[PATCH] Fix buffer overflow in Omnikey CardMan 4040 driver (CVE-2007-0005)
[pandora-kernel.git] / drivers / char / pcmcia / cm4040_cs.c
1 /*
2  * A driver for the Omnikey PCMCIA smartcard reader CardMan 4040
3  *
4  * (c) 2000-2004 Omnikey AG (http://www.omnikey.com/)
5  *
6  * (C) 2005-2006 Harald Welte <laforge@gnumonks.org>
7  *      - add support for poll()
8  *      - driver cleanup
9  *      - add waitqueues
10  *      - adhere to linux kernel coding style and policies
11  *      - support 2.6.13 "new style" pcmcia interface
12  *      - add class interface for udev device creation
13  *
14  * The device basically is a USB CCID compliant device that has been
15  * attached to an I/O-Mapped FIFO.
16  *
17  * All rights reserved, Dual BSD/GPL Licensed.
18  */
19
20 /* #define PCMCIA_DEBUG 6 */
21
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/slab.h>
25 #include <linux/init.h>
26 #include <linux/fs.h>
27 #include <linux/delay.h>
28 #include <linux/poll.h>
29 #include <linux/wait.h>
30 #include <asm/uaccess.h>
31 #include <asm/io.h>
32
33 #include <pcmcia/cs_types.h>
34 #include <pcmcia/cs.h>
35 #include <pcmcia/cistpl.h>
36 #include <pcmcia/cisreg.h>
37 #include <pcmcia/ciscode.h>
38 #include <pcmcia/ds.h>
39
40 #include "cm4040_cs.h"
41
42
43 #ifdef PCMCIA_DEBUG
44 #define reader_to_dev(x)        (&handle_to_dev(x->p_dev->handle))
45 static int pc_debug = PCMCIA_DEBUG;
46 module_param(pc_debug, int, 0600);
47 #define DEBUGP(n, rdr, x, args...) do {                                 \
48         if (pc_debug >= (n))                                            \
49                 dev_printk(KERN_DEBUG, reader_to_dev(rdr), "%s:" x,     \
50                            __FUNCTION__ , ##args);                      \
51         } while (0)
52 #else
53 #define DEBUGP(n, rdr, x, args...)
54 #endif
55
56 static char *version =
57 "OMNIKEY CardMan 4040 v1.1.0gm5 - All bugs added by Harald Welte";
58
59 #define CCID_DRIVER_BULK_DEFAULT_TIMEOUT        (150*HZ)
60 #define CCID_DRIVER_ASYNC_POWERUP_TIMEOUT       (35*HZ)
61 #define CCID_DRIVER_MINIMUM_TIMEOUT             (3*HZ)
62 #define READ_WRITE_BUFFER_SIZE 512
63 #define POLL_LOOP_COUNT                         1000
64
65 /* how often to poll for fifo status change */
66 #define POLL_PERIOD                             msecs_to_jiffies(10)
67
68 static void reader_release(struct pcmcia_device *link);
69
70 static int major;
71 static struct class *cmx_class;
72
73 #define         BS_READABLE     0x01
74 #define         BS_WRITABLE     0x02
75
76 struct reader_dev {
77         struct pcmcia_device    *p_dev;
78         dev_node_t              node;
79         wait_queue_head_t       devq;
80         wait_queue_head_t       poll_wait;
81         wait_queue_head_t       read_wait;
82         wait_queue_head_t       write_wait;
83         unsigned long           buffer_status;
84         unsigned long           timeout;
85         unsigned char           s_buf[READ_WRITE_BUFFER_SIZE];
86         unsigned char           r_buf[READ_WRITE_BUFFER_SIZE];
87         struct timer_list       poll_timer;
88 };
89
90 static struct pcmcia_device *dev_table[CM_MAX_DEV];
91
92 #ifndef PCMCIA_DEBUG
93 #define xoutb   outb
94 #define xinb    inb
95 #else
96 static inline void xoutb(unsigned char val, unsigned short port)
97 {
98         if (pc_debug >= 7)
99                 printk(KERN_DEBUG "outb(val=%.2x,port=%.4x)\n", val, port);
100         outb(val, port);
101 }
102
103 static inline unsigned char xinb(unsigned short port)
104 {
105         unsigned char val;
106
107         val = inb(port);
108         if (pc_debug >= 7)
109                 printk(KERN_DEBUG "%.2x=inb(%.4x)\n", val, port);
110         return val;
