[PATCH] USB Serial: fix use-after-free bug in usb-serial core
[pandora-kernel.git] / drivers / usb / serial / usb-serial.c
1 /*
2  * USB Serial Converter driver
3  *
4  * Copyright (C) 1999 - 2005 Greg Kroah-Hartman (greg@kroah.com)
5  * Copyright (C) 2000 Peter Berger (pberger@brimson.com)
6  * Copyright (C) 2000 Al Borchers (borchers@steinerpoint.com)
7  *
8  *      This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License version
10  *      2 as published by the Free Software Foundation.
11  *
12  * This driver was originally based on the ACM driver by Armin Fuerst (which was
13  * based on a driver by Brad Keryan)
14  *
15  * See Documentation/usb/usb-serial.txt for more information on using this driver
16  *
17  */
18
19 #include <linux/config.h>
20 #include <linux/kernel.h>
21 #include <linux/errno.h>
22 #include <linux/init.h>
23 #include <linux/slab.h>
24 #include <linux/tty.h>
25 #include <linux/tty_driver.h>
26 #include <linux/tty_flip.h>
27 #include <linux/module.h>
28 #include <linux/moduleparam.h>
29 #include <linux/spinlock.h>
30 #include <linux/list.h>
31 #include <linux/smp_lock.h>
32 #include <asm/uaccess.h>
33 #include <asm/semaphore.h>
34 #include <linux/usb.h>
35 #include "usb-serial.h"
36 #include "pl2303.h"
37
38 /*
39  * Version Information
40  */
41 #define DRIVER_AUTHOR "Greg Kroah-Hartman, greg@kroah.com, http://www.kroah.com/linux/"
42 #define DRIVER_DESC "USB Serial Driver core"
43
44 /* Driver structure we register with the USB core */
45 static struct usb_driver usb_serial_driver = {
46         .name =         "usbserial",
47         .probe =        usb_serial_probe,
48         .disconnect =   usb_serial_disconnect,
49         .no_dynamic_id =        1,
50 };
51
52 /* There is no MODULE_DEVICE_TABLE for usbserial.c.  Instead
53    the MODULE_DEVICE_TABLE declarations in each serial driver
54    cause the "hotplug" program to pull in whatever module is necessary
55    via modprobe, and modprobe will load usbserial because the serial
56    drivers depend on it.
57 */
58
59 static int debug;
60 static struct usb_serial *serial_table[SERIAL_TTY_MINORS];      /* initially all NULL */
61 static LIST_HEAD(usb_serial_driver_list);
62
63 struct usb_serial *usb_serial_get_by_index(unsigned index)
64 {
65         struct usb_serial *serial = serial_table[index];
66
67         if (serial)
68                 kref_get(&serial->kref);
69         return serial;
70 }
71
72 static struct usb_serial *get_free_serial (struct usb_serial *serial, int num_ports, unsigned int *minor)
73 {
74         unsigned int i, j;
75         int good_spot;
76
77         dbg("%s %d", __FUNCTION__, num_ports);
78
79         *minor = 0;
80         for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
81                 if (serial_table[i])
82                         continue;
83
84                 good_spot = 1;
85                 for (j = 1; j <= num_ports-1; ++j)
86                         if ((i+j >= SERIAL_TTY_MINORS) || (serial_table[i+j])) {
87                                 good_spot = 0;
88                                 i += j;
89                                 break;
90                         }
91                 if (good_spot == 0)
92                         continue;
93
94                 *minor = i;
95                 dbg("%s - minor base = %d", __FUNCTION__, *minor);
96                 for (i = *minor; (i < (*minor + num_ports)) && (i < SERIAL_TTY_MINORS); ++i)
97                         serial_table[i] = serial;
98                 return serial;
99         }
100         return NULL;
101 }
102
103 static void return_serial(struct usb_serial *serial)
104 {
105         int i;
106
107         dbg("%s", __FUNCTION__);
108
109         if (serial == NULL)
110                 return;
111
112         for (i = 0; i < serial->num_ports; ++i) {
113                 serial_table[serial->minor + i] = NULL;
114         }
115 }
116
117 static void destroy_serial(struct kref *kref)
118 {
119         struct usb_serial *serial;
120         struct usb_serial_port *port;
121         int i;
122
123         serial = to_usb_serial(kref);
124
125         dbg("%s - %s", __FUNCTION__, serial->type->description);
126
127         serial->type->shutdown(serial);
128
129         /* return the minor range that this device had */
130         return_serial(serial);
131
132         for (i = 0; i < serial->num_ports; ++i)
133                 serial->port[i]->open_count = 0;
134
135         /* the ports are cleaned up and released in port_release() */
136         for (i = 0; i < serial->num_ports; ++i)
137                 if (serial->port[i]->dev.parent != NULL) {
138                         device_unregister(&serial->port[i]->dev);
139                         serial->port[i] = NULL;
140                 }
141
142         /* If this is a "fake" port, we have to clean it up here, as it will
143          * not get cleaned up in port_release() as it was never registered with
144          * the driver core */
145         if (serial->num_ports < serial->num_port_pointers) {
146                 for (i = serial->num_ports; i < serial->num_port_pointers; ++i) {
147                         port = serial->port[i];
148                         if (!port)
149                                 continue;
150                         usb_kill_urb(port->read_urb);
151                         usb_free_urb(port->read_urb);
152                         usb_kill_urb(port->write_urb);
153                         usb_free_urb(port->write_urb);
154                         usb_kill_urb(port->interrupt_in_urb);
155                         usb_free_urb(port->interrupt_in_urb);
156                         usb_kill_urb(port->interrupt_out_urb);
157                         usb_free_urb(port->interrupt_out_urb);
158                         kfree(port->bulk_in_buffer);
159                         kfree(port->bulk_out_buffer);
160                         kfree(port->interrupt_in_buffer);
161                         kfree(port->interrupt_out_buffer);
162                 }
163         }
164
165         usb_put_dev(serial->dev);
166
167         /* free up any memory that we allocated */
168         kfree (serial);
169 }
170
171 /*****************************************************************************
172  * Driver tty interface functions
173  *****************************************************************************/
174 static int serial_open (struct tty_struct *tty, struct file * filp)
175 {
176         struct usb_serial *serial;
177         struct usb_serial_port *port;
178         unsigned int portNumber;
179         int retval;
180         
181         dbg("%s", __FUNCTION__);
182
183         /* get the serial object associated with this tty pointer */
184         serial = usb_serial_get_by_index(tty->index);
185         if (!serial) {
186                 tty->driver_data = NULL;
187                 return -ENODEV;
188         }
189
190         portNumber = tty->index - serial->minor;
191         port = serial->port[portNumber];
192         if (!port)
193                 return -ENODEV;
194
195         if (down_interruptible(&port->sem))
196                 return -ERESTARTSYS;
197          
198         ++port->open_count;
199
200         if (port->open_count == 1) {
201
202                 /* set up our port structure making the tty driver
203                  * remember our port object, and us it */
204                 tty->driver_data = port;
205                 port->tty = tty;
206
207                 /* lock this module before we call it
208                  * this may fail, which means we must bail out,
209                  * safe because we are called with BKL held */
210                 if (!try_module_get(serial->type->driver.owner)) {
211                         retval = -ENODEV;
212                         goto bailout_kref_put;
213                 }
214
215                 /* only call the device specific open if this 
216                  * is the first time the port is opened */
217                 retval = serial->type->open(port, filp);
218                 if (retval)
219                         goto bailout_module_put;
220         }
221
222         up(&port->sem);
223         return 0;
224
225 bailout_module_put:
226         module_put(serial->type->driver.owner);
227 bailout_kref_put:
228         kref_put(&serial->kref, destroy_serial);
229         port->open_count = 0;
230         up(&port->sem);
231         return retval;
232 }
233
234 static void serial_close(struct tty_struct *tty, struct file * filp)
235 {
236         struct usb_serial_port *port = tty->driver_data;
237
238         if (!port)
239                 return;
240
241         dbg("%s - port %d", __FUNCTION__, port->number);
242
243         down(&port->sem);
244
245         if (port->open_count == 0) {
246                 up(&port->sem);
247                 return;
248         }
249
250         --port->open_count;
251         if (port->open_count == 0) {
252                 /* only call the device specific close if this 
253                  * port is being closed by the last owner */
254                 port->serial->type->close(port, filp);
255
256                 if (port->tty) {
257                         if (port->tty->driver_data)
258                                 port->tty->driver_data = NULL;
259                         port->tty = NULL;
260                 }
261
262                 module_put(port->serial->type->driver.owner);
263         }
264
265         up(&port->sem);
266         kref_put(&port->serial->kref, destroy_serial);
267 }
268
269 static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count)
270 {
271         struct usb_serial_port *port = tty->driver_data;
272         int retval = -EINVAL;
273
274         if (!port)
275                 goto exit;
276
277         dbg("%s - port %d, %d byte(s)", __FUNCTION__, port->number, count);
278
279         if (!port->open_count) {
280                 dbg("%s - port not opened", __FUNCTION__);
281                 goto exit;
282         }
283
284         /* pass on to the driver specific version of this function */
285         retval = port->serial->type->write(port, buf, count);
286
287 exit:
288         return retval;
289 }
290
291 static int serial_write_room (struct tty_struct *tty) 
292 {
293         struct usb_serial_port *port = tty->driver_data;
294         int retval = -EINVAL;
295
296         if (!port)
297                 goto exit;
298
299         dbg("%s - port %d", __FUNCTION__, port->number);
300
301         if (!port->open_count) {
302                 dbg("%s - port not open", __FUNCTION__);
303                 goto exit;
304         }
305
306         /* pass on to the driver specific version of this function */
307         retval = port->serial->type->write_room(port);
308
309 exit:
310         return retval;
311 }
312
313 static int serial_chars_in_buffer (struct tty_struct *tty) 
314 {
315         struct usb_serial_port *port = tty->driver_data;
316         int retval = -EINVAL;
317
318         if (!port)
319                 goto exit;
320
321         dbg("%s = port %d", __FUNCTION__, port->number);
322
323         if (!port->open_count) {
324                 dbg("%s - port not open", __FUNCTION__);
325                 goto exit;
326         }
327
328         /* pass on to the driver specific version of this function */
329         retval = port->serial->type->chars_in_buffer(port);
330
331 exit:
332         return retval;
333 }
334
335 static void serial_throttle (struct tty_struct * tty)
336 {
337         struct usb_serial_port *port = tty->driver_data;
338
339         if (!port)
340                 return;
341
342         dbg("%s - port %d", __FUNCTION__, port->number);
343
344         if (!port->open_count) {
345                 dbg ("%s - port not open", __FUNCTION__);
346                 return;
