cdc-acm: prevent infinite loop when parsing CDC headers.
[pandora-kernel.git] / drivers / usb / class / cdc-acm.c
1 /*
2  * cdc-acm.c
3  *
4  * Copyright (c) 1999 Armin Fuerst      <fuerst@in.tum.de>
5  * Copyright (c) 1999 Pavel Machek      <pavel@ucw.cz>
6  * Copyright (c) 1999 Johannes Erdfelt  <johannes@erdfelt.com>
7  * Copyright (c) 2000 Vojtech Pavlik    <vojtech@suse.cz>
8  * Copyright (c) 2004 Oliver Neukum     <oliver@neukum.name>
9  * Copyright (c) 2005 David Kubicek     <dave@awk.cz>
10  * Copyright (c) 2011 Johan Hovold      <jhovold@gmail.com>
11  *
12  * USB Abstract Control Model driver for USB modems and ISDN adapters
13  *
14  * Sponsored by SuSE
15  *
16  * This program is free software; you can redistribute it and/or modify
17  * it under the terms of the GNU General Public License as published by
18  * the Free Software Foundation; either version 2 of the License, or
19  * (at your option) any later version.
20  *
21  * This program is distributed in the hope that it will be useful,
22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
24  * GNU General Public License for more details.
25  *
26  * You should have received a copy of the GNU General Public License
27  * along with this program; if not, write to the Free Software
28  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
29  */
30
31 #undef DEBUG
32 #undef VERBOSE_DEBUG
33
34 #include <linux/kernel.h>
35 #include <linux/errno.h>
36 #include <linux/init.h>
37 #include <linux/slab.h>
38 #include <linux/tty.h>
39 #include <linux/serial.h>
40 #include <linux/tty_driver.h>
41 #include <linux/tty_flip.h>
42 #include <linux/module.h>
43 #include <linux/mutex.h>
44 #include <linux/uaccess.h>
45 #include <linux/usb.h>
46 #include <linux/usb/cdc.h>
47 #include <asm/byteorder.h>
48 #include <asm/unaligned.h>
49 #include <linux/list.h>
50
51 #include "cdc-acm.h"
52
53
54 #define DRIVER_AUTHOR "Armin Fuerst, Pavel Machek, Johannes Erdfelt, Vojtech Pavlik, David Kubicek, Johan Hovold"
55 #define DRIVER_DESC "USB Abstract Control Model driver for USB modems and ISDN adapters"
56
57 static struct usb_driver acm_driver;
58 static struct tty_driver *acm_tty_driver;
59 static struct acm *acm_table[ACM_TTY_MINORS];
60
61 static DEFINE_MUTEX(open_mutex);
62
63 #define ACM_READY(acm)  (acm && acm->dev && acm->port.count)
64
65 static const struct tty_port_operations acm_port_ops = {
66 };
67
68 /*
69  * Functions for ACM control messages.
70  */
71
72 static int acm_ctrl_msg(struct acm *acm, int request, int value,
73                                                         void *buf, int len)
74 {
75         int retval;
76
77         retval = usb_autopm_get_interface(acm->control);
78         if (retval)
79                 return retval;
80
81         retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
82                 request, USB_RT_ACM, value,
83                 acm->control->altsetting[0].desc.bInterfaceNumber,
84                 buf, len, 5000);
85
86         dev_dbg(&acm->control->dev,
87                         "%s - rq 0x%02x, val %#x, len %#x, result %d\n",
88                         __func__, request, value, len, retval);
89
90         usb_autopm_put_interface(acm->control);
91
92         return retval < 0 ? retval : 0;
93 }
94
95 /* devices aren't required to support these requests.
96  * the cdc acm descriptor tells whether they do...
97  */
98 #define acm_set_control(acm, control) \
99         acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE, control, NULL, 0)
100 #define acm_set_line(acm, line) \
101         acm_ctrl_msg(acm, USB_CDC_REQ_SET_LINE_CODING, 0, line, sizeof *(line))
102 #define acm_send_break(acm, ms) \
103         acm_ctrl_msg(acm, USB_CDC_REQ_SEND_BREAK, ms, NULL, 0)
104
105 /*
106  * Write buffer management.
107  * All of these assume proper locks taken by the caller.
108  */
109
110 static int acm_wb_alloc(struct acm *acm)
111 {
112         int i, wbn;
113         struct acm_wb *wb;
114
115         wbn = 0;
116         i = 0;
117         for (;;) {
118                 wb = &acm->wb[wbn];
119                 if (!wb->use) {
120                         wb->use = 1;
121                         return wbn;
122                 }
123                 wbn = (wbn + 1) % ACM_NW;
124                 if (++i >= ACM_NW)
125                         return -1;
126         }
127 }
128
129 static int acm_wb_is_avail(struct acm *acm)
130 {
131         int i, n;
132         unsigned long flags;
133
134         n = ACM_NW;
135         spin_lock_irqsave(&acm->write_lock, flags);
136         for (i = 0; i < ACM_NW; i++)
137                 n -= acm->wb[i].use;
138         spin_unlock_irqrestore(&acm->write_lock, flags);
139         return n;
140 }
141
142 /*
143  * Finish write. Caller must hold acm->write_lock
144  */
145 static void acm_write_done(struct acm *acm, struct acm_wb *wb)
146 {
147         wb->use = 0;
148         acm->transmitting--;
149         usb_autopm_put_interface_async(acm->control);
150 }
151
152 /*
153  * Poke write.
154  *
155  * the caller is responsible for locking
156  */
157
158 static int acm_start_wb(struct acm *acm, struct acm_wb *wb)
159 {
160         int rc;
161
162         acm->transmitting++;
163
164         wb->urb->transfer_buffer = wb->buf;
165         wb->urb->transfer_dma = wb->dmah;
166         wb->urb->transfer_buffer_length = wb->len;
167         wb->urb->dev = acm->dev;
168
169         rc = usb_submit_urb(wb->urb, GFP_ATOMIC);
170         if (rc < 0) {
171                 dev_err(&acm->data->dev,
172                         "%s - usb_submit_urb(write bulk) failed: %d\n",
173                         __func__, rc);
174                 acm_write_done(acm, wb);
175         }
176         return rc;
177 }
178
179 static int acm_write_start(struct acm *acm, int wbn)
180 {
181         unsigned long flags;
182         struct acm_wb *wb = &acm->wb[wbn];
183         int rc;
184
185         spin_lock_irqsave(&acm->write_lock, flags);
186         if (!acm->dev) {
187                 wb->use = 0;
188                 spin_unlock_irqrestore(&acm->write_lock, flags);
189                 return -ENODEV;
190         }
191
192         dev_vdbg(&acm->data->dev, "%s - susp_count %d\n", __func__,
193                                                         acm->susp_count);
194         rc = usb_autopm_get_interface_async(acm->control);
195         if (rc) {
196                 wb->use = 0;
197                 spin_unlock_irqrestore(&acm->write_lock, flags);
198                 return rc;
199         }
200
201         if (acm->susp_count) {
202                 usb_anchor_urb(wb->urb, &acm->delayed);
203                 spin_unlock_irqrestore(&acm->write_lock, flags);
204                 return 0;
205         }
206         usb_mark_last_busy(acm->dev);
207
208         rc = acm_start_wb(acm, wb);
209         spin_unlock_irqrestore(&acm->write_lock, flags);
210
211         return rc;
212
213 }
214 /*
215  * attributes exported through sysfs
216  */
217 static ssize_t show_caps
218 (struct device *dev, struct device_attribute *attr, char *buf)
219 {
220         struct usb_interface *intf = to_usb_interface(dev);
221         struct acm *acm = usb_get_intfdata(intf);
222
223         return sprintf(buf, "%d", acm->ctrl_caps);
224 }
225 static DEVICE_ATTR(bmCapabilities, S_IRUGO, show_caps, NULL);
226
227 static ssize_t show_country_codes
228 (struct device *dev, struct device_attribute *attr, char *buf)
229 {
230         struct usb_interface *intf = to_usb_interface(dev);
231         struct acm *acm = usb_get_intfdata(intf);
232
233         memcpy(buf, acm->country_codes, acm->country_code_size);
234         return acm->country_code_size;
235 }
236
237 static DEVICE_ATTR(wCountryCodes, S_IRUGO, show_country_codes, NULL);
238
239 static ssize_t show_country_rel_date
240 (struct device *dev, struct device_attribute *attr, char *buf)
241 {
242         struct usb_interface *intf = to_usb_interface(dev);
243         struct acm *acm = usb_get_intfdata(intf);
244
245         return sprintf(buf, "%d", acm->country_rel_date);
246 }
247
248 static DEVICE_ATTR(iCountryCodeRelDate, S_IRUGO, show_country_rel_date, NULL);
249 /*
250  * Interrupt handlers for various ACM device responses
251  */
252
253 /* control interface reports status changes with "interrupt" transfers */
254 static void acm_ctrl_irq(struct urb *urb)
255 {
256         struct acm *acm = urb->context;
257         struct usb_cdc_notification *dr = urb->transfer_buffer;
258         struct tty_struct *tty;
259         unsigned char *data;
260         int newctrl;
261         int retval;
262         int status = urb->status;
263
264         switch (status) {
265         case 0:
266                 /* success */
267                 break;
268         case -ECONNRESET:
269         case -ENOENT:
270         case -ESHUTDOWN:
