usb: mdm_ctrl_bridge: Do not unlink URB upon cable disconnect

MDM control bridge driver unlinks the pending URBs when control
bridge gets closed as a result of usb cable disconnect. Driver
sends set_control_line_state request to MDM upon bridge close.
Right after sending the setup request driver unlinks the pending
URBs. In case if the URB is unlinked after setup stage is completed,
status stage remains pending. This results in a control transfer
stall. Similarly, when the bridge is reopened as a result of USB
cable plug-in, the interrupt URB is not resubmitted, which can also
lead to a QMI stall since the MDM is waiting indefinitely to send
its response available notification. Fix these two potential stall
conditions by not unlinking URBs upon cable disconnect; this will
allow in-progress control transfers to finish gracefully and will
also allow notification interrupts to always be handled. Unlinking
of the URBs will happen during MDM device disconnect, instead of
upon bridge close.

CRs-Fixed: 419128,418478
Change-Id: I81690b2fd9e56b8f05a14945b0063080ca6dbd7b
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
USB: mdm_bridge: Fix a possible freed memory access

When tethered rmnet/dun interface probe is failed, the bridge channel
platform device is removed in error path.  The gadget driver schedule
a work to open the bridge channel in probe.  Cancel this work in remove
before closing the channel.

Cancel any pending work while closing the bridge.  Otherwise there is
a possibility of rx work running in parallel with probe error path.  If
this happens, rx work access already freed memory.

CRs-Fixed: 442119
(cherry picked from commit 50f3815166483c654ebb325c49e50af4e31547da)

Change-Id: I78c2ee04cfd083248127cfd6b9f07994087729ca
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
usb: mdm_bridge: Increase the number of rx urbs

Due to higher HSIC interrupt threshold value, sometimes
driver is running short of enough rx urbs queued to HSIC
HW to receive IP packets from mdm device. In this case
driver is busy processing large number of completed rx
urbs and left with fewer pending urbs with HW. This causes
occasional throughput drops on rx data path. Hence increase
number of rx urb from 50 to 100, to keep HSIC HW busy in
pulling data from mdm device while completed urbs are getting
processed.

(cherry picked from commit e8f691f60db39b50951148c3e68ae35c89cdd397)
CRs-Fixed: 397809
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>

Change-Id: I590c203551c5ac83a71b8628d195f2a15840edf1
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
usb: mdm_bridge: Fix race between disconnect and I/O completion handler

There is a possibility of race between device disconnect and I/O
completion handler. In this case disconnect frees bridge device
memory in thread context and I/O completion handler uses already
freed bridge device memory in interrupt context. Hence allocate
bridge device memory at the time of driver load and free it
during unload. Also, do not anchor interrupt and read urb and
unlink them synchronously to avoid accessing transfer buffers
associated to these urbs when driver disconnect frees them.

Guard the race condition by:-
1) Adding check for usb device disconnect state in the I/O
completion handler to avoid further processing I/O completion.

2) Unlinking tx urbs synchronously since asynchronous unlinking
results in the same race condition.

CRs-Fixed: 447591
Change-Id: Iae4c2a1920c16fcf3e1728144a7cfe6ca66c7705
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: mdm_bridge: Simplify data bridge suspend/resume path

Synchronous runtime PM API is used to increment the PM usage counter
in Tx path.  It means Tx data path will not race with interface suspend.
Remove "delayed" anchor which is meant for Tx requests, that are arrived
during suspend.  There is no point in distinguishing auto suspend and
system wide suspend.  Abort suspend when we have pending Tx URBs.

CRs-Fixed: 451414
Change-Id: I302b120ccecfe30db1ebd2b1fcd9945a3675cf83
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
USB: mdm_bridge: Fix control bridge suspend

The current code does not abort suspend when there are pending URBs.
They are simply killed during suspend. This may lead to QMI stall.
Add proper checks to ensure that there is no pending Tx/Rx data
during suspend.  Clear the "SUSPENDED" flag in resume only after
taking out all the URBs from "tx_deferred" anchor.

CRs-Fixed: 451414
Change-Id: Icc48afc5eeedcc126d0ab1bec951bde4a53ac165
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
usb: diag_bridge: Fix NULL pointer crash during disconnect

DIAG I/O could be executing concurrently when the device/interface
is disconnected. In such cases the usb_interface pointer could
become NULL while the read or write functions are about to access
it. Prevent these NULL pointer dereferences by guarding the
pointer with a mutex.

Change-Id: I0e2660dc53dae811e0a8686e69636808281ec53c
CRs-fixed: 393826
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
usb: diag_bridge: call bridge callbacks even for -EPROTO.

The diagfwd_hsic driver acts as a client of the bridge and must
have its read/write callbacks called so it can properly free its
memory buffers. In the case of the HSIC device being disconnected,
the URB status is -EPROTO but the callback was withheld, which
led to lost buffers when the HSIC device is disconnected. Fix this
by always calling the callbacks, while continuing to treat -EPROTO
as a special case by returning -ENODEV on subsequent reads and
writes. Also fix a major but tiny gotcha in diagfwd's read function
in which the 'err' variable is additionally declared and used in a
local scope but is read outside it.

CRs-fixed: 394401
Signed-off-by: Jack Pham <jackp@codeaurora.org>

Conflicts:

	drivers/usb/misc/diag_bridge.c

Change-Id: Ic40e43555ba557ac0caf3abfd3b8e372eb522003
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
Merge https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm.git;a=commit;h=0a405a144cf8e4ded7af9a4d25cffbc1db294244

Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>