111 }
112 #endif
113
114 /* poll the device fifo status register.  not to be confused with
115  * the poll syscall. */
116 static void cm4040_do_poll(unsigned long dummy)
117 {
118         struct reader_dev *dev = (struct reader_dev *) dummy;
119         unsigned int obs = xinb(dev->p_dev->io.BasePort1
120                                 + REG_OFFSET_BUFFER_STATUS);
121
122         if ((obs & BSR_BULK_IN_FULL)) {
123                 set_bit(BS_READABLE, &dev->buffer_status);
124                 DEBUGP(4, dev, "waking up read_wait\n");
125                 wake_up_interruptible(&dev->read_wait);
126         } else
127                 clear_bit(BS_READABLE, &dev->buffer_status);
128
129         if (!(obs & BSR_BULK_OUT_FULL)) {
130                 set_bit(BS_WRITABLE, &dev->buffer_status);
131                 DEBUGP(4, dev, "waking up write_wait\n");
132                 wake_up_interruptible(&dev->write_wait);
133         } else
134                 clear_bit(BS_WRITABLE, &dev->buffer_status);
135
136         if (dev->buffer_status)
137                 wake_up_interruptible(&dev->poll_wait);
138
139         mod_timer(&dev->poll_timer, jiffies + POLL_PERIOD);
140 }
141
142 static void cm4040_stop_poll(struct reader_dev *dev)
143 {
144         del_timer_sync(&dev->poll_timer);
145 }
146
147 static int wait_for_bulk_out_ready(struct reader_dev *dev)
148 {
149         int i, rc;
150         int iobase = dev->p_dev->io.BasePort1;
151
152         for (i = 0; i < POLL_LOOP_COUNT; i++) {
153                 if ((xinb(iobase + REG_OFFSET_BUFFER_STATUS)
154                     & BSR_BULK_OUT_FULL) == 0) {
155                         DEBUGP(4, dev, "BulkOut empty (i=%d)\n", i);
156                         return 1;
157                 }
158         }
159
160         DEBUGP(4, dev, "wait_event_interruptible_timeout(timeout=%ld\n",
161                 dev->timeout);
162         rc = wait_event_interruptible_timeout(dev->write_wait,
163                                               test_and_clear_bit(BS_WRITABLE,
164                                                        &dev->buffer_status),
165                                               dev->timeout);
166
167         if (rc > 0)
168                 DEBUGP(4, dev, "woke up: BulkOut empty\n");
169         else if (rc == 0)
170                 DEBUGP(4, dev, "woke up: BulkOut full, returning 0 :(\n");
171         else if (rc < 0)
172                 DEBUGP(4, dev, "woke up: signal arrived\n");
173
174         return rc;
175 }
176
177 /* Write to Sync Control Register */
178 static int write_sync_reg(unsigned char val, struct reader_dev *dev)
179 {
180         int iobase = dev->p_dev->io.BasePort1;
181         int rc;
182
183         rc = wait_for_bulk_out_ready(dev);
184         if (rc <= 0)
185                 return rc;
186
187         xoutb(val, iobase + REG_OFFSET_SYNC_CONTROL);
188         rc = wait_for_bulk_out_ready(dev);
189         if (rc <= 0)
190                 return rc;
191
192         return 1;
193 }
194
195 static int wait_for_bulk_in_ready(struct reader_dev *dev)
196 {
197         int i, rc;
198         int iobase = dev->p_dev->io.BasePort1;
199
200         for (i = 0; i < POLL_LOOP_COUNT; i++) {
201                 if ((xinb(iobase + REG_OFFSET_BUFFER_STATUS)
202                     & BSR_BULK_IN_FULL) == BSR_BULK_IN_FULL) {
203                         DEBUGP(3, dev, "BulkIn full (i=%d)\n", i);
204                         return 1;
205                 }
206         }
207
208         DEBUGP(4, dev, "wait_event_interruptible_timeout(timeout=%ld\n",
209                 dev->timeout);
210         rc = wait_event_interruptible_timeout(dev->read_wait,
211                                               test_and_clear_bit(BS_READABLE,
