USB: gadget: composite: Don't enable endpoints if already enabled

As part of USBCV complaince, host sends set interface request
after set configuration request. This will reenable the endpoints
which are already enabled. This could cause WARN_ON message by
DCD. Hence check whether config is active or not and allow to call
function driver's set_alt if alternate setting is non zero.

CRs-Fixed: 486281
Change-Id: Id90c50f364b446329a38cd3b7389e4d0638d9023
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: android: Schedule work only if suspended variable is changed

currently as part of USB link status change event for U3 -> U0,
DWC3 controller driver is not calling driver resume. This results
in not updating suspended status in composite layer due to which
disconnect, configured and then disconnect events are sent to userspace.
This might cause problems for some userspace applications. Hence handle
USB link status event for resume by reverting the commit b217f5007d
("USB: dwc3: Don't handle USB/Link Status change event for RESUME").
Fix actual issue of disconnect sent during suspend/resume in android.c
by scheduling work only if the suspended status is changed to notify
userspace.

CRs-Fixed: 569639
Change-Id: If4fe6f3e8087d3bc972705ff40e4f94f597e2d09
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: android: Prevent change of host mac address of 'rndis0' interface

On windows 7 platform, previously allocated ip address is maintained.
However, Host MAC address of 'rndis0' interface is changed when the
tethering driver re-enumerated. Thus, the tethering network driver
can't be allocated ip address from dhcp. It causes connection delay
between host and phone for usb tethering.

This patch prevents from changing Host MAC address of 'rndis0' interface.
In other words, this patch maintains the Host MAC address allocated by
userspace although the driver is re-enumerated.

CRs-Fixed: 534083
Change-Id: I94176ec010fc2cf5c57c35ed31a311dd747200bd
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: gadget: rndis: Optimize tx path for better performance

Current rndis header addition and aggregation steps:
1. Increase skb headroom by size of rndis header.
2. Copy skb data with newly created skb having more headroom.
3. Create and add rndis header with it.
4. Again copy skb data with usb request buffer for aggregation purpose.

New optimized steps :
1. Create and copy rndis header directly with usb request buffer
2. Copy skb data with usb request buffer

Above new steps avoids cpu intensive skb operations which reduces CPU
usage and provide better throughput.

This change also assigns completion handle with usb request at the time
of usb request creation instead of assigning everytime before queueing
usb request.

CRs-Fixed: 551363
Change-Id: Ifc64d6a8573f6a24e28c73ef9a19b62649e171cd
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
USB: gadget: ether: Clean up req->buf to avoid wild pointer

When OOM, the req->buf will fail to get memory from kmalloc.
And all the req->buf in dev->tx_reqs will be freed in the
error handler. But they are not cleared to NULL. So they are
not allocated while below function got called again.

int alloc_tx_buffer(struct eth_dev *dev)
{
   list_for_each(act, &dev->tx_reqs) {
       if ((!req->buf)         ->3. it can't allocate again.
          req->buf = kmalloc();->1. it fails to get memory as OOM.
       if (!req->buf)
          goto free_buf;
        ...
   }
   return 0;
free_buf:
   ...
   kfree(req->buf);             ->2. It's freed.
   return -ENOMEM;
}
So these pointers will be freed multi times. What's worse,
once they are used as normally, system maybe be panic due to
wild pointer.
CRs-fixed: 571628
Change-Id: I96eb21553eb4840c02331d68056ea0eca9a25552
Signed-off-by: Figo Wang <figow@codeaurora.org>>
ASoC: msm: qdsp6v2: Clear ION handle after freeing

Once ion memory is freed ion handle should be set to
NULL to avoid double free or any unintended access.
This change clears the ION handle after freeing up
the memory.

Change-Id: I37d76fe2641c111fa4376eff8f7e45f6795414ca
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
msm: usb: Add multi-lun support for UMS

UMS(usb mass storage) need a new lun for internal
storage.So add a new lun number for internal mass storage.

Change-Id: I17ccb8f85d458567a1f1b35366b8b0834397601f
Signed-off-by: Jin Wu <jinw@codeaurora.org>
usb: gadget: Allow non-default and non-zero ITC value

Allow setting ITC value provided from device tree. In case no value
provided from device tree, check the CI13XXX_ZERO_ITC flag, and
if set use the value of 0 as the ITC.

Change-Id: I9333124913b7ae737eabc8eb5d154d99ac184ee8
Signed-off-by: Amit Blay <ablay@codeaurora.org>
usb: gadget: bam_data: Wait for BAM reset only on A2 BAM

Previous change 'usb: gadget: Fix race condition in connect/disconnect'
introduced a bug which adds unnecessary delay waiting for bam
reset completion after usb cable disconnection. BAM reset completion
is not needed for IPA bam type. Fix it by waiting for bam reset only
for A2 bam.

Change-Id: I491e5ff561b226711ec80d281a3c7dbb91a91f96
CRs-Fixed: 503808
Signed-off-by: Bar Weiner <bweiner@codeaurora.org>
usb: gadget: u_bam: Lock access to port_usb in start/stop transfers

Add protection to access to port_usb fields in start/stop transfers.
Otherwise the functions might compete with disconnect sequence
and null dereference might occur.

Change-Id: I7e62ddd98adc414cadf426daae900c5db04939ee
Signed-off-by: Lena Salman <esalman@codeaurora.org>
usb: dwc3-msm: remove use of global context variable (DBM)

Remove usage of the global context variable in the gadget and DBM
functions by passing a dwc3_msm pointer directly.  This will allow
the driver to eventually support multiple instances.

