[PATCH v2 0/4] DWC3 link tunneling state reporting

[PATCH v2 0/4] DWC3 link tunneling state reporting

[Konrad Dybcio]

Currently, retrieving the tunneled/native state of a running port is
only possible on Intel XHCI hosts. This series extends that to CIO-
capable DWC31 controllers (see [1]).

Note that this patchset only results in the correct udev->tunnel_mode
value being assigned. Creating the device links (which requires this
information) between the USB4 router and the USB3 controller does not
currently take place on DT-based platforms, but that will be amended
in a follow-up patchset.

Tested on a Qualcomm X1E80100 CRD board, with a (currently) out-of-tree
set of drivers.

[1] I'm not entirely sure about the DWC version range (particularly
    wrt DWC32 and newer), so I limited it to a reasonable subset. I'll
    happily amend that.

Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
---
Changes in v2:
- Add handling for XHCI v1.2's USB3 tunneling and PORTSC.TM for
  platforms that advertise it (!!! UNTESTED !!!, I have no access to
  HW that exposes this)
- Prefer the aforementioned cap over custom implementations
- Bail out of the DWC3-specific check if `usb4-host-interface` device
  property is absent - hence this now depends on:
  https://github.com/devicetree-org/dt-schema/pull/196

- Link to v1: https://patch.msgid.link/20260505-topic-dwc3_tunneling_state-v1-0-4aaa6c3c14cb@oss.qualcomm.com

To: Mathias Nyman <mathias.nyman@intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Cc: linux-usb@vger.kernel.org
Cc: linux-kernel@vger.kernel.org

---
Konrad Dybcio (4):
      usb: xhci: debugfs: Expose the USB3 tunneling ext_cap register value
      usb: xhci: Honor PORTSC.TM if valid
      usb: xhci: Allow custom op for usb_link_tunnel_mode reporting
      usb: dwc3: Notify XHCI core of tunneled status

 drivers/usb/dwc3/core.c          | 16 ++++++++++++++++
 drivers/usb/dwc3/core.h          | 18 ++++++++++++++++++
 drivers/usb/dwc3/host.c          | 12 ++++++++++++
 drivers/usb/host/xhci-debugfs.c  |  9 +++++++++
 drivers/usb/host/xhci-debugfs.h  |  2 ++
 drivers/usb/host/xhci-ext-caps.h |  4 ++++
 drivers/usb/host/xhci-hub.c      | 32 +++++++++++++++++++++++++-------
 drivers/usb/host/xhci-plat.c     |  2 ++
 drivers/usb/host/xhci-plat.h     |  1 +
 drivers/usb/host/xhci-port.h     |  3 ++-
 drivers/usb/host/xhci.c          |  3 ++-
 drivers/usb/host/xhci.h          |  5 ++++-
 12 files changed, 97 insertions(+), 10 deletions(-)
---
base-commit: cc2b5f627e8ccbae1188ef2d8be3e451d7f933a5
change-id: 20260504-topic-dwc3_tunneling_state-50588c0e1ae3

Best regards,
--  
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

[PATCH v2 1/4] usb: xhci: debugfs: Expose the USB3 tunneling ext_cap register value

[Konrad Dybcio]

From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

The USB3 Tunneling Support Capability (idx 18) features a single
register. Expose it over debugfs, if supported by the controller.

Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
---
 drivers/usb/host/xhci-debugfs.c  | 9 +++++++++
 drivers/usb/host/xhci-debugfs.h  | 2 ++
 drivers/usb/host/xhci-ext-caps.h | 1 +
 3 files changed, 12 insertions(+)

diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index d07276192256..380778403b2d 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -81,6 +81,10 @@ static const struct debugfs_reg32 xhci_extcap_dbc[] = {
 	dump_register(EXTCAP_DBC_DEVINFO2),
 };
 
+static const struct debugfs_reg32 xhci_extcap_usb3_tunneling[] = {
+	dump_register(EXTCAP_USB3_TUNNELING),
+};
+
 static struct dentry *xhci_debugfs_root;
 
 static struct xhci_regset *xhci_debugfs_alloc_regset(struct xhci_hcd *xhci)
@@ -815,6 +819,11 @@ void xhci_debugfs_init(struct xhci_hcd *xhci)
 				   ARRAY_SIZE(xhci_extcap_dbc),
 				   "reg-ext-dbc");
 
+	xhci_debugfs_extcap_regset(xhci, XHCI_EXT_CAPS_USB3_TUNNELING,
+				   xhci_extcap_usb3_tunneling,
+				   ARRAY_SIZE(xhci_extcap_usb3_tunneling),
+				   "reg-usb3-tunneling");
+
 	xhci_debugfs_create_ring_dir(xhci, &xhci->cmd_ring,
 				     "command-ring",
 				     xhci->debugfs_root);
diff --git a/drivers/usb/host/xhci-debugfs.h b/drivers/usb/host/xhci-debugfs.h
index 7c074b4be819..ca6b7f2da8e3 100644
--- a/drivers/usb/host/xhci-debugfs.h
+++ b/drivers/usb/host/xhci-debugfs.h
@@ -70,6 +70,8 @@
 #define REG_EXTCAP_DBC_DEVINFO1				0x38
 #define REG_EXTCAP_DBC_DEVINFO2				0x3c
 
