[PATCH v1 1/2] dt-bindings: usb: dwc3: Document Renesas R-Car Gen5 DWC3 xHCI USB controller

[PATCH v1 1/2] dt-bindings: usb: dwc3: Document Renesas R-Car Gen5 DWC3 xHCI USB controller

[Marek Vasut]

The Renesas R-Car Gen5 SoC contains multiple instances of DWC3 USB
controller with glue logic wrapper around them. Document the glue
logic and DWC3 controller.

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
---
Cc: Conor Dooley <conor+dt@kernel.org>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
Cc: Rob Herring <robh@kernel.org>
Cc: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Cc: devicetree@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-renesas-soc@vger.kernel.org
Cc: linux-usb@vger.kernel.org
---
 .../bindings/usb/renesas,rcar-gen5-usb.yaml   | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/usb/renesas,rcar-gen5-usb.yaml

diff --git a/Documentation/devicetree/bindings/usb/renesas,rcar-gen5-usb.yaml b/Documentation/devicetree/bindings/usb/renesas,rcar-gen5-usb.yaml
new file mode 100644
index 0000000000000..a334648e2dfc4
--- /dev/null
+++ b/Documentation/devicetree/bindings/usb/renesas,rcar-gen5-usb.yaml
@@ -0,0 +1,82 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/usb/renesas,rcar-gen5-usb.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Renesas R-Car Gen5 DWC3 xHCI USB controller
+
+maintainers:
+  - Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+properties:
+  compatible:
+    items:
+      - const: renesas,r8a78000-usb
+      - const: renesas,rcar-gen5-usb
+
+  '#address-cells':
+    const: 2
+
+  '#size-cells':
+    const: 2
+
+  ranges: true
+
+  reg:
+    maxItems: 1
+
+  clocks:
+    maxItems: 1
+
+  power-domains:
+    maxItems: 1
+
+  resets:
+    maxItems: 1
+
+patternProperties:
+  '^usb@':
+    $ref: snps,dwc3.yaml#
+
+required:
+  - compatible
+  - '#address-cells'
+  - '#size-cells'
+  - ranges
+  - reg
+  - clocks
+  - power-domains
+  - resets
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/interrupt-controller/arm-gic.h>
+
+    bus {
+        #address-cells = <2>;
+        #size-cells = <2>;
+
+        usb@c9c54000 {
+            compatible = "renesas,r8a78000-usb", "renesas,rcar-gen5-usb";
+            reg = <0 0xc9c54000 0 0x2000>;
+            clocks = <&scmi_clk 336>;
+            power-domains = <&scmi_devpd 16>;
+            resets = <&scmi_reset 336>;
+
+            #address-cells = <2>;
+            #size-cells = <2>;
+            ranges = <0x0 0xc8800000 0x0 0xc8800000 0x0 0x100000>;
+
+            usb@c8800000 {
+                compatible = "synopsys,dwc3";
+                reg = <0x0 0xc8800000 0x0 0x100000>;
+                interrupts = <GIC_SPI 795 IRQ_TYPE_LEVEL_HIGH>;
+                maximum-speed = "super-speed-plus";
+                phys = <&mp_phy 2>;
+                phy-names = "usb3-phy";
+            };
+        };
+    };
-- 
2.53.0

[PATCH v1 2/2] usb: dwc3: Add Renesas R-Car Gen5 DWC3 xHCI USB controller glue

[Marek Vasut]

From: Thanh Quan <thanh.quan.xn@renesas.com>

The Renesas R-Car Gen5 SoC contains multiple instances of DWC3 USB
controller with glue logic wrapper around them. Add driver for the
glue logic around the DWC3 USB controller core.

Signed-off-by: Thanh Quan <thanh.quan.xn@renesas.com>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
---
Cc: Conor Dooley <conor+dt@kernel.org>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
Cc: Rob Herring <robh@kernel.org>
Cc: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Cc: devicetree@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-renesas-soc@vger.kernel.org
Cc: linux-usb@vger.kernel.org
---
 drivers/usb/dwc3/Kconfig          |  10 ++
 drivers/usb/dwc3/Makefile         |   1 +
 drivers/usb/dwc3/dwc3-rcar-gen5.c | 150 ++++++++++++++++++++++++++++++
 3 files changed, 161 insertions(+)
 create mode 100644 drivers/usb/dwc3/dwc3-rcar-gen5.c

diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
index 18169727a413e..7d8ee192b1241 100644
--- a/drivers/usb/dwc3/Kconfig
+++ b/drivers/usb/dwc3/Kconfig
@@ -234,4 +234,14 @@ config USB_DWC3_GOOGLE
 	  To compile this driver as a module, choose M here: the
 	  module will be called dwc3-google.ko.
 
