Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 1991, 1992 Linus Torvalds
4 */
5
6/*
7 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
8 * or rs-channels. It also implements echoing, cooked mode etc.
9 *
10 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
11 *
12 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
13 * tty_struct and tty_queue structures. Previously there was an array
14 * of 256 tty_struct's which was statically allocated, and the
15 * tty_queue structures were allocated at boot time. Both are now
16 * dynamically allocated only when the tty is open.
17 *
18 * Also restructured routines so that there is more of a separation
19 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
20 * the low-level tty routines (serial.c, pty.c, console.c). This
21 * makes for cleaner and more compact code. -TYT, 9/17/92
22 *
23 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
24 * which can be dynamically activated and de-activated by the line
25 * discipline handling modules (like SLIP).
26 *
27 * NOTE: pay no attention to the line discipline code (yet); its
28 * interface is still subject to change in this version...
29 * -- TYT, 1/31/92
30 *
31 * Added functionality to the OPOST tty handling. No delays, but all
32 * other bits should be there.
33 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
34 *
35 * Rewrote canonical mode and added more termios flags.
36 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
37 *
38 * Reorganized FASYNC support so mouse code can share it.
39 * -- ctm@ardi.com, 9Sep95
40 *
41 * New TIOCLINUX variants added.
42 * -- mj@k332.feld.cvut.cz, 19-Nov-95
43 *
44 * Restrict vt switching via ioctl()
45 * -- grif@cs.ucr.edu, 5-Dec-95
46 *
47 * Move console and virtual terminal code to more appropriate files,
48 * implement CONFIG_VT and generalize console device interface.
49 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
50 *
51 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
52 * -- Bill Hawes <whawes@star.net>, June 97
53 *
54 * Added devfs support.
55 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
56 *
57 * Added support for a Unix98-style ptmx device.
58 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
59 *
60 * Reduced memory usage for older ARM systems
61 * -- Russell King <rmk@arm.linux.org.uk>
62 *
63 * Move do_SAK() into process context. Less stack use in devfs functions.
64 * alloc_tty_struct() always uses kmalloc()
65 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66 */
67
68#include <linux/types.h>
69#include <linux/major.h>
70#include <linux/errno.h>
71#include <linux/signal.h>
72#include <linux/fcntl.h>
73#include <linux/sched/signal.h>
74#include <linux/sched/task.h>
75#include <linux/interrupt.h>
76#include <linux/tty.h>
77#include <linux/tty_driver.h>
78#include <linux/tty_flip.h>
79#include <linux/devpts_fs.h>
80#include <linux/file.h>
81#include <linux/fdtable.h>
82#include <linux/console.h>
83#include <linux/timer.h>
84#include <linux/ctype.h>
85#include <linux/kd.h>
86#include <linux/mm.h>
87#include <linux/string.h>
88#include <linux/slab.h>
89#include <linux/poll.h>
90#include <linux/proc_fs.h>
91#include <linux/init.h>
92#include <linux/module.h>
93#include <linux/device.h>
94#include <linux/wait.h>
95#include <linux/bitops.h>
96#include <linux/delay.h>
97#include <linux/seq_file.h>
98#include <linux/serial.h>
99#include <linux/ratelimit.h>
100#include <linux/compat.h>
101
102#include <linux/uaccess.h>
103
104#include <linux/kbd_kern.h>
105#include <linux/vt_kern.h>
106#include <linux/selection.h>
107
108#include <linux/kmod.h>
109#include <linux/nsproxy.h>
110
111#undef TTY_DEBUG_HANGUP
112#ifdef TTY_DEBUG_HANGUP
113# define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
114#else
115# define tty_debug_hangup(tty, f, args...) do { } while (0)
116#endif
117
118#define TTY_PARANOIA_CHECK 1
119#define CHECK_TTY_COUNT 1
120
121struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
122 .c_iflag = ICRNL | IXON,
123 .c_oflag = OPOST | ONLCR,
124 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
125 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
126 ECHOCTL | ECHOKE | IEXTEN,
127 .c_cc = INIT_C_CC,
128 .c_ispeed = 38400,
129 .c_ospeed = 38400,
130 /* .c_line = N_TTY, */
131};
132
133EXPORT_SYMBOL(tty_std_termios);
134
135/* This list gets poked at by procfs and various bits of boot up code. This
136 could do with some rationalisation such as pulling the tty proc function
137 into this file */
138
139LIST_HEAD(tty_drivers); /* linked list of tty drivers */
140
141/* Mutex to protect creating and releasing a tty */
142DEFINE_MUTEX(tty_mutex);
143
144static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
145static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
146ssize_t redirected_tty_write(struct file *, const char __user *,
147 size_t, loff_t *);
148static __poll_t tty_poll(struct file *, poll_table *);
149static int tty_open(struct inode *, struct file *);
150long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
151#ifdef CONFIG_COMPAT
152static long tty_compat_ioctl(struct file *file, unsigned int cmd,
153 unsigned long arg);
154#else
155#define tty_compat_ioctl NULL
156#endif
157static int __tty_fasync(int fd, struct file *filp, int on);
158static int tty_fasync(int fd, struct file *filp, int on);
159static void release_tty(struct tty_struct *tty, int idx);
160
161/**
162 * free_tty_struct - free a disused tty
163 * @tty: tty struct to free
164 *
165 * Free the write buffers, tty queue and tty memory itself.
166 *
167 * Locking: none. Must be called after tty is definitely unused
168 */
169
170static void free_tty_struct(struct tty_struct *tty)
171{
172 tty_ldisc_deinit(tty);
173 put_device(tty->dev);
174 kfree(tty->write_buf);
175 tty->magic = 0xDEADDEAD;
176 kfree(tty);
177}
178
179static inline struct tty_struct *file_tty(struct file *file)
180{
181 return ((struct tty_file_private *)file->private_data)->tty;
182}
183
184int tty_alloc_file(struct file *file)
185{
186 struct tty_file_private *priv;
187
188 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
189 if (!priv)
190 return -ENOMEM;
191
192 file->private_data = priv;
193
194 return 0;
195}
196
197/* Associate a new file with the tty structure */
198void tty_add_file(struct tty_struct *tty, struct file *file)
199{
200 struct tty_file_private *priv = file->private_data;
201
202 priv->tty = tty;
203 priv->file = file;
204
205 spin_lock(&tty->files_lock);
206 list_add(&priv->list, &tty->tty_files);
207 spin_unlock(&tty->files_lock);
208}
209
210/**
211 * tty_free_file - free file->private_data
212 *
213 * This shall be used only for fail path handling when tty_add_file was not
214 * called yet.
215 */
216void tty_free_file(struct file *file)
217{
218 struct tty_file_private *priv = file->private_data;
219
220 file->private_data = NULL;
221 kfree(priv);
222}
223
224/* Delete file from its tty */
225static void tty_del_file(struct file *file)
226{
227 struct tty_file_private *priv = file->private_data;
228 struct tty_struct *tty = priv->tty;
229
230 spin_lock(&tty->files_lock);
231 list_del(&priv->list);
232 spin_unlock(&tty->files_lock);
233 tty_free_file(file);
234}
235
236/**
237 * tty_name - return tty naming
238 * @tty: tty structure
239 *
240 * Convert a tty structure into a name. The name reflects the kernel
241 * naming policy and if udev is in use may not reflect user space
242 *
243 * Locking: none
244 */
245
246const char *tty_name(const struct tty_struct *tty)
247{
248 if (!tty) /* Hmm. NULL pointer. That's fun. */
249 return "NULL tty";
250 return tty->name;
251}
252
253EXPORT_SYMBOL(tty_name);
254
255const char *tty_driver_name(const struct tty_struct *tty)
256{
257 if (!tty || !tty->driver)
258 return "";
259 return tty->driver->name;
260}
261
262static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
263 const char *routine)
264{
265#ifdef TTY_PARANOIA_CHECK
266 if (!tty) {
267 pr_warn("(%d:%d): %s: NULL tty\n",
268 imajor(inode), iminor(inode), routine);
269 return 1;
270 }
271 if (tty->magic != TTY_MAGIC) {
272 pr_warn("(%d:%d): %s: bad magic number\n",
273 imajor(inode), iminor(inode), routine);
274 return 1;
275 }
276#endif
277 return 0;
278}
279
280/* Caller must hold tty_lock */
281static int check_tty_count(struct tty_struct *tty, const char *routine)
282{
283#ifdef CHECK_TTY_COUNT
284 struct list_head *p;
285 int count = 0, kopen_count = 0;
286
287 spin_lock(&tty->files_lock);
288 list_for_each(p, &tty->tty_files) {
289 count++;
290 }
291 spin_unlock(&tty->files_lock);
292 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
293 tty->driver->subtype == PTY_TYPE_SLAVE &&
294 tty->link && tty->link->count)
295 count++;
296 if (tty_port_kopened(tty->port))
297 kopen_count++;
298 if (tty->count != (count + kopen_count)) {
299 tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
300 routine, tty->count, count, kopen_count);
301 return (count + kopen_count);
302 }
303#endif
304 return 0;
305}
306
307/**
308 * get_tty_driver - find device of a tty
309 * @dev_t: device identifier
310 * @index: returns the index of the tty
311 *
312 * This routine returns a tty driver structure, given a device number
313 * and also passes back the index number.
314 *
315 * Locking: caller must hold tty_mutex
316 */
317
318static struct tty_driver *get_tty_driver(dev_t device, int *index)
319{
320 struct tty_driver *p;
321
322 list_for_each_entry(p, &tty_drivers, tty_drivers) {
323 dev_t base = MKDEV(p->major, p->minor_start);
324 if (device < base || device >= base + p->num)
325 continue;
326 *index = device - base;
327 return tty_driver_kref_get(p);
328 }
329 return NULL;
330}
331
332/**
333 * tty_dev_name_to_number - return dev_t for device name
334 * @name: user space name of device under /dev
335 * @number: pointer to dev_t that this function will populate
336 *
337 * This function converts device names like ttyS0 or ttyUSB1 into dev_t
338 * like (4, 64) or (188, 1). If no corresponding driver is registered then
339 * the function returns -ENODEV.
340 *
341 * Locking: this acquires tty_mutex to protect the tty_drivers list from
342 * being modified while we are traversing it, and makes sure to
343 * release it before exiting.
344 */
345int tty_dev_name_to_number(const char *name, dev_t *number)
346{
347 struct tty_driver *p;
348 int ret;
349 int index, prefix_length = 0;
350 const char *str;
351
352 for (str = name; *str && !isdigit(*str); str++)
353 ;
354
355 if (!*str)
356 return -EINVAL;
357
358 ret = kstrtoint(str, 10, &index);
359 if (ret)
360 return ret;
361
362 prefix_length = str - name;
363 mutex_lock(&tty_mutex);
364
365 list_for_each_entry(p, &tty_drivers, tty_drivers)
366 if (prefix_length == strlen(p->name) && strncmp(name,
367 p->name, prefix_length) == 0) {
368 if (index < p->num) {
369 *number = MKDEV(p->major, p->minor_start + index);
370 goto out;
371 }
372 }
373
374 /* if here then driver wasn't found */
375 ret = -ENODEV;
376out:
377 mutex_unlock(&tty_mutex);
378 return ret;
379}
380EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
381
382#ifdef CONFIG_CONSOLE_POLL
383
384/**
385 * tty_find_polling_driver - find device of a polled tty
386 * @name: name string to match
387 * @line: pointer to resulting tty line nr
388 *
389 * This routine returns a tty driver structure, given a name
390 * and the condition that the tty driver is capable of polled
391 * operation.
392 */
393struct tty_driver *tty_find_polling_driver(char *name, int *line)
394{
395 struct tty_driver *p, *res = NULL;
396 int tty_line = 0;
397 int len;
398 char *str, *stp;
399
400 for (str = name; *str; str++)
401 if ((*str >= '0' && *str <= '9') || *str == ',')
402 break;
403 if (!*str)
404 return NULL;
405
406 len = str - name;
407 tty_line = simple_strtoul(str, &str, 10);
408
409 mutex_lock(&tty_mutex);
410 /* Search through the tty devices to look for a match */
411 list_for_each_entry(p, &tty_drivers, tty_drivers) {
412 if (!len || strncmp(name, p->name, len) != 0)
413 continue;
414 stp = str;
415 if (*stp == ',')
416 stp++;
417 if (*stp == '\0')
418 stp = NULL;
419
420 if (tty_line >= 0 && tty_line < p->num && p->ops &&
421 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
422 res = tty_driver_kref_get(p);
423 *line = tty_line;
424 break;
425 }
426 }
427 mutex_unlock(&tty_mutex);
428
429 return res;
430}
431EXPORT_SYMBOL_GPL(tty_find_polling_driver);
432#endif
433
434static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
435 size_t count, loff_t *ppos)
436{
437 return 0;
438}
439
440static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
441 size_t count, loff_t *ppos)
442{
443 return -EIO;
444}
445
446/* No kernel lock held - none needed ;) */
447static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
448{
449 return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
450}
451
452static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
453 unsigned long arg)
454{
455 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
456}
457
458static long hung_up_tty_compat_ioctl(struct file *file,
459 unsigned int cmd, unsigned long arg)
460{
461 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
462}
463
464static int hung_up_tty_fasync(int fd, struct file *file, int on)
465{
466 return -ENOTTY;
467}
468
469static void tty_show_fdinfo(struct seq_file *m, struct file *file)
470{
471 struct tty_struct *tty = file_tty(file);
472
473 if (tty && tty->ops && tty->ops->show_fdinfo)
474 tty->ops->show_fdinfo(tty, m);
475}
476
477static const struct file_operations tty_fops = {
478 .llseek = no_llseek,
479 .read = tty_read,
480 .write = tty_write,
481 .poll = tty_poll,
482 .unlocked_ioctl = tty_ioctl,
483 .compat_ioctl = tty_compat_ioctl,
484 .open = tty_open,
485 .release = tty_release,
486 .fasync = tty_fasync,
487 .show_fdinfo = tty_show_fdinfo,
488};
489
490static const struct file_operations console_fops = {
491 .llseek = no_llseek,
492 .read = tty_read,
493 .write = redirected_tty_write,
494 .poll = tty_poll,
495 .unlocked_ioctl = tty_ioctl,
496 .compat_ioctl = tty_compat_ioctl,
497 .open = tty_open,
498 .release = tty_release,
499 .fasync = tty_fasync,
500};
501
502static const struct file_operations hung_up_tty_fops = {
503 .llseek = no_llseek,
504 .read = hung_up_tty_read,
505 .write = hung_up_tty_write,
506 .poll = hung_up_tty_poll,
507 .unlocked_ioctl = hung_up_tty_ioctl,
508 .compat_ioctl = hung_up_tty_compat_ioctl,
509 .release = tty_release,
510 .fasync = hung_up_tty_fasync,
511};
512
513static DEFINE_SPINLOCK(redirect_lock);
514static struct file *redirect;
515
516extern void tty_sysctl_init(void);
517
518/**
519 * tty_wakeup - request more data
520 * @tty: terminal
521 *
522 * Internal and external helper for wakeups of tty. This function
523 * informs the line discipline if present that the driver is ready
524 * to receive more output data.
525 */
526
527void tty_wakeup(struct tty_struct *tty)
528{
529 struct tty_ldisc *ld;
530
531 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
532 ld = tty_ldisc_ref(tty);
533 if (ld) {
534 if (ld->ops->write_wakeup)
535 ld->ops->write_wakeup(tty);
536 tty_ldisc_deref(ld);
537 }
538 }
539 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
540}
541
542EXPORT_SYMBOL_GPL(tty_wakeup);
543
544/**
545 * __tty_hangup - actual handler for hangup events
546 * @work: tty device
547 *
548 * This can be called by a "kworker" kernel thread. That is process
549 * synchronous but doesn't hold any locks, so we need to make sure we
550 * have the appropriate locks for what we're doing.
551 *
552 * The hangup event clears any pending redirections onto the hung up
553 * device. It ensures future writes will error and it does the needed
554 * line discipline hangup and signal delivery. The tty object itself
555 * remains intact.
556 *
557 * Locking:
558 * BTM
559 * redirect lock for undoing redirection
560 * file list lock for manipulating list of ttys
561 * tty_ldiscs_lock from called functions
562 * termios_rwsem resetting termios data
563 * tasklist_lock to walk task list for hangup event
564 * ->siglock to protect ->signal/->sighand
565 */
566static void __tty_hangup(struct tty_struct *tty, int exit_session)
567{
568 struct file *cons_filp = NULL;
569 struct file *filp, *f = NULL;
570 struct tty_file_private *priv;
571 int closecount = 0, n;
572 int refs;
573
574 if (!tty)
575 return;
576
577
578 spin_lock(&redirect_lock);
579 if (redirect && file_tty(redirect) == tty) {
580 f = redirect;
581 redirect = NULL;
582 }
583 spin_unlock(&redirect_lock);
584
585 tty_lock(tty);
586
587 if (test_bit(TTY_HUPPED, &tty->flags)) {
588 tty_unlock(tty);
589 return;
590 }
591
592 /*
593 * Some console devices aren't actually hung up for technical and
594 * historical reasons, which can lead to indefinite interruptible
595 * sleep in n_tty_read(). The following explicitly tells
596 * n_tty_read() to abort readers.
597 */
598 set_bit(TTY_HUPPING, &tty->flags);
599
600 /* inuse_filps is protected by the single tty lock,
601 this really needs to change if we want to flush the
602 workqueue with the lock held */
603 check_tty_count(tty, "tty_hangup");
604
605 spin_lock(&tty->files_lock);
606 /* This breaks for file handles being sent over AF_UNIX sockets ? */
607 list_for_each_entry(priv, &tty->tty_files, list) {
608 filp = priv->file;
609 if (filp->f_op->write == redirected_tty_write)
610 cons_filp = filp;
611 if (filp->f_op->write != tty_write)
612 continue;
613 closecount++;
614 __tty_fasync(-1, filp, 0); /* can't block */
615 filp->f_op = &hung_up_tty_fops;
616 }
617 spin_unlock(&tty->files_lock);
618
619 refs = tty_signal_session_leader(tty, exit_session);
620 /* Account for the p->signal references we killed */
621 while (refs--)
622 tty_kref_put(tty);
623
624 tty_ldisc_hangup(tty, cons_filp != NULL);
625
626 spin_lock_irq(&tty->ctrl_lock);
627 clear_bit(TTY_THROTTLED, &tty->flags);
628 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
629 put_pid(tty->session);
630 put_pid(tty->pgrp);
631 tty->session = NULL;
632 tty->pgrp = NULL;
633 tty->ctrl_status = 0;
634 spin_unlock_irq(&tty->ctrl_lock);
635
636 /*
637 * If one of the devices matches a console pointer, we
638 * cannot just call hangup() because that will cause
639 * tty->count and state->count to go out of sync.
640 * So we just call close() the right number of times.
641 */
642 if (cons_filp) {
643 if (tty->ops->close)
644 for (n = 0; n < closecount; n++)
645 tty->ops->close(tty, cons_filp);
646 } else if (tty->ops->hangup)
647 tty->ops->hangup(tty);
648 /*
649 * We don't want to have driver/ldisc interactions beyond the ones
650 * we did here. The driver layer expects no calls after ->hangup()
651 * from the ldisc side, which is now guaranteed.
652 */
653 set_bit(TTY_HUPPED, &tty->flags);
654 clear_bit(TTY_HUPPING, &tty->flags);
655 tty_unlock(tty);
656
657 if (f)
658 fput(f);
659}
660
661static void do_tty_hangup(struct work_struct *work)
662{
663 struct tty_struct *tty =
664 container_of(work, struct tty_struct, hangup_work);
665
666 __tty_hangup(tty, 0);
667}
668
669/**
670 * tty_hangup - trigger a hangup event
671 * @tty: tty to hangup
672 *
673 * A carrier loss (virtual or otherwise) has occurred on this like
674 * schedule a hangup sequence to run after this event.
675 */
676
677void tty_hangup(struct tty_struct *tty)
678{
679 tty_debug_hangup(tty, "hangup\n");
680 schedule_work(&tty->hangup_work);
681}
682
683EXPORT_SYMBOL(tty_hangup);
684
685/**
686 * tty_vhangup - process vhangup
687 * @tty: tty to hangup
688 *
689 * The user has asked via system call for the terminal to be hung up.
690 * We do this synchronously so that when the syscall returns the process
691 * is complete. That guarantee is necessary for security reasons.
692 */
693
694void tty_vhangup(struct tty_struct *tty)
695{
696 tty_debug_hangup(tty, "vhangup\n");
697 __tty_hangup(tty, 0);
698}
699
700EXPORT_SYMBOL(tty_vhangup);
701
702
703/**
704 * tty_vhangup_self - process vhangup for own ctty
705 *
706 * Perform a vhangup on the current controlling tty
707 */
708
709void tty_vhangup_self(void)
710{
711 struct tty_struct *tty;
712
713 tty = get_current_tty();
714 if (tty) {
715 tty_vhangup(tty);
716 tty_kref_put(tty);
717 }
718}
719
720/**
721 * tty_vhangup_session - hangup session leader exit
722 * @tty: tty to hangup
723 *
724 * The session leader is exiting and hanging up its controlling terminal.
725 * Every process in the foreground process group is signalled SIGHUP.
726 *
727 * We do this synchronously so that when the syscall returns the process
728 * is complete. That guarantee is necessary for security reasons.
729 */
730
731void tty_vhangup_session(struct tty_struct *tty)
732{
733 tty_debug_hangup(tty, "session hangup\n");
734 __tty_hangup(tty, 1);
735}
736
737/**
738 * tty_hung_up_p - was tty hung up
739 * @filp: file pointer of tty
740 *
741 * Return true if the tty has been subject to a vhangup or a carrier
742 * loss
743 */
744
745int tty_hung_up_p(struct file *filp)
746{
747 return (filp && filp->f_op == &hung_up_tty_fops);
748}
749
750EXPORT_SYMBOL(tty_hung_up_p);
751
752/**
753 * stop_tty - propagate flow control
754 * @tty: tty to stop
755 *
756 * Perform flow control to the driver. May be called
757 * on an already stopped device and will not re-call the driver
758 * method.
759 *
760 * This functionality is used by both the line disciplines for
761 * halting incoming flow and by the driver. It may therefore be
762 * called from any context, may be under the tty atomic_write_lock
763 * but not always.
764 *
765 * Locking:
766 * flow_lock
767 */
768
769void __stop_tty(struct tty_struct *tty)
770{
771 if (tty->stopped)
772 return;
773 tty->stopped = 1;
774 if (tty->ops->stop)
775 tty->ops->stop(tty);
776}
777
778void stop_tty(struct tty_struct *tty)
779{
780 unsigned long flags;
781
782 spin_lock_irqsave(&tty->flow_lock, flags);
783 __stop_tty(tty);
784 spin_unlock_irqrestore(&tty->flow_lock, flags);
785}
786EXPORT_SYMBOL(stop_tty);
787
788/**
789 * start_tty - propagate flow control
790 * @tty: tty to start
791 *
792 * Start a tty that has been stopped if at all possible. If this
793 * tty was previous stopped and is now being started, the driver
794 * start method is invoked and the line discipline woken.
795 *
796 * Locking:
797 * flow_lock
798 */
799
800void __start_tty(struct tty_struct *tty)
801{
802 if (!tty->stopped || tty->flow_stopped)
803 return;
804 tty->stopped = 0;
805 if (tty->ops->start)
806 tty->ops->start(tty);
807 tty_wakeup(tty);
808}
809
810void start_tty(struct tty_struct *tty)
811{
812 unsigned long flags;
813
814 spin_lock_irqsave(&tty->flow_lock, flags);
815 __start_tty(tty);
816 spin_unlock_irqrestore(&tty->flow_lock, flags);
817}
818EXPORT_SYMBOL(start_tty);
819
820static void tty_update_time(struct timespec64 *time)
821{
822 time64_t sec = ktime_get_real_seconds();
823
824 /*
825 * We only care if the two values differ in anything other than the
826 * lower three bits (i.e every 8 seconds). If so, then we can update
827 * the time of the tty device, otherwise it could be construded as a
828 * security leak to let userspace know the exact timing of the tty.
829 */
830 if ((sec ^ time->tv_sec) & ~7)
831 time->tv_sec = sec;
832}
833
834/**
835 * tty_read - read method for tty device files
836 * @file: pointer to tty file
837 * @buf: user buffer
838 * @count: size of user buffer
839 * @ppos: unused
840 *
841 * Perform the read system call function on this terminal device. Checks
842 * for hung up devices before calling the line discipline method.
843 *
844 * Locking:
845 * Locks the line discipline internally while needed. Multiple
846 * read calls may be outstanding in parallel.
847 */
848
849static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
850 loff_t *ppos)
851{
852 int i;
853 struct inode *inode = file_inode(file);
854 struct tty_struct *tty = file_tty(file);
855 struct tty_ldisc *ld;
856
857 if (tty_paranoia_check(tty, inode, "tty_read"))
858 return -EIO;
859 if (!tty || tty_io_error(tty))
860 return -EIO;
861
862 /* We want to wait for the line discipline to sort out in this
863 situation */
864 ld = tty_ldisc_ref_wait(tty);
865 if (!ld)
866 return hung_up_tty_read(file, buf, count, ppos);
867 if (ld->ops->read)
868 i = ld->ops->read(tty, file, buf, count);
869 else
870 i = -EIO;
871 tty_ldisc_deref(ld);
872
873 if (i > 0)
874 tty_update_time(&inode->i_atime);
875
876 return i;
877}
878
879static void tty_write_unlock(struct tty_struct *tty)
880{
881 mutex_unlock(&tty->atomic_write_lock);
882 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
883}
884
885static int tty_write_lock(struct tty_struct *tty, int ndelay)
886{
887 if (!mutex_trylock(&tty->atomic_write_lock)) {
888 if (ndelay)
889 return -EAGAIN;
890 if (mutex_lock_interruptible(&tty->atomic_write_lock))
891 return -ERESTARTSYS;
892 }
893 return 0;
894}
895
896/*
897 * Split writes up in sane blocksizes to avoid
898 * denial-of-service type attacks
899 */
900static inline ssize_t do_tty_write(
901 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
902 struct tty_struct *tty,
903 struct file *file,
904 const char __user *buf,
905 size_t count)
906{
907 ssize_t ret, written = 0;
908 unsigned int chunk;
909
910 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
911 if (ret < 0)
912 return ret;
913
914 /*
915 * We chunk up writes into a temporary buffer. This
916 * simplifies low-level drivers immensely, since they
917 * don't have locking issues and user mode accesses.