347         }
348
349         /* pass on to the driver specific version of this function */
350         if (port->serial->type->throttle)
351                 port->serial->type->throttle(port);
352 }
353
354 static void serial_unthrottle (struct tty_struct * tty)
355 {
356         struct usb_serial_port *port = tty->driver_data;
357
358         if (!port)
359                 return;
360
361         dbg("%s - port %d", __FUNCTION__, port->number);
362
363         if (!port->open_count) {
364                 dbg("%s - port not open", __FUNCTION__);
365                 return;
366         }
367
368         /* pass on to the driver specific version of this function */
369         if (port->serial->type->unthrottle)
370                 port->serial->type->unthrottle(port);
371 }
372
373 static int serial_ioctl (struct tty_struct *tty, struct file * file, unsigned int cmd, unsigned long arg)
374 {
375         struct usb_serial_port *port = tty->driver_data;
376         int retval = -ENODEV;
377
378         if (!port)
379                 goto exit;
380
381         dbg("%s - port %d, cmd 0x%.4x", __FUNCTION__, port->number, cmd);
382
383         if (!port->open_count) {
384                 dbg ("%s - port not open", __FUNCTION__);
385                 goto exit;
386         }
387
388         /* pass on to the driver specific version of this function if it is available */
389         if (port->serial->type->ioctl)
390                 retval = port->serial->type->ioctl(port, file, cmd, arg);
391         else
392                 retval = -ENOIOCTLCMD;
393
394 exit:
395         return retval;
396 }
397
398 static void serial_set_termios (struct tty_struct *tty, struct termios * old)
399 {
400         struct usb_serial_port *port = tty->driver_data;
401
402         if (!port)
403                 return;
404
405         dbg("%s - port %d", __FUNCTION__, port->number);
406
407         if (!port->open_count) {
408                 dbg("%s - port not open", __FUNCTION__);
409                 return;
410         }
411
412         /* pass on to the driver specific version of this function if it is available */
413         if (port->serial->type->set_termios)
414                 port->serial->type->set_termios(port, old);
415 }
416
417 static void serial_break (struct tty_struct *tty, int break_state)
418 {
419         struct usb_serial_port *port = tty->driver_data;
420
421         if (!port)
422                 return;
423
424         dbg("%s - port %d", __FUNCTION__, port->number);
425
426         if (!port->open_count) {
427                 dbg("%s - port not open", __FUNCTION__);
428                 return;
429         }
430
431         /* pass on to the driver specific version of this function if it is available */
432         if (port->serial->type->break_ctl)
433                 port->serial->type->break_ctl(port, break_state);
434 }
435
436 static int serial_read_proc (char *page, char **start, off_t off, int count, int *eof, void *data)
437 {
438         struct usb_serial *serial;
439         int length = 0;
440         int i;
441         off_t begin = 0;
442         char tmp[40];
443
444         dbg("%s", __FUNCTION__);
445         length += sprintf (page, "usbserinfo:1.0 driver:2.0\n");
446         for (i = 0; i < SERIAL_TTY_MINORS && length < PAGE_SIZE; ++i) {
447                 serial = usb_serial_get_by_index(i);
448                 if (serial == NULL)
449                         continue;
450
451                 length += sprintf (page+length, "%d:", i);
452                 if (serial->type->driver.owner)
453                         length += sprintf (page+length, " module:%s", module_name(serial->type->driver.owner));
454                 length += sprintf (page+length, " name:\"%s\"", serial->type->description);
455                 length += sprintf (page+length, " vendor:%04x product:%04x", 
456                                    le16_to_cpu(serial->dev->descriptor.idVendor), 
457                                    le16_to_cpu(serial->dev->descriptor.idProduct));
458                 length += sprintf (page+length, " num_ports:%d", serial->num_ports);
459                 length += sprintf (page+length, " port:%d", i - serial->minor + 1);
460
461                 usb_make_path(serial->dev, tmp, sizeof(tmp));
462                 length += sprintf (page+length, " path:%s", tmp);
463                         
464                 length += sprintf (page+length, "\n");
465                 if ((length + begin) > (off + count))
466                         goto done;
467                 if ((length + begin) < off) {
468                         begin += length;
469                         length = 0;
470                 }
471                 kref_put(&serial->kref, destroy_serial);
472         }
473         *eof = 1;
474 done:
475         if (off >= (length + begin))
476                 return 0;
477         *start = page + (off-begin);
478         return ((count < begin+length-off) ? count : begin+length-off);
479 }
480
481 static int serial_tiocmget (struct tty_struct *tty, struct file *file)
482 {
483         struct usb_serial_port *port = tty->driver_data;
484
485         if (!port)
486                 goto exit;
487
488         dbg("%s - port %d", __FUNCTION__, port->number);
489
490         if (!port->open_count) {
491                 dbg("%s - port not open", __FUNCTION__);
492                 goto exit;
493         }
494
495         if (port->serial->type->tiocmget)
496                 return port->serial->type->tiocmget(port, file);
497
498 exit:
499         return -EINVAL;
500 }
501
502 static int serial_tiocmset (struct tty_struct *tty, struct file *file,
503                             unsigned int set, unsigned int clear)
504 {
505         struct usb_serial_port *port = tty->driver_data;
506
507         if (!port)
508                 goto exit;
509
510         dbg("%s - port %d", __FUNCTION__, port->number);
