep_tx->ep_addr)) return;
+  if (!usbd_edpt_xfer(p_midi->rhport, ep_tx->ep_addr, buf, bytes, false)) {
+    usbd_edpt_release(p_midi->rhport, ep_tx->ep_addr);
+  }
+}
+
 bool midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
   (void) rhport;
 
@@ -655,9 +702,7 @@ bool midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint3
     }
     tu_edpt_stream_read_xfer(ep_rx);
   } else if (ep_addr == ep_tx->ep_addr && result == XFER_RESULT_SUCCESS) {
-    if (0 == tu_edpt_stream_write_xfer(ep_tx)) {
-      (void) tu_edpt_stream_write_zlp_if_needed(ep_tx, xferred_bytes);
-    }
+    midi2d_flush_tx_boundary_aware(p_midi, xferred_bytes);
   } else {
     return false;
   }
diff --git a/src/class/midi/midi2_host.c b/src/class/midi/midi2_host.c
index 2046fdb67..5d77e5990 100644
--- a/src/class/midi/midi2_host.c
+++ b/src/class/midi/midi2_host.c
@@ -455,6 +455,44 @@ void midih2_close(uint8_t dev_addr) {
   }
 }
 
+// Drain whole UMP packets from the TX FIFO into the EP buffer, capped at
+// wMaxPacketSize. Needed when CFG_TUH_MIDI2_TX_BUFSIZE > mps to keep UMP
+// packets from crossing USB transfer boundaries.
+static void midih2_flush_tx_boundary_aware(midih2_interface_t* p_midi, uint32_t last_xferred) {
+  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  const uint16_t   mps      = ep_tx->mps;
+  const uint16_t   ff_count = tu_fifo_count(&ep_tx->ff);
+
+  if (ff_count == 0) {
+    (void) tu_edpt_stream_write_zlp_if_needed(ep_tx, last_xferred);
+    return;
+  }
+  if (ff_count <= mps || ep_tx->ep_buf == NULL) {
+    (void) tu_edpt_stream_write_xfer(ep_tx);
+    return;
+  }
+
+  uint8_t  word_bytes[4];
+  uint8_t* buf   = ep_tx->ep_buf;
+  uint16_t bytes = 0;
+  while (bytes < mps) {
+    if (tu_fifo_count(&ep_tx->ff) < 4) break;
+    if (4 != tu_fifo_peek_n(&ep_tx->ff, word_bytes, 4)) break;
+    uint8_t  mt        = (uint8_t)((word_bytes[3] >> 4) & 0x0F);
+    uint8_t  pkt_words = midi2_ump_word_count(mt);
+    uint16_t pkt_bytes = (uint16_t)(pkt_words * 4);
+    if (tu_fifo_count(&ep_tx->ff) < pkt_bytes) break;
+    if (bytes + pkt_bytes > mps) break;
+    tu_fifo_read_n(&ep_tx->ff, buf + bytes, pkt_bytes);
+    bytes = (uint16_t)(bytes + pkt_bytes);
+  }
+  if (bytes == 0) return;
+  if (!usbh_edpt_claim(p_midi->daddr, ep_tx->ep_addr)) return;
+  if (!usbh_edpt_xfer(p_midi->daddr, ep_tx->ep_addr, buf, bytes)) {
+    usbh_edpt_release(p_midi->daddr, ep_tx->ep_addr);
+  }
+}
+
 bool midih2_xfer_cb(uint8_t dev_addr, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
   uint8_t idx = get_idx_by_ep_addr(dev_addr, ep_addr);
   TU_VERIFY(idx < CFG_TUH_MIDI2);
@@ -469,8 +507,8 @@ bool midih2_xfer_cb(uint8_t dev_addr, uint8_t ep_addr, xfer_result_t result, uin
     tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx);
   } else if (ep_addr == p_midi->ep_stream.tx.ep_addr) {
     tuh_midi2_tx_cb(idx, xferred_bytes);
-    if (0 == tu_edpt_stream_write_xfer(&p_midi->ep_stream.tx)) {
-      tu_edpt_stream_write_zlp_if_needed(&p_midi->ep_stream.tx, xferred_bytes);
+    if (result == XFER_RESULT_SUCCESS) {
+      midih2_flush_tx_boundary_aware(p_midi, xferred_bytes);
     }
   }
 
-- 
cgit v1.3.1


From 4baf1883c194c2c4b6fa30cc0c443ad6c83e0b19 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Mon, 18 May 2026 23:07:49 +0200
Subject: midi2: convert to raw Tx FIFO for better segmentation handling, add
 count to packet api

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 docs/reference/class_drivers.rst |   4 +-
 src/class/midi/midi2_device.c    | 276 +++++++++++++++++++++++----------------
 src/class/midi/midi2_device.h    |  14 +-
 3 files changed, 176 insertions(+), 118 deletions(-)

(limited to 'src')

diff --git a/docs/reference/class_drivers.rst b/docs/reference/class_drivers.rst
index 3ac0d8d4e..4a101fabc 100644
--- a/docs/reference/class_drivers.rst
+++ b/docs/reference/class_drivers.rst
@@ -64,8 +64,8 @@ I/O Functions
 
    uint32_t tud_midi2_ump_read(uint32_t* words, uint32_t max_words);
    uint32_t tud_midi2_ump_write(const uint32_t* words, uint32_t count);
-   bool     tud_midi2_packet_read(uint8_t packet[4]);
-   bool     tud_midi2_packet_write(const uint8_t packet[4]);
+  uint32_t tud_midi2_packet_read(uint8_t packets[], uint32_t max_packets);
+  uint32_t tud_midi2_packet_write(const uint8_t packets[], uint32_t count);
 
 Callbacks
 ^^^^^^^^^
diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index c61884689..b14f439f8 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -100,6 +100,16 @@ enum {
 //--------------------------------------------------------------------+
 // MACRO CONSTANT TYPEDEF
 //--------------------------------------------------------------------+
+typedef struct {
+  uint8_t ep_addr;
+  uint16_t mps;
+  tu_fifo_t ff;
+
+#if CFG_TUD_EDPT_DEDICATED_HWFIFO == 0
+  uint8_t* ep_buf;
+#endif
+} midi2d_tx_t;
+
 typedef struct {
   uint8_t rhport;
   uint8_t itf_num;
@@ -109,7 +119,7 @@ typedef struct {
 
   /*------------- From this point, data is not cleared by bus reset -------------*/
   struct {
-    tu_edpt_stream_t tx;
+    midi2d_tx_t      tx;
     tu_edpt_stream_t rx;
 
     uint8_t rx_ff_buf[CFG_TUD_MIDI2_RX_BUFSIZE];
@@ -117,19 +127,6 @@ typedef struct {
   } ep_stream;
 } midi2d_interface_t;
 
-TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_GROUPS >= 1 && CFG_TUD_MIDI2_NUM_GROUPS <= 16,
-                 "CFG_TUD_MIDI2_NUM_GROUPS must be 1..16");
-TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS >= 1 && CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS <= 32,
-                 "CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS must be 1..32");
-
-#define ITF_MEM_RESET_SIZE offsetof(midi2d_interface_t, ep_stream)
-
-static midi2d_interface_t _midi2d_itf[CFG_TUD_MIDI2];
-
-static inline uint8_t _itf_idx(const midi2d_interface_t* p_midi) {
-  return (uint8_t)(p_midi - _midi2d_itf);
-}
-
 // Skip local EP buffer if dedicated hw FIFO is supported
 #if CFG_TUD_EDPT_DEDICATED_HWFIFO == 0
 typedef struct {
@@ -140,6 +137,15 @@ typedef struct {
 CFG_TUD_MEM_SECTION static midi2d_epbuf_t _midi2d_epbuf[CFG_TUD_MIDI2];
 #endif
 
+TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_GROUPS >= 1 && CFG_TUD_MIDI2_NUM_GROUPS <= 16,
+                 "CFG_TUD_MIDI2_NUM_GROUPS must be 1..16");
+TU_VERIFY_STATIC(CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS >= 1 && CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS <= 32,
+                 "CFG_TUD_MIDI2_NUM_FUNCTION_BLOCKS must be 1..32");
+
+#define ITF_MEM_RESET_SIZE offsetof(midi2d_interface_t, ep_stream)
+
+static midi2d_interface_t _midi2d_itf[CFG_TUD_MIDI2];
+
 // Default Group Terminal Block descriptor (USB-MIDI 2.0 spec, Table 5-5/5-6)
 static const uint8_t _default_gtb_desc[] = {
   // GTB Header (5 bytes)
@@ -162,15 +168,112 @@ static const uint8_t _default_gtb_desc[] = {
   0, 0                                      // wMaxOutputBandwidth: unknown
 };
 
+//--------------------------------------------------------------------+
+// Common utility functions
+//--------------------------------------------------------------------+
+
+static inline uint8_t _itf_idx(const midi2d_interface_t* p_midi) {
+  return (uint8_t)(p_midi - _midi2d_itf);
+}
+
+static inline bool _tx_opened(const midi2d_interface_t* p_midi) {
+  return p_midi->ep_stream.tx.ep_addr != 0;
+}
+
+static uint8_t _tx_byte_at(const tu_fifo_buffer_info_t* info, uint16_t offset) {
+  if (offset < info->linear.len) {
+    return info->linear.ptr[offset];
+  }
+
+  offset = (uint16_t) (offset - info->linear.len);
+  if (offset < info->wrapped.len) {
+    return info->wrapped.ptr[offset];
+  }
+
+  return 0;
+}
+
+// Calculate the largest byte count that contains only whole UMP packets and
+// fits in one USB transfer (<= mps).
+static uint16_t _tx_nonseg_len_to_mps(midi2d_tx_t* tx) {
+  tu_fifo_buffer_info_t info;
+  tu_fifo_get_read_info(&tx->ff, &info);
+
+  const uint16_t available = (uint16_t) (info.linear.len + info.wrapped.len);
+  uint16_t bytes = 0;
+
+  while (bytes < tx->mps) {
+    if ((uint16_t) (available - bytes) < 4) break;
+
+    uint8_t mt = (uint8_t)((_tx_byte_at(&info, (uint16_t) (bytes + 3)) >> 4) & 0x0F);
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+    uint16_t pkt_bytes = (uint16_t) pkt_words * 4;
+
+    if (pkt_bytes == 0) break;
+    if ((uint16_t) (available - bytes) < pkt_bytes) break;
+    if ((uint16_t) (bytes + pkt_bytes) > tx->mps) break;
+
+    bytes = (uint16_t) (bytes + pkt_bytes);
+  }
+
+  return bytes;
+}
+
+// Start one IN transfer capped at mps, return number of bytes queued to the controller, or 0 if nothing was queued.
+static uint16_t _tx_start_xfer(midi2d_interface_t* p_midi) {
+  midi2d_tx_t* tx = &p_midi->ep_stream.tx;
+  uint16_t ff_count = tu_fifo_count(&tx->ff);
+
+  if (ff_count == 0) return 0;
+
+  if (!usbd_edpt_claim(p_midi->rhport, tx->ep_addr)) return 0;
+
+  uint16_t bytes;
+  if (p_midi->alt_setting == 1) {
+    bytes = _tx_nonseg_len_to_mps(tx);
+  } else {
+    bytes = tu_min16(tu_fifo_count(&tx->ff), tx->mps);
+  }
+  if (bytes == 0) {
+    usbd_edpt_release(p_midi->rhport, tx->ep_addr);
+    return 0;
+  }
+
+#if CFG_TUD_EDPT_DEDICATED_HWFIFO
+  TU_ASSERT(usbd_edpt_xfer_fifo(p_midi->rhport, tx->ep_addr, &tx->ff, bytes, false), 0);
+#else
+  tu_fifo_read_n(&tx->ff, tx->ep_buf, bytes);
+  TU_ASSERT(usbd_edpt_xfer(p_midi->rhport, tx->ep_addr, tx->ep_buf, bytes, false), 0);
+#endif
+
+  return bytes;
+}
+
+static uint32_t _tx_ump_write(midi2d_interface_t* p_midi, const uint32_t* words, uint32_t count) {
+  uint32_t written = 0;
+  while (written < count) {
+    uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F);
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+    uint16_t pkt_bytes = (uint16_t) pkt_words * 4;
+
+    if (written + pkt_words > count) break;
+    if (tu_fifo_remaining(&p_midi->ep_stream.tx.ff) < pkt_bytes) break;
+
+    if (tu_fifo_write_n(&p_midi->ep_stream.tx.ff, &words[written], pkt_bytes) != pkt_bytes) break;
+    written += pkt_words;
+  }
+
+  (void) _tx_start_xfer(p_midi);
+  return written;
+}
+
 //--------------------------------------------------------------------+
 // Protocol Negotiation
 //--------------------------------------------------------------------+
 static void _nego_send_ump(midi2d_interface_t* p_midi, const uint32_t* words, uint8_t count) {
-  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
-  if (!tu_edpt_stream_is_opened(ep_tx)) return;
-  if (tu_edpt_stream_write_available(ep_tx) < count * 4) return;
-  tu_edpt_stream_write(ep_tx, words, count * 4);
-  tu_edpt_stream_write_xfer(ep_tx);
+  if (!_tx_opened(p_midi)) return;
+  if (tu_fifo_remaining(&p_midi->ep_stream.tx.ff) < (uint32_t) count * 4) return;
+  (void) _tx_ump_write(p_midi, words, count);
 }
 
 static void _nego_send_endpoint_info(midi2d_interface_t* p_midi) {
@@ -307,7 +410,7 @@ static void _nego_process_rx(midi2d_interface_t* p_midi) {
 bool tud_midi2_n_mounted(uint8_t itf) {
   TU_VERIFY(itf < CFG_TUD_MIDI2, false);
   midi2d_interface_t* p_midi = &_midi2d_itf[itf];
-  return tu_edpt_stream_is_opened(&p_midi->ep_stream.tx) &&
+  return _tx_opened(p_midi) &&
          tu_edpt_stream_is_opened(&p_midi->ep_stream.rx);
 }
 
@@ -346,10 +449,10 @@ uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words)
   return total_read;
 }
 
-bool tud_midi2_n_packet_read(uint8_t itf, uint8_t packet[4]) {
-  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
+uint32_t tud_midi2_n_packet_read(uint8_t itf, uint8_t packets[], uint32_t max_packets) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2 && packets != NULL && max_packets > 0, 0);
   midi2d_interface_t* p_midi = &_midi2d_itf[itf];
-  return 4 == tu_edpt_stream_read(&p_midi->ep_stream.rx, packet, 4);
+  return tu_edpt_stream_read(&p_midi->ep_stream.rx, packets, max_packets * 4u) >> 2u;
 }
 
 //--------------------------------------------------------------------+
@@ -362,44 +465,31 @@ uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t coun
   // UMP API is only valid on Alt Setting 1 (USB-MIDI 2.0).
   // Alt 0 carries USB-MIDI 1.0 32-bit Event Packets, not UMP words.
   if (p_midi->alt_setting != 1) { return 0; }
+  TU_VERIFY(_tx_opened(p_midi), 0);
 
-  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
-  TU_VERIFY(tu_edpt_stream_is_opened(ep_tx), 0);
+  return _tx_ump_write(p_midi, words, count);
+}
+
+uint32_t tud_midi2_n_packet_write(uint8_t itf, const uint8_t packets[], uint32_t count) {
+  TU_VERIFY(itf < CFG_TUD_MIDI2 && packets != NULL && count > 0, 0);
+  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
+  midi2d_tx_t* tx = &p_midi->ep_stream.tx;
+
+  // Packet API is for Alt Setting 0 (USB-MIDI 1.0) event packets.
+  TU_VERIFY(p_midi->alt_setting == 0, 0);
+  TU_VERIFY(_tx_opened(p_midi), 0);
 
   uint32_t written = 0;
   while (written < count) {
-    uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F);
-    uint8_t pkt_words = midi2_ump_word_count(mt);
-    uint32_t pkt_bytes = (uint32_t)pkt_words * 4;
+    if (tu_fifo_remaining(&tx->ff) < 4) break;
 
-    if (written + pkt_words > count) break;
-    if (tu_edpt_stream_write_available(ep_tx) < pkt_bytes) break;
-
-    // Flush whole packets already queued before adding one that would cross
-    // the wMaxPacketSize boundary. Prevents an UMP message from being split
-    // across two USB transfers, which would corrupt the host RX context.
-    uint16_t ff_count = tu_fifo_count(&ep_tx->ff);
-    if (ff_count > 0 && ff_count + pkt_bytes > ep_tx->mps) {
-      tu_edpt_stream_write_xfer(ep_tx);
-    }
-
-    tu_edpt_stream_write(ep_tx, &words[written], pkt_bytes);
-    written += pkt_words;
+    if (tu_fifo_write_n(&tx->ff, packets + written * 4u, 4) != 4) break;
+    written++;
   }
 
-  (void) tu_edpt_stream_write_xfer(ep_tx);
-  return written;
-}
+  (void) _tx_start_xfer(p_midi);
 
-bool tud_midi2_n_packet_write(uint8_t itf, const uint8_t packet[4]) {
-  TU_VERIFY(itf < CFG_TUD_MIDI2, false);
-  midi2d_interface_t* p_midi = &_midi2d_itf[itf];
-  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
-  TU_VERIFY(tu_edpt_stream_is_opened(ep_tx), false);
-  TU_VERIFY(tu_edpt_stream_write_available(ep_tx) >= 4, false);
-  TU_VERIFY(tu_edpt_stream_write(ep_tx, packet, 4) > 0, false);
-  (void) tu_edpt_stream_write_xfer(ep_tx);
-  return true;
+  return written;
 }
 
 //--------------------------------------------------------------------+
@@ -439,8 +529,14 @@ void midi2d_init(void) {
 
     tu_edpt_stream_init(&p_midi->ep_stream.rx, false, false, false,
                         p_midi->ep_stream.rx_ff_buf, CFG_TUD_MIDI2_RX_BUFSIZE, epout_buf);
-    tu_edpt_stream_init(&p_midi->ep_stream.tx, false, true, false,
-                        p_midi->ep_stream.tx_ff_buf, CFG_TUD_MIDI2_TX_BUFSIZE, epin_buf);
+
+    midi2d_tx_t* tx = &p_midi->ep_stream.tx;
+    (void) tu_fifo_config(&tx->ff, p_midi->ep_stream.tx_ff_buf, CFG_TUD_MIDI2_TX_BUFSIZE, false);
+#if CFG_TUD_EDPT_DEDICATED_HWFIFO == 0
+    tx->ep_buf = epin_buf;
+#else
+    (void) epin_buf;
+#endif
   }
 }
 
@@ -448,7 +544,6 @@ bool midi2d_deinit(void) {
   for (uint8_t i = 0; i < CFG_TUD_MIDI2; i++) {
     midi2d_interface_t* p_midi = &_midi2d_itf[i];
     tu_edpt_stream_deinit(&p_midi->ep_stream.rx);
-    tu_edpt_stream_deinit(&p_midi->ep_stream.tx);
   }
   return true;
 }
@@ -462,8 +557,8 @@ void midi2d_reset(uint8_t rhport) {
     tu_edpt_stream_clear(&p_midi->ep_stream.rx);
     tu_edpt_stream_close(&p_midi->ep_stream.rx);
 
-    tu_edpt_stream_clear(&p_midi->ep_stream.tx);
-    tu_edpt_stream_close(&p_midi->ep_stream.tx);
+    tu_fifo_clear(&p_midi->ep_stream.tx.ff);
+    p_midi->ep_stream.tx.ep_addr = 0;
   }
 }
 
@@ -533,8 +628,9 @@ uint16_t midi2d_open(uint8_t rhport, const tusb_desc_interface_t* desc_itf, uint
       const uint8_t ep_addr = desc_ep->bEndpointAddress;
 
       if (tu_edpt_dir(ep_addr) == TUSB_DIR_IN) {
-        tu_edpt_stream_open(&p_midi->ep_stream.tx, rhport, desc_ep, CFG_TUD_MIDI2_TX_EPSIZE);
-        tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+        p_midi->ep_stream.tx.ep_addr = ep_addr;
+        p_midi->ep_stream.tx.mps = tu_edpt_packet_size(desc_ep);
+        tu_fifo_clear(&p_midi->ep_stream.tx.ff);
       } else {
         tu_edpt_stream_open(&p_midi->ep_stream.rx, rhport, desc_ep, tu_edpt_packet_size(desc_ep));
         tu_edpt_stream_clear(&p_midi->ep_stream.rx);
@@ -588,7 +684,7 @@ bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_re
       p_midi->alt_setting = alt;
 
       tu_edpt_stream_clear(&p_midi->ep_stream.rx);
-      tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+      tu_fifo_clear(&p_midi->ep_stream.tx.ff);
 
       if (alt == 1) {
         p_midi->negotiated = false;
@@ -635,53 +731,6 @@ bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_re
   }
 }
 
-// Drain whole UMP packets from the TX FIFO into the EP buffer, capped at
-// wMaxPacketSize. Needed when CFG_TUD_MIDI2_TX_BUFSIZE > mps: the FIFO can
-// then hold more bytes than fit in a single USB transfer, and a blind
-// tu_edpt_stream_write_xfer would split a UMP across two transfers.
-static void midi2d_flush_tx_boundary_aware(midi2d_interface_t* p_midi, uint32_t last_xferred) {
-  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
-  const uint16_t   mps      = ep_tx->mps;
-  const uint16_t   ff_count = tu_fifo_count(&ep_tx->ff);
-
-  if (ff_count == 0) {
-    (void) tu_edpt_stream_write_zlp_if_needed(ep_tx, last_xferred);
-    return;
-  }
-  if (ff_count <= mps) {
-    // Whole FIFO fits in one transfer; the stream API drain is safe.
-    (void) tu_edpt_stream_write_xfer(ep_tx);
-    return;
-  }
-  if (ep_tx->ep_buf == NULL) {
-    // HWFIFO mode: relies on CFG_TUD_MIDI2_TX_BUFSIZE <= mps for UMP integrity.
-    (void) tu_edpt_stream_write_xfer(ep_tx);
-    return;
-  }
-
-  // ff_count > mps and a local EP buffer is available: drain only whole UMP
-  // packets up to mps to preserve packet boundaries on the USB wire.
-  uint8_t  word_bytes[4];
-  uint8_t* buf   = ep_tx->ep_buf;
-  uint16_t bytes = 0;
-  while (bytes < mps) {
-    if (tu_fifo_count(&ep_tx->ff) < 4) break;
-    if (4 != tu_fifo_peek_n(&ep_tx->ff, word_bytes, 4)) break;
-    uint8_t  mt        = (uint8_t)((word_bytes[3] >> 4) & 0x0F);
-    uint8_t  pkt_words = midi2_ump_word_count(mt);
-    uint16_t pkt_bytes = (uint16_t)(pkt_words * 4);
-    if (tu_fifo_count(&ep_tx->ff) < pkt_bytes) break;
-    if (bytes + pkt_bytes > mps) break;
-    tu_fifo_read_n(&ep_tx->ff, buf + bytes, pkt_bytes);
-    bytes = (uint16_t)(bytes + pkt_bytes);
-  }
-  if (bytes == 0) return;
-  if (!usbd_edpt_claim(p_midi->rhport, ep_tx->ep_addr)) return;
-  if (!usbd_edpt_xfer(p_midi->rhport, ep_tx->ep_addr, buf, bytes, false)) {
-    usbd_edpt_release(p_midi->rhport, ep_tx->ep_addr);
-  }
-}
-
 bool midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
   (void) rhport;
 
@@ -690,7 +739,7 @@ bool midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint3
   midi2d_interface_t* p_midi = &_midi2d_itf[idx];
 
   tu_edpt_stream_t* ep_rx = &p_midi->ep_stream.rx;
-  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
+  midi2d_tx_t* ep_tx = &p_midi->ep_stream.tx;
 
   if (ep_addr == ep_rx->ep_addr) {
     if (result == XFER_RESULT_SUCCESS) {
@@ -702,7 +751,14 @@ bool midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint3
     }
     tu_edpt_stream_read_xfer(ep_rx);
   } else if (ep_addr == ep_tx->ep_addr && result == XFER_RESULT_SUCCESS) {
-    midi2d_flush_tx_boundary_aware(p_midi, xferred_bytes);
+    uint16_t queued = _tx_start_xfer(p_midi);
+    // Send ZLP if no more data is queued but the last transfer was exactly mps
+    if (queued == 0 && tu_fifo_count(&ep_tx->ff) == 0 && xferred_bytes > 0 &&
+        (0 == (xferred_bytes & (ep_tx->mps - 1)))) {
+      if (usbd_edpt_claim(rhport, ep_tx->ep_addr)) {
+          usbd_edpt_xfer(rhport, ep_tx->ep_addr, NULL, 0, false);
+      }
+    }
   } else {
     return false;
   }
diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
index 6c29b8ddf..e53535693 100644
--- a/src/class/midi/midi2_device.h
+++ b/src/class/midi/midi2_device.h
@@ -130,8 +130,8 @@ uint8_t  tud_midi2_n_protocol(uint8_t itf);
 uint32_t tud_midi2_n_ump_read(uint8_t itf, uint32_t* words, uint32_t max_words);
 uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t count);
 
