linux.git/drivers/tty, branch v6.3-rc3

Merge tag 'tty-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2023-03-19T17:09:58+00:00

Pull tty/serial driver fixes from Greg KH:
 "Here are some small tty and serial driver fixes for 6.3-rc3 to resolve
  some reported issues.

  They include:

   - 8250 driver Kconfig issue pointed out by you that showed up in -rc1

   - qcom-geni serial driver fixes

   - various 8250 driver fixes for reported problems

   - fsl_lpuart driver fixes

   - serdev fix for regression in -rc1

   - vt.c bugfix

  All have been in linux-next for over a week with no reported problems"

* tag 'tty-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  tty: vt: protect KD_FONT_OP_GET_TALL from unbound access
  serial: qcom-geni: drop bogus uart_write_wakeup()
  serial: qcom-geni: fix mapping of empty DMA buffer
  serial: qcom-geni: fix DMA mapping leak on shutdown
  serial: qcom-geni: fix console shutdown hang
  serdev: Set fwnode for serdev devices
  tty: serial: fsl_lpuart: fix race on RX DMA shutdown
  serial: 8250_pci1xxxx: Disable SERIAL_8250_PCI1XXXX config by default
  serial: 8250_fsl: fix handle_irq locking
  serial: 8250_em: Fix UART port type
  serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it
  tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
  Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency"

serial: sc16is7xx: Convert to i2c's .probe_new()

2023-03-09T20:58:53+00:00

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.

Reviewed-by: Greg Kroah-Hartman 
Link: https://lore.kernel.org/lkml/20221118224540.619276-572-uwe@kleine-koenig.org
Signed-off-by: Uwe Kleine-König 
Signed-off-by: Wolfram Sang

tty: vt: protect KD_FONT_OP_GET_TALL from unbound access

2023-03-09T16:56:56+00:00

In ioctl(KD_FONT_OP_GET_TALL), userland tells through op->height which
vpitch should be used to copy over the font. In con_font_get, we were
not checking that it is within the maximum height value, and thus
userland could make the vc->vc_sw->con_font_get(vc, &font, vpitch);
call possibly overflow the allocated max_font_size bytes, and the
copy_to_user(op->data, font.data, c) call possibly read out of that
allocated buffer.

By checking vpitch against max_font_height, the max_font_size buffer
will always be large enough for the vc->vc_sw->con_font_get(vc, &font,
vpitch) call (since we already prevent loading a font larger than that),
and c = (font.width+7)/8 * vpitch * font.charcount will always remain
below max_font_size.

Fixes: 24d69384bcd3 ("VT: Add KD_FONT_OP_SET/GET_TALL operations")
Reported-by: syzbot+3af17071816b61e807ed@syzkaller.appspotmail.com
Signed-off-by: Samuel Thibault 
Reviewed-by: Jiri Slaby 
Link: https://lore.kernel.org/r/20230306094921.tik5ewne4ft6mfpo@begin
Signed-off-by: Greg Kroah-Hartman

serial: qcom-geni: drop bogus uart_write_wakeup()

2023-03-09T16:27:53+00:00

Drop the bogus uart_write_wakeup() from when setting up a new DMA
transfer, which does not free up any more space in the ring buffer.

Any pending writers will be woken up when the transfer completes.

Cc: stable 
Signed-off-by: Johan Hovold 
Reviewed-by: Douglas Anderson 
Reviewed-by: Srinivas Kandagatla 
Tested-by: Srinivas Kandagatla 
Reviewed-by: Andrew Halaney 
Tested-by: Andrew Halaney  # sa8540p-ride
Link: https://lore.kernel.org/r/20230307164405.14218-5-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman

serial: qcom-geni: fix mapping of empty DMA buffer

2023-03-09T16:27:50+00:00

Make sure that there is data in the ring buffer before trying to set up
a zero-length DMA transfer.

This specifically fixes the following warning when unmapping the empty
buffer on the sc8280xp-crd:

   WARNING: CPU: 0 PID: 138 at drivers/iommu/dma-iommu.c:1046 iommu_dma_unmap_page+0xbc/0xd8
   ...
   Call trace:
    iommu_dma_unmap_page+0xbc/0xd8
    dma_unmap_page_attrs+0x30/0x1c8
    geni_se_tx_dma_unprep+0x28/0x38
    qcom_geni_serial_isr+0x358/0x75c

Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA")
Cc: stable 
Cc: Bartosz Golaszewski 
Signed-off-by: Johan Hovold 
Reviewed-by: Douglas Anderson 
Reviewed-by: Srinivas Kandagatla 
Tested-by: Srinivas Kandagatla 
Reviewed-by: Andrew Halaney 
Tested-by: Andrew Halaney  # sa8540p-ride
Link: https://lore.kernel.org/r/20230307164405.14218-4-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman

serial: qcom-geni: fix DMA mapping leak on shutdown

2023-03-09T16:27:47+00:00

Fix what appears to be a copy-paste error that can lead to a leaked DMA
mapping on close() and failure to restart TX after the port is reopened.