+#define REG_EXTCAP_USB3_TUNNELING			0x00
+
 #define dump_register(nm)				\
 {							\
 	.name	= __stringify(nm),			\
diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
index 67ecf7320c62..22e53a750e2a 100644
--- a/drivers/usb/host/xhci-ext-caps.h
+++ b/drivers/usb/host/xhci-ext-caps.h
@@ -40,6 +40,7 @@
 #define XHCI_EXT_CAPS_ROUTE	5
 /* IDs 6-9 reserved */
 #define XHCI_EXT_CAPS_DEBUG	10
+#define XHCI_EXT_CAPS_USB3_TUNNELING	18
 /* Vendor caps */
 #define XHCI_EXT_CAPS_VENDOR_INTEL	192
 #define XHCI_EXT_CAPS_INTEL_SPR_SHADOW	206

-- 
2.55.0

[PATCH v2 2/4] usb: xhci: Honor PORTSC.TM if valid

[Konrad Dybcio]

From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Currently, the only way for the USB core to determine whether the link
is native or tunneled is via an Intel vendor-specific Extended
Capability.

The XHCI specification v1.2 and newer expose a common ext_cap,
indicating whether BIT(2) of PORTSC can be interpreted as the tunneling
status.

Make use of that and fall back to the existing Intel-specific path if
the ext_cap is absent.

Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
---
 drivers/usb/host/xhci-ext-caps.h |  3 +++
 drivers/usb/host/xhci-hub.c      | 19 ++++++++++++++++---
 drivers/usb/host/xhci-port.h     |  3 ++-
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
index 22e53a750e2a..af7d624cd38e 100644
--- a/drivers/usb/host/xhci-ext-caps.h
+++ b/drivers/usb/host/xhci-ext-caps.h
@@ -66,6 +66,9 @@
 #define XHCI_HLC               (1 << 19)
 #define XHCI_BLC               (1 << 20)
 
+/* USB3 tunneling support capability - section 7.11 */
+#define XHCI_USB3_TUNNELING_SUPPORTED	BIT(16)
+
 /* Intel SPR shadow capability */
 #define XHCI_INTEL_SPR_ESS_PORT_OFFSET  0x8ac4	/* SuperSpeed port control */
 #define XHCI_INTEL_SPR_TUNEN	BIT(4)		/* Tunnel mode enabled */
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index b0264bd8577a..402e98ab95ee 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -766,17 +766,30 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci)
 enum usb_link_tunnel_mode xhci_port_is_tunneled(struct xhci_hcd *xhci,
 						struct xhci_port *port)
 {
+	void __iomem *base = &xhci->cap_regs->hc_capbase;
 	struct usb_hcd *hcd;
-	void __iomem *base;
 	u32 offset;
+	u32 val;
 
-	/* Don't try and probe this capability for non-Intel hosts */
+	/* Prefer the XHCI v1.2 ext_cap if advertised */
+	offset = xhci_find_next_ext_cap(base, 0, XHCI_EXT_CAPS_USB3_TUNNELING);
+	if (offset) {
+		if (!(readl(base + offset) & XHCI_USB3_TUNNELING_SUPPORTED))
+			return USB_LINK_NATIVE;
+
+		val = xhci_portsc_readl(port);
+		if (val & PORT_TM)
+			return USB_LINK_TUNNELED;
+
+		return USB_LINK_NATIVE;
+	}
+
+	/* Fall back to the legacy Intel-specific ext_cap */
 	hcd = xhci_to_hcd(xhci);
 	if (!dev_is_pci(hcd->self.controller) ||
 	    to_pci_dev(hcd->self.controller)->vendor != PCI_VENDOR_ID_INTEL)
 		return USB_LINK_UNKNOWN;
 
-	base = &xhci->cap_regs->hc_capbase;
 	offset = xhci_find_next_ext_cap(base, 0, XHCI_EXT_CAPS_INTEL_SPR_SHADOW);
 
 	if (offset && offset <= XHCI_INTEL_SPR_ESS_PORT_OFFSET) {
diff --git a/drivers/usb/host/xhci-port.h b/drivers/usb/host/xhci-port.h
index 889b5fb0fcd8..215c9cadbc34 100644
--- a/drivers/usb/host/xhci-port.h
+++ b/drivers/usb/host/xhci-port.h
@@ -5,7 +5,8 @@
 #define PORT_CONNECT	(1 << 0)
 /* true: port enabled */
 #define PORT_PE		(1 << 1)
-/* bit 2 reserved and zeroed */
+/* true: port is tunneling traffic over USB4 */
+#define PORT_TM		(1 << 2)
 /* true: port has an over-current condition */
 #define PORT_OC		(1 << 3)
 /* true: port reset signaling asserted */

-- 
2.55.0

[PATCH v2 3/4] usb: xhci: Allow custom op for usb_link_tunnel_mode reporting

[Konrad Dybcio]

From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

The Thunderbolt framework relies on the USB core to create device links
for tunneled ports, so that the USB3 controller is only kept
runtime-resumed for the duration of the tunneling.

