[kernel] r16817 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/debian patches/features/all/openvz patches/series
Ben Hutchings
benh at alioth.debian.org
Sun Jan 16 05:29:26 UTC 2011
Author: benh
Date: Sun Jan 16 05:29:16 2011
New Revision: 16817
Log:
tty: Fix information leaks from SIOCGICOUNT handlers (CVE-2010-4075, CVE-2010-4076, CVE-2010-4077)
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/tty-Make-tiocgicount-a-handler.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/tty-fix-warning-in-synclink-driver.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/tty-icount-changeover-for-other-main-devices.patch
dists/sid/linux-2.6/debian/patches/debian/tty-Avoid-ABI-change-for-addition-of-get_icount.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/features/all/openvz/openvz.patch
dists/sid/linux-2.6/debian/patches/series/31
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Sun Jan 16 03:04:20 2011 (r16816)
+++ dists/sid/linux-2.6/debian/changelog Sun Jan 16 05:29:16 2011 (r16817)
@@ -7,6 +7,10 @@
* Fix CVE-2010-4250
* Fix CVE-2010-3865
+ [ Ben Hutchings ]
+ * tty: Fix information leaks from SIOCGICOUNT handlers (CVE-2010-4075,
+ CVE-2010-4076, CVE-2010-4077)
+
-- Ian Campbell <ijc at hellion.org.uk> Thu, 13 Jan 2011 07:07:54 +0000
linux-2.6 (2.6.32-30) unstable; urgency=high
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/tty-Make-tiocgicount-a-handler.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/tty-Make-tiocgicount-a-handler.patch Sun Jan 16 05:29:16 2011 (r16817)
@@ -0,0 +1,219 @@
+From: Alan Cox <alan at linux.intel.com>
+Date: Thu, 16 Sep 2010 18:21:24 +0100
+Subject: [PATCH 1/4] tty: Make tiocgicount a handler
+
+commit d281da7ff6f70efca0553c288bb883e8605b3862 upstream.
+
+Dan Rosenberg noted that various drivers return the struct with uncleared
+fields. Instead of spending forever trying to stomp all the drivers that
+get it wrong (and every new driver) do the job in one place.
+
+This first patch adds the needed operations and hooks them up, including
+the needed USB midlayer and serial core plumbing.
+
+Signed-off-by: Alan Cox <alan at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/char/tty_io.c | 21 +++++++++++++++++++++
+ drivers/serial/serial_core.c | 37 +++++++++++++++++--------------------
+ drivers/usb/serial/usb-serial.c | 13 +++++++++++++
+ include/linux/tty_driver.h | 9 +++++++++
+ include/linux/usb/serial.h | 2 ++
+ 5 files changed, 62 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
+index 53ffcfc..123cedf 100644
+--- a/drivers/char/tty_io.c
++++ b/drivers/char/tty_io.c
+@@ -96,6 +96,7 @@
+ #include <linux/bitops.h>
+ #include <linux/delay.h>
+ #include <linux/seq_file.h>
++#include <linux/serial.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/system.h>
+@@ -2436,6 +2437,20 @@ static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int
+ return tty->ops->tiocmset(tty, file, set, clear);
+ }
+
++static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
++{
++ int retval = -EINVAL;
++ struct serial_icounter_struct icount;
++ memset(&icount, 0, sizeof(icount));
++ if (tty->ops->get_icount)
++ retval = tty->ops->get_icount(tty, &icount);
++ if (retval != 0)
++ return retval;
++ if (copy_to_user(arg, &icount, sizeof(icount)))
++ return -EFAULT;
++ return 0;
++}
++
+ struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
+ {
+ if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
+@@ -2556,6 +2571,12 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ case TIOCMBIC:
+ case TIOCMBIS:
+ return tty_tiocmset(tty, file, cmd, p);
++ case TIOCGICOUNT:
++ retval = tty_tiocgicount(tty, p);
++ /* For the moment allow fall through to the old method */
++ if (retval != -EINVAL)
++ return retval;
++ break;
+ case TCFLSH:
+ switch (arg) {
+ case TCIFLUSH:
+diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
+index dcc7244..772d9d8 100644
+--- a/drivers/serial/serial_core.c
++++ b/drivers/serial/serial_core.c
+@@ -1067,10 +1067,10 @@ uart_wait_modem_status(struct uart_state *state, unsigned long arg)
+ * NB: both 1->0 and 0->1 transitions are counted except for
+ * RI where only 0->1 is counted.
+ */
+-static int uart_get_count(struct uart_state *state,
+- struct serial_icounter_struct __user *icnt)
++static int uart_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
+ {
+- struct serial_icounter_struct icount;
++ struct uart_state *state = tty->driver_data;
+ struct uart_icount cnow;
+ struct uart_port *uport = state->uart_port;
+
+@@ -1078,19 +1078,19 @@ static int uart_get_count(struct uart_state *state,
+ memcpy(&cnow, &uport->icount, sizeof(struct uart_icount));
+ spin_unlock_irq(&uport->lock);
+
+- icount.cts = cnow.cts;
+- icount.dsr = cnow.dsr;
+- icount.rng = cnow.rng;
+- icount.dcd = cnow.dcd;
+- icount.rx = cnow.rx;
+- icount.tx = cnow.tx;
+- icount.frame = cnow.frame;
+- icount.overrun = cnow.overrun;
+- icount.parity = cnow.parity;
+- icount.brk = cnow.brk;
+- icount.buf_overrun = cnow.buf_overrun;
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->frame = cnow.frame;
++ icount->overrun = cnow.overrun;
++ icount->parity = cnow.parity;
++ icount->brk = cnow.brk;
++ icount->buf_overrun = cnow.buf_overrun;
+
+- return copy_to_user(icnt, &icount, sizeof(icount)) ? -EFAULT : 0;
++ return 0;
+ }
+
+ /*
+@@ -1143,10 +1143,6 @@ uart_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd,
+ case TIOCMIWAIT:
+ ret = uart_wait_modem_status(state, arg);
+ break;
+-
+- case TIOCGICOUNT:
+- ret = uart_get_count(state, uarg);
+- break;
+ }
+
+ if (ret != -ENOIOCTLCMD)
+@@ -2322,6 +2318,7 @@ static const struct tty_operations uart_ops = {
+ #endif
+ .tiocmget = uart_tiocmget,
+ .tiocmset = uart_tiocmset,
++ .get_icount = uart_get_icount,
+ #ifdef CONFIG_CONSOLE_POLL
+ .poll_init = uart_poll_init,
+ .poll_get_char = uart_poll_get_char,
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index bd3fa7f..f23f3b4 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -562,6 +562,18 @@ static int serial_tiocmset(struct tty_struct *tty, struct file *file,
+ return -EINVAL;
+ }
+
++static int serial_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++{
++ struct usb_serial_port *port = tty->driver_data;
++
++ dbg("%s - port %d", __func__, port->number);
++
++ if (port->serial->type->get_icount)
++ return port->serial->type->get_icount(tty, icount);
++ return -EINVAL;
++}
++
+ /*
+ * We would be calling tty_wakeup here, but unfortunately some line
+ * disciplines have an annoying habit of calling tty->write from
+@@ -1214,6 +1226,7 @@ static const struct tty_operations serial_ops = {
+ .chars_in_buffer = serial_chars_in_buffer,
+ .tiocmget = serial_tiocmget,
+ .tiocmset = serial_tiocmset,
++ .get_icount = serial_get_icount,
+ .cleanup = serial_cleanup,
+ .install = serial_install,
+ .proc_fops = &serial_proc_fops,
+diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
+index b086779..db2d227 100644
+--- a/include/linux/tty_driver.h
++++ b/include/linux/tty_driver.h
+@@ -224,6 +224,12 @@
+ * unless the tty also has a valid tty->termiox pointer.
