Use unsigned-char type for the endpoint and port counters.
Signed-off-by: NJohan Hovold <johan@kernel.org>

Clean up the probe error paths by adding a couple of new error labels.
Signed-off-by: NJohan Hovold <johan@kernel.org>

The 'store' function for the "event_char" device attribute currently
expects a base 10 value.  The value is composed of an enable bit in bit
8 and an 8-bit "event character" code in bits 7 to 0.  It seems
reasonable to allow hexadecimal and octal numbers to be written to the
device attribute in addition to decimal.  Make it so.

Change the debug message to show the value in hexadecimal, rather than
decimal.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NJohan Hovold <johan@kernel.org>

The "event_char" device attribute value, when written, is interpreted as
an enable bit in bit 8, and an "event character" in bits 7 to 0.

Return an error -EINVAL for out-of-range values.  Use kstrtouint() to
parse the integer instead of the obsolete simple_strtoul().
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Valid latency timer values are between 1 ms and 255 ms in 1 ms steps.
The store function for the "latency_timer" device attribute currently
allows any value, although only the lower 16 bits will be sent to the
device, and the device only stores the lower 8 bits.  The hardware
appears to accept the (invalid) value 0 and treats it the same as 1
(resulting in a latency of 1 ms).

Change the latency_timer_store() function to accept only the values 0 to
255, returning an error -EINVAL for out-of-range values.  Call
kstrtou8() to parse the integer instead of the obsolete
simple_strtoul().
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NJohan Hovold <johan@kernel.org>

If a BM type chip has iSerialNumber set to 0 in its EEPROM, an incorrect
value is read from the bcdDevice field of the USB descriptor, making it
look like an AM type chip.  Attempt to correct this in
ftdi_determine_type() by attempting to read the latency timer for an AM
type chip if it has iSerialNumber set to 0.  If that succeeds, assume it
is a BM type chip.

Currently, read_latency_timer() bails out without reading the latency
timer for an AM type chip, so factor out the guts of
read_latency_timer() into a new function _read_latency_timer() that
attempts to read the latency timer regardless of chip type, and returns
either the latency timer value or a negative error number.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NJohan Hovold <johan@kernel.org>

The latency timer was introduced with the FT232BM and FT245BM chips.  Do
not bother attempting to read or write it for older chip versions.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NJohan Hovold <johan@kernel.org>

A recent change claimed to fix an off-by-one error in the OOB-port
completion handler, but instead introduced such an error. This could
specifically led to modem-status changes going unnoticed, effectively
breaking TIOCMGET.

Note that the offending commit fixes a loop-condition underflow and is
marked for stable, but should not be backported without this fix.
Reported-by: NBen Hutchings <ben@decadent.org.uk>
Fixes: 2d380889 ("USB: serial: digi_acceleport: fix OOB data sanity check")
Cc: stable <stable@vger.kernel.org>	# v2.6.30
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that could be triggered by a malicious device.

This avoids leaking up to 56 bytes from after the URB transfer buffer to
user space.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that can be triggered by a malicious device.

This avoids leaking 128 kB of memory content from after the URB transfer
buffer to user space.

Fixes: 8c209e67 ("USB: make actual_length in struct urb field u32")
Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>	# 2.6.30
Signed-off-by: NJohan Hovold <johan@kernel.org>

Remove the now redundant open callback and let core call the generic
handler for us instead.
Signed-off-by: NJohan Hovold <johan@kernel.org>

This driver needlessly took another reference to the tty on open, a
reference which was then never released on close. This lead to not just
a leak of the tty, but also a driver reference leak that prevented the
driver from being unloaded after a port had once been opened.

Fixes: 4a90f09b ("tty: usb-serial krefs")
Cc: stable <stable@vger.kernel.org>	# 2.6.28
Signed-off-by: NJohan Hovold <johan@kernel.org>

Fix a NULL-pointer dereference in the interrupt callback should a
malicious device send data containing a bad port number by adding the
missing sanity check.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

A recent change claimed to fix an off-by-one error in the OOB-port
completion handler, but instead introduced such an error. This could
specifically led to modem-status changes going unnoticed, effectively
breaking TIOCMGET.

Note that the offending commit fixes a loop-condition underflow and is
marked for stable, but should not be backported without this fix.
Reported-by: NBen Hutchings <ben@decadent.org.uk>
Fixes: 2d380889 ("USB: serial: digi_acceleport: fix OOB data sanity
check")
Cc: stable <stable@vger.kernel.org>	# v2.6.30: 2d380889Signed-off-by: NJohan Hovold <johan@kernel.org>

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

Fix up affected files that include this signal functionality via sched.h.
Acked-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: NIngo Molnar <mingo@kernel.org>

Move all declarations and definitions in keyspan.h to keyspan.c, which
is the only place were they are used.

This specifically moves the driver device-id tables and usb-serial
driver definitions to the source file where they are expected to be
found.

While at it, fix up some multi-line comments and minor white-space
issues (spaces instead of tabs and superfluous white space).

Note that the information in the comment header of the removed header
file is also present in the source file.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Move the driver device-id tables and usb-serial driver definitions to
the source file where they are expected to be found.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Sort the device ids by vendor id.
Signed-off-by: NJohan Hovold <johan@kernel.org>

The adaptor on Analog Devices EVAL-ADXL362Z development board is used
to flash and debug firmware of on-board Renesas RL78/G13 MCU.
Also added support of the 153600 baud rate, since the stock firmware
uses it.
Signed-off-by: NMaksim Salau <maksim.salau@gmail.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Fix another NULL-pointer dereference at open should a malicious device
lack an interrupt-in endpoint.

Note that the driver has a broken check for an interrupt-in endpoint
which means that an interrupt URB has never even been submitted.