271                 /* this urb is terminated, clean up */
272                 dev_dbg(&acm->control->dev,
273                                 "%s - urb shutting down with status: %d\n",
274                                 __func__, status);
275                 return;
276         default:
277                 dev_dbg(&acm->control->dev,
278                                 "%s - nonzero urb status received: %d\n",
279                                 __func__, status);
280                 goto exit;
281         }
282
283         if (!ACM_READY(acm))
284                 goto exit;
285
286         usb_mark_last_busy(acm->dev);
287
288         data = (unsigned char *)(dr + 1);
289         switch (dr->bNotificationType) {
290         case USB_CDC_NOTIFY_NETWORK_CONNECTION:
291                 dev_dbg(&acm->control->dev, "%s - network connection: %d\n",
292                                                         __func__, dr->wValue);
293                 break;
294
295         case USB_CDC_NOTIFY_SERIAL_STATE:
296                 tty = tty_port_tty_get(&acm->port);
297                 newctrl = get_unaligned_le16(data);
298
299                 if (tty) {
300                         if (!acm->clocal &&
301                                 (acm->ctrlin & ~newctrl & ACM_CTRL_DCD)) {
302                                 dev_dbg(&acm->control->dev,
303                                         "%s - calling hangup\n", __func__);
304                                 tty_hangup(tty);
305                         }
306                         tty_kref_put(tty);
307                 }
308
309                 acm->ctrlin = newctrl;
310
311                 dev_dbg(&acm->control->dev,
312                         "%s - input control lines: dcd%c dsr%c break%c "
313                         "ring%c framing%c parity%c overrun%c\n",
314                         __func__,
315                         acm->ctrlin & ACM_CTRL_DCD ? '+' : '-',
316                         acm->ctrlin & ACM_CTRL_DSR ? '+' : '-',
317                         acm->ctrlin & ACM_CTRL_BRK ? '+' : '-',
318                         acm->ctrlin & ACM_CTRL_RI  ? '+' : '-',
319                         acm->ctrlin & ACM_CTRL_FRAMING ? '+' : '-',
320                         acm->ctrlin & ACM_CTRL_PARITY ? '+' : '-',
321                         acm->ctrlin & ACM_CTRL_OVERRUN ? '+' : '-');
322                         break;
323
324         default:
325                 dev_dbg(&acm->control->dev,
326                         "%s - unknown notification %d received: index %d "
327                         "len %d data0 %d data1 %d\n",
328                         __func__,
329                         dr->bNotificationType, dr->wIndex,
330                         dr->wLength, data[0], data[1]);
331                 break;
332         }
333 exit:
334         retval = usb_submit_urb(urb, GFP_ATOMIC);
335         if (retval)
336                 dev_err(&acm->control->dev, "%s - usb_submit_urb failed: %d\n",
337                                                         __func__, retval);
338 }
339
340 static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags)
341 {
342         int res;
343
344         if (!test_and_clear_bit(index, &acm->read_urbs_free))
345                 return 0;
346
347         dev_vdbg(&acm->data->dev, "%s - urb %d\n", __func__, index);
348
349         res = usb_submit_urb(acm->read_urbs[index], mem_flags);
350         if (res) {
351                 if (res != -EPERM) {
352                         dev_err(&acm->data->dev,
353                                         "%s - usb_submit_urb failed: %d\n",
354                                         __func__, res);
355                 }
356                 set_bit(index, &acm->read_urbs_free);
357                 return res;
358         }
359
360         return 0;
361 }
362
363 static int acm_submit_read_urbs(struct acm *acm, gfp_t mem_flags)
364 {
365         int res;
366         int i;
367
368         for (i = 0; i < acm->rx_buflimit; ++i) {
369                 res = acm_submit_read_urb(acm, i, mem_flags);
370                 if (res)
371                         return res;
372         }
373
374         return 0;
375 }
376
377 static void acm_process_read_urb(struct acm *acm, struct urb *urb)
378 {
379         struct tty_struct *tty;
380
381         if (!urb->actual_length)
382                 return;
383
384         tty = tty_port_tty_get(&acm->port);
385         if (!tty)
386                 return;
387
388         tty_insert_flip_string(tty, urb->transfer_buffer, urb->actual_length);
389         tty_flip_buffer_push(tty);
390
391         tty_kref_put(tty);
392 }
393
394 static void acm_read_bulk_callback(struct urb *urb)
395 {
396         struct acm_rb *rb = urb->context;
397         struct acm *acm = rb->instance;
398         unsigned long flags;
399
400         dev_vdbg(&acm->data->dev, "%s - urb %d, len %d\n", __func__,
401                                         rb->index, urb->actual_length);
402         set_bit(rb->index, &acm->read_urbs_free);
403
404         if (!acm->dev) {
405                 dev_dbg(&acm->data->dev, "%s - disconnected\n", __func__);
406                 return;
407         }
408         usb_mark_last_busy(acm->dev);
409
410         if (urb->status) {
411                 dev_dbg(&acm->data->dev, "%s - non-zero urb status: %d\n",
412                                                         __func__, urb->status);
413                 return;
414         }
415         acm_process_read_urb(acm, urb);
416
417         /* throttle device if requested by tty */
418         spin_lock_irqsave(&acm->read_lock, flags);
419         acm->throttled = acm->throttle_req;
420         if (!acm->throttled && !acm->susp_count) {
421                 spin_unlock_irqrestore(&acm->read_lock, flags);
422                 acm_submit_read_urb(acm, rb->index, GFP_ATOMIC);
423         } else {
424                 spin_unlock_irqrestore(&acm->read_lock, flags);
425         }
426 }
427
428 /* data interface wrote those outgoing bytes */
429 static void acm_write_bulk(struct urb *urb)
430 {
431         struct acm_wb *wb = urb->context;
432         struct acm *acm = wb->instance;
433         unsigned long flags;
434
435         if (urb->status || (urb->actual_length != urb->transfer_buffer_length))
436                 dev_vdbg(&acm->data->dev, "%s - len %d/%d, status %d\n",
437                         __func__,
438                         urb->actual_length,
439                         urb->transfer_buffer_length,
440                         urb->status);
441
442         spin_lock_irqsave(&acm->write_lock, flags);
443         acm_write_done(acm, wb);
444         spin_unlock_irqrestore(&acm->write_lock, flags);
445         if (ACM_READY(acm))
446                 schedule_work(&acm->work);
447 }
448
449 static void acm_softint(struct work_struct *work)
450 {
451         struct acm *acm = container_of(work, struct acm, work);
452         struct tty_struct *tty;
453
454         dev_vdbg(&acm->data->dev, "%s\n", __func__);
455
456         if (!ACM_READY(acm))
457                 return;
458         tty = tty_port_tty_get(&acm->port);
459         if (!tty)
460                 return;
461         tty_wakeup(tty);
462         tty_kref_put(tty);
463 }
464
465 /*
466  * TTY handlers
467  */
468
469 static int acm_tty_open(struct tty_struct *tty, struct file *filp)
470 {
471         struct acm *acm;
472         int rv = -ENODEV;
473
474         mutex_lock(&open_mutex);
475
476         acm = acm_table[tty->index];
477         if (!acm || !acm->dev)
478                 goto out;
479         else
480                 rv = 0;
481
482         dev_dbg(&acm->control->dev, "%s\n", __func__);
483
484         set_bit(TTY_NO_WRITE_SPLIT, &tty->flags);
485
486         tty->driver_data = acm;
487         tty_port_tty_set(&acm->port, tty);
488
489         if (usb_autopm_get_interface(acm->control) < 0)
490                 goto early_bail;
491         else
492                 acm->control->needs_remote_wakeup = 1;
493
494         mutex_lock(&acm->mutex);
495         if (acm->port.count++) {
496                 mutex_unlock(&acm->mutex);
497                 usb_autopm_put_interface(acm->control);
498                 goto out;
499         }
500
501         acm->ctrlurb->dev = acm->dev;
502         if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
503                 dev_err(&acm->control->dev,
504                         "%s - usb_submit_urb(ctrl irq) failed\n", __func__);
505                 goto bail_out;
506         }
507
508         if (0 > acm_set_control(acm, acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS) &&
509             (acm->ctrl_caps & USB_CDC_CAP_LINE))
510                 goto bail_out;
511
512         usb_autopm_put_interface(acm->control);
513
514         /*
515          * Unthrottle device in case the TTY was closed while throttled.
