USB: serial: fix race between probe and open
[linux-flexiantxendom0.git] / drivers / usb / serial / usb-serial.c
index 8d51890..38d7ebd 100644 (file)
 #include <linux/tty_flip.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
+#include <linux/seq_file.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/uaccess.h>
+#include <linux/serial.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
+#include <linux/kfifo.h>
 #include "pl2303.h"
 
 /*
@@ -40,8 +43,6 @@
 #define DRIVER_AUTHOR "Greg Kroah-Hartman, greg@kroah.com, http://www.kroah.com/linux/"
 #define DRIVER_DESC "USB Serial Driver core"
 
-static void port_free(struct usb_serial_port *port);
-
 /* Driver structure we register with the USB core */
 static struct usb_driver usb_serial_driver = {
        .name =         "usbserial",
@@ -50,6 +51,7 @@ static struct usb_driver usb_serial_driver = {
        .suspend =      usb_serial_suspend,
        .resume =       usb_serial_resume,
        .no_dynamic_id =        1,
+       .supports_autosuspend = 1,
 };
 
 /* There is no MODULE_DEVICE_TABLE for usbserial.c.  Instead
@@ -65,6 +67,11 @@ static struct usb_serial *serial_table[SERIAL_TTY_MINORS];
 static DEFINE_MUTEX(table_lock);
 static LIST_HEAD(usb_serial_driver_list);
 
+/*
+ * Look up the serial structure.  If it is found and it hasn't been
+ * disconnected, return with its disc_mutex held and its refcount
+ * incremented.  Otherwise return NULL.
+ */
 struct usb_serial *usb_serial_get_by_index(unsigned index)
 {
        struct usb_serial *serial;
@@ -72,8 +79,15 @@ struct usb_serial *usb_serial_get_by_index(unsigned index)
        mutex_lock(&table_lock);
        serial = serial_table[index];
 
-       if (serial)
-               kref_get(&serial->kref);
+       if (serial) {
+               mutex_lock(&serial->disc_mutex);
+               if (serial->disconnected) {
+                       mutex_unlock(&serial->disc_mutex);
+                       serial = NULL;
+               } else {
+                       kref_get(&serial->kref);
+               }
+       }
        mutex_unlock(&table_lock);
        return serial;
 }
@@ -122,8 +136,10 @@ static void return_serial(struct usb_serial *serial)
 
        dbg("%s", __func__);
 
+       mutex_lock(&table_lock);
        for (i = 0; i < serial->num_ports; ++i)
                serial_table[serial->minor + i] = NULL;
+       mutex_unlock(&table_lock);
 }
 
 static void destroy_serial(struct kref *kref)
@@ -136,170 +152,199 @@ static void destroy_serial(struct kref *kref)
 
        dbg("%s - %s", __func__, serial->type->description);
 
-       serial->type->shutdown(serial);
-
        /* return the minor range that this device had */
        if (serial->minor != SERIAL_TTY_NO_MINOR)
                return_serial(serial);
 
-       for (i = 0; i < serial->num_ports; ++i)
-               serial->port[i]->port.count = 0;
-
-       /* the ports are cleaned up and released in port_release() */
-       for (i = 0; i < serial->num_ports; ++i)
-               if (serial->port[i]->dev.parent != NULL) {
-                       device_unregister(&serial->port[i]->dev);
-                       serial->port[i] = NULL;
-               }
+       if (serial->attached)
+               serial->type->release(serial);
 
-       /* If this is a "fake" port, we have to clean it up here, as it will
-        * not get cleaned up in port_release() as it was never registered with
-        * the driver core */
-       if (serial->num_ports < serial->num_port_pointers) {
-               for (i = serial->num_ports;
-                                       i < serial->num_port_pointers; ++i) {
-                       port = serial->port[i];
-                       if (!port)
-                               continue;
-                       port_free(port);
+       /* Now that nothing is using the ports, they can be freed */
+       for (i = 0; i < serial->num_port_pointers; ++i) {
+               port = serial->port[i];
+               if (port) {
+                       port->serial = NULL;
+                       put_device(&port->dev);
                }
        }
 
        usb_put_dev(serial->dev);
-
-       /* free up any memory that we allocated */
        kfree(serial);
 }
 
 void usb_serial_put(struct usb_serial *serial)
 {
-       mutex_lock(&table_lock);
        kref_put(&serial->kref, destroy_serial);
-       mutex_unlock(&table_lock);
 }
 
 /*****************************************************************************
  * Driver tty interface functions
  *****************************************************************************/
-static int serial_open (struct tty_struct *tty, struct file *filp)
+
+/**
+ * serial_install - install tty
+ * @driver: the driver (USB in our case)
+ * @tty: the tty being created
+ *
+ * Create the termios objects for this tty.  We use the default
+ * USB serial settings but permit them to be overridden by
+ * serial->type->init_termios.
+ *
+ * This is the first place a new tty gets used.  Hence this is where we
+ * acquire references to the usb_serial structure and the driver module,
+ * where we store a pointer to the port, and where we do an autoresume.
+ * All these actions are reversed in serial_cleanup().
+ */
+static int serial_install(struct tty_driver *driver, struct tty_struct *tty)
 {
+       int idx = tty->index;
        struct usb_serial *serial;
        struct usb_serial_port *port;
-       unsigned int portNumber;
-       int retval;
+       int retval = -ENODEV;
 
        dbg("%s", __func__);
 
