usb: ks_bridge: Check for received data upon unlinking the urb

There is a possibility of runtime suspend in the middle of
data transfer on the rx data path of driver. This results in
the completion of data transfer on bulk IN endpoint with short
packet or integral multiple of 512 bytes. Hence for -ENOENT
transfer status check for non-zero data length and pass it to
the consumer in the userspace. Also, replace printk with
DBG-level message in driver suspend function and in rx
callback function for -EPROTO urb status.

Change-Id: Id7f9602e61e98f5bbd38c2f2f8121616b5661591
CRs-Fixed: 394954
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: ks_bridge: Fix bug in partial read on data buffer

If driver copies only partial data buffer to user space
it does not update the buffer pointer. In this case
buffer pointer is still pointing to the already read
buffer and will be copied again in next read request
from user space. This corrupts the contents of the
efs file or ram dump files. Hence update data buffer
pointer with length of memory read completed by user
space.

(cherry picked from commit b48f4737ac62a5c26b59eea59322186179c06ab0)

Change-Id: Ibc2a248394b1fd3ece7cef6a94e99e27dc4f9575
CRs-Fixed: 403250
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: ks_bridge: Fix memory leak in tx data path.

ks bridge is allocating urb to transmit data to mdm.
This urb is not getting freed after transmit completes.
Hence call usb_free_urb() after urb gets submitted
successfully. Urb will eventually be freed after tx
completion.

CRs-Fixed: 401536
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
(cherry picked from commit 1432f6f448bb2231499ef989f9e1ec314e9817d9)

Change-Id: I0ec244b6bff35aa1e59b39735ec867be39c4d221
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
usb: ks_bridge: Avoid allocating large buffers in atomic context

The current code allocates a new Rx buffer in Rx completion handler.
Rx buffers are freed after user space consumes them.  This results in
allocating larger buffers in atomic context which may fail some times.
Don't queue the Rx buffer immediately. Defer it till user space consumes
it and reuse the same buffer.  The test results indicate no throughput
degradation.  The Rx buffers will be freed when interface is suspended
or disconnected.

CRs-Fixed: 430595
Change-Id: I8e69e27df2e11b38497e0384a8edd87ecedcb24b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
(cherry picked from commit 5c915c1949b79bc59d2b222bfcce02cd429619b2)
usb: ks_bridge: Limit write size to 16KB

The user space application writes in 1MB chunks while loading MDM
images.  The current code allocate as many bytes as user space
passed to write system call.  These allocations are failing under
memory fragmentation scenario.  Hence limit write size to 16KB.

CRs-Fixed: 434638
(cherry picked from commit 7fcc7799af7ace4c4eda229b0eac6448f98d6637)

Conflicts:

	drivers/usb/misc/ks_bridge.c

Change-Id: I224cf201d724642f99e29874c4c5366ad773131e
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ks_bridge: Fix PM usage counter mismatch

The runtime PM is disabled for a device during suspend.  It is
enabled again just before resuming  the device.  The resume method
of USB interface drivers are called while resuming a USB device.  As
USB device is the parent of an interface, the interface resume is
blocked till USB device resume is completed.  If interface driver
call any runtime PM API before interface runtime PM is enabled, it
fails with -EACCESS error.

The USB runtime wrapper usb_autopm_get_interface() decrements PM usage
counter when get_sync() is failed.  The current code is decrementing
the PM usage counter even when an error code is returned from
usb_autopm_get_interface().  Due to this double decrementing, the KS
bridge interface PM usage counter is becoming negative after several
suspend and resume cycles.  Once the PM usage counter becomes negative,
the interface runtime PM state will never become active.  That means,
USB device suspend can happen even when a Tx URB is pending from ks
bridge driver.

The fix is trivial.  Don't decrement PM usage counter when error code
is returned from usb_autopm_get_interface().

(cherry picked from commit 361d9af92470ebeeb0a42f73e6eb457ab279b282)

Conflicts:

	drivers/usb/misc/ks_bridge.c

CRs-Fixed: 437214
Change-Id: I96c9e1797c137cd158c424ebf6342f607cee6d78
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: ks_bridge: Fix memory leaks in the driver.

This change addresses two memory leaks:-
1) misc device is not getting deregistered during device
disconnect. Hence call misc_deregister() in disconnect.

