--- /dev/null
+From f76a1cbed18c86e2d192455f0daebb48458965f3 Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Tue, 14 Jan 2014 16:03:37 -0500
+Subject: hvc: ensure hvc_init is only ever called once in hvc_console.c
+
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+commit f76a1cbed18c86e2d192455f0daebb48458965f3 upstream.
+
+Commit 3e6c6f630a5282df8f3393a59f10eb9c56536d23 ("Delay creation of
+khcvd thread") moved the call of hvc_init from being a device_initcall
+into hvc_alloc, and used a non-null hvc_driver as indication of whether
+hvc_init had already been called.
+
+The problem with this is that hvc_driver is only assigned a value
+at the bottom of hvc_init, and so there is a window where multiple
+hvc_alloc calls can be in progress at the same time and hence try
+and call hvc_init multiple times. Previously the use of device_init
+guaranteed that hvc_init was only called once.
+
+This manifests itself as sporadic instances of two hvc_init calls
+racing each other, and with the loser of the race getting -EBUSY
+from tty_register_driver() and hence that virtual console fails:
+
+ Couldn't register hvc console driver
+ virtio-ports vport0p1: error -16 allocating hvc for port
+
+Here we add an atomic_t to guarantee we'll never run hvc_init twice.
+
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Fixes: 3e6c6f630a52 ("Delay creation of khcvd thread")
+Reported-by: Jim Somerville <Jim.Somerville@windriver.com>
+Tested-by: Jim Somerville <Jim.Somerville@windriver.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/hvc/hvc_console.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/hvc/hvc_console.c
++++ b/drivers/tty/hvc/hvc_console.c
+@@ -31,6 +31,7 @@
+ #include <linux/list.h>
+ #include <linux/module.h>
+ #include <linux/major.h>
++#include <linux/atomic.h>
+ #include <linux/sysrq.h>
+ #include <linux/tty.h>
+ #include <linux/tty_flip.h>
+@@ -70,6 +71,9 @@ static struct task_struct *hvc_task;
+ /* Picks up late kicks after list walk but before schedule() */
+ static int hvc_kicked;
+
++/* hvc_init is triggered from hvc_alloc, i.e. only when actually used */
++static atomic_t hvc_needs_init __read_mostly = ATOMIC_INIT(-1);
++
+ static int hvc_init(void);
+
+ #ifdef CONFIG_MAGIC_SYSRQ
+@@ -842,7 +846,7 @@ struct hvc_struct *hvc_alloc(uint32_t vt
+ int i;
+
+ /* We wait until a driver actually comes along */
+- if (!hvc_driver) {
++ if (atomic_inc_not_zero(&hvc_needs_init)) {
+ int err = hvc_init();
+ if (err)
+ return ERR_PTR(err);
--- /dev/null
+From eee3f15d5f1f4f0c283dd4db67dc1b874a2852d1 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Tue, 25 Feb 2014 10:58:43 -0600
+Subject: usb: musb: avoid NULL pointer dereference
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit eee3f15d5f1f4f0c283dd4db67dc1b874a2852d1 upstream.
+
+instead of relying on the otg pointer, which
+can be NULL in certain cases, we can use the
+gadget and host pointers we already hold inside
+struct musb.
+
+Tested-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_core.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -440,7 +440,6 @@ void musb_hnp_stop(struct musb *musb)
+ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
+ u8 devctl)
+ {
+- struct usb_otg *otg = musb->xceiv->otg;
+ irqreturn_t handled = IRQ_NONE;
+
+ dev_dbg(musb->controller, "<== DevCtl=%02x, int_usb=0x%x\n", devctl,
+@@ -655,7 +654,7 @@ static irqreturn_t musb_stage0_irq(struc
+ break;
+ case OTG_STATE_B_PERIPHERAL:
+ musb_g_suspend(musb);
+- musb->is_active = otg->gadget->b_hnp_enable;
++ musb->is_active = musb->g.b_hnp_enable;
+ if (musb->is_active) {
+ musb->xceiv->state = OTG_STATE_B_WAIT_ACON;
+ dev_dbg(musb->controller, "HNP: Setting timer for b_ase0_brst\n");
+@@ -671,7 +670,7 @@ static irqreturn_t musb_stage0_irq(struc
+ break;
+ case OTG_STATE_A_HOST:
+ musb->xceiv->state = OTG_STATE_A_SUSPEND;
+- musb->is_active = otg->host->b_hnp_enable;
++ musb->is_active = musb->hcd->self.b_hnp_enable;
+ break;
+ case OTG_STATE_B_HOST:
+ /* Transition to B_PERIPHERAL, see 6.8.2.6 p 44 */
--- /dev/null
+From 6aec044cc2f5670cf3b143c151c8be846499bd15 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 12 Mar 2014 11:30:38 -0400
+Subject: USB: unbind all interfaces before rebinding any
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 6aec044cc2f5670cf3b143c151c8be846499bd15 upstream.
