LPC17 USB host: Fix some OHCI done head handling when a tranfer is cancelled

arch/arm/src/lpc17xx/lpc17_usbhost.c

@@ -1786,19 +1786,38 @@ static int lpc17_usbinterrupt(int irq, void *context)
            * cleared in the interrupt status register.
            */
 
-          td = (struct lpc17_gtd_s *)HCCA->donehead;
+          td = (struct lpc17_gtd_s *)(HCCA->donehead & HCCA_DONEHEAD_MASK);
           HCCA->donehead = 0;
 
           /* Process each TD in the write done list */
 
           for (; td; td = next)
             {
+              /* REVISIT: I have encountered bad TDs in the done list linked
+               * after at least one good TD.  This is some consequence of how
+               * transfers are being cancelled.  But for now, I have only
+               * this work-around.
+               */
+
+              if ((uintptr_t)td < LPC17_TDFREE_BASE ||
+                  (uintptr_t)td >= (LPC17_TDFREE_BASE + LPC17_TD_SIZE*CONFIG_USBHOST_NTDS))
+                {
+                  break;
+                }
+
               /* Get the ED in which this TD was enqueued */
 
               ed      = td->ed;
-              DEBUGASSERT(ed != NULL && ed->xfrinfo != NULL);
+              DEBUGASSERT(ed != NULL);
-              xfrinfo = ed->xfrinfo;
 
+              /* If there is a transfer in progress, then the xfrinfo pointer will be
+               * non-NULL.  But it appears that a NULL pointer may be received with a
+               * spurious interrupt such as may occur after a transfer is cancelled.
+               */
+
+              xfrinfo = ed->xfrinfo;
+              if (xfrinfo)
+                {
                   /* Save the condition code from the (single) TD status/control
                    * word.
                    */
@@ -1817,8 +1836,8 @@ static int lpc17_usbinterrupt(int irq, void *context)
 #endif
 
                   /* Determine the number of bytes actually transfer by
-               * subtracting the buffer start address from the CBP.  A value
+                   * subtracting the buffer start address from the CBP.  A
-               * of zero means that all bytes were transferred.
+                   * value of zero means that all bytes were transferred.
                    */
 
                   tmp = (uintptr_t)td->hw.cbp;
@@ -1832,9 +1851,9 @@ static int lpc17_usbinterrupt(int irq, void *context)
                     {
                       DEBUGASSERT(tmp >= (uintptr_t)xfrinfo->buffer);
 
-                  /* Determine the size of the transfer by subtracting the
+                      /* Determine the size of the transfer by subtracting
-                   * current buffer pointer (CBP) from the initial buffer
+                       * the current buffer pointer (CBP) from the initial
-                   * pointer (on packet receipt only).
+                       * buffer pointer (on packet receipt only).
                        */
 
                       tmp -= (uintptr_t)xfrinfo->buffer;
@@ -1857,8 +1876,8 @@ static int lpc17_usbinterrupt(int irq, void *context)
                     }
 
 #ifdef CONFIG_USBHOST_ASYNCH
-              /* Perform any pending callbacks for the case of asynchronous
+                  /* Perform any pending callbacks for the case of
-               * transfers.
+                   * asynchronous transfers.
                    */
 
                   else if (xfrinfo->callback)
@@ -1869,6 +1888,7 @@ static int lpc17_usbinterrupt(int irq, void *context)
 #endif
                 }
             }
+        }
 
 #ifdef CONFIG_DEBUG_USB
       if ((pending & LPC17_DEBUG_INTS) != 0)

arch/arm/src/sama5/sam_ohci.c

@@ -2113,7 +2113,7 @@ static void sam_wdh_bottomhalf(void)
 
   /* Now read the done head. */
 
-  td = (struct sam_gtd_s *)sam_virtramaddr(g_hcca.donehead);
+  td = (struct sam_gtd_s *)sam_virtramaddr(g_hcca.donehead & HCCA_DONEHEAD_MASK);
   g_hcca.donehead = 0;
 
   /* Process each TD in the write done list */

include/nuttx/usb/ohci.h

@@ -367,11 +367,17 @@
 /* HccaDoneHead: When the HC reaches the end of a frame and its deferred
  * interrupt register is 0, it writes the current value of its HcDoneHead to
  * this location and generates an interrupt.
+ *
+ * The LSB of HCCADoneHead may be set to 1 to indicate that an unmasked
+ * HcInterruptStatus was set when HccaDoneHead was written.
  */
 
 #define HCCA_DONEHEAD_OFFSET       (0x84)
 #define HCCA_DONEHEAD_BSIZE        (4)
 
+#define HCCA_DONEHEAD_MASK         0xfffffffe
+#define HCCA_DONEHEAD_INTSTA       (1 << 0)
+
 /* 0x88: 116 bytes reserved */
 
 #define HCCA_RESERVED_OFFSET       (0x88)