29 Jan, 2016

1 commit

  • Only the N_TTY line discipline implements the signal-driven i/o
    notification enabled/disabled by fcntl(F_SETFL, O_ASYNC). The ldisc
    fasync() notification is sent to the ldisc when the enable state has
    changed (the tty core is notified via the fasync() VFS file operation).

    The N_TTY line discipline used the enable state to change the wakeup
    condition (minimum_to_wake = 1) for notifying the signal handler i/o is
    available. However, just the presence of data is sufficient and necessary
    to signal i/o is available, so changing minimum_to_wake is unnecessary
    (and creates a race condition with read() and poll() which may be
    concurrently updating minimum_to_wake).

    Furthermore, since the kill_fasync() VFS helper performs no action if
    the fasync list is empty, calling unconditionally is preferred; if
    signal driven i/o just has been disabled, no signal will be sent by
    kill_fasync() anyway so notification of the change via the ldisc
    fasync() method is superfluous.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

28 Jan, 2016

1 commit

  • The chars_in_buffer() line discipline method serves no functional
    purpose, other than as a (dubious) debugging aid for mostly bit-rotting
    drivers. Despite being documented as an optional method, every caller
    is unconditionally executed (although conditionally compiled).
    Furthermore, direct tty->ldisc access without an ldisc ref is unsafe.
    Lastly, N_TTY's chars_in_buffer() has warned of removal since 3.12.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

25 Apr, 2014

1 commit

  • In the uart_handle_cts_change(), uart_write_wakeup() is called after
    we call @uart_port->ops->start_tx().

    The Documentation/serial/driver tells us:
    -----------------------------------------------
    start_tx(port)
    Start transmitting characters.

    Locking: port->lock taken.
    Interrupts: locally disabled.
    -----------------------------------------------

    So when the uart_write_wakeup() is called, the port->lock is taken by
    the upper. See the following callstack:

    |_ uart_write_wakeup
    |_ tty_wakeup
    |_ ld->ops->write_wakeup

    With the port->lock held, we call the @write_wakeup. Some implemetation of
    the @write_wakeup does not notice that the port->lock is held, and it still
    tries to send data with uart_write() which will try to grab the prot->lock.
    A dead lock occurs, see the following log caught in the Bluetooth by uart:

    --------------------------------------------------------------------
    BUG: spinlock lockup suspected on CPU#0, swapper/0/0
    lock: 0xdc3f4410, .magic: dead4ead, .owner: swapper/0/0, .owner_cpu: 0
    CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 3.10.17-16839-ge4a1bef #1320
    [] (unwind_backtrace+0x0/0x138) from [] (show_stack+0x10/0x14)
    [] (show_stack+0x10/0x14) from [] (do_raw_spin_lock+0x108/0x184)
    [] (do_raw_spin_lock+0x108/0x184) from [] (_raw_spin_lock_irqsave+0x54/0x60)
    [] (_raw_spin_lock_irqsave+0x54/0x60) from [] (uart_write+0x38/0xe0)
    [] (uart_write+0x38/0xe0) from [] (hci_uart_tx_wakeup+0xa4/0x168)
    [] (hci_uart_tx_wakeup+0xa4/0x168) from [] (tty_wakeup+0x50/0x5c)
    [] (tty_wakeup+0x50/0x5c) from [] (imx_rtsint+0x50/0x80)
    [] (imx_rtsint+0x50/0x80) from [] (imx_int+0x158/0x17c)
    [] (imx_int+0x158/0x17c) from [] (handle_irq_event_percpu+0x50/0x194)
    [] (handle_irq_event_percpu+0x50/0x194) from [] (handle_irq_event+0x3c/0x5c)
    --------------------------------------------------------------------

    This patch adds more limits to the @write_wakeup, the one who wants to
    implemet the @write_wakeup should follow the limits which avoid the deadlock.

    Signed-off-by: Huang Shijie
    Signed-off-by: Felipe Balbi
    Signed-off-by: Greg Kroah-Hartman

    Huang Shijie
     

19 Feb, 2014

1 commit


09 Dec, 2013

1 commit

  • Most line disciplines already handle the undocumented NULL flag
    ptr in their .receive_buf method; however, several don't.

    Document the NULL flag ptr, and correct handling in the
    N_MOUSE, N_GSM0710 and N_R394 line disciplines.

    Signed-off-by: Peter Hurley
    Acked-by: Dmitry Torokhov
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

24 Jul, 2013

2 commits

  • Although line discipline receiving is single-producer/single-consumer,
    using tty->receive_room to manage flow control creates unnecessary
    critical regions requiring additional lock use.

