From 73af6494cd5defc296b91da80e2f59b8af4efa70 Mon Sep 17 00:00:00 2001 From: hathach Date: Wed, 3 Jun 2026 21:44:19 +0700 Subject: [PATCH 1/5] dwc2: submit setup packet on SETUP_DONE and drop spurious EP0 RX_COMPLETE on core v3.10a (STM32L476) DWC2 core rev 3.10a pushes an extra EP0 RX_COMPLETE (RXFLVL PKTSTS 0x3) that is not a real OUT data completion, in two cases flagged on DOEPINT: - STPKTRX (Setup Packet Received): between SETUP_RX and SETUP_DONE - STSPHSRX (Status Phase Received, control write): after the OUT data stage when the host starts the IN status phase --- src/portable/synopsys/dwc2/dcd_dwc2.c | 64 ++++++++++++++++++--------- 1 file changed, 42 insertions(+), 22 deletions(-) diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c index c90429a15e..447e644792 100644 --- a/src/portable/synopsys/dwc2/dcd_dwc2.c +++ b/src/portable/synopsys/dwc2/dcd_dwc2.c @@ -794,15 +794,15 @@ static void handle_bus_reset(uint8_t rhport) { xfer_status[0][TUSB_DIR_OUT].max_size = CFG_TUD_ENDPOINT0_SIZE; xfer_status[0][TUSB_DIR_IN].max_size = CFG_TUD_ENDPOINT0_SIZE; - uint32_t oepmsk = 0; + uint32_t gintmsk = GINTMSK_OTGINT | GINTMSK_IEPINT | GINTMSK_IISOIXFRM; if(dma_device_enabled(dwc2)) { - oepmsk = GINTMSK_OEPINT; + gintmsk |= GINTMSK_OEPINT; dma_setup_prepare(rhport); } else { dwc2->epout[0].doeptsiz |= (3 << DOEPTSIZ_STUPCNT_Pos); } - dwc2->gintmsk |= GINTMSK_OTGINT | oepmsk | GINTMSK_IEPINT | GINTMSK_IISOIXFRM; + dwc2->gintmsk |= gintmsk; } static void handle_enum_done(uint8_t rhport) { @@ -886,45 +886,50 @@ static void handle_rxflvl_irq(uint8_t rhport) { dwc2_regs_t* dwc2 = DWC2_REG(rhport); const volatile uint32_t* rx_fifo = dwc2->fifo[0]; + // DWC2 v3.10a (e.g. STM32L476) emits an extra EP0 RX_COMPLETE that is NOT a real OUT data transfer completion, in two + // situations - each flagged by a DOEPINT bit set on that word: + // - DOEPINT.STPKTRX (Setup Packet Received): pushed between SETUP_RX and SETUP_DONE of every control transfer. + // - DOEPINT.STSPHSRX (Status Phase Received for control write): pushed after the OUT data stage when the host + // starts the IN status phase. + // Both are dropped in the RX_COMPLETE case below, clearing the flag (W1C) so a latched STSPHSRX + // does not block the core from emitting the next SETUP_DONE. usbd still processes the real OUT data + // and queues the IN status ZLP itself - the core does not auto-complete the control-write status. + const bool quirk_v310a = (dwc2->gsnpsid == DWC2_CORE_REV_3_10a); + // Pop control word off FIFO const dwc2_grxstsp_t grxstsp = {.value = dwc2->grxstsp}; + const uint8_t packet_status = grxstsp.packet_status; const uint8_t epnum = grxstsp.ep_ch_num; dwc2_dep_t* epout = &dwc2->epout[epnum]; - switch (grxstsp.packet_status) { + TU_LOG1("packet_status = %u, ep %u, doepint = 0x%04lX\r\n", packet_status, epnum, epout->doepint); + + switch (packet_status) { case GRXSTS_PKTSTS_GLOBAL_OUT_NAK: // Global OUT NAK: do nothing break; case GRXSTS_PKTSTS_SETUP_RX: { // Setup packet received - uint32_t* setup = (uint32_t*)(uintptr_t) _dcd_usbbuf.setup_buffer; + uint32_t * setup = (uint32_t*)(uintptr_t) _dcd_usbbuf.setup_buffer; // We can receive up to three setup packets in succession, but only the last one is valid. setup[0] = (*rx_fifo); setup[1] = (*rx_fifo); - - dwc2_dep_t* epin0 = &dwc2->epin[0]; - if (edpt_is_enabled(epin0)) { - edpt_disable(rhport, 0x80, false); - } - - // (GenID < 3.00a) Must wait SETUP_DONE before next OUT transfer, otherwise OUT data may be corrupted. - // (GenID >= 3.00a) On the other hand STUPCNT is auto reloaded and SETUP_DONE is only triggered once after bus reset. - if (dwc2->gsnpsid >= DWC2_CORE_REV_3_00a) { - dcd_event_setup_received(rhport, _dcd_usbbuf.setup_buffer, true); - } break; } - case GRXSTS_PKTSTS_SETUP_DONE: - // Setup packet done: + case GRXSTS_PKTSTS_SETUP_DONE: { + // Pop this word cause Setup interrupt + // TU_LOG1("\r\n"); epout->doeptsiz |= (3 << DOEPTSIZ_STUPCNT_Pos); - - if (dwc2->gsnpsid < DWC2_CORE_REV_3_00a) { - dcd_event_setup_received(rhport, _dcd_usbbuf.setup_buffer, true); + epout->doepint = DOEPINT_SETUP | DOEPINT_STPKTRX; // Clear SETUP interrupt, required for core to re-write this control word + if (edpt_is_enabled(&dwc2->epin[0])) { + edpt_disable(rhport, 0x80, false); } + dcd_event_setup_received(rhport, _dcd_usbbuf.setup_buffer, true); break; + } case GRXSTS_PKTSTS_RX_DATA: { // Out packet received @@ -953,7 +958,20 @@ static void handle_rxflvl_irq(uint8_t rhport) { } case GRXSTS_PKTSTS_RX_COMPLETE: { - // Out packet done + // Pop this word cause xfer complete interrupt + const uint32_t doepint = epout->doepint; + epout->doepint = DOEPINT_XFRC; + + // v3.10a quirk (see top of function): the extra RX_COMPLETE flagged with Setup Packet Received (STPKTRX) or + // Status Phase Received for control write (STSPHSRX) is not a real OUT completion. Drop it + if (quirk_v310a) { + if (doepint & (DOEPINT_STPKTRX | DOEPINT_STSPHSRX)) { + epout->doepint = DOEPINT_STPKTRX | DOEPINT_STSPHSRX; + break; + } + } + // TU_LOG1("\r\n"); + xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT); if (epnum == 0 && _dcd_data.ep0_pending[TUSB_DIR_OUT] > 0) { // EP0 can only handle one packet, schedule another packet to be received. @@ -1093,6 +1111,8 @@ static void handle_ep_irq(uint8_t rhport, uint8_t dir) { #if CFG_TUD_DWC2_SLAVE_ENABLE if (dir == TUSB_DIR_IN) { handle_epin_slave(rhport, epnum, intr.diepint_bm); + } else { + // epout is handled in rxflv } #endif } From a6098c38ac3390716a6cf3046a87b13dd85fecca Mon Sep 17 00:00:00 2001 From: hathach Date: Wed, 3 Jun 2026 21:46:11 +0700 Subject: [PATCH 2/5] refactor(cmake): comment out unused target folder properties --- hw/bsp/family_support.cmake | 36 +++++++++---------- .../stm32f7/boards/stm32f769disco/board.cmake | 1 + src/class/mtp/mtp_device.c | 11 +++--- 3 files changed, 23 insertions(+), 25 deletions(-) diff --git a/hw/bsp/family_support.cmake b/hw/bsp/family_support.cmake index 2468ac43c8..07d693d77b 100644 --- a/hw/bsp/family_support.cmake +++ b/hw/bsp/family_support.cmake @@ -244,7 +244,7 @@ function(family_add_bloaty TARGET) COMMAND ${BLOATY_EXE} ${OPTION_LIST} $ VERBATIM) - set_property(TARGET ${TARGET}-bloaty PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-bloaty PROPERTY FOLDER ${TARGET}-group) # post build # add_custom_command(TARGET ${TARGET} POST_BUILD # COMMAND ${BLOATY_EXE} --csv ${OPTION_LIST} $ > ${CMAKE_CURRENT_BINARY_DIR}/${TARGET}_bloaty.csv @@ -265,7 +265,7 @@ function(family_add_linkermap TARGET) VERBATIM ) - set_property(TARGET ${TARGET}-linkermap PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-linkermap PROPERTY FOLDER ${TARGET}-group) # post build add_custom_command(TARGET ${TARGET} POST_BUILD @@ -347,7 +347,7 @@ echo \"$MEMBROWSE_CMD\"") COMMAND ${CMAKE_COMMAND} -E env MEMBROWSE_UPLOAD=0 bash -lc "${MEMBROWSE_PREPARE_CMD}; eval \"$MEMBROWSE_CMD\"" VERBATIM ) - set_property(TARGET ${TARGET}-membrowse PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-membrowse PROPERTY FOLDER ${TARGET}-group) add_custom_target(${TARGET}-membrowse-upload COMMAND ${CMAKE_COMMAND} -E env MEMBROWSE_UPLOAD=1 bash -lc "${MEMBROWSE_PREPARE_CMD}; eval \"$MEMBROWSE_CMD\"" @@ -359,7 +359,7 @@ echo \"$MEMBROWSE_CMD\"") endif () add_dependencies(examples-membrowse-upload ${TARGET}-membrowse-upload) - set_property(TARGET ${TARGET}-membrowse-upload PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-membrowse-upload PROPERTY FOLDER ${TARGET}-group) endif () endfunction() @@ -648,7 +648,7 @@ exit" VERBATIM ) - set_property(TARGET ${NAME_TARGET}-jlink PROPERTY FOLDER ${TARGET}-group) +# set_property(TARGET ${NAME_TARGET}-jlink PROPERTY FOLDER ${NAME_TARGET}-group) endfunction() @@ -663,7 +663,7 @@ function(family_flash_stlink TARGET) COMMAND ${STM32_PROGRAMMER_CLI} --connect port=swd --write $ --go ) - set_property(TARGET ${TARGET}-stlink PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-stlink PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -678,7 +678,7 @@ function(family_flash_stflash TARGET) COMMAND ${ST_FLASH} write $/${TARGET}.bin 0x8000000 ) - set_property(TARGET ${TARGET}-stflash PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-stflash PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -706,7 +706,7 @@ function(family_flash_openocd TARGET) VERBATIM ) - set_property(TARGET ${TARGET}-openocd PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-openocd PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -769,7 +769,7 @@ function(family_flash_wlink_rs TARGET) COMMAND ${WLINK_RS} flash $ ) - set_property(TARGET ${TARGET}-wlink-rs PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-wlink-rs PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -784,7 +784,7 @@ function(family_flash_pyocd TARGET) COMMAND ${PYOCD} flash -t ${PYOCD_TARGET} $ ) - set_property(TARGET ${TARGET}-pyocd PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-pyocd PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -794,7 +794,7 @@ function(family_flash_uf2 TARGET FAMILY_ID) DEPENDS ${TARGET} COMMAND python ${UF2CONV_PY} -f ${FAMILY_ID} --deploy $/${TARGET}.uf2 ) - set_property(TARGET ${TARGET}-uf2 PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-uf2 PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -810,7 +810,7 @@ function(family_flash_teensy TARGET) COMMAND ${TEENSY_CLI} --mcu=${TEENSY_MCU} -w -s $/${TARGET}.hex ) - set_property(TARGET ${TARGET}-teensy PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-teensy PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -830,7 +830,7 @@ function(family_flash_nxplink TARGET) COMMAND ${LINKSERVER_PATH} flash ${NXPLINK_DEVICE} load $ ) - set_property(TARGET ${TARGET}-nxplink PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-nxplink PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -845,7 +845,7 @@ function(family_flash_dfu_util TARGET OPTION) VERBATIM ) - set_property(TARGET ${TARGET}-dfu-util PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-dfu-util PROPERTY FOLDER ${TARGET}-group) endfunction() function(family_flash_msp430flasher TARGET) @@ -862,7 +862,7 @@ function(family_flash_msp430flasher TARGET) ${MSP430FLASHER} -w $/${TARGET}.hex -z [VCC] ) - set_property(TARGET ${TARGET}-msp430flasher PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-msp430flasher PROPERTY FOLDER ${TARGET}-group) endfunction() function(family_flash_rfp TARGET) @@ -880,7 +880,7 @@ function(family_flash_rfp TARGET) VERBATIM ) - set_property(TARGET ${TARGET}-rfp PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-rfp PROPERTY FOLDER ${TARGET}-group) endfunction() @@ -897,7 +897,7 @@ function(family_flash_uniflash TARGET) VERBATIM ) - set_property(TARGET ${TARGET}-uniflash PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-uniflash PROPERTY FOLDER ${TARGET}-group) endfunction() # Add flash ft9xx target need to remove kernal's ftdi_sio and bind D2XX drivers @@ -912,7 +912,7 @@ function(family_flash_ft9xx TARGET) COMMAND ${FT9XXPROG} -f $/${TARGET}.bin ) - set_property(TARGET ${TARGET}-ft9xx PROPERTY FOLDER ${TARGET}-group) + #set_property(TARGET ${TARGET}-ft9xx PROPERTY FOLDER ${TARGET}-group) endfunction() #---------------------------------- diff --git a/hw/bsp/stm32f7/boards/stm32f769disco/board.cmake b/hw/bsp/stm32f7/boards/stm32f769disco/board.cmake index 2335b869e4..dbdd07e4d3 100644 --- a/hw/bsp/stm32f7/boards/stm32f769disco/board.cmake +++ b/hw/bsp/stm32f7/boards/stm32f769disco/board.cmake @@ -1,5 +1,6 @@ set(MCU_VARIANT stm32f769xx) set(JLINK_DEVICE stm32f769ni) +#set(JLINK_OPTION "-USB 000778170924") set(LD_FILE_GNU ${CMAKE_CURRENT_LIST_DIR}/STM32F769ZITx_FLASH.ld) diff --git a/src/class/mtp/mtp_device.c b/src/class/mtp/mtp_device.c index fd06b46016..1f76dfcc70 100644 --- a/src/class/mtp/mtp_device.c +++ b/src/class/mtp/mtp_device.c @@ -443,15 +443,12 @@ bool mtpd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t event, uint32_t // Check completion for IN and OUT separately bool is_complete; - - if (is_data_in) - { + if (is_data_in) { // IN completion: short packet, ZLP, or reaching total_len is_complete = (xferred_bytes == 0 || xferred_bytes < threshold || p_mtp->xferred_len >= p_mtp->total_len); - } - else - { - // OUT completion: reaching total_len or ZLP + } else { + // OUT completion: reaching total_len or ZLP only. A short packet does NOT end the phase + // (an early short packet before total_len is the cancel case, not normal completion). is_complete = (p_mtp->xferred_len >= p_mtp->total_len) || ((xferred_bytes == 0 && p_mtp->xferred_len > 0)); } From e45d5ad528e82d6d4323c5c23c6f489fe0e02dc6 Mon Sep 17 00:00:00 2001 From: hathach Date: Wed, 3 Jun 2026 23:13:17 +0700 Subject: [PATCH 3/5] Add STM32F407 and STM32L476 disco board configurations to tinyusb.json --- test/hil/tinyusb.json | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/test/hil/tinyusb.json b/test/hil/tinyusb.json index dc28df7b9b..c0a35ddc20 100644 --- a/test/hil/tinyusb.json +++ b/test/hil/tinyusb.json @@ -343,6 +343,20 @@ }, "comment": "2x16 access scheme with 1KB USB SRAM" }, + { + "name": "stm32f407disco", + "uid": "30001A000647313332353735", + "tests": { + "device": true, + "host": false, + "dual": false + }, + "flasher": { + "name": "jlink", + "uid": "000773661813", + "args": "-device stm32f407vg" + } + }, { "name": "stm32f723disco", "uid": "460029001951373031313335", @@ -413,6 +427,20 @@ "args": "-f interface/stlink.cfg -f target/stm32g0x.cfg" }, "comment": "32-bit scheme, 2KB USB SRAM" + }, + { + "name": "stm32l476disco", + "uid": "3C0050001150334258343920", + "tests": { + "device": true, + "host": false, + "dual": false + }, + "flasher": { + "name": "jlink", + "uid": "777632258", + "args": "-device STM32L476VG" + } } ], "boards-skip": [ From 6b89aea9de07f537611ddffca1183a3a958a7ee4 Mon Sep 17 00:00:00 2001 From: hathach Date: Wed, 3 Jun 2026 23:18:28 +0700 Subject: [PATCH 4/5] dwc2: remove investigation debug logging Co-Authored-By: Claude Opus 4.8 (1M context) --- src/portable/synopsys/dwc2/dcd_dwc2.