+ *
+ * Optional: Called under the termios lock
++ *
++ * int (*get_icount)(struct tty_struct *tty, struct serial_icounter *icount);
++ *
++ * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel
++ * structure to complete. This method is optional and will only be called
++ * if provided (otherwise EINVAL will be returned).
+ */
+
+ #include <linux/fs.h>
+@@ -232,6 +238,7 @@
+
+ struct tty_struct;
+ struct tty_driver;
++struct serial_icounter_struct;
+
+ struct tty_operations {
+ struct tty_struct * (*lookup)(struct tty_driver *driver,
+@@ -268,6 +275,8 @@ struct tty_operations {
+ unsigned int set, unsigned int clear);
+ int (*resize)(struct tty_struct *tty, struct winsize *ws);
+ int (*set_termiox)(struct tty_struct *tty, struct termiox *tnew);
++ int (*get_icount)(struct tty_struct *tty,
++ struct serial_icounter_struct *icount);
+ #ifdef CONFIG_CONSOLE_POLL
+ int (*poll_init)(struct tty_driver *driver, int line, char *options);
+ int (*poll_get_char)(struct tty_driver *driver, int line);
+diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
+index ce911eb..7a159e1 100644
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -259,6 +259,8 @@ struct usb_serial_driver {
+ int (*tiocmget)(struct tty_struct *tty, struct file *file);
+ int (*tiocmset)(struct tty_struct *tty, struct file *file,
+ unsigned int set, unsigned int clear);
++ int (*get_icount)(struct tty_struct *tty,
++ struct serial_icounter_struct *icount);
+ /* Called by the tty layer for port level work. There may or may not
+ be an attached tty at this point */
+ void (*dtr_rts)(struct usb_serial_port *port, int on);
+--
+1.7.2.3
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/tty-fix-warning-in-synclink-driver.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/tty-fix-warning-in-synclink-driver.patch Sun Jan 16 05:29:16 2011 (r16817)
@@ -0,0 +1,39 @@
+From: Andres Salomon <dilinger at queued.net>
+Date: Tue, 9 Nov 2010 14:10:38 -0800
+Subject: [PATCH 3/4] tty: fix warning in synclink driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit dc98d9650891661a20842a8eef9e76536046d897 upstream.
+
+During builds I see the following warning -
+
+ CC [M] drivers/char/pcmcia/synclink_cs.o
+drivers/char/pcmcia/synclink_cs.c:2194: warning: ‘mgslpc_get_icount’ defined but not used
+
+The function is a callback meant to be assigned to get_icount (added during 0587102cf).
+Fix accordingly.
+
+Signed-off-by: Andres Salomon <dilinger at queued.net>
+Acked-by: Alan Cox <alan at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/char/pcmcia/synclink_cs.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
+index 74d124b..55ae376 100644
+--- a/drivers/char/pcmcia/synclink_cs.c
++++ b/drivers/char/pcmcia/synclink_cs.c
+@@ -2859,6 +2859,7 @@ static const struct tty_operations mgslpc_ops = {
+ .hangup = mgslpc_hangup,
+ .tiocmget = tiocmget,
+ .tiocmset = tiocmset,
++ .get_icount = mgslpc_get_icount,
+ .proc_fops = &mgslpc_proc_fops,
+ };
+
+--
+1.7.2.3
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/tty-icount-changeover-for-other-main-devices.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/tty-icount-changeover-for-other-main-devices.patch Sun Jan 16 05:29:16 2011 (r16817)
@@ -0,0 +1,982 @@
+From: Alan Cox <alan at linux.intel.com>
+Date: Thu, 16 Sep 2010 18:21:52 +0100
+Subject: [PATCH 2/4] tty: icount changeover for other main devices
+
+commit 0587102cf9f427c185bfdeb2cef41e13ee0264b1 upstream.
+
+Again basically cut and paste
+
+Convert the main driver set to use the hooks for GICOUNT
+
+Signed-off-by: Alan Cox <alan at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/ia64/hp/sim/simserial.c | 12 +------
+ drivers/char/amiserial.c | 56 ++++++++++++++++-------------
+ drivers/char/cyclades.c | 49 +++++++++++++------------
+ drivers/char/ip2/ip2main.c | 72 ++++++++++++++++++++++---------------
+ drivers/char/mxser.c | 62 ++++++++++++++++++--------------
+ drivers/char/nozomi.c | 37 +++++++++----------
+ drivers/char/pcmcia/synclink_cs.c | 60 ++++++++++++++-----------------
+ drivers/char/synclink.c | 73 +++++++++++++++++--------------------
+ drivers/char/synclink_gt.c | 56 +++++++++++++++--------------
+ drivers/char/synclinkmp.c | 61 ++++++++++++++-----------------
+ drivers/serial/68360serial.c | 51 +++++++++++++-------------
+ net/bluetooth/rfcomm/tty.c | 4 --
+ 12 files changed, 297 insertions(+), 296 deletions(-)
+
+diff --git a/arch/ia64/hp/sim/simserial.c b/arch/ia64/hp/sim/simserial.c
+index 2bef526..204f650 100644
+--- a/arch/ia64/hp/sim/simserial.c
++++ b/arch/ia64/hp/sim/simserial.c
+@@ -395,7 +395,7 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
+ {
+ if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
+ (cmd != TIOCSERCONFIG) && (cmd != TIOCSERGSTRUCT) &&
+- (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
++ (cmd != TIOCMIWAIT)) {
+ if (tty->flags & (1 << TTY_IO_ERROR))
+ return -EIO;
+ }
+@@ -433,16 +433,6 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
+ case TIOCMIWAIT:
+ printk(KERN_INFO "rs_ioctl: TIOCMIWAIT: called\n");
+ return 0;
+- /*
+- * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+- * Return: write counters to the user passed counter struct
+- * NB: both 1->0 and 0->1 transitions are counted except for
+- * RI where only 0->1 is counted.
+- */
+- case TIOCGICOUNT:
+- printk(KERN_INFO "rs_ioctl: TIOCGICOUNT called\n");
+- return 0;
+-
+ case TIOCSERGWILD:
+ case TIOCSERSWILD:
+ /* "setserial -W" is called in Debian boot */
+diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
+index 6c32fbf..579d479 100644
+--- a/drivers/char/amiserial.c
++++ b/drivers/char/amiserial.c
+@@ -1262,6 +1262,36 @@ static int rs_break(struct tty_struct *tty, int break_state)
+ return 0;
+ }
+
++/*
++ * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
++ * Return: write counters to the user passed counter struct
++ * NB: both 1->0 and 0->1 transitions are counted except for
++ * RI where only 0->1 is counted.
++ */
++static int rs_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++{
++ struct async_struct *info = tty->driver_data;
++ struct async_icount cnow;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ cnow = info->state->icount;
++ local_irq_restore(flags);
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->frame = cnow.frame;
++ icount->overrun = cnow.overrun;
++ icount->parity = cnow.parity;
++ icount->brk = cnow.brk;
++ icount->buf_overrun = cnow.buf_overrun;
++
++ return 0;
++}
+
+ static int rs_ioctl(struct tty_struct *tty, struct file * file,
+ unsigned int cmd, unsigned long arg)
+@@ -1331,31 +1361,6 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
+ }
+ /* NOTREACHED */
+
+- /*
+- * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+- * Return: write counters to the user passed counter struct
+- * NB: both 1->0 and 0->1 transitions are counted except for
+- * RI where only 0->1 is counted.