Note that rx_dma_addr is generally NULL when
qcom_geni_serial_stop_tx_dma() is called as part of shutdown() (but
tx_dma_addr need not be).

Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA")
Cc: stable 
Cc: Bartosz Golaszewski 
Signed-off-by: Johan Hovold 
Reviewed-by: Douglas Anderson 
Reviewed-by: Srinivas Kandagatla 
Tested-by: Srinivas Kandagatla 
Reviewed-by: Andrew Halaney 
Tested-by: Andrew Halaney  # sa8540p-ride
Link: https://lore.kernel.org/r/20230307164405.14218-3-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman

serial: qcom-geni: fix console shutdown hang

2023-03-09T16:27:44+00:00

A recent commit added back the calls top stop tx and rx to shutdown()
which had previously been removed by commit e83766334f96 ("tty: serial:
qcom_geni_serial: No need to stop tx/rx on UART shutdown") in order to
be able to use kgdb after stopping the getty.

Not only did this again break kgdb, but it also broke serial consoles
more generally by hanging TX when stopping the getty during reboot.

The underlying problem has been there since the driver was first merged
and fixing it is going to be a bit involved so simply stop calling the
broken stop functions during shutdown for consoles for now.

Fixes: d8aca2f96813 ("tty: serial: qcom-geni-serial: stop operations in progress at shutdown")
Cc: stable 
Cc: Bartosz Golaszewski 
Signed-off-by: Johan Hovold 
Reviewed-by: Douglas Anderson 
Reviewed-by: Srinivas Kandagatla 
Tested-by: Srinivas Kandagatla 
Reviewed-by: Andrew Halaney 
Tested-by: Andrew Halaney  # sa8540p-ride
Link: https://lore.kernel.org/r/20230307164405.14218-2-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman

serdev: Set fwnode for serdev devices

2023-03-09T16:09:56+00:00

This allow fw_devlink to do dependency tracking for serdev devices.

Reported-by: Florian Fainelli 
Link: https://lore.kernel.org/lkml/03b70a8a-0591-f28b-a567-9d2f736f17e5@gmail.com/
Cc: Stefan Wahren 
Signed-off-by: Saravana Kannan 
Tested-by: Stefan Wahren 
Tested-by: Florian Fainelli 
Link: https://lore.kernel.org/r/20230302023509.319903-1-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman

tty: serial: fsl_lpuart: fix race on RX DMA shutdown

2023-03-09T16:09:06+00:00

From time to time DMA completion can come in the middle of DMA shutdown:

:				:
lpuart32_shutdown()
  lpuart_dma_shutdown()
    del_timer_sync()
					lpuart_dma_rx_complete()
					  lpuart_copy_rx_to_tty()
					    mod_timer()
    lpuart_dma_rx_free()

When the timer fires a bit later, sport->dma_rx_desc is NULL:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
pc : lpuart_copy_rx_to_tty+0xcc/0x5bc
lr : lpuart_timer_func+0x1c/0x2c
Call trace:
 lpuart_copy_rx_to_tty
 lpuart_timer_func
 call_timer_fn
 __run_timers.part.0
 run_timer_softirq
 __do_softirq
 __irq_exit_rcu
 irq_exit
 handle_domain_irq
 gic_handle_irq
 call_on_irq_stack
 do_interrupt_handler
 ...

To fix this fold del_timer_sync() into lpuart_dma_rx_free() after
dmaengine_terminate_sync() to make sure timer will not be re-started in
lpuart_copy_rx_to_tty() <= lpuart_dma_rx_complete().

Fixes: 4a8588a1cf86 ("serial: fsl_lpuart: delete timer on shutdown")
Cc: stable 
Signed-off-by: Alexander Sverdlin 
Link: https://lore.kernel.org/r/20230309134302.74940-2-alexander.sverdlin@siemens.com
Signed-off-by: Greg Kroah-Hartman

serial: 8250_pci1xxxx: Disable SERIAL_8250_PCI1XXXX config by default

2023-03-09T16:08:15+00:00

Commit 32bb477fa7bf ("serial: 8250_pci1xxxx: Add driver for quad-uart
support") made the SERIAL_8250_PCI1XXXX driver enabled when SERIAL_8250
is enabled, disable it as this driver does not need to be enabled by
default

Fixes: 32bb477fa7bf ("serial: 8250_pci1xxxx: Add driver for quad-uart support")
Reported-by: Linus Torvalds 
Link: https://lore.kernel.org/lkml/CAHk-=whhFCeeuo6vTEmNSx6S-KKkugxgzN_W5Z6v-9yH9gc3Zw@mail.gmail.com/
Signed-off-by: Kumaravel Thiagarajan 
Reviewed-by: Geert Uytterhoeven 
Link: https://lore.kernel.org/r/20230305145124.13444-1-kumaravel.thiagarajan@microchip.com
Signed-off-by: Greg Kroah-Hartman