[PATCH v2 0/3] usb: Add support for eUSB2v2 1024-byte Bulk MaxPacketSize

[PATCH v2 0/3] usb: Add support for eUSB2v2 1024-byte Bulk MaxPacketSize

[Pawel Laszczak via B4 Relay]

The Embedded USB2 (eUSB2) v2 specification (bcdUSB 0x0230) introduces a
mechanism that allows High-Speed Bulk endpoints to support a maximum packet
size (MPS) of 1024 bytes, expanding it from the traditional 512-byte limit
defined in the standard USB 2.0 specification. This capability is highly
beneficial for Mass Storage Class (MSC) devices, significantly improving
overall throughput.

Per the eUSB2v2 specification, a peripheral device will revert its internal
Bulk MPS back to 512 bytes after major bus events, including a bus reset,
disconnect, or deconfiguration. To establish and maintain the 1024-byte mode,
the host controller must explicitly issue a device-recipient SET_FEATURE
request called USB_DEVICE_BULK_MAX_PACKET_UPDATE. This must occur after the
device enters the ADDRESSED state, but strictly *before* it transitions to the
CONFIGURED state.

This patch series implements the required infrastructure on both the host and
gadget sides, and enables it for the Cadence (cdnsp) controller.

Structure of the series:
- Patch 1: Introduces host-side core support in usb_set_configuration() to
  detect eUSB2v2 devices and issue the SET_FEATURE update request prior to
  activating the device configuration. Adds eusb2v2_mps_active flag to
  struct usb_device to track negotiation state. Extends hub.c to re-issue
  SET_FEATURE after bus reset in usb_reset_and_verify_device(); on failure
  triggers re-enumeration to prevent driver from operating with inconsistent
  MPS state. Also updates xHCI endpoint initialization to allow 1024-byte
  packets for High-Speed Bulk endpoints when HCC2_E2V2C is present.

- Patch 2: Extends the USB Gadget Composite framework to advertise bcdUSB
  0x0230 when eUSB2v2 is supported, intercept the incoming feature request,
  and dynamically update the wMaxPacketSize fields across all High-Speed
  Bulk descriptors before configuration is completed.
  
- Patch 3: Implements peripheral-specific handling in the Cadence (cdnsp)
  driver, reading HCCPARAMS2 to discover the hardware capability and adapting
  cdnsp_endpoint_init() boundaries to allow for the larger packet size.

Testing:
The flow has been validated using the Cadence eUSB2v2 Host and Device
controllers, ensuring seamless transition to 1024-byte mode during early
enumeration stages and successful verification under USB-IF Compliance
Verification (CV) tooling.

Signed-off-by: Pawel Laszczak <pawell@cadence.com>
---
Changes in v2:
- Removed config.c change: per eUSB2v2 spec section 5.2, conformant devices
  always report wMaxPacketSize=512 in their descriptor regardless of operating
  mode, so the warning suppression was unnecessary.
- eusb_update_max_packet(): changed from void to int; added error propagation
  and eusb2v2_mps_active state tracking.
- Added hub.c handling to restore 1KB mode after bus reset, with re-enumeration
  on failure (addresses Oliver Neukum's review comments).
- xhci-mem.c: simplified HS bulk clamp logic.
- xhci.c: moved is_eusb2v2 assignment into xhci_hcd_init_usb2_data().
- composite.c: stall CLEAR_FEATURE(BULK_MAX_PACKET_UPDATE) as it is not
  defined by the eUSB2v2 spec.
- cdnsp-mem.c: simplified HS bulk clamp logic, consistent with xhci-mem.c.
- Link to v1: https://patch.msgid.link/20260717-eusb2v2-packet-size-v1-0-67c611bd0c5b@cadence.com

---
Pawel Laszczak (3):
      usb: xhci: Add support for eUSB2v2 1024-byte bulk packet size
      usb: gadget: composite: Support eUSB2v2 bulk MPS update request
      usb: cdns3: cdnsp: Enable eUSB2v2 1KB bulk packet capability

 drivers/usb/cdns3/cdnsp-ep0.c    |  2 ++
 drivers/usb/cdns3/cdnsp-gadget.c |  4 +++
 drivers/usb/cdns3/cdnsp-gadget.h |  8 +++++
 drivers/usb/cdns3/cdnsp-mem.c    | 10 ++++--
 drivers/usb/common/debug.c       |  2 ++
 drivers/usb/core/hub.c           | 16 +++++++++
 drivers/usb/core/message.c       | 74 +++++++++++++++++++++++++++++++++++++++-
 drivers/usb/core/usb.h           |  2 ++
 drivers/usb/gadget/composite.c   | 68 ++++++++++++++++++++++++++++++++----
 drivers/usb/host/xhci-mem.c      | 18 ++++++++--
 drivers/usb/host/xhci.c          |  4 +++
 include/linux/usb.h              |  7 ++++
 include/linux/usb/gadget.h       |  2 ++
 13 files changed, 205 insertions(+), 12 deletions(-)
---
base-commit: 1d52b92ce8748624f84eca7eaea3ac31ed7b09a5
change-id: 20260609-eusb2v2-packet-size-4cb668455465

Best regards,
--  
Pawel Laszczak <pawell@cadence.com>

[PATCH v2 1/3] usb: xhci: Add support for eUSB2v2 1024-byte bulk packet size

[Pawel Laszczak via B4 Relay]

From: Pawel Laszczak <pawell@cadence.com>

The eUSB2 v2 specification (bcdUSB 0x0230) introduces support for
1024-byte maximum packet sizes for Bulk endpoints in High-Speed mode.
However, an eUSB2v2 peripheral will revert its internal maximum packet
size back to 512 bytes after events like a bus reset, disconnect, or
deconfiguration.

To support 1024-byte bulk transfers on capable hosts, add a new
is_eusb2v2 flag to the usb_bus structure, populated via the HCCPARAMS2
E2V2C capability bit in the xHCI driver.

When an eUSB2v2 host configures an eUSB2v2 device, issue a specific
SET_FEATURE (USB_DEVICE_BULK_MAX_PACKET_UPDATE) request during device
configuration to switch the peripheral to 1024-byte packet mode, and
allow the xHCI endpoint initialization to accept up to 1024 bytes for
HS bulk endpoints.

Signed-off-by: Pawel Laszczak <pawell@cadence.com>
---
Changes in v2:
- Removed change in config.c: per eUSB2v2 spec section 5.2, conformant
  devices always report wMaxPacketSize=512 in their descriptor regardless
  of operating mode, so the warning suppression was unnecessary.
- xhci-mem.c: simplified HS bulk clamp
- xhci.c: moved is_eusb2v2 assignment into xhci_hcd_init_usb2_data()
- eusb_update_max_packet(): changed from void to int; returns error on
  SET_FEATURE failure.
- Added eusb2v2_mps_active flag to struct usb_device to track whether
  SET_FEATURE(BULK_MAX_PACKET_UPDATE) succeeded.
- Added hub.c: usb_reset_and_verify_device() now re-issues SET_FEATURE
  after bus reset to restore 1KB mode. Failure triggers re-enumeration
  to prevent a driver from operating with inconsistent MPS state.
---
 drivers/usb/core/hub.c      | 16 ++++++++++
 drivers/usb/core/message.c  | 74 ++++++++++++++++++++++++++++++++++++++++++++-
 drivers/usb/core/usb.h      |  2 ++
 drivers/usb/host/xhci-mem.c | 18 +++++++++--
 drivers/usb/host/xhci.c     |  4 +++
 include/linux/usb.h         |  7 +++++
 6 files changed, 117 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 24960ba9caa9..34cfc44c5df8 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -6252,6 +6252,22 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
 		mutex_unlock(hcd->bandwidth_mutex);
 		goto re_enumerate;
 	}
+
+	/*
+	 * Restore eUSB2v2 1KB bulk mode after reset (device reverts to 512
+	 * after any bus reset per eUSB2v2 spec section 5.2).
+	 * Only retry if the initial SET_FEATURE had succeeded.
+	 */
+	if (udev->eusb2v2_mps_active) {
+		ret = eusb_update_max_packet(udev, udev->actconfig);
+		if (ret < 0) {
+			dev_err(&udev->dev,
+				"eUSB2v2: failed to restore 1KB mode after reset (%d)\n", ret);
+			mutex_unlock(hcd->bandwidth_mutex);
+			goto re_enumerate;
+		}
+	}
+
 	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 			USB_REQ_SET_CONFIGURATION, 0,
 			udev->actconfig->desc.bConfigurationValue, 0,
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd744a9..18bedc7f91a3 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2007,6 +2007,67 @@ int usb_set_wireless_status(struct usb_interface *iface,
 }
 EXPORT_SYMBOL_GPL(usb_set_wireless_status);
 