+- */
+- case TIOCGICOUNT:
+- local_irq_save(flags);
+- cnow = info->state->icount;
+- local_irq_restore(flags);
+- icount.cts = cnow.cts;
+- icount.dsr = cnow.dsr;
+- icount.rng = cnow.rng;
+- icount.dcd = cnow.dcd;
+- icount.rx = cnow.rx;
+- icount.tx = cnow.tx;
+- icount.frame = cnow.frame;
+- icount.overrun = cnow.overrun;
+- icount.parity = cnow.parity;
+- icount.brk = cnow.brk;
+- icount.buf_overrun = cnow.buf_overrun;
+-
+- if (copy_to_user(argp, &icount, sizeof(icount)))
+- return -EFAULT;
+- return 0;
+ case TIOCSERGWILD:
+ case TIOCSERSWILD:
+ /* "setserial -W" is called in Debian boot */
+@@ -1948,6 +1953,7 @@ static const struct tty_operations serial_ops = {
+ .wait_until_sent = rs_wait_until_sent,
+ .tiocmget = rs_tiocmget,
+ .tiocmset = rs_tiocmset,
++ .get_icount = rs_get_icount,
+ .proc_fops = &rs_proc_fops,
+ };
+
+diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
+index 0113574..eb863de 100644
+--- a/drivers/char/cyclades.c
++++ b/drivers/char/cyclades.c
+@@ -2798,29 +2798,6 @@ cy_ioctl(struct tty_struct *tty, struct file *file,
+ * NB: both 1->0 and 0->1 transitions are counted except for
+ * RI where only 0->1 is counted.
+ */
+- case TIOCGICOUNT: {
+- struct serial_icounter_struct sic = { };
+-
+- spin_lock_irqsave(&info->card->card_lock, flags);
+- cnow = info->icount;
+- spin_unlock_irqrestore(&info->card->card_lock, flags);
+-
+- sic.cts = cnow.cts;
+- sic.dsr = cnow.dsr;
+- sic.rng = cnow.rng;
+- sic.dcd = cnow.dcd;
+- sic.rx = cnow.rx;
+- sic.tx = cnow.tx;
+- sic.frame = cnow.frame;
+- sic.overrun = cnow.overrun;
+- sic.parity = cnow.parity;
+- sic.brk = cnow.brk;
+- sic.buf_overrun = cnow.buf_overrun;
+-
+- if (copy_to_user(argp, &sic, sizeof(sic)))
+- ret_val = -EFAULT;
+- break;
+- }
+ default:
+ ret_val = -ENOIOCTLCMD;
+ }
+@@ -2832,6 +2809,31 @@ cy_ioctl(struct tty_struct *tty, struct file *file,
+ return ret_val;
+ } /* cy_ioctl */
+
++static int cy_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *sic)
++{
++ struct cyclades_port *info = tty->driver_data;
++ struct cyclades_icount cnow; /* Used to snapshot */
++ unsigned long flags;
++
++ spin_lock_irqsave(&info->card->card_lock, flags);
++ cnow = info->icount;
++ spin_unlock_irqrestore(&info->card->card_lock, flags);
++
++ sic->cts = cnow.cts;
++ sic->dsr = cnow.dsr;
++ sic->rng = cnow.rng;
++ sic->dcd = cnow.dcd;
++ sic->rx = cnow.rx;
++ sic->tx = cnow.tx;
++ sic->frame = cnow.frame;
++ sic->overrun = cnow.overrun;
++ sic->parity = cnow.parity;
++ sic->brk = cnow.brk;
++ sic->buf_overrun = cnow.buf_overrun;
++ return 0;
++}
++
+ /*
+ * This routine allows the tty driver to be notified when
+ * device's termios settings have changed. Note that a
+@@ -4098,6 +4100,7 @@ static const struct tty_operations cy_ops = {
+ .wait_until_sent = cy_wait_until_sent,
+ .tiocmget = cy_tiocmget,
+ .tiocmset = cy_tiocmset,
++ .get_icount = cy_get_icount,
+ .proc_fops = &cyclades_proc_fops,
+ };
+
+diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
+index 791e589..e04c1d3 100644
+--- a/drivers/char/ip2/ip2main.c
++++ b/drivers/char/ip2/ip2main.c
+@@ -183,6 +183,8 @@ static void ip2_hangup(PTTY);
+ static int ip2_tiocmget(struct tty_struct *tty, struct file *file);
+ static int ip2_tiocmset(struct tty_struct *tty, struct file *file,
+ unsigned int set, unsigned int clear);
++static int ip2_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount);
+
+ static void set_irq(int, int);
+ static void ip2_interrupt_bh(struct work_struct *work);
+@@ -448,6 +450,7 @@ static const struct tty_operations ip2_ops = {
+ .hangup = ip2_hangup,
+ .tiocmget = ip2_tiocmget,
+ .tiocmset = ip2_tiocmset,
++ .get_icount = ip2_get_icount,
+ .proc_fops = &ip2_proc_fops,
+ };
+
+@@ -2112,7 +2115,6 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
+ i2ChanStrPtr pCh = DevTable[tty->index];
+ i2eBordStrPtr pB;
+ struct async_icount cprev, cnow; /* kernel counter temps */
+- struct serial_icounter_struct __user *p_cuser;
+ int rc = 0;
+ unsigned long flags;
+ void __user *argp = (void __user *)arg;
+@@ -2281,34 +2283,6 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
+ break;
+
+ /*
+- * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+- * Return: write counters to the user passed counter struct
+- * NB: both 1->0 and 0->1 transitions are counted except for RI where
+- * only 0->1 is counted. The controller is quite capable of counting
+- * both, but this done to preserve compatibility with the standard
+- * serial driver.
+- */
+- case TIOCGICOUNT:
+- ip2trace (CHANN, ITRC_IOCTL, 11, 1, rc );
+-
+- write_lock_irqsave(&pB->read_fifo_spinlock, flags);
+- cnow = pCh->icount;
+- write_unlock_irqrestore(&pB->read_fifo_spinlock, flags);
+- p_cuser = argp;
+- rc = put_user(cnow.cts, &p_cuser->cts);
+- rc = put_user(cnow.dsr, &p_cuser->dsr);
+- rc = put_user(cnow.rng, &p_cuser->rng);
+- rc = put_user(cnow.dcd, &p_cuser->dcd);
+- rc = put_user(cnow.rx, &p_cuser->rx);
+- rc = put_user(cnow.tx, &p_cuser->tx);
+- rc = put_user(cnow.frame, &p_cuser->frame);
+- rc = put_user(cnow.overrun, &p_cuser->overrun);
+- rc = put_user(cnow.parity, &p_cuser->parity);
+- rc = put_user(cnow.brk, &p_cuser->brk);
+- rc = put_user(cnow.buf_overrun, &p_cuser->buf_overrun);
+- break;
+-
+- /*
+ * The rest are not supported by this driver. By returning -ENOIOCTLCMD they
+ * will be passed to the line discipline for it to handle.
+ */
+@@ -2332,6 +2306,46 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
+ return rc;
+ }
+
++static int ip2_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++{
++ i2ChanStrPtr pCh = DevTable[tty->index];
++ i2eBordStrPtr pB;
++ struct async_icount cnow; /* kernel counter temp */
++ unsigned long flags;
++
++ if ( pCh == NULL )
++ return -ENODEV;
++
++ pB = pCh->pMyBord;
++
++ /*
++ * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
++ * Return: write counters to the user passed counter struct
++ * NB: both 1->0 and 0->1 transitions are counted except for RI where
++ * only 0->1 is counted. The controller is quite capable of counting
++ * both, but this done to preserve compatibility with the standard
++ * serial driver.
