usb: gadget: mbim: Fix BUG in spin_lock usage in mbim_read

mbim_read (thread context) and fmbim_cmd_complete (interrupt
context) share some data structures that are currently
protected using spin_lock API. This is a BUG as this spin_lock
doesn't disable local interrupts, hence, there is still a
possibility that IRQ may be fired after acquiring spin_lock.
On SMP this may result in deadlock if spin_lock is acquired
again from ISR, but on uniprocessor this more or less in this
usecase becomes NO-OP.

Change-Id: I204b3a9d825bb45787bb42017fa7f5e7b84bcfe9
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Merge "usb: gadget: mbim: Fix BUG in spin_lock usage in mbim_read"
HSIC_HOST: Wait for BAM Pipe to be empty before suspend

HSIC_CONS release notification doesn't confirm that all IPA HSIC BAM pipes'
are empty used for HSIC host mode functionality. In some of regression
testing, it has been found that HSIC host is being suspended when there is
data pending in HSIC IPA BAM pipe which causes BAM data stall issue. Hence
this change adds required support to check all used BAM pipes' state with
HSIC Host mode before performing suspend and notifying IPA driver to switch
of IPA clocks.

This change also checks pipe state before resuming root hub in resume
sequeunce, and would crash device if there is any pending data i.e. data is
written to HSIC BAM when HSIC host was suspended.

CRs-Fixed: 711785
Change-Id: I207a99e9cec0516f41f3991d13f673b6ab371736
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Merge "HSIC_HOST: Wait for BAM Pipe to be empty before suspend"
f_rmnet: Disconnect IPA on USB suspend if remote wakeup is disabled

If USB host doesn't enable remote wakeup feature on RMNET device
then it is not allowed to wakeup the usb bus after bus suspend.
If IPA is willing to wakeup the USB bus as part of CONS request,
USB cannot wakeup the host and therefore cannot grant the consumer.
This causes IPA resource manager to timeout and stall.
Therefore in case of remote wakeup disabled, avoid the IPA side
request for HSUSB CONS by tearing down data path with IPA.

Change-Id: I57218abe7d18d59fc7092883ceeef426fb05aa5f
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
usb: gadget: qc_ecm: Release EPs if disable happens before set_alt(1)

DATA EPs (bulk IN/OUT) are used only after set_alt(1). If disconnect
(disable) happens before this then EPs are configured again based
on the stopped. Things work fine if there is no change in speed on
next connection. Otherwise for a scenario like below device ends up
using wrong maxPacketSize with endpoint.
 -ECM gadget connects in FullSpeed
 -SET_CONFIG happens: This results in set_alt(0)
 -Disconnection and reconnect in HighSpeed
 -SET_CONFIG
 -set_alt(1) for ECM.
This results in ECM using 64bytes maxpacket size in high speed and
may result in data stall.

Fix this by explicitly clearing ep->driver_data on disconnect.

CRs-Fixed: 722950
Change-Id: Ieb6b333195387e42df35f76b40ac1e171d46b1da
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
usb_bam: Fix BUG in HSIC remove making pm usage_count negative

Runtime PM usage count of HSIC device is also used by usb_bam
to allow/forbid HSIC entering LPM. HSIC is allowed to enter
LPM only when both PROD and CONS are released by usb_bam.
During initialization, usb_bam increments pm usage_count when
HSIC registers with it and vice versa it decrements the count
when HSIC is de-registered. But, if HSIC was already in LPM when
getting de-registered then usb_bam ends up making pm usage_count
-1 later on HSIC remove. Next time when HSIC is registered again
then pm usage count toggles between 0 and -1. Negative pm
usage_count results in failure to wake up HSIC using pm_runtim_get
on async_irq (remote wakeup) or any usb_bam triggers.

Change-Id: I460e628dc704e45285e47b70dc8aaf5963555031
CRs-Fixed: 709563
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
usb_bam: Fix handling of ipa_resume during fast suspend/resume

During fast HSIC CONS release and request scenario, there is a
race condition possible - if Pipe resumed while we dropped lock
due to HSIC CONS request then ipa_resume may not have been called.
During this scenario, restore in_lpm to allow ipa_resume when HSIC
resumes next time from msm_bam_wait_for_hsic_prod_granted().

Change-Id: I48a413a553dd456eb29b4d22ab577489c656f55d
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Merge "f_rmnet: Disconnect IPA on USB suspend if remote wakeup is disabled"
Merge "usb: gadget: qc_ecm: Release EPs if disable happens before set_alt(1)"
Merge "usb_bam: Fix BUG in HSIC remove making pm usage_count negative"
USB: gadget: u_bam: Bail out from disconnect_w if already disconnected

IPA BAM port is disconnect in suspend state as well if remote wakeup
is not enabled. If disconnect happens after suspend then driver
tries to perform BAM disconnect again which fails. It also results
in USB failing to enter LPM as usb_bam_lpm_ok then return FALSE if
usb_bam disconnect had failed with error.

CRs-fixed: 721518
Change-Id: Ib26b97c49801d4994aa4f36fa84c3a2ee9a89ce4
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Merge "usb_bam: Fix handling of ipa_resume during fast suspend/resume"
Merge "USB: gadget: u_bam: Bail out from disconnect_w if already disconnected"
msm: smd: flush pending work on release

If an SMD device is closed while the device is active and then
immediately re-opened, then a delayed work item may get processed while
data structures are in the process of being re-initialized.

Move initialization of data structures to device creation which happens
once during module initialization.

CRs-Fixed: 698603
Change-Id: Ida85d8452f32b62fd848c706ba046f1a9a08bc85
Signed-off-by: Eric Holmberg <eholmber@codeaurora.org>
Merge "msm: smd: flush pending work on release"
ASoC: msm: Add bounds checking to ADM get params

Add additional bounds checking to ADM get params.
Validate that all buffer sizes are valid before
dereferencing.

Change-Id: If7c7a5ae6a56812e9c4a11a38c9bdc78f42d09f3
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
Merge "ASoC: msm: Add bounds checking to ADM get params"
usb: gadget: qc_ecm: Remove setting of cdev and func to NULL

If host doesn't support remote wakeup and while performing
bus suspend functionality, currently cdev and func are being
set to NULL from ecm_qc_bam_disconnect(). Due to which resuming
device would never able to re-established USB IPA BAM
functionality. Fix this issue by removing setting of cdev and
func to NULL using data_inteface_up flag to check this condition
which would handle case where suspend is being received before
SET_ALT(1) is sent from host.

Change-Id: I35076382916c3df720f256a2ac19c36c4da79407
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Merge "usb: gadget: qc_ecm: Remove setting of cdev and func to NULL"