918 *
919 * But if TTY_NO_WRITE_SPLIT is set, we should use a
920 * big chunk-size..
921 *
922 * The default chunk-size is 2kB, because the NTTY
923 * layer has problems with bigger chunks. It will
924 * claim to be able to handle more characters than
925 * it actually does.
926 *
927 * FIXME: This can probably go away now except that 64K chunks
928 * are too likely to fail unless switched to vmalloc...
929 */
930 chunk = 2048;
931 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
932 chunk = 65536;
933 if (count < chunk)
934 chunk = count;
935
936 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
937 if (tty->write_cnt < chunk) {
938 unsigned char *buf_chunk;
939
940 if (chunk < 1024)
941 chunk = 1024;
942
943 buf_chunk = kmalloc(chunk, GFP_KERNEL);
944 if (!buf_chunk) {
945 ret = -ENOMEM;
946 goto out;
947 }
948 kfree(tty->write_buf);
949 tty->write_cnt = chunk;
950 tty->write_buf = buf_chunk;
951 }
952
953 /* Do the write .. */
954 for (;;) {
955 size_t size = count;
956 if (size > chunk)
957 size = chunk;
958 ret = -EFAULT;
959 if (copy_from_user(tty->write_buf, buf, size))
960 break;
961 ret = write(tty, file, tty->write_buf, size);
962 if (ret <= 0)
963 break;
964 written += ret;
965 buf += ret;
966 count -= ret;
967 if (!count)
968 break;
969 ret = -ERESTARTSYS;
970 if (signal_pending(current))
971 break;
972 cond_resched();
973 }
974 if (written) {
975 tty_update_time(&file_inode(file)->i_mtime);
976 ret = written;
977 }
978out:
979 tty_write_unlock(tty);
980 return ret;
981}
982
983/**
984 * tty_write_message - write a message to a certain tty, not just the console.
985 * @tty: the destination tty_struct
986 * @msg: the message to write
987 *
988 * This is used for messages that need to be redirected to a specific tty.
989 * We don't put it into the syslog queue right now maybe in the future if
990 * really needed.
991 *
992 * We must still hold the BTM and test the CLOSING flag for the moment.
993 */
994
995void tty_write_message(struct tty_struct *tty, char *msg)
996{
997 if (tty) {
998 mutex_lock(&tty->atomic_write_lock);
999 tty_lock(tty);
1000 if (tty->ops->write && tty->count > 0)
1001 tty->ops->write(tty, msg, strlen(msg));
1002 tty_unlock(tty);
1003 tty_write_unlock(tty);
1004 }
1005 return;
1006}
1007
1008
1009/**
1010 * tty_write - write method for tty device file
1011 * @file: tty file pointer
1012 * @buf: user data to write
1013 * @count: bytes to write
1014 * @ppos: unused
1015 *
1016 * Write data to a tty device via the line discipline.
1017 *
1018 * Locking:
1019 * Locks the line discipline as required
1020 * Writes to the tty driver are serialized by the atomic_write_lock
1021 * and are then processed in chunks to the device. The line discipline
1022 * write method will not be invoked in parallel for each device.
1023 */
1024
1025static ssize_t tty_write(struct file *file, const char __user *buf,
1026 size_t count, loff_t *ppos)
1027{
1028 struct tty_struct *tty = file_tty(file);
1029 struct tty_ldisc *ld;
1030 ssize_t ret;
1031
1032 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1033 return -EIO;
1034 if (!tty || !tty->ops->write || tty_io_error(tty))
1035 return -EIO;
1036 /* Short term debug to catch buggy drivers */
1037 if (tty->ops->write_room == NULL)
1038 tty_err(tty, "missing write_room method\n");
1039 ld = tty_ldisc_ref_wait(tty);
1040 if (!ld)
1041 return hung_up_tty_write(file, buf, count, ppos);
1042 if (!ld->ops->write)
1043 ret = -EIO;
1044 else
1045 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1046 tty_ldisc_deref(ld);
1047 return ret;
1048}
1049
1050ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1051 size_t count, loff_t *ppos)
1052{
1053 struct file *p = NULL;
1054
1055 spin_lock(&redirect_lock);
1056 if (redirect)
1057 p = get_file(redirect);
1058 spin_unlock(&redirect_lock);
1059
1060 if (p) {
1061 ssize_t res;
1062 res = vfs_write(p, buf, count, &p->f_pos);
1063 fput(p);
1064 return res;
1065 }
1066 return tty_write(file, buf, count, ppos);
1067}
1068
1069/**
1070 * tty_send_xchar - send priority character
1071 *
1072 * Send a high priority character to the tty even if stopped
1073 *
1074 * Locking: none for xchar method, write ordering for write method.
1075 */
1076
1077int tty_send_xchar(struct tty_struct *tty, char ch)
1078{
1079 int was_stopped = tty->stopped;
1080
1081 if (tty->ops->send_xchar) {
1082 down_read(&tty->termios_rwsem);
1083 tty->ops->send_xchar(tty, ch);
1084 up_read(&tty->termios_rwsem);
1085 return 0;
1086 }
1087
1088 if (tty_write_lock(tty, 0) < 0)
1089 return -ERESTARTSYS;
1090
1091 down_read(&tty->termios_rwsem);
1092 if (was_stopped)
1093 start_tty(tty);
1094 tty->ops->write(tty, &ch, 1);
1095 if (was_stopped)
1096 stop_tty(tty);
1097 up_read(&tty->termios_rwsem);
1098 tty_write_unlock(tty);
1099 return 0;
1100}
1101
1102static char ptychar[] = "pqrstuvwxyzabcde";
1103
1104/**
1105 * pty_line_name - generate name for a pty
1106 * @driver: the tty driver in use
1107 * @index: the minor number
1108 * @p: output buffer of at least 6 bytes
1109 *
1110 * Generate a name from a driver reference and write it to the output
1111 * buffer.
1112 *
1113 * Locking: None
1114 */
1115static void pty_line_name(struct tty_driver *driver, int index, char *p)
1116{
1117 int i = index + driver->name_base;
1118 /* ->name is initialized to "ttyp", but "tty" is expected */
1119 sprintf(p, "%s%c%x",
1120 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1121 ptychar[i >> 4 & 0xf], i & 0xf);
1122}
1123
1124/**
1125 * tty_line_name - generate name for a tty
1126 * @driver: the tty driver in use
1127 * @index: the minor number
1128 * @p: output buffer of at least 7 bytes
1129 *
1130 * Generate a name from a driver reference and write it to the output
1131 * buffer.
1132 *
1133 * Locking: None
1134 */
1135static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1136{
1137 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1138 return sprintf(p, "%s", driver->name);
1139 else
1140 return sprintf(p, "%s%d", driver->name,
1141 index + driver->name_base);
1142}
1143
1144/**
1145 * tty_driver_lookup_tty() - find an existing tty, if any
1146 * @driver: the driver for the tty
1147 * @idx: the minor number
1148 *
1149 * Return the tty, if found. If not found, return NULL or ERR_PTR() if the
1150 * driver lookup() method returns an error.
1151 *
1152 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1153 */
1154static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1155 struct file *file, int idx)
1156{
1157 struct tty_struct *tty;
1158
1159 if (driver->ops->lookup)
1160 if (!file)
1161 tty = ERR_PTR(-EIO);
1162 else
1163 tty = driver->ops->lookup(driver, file, idx);
1164 else
1165 tty = driver->ttys[idx];
1166
1167 if (!IS_ERR(tty))
1168 tty_kref_get(tty);
1169 return tty;
1170}
1171
1172/**
1173 * tty_init_termios - helper for termios setup
1174 * @tty: the tty to set up
1175 *
1176 * Initialise the termios structure for this tty. This runs under
1177 * the tty_mutex currently so we can be relaxed about ordering.
1178 */
1179
1180void tty_init_termios(struct tty_struct *tty)
1181{
1182 struct ktermios *tp;
1183 int idx = tty->index;
1184
1185 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1186 tty->termios = tty->driver->init_termios;
1187 else {
1188 /* Check for lazy saved data */
1189 tp = tty->driver->termios[idx];
1190 if (tp != NULL) {
1191 tty->termios = *tp;
1192 tty->termios.c_line = tty->driver->init_termios.c_line;
1193 } else
1194 tty->termios = tty->driver->init_termios;
1195 }
1196 /* Compatibility until drivers always set this */
1197 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1198 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1199}
1200EXPORT_SYMBOL_GPL(tty_init_termios);
1201
1202int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1203{
1204 tty_init_termios(tty);
1205 tty_driver_kref_get(driver);
1206 tty->count++;
1207 driver->ttys[tty->index] = tty;
1208 return 0;
1209}
1210EXPORT_SYMBOL_GPL(tty_standard_install);
1211
1212/**
1213 * tty_driver_install_tty() - install a tty entry in the driver
1214 * @driver: the driver for the tty
1215 * @tty: the tty
1216 *
1217 * Install a tty object into the driver tables. The tty->index field
1218 * will be set by the time this is called. This method is responsible
1219 * for ensuring any need additional structures are allocated and
1220 * configured.
1221 *
1222 * Locking: tty_mutex for now
1223 */
1224static int tty_driver_install_tty(struct tty_driver *driver,
1225 struct tty_struct *tty)
1226{
1227 return driver->ops->install ? driver->ops->install(driver, tty) :
1228 tty_standard_install(driver, tty);
1229}
1230
1231/**
1232 * tty_driver_remove_tty() - remove a tty from the driver tables
1233 * @driver: the driver for the tty
1234 * @idx: the minor number
1235 *
1236 * Remvoe a tty object from the driver tables. The tty->index field
1237 * will be set by the time this is called.
1238 *
1239 * Locking: tty_mutex for now
1240 */
1241static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1242{
1243 if (driver->ops->remove)
1244 driver->ops->remove(driver, tty);
1245 else
1246 driver->ttys[tty->index] = NULL;
1247}
1248
1249/*
1250 * tty_reopen() - fast re-open of an open tty
1251 * @tty - the tty to open
1252 *
1253 * Return 0 on success, -errno on error.
1254 * Re-opens on master ptys are not allowed and return -EIO.
1255 *
1256 * Locking: Caller must hold tty_lock
1257 */
1258static int tty_reopen(struct tty_struct *tty)
1259{
1260 struct tty_driver *driver = tty->driver;
1261 struct tty_ldisc *ld;
1262 int retval = 0;
1263
1264 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1265 driver->subtype == PTY_TYPE_MASTER)
1266 return -EIO;
1267
1268 if (!tty->count)
1269 return -EAGAIN;
1270
1271 if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1272 return -EBUSY;
1273
1274 ld = tty_ldisc_ref_wait(tty);
1275 if (ld) {
1276 tty_ldisc_deref(ld);
1277 } else {
1278 retval = tty_ldisc_lock(tty, 5 * HZ);
1279 if (retval)
1280 return retval;
1281
1282 if (!tty->ldisc)
1283 retval = tty_ldisc_reinit(tty, tty->termios.c_line);
1284 tty_ldisc_unlock(tty);
1285 }
1286
1287 if (retval == 0)
1288 tty->count++;
1289
1290 return retval;
1291}
1292
1293/**
1294 * tty_init_dev - initialise a tty device
1295 * @driver: tty driver we are opening a device on
1296 * @idx: device index
1297 * @ret_tty: returned tty structure
1298 *
1299 * Prepare a tty device. This may not be a "new" clean device but
1300 * could also be an active device. The pty drivers require special
1301 * handling because of this.
1302 *
1303 * Locking:
1304 * The function is called under the tty_mutex, which
1305 * protects us from the tty struct or driver itself going away.
1306 *
1307 * On exit the tty device has the line discipline attached and
1308 * a reference count of 1. If a pair was created for pty/tty use
1309 * and the other was a pty master then it too has a reference count of 1.
1310 *
1311 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1312 * failed open. The new code protects the open with a mutex, so it's
1313 * really quite straightforward. The mutex locking can probably be
1314 * relaxed for the (most common) case of reopening a tty.
1315 */
1316
1317struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1318{
1319 struct tty_struct *tty;
1320 int retval;
1321
1322 /*
1323 * First time open is complex, especially for PTY devices.
1324 * This code guarantees that either everything succeeds and the
1325 * TTY is ready for operation, or else the table slots are vacated
1326 * and the allocated memory released. (Except that the termios
1327 * may be retained.)
1328 */
1329
1330 if (!try_module_get(driver->owner))
1331 return ERR_PTR(-ENODEV);
1332
1333 tty = alloc_tty_struct(driver, idx);
1334 if (!tty) {
1335 retval = -ENOMEM;
1336 goto err_module_put;
1337 }
1338
1339 tty_lock(tty);
1340 retval = tty_driver_install_tty(driver, tty);
1341 if (retval < 0)
1342 goto err_free_tty;
1343
1344 if (!tty->port)
1345 tty->port = driver->ports[idx];
1346
1347 WARN_RATELIMIT(!tty->port,
1348 "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1349 __func__, tty->driver->name);
1350
1351 retval = tty_ldisc_lock(tty, 5 * HZ);
1352 if (retval)
1353 goto err_release_lock;
1354 tty->port->itty = tty;
1355
1356 /*
1357 * Structures all installed ... call the ldisc open routines.
1358 * If we fail here just call release_tty to clean up. No need
1359 * to decrement the use counts, as release_tty doesn't care.
1360 */
1361 retval = tty_ldisc_setup(tty, tty->link);
1362 if (retval)
1363 goto err_release_tty;
1364 tty_ldisc_unlock(tty);
1365 /* Return the tty locked so that it cannot vanish under the caller */
1366 return tty;
1367
1368err_free_tty:
1369 tty_unlock(tty);
1370 free_tty_struct(tty);
1371err_module_put:
1372 module_put(driver->owner);
1373 return ERR_PTR(retval);
1374
1375 /* call the tty release_tty routine to clean out this slot */
1376err_release_tty:
1377 tty_ldisc_unlock(tty);
1378 tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1379 retval, idx);
1380err_release_lock:
1381 tty_unlock(tty);
1382 release_tty(tty, idx);
1383 return ERR_PTR(retval);
1384}
1385
1386/**
1387 * tty_save_termios() - save tty termios data in driver table
1388 * @tty: tty whose termios data to save
1389 *
1390 * Locking: Caller guarantees serialisation with tty_init_termios().
1391 */
1392void tty_save_termios(struct tty_struct *tty)
1393{
1394 struct ktermios *tp;
1395 int idx = tty->index;
1396
1397 /* If the port is going to reset then it has no termios to save */
1398 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1399 return;
1400
1401 /* Stash the termios data */
1402 tp = tty->driver->termios[idx];
1403 if (tp == NULL) {
1404 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1405 if (tp == NULL)
1406 return;
1407 tty->driver->termios[idx] = tp;
1408 }
1409 *tp = tty->termios;
1410}
1411EXPORT_SYMBOL_GPL(tty_save_termios);
1412
1413/**
1414 * tty_flush_works - flush all works of a tty/pty pair
1415 * @tty: tty device to flush works for (or either end of a pty pair)
1416 *
1417 * Sync flush all works belonging to @tty (and the 'other' tty).
1418 */
1419static void tty_flush_works(struct tty_struct *tty)
1420{
1421 flush_work(&tty->SAK_work);
1422 flush_work(&tty->hangup_work);
1423 if (tty->link) {
1424 flush_work(&tty->link->SAK_work);
1425 flush_work(&tty->link->hangup_work);
1426 }
1427}
1428
1429/**
1430 * release_one_tty - release tty structure memory
1431 * @kref: kref of tty we are obliterating
1432 *
1433 * Releases memory associated with a tty structure, and clears out the
1434 * driver table slots. This function is called when a device is no longer
1435 * in use. It also gets called when setup of a device fails.
1436 *
1437 * Locking:
1438 * takes the file list lock internally when working on the list
1439 * of ttys that the driver keeps.
1440 *
1441 * This method gets called from a work queue so that the driver private
1442 * cleanup ops can sleep (needed for USB at least)
1443 */
1444static void release_one_tty(struct work_struct *work)
1445{
1446 struct tty_struct *tty =
1447 container_of(work, struct tty_struct, hangup_work);
1448 struct tty_driver *driver = tty->driver;
1449 struct module *owner = driver->owner;
1450
1451 if (tty->ops->cleanup)
1452 tty->ops->cleanup(tty);
1453
1454 tty->magic = 0;
1455 tty_driver_kref_put(driver);
1456 module_put(owner);
1457
1458 spin_lock(&tty->files_lock);
1459 list_del_init(&tty->tty_files);
1460 spin_unlock(&tty->files_lock);
1461
1462 put_pid(tty->pgrp);
1463 put_pid(tty->session);
1464 free_tty_struct(tty);
1465}
1466
1467static void queue_release_one_tty(struct kref *kref)
1468{
1469 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1470
1471 /* The hangup queue is now free so we can reuse it rather than
1472 waste a chunk of memory for each port */
1473 INIT_WORK(&tty->hangup_work, release_one_tty);
1474 schedule_work(&tty->hangup_work);
1475}
1476
1477/**
1478 * tty_kref_put - release a tty kref
1479 * @tty: tty device
1480 *
1481 * Release a reference to a tty device and if need be let the kref
1482 * layer destruct the object for us
1483 */
1484
1485void tty_kref_put(struct tty_struct *tty)
1486{
1487 if (tty)
1488 kref_put(&tty->kref, queue_release_one_tty);
1489}
1490EXPORT_SYMBOL(tty_kref_put);
1491
1492/**
1493 * release_tty - release tty structure memory
1494 *
1495 * Release both @tty and a possible linked partner (think pty pair),
1496 * and decrement the refcount of the backing module.
1497 *
1498 * Locking:
1499 * tty_mutex
1500 * takes the file list lock internally when working on the list
1501 * of ttys that the driver keeps.
1502 *
1503 */
1504static void release_tty(struct tty_struct *tty, int idx)
1505{
1506 /* This should always be true but check for the moment */
1507 WARN_ON(tty->index != idx);
1508 WARN_ON(!mutex_is_locked(&tty_mutex));
1509 if (tty->ops->shutdown)
1510 tty->ops->shutdown(tty);
1511 tty_save_termios(tty);
1512 tty_driver_remove_tty(tty->driver, tty);
1513 tty->port->itty = NULL;
1514 if (tty->link)
1515 tty->link->port->itty = NULL;
1516 tty_buffer_cancel_work(tty->port);
1517 if (tty->link)
1518 tty_buffer_cancel_work(tty->link->port);
1519
1520 tty_kref_put(tty->link);
1521 tty_kref_put(tty);
1522}
1523
1524/**
1525 * tty_release_checks - check a tty before real release
1526 * @tty: tty to check
1527 * @o_tty: link of @tty (if any)
1528 * @idx: index of the tty
1529 *
1530 * Performs some paranoid checking before true release of the @tty.
1531 * This is a no-op unless TTY_PARANOIA_CHECK is defined.
1532 */
1533static int tty_release_checks(struct tty_struct *tty, int idx)
1534{
1535#ifdef TTY_PARANOIA_CHECK
1536 if (idx < 0 || idx >= tty->driver->num) {
1537 tty_debug(tty, "bad idx %d\n", idx);
1538 return -1;
1539 }
1540
1541 /* not much to check for devpts */
1542 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1543 return 0;
1544
1545 if (tty != tty->driver->ttys[idx]) {
1546 tty_debug(tty, "bad driver table[%d] = %p\n",
1547 idx, tty->driver->ttys[idx]);
1548 return -1;
1549 }
1550 if (tty->driver->other) {
1551 struct tty_struct *o_tty = tty->link;
1552
1553 if (o_tty != tty->driver->other->ttys[idx]) {
1554 tty_debug(tty, "bad other table[%d] = %p\n",
1555 idx, tty->driver->other->ttys[idx]);
1556 return -1;
1557 }
1558 if (o_tty->link != tty) {
1559 tty_debug(tty, "bad link = %p\n", o_tty->link);
1560 return -1;
1561 }
1562 }
1563#endif
1564 return 0;
1565}
1566
1567/**
1568 * tty_kclose - closes tty opened by tty_kopen
1569 * @tty: tty device
1570 *
1571 * Performs the final steps to release and free a tty device. It is the
1572 * same as tty_release_struct except that it also resets TTY_PORT_KOPENED
1573 * flag on tty->port.
1574 */
1575void tty_kclose(struct tty_struct *tty)
1576{
1577 /*
1578 * Ask the line discipline code to release its structures
1579 */
1580 tty_ldisc_release(tty);
1581
1582 /* Wait for pending work before tty destruction commmences */
1583 tty_flush_works(tty);
1584
1585 tty_debug_hangup(tty, "freeing structure\n");
1586 /*
1587 * The release_tty function takes care of the details of clearing
1588 * the slots and preserving the termios structure. The tty_unlock_pair
1589 * should be safe as we keep a kref while the tty is locked (so the
1590 * unlock never unlocks a freed tty).
1591 */
1592 mutex_lock(&tty_mutex);
1593 tty_port_set_kopened(tty->port, 0);
1594 release_tty(tty, tty->index);
1595 mutex_unlock(&tty_mutex);
1596}
1597EXPORT_SYMBOL_GPL(tty_kclose);
1598
1599/**
1600 * tty_release_struct - release a tty struct
1601 * @tty: tty device
1602 * @idx: index of the tty
1603 *
1604 * Performs the final steps to release and free a tty device. It is
1605 * roughly the reverse of tty_init_dev.
1606 */
1607void tty_release_struct(struct tty_struct *tty, int idx)
1608{
1609 /*
1610 * Ask the line discipline code to release its structures
1611 */
1612 tty_ldisc_release(tty);
1613
1614 /* Wait for pending work before tty destruction commmences */
1615 tty_flush_works(tty);
1616
1617 tty_debug_hangup(tty, "freeing structure\n");
1618 /*
1619 * The release_tty function takes care of the details of clearing
1620 * the slots and preserving the termios structure. The tty_unlock_pair
1621 * should be safe as we keep a kref while the tty is locked (so the
1622 * unlock never unlocks a freed tty).
1623 */
1624 mutex_lock(&tty_mutex);
1625 release_tty(tty, idx);
1626 mutex_unlock(&tty_mutex);
1627}
1628EXPORT_SYMBOL_GPL(tty_release_struct);
1629
1630/**
1631 * tty_release - vfs callback for close
1632 * @inode: inode of tty
1633 * @filp: file pointer for handle to tty
1634 *
1635 * Called the last time each file handle is closed that references
1636 * this tty. There may however be several such references.
1637 *
1638 * Locking:
1639 * Takes bkl. See tty_release_dev
1640 *
1641 * Even releasing the tty structures is a tricky business.. We have
1642 * to be very careful that the structures are all released at the
1643 * same time, as interrupts might otherwise get the wrong pointers.
1644 *
1645 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1646 * lead to double frees or releasing memory still in use.
1647 */
1648
1649int tty_release(struct inode *inode, struct file *filp)
1650{
1651 struct tty_struct *tty = file_tty(filp);
1652 struct tty_struct *o_tty = NULL;
1653 int do_sleep, final;
1654 int idx;
1655 long timeout = 0;
1656 int once = 1;
1657
1658 if (tty_paranoia_check(tty, inode, __func__))
1659 return 0;
1660
1661 tty_lock(tty);
1662 check_tty_count(tty, __func__);
1663
1664 __tty_fasync(-1, filp, 0);
1665
1666 idx = tty->index;
1667 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1668 tty->driver->subtype == PTY_TYPE_MASTER)
1669 o_tty = tty->link;
1670
1671 if (tty_release_checks(tty, idx)) {
1672 tty_unlock(tty);
1673 return 0;
1674 }
1675
1676 tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1677
1678 if (tty->ops->close)
1679 tty->ops->close(tty, filp);
1680
1681 /* If tty is pty master, lock the slave pty (stable lock order) */
1682 tty_lock_slave(o_tty);
1683
1684 /*
1685 * Sanity check: if tty->count is going to zero, there shouldn't be
1686 * any waiters on tty->read_wait or tty->write_wait. We test the
1687 * wait queues and kick everyone out _before_ actually starting to
1688 * close. This ensures that we won't block while releasing the tty
1689 * structure.
1690 *
1691 * The test for the o_tty closing is necessary, since the master and
1692 * slave sides may close in any order. If the slave side closes out
1693 * first, its count will be one, since the master side holds an open.
1694 * Thus this test wouldn't be triggered at the time the slave closed,
1695 * so we do it now.
1696 */
1697 while (1) {
1698 do_sleep = 0;
1699
1700 if (tty->count <= 1) {
1701 if (waitqueue_active(&tty->read_wait)) {
1702 wake_up_poll(&tty->read_wait, EPOLLIN);
1703 do_sleep++;
1704 }
1705 if (waitqueue_active(&tty->write_wait)) {
1706 wake_up_poll(&tty->write_wait, EPOLLOUT);
1707 do_sleep++;
1708 }
1709 }
1710 if (o_tty && o_tty->count <= 1) {
1711 if (waitqueue_active(&o_tty->read_wait)) {
1712 wake_up_poll(&o_tty->read_wait, EPOLLIN);
1713 do_sleep++;
1714 }
1715 if (waitqueue_active(&o_tty->write_wait)) {
1716 wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1717 do_sleep++;
1718 }
1719 }
1720 if (!do_sleep)
1721 break;
1722
1723 if (once) {
1724 once = 0;
1725 tty_warn(tty, "read/write wait queue active!\n");
1726 }
1727 schedule_timeout_killable(timeout);
1728 if (timeout < 120 * HZ)
1729 timeout = 2 * timeout + 1;
1730 else
1731 timeout = MAX_SCHEDULE_TIMEOUT;
1732 }
1733
1734 if (o_tty) {
1735 if (--o_tty->count < 0) {
1736 tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1737 o_tty->count = 0;
1738 }
1739 }
1740 if (--tty->count < 0) {
1741 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1742 tty->count = 0;
1743 }
1744
1745 /*
1746 * We've decremented tty->count, so we need to remove this file
1747 * descriptor off the tty->tty_files list; this serves two
1748 * purposes:
1749 * - check_tty_count sees the correct number of file descriptors
1750 * associated with this tty.