    Instead, introduce the optional .receive_buf2() ldisc method which
    returns the # of bytes actually received. Serialization is guaranteed
    by the caller.

    In turn, the line discipline should schedule the buffer work item
    whenever space becomes available; ie., when there is room to receive
    data and receive_room() previously returned 0 (the buffer work
    item stops processing if receive_buf2() returns 0). Note the
    'no room' state need not be atomic despite concurrent use by two
    threads because only the buffer work thread can set the state and
    only the read() thread can clear the state.

    Add n_tty_receive_buf2() as the receive_buf2() method for N_TTY.
    Provide a public helper function, tty_ldisc_receive_buf(), to use
    when directly accessing the receive_buf() methods.

    Line disciplines not using input flow control can continue to set
    tty->receive_room to a fixed value and only provide the receive_buf()
    method.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Line discipline locking was performed with a combination of
    a mutex, a status bit, a count, and a waitqueue -- basically,
    a rw semaphore.

    Replace the existing combination with an ld_semaphore.

    Fixes:
    1) the 'reference acquire after ldisc locked' bug
    2) the over-complicated halt mechanism
    3) lock order wrt. tty_lock()
    4) dropping locks while changing ldisc
    5) previously unidentified deadlock while locking ldisc from
    both linked ttys concurrently
    6) previously unidentified recursive deadlocks

    Adds much-needed lockdep diagnostics.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

18 Jun, 2013

1 commit

  • minimum_to_wake is unique to N_TTY processing, and belongs in
    per-ldisc data.

    Add the ldisc method, ldisc_ops::fasync(), to notify line disciplines
    when signal-driven I/O is enabled or disabled. When enabled for N_TTY
    (by fcntl(F_SETFL, O_ASYNC)), blocking reader/polls will be woken
    for any readable input. When disabled, blocking reader/polls are not
    woken until the read buffer is full.

    Canonical mode (L_ICANON(tty), n_tty_data::icanon) is not affected by
    the minimum_to_wake setting.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

21 May, 2013

1 commit

  • The semantics of a rw semaphore are almost ideally suited
    for tty line discipline lifetime management; multiple active
    threads obtain "references" (read locks) while performing i/o
    to prevent the loss or change of the current line discipline
    (write lock).

    Unfortunately, the existing rw_semaphore is ill-suited in other
    ways;
    1) TIOCSETD ioctl (change line discipline) expects to return an
    error if the line discipline cannot be exclusively locked within
    5 secs. Lock wait timeouts are not supported by rwsem.
    2) A tty hangup is expected to halt and scrap pending i/o, so
    exclusive locking must be prioritized.
    Writer priority is not supported by rwsem.

    Add ld_semaphore which implements these requirements in a
    semantically similar way to rw_semaphore.

    Writer priority is handled by separate wait lists for readers and
    writers. Pending write waits are priortized before existing read
    waits and prevent further read locks.

    Wait timeouts are trivially added, but obviously change the lock
    semantics as lock attempts can fail (but only due to timeout).

    This implementation incorporates the write-lock stealing work of
    Michel Lespinasse .

    Cc: Michel Lespinasse
    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

19 Mar, 2013

1 commit


14 Feb, 2013

1 commit

  • The PPS (Pulse-Per-Second) line discipline has developed a number of
    unhealthy attachments to core tty data and functions, ultimately leading
    to its breakage.

    The previous patches fixed the crashing. This one reduces coupling further
    by eliminating the timestamp parameter from the dcd_change ldisc method.
    This reduces header file linkage and makes the extension more generic,
    and the timestamp read is delayed only slightly, from just before the
    ldisc->ops->dcd_change method call to just after.

    Fix attendant build breakage in
    drivers/tty/n_tty.c
    drivers/tty/tty_buffer.c
    drivers/staging/speakup/selection.c
    drivers/staging/dgrp/dgrp_*.c

    Cc: William Hubbs
    Cc: Chris Brannon
    Cc: Kirk Reiser
    Cc: Samuel Thibault
    Signed-off-by: Peter Hurley
    Signed-off-by: George Spelvin
    Acked-by: Rodolfo Giometti
    Signed-off-by: Greg Kroah-Hartman

    George Spelvin
     

11 May, 2012

1 commit


04 Jun, 2011

1 commit

  • This reverts commit b1c43f82c5aa265442f82dba31ce985ebb7aa71c.

    It was broken in so many ways, and results in random odd pty issues.