Currently, retrieving that information is only possibe on Intel XHCI
hosts, through a vendor-specific capability. Extend xhci-plat to allow
plumbing a custom one.

Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
---
 drivers/usb/host/xhci-hub.c  | 13 +++++++++----
 drivers/usb/host/xhci-plat.c |  2 ++
 drivers/usb/host/xhci-plat.h |  1 +
 drivers/usb/host/xhci.c      |  3 ++-
 drivers/usb/host/xhci.h      |  5 ++++-
 5 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 402e98ab95ee..9964cbd154ab 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -749,7 +749,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci)
 }
 
 /**
- * xhci_port_is_tunneled() - Check if USB3 connection is tunneled over USB4
+ * xhci_port_tunnel_mode() - Check if USB3 connection is tunneled over USB4
  * @xhci: xhci host controller
  * @port: USB3 port to be checked.
  *
@@ -763,7 +763,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci)
  * detecting USB3 over USB4 tunnels. USB_LINK_NATIVE or USB_LINK_TUNNELED
  * otherwise.
  */
-enum usb_link_tunnel_mode xhci_port_is_tunneled(struct xhci_hcd *xhci,
+enum usb_link_tunnel_mode xhci_port_tunnel_mode(struct xhci_hcd *xhci,
 						struct xhci_port *port)
 {
 	void __iomem *base = &xhci->cap_regs->hc_capbase;
@@ -787,8 +787,13 @@ enum usb_link_tunnel_mode xhci_port_is_tunneled(struct xhci_hcd *xhci,
 	/* Fall back to the legacy Intel-specific ext_cap */
 	hcd = xhci_to_hcd(xhci);
 	if (!dev_is_pci(hcd->self.controller) ||
-	    to_pci_dev(hcd->self.controller)->vendor != PCI_VENDOR_ID_INTEL)
-		return USB_LINK_UNKNOWN;
+	    to_pci_dev(hcd->self.controller)->vendor != PCI_VENDOR_ID_INTEL) {
+		/* Last chance - if the controller has a custom tunnel_mode op, try that */
+		if (xhci->tunnel_mode)
+			return xhci->tunnel_mode(xhci_to_hcd(xhci), port->hcd_portnum);
+		else
+			return USB_LINK_UNKNOWN;
+	}
 
 	offset = xhci_find_next_ext_cap(base, 0, XHCI_EXT_CAPS_INTEL_SPR_SHADOW);
 
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 074d9c731639..dbaca694baa2 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -244,6 +244,8 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s
 		priv = hcd_to_xhci_priv(hcd);
 		/* Just copy data for now */
 		*priv = *priv_match;
+
+		xhci->tunnel_mode = priv->tunnel_mode;
 	}
 
 	device_set_wakeup_capable(&pdev->dev, true);
diff --git a/drivers/usb/host/xhci-plat.h b/drivers/usb/host/xhci-plat.h
index 00751d851831..c5042766a486 100644
--- a/drivers/usb/host/xhci-plat.h
+++ b/drivers/usb/host/xhci-plat.h
@@ -22,6 +22,7 @@ struct xhci_plat_priv {
 	int (*suspend_quirk)(struct usb_hcd *);
 	int (*resume_quirk)(struct usb_hcd *);
 	int (*post_resume_quirk)(struct usb_hcd *);
+	enum usb_link_tunnel_mode (*tunnel_mode)(struct usb_hcd *hcd, int portnum);
 };
 
 #define hcd_to_xhci_priv(h) ((struct xhci_plat_priv *)hcd_to_xhci(h)->priv)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 091c82ca8ee2..118401a74244 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4760,7 +4760,8 @@ static int xhci_update_device(struct usb_hcd *hcd, struct usb_device *udev)
 	if (hcd->speed >= HCD_USB3 && !udev->parent->parent) {
 		port = xhci->usb3_rhub.ports[udev->portnum - 1];
 
