[PATCH v2 0/3] USB: dwc2: Fix handling NAK

[PATCH v2 0/3] USB: dwc2: Fix handling NAK

[Sascha Hauer]

A NAK should return -EAGAIN to let the retry logic work. This showed up
on a Samsung USB-C memory stick which otherwise was recognized, but
couldn't be initialized.

The v2 now adddresses Anis' log spamming problems. The solution here is
to just silence the error message by turning it into dev_dbg. The
message says "Timeout on bulk endpoint" which is normal and expected
behaviour. The usbnet driver expects bulk messages to timeout when
no RX data is available.

I do not have a Rpi4 CM to reproduce Anis problems, but I have seen the
same on a Rpi3B. With this series USB memory sticks now work on the
Rpi3B, hopefully on the Rpi4 CM as well.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
Changes in v2:
- Address Anis Chalis log spam problems
- Link to v1: https://lore.barebox.org/20260420-usb-dwc2-usb-c-stick-v1-0-c86f733f24f8@pengutronix.de

---
Sascha Hauer (3):
      usb: dwc2: Do not print error messages when URBs are nacked
      usb: dwc2: handle NAK when CHHLTD does not fire
      usb: dwc2: fix data toggle reset direction on ClearFeature(ENDPOINT_HALT)

 drivers/usb/dwc2/host.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)
---
base-commit: 651343da8af78d134d7ead4d2b36095d7ddc2d8f
change-id: 20260420-usb-dwc2-usb-c-stick-ea31c736477c

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>

[PATCH v2 1/3] usb: dwc2: Do not print error messages when URBs are nacked

[Sascha Hauer]

It's a normal usecase that a USB bulk transfer is nacked, so do not
print an error message in this case. The usbnet driver polls the
availability of RX frames with bulk transfers with short timeouts.
When it's nacked it just means that currently no RX data is available.

Currently wait_for_chhltd() returns -ETIMEDOUT when a transfer is
nacked, so the message is not printed. This however changes with
the next patch, so silence the error message now to avoid log spam
with the next patch.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/usb/dwc2/host.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/host.c b/drivers/usb/dwc2/host.c
index 93994f0be3..eede21c692 100644
--- a/drivers/usb/dwc2/host.c
+++ b/drivers/usb/dwc2/host.c
@@ -435,7 +435,7 @@ static int dwc2_submit_bulk_msg(struct usb_device *udev, unsigned long pipe,
 					 buffer, len);
 	} while (ret == -EAGAIN && !is_timeout(start, timeout * MSECOND));
 	if (ret == -EAGAIN) {
-		dwc2_err(dwc2, "Timeout on bulk endpoint\n");
+		dwc2_dbg(dwc2, "Timeout on bulk endpoint\n");
 		ret = -ETIMEDOUT;
 	}
 

-- 
2.47.3

[PATCH v2 2/3] usb: dwc2: handle NAK when CHHLTD does not fire

[Sascha Hauer]

From: Sascha Hauer <sascha@saschahauer.de>

Some DWC2 configurations do not assert CHHLTD when a NAK is received;
the hardware keeps the channel active and only sets the NAK bit in HCINT.
wait_for_chhltd() polls for CHHLTD with a 10ms timeout; when CHHLTD never
fires the timeout expires and -ETIMEDOUT is returned without inspecting
HCINT. This causes the caller to treat the NAK as a hard error instead of
a retryable condition.

The symptom is that devices which NAK bulk or control transfers during
initialisation (e.g. some Samsung USB-C flash drives that NAK while their
firmware starts up) fail immediately rather than being retried via the
5-second NAK-retry loop in dwc2_submit_bulk_msg() or the do/while loops
in dwc2_submit_control_msg().

Fix by reading HCINT before aborting the channel when the CHHLTD timeout
fires. If the NAK or FRMOVRUN bit is set, abort the channel, wait for the
abort to complete, and return -EAGAIN so that the existing retry logic can
handle the NAK. Log a diagnostic message if the channel abort itself times
out, which would indicate a real hardware problem.

Assisted-by: Claude Sonnet 4.6
Signed-off-by: Sascha Hauer <sascha@saschahauer.de>
---
 drivers/usb/dwc2/host.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/host.c b/drivers/usb/dwc2/host.c
index eede21c692..a779cade59 100644
--- a/drivers/usb/dwc2/host.c
+++ b/drivers/usb/dwc2/host.c
@@ -134,9 +134,14 @@ static int wait_for_chhltd(struct dwc2 *dwc2, u8 hc, uint32_t *sub, u8 *tgl)
 
 	ret = dwc2_wait_bit_set(dwc2, HCINT(hc), HCINTMSK_CHHLTD, 10000);
 	if (ret) {
+		hcint = dwc2_readl(dwc2, HCINT(hc));
 		hcchar = dwc2_readl(dwc2, HCCHAR(hc));
 		dwc2_writel(dwc2, hcchar | HCCHAR_CHDIS, HCCHAR(hc));
-		dwc2_wait_bit_set(dwc2, HCINT(hc), HCINTMSK_CHHLTD, 10000);
+		if (dwc2_wait_bit_set(dwc2, HCINT(hc), HCINTMSK_CHHLTD, 10000))
+			dwc2_err(dwc2, "%s: channel abort timed out: HCINT=%08x HCCHAR=%08x\n",
+				 __func__, hcint, hcchar);
+		if (hcint & (HCINTMSK_NAK | HCINTMSK_FRMOVRUN))
+			return -EAGAIN;
 		return ret;
 	}
 

-- 
2.47.3

[PATCH v2 3/3] usb: dwc2: fix data toggle reset direction on ClearFeature(ENDPOINT_HALT)

[Sascha Hauer]

From: Sascha Hauer <sascha@saschahauer.de>

dwc2_submit_control_msg() resets the data toggle after a successful
ClearFeature(ENDPOINT_HALT) request. It passes usb_pipein(pipe) as the
direction to dwc2_endpoint_reset(), but pipe is always the control-out
pipe used to send the request, so usb_pipein() always returns 0 (OUT).

As a result, clearing an IN endpoint halt resets the OUT toggle instead
of the IN toggle, leaving the IN data toggle in an incorrect state for
subsequent transfers.

Fix by extracting the direction from the endpoint address in setup->index
(wIndex), where bit 7 is the direction flag per USB 2.0 section 9.3.4.

Fixes: 446bcf875395 ("usb: dwc2: host: Fix toggle reset")
Assisted-by: Claude Sonnet 4.6
Signed-off-by: Sascha Hauer <sascha@saschahauer.de>
---
 drivers/usb/dwc2/host.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc2/host.c b/drivers/usb/dwc2/host.c
index a779cade59..5ee0593fe7 100644
--- a/drivers/usb/dwc2/host.c
+++ b/drivers/usb/dwc2/host.c
@@ -401,8 +401,8 @@ static int dwc2_submit_control_msg(struct usb_device *udev,
 		 * ClearFeature(ENDPOINT_HALT) request always results
 		 * in the data toggle being reinitialized to DATA0.
 		 */
-		int ep = le16_to_cpu(setup->index) & 0xf;
-		dwc2_endpoint_reset(dwc2, usb_pipein(pipe), devnum, ep);
+		int ep_addr = le16_to_cpu(setup->index);
+		dwc2_endpoint_reset(dwc2, ep_addr >> 7, devnum, ep_addr & 0xf);
 	}
 
 	udev->act_len = act_len;

-- 
2.47.3