+
+When a driver doesn't have pre_reset, post_reset, or reset_resume
+methods, the USB core unbinds that driver when its device undergoes a
+reset or a reset-resume, and then rebinds it afterward.
+
+The existing straightforward implementation can lead to problems,
+because each interface gets unbound and rebound before the next
+interface is handled. If a driver claims additional interfaces, the
+claim may fail because the old binding instance may still own the
+additional interface when the new instance tries to claim it.
+
+This patch fixes the problem by first unbinding all the interfaces
+that are marked (i.e., their needs_binding flag is set) and then
+rebinding all of them.
+
+The patch also makes the helper functions in driver.c a little more
+uniform and adjusts some out-of-date comments.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: "Poulain, Loic" <loic.poulain@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/driver.c | 94 +++++++++++++++++++++++++++-------------------
+ drivers/usb/core/hub.c | 5 +-
+ drivers/usb/core/usb.h | 2
+ 3 files changed, 60 insertions(+), 41 deletions(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -953,8 +953,7 @@ EXPORT_SYMBOL_GPL(usb_deregister);
+ * it doesn't support pre_reset/post_reset/reset_resume or
+ * because it doesn't support suspend/resume.
+ *
+- * The caller must hold @intf's device's lock, but not its pm_mutex
+- * and not @intf->dev.sem.
++ * The caller must hold @intf's device's lock, but not @intf's lock.
+ */
+ void usb_forced_unbind_intf(struct usb_interface *intf)
+ {
+@@ -967,16 +966,37 @@ void usb_forced_unbind_intf(struct usb_i
+ intf->needs_binding = 1;
+ }
+
++/*
++ * Unbind drivers for @udev's marked interfaces. These interfaces have
++ * the needs_binding flag set, for example by usb_resume_interface().
++ *
++ * The caller must hold @udev's device lock.
++ */
++static void unbind_marked_interfaces(struct usb_device *udev)
++{
++ struct usb_host_config *config;
++ int i;
++ struct usb_interface *intf;
++
++ config = udev->actconfig;
++ if (config) {
++ for (i = 0; i < config->desc.bNumInterfaces; ++i) {
++ intf = config->interface[i];
++ if (intf->dev.driver && intf->needs_binding)
++ usb_forced_unbind_intf(intf);
++ }
++ }
++}
++
+ /* Delayed forced unbinding of a USB interface driver and scan
+ * for rebinding.
+ *
+- * The caller must hold @intf's device's lock, but not its pm_mutex
+- * and not @intf->dev.sem.
++ * The caller must hold @intf's device's lock, but not @intf's lock.
+ *
+ * Note: Rebinds will be skipped if a system sleep transition is in
+ * progress and the PM "complete" callback hasn't occurred yet.
+ */
+-void usb_rebind_intf(struct usb_interface *intf)
++static void usb_rebind_intf(struct usb_interface *intf)
+ {
+ int rc;
+
+@@ -993,68 +1013,66 @@ void usb_rebind_intf(struct usb_interfac
+ }
+ }
+
+-#ifdef CONFIG_PM
+-
+-/* Unbind drivers for @udev's interfaces that don't support suspend/resume
+- * There is no check for reset_resume here because it can be determined
+- * only during resume whether reset_resume is needed.
++/*
++ * Rebind drivers to @udev's marked interfaces. These interfaces have
++ * the needs_binding flag set.
+ *
+ * The caller must hold @udev's device lock.