-bool     tud_midi2_n_packet_read(uint8_t itf, uint8_t packet[4]);
-bool     tud_midi2_n_packet_write(uint8_t itf, const uint8_t packet[4]);
+uint32_t tud_midi2_n_packet_read(uint8_t itf, uint8_t packets[], uint32_t max_packets);
+uint32_t tud_midi2_n_packet_write(uint8_t itf, const uint8_t packets[], uint32_t count);
 
 //--------------------------------------------------------------------+
 // Application API (Single Interface)
@@ -166,12 +166,14 @@ tud_midi2_ump_write(const uint32_t* words, uint32_t count) {
   return tud_midi2_n_ump_write(0, words, count);
 }
 
-TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_packet_read(uint8_t packet[4]) {
-  return tud_midi2_n_packet_read(0, packet);
+TU_ATTR_ALWAYS_INLINE static inline uint32_t
+tud_midi2_packet_read(uint8_t packets[], uint32_t max_packets) {
+  return tud_midi2_n_packet_read(0, packets, max_packets);
 }
 
-TU_ATTR_ALWAYS_INLINE static inline bool tud_midi2_packet_write(const uint8_t packet[4]) {
-  return tud_midi2_n_packet_write(0, packet);
+TU_ATTR_ALWAYS_INLINE static inline uint32_t
+tud_midi2_packet_write(const uint8_t packets[], uint32_t count) {
+  return tud_midi2_n_packet_write(0, packets, count);
 }
 
 //--------------------------------------------------------------------+
-- 
cgit v1.3.1


From dad8c0ae51d68fd5355a8a0de4e478e4149ec05e Mon Sep 17 00:00:00 2001
From: Saulo Veríssimo <sauloverissimo@gmail.com>
Date: Tue, 19 May 2026 16:34:42 -0300
Subject: midi2_host: convert TX to raw FIFO mirroring midi2_device refactor

---
 src/class/midi/midi2_host.c | 192 ++++++++++++++++++++++++++------------------
 1 file changed, 113 insertions(+), 79 deletions(-)

(limited to 'src')

diff --git a/src/class/midi/midi2_host.c b/src/class/midi/midi2_host.c
index 5d77e5990..6d8861f4b 100644
--- a/src/class/midi/midi2_host.c
+++ b/src/class/midi/midi2_host.c
@@ -62,6 +62,13 @@ TU_ATTR_WEAK void tuh_midi2_umount_cb(uint8_t idx) {
 // Internal structure and state
 //--------------------------------------------------------------------+
 
+typedef struct {
+  uint8_t   ep_addr;
+  uint16_t  mps;
+  tu_fifo_t ff;
+  uint8_t*  ep_buf;
+} midih2_tx_t;
+
 typedef struct {
   uint8_t daddr;
   uint8_t bInterfaceNumber;
@@ -76,7 +83,7 @@ typedef struct {
   uint8_t tx_cable_count_alt1;
 
   struct {
-    tu_edpt_stream_t tx;
+    midih2_tx_t      tx;
     tu_edpt_stream_t rx;
 
     uint8_t rx_ff_buf[CFG_TUH_MIDI2_RX_BUFSIZE];
@@ -119,6 +126,86 @@ static inline uint8_t get_idx_by_ep_addr(uint8_t daddr, uint8_t ep_addr) {
   return TUSB_INDEX_INVALID_8;
 }
 
+static inline bool _tuh_tx_opened(const midih2_interface_t* p_midi) {
+  return p_midi->ep_stream.tx.ep_addr != 0;
+}
+
+static uint8_t _tuh_tx_byte_at(const tu_fifo_buffer_info_t* info, uint16_t offset) {
+  if (offset < info->linear.len) {
+    return info->linear.ptr[offset];
+  }
+  offset = (uint16_t)(offset - info->linear.len);
+  if (offset < info->wrapped.len) {
+    return info->wrapped.ptr[offset];
+  }
+  return 0;
+}
+
+// Largest byte count containing only whole UMP packets and fitting one xfer.
+static uint16_t _tuh_tx_nonseg_len_to_mps(midih2_tx_t* tx) {
+  tu_fifo_buffer_info_t info;
+  tu_fifo_get_read_info(&tx->ff, &info);
+
+  const uint16_t available = (uint16_t)(info.linear.len + info.wrapped.len);
+  uint16_t bytes = 0;
+
+  while (bytes < tx->mps) {
+    if ((uint16_t)(available - bytes) < 4) break;
+
+    uint8_t mt = (uint8_t)((_tuh_tx_byte_at(&info, (uint16_t)(bytes + 3)) >> 4) & 0x0F);
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+    uint16_t pkt_bytes = (uint16_t)(pkt_words * 4);
+
+    if (pkt_bytes == 0) break;
+    if ((uint16_t)(available - bytes) < pkt_bytes) break;
+    if ((uint16_t)(bytes + pkt_bytes) > tx->mps) break;
+
+    bytes = (uint16_t)(bytes + pkt_bytes);
+  }
+
+  return bytes;
+}
+
+// Start one OUT transfer capped at mps. Returns bytes queued, or 0 if nothing.
+static uint16_t _tuh_tx_start_xfer(midih2_interface_t* p_midi) {
+  midih2_tx_t* tx = &p_midi->ep_stream.tx;
+  uint16_t ff_count = tu_fifo_count(&tx->ff);
+  if (ff_count == 0) return 0;
+  if (!usbh_edpt_claim(p_midi->daddr, tx->ep_addr)) return 0;
+
+  uint16_t bytes;
+  if (p_midi->alt_setting_current == 1) {
+    bytes = _tuh_tx_nonseg_len_to_mps(tx);
+  } else {
+    bytes = tu_min16(tu_fifo_count(&tx->ff), tx->mps);
+  }
+  if (bytes == 0) {
+    usbh_edpt_release(p_midi->daddr, tx->ep_addr);
+    return 0;
+  }
+
+  tu_fifo_read_n(&tx->ff, tx->ep_buf, bytes);
+  TU_ASSERT(usbh_edpt_xfer(p_midi->daddr, tx->ep_addr, tx->ep_buf, bytes), 0);
+  return bytes;
+}
+
+static uint32_t _tuh_tx_ump_write(midih2_interface_t* p_midi, const uint32_t* words, uint32_t count) {
+  uint32_t written = 0;
+  while (written < count) {
+    uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F);
+    uint8_t pkt_words = midi2_ump_word_count(mt);
+    uint16_t pkt_bytes = (uint16_t)(pkt_words * 4);
+
+    if (written + pkt_words > count) break;
+    if (tu_fifo_remaining(&p_midi->ep_stream.tx.ff) < pkt_bytes) break;
+    if (tu_fifo_write_n(&p_midi->ep_stream.tx.ff, &words[written], pkt_bytes) != pkt_bytes) break;
+    written += pkt_words;
+  }
+
+  (void) _tuh_tx_start_xfer(p_midi);
+  return written;
+}
+
 //--------------------------------------------------------------------+
 // Descriptor parsing
 //--------------------------------------------------------------------+
@@ -151,8 +238,9 @@ static const uint8_t* midih2_parse_descriptors_alt0(midih2_interface_t *p_midi,
           tu_edpt_stream_open(&p_midi->ep_stream.rx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
           tu_edpt_stream_clear(&p_midi->ep_stream.rx);
         } else {
-          tu_edpt_stream_open(&p_midi->ep_stream.tx, p_midi->daddr, p_ep, tu_edpt_packet_size(p_ep));
-          tu_edpt_stream_clear(&p_midi->ep_stream.tx);
+          p_midi->ep_stream.tx.ep_addr = p_ep->bEndpointAddress;
+          p_midi->ep_stream.tx.mps     = tu_edpt_packet_size(p_ep);
+          tu_fifo_clear(&p_midi->ep_stream.tx.ff);
         }
 
         p_desc = tu_desc_next(p_desc);
@@ -264,13 +352,14 @@ bool midih2_init(void) {
   for (int inst = 0; inst < CFG_TUH_MIDI2; inst++) {
     midih2_interface_t *p_midi = &_midi2_host[inst];
 
-    uint8_t* rx_buf = _midi2_epbuf[inst].rx;
-    uint8_t* tx_buf = _midi2_epbuf[inst].tx;
-
     tu_edpt_stream_init(&p_midi->ep_stream.rx, true, false, false,
-      p_midi->ep_stream.rx_ff_buf, CFG_TUH_MIDI2_RX_BUFSIZE, rx_buf);
-    tu_edpt_stream_init(&p_midi->ep_stream.tx, true, true, false,
-      p_midi->ep_stream.tx_ff_buf, CFG_TUH_MIDI2_TX_BUFSIZE, tx_buf);
+      p_midi->ep_stream.rx_ff_buf, CFG_TUH_MIDI2_RX_BUFSIZE, _midi2_epbuf[inst].rx);
+
+    // TX uses raw tu_fifo + direct usbh_edpt_xfer (no FIFO wrapper) to preserve
+    // UMP packet boundaries across USB transfers.
+    midih2_tx_t* tx = &p_midi->ep_stream.tx;
+    (void) tu_fifo_config(&tx->ff, p_midi->ep_stream.tx_ff_buf, CFG_TUH_MIDI2_TX_BUFSIZE, false);
+    tx->ep_buf = _midi2_epbuf[inst].tx;
   }
   return true;
 }
@@ -279,7 +368,6 @@ bool midih2_deinit(void) {
   for (size_t i = 0; i < CFG_TUH_MIDI2; i++) {
     midih2_interface_t* p_midi = &_midi2_host[i];
     tu_edpt_stream_deinit(&p_midi->ep_stream.rx);
-    tu_edpt_stream_deinit(&p_midi->ep_stream.tx);
   }
   return true;
 }
@@ -448,56 +536,20 @@ void midih2_close(uint8_t dev_addr) {
     if (p_midi->daddr == dev_addr) {
       TU_LOG_DRV("  MIDI2 close addr = %u index = %u\r\n", dev_addr, idx);
       tu_edpt_stream_close(&p_midi->ep_stream.rx);
-      tu_edpt_stream_close(&p_midi->ep_stream.tx);
+      tu_fifo_clear(&p_midi->ep_stream.tx.ff);
+      p_midi->ep_stream.tx.ep_addr = 0;
       tuh_midi2_umount_cb(idx);
       tu_memclr(p_midi, sizeof(midih2_interface_t));
     }
   }
 }
 
-// Drain whole UMP packets from the TX FIFO into the EP buffer, capped at
-// wMaxPacketSize. Needed when CFG_TUH_MIDI2_TX_BUFSIZE > mps to keep UMP
-// packets from crossing USB transfer boundaries.
-static void midih2_flush_tx_boundary_aware(midih2_interface_t* p_midi, uint32_t last_xferred) {
-  tu_edpt_stream_t* ep_tx = &p_midi->ep_stream.tx;
-  const uint16_t   mps      = ep_tx->mps;
-  const uint16_t   ff_count = tu_fifo_count(&ep_tx->ff);
-
-  if (ff_count == 0) {
-    (void) tu_edpt_stream_write_zlp_if_needed(ep_tx, last_xferred);
-    return;
-  }
-  if (ff_count <= mps || ep_tx->ep_buf == NULL) {
-    (void) tu_edpt_stream_write_xfer(ep_tx);
-    return;
-  }
-
-  uint8_t  word_bytes[4];
-  uint8_t* buf   = ep_tx->ep_buf;
-  uint16_t bytes = 0;
-  while (bytes < mps) {
-    if (tu_fifo_count(&ep_tx->ff) < 4) break;
-    if (4 != tu_fifo_peek_n(&ep_tx->ff, word_bytes, 4)) break;
-    uint8_t  mt        = (uint8_t)((word_bytes[3] >> 4) & 0x0F);
-    uint8_t  pkt_words = midi2_ump_word_count(mt);
-    uint16_t pkt_bytes = (uint16_t)(pkt_words * 4);
-    if (tu_fifo_count(&ep_tx->ff) < pkt_bytes) break;
-    if (bytes + pkt_bytes > mps) break;
-    tu_fifo_read_n(&ep_tx->ff, buf + bytes, pkt_bytes);
-    bytes = (uint16_t)(bytes + pkt_bytes);
-  }
-  if (bytes == 0) return;
-  if (!usbh_edpt_claim(p_midi->daddr, ep_tx->ep_addr)) return;
-  if (!usbh_edpt_xfer(p_midi->daddr, ep_tx->ep_addr, buf, bytes)) {
-    usbh_edpt_release(p_midi->daddr, ep_tx->ep_addr);
-  }
-}
-
 bool midih2_xfer_cb(uint8_t dev_addr, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
   uint8_t idx = get_idx_by_ep_addr(dev_addr, ep_addr);
   TU_VERIFY(idx < CFG_TUH_MIDI2);
 
   midih2_interface_t *p_midi = &_midi2_host[idx];
+  midih2_tx_t* ep_tx = &p_midi->ep_stream.tx;
 
   if (ep_addr == p_midi->ep_stream.rx.ep_addr) {
     if (result == XFER_RESULT_SUCCESS && xferred_bytes > 0) {
@@ -505,10 +557,17 @@ bool midih2_xfer_cb(uint8_t dev_addr, uint8_t ep_addr, xfer_result_t result, uin
       tuh_midi2_rx_cb(idx, xferred_bytes);
     }
     tu_edpt_stream_read_xfer(&p_midi->ep_stream.rx);
-  } else if (ep_addr == p_midi->ep_stream.tx.ep_addr) {
+  } else if (ep_addr == ep_tx->ep_addr) {
     tuh_midi2_tx_cb(idx, xferred_bytes);
     if (result == XFER_RESULT_SUCCESS) {
-      midih2_flush_tx_boundary_aware(p_midi, xferred_bytes);
+      uint16_t queued = _tuh_tx_start_xfer(p_midi);
+      // Send ZLP if no more data is queued but the last transfer was exactly mps
+      if (queued == 0 && tu_fifo_count(&ep_tx->ff) == 0 && xferred_bytes > 0 &&
+          (0 == (xferred_bytes & (ep_tx->mps - 1)))) {
+        if (usbh_edpt_claim(dev_addr, ep_tx->ep_addr)) {
+          usbh_edpt_xfer(dev_addr, ep_tx->ep_addr, NULL, 0);
+        }
+      }
     }
   }
 
@@ -563,39 +622,14 @@ uint32_t tuh_midi2_ump_write(uint8_t idx, const uint32_t* words, uint32_t count)
   TU_VERIFY(idx < CFG_TUH_MIDI2 && words && count);
 
   midih2_interface_t *p_midi = &_midi2_host[idx];
-  tu_edpt_stream_t *ep_tx = &p_midi->ep_stream.tx;
+  TU_VERIFY(_tuh_tx_opened(p_midi), 0);
 
-  uint32_t written = 0;
-  while (written < count) {
-    uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F);
-    uint8_t pkt_words = midi2_ump_word_count(mt);
-    uint32_t pkt_bytes = (uint32_t)pkt_words * 4;
-
-    if (written + pkt_words > count) break;
-    if (tu_edpt_stream_write_available(ep_tx) < pkt_bytes) break;
-
-    // Flush whole packets already queued before adding one that would cross
-    // the wMaxPacketSize boundary. Prevents an UMP message from being split
-    // across two USB transfers, which would corrupt the peer RX context.
-    uint16_t ff_count = tu_fifo_count(&ep_tx->ff);
-    if (ff_count > 0 && ff_count + pkt_bytes > ep_tx->mps) {
-      tu_edpt_stream_write_xfer(ep_tx);
-    }
-
-    tu_edpt_stream_write(ep_tx, (const uint8_t *) &words[written], pkt_bytes);
-    written += pkt_words;
-  }
-
-  return written;
+  return _tuh_tx_ump_write(p_midi, words, count);
 }
 
 uint32_t tuh_midi2_write_flush(uint8_t idx) {
   TU_VERIFY(idx < CFG_TUH_MIDI2);
-
-  midih2_interface_t *p_midi = &_midi2_host[idx];
-  tu_edpt_stream_t *ep_tx = &p_midi->ep_stream.tx;
-
-  return tu_edpt_stream_write_xfer(ep_tx);
+  return _tuh_tx_start_xfer(&_midi2_host[idx]);
 }
 
 #endif // CFG_TUH_ENABLED && CFG_TUH_MIDI2
-- 
cgit v1.3.1


From 650e8a194fcfaa4b91203e9aedfecd614ea70105 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Wed, 20 May 2026 23:22:02 +0200
Subject: dwc2: handle EP0 status OUT in RXFLVL interrupt

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/synopsys/dwc2/dcd_dwc2.c | 65 +++++++++++++----------------------
 1 file changed, 24 insertions(+), 41 deletions(-)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 72beb1b80..bdab49f1b 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -62,7 +62,6 @@ static xfer_ctl_t xfer_status[DWC2_EP_MAX][2];
 typedef struct {
   // EP0 transfers are limited to 1 packet - larger sizes has to be split
   uint16_t ep0_pending[2];  // Index determines direction as tusb_dir_t type
-  bool ep0_out_zlp_armed;   // EP0 OUT ZLP transfer is armed and waiting for completion
   uint16_t dfifo_top;      // top free location in DFIFO in words
 
   // Number of IN endpoints active
@@ -70,6 +69,9 @@ typedef struct {
 
   // SOF enabling flag - required for SOF to not get disabled in ISR when SOF was enabled by
   bool sof_en;
+
+  // EP0 status OUT flag
+  bool ep0_status_out;
 } dcd_data_t;
 
 static dcd_data_t _dcd_data;
@@ -667,7 +669,7 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t* buffer, uint16_t to
     if (epnum == 0) {
       _dcd_data.ep0_pending[dir] = total_bytes;
       if (dir == TUSB_DIR_OUT) {
-        _dcd_data.ep0_out_zlp_armed = (total_bytes == 0);
+        _dcd_data.ep0_status_out = (total_bytes == 0);
       }
     }
 
@@ -748,11 +750,9 @@ static void handle_bus_reset(uint8_t rhport) {
 
   tu_memclr(xfer_status, sizeof(xfer_status));
 
-  _dcd_data.ep0_pending[TUSB_DIR_OUT] = 0;
-  _dcd_data.ep0_pending[TUSB_DIR_IN] = 0;
-  _dcd_data.ep0_out_zlp_armed = false;
   _dcd_data.sof_en = false;
   _dcd_data.allocated_epin_count = 0;
+  _dcd_data.ep0_status_out = false;
 
   // 1. NAK for all OUT endpoints
   for (uint8_t n = 0; n < ep_count; n++) {
@@ -907,6 +907,9 @@ static void handle_rxflvl_irq(uint8_t rhport) {
       // We can receive up to three setup packets in succession, but only the last one is valid.
       setup[0] = (*rx_fifo);
       setup[1] = (*rx_fifo);
+
+      // Clear previous pending EP0 OUT if any
+      _dcd_data.ep0_status_out = false;
       break;
     }
 
@@ -946,6 +949,12 @@ static void handle_rxflvl_irq(uint8_t rhport) {
       // Out packet done
       // After this entry is popped from the receive FIFO, dwc2 asserts a Transfer Completed interrupt on
       // the specified OUT endpoint which will be handled by handle_epout_irq()
+
+      // EP0 status OUT is complete
+      if (epnum == 0 && _dcd_data.ep0_status_out) {
+        _dcd_data.ep0_status_out = false;
+        dcd_event_xfer_complete(rhport, epnum, 0, XFER_RESULT_SUCCESS, true);
+      }
       break;
 
     default: break; // nothing to do
@@ -953,21 +962,7 @@ static void handle_rxflvl_irq(uint8_t rhport) {
 }
 
 static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepint_bm) {
-  xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
-  const bool ep0_status_complete_before_setup = (epnum == 0) && doepint_bm.setup_phase_done &&
-                                                doepint_bm.xfer_complete &&
-                                                _dcd_data.ep0_out_zlp_armed &&
-                                                (_dcd_data.ep0_pending[TUSB_DIR_OUT] == 0) &&
-                                                (xfer->total_len == 0);
-
   if (doepint_bm.setup_phase_done) {
-    if (ep0_status_complete_before_setup) {
-      _dcd_data.ep0_out_zlp_armed = false;
-      dcd_event_xfer_complete(rhport, epnum, 0, XFER_RESULT_SUCCESS, true);
-    } else if (epnum == 0) {
-      _dcd_data.ep0_out_zlp_armed = false;
-    }
-
     // Cleanup previous pending EP0 IN transfer if any
     dwc2_dep_t* epin0 = &DWC2_REG(rhport)->epin[0];
     if (edpt_is_enabled(epin0)) {
@@ -983,13 +978,16 @@ static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doe
     // Note: even though (xfer_complete + status_phase_rx) is for buffered DMA only, for STM32L47x (dwc2 v3.00a) they
     // can is set when GRXSTS_PKTSTS_SETUP_RX is popped therefore they can bet set before/together with setup_phase_done
     if (!doepint_bm.status_phase_rx && !doepint_bm.setup_packet_rx) {
-      if ((epnum == 0) && _dcd_data.ep0_pending[TUSB_DIR_OUT]) {
-        // EP0 can only handle one packet, Schedule another packet to be received.
-        edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
-      } else {
-        if (epnum == 0) {
-          _dcd_data.ep0_out_zlp_armed = false;
+      xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
+      if (epnum == 0) {
+        if (_dcd_data.ep0_pending[TUSB_DIR_OUT]) {
+          // EP0 can only handle one packet, Schedule another packet to be received.
+          edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
+        } else if (xfer->total_len > 0) {
+          // EP0 status out is handled in handle_rxflvl_irq
+          dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
         }
+      } else {
         dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
       }
     }
@@ -1028,21 +1026,8 @@ static void handle_epin_slave(uint8_t rhport, uint8_t epnum, dwc2_diepint_t diep
 #if CFG_TUD_DWC2_DMA_ENABLE
 static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepint_bm) {
   dwc2_regs_t* dwc2 = DWC2_REG(rhport);
-  xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
-  const bool ep0_status_complete_before_setup = (epnum == 0) && doepint_bm.setup_phase_done &&
-                                                doepint_bm.xfer_complete &&
-                                                _dcd_data.ep0_out_zlp_armed &&
-                                                (_dcd_data.ep0_pending[TUSB_DIR_OUT] == 0) &&
-                                                (xfer->total_len == 0);
 
   if (doepint_bm.setup_phase_done) {
-    if (ep0_status_complete_before_setup) {
-      _dcd_data.ep0_out_zlp_armed = false;
-      dcd_event_xfer_complete(rhport, epnum, 0, XFER_RESULT_SUCCESS, true);
-    } else if (epnum == 0) {
-      _dcd_data.ep0_out_zlp_armed = false;
-    }
-
     // Cleanup previous pending EP0 IN transfer if any
     dwc2_dep_t* epin0 = &DWC2_REG(rhport)->epin[0];
     if (edpt_is_enabled(epin0)) {
@@ -1064,6 +1049,7 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
         edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
       } else {
         dwc2_dep_t* epout = &dwc2->epout[epnum];
+        xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
 
         // determine actual received bytes
         const dwc2_ep_tsize_t tsiz = {.value = epout->tsiz};
@@ -1076,9 +1062,6 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
           dma_setup_prepare(rhport);
         }
 
-        if (epnum == 0) {
-          _dcd_data.ep0_out_zlp_armed = false;
-        }
         dcd_dcache_invalidate(xfer->buffer, xfer->total_len);
         dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
       }
-- 
cgit v1.3.1


From 2267046fadd8c40086c66c10abc99153b95d25bf Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 22 May 2026 15:30:51 +0200
Subject: ch32v20x: fix port1 IP selection

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 hw/bsp/ch32v20x/family.cmake |  3 ++-
 src/common/tusb_mcu.h        | 10 ++++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

(limited to 'src')

diff --git a/hw/bsp/ch32v20x/family.cmake b/hw/bsp/ch32v20x/family.cmake
index 59a96f70d..785f5ee35 100644
--- a/hw/bsp/ch32v20x/family.cmake
+++ b/hw/bsp/ch32v20x/family.cmake
@@ -61,8 +61,9 @@ function(family_add_board BOARD_TARGET)
 
   if (RHPORT_DEVICE EQUAL 0)
     target_compile_definitions(${BOARD_TARGET} PUBLIC CFG_TUD_WCH_USBIP_FSDEV=1)
+    target_compile_definitions(${BOARD_TARGET} PUBLIC CFG_TUH_WCH_USBIP_FSDEV=1)
   elseif (RHPORT_DEVICE EQUAL 1)
-    target_compile_definitions(${BOARD_TARGET} PUBLIC CFG_TUH_WCH_USBIP_USBFS=1)
+    target_compile_definitions(${BOARD_TARGET} PUBLIC CFG_TUD_WCH_USBIP_USBFS=1)
   else()
     message(FATAL_ERROR "Invalid RHPORT_DEVICE ${RHPORT_DEVICE}")
   endif()
diff --git a/src/common/tusb_mcu.h b/src/common/tusb_mcu.h
index c85ade4d0..413ac4850 100644
--- a/src/common/tusb_mcu.h
+++ b/src/common/tusb_mcu.h
@@ -616,10 +616,6 @@
     #define CFG_TUH_WCH_USBIP_USBFS 1
   #endif
 
