Re: [PATCH 5/5] usb: xhci: Rework and improve the TD matching and skipping logic

[Michal Pecio]

> On Wed, 5 Aug 2026 20:39:12 +0300, Mathias Nyman wrote:
> If the event points to a valid trb ahead of last trb in td, but
> before the enqueue pointer, then we know hardware has passed this td
> and we can give it back.

Actually, we don't, because of a race condition (and driver bug).

A very long TD completes with Short Packet on the first TRB.
We give back the TD and advance ep_ring->dequeue past it (bug).
Some event is generated later in the TD but we don't know yet.
We queue a lot of TRBs and move enqueue into the completed TD.

We handle the event and it appears to be "before" enqueue. But
the HW not only hasn't passed, it hasn't even begun executing
any TD after the initially completed one.

We give them back and later get their events, or IOMMU faults.

Regards,
Michal