-		udev->tunnel_mode = xhci_port_is_tunneled(xhci, port);
+		udev->tunnel_mode = xhci_port_tunnel_mode(xhci, port);
+
 		if (udev->tunnel_mode == USB_LINK_UNKNOWN)
 			dev_dbg(&udev->dev, "link tunnel state unknown\n");
 		else if (udev->tunnel_mode == USB_LINK_TUNNELED)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 2d3941b5e1e3..a85968008a94 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1675,6 +1675,9 @@ struct xhci_hcd {
 	struct list_head	regset_list;
 
 	void			*dbc;
+
+	enum usb_link_tunnel_mode (*tunnel_mode)(struct usb_hcd *hcd, int portnum);
+
 	/* platform-specific data -- must come last */
 	unsigned long		priv[] __aligned(sizeof(s64));
 };
@@ -1981,7 +1984,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
 int xhci_hub_status_data(struct usb_hcd *hcd, char *buf);
 int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1);
 struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd);
-enum usb_link_tunnel_mode xhci_port_is_tunneled(struct xhci_hcd *xhci,
+enum usb_link_tunnel_mode xhci_port_tunnel_mode(struct xhci_hcd *xhci,
 						struct xhci_port *port);
 void xhci_hc_died(struct xhci_hcd *xhci);
 

-- 
2.55.0

[PATCH v2 4/4] usb: dwc3: Notify XHCI core of tunneled status

[Konrad Dybcio]

From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

The Thunderbolt framework relies on the USB core to create device links
for tunneled ports, so that the USB3 controller is only kept
runtime-resumed for the duration of the tunneling. This depends on
first knowing whether a connection is tunneled or native.

Add the logic to handle that for DWC3 controllers.

Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
---
 drivers/usb/dwc3/core.c | 16 ++++++++++++++++
 drivers/usb/dwc3/core.h | 18 ++++++++++++++++++
 drivers/usb/dwc3/host.c | 12 ++++++++++++
 3 files changed, 46 insertions(+)

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index fd5c2cd36c59..6ee6fce4c927 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -162,6 +162,22 @@ void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode, bool ignore_susphy)
 }
 EXPORT_SYMBOL_GPL(dwc3_set_prtcap);
 
+enum usb_link_tunnel_mode dwc3_link_tunnel_mode(struct dwc3 *dwc, u8 port)
+{
+	/* Prior versions had no CIO support */
+	if (!DWC3_VER_IS_WITHIN(DWC31, 191A, ANY))
+		return USB_LINK_NATIVE;
+
+	/* Not all DWC3 instances have CIO HW, trust the platform firmware */
+	if (!device_property_present(dwc->dev, "usb4-host-interface"))
+		return USB_LINK_NATIVE;
+
+	if (dwc3_readl(dwc, DWC3_CIOCTRL(port)) & DWC3_CIOCTRL_CIO_EN)
+		return USB_LINK_TUNNELED;
+
+	return USB_LINK_NATIVE;
+}
+
 static void __dwc3_set_mode(struct work_struct *work)
 {
 	struct dwc3 *dwc = work_to_dwc(work);
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 608daeb7ef10..decc51cd6505 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -179,6 +179,11 @@
 #define DWC3_OEVTEN		0xcc0C
 #define DWC3_OSTS		0xcc10
 
+/* CIO regs */
+#define DWC3_CIO_BASE(n)	(0xcd20 + ((n) * 0x30))
+#define DWC3_CIOCTRL(n)		(DWC3_CIO_BASE(n) + 0x00)
+#define DWC3_CIOCTRL_CIO_EN	BIT(0)
+
 #define DWC3_LLUCTL(n)		(0xd024 + ((n) * 0x80))
 
 /* Bit fields */
@@ -1314,6 +1319,7 @@ struct dwc3 {
 #define DWC31_REVISION_170A	0x3137302a
 #define DWC31_REVISION_180A	0x3138302a
 #define DWC31_REVISION_190A	0x3139302a
+#define DWC31_REVISION_191A	0x3139312a
 #define DWC31_REVISION_200A	0x3230302a
 
 #define DWC32_REVISION_ANY	0x0
@@ -1658,11 +1664,23 @@ static inline void dwc3_pre_run_stop(struct dwc3 *dwc, bool is_on)
 #if IS_ENABLED(CONFIG_USB_DWC3_HOST) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE)
 int dwc3_host_init(struct dwc3 *dwc);
 void dwc3_host_exit(struct dwc3 *dwc);
+
+/**
+ * dwc3_link_tunnel_mode - Check whether the link is tunneled over TBT/USB4
+ * @dwc: Pointer to DWC3 controller context
+ * @port: 0-based port index
+ *
+ * Returns: USB_LINK_TUNNELED if tunneled, USB_LINK_NATIVE if not, or
+ *          when the controller does not have USB4 capabilities.
+ */
+enum usb_link_tunnel_mode dwc3_link_tunnel_mode(struct dwc3 *dwc, u8 port);
 #else
 static inline int dwc3_host_init(struct dwc3 *dwc)
 { return 0; }
 static inline void dwc3_host_exit(struct dwc3 *dwc)
 { }
+static inline enum usb_link_tunnel_mode dwc3_link_tunnel_mode(struct dwc3 *dwc, u8 port)
+{ return USB_LINK_UNKNOWN; }
 #endif
 
