linux-toradex.git/drivers/tty, branch v3.14.35

vt: provide notifications on selection changes

2015-03-06T22:43:30+00:00

commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream.

The vcs device's poll/fasync support relies on the vt notifier to signal
changes to the screen content.  Notifier invocations were missing for
changes that comes through the selection interface though.  Fix that.

Tested with BRLTTY 5.2.

Signed-off-by: Nicolas Pitre 
Cc: Dave Mielke 
Signed-off-by: Greg Kroah-Hartman

tty/serial: at91: fix error handling in atmel_serial_probe()

2015-03-06T22:43:30+00:00

commit 6fbb9bdf0f3fbe23aeff806489791aa876adaffb upstream.

-EDEFER error wasn't handle properly by atmel_serial_probe().
As an example, when atmel_serial_probe() is called for the first time, we pass
the test_and_set_bit() test to check whether the port has already been
initalized. Then we call atmel_init_port(), which may return -EDEFER, possibly
returned before by clk_get(). Consequently atmel_serial_probe() used to return
this error code WITHOUT clearing the port bit in the "atmel_ports_in_use" mask.
When atmel_serial_probe() was called for the second time, it used to fail on
the test_and_set_bit() function then returning -EBUSY.

When atmel_serial_probe() fails, this patch make it clear the port bit in the
"atmel_ports_in_use" mask, if needed, before returning the error code.

Signed-off-by: Cyrille Pitchen 
Acked-by: Nicolas Ferre 
Signed-off-by: Greg Kroah-Hartman

tty: Prevent untrappable signals from malicious program

2015-03-06T22:43:30+00:00

commit 37480a05685ed5b8e1b9bf5e5c53b5810258b149 upstream.

Commit 26df6d13406d1a5 ("tty: Add EXTPROC support for LINEMODE")
allows a process which has opened a pty master to send _any_ signal
to the process group of the pty slave. Although potentially
exploitable by a malicious program running a setuid program on
a pty slave, it's unknown if this exploit currently exists.

Limit to signals actually used.

Cc: Theodore Ts'o 
Cc: Howard Chu 
Cc: One Thousand Gnomes 
Cc: Jiri Slaby 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Fix pty master poll() after slave closes v2

2015-01-30T01:40:51+00:00

commit c4dc304677e8d566572c4738d95c48be150c6606 upstream.

Commit f95499c3030f ("n_tty: Don't wait for buffer work in read() loop")
introduces a race window where a pty master can be signalled that the pty
slave was closed before all the data that the slave wrote is delivered.
Commit f8747d4a466a ("tty: Fix pty master read() after slave closes") fixed the
problem in case of n_tty_read, but the problem still exists for n_tty_poll.
This can be seen by running 'for ((i=0; i<100;i++));do ./test.py ;done'
where test.py is:

import os, select, pty

(pid, pty_fd) = pty.fork()

if pid == 0:
   os.write(1, 'This string should be received by parent')
else:
   poller = select.epoll()
   poller.register( pty_fd, select.EPOLLIN )
   ready = poller.poll( 1 * 1000 )
   for fd, events in ready:
      if not events & select.EPOLLIN:
         print 'missed POLLIN event'
      else:
         print os.read(fd, 100)
   poller.close()

The string from the slave is missed several times.
This patch takes the same approach as the fix for read and special cases
this condition for poll.
Tested on 3.16.

Signed-off-by: Francesco Ruggeri 
Cc: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

n_tty: Fix read_buf race condition, increment read_head after pushing data

2015-01-16T14:59:32+00:00

commit 8bfbe2de769afda051c56aba5450391670e769fc upstream.

Commit 19e2ad6a09f0c06dbca19c98e5f4584269d913dd ("n_tty: Remove overflow
tests from receive_buf() path") moved the increment of read_head into
the arguments list of read_buf_addr(). Function calls represent a
sequence point in C. Therefore read_head is incremented before the
character c is placed in the buffer. Since the circular read buffer is
a lock-less design since commit 6d76bd2618535c581f1673047b8341fd291abc67
("n_tty: Make N_TTY ldisc receive path lockless"), this creates a race
condition that leads to communication errors.

This patch modifies the code to increment read_head _after_ the data
is placed in the buffer and thus fixes the race for non-SMP machines.
To fix the problem for SMP machines, memory barriers must be added in
a separate patch.