-  #define TUP_USBIP_FSDEV
-  #define TUP_USBIP_FSDEV_CH32
-  #define CFG_TUSB_FSDEV_PMA_SIZE 512u
-
   // default to FSDEV for device
   #if !defined(CFG_TUD_WCH_USBIP_USBFS)
     #define CFG_TUD_WCH_USBIP_USBFS 0
@@ -629,6 +625,12 @@
     #define CFG_TUD_WCH_USBIP_FSDEV (CFG_TUD_WCH_USBIP_USBFS ? 0 : 1)
   #endif
 
+  #if CFG_TUD_WCH_USBIP_FSDEV
+    #define TUP_USBIP_FSDEV
+    #define TUP_USBIP_FSDEV_CH32
+    #define CFG_TUSB_FSDEV_PMA_SIZE 512u
+  #endif
+
   #define TUP_DCD_ENDPOINT_MAX 8
 
 #elif TU_CHECK_MCU(OPT_MCU_CH32V307)
-- 
cgit v1.3.1


From d202477ebe0f8805bf88fcee4c0d5968d146dfbd Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 22 May 2026 18:02:23 +0200
Subject: dcd/ch32fs: reset EP regs on bus reset

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index 39c1cfb4a..0727664c9 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -125,6 +125,16 @@ static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
   }
 }
 
+static void reset_ep_ctrls(void) {
+  for (uint8_t ep = 1; ep < EP_MAX; ep++) {
+    EP_DMA(ep) = (uint32_t) &data.buffer[ep][0];
+    EP_TX_LEN(ep) = 0;
+    EP_TX_CTRL(ep) = USBFS_EP_T_AUTO_TOG | USBFS_EP_T_RES_NYET;
+    EP_RX_CTRL(ep) = USBFS_EP_R_AUTO_TOG | USBFS_EP_R_RES_NYET;
+  }
+  EP_DMA(3) = (uint32_t) &data.ep3_buffer.out[0];
+}
+
 /* public functions */
 bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
   (void) rh_init;
@@ -148,13 +158,7 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
   USBOTG_FS->UEP5_6_MOD = 0xCC;
   USBOTG_FS->UEP7_MOD = 0x0C;
 
-  for (uint8_t ep = 1; ep < EP_MAX; ep++) {
-    EP_DMA(ep) = (uint32_t) &data.buffer[ep][0];
-    EP_TX_LEN(ep) = 0;
-    EP_TX_CTRL(ep) = USBFS_EP_T_AUTO_TOG | USBFS_EP_T_RES_NAK;
-    EP_RX_CTRL(ep) = USBFS_EP_R_AUTO_TOG | USBFS_EP_R_RES_NAK;
-  }
-  EP_DMA(3) = (uint32_t) &data.ep3_buffer.out[0];
+  reset_ep_ctrls();
 
   dcd_connect(rhport);
 
@@ -201,6 +205,8 @@ void dcd_int_handler(uint8_t rhport) {
     USBOTG_FS->DEV_ADDR = 0x00;
     EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
 
+    reset_ep_ctrls();
+
     USBOTG_FS->INT_FG = USBFS_INT_FG_BUS_RST;
   } else if (status & USBFS_INT_FG_SUSPEND) {
     dcd_event_t event = {.rhport = rhport, .event_id = DCD_EVENT_SUSPEND};
-- 
cgit v1.3.1


From 66c5f6d45dc90f947261e2e4e62918c2ceb0ce11 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 22 May 2026 18:04:44 +0200
Subject: dcd/ch32fs: only enable EP0 ACK if no data stage, reduce race

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index 0727664c9..e4abbd824 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -186,9 +186,12 @@ void dcd_int_handler(uint8_t rhport) {
       case PID_SETUP:
         // setup clears stall
         EP_TX_CTRL(0) = USBFS_EP_T_RES_NAK;
-        EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
-
         data.ep0_tog = true;
+
+        tusb_control_request_t const* setup =
+            (tusb_control_request_t const*) &data.buffer[0][TUSB_DIR_OUT][0];
+        EP_RX_CTRL(0) = (setup->wLength == 0) ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK;
+
         dcd_event_setup_received(rhport, &data.buffer[0][TUSB_DIR_OUT][0], true);
         break;
     }
-- 
cgit v1.3.1


From 61a8f688c800626962cfed4022f4672b35ceb3ae Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 22 May 2026 18:13:42 +0200
Subject: dcd/ch32fs: fix ISO IN transfer

OUT is still buggy

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index e4abbd824..f6c573b47 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -119,8 +119,10 @@ static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
     if (ep == 0) {
       EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
     } else {
-      EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) |
-                       (xfer->valid ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK);
+      uint8_t rx_res = data.isochronous[ep]
+                      ? USBFS_EP_R_RES_NYET
+                      : (xfer->valid ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK);
+      EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) | rx_res;
     }
   }
 }
@@ -272,18 +274,12 @@ bool dcd_edpt_open(uint8_t rhport, tusb_desc_endpoint_t const* desc_ep) {
   uint8_t dir = tu_edpt_dir(desc_ep->bEndpointAddress);
   TU_ASSERT(ep < EP_MAX);
 
-  data.isochronous[ep] = desc_ep->bmAttributes.xfer == TUSB_XFER_ISOCHRONOUS;
   data.xfer[ep][dir].max_size = tu_edpt_packet_size(desc_ep);
 
   if (ep != 0) {
     if (dir == TUSB_DIR_OUT) {
-      if (data.isochronous[ep]) {
-        EP_RX_CTRL(ep) = USBFS_EP_R_AUTO_TOG | USBFS_EP_R_RES_NYET;
-      } else {
-        EP_RX_CTRL(ep) = USBFS_EP_R_AUTO_TOG | USBFS_EP_R_RES_ACK;
-      }
+      EP_RX_CTRL(ep) = USBFS_EP_R_AUTO_TOG | USBFS_EP_T_RES_NAK;
     } else {
-      EP_TX_LEN(ep) = 0;
       EP_TX_CTRL(ep) = USBFS_EP_T_AUTO_TOG | USBFS_EP_T_RES_NAK;
     }
   }
@@ -299,13 +295,18 @@ bool dcd_edpt_iso_alloc(uint8_t rhport, uint8_t ep_addr, uint16_t largest_packet
   (void) rhport;
   (void) ep_addr;
   (void)largest_packet_size;
-  return false;
+  uint8_t ep = tu_edpt_number(ep_addr);
+  uint8_t dir = tu_edpt_dir(ep_addr);
+
+  data.isochronous[ep] = true;
+  data.xfer[ep][dir].max_size = largest_packet_size;
+  return true;
 }
 
 bool dcd_edpt_iso_activate(uint8_t rhport, const tusb_desc_endpoint_t *desc_ep) {
   (void)rhport;
   (void)desc_ep;
-  return false;
+  return true;
 }
 
 bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t total_bytes, bool is_isr) {
@@ -325,7 +326,8 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t t
   if (dir == TUSB_DIR_IN) {
     update_in(rhport, ep, true);
   } else {
-    EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) | USBFS_EP_R_RES_ACK;
+    uint8_t rx_res = data.isochronous[ep] ? USBFS_EP_R_RES_NYET : USBFS_EP_R_RES_ACK;
+    EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) | rx_res;
   }
   return true;
 }
-- 
cgit v1.3.1


From 28d4ec5723428cbdb085ecdaa70e7fd2bf7f893d Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 22 May 2026 18:14:58 +0200
Subject: dcd/ch32fs: reset EP on clear stall

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index f6c573b47..8f583510c 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -362,9 +362,9 @@ void dcd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
     }
   } else {
     if (dir == TUSB_DIR_OUT) {
-      EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~(USBFS_EP_R_RES_MASK | USBFS_EP_R_TOG)) | USBFS_EP_R_RES_ACK;
+      EP_RX_CTRL(ep) = USBFS_EP_R_AUTO_TOG | USBFS_EP_R_RES_NAK;
     } else {
-      EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK | USBFS_EP_T_TOG)) | USBFS_EP_T_RES_NAK;
+      EP_TX_CTRL(ep) = USBFS_EP_T_AUTO_TOG | USBFS_EP_T_RES_NAK;
     }
   }
 }
-- 
cgit v1.3.1


From e14b0e8514ace0043472d9cb0779152fccade1ee Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Sat, 23 May 2026 13:02:53 +0200
Subject: dcd/ch32fs: set EP to NAK earlier to reduce spuroius transfer

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index 8f583510c..3ba6eee87 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -66,6 +66,13 @@ static struct {
 static void update_in(uint8_t rhport, uint8_t ep, bool force) {
   struct usb_xfer* xfer = &data.xfer[ep][TUSB_DIR_IN];
   if (xfer->valid) {
+    // Set EP to NAK to avoid spurious tramsfer
+    if (ep == 0) {
+      EP_TX_CTRL(0) = USBFS_EP_T_RES_NAK | (data.ep0_tog ? USBFS_EP_T_TOG : 0);
+    } else if (!data.isochronous[ep]) {
+      EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK)) | USBFS_EP_T_RES_NAK;
+    }
+
     if (force || xfer->len) {
       size_t len = TU_MIN(xfer->max_size, xfer->len);
       if (ep == 0) {
@@ -101,6 +108,13 @@ static void update_in(uint8_t rhport, uint8_t ep, bool force) {
 static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
   struct usb_xfer* xfer = &data.xfer[ep][TUSB_DIR_OUT];
   if (xfer->valid) {
+    // Set EP to NAK to avoid spurious tramsfer
+    if (ep == 0) {
+      EP_RX_CTRL(0) = USBFS_EP_R_RES_NAK;
+    } else if (!data.isochronous[ep]) {
+      EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) | USBFS_EP_R_RES_NAK;
+    }
+
     size_t len = TU_MIN(xfer->max_size, TU_MIN(xfer->len, rx_len));
     if (ep == 3) {
       memcpy(xfer->buffer, data.ep3_buffer.out, len);
@@ -116,9 +130,7 @@ static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
       dcd_event_xfer_complete(rhport, ep, xfer->processed_len, XFER_RESULT_SUCCESS, true);
     }
 
-    if (ep == 0) {
-      EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
-    } else {
+    if (ep != 0) {
       uint8_t rx_res = data.isochronous[ep]
                       ? USBFS_EP_R_RES_NYET
                       : (xfer->valid ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK);
@@ -173,10 +185,11 @@ void dcd_int_handler(uint8_t rhport) {
   if (status & USBFS_INT_FG_TRANSFER) {
     uint8_t ep = USBFS_INT_ST_MASK_UIS_ENDP(USBOTG_FS->INT_ST);
     uint8_t token = USBFS_INT_ST_MASK_UIS_TOKEN(USBOTG_FS->INT_ST);
+    uint16_t rx_len = USBOTG_FS->RX_LEN;
+    USBOTG_FS->INT_FG = USBFS_INT_FG_TRANSFER;
 
     switch (token) {
       case PID_OUT: {
-        uint16_t rx_len = USBOTG_FS->RX_LEN;
         update_out(rhport, ep, rx_len);
         break;
       }
@@ -198,7 +211,6 @@ void dcd_int_handler(uint8_t rhport) {
         break;
     }
 
-    USBOTG_FS->INT_FG = USBFS_INT_FG_TRANSFER;
   } else if (status & USBFS_INT_FG_BUS_RST) {
     data.ep0_tog = true;
     data.xfer[0][TUSB_DIR_OUT].max_size = 64;
-- 
cgit v1.3.1


From b66fc7e88400caf7748779c7dc0b9c90f90e626b Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Sat, 23 May 2026 13:10:47 +0200
Subject: dcd/ch32x : code reformat

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 159 ++++++++++++++++---------------
 src/portable/wch/dcd_ch32_usbhs.c | 191 +++++++++++++++++++-------------------
 2 files changed, 173 insertions(+), 177 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index 3ba6eee87..37677276c 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -29,29 +29,29 @@
 
 #if CFG_TUD_ENABLED && defined(TUP_USBIP_WCH_USBFS) && CFG_TUD_WCH_USBIP_USBFS
 
-#include "device/dcd.h"
-#include "ch32_usbfs_reg.h"
+  #include "device/dcd.h"
+  #include "ch32_usbfs_reg.h"
 
-/* private defines */
-#define EP_MAX (8)
+  /* private defines */
+  #define EP_MAX         (8)
 
-#define EP_DMA(ep)     ((&USBOTG_FS->UEP0_DMA)[ep])
-#define EP_TX_LEN(ep)  ((&USBOTG_FS->UEP0_TX_LEN)[2 * ep])
-#define EP_TX_CTRL(ep) ((&USBOTG_FS->UEP0_TX_CTRL)[4 * ep])
-#define EP_RX_CTRL(ep) ((&USBOTG_FS->UEP0_RX_CTRL)[4 * ep])
+  #define EP_DMA(ep)     ((&USBOTG_FS->UEP0_DMA)[ep])
+  #define EP_TX_LEN(ep)  ((&USBOTG_FS->UEP0_TX_LEN)[2 * ep])
+  #define EP_TX_CTRL(ep) ((&USBOTG_FS->UEP0_TX_CTRL)[4 * ep])
+  #define EP_RX_CTRL(ep) ((&USBOTG_FS->UEP0_RX_CTRL)[4 * ep])
 
 /* private data */
 struct usb_xfer {
-  bool valid;
-  uint8_t* buffer;
-  size_t len;
-  size_t processed_len;
-  size_t max_size;
+  bool     valid;
+  uint8_t *buffer;
+  size_t   len;
+  size_t   processed_len;
+  size_t   max_size;
 };
 
 static struct {
-  bool ep0_tog;
-  bool isochronous[EP_MAX];
+  bool            ep0_tog;
+  bool            isochronous[EP_MAX];
   struct usb_xfer xfer[EP_MAX][2];
   TU_ATTR_ALIGNED(4) uint8_t buffer[EP_MAX][2][64];
   TU_ATTR_ALIGNED(4) struct {
@@ -64,7 +64,7 @@ static struct {
 
 /* private helpers */
 static void update_in(uint8_t rhport, uint8_t ep, bool force) {
-  struct usb_xfer* xfer = &data.xfer[ep][TUSB_DIR_IN];
+  struct usb_xfer *xfer = &data.xfer[ep][TUSB_DIR_IN];
   if (xfer->valid) {
     // Set EP to NAK to avoid spurious tramsfer
     if (ep == 0) {
@@ -89,24 +89,22 @@ static void update_in(uint8_t rhport, uint8_t ep, bool force) {
       EP_TX_LEN(ep) = len;
       if (ep == 0) {
         EP_TX_CTRL(0) = USBFS_EP_T_RES_ACK | (data.ep0_tog ? USBFS_EP_T_TOG : 0);
-        data.ep0_tog = !data.ep0_tog;
+        data.ep0_tog  = !data.ep0_tog;
       } else if (data.isochronous[ep]) {
         EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK)) | USBFS_EP_T_RES_NYET;
       } else {
         EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK)) | USBFS_EP_T_RES_ACK;
       }
     } else {
-      xfer->valid = false;
+      xfer->valid    = false;
       EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK)) | USBFS_EP_T_RES_NAK;
-      dcd_event_xfer_complete(
-          rhport, ep | TUSB_DIR_IN_MASK, xfer->processed_len,
-          XFER_RESULT_SUCCESS, true);
+      dcd_event_xfer_complete(rhport, ep | TUSB_DIR_IN_MASK, xfer->processed_len, XFER_RESULT_SUCCESS, true);
     }
   }
 }
 
 static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
-  struct usb_xfer* xfer = &data.xfer[ep][TUSB_DIR_OUT];
+  struct usb_xfer *xfer = &data.xfer[ep][TUSB_DIR_OUT];
   if (xfer->valid) {
     // Set EP to NAK to avoid spurious tramsfer
     if (ep == 0) {
@@ -131,9 +129,8 @@ static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
     }
 
     if (ep != 0) {
-      uint8_t rx_res = data.isochronous[ep]
-                      ? USBFS_EP_R_RES_NYET
-                      : (xfer->valid ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK);
+      uint8_t rx_res =
+        data.isochronous[ep] ? USBFS_EP_R_RES_NYET : (xfer->valid ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK);
       EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) | rx_res;
     }
   }
@@ -141,28 +138,28 @@ static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
 
 static void reset_ep_ctrls(void) {
   for (uint8_t ep = 1; ep < EP_MAX; ep++) {
-    EP_DMA(ep) = (uint32_t) &data.buffer[ep][0];
-    EP_TX_LEN(ep) = 0;
+    EP_DMA(ep)     = (uint32_t)&data.buffer[ep][0];
+    EP_TX_LEN(ep)  = 0;
     EP_TX_CTRL(ep) = USBFS_EP_T_AUTO_TOG | USBFS_EP_T_RES_NYET;
     EP_RX_CTRL(ep) = USBFS_EP_R_AUTO_TOG | USBFS_EP_R_RES_NYET;
   }
-  EP_DMA(3) = (uint32_t) &data.ep3_buffer.out[0];
+  EP_DMA(3) = (uint32_t)&data.ep3_buffer.out[0];
 }
 
 /* public functions */
-bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
-  (void) rh_init;
+bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
+  (void)rh_init;
   // init registers
   USBOTG_FS->BASE_CTRL = USBFS_CTRL_SYS_CTRL | USBFS_CTRL_INT_BUSY | USBFS_CTRL_DMA_EN;
   USBOTG_FS->UDEV_CTRL = USBFS_UDEV_CTRL_PD_DIS | USBFS_UDEV_CTRL_PORT_EN;
-  USBOTG_FS->DEV_ADDR = 0x00;
+  USBOTG_FS->DEV_ADDR  = 0x00;
 
   USBOTG_FS->INT_FG = 0xFF;
   USBOTG_FS->INT_EN = USBFS_INT_EN_BUS_RST | USBFS_INT_EN_TRANSFER | USBFS_INT_EN_SUSPEND;
 
   // setup endpoint 0
-  EP_DMA(0) = (uint32_t) &data.buffer[0][0];
-  EP_TX_LEN(0) = 0;
+  EP_DMA(0)     = (uint32_t)&data.buffer[0][0];
+  EP_TX_LEN(0)  = 0;
   EP_TX_CTRL(0) = USBFS_EP_T_RES_NAK;
   EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
 
@@ -170,7 +167,7 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
   USBOTG_FS->UEP4_1_MOD = 0xCC;
   USBOTG_FS->UEP2_3_MOD = 0xCC;
   USBOTG_FS->UEP5_6_MOD = 0xCC;
-  USBOTG_FS->UEP7_MOD = 0x0C;
+  USBOTG_FS->UEP7_MOD   = 0x0C;
 
   reset_ep_ctrls();
 
@@ -180,12 +177,12 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
 }
 
 void dcd_int_handler(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   uint8_t status = USBOTG_FS->INT_FG;
   if (status & USBFS_INT_FG_TRANSFER) {
-    uint8_t ep = USBFS_INT_ST_MASK_UIS_ENDP(USBOTG_FS->INT_ST);
-    uint8_t token = USBFS_INT_ST_MASK_UIS_TOKEN(USBOTG_FS->INT_ST);
-    uint16_t rx_len = USBOTG_FS->RX_LEN;
+    uint8_t  ep       = USBFS_INT_ST_MASK_UIS_ENDP(USBOTG_FS->INT_ST);
+    uint8_t  token    = USBFS_INT_ST_MASK_UIS_TOKEN(USBOTG_FS->INT_ST);
+    uint16_t rx_len   = USBOTG_FS->RX_LEN;
     USBOTG_FS->INT_FG = USBFS_INT_FG_TRANSFER;
 
     switch (token) {
@@ -201,26 +198,27 @@ void dcd_int_handler(uint8_t rhport) {
       case PID_SETUP:
         // setup clears stall
         EP_TX_CTRL(0) = USBFS_EP_T_RES_NAK;
-        data.ep0_tog = true;
+        data.ep0_tog  = true;
 
-        tusb_control_request_t const* setup =
-            (tusb_control_request_t const*) &data.buffer[0][TUSB_DIR_OUT][0];
-        EP_RX_CTRL(0) = (setup->wLength == 0) ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK;
+        const tusb_control_request_t *setup = (const tusb_control_request_t *)&data.buffer[0][TUSB_DIR_OUT][0];
+        EP_RX_CTRL(0)                       = (setup->wLength == 0) ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK;
 
         dcd_event_setup_received(rhport, &data.buffer[0][TUSB_DIR_OUT][0], true);
         break;
     }
 
   } else if (status & USBFS_INT_FG_BUS_RST) {
-    data.ep0_tog = true;
+    data.ep0_tog                        = true;
     data.xfer[0][TUSB_DIR_OUT].max_size = 64;
-    data.xfer[0][TUSB_DIR_IN].max_size = 64;
+    data.xfer[0][TUSB_DIR_IN].max_size  = 64;
 
-    //dcd_event_bus_reset(rhport, (USBOTG_FS->BASE_CTRL & USBFS_CTRL_LOW_SPEED) ? TUSB_SPEED_LOW : TUSB_SPEED_FULL, true);
-    dcd_event_bus_reset(rhport, (USBOTG_FS->UDEV_CTRL & USBFS_UDEV_CTRL_LOW_SPEED) ? TUSB_SPEED_LOW : TUSB_SPEED_FULL, true);
+    // dcd_event_bus_reset(rhport, (USBOTG_FS->BASE_CTRL & USBFS_CTRL_LOW_SPEED) ? TUSB_SPEED_LOW : TUSB_SPEED_FULL,
+    // true);
+    dcd_event_bus_reset(rhport, (USBOTG_FS->UDEV_CTRL & USBFS_UDEV_CTRL_LOW_SPEED) ? TUSB_SPEED_LOW : TUSB_SPEED_FULL,
+                        true);
 
     USBOTG_FS->DEV_ADDR = 0x00;
-    EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
+    EP_RX_CTRL(0)       = USBFS_EP_R_RES_ACK;
 
     reset_ep_ctrls();
 
@@ -233,56 +231,55 @@ void dcd_int_handler(uint8_t rhport) {
 }
 
 void dcd_int_enable(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   NVIC_EnableIRQ(USBHD_IRQn);
 }
 
 void dcd_int_disable(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   NVIC_DisableIRQ(USBHD_IRQn);
 }
 
 void dcd_set_address(uint8_t rhport, uint8_t dev_addr) {
-  (void) dev_addr;
+  (void)dev_addr;
   dcd_edpt_xfer(rhport, 0x80, NULL, 0, false); // zlp status response
 }
 
 void dcd_remote_wakeup(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   // TODO optional
 }
 
 void dcd_connect(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   USBOTG_FS->BASE_CTRL |= USBFS_CTRL_DEV_PUEN;
 }
 
 void dcd_disconnect(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   USBOTG_FS->BASE_CTRL &= ~USBFS_CTRL_DEV_PUEN;
 }
 
 void dcd_sof_enable(uint8_t rhport, bool en) {
-  (void) rhport;
-  (void) en;
+  (void)rhport;
+  (void)en;
 
   // TODO implement later
 }
 
-void dcd_edpt0_status_complete(uint8_t rhport, tusb_control_request_t const* request) {
-  (void) rhport;
+void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_request_t *request) {
+  (void)rhport;
   if (request->bmRequestType_bit.recipient == TUSB_REQ_RCPT_DEVICE &&
-      request->bmRequestType_bit.type == TUSB_REQ_TYPE_STANDARD &&
-      request->bRequest == TUSB_REQ_SET_ADDRESS) {
-    USBOTG_FS->DEV_ADDR = (uint8_t) request->wValue;
+      request->bmRequestType_bit.type == TUSB_REQ_TYPE_STANDARD && request->bRequest == TUSB_REQ_SET_ADDRESS) {
+    USBOTG_FS->DEV_ADDR = (uint8_t)request->wValue;
   }
   EP_TX_CTRL(0) = USBFS_EP_T_RES_NAK;
   EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
 }
 
-bool dcd_edpt_open(uint8_t rhport, tusb_desc_endpoint_t const* desc_ep) {
-  (void) rhport;
-  uint8_t ep = tu_edpt_number(desc_ep->bEndpointAddress);
+bool dcd_edpt_open(uint8_t rhport, const tusb_desc_endpoint_t *desc_ep) {
+  (void)rhport;
+  uint8_t ep  = tu_edpt_number(desc_ep->bEndpointAddress);
   uint8_t dir = tu_edpt_dir(desc_ep->bEndpointAddress);
   TU_ASSERT(ep < EP_MAX);
 
@@ -299,18 +296,18 @@ bool dcd_edpt_open(uint8_t rhport, tusb_desc_endpoint_t const* desc_ep) {
 }
 
 void dcd_edpt_close_all(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   // TODO optional
 }
 
 bool dcd_edpt_iso_alloc(uint8_t rhport, uint8_t ep_addr, uint16_t largest_packet_size) {
-  (void) rhport;
-  (void) ep_addr;
+  (void)rhport;
+  (void)ep_addr;
   (void)largest_packet_size;
-  uint8_t ep = tu_edpt_number(ep_addr);
+  uint8_t ep  = tu_edpt_number(ep_addr);
   uint8_t dir = tu_edpt_dir(ep_addr);
 
-  data.isochronous[ep] = true;
+  data.isochronous[ep]        = true;
   data.xfer[ep][dir].max_size = largest_packet_size;
   return true;
 }
@@ -321,17 +318,17 @@ bool dcd_edpt_iso_activate(uint8_t rhport, const tusb_desc_endpoint_t *desc_ep)
   return true;
 }
 
-bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t total_bytes, bool is_isr) {
-  (void) is_isr;
-  (void) rhport;
-  uint8_t ep = tu_edpt_number(ep_addr);
+bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t *buffer, uint16_t total_bytes, bool is_isr) {
+  (void)is_isr;
+  (void)rhport;
+  uint8_t ep  = tu_edpt_number(ep_addr);
   uint8_t dir = tu_edpt_dir(ep_addr);
 
-  struct usb_xfer* xfer = &data.xfer[ep][dir];
+  struct usb_xfer *xfer = &data.xfer[ep][dir];
   dcd_int_disable(rhport);
-  xfer->valid = true;
-  xfer->buffer = buffer;
-  xfer->len = total_bytes;
+  xfer->valid         = true;
+  xfer->buffer        = buffer;
+  xfer->len           = total_bytes;
   xfer->processed_len = 0;
   dcd_int_enable(rhport);
 
@@ -345,14 +342,14 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t t
 }
 
 void dcd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
-  (void) rhport;
-  uint8_t ep = tu_edpt_number(ep_addr);
+  (void)rhport;
+  uint8_t ep  = tu_edpt_number(ep_addr);
   uint8_t dir = tu_edpt_dir(ep_addr);
   if (ep == 0) {
     if (dir == TUSB_DIR_OUT) {
       EP_RX_CTRL(0) = USBFS_EP_R_RES_STALL;
     } else {
-      EP_TX_LEN(0) = 0;
+      EP_TX_LEN(0)  = 0;
       EP_TX_CTRL(0) = USBFS_EP_T_RES_STALL;
     }
   } else {
@@ -365,8 +362,8 @@ void dcd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
 }
 
 void dcd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
-  (void) rhport;
-  uint8_t ep = tu_edpt_number(ep_addr);
+  (void)rhport;
+  uint8_t ep  = tu_edpt_number(ep_addr);
   uint8_t dir = tu_edpt_dir(ep_addr);
   if (ep == 0) {
     if (dir == TUSB_DIR_OUT) {
diff --git a/src/portable/wch/dcd_ch32_usbhs.c b/src/portable/wch/dcd_ch32_usbhs.c
index 11734de37..01ff6eba3 100644
--- a/src/portable/wch/dcd_ch32_usbhs.c
+++ b/src/portable/wch/dcd_ch32_usbhs.c
@@ -37,12 +37,12 @@
   #define EP_MAX 16
 
 typedef struct {
-  uint8_t* buffer;
+  uint8_t *buffer;
   uint16_t total_len;
   uint16_t queued_len;
   uint16_t max_size;
-  bool is_last_packet;
-  bool is_iso;
+  bool     is_last_packet;
+  bool     is_iso;
 } xfer_ctl_t;
 
 typedef enum {
@@ -50,16 +50,16 @@ typedef enum {
   EP_RESPONSE_NAK,
 } ep_response_list_t;
 
-#define XFER_CTL_BASE(_ep, _dir) &xfer_status[_ep][_dir]
+  #define XFER_CTL_BASE(_ep, _dir) &xfer_status[_ep][_dir]
 static xfer_ctl_t xfer_status[EP_MAX][2];
 
-#define EP_TX_LEN(ep)     *(volatile uint16_t *)((volatile uint16_t *)&(USBHSD->UEP0_TX_LEN) + (ep) * 2)
-#define EP_TX_CTRL(ep)    *(volatile uint8_t *)((volatile uint8_t *)&(USBHSD->UEP0_TX_CTRL) + (ep) * 4)
-#define EP_RX_CTRL(ep)    *(volatile uint8_t *)((volatile uint8_t *)&(USBHSD->UEP0_RX_CTRL) + (ep) * 4)
-#define EP_RX_MAX_LEN(ep) *(volatile uint16_t *)((volatile uint16_t *)&(USBHSD->UEP0_MAX_LEN) + (ep) * 2)
+  #define EP_TX_LEN(ep)      *(volatile uint16_t *)((volatile uint16_t *)&(USBHSD->UEP0_TX_LEN) + (ep) * 2)
+  #define EP_TX_CTRL(ep)     *(volatile uint8_t *)((volatile uint8_t *)&(USBHSD->UEP0_TX_CTRL) + (ep) * 4)
+  #define EP_RX_CTRL(ep)     *(volatile uint8_t *)((volatile uint8_t *)&(USBHSD->UEP0_RX_CTRL) + (ep) * 4)
+  #define EP_RX_MAX_LEN(ep)  *(volatile uint16_t *)((volatile uint16_t *)&(USBHSD->UEP0_MAX_LEN) + (ep) * 2)
 
-#define EP_TX_DMA_ADDR(ep) *(volatile uint32_t *)((volatile uint32_t *)&(USBHSD->UEP1_TX_DMA) + (ep - 1))
-#define EP_RX_DMA_ADDR(ep) *(volatile uint32_t *)((volatile uint32_t *)&(USBHSD->UEP1_RX_DMA) + (ep - 1))
+  #define EP_TX_DMA_ADDR(ep) *(volatile uint32_t *)((volatile uint32_t *)&(USBHSD->UEP1_TX_DMA) + (ep - 1))
+  #define EP_RX_DMA_ADDR(ep) *(volatile uint32_t *)((volatile uint32_t *)&(USBHSD->UEP1_RX_DMA) + (ep - 1))
 
 /* Endpoint Buffer */
 TU_ATTR_ALIGNED(4) static uint8_t ep0_buffer[CFG_TUD_ENDPOINT0_SIZE];
@@ -96,15 +96,15 @@ static void ep_set_response_and_toggle(uint8_t ep_num, tusb_dir_t ep_dir, ep_res
   }
 }
 
-static void xfer_data_packet(uint8_t ep_num, tusb_dir_t ep_dir, xfer_ctl_t* xfer) {
+static void xfer_data_packet(uint8_t ep_num, tusb_dir_t ep_dir, xfer_ctl_t *xfer) {
   if (ep_dir == TUSB_DIR_IN) {
-    uint16_t remaining = xfer->total_len - xfer->queued_len;
+    uint16_t remaining    = xfer->total_len - xfer->queued_len;
     uint16_t next_tx_size = TU_MIN(remaining, xfer->max_size);
 
     if (ep_num == 0) {
       memcpy(ep0_buffer, &xfer->buffer[xfer->queued_len], next_tx_size);
     } else {
-      EP_TX_DMA_ADDR(ep_num) = (uint32_t) &xfer->buffer[xfer->queued_len];
+      EP_TX_DMA_ADDR(ep_num) = (uint32_t)&xfer->buffer[xfer->queued_len];
     }
 
     EP_TX_LEN(ep_num) = next_tx_size;
@@ -117,7 +117,7 @@ static void xfer_data_packet(uint8_t ep_num, tusb_dir_t ep_dir, xfer_ctl_t* xfer
       USBHSD->ENDP_CONFIG |= (USBHS_EP0_T_EN << ep_num);
     }
   } else { /* TUSB_DIR_OUT */
-    uint16_t left_to_receive = xfer->total_len - xfer->queued_len;
+    uint16_t left_to_receive      = xfer->total_len - xfer->queued_len;
     uint16_t max_possible_rx_size = TU_MIN(xfer->max_size, left_to_receive);
 
     if (max_possible_rx_size == left_to_receive) {
@@ -125,16 +125,16 @@ static void xfer_data_packet(uint8_t ep_num, tusb_dir_t ep_dir, xfer_ctl_t* xfer
     }
 
     if (ep_num > 0) {
-      EP_RX_DMA_ADDR(ep_num) = (uint32_t) &xfer->buffer[xfer->queued_len];
-      EP_RX_MAX_LEN(ep_num) = max_possible_rx_size;
+      EP_RX_DMA_ADDR(ep_num) = (uint32_t)&xfer->buffer[xfer->queued_len];
+      EP_RX_MAX_LEN(ep_num)  = max_possible_rx_size;
     }
   }
   ep_set_response_and_toggle(ep_num, ep_dir, USBHS_EP_R_RES_ACK);
 }
 
-bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
-  (void) rhport;
-  (void) rh_init;
+bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
+  (void)rhport;
+  (void)rh_init;
 
   memset(&xfer_status, 0, sizeof(xfer_status));
 
@@ -143,32 +143,32 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
 
   USBHSD->CONTROL = 0;
 
-#if TUD_OPT_HIGH_SPEED
+  #if TUD_OPT_HIGH_SPEED
   USBHSD->CONTROL = USBHS_DMA_EN | USBHS_INT_BUSY_EN | USBHS_HIGH_SPEED;
-#else
-  #error OPT_MODE_FULL_SPEED not currently supported on CH32
+  #else
+    #error OPT_MODE_FULL_SPEED not currently supported on CH32
   USBHSD->CONTROL = USBHS_DMA_EN | USBHS_INT_BUSY_EN | USBHS_FULL_SPEED;
-#endif
+  #endif
 
   USBHSD->INT_EN = 0;
   USBHSD->INT_EN = USBHS_SETUP_ACT_EN | USBHS_TRANSFER_EN | USBHS_BUS_RST_EN | USBHS_SUSPEND_EN | USBHS_ISO_ACT_EN;
 
   USBHSD->ENDP_CONFIG = USBHS_EP0_T_EN | USBHS_EP0_R_EN;
-  USBHSD->ENDP_TYPE = 0x00;
-  USBHSD->BUF_MODE = 0x00;
+  USBHSD->ENDP_TYPE   = 0x00;
+  USBHSD->BUF_MODE    = 0x00;
 
   for (int ep = 0; ep < EP_MAX; ep++) {
-    EP_TX_LEN(ep) = 0;
+    EP_TX_LEN(ep)  = 0;
     EP_TX_CTRL(ep) = USBHS_EP_T_AUTOTOG | USBHS_EP_T_RES_NAK;
     EP_RX_CTRL(ep) = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
 
     EP_RX_MAX_LEN(ep) = 0;
   }
 
-  USBHSD->UEP0_DMA = (uint32_t) ep0_buffer;
-  USBHSD->UEP0_MAX_LEN = CFG_TUD_ENDPOINT0_SIZE;
+  USBHSD->UEP0_DMA                      = (uint32_t)ep0_buffer;
+  USBHSD->UEP0_MAX_LEN                  = CFG_TUD_ENDPOINT0_SIZE;
   xfer_status[0][TUSB_DIR_OUT].max_size = CFG_TUD_ENDPOINT0_SIZE;
-  xfer_status[0][TUSB_DIR_IN].max_size = CFG_TUD_ENDPOINT0_SIZE;
+  xfer_status[0][TUSB_DIR_IN].max_size  = CFG_TUD_ENDPOINT0_SIZE;
 
   USBHSD->DEV_AD = 0;
   USBHSD->CONTROL |= USBHS_DEV_PU_EN;
@@ -177,20 +177,20 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
 }
 
 void dcd_int_enable(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   NVIC_EnableIRQ(USBHS_IRQn);
 }
 
 void dcd_int_disable(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   NVIC_DisableIRQ(USBHS_IRQn);
 }
 
 void dcd_edpt_close_all(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
 
   for (size_t ep = 1; ep < EP_MAX; ep++) {
-    EP_TX_LEN(ep) = 0;
+    EP_TX_LEN(ep)  = 0;
     EP_TX_CTRL(ep) = USBHS_EP_T_AUTOTOG | USBHS_EP_T_RES_NAK;
     EP_RX_CTRL(ep) = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
 
@@ -201,18 +201,18 @@ void dcd_edpt_close_all(uint8_t rhport) {
 }
 
 void dcd_set_address(uint8_t rhport, uint8_t dev_addr) {
-  (void) dev_addr;
+  (void)dev_addr;
 
   // Response with zlp status
   dcd_edpt_xfer(rhport, 0x80, NULL, 0, false);
 }
 
 void dcd_remote_wakeup(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
 }
 
 void dcd_sof_enable(uint8_t rhport, bool en) {
-  (void) rhport;
+  (void)rhport;
   if (en) {
     USBHSD->INT_EN |= USBHS_SOF_ACT_EN;
   } else {
@@ -220,24 +220,23 @@ void dcd_sof_enable(uint8_t rhport, bool en) {
   }
 }
 
-void dcd_edpt0_status_complete(uint8_t rhport, tusb_control_request_t const* request) {
-  (void) rhport;
+void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_request_t *request) {
+  (void)rhport;
 
   if (request->bmRequestType_bit.recipient == TUSB_REQ_RCPT_DEVICE &&
-      request->bmRequestType_bit.type == TUSB_REQ_TYPE_STANDARD &&
-      request->bRequest == TUSB_REQ_SET_ADDRESS) {
-    USBHSD->DEV_AD = (uint8_t) request->wValue;
+      request->bmRequestType_bit.type == TUSB_REQ_TYPE_STANDARD && request->bRequest == TUSB_REQ_SET_ADDRESS) {
+    USBHSD->DEV_AD = (uint8_t)request->wValue;
   }
 
   EP_TX_CTRL(0) = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
   EP_RX_CTRL(0) = USBHS_EP_R_RES_NAK | USBHS_EP_R_TOG_0;
 }
 
-bool dcd_edpt_open(uint8_t rhport, tusb_desc_endpoint_t const* desc_edpt) {
-  (void) rhport;
+bool dcd_edpt_open(uint8_t rhport, const tusb_desc_endpoint_t *desc_edpt) {
+  (void)rhport;
 
-  uint8_t const ep_num = tu_edpt_number(desc_edpt->bEndpointAddress);
-  tusb_dir_t const dir = tu_edpt_dir(desc_edpt->bEndpointAddress);
+  const uint8_t    ep_num = tu_edpt_number(desc_edpt->bEndpointAddress);
+  const tusb_dir_t dir    = tu_edpt_dir(desc_edpt->bEndpointAddress);
 
   TU_ASSERT(ep_num < EP_MAX);
 
@@ -245,8 +244,8 @@ bool dcd_edpt_open(uint8_t rhport, tusb_desc_endpoint_t const* desc_edpt) {
     return true;
   }
 
-  xfer_ctl_t* xfer = XFER_CTL_BASE(ep_num, dir);
-  xfer->max_size = tu_edpt_packet_size(desc_edpt);
+  xfer_ctl_t *xfer = XFER_CTL_BASE(ep_num, dir);
+  xfer->max_size   = tu_edpt_packet_size(desc_edpt);
 
   xfer->is_iso = (desc_edpt->bmAttributes.xfer == TUSB_XFER_ISOCHRONOUS);
   if (dir == TUSB_DIR_OUT) {
@@ -263,7 +262,7 @@ bool dcd_edpt_open(uint8_t rhport, tusb_desc_endpoint_t const* desc_edpt) {
       /* Enable all types except Isochronous to avoid ISO_ACT interrupt generation */
       USBHSD->ENDP_CONFIG |= (USBHS_EP0_T_EN << ep_num);
     }
-    EP_TX_LEN(ep_num) = 0;
+    EP_TX_LEN(ep_num)  = 0;
     EP_TX_CTRL(ep_num) = USBHS_EP_T_AUTOTOG | USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
   }
 
@@ -271,19 +270,19 @@ bool dcd_edpt_open(uint8_t rhport, tusb_desc_endpoint_t const* desc_edpt) {
 }
 
 void dcd_edpt_close(uint8_t rhport, uint8_t ep_addr) {
-  (void) rhport;
+  (void)rhport;
 
-  uint8_t const ep_num = tu_edpt_number(ep_addr);
-  tusb_dir_t const dir = tu_edpt_dir(ep_addr);
+  const uint8_t    ep_num = tu_edpt_number(ep_addr);
+  const tusb_dir_t dir    = tu_edpt_dir(ep_addr);
 
   if (dir == TUSB_DIR_OUT) {
-    EP_RX_CTRL(ep_num) = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
+    EP_RX_CTRL(ep_num)    = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
     EP_RX_MAX_LEN(ep_num) = 0;
     USBHSD->ENDP_TYPE &= ~(USBHS_EP0_R_TYP << ep_num);
     USBHSD->ENDP_CONFIG &= ~(USBHS_EP0_R_EN << ep_num);
-  } else {  // TUSB_DIR_IN
+  } else { // TUSB_DIR_IN
     EP_TX_CTRL(ep_num) = USBHS_EP_T_AUTOTOG | USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
-    EP_TX_LEN(ep_num) = 0;
+    EP_TX_LEN(ep_num)  = 0;
     USBHSD->ENDP_TYPE &= ~(USBHS_EP0_T_TYP << ep_num);
     USBHSD->ENDP_CONFIG &= ~(USBHS_EP0_T_EN << ep_num);
   }
@@ -305,24 +304,24 @@ bool dcd_edpt_iso_activate(uint8_t rhport, tusb_desc_endpoint_t const * desc_ep)
   #endif
 
 void dcd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
-  (void) rhport;
+  (void)rhport;
 
-  uint8_t const ep_num = tu_edpt_number(ep_addr);
-  tusb_dir_t const dir = tu_edpt_dir(ep_addr);
+  const uint8_t    ep_num = tu_edpt_number(ep_addr);
+  const tusb_dir_t dir    = tu_edpt_dir(ep_addr);
 
   if (dir == TUSB_DIR_OUT) {
     EP_RX_CTRL(ep_num) = USBHS_EP_R_RES_STALL;
   } else {
-    EP_TX_LEN(0) = 0;
+    EP_TX_LEN(0)       = 0;
     EP_TX_CTRL(ep_num) = USBHS_EP_T_RES_STALL;
   }
 }
 
 void dcd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
-  (void) rhport;
+  (void)rhport;
 
-  uint8_t const ep_num = tu_edpt_number(ep_addr);
-  tusb_dir_t const dir = tu_edpt_dir(ep_addr);
+  const uint8_t    ep_num = tu_edpt_number(ep_addr);
+  const tusb_dir_t dir    = tu_edpt_dir(ep_addr);
 
   if (dir == TUSB_DIR_OUT) {
     EP_RX_CTRL(ep_num) = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
@@ -331,16 +330,16 @@ void dcd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
   }
 }
 
-bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t total_bytes, bool is_isr) {
-  (void) is_isr;
-  (void) rhport;
-  uint8_t const ep_num = tu_edpt_number(ep_addr);
-  tusb_dir_t const dir = tu_edpt_dir(ep_addr);
+bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t *buffer, uint16_t total_bytes, bool is_isr) {
+  (void)is_isr;
+  (void)rhport;
+  const uint8_t    ep_num = tu_edpt_number(ep_addr);
+  const tusb_dir_t dir    = tu_edpt_dir(ep_addr);
 
-  xfer_ctl_t* xfer = XFER_CTL_BASE(ep_num, dir);
-  xfer->buffer = buffer;
-  xfer->total_len = total_bytes;
-  xfer->queued_len = 0;
+  xfer_ctl_t *xfer     = XFER_CTL_BASE(ep_num, dir);
+  xfer->buffer         = buffer;
+  xfer->total_len      = total_bytes;
+  xfer->queued_len     = 0;
   xfer->is_last_packet = false;
 
   xfer_data_packet(ep_num, dir, xfer);
@@ -349,22 +348,22 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t t
 }
 
 void dcd_int_handler(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
 
-  uint8_t int_flag = USBHSD->INT_FG;
+  uint8_t int_flag   = USBHSD->INT_FG;
   uint8_t int_status = USBHSD->INT_ST;
 
   if (int_flag & (USBHS_ISO_ACT_FLAG | USBHS_TRANSFER_FLAG)) {
-    uint8_t const token = int_status & MASK_UIS_TOKEN;
+    const uint8_t token = int_status & MASK_UIS_TOKEN;
 
     if (token == USBHS_TOKEN_PID_SOF) {
       uint32_t frame_count = USBHSD->FRAME_NO & USBHS_FRAME_NO_NUM_MASK;
       dcd_event_sof(rhport, frame_count, true);
-    }else {
-      uint8_t const ep_num = int_status & MASK_UIS_ENDP;
-      tusb_dir_t const ep_dir = (token == USBHS_TOKEN_PID_IN) ? TUSB_DIR_IN : TUSB_DIR_OUT;
-      uint8_t const ep_addr = tu_edpt_addr(ep_num, ep_dir);
-      xfer_ctl_t* xfer = XFER_CTL_BASE(ep_num, ep_dir);
+    } else {
+      const uint8_t    ep_num  = int_status & MASK_UIS_ENDP;
+      const tusb_dir_t ep_dir  = (token == USBHS_TOKEN_PID_IN) ? TUSB_DIR_IN : TUSB_DIR_OUT;
+      const uint8_t    ep_addr = tu_edpt_addr(ep_num, ep_dir);
+      xfer_ctl_t      *xfer    = XFER_CTL_BASE(ep_num, ep_dir);
 
       if (token == USBHS_TOKEN_PID_OUT) {
         uint16_t rx_len = USBHSD->RX_LEN;
@@ -405,28 +404,28 @@ void dcd_int_handler(uint8_t rhport) {
   } else if (int_flag & USBHS_BUS_RST_FLAG) {
     // TODO CH32 does not detect actual speed at this time (should be known at end of reset)
     // This interrupt probably triggered at start of bus reset
-//    tusb_speed_t actual_speed;
-//    switch(USBHSD->SPEED_TYPE & USBHS_SPEED_TYPE_MASK){
-//      case USBHS_SPEED_TYPE_HIGH:
-//        actual_speed = TUSB_SPEED_HIGH;
-//        break;
-//      case USBHS_SPEED_TYPE_FULL:
-//        actual_speed = TUSB_SPEED_FULL;
-//        break;
-//      case USBHS_SPEED_TYPE_LOW:
-//        actual_speed = TUSB_SPEED_LOW;
-//        break;
-//      default:
-//        TU_ASSERT(0,);
-//        break;
-//    }
-//    dcd_event_bus_reset(0, actual_speed, true);
+    //    tusb_speed_t actual_speed;
+    //    switch(USBHSD->SPEED_TYPE & USBHS_SPEED_TYPE_MASK){
+    //      case USBHS_SPEED_TYPE_HIGH:
+    //        actual_speed = TUSB_SPEED_HIGH;
+    //        break;
+    //      case USBHS_SPEED_TYPE_FULL:
+    //        actual_speed = TUSB_SPEED_FULL;
+    //        break;
+    //      case USBHS_SPEED_TYPE_LOW:
+    //        actual_speed = TUSB_SPEED_LOW;
+    //        break;
+    //      default:
+    //        TU_ASSERT(0,);
+    //        break;
+    //    }
+    //    dcd_event_bus_reset(0, actual_speed, true);
 
     dcd_event_bus_reset(0, TUSB_SPEED_HIGH, true);
 
     USBHSD->DEV_AD = 0;
-    EP_RX_CTRL(0) = USBHS_EP_R_RES_ACK | USBHS_EP_R_TOG_0;
-    EP_TX_CTRL(0) = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
+    EP_RX_CTRL(0)  = USBHS_EP_R_RES_ACK | USBHS_EP_R_TOG_0;
+    EP_TX_CTRL(0)  = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
 
     USBHSD->INT_FG = USBHS_BUS_RST_FLAG; /* Clear flag */
   } else if (int_flag & USBHS_SUSPEND_FLAG) {
-- 
cgit v1.3.1


From 08cd5c3270e79ed2e63c8941c13c84027a5c003e Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Sat, 23 May 2026 17:45:16 +0200
Subject: dcd/ch32fs: clear INT flag after processing

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index 37677276c..4ecaf129e 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -183,7 +183,6 @@ void dcd_int_handler(uint8_t rhport) {
     uint8_t  ep       = USBFS_INT_ST_MASK_UIS_ENDP(USBOTG_FS->INT_ST);
     uint8_t  token    = USBFS_INT_ST_MASK_UIS_TOKEN(USBOTG_FS->INT_ST);
     uint16_t rx_len   = USBOTG_FS->RX_LEN;
-    USBOTG_FS->INT_FG = USBFS_INT_FG_TRANSFER;
 
     switch (token) {
       case PID_OUT: {
@@ -207,6 +206,7 @@ void dcd_int_handler(uint8_t rhport) {
         break;
     }
 
+    USBOTG_FS->INT_FG = USBFS_INT_FG_TRANSFER;
   } else if (status & USBFS_INT_FG_BUS_RST) {
     data.ep0_tog                        = true;
     data.xfer[0][TUSB_DIR_OUT].max_size = 64;
-- 
cgit v1.3.1


From c6beac24ca280ce13e538f0b9459553abc825571 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Sat, 23 May 2026 19:21:59 +0200
Subject: dcd/ch32fs: do not set EP0 to ACK on status complete

It would casue race condition, SETUP packet is always acked.

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 2 --
 1 file changed, 2 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index 4ecaf129e..ca3ce7ba8 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -273,8 +273,6 @@ void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_request_t *req
       request->bmRequestType_bit.type == TUSB_REQ_TYPE_STANDARD && request->bRequest == TUSB_REQ_SET_ADDRESS) {
     USBOTG_FS->DEV_ADDR = (uint8_t)request->wValue;
   }
-  EP_TX_CTRL(0) = USBFS_EP_T_RES_NAK;
-  EP_RX_CTRL(0) = USBFS_EP_R_RES_ACK;
 }
 
 bool dcd_edpt_open(uint8_t rhport, const tusb_desc_endpoint_t *desc_ep) {
-- 
cgit v1.3.1


From 420de14b50dc2b9c1ed7ba587ef22eb227739eee Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Sat, 23 May 2026 19:30:22 +0200
Subject: dcd/ch32hs: refactor transfer flow

Refactor the driver to follow USBFS style for easier maintenance.
Replace the old packet/response helpers with explicit queue and update paths for IN and OUT transfers.
Introduce transfer validity tracking and per-endpoint data toggle state.
Reset toggle state on init, close-all, endpoint close, clear-stall, and bus reset.
Initialize endpoint controls consistently in NAK + TOG_0 mode.
Tighten EP0 setup/status handling and route transfer IRQ processing through the transfer-flag path.
Stop enabling ISO_ACT in INT_EN and clear unhandled interrupt flags explicitly.

