]> git.karo-electronics.de Git - karo-tx-linux.git/blob - drivers/usb/class/cdc-acm.c
USB: cdc-acm: fix potential null-pointer dereference on disconnect
[karo-tx-linux.git] / drivers / usb / class / cdc-acm.c
1 /*
2  * cdc-acm.c
3  *
4  * Copyright (c) 1999 Armin Fuerst      <fuerst@in.tum.de>
5  * Copyright (c) 1999 Pavel Machek      <pavel@suse.cz>
6  * Copyright (c) 1999 Johannes Erdfelt  <johannes@erdfelt.com>
7  * Copyright (c) 2000 Vojtech Pavlik    <vojtech@suse.cz>
8  * Copyright (c) 2004 Oliver Neukum     <oliver@neukum.name>
9  * Copyright (c) 2005 David Kubicek     <dave@awk.cz>
10  *
11  * USB Abstract Control Model driver for USB modems and ISDN adapters
12  *
13  * Sponsored by SuSE
14  *
15  * ChangeLog:
16  *      v0.9  - thorough cleaning, URBification, almost a rewrite
17  *      v0.10 - some more cleanups
18  *      v0.11 - fixed flow control, read error doesn't stop reads
19  *      v0.12 - added TIOCM ioctls, added break handling, made struct acm
20  *              kmalloced
21  *      v0.13 - added termios, added hangup
22  *      v0.14 - sized down struct acm
23  *      v0.15 - fixed flow control again - characters could be lost
24  *      v0.16 - added code for modems with swapped data and control interfaces
25  *      v0.17 - added new style probing
26  *      v0.18 - fixed new style probing for devices with more configurations
27  *      v0.19 - fixed CLOCAL handling (thanks to Richard Shih-Ping Chan)
28  *      v0.20 - switched to probing on interface (rather than device) class
29  *      v0.21 - revert to probing on device for devices with multiple configs
30  *      v0.22 - probe only the control interface. if usbcore doesn't choose the
31  *              config we want, sysadmin changes bConfigurationValue in sysfs.
32  *      v0.23 - use softirq for rx processing, as needed by tty layer
33  *      v0.24 - change probe method to evaluate CDC union descriptor
34  *      v0.25 - downstream tasks paralelized to maximize throughput
35  *      v0.26 - multiple write urbs, writesize increased
36  */
37
38 /*
39  * This program is free software; you can redistribute it and/or modify
40  * it under the terms of the GNU General Public License as published by
41  * the Free Software Foundation; either version 2 of the License, or
42  * (at your option) any later version.
43  *
44  * This program is distributed in the hope that it will be useful,
45  * but WITHOUT ANY WARRANTY; without even the implied warranty of
46  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
47  * GNU General Public License for more details.
48  *
49  * You should have received a copy of the GNU General Public License
50  * along with this program; if not, write to the Free Software
51  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
52  */
53
54 #undef DEBUG
55 #undef VERBOSE_DEBUG
56
57 #include <linux/kernel.h>
58 #include <linux/errno.h>
59 #include <linux/init.h>
60 #include <linux/slab.h>
61 #include <linux/tty.h>
62 #include <linux/serial.h>
63 #include <linux/tty_driver.h>
64 #include <linux/tty_flip.h>
65 #include <linux/module.h>
66 #include <linux/mutex.h>
67 #include <linux/uaccess.h>
68 #include <linux/usb.h>
69 #include <linux/usb/cdc.h>
70 #include <asm/byteorder.h>
71 #include <asm/unaligned.h>
72 #include <linux/list.h>
73
74 #include "cdc-acm.h"
75
76
77 #define ACM_CLOSE_TIMEOUT       15      /* seconds to let writes drain */
78
79 /*
80  * Version Information
81  */
82 #define DRIVER_VERSION "v0.26"
83 #define DRIVER_AUTHOR "Armin Fuerst, Pavel Machek, Johannes Erdfelt, Vojtech Pavlik, David Kubicek"
84 #define DRIVER_DESC "USB Abstract Control Model driver for USB modems and ISDN adapters"
85
86 static struct usb_driver acm_driver;
87 static struct tty_driver *acm_tty_driver;
88 static struct acm *acm_table[ACM_TTY_MINORS];
89
90 static DEFINE_MUTEX(open_mutex);
91
92 #define ACM_READY(acm)  (acm && acm->dev && acm->port.count)
93
94 static const struct tty_port_operations acm_port_ops = {
95 };
96
97 #ifdef VERBOSE_DEBUG
98 #define verbose 1
99 #else
100 #define verbose 0
101 #endif
102
103 /*
104  * Functions for ACM control messages.
105  */
106
107 static int acm_ctrl_msg(struct acm *acm, int request, int value,
108                                                         void *buf, int len)
109 {
110         int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
111                 request, USB_RT_ACM, value,
112                 acm->control->altsetting[0].desc.bInterfaceNumber,
113                 buf, len, 5000);
114         dbg("acm_control_msg: rq: 0x%02x val: %#x len: %#x result: %d",
115                                                 request, value, len, retval);
116         return retval < 0 ? retval : 0;
117 }
118
119 /* devices aren't required to support these requests.
120  * the cdc acm descriptor tells whether they do...
121  */
122 #define acm_set_control(acm, control) \
123         acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE, control, NULL, 0)
124 #define acm_set_line(acm, line) \
125         acm_ctrl_msg(acm, USB_CDC_REQ_SET_LINE_CODING, 0, line, sizeof *(line))
126 #define acm_send_break(acm, ms) \
127         acm_ctrl_msg(acm, USB_CDC_REQ_SEND_BREAK, ms, NULL, 0)
128
129 /*
130  * Write buffer management.
131  * All of these assume proper locks taken by the caller.
132  */
133
134 static int acm_wb_alloc(struct acm *acm)
135 {
136         int i, wbn;
137         struct acm_wb *wb;
138
139         wbn = 0;
140         i = 0;
141         for (;;) {
142                 wb = &acm->wb[wbn];
143                 if (!wb->use) {
144                         wb->use = 1;
145                         return wbn;
146                 }
147                 wbn = (wbn + 1) % ACM_NW;
148                 if (++i >= ACM_NW)
149                         return -1;
150         }
151 }
152
153 static int acm_wb_is_avail(struct acm *acm)
154 {
155         int i, n;
156         unsigned long flags;
157
158         n = ACM_NW;
159         spin_lock_irqsave(&acm->write_lock, flags);
160         for (i = 0; i < ACM_NW; i++)
161                 n -= acm->wb[i].use;
162         spin_unlock_irqrestore(&acm->write_lock, flags);
163         return n;
164 }
165
166 /*
167  * Finish write. Caller must hold acm->write_lock
168  */
169 static void acm_write_done(struct acm *acm, struct acm_wb *wb)
170 {
171         wb->use = 0;
172         acm->transmitting--;
173         usb_autopm_put_interface_async(acm->control);
174 }
175
176 /*
177  * Poke write.
