Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 1991, 1992 Linus Torvalds
4 */
5
6/*
7 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
8 * or rs-channels. It also implements echoing, cooked mode etc.
9 *
10 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
11 *
12 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
13 * tty_struct and tty_queue structures. Previously there was an array
14 * of 256 tty_struct's which was statically allocated, and the
15 * tty_queue structures were allocated at boot time. Both are now
16 * dynamically allocated only when the tty is open.
17 *
18 * Also restructured routines so that there is more of a separation
19 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
20 * the low-level tty routines (serial.c, pty.c, console.c). This
21 * makes for cleaner and more compact code. -TYT, 9/17/92
22 *
23 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
24 * which can be dynamically activated and de-activated by the line
25 * discipline handling modules (like SLIP).
26 *
27 * NOTE: pay no attention to the line discipline code (yet); its
28 * interface is still subject to change in this version...
29 * -- TYT, 1/31/92
30 *
31 * Added functionality to the OPOST tty handling. No delays, but all
32 * other bits should be there.
33 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
34 *
35 * Rewrote canonical mode and added more termios flags.
36 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
37 *
38 * Reorganized FASYNC support so mouse code can share it.
39 * -- ctm@ardi.com, 9Sep95
40 *
41 * New TIOCLINUX variants added.
42 * -- mj@k332.feld.cvut.cz, 19-Nov-95
43 *
44 * Restrict vt switching via ioctl()
45 * -- grif@cs.ucr.edu, 5-Dec-95
46 *
47 * Move console and virtual terminal code to more appropriate files,
48 * implement CONFIG_VT and generalize console device interface.
49 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
50 *
51 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
52 * -- Bill Hawes <whawes@star.net>, June 97
53 *
54 * Added devfs support.
55 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
56 *
57 * Added support for a Unix98-style ptmx device.
58 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
59 *
60 * Reduced memory usage for older ARM systems
61 * -- Russell King <rmk@arm.linux.org.uk>
62 *
63 * Move do_SAK() into process context. Less stack use in devfs functions.
64 * alloc_tty_struct() always uses kmalloc()
65 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66 */
67
68#include <linux/types.h>
69#include <linux/major.h>
70#include <linux/errno.h>
71#include <linux/signal.h>
72#include <linux/fcntl.h>
73#include <linux/sched/signal.h>
74#include <linux/sched/task.h>
75#include <linux/interrupt.h>
76#include <linux/tty.h>
77#include <linux/tty_driver.h>
78#include <linux/tty_flip.h>
79#include <linux/devpts_fs.h>
80#include <linux/file.h>
81#include <linux/fdtable.h>
82#include <linux/console.h>
83#include <linux/timer.h>
84#include <linux/ctype.h>
85#include <linux/kd.h>
86#include <linux/mm.h>
87#include <linux/string.h>
88#include <linux/slab.h>
89#include <linux/poll.h>
90#include <linux/ppp-ioctl.h>
91#include <linux/proc_fs.h>
92#include <linux/init.h>
93#include <linux/module.h>
94#include <linux/device.h>
95#include <linux/wait.h>
96#include <linux/bitops.h>
97#include <linux/delay.h>
98#include <linux/seq_file.h>
99#include <linux/serial.h>
100#include <linux/ratelimit.h>
101#include <linux/compat.h>
102#include <linux/uaccess.h>
103#include <linux/termios_internal.h>
104
105#include <linux/kbd_kern.h>
106#include <linux/vt_kern.h>
107#include <linux/selection.h>
108
109#include <linux/kmod.h>
110#include <linux/nsproxy.h>
111#include "tty.h"
112
113#undef TTY_DEBUG_HANGUP
114#ifdef TTY_DEBUG_HANGUP
115# define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
116#else
117# define tty_debug_hangup(tty, f, args...) do { } while (0)
118#endif
119
120#define TTY_PARANOIA_CHECK 1
121#define CHECK_TTY_COUNT 1
122
123struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
124 .c_iflag = ICRNL | IXON,
125 .c_oflag = OPOST | ONLCR,
126 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
127 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
128 ECHOCTL | ECHOKE | IEXTEN,
129 .c_cc = INIT_C_CC,
130 .c_ispeed = 38400,
131 .c_ospeed = 38400,
132 /* .c_line = N_TTY, */
133};
134EXPORT_SYMBOL(tty_std_termios);
135
136/* This list gets poked at by procfs and various bits of boot up code. This
137 * could do with some rationalisation such as pulling the tty proc function
138 * into this file.
139 */
140
141LIST_HEAD(tty_drivers); /* linked list of tty drivers */
142
143/* Mutex to protect creating and releasing a tty */
144DEFINE_MUTEX(tty_mutex);
145
146static ssize_t tty_read(struct kiocb *, struct iov_iter *);
147static ssize_t tty_write(struct kiocb *, struct iov_iter *);
148static __poll_t tty_poll(struct file *, poll_table *);
149static int tty_open(struct inode *, struct file *);
150#ifdef CONFIG_COMPAT
151static long tty_compat_ioctl(struct file *file, unsigned int cmd,
152 unsigned long arg);
153#else
154#define tty_compat_ioctl NULL
155#endif
156static int __tty_fasync(int fd, struct file *filp, int on);
157static int tty_fasync(int fd, struct file *filp, int on);
158static void release_tty(struct tty_struct *tty, int idx);
159
160/**
161 * free_tty_struct - free a disused tty
162 * @tty: tty struct to free
163 *
164 * Free the write buffers, tty queue and tty memory itself.
165 *
166 * Locking: none. Must be called after tty is definitely unused
167 */
168static void free_tty_struct(struct tty_struct *tty)
169{
170 tty_ldisc_deinit(tty);
171 put_device(tty->dev);
172 kvfree(tty->write_buf);
173 kfree(tty);
174}
175
176static inline struct tty_struct *file_tty(struct file *file)
177{
178 return ((struct tty_file_private *)file->private_data)->tty;
179}
180
181int tty_alloc_file(struct file *file)
182{
183 struct tty_file_private *priv;
184
185 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
186 if (!priv)
187 return -ENOMEM;
188
189 file->private_data = priv;
190
191 return 0;
192}
193
194/* Associate a new file with the tty structure */
195void tty_add_file(struct tty_struct *tty, struct file *file)
196{
197 struct tty_file_private *priv = file->private_data;
198
199 priv->tty = tty;
200 priv->file = file;
201
202 spin_lock(&tty->files_lock);
203 list_add(&priv->list, &tty->tty_files);
204 spin_unlock(&tty->files_lock);
205}
206
207/**
208 * tty_free_file - free file->private_data
209 * @file: to free private_data of
210 *
211 * This shall be used only for fail path handling when tty_add_file was not
212 * called yet.
213 */
214void tty_free_file(struct file *file)
215{
216 struct tty_file_private *priv = file->private_data;
217
218 file->private_data = NULL;
219 kfree(priv);
220}
221
222/* Delete file from its tty */
223static void tty_del_file(struct file *file)
224{
225 struct tty_file_private *priv = file->private_data;
226 struct tty_struct *tty = priv->tty;
227
228 spin_lock(&tty->files_lock);
229 list_del(&priv->list);
230 spin_unlock(&tty->files_lock);
231 tty_free_file(file);
232}
233
234/**
235 * tty_name - return tty naming
236 * @tty: tty structure
237 *
238 * Convert a tty structure into a name. The name reflects the kernel naming
239 * policy and if udev is in use may not reflect user space
240 *
241 * Locking: none
242 */
243const char *tty_name(const struct tty_struct *tty)
244{
245 if (!tty) /* Hmm. NULL pointer. That's fun. */
246 return "NULL tty";
247 return tty->name;
248}
249EXPORT_SYMBOL(tty_name);
250
251const char *tty_driver_name(const struct tty_struct *tty)
252{
253 if (!tty || !tty->driver)
254 return "";
255 return tty->driver->name;
256}
257
258static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
259 const char *routine)
260{
261#ifdef TTY_PARANOIA_CHECK
262 if (!tty) {
263 pr_warn("(%d:%d): %s: NULL tty\n",
264 imajor(inode), iminor(inode), routine);
265 return 1;
266 }
267#endif
268 return 0;
269}
270
271/* Caller must hold tty_lock */
272static int check_tty_count(struct tty_struct *tty, const char *routine)
273{
274#ifdef CHECK_TTY_COUNT
275 struct list_head *p;
276 int count = 0, kopen_count = 0;
277
278 spin_lock(&tty->files_lock);
279 list_for_each(p, &tty->tty_files) {
280 count++;
281 }
282 spin_unlock(&tty->files_lock);
283 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
284 tty->driver->subtype == PTY_TYPE_SLAVE &&
285 tty->link && tty->link->count)
286 count++;
287 if (tty_port_kopened(tty->port))
288 kopen_count++;
289 if (tty->count != (count + kopen_count)) {
290 tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
291 routine, tty->count, count, kopen_count);
292 return (count + kopen_count);
293 }
294#endif
295 return 0;
296}
297
298/**
299 * get_tty_driver - find device of a tty
300 * @device: device identifier
301 * @index: returns the index of the tty
302 *
303 * This routine returns a tty driver structure, given a device number and also
304 * passes back the index number.
305 *
306 * Locking: caller must hold tty_mutex
307 */
308static struct tty_driver *get_tty_driver(dev_t device, int *index)
309{
310 struct tty_driver *p;
311
312 list_for_each_entry(p, &tty_drivers, tty_drivers) {
313 dev_t base = MKDEV(p->major, p->minor_start);
314
315 if (device < base || device >= base + p->num)
316 continue;
317 *index = device - base;
318 return tty_driver_kref_get(p);
319 }
320 return NULL;
321}
322
323/**
324 * tty_dev_name_to_number - return dev_t for device name
325 * @name: user space name of device under /dev
326 * @number: pointer to dev_t that this function will populate
327 *
328 * This function converts device names like ttyS0 or ttyUSB1 into dev_t like
329 * (4, 64) or (188, 1). If no corresponding driver is registered then the
330 * function returns -%ENODEV.
331 *
332 * Locking: this acquires tty_mutex to protect the tty_drivers list from
333 * being modified while we are traversing it, and makes sure to
334 * release it before exiting.
335 */
336int tty_dev_name_to_number(const char *name, dev_t *number)
337{
338 struct tty_driver *p;
339 int ret;
340 int index, prefix_length = 0;
341 const char *str;
342
343 for (str = name; *str && !isdigit(*str); str++)
344 ;
345
346 if (!*str)
347 return -EINVAL;
348
349 ret = kstrtoint(str, 10, &index);
350 if (ret)
351 return ret;
352
353 prefix_length = str - name;
354 mutex_lock(&tty_mutex);
355
356 list_for_each_entry(p, &tty_drivers, tty_drivers)
357 if (prefix_length == strlen(p->name) && strncmp(name,
358 p->name, prefix_length) == 0) {
359 if (index < p->num) {
360 *number = MKDEV(p->major, p->minor_start + index);
361 goto out;
362 }
363 }
364
365 /* if here then driver wasn't found */
366 ret = -ENODEV;
367out:
368 mutex_unlock(&tty_mutex);
369 return ret;
370}
371EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
372
373#ifdef CONFIG_CONSOLE_POLL
374
375/**
376 * tty_find_polling_driver - find device of a polled tty
377 * @name: name string to match
378 * @line: pointer to resulting tty line nr
379 *
380 * This routine returns a tty driver structure, given a name and the condition
381 * that the tty driver is capable of polled operation.
382 */
383struct tty_driver *tty_find_polling_driver(char *name, int *line)
384{
385 struct tty_driver *p, *res = NULL;
386 int tty_line = 0;
387 int len;
388 char *str, *stp;
389
390 for (str = name; *str; str++)
391 if ((*str >= '0' && *str <= '9') || *str == ',')
392 break;
393 if (!*str)
394 return NULL;
395
396 len = str - name;
397 tty_line = simple_strtoul(str, &str, 10);
398
399 mutex_lock(&tty_mutex);
400 /* Search through the tty devices to look for a match */
401 list_for_each_entry(p, &tty_drivers, tty_drivers) {
402 if (!len || strncmp(name, p->name, len) != 0)
403 continue;
404 stp = str;
405 if (*stp == ',')
406 stp++;
407 if (*stp == '\0')
408 stp = NULL;
409
410 if (tty_line >= 0 && tty_line < p->num && p->ops &&
411 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
412 res = tty_driver_kref_get(p);
413 *line = tty_line;
414 break;
415 }
416 }
417 mutex_unlock(&tty_mutex);
418
419 return res;
420}
421EXPORT_SYMBOL_GPL(tty_find_polling_driver);
422#endif
423
424static ssize_t hung_up_tty_read(struct kiocb *iocb, struct iov_iter *to)
425{
426 return 0;
427}
428
429static ssize_t hung_up_tty_write(struct kiocb *iocb, struct iov_iter *from)
430{
431 return -EIO;
432}
433
434/* No kernel lock held - none needed ;) */
435static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
436{
437 return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
438}
439
440static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
441 unsigned long arg)
442{
443 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
444}
445
446static long hung_up_tty_compat_ioctl(struct file *file,
447 unsigned int cmd, unsigned long arg)
448{
449 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
450}
451
452static int hung_up_tty_fasync(int fd, struct file *file, int on)
453{
454 return -ENOTTY;
455}
456
457static void tty_show_fdinfo(struct seq_file *m, struct file *file)
458{
459 struct tty_struct *tty = file_tty(file);
460
461 if (tty && tty->ops && tty->ops->show_fdinfo)
462 tty->ops->show_fdinfo(tty, m);
463}
464
465static const struct file_operations tty_fops = {
466 .llseek = no_llseek,
467 .read_iter = tty_read,
468 .write_iter = tty_write,
469 .splice_read = generic_file_splice_read,
470 .splice_write = iter_file_splice_write,
471 .poll = tty_poll,
472 .unlocked_ioctl = tty_ioctl,
473 .compat_ioctl = tty_compat_ioctl,
474 .open = tty_open,
475 .release = tty_release,
476 .fasync = tty_fasync,
477 .show_fdinfo = tty_show_fdinfo,
478};
479
480static const struct file_operations console_fops = {
481 .llseek = no_llseek,
482 .read_iter = tty_read,
483 .write_iter = redirected_tty_write,
484 .splice_read = generic_file_splice_read,
485 .splice_write = iter_file_splice_write,
486 .poll = tty_poll,
487 .unlocked_ioctl = tty_ioctl,
488 .compat_ioctl = tty_compat_ioctl,
489 .open = tty_open,
490 .release = tty_release,
491 .fasync = tty_fasync,
492};
493
494static const struct file_operations hung_up_tty_fops = {
495 .llseek = no_llseek,
496 .read_iter = hung_up_tty_read,
497 .write_iter = hung_up_tty_write,
498 .poll = hung_up_tty_poll,
499 .unlocked_ioctl = hung_up_tty_ioctl,
500 .compat_ioctl = hung_up_tty_compat_ioctl,
501 .release = tty_release,
502 .fasync = hung_up_tty_fasync,
503};
504
505static DEFINE_SPINLOCK(redirect_lock);
506static struct file *redirect;
507
508/**
509 * tty_wakeup - request more data
510 * @tty: terminal
511 *
512 * Internal and external helper for wakeups of tty. This function informs the
513 * line discipline if present that the driver is ready to receive more output
514 * data.
515 */
516void tty_wakeup(struct tty_struct *tty)
517{
518 struct tty_ldisc *ld;
519
520 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
521 ld = tty_ldisc_ref(tty);
522 if (ld) {
523 if (ld->ops->write_wakeup)
524 ld->ops->write_wakeup(tty);
525 tty_ldisc_deref(ld);
526 }
527 }
528 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
529}
530EXPORT_SYMBOL_GPL(tty_wakeup);
531
532/**
533 * tty_release_redirect - Release a redirect on a pty if present
534 * @tty: tty device
535 *
536 * This is available to the pty code so if the master closes, if the slave is a
537 * redirect it can release the redirect.
538 */
539static struct file *tty_release_redirect(struct tty_struct *tty)
540{
541 struct file *f = NULL;
542
543 spin_lock(&redirect_lock);
544 if (redirect && file_tty(redirect) == tty) {
545 f = redirect;
546 redirect = NULL;
547 }
548 spin_unlock(&redirect_lock);
549
550 return f;
551}
552
553/**
554 * __tty_hangup - actual handler for hangup events
555 * @tty: tty device
556 * @exit_session: if non-zero, signal all foreground group processes
557 *
558 * This can be called by a "kworker" kernel thread. That is process synchronous
559 * but doesn't hold any locks, so we need to make sure we have the appropriate
560 * locks for what we're doing.
561 *
562 * The hangup event clears any pending redirections onto the hung up device. It
563 * ensures future writes will error and it does the needed line discipline
564 * hangup and signal delivery. The tty object itself remains intact.
565 *
566 * Locking:
567 * * BTM
568 *
569 * * redirect lock for undoing redirection
570 * * file list lock for manipulating list of ttys
571 * * tty_ldiscs_lock from called functions
572 * * termios_rwsem resetting termios data
573 * * tasklist_lock to walk task list for hangup event
574 *
575 * * ->siglock to protect ->signal/->sighand
576 *
577 */
578static void __tty_hangup(struct tty_struct *tty, int exit_session)
579{
580 struct file *cons_filp = NULL;
581 struct file *filp, *f;
582 struct tty_file_private *priv;
583 int closecount = 0, n;
584 int refs;
585
586 if (!tty)
587 return;
588
589 f = tty_release_redirect(tty);
590
591 tty_lock(tty);
592
593 if (test_bit(TTY_HUPPED, &tty->flags)) {
594 tty_unlock(tty);
595 return;
596 }
597
598 /*
599 * Some console devices aren't actually hung up for technical and
600 * historical reasons, which can lead to indefinite interruptible
601 * sleep in n_tty_read(). The following explicitly tells
602 * n_tty_read() to abort readers.
603 */
604 set_bit(TTY_HUPPING, &tty->flags);
605
606 /* inuse_filps is protected by the single tty lock,
607 * this really needs to change if we want to flush the
608 * workqueue with the lock held.
609 */
610 check_tty_count(tty, "tty_hangup");
611
612 spin_lock(&tty->files_lock);
613 /* This breaks for file handles being sent over AF_UNIX sockets ? */
614 list_for_each_entry(priv, &tty->tty_files, list) {
615 filp = priv->file;
616 if (filp->f_op->write_iter == redirected_tty_write)
617 cons_filp = filp;
618 if (filp->f_op->write_iter != tty_write)
619 continue;
620 closecount++;
621 __tty_fasync(-1, filp, 0); /* can't block */
622 filp->f_op = &hung_up_tty_fops;
623 }
624 spin_unlock(&tty->files_lock);
625
626 refs = tty_signal_session_leader(tty, exit_session);
627 /* Account for the p->signal references we killed */
628 while (refs--)
629 tty_kref_put(tty);
630
631 tty_ldisc_hangup(tty, cons_filp != NULL);
632
633 spin_lock_irq(&tty->ctrl.lock);
634 clear_bit(TTY_THROTTLED, &tty->flags);
635 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
636 put_pid(tty->ctrl.session);
637 put_pid(tty->ctrl.pgrp);
638 tty->ctrl.session = NULL;
639 tty->ctrl.pgrp = NULL;
640 tty->ctrl.pktstatus = 0;
641 spin_unlock_irq(&tty->ctrl.lock);
642
643 /*
644 * If one of the devices matches a console pointer, we
645 * cannot just call hangup() because that will cause
646 * tty->count and state->count to go out of sync.
647 * So we just call close() the right number of times.
648 */
649 if (cons_filp) {
650 if (tty->ops->close)
651 for (n = 0; n < closecount; n++)
652 tty->ops->close(tty, cons_filp);
653 } else if (tty->ops->hangup)
654 tty->ops->hangup(tty);
655 /*
656 * We don't want to have driver/ldisc interactions beyond the ones
657 * we did here. The driver layer expects no calls after ->hangup()
658 * from the ldisc side, which is now guaranteed.
659 */
660 set_bit(TTY_HUPPED, &tty->flags);
661 clear_bit(TTY_HUPPING, &tty->flags);
662 tty_unlock(tty);
663
664 if (f)
665 fput(f);
666}
667
668static void do_tty_hangup(struct work_struct *work)
669{
670 struct tty_struct *tty =
671 container_of(work, struct tty_struct, hangup_work);
672
673 __tty_hangup(tty, 0);
674}
675
676/**
677 * tty_hangup - trigger a hangup event
678 * @tty: tty to hangup
679 *
680 * A carrier loss (virtual or otherwise) has occurred on @tty. Schedule a
681 * hangup sequence to run after this event.
682 */
683void tty_hangup(struct tty_struct *tty)
684{
685 tty_debug_hangup(tty, "hangup\n");
686 schedule_work(&tty->hangup_work);
687}
688EXPORT_SYMBOL(tty_hangup);
689
690/**
691 * tty_vhangup - process vhangup
692 * @tty: tty to hangup
693 *
694 * The user has asked via system call for the terminal to be hung up. We do
695 * this synchronously so that when the syscall returns the process is complete.
696 * That guarantee is necessary for security reasons.
697 */
698void tty_vhangup(struct tty_struct *tty)
699{
700 tty_debug_hangup(tty, "vhangup\n");
701 __tty_hangup(tty, 0);
702}
703EXPORT_SYMBOL(tty_vhangup);
704
705
706/**
707 * tty_vhangup_self - process vhangup for own ctty
708 *
709 * Perform a vhangup on the current controlling tty
710 */
711void tty_vhangup_self(void)
712{
713 struct tty_struct *tty;
714
715 tty = get_current_tty();
716 if (tty) {
717 tty_vhangup(tty);
718 tty_kref_put(tty);
719 }
720}
721
722/**
723 * tty_vhangup_session - hangup session leader exit
724 * @tty: tty to hangup
725 *
726 * The session leader is exiting and hanging up its controlling terminal.
727 * Every process in the foreground process group is signalled %SIGHUP.
728 *
729 * We do this synchronously so that when the syscall returns the process is
730 * complete. That guarantee is necessary for security reasons.
731 */
732void tty_vhangup_session(struct tty_struct *tty)
733{
734 tty_debug_hangup(tty, "session hangup\n");
735 __tty_hangup(tty, 1);
736}
737
738/**
739 * tty_hung_up_p - was tty hung up
740 * @filp: file pointer of tty
741 *
742 * Return: true if the tty has been subject to a vhangup or a carrier loss
743 */
744int tty_hung_up_p(struct file *filp)
745{
746 return (filp && filp->f_op == &hung_up_tty_fops);
747}
748EXPORT_SYMBOL(tty_hung_up_p);
749
750void __stop_tty(struct tty_struct *tty)
751{
752 if (tty->flow.stopped)
753 return;
754 tty->flow.stopped = true;
755 if (tty->ops->stop)
756 tty->ops->stop(tty);
757}
758
759/**
760 * stop_tty - propagate flow control
761 * @tty: tty to stop
762 *
763 * Perform flow control to the driver. May be called on an already stopped
764 * device and will not re-call the &tty_driver->stop() method.
765 *
766 * This functionality is used by both the line disciplines for halting incoming
767 * flow and by the driver. It may therefore be called from any context, may be
768 * under the tty %atomic_write_lock but not always.
769 *
770 * Locking:
771 * flow.lock
772 */
773void stop_tty(struct tty_struct *tty)
774{
775 unsigned long flags;
776
777 spin_lock_irqsave(&tty->flow.lock, flags);
778 __stop_tty(tty);
779 spin_unlock_irqrestore(&tty->flow.lock, flags);
780}
781EXPORT_SYMBOL(stop_tty);
782
783void __start_tty(struct tty_struct *tty)
784{
785 if (!tty->flow.stopped || tty->flow.tco_stopped)
786 return;
787 tty->flow.stopped = false;
788 if (tty->ops->start)
789 tty->ops->start(tty);
790 tty_wakeup(tty);
791}
792
793/**
794 * start_tty - propagate flow control
795 * @tty: tty to start
796 *
797 * Start a tty that has been stopped if at all possible. If @tty was previously
798 * stopped and is now being started, the &tty_driver->start() method is invoked
799 * and the line discipline woken.
800 *
801 * Locking:
802 * flow.lock
803 */
804void start_tty(struct tty_struct *tty)
805{
806 unsigned long flags;
807
808 spin_lock_irqsave(&tty->flow.lock, flags);
809 __start_tty(tty);
810 spin_unlock_irqrestore(&tty->flow.lock, flags);
811}
812EXPORT_SYMBOL(start_tty);
813
814static void tty_update_time(struct timespec64 *time)
815{
816 time64_t sec = ktime_get_real_seconds();
817
818 /*
819 * We only care if the two values differ in anything other than the
820 * lower three bits (i.e every 8 seconds). If so, then we can update
821 * the time of the tty device, otherwise it could be construded as a
822 * security leak to let userspace know the exact timing of the tty.
823 */
824 if ((sec ^ time->tv_sec) & ~7)
825 time->tv_sec = sec;
826}
827
828/*
829 * Iterate on the ldisc ->read() function until we've gotten all
830 * the data the ldisc has for us.
831 *
832 * The "cookie" is something that the ldisc read function can fill
833 * in to let us know that there is more data to be had.
834 *
835 * We promise to continue to call the ldisc until it stops returning
836 * data or clears the cookie. The cookie may be something that the
837 * ldisc maintains state for and needs to free.
838 */
839static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty,
840 struct file *file, struct iov_iter *to)
841{
842 int retval = 0;
843 void *cookie = NULL;
844 unsigned long offset = 0;
845 char kernel_buf[64];
846 size_t count = iov_iter_count(to);
847
848 do {
849 int size, copied;
850
851 size = count > sizeof(kernel_buf) ? sizeof(kernel_buf) : count;
852 size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
853 if (!size)
854 break;
855
856 if (size < 0) {
857 /* Did we have an earlier error (ie -EFAULT)? */
858 if (retval)
859 break;
860 retval = size;
861
862 /*
863 * -EOVERFLOW means we didn't have enough space
864 * for a whole packet, and we shouldn't return
865 * a partial result.
866 */
867 if (retval == -EOVERFLOW)
868 offset = 0;
869 break;
870 }
871
872 copied = copy_to_iter(kernel_buf, size, to);
873 offset += copied;
874 count -= copied;
875
876 /*
877 * If the user copy failed, we still need to do another ->read()
878 * call if we had a cookie to let the ldisc clear up.
879 *
880 * But make sure size is zeroed.
881 */
882 if (unlikely(copied != size)) {
883 count = 0;
884 retval = -EFAULT;
885 }
886 } while (cookie);
887
888 /* We always clear tty buffer in case they contained passwords */
889 memzero_explicit(kernel_buf, sizeof(kernel_buf));
890 return offset ? offset : retval;
891}
892
893
894/**
895 * tty_read - read method for tty device files
896 * @iocb: kernel I/O control block
897 * @to: destination for the data read
898 *
899 * Perform the read system call function on this terminal device. Checks
900 * for hung up devices before calling the line discipline method.
901 *
902 * Locking:
903 * Locks the line discipline internally while needed. Multiple read calls
904 * may be outstanding in parallel.
905 */
906static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
907{
908 int i;
909 struct file *file = iocb->ki_filp;
910 struct inode *inode = file_inode(file);
911 struct tty_struct *tty = file_tty(file);
912 struct tty_ldisc *ld;
913
914 if (tty_paranoia_check(tty, inode, "tty_read"))
915 return -EIO;
916 if (!tty || tty_io_error(tty))
917 return -EIO;
918
919 /* We want to wait for the line discipline to sort out in this
920 * situation.
