rt-thread
rt-thread copied to clipboard
Missing address indirection in usb device
Hi,
In components/drivers/usb/usbdevice/core/core.c
in _ep0_out_notify
around line 888 the line that currently reads;
size = dcd_ep_read(device->dcd, EP0_OUT_ADDR, ep0->request.buffer);
should be updated to read;
size = dcd_ep_read(device->dcd, EP0_OUT_ADDR, &ep0->request.buffer);
...otherwise bad things happen, but not very often.
DAVE
@lymzzyh could you please confirm this issue?
我不是看的很懂
struct uio_request
{
rt_list_t list;
UIO_REQUEST_TYPE req_type;
rt_uint8_t* buffer;
rt_size_t size;
rt_size_t remain_size;
};
typedef struct uio_request* uio_request_t;
buffer本身就是个 (rt_uint8_t *)
而
rt_inline rt_size_t dcd_ep_read(udcd_t dcd, rt_uint8_t address, void *buffer)
的入口参数是 (void *) 是出于什么理由给buffer做取址运算的?
而且目前 dcd_ep_read 并没有在任何bsp的驱动中被具体实现,所以你发生的任何问题都不会跟这玩意有关
所以你发生的任何问题都不会跟这玩意有关
我在调试 rtt-win usb 的bulk endpoint 的时候发现了
size = ep_msg->size;
if(ep->request.remain_size == 0)
{
return RT_EOK;
}
if(size == 0)
{
size = dcd_ep_read(device->dcd, EP_ADDRESS(ep), ep->request.buffer);
}
ep->request.remain_size -= size;
ep->request.buffer += size;
if(ep->request.req_type == UIO_REQUEST_READ_BEST)
{
EP_HANDLER(ep, func, size);
}
else if(ep->request.remain_size == 0)
{
EP_HANDLER(ep, func, ep->request.size);
}
else
{
dcd_ep_read_prepare(device->dcd, EP_ADDRESS(ep), ep->request.buffer, ep->request.remain_size > EP_MAXPACKET(ep) ? EP_MAXPACKET(ep) : ep->request.remain_size);
}
这里确实没有实现 ep->request 其中的 remian_size 总是为0 所以不会进去
@lymzzyh 不要在没有判定对方国籍的情况下就直接用中文回复啊