178  *
179  * the caller is responsible for locking
180  */
181
182 static int acm_start_wb(struct acm *acm, struct acm_wb *wb)
183 {
184         int rc;
185
186         acm->transmitting++;
187
188         wb->urb->transfer_buffer = wb->buf;
189         wb->urb->transfer_dma = wb->dmah;
190         wb->urb->transfer_buffer_length = wb->len;
191         wb->urb->dev = acm->dev;
192
193         rc = usb_submit_urb(wb->urb, GFP_ATOMIC);
194         if (rc < 0) {
195                 dbg("usb_submit_urb(write bulk) failed: %d", rc);
196                 acm_write_done(acm, wb);
197         }
198         return rc;
199 }
200
201 static int acm_write_start(struct acm *acm, int wbn)
202 {
203         unsigned long flags;
204         struct acm_wb *wb = &acm->wb[wbn];
205         int rc;
206
207         spin_lock_irqsave(&acm->write_lock, flags);
208         if (!acm->dev) {
209                 wb->use = 0;
210                 spin_unlock_irqrestore(&acm->write_lock, flags);
211                 return -ENODEV;
212         }
213
214         dbg("%s susp_count: %d", __func__, acm->susp_count);
215         usb_autopm_get_interface_async(acm->control);
216         if (acm->susp_count) {
217                 if (!acm->delayed_wb)
218                         acm->delayed_wb = wb;
219                 else
220                         usb_autopm_put_interface_async(acm->control);
221                 spin_unlock_irqrestore(&acm->write_lock, flags);
222                 return 0;       /* A white lie */
223         }
224         usb_mark_last_busy(acm->dev);
225
226         rc = acm_start_wb(acm, wb);
227         spin_unlock_irqrestore(&acm->write_lock, flags);
228
229         return rc;
230
231 }
232 /*
233  * attributes exported through sysfs
234  */
235 static ssize_t show_caps
236 (struct device *dev, struct device_attribute *attr, char *buf)
237 {
238         struct usb_interface *intf = to_usb_interface(dev);
239         struct acm *acm = usb_get_intfdata(intf);
240
241         return sprintf(buf, "%d", acm->ctrl_caps);
242 }
243 static DEVICE_ATTR(bmCapabilities, S_IRUGO, show_caps, NULL);
244
245 static ssize_t show_country_codes
246 (struct device *dev, struct device_attribute *attr, char *buf)
247 {
248         struct usb_interface *intf = to_usb_interface(dev);
249         struct acm *acm = usb_get_intfdata(intf);
250
251         memcpy(buf, acm->country_codes, acm->country_code_size);
252         return acm->country_code_size;
253 }
254
255 static DEVICE_ATTR(wCountryCodes, S_IRUGO, show_country_codes, NULL);
256
257 static ssize_t show_country_rel_date
258 (struct device *dev, struct device_attribute *attr, char *buf)
259 {
260         struct usb_interface *intf = to_usb_interface(dev);
261         struct acm *acm = usb_get_intfdata(intf);
262
263         return sprintf(buf, "%d", acm->country_rel_date);
264 }
265
266 static DEVICE_ATTR(iCountryCodeRelDate, S_IRUGO, show_country_rel_date, NULL);
267 /*
268  * Interrupt handlers for various ACM device responses
269  */
270
271 /* control interface reports status changes with "interrupt" transfers */
272 static void acm_ctrl_irq(struct urb *urb)
273 {
274         struct acm *acm = urb->context;
275         struct usb_cdc_notification *dr = urb->transfer_buffer;
276         struct tty_struct *tty;
277         unsigned char *data;
278         int newctrl;
279         int retval;
280         int status = urb->status;
281
282         switch (status) {
283         case 0:
284                 /* success */
285                 break;
286         case -ECONNRESET:
287         case -ENOENT:
288         case -ESHUTDOWN:
289                 /* this urb is terminated, clean up */
290                 dbg("%s - urb shutting down with status: %d", __func__, status);
291                 return;
292         default:
293                 dbg("%s - nonzero urb status received: %d", __func__, status);
294                 goto exit;
295         }
296
297         if (!ACM_READY(acm))
298                 goto exit;
299
300         usb_mark_last_busy(acm->dev);
301
302         data = (unsigned char *)(dr + 1);
303         switch (dr->bNotificationType) {
304         case USB_CDC_NOTIFY_NETWORK_CONNECTION:
305                 dbg("%s network", dr->wValue ?
306                                         "connected to" : "disconnected from");
307                 break;
308
309         case USB_CDC_NOTIFY_SERIAL_STATE:
310                 tty = tty_port_tty_get(&acm->port);
311                 newctrl = get_unaligned_le16(data);
312
313                 if (tty) {
314                         if (!acm->clocal &&
315                                 (acm->ctrlin & ~newctrl & ACM_CTRL_DCD)) {
316                                 dbg("calling hangup");
317                                 tty_hangup(tty);
318                         }
319                         tty_kref_put(tty);
320                 }
321
322                 acm->ctrlin = newctrl;
323
324                 dbg("input control lines: dcd%c dsr%c break%c ring%c framing%c parity%c overrun%c",
325                         acm->ctrlin & ACM_CTRL_DCD ? '+' : '-',
326                         acm->ctrlin & ACM_CTRL_DSR ? '+' : '-',
327                         acm->ctrlin & ACM_CTRL_BRK ? '+' : '-',
328                         acm->ctrlin & ACM_CTRL_RI  ? '+' : '-',
329                         acm->ctrlin & ACM_CTRL_FRAMING ? '+' : '-',
330                         acm->ctrlin & ACM_CTRL_PARITY ? '+' : '-',
331                         acm->ctrlin & ACM_CTRL_OVERRUN ? '+' : '-');
332                         break;
333
334         default:
335                 dbg("unknown notification %d received: index %d len %d data0 %d data1 %d",
336                         dr->bNotificationType, dr->wIndex,
337                         dr->wLength, data[0], data[1]);
338                 break;
339         }
340 exit:
341         retval = usb_submit_urb(urb, GFP_ATOMIC);
342         if (retval)
343                 dev_err(&urb->dev->dev, "%s - usb_submit_urb failed with "
344                         "result %d", __func__, retval);
345 }
346
347 /* data interface returns incoming bytes, or we got unthrottled */
348 static void acm_read_bulk(struct urb *urb)
349 {
350         struct acm_rb *buf;
351         struct acm_ru *rcv = urb->context;
352         struct acm *acm = rcv->instance;
353         int status = urb->status;
354
355         dbg("Entering acm_read_bulk with status %d", status);
356
357         if (!ACM_READY(acm)) {
358                 dev_dbg(&acm->data->dev, "Aborting, acm not ready");
359                 return;
360         }
361         usb_mark_last_busy(acm->dev);
362
363         if (status)
364                 dev_dbg(&acm->data->dev, "bulk rx status %d\n", status);
365
366         buf = rcv->buffer;
367         buf->size = urb->actual_length;
368
369         if (likely(status == 0)) {
370                 spin_lock(&acm->read_lock);
371                 acm->processing++;
372                 list_add_tail(&rcv->list, &acm->spare_read_urbs);
373                 list_add_tail(&buf->list, &acm->filled_read_bufs);
374                 spin_unlock(&acm->read_lock);
375         } else {
376                 /* we drop the buffer due to an error */
377                 spin_lock(&acm->read_lock);
378                 list_add_tail(&rcv->list, &acm->spare_read_urbs);
379                 list_add(&buf->list, &acm->spare_read_bufs);
380                 spin_unlock(&acm->read_lock);
381                 /* nevertheless the tasklet must be kicked unconditionally
382                 so the queue cannot dry up */
383         }
384         if (likely(!acm->susp_count))
385                 tasklet_schedule(&acm->urb_task);
386 }
387
388 static void acm_rx_tasklet(unsigned long _acm)
389 {
390         struct acm *acm = (void *)_acm;
391         struct acm_rb *buf;
392         struct tty_struct *tty;
393         struct acm_ru *rcv;
394         unsigned long flags;
395         unsigned char throttled;
396
397         dbg("Entering acm_rx_tasklet");
398
399         if (!ACM_READY(acm)) {
400                 dbg("acm_rx_tasklet: ACM not ready");
401                 return;
402         }
403
404         spin_lock_irqsave(&acm->throttle_lock, flags);
405         throttled = acm->throttle;
406         spin_unlock_irqrestore(&acm->throttle_lock, flags);
407         if (throttled) {
408                 dbg("acm_rx_tasklet: throttled");
409                 return;
410         }
411
412         tty = tty_port_tty_get(&acm->port);
413
414 next_buffer:
415         spin_lock_irqsave(&acm->read_lock, flags);
416         if (list_empty(&acm->filled_read_bufs)) {
417                 spin_unlock_irqrestore(&acm->read_lock, flags);
418                 goto urbs;
419         }
420         buf = list_entry(acm->filled_read_bufs.next,
421                          struct acm_rb, list);
422         list_del(&buf->list);
423         spin_unlock_irqrestore(&acm->read_lock, flags);
424
425         dbg("acm_rx_tasklet: procesing buf 0x%p, size = %d", buf, buf->size);
426
427         if (tty) {
428                 spin_lock_irqsave(&acm->throttle_lock, flags);
429                 throttled = acm->throttle;
430                 spin_unlock_irqrestore(&acm->throttle_lock, flags);
431                 if (!throttled) {
432                         tty_buffer_request_room(tty, buf->size);
433                         tty_insert_flip_string(tty, buf->base, buf->size);
434                         tty_flip_buffer_push(tty);
435                 } else {
436                         tty_kref_put(tty);
437                         dbg("Throttling noticed");
438                         spin_lock_irqsave(&acm->read_lock, flags);
439                         list_add(&buf->list, &acm->filled_read_bufs);
440                         spin_unlock_irqrestore(&acm->read_lock, flags);
441                         return;
442                 }
443         }
444
445         spin_lock_irqsave(&acm->read_lock, flags);
446         list_add(&buf->list, &acm->spare_read_bufs);
447         spin_unlock_irqrestore(&acm->read_lock, flags);
448         goto next_buffer;
449
450 urbs:
451         tty_kref_put(tty);
452
453         while (!list_empty(&acm->spare_read_bufs)) {
454                 spin_lock_irqsave(&acm->read_lock, flags);
455                 if (list_empty(&acm->spare_read_urbs)) {
456                         acm->processing = 0;
457                         spin_unlock_irqrestore(&acm->read_lock, flags);
458                         return;
459                 }