 #if IS_ENABLED(CONFIG_USB_DWC3_GADGET) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE)
diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
index 96b588bd08cd..eb03b079696e 100644
--- a/drivers/usb/dwc3/host.c
+++ b/drivers/usb/dwc3/host.c
@@ -77,8 +77,20 @@ static void dwc3_xhci_plat_start(struct usb_hcd *hcd)
 	dwc3_enable_susphy(dwc, true);
 }
 
+static enum usb_link_tunnel_mode dwc3_xhci_tunnel_mode(struct usb_hcd *hcd, int portnum)
+{
+	struct platform_device *pdev;
+	struct dwc3 *dwc;
+
+	pdev = to_platform_device(hcd->self.controller);
+	dwc = dev_get_drvdata(pdev->dev.parent);
+
+	return dwc3_link_tunnel_mode(dwc, portnum);
+}
+
 static const struct xhci_plat_priv dwc3_xhci_plat_quirk = {
 	.plat_start = dwc3_xhci_plat_start,
+	.tunnel_mode = dwc3_xhci_tunnel_mode,
 };
 
 static void dwc3_host_fill_xhci_irq_res(struct dwc3 *dwc,

-- 
2.55.0

Re: [PATCH v2 0/4] DWC3 link tunneling state reporting

[Konrad Dybcio]

On 7/15/26 2:29 PM, 'Konrad Dybcio' via USB4 - Upstream wrote:
> Currently, retrieving the tunneled/native state of a running port is
> only possible on Intel XHCI hosts. This series extends that to CIO-
> capable DWC31 controllers (see [1]).
> 
> Note that this patchset only results in the correct udev->tunnel_mode
> value being assigned. Creating the device links (which requires this
> information) between the USB4 router and the USB3 controller does not
> currently take place on DT-based platforms, but that will be amended
> in a follow-up patchset.
> 
> Tested on a Qualcomm X1E80100 CRD board, with a (currently) out-of-tree
> set of drivers.
> 
> [1] I'm not entirely sure about the DWC version range (particularly
>     wrt DWC32 and newer), so I limited it to a reasonable subset. I'll
>     happily amend that.
> 
> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> ---
> Changes in v2:
> - Add handling for XHCI v1.2's USB3 tunneling and PORTSC.TM for
>   platforms that advertise it (!!! UNTESTED !!!, I have no access to
>   HW that exposes this)
> - Prefer the aforementioned cap over custom implementations
> - Bail out of the DWC3-specific check if `usb4-host-interface` device
>   property is absent - hence this now depends on:
>   https://github.com/devicetree-org/dt-schema/pull/196
> 
> - Link to v1: https://patch.msgid.link/20260505-topic-dwc3_tunneling_state-v1-0-4aaa6c3c14cb@oss.qualcomm.com

+Cc Sven sorry, I forgot to include you..

Konrad

Re: [PATCH v2 3/4] usb: xhci: Allow custom op for usb_link_tunnel_mode reporting

[Thinh Nguyen]

