usb: gps: Fix multiple gps setup issue

The problem this fix solves happens when calling
gps_port_setup more than once. This can happen during
dynamic composition switch. In this case the wrong
port number would be assigned to port_num, which would
result in a connection error.

Change-Id: Ibdfc84c41039cb021e705e98d4cba690452c0cf8
Signed-off-by: Bar Weiner <bweiner@codeaurora.org>
msm: ipa: provide ECM connect and disconnect using IPA messaging

This supplements the exiting mechanism based on netlink events.
This is added because in some cases, the netlink events are
not seen at user-space leading to device crash.

Change-Id: I8e34e1ef6556f3d79af84b39174a849c3bd5d29f
Signed-off-by: Ravi Gummadidala <rgummadi@codeaurora.org>
usb: gadget: mbim: protect packets queue corruption

The f_mbim usb function driver maintain a packets queue sent from the
host as encapsulated commands which need to be read by the QBI using the
mbim_read fops.

In case of excessive messages arriving from the host we end up with simple
race condition between the queue writer and queue reader which end up in
corruption of the queue and packet loss.

Simply add a missing lock protection upon reading (deleting) a packet from
queue.

CRs-Fixed: 576720
Change-Id: I8aff04745f02cbefd3d6b83d944cad9aa1726ebf
Signed-off-by: Ido Shayevitz <idos@codeaurora.org>
usb: msm_otg: Remove sleep waiting loop from the ci13xxx_wakeup function

When USB core exits from low power state in BAM to BAM mode, the
ci13xxx_wakeup function gets called from an atomic context and therefore
the usleep() call fails and an error message is returned. The fix is to
remove the usleep() call when the CI13XXX driver is used.

Change-Id: I3624180622380616453e9725fe0aec82ff9af381
Signed-off-by: Danny Segal <dsegal@codeaurora.org>
USB: gadget: Fix IPA disconnect on suspend change

The IPA disconnect on suspend change has introduced a new is_connected flag
for tracking the BAM port state. However, this flag is not updated on the
connect and disconnect work functions. With this fix it is set to true in
the end of the connect work function and to false in the end of the
disconnect work functions.

Change-Id: Ibe22929b06038bee8c3b29e01cc5b25008758935
CRs-fixed: 571703
Signed-off-by: Danny Segal <dsegal@codeaurora.org>
Merge "usb: gadget: mbim: protect packets queue corruption"
Merge "usb: msm_otg: Remove sleep waiting loop from the ci13xxx_wakeup function"
Merge "usb: gps: Fix multiple gps setup issue"
Merge "USB: gadget: Fix IPA disconnect on suspend change"
msm: ipa: wwan: update trans_start in proper place

trans_start was not updated in some cases which caused the watchdog
timeout to expire. Fix trans_start to be updated an soon as transmit
callback is called.

Change-Id: I8d2a4acabb71af1c5b444f05ccbe29f45417a336
CRs-Fixed: 604906
Acked-by: Ady Abraham <adya@qti.qualcomm.com>
Signed-off-by: Gidon Studinski <gidons@codeaurora.org>
USB: gadget: diag: Free USB requests during composition switch

Diag char driver allocates and frees USB requests from workqueue
context as part of USB connect and disconnect notifications.
There is possibility that by the time diag char's worqueue
requests USB to free up USB requests, USB DIAG is already UNBOUND
(as part of composition switch) or DISABLED (as part of cable
disconnect) resulting in requests not getting freed. Second
scenario is handled in the code by freeing the USB requests as
part of next cable connect but first scenario is not handled, which
results in memory leak. Handle this by freeing USB requests during
unbind before releasing reference to USB DIAG device context.

Change-Id: I59afb989ea3b4e60dc3287db6e281952fb880427
CRs-Fixed: 506822
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Merge "msm: ipa: wwan: update trans_start in proper place"
Merge "USB: gadget: diag: Free USB requests during composition switch"
Merge "msm: ipa: provide ECM connect and disconnect using IPA messaging"
USB: msm_otg: Fail suspend if !BSV is under processing

USB BAM driver is also responsible for putting USB OTG
in runtime suspend state during bus suspend or cable
disconnect. There is a handshake between usb_bam and
IPA for the same. msm_otg checks with usb_bam for the
same using msm_bam_lpm_ok() before entering suspend
to make sure that handshake between usb_bam and its
peer bam peripheral is finished.
In case that handshake takes more time and msm_bam_lpm_ok
returns FALSE then it is the responsibility of usb_bam
driver to put usb_otg in runtime_suspend later when
it is finished. But, there is chance that user disconnects
USB cable just when usb_bam is trying to put USB in
LPM and its processing is not finished by sm_work_fn.
This may result in stop_peripheral and msm_otg_suspend
racing with each other. Fix this by not allowing LPM if
cable is disconnected but OTG state is not B_IDLE. OTG
state is marked B_IDLE only after gadget driver is
disconnected or stopped.

Change-Id: I14b12ba52afd568bcb7fbc5a690ed135c3e90c55
CRs-fixed: 606558
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
mtd: msm_qpic_nand: Fix buffer overflow issue

Correct the size argument passed to memset() in function
msm_nand_block_isbad() to fix buffer overflow issue.

CRs-fixed: 561236
Change-Id: I1c664ef529a42901d1f3d5d1d7b747cf58f886b6
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Merge "mtd: msm_qpic_nand: Fix buffer overflow issue"
usb: adb: Don't dequeue request during system suspend

Userspace adb daemon queues usb_request from adb_read and
waits for its completion to fetch data from host.
If host suspends USB bus then allowing system suspend
subsequently results in a signal being issued to adbd as part
of freezing the userspace processes. Currently this causes
adb_read to dequeues RX request.
If USB clocks are turned off as part of bus suspend then
usb_ep_dequeue may result in unclocked access.
Fix this by avoiding request dequeue from adb_read during
system suspend and re-using same request after resume.

CRs-fixed: 607157
Change-Id: Ifd0f300377d5ac462fb0d65a593a17f4eab43344
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
USB: gadget: ether: Fix memory corruption issues with multi_pkt_xfers

If gadget xmits packets before host sends RNDIS_MSG_INIT to update
maximum packets supported per transfer, then there is a possibility
of using freed skb memory later from xmit function. Fix such
races which may arise between tx_complete and start_xmit routines
depending on when multi_pkt_transfers are enabled.
Other option is to defer starting TX transfers until RNDIS_MSG_INIT
is received, but then it makes it difficult to handle scenarios
where host doesn't support this message or just doesn't send it.

CRs-fixed: 595367
Change-Id: I181da831120b38840ae4b8b74c1dacce129d1ba6
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
msm: kgsl: Verify the user address before reading a perfcounter group

In adreno_perfcounter_read_group some user input verification is
occuring on a user pointer before copy_from_user is called
resulting in a possible segmentation fault if called with improper
input data.

CRs-fixed: 553314
Change-Id: Ic0dedbad4c5e4b2610368d51ff591d1f716712f4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>