Change-Id: I0fdc5d703b3fd445e83226534f07743461c96f4c
Signed-off-by: Jack Pham <jackp@codeaurora.org>
usb: gadget: u_bam: Delay suspend sequence until connect sequence finished

Suspend sequence can also start as a result of cable disconnection.
When connecting and disconnecting the cable fast enough, it can
result in a race condition between the connect and the suspend sequences.
As a result of that, both suspend and connect would not finish, which
will leave IPA resource manager in invalid state.
This fix guarantee that the suspend sequence will only start after
calling teth_bridge_connect, which means connect sequence can finish
successfully.

CRs-Fixed: 511697
Change-Id: Ie2303d1080d40e9fa23db489482004933f3f21e2
Signed-off-by: Bar Weiner <bweiner@codeaurora.org>
USB: gadget: qdss: Return Error when set_alt failed

QDSS functionality is not supported with Full Speed mode. If it is enabled,
it returns success when its set_alt fails after checking USB speed. With
this usb enumeration happens and on USB cable disconnect, qdss_disable() is
called which is crashing the system due to NULL pointer dereference in
uninit_data().

qdss_disable() is also called as part of reset_config() on returning above
error code as part of set_config(). This would again lead to crash as
uninit_data() is being called as part of qdss_disable().

Fix this issue by returning correct error code when QDSS is being used
with Full Speed mode which would failed USB enumeration. And add check in
qdss_disable() to resolve cable disconnect issue.

CRs-Fixed: 529148
Change-Id: Id27a857b0614ce0536ed96f7afe8e4dbf57a268c
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
USB: gadget: qdss: Unconfigure DBM endpoint in process context

Currently qdss driver does configuring endpoint as DBM endpoint
in process context for cable connect, but unconfiguring DBM
endpoint in interrupt context during cable disconnect. This results
in error while queueing sps request to DBM endpoint during fast
PI/PO test like USBCV chapter 9 test. Due to this, sometimes leading
to target crash. Hence move unconfiguring DBM endpoint to process
context instead of doing interrupt context.

CRs-Fixed: 519090
Change-Id: I20c3a2ef4e0da3f1826989438030f703f277a422
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: f_mtp: Set maximum burst value to two for superspeed mode

Currently burst value is set to zero for superspeed in mtp driver.
MTP throughput can be improved by setting max burst vlaue to non
zero value in superspeed mode. Hence set max burst vlaue to two
for both IN and OUT bulk endpoints in superspeed mode.

CRs-Fixed: 532070
Change-Id: Ib78b8fec5d1ab934f4d4ec80b7e008149707ce0f
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: u_ether: Set complete handler before queueing to endpoint

rndis function driver will queue requests for TX endpoints in
tasklet context and interrupt context. While queueing requests
in interrupt context, not setting completion handler before
queueing to TX endpoint. Due to this, there is a chance that
usb request will be queued to USB HW without setting completion
handler. This results in crash when that particular usb request
is completed. Hence mark complete handler before queueing usb
request in interrupt context.

CRs-Fixed: 534958
Change-Id: I4cf235ace13f05f1e7bf2415b8a7dccf09d1115d
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: Debugfs: Fix compilation issues when debugfs is disabled

When we disable debugfs some of the function driver does not
handle those error properly so we see error of kind variable
undeclared, too many arguements to function. This fixes all
these obseved issue

CRs-fixed: 551713
Change-Id: I1b60c86b1c489f77edf86a5df44f8766a08dc117
Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
USB: f_mass_storage: Send GADGET_DELAYED_STATUS for MSC RESET command

When Host sends MSC RESET command to the device, device is expected
to clear HALT condition on the bulk IN endpoint as part of handling it,
before sending status phase to the Host. Since handling of MSC RESET is
done by sending signal to fsg_thread, it could take time for handling it.
It could lead to sending bulk IN endpoint as halted, when host asks for
endpoint status as status phase is sent for MSC RESET command immediately
after it is recieved. Due to this, MSC compliance tests fail. Hence send
delayed status in case of MSC RESET and send status phase after it is
handled and cleared halt condition.

CRs-Fixed: 547929
Change-Id: If80d0ffb2d012724b899772b1b45dff8092bd8d5
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: gadget: qdss: Fix strncmp length usage

Using a newer GCC we get the following warnings:

drivers/usb/gadget/f_qdss.c: In function 'qdss_bind_config':
drivers/usb/gadget/f_qdss.c:598: warning: argument to 'sizeof' in
'strncmp' call is the same expression as the second source; did you mean
to provide an explicit length? [-Wsizeof-pointer-memaccess]

drivers/usb/gadget/f_qdss.c: In function 'usb_qdss_open':
drivers/usb/gadget/f_qdss.c:760: warning: argument to 'sizeof' in
'strncmp' call is the same expression as the second source; did you mean
to provide an explicit length? [-Wsizeof-pointer-memaccess]

These look to be due to using sizeof(ch->name) which is a pointer, use
a simple strcmp instead.

Change-Id: I09e09a18ffb3361fc351b177ed3a35432d9ed933
Signed-off-by: Kumar Gala <galak@codeaurora.org>
usb: gadget: Fixing array index out of bound violation

In mass_storage_function_init(), current code has array size
allocated as 2. Maximum number of luns which can be supported
is 3 (for cdrom, external memory and internal memory). Array
name[0] is initialized to "lun" as by default it is required to
support minimum one lun for external memory.  For additional luns
support array index 1 and 2 is required to be used.

But with current code there would be array index out of bound
violation when name[2] is accessed. Hence fixing the issue by adding
correct size for the array to 3.

CRs-Fixed: 579049
Change-Id: Iad74a95205e503bf6a30dfac70b6ac1963df76a6
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>