Johan's 'fix use-after-free in TIOCMIWAIT' patchset[1] introduces
one bug which can cause kernel hang when opening port.

This patch initialized the 'port->delta_msr_wait' waitqueue head
to fix the bug which is introduced in 3.9-rc4.

[1], http://marc.info/?l=linux-usb&m=136368139627876&w=2

Cc: stable <stable@vger.kernel.org>
Signed-off-by: NMing Lei <tom.leiming@gmail.com>
Acked-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Make sure the interface is not released before our serial device.

Note that drivers are still not allowed to access the interface in
any way that may interfere with another driver that may have gotten
bound to the same interface after disconnect returns.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Make sure serial-driver dtr_rts is called with disc_mutex held after
checking the disconnected flag.

Due to a bug in the tty layer, dtr_rts may get called after a device has
been disconnected and the tty-device unregistered. Some drivers have had
individual checks for disconnect to make sure the disconnected interface
was not accessed, but this should really be handled in usb-serial core
(at least until the long-standing tty-bug has been fixed).

Note that the problem has been made more acute with commit 0998d063
("device-core: Ensure drvdata = NULL when no driver is bound") as the
port data is now also NULL when dtr_rts is called resulting in further
oopses.
Reported-by: NChris Ruehl <chris.ruehl@gtsys.com.hk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Grab disconnect mutex in chars_in_buffer before checking disconnected
flag or calling driver specific function.

This allows subdrivers to query any hardware buffer status without
having to handle the locking themselves.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

After commit "TTY: move tty buffers to tty_port", the tty buffers are
not freed in some drivers. This is because tty_port_destructor is not
called whenever a tty_port is freed. This was an assumption I counted
with but was unfortunately untrue. So fix the drivers to fulfil this
assumption.

To be sure, the TTY buffers (and later some stuff) are gone along with
the tty_port, we have to call tty_port_destroy at tear-down places.
This is mostly where the structure containing a tty_port is freed.
This patch does exactly that -- put tty_port_destroy at those places.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

As reported by Fengguang:

FYI, coccinelle warns about

drivers/usb/serial/usb-serial.c:1415:3-51: code aligned with following code on line 1416

vim +1415 drivers/usb/serial/usb-serial.c

  1412          /* we only set the reset_resume field if the serial_driver has one */
  1413          for (sd = serial_drivers; *sd; ++sd) {
  1414                  if ((*sd)->reset_resume)
> 1415                          udriver->reset_resume = usb_serial_reset_resume;
> 1416                          break;
  1417          }
Reported-by: NFengguang Wu <fengguang.wu@intel.com>
Cc: stable <stable@vger.kernel.org> [3.5]
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This moves to using pr_info() where needed instead of a "raw" printk()
call, making the whole driver more unified.

It also cleans up my email address in the MODULE_AUTHOR field.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now that all usb-serial modules are only using dev_dbg()
the debug module parameter does not do anything at all, so
remove it to reduce any confusion if someone were to try
to use it.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This cleans up the usb-serial module to remove all old usages of dbg()
and "raw" printk() calls for error reporting (there are some info
messages left for now.)
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

These dbg() calls were no more than just a function trace, so remove
them.  If you want to see the functions being called, use the in-kernel
function trace code instead, it's much nicer.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now that we don't have tty->termios tied to drivers->tty we can untangle
the logic here. In addition we can push the removal logic out of the
destructor path.

At that point we can think about sorting out tty_port and console and all
the other ugly hangovers.
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This will let us sort out a whole pile of tty related races. The
alternative would be to keep points and refcount the termios objects.
However
1. They are tiny anyway
2. Many devices don't use the stored copies
3. We can remove a pty special case
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

To have tty->port set in ->install.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The use of kfree(serial) in error cases of usb_serial_probe
was invalid - usb_serial structure allocated in create_serial()
gets reference of usb_device that needs to be put, so we need
to use usb_serial_put() instead of simple kfree().
Signed-off-by: NJan Safrata <jan.nikitenko@gmail.com>
Acked-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We need to make sure that the USB serial driver we find
matches the USB driver whose probe we are currently
executing. Otherwise we will end up with USB serial
devices bound to the correct serial driver but wrong
USB driver.

An example of such cross-probing, where the usbserial_generic
USB driver has found the sierra serial driver:

May 29 18:26:15 nemi kernel: [ 4442.559246] usbserial_generic 4-4:1.0: Sierra USB modem converter detected
May 29 18:26:20 nemi kernel: [ 4447.556747] usbserial_generic 4-4:1.2: Sierra USB modem converter detected
May 29 18:26:25 nemi kernel: [ 4452.557288] usbserial_generic 4-4:1.3: Sierra USB modem converter detected

sysfs view of the same problem:

bjorn@nemi:~$ ls -l /sys/bus/usb/drivers/sierra/
total 0
--w------- 1 root root 4096 May 29 18:23 bind
lrwxrwxrwx 1 root root    0 May 29 18:23 module -> ../../../../module/usbserial
--w------- 1 root root 4096 May 29 18:23 uevent
--w------- 1 root root 4096 May 29 18:23 unbind
bjorn@nemi:~$ ls -l /sys/bus/usb-serial/drivers/sierra/
total 0
--w------- 1 root root 4096 May 29 18:23 bind
lrwxrwxrwx 1 root root    0 May 29 18:23 module -> ../../../../module/sierra
-rw-r--r-- 1 root root 4096 May 29 18:23 new_id
lrwxrwxrwx 1 root root    0 May 29 18:32 ttyUSB0 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.0/ttyUSB0
lrwxrwxrwx 1 root root    0 May 29 18:32 ttyUSB1 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.2/ttyUSB1
lrwxrwxrwx 1 root root    0 May 29 18:32 ttyUSB2 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.3/ttyUSB2
--w------- 1 root root 4096 May 29 18:23 uevent
--w------- 1 root root 4096 May 29 18:23 unbind

bjorn@nemi:~$ ls -l /sys/bus/usb/drivers/usbserial_generic/
total 0
lrwxrwxrwx 1 root root    0 May 29 18:33 4-4:1.0 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.0
lrwxrwxrwx 1 root root    0 May 29 18:33 4-4:1.2 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.2
lrwxrwxrwx 1 root root    0 May 29 18:33 4-4:1.3 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.3
--w------- 1 root root 4096 May 29 18:33 bind
lrwxrwxrwx 1 root root    0 May 29 18:33 module -> ../../../../module/usbserial
--w------- 1 root root 4096 May 29 18:22 uevent
--w------- 1 root root 4096 May 29 18:33 unbind
bjorn@nemi:~$ ls -l /sys/bus/usb-serial/drivers/generic/
total 0
--w------- 1 root root 4096 May 29 18:33 bind
lrwxrwxrwx 1 root root    0 May 29 18:33 module -> ../../../../module/usbserial
-rw-r--r-- 1 root root 4096 May 29 18:33 new_id
--w------- 1 root root 4096 May 29 18:22 uevent
--w------- 1 root root 4096 May 29 18:33 unbind

So we end up with a mismatch between the USB driver and the
USB serial driver.  The reason for the above is simple: The
USB driver probe will succeed if *any* registered serial
driver matches, and will use that serial driver for all
serial driver functions.

This makes ref counting go wrong. We count the USB driver
as used, but not the USB serial driver.  This may result
in Oops'es as demonstrated by Johan Hovold <jhovold@gmail.com>:

[11811.646396] drivers/usb/serial/usb-serial.c: get_free_serial 1
[11811.646443] drivers/usb/serial/usb-serial.c: get_free_serial - minor base = 0
[11811.646460] drivers/usb/serial/usb-serial.c: usb_serial_probe - registering ttyUSB0
[11811.646766] usb 6-1: pl2303 converter now attached to ttyUSB0
[11812.264197] USB Serial deregistering driver FTDI USB Serial Device
[11812.264865] usbcore: deregistering interface driver ftdi_sio
[11812.282180] USB Serial deregistering driver pl2303
[11812.283141] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0
[11812.283272] usbcore: deregistering interface driver pl2303
[11812.301056] USB Serial deregistering driver generic
[11812.301186] usbcore: deregistering interface driver usbserial_generic
[11812.301259] drivers/usb/serial/usb-serial.c: usb_serial_disconnect
[11812.301823] BUG: unable to handle kernel paging request at f8e7438c
[11812.301845] IP: [<f8e38445>] usb_serial_disconnect+0xb5/0x100 [usbserial]
[11812.301871] *pde = 357ef067 *pte = 00000000
[11812.301957] Oops: 0000 [#1] PREEMPT SMP
[11812.301983] Modules linked in: usbserial(-) [last unloaded: pl2303]
[11812.302008]
[11812.302019] Pid: 1323, comm: modprobe Tainted: G        W    3.4.0-rc7+ #101 Dell Inc. Vostro 1520/0T816J
[11812.302115] EIP: 0060:[<f8e38445>] EFLAGS: 00010246 CPU: 1
[11812.302130] EIP is at usb_serial_disconnect+0xb5/0x100 [usbserial]
[11812.302141] EAX: f508a180 EBX: f508a180 ECX: 00000000 EDX: f8e74300
[11812.302151] ESI: f5050800 EDI: 00000001 EBP: f5141e78 ESP: f5141e58
[11812.302160]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[11812.302170] CR0: 8005003b CR2: f8e7438c CR3: 34848000 CR4: 000007d0
[11812.302180] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[11812.302189] DR6: ffff0ff0 DR7: 00000400
[11812.302199] Process modprobe (pid: 1323, ti=f5140000 task=f61e2bc0 task.ti=f5140000)
[11812.302209] Stack:
[11812.302216]  f8e3be0f f8e3b29c f8e3ae00 00000000 f513641c f5136400 f513641c f507a540
[11812.302325]  f5141e98 c133d2c1 00000000 00000000 f509c400 f513641c f507a590 f5136450
[11812.302372]  f5141ea8 c12f0344 f513641c f507a590 f5141ebc c12f0c67 00000000 f507a590
[11812.302419] Call Trace:
[11812.302439]  [<c133d2c1>] usb_unbind_interface+0x51/0x190
[11812.302456]  [<c12f0344>] __device_release_driver+0x64/0xb0
[11812.302469]  [<c12f0c67>] driver_detach+0x97/0xa0
[11812.302483]  [<c12f001c>] bus_remove_driver+0x6c/0xe0
[11812.302500]  [<c145938d>] ? __mutex_unlock_slowpath+0xcd/0x140
[11812.302514]  [<c12f0ff9>] driver_unregister+0x49/0x80
[11812.302528]  [<c1457df6>] ? printk+0x1d/0x1f
[11812.302540]  [<c133c50d>] usb_deregister+0x5d/0xb0
[11812.302557]  [<f8e37c55>] ? usb_serial_deregister+0x45/0x50 [usbserial]
[11812.302575]  [<f8e37c8d>] usb_serial_deregister_drivers+0x2d/0x40 [usbserial]
[11812.302593]  [<f8e3a6e2>] usb_serial_generic_deregister+0x12/0x20 [usbserial]
[11812.302611]  [<f8e3acf0>] usb_serial_exit+0x8/0x32 [usbserial]
[11812.302716]  [<c1080b48>] sys_delete_module+0x158/0x260
[11812.302730]  [<c110594e>] ? mntput+0x1e/0x30
[11812.302746]  [<c145c3c3>] ? sysenter_exit+0xf/0x18
[11812.302746]  [<c107777c>] ? trace_hardirqs_on_caller+0xec/0x170
[11812.302746]  [<c145c390>] sysenter_do_call+0x12/0x36
[11812.302746] Code: 24 02 00 00 e8 dd f3 20 c8 f6 86 74 02 00 00 02 74 b4 8d 86 4c 02 00 00 47 e8 78 55 4b c8 0f b6 43 0e 39 f8 7f a9 8b 53 04 89 d8 <ff> 92 8c 00 00 00 89 d8 e8 0e ff ff ff 8b 45 f0 c7 44 24 04 2f
[11812.302746] EIP: [<f8e38445>] usb_serial_disconnect+0xb5/0x100 [usbserial] SS:ESP 0068:f5141e58
[11812.302746] CR2: 00000000f8e7438c

Fix by only evaluating serial drivers pointing back to the
USB driver we are currently probing.  This still allows two
or more drivers to match the same device, running their
serial driver probes to sort out which one to use.

Cc: stable@vger.kernel.org # 3.0, 3.2, 3.3, 3.4
Signed-off-by: NBjørn Mork <bjorn@mork.no>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
Tested-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

If the usb-serial driver doesn't have a reset_resume callback, then we
need to tell the USB core that it doesn't, and it needs to rebind the
device.

Thanks to Alan for pointing out my mistake, and providing the fix.
Reported-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Make some noise during probe to make sure the users
are aware of the intended purpose of this driver.
Signed-off-by: NBjørn Mork <bjorn@mork.no>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The callback is now hooked up for any USB to serial driver that wants
it.  We only register the callback if any of the usb-serial structures
want it, this keeps the USB core happy.

Thanks to Alan Stern for the ideas on how to do this.

Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This reworks the usb_serial_register_drivers() and
usb_serial_deregister_drivers() to not need a pointer to a struct
usb_driver anymore.  The usb_driver structure is now created dynamically
and registered and unregistered as needed.

This saves lines of code in each usb-serial driver.  All in-kernel users
of these functions were also fixed up at this time.  The pl2303 driver
was tested that everything worked properly.

Thanks for the idea to do this from Alan Stern.

Cc: Adhir Ramjiawan <adhirramjiawan0@gmail.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Al Borchers <alborchers@steinerpoint.com>
Cc: Aleksey Babahin <tamerlan311@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrew Worsley <amworsley@gmail.com>
Cc: Bart Hartgers <bart.hartgers@gmail.com>
Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Donald Lee <donald@asix.com.tw>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Gary Brubaker <xavyer@ix.netcom.com>
Cc: Jesper Juhl <jj@chaosbits.net>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Johan Hovold <jhovold@gmail.com>
Cc: Julia Lawall <julia@diku.dk>
Cc: Kautuk Consul <consul.kautuk@gmail.com>
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Cc: Lonnie Mendez <dignome@gmail.com>
Cc: Matthias Bruestle and Harald Welte <support@reiner-sct.com>
Cc: Matthias Urlichs <smurf@smurf.noris.de>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Michal Sroczynski <msroczyn@gmail.com>
Cc: "Michał Wróbel" <michal.wrobel@flytronic.pl>
Cc: Oliver Neukum <oliver@neukum.name>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Berger <pberger@brimson.com>
Cc: Preston Fick <preston.fick@silabs.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Rigbert Hamisch <rigbert@gmx.de>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Simon Arlott <simon@fire.lp0.eu>
Cc: Support Department <support@connecttech.com>
Cc: Thomas Tuttle <ttuttle@chromium.org>
Cc: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>
Cc: Wang YanQing <Udknight@gmail.com>
Cc: William Greathouse <wgreathouse@smva.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

I can't remember why I wrote it like this many many years ago, but it's
not needed at all, let's rely on the usb-serial core for this function,
especially as it is being overridden by it anyway.

This lets us make usb_serial_probe() a static function, which it should
be.

Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This is now set by the usb-serial core, no need for the driver to
individually set it.

Thanks to Alan Stern for the idea to get rid of it.

Cc: William Greathouse <wgreathouse@smva.com>
Cc: Matthias Bruestle and Harald Welte <support@reiner-sct.com>
Cc: Lonnie Mendez <dignome@gmail.com>
Cc: Peter Berger <pberger@brimson.com>
Cc: Al Borchers <alborchers@steinerpoint.com>
Cc: Gary Brubaker <xavyer@ix.netcom.com>
Cc: Oliver Neukum <oliver@neukum.name>
Cc: Matthias Urlichs <smurf@smurf.noris.de>
Cc: Support Department <support@connecttech.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Kautuk Consul <consul.kautuk@gmail.com>
Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Bart Hartgers <bart.hartgers@gmail.com>
Cc: Johan Hovold <jhovold@gmail.com>
Cc: Preston Fick <preston.fick@silabs.com>
Cc: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>
Cc: Simon Arlott <simon@fire.lp0.eu>
Cc: Andrew Worsley <amworsley@gmail.com>
Cc: "Michał Wróbel" <michal.wrobel@flytronic.pl>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Aleksey Babahin <tamerlan311@gmail.com>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Donald Lee <donald@asix.com.tw>
Cc: Julia Lawall <julia@diku.dk>
Cc: Michal Sroczynski <msroczyn@gmail.com>
Cc: Wang YanQing <Udknight@gmail.com>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Thomas Tuttle <ttuttle@chromium.org>
Cc: Rigbert Hamisch <rigbert@gmx.de>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Cc: Jesper Juhl <jj@chaosbits.net>
Cc: Adhir Ramjiawan <adhirramjiawan0@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This is now set by the usb-serial core, no need for the driver to
individually set it.

Thanks to Alan Stern for the idea to get rid of it.

Cc: William Greathouse <wgreathouse@smva.com>
Cc: Matthias Bruestle and Harald Welte <support@reiner-sct.com>
Cc: Lonnie Mendez <dignome@gmail.com>
Cc: Peter Berger <pberger@brimson.com>
Cc: Al Borchers <alborchers@steinerpoint.com>
Cc: Gary Brubaker <xavyer@ix.netcom.com>
Cc: Oliver Neukum <oliver@neukum.name>
Cc: Matthias Urlichs <smurf@smurf.noris.de>
Cc: Support Department <support@connecttech.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Kautuk Consul <consul.kautuk@gmail.com>
Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Bart Hartgers <bart.hartgers@gmail.com>
Cc: Johan Hovold <jhovold@gmail.com>
Cc: Preston Fick <preston.fick@silabs.com>
Cc: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>
Cc: Simon Arlott <simon@fire.lp0.eu>
Cc: Andrew Worsley <amworsley@gmail.com>
Cc: "Michał Wróbel" <michal.wrobel@flytronic.pl>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Aleksey Babahin <tamerlan311@gmail.com>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Donald Lee <donald@asix.com.tw>
Cc: Julia Lawall <julia@diku.dk>
Cc: Michal Sroczynski <msroczyn@gmail.com>
Cc: Wang YanQing <Udknight@gmail.com>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Thomas Tuttle <ttuttle@chromium.org>
Cc: Rigbert Hamisch <rigbert@gmx.de>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Cc: Jesper Juhl <jj@chaosbits.net>
Cc: Adhir Ramjiawan <adhirramjiawan0@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1550) fixes a bug in the usb-serial core that affects
the ftdi_sio driver and most likely others as well.  The core
implements suspend and resume routines, but it doesn't store pointers
to those routines in the usb_driver structures that it registers,
even though it does set those drivers' supports_autosuspend flag.  The
end result is that when one of these devices is autosuspended, we try
to call through a NULL pointer.

The patch fixes the problem by setting the suspend and resume method
pointers to the appropriate routines in the USB serial core, along
with the supports_autosuspend field, in each driver as it is
registered.

This should be back-ported to all the stable kernels that have the new
usb_serial_register_drivers() interface.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: NFrank Schäfer <schaefer.frank@gmx.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The interface data should not be used as a flag to signal disconnect.

Now that all serial drivers use the usb_serial disconnect flag and
mutex, we can set the interface data prior to registering the ports and
there's no need to clear it at disconnect.

This should hopefully also make it more clear that the interface data is
not a flag, which could prevent future misuse.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix race between probe and open by making sure that the disconnected
flag is not cleared until all ports have been registered.

A call to tty_open while probe is running may get a reference to the
serial structure in serial_install before its ports have been
registered. This may lead to usb_serial_core calling driver open before
port is fully initialised.

With ftdi_sio this result in the following NULL-pointer dereference as
the private data has not been initialised at open:

[  199.698286] IP: [<f811a089>] ftdi_open+0x59/0xe0 [ftdi_sio]
[  199.698297] *pde = 00000000
[  199.698303] Oops: 0000 [#1] PREEMPT SMP
[  199.698313] Modules linked in: ftdi_sio usbserial
[  199.698323]
[  199.698327] Pid: 1146, comm: ftdi_open Not tainted 3.2.11 #70 Dell Inc. Vostro 1520/0T816J
[  199.698339] EIP: 0060:[<f811a089>] EFLAGS: 00010286 CPU: 0
[  199.698344] EIP is at ftdi_open+0x59/0xe0 [ftdi_sio]
[  199.698348] EAX: 0000003e EBX: f5067000 ECX: 00000000 EDX: 80000600
[  199.698352] ESI: f48d8800 EDI: 00000001 EBP: f515dd54 ESP: f515dcfc
[  199.698356]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[  199.698361] Process ftdi_open (pid: 1146, ti=f515c000 task=f481e040 task.ti=f515c000)
[  199.698364] Stack:
[  199.698368]  f811a9fe f811a9e0 f811b3ef 00000000 00000000 00001388 00000000 f4a86800
[  199.698387]  00000002 00000000 f806e68e 00000000 f532765c f481e040 00000246 22222222
[  199.698479]  22222222 22222222 22222222 f5067004 f5327600 f5327638 f515dd74 f806e6ab
[  199.698496] Call Trace:
[  199.698504]  [<f806e68e>] ? serial_activate+0x2e/0x70 [usbserial]
[  199.698511]  [<f806e6ab>] serial_activate+0x4b/0x70 [usbserial]
[  199.698521]  [<c126380c>] tty_port_open+0x7c/0xd0
[  199.698527]  [<f806e660>] ? serial_set_termios+0xa0/0xa0 [usbserial]
[  199.698534]  [<f806e76f>] serial_open+0x2f/0x70 [usbserial]
[  199.698540]  [<c125d07c>] tty_open+0x20c/0x510
[  199.698546]  [<c10e9eb7>] chrdev_open+0xe7/0x230
[  199.698553]  [<c10e48f2>] __dentry_open+0x1f2/0x390
[  199.698559]  [<c144bfec>] ? _raw_spin_unlock+0x2c/0x50
[  199.698565]  [<c10e4b76>] nameidata_to_filp+0x66/0x80
[  199.698570]  [<c10e9dd0>] ? cdev_put+0x20/0x20
[  199.698576]  [<c10f3e08>] do_last+0x198/0x730
[  199.698581]  [<c10f4440>] path_openat+0xa0/0x350
[  199.698587]  [<c10f47d5>] do_filp_open+0x35/0x80
[  199.698593]  [<c144bfec>] ? _raw_spin_unlock+0x2c/0x50
[  199.698599]  [<c10ff110>] ? alloc_fd+0xc0/0x100
[  199.698605]  [<c10f0b72>] ? getname_flags+0x72/0x120
[  199.698611]  [<c10e4450>] do_sys_open+0xf0/0x1c0
[  199.698617]  [<c11fcc08>] ? trace_hardirqs_on_thunk+0xc/0x10
[  199.698623]  [<c10e458e>] sys_open+0x2e/0x40
[  199.698628]  [<c144c990>] sysenter_do_call+0x12/0x36
[  199.698632] Code: 85 89 00 00 00 8b 16 8b 4d c0 c1 e2 08 c7 44 24 14 88 13 00 00 81 ca 00 00 00 80 c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 <0f> b7 41 78 31 c9 89 44 24 08 c7 44 24 04 00 00 00 00 c7 04 24
[  199.698884] EIP: [<f811a089>] ftdi_open+0x59/0xe0 [ftdi_sio] SS:ESP 0068:f515dcfc
[  199.698893] CR2: 0000000000000078
[  199.698925] ---[ end trace 77c43ec023940cff ]---
Reported-and-tested-by: NKen Huang <csuhgw@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1536) fixes a bug in the USB serial core.  Unloading and
reloading a serial driver while a serial device is plugged in causes
errors because of the code in usb_serial_disconnect() that tries to
make sure the port_remove method is called.  With the new order of
driver registration introduced in the 3.4 kernel, this is definitely
not the right thing to do (if indeed it ever was).

The patch removes that whole section code, along with the mechanism
for keeping track of each port's registration state, which is no
longer needed.  The driver core can handle all that stuff for us.

Note: This has been tested only with one or two USB serial drivers.
In theory, other drivers might still run into trouble.  But if they
do, it will be the fault of the drivers, not of this patch -- that is,
the drivers will need to be fixed.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

All num, magic and owner are set by alloc_tty_driver. No need to
re-set them on each allocation site.

pti driver sets something different to what it passes to
alloc_tty_driver. It is not a bug, since we don't use the lines
parameter in any way. Anyway this is fixed, and now we do the right
thing.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Acked-by: NTilman Schmidt <tilman@imap.cc>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

No one uses them anymore, they should be using the safer
usb_serial_register_drivers() and usb_serial_deregister_drivers()
functions instead.

Thanks to Alan Stern for writing these functions and porting all
in-kernel users to them.

Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1522) adds two new routines to the usb-serial core, for
registering and unregistering serial drivers.  Instead of registering
the usb_driver and usb_serial_drivers separately, with error checking
for each one, the drivers can all be registered and unregistered by a
single function call.  This reduces duplicated code.

More importantly, the new core routines change the order in which the
drivers are registered.  Currently the usb-serial drivers are all
registered first and the usb_driver is done last, which leaves a
window for problems.  A udev script may quickly add a new dynamic-ID
for a usb-serial driver, causing the corresponding usb_driver to be
probed.  If the usb_driver hasn't been registered yet then an oops
will occur.

The new routine prevents such problems by registering the usb_driver
first.  To insure that it gets probed properly for already-attached
serial devices, we call driver_attach() after all the usb-serial
drivers have been registered.

Along with adding the new routines, the patch modifies the "generic"
serial driver to use them.  Further patches will similarly modify all
the other in-tree USB serial drivers.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

But before that we need to reorder the calls so that we don't need to
lower the reference counts if usb_autopm_get_interface fails.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

module_param(bool) used to counter-intuitively take an int.  In
fddd5201 (mid-2009) we allowed bool or int/unsigned int using a messy
trick.

It's time to remove the int/unsigned int option.  For this version
it'll simply give a warning, but it'll break next kernel version.
Acked-by: NMauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>

The BKL is a gonner.
Signed-off-by: NDavidlohr Bueso <dave@gnu.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use usb_translate_errors() to map USB-specific errors to errors
appropriate for user space (ENOMEM, ENODEV and EIO) in write.