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbhs.c | 282 ++++++++++++++++++++++----------------
 1 file changed, 163 insertions(+), 119 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbhs.c b/src/portable/wch/dcd_ch32_usbhs.c
index 01ff6eba3..cfe5e646f 100644
--- a/src/portable/wch/dcd_ch32_usbhs.c
+++ b/src/portable/wch/dcd_ch32_usbhs.c
@@ -24,7 +24,6 @@
  *
  * This file is part of the TinyUSB stack.
  */
-
 #include "tusb_option.h"
 
 #if CFG_TUD_ENABLED && defined(TUP_USBIP_WCH_USBHS) && defined(CFG_TUD_WCH_USBIP_USBHS) && \
@@ -41,15 +40,10 @@ typedef struct {
   uint16_t total_len;
   uint16_t queued_len;
   uint16_t max_size;
-  bool     is_last_packet;
   bool     is_iso;
+  bool     valid;
 } xfer_ctl_t;
 
-typedef enum {
-  EP_RESPONSE_ACK,
-  EP_RESPONSE_NAK,
-} ep_response_list_t;
-
   #define XFER_CTL_BASE(_ep, _dir) &xfer_status[_ep][_dir]
 static xfer_ctl_t xfer_status[EP_MAX][2];
 
@@ -63,73 +57,127 @@ static xfer_ctl_t xfer_status[EP_MAX][2];
 
 /* Endpoint Buffer */
 TU_ATTR_ALIGNED(4) static uint8_t ep0_buffer[CFG_TUD_ENDPOINT0_SIZE];
+static bool ep0_tog;
+static bool ep_data_tog[EP_MAX][2];
 
-static void ep_set_response_and_toggle(uint8_t ep_num, tusb_dir_t ep_dir, ep_response_list_t response_type) {
+static void set_ep_toggle(uint8_t ep_num, tusb_dir_t ep_dir, bool data1) {
   if (ep_dir == TUSB_DIR_IN) {
-    uint8_t response = (response_type == EP_RESPONSE_ACK) ? USBHS_EP_T_RES_ACK : USBHS_EP_T_RES_NAK;
-    if (ep_num == 0) {
-      if (response_type == EP_RESPONSE_ACK) {
-        if (EP_TX_LEN(ep_num) == 0) {
-          EP_TX_CTRL(ep_num) |= USBHS_EP_T_TOG_1;
-        } else {
-          EP_TX_CTRL(ep_num) ^= USBHS_EP_T_TOG_1;
-        }
-      }
-    }
-    if (xfer_status[ep_num][TUSB_DIR_IN].is_iso == true) {
-      EP_TX_CTRL(ep_num) = USBHS_EP_T_AUTOTOG;
-    } else {
-      EP_TX_CTRL(ep_num) = (EP_TX_CTRL(ep_num) & ~(USBHS_EP_T_RES_MASK)) | response;
-    }
+    EP_TX_CTRL(ep_num) = (EP_TX_CTRL(ep_num) & ~(USBHS_EP_T_TOG_MASK)) |
+                         (data1 ? USBHS_EP_T_TOG_1 : USBHS_EP_T_TOG_0);
   } else {
-    uint8_t response = (response_type == EP_RESPONSE_ACK) ? USBHS_EP_R_RES_ACK : USBHS_EP_R_RES_NAK;
-    if (ep_num == 0) {
-      if (response_type == EP_RESPONSE_ACK) {
-        if (xfer_status[ep_num][TUSB_DIR_OUT].queued_len == 0) {
-          EP_RX_CTRL(ep_num) |= USBHS_EP_R_TOG_1;
-        }
-      } else {
-        EP_RX_CTRL(ep_num) ^= USBHS_EP_R_TOG_1;
-      }
-    }
-    EP_RX_CTRL(ep_num) = (EP_RX_CTRL(ep_num) & ~(USBHS_EP_R_RES_MASK)) | response;
+    EP_RX_CTRL(ep_num) = (EP_RX_CTRL(ep_num) & ~(USBHS_EP_R_TOG_MASK)) |
+                         (data1 ? USBHS_EP_R_TOG_1 : USBHS_EP_R_TOG_0);
   }
 }
 
-static void xfer_data_packet(uint8_t ep_num, tusb_dir_t ep_dir, xfer_ctl_t *xfer) {
-  if (ep_dir == TUSB_DIR_IN) {
-    uint16_t remaining    = xfer->total_len - xfer->queued_len;
-    uint16_t next_tx_size = TU_MIN(remaining, xfer->max_size);
+static void queue_in_packet(uint8_t ep_num, xfer_ctl_t* xfer) {
+  uint16_t remaining = xfer->total_len - xfer->queued_len;
+  uint16_t tx_len = TU_MIN(remaining, xfer->max_size);
 
-    if (ep_num == 0) {
-      memcpy(ep0_buffer, &xfer->buffer[xfer->queued_len], next_tx_size);
-    } else {
-      EP_TX_DMA_ADDR(ep_num) = (uint32_t)&xfer->buffer[xfer->queued_len];
-    }
+  if (ep_num == 0) {
+    memcpy(ep0_buffer, &xfer->buffer[xfer->queued_len], tx_len);
+  } else {
+    EP_TX_DMA_ADDR(ep_num) = (uint32_t) &xfer->buffer[xfer->queued_len];
+  }
 
-    EP_TX_LEN(ep_num) = next_tx_size;
-    xfer->queued_len += next_tx_size;
-    if (xfer->queued_len == xfer->total_len) {
-      xfer->is_last_packet = true;
-    }
-    if (xfer->is_iso == true) {
-      /* Enable EP to generate ISA_ACT interrupt */
-      USBHSD->ENDP_CONFIG |= (USBHS_EP0_T_EN << ep_num);
-    }
-  } else { /* TUSB_DIR_OUT */
-    uint16_t left_to_receive      = xfer->total_len - xfer->queued_len;
-    uint16_t max_possible_rx_size = TU_MIN(xfer->max_size, left_to_receive);
+  EP_TX_LEN(ep_num) = tx_len;
+  xfer->queued_len += tx_len;
+
+  if (ep_num == 0) {
+    EP_TX_CTRL(0) = USBHS_EP_T_RES_ACK | (ep0_tog ? USBHS_EP_T_TOG_1 : USBHS_EP_T_TOG_0);
+    ep0_tog = !ep0_tog;
+  } else if (xfer->is_iso) {
+    EP_TX_CTRL(ep_num) = (EP_TX_CTRL(ep_num) & ~(USBHS_EP_T_RES_MASK)) | USBHS_EP_T_RES_NYET;
+  } else {
+    set_ep_toggle(ep_num, TUSB_DIR_IN, ep_data_tog[ep_num][TUSB_DIR_IN]);
+    EP_TX_CTRL(ep_num) = (EP_TX_CTRL(ep_num) & ~(USBHS_EP_T_RES_MASK)) | USBHS_EP_T_RES_ACK;
+  }
+}
 
-    if (max_possible_rx_size == left_to_receive) {
-      xfer->is_last_packet = true;
+static void queue_out_packet(uint8_t ep_num, xfer_ctl_t* xfer) {
+  uint16_t remaining = xfer->total_len - xfer->queued_len;
+  uint16_t rx_len = TU_MIN(remaining, xfer->max_size);
+
+  if (ep_num > 0) {
+    EP_RX_DMA_ADDR(ep_num) = (uint32_t) &xfer->buffer[xfer->queued_len];
+    EP_RX_MAX_LEN(ep_num) = rx_len;
+  }
+
+  if (ep_num == 0) {
+    EP_RX_CTRL(0) = (EP_RX_CTRL(0) & ~(USBHS_EP_R_RES_MASK)) | USBHS_EP_R_RES_ACK;
+  } else if (xfer->is_iso) {
+    EP_RX_CTRL(ep_num) = (EP_RX_CTRL(ep_num) & ~(USBHS_EP_R_RES_MASK)) | USBHS_EP_R_RES_NYET;
+  } else {
+    set_ep_toggle(ep_num, TUSB_DIR_OUT, ep_data_tog[ep_num][TUSB_DIR_OUT]);
+    EP_RX_CTRL(ep_num) = (EP_RX_CTRL(ep_num) & ~(USBHS_EP_R_RES_MASK)) | USBHS_EP_R_RES_ACK;
+  }
+}
+
+static void update_in(uint8_t rhport, uint8_t ep_num, bool force) {
+  xfer_ctl_t* xfer = XFER_CTL_BASE(ep_num, TUSB_DIR_IN);
+  if (!xfer->valid) {
+    return;
+  }
+
+  if (!force && ep_num != 0 && !xfer->is_iso) {
+    ep_data_tog[ep_num][TUSB_DIR_IN] = !ep_data_tog[ep_num][TUSB_DIR_IN];
+  }
+
+  if (ep_num == 0) {
+    EP_TX_CTRL(0) = USBHS_EP_T_RES_NAK | (ep0_tog ? USBHS_EP_T_TOG_1 : USBHS_EP_T_TOG_0);
+  } else if (!xfer->is_iso) {
+    EP_TX_CTRL(ep_num) = (EP_TX_CTRL(ep_num) & ~(USBHS_EP_T_RES_MASK)) | USBHS_EP_T_RES_NAK;
+  }
+
+  if (force || (xfer->total_len > xfer->queued_len)) {
+    queue_in_packet(ep_num, xfer);
+  } else {
+    xfer->valid = false;
+    if (ep_num != 0) {
+      EP_TX_CTRL(ep_num) = (EP_TX_CTRL(ep_num) & ~(USBHS_EP_T_RES_MASK)) | USBHS_EP_T_RES_NAK;
     }
+    dcd_event_xfer_complete(rhport, ep_num | TUSB_DIR_IN_MASK, xfer->queued_len, XFER_RESULT_SUCCESS, true);
+  }
+}
+
+static void update_out(uint8_t rhport, uint8_t ep_num, uint16_t rx_len) {
+  xfer_ctl_t* xfer = XFER_CTL_BASE(ep_num, TUSB_DIR_OUT);
+  if (!xfer->valid) {
+    return;
+  }
+
+  if (ep_num == 0) {
+    EP_RX_CTRL(0) = (EP_RX_CTRL(0) & ~(USBHS_EP_R_RES_MASK)) | USBHS_EP_R_RES_NAK;
+  } else if (!xfer->is_iso) {
+    EP_RX_CTRL(ep_num) = (EP_RX_CTRL(ep_num) & ~(USBHS_EP_R_RES_MASK)) | USBHS_EP_R_RES_NAK;
+  }
 
-    if (ep_num > 0) {
-      EP_RX_DMA_ADDR(ep_num) = (uint32_t)&xfer->buffer[xfer->queued_len];
-      EP_RX_MAX_LEN(ep_num)  = max_possible_rx_size;
+  uint16_t remaining = xfer->total_len - xfer->queued_len;
+  uint16_t len = TU_MIN(rx_len, TU_MIN(remaining, xfer->max_size));
+
+  if (ep_num == 0) {
+    memcpy(&xfer->buffer[xfer->queued_len], ep0_buffer, len);
+  }
+
+  xfer->queued_len += len;
+
+  if (ep_num != 0 && !xfer->is_iso) {
+    ep_data_tog[ep_num][TUSB_DIR_OUT] = !ep_data_tog[ep_num][TUSB_DIR_OUT];
+  }
+
+  if ((xfer->queued_len == xfer->total_len) || (len < xfer->max_size)) {
+    xfer->valid = false;
+    dcd_event_xfer_complete(rhport, ep_num, xfer->queued_len, XFER_RESULT_SUCCESS, true);
+  }
+
+  if (ep_num != 0) {
+    if (xfer->valid) {
+      queue_out_packet(ep_num, xfer);
+    } else {
+      uint8_t rx_res = xfer->is_iso ? USBHS_EP_R_RES_NYET : USBHS_EP_R_RES_NAK;
+      EP_RX_CTRL(ep_num) = (EP_RX_CTRL(ep_num) & ~(USBHS_EP_R_RES_MASK)) | rx_res;
     }
   }
-  ep_set_response_and_toggle(ep_num, ep_dir, USBHS_EP_R_RES_ACK);
 }
 
 bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
@@ -137,6 +185,8 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
   (void)rh_init;
 
   memset(&xfer_status, 0, sizeof(xfer_status));
+  memset(ep_data_tog, 0, sizeof(ep_data_tog));
+  ep0_tog = true;
 
   USBHSD->HOST_CTRL = 0x00;
   USBHSD->HOST_CTRL = USBHS_PHY_SUSPENDM;
@@ -151,7 +201,7 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
   #endif
 
   USBHSD->INT_EN = 0;
-  USBHSD->INT_EN = USBHS_SETUP_ACT_EN | USBHS_TRANSFER_EN | USBHS_BUS_RST_EN | USBHS_SUSPEND_EN | USBHS_ISO_ACT_EN;
+  USBHSD->INT_EN = USBHS_SETUP_ACT_EN | USBHS_TRANSFER_EN | USBHS_BUS_RST_EN | USBHS_SUSPEND_EN;
 
   USBHSD->ENDP_CONFIG = USBHS_EP0_T_EN | USBHS_EP0_R_EN;
   USBHSD->ENDP_TYPE   = 0x00;
@@ -159,8 +209,8 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
 
   for (int ep = 0; ep < EP_MAX; ep++) {
     EP_TX_LEN(ep)  = 0;
-    EP_TX_CTRL(ep) = USBHS_EP_T_AUTOTOG | USBHS_EP_T_RES_NAK;
-    EP_RX_CTRL(ep) = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
+    EP_TX_CTRL(ep) = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
+    EP_RX_CTRL(ep) = USBHS_EP_R_RES_NAK | USBHS_EP_R_TOG_0;
 
     EP_RX_MAX_LEN(ep) = 0;
   }
@@ -189,10 +239,12 @@ void dcd_int_disable(uint8_t rhport) {
 void dcd_edpt_close_all(uint8_t rhport) {
   (void)rhport;
 
+  memset(ep_data_tog, 0, sizeof(ep_data_tog));
+
   for (size_t ep = 1; ep < EP_MAX; ep++) {
     EP_TX_LEN(ep)  = 0;
-    EP_TX_CTRL(ep) = USBHS_EP_T_AUTOTOG | USBHS_EP_T_RES_NAK;
-    EP_RX_CTRL(ep) = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
+    EP_TX_CTRL(ep) = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
+    EP_RX_CTRL(ep) = USBHS_EP_R_RES_NAK | USBHS_EP_R_TOG_0;
 
     EP_RX_MAX_LEN(ep) = 0;
   }
@@ -222,14 +274,10 @@ void dcd_sof_enable(uint8_t rhport, bool en) {
 
 void dcd_edpt0_status_complete(uint8_t rhport, const tusb_control_request_t *request) {
   (void)rhport;
-
   if (request->bmRequestType_bit.recipient == TUSB_REQ_RCPT_DEVICE &&
       request->bmRequestType_bit.type == TUSB_REQ_TYPE_STANDARD && request->bRequest == TUSB_REQ_SET_ADDRESS) {
     USBHSD->DEV_AD = (uint8_t)request->wValue;
   }
-
-  EP_TX_CTRL(0) = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
-  EP_RX_CTRL(0) = USBHS_EP_R_RES_NAK | USBHS_EP_R_TOG_0;
 }
 
 bool dcd_edpt_open(uint8_t rhport, const tusb_desc_endpoint_t *desc_edpt) {
@@ -246,11 +294,12 @@ bool dcd_edpt_open(uint8_t rhport, const tusb_desc_endpoint_t *desc_edpt) {
 
   xfer_ctl_t *xfer = XFER_CTL_BASE(ep_num, dir);
   xfer->max_size   = tu_edpt_packet_size(desc_edpt);
+  ep_data_tog[ep_num][dir] = false;
 
   xfer->is_iso = (desc_edpt->bmAttributes.xfer == TUSB_XFER_ISOCHRONOUS);
   if (dir == TUSB_DIR_OUT) {
     USBHSD->ENDP_CONFIG |= (USBHS_EP0_R_EN << ep_num);
-    EP_RX_CTRL(ep_num) = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
+    EP_RX_CTRL(ep_num) = USBHS_EP_R_RES_NAK | USBHS_EP_R_TOG_0;
     if (xfer->is_iso == true) {
       USBHSD->ENDP_TYPE |= (USBHS_EP0_R_TYP << ep_num);
     }
@@ -258,12 +307,10 @@ bool dcd_edpt_open(uint8_t rhport, const tusb_desc_endpoint_t *desc_edpt) {
   } else {
     if (xfer->is_iso == true) {
       USBHSD->ENDP_TYPE |= (USBHS_EP0_T_TYP << ep_num);
-    } else {
-      /* Enable all types except Isochronous to avoid ISO_ACT interrupt generation */
-      USBHSD->ENDP_CONFIG |= (USBHS_EP0_T_EN << ep_num);
     }
+    USBHSD->ENDP_CONFIG |= (USBHS_EP0_T_EN << ep_num);
     EP_TX_LEN(ep_num)  = 0;
-    EP_TX_CTRL(ep_num) = USBHS_EP_T_AUTOTOG | USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
+    EP_TX_CTRL(ep_num) = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
   }
 
   return true;
@@ -276,13 +323,15 @@ void dcd_edpt_close(uint8_t rhport, uint8_t ep_addr) {
   const tusb_dir_t dir    = tu_edpt_dir(ep_addr);
 
   if (dir == TUSB_DIR_OUT) {
-    EP_RX_CTRL(ep_num)    = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
+    EP_RX_CTRL(ep_num)    = USBHS_EP_R_RES_NAK | USBHS_EP_R_TOG_0;
     EP_RX_MAX_LEN(ep_num) = 0;
+    ep_data_tog[ep_num][TUSB_DIR_OUT] = false;
     USBHSD->ENDP_TYPE &= ~(USBHS_EP0_R_TYP << ep_num);
     USBHSD->ENDP_CONFIG &= ~(USBHS_EP0_R_EN << ep_num);
   } else { // TUSB_DIR_IN
-    EP_TX_CTRL(ep_num) = USBHS_EP_T_AUTOTOG | USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
+    EP_TX_CTRL(ep_num) = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
     EP_TX_LEN(ep_num)  = 0;
+    ep_data_tog[ep_num][TUSB_DIR_IN] = false;
     USBHSD->ENDP_TYPE &= ~(USBHS_EP0_T_TYP << ep_num);
     USBHSD->ENDP_CONFIG &= ~(USBHS_EP0_T_EN << ep_num);
   }
@@ -324,9 +373,11 @@ void dcd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr) {
   const tusb_dir_t dir    = tu_edpt_dir(ep_addr);
 
   if (dir == TUSB_DIR_OUT) {
-    EP_RX_CTRL(ep_num) = USBHS_EP_R_AUTOTOG | USBHS_EP_R_RES_NAK;
+    EP_RX_CTRL(ep_num) = USBHS_EP_R_RES_NAK | USBHS_EP_R_TOG_0;
+    ep_data_tog[ep_num][TUSB_DIR_OUT] = false;
   } else {
-    EP_TX_CTRL(ep_num) = USBHS_EP_T_AUTOTOG | USBHS_EP_R_RES_NAK;
+    EP_TX_CTRL(ep_num) = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
+    ep_data_tog[ep_num][TUSB_DIR_IN] = false;
   }
 }
 
@@ -340,9 +391,21 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t *buffer, uint16_t to
   xfer->buffer         = buffer;
   xfer->total_len      = total_bytes;
   xfer->queued_len     = 0;
-  xfer->is_last_packet = false;
+  xfer->valid         = true;
+
+  if (ep_num == 0 && dir == TUSB_DIR_OUT) {
+    if (total_bytes == 0) {
+      EP_RX_CTRL(0) = (EP_RX_CTRL(0) & ~(USBHS_EP_R_TOG_MASK)) | USBHS_EP_R_TOG_1;
+    } else {
+      EP_RX_CTRL(0) ^= USBHS_EP_R_TOG_1;
+    }
+  }
 
-  xfer_data_packet(ep_num, dir, xfer);
+  if (dir == TUSB_DIR_IN) {
+    update_in(rhport, ep_num, true);
+  } else {
+    queue_out_packet(ep_num, xfer);
+  }
 
   return true;
 }
@@ -353,51 +416,27 @@ void dcd_int_handler(uint8_t rhport) {
   uint8_t int_flag   = USBHSD->INT_FG;
   uint8_t int_status = USBHSD->INT_ST;
 
-  if (int_flag & (USBHS_ISO_ACT_FLAG | USBHS_TRANSFER_FLAG)) {
+  if (int_flag & USBHS_TRANSFER_FLAG) {
     const uint8_t token = int_status & MASK_UIS_TOKEN;
+    const uint8_t ep_num = int_status & MASK_UIS_ENDP;
+    const uint16_t len = USBHSD->RX_LEN;
 
     if (token == USBHS_TOKEN_PID_SOF) {
       uint32_t frame_count = USBHSD->FRAME_NO & USBHS_FRAME_NO_NUM_MASK;
       dcd_event_sof(rhport, frame_count, true);
-    } else {
-      const uint8_t    ep_num  = int_status & MASK_UIS_ENDP;
-      const tusb_dir_t ep_dir  = (token == USBHS_TOKEN_PID_IN) ? TUSB_DIR_IN : TUSB_DIR_OUT;
-      const uint8_t    ep_addr = tu_edpt_addr(ep_num, ep_dir);
-      xfer_ctl_t      *xfer    = XFER_CTL_BASE(ep_num, ep_dir);
-
-      if (token == USBHS_TOKEN_PID_OUT) {
-        uint16_t rx_len = USBHSD->RX_LEN;
-
-        if (ep_num == 0) {
-          memcpy(&xfer->buffer[xfer->queued_len], ep0_buffer, rx_len);
-        }
-
-        xfer->queued_len += rx_len;
-        if (rx_len < xfer->max_size) {
-          xfer->is_last_packet = true;
-        }
-      } else if (token == USBHS_TOKEN_PID_IN) {
-        if (xfer->is_iso && xfer->is_last_packet) {
-          /* Disable EP to avoid ISO_ACT interrupt generation */
-          USBHSD->ENDP_CONFIG &= ~(USBHS_EP0_T_EN << ep_num);
-        } else {
-          // Do nothing, no need to update xfer->is_last_packet, it is already updated in xfer_data_packet
-        }
-      }
-
-      if (xfer->is_last_packet == true) {
-        ep_set_response_and_toggle(ep_num, ep_dir, EP_RESPONSE_NAK);
-        dcd_event_xfer_complete(0, ep_addr, xfer->queued_len, XFER_RESULT_SUCCESS, true);
-      } else {
-        /* prepare next part of packet to xref */
-        xfer_data_packet(ep_num, ep_dir, xfer);
-      }
+    } else if (token == USBHS_TOKEN_PID_OUT) {
+      update_out(rhport, ep_num, len);
+    } else if (token == USBHS_TOKEN_PID_IN) {
+      update_in(rhport, ep_num, false);
     }
-
-    USBHSD->INT_FG = (int_flag & (USBHS_ISO_ACT_FLAG | USBHS_TRANSFER_FLAG)); /* Clear flag */
+    USBHSD->INT_FG = (int_flag & USBHS_TRANSFER_FLAG); /* Clear flag */
   } else if (int_flag & USBHS_SETUP_FLAG) {
-    ep_set_response_and_toggle(0, TUSB_DIR_IN, EP_RESPONSE_NAK);
-    ep_set_response_and_toggle(0, TUSB_DIR_OUT, EP_RESPONSE_NAK);
+    tusb_control_request_t const* setup =
+        (tusb_control_request_t const*) ep0_buffer;
+    ep0_tog = true;
+    EP_RX_CTRL(0) = (setup->wLength == 0) ? USBHS_EP_R_RES_ACK : USBHS_EP_R_RES_NAK;
+    EP_TX_CTRL(0) = USBHS_EP_T_RES_NAK;
+
     dcd_event_setup_received(0, ep0_buffer, true);
 
     USBHSD->INT_FG = USBHS_SETUP_FLAG; /* Clear flag */
@@ -424,6 +463,8 @@ void dcd_int_handler(uint8_t rhport) {
     dcd_event_bus_reset(0, TUSB_SPEED_HIGH, true);
 
     USBHSD->DEV_AD = 0;
+    memset(ep_data_tog, 0, sizeof(ep_data_tog));
+    ep0_tog = true;
     EP_RX_CTRL(0)  = USBHS_EP_R_RES_ACK | USBHS_EP_R_TOG_0;
     EP_TX_CTRL(0)  = USBHS_EP_T_RES_NAK | USBHS_EP_T_TOG_0;
 