460                 rcv = list_entry(acm->spare_read_urbs.next,
461                                  struct acm_ru, list);
462                 list_del(&rcv->list);
463                 spin_unlock_irqrestore(&acm->read_lock, flags);
464
465                 buf = list_entry(acm->spare_read_bufs.next,
466                                  struct acm_rb, list);
467                 list_del(&buf->list);
468
469                 rcv->buffer = buf;
470
471                 if (acm->is_int_ep)
472                         usb_fill_int_urb(rcv->urb, acm->dev,
473                                          acm->rx_endpoint,
474                                          buf->base,
475                                          acm->readsize,
476                                          acm_read_bulk, rcv, acm->bInterval);
477                 else
478                         usb_fill_bulk_urb(rcv->urb, acm->dev,
479                                           acm->rx_endpoint,
480                                           buf->base,
481                                           acm->readsize,
482                                           acm_read_bulk, rcv);
483                 rcv->urb->transfer_dma = buf->dma;
484                 rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
485
486                 /* This shouldn't kill the driver as unsuccessful URBs are
487                    returned to the free-urbs-pool and resubmited ASAP */
488                 spin_lock_irqsave(&acm->read_lock, flags);
489                 if (acm->susp_count ||
490                                 usb_submit_urb(rcv->urb, GFP_ATOMIC) < 0) {
491                         list_add(&buf->list, &acm->spare_read_bufs);
492                         list_add(&rcv->list, &acm->spare_read_urbs);
493                         acm->processing = 0;
494                         spin_unlock_irqrestore(&acm->read_lock, flags);
495                         return;
496                 } else {
497                         spin_unlock_irqrestore(&acm->read_lock, flags);
498                         dbg("acm_rx_tasklet: sending urb 0x%p, rcv 0x%p, buf 0x%p", rcv->urb, rcv, buf);
499                 }
500         }
501         spin_lock_irqsave(&acm->read_lock, flags);
502         acm->processing = 0;
503         spin_unlock_irqrestore(&acm->read_lock, flags);
504 }
505
506 /* data interface wrote those outgoing bytes */
507 static void acm_write_bulk(struct urb *urb)
508 {
509         struct acm_wb *wb = urb->context;
510         struct acm *acm = wb->instance;
511         unsigned long flags;
512
513         if (verbose || urb->status
514                         || (urb->actual_length != urb->transfer_buffer_length))
515                 dev_dbg(&acm->data->dev, "tx %d/%d bytes -- > %d\n",
516                         urb->actual_length,
517                         urb->transfer_buffer_length,
518                         urb->status);
519
520         spin_lock_irqsave(&acm->write_lock, flags);
521         acm_write_done(acm, wb);
522         spin_unlock_irqrestore(&acm->write_lock, flags);
523         if (ACM_READY(acm))
524                 schedule_work(&acm->work);
525         else
526                 wake_up_interruptible(&acm->drain_wait);
527 }
528
529 static void acm_softint(struct work_struct *work)
530 {
531         struct acm *acm = container_of(work, struct acm, work);
532         struct tty_struct *tty;
533
534         dev_vdbg(&acm->data->dev, "tx work\n");
535         if (!ACM_READY(acm))
536                 return;
537         tty = tty_port_tty_get(&acm->port);
538         if (!tty)
539                 return;
540         tty_wakeup(tty);
541         tty_kref_put(tty);
542 }
543
544 /*
545  * TTY handlers
546  */
547
548 static int acm_tty_open(struct tty_struct *tty, struct file *filp)
549 {
550         struct acm *acm;
551         int rv = -ENODEV;
552         int i;
553         dbg("Entering acm_tty_open.");
554
555         mutex_lock(&open_mutex);
556
557         acm = acm_table[tty->index];
558         if (!acm || !acm->dev)
559                 goto err_out;
560         else
561                 rv = 0;
562
563         set_bit(TTY_NO_WRITE_SPLIT, &tty->flags);
564
565         tty->driver_data = acm;
566         tty_port_tty_set(&acm->port, tty);
567
568         if (usb_autopm_get_interface(acm->control) < 0)
569                 goto early_bail;
570         else
571                 acm->control->needs_remote_wakeup = 1;
572
573         mutex_lock(&acm->mutex);
574         if (acm->port.count++) {
575                 usb_autopm_put_interface(acm->control);
576                 goto done;
577         }
578
579         acm->ctrlurb->dev = acm->dev;
580         if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
581                 dbg("usb_submit_urb(ctrl irq) failed");
582                 goto bail_out;
583         }
584
585         if (0 > acm_set_control(acm, acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS) &&
586             (acm->ctrl_caps & USB_CDC_CAP_LINE))
587                 goto full_bailout;
588
589         usb_autopm_put_interface(acm->control);
590
591         INIT_LIST_HEAD(&acm->spare_read_urbs);
592         INIT_LIST_HEAD(&acm->spare_read_bufs);
593         INIT_LIST_HEAD(&acm->filled_read_bufs);
594
595         for (i = 0; i < acm->rx_buflimit; i++)
596                 list_add(&(acm->ru[i].list), &acm->spare_read_urbs);
597         for (i = 0; i < acm->rx_buflimit; i++)
598                 list_add(&(acm->rb[i].list), &acm->spare_read_bufs);
599
600         acm->throttle = 0;
601
602         set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
603         rv = tty_port_block_til_ready(&acm->port, tty, filp);
604         tasklet_schedule(&acm->urb_task);
605 done:
606         mutex_unlock(&acm->mutex);
607 err_out:
608         mutex_unlock(&open_mutex);
609         return rv;
610
611 full_bailout:
612         usb_kill_urb(acm->ctrlurb);
613 bail_out:
614         usb_autopm_put_interface(acm->control);
615         acm->port.count--;
616         mutex_unlock(&acm->mutex);
617 early_bail:
618         mutex_unlock(&open_mutex);
619         tty_port_tty_set(&acm->port, NULL);
620         return -EIO;
621 }
622
623 static void acm_tty_unregister(struct acm *acm)
624 {
625         int i, nr;
626
627         nr = acm->rx_buflimit;
628         tty_unregister_device(acm_tty_driver, acm->minor);
629         usb_put_intf(acm->control);
630         acm_table[acm->minor] = NULL;
631         usb_free_urb(acm->ctrlurb);
632         for (i = 0; i < ACM_NW; i++)
633                 usb_free_urb(acm->wb[i].urb);
634         for (i = 0; i < nr; i++)
635                 usb_free_urb(acm->ru[i].urb);
636         kfree(acm->country_codes);
637         kfree(acm);
638 }
639
640 static int acm_tty_chars_in_buffer(struct tty_struct *tty);
641
642 static void acm_port_down(struct acm *acm, int drain)
643 {
644         int i, nr = acm->rx_buflimit;
645         mutex_lock(&open_mutex);
646         if (acm->dev) {
647                 usb_autopm_get_interface(acm->control);
648                 acm_set_control(acm, acm->ctrlout = 0);
649                 /* try letting the last writes drain naturally */
650                 if (drain) {
651                         wait_event_interruptible_timeout(acm->drain_wait,
652                                 (ACM_NW == acm_wb_is_avail(acm)) || !acm->dev,
653                                         ACM_CLOSE_TIMEOUT * HZ);
654                 }
655                 usb_kill_urb(acm->ctrlurb);
656                 for (i = 0; i < ACM_NW; i++)
657                         usb_kill_urb(acm->wb[i].urb);
658                 tasklet_disable(&acm->urb_task);
659                 for (i = 0; i < nr; i++)
660                         usb_kill_urb(acm->ru[i].urb);
661                 tasklet_enable(&acm->urb_task);
662                 acm->control->needs_remote_wakeup = 0;
663                 usb_autopm_put_interface(acm->control);
664         }
665         mutex_unlock(&open_mutex);
666 }
667
668 static void acm_tty_hangup(struct tty_struct *tty)
669 {
670         struct acm *acm = tty->driver_data;
671         tty_port_hangup(&acm->port);
672         acm_port_down(acm, 0);
673 }
674
675 static void acm_tty_close(struct tty_struct *tty, struct file *filp)
676 {
677         struct acm *acm = tty->driver_data;
678
679         /* Perform the closing process and see if we need to do the hardware
680            shutdown */
681         if (!acm)
682                 return;
683         if (tty_port_close_start(&acm->port, tty, filp) == 0) {
684                 mutex_lock(&open_mutex);
685                 if (!acm->dev) {
686                         tty_port_tty_set(&acm->port, NULL);
687                         acm_tty_unregister(acm);
688                         tty->driver_data = NULL;
689                 }
690                 mutex_unlock(&open_mutex);
691                 return;
692         }
693         acm_port_down(acm, 0);
694         tty_port_close_end(&acm->port, tty);
695         tty_port_tty_set(&acm->port, NULL);
696 }
697
698 static int acm_tty_write(struct tty_struct *tty,
699                                         const unsigned char *buf, int count)
700 {
701         struct acm *acm = tty->driver_data;
702         int stat;
703         unsigned long flags;
704         int wbn;
705         struct acm_wb *wb;
706
707         dbg("Entering acm_tty_write to write %d bytes,", count);
708
709         if (!ACM_READY(acm))
710                 return -EINVAL;
711         if (!count)
712                 return 0;
713
714         spin_lock_irqsave(&acm->write_lock, flags);
715         wbn = acm_wb_alloc(acm);
716         if (wbn < 0) {
717                 spin_unlock_irqrestore(&acm->write_lock, flags);
718                 return 0;
719         }
720         wb = &acm->wb[wbn];
721
722         count = (count > acm->writesize) ? acm->writesize : count;
723         dbg("Get %d bytes...", count);
724         memcpy(wb->buf, buf, count);
725         wb->len = count;
726         spin_unlock_irqrestore(&acm->write_lock, flags);
727
728         stat = acm_write_start(acm, wbn);
729         if (stat < 0)
730                 return stat;
731         return count;
732 }
733
734 static int acm_tty_write_room(struct tty_struct *tty)
735 {
736         struct acm *acm = tty->driver_data;
737         if (!ACM_READY(acm))
738                 return -EINVAL;
739         /*
740          * Do not let the line discipline to know that we have a reserve,
741          * or it might get too enthusiastic.
742          */
743         return acm_wb_is_avail(acm) ? acm->writesize : 0;
744 }
745
746 static int acm_tty_chars_in_buffer(struct tty_struct *tty)
747 {
748         struct acm *acm = tty->driver_data;
749         if (!ACM_READY(acm))
750                 return 0;
751         /*
752          * This is inaccurate (overcounts), but it works.
753          */
754         return (ACM_NW - acm_wb_is_avail(acm)) * acm->writesize;
755 }
756
757 static void acm_tty_throttle(struct tty_struct *tty)
758 {
759         struct acm *acm = tty->driver_data;
760         if (!ACM_READY(acm))
761                 return;
762         spin_lock_bh(&acm->throttle_lock);
763         acm->throttle = 1;
764         spin_unlock_bh(&acm->throttle_lock);
765 }
766
767 static void acm_tty_unthrottle(struct tty_struct *tty)
768 {
769         struct acm *acm = tty->driver_data;
770         if (!ACM_READY(acm))
771                 return;
772         spin_lock_bh(&acm->throttle_lock);
773         acm->throttle = 0;
774         spin_unlock_bh(&acm->throttle_lock);
775         tasklet_schedule(&acm->urb_task);
776 }
777
778 static int acm_tty_break_ctl(struct tty_struct *tty, int state)
779 {
780         struct acm *acm = tty->driver_data;
781         int retval;
782         if (!ACM_READY(acm))
783                 return -EINVAL;
784         retval = acm_send_break(acm, state ? 0xffff : 0);
785         if (retval < 0)
786                 dbg("send break failed");
787         return retval;
788 }
789
790 static int acm_tty_tiocmget(struct tty_struct *tty, struct file *file)
791 {
792         struct acm *acm = tty->driver_data;
793
794         if (!ACM_READY(acm))
795                 return -EINVAL;
796
797         return (acm->ctrlout & ACM_CTRL_DTR ? TIOCM_DTR : 0) |
798                (acm->ctrlout & ACM_CTRL_RTS ? TIOCM_RTS : 0) |
799                (acm->ctrlin  & ACM_CTRL_DSR ? TIOCM_DSR : 0) |
800                (acm->ctrlin  & ACM_CTRL_RI  ? TIOCM_RI  : 0) |
801                (acm->ctrlin  & ACM_CTRL_DCD ? TIOCM_CD  : 0) |
802                TIOCM_CTS;
803 }
804
805 static int acm_tty_tiocmset(struct tty_struct *tty, struct file *file,
806                             unsigned int set, unsigned int clear)
807 {
808         struct acm *acm = tty->driver_data;
809         unsigned int newctrl;
810
811         if (!ACM_READY(acm))
812                 return -EINVAL;
813
814         newctrl = acm->ctrlout;
815         set = (set & TIOCM_DTR ? ACM_CTRL_DTR : 0) |
816                                         (set & TIOCM_RTS ? ACM_CTRL_RTS : 0);
817         clear = (clear & TIOCM_DTR ? ACM_CTRL_DTR : 0) |
818                                         (clear & TIOCM_RTS ? ACM_CTRL_RTS : 0);
819
820         newctrl = (newctrl & ~clear) | set;
821
822         if (acm->ctrlout == newctrl)
823                 return 0;
824         return acm_set_control(acm, acm->ctrlout = newctrl);
825 }
826
827 static int acm_tty_ioctl(struct tty_struct *tty, struct file *file,
828                                         unsigned int cmd, unsigned long arg)
829 {
830         struct acm *acm = tty->driver_data;
831
832         if (!ACM_READY(acm))
833                 return -EINVAL;
834
835         return -ENOIOCTLCMD;
836 }
837
838 static const __u32 acm_tty_speed[] = {
839         0, 50, 75, 110, 134, 150, 200, 300, 600,
840         1200, 1800, 2400, 4800, 9600, 19200, 38400,
841         57600, 115200, 230400, 460800, 500000, 576000,
842         921600, 1000000, 1152000, 1500000, 2000000,
843         2500000, 3000000, 3500000, 4000000
844 };
845
846 static const __u8 acm_tty_size[] = {
847         5, 6, 7, 8
848 };
849
850 static void acm_tty_set_termios(struct tty_struct *tty,
851                                                 struct ktermios *termios_old)
852 {
853         struct acm *acm = tty->driver_data;
854         struct ktermios *termios = tty->termios;
855         struct usb_cdc_line_coding newline;
856         int newctrl = acm->ctrlout;
857
858         if (!ACM_READY(acm))
859                 return;
860
861         newline.dwDTERate = cpu_to_le32(tty_get_baud_rate(tty));
862         newline.bCharFormat = termios->c_cflag & CSTOPB ? 2 : 0;
863         newline.bParityType = termios->c_cflag & PARENB ?
864                                 (termios->c_cflag & PARODD ? 1 : 2) +
865                                 (termios->c_cflag & CMSPAR ? 2 : 0) : 0;
866         newline.bDataBits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4];
867         /* FIXME: Needs to clear unsupported bits in the termios */
868         acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
869
870         if (!newline.dwDTERate) {
871                 newline.dwDTERate = acm->line.dwDTERate;
872                 newctrl &= ~ACM_CTRL_DTR;
873         } else
874                 newctrl |=  ACM_CTRL_DTR;
875
876         if (newctrl != acm->ctrlout)
877                 acm_set_control(acm, acm->ctrlout = newctrl);
878
879         if (memcmp(&acm->line, &newline, sizeof newline)) {
880                 memcpy(&acm->line, &newline, sizeof newline);
881                 dbg("set line: %d %d %d %d", le32_to_cpu(newline.dwDTERate),
882                         newline.bCharFormat, newline.bParityType,
883                         newline.bDataBits);
884                 acm_set_line(acm, &acm->line);
885         }
886 }
887
888 /*
889  * USB probe and disconnect routines.
890  */
891
892 /* Little helpers: write/read buffers free */
893 static void acm_write_buffers_free(struct acm *acm)
894 {
895         int i;
896         struct acm_wb *wb;
897         struct usb_device *usb_dev = interface_to_usbdev(acm->control);
898
899         for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++)
900                 usb_buffer_free(usb_dev, acm->writesize, wb->buf, wb->dmah);
901 }
902
903 static void acm_read_buffers_free(struct acm *acm)
904 {
905         struct usb_device *usb_dev = interface_to_usbdev(acm->control);
906         int i, n = acm->rx_buflimit;
907
908         for (i = 0; i < n; i++)
909                 usb_buffer_free(usb_dev, acm->readsize,
910                                         acm->rb[i].base, acm->rb[i].dma);
911 }
912
913 /* Little helper: write buffers allocate */
914 static int acm_write_buffers_alloc(struct acm *acm)
915 {
916         int i;
917         struct acm_wb *wb;
918
919         for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++) {
920                 wb->buf = usb_buffer_alloc(acm->dev, acm->writesize, GFP_KERNEL,
921                     &wb->dmah);
922                 if (!wb->buf) {
923                         while (i != 0) {
924                                 --i;
925                                 --wb;
926                                 usb_buffer_free(acm->dev, acm->writesize,
927                                     wb->buf, wb->dmah);
928                         }
929                         return -ENOMEM;
930                 }
931         }
932         return 0;
933 }
934
935 static int acm_probe(struct usb_interface *intf,
936                      const struct usb_device_id *id)
937 {
938         struct usb_cdc_union_desc *union_header = NULL;
939         struct usb_cdc_country_functional_desc *cfd = NULL;
940         unsigned char *buffer = intf->altsetting->extra;
941         int buflen = intf->altsetting->extralen;
942         struct usb_interface *control_interface;
943         struct usb_interface *data_interface;
944         struct usb_endpoint_descriptor *epctrl = NULL;
945         struct usb_endpoint_descriptor *epread = NULL;
946         struct usb_endpoint_descriptor *epwrite = NULL;
947         struct usb_device *usb_dev = interface_to_usbdev(intf);
948         struct acm *acm;
949         int minor;
950         int ctrlsize, readsize;
951         u8 *buf;
952         u8 ac_management_function = 0;
953         u8 call_management_function = 0;
954         int call_interface_num = -1;
955         int data_interface_num;
956         unsigned long quirks;
957         int num_rx_buf;
958         int i;
959         int combined_interfaces = 0;
960
961         /* normal quirks */
962         quirks = (unsigned long)id->driver_info;
963         num_rx_buf = (quirks == SINGLE_RX_URB) ? 1 : ACM_NR;
964
965         /* handle quirks deadly to normal probing*/
966         if (quirks == NO_UNION_NORMAL) {
967                 data_interface = usb_ifnum_to_if(usb_dev, 1);
968                 control_interface = usb_ifnum_to_if(usb_dev, 0);
969                 goto skip_normal_probe;
970         }
971
972         /* normal probing*/
973         if (!buffer) {
974                 dev_err(&intf->dev, "Weird descriptor references\n");
975                 return -EINVAL;
976         }
977
978         if (!buflen) {
979                 if (intf->cur_altsetting->endpoint &&
980                                 intf->cur_altsetting->endpoint->extralen &&
981                                 intf->cur_altsetting->endpoint->extra) {
982                         dev_dbg(&intf->dev,
983                                 "Seeking extra descriptors on endpoint\n");
984                         buflen = intf->cur_altsetting->endpoint->extralen;
985                         buffer = intf->cur_altsetting->endpoint->extra;
986                 } else {
987                         dev_err(&intf->dev,
988                                 "Zero length descriptor references\n");
989                         return -EINVAL;
990                 }
991         }
992
993         while (buflen > 0) {
994                 if (buffer[1] != USB_DT_CS_INTERFACE) {
995                         dev_err(&intf->dev, "skipping garbage\n");
996                         goto next_desc;
997                 }
998
999                 switch (buffer[2]) {
1000                 case USB_CDC_UNION_TYPE: /* we've found it */
1001                         if (union_header) {
1002                                 dev_err(&intf->dev, "More than one "
1003                                         "union descriptor, skipping ...\n");
1004                                 goto next_desc;
1005                         }
1006                         union_header = (struct usb_cdc_union_desc *)buffer;
1007                         break;
1008                 case USB_CDC_COUNTRY_TYPE: /* export through sysfs*/
1009                         cfd = (struct usb_cdc_country_functional_desc *)buffer;
1010                         break;
1011                 case USB_CDC_HEADER_TYPE: /* maybe check version */
1012                         break; /* for now we ignore it */
1013                 case USB_CDC_ACM_TYPE:
1014                         ac_management_function = buffer[3];
1015                         break;
1016                 case USB_CDC_CALL_MANAGEMENT_TYPE:
1017                         call_management_function = buffer[3];
1018                         call_interface_num = buffer[4];
1019                         if ((call_management_function & 3) != 3)
1020                                 dev_err(&intf->dev, "This device cannot do calls on its own. It is not a modem.\n");
1021                         break;
1022                 default:
1023                         /* there are LOTS more CDC descriptors that
1024                          * could legitimately be found here.
1025                          */
1026                         dev_dbg(&intf->dev, "Ignoring descriptor: "
1027                                         "type %02x, length %d\n",
1028                                         buffer[2], buffer[0]);
1029                         break;
1030                 }
1031 next_desc:
1032                 buflen -= buffer[0];
1033                 buffer += buffer[0];
1034         }
1035
1036         if (!union_header) {
1037                 if (call_interface_num > 0) {
1038                         dev_dbg(&intf->dev, "No union descriptor, using call management descriptor\n");
1039                         data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num));
1040                         control_interface = intf;
1041                 } else {
1042                         if (intf->cur_altsetting->desc.bNumEndpoints != 3) {
1043                                 dev_dbg(&intf->dev,"No union descriptor, giving up\n");
1044                                 return -ENODEV;
1045                         } else {
1046                                 dev_warn(&intf->dev,"No union descriptor, testing for castrated device\n");
1047                                 combined_interfaces = 1;
1048                                 control_interface = data_interface = intf;
1049                                 goto look_for_collapsed_interface;
1050                         }
1051                 }
1052         } else {
1053                 control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
1054                 data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0));
1055                 if (!control_interface || !data_interface) {
1056                         dev_dbg(&intf->dev, "no interfaces\n");
1057                         return -ENODEV;
1058                 }
1059         }
1060
1061         if (data_interface_num != call_interface_num)
1062                 dev_dbg(&intf->dev, "Separate call control interface. That is not fully supported.\n");
1063
1064         if (control_interface == data_interface) {
1065                 /* some broken devices designed for windows work this way */
1066                 dev_warn(&intf->dev,"Control and data interfaces are not separated!\n");
1067                 combined_interfaces = 1;
1068                 /* a popular other OS doesn't use it */
1069                 quirks |= NO_CAP_LINE;
1070                 if (data_interface->cur_altsetting->desc.bNumEndpoints != 3) {
1071                         dev_err(&intf->dev, "This needs exactly 3 endpoints\n");
1072                         return -EINVAL;
1073                 }
1074 look_for_collapsed_interface:
1075                 for (i = 0; i < 3; i++) {
1076                         struct usb_endpoint_descriptor *ep;
1077                         ep = &data_interface->cur_altsetting->endpoint[i].desc;
1078
1079                         if (usb_endpoint_is_int_in(ep))
1080                                 epctrl = ep;
1081                         else if (usb_endpoint_is_bulk_out(ep))
1082                                 epwrite = ep;
1083                         else if (usb_endpoint_is_bulk_in(ep))
1084                                 epread = ep;
1085                         else
1086                                 return -EINVAL;
1087                 }
1088                 if (!epctrl || !epread || !epwrite)
1089                         return -ENODEV;
1090                 else
1091                         goto made_compressed_probe;
1092         }
1093
1094 skip_normal_probe:
1095
1096         /*workaround for switched interfaces */
1097         if (data_interface->cur_altsetting->desc.bInterfaceClass
1098                                                 != CDC_DATA_INTERFACE_TYPE) {
1099                 if (control_interface->cur_altsetting->desc.bInterfaceClass
1100                                                 == CDC_DATA_INTERFACE_TYPE) {
1101                         struct usb_interface *t;
1102                         dev_dbg(&intf->dev,
1103                                 "Your device has switched interfaces.\n");
1104                         t = control_interface;
1105                         control_interface = data_interface;
1106                         data_interface = t;
1107                 } else {
1108                         return -EINVAL;
1109                 }
1110         }
1111
1112         /* Accept probe requests only for the control interface */
1113         if (!combined_interfaces && intf != control_interface)
1114                 return -ENODEV;
1115
1116         if (!combined_interfaces && usb_interface_claimed(data_interface)) {
1117                 /* valid in this context */
1118                 dev_dbg(&intf->dev, "The data interface isn't available\n");
1119                 return -EBUSY;
1120         }
1121
1122
1123         if (data_interface->cur_altsetting->desc.bNumEndpoints < 2)
1124                 return -EINVAL;
1125
1126         epctrl = &control_interface->cur_altsetting->endpoint[0].desc;
1127         epread = &data_interface->cur_altsetting->endpoint[0].desc;
1128         epwrite = &data_interface->cur_altsetting->endpoint[1].desc;
1129
1130
1131         /* workaround for switched endpoints */
1132         if (!usb_endpoint_dir_in(epread)) {
1133                 /* descriptors are swapped */
1134                 struct usb_endpoint_descriptor *t;
1135                 dev_dbg(&intf->dev,
1136                         "The data interface has switched endpoints\n");
1137                 t = epread;
1138                 epread = epwrite;
1139                 epwrite = t;
1140         }
1141 made_compressed_probe:
1142         dbg("interfaces are valid");
1143         for (minor = 0; minor < ACM_TTY_MINORS && acm_table[minor]; minor++);
1144
1145         if (minor == ACM_TTY_MINORS) {
1146                 dev_err(&intf->dev, "no more free acm devices\n");
1147                 return -ENODEV;
1148         }
1149
1150         acm = kzalloc(sizeof(struct acm), GFP_KERNEL);
1151         if (acm == NULL) {
1152                 dev_dbg(&intf->dev, "out of memory (acm kzalloc)\n");
1153                 goto alloc_fail;
1154         }
1155
1156         ctrlsize = le16_to_cpu(epctrl->wMaxPacketSize);
1157         readsize = le16_to_cpu(epread->wMaxPacketSize) *
1158                                 (quirks == SINGLE_RX_URB ? 1 : 2);
1159         acm->combined_interfaces = combined_interfaces;
1160         acm->writesize = le16_to_cpu(epwrite->wMaxPacketSize) * 20;
1161         acm->control = control_interface;
1162         acm->data = data_interface;
1163         acm->minor = minor;
1164         acm->dev = usb_dev;
1165         acm->ctrl_caps = ac_management_function;
1166         if (quirks & NO_CAP_LINE)
1167                 acm->ctrl_caps &= ~USB_CDC_CAP_LINE;
1168         acm->ctrlsize = ctrlsize;
1169         acm->readsize = readsize;
1170         acm->rx_buflimit = num_rx_buf;
1171         acm->urb_task.func = acm_rx_tasklet;
1172         acm->urb_task.data = (unsigned long) acm;
1173         INIT_WORK(&acm->work, acm_softint);
1174         init_waitqueue_head(&acm->drain_wait);
1175         spin_lock_init(&acm->throttle_lock);
1176         spin_lock_init(&acm->write_lock);
1177         spin_lock_init(&acm->read_lock);
1178         mutex_init(&acm->mutex);
1179         acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
1180         acm->is_int_ep = usb_endpoint_xfer_int(epread);
1181         if (acm->is_int_ep)
1182                 acm->bInterval = epread->bInterval;
1183         tty_port_init(&acm->port);
1184         acm->port.ops = &acm_port_ops;
1185
1186         buf = usb_buffer_alloc(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
1187         if (!buf) {
1188                 dev_dbg(&intf->dev, "out of memory (ctrl buffer alloc)\n");
1189                 goto alloc_fail2;
1190         }
1191         acm->ctrl_buffer = buf;
1192
1193         if (acm_write_buffers_alloc(acm) < 0) {
1194                 dev_dbg(&intf->dev, "out of memory (write buffer alloc)\n");
1195                 goto alloc_fail4;
1196         }
1197
1198         acm->ctrlurb = usb_alloc_urb(0, GFP_KERNEL);
1199         if (!acm->ctrlurb) {
1200                 dev_dbg(&intf->dev, "out of memory (ctrlurb kmalloc)\n");
1201                 goto alloc_fail5;
1202         }
1203         for (i = 0; i < num_rx_buf; i++) {
1204                 struct acm_ru *rcv = &(acm->ru[i]);
1205
1206                 rcv->urb = usb_alloc_urb(0, GFP_KERNEL);
1207                 if (rcv->urb == NULL) {
1208                         dev_dbg(&intf->dev,
1209                                 "out of memory (read urbs usb_alloc_urb)\n");
1210                         goto alloc_fail6;
1211                 }
1212
1213                 rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1214                 rcv->instance = acm;
1215         }
1216         for (i = 0; i < num_rx_buf; i++) {
1217                 struct acm_rb *rb = &(acm->rb[i]);
1218
1219                 rb->base = usb_buffer_alloc(acm->dev, readsize,
1220                                 GFP_KERNEL, &rb->dma);
1221                 if (!rb->base) {
1222                         dev_dbg(&intf->dev,
1223                                 "out of memory (read bufs usb_buffer_alloc)\n");
1224                         goto alloc_fail7;
1225                 }
1226         }
1227         for (i = 0; i < ACM_NW; i++) {
1228                 struct acm_wb *snd = &(acm->wb[i]);
1229
1230                 snd->urb = usb_alloc_urb(0, GFP_KERNEL);
1231                 if (snd->urb == NULL) {
1232                         dev_dbg(&intf->dev,
1233                                 "out of memory (write urbs usb_alloc_urb)");
1234                         goto alloc_fail8;
1235                 }
1236
1237                 if (usb_endpoint_xfer_int(epwrite))
1238                         usb_fill_int_urb(snd->urb, usb_dev,
1239                                 usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
1240                                 NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval);
1241                 else
1242                         usb_fill_bulk_urb(snd->urb, usb_dev,
1243                                 usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
1244                                 NULL, acm->writesize, acm_write_bulk, snd);
1245                 snd->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1246                 snd->instance = acm;
1247         }
1248
1249         usb_set_intfdata(intf, acm);
1250
1251         i = device_create_file(&intf->dev, &dev_attr_bmCapabilities);
1252         if (i < 0)
1253                 goto alloc_fail8;
1254
1255         if (cfd) { /* export the country data */
1256                 acm->country_codes = kmalloc(cfd->bLength - 4, GFP_KERNEL);
1257                 if (!acm->country_codes)
1258                         goto skip_countries;
1259                 acm->country_code_size = cfd->bLength - 4;
1260                 memcpy(acm->country_codes, (u8 *)&cfd->wCountyCode0,
1261                                                         cfd->bLength - 4);
1262                 acm->country_rel_date = cfd->iCountryCodeRelDate;
1263
1264                 i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
1265                 if (i < 0) {
1266                         kfree(acm->country_codes);
1267                         goto skip_countries;
1268                 }
1269
1270                 i = device_create_file(&intf->dev,
1271                                                 &dev_attr_iCountryCodeRelDate);
1272                 if (i < 0) {
1273                         device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
1274                         kfree(acm->country_codes);
1275                         goto skip_countries;
1276                 }
1277         }
1278
1279 skip_countries:
1280         usb_fill_int_urb(acm->ctrlurb, usb_dev,
1281                          usb_rcvintpipe(usb_dev, epctrl->bEndpointAddress),
1282                          acm->ctrl_buffer, ctrlsize, acm_ctrl_irq, acm,
1283                          /* works around buggy devices */
1284                          epctrl->bInterval ? epctrl->bInterval : 0xff);
1285         acm->ctrlurb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1286         acm->ctrlurb->transfer_dma = acm->ctrl_dma;
1287
1288         dev_info(&intf->dev, "ttyACM%d: USB ACM device\n", minor);
1289
1290         acm_set_control(acm, acm->ctrlout);
1291
1292         acm->line.dwDTERate = cpu_to_le32(9600);
1293         acm->line.bDataBits = 8;
1294         acm_set_line(acm, &acm->line);
1295
1296         usb_driver_claim_interface(&acm_driver, data_interface, acm);
1297         usb_set_intfdata(data_interface, acm);
1298
1299         usb_get_intf(control_interface);
1300         tty_register_device(acm_tty_driver, minor, &control_interface->dev);
1301
1302         acm_table[minor] = acm;
1303
1304         return 0;
1305 alloc_fail8:
1306         for (i = 0; i < ACM_NW; i++)
1307                 usb_free_urb(acm->wb[i].urb);
1308 alloc_fail7:
1309         acm_read_buffers_free(acm);
1310 alloc_fail6:
1311         for (i = 0; i < num_rx_buf; i++)
1312                 usb_free_urb(acm->ru[i].urb);
1313         usb_free_urb(acm->ctrlurb);
1314 alloc_fail5:
1315         acm_write_buffers_free(acm);
1316 alloc_fail4:
1317         usb_buffer_free(usb_dev, ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
1318 alloc_fail2:
1319         kfree(acm);
1320 alloc_fail:
1321         return -ENOMEM;
1322 }
1323
1324 static void stop_data_traffic(struct acm *acm)
1325 {
1326         int i;
1327         dbg("Entering stop_data_traffic");
1328
1329         tasklet_disable(&acm->urb_task);
1330
1331         usb_kill_urb(acm->ctrlurb);
1332         for (i = 0; i < ACM_NW; i++)
1333                 usb_kill_urb(acm->wb[i].urb);
1334         for (i = 0; i < acm->rx_buflimit; i++)
1335                 usb_kill_urb(acm->ru[i].urb);
1336
1337         tasklet_enable(&acm->urb_task);
1338
1339         cancel_work_sync(&acm->work);
1340 }
1341
1342 static void acm_disconnect(struct usb_interface *intf)
1343 {
1344         struct acm *acm = usb_get_intfdata(intf);
1345         struct usb_device *usb_dev = interface_to_usbdev(intf);
1346         struct tty_struct *tty;
1347
1348         /* sibling interface is already cleaning up */
1349         if (!acm)
1350                 return;
1351
1352         mutex_lock(&open_mutex);
1353         if (acm->country_codes) {
1354                 device_remove_file(&acm->control->dev,
1355                                 &dev_attr_wCountryCodes);
1356                 device_remove_file(&acm->control->dev,
1357                                 &dev_attr_iCountryCodeRelDate);
1358         }
1359         device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
1360         acm->dev = NULL;
1361         usb_set_intfdata(acm->control, NULL);
1362         usb_set_intfdata(acm->data, NULL);
1363
1364         stop_data_traffic(acm);
1365
1366         acm_write_buffers_free(acm);
1367         usb_buffer_free(usb_dev, acm->ctrlsize, acm->ctrl_buffer,
1368                                                                 acm->ctrl_dma);
1369         acm_read_buffers_free(acm);
1370
1371         if (!acm->combined_interfaces)
1372                 usb_driver_release_interface(&acm_driver, intf == acm->control ?