516          */
517         spin_lock_irq(&acm->read_lock);
518         acm->throttled = 0;
519         acm->throttle_req = 0;
520         spin_unlock_irq(&acm->read_lock);
521
522         if (acm_submit_read_urbs(acm, GFP_KERNEL))
523                 goto bail_out;
524
525         set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
526         rv = tty_port_block_til_ready(&acm->port, tty, filp);
527
528         mutex_unlock(&acm->mutex);
529 out:
530         mutex_unlock(&open_mutex);
531         return rv;
532
533 bail_out:
534         acm->port.count--;
535         mutex_unlock(&acm->mutex);
536         usb_autopm_put_interface(acm->control);
537 early_bail:
538         mutex_unlock(&open_mutex);
539         tty_port_tty_set(&acm->port, NULL);
540         return -EIO;
541 }
542
543 static void acm_tty_unregister(struct acm *acm)
544 {
545         int i;
546
547         tty_unregister_device(acm_tty_driver, acm->minor);
548         usb_put_intf(acm->control);
549         acm_table[acm->minor] = NULL;
550         usb_free_urb(acm->ctrlurb);
551         for (i = 0; i < ACM_NW; i++)
552                 usb_free_urb(acm->wb[i].urb);
553         for (i = 0; i < acm->rx_buflimit; i++)
554                 usb_free_urb(acm->read_urbs[i]);
555         kfree(acm->country_codes);
556         kfree(acm);
557 }
558
559 static void acm_port_down(struct acm *acm)
560 {
561         struct urb *urb;
562         struct acm_wb *wb;
563         int i;
564
565         if (acm->dev) {
566                 usb_autopm_get_interface(acm->control);
567                 acm_set_control(acm, acm->ctrlout = 0);
568
569                 for (;;) {
570                         urb = usb_get_from_anchor(&acm->delayed);
571                         if (!urb)
572                                 break;
573                         wb = urb->context;
574                         wb->use = 0;
575                         usb_autopm_put_interface_async(acm->control);
576                 }
577
578                 usb_kill_urb(acm->ctrlurb);
579                 for (i = 0; i < ACM_NW; i++)
580                         usb_kill_urb(acm->wb[i].urb);
581                 for (i = 0; i < acm->rx_buflimit; i++)
582                         usb_kill_urb(acm->read_urbs[i]);
583                 acm->control->needs_remote_wakeup = 0;
584                 usb_autopm_put_interface(acm->control);
585         }
586 }
587
588 static void acm_tty_hangup(struct tty_struct *tty)
589 {
590         struct acm *acm;
591
592         mutex_lock(&open_mutex);
593         acm = tty->driver_data;
594
595         if (!acm)
596                 goto out;
597
598         tty_port_hangup(&acm->port);
599         acm_port_down(acm);
600
601 out:
602         mutex_unlock(&open_mutex);
603 }
604
605 static void acm_tty_close(struct tty_struct *tty, struct file *filp)
606 {
607         struct acm *acm = tty->driver_data;
608
609         /* Perform the closing process and see if we need to do the hardware
610            shutdown */
611         if (!acm)
612                 return;
613
614         mutex_lock(&open_mutex);
615         if (tty_port_close_start(&acm->port, tty, filp) == 0) {
616                 if (!acm->dev) {
617                         tty_port_tty_set(&acm->port, NULL);
618                         acm_tty_unregister(acm);
619                         tty->driver_data = NULL;
620                 }
621                 mutex_unlock(&open_mutex);
622                 return;
623         }
624         acm_port_down(acm);
625         tty_port_close_end(&acm->port, tty);
626         tty_port_tty_set(&acm->port, NULL);
627         mutex_unlock(&open_mutex);
628 }
629
630 static int acm_tty_write(struct tty_struct *tty,
631                                         const unsigned char *buf, int count)
632 {
633         struct acm *acm = tty->driver_data;
634         int stat;
635         unsigned long flags;
636         int wbn;
637         struct acm_wb *wb;
638
639         if (!ACM_READY(acm))
640                 return -EINVAL;
641         if (!count)
642                 return 0;
643
644         dev_vdbg(&acm->data->dev, "%s - count %d\n", __func__, count);
645
646         spin_lock_irqsave(&acm->write_lock, flags);
647         wbn = acm_wb_alloc(acm);
648         if (wbn < 0) {
649                 spin_unlock_irqrestore(&acm->write_lock, flags);
650                 return 0;
651         }
652         wb = &acm->wb[wbn];
653
654         count = (count > acm->writesize) ? acm->writesize : count;
655         dev_vdbg(&acm->data->dev, "%s - write %d\n", __func__, count);
656         memcpy(wb->buf, buf, count);
657         wb->len = count;
658         spin_unlock_irqrestore(&acm->write_lock, flags);
659
660         stat = acm_write_start(acm, wbn);
661         if (stat < 0)
662                 return stat;
663         return count;
664 }
665
666 static int acm_tty_write_room(struct tty_struct *tty)
667 {
668         struct acm *acm = tty->driver_data;
669         if (!ACM_READY(acm))
670                 return -EINVAL;
671         /*
672          * Do not let the line discipline to know that we have a reserve,
673          * or it might get too enthusiastic.
674          */
675         return acm_wb_is_avail(acm) ? acm->writesize : 0;
676 }
677
678 static int acm_tty_chars_in_buffer(struct tty_struct *tty)
679 {
680         struct acm *acm = tty->driver_data;
681         if (!ACM_READY(acm))
682                 return 0;
683         /*
684          * This is inaccurate (overcounts), but it works.
685          */
686         return (ACM_NW - acm_wb_is_avail(acm)) * acm->writesize;
687 }
688
689 static void acm_tty_throttle(struct tty_struct *tty)
690 {
691         struct acm *acm = tty->driver_data;
692
693         if (!ACM_READY(acm))
694                 return;
695
696         spin_lock_irq(&acm->read_lock);
697         acm->throttle_req = 1;
698         spin_unlock_irq(&acm->read_lock);
699 }
700
701 static void acm_tty_unthrottle(struct tty_struct *tty)
702 {
703         struct acm *acm = tty->driver_data;
704         unsigned int was_throttled;
705
706         if (!ACM_READY(acm))
707                 return;
708
709         spin_lock_irq(&acm->read_lock);
710         was_throttled = acm->throttled;
711         acm->throttled = 0;
712         acm->throttle_req = 0;
713         spin_unlock_irq(&acm->read_lock);
714
715         if (was_throttled)
716                 acm_submit_read_urbs(acm, GFP_KERNEL);
717 }
718
719 static int acm_tty_break_ctl(struct tty_struct *tty, int state)
720 {
721         struct acm *acm = tty->driver_data;
722         int retval;
723         if (!ACM_READY(acm))
724                 return -EINVAL;
725         retval = acm_send_break(acm, state ? 0xffff : 0);
726         if (retval < 0)
727                 dev_dbg(&acm->control->dev, "%s - send break failed\n",
728                                                                 __func__);
729         return retval;
730 }
731
732 static int acm_tty_tiocmget(struct tty_struct *tty)
733 {
734         struct acm *acm = tty->driver_data;
735
736         if (!ACM_READY(acm))
737                 return -EINVAL;
738
739         return (acm->ctrlout & ACM_CTRL_DTR ? TIOCM_DTR : 0) |
740                (acm->ctrlout & ACM_CTRL_RTS ? TIOCM_RTS : 0) |
741                (acm->ctrlin  & ACM_CTRL_DSR ? TIOCM_DSR : 0) |
742                (acm->ctrlin  & ACM_CTRL_RI  ? TIOCM_RI  : 0) |
743                (acm->ctrlin  & ACM_CTRL_DCD ? TIOCM_CD  : 0) |
744                TIOCM_CTS;
745 }
746
747 static int acm_tty_tiocmset(struct tty_struct *tty,
748                             unsigned int set, unsigned int clear)
749 {
750         struct acm *acm = tty->driver_data;
751         unsigned int newctrl;
752
753         if (!ACM_READY(acm))
754                 return -EINVAL;
755
756         newctrl = acm->ctrlout;
757         set = (set & TIOCM_DTR ? ACM_CTRL_DTR : 0) |
758                                         (set & TIOCM_RTS ? ACM_CTRL_RTS : 0);
759         clear = (clear & TIOCM_DTR ? ACM_CTRL_DTR : 0) |
760                                         (clear & TIOCM_RTS ? ACM_CTRL_RTS : 0);
761
762         newctrl = (newctrl & ~clear) | set;
763
764         if (acm->ctrlout == newctrl)
765                 return 0;
766         return acm_set_control(acm, acm->ctrlout = newctrl);
767 }
768
769 static int acm_tty_ioctl(struct tty_struct *tty,
770                                         unsigned int cmd, unsigned long arg)
771 {
772         struct acm *acm = tty->driver_data;
773
774         if (!ACM_READY(acm))
775                 return -EINVAL;
776
777         return -ENOIOCTLCMD;
778 }
779
780 static const __u32 acm_tty_speed[] = {
781         0, 50, 75, 110, 134, 150, 200, 300, 600,
782         1200, 1800, 2400, 4800, 9600, 19200, 38400,
783         57600, 115200, 230400, 460800, 500000, 576000,
784         921600, 1000000, 1152000, 1500000, 2000000,
785         2500000, 3000000, 3500000, 4000000
786 };
787
788 static void acm_tty_set_termios(struct tty_struct *tty,
789                                                 struct ktermios *termios_old)
790 {
791         struct acm *acm = tty->driver_data;
792         struct ktermios *termios = tty->termios;
793         struct usb_cdc_line_coding newline;
794         int newctrl = acm->ctrlout;
795
796         if (!ACM_READY(acm))
797                 return;
798
799         newline.dwDTERate = cpu_to_le32(tty_get_baud_rate(tty));
800         newline.bCharFormat = termios->c_cflag & CSTOPB ? 2 : 0;
801         newline.bParityType = termios->c_cflag & PARENB ?
