This reverts commit 3f678c96

.

We've been a bit too optimistic with this one here :(

The trouble is that internally we're still using these plane
update/disable hooks. Which was totally ok pre-atomic since the drm
core did all the book-keeping updating and these just mostly updated
hw state. But with atomic there's lots more going on, and it causes
heaps of trouble with the load detect code.

This one specifically cause a deadlock since both the load detect code
and the nested plane atomic helper functions tried to grab the same
locks. It only blows up because of the evil tricks though we play with
the implicit ww acquire context.

Applying this revert unearths the NULL deref on already freed
framebuffer objects reported as a regression in 4.0 by various people.

Fixing this will be fairly invasive, hence revert even for the
4.1-next queue.

Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

This translation entry was updated after electrical validation by the hw
team. The other entries are removed from existence as they aren't
validated and because the sole use of a certain type of level shifter
for SKL products is anticipated.

v2: Remove all the other entries and force the use of the 800mv+2dB
    config (Sonika)

Suggested-by: Sonika Jindal <sonika.jindal@intel.com>
Cc: Sonika Jindal <sonika.jindal@intel.com>
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
Reviewed-by: Sonika Jindal <sonika.jindal@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Implicit usage of local variables in macros isn't exactly the greatest
thing in the world, especially when that variable is the drm device and
we want to move towards a broader use of the i915 device structure.

Let's make for_each_sprite() take dev_priv as its first argument then.

Suggested-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
Reviewed-by: Chris Wilson <chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Implicit usage of local variables in macros isn't exactly the greatest
thing in the world, especially when that variable is the drm device and
we want to move towards a broader use of the i915 device structure.

Let's make for_each_plane() take dev_priv as its first argument then.

Suggested-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
Reviewed-by: Chris Wilson <chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

With the two-step reset counter increments which braket the actual
reset code and the subsequent wake-up we're guaranteeing that all the
lockless waiters _will_ be woken up. And since we unconditionally bail
out of waits with -EAGAIN (or -EIO) in that case there is not risk of
lost interrupt enabling bits when the lockless wait code races against
a gpu reset.

Let's remove this FIXME as resolved then.

Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Change 'mutliple' to 'multiple'
Change 'mutlipler' to 'multiplier'
Change 'Haswel' to 'Haswell'

Signed-off-by: Yannick Guerrini <yguerrini@tomshardware.fr>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

plane->fb is a legacy pointer that not always be up-to-date (or updated
early enough).  Make sure the watermark code uses plane->state->fb so
that we're always doing our calculations based on the correct
framebuffers.

This patch was generated by Coccinelle with the following semantic
patch:

        @@
        struct drm_plane *P;
        @@
        - P->fb
        + P->state->fb

v2: Rebase

Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

The cursor size fields in intel_crtc just duplicate the data from
cursor->state.crtc_{w,h} so we don't need them any more.  Worse, their
use in the watermark code actually introduces a subtle bug since they
don't get updated to mirror the state values until the plane commit
stage, which is *after* we've already used them to calculate new
watermark values.  This happens because we had to move watermark updates
slightly earlier (outside vblank evasion) in commit

        commit 32b7eeec


        Author: Matt Roper <matthew.d.roper@intel.com>
        Date:   Wed Dec 24 07:59:06 2014 -0800

            drm/i915: Refactor work that can sleep out of commit (v7)

Dropping the intel_crtc fields and just using the state values (which
are properly updated by the time watermark updates happen) should solve
the problem.

Aside from the actual removal of the struct fields (which are formatted
in a way that I couldn't figure out how to match in Coccinelle), the
rest of this patch was generated via the following semantic patch:

        // Drop assignment
        @@
        struct intel_crtc *C;
        struct drm_plane_state S;
        @@
        (
        - C->cursor_width = S.crtc_w;
        |
        - C->cursor_height = S.crtc_h;
        )

        // Replace usage
        @@
        struct intel_crtc *C;
        expression E;
        @@
        (
        - C->cursor_width
        + C->base.cursor->state->crtc_w
        |
        - C->cursor_height
        + C->base.cursor->state->crtc_h
        |
        - to_intel_crtc(E)->cursor_width
        + E->cursor->state->crtc_w
        |
        - to_intel_crtc(E)->cursor_height
        + E->cursor->state->crtc_h
        )

v2: Rebase

Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Joe Konno <joe.konno@linux.intel.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89346
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Another pile of misc drm patches all over, mostly polish for atomic. Last
minute rebase was to avoid the broken merge.

