diag: Add support for QSC restart

Add cleanup of SMUX port once disconnect event is
received by diagfwd driver.

CRs-Fixed: 376401
Change-Id: I5ef07c8ccbfcc4ad6c5e41b3d985bdea434ab9ce
Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org>

Conflicts:

	drivers/char/diag/diagchar.h

Signed-off-by: Seongmin Park <r_data@naver.com>
diag: Increase HSIC throughput by implementing multiple simultaneous reads

The HSIC implementation has been found to be too slow causing
the dropping of logs. The HSIC implementation is using a one-in-one-out
read buffer strategy. This strategy coupled with the high latency of
callbacks is leading to poor throughput, and thus the dropping of
logs. Modify the implementation to queue up multiple simultaneous
read requests on the HSIC. Manage these read buffers using a memory
pool.

Change-Id: I7cf334f54ebc41d0e222732e4cf68e158f015c67
CRs-Fixed: 373328
Signed-off-by: Dixon Peterson <dixonp@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: diag_bridge: call bridge callbacks even for -EPROTO

The diagfwd_hsic driver acts as a client of the bridge and must
have its read/write callbacks called so it can properly free its
memory buffers. In the case of the HSIC device being disconnected,
the URB status is -EPROTO but the callback was withheld, which
led to lost buffers when the HSIC device is disconnected. Fix this
by always calling the callbacks, while continuing to treat -EPROTO
as a special case by returning -ENODEV on subsequent reads and
writes. Also fix a major but tiny gotcha in diagfwd's read function
in which the 'err' variable is additionally declared and used in a
local scope but is read outside it.

CRs-fixed: 394401
Change-Id: I2d4f7a2cf1caa5565d4131890fa39181aee8e4a2
Signed-off-by: Jack Pham <jackp@codeaurora.org>

Conflicts:

	drivers/usb/misc/diag_bridge.c

Signed-off-by: Seongmin Park <r_data@naver.com>
diag: fix hsic concurrency issue when in MEMORY_DEVICE_MODE

When the logging mode changes to MEMORY_DEVICE_MODE, an array
is used to house the pointers to the data read from the hsic
until the data can be copied to user space. Since the storing
and copying actions access this array in different threads,
access to this array can result in concurrent access by these
threads. Note that the storing access to the array happens in
interrupt context and the copying access happens in process
context.  Use spin_locks to protect agains this concurrency
issue.

Also, there is unnecessary queuing of the hsic read work function
on the work queue. Add checks to remove this unnecessary queuing.

Change-Id: I2835435200bca4086d34c0dfb6e88da473dfff1f
Signed-off-by: Dixon Peterson <dixonp@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
diag: hsic: Fix improper opening/closing of diag_bridge

diag_bridge_open/close should not be called multiple times, as it
would incorrectly increase/decrease the internal reference counter.
This could respectively lead to either a stale device structure when
HSIC is disconnected, or a NULL pointer when HSIC is reconnected.

Fix this by adding a check in the bridge open routine to disallow
further calls if the bridge is already open, and similarly in close
to no-op if the bridge isn't open. Also add a mutex to the diagfwd
driver to serialize access to the various state variables such as
hsic_device_enabled and hsic_device_opened and to prevent near-
simultaneous calls to diag_bridge_open. In particular, the platform
device probe (or remove) and the callback for cable connect
(disconnect) could potentially execute concurrently; only one should
"win" calling diag_bridge_open (or close) successfully.

CRs-fixed: 395637
Change-Id: I5674285065cd63f89bf657cad770f04d53efb247
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
diag: Rate limit usb write error messages for hsic data

When writing hsic data on the usb (usb_diag_write) the device
can get into the state where an error is returned each time.
If this happens, then the device is flooded with these messages.
Prevent the flooding with messages by rate limiting the error
message.

Change-Id: I0cbec8680197e2f678b336f9b9d4ed49b4c2a91a
Signed-off-by: Dixon Peterson <dixonp@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: gadget: Send zero-length packets on bulk IN

Set the flag that enables the usb device controller to
send zero-length packet if the payload size is a multiple
of the max packet size. For such payload size if zero length
packet is not sent, IP packet received by host driver after
transfer completion will be a corrupted IP packet which will
be dropped by network layer. This results in downlink data
stall.

Change-Id: Ica99e0be7f18f27f7a77c31526f51d88df4682ec
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
USB: mdm_bridge: Fix a possible freed memory access

When tethered rmnet/dun interface probe is failed, the bridge channel
platform device is removed in error path.  The gadget driver schedule
a work to open the bridge channel in probe.  Cancel this work in remove
before closing the channel.

Cancel any pending work while closing the bridge.  Otherwise there is
a possibility of rx work running in parallel with probe error path.  If
this happens, rx work access already freed memory.