++ */
++
++ write_lock_irqsave(&pB->read_fifo_spinlock, flags);
++ cnow = pCh->icount;
++ write_unlock_irqrestore(&pB->read_fifo_spinlock, flags);
++
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->frame = cnow.frame;
++ icount->overrun = cnow.overrun;
++ icount->parity = cnow.parity;
++ icount->brk = cnow.brk;
++ icount->buf_overrun = cnow.buf_overrun;
++ return 0;
++}
++
+ /******************************************************************************/
+ /* Function: GetSerialInfo() */
+ /* Parameters: Pointer to channel structure */
+diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
+index 5e28d39..4b97406 100644
+--- a/drivers/char/mxser.c
++++ b/drivers/char/mxser.c
+@@ -1736,7 +1736,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
+ return 0;
+ }
+
+- if (cmd != TIOCGSERIAL && cmd != TIOCMIWAIT && cmd != TIOCGICOUNT &&
++ if (cmd != TIOCGSERIAL && cmd != TIOCMIWAIT &&
+ test_bit(TTY_IO_ERROR, &tty->flags))
+ return -EIO;
+
+@@ -1766,32 +1766,6 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
+
+ return wait_event_interruptible(info->port.delta_msr_wait,
+ mxser_cflags_changed(info, arg, &cnow));
+- /*
+- * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+- * Return: write counters to the user passed counter struct
+- * NB: both 1->0 and 0->1 transitions are counted except for
+- * RI where only 0->1 is counted.
+- */
+- case TIOCGICOUNT: {
+- struct serial_icounter_struct icnt = { 0 };
+- spin_lock_irqsave(&info->slock, flags);
+- cnow = info->icount;
+- spin_unlock_irqrestore(&info->slock, flags);
+-
+- icnt.frame = cnow.frame;
+- icnt.brk = cnow.brk;
+- icnt.overrun = cnow.overrun;
+- icnt.buf_overrun = cnow.buf_overrun;
+- icnt.parity = cnow.parity;
+- icnt.rx = cnow.rx;
+- icnt.tx = cnow.tx;
+- icnt.cts = cnow.cts;
+- icnt.dsr = cnow.dsr;
+- icnt.rng = cnow.rng;
+- icnt.dcd = cnow.dcd;
+-
+- return copy_to_user(argp, &icnt, sizeof(icnt)) ? -EFAULT : 0;
+- }
+ case MOXA_HighSpeedOn:
+ return put_user(info->baud_base != 115200 ? 1 : 0, (int __user *)argp);
+ case MOXA_SDS_RSTICOUNTER:
+@@ -1862,6 +1836,39 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
+ return 0;
+ }
+
++ /*
++ * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
++ * Return: write counters to the user passed counter struct
++ * NB: both 1->0 and 0->1 transitions are counted except for
++ * RI where only 0->1 is counted.
++ */
++
++static int mxser_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++
++{
++ struct mxser_port *info = tty->driver_data;
++ struct async_icount cnow;
++ unsigned long flags;
++
++ spin_lock_irqsave(&info->slock, flags);
++ cnow = info->icount;
++ spin_unlock_irqrestore(&info->slock, flags);
++
++ icount->frame = cnow.frame;
++ icount->brk = cnow.brk;
++ icount->overrun = cnow.overrun;
++ icount->buf_overrun = cnow.buf_overrun;
++ icount->parity = cnow.parity;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ return 0;
++}
++
+ static void mxser_stoprx(struct tty_struct *tty)
+ {
+ struct mxser_port *info = tty->driver_data;
+@@ -2358,6 +2365,7 @@ static const struct tty_operations mxser_ops = {
+ .wait_until_sent = mxser_wait_until_sent,
+ .tiocmget = mxser_tiocmget,
+ .tiocmset = mxser_tiocmset,
++ .get_icount = mxser_get_icount,
+ };
+
+ struct tty_port_operations mxser_port_ops = {
+diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
+index dc52f75..19b3e1d 100644
+--- a/drivers/char/nozomi.c
++++ b/drivers/char/nozomi.c
+@@ -1783,24 +1783,24 @@ static int ntty_cflags_changed(struct port *port, unsigned long flags,
+ return ret;
+ }
+
+-static int ntty_ioctl_tiocgicount(struct port *port, void __user *argp)
++static int ntty_tiocgicount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
+ {
++ struct port *port = tty->driver_data;
+ const struct async_icount cnow = port->tty_icount;
+- struct serial_icounter_struct icount;
+-
+- icount.cts = cnow.cts;
+- icount.dsr = cnow.dsr;
+- icount.rng = cnow.rng;
+- icount.dcd = cnow.dcd;
+- icount.rx = cnow.rx;
+- icount.tx = cnow.tx;
+- icount.frame = cnow.frame;
+- icount.overrun = cnow.overrun;
+- icount.parity = cnow.parity;
+- icount.brk = cnow.brk;
+- icount.buf_overrun = cnow.buf_overrun;
+-
+- return copy_to_user(argp, &icount, sizeof(icount)) ? -EFAULT : 0;
++
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->frame = cnow.frame;
++ icount->overrun = cnow.overrun;
++ icount->parity = cnow.parity;
++ icount->brk = cnow.brk;
++ icount->buf_overrun = cnow.buf_overrun;
++ return 0;
+ }
+
+ static int ntty_ioctl(struct tty_struct *tty, struct file *file,
+@@ -1819,9 +1819,7 @@ static int ntty_ioctl(struct tty_struct *tty, struct file *file,
+ rval = wait_event_interruptible(port->tty_wait,
+ ntty_cflags_changed(port, arg, &cprev));
+ break;
+- } case TIOCGICOUNT:
+- rval = ntty_ioctl_tiocgicount(port, argp);
+- break;
++ }
+ default:
+ DBG1("ERR: 0x%08X, %d", cmd, cmd);
+ break;
+@@ -1895,6 +1893,7 @@ static const struct tty_operations tty_ops = {
+ .chars_in_buffer = ntty_chars_in_buffer,
+ .tiocmget = ntty_tiocmget,
+ .tiocmset = ntty_tiocmset,
++ .get_icount = ntty_tiocgicount,
+ };
+
+ /* Module initialization */
+diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
+index a08c899..74d124b 100644
+--- a/drivers/char/pcmcia/synclink_cs.c
++++ b/drivers/char/pcmcia/synclink_cs.c
+@@ -2252,6 +2252,32 @@ static int mgslpc_break(struct tty_struct *tty, int break_state)
+ return 0;
+ }
+
++static int mgslpc_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++{
++ MGSLPC_INFO * info = (MGSLPC_INFO *)tty->driver_data;
++ struct mgsl_icount cnow; /* kernel counter temps */
++ unsigned long flags;
++
++ spin_lock_irqsave(&info->lock,flags);
++ cnow = info->icount;
++ spin_unlock_irqrestore(&info->lock,flags);
++
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->frame = cnow.frame;
++ icount->overrun = cnow.overrun;
++ icount->parity = cnow.parity;
++ icount->brk = cnow.brk;
++ icount->buf_overrun = cnow.buf_overrun;
++
++ return 0;
++}
++
+ /* Service an IOCTL request
+ *
+ * Arguments:
+@@ -2267,11 +2293,7 @@ static int mgslpc_ioctl(struct tty_struct *tty, struct file * file,
+ unsigned int cmd, unsigned long arg)
+ {
+ MGSLPC_INFO * info = (MGSLPC_INFO *)tty->driver_data;
+- int error;
+- struct mgsl_icount cnow; /* kernel counter temps */
+- struct serial_icounter_struct __user *p_cuser; /* user space */
+ void __user *argp = (void __user *)arg;
+- unsigned long flags;
+
+ if (debug_level >= DEBUG_LEVEL_INFO)
