Problem Observed:
- interrupt status is set by rising or falling edge on CTS line
- interrupt status is cleared on a .0. to .1. transition of the
  interrupt-clear register bit 1.
- interrupt-clear register is reset by hardware once the interrupt
  status is .0..
  Remark: It seems not possible to read this register back by the
  CPU though, but internally this register exists.
- when simultaneous set and reset event on the interrupt status
  happens, then the set-event has priority and the status remains
  .1.. As a result the interrupt-clear register is not reset to
  .0., and no new .0. to .1. transition can be detected on it when
  writing a .1. to it.
  This implies race condition, the clear must be performed at least
  one UARTCLK the riding edge of CTS RIS interrupt.

Fix:
  Instead of resetting UART as done in commit
  c16d51a3
  "amba pl011: workaround for uart registers lockup" do the
  following:

  write .0. and then  .1. to the interrupt-clear register to make
  sure that this transition is detected. According to the datasheet
  writing a .0. does not have any effect, but actually it allows to
  reset the internal interrupt-clear register.

  Take into account:
  The .0. needs to last at least for one clk_uart clock period
  (~ 38 MHz, 26.08ns)

This way we can do away with the tasklet and keep only a tiny
fix triggered by the variant flag introduced in this patch.
Signed-off-by: NGuillaume Jaunet <guillaume.jaunet@stericsson.com>
Signed-off-by: NChristophe Arnal <christophe.arnal@stericsson.com>
Signed-off-by: NMatthias Locher  <Matthias.Locher@stericsson.com>
Signed-off-by: NRajanikanth H.V <rajanikanth.hv@stericsson.com>
Reviewed-by: NSrinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix compile error caused by "TTY: con3215, use tty from tty_port":

 CC      drivers/s390/char/con3215.o
drivers/s390/char/con3215.c: In function 'raw3215_wakeup':
drivers/s390/char/con3215.c:339:16: error: 'struct raw3215_info' has no member named 'tty'
make[1]: *** [drivers/s390/char/con3215.o] Error 1
make: *** [drivers/s390/char/] Error 2

Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Obtain tty_struct only once in ISR and pass it down to
raw3215_next_io. Other than that, we just use the tty with raised
reference. And set it properly in open and close.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: linux390@de.ibm.com
Cc: linux-s390@vger.kernel.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use flags from that. But first we have to get rid of duplicated
flag names. From now on, for the standard ones that are stored in
tty_port->flags, we use ASYNC_* ones.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: linux390@de.ibm.com
Cc: linux-s390@vger.kernel.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

A -next commit "TTY: HVC, use tty from tty_port" switched the driver
to use tty_port helper for tty refcounting. But it omitted to remove
manual tty refcounting from open, close and hangup. So now we are
getting random crashes caused by use-after-free:
Unable to handle kernel paging request for data at address 0xc0000003f9d550
Faulting instruction address: 0xc0000000001b7f40
Oops: Kernel access of bad area, sig: 11 [#1]
...
NIP: c0000000001b7f40 LR: c0000000001b7f14 CTR: c0000000000e04f0
...
NIP [c0000000001b7f40] .__kmalloc+0x70/0x230
LR [c0000000001b7f14] .__kmalloc+0x44/0x230
Call Trace:
[c0000003f68bf930] [c0000003f68bf9b0] 0xc0000003f68bf9b0 (unreliable)
[c0000003f68bf9e0] [c0000000001e5424] .alloc_fdmem+0x24/0x70
[c0000003f68bfa60] [c0000000001e54f8] .alloc_fdtable+0x88/0x130
[c0000003f68bfaf0] [c0000000001e5924] .dup_fd+0x384/0x450
[c0000003f68bfbd0] [c00000000009a310] .copy_process+0x880/0x11d0
[c0000003f68bfcd0] [c00000000009aee0] .do_fork+0x70/0x400
[c0000003f68bfdc0] [c0000000000141c4] .sys_clone+0x54/0x70
[c0000003f68bfe30] [c000000000009aa0] .ppc_clone+0x8/0xc

Fix that by complete removal of tty_kref_get/put in open/close/hangup
paths.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Reported-and-tested-by: NMichael Neuling <mikey@neuling.org>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: ppc-dev <linuxppc-dev@lists.ozlabs.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit "ISDN: i4l, remove cvs crap" removed definition of
isdn_tty_revision, but there is still a user. So this causes linking
errors. This was hidden from my radar because the variable was not
declared in any header. Instead isdn_common.c declares it locally.