1751 * - do_tty_hangup no longer sees this file descriptor as
1752 * something that needs to be handled for hangups.
1753 */
1754 tty_del_file(filp);
1755
1756 /*
1757 * Perform some housekeeping before deciding whether to return.
1758 *
1759 * If _either_ side is closing, make sure there aren't any
1760 * processes that still think tty or o_tty is their controlling
1761 * tty.
1762 */
1763 if (!tty->count) {
1764 read_lock(&tasklist_lock);
1765 session_clear_tty(tty->session);
1766 if (o_tty)
1767 session_clear_tty(o_tty->session);
1768 read_unlock(&tasklist_lock);
1769 }
1770
1771 /* check whether both sides are closing ... */
1772 final = !tty->count && !(o_tty && o_tty->count);
1773
1774 tty_unlock_slave(o_tty);
1775 tty_unlock(tty);
1776
1777 /* At this point, the tty->count == 0 should ensure a dead tty
1778 cannot be re-opened by a racing opener */
1779
1780 if (!final)
1781 return 0;
1782
1783 tty_debug_hangup(tty, "final close\n");
1784
1785 tty_release_struct(tty, idx);
1786 return 0;
1787}
1788
1789/**
1790 * tty_open_current_tty - get locked tty of current task
1791 * @device: device number
1792 * @filp: file pointer to tty
1793 * @return: locked tty of the current task iff @device is /dev/tty
1794 *
1795 * Performs a re-open of the current task's controlling tty.
1796 *
1797 * We cannot return driver and index like for the other nodes because
1798 * devpts will not work then. It expects inodes to be from devpts FS.
1799 */
1800static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1801{
1802 struct tty_struct *tty;
1803 int retval;
1804
1805 if (device != MKDEV(TTYAUX_MAJOR, 0))
1806 return NULL;
1807
1808 tty = get_current_tty();
1809 if (!tty)
1810 return ERR_PTR(-ENXIO);
1811
1812 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1813 /* noctty = 1; */
1814 tty_lock(tty);
1815 tty_kref_put(tty); /* safe to drop the kref now */
1816
1817 retval = tty_reopen(tty);
1818 if (retval < 0) {
1819 tty_unlock(tty);
1820 tty = ERR_PTR(retval);
1821 }
1822 return tty;
1823}
1824
1825/**
1826 * tty_lookup_driver - lookup a tty driver for a given device file
1827 * @device: device number
1828 * @filp: file pointer to tty
1829 * @index: index for the device in the @return driver
1830 * @return: driver for this inode (with increased refcount)
1831 *
1832 * If @return is not erroneous, the caller is responsible to decrement the
1833 * refcount by tty_driver_kref_put.
1834 *
1835 * Locking: tty_mutex protects get_tty_driver
1836 */
1837static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1838 int *index)
1839{
1840 struct tty_driver *driver = NULL;
1841
1842 switch (device) {
1843#ifdef CONFIG_VT
1844 case MKDEV(TTY_MAJOR, 0): {
1845 extern struct tty_driver *console_driver;
1846 driver = tty_driver_kref_get(console_driver);
1847 *index = fg_console;
1848 break;
1849 }
1850#endif
1851 case MKDEV(TTYAUX_MAJOR, 1): {
1852 struct tty_driver *console_driver = console_device(index);
1853 if (console_driver) {
1854 driver = tty_driver_kref_get(console_driver);
1855 if (driver && filp) {
1856 /* Don't let /dev/console block */
1857 filp->f_flags |= O_NONBLOCK;
1858 break;
1859 }
1860 }
1861 if (driver)
1862 tty_driver_kref_put(driver);
1863 return ERR_PTR(-ENODEV);
1864 }
1865 default:
1866 driver = get_tty_driver(device, index);
1867 if (!driver)
1868 return ERR_PTR(-ENODEV);
1869 break;
1870 }
1871 return driver;
1872}
1873
1874/**
1875 * tty_kopen - open a tty device for kernel
1876 * @device: dev_t of device to open
1877 *
1878 * Opens tty exclusively for kernel. Performs the driver lookup,
1879 * makes sure it's not already opened and performs the first-time
1880 * tty initialization.
1881 *
1882 * Returns the locked initialized &tty_struct
1883 *
1884 * Claims the global tty_mutex to serialize:
1885 * - concurrent first-time tty initialization
1886 * - concurrent tty driver removal w/ lookup
1887 * - concurrent tty removal from driver table
1888 */
1889struct tty_struct *tty_kopen(dev_t device)
1890{
1891 struct tty_struct *tty;
1892 struct tty_driver *driver = NULL;
1893 int index = -1;
1894
1895 mutex_lock(&tty_mutex);
1896 driver = tty_lookup_driver(device, NULL, &index);
1897 if (IS_ERR(driver)) {
1898 mutex_unlock(&tty_mutex);
1899 return ERR_CAST(driver);
1900 }
1901
1902 /* check whether we're reopening an existing tty */
1903 tty = tty_driver_lookup_tty(driver, NULL, index);
1904 if (IS_ERR(tty))
1905 goto out;
1906
1907 if (tty) {
1908 /* drop kref from tty_driver_lookup_tty() */
1909 tty_kref_put(tty);
1910 tty = ERR_PTR(-EBUSY);
1911 } else { /* tty_init_dev returns tty with the tty_lock held */
1912 tty = tty_init_dev(driver, index);
1913 if (IS_ERR(tty))
1914 goto out;
1915 tty_port_set_kopened(tty->port, 1);
1916 }
1917out:
1918 mutex_unlock(&tty_mutex);
1919 tty_driver_kref_put(driver);
1920 return tty;
1921}
1922EXPORT_SYMBOL_GPL(tty_kopen);
1923
1924/**
1925 * tty_open_by_driver - open a tty device
1926 * @device: dev_t of device to open
1927 * @inode: inode of device file
1928 * @filp: file pointer to tty
1929 *
1930 * Performs the driver lookup, checks for a reopen, or otherwise
1931 * performs the first-time tty initialization.
1932 *
1933 * Returns the locked initialized or re-opened &tty_struct
1934 *
1935 * Claims the global tty_mutex to serialize:
1936 * - concurrent first-time tty initialization
1937 * - concurrent tty driver removal w/ lookup
1938 * - concurrent tty removal from driver table
1939 */
1940static struct tty_struct *tty_open_by_driver(dev_t device, struct inode *inode,
1941 struct file *filp)
1942{
1943 struct tty_struct *tty;
1944 struct tty_driver *driver = NULL;
1945 int index = -1;
1946 int retval;
1947
1948 mutex_lock(&tty_mutex);
1949 driver = tty_lookup_driver(device, filp, &index);
1950 if (IS_ERR(driver)) {
1951 mutex_unlock(&tty_mutex);
1952 return ERR_CAST(driver);
1953 }
1954
1955 /* check whether we're reopening an existing tty */
1956 tty = tty_driver_lookup_tty(driver, filp, index);
1957 if (IS_ERR(tty)) {
1958 mutex_unlock(&tty_mutex);
1959 goto out;
1960 }
1961
1962 if (tty) {
1963 if (tty_port_kopened(tty->port)) {
1964 tty_kref_put(tty);
1965 mutex_unlock(&tty_mutex);
1966 tty = ERR_PTR(-EBUSY);
1967 goto out;
1968 }
1969 mutex_unlock(&tty_mutex);
1970 retval = tty_lock_interruptible(tty);
1971 tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
1972 if (retval) {
1973 if (retval == -EINTR)
1974 retval = -ERESTARTSYS;
1975 tty = ERR_PTR(retval);
1976 goto out;
1977 }
1978 retval = tty_reopen(tty);
1979 if (retval < 0) {
1980 tty_unlock(tty);
1981 tty = ERR_PTR(retval);
1982 }
1983 } else { /* Returns with the tty_lock held for now */
1984 tty = tty_init_dev(driver, index);
1985 mutex_unlock(&tty_mutex);
1986 }
1987out:
1988 tty_driver_kref_put(driver);
1989 return tty;
1990}
1991
1992/**
1993 * tty_open - open a tty device
1994 * @inode: inode of device file
1995 * @filp: file pointer to tty
1996 *
1997 * tty_open and tty_release keep up the tty count that contains the
1998 * number of opens done on a tty. We cannot use the inode-count, as
1999 * different inodes might point to the same tty.
2000 *
2001 * Open-counting is needed for pty masters, as well as for keeping
2002 * track of serial lines: DTR is dropped when the last close happens.
2003 * (This is not done solely through tty->count, now. - Ted 1/27/92)
2004 *
2005 * The termios state of a pty is reset on first open so that
2006 * settings don't persist across reuse.
2007 *
2008 * Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2009 * tty->count should protect the rest.
2010 * ->siglock protects ->signal/->sighand
2011 *
2012 * Note: the tty_unlock/lock cases without a ref are only safe due to
2013 * tty_mutex
2014 */
2015
2016static int tty_open(struct inode *inode, struct file *filp)
2017{
2018 struct tty_struct *tty;
2019 int noctty, retval;
2020 dev_t device = inode->i_rdev;
2021 unsigned saved_flags = filp->f_flags;
2022
2023 nonseekable_open(inode, filp);
2024
2025retry_open:
2026 retval = tty_alloc_file(filp);
2027 if (retval)
2028 return -ENOMEM;
2029
2030 tty = tty_open_current_tty(device, filp);
2031 if (!tty)
2032 tty = tty_open_by_driver(device, inode, filp);
2033
2034 if (IS_ERR(tty)) {
2035 tty_free_file(filp);
2036 retval = PTR_ERR(tty);
2037 if (retval != -EAGAIN || signal_pending(current))
2038 return retval;
2039 schedule();
2040 goto retry_open;
2041 }
2042
2043 tty_add_file(tty, filp);
2044
2045 check_tty_count(tty, __func__);
2046 tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2047
2048 if (tty->ops->open)
2049 retval = tty->ops->open(tty, filp);
2050 else
2051 retval = -ENODEV;
2052 filp->f_flags = saved_flags;
2053
2054 if (retval) {
2055 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2056
2057 tty_unlock(tty); /* need to call tty_release without BTM */
2058 tty_release(inode, filp);
2059 if (retval != -ERESTARTSYS)
2060 return retval;
2061
2062 if (signal_pending(current))
2063 return retval;
2064
2065 schedule();
2066 /*
2067 * Need to reset f_op in case a hangup happened.
2068 */
2069 if (tty_hung_up_p(filp))
2070 filp->f_op = &tty_fops;
2071 goto retry_open;
2072 }
2073 clear_bit(TTY_HUPPED, &tty->flags);
2074
2075 noctty = (filp->f_flags & O_NOCTTY) ||
2076 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2077 device == MKDEV(TTYAUX_MAJOR, 1) ||
2078 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2079 tty->driver->subtype == PTY_TYPE_MASTER);
2080 if (!noctty)
2081 tty_open_proc_set_tty(filp, tty);
2082 tty_unlock(tty);
2083 return 0;
2084}
2085
2086
2087
2088/**
2089 * tty_poll - check tty status
2090 * @filp: file being polled
2091 * @wait: poll wait structures to update
2092 *
2093 * Call the line discipline polling method to obtain the poll
2094 * status of the device.
2095 *
2096 * Locking: locks called line discipline but ldisc poll method
2097 * may be re-entered freely by other callers.
2098 */
2099
2100static __poll_t tty_poll(struct file *filp, poll_table *wait)
2101{
2102 struct tty_struct *tty = file_tty(filp);
2103 struct tty_ldisc *ld;
2104 __poll_t ret = 0;
2105
2106 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2107 return 0;
2108
2109 ld = tty_ldisc_ref_wait(tty);
2110 if (!ld)
2111 return hung_up_tty_poll(filp, wait);
2112 if (ld->ops->poll)
2113 ret = ld->ops->poll(tty, filp, wait);
2114 tty_ldisc_deref(ld);
2115 return ret;
2116}
2117
2118static int __tty_fasync(int fd, struct file *filp, int on)
2119{
2120 struct tty_struct *tty = file_tty(filp);
2121 unsigned long flags;
2122 int retval = 0;
2123
2124 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2125 goto out;
2126
2127 retval = fasync_helper(fd, filp, on, &tty->fasync);
2128 if (retval <= 0)
2129 goto out;
2130
2131 if (on) {
2132 enum pid_type type;
2133 struct pid *pid;
2134
2135 spin_lock_irqsave(&tty->ctrl_lock, flags);
2136 if (tty->pgrp) {
2137 pid = tty->pgrp;
2138 type = PIDTYPE_PGID;
2139 } else {
2140 pid = task_pid(current);
2141 type = PIDTYPE_TGID;
2142 }
2143 get_pid(pid);
2144 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2145 __f_setown(filp, pid, type, 0);
2146 put_pid(pid);
2147 retval = 0;
2148 }
2149out:
2150 return retval;
2151}
2152
2153static int tty_fasync(int fd, struct file *filp, int on)
2154{
2155 struct tty_struct *tty = file_tty(filp);
2156 int retval = -ENOTTY;
2157
2158 tty_lock(tty);
2159 if (!tty_hung_up_p(filp))
2160 retval = __tty_fasync(fd, filp, on);
2161 tty_unlock(tty);
2162
2163 return retval;
2164}
2165
2166/**
2167 * tiocsti - fake input character
2168 * @tty: tty to fake input into
2169 * @p: pointer to character
2170 *
2171 * Fake input to a tty device. Does the necessary locking and
2172 * input management.
2173 *
2174 * FIXME: does not honour flow control ??
2175 *
2176 * Locking:
2177 * Called functions take tty_ldiscs_lock
2178 * current->signal->tty check is safe without locks
2179 *
2180 * FIXME: may race normal receive processing
2181 */
2182
2183static int tiocsti(struct tty_struct *tty, char __user *p)
2184{
2185 char ch, mbz = 0;
2186 struct tty_ldisc *ld;
2187
2188 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2189 return -EPERM;
2190 if (get_user(ch, p))
2191 return -EFAULT;
2192 tty_audit_tiocsti(tty, ch);
2193 ld = tty_ldisc_ref_wait(tty);
2194 if (!ld)
2195 return -EIO;
2196 if (ld->ops->receive_buf)
2197 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2198 tty_ldisc_deref(ld);
2199 return 0;
2200}
2201
2202/**
2203 * tiocgwinsz - implement window query ioctl
2204 * @tty; tty
2205 * @arg: user buffer for result
2206 *
2207 * Copies the kernel idea of the window size into the user buffer.
2208 *
2209 * Locking: tty->winsize_mutex is taken to ensure the winsize data
2210 * is consistent.
2211 */
2212
2213static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2214{
2215 int err;
2216
2217 mutex_lock(&tty->winsize_mutex);
2218 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2219 mutex_unlock(&tty->winsize_mutex);
2220
2221 return err ? -EFAULT: 0;
2222}
2223
2224/**
2225 * tty_do_resize - resize event
2226 * @tty: tty being resized
2227 * @rows: rows (character)
2228 * @cols: cols (character)
2229 *
2230 * Update the termios variables and send the necessary signals to
2231 * peform a terminal resize correctly
2232 */
2233
2234int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2235{
2236 struct pid *pgrp;
2237
2238 /* Lock the tty */
2239 mutex_lock(&tty->winsize_mutex);
2240 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2241 goto done;
2242
2243 /* Signal the foreground process group */
2244 pgrp = tty_get_pgrp(tty);
2245 if (pgrp)
2246 kill_pgrp(pgrp, SIGWINCH, 1);
2247 put_pid(pgrp);
2248
2249 tty->winsize = *ws;
2250done:
2251 mutex_unlock(&tty->winsize_mutex);
2252 return 0;
2253}
2254EXPORT_SYMBOL(tty_do_resize);
2255
2256/**
2257 * tiocswinsz - implement window size set ioctl
2258 * @tty; tty side of tty
2259 * @arg: user buffer for result
2260 *
2261 * Copies the user idea of the window size to the kernel. Traditionally
2262 * this is just advisory information but for the Linux console it
2263 * actually has driver level meaning and triggers a VC resize.
2264 *
2265 * Locking:
2266 * Driver dependent. The default do_resize method takes the
2267 * tty termios mutex and ctrl_lock. The console takes its own lock
2268 * then calls into the default method.
2269 */
2270
2271static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2272{
2273 struct winsize tmp_ws;
2274 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2275 return -EFAULT;
2276
2277 if (tty->ops->resize)
2278 return tty->ops->resize(tty, &tmp_ws);
2279 else
2280 return tty_do_resize(tty, &tmp_ws);
2281}
2282
2283/**
2284 * tioccons - allow admin to move logical console
2285 * @file: the file to become console
2286 *
2287 * Allow the administrator to move the redirected console device
2288 *
2289 * Locking: uses redirect_lock to guard the redirect information
2290 */
2291
2292static int tioccons(struct file *file)
2293{
2294 if (!capable(CAP_SYS_ADMIN))
2295 return -EPERM;
2296 if (file->f_op->write == redirected_tty_write) {
2297 struct file *f;
2298 spin_lock(&redirect_lock);
2299 f = redirect;
2300 redirect = NULL;
2301 spin_unlock(&redirect_lock);
2302 if (f)
2303 fput(f);
2304 return 0;
2305 }
2306 spin_lock(&redirect_lock);
2307 if (redirect) {
2308 spin_unlock(&redirect_lock);
2309 return -EBUSY;
2310 }
2311 redirect = get_file(file);
2312 spin_unlock(&redirect_lock);
2313 return 0;
2314}
2315
2316/**
2317 * tiocsetd - set line discipline
2318 * @tty: tty device
2319 * @p: pointer to user data
2320 *
2321 * Set the line discipline according to user request.
2322 *
2323 * Locking: see tty_set_ldisc, this function is just a helper
2324 */
2325
2326static int tiocsetd(struct tty_struct *tty, int __user *p)
2327{
2328 int disc;
2329 int ret;
2330
2331 if (get_user(disc, p))
2332 return -EFAULT;
2333
2334 ret = tty_set_ldisc(tty, disc);
2335
2336 return ret;
2337}
2338
2339/**
2340 * tiocgetd - get line discipline
2341 * @tty: tty device
2342 * @p: pointer to user data
2343 *
2344 * Retrieves the line discipline id directly from the ldisc.
2345 *
2346 * Locking: waits for ldisc reference (in case the line discipline
2347 * is changing or the tty is being hungup)
2348 */
2349
2350static int tiocgetd(struct tty_struct *tty, int __user *p)
2351{
2352 struct tty_ldisc *ld;
2353 int ret;
2354
2355 ld = tty_ldisc_ref_wait(tty);
2356 if (!ld)
2357 return -EIO;
2358 ret = put_user(ld->ops->num, p);
2359 tty_ldisc_deref(ld);
2360 return ret;
2361}
2362
2363/**
2364 * send_break - performed time break
2365 * @tty: device to break on
2366 * @duration: timeout in mS
2367 *
2368 * Perform a timed break on hardware that lacks its own driver level
2369 * timed break functionality.
2370 *
2371 * Locking:
2372 * atomic_write_lock serializes
2373 *
2374 */
2375
2376static int send_break(struct tty_struct *tty, unsigned int duration)
2377{
2378 int retval;
2379
2380 if (tty->ops->break_ctl == NULL)
2381 return 0;
2382
2383 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2384 retval = tty->ops->break_ctl(tty, duration);
2385 else {
2386 /* Do the work ourselves */
2387 if (tty_write_lock(tty, 0) < 0)
2388 return -EINTR;
2389 retval = tty->ops->break_ctl(tty, -1);
2390 if (retval)
2391 goto out;
2392 if (!signal_pending(current))
2393 msleep_interruptible(duration);
2394 retval = tty->ops->break_ctl(tty, 0);
2395out:
2396 tty_write_unlock(tty);
2397 if (signal_pending(current))
2398 retval = -EINTR;
2399 }
2400 return retval;
2401}
2402
2403/**
2404 * tty_tiocmget - get modem status
2405 * @tty: tty device
2406 * @file: user file pointer
2407 * @p: pointer to result
2408 *
2409 * Obtain the modem status bits from the tty driver if the feature
2410 * is supported. Return -EINVAL if it is not available.
2411 *
2412 * Locking: none (up to the driver)
2413 */
2414
2415static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2416{
2417 int retval = -EINVAL;
2418
2419 if (tty->ops->tiocmget) {
2420 retval = tty->ops->tiocmget(tty);
2421
2422 if (retval >= 0)
2423 retval = put_user(retval, p);
2424 }
2425 return retval;
2426}
2427
2428/**
2429 * tty_tiocmset - set modem status
2430 * @tty: tty device
2431 * @cmd: command - clear bits, set bits or set all
2432 * @p: pointer to desired bits
2433 *
2434 * Set the modem status bits from the tty driver if the feature
2435 * is supported. Return -EINVAL if it is not available.
2436 *
2437 * Locking: none (up to the driver)
2438 */
2439
2440static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2441 unsigned __user *p)
2442{
2443 int retval;
2444 unsigned int set, clear, val;
2445
2446 if (tty->ops->tiocmset == NULL)
2447 return -EINVAL;
2448
2449 retval = get_user(val, p);
2450 if (retval)
2451 return retval;
2452 set = clear = 0;
2453 switch (cmd) {
2454 case TIOCMBIS:
2455 set = val;
2456 break;
2457 case TIOCMBIC:
2458 clear = val;
2459 break;
2460 case TIOCMSET:
2461 set = val;
2462 clear = ~val;
2463 break;
2464 }
2465 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2466 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2467 return tty->ops->tiocmset(tty, set, clear);
2468}
2469
2470static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2471{
2472 int retval = -EINVAL;
2473 struct serial_icounter_struct icount;
2474 memset(&icount, 0, sizeof(icount));
2475 if (tty->ops->get_icount)
2476 retval = tty->ops->get_icount(tty, &icount);
2477 if (retval != 0)
2478 return retval;
2479 if (copy_to_user(arg, &icount, sizeof(icount)))
2480 return -EFAULT;
2481 return 0;
2482}
2483
2484static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
2485{
2486 static DEFINE_RATELIMIT_STATE(depr_flags,
2487 DEFAULT_RATELIMIT_INTERVAL,
2488 DEFAULT_RATELIMIT_BURST);
2489 char comm[TASK_COMM_LEN];
2490 struct serial_struct v;
2491 int flags;
2492
2493 if (copy_from_user(&v, ss, sizeof(struct serial_struct)))
2494 return -EFAULT;
2495
2496 flags = v.flags & ASYNC_DEPRECATED;
2497
2498 if (flags && __ratelimit(&depr_flags))
2499 pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2500 __func__, get_task_comm(comm, current), flags);
2501 if (!tty->ops->set_serial)
2502 return -ENOTTY;
2503 return tty->ops->set_serial(tty, &v);
2504}
2505
2506static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2507{
2508 struct serial_struct v;
2509 int err;
2510
2511 memset(&v, 0, sizeof(struct serial_struct));
2512 if (!tty->ops->get_serial)
2513 return -ENOTTY;
2514 err = tty->ops->get_serial(tty, &v);
2515 if (!err && copy_to_user(ss, &v, sizeof(struct serial_struct)))
2516 err = -EFAULT;
2517 return err;
2518}
2519
2520/*
2521 * if pty, return the slave side (real_tty)
2522 * otherwise, return self
2523 */
2524static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2525{
2526 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2527 tty->driver->subtype == PTY_TYPE_MASTER)
2528 tty = tty->link;
2529 return tty;
2530}
2531
2532/*
2533 * Split this up, as gcc can choke on it otherwise..
2534 */
2535long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2536{
2537 struct tty_struct *tty = file_tty(file);
2538 struct tty_struct *real_tty;
2539 void __user *p = (void __user *)arg;
2540 int retval;
2541 struct tty_ldisc *ld;
2542
2543 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2544 return -EINVAL;
2545
2546 real_tty = tty_pair_get_tty(tty);
2547
2548 /*
2549 * Factor out some common prep work
2550 */
2551 switch (cmd) {
2552 case TIOCSETD:
2553 case TIOCSBRK:
2554 case TIOCCBRK:
2555 case TCSBRK:
2556 case TCSBRKP:
2557 retval = tty_check_change(tty);
2558 if (retval)
2559 return retval;
2560 if (cmd != TIOCCBRK) {
2561 tty_wait_until_sent(tty, 0);
2562 if (signal_pending(current))
2563 return -EINTR;
2564 }
2565 break;
2566 }
2567
2568 /*
2569 * Now do the stuff.
2570 */
2571 switch (cmd) {
2572 case TIOCSTI:
2573 return tiocsti(tty, p);
2574 case TIOCGWINSZ:
2575 return tiocgwinsz(real_tty, p);
2576 case TIOCSWINSZ:
2577 return tiocswinsz(real_tty, p);
2578 case TIOCCONS:
2579 return real_tty != tty ? -EINVAL : tioccons(file);
2580 case TIOCEXCL:
2581 set_bit(TTY_EXCLUSIVE, &tty->flags);
2582 return 0;
2583 case TIOCNXCL:
2584 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2585 return 0;
2586 case TIOCGEXCL:
2587 {
2588 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2589 return put_user(excl, (int __user *)p);
2590 }
2591 case TIOCGETD:
2592 return tiocgetd(tty, p);
2593 case TIOCSETD:
2594 return tiocsetd(tty, p);
2595 case TIOCVHANGUP:
2596 if (!capable(CAP_SYS_ADMIN))
2597 return -EPERM;
2598 tty_vhangup(tty);
2599 return 0;
2600 case TIOCGDEV:
2601 {
2602 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2603 return put_user(ret, (unsigned int __user *)p);
2604 }
2605 /*
2606 * Break handling
2607 */
2608 case TIOCSBRK: /* Turn break on, unconditionally */
2609 if (tty->ops->break_ctl)
2610 return tty->ops->break_ctl(tty, -1);
2611 return 0;
2612 case TIOCCBRK: /* Turn break off, unconditionally */
2613 if (tty->ops->break_ctl)
2614 return tty->ops->break_ctl(tty, 0);
2615 return 0;
2616 case TCSBRK: /* SVID version: non-zero arg --> no break */
2617 /* non-zero arg means wait for all output data
2618 * to be sent (performed above) but don't send break.
2619 * This is used by the tcdrain() termios function.
