Re: [PATCH] usb: gadget: tegra-xudc: drain EP pipeline before DMA unmap

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Jun 05, 2026 at 02:16:47PM +0900, Vi_ _Ku wrote:
> On Tegra186/194/234 the XUDC appears to post a transfer-completion
> event when the DMA write is dispatched to the AXI interconnect, before
> the store is committed to memory.  Under SMMU strict mode dma_unmap()
> synchronously removes the IOVA TLB entry.  If an in-flight AXI write
> to that IOVA has not yet been committed, the SMMU raises a translation
> fault (fsr=0x402) that permanently wedges the bulk endpoint; the host
> cdc_ncm TX queue stalls and fires NETDEV WATCHDOG after 5 s.
> 
> Fix for non-control endpoints: poll EP_THREAD_ACTIVE until the endpoint
> sequencer goes idle before calling dma_unmap().  Follow the poll with an
> MMIO read-back that orders prior CPU writes to device memory.  Only
> after that does dma_unmap() invalidate the TLB entry.
> 
> On timeout, skip the dma_unmap to avoid triggering the SMMU fault.  The
> DMA mapping leaks, but the hardware is already in an unrecoverable state
> at that point.
> 
> ep_wait_for_inactive() uses readl_poll_timeout_atomic() (1 µs poll,
> 100 µs timeout), already called from IRQ context in
> __tegra_xudc_ep_dequeue().  Change its return type from void to int so
> both call sites can detect and report a timeout.
> 
> Control endpoints (EP0) are excluded: their completions go through the
> control-transfer state machine where the DMA is fully committed before
> req_done is called.
> 
> Fixes: d720f0f7bfa0 ("usb: gadget: Add Tegra XUSB device mode controller
> driver")
> Cc: stable@vger.kernel.org
> Cc: Thierry Reding <thierry.reding@gmail.com>
> Cc: Jonathan Hunter <jonathanh@nvidia.com>
> Cc: Dmitry Osipenko <digetx@gmail.com>
> Cc: linux-tegra@vger.kernel.org
> Signed-off-by: Vishal Kumar <vishalmimani008@gmail.com>

Does not match your "From:" line :(