* tag 'topic/drm-misc-2015-03-10' of git://anongit.freedesktop.org/drm-intel:
  drm: Check in setcrtc if the primary plane supports the fb pixel format
  drm: Lighten sysfs connector 'status'
  drm/plane-helper: unexport drm_primary_helper_create_plane
  drm: Share plane pixel format check code between legacy and atomic
  drm: Fix trivial typos in comments
  drm/dp: add DPCD definitions from eDP 1.4
  drm/dp: add DPCD definitions from DP 1.1 and 1.2a
  drm: Fixup racy refcounting in plane_force_disable
  drm/i915: Rotation property is now handled in DRM core
  drm: Complete moving rotation property to core
  drm/dp: add DPCD definitions from eDP 1.2
  drm/dp: indentation and ordering cleanups
  drm/atomic-helper: Fix kerneldoc for prepare_planes
  drm: Remove redundant code in the getencoder ioctl

Drivers implementing the universal planes API report the list of
supported pixel formats for the primary plane. Make sure the fb passed
to the setcrtc ioctl is compatible.

Drivers not implementing the universal planes API will have no format
reported for the primary plane, skip the check in that case.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Since the beginning, sysfs/connector/status has done a heavyweight
detection of the current connector status. But no user, such as upowerd
or logind, has ever desired to initiate a probe. Move the probing into a
new attribute so that existing readers get the behaviour they desire.

v2: David Herrmann suggested using "echo detect > /sys/.../status" to
trigger the probing, which is a fine idea. This extends that to also
allow the user to apply the force detection overrides at runtime.

v3: Now with airlied's email address fixed! Requires sysfs_streq()

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: David Herrmann <dh.herrmann@gmail.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Alex Deucher <alexdeucher@gmail.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

We shouldn't tempt driver writers into using this since it uses a
default format list which is likely wrong. And when that's done we can
simplify the code a bit, too.

Noticed while reviewing a patch from Laurent.

Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

Both the legacy and atomic helpers need to check whether a plane
supports a given pixel format. The code is currently duplicated, share
it.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
[danvet: Slightly extend the docbook.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Change 'pixes' to 'pixels'
Change 'enabel' to 'enable'
Change 'enabeling' to 'enabling'

Signed-off-by: Yannick Guerrini <yguerrini@tomshardware.fr>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Add a number of DPCD definitions from eDP 1.4.

v2: s/DP_ALPM_LOCK_TIMEOUT_ERROR_STATUS/DP_ALPM_LOCK_TIMEOUT_ERROR/
   (Sonika)

Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Sonika Jindal <sonika.jindal@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Add a number of DPCD definitions from DP 1.1 and 1.2a.

v2: drop wrong DP version reference, rename DP training set macros
(Sonika).

Reviewed-by: Sonika Jindal <sonika.jindal@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Originally it was impossible to be dropping the last refcount in this
function since there was always one around still from the idr. But in

commit 83f45fc3


Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Wed Aug 6 09:10:18 2014 +0200

    drm: Don't grab an fb reference for the idr

we've switched to weak references, broke that assumption but forgot to
fix it up.

Since we still force-disable planes it's only possible to hit this
when racing multiple rmfb with fbdev restoring or similar evil things.
As long as userspace is nice it's impossible to hit the BUG_ON.

But the BUG_ON would most likely be hit from fbdev code, which usually
invovles the console_lock besides all modeset locks. So very likely
we'd never get the bug reports if this was hit in the wild, hence
better be safe than sorry and backport.

Spotted by Matt Roper while reviewing other patches.

Cc: stable@vger.kernel.org
Cc: Matt Roper <matthew.d.roper@intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

So no need to have code which never gets called in the driver.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Commit 1da30627

 "drm: Add rotation value to
plane state" moved the rotation property to DRM core but only did the set
property part. This does the get property part as well.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Mostly display control related DPCD addresses.

Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Sonika Jindal <sonika.jindal@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Keep the DPCD macros ordered by address, and make indentation conform to
the rest of the file.

commit e045d20b


Author: Sonika Jindal <sonika.jindal@intel.com>
Date:   Thu Feb 19 13:16:44 2015 +0530

    drm: Adding edp1.4 specific dpcd macros

Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Sonika Jindal <sonika.jindal@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Copypaste-fail from cleanup_planes. Reported by Tvrtko.

Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

When enabling atomic state object for this ioctl in

commit abd69c55


Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Tue Nov 25 23:50:05 2014 +0100

    drm: Handle atomic state properly in kms getfoo ioctl

I've forgotten to remove this hunk in one of the later revisions.
drm_encoder_get_crtc already does this.

Cc: Rob Clark <robdclark@gmail.com>
Cc: Sean Paul <seanpaul@chromium.org>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

commit a8c6ecb3
Merge: 8dd0eb35 9eccca08


Author: Dave Airlie <airlied@redhat.com>
Date:   Mon Mar 9 19:58:30 2015 +1000

    Merge tag 'v4.0-rc3' into drm-next

managed to pick the wrong code to resolve the conflict and left us with
a mutex_lock(struct_mutex) without the mutex_unlock(struct_mutex) leading
to a deadlock. Fix the problem by recovering the correct code which doesn't
need the lock.

Cc: Dave Airlie <airlied@redhat.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Linux 4.0-rc3 backmerge to fix two i915 conflicts, and get
some mainline bug fixes needed for my testing box

Conflicts:
	drivers/gpu/drm/i915/i915_drv.h
	drivers/gpu/drm/i915/intel_display.c

- Y tiling support for scanout from Tvrtko&Damien
- Remove more UMS support
- some small prep patches for OLR removal from John Harrison
- first few patches for dynamic pagetable allocation from Ben Widawsky, rebased
  by tons of other people
- DRRS support patches (Sonika&Vandana)
- fbc patches from Paulo
- make sure our vblank callbacks aren't called when the pipes are off
- various patches all over

* tag 'drm-intel-next-2015-02-27' of git://anongit.freedesktop.org/drm-intel: (61 commits)
  drm/i915: Update DRIVER_DATE to 20150227
  drm/i915: Clarify obj->map_and_fenceable
  drm/i915/skl: Allow Y (and Yf) frame buffer creation
  drm/i915/skl: Update watermarks for Y tiling
  drm/i915/skl: Updated watermark programming
  drm/i915/skl: Adjust get_plane_config() to support Yb/Yf tiling
  drm/i915/skl: Teach pin_and_fence_fb_obj() about Y tiling constraints
  drm/i915/skl: Adjust intel_fb_align_height() for Yb/Yf tiling
  drm/i915/skl: Allow scanning out Y and Yf fbs
  drm/i915/skl: Add new displayable tiling formats
  drm/i915: Remove DRIVER_MODESET checks from modeset code
  drm/i915: Remove regfile code&data for UMS suspend/resume
  drm/i915: Remove DRIVER_MODESET checks from gem code
  drm/i915: Remove DRIVER_MODESET checks in the gpu reset code
  drm/i915: Remove DRIVER_MODESET checks from suspend/resume code
  drm/i915: Remove DRIVER_MODESET checks in load/unload/close code
  drm/i915: fix a printk format
  drm/i915: Add media rc6 residency file to sysfs
  drm/i915: Add missing description to parameter in alloc_pt_range
  drm/i915: Removed the read of RP_STATE_CAP from sysfs/debugfs functions
  ...

POLL_OUT isn't what callers of ->poll() are expecting to see; it's
actually __SI_POLL | 2 and it's a siginfo code, not a poll bitmap
bit...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@vger.kernel.org
Cc: Bruce Fields <bfields@fieldses.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull USB fixes from Greg KH:
 "Here's a round of USB fixes for 4.0-rc3.

  Nothing major, the usual gadget, xhci and usb-serial fixes and a few
  new device ids as well.

