Latest master can be 0.13.0.
mynewt/nimble build with BTH and MSC enabled
What happened ?
When DMA is started for one OUT endpoint values read from SIZE.EPOUT[n] for other endpoint are not valid.
This behavior is not documented (yet) by Nordic but it can be observed on NRF52/NRF53.
When two packets arrive on two different endpoints single interrupt will detect and try to handle both.
It calls function xact_out_dma() for both endpoints one after the other.
For the first endpoint (one with lower number) DMA will start transferring data from endpoint to RAM.
Second call xact_out_dma() for next ready endpoint will not start DMA right away since it's already started, it will call usbd_defer_func() with task start register.
This looks like correct sequence however there is problem in following code inside xact_out_dma()
// Following line may compute incorrect value !!!!!!!!!!!!!
xact_len = tu_min16((uint16_t) NRF_USBD->SIZE.EPOUT[epnum], xfer->total_len - xfer->actual_len);
// Trigger DMA move data from Endpoint -> SRAM
NRF_USBD->EPOUT[epnum].PTR = (uint32_t) xfer->buffer;
NRF_USBD->EPOUT[epnum].MAXCNT = xact_len; // <- Possible wrong value
edpt_dma_start(&NRF_USBD->TASKS_STARTEPOUT[epnum]);
first line can incorrectly computes xact_len while DMA is ongoing.
Read from NRF_USBD->SIZE.EPOUT[epnum] yields incorrect values.
This incorrect value is then set to NRF_USBD->EPOUT[epnum].MAXCNT and later DMA will copy less bytes that it should and resulting in broken protocols.
Following code could be used to trap error
// helper to start DMA
static void start_dma(volatile uint32_t* reg_startep)
{
for (int i = 0; i < 8; ++i) stored_size_epout1[i] = NRF_USBD->SIZE.EPOUT[i];
(*reg_startep) = 1;
__ISB(); __DSB();
for (int i = 0; i < 8; ++i) stored_size_epout2[i] = NRF_USBD->SIZE.EPOUT[i];
if (memcmp(stored_size_epout1, stored_size_epout2, 8))
TU_BREAKPOINT();
How to reproduce ?
I think it maybe it could be reproduce in cdc_msc modified sample (at least two OUT endpoint are needed) and some massive transfer on both endpoints.
Operating System
Linux
Board
pca10095 or pca10056 or other NRF52/NRF53
Firmware
Latest master can be 0.13.0. mynewt/nimble build with BTH and MSC enabled
What happened ?
When DMA is started for one OUT endpoint values read from
SIZE.EPOUT[n]
for other endpoint are not valid. This behavior is not documented (yet) by Nordic but it can be observed on NRF52/NRF53. When two packets arrive on two different endpoints single interrupt will detect and try to handle both. It calls functionxact_out_dma()
for both endpoints one after the other. For the first endpoint (one with lower number) DMA will start transferring data from endpoint to RAM. Second callxact_out_dma()
for next ready endpoint will not start DMA right away since it's already started, it will callusbd_defer_func()
with task start register. This looks like correct sequence however there is problem in following code insidexact_out_dma()
first line can incorrectly computes
xact_len
while DMA is ongoing. Read fromNRF_USBD->SIZE.EPOUT[epnum]
yields incorrect values. This incorrect value is then set toNRF_USBD->EPOUT[epnum].MAXCNT
and later DMA will copy less bytes that it should and resulting in broken protocols.Following code could be used to trap error
How to reproduce ?
I think it maybe it could be reproduce in cdc_msc modified sample (at least two OUT endpoint are needed) and some massive transfer on both endpoints.
Debug Log as txt file
No response
Screenshots
No response