2620 */
2621 if (!arg)
2622 return send_break(tty, 250);
2623 return 0;
2624 case TCSBRKP: /* support for POSIX tcsendbreak() */
2625 return send_break(tty, arg ? arg*100 : 250);
2626
2627 case TIOCMGET:
2628 return tty_tiocmget(tty, p);
2629 case TIOCMSET:
2630 case TIOCMBIC:
2631 case TIOCMBIS:
2632 return tty_tiocmset(tty, cmd, p);
2633 case TIOCGICOUNT:
2634 return tty_tiocgicount(tty, p);
2635 case TCFLSH:
2636 switch (arg) {
2637 case TCIFLUSH:
2638 case TCIOFLUSH:
2639 /* flush tty buffer and allow ldisc to process ioctl */
2640 tty_buffer_flush(tty, NULL);
2641 break;
2642 }
2643 break;
2644 case TIOCSSERIAL:
2645 return tty_tiocsserial(tty, p);
2646 case TIOCGSERIAL:
2647 return tty_tiocgserial(tty, p);
2648 case TIOCGPTPEER:
2649 /* Special because the struct file is needed */
2650 return ptm_open_peer(file, tty, (int)arg);
2651 default:
2652 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2653 if (retval != -ENOIOCTLCMD)
2654 return retval;
2655 }
2656 if (tty->ops->ioctl) {
2657 retval = tty->ops->ioctl(tty, cmd, arg);
2658 if (retval != -ENOIOCTLCMD)
2659 return retval;
2660 }
2661 ld = tty_ldisc_ref_wait(tty);
2662 if (!ld)
2663 return hung_up_tty_ioctl(file, cmd, arg);
2664 retval = -EINVAL;
2665 if (ld->ops->ioctl) {
2666 retval = ld->ops->ioctl(tty, file, cmd, arg);
2667 if (retval == -ENOIOCTLCMD)
2668 retval = -ENOTTY;
2669 }
2670 tty_ldisc_deref(ld);
2671 return retval;
2672}
2673
2674#ifdef CONFIG_COMPAT
2675
2676struct serial_struct32 {
2677 compat_int_t type;
2678 compat_int_t line;
2679 compat_uint_t port;
2680 compat_int_t irq;
2681 compat_int_t flags;
2682 compat_int_t xmit_fifo_size;
2683 compat_int_t custom_divisor;
2684 compat_int_t baud_base;
2685 unsigned short close_delay;
2686 char io_type;
2687 char reserved_char[1];
2688 compat_int_t hub6;
2689 unsigned short closing_wait; /* time to wait before closing */
2690 unsigned short closing_wait2; /* no longer used... */
2691 compat_uint_t iomem_base;
2692 unsigned short iomem_reg_shift;
2693 unsigned int port_high;
2694 /* compat_ulong_t iomap_base FIXME */
2695 compat_int_t reserved[1];
2696};
2697
2698static int compat_tty_tiocsserial(struct tty_struct *tty,
2699 struct serial_struct32 __user *ss)
2700{
2701 static DEFINE_RATELIMIT_STATE(depr_flags,
2702 DEFAULT_RATELIMIT_INTERVAL,
2703 DEFAULT_RATELIMIT_BURST);
2704 char comm[TASK_COMM_LEN];
2705 struct serial_struct32 v32;
2706 struct serial_struct v;
2707 int flags;
2708
2709 if (copy_from_user(&v32, ss, sizeof(struct serial_struct32)))
2710 return -EFAULT;
2711
2712 memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2713 v.iomem_base = compat_ptr(v32.iomem_base);
2714 v.iomem_reg_shift = v32.iomem_reg_shift;
2715 v.port_high = v32.port_high;
2716 v.iomap_base = 0;
2717
2718 flags = v.flags & ASYNC_DEPRECATED;
2719
2720 if (flags && __ratelimit(&depr_flags))
2721 pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2722 __func__, get_task_comm(comm, current), flags);
2723 if (!tty->ops->set_serial)
2724 return -ENOTTY;
2725 return tty->ops->set_serial(tty, &v);
2726}
2727
2728static int compat_tty_tiocgserial(struct tty_struct *tty,
2729 struct serial_struct32 __user *ss)
2730{
2731 struct serial_struct32 v32;
2732 struct serial_struct v;
2733 int err;
2734 memset(&v, 0, sizeof(struct serial_struct));
2735
2736 if (!tty->ops->set_serial)
2737 return -ENOTTY;
2738 err = tty->ops->get_serial(tty, &v);
2739 if (!err) {
2740 memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2741 v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2742 0xfffffff : ptr_to_compat(v.iomem_base);
2743 v32.iomem_reg_shift = v.iomem_reg_shift;
2744 v32.port_high = v.port_high;
2745 if (copy_to_user(ss, &v32, sizeof(struct serial_struct32)))
2746 err = -EFAULT;
2747 }
2748 return err;
2749}
2750static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2751 unsigned long arg)
2752{
2753 struct tty_struct *tty = file_tty(file);
2754 struct tty_ldisc *ld;
2755 int retval = -ENOIOCTLCMD;
2756
2757 switch (cmd) {
2758 case TIOCSTI:
2759 case TIOCGWINSZ:
2760 case TIOCSWINSZ:
2761 case TIOCGEXCL:
2762 case TIOCGETD:
2763 case TIOCSETD:
2764 case TIOCGDEV:
2765 case TIOCMGET:
2766 case TIOCMSET:
2767 case TIOCMBIC:
2768 case TIOCMBIS:
2769 case TIOCGICOUNT:
2770 case TIOCGPGRP:
2771 case TIOCSPGRP:
2772 case TIOCGSID:
2773 case TIOCSERGETLSR:
2774 case TIOCGRS485:
2775 case TIOCSRS485:
2776#ifdef TIOCGETP
2777 case TIOCGETP:
2778 case TIOCSETP:
2779 case TIOCSETN:
2780#endif
2781#ifdef TIOCGETC
2782 case TIOCGETC:
2783 case TIOCSETC:
2784#endif
2785#ifdef TIOCGLTC
2786 case TIOCGLTC:
2787 case TIOCSLTC:
2788#endif
2789 case TCSETSF:
2790 case TCSETSW:
2791 case TCSETS:
2792 case TCGETS:
2793#ifdef TCGETS2
2794 case TCGETS2:
2795 case TCSETSF2:
2796 case TCSETSW2:
2797 case TCSETS2:
2798#endif
2799 case TCGETA:
2800 case TCSETAF:
2801 case TCSETAW:
2802 case TCSETA:
2803 case TIOCGLCKTRMIOS:
2804 case TIOCSLCKTRMIOS:
2805#ifdef TCGETX
2806 case TCGETX:
2807 case TCSETX:
2808 case TCSETXW:
2809 case TCSETXF:
2810#endif
2811 case TIOCGSOFTCAR:
2812 case TIOCSSOFTCAR:
2813 return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
2814 case TIOCCONS:
2815 case TIOCEXCL:
2816 case TIOCNXCL:
2817 case TIOCVHANGUP:
2818 case TIOCSBRK:
2819 case TIOCCBRK:
2820 case TCSBRK:
2821 case TCSBRKP:
2822 case TCFLSH:
2823 case TIOCGPTPEER:
2824 case TIOCNOTTY:
2825 case TIOCSCTTY:
2826 case TCXONC:
2827 case TIOCMIWAIT:
2828 case TIOCSERCONFIG:
2829 return tty_ioctl(file, cmd, arg);
2830 }
2831
2832 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2833 return -EINVAL;
2834
2835 switch (cmd) {
2836 case TIOCSSERIAL:
2837 return compat_tty_tiocsserial(tty, compat_ptr(arg));
2838 case TIOCGSERIAL:
2839 return compat_tty_tiocgserial(tty, compat_ptr(arg));
2840 }
2841 if (tty->ops->compat_ioctl) {
2842 retval = tty->ops->compat_ioctl(tty, cmd, arg);
2843 if (retval != -ENOIOCTLCMD)
2844 return retval;
2845 }
2846
2847 ld = tty_ldisc_ref_wait(tty);
2848 if (!ld)
2849 return hung_up_tty_compat_ioctl(file, cmd, arg);
2850 if (ld->ops->compat_ioctl)
2851 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2852 if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2853 retval = ld->ops->ioctl(tty, file,
2854 (unsigned long)compat_ptr(cmd), arg);
2855 tty_ldisc_deref(ld);
2856
2857 return retval;
2858}
2859#endif
2860
2861static int this_tty(const void *t, struct file *file, unsigned fd)
2862{
2863 if (likely(file->f_op->read != tty_read))
2864 return 0;
2865 return file_tty(file) != t ? 0 : fd + 1;
2866}
2867
2868/*
2869 * This implements the "Secure Attention Key" --- the idea is to
2870 * prevent trojan horses by killing all processes associated with this
2871 * tty when the user hits the "Secure Attention Key". Required for
2872 * super-paranoid applications --- see the Orange Book for more details.
2873 *
2874 * This code could be nicer; ideally it should send a HUP, wait a few
2875 * seconds, then send a INT, and then a KILL signal. But you then
2876 * have to coordinate with the init process, since all processes associated
2877 * with the current tty must be dead before the new getty is allowed
2878 * to spawn.
2879 *
2880 * Now, if it would be correct ;-/ The current code has a nasty hole -
2881 * it doesn't catch files in flight. We may send the descriptor to ourselves
2882 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2883 *
2884 * Nasty bug: do_SAK is being called in interrupt context. This can
2885 * deadlock. We punt it up to process context. AKPM - 16Mar2001
2886 */
2887void __do_SAK(struct tty_struct *tty)
2888{
2889#ifdef TTY_SOFT_SAK
2890 tty_hangup(tty);
2891#else
2892 struct task_struct *g, *p;
2893 struct pid *session;
2894 int i;
2895
2896 if (!tty)
2897 return;
2898 session = tty->session;
2899
2900 tty_ldisc_flush(tty);
2901
2902 tty_driver_flush_buffer(tty);
2903
2904 read_lock(&tasklist_lock);
2905 /* Kill the entire session */
2906 do_each_pid_task(session, PIDTYPE_SID, p) {
2907 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
2908 task_pid_nr(p), p->comm);
2909 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2910 } while_each_pid_task(session, PIDTYPE_SID, p);
2911
2912 /* Now kill any processes that happen to have the tty open */
2913 do_each_thread(g, p) {
2914 if (p->signal->tty == tty) {
2915 tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
2916 task_pid_nr(p), p->comm);
2917 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2918 continue;
2919 }
2920 task_lock(p);
2921 i = iterate_fd(p->files, 0, this_tty, tty);
2922 if (i != 0) {
2923 tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
2924 task_pid_nr(p), p->comm, i - 1);
2925 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2926 }
2927 task_unlock(p);
2928 } while_each_thread(g, p);
2929 read_unlock(&tasklist_lock);
2930#endif
2931}
2932
2933static void do_SAK_work(struct work_struct *work)
2934{
2935 struct tty_struct *tty =
2936 container_of(work, struct tty_struct, SAK_work);
2937 __do_SAK(tty);
2938}
2939
2940/*
2941 * The tq handling here is a little racy - tty->SAK_work may already be queued.
2942 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2943 * the values which we write to it will be identical to the values which it
2944 * already has. --akpm
2945 */
2946void do_SAK(struct tty_struct *tty)
2947{
2948 if (!tty)
2949 return;
2950 schedule_work(&tty->SAK_work);
2951}
2952
2953EXPORT_SYMBOL(do_SAK);
2954
2955/* Must put_device() after it's unused! */
2956static struct device *tty_get_device(struct tty_struct *tty)
2957{
2958 dev_t devt = tty_devnum(tty);
2959 return class_find_device_by_devt(tty_class, devt);
2960}
2961
2962
2963/**
2964 * alloc_tty_struct
2965 *
2966 * This subroutine allocates and initializes a tty structure.
2967 *
2968 * Locking: none - tty in question is not exposed at this point
2969 */
2970
2971struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
2972{
2973 struct tty_struct *tty;
2974
2975 tty = kzalloc(sizeof(*tty), GFP_KERNEL);
2976 if (!tty)
2977 return NULL;
2978
2979 kref_init(&tty->kref);
2980 tty->magic = TTY_MAGIC;
2981 if (tty_ldisc_init(tty)) {
2982 kfree(tty);
2983 return NULL;
2984 }
2985 tty->session = NULL;
2986 tty->pgrp = NULL;
2987 mutex_init(&tty->legacy_mutex);
2988 mutex_init(&tty->throttle_mutex);
2989 init_rwsem(&tty->termios_rwsem);
2990 mutex_init(&tty->winsize_mutex);
2991 init_ldsem(&tty->ldisc_sem);
2992 init_waitqueue_head(&tty->write_wait);
2993 init_waitqueue_head(&tty->read_wait);
2994 INIT_WORK(&tty->hangup_work, do_tty_hangup);
2995 mutex_init(&tty->atomic_write_lock);
2996 spin_lock_init(&tty->ctrl_lock);
2997 spin_lock_init(&tty->flow_lock);
2998 spin_lock_init(&tty->files_lock);
2999 INIT_LIST_HEAD(&tty->tty_files);
3000 INIT_WORK(&tty->SAK_work, do_SAK_work);
3001
3002 tty->driver = driver;
3003 tty->ops = driver->ops;
3004 tty->index = idx;
3005 tty_line_name(driver, idx, tty->name);
3006 tty->dev = tty_get_device(tty);
3007
3008 return tty;
3009}
3010
3011/**
3012 * tty_put_char - write one character to a tty
3013 * @tty: tty
3014 * @ch: character
3015 *
3016 * Write one byte to the tty using the provided put_char method
3017 * if present. Returns the number of characters successfully output.
3018 *
3019 * Note: the specific put_char operation in the driver layer may go
3020 * away soon. Don't call it directly, use this method
3021 */
3022
3023int tty_put_char(struct tty_struct *tty, unsigned char ch)
3024{
3025 if (tty->ops->put_char)
3026 return tty->ops->put_char(tty, ch);
3027 return tty->ops->write(tty, &ch, 1);
3028}
3029EXPORT_SYMBOL_GPL(tty_put_char);
3030
3031struct class *tty_class;
3032
3033static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3034 unsigned int index, unsigned int count)
3035{
3036 int err;
3037
3038 /* init here, since reused cdevs cause crashes */
3039 driver->cdevs[index] = cdev_alloc();
3040 if (!driver->cdevs[index])
3041 return -ENOMEM;
3042 driver->cdevs[index]->ops = &tty_fops;
3043 driver->cdevs[index]->owner = driver->owner;
3044 err = cdev_add(driver->cdevs[index], dev, count);
3045 if (err)
3046 kobject_put(&driver->cdevs[index]->kobj);
3047 return err;
3048}
3049
3050/**
3051 * tty_register_device - register a tty device
3052 * @driver: the tty driver that describes the tty device
3053 * @index: the index in the tty driver for this tty device
3054 * @device: a struct device that is associated with this tty device.
3055 * This field is optional, if there is no known struct device
3056 * for this tty device it can be set to NULL safely.
3057 *
3058 * Returns a pointer to the struct device for this tty device
3059 * (or ERR_PTR(-EFOO) on error).
3060 *
3061 * This call is required to be made to register an individual tty device
3062 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3063 * that bit is not set, this function should not be called by a tty
3064 * driver.
3065 *
3066 * Locking: ??
3067 */
3068
3069struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3070 struct device *device)
3071{
3072 return tty_register_device_attr(driver, index, device, NULL, NULL);
3073}
3074EXPORT_SYMBOL(tty_register_device);
3075
3076static void tty_device_create_release(struct device *dev)
3077{
3078 dev_dbg(dev, "releasing...\n");
3079 kfree(dev);
3080}
3081
3082/**
3083 * tty_register_device_attr - register a tty device
3084 * @driver: the tty driver that describes the tty device
3085 * @index: the index in the tty driver for this tty device
3086 * @device: a struct device that is associated with this tty device.
3087 * This field is optional, if there is no known struct device
3088 * for this tty device it can be set to NULL safely.
3089 * @drvdata: Driver data to be set to device.
3090 * @attr_grp: Attribute group to be set on device.
3091 *
3092 * Returns a pointer to the struct device for this tty device
3093 * (or ERR_PTR(-EFOO) on error).
3094 *
3095 * This call is required to be made to register an individual tty device
3096 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3097 * that bit is not set, this function should not be called by a tty
3098 * driver.
3099 *
3100 * Locking: ??
3101 */
3102struct device *tty_register_device_attr(struct tty_driver *driver,
3103 unsigned index, struct device *device,
3104 void *drvdata,
3105 const struct attribute_group **attr_grp)
3106{
3107 char name[64];
3108 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3109 struct ktermios *tp;
3110 struct device *dev;
3111 int retval;
3112
3113 if (index >= driver->num) {
3114 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3115 driver->name, index);
3116 return ERR_PTR(-EINVAL);
3117 }
3118
3119 if (driver->type == TTY_DRIVER_TYPE_PTY)
3120 pty_line_name(driver, index, name);
3121 else
3122 tty_line_name(driver, index, name);
3123
3124 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3125 if (!dev)
3126 return ERR_PTR(-ENOMEM);
3127
3128 dev->devt = devt;
3129 dev->class = tty_class;
3130 dev->parent = device;
3131 dev->release = tty_device_create_release;
3132 dev_set_name(dev, "%s", name);
3133 dev->groups = attr_grp;
3134 dev_set_drvdata(dev, drvdata);
3135
3136 dev_set_uevent_suppress(dev, 1);
3137
3138 retval = device_register(dev);
3139 if (retval)
3140 goto err_put;
3141
3142 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3143 /*
3144 * Free any saved termios data so that the termios state is
3145 * reset when reusing a minor number.
3146 */
3147 tp = driver->termios[index];
3148 if (tp) {
3149 driver->termios[index] = NULL;
3150 kfree(tp);
3151 }
3152
3153 retval = tty_cdev_add(driver, devt, index, 1);
3154 if (retval)
3155 goto err_del;
3156 }
3157
3158 dev_set_uevent_suppress(dev, 0);
3159 kobject_uevent(&dev->kobj, KOBJ_ADD);
3160
3161 return dev;
3162
3163err_del:
3164 device_del(dev);
3165err_put:
3166 put_device(dev);
3167
3168 return ERR_PTR(retval);
3169}
3170EXPORT_SYMBOL_GPL(tty_register_device_attr);
3171
3172/**
3173 * tty_unregister_device - unregister a tty device
3174 * @driver: the tty driver that describes the tty device
3175 * @index: the index in the tty driver for this tty device
3176 *
3177 * If a tty device is registered with a call to tty_register_device() then
3178 * this function must be called when the tty device is gone.
3179 *
3180 * Locking: ??
3181 */
3182
3183void tty_unregister_device(struct tty_driver *driver, unsigned index)
3184{
3185 device_destroy(tty_class,
3186 MKDEV(driver->major, driver->minor_start) + index);
3187 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3188 cdev_del(driver->cdevs[index]);
3189 driver->cdevs[index] = NULL;
3190 }
3191}
3192EXPORT_SYMBOL(tty_unregister_device);
3193
3194/**
3195 * __tty_alloc_driver -- allocate tty driver
3196 * @lines: count of lines this driver can handle at most
3197 * @owner: module which is responsible for this driver
3198 * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3199 *
3200 * This should not be called directly, some of the provided macros should be
3201 * used instead. Use IS_ERR and friends on @retval.
3202 */
3203struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3204 unsigned long flags)
3205{
3206 struct tty_driver *driver;
3207 unsigned int cdevs = 1;
3208 int err;
3209
3210 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3211 return ERR_PTR(-EINVAL);
3212
3213 driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3214 if (!driver)
3215 return ERR_PTR(-ENOMEM);
3216
3217 kref_init(&driver->kref);
3218 driver->magic = TTY_DRIVER_MAGIC;
3219 driver->num = lines;
3220 driver->owner = owner;
3221 driver->flags = flags;
3222
3223 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3224 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3225 GFP_KERNEL);
3226 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3227 GFP_KERNEL);
3228 if (!driver->ttys || !driver->termios) {
3229 err = -ENOMEM;
3230 goto err_free_all;
3231 }
3232 }
3233
3234 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3235 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3236 GFP_KERNEL);
3237 if (!driver->ports) {
3238 err = -ENOMEM;
3239 goto err_free_all;
3240 }
3241 cdevs = lines;
3242 }
3243
3244 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3245 if (!driver->cdevs) {
3246 err = -ENOMEM;
3247 goto err_free_all;
3248 }
3249
3250 return driver;
3251err_free_all:
3252 kfree(driver->ports);
3253 kfree(driver->ttys);
3254 kfree(driver->termios);
3255 kfree(driver->cdevs);
3256 kfree(driver);
3257 return ERR_PTR(err);
3258}
3259EXPORT_SYMBOL(__tty_alloc_driver);
3260
3261static void destruct_tty_driver(struct kref *kref)
3262{
3263 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3264 int i;
3265 struct ktermios *tp;
3266
3267 if (driver->flags & TTY_DRIVER_INSTALLED) {
3268 for (i = 0; i < driver->num; i++) {
3269 tp = driver->termios[i];
3270 if (tp) {
3271 driver->termios[i] = NULL;
3272 kfree(tp);
3273 }
3274 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3275 tty_unregister_device(driver, i);
3276 }
3277 proc_tty_unregister_driver(driver);
3278 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3279 cdev_del(driver->cdevs[0]);
3280 }
3281 kfree(driver->cdevs);
3282 kfree(driver->ports);
3283 kfree(driver->termios);
3284 kfree(driver->ttys);
3285 kfree(driver);
3286}
3287
3288void tty_driver_kref_put(struct tty_driver *driver)
3289{
3290 kref_put(&driver->kref, destruct_tty_driver);
3291}
3292EXPORT_SYMBOL(tty_driver_kref_put);
3293
3294void tty_set_operations(struct tty_driver *driver,
3295 const struct tty_operations *op)
3296{
3297 driver->ops = op;
3298};
3299EXPORT_SYMBOL(tty_set_operations);
3300
3301void put_tty_driver(struct tty_driver *d)
3302{
3303 tty_driver_kref_put(d);
3304}
3305EXPORT_SYMBOL(put_tty_driver);
3306
3307/*
3308 * Called by a tty driver to register itself.
3309 */
3310int tty_register_driver(struct tty_driver *driver)
3311{
3312 int error;
3313 int i;
3314 dev_t dev;
3315 struct device *d;
3316
3317 if (!driver->major) {
3318 error = alloc_chrdev_region(&dev, driver->minor_start,
3319 driver->num, driver->name);
3320 if (!error) {
3321 driver->major = MAJOR(dev);
3322 driver->minor_start = MINOR(dev);
3323 }
3324 } else {
3325 dev = MKDEV(driver->major, driver->minor_start);
3326 error = register_chrdev_region(dev, driver->num, driver->name);
3327 }
3328 if (error < 0)
3329 goto err;
3330
3331 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3332 error = tty_cdev_add(driver, dev, 0, driver->num);
3333 if (error)
3334 goto err_unreg_char;
3335 }
3336
3337 mutex_lock(&tty_mutex);
3338 list_add(&driver->tty_drivers, &tty_drivers);
3339 mutex_unlock(&tty_mutex);
3340
3341 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3342 for (i = 0; i < driver->num; i++) {
3343 d = tty_register_device(driver, i, NULL);
3344 if (IS_ERR(d)) {
3345 error = PTR_ERR(d);
3346 goto err_unreg_devs;
3347 }
3348 }
3349 }
3350 proc_tty_register_driver(driver);
3351 driver->flags |= TTY_DRIVER_INSTALLED;
3352 return 0;
3353
3354err_unreg_devs:
3355 for (i--; i >= 0; i--)
3356 tty_unregister_device(driver, i);
3357
3358 mutex_lock(&tty_mutex);
3359 list_del(&driver->tty_drivers);
3360 mutex_unlock(&tty_mutex);
3361
3362err_unreg_char:
3363 unregister_chrdev_region(dev, driver->num);
3364err:
3365 return error;
3366}
3367EXPORT_SYMBOL(tty_register_driver);
3368
3369/*
3370 * Called by a tty driver to unregister itself.
3371 */
3372int tty_unregister_driver(struct tty_driver *driver)
3373{
3374#if 0
3375 /* FIXME */
3376 if (driver->refcount)
3377 return -EBUSY;
3378#endif
3379 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3380 driver->num);
3381 mutex_lock(&tty_mutex);
3382 list_del(&driver->tty_drivers);
3383 mutex_unlock(&tty_mutex);
3384 return 0;
3385}
3386
3387EXPORT_SYMBOL(tty_unregister_driver);
3388
3389dev_t tty_devnum(struct tty_struct *tty)
3390{
3391 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3392}
3393EXPORT_SYMBOL(tty_devnum);
3394
3395void tty_default_fops(struct file_operations *fops)
3396{
3397 *fops = tty_fops;
3398}
3399
3400static char *tty_devnode(struct device *dev, umode_t *mode)
3401{
3402 if (!mode)
3403 return NULL;
3404 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3405 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3406 *mode = 0666;
3407 return NULL;
3408}
3409
3410static int __init tty_class_init(void)
3411{
3412 tty_class = class_create(THIS_MODULE, "tty");
3413 if (IS_ERR(tty_class))
3414 return PTR_ERR(tty_class);
3415 tty_class->devnode = tty_devnode;
3416 return 0;
3417}
3418
3419postcore_initcall(tty_class_init);
3420
3421/* 3/2004 jmc: why do these devices exist? */
3422static struct cdev tty_cdev, console_cdev;
3423
3424static ssize_t show_cons_active(struct device *dev,
3425 struct device_attribute *attr, char *buf)
3426{
3427 struct console *cs[16];
3428 int i = 0;
3429 struct console *c;
3430 ssize_t count = 0;
3431
3432 console_lock();
3433 for_each_console(c) {
3434 if (!c->device)
3435 continue;
3436 if (!c->write)
3437 continue;
3438 if ((c->flags & CON_ENABLED) == 0)
3439 continue;
3440 cs[i++] = c;
3441 if (i >= ARRAY_SIZE(cs))
3442 break;
3443 }
3444 while (i--) {
3445 int index = cs[i]->index;
3446 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3447
3448 /* don't resolve tty0 as some programs depend on it */
3449 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3450 count += tty_line_name(drv, index, buf + count);
3451 else
3452 count += sprintf(buf + count, "%s%d",
3453 cs[i]->name, cs[i]->index);
3454
3455 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3456 }
3457 console_unlock();
3458
3459 return count;
3460}
3461static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3462
3463static struct attribute *cons_dev_attrs[] = {
3464 &dev_attr_active.attr,
3465 NULL
3466};
3467
3468ATTRIBUTE_GROUPS(cons_dev);
3469
3470static struct device *consdev;
3471
3472void console_sysfs_notify(void)
3473{
3474 if (consdev)
3475 sysfs_notify(&consdev->kobj, NULL, "active");
3476}
3477
3478/*
3479 * Ok, now we can initialize the rest of the tty devices and can count
3480 * on memory allocations, interrupts etc..
