Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.

Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>     # 2.6.12
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Drop some unnecessary termios-flag debugging that have been faithfully
reproduced in a few old drivers, including the "clfag" typo and all.

This also addresses a compiler warning on sparc where tcflag_t is
unsigned long and would have required an explicit cast.
Reported-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Drop the redundant read-urb check from open. The presence of a bulk-in
endpoint is now verified during probe and core has allocated the
corresponding resources.
Signed-off-by: NJohan Hovold <johan@kernel.org>

Verify that the required interrupt endpoint is present at probe rather
than at open to avoid allocating resources for an unusable device.

Note that the endpoint is only required when in download mode.
Signed-off-by: NJohan Hovold <johan@kernel.org>

These devices always require at least one bulk-out endpoint so let core
verify that.

This avoids attempting to send bulk data to the default pipe when
downloading firmware in boot mode.

Note that further endpoints are still needed when not in boot mode.
Signed-off-by: NJohan Hovold <johan@kernel.org>

Use the calc_num_ports rather than attach callback to verify that the
required endpoints are present when in download mode.

This avoids allocating port resources for interfaces that won't be bound.
Signed-off-by: NJohan Hovold <johan@kernel.org>

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that can be triggered by a malicious device.

This avoids leaking 128 kB of memory content from after the URB transfer
buffer to user space.

Fixes: 8c209e67 ("USB: make actual_length in struct urb field u32")
Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>	# 2.6.30
Signed-off-by: NJohan Hovold <johan@kernel.org>

Fix a NULL-pointer dereference in the interrupt callback should a
malicious device send data containing a bad port number by adding the
missing sanity check.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Do not report ASYNC_SKIP_TEST or ASYNC_AUTO_IRQ as being set in
TIOCGSERIAL handlers as these flags are not supported and do not really
make any sense for USB serial devices in the first place.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Bind to the interface, but do not register any ports, after having
downloaded the firmware. The device will still disconnect and
re-enumerate, but this way we avoid an error messages from being logged
as part of the process:

io_ti: probe of 1-1.3:1.0 failed with error -5
Signed-off-by: NJohan Hovold <johan@kernel.org>

Cancel the heartbeat work on driver unbind in order to avoid I/O after
disconnect in case the port is held open.

Note that the cancel in release() is still needed to stop the heartbeat
after late probe errors.

Fixes: 26c78daa ("USB: io_ti: Add heartbeat to keep idle EP/416
ports from disconnecting")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

In case a device is left in "boot-mode" we must not register any port
devices in order to avoid a NULL-pointer dereference on open due to
missing endpoints. This could be used by a malicious device to trigger
an OOPS:

Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
[<bf0caa84>] (edge_open [io_ti]) from [<bf0b0118>] (serial_port_activate+0x68/0x98 [usbserial])
[<bf0b0118>] (serial_port_activate [usbserial]) from [<c0470ca4>] (tty_port_open+0x9c/0xe8)
[<c0470ca4>] (tty_port_open) from [<bf0b0da0>] (serial_open+0x48/0x6c [usbserial])
[<bf0b0da0>] (serial_open [usbserial]) from [<c0469178>] (tty_open+0xcc/0x5cc)

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Fix NULL-pointer dereference when clearing halt at open should a
malicious device lack the expected endpoints when in download mode.

Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
[<bf011ed8>] (edge_open [io_ti]) from [<bf000118>] (serial_port_activate+0x68/0x98 [usbserial])
[<bf000118>] (serial_port_activate [usbserial]) from [<c0470ca4>] (tty_port_open+0x9c/0xe8)
[<c0470ca4>] (tty_port_open) from [<bf000da0>] (serial_open+0x48/0x6c [usbserial])
[<bf000da0>] (serial_open [usbserial]) from [<c0469178>] (tty_open+0xcc/0x5cc)

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Drop invalid user-pointer checks from ioctl handlers.

A NULL-pointer can be valid in user space and copy_to_user() takes care
of sanity checking.
Signed-off-by: NJohan Hovold <johan@kernel.org>

Remove extra blank lines in the several places where functions were
separated by more than one.
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Fix non-standard formatting in some of the comments.
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
[johan: minor fixes ]
Signed-off-by: NJohan Hovold <johan@kernel.org>

Move request_firmware from edge_startup to download_fw.
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Separate the download and boot mode code from download_fw() into two new
helper functions: do_download_mode() and do_boot_mode().
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Use serial->interface instead of serial->dev for messages in download_fw().
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Remove unused "dev" parameter from build_i2c_fw_hdr() and its caller.
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

When using Edgeport/416 models with newer firmware (sometime after
firmware version 4.80.0), idle ports are automatically bounced
(disconnected and then reconnected) approximately every 60 seconds.
This breaks programs (e.g: minicom) where idle periods are common,
normal and expected.

I confirmed with the manufacturer (Digi International) that Edgeport/416
models now ship from the factory with firmware that expects periodic
"heartbeat" queries from the driver to keep idle ports alive.  This
patch implements heartbeat support using the mechanism Digi suggested
(periodically requesting an I2C descriptor address) that appears effective
on Edgeports running the newer firmware (that require it) and benign on
Edgeport devices running older firmware.  Since we know that Edgeport
firmware version 4.80 (the version distributed in /lib/firmware/down3.bin
and used for Edgeports that are either running still older versions or
have no onboard non-volatile firmware image) does not require heartbeat
support, this patch schedules heartbeats only on Edgeport/416 devices,
and only if they are running firmware versions newer than 4.80.
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
[johan: minor style changes ]
Signed-off-by: NJohan Hovold <johan@kernel.org>

Do what we can to verify that the driver's firmware image is valid
(before attempting to download it to the Edgeport) by adding a new
function, check_fw_sanity(), and a call to it in in download_fw().

Note: It looks like some Edgeports (models like the EP/416 with on-board
E2PROM) may be able to function even if the on-disk firmware image is
bad or missing, iff their local E2PROM versions are valid.  But most
Edgeport models (I've tried EP/1 and EP/8) do not appear to have this
capability and they always rely on the on-disk firmware image.

I tested an implementation that calls the new check_fw_sanity()
function at the top of download_fw() and, rather than simply returning
an error if the firmware image is bad or missing, it saves the result
and defers the decision until later when it may find that it is running
on a E2PROM-equipped device with a valid image.  But I think this is
messier than it is worth (adding still more messiness to the already
very messy download_fw()) for such a marginal possible benefit.  So, at
least for now, I have chosen the much simpler approach of returning an
error whenever edge_startup() fails to load an on-disk firmware image, or
check_fw_sanity() indicates that it is unusable.
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
[johan: drop redundant checksum mask ]
Signed-off-by: NJohan Hovold <johan@kernel.org>

The io_ti driver fails to download firmware to Edgeport
devices such as the EP/416, even when the on-disk firmware image
(/lib/firmware/edgeport/down3.bin) is more current than the version
on the EP/416.  The current download code is broken in a few ways.
Notably it mis-uses global variables OperationalMajorVersion and
OperationalMinorVersion (reading their values before they've been
properly initialized and subsequently initializing them multiple times
without synchronization).  This patch drops the global variables and
replaces the redundant calls to request_firmware()/release_firmware()
in download_fw() with a single call pair in edge_startup(); the firmware
image pointer is then passed to download_fw() and build_i2c_fw_hdr().
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

The io_ti driver fails to download firmware to Edgeport devices such as
the EP/416 and EP/421 (devices with on-board E2PROM).  One of the problems
is that the default 1 second timeout in ti_vsend_sync() is insufficient
for download operations.  This patch increases the download timeout to
10 seconds.
Signed-off-by: NPeter E. Berger <pberger@brimson.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

The tty core does not test tty->hw_stopped; remove from drivers
which don't test it themselves.
Acked-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NPeter Hurley <peter@hurleysoftware.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

A recent patch that purported to fix firmware download on big-endian
machines failed to add the corresponding sparse annotation to the
i2c-header. This was reported by the kbuild test robot.

Adding the appropriate annotation revealed another endianess bug related
to the i2c-header Size-field in a code path that is exercised when the
firmware is actually being downloaded (and not just verified and left
untouched unless older than the firmware at hand).

This patch adds the required sparse annotation to the i2c-header and
makes sure that the Size-field is sent in little-endian byte order
during firmware download also on big-endian machines.

Note that this patch is only compile-tested, but that there is no
functional change for little-endian systems.
Reported-by: Nkbuild test robot <fengguang.wu@intel.com>
Cc: Ludovic Drolez <ldrolez@debian.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

During firmware download the device expects memory addresses in
big-endian byte order. As the wIndex parameter which hold the address is
sent in little-endian byte order regardless of host byte order, we need
to use swab16 rather than cpu_to_be16.

Also make sure to handle the struct ti_i2c_desc size parameter which is
returned in little-endian byte order.
Reported-by: NLudovic Drolez <ldrolez@debian.org>
Tested-by: NLudovic Drolez <ldrolez@debian.org>
Cc: stable@vger.kernel.org
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

None of these files are actually using any __init type directives
and hence don't need to include <linux/init.h>.  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.
Signed-off-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove redundant error messages on allocation failures, which have
already been logged.

Cc: Joe Perches <joe@perches.com>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove redundant ioctl debugging from subdrivers. The ioctl request code
has already been logged by usb-serial core.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Clean up the DEVICE_ATTR usage in the USB serial drivers, making them
more obvious as to the permissions that the sysfs files should be.

Note: ftdi_sio.c still has a DEVICE_ATTR() used, that will have to wait
until after 3.12-rc1 comes out when DEVICE_ATTR_WO() shows up in Linus's
tree.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Move port initialisation code from open to probe where it belongs.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Kill private write fifo and use the already allocated port write fifo
instead.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The port drain delay is constant and should be set at port probe rather
than open.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This moves the allocation of minor device numbers from a static array to
be dynamic, using the idr interface.  This means that you could
potentially get "gaps" in a minor number range for a single USB serial
device with multiple ports, but all should still work properly.

We remove the 'minor' field from the usb_serial structure, as it no
longer makes any sense for it (use the field in the usb_serial_port
structure if you really want to know this number), and take the fact
that we were overloading a number in this field to determine if we had
initialized the minor numbers or not, and just use a flag variable
instead.

Note, we still have the limitation of 255 USB to serial devices in the
system, as that is all we are registering with the TTY layer at this
point in time.
Tested-by: NTobias Winter <tobias@linuxdingsda.de>
Reviewed-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The usb_serial_port structure had the number field, which was the minor
number for the port, which almost no one really cared about.  They
really wanted the number of the port within the device, which you had to
subtract from the minor of the parent usb_serial_device structure.  To
clean this up, provide the real minor number of the port, and the number
of the port within the serial device separately, as these numbers might
not be related in the future.

Bonus is that this cleans up a lot of logic in the drivers, and saves
lines overall.
Tested-by: NTobias Winter <tobias@linuxdingsda.de>
Reviewed-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

--
 drivers/staging/serqt_usb2/serqt_usb2.c |   21 +++--------
 drivers/usb/serial/ark3116.c            |    2 -
 drivers/usb/serial/bus.c                |    6 +--
 drivers/usb/serial/console.c            |    2 -
 drivers/usb/serial/cp210x.c             |    2 -
 drivers/usb/serial/cypress_m8.c         |    4 +-
 drivers/usb/serial/digi_acceleport.c    |    6 ---
 drivers/usb/serial/f81232.c             |    5 +-
 drivers/usb/serial/garmin_gps.c         |    6 +--
 drivers/usb/serial/io_edgeport.c        |   58 ++++++++++++--------------------
 drivers/usb/serial/io_ti.c              |   21 ++++-------
 drivers/usb/serial/keyspan.c            |   29 +++++++---------
 drivers/usb/serial/metro-usb.c          |    4 +-
 drivers/usb/serial/mos7720.c            |   37 +++++++++-----------
 drivers/usb/serial/mos7840.c            |   52 +++++++++-------------------
 drivers/usb/serial/opticon.c            |    2 -
 drivers/usb/serial/pl2303.c             |    2 -
 drivers/usb/serial/quatech2.c           |    7 +--
 drivers/usb/serial/sierra.c             |    2 -
 drivers/usb/serial/ti_usb_3410_5052.c   |   10 ++---
 drivers/usb/serial/usb-serial.c         |    7 ++-
 drivers/usb/serial/usb_wwan.c           |    2 -
 drivers/usb/serial/whiteheat.c          |   20 +++++------
 include/linux/usb/serial.h              |    6 ++-
 24 files changed, 133 insertions(+), 180 deletions(-)

Use the new generic usb-serial wait_until_sent implementation to wait
for hardware buffers to drain.

This removes the need to check the hardware buffers in chars_in_buffer
and thus removes the overhead introduced by commit 263e1f9f ("USB:
io_ti: query hardware-buffer status in chars_in_buffer") without
breaking tty_wait_until_sent (used by, for example, tcdrain, tcsendbreak
and close).
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove redundant wait_until_sent, which has already been handled by the
tty-layer, from break_ctl.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix regression introduced by commit f40d7815 ("USB: io_ti: kill custom
closing_wait implementation") which made TIOCGSERIAL return the wrong
value for closing_wait.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Cc: stable <stable@vger.kernel.org> # 3.9
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

tty_port_tty_get might return a tty which is NULL. But it is
dereferenced unconditionally in edge_send. Stop dereferencing that by
sending usb_serial_port pointer around.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Johan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>