921 */
922 ld = tty_ldisc_ref_wait(tty);
923 if (!ld)
924 return hung_up_tty_read(iocb, to);
925 i = -EIO;
926 if (ld->ops->read)
927 i = iterate_tty_read(ld, tty, file, to);
928 tty_ldisc_deref(ld);
929
930 if (i > 0)
931 tty_update_time(&inode->i_atime);
932
933 return i;
934}
935
936static void tty_write_unlock(struct tty_struct *tty)
937{
938 mutex_unlock(&tty->atomic_write_lock);
939 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
940}
941
942static int tty_write_lock(struct tty_struct *tty, int ndelay)
943{
944 if (!mutex_trylock(&tty->atomic_write_lock)) {
945 if (ndelay)
946 return -EAGAIN;
947 if (mutex_lock_interruptible(&tty->atomic_write_lock))
948 return -ERESTARTSYS;
949 }
950 return 0;
951}
952
953/*
954 * Split writes up in sane blocksizes to avoid
955 * denial-of-service type attacks
956 */
957static inline ssize_t do_tty_write(
958 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
959 struct tty_struct *tty,
960 struct file *file,
961 struct iov_iter *from)
962{
963 size_t count = iov_iter_count(from);
964 ssize_t ret, written = 0;
965 unsigned int chunk;
966
967 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
968 if (ret < 0)
969 return ret;
970
971 /*
972 * We chunk up writes into a temporary buffer. This
973 * simplifies low-level drivers immensely, since they
974 * don't have locking issues and user mode accesses.
975 *
976 * But if TTY_NO_WRITE_SPLIT is set, we should use a
977 * big chunk-size..
978 *
979 * The default chunk-size is 2kB, because the NTTY
980 * layer has problems with bigger chunks. It will
981 * claim to be able to handle more characters than
982 * it actually does.
983 */
984 chunk = 2048;
985 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
986 chunk = 65536;
987 if (count < chunk)
988 chunk = count;
989
990 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
991 if (tty->write_cnt < chunk) {
992 unsigned char *buf_chunk;
993
994 if (chunk < 1024)
995 chunk = 1024;
996
997 buf_chunk = kvmalloc(chunk, GFP_KERNEL | __GFP_RETRY_MAYFAIL);
998 if (!buf_chunk) {
999 ret = -ENOMEM;
1000 goto out;
1001 }
1002 kvfree(tty->write_buf);
1003 tty->write_cnt = chunk;
1004 tty->write_buf = buf_chunk;
1005 }
1006
1007 /* Do the write .. */
1008 for (;;) {
1009 size_t size = count;
1010
1011 if (size > chunk)
1012 size = chunk;
1013
1014 ret = -EFAULT;
1015 if (copy_from_iter(tty->write_buf, size, from) != size)
1016 break;
1017
1018 ret = write(tty, file, tty->write_buf, size);
1019 if (ret <= 0)
1020 break;
1021
1022 written += ret;
1023 if (ret > size)
1024 break;
1025
1026 /* FIXME! Have Al check this! */
1027 if (ret != size)
1028 iov_iter_revert(from, size-ret);
1029
1030 count -= ret;
1031 if (!count)
1032 break;
1033 ret = -ERESTARTSYS;
1034 if (signal_pending(current))
1035 break;
1036 cond_resched();
1037 }
1038 if (written) {
1039 tty_update_time(&file_inode(file)->i_mtime);
1040 ret = written;
1041 }
1042out:
1043 tty_write_unlock(tty);
1044 return ret;
1045}
1046
1047/**
1048 * tty_write_message - write a message to a certain tty, not just the console.
1049 * @tty: the destination tty_struct
1050 * @msg: the message to write
1051 *
1052 * This is used for messages that need to be redirected to a specific tty. We
1053 * don't put it into the syslog queue right now maybe in the future if really
1054 * needed.
1055 *
1056 * We must still hold the BTM and test the CLOSING flag for the moment.
1057 */
1058void tty_write_message(struct tty_struct *tty, char *msg)
1059{
1060 if (tty) {
1061 mutex_lock(&tty->atomic_write_lock);
1062 tty_lock(tty);
1063 if (tty->ops->write && tty->count > 0)
1064 tty->ops->write(tty, msg, strlen(msg));
1065 tty_unlock(tty);
1066 tty_write_unlock(tty);
1067 }
1068}
1069
1070static ssize_t file_tty_write(struct file *file, struct kiocb *iocb, struct iov_iter *from)
1071{
1072 struct tty_struct *tty = file_tty(file);
1073 struct tty_ldisc *ld;
1074 ssize_t ret;
1075
1076 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1077 return -EIO;
1078 if (!tty || !tty->ops->write || tty_io_error(tty))
1079 return -EIO;
1080 /* Short term debug to catch buggy drivers */
1081 if (tty->ops->write_room == NULL)
1082 tty_err(tty, "missing write_room method\n");
1083 ld = tty_ldisc_ref_wait(tty);
1084 if (!ld)
1085 return hung_up_tty_write(iocb, from);
1086 if (!ld->ops->write)
1087 ret = -EIO;
1088 else
1089 ret = do_tty_write(ld->ops->write, tty, file, from);
1090 tty_ldisc_deref(ld);
1091 return ret;
1092}
1093
1094/**
1095 * tty_write - write method for tty device file
1096 * @iocb: kernel I/O control block
1097 * @from: iov_iter with data to write
1098 *
1099 * Write data to a tty device via the line discipline.
1100 *
1101 * Locking:
1102 * Locks the line discipline as required
1103 * Writes to the tty driver are serialized by the atomic_write_lock
1104 * and are then processed in chunks to the device. The line
1105 * discipline write method will not be invoked in parallel for
1106 * each device.
1107 */
1108static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
1109{
1110 return file_tty_write(iocb->ki_filp, iocb, from);
1111}
1112
1113ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
1114{
1115 struct file *p = NULL;
1116
1117 spin_lock(&redirect_lock);
1118 if (redirect)
1119 p = get_file(redirect);
1120 spin_unlock(&redirect_lock);
1121
1122 /*
1123 * We know the redirected tty is just another tty, we can
1124 * call file_tty_write() directly with that file pointer.
1125 */
1126 if (p) {
1127 ssize_t res;
1128
1129 res = file_tty_write(p, iocb, iter);
1130 fput(p);
1131 return res;
1132 }
1133 return tty_write(iocb, iter);
1134}
1135
1136/**
1137 * tty_send_xchar - send priority character
1138 * @tty: the tty to send to
1139 * @ch: xchar to send
1140 *
1141 * Send a high priority character to the tty even if stopped.
1142 *
1143 * Locking: none for xchar method, write ordering for write method.
1144 */
1145int tty_send_xchar(struct tty_struct *tty, char ch)
1146{
1147 bool was_stopped = tty->flow.stopped;
1148
1149 if (tty->ops->send_xchar) {
1150 down_read(&tty->termios_rwsem);
1151 tty->ops->send_xchar(tty, ch);
1152 up_read(&tty->termios_rwsem);
1153 return 0;
1154 }
1155
1156 if (tty_write_lock(tty, 0) < 0)
1157 return -ERESTARTSYS;
1158
1159 down_read(&tty->termios_rwsem);
1160 if (was_stopped)
1161 start_tty(tty);
1162 tty->ops->write(tty, &ch, 1);
1163 if (was_stopped)
1164 stop_tty(tty);
1165 up_read(&tty->termios_rwsem);
1166 tty_write_unlock(tty);
1167 return 0;
1168}
1169
1170/**
1171 * pty_line_name - generate name for a pty
1172 * @driver: the tty driver in use
1173 * @index: the minor number
1174 * @p: output buffer of at least 6 bytes
1175 *
1176 * Generate a name from a @driver reference and write it to the output buffer
1177 * @p.
1178 *
1179 * Locking: None
1180 */
1181static void pty_line_name(struct tty_driver *driver, int index, char *p)
1182{
1183 static const char ptychar[] = "pqrstuvwxyzabcde";
1184 int i = index + driver->name_base;
1185 /* ->name is initialized to "ttyp", but "tty" is expected */
1186 sprintf(p, "%s%c%x",
1187 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1188 ptychar[i >> 4 & 0xf], i & 0xf);
1189}
1190
1191/**
1192 * tty_line_name - generate name for a tty
1193 * @driver: the tty driver in use
1194 * @index: the minor number
1195 * @p: output buffer of at least 7 bytes
1196 *
1197 * Generate a name from a @driver reference and write it to the output buffer
1198 * @p.
1199 *
1200 * Locking: None
1201 */
1202static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1203{
1204 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1205 return sprintf(p, "%s", driver->name);
1206 else
1207 return sprintf(p, "%s%d", driver->name,
1208 index + driver->name_base);
1209}
1210
1211/**
1212 * tty_driver_lookup_tty() - find an existing tty, if any
1213 * @driver: the driver for the tty
1214 * @file: file object
1215 * @idx: the minor number
1216 *
1217 * Return: the tty, if found. If not found, return %NULL or ERR_PTR() if the
1218 * driver lookup() method returns an error.
1219 *
1220 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1221 */
1222static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1223 struct file *file, int idx)
1224{
1225 struct tty_struct *tty;
1226
1227 if (driver->ops->lookup)
1228 if (!file)
1229 tty = ERR_PTR(-EIO);
1230 else
1231 tty = driver->ops->lookup(driver, file, idx);
1232 else
1233 tty = driver->ttys[idx];
1234
1235 if (!IS_ERR(tty))
1236 tty_kref_get(tty);
1237 return tty;
1238}
1239
1240/**
1241 * tty_init_termios - helper for termios setup
1242 * @tty: the tty to set up
1243 *
1244 * Initialise the termios structure for this tty. This runs under the
1245 * %tty_mutex currently so we can be relaxed about ordering.
1246 */
1247void tty_init_termios(struct tty_struct *tty)
1248{
1249 struct ktermios *tp;
1250 int idx = tty->index;
1251
1252 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1253 tty->termios = tty->driver->init_termios;
1254 else {
1255 /* Check for lazy saved data */
1256 tp = tty->driver->termios[idx];
1257 if (tp != NULL) {
1258 tty->termios = *tp;
1259 tty->termios.c_line = tty->driver->init_termios.c_line;
1260 } else
1261 tty->termios = tty->driver->init_termios;
1262 }
1263 /* Compatibility until drivers always set this */
1264 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1265 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1266}
1267EXPORT_SYMBOL_GPL(tty_init_termios);
1268
1269/**
1270 * tty_standard_install - usual tty->ops->install
1271 * @driver: the driver for the tty
1272 * @tty: the tty
1273 *
1274 * If the @driver overrides @tty->ops->install, it still can call this function
1275 * to perform the standard install operations.
1276 */
1277int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1278{
1279 tty_init_termios(tty);
1280 tty_driver_kref_get(driver);
1281 tty->count++;
1282 driver->ttys[tty->index] = tty;
1283 return 0;
1284}
1285EXPORT_SYMBOL_GPL(tty_standard_install);
1286
1287/**
1288 * tty_driver_install_tty() - install a tty entry in the driver
1289 * @driver: the driver for the tty
1290 * @tty: the tty
1291 *
1292 * Install a tty object into the driver tables. The @tty->index field will be
1293 * set by the time this is called. This method is responsible for ensuring any
1294 * need additional structures are allocated and configured.
1295 *
1296 * Locking: tty_mutex for now
1297 */
1298static int tty_driver_install_tty(struct tty_driver *driver,
1299 struct tty_struct *tty)
1300{
1301 return driver->ops->install ? driver->ops->install(driver, tty) :
1302 tty_standard_install(driver, tty);
1303}
1304
1305/**
1306 * tty_driver_remove_tty() - remove a tty from the driver tables
1307 * @driver: the driver for the tty
1308 * @tty: tty to remove
1309 *
1310 * Remove a tty object from the driver tables. The tty->index field will be set
1311 * by the time this is called.
1312 *
1313 * Locking: tty_mutex for now
1314 */
1315static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1316{
1317 if (driver->ops->remove)
1318 driver->ops->remove(driver, tty);
1319 else
1320 driver->ttys[tty->index] = NULL;
1321}
1322
1323/**
1324 * tty_reopen() - fast re-open of an open tty
1325 * @tty: the tty to open
1326 *
1327 * Re-opens on master ptys are not allowed and return -%EIO.
1328 *
1329 * Locking: Caller must hold tty_lock
1330 * Return: 0 on success, -errno on error.
1331 */
1332static int tty_reopen(struct tty_struct *tty)
1333{
1334 struct tty_driver *driver = tty->driver;
1335 struct tty_ldisc *ld;
1336 int retval = 0;
1337
1338 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1339 driver->subtype == PTY_TYPE_MASTER)
1340 return -EIO;
1341
1342 if (!tty->count)
1343 return -EAGAIN;
1344
1345 if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1346 return -EBUSY;
1347
1348 ld = tty_ldisc_ref_wait(tty);
1349 if (ld) {
1350 tty_ldisc_deref(ld);
1351 } else {
1352 retval = tty_ldisc_lock(tty, 5 * HZ);
1353 if (retval)
1354 return retval;
1355
1356 if (!tty->ldisc)
1357 retval = tty_ldisc_reinit(tty, tty->termios.c_line);
1358 tty_ldisc_unlock(tty);
1359 }
1360
1361 if (retval == 0)
1362 tty->count++;
1363
1364 return retval;
1365}
1366
1367/**
1368 * tty_init_dev - initialise a tty device
1369 * @driver: tty driver we are opening a device on
1370 * @idx: device index
1371 *
1372 * Prepare a tty device. This may not be a "new" clean device but could also be
1373 * an active device. The pty drivers require special handling because of this.
1374 *
1375 * Locking:
1376 * The function is called under the tty_mutex, which protects us from the
1377 * tty struct or driver itself going away.
1378 *
1379 * On exit the tty device has the line discipline attached and a reference
1380 * count of 1. If a pair was created for pty/tty use and the other was a pty
1381 * master then it too has a reference count of 1.
1382 *
1383 * WSH 06/09/97: Rewritten to remove races and properly clean up after a failed
1384 * open. The new code protects the open with a mutex, so it's really quite
1385 * straightforward. The mutex locking can probably be relaxed for the (most
1386 * common) case of reopening a tty.
1387 *
1388 * Return: new tty structure
1389 */
1390struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1391{
1392 struct tty_struct *tty;
1393 int retval;
1394
1395 /*
1396 * First time open is complex, especially for PTY devices.
1397 * This code guarantees that either everything succeeds and the
1398 * TTY is ready for operation, or else the table slots are vacated
1399 * and the allocated memory released. (Except that the termios
1400 * may be retained.)
1401 */
1402
1403 if (!try_module_get(driver->owner))
1404 return ERR_PTR(-ENODEV);
1405
1406 tty = alloc_tty_struct(driver, idx);
1407 if (!tty) {
1408 retval = -ENOMEM;
1409 goto err_module_put;
1410 }
1411
1412 tty_lock(tty);
1413 retval = tty_driver_install_tty(driver, tty);
1414 if (retval < 0)
1415 goto err_free_tty;
1416
1417 if (!tty->port)
1418 tty->port = driver->ports[idx];
1419
1420 if (WARN_RATELIMIT(!tty->port,
1421 "%s: %s driver does not set tty->port. This would crash the kernel. Fix the driver!\n",
1422 __func__, tty->driver->name)) {
1423 retval = -EINVAL;
1424 goto err_release_lock;
1425 }
1426
1427 retval = tty_ldisc_lock(tty, 5 * HZ);
1428 if (retval)
1429 goto err_release_lock;
1430 tty->port->itty = tty;
1431
1432 /*
1433 * Structures all installed ... call the ldisc open routines.
1434 * If we fail here just call release_tty to clean up. No need
1435 * to decrement the use counts, as release_tty doesn't care.
1436 */
1437 retval = tty_ldisc_setup(tty, tty->link);
1438 if (retval)
1439 goto err_release_tty;
1440 tty_ldisc_unlock(tty);
1441 /* Return the tty locked so that it cannot vanish under the caller */
1442 return tty;
1443
1444err_free_tty:
1445 tty_unlock(tty);
1446 free_tty_struct(tty);
1447err_module_put:
1448 module_put(driver->owner);
1449 return ERR_PTR(retval);
1450
1451 /* call the tty release_tty routine to clean out this slot */
1452err_release_tty:
1453 tty_ldisc_unlock(tty);
1454 tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1455 retval, idx);
1456err_release_lock:
1457 tty_unlock(tty);
1458 release_tty(tty, idx);
1459 return ERR_PTR(retval);
1460}
1461
1462/**
1463 * tty_save_termios() - save tty termios data in driver table
1464 * @tty: tty whose termios data to save
1465 *
1466 * Locking: Caller guarantees serialisation with tty_init_termios().
1467 */
1468void tty_save_termios(struct tty_struct *tty)
1469{
1470 struct ktermios *tp;
1471 int idx = tty->index;
1472
1473 /* If the port is going to reset then it has no termios to save */
1474 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1475 return;
1476
1477 /* Stash the termios data */
1478 tp = tty->driver->termios[idx];
1479 if (tp == NULL) {
1480 tp = kmalloc(sizeof(*tp), GFP_KERNEL);
1481 if (tp == NULL)
1482 return;
1483 tty->driver->termios[idx] = tp;
1484 }
1485 *tp = tty->termios;
1486}
1487EXPORT_SYMBOL_GPL(tty_save_termios);
1488
1489/**
1490 * tty_flush_works - flush all works of a tty/pty pair
1491 * @tty: tty device to flush works for (or either end of a pty pair)
1492 *
1493 * Sync flush all works belonging to @tty (and the 'other' tty).
1494 */
1495static void tty_flush_works(struct tty_struct *tty)
1496{
1497 flush_work(&tty->SAK_work);
1498 flush_work(&tty->hangup_work);
1499 if (tty->link) {
1500 flush_work(&tty->link->SAK_work);
1501 flush_work(&tty->link->hangup_work);
1502 }
1503}
1504
1505/**
1506 * release_one_tty - release tty structure memory
1507 * @work: work of tty we are obliterating
1508 *
1509 * Releases memory associated with a tty structure, and clears out the
1510 * driver table slots. This function is called when a device is no longer
1511 * in use. It also gets called when setup of a device fails.
1512 *
1513 * Locking:
1514 * takes the file list lock internally when working on the list of ttys
1515 * that the driver keeps.
1516 *
1517 * This method gets called from a work queue so that the driver private
1518 * cleanup ops can sleep (needed for USB at least)
1519 */
1520static void release_one_tty(struct work_struct *work)
1521{
1522 struct tty_struct *tty =
1523 container_of(work, struct tty_struct, hangup_work);
1524 struct tty_driver *driver = tty->driver;
1525 struct module *owner = driver->owner;
1526
1527 if (tty->ops->cleanup)
1528 tty->ops->cleanup(tty);
1529
1530 tty_driver_kref_put(driver);
1531 module_put(owner);
1532
1533 spin_lock(&tty->files_lock);
1534 list_del_init(&tty->tty_files);
1535 spin_unlock(&tty->files_lock);
1536
1537 put_pid(tty->ctrl.pgrp);
1538 put_pid(tty->ctrl.session);
1539 free_tty_struct(tty);
1540}
1541
1542static void queue_release_one_tty(struct kref *kref)
1543{
1544 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1545
1546 /* The hangup queue is now free so we can reuse it rather than
1547 * waste a chunk of memory for each port.
1548 */
1549 INIT_WORK(&tty->hangup_work, release_one_tty);
1550 schedule_work(&tty->hangup_work);
1551}
1552
1553/**
1554 * tty_kref_put - release a tty kref
1555 * @tty: tty device
1556 *
1557 * Release a reference to the @tty device and if need be let the kref layer
1558 * destruct the object for us.
1559 */
1560void tty_kref_put(struct tty_struct *tty)
1561{
1562 if (tty)
1563 kref_put(&tty->kref, queue_release_one_tty);
1564}
1565EXPORT_SYMBOL(tty_kref_put);
1566
1567/**
1568 * release_tty - release tty structure memory
1569 * @tty: tty device release
1570 * @idx: index of the tty device release
1571 *
1572 * Release both @tty and a possible linked partner (think pty pair),
1573 * and decrement the refcount of the backing module.
1574 *
1575 * Locking:
1576 * tty_mutex
1577 * takes the file list lock internally when working on the list of ttys
1578 * that the driver keeps.
1579 */
1580static void release_tty(struct tty_struct *tty, int idx)
1581{
1582 /* This should always be true but check for the moment */
1583 WARN_ON(tty->index != idx);
1584 WARN_ON(!mutex_is_locked(&tty_mutex));
1585 if (tty->ops->shutdown)
1586 tty->ops->shutdown(tty);
1587 tty_save_termios(tty);
1588 tty_driver_remove_tty(tty->driver, tty);
1589 if (tty->port)
1590 tty->port->itty = NULL;
1591 if (tty->link)
1592 tty->link->port->itty = NULL;
1593 if (tty->port)
1594 tty_buffer_cancel_work(tty->port);
1595 if (tty->link)
1596 tty_buffer_cancel_work(tty->link->port);
1597
1598 tty_kref_put(tty->link);
1599 tty_kref_put(tty);
1600}
1601
1602/**
1603 * tty_release_checks - check a tty before real release
1604 * @tty: tty to check
1605 * @idx: index of the tty
1606 *
1607 * Performs some paranoid checking before true release of the @tty. This is a
1608 * no-op unless %TTY_PARANOIA_CHECK is defined.
1609 */
1610static int tty_release_checks(struct tty_struct *tty, int idx)
1611{
1612#ifdef TTY_PARANOIA_CHECK
1613 if (idx < 0 || idx >= tty->driver->num) {
1614 tty_debug(tty, "bad idx %d\n", idx);
1615 return -1;
1616 }
1617
1618 /* not much to check for devpts */
1619 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1620 return 0;
1621
1622 if (tty != tty->driver->ttys[idx]) {
1623 tty_debug(tty, "bad driver table[%d] = %p\n",
1624 idx, tty->driver->ttys[idx]);
1625 return -1;
1626 }
1627 if (tty->driver->other) {
1628 struct tty_struct *o_tty = tty->link;
1629
1630 if (o_tty != tty->driver->other->ttys[idx]) {
1631 tty_debug(tty, "bad other table[%d] = %p\n",
1632 idx, tty->driver->other->ttys[idx]);
1633 return -1;
1634 }
1635 if (o_tty->link != tty) {
1636 tty_debug(tty, "bad link = %p\n", o_tty->link);
1637 return -1;
1638 }
1639 }
1640#endif
1641 return 0;
1642}
1643
1644/**
1645 * tty_kclose - closes tty opened by tty_kopen
1646 * @tty: tty device
1647 *
1648 * Performs the final steps to release and free a tty device. It is the same as
1649 * tty_release_struct() except that it also resets %TTY_PORT_KOPENED flag on
1650 * @tty->port.
1651 */
1652void tty_kclose(struct tty_struct *tty)
1653{
1654 /*
1655 * Ask the line discipline code to release its structures
1656 */
1657 tty_ldisc_release(tty);
1658
1659 /* Wait for pending work before tty destruction commences */
1660 tty_flush_works(tty);
1661
1662 tty_debug_hangup(tty, "freeing structure\n");
1663 /*
1664 * The release_tty function takes care of the details of clearing
1665 * the slots and preserving the termios structure.
1666 */
1667 mutex_lock(&tty_mutex);
1668 tty_port_set_kopened(tty->port, 0);
1669 release_tty(tty, tty->index);
1670 mutex_unlock(&tty_mutex);
1671}
1672EXPORT_SYMBOL_GPL(tty_kclose);
1673
1674/**
1675 * tty_release_struct - release a tty struct
1676 * @tty: tty device
1677 * @idx: index of the tty
1678 *
1679 * Performs the final steps to release and free a tty device. It is roughly the
1680 * reverse of tty_init_dev().
1681 */
1682void tty_release_struct(struct tty_struct *tty, int idx)
1683{
1684 /*
1685 * Ask the line discipline code to release its structures
1686 */
1687 tty_ldisc_release(tty);
1688
1689 /* Wait for pending work before tty destruction commmences */
1690 tty_flush_works(tty);
1691
1692 tty_debug_hangup(tty, "freeing structure\n");
1693 /*
1694 * The release_tty function takes care of the details of clearing
1695 * the slots and preserving the termios structure.
1696 */
1697 mutex_lock(&tty_mutex);
1698 release_tty(tty, idx);
1699 mutex_unlock(&tty_mutex);
1700}
1701EXPORT_SYMBOL_GPL(tty_release_struct);
1702
1703/**
1704 * tty_release - vfs callback for close
1705 * @inode: inode of tty
1706 * @filp: file pointer for handle to tty
1707 *
1708 * Called the last time each file handle is closed that references this tty.
1709 * There may however be several such references.
1710 *
1711 * Locking:
1712 * Takes BKL. See tty_release_dev().
1713 *
1714 * Even releasing the tty structures is a tricky business. We have to be very
1715 * careful that the structures are all released at the same time, as interrupts
1716 * might otherwise get the wrong pointers.
1717 *
1718 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1719 * lead to double frees or releasing memory still in use.
1720 */
1721int tty_release(struct inode *inode, struct file *filp)
1722{
1723 struct tty_struct *tty = file_tty(filp);
1724 struct tty_struct *o_tty = NULL;
1725 int do_sleep, final;
1726 int idx;
1727 long timeout = 0;
1728 int once = 1;
1729
1730 if (tty_paranoia_check(tty, inode, __func__))
1731 return 0;
1732
1733 tty_lock(tty);
1734 check_tty_count(tty, __func__);
1735
1736 __tty_fasync(-1, filp, 0);
1737
1738 idx = tty->index;
1739 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1740 tty->driver->subtype == PTY_TYPE_MASTER)
1741 o_tty = tty->link;
1742
1743 if (tty_release_checks(tty, idx)) {
1744 tty_unlock(tty);
1745 return 0;
1746 }
1747
1748 tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1749
1750 if (tty->ops->close)
1751 tty->ops->close(tty, filp);
1752
1753 /* If tty is pty master, lock the slave pty (stable lock order) */
1754 tty_lock_slave(o_tty);
1755
1756 /*
1757 * Sanity check: if tty->count is going to zero, there shouldn't be
1758 * any waiters on tty->read_wait or tty->write_wait. We test the
1759 * wait queues and kick everyone out _before_ actually starting to
1760 * close. This ensures that we won't block while releasing the tty
1761 * structure.
1762 *
1763 * The test for the o_tty closing is necessary, since the master and
1764 * slave sides may close in any order. If the slave side closes out
1765 * first, its count will be one, since the master side holds an open.
1766 * Thus this test wouldn't be triggered at the time the slave closed,
1767 * so we do it now.
1768 */
1769 while (1) {
1770 do_sleep = 0;
1771
1772 if (tty->count <= 1) {
1773 if (waitqueue_active(&tty->read_wait)) {
1774 wake_up_poll(&tty->read_wait, EPOLLIN);
1775 do_sleep++;
1776 }
1777 if (waitqueue_active(&tty->write_wait)) {
1778 wake_up_poll(&tty->write_wait, EPOLLOUT);
1779 do_sleep++;
1780 }
1781 }
1782 if (o_tty && o_tty->count <= 1) {
1783 if (waitqueue_active(&o_tty->read_wait)) {
1784 wake_up_poll(&o_tty->read_wait, EPOLLIN);
1785 do_sleep++;
1786 }
1787 if (waitqueue_active(&o_tty->write_wait)) {
1788 wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1789 do_sleep++;
1790 }
1791 }
1792 if (!do_sleep)
1793 break;
1794
1795 if (once) {
1796 once = 0;
1797 tty_warn(tty, "read/write wait queue active!\n");
1798 }
1799 schedule_timeout_killable(timeout);
1800 if (timeout < 120 * HZ)
1801 timeout = 2 * timeout + 1;
1802 else
1803 timeout = MAX_SCHEDULE_TIMEOUT;
1804 }
1805
1806 if (o_tty) {
1807 if (--o_tty->count < 0) {
1808 tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1809 o_tty->count = 0;
1810 }
1811 }
1812 if (--tty->count < 0) {
1813 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1814 tty->count = 0;
1815 }
1816
1817 /*
1818 * We've decremented tty->count, so we need to remove this file
1819 * descriptor off the tty->tty_files list; this serves two
1820 * purposes:
1821 * - check_tty_count sees the correct number of file descriptors
1822 * associated with this tty.