3481 */
3482int __init tty_init(void)
3483{
3484 tty_sysctl_init();
3485 cdev_init(&tty_cdev, &tty_fops);
3486 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3487 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3488 panic("Couldn't register /dev/tty driver\n");
3489 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3490
3491 cdev_init(&console_cdev, &console_fops);
3492 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3493 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3494 panic("Couldn't register /dev/console driver\n");
3495 consdev = device_create_with_groups(tty_class, NULL,
3496 MKDEV(TTYAUX_MAJOR, 1), NULL,
3497 cons_dev_groups, "console");
3498 if (IS_ERR(consdev))
3499 consdev = NULL;
3500
3501#ifdef CONFIG_VT
3502 vty_init(&console_fops);
3503#endif
3504 return 0;
3505}
3506
1/*
2 * Copyright (C) 1991, 1992 Linus Torvalds
3 */
4
5/*
6 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7 * or rs-channels. It also implements echoing, cooked mode etc.
8 *
9 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10 *
11 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12 * tty_struct and tty_queue structures. Previously there was an array
13 * of 256 tty_struct's which was statically allocated, and the
14 * tty_queue structures were allocated at boot time. Both are now
15 * dynamically allocated only when the tty is open.
16 *
17 * Also restructured routines so that there is more of a separation
18 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19 * the low-level tty routines (serial.c, pty.c, console.c). This
20 * makes for cleaner and more compact code. -TYT, 9/17/92
21 *
22 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23 * which can be dynamically activated and de-activated by the line
24 * discipline handling modules (like SLIP).
25 *
26 * NOTE: pay no attention to the line discipline code (yet); its
27 * interface is still subject to change in this version...
28 * -- TYT, 1/31/92
29 *
30 * Added functionality to the OPOST tty handling. No delays, but all
31 * other bits should be there.
32 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33 *
34 * Rewrote canonical mode and added more termios flags.
35 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36 *
37 * Reorganized FASYNC support so mouse code can share it.
38 * -- ctm@ardi.com, 9Sep95
39 *
40 * New TIOCLINUX variants added.
41 * -- mj@k332.feld.cvut.cz, 19-Nov-95
42 *
43 * Restrict vt switching via ioctl()
44 * -- grif@cs.ucr.edu, 5-Dec-95
45 *
46 * Move console and virtual terminal code to more appropriate files,
47 * implement CONFIG_VT and generalize console device interface.
48 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49 *
50 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51 * -- Bill Hawes <whawes@star.net>, June 97
52 *
53 * Added devfs support.
54 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55 *
56 * Added support for a Unix98-style ptmx device.
57 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58 *
59 * Reduced memory usage for older ARM systems
60 * -- Russell King <rmk@arm.linux.org.uk>
61 *
62 * Move do_SAK() into process context. Less stack use in devfs functions.
63 * alloc_tty_struct() always uses kmalloc()
64 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65 */
66
67#include <linux/types.h>
68#include <linux/major.h>
69#include <linux/errno.h>
70#include <linux/signal.h>
71#include <linux/fcntl.h>
72#include <linux/sched.h>
73#include <linux/interrupt.h>
74#include <linux/tty.h>
75#include <linux/tty_driver.h>
76#include <linux/tty_flip.h>
77#include <linux/devpts_fs.h>
78#include <linux/file.h>
79#include <linux/fdtable.h>
80#include <linux/console.h>
81#include <linux/timer.h>
82#include <linux/ctype.h>
83#include <linux/kd.h>
84#include <linux/mm.h>
85#include <linux/string.h>
86#include <linux/slab.h>
87#include <linux/poll.h>
88#include <linux/proc_fs.h>
89#include <linux/init.h>
90#include <linux/module.h>
91#include <linux/device.h>
92#include <linux/wait.h>
93#include <linux/bitops.h>
94#include <linux/delay.h>
95#include <linux/seq_file.h>
96#include <linux/serial.h>
97#include <linux/ratelimit.h>
98
99#include <linux/uaccess.h>
100
101#include <linux/kbd_kern.h>
102#include <linux/vt_kern.h>
103#include <linux/selection.h>
104
105#include <linux/kmod.h>
106#include <linux/nsproxy.h>
107
108#undef TTY_DEBUG_HANGUP
109
110#define TTY_PARANOIA_CHECK 1
111#define CHECK_TTY_COUNT 1
112
113struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
114 .c_iflag = ICRNL | IXON,
115 .c_oflag = OPOST | ONLCR,
116 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
117 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
118 ECHOCTL | ECHOKE | IEXTEN,
119 .c_cc = INIT_C_CC,
120 .c_ispeed = 38400,
121 .c_ospeed = 38400
122};
123
124EXPORT_SYMBOL(tty_std_termios);
125
126/* This list gets poked at by procfs and various bits of boot up code. This
127 could do with some rationalisation such as pulling the tty proc function
128 into this file */
129
130LIST_HEAD(tty_drivers); /* linked list of tty drivers */
131
132/* Mutex to protect creating and releasing a tty. This is shared with
133 vt.c for deeply disgusting hack reasons */
134DEFINE_MUTEX(tty_mutex);
135EXPORT_SYMBOL(tty_mutex);
136
137/* Spinlock to protect the tty->tty_files list */
138DEFINE_SPINLOCK(tty_files_lock);
139
140static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
141static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
142ssize_t redirected_tty_write(struct file *, const char __user *,
143 size_t, loff_t *);
144static unsigned int tty_poll(struct file *, poll_table *);
145static int tty_open(struct inode *, struct file *);
146long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
147#ifdef CONFIG_COMPAT
148static long tty_compat_ioctl(struct file *file, unsigned int cmd,
149 unsigned long arg);
150#else
151#define tty_compat_ioctl NULL
152#endif
153static int __tty_fasync(int fd, struct file *filp, int on);
154static int tty_fasync(int fd, struct file *filp, int on);
155static void release_tty(struct tty_struct *tty, int idx);
156static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158
159/**
160 * alloc_tty_struct - allocate a tty object
161 *
162 * Return a new empty tty structure. The data fields have not
163 * been initialized in any way but has been zeroed
164 *
165 * Locking: none
166 */
167
168struct tty_struct *alloc_tty_struct(void)
169{
170 return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
171}
172
173/**
174 * free_tty_struct - free a disused tty
175 * @tty: tty struct to free
176 *
177 * Free the write buffers, tty queue and tty memory itself.
178 *
179 * Locking: none. Must be called after tty is definitely unused
180 */
181
182void free_tty_struct(struct tty_struct *tty)
183{
184 if (tty->dev)
185 put_device(tty->dev);
186 kfree(tty->write_buf);
187 tty_buffer_free_all(tty);
188 kfree(tty);
189}
190
191static inline struct tty_struct *file_tty(struct file *file)
192{
193 return ((struct tty_file_private *)file->private_data)->tty;
194}
195
196int tty_alloc_file(struct file *file)
197{
198 struct tty_file_private *priv;
199
200 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
201 if (!priv)
202 return -ENOMEM;
203
204 file->private_data = priv;
205
206 return 0;
207}
208
209/* Associate a new file with the tty structure */
210void tty_add_file(struct tty_struct *tty, struct file *file)
211{
212 struct tty_file_private *priv = file->private_data;
213
214 priv->tty = tty;
215 priv->file = file;
216
217 spin_lock(&tty_files_lock);
218 list_add(&priv->list, &tty->tty_files);
219 spin_unlock(&tty_files_lock);
220}
221
222/**
223 * tty_free_file - free file->private_data
224 *
225 * This shall be used only for fail path handling when tty_add_file was not
226 * called yet.
227 */
228void tty_free_file(struct file *file)
229{
230 struct tty_file_private *priv = file->private_data;
231
232 file->private_data = NULL;
233 kfree(priv);
234}
235
236/* Delete file from its tty */
237void tty_del_file(struct file *file)
238{
239 struct tty_file_private *priv = file->private_data;
240
241 spin_lock(&tty_files_lock);
242 list_del(&priv->list);
243 spin_unlock(&tty_files_lock);
244 tty_free_file(file);
245}
246
247
248#define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
249
250/**
251 * tty_name - return tty naming
252 * @tty: tty structure
253 * @buf: buffer for output
254 *
255 * Convert a tty structure into a name. The name reflects the kernel
256 * naming policy and if udev is in use may not reflect user space
257 *
258 * Locking: none
259 */
260
261char *tty_name(struct tty_struct *tty, char *buf)
262{
263 if (!tty) /* Hmm. NULL pointer. That's fun. */
264 strcpy(buf, "NULL tty");
265 else
266 strcpy(buf, tty->name);
267 return buf;
268}
269
270EXPORT_SYMBOL(tty_name);
271
272int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
273 const char *routine)
274{
275#ifdef TTY_PARANOIA_CHECK
276 if (!tty) {
277 printk(KERN_WARNING
278 "null TTY for (%d:%d) in %s\n",
279 imajor(inode), iminor(inode), routine);
280 return 1;
281 }
282 if (tty->magic != TTY_MAGIC) {
283 printk(KERN_WARNING
284 "bad magic number for tty struct (%d:%d) in %s\n",
285 imajor(inode), iminor(inode), routine);
286 return 1;
287 }
288#endif
289 return 0;
290}
291
292static int check_tty_count(struct tty_struct *tty, const char *routine)
293{
294#ifdef CHECK_TTY_COUNT
295 struct list_head *p;
296 int count = 0;
297
298 spin_lock(&tty_files_lock);
299 list_for_each(p, &tty->tty_files) {
300 count++;
301 }
302 spin_unlock(&tty_files_lock);
303 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
304 tty->driver->subtype == PTY_TYPE_SLAVE &&
305 tty->link && tty->link->count)
306 count++;
307 if (tty->count != count) {
308 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
309 "!= #fd's(%d) in %s\n",
310 tty->name, tty->count, count, routine);
311 return count;
312 }
313#endif
314 return 0;
315}
316
317/**
318 * get_tty_driver - find device of a tty
319 * @dev_t: device identifier
320 * @index: returns the index of the tty
321 *
322 * This routine returns a tty driver structure, given a device number
323 * and also passes back the index number.
324 *
325 * Locking: caller must hold tty_mutex
326 */
327
328static struct tty_driver *get_tty_driver(dev_t device, int *index)
329{
330 struct tty_driver *p;
331
332 list_for_each_entry(p, &tty_drivers, tty_drivers) {
333 dev_t base = MKDEV(p->major, p->minor_start);
334 if (device < base || device >= base + p->num)
335 continue;
336 *index = device - base;
337 return tty_driver_kref_get(p);
338 }
339 return NULL;
340}
341
342#ifdef CONFIG_CONSOLE_POLL
343
344/**
345 * tty_find_polling_driver - find device of a polled tty
346 * @name: name string to match
347 * @line: pointer to resulting tty line nr
348 *
349 * This routine returns a tty driver structure, given a name
350 * and the condition that the tty driver is capable of polled
351 * operation.
352 */
353struct tty_driver *tty_find_polling_driver(char *name, int *line)
354{
355 struct tty_driver *p, *res = NULL;
356 int tty_line = 0;
357 int len;
358 char *str, *stp;
359
360 for (str = name; *str; str++)
361 if ((*str >= '0' && *str <= '9') || *str == ',')
362 break;
363 if (!*str)
364 return NULL;
365
366 len = str - name;
367 tty_line = simple_strtoul(str, &str, 10);
368
369 mutex_lock(&tty_mutex);
370 /* Search through the tty devices to look for a match */
371 list_for_each_entry(p, &tty_drivers, tty_drivers) {
372 if (strncmp(name, p->name, len) != 0)
373 continue;
374 stp = str;
375 if (*stp == ',')
376 stp++;
377 if (*stp == '\0')
378 stp = NULL;
379
380 if (tty_line >= 0 && tty_line < p->num && p->ops &&
381 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
382 res = tty_driver_kref_get(p);
383 *line = tty_line;
384 break;
385 }
386 }
387 mutex_unlock(&tty_mutex);
388
389 return res;
390}
391EXPORT_SYMBOL_GPL(tty_find_polling_driver);
392#endif
393
394/**
395 * tty_check_change - check for POSIX terminal changes
396 * @tty: tty to check
397 *
398 * If we try to write to, or set the state of, a terminal and we're
399 * not in the foreground, send a SIGTTOU. If the signal is blocked or
400 * ignored, go ahead and perform the operation. (POSIX 7.2)
401 *
402 * Locking: ctrl_lock
403 */
404
405int tty_check_change(struct tty_struct *tty)
406{
407 unsigned long flags;
408 int ret = 0;
409
410 if (current->signal->tty != tty)
411 return 0;
412
413 spin_lock_irqsave(&tty->ctrl_lock, flags);
414
415 if (!tty->pgrp) {
416 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
417 goto out_unlock;
418 }
419 if (task_pgrp(current) == tty->pgrp)
420 goto out_unlock;
421 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
422 if (is_ignored(SIGTTOU))
423 goto out;
424 if (is_current_pgrp_orphaned()) {
425 ret = -EIO;
426 goto out;
427 }
428 kill_pgrp(task_pgrp(current), SIGTTOU, 1);
429 set_thread_flag(TIF_SIGPENDING);
430 ret = -ERESTARTSYS;
431out:
432 return ret;
433out_unlock:
434 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
435 return ret;
436}
437
438EXPORT_SYMBOL(tty_check_change);
439
440static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
441 size_t count, loff_t *ppos)
442{
443 return 0;
444}
445
446static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
447 size_t count, loff_t *ppos)
448{
449 return -EIO;
450}
451
452/* No kernel lock held - none needed ;) */
453static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
454{
455 return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
456}
457
458static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
459 unsigned long arg)
460{
461 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
462}
463
464static long hung_up_tty_compat_ioctl(struct file *file,
465 unsigned int cmd, unsigned long arg)
466{
467 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
468}
469
470static const struct file_operations tty_fops = {
471 .llseek = no_llseek,
472 .read = tty_read,
473 .write = tty_write,
474 .poll = tty_poll,
475 .unlocked_ioctl = tty_ioctl,
476 .compat_ioctl = tty_compat_ioctl,
477 .open = tty_open,
478 .release = tty_release,
479 .fasync = tty_fasync,
480};
481
482static const struct file_operations console_fops = {
483 .llseek = no_llseek,
484 .read = tty_read,
485 .write = redirected_tty_write,
486 .poll = tty_poll,
487 .unlocked_ioctl = tty_ioctl,
488 .compat_ioctl = tty_compat_ioctl,
489 .open = tty_open,
490 .release = tty_release,
491 .fasync = tty_fasync,
492};
493
494static const struct file_operations hung_up_tty_fops = {
495 .llseek = no_llseek,
496 .read = hung_up_tty_read,
497 .write = hung_up_tty_write,
498 .poll = hung_up_tty_poll,
499 .unlocked_ioctl = hung_up_tty_ioctl,
500 .compat_ioctl = hung_up_tty_compat_ioctl,
501 .release = tty_release,
502};
503
504static DEFINE_SPINLOCK(redirect_lock);
505static struct file *redirect;
506
507/**
508 * tty_wakeup - request more data
509 * @tty: terminal
510 *
511 * Internal and external helper for wakeups of tty. This function
512 * informs the line discipline if present that the driver is ready
513 * to receive more output data.
514 */
515
516void tty_wakeup(struct tty_struct *tty)
517{
518 struct tty_ldisc *ld;
519
520 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
521 ld = tty_ldisc_ref(tty);
522 if (ld) {
523 if (ld->ops->write_wakeup)
524 ld->ops->write_wakeup(tty);
525 tty_ldisc_deref(ld);
526 }
527 }
528 wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
529}
530
531EXPORT_SYMBOL_GPL(tty_wakeup);
532
533/**
534 * __tty_hangup - actual handler for hangup events
535 * @work: tty device
536 *
537 * This can be called by the "eventd" kernel thread. That is process
538 * synchronous but doesn't hold any locks, so we need to make sure we
539 * have the appropriate locks for what we're doing.
540 *
541 * The hangup event clears any pending redirections onto the hung up
542 * device. It ensures future writes will error and it does the needed
543 * line discipline hangup and signal delivery. The tty object itself
544 * remains intact.
545 *
546 * Locking:
547 * BTM
548 * redirect lock for undoing redirection
549 * file list lock for manipulating list of ttys
550 * tty_ldisc_lock from called functions
551 * termios_mutex resetting termios data
552 * tasklist_lock to walk task list for hangup event
553 * ->siglock to protect ->signal/->sighand
554 */
555void __tty_hangup(struct tty_struct *tty)
556{
557 struct file *cons_filp = NULL;
558 struct file *filp, *f = NULL;
559 struct task_struct *p;
560 struct tty_file_private *priv;
561 int closecount = 0, n;
562 unsigned long flags;
563 int refs = 0;
564
565 if (!tty)
566 return;
567
568
569 spin_lock(&redirect_lock);
570 if (redirect && file_tty(redirect) == tty) {
571 f = redirect;
572 redirect = NULL;
573 }
574 spin_unlock(&redirect_lock);
575
576 tty_lock();
577
578 /* some functions below drop BTM, so we need this bit */
579 set_bit(TTY_HUPPING, &tty->flags);
580
581 /* inuse_filps is protected by the single tty lock,
582 this really needs to change if we want to flush the
583 workqueue with the lock held */
584 check_tty_count(tty, "tty_hangup");
585
586 spin_lock(&tty_files_lock);
587 /* This breaks for file handles being sent over AF_UNIX sockets ? */
588 list_for_each_entry(priv, &tty->tty_files, list) {
589 filp = priv->file;
590 if (filp->f_op->write == redirected_tty_write)
591 cons_filp = filp;
592 if (filp->f_op->write != tty_write)
593 continue;
594 closecount++;
595 __tty_fasync(-1, filp, 0); /* can't block */
596 filp->f_op = &hung_up_tty_fops;
597 }
598 spin_unlock(&tty_files_lock);
599
600 /*
601 * it drops BTM and thus races with reopen
602 * we protect the race by TTY_HUPPING
603 */
604 tty_ldisc_hangup(tty);
605
606 read_lock(&tasklist_lock);
607 if (tty->session) {
608 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
609 spin_lock_irq(&p->sighand->siglock);
610 if (p->signal->tty == tty) {
611 p->signal->tty = NULL;
612 /* We defer the dereferences outside fo
613 the tasklist lock */
614 refs++;
615 }
616 if (!p->signal->leader) {
617 spin_unlock_irq(&p->sighand->siglock);
618 continue;
619 }
620 __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
621 __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
622 put_pid(p->signal->tty_old_pgrp); /* A noop */
623 spin_lock_irqsave(&tty->ctrl_lock, flags);
624 if (tty->pgrp)
625 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
626 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
627 spin_unlock_irq(&p->sighand->siglock);
628 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
629 }
630 read_unlock(&tasklist_lock);
631
632 spin_lock_irqsave(&tty->ctrl_lock, flags);
633 clear_bit(TTY_THROTTLED, &tty->flags);
634 clear_bit(TTY_PUSH, &tty->flags);
635 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
636 put_pid(tty->session);
637 put_pid(tty->pgrp);
638 tty->session = NULL;
639 tty->pgrp = NULL;
640 tty->ctrl_status = 0;
641 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
642
643 /* Account for the p->signal references we killed */
644 while (refs--)
645 tty_kref_put(tty);
646
647 /*
648 * If one of the devices matches a console pointer, we
649 * cannot just call hangup() because that will cause
650 * tty->count and state->count to go out of sync.
651 * So we just call close() the right number of times.
652 */
653 if (cons_filp) {
654 if (tty->ops->close)
655 for (n = 0; n < closecount; n++)
656 tty->ops->close(tty, cons_filp);
657 } else if (tty->ops->hangup)
658 (tty->ops->hangup)(tty);
659 /*
660 * We don't want to have driver/ldisc interactions beyond
661 * the ones we did here. The driver layer expects no
662 * calls after ->hangup() from the ldisc side. However we
663 * can't yet guarantee all that.
664 */
665 set_bit(TTY_HUPPED, &tty->flags);
666 clear_bit(TTY_HUPPING, &tty->flags);
667 tty_ldisc_enable(tty);
668
669 tty_unlock();
670
671 if (f)
672 fput(f);
673}
674
675static void do_tty_hangup(struct work_struct *work)
676{
677 struct tty_struct *tty =
678 container_of(work, struct tty_struct, hangup_work);
679
680 __tty_hangup(tty);
681}
682
683/**
684 * tty_hangup - trigger a hangup event
685 * @tty: tty to hangup
686 *
687 * A carrier loss (virtual or otherwise) has occurred on this like
688 * schedule a hangup sequence to run after this event.
689 */
690
691void tty_hangup(struct tty_struct *tty)
692{
693#ifdef TTY_DEBUG_HANGUP
694 char buf[64];
695 printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
696#endif
697 schedule_work(&tty->hangup_work);
698}
699
700EXPORT_SYMBOL(tty_hangup);
701
702/**
703 * tty_vhangup - process vhangup
704 * @tty: tty to hangup
705 *
706 * The user has asked via system call for the terminal to be hung up.
707 * We do this synchronously so that when the syscall returns the process
708 * is complete. That guarantee is necessary for security reasons.
709 */
710
711void tty_vhangup(struct tty_struct *tty)
712{
713#ifdef TTY_DEBUG_HANGUP
714 char buf[64];
715
716 printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
717#endif
718 __tty_hangup(tty);
719}
720
721EXPORT_SYMBOL(tty_vhangup);
722
723
724/**
725 * tty_vhangup_self - process vhangup for own ctty
726 *
727 * Perform a vhangup on the current controlling tty
728 */
729
730void tty_vhangup_self(void)
731{
732 struct tty_struct *tty;
733
734 tty = get_current_tty();
735 if (tty) {
736 tty_vhangup(tty);
737 tty_kref_put(tty);
738 }
739}
740
741/**
742 * tty_hung_up_p - was tty hung up
743 * @filp: file pointer of tty
744 *
745 * Return true if the tty has been subject to a vhangup or a carrier
746 * loss
747 */
748
749int tty_hung_up_p(struct file *filp)
750{
751 return (filp->f_op == &hung_up_tty_fops);
752}
753
754EXPORT_SYMBOL(tty_hung_up_p);
755
756static void session_clear_tty(struct pid *session)
757{
758 struct task_struct *p;
759 do_each_pid_task(session, PIDTYPE_SID, p) {
760 proc_clear_tty(p);
761 } while_each_pid_task(session, PIDTYPE_SID, p);
762}
763
764/**
765 * disassociate_ctty - disconnect controlling tty
766 * @on_exit: true if exiting so need to "hang up" the session
767 *
768 * This function is typically called only by the session leader, when
769 * it wants to disassociate itself from its controlling tty.
770 *
771 * It performs the following functions:
772 * (1) Sends a SIGHUP and SIGCONT to the foreground process group
773 * (2) Clears the tty from being controlling the session
774 * (3) Clears the controlling tty for all processes in the
775 * session group.
776 *
777 * The argument on_exit is set to 1 if called when a process is
778 * exiting; it is 0 if called by the ioctl TIOCNOTTY.
779 *
780 * Locking:
781 * BTM is taken for hysterical raisins, and held when
782 * called from no_tty().
783 * tty_mutex is taken to protect tty
784 * ->siglock is taken to protect ->signal/->sighand
785 * tasklist_lock is taken to walk process list for sessions
786 * ->siglock is taken to protect ->signal/->sighand
787 */
788
789void disassociate_ctty(int on_exit)
790{
791 struct tty_struct *tty;
792
793 if (!current->signal->leader)
794 return;
795
796 tty = get_current_tty();
797 if (tty) {
798 struct pid *tty_pgrp = get_pid(tty->pgrp);
799 if (on_exit) {
800 if (tty->driver->type != TTY_DRIVER_TYPE_PTY)
801 tty_vhangup(tty);
802 }
803 tty_kref_put(tty);
804 if (tty_pgrp) {
805 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
806 if (!on_exit)
807 kill_pgrp(tty_pgrp, SIGCONT, on_exit);
808 put_pid(tty_pgrp);
809 }
810 } else if (on_exit) {
811 struct pid *old_pgrp;
812 spin_lock_irq(¤t->sighand->siglock);
813 old_pgrp = current->signal->tty_old_pgrp;
814 current->signal->tty_old_pgrp = NULL;
815 spin_unlock_irq(¤t->sighand->siglock);
816 if (old_pgrp) {
817 kill_pgrp(old_pgrp, SIGHUP, on_exit);
818 kill_pgrp(old_pgrp, SIGCONT, on_exit);
819 put_pid(old_pgrp);
820 }
821 return;
822 }
823
824 spin_lock_irq(¤t->sighand->siglock);
825 put_pid(current->signal->tty_old_pgrp);
826 current->signal->tty_old_pgrp = NULL;
827 spin_unlock_irq(¤t->sighand->siglock);
828
829 tty = get_current_tty();
830 if (tty) {
831 unsigned long flags;
832 spin_lock_irqsave(&tty->ctrl_lock, flags);
833 put_pid(tty->session);
834 put_pid(tty->pgrp);
835 tty->session = NULL;
836 tty->pgrp = NULL;
837 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
838 tty_kref_put(tty);
839 } else {
840#ifdef TTY_DEBUG_HANGUP
841 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
842 " = NULL", tty);
843#endif
844 }
845
846 /* Now clear signal->tty under the lock */
847 read_lock(&tasklist_lock);
848 session_clear_tty(task_session(current));
849 read_unlock(&tasklist_lock);
850}
851
852/**
853 *
854 * no_tty - Ensure the current process does not have a controlling tty
855 */
856void no_tty(void)
857{
858 /* FIXME: Review locking here. The tty_lock never covered any race
859 between a new association and proc_clear_tty but possible we need
860 to protect against this anyway */
861 struct task_struct *tsk = current;
862 disassociate_ctty(0);
863 proc_clear_tty(tsk);
864}
865
866
867/**
868 * stop_tty - propagate flow control
869 * @tty: tty to stop
870 *
871 * Perform flow control to the driver. For PTY/TTY pairs we
872 * must also propagate the TIOCKPKT status. May be called
873 * on an already stopped device and will not re-call the driver
874 * method.