@@ -433,6 +474,9 @@ void dcd_int_handler(uint8_t rhport) {
     dcd_event_handler(&event, true);
 
     USBHSD->INT_FG = USBHS_SUSPEND_FLAG; /* Clear flag */
+  } else {
+    // Unhandled interrupt
+    USBHSD->INT_FG = int_flag; /* Clear all flags */
   }
 }
 #endif
-- 
cgit v1.3.1


From 311fb46eb2f963254af6ab206b74828a0ba0273c Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Sat, 23 May 2026 20:06:50 +0200
Subject: dcd/ch32x: optmize CTRL reg writing, basically revert e14b0e85

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/wch/dcd_ch32_usbfs.c | 26 +++++++++-----------------
 src/portable/wch/dcd_ch32_usbhs.c | 19 ++++++-------------
 2 files changed, 15 insertions(+), 30 deletions(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index ca3ce7ba8..af0f17785 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -66,13 +66,6 @@ static struct {
 static void update_in(uint8_t rhport, uint8_t ep, bool force) {
   struct usb_xfer *xfer = &data.xfer[ep][TUSB_DIR_IN];
   if (xfer->valid) {
-    // Set EP to NAK to avoid spurious tramsfer
-    if (ep == 0) {
-      EP_TX_CTRL(0) = USBFS_EP_T_RES_NAK | (data.ep0_tog ? USBFS_EP_T_TOG : 0);
-    } else if (!data.isochronous[ep]) {
-      EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK)) | USBFS_EP_T_RES_NAK;
-    }
-
     if (force || xfer->len) {
       size_t len = TU_MIN(xfer->max_size, xfer->len);
       if (ep == 0) {
@@ -96,8 +89,12 @@ static void update_in(uint8_t rhport, uint8_t ep, bool force) {
         EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK)) | USBFS_EP_T_RES_ACK;
       }
     } else {
-      xfer->valid    = false;
-      EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK)) | USBFS_EP_T_RES_NAK;
+      xfer->valid = false;
+      if (ep == 0) {
+        EP_TX_CTRL(0) = USBFS_EP_T_RES_NAK | (data.ep0_tog ? USBFS_EP_T_TOG : 0);
+      } else if (!data.isochronous[ep]) {
+        EP_TX_CTRL(ep) = (EP_TX_CTRL(ep) & ~(USBFS_EP_T_RES_MASK)) | USBFS_EP_T_RES_NAK;
+      }
       dcd_event_xfer_complete(rhport, ep | TUSB_DIR_IN_MASK, xfer->processed_len, XFER_RESULT_SUCCESS, true);
     }
   }
@@ -106,13 +103,6 @@ static void update_in(uint8_t rhport, uint8_t ep, bool force) {
 static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
   struct usb_xfer *xfer = &data.xfer[ep][TUSB_DIR_OUT];
   if (xfer->valid) {
-    // Set EP to NAK to avoid spurious tramsfer
-    if (ep == 0) {
-      EP_RX_CTRL(0) = USBFS_EP_R_RES_NAK;
-    } else if (!data.isochronous[ep]) {
-      EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) | USBFS_EP_R_RES_NAK;
-    }
-
     size_t len = TU_MIN(xfer->max_size, TU_MIN(xfer->len, rx_len));
     if (ep == 3) {
       memcpy(xfer->buffer, data.ep3_buffer.out, len);
@@ -128,7 +118,9 @@ static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
       dcd_event_xfer_complete(rhport, ep, xfer->processed_len, XFER_RESULT_SUCCESS, true);
     }
 
-    if (ep != 0) {
+    if (ep == 0) {
+      EP_RX_CTRL(0) = USBFS_EP_R_RES_NAK;
+    } else {
       uint8_t rx_res =
         data.isochronous[ep] ? USBFS_EP_R_RES_NYET : (xfer->valid ? USBFS_EP_R_RES_ACK : USBFS_EP_R_RES_NAK);
       EP_RX_CTRL(ep) = (EP_RX_CTRL(ep) & ~USBFS_EP_R_RES_MASK) | rx_res;
diff --git a/src/portable/wch/dcd_ch32_usbhs.c b/src/portable/wch/dcd_ch32_usbhs.c
index cfe5e646f..a6dd5bb79 100644
--- a/src/portable/wch/dcd_ch32_usbhs.c
+++ b/src/portable/wch/dcd_ch32_usbhs.c
@@ -123,17 +123,13 @@ static void update_in(uint8_t rhport, uint8_t ep_num, bool force) {
     ep_data_tog[ep_num][TUSB_DIR_IN] = !ep_data_tog[ep_num][TUSB_DIR_IN];
   }
 
-  if (ep_num == 0) {
-    EP_TX_CTRL(0) = USBHS_EP_T_RES_NAK | (ep0_tog ? USBHS_EP_T_TOG_1 : USBHS_EP_T_TOG_0);
-  } else if (!xfer->is_iso) {
-    EP_TX_CTRL(ep_num) = (EP_TX_CTRL(ep_num) & ~(USBHS_EP_T_RES_MASK)) | USBHS_EP_T_RES_NAK;
-  }
-
   if (force || (xfer->total_len > xfer->queued_len)) {
     queue_in_packet(ep_num, xfer);
   } else {
     xfer->valid = false;
-    if (ep_num != 0) {
+    if (ep_num == 0) {
+      EP_TX_CTRL(0) = USBHS_EP_T_RES_NAK | (ep0_tog ? USBHS_EP_T_TOG_1 : USBHS_EP_T_TOG_0);
+    } else {
       EP_TX_CTRL(ep_num) = (EP_TX_CTRL(ep_num) & ~(USBHS_EP_T_RES_MASK)) | USBHS_EP_T_RES_NAK;
     }
     dcd_event_xfer_complete(rhport, ep_num | TUSB_DIR_IN_MASK, xfer->queued_len, XFER_RESULT_SUCCESS, true);
@@ -146,12 +142,6 @@ static void update_out(uint8_t rhport, uint8_t ep_num, uint16_t rx_len) {
     return;
   }
 
-  if (ep_num == 0) {
-    EP_RX_CTRL(0) = (EP_RX_CTRL(0) & ~(USBHS_EP_R_RES_MASK)) | USBHS_EP_R_RES_NAK;
-  } else if (!xfer->is_iso) {
-    EP_RX_CTRL(ep_num) = (EP_RX_CTRL(ep_num) & ~(USBHS_EP_R_RES_MASK)) | USBHS_EP_R_RES_NAK;
-  }
-
   uint16_t remaining = xfer->total_len - xfer->queued_len;
   uint16_t len = TU_MIN(rx_len, TU_MIN(remaining, xfer->max_size));
 
@@ -167,6 +157,9 @@ static void update_out(uint8_t rhport, uint8_t ep_num, uint16_t rx_len) {
 
   if ((xfer->queued_len == xfer->total_len) || (len < xfer->max_size)) {
     xfer->valid = false;
+    if (ep_num == 0) {
+      EP_RX_CTRL(0) = (EP_RX_CTRL(0) & ~(USBHS_EP_R_RES_MASK)) | USBHS_EP_R_RES_NAK;
+    }
     dcd_event_xfer_complete(rhport, ep_num, xfer->queued_len, XFER_RESULT_SUCCESS, true);
   }
 
-- 
cgit v1.3.1


From d63a45509fd283f5ffccc29cd8569e6efd075c59 Mon Sep 17 00:00:00 2001
From: Jie Feng <hjf3108@gmail.com>
Date: Thu, 21 May 2026 14:52:38 +0800
Subject: ch32_usbhs: fix endpoint stall length index and clear-stall response

Fix issue in the stall handling:

- dcd_edpt_stall() for an IN endpoint cleared EP_TX_LEN(0) instead of
  EP_TX_LEN(ep_num), clobbering endpoint 0's transmit length register
  when stalling any other IN endpoint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/portable/wch/dcd_ch32_usbhs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/portable/wch/dcd_ch32_usbhs.c b/src/portable/wch/dcd_ch32_usbhs.c
index a6dd5bb79..ea3b052ad 100644
--- a/src/portable/wch/dcd_ch32_usbhs.c
+++ b/src/portable/wch/dcd_ch32_usbhs.c
@@ -354,7 +354,7 @@ void dcd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
   if (dir == TUSB_DIR_OUT) {
     EP_RX_CTRL(ep_num) = USBHS_EP_R_RES_STALL;
   } else {
-    EP_TX_LEN(0)       = 0;
+    EP_TX_LEN(ep_num) = 0;
     EP_TX_CTRL(ep_num) = USBHS_EP_T_RES_STALL;
   }
 }
-- 
cgit v1.3.1


From e520cff090e5da57e38ef3c7af250aab6d57a186 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Wed, 27 May 2026 00:19:42 +0200
Subject: dwc2: simplify EP0 ZLP handling

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/synopsys/dwc2/dcd_dwc2.c | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 8997394dd..23fe671d4 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -69,9 +69,6 @@ typedef struct {
 
   // SOF enabling flag - required for SOF to not get disabled in ISR when SOF was enabled by
   bool sof_en;
-
-  // EP0 status OUT flag
-  bool ep0_status_out;
 } dcd_data_t;
 
 static dcd_data_t _dcd_data;
@@ -668,9 +665,6 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t* buffer, uint16_t to
     // EP0 can only handle one packet
     if (epnum == 0) {
       _dcd_data.ep0_pending[dir] = total_bytes;
-      if (dir == TUSB_DIR_OUT) {
-        _dcd_data.ep0_status_out = (total_bytes == 0);
-      }
     }
 
     // Schedule packets to be sent within interrupt
@@ -752,7 +746,6 @@ static void handle_bus_reset(uint8_t rhport) {
 
   _dcd_data.sof_en = false;
   _dcd_data.allocated_epin_count = 0;
-  _dcd_data.ep0_status_out = false;
 
   // 1. NAK for all OUT endpoints
   for (uint8_t n = 0; n < ep_count; n++) {
@@ -907,9 +900,6 @@ static void handle_rxflvl_irq(uint8_t rhport) {
       // We can receive up to three setup packets in succession, but only the last one is valid.
       setup[0] = (*rx_fifo);
       setup[1] = (*rx_fifo);
-
-      // Clear previous pending EP0 OUT if any
-      _dcd_data.ep0_status_out = false;
       break;
     }
 
@@ -940,6 +930,10 @@ static void handle_rxflvl_irq(uint8_t rhport) {
         xfer->total_len -= tsiz.xfer_size;
         if (epnum == 0) {
           _dcd_data.ep0_pending[TUSB_DIR_OUT] = 0;
+          // Handle EP0 STATUS OUT (or ZLP) here to avoid mix with next SETUP packet received IRQ
+          if (xfer->total_len == 0) {
+            dcd_event_xfer_complete(rhport, 0, 0, XFER_RESULT_SUCCESS, true);
+          }
         }
       }
       break;
@@ -949,12 +943,6 @@ static void handle_rxflvl_irq(uint8_t rhport) {
       // Out packet done
       // After this entry is popped from the receive FIFO, dwc2 asserts a Transfer Completed interrupt on
       // the specified OUT endpoint which will be handled by handle_epout_irq()
-
-      // EP0 status OUT is complete
-      if (epnum == 0 && _dcd_data.ep0_status_out) {
-        _dcd_data.ep0_status_out = false;
-        dcd_event_xfer_complete(rhport, epnum, 0, XFER_RESULT_SUCCESS, true);
-      }
       break;
 
     default: break; // nothing to do
@@ -984,7 +972,7 @@ static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doe
           // EP0 can only handle one packet, Schedule another packet to be received.
           edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
         } else if (xfer->total_len > 0) {
-          // EP0 status out is handled in handle_rxflvl_irq
+          // EP0 STATUS OUT (or ZLP) is handled in handle_rxflvl_irq()
           dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
         }
       } else {
-- 
cgit v1.3.1


From a560281051022473c844bdb258be452da52ce5c3 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 22 May 2026 13:42:08 +0200
Subject: dwc2: fix EP0 DMA setup race condition

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/synopsys/dwc2/dcd_dwc2.c | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 23fe671d4..1c119eef4 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -73,8 +73,9 @@ typedef struct {
 
 static dcd_data_t _dcd_data;
 
-CFG_TUD_MEM_SECTION static struct {
-  TUD_EPBUF_DEF(setup_packet, 8);
+CFG_TUD_MEM_SECTION static union {
+  TUD_EPBUF_DEF(setup_buffer, 8);
+  tusb_control_request_t setup_packet;
 } _dcd_usbbuf;
 
 static tud_configure_dwc2_t _tud_cfg = CFG_TUD_CONFIGURE_DWC2_DEFAULT;
@@ -138,7 +139,7 @@ static void dma_setup_prepare(uint8_t rhport) {
 
   // Receive only 1 packet
   dwc2->epout[0].doeptsiz = (1 << DOEPTSIZ_STUPCNT_Pos) | (1 << DOEPTSIZ_PKTCNT_Pos) | (8 << DOEPTSIZ_XFRSIZ_Pos);
-  dwc2->epout[0].doepdma = (uintptr_t) _dcd_usbbuf.setup_packet;
+  dwc2->epout[0].doepdma = (uintptr_t) _dcd_usbbuf.setup_buffer;
   dwc2->epout[0].doepctl |= DOEPCTL_EPENA | DOEPCTL_USBAEP;
 }
 
@@ -896,7 +897,7 @@ static void handle_rxflvl_irq(uint8_t rhport) {
 
     case GRXSTS_PKTSTS_SETUP_RX: {
       // Setup packet received
-      uint32_t* setup = (uint32_t*)(uintptr_t) _dcd_usbbuf.setup_packet;
+      uint32_t* setup = (uint32_t*)(uintptr_t) _dcd_usbbuf.setup_buffer;
       // We can receive up to three setup packets in succession, but only the last one is valid.
       setup[0] = (*rx_fifo);
       setup[1] = (*rx_fifo);
@@ -956,7 +957,7 @@ static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doe
     if (edpt_is_enabled(epin0)) {
       edpt_disable(rhport, 0x80, false);
     }
-    dcd_event_setup_received(rhport, _dcd_usbbuf.setup_packet, true);
+    dcd_event_setup_received(rhport, _dcd_usbbuf.setup_buffer, true);
     return;
   }
 
@@ -1021,9 +1022,13 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
     if (edpt_is_enabled(epin0)) {
       edpt_disable(rhport, 0x80, false);
     }
-    dma_setup_prepare(rhport);
-    dcd_dcache_invalidate(_dcd_usbbuf.setup_packet, 8);
-    dcd_event_setup_received(rhport, _dcd_usbbuf.setup_packet, true);
+    dcd_dcache_invalidate(_dcd_usbbuf.setup_buffer, 8);
+    dcd_event_setup_received(rhport, _dcd_usbbuf.setup_buffer, true);
+
+    // Prepare EP0 for next setup if this setup has no data stage
+    if (_dcd_usbbuf.setup_packet.wLength == 0) {
+      dma_setup_prepare(rhport);
+    }
     return;
   }
 
@@ -1044,9 +1049,8 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
         const uint16_t remain = tsiz.xfer_size;
         xfer->total_len -= remain;
 
-        // this is ZLP, so prepare EP0 for next setup
-        // TODO use status phase rx
-        if(epnum == 0 && xfer->total_len == 0) {
+        // prepare EP0 for next setup
+        if(epnum == 0) {
           dma_setup_prepare(rhport);
         }
 
@@ -1065,9 +1069,6 @@ static void handle_epin_dma(uint8_t rhport, uint8_t epnum, dwc2_diepint_t diepin
       // EP0 can only handle one packet. Schedule another packet to be transmitted.
       edpt_schedule_packets(rhport, epnum, TUSB_DIR_IN);
     } else {
-      if(epnum == 0) {
-        dma_setup_prepare(rhport);
-      }
       dcd_event_xfer_complete(rhport, epnum | TUSB_DIR_IN_MASK, xfer->total_len, XFER_RESULT_SUCCESS, true);
     }
   }
-- 
cgit v1.3.1


From 616acfa7328b1a05ea0370a3628fc6a07f4caf57 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Wed, 27 May 2026 19:20:58 +0700
Subject: osal add osal_task_get_current_handle()

---
 src/osal/osal.h          | 47 +++++++++++++++++++++++++----------------------
 src/osal/osal_freertos.h |  7 +++++++
 src/osal/osal_mynewt.h   |  6 ++++++
 src/osal/osal_none.h     | 16 ++++++++++++++++
 src/osal/osal_pico.h     |  7 +++++++
 src/osal/osal_rtthread.h |  6 ++++++
 src/osal/osal_rtx4.h     |  6 ++++++
 src/osal/osal_threadx.h  |  5 +++++
 src/osal/osal_zephyr.h   |  6 ++++++
 9 files changed, 84 insertions(+), 22 deletions(-)

(limited to 'src')

diff --git a/src/osal/osal.h b/src/osal/osal.h
index 4840463f3..69cb356d4 100644
--- a/src/osal/osal.h
+++ b/src/osal/osal.h
@@ -76,28 +76,31 @@ typedef void (*osal_task_func_t)(void* param);
 /*--------------------------------------------------------------------
   OSAL Porting API
   Should be implemented as static inline function in osal_port.h header
-   uint32_t osal_time_millis(void);
-
-   void osal_spin_init(osal_spinlock_t *ctx);
-   void osal_spin_lock(osal_spinlock_t *ctx, bool in_isr)
-   void osal_spin_unlock(osal_spinlock_t *ctx, bool in_isr);
-
-   osal_semaphore_t osal_semaphore_create(osal_semaphore_def_t* semdef);
-   bool osal_semaphore_delete(osal_semaphore_t semd_hdl);
-   bool osal_semaphore_post(osal_semaphore_t sem_hdl, bool in_isr);
-   bool osal_semaphore_wait(osal_semaphore_t sem_hdl, uint32_t msec);
-   void osal_semaphore_reset(osal_semaphore_t sem_hdl);
-
-   osal_mutex_t osal_mutex_create(osal_mutex_def_t* mdef);
-   bool osal_mutex_delete(osal_mutex_t mutex_hdl)
-   bool osal_mutex_lock (osal_mutex_t sem_hdl, uint32_t msec);
-   bool osal_mutex_unlock(osal_mutex_t mutex_hdl);
-
-   osal_queue_t osal_queue_create(osal_queue_def_t* qdef);
-   bool osal_queue_delete(osal_queue_t qhdl);
-   bool osal_queue_receive(osal_queue_t qhdl, void* data, uint32_t msec);
-   bool osal_queue_send(osal_queue_t qhdl, void const * data, bool in_isr);
-   bool osal_queue_empty(osal_queue_t qhdl);
+    uint32_t osal_time_millis(void);
+
+    void osal_task_delay(uint32_t msec);
+    osal_task_handle_t osal_task_get_current_handle(void);
+
+    void osal_spin_init(osal_spinlock_t *ctx);
+    void osal_spin_lock(osal_spinlock_t *ctx, bool in_isr)
+    void osal_spin_unlock(osal_spinlock_t *ctx, bool in_isr);
+
+    osal_semaphore_t osal_semaphore_create(osal_semaphore_def_t* semdef);
+    bool osal_semaphore_delete(osal_semaphore_t semd_hdl);
+    bool osal_semaphore_post(osal_semaphore_t sem_hdl, bool in_isr);
+    bool osal_semaphore_wait(osal_semaphore_t sem_hdl, uint32_t msec);
+    void osal_semaphore_reset(osal_semaphore_t sem_hdl);
+
+    osal_mutex_t osal_mutex_create(osal_mutex_def_t* mdef);
+    bool osal_mutex_delete(osal_mutex_t mutex_hdl)
+    bool osal_mutex_lock (osal_mutex_t sem_hdl, uint32_t msec);
+    bool osal_mutex_unlock(osal_mutex_t mutex_hdl);
+
+    osal_queue_t osal_queue_create(osal_queue_def_t* qdef);
+    bool osal_queue_delete(osal_queue_t qhdl);
+    bool osal_queue_receive(osal_queue_t qhdl, void* data, uint32_t msec);
+    bool osal_queue_send(osal_queue_t qhdl, void const * data, bool in_isr);
+    bool osal_queue_empty(osal_queue_t qhdl);
 --------------------------------------------------------------------------*/
 
 
diff --git a/src/osal/osal_freertos.h b/src/osal/osal_freertos.h
index 898edd4ed..9b12b5c0e 100644
--- a/src/osal/osal_freertos.h
+++ b/src/osal/osal_freertos.h
@@ -83,6 +83,13 @@ typedef struct {
 //--------------------------------------------------------------------+
 // TASK API
 //--------------------------------------------------------------------+
+typedef TaskHandle_t osal_task_handle_t;
+
+// Requires INCLUDE_xTaskGetCurrentTaskHandle == 1 in FreeRTOSConfig.h.
+TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
+  return xTaskGetCurrentTaskHandle();
+}
+
 TU_ATTR_ALWAYS_INLINE static inline uint32_t _osal_ms2tick(uint32_t msec) {
   if (msec == OSAL_TIMEOUT_WAIT_FOREVER) { return portMAX_DELAY; }
   if (msec == 0) { return 0; }
diff --git a/src/osal/osal_mynewt.h b/src/osal/osal_mynewt.h
index 335d53491..d1fa77ecb 100644
--- a/src/osal/osal_mynewt.h
+++ b/src/osal/osal_mynewt.h
@@ -36,6 +36,12 @@
 //--------------------------------------------------------------------+
 // TASK API
 //--------------------------------------------------------------------+
+typedef struct os_task* osal_task_handle_t;
+
+TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
+  return os_sched_get_current_task();
+}
+
 TU_ATTR_ALWAYS_INLINE static inline void osal_task_delay(uint32_t msec) {
   os_time_delay( os_time_ms_to_ticks32(msec) );
 }
diff --git a/src/osal/osal_none.h b/src/osal/osal_none.h
index 7bf6029d6..e174d3518 100644
--- a/src/osal/osal_none.h
+++ b/src/osal/osal_none.h
@@ -33,6 +33,22 @@ extern "C" {
 
 // osal_time_millis() is not provided, tusb_time_millis_api() must be implemented by user application
 
+//--------------------------------------------------------------------+
+// TASK API
+//--------------------------------------------------------------------+
+// Bare-metal single context: return a non-NULL sentinel so equality compares true.
+typedef void* osal_task_handle_t;
+
+TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
+  return (osal_task_handle_t) 1;
+}
+
+// Bare-metal has no scheduler to yield to; this is dead code in practice because
+// callers gate it on running outside the host task, which can't happen here.
+TU_ATTR_ALWAYS_INLINE static inline void osal_task_delay(uint32_t msec) {
+  (void) msec;
+}
+
 //--------------------------------------------------------------------+
 // Spinlock API
 //--------------------------------------------------------------------+
diff --git a/src/osal/osal_pico.h b/src/osal/osal_pico.h
index 6a0a21bb3..364c38b01 100644
--- a/src/osal/osal_pico.h
+++ b/src/osal/osal_pico.h
@@ -39,6 +39,13 @@ extern "C" {
 //--------------------------------------------------------------------+
 // TASK API
 //--------------------------------------------------------------------+
+// Bare-metal single context: return a non-NULL sentinel so equality compares true.
+typedef void* osal_task_handle_t;
+
+TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
+  return (osal_task_handle_t) 1;
+}
+
 TU_ATTR_ALWAYS_INLINE static inline void osal_task_delay(uint32_t msec) {
   sleep_ms(msec);
 }
diff --git a/src/osal/osal_rtthread.h b/src/osal/osal_rtthread.h
index f560281c5..a151a7d70 100644
--- a/src/osal/osal_rtthread.h
+++ b/src/osal/osal_rtthread.h
@@ -38,6 +38,12 @@ extern "C" {
 //--------------------------------------------------------------------+
 // TASK API
 //--------------------------------------------------------------------+
+typedef rt_thread_t osal_task_handle_t;
+
+TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
+  return rt_thread_self();
+}
+
 TU_ATTR_ALWAYS_INLINE static inline void osal_task_delay(uint32_t msec) {
   rt_thread_mdelay(msec);
 }
diff --git a/src/osal/osal_rtx4.h b/src/osal/osal_rtx4.h
index e1930c96c..e5b708a2c 100644
--- a/src/osal/osal_rtx4.h
+++ b/src/osal/osal_rtx4.h
@@ -37,6 +37,12 @@ extern "C" {
 //--------------------------------------------------------------------+
 // TASK API
 //--------------------------------------------------------------------+
+typedef OS_TID osal_task_handle_t;
+
+TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
+  return os_tsk_self();
+}
+
 TU_ATTR_ALWAYS_INLINE static inline void osal_task_delay(uint32_t msec) {
   uint16_t hi = msec >> 16;
   uint16_t lo = msec;
diff --git a/src/osal/osal_threadx.h b/src/osal/osal_threadx.h
index 6bcf9c5ab..cca4eb487 100644
--- a/src/osal/osal_threadx.h
+++ b/src/osal/osal_threadx.h
@@ -37,6 +37,11 @@ extern "C" {
 //--------------------------------------------------------------------+
 // TASK API
 //--------------------------------------------------------------------+
+typedef TX_THREAD* osal_task_handle_t;
+
+TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
+  return tx_thread_identify();
+}
 