511
512         if (!port->open_count) {
513                 dbg("%s - port not open", __FUNCTION__);
514                 goto exit;
515         }
516
517         if (port->serial->type->tiocmset)
518                 return port->serial->type->tiocmset(port, file, set, clear);
519
520 exit:
521         return -EINVAL;
522 }
523
524 void usb_serial_port_softint(void *private)
525 {
526         struct usb_serial_port *port = private;
527         struct tty_struct *tty;
528
529         dbg("%s - port %d", __FUNCTION__, port->number);
530         
531         if (!port)
532                 return;
533
534         tty = port->tty;
535         if (!tty)
536                 return;
537
538         tty_wakeup(tty);
539 }
540
541 static void port_release(struct device *dev)
542 {
543         struct usb_serial_port *port = to_usb_serial_port(dev);
544
545         dbg ("%s - %s", __FUNCTION__, dev->bus_id);
546         usb_kill_urb(port->read_urb);
547         usb_free_urb(port->read_urb);
548         usb_kill_urb(port->write_urb);
549         usb_free_urb(port->write_urb);
550         usb_kill_urb(port->interrupt_in_urb);
551         usb_free_urb(port->interrupt_in_urb);
552         usb_kill_urb(port->interrupt_out_urb);
553         usb_free_urb(port->interrupt_out_urb);
554         kfree(port->bulk_in_buffer);
555         kfree(port->bulk_out_buffer);
556         kfree(port->interrupt_in_buffer);
557         kfree(port->interrupt_out_buffer);
558         kfree(port);
559 }
560
561 static struct usb_serial * create_serial (struct usb_device *dev, 
562                                           struct usb_interface *interface,
563                                           struct usb_serial_driver *driver)
564 {
565         struct usb_serial *serial;
566
567         serial = kmalloc (sizeof (*serial), GFP_KERNEL);
568         if (!serial) {
569                 dev_err(&dev->dev, "%s - out of memory\n", __FUNCTION__);
570                 return NULL;
571         }
572         memset (serial, 0, sizeof(*serial));
573         serial->dev = usb_get_dev(dev);
574         serial->type = driver;
575         serial->interface = interface;
576         kref_init(&serial->kref);
577
578         return serial;
579 }
580
581 static struct usb_serial_driver *search_serial_device(struct usb_interface *iface)
582 {
583         struct list_head *p;
584         const struct usb_device_id *id;
585         struct usb_serial_driver *t;
586
587         /* Check if the usb id matches a known device */
588         list_for_each(p, &usb_serial_driver_list) {
589                 t = list_entry(p, struct usb_serial_driver, driver_list);
590                 id = usb_match_id(iface, t->id_table);
591                 if (id != NULL) {
592                         dbg("descriptor matches");
593                         return t;
594                 }
595         }
596
597         return NULL;
598 }
599
600 int usb_serial_probe(struct usb_interface *interface,
601                                const struct usb_device_id *id)
602 {
603         struct usb_device *dev = interface_to_usbdev (interface);
604         struct usb_serial *serial = NULL;
605         struct usb_serial_port *port;
606         struct usb_host_interface *iface_desc;
607         struct usb_endpoint_descriptor *endpoint;
608         struct usb_endpoint_descriptor *interrupt_in_endpoint[MAX_NUM_PORTS];
609         struct usb_endpoint_descriptor *interrupt_out_endpoint[MAX_NUM_PORTS];
610         struct usb_endpoint_descriptor *bulk_in_endpoint[MAX_NUM_PORTS];
611         struct usb_endpoint_descriptor *bulk_out_endpoint[MAX_NUM_PORTS];
612         struct usb_serial_driver *type = NULL;
613         int retval;
614         int minor;
615         int buffer_size;
616         int i;
617         int num_interrupt_in = 0;
618         int num_interrupt_out = 0;
619         int num_bulk_in = 0;
620         int num_bulk_out = 0;
621         int num_ports = 0;
622         int max_endpoints;
623
624         type = search_serial_device(interface);
625         if (!type) {
626                 dbg("none matched");
627                 return -ENODEV;
628         }
629
630         serial = create_serial (dev, interface, type);
631         if (!serial) {
632                 dev_err(&interface->dev, "%s - out of memory\n", __FUNCTION__);
633                 return -ENOMEM;
634         }
635
636         /* if this device type has a probe function, call it */
637         if (type->probe) {
638                 const struct usb_device_id *id;
639
640                 if (!try_module_get(type->driver.owner)) {
641                         dev_err(&interface->dev, "module get failed, exiting\n");
642                         kfree (serial);
643                         return -EIO;
644                 }
645
646                 id = usb_match_id(interface, type->id_table);
647                 retval = type->probe(serial, id);
648                 module_put(type->driver.owner);
649
650                 if (retval) {
651                         dbg ("sub driver rejected device");
652                         kfree (serial);
653                         return retval;
654                 }
655         }
656
657         /* descriptor matches, let's find the endpoints needed */
658         /* check out the endpoints */
659         iface_desc = interface->cur_altsetting;
660         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
661                 endpoint = &iface_desc->endpoint[i].desc;
662                 
663                 if ((endpoint->bEndpointAddress & 0x80) &&
664                     ((endpoint->bmAttributes & 3) == 0x02)) {
665                         /* we found a bulk in endpoint */
666                         dbg("found bulk in on endpoint %d", i);
667                         bulk_in_endpoint[num_bulk_in] = endpoint;
668                         ++num_bulk_in;
669                 }
670