1823 * - do_tty_hangup no longer sees this file descriptor as
1824 * something that needs to be handled for hangups.
1825 */
1826 tty_del_file(filp);
1827
1828 /*
1829 * Perform some housekeeping before deciding whether to return.
1830 *
1831 * If _either_ side is closing, make sure there aren't any
1832 * processes that still think tty or o_tty is their controlling
1833 * tty.
1834 */
1835 if (!tty->count) {
1836 read_lock(&tasklist_lock);
1837 session_clear_tty(tty->ctrl.session);
1838 if (o_tty)
1839 session_clear_tty(o_tty->ctrl.session);
1840 read_unlock(&tasklist_lock);
1841 }
1842
1843 /* check whether both sides are closing ... */
1844 final = !tty->count && !(o_tty && o_tty->count);
1845
1846 tty_unlock_slave(o_tty);
1847 tty_unlock(tty);
1848
1849 /* At this point, the tty->count == 0 should ensure a dead tty
1850 * cannot be re-opened by a racing opener.
1851 */
1852
1853 if (!final)
1854 return 0;
1855
1856 tty_debug_hangup(tty, "final close\n");
1857
1858 tty_release_struct(tty, idx);
1859 return 0;
1860}
1861
1862/**
1863 * tty_open_current_tty - get locked tty of current task
1864 * @device: device number
1865 * @filp: file pointer to tty
1866 * @return: locked tty of the current task iff @device is /dev/tty
1867 *
1868 * Performs a re-open of the current task's controlling tty.
1869 *
1870 * We cannot return driver and index like for the other nodes because devpts
1871 * will not work then. It expects inodes to be from devpts FS.
1872 */
1873static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1874{
1875 struct tty_struct *tty;
1876 int retval;
1877
1878 if (device != MKDEV(TTYAUX_MAJOR, 0))
1879 return NULL;
1880
1881 tty = get_current_tty();
1882 if (!tty)
1883 return ERR_PTR(-ENXIO);
1884
1885 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1886 /* noctty = 1; */
1887 tty_lock(tty);
1888 tty_kref_put(tty); /* safe to drop the kref now */
1889
1890 retval = tty_reopen(tty);
1891 if (retval < 0) {
1892 tty_unlock(tty);
1893 tty = ERR_PTR(retval);
1894 }
1895 return tty;
1896}
1897
1898/**
1899 * tty_lookup_driver - lookup a tty driver for a given device file
1900 * @device: device number
1901 * @filp: file pointer to tty
1902 * @index: index for the device in the @return driver
1903 *
1904 * If returned value is not erroneous, the caller is responsible to decrement
1905 * the refcount by tty_driver_kref_put().
1906 *
1907 * Locking: %tty_mutex protects get_tty_driver()
1908 *
1909 * Return: driver for this inode (with increased refcount)
1910 */
1911static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1912 int *index)
1913{
1914 struct tty_driver *driver = NULL;
1915
1916 switch (device) {
1917#ifdef CONFIG_VT
1918 case MKDEV(TTY_MAJOR, 0): {
1919 extern struct tty_driver *console_driver;
1920
1921 driver = tty_driver_kref_get(console_driver);
1922 *index = fg_console;
1923 break;
1924 }
1925#endif
1926 case MKDEV(TTYAUX_MAJOR, 1): {
1927 struct tty_driver *console_driver = console_device(index);
1928
1929 if (console_driver) {
1930 driver = tty_driver_kref_get(console_driver);
1931 if (driver && filp) {
1932 /* Don't let /dev/console block */
1933 filp->f_flags |= O_NONBLOCK;
1934 break;
1935 }
1936 }
1937 if (driver)
1938 tty_driver_kref_put(driver);
1939 return ERR_PTR(-ENODEV);
1940 }
1941 default:
1942 driver = get_tty_driver(device, index);
1943 if (!driver)
1944 return ERR_PTR(-ENODEV);
1945 break;
1946 }
1947 return driver;
1948}
1949
1950static struct tty_struct *tty_kopen(dev_t device, int shared)
1951{
1952 struct tty_struct *tty;
1953 struct tty_driver *driver;
1954 int index = -1;
1955
1956 mutex_lock(&tty_mutex);
1957 driver = tty_lookup_driver(device, NULL, &index);
1958 if (IS_ERR(driver)) {
1959 mutex_unlock(&tty_mutex);
1960 return ERR_CAST(driver);
1961 }
1962
1963 /* check whether we're reopening an existing tty */
1964 tty = tty_driver_lookup_tty(driver, NULL, index);
1965 if (IS_ERR(tty) || shared)
1966 goto out;
1967
1968 if (tty) {
1969 /* drop kref from tty_driver_lookup_tty() */
1970 tty_kref_put(tty);
1971 tty = ERR_PTR(-EBUSY);
1972 } else { /* tty_init_dev returns tty with the tty_lock held */
1973 tty = tty_init_dev(driver, index);
1974 if (IS_ERR(tty))
1975 goto out;
1976 tty_port_set_kopened(tty->port, 1);
1977 }
1978out:
1979 mutex_unlock(&tty_mutex);
1980 tty_driver_kref_put(driver);
1981 return tty;
1982}
1983
1984/**
1985 * tty_kopen_exclusive - open a tty device for kernel
1986 * @device: dev_t of device to open
1987 *
1988 * Opens tty exclusively for kernel. Performs the driver lookup, makes sure
1989 * it's not already opened and performs the first-time tty initialization.
1990 *
1991 * Claims the global %tty_mutex to serialize:
1992 * * concurrent first-time tty initialization
1993 * * concurrent tty driver removal w/ lookup
1994 * * concurrent tty removal from driver table
1995 *
1996 * Return: the locked initialized &tty_struct
1997 */
1998struct tty_struct *tty_kopen_exclusive(dev_t device)
1999{
2000 return tty_kopen(device, 0);
2001}
2002EXPORT_SYMBOL_GPL(tty_kopen_exclusive);
2003
2004/**
2005 * tty_kopen_shared - open a tty device for shared in-kernel use
2006 * @device: dev_t of device to open
2007 *
2008 * Opens an already existing tty for in-kernel use. Compared to
2009 * tty_kopen_exclusive() above it doesn't ensure to be the only user.
2010 *
2011 * Locking: identical to tty_kopen() above.
2012 */
2013struct tty_struct *tty_kopen_shared(dev_t device)
2014{
2015 return tty_kopen(device, 1);
2016}
2017EXPORT_SYMBOL_GPL(tty_kopen_shared);
2018
2019/**
2020 * tty_open_by_driver - open a tty device
2021 * @device: dev_t of device to open
2022 * @filp: file pointer to tty
2023 *
2024 * Performs the driver lookup, checks for a reopen, or otherwise performs the
2025 * first-time tty initialization.
2026 *
2027 *
2028 * Claims the global tty_mutex to serialize:
2029 * * concurrent first-time tty initialization
2030 * * concurrent tty driver removal w/ lookup
2031 * * concurrent tty removal from driver table
2032 *
2033 * Return: the locked initialized or re-opened &tty_struct
2034 */
2035static struct tty_struct *tty_open_by_driver(dev_t device,
2036 struct file *filp)
2037{
2038 struct tty_struct *tty;
2039 struct tty_driver *driver = NULL;
2040 int index = -1;
2041 int retval;
2042
2043 mutex_lock(&tty_mutex);
2044 driver = tty_lookup_driver(device, filp, &index);
2045 if (IS_ERR(driver)) {
2046 mutex_unlock(&tty_mutex);
2047 return ERR_CAST(driver);
2048 }
2049
2050 /* check whether we're reopening an existing tty */
2051 tty = tty_driver_lookup_tty(driver, filp, index);
2052 if (IS_ERR(tty)) {
2053 mutex_unlock(&tty_mutex);
2054 goto out;
2055 }
2056
2057 if (tty) {
2058 if (tty_port_kopened(tty->port)) {
2059 tty_kref_put(tty);
2060 mutex_unlock(&tty_mutex);
2061 tty = ERR_PTR(-EBUSY);
2062 goto out;
2063 }
2064 mutex_unlock(&tty_mutex);
2065 retval = tty_lock_interruptible(tty);
2066 tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
2067 if (retval) {
2068 if (retval == -EINTR)
2069 retval = -ERESTARTSYS;
2070 tty = ERR_PTR(retval);
2071 goto out;
2072 }
2073 retval = tty_reopen(tty);
2074 if (retval < 0) {
2075 tty_unlock(tty);
2076 tty = ERR_PTR(retval);
2077 }
2078 } else { /* Returns with the tty_lock held for now */
2079 tty = tty_init_dev(driver, index);
2080 mutex_unlock(&tty_mutex);
2081 }
2082out:
2083 tty_driver_kref_put(driver);
2084 return tty;
2085}
2086
2087/**
2088 * tty_open - open a tty device
2089 * @inode: inode of device file
2090 * @filp: file pointer to tty
2091 *
2092 * tty_open() and tty_release() keep up the tty count that contains the number
2093 * of opens done on a tty. We cannot use the inode-count, as different inodes
2094 * might point to the same tty.
2095 *
2096 * Open-counting is needed for pty masters, as well as for keeping track of
2097 * serial lines: DTR is dropped when the last close happens.
2098 * (This is not done solely through tty->count, now. - Ted 1/27/92)
2099 *
2100 * The termios state of a pty is reset on the first open so that settings don't
2101 * persist across reuse.
2102 *
2103 * Locking:
2104 * * %tty_mutex protects tty, tty_lookup_driver() and tty_init_dev().
2105 * * @tty->count should protect the rest.
2106 * * ->siglock protects ->signal/->sighand
2107 *
2108 * Note: the tty_unlock/lock cases without a ref are only safe due to %tty_mutex
2109 */
2110static int tty_open(struct inode *inode, struct file *filp)
2111{
2112 struct tty_struct *tty;
2113 int noctty, retval;
2114 dev_t device = inode->i_rdev;
2115 unsigned saved_flags = filp->f_flags;
2116
2117 nonseekable_open(inode, filp);
2118
2119retry_open:
2120 retval = tty_alloc_file(filp);
2121 if (retval)
2122 return -ENOMEM;
2123
2124 tty = tty_open_current_tty(device, filp);
2125 if (!tty)
2126 tty = tty_open_by_driver(device, filp);
2127
2128 if (IS_ERR(tty)) {
2129 tty_free_file(filp);
2130 retval = PTR_ERR(tty);
2131 if (retval != -EAGAIN || signal_pending(current))
2132 return retval;
2133 schedule();
2134 goto retry_open;
2135 }
2136
2137 tty_add_file(tty, filp);
2138
2139 check_tty_count(tty, __func__);
2140 tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2141
2142 if (tty->ops->open)
2143 retval = tty->ops->open(tty, filp);
2144 else
2145 retval = -ENODEV;
2146 filp->f_flags = saved_flags;
2147
2148 if (retval) {
2149 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2150
2151 tty_unlock(tty); /* need to call tty_release without BTM */
2152 tty_release(inode, filp);
2153 if (retval != -ERESTARTSYS)
2154 return retval;
2155
2156 if (signal_pending(current))
2157 return retval;
2158
2159 schedule();
2160 /*
2161 * Need to reset f_op in case a hangup happened.
2162 */
2163 if (tty_hung_up_p(filp))
2164 filp->f_op = &tty_fops;
2165 goto retry_open;
2166 }
2167 clear_bit(TTY_HUPPED, &tty->flags);
2168
2169 noctty = (filp->f_flags & O_NOCTTY) ||
2170 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2171 device == MKDEV(TTYAUX_MAJOR, 1) ||
2172 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2173 tty->driver->subtype == PTY_TYPE_MASTER);
2174 if (!noctty)
2175 tty_open_proc_set_tty(filp, tty);
2176 tty_unlock(tty);
2177 return 0;
2178}
2179
2180
2181/**
2182 * tty_poll - check tty status
2183 * @filp: file being polled
2184 * @wait: poll wait structures to update
2185 *
2186 * Call the line discipline polling method to obtain the poll status of the
2187 * device.
2188 *
2189 * Locking: locks called line discipline but ldisc poll method may be
2190 * re-entered freely by other callers.
2191 */
2192static __poll_t tty_poll(struct file *filp, poll_table *wait)
2193{
2194 struct tty_struct *tty = file_tty(filp);
2195 struct tty_ldisc *ld;
2196 __poll_t ret = 0;
2197
2198 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2199 return 0;
2200
2201 ld = tty_ldisc_ref_wait(tty);
2202 if (!ld)
2203 return hung_up_tty_poll(filp, wait);
2204 if (ld->ops->poll)
2205 ret = ld->ops->poll(tty, filp, wait);
2206 tty_ldisc_deref(ld);
2207 return ret;
2208}
2209
2210static int __tty_fasync(int fd, struct file *filp, int on)
2211{
2212 struct tty_struct *tty = file_tty(filp);
2213 unsigned long flags;
2214 int retval = 0;
2215
2216 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2217 goto out;
2218
2219 retval = fasync_helper(fd, filp, on, &tty->fasync);
2220 if (retval <= 0)
2221 goto out;
2222
2223 if (on) {
2224 enum pid_type type;
2225 struct pid *pid;
2226
2227 spin_lock_irqsave(&tty->ctrl.lock, flags);
2228 if (tty->ctrl.pgrp) {
2229 pid = tty->ctrl.pgrp;
2230 type = PIDTYPE_PGID;
2231 } else {
2232 pid = task_pid(current);
2233 type = PIDTYPE_TGID;
2234 }
2235 get_pid(pid);
2236 spin_unlock_irqrestore(&tty->ctrl.lock, flags);
2237 __f_setown(filp, pid, type, 0);
2238 put_pid(pid);
2239 retval = 0;
2240 }
2241out:
2242 return retval;
2243}
2244
2245static int tty_fasync(int fd, struct file *filp, int on)
2246{
2247 struct tty_struct *tty = file_tty(filp);
2248 int retval = -ENOTTY;
2249
2250 tty_lock(tty);
2251 if (!tty_hung_up_p(filp))
2252 retval = __tty_fasync(fd, filp, on);
2253 tty_unlock(tty);
2254
2255 return retval;
2256}
2257
2258static bool tty_legacy_tiocsti __read_mostly = IS_ENABLED(CONFIG_LEGACY_TIOCSTI);
2259/**
2260 * tiocsti - fake input character
2261 * @tty: tty to fake input into
2262 * @p: pointer to character
2263 *
2264 * Fake input to a tty device. Does the necessary locking and input management.
2265 *
2266 * FIXME: does not honour flow control ??
2267 *
2268 * Locking:
2269 * * Called functions take tty_ldiscs_lock
2270 * * current->signal->tty check is safe without locks
2271 */
2272static int tiocsti(struct tty_struct *tty, char __user *p)
2273{
2274 char ch, mbz = 0;
2275 struct tty_ldisc *ld;
2276
2277 if (!tty_legacy_tiocsti)
2278 return -EIO;
2279
2280 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2281 return -EPERM;
2282 if (get_user(ch, p))
2283 return -EFAULT;
2284 tty_audit_tiocsti(tty, ch);
2285 ld = tty_ldisc_ref_wait(tty);
2286 if (!ld)
2287 return -EIO;
2288 tty_buffer_lock_exclusive(tty->port);
2289 if (ld->ops->receive_buf)
2290 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2291 tty_buffer_unlock_exclusive(tty->port);
2292 tty_ldisc_deref(ld);
2293 return 0;
2294}
2295
2296/**
2297 * tiocgwinsz - implement window query ioctl
2298 * @tty: tty
2299 * @arg: user buffer for result
2300 *
2301 * Copies the kernel idea of the window size into the user buffer.
2302 *
2303 * Locking: @tty->winsize_mutex is taken to ensure the winsize data is
2304 * consistent.
2305 */
2306static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2307{
2308 int err;
2309
2310 mutex_lock(&tty->winsize_mutex);
2311 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2312 mutex_unlock(&tty->winsize_mutex);
2313
2314 return err ? -EFAULT : 0;
2315}
2316
2317/**
2318 * tty_do_resize - resize event
2319 * @tty: tty being resized
2320 * @ws: new dimensions
2321 *
2322 * Update the termios variables and send the necessary signals to peform a
2323 * terminal resize correctly.
2324 */
2325int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2326{
2327 struct pid *pgrp;
2328
2329 /* Lock the tty */
2330 mutex_lock(&tty->winsize_mutex);
2331 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2332 goto done;
2333
2334 /* Signal the foreground process group */
2335 pgrp = tty_get_pgrp(tty);
2336 if (pgrp)
2337 kill_pgrp(pgrp, SIGWINCH, 1);
2338 put_pid(pgrp);
2339
2340 tty->winsize = *ws;
2341done:
2342 mutex_unlock(&tty->winsize_mutex);
2343 return 0;
2344}
2345EXPORT_SYMBOL(tty_do_resize);
2346
2347/**
2348 * tiocswinsz - implement window size set ioctl
2349 * @tty: tty side of tty
2350 * @arg: user buffer for result
2351 *
2352 * Copies the user idea of the window size to the kernel. Traditionally this is
2353 * just advisory information but for the Linux console it actually has driver
2354 * level meaning and triggers a VC resize.
2355 *
2356 * Locking:
2357 * Driver dependent. The default do_resize method takes the tty termios
2358 * mutex and ctrl.lock. The console takes its own lock then calls into the
2359 * default method.
2360 */
2361static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2362{
2363 struct winsize tmp_ws;
2364
2365 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2366 return -EFAULT;
2367
2368 if (tty->ops->resize)
2369 return tty->ops->resize(tty, &tmp_ws);
2370 else
2371 return tty_do_resize(tty, &tmp_ws);
2372}
2373
2374/**
2375 * tioccons - allow admin to move logical console
2376 * @file: the file to become console
2377 *
2378 * Allow the administrator to move the redirected console device.
2379 *
2380 * Locking: uses redirect_lock to guard the redirect information
2381 */
2382static int tioccons(struct file *file)
2383{
2384 if (!capable(CAP_SYS_ADMIN))
2385 return -EPERM;
2386 if (file->f_op->write_iter == redirected_tty_write) {
2387 struct file *f;
2388
2389 spin_lock(&redirect_lock);
2390 f = redirect;
2391 redirect = NULL;
2392 spin_unlock(&redirect_lock);
2393 if (f)
2394 fput(f);
2395 return 0;
2396 }
2397 if (file->f_op->write_iter != tty_write)
2398 return -ENOTTY;
2399 if (!(file->f_mode & FMODE_WRITE))
2400 return -EBADF;
2401 if (!(file->f_mode & FMODE_CAN_WRITE))
2402 return -EINVAL;
2403 spin_lock(&redirect_lock);
2404 if (redirect) {
2405 spin_unlock(&redirect_lock);
2406 return -EBUSY;
2407 }
2408 redirect = get_file(file);
2409 spin_unlock(&redirect_lock);
2410 return 0;
2411}
2412
2413/**
2414 * tiocsetd - set line discipline
2415 * @tty: tty device
2416 * @p: pointer to user data
2417 *
2418 * Set the line discipline according to user request.
2419 *
2420 * Locking: see tty_set_ldisc(), this function is just a helper
2421 */
2422static int tiocsetd(struct tty_struct *tty, int __user *p)
2423{
2424 int disc;
2425 int ret;
2426
2427 if (get_user(disc, p))
2428 return -EFAULT;
2429
2430 ret = tty_set_ldisc(tty, disc);
2431
2432 return ret;
2433}
2434
2435/**
2436 * tiocgetd - get line discipline
2437 * @tty: tty device
2438 * @p: pointer to user data
2439 *
2440 * Retrieves the line discipline id directly from the ldisc.
2441 *
2442 * Locking: waits for ldisc reference (in case the line discipline is changing
2443 * or the @tty is being hungup)
2444 */
2445static int tiocgetd(struct tty_struct *tty, int __user *p)
2446{
2447 struct tty_ldisc *ld;
2448 int ret;
2449
2450 ld = tty_ldisc_ref_wait(tty);
2451 if (!ld)
2452 return -EIO;
2453 ret = put_user(ld->ops->num, p);
2454 tty_ldisc_deref(ld);
2455 return ret;
2456}
2457
2458/**
2459 * send_break - performed time break
2460 * @tty: device to break on
2461 * @duration: timeout in mS
2462 *
2463 * Perform a timed break on hardware that lacks its own driver level timed
2464 * break functionality.
2465 *
2466 * Locking:
2467 * @tty->atomic_write_lock serializes
2468 */
2469static int send_break(struct tty_struct *tty, unsigned int duration)
2470{
2471 int retval;
2472
2473 if (tty->ops->break_ctl == NULL)
2474 return 0;
2475
2476 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2477 retval = tty->ops->break_ctl(tty, duration);
2478 else {
2479 /* Do the work ourselves */
2480 if (tty_write_lock(tty, 0) < 0)
2481 return -EINTR;
2482 retval = tty->ops->break_ctl(tty, -1);
2483 if (retval)
2484 goto out;
2485 if (!signal_pending(current))
2486 msleep_interruptible(duration);
2487 retval = tty->ops->break_ctl(tty, 0);
2488out:
2489 tty_write_unlock(tty);
2490 if (signal_pending(current))
2491 retval = -EINTR;
2492 }
2493 return retval;
2494}
2495
2496/**
2497 * tty_tiocmget - get modem status
2498 * @tty: tty device
2499 * @p: pointer to result
2500 *
2501 * Obtain the modem status bits from the tty driver if the feature is
2502 * supported. Return -%ENOTTY if it is not available.
2503 *
2504 * Locking: none (up to the driver)
2505 */
2506static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2507{
2508 int retval = -ENOTTY;
2509
2510 if (tty->ops->tiocmget) {
2511 retval = tty->ops->tiocmget(tty);
2512
2513 if (retval >= 0)
2514 retval = put_user(retval, p);
2515 }
2516 return retval;
2517}
2518
2519/**
2520 * tty_tiocmset - set modem status
2521 * @tty: tty device
2522 * @cmd: command - clear bits, set bits or set all
2523 * @p: pointer to desired bits
2524 *
2525 * Set the modem status bits from the tty driver if the feature
2526 * is supported. Return -%ENOTTY if it is not available.
2527 *
2528 * Locking: none (up to the driver)
2529 */
2530static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2531 unsigned __user *p)
2532{
2533 int retval;
2534 unsigned int set, clear, val;
2535
2536 if (tty->ops->tiocmset == NULL)
2537 return -ENOTTY;
2538
2539 retval = get_user(val, p);
2540 if (retval)
2541 return retval;
2542 set = clear = 0;
2543 switch (cmd) {
2544 case TIOCMBIS:
2545 set = val;
2546 break;
2547 case TIOCMBIC:
2548 clear = val;
2549 break;
2550 case TIOCMSET:
2551 set = val;
2552 clear = ~val;
2553 break;
2554 }
2555 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2556 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2557 return tty->ops->tiocmset(tty, set, clear);
2558}
2559
2560/**
2561 * tty_get_icount - get tty statistics
2562 * @tty: tty device
2563 * @icount: output parameter
2564 *
2565 * Gets a copy of the @tty's icount statistics.
2566 *
2567 * Locking: none (up to the driver)
2568 */
2569int tty_get_icount(struct tty_struct *tty,
2570 struct serial_icounter_struct *icount)
2571{
2572 memset(icount, 0, sizeof(*icount));
2573
2574 if (tty->ops->get_icount)
2575 return tty->ops->get_icount(tty, icount);
2576 else
2577 return -ENOTTY;
2578}
2579EXPORT_SYMBOL_GPL(tty_get_icount);
2580
2581static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2582{
2583 struct serial_icounter_struct icount;
2584 int retval;
2585
2586 retval = tty_get_icount(tty, &icount);
2587 if (retval != 0)
2588 return retval;
2589
2590 if (copy_to_user(arg, &icount, sizeof(icount)))
2591 return -EFAULT;
2592 return 0;
2593}
2594
2595static int tty_set_serial(struct tty_struct *tty, struct serial_struct *ss)
2596{
2597 char comm[TASK_COMM_LEN];
2598 int flags;
2599
2600 flags = ss->flags & ASYNC_DEPRECATED;
2601
2602 if (flags)
2603 pr_warn_ratelimited("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2604 __func__, get_task_comm(comm, current), flags);
2605
2606 if (!tty->ops->set_serial)
2607 return -ENOTTY;
2608
2609 return tty->ops->set_serial(tty, ss);
2610}
2611
2612static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
2613{
2614 struct serial_struct v;
2615
2616 if (copy_from_user(&v, ss, sizeof(*ss)))
2617 return -EFAULT;
2618
2619 return tty_set_serial(tty, &v);
2620}
2621
2622static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2623{
2624 struct serial_struct v;
2625 int err;
2626
2627 memset(&v, 0, sizeof(v));
2628 if (!tty->ops->get_serial)
2629 return -ENOTTY;
2630 err = tty->ops->get_serial(tty, &v);
2631 if (!err && copy_to_user(ss, &v, sizeof(v)))
2632 err = -EFAULT;
2633 return err;
2634}
2635
2636/*
2637 * if pty, return the slave side (real_tty)
2638 * otherwise, return self
2639 */
2640static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2641{
2642 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2643 tty->driver->subtype == PTY_TYPE_MASTER)
2644 tty = tty->link;
2645 return tty;
2646}
2647
2648/*
2649 * Split this up, as gcc can choke on it otherwise..
2650 */
2651long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2652{
2653 struct tty_struct *tty = file_tty(file);
2654 struct tty_struct *real_tty;
2655 void __user *p = (void __user *)arg;
2656 int retval;
2657 struct tty_ldisc *ld;
2658
2659 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2660 return -EINVAL;
2661
2662 real_tty = tty_pair_get_tty(tty);
2663
2664 /*
2665 * Factor out some common prep work
2666 */
2667 switch (cmd) {
2668 case TIOCSETD:
2669 case TIOCSBRK:
2670 case TIOCCBRK:
2671 case TCSBRK:
2672 case TCSBRKP:
2673 retval = tty_check_change(tty);
2674 if (retval)
2675 return retval;
2676 if (cmd != TIOCCBRK) {
2677 tty_wait_until_sent(tty, 0);
2678 if (signal_pending(current))
2679 return -EINTR;
2680 }
2681 break;
2682 }
2683
2684 /*
2685 * Now do the stuff.
2686 */
2687 switch (cmd) {
2688 case TIOCSTI:
2689 return tiocsti(tty, p);
2690 case TIOCGWINSZ:
2691 return tiocgwinsz(real_tty, p);
2692 case TIOCSWINSZ:
2693 return tiocswinsz(real_tty, p);
2694 case TIOCCONS:
2695 return real_tty != tty ? -EINVAL : tioccons(file);
2696 case TIOCEXCL:
2697 set_bit(TTY_EXCLUSIVE, &tty->flags);
2698 return 0;
2699 case TIOCNXCL:
2700 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2701 return 0;
2702 case TIOCGEXCL:
2703 {
2704 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2705
2706 return put_user(excl, (int __user *)p);
2707 }
2708 case TIOCGETD:
2709 return tiocgetd(tty, p);
2710 case TIOCSETD:
2711 return tiocsetd(tty, p);
2712 case TIOCVHANGUP:
2713 if (!capable(CAP_SYS_ADMIN))
2714 return -EPERM;
2715 tty_vhangup(tty);
2716 return 0;
2717 case TIOCGDEV:
2718 {
2719 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2720
2721 return put_user(ret, (unsigned int __user *)p);
2722 }
2723 /*
2724 * Break handling
2725 */
2726 case TIOCSBRK: /* Turn break on, unconditionally */
2727 if (tty->ops->break_ctl)
2728 return tty->ops->break_ctl(tty, -1);
2729 return 0;
2730 case TIOCCBRK: /* Turn break off, unconditionally */
2731 if (tty->ops->break_ctl)
2732 return tty->ops->break_ctl(tty, 0);
2733 return 0;
2734 case TCSBRK: /* SVID version: non-zero arg --> no break */
2735 /* non-zero arg means wait for all output data
2736 * to be sent (performed above) but don't send break.
