AnsweredAssumed Answered

Corrupted USB packet BF527

Question asked by tcmichals on Feb 3, 2012
Latest reply on Apr 9, 2012 by jobo23

During long running tests, sometimes running for several days,  an USB packet is sent with invalid data. 

Software SDK/Development:

- VDK 5.0 Update 11, VisualDSP, using standard adi_usb_hdr.c/adi_usb_core.c

-  USB mode is device


-  2 Bulk Endpoints

- 1 Interrupt

- Speed Full Speed


The corrupted packet is using INT Endpoint, 8 bytes (USB_SETUP_PACKET), using an USB sniffer the packet has the wrong RequestType, length, etc.  In RNDIS, a CDC request is send, the BF527, then sends a response, on the interrupt endpoint to inform RNDIS the response is ready.


But, there has been several thousand or more of valid packets sent over the INT endpoint using the same function as below. The RNDIS protocol sends a Command via the control endpoint, the client (BF527) sends an INT(USB_SETUP_PACKET) that Response is ready for the command, then WIN sends a Get Response message to get the data via the control endpoint.  This sequence has occurred thousand or more times without any "corrupted packets" on INT endpoint.  Also, bulk data endpoints are also active sending about 3Mb. The same function is called everytime to generate the interrupt endpoint message, shown below:


#pragma align 32

static ADI_DEV_1D_BUFFER   _rndis1DIntCmdBuff;

#pragma align 32

static USB_SETUP_PACKET   _rndisReply;


static u32 sendINTReply( RNDIS_CDC_DEF *pVSDev, unsigned int __arg2, void *__arg3)



    _rndisReply.bRequest      = 1,

    _rndisReply.wValue        = 0,

    _rndisReply.wIndex        = 0,

    _rndisReply.wLength       = sizeof(_rndisReply) - sizeof(USB_SETUP_PACKET);



    _rndis1DIntCmdBuff.Data = &_rndisReply;

    _rndis1DIntCmdBuff.ElementCount= sizeof(_rndisReply);

    _rndis1DIntCmdBuff.ElementWidth =1;

    _rndis1DIntCmdBuff.CallbackParameter = &_rndis1DIntCmdBuff;

    _rndis1DIntCmdBuff.ProcessedElementCount =0;

    _rndis1DIntCmdBuff.ProcessedFlag = 0;

    _rndis1DIntCmdBuff.pNext = (adi_dev_1d_buffer *)NULL;


    /* Set the the address to endpoint zero */

    _rndis1DIntCmdBuff.Reserved[BUFFER_RSVD_EP_ADDRESS] = pVSDev->rndis_IN_IntEP;


    syslogRNDIS("Send Int");


    /* Write to the peripheral driver */           

    return  adi_dev_Write(pVSDev->hUsbController,


                  (ADI_DEV_BUFFER *)&_rndis1DIntCmdBuff);