1373                                         acm->data : acm->control);
1374
1375         if (acm->port.count == 0) {
1376                 acm_tty_unregister(acm);
1377                 mutex_unlock(&open_mutex);
1378                 return;
1379         }
1380
1381         mutex_unlock(&open_mutex);
1382         tty = tty_port_tty_get(&acm->port);
1383         if (tty) {
1384                 tty_hangup(tty);
1385                 tty_kref_put(tty);
1386         }
1387 }
1388
1389 #ifdef CONFIG_PM
1390 static int acm_suspend(struct usb_interface *intf, pm_message_t message)
1391 {
1392         struct acm *acm = usb_get_intfdata(intf);
1393         int cnt;
1394
1395         if (message.event & PM_EVENT_AUTO) {
1396                 int b;
1397
1398                 spin_lock_irq(&acm->read_lock);
1399                 spin_lock(&acm->write_lock);
1400                 b = acm->processing + acm->transmitting;
1401                 spin_unlock(&acm->write_lock);
1402                 spin_unlock_irq(&acm->read_lock);
1403                 if (b)
1404                         return -EBUSY;
1405         }
1406
1407         spin_lock_irq(&acm->read_lock);
1408         spin_lock(&acm->write_lock);
1409         cnt = acm->susp_count++;
1410         spin_unlock(&acm->write_lock);
1411         spin_unlock_irq(&acm->read_lock);
1412
1413         if (cnt)
1414                 return 0;
1415         /*
1416         we treat opened interfaces differently,
1417         we must guard against open
1418         */
1419         mutex_lock(&acm->mutex);
1420
1421         if (acm->port.count)
1422                 stop_data_traffic(acm);
1423
1424         mutex_unlock(&acm->mutex);
1425         return 0;
1426 }
1427
1428 static int acm_resume(struct usb_interface *intf)
1429 {
1430         struct acm *acm = usb_get_intfdata(intf);
1431         struct acm_wb *wb;
1432         int rv = 0;
1433         int cnt;
1434
1435         spin_lock_irq(&acm->read_lock);
1436         acm->susp_count -= 1;
1437         cnt = acm->susp_count;
1438         spin_unlock_irq(&acm->read_lock);
1439
1440         if (cnt)
1441                 return 0;
1442
1443         mutex_lock(&acm->mutex);
1444         if (acm->port.count) {
1445                 rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO);
1446
1447                 spin_lock_irq(&acm->write_lock);
1448                 if (acm->delayed_wb) {
1449                         wb = acm->delayed_wb;
1450                         acm->delayed_wb = NULL;
1451                         spin_unlock_irq(&acm->write_lock);
1452                         acm_start_wb(acm, wb);
1453                 } else {
1454                         spin_unlock_irq(&acm->write_lock);
1455                 }
1456
1457                 /*
1458                  * delayed error checking because we must
1459                  * do the write path at all cost
1460                  */
1461                 if (rv < 0)
1462                         goto err_out;
1463
1464                 tasklet_schedule(&acm->urb_task);
1465         }
1466
1467 err_out:
1468         mutex_unlock(&acm->mutex);
1469         return rv;
1470 }
1471
1472 #endif /* CONFIG_PM */
1473
1474 #define NOKIA_PCSUITE_ACM_INFO(x) \
1475                 USB_DEVICE_AND_INTERFACE_INFO(0x0421, x, \
1476                 USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, \
1477                 USB_CDC_ACM_PROTO_VENDOR)
1478
1479 #define SAMSUNG_PCSUITE_ACM_INFO(x) \
1480                 USB_DEVICE_AND_INTERFACE_INFO(0x04e7, x, \
1481                 USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, \
1482                 USB_CDC_ACM_PROTO_VENDOR)
1483
1484 /*
1485  * USB driver structure.
1486  */
1487
1488 static struct usb_device_id acm_ids[] = {
1489         /* quirky and broken devices */
1490         { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
1491         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1492         },
1493         { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
1494         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1495         },
1496         { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */
1497         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1498         },
1499         { USB_DEVICE(0x0482, 0x0203), /* KYOCERA AH-K3001V */
1500         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1501         },
1502         { USB_DEVICE(0x079b, 0x000f), /* BT On-Air USB MODEM */
1503         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1504         },
1505         { USB_DEVICE(0x0ace, 0x1602), /* ZyDAS 56K USB MODEM */
1506         .driver_info = SINGLE_RX_URB,
1507         },
1508         { USB_DEVICE(0x0ace, 0x1608), /* ZyDAS 56K USB MODEM */
1509         .driver_info = SINGLE_RX_URB, /* firmware bug */
1510         },
1511         { USB_DEVICE(0x0ace, 0x1611), /* ZyDAS 56K USB MODEM - new version */
1512         .driver_info = SINGLE_RX_URB, /* firmware bug */
1513         },
1514         { USB_DEVICE(0x22b8, 0x7000), /* Motorola Q Phone */
1515         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1516         },
1517         { USB_DEVICE(0x0803, 0x3095), /* Zoom Telephonics Model 3095F USB MODEM */
1518         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1519         },
1520         { USB_DEVICE(0x0572, 0x1321), /* Conexant USB MODEM CX93010 */
1521         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1522         },
1523         { USB_DEVICE(0x0572, 0x1324), /* Conexant USB MODEM RD02-D400 */
1524         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1525         },
1526         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
1527         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1528         },
1529         { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
1530         },
1531         { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
1532         .driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
1533                                            data interface instead of
1534                                            communications interface.