  All have been in linux-next successfully"

* tag 'usb-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (36 commits)
  xhci: Workaround for PME stuck issues in Intel xhci
  xhci: fix reporting of 0-sized URBs in control endpoint
  usb: ftdi_sio: Add jtag quirk support for Cyber Cortex AV boards
  USB: ch341: set tty baud speed according to tty struct
  USB: serial: cp210x: Adding Seletek device id's
  USB: pl2303: disable break on shutdown
  USB: mxuport: fix null deref when used as a console
  USB: serial: clean up bus probe error handling
  USB: serial: fix port attribute-creation race
  USB: serial: fix tty-device error handling at probe
  USB: serial: fix potential use-after-free after failed probe
  USB: console: add dummy __module_get
  USB: ftdi_sio: add PIDs for Actisense USB devices
  Revert "USB: serial: make bulk_out_size a lower limit"
  cdc-acm: Add support for Denso cradle CU-321
  usb-storage: support for more than 8 LUNs
  uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS539
  USB: usbfs: don't leak kernel data in siginfo
  xhci: Clear the host side toggle manually when endpoint is 'soft reset'
  xhci: Allocate correct amount of scratchpad buffers
  ...

Pull tty/serial fixes from Greg KH:
 "Here are some tty and serial driver fixes for 4.0-rc3.

  Along with the atime fix that you know about, here are some other
  serial driver bugfixes as well.  Most notable is a wait_until_sent
  bugfix that was traced back to being around since before 2.6.12 that
  Johan has fixed up.

  All have been in linux-next successfully"

* tag 'tty-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  TTY: fix tty_wait_until_sent maximum timeout
  TTY: fix tty_wait_until_sent on 64-bit machines
  USB: serial: fix infinite wait_until_sent timeout
  TTY: bfin_jtag_comm: remove incorrect wait_until_sent operation
  net: irda: fix wait_until_sent poll timeout
  serial: uapi: Declare all userspace-visible io types
  serial: core: Fix iotype userspace breakage
  serial: sprd: Fix missing spin_unlock in sprd_handle_irq()
  console: Fix console name size mismatch
  tty: fix up atime/mtime mess, take four
  serial: 8250_dw: Fix get_mctrl behaviour
  serial:8250:8250_pci: delete unneeded quirk entries
  serial:8250:8250_pci: fix redundant entry report for WCH_CH352_2S
  Change email address for 8250_pci
  serial: 8250: Revert "tty: serial: 8250_core: read only RX if there is something in the FIFO"
  Revert "tty/serial: of_serial: add DT alias ID handling"

Pull staging driver fixes from Greg KH:
 "Here are some IIO and staging driver fixes for 4.0-rc3.

  Details are in the shortlog, nothing major, mostly IIO fixes for
  reported issues.

  All have been in linux-next successfully"

* tag 'staging-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (23 commits)
  staging: comedi: adv_pci1710: fix AI INSN_READ for non-zero channel
  staging: comedi: vmk80xx: remove "firmware version" kernel messages
  staging: comedi: comedi_isadma: fix "stalled" detect in comedi_isadma_disable_on_sample()
  iio: ak8975: fix AK09911 dependencies
  iio: common: ssp_sensors: Protect PM-only functions to kill warning
  IIO: si7020: Allocate correct amount of memory in devm_iio_device_alloc
  Revert "iio:humidity:si7020: fix pointer to i2c client"
  iio: light: gp2ap020a00f: Select REGMAP_I2C
  iio: light: jsa1212: Select REGMAP_I2C
  iio: ad5686: fix optional reference voltage declaration
  iio:adc:mcp3422 Fix incorrect scales table
  iio: mxs-lradc: fix iio channel map regression
  iio: imu: adis16400: Fix sign extension
  staging: iio: ad2s1200: Fix sign extension
  iio: mxs-lradc: only update the buffer when its conversions have finished
  iio: mxs-lradc: make ADC reads not unschedule touchscreen conversions
  iio: mxs-lradc: make ADC reads not disable touchscreen interrupts
  iio: mxs-lradc: separate touchscreen and buffer virtual channels
  iio: imu: inv_mpu6050: Prevent dereferencing NULL
  iio: iadc: wait_for_completion_timeout time in jiffies
  ...

Pull char/misc driver fixes from Greg KH:
 "Here are two char/misc fixes for 4.0-rc3.