2) Driver returns without freeing previous instances of
the driver data structure if memory allocation fails. Hence
free up memory allocated for ks_bridge structure.

Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
(cherry picked from commit da86bd2faa9cfbf065c7a1f0adba124d7e8335e0)

Conflicts:

	drivers/usb/misc/ks_bridge.c

Change-Id: I5e1c357fa29b455bae5f3dc71b4d65d5cc216bb3
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
usb: ks_bridge: Add support for multiple instance of driver

ks bridver needs to get loaded for two mdm9x15 device enumeration
to support flashless boot and efs sync.

Change-Id: Iabeab32f05592032b13ec6ab28da67093cc23531
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Shashank Mittal <mittals@codeaurora.org>
usb: ks_bridge: Synchronize disconnect with ongoing IO

Following scenarios possible for interface disconnect racing
with ongoing IO:-

1) Interface disconnect setting interface pointer to NULL and
rx work is executing on other core dereferencing interface
pointer, causing kernel panic. Cancel a work and wait for it
to finish during disconnect.

2) Interface disconnect setting interface pointer to NULL and
tx completion running on other core dereferencing interface
pointer while calling usb_autopm_put_interface_async() API.
Check for USB_DEV_CONNECTED flag(cleared at the time of
disconnect) before dereferencing the interface pointer.

3) Interface unbound and driver is accessing already freed
interface pointer in tx completion or usb device pointer to
re-submit rx urb in rx completion. Add rx and tx urb pending
counters and wait for them to become zero (or timeout) during
disconnect.

CRs-Fixed: 448142
Change-Id: I50341173b94200bcfa60715b4b26b2117fc37c2c
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: ks_bridge: Free up stale buffers in probe

Driver can add data buffer to the link list of rx/tx
buffers after emptying the list during disconnect.
These stale buffers can confuse efs sync server when
mdm device connects back. Hence free up the rx/tx
buffers again during probe. Avoid further addition of
tx buffers after disconnect by checking device
connection status in write API. Also, move
misc_deregister() after cancelling the work in order
to remove device node early during disconnect to avoid
any write call further.

CRs-Fixed: 448142
Change-Id: Ifff58d2adc113257809eb80b7f91c1a0f4a0adeb
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ks_bridge: Prevent freeing buffers while copy is in progress

The completed read buffers are added to to_ks_list in Rx URB
completion handler.  The buffer is deleted from this list by
reader process after copying to user space buffer.  If disconnect
happens during this copy, the buffer is freed from disconnect
context.  Hence detach the buffer from to_ks_list before copying
to user space buffer.

CRs-Fixed: 448142
Change-Id: Ia4484b2709065162b0d32782a30e2b2fd36f5fda
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ks_bridge: Abort suspend when data is received during unlink

All the submitted URBs are unlinked during suspend.  Abort suspend
if data is received during unlink.  This avoids unnecessary suspend
and resume of remaining interfaces.

CRs-Fixed: 449097
Change-Id: Ia4009775ec29df0222b475581649c3a9f4f1899f
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ks_bridge: Enable autosuspend only for remote wakeup capable devices

USB core marks a device wakeup capable if it supports remote wakeup.
Check this wakeup capable flag before enabling autosuspend.

CRs-Fixed: 449100
Change-Id: I055bf5801859e4d83782916c71e0245c455becbf
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: mdm_ctrl_bridge: Do not unlink URB upon cable disconnect

MDM control bridge driver unlinks the pending URBs when control
bridge gets closed as a result of usb cable disconnect. Driver
sends set_control_line_state request to MDM upon bridge close.
Right after sending the setup request driver unlinks the pending
URBs. In case if the URB is unlinked after setup stage is completed,
status stage remains pending. This results in a control transfer
stall. Similarly, when the bridge is reopened as a result of USB
cable plug-in, the interrupt URB is not resubmitted, which can also
lead to a QMI stall since the MDM is waiting indefinitely to send
its response available notification. Fix these two potential stall
conditions by not unlinking URBs upon cable disconnect; this will
allow in-progress control transfers to finish gracefully and will
also allow notification interrupts to always be handled. Unlinking
of the URBs will happen during MDM device disconnect, instead of
upon bridge close.

