usb: gadget: u_data_hsic: Use GFP_KERNEL where ever possible

The USB requests are allocated using dma pool API.  The dma pool has
limited memory for non-sleeping use case.  The current code does not
free USB requests during subsystem restart.  The requests are freed
only after cable is disconnected.  If subsystem restart happens
multiple  times without disconnecting cable, system may run out of the
dma pool memory.  This is leading to URB submission failures.  Use
GFP_KERNEL where ever possible.

CRs-Fixed: 463423
Change-Id: I0fca533e460e7b4234fe771e048e0e50494cb1da
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: Dump usb info during memory access violation

USB is accessing an invalid memory which results in EBI error.
To find the endpoint information and the address being accessed,
dump all the usb request info required for debugging memory access
violation issue from APP's proc using the trace framework.

CRs-Fixed: 430455
Change-Id: Ie99c31f43dfa9858a9ec2756903574888629e341
Signed-off-by: Chiranjeevi Velempati <cvelempa@codeaurora.org>
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Revert "usb: gadget: rndis: Fix re-binding f_rndis"

This reverts commit 7f141c58da4a6c8920fd6d7051b832e3dec6b877.

This patch should not have been applied in the first place. The USB
string id index is limited to 255.  Function drivers are supposed
to allocate string id for the first time their bind is called.  There
is no API to release string id index.  If string id is reset in unbind,
we will run out of string id after multiple bind/unbind.

CRs-Fixed: 425501
Change-Id: Ia82a528f9e0af192063970a9227c9c739ed77f48
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: android: Fix kernel panic during ACM enable

92fe88c8 commit (usb: gadget: Support multiple HSIC transport
instances for dun and rmnet) introduced a sysfs file called
"transport_names" for DUN and RMNET to accept transport names
from user space.  The transport names are used for registering
platform drivers.  Update ACM function too.  Otherwise NULL
string is used to register platform driver and kernel panics.

CRs-Fixed: 479434
Change-Id: I88b56f252f74bcfb2e664a6e37b64fe224739381
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: gadget: diag: cleanup connect event processing

USB connect event is notified to DIAG in process context.  The
process context is achieved by scheduling a work in connect
interrupt.  But the disconnect event is notified from disconnect
interrupt context.  This is leading to synchronization problems
during fast cable connect and disconnect scenarios.

Notify the connect event from interrupt context.  Updating
product and serial number for every cable connect is redundant.
Move this to bind time and remove config work completely.

CRs-Fixed: 475955
Change-Id: I9d6685f64e0348a63dd88ea36297198ca1fd4596
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: gadget: u_data_hsic: Fix NULL pointer dereference

The port->in and port->out are reset to NULL during disconnect.  The
connect work checks these variables before allocating requests.  Store
port->in and port->out in local variables to free the already allocated
requests before returning.

CRs-Fixed: 488044
Change-Id: Idcdc98e4237b646934c90077a1d58990e853e344
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
ci13xxx_udc: Draw 100mA of current in unconfigured state

As a part of usb enumeration, udc driver is currently notifying the pmic
to draw 0mA of current during usb reset. The pmic driver notifies the
charger driver that usb is in suspend state if <=2mA is notified.
In 8930 targets with real battery connected, USB-CV Enumeration tests
fail after some iterations. The failure logs show an error in SOF frame
number and unexpected chirp sequence.

As a part of USB Reset, instead of notifying PMIC to draw 0mA current,
if we notify to draw 100mA current, then the USB-CV Ch-9 Enumeration
failures are not seen. It seems there is some interference when PMIC stops
charging during USB reset and causing the unexpected chirp sequence
during USB Reset.

In any case, as a part of USB reset or unconfigured state, device can draw
upto 100mA of current from USB bus. Hence notify charging driver with
100mA current draw as a part of USB reset interrupt.

CRs-Fixed: 477655
Change-Id: I2658bd570c500c62705e0c07384d6b5c900f407d
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
USB: msm_otg: Allow low power mode with proprietary charger connected

When a proprietary (non-standard) charger is connected, enter low power
mode.  There is no requirement to pull DP to VDP_SRC.  Hence allow PHY
retention and power collapse. Enable PHY asynchronous interrupt for all
cases when PHY comparators are used.

CRs-Fixed: 482226
Change-Id: I54976cabceaa06737e1e5a22313910a3db79ab26
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
EHCI: HSIC: Abort system suspend if controller is outside LPM

98089c0d commit (USB: Prevent system suspend when HSIC device
is active) ensures that USB devices are auto suspended before
system suspend begins.  Apply the same policy to HSIC controller
platform device.  This will cover the corner case where controller
and root hub are resumed after root hub system suspend routine
returns success.

CRs-Fixed: 482498
Change-Id: I604b24775e1c2f52020161c236c44c20d579d5e0
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Fix kernel panic during composition switch

The control endpoint requests are not nuked properly during
composition switch.  The stale request is getting completed
during enumeration of the new composition.  Kernel panics if
completion handler access already freed data.  This is happening
with RNDIS interface.

The Android composite driver dequeue the control request before
removing the composition.  The current code returns immediately
if the queue is empty.  The control endpoint queues are handled
differently.  The EP0 IN endpoint is only exposed to the composite
driver.  The controller driver takes care of queuing the request
on EP0 IN or EP0 OUT based on control transfer direction.  When
the composite driver dequeue request on control endpoint, check
both direction endpoints queues.

When USB bus is reset, nuke the control endpoints.  Flushing the
endpoint will not call completion handler.

Test endpoint queue list, request list, endpoint descriptor and
soft pull up status under spinlock to prevent any races between
dequeue and queue paths.

CRs-Fixed: 474578
Change-Id: I3d7ca4be4d6cee65707879c6c9b501f442e53018
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
ci13xxx_udc: Acquire spinlock before calling ep_nuke()

The commit b0ad433 (USB: ci13xxx_udc: Fix kernel panic during
composition switch) adds ep_nuke() function in gadget_stop_activity().

_ep_nuke() releases and re-acquires spinlock on every entry of the
function. Acquiring spinlock before calling _ep_nuke() is necessary,
else it may end up in unlocking the lock twice, as it is already
unlocked before calling _ep_nuke(), which may lead to crash.

Hence, acquire spinlocks before calling _ep_nuke() function.

CRs-Fixed: 486502
Change-Id: Ia80b9facb8e592f8fb41879dc08f9f1a04a20b48
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
USB: ci13xxx_udc:  Retire pending requests while flushing an endpoint

Rmnet and dun function drivers are designed to start fresh upon MODEM
restart.  The current code is flushing endpoints without freeing
requests.  New requests are allocated again after MODEM is powered up.
All accumulated requests are freed only upon cable disconnect.  If
MODEM is restarted multiple times without disconnecting the cable, we
are running low memory issues.

A pending request can not be freed without dequeuing it.  Dequeuing
all requests in a loop is a heavy operation and involves changing
multiple function drivers.  All pending requests are retired upon
disabling an endpoint.  But an endpoint can not be disabled in
configured state.  Hence retire pending requests while flushing an
endpoint.

CRs-Fixed: 489047
Change-Id: I3440a204ad8c4beb043b1068cb1d3965be96e9b7
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>