    It re-introduced the buggy schedule_work() in flush_to_ldisc() that can
    cause endless work-loops (see commit a5660b41af6a: "tty: fix endless
    work loop when the buffer fills up").

    It also used an "unsigned int" return value fo the ->receive_buf()
    function, but then made multiple functions return a negative error code,
    and didn't actually check for the error in the caller.

    And it didn't actually work at all. BenH bisected down odd tty behavior
    to it:
    "It looks like the patch is causing some major malfunctions of the X
    server for me, possibly related to PTYs. For example, cat'ing a
    large file in a gnome terminal hangs the kernel for -minutes- in a
    loop of what looks like flush_to_ldisc/workqueue code, (some ftrace
    data in the quoted bits further down).

    ...

    Some more data: It -looks- like what happens is that the
    flush_to_ldisc work queue entry constantly re-queues itself (because
    the PTY is full ?) and the workqueue thread will basically loop
    forver calling it without ever scheduling, thus starving the consumer
    process that could have emptied the PTY."

    which is pretty much exactly the problem we fixed in a5660b41af6a.

    Milton Miller pointed out the 'unsigned int' issue.

    Reported-by: Benjamin Herrenschmidt
    Reported-by: Milton Miller
    Cc: Stefan Bigler
    Cc: Toby Gray
    Cc: Felipe Balbi
    Cc: Greg Kroah-Hartman
    Cc: Alan Cox
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

23 Apr, 2011

1 commit

  • it makes it simpler to keep track of the amount of
    bytes received and simplifies how flush_to_ldisc counts
    the remaining bytes. It also fixes a bug of lost bytes
    on n_tty when flushing too many bytes via the USB
    serial gadget driver.

    Tested-by: Stefan Bigler
    Tested-by: Toby Gray
    Signed-off-by: Felipe Balbi
    Signed-off-by: Greg Kroah-Hartman

    Felipe Balbi
     

14 Jan, 2011

2 commits


13 Mar, 2010

1 commit


05 Aug, 2009

1 commit

  • This is pure preparation of changing the ldisc reference counting to be
    a true refcount that defines the lifetime of the ldisc. But this is a
    purely syntactic change for now to make the next steps easier.

    This patch should make no semantic changes at all. But I wanted to make
    the ldisc refcount be an atomic (I will be touching it without locks
    soon enough), and I wanted to rename it so that there isn't quite as
    much confusion between 'ldo->refcount' (ldisk operations refcount) and
    'ld->refcount' (ldisc refcount itself) in the same file.

    So it's now an atomic 'ld->users' count. It still starts at zero,
    despite having a reference from 'tty->ldisc', but that will change once
    we turn it into a _real_ refcount.

    Signed-off-by: Linus Torvalds
    Tested-by: OGAWA Hirofumi
    Tested-by: Sergey Senozhatsky
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Linus Torvalds
     

21 Jul, 2008

1 commit

  • Move the line disciplines towards a conventional ->ops arrangement. For
    the moment the actual 'tty_ldisc' struct in the tty is kept as part of
    the tty struct but this can then be changed if it turns out that when it
    all settles down we want to refcount ldiscs separately to the tty.

    Pull the ldisc code out of /proc and put it with our ldisc code.

    Signed-off-by: Alan Cox
    Signed-off-by: Linus Torvalds

    Alan Cox
     

11 May, 2007

1 commit

  • Add compat_ioctl method for tty code to allow processing of 32 bit ioctl
    calls on 64 bit systems by tty core, tty drivers, and line disciplines.

    Based on patch by Arnd Bergmann:
    http://www.uwsg.iu.edu/hypermail/linux/kernel/0511.0/1732.html

    [akpm@linux-foundation.org: make things static]
    Signed-off-by: Paul Fulghum
    Acked-by: Arnd Bergmann
    Cc: Alan Cox
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Paul Fulghum
     

09 Dec, 2006

1 commit

  • This is the core of the switch to the new framework. I've split it from the
    driver patches which are mostly search/replace and would encourage people to
    give this one a good hard stare.

    The references to BOTHER and ISHIFT are the termios values that must be
    defined by a platform once it wants to turn on "new style" ioctl support. The
    code patches here ensure that providing

    1. The termios overlays the ktermios in memory
    2. The only new kernel only fields are c_ispeed/c_ospeed (or none)

    the existing behaviour is retained. This is true for the patches at this
    point in time.

    Future patches will define BOTHER, ISHIFT and enable newer termios structures
    for each architecture, and once they are all done some of the ifdefs also
    vanish.

