commit e144c58cad6667876173dd76977e9e6557e34941 upstream.
While closing, new rx data may be received after the input buffers
have been flushed but before stop_rx() halts receiving [1]. The
new data might not be processed by flush_to_ldisc() until after
uart_shutdown() and normal input processing is re-enabled (ie.,
tty->closing = 0). The race is outlined below:
CPU 0 | CPU 1
|
uart_close() |
tty_port_close_start() |
tty->closing = 1 |
tty_ldisc_flush() |
| => IRQ
| while (LSR & data ready)
| uart_insert_char()
| tty_flip_buffer_push()
| <= EOI
stop_rx() | .
uart_shutdown() | .
free xmit.buf | .
tty_port_tty_set(NULL) | .
tty->closing = 0 | .
| flush_to_ldisc()
| n_tty_receive_buf_common()
| __receive_buf()
| ...
| commit_echoes()
| uart_flush_chars()
| __uart_start()
| ** OOPS on port.tty deref **
tty_ldisc_flush() |
Input processing must be prevented from echoing (tty->closing = 1)
until _after_ the input buffers have been flushed again at the end
of uart_close().
[1] In fact, some input may actually be buffered _after_ stop_rx()
since the rx interrupt may have already triggered but not yet been
handled when stop_rx() disables rx interrupts.
Fixes: 2e758910832d ("serial: core: Flush ldisc after dropping port
mutex in uart_close()")
Reported-by: Robert Elliott <elliott@hp.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 907eda32a36fcdb979bdb91ea097abb3dd2c23c9 upstream. This reverts commit 068500e08dc87ea9a453cc4a500cf3ab28d0f936. According to some tests, SDMA support is broken at least for i.MX6 without HW flow control. Different forms of data-corruption appear either with the ROM firmware for the SDMA controller as well as when loading Freescale provided SDMA firmware versions 1.1 or 3.1. Signed-off-by: David Jander <david@protonic.nl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 357d56151976a78d90dc3dfac01777de0ef05212 upstream.
A configuration that enables earlycon but not the core console
code causes a link error:
drivers/built-in.o: In function `setup_earlycon':
drivers/tty/serial/earlycon.c:70: undefined reference to `uart_parse_earlycon'
That error can be triggered by the newly added samsung earlycon support,
which is missing a 'select' statement.
As suggested by Peter Hurley, solves the problem by moving the
'select SERIAL_EARLYCON' statement to the samsung console driver
option, as it is done by all other console drivers.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: b94ba0328d3b3 ("serial: samsung: Add support for early console")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8687634b7908c42eb700e0469e110e02833611d1 upstream. In RS485 mode, we may want to set the delay_rts_after_send value to 0. In the datasheet, the 0 value is said to "disable" the Transmitter Timeguard but this is exactly the expected behavior if we want no delay... Moreover, if the value was set to non-zero value by device-tree or earlier ioctl command, it was impossible to change it back to zero. Reported-by: Sami Pietikäinen <Sami.Pietikainen@wapice.com> Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The currently in-use port->startup and port->shutdown are "okay". The
startup part for instance does the tiny omap extra part and invokes
serial8250_do_startup() for the remaining pieces. The workflow in
serial8250_do_startup() is okay except for the part where UART_RX is
read without a check if there is something to read. I tried to
workaround it in commit 0aa525d11859 ("tty: serial: 8250_core: read only
RX if there is something in the FIFO") but then reverted it later in
commit ca8bb4aefb9 ("serial: 8250: Revert "tty: serial: 8250_core: read
only RX if there is something in the FIFO"").
This is the second attempt to get it to work on older OMAPs without
breaking other chips this time
Peter Hurley suggested to pull in the few needed lines from
serial8250_do_startup() and drop everything else that is not required
including making it simpler like using just request_irq() instead the
chain handler like it is doing now.
So lets try that.