875 *
876 * This functionality is used by both the line disciplines for
877 * halting incoming flow and by the driver. It may therefore be
878 * called from any context, may be under the tty atomic_write_lock
879 * but not always.
880 *
881 * Locking:
882 * Uses the tty control lock internally
883 */
884
885void stop_tty(struct tty_struct *tty)
886{
887 unsigned long flags;
888 spin_lock_irqsave(&tty->ctrl_lock, flags);
889 if (tty->stopped) {
890 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
891 return;
892 }
893 tty->stopped = 1;
894 if (tty->link && tty->link->packet) {
895 tty->ctrl_status &= ~TIOCPKT_START;
896 tty->ctrl_status |= TIOCPKT_STOP;
897 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
898 }
899 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
900 if (tty->ops->stop)
901 (tty->ops->stop)(tty);
902}
903
904EXPORT_SYMBOL(stop_tty);
905
906/**
907 * start_tty - propagate flow control
908 * @tty: tty to start
909 *
910 * Start a tty that has been stopped if at all possible. Perform
911 * any necessary wakeups and propagate the TIOCPKT status. If this
912 * is the tty was previous stopped and is being started then the
913 * driver start method is invoked and the line discipline woken.
914 *
915 * Locking:
916 * ctrl_lock
917 */
918
919void start_tty(struct tty_struct *tty)
920{
921 unsigned long flags;
922 spin_lock_irqsave(&tty->ctrl_lock, flags);
923 if (!tty->stopped || tty->flow_stopped) {
924 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
925 return;
926 }
927 tty->stopped = 0;
928 if (tty->link && tty->link->packet) {
929 tty->ctrl_status &= ~TIOCPKT_STOP;
930 tty->ctrl_status |= TIOCPKT_START;
931 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
932 }
933 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
934 if (tty->ops->start)
935 (tty->ops->start)(tty);
936 /* If we have a running line discipline it may need kicking */
937 tty_wakeup(tty);
938}
939
940EXPORT_SYMBOL(start_tty);
941
942/**
943 * tty_read - read method for tty device files
944 * @file: pointer to tty file
945 * @buf: user buffer
946 * @count: size of user buffer
947 * @ppos: unused
948 *
949 * Perform the read system call function on this terminal device. Checks
950 * for hung up devices before calling the line discipline method.
951 *
952 * Locking:
953 * Locks the line discipline internally while needed. Multiple
954 * read calls may be outstanding in parallel.
955 */
956
957static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
958 loff_t *ppos)
959{
960 int i;
961 struct inode *inode = file->f_path.dentry->d_inode;
962 struct tty_struct *tty = file_tty(file);
963 struct tty_ldisc *ld;
964
965 if (tty_paranoia_check(tty, inode, "tty_read"))
966 return -EIO;
967 if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
968 return -EIO;
969
970 /* We want to wait for the line discipline to sort out in this
971 situation */
972 ld = tty_ldisc_ref_wait(tty);
973 if (ld->ops->read)
974 i = (ld->ops->read)(tty, file, buf, count);
975 else
976 i = -EIO;
977 tty_ldisc_deref(ld);
978 if (i > 0)
979 inode->i_atime = current_fs_time(inode->i_sb);
980 return i;
981}
982
983void tty_write_unlock(struct tty_struct *tty)
984 __releases(&tty->atomic_write_lock)
985{
986 mutex_unlock(&tty->atomic_write_lock);
987 wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
988}
989
990int tty_write_lock(struct tty_struct *tty, int ndelay)
991 __acquires(&tty->atomic_write_lock)
992{
993 if (!mutex_trylock(&tty->atomic_write_lock)) {
994 if (ndelay)
995 return -EAGAIN;
996 if (mutex_lock_interruptible(&tty->atomic_write_lock))
997 return -ERESTARTSYS;
998 }
999 return 0;
1000}
1001
1002/*
1003 * Split writes up in sane blocksizes to avoid
1004 * denial-of-service type attacks
1005 */
1006static inline ssize_t do_tty_write(
1007 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1008 struct tty_struct *tty,
1009 struct file *file,
1010 const char __user *buf,
1011 size_t count)
1012{
1013 ssize_t ret, written = 0;
1014 unsigned int chunk;
1015
1016 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1017 if (ret < 0)
1018 return ret;
1019
1020 /*
1021 * We chunk up writes into a temporary buffer. This
1022 * simplifies low-level drivers immensely, since they
1023 * don't have locking issues and user mode accesses.
1024 *
1025 * But if TTY_NO_WRITE_SPLIT is set, we should use a
1026 * big chunk-size..
1027 *
1028 * The default chunk-size is 2kB, because the NTTY
1029 * layer has problems with bigger chunks. It will
1030 * claim to be able to handle more characters than
1031 * it actually does.
1032 *
1033 * FIXME: This can probably go away now except that 64K chunks
1034 * are too likely to fail unless switched to vmalloc...
1035 */
1036 chunk = 2048;
1037 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1038 chunk = 65536;
1039 if (count < chunk)
1040 chunk = count;
1041
1042 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1043 if (tty->write_cnt < chunk) {
1044 unsigned char *buf_chunk;
1045
1046 if (chunk < 1024)
1047 chunk = 1024;
1048
1049 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1050 if (!buf_chunk) {
1051 ret = -ENOMEM;
1052 goto out;
1053 }
1054 kfree(tty->write_buf);
1055 tty->write_cnt = chunk;
1056 tty->write_buf = buf_chunk;
1057 }
1058
1059 /* Do the write .. */
1060 for (;;) {
1061 size_t size = count;
1062 if (size > chunk)
1063 size = chunk;
1064 ret = -EFAULT;
1065 if (copy_from_user(tty->write_buf, buf, size))
1066 break;
1067 ret = write(tty, file, tty->write_buf, size);
1068 if (ret <= 0)
1069 break;
1070 written += ret;
1071 buf += ret;
1072 count -= ret;
1073 if (!count)
1074 break;
1075 ret = -ERESTARTSYS;
1076 if (signal_pending(current))
1077 break;
1078 cond_resched();
1079 }
1080 if (written) {
1081 struct inode *inode = file->f_path.dentry->d_inode;
1082 inode->i_mtime = current_fs_time(inode->i_sb);
1083 ret = written;
1084 }
1085out:
1086 tty_write_unlock(tty);
1087 return ret;
1088}
1089
1090/**
1091 * tty_write_message - write a message to a certain tty, not just the console.
1092 * @tty: the destination tty_struct
1093 * @msg: the message to write
1094 *
1095 * This is used for messages that need to be redirected to a specific tty.
1096 * We don't put it into the syslog queue right now maybe in the future if
1097 * really needed.
1098 *
1099 * We must still hold the BTM and test the CLOSING flag for the moment.
1100 */
1101
1102void tty_write_message(struct tty_struct *tty, char *msg)
1103{
1104 if (tty) {
1105 mutex_lock(&tty->atomic_write_lock);
1106 tty_lock();
1107 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1108 tty_unlock();
1109 tty->ops->write(tty, msg, strlen(msg));
1110 } else
1111 tty_unlock();
1112 tty_write_unlock(tty);
1113 }
1114 return;
1115}
1116
1117
1118/**
1119 * tty_write - write method for tty device file
1120 * @file: tty file pointer
1121 * @buf: user data to write
1122 * @count: bytes to write
1123 * @ppos: unused
1124 *
1125 * Write data to a tty device via the line discipline.
1126 *
1127 * Locking:
1128 * Locks the line discipline as required
1129 * Writes to the tty driver are serialized by the atomic_write_lock
1130 * and are then processed in chunks to the device. The line discipline
1131 * write method will not be invoked in parallel for each device.
1132 */
1133
1134static ssize_t tty_write(struct file *file, const char __user *buf,
1135 size_t count, loff_t *ppos)
1136{
1137 struct inode *inode = file->f_path.dentry->d_inode;
1138 struct tty_struct *tty = file_tty(file);
1139 struct tty_ldisc *ld;
1140 ssize_t ret;
1141
1142 if (tty_paranoia_check(tty, inode, "tty_write"))
1143 return -EIO;
1144 if (!tty || !tty->ops->write ||
1145 (test_bit(TTY_IO_ERROR, &tty->flags)))
1146 return -EIO;
1147 /* Short term debug to catch buggy drivers */
1148 if (tty->ops->write_room == NULL)
1149 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1150 tty->driver->name);
1151 ld = tty_ldisc_ref_wait(tty);
1152 if (!ld->ops->write)
1153 ret = -EIO;
1154 else
1155 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1156 tty_ldisc_deref(ld);
1157 return ret;
1158}
1159
1160ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1161 size_t count, loff_t *ppos)
1162{
1163 struct file *p = NULL;
1164
1165 spin_lock(&redirect_lock);
1166 if (redirect) {
1167 get_file(redirect);
1168 p = redirect;
1169 }
1170 spin_unlock(&redirect_lock);
1171
1172 if (p) {
1173 ssize_t res;
1174 res = vfs_write(p, buf, count, &p->f_pos);
1175 fput(p);
1176 return res;
1177 }
1178 return tty_write(file, buf, count, ppos);
1179}
1180
1181static char ptychar[] = "pqrstuvwxyzabcde";
1182
1183/**
1184 * pty_line_name - generate name for a pty
1185 * @driver: the tty driver in use
1186 * @index: the minor number
1187 * @p: output buffer of at least 6 bytes
1188 *
1189 * Generate a name from a driver reference and write it to the output
1190 * buffer.
1191 *
1192 * Locking: None
1193 */
1194static void pty_line_name(struct tty_driver *driver, int index, char *p)
1195{
1196 int i = index + driver->name_base;
1197 /* ->name is initialized to "ttyp", but "tty" is expected */
1198 sprintf(p, "%s%c%x",
1199 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1200 ptychar[i >> 4 & 0xf], i & 0xf);
1201}
1202
1203/**
1204 * tty_line_name - generate name for a tty
1205 * @driver: the tty driver in use
1206 * @index: the minor number
1207 * @p: output buffer of at least 7 bytes
1208 *
1209 * Generate a name from a driver reference and write it to the output
1210 * buffer.
1211 *
1212 * Locking: None
1213 */
1214static void tty_line_name(struct tty_driver *driver, int index, char *p)
1215{
1216 sprintf(p, "%s%d", driver->name, index + driver->name_base);
1217}
1218
1219/**
1220 * tty_driver_lookup_tty() - find an existing tty, if any
1221 * @driver: the driver for the tty
1222 * @idx: the minor number
1223 *
1224 * Return the tty, if found or ERR_PTR() otherwise.
1225 *
1226 * Locking: tty_mutex must be held. If tty is found, the mutex must
1227 * be held until the 'fast-open' is also done. Will change once we
1228 * have refcounting in the driver and per driver locking
1229 */
1230static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1231 struct inode *inode, int idx)
1232{
1233 if (driver->ops->lookup)
1234 return driver->ops->lookup(driver, inode, idx);
1235
1236 return driver->ttys[idx];
1237}
1238
1239/**
1240 * tty_init_termios - helper for termios setup
1241 * @tty: the tty to set up
1242 *
1243 * Initialise the termios structures for this tty. Thus runs under
1244 * the tty_mutex currently so we can be relaxed about ordering.
1245 */
1246
1247int tty_init_termios(struct tty_struct *tty)
1248{
1249 struct ktermios *tp;
1250 int idx = tty->index;
1251
1252 tp = tty->driver->termios[idx];
1253 if (tp == NULL) {
1254 tp = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
1255 if (tp == NULL)
1256 return -ENOMEM;
1257 memcpy(tp, &tty->driver->init_termios,
1258 sizeof(struct ktermios));
1259 tty->driver->termios[idx] = tp;
1260 }
1261 tty->termios = tp;
1262 tty->termios_locked = tp + 1;
1263
1264 /* Compatibility until drivers always set this */
1265 tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1266 tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1267 return 0;
1268}
1269EXPORT_SYMBOL_GPL(tty_init_termios);
1270
1271int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1272{
1273 int ret = tty_init_termios(tty);
1274 if (ret)
1275 return ret;
1276
1277 tty_driver_kref_get(driver);
1278 tty->count++;
1279 driver->ttys[tty->index] = tty;
1280 return 0;
1281}
1282EXPORT_SYMBOL_GPL(tty_standard_install);
1283
1284/**
1285 * tty_driver_install_tty() - install a tty entry in the driver
1286 * @driver: the driver for the tty
1287 * @tty: the tty
1288 *
1289 * Install a tty object into the driver tables. The tty->index field
1290 * will be set by the time this is called. This method is responsible
1291 * for ensuring any need additional structures are allocated and
1292 * configured.
1293 *
1294 * Locking: tty_mutex for now
1295 */
1296static int tty_driver_install_tty(struct tty_driver *driver,
1297 struct tty_struct *tty)
1298{
1299 return driver->ops->install ? driver->ops->install(driver, tty) :
1300 tty_standard_install(driver, tty);
1301}
1302
1303/**
1304 * tty_driver_remove_tty() - remove a tty from the driver tables
1305 * @driver: the driver for the tty
1306 * @idx: the minor number
1307 *
1308 * Remvoe a tty object from the driver tables. The tty->index field
1309 * will be set by the time this is called.
1310 *
1311 * Locking: tty_mutex for now
1312 */
1313void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1314{
1315 if (driver->ops->remove)
1316 driver->ops->remove(driver, tty);
1317 else
1318 driver->ttys[tty->index] = NULL;
1319}
1320
1321/*
1322 * tty_reopen() - fast re-open of an open tty
1323 * @tty - the tty to open
1324 *
1325 * Return 0 on success, -errno on error.
1326 *
1327 * Locking: tty_mutex must be held from the time the tty was found
1328 * till this open completes.
1329 */
1330static int tty_reopen(struct tty_struct *tty)
1331{
1332 struct tty_driver *driver = tty->driver;
1333
1334 if (test_bit(TTY_CLOSING, &tty->flags) ||
1335 test_bit(TTY_HUPPING, &tty->flags) ||
1336 test_bit(TTY_LDISC_CHANGING, &tty->flags))
1337 return -EIO;
1338
1339 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1340 driver->subtype == PTY_TYPE_MASTER) {
1341 /*
1342 * special case for PTY masters: only one open permitted,
1343 * and the slave side open count is incremented as well.
1344 */
1345 if (tty->count)
1346 return -EIO;
1347
1348 tty->link->count++;
1349 }
1350 tty->count++;
1351
1352 mutex_lock(&tty->ldisc_mutex);
1353 WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1354 mutex_unlock(&tty->ldisc_mutex);
1355
1356 return 0;
1357}
1358
1359/**
1360 * tty_init_dev - initialise a tty device
1361 * @driver: tty driver we are opening a device on
1362 * @idx: device index
1363 * @ret_tty: returned tty structure
1364 *
1365 * Prepare a tty device. This may not be a "new" clean device but
1366 * could also be an active device. The pty drivers require special
1367 * handling because of this.
1368 *
1369 * Locking:
1370 * The function is called under the tty_mutex, which
1371 * protects us from the tty struct or driver itself going away.
1372 *
1373 * On exit the tty device has the line discipline attached and
1374 * a reference count of 1. If a pair was created for pty/tty use
1375 * and the other was a pty master then it too has a reference count of 1.
1376 *
1377 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1378 * failed open. The new code protects the open with a mutex, so it's
1379 * really quite straightforward. The mutex locking can probably be
1380 * relaxed for the (most common) case of reopening a tty.
1381 */
1382
1383struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1384{
1385 struct tty_struct *tty;
1386 int retval;
1387
1388 /*
1389 * First time open is complex, especially for PTY devices.
1390 * This code guarantees that either everything succeeds and the
1391 * TTY is ready for operation, or else the table slots are vacated
1392 * and the allocated memory released. (Except that the termios
1393 * and locked termios may be retained.)
1394 */
1395
1396 if (!try_module_get(driver->owner))
1397 return ERR_PTR(-ENODEV);
1398
1399 tty = alloc_tty_struct();
1400 if (!tty) {
1401 retval = -ENOMEM;
1402 goto err_module_put;
1403 }
1404 initialize_tty_struct(tty, driver, idx);
1405
1406 retval = tty_driver_install_tty(driver, tty);
1407 if (retval < 0)
1408 goto err_deinit_tty;
1409
1410 /*
1411 * Structures all installed ... call the ldisc open routines.
1412 * If we fail here just call release_tty to clean up. No need
1413 * to decrement the use counts, as release_tty doesn't care.
1414 */
1415 retval = tty_ldisc_setup(tty, tty->link);
1416 if (retval)
1417 goto err_release_tty;
1418 return tty;
1419
1420err_deinit_tty:
1421 deinitialize_tty_struct(tty);
1422 free_tty_struct(tty);
1423err_module_put:
1424 module_put(driver->owner);
1425 return ERR_PTR(retval);
1426
1427 /* call the tty release_tty routine to clean out this slot */
1428err_release_tty:
1429 printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1430 "clearing slot %d\n", idx);
1431 release_tty(tty, idx);
1432 return ERR_PTR(retval);
1433}
1434
1435void tty_free_termios(struct tty_struct *tty)
1436{
1437 struct ktermios *tp;
1438 int idx = tty->index;
1439 /* Kill this flag and push into drivers for locking etc */
1440 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1441 /* FIXME: Locking on ->termios array */
1442 tp = tty->termios;
1443 tty->driver->termios[idx] = NULL;
1444 kfree(tp);
1445 }
1446}
1447EXPORT_SYMBOL(tty_free_termios);
1448
1449void tty_shutdown(struct tty_struct *tty)
1450{
1451 tty_driver_remove_tty(tty->driver, tty);
1452 tty_free_termios(tty);
1453}
1454EXPORT_SYMBOL(tty_shutdown);
1455
1456/**
1457 * release_one_tty - release tty structure memory
1458 * @kref: kref of tty we are obliterating
1459 *
1460 * Releases memory associated with a tty structure, and clears out the
1461 * driver table slots. This function is called when a device is no longer
1462 * in use. It also gets called when setup of a device fails.
1463 *
1464 * Locking:
1465 * tty_mutex - sometimes only
1466 * takes the file list lock internally when working on the list
1467 * of ttys that the driver keeps.
1468 *
1469 * This method gets called from a work queue so that the driver private
1470 * cleanup ops can sleep (needed for USB at least)
1471 */
1472static void release_one_tty(struct work_struct *work)
1473{
1474 struct tty_struct *tty =
1475 container_of(work, struct tty_struct, hangup_work);
1476 struct tty_driver *driver = tty->driver;
1477
1478 if (tty->ops->cleanup)
1479 tty->ops->cleanup(tty);
1480
1481 tty->magic = 0;
1482 tty_driver_kref_put(driver);
1483 module_put(driver->owner);
1484
1485 spin_lock(&tty_files_lock);
1486 list_del_init(&tty->tty_files);
1487 spin_unlock(&tty_files_lock);
1488
1489 put_pid(tty->pgrp);
1490 put_pid(tty->session);
1491 free_tty_struct(tty);
1492}
1493
1494static void queue_release_one_tty(struct kref *kref)
1495{
1496 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1497
1498 if (tty->ops->shutdown)
1499 tty->ops->shutdown(tty);
1500 else
1501 tty_shutdown(tty);
1502
1503 /* The hangup queue is now free so we can reuse it rather than
1504 waste a chunk of memory for each port */
1505 INIT_WORK(&tty->hangup_work, release_one_tty);
1506 schedule_work(&tty->hangup_work);
1507}
1508
1509/**
1510 * tty_kref_put - release a tty kref
1511 * @tty: tty device
1512 *
1513 * Release a reference to a tty device and if need be let the kref
1514 * layer destruct the object for us
1515 */
1516
1517void tty_kref_put(struct tty_struct *tty)
1518{
1519 if (tty)
1520 kref_put(&tty->kref, queue_release_one_tty);
1521}
1522EXPORT_SYMBOL(tty_kref_put);
1523
1524/**
1525 * release_tty - release tty structure memory
1526 *
1527 * Release both @tty and a possible linked partner (think pty pair),
1528 * and decrement the refcount of the backing module.
1529 *
1530 * Locking:
1531 * tty_mutex - sometimes only
1532 * takes the file list lock internally when working on the list
1533 * of ttys that the driver keeps.
1534 * FIXME: should we require tty_mutex is held here ??
1535 *
1536 */
1537static void release_tty(struct tty_struct *tty, int idx)
1538{
1539 /* This should always be true but check for the moment */
1540 WARN_ON(tty->index != idx);
1541
1542 if (tty->link)
1543 tty_kref_put(tty->link);
1544 tty_kref_put(tty);
1545}
1546
1547/**
1548 * tty_release_checks - check a tty before real release
1549 * @tty: tty to check
1550 * @o_tty: link of @tty (if any)
1551 * @idx: index of the tty
1552 *
1553 * Performs some paranoid checking before true release of the @tty.
1554 * This is a no-op unless TTY_PARANOIA_CHECK is defined.
1555 */
1556static int tty_release_checks(struct tty_struct *tty, struct tty_struct *o_tty,
1557 int idx)
1558{
1559#ifdef TTY_PARANOIA_CHECK
1560 if (idx < 0 || idx >= tty->driver->num) {
1561 printk(KERN_DEBUG "%s: bad idx when trying to free (%s)\n",
1562 __func__, tty->name);
1563 return -1;
1564 }
1565
1566 /* not much to check for devpts */
1567 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1568 return 0;
1569
1570 if (tty != tty->driver->ttys[idx]) {
1571 printk(KERN_DEBUG "%s: driver.table[%d] not tty for (%s)\n",
1572 __func__, idx, tty->name);
1573 return -1;
1574 }
1575 if (tty->termios != tty->driver->termios[idx]) {
1576 printk(KERN_DEBUG "%s: driver.termios[%d] not termios for (%s)\n",
1577 __func__, idx, tty->name);
1578 return -1;
1579 }
1580 if (tty->driver->other) {
1581 if (o_tty != tty->driver->other->ttys[idx]) {
1582 printk(KERN_DEBUG "%s: other->table[%d] not o_tty for (%s)\n",
1583 __func__, idx, tty->name);
1584 return -1;
1585 }
1586 if (o_tty->termios != tty->driver->other->termios[idx]) {
1587 printk(KERN_DEBUG "%s: other->termios[%d] not o_termios for (%s)\n",
1588 __func__, idx, tty->name);
1589 return -1;
1590 }
1591 if (o_tty->link != tty) {
1592 printk(KERN_DEBUG "%s: bad pty pointers\n", __func__);
1593 return -1;
1594 }
1595 }
1596#endif
1597 return 0;
1598}
1599
1600/**
1601 * tty_release - vfs callback for close
1602 * @inode: inode of tty
1603 * @filp: file pointer for handle to tty
1604 *
1605 * Called the last time each file handle is closed that references
1606 * this tty. There may however be several such references.
1607 *
1608 * Locking:
1609 * Takes bkl. See tty_release_dev
1610 *
1611 * Even releasing the tty structures is a tricky business.. We have
1612 * to be very careful that the structures are all released at the
1613 * same time, as interrupts might otherwise get the wrong pointers.
1614 *
1615 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1616 * lead to double frees or releasing memory still in use.
1617 */
1618
1619int tty_release(struct inode *inode, struct file *filp)
1620{
1621 struct tty_struct *tty = file_tty(filp);
1622 struct tty_struct *o_tty;
1623 int pty_master, tty_closing, o_tty_closing, do_sleep;
1624 int devpts;
1625 int idx;
1626 char buf[64];
1627
1628 if (tty_paranoia_check(tty, inode, __func__))
1629 return 0;
1630
1631 tty_lock();
1632 check_tty_count(tty, __func__);
1633
1634 __tty_fasync(-1, filp, 0);
1635
1636 idx = tty->index;
1637 pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1638 tty->driver->subtype == PTY_TYPE_MASTER);
1639 devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1640 o_tty = tty->link;
1641
1642 if (tty_release_checks(tty, o_tty, idx)) {
1643 tty_unlock();
1644 return 0;
1645 }
1646
1647#ifdef TTY_DEBUG_HANGUP
1648 printk(KERN_DEBUG "%s: %s (tty count=%d)...\n", __func__,
1649 tty_name(tty, buf), tty->count);
1650#endif
1651
1652 if (tty->ops->close)
1653 tty->ops->close(tty, filp);
1654
1655 tty_unlock();
1656 /*
1657 * Sanity check: if tty->count is going to zero, there shouldn't be
1658 * any waiters on tty->read_wait or tty->write_wait. We test the
1659 * wait queues and kick everyone out _before_ actually starting to
1660 * close. This ensures that we won't block while releasing the tty
1661 * structure.
1662 *
1663 * The test for the o_tty closing is necessary, since the master and
1664 * slave sides may close in any order. If the slave side closes out
1665 * first, its count will be one, since the master side holds an open.
1666 * Thus this test wouldn't be triggered at the time the slave closes,
1667 * so we do it now.
1668 *
1669 * Note that it's possible for the tty to be opened again while we're
1670 * flushing out waiters. By recalculating the closing flags before
1671 * each iteration we avoid any problems.
1672 */
1673 while (1) {
1674 /* Guard against races with tty->count changes elsewhere and
1675 opens on /dev/tty */
1676
1677 mutex_lock(&tty_mutex);
1678 tty_lock();
1679 tty_closing = tty->count <= 1;
1680 o_tty_closing = o_tty &&
1681 (o_tty->count <= (pty_master ? 1 : 0));
1682 do_sleep = 0;
1683
1684 if (tty_closing) {
1685 if (waitqueue_active(&tty->read_wait)) {
1686 wake_up_poll(&tty->read_wait, POLLIN);
1687 do_sleep++;
1688 }
1689 if (waitqueue_active(&tty->write_wait)) {
1690 wake_up_poll(&tty->write_wait, POLLOUT);
1691 do_sleep++;
1692 }
1693 }
1694 if (o_tty_closing) {
1695 if (waitqueue_active(&o_tty->read_wait)) {
1696 wake_up_poll(&o_tty->read_wait, POLLIN);
1697 do_sleep++;
1698 }
1699 if (waitqueue_active(&o_tty->write_wait)) {
1700 wake_up_poll(&o_tty->write_wait, POLLOUT);
1701 do_sleep++;
1702 }
1703 }
1704 if (!do_sleep)
1705 break;
1706
1707 printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
1708 __func__, tty_name(tty, buf));
1709 tty_unlock();
1710 mutex_unlock(&tty_mutex);
1711 schedule();
1712 }
1713
1714 /*
1715 * The closing flags are now consistent with the open counts on
1716 * both sides, and we've completed the last operation that could
1717 * block, so it's safe to proceed with closing.