212                                                         &dev->buffer_status),
213                                               dev->timeout);
214         if (rc > 0)
215                 DEBUGP(4, dev, "woke up: BulkIn full\n");
216         else if (rc == 0)
217                 DEBUGP(4, dev, "woke up: BulkIn not full, returning 0 :(\n");
218         else if (rc < 0)
219                 DEBUGP(4, dev, "woke up: signal arrived\n");
220
221         return rc;
222 }
223
224 static ssize_t cm4040_read(struct file *filp, char __user *buf,
225                         size_t count, loff_t *ppos)
226 {
227         struct reader_dev *dev = filp->private_data;
228         int iobase = dev->p_dev->io.BasePort1;
229         size_t bytes_to_read;
230         unsigned long i;
231         size_t min_bytes_to_read;
232         int rc;
233         unsigned char uc;
234
235         DEBUGP(2, dev, "-> cm4040_read(%s,%d)\n", current->comm, current->pid);
236
237         if (count == 0)
238                 return 0;
239
240         if (count < 10)
241                 return -EFAULT;
242
243         if (filp->f_flags & O_NONBLOCK) {
244                 DEBUGP(4, dev, "filep->f_flags O_NONBLOCK set\n");
245                 DEBUGP(2, dev, "<- cm4040_read (failure)\n");
246                 return -EAGAIN;
247         }
248
249         if (!pcmcia_dev_present(dev->p_dev))
250                 return -ENODEV;
251
252         for (i = 0; i < 5; i++) {
253                 rc = wait_for_bulk_in_ready(dev);
254                 if (rc <= 0) {
255                         DEBUGP(5, dev, "wait_for_bulk_in_ready rc=%.2x\n", rc);
256                         DEBUGP(2, dev, "<- cm4040_read (failed)\n");
257                         if (rc == -ERESTARTSYS)
258                                 return rc;
259                         return -EIO;
260                 }
261                 dev->r_buf[i] = xinb(iobase + REG_OFFSET_BULK_IN);
262 #ifdef PCMCIA_DEBUG
263                 if (pc_debug >= 6)
264                         printk(KERN_DEBUG "%lu:%2x ", i, dev->r_buf[i]);
265         }
266         printk("\n");
267 #else
268         }
269 #endif
270
271         bytes_to_read = 5 + le32_to_cpu(*(__le32 *)&dev->r_buf[1]);
272
273         DEBUGP(6, dev, "BytesToRead=%lu\n", bytes_to_read);
274
275         min_bytes_to_read = min(count, bytes_to_read + 5);
276         min_bytes_to_read = min_t(size_t, min_bytes_to_read, READ_WRITE_BUFFER_SIZE);
277
278         DEBUGP(6, dev, "Min=%lu\n", min_bytes_to_read);
279
280         for (i = 0; i < (min_bytes_to_read-5); i++) {
281                 rc = wait_for_bulk_in_ready(dev);
282                 if (rc <= 0) {
283                         DEBUGP(5, dev, "wait_for_bulk_in_ready rc=%.2x\n", rc);
284                         DEBUGP(2, dev, "<- cm4040_read (failed)\n");
285                         if (rc == -ERESTARTSYS)
286                                 return rc;
287                         return -EIO;
288                 }
289                 dev->r_buf[i+5] = xinb(iobase + REG_OFFSET_BULK_IN);
290 #ifdef PCMCIA_DEBUG
291                 if (pc_debug >= 6)
292                         printk(KERN_DEBUG "%lu:%2x ", i, dev->r_buf[i]);
293         }
294         printk("\n");
295 #else
296         }
297 #endif
298
299         *ppos = min_bytes_to_read;
300         if (copy_to_user(buf, dev->r_buf, min_bytes_to_read))
301                 return -EFAULT;
302
303         rc = wait_for_bulk_in_ready(dev);
304         if (rc <= 0) {
305                 DEBUGP(5, dev, "wait_for_bulk_in_ready rc=%.2x\n", rc);
306                 DEBUGP(2, dev, "<- cm4040_read (failed)\n");
307                 if (rc == -ERESTARTSYS)
308                         return rc;
309                 return -EIO;
310         }
311
312         rc = write_sync_reg(SCR_READER_TO_HOST_DONE, dev);
313         if (rc <= 0) {
314                 DEBUGP(5, dev, "write_sync_reg c=%.2x\n", rc);
315                 DEBUGP(2, dev, "<- cm4040_read (failed)\n");
316                 if (rc == -ERESTARTSYS)
317                         return rc;
318                 else
319                         return -EIO;
320         }
321
322         uc = xinb(iobase + REG_OFFSET_BULK_IN);
323
324         DEBUGP(2, dev, "<- cm4040_read (successfully)\n");
325         return min_bytes_to_read;
326 }
327
328 static ssize_t cm4040_write(struct file *filp, const char __user *buf,
329                          size_t count, loff_t *ppos)
330 {
331         struct reader_dev *dev = filp->private_data;
332         int iobase = dev->p_dev->io.BasePort1;
333         ssize_t rc;
334         int i;
335         unsigned int bytes_to_write;
336
337         DEBUGP(2, dev, "-> cm4040_write(%s,%d)\n", current->comm, current->pid);
338
339         if (count == 0) {
340                 DEBUGP(2, dev, "<- cm4040_write empty read (successfully)\n");
341                 return 0;
342         }
343
344         if ((count < 5) || (count > READ_WRITE_BUFFER_SIZE)) {
345                 DEBUGP(2, dev, "<- cm4040_write buffersize=%Zd < 5\n", count);
346                 return -EIO;
347         }
348
349         if (filp->f_flags & O_NONBLOCK) {
350                 DEBUGP(4, dev, "filep->f_flags O_NONBLOCK set\n");
351                 DEBUGP(4, dev, "<- cm4040_write (failure)\n");
352                 return -EAGAIN;
353         }
354
355         if (!pcmcia_dev_present(dev->p_dev))
356                 return -ENODEV;
357
358         bytes_to_write = count;
359         if (copy_from_user(dev->s_buf, buf, bytes_to_write))
360                 return -EFAULT;
361
362         switch (dev->s_buf[0]) {
363                 case CMD_PC_TO_RDR_XFRBLOCK:
364                 case CMD_PC_TO_RDR_SECURE:
365                 case CMD_PC_TO_RDR_TEST_SECURE:
366                 case CMD_PC_TO_RDR_OK_SECURE:
367                         dev->timeout = CCID_DRIVER_BULK_DEFAULT_TIMEOUT;
368                         break;
369
370                 case CMD_PC_TO_RDR_ICCPOWERON:
371                         dev->timeout = CCID_DRIVER_ASYNC_POWERUP_TIMEOUT;
372                         break;
373
374                 case CMD_PC_TO_RDR_GETSLOTSTATUS:
375                 case CMD_PC_TO_RDR_ICCPOWEROFF:
376                 case CMD_PC_TO_RDR_GETPARAMETERS:
377                 case CMD_PC_TO_RDR_RESETPARAMETERS:
378                 case CMD_PC_TO_RDR_SETPARAMETERS:
379                 case CMD_PC_TO_RDR_ESCAPE:
380                 case CMD_PC_TO_RDR_ICCCLOCK:
381                 default:
382                         dev->timeout = CCID_DRIVER_MINIMUM_TIMEOUT;
383                         break;
384         }
385
386         rc = write_sync_reg(SCR_HOST_TO_READER_START, dev);
387         if (rc <= 0) {
388                 DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
389                 DEBUGP(2, dev, "<- cm4040_write (failed)\n");
390                 if (rc == -ERESTARTSYS)
391                         return rc;
392                 else
393                         return -EIO;
394         }
395
396         DEBUGP(4, dev, "start \n");
397
398         for (i = 0; i < bytes_to_write; i++) {
399                 rc = wait_for_bulk_out_ready(dev);
400                 if (rc <= 0) {
401                         DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2Zx\n",
402                                rc);
403                         DEBUGP(2, dev, "<- cm4040_write (failed)\n");
