linux-toradex.git/drivers/char, branch tegra-T30.ER5

Merge branch 'linux-tegra-2.6.36' into android-tegra-2.6.36

2011-01-08T01:20:53+00:00

Conflicts:
	arch/arm/mm/cache-v6.S

Change-Id: I1a2063218dd705a762a40f4a9dfe504ce1a1d491

RAMOOPS: Don't overflow over non-allocated regions

2011-01-07T21:58:42+00:00

commit 1873bb8115e678ad9fd0aac9dbbc68383bc36e06 upstream.

The current code mis-calculates the ramoops header size, leading to an
overflow over the next record at best, or over a non-allocated region at
worst.  Fix that calculation.

Signed-off-by: Ahmed S. Darwish 
Acked-by: Marco Stornelli 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

n_gsm: gsm_data_alloc buffer allocation could fail and it is not being checked

2011-01-07T21:58:37+00:00

commit 093d804611b9a38fe59753b37c29f840518406a9 upstream.

gsm_data_alloc buffer allocation could fail and it is not being checked.

Add check for allocated buffer and return if the buffer allocation
fails.

Signed-off-by: Ken Mills 
Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

n_gsm: Fix message length handling when building header

2011-01-07T21:58:37+00:00

commit be7a7411d63ccad165d66fe8e0b11b2ee336159b upstream.

Fix message length handling when building header

When the message length is greater than 127, the length field in the header
is built incorrectly. According to the spec, when the length is less than 128
the length field is a single byte formatted as: bbbbbbb1. When it is greater
than 127 then the field is two bytes of the format: bbbbbbb0 bbbbbbbb.

Signed-off-by: Ken Mills 
Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'linux-tegra-2.6.36' into android-tegra-2.6.36

2010-12-22T02:38:13+00:00

Conflicts:
	drivers/usb/gadget/composite.c

Change-Id: I1a332ec21da62aea98912df9a01cf0282ed50ee1

intel-gtt: fix gtt_total_entries detection

2010-12-09T21:32:58+00:00

commit e5e408fc94595aab897f613b6f4e2f5b36870a6f upstream.

In commit f1befe71 Chris Wilson added some code to clear the full gtt
on g33/pineview instead of just the mappable part. The code looks like
it was copy-pasted from agp/intel-gtt.c, at least an identical piece
of code is still there (in intel_i830_init_gtt_entries). This lead to
a regression in 2.6.35 which was supposedly fixed in commit e7b96f28

Now this commit makes absolutely no sense to me. It seems to be
slightly confused about chipset generations - it references docs for
4th gen but the regression concerns 3rd gen g33. Luckily the the g33
gmch docs are available with the GMCH Graphics Control pci config
register definitions. The other (bigger problem) is that the new
check in there uses the i830 stolen mem bits (.5M, 1M or 8M of stolen
mem). They are different since the i855GM.

The most likely case is that it hits the 512M fallback, which was
probably the right thing for the boxes this was tested on.

So the original approach by Chris Wilson seems to be wrong and the
current code is definitely wrong. There is a third approach by Jesse
Barnes from his RFC patch "Who wants a bigger GTT mapping range?"
where he simply shoves g33 in the same clause like later chipset
generations.

I've asked him and Jesse confirmed that this should work. So implement
it.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16891$
Tested-by: Anisse Astier 
Signed-off-by: Anisse Astier 
Signed-off-by: Daniel Vetter 
Signed-off-by: Chris Wilson 
Signed-off-by: Greg Kroah-Hartman

TTY: open/hangup race fixup

2010-12-09T21:32:42+00:00

commit acfa747baf73922021a047f2d87a2d866f5dbab5 upstream.

Like in the "TTY: don't allow reopen when ldisc is changing" patch,
this one fixes a TTY WARNING as described in the option 1) there:
1) __tty_hangup from tty_ldisc_hangup to tty_ldisc_enable. During this
section tty_lock is held. However tty_lock is temporarily dropped in
the middle of the function by tty_ldisc_hangup.

The fix is to introduce a new flag which we set during the unlocked
window and check it in tty_reopen too. The flag is TTY_HUPPING and is
cleared after TTY_HUPPED is set.

While at it, remove duplicate TTY_HUPPED set_bit. The one after
calling ops->hangup seems to be more correct. But anyway, we hold
tty_lock, so there should be no difference.

Also document the function it does that kind of crap.