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c index 447e644792..ac35eb951a 100644 --- a/src/portable/synopsys/dwc2/dcd_dwc2.c +++ b/src/portable/synopsys/dwc2/dcd_dwc2.c @@ -903,8 +903,6 @@ static void handle_rxflvl_irq(uint8_t rhport) { dwc2_dep_t* epout = &dwc2->epout[epnum]; - TU_LOG1("packet_status = %u, ep %u, doepint = 0x%04lX\r\n", packet_status, epnum, epout->doepint); - switch (packet_status) { case GRXSTS_PKTSTS_GLOBAL_OUT_NAK: // Global OUT NAK: do nothing @@ -921,7 +919,6 @@ static void handle_rxflvl_irq(uint8_t rhport) { case GRXSTS_PKTSTS_SETUP_DONE: { // Pop this word cause Setup interrupt - // TU_LOG1("\r\n"); epout->doeptsiz |= (3 << DOEPTSIZ_STUPCNT_Pos); epout->doepint = DOEPINT_SETUP | DOEPINT_STPKTRX; // Clear SETUP interrupt, required for core to re-write this control word if (edpt_is_enabled(&dwc2->epin[0])) { @@ -970,7 +967,6 @@ static void handle_rxflvl_irq(uint8_t rhport) { break; } } - // TU_LOG1("\r\n"); xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT); if (epnum == 0 && _dcd_data.ep0_pending[TUSB_DIR_OUT] > 0) { From 1f6236ae0788e37bb833e4b018faf10fb691bbdd Mon Sep 17 00:00:00 2001 From: hathach Date: Wed, 3 Jun 2026 23:41:19 +0700 Subject: [PATCH 5/5] dwc2: address Copilot review (comment grammar/typo, tinyusb.json f407 dedup) Co-Authored-By: Claude Opus 4.8 (1M context) --- src/portable/synopsys/dwc2/dcd_dwc2.c | 6 +++--- test/hil/tinyusb.json | 14 -------------- 2 files changed, 3 insertions(+), 17 deletions(-) diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c index ac35eb951a..bab7118dd9 100644 --- a/src/portable/synopsys/dwc2/dcd_dwc2.c +++ b/src/portable/synopsys/dwc2/dcd_dwc2.c @@ -918,7 +918,7 @@ static void handle_rxflvl_irq(uint8_t rhport) { } case GRXSTS_PKTSTS_SETUP_DONE: { - // Pop this word cause Setup interrupt + // Pop this word causes the Setup interrupt epout->doeptsiz |= (3 << DOEPTSIZ_STUPCNT_Pos); epout->doepint = DOEPINT_SETUP | DOEPINT_STPKTRX; // Clear SETUP interrupt, required for core to re-write this control word if (edpt_is_enabled(&dwc2->epin[0])) { @@ -955,7 +955,7 @@ static void handle_rxflvl_irq(uint8_t rhport) { } case GRXSTS_PKTSTS_RX_COMPLETE: { - // Pop this word cause xfer complete interrupt + // Pop this word causes the xfer complete interrupt const uint32_t doepint = epout->doepint; epout->doepint = DOEPINT_XFRC; @@ -1108,7 +1108,7 @@ static void handle_ep_irq(uint8_t rhport, uint8_t dir) { if (dir == TUSB_DIR_IN) { handle_epin_slave(rhport, epnum, intr.diepint_bm); } else { - // epout is handled in rxflv + // epout is handled in handle_rxflvl_irq } #endif } diff --git a/test/hil/tinyusb.json b/test/hil/tinyusb.json index c0a35ddc20..467b7378af 100644 --- a/test/hil/tinyusb.json +++ b/test/hil/tinyusb.json @@ -477,20 +477,6 @@ "uid": "EBCA8F0670AF", "args": "" } - }, - { - "name": "stm32f407disco", - "uid": "30001A000647313332353735", - "tests": { - "device": true, - "host": false, - "dual": false - }, - "flasher": { - "name": "jlink", - "uid": "000773661813", - "args": "-device stm32f407vg" - } } ] }