404                         if (rc == -ERESTARTSYS)
405                                 return rc;
406                         else
407                                 return -EIO;
408                 }
409
410                 xoutb(dev->s_buf[i],iobase + REG_OFFSET_BULK_OUT);
411         }
412         DEBUGP(4, dev, "end\n");
413
414         rc = write_sync_reg(SCR_HOST_TO_READER_DONE, dev);
415
416         if (rc <= 0) {
417                 DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
418                 DEBUGP(2, dev, "<- cm4040_write (failed)\n");
419                 if (rc == -ERESTARTSYS)
420                         return rc;
421                 else
422                         return -EIO;
423         }
424
425         DEBUGP(2, dev, "<- cm4040_write (successfully)\n");
426         return count;
427 }
428
429 static unsigned int cm4040_poll(struct file *filp, poll_table *wait)
430 {
431         struct reader_dev *dev = filp->private_data;
432         unsigned int mask = 0;
433
434         poll_wait(filp, &dev->poll_wait, wait);
435
436         if (test_and_clear_bit(BS_READABLE, &dev->buffer_status))
437                 mask |= POLLIN | POLLRDNORM;
438         if (test_and_clear_bit(BS_WRITABLE, &dev->buffer_status))
439                 mask |= POLLOUT | POLLWRNORM;
440
441         DEBUGP(2, dev, "<- cm4040_poll(%u)\n", mask);
442
443         return mask;
444 }
445
446 static int cm4040_open(struct inode *inode, struct file *filp)
447 {
448         struct reader_dev *dev;
449         struct pcmcia_device *link;
450         int minor = iminor(inode);
451
452         if (minor >= CM_MAX_DEV)
453                 return -ENODEV;
454
455         link = dev_table[minor];
456         if (link == NULL || !pcmcia_dev_present(link))
457                 return -ENODEV;
458
459         if (link->open)
460                 return -EBUSY;
461
462         dev = link->priv;
463         filp->private_data = dev;
464
465         if (filp->f_flags & O_NONBLOCK) {
466                 DEBUGP(4, dev, "filep->f_flags O_NONBLOCK set\n");
467                 return -EAGAIN;
468         }
469
470         link->open = 1;
471
472         dev->poll_timer.data = (unsigned long) dev;
473         mod_timer(&dev->poll_timer, jiffies + POLL_PERIOD);
474
475         DEBUGP(2, dev, "<- cm4040_open (successfully)\n");
476         return nonseekable_open(inode, filp);
477 }
478
479 static int cm4040_close(struct inode *inode, struct file *filp)
480 {
481         struct reader_dev *dev = filp->private_data;
482         struct pcmcia_device *link;
483         int minor = iminor(inode);
484
485         DEBUGP(2, dev, "-> cm4040_close(maj/min=%d.%d)\n", imajor(inode),
486               iminor(inode));
487
488         if (minor >= CM_MAX_DEV)
489                 return -ENODEV;
490
491         link = dev_table[minor];
492         if (link == NULL)
493                 return -ENODEV;
494
495         cm4040_stop_poll(dev);
496
497         link->open = 0;
498         wake_up(&dev->devq);
499
500         DEBUGP(2, dev, "<- cm4040_close\n");
501         return 0;
502 }
503
504 static void cm4040_reader_release(struct pcmcia_device *link)
505 {
506         struct reader_dev *dev = link->priv;
507
508         DEBUGP(3, dev, "-> cm4040_reader_release\n");
509         while (link->open) {
510                 DEBUGP(3, dev, KERN_INFO MODULE_NAME ": delaying release "
511                        "until process has terminated\n");
512                 wait_event(dev->devq, (link->open == 0));
513         }
514         DEBUGP(3, dev, "<- cm4040_reader_release\n");
515         return;
516 }
517
518 static int reader_config(struct pcmcia_device *link, int devno)
519 {