2737 * This is used by the tcdrain() termios function.
2738 */
2739 if (!arg)
2740 return send_break(tty, 250);
2741 return 0;
2742 case TCSBRKP: /* support for POSIX tcsendbreak() */
2743 return send_break(tty, arg ? arg*100 : 250);
2744
2745 case TIOCMGET:
2746 return tty_tiocmget(tty, p);
2747 case TIOCMSET:
2748 case TIOCMBIC:
2749 case TIOCMBIS:
2750 return tty_tiocmset(tty, cmd, p);
2751 case TIOCGICOUNT:
2752 return tty_tiocgicount(tty, p);
2753 case TCFLSH:
2754 switch (arg) {
2755 case TCIFLUSH:
2756 case TCIOFLUSH:
2757 /* flush tty buffer and allow ldisc to process ioctl */
2758 tty_buffer_flush(tty, NULL);
2759 break;
2760 }
2761 break;
2762 case TIOCSSERIAL:
2763 return tty_tiocsserial(tty, p);
2764 case TIOCGSERIAL:
2765 return tty_tiocgserial(tty, p);
2766 case TIOCGPTPEER:
2767 /* Special because the struct file is needed */
2768 return ptm_open_peer(file, tty, (int)arg);
2769 default:
2770 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2771 if (retval != -ENOIOCTLCMD)
2772 return retval;
2773 }
2774 if (tty->ops->ioctl) {
2775 retval = tty->ops->ioctl(tty, cmd, arg);
2776 if (retval != -ENOIOCTLCMD)
2777 return retval;
2778 }
2779 ld = tty_ldisc_ref_wait(tty);
2780 if (!ld)
2781 return hung_up_tty_ioctl(file, cmd, arg);
2782 retval = -EINVAL;
2783 if (ld->ops->ioctl) {
2784 retval = ld->ops->ioctl(tty, cmd, arg);
2785 if (retval == -ENOIOCTLCMD)
2786 retval = -ENOTTY;
2787 }
2788 tty_ldisc_deref(ld);
2789 return retval;
2790}
2791
2792#ifdef CONFIG_COMPAT
2793
2794struct serial_struct32 {
2795 compat_int_t type;
2796 compat_int_t line;
2797 compat_uint_t port;
2798 compat_int_t irq;
2799 compat_int_t flags;
2800 compat_int_t xmit_fifo_size;
2801 compat_int_t custom_divisor;
2802 compat_int_t baud_base;
2803 unsigned short close_delay;
2804 char io_type;
2805 char reserved_char;
2806 compat_int_t hub6;
2807 unsigned short closing_wait; /* time to wait before closing */
2808 unsigned short closing_wait2; /* no longer used... */
2809 compat_uint_t iomem_base;
2810 unsigned short iomem_reg_shift;
2811 unsigned int port_high;
2812 /* compat_ulong_t iomap_base FIXME */
2813 compat_int_t reserved;
2814};
2815
2816static int compat_tty_tiocsserial(struct tty_struct *tty,
2817 struct serial_struct32 __user *ss)
2818{
2819 struct serial_struct32 v32;
2820 struct serial_struct v;
2821
2822 if (copy_from_user(&v32, ss, sizeof(*ss)))
2823 return -EFAULT;
2824
2825 memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2826 v.iomem_base = compat_ptr(v32.iomem_base);
2827 v.iomem_reg_shift = v32.iomem_reg_shift;
2828 v.port_high = v32.port_high;
2829 v.iomap_base = 0;
2830
2831 return tty_set_serial(tty, &v);
2832}
2833
2834static int compat_tty_tiocgserial(struct tty_struct *tty,
2835 struct serial_struct32 __user *ss)
2836{
2837 struct serial_struct32 v32;
2838 struct serial_struct v;
2839 int err;
2840
2841 memset(&v, 0, sizeof(v));
2842 memset(&v32, 0, sizeof(v32));
2843
2844 if (!tty->ops->get_serial)
2845 return -ENOTTY;
2846 err = tty->ops->get_serial(tty, &v);
2847 if (!err) {
2848 memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2849 v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2850 0xfffffff : ptr_to_compat(v.iomem_base);
2851 v32.iomem_reg_shift = v.iomem_reg_shift;
2852 v32.port_high = v.port_high;
2853 if (copy_to_user(ss, &v32, sizeof(v32)))
2854 err = -EFAULT;
2855 }
2856 return err;
2857}
2858static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2859 unsigned long arg)
2860{
2861 struct tty_struct *tty = file_tty(file);
2862 struct tty_ldisc *ld;
2863 int retval = -ENOIOCTLCMD;
2864
2865 switch (cmd) {
2866 case TIOCOUTQ:
2867 case TIOCSTI:
2868 case TIOCGWINSZ:
2869 case TIOCSWINSZ:
2870 case TIOCGEXCL:
2871 case TIOCGETD:
2872 case TIOCSETD:
2873 case TIOCGDEV:
2874 case TIOCMGET:
2875 case TIOCMSET:
2876 case TIOCMBIC:
2877 case TIOCMBIS:
2878 case TIOCGICOUNT:
2879 case TIOCGPGRP:
2880 case TIOCSPGRP:
2881 case TIOCGSID:
2882 case TIOCSERGETLSR:
2883 case TIOCGRS485:
2884 case TIOCSRS485:
2885#ifdef TIOCGETP
2886 case TIOCGETP:
2887 case TIOCSETP:
2888 case TIOCSETN:
2889#endif
2890#ifdef TIOCGETC
2891 case TIOCGETC:
2892 case TIOCSETC:
2893#endif
2894#ifdef TIOCGLTC
2895 case TIOCGLTC:
2896 case TIOCSLTC:
2897#endif
2898 case TCSETSF:
2899 case TCSETSW:
2900 case TCSETS:
2901 case TCGETS:
2902#ifdef TCGETS2
2903 case TCGETS2:
2904 case TCSETSF2:
2905 case TCSETSW2:
2906 case TCSETS2:
2907#endif
2908 case TCGETA:
2909 case TCSETAF:
2910 case TCSETAW:
2911 case TCSETA:
2912 case TIOCGLCKTRMIOS:
2913 case TIOCSLCKTRMIOS:
2914#ifdef TCGETX
2915 case TCGETX:
2916 case TCSETX:
2917 case TCSETXW:
2918 case TCSETXF:
2919#endif
2920 case TIOCGSOFTCAR:
2921 case TIOCSSOFTCAR:
2922
2923 case PPPIOCGCHAN:
2924 case PPPIOCGUNIT:
2925 return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
2926 case TIOCCONS:
2927 case TIOCEXCL:
2928 case TIOCNXCL:
2929 case TIOCVHANGUP:
2930 case TIOCSBRK:
2931 case TIOCCBRK:
2932 case TCSBRK:
2933 case TCSBRKP:
2934 case TCFLSH:
2935 case TIOCGPTPEER:
2936 case TIOCNOTTY:
2937 case TIOCSCTTY:
2938 case TCXONC:
2939 case TIOCMIWAIT:
2940 case TIOCSERCONFIG:
2941 return tty_ioctl(file, cmd, arg);
2942 }
2943
2944 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2945 return -EINVAL;
2946
2947 switch (cmd) {
2948 case TIOCSSERIAL:
2949 return compat_tty_tiocsserial(tty, compat_ptr(arg));
2950 case TIOCGSERIAL:
2951 return compat_tty_tiocgserial(tty, compat_ptr(arg));
2952 }
2953 if (tty->ops->compat_ioctl) {
2954 retval = tty->ops->compat_ioctl(tty, cmd, arg);
2955 if (retval != -ENOIOCTLCMD)
2956 return retval;
2957 }
2958
2959 ld = tty_ldisc_ref_wait(tty);
2960 if (!ld)
2961 return hung_up_tty_compat_ioctl(file, cmd, arg);
2962 if (ld->ops->compat_ioctl)
2963 retval = ld->ops->compat_ioctl(tty, cmd, arg);
2964 if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2965 retval = ld->ops->ioctl(tty, (unsigned long)compat_ptr(cmd),
2966 arg);
2967 tty_ldisc_deref(ld);
2968
2969 return retval;
2970}
2971#endif
2972
2973static int this_tty(const void *t, struct file *file, unsigned fd)
2974{
2975 if (likely(file->f_op->read_iter != tty_read))
2976 return 0;
2977 return file_tty(file) != t ? 0 : fd + 1;
2978}
2979
2980/*
2981 * This implements the "Secure Attention Key" --- the idea is to
2982 * prevent trojan horses by killing all processes associated with this
2983 * tty when the user hits the "Secure Attention Key". Required for
2984 * super-paranoid applications --- see the Orange Book for more details.
2985 *
2986 * This code could be nicer; ideally it should send a HUP, wait a few
2987 * seconds, then send a INT, and then a KILL signal. But you then
2988 * have to coordinate with the init process, since all processes associated
2989 * with the current tty must be dead before the new getty is allowed
2990 * to spawn.
2991 *
2992 * Now, if it would be correct ;-/ The current code has a nasty hole -
2993 * it doesn't catch files in flight. We may send the descriptor to ourselves
2994 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2995 *
2996 * Nasty bug: do_SAK is being called in interrupt context. This can
2997 * deadlock. We punt it up to process context. AKPM - 16Mar2001
2998 */
2999void __do_SAK(struct tty_struct *tty)
3000{
3001 struct task_struct *g, *p;
3002 struct pid *session;
3003 int i;
3004 unsigned long flags;
3005
3006 spin_lock_irqsave(&tty->ctrl.lock, flags);
3007 session = get_pid(tty->ctrl.session);
3008 spin_unlock_irqrestore(&tty->ctrl.lock, flags);
3009
3010 tty_ldisc_flush(tty);
3011
3012 tty_driver_flush_buffer(tty);
3013
3014 read_lock(&tasklist_lock);
3015 /* Kill the entire session */
3016 do_each_pid_task(session, PIDTYPE_SID, p) {
3017 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
3018 task_pid_nr(p), p->comm);
3019 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
3020 } while_each_pid_task(session, PIDTYPE_SID, p);
3021
3022 /* Now kill any processes that happen to have the tty open */
3023 do_each_thread(g, p) {
3024 if (p->signal->tty == tty) {
3025 tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
3026 task_pid_nr(p), p->comm);
3027 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p,
3028 PIDTYPE_SID);
3029 continue;
3030 }
3031 task_lock(p);
3032 i = iterate_fd(p->files, 0, this_tty, tty);
3033 if (i != 0) {
3034 tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
3035 task_pid_nr(p), p->comm, i - 1);
3036 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p,
3037 PIDTYPE_SID);
3038 }
3039 task_unlock(p);
3040 } while_each_thread(g, p);
3041 read_unlock(&tasklist_lock);
3042 put_pid(session);
3043}
3044
3045static void do_SAK_work(struct work_struct *work)
3046{
3047 struct tty_struct *tty =
3048 container_of(work, struct tty_struct, SAK_work);
3049 __do_SAK(tty);
3050}
3051
3052/*
3053 * The tq handling here is a little racy - tty->SAK_work may already be queued.
3054 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3055 * the values which we write to it will be identical to the values which it
3056 * already has. --akpm
3057 */
3058void do_SAK(struct tty_struct *tty)
3059{
3060 if (!tty)
3061 return;
3062 schedule_work(&tty->SAK_work);
3063}
3064EXPORT_SYMBOL(do_SAK);
3065
3066/* Must put_device() after it's unused! */
3067static struct device *tty_get_device(struct tty_struct *tty)
3068{
3069 dev_t devt = tty_devnum(tty);
3070
3071 return class_find_device_by_devt(tty_class, devt);
3072}
3073
3074
3075/**
3076 * alloc_tty_struct - allocate a new tty
3077 * @driver: driver which will handle the returned tty
3078 * @idx: minor of the tty
3079 *
3080 * This subroutine allocates and initializes a tty structure.
3081 *
3082 * Locking: none - @tty in question is not exposed at this point
3083 */
3084struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
3085{
3086 struct tty_struct *tty;
3087
3088 tty = kzalloc(sizeof(*tty), GFP_KERNEL_ACCOUNT);
3089 if (!tty)
3090 return NULL;
3091
3092 kref_init(&tty->kref);
3093 if (tty_ldisc_init(tty)) {
3094 kfree(tty);
3095 return NULL;
3096 }
3097 tty->ctrl.session = NULL;
3098 tty->ctrl.pgrp = NULL;
3099 mutex_init(&tty->legacy_mutex);
3100 mutex_init(&tty->throttle_mutex);
3101 init_rwsem(&tty->termios_rwsem);
3102 mutex_init(&tty->winsize_mutex);
3103 init_ldsem(&tty->ldisc_sem);
3104 init_waitqueue_head(&tty->write_wait);
3105 init_waitqueue_head(&tty->read_wait);
3106 INIT_WORK(&tty->hangup_work, do_tty_hangup);
3107 mutex_init(&tty->atomic_write_lock);
3108 spin_lock_init(&tty->ctrl.lock);
3109 spin_lock_init(&tty->flow.lock);
3110 spin_lock_init(&tty->files_lock);
3111 INIT_LIST_HEAD(&tty->tty_files);
3112 INIT_WORK(&tty->SAK_work, do_SAK_work);
3113
3114 tty->driver = driver;
3115 tty->ops = driver->ops;
3116 tty->index = idx;
3117 tty_line_name(driver, idx, tty->name);
3118 tty->dev = tty_get_device(tty);
3119
3120 return tty;
3121}
3122
3123/**
3124 * tty_put_char - write one character to a tty
3125 * @tty: tty
3126 * @ch: character to write
3127 *
3128 * Write one byte to the @tty using the provided @tty->ops->put_char() method
3129 * if present.
3130 *
3131 * Note: the specific put_char operation in the driver layer may go
3132 * away soon. Don't call it directly, use this method
3133 *
3134 * Return: the number of characters successfully output.
3135 */
3136int tty_put_char(struct tty_struct *tty, unsigned char ch)
3137{
3138 if (tty->ops->put_char)
3139 return tty->ops->put_char(tty, ch);
3140 return tty->ops->write(tty, &ch, 1);
3141}
3142EXPORT_SYMBOL_GPL(tty_put_char);
3143
3144struct class *tty_class;
3145
3146static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3147 unsigned int index, unsigned int count)
3148{
3149 int err;
3150
3151 /* init here, since reused cdevs cause crashes */
3152 driver->cdevs[index] = cdev_alloc();
3153 if (!driver->cdevs[index])
3154 return -ENOMEM;
3155 driver->cdevs[index]->ops = &tty_fops;
3156 driver->cdevs[index]->owner = driver->owner;
3157 err = cdev_add(driver->cdevs[index], dev, count);
3158 if (err)
3159 kobject_put(&driver->cdevs[index]->kobj);
3160 return err;
3161}
3162
3163/**
3164 * tty_register_device - register a tty device
3165 * @driver: the tty driver that describes the tty device
3166 * @index: the index in the tty driver for this tty device
3167 * @device: a struct device that is associated with this tty device.
3168 * This field is optional, if there is no known struct device
3169 * for this tty device it can be set to NULL safely.
3170 *
3171 * This call is required to be made to register an individual tty device
3172 * if the tty driver's flags have the %TTY_DRIVER_DYNAMIC_DEV bit set. If
3173 * that bit is not set, this function should not be called by a tty
3174 * driver.
3175 *
3176 * Locking: ??
3177 *
3178 * Return: A pointer to the struct device for this tty device (or
3179 * ERR_PTR(-EFOO) on error).
3180 */
3181struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3182 struct device *device)
3183{
3184 return tty_register_device_attr(driver, index, device, NULL, NULL);
3185}
3186EXPORT_SYMBOL(tty_register_device);
3187
3188static void tty_device_create_release(struct device *dev)
3189{
3190 dev_dbg(dev, "releasing...\n");
3191 kfree(dev);
3192}
3193
3194/**
3195 * tty_register_device_attr - register a tty device
3196 * @driver: the tty driver that describes the tty device
3197 * @index: the index in the tty driver for this tty device
3198 * @device: a struct device that is associated with this tty device.
3199 * This field is optional, if there is no known struct device
3200 * for this tty device it can be set to %NULL safely.
3201 * @drvdata: Driver data to be set to device.
3202 * @attr_grp: Attribute group to be set on device.
3203 *
3204 * This call is required to be made to register an individual tty device if the
3205 * tty driver's flags have the %TTY_DRIVER_DYNAMIC_DEV bit set. If that bit is
3206 * not set, this function should not be called by a tty driver.
3207 *
3208 * Locking: ??
3209 *
3210 * Return: A pointer to the struct device for this tty device (or
3211 * ERR_PTR(-EFOO) on error).
3212 */
3213struct device *tty_register_device_attr(struct tty_driver *driver,
3214 unsigned index, struct device *device,
3215 void *drvdata,
3216 const struct attribute_group **attr_grp)
3217{
3218 char name[64];
3219 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3220 struct ktermios *tp;
3221 struct device *dev;
3222 int retval;
3223
3224 if (index >= driver->num) {
3225 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3226 driver->name, index);
3227 return ERR_PTR(-EINVAL);
3228 }
3229
3230 if (driver->type == TTY_DRIVER_TYPE_PTY)
3231 pty_line_name(driver, index, name);
3232 else
3233 tty_line_name(driver, index, name);
3234
3235 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3236 if (!dev)
3237 return ERR_PTR(-ENOMEM);
3238
3239 dev->devt = devt;
3240 dev->class = tty_class;
3241 dev->parent = device;
3242 dev->release = tty_device_create_release;
3243 dev_set_name(dev, "%s", name);
3244 dev->groups = attr_grp;
3245 dev_set_drvdata(dev, drvdata);
3246
3247 dev_set_uevent_suppress(dev, 1);
3248
3249 retval = device_register(dev);
3250 if (retval)
3251 goto err_put;
3252
3253 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3254 /*
3255 * Free any saved termios data so that the termios state is
3256 * reset when reusing a minor number.
3257 */
3258 tp = driver->termios[index];
3259 if (tp) {
3260 driver->termios[index] = NULL;
3261 kfree(tp);
3262 }
3263
3264 retval = tty_cdev_add(driver, devt, index, 1);
3265 if (retval)
3266 goto err_del;
3267 }
3268
3269 dev_set_uevent_suppress(dev, 0);
3270 kobject_uevent(&dev->kobj, KOBJ_ADD);
3271
3272 return dev;
3273
3274err_del:
3275 device_del(dev);
3276err_put:
3277 put_device(dev);
3278
3279 return ERR_PTR(retval);
3280}
3281EXPORT_SYMBOL_GPL(tty_register_device_attr);
3282
3283/**
3284 * tty_unregister_device - unregister a tty device
3285 * @driver: the tty driver that describes the tty device
3286 * @index: the index in the tty driver for this tty device
3287 *
3288 * If a tty device is registered with a call to tty_register_device() then
3289 * this function must be called when the tty device is gone.
3290 *
3291 * Locking: ??
3292 */
3293void tty_unregister_device(struct tty_driver *driver, unsigned index)
3294{
3295 device_destroy(tty_class,
3296 MKDEV(driver->major, driver->minor_start) + index);
3297 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3298 cdev_del(driver->cdevs[index]);
3299 driver->cdevs[index] = NULL;
3300 }
3301}
3302EXPORT_SYMBOL(tty_unregister_device);
3303
3304/**
3305 * __tty_alloc_driver -- allocate tty driver
3306 * @lines: count of lines this driver can handle at most
3307 * @owner: module which is responsible for this driver
3308 * @flags: some of %TTY_DRIVER_ flags, will be set in driver->flags
3309 *
3310 * This should not be called directly, some of the provided macros should be
3311 * used instead. Use IS_ERR() and friends on @retval.
3312 */
3313struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3314 unsigned long flags)
3315{
3316 struct tty_driver *driver;
3317 unsigned int cdevs = 1;
3318 int err;
3319
3320 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3321 return ERR_PTR(-EINVAL);
3322
3323 driver = kzalloc(sizeof(*driver), GFP_KERNEL);
3324 if (!driver)
3325 return ERR_PTR(-ENOMEM);
3326
3327 kref_init(&driver->kref);
3328 driver->num = lines;
3329 driver->owner = owner;
3330 driver->flags = flags;
3331
3332 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3333 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3334 GFP_KERNEL);
3335 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3336 GFP_KERNEL);
3337 if (!driver->ttys || !driver->termios) {
3338 err = -ENOMEM;
3339 goto err_free_all;
3340 }
3341 }
3342
3343 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3344 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3345 GFP_KERNEL);
3346 if (!driver->ports) {
3347 err = -ENOMEM;
3348 goto err_free_all;
3349 }
3350 cdevs = lines;
3351 }
3352
3353 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3354 if (!driver->cdevs) {
3355 err = -ENOMEM;
3356 goto err_free_all;
3357 }
3358
3359 return driver;
3360err_free_all:
3361 kfree(driver->ports);
3362 kfree(driver->ttys);
3363 kfree(driver->termios);
3364 kfree(driver->cdevs);
3365 kfree(driver);
3366 return ERR_PTR(err);
3367}
3368EXPORT_SYMBOL(__tty_alloc_driver);
3369
3370static void destruct_tty_driver(struct kref *kref)
3371{
3372 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3373 int i;
3374 struct ktermios *tp;
3375
3376 if (driver->flags & TTY_DRIVER_INSTALLED) {
3377 for (i = 0; i < driver->num; i++) {
3378 tp = driver->termios[i];
3379 if (tp) {
3380 driver->termios[i] = NULL;
3381 kfree(tp);
3382 }
3383 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3384 tty_unregister_device(driver, i);
3385 }
3386 proc_tty_unregister_driver(driver);
3387 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3388 cdev_del(driver->cdevs[0]);
3389 }
3390 kfree(driver->cdevs);
3391 kfree(driver->ports);
3392 kfree(driver->termios);
3393 kfree(driver->ttys);
3394 kfree(driver);
3395}
3396
3397/**
3398 * tty_driver_kref_put -- drop a reference to a tty driver
3399 * @driver: driver of which to drop the reference
3400 *
3401 * The final put will destroy and free up the driver.
3402 */
3403void tty_driver_kref_put(struct tty_driver *driver)
3404{
3405 kref_put(&driver->kref, destruct_tty_driver);
3406}
3407EXPORT_SYMBOL(tty_driver_kref_put);
3408
3409/**
3410 * tty_register_driver -- register a tty driver
3411 * @driver: driver to register
3412 *
3413 * Called by a tty driver to register itself.
3414 */
3415int tty_register_driver(struct tty_driver *driver)
3416{
3417 int error;
3418 int i;
3419 dev_t dev;
3420 struct device *d;
3421
3422 if (!driver->major) {
3423 error = alloc_chrdev_region(&dev, driver->minor_start,
3424 driver->num, driver->name);
3425 if (!error) {
3426 driver->major = MAJOR(dev);
3427 driver->minor_start = MINOR(dev);
3428 }
3429 } else {
3430 dev = MKDEV(driver->major, driver->minor_start);
3431 error = register_chrdev_region(dev, driver->num, driver->name);
3432 }
3433 if (error < 0)
3434 goto err;
3435
3436 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3437 error = tty_cdev_add(driver, dev, 0, driver->num);
3438 if (error)
3439 goto err_unreg_char;
3440 }
3441
3442 mutex_lock(&tty_mutex);
3443 list_add(&driver->tty_drivers, &tty_drivers);
3444 mutex_unlock(&tty_mutex);
3445
3446 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3447 for (i = 0; i < driver->num; i++) {
3448 d = tty_register_device(driver, i, NULL);
3449 if (IS_ERR(d)) {
3450 error = PTR_ERR(d);
3451 goto err_unreg_devs;
3452 }
3453 }
3454 }
3455 proc_tty_register_driver(driver);
3456 driver->flags |= TTY_DRIVER_INSTALLED;
3457 return 0;
3458
3459err_unreg_devs:
3460 for (i--; i >= 0; i--)
3461 tty_unregister_device(driver, i);
3462
3463 mutex_lock(&tty_mutex);
3464 list_del(&driver->tty_drivers);
3465 mutex_unlock(&tty_mutex);
3466
3467err_unreg_char:
3468 unregister_chrdev_region(dev, driver->num);
3469err:
3470 return error;
3471}
3472EXPORT_SYMBOL(tty_register_driver);
3473
3474/**
3475 * tty_unregister_driver -- unregister a tty driver
3476 * @driver: driver to unregister
3477 *
3478 * Called by a tty driver to unregister itself.
3479 */
3480void tty_unregister_driver(struct tty_driver *driver)
3481{
3482 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3483 driver->num);
3484 mutex_lock(&tty_mutex);
3485 list_del(&driver->tty_drivers);
3486 mutex_unlock(&tty_mutex);
3487}
3488EXPORT_SYMBOL(tty_unregister_driver);
3489
3490dev_t tty_devnum(struct tty_struct *tty)
3491{
3492 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3493}
3494EXPORT_SYMBOL(tty_devnum);
3495
3496void tty_default_fops(struct file_operations *fops)
3497{
3498 *fops = tty_fops;
3499}
3500
3501static char *tty_devnode(const struct device *dev, umode_t *mode)
3502{
3503 if (!mode)
3504 return NULL;
3505 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3506 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3507 *mode = 0666;
3508 return NULL;
3509}
3510
3511static int __init tty_class_init(void)
3512{
3513 tty_class = class_create(THIS_MODULE, "tty");
3514 if (IS_ERR(tty_class))
3515 return PTR_ERR(tty_class);
3516 tty_class->devnode = tty_devnode;
3517 return 0;
3518}
3519
3520postcore_initcall(tty_class_init);
3521
3522/* 3/2004 jmc: why do these devices exist? */
3523static struct cdev tty_cdev, console_cdev;
3524
3525static ssize_t show_cons_active(struct device *dev,
3526 struct device_attribute *attr, char *buf)
3527{
3528 struct console *cs[16];
3529 int i = 0;
3530 struct console *c;
3531 ssize_t count = 0;
3532
3533 /*
3534 * Hold the console_list_lock to guarantee that no consoles are
3535 * unregistered until all console processing is complete.
3536 * This also allows safe traversal of the console list and
3537 * race-free reading of @flags.
3538 */
3539 console_list_lock();
3540
3541 for_each_console(c) {
3542 if (!c->device)
3543 continue;
3544 if (!c->write)
3545 continue;
3546 if ((c->flags & CON_ENABLED) == 0)
3547 continue;
3548 cs[i++] = c;
3549 if (i >= ARRAY_SIZE(cs))
3550 break;
3551 }
3552
3553 /*
3554 * Take console_lock to serialize device() callback with
3555 * other console operations. For example, fg_console is
3556 * modified under console_lock when switching vt.
3557 */
3558 console_lock();
3559 while (i--) {
3560 int index = cs[i]->index;
3561 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3562
3563 /* don't resolve tty0 as some programs depend on it */
3564 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3565 count += tty_line_name(drv, index, buf + count);
3566 else
3567 count += sprintf(buf + count, "%s%d",
3568 cs[i]->name, cs[i]->index);
3569
3570 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3571 }
3572 console_unlock();
3573
3574 console_list_unlock();
3575
3576 return count;
3577}
3578static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3579
3580static struct attribute *cons_dev_attrs[] = {
3581 &dev_attr_active.attr,
3582 NULL
3583};
3584
3585ATTRIBUTE_GROUPS(cons_dev);
3586
3587static struct device *consdev;
3588
3589void console_sysfs_notify(void)
3590{
3591 if (consdev)
3592 sysfs_notify(&consdev->kobj, NULL, "active");
3593}
3594
3595static struct ctl_table tty_table[] = {
3596 {
3597 .procname = "legacy_tiocsti",
3598 .data = &tty_legacy_tiocsti,
3599 .maxlen = sizeof(tty_legacy_tiocsti),
3600 .mode = 0644,
3601 .proc_handler = proc_dobool,
3602 },
3603 {
3604 .procname = "ldisc_autoload",
3605 .data = &tty_ldisc_autoload,
3606 .maxlen = sizeof(tty_ldisc_autoload),
3607 .mode = 0644,
3608 .proc_handler = proc_dointvec,
3609 .extra1 = SYSCTL_ZERO,
3610 .extra2 = SYSCTL_ONE,
3611 },
3612 { }
3613};
3614
3615static struct ctl_table tty_dir_table[] = {
3616 {
3617 .procname = "tty",
3618 .mode = 0555,
3619 .child = tty_table,
3620 },
3621 { }
3622};
3623
3624static struct ctl_table tty_root_table[] = {
3625 {
3626 .procname = "dev",
3627 .mode = 0555,
3628 .child = tty_dir_table,
3629 },
3630 { }
3631};
3632
3633/*
3634 * Ok, now we can initialize the rest of the tty devices and can count
3635 * on memory allocations, interrupts etc..