+config USB_DWC3_RCAR_GEN5
+	tristate "Renesas R-Car Gen5 DWC3 Platform Driver"
+	depends on ARCH_RENESAS || COMPILE_TEST
+	default USB_DWC3
+	help
+	  Support the DesignWare Core USB3 IP found on Renesas R-Car Gen5
+	  SoC. This driver provides the glue layer for the USB controller
+	  on Renesas R-Car Gen5 platform.
+	  Say 'Y' or 'M' if you have such device.
+
 endif
diff --git a/drivers/usb/dwc3/Makefile b/drivers/usb/dwc3/Makefile
index f37971197203e..99bbd147f0b5f 100644
--- a/drivers/usb/dwc3/Makefile
+++ b/drivers/usb/dwc3/Makefile
@@ -61,3 +61,4 @@ obj-$(CONFIG_USB_DWC3_OCTEON)		+= dwc3-octeon.o
 obj-$(CONFIG_USB_DWC3_RTK)		+= dwc3-rtk.o
 obj-$(CONFIG_USB_DWC3_GENERIC_PLAT)	+= dwc3-generic-plat.o
 obj-$(CONFIG_USB_DWC3_GOOGLE)		+= dwc3-google.o
+obj-$(CONFIG_USB_DWC3_RCAR_GEN5)	+= dwc3-rcar-gen5.o
diff --git a/drivers/usb/dwc3/dwc3-rcar-gen5.c b/drivers/usb/dwc3/dwc3-rcar-gen5.c
new file mode 100644
index 0000000000000..344d0851559f5
--- /dev/null
+++ b/drivers/usb/dwc3/dwc3-rcar-gen5.c
@@ -0,0 +1,150 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Renesas USB device driver with DWC3 integration
+ *
+ * Copyright (C) 2025-2026 Renesas Electronics Corporation
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/reset.h>
+
+struct dwc3_rcar_gen5_priv {
+	void __iomem		*base;
+	struct clk		*clk;
+	bool			use_usb3_flow;
+};
+
+static int dwc3_rcar_gen5_init(struct dwc3_rcar_gen5_priv *priv)
+{
+	/*
+	 * The datasheet describes initialization procedure without full
+	 * information about the registers. Therefore, the source code is
+	 * based on the bare metal code shared by the board team.
+	 */
+	writew(0x211, priv->base + 0x26);
+
+	/* USB3 does not need additional register programming. */
+	if (priv->use_usb3_flow)
+		return 0;
+
+	writew(0x11, priv->base + 0x81c);
+	writew(0x0, priv->base + 0x81a);
+	writew(0x1, priv->base + 0x802);
+
+	usleep_range(10000, 20000);
+
+	writew(0x0, priv->base + 0x802);
+	writew(0x1, priv->base + 0x2a);
+	writew(0x1, priv->base + 0x81a);
+
+	usleep_range(10000, 20000);
+
+	return 0;
+}
+
+static int dwc3_rcar_gen5_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *subnode;
+	struct reset_control *reset;
+	const char *maximum_speed;
+	struct dwc3_rcar_gen5_priv *priv;
+	int ret;
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	platform_set_drvdata(pdev, priv);
+
+	priv->base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(priv->base))
+		return dev_err_probe(dev, PTR_ERR(priv->base), "Failed to map registers\n");
+
+	reset = devm_reset_control_get(dev, NULL);
+	if (IS_ERR(reset))
+		return dev_err_probe(dev, PTR_ERR(reset), "Failed to get reset control\n");
+
+	priv->clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(priv->clk))
+		return dev_err_probe(dev, PTR_ERR(priv->clk), "Failed to get clock control\n");
+
+	subnode = of_get_compatible_child(dev->of_node, "synopsys,dwc3");
+	if (!subnode)
+		return dev_err_probe(dev, -ENODEV, "Failed to find DWC3 subnode node\n");
+
+	ret = of_property_read_string(subnode, "maximum-speed", &maximum_speed);
+	of_node_put(subnode);
+	if (ret)
+		return dev_err_probe(dev, -ENODEV, "Failed to determine maximum speed\n");
+
+	priv->use_usb3_flow = !strcmp(maximum_speed, "super-speed-plus") ||
+			      !strcmp(maximum_speed, "super-speed");
+
+	ret = devm_pm_runtime_enable(dev);
+	if (ret)
+		return dev_err_probe(dev, ret, "Failed to enable runtime PM\n");
+
+	ret = pm_runtime_resume_and_get(dev);
+	if (ret)
+		return dev_err_probe(dev, ret, "Failed to resume runtime PM\n");
+
+	return devm_of_platform_populate(dev);
+}
+
+static int __maybe_unused dwc3_rcar_gen5_suspend(struct device *dev)
+{
+	struct dwc3_rcar_gen5_priv *priv = dev_get_drvdata(dev);
+
+	clk_disable_unprepare(priv->clk);
+
+	return 0;
+}
+
+static int __maybe_unused dwc3_rcar_gen5_resume(struct device *dev)
+{
+	struct dwc3_rcar_gen5_priv *priv = dev_get_drvdata(dev);
+	int ret;
+
+	ret = clk_prepare_enable(priv->clk);
+	if (ret) {
+		dev_err(dev, "Failed to enable clock on resume: %d\n", ret);
+		return ret;
+	}
+
+	usleep_range(10000, 20000);
+
+	return dwc3_rcar_gen5_init(priv);
+}
+
+static DEFINE_RUNTIME_DEV_PM_OPS(dwc3_rcar_gen5_pm_ops,
+				 dwc3_rcar_gen5_suspend,
+				 dwc3_rcar_gen5_resume, NULL);
+
+static const struct of_device_id dwc3_rcar_gen5_of_match[] = {
+	{ .compatible = "renesas,rcar-gen5-usb" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, dwc3_rcar_gen5_of_match);
+
+static struct platform_driver dwc3_rcar_gen5_driver = {
+	.probe		= dwc3_rcar_gen5_probe,
+	.driver		= {
+		.name	= "renesas-rcar-gen5-usb",
+		.of_match_table = dwc3_rcar_gen5_of_match,
+		.pm	= &dwc3_rcar_gen5_pm_ops,
+	},
+};
+
+module_platform_driver(dwc3_rcar_gen5_driver);
+
+MODULE_AUTHOR("Thanh Quan");
+MODULE_DESCRIPTION("Renesas R-Car X5H USB Glue Layer Driver");
+MODULE_LICENSE("GPL");
-- 
2.53.0