  One is a reported binder driver fix needed due to a change in the mm
  core that happened in 4.0-rc1.  Another is a mei driver fix that
  resolves a reported issue in that driver.

  Both have been in linux-next for a while"

* tag 'char-misc-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  mei: make device disabled on stop unconditionally
  android: binder: fix binder mmap failures

Pull "code of conflict" from Greg KH:
 "This file tries to set the rational basis for our code reviews, gives
  some advice on how to conduct them, and provides an excalation channel
  for any kernel developers if they so desire it"

[ Let's see how this works ]

* tag 'cc-4.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  Code of Conflict

Pull i2c fixes from Wolfram Sang:
 "A set of updates and bugfixes for the new designware-baytrail driver.

  And a documentation bugfix"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: imx: add required clocks property to binding
  i2c: designware-baytrail: baytrail_i2c_acquire() might sleep
  i2c: designware-baytrail: cross-check lock functions
  i2c: designware-baytrail: fix sparse warnings
  i2c: designware-baytrail: fix typo in error path
  i2c: designware-baytrail: describe magic numbers

Pull slave-dmaengine fixes from Vinod Koul:
 "This contains small fixes spread across the drivers"

* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
  dmaengine: mmp_pdma: fix warning about slave caps
  dmaengine: qcom_bam_dma: fix wrong register offsets
  dmaengine: bam-dma: fix a warning about missing capabilities
  dmaengine: ioatdma: workaround for incorrect DMACAP register
  dmaengine: at_xdmac: fix for chan conf simplification
  dmaengine: dw: don't handle interrupt when dmaengine is not used
  dma: mmp-tdma: refine dma disable and dma-pos update
  dmaengine: shdma: Move DMA stop to (runtime) suspend callbacks
  dmaenegine: mmp-pdma: fix irq handler overwrite physical chan issue

Pull arm64 fixes from Catalin Marinas:
 "arm64 and generic kernel/module.c (acked by Rusty) fixes for
  CONFIG_DEBUG_SET_MODULE_RONX"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  kernel/module.c: Update debug alignment after symtable generation
  arm64: Don't use is_module_addr in setting page attributes

Currently tty_wait_until_sent may take up to twice as long as the
requested timeout while waiting for driver and hardware buffers to
drain.

Fix this by taking the remaining number of jiffies after waiting for
driver buffers to drain into account so that the timeout actually
becomes a maximum timeout as it is documented to be.

Note that this specifically implies tighter timings when closing a port
as a consequence of actually honouring the port closing-wait setting
for drivers relying on tty_wait_until_sent_from_close (e.g. via
tty_port_close_start).

Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix overflow bug in tty_wait_until_sent on 64-bit machines, where an
infinite timeout (0) would be passed to the underlying tty-driver's
wait_until_sent-operation as a negative timeout (-1), causing it to
return immediately.

This manifests itself for example as tcdrain() returning immediately,
drivers not honouring the drain flags when setting terminal attributes,
or even dropped data on close as a requested infinite closing-wait
timeout would be ignored.

The first symptom  was reported by Asier LLANO who noted that tcdrain()
returned prematurely when using the ftdi_sio usb-serial driver.

Fix this by passing 0 rather than MAX_SCHEDULE_TIMEOUT (LONG_MAX) to the
underlying tty driver.

Note that the serial-core wait_until_sent-implementation is not affected
by this bug due to a lucky chance (comparison to an unsigned maximum
timeout), and neither is the cyclades one that had an explicit check for
negative timeouts, but all other tty drivers appear to be affected.

Fixes: 1da177e4

 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>	# v2.6.12
Reported-by: ZIV-Asier Llano Palacios <asier.llano@cgglobal.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Make sure to handle an infinite timeout (0).

Note that wait_until_sent is currently never called with a 0-timeout
argument due to a bug in tty_wait_until_sent.

Fixes: dcf01050

 ("USB: serial: add generic wait_until_sent
implementation")
Cc: stable <stable@vger.kernel.org>	# v3.10

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove incorrect and redundant wait_until_sent operation, which waits
for the driver buffer rather than any hardware buffers to drain,
something which is already taken care of by the tty layer (and
chars_in_buffer).

Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>