linux-toradex.git/drivers/tty/n_gsm.c, branch v3.14.33

tty: n_gsm: Fix for modems with brk in modem status control

2014-02-07T16:40:54+00:00

3GPP TS 07.10 states in section 5.4.6.3.7:
"The length byte contains the value 2 or 3 ... depending on the break
signal." The break byte is optional and if it is sent, the length is
3. In fact the driver was not able to work with modems that send this
break byte in their modem status control message. If the modem just
sends the break byte if it is really set, then weird things might
happen.
The code for deconding the modem status to the internal linux
presentation in gsm_process_modem has already a big comment about
this 2 or 3 byte length thing and it is already able to decode the
brk, but the code calling the gsm_process_modem function in
gsm_control_modem does not encode it and hand it over the right way.
This patch fixes this.
Without this fix if the modem sends the brk byte in it's modem status
control message the driver will hang when opening a muxed channel.

Signed-off-by: Lars Poeschel 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

TTY/n_gsm: Removing the wrong tty_unlock/lock() in gsm_dlci_release()

2013-12-19T00:58:28+00:00

Commit 4d9b109060f690f5c835(tty: Prevent deadlock in n_gsm driver)
tried to close all the virtual ports synchronously before closing the
phycial ports, so the tty_vhangup() is used.

But the tty_unlock/lock() is wrong:
tty_release
 tty_ldisc_release
  tty_lock_pair(tty, o_tty)  < == Here the tty is for physical port
  tty_ldisc_kill
    gsmld_close
      gsm_cleanup_mux
        gsm_dlci_release
          tty = tty_port_tty_get(&dlci->port)
                            < == Here the tty(s) are for virtual port

They are different ttys, so before tty_vhangup(virtual tty), do not need
to call the tty_unlock(virtual tty) at all which causes unbalanced unlock
warning.

When enabling mutex debugging option, we will hit the below warning also:
[   99.276903] =====================================
[   99.282172] [ BUG: bad unlock balance detected! ]
[   99.287442] 3.10.20-261976-gaec5ba0 #44 Tainted: G           O
[   99.293972] -------------------------------------
[   99.299240] mmgr/152 is trying to release lock (&tty->legacy_mutex) at:
[   99.306693] [] mutex_unlock+0xd/0x10
[   99.311669] but there are no more locks to release!
[   99.317131]
[   99.317131] other info that might help us debug this:
[   99.324440] 3 locks held by mmgr/152:
[   99.328542]  #0:  (&tty->legacy_mutex/1){......}, at: [] tty_lock_nested+0x40/0x90
[   99.338116]  #1:  (&tty->ldisc_mutex){......}, at: [] tty_ldisc_kill+0x22/0xd0
[   99.347284]  #2:  (&gsm->mutex){......}, at: [] gsm_cleanup_mux+0x73/0x170
[   99.356060]
[   99.356060] stack backtrace:
[   99.360932] CPU: 0 PID: 152 Comm: mmgr Tainted: G           O 3.10.20-261976-gaec5ba0 #44
[   99.370086]  ef4a4de0 ef4a4de0 ef4c1d98 c1b27b91 ef4c1db8 c1292655 c1dd10f5 c1b2dcad
[   99.378921]  c1b2dcad ef4a4de0 ef4a528c ffffffff ef4c1dfc c12930dd 00000246 00000000
[   99.387754]  00000000 00000000 c15e1926 00000000 00000001 ddfa7530 00000003 c1b2dcad
[   99.396588] Call Trace:
[   99.399326]  [] dump_stack+0x16/0x18
[   99.404307]  [] print_unlock_imbalance_bug+0xe5/0xf0
[   99.410840]  [] ? mutex_unlock+0xd/0x10
[   99.416110]  [] ? mutex_unlock+0xd/0x10
[   99.421382]  [] lock_release_non_nested+0x1cd/0x210
[   99.427818]  [] ? gsm_destroy_network+0x36/0x130
[   99.433964]  [] ? mutex_unlock+0xd/0x10
[   99.439235]  [] lock_release+0x82/0x1c0
[   99.444505]  [] ? mutex_unlock+0xd/0x10
[   99.449776]  [] ? mutex_unlock+0xd/0x10
[   99.455047]  [] __mutex_unlock_slowpath+0x5f/0xd0
[   99.461288]  [] mutex_unlock+0xd/0x10
[   99.466365]  [] tty_unlock+0x21/0x50
[   99.471345]  [] gsm_cleanup_mux+0xc1/0x170
[   99.476906]  [] gsmld_close+0x52/0x90
[   99.481983]  [] tty_ldisc_close.isra.1+0x35/0x50
[   99.488127]  [] tty_ldisc_kill+0x2c/0xd0
[   99.493494]  [] tty_ldisc_release+0x2f/0x50
[   99.499152]  [] tty_release+0x37c/0x4b0
[   99.504424]  [] ? mutex_unlock+0xd/0x10
[   99.509695]  [] ? mutex_unlock+0xd/0x10
[   99.514967]  [] ? eventpoll_release_file+0x7e/0x90
[   99.521307]  [] __fput+0xd9/0x200
[   99.525996]  [] ____fput+0xd/0x10
[   99.530685]  [] task_work_run+0x81/0xb0
[   99.535957]  [] do_notify_resume+0x49/0x70
[   99.541520]  [] work_notifysig+0x29/0x31
[   99.546897] ------------[ cut here ]------------

So here we can call tty_vhangup() directly which is for virtual port.