+/*
+ * eusb_update_max_packet - set or restore max packet size
+ * @udev: target device
+ * @cp: if NULL restore MPS to 512 else set 1024
+ *
+ * This request is specific to eUSB2v2.
+ * An eUSB2v2 peripheral will revert the maximum packet size to 512
+ * for bulk endpoints after bus reset, disconnect and deconfiguration.
+ * This function allows updating the max packet size for BULK endpoints
+ * to 1024 after above events.
+ */
+int eusb_update_max_packet(struct usb_device *udev, struct usb_host_config *cp)
+{
+	struct usb_host_config *config = cp ? cp : udev->actconfig;
+	struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+	struct usb_interface_cache *intfc;
+	struct usb_host_interface *alt;
+	struct usb_host_endpoint *ep;
+	u16 mps = 512;
+	int i, j, a;
+	int ret;
+
+	if (le16_to_cpu(udev->descriptor.bcdUSB) != 0x0230 ||
+	    !hcd->self.is_eusb2v2)
+		return 0;
+
+	if (cp) {
+		ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+				      USB_REQ_SET_FEATURE, USB_RECIP_DEVICE,
+				      USB_DEVICE_BULK_MAX_PACKET_UPDATE, 0, NULL, 0,
+				      USB_CTRL_SET_TIMEOUT);
+		if (ret < 0) {
+			dev_warn(&udev->dev, "eUSB2v2 1KB update failed: %d\n", ret);
+			return ret;
+		}
+
+		mps = 1024;
+	} else if (!udev->actconfig)
+		return 0;
+
+	for (i = 0; i < config->desc.bNumInterfaces; i++) {
+		intfc = config->intf_cache[i];
+
+		if (!intfc)
+			continue;
+
+		for (a = 0; a < intfc->num_altsetting; a++) {
+			alt = &intfc->altsetting[a];
+
+			for (j = 0; j < alt->desc.bNumEndpoints; j++) {
+				ep = &alt->endpoint[j];
+
+				if (usb_endpoint_xfer_bulk(&ep->desc))
+					ep->desc.wMaxPacketSize = cpu_to_le16(mps);
+			}
+		}
+	}
+
+	return 0;
+}
+
 /*
  * usb_set_configuration - Makes a particular device setting be current
  * @dev: the device whose configuration is being updated
@@ -2120,8 +2181,19 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 	/* if it's already configured, clear out old state first.
 	 * getting rid of old interfaces means unbinding their drivers.
 	 */
-	if (dev->state != USB_STATE_ADDRESS)
+	if (dev->state != USB_STATE_ADDRESS) {
+		eusb_update_max_packet(dev, NULL);
 		usb_disable_device(dev, 1);	/* Skip ep0 */
+	}
+
+	ret = eusb_update_max_packet(dev, cp);
+	if (ret < 0)
+		dev->eusb2v2_mps_active = 0;
+	else if (le16_to_cpu(dev->descriptor.bcdUSB) == 0x0230 &&
+		 hcd->self.is_eusb2v2)
+		dev->eusb2v2_mps_active = 1;
+	else
+		dev->eusb2v2_mps_active = 0;
 
 	/* Get rid of pending async Set-Config requests for this device */
 	cancel_async_set_config(dev);
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index a9b37aeb515b..c36fe2a2acea 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -89,6 +89,8 @@ extern int usb_major_init(void);
 extern void usb_major_cleanup(void);
 extern int usb_device_supports_lpm(struct usb_device *udev);
 extern int usb_port_disable(struct usb_device *udev);
+extern int eusb_update_max_packet(struct usb_device *udev,
+				  struct usb_host_config *cp);
 
 #ifdef	CONFIG_PM
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 997fe90f54e5..8ccbfaf57612 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1479,10 +1479,22 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
 	/* Allow 3 retries for everything but isoc, set CErr = 3 */
 	if (!usb_endpoint_xfer_isoc(&ep->desc))
 		err_count = 3;
-	/* HS bulk max packet should be 512, FS bulk supports 8, 16, 32 or 64 */
+
+	/*
+	 * HS bulk max packet should be 512 (or 1024 for eUSB2v2),
+	 * FS bulk supports 8, 16, 32 or 64.
+	 */
 	if (usb_endpoint_xfer_bulk(&ep->desc)) {
-		if (udev->speed == USB_SPEED_HIGH)
-			max_packet = 512;
+		if (udev->speed == USB_SPEED_HIGH) {
+			if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0230 &&
+			    xhci->hcc_params2 & HCC2_E2V2C) {
+				if (max_packet != 1024)
+					max_packet = 512;
+			} else {
+				max_packet = 512;
+			}
+		}
+
 		if (udev->speed == USB_SPEED_FULL) {
 			max_packet = rounddown_pow_of_two(max_packet);
 			max_packet = clamp_val(max_packet, 8, 64);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index a54f5b57f205..ba3cdc5c732d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -5371,6 +5371,10 @@ static void xhci_hcd_init_usb2_data(struct xhci_hcd *xhci, struct usb_hcd *hcd)
 	xhci->usb2_rhub.hcd = hcd;
 	hcd->speed = HCD_USB2;
 	hcd->self.root_hub->speed = USB_SPEED_HIGH;
+
+	if (xhci->hcc_params2 & HCC2_E2V2C)
+		hcd->self.is_eusb2v2 = 1;
+
 	/*
 	 * USB 2.0 roothub under xHCI has an integrated TT,
 	 * (rate matching hub) as opposed to having an OHCI/UHCI
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 25a203ac7a7e..57fb4c552740 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -464,6 +464,10 @@ struct usb_bus {
 					 * the ep queue on a short transfer
 					 * with the URB_SHORT_NOT_OK flag set.
 					 */
+	unsigned is_eusb2v2:1;		/*
+					 * true when HC controller supports
+					 * eusb2v2
+					 */
 	unsigned no_sg_constraint:1;	/* no sg constraint */
 	unsigned sg_tablesize;		/* 0 or largest number of sg list entries */
 
@@ -625,6 +629,8 @@ struct usb3_lpm_parameters {
  * @usb2_hw_lpm_allowed: Userspace allows USB 2.0 LPM to be enabled
  * @usb3_lpm_u1_enabled: USB3 hardware U1 LPM enabled
  * @usb3_lpm_u2_enabled: USB3 hardware U2 LPM enabled
+ * @eusb2v2_mps_active: 1024-byte bulk mode is active and must be restored
+ *	 after bus reset.
  * @string_langid: language ID for strings
  * @product: iProduct string, if present (static)
  * @manufacturer: iManufacturer string, if present (static)
@@ -708,6 +714,7 @@ struct usb_device {
 	unsigned usb2_hw_lpm_allowed:1;
 	unsigned usb3_lpm_u1_enabled:1;
 	unsigned usb3_lpm_u2_enabled:1;
+	unsigned eusb2v2_mps_active:1;
 	int string_langid;
 
 	/* static strings from the device */

-- 
2.43.0

[PATCH v2 2/3] usb: gadget: composite: Support eUSB2v2 bulk MPS update request

[Pawel Laszczak via B4 Relay]

From: Pawel Laszczak <pawell@cadence.com>

Add support for eUSB2v2 1024-byte Bulk MPS negotiation to the Gadget
Composite framework.

If 'gadget->is_eusb2v2' is set, force bcdUSB to 0x0230 and bMaxPacketSize0
to 64 bytes. Handle the USB_DEVICE_BULK_MAX_PACKET_UPDATE feature request
by introducing eusb2_update_mps_bulk(), which dynamically updates the
wMaxPacketSize of all HS Bulk endpoint descriptors to 1024 bytes before
the device is configured.