802                                 (termios->c_cflag & PARODD ? 1 : 2) +
803                                 (termios->c_cflag & CMSPAR ? 2 : 0) : 0;
804         switch (termios->c_cflag & CSIZE) {
805         case CS5:
806                 newline.bDataBits = 5;
807                 break;
808         case CS6:
809                 newline.bDataBits = 6;
810                 break;
811         case CS7:
812                 newline.bDataBits = 7;
813                 break;
814         case CS8:
815         default:
816                 newline.bDataBits = 8;
817                 break;
818         }
819         /* FIXME: Needs to clear unsupported bits in the termios */
820         acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
821
822         if (C_BAUD(tty) == B0) {
823                 newline.dwDTERate = acm->line.dwDTERate;
824                 newctrl &= ~ACM_CTRL_DTR;
825         } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) {
826                 newctrl |=  ACM_CTRL_DTR;
827         }
828
829         if (newctrl != acm->ctrlout)
830                 acm_set_control(acm, acm->ctrlout = newctrl);
831
832         if (memcmp(&acm->line, &newline, sizeof newline)) {
833                 memcpy(&acm->line, &newline, sizeof newline);
834                 dev_dbg(&acm->control->dev, "%s - set line: %d %d %d %d\n",
835                         __func__,
836                         le32_to_cpu(newline.dwDTERate),
837                         newline.bCharFormat, newline.bParityType,
838                         newline.bDataBits);
839                 acm_set_line(acm, &acm->line);
840         }
841 }
842
843 /*
844  * USB probe and disconnect routines.
845  */
846
847 /* Little helpers: write/read buffers free */
848 static void acm_write_buffers_free(struct acm *acm)
849 {
850         int i;
851         struct acm_wb *wb;
852         struct usb_device *usb_dev = interface_to_usbdev(acm->control);
853
854         for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++)
855                 usb_free_coherent(usb_dev, acm->writesize, wb->buf, wb->dmah);
856 }
857
858 static void acm_read_buffers_free(struct acm *acm)
859 {
860         struct usb_device *usb_dev = interface_to_usbdev(acm->control);
861         int i;
862
863         for (i = 0; i < acm->rx_buflimit; i++)
864                 usb_free_coherent(usb_dev, acm->readsize,
865                           acm->read_buffers[i].base, acm->read_buffers[i].dma);
866 }
867
868 /* Little helper: write buffers allocate */
869 static int acm_write_buffers_alloc(struct acm *acm)
870 {
871         int i;
872         struct acm_wb *wb;
873
874         for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++) {
875                 wb->buf = usb_alloc_coherent(acm->dev, acm->writesize, GFP_KERNEL,
876                     &wb->dmah);
877                 if (!wb->buf) {
878                         while (i != 0) {
879                                 --i;
880                                 --wb;
881                                 usb_free_coherent(acm->dev, acm->writesize,
882                                     wb->buf, wb->dmah);
883                         }
884                         return -ENOMEM;
885                 }
886         }
887         return 0;
888 }
889
890 static int acm_probe(struct usb_interface *intf,
891                      const struct usb_device_id *id)
892 {
893         struct usb_cdc_union_desc *union_header = NULL;
894         struct usb_cdc_country_functional_desc *cfd = NULL;
895         unsigned char *buffer = intf->altsetting->extra;
896         int buflen = intf->altsetting->extralen;
897         struct usb_interface *control_interface;
898         struct usb_interface *data_interface;
899         struct usb_endpoint_descriptor *epctrl = NULL;
900         struct usb_endpoint_descriptor *epread = NULL;
901         struct usb_endpoint_descriptor *epwrite = NULL;
902         struct usb_device *usb_dev = interface_to_usbdev(intf);
903         struct acm *acm;
904         int minor;
905         int ctrlsize, readsize;
906         u8 *buf;
907         u8 ac_management_function = 0;
908         u8 call_management_function = 0;
909         int call_interface_num = -1;
910         int data_interface_num = -1;
911         unsigned long quirks;
912         int num_rx_buf;
913         int i;
914         unsigned int elength = 0;
915         int combined_interfaces = 0;
916
917         /* normal quirks */
918         quirks = (unsigned long)id->driver_info;
919         num_rx_buf = (quirks == SINGLE_RX_URB) ? 1 : ACM_NR;
920
921         /* handle quirks deadly to normal probing*/
922         if (quirks == NO_UNION_NORMAL) {
923                 data_interface = usb_ifnum_to_if(usb_dev, 1);
924                 control_interface = usb_ifnum_to_if(usb_dev, 0);
925                 goto skip_normal_probe;
926         }
927
928         /* normal probing*/
929         if (!buffer) {
930                 dev_err(&intf->dev, "Weird descriptor references\n");
931                 return -EINVAL;
932         }
933
934         if (!buflen) {
935                 if (intf->cur_altsetting->endpoint &&
936                                 intf->cur_altsetting->endpoint->extralen &&
937                                 intf->cur_altsetting->endpoint->extra) {
938                         dev_dbg(&intf->dev,
939                                 "Seeking extra descriptors on endpoint\n");
940                         buflen = intf->cur_altsetting->endpoint->extralen;
941                         buffer = intf->cur_altsetting->endpoint->extra;
942                 } else {
943                         dev_err(&intf->dev,
944                                 "Zero length descriptor references\n");
945                         return -EINVAL;
946                 }
947         }
948
949         while (buflen > 0) {
950                 elength = buffer[0];
951                 if (!elength) {
952                         dev_err(&intf->dev, "skipping garbage byte\n");
953                         elength = 1;
954                         goto next_desc;
955                 }
956                 if (buffer[1] != USB_DT_CS_INTERFACE) {
957                         dev_err(&intf->dev, "skipping garbage\n");
958                         goto next_desc;
959                 }
960
961                 switch (buffer[2]) {
962                 case USB_CDC_UNION_TYPE: /* we've found it */
963                         if (elength < sizeof(struct usb_cdc_union_desc))
964                                 goto next_desc;
965                         if (union_header) {
966                                 dev_err(&intf->dev, "More than one "
967                                         "union descriptor, skipping ...\n");
968                                 goto next_desc;
969                         }
970                         union_header = (struct usb_cdc_union_desc *)buffer;
971                         break;
972                 case USB_CDC_COUNTRY_TYPE: /* export through sysfs*/
973                         if (elength < sizeof(struct usb_cdc_country_functional_desc))
974                                 goto next_desc;
975                         cfd = (struct usb_cdc_country_functional_desc *)buffer;
976                         break;
977                 case USB_CDC_HEADER_TYPE: /* maybe check version */
978                         break; /* for now we ignore it */
979                 case USB_CDC_ACM_TYPE:
980                         if (elength < 4)
981                                 goto next_desc;
982                         ac_management_function = buffer[3];
983                         break;
984                 case USB_CDC_CALL_MANAGEMENT_TYPE:
985                         if (elength < 5)
986                                 goto next_desc;
987                         call_management_function = buffer[3];
988                         call_interface_num = buffer[4];
989                         if ( (quirks & NOT_A_MODEM) == 0 && (call_management_function & 3) != 3)
990                                 dev_err(&intf->dev, "This device cannot do calls on its own. It is not a modem.\n");
991                         break;
992                 default:
993                         /*
994                          * there are LOTS more CDC descriptors that
995                          * could legitimately be found here.
