When the system goes to suspend, if the controller is at device mode with
cable connecting to host, the call stack is: cdns3_suspend->
cdns3_gadget_suspend -> cdns3_disconnect_gadget, after cdns3_disconnect_gadget
is called, it owns lock wrongly, it causes the system being deadlock after
resume due to at cdns3_device_thread_irq_handler, it tries to get the lock,
but can't get it forever.

To fix it, we delete the unlock-lock operations at cdns3_disconnect_gadget,
and do it at the caller.

Fixes: b1234e3b ("usb: cdns3: add runtime PM support")
Acked-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

Patch fixes issue caused setting On-chip memory overflow bit in usb_sts
register. The issue occurred because EP_CFG register was set twice
before USB_STS.CFGSTS was set. Every write operation on EP_CFG.BUFFERING
causes that controller increases internal counter holding the number
of reserved on-chip buffers. First time this register was updated in
function cdns3_ep_config before delegating SET_CONFIGURATION request
to class driver and again it was updated when class wanted to enable
endpoint.  This patch fixes this issue by configuring endpoints
enabled by class driver in cdns3_gadget_ep_enable and others just
before status stage.

Cc: stable@vger.kernel.org#v5.8+
Fixes: 7733f6c3 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Reported-and-tested-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

The code:
trb->length = cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size)
	       	| TRB_LEN(length));

TRB_BURST_LEN(priv_ep->trb_burst_size) may be overflow for int 32 if
priv_ep->trb_burst_size is equal or larger than 0x80;

Below is the Coverity warning:
sign_extension: Suspicious implicit sign extension: priv_ep->trb_burst_size
with type u8 (8 bits, unsigned) is promoted in priv_ep->trb_burst_size << 24
to type int (32 bits, signed), then sign-extended to type unsigned long
(64 bits, unsigned). If priv_ep->trb_burst_size << 24 is greater than 0x7FFFFFFF,
the upper bits of the result will all be 1.

To fix it, it needs to add an explicit cast to unsigned int type for ((p) << 24).
Reviewed-by: NJun Li <jun.li@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

Patch removes not used variable 'length' from
cdns3_wa2_descmiss_copy_data function.

Fixes: 141e70fe ("usb: cdns3: gadget: need to handle sg case for workaround 2 case")
Acked-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

At Android ADB and MTP use case, it uses f_fs which supports scatter list,
it means one request may need several TRBs for it. Besides, TRB consumes
very fast compared to TRB has prepared for above use case, there are at
most 120 pending requests, the date size is 16KB for each request, so four
TRBs (4KB per TRB) per sg entry at worst case. so we need to enlarge the
TRB ring length to avoid "no free TRB error". Since each TRB only consumes
12 bytes (3 * 32 bits), we enlarge the TRB length to 600, it leaves some
buffers for potential "no free TRB error", and only increases a little
memory cost.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

The scatter buffer list support earlier than DEV_VER_V2 is not
good enough, software can't know well about short transfer for it.

Cc: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Add sg case for workaround 2, the workaround 2 is described at the
beginning of this file.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

- Judge each TRB has been handled at cdns3_trb_handled, since
the DMA pointer may be at the middle of the TD, we can't consider
this TD has finished at that time.
- Calculate req->actual according to finished TRBs.
- Handle short transfer for sg list use case correctly. When the
short transfer occurs, we check OUT_SMM at TRB to see if it is
the last TRB.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

For sg buffer list use case, we need to add ISP for each TRB, and
add CHAIN bit for each TRB except for the last TRB.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

It only dumps the first TRB per request, it is not useful if only dump
the first TRB when there are several TRBs per request. We improve it by
dumpping all TRBs per request in this commit.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

It needs to use request->num_mapped_sgs to indicate mapped sg number,
the request->num_sgs is the sg number before the mapping. These two
entries have different values for the platforms which iommu or
swiotlb is used. Besides, it needs to use correct sg APIs for
mapped sg list for TRB assignment.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

If cdns3_gadget_start is failed, it never frees cdns3_device structure.
Meanwhile, there is no release function for gadget device, it causes
there is no sync with driver core.

To fix this, we add release function for gadget device, and free
cdns3_device structure at there. Meanwhile, With the new UDC core
APIs, we could work with driver core better to handle memory leak
issue.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

It is found by sparse.
Reported-by: Nkbuild test robot <lkp@intel.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

After commit f4cfe5ce ("usb: cdns3: gadget: improve the
set_configuration handling"), the software will inform the
hardware the request has finished at cdns3_ep0_complete_setup.
The configuration set bit is only set after request has finished,
so it needs to move waiting operation after that. Meanwhile,
if it is timeout, it will show warning message and return error.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Some PHYs may need to enter related mode, and do some settings.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

It is meaningless to handle any interrupts after disconnecting
with host
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Below is the recommendation from Cadence designer:
	Using this bit to be sure that PHY clock is keeping up in active
	state. It's good to keep Fast Access bit enabled as long as there
	is any access to USB register.

It is used to fix the potential ARM core hang when visit controller
register after DEVDS (.pullup is cleared) is set, the threaded irq
may be scheduled at that time.

Cc: Pawel Laszczak <pawell@cadence.com>
Reviewed-by: NJun Li <jun.li@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

If the board uses role switch class for switching the role, it should
not depends on SoC OTG hardware siginal any more, so quit early.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

USB2.0 PHY hangs in Rx Compliance test when the incoming packet
amplitude is varied below and above the Squelch Level of
Receiver during the active packet multiple times.

Version 1 of the controller allows PHY to be reset when RX fail condition
is detected to work around the above issue. This feature is
disabled by default and needs to be enabled using a bit from
the newly added PHYRST_CFG register. This patch enables the workaround.

There is no way to know controller version before device controller
is started and the workaround needs to be applied for both host and
device modes, so we rely on a DT property do decide when to
apply the workaround.
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Add imx glue layer runtime pm implementation, and the runtime
pm is default off.
Reviewed-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Introduce runtime PM and wakeup interrupt handler for cdns3,
the runtime PM is default off since other cdns3 may not
implement glue layer support for runtime PM.

One typical wakeup event use case is xHCI runtime suspend will clear
USBCMD.RS bit, after that the xHCI will not trigger any interrupts,
so its parent (cdns core device) needs to resume xHCI device when
any (wakeup) events occurs at host port.

When the controller is in low power mode, the lpm flag will be set.
The interrupt triggered later than lpm flag is set considers as
wakeup interrupt and handled at cdns_wakeup_irq. Once the wakeup
occurs, it first disables interrupt to avoid later interrupt
occurrence since the controller is in low power mode at that
time, and access registers may be invalid at that time. At wakeup
handler, it will call pm_request_resume to wakeup xHCI device, and
at runtime resume handler, it will enable interrupt again.

The API platform_suspend is introduced for glue layer to implement
platform specific PM sequence.
Reviewed-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Since we have both USB2 and USB3 PHYs for cdns3 controller, it is
better we have unity APIs to handle both USB2 and USB3's power, it
could simplify code for error handling and further power management
implementation.
Reviewed-by: NPawel Laszczak <pawell@cadence.com>
Reviewed-by: NJun Li <jun.li@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

The interrupt may occur during the gadget deletion, it fixes the
below oops.

