Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 1991, 1992 Linus Torvalds
4 */
5
6/*
7 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
8 * or rs-channels. It also implements echoing, cooked mode etc.
9 *
10 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
11 *
12 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
13 * tty_struct and tty_queue structures. Previously there was an array
14 * of 256 tty_struct's which was statically allocated, and the
15 * tty_queue structures were allocated at boot time. Both are now
16 * dynamically allocated only when the tty is open.
17 *
18 * Also restructured routines so that there is more of a separation
19 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
20 * the low-level tty routines (serial.c, pty.c, console.c). This
21 * makes for cleaner and more compact code. -TYT, 9/17/92
22 *
23 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
24 * which can be dynamically activated and de-activated by the line
25 * discipline handling modules (like SLIP).
26 *
27 * NOTE: pay no attention to the line discipline code (yet); its
28 * interface is still subject to change in this version...
29 * -- TYT, 1/31/92
30 *
31 * Added functionality to the OPOST tty handling. No delays, but all
32 * other bits should be there.
33 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
34 *
35 * Rewrote canonical mode and added more termios flags.
36 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
37 *
38 * Reorganized FASYNC support so mouse code can share it.
39 * -- ctm@ardi.com, 9Sep95
40 *
41 * New TIOCLINUX variants added.
42 * -- mj@k332.feld.cvut.cz, 19-Nov-95
43 *
44 * Restrict vt switching via ioctl()
45 * -- grif@cs.ucr.edu, 5-Dec-95
46 *
47 * Move console and virtual terminal code to more appropriate files,
48 * implement CONFIG_VT and generalize console device interface.
49 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
50 *
51 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
52 * -- Bill Hawes <whawes@star.net>, June 97
53 *
54 * Added devfs support.
55 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
56 *
57 * Added support for a Unix98-style ptmx device.
58 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
59 *
60 * Reduced memory usage for older ARM systems
61 * -- Russell King <rmk@arm.linux.org.uk>
62 *
63 * Move do_SAK() into process context. Less stack use in devfs functions.
64 * alloc_tty_struct() always uses kmalloc()
65 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66 */
67
68#include <linux/types.h>
69#include <linux/major.h>
70#include <linux/errno.h>
71#include <linux/signal.h>
72#include <linux/fcntl.h>
73#include <linux/sched/signal.h>
74#include <linux/sched/task.h>
75#include <linux/interrupt.h>
76#include <linux/tty.h>
77#include <linux/tty_driver.h>
78#include <linux/tty_flip.h>
79#include <linux/devpts_fs.h>
80#include <linux/file.h>
81#include <linux/fdtable.h>
82#include <linux/console.h>
83#include <linux/timer.h>
84#include <linux/ctype.h>
85#include <linux/kd.h>
86#include <linux/mm.h>
87#include <linux/string.h>
88#include <linux/slab.h>
89#include <linux/poll.h>
90#include <linux/ppp-ioctl.h>
91#include <linux/proc_fs.h>
92#include <linux/init.h>
93#include <linux/module.h>
94#include <linux/device.h>
95#include <linux/wait.h>
96#include <linux/bitops.h>
97#include <linux/delay.h>
98#include <linux/seq_file.h>
99#include <linux/serial.h>
100#include <linux/ratelimit.h>
101#include <linux/compat.h>
102#include <linux/uaccess.h>
103#include <linux/termios_internal.h>
104#include <linux/fs.h>
105
106#include <linux/kbd_kern.h>
107#include <linux/vt_kern.h>
108#include <linux/selection.h>
109
110#include <linux/kmod.h>
111#include <linux/nsproxy.h>
112#include "tty.h"
113
114#undef TTY_DEBUG_HANGUP
115#ifdef TTY_DEBUG_HANGUP
116# define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
117#else
118# define tty_debug_hangup(tty, f, args...) do { } while (0)
119#endif
120
121#define TTY_PARANOIA_CHECK 1
122#define CHECK_TTY_COUNT 1
123
124struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
125 .c_iflag = ICRNL | IXON,
126 .c_oflag = OPOST | ONLCR,
127 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
128 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
129 ECHOCTL | ECHOKE | IEXTEN,
130 .c_cc = INIT_C_CC,
131 .c_ispeed = 38400,
132 .c_ospeed = 38400,
133 /* .c_line = N_TTY, */
134};
135EXPORT_SYMBOL(tty_std_termios);
136
137/* This list gets poked at by procfs and various bits of boot up code. This
138 * could do with some rationalisation such as pulling the tty proc function
139 * into this file.
140 */
141
142LIST_HEAD(tty_drivers); /* linked list of tty drivers */
143
144/* Mutex to protect creating and releasing a tty */
145DEFINE_MUTEX(tty_mutex);
146
147static ssize_t tty_read(struct kiocb *, struct iov_iter *);
148static ssize_t tty_write(struct kiocb *, struct iov_iter *);
149static __poll_t tty_poll(struct file *, poll_table *);
150static int tty_open(struct inode *, struct file *);
151#ifdef CONFIG_COMPAT
152static long tty_compat_ioctl(struct file *file, unsigned int cmd,
153 unsigned long arg);
154#else
155#define tty_compat_ioctl NULL
156#endif
157static int __tty_fasync(int fd, struct file *filp, int on);
158static int tty_fasync(int fd, struct file *filp, int on);
159static void release_tty(struct tty_struct *tty, int idx);
160
161/**
162 * free_tty_struct - free a disused tty
163 * @tty: tty struct to free
164 *
165 * Free the write buffers, tty queue and tty memory itself.
166 *
167 * Locking: none. Must be called after tty is definitely unused
168 */
169static void free_tty_struct(struct tty_struct *tty)
170{
171 tty_ldisc_deinit(tty);
172 put_device(tty->dev);
173 kvfree(tty->write_buf);
174 kfree(tty);
175}
176
177static inline struct tty_struct *file_tty(struct file *file)
178{
179 return ((struct tty_file_private *)file->private_data)->tty;
180}
181
182int tty_alloc_file(struct file *file)
183{
184 struct tty_file_private *priv;
185
186 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
187 if (!priv)
188 return -ENOMEM;
189
190 file->private_data = priv;
191
192 return 0;
193}
194
195/* Associate a new file with the tty structure */
196void tty_add_file(struct tty_struct *tty, struct file *file)
197{
198 struct tty_file_private *priv = file->private_data;
199
200 priv->tty = tty;
201 priv->file = file;
202
203 spin_lock(&tty->files_lock);
204 list_add(&priv->list, &tty->tty_files);
205 spin_unlock(&tty->files_lock);
206}
207
208/**
209 * tty_free_file - free file->private_data
210 * @file: to free private_data of
211 *
212 * This shall be used only for fail path handling when tty_add_file was not
213 * called yet.
214 */
215void tty_free_file(struct file *file)
216{
217 struct tty_file_private *priv = file->private_data;
218
219 file->private_data = NULL;
220 kfree(priv);
221}
222
223/* Delete file from its tty */
224static void tty_del_file(struct file *file)
225{
226 struct tty_file_private *priv = file->private_data;
227 struct tty_struct *tty = priv->tty;
228
229 spin_lock(&tty->files_lock);
230 list_del(&priv->list);
231 spin_unlock(&tty->files_lock);
232 tty_free_file(file);
233}
234
235/**
236 * tty_name - return tty naming
237 * @tty: tty structure
238 *
239 * Convert a tty structure into a name. The name reflects the kernel naming
240 * policy and if udev is in use may not reflect user space
241 *
242 * Locking: none
243 */
244const char *tty_name(const struct tty_struct *tty)
245{
246 if (!tty) /* Hmm. NULL pointer. That's fun. */
247 return "NULL tty";
248 return tty->name;
249}
250EXPORT_SYMBOL(tty_name);
251
252const char *tty_driver_name(const struct tty_struct *tty)
253{
254 if (!tty || !tty->driver)
255 return "";
256 return tty->driver->name;
257}
258
259static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
260 const char *routine)
261{
262#ifdef TTY_PARANOIA_CHECK
263 if (!tty) {
264 pr_warn("(%d:%d): %s: NULL tty\n",
265 imajor(inode), iminor(inode), routine);
266 return 1;
267 }
268#endif
269 return 0;
270}
271
272/* Caller must hold tty_lock */
273static void check_tty_count(struct tty_struct *tty, const char *routine)
274{
275#ifdef CHECK_TTY_COUNT
276 struct list_head *p;
277 int count = 0, kopen_count = 0;
278
279 spin_lock(&tty->files_lock);
280 list_for_each(p, &tty->tty_files) {
281 count++;
282 }
283 spin_unlock(&tty->files_lock);
284 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
285 tty->driver->subtype == PTY_TYPE_SLAVE &&
286 tty->link && tty->link->count)
287 count++;
288 if (tty_port_kopened(tty->port))
289 kopen_count++;
290 if (tty->count != (count + kopen_count)) {
291 tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
292 routine, tty->count, count, kopen_count);
293 }
294#endif
295}
296
297/**
298 * get_tty_driver - find device of a tty
299 * @device: device identifier
300 * @index: returns the index of the tty
301 *
302 * This routine returns a tty driver structure, given a device number and also
303 * passes back the index number.
304 *
305 * Locking: caller must hold tty_mutex
306 */
307static struct tty_driver *get_tty_driver(dev_t device, int *index)
308{
309 struct tty_driver *p;
310
311 list_for_each_entry(p, &tty_drivers, tty_drivers) {
312 dev_t base = MKDEV(p->major, p->minor_start);
313
314 if (device < base || device >= base + p->num)
315 continue;
316 *index = device - base;
317 return tty_driver_kref_get(p);
318 }
319 return NULL;
320}
321
322/**
323 * tty_dev_name_to_number - return dev_t for device name
324 * @name: user space name of device under /dev
325 * @number: pointer to dev_t that this function will populate
326 *
327 * This function converts device names like ttyS0 or ttyUSB1 into dev_t like
328 * (4, 64) or (188, 1). If no corresponding driver is registered then the
329 * function returns -%ENODEV.
330 *
331 * Locking: this acquires tty_mutex to protect the tty_drivers list from
332 * being modified while we are traversing it, and makes sure to
333 * release it before exiting.
334 */
335int tty_dev_name_to_number(const char *name, dev_t *number)
336{
337 struct tty_driver *p;
338 int ret;
339 int index, prefix_length = 0;
340 const char *str;
341
342 for (str = name; *str && !isdigit(*str); str++)
343 ;
344
345 if (!*str)
346 return -EINVAL;
347
348 ret = kstrtoint(str, 10, &index);
349 if (ret)
350 return ret;
351
352 prefix_length = str - name;
353 mutex_lock(&tty_mutex);
354
355 list_for_each_entry(p, &tty_drivers, tty_drivers)
356 if (prefix_length == strlen(p->name) && strncmp(name,
357 p->name, prefix_length) == 0) {
358 if (index < p->num) {
359 *number = MKDEV(p->major, p->minor_start + index);
360 goto out;
361 }
362 }
363
364 /* if here then driver wasn't found */
365 ret = -ENODEV;
366out:
367 mutex_unlock(&tty_mutex);
368 return ret;
369}
370EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
371
372#ifdef CONFIG_CONSOLE_POLL
373
374/**
375 * tty_find_polling_driver - find device of a polled tty
376 * @name: name string to match
377 * @line: pointer to resulting tty line nr
378 *
379 * This routine returns a tty driver structure, given a name and the condition
380 * that the tty driver is capable of polled operation.
381 */
382struct tty_driver *tty_find_polling_driver(char *name, int *line)
383{
384 struct tty_driver *p, *res = NULL;
385 int tty_line = 0;
386 int len;
387 char *str, *stp;
388
389 for (str = name; *str; str++)
390 if ((*str >= '0' && *str <= '9') || *str == ',')
391 break;
392 if (!*str)
393 return NULL;
394
395 len = str - name;
396 tty_line = simple_strtoul(str, &str, 10);
397
398 mutex_lock(&tty_mutex);
399 /* Search through the tty devices to look for a match */
400 list_for_each_entry(p, &tty_drivers, tty_drivers) {
401 if (!len || strncmp(name, p->name, len) != 0)
402 continue;
403 stp = str;
404 if (*stp == ',')
405 stp++;
406 if (*stp == '\0')
407 stp = NULL;
408
409 if (tty_line >= 0 && tty_line < p->num && p->ops &&
410 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
411 res = tty_driver_kref_get(p);
412 *line = tty_line;
413 break;
414 }
415 }
416 mutex_unlock(&tty_mutex);
417
418 return res;
419}
420EXPORT_SYMBOL_GPL(tty_find_polling_driver);
421#endif
422
423static ssize_t hung_up_tty_read(struct kiocb *iocb, struct iov_iter *to)
424{
425 return 0;
426}
427
428static ssize_t hung_up_tty_write(struct kiocb *iocb, struct iov_iter *from)
429{
430 return -EIO;
431}
432
433/* No kernel lock held - none needed ;) */
434static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
435{
436 return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
437}
438
439static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
440 unsigned long arg)
441{
442 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
443}
444
445static long hung_up_tty_compat_ioctl(struct file *file,
446 unsigned int cmd, unsigned long arg)
447{
448 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
449}
450
451static int hung_up_tty_fasync(int fd, struct file *file, int on)
452{
453 return -ENOTTY;
454}
455
456static void tty_show_fdinfo(struct seq_file *m, struct file *file)
457{
458 struct tty_struct *tty = file_tty(file);
459
460 if (tty && tty->ops && tty->ops->show_fdinfo)
461 tty->ops->show_fdinfo(tty, m);
462}
463
464static const struct file_operations tty_fops = {
465 .llseek = no_llseek,
466 .read_iter = tty_read,
467 .write_iter = tty_write,
468 .splice_read = copy_splice_read,
469 .splice_write = iter_file_splice_write,
470 .poll = tty_poll,
471 .unlocked_ioctl = tty_ioctl,
472 .compat_ioctl = tty_compat_ioctl,
473 .open = tty_open,
474 .release = tty_release,
475 .fasync = tty_fasync,
476 .show_fdinfo = tty_show_fdinfo,
477};
478
479static const struct file_operations console_fops = {
480 .llseek = no_llseek,
481 .read_iter = tty_read,
482 .write_iter = redirected_tty_write,
483 .splice_read = copy_splice_read,
484 .splice_write = iter_file_splice_write,
485 .poll = tty_poll,
486 .unlocked_ioctl = tty_ioctl,
487 .compat_ioctl = tty_compat_ioctl,
488 .open = tty_open,
489 .release = tty_release,
490 .fasync = tty_fasync,
491};
492
493static const struct file_operations hung_up_tty_fops = {
494 .llseek = no_llseek,
495 .read_iter = hung_up_tty_read,
496 .write_iter = hung_up_tty_write,
497 .poll = hung_up_tty_poll,
498 .unlocked_ioctl = hung_up_tty_ioctl,
499 .compat_ioctl = hung_up_tty_compat_ioctl,
500 .release = tty_release,
501 .fasync = hung_up_tty_fasync,
502};
503
504static DEFINE_SPINLOCK(redirect_lock);
505static struct file *redirect;
506
507/**
508 * tty_wakeup - request more data
509 * @tty: terminal
510 *
511 * Internal and external helper for wakeups of tty. This function informs the
512 * line discipline if present that the driver is ready to receive more output
513 * data.
514 */
515void tty_wakeup(struct tty_struct *tty)
516{
517 struct tty_ldisc *ld;
518
519 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
520 ld = tty_ldisc_ref(tty);
521 if (ld) {
522 if (ld->ops->write_wakeup)
523 ld->ops->write_wakeup(tty);
524 tty_ldisc_deref(ld);
525 }
526 }
527 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
528}
529EXPORT_SYMBOL_GPL(tty_wakeup);
530
531/**
532 * tty_release_redirect - Release a redirect on a pty if present
533 * @tty: tty device
534 *
535 * This is available to the pty code so if the master closes, if the slave is a
536 * redirect it can release the redirect.
537 */
538static struct file *tty_release_redirect(struct tty_struct *tty)
539{
540 struct file *f = NULL;
541
542 spin_lock(&redirect_lock);
543 if (redirect && file_tty(redirect) == tty) {
544 f = redirect;
545 redirect = NULL;
546 }
547 spin_unlock(&redirect_lock);
548
549 return f;
550}
551
552/**
553 * __tty_hangup - actual handler for hangup events
554 * @tty: tty device
555 * @exit_session: if non-zero, signal all foreground group processes
556 *
557 * This can be called by a "kworker" kernel thread. That is process synchronous
558 * but doesn't hold any locks, so we need to make sure we have the appropriate
559 * locks for what we're doing.
560 *
561 * The hangup event clears any pending redirections onto the hung up device. It
562 * ensures future writes will error and it does the needed line discipline
563 * hangup and signal delivery. The tty object itself remains intact.
564 *
565 * Locking:
566 * * BTM
567 *
568 * * redirect lock for undoing redirection
569 * * file list lock for manipulating list of ttys
570 * * tty_ldiscs_lock from called functions
571 * * termios_rwsem resetting termios data
572 * * tasklist_lock to walk task list for hangup event
573 *
574 * * ->siglock to protect ->signal/->sighand
575 *
576 */
577static void __tty_hangup(struct tty_struct *tty, int exit_session)
578{
579 struct file *cons_filp = NULL;
580 struct file *filp, *f;
581 struct tty_file_private *priv;
582 int closecount = 0, n;
583 int refs;
584
585 if (!tty)
586 return;
587
588 f = tty_release_redirect(tty);
589
590 tty_lock(tty);
591
592 if (test_bit(TTY_HUPPED, &tty->flags)) {
593 tty_unlock(tty);
594 return;
595 }
596
597 /*
598 * Some console devices aren't actually hung up for technical and
599 * historical reasons, which can lead to indefinite interruptible
600 * sleep in n_tty_read(). The following explicitly tells
601 * n_tty_read() to abort readers.
602 */
603 set_bit(TTY_HUPPING, &tty->flags);
604
605 /* inuse_filps is protected by the single tty lock,
606 * this really needs to change if we want to flush the
607 * workqueue with the lock held.
