Peter Chen [off-list ref] writes:

quoted

quoted

quoted

+            tmode = le16_to_cpu(ctrl->wIndex);
+
+            if (!set || (tmode & 0xff) != 0)
+                    return -EINVAL;
+
+            switch (tmode >> 8) {
+            case TEST_J:
+            case TEST_K:
+            case TEST_SE0_NAK:
+            case TEST_PACKET:
+                    cdns3_set_register_bit(&priv_dev->regs->usb_cmd,
+                                           USB_CMD_STMODE |
+                                           USB_STS_TMODE_SEL(tmode - 1));

I'm 90% sure this won't work. There's a reason why we only enter the
requested test mode from status stage. How have you tested this?

What's the reason?
It can work although the code is a little different with above, I
tested it using USBxHSETT tool at Windows.

put a sniffer. Status stage won't complete

quoted

quoted

quoted

+    irqreturn_t ret = IRQ_NONE;
+    unsigned long flags;
+    u32 reg;
+
+    priv_dev = cdns->gadget_dev;
+    spin_lock_irqsave(&priv_dev->lock, flags);

you're already running in hardirq context. Why do you need this lock at
all? I would be better to use the hardirq handler to mask your
interrupts, so they don't fire again, then used the top-half (softirq)
handler to actually handle the interrupts.

This controller may be ran at SMP environment, register and flag access
needs to be protected among CPUs running.

in hardirq context? When interrupts are already disabled?

-- 
balbi