(cherry picked from commit 77f79575ebe35f2ec329827290e7a67fb0e75286)
CRs-Fixed: 419128,418478

Change-Id: I5474372d832de2fd49f17faf77e7e549e80566ad
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: mdm_bridge: Increase the number of rx urbs

Due to higher HSIC interrupt threshold value, sometimes
driver is running short of enough rx urbs queued to HSIC
HW to receive IP packets from mdm device. In this case
driver is busy processing large number of completed rx
urbs and left with fewer pending urbs with HW. This causes
occasional throughput drops on rx data path. Hence increase
number of rx urb from 50 to 100, to keep HSIC HW busy in
pulling data from mdm device while completed urbs are getting
processed.

(cherry picked from commit e8f691f60db39b50951148c3e68ae35c89cdd397)
CRs-Fixed: 397809
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>

Change-Id: I590c203551c5ac83a71b8628d195f2a15840edf1
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
USB: mdm_bridge: Fix a possible freed memory access

When tethered rmnet/dun interface probe is failed, the bridge channel
platform device is removed in error path.  The gadget driver schedule
a work to open the bridge channel in probe.  Cancel this work in remove
before closing the channel.

Cancel any pending work while closing the bridge.  Otherwise there is
a possibility of rx work running in parallel with probe error path.  If
this happens, rx work access already freed memory.

CRs-Fixed: 442119
(cherry picked from commit 50f3815166483c654ebb325c49e50af4e31547da)

Change-Id: I78c2ee04cfd083248127cfd6b9f07994087729ca
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: mdm_bridge: Fix race between disconnect and I/O completion handler

There is a possibility of race between device disconnect and I/O
completion handler. In this case disconnect frees bridge device
memory in thread context and I/O completion handler uses already
freed bridge device memory in interrupt context. Hence allocate
bridge device memory at the time of driver load and free it
during unload. Also, do not anchor interrupt and read urb and
unlink them synchronously to avoid accessing transfer buffers
associated to these urbs when driver disconnect frees them.

Guard the race condition by:-
1) Adding check for usb device disconnect state in the I/O
completion handler to avoid further processing I/O completion.

2) Unlinking tx urbs synchronously since asynchronous unlinking
results in the same race condition.

CRs-Fixed: 447591
Change-Id: Iae4c2a1920c16fcf3e1728144a7cfe6ca66c7705
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Conflicts:
	drivers/usb/misc/mdm_ctrl_bridge.c
USB: mdm_bridge: Simplify data bridge suspend/resume path

Synchronous runtime PM API is used to increment the PM usage counter
in Tx path.  It means Tx data path will not race with interface suspend.
Remove "delayed" anchor which is meant for Tx requests, that are arrived
during suspend.  There is no point in distinguishing auto suspend and
system wide suspend.  Abort suspend when we have pending Tx URBs.

CRs-Fixed: 451414
Change-Id: I302b120ccecfe30db1ebd2b1fcd9945a3675cf83
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: mdm_bridge: Fix control bridge suspend

The current code does not abort suspend when there are pending URBs.
They are simply killed during suspend. This may lead to QMI stall.
Add proper checks to ensure that there is no pending Tx/Rx data
during suspend.  Clear the "SUSPENDED" flag in resume only after
taking out all the URBs from "tx_deferred" anchor.

CRs-Fixed: 451414
Change-Id: Icc48afc5eeedcc126d0ab1bec951bde4a53ac165
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
net: usb: Prevent suspend if response available notification received

cherry picked from 148c5323330bf41890392fe23e8983612ecb3580

There is a possibility of interface suspend after receiving response
available notification from mdm device. In this case driver unlinks
the rx urb and do not send GET_ENCAPSULATED_RESPONSE setup packet to
mdm. Response to mdm gets delayed up until interface resumes and mdm
sends response available notification again. Hence resume interface
after receiving response available notification if it is suspended.
Allow interface suspend only after completing
GET_ENCAPSULATED_RESPONSE.

Change-Id: Ib52e64b1cc7b6d5edfe3ada9651ec56526cf4852
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Conflicts:
	drivers/net/usb/rmnet_usb_ctrl.c
	drivers/net/usb/rmnet_usb_data.c