On Wed, Jul 15, 2026, Konrad Dybcio wrote:
> From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> 
> The Thunderbolt framework relies on the USB core to create device links
> for tunneled ports, so that the USB3 controller is only kept
> runtime-resumed for the duration of the tunneling.
> 
> Currently, retrieving that information is only possibe on Intel XHCI
> hosts, through a vendor-specific capability. Extend xhci-plat to allow
> plumbing a custom one.
> 
> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> ---
>  drivers/usb/host/xhci-hub.c  | 13 +++++++++----
>  drivers/usb/host/xhci-plat.c |  2 ++
>  drivers/usb/host/xhci-plat.h |  1 +
>  drivers/usb/host/xhci.c      |  3 ++-
>  drivers/usb/host/xhci.h      |  5 ++++-
>  5 files changed, 18 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
> index 402e98ab95ee..9964cbd154ab 100644
> --- a/drivers/usb/host/xhci-hub.c
> +++ b/drivers/usb/host/xhci-hub.c
> @@ -749,7 +749,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci)
>  }
>  
>  /**
> - * xhci_port_is_tunneled() - Check if USB3 connection is tunneled over USB4
> + * xhci_port_tunnel_mode() - Check if USB3 connection is tunneled over USB4
>   * @xhci: xhci host controller
>   * @port: USB3 port to be checked.
>   *
> @@ -763,7 +763,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci)
>   * detecting USB3 over USB4 tunnels. USB_LINK_NATIVE or USB_LINK_TUNNELED
>   * otherwise.
>   */
> -enum usb_link_tunnel_mode xhci_port_is_tunneled(struct xhci_hcd *xhci,
> +enum usb_link_tunnel_mode xhci_port_tunnel_mode(struct xhci_hcd *xhci,
>  						struct xhci_port *port)
>  {
>  	void __iomem *base = &xhci->cap_regs->hc_capbase;
> @@ -787,8 +787,13 @@ enum usb_link_tunnel_mode xhci_port_is_tunneled(struct xhci_hcd *xhci,
>  	/* Fall back to the legacy Intel-specific ext_cap */
>  	hcd = xhci_to_hcd(xhci);
>  	if (!dev_is_pci(hcd->self.controller) ||
> -	    to_pci_dev(hcd->self.controller)->vendor != PCI_VENDOR_ID_INTEL)
> -		return USB_LINK_UNKNOWN;
> +	    to_pci_dev(hcd->self.controller)->vendor != PCI_VENDOR_ID_INTEL) {
> +		/* Last chance - if the controller has a custom tunnel_mode op, try that */
> +		if (xhci->tunnel_mode)
> +			return xhci->tunnel_mode(xhci_to_hcd(xhci), port->hcd_portnum);
> +		else
> +			return USB_LINK_UNKNOWN;
> +	}
>  
>  	offset = xhci_find_next_ext_cap(base, 0, XHCI_EXT_CAPS_INTEL_SPR_SHADOW);
>  
> diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
> index 074d9c731639..dbaca694baa2 100644
> --- a/drivers/usb/host/xhci-plat.c
> +++ b/drivers/usb/host/xhci-plat.c
> @@ -244,6 +244,8 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s
>  		priv = hcd_to_xhci_priv(hcd);
>  		/* Just copy data for now */
>  		*priv = *priv_match;
> +
> +		xhci->tunnel_mode = priv->tunnel_mode;
>  	}
>  
>  	device_set_wakeup_capable(&pdev->dev, true);
> diff --git a/drivers/usb/host/xhci-plat.h b/drivers/usb/host/xhci-plat.h
> index 00751d851831..c5042766a486 100644
> --- a/drivers/usb/host/xhci-plat.h
> +++ b/drivers/usb/host/xhci-plat.h
> @@ -22,6 +22,7 @@ struct xhci_plat_priv {
>  	int (*suspend_quirk)(struct usb_hcd *);
>  	int (*resume_quirk)(struct usb_hcd *);
>  	int (*post_resume_quirk)(struct usb_hcd *);
> +	enum usb_link_tunnel_mode (*tunnel_mode)(struct usb_hcd *hcd, int portnum);

We should add a boolean tunnel_mode_override. When set, ->tunnel_mode()
is called before the standard xhci v1.2 ext_cap check. If the
->tunnel_mode() returns USB_LINK_UNKNOWN, go to the standard path. This
allows the quirk to selectively bypass or override it.

BR,
Thinh

>  };
>  
>  #define hcd_to_xhci_priv(h) ((struct xhci_plat_priv *)hcd_to_xhci(h)->priv)
> diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
> index 091c82ca8ee2..118401a74244 100644
> --- a/drivers/usb/host/xhci.c
> +++ b/drivers/usb/host/xhci.c
> @@ -4760,7 +4760,8 @@ static int xhci_update_device(struct usb_hcd *hcd, struct usb_device *udev)
>  	if (hcd->speed >= HCD_USB3 && !udev->parent->parent) {
>  		port = xhci->usb3_rhub.ports[udev->portnum - 1];
>  
> -		udev->tunnel_mode = xhci_port_is_tunneled(xhci, port);
> +		udev->tunnel_mode = xhci_port_tunnel_mode(xhci, port);
> +
>  		if (udev->tunnel_mode == USB_LINK_UNKNOWN)
>  			dev_dbg(&udev->dev, "link tunnel state unknown\n");
>  		else if (udev->tunnel_mode == USB_LINK_TUNNELED)
> diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
> index 2d3941b5e1e3..a85968008a94 100644
> --- a/drivers/usb/host/xhci.h
> +++ b/drivers/usb/host/xhci.h
> @@ -1675,6 +1675,9 @@ struct xhci_hcd {
>  	struct list_head	regset_list;
>  
>  	void			*dbc;
> +
> +	enum usb_link_tunnel_mode (*tunnel_mode)(struct usb_hcd *hcd, int portnum);
> +
>  	/* platform-specific data -- must come last */
>  	unsigned long		priv[] __aligned(sizeof(s64));
>  };
> @@ -1981,7 +1984,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
>  int xhci_hub_status_data(struct usb_hcd *hcd, char *buf);
>  int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1);
>  struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd);
> -enum usb_link_tunnel_mode xhci_port_is_tunneled(struct xhci_hcd *xhci,
> +enum usb_link_tunnel_mode xhci_port_tunnel_mode(struct xhci_hcd *xhci,
>  						struct xhci_port *port);
>  void xhci_hc_died(struct xhci_hcd *xhci);
>  
> 
> -- 
> 2.55.0
> 