520         struct reader_dev *dev;
521         tuple_t tuple;
522         cisparse_t parse;
523         u_char buf[64];
524         int fail_fn, fail_rc;
525         int rc;
526
527         tuple.Attributes = 0;
528         tuple.TupleData = buf;
529         tuple.TupleDataMax = sizeof(buf);
530         tuple.TupleOffset = 0;
531
532         link->io.BasePort2 = 0;
533         link->io.NumPorts2 = 0;
534         link->io.Attributes2 = 0;
535         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
536         for (rc = pcmcia_get_first_tuple(link, &tuple);
537              rc == CS_SUCCESS;
538              rc = pcmcia_get_next_tuple(link, &tuple)) {
539                 rc = pcmcia_get_tuple_data(link, &tuple);
540                 if (rc != CS_SUCCESS)
541                         continue;
542                 rc = pcmcia_parse_tuple(link, &tuple, &parse);
543                 if (rc != CS_SUCCESS)
544                         continue;
545
546                 link->conf.ConfigIndex = parse.cftable_entry.index;
547
548                 if (!parse.cftable_entry.io.nwin)
549                         continue;
550
551                 link->io.BasePort1 = parse.cftable_entry.io.win[0].base;
552                 link->io.NumPorts1 = parse.cftable_entry.io.win[0].len;
553                 link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
554                 if (!(parse.cftable_entry.io.flags & CISTPL_IO_8BIT))
555                         link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
556                 if (!(parse.cftable_entry.io.flags & CISTPL_IO_16BIT))
557                         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
558                 link->io.IOAddrLines = parse.cftable_entry.io.flags
559                                                 & CISTPL_IO_LINES_MASK;
560                 rc = pcmcia_request_io(link, &link->io);
561
562                 dev_printk(KERN_INFO, &handle_to_dev(link), "foo");
563                 if (rc == CS_SUCCESS)
564                         break;
565                 else
566                         dev_printk(KERN_INFO, &handle_to_dev(link),
567                                    "pcmcia_request_io failed 0x%x\n", rc);
568         }
569         if (rc != CS_SUCCESS)
570                 goto cs_release;
571
572         link->conf.IntType = 00000002;
573
574         if ((fail_rc = pcmcia_request_configuration(link,&link->conf))
575                                                                 !=CS_SUCCESS) {
576                 fail_fn = RequestConfiguration;
577                 dev_printk(KERN_INFO, &handle_to_dev(link),
578                            "pcmcia_request_configuration failed 0x%x\n",
579                            fail_rc);
580                 goto cs_release;
581         }
582
583         dev = link->priv;
584         sprintf(dev->node.dev_name, DEVICE_NAME "%d", devno);
585         dev->node.major = major;
586         dev->node.minor = devno;
587         dev->node.next = &dev->node;
588
589         DEBUGP(2, dev, "device " DEVICE_NAME "%d at 0x%.4x-0x%.4x\n", devno,
590               link->io.BasePort1, link->io.BasePort1+link->io.NumPorts1);
591         DEBUGP(2, dev, "<- reader_config (succ)\n");
592
593         return 0;
594
595 cs_release:
596         reader_release(link);
597         return -ENODEV;
598 }
599
600 static void reader_release(struct pcmcia_device *link)
601 {
602         cm4040_reader_release(link->priv);
603         pcmcia_disable_device(link);
604 }
605
606 static int reader_probe(struct pcmcia_device *link)
607 {
608         struct reader_dev *dev;
609         int i, ret;
610
611         for (i = 0; i < CM_MAX_DEV; i++) {
612                 if (dev_table[i] == NULL)