996                          */
997                         dev_dbg(&intf->dev, "Ignoring descriptor: "
998                                         "type %02x, length %ud\n",
999                                         buffer[2], elength);
1000                         break;
1001                 }
1002 next_desc:
1003                 buflen -= elength;
1004                 buffer += elength;
1005         }
1006
1007         if (!union_header) {
1008                 if (call_interface_num > 0) {
1009                         dev_dbg(&intf->dev, "No union descriptor, using call management descriptor\n");
1010                         /* quirks for Droids MuIn LCD */
1011                         if (quirks & NO_DATA_INTERFACE)
1012                                 data_interface = usb_ifnum_to_if(usb_dev, 0);
1013                         else
1014                                 data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num));
1015                         control_interface = intf;
1016                 } else {
1017                         if (intf->cur_altsetting->desc.bNumEndpoints != 3) {
1018                                 dev_dbg(&intf->dev,"No union descriptor, giving up\n");
1019                                 return -ENODEV;
1020                         } else {
1021                                 dev_warn(&intf->dev,"No union descriptor, testing for castrated device\n");
1022                                 combined_interfaces = 1;
1023                                 control_interface = data_interface = intf;
1024                                 goto look_for_collapsed_interface;
1025                         }
1026                 }
1027         } else {
1028                 control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
1029                 data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0));
1030         }
1031
1032         if (!control_interface || !data_interface) {
1033                 dev_dbg(&intf->dev, "no interfaces\n");
1034                 return -ENODEV;
1035         }
1036
1037         if (data_interface_num != call_interface_num)
1038                 dev_dbg(&intf->dev, "Separate call control interface. That is not fully supported.\n");
1039
1040         if (control_interface == data_interface) {
1041                 /* some broken devices designed for windows work this way */
1042                 dev_warn(&intf->dev,"Control and data interfaces are not separated!\n");
1043                 combined_interfaces = 1;
1044                 /* a popular other OS doesn't use it */
1045                 quirks |= NO_CAP_LINE;
1046                 if (data_interface->cur_altsetting->desc.bNumEndpoints != 3) {
1047                         dev_err(&intf->dev, "This needs exactly 3 endpoints\n");
1048                         return -EINVAL;
1049                 }
1050 look_for_collapsed_interface:
1051                 for (i = 0; i < 3; i++) {
1052                         struct usb_endpoint_descriptor *ep;
1053                         ep = &data_interface->cur_altsetting->endpoint[i].desc;
1054
1055                         if (usb_endpoint_is_int_in(ep))
1056                                 epctrl = ep;
1057                         else if (usb_endpoint_is_bulk_out(ep))
1058                                 epwrite = ep;
1059                         else if (usb_endpoint_is_bulk_in(ep))
1060                                 epread = ep;
1061                         else
1062                                 return -EINVAL;
1063                 }
1064                 if (!epctrl || !epread || !epwrite)
1065                         return -ENODEV;
1066                 else
1067                         goto made_compressed_probe;
1068         }
1069
1070 skip_normal_probe:
1071
1072         /*workaround for switched interfaces */
1073         if (data_interface->cur_altsetting->desc.bInterfaceClass
1074                                                 != CDC_DATA_INTERFACE_TYPE) {
1075                 if (control_interface->cur_altsetting->desc.bInterfaceClass
1076                                                 == CDC_DATA_INTERFACE_TYPE) {
1077                         struct usb_interface *t;
1078                         dev_dbg(&intf->dev,
1079                                 "Your device has switched interfaces.\n");
1080                         t = control_interface;
1081                         control_interface = data_interface;
1082                         data_interface = t;
1083                 } else {
1084                         return -EINVAL;
1085                 }
1086         }
1087
1088         /* Accept probe requests only for the control interface */
1089         if (!combined_interfaces && intf != control_interface)
1090                 return -ENODEV;
1091
1092         if (!combined_interfaces && usb_interface_claimed(data_interface)) {
1093                 /* valid in this context */
1094                 dev_dbg(&intf->dev, "The data interface isn't available\n");
1095                 return -EBUSY;
1096         }
1097
1098
1099         if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
1100             control_interface->cur_altsetting->desc.bNumEndpoints == 0)
1101                 return -EINVAL;
1102
1103         epctrl = &control_interface->cur_altsetting->endpoint[0].desc;
1104         epread = &data_interface->cur_altsetting->endpoint[0].desc;
1105         epwrite = &data_interface->cur_altsetting->endpoint[1].desc;
1106
1107
1108         /* workaround for switched endpoints */
1109         if (!usb_endpoint_dir_in(epread)) {
1110                 /* descriptors are swapped */
1111                 struct usb_endpoint_descriptor *t;
1112                 dev_dbg(&intf->dev,
1113                         "The data interface has switched endpoints\n");
1114                 t = epread;
1115                 epread = epwrite;
1116                 epwrite = t;
1117         }
1118 made_compressed_probe:
1119         dev_dbg(&intf->dev, "interfaces are valid\n");
1120         for (minor = 0; minor < ACM_TTY_MINORS && acm_table[minor]; minor++);
1121
1122         if (minor == ACM_TTY_MINORS) {
1123                 dev_err(&intf->dev, "no more free acm devices\n");
1124                 return -ENODEV;
1125         }
1126
1127         acm = kzalloc(sizeof(struct acm), GFP_KERNEL);
1128         if (acm == NULL) {
1129                 dev_err(&intf->dev, "out of memory (acm kzalloc)\n");
1130                 goto alloc_fail;
1131         }
1132
1133         ctrlsize = usb_endpoint_maxp(epctrl);
1134         readsize = usb_endpoint_maxp(epread) *
1135                                 (quirks == SINGLE_RX_URB ? 1 : 2);
1136         acm->combined_interfaces = combined_interfaces;
1137         acm->writesize = usb_endpoint_maxp(epwrite) * 20;
1138         acm->control = control_interface;
1139         acm->data = data_interface;
1140         acm->minor = minor;
1141         acm->dev = usb_dev;
1142         acm->ctrl_caps = ac_management_function;
1143         if (quirks & NO_CAP_LINE)
1144                 acm->ctrl_caps &= ~USB_CDC_CAP_LINE;
1145         acm->ctrlsize = ctrlsize;
1146         acm->readsize = readsize;
1147         acm->rx_buflimit = num_rx_buf;
1148         INIT_WORK(&acm->work, acm_softint);
1149         spin_lock_init(&acm->write_lock);
1150         spin_lock_init(&acm->read_lock);
1151         mutex_init(&acm->mutex);
1152         acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
1153         acm->is_int_ep = usb_endpoint_xfer_int(epread);
1154         if (acm->is_int_ep)
1155                 acm->bInterval = epread->bInterval;
1156         tty_port_init(&acm->port);
1157         acm->port.ops = &acm_port_ops;
1158         init_usb_anchor(&acm->delayed);
1159
1160         buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
1161         if (!buf) {
1162                 dev_err(&intf->dev, "out of memory (ctrl buffer alloc)\n");
1163                 goto alloc_fail2;
1164         }
1165         acm->ctrl_buffer = buf;
1166
1167         if (acm_write_buffers_alloc(acm) < 0) {
1168                 dev_err(&intf->dev, "out of memory (write buffer alloc)\n");
1169                 goto alloc_fail4;
1170         }
1171
1172         acm->ctrlurb = usb_alloc_urb(0, GFP_KERNEL);
1173         if (!acm->ctrlurb) {
1174                 dev_err(&intf->dev, "out of memory (ctrlurb kmalloc)\n");
1175                 goto alloc_fail5;
1176         }
1177         for (i = 0; i < num_rx_buf; i++) {
1178                 struct acm_rb *rb = &(acm->read_buffers[i]);
1179                 struct urb *urb;
1180
1181                 rb->base = usb_alloc_coherent(acm->dev, readsize, GFP_KERNEL,
1182                                                                 &rb->dma);
1183                 if (!rb->base) {
1184                         dev_err(&intf->dev, "out of memory "
1185                                         "(read bufs usb_alloc_coherent)\n");
1186                         goto alloc_fail6;
1187                 }
1188                 rb->index = i;
1189                 rb->instance = acm;
1190
1191                 urb = usb_alloc_urb(0, GFP_KERNEL);
1192                 if (!urb) {
1193                         dev_err(&intf->dev,
1194                                 "out of memory (read urbs usb_alloc_urb)\n");
1195                         goto alloc_fail6;
1196                 }
1197                 urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1198                 urb->transfer_dma = rb->dma;
1199                 if (acm->is_int_ep) {
1200                         usb_fill_int_urb(urb, acm->dev,
1201                                          acm->rx_endpoint,
1202                                          rb->base,
1203                                          acm->readsize,
1204                                          acm_read_bulk_callback, rb,
1205                                          acm->bInterval);
1206                 } else {
1207                         usb_fill_bulk_urb(urb, acm->dev,
1208                                           acm->rx_endpoint,
1209                                           rb->base,
1210                                           acm->readsize,
1211                                           acm_read_bulk_callback, rb);
1212                 }
1213
1214                 acm->read_urbs[i] = urb;
1215                 __set_bit(i, &acm->read_urbs_free);
1216         }
1217         for (i = 0; i < ACM_NW; i++) {
1218                 struct acm_wb *snd = &(acm->wb[i]);
1219
1220                 snd->urb = usb_alloc_urb(0, GFP_KERNEL);
1221                 if (snd->urb == NULL) {
1222                         dev_err(&intf->dev,
1223                                 "out of memory (write urbs usb_alloc_urb)\n");
1224                         goto alloc_fail7;
1225                 }
1226
1227                 if (usb_endpoint_xfer_int(epwrite))
1228                         usb_fill_int_urb(snd->urb, usb_dev,
1229                                 usb_sndintpipe(usb_dev, epwrite->bEndpointAddress),
1230                                 NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval);
1231                 else
1232                         usb_fill_bulk_urb(snd->urb, usb_dev,
1233                                 usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
1234                                 NULL, acm->writesize, acm_write_bulk, snd);
1235                 snd->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1236                 snd->instance = acm;
1237         }
1238
1239         usb_set_intfdata(intf, acm);
1240
1241         i = device_create_file(&intf->dev, &dev_attr_bmCapabilities);
1242         if (i < 0)
1243                 goto alloc_fail7;
1244
1245         if (cfd) { /* export the country data */
1246                 acm->country_codes = kmalloc(cfd->bLength - 4, GFP_KERNEL);
1247                 if (!acm->country_codes)
1248                         goto skip_countries;
1249                 acm->country_code_size = cfd->bLength - 4;
1250                 memcpy(acm->country_codes, (u8 *)&cfd->wCountyCode0,
1251                                                         cfd->bLength - 4);
1252                 acm->country_rel_date = cfd->iCountryCodeRelDate;
1253
1254                 i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
1255                 if (i < 0) {
1256                         kfree(acm->country_codes);
1257                         acm->country_codes = NULL;
1258                         acm->country_code_size = 0;
1259                         goto skip_countries;
1260                 }
1261
1262                 i = device_create_file(&intf->dev,
1263                                                 &dev_attr_iCountryCodeRelDate);
1264                 if (i < 0) {
1265                         device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
1266                         kfree(acm->country_codes);
1267                         acm->country_codes = NULL;
1268                         acm->country_code_size = 0;
1269                         goto skip_countries;
1270                 }
1271         }
1272
1273 skip_countries:
1274         usb_fill_int_urb(acm->ctrlurb, usb_dev,
1275                          usb_rcvintpipe(usb_dev, epctrl->bEndpointAddress),
1276                          acm->ctrl_buffer, ctrlsize, acm_ctrl_irq, acm,
1277                          /* works around buggy devices */
1278                          epctrl->bInterval ? epctrl->bInterval : 0xff);
1279         acm->ctrlurb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1280         acm->ctrlurb->transfer_dma = acm->ctrl_dma;
1281
1282         dev_info(&intf->dev, "ttyACM%d: USB ACM device\n", minor);
1283
1284         acm_set_control(acm, acm->ctrlout);
1285
1286         acm->line.dwDTERate = cpu_to_le32(9600);
1287         acm->line.bDataBits = 8;
1288         acm_set_line(acm, &acm->line);
1289
1290         usb_driver_claim_interface(&acm_driver, data_interface, acm);
1291         usb_set_intfdata(data_interface, acm);
1292
1293         usb_get_intf(control_interface);
1294         tty_register_device(acm_tty_driver, minor, &control_interface->dev);
1295
1296         acm_table[minor] = acm;
1297
1298         return 0;
1299 alloc_fail7:
1300         for (i = 0; i < ACM_NW; i++)
1301                 usb_free_urb(acm->wb[i].urb);
1302 alloc_fail6:
1303         for (i = 0; i < num_rx_buf; i++)
1304                 usb_free_urb(acm->read_urbs[i]);
1305         acm_read_buffers_free(acm);
1306         usb_free_urb(acm->ctrlurb);
1307 alloc_fail5:
1308         acm_write_buffers_free(acm);
1309 alloc_fail4:
1310         usb_free_coherent(usb_dev, ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
1311 alloc_fail2:
1312         kfree(acm);
1313 alloc_fail:
1314         return -ENOMEM;
1315 }
1316
1317 static void stop_data_traffic(struct acm *acm)
1318 {
1319         int i;
1320
1321         dev_dbg(&acm->control->dev, "%s\n", __func__);
1322
1323         usb_kill_urb(acm->ctrlurb);
1324         for (i = 0; i < ACM_NW; i++)
1325                 usb_kill_urb(acm->wb[i].urb);
1326         for (i = 0; i < acm->rx_buflimit; i++)
1327                 usb_kill_urb(acm->read_urbs[i]);
1328
1329         cancel_work_sync(&acm->work);
1330 }
1331
1332 static void acm_disconnect(struct usb_interface *intf)
1333 {
1334         struct acm *acm = usb_get_intfdata(intf);
1335         struct usb_device *usb_dev = interface_to_usbdev(intf);
1336         struct tty_struct *tty;
1337
1338         /* sibling interface is already cleaning up */
1339         if (!acm)
1340                 return;
1341
1342         mutex_lock(&open_mutex);
1343         if (acm->country_codes) {
1344                 device_remove_file(&acm->control->dev,
1345                                 &dev_attr_wCountryCodes);
1346                 device_remove_file(&acm->control->dev,
1347                                 &dev_attr_iCountryCodeRelDate);
1348         }
1349         device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
1350         acm->dev = NULL;
1351         usb_set_intfdata(acm->control, NULL);
1352         usb_set_intfdata(acm->data, NULL);
1353
1354         stop_data_traffic(acm);
1355
1356         acm_write_buffers_free(acm);
1357         usb_free_coherent(usb_dev, acm->ctrlsize, acm->ctrl_buffer,
1358                           acm->ctrl_dma);
1359         acm_read_buffers_free(acm);
1360
1361         if (!acm->combined_interfaces)
1362                 usb_driver_release_interface(&acm_driver, intf == acm->control ?