608 */
609 check_tty_count(tty, "tty_hangup");
610
611 spin_lock(&tty->files_lock);
612 /* This breaks for file handles being sent over AF_UNIX sockets ? */
613 list_for_each_entry(priv, &tty->tty_files, list) {
614 filp = priv->file;
615 if (filp->f_op->write_iter == redirected_tty_write)
616 cons_filp = filp;
617 if (filp->f_op->write_iter != tty_write)
618 continue;
619 closecount++;
620 __tty_fasync(-1, filp, 0); /* can't block */
621 filp->f_op = &hung_up_tty_fops;
622 }
623 spin_unlock(&tty->files_lock);
624
625 refs = tty_signal_session_leader(tty, exit_session);
626 /* Account for the p->signal references we killed */
627 while (refs--)
628 tty_kref_put(tty);
629
630 tty_ldisc_hangup(tty, cons_filp != NULL);
631
632 spin_lock_irq(&tty->ctrl.lock);
633 clear_bit(TTY_THROTTLED, &tty->flags);
634 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
635 put_pid(tty->ctrl.session);
636 put_pid(tty->ctrl.pgrp);
637 tty->ctrl.session = NULL;
638 tty->ctrl.pgrp = NULL;
639 tty->ctrl.pktstatus = 0;
640 spin_unlock_irq(&tty->ctrl.lock);
641
642 /*
643 * If one of the devices matches a console pointer, we
644 * cannot just call hangup() because that will cause
645 * tty->count and state->count to go out of sync.
646 * So we just call close() the right number of times.
647 */
648 if (cons_filp) {
649 if (tty->ops->close)
650 for (n = 0; n < closecount; n++)
651 tty->ops->close(tty, cons_filp);
652 } else if (tty->ops->hangup)
653 tty->ops->hangup(tty);
654 /*
655 * We don't want to have driver/ldisc interactions beyond the ones
656 * we did here. The driver layer expects no calls after ->hangup()
657 * from the ldisc side, which is now guaranteed.
658 */
659 set_bit(TTY_HUPPED, &tty->flags);
660 clear_bit(TTY_HUPPING, &tty->flags);
661 tty_unlock(tty);
662
663 if (f)
664 fput(f);
665}
666
667static void do_tty_hangup(struct work_struct *work)
668{
669 struct tty_struct *tty =
670 container_of(work, struct tty_struct, hangup_work);
671
672 __tty_hangup(tty, 0);
673}
674
675/**
676 * tty_hangup - trigger a hangup event
677 * @tty: tty to hangup
678 *
679 * A carrier loss (virtual or otherwise) has occurred on @tty. Schedule a
680 * hangup sequence to run after this event.
681 */
682void tty_hangup(struct tty_struct *tty)
683{
684 tty_debug_hangup(tty, "hangup\n");
685 schedule_work(&tty->hangup_work);
686}
687EXPORT_SYMBOL(tty_hangup);
688
689/**
690 * tty_vhangup - process vhangup
691 * @tty: tty to hangup
692 *
693 * The user has asked via system call for the terminal to be hung up. We do
694 * this synchronously so that when the syscall returns the process is complete.
695 * That guarantee is necessary for security reasons.
696 */
697void tty_vhangup(struct tty_struct *tty)
698{
699 tty_debug_hangup(tty, "vhangup\n");
700 __tty_hangup(tty, 0);
701}
702EXPORT_SYMBOL(tty_vhangup);
703
704
705/**
706 * tty_vhangup_self - process vhangup for own ctty
707 *
708 * Perform a vhangup on the current controlling tty
709 */
710void tty_vhangup_self(void)
711{
712 struct tty_struct *tty;
713
714 tty = get_current_tty();
715 if (tty) {
716 tty_vhangup(tty);
717 tty_kref_put(tty);
718 }
719}
720
721/**
722 * tty_vhangup_session - hangup session leader exit
723 * @tty: tty to hangup
724 *
725 * The session leader is exiting and hanging up its controlling terminal.
726 * Every process in the foreground process group is signalled %SIGHUP.
727 *
728 * We do this synchronously so that when the syscall returns the process is
729 * complete. That guarantee is necessary for security reasons.
730 */
731void tty_vhangup_session(struct tty_struct *tty)
732{
733 tty_debug_hangup(tty, "session hangup\n");
734 __tty_hangup(tty, 1);
735}
736
737/**
738 * tty_hung_up_p - was tty hung up
739 * @filp: file pointer of tty
740 *
741 * Return: true if the tty has been subject to a vhangup or a carrier loss
742 */
743int tty_hung_up_p(struct file *filp)
744{
745 return (filp && filp->f_op == &hung_up_tty_fops);
746}
747EXPORT_SYMBOL(tty_hung_up_p);
748
749void __stop_tty(struct tty_struct *tty)
750{
751 if (tty->flow.stopped)
752 return;
753 tty->flow.stopped = true;
754 if (tty->ops->stop)
755 tty->ops->stop(tty);
756}
757
758/**
759 * stop_tty - propagate flow control
760 * @tty: tty to stop
761 *
762 * Perform flow control to the driver. May be called on an already stopped
763 * device and will not re-call the &tty_driver->stop() method.
764 *
765 * This functionality is used by both the line disciplines for halting incoming
766 * flow and by the driver. It may therefore be called from any context, may be
767 * under the tty %atomic_write_lock but not always.
768 *
769 * Locking:
770 * flow.lock
771 */
772void stop_tty(struct tty_struct *tty)
773{
774 unsigned long flags;
775
776 spin_lock_irqsave(&tty->flow.lock, flags);
777 __stop_tty(tty);
778 spin_unlock_irqrestore(&tty->flow.lock, flags);
779}
780EXPORT_SYMBOL(stop_tty);
781
782void __start_tty(struct tty_struct *tty)
783{
784 if (!tty->flow.stopped || tty->flow.tco_stopped)
785 return;
786 tty->flow.stopped = false;
787 if (tty->ops->start)
788 tty->ops->start(tty);
789 tty_wakeup(tty);
790}
791
792/**
793 * start_tty - propagate flow control
794 * @tty: tty to start
795 *
796 * Start a tty that has been stopped if at all possible. If @tty was previously
797 * stopped and is now being started, the &tty_driver->start() method is invoked
798 * and the line discipline woken.
799 *
800 * Locking:
801 * flow.lock
802 */
803void start_tty(struct tty_struct *tty)
804{
805 unsigned long flags;
806
807 spin_lock_irqsave(&tty->flow.lock, flags);
808 __start_tty(tty);
809 spin_unlock_irqrestore(&tty->flow.lock, flags);
810}
811EXPORT_SYMBOL(start_tty);
812
813static void tty_update_time(struct tty_struct *tty, bool mtime)
814{
815 time64_t sec = ktime_get_real_seconds();
816 struct tty_file_private *priv;
817
818 spin_lock(&tty->files_lock);
819 list_for_each_entry(priv, &tty->tty_files, list) {
820 struct inode *inode = file_inode(priv->file);
821 struct timespec64 time = mtime ? inode_get_mtime(inode) : inode_get_atime(inode);
822
823 /*
824 * We only care if the two values differ in anything other than the
825 * lower three bits (i.e every 8 seconds). If so, then we can update
826 * the time of the tty device, otherwise it could be construded as a
827 * security leak to let userspace know the exact timing of the tty.
828 */
829 if ((sec ^ time.tv_sec) & ~7) {
830 if (mtime)
831 inode_set_mtime(inode, sec, 0);
832 else
833 inode_set_atime(inode, sec, 0);
834 }
835 }
836 spin_unlock(&tty->files_lock);
837}
838
839/*
840 * Iterate on the ldisc ->read() function until we've gotten all
841 * the data the ldisc has for us.
842 *
843 * The "cookie" is something that the ldisc read function can fill
844 * in to let us know that there is more data to be had.
845 *
846 * We promise to continue to call the ldisc until it stops returning
847 * data or clears the cookie. The cookie may be something that the
848 * ldisc maintains state for and needs to free.
849 */
850static ssize_t iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty,
851 struct file *file, struct iov_iter *to)
852{
853 void *cookie = NULL;
854 unsigned long offset = 0;
855 ssize_t retval = 0;
856 size_t copied, count = iov_iter_count(to);
857 u8 kernel_buf[64];
858
859 do {
860 ssize_t size = min(count, sizeof(kernel_buf));
861
862 size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
863 if (!size)
864 break;
865
866 if (size < 0) {
867 /* Did we have an earlier error (ie -EFAULT)? */
868 if (retval)
869 break;
870 retval = size;
871
872 /*
873 * -EOVERFLOW means we didn't have enough space
874 * for a whole packet, and we shouldn't return
875 * a partial result.
876 */
877 if (retval == -EOVERFLOW)
878 offset = 0;
879 break;
880 }
881
882 copied = copy_to_iter(kernel_buf, size, to);
883 offset += copied;
884 count -= copied;
885
886 /*
887 * If the user copy failed, we still need to do another ->read()
888 * call if we had a cookie to let the ldisc clear up.
889 *
890 * But make sure size is zeroed.
891 */
892 if (unlikely(copied != size)) {
893 count = 0;
894 retval = -EFAULT;
895 }
896 } while (cookie);
897
898 /* We always clear tty buffer in case they contained passwords */
899 memzero_explicit(kernel_buf, sizeof(kernel_buf));
900 return offset ? offset : retval;
901}
902
903
904/**
905 * tty_read - read method for tty device files
906 * @iocb: kernel I/O control block
907 * @to: destination for the data read
908 *
909 * Perform the read system call function on this terminal device. Checks
910 * for hung up devices before calling the line discipline method.
911 *
912 * Locking:
913 * Locks the line discipline internally while needed. Multiple read calls
914 * may be outstanding in parallel.
915 */
916static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
917{
918 struct file *file = iocb->ki_filp;
919 struct inode *inode = file_inode(file);
920 struct tty_struct *tty = file_tty(file);
921 struct tty_ldisc *ld;
922 ssize_t ret;
923
924 if (tty_paranoia_check(tty, inode, "tty_read"))
925 return -EIO;
926 if (!tty || tty_io_error(tty))
927 return -EIO;
928
929 /* We want to wait for the line discipline to sort out in this
930 * situation.
931 */
932 ld = tty_ldisc_ref_wait(tty);
933 if (!ld)
934 return hung_up_tty_read(iocb, to);
935 ret = -EIO;
936 if (ld->ops->read)
937 ret = iterate_tty_read(ld, tty, file, to);
938 tty_ldisc_deref(ld);
939
940 if (ret > 0)
941 tty_update_time(tty, false);
942
943 return ret;
944}
945
946void tty_write_unlock(struct tty_struct *tty)
947{
948 mutex_unlock(&tty->atomic_write_lock);
949 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
950}
951
952int tty_write_lock(struct tty_struct *tty, bool ndelay)
953{
954 if (!mutex_trylock(&tty->atomic_write_lock)) {
955 if (ndelay)
956 return -EAGAIN;
957 if (mutex_lock_interruptible(&tty->atomic_write_lock))
958 return -ERESTARTSYS;
959 }
960 return 0;
961}
962
963/*
964 * Split writes up in sane blocksizes to avoid
965 * denial-of-service type attacks
966 */
967static ssize_t iterate_tty_write(struct tty_ldisc *ld, struct tty_struct *tty,
968 struct file *file, struct iov_iter *from)
969{
970 size_t chunk, count = iov_iter_count(from);
971 ssize_t ret, written = 0;
972
973 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
974 if (ret < 0)
975 return ret;
976
977 /*
978 * We chunk up writes into a temporary buffer. This
979 * simplifies low-level drivers immensely, since they
980 * don't have locking issues and user mode accesses.
981 *
982 * But if TTY_NO_WRITE_SPLIT is set, we should use a
983 * big chunk-size..
984 *
985 * The default chunk-size is 2kB, because the NTTY
986 * layer has problems with bigger chunks. It will
987 * claim to be able to handle more characters than
988 * it actually does.
989 */
990 chunk = 2048;
991 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
992 chunk = 65536;
993 if (count < chunk)
994 chunk = count;
995
996 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
997 if (tty->write_cnt < chunk) {
998 u8 *buf_chunk;
999
1000 if (chunk < 1024)
1001 chunk = 1024;
1002
1003 buf_chunk = kvmalloc(chunk, GFP_KERNEL | __GFP_RETRY_MAYFAIL);
1004 if (!buf_chunk) {
1005 ret = -ENOMEM;
1006 goto out;
1007 }
1008 kvfree(tty->write_buf);
1009 tty->write_cnt = chunk;
1010 tty->write_buf = buf_chunk;
1011 }
1012
1013 /* Do the write .. */
1014 for (;;) {
1015 size_t size = min(chunk, count);
1016
1017 ret = -EFAULT;
1018 if (copy_from_iter(tty->write_buf, size, from) != size)
1019 break;
1020
1021 ret = ld->ops->write(tty, file, tty->write_buf, size);
1022 if (ret <= 0)
1023 break;
1024
1025 written += ret;
1026 if (ret > size)
1027 break;
1028
1029 /* FIXME! Have Al check this! */
1030 if (ret != size)
1031 iov_iter_revert(from, size-ret);
1032
1033 count -= ret;
1034 if (!count)
1035 break;
1036 ret = -ERESTARTSYS;
1037 if (signal_pending(current))
1038 break;
1039 cond_resched();
1040 }
1041 if (written) {
1042 tty_update_time(tty, true);
1043 ret = written;
1044 }
1045out:
1046 tty_write_unlock(tty);
1047 return ret;
1048}
1049
1050#ifdef CONFIG_PRINT_QUOTA_WARNING
1051/**
1052 * tty_write_message - write a message to a certain tty, not just the console.
1053 * @tty: the destination tty_struct
1054 * @msg: the message to write
1055 *
1056 * This is used for messages that need to be redirected to a specific tty. We
1057 * don't put it into the syslog queue right now maybe in the future if really
1058 * needed.
1059 *
1060 * We must still hold the BTM and test the CLOSING flag for the moment.
1061 *
1062 * This function is DEPRECATED, do not use in new code.
1063 */
1064void tty_write_message(struct tty_struct *tty, char *msg)
1065{
1066 if (tty) {
1067 mutex_lock(&tty->atomic_write_lock);
1068 tty_lock(tty);
1069 if (tty->ops->write && tty->count > 0)
1070 tty->ops->write(tty, msg, strlen(msg));
1071 tty_unlock(tty);
1072 tty_write_unlock(tty);
1073 }
1074}
1075#endif
1076
1077static ssize_t file_tty_write(struct file *file, struct kiocb *iocb, struct iov_iter *from)
1078{
1079 struct tty_struct *tty = file_tty(file);
1080 struct tty_ldisc *ld;
1081 ssize_t ret;
1082
1083 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1084 return -EIO;
1085 if (!tty || !tty->ops->write || tty_io_error(tty))
1086 return -EIO;
1087 /* Short term debug to catch buggy drivers */
1088 if (tty->ops->write_room == NULL)
1089 tty_err(tty, "missing write_room method\n");
1090 ld = tty_ldisc_ref_wait(tty);
1091 if (!ld)
1092 return hung_up_tty_write(iocb, from);
1093 if (!ld->ops->write)
1094 ret = -EIO;
1095 else
1096 ret = iterate_tty_write(ld, tty, file, from);
1097 tty_ldisc_deref(ld);
1098 return ret;
1099}
1100
1101/**
1102 * tty_write - write method for tty device file
1103 * @iocb: kernel I/O control block
1104 * @from: iov_iter with data to write
1105 *
1106 * Write data to a tty device via the line discipline.
1107 *
1108 * Locking:
1109 * Locks the line discipline as required
1110 * Writes to the tty driver are serialized by the atomic_write_lock
1111 * and are then processed in chunks to the device. The line
1112 * discipline write method will not be invoked in parallel for
1113 * each device.
1114 */
1115static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
1116{
1117 return file_tty_write(iocb->ki_filp, iocb, from);
1118}
1119
1120ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
1121{
1122 struct file *p = NULL;
1123
1124 spin_lock(&redirect_lock);
1125 if (redirect)
1126 p = get_file(redirect);
1127 spin_unlock(&redirect_lock);
1128
1129 /*
1130 * We know the redirected tty is just another tty, we can
1131 * call file_tty_write() directly with that file pointer.
1132 */
1133 if (p) {
1134 ssize_t res;
1135
1136 res = file_tty_write(p, iocb, iter);
1137 fput(p);
1138 return res;
1139 }
1140 return tty_write(iocb, iter);
1141}
1142
1143/**
1144 * tty_send_xchar - send priority character
1145 * @tty: the tty to send to
1146 * @ch: xchar to send
1147 *
1148 * Send a high priority character to the tty even if stopped.
1149 *
1150 * Locking: none for xchar method, write ordering for write method.
1151 */
1152int tty_send_xchar(struct tty_struct *tty, u8 ch)
1153{
1154 bool was_stopped = tty->flow.stopped;
1155
1156 if (tty->ops->send_xchar) {
1157 down_read(&tty->termios_rwsem);
1158 tty->ops->send_xchar(tty, ch);
1159 up_read(&tty->termios_rwsem);
1160 return 0;
1161 }
1162
1163 if (tty_write_lock(tty, false) < 0)
1164 return -ERESTARTSYS;
1165
1166 down_read(&tty->termios_rwsem);
1167 if (was_stopped)
1168 start_tty(tty);
1169 tty->ops->write(tty, &ch, 1);
1170 if (was_stopped)
1171 stop_tty(tty);
1172 up_read(&tty->termios_rwsem);
1173 tty_write_unlock(tty);
1174 return 0;
1175}
1176
1177/**
1178 * pty_line_name - generate name for a pty
1179 * @driver: the tty driver in use
1180 * @index: the minor number
1181 * @p: output buffer of at least 6 bytes
1182 *
1183 * Generate a name from a @driver reference and write it to the output buffer
1184 * @p.
1185 *
1186 * Locking: None
1187 */
1188static void pty_line_name(struct tty_driver *driver, int index, char *p)
1189{
1190 static const char ptychar[] = "pqrstuvwxyzabcde";
1191 int i = index + driver->name_base;
1192 /* ->name is initialized to "ttyp", but "tty" is expected */
1193 sprintf(p, "%s%c%x",
1194 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1195 ptychar[i >> 4 & 0xf], i & 0xf);
1196}
1197
1198/**
1199 * tty_line_name - generate name for a tty
1200 * @driver: the tty driver in use
1201 * @index: the minor number
1202 * @p: output buffer of at least 7 bytes
1203 *
1204 * Generate a name from a @driver reference and write it to the output buffer
1205 * @p.
1206 *
1207 * Locking: None
1208 */
1209static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1210{
1211 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1212 return sprintf(p, "%s", driver->name);
1213 else
1214 return sprintf(p, "%s%d", driver->name,
1215 index + driver->name_base);
1216}
1217
1218/**
1219 * tty_driver_lookup_tty() - find an existing tty, if any
1220 * @driver: the driver for the tty
1221 * @file: file object
1222 * @idx: the minor number
1223 *
1224 * Return: the tty, if found. If not found, return %NULL or ERR_PTR() if the
1225 * driver lookup() method returns an error.