-       /* get the serial object associated with this tty pointer */
-       serial = usb_serial_get_by_index(tty->index);
-       if (!serial) {
-               tty->driver_data = NULL;
-               return -ENODEV;
-       }
+       serial = usb_serial_get_by_index(idx);
+       if (!serial)
+               return retval;
 
-       portNumber = tty->index - serial->minor;
-       port = serial->port[portNumber];
-       if (!port) {
-               retval = -ENODEV;
-               goto bailout_kref_put;
-       }
-
-       if (mutex_lock_interruptible(&port->mutex)) {
-               retval = -ERESTARTSYS;
-               goto bailout_kref_put;
-       }
+       port = serial->port[idx - serial->minor];
+       if (!port)
+               goto error_no_port;
+       if (!try_module_get(serial->type->driver.owner))
+               goto error_module_get;
 
-       ++port->port.count;
+       /* perform the standard setup */
+       retval = tty_init_termios(tty);
+       if (retval)
+               goto error_init_termios;
 
-       /* set up our port structure making the tty driver
-        * remember our port object, and us it */
-       tty->driver_data = port;
-       tty_port_tty_set(&port->port, tty);
+       retval = usb_autopm_get_interface(serial->interface);
+       if (retval)
+               goto error_get_interface;
 
-       if (port->port.count == 1) {
+       mutex_unlock(&serial->disc_mutex);
 
-               /* lock this module before we call it
-                * this may fail, which means we must bail out,
-                * safe because we are called with BKL held */
-               if (!try_module_get(serial->type->driver.owner)) {
-                       retval = -ENODEV;
-                       goto bailout_mutex_unlock;
-               }
+       /* allow the driver to update the settings */
+       if (serial->type->init_termios)
+               serial->type->init_termios(tty);
 
-               retval = usb_autopm_get_interface(serial->interface);
-               if (retval)
-                       goto bailout_module_put;
-               /* only call the device specific open if this
-                * is the first time the port is opened */
-               retval = serial->type->open(tty, port, filp);
-               if (retval)
-                       goto bailout_interface_put;
-       }
+       tty->driver_data = port;
 
-       mutex_unlock(&port->mutex);
-       return 0;
+       /* Final install (we use the default method) */
+       tty_driver_kref_get(driver);
+       tty->count++;
+       driver->ttys[idx] = tty;
+       return retval;
 
-bailout_interface_put:
-       usb_autopm_put_interface(serial->interface);
-bailout_module_put:
+ error_get_interface:
+ error_init_termios:
        module_put(serial->type->driver.owner);
-bailout_mutex_unlock:
-       port->port.count = 0;
-       tty->driver_data = NULL;
-       tty_port_tty_set(&port->port, NULL);
-       mutex_unlock(&port->mutex);
-bailout_kref_put:
+ error_module_get:
+ error_no_port:
        usb_serial_put(serial);
+       mutex_unlock(&serial->disc_mutex);
        return retval;
 }
 
-static void serial_close(struct tty_struct *tty, struct file *filp)
+static int serial_activate(struct tty_port *tport, struct tty_struct *tty)
+{
+       struct usb_serial_port *port =
+               container_of(tport, struct usb_serial_port, port);
+       struct usb_serial *serial = port->serial;
+       int retval;
+
+       mutex_lock(&serial->disc_mutex);
+       if (serial->disconnected)
+               retval = -ENODEV;
+       else
+               retval = port->serial->type->open(tty, port);
+       mutex_unlock(&serial->disc_mutex);
+       return retval;
+}
+
+static int serial_open(struct tty_struct *tty, struct file *filp)
 {
        struct usb_serial_port *port = tty->driver_data;
 
-       if (!port)
+       dbg("%s - port %d", __func__, port->number);
+       return tty_port_open(&port->port, tty, filp);
+}
+
+/**
+ * serial_down - shut down hardware
+ * @tport: tty port to shut down
+ *
+ * Shut down a USB serial port unless it is the console.  We never
+ * shut down the console hardware as it will always be in use. Serialized
+ * against activate by the tport mutex and kept to matching open/close pairs
+ * of calls by the ASYNCB_INITIALIZED flag.
+ */
+static void serial_down(struct tty_port *tport)
+{
+       struct usb_serial_port *port =
+               container_of(tport, struct usb_serial_port, port);
+       struct usb_serial_driver *drv = port->serial->type;
+       /*
+        * The console is magical.  Do not hang up the console hardware
+        * or there will be tears.
+        */
+       if (port->port.console)
                return;
+       if (drv->close)
+               drv->close(port);
+}
 
+static void serial_hangup(struct tty_struct *tty)
+{
+       struct usb_serial_port *port = tty->driver_data;
        dbg("%s - port %d", __func__, port->number);
+       tty_port_hangup(&port->port);
+}
 
-       mutex_lock(&port->mutex);
+static void serial_close(struct tty_struct *tty, struct file *filp)
+{
+       struct usb_serial_port *port = tty->driver_data;
+       dbg("%s - port %d", __func__, port->number);
+       tty_port_close(&port->port, tty, filp);
+}
+
+/**
+ * serial_cleanup - free resources post close/hangup
+ * @port: port to free up
+ *
+ * Do the resource freeing and refcount dropping for the port.
+ * Avoid freeing the console.
+ *
+ * Called asynchronously after the last tty kref is dropped,
+ * and the tty layer has already done the tty_shutdown(tty);
+ */
+static void serial_cleanup(struct tty_struct *tty)
+{
+       struct usb_serial_port *port = tty->driver_data;
+       struct usb_serial *serial;
+       struct module *owner;
 