+ printk("%s(%d):mgslpc_ioctl %s cmd=%08X\n", __FILE__,__LINE__,
+@@ -2281,7 +2303,7 @@ static int mgslpc_ioctl(struct tty_struct *tty, struct file * file,
+ return -ENODEV;
+
+ if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
+- (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
++ (cmd != TIOCMIWAIT)) {
+ if (tty->flags & (1 << TTY_IO_ERROR))
+ return -EIO;
+ }
+@@ -2311,34 +2333,6 @@ static int mgslpc_ioctl(struct tty_struct *tty, struct file * file,
+ return wait_events(info, argp);
+ case TIOCMIWAIT:
+ return modem_input_wait(info,(int)arg);
+- case TIOCGICOUNT:
+- spin_lock_irqsave(&info->lock,flags);
+- cnow = info->icount;
+- spin_unlock_irqrestore(&info->lock,flags);
+- p_cuser = argp;
+- PUT_USER(error,cnow.cts, &p_cuser->cts);
+- if (error) return error;
+- PUT_USER(error,cnow.dsr, &p_cuser->dsr);
+- if (error) return error;
+- PUT_USER(error,cnow.rng, &p_cuser->rng);
+- if (error) return error;
+- PUT_USER(error,cnow.dcd, &p_cuser->dcd);
+- if (error) return error;
+- PUT_USER(error,cnow.rx, &p_cuser->rx);
+- if (error) return error;
+- PUT_USER(error,cnow.tx, &p_cuser->tx);
+- if (error) return error;
+- PUT_USER(error,cnow.frame, &p_cuser->frame);
+- if (error) return error;
+- PUT_USER(error,cnow.overrun, &p_cuser->overrun);
+- if (error) return error;
+- PUT_USER(error,cnow.parity, &p_cuser->parity);
+- if (error) return error;
+- PUT_USER(error,cnow.brk, &p_cuser->brk);
+- if (error) return error;
+- PUT_USER(error,cnow.buf_overrun, &p_cuser->buf_overrun);
+- if (error) return error;
+- return 0;
+ default:
+ return -ENOIOCTLCMD;
+ }
+diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
+index 4846b73..b118959 100644
+--- a/drivers/char/synclink.c
++++ b/drivers/char/synclink.c
+@@ -2920,6 +2920,38 @@ static int mgsl_break(struct tty_struct *tty, int break_state)
+
+ } /* end of mgsl_break() */
+
++/*
++ * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
++ * Return: write counters to the user passed counter struct
++ * NB: both 1->0 and 0->1 transitions are counted except for
++ * RI where only 0->1 is counted.
++ */
++static int msgl_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++
++{
++ struct mgsl_struct * info = tty->driver_data;
++ struct mgsl_icount cnow; /* kernel counter temps */
++ unsigned long flags;
++
++ spin_lock_irqsave(&info->irq_spinlock,flags);
++ cnow = info->icount;
++ spin_unlock_irqrestore(&info->irq_spinlock,flags);
++
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->frame = cnow.frame;
++ icount->overrun = cnow.overrun;
++ icount->parity = cnow.parity;
++ icount->brk = cnow.brk;
++ icount->buf_overrun = cnow.buf_overrun;
++ return 0;
++}
++
+ /* mgsl_ioctl() Service an IOCTL request
+ *
+ * Arguments:
+@@ -2945,7 +2977,7 @@ static int mgsl_ioctl(struct tty_struct *tty, struct file * file,
+ return -ENODEV;
+
+ if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
+- (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
++ (cmd != TIOCMIWAIT)) {
+ if (tty->flags & (1 << TTY_IO_ERROR))
+ return -EIO;
+ }
+@@ -2958,11 +2990,7 @@ static int mgsl_ioctl(struct tty_struct *tty, struct file * file,
+
+ static int mgsl_ioctl_common(struct mgsl_struct *info, unsigned int cmd, unsigned long arg)
+ {
+- int error;
+- struct mgsl_icount cnow; /* kernel counter temps */
+ void __user *argp = (void __user *)arg;
+- struct serial_icounter_struct __user *p_cuser; /* user space */
+- unsigned long flags;
+
+ switch (cmd) {
+ case MGSL_IOCGPARAMS:
+@@ -2991,40 +3019,6 @@ static int mgsl_ioctl_common(struct mgsl_struct *info, unsigned int cmd, unsigne
+ case TIOCMIWAIT:
+ return modem_input_wait(info,(int)arg);
+
+- /*
+- * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+- * Return: write counters to the user passed counter struct
+- * NB: both 1->0 and 0->1 transitions are counted except for
+- * RI where only 0->1 is counted.
+- */
+- case TIOCGICOUNT:
+- spin_lock_irqsave(&info->irq_spinlock,flags);
+- cnow = info->icount;
+- spin_unlock_irqrestore(&info->irq_spinlock,flags);
+- p_cuser = argp;
+- PUT_USER(error,cnow.cts, &p_cuser->cts);
+- if (error) return error;
+- PUT_USER(error,cnow.dsr, &p_cuser->dsr);
+- if (error) return error;
+- PUT_USER(error,cnow.rng, &p_cuser->rng);
+- if (error) return error;
+- PUT_USER(error,cnow.dcd, &p_cuser->dcd);
+- if (error) return error;
+- PUT_USER(error,cnow.rx, &p_cuser->rx);
+- if (error) return error;
+- PUT_USER(error,cnow.tx, &p_cuser->tx);
+- if (error) return error;
+- PUT_USER(error,cnow.frame, &p_cuser->frame);
+- if (error) return error;
+- PUT_USER(error,cnow.overrun, &p_cuser->overrun);
+- if (error) return error;
+- PUT_USER(error,cnow.parity, &p_cuser->parity);
+- if (error) return error;
+- PUT_USER(error,cnow.brk, &p_cuser->brk);
+- if (error) return error;
+- PUT_USER(error,cnow.buf_overrun, &p_cuser->buf_overrun);
+- if (error) return error;
+- return 0;
+ default:
+ return -ENOIOCTLCMD;
+ }
+@@ -4325,6 +4319,7 @@ static const struct tty_operations mgsl_ops = {
+ .hangup = mgsl_hangup,
+ .tiocmget = tiocmget,
+ .tiocmset = tiocmset,
++ .get_icount = msgl_get_icount,
+ .proc_fops = &mgsl_proc_fops,
+ };
+
+diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
+index 8678f0c..c300ff6 100644
+--- a/drivers/char/synclink_gt.c
++++ b/drivers/char/synclink_gt.c
+@@ -1057,9 +1057,6 @@ static int ioctl(struct tty_struct *tty, struct file *file,
+ unsigned int cmd, unsigned long arg)
+ {
+ struct slgt_info *info = tty->driver_data;
+- struct mgsl_icount cnow; /* kernel counter temps */
+- struct serial_icounter_struct __user *p_cuser; /* user space */
+- unsigned long flags;
+ void __user *argp = (void __user *)arg;
+ int ret;
+
+@@ -1068,7 +1065,7 @@ static int ioctl(struct tty_struct *tty, struct file *file,
+ DBGINFO(("%s ioctl() cmd=%08X\n", info->device_name, cmd));
+
+ if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
+- (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
++ (cmd != TIOCMIWAIT)) {
+ if (tty->flags & (1 << TTY_IO_ERROR))
+ return -EIO;
+ }
+@@ -1121,25 +1118,6 @@ static int ioctl(struct tty_struct *tty, struct file *file,
+ case MGSL_IOCWAITGPIO:
+ ret = wait_gpio(info, argp);
+ break;
+- case TIOCGICOUNT:
+- spin_lock_irqsave(&info->lock,flags);
+- cnow = info->icount;
+- spin_unlock_irqrestore(&info->lock,flags);
+- p_cuser = argp;
+- if (put_user(cnow.cts, &p_cuser->cts) ||
+- put_user(cnow.dsr, &p_cuser->dsr) ||
+- put_user(cnow.rng, &p_cuser->rng) ||
+- put_user(cnow.dcd, &p_cuser->dcd) ||
+- put_user(cnow.rx, &p_cuser->rx) ||
+- put_user(cnow.tx, &p_cuser->tx) ||
+- put_user(cnow.frame, &p_cuser->frame) ||
+- put_user(cnow.overrun, &p_cuser->overrun) ||
+- put_user(cnow.parity, &p_cuser->parity) ||
+- put_user(cnow.brk, &p_cuser->brk) ||
+- put_user(cnow.buf_overrun, &p_cuser->buf_overrun))
+- ret = -EFAULT;
+- ret = 0;
+- break;
+ default:
+ ret = -ENOIOCTLCMD;
+ }
+@@ -1147,6 +1125,33 @@ static int ioctl(struct tty_struct *tty, struct file *file,
+ return ret;
+ }
+
++static int get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++
++{
++ struct slgt_info *info = tty->driver_data;
++ struct mgsl_icount cnow; /* kernel counter temps */
++ unsigned long flags;
++
++ spin_lock_irqsave(&info->lock,flags);
++ cnow = info->icount;
++ spin_unlock_irqrestore(&info->lock,flags);
++
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->frame = cnow.frame;
++ icount->overrun = cnow.overrun;
++ icount->parity = cnow.parity;
++ icount->brk = cnow.brk;
++ icount->buf_overrun = cnow.buf_overrun;
++
++ return 0;
++}
++
+ /*
+ * support for 32 bit ioctl calls on 64 bit systems
+ */
+@@ -1236,10 +1241,6 @@ static long slgt_compat_ioctl(struct tty_struct *tty, struct file *file,
+ case MGSL_IOCSGPIO:
+ case MGSL_IOCGGPIO:
+ case MGSL_IOCWAITGPIO:
+- case TIOCGICOUNT:
+- rc = ioctl(tty, file, cmd, (unsigned long)(compat_ptr(arg)));
+- break;
+-
+ case MGSL_IOCSTXIDLE:
+ case MGSL_IOCTXENABLE:
+ case MGSL_IOCRXENABLE:
+@@ -3639,6 +3640,7 @@ static const struct tty_operations ops = {
+ .hangup = hangup,
+ .tiocmget = tiocmget,
+ .tiocmset = tiocmset,
++ .get_icount = get_icount,
+ .proc_fops = &synclink_gt_proc_fops,
+ };
+
+diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
+index 2b18adc..951b65f 100644
+--- a/drivers/char/synclinkmp.c
++++ b/drivers/char/synclinkmp.c
+@@ -1255,10 +1255,6 @@ static int do_ioctl(struct tty_struct *tty, struct file *file,
+ unsigned int cmd, unsigned long arg)
+ {
+ SLMP_INFO *info = tty->driver_data;
+- int error;
+- struct mgsl_icount cnow; /* kernel counter temps */
+- struct serial_icounter_struct __user *p_cuser; /* user space */
+- unsigned long flags;
+ void __user *argp = (void __user *)arg;
+
+ if (debug_level >= DEBUG_LEVEL_INFO)
+@@ -1269,7 +1265,7 @@ static int do_ioctl(struct tty_struct *tty, struct file *file,
+ return -ENODEV;
+
+ if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
+- (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
++ (cmd != TIOCMIWAIT)) {
+ if (tty->flags & (1 << TTY_IO_ERROR))
+ return -EIO;
+ }
+@@ -1307,40 +1303,38 @@ static int do_ioctl(struct tty_struct *tty, struct file *file,
+ * NB: both 1->0 and 0->1 transitions are counted except for
+ * RI where only 0->1 is counted.
+ */
+- case TIOCGICOUNT:
+- spin_lock_irqsave(&info->lock,flags);
+- cnow = info->icount;
+- spin_unlock_irqrestore(&info->lock,flags);
+- p_cuser = argp;
+- PUT_USER(error,cnow.cts, &p_cuser->cts);
+- if (error) return error;
+- PUT_USER(error,cnow.dsr, &p_cuser->dsr);
+- if (error) return error;
+- PUT_USER(error,cnow.rng, &p_cuser->rng);
+- if (error) return error;
+- PUT_USER(error,cnow.dcd, &p_cuser->dcd);
+- if (error) return error;
+- PUT_USER(error,cnow.rx, &p_cuser->rx);
+- if (error) return error;
+- PUT_USER(error,cnow.tx, &p_cuser->tx);
+- if (error) return error;
+- PUT_USER(error,cnow.frame, &p_cuser->frame);
+- if (error) return error;
+- PUT_USER(error,cnow.overrun, &p_cuser->overrun);
+- if (error) return error;
+- PUT_USER(error,cnow.parity, &p_cuser->parity);
+- if (error) return error;
+- PUT_USER(error,cnow.brk, &p_cuser->brk);
+- if (error) return error;
+- PUT_USER(error,cnow.buf_overrun, &p_cuser->buf_overrun);
+- if (error) return error;
+- return 0;
+ default:
+ return -ENOIOCTLCMD;
+ }
+ return 0;
+ }
+
++static int get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++{
++ SLMP_INFO *info = tty->driver_data;
++ struct mgsl_icount cnow; /* kernel counter temps */
++ unsigned long flags;
++
++ spin_lock_irqsave(&info->lock,flags);
++ cnow = info->icount;
++ spin_unlock_irqrestore(&info->lock,flags);
++
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++ icount->rx = cnow.rx;
++ icount->tx = cnow.tx;
++ icount->frame = cnow.frame;
++ icount->overrun = cnow.overrun;
++ icount->parity = cnow.parity;
++ icount->brk = cnow.brk;
++ icount->buf_overrun = cnow.buf_overrun;
++
++ return 0;
++}
++
+ static int ioctl(struct tty_struct *tty, struct file *file,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -3908,6 +3902,7 @@ static const struct tty_operations ops = {
+ .hangup = hangup,
+ .tiocmget = tiocmget,
+ .tiocmset = tiocmset,
++ .get_icount = get_icount,
+ .proc_fops = &synclinkmp_proc_fops,
+ };
+
+diff --git a/drivers/serial/68360serial.c b/drivers/serial/68360serial.c
+index 24661cd..1e4f831 100644
+--- a/drivers/serial/68360serial.c
++++ b/drivers/serial/68360serial.c
+@@ -1381,6 +1381,30 @@ static void send_break(ser_info_t *info, unsigned int duration)
+ }
+
+
++/*
++ * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
++ * Return: write counters to the user passed counter struct
++ * NB: both 1->0 and 0->1 transitions are counted except for
++ * RI where only 0->1 is counted.
++ */
++static int rs_360_get_icount(struct tty_struct *tty,
++ struct serial_icounter_struct *icount)
++{
++ ser_info_t *info = (ser_info_t *)tty->driver_data;
++ struct async_icount cnow;
++
++ local_irq_disable();
++ cnow = info->state->icount;
++ local_irq_enable();
++
++ icount->cts = cnow.cts;
++ icount->dsr = cnow.dsr;
++ icount->rng = cnow.rng;
++ icount->dcd = cnow.dcd;
++
++ return 0;
++}
++
+ static int rs_360_ioctl(struct tty_struct *tty, struct file * file,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -1394,7 +1418,7 @@ static int rs_360_ioctl(struct tty_struct *tty, struct file * file,
+ if (serial_paranoia_check(info, tty->name, "rs_ioctl"))
+ return -ENODEV;
+
+- if ((cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
++ if (cmd != TIOCMIWAIT) {
+ if (tty->flags & (1 << TTY_IO_ERROR))
+ return -EIO;
+ }
+@@ -1477,31 +1501,6 @@ static int rs_360_ioctl(struct tty_struct *tty, struct file * file,
+ return 0;
+ #endif
+
+- /*
+- * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+- * Return: write counters to the user passed counter struct
+- * NB: both 1->0 and 0->1 transitions are counted except for
+- * RI where only 0->1 is counted.