Currently almost all serial drivers simply forward error codes from the
stack (e.g. from usb_submit_urb()), but these codes often have
different meanings in user-space. Doing the mapping in usb-serial core
simplifies driver code and allows for more consistent error reporting.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Minor whitespace clean ups.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use usb_translate_errors() to map USB-specific errors to errors
appropriate for user space (ENOMEM, ENODEV and EIO) in open.

Currently almost all serial drivers simply forward error codes from the
stack (e.g. from usb_submit_urb()), but these codes often have
different meanings in user-space. Doing the mapping in usb-serial core
simplifies driver code and allows for more consistent error reporting.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add support for multiple read urbs to generic read implementation.

Use a static array of two read urbs for now which is enough to get a
50% throughput increase in one test setup.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Reuse first write urb and bulk-out buffer of the generic write
implementation for drivers that rely on port->write_urb rather than
allocating them separately.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Now ${LINUX}/drivers/usb/* can use usb_endpoint_maxp(desc) to get maximum packet size
instead of le16_to_cpu(desc->wMaxPacketSize).
This patch fix it up

Cc: Armin Fuerst <fuerst@in.tum.de>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Johannes Erdfelt <johannes@erdfelt.com>
Cc: Vojtech Pavlik <vojtech@suse.cz>
Cc: Oliver Neukum <oliver@neukum.name>
Cc: David Kubicek <dave@awk.cz>
Cc: Johan Hovold <jhovold@gmail.com>
Cc: Brad Hards <bhards@bigpond.net.au>
Acked-by: NFelipe Balbi <balbi@ti.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Thomas Dahlmann <dahlmann.thomas@arcor.de>
Cc: David Brownell <david-b@pacbell.net>
Cc: David Lopo <dlopo@chipidea.mips.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: Xie Xiaobo <X.Xie@freescale.com>
Cc: Li Yang <leoli@freescale.com>
Cc: Jiang Bo <tanya.jiang@freescale.com>
Cc: Yuan-hsin Chen <yhchen@faraday-tech.com>
Cc: Darius Augulis <augulis.darius@gmail.com>
Cc: Xiaochen Shen <xiaochen.shen@intel.com>
Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Cc: OKI SEMICONDUCTOR, <toshiharu-linux@dsn.okisemi.com>
Cc: Robert Jarzmik <robert.jarzmik@free.fr>
Cc: Ben Dooks <ben@simtec.co.uk>
Cc: Thomas Abraham <thomas.ab@samsung.com>
Cc: Herbert Pötzl <herbert@13thfloor.at>
Cc: Arnaud Patard <arnaud.patard@rtp-net.org>
Cc: Roman Weissgaerber <weissg@vienna.at>
Acked-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Tony Olech <tony.olech@elandigitalsystems.com>
Cc: Florian Floe Echtler <echtler@fs.tum.de>
Cc: Christian Lucht <lucht@codemercs.com>
Cc: Juergen Stuber <starblue@sourceforge.net>
Cc: Georges Toth <g.toth@e-biz.lu>
Cc: Bill Ryder <bryder@sgi.com>
Cc: Kuba Ober <kuba@mareimbrium.org>
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: NKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

When a driver doesn't know how much data a device is going to send,
the buffer size should be at least as big as the endpoint's maxpacket
value.  The serial drivers don't follow this rule; many of them
request only 256-byte bulk-in buffers.  As a result, they suffer
overflow errors if a high-speed device wants to send a lot of data,
because high-speed bulk endpoints are required to have a maxpacket
size of 512.

This patch (as1450) fixes the problem by using the driver's
bulk_in_size value as a minimum, always allocating buffers no smaller
than the endpoint's maxpacket size.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NFlynn Marquardt <flynn@flynnux.de>
CC: <stable@kernel.org> [after .39-rc1 is out]
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Only oddities here are a couple of drivers that bogusly called the ldisc
helpers instead of returning -ENOIOCTLCMD. Fix the bug and the rest goes
away.
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>