-       if (port->port.count == 0) {
-               mutex_unlock(&port->mutex);
+       /* The console is magical.  Do not hang up the console hardware
+        * or there will be tears.
+        */
+       if (port->port.console)
                return;
-       }
 
-       if (port->port.count == 1)
-               /* only call the device specific close if this
-                * port is being closed by the last owner. Ensure we do
-                * this before we drop the port count. The call is protected
-                * by the port mutex
-                */
-               port->serial->type->close(tty, port, filp);
-
-       if (port->port.count == (port->console ? 2 : 1)) {
-               struct tty_struct *tty = tty_port_tty_get(&port->port);
-               if (tty) {
-                       /* We must do this before we drop the port count to
-                          zero. */
-                       if (tty->driver_data)
-                               tty->driver_data = NULL;
-                       tty_port_tty_set(&port->port, NULL);
-                       tty_kref_put(tty);
-               }
-       }
+       dbg("%s - port %d", __func__, port->number);
 
-       if (port->port.count == 1) {
-               mutex_lock(&port->serial->disc_mutex);
-               if (!port->serial->disconnected)
-                       usb_autopm_put_interface(port->serial->interface);
-               mutex_unlock(&port->serial->disc_mutex);
-               module_put(port->serial->type->driver.owner);
-       }
-       --port->port.count;
+       tty->driver_data = NULL;
+
+       serial = port->serial;
+       owner = serial->type->driver.owner;
+
+       mutex_lock(&serial->disc_mutex);
+       if (!serial->disconnected)
+               usb_autopm_put_interface(serial->interface);
+       mutex_unlock(&serial->disc_mutex);
 
-       mutex_unlock(&port->mutex);
-       usb_serial_put(port->serial);
+       usb_serial_put(serial);
+       module_put(owner);
 }
 
 static int serial_write(struct tty_struct *tty, const unsigned char *buf,
@@ -313,10 +358,6 @@ static int serial_write(struct tty_struct *tty, const unsigned char *buf,
 
        dbg("%s - port %d, %d byte(s)", __func__, port->number, count);
 
-       /* count is managed under the mutex lock for the tty so cannot
-          drop to zero until after the last close completes */
-       WARN_ON(!port->port.count);
-
        /* pass on to the driver specific version of this function */
        retval = port->serial->type->write(tty, port, buf, count);
 
@@ -328,7 +369,6 @@ static int serial_write_room(struct tty_struct *tty)
 {
        struct usb_serial_port *port = tty->driver_data;
        dbg("%s - port %d", __func__, port->number);
-       WARN_ON(!port->port.count);
        /* pass on to the driver specific version of this function */
        return port->serial->type->write_room(tty);
 }
@@ -336,9 +376,8 @@ static int serial_write_room(struct tty_struct *tty)
 static int serial_chars_in_buffer(struct tty_struct *tty)
 {
        struct usb_serial_port *port = tty->driver_data;
-       dbg("%s = port %d", __func__, port->number);
+       dbg("%s - port %d", __func__, port->number);
 
-       WARN_ON(!port->port.count);
        /* if the device was unplugged then any remaining characters
           fell out of the connector ;) */
        if (port->serial->disconnected)
@@ -352,7 +391,6 @@ static void serial_throttle(struct tty_struct *tty)
        struct usb_serial_port *port = tty->driver_data;
        dbg("%s - port %d", __func__, port->number);
 
-       WARN_ON(!port->port.count);
        /* pass on to the driver specific version of this function */
        if (port->serial->type->throttle)
                port->serial->type->throttle(tty);
@@ -363,13 +401,12 @@ static void serial_unthrottle(struct tty_struct *tty)
        struct usb_serial_port *port = tty->driver_data;
        dbg("%s - port %d", __func__, port->number);
 
-       WARN_ON(!port->port.count);
        /* pass on to the driver specific version of this function */
        if (port->serial->type->unthrottle)
                port->serial->type->unthrottle(tty);
 }
 
-static int serial_ioctl(struct tty_struct *tty, struct file *file,
+static int serial_ioctl(struct tty_struct *tty,
                                        unsigned int cmd, unsigned long arg)
 {
        struct usb_serial_port *port = tty->driver_data;
@@ -377,14 +414,10 @@ static int serial_ioctl(struct tty_struct *tty, struct file *file,
 
        dbg("%s - port %d, cmd 0x%.4x", __func__, port->number, cmd);
 
-       WARN_ON(!port->port.count);
-
        /* pass on to the driver specific version of this function
           if it is available */
        if (port->serial->type->ioctl) {
-               lock_kernel();
-               retval = port->serial->type->ioctl(tty, file, cmd, arg);
-               unlock_kernel();
+               retval = port->serial->type->ioctl(tty, cmd, arg);
        } else
                retval = -ENOIOCTLCMD;
        return retval;
@@ -395,7 +428,6 @@ static void serial_set_termios(struct tty_struct *tty, struct ktermios *old)
        struct usb_serial_port *port = tty->driver_data;
        dbg("%s - port %d", __func__, port->number);
 