613                         break;
614         }
615
616         if (i == CM_MAX_DEV)
617                 return -ENODEV;
618
619         dev = kzalloc(sizeof(struct reader_dev), GFP_KERNEL);
620         if (dev == NULL)
621                 return -ENOMEM;
622
623         dev->timeout = CCID_DRIVER_MINIMUM_TIMEOUT;
624         dev->buffer_status = 0;
625
626         link->priv = dev;
627         dev->p_dev = link;
628
629         link->conf.IntType = INT_MEMORY_AND_IO;
630         dev_table[i] = link;
631
632         init_waitqueue_head(&dev->devq);
633         init_waitqueue_head(&dev->poll_wait);
634         init_waitqueue_head(&dev->read_wait);
635         init_waitqueue_head(&dev->write_wait);
636         setup_timer(&dev->poll_timer, cm4040_do_poll, 0);
637
638         ret = reader_config(link, i);
639         if (ret)
640                 return ret;
641
642         class_device_create(cmx_class, NULL, MKDEV(major, i), NULL,
643                             "cmx%d", i);
644
645         return 0;
646 }
647
648 static void reader_detach(struct pcmcia_device *link)
649 {
650         struct reader_dev *dev = link->priv;
651         int devno;
652
653         /* find device */
654         for (devno = 0; devno < CM_MAX_DEV; devno++) {
655                 if (dev_table[devno] == link)
656                         break;
657         }
658         if (devno == CM_MAX_DEV)
659                 return;
660
661         reader_release(link);
662
663         dev_table[devno] = NULL;
664         kfree(dev);
665
666         class_device_destroy(cmx_class, MKDEV(major, devno));
667
668         return;
669 }
670
671 static const struct file_operations reader_fops = {
672         .owner          = THIS_MODULE,
673         .read           = cm4040_read,
674         .write          = cm4040_write,
675         .open           = cm4040_open,
676         .release        = cm4040_close,
677         .poll           = cm4040_poll,
678 };
679
680 static struct pcmcia_device_id cm4040_ids[] = {
681         PCMCIA_DEVICE_MANF_CARD(0x0223, 0x0200),
682         PCMCIA_DEVICE_PROD_ID12("OMNIKEY", "CardMan 4040",
683                                 0xE32CDD8C, 0x8F23318B),
684         PCMCIA_DEVICE_NULL,
685 };
686 MODULE_DEVICE_TABLE(pcmcia, cm4040_ids);
687
688 static struct pcmcia_driver reader_driver = {
689         .owner          = THIS_MODULE,
690         .drv            = {
691                 .name   = "cm4040_cs",
692         },
693         .probe          = reader_probe,
694         .remove         = reader_detach,
695         .id_table       = cm4040_ids,
696 };
697
698 static int __init cm4040_init(void)
699 {
700         int rc;
701
702         printk(KERN_INFO "%s\n", version);
703         cmx_class = class_create(THIS_MODULE, "cardman_4040");
704         if (IS_ERR(cmx_class))
705                 return PTR_ERR(cmx_class);
706
707         major = register_chrdev(0, DEVICE_NAME, &reader_fops);
708         if (major < 0) {
709                 printk(KERN_WARNING MODULE_NAME
710                         ": could not get major number\n");
711                 return major;
712         }
713
714         rc = pcmcia_register_driver(&reader_driver);
715         if (rc < 0) {
716                 unregister_chrdev(major, DEVICE_NAME);
717                 return rc;
718         }
719
720         return 0;
721 }
722
723 static void __exit cm4040_exit(void)
724 {
725         printk(KERN_INFO MODULE_NAME ": unloading\n");
726         pcmcia_unregister_driver(&reader_driver);
727         unregister_chrdev(major, DEVICE_NAME);
728         class_destroy(cmx_class);
729 }
730
731 module_init(cm4040_init);
732 module_exit(cm4040_exit);
733 MODULE_LICENSE("Dual BSD/GPL");