    [akpm@osdl.org: warning fix]
    [akpm@osdl.org: IRDA fix]
    Signed-off-by: Alan Cox
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alan Cox
     

11 Jan, 2006

1 commit

  • The API and code have been through various bits of initial review by
    serial driver people but they definitely need to live somewhere for a
    while so the unconverted drivers can get knocked into shape, existing
    drivers that have been updated can be better tuned and bugs whacked out.

    This replaces the tty flip buffers with kmalloc objects in rings. In the
    normal situation for an IRQ driven serial port at typical speeds the
    behaviour is pretty much the same, two buffers end up allocated and the
    kernel cycles between them as before.

    When there are delays or at high speed we now behave far better as the
    buffer pool can grow a bit rather than lose characters. This also means
    that we can operate at higher speeds reliably.

    For drivers that receive characters in blocks (DMA based, USB and
    especially virtualisation) the layer allows a lot of driver specific
    code that works around the tty layer with private secondary queues to be
    removed. The IBM folks need this sort of layer, the smart serial port
    people do, the virtualisers do (because a virtualised tty typically
    operates at infinite speed rather than emulating 9600 baud).

    Finally many drivers had invalid and unsafe attempts to avoid buffer
    overflows by directly invoking tty methods extracted out of the innards
    of work queue structs. These are no longer needed and all go away. That
    fixes various random hangs with serial ports on overflow.

    The other change in here is to optimise the receive_room path that is
    used by some callers. It turns out that only one ldisc uses receive room
    except asa constant and it updates it far far less than the value is
    read. We thus make it a variable not a function call.

    I expect the code to contain bugs due to the size alone but I'll be
    watching and squashing them and feeding out new patches as it goes.

    Because the buffers now dynamically expand you should only run out of
    buffering when the kernel runs out of memory for real. That means a lot of
    the horrible hacks high performance drivers used to do just aren't needed any
    more.

    Description:

    tty_insert_flip_char is an old API and continues to work as before, as does
    tty_flip_buffer_push() [this is why many drivers dont need modification]. It
    does now also return the number of chars inserted

    There are also

    tty_buffer_request_room(tty, len)

    which asks for a buffer block of the length requested and returns the space
    found. This improves efficiency with hardware that knows how much to
    transfer.

    and tty_insert_flip_string_flags(tty, str, flags, len)

    to insert a string of characters and flags

    For a smart interface the usual code is

    len = tty_request_buffer_room(tty, amount_hardware_says);
    tty_insert_flip_string(tty, buffer_from_card, len);

    More description!

    At the moment tty buffers are attached directly to the tty. This is causing a
    lot of the problems related to tty layer locking, also problems at high speed
    and also with bursty data (such as occurs in virtualised environments)

    I'm working on ripping out the flip buffers and replacing them with a pool of
    dynamically allocated buffers. This allows both for old style "byte I/O"
    devices and also helps virtualisation and smart devices where large blocks of
    data suddenely materialise and need storing.

    So far so good. Lots of drivers reference tty->flip.*. Several of them also
    call directly and unsafely into function pointers it provides. This will all
    break. Most drivers can use tty_insert_flip_char which can be kept as an API
    but others need more.

    At the moment I've added the following interfaces, if people think more will
    be needed now is a good time to say

    int tty_buffer_request_room(tty, size)

    Try and ensure at least size bytes are available, returns actual room (may be
    zero). At the moment it just uses the flipbuf space but that will change.
    Repeated calls without characters being added are not cumulative. (ie if you
    call it with 1, 1, 1, and then 4 you'll have four characters of space. The
    other functions will also try and grow buffers in future but this will be a
    more efficient way when you know block sizes.

    int tty_insert_flip_char(tty, ch, flag)

    As before insert a character if there is room. Now returns 1 for success, 0
    for failure.

    int tty_insert_flip_string(tty, str, len)

    Insert a block of non error characters. Returns the number inserted.

    int tty_prepare_flip_string(tty, strptr, len)

    Adjust the buffer to allow len characters to be added. Returns a buffer
    pointer in strptr and the length available. This allows for hardware that
    needs to use functions like insl or mencpy_fromio.

    Signed-off-by: Alan Cox
    Cc: Paul Fulghum
    Signed-off-by: Hirokazu Takata
    Signed-off-by: Serge Hallyn
    Signed-off-by: Jeff Dike
    Signed-off-by: John Hawkes
    Signed-off-by: Martin Schwidefsky
    Signed-off-by: Adrian Bunk
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alan Cox
     

17 Apr, 2005

1 commit

  • Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds