USB: serial: cyberjack: fix NULL-deref at open
[pandora-kernel.git] / drivers / usb / serial / ch341.c
1 /*
2  * Copyright 2007, Frank A Kingswood <frank@kingswood-consulting.co.uk>
3  * Copyright 2007, Werner Cornelius <werner@cornelius-consult.de>
4  * Copyright 2009, Boris Hajduk <boris@hajduk.org>
5  *
6  * ch341.c implements a serial port driver for the Winchiphead CH341.
7  *
8  * The CH341 device can be used to implement an RS232 asynchronous
9  * serial port, an IEEE-1284 parallel printer port or a memory-like
10  * interface. In all cases the CH341 supports an I2C interface as well.
11  * This driver only supports the asynchronous serial interface.
12  *
13  * This program is free software; you can redistribute it and/or
14  * modify it under the terms of the GNU General Public License version
15  * 2 as published by the Free Software Foundation.
16  */
17
18 #include <linux/kernel.h>
19 #include <linux/init.h>
20 #include <linux/tty.h>
21 #include <linux/module.h>
22 #include <linux/slab.h>
23 #include <linux/usb.h>
24 #include <linux/usb/serial.h>
25 #include <linux/serial.h>
26 #include <asm/unaligned.h>
27
28 #define DEFAULT_BAUD_RATE 9600
29 #define DEFAULT_TIMEOUT   1000
30
31 /* flags for IO-Bits */
32 #define CH341_BIT_RTS (1 << 6)
33 #define CH341_BIT_DTR (1 << 5)
34
35 /******************************/
36 /* interrupt pipe definitions */
37 /******************************/
38 /* always 4 interrupt bytes */
39 /* first irq byte normally 0x08 */
40 /* second irq byte base 0x7d + below */
41 /* third irq byte base 0x94 + below */
42 /* fourth irq byte normally 0xee */
43
44 /* second interrupt byte */
45 #define CH341_MULT_STAT 0x04 /* multiple status since last interrupt event */
46
47 /* status returned in third interrupt answer byte, inverted in data
48    from irq */
49 #define CH341_BIT_CTS 0x01
50 #define CH341_BIT_DSR 0x02
51 #define CH341_BIT_RI  0x04
52 #define CH341_BIT_DCD 0x08
53 #define CH341_BITS_MODEM_STAT 0x0f /* all bits */
54
55 /*******************************/
56 /* baudrate calculation factor */
57 /*******************************/
58 #define CH341_BAUDBASE_FACTOR 1532620800
59 #define CH341_BAUDBASE_DIVMAX 3
60
61 /* Break support - the information used to implement this was gleaned from
62  * the Net/FreeBSD uchcom.c driver by Takanori Watanabe.  Domo arigato.
63  */
64
65 #define CH341_REQ_WRITE_REG    0x9A
66 #define CH341_REQ_READ_REG     0x95
67 #define CH341_REG_BREAK1       0x05
68 #define CH341_REG_BREAK2       0x18
69 #define CH341_NBREAK_BITS_REG1 0x01
70 #define CH341_NBREAK_BITS_REG2 0x40
71
72
73 static int debug;
74
75 static const struct usb_device_id id_table[] = {
76         { USB_DEVICE(0x4348, 0x5523) },
77         { USB_DEVICE(0x1a86, 0x7523) },
78         { USB_DEVICE(0x1a86, 0x5523) },
79         { },
80 };
81 MODULE_DEVICE_TABLE(usb, id_table);
82
83 struct ch341_private {
84         spinlock_t lock; /* access lock */
85         unsigned baud_rate; /* set baud rate */
86         u8 line_control; /* set line control value RTS/DTR */
87         u8 line_status; /* active status of modem control inputs */
88         u8 multi_status_change; /* status changed multiple since last call */
89 };
90
91 static int ch341_control_out(struct usb_device *dev, u8 request,
92                              u16 value, u16 index)
93 {
94         int r;
95         dbg("ch341_control_out(%02x,%02x,%04x,%04x)", USB_DIR_OUT|0x40,
96                 (int)request, (int)value, (int)index);
97
98         r = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), request,
99                             USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
100                             value, index, NULL, 0, DEFAULT_TIMEOUT);
101
102         return r;
103 }
104
105 static int ch341_control_in(struct usb_device *dev,
106                             u8 request, u16 value, u16 index,
107                             char *buf, unsigned bufsize)
108 {
109         int r;
110         dbg("ch341_control_in(%02x,%02x,%04x,%04x,%p,%u)", USB_DIR_IN|0x40,
111                 (int)request, (int)value, (int)index, buf, (int)bufsize);
112
113         r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request,
114                             USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
115                             value, index, buf, bufsize, DEFAULT_TIMEOUT);
116         return r;
117 }
118
119 static int ch341_set_baudrate(struct usb_device *dev,
120                               struct ch341_private *priv)
121 {
122         short a, b;
123         int r;
124         unsigned long factor;
125         short divisor;
126
127         dbg("ch341_set_baudrate(%d)", priv->baud_rate);
128
129         if (!priv->baud_rate)
130                 return -EINVAL;
131         factor = (CH341_BAUDBASE_FACTOR / priv->baud_rate);
132         divisor = CH341_BAUDBASE_DIVMAX;
133
134         while ((factor > 0xfff0) && divisor) {
135                 factor >>= 3;
136                 divisor--;
137         }
138
139         if (factor > 0xfff0)
140                 return -EINVAL;
141
142         factor = 0x10000 - factor;
143         a = (factor & 0xff00) | divisor;
144         b = factor & 0xff;
145
146         r = ch341_control_out(dev, 0x9a, 0x1312, a);
147         if (!r)
148                 r = ch341_control_out(dev, 0x9a, 0x0f2c, b);
149
150         return r;
151 }
152
153 static int ch341_set_handshake(struct usb_device *dev, u8 control)
154 {
155         dbg("ch341_set_handshake(0x%02x)", control);
156         return ch341_control_out(dev, 0xa4, ~control, 0);
157 }
158
159 static int ch341_get_status(struct usb_device *dev, struct ch341_private *priv)
160 {
161         char *buffer;
162         int r;
163         const unsigned size = 8;
164         unsigned long flags;
165
166         dbg("ch341_get_status()");
167
168         buffer = kmalloc(size, GFP_KERNEL);
169         if (!buffer)
170                 return -ENOMEM;
171
172         r = ch341_control_in(dev, 0x95, 0x0706, 0, buffer, size);
173         if (r < 0)
174                 goto out;
175
176         /* setup the private status if available */
177         if (r == 2) {
178                 r = 0;
179                 spin_lock_irqsave(&priv->lock, flags);
180                 priv->line_status = (~(*buffer)) & CH341_BITS_MODEM_STAT;
181                 priv->multi_status_change = 0;
182                 spin_unlock_irqrestore(&priv->lock, flags);
183         } else
184                 r = -EPROTO;
185
186 out:    kfree(buffer);
187         return r;
188 }
189
190 /* -------------------------------------------------------------------------- */
191
192 static int ch341_configure(struct usb_device *dev, struct ch341_private *priv)
193 {
194         char *buffer;
195         int r;
196         const unsigned size = 8;
197
198         dbg("ch341_configure()");
199
200         buffer = kmalloc(size, GFP_KERNEL);
201         if (!buffer)
202                 return -ENOMEM;
203
204         /* expect two bytes 0x27 0x00 */
205         r = ch341_control_in(dev, 0x5f, 0, 0, buffer, size);
206         if (r < 0)
207                 goto out;
208
209         r = ch341_control_out(dev, 0xa1, 0, 0);
210         if (r < 0)
211                 goto out;
212
213         r = ch341_set_baudrate(dev, priv);
214         if (r < 0)
215                 goto out;
216
217         /* expect two bytes 0x56 0x00 */
218         r = ch341_control_in(dev, 0x95, 0x2518, 0, buffer, size);
219         if (r < 0)
220                 goto out;
221
222         r = ch341_control_out(dev, 0x9a, 0x2518, 0x0050);
223         if (r < 0)
224                 goto out;
225
226         /* expect 0xff 0xee */
227         r = ch341_get_status(dev, priv);
228         if (r < 0)
229                 goto out;
230
231         r = ch341_control_out(dev, 0xa1, 0x501f, 0xd90a);
232         if (r < 0)
233                 goto out;
234
235         r = ch341_set_baudrate(dev, priv);
236         if (r < 0)
237                 goto out;
238
239         r = ch341_set_handshake(dev, priv->line_control);
240         if (r < 0)
241                 goto out;
242
243         /* expect 0x9f 0xee */
244         r = ch341_get_status(dev, priv);
245
246 out:    kfree(buffer);
247         return r;
248 }
249
250 /* allocate private data */
251 static int ch341_attach(struct usb_serial *serial)
252 {
253         struct ch341_private *priv;
254         int r;
255
256         dbg("ch341_attach()");
257
258         /* private data */
259         priv = kzalloc(sizeof(struct ch341_private), GFP_KERNEL);
260         if (!priv)
261                 return -ENOMEM;
262
263         spin_lock_init(&priv->lock);
264         priv->baud_rate = DEFAULT_BAUD_RATE;
265         priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
266
267         r = ch341_configure(serial->dev, priv);
268         if (r < 0)
269                 goto error;
270
271         usb_set_serial_port_data(serial->port[0], priv);
272         return 0;
273
274 error:  kfree(priv);
275         return r;
276 }
277
278 static int ch341_carrier_raised(struct usb_serial_port *port)
279 {
280         struct ch341_private *priv = usb_get_serial_port_data(port);
281         if (priv->line_status & CH341_BIT_DCD)
282                 return 1;
283         return 0;
284 }
285
286 static void ch341_dtr_rts(struct usb_serial_port *port, int on)
287 {
288         struct ch341_private *priv = usb_get_serial_port_data(port);
289         unsigned long flags;
290
291         dbg("%s - port %d", __func__, port->number);
292         /* drop DTR and RTS */
293         spin_lock_irqsave(&priv->lock, flags);
294         if (on)
295                 priv->line_control |= CH341_BIT_RTS | CH341_BIT_DTR;
296         else
297                 priv->line_control &= ~(CH341_BIT_RTS | CH341_BIT_DTR);
298         spin_unlock_irqrestore(&priv->lock, flags);
299         ch341_set_handshake(port->serial->dev, priv->line_control);
300         wake_up_interruptible(&port->delta_msr_wait);
301 }
302
303 static void ch341_close(struct usb_serial_port *port)
304 {
305         dbg("%s - port %d", __func__, port->number);
306
307         usb_serial_generic_close(port);
308         usb_kill_urb(port->interrupt_in_urb);
309 }
310
311
312 /* open this device, set default parameters */
313 static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port)
314 {
315         struct usb_serial *serial = port->serial;
316         struct ch341_private *priv = usb_get_serial_port_data(serial->port[0]);
317         int r;
318
319         dbg("ch341_open()");
320
321         priv->baud_rate = DEFAULT_BAUD_RATE;
322
323         r = ch341_configure(serial->dev, priv);
324         if (r)
325                 goto out;
326
327         r = ch341_set_handshake(serial->dev, priv->line_control);
328         if (r)
329                 goto out;
330
331         r = ch341_set_baudrate(serial->dev, priv);
332         if (r)
333                 goto out;
334
335         dbg("%s - submitting interrupt urb", __func__);
336         port->interrupt_in_urb->dev = serial->dev;
337         r = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
338         if (r) {
339                 dev_err(&port->dev, "%s - failed submitting interrupt urb,"
340                         " error %d\n", __func__, r);
341                 ch341_close(port);
342                 return -EPROTO;
343         }
344
345         r = usb_serial_generic_open(tty, port);
346
347 out:    return r;
348 }
349
350 /* Old_termios contains the original termios settings and
351  * tty->termios contains the new setting to be used.
352  */
353 static void ch341_set_termios(struct tty_struct *tty,
354                 struct usb_serial_port *port, struct ktermios *old_termios)
355 {
356         struct ch341_private *priv = usb_get_serial_port_data(port);
357         unsigned baud_rate;
358         unsigned long flags;
359
360         dbg("ch341_set_termios()");
361
362         baud_rate = tty_get_baud_rate(tty);
363
364         priv->baud_rate = baud_rate;
365
366         if (baud_rate) {
367                 spin_lock_irqsave(&priv->lock, flags);
368                 priv->line_control |= (CH341_BIT_DTR | CH341_BIT_RTS);
369                 spin_unlock_irqrestore(&priv->lock, flags);
370                 ch341_set_baudrate(port->serial->dev, priv);
371         } else {
372                 spin_lock_irqsave(&priv->lock, flags);
373                 priv->line_control &= ~(CH341_BIT_DTR | CH341_BIT_RTS);
374                 spin_unlock_irqrestore(&priv->lock, flags);
375         }
376
377         ch341_set_handshake(port->serial->dev, priv->line_control);
378
379         /* Unimplemented:
380          * (cflag & CSIZE) : data bits [5, 8]
381          * (cflag & PARENB) : parity {NONE, EVEN, ODD}
382          * (cflag & CSTOPB) : stop bits [1, 2]
383          */
384 }
385
386 static void ch341_break_ctl(struct tty_struct *tty, int break_state)
387 {
388         const uint16_t ch341_break_reg =
389                 CH341_REG_BREAK1 | ((uint16_t) CH341_REG_BREAK2 << 8);
390         struct usb_serial_port *port = tty->driver_data;
391         int r;
392         uint16_t reg_contents;
393         uint8_t *break_reg;
394
395         dbg("%s()", __func__);
396
397         break_reg = kmalloc(2, GFP_KERNEL);
398         if (!break_reg) {
399                 dev_err(&port->dev, "%s - kmalloc failed\n", __func__);
400                 return;
401         }
402
403         r = ch341_control_in(port->serial->dev, CH341_REQ_READ_REG,
404                         ch341_break_reg, 0, break_reg, 2);
405         if (r < 0) {
406                 dev_err(&port->dev, "%s - USB control read error (%d)\n",
407                                 __func__, r);
408                 goto out;
409         }
410         dbg("%s - initial ch341 break register contents - reg1: %x, reg2: %x",
411                         __func__, break_reg[0], break_reg[1]);
412         if (break_state != 0) {
413                 dbg("%s - Enter break state requested", __func__);
414                 break_reg[0] &= ~CH341_NBREAK_BITS_REG1;
415                 break_reg[1] &= ~CH341_NBREAK_BITS_REG2;
416         } else {
417                 dbg("%s - Leave break state requested", __func__);
418                 break_reg[0] |= CH341_NBREAK_BITS_REG1;
419                 break_reg[1] |= CH341_NBREAK_BITS_REG2;
420         }
421         dbg("%s - New ch341 break register contents - reg1: %x, reg2: %x",
422                         __func__, break_reg[0], break_reg[1]);
423         reg_contents = get_unaligned_le16(break_reg);
424         r = ch341_control_out(port->serial->dev, CH341_REQ_WRITE_REG,
425                         ch341_break_reg, reg_contents);
426         if (r < 0)
427                 dev_err(&port->dev, "%s - USB control write error (%d)\n",
428                                 __func__, r);
429 out:
430         kfree(break_reg);
431 }
432
433 static int ch341_tiocmset(struct tty_struct *tty,
434                           unsigned int set, unsigned int clear)
435 {
436         struct usb_serial_port *port = tty->driver_data;
437         struct ch341_private *priv = usb_get_serial_port_data(port);
438         unsigned long flags;
439         u8 control;
440
441         spin_lock_irqsave(&priv->lock, flags);
442         if (set & TIOCM_RTS)
443                 priv->line_control |= CH341_BIT_RTS;
444         if (set & TIOCM_DTR)
445                 priv->line_control |= CH341_BIT_DTR;
446         if (clear & TIOCM_RTS)
447                 priv->line_control &= ~CH341_BIT_RTS;
448         if (clear & TIOCM_DTR)
449                 priv->line_control &= ~CH341_BIT_DTR;
450         control = priv->line_control;
451         spin_unlock_irqrestore(&priv->lock, flags);
452
453         return ch341_set_handshake(port->serial->dev, control);
454 }
455
456 static void ch341_read_int_callback(struct urb *urb)
457 {
458         struct usb_serial_port *port = (struct usb_serial_port *) urb->context;
459         unsigned char *data = urb->transfer_buffer;
460         unsigned int actual_length = urb->actual_length;
461         int status;
462
463         dbg("%s (%d)", __func__, port->number);
464
465         switch (urb->status) {
466         case 0:
467                 /* success */
468                 break;
469         case -ECONNRESET:
470         case -ENOENT:
471         case -ESHUTDOWN:
472                 /* this urb is terminated, clean up */
473                 dbg("%s - urb shutting down with status: %d", __func__,
474                     urb->status);
475                 return;
476         default:
477                 dbg("%s - nonzero urb status received: %d", __func__,
478                     urb->status);
479                 goto exit;
480         }
481
482         usb_serial_debug_data(debug, &port->dev, __func__,
483                               urb->actual_length, urb->transfer_buffer);
484
485         if (actual_length >= 4) {
486                 struct ch341_private *priv = usb_get_serial_port_data(port);
487                 unsigned long flags;
488                 u8 prev_line_status = priv->line_status;
489
490                 spin_lock_irqsave(&priv->lock, flags);
491                 priv->line_status = (~(data[2])) & CH341_BITS_MODEM_STAT;
492                 if ((data[1] & CH341_MULT_STAT))
493                         priv->multi_status_change = 1;
494                 spin_unlock_irqrestore(&priv->lock, flags);
495
496                 if ((priv->line_status ^ prev_line_status) & CH341_BIT_DCD) {
497                         struct tty_struct *tty = tty_port_tty_get(&port->port);
498                         if (tty)
499                                 usb_serial_handle_dcd_change(port, tty,
500                                             priv->line_status & CH341_BIT_DCD);
501                         tty_kref_put(tty);
502                 }
503
504                 wake_up_interruptible(&port->delta_msr_wait);
505         }
506
507 exit:
508         status = usb_submit_urb(urb, GFP_ATOMIC);
509         if (status)
510                 dev_err(&urb->dev->dev,
511                         "%s - usb_submit_urb failed with result %d\n",
512                         __func__, status);
513 }
514
515 static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
516 {
517         struct ch341_private *priv = usb_get_serial_port_data(port);
518         unsigned long flags;
519         u8 prevstatus;
520         u8 status;
521         u8 changed;
522         u8 multi_change = 0;
523
524         spin_lock_irqsave(&priv->lock, flags);
525         prevstatus = priv->line_status;
526         priv->multi_status_change = 0;
527         spin_unlock_irqrestore(&priv->lock, flags);
528
529         while (!multi_change) {
530                 interruptible_sleep_on(&port->delta_msr_wait);
531                 /* see if a signal did it */
532                 if (signal_pending(current))
533                         return -ERESTARTSYS;
534
535                 if (port->serial->disconnected)
536                         return -EIO;
537
538                 spin_lock_irqsave(&priv->lock, flags);
539                 status = priv->line_status;
540                 multi_change = priv->multi_status_change;
541                 spin_unlock_irqrestore(&priv->lock, flags);
542
543                 changed = prevstatus ^ status;
544
545                 if (((arg & TIOCM_RNG) && (changed & CH341_BIT_RI)) ||
546                     ((arg & TIOCM_DSR) && (changed & CH341_BIT_DSR)) ||
547                     ((arg & TIOCM_CD)  && (changed & CH341_BIT_DCD)) ||
548                     ((arg & TIOCM_CTS) && (changed & CH341_BIT_CTS))) {
549                         return 0;
550                 }
551                 prevstatus = status;
552         }
553
554         return 0;
555 }
556
557 static int ch341_ioctl(struct tty_struct *tty,
558                         unsigned int cmd, unsigned long arg)
559 {
560         struct usb_serial_port *port = tty->driver_data;
561         dbg("%s (%d) cmd = 0x%04x", __func__, port->number, cmd);
562
563         switch (cmd) {
564         case TIOCMIWAIT:
565                 dbg("%s (%d) TIOCMIWAIT", __func__,  port->number);
566                 return wait_modem_info(port, arg);
567
568         default:
569                 dbg("%s not supported = 0x%04x", __func__, cmd);
570                 break;
571         }
572
573         return -ENOIOCTLCMD;
574 }
575
576 static int ch341_tiocmget(struct tty_struct *tty)
577 {
578         struct usb_serial_port *port = tty->driver_data;
579         struct ch341_private *priv = usb_get_serial_port_data(port);
580         unsigned long flags;
581         u8 mcr;
582         u8 status;
583         unsigned int result;
584
585         dbg("%s (%d)", __func__, port->number);
586
587         spin_lock_irqsave(&priv->lock, flags);
588         mcr = priv->line_control;
589         status = priv->line_status;
590         spin_unlock_irqrestore(&priv->lock, flags);
591
592         result = ((mcr & CH341_BIT_DTR)         ? TIOCM_DTR : 0)
593                   | ((mcr & CH341_BIT_RTS)      ? TIOCM_RTS : 0)
594                   | ((status & CH341_BIT_CTS)   ? TIOCM_CTS : 0)
595                   | ((status & CH341_BIT_DSR)   ? TIOCM_DSR : 0)
596                   | ((status & CH341_BIT_RI)    ? TIOCM_RI  : 0)
597                   | ((status & CH341_BIT_DCD)   ? TIOCM_CD  : 0);
598
599         dbg("%s - result = %x", __func__, result);
600
601         return result;
602 }
603
604
605 static int ch341_reset_resume(struct usb_interface *intf)
606 {
607         struct usb_device *dev = interface_to_usbdev(intf);
608         struct usb_serial *serial = NULL;
609         struct ch341_private *priv;
610
611         serial = usb_get_intfdata(intf);
612         priv = usb_get_serial_port_data(serial->port[0]);
613
614         /*reconfigure ch341 serial port after bus-reset*/
615         ch341_configure(dev, priv);
616
617         usb_serial_resume(intf);
618
619         return 0;
620 }
621
622 static struct usb_driver ch341_driver = {
623         .name           = "ch341",
624         .probe          = usb_serial_probe,
625         .disconnect     = usb_serial_disconnect,
626         .suspend        = usb_serial_suspend,
627         .resume         = usb_serial_resume,
628         .reset_resume   = ch341_reset_resume,
629         .id_table       = id_table,
630         .no_dynamic_id  = 1,
631         .supports_autosuspend = 1,
632 };
633
634 static struct usb_serial_driver ch341_device = {
635         .driver = {
636                 .owner  = THIS_MODULE,
637                 .name   = "ch341-uart",
638         },
639         .id_table          = id_table,
640         .usb_driver        = &ch341_driver,
641         .num_ports         = 1,
642         .open              = ch341_open,
643         .dtr_rts           = ch341_dtr_rts,
644         .carrier_raised    = ch341_carrier_raised,
645         .close             = ch341_close,
646         .ioctl             = ch341_ioctl,
647         .set_termios       = ch341_set_termios,
648         .break_ctl         = ch341_break_ctl,
649         .tiocmget          = ch341_tiocmget,
650         .tiocmset          = ch341_tiocmset,
651         .read_int_callback = ch341_read_int_callback,
652         .attach            = ch341_attach,
653 };
654
655 static int __init ch341_init(void)
656 {
657         int retval;
658
659         retval = usb_serial_register(&ch341_device);
660         if (retval)
661                 return retval;
662         retval = usb_register(&ch341_driver);
663         if (retval)
664                 usb_serial_deregister(&ch341_device);
665         return retval;
666 }
667
668 static void __exit ch341_exit(void)
669 {
670         usb_deregister(&ch341_driver);
671         usb_serial_deregister(&ch341_device);
672 }
673
674 module_init(ch341_init);
675 module_exit(ch341_exit);
676 MODULE_LICENSE("GPL");
677
678 module_param(debug, bool, S_IRUGO | S_IWUSR);
679 MODULE_PARM_DESC(debug, "Debug enabled or not");
680
681 /* EOF ch341.c */