671                 if (((endpoint->bEndpointAddress & 0x80) == 0x00) &&
672                     ((endpoint->bmAttributes & 3) == 0x02)) {
673                         /* we found a bulk out endpoint */
674                         dbg("found bulk out on endpoint %d", i);
675                         bulk_out_endpoint[num_bulk_out] = endpoint;
676                         ++num_bulk_out;
677                 }
678                 
679                 if ((endpoint->bEndpointAddress & 0x80) &&
680                     ((endpoint->bmAttributes & 3) == 0x03)) {
681                         /* we found a interrupt in endpoint */
682                         dbg("found interrupt in on endpoint %d", i);
683                         interrupt_in_endpoint[num_interrupt_in] = endpoint;
684                         ++num_interrupt_in;
685                 }
686
687                 if (((endpoint->bEndpointAddress & 0x80) == 0x00) &&
688                     ((endpoint->bmAttributes & 3) == 0x03)) {
689                         /* we found an interrupt out endpoint */
690                         dbg("found interrupt out on endpoint %d", i);
691                         interrupt_out_endpoint[num_interrupt_out] = endpoint;
692                         ++num_interrupt_out;
693                 }
694         }
695
696 #if defined(CONFIG_USB_SERIAL_PL2303) || defined(CONFIG_USB_SERIAL_PL2303_MODULE)
697         /* BEGIN HORRIBLE HACK FOR PL2303 */ 
698         /* this is needed due to the looney way its endpoints are set up */
699         if (((le16_to_cpu(dev->descriptor.idVendor) == PL2303_VENDOR_ID) &&
700              (le16_to_cpu(dev->descriptor.idProduct) == PL2303_PRODUCT_ID)) ||
701             ((le16_to_cpu(dev->descriptor.idVendor) == ATEN_VENDOR_ID) &&
702              (le16_to_cpu(dev->descriptor.idProduct) == ATEN_PRODUCT_ID))) {
703                 if (interface != dev->actconfig->interface[0]) {
704                         /* check out the endpoints of the other interface*/
705                         iface_desc = dev->actconfig->interface[0]->cur_altsetting;
706                         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
707                                 endpoint = &iface_desc->endpoint[i].desc;
708                                 if ((endpoint->bEndpointAddress & 0x80) &&
709                                     ((endpoint->bmAttributes & 3) == 0x03)) {
710                                         /* we found a interrupt in endpoint */
711                                         dbg("found interrupt in for Prolific device on separate interface");
712                                         interrupt_in_endpoint[num_interrupt_in] = endpoint;
713                                         ++num_interrupt_in;
714                                 }
715                         }
716                 }
717
718                 /* Now make sure the PL-2303 is configured correctly.
719                  * If not, give up now and hope this hack will work
720                  * properly during a later invocation of usb_serial_probe
721                  */
722                 if (num_bulk_in == 0 || num_bulk_out == 0) {
723                         dev_info(&interface->dev, "PL-2303 hack: descriptors matched but endpoints did not\n");
724                         kfree (serial);
725                         return -ENODEV;
726                 }
727         }
728         /* END HORRIBLE HACK FOR PL2303 */
729 #endif
730
731         /* found all that we need */
732         dev_info(&interface->dev, "%s converter detected\n", type->description);
733
734 #ifdef CONFIG_USB_SERIAL_GENERIC
735         if (type == &usb_serial_generic_device) {
736                 num_ports = num_bulk_out;
737                 if (num_ports == 0) {
738                         dev_err(&interface->dev, "Generic device with no bulk out, not allowed.\n");
739                         kfree (serial);
740                         return -EIO;
741                 }
742         }
743 #endif
744         if (!num_ports) {
745                 /* if this device type has a calc_num_ports function, call it */
746                 if (type->calc_num_ports) {
747                         if (!try_module_get(type->driver.owner)) {
748                                 dev_err(&interface->dev, "module get failed, exiting\n");
749                                 kfree (serial);
750                                 return -EIO;
751                         }
752                         num_ports = type->calc_num_ports (serial);
753                         module_put(type->driver.owner);
754                 }
755                 if (!num_ports)
756                         num_ports = type->num_ports;
757         }
758
759         if (get_free_serial (serial, num_ports, &minor) == NULL) {
760                 dev_err(&interface->dev, "No more free serial devices\n");
761                 kfree (serial);
762                 return -ENOMEM;
763         }
764
765         serial->minor = minor;
766         serial->num_ports = num_ports;
767         serial->num_bulk_in = num_bulk_in;
768         serial->num_bulk_out = num_bulk_out;
769         serial->num_interrupt_in = num_interrupt_in;
770         serial->num_interrupt_out = num_interrupt_out;
771
772         /* create our ports, we need as many as the max endpoints */
773         /* we don't use num_ports here cauz some devices have more endpoint pairs than ports */
774         max_endpoints = max(num_bulk_in, num_bulk_out);
775         max_endpoints = max(max_endpoints, num_interrupt_in);
776         max_endpoints = max(max_endpoints, num_interrupt_out);
777         max_endpoints = max(max_endpoints, (int)serial->num_ports);
778         serial->num_port_pointers = max_endpoints;
779         dbg("%s - setting up %d port structures for this device", __FUNCTION__, max_endpoints);
780         for (i = 0; i < max_endpoints; ++i) {
781                 port = kmalloc(sizeof(struct usb_serial_port), GFP_KERNEL);
782                 if (!port)
783                         goto probe_error;
784                 memset(port, 0x00, sizeof(struct usb_serial_port));
785                 port->number = i + serial->minor;
786                 port->serial = serial;
787                 spin_lock_init(&port->lock);
788                 sema_init(&port->sem, 1);
789                 INIT_WORK(&port->work, usb_serial_port_softint, port);
790                 serial->port[i] = port;
791         }
792
793         /* set up the endpoint information */
794         for (i = 0; i < num_bulk_in; ++i) {
795                 endpoint = bulk_in_endpoint[i];
796                 port = serial->port[i];
797                 port->read_urb = usb_alloc_urb (0, GFP_KERNEL);
798                 if (!port->read_urb) {
799                         dev_err(&interface->dev, "No free urbs available\n");
800                         goto probe_error;
801                 }
802                 buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
803                 port->bulk_in_size = buffer_size;
804                 port->bulk_in_endpointAddress = endpoint->bEndpointAddress;
805                 port->bulk_in_buffer = kmalloc (buffer_size, GFP_KERNEL);
806                 if (!port->bulk_in_buffer) {
807                         dev_err(&interface->dev, "Couldn't allocate bulk_in_buffer\n");
808                         goto probe_error;
809                 }
810                 usb_fill_bulk_urb (port->read_urb, dev,
811                                    usb_rcvbulkpipe (dev,
812                                                     endpoint->bEndpointAddress),
813                                    port->bulk_in_buffer, buffer_size,
814                                    serial->type->read_bulk_callback,
815                                    port);
816         }
817
818         for (i = 0; i < num_bulk_out; ++i) {
819                 endpoint = bulk_out_endpoint[i];
820                 port = serial->port[i];
821                 port->write_urb = usb_alloc_urb(0, GFP_KERNEL);
822                 if (!port->write_urb) {
823                         dev_err(&interface->dev, "No free urbs available\n");
824                         goto probe_error;
825                 }
826                 buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
827                 port->bulk_out_size = buffer_size;
828                 port->bulk_out_endpointAddress = endpoint->bEndpointAddress;
829                 port->bulk_out_buffer = kmalloc (buffer_size, GFP_KERNEL);
830                 if (!port->bulk_out_buffer) {
831                         dev_err(&interface->dev, "Couldn't allocate bulk_out_buffer\n");
832                         goto probe_error;
833                 }
834                 usb_fill_bulk_urb (port->write_urb, dev,
835                                    usb_sndbulkpipe (dev,
836                                                     endpoint->bEndpointAddress),
837                                    port->bulk_out_buffer, buffer_size, 
838                                    serial->type->write_bulk_callback,
839                                    port);
840         }
841
842         if (serial->type->read_int_callback) {
843                 for (i = 0; i < num_interrupt_in; ++i) {
844                         endpoint = interrupt_in_endpoint[i];
845                         port = serial->port[i];
846                         port->interrupt_in_urb = usb_alloc_urb(0, GFP_KERNEL);
847                         if (!port->interrupt_in_urb) {
848                                 dev_err(&interface->dev, "No free urbs available\n");
849                                 goto probe_error;
850                         }
851                         buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
852                         port->interrupt_in_endpointAddress = endpoint->bEndpointAddress;
853                         port->interrupt_in_buffer = kmalloc (buffer_size, GFP_KERNEL);
854                         if (!port->interrupt_in_buffer) {
855                                 dev_err(&interface->dev, "Couldn't allocate interrupt_in_buffer\n");
856                                 goto probe_error;
857                         }
858                         usb_fill_int_urb (port->interrupt_in_urb, dev, 
859                                           usb_rcvintpipe (dev,
860                                                           endpoint->bEndpointAddress),
861                                           port->interrupt_in_buffer, buffer_size, 
862                                           serial->type->read_int_callback, port, 
863                                           endpoint->bInterval);
864                 }
865         } else if (num_interrupt_in) {
866                 dbg("the device claims to support interrupt in transfers, but read_int_callback is not defined");
867         }
868         
869         if (serial->type->write_int_callback) {
870                 for (i = 0; i < num_interrupt_out; ++i) {
871                         endpoint = interrupt_out_endpoint[i];
872                         port = serial->port[i];
873                         port->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
874                         if (!port->interrupt_out_urb) {
875                                 dev_err(&interface->dev, "No free urbs available\n");
876                                 goto probe_error;
877                         }
878                         buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
879                         port->interrupt_out_size = buffer_size;
880                         port->interrupt_out_endpointAddress = endpoint->bEndpointAddress;
881                         port->interrupt_out_buffer = kmalloc (buffer_size, GFP_KERNEL);