Signed-off-by: Christian Riesch 
Signed-off-by: Greg Kroah-Hartman

serial: samsung: wait for transfer completion before clock disable

2015-01-16T14:59:32+00:00

commit 1ff383a4c3eda8893ec61b02831826e1b1f46b41 upstream.

This patch adds waiting until transmit buffer and shifter will be empty
before clock disabling.

Without this fix it's possible to have clock disabled while data was
not transmited yet, which causes unproper state of TX line and problems
in following data transfers.

Signed-off-by: Robert Baldyga 
Signed-off-by: Greg Kroah-Hartman

tty: Fix high cpu load if tty is unreleaseable

2014-11-14T17:00:10+00:00

commit 37b164578826406a173ca7c20d9ba7430134d23e upstream.

Kernel oops can cause the tty to be unreleaseable (for example, if
n_tty_read() crashes while on the read_wait queue). This will cause
tty_release() to endlessly loop without sleeping.

Use a killable sleep timeout which grows by 2n+1 jiffies over the interval
[0, 120 secs.) and then jumps to forever (but still killable).

NB: killable just allows for the task to be rewoken manually, not
to be terminated.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

serial: Fix divide-by-zero fault in uart_get_divisor()

2014-11-14T17:00:02+00:00

commit 547039ec502076e60034eeb79611df3433a99b7d upstream.

uart_get_baud_rate() will return baud == 0 if the max rate is set
to the "magic" 38400 rate and the SPD_* flags are also specified.
On the first iteration, if the current baud rate is higher than the
max, the baud rate is clamped at the max (which in the degenerate
case is 38400). On the second iteration, the now-"magic" 38400 baud
rate selects the possibly higher alternate baud rate indicated by
the SPD_* flag. Since only two loop iterations are performed, the
loop is exited, a kernel WARNING is generated and a baud rate of
0 is returned.

Reproducible with:
 setserial /dev/ttyS0 spd_hi base_baud 38400

Only perform the "magic" 38400 -> SPD_* baud transform on the first
loop iteration, which prevents the degenerate case from recognizing
the clamped baud rate as the "magic" 38400 value.

Reported-by: Robert Święcki 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: omap-serial: fix division by zero

2014-10-30T16:38:22+00:00

commit dc3187564e61260f49eceb21a4e7eb5e4428e90a upstream.

If the chosen baud rate is large enough (e.g. 3.5 megabaud), the
calculated n values in serial_omap_is_baud_mode16() may become 0. This
causes a division by zero when calculating the difference between
calculated and desired baud rates. To prevent this, cap the n13 and n16
values on 1.

Division by zero in kernel.
[] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[] (show_stack) from [] (Ldiv0+0x8/0x10)
[] (Ldiv0) from [] (serial_omap_baud_is_mode16+0x4c/0x68)
[] (serial_omap_baud_is_mode16) from [] (serial_omap_set_termios+0x90/0x8d8)
[] (serial_omap_set_termios) from [] (uart_change_speed+0xa4/0xa8)
[] (uart_change_speed) from [] (uart_set_termios+0xa0/0x1fc)
[] (uart_set_termios) from [] (tty_set_termios+0x248/0x2c0)
[] (tty_set_termios) from [] (set_termios+0x248/0x29c)
[] (set_termios) from [] (tty_mode_ioctl+0x1c8/0x4e8)
[] (tty_mode_ioctl) from [] (tty_ioctl+0xa94/0xb18)
[] (tty_ioctl) from [] (do_vfs_ioctl+0x4a0/0x560)
[] (do_vfs_ioctl) from [] (SyS_ioctl+0x4c/0x74)
[] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x30)

Signed-off-by: Frans Klaver 
Signed-off-by: Greg Kroah-Hartman

serial: 8250: Add Quark X1000 to 8250_pci.c

2014-10-15T06:36:43+00:00

commit 1ede7dcca3c4fa15a518ab0473126f9c3e621e4c upstream.

Quark X1000 contains two designware derived 8250 serial ports.
Each port has a unique PCI configuration space consisting of
BAR0:UART BAR1:DMA respectively.

Unlike the standard 8250 the register width is 32 bits for RHR,IER etc
The Quark UART has a fundamental clock @ 44.2368 MHz allowing for a
bitrate of up to about 2.76 megabits per second.

This patch enables standard 8250 mode

Signed-off-by: Bryan O'Donoghue 
Reviewed-by: Heikki Krogerus 
Signed-off-by: Greg Kroah-Hartman