[ 2394.974604] configfs-gadget gadget: suspend
[ 2395.042578] configfs-gadget 5b130000.usb: unregistering UDC driver [g1]
[ 2395.382562] irq 229: nobody cared (try booting with the "irqpoll" option)
[ 2395.389362] CPU: 0 PID: 301 Comm: kworker/u12:6 Not tainted 5.8.0-rc3-next-20200703-00060-g2f13b83cbf30-dirty #456
[ 2395.399712] Hardware name: Freescale i.MX8QM MEK (DT)
[ 2395.404782] Workqueue: 2-0051 tcpm_state_machine_work
[ 2395.409832] Call trace:
[ 2395.412289]  dump_backtrace+0x0/0x1d0
[ 2395.415950]  show_stack+0x1c/0x28
[ 2395.419271]  dump_stack+0xbc/0x118
[ 2395.422678]  __report_bad_irq+0x50/0xe0
[ 2395.426513]  note_interrupt+0x2cc/0x38c
[ 2395.430355]  handle_irq_event_percpu+0x88/0x90
[ 2395.434800]  handle_irq_event+0x4c/0xe8
[ 2395.438640]  handle_fasteoi_irq+0xbc/0x168
[ 2395.442740]  generic_handle_irq+0x34/0x48
[ 2395.446752]  __handle_domain_irq+0x68/0xc0
[ 2395.450846]  gic_handle_irq+0x64/0x150
[ 2395.454596]  el1_irq+0xb8/0x180
[ 2395.457733]  __do_softirq+0xac/0x3b8
[ 2395.461310]  irq_exit+0xc0/0xe0
[ 2395.464448]  __handle_domain_irq+0x6c/0xc0
[ 2395.468540]  gic_handle_irq+0x64/0x150
[ 2395.472295]  el1_irq+0xb8/0x180
[ 2395.475436]  _raw_spin_unlock_irqrestore+0x14/0x48
[ 2395.480232]  usb_gadget_disconnect+0x120/0x140
[ 2395.484678]  usb_gadget_remove_driver+0xb4/0xd0
[ 2395.489208]  usb_del_gadget+0x6c/0xc8
[ 2395.492872]  cdns3_gadget_exit+0x5c/0x120
[ 2395.496882]  cdns3_role_stop+0x60/0x90
[ 2395.500634]  cdns3_role_set+0x64/0xd8
[ 2395.504301]  usb_role_switch_set_role.part.0+0x3c/0x90
[ 2395.509444]  usb_role_switch_set_role+0x20/0x30
[ 2395.513978]  tcpm_mux_set+0x60/0xf8
[ 2395.517470]  tcpm_reset_port+0xa4/0xf0
[ 2395.521222]  tcpm_detach.part.0+0x44/0x50
[ 2395.525227]  tcpm_state_machine_work+0x8b0/0x2360
[ 2395.529932]  process_one_work+0x1c8/0x470
[ 2395.533939]  worker_thread+0x50/0x420
[ 2395.537603]  kthread+0x148/0x168
[ 2395.540830]  ret_from_fork+0x10/0x18
[ 2395.544399] handlers:
[ 2395.546671] [<000000008dea28da>] cdns3_wakeup_irq
[ 2395.551375] [<000000009fee5c61>] cdns3_drd_irq threaded [<000000005148eaec>] cdns3_drd_thread_irq
[ 2395.560255] Disabling IRQ #229
[ 2395.563454] configfs-gadget gadget: unbind function 'Mass Storage Function'/000000000132f835
[ 2395.563657] configfs-gadget gadget: unbind
[ 2395.563917] udc 5b130000.usb: releasing '5b130000.usb'

Fixes: 7733f6c3 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: <stable@vger.kernel.org>
Acked-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Use devm_platform_ioremap_resource_byname() to simplify code

Cc: Peter Chen <peter.chen@nxp.com>
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NChunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/1595404275-8449-3-git-send-email-chunfeng.yun@mediatek.comSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Patch split function cdns3_drd_switch_gadget and
cdns3_drd_switch_host into:
- cdns3_drd_host_on
- cdns3_drd_host_off
- cdns3_drd_gadget_on
- cdns3_drd_gadgett_off

These functions don't have any shared code so it's better to
have smaller, faster and easier functions.
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Some error code can be preserved, so we can remove overwriting
error code returned by some functions.
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Patch removes 'goto not_otg' instruction from
cdns3_hw_role_state_machine function.
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Patch adds 2 definitions that make it easier to understand the code.
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Patch changes return type from int to bool for
cdns3_is_host and cdns3_is_device functions.
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

IRQ_NONE can be returned indirect.
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Patch deletes unnecessary != from condition statement in cdns3_drd_init
function.
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Patch remove some variables initialization from core.c and drd.c
file.
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Function is not used in driver so it can be removed.
Signed-off-by: NPawel Laszczak <pawell@cadence.com>
Reviewed-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