Signed-off-by: Pawel Laszczak <pawell@cadence.com>
---
Changes in v2:
- composite.c: CLEAR_FEATURE(BULK_MAX_PACKET_UPDATE) is not defined in the
  eUSB2v2 spec; stall it instead of incorrectly setting 1024-byte mode.
- restore MPS in __composite_disconnect
---
 drivers/usb/gadget/composite.c | 68 ++++++++++++++++++++++++++++++++++++++----
 include/linux/usb/gadget.h     |  2 ++
 2 files changed, 64 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index dc3664374596..f0246e25f2b5 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -924,6 +924,48 @@ static void device_qual(struct usb_composite_dev *cdev)
 }
 
 /*-------------------------------------------------------------------------*/
+static void eusb2_update_ep_mps(struct usb_descriptor_header *header, __le16 mps)
+{
+	struct usb_endpoint_descriptor *epd;
+
+	if (header->bDescriptorType != USB_DT_ENDPOINT)
+		return;
+
+	epd = (void *)header;
+	if (usb_endpoint_xfer_bulk(epd))
+		epd->wMaxPacketSize = mps;
+}
+
+static int eusb2_update_mps_bulk(struct usb_composite_dev *cdev, bool set)
+{
+	__le16 mps = cpu_to_le16(set ? 1024 : 512);
+	struct usb_gadget *gadget = cdev->gadget;
+	struct usb_configuration *config;
+	struct usb_function *f;
+
+	if (!gadget->is_eusb2v2)
+		return -EINVAL;
+
+	if (set && gadget->state >= USB_STATE_CONFIGURED)
+		return -EINVAL;
+
+	list_for_each_entry(config, &cdev->configs, list) {
+		if (!config->highspeed)
+			continue;
+
+		list_for_each_entry(f, &config->functions, list) {
+			struct usb_descriptor_header **desc = f->hs_descriptors;
+
+			if (!desc)
+				continue;
+
+			for (; *desc; desc++)
+				eusb2_update_ep_mps(*desc, mps);
+		}
+	}
+
+	return 0;
+}
 
 static void reset_config(struct usb_composite_dev *cdev)
 {
@@ -971,8 +1013,10 @@ static int set_config(struct usb_composite_dev *cdev,
 		if (result < 0)
 			goto done;
 	} else { /* Zero configuration value - need to reset the config */
-		if (cdev->config)
+		if (cdev->config) {
 			reset_config(cdev);
+			eusb2_update_mps_bulk(cdev, false);
+		}
 		result = 0;
 	}
 
@@ -1807,7 +1851,11 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 				count_configs(cdev, USB_DT_DEVICE);
 			cdev->desc.bMaxPacketSize0 =
 				cdev->gadget->ep0->maxpacket;
-			if (gadget_is_superspeed(gadget)) {
+
+			if (gadget->is_eusb2v2) {
+				cdev->desc.bcdUSB = cpu_to_le16(0x0230);
+				cdev->desc.bMaxPacketSize0 = 64;
+			} else if (gadget_is_superspeed(gadget)) {
 				if (gadget->speed >= USB_SPEED_SUPER) {
 					cdev->desc.bcdUSB = cpu_to_le16(0x0320);
 					cdev->desc.bMaxPacketSize0 = 9;
@@ -2005,12 +2053,19 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 	 */
 	case USB_REQ_CLEAR_FEATURE:
 	case USB_REQ_SET_FEATURE:
-		if (!gadget_is_superspeed(gadget))
-			goto unknown;
-		if (ctrl->bRequestType != (USB_DIR_OUT | USB_RECIP_INTERFACE))
-			goto unknown;
 		switch (w_value) {
+		case USB_DEVICE_BULK_MAX_PACKET_UPDATE:
+			if (ctrl->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
+				goto unknown;
+			if (ctrl->bRequest != USB_REQ_SET_FEATURE)
+				goto unknown;
+			value = eusb2_update_mps_bulk(cdev, true);
+			break;
 		case USB_INTRF_FUNC_SUSPEND:
+			if (!gadget_is_superspeed(gadget))
+				goto unknown;
+			if (ctrl->bRequestType != (USB_DIR_OUT | USB_RECIP_INTERFACE))
+				goto unknown;
 			if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
 				break;
 			f = cdev->config->interface[intf];
@@ -2293,6 +2348,7 @@ static void __composite_disconnect(struct usb_gadget *gadget)
 	 * disconnect callbacks?
 	 */
 	spin_lock_irqsave(&cdev->lock, flags);
+	eusb2_update_mps_bulk(cdev, false);
 	cdev->suspended = 0;
 	if (cdev->config)
 		reset_config(cdev);
diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
index 8285b19a25e0..3c554fe95f87 100644
--- a/include/linux/usb/gadget.h
+++ b/include/linux/usb/gadget.h
@@ -420,6 +420,7 @@ struct usb_gadget_ops {
  * @wakeup_armed: True if gadget is armed by the host for remote wakeup.
  * @irq: the interrupt number for device controller.
  * @id_number: a unique ID number for ensuring that gadget names are distinct
+ * @is_eusb2v2: True if controller is Embedded usb2.
  *
  * Gadgets have a mostly-portable "gadget driver" implementing device
  * functions, handling all usb configurations and interfaces.  Gadget
@@ -483,6 +484,7 @@ struct usb_gadget {
 	unsigned			lpm_capable:1;
 	unsigned			wakeup_capable:1;
 	unsigned			wakeup_armed:1;
+	unsigned			is_eusb2v2:1;
 	int				irq;
 	int				id_number;
 };

-- 
2.43.0

[PATCH v2 3/3] usb: cdns3: cdnsp: Enable eUSB2v2 1KB bulk packet capability

[Pawel Laszczak via B4 Relay]

From: Pawel Laszczak <pawell@cadence.com>

Implement peripheral-side changes in the Cadence (cdnsp) driver
to support eUSB2v2 1024-byte Bulk MaxPacketSize.

Check the HCC2_E2V2C bit in HCCPARAMS2 during setup and set
'pdev->gadget.is_eusb2v2 = 1' if supported. Update cdnsp_endpoint_init()
to allow internal max_packet size allocation up to 1024 bytes for HS
Bulk endpoints, and delegate the incoming update setup request from
ep0 to the composite layer.

Signed-off-by: Pawel Laszczak <pawell@cadence.com>
---
Changes in v2:
- cdnsp-mem.c: simplified HS bulk clamp logic to: if (max_packet != 1024)
  max_packet = 512, consistent with xhci-mem.c.
---
 drivers/usb/cdns3/cdnsp-ep0.c    |  2 ++
 drivers/usb/cdns3/cdnsp-gadget.c |  4 ++++
 drivers/usb/cdns3/cdnsp-gadget.h |  8 ++++++++
 drivers/usb/cdns3/cdnsp-mem.c    | 10 ++++++++--
 drivers/usb/common/debug.c       |  2 ++
 5 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/cdns3/cdnsp-ep0.c b/drivers/usb/cdns3/cdnsp-ep0.c
index 5cd9b898ce97..090d20b307ee 100644
--- a/drivers/usb/cdns3/cdnsp-ep0.c
+++ b/drivers/usb/cdns3/cdnsp-ep0.c
@@ -253,6 +253,8 @@ static int cdnsp_ep0_handle_feature_device(struct cdnsp_device *pdev,
 		 */
 		cdnsp_enter_test_mode(pdev);
 		break;
+	case USB_DEVICE_BULK_MAX_PACKET_UPDATE:
+		return cdnsp_ep0_delegate_req(pdev, ctrl);
 	default:
 		return -EINVAL;
 	}
diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
index a5275c2fb43b..ac1dde43ce1d 100644
--- a/drivers/usb/cdns3/cdnsp-gadget.c
+++ b/drivers/usb/cdns3/cdnsp-gadget.c
@@ -1853,6 +1853,10 @@ static int cdnsp_gen_setup(struct cdnsp_device *pdev)
 	pdev->hcc_params = readl(&pdev->cap_regs->hc_capbase);
 	pdev->hci_version = HC_VERSION(pdev->hcc_params);
 	pdev->hcc_params = readl(&pdev->cap_regs->hcc_params);
+	pdev->hcc_params2 = readl(&pdev->cap_regs->hcc_params2);
+
+	if (pdev->hcc_params2 & HCC2_E2V2C)
+		pdev->gadget.is_eusb2v2 = 1;
 
 	/*
 	 * Override the APB timeout value to give the controller more time for
diff --git a/drivers/usb/cdns3/cdnsp-gadget.h b/drivers/usb/cdns3/cdnsp-gadget.h
index c44bca348a41..75bc3f15bde5 100644
--- a/drivers/usb/cdns3/cdnsp-gadget.h
+++ b/drivers/usb/cdns3/cdnsp-gadget.h
@@ -89,6 +89,12 @@ struct cdnsp_cap_regs {
 
 #define CTX_SIZE(_hcc)		(HCC_64BYTE_CONTEXT(_hcc) ? 64 : 32)
 
+/* HCCPARAMS2 - hcc_params2 - bitmasks */
+/* bit 11 - DC support Double BW on a eUSB2 HS ISOC EP */
+#define HCC2_EUSB2_DIC		BIT(11)
+/* bit 12 - DC support eUSB2V2 capability */
+#define HCC2_E2V2C		BIT(12)
+
 /* db_off bitmask - bits 0:1 reserved. */
 #define DBOFF_MASK	GENMASK(31, 2)
 
@@ -1370,6 +1376,7 @@ struct cdnsp_port {
  * @rev_cap: Controller Capabilities Registers.
  * @hcs_params1: Cached register copies of read-only HCSPARAMS1
  * @hcc_params: Cached register copies of read-only HCCPARAMS1
+ * @hcc_params2: Cached register copies of read-only HCCPARAMS2
  * @rtl_revision: Cached controller rtl revision.
  * @setup: Temporary buffer for setup packet.
  * @ep0_preq: Internal allocated request used during enumeration.
@@ -1425,6 +1432,7 @@ struct cdnsp_device {
 	__u32 hcs_params1;
 	__u32 hcs_params3;
 	__u32 hcc_params;
+	__u32 hcc_params2;
 	#define RTL_REVISION_NEW_LPM 0x2700
 	__u32 rtl_revision;
 	/* Lock used in interrupt thread context. */
diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.c
index 5d8cdc91927d..e9f205cb1dac 100644
--- a/drivers/usb/cdns3/cdnsp-mem.c
+++ b/drivers/usb/cdns3/cdnsp-mem.c
@@ -978,8 +978,14 @@ int cdnsp_endpoint_init(struct cdnsp_device *pdev,
 	if (!usb_endpoint_xfer_isoc(pep->endpoint.desc))
 		err_count = 3;
 	if (usb_endpoint_xfer_bulk(pep->endpoint.desc) &&
-	    pdev->gadget.speed == USB_SPEED_HIGH)
-		max_packet = 512;
+	    pdev->gadget.speed == USB_SPEED_HIGH) {
+		if (!pdev->gadget.is_eusb2v2)
+			max_packet = 512;
+		else
+			if (max_packet != 1024)
+				max_packet = 512;
+	}
+
 	/* Controller spec indicates that ctrl ep avg TRB Length should be 8. */
 	if (usb_endpoint_xfer_control(pep->endpoint.desc))
 		avg_trb_len = 8;
diff --git a/drivers/usb/common/debug.c b/drivers/usb/common/debug.c
index f204cec8d380..b9696fae7ef5 100644
--- a/drivers/usb/common/debug.c
+++ b/drivers/usb/common/debug.c
@@ -46,6 +46,8 @@ static const char *usb_decode_device_feature(u16 wValue)
 		return "U2 Enable";
 	case USB_DEVICE_LTM_ENABLE:
 		return "LTM Enable";
+	case USB_DEVICE_BULK_MAX_PACKET_UPDATE:
+		return "Bulk mps update";
 	default:
 		return "UNKNOWN";
 	}

-- 
2.43.0

Re: [PATCH v2 2/3] usb: gadget: composite: Support eUSB2v2 bulk MPS update request

[Selvarasu Ganesan]

On 8/26/2026 4:54 PM, Pawel Laszczak via B4 Relay wrote:
> From: Pawel Laszczak <pawell@cadence.com>
>
> Add support for eUSB2v2 1024-byte Bulk MPS negotiation to the Gadget
> Composite framework.
>
> If 'gadget->is_eusb2v2' is set, force bcdUSB to 0x0230 and bMaxPacketSize0
> to 64 bytes. Handle the USB_DEVICE_BULK_MAX_PACKET_UPDATE feature request
> by introducing eusb2_update_mps_bulk(), which dynamically updates the
> wMaxPacketSize of all HS Bulk endpoint descriptors to 1024 bytes before
> the device is configured.
>
> Signed-off-by: Pawel Laszczak <pawell@cadence.com>
> ---
> Changes in v2:
> - composite.c: CLEAR_FEATURE(BULK_MAX_PACKET_UPDATE) is not defined in the
>    eUSB2v2 spec; stall it instead of incorrectly setting 1024-byte mode.
> - restore MPS in __composite_disconnect
> ---
>   drivers/usb/gadget/composite.c | 68 ++++++++++++++++++++++++++++++++++++++----
>   include/linux/usb/gadget.h     |  2 ++
>   2 files changed, 64 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
> index dc3664374596..f0246e25f2b5 100644
> --- a/drivers/usb/gadget/composite.c
> +++ b/drivers/usb/gadget/composite.c
> @@ -924,6 +924,48 @@ static void device_qual(struct usb_composite_dev *cdev)
>   }
>   
>   /*-------------------------------------------------------------------------*/
> +static void eusb2_update_ep_mps(struct usb_descriptor_header *header, __le16 mps)
> +{
> +	struct usb_endpoint_descriptor *epd;
> +
> +	if (header->bDescriptorType != USB_DT_ENDPOINT)
> +		return;
> +
> +	epd = (void *)header;
> +	if (usb_endpoint_xfer_bulk(epd))
> +		epd->wMaxPacketSize = mps;
> +}
> +
> +static int eusb2_update_mps_bulk(struct usb_composite_dev *cdev, bool set)
> +{
> +	__le16 mps = cpu_to_le16(set ? 1024 : 512);
> +	struct usb_gadget *gadget = cdev->gadget;
> +	struct usb_configuration *config;
> +	struct usb_function *f;
> +
> +	if (!gadget->is_eusb2v2)
> +		return -EINVAL;
> +
> +	if (set && gadget->state >= USB_STATE_CONFIGURED)
> +		return -EINVAL;
> +
> +	list_for_each_entry(config, &cdev->configs, list) {
> +		if (!config->highspeed)
> +			continue;
> +
> +		list_for_each_entry(f, &config->functions, list) {
> +			struct usb_descriptor_header **desc = f->hs_descriptors;
> +
> +			if (!desc)
> +				continue;
> +
> +			for (; *desc; desc++)
> +				eusb2_update_ep_mps(*desc, mps);
> +		}
> +	}
> +
> +	return 0;
> +}
>   
>   static void reset_config(struct usb_composite_dev *cdev)
>   {
> @@ -971,8 +1013,10 @@ static int set_config(struct usb_composite_dev *cdev,
>   		if (result < 0)
>   			goto done;
>   	} else { /* Zero configuration value - need to reset the config */
> -		if (cdev->config)
> +		if (cdev->config) {
>   			reset_config(cdev);
> +			eusb2_update_mps_bulk(cdev, false);
> +		}
>   		result = 0;
>   	}
>   
> @@ -1807,7 +1851,11 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
>   				count_configs(cdev, USB_DT_DEVICE);
>   			cdev->desc.bMaxPacketSize0 =
>   				cdev->gadget->ep0->maxpacket;
> -			if (gadget_is_superspeed(gadget)) {
> +
> +			if (gadget->is_eusb2v2) {
> +				cdev->desc.bcdUSB = cpu_to_le16(0x0230);
> +				cdev->desc.bMaxPacketSize0 = 64;
> +			} else if (gadget_is_superspeed(gadget)) {
>   				if (gadget->speed >= USB_SPEED_SUPER) {
>   					cdev->desc.bcdUSB = cpu_to_le16(0x0320);
>   					cdev->desc.bMaxPacketSize0 = 9;
> @@ -2005,12 +2053,19 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
>   	 */
>   	case USB_REQ_CLEAR_FEATURE:
>   	case USB_REQ_SET_FEATURE:
> -		if (!gadget_is_superspeed(gadget))
> -			goto unknown;
> -		if (ctrl->bRequestType != (USB_DIR_OUT | USB_RECIP_INTERFACE))
> -			goto unknown;
>   		switch (w_value) {
> +		case USB_DEVICE_BULK_MAX_PACKET_UPDATE:
> +			if (ctrl->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
> +				goto unknown;
> +			if (ctrl->bRequest != USB_REQ_SET_FEATURE)
> +				goto unknown;
> +			value = eusb2_update_mps_bulk(cdev, true);
Here both USB_REQ_CLEAR_FEATURE and USB_REQ_SET_FEATURE fall through to 
the same switch, and USB_DEVICE_BULK_MAX_PACKET_UPDATE unconditionally 
calls eusb2_update_mps_bulk(cdev, true) regardless of which request type 
was received.

The CLEAR_FEATURE may request should revert the MPS back to the default 
by calling eusb2_update_mps_bulk(cdev, false), but instead it performs 
the same action as SET_FEATURE.

Is this required distinguished using ctrl->bRequest to check whether 
this is a SET or CLEAR operation?


Thanks,
Selva
> +			break;
>   		case USB_INTRF_FUNC_SUSPEND:
> +			if (!gadget_is_superspeed(gadget))
> +				goto unknown;
> +			if (ctrl->bRequestType != (USB_DIR_OUT | USB_RECIP_INTERFACE))
> +				goto unknown;
>   			if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
>   				break;
>   			f = cdev->config->interface[intf];
> @@ -2293,6 +2348,7 @@ static void __composite_disconnect(struct usb_gadget *gadget)
>   	 * disconnect callbacks?
>   	 */
>   	spin_lock_irqsave(&cdev->lock, flags);
> +	eusb2_update_mps_bulk(cdev, false);
>   	cdev->suspended = 0;
>   	if (cdev->config)
>   		reset_config(cdev);
> diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
> index 8285b19a25e0..3c554fe95f87 100644
> --- a/include/linux/usb/gadget.h
> +++ b/include/linux/usb/gadget.h
> @@ -420,6 +420,7 @@ struct usb_gadget_ops {
>    * @wakeup_armed: True if gadget is armed by the host for remote wakeup.
>    * @irq: the interrupt number for device controller.
>    * @id_number: a unique ID number for ensuring that gadget names are distinct
> + * @is_eusb2v2: True if controller is Embedded usb2.
>    *
>    * Gadgets have a mostly-portable "gadget driver" implementing device
>    * functions, handling all usb configurations and interfaces.  Gadget
> @@ -483,6 +484,7 @@ struct usb_gadget {
>   	unsigned			lpm_capable:1;
>   	unsigned			wakeup_capable:1;
>   	unsigned			wakeup_armed:1;
> +	unsigned			is_eusb2v2:1;
>   	int				irq;
>   	int				id_number;
>   };
>

RE: [PATCH v2 2/3] usb: gadget: composite: Support eUSB2v2 bulk MPS update request

[Pawel Laszczak]

>
>On 8/26/2026 4:54 PM, Pawel Laszczak via B4 Relay wrote:
>> From: Pawel Laszczak <pawell@cadence.com>
>>
>> Add support for eUSB2v2 1024-byte Bulk MPS negotiation to the Gadget
>> Composite framework.
>>
>> If 'gadget->is_eusb2v2' is set, force bcdUSB to 0x0230 and bMaxPacketSize0
>> to 64 bytes. Handle the USB_DEVICE_BULK_MAX_PACKET_UPDATE feature
>request
>> by introducing eusb2_update_mps_bulk(), which dynamically updates the
>> wMaxPacketSize of all HS Bulk endpoint descriptors to 1024 bytes before
>> the device is configured.
>>
>> Signed-off-by: Pawel Laszczak <pawell@cadence.com>
>> ---
>> Changes in v2:
>> - composite.c: CLEAR_FEATURE(BULK_MAX_PACKET_UPDATE) is not defined in
>the
>>    eUSB2v2 spec; stall it instead of incorrectly setting 1024-byte mode.
>> - restore MPS in __composite_disconnect
>> ---
>>   drivers/usb/gadget/composite.c | 68
>++++++++++++++++++++++++++++++++++++++----
>>   include/linux/usb/gadget.h     |  2 ++
>>   2 files changed, 64 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
>> index dc3664374596..f0246e25f2b5 100644
>> --- a/drivers/usb/gadget/composite.c
>> +++ b/drivers/usb/gadget/composite.c
>> @@ -924,6 +924,48 @@ static void device_qual(struct usb_composite_dev
>*cdev)
>>   }
>>
>>   /*-------------------------------------------------------------------------*/
>> +static void eusb2_update_ep_mps(struct usb_descriptor_header *header,
>__le16 mps)
>> +{
>> +	struct usb_endpoint_descriptor *epd;
>> +
>> +	if (header->bDescriptorType != USB_DT_ENDPOINT)
>> +		return;
>> +
>> +	epd = (void *)header;
>> +	if (usb_endpoint_xfer_bulk(epd))
>> +		epd->wMaxPacketSize = mps;
>> +}
>> +
>> +static int eusb2_update_mps_bulk(struct usb_composite_dev *cdev, bool
>set)
>> +{
>> +	__le16 mps = cpu_to_le16(set ? 1024 : 512);
>> +	struct usb_gadget *gadget = cdev->gadget;
>> +	struct usb_configuration *config;
>> +	struct usb_function *f;
>> +
>> +	if (!gadget->is_eusb2v2)
>> +		return -EINVAL;
>> +
>> +	if (set && gadget->state >= USB_STATE_CONFIGURED)
>> +		return -EINVAL;
>> +
>> +	list_for_each_entry(config, &cdev->configs, list) {
>> +		if (!config->highspeed)
>> +			continue;
>> +
>> +		list_for_each_entry(f, &config->functions, list) {
>> +			struct usb_descriptor_header **desc = f-
>>hs_descriptors;
>> +
>> +			if (!desc)
>> +				continue;
>> +
>> +			for (; *desc; desc++)
>> +				eusb2_update_ep_mps(*desc, mps);
>> +		}
>> +	}
>> +
>> +	return 0;
>> +}
>>
>>   static void reset_config(struct usb_composite_dev *cdev)
>>   {
>> @@ -971,8 +1013,10 @@ static int set_config(struct usb_composite_dev
>*cdev,
>>   		if (result < 0)
>>   			goto done;
>>   	} else { /* Zero configuration value - need to reset the config */
>> -		if (cdev->config)
>> +		if (cdev->config) {
>>   			reset_config(cdev);
>> +			eusb2_update_mps_bulk(cdev, false);
>> +		}
>>   		result = 0;
>>   	}
>>
>> @@ -1807,7 +1851,11 @@ composite_setup(struct usb_gadget *gadget,
>const struct usb_ctrlrequest *ctrl)
>>   				count_configs(cdev, USB_DT_DEVICE);
>>   			cdev->desc.bMaxPacketSize0 =
>>   				cdev->gadget->ep0->maxpacket;
>> -			if (gadget_is_superspeed(gadget)) {
>> +
>> +			if (gadget->is_eusb2v2) {
>> +				cdev->desc.bcdUSB = cpu_to_le16(0x0230);
>> +				cdev->desc.bMaxPacketSize0 = 64;
>> +			} else if (gadget_is_superspeed(gadget)) {
>>   				if (gadget->speed >= USB_SPEED_SUPER) {
>>   					cdev->desc.bcdUSB =
>cpu_to_le16(0x0320);
>>   					cdev->desc.bMaxPacketSize0 = 9;
>> @@ -2005,12 +2053,19 @@ composite_setup(struct usb_gadget *gadget,
>const struct usb_ctrlrequest *ctrl)
>>   	 */
>>   	case USB_REQ_CLEAR_FEATURE:
>>   	case USB_REQ_SET_FEATURE:
>> -		if (!gadget_is_superspeed(gadget))
>> -			goto unknown;
>> -		if (ctrl->bRequestType != (USB_DIR_OUT |
>USB_RECIP_INTERFACE))
>> -			goto unknown;
>>   		switch (w_value) {
>> +		case USB_DEVICE_BULK_MAX_PACKET_UPDATE:
>> +			if (ctrl->bRequestType != (USB_DIR_OUT |
>USB_RECIP_DEVICE))
>> +				goto unknown;
>> +			if (ctrl->bRequest != USB_REQ_SET_FEATURE)
>> +				goto unknown;
>> +			value = eusb2_update_mps_bulk(cdev, true);
>Here both USB_REQ_CLEAR_FEATURE and USB_REQ_SET_FEATURE fall through
>to
>the same switch, and USB_DEVICE_BULK_MAX_PACKET_UPDATE unconditionally
>calls eusb2_update_mps_bulk(cdev, true) regardless of which request type
>was received.
>
>The CLEAR_FEATURE may request should revert the MPS back to the default
>by calling eusb2_update_mps_bulk(cdev, false), but instead it performs
>the same action as SET_FEATURE.
>
>Is this required distinguished using ctrl->bRequest to check whether
>this is a SET or CLEAR operation?

Hi Selva,

Thank you for the review.

The eUSB2v2 specification does not define CLEAR_FEATURE for the
BULK_MAX_PACKET_UPDATE feature selector, so the device is expected to
respond with a STALL in that case.

The check on line:

if (ctrl->bRequest != USB_REQ_SET_FEATURE)
        goto unknown;

already handles this: when CLEAR_FEATURE falls through to the
USB_DEVICE_BULK_MAX_PACKET_UPDATE case, it hits this condition and
jumps to 'unknown', which results in a STALL being returned to the
host. So eusb2_update_mps_bulk(cdev, true) is never called for
CLEAR_FEATURE.

MPS restoration to 512 bytes is handled separately on disconnect and
deconfiguration events (__composite_disconnect and set_config).

Thanks,
Pawel
>
>
>Thanks,
>Selva
>> +			break;
>>   		case USB_INTRF_FUNC_SUSPEND:
>> +			if (!gadget_is_superspeed(gadget))
>> +				goto unknown;
>> +			if (ctrl->bRequestType != (USB_DIR_OUT |
>USB_RECIP_INTERFACE))
>> +				goto unknown;
>>   			if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
>>   				break;
>>   			f = cdev->config->interface[intf];
>> @@ -2293,6 +2348,7 @@ static void __composite_disconnect(struct
>usb_gadget *gadget)
>>   	 * disconnect callbacks?
>>   	 */
>>   	spin_lock_irqsave(&cdev->lock, flags);
>> +	eusb2_update_mps_bulk(cdev, false);
>>   	cdev->suspended = 0;
>>   	if (cdev->config)
>>   		reset_config(cdev);
>> diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
>> index 8285b19a25e0..3c554fe95f87 100644
>> --- a/include/linux/usb/gadget.h
>> +++ b/include/linux/usb/gadget.h
>> @@ -420,6 +420,7 @@ struct usb_gadget_ops {
>>    * @wakeup_armed: True if gadget is armed by the host for remote wakeup.
>>    * @irq: the interrupt number for device controller.
>>    * @id_number: a unique ID number for ensuring that gadget names are
>distinct
>> + * @is_eusb2v2: True if controller is Embedded usb2.
>>    *
>>    * Gadgets have a mostly-portable "gadget driver" implementing device
>>    * functions, handling all usb configurations and interfaces.  Gadget
>> @@ -483,6 +484,7 @@ struct usb_gadget {
>>   	unsigned			lpm_capable:1;
>>   	unsigned			wakeup_capable:1;
>>   	unsigned			wakeup_armed:1;
>> +	unsigned			is_eusb2v2:1;
>>   	int				irq;
>>   	int				id_number;
>>   };
>>

Re: [PATCH v2 2/3] usb: gadget: composite: Support eUSB2v2 bulk MPS update request

[Selvarasu Ganesan]

On 9/22/2026 1:46 PM, Pawel Laszczak wrote:
>> On 8/26/2026 4:54 PM, Pawel Laszczak via B4 Relay wrote:
>>> From: Pawel Laszczak <pawell@cadence.com>
>>>
>>> Add support for eUSB2v2 1024-byte Bulk MPS negotiation to the Gadget
>>> Composite framework.
>>>
>>> If 'gadget->is_eusb2v2' is set, force bcdUSB to 0x0230 and bMaxPacketSize0
>>> to 64 bytes. Handle the USB_DEVICE_BULK_MAX_PACKET_UPDATE feature
>> request
>>> by introducing eusb2_update_mps_bulk(), which dynamically updates the
>>> wMaxPacketSize of all HS Bulk endpoint descriptors to 1024 bytes before
>>> the device is configured.
>>>
>>> Signed-off-by: Pawel Laszczak <pawell@cadence.com>
>>> ---
>>> Changes in v2:
>>> - composite.c: CLEAR_FEATURE(BULK_MAX_PACKET_UPDATE) is not defined in
>> the
>>>     eUSB2v2 spec; stall it instead of incorrectly setting 1024-byte mode.
>>> - restore MPS in __composite_disconnect
>>> ---
>>>    drivers/usb/gadget/composite.c | 68
>> ++++++++++++++++++++++++++++++++++++++----
>>>    include/linux/usb/gadget.h     |  2 ++
>>>    2 files changed, 64 insertions(+), 6 deletions(-)
>>>
>>> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
>>> index dc3664374596..f0246e25f2b5 100644
>>> --- a/drivers/usb/gadget/composite.c
>>> +++ b/drivers/usb/gadget/composite.c
>>> @@ -924,6 +924,48 @@ static void device_qual(struct usb_composite_dev
>> *cdev)
>>>    }
>>>
>>>    /*-------------------------------------------------------------------------*/
>>> +static void eusb2_update_ep_mps(struct usb_descriptor_header *header,
>> __le16 mps)
>>> +{
>>> +	struct usb_endpoint_descriptor *epd;
>>> +
>>> +	if (header->bDescriptorType != USB_DT_ENDPOINT)
>>> +		return;
>>> +
>>> +	epd = (void *)header;
>>> +	if (usb_endpoint_xfer_bulk(epd))
>>> +		epd->wMaxPacketSize = mps;
>>> +}
>>> +
>>> +static int eusb2_update_mps_bulk(struct usb_composite_dev *cdev, bool
>> set)
>>> +{
>>> +	__le16 mps = cpu_to_le16(set ? 1024 : 512);
>>> +	struct usb_gadget *gadget = cdev->gadget;
>>> +	struct usb_configuration *config;
>>> +	struct usb_function *f;
>>> +
>>> +	if (!gadget->is_eusb2v2)
>>> +		return -EINVAL;
>>> +
>>> +	if (set && gadget->state >= USB_STATE_CONFIGURED)
>>> +		return -EINVAL;
>>> +
>>> +	list_for_each_entry(config, &cdev->configs, list) {
>>> +		if (!config->highspeed)
>>> +			continue;
>>> +
>>> +		list_for_each_entry(f, &config->functions, list) {
>>> +			struct usb_descriptor_header **desc = f-
>>> hs_descriptors;
>>> +
>>> +			if (!desc)
>>> +				continue;
>>> +
>>> +			for (; *desc; desc++)
>>> +				eusb2_update_ep_mps(*desc, mps);
>>> +		}
>>> +	}
>>> +
>>> +	return 0;
>>> +}
>>>
>>>    static void reset_config(struct usb_composite_dev *cdev)
>>>    {
>>> @@ -971,8 +1013,10 @@ static int set_config(struct usb_composite_dev
>> *cdev,
>>>    		if (result < 0)
>>>    			goto done;
>>>    	} else { /* Zero configuration value - need to reset the config */
>>> -		if (cdev->config)
>>> +		if (cdev->config) {
>>>    			reset_config(cdev);
>>> +			eusb2_update_mps_bulk(cdev, false);
>>> +		}
>>>    		result = 0;
>>>    	}
>>>
>>> @@ -1807,7 +1851,11 @@ composite_setup(struct usb_gadget *gadget,
>> const struct usb_ctrlrequest *ctrl)
>>>    				count_configs(cdev, USB_DT_DEVICE);
>>>    			cdev->desc.bMaxPacketSize0 =
>>>    				cdev->gadget->ep0->maxpacket;
>>> -			if (gadget_is_superspeed(gadget)) {
>>> +
>>> +			if (gadget->is_eusb2v2) {
>>> +				cdev->desc.bcdUSB = cpu_to_le16(0x0230);
>>> +				cdev->desc.bMaxPacketSize0 = 64;
>>> +			} else if (gadget_is_superspeed(gadget)) {
>>>    				if (gadget->speed >= USB_SPEED_SUPER) {
>>>    					cdev->desc.bcdUSB =
>> cpu_to_le16(0x0320);
>>>    					cdev->desc.bMaxPacketSize0 = 9;
>>> @@ -2005,12 +2053,19 @@ composite_setup(struct usb_gadget *gadget,
>> const struct usb_ctrlrequest *ctrl)
>>>    	 */
>>>    	case USB_REQ_CLEAR_FEATURE:
>>>    	case USB_REQ_SET_FEATURE:
>>> -		if (!gadget_is_superspeed(gadget))
>>> -			goto unknown;
>>> -		if (ctrl->bRequestType != (USB_DIR_OUT |
>> USB_RECIP_INTERFACE))
>>> -			goto unknown;
>>>    		switch (w_value) {
>>> +		case USB_DEVICE_BULK_MAX_PACKET_UPDATE:
>>> +			if (ctrl->bRequestType != (USB_DIR_OUT |
>> USB_RECIP_DEVICE))
>>> +				goto unknown;
>>> +			if (ctrl->bRequest != USB_REQ_SET_FEATURE)
>>> +				goto unknown;
>>> +			value = eusb2_update_mps_bulk(cdev, true);
>> Here both USB_REQ_CLEAR_FEATURE and USB_REQ_SET_FEATURE fall through
>> to
>> the same switch, and USB_DEVICE_BULK_MAX_PACKET_UPDATE unconditionally
>> calls eusb2_update_mps_bulk(cdev, true) regardless of which request type
>> was received.
>>
>> The CLEAR_FEATURE may request should revert the MPS back to the default
>> by calling eusb2_update_mps_bulk(cdev, false), but instead it performs
>> the same action as SET_FEATURE.
>>
>> Is this required distinguished using ctrl->bRequest to check whether
>> this is a SET or CLEAR operation?
> Hi Selva,
>
> Thank you for the review.
>
> The eUSB2v2 specification does not define CLEAR_FEATURE for the
> BULK_MAX_PACKET_UPDATE feature selector, so the device is expected to
> respond with a STALL in that case.
>
> The check on line:
>
> if (ctrl->bRequest != USB_REQ_SET_FEATURE)
>          goto unknown;
>
> already handles this: when CLEAR_FEATURE falls through to the
> USB_DEVICE_BULK_MAX_PACKET_UPDATE case, it hits this condition and
> jumps to 'unknown', which results in a STALL being returned to the
> host. So eusb2_update_mps_bulk(cdev, true) is never called for
> CLEAR_FEATURE.