So remove this variable also from isdn_common.c, because there is
really no way to find out the version. Git commit or tag is...
Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

tty_buffer_request_room is well protected, but while after it returns,
 it releases the port->lock. tty->buf.tail might be modified
by either irq handler or other threads. The patch adds more protection
by holding the lock across tty buffer finding and buffer filling.
Signed-off-by: NAlek Du <alek.du@intel.com>
Signed-off-by: NXiaobing Tu <xiaobing.tu@intel.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

set_get_cmap() ignored the result of {get,put}_user(), causing ioctl(vt,
{G,P}IO_CMAP, 0xdeadbeef) to silently fail.

Another side effect of this: calling the PIO_CMAP ioctl with an invalid
buffer would zero the default colormap and the palette for all vts (all
colors set to black).

Leave the default colormap intact and return -EFAULT when
reading/writing to the userspace buffer fails.
Signed-off-by: NMichael Gehring <mg@ebfe.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add initialize variable to prevent duplicate free memory.
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently, occurring line status interrupt,
returned value is not set in interrupt handler function.
As a result, 0 can be returned.

This patch adds setting returned value.
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

%02x format is easier to understand better than %d.
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Target uart register access size is 8bit.
However, 32bit is used at 2 points.

This patch modifies type "unsigned int" to "unsigned char".
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This means converting an atomic counter to a counter protected by
lock. This is the first step needed to convert the rest of the code to
the tty_port helpers.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

tty_wakeup is safe to be called from all contexts. No need to schedule
a work for that. Let us call it directly like in other drivers.

This allows us to kill another member of rfcomm_dev structure.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Switch the refcounting from manual atomic plays with refcounter to the
one offered by tty_port.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use tty from there.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use count from there.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Since the code is identical, use the tty_port_block_til_ready helper
instead of re-implemented variant.

The code does not perform rtsdts handling, hence we do not need to
provide tty port hooks for them. The default ones will be used
instead. The only necessary thing is to provide tty_port_operations.
It is empty, but has to be there...
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And refcount that properly.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We need tty at some places, but info->tty might be NULL at those. Let
us propagate tty from callers where we know we have a valid tty. This
will make a switch to tty refcounting simpler.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use count and blocked_count from that.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

All the needed stuff is moved to 68328serial.c now.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

flags passed to local_irq_save/restore should be ulong. Switch tehem
to that. Otherwise we get compilation warnings:
.../68328serial.c:248:9: warning: comparison of distinct pointer types lacks a cast [enabled by default]
.../68328serial.c:257:9: warning: comparison of distinct pointer types lacks a cast [enabled by default]
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

- empty functions
- unused global variables
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Not everything from struct m68k_serial is really used. So remove
unused or only-set members of that structure. Next step is to move it
to 68328serial.c and remove 68328serial.h completely.

This change also takes status_handle and batten_down_hatches away
since they use break_abort but do nothing.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

serial_state in 68328serial.h is a duplicated structure. One is
defined in linux/serial.h. So let us use that instead. And since the
serial flags are identical, use ones from there too.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Cc: linux-m68k@lists.linux-m68k.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

It does not make the driver less racy though. Close and hangup should
be rewritten and tty refcounting used properly.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: NDavid Sterba <dsterba@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use count from that.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: NDavid Sterba <dsterba@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There are two functions which only print a status. Let us do that
directly at places where they are called.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: NDavid Sterba <dsterba@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Do not touch internal workqueue. Call tty_vhangup instead.

Note that finished hangup does not necessarily mean that all processes
are dead. Especially when the tty is a console. The code assumes that
right now.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: NDavid Sterba <dsterba@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now, we switch to the refcounted model and do not need hp->lock to
protect hp->tty anymore.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

- use tty, not hp->tty wherever possible
- pass tty down to some functions and go to step one
- do not defer tty_hangup calls -- it is as simple as schedule_work,
  so might be called with hp->lock held
- do not defer tty buffer flips -- since the driver does not use
  low_latency (it cannot actually), the flip is a simple tail move
  plus schedule_work. It will make our life easier in the next patch.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>