+ */
+-static void unbind_no_pm_drivers_interfaces(struct usb_device *udev)
++static void rebind_marked_interfaces(struct usb_device *udev)
+ {
+ struct usb_host_config *config;
+ int i;
+ struct usb_interface *intf;
+- struct usb_driver *drv;
+
+ config = udev->actconfig;
+ if (config) {
+ for (i = 0; i < config->desc.bNumInterfaces; ++i) {
+ intf = config->interface[i];
+-
+- if (intf->dev.driver) {
+- drv = to_usb_driver(intf->dev.driver);
+- if (!drv->suspend || !drv->resume)
+- usb_forced_unbind_intf(intf);
+- }
++ if (intf->needs_binding)
++ usb_rebind_intf(intf);
+ }
+ }
+ }
+
+-/* Unbind drivers for @udev's interfaces that failed to support reset-resume.
+- * These interfaces have the needs_binding flag set by usb_resume_interface().
++/*
++ * Unbind all of @udev's marked interfaces and then rebind all of them.
++ * This ordering is necessary because some drivers claim several interfaces
++ * when they are first probed.
+ *
+ * The caller must hold @udev's device lock.
+ */
+-static void unbind_no_reset_resume_drivers_interfaces(struct usb_device *udev)
++void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev)
+ {
+- struct usb_host_config *config;
+- int i;
+- struct usb_interface *intf;
+-
+- config = udev->actconfig;
+- if (config) {
+- for (i = 0; i < config->desc.bNumInterfaces; ++i) {
+- intf = config->interface[i];
+- if (intf->dev.driver && intf->needs_binding)
+- usb_forced_unbind_intf(intf);
+- }
+- }
++ unbind_marked_interfaces(udev);
++ rebind_marked_interfaces(udev);
+ }
+
+-static void do_rebind_interfaces(struct usb_device *udev)
++#ifdef CONFIG_PM
++
++/* Unbind drivers for @udev's interfaces that don't support suspend/resume
++ * There is no check for reset_resume here because it can be determined
++ * only during resume whether reset_resume is needed.
++ *
++ * The caller must hold @udev's device lock.
++ */
++static void unbind_no_pm_drivers_interfaces(struct usb_device *udev)
+ {
+ struct usb_host_config *config;
+ int i;
+ struct usb_interface *intf;
++ struct usb_driver *drv;
+
+ config = udev->actconfig;
+ if (config) {
+ for (i = 0; i < config->desc.bNumInterfaces; ++i) {
+ intf = config->interface[i];
+- if (intf->needs_binding)
+- usb_rebind_intf(intf);
++
++ if (intf->dev.driver) {
++ drv = to_usb_driver(intf->dev.driver);
++ if (!drv->suspend || !drv->resume)
++ usb_forced_unbind_intf(intf);
++ }
+ }
+ }
+ }
+@@ -1379,7 +1397,7 @@ int usb_resume_complete(struct device *d
+ * whose needs_binding flag is set
+ */
+ if (udev->state != USB_STATE_NOTATTACHED)
+- do_rebind_interfaces(udev);
++ rebind_marked_interfaces(udev);
+ return 0;
+ }
+
+@@ -1401,7 +1419,7 @@ int usb_resume(struct device *dev, pm_me
+ pm_runtime_disable(dev);
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+- unbind_no_reset_resume_drivers_interfaces(udev);
++ unbind_marked_interfaces(udev);
+ }
+
+ /* Avoid PM error messages for devices disconnected while suspended
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5252,10 +5252,11 @@ int usb_reset_device(struct usb_device *
+ else if (cintf->condition ==
+ USB_INTERFACE_BOUND)
+ rebind = 1;
++ if (rebind)
++ cintf->needs_binding = 1;
+ }
+- if (ret == 0 && rebind)
+- usb_rebind_intf(cintf);
+ }
++ usb_unbind_and_rebind_marked_interfaces(udev);
+ }
+
+ usb_autosuspend_device(udev);
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -55,7 +55,7 @@ extern int usb_match_one_id_intf(struct
+ extern int usb_match_device(struct usb_device *dev,
+ const struct usb_device_id *id);
+ extern void usb_forced_unbind_intf(struct usb_interface *intf);
+-extern void usb_rebind_intf(struct usb_interface *intf);
++extern void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev);
+
+ extern int usb_hub_claim_port(struct usb_device *hdev, unsigned port,
+ struct dev_state *owner);
projects / thirdparty / kernel / stable-queue.git / commitdiff