Reviewed-by: Chao Bi 
Signed-off-by: Liu, Chuansheng 
Signed-off-by: Greg Kroah-Hartman

drivers: tty: Mark the functions as static in n_gsm.c

2013-12-17T17:37:44+00:00

Marks the functions gsm_cleanup_mux(), gsm_activate_mux(),
gsm_free_mux(), gsm_alloc_mux() and gsm_change_mtu() as static in
n_gsm.c because they are not used outside this file.

Also, drop the EXPORT_SYMBOL_GPL for the above mentioned functions
because nothing else in the kernel calls them.

This eliminates the following warnings in n_gsm.c:
drivers/tty/n_gsm.c:2022:6: warning: no previous prototype for ‘gsm_cleanup_mux’ [-Wmissing-prototypes]
drivers/tty/n_gsm.c:2076:5: warning: no previous prototype for ‘gsm_activate_mux’ [-Wmissing-prototypes]
drivers/tty/n_gsm.c:2120:6: warning: no previous prototype for ‘gsm_free_mux’ [-Wmissing-prototypes]
drivers/tty/n_gsm.c:2156:17: warning: no previous prototype for ‘gsm_alloc_mux’ [-Wmissing-prototypes]
drivers/tty/n_gsm.c:2714:5: warning: no previous prototype for ‘gsm_change_mtu’ [-Wmissing-prototypes]

Signed-off-by: Rashika Kheria 
Reviewed-by: Josh Triplett 
Signed-off-by: Greg Kroah-Hartman

n_gsm: race between ld close and gsmtty open

2013-12-09T01:05:14+00:00

ttyA has ld associated to n_gsm, when ttyA is closing, it triggers
to release gsmttyB's ld data dlci[B], then race would happen if gsmttyB
is opening in parallel.

(Note: This patch set differs from previous set in that it uses mutex
instead of spin lock to avoid race, so that it avoids sleeping in automic
context)

Here are race cases we found recently in test:

CASE #1
====================================================================
releasing dlci[B] race with gsmtty_install(gsmttyB), then panic
in gsmtty_open(gsmttyB), as below:

 tty_release(ttyA)                  tty_open(gsmttyB)
     |                                   |
   -----                           gsmtty_install(gsmttyB)
     |                                   |
   -----                    gsm_dlci_alloc(gsmttyB) => alloc dlci[B]
 tty_ldisc_release(ttyA)               -----
     |                                   |
 gsm_dlci_release(dlci[B])             -----
     |                                   |
 gsm_dlci_free(dlci[B])                -----
     |                                   |
   -----                           gsmtty_open(gsmttyB)

 gsmtty_open()
 {
     struct gsm_dlci *dlci = tty->driver_data; => here it uses dlci[B]
     ...
 }

 In gsmtty_open(gsmttyA), it uses dlci[B] which was release, so hit a panic.
=====================================================================

CASE #2
=====================================================================
releasing dlci[0] race with gsmtty_install(gsmttyB), then panic
in gsmtty_open(), as below:

 tty_release(ttyA)                  tty_open(gsmttyB)
     |                                   |
   -----                           gsmtty_install(gsmttyB)
     |                                   |
   -----                    gsm_dlci_alloc(gsmttyB) => alloc dlci[B]
     |                                   |
   -----                         gsmtty_open(gsmttyB) fail
     |                                   |
   -----                           tty_release(gsmttyB)
     |                                   |
   -----                           gsmtty_close(gsmttyB)
     |                                   |
   -----                        gsmtty_detach_dlci(dlci[B])
     |                                   |
   -----                             dlci_put(dlci[B])
     |                                   |
 tty_ldisc_release(ttyA)               -----
     |                                   |
 gsm_dlci_release(dlci[0])             -----
     |                                   |
 gsm_dlci_free(dlci[0])                -----
     |                                   |
   -----                             dlci_put(dlci[0])

 In gsmtty_detach_dlci(dlci[B]), it tries to use dlci[0] which was released,
 then hit panic.
=====================================================================

IMHO, n_gsm tty operations would refer released ldisc,  as long as
gsm_dlci_release() has chance to release ldisc data when some gsmtty operations
are ongoing..