-       WARN_ON(!port->port.count);
        /* pass on to the driver specific version of this function
           if it is available */
        if (port->serial->type->set_termios)
@@ -410,90 +442,92 @@ static int serial_break(struct tty_struct *tty, int break_state)
 
        dbg("%s - port %d", __func__, port->number);
 
-       WARN_ON(!port->port.count);
        /* pass on to the driver specific version of this function
           if it is available */
-       if (port->serial->type->break_ctl) {
-               lock_kernel();
+       if (port->serial->type->break_ctl)
                port->serial->type->break_ctl(tty, break_state);
-               unlock_kernel();
-       }
        return 0;
 }
 
-static int serial_read_proc(char *page, char **start, off_t off, int count,
-                                                       int *eof, void *data)
+static int serial_proc_show(struct seq_file *m, void *v)
 {
        struct usb_serial *serial;
-       int length = 0;
        int i;
-       off_t begin = 0;
        char tmp[40];
 
        dbg("%s", __func__);
-       length += sprintf(page, "usbserinfo:1.0 driver:2.0\n");
-       for (i = 0; i < SERIAL_TTY_MINORS && length < PAGE_SIZE; ++i) {
+       seq_puts(m, "usbserinfo:1.0 driver:2.0\n");
+       for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
                serial = usb_serial_get_by_index(i);
                if (serial == NULL)
                        continue;
 
-               length += sprintf(page+length, "%d:", i);
+               seq_printf(m, "%d:", i);
                if (serial->type->driver.owner)
-                       length += sprintf(page+length, " module:%s",
+                       seq_printf(m, " module:%s",
                                module_name(serial->type->driver.owner));
-               length += sprintf(page+length, " name:\"%s\"",
+               seq_printf(m, " name:\"%s\"",
                                serial->type->description);
-               length += sprintf(page+length, " vendor:%04x product:%04x",
+               seq_printf(m, " vendor:%04x product:%04x",
                        le16_to_cpu(serial->dev->descriptor.idVendor),
                        le16_to_cpu(serial->dev->descriptor.idProduct));
-               length += sprintf(page+length, " num_ports:%d",
-                                                       serial->num_ports);
-               length += sprintf(page+length, " port:%d",
-                                                       i - serial->minor + 1);
+               seq_printf(m, " num_ports:%d", serial->num_ports);
+               seq_printf(m, " port:%d", i - serial->minor + 1);
                usb_make_path(serial->dev, tmp, sizeof(tmp));
-               length += sprintf(page+length, " path:%s", tmp);
+               seq_printf(m, " path:%s", tmp);
 
-               length += sprintf(page+length, "\n");
-               if ((length + begin) > (off + count)) {
-                       usb_serial_put(serial);
-                       goto done;
-               }
-               if ((length + begin) < off) {
-                       begin += length;
-                       length = 0;
-               }
+               seq_putc(m, '\n');
                usb_serial_put(serial);
+               mutex_unlock(&serial->disc_mutex);
        }
-       *eof = 1;
-done:
-       if (off >= (length + begin))
-               return 0;
-       *start = page + (off-begin);
-       return (count < begin+length-off) ? count : begin+length-off;
+       return 0;
 }
 
-static int serial_tiocmget(struct tty_struct *tty, struct file *file)
+static int serial_proc_open(struct inode *inode, struct file *file)
+{
+       return single_open(file, serial_proc_show, NULL);
+}
+
+static const struct file_operations serial_proc_fops = {
+       .owner          = THIS_MODULE,
+       .open           = serial_proc_open,
+       .read           = seq_read,
+       .llseek         = seq_lseek,
+       .release        = single_release,
+};
+
+static int serial_tiocmget(struct tty_struct *tty)
 {
        struct usb_serial_port *port = tty->driver_data;
 
        dbg("%s - port %d", __func__, port->number);
 
-       WARN_ON(!port->port.count);
        if (port->serial->type->tiocmget)
-               return port->serial->type->tiocmget(tty, file);
+               return port->serial->type->tiocmget(tty);
        return -EINVAL;
 }
 
-static int serial_tiocmset(struct tty_struct *tty, struct file *file,
+static int serial_tiocmset(struct tty_struct *tty,
                            unsigned int set, unsigned int clear)
 {
        struct usb_serial_port *port = tty->driver_data;
 
        dbg("%s - port %d", __func__, port->number);
 
-       WARN_ON(!port->port.count);
        if (port->serial->type->tiocmset)
-               return port->serial->type->tiocmset(tty, file, set, clear);
+               return port->serial->type->tiocmset(tty, set, clear);
+       return -EINVAL;
+}
+
+static int serial_get_icount(struct tty_struct *tty,
+                               struct serial_icounter_struct *icount)
+{
+       struct usb_serial_port *port = tty->driver_data;
+
+       dbg("%s - port %d", __func__, port->number);
+
+       if (port->serial->type->get_icount)
+               return port->serial->type->get_icount(tty, icount);
        return -EINVAL;
 }
 
@@ -516,9 +550,6 @@ static void usb_serial_port_work(struct work_struct *work)
 
        dbg("%s - port %d", __func__, port->number);
 
-       if (!port)
-               return;
-
        tty = tty_port_tty_get(&port->port);
        if (!tty)
                return;
@@ -527,18 +558,14 @@ static void usb_serial_port_work(struct work_struct *work)
        tty_kref_put(tty);
 }
 
-static void port_release(struct device *dev)
-{
-       struct usb_serial_port *port = to_usb_serial_port(dev);
-
-       dbg ("%s - %s", __func__, dev_name(dev));
-       port_free(port);
-}
-
 static void kill_traffic(struct usb_serial_port *port)
 {
+       int i;
+
        usb_kill_urb(port->read_urb);
        usb_kill_urb(port->write_urb);
+       for (i = 0; i < ARRAY_SIZE(port->write_urbs); ++i)
+               usb_kill_urb(port->write_urbs[i]);
        /*
         * This is tricky.
         * Some drivers submit the read_urb in the
@@ -554,18 +581,33 @@ static void kill_traffic(struct usb_serial_port *port)
        usb_kill_urb(port->interrupt_out_urb);
 }
 
-static void port_free(struct usb_serial_port *port)
+static void port_release(struct device *dev)
 {
+       struct usb_serial_port *port = to_usb_serial_port(dev);
+       int i;
+
+       dbg ("%s - %s", __func__, dev_name(dev));
+
+       /*
+        * Stop all the traffic before cancelling the work, so that
+        * nobody will restart it by calling usb_serial_port_softint.
+        */
        kill_traffic(port);
+       cancel_work_sync(&port->work);
+
        usb_free_urb(port->read_urb);
        usb_free_urb(port->write_urb);
        usb_free_urb(port->interrupt_in_urb);
        usb_free_urb(port->interrupt_out_urb);
+       for (i = 0; i < ARRAY_SIZE(port->write_urbs); ++i) {
+               usb_free_urb(port->write_urbs[i]);
+               kfree(port->bulk_out_buffers[i]);
+       }
+       kfifo_free(&port->write_fifo);
        kfree(port->bulk_in_buffer);
        kfree(port->bulk_out_buffer);
        kfree(port->interrupt_in_buffer);
        kfree(port->interrupt_out_buffer);
-       flush_scheduled_work();         /* port->work */
        kfree(port);
 }
 
@@ -623,6 +665,7 @@ exit:
        return id;
 }
 
+/* Caller must hold table_lock */
 static struct usb_serial_driver *search_serial_device(
                                        struct usb_interface *iface)
 {
@@ -639,6 +682,31 @@ static struct usb_serial_driver *search_serial_device(
        return NULL;
 }
 
+static int serial_carrier_raised(struct tty_port *port)
+{
+       struct usb_serial_port *p = container_of(port, struct usb_serial_port, port);
+       struct usb_serial_driver *drv = p->serial->type;
+       if (drv->carrier_raised)
+               return drv->carrier_raised(p);
+       /* No carrier control - don't block */
+       return 1;       
+}
+
+static void serial_dtr_rts(struct tty_port *port, int on)
+{
+       struct usb_serial_port *p = container_of(port, struct usb_serial_port, port);
+       struct usb_serial_driver *drv = p->serial->type;
+       if (drv->dtr_rts)
+               drv->dtr_rts(p, on);
+}
+
+static const struct tty_port_operations serial_port_ops = {
+       .carrier_raised = serial_carrier_raised,
+       .dtr_rts = serial_dtr_rts,
+       .activate = serial_activate,
+       .shutdown = serial_down,
+};
+
 int usb_serial_probe(struct usb_interface *interface,
                               const struct usb_device_id *id)
 {
@@ -663,17 +731,24 @@ int usb_serial_probe(struct usb_interface *interface,
        int num_ports = 0;
        int max_endpoints;
 
-       lock_kernel(); /* guard against unloading a serial driver module */
+       mutex_lock(&table_lock);
        type = search_serial_device(interface);
        if (!type) {
-               unlock_kernel();
+               mutex_unlock(&table_lock);
                dbg("none matched");
                return -ENODEV;
        }
 
+       if (!try_module_get(type->driver.owner)) {
+               mutex_unlock(&table_lock);
+               dev_err(&interface->dev, "module get failed, exiting\n");
+               return -EIO;
+       }
+       mutex_unlock(&table_lock);
+
        serial = create_serial(dev, interface, type);
        if (!serial) {
-               unlock_kernel();
+               module_put(type->driver.owner);
                dev_err(&interface->dev, "%s - out of memory\n", __func__);
                return -ENOMEM;
        }
@@ -682,22 +757,13 @@ int usb_serial_probe(struct usb_interface *interface,
        if (type->probe) {
                const struct usb_device_id *id;
 
-               if (!try_module_get(type->driver.owner)) {
-                       unlock_kernel();
-                       dev_err(&interface->dev,
-                               "module get failed, exiting\n");
-                       kfree(serial);
-                       return -EIO;
-               }
-
                id = get_iface_id(type, interface);
                retval = type->probe(serial, id);
-               module_put(type->driver.owner);
 
                if (retval) {
-                       unlock_kernel();
                        dbg("sub driver rejected device");
                        kfree(serial);
+                       module_put(type->driver.owner);
                        return retval;
                }
        }
@@ -767,9 +833,9 @@ int usb_serial_probe(struct usb_interface *interface,
                 * properly during a later invocation of usb_serial_probe
                 */
                if (num_bulk_in == 0 || num_bulk_out == 0) {
-                       unlock_kernel();
                        dev_info(&interface->dev, "PL-2303 hack: descriptors matched but endpoints did not\n");
                        kfree(serial);
+                       module_put(type->driver.owner);
                        return -ENODEV;
                }
        }
@@ -780,27 +846,18 @@ int usb_serial_probe(struct usb_interface *interface,
        if (type == &usb_serial_generic_device) {
                num_ports = num_bulk_out;
                if (num_ports == 0) {
-                       unlock_kernel();
                        dev_err(&interface->dev,
                            "Generic device with no bulk out, not allowed.\n");
                        kfree(serial);
+                       module_put(type->driver.owner);
                        return -EIO;
                }
        }
 #endif
        if (!num_ports) {
                /* if this device type has a calc_num_ports function, call it */
-               if (type->calc_num_ports) {
-                       if (!try_module_get(type->driver.owner)) {
-                               unlock_kernel();
-                               dev_err(&interface->dev,
-                                       "module get failed, exiting\n");
-                               kfree(serial);
-                               return -EIO;
-                       }
+               if (type->calc_num_ports)
                        num_ports = type->calc_num_ports(serial);
-                       module_put(type->driver.owner);
-               }
                if (!num_ports)
                        num_ports = type->num_ports;
        }
@@ -823,7 +880,6 @@ int usb_serial_probe(struct usb_interface *interface,
        max_endpoints = max(max_endpoints, num_interrupt_out);
        max_endpoints = max(max_endpoints, (int)serial->num_ports);
        serial->num_port_pointers = max_endpoints;
-       unlock_kernel();
 
        dbg("%s - setting up %d port structures for this device",
                                                __func__, max_endpoints);
@@ -832,11 +888,18 @@ int usb_serial_probe(struct usb_interface *interface,
                if (!port)
                        goto probe_error;
                tty_port_init(&port->port);
+               port->port.ops = &serial_port_ops;
                port->serial = serial;
                spin_lock_init(&port->lock);
-               mutex_init(&port->mutex);
+               /* Keep this for private driver use for the moment but
+                  should probably go away */
                INIT_WORK(&port->work, usb_serial_port_work);
                serial->port[i] = port;
+               port->dev.parent = &interface->dev;
+               port->dev.driver = NULL;
+               port->dev.bus = &usb_serial_bus_type;
+               port->dev.release = &port_release;
+               device_initialize(&port->dev);
        }
 
        /* set up the endpoint information */
@@ -848,7 +911,8 @@ int usb_serial_probe(struct usb_interface *interface,
                        dev_err(&interface->dev, "No free urbs available\n");
                        goto probe_error;
                }
-               buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
+               buffer_size = max_t(int, serial->type->bulk_in_size,
+                               usb_endpoint_maxp(endpoint));
                port->bulk_in_size = buffer_size;
                port->bulk_in_endpointAddress = endpoint->bEndpointAddress;
                port->bulk_in_buffer = kmalloc(buffer_size, GFP_KERNEL);
@@ -865,6 +929,8 @@ int usb_serial_probe(struct usb_interface *interface,
        }
 
        for (i = 0; i < num_bulk_out; ++i) {
+               int j;
+
                endpoint = bulk_out_endpoint[i];
                port = serial->port[i];
                port->write_urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -872,7 +938,11 @@ int usb_serial_probe(struct usb_interface *interface,
                        dev_err(&interface->dev, "No free urbs available\n");
                        goto probe_error;
                }
-               buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
+               if (kfifo_alloc(&port->write_fifo, PAGE_SIZE, GFP_KERNEL))
+                       goto probe_error;
+               buffer_size = serial->type->bulk_out_size;
+               if (!buffer_size)
+                       buffer_size = usb_endpoint_maxp(endpoint);
                port->bulk_out_size = buffer_size;
                port->bulk_out_endpointAddress = endpoint->bEndpointAddress;
                port->bulk_out_buffer = kmalloc(buffer_size, GFP_KERNEL);
@@ -886,6 +956,28 @@ int usb_serial_probe(struct usb_interface *interface,
                                        endpoint->bEndpointAddress),
                                port->bulk_out_buffer, buffer_size,
                                serial->type->write_bulk_callback, port);
+               for (j = 0; j < ARRAY_SIZE(port->write_urbs); ++j) {
+                       set_bit(j, &port->write_urbs_free);
+                       port->write_urbs[j] = usb_alloc_urb(0, GFP_KERNEL);
+                       if (!port->write_urbs[j]) {
+                               dev_err(&interface->dev,
+                                               "No free urbs available\n");
+                               goto probe_error;
+                       }
+                       port->bulk_out_buffers[j] = kmalloc(buffer_size,
+                                                               GFP_KERNEL);
+                       if (!port->bulk_out_buffers[j]) {
+                               dev_err(&interface->dev,
+                                       "Couldn't allocate bulk_out_buffer\n");
+                               goto probe_error;
+                       }
+                       usb_fill_bulk_urb(port->write_urbs[j], dev,
+                                       usb_sndbulkpipe(dev,
+                                               endpoint->bEndpointAddress),
+                                       port->bulk_out_buffers[j], buffer_size,
+                                       serial->type->write_bulk_callback,
+                                       port);
+               }
        }
 
        if (serial->type->read_int_callback) {
@@ -898,7 +990,7 @@ int usb_serial_probe(struct usb_interface *interface,
                                                "No free urbs available\n");
                                goto probe_error;
                        }
-                       buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
+                       buffer_size = usb_endpoint_maxp(endpoint);
                        port->interrupt_in_endpointAddress =
                                                endpoint->bEndpointAddress;
                        port->interrupt_in_buffer = kmalloc(buffer_size,
@@ -929,7 +1021,7 @@ int usb_serial_probe(struct usb_interface *interface,
                                                "No free urbs available\n");
                                goto probe_error;
                        }
-                       buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
+                       buffer_size = usb_endpoint_maxp(endpoint);
                        port->interrupt_out_size = buffer_size;
                        port->interrupt_out_endpointAddress =
                                                endpoint->bEndpointAddress;
@@ -953,22 +1045,26 @@ int usb_serial_probe(struct usb_interface *interface,
 
        /* if this device type has an attach function, call it */
        if (type->attach) {
-               if (!try_module_get(type->driver.owner)) {
-                       dev_err(&interface->dev,
-                                       "module get failed, exiting\n");
-                       goto probe_error;
-               }
                retval = type->attach(serial);
-               module_put(type->driver.owner);
                if (retval < 0)
                        goto probe_error;
+               serial->attached = 1;
                if (retval > 0) {
                        /* quietly accept this device, but don't bind to a
                           serial port as it's about to disappear */
+                       serial->num_ports = 0;
                        goto exit;
                }
+       } else {
+               serial->attached = 1;
        }
 
+       /* Avoid race with tty_open and serial_install by setting the
+        * disconnected flag and not clearing it until all ports have been
+        * registered.
+        */
+       serial->disconnected = 1;
+
        if (get_free_serial(serial, num_ports, &minor) == NULL) {
                dev_err(&interface->dev, "No more free serial devices\n");
                goto probe_error;
@@ -978,60 +1074,34 @@ int usb_serial_probe(struct usb_interface *interface,
        /* register all of the individual ports with the driver core */
        for (i = 0; i < num_ports; ++i) {
                port = serial->port[i];
-               port->dev.parent = &interface->dev;
-               port->dev.driver = NULL;
-               port->dev.bus = &usb_serial_bus_type;
-               port->dev.release = &port_release;
-
                dev_set_name(&port->dev, "ttyUSB%d", port->number);
                dbg ("%s - registering %s", __func__, dev_name(&port->dev));
-               retval = device_register(&port->dev);
-               if (retval)
+               port->dev_state = PORT_REGISTERING;
+               device_enable_async_suspend(&port->dev);
+
+               retval = device_add(&port->dev);
+               if (retval) {
                        dev_err(&port->dev, "Error registering port device, "
                                "continuing\n");
+                       port->dev_state = PORT_UNREGISTERED;
+               } else {
+                       port->dev_state = PORT_REGISTERED;
+               }
        }
 
+       serial->disconnected = 0;
+
        usb_serial_console_init(debug, minor);
 
 exit:
        /* success */
        usb_set_intfdata(interface, serial);
+       module_put(type->driver.owner);
        return 0;
 
 probe_error:
-       for (i = 0; i < num_bulk_in; ++i) {
-               port = serial->port[i];
-               if (!port)
-                       continue;
-               usb_free_urb(port->read_urb);
-               kfree(port->bulk_in_buffer);
-       }
-       for (i = 0; i < num_bulk_out; ++i) {
-               port = serial->port[i];
-               if (!port)
-                       continue;
-               usb_free_urb(port->write_urb);
-               kfree(port->bulk_out_buffer);
-       }
-       for (i = 0; i < num_interrupt_in; ++i) {
-               port = serial->port[i];
-               if (!port)
-                       continue;
-               usb_free_urb(port->interrupt_in_urb);
-               kfree(port->interrupt_in_buffer);
-       }
-       for (i = 0; i < num_interrupt_out; ++i) {
-               port = serial->port[i];
-               if (!port)
-                       continue;
-               usb_free_urb(port->interrupt_out_urb);
-               kfree(port->interrupt_out_buffer);
-       }
-
-       /* free up any memory that we allocated */
-       for (i = 0; i < serial->num_port_pointers; ++i)
-               kfree(serial->port[i]);
-       kfree(serial);
+       usb_serial_put(serial);
+       module_put(type->driver.owner);
        return -EIO;
 }
 EXPORT_SYMBOL_GPL(usb_serial_probe);
@@ -1050,20 +1120,39 @@ void usb_serial_disconnect(struct usb_interface *interface)
        usb_set_intfdata(interface, NULL);
        /* must set a flag, to signal subdrivers */
        serial->disconnected = 1;
+       mutex_unlock(&serial->disc_mutex);
+
        for (i = 0; i < serial->num_ports; ++i) {
                port = serial->port[i];
                if (port) {
                        struct tty_struct *tty = tty_port_tty_get(&port->port);
                        if (tty) {
-                               tty_hangup(tty);
+                               tty_vhangup(tty);
                                tty_kref_put(tty);
                        }
                        kill_traffic(port);
+                       cancel_work_sync(&port->work);
+                       if (port->dev_state == PORT_REGISTERED) {
+
+                               /* Make sure the port is bound so that the
+                                * driver's port_remove method is called.
+                                */
+                               if (!port->dev.driver) {
+                                       int rc;
+
+                                       port->dev.driver =
+                                                       &serial->type->driver;
+                                       rc = device_bind_driver(&port->dev);
+                               }
+                               port->dev_state = PORT_UNREGISTERING;
+                               device_del(&port->dev);
+                               port->dev_state = PORT_UNREGISTERED;
+                       }
                }
        }
-       /* let the last holder of this object
-        * cause it to be cleaned up */
-       mutex_unlock(&serial->disc_mutex);
+       serial->type->disconnect(serial);
+
+       /* let the last holder of this object cause it to be cleaned up */
        usb_serial_put(serial);
        dev_info(dev, "device disconnected\n");
 }
@@ -1075,15 +1164,23 @@ int usb_serial_suspend(struct usb_interface *intf, pm_message_t message)
        struct usb_serial_port *port;
        int i, r = 0;
 