1718 */
1719 if (pty_master) {
1720 if (--o_tty->count < 0) {
1721 printk(KERN_WARNING "%s: bad pty slave count (%d) for %s\n",
1722 __func__, o_tty->count, tty_name(o_tty, buf));
1723 o_tty->count = 0;
1724 }
1725 }
1726 if (--tty->count < 0) {
1727 printk(KERN_WARNING "%s: bad tty->count (%d) for %s\n",
1728 __func__, tty->count, tty_name(tty, buf));
1729 tty->count = 0;
1730 }
1731
1732 /*
1733 * We've decremented tty->count, so we need to remove this file
1734 * descriptor off the tty->tty_files list; this serves two
1735 * purposes:
1736 * - check_tty_count sees the correct number of file descriptors
1737 * associated with this tty.
1738 * - do_tty_hangup no longer sees this file descriptor as
1739 * something that needs to be handled for hangups.
1740 */
1741 tty_del_file(filp);
1742
1743 /*
1744 * Perform some housekeeping before deciding whether to return.
1745 *
1746 * Set the TTY_CLOSING flag if this was the last open. In the
1747 * case of a pty we may have to wait around for the other side
1748 * to close, and TTY_CLOSING makes sure we can't be reopened.
1749 */
1750 if (tty_closing)
1751 set_bit(TTY_CLOSING, &tty->flags);
1752 if (o_tty_closing)
1753 set_bit(TTY_CLOSING, &o_tty->flags);
1754
1755 /*
1756 * If _either_ side is closing, make sure there aren't any
1757 * processes that still think tty or o_tty is their controlling
1758 * tty.
1759 */
1760 if (tty_closing || o_tty_closing) {
1761 read_lock(&tasklist_lock);
1762 session_clear_tty(tty->session);
1763 if (o_tty)
1764 session_clear_tty(o_tty->session);
1765 read_unlock(&tasklist_lock);
1766 }
1767
1768 mutex_unlock(&tty_mutex);
1769
1770 /* check whether both sides are closing ... */
1771 if (!tty_closing || (o_tty && !o_tty_closing)) {
1772 tty_unlock();
1773 return 0;
1774 }
1775
1776#ifdef TTY_DEBUG_HANGUP
1777 printk(KERN_DEBUG "%s: freeing tty structure...\n", __func__);
1778#endif
1779 /*
1780 * Ask the line discipline code to release its structures
1781 */
1782 tty_ldisc_release(tty, o_tty);
1783 /*
1784 * The release_tty function takes care of the details of clearing
1785 * the slots and preserving the termios structure.
1786 */
1787 release_tty(tty, idx);
1788
1789 /* Make this pty number available for reallocation */
1790 if (devpts)
1791 devpts_kill_index(inode, idx);
1792 tty_unlock();
1793 return 0;
1794}
1795
1796/**
1797 * tty_open_current_tty - get tty of current task for open
1798 * @device: device number
1799 * @filp: file pointer to tty
1800 * @return: tty of the current task iff @device is /dev/tty
1801 *
1802 * We cannot return driver and index like for the other nodes because
1803 * devpts will not work then. It expects inodes to be from devpts FS.
1804 *
1805 * We need to move to returning a refcounted object from all the lookup
1806 * paths including this one.
1807 */
1808static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1809{
1810 struct tty_struct *tty;
1811
1812 if (device != MKDEV(TTYAUX_MAJOR, 0))
1813 return NULL;
1814
1815 tty = get_current_tty();
1816 if (!tty)
1817 return ERR_PTR(-ENXIO);
1818
1819 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1820 /* noctty = 1; */
1821 tty_kref_put(tty);
1822 /* FIXME: we put a reference and return a TTY! */
1823 /* This is only safe because the caller holds tty_mutex */
1824 return tty;
1825}
1826
1827/**
1828 * tty_lookup_driver - lookup a tty driver for a given device file
1829 * @device: device number
1830 * @filp: file pointer to tty
1831 * @noctty: set if the device should not become a controlling tty
1832 * @index: index for the device in the @return driver
1833 * @return: driver for this inode (with increased refcount)
1834 *
1835 * If @return is not erroneous, the caller is responsible to decrement the
1836 * refcount by tty_driver_kref_put.
1837 *
1838 * Locking: tty_mutex protects get_tty_driver
1839 */
1840static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1841 int *noctty, int *index)
1842{
1843 struct tty_driver *driver;
1844
1845 switch (device) {
1846#ifdef CONFIG_VT
1847 case MKDEV(TTY_MAJOR, 0): {
1848 extern struct tty_driver *console_driver;
1849 driver = tty_driver_kref_get(console_driver);
1850 *index = fg_console;
1851 *noctty = 1;
1852 break;
1853 }
1854#endif
1855 case MKDEV(TTYAUX_MAJOR, 1): {
1856 struct tty_driver *console_driver = console_device(index);
1857 if (console_driver) {
1858 driver = tty_driver_kref_get(console_driver);
1859 if (driver) {
1860 /* Don't let /dev/console block */
1861 filp->f_flags |= O_NONBLOCK;
1862 *noctty = 1;
1863 break;
1864 }
1865 }
1866 return ERR_PTR(-ENODEV);
1867 }
1868 default:
1869 driver = get_tty_driver(device, index);
1870 if (!driver)
1871 return ERR_PTR(-ENODEV);
1872 break;
1873 }
1874 return driver;
1875}
1876
1877/**
1878 * tty_open - open a tty device
1879 * @inode: inode of device file
1880 * @filp: file pointer to tty
1881 *
1882 * tty_open and tty_release keep up the tty count that contains the
1883 * number of opens done on a tty. We cannot use the inode-count, as
1884 * different inodes might point to the same tty.
1885 *
1886 * Open-counting is needed for pty masters, as well as for keeping
1887 * track of serial lines: DTR is dropped when the last close happens.
1888 * (This is not done solely through tty->count, now. - Ted 1/27/92)
1889 *
1890 * The termios state of a pty is reset on first open so that
1891 * settings don't persist across reuse.
1892 *
1893 * Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
1894 * tty->count should protect the rest.
1895 * ->siglock protects ->signal/->sighand
1896 */
1897
1898static int tty_open(struct inode *inode, struct file *filp)
1899{
1900 struct tty_struct *tty;
1901 int noctty, retval;
1902 struct tty_driver *driver = NULL;
1903 int index;
1904 dev_t device = inode->i_rdev;
1905 unsigned saved_flags = filp->f_flags;
1906
1907 nonseekable_open(inode, filp);
1908
1909retry_open:
1910 retval = tty_alloc_file(filp);
1911 if (retval)
1912 return -ENOMEM;
1913
1914 noctty = filp->f_flags & O_NOCTTY;
1915 index = -1;
1916 retval = 0;
1917
1918 mutex_lock(&tty_mutex);
1919 tty_lock();
1920
1921 tty = tty_open_current_tty(device, filp);
1922 if (IS_ERR(tty)) {
1923 retval = PTR_ERR(tty);
1924 goto err_unlock;
1925 } else if (!tty) {
1926 driver = tty_lookup_driver(device, filp, &noctty, &index);
1927 if (IS_ERR(driver)) {
1928 retval = PTR_ERR(driver);
1929 goto err_unlock;
1930 }
1931
1932 /* check whether we're reopening an existing tty */
1933 tty = tty_driver_lookup_tty(driver, inode, index);
1934 if (IS_ERR(tty)) {
1935 retval = PTR_ERR(tty);
1936 goto err_unlock;
1937 }
1938 }
1939
1940 if (tty) {
1941 retval = tty_reopen(tty);
1942 if (retval)
1943 tty = ERR_PTR(retval);
1944 } else
1945 tty = tty_init_dev(driver, index);
1946
1947 mutex_unlock(&tty_mutex);
1948 if (driver)
1949 tty_driver_kref_put(driver);
1950 if (IS_ERR(tty)) {
1951 tty_unlock();
1952 retval = PTR_ERR(tty);
1953 goto err_file;
1954 }
1955
1956 tty_add_file(tty, filp);
1957
1958 check_tty_count(tty, __func__);
1959 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1960 tty->driver->subtype == PTY_TYPE_MASTER)
1961 noctty = 1;
1962#ifdef TTY_DEBUG_HANGUP
1963 printk(KERN_DEBUG "%s: opening %s...\n", __func__, tty->name);
1964#endif
1965 if (tty->ops->open)
1966 retval = tty->ops->open(tty, filp);
1967 else
1968 retval = -ENODEV;
1969 filp->f_flags = saved_flags;
1970
1971 if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
1972 !capable(CAP_SYS_ADMIN))
1973 retval = -EBUSY;
1974
1975 if (retval) {
1976#ifdef TTY_DEBUG_HANGUP
1977 printk(KERN_DEBUG "%s: error %d in opening %s...\n", __func__,
1978 retval, tty->name);
1979#endif
1980 tty_unlock(); /* need to call tty_release without BTM */
1981 tty_release(inode, filp);
1982 if (retval != -ERESTARTSYS)
1983 return retval;
1984
1985 if (signal_pending(current))
1986 return retval;
1987
1988 schedule();
1989 /*
1990 * Need to reset f_op in case a hangup happened.
1991 */
1992 tty_lock();
1993 if (filp->f_op == &hung_up_tty_fops)
1994 filp->f_op = &tty_fops;
1995 tty_unlock();
1996 goto retry_open;
1997 }
1998 tty_unlock();
1999
2000
2001 mutex_lock(&tty_mutex);
2002 tty_lock();
2003 spin_lock_irq(¤t->sighand->siglock);
2004 if (!noctty &&
2005 current->signal->leader &&
2006 !current->signal->tty &&
2007 tty->session == NULL)
2008 __proc_set_tty(current, tty);
2009 spin_unlock_irq(¤t->sighand->siglock);
2010 tty_unlock();
2011 mutex_unlock(&tty_mutex);
2012 return 0;
2013err_unlock:
2014 tty_unlock();
2015 mutex_unlock(&tty_mutex);
2016 /* after locks to avoid deadlock */
2017 if (!IS_ERR_OR_NULL(driver))
2018 tty_driver_kref_put(driver);
2019err_file:
2020 tty_free_file(filp);
2021 return retval;
2022}
2023
2024
2025
2026/**
2027 * tty_poll - check tty status
2028 * @filp: file being polled
2029 * @wait: poll wait structures to update
2030 *
2031 * Call the line discipline polling method to obtain the poll
2032 * status of the device.
2033 *
2034 * Locking: locks called line discipline but ldisc poll method
2035 * may be re-entered freely by other callers.
2036 */
2037
2038static unsigned int tty_poll(struct file *filp, poll_table *wait)
2039{
2040 struct tty_struct *tty = file_tty(filp);
2041 struct tty_ldisc *ld;
2042 int ret = 0;
2043
2044 if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2045 return 0;
2046
2047 ld = tty_ldisc_ref_wait(tty);
2048 if (ld->ops->poll)
2049 ret = (ld->ops->poll)(tty, filp, wait);
2050 tty_ldisc_deref(ld);
2051 return ret;
2052}
2053
2054static int __tty_fasync(int fd, struct file *filp, int on)
2055{
2056 struct tty_struct *tty = file_tty(filp);
2057 unsigned long flags;
2058 int retval = 0;
2059
2060 if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2061 goto out;
2062
2063 retval = fasync_helper(fd, filp, on, &tty->fasync);
2064 if (retval <= 0)
2065 goto out;
2066
2067 if (on) {
2068 enum pid_type type;
2069 struct pid *pid;
2070 if (!waitqueue_active(&tty->read_wait))
2071 tty->minimum_to_wake = 1;
2072 spin_lock_irqsave(&tty->ctrl_lock, flags);
2073 if (tty->pgrp) {
2074 pid = tty->pgrp;
2075 type = PIDTYPE_PGID;
2076 } else {
2077 pid = task_pid(current);
2078 type = PIDTYPE_PID;
2079 }
2080 get_pid(pid);
2081 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2082 retval = __f_setown(filp, pid, type, 0);
2083 put_pid(pid);
2084 if (retval)
2085 goto out;
2086 } else {
2087 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2088 tty->minimum_to_wake = N_TTY_BUF_SIZE;
2089 }
2090 retval = 0;
2091out:
2092 return retval;
2093}
2094
2095static int tty_fasync(int fd, struct file *filp, int on)
2096{
2097 int retval;
2098 tty_lock();
2099 retval = __tty_fasync(fd, filp, on);
2100 tty_unlock();
2101 return retval;
2102}
2103
2104/**
2105 * tiocsti - fake input character
2106 * @tty: tty to fake input into
2107 * @p: pointer to character
2108 *
2109 * Fake input to a tty device. Does the necessary locking and
2110 * input management.
2111 *
2112 * FIXME: does not honour flow control ??
2113 *
2114 * Locking:
2115 * Called functions take tty_ldisc_lock
2116 * current->signal->tty check is safe without locks
2117 *
2118 * FIXME: may race normal receive processing
2119 */
2120
2121static int tiocsti(struct tty_struct *tty, char __user *p)
2122{
2123 char ch, mbz = 0;
2124 struct tty_ldisc *ld;
2125
2126 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2127 return -EPERM;
2128 if (get_user(ch, p))
2129 return -EFAULT;
2130 tty_audit_tiocsti(tty, ch);
2131 ld = tty_ldisc_ref_wait(tty);
2132 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2133 tty_ldisc_deref(ld);
2134 return 0;
2135}
2136
2137/**
2138 * tiocgwinsz - implement window query ioctl
2139 * @tty; tty
2140 * @arg: user buffer for result
2141 *
2142 * Copies the kernel idea of the window size into the user buffer.
2143 *
2144 * Locking: tty->termios_mutex is taken to ensure the winsize data
2145 * is consistent.
2146 */
2147
2148static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2149{
2150 int err;
2151
2152 mutex_lock(&tty->termios_mutex);
2153 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2154 mutex_unlock(&tty->termios_mutex);
2155
2156 return err ? -EFAULT: 0;
2157}
2158
2159/**
2160 * tty_do_resize - resize event
2161 * @tty: tty being resized
2162 * @rows: rows (character)
2163 * @cols: cols (character)
2164 *
2165 * Update the termios variables and send the necessary signals to
2166 * peform a terminal resize correctly
2167 */
2168
2169int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2170{
2171 struct pid *pgrp;
2172 unsigned long flags;
2173
2174 /* Lock the tty */
2175 mutex_lock(&tty->termios_mutex);
2176 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2177 goto done;
2178 /* Get the PID values and reference them so we can
2179 avoid holding the tty ctrl lock while sending signals */
2180 spin_lock_irqsave(&tty->ctrl_lock, flags);
2181 pgrp = get_pid(tty->pgrp);
2182 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2183
2184 if (pgrp)
2185 kill_pgrp(pgrp, SIGWINCH, 1);
2186 put_pid(pgrp);
2187
2188 tty->winsize = *ws;
2189done:
2190 mutex_unlock(&tty->termios_mutex);
2191 return 0;
2192}
2193
2194/**
2195 * tiocswinsz - implement window size set ioctl
2196 * @tty; tty side of tty
2197 * @arg: user buffer for result
2198 *
2199 * Copies the user idea of the window size to the kernel. Traditionally
2200 * this is just advisory information but for the Linux console it
2201 * actually has driver level meaning and triggers a VC resize.
2202 *
2203 * Locking:
2204 * Driver dependent. The default do_resize method takes the
2205 * tty termios mutex and ctrl_lock. The console takes its own lock
2206 * then calls into the default method.
2207 */
2208
2209static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2210{
2211 struct winsize tmp_ws;
2212 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2213 return -EFAULT;
2214
2215 if (tty->ops->resize)
2216 return tty->ops->resize(tty, &tmp_ws);
2217 else
2218 return tty_do_resize(tty, &tmp_ws);
2219}
2220
2221/**
2222 * tioccons - allow admin to move logical console
2223 * @file: the file to become console
2224 *
2225 * Allow the administrator to move the redirected console device
2226 *
2227 * Locking: uses redirect_lock to guard the redirect information
2228 */
2229
2230static int tioccons(struct file *file)
2231{
2232 if (!capable(CAP_SYS_ADMIN))
2233 return -EPERM;
2234 if (file->f_op->write == redirected_tty_write) {
2235 struct file *f;
2236 spin_lock(&redirect_lock);
2237 f = redirect;
2238 redirect = NULL;
2239 spin_unlock(&redirect_lock);
2240 if (f)
2241 fput(f);
2242 return 0;
2243 }
2244 spin_lock(&redirect_lock);
2245 if (redirect) {
2246 spin_unlock(&redirect_lock);
2247 return -EBUSY;
2248 }
2249 get_file(file);
2250 redirect = file;
2251 spin_unlock(&redirect_lock);
2252 return 0;
2253}
2254
2255/**
2256 * fionbio - non blocking ioctl
2257 * @file: file to set blocking value
2258 * @p: user parameter
2259 *
2260 * Historical tty interfaces had a blocking control ioctl before
2261 * the generic functionality existed. This piece of history is preserved
2262 * in the expected tty API of posix OS's.
2263 *
2264 * Locking: none, the open file handle ensures it won't go away.
2265 */
2266
2267static int fionbio(struct file *file, int __user *p)
2268{
2269 int nonblock;
2270
2271 if (get_user(nonblock, p))
2272 return -EFAULT;
2273
2274 spin_lock(&file->f_lock);
2275 if (nonblock)
2276 file->f_flags |= O_NONBLOCK;
2277 else
2278 file->f_flags &= ~O_NONBLOCK;
2279 spin_unlock(&file->f_lock);
2280 return 0;
2281}
2282
2283/**
2284 * tiocsctty - set controlling tty
2285 * @tty: tty structure
2286 * @arg: user argument
2287 *
2288 * This ioctl is used to manage job control. It permits a session
2289 * leader to set this tty as the controlling tty for the session.
2290 *
2291 * Locking:
2292 * Takes tty_mutex() to protect tty instance
2293 * Takes tasklist_lock internally to walk sessions
2294 * Takes ->siglock() when updating signal->tty
2295 */
2296
2297static int tiocsctty(struct tty_struct *tty, int arg)
2298{
2299 int ret = 0;
2300 if (current->signal->leader && (task_session(current) == tty->session))
2301 return ret;
2302
2303 mutex_lock(&tty_mutex);
2304 /*
2305 * The process must be a session leader and
2306 * not have a controlling tty already.
2307 */
2308 if (!current->signal->leader || current->signal->tty) {
2309 ret = -EPERM;
2310 goto unlock;
2311 }
2312
2313 if (tty->session) {
2314 /*
2315 * This tty is already the controlling
2316 * tty for another session group!
2317 */
2318 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2319 /*
2320 * Steal it away
2321 */
2322 read_lock(&tasklist_lock);
2323 session_clear_tty(tty->session);
2324 read_unlock(&tasklist_lock);
2325 } else {
2326 ret = -EPERM;
2327 goto unlock;
2328 }
2329 }
2330 proc_set_tty(current, tty);
2331unlock:
2332 mutex_unlock(&tty_mutex);
2333 return ret;
2334}
2335
2336/**
2337 * tty_get_pgrp - return a ref counted pgrp pid
2338 * @tty: tty to read
2339 *
2340 * Returns a refcounted instance of the pid struct for the process
2341 * group controlling the tty.
2342 */
2343
2344struct pid *tty_get_pgrp(struct tty_struct *tty)
2345{
2346 unsigned long flags;
2347 struct pid *pgrp;
2348
2349 spin_lock_irqsave(&tty->ctrl_lock, flags);
2350 pgrp = get_pid(tty->pgrp);
2351 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2352
2353 return pgrp;
2354}
2355EXPORT_SYMBOL_GPL(tty_get_pgrp);
2356
2357/**
2358 * tiocgpgrp - get process group
2359 * @tty: tty passed by user
2360 * @real_tty: tty side of the tty passed by the user if a pty else the tty
2361 * @p: returned pid
2362 *
2363 * Obtain the process group of the tty. If there is no process group
2364 * return an error.
2365 *
2366 * Locking: none. Reference to current->signal->tty is safe.
2367 */
2368
2369static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2370{
2371 struct pid *pid;
2372 int ret;
2373 /*
2374 * (tty == real_tty) is a cheap way of
2375 * testing if the tty is NOT a master pty.
2376 */
2377 if (tty == real_tty && current->signal->tty != real_tty)
2378 return -ENOTTY;
2379 pid = tty_get_pgrp(real_tty);
2380 ret = put_user(pid_vnr(pid), p);
2381 put_pid(pid);
2382 return ret;
2383}
2384
2385/**
2386 * tiocspgrp - attempt to set process group
2387 * @tty: tty passed by user
2388 * @real_tty: tty side device matching tty passed by user
2389 * @p: pid pointer
2390 *
2391 * Set the process group of the tty to the session passed. Only
2392 * permitted where the tty session is our session.
2393 *
2394 * Locking: RCU, ctrl lock
2395 */
2396
2397static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2398{
2399 struct pid *pgrp;
2400 pid_t pgrp_nr;
2401 int retval = tty_check_change(real_tty);
2402 unsigned long flags;
2403
2404 if (retval == -EIO)
2405 return -ENOTTY;
2406 if (retval)
2407 return retval;
2408 if (!current->signal->tty ||
2409 (current->signal->tty != real_tty) ||
2410 (real_tty->session != task_session(current)))
2411 return -ENOTTY;
2412 if (get_user(pgrp_nr, p))
2413 return -EFAULT;
2414 if (pgrp_nr < 0)
2415 return -EINVAL;
2416 rcu_read_lock();
2417 pgrp = find_vpid(pgrp_nr);
2418 retval = -ESRCH;
2419 if (!pgrp)
2420 goto out_unlock;
2421 retval = -EPERM;
2422 if (session_of_pgrp(pgrp) != task_session(current))
2423 goto out_unlock;
2424 retval = 0;
2425 spin_lock_irqsave(&tty->ctrl_lock, flags);
2426 put_pid(real_tty->pgrp);
2427 real_tty->pgrp = get_pid(pgrp);
2428 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2429out_unlock:
2430 rcu_read_unlock();
2431 return retval;
2432}
2433
2434/**
2435 * tiocgsid - get session id
2436 * @tty: tty passed by user
2437 * @real_tty: tty side of the tty passed by the user if a pty else the tty
2438 * @p: pointer to returned session id
2439 *
2440 * Obtain the session id of the tty. If there is no session
2441 * return an error.
2442 *
2443 * Locking: none. Reference to current->signal->tty is safe.
2444 */
2445
2446static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2447{
2448 /*
2449 * (tty == real_tty) is a cheap way of
2450 * testing if the tty is NOT a master pty.
2451 */
2452 if (tty == real_tty && current->signal->tty != real_tty)
2453 return -ENOTTY;
2454 if (!real_tty->session)
2455 return -ENOTTY;
2456 return put_user(pid_vnr(real_tty->session), p);
2457}
2458
2459/**
2460 * tiocsetd - set line discipline
2461 * @tty: tty device
2462 * @p: pointer to user data
2463 *
2464 * Set the line discipline according to user request.
2465 *
2466 * Locking: see tty_set_ldisc, this function is just a helper
2467 */
2468
2469static int tiocsetd(struct tty_struct *tty, int __user *p)
2470{
2471 int ldisc;
2472 int ret;
2473
2474 if (get_user(ldisc, p))
2475 return -EFAULT;
2476
2477 ret = tty_set_ldisc(tty, ldisc);
2478
2479 return ret;
2480}
2481
2482/**
2483 * send_break - performed time break
2484 * @tty: device to break on
2485 * @duration: timeout in mS
2486 *
2487 * Perform a timed break on hardware that lacks its own driver level
2488 * timed break functionality.
2489 *
2490 * Locking:
2491 * atomic_write_lock serializes
2492 *
2493 */
2494
2495static int send_break(struct tty_struct *tty, unsigned int duration)
2496{
2497 int retval;
2498
2499 if (tty->ops->break_ctl == NULL)
2500 return 0;
2501
2502 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2503 retval = tty->ops->break_ctl(tty, duration);
2504 else {
2505 /* Do the work ourselves */
2506 if (tty_write_lock(tty, 0) < 0)
2507 return -EINTR;
2508 retval = tty->ops->break_ctl(tty, -1);
2509 if (retval)
2510 goto out;
2511 if (!signal_pending(current))
2512 msleep_interruptible(duration);
2513 retval = tty->ops->break_ctl(tty, 0);
2514out:
2515 tty_write_unlock(tty);
2516 if (signal_pending(current))
2517 retval = -EINTR;
2518 }
2519 return retval;
2520}
2521
2522/**
2523 * tty_tiocmget - get modem status
2524 * @tty: tty device
2525 * @file: user file pointer
2526 * @p: pointer to result
2527 *
2528 * Obtain the modem status bits from the tty driver if the feature
2529 * is supported. Return -EINVAL if it is not available.
2530 *
2531 * Locking: none (up to the driver)
2532 */
2533
2534static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2535{
2536 int retval = -EINVAL;
2537
2538 if (tty->ops->tiocmget) {
2539 retval = tty->ops->tiocmget(tty);
2540
2541 if (retval >= 0)
2542 retval = put_user(retval, p);
2543 }
2544 return retval;
2545}
2546
2547/**
2548 * tty_tiocmset - set modem status
2549 * @tty: tty device
2550 * @cmd: command - clear bits, set bits or set all
2551 * @p: pointer to desired bits
2552 *
2553 * Set the modem status bits from the tty driver if the feature
2554 * is supported. Return -EINVAL if it is not available.