CRs-Fixed: 442119
Change-Id: I41adb997e7f13a7a5acac99762a2f3ce81ccb178
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: gadget: Unclaim endpoints upon disconnect

HSIC data driver is not setting endpoint driver data to NULL
upon disconnect. This causes endpoints to remain claimed at
the time of function driver unbind. Endpoints will remain
unusable when driver bind happens later. This can result in
function bind failure due to lack of available(unclaimed)
endpoints if there is a series of driver unbind and bind
happens. Hence after disabling endpoint set driver data of
the endpoint to NULL upon disconnect.

CRs-Fixed: 449814
Change-Id: I8656e15ac26dfc6f4f6679b7ee2bba0bf935f0d6
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
diagchar.h: Fix build error

Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Check for received data upon unlinking the urb

There is a possibility of runtime suspend in the middle of
data transfer on the rx data path of driver. This results in
the completion of data transfer on bulk IN endpoint with short
packet or integral multiple of 512 bytes. Hence for -ENOENT
transfer status check for non-zero data length and pass it to
the consumer in the userspace. Also, replace printk with
DBG-level message in driver suspend function and in rx
callback function for -EPROTO urb status.

CRs-Fixed: 394954
Change-Id: I26f4081869377000d163649b3a860386ff9c3806
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Add support for autosuspend

ks bridge driver needs to add support for autosuspend
for 9008 PID. This change allows for the device to be
suspended when there is no active traffic, and USB
remote wakeup is used to signal a resume to the host.

CRs-Fixed: 397969
Change-Id: Id4f1083c7f136e027778c1d6b08f3b3a6048f7e7
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Fix memory leak in tx data path

ks bridge is allocating urb to transmit data to mdm.
This urb is not getting freed after transmit completes.
Hence call usb_free_urb() after urb gets submitted
successfully. Urb will eventually be freed after tx
completion.

CRs-Fixed: 401536
Change-Id: I7e0bc7d1de74613f6b3b019d1513e22ad9765709
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Fix bug in partial read on data buffer

If driver copies only partial data buffer to user space
it does not update the buffer pointer. In this case
buffer pointer is still pointing to the already read
buffer and will be copied again in next read request
from user space. This corrupts the contents of the
efs file or ram dump files. Hence update data buffer
pointer with length of memory read completed by user
space.

CRs-Fixed: 403250
Change-Id: I48217aeeb2ee5ad05089922c6a7793195b95ce0c
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Synchronize disconnect with ongoing IO

Following scenarios possible for interface disconnect racing
with ongoing IO:-

1) Interface disconnect setting interface pointer to NULL and
rx work is executing on other core dereferencing interface
pointer, causing kernel panic. Cancel a work and wait for it
to finish during disconnect.

2) Interface disconnect setting interface pointer to NULL and
tx completion running on other core dereferencing interface
pointer while calling usb_autopm_put_interface_async() API.
Check for USB_DEV_CONNECTED flag(cleared at the time of
disconnect) before dereferencing the interface pointer.

3) Interface unbound and driver is accessing already freed
interface pointer in tx completion or usb device pointer to
re-submit rx urb in rx completion. Add rx and tx urb pending
counters and wait for them to become zero (or timeout) during
disconnect.

Change-Id: I75c0284136dda8b0e1b76c326e80e0c3efb41d5c
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Free up stale buffers in probe

Driver can add data buffer to the link list of rx/tx
buffers after emptying the list during disconnect.
These stale buffers can confuse efs sync server when
mdm device connects back. Hence free up the rx/tx
buffers again during probe. Avoid further addition of
tx buffers after disconnect by checking device
connection status in write API. Also, move
misc_deregister() after cancelling the work in order
to remove device node early during disconnect to avoid
any write call further.

Change-Id: I0641669afcf1e1aec36d7c619dc8922495f446d0
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
HSIC: Add support for product id 9075

Product Id 0x9075 includes DIAG, SER3(System monitor), SER4(EFS sync),
DUN, CSVT, NET1(Tethered RmNet) + NET2(Muxed Embedded RmNet) device
interfaces.

Change-Id: I75f61445af0ff9eab3d8f22bc2239011a9495e0e
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Avoid allocating large buffers in atomic context

The current code allocates a new Rx buffer in Rx completion handler.
Rx buffers are freed after user space consumes them.  This results in
allocating larger buffers in atomic context which may fail some times.
Don't queue the Rx buffer immediately. Defer it till user space consumes
it and reuse the same buffer.  The test results indicate no throughput
degradation.  The Rx buffers will be freed when interface is suspended
or disconnected.

CRs-Fixed: 430595
Change-Id: I8e69e27df2e11b38497e0384a8edd87ecedcb24b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Add efs sync support for PID 0x9075

Driver needs to claim efs sync interface for PID 0x9075
at the time of driver probe.

Change-Id: Idd637aa04eab7babe509a4fbfc3671555dcca189
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>
usb: ks_bridge: Limit write size to 16KB

The user space application writes in 1MB chunks while loading MDM
images.  The current code allocate as many bytes as user space
passed to write system call.  These allocations are failing under
memory fragmentation scenario.  Hence limit write size to 16KB.

CRs-Fixed: 434638
Change-Id: Ibfad0f13c1fb2c30342d2435114001c580143292
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Seongmin Park <r_data@naver.com>