+       serial->suspending = 1;
+
+       if (serial->type->suspend) {
+               r = serial->type->suspend(serial, message);
+               if (r < 0) {
+                       serial->suspending = 0;
+                       goto err_out;
+               }
+       }
+
        for (i = 0; i < serial->num_ports; ++i) {
                port = serial->port[i];
                if (port)
                        kill_traffic(port);
        }
 
-       if (serial->type->suspend)
-               r = serial->type->suspend(serial, message);
-
+err_out:
        return r;
 }
 EXPORT_SYMBOL(usb_serial_suspend);
@@ -1091,10 +1188,15 @@ EXPORT_SYMBOL(usb_serial_suspend);
 int usb_serial_resume(struct usb_interface *intf)
 {
        struct usb_serial *serial = usb_get_intfdata(intf);
+       int rv;
 
+       serial->suspending = 0;
        if (serial->type->resume)
-               return serial->type->resume(serial);
-       return 0;
+               rv = serial->type->resume(serial);
+       else
+               rv = usb_serial_generic_resume(serial);
+
+       return rv;
 }
 EXPORT_SYMBOL(usb_serial_resume);
 
@@ -1102,6 +1204,7 @@ static const struct tty_operations serial_ops = {
        .open =                 serial_open,
        .close =                serial_close,
        .write =                serial_write,
+       .hangup =               serial_hangup,
        .write_room =           serial_write_room,
        .ioctl =                serial_ioctl,
        .set_termios =          serial_set_termios,
@@ -1109,11 +1212,15 @@ static const struct tty_operations serial_ops = {
        .unthrottle =           serial_unthrottle,
        .break_ctl =            serial_break,
        .chars_in_buffer =      serial_chars_in_buffer,
-       .read_proc =            serial_read_proc,
        .tiocmget =             serial_tiocmget,
        .tiocmset =             serial_tiocmset,
+       .get_icount =           serial_get_icount,
+       .cleanup =              serial_cleanup,
+       .install =              serial_install,
+       .proc_fops =            &serial_proc_fops,
 };
 
+
 struct tty_driver *usb_serial_tty_driver;
 
 static int __init usb_serial_init(void)
@@ -1229,8 +1336,10 @@ static void fixup_generic(struct usb_serial_driver *device)
        set_to_generic_if_null(device, chars_in_buffer);
        set_to_generic_if_null(device, read_bulk_callback);
        set_to_generic_if_null(device, write_bulk_callback);
-       set_to_generic_if_null(device, shutdown);
-       set_to_generic_if_null(device, resume);
+       set_to_generic_if_null(device, disconnect);
+       set_to_generic_if_null(device, release);
+       set_to_generic_if_null(device, process_read_urb);
+       set_to_generic_if_null(device, prepare_write_buffer);
 }
 
 int usb_serial_register(struct usb_serial_driver *driver)
@@ -1238,12 +1347,22 @@ int usb_serial_register(struct usb_serial_driver *driver)
        /* must be called with BKL held */
        int retval;
 
+       if (usb_disabled())
+               return -ENODEV;
+
        fixup_generic(driver);
 
        if (!driver->description)
                driver->description = driver->driver.name;
+       if (!driver->usb_driver) {
+               WARN(1, "Serial driver %s has no usb_driver\n",
+                               driver->description);
+               return -EINVAL;
+       }
+       driver->usb_driver->supports_autosuspend = 1;
 
        /* Add this device to our list of devices */
+       mutex_lock(&table_lock);
        list_add(&driver->driver_list, &usb_serial_driver_list);
 
        retval = usb_serial_bus_register(driver);
@@ -1255,6 +1374,7 @@ int usb_serial_register(struct usb_serial_driver *driver)
                printk(KERN_INFO "USB Serial support registered for %s\n",
                                                driver->description);
 
+       mutex_unlock(&table_lock);
        return retval;
 }
 EXPORT_SYMBOL_GPL(usb_serial_register);
@@ -1265,8 +1385,10 @@ void usb_serial_deregister(struct usb_serial_driver *device)
        /* must be called with BKL held */
        printk(KERN_INFO "USB Serial deregistering driver %s\n",
               device->description);
+       mutex_lock(&table_lock);
        list_del(&device->driver_list);
        usb_serial_bus_deregister(device);
+       mutex_unlock(&table_lock);
 }
 EXPORT_SYMBOL_GPL(usb_serial_deregister);