1363                                         acm->data : acm->control);
1364
1365         if (acm->port.count == 0) {
1366                 acm_tty_unregister(acm);
1367                 mutex_unlock(&open_mutex);
1368                 return;
1369         }
1370
1371         mutex_unlock(&open_mutex);
1372         tty = tty_port_tty_get(&acm->port);
1373         if (tty) {
1374                 tty_hangup(tty);
1375                 tty_kref_put(tty);
1376         }
1377 }
1378
1379 #ifdef CONFIG_PM
1380 static int acm_suspend(struct usb_interface *intf, pm_message_t message)
1381 {
1382         struct acm *acm = usb_get_intfdata(intf);
1383         int cnt;
1384
1385         spin_lock_irq(&acm->read_lock);
1386         spin_lock(&acm->write_lock);
1387         if (PMSG_IS_AUTO(message)) {
1388                 if (acm->transmitting) {
1389                         spin_unlock(&acm->write_lock);
1390                         spin_unlock_irq(&acm->read_lock);
1391                         return -EBUSY;
1392                 }
1393         }
1394         cnt = acm->susp_count++;
1395         spin_unlock(&acm->write_lock);
1396         spin_unlock_irq(&acm->read_lock);
1397
1398         if (cnt)
1399                 return 0;
1400         /*
1401         we treat opened interfaces differently,
1402         we must guard against open
1403         */
1404         mutex_lock(&acm->mutex);
1405
1406         if (acm->port.count)
1407                 stop_data_traffic(acm);
1408
1409         mutex_unlock(&acm->mutex);
1410         return 0;
1411 }
1412
1413 static int acm_resume(struct usb_interface *intf)
1414 {
1415         struct acm *acm = usb_get_intfdata(intf);
1416         struct urb *urb;
1417         int rv = 0;
1418
1419         mutex_lock(&acm->mutex);
1420         spin_lock_irq(&acm->read_lock);
1421         spin_lock(&acm->write_lock);
1422
1423         if (--acm->susp_count)
1424                 goto out;
1425
1426         if (acm->port.count) {
1427                 rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
1428
1429                 for (;;) {
1430                         urb = usb_get_from_anchor(&acm->delayed);
1431                         if (!urb)
1432                                 break;
1433
1434                         acm_start_wb(acm, urb->context);
1435                 }
1436
1437                 /*
1438                  * delayed error checking because we must
1439                  * do the write path at all cost
1440                  */
1441                 if (rv < 0)
1442                         goto out;
1443
1444                 rv = acm_submit_read_urbs(acm, GFP_ATOMIC);
1445         }
1446 out:
1447         spin_unlock(&acm->write_lock);
1448         spin_unlock_irq(&acm->read_lock);
1449         mutex_unlock(&acm->mutex);
1450
1451         return rv;
1452 }
1453
1454 static int acm_reset_resume(struct usb_interface *intf)
1455 {
1456         struct acm *acm = usb_get_intfdata(intf);
1457         struct tty_struct *tty;
1458
1459         mutex_lock(&acm->mutex);
1460         if (acm->port.count) {
1461                 tty = tty_port_tty_get(&acm->port);
1462                 if (tty) {
1463                         tty_hangup(tty);
1464                         tty_kref_put(tty);
1465                 }
1466         }
1467         mutex_unlock(&acm->mutex);
1468         return acm_resume(intf);
1469 }
1470
1471 #endif /* CONFIG_PM */
1472
1473 #define NOKIA_PCSUITE_ACM_INFO(x) \
1474                 USB_DEVICE_AND_INTERFACE_INFO(0x0421, x, \
1475                 USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, \
1476                 USB_CDC_ACM_PROTO_VENDOR)
1477
1478 #define SAMSUNG_PCSUITE_ACM_INFO(x) \
1479                 USB_DEVICE_AND_INTERFACE_INFO(0x04e7, x, \
1480                 USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, \
1481                 USB_CDC_ACM_PROTO_VENDOR)
1482
1483 /*
1484  * USB driver structure.
1485  */
1486
1487 static const struct usb_device_id acm_ids[] = {
1488         /* quirky and broken devices */
1489         { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
1490         .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
1491         { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
1492         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1493         },
1494         { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
1495         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1496         },
1497         { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */
1498         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1499         },
1500         { USB_DEVICE(0x0482, 0x0203), /* KYOCERA AH-K3001V */
1501         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1502         },
1503         { USB_DEVICE(0x079b, 0x000f), /* BT On-Air USB MODEM */
1504         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1505         },
1506         { USB_DEVICE(0x0ace, 0x1602), /* ZyDAS 56K USB MODEM */
1507         .driver_info = SINGLE_RX_URB,
1508         },
1509         { USB_DEVICE(0x0ace, 0x1608), /* ZyDAS 56K USB MODEM */
1510         .driver_info = SINGLE_RX_URB, /* firmware bug */
1511         },
1512         { USB_DEVICE(0x0ace, 0x1611), /* ZyDAS 56K USB MODEM - new version */
1513         .driver_info = SINGLE_RX_URB, /* firmware bug */
1514         },
1515         { USB_DEVICE(0x22b8, 0x7000), /* Motorola Q Phone */
1516         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1517         },
1518         { USB_DEVICE(0x0803, 0x3095), /* Zoom Telephonics Model 3095F USB MODEM */
1519         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1520         },
1521         { USB_DEVICE(0x0572, 0x1321), /* Conexant USB MODEM CX93010 */
1522         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1523         },
1524         { USB_DEVICE(0x0572, 0x1324), /* Conexant USB MODEM RD02-D400 */
1525         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1526         },
1527         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
1528         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1529         },
1530         { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
1531         { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
1532         },
1533         /* Motorola H24 HSPA module: */
1534         { USB_DEVICE(0x22b8, 0x2d91) }, /* modem                                */
1535         { USB_DEVICE(0x22b8, 0x2d92),   /* modem           + diagnostics        */
1536         .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
1537         },
1538         { USB_DEVICE(0x22b8, 0x2d93),   /* modem + AT port                      */
1539         .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
1540         },
1541         { USB_DEVICE(0x22b8, 0x2d95),   /* modem + AT port + diagnostics        */
1542         .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
1543         },
1544         { USB_DEVICE(0x22b8, 0x2d96),   /* modem                         + NMEA */
1545         .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
1546         },
1547         { USB_DEVICE(0x22b8, 0x2d97),   /* modem           + diagnostics + NMEA */
1548         .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
1549         },
1550         { USB_DEVICE(0x22b8, 0x2d99),   /* modem + AT port               + NMEA */
1551         .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
1552         },
1553         { USB_DEVICE(0x22b8, 0x2d9a),   /* modem + AT port + diagnostics + NMEA */
1554         .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
1555         },
1556
1557         { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
1558         .driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
1559                                            data interface instead of
1560                                            communications interface.
1561                                            Maybe we should define a new
1562                                            quirk for this. */
1563         },
1564         { USB_DEVICE(0x0572, 0x1340), /* Conexant CX93010-2x UCMxx */
1565         .driver_info = NO_UNION_NORMAL,
1566         },
1567         { USB_DEVICE(0x05f9, 0x4002), /* PSC Scanning, Magellan 800i */
1568         .driver_info = NO_UNION_NORMAL,
1569         },
1570         { USB_DEVICE(0x1bbb, 0x0003), /* Alcatel OT-I650 */
1571         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
1572         },
1573         { USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
1574         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
1575         },
1576
1577         /* Nokia S60 phones expose two ACM channels. The first is
1578          * a modem and is picked up by the standard AT-command
1579          * information below. The second is 'vendor-specific' but
1580          * is treated as a serial device at the S60 end, so we want