 TU_ATTR_ALWAYS_INLINE static inline uint32_t _osal_ms2tick(uint32_t msec) {
   if ( msec == TX_WAIT_FOREVER ) {
diff --git a/src/osal/osal_zephyr.h b/src/osal/osal_zephyr.h
index 900ac786c..6ea45131e 100644
--- a/src/osal/osal_zephyr.h
+++ b/src/osal/osal_zephyr.h
@@ -31,6 +31,12 @@
 //--------------------------------------------------------------------+
 // TASK API
 //--------------------------------------------------------------------+
+typedef k_tid_t osal_task_handle_t;
+
+TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
+  return k_current_get();
+}
+
 TU_ATTR_ALWAYS_INLINE static inline void osal_task_delay(uint32_t msec) {
   k_msleep(msec);
 }
-- 
cgit v1.3.1


From c5676382c7d5cad7b6cfe5dc185d9891b89241f2 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Thu, 28 May 2026 18:23:46 +0700
Subject: abstract OS logic with `CFG_TUSB_OS_HAS_SCHEDULER` to simplify
 conditional checks

---
 examples/device/msc_dual_lun/src/main.c          |  2 +-
 examples/dual/host_info_to_device_cdc/src/main.c |  6 +++---
 src/tusb_option.h                                | 12 ++++++++++++
 3 files changed, 16 insertions(+), 4 deletions(-)

(limited to 'src')

diff --git a/examples/device/msc_dual_lun/src/main.c b/examples/device/msc_dual_lun/src/main.c
index a4ade6f9b..1d764f12c 100644
--- a/examples/device/msc_dual_lun/src/main.c
+++ b/examples/device/msc_dual_lun/src/main.c
@@ -71,7 +71,7 @@ static void usb_device_init(void) {
   board_init_after_tusb();
 }
 
-#if CFG_TUSB_OS != OPT_OS_NONE && CFG_TUSB_OS != OPT_OS_PICO
+#if CFG_TUSB_OS_HAS_SCHEDULER
 static void usb_device_task(RTOS_PARAM param) {
   (void) param;
   usb_device_init();
diff --git a/examples/dual/host_info_to_device_cdc/src/main.c b/examples/dual/host_info_to_device_cdc/src/main.c
index cf3430464..5186f91dc 100644
--- a/examples/dual/host_info_to_device_cdc/src/main.c
+++ b/examples/dual/host_info_to_device_cdc/src/main.c
@@ -130,7 +130,7 @@ static void main_task(void* param) {
     led_blinking_task();
 
     // preempted RTOS run device/host stack in its own task
-#if CFG_TUSB_OS == OPT_OS_NONE || CFG_TUSB_OS == OPT_OS_PICO
+#if CFG_TUSB_OS_HAS_SCHEDULER == 0
     tud_task(); // tinyusb device task
     tuh_task(); // tinyusb host task
 #endif
@@ -140,7 +140,7 @@ static void main_task(void* param) {
 int main(void) {
   board_init();
 
-#if CFG_TUSB_OS == OPT_OS_NONE || CFG_TUSB_OS == OPT_OS_PICO
+#if CFG_TUSB_OS_HAS_SCHEDULER == 0
   printf("TinyUSB Host Information -> Device CDC Example\r\n");
 
   usb_device_init();
@@ -156,7 +156,7 @@ int main(void) {
   return 0;
 }
 
-#if CFG_TUSB_OS != OPT_OS_NONE && CFG_TUSB_OS != OPT_OS_PICO
+#if CFG_TUSB_OS_HAS_SCHEDULER
 // USB Device Driver task for RTOS
 static void usb_device_task(void *param) {
   (void) param;
diff --git a/src/tusb_option.h b/src/tusb_option.h
index 74eb8cc06..dcf0646cf 100644
--- a/src/tusb_option.h
+++ b/src/tusb_option.h
@@ -535,6 +535,18 @@
   #define CFG_TUSB_OS           OPT_OS_NONE
 #endif
 
+// 1 when CFG_TUSB_OS provides a preemptive scheduler with distinct tasks
+// (FreeRTOS, Zephyr, ThreadX, etc.); 0 when the application is single-context
+// (bare-metal OS_NONE or Pico SDK). Sync host control xfers from the host
+// task are forbidden when this is 1.
+#ifndef CFG_TUSB_OS_HAS_SCHEDULER
+  #if CFG_TUSB_OS == OPT_OS_NONE || CFG_TUSB_OS == OPT_OS_PICO
+    #define CFG_TUSB_OS_HAS_SCHEDULER 0
+  #else
+    #define CFG_TUSB_OS_HAS_SCHEDULER 1
+  #endif
+#endif
+
 #ifndef CFG_TUSB_OS_INC_PATH
   #ifndef CFG_TUSB_OS_INC_PATH_DEFAULT
   #define CFG_TUSB_OS_INC_PATH_DEFAULT
-- 
cgit v1.3.1


From dafdc5c54f34f88c963f7efc0062d0e992074b8f Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 29 May 2026 00:05:44 +0200
Subject: dwc2: move OUT transfer management into RXFLVL IRQ

- GRXSTSP register has internal FIFO, receiving events won't mix up (STATUS OUT & next SETUP)
- Improve efficiency, remove 2nd IRQ overhead

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/synopsys/dwc2/dcd_dwc2.c | 71 ++++++++++++++---------------------
 1 file changed, 28 insertions(+), 43 deletions(-)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 1c119eef4..233840e8b 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -794,13 +794,15 @@ static void handle_bus_reset(uint8_t rhport) {
   xfer_status[0][TUSB_DIR_OUT].max_size = CFG_TUD_ENDPOINT0_SIZE;
   xfer_status[0][TUSB_DIR_IN].max_size = CFG_TUD_ENDPOINT0_SIZE;
 
+  uint32_t oepmsk = 0;
   if(dma_device_enabled(dwc2)) {
+    oepmsk = GINTMSK_OEPINT;
     dma_setup_prepare(rhport);
   } else {
     dwc2->epout[0].doeptsiz |= (3 << DOEPTSIZ_STUPCNT_Pos);
   }
 
-  dwc2->gintmsk |= GINTMSK_OTGINT | GINTMSK_OEPINT | GINTMSK_IEPINT | GINTMSK_IISOIXFRM;
+  dwc2->gintmsk |= GINTMSK_OTGINT | oepmsk | GINTMSK_IEPINT | GINTMSK_IISOIXFRM;
 }
 
 static void handle_enum_done(uint8_t rhport) {
@@ -901,13 +903,27 @@ static void handle_rxflvl_irq(uint8_t rhport) {
       // We can receive up to three setup packets in succession, but only the last one is valid.
       setup[0] = (*rx_fifo);
       setup[1] = (*rx_fifo);
+
+      dwc2_dep_t* epin0 = &dwc2->epin[0];
+      if (edpt_is_enabled(epin0)) {
+        edpt_disable(rhport, 0x80, false);
+      }
+
+      // (GenID < 3.00a) Must wait SETUP_DONE before next OUT transfer, otherwise OUT data may be corrupted.
+      // (GenID >= 3.00a) On the other hand STUPCNT is auto reloaded and SETUP_DONE is only triggered once after bus reset.
+      if (dwc2->gsnpsid >= DWC2_CORE_REV_3_00a) {
+        dcd_event_setup_received(rhport, _dcd_usbbuf.setup_buffer, true);
+      }
       break;
     }
 
     case GRXSTS_PKTSTS_SETUP_DONE:
       // Setup packet done:
-      // After popping this out, dwc2 asserts a DOEPINT_SETUP interrupt which is handled by handle_epout_irq()
       epout->doeptsiz |= (3 << DOEPTSIZ_STUPCNT_Pos);
+
+      if (dwc2->gsnpsid < DWC2_CORE_REV_3_00a) {
+        dcd_event_setup_received(rhport, _dcd_usbbuf.setup_buffer, true);
+      }
       break;
 
     case GRXSTS_PKTSTS_RX_DATA: {
@@ -931,55 +947,24 @@ static void handle_rxflvl_irq(uint8_t rhport) {
         xfer->total_len -= tsiz.xfer_size;
         if (epnum == 0) {
           _dcd_data.ep0_pending[TUSB_DIR_OUT] = 0;
-          // Handle EP0 STATUS OUT (or ZLP) here to avoid mix with next SETUP packet received IRQ
-          if (xfer->total_len == 0) {
-            dcd_event_xfer_complete(rhport, 0, 0, XFER_RESULT_SUCCESS, true);
-          }
         }
       }
       break;
     }
 
-    case GRXSTS_PKTSTS_RX_COMPLETE:
+    case GRXSTS_PKTSTS_RX_COMPLETE: {
       // Out packet done
-      // After this entry is popped from the receive FIFO, dwc2 asserts a Transfer Completed interrupt on
-      // the specified OUT endpoint which will be handled by handle_epout_irq()
-      break;
-
-    default: break; // nothing to do
-  }
-}
-
-static void handle_epout_slave(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepint_bm) {
-  if (doepint_bm.setup_phase_done) {
-    // Cleanup previous pending EP0 IN transfer if any
-    dwc2_dep_t* epin0 = &DWC2_REG(rhport)->epin[0];
-    if (edpt_is_enabled(epin0)) {
-      edpt_disable(rhport, 0x80, false);
-    }
-    dcd_event_setup_received(rhport, _dcd_usbbuf.setup_buffer, true);
-    return;
-  }
-
-  // Normal OUT transfer complete
-  if (doepint_bm.xfer_complete) {
-    // only handle data skip if it is setup or status related
-    // Note: even though (xfer_complete + status_phase_rx) is for buffered DMA only, for STM32L47x (dwc2 v3.00a) they
-    // can is set when GRXSTS_PKTSTS_SETUP_RX is popped therefore they can bet set before/together with setup_phase_done
-    if (!doepint_bm.status_phase_rx && !doepint_bm.setup_packet_rx) {
       xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
-      if (epnum == 0) {
-        if (_dcd_data.ep0_pending[TUSB_DIR_OUT]) {
-          // EP0 can only handle one packet, Schedule another packet to be received.
-          edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
-        } else if (xfer->total_len > 0) {
-          // EP0 STATUS OUT (or ZLP) is handled in handle_rxflvl_irq()
-          dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
-        }
+      if (epnum == 0 && _dcd_data.ep0_pending[TUSB_DIR_OUT] > 0) {
+        // EP0 can only handle one packet, schedule another packet to be received.
+        edpt_schedule_packets(rhport, 0, TUSB_DIR_OUT);
       } else {
         dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
       }
+      break;
     }
+
+    default: break; // nothing to do
   }
 }
 
@@ -1108,8 +1093,6 @@ static void handle_ep_irq(uint8_t rhport, uint8_t dir) {
         #if CFG_TUD_DWC2_SLAVE_ENABLE
         if (dir == TUSB_DIR_IN) {
           handle_epin_slave(rhport, epnum, intr.diepint_bm);
-        } else {
-          handle_epout_slave(rhport, epnum, intr.doepint_bm);
         }
         #endif
       }
@@ -1217,7 +1200,7 @@ void dcd_int_handler(uint8_t rhport) {
     dwc2->gotgint = otg_int;
   }
 
-  if(gintsts & GINTSTS_SOF) {
+  if(gintsts & GINTSTS_SOF && dwc2->gintmsk & GINTMSK_SOFM) {
     dwc2->gintsts = GINTSTS_SOF;
     dwc2->gintmsk |= GINTMSK_USBSUSPM;
     const uint32_t frame = (dwc2->dsts & DSTS_FNSOF) >> DSTS_FNSOF_Pos;
@@ -1244,11 +1227,13 @@ void dcd_int_handler(uint8_t rhport) {
   }
 #endif
 
+#if CFG_TUD_DWC2_DMA_ENABLE
   // OUT endpoint interrupt handling.
   if (gintsts & GINTSTS_OEPINT) {
     // OEPINT is read-only, clear using DOEPINTn
     handle_ep_irq(rhport, TUSB_DIR_OUT);
   }
+#endif
 
   // IN endpoint interrupt handling.
   if (gintsts & GINTSTS_IEPINT) {
-- 
cgit v1.3.1


From d754c0697cbd29874c56254bd97561349fb9a229 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Fri, 29 May 2026 16:16:21 +0700
Subject: Implement asynchronous control transfer queuing for USB host stack

- Added a pending FIFO queue for asynchronous control transfers when the active slot is busy.
- Introduced `control_xfer_dispatch_pending` to handle queued transfers on slot availability.
- Improved synchronization for blocking and non-blocking transfer modes, preventing deadlocks in RTOS.
- Refactored and renamed related functions for clarity and consistency.
- Enhanced error handling and callback invocation for failed or stale transfers.
---
 src/common/tusb_types.h  |   1 +
 src/host/usbh.c          | 332 ++++++++++++++++++++++++++++++++++++-----------
 src/osal/osal_freertos.h |   8 +-
 3 files changed, 263 insertions(+), 78 deletions(-)

(limited to 'src')

diff --git a/src/common/tusb_types.h b/src/common/tusb_types.h
index 959fc129a..cb06b89bb 100644
--- a/src/common/tusb_types.h
+++ b/src/common/tusb_types.h
@@ -282,6 +282,7 @@ typedef enum {
   XFER_RESULT_FAILED,
   XFER_RESULT_STALLED,
   XFER_RESULT_TIMEOUT,
+  XFER_RESULT_ABORTED,
   XFER_RESULT_INVALID
 } xfer_result_t;
 
diff --git a/src/host/usbh.c b/src/host/usbh.c
index 2e3c93c5e..05e03245f 100644
--- a/src/host/usbh.c
+++ b/src/host/usbh.c
@@ -40,6 +40,10 @@
   #define CFG_TUH_TASK_QUEUE_SZ   16
 #endif
 
+#ifndef CFG_TUH_CONTROL_PENDING_QUEUE_SZ
+  #define CFG_TUH_CONTROL_PENDING_QUEUE_SZ 4
+#endif
+
 #ifndef CFG_TUH_INTERFACE_MAX
   #define CFG_TUH_INTERFACE_MAX   8
 #endif
@@ -175,11 +179,11 @@ static OSAL_SPINLOCK_DEF(_usbh_spin, usbh_int_set);
 OSAL_QUEUE_DEF(usbh_int_set, _usbh_qdef, CFG_TUH_TASK_QUEUE_SZ, hcd_event_t);
 static osal_queue_t _usbh_q;
 
-  #if CFG_TUH_HUB
+#if CFG_TUH_HUB
 // Deferred attachment queue, only needed when using hub
 OSAL_QUEUE_DEF(usbh_int_set, _usbh_daqdef, CFG_TUH_HUB, hcd_event_t);
 static osal_queue_t _usbh_daq;
-  #endif
+#endif
 
 // Control transfers: since most controllers do not support multiple control transfers
 // on multiple devices concurrently and control transfers are not used much except for
@@ -189,9 +193,9 @@ typedef struct {
   tuh_xfer_cb_t complete_cb;
   uintptr_t user_data;
 
+  volatile uint16_t actual_len;
   volatile uint8_t stage;
   uint8_t daddr;
-  volatile uint16_t actual_len;
   uint8_t failed_count;
 } usbh_ctrl_xfer_info_t;
 
@@ -202,17 +206,32 @@ typedef struct {
 } usbh_call_after_t;
 
 typedef struct {
-  uint8_t controller_id;      // controller ID
+  tusb_control_request_t setup;
+  uint8_t*               buffer;
+  tuh_xfer_cb_t          complete_cb;
+  uintptr_t              user_data;
+  uint8_t                daddr;
+  uint8_t                daddr_gen;
+} usbh_pending_ctrl_t;
+
+// FIFO for pending async control transfers since we only execute 1 control transfer at a time
+TU_FIFO_DEF(_usbh_pending_ctrl_q, CFG_TUH_CONTROL_PENDING_QUEUE_SZ * sizeof(usbh_pending_ctrl_t), false);
+
+typedef struct {
   uint8_t enumerating_daddr;  // device address of the device being enumerated
   uint8_t attach_debouncing_bm;  // bitmask for roothub port attach debouncing
   tuh_bus_info_t dev0_bus;    // bus info for dev0 in enumeration
   usbh_ctrl_xfer_info_t ctrl_xfer_info; // control transfer
   usbh_call_after_t call_after;
+  // Per-daddr generation counter — bumped on usbh_device_close() to identify stale pending control transfer
+  uint8_t daddr_gen[TOTAL_DEVICES + 1];
+#if CFG_TUSB_OS_HAS_SCHEDULER
+  osal_task_handle_t task_hdl;  // host task handle, lazy-captured on first tuh_task_ext()
+#endif
 } usbh_data_t;
 
-static usbh_data_t _usbh_data = {
-  .controller_id = TUSB_INDEX_INVALID_8,
-};
+static uint8_t _usbh_controller_id = TUSB_INDEX_INVALID_8;
+static usbh_data_t _usbh_data;
 
 typedef struct {
   TUH_EPBUF_TYPE_DEF(tusb_control_request_t, request);
@@ -346,8 +365,11 @@ static void enum_new_device(hcd_event_t* event);
 static void enum_delay_async(uintptr_t state);
 static void process_remove_event(hcd_event_t *event);
 static void remove_device_tree(uint8_t rhport, uint8_t hub_addr, uint8_t hub_port);
+
 static bool usbh_edpt_control_open(uint8_t dev_addr, uint8_t max_packet_size);
 static bool usbh_control_xfer_cb (uint8_t daddr, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
+static void control_xfer_dispatch_pending(void);
+static void control_xfer_complete(uint8_t daddr, xfer_result_t result);
 
 TU_ATTR_ALWAYS_INLINE static inline usbh_device_t* get_device(uint8_t dev_addr) {
   TU_VERIFY(dev_addr > 0 && dev_addr <= TOTAL_DEVICES, NULL);
@@ -364,7 +386,7 @@ TU_ATTR_ALWAYS_INLINE static inline bool queue_event(hcd_event_t const * event,
   return true;
 }
 
-TU_ATTR_ALWAYS_INLINE static inline void _control_set_xfer_stage(uint8_t stage) {
+TU_ATTR_ALWAYS_INLINE static inline void control_xfer_set_stage(uint8_t stage) {
   if (_usbh_data.ctrl_xfer_info.stage != stage) {
     (void) osal_mutex_lock(_usbh_mutex, OSAL_TIMEOUT_WAIT_FOREVER);
     _usbh_data.ctrl_xfer_info.stage = stage;
@@ -372,15 +394,6 @@ TU_ATTR_ALWAYS_INLINE static inline void _control_set_xfer_stage(uint8_t stage)
   }
 }
 
-TU_ATTR_ALWAYS_INLINE static inline bool usbh_setup_send(uint8_t daddr, const uint8_t setup_packet[8]) {
-  const uint8_t rhport = usbh_get_rhport(daddr);
-  const bool ret = hcd_setup_send(rhport, daddr, setup_packet);
-  if (!ret) {
-    _control_set_xfer_stage(CONTROL_STAGE_IDLE);
-  }
-  return ret;
-}
-
 bool usbh_defer_func_ms_async(uint32_t ms, tusb_defer_func_t func, uintptr_t param) {
   TU_ASSERT(_usbh_data.call_after.func == NULL);
   TU_LOG_USBH("USBH schedule function after %u ms\r\n", (unsigned int)ms);
@@ -394,9 +407,16 @@ bool usbh_defer_func_ms_async(uint32_t ms, tusb_defer_func_t func, uintptr_t par
 TU_ATTR_ALWAYS_INLINE static inline void usbh_device_close(uint8_t rhport, uint8_t daddr) {
   hcd_device_close(rhport, daddr);
 
-  // abort any ongoing control transfer
-  if (daddr == _usbh_data.ctrl_xfer_info.daddr) {
-    _control_set_xfer_stage(CONTROL_STAGE_IDLE);
+  // Bump the generation under the mutex so a concurrent producer in
+  // tuh_control_xfer stamps a value that is strictly monotonic w.r.t. close.
+  (void) osal_mutex_lock(_usbh_mutex, OSAL_TIMEOUT_WAIT_FOREVER);
+  _usbh_data.daddr_gen[daddr]++;
+  (void) osal_mutex_unlock(_usbh_mutex);
+
+  // If this device has in-flight control xfer, complete as FAILED
+  usbh_ctrl_xfer_info_t* ctrl_info = &_usbh_data.ctrl_xfer_info;
+  if (daddr == ctrl_info->daddr && ctrl_info->stage != CONTROL_STAGE_IDLE) {
+    control_xfer_complete(daddr, XFER_RESULT_FAILED);
   }
 
   // invalidate if enumerating
@@ -458,7 +478,7 @@ tusb_speed_t tuh_speed_get(uint8_t daddr) {
 }
 
 bool tuh_rhport_is_active(uint8_t rhport) {
-  return _usbh_data.controller_id == rhport;
+  return _usbh_controller_id == rhport;
 }
 
 bool tuh_rhport_reset_bus(uint8_t rhport, bool active) {
@@ -485,7 +505,7 @@ static void clear_device(usbh_device_t* dev) {
 }
 
 bool tuh_inited(void) {
-  return _usbh_data.controller_id != TUSB_INDEX_INVALID_8;
+  return _usbh_controller_id != TUSB_INDEX_INVALID_8;
 }
 
 bool tuh_rhport_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
@@ -547,7 +567,7 @@ bool tuh_rhport_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
     tu_memclr(_usbh_devices, sizeof(_usbh_devices));
     tu_memclr(&_usbh_data, sizeof(_usbh_data));
 
-    _usbh_data.controller_id = TUSB_INDEX_INVALID_8;
+    _usbh_controller_id = TUSB_INDEX_INVALID_8;
     _usbh_data.enumerating_daddr = TUSB_INDEX_INVALID_8;
 
     for (uint8_t i = 0; i < TOTAL_DEVICES; i++) {
@@ -565,7 +585,7 @@ bool tuh_rhport_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
   }
 
   // Init host controller
-  _usbh_data.controller_id = rhport;
+  _usbh_controller_id = rhport;
   TU_ASSERT(hcd_init(rhport, rh_init));
   hcd_int_enable(rhport);
 
@@ -580,7 +600,7 @@ bool tuh_deinit(uint8_t rhport) {
   // deinit host controller
   hcd_int_disable(rhport);
   TU_ASSERT(hcd_deinit(rhport));
-  _usbh_data.controller_id = TUSB_INDEX_INVALID_8;
+  _usbh_controller_id = TUSB_INDEX_INVALID_8;
 
   // remove all devices on this rhport (hub_addr = 0, hub_port = 0)
   remove_device_tree(rhport, 0, 0);
@@ -604,6 +624,25 @@ bool tuh_deinit(uint8_t rhport) {
     _usbh_daq = NULL;
   #endif
 
+    // Fire FAILED cb for any queued async control xfer so callers aren't stranded.
+    usbh_pending_ctrl_t pending;
+    while (tu_fifo_read_n(&_usbh_pending_ctrl_q, &pending, sizeof(pending)) == sizeof(pending)) {
+      if (pending.complete_cb) {
+        tuh_xfer_t x = {
+          .daddr       = pending.daddr,
+          .ep_addr     = 0,
+          .result      = XFER_RESULT_FAILED,
+          .actual_len  = 0,
+          .setup       = &pending.setup,
+          .buffer      = pending.buffer,
+          .complete_cb = pending.complete_cb,
+          .user_data   = pending.user_data,
+        };
+        pending.complete_cb(&x);
+      }
+    }
+    tu_fifo_clear(&_usbh_pending_ctrl_q);
+
   #if OSAL_MUTEX_REQUIRED
     // TODO make sure there is no task waiting on this mutex
     osal_mutex_delete(_usbh_mutex);
@@ -629,6 +668,12 @@ bool tuh_task_event_ready(void) {
   }
   #endif
 
+  // Pending control xfer waiting for an idle slot
+  if (_usbh_data.ctrl_xfer_info.stage == CONTROL_STAGE_IDLE &&
+      !tu_fifo_empty(&_usbh_pending_ctrl_q)) {
+    return true;
+  }
+
   if (_usbh_data.call_after.func) {
     int32_t remain_ms = (int32_t)(_usbh_data.call_after.at_ms - tusb_time_millis_api());
     if (remain_ms <= 0) {
@@ -663,6 +708,13 @@ void tuh_task_ext(uint32_t timeout_ms, bool in_isr) {
 
   (void) in_isr; // not implemented yet
 
+#if CFG_TUSB_OS_HAS_SCHEDULER
+  // Save task handle on 1st run
+  if (_usbh_data.task_hdl == NULL) {
+    _usbh_data.task_hdl = osal_task_get_current_handle();
+  }
+#endif
+
   // Loop until there are no more events in the queue or CFG_TUH_TASK_EVENTS_PER_RUN is reached
   for (unsigned epr = 0;; epr++) {
   #if CFG_TUH_TASK_EVENTS_PER_RUN > 0
@@ -695,6 +747,16 @@ void tuh_task_ext(uint32_t timeout_ms, bool in_isr) {
       }
     }
 
+    // Drain pending async control xfers. Slot transitions and dispatch are
+    // decoupled: completion / abort / device_close set stage = IDLE via
+    // control_xfer_set_stage() and the actual FIFO drain happens here in the
+    // event loop. The check is a fast non-mutex sanity gate; the dispatcher
+    // itself re-checks under the mutex.
+    if (_usbh_data.ctrl_xfer_info.stage == CONTROL_STAGE_IDLE &&
+        !tu_fifo_empty(&_usbh_pending_ctrl_q)) {
+      control_xfer_dispatch_pending();
+    }
+
     hcd_event_t event;
 