During the endpoint dequeue operation, it changes dequeued TRB as link
TRB, when the endpoint is disabled and re-enabled, the DMA fetches the
TRB before the link TRB, after it handles current TRB, the DMA pointer
will advance to the TRB after link TRB, but enqueue and dequene
variables don't know it due to no hardware interrupt at the time, when
the next TRB is added to link TRB position, the DMA will not handle
this TRB due to its pointer is already at the next TRB. See the trace
log like below:

file-storage-675   [001] d..1    86.585657: usb_ep_queue: ep0: req 00000000df9b3a4f length 0/0 sgs 0/0 stream 0 zsI status 0 --> 0
file-storage-675   [001] d..1    86.585663: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr (null)], flags:0 SID: 0
file-storage-675   [001] d..1    86.585671: cdns3_prepare_trb: ep1out: trb 000000007f770303, dma buf: 0xbd195800, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
file-storage-675   [001] d..1    86.585676: cdns3_ring:
            Ring contents for ep1out:
            Ring deq index: 0, trb: 000000007f770303 (virt), 0xc4003000 (dma)
            Ring enq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
            free trbs: 38, CCS=1, PCS=1
            @0x00000000c4003000 bd195800 80020400 00000425
            @0x00000000c400300c c4003018 80020400 00001811
            @0x00000000c4003018 bcfcc000 0000001f 00000426
            @0x00000000c4003024 bcfce800 0000001f 00000426

	    ...

 irq/144-5b13000-698   [000] d...    87.619286: usb_gadget_giveback_request: ep1in: req 0000000031b832eb length 13/13 sgs 0/0 stream 0 zsI status 0 --> 0
    file-storage-675   [001] d..1    87.619287: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr 0x80020400c400300c], flags:0 SID: 0
    file-storage-675   [001] d..1    87.619294: cdns3_prepare_trb: ep1out: trb 0000000049c1ba21, dma buf: 0xbd198000, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
    file-storage-675   [001] d..1    87.619297: cdns3_ring:
                Ring contents for ep1out:
                Ring deq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
                Ring enq index: 2, trb: 0000000059b34b67 (virt), 0xc4003018 (dma)
                free trbs: 38, CCS=1, PCS=1
                @0x00000000c4003000 bd195800 0000001f 00000427
                @0x00000000c400300c bd198000 80020400 00000425
                @0x00000000c4003018 bcfcc000 0000001f 00000426
                @0x00000000c4003024 bcfce800 0000001f 00000426
		...

    file-storage-675   [001] d..1    87.619305: cdns3_doorbell_epx: ep1out, ep_trbaddr c4003018
    file-storage-675   [001] ....    87.619308: usb_ep_queue: ep1out: req 000000002ebce364 length 0/1024 sgs 0/0 stream 0 zsI status -115 --> 0
 irq/144-5b13000-698   [000] d..1    87.619315: cdns3_epx_irq: IRQ for ep1out: 01000c80 TRBERR , ep_traddr: c4003018 ep_last_sid: 00000000 use_streams: 0
 irq/144-5b13000-698   [000] d..1    87.619395: cdns3_usb_irq: IRQ 00000008 = Hot Reset

Fixes: f616c3bd ("usb: cdns3: Fix dequeue implementation")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

It doesn't need to enable/disable L1 on the fly for EP0 transfer,
we only need to enable L1 after SET_CONFIGURATION.

This code may be introduced by careless.

Cc: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

- Delete the duplicated EP_CMD_ERDY and EP_CMD_REQ_CMPL setting
- Prepare the next setup before setting EP_CMD_ERDY and EP_CMD_REQ_CMPL,
it could avoid a bug that DMA hang at EP0 OUT for DEV_VER_NXP_V1
- Delete the duplicated cdns3_set_hw_configuration calling at
cdns3_req_ep0_set_configuration, the composite.c will handle
this request, and call .ep0_queue back, and at .ep_queue it will
call cdns3_set_hw_configuration.
- Move cdns3_allow_enable_l1 into cdns3_set_hw_configuration since
it is part of this function.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Rationale:
Reduces attack surface on kernel devs opening the links for MITM
as HTTPS traffic is much harder to manipulate.

Deterministic algorithm:
For each file:
  If not .svg:
    For each line:
      If doesn't contain `\bxmlns\b`:
        For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
	  If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
            If both the HTTP and HTTPS versions
            return 200 OK and serve the same content:
              Replace HTTP with HTTPS.
Signed-off-by: NAlexander A. Klimov <grandmaster@al2klimov.de>
Link: https://lore.kernel.org/r/20200719160910.60018-1-grandmaster@al2klimov.deSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-throughSigned-off-by: NGustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20200707195607.GA4198@embeddedorSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

It is found by sparse.
Reported-by: Nkbuild test robot <lkp@intel.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

It is found by sparse.
Reported-by: Nkbuild test robot <lkp@intel.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>