dwc2: fix EP0 OUT dcache invalidate range; run usbtest on espressif s3/p4 and mimxrt1015

edpt_schedule_packets() advanced xfer->buffer past each armed EP0
chunk, so the OUT-complete handler invalidated the cache at the
ADVANCED pointer: one line past the received data. The CPU then read
stale cached bytes instead of the DMA'd packet, and the misplaced
invalidate discarded a dirty line of whatever variable follows the
buffer - random neighbor corruption on every control-OUT data stage.
Found by usbtest ctrl_out (cases 14/21) on espressif_p4_function_ev
with DMA enabled, the first DWC2 target combining buffer DMA with a
data cache: usbd control state wedged after the first control write
(every later request stalled), and one build layout panicked in the
usbd memcpy with a wild pointer.

Rework the EP0 chunk bookkeeping so xfer->buffer always points at the
un-consumed position: the arm no longer advances it; instead the EP0
re-arm paths advance past each completed (full) chunk, invalidating it
first on the OUT side. The final OUT completion invalidates exactly
the received bytes of its last chunk, taken from DOEPDMA ("incremented
on every AHB transaction", databook 7.1.83 - the same semantics the
SETUP path relies on) before dma_setup_prepare() re-targets it. EP0
chunking state (ep0_pending) is now also dropped on bus reset and on
a new SETUP, so a stale latched completion can no longer re-arm EP0
DMA from dead state. No behavior change for targets without dcache.

While root-causing, the FIFO layout was cross-checked against the
DWC2 databook/programming guide v4.20a: the existing GDFIFOCFG
programming (EPInfoBaseAddr = otg_dfifo_depth - 2*ep_count, one SPRAM
word per endpoint direction for buffer DMA) is conformant and needs
no change; the P4 HS instance's reset GDFIFOCFG (0x03800400) merely
reflects a scatter/gather-sized EP_LOC_CNT of 128 that buffer DMA
does not need.

With the fix in place, enable the usbtest battery on the espressif
fleet: tools/build.py allowlists device/usbtest (a plain IDF component
like board_test/video_capture) and both espressif boards' only-lists
gain device/usbtest. Also re-enable device/usbtest on mimxrt1015_evk:
its skip predated the dcd_ci_hs stale-ACTIVE-overlay fix (already on
this branch), which cured the battery that previously killed the
uPD720201 host controller twice (2026-07-11 ROM fw, 2026-07-13 case 27
on fw 2.0.2.6); rig-validated 30/30 three consecutive runs.

Validated on rig (all 30/30): espressif_p4_function_ev(-DMA) (was
22/30 under DMA), espressif_s3_devkitm(-DMA), stm32f723disco(-DMA),
mimxrt1015_evk; p4/s3 slave-mode unaffected (DMA-only code path);
compile-checked stm32h743nucleo +TUD DMA, stm32f407disco,
stm32l476disco (device ports currently on the dead hub).

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_017TQZrFfU3K4Y198aLsUpBC

3 files changed, 30 insertions, 11 deletions

diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 6c88b4f27..86aa54510 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -393,10 +393,6 @@ static void edpt_schedule_packets(uint8_t rhport, const uint8_t epnum, const uin
     }
     dep->diepdma = (uintptr_t) xfer->buffer;
     dep->diepctl = depctl.value; // enable endpoint
-    // Advance buffer pointer for EP0
-    if (epnum == 0) {
-      xfer->buffer += total_bytes;
-    }
   } else
   #endif
   {
@@ -732,6 +728,8 @@ static void handle_bus_reset(uint8_t rhport) {
 
   tu_memclr(xfer_status, sizeof(xfer_status));
 
+  _dcd_data.ep0_pending[TUSB_DIR_OUT] = 0;
+  _dcd_data.ep0_pending[TUSB_DIR_IN] = 0;
   _dcd_data.sof_en = false;
   _dcd_data.allocated_epin_count = 0;
 
@@ -1009,6 +1007,10 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
     if (edpt_is_enabled(epin0)) {
       edpt_disable(rhport, 0x80, false);
     }
+    // a new SETUP aborts any in-progress control transfer: drop leftover EP0 chunking state so a
+    // stale latched completion cannot re-arm from it
+    _dcd_data.ep0_pending[TUSB_DIR_OUT] = 0;
+    _dcd_data.ep0_pending[TUSB_DIR_IN] = 0;
 
     dcd_dcache_invalidate(_dcd_usbbuf.setup_buffer, sizeof(_dcd_usbbuf.setup_buffer));
 