Fixes: ca8bb4aefb93 ("serial: 8250: Revert "tty: serial: 8250_core:
read only RX if there is something in the FIFO"")
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The driver configures the IDLE condition to interrupt the SDMA engine. Since the SDMA UART ROM script doesn't clear the IDLE bit itself, this caused repeated 1-byte DMA transfers, regardless of available data in the RX FIFO. Also, when returning due to the IDLE condition, the UART ROM script already increased its counter, causing residue to be off by one. This patch clears the IDLE condition to avoid repeated 1-byte DMA transfers and decreases count by when the DMA transfer was aborted due to the IDLE condition, fixing serial transfers using DMA on i.MX6Q. Reported-by: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Tested-by: Fabio Estevam <fabio.estevam@freescale.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit 734745caeb9f155ab58918834a8c70e83fa6afd3 serial/amba-pl011: (Activate TX IRQ passively) introduces a race which causes the driver sometimes to attempt to write a character to the TX FIFO when the FIFO is already full. The PL011 does not guarantee its behaviour when the FIFO is overfilled. In practice, this can cause duplicate and/or dropped characters to be output on the wire. The problem is common enough to be readily observable on the ARM Juno platform when the PL011 UART is used as the console and DMA is not in use. This patch fixes this problem by always polling for space before each character is written to the FIFO. This will be amended to a less brute-force approach in a later commit, but this patch should help ensure correct behaviour for now. Signed-off-by: Dave Martin <Dave.Martin@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit f2ee6dfa0e8597eea8b98d240b0033994e20d215. Jakub Kiciński observed that this patch can cause the pl011 driver to hang if if the only process with a pl011 port open is killed by a signal, pl011_shutdown() can get called with an arbitrary amount of data still in the FIFO. Calling _shutdown() with the TX FIFO non-empty is questionable behaviour and my itself be a bug. Since the affected patch was speculative anyway, and brings limited benefit, the simplest course is to remove the assumption that TXIS will always be left asserted after the port is shut down. Signed-off-by: Dave Martin <Dave.Martin@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
There is pm_qos_add_request() being executed on serial_omap_probe(),
which stores "&up->pm_qos_request" from omap-serial driver to
"pm_qos_array[PM_QOS_CPU_DMA_LATENCY]->constraints". If
serial_omap_probe() fails after pm_qos_add_request() (e.g. on
uart_add_one_port() call), pm_qos_array still keeping pm_qos_request
struct from omap-serial driver, which is not valid anymore (since driver
failed). This leads further to kernel crash on pm_qos_update_target(),
executing from some completely different driver.
We were observing this while trying to run audio playback while having
one of omap-serial driver instances failed on uart_add_one_port() call:
Unable to handle kernel paging request at virtual address fffffffc
Backtrace:
(plist_add) from (pm_qos_update_target)
(pm_qos_update_target) from (pm_qos_add_request)
(pm_qos_add_request) from (snd_pcm_hw_params)
(snd_pcm_hw_params) from (snd_pcm_common_ioctl1)
(snd_pcm_common_ioctl1) from (snd_pcm_playback_ioctl1)
(snd_pcm_playback_ioctl1) from (snd_pcm_playback_ioctl)
(snd_pcm_playback_ioctl) from (do_vfs_ioctl)
(do_vfs_ioctl) from (SyS_ioctl)
(SyS_ioctl) from (ret_fast_syscall)
This patch adds pm_qos_remove_request() on fail path in
serial_omap_probe() in order to fix this issue. While at it, free the
wakeup settings on fail path as well, just like it's done in
serial_omap_remove().
Signed-off-by: Semen Protsenko <semen.protsenko@globallogic.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Log warnings meant to help diagnose problems setting up earlycon are reporting false positives for 'console='. Revert to the previous behavior which reported nothing. Cc: Maciej W. Rozycki <macro@linux-mips.org> Cc: Robert Schwebel <r.schwebel@pengutronix.de> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>