ricardgb commented on PR #19378: URL: https://github.com/apache/nuttx/pull/19378#issuecomment-4928930138
Thanks for reviewing. Here are before/after logs. **Setup:** `raspberrypi-pico` (RP2040), Linux host, standalone `CONFIG_NET_CDCNCM` gadget. NuttX gadgets use the Linux-gadget VID/PID `0525:a4a2`, which the host `cdc_subset` driver also claims, so to exercise NCM I unbind it and bind `cdc_ncm`: `echo 3-1:1.1 > /sys/bus/usb/drivers/cdc_subset/unbind; echo 3-1:1.0 > /sys/bus/usb/drivers/cdc_ncm/bind`. Board is `192.168.7.1`, host `192.168.7.2` on `usb0`, `ifup eth0` on the board. ### Before the patches The host binds `cdc_ncm` and brings the link up, but no traffic passes. Every bulk OUT read completes with zero bytes (the read buffer is armed with the full 16 KiB request length, overflowing the 10-bit `LEN` field), so the board floods: ``` cdcncm_receive: Wrong NTH SIGN, skblen 0 cdcncm_receive: Wrong NTH SIGN, skblen 0 cdcncm_receive: Wrong NTH SIGN, skblen 0 ... ``` ``` $ ping -c 10 192.168.7.1 10 packets transmitted, 0 received, +10 errors, 100% packet loss ``` Separately, the interrupt-IN `NETWORK_CONNECTION`/`SPEED_CHANGE` notification is armed twice (once by `epsubmit` from the notify callback, once by the unconditional re-arm in `txcomplete`), toggling the data PID and getting dropped by the host, so the interface never sees carrier from the notification path. ### After the patches The `Wrong NTH SIGN, skblen 0` flood is gone, OUT data is received, and ping is 0% loss in both directions: ``` # host -> board $ ping -c 20 -i 0.2 192.168.7.1 20 packets transmitted, 20 received, 0% packet loss rtt min/avg/max/mdev = 12.852/18.594/37.781/5.248 ms ``` ``` # board -> host (nsh) nsh> ping -c 4 192.168.7.2 4 packets transmitted, 4 received, 0% packet loss ``` The interrupt-IN notification now completes and reaches the host — `usbmon` on the bulk-notify endpoint (EP 0x81), 16-byte `a1` (`NETWORK_CONNECTION`/`SPEED_CHANGE`) completing with status 0: ``` C Ii:3:015:1 0:4 16 = a12a0000 00000800 00709400 00709400 ``` `cdc_ncm` bound, carrier up after the fix: ``` usb0 UP 02:00:00:11:22:33 <BROADCAST,MULTICAST,UP,LOWER_UP> driver: cdc_ncm ``` No regression on `cdcacm` / `usbmsc` (their reads already fit in `LEN` and they don't resubmit from completion callbacks). The RP2350 (`rp23xx_usbdev.c`) changes are the identical fix to byte-identical functions; they compile for `raspberrypi-pico-2` but were not separately re-tested on RP2350 silicon. --- *Disclosure: these logs, the patch, and its validation were produced by an AI agent (Claude Code), operated and directed by me, and reviewed by me before posting.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