This patch is try to avoid it by:

1) in n_gsm driver, use a global gsm mutex lock to avoid gsm_dlci_release() run in
parallel with gsmtty_install();

2) Increase dlci's ref count in gsmtty_install() instead of in gsmtty_open(), the
purpose is to prevent gsm_dlci_release() releasing dlci after gsmtty_install()
allocats dlci but before gsmtty_open increases dlci's ref count;

3) Decrease dlci's ref count in gsmtty_remove(), a tty framework API, this is the
opposite process of step 2).

Signed-off-by: Chao Bi 
Signed-off-by: Greg Kroah-Hartman

tty: Always handle NULL flag ptr

2013-12-09T00:56:05+00:00

Most line disciplines already handle the undocumented NULL flag
ptr in their .receive_buf method; however, several don't.

Document the NULL flag ptr, and correct handling in the
N_MOUSE, N_GSM0710 and N_R394 line disciplines.

Signed-off-by: Peter Hurley 
Acked-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

Drivers: tty: n_gsm.c: fixed 7 errors & 6 warnings that checkpatch complained

2013-07-24T22:21:13+00:00

Specifically:
n_gsm.c:810: ERROR: space required before the open parenthesis '('
n_gsm.c:830: WARNING: line over 80 characters
n_gsm.c:971: ERROR: trailing whitespace
n_gsm.c:984: ERROR: code indent should use tabs where possible
n_gsm.c:984: WARNING: please, no space before tabs
n_gsm.c:984: WARNING: please, no spaces at the start of a line
n_gsm.c:1141: WARNING: space prohibited before semicolon
n_gsm.c:1743: ERROR: space required before the open brace '{'
n_gsm.c:1744: WARNING: line over 80 characters
n_gsm.c:1745: ERROR: code indent should use tabs where possible
n_gsm.c:1746: ERROR: code indent should use tabs where possible
n_gsm.c:2908: WARNING: line over 80 characters
n_gsm.c:2912: ERROR: trailing whitespace

Signed-off-by: Aldo Iljazi 
Signed-off-by: Greg Kroah-Hartman

TTY: fix DTR not being dropped on hang up

2013-03-18T23:27:53+00:00

Move HUPCL handling to port shutdown so that DTR is dropped also on hang
up (tty_port_close is a noop for hung-up ports).

Also do not try to drop DTR for uninitialised ports where it has never
been raised (e.g. after a failed open).

Note that this is also the current behaviour of serial-core.

Nine drivers currently call tty_port_close_start directly (rather than
through tty_port_close) and seven of them lower DTR as part of their
close (if the port has been initialised). Fixup the remaining two
drivers so that it continues to be lowered also on normal (non-HUP)
close. [ Note that most of those other seven drivers did not expect DTR
to have been dropped by tty_port_close_start in the first place. ]

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

TTY: add tty_port_tty_hangup helper

2013-03-18T23:24:29+00:00

It allows for cleaning up on a considerable amount of places. They did
port_get, hangup, kref_put. Now the only thing needed is to call
tty_port_tty_hangup which does exactly that. And they can also decide
whether to consider CLOCAL or completely ignore that.

Signed-off-by: Jiri Slaby 
Signed-off-by: Greg Kroah-Hartman

tty: Prevent deadlock in n_gsm driver

2013-01-30T11:10:09+00:00

This change fixes a deadlock when the multiplexer is closed while there
are still client side ports open.

When the multiplexer is closed and there are active tty's it tries to
close them with tty_vhangup. This has a problem though, because
tty_vhangup needs the tty_lock. This patch changes it to unlock the
tty_lock before attempting the hangup and relocks afterwards. The
additional call to tty_port_tty_set is needed because otherwise the
port stays active because of the reference counter.

This change also exposed another problem that other code paths don't
expect that the multiplexer could have been closed. This patch also adds
checks for these cases in the gsmtty_ class of function that could be
called.

The documentation explicitly states that "first close all virtual ports
before closing the physical port" but we've found this to not always
reality in our field situations. The GPRS / UTMS modem sometimes crashes
and needs a power cycle in that case which means cleanly shutting down
everything is not always possible. This change makes it much more robust
for our situation where at least the system is recoverable with this patch
and doesn't hang in a deadlock situation inside the kernel.

The patch is against the long term support kernel (3.4.27) and should
apply cleanly to more recent branches. Tested with a Telit GE864-QUADV2
and Telit HE910 modem.

Signed-off-by: Dirkjan Bussink 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

Revert "n_gsm.c: add tx_lock in gsm_send"

2013-01-16T06:48:15+00:00

This reverts commit f96f7f7f39af53274d98aa9c29d6fa4d122218a4, at the
request of Jin.

Cc: xiaojin 
Cc: Alan Cox 
Signed-off-by: Greg Kroah-Hartman