882                         if (!port->interrupt_out_buffer) {
883                                 dev_err(&interface->dev, "Couldn't allocate interrupt_out_buffer\n");
884                                 goto probe_error;
885                         }
886                         usb_fill_int_urb (port->interrupt_out_urb, dev,
887                                           usb_sndintpipe (dev,
888                                                           endpoint->bEndpointAddress),
889                                           port->interrupt_out_buffer, buffer_size,
890                                           serial->type->write_int_callback, port,
891                                           endpoint->bInterval);
892                 }
893         } else if (num_interrupt_out) {
894                 dbg("the device claims to support interrupt out transfers, but write_int_callback is not defined");
895         }
896         
897         /* if this device type has an attach function, call it */
898         if (type->attach) {
899                 if (!try_module_get(type->driver.owner)) {
900                         dev_err(&interface->dev, "module get failed, exiting\n");
901                         goto probe_error;
902                 }
903                 retval = type->attach (serial);
904                 module_put(type->driver.owner);
905                 if (retval < 0)
906                         goto probe_error;
907                 if (retval > 0) {
908                         /* quietly accept this device, but don't bind to a serial port
909                          * as it's about to disappear */
910                         goto exit;
911                 }
912         }
913
914         /* register all of the individual ports with the driver core */
915         for (i = 0; i < num_ports; ++i) {
916                 port = serial->port[i];
917                 port->dev.parent = &interface->dev;
918                 port->dev.driver = NULL;
919                 port->dev.bus = &usb_serial_bus_type;
920                 port->dev.release = &port_release;
921
922                 snprintf (&port->dev.bus_id[0], sizeof(port->dev.bus_id), "ttyUSB%d", port->number);
923                 dbg ("%s - registering %s", __FUNCTION__, port->dev.bus_id);
924                 device_register (&port->dev);
925         }
926
927         usb_serial_console_init (debug, minor);
928
929 exit:
930         /* success */
931         usb_set_intfdata (interface, serial);
932         return 0;
933
934 probe_error:
935         for (i = 0; i < num_bulk_in; ++i) {
936                 port = serial->port[i];
937                 if (!port)
938                         continue;
939                 if (port->read_urb)
940                         usb_free_urb (port->read_urb);
941                 kfree(port->bulk_in_buffer);
942         }
943         for (i = 0; i < num_bulk_out; ++i) {
944                 port = serial->port[i];
945                 if (!port)
946                         continue;
947                 if (port->write_urb)
948                         usb_free_urb (port->write_urb);
949                 kfree(port->bulk_out_buffer);
950         }
951         for (i = 0; i < num_interrupt_in; ++i) {
952                 port = serial->port[i];
953                 if (!port)
954                         continue;
955                 if (port->interrupt_in_urb)
956                         usb_free_urb (port->interrupt_in_urb);
957                 kfree(port->interrupt_in_buffer);
958         }
959         for (i = 0; i < num_interrupt_out; ++i) {
960                 port = serial->port[i];
961                 if (!port)
962                         continue;
963                 if (port->interrupt_out_urb)
964                         usb_free_urb (port->interrupt_out_urb);
965                 kfree(port->interrupt_out_buffer);
966         }
967
968         /* return the minor range that this device had */
969         return_serial (serial);
970
971         /* free up any memory that we allocated */
972         for (i = 0; i < serial->num_port_pointers; ++i)
973                 kfree(serial->port[i]);
974         kfree (serial);
975         return -EIO;
976 }
977
978 void usb_serial_disconnect(struct usb_interface *interface)
979 {
980         int i;
981         struct usb_serial *serial = usb_get_intfdata (interface);
982         struct device *dev = &interface->dev;
983         struct usb_serial_port *port;
984
985         dbg ("%s", __FUNCTION__);
986
987         usb_set_intfdata (interface, NULL);
988         if (serial) {
989                 for (i = 0; i < serial->num_ports; ++i) {
990                         port = serial->port[i];
991                         if (port && port->tty)
992                                 tty_hangup(port->tty);
993                 }
994                 /* let the last holder of this object 
995                  * cause it to be cleaned up */
996                 kref_put(&serial->kref, destroy_serial);
997         }
998         dev_info(dev, "device disconnected\n");
999 }
1000
1001 static struct tty_operations serial_ops = {
1002         .open =                 serial_open,
1003         .close =                serial_close,
1004         .write =                serial_write,
1005         .write_room =           serial_write_room,
1006         .ioctl =                serial_ioctl,
1007         .set_termios =          serial_set_termios,
1008         .throttle =             serial_throttle,
1009         .unthrottle =           serial_unthrottle,
1010         .break_ctl =            serial_break,
1011         .chars_in_buffer =      serial_chars_in_buffer,
1012         .read_proc =            serial_read_proc,
1013         .tiocmget =             serial_tiocmget,
1014         .tiocmset =             serial_tiocmset,
1015 };
1016
1017 struct tty_driver *usb_serial_tty_driver;
1018
1019 static int __init usb_serial_init(void)
1020 {
1021         int i;
1022         int result;
1023
1024         usb_serial_tty_driver = alloc_tty_driver(SERIAL_TTY_MINORS);
1025         if (!usb_serial_tty_driver)
1026                 return -ENOMEM;
1027
1028         /* Initialize our global data */
1029         for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
1030                 serial_table[i] = NULL;
1031         }
1032
1033         result = bus_register(&usb_serial_bus_type);
1034         if (result) {
1035                 err("%s - registering bus driver failed", __FUNCTION__);
1036                 goto exit_bus;
1037         }
1038
1039         usb_serial_tty_driver->owner = THIS_MODULE;
1040         usb_serial_tty_driver->driver_name = "usbserial";
1041         usb_serial_tty_driver->devfs_name = "usb/tts/";
1042         usb_serial_tty_driver->name =   "ttyUSB";
1043         usb_serial_tty_driver->major = SERIAL_TTY_MAJOR;
1044         usb_serial_tty_driver->minor_start = 0;
1045         usb_serial_tty_driver->type = TTY_DRIVER_TYPE_SERIAL;
1046         usb_serial_tty_driver->subtype = SERIAL_TYPE_NORMAL;
1047         usb_serial_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_NO_DEVFS;
1048         usb_serial_tty_driver->init_termios = tty_std_termios;
1049         usb_serial_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1050         tty_set_operations(usb_serial_tty_driver, &serial_ops);
1051         result = tty_register_driver(usb_serial_tty_driver);
1052         if (result) {
1053                 err("%s - tty_register_driver failed", __FUNCTION__);
1054                 goto exit_reg_driver;
1055         }
1056
1057         /* register the USB driver */
1058         result = usb_register(&usb_serial_driver);
1059         if (result < 0) {
1060                 err("%s - usb_register failed", __FUNCTION__);
1061                 goto exit_tty;
1062         }
1063
1064         /* register the generic driver, if we should */
1065         result = usb_serial_generic_register(debug);
1066         if (result < 0) {
1067                 err("%s - registering generic driver failed", __FUNCTION__);
1068                 goto exit_generic;
1069         }
1070
1071         info(DRIVER_DESC);
1072
1073         return result;
1074
1075 exit_generic:
1076         usb_deregister(&usb_serial_driver);
1077
1078 exit_tty:
1079         tty_unregister_driver(usb_serial_tty_driver);
1080
1081 exit_reg_driver:
1082         bus_unregister(&usb_serial_bus_type);
1083
1084 exit_bus:
1085         err ("%s - returning with error %d", __FUNCTION__, result);
1086         put_tty_driver(usb_serial_tty_driver);
1087         return result;
1088 }
1089
1090
1091 static void __exit usb_serial_exit(void)
1092 {
1093         usb_serial_console_exit();
1094
1095         usb_serial_generic_deregister();
1096
1097         usb_deregister(&usb_serial_driver);
1098         tty_unregister_driver(usb_serial_tty_driver);
1099         put_tty_driver(usb_serial_tty_driver);
1100         bus_unregister(&usb_serial_bus_type);
1101 }
1102
1103
1104 module_init(usb_serial_init);
1105 module_exit(usb_serial_exit);
1106
1107 #define set_to_generic_if_null(type, function)                          \
1108         do {                                                            \
1109                 if (!type->function) {                                  \
1110                         type->function = usb_serial_generic_##function; \
1111                         dbg("Had to override the " #function            \
1112                                  " usb serial operation with the generic one.");\
1113                         }                                               \
1114         } while (0)
1115
1116 static void fixup_generic(struct usb_serial_driver *device)
1117 {
1118         set_to_generic_if_null(device, open);
1119         set_to_generic_if_null(device, write);
1120         set_to_generic_if_null(device, close);
1121         set_to_generic_if_null(device, write_room);
1122         set_to_generic_if_null(device, chars_in_buffer);
1123         set_to_generic_if_null(device, read_bulk_callback);
1124         set_to_generic_if_null(device, write_bulk_callback);
1125         set_to_generic_if_null(device, shutdown);
1126 }
1127
1128 int usb_serial_register(struct usb_serial_driver *driver)
1129 {
1130         int retval;
1131
1132         fixup_generic(driver);
1133
1134         if (!driver->description)
1135                 driver->description = driver->driver.name;
1136
1137         /* Add this device to our list of devices */
1138         list_add(&driver->driver_list, &usb_serial_driver_list);
1139
1140         retval = usb_serial_bus_register(driver);
1141         if (retval) {
1142                 err("problem %d when registering driver %s", retval, driver->description);
1143                 list_del(&driver->driver_list);
1144         }
1145         else
1146                 info("USB Serial support registered for %s", driver->description);
1147
1148         return retval;
1149 }
1150
1151
1152 void usb_serial_deregister(struct usb_serial_driver *device)
1153 {
1154         info("USB Serial deregistering driver %s", device->description);
1155         list_del(&device->driver_list);
1156         usb_serial_bus_deregister(device);
1157 }
1158
1159
1160
1161 /* If the usb-serial core is built into the core, the usb-serial drivers
1162    need these symbols to load properly as modules. */
1163 EXPORT_SYMBOL_GPL(usb_serial_register);
1164 EXPORT_SYMBOL_GPL(usb_serial_deregister);
1165 EXPORT_SYMBOL_GPL(usb_serial_probe);
1166 EXPORT_SYMBOL_GPL(usb_serial_disconnect);
1167 EXPORT_SYMBOL_GPL(usb_serial_port_softint);
1168
1169
1170 /* Module information */
1171 MODULE_AUTHOR( DRIVER_AUTHOR );
1172 MODULE_DESCRIPTION( DRIVER_DESC );
1173 MODULE_LICENSE("GPL");
1174
1175 module_param(debug, bool, S_IRUGO | S_IWUSR);
1176 MODULE_PARM_DESC(debug, "Debug enabled or not");