1535                                            Maybe we should define a new
1536                                            quirk for this. */
1537         },
1538         { USB_DEVICE(0x1bbb, 0x0003), /* Alcatel OT-I650 */
1539         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
1540         },
1541         { USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
1542         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
1543         },
1544
1545         /* Nokia S60 phones expose two ACM channels. The first is
1546          * a modem and is picked up by the standard AT-command
1547          * information below. The second is 'vendor-specific' but
1548          * is treated as a serial device at the S60 end, so we want
1549          * to expose it on Linux too. */
1550         { NOKIA_PCSUITE_ACM_INFO(0x042D), }, /* Nokia 3250 */
1551         { NOKIA_PCSUITE_ACM_INFO(0x04D8), }, /* Nokia 5500 Sport */
1552         { NOKIA_PCSUITE_ACM_INFO(0x04C9), }, /* Nokia E50 */
1553         { NOKIA_PCSUITE_ACM_INFO(0x0419), }, /* Nokia E60 */
1554         { NOKIA_PCSUITE_ACM_INFO(0x044D), }, /* Nokia E61 */
1555         { NOKIA_PCSUITE_ACM_INFO(0x0001), }, /* Nokia E61i */
1556         { NOKIA_PCSUITE_ACM_INFO(0x0475), }, /* Nokia E62 */
1557         { NOKIA_PCSUITE_ACM_INFO(0x0508), }, /* Nokia E65 */
1558         { NOKIA_PCSUITE_ACM_INFO(0x0418), }, /* Nokia E70 */
1559         { NOKIA_PCSUITE_ACM_INFO(0x0425), }, /* Nokia N71 */
1560         { NOKIA_PCSUITE_ACM_INFO(0x0486), }, /* Nokia N73 */
1561         { NOKIA_PCSUITE_ACM_INFO(0x04DF), }, /* Nokia N75 */
1562         { NOKIA_PCSUITE_ACM_INFO(0x000e), }, /* Nokia N77 */
1563         { NOKIA_PCSUITE_ACM_INFO(0x0445), }, /* Nokia N80 */
1564         { NOKIA_PCSUITE_ACM_INFO(0x042F), }, /* Nokia N91 & N91 8GB */
1565         { NOKIA_PCSUITE_ACM_INFO(0x048E), }, /* Nokia N92 */
1566         { NOKIA_PCSUITE_ACM_INFO(0x0420), }, /* Nokia N93 */
1567         { NOKIA_PCSUITE_ACM_INFO(0x04E6), }, /* Nokia N93i  */
1568         { NOKIA_PCSUITE_ACM_INFO(0x04B2), }, /* Nokia 5700 XpressMusic */
1569         { NOKIA_PCSUITE_ACM_INFO(0x0134), }, /* Nokia 6110 Navigator (China) */
1570         { NOKIA_PCSUITE_ACM_INFO(0x046E), }, /* Nokia 6110 Navigator */
1571         { NOKIA_PCSUITE_ACM_INFO(0x002f), }, /* Nokia 6120 classic &  */
1572         { NOKIA_PCSUITE_ACM_INFO(0x0088), }, /* Nokia 6121 classic */
1573         { NOKIA_PCSUITE_ACM_INFO(0x00fc), }, /* Nokia 6124 classic */
1574         { NOKIA_PCSUITE_ACM_INFO(0x0042), }, /* Nokia E51 */
1575         { NOKIA_PCSUITE_ACM_INFO(0x00b0), }, /* Nokia E66 */
1576         { NOKIA_PCSUITE_ACM_INFO(0x00ab), }, /* Nokia E71 */
1577         { NOKIA_PCSUITE_ACM_INFO(0x0481), }, /* Nokia N76 */
1578         { NOKIA_PCSUITE_ACM_INFO(0x0007), }, /* Nokia N81 & N81 8GB */
1579         { NOKIA_PCSUITE_ACM_INFO(0x0071), }, /* Nokia N82 */
1580         { NOKIA_PCSUITE_ACM_INFO(0x04F0), }, /* Nokia N95 & N95-3 NAM */
1581         { NOKIA_PCSUITE_ACM_INFO(0x0070), }, /* Nokia N95 8GB  */
1582         { NOKIA_PCSUITE_ACM_INFO(0x00e9), }, /* Nokia 5320 XpressMusic */
1583         { NOKIA_PCSUITE_ACM_INFO(0x0099), }, /* Nokia 6210 Navigator, RM-367 */
1584         { NOKIA_PCSUITE_ACM_INFO(0x0128), }, /* Nokia 6210 Navigator, RM-419 */
1585         { NOKIA_PCSUITE_ACM_INFO(0x008f), }, /* Nokia 6220 Classic */
1586         { NOKIA_PCSUITE_ACM_INFO(0x00a0), }, /* Nokia 6650 */
1587         { NOKIA_PCSUITE_ACM_INFO(0x007b), }, /* Nokia N78 */
1588         { NOKIA_PCSUITE_ACM_INFO(0x0094), }, /* Nokia N85 */
1589         { NOKIA_PCSUITE_ACM_INFO(0x003a), }, /* Nokia N96 & N96-3  */
1590         { NOKIA_PCSUITE_ACM_INFO(0x00e9), }, /* Nokia 5320 XpressMusic */
1591         { NOKIA_PCSUITE_ACM_INFO(0x0108), }, /* Nokia 5320 XpressMusic 2G */
1592         { NOKIA_PCSUITE_ACM_INFO(0x01f5), }, /* Nokia N97, RM-505 */
1593         { NOKIA_PCSUITE_ACM_INFO(0x02e3), }, /* Nokia 5230, RM-588 */
1594         { NOKIA_PCSUITE_ACM_INFO(0x0178), }, /* Nokia E63 */
1595         { NOKIA_PCSUITE_ACM_INFO(0x010e), }, /* Nokia E75 */
1596         { NOKIA_PCSUITE_ACM_INFO(0x02d9), }, /* Nokia 6760 Slide */
1597         { NOKIA_PCSUITE_ACM_INFO(0x01d0), }, /* Nokia E52 */
1598         { NOKIA_PCSUITE_ACM_INFO(0x0223), }, /* Nokia E72 */
1599         { NOKIA_PCSUITE_ACM_INFO(0x0275), }, /* Nokia X6 */
1600         { NOKIA_PCSUITE_ACM_INFO(0x026c), }, /* Nokia N97 Mini */
1601         { NOKIA_PCSUITE_ACM_INFO(0x0154), }, /* Nokia 5800 XpressMusic */
1602         { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
1603         { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
1604         { NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
1605         { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
1606
1607         /* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
1608
1609         /* control interfaces without any protocol set */
1610         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1611                 USB_CDC_PROTO_NONE) },
1612
1613         /* control interfaces with various AT-command sets */
1614         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1615                 USB_CDC_ACM_PROTO_AT_V25TER) },
1616         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1617                 USB_CDC_ACM_PROTO_AT_PCCA101) },
1618         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1619                 USB_CDC_ACM_PROTO_AT_PCCA101_WAKE) },
1620         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1621                 USB_CDC_ACM_PROTO_AT_GSM) },
1622         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1623                 USB_CDC_ACM_PROTO_AT_3G) },
1624         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
1625                 USB_CDC_ACM_PROTO_AT_CDMA) },
1626
1627         { }
1628 };
1629
1630 MODULE_DEVICE_TABLE(usb, acm_ids);
1631
1632 static struct usb_driver acm_driver = {
1633         .name =         "cdc_acm",
1634         .probe =        acm_probe,
1635         .disconnect =   acm_disconnect,
1636 #ifdef CONFIG_PM
1637         .suspend =      acm_suspend,
1638         .resume =       acm_resume,
1639 #endif
1640         .id_table =     acm_ids,
1641 #ifdef CONFIG_PM
1642         .supports_autosuspend = 1,
1643 #endif
1644 };
1645
1646 /*
1647  * TTY driver structures.
1648  */
1649
1650 static const struct tty_operations acm_ops = {
1651         .open =                 acm_tty_open,
1652         .close =                acm_tty_close,
1653         .hangup =               acm_tty_hangup,
1654         .write =                acm_tty_write,
1655         .write_room =           acm_tty_write_room,
1656         .ioctl =                acm_tty_ioctl,
1657         .throttle =             acm_tty_throttle,
1658         .unthrottle =           acm_tty_unthrottle,
1659         .chars_in_buffer =      acm_tty_chars_in_buffer,
1660         .break_ctl =            acm_tty_break_ctl,
1661         .set_termios =          acm_tty_set_termios,
1662         .tiocmget =             acm_tty_tiocmget,
1663         .tiocmset =             acm_tty_tiocmset,
1664 };
1665
1666 /*
1667  * Init / exit.
1668  */
1669
1670 static int __init acm_init(void)
1671 {
1672         int retval;
1673         acm_tty_driver = alloc_tty_driver(ACM_TTY_MINORS);
1674         if (!acm_tty_driver)
1675                 return -ENOMEM;
1676         acm_tty_driver->owner = THIS_MODULE,
1677         acm_tty_driver->driver_name = "acm",
1678         acm_tty_driver->name = "ttyACM",
1679         acm_tty_driver->major = ACM_TTY_MAJOR,
1680         acm_tty_driver->minor_start = 0,
1681         acm_tty_driver->type = TTY_DRIVER_TYPE_SERIAL,
1682         acm_tty_driver->subtype = SERIAL_TYPE_NORMAL,
1683         acm_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1684         acm_tty_driver->init_termios = tty_std_termios;
1685         acm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD |
1686                                                                 HUPCL | CLOCAL;
1687         tty_set_operations(acm_tty_driver, &acm_ops);
1688
1689         retval = tty_register_driver(acm_tty_driver);
1690         if (retval) {
1691                 put_tty_driver(acm_tty_driver);
1692                 return retval;
1693         }
1694
1695         retval = usb_register(&acm_driver);
1696         if (retval) {
1697                 tty_unregister_driver(acm_tty_driver);
1698                 put_tty_driver(acm_tty_driver);
1699                 return retval;
1700         }
1701
1702         printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
1703                DRIVER_DESC "\n");
1704
1705         return 0;
1706 }
1707
1708 static void __exit acm_exit(void)
1709 {
1710         usb_deregister(&acm_driver);
1711         tty_unregister_driver(acm_tty_driver);
1712         put_tty_driver(acm_tty_driver);
1713 }
1714
1715 module_init(acm_init);
1716 module_exit(acm_exit);
1717
1718 MODULE_AUTHOR(DRIVER_AUTHOR);
1719 MODULE_DESCRIPTION(DRIVER_DESC);
1720 MODULE_LICENSE("GPL");
1721 MODULE_ALIAS_CHARDEV_MAJOR(ACM_TTY_MAJOR);