Re: [PATCH v2 2/4] usb: xhci: Honor PORTSC.TM if valid

[Thinh Nguyen]

On Wed, Jul 15, 2026, Konrad Dybcio wrote:
> From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> 
> Currently, the only way for the USB core to determine whether the link
> is native or tunneled is via an Intel vendor-specific Extended
> Capability.
> 
> The XHCI specification v1.2 and newer expose a common ext_cap,
> indicating whether BIT(2) of PORTSC can be interpreted as the tunneling
> status.
> 
> Make use of that and fall back to the existing Intel-specific path if
> the ext_cap is absent.
> 
> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> ---
>  drivers/usb/host/xhci-ext-caps.h |  3 +++
>  drivers/usb/host/xhci-hub.c      | 19 ++++++++++++++++---
>  drivers/usb/host/xhci-port.h     |  3 ++-
>  3 files changed, 21 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
> index 22e53a750e2a..af7d624cd38e 100644
> --- a/drivers/usb/host/xhci-ext-caps.h
> +++ b/drivers/usb/host/xhci-ext-caps.h
> @@ -66,6 +66,9 @@
>  #define XHCI_HLC               (1 << 19)
>  #define XHCI_BLC               (1 << 20)
>  
> +/* USB3 tunneling support capability - section 7.11 */
> +#define XHCI_USB3_TUNNELING_SUPPORTED	BIT(16)
> +
>  /* Intel SPR shadow capability */
>  #define XHCI_INTEL_SPR_ESS_PORT_OFFSET  0x8ac4	/* SuperSpeed port control */
>  #define XHCI_INTEL_SPR_TUNEN	BIT(4)		/* Tunnel mode enabled */
> diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
> index b0264bd8577a..402e98ab95ee 100644
> --- a/drivers/usb/host/xhci-hub.c
> +++ b/drivers/usb/host/xhci-hub.c
> @@ -766,17 +766,30 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci)
>  enum usb_link_tunnel_mode xhci_port_is_tunneled(struct xhci_hcd *xhci,
>  						struct xhci_port *port)
>  {
> +	void __iomem *base = &xhci->cap_regs->hc_capbase;
>  	struct usb_hcd *hcd;
> -	void __iomem *base;
>  	u32 offset;
> +	u32 val;

Continue from the response on [PATCH v2 3/4], base on the priority to
determine the tunnel_mode:

First we should check if tunnel_mode_override is set:

	if (xhci->tunnel_mode_override && xhci->tunnel_mode) {
		enum usb_link_tunnel_mode mode;

		mode = xhci->tunnel_mode(xhci_to_hcd(xhci), port->hcd_portnum);
		if (mode != USB_LINK_UNKNOWN)
			return mode;
	}

>  
> -	/* Don't try and probe this capability for non-Intel hosts */
> +	/* Prefer the XHCI v1.2 ext_cap if advertised */
> +	offset = xhci_find_next_ext_cap(base, 0, XHCI_EXT_CAPS_USB3_TUNNELING);
> +	if (offset) {
> +		if (!(readl(base + offset) & XHCI_USB3_TUNNELING_SUPPORTED))
> +			return USB_LINK_NATIVE;

Second, don't return early here. Check if XHCI_EXT_CAPS_USB3_TUNNELING
present and supported:

	if (offset && (readl(base + offset) & XHCI_USB3_TUNNELING_SUPPORTED)) {

> +
> +		val = xhci_portsc_readl(port);
> +		if (val & PORT_TM)
> +			return USB_LINK_TUNNELED;
> +
> +		return USB_LINK_NATIVE;
> +	}
> +

Third, check for Intel PCI and keep it as is here:

> +	/* Fall back to the legacy Intel-specific ext_cap */
>  	hcd = xhci_to_hcd(xhci);
>  	if (!dev_is_pci(hcd->self.controller) ||
>  	    to_pci_dev(hcd->self.controller)->vendor != PCI_VENDOR_ID_INTEL)
>  		return USB_LINK_UNKNOWN;
>  
> -	base = &xhci->cap_regs->hc_capbase;
>  	offset = xhci_find_next_ext_cap(base, 0, XHCI_EXT_CAPS_INTEL_SPR_SHADOW);
>  
>  	if (offset && offset <= XHCI_INTEL_SPR_ESS_PORT_OFFSET) {
> diff --git a/drivers/usb/host/xhci-port.h b/drivers/usb/host/xhci-port.h
> index 889b5fb0fcd8..215c9cadbc34 100644
> --- a/drivers/usb/host/xhci-port.h
> +++ b/drivers/usb/host/xhci-port.h
> @@ -5,7 +5,8 @@
>  #define PORT_CONNECT	(1 << 0)
>  /* true: port enabled */
>  #define PORT_PE		(1 << 1)
> -/* bit 2 reserved and zeroed */
> +/* true: port is tunneling traffic over USB4 */
> +#define PORT_TM		(1 << 2)
>  /* true: port has an over-current condition */
>  #define PORT_OC		(1 << 3)
>  /* true: port reset signaling asserted */
> 
> -- 
> 2.55.0
> 

