If the HWO bit is set for the TRB (or the first TRB if scatter-gather is used) of a request, it implies that core is still processing it. In that case do not reclaim that TRB and do not giveback the request to the function driver, else it will result in a SMMU translation fault when core tries to access the buffer corresponding to this TRB. Signed-off-by: Sriharsha Allenki <sallenki@xxxxxxxxxxxxxx> --- drivers/usb/dwc3/gadget.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index a9aba71..4a2c5fc 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2476,6 +2476,14 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep, { int ret; + /* + * If the HWO is set, it implies the TRB is still being + * processed by the core. Hence do not reclaim it until + * it is processed by the core. + */ + if (req->trb->ctrl & DWC3_TRB_CTRL_HWO) + return 1; + if (req->num_pending_sgs) ret = dwc3_gadget_ep_reclaim_trb_sg(dep, req, event, status); -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project