Hi Pawel,

Thanks for the explanation. Its looks good to me.

It would be nice to have a brief mention of the CLEAR_FEATURE behavior 
and MPS restoration in the commit message just for future reference, but 
I'll leave it up to you if you think it's necessary.

Thanks,
Selva
>
> MPS restoration to 512 bytes is handled separately on disconnect and
> deconfiguration events (__composite_disconnect and set_config).
>
> Thanks,
> Pawel
>>
>> Thanks,
>> Selva
>>> +			break;
>>>    		case USB_INTRF_FUNC_SUSPEND:
>>> +			if (!gadget_is_superspeed(gadget))
>>> +				goto unknown;
>>> +			if (ctrl->bRequestType != (USB_DIR_OUT |
>> USB_RECIP_INTERFACE))
>>> +				goto unknown;
>>>    			if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
>>>    				break;
>>>    			f = cdev->config->interface[intf];
>>> @@ -2293,6 +2348,7 @@ static void __composite_disconnect(struct
>> usb_gadget *gadget)
>>>    	 * disconnect callbacks?
>>>    	 */
>>>    	spin_lock_irqsave(&cdev->lock, flags);
>>> +	eusb2_update_mps_bulk(cdev, false);
>>>    	cdev->suspended = 0;
>>>    	if (cdev->config)
>>>    		reset_config(cdev);
>>> diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
>>> index 8285b19a25e0..3c554fe95f87 100644
>>> --- a/include/linux/usb/gadget.h
>>> +++ b/include/linux/usb/gadget.h
>>> @@ -420,6 +420,7 @@ struct usb_gadget_ops {
>>>     * @wakeup_armed: True if gadget is armed by the host for remote wakeup.
>>>     * @irq: the interrupt number for device controller.
>>>     * @id_number: a unique ID number for ensuring that gadget names are
>> distinct
>>> + * @is_eusb2v2: True if controller is Embedded usb2.
>>>     *
>>>     * Gadgets have a mostly-portable "gadget driver" implementing device
>>>     * functions, handling all usb configurations and interfaces.  Gadget
>>> @@ -483,6 +484,7 @@ struct usb_gadget {
>>>    	unsigned			lpm_capable:1;
>>>    	unsigned			wakeup_capable:1;
>>>    	unsigned			wakeup_armed:1;
>>> +	unsigned			is_eusb2v2:1;
>>>    	int				irq;
>>>    	int				id_number;
>>>    };
>>>

Re: [PATCH v2 1/3] usb: xhci: Add support for eUSB2v2 1024-byte bulk packet size

[Mathias Nyman]

Hi

Thanks for working on the eUSB2v2 bulk support.

On 8/26/26 14:24, Pawel Laszczak via B4 Relay wrote:
> From: Pawel Laszczak <pawell@cadence.com>
> 
> The eUSB2 v2 specification (bcdUSB 0x0230) introduces support for
> 1024-byte maximum packet sizes for Bulk endpoints in High-Speed mode.
> However, an eUSB2v2 peripheral will revert its internal maximum packet
> size back to 512 bytes after events like a bus reset, disconnect, or
> deconfiguration.
> 
> To support 1024-byte bulk transfers on capable hosts, add a new
> is_eusb2v2 flag to the usb_bus structure, populated via the HCCPARAMS2
> E2V2C capability bit in the xHCI driver.
> 
> When an eUSB2v2 host configures an eUSB2v2 device, issue a specific
> SET_FEATURE (USB_DEVICE_BULK_MAX_PACKET_UPDATE) request during device
> configuration to switch the peripheral to 1024-byte packet mode, and
> allow the xHCI endpoint initialization to accept up to 1024 bytes for
> HS bulk endpoints.
> 
> Signed-off-by: Pawel Laszczak <pawell@cadence.com>
> ---
> Changes in v2:
> - Removed change in config.c: per eUSB2v2 spec section 5.2, conformant
>    devices always report wMaxPacketSize=512 in their descriptor regardless
>    of operating mode, so the warning suppression was unnecessary.
> - xhci-mem.c: simplified HS bulk clamp
> - xhci.c: moved is_eusb2v2 assignment into xhci_hcd_init_usb2_data()
> - eusb_update_max_packet(): changed from void to int; returns error on
>    SET_FEATURE failure.
> - Added eusb2v2_mps_active flag to struct usb_device to track whether
>    SET_FEATURE(BULK_MAX_PACKET_UPDATE) succeeded.
> - Added hub.c: usb_reset_and_verify_device() now re-issues SET_FEATURE
>    after bus reset to restore 1KB mode. Failure triggers re-enumeration
>    to prevent a driver from operating with inconsistent MPS state.
> ---
>   drivers/usb/core/hub.c      | 16 ++++++++++
>   drivers/usb/core/message.c  | 74 ++++++++++++++++++++++++++++++++++++++++++++-
>   drivers/usb/core/usb.h      |  2 ++
>   drivers/usb/host/xhci-mem.c | 18 +++++++++--
>   drivers/usb/host/xhci.c     |  4 +++
>   include/linux/usb.h         |  7 +++++
>   6 files changed, 117 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
> index 24960ba9caa9..34cfc44c5df8 100644
> --- a/drivers/usb/core/hub.c
> +++ b/drivers/usb/core/hub.c
> @@ -6252,6 +6252,22 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
>   		mutex_unlock(hcd->bandwidth_mutex);
>   		goto re_enumerate;
>   	}
> +
> +	/*
> +	 * Restore eUSB2v2 1KB bulk mode after reset (device reverts to 512
> +	 * after any bus reset per eUSB2v2 spec section 5.2).
> +	 * Only retry if the initial SET_FEATURE had succeeded.
> +	 */
> +	if (udev->eusb2v2_mps_active) {
> +		ret = eusb_update_max_packet(udev, udev->actconfig);
> +		if (ret < 0) {
> +			dev_err(&udev->dev,
> +				"eUSB2v2: failed to restore 1KB mode after reset (%d)\n", ret);
> +			mutex_unlock(hcd->bandwidth_mutex);
> +			goto re_enumerate;
> +		}
> +	}
> +
>   	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
>   			USB_REQ_SET_CONFIGURATION, 0,
>   			udev->actconfig->desc.bConfigurationValue, 0,
> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
> index 75e2bfd744a9..18bedc7f91a3 100644
> --- a/drivers/usb/core/message.c
> +++ b/drivers/usb/core/message.c
> @@ -2007,6 +2007,67 @@ int usb_set_wireless_status(struct usb_interface *iface,
>   }
>   EXPORT_SYMBOL_GPL(usb_set_wireless_status);
>   
> +/*
> + * eusb_update_max_packet - set or restore max packet size
> + * @udev: target device
> + * @cp: if NULL restore MPS to 512 else set 1024
> + *
> + * This request is specific to eUSB2v2.
> + * An eUSB2v2 peripheral will revert the maximum packet size to 512
> + * for bulk endpoints after bus reset, disconnect and deconfiguration.
> + * This function allows updating the max packet size for BULK endpoints
> + * to 1024 after above events.
> + */
> +int eusb_update_max_packet(struct usb_device *udev, struct usb_host_config *cp)
> +{
> +	struct usb_host_config *config = cp ? cp : udev->actconfig;
> +	struct usb_hcd *hcd = bus_to_hcd(udev->bus);
> +	struct usb_interface_cache *intfc;
> +	struct usb_host_interface *alt;
> +	struct usb_host_endpoint *ep;
> +	u16 mps = 512;
> +	int i, j, a;
> +	int ret;
> +
> +	if (le16_to_cpu(udev->descriptor.bcdUSB) != 0x0230 ||
> +	    !hcd->self.is_eusb2v2)
> +		return 0;
> +
> +	if (cp) {
> +		ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
> +				      USB_REQ_SET_FEATURE, USB_RECIP_DEVICE,
> +				      USB_DEVICE_BULK_MAX_PACKET_UPDATE, 0, NULL, 0,
> +				      USB_CTRL_SET_TIMEOUT);
> +		if (ret < 0) {
> +			dev_warn(&udev->dev, "eUSB2v2 1KB update failed: %d\n", ret);
> +			return ret;
> +		}
> +
> +		mps = 1024;
> +	} else if (!udev->actconfig)
> +		return 0;
> +
> +	for (i = 0; i < config->desc.bNumInterfaces; i++) {
> +		intfc = config->intf_cache[i];
> +
> +		if (!intfc)
> +			continue;
> +
> +		for (a = 0; a < intfc->num_altsetting; a++) {
> +			alt = &intfc->altsetting[a];
> +
> +			for (j = 0; j < alt->desc.bNumEndpoints; j++) {
> +				ep = &alt->endpoint[j];
> +
> +				if (usb_endpoint_xfer_bulk(&ep->desc))
> +					ep->desc.wMaxPacketSize = cpu_to_le16(mps);