+- */
+- case TIOCGICOUNT:
+- local_irq_disable();
+- cnow = info->state->icount;
+- local_irq_enable();
+- p_cuser = (struct serial_icounter_struct *) arg;
+-/* error = put_user(cnow.cts, &p_cuser->cts); */
+-/* if (error) return error; */
+-/* error = put_user(cnow.dsr, &p_cuser->dsr); */
+-/* if (error) return error; */
+-/* error = put_user(cnow.rng, &p_cuser->rng); */
+-/* if (error) return error; */
+-/* error = put_user(cnow.dcd, &p_cuser->dcd); */
+-/* if (error) return error; */
+-
+- put_user(cnow.cts, &p_cuser->cts);
+- put_user(cnow.dsr, &p_cuser->dsr);
+- put_user(cnow.rng, &p_cuser->rng);
+- put_user(cnow.dcd, &p_cuser->dcd);
+- return 0;
+
+ default:
+ return -ENOIOCTLCMD;
+diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
+index cab71ea..5f6a305 100644
+--- a/net/bluetooth/rfcomm/tty.c
++++ b/net/bluetooth/rfcomm/tty.c
+@@ -844,10 +844,6 @@ static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned
+ BT_DBG("TIOCMIWAIT");
+ break;
+
+- case TIOCGICOUNT:
+- BT_DBG("TIOCGICOUNT");
+- break;
+-
+ case TIOCGSERIAL:
+ BT_ERR("TIOCGSERIAL is not supported");
+ return -ENOIOCTLCMD;
+--
+1.7.2.3
+
Added: dists/sid/linux-2.6/debian/patches/debian/tty-Avoid-ABI-change-for-addition-of-get_icount.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/debian/tty-Avoid-ABI-change-for-addition-of-get_icount.patch Sun Jan 16 05:29:16 2011 (r16817)
@@ -0,0 +1,253 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Sun, 16 Jan 2011 04:59:20 +0000
+Subject: [PATCH 4/4] tty: Avoid ABI change for addition of tty_operations::get_icount etc.
+
+Move tty_operations::get_icount to the end of the structures, guarded
+by #ifndef __GENKSYMS__. Define a new flag in tty_driver::flags
+indicating whether ops->get_icount is valid; set and test it as
+needed.
+
+Delete usb_serial_driver::get_icount as unused. The in-tree USB
+serial drivers that implement SIOCGICOUNT do not appear to leak
+information.
+
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+---
+ drivers/char/amiserial.c | 1 +
+ drivers/char/cyclades.c | 1 +
+ drivers/char/ip2/ip2main.c | 1 +
+ drivers/char/mxser.c | 1 +
+ drivers/char/nozomi.c | 1 +
+ drivers/char/pcmcia/synclink_cs.c | 1 +
+ drivers/char/synclink.c | 1 +
+ drivers/char/synclink_gt.c | 1 +
+ drivers/char/synclinkmp.c | 1 +
+ drivers/char/tty_io.c | 3 ++-
+ drivers/serial/68360serial.c | 1 +
+ drivers/usb/serial/usb-serial.c | 13 -------------
+ include/linux/tty_driver.h | 10 ++++++++--
+ include/linux/usb/serial.h | 2 --
+ 14 files changed, 20 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
+index 579d479..9e144f6 100644
+--- a/drivers/char/amiserial.c
++++ b/drivers/char/amiserial.c
+@@ -2001,6 +2001,7 @@ static int __init rs_init(void)
+ B9600 | CS8 | CREAD | HUPCL | CLOCAL;
+ serial_driver->flags = TTY_DRIVER_REAL_RAW;
+ tty_set_operations(serial_driver, &serial_ops);
++ serial_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+
+ error = tty_register_driver(serial_driver);
+ if (error)
+diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
+index eb863de..2be2ba4 100644
+--- a/drivers/char/cyclades.c
++++ b/drivers/char/cyclades.c
+@@ -4130,6 +4130,7 @@ static int __init cy_init(void)
+ B9600 | CS8 | CREAD | HUPCL | CLOCAL;
+ cy_serial_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
+ tty_set_operations(cy_serial_driver, &cy_ops);
++ cy_serial_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+
+ retval = tty_register_driver(cy_serial_driver);
+ if (retval) {
+diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
+index e04c1d3..4879c7a 100644
+--- a/drivers/char/ip2/ip2main.c
++++ b/drivers/char/ip2/ip2main.c
+@@ -709,6 +709,7 @@ static int __init ip2_loadmain(void)
+ ip2_tty_driver->flags = TTY_DRIVER_REAL_RAW |
+ TTY_DRIVER_DYNAMIC_DEV;
+ tty_set_operations(ip2_tty_driver, &ip2_ops);
++ ip2_tty_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+
+ ip2trace(ITRC_NO_PORT, ITRC_INIT, 3, 0);
+
+diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
+index 4b97406..17a7e14 100644
+--- a/drivers/char/mxser.c
++++ b/drivers/char/mxser.c
+@@ -2710,6 +2710,7 @@ static int __init mxser_module_init(void)
+ mxvar_sdriver->init_termios.c_cflag = B9600|CS8|CREAD|HUPCL|CLOCAL;
+ mxvar_sdriver->flags = TTY_DRIVER_REAL_RAW|TTY_DRIVER_DYNAMIC_DEV;
+ tty_set_operations(mxvar_sdriver, &mxser_ops);
++ mxvar_sdriver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+
+ retval = tty_register_driver(mxvar_sdriver);
+ if (retval) {
+diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
+index 19b3e1d..d3a21fb 100644
+--- a/drivers/char/nozomi.c
++++ b/drivers/char/nozomi.c
+@@ -1927,6 +1927,7 @@ static __init int nozomi_init(void)
+ ntty_driver->init_termios.c_ispeed = 115200;
+ ntty_driver->init_termios.c_ospeed = 115200;
+ tty_set_operations(ntty_driver, &tty_ops);
++ ntty_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+
+ ret = tty_register_driver(ntty_driver);
+ if (ret) {
+diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
+index 55ae376..ea52c8c 100644
+--- a/drivers/char/pcmcia/synclink_cs.c
++++ b/drivers/char/pcmcia/synclink_cs.c
+@@ -2916,6 +2916,7 @@ static int __init synclink_cs_init(void)
+ B9600 | CS8 | CREAD | HUPCL | CLOCAL;
+ serial_driver->flags = TTY_DRIVER_REAL_RAW;
+ tty_set_operations(serial_driver, &mgslpc_ops);
++ serial_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+
+ if ((rc = tty_register_driver(serial_driver)) < 0) {
+ printk("%s(%d):Couldn't register serial driver\n",
+diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
+index b118959..399eaf5 100644
+--- a/drivers/char/synclink.c
++++ b/drivers/char/synclink.c
+@@ -4348,6 +4348,7 @@ static int mgsl_init_tty(void)
+ serial_driver->init_termios.c_ospeed = 9600;
+ serial_driver->flags = TTY_DRIVER_REAL_RAW;
+ tty_set_operations(serial_driver, &mgsl_ops);
++ serial_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+ if ((rc = tty_register_driver(serial_driver)) < 0) {
+ printk("%s(%d):Couldn't register serial driver\n",
+ __FILE__,__LINE__);
+diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
+index c300ff6..1d131ef 100644
+--- a/drivers/char/synclink_gt.c
++++ b/drivers/char/synclink_gt.c
+@@ -3717,6 +3717,7 @@ static int __init slgt_init(void)
+ serial_driver->init_termios.c_ospeed = 9600;
+ serial_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