Re: [PATCH v1 1/2] dt-bindings: usb: dwc3: Document Renesas R-Car Gen5 DWC3 xHCI USB controller

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The device tree binding example uses a deprecated compatible string 'synopsys,dwc3' for the child DWC3 node.
--

--- Patch [1]: [PATCH v1 1/2] dt-bindings: usb: dwc3: Document Renesas R-Car Gen5 DWC3 xHCI USB controller ---
commit 716289e3efcde452eab06f93d71e6ed140cbc0c3
Author: Marek Vasut <marek.vasut+renesas@mailbox.org>

dt-bindings: usb: dwc3: Document Renesas R-Car Gen5 DWC3 xHCI USB controller

This commit adds documentation for the Renesas R-Car Gen5 DWC3 xHCI USB
controller and its glue logic wrapper. It defines a new YAML binding schema
that references the core snps,dwc3.yaml schema.

> diff --git a/Documentation/devicetree/bindings/usb/renesas,rcar-gen5-usb.yaml b/Documentation/devicetree/bindings/usb/renesas,rcar-gen5-usb.yaml
> new file mode 100644
> index 0000000000000..a334648e2dfc4
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/usb/renesas,rcar-gen5-usb.yaml

[ ... ]

> +examples:
> +  - |
> +    #include <dt-bindings/interrupt-controller/arm-gic.h>
> +
> +    bus {
> +        #address-cells = <2>;
> +        #size-cells = <2>;
> +
> +        usb@c9c54000 {
> +            compatible = "renesas,r8a78000-usb", "renesas,rcar-gen5-usb";

[ ... ]

> +            ranges = <0x0 0xc8800000 0x0 0xc8800000 0x0 0x100000>;
> +
> +            usb@c8800000 {
> +                compatible = "synopsys,dwc3";

[Severity: Low]
This isn't a bug, but the example uses the deprecated compatible string
"synopsys,dwc3" for the child DWC3 node. The base schema snps,dwc3.yaml
explicitly marks this as deprecated in favor of "snps,dwc3".

Should this be updated to avoid triggering warnings during schema validation
and to prevent users from copying outdated patterns into new device trees?