1581          * to expose it on Linux too. */
1582         { NOKIA_PCSUITE_ACM_INFO(0x042D), }, /* Nokia 3250 */
1583         { NOKIA_PCSUITE_ACM_INFO(0x04D8), }, /* Nokia 5500 Sport */
1584         { NOKIA_PCSUITE_ACM_INFO(0x04C9), }, /* Nokia E50 */
1585         { NOKIA_PCSUITE_ACM_INFO(0x0419), }, /* Nokia E60 */
1586         { NOKIA_PCSUITE_ACM_INFO(0x044D), }, /* Nokia E61 */
1587         { NOKIA_PCSUITE_ACM_INFO(0x0001), }, /* Nokia E61i */
1588         { NOKIA_PCSUITE_ACM_INFO(0x0475), }, /* Nokia E62 */
1589         { NOKIA_PCSUITE_ACM_INFO(0x0508), }, /* Nokia E65 */
1590         { NOKIA_PCSUITE_ACM_INFO(0x0418), }, /* Nokia E70 */
1591         { NOKIA_PCSUITE_ACM_INFO(0x0425), }, /* Nokia N71 */
1592         { NOKIA_PCSUITE_ACM_INFO(0x0486), }, /* Nokia N73 */
1593         { NOKIA_PCSUITE_ACM_INFO(0x04DF), }, /* Nokia N75 */
1594         { NOKIA_PCSUITE_ACM_INFO(0x000e), }, /* Nokia N77 */
1595         { NOKIA_PCSUITE_ACM_INFO(0x0445), }, /* Nokia N80 */
1596         { NOKIA_PCSUITE_ACM_INFO(0x042F), }, /* Nokia N91 & N91 8GB */
1597         { NOKIA_PCSUITE_ACM_INFO(0x048E), }, /* Nokia N92 */
1598         { NOKIA_PCSUITE_ACM_INFO(0x0420), }, /* Nokia N93 */
1599         { NOKIA_PCSUITE_ACM_INFO(0x04E6), }, /* Nokia N93i  */
1600         { NOKIA_PCSUITE_ACM_INFO(0x04B2), }, /* Nokia 5700 XpressMusic */
1601         { NOKIA_PCSUITE_ACM_INFO(0x0134), }, /* Nokia 6110 Navigator (China) */
1602         { NOKIA_PCSUITE_ACM_INFO(0x046E), }, /* Nokia 6110 Navigator */
1603         { NOKIA_PCSUITE_ACM_INFO(0x002f), }, /* Nokia 6120 classic &  */
1604         { NOKIA_PCSUITE_ACM_INFO(0x0088), }, /* Nokia 6121 classic */
1605         { NOKIA_PCSUITE_ACM_INFO(0x00fc), }, /* Nokia 6124 classic */
1606         { NOKIA_PCSUITE_ACM_INFO(0x0042), }, /* Nokia E51 */
1607         { NOKIA_PCSUITE_ACM_INFO(0x00b0), }, /* Nokia E66 */
1608         { NOKIA_PCSUITE_ACM_INFO(0x00ab), }, /* Nokia E71 */
1609         { NOKIA_PCSUITE_ACM_INFO(0x0481), }, /* Nokia N76 */
1610         { NOKIA_PCSUITE_ACM_INFO(0x0007), }, /* Nokia N81 & N81 8GB */
1611         { NOKIA_PCSUITE_ACM_INFO(0x0071), }, /* Nokia N82 */
1612         { NOKIA_PCSUITE_ACM_INFO(0x04F0), }, /* Nokia N95 & N95-3 NAM */
1613         { NOKIA_PCSUITE_ACM_INFO(0x0070), }, /* Nokia N95 8GB  */
1614         { NOKIA_PCSUITE_ACM_INFO(0x00e9), }, /* Nokia 5320 XpressMusic */
1615         { NOKIA_PCSUITE_ACM_INFO(0x0099), }, /* Nokia 6210 Navigator, RM-367 */
1616         { NOKIA_PCSUITE_ACM_INFO(0x0128), }, /* Nokia 6210 Navigator, RM-419 */
1617         { NOKIA_PCSUITE_ACM_INFO(0x008f), }, /* Nokia 6220 Classic */
1618         { NOKIA_PCSUITE_ACM_INFO(0x00a0), }, /* Nokia 6650 */
1619         { NOKIA_PCSUITE_ACM_INFO(0x007b), }, /* Nokia N78 */
1620         { NOKIA_PCSUITE_ACM_INFO(0x0094), }, /* Nokia N85 */
1621         { NOKIA_PCSUITE_ACM_INFO(0x003a), }, /* Nokia N96 & N96-3  */
1622         { NOKIA_PCSUITE_ACM_INFO(0x00e9), }, /* Nokia 5320 XpressMusic */
1623         { NOKIA_PCSUITE_ACM_INFO(0x0108), }, /* Nokia 5320 XpressMusic 2G */
1624         { NOKIA_PCSUITE_ACM_INFO(0x01f5), }, /* Nokia N97, RM-505 */
1625         { NOKIA_PCSUITE_ACM_INFO(0x02e3), }, /* Nokia 5230, RM-588 */
1626         { NOKIA_PCSUITE_ACM_INFO(0x0178), }, /* Nokia E63 */
1627         { NOKIA_PCSUITE_ACM_INFO(0x010e), }, /* Nokia E75 */
1628         { NOKIA_PCSUITE_ACM_INFO(0x02d9), }, /* Nokia 6760 Slide */
1629         { NOKIA_PCSUITE_ACM_INFO(0x01d0), }, /* Nokia E52 */
1630         { NOKIA_PCSUITE_ACM_INFO(0x0223), }, /* Nokia E72 */
1631         { NOKIA_PCSUITE_ACM_INFO(0x0275), }, /* Nokia X6 */
1632         { NOKIA_PCSUITE_ACM_INFO(0x026c), }, /* Nokia N97 Mini */
1633         { NOKIA_PCSUITE_ACM_INFO(0x0154), }, /* Nokia 5800 XpressMusic */
1634         { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
1635         { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
1636         { NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
1637         { NOKIA_PCSUITE_ACM_INFO(0x0335), }, /* Nokia E7 */
1638         { NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */
1639         { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
1640
1641         /* Support for Owen devices */
1642         { USB_DEVICE(0x03eb, 0x0030), }, /* Owen SI30 */
1643
1644         /* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
1645
1646         /* Support Lego NXT using pbLua firmware */
1647         { USB_DEVICE(0x0694, 0xff00),
1648         .driver_info = NOT_A_MODEM,
1649         },
1650
1651         /* Support for Droids MuIn LCD */
1652         { USB_DEVICE(0x04d8, 0x000b),
1653         .driver_info = NO_DATA_INTERFACE,
1654         },
1655
1656         /* control interfaces without any protocol set */
1657         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1658                 USB_CDC_PROTO_NONE) },
1659
1660         /* control interfaces with various AT-command sets */
1661         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1662                 USB_CDC_ACM_PROTO_AT_V25TER) },
1663         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1664                 USB_CDC_ACM_PROTO_AT_PCCA101) },
1665         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1666                 USB_CDC_ACM_PROTO_AT_PCCA101_WAKE) },
1667         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1668                 USB_CDC_ACM_PROTO_AT_GSM) },
1669         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1670                 USB_CDC_ACM_PROTO_AT_3G) },
1671         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1672                 USB_CDC_ACM_PROTO_AT_CDMA) },
1673
1674         { }
1675 };
1676
1677 MODULE_DEVICE_TABLE(usb, acm_ids);
1678
1679 static struct usb_driver acm_driver = {
1680         .name =         "cdc_acm",
1681         .probe =        acm_probe,
1682         .disconnect =   acm_disconnect,
1683 #ifdef CONFIG_PM
1684         .suspend =      acm_suspend,
1685         .resume =       acm_resume,
1686         .reset_resume = acm_reset_resume,
1687 #endif
1688         .id_table =     acm_ids,
1689 #ifdef CONFIG_PM
1690         .supports_autosuspend = 1,
1691 #endif
1692 };
1693
1694 /*
1695  * TTY driver structures.
1696  */
1697
1698 static const struct tty_operations acm_ops = {
1699         .open =                 acm_tty_open,
1700         .close =                acm_tty_close,
1701         .hangup =               acm_tty_hangup,
1702         .write =                acm_tty_write,
1703         .write_room =           acm_tty_write_room,
1704         .ioctl =                acm_tty_ioctl,
1705         .throttle =             acm_tty_throttle,
1706         .unthrottle =           acm_tty_unthrottle,
1707         .chars_in_buffer =      acm_tty_chars_in_buffer,
1708         .break_ctl =            acm_tty_break_ctl,
1709         .set_termios =          acm_tty_set_termios,
1710         .tiocmget =             acm_tty_tiocmget,
1711         .tiocmset =             acm_tty_tiocmset,
1712 };
1713
1714 /*
1715  * Init / exit.
1716  */
1717
1718 static int __init acm_init(void)
1719 {
1720         int retval;
1721         acm_tty_driver = alloc_tty_driver(ACM_TTY_MINORS);
1722         if (!acm_tty_driver)
1723                 return -ENOMEM;
1724         acm_tty_driver->owner = THIS_MODULE,
1725         acm_tty_driver->driver_name = "acm",
1726         acm_tty_driver->name = "ttyACM",
1727         acm_tty_driver->major = ACM_TTY_MAJOR,
1728         acm_tty_driver->minor_start = 0,
1729         acm_tty_driver->type = TTY_DRIVER_TYPE_SERIAL,
1730         acm_tty_driver->subtype = SERIAL_TYPE_NORMAL,
1731         acm_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1732         acm_tty_driver->init_termios = tty_std_termios;
1733         acm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD |
1734                                                                 HUPCL | CLOCAL;
1735         tty_set_operations(acm_tty_driver, &acm_ops);
1736
1737         retval = tty_register_driver(acm_tty_driver);
1738         if (retval) {
1739                 put_tty_driver(acm_tty_driver);
1740                 return retval;
1741         }
1742
1743         retval = usb_register(&acm_driver);
1744         if (retval) {
1745                 tty_unregister_driver(acm_tty_driver);
1746                 put_tty_driver(acm_tty_driver);
1747                 return retval;
1748         }
1749
1750         printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_DESC "\n");
1751
1752         return 0;
1753 }
1754
1755 static void __exit acm_exit(void)
1756 {
1757         usb_deregister(&acm_driver);
1758         tty_unregister_driver(acm_tty_driver);
1759         put_tty_driver(acm_tty_driver);
1760 }
1761
1762 module_init(acm_init);
1763 module_exit(acm_exit);
1764
1765 MODULE_AUTHOR(DRIVER_AUTHOR);
1766 MODULE_DESCRIPTION(DRIVER_DESC);
1767 MODULE_LICENSE("GPL");
1768 MODULE_ALIAS_CHARDEV_MAJOR(ACM_TTY_MAJOR);