   #if CFG_TUH_HUB
@@ -818,73 +880,179 @@ void tuh_task_ext(uint32_t timeout_ms, bool in_isr) {
 // Control transfer
 //--------------------------------------------------------------------+
 
-static void _control_blocking_complete_cb(tuh_xfer_t* xfer) {
-  // update result
-  *((xfer_result_t*) xfer->user_data) = xfer->result;
+// Carries both fields the sync waiter cares about — capturing from xfer_temp
+// (snapshot taken before release_slot resets ctrl_info for the next pending
+// entry) so the waiter sees this xfer's data, not the next dispatched one's.
+typedef struct {
+  volatile xfer_result_t result;
+  volatile uint32_t      actual_len;
+} control_xfer_sync_param_t;
+
+static void control_xfer_sync_complete(tuh_xfer_t* xfer) {
+  control_xfer_sync_param_t* s = (control_xfer_sync_param_t*) xfer->user_data;
+  s->actual_len = xfer->actual_len;
+  s->result     = xfer->result;
 }
 
 // TODO timeout_ms is not supported yet
 bool tuh_control_xfer (tuh_xfer_t* xfer) {
-  TU_VERIFY(xfer->ep_addr == 0 && xfer->setup); // EP0 with setup packet
   const uint8_t daddr = xfer->daddr;
-  TU_VERIFY(tuh_connected(daddr));
-
+  TU_VERIFY(daddr <= TOTAL_DEVICES && xfer->ep_addr == 0 && xfer->setup); // EP0 with setup packet
   usbh_ctrl_xfer_info_t* ctrl_info = &_usbh_data.ctrl_xfer_info;
 
-  TU_VERIFY(ctrl_info->stage == CONTROL_STAGE_IDLE); // pre-check to help reducing mutex lock
-  (void) osal_mutex_lock(_usbh_mutex, OSAL_TIMEOUT_WAIT_FOREVER);
-  bool const is_idle = (ctrl_info->stage == CONTROL_STAGE_IDLE);
-  if (is_idle) {
-    ctrl_info->stage        = CONTROL_STAGE_SETUP;
-    ctrl_info->daddr        = daddr;
-    ctrl_info->actual_len   = 0;
-    ctrl_info->failed_count = 0;
-
-    ctrl_info->buffer       = xfer->buffer;
-    ctrl_info->complete_cb  = xfer->complete_cb;
-    ctrl_info->user_data    = xfer->user_data;
-    _usbh_epbuf.request     = (*xfer->setup);
-  }
-  (void) osal_mutex_unlock(_usbh_mutex);
+#if CFG_TUSB_OS_HAS_SCHEDULER
+  // Sync (complete_cb == NULL) from a host-stack callback is forbidden on
+  // RTOS targets — the event-loop driver can't block on its own pending xfer
+  // (deadlock if other control xfers are queued behind). Use async with a
+  // chained cb instead. OS_NONE / OS_PICO are exempt: they have a single
+  // execution context and the recursive-drive path is the only way to wait.
+  TU_ASSERT(!(xfer->complete_cb == NULL &&
+              osal_task_get_current_handle() == _usbh_data.task_hdl));
+#endif
 
-  TU_VERIFY(is_idle);
+  // Slot is single-threaded — when busy, sync callers block until it frees
+  // (blocking semantics require the result); async callers get queued in the
+  // pending FIFO and submitted by control_xfer_complete() when the slot
+  // drains. The test-and-{claim|enqueue} is one critical section so a slot
+  // that becomes IDLE between the check and the enqueue can't strand an async
+  // request in a queue nothing else drains.
+  const bool is_nonblocking = (xfer->complete_cb != NULL);
+  while (true) {
+    TU_VERIFY(tuh_connected(daddr));
+    bool claimed = false;
+    bool is_queued = false;
+    (void) osal_mutex_lock(_usbh_mutex, OSAL_TIMEOUT_WAIT_FOREVER);
+    if (ctrl_info->stage == CONTROL_STAGE_IDLE) {
+      ctrl_info->stage        = CONTROL_STAGE_SETUP;
+      ctrl_info->daddr        = daddr;
+      ctrl_info->actual_len   = 0;
+      ctrl_info->failed_count = 0;
+
+      ctrl_info->buffer       = xfer->buffer;
+      ctrl_info->complete_cb  = xfer->complete_cb;
+      ctrl_info->user_data    = xfer->user_data;
+      _usbh_epbuf.request     = (*xfer->setup);
+      claimed = true;
+    } else if (is_nonblocking) {
+      // Async + busy: queue the transfer.
+      const usbh_pending_ctrl_t entry = {
+        .setup       = *xfer->setup,
+        .buffer      = xfer->buffer,
+        .complete_cb = xfer->complete_cb,
+        .user_data   = xfer->user_data,
+        .daddr       = daddr,
+        .daddr_gen   = _usbh_data.daddr_gen[daddr]
+      };
+      is_queued = tu_fifo_write_n(&_usbh_pending_ctrl_q, &entry, sizeof(entry)) == sizeof(entry);
+    }
+
+    (void) osal_mutex_unlock(_usbh_mutex);
+
+    if (claimed) {
+      break;
+    }
+
+    if (is_nonblocking) {
+      return is_queued;
+    }
+
+    // - OS_HAS_SCHEDULER: delay 1 ms
+    // - Otherwise: single execution context; drive the loop ourselves to progress the in-flight transfer.
+#if CFG_TUSB_OS_HAS_SCHEDULER
+    osal_task_delay(1);
+#else
+    tuh_task_ext(0, false);
+#endif
+  }
   TU_LOG_USBH("[%u:%u] %s: ", usbh_get_rhport(daddr), daddr,
               (xfer->setup->bmRequestType_bit.type == TUSB_REQ_TYPE_STANDARD && xfer->setup->bRequest <= TUSB_REQ_SYNCH_FRAME) ?
                   tu_str_std_request[xfer->setup->bRequest] : "Class Request");
   TU_LOG_BUF_USBH(xfer->setup, 8);
 
-  if (xfer->complete_cb != NULL) {
-    TU_ASSERT(usbh_setup_send(daddr, (uint8_t const *) &_usbh_epbuf.request));
-  }else {
-    // blocking if complete callback is not provided
-    // change callback to internal blocking, and result as user argument
-    volatile xfer_result_t result = XFER_RESULT_INVALID;
-
-    // use user_data to point to xfer_result_t
-    ctrl_info->user_data   = (uintptr_t) &result;
-    ctrl_info->complete_cb = _control_blocking_complete_cb;
+  // Sync: wire control_xfer_sync_complete BEFORE submit so a fast completion
+  // event has the cb in place. control_xfer_complete() captures both result
+  // and actual_len through this cb before release_slot overwrites ctrl_info.
+  volatile control_xfer_sync_param_t sync_state;
+  if (!is_nonblocking) {
+    sync_state.result = XFER_RESULT_INVALID;
+    sync_state.actual_len = 0;
+    ctrl_info->user_data   = (uintptr_t) &sync_state;
+    ctrl_info->complete_cb = control_xfer_sync_complete;
+  }
 
-    TU_ASSERT(usbh_setup_send(daddr, (uint8_t const *) &_usbh_epbuf.request));
+  if (!hcd_setup_send(usbh_get_rhport(daddr), daddr, (uint8_t const *) &_usbh_epbuf.request)) {
+    control_xfer_set_stage(CONTROL_STAGE_IDLE);
+    return false;
+  }
 
-    while (result == XFER_RESULT_INVALID) {
-      // Note: this can be called within an callback ie. part of tuh_task()
-      // therefore even with RTOS tuh_task_ext() still need to be invoked
+  if (!is_nonblocking) {
+    // No tuh_connected() escape needed: usbh_device_close() routes through
+    // control_xfer_complete(daddr, FAILED) on disconnect, which fires
+    // sync_complete and unblocks this poll.
+    while (sync_state.result == XFER_RESULT_INVALID) {
+#if CFG_TUSB_OS_HAS_SCHEDULER
+      osal_task_delay(1);
+#else
       tuh_task_ext(0, false);
-      // TODO probably some timeout to prevent hanged
+#endif
     }
 
-    // update transfer result, user_data is expected to point to xfer_result_t
+    // Forward to caller (xfer->user_data, if set, is a xfer_result_t pointer).
     if (xfer->user_data != 0) {
-      *((xfer_result_t*) xfer->user_data) = result;
+      *((xfer_result_t*) xfer->user_data) = sync_state.result;
     }
-    xfer->result     = result;
-    xfer->actual_len = ctrl_info->actual_len;
+    xfer->result     = sync_state.result;
+    xfer->actual_len = sync_state.actual_len;
   }
 
   return true;
 }
 
-static void _control_xfer_complete(uint8_t daddr, xfer_result_t result) {
+// Start control transfer from pending fifo
+static void control_xfer_dispatch_pending(void) {
+  usbh_ctrl_xfer_info_t* ctrl_info = &_usbh_data.ctrl_xfer_info;
+
+  while (true) {
+    usbh_pending_ctrl_t xfer;
+    bool has_xfer = false;
+
+    (void) osal_mutex_lock(_usbh_mutex, OSAL_TIMEOUT_WAIT_FOREVER);
+    if (ctrl_info->stage == CONTROL_STAGE_IDLE &&
+        tu_fifo_read_n(&_usbh_pending_ctrl_q, &xfer, sizeof(xfer)) == sizeof(xfer)) {
+      ctrl_info->stage        = CONTROL_STAGE_SETUP;
+      ctrl_info->daddr        = xfer.daddr;
+      ctrl_info->actual_len   = 0;
+      ctrl_info->failed_count = 0;
+      ctrl_info->buffer       = xfer.buffer;
+      ctrl_info->complete_cb  = xfer.complete_cb;
+      ctrl_info->user_data    = xfer.user_data;
+      _usbh_epbuf.request     = xfer.setup;
+      has_xfer = true;
+    }
+    (void) osal_mutex_unlock(_usbh_mutex);
+
+    if (!has_xfer) {
+      return; // nothing to do
+    }
+
+    // mismatched daddr_gen means pending transfer is stale due to the device got disconnected while in the FIFO
+    // Note: the address can be re-allocated to another device at this point.
+    if (xfer.daddr_gen == _usbh_data.daddr_gen[xfer.daddr]) {
+      TU_LOG_USBH("[%u:%u] %s: ", usbh_get_rhport(xfer.daddr), xfer.daddr,
+                  (xfer.setup.bmRequestType_bit.type == TUSB_REQ_TYPE_STANDARD && xfer.setup.bRequest <= TUSB_REQ_SYNCH_FRAME) ?
+                      tu_str_std_request[xfer.setup.bRequest] : "Class Request");
+      TU_LOG_BUF_USBH(&xfer.setup, 8);
+      if (hcd_setup_send(usbh_get_rhport(xfer.daddr), xfer.daddr, (uint8_t const *) &_usbh_epbuf.request)) {
+        return; // transfer kicked-off, we are done
+      }
+    }
+
+    // complete callback as FAILED and continue with next pending xfer
+    control_xfer_complete(xfer.daddr, XFER_RESULT_FAILED);
+  }
+}
+
+static void control_xfer_complete(uint8_t daddr, xfer_result_t result) {
   TU_LOG_USBH("\r\n");
   usbh_ctrl_xfer_info_t* ctrl_info = &_usbh_data.ctrl_xfer_info;
 
@@ -901,7 +1069,8 @@ static void _control_xfer_complete(uint8_t daddr, xfer_result_t result) {
     .user_data   = ctrl_info->user_data
   };
 
-  _control_set_xfer_stage(CONTROL_STAGE_IDLE);
+  // set to IDLE before callback since cb can invoke another transfer
+  control_xfer_set_stage(CONTROL_STAGE_IDLE);
 
   if (xfer_temp.complete_cb != NULL) {
     xfer_temp.complete_cb(&xfer_temp);
@@ -915,11 +1084,17 @@ static bool usbh_control_xfer_cb (uint8_t daddr, uint8_t ep_addr, xfer_result_t
   tusb_control_request_t const * request = &_usbh_epbuf.request;
   usbh_ctrl_xfer_info_t* ctrl_info = &_usbh_data.ctrl_xfer_info;
 
+  // Drop stale completions: slot already released (abort/close fired its cb)
+  // or now owns a different device's xfer (a pending entry was dispatched).
+  if (ctrl_info->stage == CONTROL_STAGE_IDLE || ctrl_info->daddr != daddr) {
+    return true;
+  }
+
   switch (result) {
     case XFER_RESULT_STALLED:
       TU_LOG_USBH("[%u:%u] Control STALLED, xferred_bytes = %" PRIu32 "\r\n", rhport, daddr, xferred_bytes);
       TU_LOG_BUF_USBH(request, 8);
-      _control_xfer_complete(daddr, result);
+      control_xfer_complete(daddr, result);
     break;
 
     case XFER_RESULT_FAILED:
@@ -931,11 +1106,14 @@ static bool usbh_control_xfer_cb (uint8_t daddr, uint8_t ep_addr, xfer_result_t
         ctrl_info->actual_len = 0; // reset actual_len
         (void) osal_mutex_unlock(_usbh_mutex);
 
-        TU_ASSERT(usbh_setup_send(daddr, (uint8_t const *) request));
+        if (!hcd_setup_send(rhport, daddr, (uint8_t const *) request)) {
+          control_xfer_complete(daddr, XFER_RESULT_FAILED);
+          return false;
+        }
       } else {
         TU_LOG_USBH("[%u:%u] Control FAILED, xferred_bytes = %" PRIu32 "\r\n", rhport, daddr, xferred_bytes);
         TU_LOG_BUF_USBH(request, 8);
-        _control_xfer_complete(daddr, result);
+        control_xfer_complete(daddr, result);
       }
     break;
 
@@ -944,7 +1122,7 @@ static bool usbh_control_xfer_cb (uint8_t daddr, uint8_t ep_addr, xfer_result_t
         case CONTROL_STAGE_SETUP:
           if (request->wLength > 0) {
             // DATA stage: initial data toggle is always 1
-            _control_set_xfer_stage(CONTROL_STAGE_DATA);
+            control_xfer_set_stage(CONTROL_STAGE_DATA);
             const uint8_t ep_data = tu_edpt_addr(0, request->bmRequestType_bit.direction);
             TU_ASSERT(hcd_edpt_xfer(rhport, daddr, ep_data, ctrl_info->buffer, request->wLength));
             return true;
@@ -959,7 +1137,7 @@ static bool usbh_control_xfer_cb (uint8_t daddr, uint8_t ep_addr, xfer_result_t
             ctrl_info->actual_len = (uint16_t) xferred_bytes;
 
             // ACK stage: toggle is always 1
-            _control_set_xfer_stage(CONTROL_STAGE_ACK);
+            control_xfer_set_stage(CONTROL_STAGE_ACK);
             const uint8_t ep_status = tu_edpt_addr(0, 1 - request->bmRequestType_bit.direction);
             TU_ASSERT(hcd_edpt_xfer(rhport, daddr, ep_status, NULL, 0));
             break;
@@ -976,7 +1154,7 @@ static bool usbh_control_xfer_cb (uint8_t daddr, uint8_t ep_addr, xfer_result_t
             }
           }
 
-          _control_xfer_complete(daddr, result);
+          control_xfer_complete(daddr, result);
           break;
         }
 
@@ -1023,7 +1201,7 @@ bool tuh_edpt_abort_xfer(uint8_t daddr, uint8_t ep_addr) {
     const usbh_ctrl_xfer_info_t* ctrl_info = &_usbh_data.ctrl_xfer_info;
     TU_VERIFY(daddr == ctrl_info->daddr && ctrl_info->stage != CONTROL_STAGE_IDLE);
     hcd_edpt_abort_xfer(rhport, daddr, ep_addr);
-    _control_set_xfer_stage(CONTROL_STAGE_IDLE); // reset control transfer state to idle
+    control_xfer_complete(daddr, XFER_RESULT_ABORTED);
   } else {
     usbh_device_t* dev = get_device(daddr);
     TU_VERIFY(dev);
@@ -1055,9 +1233,9 @@ uint8_t *usbh_get_enum_buf(void) {
 void usbh_int_set(bool enabled) {
   // TODO all host controller if multiple are used since they shared the same event queue
   if (enabled) {
-    hcd_int_enable(_usbh_data.controller_id);
+    hcd_int_enable(_usbh_controller_id);
   } else {
-    hcd_int_disable(_usbh_data.controller_id);
+    hcd_int_disable(_usbh_controller_id);
   }
 }
 
diff --git a/src/osal/osal_freertos.h b/src/osal/osal_freertos.h
index 9b12b5c0e..2f36aa9e8 100644
--- a/src/osal/osal_freertos.h
+++ b/src/osal/osal_freertos.h
@@ -85,7 +85,13 @@ typedef struct {
 //--------------------------------------------------------------------+
 typedef TaskHandle_t osal_task_handle_t;
 
-// Requires INCLUDE_xTaskGetCurrentTaskHandle == 1 in FreeRTOSConfig.h.
+// Requires INCLUDE_xTaskGetCurrentTaskHandle == 1 in FreeRTOSConfig.h. FreeRTOS
+// also exposes the symbol when configUSE_MUTEXES == 1, so accept either.
+#if !defined(INCLUDE_xTaskGetCurrentTaskHandle) || (INCLUDE_xTaskGetCurrentTaskHandle == 0)
+  #if !defined(configUSE_MUTEXES) || (configUSE_MUTEXES == 0)
+    #error "TinyUSB host stack requires INCLUDE_xTaskGetCurrentTaskHandle or configUSE_MUTEXES to be enabled in FreeRTOSConfig.h"
+  #endif
+#endif
 TU_ATTR_ALWAYS_INLINE static inline osal_task_handle_t osal_task_get_current_handle(void) {
   return xTaskGetCurrentTaskHandle();
 }
-- 
cgit v1.3.1


From 84e3347badc7f9f5146b5f5eb129900f2fc59389 Mon Sep 17 00:00:00 2001
From: Wojciech Klimek <wjklimek1@gmail.com>
Date: Thu, 28 May 2026 21:27:11 +0200
Subject: Handle OUT transfer completion in MTP

Handle OUT transfer differently from IN to not prematurely change MTP phase when host sends short packet that is not end of MTP data phase. Only reaching container length or ZLP should change phase.
---
 src/class/mtp/mtp_device.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/class/mtp/mtp_device.c b/src/class/mtp/mtp_device.c
index 0da984f4a..fd06b4601 100644
--- a/src/class/mtp/mtp_device.c
+++ b/src/class/mtp/mtp_device.c
@@ -441,9 +441,19 @@ bool mtpd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t event, uint32_t
         threshold = CFG_TUD_MTP_EP_BUFSIZE;
       }
 
-      // Check completion: ZLP, short packet, or total length reached
-      const bool is_complete =
-        (xferred_bytes == 0 || xferred_bytes < threshold || p_mtp->xferred_len >= p_mtp->total_len);
+      // Check completion for IN and OUT separately
+      bool is_complete;
+
+      if (is_data_in)
+      {
+        // IN completion: short packet, ZLP, or reaching total_len
+        is_complete = (xferred_bytes == 0 || xferred_bytes < threshold || p_mtp->xferred_len >= p_mtp->total_len);
+      }
+      else
+      {
+        // OUT completion: reaching total_len or ZLP
+        is_complete = (p_mtp->xferred_len >= p_mtp->total_len) || ((xferred_bytes == 0 && p_mtp->xferred_len > 0));
+      }
 
       TU_LOG_DRV("  MTP Data %s CB: xferred_bytes=%lu, xferred_len/total_len=%lu/%lu, is_complete=%d\r\n",
                  is_data_in ? "IN" : "OUT", xferred_bytes, p_mtp->xferred_len, p_mtp->total_len, is_complete ? 1 : 0);
-- 
cgit v1.3.1


From b4e7c25c1b57a69e4c04e41d0f2203abf0d8d358 Mon Sep 17 00:00:00 2001
From: HiFiPhile <admin@hifiphile.com>
Date: Fri, 29 May 2026 11:42:47 +0200
Subject: dwc2: process IN EP before OUT

To avoid STATUS IN completion of previous control transfer treated as next DATA IN  when IRQ latency is high.

Signed-off-by: HiFiPhile <admin@hifiphile.com>
---
 src/portable/synopsys/dwc2/dcd_dwc2.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 233840e8b..c90429a15 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -1213,6 +1213,12 @@ void dcd_int_handler(uint8_t rhport) {
     dcd_event_sof(rhport, frame, true);
   }
 
+  // IN endpoint interrupt handling.
+  if (gintsts & GINTSTS_IEPINT) {
+    // IEPINT bit read-only, clear using DIEPINTn
+    handle_ep_irq(rhport, TUSB_DIR_IN);
+  }
+
 #if CFG_TUD_DWC2_SLAVE_ENABLE
   // RxFIFO non-empty interrupt handling.
   if (gintsts & GINTSTS_RXFLVL) {
@@ -1235,12 +1241,6 @@ void dcd_int_handler(uint8_t rhport) {
   }
 #endif
 
-  // IN endpoint interrupt handling.
-  if (gintsts & GINTSTS_IEPINT) {
-    // IEPINT bit read-only, clear using DIEPINTn
-    handle_ep_irq(rhport, TUSB_DIR_IN);
-  }
-
   // Incomplete isochronous IN transfer interrupt handling.
   if (gintsts & GINTSTS_IISOIXFR) {
     dwc2->gintsts = GINTSTS_IISOIXFR;
-- 
cgit v1.3.1


From 7e0fcaa41ee9330274808d88e5211bdbe37511a4 Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 1 Jun 2026 10:05:17 +0700
Subject: ultrareview nits: keep xfer_result table in sync, hoist blinky loop

- src/tusb.c: extend tu_str_xfer_result[] with "ABORTED" and "INVALID"
  to match the new enum size. Not reachable today (no HCD posts those
  values through hcd_event_xfer_complete), but keeps the enum/table
  invariant intact so future HCDs that surface ABORTED don't index OOB.

- examples/dual/dynamic_switch/src/main.c: apply the same while(1)
  hoist already done for cdc_task / print_devinfo_task to
  led_blinking_task. On OS_NONE the loop returned mid-iteration, which
  on first call could fire multiple back-to-back toggles while
  start_ms (initially 0) caught up to uptime.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 examples/dual/dynamic_switch/src/main.c | 17 ++++++++++-------
 src/tusb.c                              |  2 +-
 2 files changed, 11 insertions(+), 8 deletions(-)

(limited to 'src')

diff --git a/examples/dual/dynamic_switch/src/main.c b/examples/dual/dynamic_switch/src/main.c
index ac5126e56..f67cd885c 100644
--- a/examples/dual/dynamic_switch/src/main.c
+++ b/examples/dual/dynamic_switch/src/main.c
@@ -483,16 +483,19 @@ void led_blinking_task(void *param) {
   (void) param;
   static uint32_t start_ms = 0;
   static bool led_state = false;
-  while (1) {
 #if CFG_TUSB_OS == OPT_OS_FREERTOS
+  while (1) {
     vTaskDelay(pdMS_TO_TICKS(blink_interval_ms));
-#else
-    if (tusb_time_millis_api() - start_ms < blink_interval_ms) {
-      return; // not enough time
-    }
-#endif
     start_ms += blink_interval_ms;
     board_led_write(led_state);
-    led_state = 1 - led_state; // toggle
+    led_state = 1 - led_state;
+  }
+#else
+  if (tusb_time_millis_api() - start_ms < blink_interval_ms) {
+    return; // not enough time
   }
+  start_ms += blink_interval_ms;
+  board_led_write(led_state);
+  led_state = 1 - led_state;
+#endif
 }
diff --git a/src/tusb.c b/src/tusb.c
index 5d656fb8c..634cbc10b 100644
--- a/src/tusb.c
+++ b/src/tusb.c
@@ -497,7 +497,7 @@ char const* const tu_str_std_request[] = {
 };
 
 char const* const tu_str_xfer_result[] = {
-    "OK", "FAILED", "STALLED", "TIMEOUT"
+    "OK", "FAILED", "STALLED", "TIMEOUT", "ABORTED", "INVALID"
 };
 #endif
 
-- 
cgit v1.3.1


From 17185428df755d7229407e6ac87c124e522877dc Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Mon, 1 Jun 2026 10:58:36 +0700
Subject: CFG_TUH_CONTROL_PENDING_QUEUE_SZ defefault to 4 if hub is eanbled, 2
 if not

---
 src/host/usbh.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/host/usbh.c b/src/host/usbh.c
index 05e03245f..9d159985e 100644
--- a/src/host/usbh.c
+++ b/src/host/usbh.c
@@ -41,7 +41,11 @@
 #endif
 
 #ifndef CFG_TUH_CONTROL_PENDING_QUEUE_SZ
-  #define CFG_TUH_CONTROL_PENDING_QUEUE_SZ 4
+  #if CFG_TUH_HUB
+    #define CFG_TUH_CONTROL_PENDING_QUEUE_SZ 4
+  #else
+    #define CFG_TUH_CONTROL_PENDING_QUEUE_SZ 2
+  #endif
 #endif
 
 #ifndef CFG_TUH_INTERFACE_MAX
-- 
cgit v1.3.1