@@ -1029,24 +1031,37 @@ static void handle_epout_dma(uint8_t rhport, uint8_t epnum, dwc2_doepint_t doepi
     // only handle data skip if it is setup or status related
     // Normal OUT transfer complete
     if (!doepint_bm.status_phase_rx && !doepint_bm.setup_packet_rx) {
+      xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
       if ((epnum == 0) && _dcd_data.ep0_pending[TUSB_DIR_OUT]) {
-        // EP0 can only handle one packet Schedule another packet to be received.
+        // EP0 can only handle one packet: invalidate and advance past the received bytes, then
+        // schedule the next.
+        if (xfer->buffer != NULL) {
+          dcd_dcache_invalidate(xfer->buffer, CFG_TUD_ENDPOINT0_SIZE);
+          xfer->buffer += CFG_TUD_ENDPOINT0_SIZE;
+        }
         edpt_schedule_packets(rhport, epnum, TUSB_DIR_OUT);
       } else {
         dwc2_dep_t* epout = &dwc2->epout[epnum];
-        xfer_ctl_t* xfer = XFER_CTL_BASE(epnum, TUSB_DIR_OUT);
 
         // determine actual received bytes
         const dwc2_ep_tsize_t tsiz = {.value = epout->tsiz};
         const uint16_t remain = tsiz.xfer_size;
         xfer->total_len -= remain;
 
+        // EP0 invalidates only this (final) chunk's DMA-written bytes: DOEPDMA "is incremented on
+        // every AHB transaction" (databook 7.1.83), i.e. it points past the last word written.
+        // Read it before dma_setup_prepare() re-targets it at the setup buffer
+        uint16_t inval_len = xfer->total_len;
+        if (epnum == 0) {
+          inval_len = (uint16_t)(epout->doepdma - (uintptr_t)xfer->buffer);
+        }
+
         // prepare EP0 for next setup
         if(epnum == 0) {
           dma_setup_prepare(rhport);
         }
 
-        dcd_dcache_invalidate(xfer->buffer, xfer->total_len);
+        dcd_dcache_invalidate(xfer->buffer, inval_len);
         dcd_event_xfer_complete(rhport, epnum, xfer->total_len, XFER_RESULT_SUCCESS, true);
       }
     }
@@ -1058,7 +1073,10 @@ static void handle_epin_dma(uint8_t rhport, uint8_t epnum, dwc2_diepint_t diepin
 
   if (diepint_bm.xfer_complete) {
     if ((epnum == 0) && _dcd_data.ep0_pending[TUSB_DIR_IN]) {
-      // EP0 can only handle one packet. Schedule another packet to be transmitted.
+      // EP0 can only handle one packet: advance past the sent bytes, then schedule the next.
+      if (xfer->buffer != NULL) {
+        xfer->buffer += CFG_TUD_ENDPOINT0_SIZE;
+      }
       edpt_schedule_packets(rhport, epnum, TUSB_DIR_IN);
     } else {
       dcd_event_xfer_complete(rhport, epnum | TUSB_DIR_IN_MASK, xfer->total_len, XFER_RESULT_SUCCESS, true);
diff --git a/test/hil/tinyusb.json b/test/hil/tinyusb.json
index 8f121b6f8..8ed33c8a2 100644
--- a/test/hil/tinyusb.json
+++ b/test/hil/tinyusb.json
@@ -22,11 +22,12 @@
                 { "name": "espressif_p4_function_ev-DMA", "flags": "-DCFG_TUD_DWC2_DMA_ENABLE=1 -DCFG_TUH_DWC2_DMA_ENABLE=1" }
             ],
             "tests": {
-                "comment": "only IDF/FreeRTOS examples are part of the espressif fleet build; device/usbtest builds under IDF but is not built/flashed by the fleet, so it is not listed",
+                "comment": "espressif fleet build = IDF/FreeRTOS examples plus the IDF-buildable bare-metal-style ones tools/build.py allowlists (board_test, usbtest, video_capture)",
                 "only": [
                     "device/cdc_msc_freertos",
                     "device/hid_composite_freertos",
                     "device/audio_test_freertos",
+                    "device/usbtest",
                     "host/device_info",
                     "host/msc_file_explorer_freertos"
                 ],
@@ -66,6 +67,7 @@
                     "device/cdc_msc_freertos",
                     "device/hid_composite_freertos",
                     "device/audio_test_freertos",
+                    "device/usbtest",
                     "host/device_info",
                     "host/msc_file_explorer_freertos"
                 ],
@@ -153,8 +155,6 @@
             "name": "mimxrt1015_evk",
             "uid": "DC28F865D2111D228D00B0543A70463C",
             "tests": {
-                "skip": ["device/usbtest"],
-                "comment": "this board's HS battery killed the uPD720201 twice (2026-07-11 on ROM fw, 2026-07-13 case 27 on fw 2.0.2.6 - stop-endpoint timeout, HC died); mimxrt1064/ch32v307 batteries pass, so it is board-specific - keep skipped",
                 "device": true,
                 "host": false,
                 "dual": false
diff --git a/tools/build.py b/tools/build.py
index 5eaaeb513..51d3d0f70 100755
--- a/tools/build.py
+++ b/tools/build.py
@@ -92,6 +92,7 @@ def get_examples(family):
 
     if family == 'espressif':
         all_examples.append('device/board_test')
+        all_examples.append('device/usbtest')
         all_examples.append('device/video_capture')
         all_examples.append('host/device_info')
     all_examples.sort()