1226 *
1227 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1228 */
1229static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1230 struct file *file, int idx)
1231{
1232 struct tty_struct *tty;
1233
1234 if (driver->ops->lookup) {
1235 if (!file)
1236 tty = ERR_PTR(-EIO);
1237 else
1238 tty = driver->ops->lookup(driver, file, idx);
1239 } else {
1240 if (idx >= driver->num)
1241 return ERR_PTR(-EINVAL);
1242 tty = driver->ttys[idx];
1243 }
1244 if (!IS_ERR(tty))
1245 tty_kref_get(tty);
1246 return tty;
1247}
1248
1249/**
1250 * tty_init_termios - helper for termios setup
1251 * @tty: the tty to set up
1252 *
1253 * Initialise the termios structure for this tty. This runs under the
1254 * %tty_mutex currently so we can be relaxed about ordering.
1255 */
1256void tty_init_termios(struct tty_struct *tty)
1257{
1258 struct ktermios *tp;
1259 int idx = tty->index;
1260
1261 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1262 tty->termios = tty->driver->init_termios;
1263 else {
1264 /* Check for lazy saved data */
1265 tp = tty->driver->termios[idx];
1266 if (tp != NULL) {
1267 tty->termios = *tp;
1268 tty->termios.c_line = tty->driver->init_termios.c_line;
1269 } else
1270 tty->termios = tty->driver->init_termios;
1271 }
1272 /* Compatibility until drivers always set this */
1273 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1274 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1275}
1276EXPORT_SYMBOL_GPL(tty_init_termios);
1277
1278/**
1279 * tty_standard_install - usual tty->ops->install
1280 * @driver: the driver for the tty
1281 * @tty: the tty
1282 *
1283 * If the @driver overrides @tty->ops->install, it still can call this function
1284 * to perform the standard install operations.
1285 */
1286int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1287{
1288 tty_init_termios(tty);
1289 tty_driver_kref_get(driver);
1290 tty->count++;
1291 driver->ttys[tty->index] = tty;
1292 return 0;
1293}
1294EXPORT_SYMBOL_GPL(tty_standard_install);
1295
1296/**
1297 * tty_driver_install_tty() - install a tty entry in the driver
1298 * @driver: the driver for the tty
1299 * @tty: the tty
1300 *
1301 * Install a tty object into the driver tables. The @tty->index field will be
1302 * set by the time this is called. This method is responsible for ensuring any
1303 * need additional structures are allocated and configured.
1304 *
1305 * Locking: tty_mutex for now
1306 */
1307static int tty_driver_install_tty(struct tty_driver *driver,
1308 struct tty_struct *tty)
1309{
1310 return driver->ops->install ? driver->ops->install(driver, tty) :
1311 tty_standard_install(driver, tty);
1312}
1313
1314/**
1315 * tty_driver_remove_tty() - remove a tty from the driver tables
1316 * @driver: the driver for the tty
1317 * @tty: tty to remove
1318 *
1319 * Remove a tty object from the driver tables. The tty->index field will be set
1320 * by the time this is called.
1321 *
1322 * Locking: tty_mutex for now
1323 */
1324static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1325{
1326 if (driver->ops->remove)
1327 driver->ops->remove(driver, tty);
1328 else
1329 driver->ttys[tty->index] = NULL;
1330}
1331
1332/**
1333 * tty_reopen() - fast re-open of an open tty
1334 * @tty: the tty to open
1335 *
1336 * Re-opens on master ptys are not allowed and return -%EIO.
1337 *
1338 * Locking: Caller must hold tty_lock
1339 * Return: 0 on success, -errno on error.
1340 */
1341static int tty_reopen(struct tty_struct *tty)
1342{
1343 struct tty_driver *driver = tty->driver;
1344 struct tty_ldisc *ld;
1345 int retval = 0;
1346
1347 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1348 driver->subtype == PTY_TYPE_MASTER)
1349 return -EIO;
1350
1351 if (!tty->count)
1352 return -EAGAIN;
1353
1354 if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1355 return -EBUSY;
1356
1357 ld = tty_ldisc_ref_wait(tty);
1358 if (ld) {
1359 tty_ldisc_deref(ld);
1360 } else {
1361 retval = tty_ldisc_lock(tty, 5 * HZ);
1362 if (retval)
1363 return retval;
1364
1365 if (!tty->ldisc)
1366 retval = tty_ldisc_reinit(tty, tty->termios.c_line);
1367 tty_ldisc_unlock(tty);
1368 }
1369
1370 if (retval == 0)
1371 tty->count++;
1372
1373 return retval;
1374}
1375
1376/**
1377 * tty_init_dev - initialise a tty device
1378 * @driver: tty driver we are opening a device on
1379 * @idx: device index
1380 *
1381 * Prepare a tty device. This may not be a "new" clean device but could also be
1382 * an active device. The pty drivers require special handling because of this.
1383 *
1384 * Locking:
1385 * The function is called under the tty_mutex, which protects us from the
1386 * tty struct or driver itself going away.
1387 *
1388 * On exit the tty device has the line discipline attached and a reference
1389 * count of 1. If a pair was created for pty/tty use and the other was a pty
1390 * master then it too has a reference count of 1.
1391 *
1392 * WSH 06/09/97: Rewritten to remove races and properly clean up after a failed
1393 * open. The new code protects the open with a mutex, so it's really quite
1394 * straightforward. The mutex locking can probably be relaxed for the (most
1395 * common) case of reopening a tty.
1396 *
1397 * Return: new tty structure
1398 */
1399struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1400{
1401 struct tty_struct *tty;
1402 int retval;
1403
1404 /*
1405 * First time open is complex, especially for PTY devices.
1406 * This code guarantees that either everything succeeds and the
1407 * TTY is ready for operation, or else the table slots are vacated
1408 * and the allocated memory released. (Except that the termios
1409 * may be retained.)
1410 */
1411
1412 if (!try_module_get(driver->owner))
1413 return ERR_PTR(-ENODEV);
1414
1415 tty = alloc_tty_struct(driver, idx);
1416 if (!tty) {
1417 retval = -ENOMEM;
1418 goto err_module_put;
1419 }
1420
1421 tty_lock(tty);
1422 retval = tty_driver_install_tty(driver, tty);
1423 if (retval < 0)
1424 goto err_free_tty;
1425
1426 if (!tty->port)
1427 tty->port = driver->ports[idx];
1428
1429 if (WARN_RATELIMIT(!tty->port,
1430 "%s: %s driver does not set tty->port. This would crash the kernel. Fix the driver!\n",
1431 __func__, tty->driver->name)) {
1432 retval = -EINVAL;
1433 goto err_release_lock;
1434 }
1435
1436 retval = tty_ldisc_lock(tty, 5 * HZ);
1437 if (retval)
1438 goto err_release_lock;
1439 tty->port->itty = tty;
1440
1441 /*
1442 * Structures all installed ... call the ldisc open routines.
1443 * If we fail here just call release_tty to clean up. No need
1444 * to decrement the use counts, as release_tty doesn't care.
1445 */
1446 retval = tty_ldisc_setup(tty, tty->link);
1447 if (retval)
1448 goto err_release_tty;
1449 tty_ldisc_unlock(tty);
1450 /* Return the tty locked so that it cannot vanish under the caller */
1451 return tty;
1452
1453err_free_tty:
1454 tty_unlock(tty);
1455 free_tty_struct(tty);
1456err_module_put:
1457 module_put(driver->owner);
1458 return ERR_PTR(retval);
1459
1460 /* call the tty release_tty routine to clean out this slot */
1461err_release_tty:
1462 tty_ldisc_unlock(tty);
1463 tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1464 retval, idx);
1465err_release_lock:
1466 tty_unlock(tty);
1467 release_tty(tty, idx);
1468 return ERR_PTR(retval);
1469}
1470
1471/**
1472 * tty_save_termios() - save tty termios data in driver table
1473 * @tty: tty whose termios data to save
1474 *
1475 * Locking: Caller guarantees serialisation with tty_init_termios().
1476 */
1477void tty_save_termios(struct tty_struct *tty)
1478{
1479 struct ktermios *tp;
1480 int idx = tty->index;
1481
1482 /* If the port is going to reset then it has no termios to save */
1483 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1484 return;
1485
1486 /* Stash the termios data */
1487 tp = tty->driver->termios[idx];
1488 if (tp == NULL) {
1489 tp = kmalloc(sizeof(*tp), GFP_KERNEL);
1490 if (tp == NULL)
1491 return;
1492 tty->driver->termios[idx] = tp;
1493 }
1494 *tp = tty->termios;
1495}
1496EXPORT_SYMBOL_GPL(tty_save_termios);
1497
1498/**
1499 * tty_flush_works - flush all works of a tty/pty pair
1500 * @tty: tty device to flush works for (or either end of a pty pair)
1501 *
1502 * Sync flush all works belonging to @tty (and the 'other' tty).
1503 */
1504static void tty_flush_works(struct tty_struct *tty)
1505{
1506 flush_work(&tty->SAK_work);
1507 flush_work(&tty->hangup_work);
1508 if (tty->link) {
1509 flush_work(&tty->link->SAK_work);
1510 flush_work(&tty->link->hangup_work);
1511 }
1512}
1513
1514/**
1515 * release_one_tty - release tty structure memory
1516 * @work: work of tty we are obliterating
1517 *
1518 * Releases memory associated with a tty structure, and clears out the
1519 * driver table slots. This function is called when a device is no longer
1520 * in use. It also gets called when setup of a device fails.
1521 *
1522 * Locking:
1523 * takes the file list lock internally when working on the list of ttys
1524 * that the driver keeps.
1525 *
1526 * This method gets called from a work queue so that the driver private
1527 * cleanup ops can sleep (needed for USB at least)
1528 */
1529static void release_one_tty(struct work_struct *work)
1530{
1531 struct tty_struct *tty =
1532 container_of(work, struct tty_struct, hangup_work);
1533 struct tty_driver *driver = tty->driver;
1534 struct module *owner = driver->owner;
1535
1536 if (tty->ops->cleanup)
1537 tty->ops->cleanup(tty);
1538
1539 tty_driver_kref_put(driver);
1540 module_put(owner);
1541
1542 spin_lock(&tty->files_lock);
1543 list_del_init(&tty->tty_files);
1544 spin_unlock(&tty->files_lock);
1545
1546 put_pid(tty->ctrl.pgrp);
1547 put_pid(tty->ctrl.session);
1548 free_tty_struct(tty);
1549}
1550
1551static void queue_release_one_tty(struct kref *kref)
1552{
1553 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1554
1555 /* The hangup queue is now free so we can reuse it rather than
1556 * waste a chunk of memory for each port.
1557 */
1558 INIT_WORK(&tty->hangup_work, release_one_tty);
1559 schedule_work(&tty->hangup_work);
1560}
1561
1562/**
1563 * tty_kref_put - release a tty kref
1564 * @tty: tty device
1565 *
1566 * Release a reference to the @tty device and if need be let the kref layer
1567 * destruct the object for us.
1568 */
1569void tty_kref_put(struct tty_struct *tty)
1570{
1571 if (tty)
1572 kref_put(&tty->kref, queue_release_one_tty);
1573}
1574EXPORT_SYMBOL(tty_kref_put);
1575
1576/**
1577 * release_tty - release tty structure memory
1578 * @tty: tty device release
1579 * @idx: index of the tty device release
1580 *
1581 * Release both @tty and a possible linked partner (think pty pair),
1582 * and decrement the refcount of the backing module.
1583 *
1584 * Locking:
1585 * tty_mutex
1586 * takes the file list lock internally when working on the list of ttys
1587 * that the driver keeps.
1588 */
1589static void release_tty(struct tty_struct *tty, int idx)
1590{
1591 /* This should always be true but check for the moment */
1592 WARN_ON(tty->index != idx);
1593 WARN_ON(!mutex_is_locked(&tty_mutex));
1594 if (tty->ops->shutdown)
1595 tty->ops->shutdown(tty);
1596 tty_save_termios(tty);
1597 tty_driver_remove_tty(tty->driver, tty);
1598 if (tty->port)
1599 tty->port->itty = NULL;
1600 if (tty->link)
1601 tty->link->port->itty = NULL;
1602 if (tty->port)
1603 tty_buffer_cancel_work(tty->port);
1604 if (tty->link)
1605 tty_buffer_cancel_work(tty->link->port);
1606
1607 tty_kref_put(tty->link);
1608 tty_kref_put(tty);
1609}
1610
1611/**
1612 * tty_release_checks - check a tty before real release
1613 * @tty: tty to check
1614 * @idx: index of the tty
1615 *
1616 * Performs some paranoid checking before true release of the @tty. This is a
1617 * no-op unless %TTY_PARANOIA_CHECK is defined.
1618 */
1619static int tty_release_checks(struct tty_struct *tty, int idx)
1620{
1621#ifdef TTY_PARANOIA_CHECK
1622 if (idx < 0 || idx >= tty->driver->num) {
1623 tty_debug(tty, "bad idx %d\n", idx);
1624 return -1;
1625 }
1626
1627 /* not much to check for devpts */
1628 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1629 return 0;
1630
1631 if (tty != tty->driver->ttys[idx]) {
1632 tty_debug(tty, "bad driver table[%d] = %p\n",
1633 idx, tty->driver->ttys[idx]);
1634 return -1;
1635 }
1636 if (tty->driver->other) {
1637 struct tty_struct *o_tty = tty->link;
1638
1639 if (o_tty != tty->driver->other->ttys[idx]) {
1640 tty_debug(tty, "bad other table[%d] = %p\n",
1641 idx, tty->driver->other->ttys[idx]);
1642 return -1;
1643 }
1644 if (o_tty->link != tty) {
1645 tty_debug(tty, "bad link = %p\n", o_tty->link);
1646 return -1;
1647 }
1648 }
1649#endif
1650 return 0;
1651}
1652
1653/**
1654 * tty_kclose - closes tty opened by tty_kopen
1655 * @tty: tty device
1656 *
1657 * Performs the final steps to release and free a tty device. It is the same as
1658 * tty_release_struct() except that it also resets %TTY_PORT_KOPENED flag on
1659 * @tty->port.
1660 */
1661void tty_kclose(struct tty_struct *tty)
1662{
1663 /*
1664 * Ask the line discipline code to release its structures
1665 */
1666 tty_ldisc_release(tty);
1667
1668 /* Wait for pending work before tty destruction commences */
1669 tty_flush_works(tty);
1670
1671 tty_debug_hangup(tty, "freeing structure\n");
1672 /*
1673 * The release_tty function takes care of the details of clearing
1674 * the slots and preserving the termios structure.
1675 */
1676 mutex_lock(&tty_mutex);
1677 tty_port_set_kopened(tty->port, 0);
1678 release_tty(tty, tty->index);
1679 mutex_unlock(&tty_mutex);
1680}
1681EXPORT_SYMBOL_GPL(tty_kclose);
1682
1683/**
1684 * tty_release_struct - release a tty struct
1685 * @tty: tty device
1686 * @idx: index of the tty
1687 *
1688 * Performs the final steps to release and free a tty device. It is roughly the
1689 * reverse of tty_init_dev().
1690 */
1691void tty_release_struct(struct tty_struct *tty, int idx)
1692{
1693 /*
1694 * Ask the line discipline code to release its structures
1695 */
1696 tty_ldisc_release(tty);
1697
1698 /* Wait for pending work before tty destruction commmences */
1699 tty_flush_works(tty);
1700
1701 tty_debug_hangup(tty, "freeing structure\n");
1702 /*
1703 * The release_tty function takes care of the details of clearing
1704 * the slots and preserving the termios structure.
1705 */
1706 mutex_lock(&tty_mutex);
1707 release_tty(tty, idx);
1708 mutex_unlock(&tty_mutex);
1709}
1710EXPORT_SYMBOL_GPL(tty_release_struct);
1711
1712/**
1713 * tty_release - vfs callback for close
1714 * @inode: inode of tty
1715 * @filp: file pointer for handle to tty
1716 *
1717 * Called the last time each file handle is closed that references this tty.
1718 * There may however be several such references.
1719 *
1720 * Locking:
1721 * Takes BKL. See tty_release_dev().
1722 *
1723 * Even releasing the tty structures is a tricky business. We have to be very
1724 * careful that the structures are all released at the same time, as interrupts
1725 * might otherwise get the wrong pointers.
1726 *
1727 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1728 * lead to double frees or releasing memory still in use.
1729 */
1730int tty_release(struct inode *inode, struct file *filp)
1731{
1732 struct tty_struct *tty = file_tty(filp);
1733 struct tty_struct *o_tty = NULL;
1734 int do_sleep, final;
1735 int idx;
1736 long timeout = 0;
1737 int once = 1;
1738
1739 if (tty_paranoia_check(tty, inode, __func__))
1740 return 0;
1741
1742 tty_lock(tty);
1743 check_tty_count(tty, __func__);
1744
1745 __tty_fasync(-1, filp, 0);
1746
1747 idx = tty->index;
1748 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1749 tty->driver->subtype == PTY_TYPE_MASTER)
1750 o_tty = tty->link;
1751
1752 if (tty_release_checks(tty, idx)) {
1753 tty_unlock(tty);
1754 return 0;
1755 }
1756
1757 tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1758
1759 if (tty->ops->close)
1760 tty->ops->close(tty, filp);
1761
1762 /* If tty is pty master, lock the slave pty (stable lock order) */
1763 tty_lock_slave(o_tty);
1764
1765 /*
1766 * Sanity check: if tty->count is going to zero, there shouldn't be
1767 * any waiters on tty->read_wait or tty->write_wait. We test the
1768 * wait queues and kick everyone out _before_ actually starting to
1769 * close. This ensures that we won't block while releasing the tty
1770 * structure.
1771 *
1772 * The test for the o_tty closing is necessary, since the master and
1773 * slave sides may close in any order. If the slave side closes out
1774 * first, its count will be one, since the master side holds an open.
1775 * Thus this test wouldn't be triggered at the time the slave closed,
1776 * so we do it now.
1777 */
1778 while (1) {
1779 do_sleep = 0;
1780
1781 if (tty->count <= 1) {
1782 if (waitqueue_active(&tty->read_wait)) {
1783 wake_up_poll(&tty->read_wait, EPOLLIN);
1784 do_sleep++;
1785 }
1786 if (waitqueue_active(&tty->write_wait)) {
1787 wake_up_poll(&tty->write_wait, EPOLLOUT);
1788 do_sleep++;
1789 }
1790 }
1791 if (o_tty && o_tty->count <= 1) {
1792 if (waitqueue_active(&o_tty->read_wait)) {
1793 wake_up_poll(&o_tty->read_wait, EPOLLIN);
1794 do_sleep++;
1795 }
1796 if (waitqueue_active(&o_tty->write_wait)) {
1797 wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1798 do_sleep++;
1799 }
1800 }
1801 if (!do_sleep)
1802 break;
1803
1804 if (once) {
1805 once = 0;
1806 tty_warn(tty, "read/write wait queue active!\n");
1807 }
1808 schedule_timeout_killable(timeout);
1809 if (timeout < 120 * HZ)
1810 timeout = 2 * timeout + 1;
1811 else
1812 timeout = MAX_SCHEDULE_TIMEOUT;
1813 }
1814
1815 if (o_tty) {
1816 if (--o_tty->count < 0) {
1817 tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1818 o_tty->count = 0;
1819 }
1820 }
1821 if (--tty->count < 0) {
1822 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1823 tty->count = 0;
1824 }
1825
1826 /*
1827 * We've decremented tty->count, so we need to remove this file
1828 * descriptor off the tty->tty_files list; this serves two
1829 * purposes:
1830 * - check_tty_count sees the correct number of file descriptors
1831 * associated with this tty.
1832 * - do_tty_hangup no longer sees this file descriptor as
1833 * something that needs to be handled for hangups.
1834 */
1835 tty_del_file(filp);
1836
1837 /*
1838 * Perform some housekeeping before deciding whether to return.
1839 *
1840 * If _either_ side is closing, make sure there aren't any
1841 * processes that still think tty or o_tty is their controlling
1842 * tty.
1843 */
1844 if (!tty->count) {
1845 read_lock(&tasklist_lock);
1846 session_clear_tty(tty->ctrl.session);
1847 if (o_tty)
1848 session_clear_tty(o_tty->ctrl.session);
1849 read_unlock(&tasklist_lock);
1850 }
1851
1852 /* check whether both sides are closing ... */
1853 final = !tty->count && !(o_tty && o_tty->count);
1854
1855 tty_unlock_slave(o_tty);
1856 tty_unlock(tty);
1857
1858 /* At this point, the tty->count == 0 should ensure a dead tty
1859 * cannot be re-opened by a racing opener.
1860 */
1861
1862 if (!final)
1863 return 0;
1864
1865 tty_debug_hangup(tty, "final close\n");
1866
1867 tty_release_struct(tty, idx);
1868 return 0;
1869}
1870
1871/**
1872 * tty_open_current_tty - get locked tty of current task
1873 * @device: device number
1874 * @filp: file pointer to tty
1875 * @return: locked tty of the current task iff @device is /dev/tty
1876 *
1877 * Performs a re-open of the current task's controlling tty.
1878 *
1879 * We cannot return driver and index like for the other nodes because devpts
1880 * will not work then. It expects inodes to be from devpts FS.
1881 */
1882static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1883{
1884 struct tty_struct *tty;
1885 int retval;
1886
1887 if (device != MKDEV(TTYAUX_MAJOR, 0))
1888 return NULL;
1889
1890 tty = get_current_tty();
1891 if (!tty)
1892 return ERR_PTR(-ENXIO);
1893
1894 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1895 /* noctty = 1; */
1896 tty_lock(tty);
1897 tty_kref_put(tty); /* safe to drop the kref now */
1898
1899 retval = tty_reopen(tty);
1900 if (retval < 0) {
1901 tty_unlock(tty);
1902 tty = ERR_PTR(retval);
1903 }
1904 return tty;
1905}
1906
1907/**
1908 * tty_lookup_driver - lookup a tty driver for a given device file
1909 * @device: device number
1910 * @filp: file pointer to tty
1911 * @index: index for the device in the @return driver
1912 *
1913 * If returned value is not erroneous, the caller is responsible to decrement
1914 * the refcount by tty_driver_kref_put().
1915 *
1916 * Locking: %tty_mutex protects get_tty_driver()
1917 *
1918 * Return: driver for this inode (with increased refcount)
1919 */
1920static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1921 int *index)
1922{
1923 struct tty_driver *driver = NULL;
1924
1925 switch (device) {
1926#ifdef CONFIG_VT
1927 case MKDEV(TTY_MAJOR, 0): {
1928 extern struct tty_driver *console_driver;
1929
1930 driver = tty_driver_kref_get(console_driver);
1931 *index = fg_console;
1932 break;
1933 }
1934#endif
1935 case MKDEV(TTYAUX_MAJOR, 1): {
1936 struct tty_driver *console_driver = console_device(index);
1937
1938 if (console_driver) {
1939 driver = tty_driver_kref_get(console_driver);
1940 if (driver && filp) {
1941 /* Don't let /dev/console block */
1942 filp->f_flags |= O_NONBLOCK;
1943 break;
1944 }
1945 }
1946 if (driver)
1947 tty_driver_kref_put(driver);
1948 return ERR_PTR(-ENODEV);
1949 }
1950 default:
1951 driver = get_tty_driver(device, index);
1952 if (!driver)
1953 return ERR_PTR(-ENODEV);
1954 break;
1955 }
1956 return driver;
1957}
1958
1959static struct tty_struct *tty_kopen(dev_t device, int shared)
1960{
1961 struct tty_struct *tty;
1962 struct tty_driver *driver;
1963 int index = -1;
1964
1965 mutex_lock(&tty_mutex);
1966 driver = tty_lookup_driver(device, NULL, &index);
1967 if (IS_ERR(driver)) {
1968 mutex_unlock(&tty_mutex);
1969 return ERR_CAST(driver);
1970 }
1971
1972 /* check whether we're reopening an existing tty */
1973 tty = tty_driver_lookup_tty(driver, NULL, index);
1974 if (IS_ERR(tty) || shared)
1975 goto out;
1976
1977 if (tty) {
1978 /* drop kref from tty_driver_lookup_tty() */
1979 tty_kref_put(tty);
1980 tty = ERR_PTR(-EBUSY);
1981 } else { /* tty_init_dev returns tty with the tty_lock held */
1982 tty = tty_init_dev(driver, index);
1983 if (IS_ERR(tty))
1984 goto out;
1985 tty_port_set_kopened(tty->port, 1);
1986 }
1987out:
1988 mutex_unlock(&tty_mutex);
1989 tty_driver_kref_put(driver);
1990 return tty;
1991}
1992
1993/**
1994 * tty_kopen_exclusive - open a tty device for kernel
1995 * @device: dev_t of device to open
1996 *
1997 * Opens tty exclusively for kernel. Performs the driver lookup, makes sure
1998 * it's not already opened and performs the first-time tty initialization.
1999 *
2000 * Claims the global %tty_mutex to serialize:
2001 * * concurrent first-time tty initialization
2002 * * concurrent tty driver removal w/ lookup
2003 * * concurrent tty removal from driver table
2004 *
2005 * Return: the locked initialized &tty_struct
2006 */
2007struct tty_struct *tty_kopen_exclusive(dev_t device)
2008{
2009 return tty_kopen(device, 0);
2010}
2011EXPORT_SYMBOL_GPL(tty_kopen_exclusive);
2012
2013/**
2014 * tty_kopen_shared - open a tty device for shared in-kernel use
2015 * @device: dev_t of device to open
2016 *
2017 * Opens an already existing tty for in-kernel use. Compared to
2018 * tty_kopen_exclusive() above it doesn't ensure to be the only user.
2019 *
2020 * Locking: identical to tty_kopen() above.
2021 */
2022struct tty_struct *tty_kopen_shared(dev_t device)
2023{
2024 return tty_kopen(device, 1);
2025}
2026EXPORT_SYMBOL_GPL(tty_kopen_shared);
2027
2028/**
2029 * tty_open_by_driver - open a tty device
2030 * @device: dev_t of device to open
2031 * @filp: file pointer to tty
2032 *
2033 * Performs the driver lookup, checks for a reopen, or otherwise performs the
2034 * first-time tty initialization.
2035 *
2036 *
2037 * Claims the global tty_mutex to serialize:
2038 * * concurrent first-time tty initialization
2039 * * concurrent tty driver removal w/ lookup
2040 * * concurrent tty removal from driver table
2041 *
2042 * Return: the locked initialized or re-opened &tty_struct
2043 */
2044static struct tty_struct *tty_open_by_driver(dev_t device,
2045 struct file *filp)
2046{
2047 struct tty_struct *tty;
2048 struct tty_driver *driver = NULL;
2049 int index = -1;
2050 int retval;
2051
2052 mutex_lock(&tty_mutex);
2053 driver = tty_lookup_driver(device, filp, &index);
2054 if (IS_ERR(driver)) {
2055 mutex_unlock(&tty_mutex);
2056 return ERR_CAST(driver);
2057 }
2058
2059 /* check whether we're reopening an existing tty */
2060 tty = tty_driver_lookup_tty(driver, filp, index);
2061 if (IS_ERR(tty)) {
2062 mutex_unlock(&tty_mutex);
2063 goto out;
2064 }
2065
2066 if (tty) {
2067 if (tty_port_kopened(tty->port)) {
2068 tty_kref_put(tty);
2069 mutex_unlock(&tty_mutex);
2070 tty = ERR_PTR(-EBUSY);
2071 goto out;
2072 }
2073 mutex_unlock(&tty_mutex);
2074 retval = tty_lock_interruptible(tty);
2075 tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
2076 if (retval) {
2077 if (retval == -EINTR)
2078 retval = -ERESTARTSYS;
2079 tty = ERR_PTR(retval);
2080 goto out;
2081 }
2082 retval = tty_reopen(tty);
2083 if (retval < 0) {
2084 tty_unlock(tty);
2085 tty = ERR_PTR(retval);
2086 }
2087 } else { /* Returns with the tty_lock held for now */
2088 tty = tty_init_dev(driver, index);
2089 mutex_unlock(&tty_mutex);
2090 }
2091out:
2092 tty_driver_kref_put(driver);
2093 return tty;
2094}
2095
2096/**
2097 * tty_open - open a tty device
2098 * @inode: inode of device file
2099 * @filp: file pointer to tty
2100 *
2101 * tty_open() and tty_release() keep up the tty count that contains the number
2102 * of opens done on a tty. We cannot use the inode-count, as different inodes
2103 * might point to the same tty.
2104 *
2105 * Open-counting is needed for pty masters, as well as for keeping track of
2106 * serial lines: DTR is dropped when the last close happens.
2107 * (This is not done solely through tty->count, now. - Ted 1/27/92)
2108 *
2109 * The termios state of a pty is reset on the first open so that settings don't
2110 * persist across reuse.
2111 *
2112 * Locking:
2113 * * %tty_mutex protects tty, tty_lookup_driver() and tty_init_dev().
2114 * * @tty->count should protect the rest.
2115 * * ->siglock protects ->signal/->sighand
2116 *
2117 * Note: the tty_unlock/lock cases without a ref are only safe due to %tty_mutex
2118 */
2119static int tty_open(struct inode *inode, struct file *filp)
2120{
2121 struct tty_struct *tty;
2122 int noctty, retval;
2123 dev_t device = inode->i_rdev;
2124 unsigned saved_flags = filp->f_flags;
2125
2126 nonseekable_open(inode, filp);
2127
2128retry_open:
2129 retval = tty_alloc_file(filp);
2130 if (retval)
2131 return -ENOMEM;
2132
2133 tty = tty_open_current_tty(device, filp);
2134 if (!tty)
2135 tty = tty_open_by_driver(device, filp);
2136
2137 if (IS_ERR(tty)) {
2138 tty_free_file(filp);
2139 retval = PTR_ERR(tty);
2140 if (retval != -EAGAIN || signal_pending(current))
2141 return retval;
2142 schedule();
2143 goto retry_open;
2144 }
2145
2146 tty_add_file(tty, filp);
2147
2148 check_tty_count(tty, __func__);
2149 tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2150
2151 if (tty->ops->open)
2152 retval = tty->ops->open(tty, filp);
2153 else
2154 retval = -ENODEV;
2155 filp->f_flags = saved_flags;
2156
2157 if (retval) {
2158 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2159
2160 tty_unlock(tty); /* need to call tty_release without BTM */
2161 tty_release(inode, filp);
2162 if (retval != -ERESTARTSYS)
2163 return retval;
2164
2165 if (signal_pending(current))
2166 return retval;
2167
2168 schedule();
2169 /*
2170 * Need to reset f_op in case a hangup happened.
2171 */
2172 if (tty_hung_up_p(filp))
2173 filp->f_op = &tty_fops;
2174 goto retry_open;
2175 }
2176 clear_bit(TTY_HUPPED, &tty->flags);
2177
2178 noctty = (filp->f_flags & O_NOCTTY) ||
2179 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2180 device == MKDEV(TTYAUX_MAJOR, 1) ||
2181 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2182 tty->driver->subtype == PTY_TYPE_MASTER);
2183 if (!noctty)
2184 tty_open_proc_set_tty(filp, tty);
2185 tty_unlock(tty);
2186 return 0;
2187}
2188
2189
2190/**
2191 * tty_poll - check tty status
2192 * @filp: file being polled
2193 * @wait: poll wait structures to update
2194 *
2195 * Call the line discipline polling method to obtain the poll status of the
2196 * device.
2197 *
2198 * Locking: locks called line discipline but ldisc poll method may be
2199 * re-entered freely by other callers.
2200 */
2201static __poll_t tty_poll(struct file *filp, poll_table *wait)
2202{
2203 struct tty_struct *tty = file_tty(filp);
2204 struct tty_ldisc *ld;
2205 __poll_t ret = 0;
2206
2207 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2208 return 0;
2209
2210 ld = tty_ldisc_ref_wait(tty);
2211 if (!ld)
2212 return hung_up_tty_poll(filp, wait);
2213 if (ld->ops->poll)
2214 ret = ld->ops->poll(tty, filp, wait);
2215 tty_ldisc_deref(ld);
2216 return ret;
2217}
2218
2219static int __tty_fasync(int fd, struct file *filp, int on)
2220{
2221 struct tty_struct *tty = file_tty(filp);
2222 unsigned long flags;
2223 int retval = 0;
2224
2225 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2226 goto out;
2227
2228 retval = fasync_helper(fd, filp, on, &tty->fasync);
2229 if (retval <= 0)
2230 goto out;
2231
2232 if (on) {
2233 enum pid_type type;
2234 struct pid *pid;
2235
2236 spin_lock_irqsave(&tty->ctrl.lock, flags);
2237 if (tty->ctrl.pgrp) {
2238 pid = tty->ctrl.pgrp;
2239 type = PIDTYPE_PGID;
2240 } else {
2241 pid = task_pid(current);
2242 type = PIDTYPE_TGID;
2243 }
2244 get_pid(pid);
2245 spin_unlock_irqrestore(&tty->ctrl.lock, flags);
2246 __f_setown(filp, pid, type, 0);
2247 put_pid(pid);
2248 retval = 0;
2249 }
2250out:
2251 return retval;
2252}
2253
2254static int tty_fasync(int fd, struct file *filp, int on)
2255{
2256 struct tty_struct *tty = file_tty(filp);
2257 int retval = -ENOTTY;
2258
2259 tty_lock(tty);
2260 if (!tty_hung_up_p(filp))
2261 retval = __tty_fasync(fd, filp, on);
2262 tty_unlock(tty);
2263
2264 return retval;
2265}
2266
2267static bool tty_legacy_tiocsti __read_mostly = IS_ENABLED(CONFIG_LEGACY_TIOCSTI);
2268/**
2269 * tiocsti - fake input character
2270 * @tty: tty to fake input into
2271 * @p: pointer to character
2272 *
2273 * Fake input to a tty device. Does the necessary locking and input management.
2274 *
2275 * FIXME: does not honour flow control ??
2276 *
2277 * Locking:
2278 * * Called functions take tty_ldiscs_lock
2279 * * current->signal->tty check is safe without locks
2280 */
2281static int tiocsti(struct tty_struct *tty, u8 __user *p)
2282{
2283 struct tty_ldisc *ld;
2284 u8 ch;
2285
2286 if (!tty_legacy_tiocsti && !capable(CAP_SYS_ADMIN))
2287 return -EIO;
2288
2289 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2290 return -EPERM;
2291 if (get_user(ch, p))
2292 return -EFAULT;
2293 tty_audit_tiocsti(tty, ch);
2294 ld = tty_ldisc_ref_wait(tty);
2295 if (!ld)
2296 return -EIO;
2297 tty_buffer_lock_exclusive(tty->port);
2298 if (ld->ops->receive_buf)
2299 ld->ops->receive_buf(tty, &ch, NULL, 1);
2300 tty_buffer_unlock_exclusive(tty->port);
2301 tty_ldisc_deref(ld);
2302 return 0;
2303}
2304
2305/**
2306 * tiocgwinsz - implement window query ioctl
2307 * @tty: tty
2308 * @arg: user buffer for result
2309 *
2310 * Copies the kernel idea of the window size into the user buffer.
2311 *
2312 * Locking: @tty->winsize_mutex is taken to ensure the winsize data is
2313 * consistent.
2314 */
2315static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2316{
2317 int err;
2318
2319 mutex_lock(&tty->winsize_mutex);
2320 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2321 mutex_unlock(&tty->winsize_mutex);
2322
2323 return err ? -EFAULT : 0;
2324}
2325
2326/**
2327 * tty_do_resize - resize event
2328 * @tty: tty being resized
2329 * @ws: new dimensions
2330 *
2331 * Update the termios variables and send the necessary signals to peform a
2332 * terminal resize correctly.
2333 */
2334int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2335{
2336 struct pid *pgrp;
2337
2338 /* Lock the tty */
2339 mutex_lock(&tty->winsize_mutex);
2340 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2341 goto done;
2342
2343 /* Signal the foreground process group */
2344 pgrp = tty_get_pgrp(tty);
2345 if (pgrp)
2346 kill_pgrp(pgrp, SIGWINCH, 1);
2347 put_pid(pgrp);
2348
2349 tty->winsize = *ws;
2350done:
2351 mutex_unlock(&tty->winsize_mutex);
2352 return 0;
2353}
2354EXPORT_SYMBOL(tty_do_resize);
2355
2356/**
2357 * tiocswinsz - implement window size set ioctl
2358 * @tty: tty side of tty
2359 * @arg: user buffer for result
2360 *
2361 * Copies the user idea of the window size to the kernel. Traditionally this is
2362 * just advisory information but for the Linux console it actually has driver
2363 * level meaning and triggers a VC resize.
2364 *
2365 * Locking:
2366 * Driver dependent. The default do_resize method takes the tty termios
2367 * mutex and ctrl.lock. The console takes its own lock then calls into the
2368 * default method.
2369 */
2370static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2371{
2372 struct winsize tmp_ws;
2373
2374 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2375 return -EFAULT;
2376
2377 if (tty->ops->resize)
2378 return tty->ops->resize(tty, &tmp_ws);
2379 else
2380 return tty_do_resize(tty, &tmp_ws);
2381}
2382
2383/**
2384 * tioccons - allow admin to move logical console
2385 * @file: the file to become console
2386 *
2387 * Allow the administrator to move the redirected console device.
2388 *
2389 * Locking: uses redirect_lock to guard the redirect information
2390 */
2391static int tioccons(struct file *file)
2392{
2393 if (!capable(CAP_SYS_ADMIN))
2394 return -EPERM;
2395 if (file->f_op->write_iter == redirected_tty_write) {
2396 struct file *f;
2397
2398 spin_lock(&redirect_lock);
2399 f = redirect;
2400 redirect = NULL;
2401 spin_unlock(&redirect_lock);
2402 if (f)
2403 fput(f);
2404 return 0;
2405 }
2406 if (file->f_op->write_iter != tty_write)
2407 return -ENOTTY;
2408 if (!(file->f_mode & FMODE_WRITE))
2409 return -EBADF;
2410 if (!(file->f_mode & FMODE_CAN_WRITE))
2411 return -EINVAL;
2412 spin_lock(&redirect_lock);
2413 if (redirect) {
2414 spin_unlock(&redirect_lock);
2415 return -EBUSY;
2416 }
2417 redirect = get_file(file);
2418 spin_unlock(&redirect_lock);
2419 return 0;
2420}
2421
2422/**
2423 * tiocsetd - set line discipline
2424 * @tty: tty device
2425 * @p: pointer to user data
2426 *
2427 * Set the line discipline according to user request.
2428 *
2429 * Locking: see tty_set_ldisc(), this function is just a helper
2430 */
2431static int tiocsetd(struct tty_struct *tty, int __user *p)
2432{
2433 int disc;
2434 int ret;
2435
2436 if (get_user(disc, p))
2437 return -EFAULT;
2438
2439 ret = tty_set_ldisc(tty, disc);
2440
2441 return ret;
2442}
2443
2444/**
2445 * tiocgetd - get line discipline
2446 * @tty: tty device
2447 * @p: pointer to user data
2448 *
2449 * Retrieves the line discipline id directly from the ldisc.
2450 *
2451 * Locking: waits for ldisc reference (in case the line discipline is changing
2452 * or the @tty is being hungup)
2453 */
2454static int tiocgetd(struct tty_struct *tty, int __user *p)
2455{
2456 struct tty_ldisc *ld;
2457 int ret;
2458
2459 ld = tty_ldisc_ref_wait(tty);
2460 if (!ld)
2461 return -EIO;
2462 ret = put_user(ld->ops->num, p);
2463 tty_ldisc_deref(ld);
2464 return ret;
2465}
2466
2467/**
2468 * send_break - performed time break
2469 * @tty: device to break on
2470 * @duration: timeout in mS
2471 *
2472 * Perform a timed break on hardware that lacks its own driver level timed
2473 * break functionality.
2474 *
2475 * Locking:
2476 * @tty->atomic_write_lock serializes
2477 */
2478static int send_break(struct tty_struct *tty, unsigned int duration)
2479{
2480 int retval;
2481
2482 if (tty->ops->break_ctl == NULL)
2483 return 0;
2484
2485 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2486 return tty->ops->break_ctl(tty, duration);
2487
2488 /* Do the work ourselves */
2489 if (tty_write_lock(tty, false) < 0)
2490 return -EINTR;
2491
2492 retval = tty->ops->break_ctl(tty, -1);
2493 if (!retval) {
2494 msleep_interruptible(duration);
2495 retval = tty->ops->break_ctl(tty, 0);
2496 } else if (retval == -EOPNOTSUPP) {
2497 /* some drivers can tell only dynamically */
2498 retval = 0;
2499 }
2500 tty_write_unlock(tty);
2501
2502 if (signal_pending(current))
2503 retval = -EINTR;
2504
2505 return retval;
2506}
2507
2508/**
2509 * tty_get_tiocm - get tiocm status register
2510 * @tty: tty device
2511 *
2512 * Obtain the modem status bits from the tty driver if the feature
2513 * is supported.
2514 */
2515int tty_get_tiocm(struct tty_struct *tty)
2516{
2517 int retval = -ENOTTY;
2518
2519 if (tty->ops->tiocmget)
2520 retval = tty->ops->tiocmget(tty);
2521
2522 return retval;
2523}
2524EXPORT_SYMBOL_GPL(tty_get_tiocm);
2525
2526/**
2527 * tty_tiocmget - get modem status
2528 * @tty: tty device
2529 * @p: pointer to result
2530 *
2531 * Obtain the modem status bits from the tty driver if the feature is
2532 * supported. Return -%ENOTTY if it is not available.
2533 *
2534 * Locking: none (up to the driver)
2535 */
2536static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2537{
2538 int retval;
2539
2540 retval = tty_get_tiocm(tty);
2541 if (retval >= 0)
2542 retval = put_user(retval, p);
2543
2544 return retval;
2545}
2546
2547/**
2548 * tty_tiocmset - set modem status
2549 * @tty: tty device
2550 * @cmd: command - clear bits, set bits or set all
2551 * @p: pointer to desired bits
2552 *
2553 * Set the modem status bits from the tty driver if the feature
2554 * is supported. Return -%ENOTTY if it is not available.
2555 *
2556 * Locking: none (up to the driver)
2557 */
2558static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2559 unsigned __user *p)
2560{
2561 int retval;
2562 unsigned int set, clear, val;
2563
2564 if (tty->ops->tiocmset == NULL)
2565 return -ENOTTY;
2566
2567 retval = get_user(val, p);
2568 if (retval)
2569 return retval;
2570 set = clear = 0;
2571 switch (cmd) {
2572 case TIOCMBIS:
2573 set = val;
2574 break;
2575 case TIOCMBIC:
2576 clear = val;
2577 break;
2578 case TIOCMSET:
2579 set = val;
2580 clear = ~val;
2581 break;
2582 }
2583 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2584 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2585 return tty->ops->tiocmset(tty, set, clear);
2586}
2587
2588/**
2589 * tty_get_icount - get tty statistics
2590 * @tty: tty device
2591 * @icount: output parameter
2592 *
2593 * Gets a copy of the @tty's icount statistics.
2594 *
2595 * Locking: none (up to the driver)
2596 */
2597int tty_get_icount(struct tty_struct *tty,
2598 struct serial_icounter_struct *icount)
2599{
2600 memset(icount, 0, sizeof(*icount));
2601
2602 if (tty->ops->get_icount)
2603 return tty->ops->get_icount(tty, icount);
2604 else
2605 return -ENOTTY;
2606}
2607EXPORT_SYMBOL_GPL(tty_get_icount);
2608
2609static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2610{
2611 struct serial_icounter_struct icount;
2612 int retval;
2613
2614 retval = tty_get_icount(tty, &icount);
2615 if (retval != 0)
2616 return retval;
2617
2618 if (copy_to_user(arg, &icount, sizeof(icount)))
2619 return -EFAULT;
2620 return 0;
2621}
2622
2623static int tty_set_serial(struct tty_struct *tty, struct serial_struct *ss)
2624{
2625 char comm[TASK_COMM_LEN];
2626 int flags;
2627
2628 flags = ss->flags & ASYNC_DEPRECATED;
2629
2630 if (flags)
2631 pr_warn_ratelimited("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2632 __func__, get_task_comm(comm, current), flags);
2633
2634 if (!tty->ops->set_serial)
2635 return -ENOTTY;
2636
2637 return tty->ops->set_serial(tty, ss);
2638}
2639
2640static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
2641{
2642 struct serial_struct v;
2643
2644 if (copy_from_user(&v, ss, sizeof(*ss)))
2645 return -EFAULT;
2646
2647 return tty_set_serial(tty, &v);
2648}
2649
2650static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2651{
2652 struct serial_struct v;
2653 int err;
2654
2655 memset(&v, 0, sizeof(v));
2656 if (!tty->ops->get_serial)
2657 return -ENOTTY;
2658 err = tty->ops->get_serial(tty, &v);
2659 if (!err && copy_to_user(ss, &v, sizeof(v)))
2660 err = -EFAULT;
2661 return err;
2662}
2663
2664/*
2665 * if pty, return the slave side (real_tty)
2666 * otherwise, return self
2667 */
2668static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2669{
2670 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2671 tty->driver->subtype == PTY_TYPE_MASTER)
2672 tty = tty->link;
2673 return tty;
2674}
2675
2676/*
2677 * Split this up, as gcc can choke on it otherwise..
2678 */
2679long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2680{
2681 struct tty_struct *tty = file_tty(file);
2682 struct tty_struct *real_tty;
2683 void __user *p = (void __user *)arg;
2684 int retval;
2685 struct tty_ldisc *ld;
2686
2687 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2688 return -EINVAL;
2689
2690 real_tty = tty_pair_get_tty(tty);
2691
2692 /*
2693 * Factor out some common prep work
2694 */
2695 switch (cmd) {
2696 case TIOCSETD:
2697 case TIOCSBRK:
2698 case TIOCCBRK:
2699 case TCSBRK:
2700 case TCSBRKP:
2701 retval = tty_check_change(tty);
2702 if (retval)
2703 return retval;
2704 if (cmd != TIOCCBRK) {
2705 tty_wait_until_sent(tty, 0);
2706 if (signal_pending(current))
2707 return -EINTR;
2708 }
2709 break;
2710 }
2711
2712 /*
2713 * Now do the stuff.
2714 */
2715 switch (cmd) {
2716 case TIOCSTI:
2717 return tiocsti(tty, p);
2718 case TIOCGWINSZ:
2719 return tiocgwinsz(real_tty, p);
2720 case TIOCSWINSZ:
2721 return tiocswinsz(real_tty, p);
2722 case TIOCCONS:
2723 return real_tty != tty ? -EINVAL : tioccons(file);
2724 case TIOCEXCL:
2725 set_bit(TTY_EXCLUSIVE, &tty->flags);
2726 return 0;
2727 case TIOCNXCL:
2728 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2729 return 0;
2730 case TIOCGEXCL:
2731 {
2732 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2733
2734 return put_user(excl, (int __user *)p);
2735 }
2736 case TIOCGETD:
2737 return tiocgetd(tty, p);
2738 case TIOCSETD:
2739 return tiocsetd(tty, p);
2740 case TIOCVHANGUP:
2741 if (!capable(CAP_SYS_ADMIN))
2742 return -EPERM;
2743 tty_vhangup(tty);
2744 return 0;
2745 case TIOCGDEV:
2746 {
2747 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2748
2749 return put_user(ret, (unsigned int __user *)p);
2750 }
2751 /*
2752 * Break handling
2753 */
2754 case TIOCSBRK: /* Turn break on, unconditionally */
2755 if (tty->ops->break_ctl)
2756 return tty->ops->break_ctl(tty, -1);
2757 return 0;
2758 case TIOCCBRK: /* Turn break off, unconditionally */
2759 if (tty->ops->break_ctl)
2760 return tty->ops->break_ctl(tty, 0);
2761 return 0;
2762 case TCSBRK: /* SVID version: non-zero arg --> no break */
2763 /* non-zero arg means wait for all output data
2764 * to be sent (performed above) but don't send break.
2765 * This is used by the tcdrain() termios function.
2766 */
2767 if (!arg)
2768 return send_break(tty, 250);
2769 return 0;
2770 case TCSBRKP: /* support for POSIX tcsendbreak() */
2771 return send_break(tty, arg ? arg*100 : 250);
2772
2773 case TIOCMGET:
2774 return tty_tiocmget(tty, p);
2775 case TIOCMSET:
2776 case TIOCMBIC:
2777 case TIOCMBIS:
2778 return tty_tiocmset(tty, cmd, p);
2779 case TIOCGICOUNT:
2780 return tty_tiocgicount(tty, p);
2781 case TCFLSH:
2782 switch (arg) {
2783 case TCIFLUSH:
2784 case TCIOFLUSH:
2785 /* flush tty buffer and allow ldisc to process ioctl */
2786 tty_buffer_flush(tty, NULL);
2787 break;
2788 }
2789 break;
2790 case TIOCSSERIAL:
2791 return tty_tiocsserial(tty, p);
2792 case TIOCGSERIAL:
2793 return tty_tiocgserial(tty, p);
2794 case TIOCGPTPEER:
2795 /* Special because the struct file is needed */
2796 return ptm_open_peer(file, tty, (int)arg);
2797 default:
2798 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2799 if (retval != -ENOIOCTLCMD)
2800 return retval;
2801 }
2802 if (tty->ops->ioctl) {
2803 retval = tty->ops->ioctl(tty, cmd, arg);
2804 if (retval != -ENOIOCTLCMD)
2805 return retval;
2806 }
2807 ld = tty_ldisc_ref_wait(tty);
2808 if (!ld)
2809 return hung_up_tty_ioctl(file, cmd, arg);
2810 retval = -EINVAL;
2811 if (ld->ops->ioctl) {
2812 retval = ld->ops->ioctl(tty, cmd, arg);
2813 if (retval == -ENOIOCTLCMD)
2814 retval = -ENOTTY;
2815 }
2816 tty_ldisc_deref(ld);
2817 return retval;
2818}
2819
2820#ifdef CONFIG_COMPAT
2821
2822struct serial_struct32 {
2823 compat_int_t type;
2824 compat_int_t line;
2825 compat_uint_t port;
2826 compat_int_t irq;
2827 compat_int_t flags;
2828 compat_int_t xmit_fifo_size;
2829 compat_int_t custom_divisor;
2830 compat_int_t baud_base;
2831 unsigned short close_delay;
2832 char io_type;
2833 char reserved_char;
2834 compat_int_t hub6;
2835 unsigned short closing_wait; /* time to wait before closing */
2836 unsigned short closing_wait2; /* no longer used... */
2837 compat_uint_t iomem_base;
2838 unsigned short iomem_reg_shift;
2839 unsigned int port_high;
2840 /* compat_ulong_t iomap_base FIXME */
2841 compat_int_t reserved;
2842};
2843
2844static int compat_tty_tiocsserial(struct tty_struct *tty,
2845 struct serial_struct32 __user *ss)
2846{
2847 struct serial_struct32 v32;
2848 struct serial_struct v;
2849
2850 if (copy_from_user(&v32, ss, sizeof(*ss)))
2851 return -EFAULT;
2852
2853 memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2854 v.iomem_base = compat_ptr(v32.iomem_base);
2855 v.iomem_reg_shift = v32.iomem_reg_shift;
2856 v.port_high = v32.port_high;
2857 v.iomap_base = 0;
2858
2859 return tty_set_serial(tty, &v);
2860}
2861
2862static int compat_tty_tiocgserial(struct tty_struct *tty,
2863 struct serial_struct32 __user *ss)
2864{
2865 struct serial_struct32 v32;
2866 struct serial_struct v;
2867 int err;
2868
2869 memset(&v, 0, sizeof(v));
2870 memset(&v32, 0, sizeof(v32));
2871
2872 if (!tty->ops->get_serial)
2873 return -ENOTTY;
2874 err = tty->ops->get_serial(tty, &v);
2875 if (!err) {
2876 memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2877 v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2878 0xfffffff : ptr_to_compat(v.iomem_base);
2879 v32.iomem_reg_shift = v.iomem_reg_shift;
2880 v32.port_high = v.port_high;
2881 if (copy_to_user(ss, &v32, sizeof(v32)))
2882 err = -EFAULT;
2883 }
2884 return err;
2885}
2886static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2887 unsigned long arg)
2888{
2889 struct tty_struct *tty = file_tty(file);
2890 struct tty_ldisc *ld;
2891 int retval = -ENOIOCTLCMD;
2892
2893 switch (cmd) {
2894 case TIOCOUTQ:
2895 case TIOCSTI:
2896 case TIOCGWINSZ:
2897 case TIOCSWINSZ:
2898 case TIOCGEXCL:
2899 case TIOCGETD:
2900 case TIOCSETD:
2901 case TIOCGDEV:
2902 case TIOCMGET:
2903 case TIOCMSET:
2904 case TIOCMBIC:
2905 case TIOCMBIS:
2906 case TIOCGICOUNT:
2907 case TIOCGPGRP:
2908 case TIOCSPGRP:
2909 case TIOCGSID:
2910 case TIOCSERGETLSR:
2911 case TIOCGRS485:
2912 case TIOCSRS485:
2913#ifdef TIOCGETP
2914 case TIOCGETP:
2915 case TIOCSETP:
2916 case TIOCSETN:
2917#endif
2918#ifdef TIOCGETC
2919 case TIOCGETC:
2920 case TIOCSETC:
2921#endif
2922#ifdef TIOCGLTC
2923 case TIOCGLTC:
2924 case TIOCSLTC:
2925#endif
2926 case TCSETSF:
2927 case TCSETSW:
2928 case TCSETS:
2929 case TCGETS:
2930#ifdef TCGETS2
2931 case TCGETS2:
2932 case TCSETSF2:
2933 case TCSETSW2:
2934 case TCSETS2:
2935#endif
2936 case TCGETA:
2937 case TCSETAF:
2938 case TCSETAW:
2939 case TCSETA:
2940 case TIOCGLCKTRMIOS:
2941 case TIOCSLCKTRMIOS:
2942#ifdef TCGETX
2943 case TCGETX:
2944 case TCSETX:
2945 case TCSETXW:
2946 case TCSETXF:
2947#endif
2948 case TIOCGSOFTCAR:
2949 case TIOCSSOFTCAR:
2950
2951 case PPPIOCGCHAN:
2952 case PPPIOCGUNIT:
2953 return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
2954 case TIOCCONS:
2955 case TIOCEXCL:
2956 case TIOCNXCL:
2957 case TIOCVHANGUP:
2958 case TIOCSBRK:
2959 case TIOCCBRK:
2960 case TCSBRK:
2961 case TCSBRKP:
2962 case TCFLSH:
2963 case TIOCGPTPEER:
2964 case TIOCNOTTY:
2965 case TIOCSCTTY:
2966 case TCXONC:
2967 case TIOCMIWAIT:
2968 case TIOCSERCONFIG:
2969 return tty_ioctl(file, cmd, arg);
2970 }
2971
2972 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2973 return -EINVAL;
2974
2975 switch (cmd) {
2976 case TIOCSSERIAL:
2977 return compat_tty_tiocsserial(tty, compat_ptr(arg));
2978 case TIOCGSERIAL:
2979 return compat_tty_tiocgserial(tty, compat_ptr(arg));
2980 }
2981 if (tty->ops->compat_ioctl) {
2982 retval = tty->ops->compat_ioctl(tty, cmd, arg);
2983 if (retval != -ENOIOCTLCMD)
2984 return retval;
2985 }
2986
2987 ld = tty_ldisc_ref_wait(tty);
2988 if (!ld)
2989 return hung_up_tty_compat_ioctl(file, cmd, arg);
2990 if (ld->ops->compat_ioctl)
2991 retval = ld->ops->compat_ioctl(tty, cmd, arg);
2992 if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2993 retval = ld->ops->ioctl(tty, (unsigned long)compat_ptr(cmd),
2994 arg);
2995 tty_ldisc_deref(ld);
2996
2997 return retval;
2998}
2999#endif
3000
3001static int this_tty(const void *t, struct file *file, unsigned fd)
3002{
3003 if (likely(file->f_op->read_iter != tty_read))
3004 return 0;
3005 return file_tty(file) != t ? 0 : fd + 1;
3006}
3007
3008/*
3009 * This implements the "Secure Attention Key" --- the idea is to
3010 * prevent trojan horses by killing all processes associated with this
3011 * tty when the user hits the "Secure Attention Key". Required for
3012 * super-paranoid applications --- see the Orange Book for more details.
3013 *
3014 * This code could be nicer; ideally it should send a HUP, wait a few
3015 * seconds, then send a INT, and then a KILL signal. But you then
3016 * have to coordinate with the init process, since all processes associated
3017 * with the current tty must be dead before the new getty is allowed
3018 * to spawn.
3019 *
3020 * Now, if it would be correct ;-/ The current code has a nasty hole -
3021 * it doesn't catch files in flight. We may send the descriptor to ourselves
3022 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
3023 *
3024 * Nasty bug: do_SAK is being called in interrupt context. This can
3025 * deadlock. We punt it up to process context. AKPM - 16Mar2001
3026 */
3027void __do_SAK(struct tty_struct *tty)
3028{
3029 struct task_struct *g, *p;
3030 struct pid *session;
3031 int i;
3032 unsigned long flags;
3033
3034 spin_lock_irqsave(&tty->ctrl.lock, flags);
3035 session = get_pid(tty->ctrl.session);
3036 spin_unlock_irqrestore(&tty->ctrl.lock, flags);
3037
3038 tty_ldisc_flush(tty);
3039
3040 tty_driver_flush_buffer(tty);
3041
3042 read_lock(&tasklist_lock);
3043 /* Kill the entire session */
3044 do_each_pid_task(session, PIDTYPE_SID, p) {
3045 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
3046 task_pid_nr(p), p->comm);
3047 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
3048 } while_each_pid_task(session, PIDTYPE_SID, p);
3049
3050 /* Now kill any processes that happen to have the tty open */
3051 for_each_process_thread(g, p) {
3052 if (p->signal->tty == tty) {
3053 tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
3054 task_pid_nr(p), p->comm);
3055 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p,
3056 PIDTYPE_SID);
3057 continue;
3058 }
3059 task_lock(p);
3060 i = iterate_fd(p->files, 0, this_tty, tty);
3061 if (i != 0) {
3062 tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
3063 task_pid_nr(p), p->comm, i - 1);
3064 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p,
3065 PIDTYPE_SID);
3066 }
3067 task_unlock(p);
3068 }
3069 read_unlock(&tasklist_lock);
3070 put_pid(session);
3071}
3072
3073static void do_SAK_work(struct work_struct *work)
3074{
3075 struct tty_struct *tty =
3076 container_of(work, struct tty_struct, SAK_work);
3077 __do_SAK(tty);
3078}
3079
3080/*
3081 * The tq handling here is a little racy - tty->SAK_work may already be queued.
3082 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3083 * the values which we write to it will be identical to the values which it
3084 * already has. --akpm
3085 */
3086void do_SAK(struct tty_struct *tty)
3087{
3088 if (!tty)
3089 return;
3090 schedule_work(&tty->SAK_work);
3091}
3092EXPORT_SYMBOL(do_SAK);
3093
3094/* Must put_device() after it's unused! */
3095static struct device *tty_get_device(struct tty_struct *tty)
3096{
3097 dev_t devt = tty_devnum(tty);
3098
3099 return class_find_device_by_devt(&tty_class, devt);
3100}
3101
3102
3103/**
3104 * alloc_tty_struct - allocate a new tty
3105 * @driver: driver which will handle the returned tty
3106 * @idx: minor of the tty
3107 *
3108 * This subroutine allocates and initializes a tty structure.
3109 *
3110 * Locking: none - @tty in question is not exposed at this point
3111 */
3112struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
3113{
3114 struct tty_struct *tty;
3115
3116 tty = kzalloc(sizeof(*tty), GFP_KERNEL_ACCOUNT);
3117 if (!tty)
3118 return NULL;
3119
3120 kref_init(&tty->kref);
3121 if (tty_ldisc_init(tty)) {
3122 kfree(tty);
3123 return NULL;
3124 }
3125 tty->ctrl.session = NULL;
3126 tty->ctrl.pgrp = NULL;
3127 mutex_init(&tty->legacy_mutex);
3128 mutex_init(&tty->throttle_mutex);
3129 init_rwsem(&tty->termios_rwsem);
3130 mutex_init(&tty->winsize_mutex);
3131 init_ldsem(&tty->ldisc_sem);
3132 init_waitqueue_head(&tty->write_wait);
3133 init_waitqueue_head(&tty->read_wait);
3134 INIT_WORK(&tty->hangup_work, do_tty_hangup);
3135 mutex_init(&tty->atomic_write_lock);
3136 spin_lock_init(&tty->ctrl.lock);
3137 spin_lock_init(&tty->flow.lock);
3138 spin_lock_init(&tty->files_lock);
3139 INIT_LIST_HEAD(&tty->tty_files);
3140 INIT_WORK(&tty->SAK_work, do_SAK_work);
3141
3142 tty->driver = driver;
3143 tty->ops = driver->ops;
3144 tty->index = idx;
3145 tty_line_name(driver, idx, tty->name);
3146 tty->dev = tty_get_device(tty);
3147
3148 return tty;
3149}
3150
3151/**
3152 * tty_put_char - write one character to a tty
3153 * @tty: tty
3154 * @ch: character to write
3155 *
3156 * Write one byte to the @tty using the provided @tty->ops->put_char() method
3157 * if present.
3158 *
3159 * Note: the specific put_char operation in the driver layer may go
3160 * away soon. Don't call it directly, use this method
3161 *
3162 * Return: the number of characters successfully output.
3163 */
3164int tty_put_char(struct tty_struct *tty, u8 ch)
3165{
3166 if (tty->ops->put_char)
3167 return tty->ops->put_char(tty, ch);
3168 return tty->ops->write(tty, &ch, 1);
3169}
3170EXPORT_SYMBOL_GPL(tty_put_char);
3171
3172static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3173 unsigned int index, unsigned int count)
3174{
3175 int err;
3176
3177 /* init here, since reused cdevs cause crashes */
3178 driver->cdevs[index] = cdev_alloc();
3179 if (!driver->cdevs[index])
3180 return -ENOMEM;
3181 driver->cdevs[index]->ops = &tty_fops;
3182 driver->cdevs[index]->owner = driver->owner;
3183 err = cdev_add(driver->cdevs[index], dev, count);
3184 if (err)
3185 kobject_put(&driver->cdevs[index]->kobj);
3186 return err;
3187}
3188
3189/**
3190 * tty_register_device - register a tty device
3191 * @driver: the tty driver that describes the tty device
3192 * @index: the index in the tty driver for this tty device
3193 * @device: a struct device that is associated with this tty device.
3194 * This field is optional, if there is no known struct device
3195 * for this tty device it can be set to NULL safely.
3196 *
3197 * This call is required to be made to register an individual tty device
3198 * if the tty driver's flags have the %TTY_DRIVER_DYNAMIC_DEV bit set. If
3199 * that bit is not set, this function should not be called by a tty
3200 * driver.
3201 *
3202 * Locking: ??
3203 *
3204 * Return: A pointer to the struct device for this tty device (or
3205 * ERR_PTR(-EFOO) on error).
3206 */
3207struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3208 struct device *device)
3209{
3210 return tty_register_device_attr(driver, index, device, NULL, NULL);
3211}
3212EXPORT_SYMBOL(tty_register_device);
3213
3214static void tty_device_create_release(struct device *dev)
3215{
3216 dev_dbg(dev, "releasing...\n");
3217 kfree(dev);
3218}
3219
3220/**
3221 * tty_register_device_attr - register a tty device
3222 * @driver: the tty driver that describes the tty device
3223 * @index: the index in the tty driver for this tty device
3224 * @device: a struct device that is associated with this tty device.
3225 * This field is optional, if there is no known struct device
3226 * for this tty device it can be set to %NULL safely.
3227 * @drvdata: Driver data to be set to device.
3228 * @attr_grp: Attribute group to be set on device.
3229 *
3230 * This call is required to be made to register an individual tty device if the
3231 * tty driver's flags have the %TTY_DRIVER_DYNAMIC_DEV bit set. If that bit is
3232 * not set, this function should not be called by a tty driver.
3233 *
3234 * Locking: ??
3235 *
3236 * Return: A pointer to the struct device for this tty device (or
3237 * ERR_PTR(-EFOO) on error).
3238 */
3239struct device *tty_register_device_attr(struct tty_driver *driver,
3240 unsigned index, struct device *device,
3241 void *drvdata,
3242 const struct attribute_group **attr_grp)
3243{
3244 char name[64];
3245 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3246 struct ktermios *tp;
3247 struct device *dev;
3248 int retval;
3249
3250 if (index >= driver->num) {
3251 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3252 driver->name, index);
3253 return ERR_PTR(-EINVAL);
3254 }
3255
3256 if (driver->type == TTY_DRIVER_TYPE_PTY)
3257 pty_line_name(driver, index, name);
3258 else
3259 tty_line_name(driver, index, name);
3260
3261 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3262 if (!dev)
3263 return ERR_PTR(-ENOMEM);
3264
3265 dev->devt = devt;
3266 dev->class = &tty_class;
3267 dev->parent = device;
3268 dev->release = tty_device_create_release;
3269 dev_set_name(dev, "%s", name);
3270 dev->groups = attr_grp;
3271 dev_set_drvdata(dev, drvdata);
3272
3273 dev_set_uevent_suppress(dev, 1);
3274
3275 retval = device_register(dev);
3276 if (retval)
3277 goto err_put;
3278
3279 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3280 /*
3281 * Free any saved termios data so that the termios state is
3282 * reset when reusing a minor number.
3283 */
3284 tp = driver->termios[index];
3285 if (tp) {
3286 driver->termios[index] = NULL;
3287 kfree(tp);
3288 }
3289
3290 retval = tty_cdev_add(driver, devt, index, 1);
3291 if (retval)
3292 goto err_del;
3293 }
3294
3295 dev_set_uevent_suppress(dev, 0);
3296 kobject_uevent(&dev->kobj, KOBJ_ADD);
3297
3298 return dev;
3299
3300err_del:
3301 device_del(dev);
3302err_put:
3303 put_device(dev);
3304
3305 return ERR_PTR(retval);
3306}
3307EXPORT_SYMBOL_GPL(tty_register_device_attr);
3308
3309/**
3310 * tty_unregister_device - unregister a tty device
3311 * @driver: the tty driver that describes the tty device
3312 * @index: the index in the tty driver for this tty device
3313 *
3314 * If a tty device is registered with a call to tty_register_device() then
3315 * this function must be called when the tty device is gone.
3316 *
3317 * Locking: ??
3318 */
3319void tty_unregister_device(struct tty_driver *driver, unsigned index)
3320{
3321 device_destroy(&tty_class, MKDEV(driver->major, driver->minor_start) + index);
3322 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3323 cdev_del(driver->cdevs[index]);
3324 driver->cdevs[index] = NULL;
3325 }
3326}
3327EXPORT_SYMBOL(tty_unregister_device);
3328
3329/**
3330 * __tty_alloc_driver - allocate tty driver
3331 * @lines: count of lines this driver can handle at most
3332 * @owner: module which is responsible for this driver
3333 * @flags: some of %TTY_DRIVER_ flags, will be set in driver->flags
3334 *
3335 * This should not be called directly, some of the provided macros should be
3336 * used instead. Use IS_ERR() and friends on @retval.
3337 */
3338struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3339 unsigned long flags)
3340{
3341 struct tty_driver *driver;
3342 unsigned int cdevs = 1;
3343 int err;
3344
3345 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3346 return ERR_PTR(-EINVAL);
3347
3348 driver = kzalloc(sizeof(*driver), GFP_KERNEL);
3349 if (!driver)
3350 return ERR_PTR(-ENOMEM);
3351
3352 kref_init(&driver->kref);
3353 driver->num = lines;
3354 driver->owner = owner;
3355 driver->flags = flags;
3356
3357 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3358 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3359 GFP_KERNEL);
3360 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3361 GFP_KERNEL);
3362 if (!driver->ttys || !driver->termios) {
3363 err = -ENOMEM;
3364 goto err_free_all;
3365 }
3366 }
3367
3368 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3369 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3370 GFP_KERNEL);
3371 if (!driver->ports) {
3372 err = -ENOMEM;
3373 goto err_free_all;
3374 }
3375 cdevs = lines;
3376 }
3377
3378 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3379 if (!driver->cdevs) {
3380 err = -ENOMEM;
3381 goto err_free_all;
3382 }
3383
3384 return driver;
3385err_free_all:
3386 kfree(driver->ports);
3387 kfree(driver->ttys);
3388 kfree(driver->termios);
3389 kfree(driver->cdevs);
3390 kfree(driver);
3391 return ERR_PTR(err);
3392}
3393EXPORT_SYMBOL(__tty_alloc_driver);
3394
3395static void destruct_tty_driver(struct kref *kref)
3396{
3397 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3398 int i;
3399 struct ktermios *tp;
3400
3401 if (driver->flags & TTY_DRIVER_INSTALLED) {
3402 for (i = 0; i < driver->num; i++) {
3403 tp = driver->termios[i];
3404 if (tp) {
3405 driver->termios[i] = NULL;
3406 kfree(tp);
3407 }
3408 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3409 tty_unregister_device(driver, i);
3410 }
3411 proc_tty_unregister_driver(driver);
3412 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3413 cdev_del(driver->cdevs[0]);
3414 }
3415 kfree(driver->cdevs);
3416 kfree(driver->ports);
3417 kfree(driver->termios);
3418 kfree(driver->ttys);
3419 kfree(driver);
3420}
3421
3422/**
3423 * tty_driver_kref_put - drop a reference to a tty driver
3424 * @driver: driver of which to drop the reference
3425 *
3426 * The final put will destroy and free up the driver.
3427 */
3428void tty_driver_kref_put(struct tty_driver *driver)
3429{
3430 kref_put(&driver->kref, destruct_tty_driver);
3431}
3432EXPORT_SYMBOL(tty_driver_kref_put);
3433
3434/**
3435 * tty_register_driver - register a tty driver
3436 * @driver: driver to register
3437 *
3438 * Called by a tty driver to register itself.
3439 */
3440int tty_register_driver(struct tty_driver *driver)
3441{
3442 int error;
3443 int i;
3444 dev_t dev;
3445 struct device *d;
3446
3447 if (!driver->major) {
3448 error = alloc_chrdev_region(&dev, driver->minor_start,
3449 driver->num, driver->name);
3450 if (!error) {
3451 driver->major = MAJOR(dev);
3452 driver->minor_start = MINOR(dev);
3453 }
3454 } else {
3455 dev = MKDEV(driver->major, driver->minor_start);
3456 error = register_chrdev_region(dev, driver->num, driver->name);
3457 }
3458 if (error < 0)
3459 goto err;
3460
3461 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3462 error = tty_cdev_add(driver, dev, 0, driver->num);
3463 if (error)
3464 goto err_unreg_char;
3465 }
3466
3467 mutex_lock(&tty_mutex);
3468 list_add(&driver->tty_drivers, &tty_drivers);
3469 mutex_unlock(&tty_mutex);
3470
3471 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3472 for (i = 0; i < driver->num; i++) {
3473 d = tty_register_device(driver, i, NULL);
3474 if (IS_ERR(d)) {
3475 error = PTR_ERR(d);
3476 goto err_unreg_devs;
3477 }
3478 }
3479 }
3480 proc_tty_register_driver(driver);
3481 driver->flags |= TTY_DRIVER_INSTALLED;
3482 return 0;
3483
3484err_unreg_devs:
3485 for (i--; i >= 0; i--)
3486 tty_unregister_device(driver, i);
3487
3488 mutex_lock(&tty_mutex);
3489 list_del(&driver->tty_drivers);
3490 mutex_unlock(&tty_mutex);
3491
3492err_unreg_char:
3493 unregister_chrdev_region(dev, driver->num);
3494err:
3495 return error;
3496}
3497EXPORT_SYMBOL(tty_register_driver);
3498
3499/**
3500 * tty_unregister_driver - unregister a tty driver
3501 * @driver: driver to unregister
3502 *
3503 * Called by a tty driver to unregister itself.
3504 */
3505void tty_unregister_driver(struct tty_driver *driver)
3506{
3507 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3508 driver->num);
3509 mutex_lock(&tty_mutex);
3510 list_del(&driver->tty_drivers);
3511 mutex_unlock(&tty_mutex);
3512}
3513EXPORT_SYMBOL(tty_unregister_driver);
3514
3515dev_t tty_devnum(struct tty_struct *tty)
3516{
3517 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3518}
3519EXPORT_SYMBOL(tty_devnum);
3520
3521void tty_default_fops(struct file_operations *fops)
3522{
3523 *fops = tty_fops;
3524}
3525
3526static char *tty_devnode(const struct device *dev, umode_t *mode)
3527{
3528 if (!mode)
3529 return NULL;
3530 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3531 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3532 *mode = 0666;
3533 return NULL;
3534}
3535
3536const struct class tty_class = {
3537 .name = "tty",
3538 .devnode = tty_devnode,
3539};
3540
3541static int __init tty_class_init(void)
3542{
3543 return class_register(&tty_class);
3544}
3545
3546postcore_initcall(tty_class_init);
3547
3548/* 3/2004 jmc: why do these devices exist? */
3549static struct cdev tty_cdev, console_cdev;
3550
3551static ssize_t show_cons_active(struct device *dev,
3552 struct device_attribute *attr, char *buf)
3553{
3554 struct console *cs[16];
3555 int i = 0;
3556 struct console *c;
3557 ssize_t count = 0;
3558
3559 /*
3560 * Hold the console_list_lock to guarantee that no consoles are
3561 * unregistered until all console processing is complete.
3562 * This also allows safe traversal of the console list and
3563 * race-free reading of @flags.
3564 */
3565 console_list_lock();
3566
3567 for_each_console(c) {
3568 if (!c->device)
3569 continue;
3570 if (!c->write)
3571 continue;
3572 if ((c->flags & CON_ENABLED) == 0)
3573 continue;
3574 cs[i++] = c;
3575 if (i >= ARRAY_SIZE(cs))
3576 break;
3577 }
3578
3579 /*
3580 * Take console_lock to serialize device() callback with
3581 * other console operations. For example, fg_console is
3582 * modified under console_lock when switching vt.
3583 */
3584 console_lock();
3585 while (i--) {
3586 int index = cs[i]->index;
3587 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3588
3589 /* don't resolve tty0 as some programs depend on it */
3590 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3591 count += tty_line_name(drv, index, buf + count);
3592 else
3593 count += sprintf(buf + count, "%s%d",
3594 cs[i]->name, cs[i]->index);
3595
3596 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3597 }
3598 console_unlock();
3599
3600 console_list_unlock();
3601
3602 return count;
3603}
3604static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3605
3606static struct attribute *cons_dev_attrs[] = {
3607 &dev_attr_active.attr,
3608 NULL
3609};
3610
3611ATTRIBUTE_GROUPS(cons_dev);
3612
3613static struct device *consdev;
3614
3615void console_sysfs_notify(void)
3616{
3617 if (consdev)
3618 sysfs_notify(&consdev->kobj, NULL, "active");
3619}
3620
3621static struct ctl_table tty_table[] = {
3622 {
3623 .procname = "legacy_tiocsti",
3624 .data = &tty_legacy_tiocsti,
3625 .maxlen = sizeof(tty_legacy_tiocsti),
3626 .mode = 0644,
3627 .proc_handler = proc_dobool,
3628 },
3629 {
3630 .procname = "ldisc_autoload",
3631 .data = &tty_ldisc_autoload,
3632 .maxlen = sizeof(tty_ldisc_autoload),
3633 .mode = 0644,
3634 .proc_handler = proc_dointvec,
3635 .extra1 = SYSCTL_ZERO,
3636 .extra2 = SYSCTL_ONE,
3637 },
3638};
3639
3640/*
3641 * Ok, now we can initialize the rest of the tty devices and can count
3642 * on memory allocations, interrupts etc..
3643 */
3644int __init tty_init(void)
3645{
3646 register_sysctl_init("dev/tty", tty_table);
3647 cdev_init(&tty_cdev, &tty_fops);
3648 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3649 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3650 panic("Couldn't register /dev/tty driver\n");
3651 device_create(&tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3652
3653 cdev_init(&console_cdev, &console_fops);
3654 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3655 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3656 panic("Couldn't register /dev/console driver\n");
3657 consdev = device_create_with_groups(&tty_class, NULL,
3658 MKDEV(TTYAUX_MAJOR, 1), NULL,
3659 cons_dev_groups, "console");
3660 if (IS_ERR(consdev))
3661 consdev = NULL;
3662
3663#ifdef CONFIG_VT
3664 vty_init(&console_fops);
3665#endif
3666 return 0;
3667}
1/*
2 * Copyright (C) 1991, 1992 Linus Torvalds
3 */
4
5/*
6 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7 * or rs-channels. It also implements echoing, cooked mode etc.
8 *
9 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10 *
11 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12 * tty_struct and tty_queue structures. Previously there was an array
13 * of 256 tty_struct's which was statically allocated, and the
14 * tty_queue structures were allocated at boot time. Both are now
15 * dynamically allocated only when the tty is open.
16 *
17 * Also restructured routines so that there is more of a separation
18 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19 * the low-level tty routines (serial.c, pty.c, console.c). This
20 * makes for cleaner and more compact code. -TYT, 9/17/92
21 *
22 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23 * which can be dynamically activated and de-activated by the line
24 * discipline handling modules (like SLIP).
25 *
26 * NOTE: pay no attention to the line discipline code (yet); its
27 * interface is still subject to change in this version...
28 * -- TYT, 1/31/92
29 *
30 * Added functionality to the OPOST tty handling. No delays, but all
31 * other bits should be there.
32 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33 *
34 * Rewrote canonical mode and added more termios flags.
35 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36 *
37 * Reorganized FASYNC support so mouse code can share it.
38 * -- ctm@ardi.com, 9Sep95
39 *
40 * New TIOCLINUX variants added.
41 * -- mj@k332.feld.cvut.cz, 19-Nov-95
42 *
43 * Restrict vt switching via ioctl()
44 * -- grif@cs.ucr.edu, 5-Dec-95
45 *
46 * Move console and virtual terminal code to more appropriate files,
47 * implement CONFIG_VT and generalize console device interface.
48 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49 *
50 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51 * -- Bill Hawes <whawes@star.net>, June 97
52 *
53 * Added devfs support.
54 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55 *
56 * Added support for a Unix98-style ptmx device.
57 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58 *
59 * Reduced memory usage for older ARM systems
60 * -- Russell King <rmk@arm.linux.org.uk>
61 *
62 * Move do_SAK() into process context. Less stack use in devfs functions.
63 * alloc_tty_struct() always uses kmalloc()
64 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65 */
66
67#include <linux/types.h>
68#include <linux/major.h>
69#include <linux/errno.h>
70#include <linux/signal.h>
71#include <linux/fcntl.h>
72#include <linux/sched.h>
73#include <linux/interrupt.h>
74#include <linux/tty.h>
75#include <linux/tty_driver.h>
76#include <linux/tty_flip.h>
77#include <linux/devpts_fs.h>
78#include <linux/file.h>
79#include <linux/fdtable.h>
80#include <linux/console.h>
81#include <linux/timer.h>
82#include <linux/ctype.h>
83#include <linux/kd.h>
84#include <linux/mm.h>
85#include <linux/string.h>
86#include <linux/slab.h>
87#include <linux/poll.h>
88#include <linux/proc_fs.h>
89#include <linux/init.h>
90#include <linux/module.h>
91#include <linux/device.h>
92#include <linux/wait.h>
93#include <linux/bitops.h>
94#include <linux/delay.h>
95#include <linux/seq_file.h>
96#include <linux/serial.h>
97#include <linux/ratelimit.h>
98
99#include <linux/uaccess.h>
100
101#include <linux/kbd_kern.h>
102#include <linux/vt_kern.h>
103#include <linux/selection.h>
104
105#include <linux/kmod.h>
106#include <linux/nsproxy.h>
107
108#undef TTY_DEBUG_HANGUP
109#ifdef TTY_DEBUG_HANGUP
110# define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
111#else
112# define tty_debug_hangup(tty, f, args...) do { } while (0)
113#endif
114
115#define TTY_PARANOIA_CHECK 1
116#define CHECK_TTY_COUNT 1
117
118struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
119 .c_iflag = ICRNL | IXON,
120 .c_oflag = OPOST | ONLCR,
121 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
122 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
123 ECHOCTL | ECHOKE | IEXTEN,
124 .c_cc = INIT_C_CC,
125 .c_ispeed = 38400,
126 .c_ospeed = 38400,
127 /* .c_line = N_TTY, */
128};
129
130EXPORT_SYMBOL(tty_std_termios);
131
132/* This list gets poked at by procfs and various bits of boot up code. This
133 could do with some rationalisation such as pulling the tty proc function
134 into this file */
135
136LIST_HEAD(tty_drivers); /* linked list of tty drivers */
137
138/* Mutex to protect creating and releasing a tty */
139DEFINE_MUTEX(tty_mutex);
140
141static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
142static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
143ssize_t redirected_tty_write(struct file *, const char __user *,
144 size_t, loff_t *);
145static unsigned int tty_poll(struct file *, poll_table *);
146static int tty_open(struct inode *, struct file *);
147long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
148#ifdef CONFIG_COMPAT
149static long tty_compat_ioctl(struct file *file, unsigned int cmd,
150 unsigned long arg);
151#else
152#define tty_compat_ioctl NULL
153#endif
154static int __tty_fasync(int fd, struct file *filp, int on);
155static int tty_fasync(int fd, struct file *filp, int on);
156static void release_tty(struct tty_struct *tty, int idx);
157
158/**
159 * free_tty_struct - free a disused tty
160 * @tty: tty struct to free
161 *
162 * Free the write buffers, tty queue and tty memory itself.
163 *
164 * Locking: none. Must be called after tty is definitely unused
165 */
166
167static void free_tty_struct(struct tty_struct *tty)
168{
169 tty_ldisc_deinit(tty);
170 put_device(tty->dev);
171 kfree(tty->write_buf);
172 tty->magic = 0xDEADDEAD;
173 kfree(tty);
174}
175
176static inline struct tty_struct *file_tty(struct file *file)
177{
178 return ((struct tty_file_private *)file->private_data)->tty;
179}
180
181int tty_alloc_file(struct file *file)
182{
183 struct tty_file_private *priv;
184
185 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
186 if (!priv)
187 return -ENOMEM;
188
189 file->private_data = priv;
190
191 return 0;
192}
193
194/* Associate a new file with the tty structure */
195void tty_add_file(struct tty_struct *tty, struct file *file)
196{
197 struct tty_file_private *priv = file->private_data;
198
199 priv->tty = tty;
200 priv->file = file;
201
202 spin_lock(&tty->files_lock);
203 list_add(&priv->list, &tty->tty_files);
204 spin_unlock(&tty->files_lock);
205}
206
207/**
208 * tty_free_file - free file->private_data
209 *
210 * This shall be used only for fail path handling when tty_add_file was not
211 * called yet.
212 */
213void tty_free_file(struct file *file)
214{
215 struct tty_file_private *priv = file->private_data;
216
217 file->private_data = NULL;
218 kfree(priv);
219}
220
221/* Delete file from its tty */
222static void tty_del_file(struct file *file)
223{
224 struct tty_file_private *priv = file->private_data;
225 struct tty_struct *tty = priv->tty;
226
227 spin_lock(&tty->files_lock);
228 list_del(&priv->list);
229 spin_unlock(&tty->files_lock);
230 tty_free_file(file);
231}
232
233/**
234 * tty_name - return tty naming
235 * @tty: tty structure
236 *
237 * Convert a tty structure into a name. The name reflects the kernel
238 * naming policy and if udev is in use may not reflect user space
239 *
240 * Locking: none
241 */
242
243const char *tty_name(const struct tty_struct *tty)
244{
245 if (!tty) /* Hmm. NULL pointer. That's fun. */
246 return "NULL tty";
247 return tty->name;
248}
249
250EXPORT_SYMBOL(tty_name);
251
252const char *tty_driver_name(const struct tty_struct *tty)
253{
254 if (!tty || !tty->driver)
255 return "";
256 return tty->driver->name;
257}
258
259static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
260 const char *routine)
261{
262#ifdef TTY_PARANOIA_CHECK
263 if (!tty) {
264 pr_warn("(%d:%d): %s: NULL tty\n",
265 imajor(inode), iminor(inode), routine);
266 return 1;
267 }
268 if (tty->magic != TTY_MAGIC) {
269 pr_warn("(%d:%d): %s: bad magic number\n",
270 imajor(inode), iminor(inode), routine);
271 return 1;
272 }
273#endif
274 return 0;
275}
276
277/* Caller must hold tty_lock */
278static int check_tty_count(struct tty_struct *tty, const char *routine)
279{
280#ifdef CHECK_TTY_COUNT
281 struct list_head *p;
282 int count = 0;
283
284 spin_lock(&tty->files_lock);
285 list_for_each(p, &tty->tty_files) {
286 count++;
287 }
288 spin_unlock(&tty->files_lock);
289 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
290 tty->driver->subtype == PTY_TYPE_SLAVE &&
291 tty->link && tty->link->count)
292 count++;
293 if (tty->count != count) {
294 tty_warn(tty, "%s: tty->count(%d) != #fd's(%d)\n",
295 routine, tty->count, count);
296 return count;
297 }
298#endif
299 return 0;
300}
301
302/**
303 * get_tty_driver - find device of a tty
304 * @dev_t: device identifier
305 * @index: returns the index of the tty
306 *
307 * This routine returns a tty driver structure, given a device number
308 * and also passes back the index number.
309 *
310 * Locking: caller must hold tty_mutex
311 */
312
313static struct tty_driver *get_tty_driver(dev_t device, int *index)
314{
315 struct tty_driver *p;
316
317 list_for_each_entry(p, &tty_drivers, tty_drivers) {
318 dev_t base = MKDEV(p->major, p->minor_start);
319 if (device < base || device >= base + p->num)
320 continue;
321 *index = device - base;
322 return tty_driver_kref_get(p);
323 }
324 return NULL;
325}
326
327#ifdef CONFIG_CONSOLE_POLL
328
329/**
330 * tty_find_polling_driver - find device of a polled tty
331 * @name: name string to match
332 * @line: pointer to resulting tty line nr
333 *
334 * This routine returns a tty driver structure, given a name
335 * and the condition that the tty driver is capable of polled
336 * operation.
337 */
338struct tty_driver *tty_find_polling_driver(char *name, int *line)
339{
340 struct tty_driver *p, *res = NULL;
341 int tty_line = 0;
342 int len;
343 char *str, *stp;
344
345 for (str = name; *str; str++)
346 if ((*str >= '0' && *str <= '9') || *str == ',')
347 break;
348 if (!*str)
349 return NULL;
350
351 len = str - name;
352 tty_line = simple_strtoul(str, &str, 10);
353
354 mutex_lock(&tty_mutex);
355 /* Search through the tty devices to look for a match */
356 list_for_each_entry(p, &tty_drivers, tty_drivers) {
357 if (strncmp(name, p->name, len) != 0)
358 continue;
359 stp = str;
360 if (*stp == ',')
361 stp++;
362 if (*stp == '\0')
363 stp = NULL;
364
365 if (tty_line >= 0 && tty_line < p->num && p->ops &&
366 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
367 res = tty_driver_kref_get(p);
368 *line = tty_line;
369 break;
370 }
371 }
372 mutex_unlock(&tty_mutex);
373
374 return res;
375}
376EXPORT_SYMBOL_GPL(tty_find_polling_driver);
377#endif
378
379static int is_ignored(int sig)
380{
381 return (sigismember(¤t->blocked, sig) ||
382 current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
383}
384
385/**
386 * tty_check_change - check for POSIX terminal changes
387 * @tty: tty to check
388 *
389 * If we try to write to, or set the state of, a terminal and we're
390 * not in the foreground, send a SIGTTOU. If the signal is blocked or
391 * ignored, go ahead and perform the operation. (POSIX 7.2)
392 *
393 * Locking: ctrl_lock
394 */
395
396int __tty_check_change(struct tty_struct *tty, int sig)
397{
398 unsigned long flags;
399 struct pid *pgrp, *tty_pgrp;
400 int ret = 0;
401
402 if (current->signal->tty != tty)
403 return 0;
404
405 rcu_read_lock();
406 pgrp = task_pgrp(current);
407
408 spin_lock_irqsave(&tty->ctrl_lock, flags);
409 tty_pgrp = tty->pgrp;
410 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
411
412 if (tty_pgrp && pgrp != tty->pgrp) {
413 if (is_ignored(sig)) {
414 if (sig == SIGTTIN)
415 ret = -EIO;
416 } else if (is_current_pgrp_orphaned())
417 ret = -EIO;
418 else {
419 kill_pgrp(pgrp, sig, 1);
420 set_thread_flag(TIF_SIGPENDING);
421 ret = -ERESTARTSYS;
422 }
423 }
424 rcu_read_unlock();
425
426 if (!tty_pgrp)
427 tty_warn(tty, "sig=%d, tty->pgrp == NULL!\n", sig);
428
429 return ret;
430}
431
432int tty_check_change(struct tty_struct *tty)
433{
434 return __tty_check_change(tty, SIGTTOU);
435}
436EXPORT_SYMBOL(tty_check_change);
437
438static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
439 size_t count, loff_t *ppos)
440{
441 return 0;
442}
443
444static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
445 size_t count, loff_t *ppos)
446{
447 return -EIO;
448}
449
450/* No kernel lock held - none needed ;) */
451static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
452{
453 return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
454}
455
456static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
457 unsigned long arg)
458{
459 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
460}
461
462static long hung_up_tty_compat_ioctl(struct file *file,
463 unsigned int cmd, unsigned long arg)
464{
465 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
466}
467
468static int hung_up_tty_fasync(int fd, struct file *file, int on)
469{
470 return -ENOTTY;
471}
472
473static const struct file_operations tty_fops = {
474 .llseek = no_llseek,
475 .read = tty_read,
476 .write = tty_write,
477 .poll = tty_poll,
478 .unlocked_ioctl = tty_ioctl,
479 .compat_ioctl = tty_compat_ioctl,
480 .open = tty_open,
481 .release = tty_release,
482 .fasync = tty_fasync,
483};
484
485static const struct file_operations console_fops = {
486 .llseek = no_llseek,
487 .read = tty_read,
488 .write = redirected_tty_write,
489 .poll = tty_poll,
490 .unlocked_ioctl = tty_ioctl,
491 .compat_ioctl = tty_compat_ioctl,
492 .open = tty_open,
493 .release = tty_release,
494 .fasync = tty_fasync,
495};
496
497static const struct file_operations hung_up_tty_fops = {
498 .llseek = no_llseek,
499 .read = hung_up_tty_read,
500 .write = hung_up_tty_write,
501 .poll = hung_up_tty_poll,
502 .unlocked_ioctl = hung_up_tty_ioctl,
503 .compat_ioctl = hung_up_tty_compat_ioctl,
504 .release = tty_release,
505 .fasync = hung_up_tty_fasync,
506};
507
508static DEFINE_SPINLOCK(redirect_lock);
509static struct file *redirect;
510
511
512void proc_clear_tty(struct task_struct *p)
513{
514 unsigned long flags;
515 struct tty_struct *tty;
516 spin_lock_irqsave(&p->sighand->siglock, flags);
517 tty = p->signal->tty;
518 p->signal->tty = NULL;
519 spin_unlock_irqrestore(&p->sighand->siglock, flags);
520 tty_kref_put(tty);
521}
522
523/**
524 * proc_set_tty - set the controlling terminal
525 *
526 * Only callable by the session leader and only if it does not already have
527 * a controlling terminal.
528 *
529 * Caller must hold: tty_lock()
530 * a readlock on tasklist_lock
531 * sighand lock
532 */
533static void __proc_set_tty(struct tty_struct *tty)
534{
535 unsigned long flags;
536
537 spin_lock_irqsave(&tty->ctrl_lock, flags);
538 /*
539 * The session and fg pgrp references will be non-NULL if
540 * tiocsctty() is stealing the controlling tty
541 */
542 put_pid(tty->session);
543 put_pid(tty->pgrp);
544 tty->pgrp = get_pid(task_pgrp(current));
545 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
546 tty->session = get_pid(task_session(current));
547 if (current->signal->tty) {
548 tty_debug(tty, "current tty %s not NULL!!\n",
549 current->signal->tty->name);
550 tty_kref_put(current->signal->tty);
551 }
552 put_pid(current->signal->tty_old_pgrp);
553 current->signal->tty = tty_kref_get(tty);
554 current->signal->tty_old_pgrp = NULL;
555}
556
557static void proc_set_tty(struct tty_struct *tty)
558{
559 spin_lock_irq(¤t->sighand->siglock);
560 __proc_set_tty(tty);
561 spin_unlock_irq(¤t->sighand->siglock);
562}
563
564struct tty_struct *get_current_tty(void)
565{
566 struct tty_struct *tty;
567 unsigned long flags;
568
569 spin_lock_irqsave(¤t->sighand->siglock, flags);
570 tty = tty_kref_get(current->signal->tty);
571 spin_unlock_irqrestore(¤t->sighand->siglock, flags);
572 return tty;
573}
574EXPORT_SYMBOL_GPL(get_current_tty);
575
576static void session_clear_tty(struct pid *session)
577{
578 struct task_struct *p;
579 do_each_pid_task(session, PIDTYPE_SID, p) {
580 proc_clear_tty(p);
581 } while_each_pid_task(session, PIDTYPE_SID, p);
582}
583
584/**
585 * tty_wakeup - request more data
586 * @tty: terminal
587 *
588 * Internal and external helper for wakeups of tty. This function
589 * informs the line discipline if present that the driver is ready
590 * to receive more output data.