I think we should avoid altering the stored, valid endpoint descriptor
wMaxPacketSize that was read from the device.
Both HS usb2 and eUSB2v2 specs state that MPS value in bulk endpoint descriptor
is 512.

Better to convey the usage of 1024 MPS to host and class driver some other way.

Userspace drivers or tools that get the MaxPacketSize directly from a device with
a get descriptor request will still see MaxPacketSize as 512 (like lsusb -v), while
host controllers and class drivers that use altered cached values from struct usb_device
see 1024.

Any comparison between old and new endpoint descriptor will also fail.


> +			}
> +		}
> +	}
> +
> +	return 0;
> +}
> +
>   /*
>    * usb_set_configuration - Makes a particular device setting be current
>    * @dev: the device whose configuration is being updated
> @@ -2120,8 +2181,19 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
>   	/* if it's already configured, clear out old state first.
>   	 * getting rid of old interfaces means unbinding their drivers.
>   	 */
> -	if (dev->state != USB_STATE_ADDRESS)
> +	if (dev->state != USB_STATE_ADDRESS) {
> +		eusb_update_max_packet(dev, NULL);
>   		usb_disable_device(dev, 1);	/* Skip ep0 */
> +	}
> +
> +	ret = eusb_update_max_packet(dev, cp);

Only eUSB2v2 devices with bulk endpoints support the new BULK_MAX_PACKET_UPDATE
request. Avoid sending it to eUSB2v2 cameras that only use isoc transfers

> +	if (ret < 0)
> +		dev->eusb2v2_mps_active = 0;
> +	else if (le16_to_cpu(dev->descriptor.bcdUSB) == 0x0230 &&
> +		 hcd->self.is_eusb2v2)
> +		dev->eusb2v2_mps_active = 1;
> +	else
> +		dev->eusb2v2_mps_active = 0;
>   
>   	/* Get rid of pending async Set-Config requests for this device */
>   	cancel_async_set_config(dev);
> diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
> index a9b37aeb515b..c36fe2a2acea 100644
> --- a/drivers/usb/core/usb.h
> +++ b/drivers/usb/core/usb.h
> @@ -89,6 +89,8 @@ extern int usb_major_init(void);
>   extern void usb_major_cleanup(void);
>   extern int usb_device_supports_lpm(struct usb_device *udev);
>   extern int usb_port_disable(struct usb_device *udev);
> +extern int eusb_update_max_packet(struct usb_device *udev,
> +				  struct usb_host_config *cp);
>   
>   #ifdef	CONFIG_PM
>   
> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index 997fe90f54e5..8ccbfaf57612 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -1479,10 +1479,22 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
>   	/* Allow 3 retries for everything but isoc, set CErr = 3 */
>   	if (!usb_endpoint_xfer_isoc(&ep->desc))
>   		err_count = 3;
> -	/* HS bulk max packet should be 512, FS bulk supports 8, 16, 32 or 64 */
> +
> +	/*
> +	 * HS bulk max packet should be 512 (or 1024 for eUSB2v2),
> +	 * FS bulk supports 8, 16, 32 or 64.
> +	 */
>   	if (usb_endpoint_xfer_bulk(&ep->desc)) {
> -		if (udev->speed == USB_SPEED_HIGH)
> -			max_packet = 512;
> +		if (udev->speed == USB_SPEED_HIGH) {
> +			if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0230 &&
> +			    xhci->hcc_params2 & HCC2_E2V2C) {
> +				if (max_packet != 1024)
> +					max_packet = 512;


I would let xhci_usb_endpoint_maxp() return 1024 if this is a HS eUSB2v2 bulk endpoint
with udev->eusb2v2_mps_active set.


> +			} else {
> +				max_packet = 512;
> +			}
> +		}
> +
>   		if (udev->speed == USB_SPEED_FULL) {
>   			max_packet = rounddown_pow_of_two(max_packet);
>   			max_packet = clamp_val(max_packet, 8, 64);
> diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
> index a54f5b57f205..ba3cdc5c732d 100644
> --- a/drivers/usb/host/xhci.c
> +++ b/drivers/usb/host/xhci.c
> @@ -5371,6 +5371,10 @@ static void xhci_hcd_init_usb2_data(struct xhci_hcd *xhci, struct usb_hcd *hcd)
>   	xhci->usb2_rhub.hcd = hcd;
>   	hcd->speed = HCD_USB2;
>   	hcd->self.root_hub->speed = USB_SPEED_HIGH;
> +
> +	if (xhci->hcc_params2 & HCC2_E2V2C)
> +		hcd->self.is_eusb2v2 = 1;
> +
>   	/*
>   	 * USB 2.0 roothub under xHCI has an integrated TT,
>   	 * (rate matching hub) as opposed to having an OHCI/UHCI
> diff --git a/include/linux/usb.h b/include/linux/usb.h
> index 25a203ac7a7e..57fb4c552740 100644
> --- a/include/linux/usb.h
> +++ b/include/linux/usb.h
> @@ -464,6 +464,10 @@ struct usb_bus {
>   					 * the ep queue on a short transfer
>   					 * with the URB_SHORT_NOT_OK flag set.
>   					 */
> +	unsigned is_eusb2v2:1;		/*
> +					 * true when HC controller supports
> +					 * eusb2v2

I wonder if we really need this flag. I understand why it's there, but is it really possible
that an embedded harwdwired eUSB2v2 device would be hardwired to host that doesn't
support it?

Thanks
Mathias