I try to use your USB library for my ATSAM3U4E in my embedded system. I find that when I have save around 300Mbytes or more, my embedded system crash so I need to restart 2 or 3 times to finally achieve the full download. I can't figurate out why my embedded system crashes. I send you a quick view of my functions.

I create an app with Qt to download the data from the memory in my embedded system:

bool Device::usbWriteRead(t_usb_packet request, t_usb_packet response, int timeout) {
mutex.lock();
/ Send request /
if (usb_bulk_write(dev_handle, udi_vendor_ep_bulk_out, (char)request, sizeof(t_usb_packet), 10) < 0) {
mutex.unlock();
return false;
}
/ Retrieve response /
if (usb_bulk_read(dev_handle, udi_vendor_ep_bulk_in, (char)response, sizeof(t_usb_packet), timeout) < 0) {
mutex.unlock();
return false;
}
mutex.unlock();
return true;
}

My embedded system threat the bulk communication as follow:
static void usb_bulk_in_received(udd_ep_status_t status, iram_size_t nb_transfered, udd_ep_id_t ep) {
if (UDD_EP_TRANSFER_OK != status) return;
udi_vendor_bulk_out_run((uint8_t*)&usb_packet, sizeof(usb_packet), usb_bulk_out_received);
}

static void usb_bulk_out_received(udd_ep_status_t status, iram_size_t nb_transfered, udd_ep_id_t ep) {
if (UDD_EP_TRANSFER_OK != status) return;
switch (usb_packet.type) {
case USB_PACKET_TYPE_GET_DATA:
/* Return data from flash /
nand_flash_ecc_read_page(&nf_ecc, usb_packet.content.data.block, usb_packet.content.data.page, nf_data_buffer, NULL);
memcpy(&usb_packet.content.data.buffer, &nf_data_buffer[usb_packet.content.data.subpage * 512], 512);
break;
default:
break;
}
udi_vendor_bulk_in_run((uint8_t)&usb_packet, sizeof(usb_packet), usb_bulk_in_received);
}

I appreciate all the help you can give me. Thank you very much.

Jorge.

Hi,
I am using same program, but getting following error:
-- SD/MMC/SDIO Card Example --

-- Compiled: Dec 13 2017 18:16:47 --

Please plug an SD, MMC or SDIO card in slot 1.

Card information:

SDHC

15193 MB

Card R/W test:

Read...  22260 KBps [OK]

Write pattern...  20078 KBps [OK]

Read and check pattern... Check [FAIL]

Test finished, please unplugged the card.
Please see ....Read and check pattern... Check [FAIL] test come fail.

I tried this example with Arduino Due, Atmel Studio 7 and Terminal program CoolTermWin. Transmissions from terminal to controller are working, but there is no echo from controller back to terminal. Is this a bug or do I miss something here.

where is TCC_ASYNC is defined? I can't compile because it doesn't recognize this definition. but it's already being used in other drivers!

ILI9225.c

I tried to get my (china) ILI9225 working with ASF and this lib on "Arduino Due" with it's SAM3x8E controller and it's hardware SPI0.
After days of research I found, why it does not work:

1. SPI_MODE_3 instead of 1 has to be chosen (CLK-Signal idle high; capture on rising CLK)
2. 8 bits per Transfer has to be selected (do not switch it back to "default 16Bit" as noted in ili9225_write_cmd-function!!)
3. write_ram and write_ram_buffer functions have to call "spi_write" twice, one time for High-Byte, one time for Low-Byte of the uint16_t-Data:
   spi_write(BOARD_ILI9225_SPI, us_data>>8, BOARD_ILI9225_SPI_NPCS, 0); //High-Byte
   spi_write(BOARD_ILI9225_SPI, us_data&0x00FF, BOARD_ILI9225_SPI_NPCS, 0); //Low-Byte

I am running the lwmesh demo code. I found the program run into the while loop in the sys_TimerTaskHandler() in sysTimer.c

Did I mess up somewhere, or this is possible a bug?

Description

In handle_received_frame_irq, it reads mpdu content from MMIO

trx_frame_read(frame_ptr, LENGTH_FIELD_LEN + phy_frame_len +
			LQI_LEN);
receive_frame->mpdu = frame_ptr;
/* Add ED value at the end of the frame buffer. */
receive_frame->mpdu[phy_frame_len + LQI_LEN + ED_VAL_LEN] = ed_value;

The mpdu content is later parsed here, the first 32 bits is considered as length of the frame without any restriction. This makes frame_ptr accessing oob memory, causing data corruption, DoS and potientially RCE.

frame_len = last_frame_length = receive_frame->mpdu[0];
...
frame_ptr = &(receive_frame->mpdu[frame_len + LQI_LEN]);
lqi = *frame_ptr++;   <-- oob write
ed_level = *frame_ptr;

Fix

As all (or almost every) versions in thirdparty/wireless/avr2025_mac/source/tal/ can have the same issue, the best way to fix this might be adding length check in right before actually using the length at here.

This is discoverd by XinDistince and xdchase.

https://github.com/avrxml/asf/blame/68cddb46ae5ebc24ef8287a8d4c61a6efa5e2848/common/components/wifi/winc1500/http_downloader_example/iot/http/http_client.c#L649

IMO
in _http_client_handle_header()
module->req.content_length= -1;
should be
module->resp.content_length= -1;

I failed to compile tc45.h/tc45.c in Atmel Studio 7.0 for XMEGA-E5.

It gives 42 errors of undeclared and unknown variables.

Disclaimer: I am new to Atmel.

https://github.com/avrxml/asf/blame/68cddb46ae5ebc24ef8287a8d4c61a6efa5e2848/common/components/wifi/winc1500/http_downloader_example/iot/http/http_client.c#L955

module->resp.read_length=module->resp.read_length*0x10+ buffer-'a';
should be
module->resp.read_length=module->resp.read_length0x10+ *buffer-'a' + 10;