Nicely reproducible with two forked children:
static void do_work(const char *tty)
{
	if (signal(SIGHUP, SIG_IGN) == SIG_ERR) exit(1);
	setsid();
	while (1) {
		int fd = open(tty, O_RDWR|O_NOCTTY);
		if (fd < 0) continue;
		if (ioctl(fd, TIOCSCTTY)) continue;
		if (vhangup()) continue;
		close(fd);
	}
	exit(0);
}

Signed-off-by: Jiri Slaby 
Reported-by: 
Reported-by: Kyle McMartin 
Cc: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

TTY: don't allow reopen when ldisc is changing

2010-12-09T21:32:42+00:00

commit e2efafbf139d2bfdfe96f2901f03189fecd172e4 upstream.

There are many WARNINGs like the following reported nowadays:
WARNING: at drivers/tty/tty_io.c:1331 tty_open+0x2a2/0x49a()
Hardware name: Latitude E6500
Modules linked in:
Pid: 1207, comm: plymouthd Not tainted 2.6.37-rc3-mmotm1123 #3
Call Trace:
 [] warn_slowpath_common+0x80/0x98
 [] warn_slowpath_null+0x15/0x17
 [] tty_open+0x2a2/0x49a
 [] chrdev_open+0x11d/0x146
...

This means tty_reopen is called without TTY_LDISC set. For further
considerations, note tty_lock is held in tty_open. TTY_LDISC is cleared in:
1) __tty_hangup from tty_ldisc_hangup to tty_ldisc_enable. During this
section tty_lock is held. However tty_lock is temporarily dropped in
the middle of the function by tty_ldisc_hangup.

2) tty_release via tty_ldisc_release till the end of tty existence. If
tty->count <= 1, tty_lock is taken, TTY_CLOSING bit set and then
tty_ldisc_release called. tty_reopen checks TTY_CLOSING before checking
TTY_LDISC.

3) tty_set_ldisc from tty_ldisc_halt to tty_ldisc_enable. We:
   * take tty_lock, set TTY_LDISC_CHANGING, put tty_lock
   * call tty_ldisc_halt (clear TTY_LDISC), tty_lock is _not_ held
   * do some other work
   * take tty_lock, call tty_ldisc_enable (set TTY_LDISC), put
     tty_lock

I cannot see how 2) can be a problem, as there I see no race. OTOH, 1)
and 3) can happen without problems. This patch the case 3) by checking
TTY_LDISC_CHANGING along with TTY_CLOSING in tty_reopen. 1) will be
fixed in the following patch.

Nicely reproducible with two processes:
while (1) {
	fd = open("/dev/ttyS1", O_RDWR);
	if (fd < 0) {
		warn("open");
		continue;
	}
	close(fd);
}
--------
while (1) {
        fd = open("/dev/ttyS1", O_RDWR);
        ld1 = 0; ld2 = 2;
        while (1) {
                ioctl(fd, TIOCSETD, &ld1);
                ioctl(fd, TIOCSETD, &ld2);
        }
        close(fd);
}

Signed-off-by: Jiri Slaby 
Reported-by: 
Cc: Kyle McMartin 
Cc: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

TTY: ldisc, fix open flag handling

2010-12-09T21:32:41+00:00

commit 7f90cfc505d613f4faf096e0d84ffe99208057d9 upstream.

When a concrete ldisc open fails in tty_ldisc_open, we forget to clear
TTY_LDISC_OPEN. This causes a false warning on the next ldisc open:
WARNING: at drivers/char/tty_ldisc.c:445 tty_ldisc_open+0x26/0x38()
Hardware name: System Product Name
Modules linked in: ...
Pid: 5251, comm: a.out Tainted: G        W  2.6.32-5-686 #1
Call Trace:
 [] ? warn_slowpath_common+0x5e/0x8a
 [] ? warn_slowpath_null+0xa/0xc
 [] ? tty_ldisc_open+0x26/0x38
 [] ? tty_set_ldisc+0x218/0x304
...

So clear the bit when failing...

Introduced in c65c9bc3efa (tty: rewrite the ldisc locking) back in
2.6.31-rc1.

Signed-off-by: Jiri Slaby 
Cc: Alan Cox 
Reported-by: Sergey Lapin 
Tested-by: Sergey Lapin 
Signed-off-by: Greg Kroah-Hartman

tty_ldisc: Fix BUG() on hangup

2010-12-09T21:32:41+00:00

commit 1c95ba1e1de7edffc0c4e275e147f1a9eb1f81ae upstream.

A kernel BUG when bluetooth rfcomm connection drop while the associated
serial port is open is sometime triggered.

It seems that the line discipline can disappear between the
tty_ldisc_put and tty_ldisc_get. This patch fall back to the N_TTY line
discipline if the previous discipline is not available anymore.

Signed-off-by: Philippe Retornaz 
Acked-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman