usb: gadget: Ignore the second set_config from the host

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation of android_work() issues disconnect
event to userspace if SetConfiguration with non-zero value is sent
twice. The Userspace application may disconnect USB and it causes
fail to connect to the USB host.

Fix this by ignoring the second time SET_CONFIGURATION request
from the host only for the same configuration value twice.

CRs-Fixed: 661220
Change-Id: Iec8dd7824fa9f371ea147784cf9137aa88a7128e
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
USB: android: Add support for USB UICC mass storage

USB UICC cards can support multiple partitions which can be
exposed to the host via USB mass storage function. The number
of partitions of UICC card may vary for each target. Hence
create a device tree property to accept the required luns.

Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
USB: android: release spinlock before queuing work in android_setup

In android_setup we release spinlock after scheduling the work but there
is no need for holding the spinlock during the schedule_work call
is executed this can lead to spinlock timeouts in case where schedule
work takes more time.

So before scheduling work in android_setup we release spinlock to avoid
potential spinlock lockup or timeout.

Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
usb: android: Skip the work when set_config arrives with same value twice

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation processing the 2nd set_config and
schedules the work. The android_work() issues disconnect event to
userspace if SetConfiguration with non-zero value is sent twice.
The userspace applications may disconnect the USB and the device
doesn't connect to the host.

Fix this by avoiding the android_work for the second time SET_CONFIGURATION
request when it receives SetConfiguration request with same configuration
value twice from the host.

Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
usb: ci13xxx_udc: Do not clear ENDPTSETUPSTAT during USB BUS RESET

When the host sends a setup packet immediately after the bus RESET,
it is possible that due to interrupt latency the USB software observe
both USB BUS Reset Interrupt and USB interrupt for SETUP packet(UI) bits
getting set at the same time. The USB Interrupt SW routine handles the
reset interrupt as it has more priority than UI interrupt and clear the
ENDPTSETUPSTAT register. If the software clears this register, it will
not know that a SETUP packet arrived.

Fix the issue by not clearing the ENDPTSETUPSTAT during usb bus reset
processing. When USB HOST sends SETUP Packet, device controller sends ACK
and sets ENDPTSETUPSTAT bit and asserts USB Interrupt so that SETUP packet
can be correctly read by the software.

Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
usb: Avoid incorrect memory leaks reported by kmemleak tool.

Certain memory allocations are not properly tracked by the kmemleak
tool, which causes it to incorrectly detect memory leaks. Notify the
tool by using kmemleak_not_leak() to ignore the memory allocation
so that incorrect leak reports are avoided.

Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
usb: Fix race between diag_function_disable() and usb_diag_write()

There is a race when diag_function_disable() and usb_diag_write()
executes in parallel.
The diag context attribute is set to NULL in diag_function_disable()
which is later accessed in usb_diag_write() leading to NULL pointer
dereference.
Fix the issue by adding proper synchronization protection
for the diag context attribute in usb_diag_write().

Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
usb: gadget: Fix response available notify count usage

The outstanding responses are purged and notify count is reset
during bus suspend. But the notify interrupt endpoint is not flushed.
If a request is pending with the controller, It gets finished during
resume and the notify count is decremented in the completion handler.
As the notify count is reset during the suspend its become negative now.
As the counter is not zero, interrupt notifications are queued even
though there are no responses. This is leading to watchdog bark due to
an error print messages.

Flush the notify endpoint before resetting the notify counter during
suspend. As we are modifying notify counter under spin lock, atomic
variable is not required. Ensure that notify counter never
becomes negative.

Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
usb: f_qc_rndis: set context for encapsulated response

Setting the req->context field for encapsulated responses
as well as for encapsulated commands. This prevents a
corner case where the request is initially used for
a response, prior to using it for a command.

Signed-off-by: Dov Levenglick <dovl@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
usb: gadget: qdss: Fix usage on non-DWC3 controllers

The QDSS function needs to call into controller-specific
routines to adjust parameters such as FIFO size and endpoint
configuration, but currently this only needs to be when using
the DWC3 controller. Previously this was handled by calling
stub functions if CONFIG_USB_DWC3_MSM is not defined. However,
this breaks targets that have it defined and compiled but do
not use the DWC3 controller as the primary gadget, as it
results in calling the routines of an uninstantiated driver.

Fix this by guarding the DWC3 calls by first checking
if (gadget_is_dwc3(gadget)).

Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
USB: gadget: qdss: Flush pending works before function unbind

Workqueue might have pending connect/disconnect works when
composite driver calls qdss unbind as part of composition
switch or remove. As qdss_unbind frees up device references
e.g. ep->driver_data, flush pending works from unbind to avoid
any access to them later from work_fn.

Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
USB: storage: Allow UICC cards to perform house keeping operations

Some UICC cards needs to perform the flash related operations during idle
time. The idle time is detected by the card by counting the consecutive
TEST_UNIT_READY commands. If the card does not find idle time, it perform
them while processing a WRITE(10) command. If the card is kept busy which
happens during continuous mass storage interfaces, it takes lot of time to
respond to the commands on the CCID interface.

Introduce a quirk called US_FL_TUR_AFTER_WRITE for sending 5 consecutive
TEST_UNIT_READY commands for every 8 WRITE(10) commands. This approach
forces the card to perform house keeping operations during continuous
mass storage transfers. The test result indicate no degradation in
the performance.

Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
idr: rename MAX_LEVEL to MAX_IDR_LEVEL

To avoid name conflicts:

  drivers/video/riva/fbdev.c:281:9: sparse: preprocessor token MAX_LEVEL redefined

While at it, also make the other names more consistent and add
parentheses.

[akpm@linux-foundation.org: repair fallout]
[sfr@canb.auug.org.au: IB/mlx4: fix for MAX_ID_MASK to MAX_IDR_MASK name change]
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Cc: Bernd Petrovitsch <bernd@petrovitsch.priv.at>
Cc: walter harms <wharms@bfs.de>
Cc: Glauber Costa <glommer@parallels.com>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Roland Dreier <roland@purestorage.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
idr: make idr_destroy() imply idr_remove_all()

idr is silly in quite a few ways, one of which is how it's supposed to
be destroyed - idr_destroy() doesn't release IDs and doesn't even whine
if the idr isn't empty.  If the caller forgets idr_remove_all(), it
simply leaks memory.

Even ida gets this wrong and leaks memory on destruction.  There is
absoltely no reason not to call idr_remove_all() from idr_destroy().
Nobody is abusing idr_destroy() for shrinking free layer buffer and
continues to use idr after idr_destroy(), so it's safe to do remove_all
from destroy.

In the whole kernel, there is only one place where idr_remove_all() is
legitimiately used without following idr_destroy() while there are quite
a few places where the caller forgets either idr_remove_all() or
idr_destroy() leaking memory.

This patch makes idr_destroy() call idr_destroy_all() and updates the
function description accordingly.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
idr: deprecate idr_remove_all()

There was only one legitimate use of idr_remove_all() and a lot more of
incorrect uses (or lack of it).  Now that idr_destroy() implies
idr_remove_all() and all the in-kernel users updated not to use it,
there's no reason to keep it around.  Mark it deprecated so that we can
later unexport it.

idr_remove_all() is made an inline function calling __idr_remove_all()
to avoid triggering deprecated warning on EXPORT_SYMBOL().

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
idr: relocate idr_for_each_entry() and reorganize id[r|a]_get_new()

* Move idr_for_each_entry() definition next to other idr related
  definitions.

* Make id[r|a]_get_new() inline wrappers of id[r|a]_get_new_above().

This changes the implementation of idr_get_new() but the new
implementation is trivial.  This patch doesn't introduce any
functional change.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
idr: remove _idr_rc_to_errno() hack

idr uses -1, IDR_NEED_TO_GROW and IDR_NOMORE_SPACE to communicate
exception conditions internally.  The return value is later translated
to errno values using _idr_rc_to_errno().

This is confusing.  Drop the custom ones and consistently use -EAGAIN
for "tree needs to grow", -ENOMEM for "need more memory" and -ENOSPC for
"ran out of ID space".

Due to the weird memory preloading mechanism, [ra]_get_new*() return
-EAGAIN on memory shortage, so we need to substitute -ENOMEM w/
-EAGAIN on those interface functions.  They'll eventually be cleaned
up and the translations will go away.

This patch doesn't introduce any functional changes.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
idr: refactor idr_get_new_above()

Move slot filling to idr_fill_slot() from idr_get_new_above_int() and
make idr_get_new_above() directly call it.  idr_get_new_above_int() is
no longer needed and removed.

This will be used to implement a new ID allocation interface.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
idr: implement idr_preload[_end]() and idr_alloc()

The current idr interface is very cumbersome.

* For all allocations, two function calls - idr_pre_get() and
  idr_get_new*() - should be made.

* idr_pre_get() doesn't guarantee that the following idr_get_new*()
  will not fail from memory shortage.  If idr_get_new*() returns
  -EAGAIN, the caller is expected to retry pre_get and allocation.

* idr_get_new*() can't enforce upper limit.  Upper limit can only be
  enforced by allocating and then freeing if above limit.

* idr_layer buffer is unnecessarily per-idr.  Each idr ends up keeping
  around MAX_IDR_FREE idr_layers.  The memory consumed per idr is
  under two pages but it makes it difficult to make idr_layer larger.

This patch implements the following new set of allocation functions.

* idr_preload[_end]() - Similar to radix preload but doesn't fail.
  The first idr_alloc() inside preload section can be treated as if it
  were called with @gfp_mask used for idr_preload().

* idr_alloc() - Allocate an ID w/ lower and upper limits.  Takes
  @gfp_flags and can be used w/o preloading.  When used inside
  preloaded section, the allocation mask of preloading can be assumed.

If idr_alloc() can be called from a context which allows sufficiently
relaxed @gfp_mask, it can be used by itself.  If, for example,
idr_alloc() is called inside spinlock protected region, preloading can
be used like the following.

	idr_preload(GFP_KERNEL);
	spin_lock(lock);

	id = idr_alloc(idr, ptr, start, end, GFP_NOWAIT);

	spin_unlock(lock);
	idr_preload_end();
	if (id < 0)
		error;

which is much simpler and less error-prone than idr_pre_get and
idr_get_new*() loop.

The new interface uses per-pcu idr_layer buffer and thus the number of
idr's in the system doesn't affect the amount of memory used for
preloading.

idr_layer_alloc() is introduced to handle idr_layer allocations for
both old and new ID allocation paths.  This is a bit hairy now but the
new interface is expected to replace the old and the internal
implementation eventually will become simpler.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
idr: Backport fix

* This fixes some conflicts between 3.4 and 3.15
  updates.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>