3636 */
3637int __init tty_init(void)
3638{
3639 register_sysctl_table(tty_root_table);
3640 cdev_init(&tty_cdev, &tty_fops);
3641 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3642 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3643 panic("Couldn't register /dev/tty driver\n");
3644 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3645
3646 cdev_init(&console_cdev, &console_fops);
3647 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3648 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3649 panic("Couldn't register /dev/console driver\n");
3650 consdev = device_create_with_groups(tty_class, NULL,
3651 MKDEV(TTYAUX_MAJOR, 1), NULL,
3652 cons_dev_groups, "console");
3653 if (IS_ERR(consdev))
3654 consdev = NULL;
3655
3656#ifdef CONFIG_VT
3657 vty_init(&console_fops);
3658#endif
3659 return 0;
3660}
1/*
2 * Copyright (C) 1991, 1992 Linus Torvalds
3 */
4
5/*
6 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7 * or rs-channels. It also implements echoing, cooked mode etc.
8 *
9 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10 *
11 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12 * tty_struct and tty_queue structures. Previously there was an array
13 * of 256 tty_struct's which was statically allocated, and the
14 * tty_queue structures were allocated at boot time. Both are now
15 * dynamically allocated only when the tty is open.
16 *
17 * Also restructured routines so that there is more of a separation
18 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19 * the low-level tty routines (serial.c, pty.c, console.c). This
20 * makes for cleaner and more compact code. -TYT, 9/17/92
21 *
22 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23 * which can be dynamically activated and de-activated by the line
24 * discipline handling modules (like SLIP).
25 *
26 * NOTE: pay no attention to the line discipline code (yet); its
27 * interface is still subject to change in this version...
28 * -- TYT, 1/31/92
29 *
30 * Added functionality to the OPOST tty handling. No delays, but all
31 * other bits should be there.
32 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33 *
34 * Rewrote canonical mode and added more termios flags.
35 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36 *
37 * Reorganized FASYNC support so mouse code can share it.
38 * -- ctm@ardi.com, 9Sep95
39 *
40 * New TIOCLINUX variants added.
41 * -- mj@k332.feld.cvut.cz, 19-Nov-95
42 *
43 * Restrict vt switching via ioctl()
44 * -- grif@cs.ucr.edu, 5-Dec-95
45 *
46 * Move console and virtual terminal code to more appropriate files,
47 * implement CONFIG_VT and generalize console device interface.
48 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49 *
50 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51 * -- Bill Hawes <whawes@star.net>, June 97
52 *
53 * Added devfs support.
54 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55 *
56 * Added support for a Unix98-style ptmx device.
57 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58 *
59 * Reduced memory usage for older ARM systems
60 * -- Russell King <rmk@arm.linux.org.uk>
61 *
62 * Move do_SAK() into process context. Less stack use in devfs functions.
63 * alloc_tty_struct() always uses kmalloc()
64 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65 */
66
67#include <linux/types.h>
68#include <linux/major.h>
69#include <linux/errno.h>
70#include <linux/signal.h>
71#include <linux/fcntl.h>
72#include <linux/sched.h>
73#include <linux/interrupt.h>
74#include <linux/tty.h>
75#include <linux/tty_driver.h>
76#include <linux/tty_flip.h>
77#include <linux/devpts_fs.h>
78#include <linux/file.h>
79#include <linux/fdtable.h>
80#include <linux/console.h>
81#include <linux/timer.h>
82#include <linux/ctype.h>
83#include <linux/kd.h>
84#include <linux/mm.h>
85#include <linux/string.h>
86#include <linux/slab.h>
87#include <linux/poll.h>
88#include <linux/proc_fs.h>
89#include <linux/init.h>
90#include <linux/module.h>
91#include <linux/device.h>
92#include <linux/wait.h>
93#include <linux/bitops.h>
94#include <linux/delay.h>
95#include <linux/seq_file.h>
96#include <linux/serial.h>
97#include <linux/ratelimit.h>
98
99#include <linux/uaccess.h>
100
101#include <linux/kbd_kern.h>
102#include <linux/vt_kern.h>
103#include <linux/selection.h>
104
105#include <linux/kmod.h>
106#include <linux/nsproxy.h>
107
108#undef TTY_DEBUG_HANGUP
109
110#define TTY_PARANOIA_CHECK 1
111#define CHECK_TTY_COUNT 1
112
113struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
114 .c_iflag = ICRNL | IXON,
115 .c_oflag = OPOST | ONLCR,
116 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
117 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
118 ECHOCTL | ECHOKE | IEXTEN,
119 .c_cc = INIT_C_CC,
120 .c_ispeed = 38400,
121 .c_ospeed = 38400
122};
123
124EXPORT_SYMBOL(tty_std_termios);
125
126/* This list gets poked at by procfs and various bits of boot up code. This
127 could do with some rationalisation such as pulling the tty proc function
128 into this file */
129
130LIST_HEAD(tty_drivers); /* linked list of tty drivers */
131
132/* Mutex to protect creating and releasing a tty. This is shared with
133 vt.c for deeply disgusting hack reasons */
134DEFINE_MUTEX(tty_mutex);
135EXPORT_SYMBOL(tty_mutex);
136
137/* Spinlock to protect the tty->tty_files list */
138DEFINE_SPINLOCK(tty_files_lock);
139
140static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
141static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
142ssize_t redirected_tty_write(struct file *, const char __user *,
143 size_t, loff_t *);
144static unsigned int tty_poll(struct file *, poll_table *);
145static int tty_open(struct inode *, struct file *);
146long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
147#ifdef CONFIG_COMPAT
148static long tty_compat_ioctl(struct file *file, unsigned int cmd,
149 unsigned long arg);
150#else
151#define tty_compat_ioctl NULL
152#endif
153static int __tty_fasync(int fd, struct file *filp, int on);
154static int tty_fasync(int fd, struct file *filp, int on);
155static void release_tty(struct tty_struct *tty, int idx);
156static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158
159/**
160 * alloc_tty_struct - allocate a tty object
161 *
162 * Return a new empty tty structure. The data fields have not
163 * been initialized in any way but has been zeroed
164 *
165 * Locking: none
166 */
167
168struct tty_struct *alloc_tty_struct(void)
169{
170 return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
171}
172
173/**
174 * free_tty_struct - free a disused tty
175 * @tty: tty struct to free
176 *
177 * Free the write buffers, tty queue and tty memory itself.
178 *
179 * Locking: none. Must be called after tty is definitely unused
180 */
181
182void free_tty_struct(struct tty_struct *tty)
183{
184 if (!tty)
185 return;
186 if (tty->dev)
187 put_device(tty->dev);
188 kfree(tty->write_buf);
189 tty->magic = 0xDEADDEAD;
190 kfree(tty);
191}
192
193static inline struct tty_struct *file_tty(struct file *file)
194{
195 return ((struct tty_file_private *)file->private_data)->tty;
196}
197
198int tty_alloc_file(struct file *file)
199{
200 struct tty_file_private *priv;
201
202 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
203 if (!priv)
204 return -ENOMEM;
205
206 file->private_data = priv;
207
208 return 0;
209}
210
211/* Associate a new file with the tty structure */
212void tty_add_file(struct tty_struct *tty, struct file *file)
213{
214 struct tty_file_private *priv = file->private_data;
215
216 priv->tty = tty;
217 priv->file = file;
218
219 spin_lock(&tty_files_lock);
220 list_add(&priv->list, &tty->tty_files);
221 spin_unlock(&tty_files_lock);
222}
223
224/**
225 * tty_free_file - free file->private_data
226 *
227 * This shall be used only for fail path handling when tty_add_file was not
228 * called yet.
229 */
230void tty_free_file(struct file *file)
231{
232 struct tty_file_private *priv = file->private_data;
233
234 file->private_data = NULL;
235 kfree(priv);
236}
237
238/* Delete file from its tty */
239static void tty_del_file(struct file *file)
240{
241 struct tty_file_private *priv = file->private_data;
242
243 spin_lock(&tty_files_lock);
244 list_del(&priv->list);
245 spin_unlock(&tty_files_lock);
246 tty_free_file(file);
247}
248
249
250#define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
251
252/**
253 * tty_name - return tty naming
254 * @tty: tty structure
255 * @buf: buffer for output
256 *
257 * Convert a tty structure into a name. The name reflects the kernel
258 * naming policy and if udev is in use may not reflect user space
259 *
260 * Locking: none
261 */
262
263char *tty_name(struct tty_struct *tty, char *buf)
264{
265 if (!tty) /* Hmm. NULL pointer. That's fun. */
266 strcpy(buf, "NULL tty");
267 else
268 strcpy(buf, tty->name);
269 return buf;
270}
271
272EXPORT_SYMBOL(tty_name);
273
274int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
275 const char *routine)
276{
277#ifdef TTY_PARANOIA_CHECK
278 if (!tty) {
279 printk(KERN_WARNING
280 "null TTY for (%d:%d) in %s\n",
281 imajor(inode), iminor(inode), routine);
282 return 1;
283 }
284 if (tty->magic != TTY_MAGIC) {
285 printk(KERN_WARNING
286 "bad magic number for tty struct (%d:%d) in %s\n",
287 imajor(inode), iminor(inode), routine);
288 return 1;
289 }
290#endif
291 return 0;
292}
293
294static int check_tty_count(struct tty_struct *tty, const char *routine)
295{
296#ifdef CHECK_TTY_COUNT
297 struct list_head *p;
298 int count = 0;
299
300 spin_lock(&tty_files_lock);
301 list_for_each(p, &tty->tty_files) {
302 count++;
303 }
304 spin_unlock(&tty_files_lock);
305 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
306 tty->driver->subtype == PTY_TYPE_SLAVE &&
307 tty->link && tty->link->count)
308 count++;
309 if (tty->count != count) {
310 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
311 "!= #fd's(%d) in %s\n",
312 tty->name, tty->count, count, routine);
313 return count;
314 }
315#endif
316 return 0;
317}
318
319/**
320 * get_tty_driver - find device of a tty
321 * @dev_t: device identifier
322 * @index: returns the index of the tty
323 *
324 * This routine returns a tty driver structure, given a device number
325 * and also passes back the index number.
326 *
327 * Locking: caller must hold tty_mutex
328 */
329
330static struct tty_driver *get_tty_driver(dev_t device, int *index)
331{
332 struct tty_driver *p;
333
334 list_for_each_entry(p, &tty_drivers, tty_drivers) {
335 dev_t base = MKDEV(p->major, p->minor_start);
336 if (device < base || device >= base + p->num)
337 continue;
338 *index = device - base;
339 return tty_driver_kref_get(p);
340 }
341 return NULL;
342}
343
344#ifdef CONFIG_CONSOLE_POLL
345
346/**
347 * tty_find_polling_driver - find device of a polled tty
348 * @name: name string to match
349 * @line: pointer to resulting tty line nr
350 *
351 * This routine returns a tty driver structure, given a name
352 * and the condition that the tty driver is capable of polled
353 * operation.
354 */
355struct tty_driver *tty_find_polling_driver(char *name, int *line)
356{
357 struct tty_driver *p, *res = NULL;
358 int tty_line = 0;
359 int len;
360 char *str, *stp;
361
362 for (str = name; *str; str++)
363 if ((*str >= '0' && *str <= '9') || *str == ',')
364 break;
365 if (!*str)
366 return NULL;
367
368 len = str - name;
369 tty_line = simple_strtoul(str, &str, 10);
370
371 mutex_lock(&tty_mutex);
372 /* Search through the tty devices to look for a match */
373 list_for_each_entry(p, &tty_drivers, tty_drivers) {
374 if (strncmp(name, p->name, len) != 0)
375 continue;
376 stp = str;
377 if (*stp == ',')
378 stp++;
379 if (*stp == '\0')
380 stp = NULL;
381
382 if (tty_line >= 0 && tty_line < p->num && p->ops &&
383 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
384 res = tty_driver_kref_get(p);
385 *line = tty_line;
386 break;
387 }
388 }
389 mutex_unlock(&tty_mutex);
390
391 return res;
392}
393EXPORT_SYMBOL_GPL(tty_find_polling_driver);
394#endif
395
396/**
397 * tty_check_change - check for POSIX terminal changes
398 * @tty: tty to check
399 *
400 * If we try to write to, or set the state of, a terminal and we're
401 * not in the foreground, send a SIGTTOU. If the signal is blocked or
402 * ignored, go ahead and perform the operation. (POSIX 7.2)
403 *
404 * Locking: ctrl_lock
405 */
406
407int tty_check_change(struct tty_struct *tty)
408{
409 unsigned long flags;
410 int ret = 0;
411
412 if (current->signal->tty != tty)
413 return 0;
414
415 spin_lock_irqsave(&tty->ctrl_lock, flags);
416
417 if (!tty->pgrp) {
418 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
419 goto out_unlock;
420 }
421 if (task_pgrp(current) == tty->pgrp)
422 goto out_unlock;
423 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
424 if (is_ignored(SIGTTOU))
425 goto out;
426 if (is_current_pgrp_orphaned()) {
427 ret = -EIO;
428 goto out;
429 }
430 kill_pgrp(task_pgrp(current), SIGTTOU, 1);
431 set_thread_flag(TIF_SIGPENDING);
432 ret = -ERESTARTSYS;
433out:
434 return ret;
435out_unlock:
436 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
437 return ret;
438}
439
440EXPORT_SYMBOL(tty_check_change);
441
442static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
443 size_t count, loff_t *ppos)
444{
445 return 0;
446}
447
448static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
449 size_t count, loff_t *ppos)
450{
451 return -EIO;
452}
453
454/* No kernel lock held - none needed ;) */
455static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
456{
457 return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
458}
459
460static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
461 unsigned long arg)
462{
463 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
464}
465
466static long hung_up_tty_compat_ioctl(struct file *file,
467 unsigned int cmd, unsigned long arg)
468{
469 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
470}
471
472static const struct file_operations tty_fops = {
473 .llseek = no_llseek,
474 .read = tty_read,
475 .write = tty_write,
476 .poll = tty_poll,
477 .unlocked_ioctl = tty_ioctl,
478 .compat_ioctl = tty_compat_ioctl,
479 .open = tty_open,
480 .release = tty_release,
481 .fasync = tty_fasync,
482};
483
484static const struct file_operations console_fops = {
485 .llseek = no_llseek,
486 .read = tty_read,
487 .write = redirected_tty_write,
488 .poll = tty_poll,
489 .unlocked_ioctl = tty_ioctl,
490 .compat_ioctl = tty_compat_ioctl,
491 .open = tty_open,
492 .release = tty_release,
493 .fasync = tty_fasync,
494};
495
496static const struct file_operations hung_up_tty_fops = {
497 .llseek = no_llseek,
498 .read = hung_up_tty_read,
499 .write = hung_up_tty_write,
500 .poll = hung_up_tty_poll,
501 .unlocked_ioctl = hung_up_tty_ioctl,
502 .compat_ioctl = hung_up_tty_compat_ioctl,
503 .release = tty_release,
504};
505
506static DEFINE_SPINLOCK(redirect_lock);
507static struct file *redirect;
508
509/**
510 * tty_wakeup - request more data
511 * @tty: terminal
512 *
513 * Internal and external helper for wakeups of tty. This function
514 * informs the line discipline if present that the driver is ready
515 * to receive more output data.
516 */
517
518void tty_wakeup(struct tty_struct *tty)
519{
520 struct tty_ldisc *ld;
521
522 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
523 ld = tty_ldisc_ref(tty);
524 if (ld) {
525 if (ld->ops->write_wakeup)
526 ld->ops->write_wakeup(tty);
527 tty_ldisc_deref(ld);
528 }
529 }
530 wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
531}
532
533EXPORT_SYMBOL_GPL(tty_wakeup);
534
535/**
536 * tty_signal_session_leader - sends SIGHUP to session leader
537 * @tty controlling tty
538 * @exit_session if non-zero, signal all foreground group processes
539 *
540 * Send SIGHUP and SIGCONT to the session leader and its process group.
541 * Optionally, signal all processes in the foreground process group.
542 *
543 * Returns the number of processes in the session with this tty
544 * as their controlling terminal. This value is used to drop
545 * tty references for those processes.
546 */
547static int tty_signal_session_leader(struct tty_struct *tty, int exit_session)
548{
549 struct task_struct *p;
550 int refs = 0;
551 struct pid *tty_pgrp = NULL;
552
553 read_lock(&tasklist_lock);
554 if (tty->session) {
555 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
556 spin_lock_irq(&p->sighand->siglock);
557 if (p->signal->tty == tty) {
558 p->signal->tty = NULL;
559 /* We defer the dereferences outside fo
560 the tasklist lock */
561 refs++;
562 }
563 if (!p->signal->leader) {
564 spin_unlock_irq(&p->sighand->siglock);
565 continue;
566 }
567 __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
568 __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
569 put_pid(p->signal->tty_old_pgrp); /* A noop */
570 spin_lock(&tty->ctrl_lock);
571 tty_pgrp = get_pid(tty->pgrp);
572 if (tty->pgrp)
573 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
574 spin_unlock(&tty->ctrl_lock);
575 spin_unlock_irq(&p->sighand->siglock);
576 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
577 }
578 read_unlock(&tasklist_lock);
579
580 if (tty_pgrp) {
581 if (exit_session)
582 kill_pgrp(tty_pgrp, SIGHUP, exit_session);
583 put_pid(tty_pgrp);
584 }
585
586 return refs;
587}
588
589/**
590 * __tty_hangup - actual handler for hangup events
591 * @work: tty device
592 *
593 * This can be called by a "kworker" kernel thread. That is process
594 * synchronous but doesn't hold any locks, so we need to make sure we
595 * have the appropriate locks for what we're doing.
596 *
597 * The hangup event clears any pending redirections onto the hung up
598 * device. It ensures future writes will error and it does the needed
599 * line discipline hangup and signal delivery. The tty object itself
600 * remains intact.
601 *
602 * Locking:
603 * BTM
604 * redirect lock for undoing redirection
605 * file list lock for manipulating list of ttys
606 * tty_ldiscs_lock from called functions
607 * termios_rwsem resetting termios data
608 * tasklist_lock to walk task list for hangup event
609 * ->siglock to protect ->signal/->sighand
610 */
611static void __tty_hangup(struct tty_struct *tty, int exit_session)
612{
613 struct file *cons_filp = NULL;
614 struct file *filp, *f = NULL;
615 struct tty_file_private *priv;
616 int closecount = 0, n;
617 int refs;
618
619 if (!tty)
620 return;
621
622
623 spin_lock(&redirect_lock);
624 if (redirect && file_tty(redirect) == tty) {
625 f = redirect;
626 redirect = NULL;
627 }
628 spin_unlock(&redirect_lock);
629
630 tty_lock(tty);
631
632 if (test_bit(TTY_HUPPED, &tty->flags)) {
633 tty_unlock(tty);
634 return;
635 }
636
637 /* some functions below drop BTM, so we need this bit */
638 set_bit(TTY_HUPPING, &tty->flags);
639
640 /* inuse_filps is protected by the single tty lock,
641 this really needs to change if we want to flush the
642 workqueue with the lock held */
643 check_tty_count(tty, "tty_hangup");
644
645 spin_lock(&tty_files_lock);
646 /* This breaks for file handles being sent over AF_UNIX sockets ? */
647 list_for_each_entry(priv, &tty->tty_files, list) {
648 filp = priv->file;
649 if (filp->f_op->write == redirected_tty_write)
650 cons_filp = filp;
651 if (filp->f_op->write != tty_write)
652 continue;
653 closecount++;
654 __tty_fasync(-1, filp, 0); /* can't block */
655 filp->f_op = &hung_up_tty_fops;
656 }
657 spin_unlock(&tty_files_lock);
658
659 refs = tty_signal_session_leader(tty, exit_session);
660 /* Account for the p->signal references we killed */
661 while (refs--)
662 tty_kref_put(tty);
663
664 /*
665 * it drops BTM and thus races with reopen
666 * we protect the race by TTY_HUPPING
667 */
668 tty_ldisc_hangup(tty);
669
670 spin_lock_irq(&tty->ctrl_lock);
671 clear_bit(TTY_THROTTLED, &tty->flags);
672 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
673 put_pid(tty->session);
674 put_pid(tty->pgrp);
675 tty->session = NULL;
676 tty->pgrp = NULL;
677 tty->ctrl_status = 0;
678 spin_unlock_irq(&tty->ctrl_lock);
679
680 /*
681 * If one of the devices matches a console pointer, we
682 * cannot just call hangup() because that will cause
683 * tty->count and state->count to go out of sync.
684 * So we just call close() the right number of times.
685 */
686 if (cons_filp) {
687 if (tty->ops->close)
688 for (n = 0; n < closecount; n++)
689 tty->ops->close(tty, cons_filp);
690 } else if (tty->ops->hangup)
691 (tty->ops->hangup)(tty);
692 /*
693 * We don't want to have driver/ldisc interactions beyond
694 * the ones we did here. The driver layer expects no
695 * calls after ->hangup() from the ldisc side. However we
696 * can't yet guarantee all that.
697 */
698 set_bit(TTY_HUPPED, &tty->flags);
699 clear_bit(TTY_HUPPING, &tty->flags);
700
701 tty_unlock(tty);
702
703 if (f)
704 fput(f);
705}
706
707static void do_tty_hangup(struct work_struct *work)
708{
709 struct tty_struct *tty =
710 container_of(work, struct tty_struct, hangup_work);
711
712 __tty_hangup(tty, 0);
713}
714
715/**
716 * tty_hangup - trigger a hangup event
717 * @tty: tty to hangup
718 *
719 * A carrier loss (virtual or otherwise) has occurred on this like
720 * schedule a hangup sequence to run after this event.
721 */
722
723void tty_hangup(struct tty_struct *tty)
724{
725#ifdef TTY_DEBUG_HANGUP
726 char buf[64];
727 printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
728#endif
729 schedule_work(&tty->hangup_work);
730}
731
732EXPORT_SYMBOL(tty_hangup);
733
734/**
735 * tty_vhangup - process vhangup
736 * @tty: tty to hangup
737 *
738 * The user has asked via system call for the terminal to be hung up.
739 * We do this synchronously so that when the syscall returns the process
740 * is complete. That guarantee is necessary for security reasons.
741 */
742
743void tty_vhangup(struct tty_struct *tty)
744{
745#ifdef TTY_DEBUG_HANGUP
746 char buf[64];
747
748 printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
749#endif
750 __tty_hangup(tty, 0);
751}
752
753EXPORT_SYMBOL(tty_vhangup);
754
755
756/**
757 * tty_vhangup_self - process vhangup for own ctty
758 *
759 * Perform a vhangup on the current controlling tty
760 */
761
762void tty_vhangup_self(void)
763{
764 struct tty_struct *tty;
765
766 tty = get_current_tty();
767 if (tty) {
768 tty_vhangup(tty);
769 tty_kref_put(tty);
770 }
771}
772
773/**
774 * tty_vhangup_session - hangup session leader exit
775 * @tty: tty to hangup
776 *
777 * The session leader is exiting and hanging up its controlling terminal.
778 * Every process in the foreground process group is signalled SIGHUP.
779 *
780 * We do this synchronously so that when the syscall returns the process
781 * is complete. That guarantee is necessary for security reasons.
782 */
783
784static void tty_vhangup_session(struct tty_struct *tty)
785{
786#ifdef TTY_DEBUG_HANGUP
787 char buf[64];
788
789 printk(KERN_DEBUG "%s vhangup session...\n", tty_name(tty, buf));
790#endif
791 __tty_hangup(tty, 1);
792}
793
794/**
795 * tty_hung_up_p - was tty hung up
796 * @filp: file pointer of tty
797 *
798 * Return true if the tty has been subject to a vhangup or a carrier
799 * loss
800 */
801
802int tty_hung_up_p(struct file *filp)
803{
804 return (filp->f_op == &hung_up_tty_fops);
805}
806
807EXPORT_SYMBOL(tty_hung_up_p);
808
809static void session_clear_tty(struct pid *session)
810{
811 struct task_struct *p;
812 do_each_pid_task(session, PIDTYPE_SID, p) {
813 proc_clear_tty(p);
814 } while_each_pid_task(session, PIDTYPE_SID, p);
815}
816
817/**
818 * disassociate_ctty - disconnect controlling tty
819 * @on_exit: true if exiting so need to "hang up" the session
820 *
821 * This function is typically called only by the session leader, when
822 * it wants to disassociate itself from its controlling tty.
823 *
824 * It performs the following functions:
825 * (1) Sends a SIGHUP and SIGCONT to the foreground process group
826 * (2) Clears the tty from being controlling the session
827 * (3) Clears the controlling tty for all processes in the
828 * session group.
829 *
830 * The argument on_exit is set to 1 if called when a process is
831 * exiting; it is 0 if called by the ioctl TIOCNOTTY.
832 *
833 * Locking:
834 * BTM is taken for hysterical raisins, and held when
835 * called from no_tty().
836 * tty_mutex is taken to protect tty
837 * ->siglock is taken to protect ->signal/->sighand
838 * tasklist_lock is taken to walk process list for sessions
839 * ->siglock is taken to protect ->signal/->sighand
840 */
841
842void disassociate_ctty(int on_exit)
843{
844 struct tty_struct *tty;
845
846 if (!current->signal->leader)
847 return;
848
849 tty = get_current_tty();
850 if (tty) {
851 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY) {
852 tty_vhangup_session(tty);
853 } else {
854 struct pid *tty_pgrp = tty_get_pgrp(tty);
855 if (tty_pgrp) {
856 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
857 if (!on_exit)
858 kill_pgrp(tty_pgrp, SIGCONT, on_exit);
859 put_pid(tty_pgrp);
860 }
861 }
862 tty_kref_put(tty);
863
864 } else if (on_exit) {
865 struct pid *old_pgrp;
866 spin_lock_irq(¤t->sighand->siglock);
867 old_pgrp = current->signal->tty_old_pgrp;
868 current->signal->tty_old_pgrp = NULL;
869 spin_unlock_irq(¤t->sighand->siglock);
870 if (old_pgrp) {
871 kill_pgrp(old_pgrp, SIGHUP, on_exit);
872 kill_pgrp(old_pgrp, SIGCONT, on_exit);
873 put_pid(old_pgrp);
874 }
875 return;
876 }
877
878 spin_lock_irq(¤t->sighand->siglock);
879 put_pid(current->signal->tty_old_pgrp);
880 current->signal->tty_old_pgrp = NULL;
881
882 tty = tty_kref_get(current->signal->tty);
883 if (tty) {
884 unsigned long flags;
885 spin_lock_irqsave(&tty->ctrl_lock, flags);
886 put_pid(tty->session);
887 put_pid(tty->pgrp);
888 tty->session = NULL;
889 tty->pgrp = NULL;
890 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
891 tty_kref_put(tty);
892 } else {
893#ifdef TTY_DEBUG_HANGUP
894 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
895 " = NULL", tty);
896#endif
897 }
898
899 spin_unlock_irq(¤t->sighand->siglock);
900 /* Now clear signal->tty under the lock */
901 read_lock(&tasklist_lock);
902 session_clear_tty(task_session(current));
903 read_unlock(&tasklist_lock);
904}
905
906/**
907 *
908 * no_tty - Ensure the current process does not have a controlling tty
909 */
910void no_tty(void)
911{
912 /* FIXME: Review locking here. The tty_lock never covered any race
913 between a new association and proc_clear_tty but possible we need
914 to protect against this anyway */
915 struct task_struct *tsk = current;
916 disassociate_ctty(0);
917 proc_clear_tty(tsk);
918}
919
920
921/**
922 * stop_tty - propagate flow control
923 * @tty: tty to stop
924 *
925 * Perform flow control to the driver. For PTY/TTY pairs we
926 * must also propagate the TIOCKPKT status. May be called
927 * on an already stopped device and will not re-call the driver
928 * method.
929 *
930 * This functionality is used by both the line disciplines for
931 * halting incoming flow and by the driver. It may therefore be
932 * called from any context, may be under the tty atomic_write_lock
933 * but not always.
934 *
935 * Locking:
936 * Uses the tty control lock internally
937 */
938
939void stop_tty(struct tty_struct *tty)
940{
941 unsigned long flags;
942 spin_lock_irqsave(&tty->ctrl_lock, flags);
943 if (tty->stopped) {
944 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
945 return;
946 }
947 tty->stopped = 1;
948 if (tty->link && tty->link->packet) {
949 tty->ctrl_status &= ~TIOCPKT_START;
950 tty->ctrl_status |= TIOCPKT_STOP;
951 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
952 }
953 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
954 if (tty->ops->stop)
955 (tty->ops->stop)(tty);
956}
957
958EXPORT_SYMBOL(stop_tty);
959
960/**
961 * start_tty - propagate flow control
962 * @tty: tty to start
963 *
964 * Start a tty that has been stopped if at all possible. Perform
965 * any necessary wakeups and propagate the TIOCPKT status. If this
966 * is the tty was previous stopped and is being started then the
967 * driver start method is invoked and the line discipline woken.
968 *
969 * Locking:
970 * ctrl_lock
971 */
972
973void start_tty(struct tty_struct *tty)
974{
975 unsigned long flags;
976 spin_lock_irqsave(&tty->ctrl_lock, flags);
977 if (!tty->stopped || tty->flow_stopped) {
978 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
979 return;
980 }
981 tty->stopped = 0;
982 if (tty->link && tty->link->packet) {
983 tty->ctrl_status &= ~TIOCPKT_STOP;
984 tty->ctrl_status |= TIOCPKT_START;
985 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
986 }
987 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
988 if (tty->ops->start)
989 (tty->ops->start)(tty);
990 /* If we have a running line discipline it may need kicking */
991 tty_wakeup(tty);
992}
993
994EXPORT_SYMBOL(start_tty);
995
996/* We limit tty time update visibility to every 8 seconds or so. */
997static void tty_update_time(struct timespec *time)
998{
999 unsigned long sec = get_seconds() & ~7;
1000 if ((long)(sec - time->tv_sec) > 0)
1001 time->tv_sec = sec;
1002}
1003
1004/**
1005 * tty_read - read method for tty device files
1006 * @file: pointer to tty file
1007 * @buf: user buffer
1008 * @count: size of user buffer
1009 * @ppos: unused
1010 *
1011 * Perform the read system call function on this terminal device. Checks
1012 * for hung up devices before calling the line discipline method.
1013 *
1014 * Locking:
1015 * Locks the line discipline internally while needed. Multiple
1016 * read calls may be outstanding in parallel.
1017 */
1018
1019static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
1020 loff_t *ppos)
1021{
1022 int i;
1023 struct inode *inode = file_inode(file);
1024 struct tty_struct *tty = file_tty(file);
1025 struct tty_ldisc *ld;
1026
1027 if (tty_paranoia_check(tty, inode, "tty_read"))
1028 return -EIO;
1029 if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1030 return -EIO;
1031
1032 /* We want to wait for the line discipline to sort out in this
1033 situation */
1034 ld = tty_ldisc_ref_wait(tty);
1035 if (ld->ops->read)
1036 i = (ld->ops->read)(tty, file, buf, count);
1037 else
1038 i = -EIO;
1039 tty_ldisc_deref(ld);
1040
1041 if (i > 0)
1042 tty_update_time(&inode->i_atime);
1043
1044 return i;
1045}
1046
1047void tty_write_unlock(struct tty_struct *tty)
1048 __releases(&tty->atomic_write_lock)
1049{
1050 mutex_unlock(&tty->atomic_write_lock);
1051 wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
1052}
1053
1054int tty_write_lock(struct tty_struct *tty, int ndelay)
1055 __acquires(&tty->atomic_write_lock)
1056{
1057 if (!mutex_trylock(&tty->atomic_write_lock)) {
1058 if (ndelay)
1059 return -EAGAIN;
1060 if (mutex_lock_interruptible(&tty->atomic_write_lock))
1061 return -ERESTARTSYS;
1062 }
1063 return 0;
1064}
1065
1066/*
1067 * Split writes up in sane blocksizes to avoid
1068 * denial-of-service type attacks
1069 */
1070static inline ssize_t do_tty_write(
1071 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1072 struct tty_struct *tty,
1073 struct file *file,
1074 const char __user *buf,
1075 size_t count)
1076{
1077 ssize_t ret, written = 0;
1078 unsigned int chunk;
1079
1080 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1081 if (ret < 0)
1082 return ret;
1083
1084 /*
1085 * We chunk up writes into a temporary buffer. This
1086 * simplifies low-level drivers immensely, since they
1087 * don't have locking issues and user mode accesses.
1088 *
1089 * But if TTY_NO_WRITE_SPLIT is set, we should use a
1090 * big chunk-size..
1091 *
1092 * The default chunk-size is 2kB, because the NTTY
1093 * layer has problems with bigger chunks. It will
1094 * claim to be able to handle more characters than
1095 * it actually does.
1096 *
1097 * FIXME: This can probably go away now except that 64K chunks
1098 * are too likely to fail unless switched to vmalloc...
1099 */
1100 chunk = 2048;
1101 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1102 chunk = 65536;
1103 if (count < chunk)
1104 chunk = count;
1105
1106 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1107 if (tty->write_cnt < chunk) {
1108 unsigned char *buf_chunk;
1109
1110 if (chunk < 1024)
1111 chunk = 1024;
1112
1113 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1114 if (!buf_chunk) {
1115 ret = -ENOMEM;
1116 goto out;
1117 }
1118 kfree(tty->write_buf);
1119 tty->write_cnt = chunk;
1120 tty->write_buf = buf_chunk;
1121 }
1122
1123 /* Do the write .. */
1124 for (;;) {
1125 size_t size = count;
1126 if (size > chunk)
1127 size = chunk;
1128 ret = -EFAULT;
1129 if (copy_from_user(tty->write_buf, buf, size))
1130 break;
1131 ret = write(tty, file, tty->write_buf, size);
1132 if (ret <= 0)
1133 break;
1134 written += ret;
1135 buf += ret;
1136 count -= ret;
1137 if (!count)
1138 break;
1139 ret = -ERESTARTSYS;
1140 if (signal_pending(current))
1141 break;
1142 cond_resched();
1143 }
1144 if (written) {
1145 tty_update_time(&file_inode(file)->i_mtime);
1146 ret = written;
1147 }
1148out:
1149 tty_write_unlock(tty);
1150 return ret;
1151}
1152
1153/**
1154 * tty_write_message - write a message to a certain tty, not just the console.
1155 * @tty: the destination tty_struct
1156 * @msg: the message to write
1157 *
1158 * This is used for messages that need to be redirected to a specific tty.
1159 * We don't put it into the syslog queue right now maybe in the future if
1160 * really needed.
1161 *
1162 * We must still hold the BTM and test the CLOSING flag for the moment.
1163 */
1164
1165void tty_write_message(struct tty_struct *tty, char *msg)
1166{
1167 if (tty) {
1168 mutex_lock(&tty->atomic_write_lock);
1169 tty_lock(tty);
1170 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1171 tty_unlock(tty);
1172 tty->ops->write(tty, msg, strlen(msg));
1173 } else
1174 tty_unlock(tty);
1175 tty_write_unlock(tty);
1176 }
1177 return;
1178}
1179
1180
1181/**
1182 * tty_write - write method for tty device file
1183 * @file: tty file pointer
1184 * @buf: user data to write
1185 * @count: bytes to write
1186 * @ppos: unused
1187 *
1188 * Write data to a tty device via the line discipline.
1189 *
1190 * Locking:
1191 * Locks the line discipline as required
1192 * Writes to the tty driver are serialized by the atomic_write_lock
1193 * and are then processed in chunks to the device. The line discipline
1194 * write method will not be invoked in parallel for each device.
1195 */
1196
1197static ssize_t tty_write(struct file *file, const char __user *buf,
1198 size_t count, loff_t *ppos)
1199{
1200 struct tty_struct *tty = file_tty(file);
1201 struct tty_ldisc *ld;
1202 ssize_t ret;
1203
1204 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1205 return -EIO;
1206 if (!tty || !tty->ops->write ||
1207 (test_bit(TTY_IO_ERROR, &tty->flags)))
1208 return -EIO;
1209 /* Short term debug to catch buggy drivers */
1210 if (tty->ops->write_room == NULL)
1211 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1212 tty->driver->name);
1213 ld = tty_ldisc_ref_wait(tty);
1214 if (!ld->ops->write)
1215 ret = -EIO;
1216 else
1217 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1218 tty_ldisc_deref(ld);
1219 return ret;
1220}
1221
1222ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1223 size_t count, loff_t *ppos)
1224{
1225 struct file *p = NULL;
1226
1227 spin_lock(&redirect_lock);
1228 if (redirect)
1229 p = get_file(redirect);
1230 spin_unlock(&redirect_lock);
1231
1232 if (p) {
1233 ssize_t res;
1234 res = vfs_write(p, buf, count, &p->f_pos);
1235 fput(p);
1236 return res;
1237 }
1238 return tty_write(file, buf, count, ppos);
1239}
1240
1241static char ptychar[] = "pqrstuvwxyzabcde";
1242
1243/**
1244 * pty_line_name - generate name for a pty
1245 * @driver: the tty driver in use
1246 * @index: the minor number
1247 * @p: output buffer of at least 6 bytes
1248 *
1249 * Generate a name from a driver reference and write it to the output
1250 * buffer.
1251 *
1252 * Locking: None
1253 */
1254static void pty_line_name(struct tty_driver *driver, int index, char *p)
1255{
1256 int i = index + driver->name_base;
1257 /* ->name is initialized to "ttyp", but "tty" is expected */
1258 sprintf(p, "%s%c%x",
1259 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1260 ptychar[i >> 4 & 0xf], i & 0xf);
1261}
1262
1263/**
1264 * tty_line_name - generate name for a tty
1265 * @driver: the tty driver in use
1266 * @index: the minor number
1267 * @p: output buffer of at least 7 bytes
1268 *
1269 * Generate a name from a driver reference and write it to the output
1270 * buffer.
1271 *
1272 * Locking: None
1273 */
1274static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1275{
1276 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1277 return sprintf(p, "%s", driver->name);
1278 else
1279 return sprintf(p, "%s%d", driver->name,
1280 index + driver->name_base);
1281}
1282
1283/**
1284 * tty_driver_lookup_tty() - find an existing tty, if any
1285 * @driver: the driver for the tty
1286 * @idx: the minor number
1287 *
1288 * Return the tty, if found or ERR_PTR() otherwise.
1289 *
1290 * Locking: tty_mutex must be held. If tty is found, the mutex must
1291 * be held until the 'fast-open' is also done. Will change once we
1292 * have refcounting in the driver and per driver locking
1293 */
1294static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1295 struct inode *inode, int idx)
1296{
1297 if (driver->ops->lookup)
1298 return driver->ops->lookup(driver, inode, idx);
1299
1300 return driver->ttys[idx];
1301}
1302
1303/**
1304 * tty_init_termios - helper for termios setup
1305 * @tty: the tty to set up
1306 *
1307 * Initialise the termios structures for this tty. Thus runs under
1308 * the tty_mutex currently so we can be relaxed about ordering.
1309 */
1310
1311int tty_init_termios(struct tty_struct *tty)
1312{
1313 struct ktermios *tp;
1314 int idx = tty->index;
1315
1316 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1317 tty->termios = tty->driver->init_termios;
1318 else {
1319 /* Check for lazy saved data */
1320 tp = tty->driver->termios[idx];
1321 if (tp != NULL)
1322 tty->termios = *tp;
1323 else
1324 tty->termios = tty->driver->init_termios;
1325 }
1326 /* Compatibility until drivers always set this */
1327 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1328 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1329 return 0;
1330}
1331EXPORT_SYMBOL_GPL(tty_init_termios);
1332
1333int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1334{
1335 int ret = tty_init_termios(tty);
1336 if (ret)
1337 return ret;
1338
1339 tty_driver_kref_get(driver);
1340 tty->count++;
1341 driver->ttys[tty->index] = tty;
1342 return 0;
1343}
1344EXPORT_SYMBOL_GPL(tty_standard_install);
1345
1346/**
1347 * tty_driver_install_tty() - install a tty entry in the driver
1348 * @driver: the driver for the tty
1349 * @tty: the tty
1350 *
1351 * Install a tty object into the driver tables. The tty->index field
1352 * will be set by the time this is called. This method is responsible
1353 * for ensuring any need additional structures are allocated and
1354 * configured.
1355 *
1356 * Locking: tty_mutex for now
1357 */
1358static int tty_driver_install_tty(struct tty_driver *driver,
1359 struct tty_struct *tty)
1360{
1361 return driver->ops->install ? driver->ops->install(driver, tty) :
1362 tty_standard_install(driver, tty);
1363}
1364
1365/**
1366 * tty_driver_remove_tty() - remove a tty from the driver tables
1367 * @driver: the driver for the tty
1368 * @idx: the minor number
1369 *
1370 * Remvoe a tty object from the driver tables. The tty->index field
1371 * will be set by the time this is called.
1372 *
1373 * Locking: tty_mutex for now
1374 */
1375void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1376{
1377 if (driver->ops->remove)
1378 driver->ops->remove(driver, tty);
1379 else
1380 driver->ttys[tty->index] = NULL;
1381}
1382
1383/*
1384 * tty_reopen() - fast re-open of an open tty
1385 * @tty - the tty to open
1386 *
1387 * Return 0 on success, -errno on error.
1388 *
1389 * Locking: tty_mutex must be held from the time the tty was found
1390 * till this open completes.
1391 */
1392static int tty_reopen(struct tty_struct *tty)
1393{
1394 struct tty_driver *driver = tty->driver;
1395
1396 if (test_bit(TTY_CLOSING, &tty->flags) ||
1397 test_bit(TTY_HUPPING, &tty->flags))
1398 return -EIO;
1399
1400 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1401 driver->subtype == PTY_TYPE_MASTER) {
1402 /*
1403 * special case for PTY masters: only one open permitted,
1404 * and the slave side open count is incremented as well.
1405 */
1406 if (tty->count)
1407 return -EIO;
1408
1409 tty->link->count++;
1410 }
1411 tty->count++;
1412
1413 WARN_ON(!tty->ldisc);
1414
1415 return 0;
1416}
1417
1418/**
1419 * tty_init_dev - initialise a tty device
1420 * @driver: tty driver we are opening a device on
1421 * @idx: device index
1422 * @ret_tty: returned tty structure
1423 *
1424 * Prepare a tty device. This may not be a "new" clean device but
1425 * could also be an active device. The pty drivers require special
1426 * handling because of this.
1427 *
1428 * Locking:
1429 * The function is called under the tty_mutex, which
1430 * protects us from the tty struct or driver itself going away.
1431 *
1432 * On exit the tty device has the line discipline attached and
1433 * a reference count of 1. If a pair was created for pty/tty use
1434 * and the other was a pty master then it too has a reference count of 1.
1435 *
1436 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1437 * failed open. The new code protects the open with a mutex, so it's
1438 * really quite straightforward. The mutex locking can probably be
1439 * relaxed for the (most common) case of reopening a tty.
1440 */
1441
1442struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1443{
1444 struct tty_struct *tty;
1445 int retval;
1446
1447 /*
1448 * First time open is complex, especially for PTY devices.
1449 * This code guarantees that either everything succeeds and the
1450 * TTY is ready for operation, or else the table slots are vacated
1451 * and the allocated memory released. (Except that the termios
1452 * and locked termios may be retained.)
1453 */
1454
1455 if (!try_module_get(driver->owner))
1456 return ERR_PTR(-ENODEV);
1457
1458 tty = alloc_tty_struct();
1459 if (!tty) {
1460 retval = -ENOMEM;
1461 goto err_module_put;
1462 }
1463 initialize_tty_struct(tty, driver, idx);
1464
1465 tty_lock(tty);
1466 retval = tty_driver_install_tty(driver, tty);
1467 if (retval < 0)
1468 goto err_deinit_tty;
1469
1470 if (!tty->port)
1471 tty->port = driver->ports[idx];
1472
1473 WARN_RATELIMIT(!tty->port,
1474 "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1475 __func__, tty->driver->name);
1476
1477 tty->port->itty = tty;
1478
1479 /*
1480 * Structures all installed ... call the ldisc open routines.
1481 * If we fail here just call release_tty to clean up. No need
1482 * to decrement the use counts, as release_tty doesn't care.
1483 */
1484 retval = tty_ldisc_setup(tty, tty->link);
1485 if (retval)
1486 goto err_release_tty;
1487 /* Return the tty locked so that it cannot vanish under the caller */
1488 return tty;
1489
1490err_deinit_tty:
1491 tty_unlock(tty);
1492 deinitialize_tty_struct(tty);
1493 free_tty_struct(tty);
1494err_module_put:
1495 module_put(driver->owner);
1496 return ERR_PTR(retval);
1497
1498 /* call the tty release_tty routine to clean out this slot */
1499err_release_tty:
1500 tty_unlock(tty);
1501 printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1502 "clearing slot %d\n", idx);
1503 release_tty(tty, idx);
1504 return ERR_PTR(retval);
1505}
1506
1507void tty_free_termios(struct tty_struct *tty)
1508{
1509 struct ktermios *tp;
1510 int idx = tty->index;
1511
1512 /* If the port is going to reset then it has no termios to save */
1513 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1514 return;
1515
1516 /* Stash the termios data */
1517 tp = tty->driver->termios[idx];
1518 if (tp == NULL) {
1519 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1520 if (tp == NULL) {
1521 pr_warn("tty: no memory to save termios state.\n");
1522 return;
1523 }
1524 tty->driver->termios[idx] = tp;
1525 }
1526 *tp = tty->termios;
1527}
1528EXPORT_SYMBOL(tty_free_termios);
1529
1530/**
1531 * tty_flush_works - flush all works of a tty
1532 * @tty: tty device to flush works for
1533 *
1534 * Sync flush all works belonging to @tty.
1535 */
1536static void tty_flush_works(struct tty_struct *tty)
1537{
1538 flush_work(&tty->SAK_work);
1539 flush_work(&tty->hangup_work);
1540}
1541
1542/**
1543 * release_one_tty - release tty structure memory
1544 * @kref: kref of tty we are obliterating
1545 *
1546 * Releases memory associated with a tty structure, and clears out the
1547 * driver table slots. This function is called when a device is no longer
1548 * in use. It also gets called when setup of a device fails.
1549 *
1550 * Locking:
1551 * takes the file list lock internally when working on the list
1552 * of ttys that the driver keeps.
1553 *
1554 * This method gets called from a work queue so that the driver private
1555 * cleanup ops can sleep (needed for USB at least)
1556 */
1557static void release_one_tty(struct work_struct *work)
1558{
1559 struct tty_struct *tty =
1560 container_of(work, struct tty_struct, hangup_work);
1561 struct tty_driver *driver = tty->driver;
1562
1563 if (tty->ops->cleanup)
1564 tty->ops->cleanup(tty);
1565
1566 tty->magic = 0;
1567 tty_driver_kref_put(driver);
1568 module_put(driver->owner);
1569
1570 spin_lock(&tty_files_lock);
1571 list_del_init(&tty->tty_files);
1572 spin_unlock(&tty_files_lock);
1573
1574 put_pid(tty->pgrp);
1575 put_pid(tty->session);
1576 free_tty_struct(tty);
1577}
1578
1579static void queue_release_one_tty(struct kref *kref)
1580{
1581 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1582
1583 /* The hangup queue is now free so we can reuse it rather than
1584 waste a chunk of memory for each port */
1585 INIT_WORK(&tty->hangup_work, release_one_tty);
1586 schedule_work(&tty->hangup_work);
1587}
1588
1589/**
1590 * tty_kref_put - release a tty kref
1591 * @tty: tty device
1592 *
1593 * Release a reference to a tty device and if need be let the kref
1594 * layer destruct the object for us
1595 */
1596
1597void tty_kref_put(struct tty_struct *tty)
1598{
1599 if (tty)
1600 kref_put(&tty->kref, queue_release_one_tty);
1601}
1602EXPORT_SYMBOL(tty_kref_put);
1603
1604/**
1605 * release_tty - release tty structure memory
1606 *
1607 * Release both @tty and a possible linked partner (think pty pair),
1608 * and decrement the refcount of the backing module.
1609 *
1610 * Locking:
1611 * tty_mutex
1612 * takes the file list lock internally when working on the list
1613 * of ttys that the driver keeps.
1614 *
1615 */
1616static void release_tty(struct tty_struct *tty, int idx)
1617{
1618 /* This should always be true but check for the moment */
1619 WARN_ON(tty->index != idx);
1620 WARN_ON(!mutex_is_locked(&tty_mutex));
1621 if (tty->ops->shutdown)
1622 tty->ops->shutdown(tty);
1623 tty_free_termios(tty);
1624 tty_driver_remove_tty(tty->driver, tty);
1625 tty->port->itty = NULL;
1626 if (tty->link)
1627 tty->link->port->itty = NULL;
1628 cancel_work_sync(&tty->port->buf.work);
1629
1630 if (tty->link)
1631 tty_kref_put(tty->link);
1632 tty_kref_put(tty);
1633}
1634
1635/**
1636 * tty_release_checks - check a tty before real release
1637 * @tty: tty to check
1638 * @o_tty: link of @tty (if any)
1639 * @idx: index of the tty
1640 *
1641 * Performs some paranoid checking before true release of the @tty.
1642 * This is a no-op unless TTY_PARANOIA_CHECK is defined.
1643 */
1644static int tty_release_checks(struct tty_struct *tty, struct tty_struct *o_tty,
1645 int idx)
1646{
1647#ifdef TTY_PARANOIA_CHECK
1648 if (idx < 0 || idx >= tty->driver->num) {
1649 printk(KERN_DEBUG "%s: bad idx when trying to free (%s)\n",
1650 __func__, tty->name);
1651 return -1;
1652 }
1653
1654 /* not much to check for devpts */
1655 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1656 return 0;
1657
1658 if (tty != tty->driver->ttys[idx]) {
1659 printk(KERN_DEBUG "%s: driver.table[%d] not tty for (%s)\n",
1660 __func__, idx, tty->name);
1661 return -1;
1662 }
1663 if (tty->driver->other) {
1664 if (o_tty != tty->driver->other->ttys[idx]) {
1665 printk(KERN_DEBUG "%s: other->table[%d] not o_tty for (%s)\n",
1666 __func__, idx, tty->name);
1667 return -1;
1668 }
1669 if (o_tty->link != tty) {
1670 printk(KERN_DEBUG "%s: bad pty pointers\n", __func__);
1671 return -1;
1672 }
1673 }
1674#endif
1675 return 0;
1676}
1677
1678/**
1679 * tty_release - vfs callback for close
1680 * @inode: inode of tty
1681 * @filp: file pointer for handle to tty
1682 *
1683 * Called the last time each file handle is closed that references
1684 * this tty. There may however be several such references.
1685 *
1686 * Locking:
1687 * Takes bkl. See tty_release_dev
1688 *
1689 * Even releasing the tty structures is a tricky business.. We have
1690 * to be very careful that the structures are all released at the
1691 * same time, as interrupts might otherwise get the wrong pointers.
1692 *
1693 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1694 * lead to double frees or releasing memory still in use.
1695 */
1696
1697int tty_release(struct inode *inode, struct file *filp)
1698{
1699 struct tty_struct *tty = file_tty(filp);
1700 struct tty_struct *o_tty;
1701 int pty_master, tty_closing, o_tty_closing, do_sleep;
1702 int idx;
1703 char buf[64];
1704
1705 if (tty_paranoia_check(tty, inode, __func__))
1706 return 0;
1707
1708 tty_lock(tty);
1709 check_tty_count(tty, __func__);
1710
1711 __tty_fasync(-1, filp, 0);
1712
1713 idx = tty->index;
1714 pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1715 tty->driver->subtype == PTY_TYPE_MASTER);
1716 /* Review: parallel close */
1717 o_tty = tty->link;
1718
1719 if (tty_release_checks(tty, o_tty, idx)) {
1720 tty_unlock(tty);
1721 return 0;
1722 }
1723
1724#ifdef TTY_DEBUG_HANGUP
1725 printk(KERN_DEBUG "%s: %s (tty count=%d)...\n", __func__,
1726 tty_name(tty, buf), tty->count);
1727#endif
1728
1729 if (tty->ops->close)
1730 tty->ops->close(tty, filp);
1731
1732 tty_unlock(tty);
1733 /*
1734 * Sanity check: if tty->count is going to zero, there shouldn't be
1735 * any waiters on tty->read_wait or tty->write_wait. We test the
1736 * wait queues and kick everyone out _before_ actually starting to
1737 * close. This ensures that we won't block while releasing the tty
1738 * structure.
1739 *
1740 * The test for the o_tty closing is necessary, since the master and
1741 * slave sides may close in any order. If the slave side closes out
1742 * first, its count will be one, since the master side holds an open.
1743 * Thus this test wouldn't be triggered at the time the slave closes,
1744 * so we do it now.
1745 *
1746 * Note that it's possible for the tty to be opened again while we're
1747 * flushing out waiters. By recalculating the closing flags before
1748 * each iteration we avoid any problems.
1749 */
1750 while (1) {
1751 /* Guard against races with tty->count changes elsewhere and
1752 opens on /dev/tty */
1753
1754 mutex_lock(&tty_mutex);
1755 tty_lock_pair(tty, o_tty);
1756 tty_closing = tty->count <= 1;
1757 o_tty_closing = o_tty &&
1758 (o_tty->count <= (pty_master ? 1 : 0));
1759 do_sleep = 0;
1760
1761 if (tty_closing) {
1762 if (waitqueue_active(&tty->read_wait)) {
1763 wake_up_poll(&tty->read_wait, POLLIN);
1764 do_sleep++;
1765 }
1766 if (waitqueue_active(&tty->write_wait)) {
1767 wake_up_poll(&tty->write_wait, POLLOUT);
1768 do_sleep++;
1769 }
1770 }
1771 if (o_tty_closing) {
1772 if (waitqueue_active(&o_tty->read_wait)) {
1773 wake_up_poll(&o_tty->read_wait, POLLIN);
1774 do_sleep++;
1775 }
1776 if (waitqueue_active(&o_tty->write_wait)) {
1777 wake_up_poll(&o_tty->write_wait, POLLOUT);
1778 do_sleep++;
1779 }
1780 }
1781 if (!do_sleep)
1782 break;
1783
1784 printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
1785 __func__, tty_name(tty, buf));
1786 tty_unlock_pair(tty, o_tty);
1787 mutex_unlock(&tty_mutex);
1788 schedule();
1789 }
1790
1791 /*
1792 * The closing flags are now consistent with the open counts on
1793 * both sides, and we've completed the last operation that could
1794 * block, so it's safe to proceed with closing.
1795 *
1796 * We must *not* drop the tty_mutex until we ensure that a further
1797 * entry into tty_open can not pick up this tty.