Fixes: 3f542974 ("USB: Moschip 7840 USB-Serial Driver")
Cc: stable <stable@vger.kernel.org>	# v2.6.19: 5c75633eReviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Drop two redundant NULL checks from usb_serial_console_disconnect().

The usb_serial_console_disconnect function is called from the
USB-serial-device disconnect callback when a device is going away. Hence
there is no need to check for the serial-device pointer being NULL.

The serial-device port pointers are stored in an array that is a member
of the serial struct so the address of the first member of the array
(which the array name decays to) is never NULL either.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Since commit 4a510969 ("tty: Make tty_files_lock per-tty") a new
tty_struct spin lock is taken in the tty release path, but the
USB-serial-console hack was never updated hence leaving the lock of its
"fake" tty uninitialised. This was eventually detected by lockdep.

Make sure to initialise the new lock also for the fake tty to address
this regression.

Yes, this code is a mess, but cleaning it up is left for another day.

Fixes: 4a510969 ("tty: Make tty_files_lock per-tty")
Cc: stable <stable@vger.kernel.org>	# 4.6
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

No need to reinitialise the interrupt-in URB with values that have not
changed before (some) resubmissions.

This also allows the interrupt-in callback to have a single path for URB
resubmission.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Drop some unnecessary debug printks.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Drop redundant URB unlink as there's no need to unlink an URB which is
about to be killed synchronously.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Drop the unused interrupt-out callback.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Interface numbers do not change when enabling alternate settings as
comment and code in this driver suggested.

Remove the confusing comment and redundant retrieval of the interface
number in probe, while simplifying and renaming the interface-number
helper.

Fixes: 4db2299d ("sierra: driver interface blacklisting")
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

FTDI devices use a receive latency timer to periodically empty the
receive buffer and report modem and line status (also when the buffer is
empty).

When a break or error condition is detected the corresponding status
flags will be set on a packet with nonzero data payload and the flags
are not updated until the break is over or further characters are
received.

In order to avoid over-reporting break and error conditions, these flags
must therefore only be processed for packets with payload.

This specifically fixes the case where after an overrun, the error
condition is continuously reported and NULL-characters inserted until
further data is received.
Reported-by: NMichael Walle <michael@walle.cc>
Fixes: 72fda3ca ("USB: serial: ftd_sio: implement sysrq handling on
break")
Fixes: 166ceb69 ("USB: ftdi_sio: clean up line-status handling")
Cc: stable <stable@vger.kernel.org>	# v2.6.35
Signed-off-by: NJohan Hovold <johan@kernel.org>

Add new USB IDs for cp2104/5 devices on Bx50v3 boards due to the design
change.
Signed-off-by: NKen Lin <yungching0725@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Make sure to check for short transfers before parsing the receive buffer
to avoid acting on stale data.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Make sure the received data has the required headers before parsing it.

Also drop the redundant urb-status check, which has already been handled
by the caller.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Make sure to check for short transfers to avoid underflow in a loop
condition when parsing the receive buffer.

Also fix an off-by-one error in the incomplete sanity check which could
lead to invalid data being parsed.

Fixes: 8c209e67 ("USB: make actual_length in struct urb field u32")
Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>	# v2.6.30
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Seems that ATEN serial-to-usb devices using pl2303 exist with
different device ids. This patch adds a missing device ID so it
is recognised by the driver.
Signed-off-by: NMarcel J.E. Mol <marcel@mesa.nl>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Use the port device rather than usb device in info and error messages.

This makes sure that driver and tty port is included in the messages,
while also making them more uniform.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Remove redundant check of num_interrupt_in which has already been
verified in probe (killing a NULL-urb would also have been fine).
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Return -ENODEV rather than -EINVAL on probe errors due to a missing
endpoint.

Also clean up the endpoint sanity check somewhat and use the interface
device for logging a more compact error in case an expected endpoint is
missing.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Currently we already have two pin configuration related callbacks
available for GPIO chips .set_single_ended() and .set_debounce(). In
future we expect to have even more, which does not scale well if we need
to add yet another callback to the GPIO chip structure for each possible
configuration parameter.

Better solution is to reuse what we already have available in the
generic pinconf.

To support this, we introduce a new .set_config() callback for GPIO
chips. The callback takes a single packed pin configuration value as
parameter. This can then be extended easily beyond what is currently
supported by just adding new types to the generic pinconf enum.

If the GPIO driver is backed up by a pinctrl driver the GPIO driver can
just assign gpiochip_generic_config() (introduced in this patch) to
.set_config and that will take care configuration requests are directed
to the pinctrl driver.

We then convert the existing drivers over .set_config() and finally
remove the .set_single_ended() and .set_debounce() callbacks.
Suggested-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>

The adaptor can be found on development boards for 78k, RL78 and V850
microcontrollers produced by Renesas Electronics Corporation.

This is not a full-featured USB to serial converter, however it allows
basic communication and simple control which is enough for programming of
on-board flash and debugging through a debug monitor.

uPD78F0730 is a USB-enabled microcontroller with USB-to-UART conversion
implemented in firmware.

This chip is also present in some debugging adaptors which use it for
USB-to-SPI conversion as well. The present driver doesn't cover SPI,
only USB-to-UART conversion is supported.
Signed-off-by: NMaksim Salau <maksim.salau@gmail.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Do not report ASYNC_SKIP_TEST or ASYNC_AUTO_IRQ as being set in
TIOCGSERIAL handlers as these flags are not supported and do not really
make any sense for USB serial devices in the first place.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Clean up the ioctl handler and make sure to pass an unsigned-int rather
than serial_struct pointer to the TIOCSERGETLSR helper as this it what
the user argument really is.
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>