Thanks,
Thinh

Re: [PATCH v2 4/4] usb: dwc3: Notify XHCI core of tunneled status

[Thinh Nguyen]

On Wed, Jul 15, 2026, Konrad Dybcio wrote:
> From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> 
> The Thunderbolt framework relies on the USB core to create device links
> for tunneled ports, so that the USB3 controller is only kept
> runtime-resumed for the duration of the tunneling. This depends on
> first knowing whether a connection is tunneled or native.
> 
> Add the logic to handle that for DWC3 controllers.
> 
> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> ---
>  drivers/usb/dwc3/core.c | 16 ++++++++++++++++
>  drivers/usb/dwc3/core.h | 18 ++++++++++++++++++
>  drivers/usb/dwc3/host.c | 12 ++++++++++++
>  3 files changed, 46 insertions(+)
> 
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index fd5c2cd36c59..6ee6fce4c927 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -162,6 +162,22 @@ void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode, bool ignore_susphy)
>  }
>  EXPORT_SYMBOL_GPL(dwc3_set_prtcap);
>  
> +enum usb_link_tunnel_mode dwc3_link_tunnel_mode(struct dwc3 *dwc, u8 port)
> +{
> +	/* Prior versions had no CIO support */
> +	if (!DWC3_VER_IS_WITHIN(DWC31, 191A, ANY))
> +		return USB_LINK_NATIVE;

Refer on the feedback from the other patches, this should return
USB_LINK_UNKNOWN instead.

> +
> +	/* Not all DWC3 instances have CIO HW, trust the platform firmware */
> +	if (!device_property_present(dwc->dev, "usb4-host-interface"))
> +		return USB_LINK_NATIVE;

Same here.

> +
> +	if (dwc3_readl(dwc, DWC3_CIOCTRL(port)) & DWC3_CIOCTRL_CIO_EN)
> +		return USB_LINK_TUNNELED;
> +
> +	return USB_LINK_NATIVE;
> +}
> +

Thanks,
Thinh

Re: [PATCH v2 0/4] DWC3 link tunneling state reporting

[Thinh Nguyen]

On Wed, Jul 15, 2026, Konrad Dybcio wrote:
> On 7/15/26 2:29 PM, 'Konrad Dybcio' via USB4 - Upstream wrote:
> > Currently, retrieving the tunneled/native state of a running port is
> > only possible on Intel XHCI hosts. This series extends that to CIO-
> > capable DWC31 controllers (see [1]).
> > 
> > Note that this patchset only results in the correct udev->tunnel_mode
> > value being assigned. Creating the device links (which requires this
> > information) between the USB4 router and the USB3 controller does not
> > currently take place on DT-based platforms, but that will be amended
> > in a follow-up patchset.
> > 
> > Tested on a Qualcomm X1E80100 CRD board, with a (currently) out-of-tree
> > set of drivers.
> > 
> > [1] I'm not entirely sure about the DWC version range (particularly
> >     wrt DWC32 and newer), so I limited it to a reasonable subset. I'll
> >     happily amend that.
> > 
> > Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> > ---
> > Changes in v2:
> > - Add handling for XHCI v1.2's USB3 tunneling and PORTSC.TM for
> >   platforms that advertise it (!!! UNTESTED !!!, I have no access to
> >   HW that exposes this)
> > - Prefer the aforementioned cap over custom implementations
> > - Bail out of the DWC3-specific check if `usb4-host-interface` device
> >   property is absent - hence this now depends on:
> >   https://urldefense.com/v3/__https://github.com/devicetree-org/dt-schema/pull/196__;!!A4F2R9G_pg!Yp4eQxr_V48OU-fhHIAT1pJrvhKI2VbT19cN4M-3EHIA5K9G57Npd31Hs5MLCPneAJ3pxM3JzzaQ7Mc_8sTGV7KEa_bieEilDA$ 
> > 
> > - Link to v1: https://urldefense.com/v3/__https://patch.msgid.link/20260505-topic-dwc3_tunneling_state-v1-0-4aaa6c3c14cb@oss.qualcomm.com__;!!A4F2R9G_pg!Yp4eQxr_V48OU-fhHIAT1pJrvhKI2VbT19cN4M-3EHIA5K9G57Npd31Hs5MLCPneAJ3pxM3JzzaQ7Mc_8sTGV7KEa_bYNq9e3w$ 
> 
> +Cc Sven sorry, I forgot to include you..
> 
> Konrad

Thank you for the patch series!

Don't worry about the DWC32 version range. Newer controllers should
follow the xhci v1.2 spec. We can always apply fixes later as needed.

Thanks,
Thinh

ps. I'll be out of office tomorrow until 7/31. My response may be
delayed.