1798 */
1799 if (pty_master) {
1800 if (--o_tty->count < 0) {
1801 printk(KERN_WARNING "%s: bad pty slave count (%d) for %s\n",
1802 __func__, o_tty->count, tty_name(o_tty, buf));
1803 o_tty->count = 0;
1804 }
1805 }
1806 if (--tty->count < 0) {
1807 printk(KERN_WARNING "%s: bad tty->count (%d) for %s\n",
1808 __func__, tty->count, tty_name(tty, buf));
1809 tty->count = 0;
1810 }
1811
1812 /*
1813 * We've decremented tty->count, so we need to remove this file
1814 * descriptor off the tty->tty_files list; this serves two
1815 * purposes:
1816 * - check_tty_count sees the correct number of file descriptors
1817 * associated with this tty.
1818 * - do_tty_hangup no longer sees this file descriptor as
1819 * something that needs to be handled for hangups.
1820 */
1821 tty_del_file(filp);
1822
1823 /*
1824 * Perform some housekeeping before deciding whether to return.
1825 *
1826 * Set the TTY_CLOSING flag if this was the last open. In the
1827 * case of a pty we may have to wait around for the other side
1828 * to close, and TTY_CLOSING makes sure we can't be reopened.
1829 */
1830 if (tty_closing)
1831 set_bit(TTY_CLOSING, &tty->flags);
1832 if (o_tty_closing)
1833 set_bit(TTY_CLOSING, &o_tty->flags);
1834
1835 /*
1836 * If _either_ side is closing, make sure there aren't any
1837 * processes that still think tty or o_tty is their controlling
1838 * tty.
1839 */
1840 if (tty_closing || o_tty_closing) {
1841 read_lock(&tasklist_lock);
1842 session_clear_tty(tty->session);
1843 if (o_tty)
1844 session_clear_tty(o_tty->session);
1845 read_unlock(&tasklist_lock);
1846 }
1847
1848 mutex_unlock(&tty_mutex);
1849 tty_unlock_pair(tty, o_tty);
1850 /* At this point the TTY_CLOSING flag should ensure a dead tty
1851 cannot be re-opened by a racing opener */
1852
1853 /* check whether both sides are closing ... */
1854 if (!tty_closing || (o_tty && !o_tty_closing))
1855 return 0;
1856
1857#ifdef TTY_DEBUG_HANGUP
1858 printk(KERN_DEBUG "%s: %s: final close\n", __func__, tty_name(tty, buf));
1859#endif
1860 /*
1861 * Ask the line discipline code to release its structures
1862 */
1863 tty_ldisc_release(tty, o_tty);
1864
1865 /* Wait for pending work before tty destruction commmences */
1866 tty_flush_works(tty);
1867 if (o_tty)
1868 tty_flush_works(o_tty);
1869
1870#ifdef TTY_DEBUG_HANGUP
1871 printk(KERN_DEBUG "%s: %s: freeing structure...\n", __func__, tty_name(tty, buf));
1872#endif
1873 /*
1874 * The release_tty function takes care of the details of clearing
1875 * the slots and preserving the termios structure. The tty_unlock_pair
1876 * should be safe as we keep a kref while the tty is locked (so the
1877 * unlock never unlocks a freed tty).
1878 */
1879 mutex_lock(&tty_mutex);
1880 release_tty(tty, idx);
1881 mutex_unlock(&tty_mutex);
1882
1883 return 0;
1884}
1885
1886/**
1887 * tty_open_current_tty - get tty of current task for open
1888 * @device: device number
1889 * @filp: file pointer to tty
1890 * @return: tty of the current task iff @device is /dev/tty
1891 *
1892 * We cannot return driver and index like for the other nodes because
1893 * devpts will not work then. It expects inodes to be from devpts FS.
1894 *
1895 * We need to move to returning a refcounted object from all the lookup
1896 * paths including this one.
1897 */
1898static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1899{
1900 struct tty_struct *tty;
1901
1902 if (device != MKDEV(TTYAUX_MAJOR, 0))
1903 return NULL;
1904
1905 tty = get_current_tty();
1906 if (!tty)
1907 return ERR_PTR(-ENXIO);
1908
1909 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1910 /* noctty = 1; */
1911 tty_kref_put(tty);
1912 /* FIXME: we put a reference and return a TTY! */
1913 /* This is only safe because the caller holds tty_mutex */
1914 return tty;
1915}
1916
1917/**
1918 * tty_lookup_driver - lookup a tty driver for a given device file
1919 * @device: device number
1920 * @filp: file pointer to tty
1921 * @noctty: set if the device should not become a controlling tty
1922 * @index: index for the device in the @return driver
1923 * @return: driver for this inode (with increased refcount)
1924 *
1925 * If @return is not erroneous, the caller is responsible to decrement the
1926 * refcount by tty_driver_kref_put.
1927 *
1928 * Locking: tty_mutex protects get_tty_driver
1929 */
1930static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1931 int *noctty, int *index)
1932{
1933 struct tty_driver *driver;
1934
1935 switch (device) {
1936#ifdef CONFIG_VT
1937 case MKDEV(TTY_MAJOR, 0): {
1938 extern struct tty_driver *console_driver;
1939 driver = tty_driver_kref_get(console_driver);
1940 *index = fg_console;
1941 *noctty = 1;
1942 break;
1943 }
1944#endif
1945 case MKDEV(TTYAUX_MAJOR, 1): {
1946 struct tty_driver *console_driver = console_device(index);
1947 if (console_driver) {
1948 driver = tty_driver_kref_get(console_driver);
1949 if (driver) {
1950 /* Don't let /dev/console block */
1951 filp->f_flags |= O_NONBLOCK;
1952 *noctty = 1;
1953 break;
1954 }
1955 }
1956 return ERR_PTR(-ENODEV);
1957 }
1958 default:
1959 driver = get_tty_driver(device, index);
1960 if (!driver)
1961 return ERR_PTR(-ENODEV);
1962 break;
1963 }
1964 return driver;
1965}
1966
1967/**
1968 * tty_open - open a tty device
1969 * @inode: inode of device file
1970 * @filp: file pointer to tty
1971 *
1972 * tty_open and tty_release keep up the tty count that contains the
1973 * number of opens done on a tty. We cannot use the inode-count, as
1974 * different inodes might point to the same tty.
1975 *
1976 * Open-counting is needed for pty masters, as well as for keeping
1977 * track of serial lines: DTR is dropped when the last close happens.
1978 * (This is not done solely through tty->count, now. - Ted 1/27/92)
1979 *
1980 * The termios state of a pty is reset on first open so that
1981 * settings don't persist across reuse.
1982 *
1983 * Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
1984 * tty->count should protect the rest.
1985 * ->siglock protects ->signal/->sighand
1986 *
1987 * Note: the tty_unlock/lock cases without a ref are only safe due to
1988 * tty_mutex
1989 */
1990
1991static int tty_open(struct inode *inode, struct file *filp)
1992{
1993 struct tty_struct *tty;
1994 int noctty, retval;
1995 struct tty_driver *driver = NULL;
1996 int index;
1997 dev_t device = inode->i_rdev;
1998 unsigned saved_flags = filp->f_flags;
1999
2000 nonseekable_open(inode, filp);
2001
2002retry_open:
2003 retval = tty_alloc_file(filp);
2004 if (retval)
2005 return -ENOMEM;
2006
2007 noctty = filp->f_flags & O_NOCTTY;
2008 index = -1;
2009 retval = 0;
2010
2011 mutex_lock(&tty_mutex);
2012 /* This is protected by the tty_mutex */
2013 tty = tty_open_current_tty(device, filp);
2014 if (IS_ERR(tty)) {
2015 retval = PTR_ERR(tty);
2016 goto err_unlock;
2017 } else if (!tty) {
2018 driver = tty_lookup_driver(device, filp, &noctty, &index);
2019 if (IS_ERR(driver)) {
2020 retval = PTR_ERR(driver);
2021 goto err_unlock;
2022 }
2023
2024 /* check whether we're reopening an existing tty */
2025 tty = tty_driver_lookup_tty(driver, inode, index);
2026 if (IS_ERR(tty)) {
2027 retval = PTR_ERR(tty);
2028 goto err_unlock;
2029 }
2030 }
2031
2032 if (tty) {
2033 tty_lock(tty);
2034 retval = tty_reopen(tty);
2035 if (retval < 0) {
2036 tty_unlock(tty);
2037 tty = ERR_PTR(retval);
2038 }
2039 } else /* Returns with the tty_lock held for now */
2040 tty = tty_init_dev(driver, index);
2041
2042 mutex_unlock(&tty_mutex);
2043 if (driver)
2044 tty_driver_kref_put(driver);
2045 if (IS_ERR(tty)) {
2046 retval = PTR_ERR(tty);
2047 goto err_file;
2048 }
2049
2050 tty_add_file(tty, filp);
2051
2052 check_tty_count(tty, __func__);
2053 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2054 tty->driver->subtype == PTY_TYPE_MASTER)
2055 noctty = 1;
2056#ifdef TTY_DEBUG_HANGUP
2057 printk(KERN_DEBUG "%s: opening %s...\n", __func__, tty->name);
2058#endif
2059 if (tty->ops->open)
2060 retval = tty->ops->open(tty, filp);
2061 else
2062 retval = -ENODEV;
2063 filp->f_flags = saved_flags;
2064
2065 if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
2066 !capable(CAP_SYS_ADMIN))
2067 retval = -EBUSY;
2068
2069 if (retval) {
2070#ifdef TTY_DEBUG_HANGUP
2071 printk(KERN_DEBUG "%s: error %d in opening %s...\n", __func__,
2072 retval, tty->name);
2073#endif
2074 tty_unlock(tty); /* need to call tty_release without BTM */
2075 tty_release(inode, filp);
2076 if (retval != -ERESTARTSYS)
2077 return retval;
2078
2079 if (signal_pending(current))
2080 return retval;
2081
2082 schedule();
2083 /*
2084 * Need to reset f_op in case a hangup happened.
2085 */
2086 if (filp->f_op == &hung_up_tty_fops)
2087 filp->f_op = &tty_fops;
2088 goto retry_open;
2089 }
2090 clear_bit(TTY_HUPPED, &tty->flags);
2091 tty_unlock(tty);
2092
2093
2094 mutex_lock(&tty_mutex);
2095 tty_lock(tty);
2096 spin_lock_irq(¤t->sighand->siglock);
2097 if (!noctty &&
2098 current->signal->leader &&
2099 !current->signal->tty &&
2100 tty->session == NULL)
2101 __proc_set_tty(current, tty);
2102 spin_unlock_irq(¤t->sighand->siglock);
2103 tty_unlock(tty);
2104 mutex_unlock(&tty_mutex);
2105 return 0;
2106err_unlock:
2107 mutex_unlock(&tty_mutex);
2108 /* after locks to avoid deadlock */
2109 if (!IS_ERR_OR_NULL(driver))
2110 tty_driver_kref_put(driver);
2111err_file:
2112 tty_free_file(filp);
2113 return retval;
2114}
2115
2116
2117
2118/**
2119 * tty_poll - check tty status
2120 * @filp: file being polled
2121 * @wait: poll wait structures to update
2122 *
2123 * Call the line discipline polling method to obtain the poll
2124 * status of the device.
2125 *
2126 * Locking: locks called line discipline but ldisc poll method
2127 * may be re-entered freely by other callers.
2128 */
2129
2130static unsigned int tty_poll(struct file *filp, poll_table *wait)
2131{
2132 struct tty_struct *tty = file_tty(filp);
2133 struct tty_ldisc *ld;
2134 int ret = 0;
2135
2136 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2137 return 0;
2138
2139 ld = tty_ldisc_ref_wait(tty);
2140 if (ld->ops->poll)
2141 ret = (ld->ops->poll)(tty, filp, wait);
2142 tty_ldisc_deref(ld);
2143 return ret;
2144}
2145
2146static int __tty_fasync(int fd, struct file *filp, int on)
2147{
2148 struct tty_struct *tty = file_tty(filp);
2149 struct tty_ldisc *ldisc;
2150 unsigned long flags;
2151 int retval = 0;
2152
2153 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2154 goto out;
2155
2156 retval = fasync_helper(fd, filp, on, &tty->fasync);
2157 if (retval <= 0)
2158 goto out;
2159
2160 ldisc = tty_ldisc_ref(tty);
2161 if (ldisc) {
2162 if (ldisc->ops->fasync)
2163 ldisc->ops->fasync(tty, on);
2164 tty_ldisc_deref(ldisc);
2165 }
2166
2167 if (on) {
2168 enum pid_type type;
2169 struct pid *pid;
2170
2171 spin_lock_irqsave(&tty->ctrl_lock, flags);
2172 if (tty->pgrp) {
2173 pid = tty->pgrp;
2174 type = PIDTYPE_PGID;
2175 } else {
2176 pid = task_pid(current);
2177 type = PIDTYPE_PID;
2178 }
2179 get_pid(pid);
2180 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2181 retval = __f_setown(filp, pid, type, 0);
2182 put_pid(pid);
2183 }
2184out:
2185 return retval;
2186}
2187
2188static int tty_fasync(int fd, struct file *filp, int on)
2189{
2190 struct tty_struct *tty = file_tty(filp);
2191 int retval;
2192
2193 tty_lock(tty);
2194 retval = __tty_fasync(fd, filp, on);
2195 tty_unlock(tty);
2196
2197 return retval;
2198}
2199
2200/**
2201 * tiocsti - fake input character
2202 * @tty: tty to fake input into
2203 * @p: pointer to character
2204 *
2205 * Fake input to a tty device. Does the necessary locking and
2206 * input management.
2207 *
2208 * FIXME: does not honour flow control ??
2209 *
2210 * Locking:
2211 * Called functions take tty_ldiscs_lock
2212 * current->signal->tty check is safe without locks
2213 *
2214 * FIXME: may race normal receive processing
2215 */
2216
2217static int tiocsti(struct tty_struct *tty, char __user *p)
2218{
2219 char ch, mbz = 0;
2220 struct tty_ldisc *ld;
2221
2222 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2223 return -EPERM;
2224 if (get_user(ch, p))
2225 return -EFAULT;
2226 tty_audit_tiocsti(tty, ch);
2227 ld = tty_ldisc_ref_wait(tty);
2228 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2229 tty_ldisc_deref(ld);
2230 return 0;
2231}
2232
2233/**
2234 * tiocgwinsz - implement window query ioctl
2235 * @tty; tty
2236 * @arg: user buffer for result
2237 *
2238 * Copies the kernel idea of the window size into the user buffer.
2239 *
2240 * Locking: tty->winsize_mutex is taken to ensure the winsize data
2241 * is consistent.
2242 */
2243
2244static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2245{
2246 int err;
2247
2248 mutex_lock(&tty->winsize_mutex);
2249 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2250 mutex_unlock(&tty->winsize_mutex);
2251
2252 return err ? -EFAULT: 0;
2253}
2254
2255/**
2256 * tty_do_resize - resize event
2257 * @tty: tty being resized
2258 * @rows: rows (character)
2259 * @cols: cols (character)
2260 *
2261 * Update the termios variables and send the necessary signals to
2262 * peform a terminal resize correctly
2263 */
2264
2265int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2266{
2267 struct pid *pgrp;
2268 unsigned long flags;
2269
2270 /* Lock the tty */
2271 mutex_lock(&tty->winsize_mutex);
2272 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2273 goto done;
2274 /* Get the PID values and reference them so we can
2275 avoid holding the tty ctrl lock while sending signals */
2276 spin_lock_irqsave(&tty->ctrl_lock, flags);
2277 pgrp = get_pid(tty->pgrp);
2278 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2279
2280 if (pgrp)
2281 kill_pgrp(pgrp, SIGWINCH, 1);
2282 put_pid(pgrp);
2283
2284 tty->winsize = *ws;
2285done:
2286 mutex_unlock(&tty->winsize_mutex);
2287 return 0;
2288}
2289EXPORT_SYMBOL(tty_do_resize);
2290
2291/**
2292 * tiocswinsz - implement window size set ioctl
2293 * @tty; tty side of tty
2294 * @arg: user buffer for result
2295 *
2296 * Copies the user idea of the window size to the kernel. Traditionally
2297 * this is just advisory information but for the Linux console it
2298 * actually has driver level meaning and triggers a VC resize.
2299 *
2300 * Locking:
2301 * Driver dependent. The default do_resize method takes the
2302 * tty termios mutex and ctrl_lock. The console takes its own lock
2303 * then calls into the default method.
2304 */
2305
2306static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2307{
2308 struct winsize tmp_ws;
2309 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2310 return -EFAULT;
2311
2312 if (tty->ops->resize)
2313 return tty->ops->resize(tty, &tmp_ws);
2314 else
2315 return tty_do_resize(tty, &tmp_ws);
2316}
2317
2318/**
2319 * tioccons - allow admin to move logical console
2320 * @file: the file to become console
2321 *
2322 * Allow the administrator to move the redirected console device
2323 *
2324 * Locking: uses redirect_lock to guard the redirect information
2325 */
2326
2327static int tioccons(struct file *file)
2328{
2329 if (!capable(CAP_SYS_ADMIN))
2330 return -EPERM;
2331 if (file->f_op->write == redirected_tty_write) {
2332 struct file *f;
2333 spin_lock(&redirect_lock);
2334 f = redirect;
2335 redirect = NULL;
2336 spin_unlock(&redirect_lock);
2337 if (f)
2338 fput(f);
2339 return 0;
2340 }
2341 spin_lock(&redirect_lock);
2342 if (redirect) {
2343 spin_unlock(&redirect_lock);
2344 return -EBUSY;
2345 }
2346 redirect = get_file(file);
2347 spin_unlock(&redirect_lock);
2348 return 0;
2349}
2350
2351/**
2352 * fionbio - non blocking ioctl
2353 * @file: file to set blocking value
2354 * @p: user parameter
2355 *
2356 * Historical tty interfaces had a blocking control ioctl before
2357 * the generic functionality existed. This piece of history is preserved
2358 * in the expected tty API of posix OS's.
2359 *
2360 * Locking: none, the open file handle ensures it won't go away.
2361 */
2362
2363static int fionbio(struct file *file, int __user *p)
2364{
2365 int nonblock;
2366
2367 if (get_user(nonblock, p))
2368 return -EFAULT;
2369
2370 spin_lock(&file->f_lock);
2371 if (nonblock)
2372 file->f_flags |= O_NONBLOCK;
2373 else
2374 file->f_flags &= ~O_NONBLOCK;
2375 spin_unlock(&file->f_lock);
2376 return 0;
2377}
2378
2379/**
2380 * tiocsctty - set controlling tty
2381 * @tty: tty structure
2382 * @arg: user argument
2383 *
2384 * This ioctl is used to manage job control. It permits a session
2385 * leader to set this tty as the controlling tty for the session.
2386 *
2387 * Locking:
2388 * Takes tty_mutex() to protect tty instance
2389 * Takes tasklist_lock internally to walk sessions
2390 * Takes ->siglock() when updating signal->tty
2391 */
2392
2393static int tiocsctty(struct tty_struct *tty, int arg)
2394{
2395 int ret = 0;
2396 if (current->signal->leader && (task_session(current) == tty->session))
2397 return ret;
2398
2399 mutex_lock(&tty_mutex);
2400 /*
2401 * The process must be a session leader and
2402 * not have a controlling tty already.
2403 */
2404 if (!current->signal->leader || current->signal->tty) {
2405 ret = -EPERM;
2406 goto unlock;
2407 }
2408
2409 if (tty->session) {
2410 /*
2411 * This tty is already the controlling
2412 * tty for another session group!
2413 */
2414 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2415 /*
2416 * Steal it away
2417 */
2418 read_lock(&tasklist_lock);
2419 session_clear_tty(tty->session);
2420 read_unlock(&tasklist_lock);
2421 } else {
2422 ret = -EPERM;
2423 goto unlock;
2424 }
2425 }
2426 proc_set_tty(current, tty);
2427unlock:
2428 mutex_unlock(&tty_mutex);
2429 return ret;
2430}
2431
2432/**
2433 * tty_get_pgrp - return a ref counted pgrp pid
2434 * @tty: tty to read
2435 *
2436 * Returns a refcounted instance of the pid struct for the process
2437 * group controlling the tty.
2438 */
2439
2440struct pid *tty_get_pgrp(struct tty_struct *tty)
2441{
2442 unsigned long flags;
2443 struct pid *pgrp;
2444
2445 spin_lock_irqsave(&tty->ctrl_lock, flags);
2446 pgrp = get_pid(tty->pgrp);
2447 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2448
2449 return pgrp;
2450}
2451EXPORT_SYMBOL_GPL(tty_get_pgrp);
2452
2453/**
2454 * tiocgpgrp - get process group
2455 * @tty: tty passed by user
2456 * @real_tty: tty side of the tty passed by the user if a pty else the tty
2457 * @p: returned pid
2458 *
2459 * Obtain the process group of the tty. If there is no process group
2460 * return an error.
2461 *
2462 * Locking: none. Reference to current->signal->tty is safe.
2463 */
2464
2465static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2466{
2467 struct pid *pid;
2468 int ret;
2469 /*
2470 * (tty == real_tty) is a cheap way of
2471 * testing if the tty is NOT a master pty.
2472 */
2473 if (tty == real_tty && current->signal->tty != real_tty)
2474 return -ENOTTY;
2475 pid = tty_get_pgrp(real_tty);
2476 ret = put_user(pid_vnr(pid), p);
2477 put_pid(pid);
2478 return ret;
2479}
2480
2481/**
2482 * tiocspgrp - attempt to set process group
2483 * @tty: tty passed by user
2484 * @real_tty: tty side device matching tty passed by user
2485 * @p: pid pointer
2486 *
2487 * Set the process group of the tty to the session passed. Only
2488 * permitted where the tty session is our session.
2489 *
2490 * Locking: RCU, ctrl lock
2491 */
2492
2493static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2494{
2495 struct pid *pgrp;
2496 pid_t pgrp_nr;
2497 int retval = tty_check_change(real_tty);
2498 unsigned long flags;
2499
2500 if (retval == -EIO)
2501 return -ENOTTY;
2502 if (retval)
2503 return retval;
2504 if (!current->signal->tty ||
2505 (current->signal->tty != real_tty) ||
2506 (real_tty->session != task_session(current)))
2507 return -ENOTTY;
2508 if (get_user(pgrp_nr, p))
2509 return -EFAULT;
2510 if (pgrp_nr < 0)
2511 return -EINVAL;
2512 rcu_read_lock();
2513 pgrp = find_vpid(pgrp_nr);
2514 retval = -ESRCH;
2515 if (!pgrp)
2516 goto out_unlock;
2517 retval = -EPERM;
2518 if (session_of_pgrp(pgrp) != task_session(current))
2519 goto out_unlock;
2520 retval = 0;
2521 spin_lock_irqsave(&tty->ctrl_lock, flags);
2522 put_pid(real_tty->pgrp);
2523 real_tty->pgrp = get_pid(pgrp);
2524 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2525out_unlock:
2526 rcu_read_unlock();
2527 return retval;
2528}
2529
2530/**
2531 * tiocgsid - get session id
2532 * @tty: tty passed by user
2533 * @real_tty: tty side of the tty passed by the user if a pty else the tty
2534 * @p: pointer to returned session id
2535 *
2536 * Obtain the session id of the tty. If there is no session
2537 * return an error.
2538 *
2539 * Locking: none. Reference to current->signal->tty is safe.
2540 */
2541
2542static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2543{
2544 /*
2545 * (tty == real_tty) is a cheap way of
2546 * testing if the tty is NOT a master pty.
2547 */
2548 if (tty == real_tty && current->signal->tty != real_tty)
2549 return -ENOTTY;
2550 if (!real_tty->session)
2551 return -ENOTTY;
2552 return put_user(pid_vnr(real_tty->session), p);
2553}
2554
2555/**
2556 * tiocsetd - set line discipline
2557 * @tty: tty device
2558 * @p: pointer to user data
2559 *
2560 * Set the line discipline according to user request.
2561 *
2562 * Locking: see tty_set_ldisc, this function is just a helper
2563 */
2564
2565static int tiocsetd(struct tty_struct *tty, int __user *p)
2566{
2567 int ldisc;
2568 int ret;
2569
2570 if (get_user(ldisc, p))
2571 return -EFAULT;
2572
2573 ret = tty_set_ldisc(tty, ldisc);
2574
2575 return ret;
2576}
2577
2578/**
2579 * send_break - performed time break
2580 * @tty: device to break on
2581 * @duration: timeout in mS
2582 *
2583 * Perform a timed break on hardware that lacks its own driver level
2584 * timed break functionality.
2585 *
2586 * Locking:
2587 * atomic_write_lock serializes
2588 *
2589 */
2590
2591static int send_break(struct tty_struct *tty, unsigned int duration)
2592{
2593 int retval;
2594
2595 if (tty->ops->break_ctl == NULL)
2596 return 0;
2597
2598 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2599 retval = tty->ops->break_ctl(tty, duration);
2600 else {
2601 /* Do the work ourselves */
2602 if (tty_write_lock(tty, 0) < 0)
2603 return -EINTR;
2604 retval = tty->ops->break_ctl(tty, -1);
2605 if (retval)
2606 goto out;
2607 if (!signal_pending(current))
2608 msleep_interruptible(duration);
2609 retval = tty->ops->break_ctl(tty, 0);
2610out:
2611 tty_write_unlock(tty);
2612 if (signal_pending(current))
2613 retval = -EINTR;
2614 }
2615 return retval;
2616}
2617
2618/**
2619 * tty_tiocmget - get modem status
2620 * @tty: tty device
2621 * @file: user file pointer
2622 * @p: pointer to result
2623 *
2624 * Obtain the modem status bits from the tty driver if the feature
2625 * is supported. Return -EINVAL if it is not available.
2626 *
2627 * Locking: none (up to the driver)
2628 */
2629
2630static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2631{
2632 int retval = -EINVAL;
2633
2634 if (tty->ops->tiocmget) {
2635 retval = tty->ops->tiocmget(tty);
2636
2637 if (retval >= 0)
2638 retval = put_user(retval, p);
2639 }
2640 return retval;
2641}
2642
2643/**
2644 * tty_tiocmset - set modem status
2645 * @tty: tty device
2646 * @cmd: command - clear bits, set bits or set all
2647 * @p: pointer to desired bits
2648 *
2649 * Set the modem status bits from the tty driver if the feature
2650 * is supported. Return -EINVAL if it is not available.
2651 *
2652 * Locking: none (up to the driver)
2653 */
2654
2655static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2656 unsigned __user *p)
2657{
2658 int retval;
2659 unsigned int set, clear, val;
2660
2661 if (tty->ops->tiocmset == NULL)
2662 return -EINVAL;
2663
2664 retval = get_user(val, p);
2665 if (retval)
2666 return retval;
2667 set = clear = 0;
2668 switch (cmd) {
2669 case TIOCMBIS:
2670 set = val;
2671 break;
2672 case TIOCMBIC:
2673 clear = val;
2674 break;
2675 case TIOCMSET:
2676 set = val;
2677 clear = ~val;
2678 break;
2679 }
2680 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2681 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2682 return tty->ops->tiocmset(tty, set, clear);
2683}
2684
2685static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2686{
2687 int retval = -EINVAL;
2688 struct serial_icounter_struct icount;
2689 memset(&icount, 0, sizeof(icount));
2690 if (tty->ops->get_icount)
2691 retval = tty->ops->get_icount(tty, &icount);
2692 if (retval != 0)
2693 return retval;
2694 if (copy_to_user(arg, &icount, sizeof(icount)))
2695 return -EFAULT;
2696 return 0;
2697}
2698
2699struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2700{
2701 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2702 tty->driver->subtype == PTY_TYPE_MASTER)
2703 tty = tty->link;
2704 return tty;
2705}
2706EXPORT_SYMBOL(tty_pair_get_tty);
2707
2708struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2709{
2710 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2711 tty->driver->subtype == PTY_TYPE_MASTER)
2712 return tty;
2713 return tty->link;
2714}
2715EXPORT_SYMBOL(tty_pair_get_pty);
2716
2717/*
2718 * Split this up, as gcc can choke on it otherwise..