+ tty_set_operations(serial_driver, &ops);
++ serial_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+ if ((rc = tty_register_driver(serial_driver)) < 0) {
+ DBGERR(("%s can't register serial driver\n", driver_name));
+ put_tty_driver(serial_driver);
+diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
+index 951b65f..676641a 100644
+--- a/drivers/char/synclinkmp.c
++++ b/drivers/char/synclinkmp.c
+@@ -3991,6 +3991,7 @@ static int __init synclinkmp_init(void)
+ serial_driver->init_termios.c_ospeed = 9600;
+ serial_driver->flags = TTY_DRIVER_REAL_RAW;
+ tty_set_operations(serial_driver, &ops);
++ serial_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+ if ((rc = tty_register_driver(serial_driver)) < 0) {
+ printk("%s(%d):Couldn't register serial driver\n",
+ __FILE__,__LINE__);
+diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
+index 123cedf..7466ea8 100644
+--- a/drivers/char/tty_io.c
++++ b/drivers/char/tty_io.c
+@@ -2442,7 +2442,8 @@ static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
+ int retval = -EINVAL;
+ struct serial_icounter_struct icount;
+ memset(&icount, 0, sizeof(icount));
+- if (tty->ops->get_icount)
++ if (tty->driver->flags & TTY_DRIVER_HAS_GET_ICOUNT &&
++ tty->ops->get_icount)
+ retval = tty->ops->get_icount(tty, &icount);
+ if (retval != 0)
+ return retval;
+diff --git a/drivers/serial/68360serial.c b/drivers/serial/68360serial.c
+index 1e4f831..e843b90 100644
+--- a/drivers/serial/68360serial.c
++++ b/drivers/serial/68360serial.c
+@@ -2461,6 +2461,7 @@ static int __init rs_360_init(void)
+ serial_driver->init_termios.c_cflag =
+ baud_idx | CS8 | CREAD | HUPCL | CLOCAL;
+ serial_driver->flags = TTY_DRIVER_REAL_RAW;
++ serial_driver->flags |= TTY_DRIVER_HAS_GET_ICOUNT;
+ tty_set_operations(serial_driver, &rs_360_ops);
+
+ if (tty_register_driver(serial_driver))
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index f23f3b4..bd3fa7f 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -562,18 +562,6 @@ static int serial_tiocmset(struct tty_struct *tty, struct file *file,
+ return -EINVAL;
+ }
+
+-static int serial_get_icount(struct tty_struct *tty,
+- struct serial_icounter_struct *icount)
+-{
+- struct usb_serial_port *port = tty->driver_data;
+-
+- dbg("%s - port %d", __func__, port->number);
+-
+- if (port->serial->type->get_icount)
+- return port->serial->type->get_icount(tty, icount);
+- return -EINVAL;
+-}
+-
+ /*
+ * We would be calling tty_wakeup here, but unfortunately some line
+ * disciplines have an annoying habit of calling tty->write from
+@@ -1226,7 +1214,6 @@ static const struct tty_operations serial_ops = {
+ .chars_in_buffer = serial_chars_in_buffer,
+ .tiocmget = serial_tiocmget,
+ .tiocmset = serial_tiocmset,
+- .get_icount = serial_get_icount,
+ .cleanup = serial_cleanup,
+ .install = serial_install,
+ .proc_fops = &serial_proc_fops,
+diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
+index db2d227..177d9e4 100644
+--- a/include/linux/tty_driver.h
++++ b/include/linux/tty_driver.h
+@@ -275,14 +275,16 @@ struct tty_operations {
+ unsigned int set, unsigned int clear);
+ int (*resize)(struct tty_struct *tty, struct winsize *ws);
+ int (*set_termiox)(struct tty_struct *tty, struct termiox *tnew);
+- int (*get_icount)(struct tty_struct *tty,
+- struct serial_icounter_struct *icount);
+ #ifdef CONFIG_CONSOLE_POLL
+ int (*poll_init)(struct tty_driver *driver, int line, char *options);
+ int (*poll_get_char)(struct tty_driver *driver, int line);
+ void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
+ #endif
+ const struct file_operations *proc_fops;
++#ifndef __GENKSYMS__
++ int (*get_icount)(struct tty_struct *tty,
++ struct serial_icounter_struct *icount);
++#endif
+ };
+
+ struct tty_driver {
+@@ -374,6 +376,9 @@ static inline struct tty_driver *tty_driver_kref_get(struct tty_driver *d)
+ * the requested timeout to the caller instead of using a simple
+ * on/off interface.
+ *
++ * TTY_DRIVER_HAS_GET_ICOUNT -- indicates whether ops->get_icount is
++ * valid (Debian ABI backward-compatibility)
++ *
+ */
+ #define TTY_DRIVER_INSTALLED 0x0001
+ #define TTY_DRIVER_RESET_TERMIOS 0x0002
+@@ -381,6 +386,7 @@ static inline struct tty_driver *tty_driver_kref_get(struct tty_driver *d)
+ #define TTY_DRIVER_DYNAMIC_DEV 0x0008
+ #define TTY_DRIVER_DEVPTS_MEM 0x0010
+ #define TTY_DRIVER_HARDWARE_BREAK 0x0020
++#define TTY_DRIVER_HAS_GET_ICOUNT 0x0040
+
+ /* tty driver types */
+ #define TTY_DRIVER_TYPE_SYSTEM 0x0001
+diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
+index 7a159e1..ce911eb 100644
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -259,8 +259,6 @@ struct usb_serial_driver {
+ int (*tiocmget)(struct tty_struct *tty, struct file *file);
+ int (*tiocmset)(struct tty_struct *tty, struct file *file,
+ unsigned int set, unsigned int clear);
+- int (*get_icount)(struct tty_struct *tty,
+- struct serial_icounter_struct *icount);
+ /* Called by the tty layer for port level work. There may or may not
+ be an attached tty at this point */
+ void (*dtr_rts)(struct usb_serial_port *port, int on);
+--
+1.7.2.3
+
Modified: dists/sid/linux-2.6/debian/patches/features/all/openvz/openvz.patch
==============================================================================
--- dists/sid/linux-2.6/debian/patches/features/all/openvz/openvz.patch Sun Jan 16 03:04:20 2011 (r16816)
+++ dists/sid/linux-2.6/debian/patches/features/all/openvz/openvz.patch Sun Jan 16 05:29:16 2011 (r16817)
@@ -11857,9 +11857,9 @@
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -96,6 +96,8 @@
- #include <linux/bitops.h>
#include <linux/delay.h>
#include <linux/seq_file.h>
+ #include <linux/serial.h>
+#include <linux/nsproxy.h>
+#include <linux/ve.h>
Modified: dists/sid/linux-2.6/debian/patches/series/31
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/31 Sun Jan 16 03:04:20 2011 (r16816)
+++ dists/sid/linux-2.6/debian/patches/series/31 Sun Jan 16 05:29:16 2011 (r16817)
@@ -1,2 +1,6 @@
+ bugfix/all/CVE-2010-4250.patch
+ bugfix/all/CVE-2010-3865.patch
++ bugfix/all/tty-Make-tiocgicount-a-handler.patch
++ bugfix/all/tty-icount-changeover-for-other-main-devices.patch
++ bugfix/all/tty-fix-warning-in-synclink-driver.patch
++ debian/tty-Avoid-ABI-change-for-addition-of-get_icount.patch
More information about the Kernel-svn-changes
mailing list