2555 *
2556 * Locking: none (up to the driver)
2557 */
2558
2559static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2560 unsigned __user *p)
2561{
2562 int retval;
2563 unsigned int set, clear, val;
2564
2565 if (tty->ops->tiocmset == NULL)
2566 return -EINVAL;
2567
2568 retval = get_user(val, p);
2569 if (retval)
2570 return retval;
2571 set = clear = 0;
2572 switch (cmd) {
2573 case TIOCMBIS:
2574 set = val;
2575 break;
2576 case TIOCMBIC:
2577 clear = val;
2578 break;
2579 case TIOCMSET:
2580 set = val;
2581 clear = ~val;
2582 break;
2583 }
2584 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2585 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2586 return tty->ops->tiocmset(tty, set, clear);
2587}
2588
2589static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2590{
2591 int retval = -EINVAL;
2592 struct serial_icounter_struct icount;
2593 memset(&icount, 0, sizeof(icount));
2594 if (tty->ops->get_icount)
2595 retval = tty->ops->get_icount(tty, &icount);
2596 if (retval != 0)
2597 return retval;
2598 if (copy_to_user(arg, &icount, sizeof(icount)))
2599 return -EFAULT;
2600 return 0;
2601}
2602
2603struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2604{
2605 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2606 tty->driver->subtype == PTY_TYPE_MASTER)
2607 tty = tty->link;
2608 return tty;
2609}
2610EXPORT_SYMBOL(tty_pair_get_tty);
2611
2612struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2613{
2614 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2615 tty->driver->subtype == PTY_TYPE_MASTER)
2616 return tty;
2617 return tty->link;
2618}
2619EXPORT_SYMBOL(tty_pair_get_pty);
2620
2621/*
2622 * Split this up, as gcc can choke on it otherwise..
2623 */
2624long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2625{
2626 struct tty_struct *tty = file_tty(file);
2627 struct tty_struct *real_tty;
2628 void __user *p = (void __user *)arg;
2629 int retval;
2630 struct tty_ldisc *ld;
2631 struct inode *inode = file->f_dentry->d_inode;
2632
2633 if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2634 return -EINVAL;
2635
2636 real_tty = tty_pair_get_tty(tty);
2637
2638 /*
2639 * Factor out some common prep work
2640 */
2641 switch (cmd) {
2642 case TIOCSETD:
2643 case TIOCSBRK:
2644 case TIOCCBRK:
2645 case TCSBRK:
2646 case TCSBRKP:
2647 retval = tty_check_change(tty);
2648 if (retval)
2649 return retval;
2650 if (cmd != TIOCCBRK) {
2651 tty_wait_until_sent(tty, 0);
2652 if (signal_pending(current))
2653 return -EINTR;
2654 }
2655 break;
2656 }
2657
2658 /*
2659 * Now do the stuff.
2660 */
2661 switch (cmd) {
2662 case TIOCSTI:
2663 return tiocsti(tty, p);
2664 case TIOCGWINSZ:
2665 return tiocgwinsz(real_tty, p);
2666 case TIOCSWINSZ:
2667 return tiocswinsz(real_tty, p);
2668 case TIOCCONS:
2669 return real_tty != tty ? -EINVAL : tioccons(file);
2670 case FIONBIO:
2671 return fionbio(file, p);
2672 case TIOCEXCL:
2673 set_bit(TTY_EXCLUSIVE, &tty->flags);
2674 return 0;
2675 case TIOCNXCL:
2676 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2677 return 0;
2678 case TIOCNOTTY:
2679 if (current->signal->tty != tty)
2680 return -ENOTTY;
2681 no_tty();
2682 return 0;
2683 case TIOCSCTTY:
2684 return tiocsctty(tty, arg);
2685 case TIOCGPGRP:
2686 return tiocgpgrp(tty, real_tty, p);
2687 case TIOCSPGRP:
2688 return tiocspgrp(tty, real_tty, p);
2689 case TIOCGSID:
2690 return tiocgsid(tty, real_tty, p);
2691 case TIOCGETD:
2692 return put_user(tty->ldisc->ops->num, (int __user *)p);
2693 case TIOCSETD:
2694 return tiocsetd(tty, p);
2695 case TIOCVHANGUP:
2696 if (!capable(CAP_SYS_ADMIN))
2697 return -EPERM;
2698 tty_vhangup(tty);
2699 return 0;
2700 case TIOCGDEV:
2701 {
2702 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2703 return put_user(ret, (unsigned int __user *)p);
2704 }
2705 /*
2706 * Break handling
2707 */
2708 case TIOCSBRK: /* Turn break on, unconditionally */
2709 if (tty->ops->break_ctl)
2710 return tty->ops->break_ctl(tty, -1);
2711 return 0;
2712 case TIOCCBRK: /* Turn break off, unconditionally */
2713 if (tty->ops->break_ctl)
2714 return tty->ops->break_ctl(tty, 0);
2715 return 0;
2716 case TCSBRK: /* SVID version: non-zero arg --> no break */
2717 /* non-zero arg means wait for all output data
2718 * to be sent (performed above) but don't send break.
2719 * This is used by the tcdrain() termios function.
2720 */
2721 if (!arg)
2722 return send_break(tty, 250);
2723 return 0;
2724 case TCSBRKP: /* support for POSIX tcsendbreak() */
2725 return send_break(tty, arg ? arg*100 : 250);
2726
2727 case TIOCMGET:
2728 return tty_tiocmget(tty, p);
2729 case TIOCMSET:
2730 case TIOCMBIC:
2731 case TIOCMBIS:
2732 return tty_tiocmset(tty, cmd, p);
2733 case TIOCGICOUNT:
2734 retval = tty_tiocgicount(tty, p);
2735 /* For the moment allow fall through to the old method */
2736 if (retval != -EINVAL)
2737 return retval;
2738 break;
2739 case TCFLSH:
2740 switch (arg) {
2741 case TCIFLUSH:
2742 case TCIOFLUSH:
2743 /* flush tty buffer and allow ldisc to process ioctl */
2744 tty_buffer_flush(tty);
2745 break;
2746 }
2747 break;
2748 }
2749 if (tty->ops->ioctl) {
2750 retval = (tty->ops->ioctl)(tty, cmd, arg);
2751 if (retval != -ENOIOCTLCMD)
2752 return retval;
2753 }
2754 ld = tty_ldisc_ref_wait(tty);
2755 retval = -EINVAL;
2756 if (ld->ops->ioctl) {
2757 retval = ld->ops->ioctl(tty, file, cmd, arg);
2758 if (retval == -ENOIOCTLCMD)
2759 retval = -EINVAL;
2760 }
2761 tty_ldisc_deref(ld);
2762 return retval;
2763}
2764
2765#ifdef CONFIG_COMPAT
2766static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2767 unsigned long arg)
2768{
2769 struct inode *inode = file->f_dentry->d_inode;
2770 struct tty_struct *tty = file_tty(file);
2771 struct tty_ldisc *ld;
2772 int retval = -ENOIOCTLCMD;
2773
2774 if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2775 return -EINVAL;
2776
2777 if (tty->ops->compat_ioctl) {
2778 retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2779 if (retval != -ENOIOCTLCMD)
2780 return retval;
2781 }
2782
2783 ld = tty_ldisc_ref_wait(tty);
2784 if (ld->ops->compat_ioctl)
2785 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2786 else
2787 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2788 tty_ldisc_deref(ld);
2789
2790 return retval;
2791}
2792#endif
2793
2794/*
2795 * This implements the "Secure Attention Key" --- the idea is to
2796 * prevent trojan horses by killing all processes associated with this
2797 * tty when the user hits the "Secure Attention Key". Required for
2798 * super-paranoid applications --- see the Orange Book for more details.
2799 *
2800 * This code could be nicer; ideally it should send a HUP, wait a few
2801 * seconds, then send a INT, and then a KILL signal. But you then
2802 * have to coordinate with the init process, since all processes associated
2803 * with the current tty must be dead before the new getty is allowed
2804 * to spawn.
2805 *
2806 * Now, if it would be correct ;-/ The current code has a nasty hole -
2807 * it doesn't catch files in flight. We may send the descriptor to ourselves
2808 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2809 *
2810 * Nasty bug: do_SAK is being called in interrupt context. This can
2811 * deadlock. We punt it up to process context. AKPM - 16Mar2001
2812 */
2813void __do_SAK(struct tty_struct *tty)
2814{
2815#ifdef TTY_SOFT_SAK
2816 tty_hangup(tty);
2817#else
2818 struct task_struct *g, *p;
2819 struct pid *session;
2820 int i;
2821 struct file *filp;
2822 struct fdtable *fdt;
2823
2824 if (!tty)
2825 return;
2826 session = tty->session;
2827
2828 tty_ldisc_flush(tty);
2829
2830 tty_driver_flush_buffer(tty);
2831
2832 read_lock(&tasklist_lock);
2833 /* Kill the entire session */
2834 do_each_pid_task(session, PIDTYPE_SID, p) {
2835 printk(KERN_NOTICE "SAK: killed process %d"
2836 " (%s): task_session(p)==tty->session\n",
2837 task_pid_nr(p), p->comm);
2838 send_sig(SIGKILL, p, 1);
2839 } while_each_pid_task(session, PIDTYPE_SID, p);
2840 /* Now kill any processes that happen to have the
2841 * tty open.
2842 */
2843 do_each_thread(g, p) {
2844 if (p->signal->tty == tty) {
2845 printk(KERN_NOTICE "SAK: killed process %d"
2846 " (%s): task_session(p)==tty->session\n",
2847 task_pid_nr(p), p->comm);
2848 send_sig(SIGKILL, p, 1);
2849 continue;
2850 }
2851 task_lock(p);
2852 if (p->files) {
2853 /*
2854 * We don't take a ref to the file, so we must
2855 * hold ->file_lock instead.
2856 */
2857 spin_lock(&p->files->file_lock);
2858 fdt = files_fdtable(p->files);
2859 for (i = 0; i < fdt->max_fds; i++) {
2860 filp = fcheck_files(p->files, i);
2861 if (!filp)
2862 continue;
2863 if (filp->f_op->read == tty_read &&
2864 file_tty(filp) == tty) {
2865 printk(KERN_NOTICE "SAK: killed process %d"
2866 " (%s): fd#%d opened to the tty\n",
2867 task_pid_nr(p), p->comm, i);
2868 force_sig(SIGKILL, p);
2869 break;
2870 }
2871 }
2872 spin_unlock(&p->files->file_lock);
2873 }
2874 task_unlock(p);
2875 } while_each_thread(g, p);
2876 read_unlock(&tasklist_lock);
2877#endif
2878}
2879
2880static void do_SAK_work(struct work_struct *work)
2881{
2882 struct tty_struct *tty =
2883 container_of(work, struct tty_struct, SAK_work);
2884 __do_SAK(tty);
2885}
2886
2887/*
2888 * The tq handling here is a little racy - tty->SAK_work may already be queued.
2889 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2890 * the values which we write to it will be identical to the values which it
2891 * already has. --akpm
2892 */
2893void do_SAK(struct tty_struct *tty)
2894{
2895 if (!tty)
2896 return;
2897 schedule_work(&tty->SAK_work);
2898}
2899
2900EXPORT_SYMBOL(do_SAK);
2901
2902static int dev_match_devt(struct device *dev, void *data)
2903{
2904 dev_t *devt = data;
2905 return dev->devt == *devt;
2906}
2907
2908/* Must put_device() after it's unused! */
2909static struct device *tty_get_device(struct tty_struct *tty)
2910{
2911 dev_t devt = tty_devnum(tty);
2912 return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2913}
2914
2915
2916/**
2917 * initialize_tty_struct
2918 * @tty: tty to initialize
2919 *
2920 * This subroutine initializes a tty structure that has been newly
2921 * allocated.
2922 *
2923 * Locking: none - tty in question must not be exposed at this point
2924 */
2925
2926void initialize_tty_struct(struct tty_struct *tty,
2927 struct tty_driver *driver, int idx)
2928{
2929 memset(tty, 0, sizeof(struct tty_struct));
2930 kref_init(&tty->kref);
2931 tty->magic = TTY_MAGIC;
2932 tty_ldisc_init(tty);
2933 tty->session = NULL;
2934 tty->pgrp = NULL;
2935 tty->overrun_time = jiffies;
2936 tty_buffer_init(tty);
2937 mutex_init(&tty->termios_mutex);
2938 mutex_init(&tty->ldisc_mutex);
2939 init_waitqueue_head(&tty->write_wait);
2940 init_waitqueue_head(&tty->read_wait);
2941 INIT_WORK(&tty->hangup_work, do_tty_hangup);
2942 mutex_init(&tty->atomic_read_lock);
2943 mutex_init(&tty->atomic_write_lock);
2944 mutex_init(&tty->output_lock);
2945 mutex_init(&tty->echo_lock);
2946 spin_lock_init(&tty->read_lock);
2947 spin_lock_init(&tty->ctrl_lock);
2948 INIT_LIST_HEAD(&tty->tty_files);
2949 INIT_WORK(&tty->SAK_work, do_SAK_work);
2950
2951 tty->driver = driver;
2952 tty->ops = driver->ops;
2953 tty->index = idx;
2954 tty_line_name(driver, idx, tty->name);
2955 tty->dev = tty_get_device(tty);
2956}
2957
2958/**
2959 * deinitialize_tty_struct
2960 * @tty: tty to deinitialize
2961 *
2962 * This subroutine deinitializes a tty structure that has been newly
2963 * allocated but tty_release cannot be called on that yet.
2964 *
2965 * Locking: none - tty in question must not be exposed at this point
2966 */
2967void deinitialize_tty_struct(struct tty_struct *tty)
2968{
2969 tty_ldisc_deinit(tty);
2970}
2971
2972/**
2973 * tty_put_char - write one character to a tty
2974 * @tty: tty
2975 * @ch: character
2976 *
2977 * Write one byte to the tty using the provided put_char method
2978 * if present. Returns the number of characters successfully output.
2979 *
2980 * Note: the specific put_char operation in the driver layer may go
2981 * away soon. Don't call it directly, use this method
2982 */
2983
2984int tty_put_char(struct tty_struct *tty, unsigned char ch)
2985{
2986 if (tty->ops->put_char)
2987 return tty->ops->put_char(tty, ch);
2988 return tty->ops->write(tty, &ch, 1);
2989}
2990EXPORT_SYMBOL_GPL(tty_put_char);
2991
2992struct class *tty_class;
2993
2994/**
2995 * tty_register_device - register a tty device
2996 * @driver: the tty driver that describes the tty device
2997 * @index: the index in the tty driver for this tty device
2998 * @device: a struct device that is associated with this tty device.
2999 * This field is optional, if there is no known struct device
3000 * for this tty device it can be set to NULL safely.
3001 *
3002 * Returns a pointer to the struct device for this tty device
3003 * (or ERR_PTR(-EFOO) on error).
3004 *
3005 * This call is required to be made to register an individual tty device
3006 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3007 * that bit is not set, this function should not be called by a tty
3008 * driver.
3009 *
3010 * Locking: ??
3011 */
3012
3013struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3014 struct device *device)
3015{
3016 char name[64];
3017 dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3018
3019 if (index >= driver->num) {
3020 printk(KERN_ERR "Attempt to register invalid tty line number "
3021 " (%d).\n", index);
3022 return ERR_PTR(-EINVAL);
3023 }
3024
3025 if (driver->type == TTY_DRIVER_TYPE_PTY)
3026 pty_line_name(driver, index, name);
3027 else
3028 tty_line_name(driver, index, name);
3029
3030 return device_create(tty_class, device, dev, NULL, name);
3031}
3032EXPORT_SYMBOL(tty_register_device);
3033
3034/**
3035 * tty_unregister_device - unregister a tty device
3036 * @driver: the tty driver that describes the tty device
3037 * @index: the index in the tty driver for this tty device
3038 *
3039 * If a tty device is registered with a call to tty_register_device() then
3040 * this function must be called when the tty device is gone.
3041 *
3042 * Locking: ??
3043 */
3044
3045void tty_unregister_device(struct tty_driver *driver, unsigned index)
3046{
3047 device_destroy(tty_class,
3048 MKDEV(driver->major, driver->minor_start) + index);
3049}
3050EXPORT_SYMBOL(tty_unregister_device);
3051
3052struct tty_driver *__alloc_tty_driver(int lines, struct module *owner)
3053{
3054 struct tty_driver *driver;
3055
3056 driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3057 if (driver) {
3058 kref_init(&driver->kref);
3059 driver->magic = TTY_DRIVER_MAGIC;
3060 driver->num = lines;
3061 driver->owner = owner;
3062 /* later we'll move allocation of tables here */
3063 }
3064 return driver;
3065}
3066EXPORT_SYMBOL(__alloc_tty_driver);
3067
3068static void destruct_tty_driver(struct kref *kref)
3069{
3070 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3071 int i;
3072 struct ktermios *tp;
3073 void *p;
3074
3075 if (driver->flags & TTY_DRIVER_INSTALLED) {
3076 /*
3077 * Free the termios and termios_locked structures because
3078 * we don't want to get memory leaks when modular tty
3079 * drivers are removed from the kernel.
3080 */
3081 for (i = 0; i < driver->num; i++) {
3082 tp = driver->termios[i];
3083 if (tp) {
3084 driver->termios[i] = NULL;
3085 kfree(tp);
3086 }
3087 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3088 tty_unregister_device(driver, i);
3089 }
3090 p = driver->ttys;
3091 proc_tty_unregister_driver(driver);
3092 driver->ttys = NULL;
3093 driver->termios = NULL;
3094 kfree(p);
3095 cdev_del(&driver->cdev);
3096 }
3097 kfree(driver);
3098}
3099
3100void tty_driver_kref_put(struct tty_driver *driver)
3101{
3102 kref_put(&driver->kref, destruct_tty_driver);
3103}
3104EXPORT_SYMBOL(tty_driver_kref_put);
3105
3106void tty_set_operations(struct tty_driver *driver,
3107 const struct tty_operations *op)
3108{
3109 driver->ops = op;
3110};
3111EXPORT_SYMBOL(tty_set_operations);
3112
3113void put_tty_driver(struct tty_driver *d)
3114{
3115 tty_driver_kref_put(d);
3116}
3117EXPORT_SYMBOL(put_tty_driver);
3118
3119/*
3120 * Called by a tty driver to register itself.
3121 */
3122int tty_register_driver(struct tty_driver *driver)
3123{
3124 int error;
3125 int i;
3126 dev_t dev;
3127 void **p = NULL;
3128 struct device *d;
3129
3130 if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3131 p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
3132 if (!p)
3133 return -ENOMEM;
3134 }
3135
3136 if (!driver->major) {
3137 error = alloc_chrdev_region(&dev, driver->minor_start,
3138 driver->num, driver->name);
3139 if (!error) {
3140 driver->major = MAJOR(dev);
3141 driver->minor_start = MINOR(dev);
3142 }
3143 } else {
3144 dev = MKDEV(driver->major, driver->minor_start);
3145 error = register_chrdev_region(dev, driver->num, driver->name);
3146 }
3147 if (error < 0) {
3148 kfree(p);
3149 return error;
3150 }
3151
3152 if (p) {
3153 driver->ttys = (struct tty_struct **)p;
3154 driver->termios = (struct ktermios **)(p + driver->num);
3155 } else {
3156 driver->ttys = NULL;
3157 driver->termios = NULL;
3158 }
3159
3160 cdev_init(&driver->cdev, &tty_fops);
3161 driver->cdev.owner = driver->owner;
3162 error = cdev_add(&driver->cdev, dev, driver->num);
3163 if (error) {
3164 unregister_chrdev_region(dev, driver->num);
3165 driver->ttys = NULL;
3166 driver->termios = NULL;
3167 kfree(p);
3168 return error;
3169 }
3170
3171 mutex_lock(&tty_mutex);
3172 list_add(&driver->tty_drivers, &tty_drivers);
3173 mutex_unlock(&tty_mutex);
3174
3175 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3176 for (i = 0; i < driver->num; i++) {
3177 d = tty_register_device(driver, i, NULL);
3178 if (IS_ERR(d)) {
3179 error = PTR_ERR(d);
3180 goto err;
3181 }
3182 }
3183 }
3184 proc_tty_register_driver(driver);
3185 driver->flags |= TTY_DRIVER_INSTALLED;
3186 return 0;
3187
3188err:
3189 for (i--; i >= 0; i--)
3190 tty_unregister_device(driver, i);
3191
3192 mutex_lock(&tty_mutex);
3193 list_del(&driver->tty_drivers);
3194 mutex_unlock(&tty_mutex);
3195
3196 unregister_chrdev_region(dev, driver->num);
3197 driver->ttys = NULL;
3198 driver->termios = NULL;
3199 kfree(p);
3200 return error;
3201}
3202
3203EXPORT_SYMBOL(tty_register_driver);
3204
3205/*
3206 * Called by a tty driver to unregister itself.
3207 */
3208int tty_unregister_driver(struct tty_driver *driver)
3209{
3210#if 0
3211 /* FIXME */
3212 if (driver->refcount)
3213 return -EBUSY;
3214#endif
3215 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3216 driver->num);
3217 mutex_lock(&tty_mutex);
3218 list_del(&driver->tty_drivers);
3219 mutex_unlock(&tty_mutex);
3220 return 0;
3221}
3222
3223EXPORT_SYMBOL(tty_unregister_driver);
3224
3225dev_t tty_devnum(struct tty_struct *tty)
3226{
3227 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3228}
3229EXPORT_SYMBOL(tty_devnum);
3230
3231void proc_clear_tty(struct task_struct *p)
3232{
3233 unsigned long flags;
3234 struct tty_struct *tty;
3235 spin_lock_irqsave(&p->sighand->siglock, flags);
3236 tty = p->signal->tty;
3237 p->signal->tty = NULL;
3238 spin_unlock_irqrestore(&p->sighand->siglock, flags);
3239 tty_kref_put(tty);
3240}
3241
3242/* Called under the sighand lock */
3243
3244static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3245{
3246 if (tty) {
3247 unsigned long flags;
3248 /* We should not have a session or pgrp to put here but.... */
3249 spin_lock_irqsave(&tty->ctrl_lock, flags);
3250 put_pid(tty->session);
3251 put_pid(tty->pgrp);
3252 tty->pgrp = get_pid(task_pgrp(tsk));
3253 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3254 tty->session = get_pid(task_session(tsk));
3255 if (tsk->signal->tty) {
3256 printk(KERN_DEBUG "tty not NULL!!\n");
3257 tty_kref_put(tsk->signal->tty);
3258 }
3259 }
3260 put_pid(tsk->signal->tty_old_pgrp);
3261 tsk->signal->tty = tty_kref_get(tty);
3262 tsk->signal->tty_old_pgrp = NULL;
3263}
3264
3265static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3266{
3267 spin_lock_irq(&tsk->sighand->siglock);
3268 __proc_set_tty(tsk, tty);
3269 spin_unlock_irq(&tsk->sighand->siglock);
3270}
3271
3272struct tty_struct *get_current_tty(void)
3273{
3274 struct tty_struct *tty;
3275 unsigned long flags;
3276
3277 spin_lock_irqsave(¤t->sighand->siglock, flags);
3278 tty = tty_kref_get(current->signal->tty);
3279 spin_unlock_irqrestore(¤t->sighand->siglock, flags);
3280 return tty;
3281}
3282EXPORT_SYMBOL_GPL(get_current_tty);
3283
3284void tty_default_fops(struct file_operations *fops)
3285{
3286 *fops = tty_fops;
3287}
3288
3289/*
3290 * Initialize the console device. This is called *early*, so
3291 * we can't necessarily depend on lots of kernel help here.
3292 * Just do some early initializations, and do the complex setup
3293 * later.
3294 */
3295void __init console_init(void)
3296{
3297 initcall_t *call;
3298
3299 /* Setup the default TTY line discipline. */
3300 tty_ldisc_begin();
3301
3302 /*
3303 * set up the console device so that later boot sequences can
3304 * inform about problems etc..
3305 */
3306 call = __con_initcall_start;
3307 while (call < __con_initcall_end) {
3308 (*call)();
3309 call++;
3310 }
3311}
3312
3313static char *tty_devnode(struct device *dev, umode_t *mode)
3314{
3315 if (!mode)
3316 return NULL;
3317 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3318 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3319 *mode = 0666;
3320 return NULL;
3321}
3322
3323static int __init tty_class_init(void)
3324{
3325 tty_class = class_create(THIS_MODULE, "tty");
3326 if (IS_ERR(tty_class))
3327 return PTR_ERR(tty_class);
3328 tty_class->devnode = tty_devnode;
3329 return 0;
3330}
3331
3332postcore_initcall(tty_class_init);
3333
3334/* 3/2004 jmc: why do these devices exist? */
3335static struct cdev tty_cdev, console_cdev;
3336
3337static ssize_t show_cons_active(struct device *dev,
3338 struct device_attribute *attr, char *buf)
3339{
3340 struct console *cs[16];
3341 int i = 0;
3342 struct console *c;
3343 ssize_t count = 0;
3344
3345 console_lock();
3346 for_each_console(c) {
3347 if (!c->device)
3348 continue;
3349 if (!c->write)
3350 continue;
3351 if ((c->flags & CON_ENABLED) == 0)
3352 continue;
3353 cs[i++] = c;
3354 if (i >= ARRAY_SIZE(cs))
3355 break;
3356 }
3357 while (i--)
3358 count += sprintf(buf + count, "%s%d%c",
3359 cs[i]->name, cs[i]->index, i ? ' ':'\n');
3360 console_unlock();
3361
3362 return count;
3363}
3364static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3365
3366static struct device *consdev;
3367
3368void console_sysfs_notify(void)
3369{
3370 if (consdev)
3371 sysfs_notify(&consdev->kobj, NULL, "active");
3372}
3373
3374/*
3375 * Ok, now we can initialize the rest of the tty devices and can count
3376 * on memory allocations, interrupts etc..
3377 */
3378int __init tty_init(void)
3379{
3380 cdev_init(&tty_cdev, &tty_fops);
3381 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3382 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3383 panic("Couldn't register /dev/tty driver\n");
3384 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3385
3386 cdev_init(&console_cdev, &console_fops);
3387 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3388 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3389 panic("Couldn't register /dev/console driver\n");
3390 consdev = device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3391 "console");
3392 if (IS_ERR(consdev))
3393 consdev = NULL;
3394 else
3395 WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
3396
3397#ifdef CONFIG_VT
3398 vty_init(&console_fops);
3399#endif
3400 return 0;
3401}
3402