> +                reg = <0x0 0xc8800000 0x0 0x100000>;
> +                interrupts = <GIC_SPI 795 IRQ_TYPE_LEVEL_HIGH>;
> +                maximum-speed = "super-speed-plus";
> +                phys = <&mp_phy 2>;
> +                phy-names = "usb3-phy";
> +            };
> +        };
> +    };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728011656.465040-1-marek.vasut+renesas@mailbox.org?part=1

Re: [PATCH v1 2/2] usb: dwc3: Add Renesas R-Car Gen5 DWC3 xHCI USB controller glue

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] The driver leaks the runtime PM usage counter on probe failure and module unbind, permanently preventing the device from suspending.
- [High] The driver acquires an exclusive reset control but never deasserts it, potentially leaving the hardware in a permanent reset state.
- [High] Use-after-free risk due to accessing a device tree property string after dropping its node reference.
- [Low] The dev_pm_ops structure is unconditionally assigned without using the pm_ptr() wrapper, violating power management subsystem guidelines.
--

--- Patch [2]: [PATCH v1 2/2] usb: dwc3: Add Renesas R-Car Gen5 DWC3 xHCI USB controller glue ---
commit fc962bfb4e19df62045a5d6f590433718732e755
Author: Thanh Quan <thanh.quan.xn@renesas.com>

usb: dwc3: Add Renesas R-Car Gen5 DWC3 xHCI USB controller glue

This commit adds a new driver for the glue logic surrounding the DWC3
USB controller core on the Renesas R-Car Gen5 SoC.

> diff --git a/drivers/usb/dwc3/dwc3-rcar-gen5.c b/drivers/usb/dwc3/dwc3-rcar-gen5.c
> new file mode 100644
> index 0000000000000..344d0851559f5
> --- /dev/null
> +++ b/drivers/usb/dwc3/dwc3-rcar-gen5.c

[ ... ]

> +static int dwc3_rcar_gen5_probe(struct platform_device *pdev)
> +{

[ ... ]

> +	reset = devm_reset_control_get(dev, NULL);
> +	if (IS_ERR(reset))
> +		return dev_err_probe(dev, PTR_ERR(reset), "Failed to get reset control\n");

[Severity: High]
Does this leave the hardware in a permanent reset state? We acquire the
reset control here, but it doesn't look like we ever call
reset_control_deassert() on it later in the probe function.

[ ... ]

> +	ret = of_property_read_string(subnode, "maximum-speed", &maximum_speed);
> +	of_node_put(subnode);
> +	if (ret)
> +		return dev_err_probe(dev, -ENODEV, "Failed to determine maximum speed\n");
> +
> +	priv->use_usb3_flow = !strcmp(maximum_speed, "super-speed-plus") ||
> +			      !strcmp(maximum_speed, "super-speed");

[Severity: High]
Can this cause a use-after-free read?

The property string pointer maximum_speed points directly into the device
tree node's memory. By calling of_node_put() before the strcmp()
evaluations, the node memory could theoretically be freed if an overlay
is concurrently removed.

Should the of_node_put() happen after we're completely done with
maximum_speed?

> +	ret = devm_pm_runtime_enable(dev);
> +	if (ret)
> +		return dev_err_probe(dev, ret, "Failed to enable runtime PM\n");
> +
> +	ret = pm_runtime_resume_and_get(dev);
> +	if (ret)
> +		return dev_err_probe(dev, ret, "Failed to resume runtime PM\n");
> +
> +	return devm_of_platform_populate(dev);
> +}

[Severity: High]
Does this leak the runtime PM usage counter if devm_of_platform_populate()
fails? It looks like we return its error code directly without calling
pm_runtime_put().

[ ... ]

> +static struct platform_driver dwc3_rcar_gen5_driver = {
> +	.probe		= dwc3_rcar_gen5_probe,
> +	.driver		= {
> +		.name	= "renesas-rcar-gen5-usb",
> +		.of_match_table = dwc3_rcar_gen5_of_match,

[Severity: High]
Does this driver need a .remove callback?

Without one, the PM usage counter incremented during probe via
pm_runtime_resume_and_get() is never dropped when the module is unbound,
permanently preventing the device from suspending.

> +		.pm	= &dwc3_rcar_gen5_pm_ops,

[Severity: Low]
Should this use the pm_ptr() wrapper? Assigning the dev_pm_ops structure
unconditionally leaves dead code in the kernel when CONFIG_PM is disabled.

> +	},
> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728011656.465040-1-marek.vasut+renesas@mailbox.org?part=2