2719 */
2720long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2721{
2722 struct tty_struct *tty = file_tty(file);
2723 struct tty_struct *real_tty;
2724 void __user *p = (void __user *)arg;
2725 int retval;
2726 struct tty_ldisc *ld;
2727
2728 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2729 return -EINVAL;
2730
2731 real_tty = tty_pair_get_tty(tty);
2732
2733 /*
2734 * Factor out some common prep work
2735 */
2736 switch (cmd) {
2737 case TIOCSETD:
2738 case TIOCSBRK:
2739 case TIOCCBRK:
2740 case TCSBRK:
2741 case TCSBRKP:
2742 retval = tty_check_change(tty);
2743 if (retval)
2744 return retval;
2745 if (cmd != TIOCCBRK) {
2746 tty_wait_until_sent(tty, 0);
2747 if (signal_pending(current))
2748 return -EINTR;
2749 }
2750 break;
2751 }
2752
2753 /*
2754 * Now do the stuff.
2755 */
2756 switch (cmd) {
2757 case TIOCSTI:
2758 return tiocsti(tty, p);
2759 case TIOCGWINSZ:
2760 return tiocgwinsz(real_tty, p);
2761 case TIOCSWINSZ:
2762 return tiocswinsz(real_tty, p);
2763 case TIOCCONS:
2764 return real_tty != tty ? -EINVAL : tioccons(file);
2765 case FIONBIO:
2766 return fionbio(file, p);
2767 case TIOCEXCL:
2768 set_bit(TTY_EXCLUSIVE, &tty->flags);
2769 return 0;
2770 case TIOCNXCL:
2771 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2772 return 0;
2773 case TIOCGEXCL:
2774 {
2775 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2776 return put_user(excl, (int __user *)p);
2777 }
2778 case TIOCNOTTY:
2779 if (current->signal->tty != tty)
2780 return -ENOTTY;
2781 no_tty();
2782 return 0;
2783 case TIOCSCTTY:
2784 return tiocsctty(tty, arg);
2785 case TIOCGPGRP:
2786 return tiocgpgrp(tty, real_tty, p);
2787 case TIOCSPGRP:
2788 return tiocspgrp(tty, real_tty, p);
2789 case TIOCGSID:
2790 return tiocgsid(tty, real_tty, p);
2791 case TIOCGETD:
2792 return put_user(tty->ldisc->ops->num, (int __user *)p);
2793 case TIOCSETD:
2794 return tiocsetd(tty, p);
2795 case TIOCVHANGUP:
2796 if (!capable(CAP_SYS_ADMIN))
2797 return -EPERM;
2798 tty_vhangup(tty);
2799 return 0;
2800 case TIOCGDEV:
2801 {
2802 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2803 return put_user(ret, (unsigned int __user *)p);
2804 }
2805 /*
2806 * Break handling
2807 */
2808 case TIOCSBRK: /* Turn break on, unconditionally */
2809 if (tty->ops->break_ctl)
2810 return tty->ops->break_ctl(tty, -1);
2811 return 0;
2812 case TIOCCBRK: /* Turn break off, unconditionally */
2813 if (tty->ops->break_ctl)
2814 return tty->ops->break_ctl(tty, 0);
2815 return 0;
2816 case TCSBRK: /* SVID version: non-zero arg --> no break */
2817 /* non-zero arg means wait for all output data
2818 * to be sent (performed above) but don't send break.
2819 * This is used by the tcdrain() termios function.
2820 */
2821 if (!arg)
2822 return send_break(tty, 250);
2823 return 0;
2824 case TCSBRKP: /* support for POSIX tcsendbreak() */
2825 return send_break(tty, arg ? arg*100 : 250);
2826
2827 case TIOCMGET:
2828 return tty_tiocmget(tty, p);
2829 case TIOCMSET:
2830 case TIOCMBIC:
2831 case TIOCMBIS:
2832 return tty_tiocmset(tty, cmd, p);
2833 case TIOCGICOUNT:
2834 retval = tty_tiocgicount(tty, p);
2835 /* For the moment allow fall through to the old method */
2836 if (retval != -EINVAL)
2837 return retval;
2838 break;
2839 case TCFLSH:
2840 switch (arg) {
2841 case TCIFLUSH:
2842 case TCIOFLUSH:
2843 /* flush tty buffer and allow ldisc to process ioctl */
2844 tty_buffer_flush(tty);
2845 break;
2846 }
2847 break;
2848 }
2849 if (tty->ops->ioctl) {
2850 retval = (tty->ops->ioctl)(tty, cmd, arg);
2851 if (retval != -ENOIOCTLCMD)
2852 return retval;
2853 }
2854 ld = tty_ldisc_ref_wait(tty);
2855 retval = -EINVAL;
2856 if (ld->ops->ioctl) {
2857 retval = ld->ops->ioctl(tty, file, cmd, arg);
2858 if (retval == -ENOIOCTLCMD)
2859 retval = -ENOTTY;
2860 }
2861 tty_ldisc_deref(ld);
2862 return retval;
2863}
2864
2865#ifdef CONFIG_COMPAT
2866static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2867 unsigned long arg)
2868{
2869 struct tty_struct *tty = file_tty(file);
2870 struct tty_ldisc *ld;
2871 int retval = -ENOIOCTLCMD;
2872
2873 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2874 return -EINVAL;
2875
2876 if (tty->ops->compat_ioctl) {
2877 retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2878 if (retval != -ENOIOCTLCMD)
2879 return retval;
2880 }
2881
2882 ld = tty_ldisc_ref_wait(tty);
2883 if (ld->ops->compat_ioctl)
2884 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2885 else
2886 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2887 tty_ldisc_deref(ld);
2888
2889 return retval;
2890}
2891#endif
2892
2893static int this_tty(const void *t, struct file *file, unsigned fd)
2894{
2895 if (likely(file->f_op->read != tty_read))
2896 return 0;
2897 return file_tty(file) != t ? 0 : fd + 1;
2898}
2899
2900/*
2901 * This implements the "Secure Attention Key" --- the idea is to
2902 * prevent trojan horses by killing all processes associated with this
2903 * tty when the user hits the "Secure Attention Key". Required for
2904 * super-paranoid applications --- see the Orange Book for more details.
2905 *
2906 * This code could be nicer; ideally it should send a HUP, wait a few
2907 * seconds, then send a INT, and then a KILL signal. But you then
2908 * have to coordinate with the init process, since all processes associated
2909 * with the current tty must be dead before the new getty is allowed
2910 * to spawn.
2911 *
2912 * Now, if it would be correct ;-/ The current code has a nasty hole -
2913 * it doesn't catch files in flight. We may send the descriptor to ourselves
2914 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2915 *
2916 * Nasty bug: do_SAK is being called in interrupt context. This can
2917 * deadlock. We punt it up to process context. AKPM - 16Mar2001
2918 */
2919void __do_SAK(struct tty_struct *tty)
2920{
2921#ifdef TTY_SOFT_SAK
2922 tty_hangup(tty);
2923#else
2924 struct task_struct *g, *p;
2925 struct pid *session;
2926 int i;
2927
2928 if (!tty)
2929 return;
2930 session = tty->session;
2931
2932 tty_ldisc_flush(tty);
2933
2934 tty_driver_flush_buffer(tty);
2935
2936 read_lock(&tasklist_lock);
2937 /* Kill the entire session */
2938 do_each_pid_task(session, PIDTYPE_SID, p) {
2939 printk(KERN_NOTICE "SAK: killed process %d"
2940 " (%s): task_session(p)==tty->session\n",
2941 task_pid_nr(p), p->comm);
2942 send_sig(SIGKILL, p, 1);
2943 } while_each_pid_task(session, PIDTYPE_SID, p);
2944 /* Now kill any processes that happen to have the
2945 * tty open.
2946 */
2947 do_each_thread(g, p) {
2948 if (p->signal->tty == tty) {
2949 printk(KERN_NOTICE "SAK: killed process %d"
2950 " (%s): task_session(p)==tty->session\n",
2951 task_pid_nr(p), p->comm);
2952 send_sig(SIGKILL, p, 1);
2953 continue;
2954 }
2955 task_lock(p);
2956 i = iterate_fd(p->files, 0, this_tty, tty);
2957 if (i != 0) {
2958 printk(KERN_NOTICE "SAK: killed process %d"
2959 " (%s): fd#%d opened to the tty\n",
2960 task_pid_nr(p), p->comm, i - 1);
2961 force_sig(SIGKILL, p);
2962 }
2963 task_unlock(p);
2964 } while_each_thread(g, p);
2965 read_unlock(&tasklist_lock);
2966#endif
2967}
2968
2969static void do_SAK_work(struct work_struct *work)
2970{
2971 struct tty_struct *tty =
2972 container_of(work, struct tty_struct, SAK_work);
2973 __do_SAK(tty);
2974}
2975
2976/*
2977 * The tq handling here is a little racy - tty->SAK_work may already be queued.
2978 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2979 * the values which we write to it will be identical to the values which it
2980 * already has. --akpm
2981 */
2982void do_SAK(struct tty_struct *tty)
2983{
2984 if (!tty)
2985 return;
2986 schedule_work(&tty->SAK_work);
2987}
2988
2989EXPORT_SYMBOL(do_SAK);
2990
2991static int dev_match_devt(struct device *dev, const void *data)
2992{
2993 const dev_t *devt = data;
2994 return dev->devt == *devt;
2995}
2996
2997/* Must put_device() after it's unused! */
2998static struct device *tty_get_device(struct tty_struct *tty)
2999{
3000 dev_t devt = tty_devnum(tty);
3001 return class_find_device(tty_class, NULL, &devt, dev_match_devt);
3002}
3003
3004
3005/**
3006 * initialize_tty_struct
3007 * @tty: tty to initialize
3008 *
3009 * This subroutine initializes a tty structure that has been newly
3010 * allocated.
3011 *
3012 * Locking: none - tty in question must not be exposed at this point
3013 */
3014
3015void initialize_tty_struct(struct tty_struct *tty,
3016 struct tty_driver *driver, int idx)
3017{
3018 memset(tty, 0, sizeof(struct tty_struct));
3019 kref_init(&tty->kref);
3020 tty->magic = TTY_MAGIC;
3021 tty_ldisc_init(tty);
3022 tty->session = NULL;
3023 tty->pgrp = NULL;
3024 mutex_init(&tty->legacy_mutex);
3025 mutex_init(&tty->throttle_mutex);
3026 init_rwsem(&tty->termios_rwsem);
3027 mutex_init(&tty->winsize_mutex);
3028 init_ldsem(&tty->ldisc_sem);
3029 init_waitqueue_head(&tty->write_wait);
3030 init_waitqueue_head(&tty->read_wait);
3031 INIT_WORK(&tty->hangup_work, do_tty_hangup);
3032 mutex_init(&tty->atomic_write_lock);
3033 spin_lock_init(&tty->ctrl_lock);
3034 INIT_LIST_HEAD(&tty->tty_files);
3035 INIT_WORK(&tty->SAK_work, do_SAK_work);
3036
3037 tty->driver = driver;
3038 tty->ops = driver->ops;
3039 tty->index = idx;
3040 tty_line_name(driver, idx, tty->name);
3041 tty->dev = tty_get_device(tty);
3042}
3043
3044/**
3045 * deinitialize_tty_struct
3046 * @tty: tty to deinitialize
3047 *
3048 * This subroutine deinitializes a tty structure that has been newly
3049 * allocated but tty_release cannot be called on that yet.
3050 *
3051 * Locking: none - tty in question must not be exposed at this point
3052 */
3053void deinitialize_tty_struct(struct tty_struct *tty)
3054{
3055 tty_ldisc_deinit(tty);
3056}
3057
3058/**
3059 * tty_put_char - write one character to a tty
3060 * @tty: tty
3061 * @ch: character
3062 *
3063 * Write one byte to the tty using the provided put_char method
3064 * if present. Returns the number of characters successfully output.
3065 *
3066 * Note: the specific put_char operation in the driver layer may go
3067 * away soon. Don't call it directly, use this method
3068 */
3069
3070int tty_put_char(struct tty_struct *tty, unsigned char ch)
3071{
3072 if (tty->ops->put_char)
3073 return tty->ops->put_char(tty, ch);
3074 return tty->ops->write(tty, &ch, 1);
3075}
3076EXPORT_SYMBOL_GPL(tty_put_char);
3077
3078struct class *tty_class;
3079
3080static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3081 unsigned int index, unsigned int count)
3082{
3083 /* init here, since reused cdevs cause crashes */
3084 cdev_init(&driver->cdevs[index], &tty_fops);
3085 driver->cdevs[index].owner = driver->owner;
3086 return cdev_add(&driver->cdevs[index], dev, count);
3087}
3088
3089/**
3090 * tty_register_device - register a tty device
3091 * @driver: the tty driver that describes the tty device
3092 * @index: the index in the tty driver for this tty device
3093 * @device: a struct device that is associated with this tty device.
3094 * This field is optional, if there is no known struct device
3095 * for this tty device it can be set to NULL safely.
3096 *
3097 * Returns a pointer to the struct device for this tty device
3098 * (or ERR_PTR(-EFOO) on error).
3099 *
3100 * This call is required to be made to register an individual tty device
3101 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3102 * that bit is not set, this function should not be called by a tty
3103 * driver.
3104 *
3105 * Locking: ??
3106 */
3107
3108struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3109 struct device *device)
3110{
3111 return tty_register_device_attr(driver, index, device, NULL, NULL);
3112}
3113EXPORT_SYMBOL(tty_register_device);
3114
3115static void tty_device_create_release(struct device *dev)
3116{
3117 pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
3118 kfree(dev);
3119}
3120
3121/**
3122 * tty_register_device_attr - register a tty device
3123 * @driver: the tty driver that describes the tty device
3124 * @index: the index in the tty driver for this tty device
3125 * @device: a struct device that is associated with this tty device.
3126 * This field is optional, if there is no known struct device
3127 * for this tty device it can be set to NULL safely.
3128 * @drvdata: Driver data to be set to device.
3129 * @attr_grp: Attribute group to be set on device.
3130 *
3131 * Returns a pointer to the struct device for this tty device
3132 * (or ERR_PTR(-EFOO) on error).
3133 *
3134 * This call is required to be made to register an individual tty device
3135 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3136 * that bit is not set, this function should not be called by a tty
3137 * driver.
3138 *
3139 * Locking: ??
3140 */
3141struct device *tty_register_device_attr(struct tty_driver *driver,
3142 unsigned index, struct device *device,
3143 void *drvdata,
3144 const struct attribute_group **attr_grp)
3145{
3146 char name[64];
3147 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3148 struct device *dev = NULL;
3149 int retval = -ENODEV;
3150 bool cdev = false;
3151
3152 if (index >= driver->num) {
3153 printk(KERN_ERR "Attempt to register invalid tty line number "
3154 " (%d).\n", index);
3155 return ERR_PTR(-EINVAL);
3156 }
3157
3158 if (driver->type == TTY_DRIVER_TYPE_PTY)
3159 pty_line_name(driver, index, name);
3160 else
3161 tty_line_name(driver, index, name);
3162
3163 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3164 retval = tty_cdev_add(driver, devt, index, 1);
3165 if (retval)
3166 goto error;
3167 cdev = true;
3168 }
3169
3170 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3171 if (!dev) {
3172 retval = -ENOMEM;
3173 goto error;
3174 }
3175
3176 dev->devt = devt;
3177 dev->class = tty_class;
3178 dev->parent = device;
3179 dev->release = tty_device_create_release;
3180 dev_set_name(dev, "%s", name);
3181 dev->groups = attr_grp;
3182 dev_set_drvdata(dev, drvdata);
3183
3184 retval = device_register(dev);
3185 if (retval)
3186 goto error;
3187
3188 return dev;
3189
3190error:
3191 put_device(dev);
3192 if (cdev)
3193 cdev_del(&driver->cdevs[index]);
3194 return ERR_PTR(retval);
3195}
3196EXPORT_SYMBOL_GPL(tty_register_device_attr);
3197
3198/**
3199 * tty_unregister_device - unregister a tty device
3200 * @driver: the tty driver that describes the tty device
3201 * @index: the index in the tty driver for this tty device
3202 *
3203 * If a tty device is registered with a call to tty_register_device() then
3204 * this function must be called when the tty device is gone.
3205 *
3206 * Locking: ??
3207 */
3208
3209void tty_unregister_device(struct tty_driver *driver, unsigned index)
3210{
3211 device_destroy(tty_class,
3212 MKDEV(driver->major, driver->minor_start) + index);
3213 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC))
3214 cdev_del(&driver->cdevs[index]);
3215}
3216EXPORT_SYMBOL(tty_unregister_device);
3217
3218/**
3219 * __tty_alloc_driver -- allocate tty driver
3220 * @lines: count of lines this driver can handle at most
3221 * @owner: module which is repsonsible for this driver
3222 * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3223 *
3224 * This should not be called directly, some of the provided macros should be
3225 * used instead. Use IS_ERR and friends on @retval.
3226 */
3227struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3228 unsigned long flags)
3229{
3230 struct tty_driver *driver;
3231 unsigned int cdevs = 1;
3232 int err;
3233
3234 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3235 return ERR_PTR(-EINVAL);
3236
3237 driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3238 if (!driver)
3239 return ERR_PTR(-ENOMEM);
3240
3241 kref_init(&driver->kref);
3242 driver->magic = TTY_DRIVER_MAGIC;
3243 driver->num = lines;
3244 driver->owner = owner;
3245 driver->flags = flags;
3246
3247 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3248 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3249 GFP_KERNEL);
3250 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3251 GFP_KERNEL);
3252 if (!driver->ttys || !driver->termios) {
3253 err = -ENOMEM;
3254 goto err_free_all;
3255 }
3256 }
3257
3258 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3259 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3260 GFP_KERNEL);
3261 if (!driver->ports) {
3262 err = -ENOMEM;
3263 goto err_free_all;
3264 }
3265 cdevs = lines;
3266 }
3267
3268 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3269 if (!driver->cdevs) {
3270 err = -ENOMEM;
3271 goto err_free_all;
3272 }
3273
3274 return driver;
3275err_free_all:
3276 kfree(driver->ports);
3277 kfree(driver->ttys);
3278 kfree(driver->termios);
3279 kfree(driver);
3280 return ERR_PTR(err);
3281}
3282EXPORT_SYMBOL(__tty_alloc_driver);
3283
3284static void destruct_tty_driver(struct kref *kref)
3285{
3286 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3287 int i;
3288 struct ktermios *tp;
3289
3290 if (driver->flags & TTY_DRIVER_INSTALLED) {
3291 /*
3292 * Free the termios and termios_locked structures because
3293 * we don't want to get memory leaks when modular tty
3294 * drivers are removed from the kernel.
3295 */
3296 for (i = 0; i < driver->num; i++) {
3297 tp = driver->termios[i];
3298 if (tp) {
3299 driver->termios[i] = NULL;
3300 kfree(tp);
3301 }
3302 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3303 tty_unregister_device(driver, i);
3304 }
3305 proc_tty_unregister_driver(driver);
3306 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3307 cdev_del(&driver->cdevs[0]);
3308 }
3309 kfree(driver->cdevs);
3310 kfree(driver->ports);
3311 kfree(driver->termios);
3312 kfree(driver->ttys);
3313 kfree(driver);
3314}
3315
3316void tty_driver_kref_put(struct tty_driver *driver)
3317{
3318 kref_put(&driver->kref, destruct_tty_driver);
3319}
3320EXPORT_SYMBOL(tty_driver_kref_put);
3321
3322void tty_set_operations(struct tty_driver *driver,
3323 const struct tty_operations *op)
3324{
3325 driver->ops = op;
3326};
3327EXPORT_SYMBOL(tty_set_operations);
3328
3329void put_tty_driver(struct tty_driver *d)
3330{
3331 tty_driver_kref_put(d);
3332}
3333EXPORT_SYMBOL(put_tty_driver);
3334
3335/*
3336 * Called by a tty driver to register itself.
3337 */
3338int tty_register_driver(struct tty_driver *driver)
3339{
3340 int error;
3341 int i;
3342 dev_t dev;
3343 struct device *d;
3344
3345 if (!driver->major) {
3346 error = alloc_chrdev_region(&dev, driver->minor_start,
3347 driver->num, driver->name);
3348 if (!error) {
3349 driver->major = MAJOR(dev);
3350 driver->minor_start = MINOR(dev);
3351 }
3352 } else {
3353 dev = MKDEV(driver->major, driver->minor_start);
3354 error = register_chrdev_region(dev, driver->num, driver->name);
3355 }
3356 if (error < 0)
3357 goto err;
3358
3359 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3360 error = tty_cdev_add(driver, dev, 0, driver->num);
3361 if (error)
3362 goto err_unreg_char;
3363 }
3364
3365 mutex_lock(&tty_mutex);
3366 list_add(&driver->tty_drivers, &tty_drivers);
3367 mutex_unlock(&tty_mutex);
3368
3369 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3370 for (i = 0; i < driver->num; i++) {
3371 d = tty_register_device(driver, i, NULL);
3372 if (IS_ERR(d)) {
3373 error = PTR_ERR(d);
3374 goto err_unreg_devs;
3375 }
3376 }
3377 }
3378 proc_tty_register_driver(driver);
3379 driver->flags |= TTY_DRIVER_INSTALLED;
3380 return 0;
3381
3382err_unreg_devs:
3383 for (i--; i >= 0; i--)
3384 tty_unregister_device(driver, i);
3385
3386 mutex_lock(&tty_mutex);
3387 list_del(&driver->tty_drivers);
3388 mutex_unlock(&tty_mutex);
3389
3390err_unreg_char:
3391 unregister_chrdev_region(dev, driver->num);
3392err:
3393 return error;
3394}
3395EXPORT_SYMBOL(tty_register_driver);
3396
3397/*
3398 * Called by a tty driver to unregister itself.
3399 */
3400int tty_unregister_driver(struct tty_driver *driver)
3401{
3402#if 0
3403 /* FIXME */
3404 if (driver->refcount)
3405 return -EBUSY;
3406#endif
3407 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3408 driver->num);
3409 mutex_lock(&tty_mutex);
3410 list_del(&driver->tty_drivers);
3411 mutex_unlock(&tty_mutex);
3412 return 0;
3413}
3414
3415EXPORT_SYMBOL(tty_unregister_driver);
3416
3417dev_t tty_devnum(struct tty_struct *tty)
3418{
3419 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3420}
3421EXPORT_SYMBOL(tty_devnum);
3422
3423void proc_clear_tty(struct task_struct *p)
3424{
3425 unsigned long flags;
3426 struct tty_struct *tty;
3427 spin_lock_irqsave(&p->sighand->siglock, flags);
3428 tty = p->signal->tty;
3429 p->signal->tty = NULL;
3430 spin_unlock_irqrestore(&p->sighand->siglock, flags);
3431 tty_kref_put(tty);
3432}
3433
3434/* Called under the sighand lock */
3435
3436static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3437{
3438 if (tty) {
3439 unsigned long flags;
3440 /* We should not have a session or pgrp to put here but.... */
3441 spin_lock_irqsave(&tty->ctrl_lock, flags);
3442 put_pid(tty->session);
3443 put_pid(tty->pgrp);
3444 tty->pgrp = get_pid(task_pgrp(tsk));
3445 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3446 tty->session = get_pid(task_session(tsk));
3447 if (tsk->signal->tty) {
3448 printk(KERN_DEBUG "tty not NULL!!\n");
3449 tty_kref_put(tsk->signal->tty);
3450 }
3451 }
3452 put_pid(tsk->signal->tty_old_pgrp);
3453 tsk->signal->tty = tty_kref_get(tty);
3454 tsk->signal->tty_old_pgrp = NULL;
3455}
3456
3457static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3458{
3459 spin_lock_irq(&tsk->sighand->siglock);
3460 __proc_set_tty(tsk, tty);
3461 spin_unlock_irq(&tsk->sighand->siglock);
3462}
3463
3464struct tty_struct *get_current_tty(void)
3465{
3466 struct tty_struct *tty;
3467 unsigned long flags;
3468
3469 spin_lock_irqsave(¤t->sighand->siglock, flags);
3470 tty = tty_kref_get(current->signal->tty);
3471 spin_unlock_irqrestore(¤t->sighand->siglock, flags);
3472 return tty;
3473}
3474EXPORT_SYMBOL_GPL(get_current_tty);
3475
3476void tty_default_fops(struct file_operations *fops)
3477{
3478 *fops = tty_fops;
3479}
3480
3481/*
3482 * Initialize the console device. This is called *early*, so
3483 * we can't necessarily depend on lots of kernel help here.
3484 * Just do some early initializations, and do the complex setup
3485 * later.
3486 */
3487void __init console_init(void)
3488{
3489 initcall_t *call;
3490
3491 /* Setup the default TTY line discipline. */
3492 tty_ldisc_begin();
3493
3494 /*
3495 * set up the console device so that later boot sequences can
3496 * inform about problems etc..
3497 */
3498 call = __con_initcall_start;
3499 while (call < __con_initcall_end) {
3500 (*call)();
3501 call++;
3502 }
3503}
3504
3505static char *tty_devnode(struct device *dev, umode_t *mode)
3506{
3507 if (!mode)
3508 return NULL;
3509 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3510 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3511 *mode = 0666;
3512 return NULL;
3513}
3514
3515static int __init tty_class_init(void)
3516{
3517 tty_class = class_create(THIS_MODULE, "tty");
3518 if (IS_ERR(tty_class))
3519 return PTR_ERR(tty_class);
3520 tty_class->devnode = tty_devnode;
3521 return 0;
3522}
3523
3524postcore_initcall(tty_class_init);
3525
3526/* 3/2004 jmc: why do these devices exist? */
3527static struct cdev tty_cdev, console_cdev;
3528
3529static ssize_t show_cons_active(struct device *dev,
3530 struct device_attribute *attr, char *buf)
3531{
3532 struct console *cs[16];
3533 int i = 0;
3534 struct console *c;
3535 ssize_t count = 0;
3536
3537 console_lock();
3538 for_each_console(c) {
3539 if (!c->device)
3540 continue;
3541 if (!c->write)
3542 continue;
3543 if ((c->flags & CON_ENABLED) == 0)
3544 continue;
3545 cs[i++] = c;
3546 if (i >= ARRAY_SIZE(cs))
3547 break;
3548 }
3549 while (i--) {
3550 int index = cs[i]->index;
3551 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3552
3553 /* don't resolve tty0 as some programs depend on it */
3554 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3555 count += tty_line_name(drv, index, buf + count);
3556 else
3557 count += sprintf(buf + count, "%s%d",
3558 cs[i]->name, cs[i]->index);
3559
3560 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3561 }
3562 console_unlock();
3563
3564 return count;
3565}
3566static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3567
3568static struct device *consdev;
3569
3570void console_sysfs_notify(void)
3571{
3572 if (consdev)
3573 sysfs_notify(&consdev->kobj, NULL, "active");
3574}
3575
3576/*
3577 * Ok, now we can initialize the rest of the tty devices and can count
3578 * on memory allocations, interrupts etc..
3579 */
3580int __init tty_init(void)
3581{
3582 cdev_init(&tty_cdev, &tty_fops);
3583 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3584 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3585 panic("Couldn't register /dev/tty driver\n");
3586 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3587
3588 cdev_init(&console_cdev, &console_fops);
3589 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3590 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3591 panic("Couldn't register /dev/console driver\n");
3592 consdev = device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3593 "console");
3594 if (IS_ERR(consdev))
3595 consdev = NULL;
3596 else
3597 WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
3598
3599#ifdef CONFIG_VT
3600 vty_init(&console_fops);
3601#endif
3602 return 0;
3603}
3604