591 */
592
593void tty_wakeup(struct tty_struct *tty)
594{
595 struct tty_ldisc *ld;
596
597 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
598 ld = tty_ldisc_ref(tty);
599 if (ld) {
600 if (ld->ops->write_wakeup)
601 ld->ops->write_wakeup(tty);
602 tty_ldisc_deref(ld);
603 }
604 }
605 wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
606}
607
608EXPORT_SYMBOL_GPL(tty_wakeup);
609
610/**
611 * tty_signal_session_leader - sends SIGHUP to session leader
612 * @tty controlling tty
613 * @exit_session if non-zero, signal all foreground group processes
614 *
615 * Send SIGHUP and SIGCONT to the session leader and its process group.
616 * Optionally, signal all processes in the foreground process group.
617 *
618 * Returns the number of processes in the session with this tty
619 * as their controlling terminal. This value is used to drop
620 * tty references for those processes.
621 */
622static int tty_signal_session_leader(struct tty_struct *tty, int exit_session)
623{
624 struct task_struct *p;
625 int refs = 0;
626 struct pid *tty_pgrp = NULL;
627
628 read_lock(&tasklist_lock);
629 if (tty->session) {
630 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
631 spin_lock_irq(&p->sighand->siglock);
632 if (p->signal->tty == tty) {
633 p->signal->tty = NULL;
634 /* We defer the dereferences outside fo
635 the tasklist lock */
636 refs++;
637 }
638 if (!p->signal->leader) {
639 spin_unlock_irq(&p->sighand->siglock);
640 continue;
641 }
642 __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
643 __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
644 put_pid(p->signal->tty_old_pgrp); /* A noop */
645 spin_lock(&tty->ctrl_lock);
646 tty_pgrp = get_pid(tty->pgrp);
647 if (tty->pgrp)
648 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
649 spin_unlock(&tty->ctrl_lock);
650 spin_unlock_irq(&p->sighand->siglock);
651 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
652 }
653 read_unlock(&tasklist_lock);
654
655 if (tty_pgrp) {
656 if (exit_session)
657 kill_pgrp(tty_pgrp, SIGHUP, exit_session);
658 put_pid(tty_pgrp);
659 }
660
661 return refs;
662}
663
664/**
665 * __tty_hangup - actual handler for hangup events
666 * @work: tty device
667 *
668 * This can be called by a "kworker" kernel thread. That is process
669 * synchronous but doesn't hold any locks, so we need to make sure we
670 * have the appropriate locks for what we're doing.
671 *
672 * The hangup event clears any pending redirections onto the hung up
673 * device. It ensures future writes will error and it does the needed
674 * line discipline hangup and signal delivery. The tty object itself
675 * remains intact.
676 *
677 * Locking:
678 * BTM
679 * redirect lock for undoing redirection
680 * file list lock for manipulating list of ttys
681 * tty_ldiscs_lock from called functions
682 * termios_rwsem resetting termios data
683 * tasklist_lock to walk task list for hangup event
684 * ->siglock to protect ->signal/->sighand
685 */
686static void __tty_hangup(struct tty_struct *tty, int exit_session)
687{
688 struct file *cons_filp = NULL;
689 struct file *filp, *f = NULL;
690 struct tty_file_private *priv;
691 int closecount = 0, n;
692 int refs;
693
694 if (!tty)
695 return;
696
697
698 spin_lock(&redirect_lock);
699 if (redirect && file_tty(redirect) == tty) {
700 f = redirect;
701 redirect = NULL;
702 }
703 spin_unlock(&redirect_lock);
704
705 tty_lock(tty);
706
707 if (test_bit(TTY_HUPPED, &tty->flags)) {
708 tty_unlock(tty);
709 return;
710 }
711
712 /* inuse_filps is protected by the single tty lock,
713 this really needs to change if we want to flush the
714 workqueue with the lock held */
715 check_tty_count(tty, "tty_hangup");
716
717 spin_lock(&tty->files_lock);
718 /* This breaks for file handles being sent over AF_UNIX sockets ? */
719 list_for_each_entry(priv, &tty->tty_files, list) {
720 filp = priv->file;
721 if (filp->f_op->write == redirected_tty_write)
722 cons_filp = filp;
723 if (filp->f_op->write != tty_write)
724 continue;
725 closecount++;
726 __tty_fasync(-1, filp, 0); /* can't block */
727 filp->f_op = &hung_up_tty_fops;
728 }
729 spin_unlock(&tty->files_lock);
730
731 refs = tty_signal_session_leader(tty, exit_session);
732 /* Account for the p->signal references we killed */
733 while (refs--)
734 tty_kref_put(tty);
735
736 tty_ldisc_hangup(tty, cons_filp != NULL);
737
738 spin_lock_irq(&tty->ctrl_lock);
739 clear_bit(TTY_THROTTLED, &tty->flags);
740 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
741 put_pid(tty->session);
742 put_pid(tty->pgrp);
743 tty->session = NULL;
744 tty->pgrp = NULL;
745 tty->ctrl_status = 0;
746 spin_unlock_irq(&tty->ctrl_lock);
747
748 /*
749 * If one of the devices matches a console pointer, we
750 * cannot just call hangup() because that will cause
751 * tty->count and state->count to go out of sync.
752 * So we just call close() the right number of times.
753 */
754 if (cons_filp) {
755 if (tty->ops->close)
756 for (n = 0; n < closecount; n++)
757 tty->ops->close(tty, cons_filp);
758 } else if (tty->ops->hangup)
759 tty->ops->hangup(tty);
760 /*
761 * We don't want to have driver/ldisc interactions beyond the ones
762 * we did here. The driver layer expects no calls after ->hangup()
763 * from the ldisc side, which is now guaranteed.
764 */
765 set_bit(TTY_HUPPED, &tty->flags);
766 tty_unlock(tty);
767
768 if (f)
769 fput(f);
770}
771
772static void do_tty_hangup(struct work_struct *work)
773{
774 struct tty_struct *tty =
775 container_of(work, struct tty_struct, hangup_work);
776
777 __tty_hangup(tty, 0);
778}
779
780/**
781 * tty_hangup - trigger a hangup event
782 * @tty: tty to hangup
783 *
784 * A carrier loss (virtual or otherwise) has occurred on this like
785 * schedule a hangup sequence to run after this event.
786 */
787
788void tty_hangup(struct tty_struct *tty)
789{
790 tty_debug_hangup(tty, "hangup\n");
791 schedule_work(&tty->hangup_work);
792}
793
794EXPORT_SYMBOL(tty_hangup);
795
796/**
797 * tty_vhangup - process vhangup
798 * @tty: tty to hangup
799 *
800 * The user has asked via system call for the terminal to be hung up.
801 * We do this synchronously so that when the syscall returns the process
802 * is complete. That guarantee is necessary for security reasons.
803 */
804
805void tty_vhangup(struct tty_struct *tty)
806{
807 tty_debug_hangup(tty, "vhangup\n");
808 __tty_hangup(tty, 0);
809}
810
811EXPORT_SYMBOL(tty_vhangup);
812
813
814/**
815 * tty_vhangup_self - process vhangup for own ctty
816 *
817 * Perform a vhangup on the current controlling tty
818 */
819
820void tty_vhangup_self(void)
821{
822 struct tty_struct *tty;
823
824 tty = get_current_tty();
825 if (tty) {
826 tty_vhangup(tty);
827 tty_kref_put(tty);
828 }
829}
830
831/**
832 * tty_vhangup_session - hangup session leader exit
833 * @tty: tty to hangup
834 *
835 * The session leader is exiting and hanging up its controlling terminal.
836 * Every process in the foreground process group is signalled SIGHUP.
837 *
838 * We do this synchronously so that when the syscall returns the process
839 * is complete. That guarantee is necessary for security reasons.
840 */
841
842static void tty_vhangup_session(struct tty_struct *tty)
843{
844 tty_debug_hangup(tty, "session hangup\n");
845 __tty_hangup(tty, 1);
846}
847
848/**
849 * tty_hung_up_p - was tty hung up
850 * @filp: file pointer of tty
851 *
852 * Return true if the tty has been subject to a vhangup or a carrier
853 * loss
854 */
855
856int tty_hung_up_p(struct file *filp)
857{
858 return (filp->f_op == &hung_up_tty_fops);
859}
860
861EXPORT_SYMBOL(tty_hung_up_p);
862
863/**
864 * disassociate_ctty - disconnect controlling tty
865 * @on_exit: true if exiting so need to "hang up" the session
866 *
867 * This function is typically called only by the session leader, when
868 * it wants to disassociate itself from its controlling tty.
869 *
870 * It performs the following functions:
871 * (1) Sends a SIGHUP and SIGCONT to the foreground process group
872 * (2) Clears the tty from being controlling the session
873 * (3) Clears the controlling tty for all processes in the
874 * session group.
875 *
876 * The argument on_exit is set to 1 if called when a process is
877 * exiting; it is 0 if called by the ioctl TIOCNOTTY.
878 *
879 * Locking:
880 * BTM is taken for hysterical raisins, and held when
881 * called from no_tty().
882 * tty_mutex is taken to protect tty
883 * ->siglock is taken to protect ->signal/->sighand
884 * tasklist_lock is taken to walk process list for sessions
885 * ->siglock is taken to protect ->signal/->sighand
886 */
887
888void disassociate_ctty(int on_exit)
889{
890 struct tty_struct *tty;
891
892 if (!current->signal->leader)
893 return;
894
895 tty = get_current_tty();
896 if (tty) {
897 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY) {
898 tty_vhangup_session(tty);
899 } else {
900 struct pid *tty_pgrp = tty_get_pgrp(tty);
901 if (tty_pgrp) {
902 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
903 if (!on_exit)
904 kill_pgrp(tty_pgrp, SIGCONT, on_exit);
905 put_pid(tty_pgrp);
906 }
907 }
908 tty_kref_put(tty);
909
910 } else if (on_exit) {
911 struct pid *old_pgrp;
912 spin_lock_irq(¤t->sighand->siglock);
913 old_pgrp = current->signal->tty_old_pgrp;
914 current->signal->tty_old_pgrp = NULL;
915 spin_unlock_irq(¤t->sighand->siglock);
916 if (old_pgrp) {
917 kill_pgrp(old_pgrp, SIGHUP, on_exit);
918 kill_pgrp(old_pgrp, SIGCONT, on_exit);
919 put_pid(old_pgrp);
920 }
921 return;
922 }
923
924 spin_lock_irq(¤t->sighand->siglock);
925 put_pid(current->signal->tty_old_pgrp);
926 current->signal->tty_old_pgrp = NULL;
927
928 tty = tty_kref_get(current->signal->tty);
929 if (tty) {
930 unsigned long flags;
931 spin_lock_irqsave(&tty->ctrl_lock, flags);
932 put_pid(tty->session);
933 put_pid(tty->pgrp);
934 tty->session = NULL;
935 tty->pgrp = NULL;
936 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
937 tty_kref_put(tty);
938 } else
939 tty_debug_hangup(tty, "no current tty\n");
940
941 spin_unlock_irq(¤t->sighand->siglock);
942 /* Now clear signal->tty under the lock */
943 read_lock(&tasklist_lock);
944 session_clear_tty(task_session(current));
945 read_unlock(&tasklist_lock);
946}
947
948/**
949 *
950 * no_tty - Ensure the current process does not have a controlling tty
951 */
952void no_tty(void)
953{
954 /* FIXME: Review locking here. The tty_lock never covered any race
955 between a new association and proc_clear_tty but possible we need
956 to protect against this anyway */
957 struct task_struct *tsk = current;
958 disassociate_ctty(0);
959 proc_clear_tty(tsk);
960}
961
962
963/**
964 * stop_tty - propagate flow control
965 * @tty: tty to stop
966 *
967 * Perform flow control to the driver. May be called
968 * on an already stopped device and will not re-call the driver
969 * method.
970 *
971 * This functionality is used by both the line disciplines for
972 * halting incoming flow and by the driver. It may therefore be
973 * called from any context, may be under the tty atomic_write_lock
974 * but not always.
975 *
976 * Locking:
977 * flow_lock
978 */
979
980void __stop_tty(struct tty_struct *tty)
981{
982 if (tty->stopped)
983 return;
984 tty->stopped = 1;
985 if (tty->ops->stop)
986 tty->ops->stop(tty);
987}
988
989void stop_tty(struct tty_struct *tty)
990{
991 unsigned long flags;
992
993 spin_lock_irqsave(&tty->flow_lock, flags);
994 __stop_tty(tty);
995 spin_unlock_irqrestore(&tty->flow_lock, flags);
996}
997EXPORT_SYMBOL(stop_tty);
998
999/**
1000 * start_tty - propagate flow control
1001 * @tty: tty to start
1002 *
1003 * Start a tty that has been stopped if at all possible. If this
1004 * tty was previous stopped and is now being started, the driver
1005 * start method is invoked and the line discipline woken.
1006 *
1007 * Locking:
1008 * flow_lock
1009 */
1010
1011void __start_tty(struct tty_struct *tty)
1012{
1013 if (!tty->stopped || tty->flow_stopped)
1014 return;
1015 tty->stopped = 0;
1016 if (tty->ops->start)
1017 tty->ops->start(tty);
1018 tty_wakeup(tty);
1019}
1020
1021void start_tty(struct tty_struct *tty)
1022{
1023 unsigned long flags;
1024
1025 spin_lock_irqsave(&tty->flow_lock, flags);
1026 __start_tty(tty);
1027 spin_unlock_irqrestore(&tty->flow_lock, flags);
1028}
1029EXPORT_SYMBOL(start_tty);
1030
1031static void tty_update_time(struct timespec *time)
1032{
1033 unsigned long sec = get_seconds();
1034
1035 /*
1036 * We only care if the two values differ in anything other than the
1037 * lower three bits (i.e every 8 seconds). If so, then we can update
1038 * the time of the tty device, otherwise it could be construded as a
1039 * security leak to let userspace know the exact timing of the tty.
1040 */
1041 if ((sec ^ time->tv_sec) & ~7)
1042 time->tv_sec = sec;
1043}
1044
1045/**
1046 * tty_read - read method for tty device files
1047 * @file: pointer to tty file
1048 * @buf: user buffer
1049 * @count: size of user buffer
1050 * @ppos: unused
1051 *
1052 * Perform the read system call function on this terminal device. Checks
1053 * for hung up devices before calling the line discipline method.
1054 *
1055 * Locking:
1056 * Locks the line discipline internally while needed. Multiple
1057 * read calls may be outstanding in parallel.
1058 */
1059
1060static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
1061 loff_t *ppos)
1062{
1063 int i;
1064 struct inode *inode = file_inode(file);
1065 struct tty_struct *tty = file_tty(file);
1066 struct tty_ldisc *ld;
1067
1068 if (tty_paranoia_check(tty, inode, "tty_read"))
1069 return -EIO;
1070 if (!tty || tty_io_error(tty))
1071 return -EIO;
1072
1073 /* We want to wait for the line discipline to sort out in this
1074 situation */
1075 ld = tty_ldisc_ref_wait(tty);
1076 if (!ld)
1077 return hung_up_tty_read(file, buf, count, ppos);
1078 if (ld->ops->read)
1079 i = ld->ops->read(tty, file, buf, count);
1080 else
1081 i = -EIO;
1082 tty_ldisc_deref(ld);
1083
1084 if (i > 0)
1085 tty_update_time(&inode->i_atime);
1086
1087 return i;
1088}
1089
1090static void tty_write_unlock(struct tty_struct *tty)
1091{
1092 mutex_unlock(&tty->atomic_write_lock);
1093 wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
1094}
1095
1096static int tty_write_lock(struct tty_struct *tty, int ndelay)
1097{
1098 if (!mutex_trylock(&tty->atomic_write_lock)) {
1099 if (ndelay)
1100 return -EAGAIN;
1101 if (mutex_lock_interruptible(&tty->atomic_write_lock))
1102 return -ERESTARTSYS;
1103 }
1104 return 0;
1105}
1106
1107/*
1108 * Split writes up in sane blocksizes to avoid
1109 * denial-of-service type attacks
1110 */
1111static inline ssize_t do_tty_write(
1112 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1113 struct tty_struct *tty,
1114 struct file *file,
1115 const char __user *buf,
1116 size_t count)
1117{
1118 ssize_t ret, written = 0;
1119 unsigned int chunk;
1120
1121 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1122 if (ret < 0)
1123 return ret;
1124
1125 /*
1126 * We chunk up writes into a temporary buffer. This
1127 * simplifies low-level drivers immensely, since they
1128 * don't have locking issues and user mode accesses.
1129 *
1130 * But if TTY_NO_WRITE_SPLIT is set, we should use a
1131 * big chunk-size..
1132 *
1133 * The default chunk-size is 2kB, because the NTTY
1134 * layer has problems with bigger chunks. It will
1135 * claim to be able to handle more characters than
1136 * it actually does.
1137 *
1138 * FIXME: This can probably go away now except that 64K chunks
1139 * are too likely to fail unless switched to vmalloc...
1140 */
1141 chunk = 2048;
1142 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1143 chunk = 65536;
1144 if (count < chunk)
1145 chunk = count;
1146
1147 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1148 if (tty->write_cnt < chunk) {
1149 unsigned char *buf_chunk;
1150
1151 if (chunk < 1024)
1152 chunk = 1024;
1153
1154 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1155 if (!buf_chunk) {
1156 ret = -ENOMEM;
1157 goto out;
1158 }
1159 kfree(tty->write_buf);
1160 tty->write_cnt = chunk;
1161 tty->write_buf = buf_chunk;
1162 }
1163
1164 /* Do the write .. */
1165 for (;;) {
1166 size_t size = count;
1167 if (size > chunk)
1168 size = chunk;
1169 ret = -EFAULT;
1170 if (copy_from_user(tty->write_buf, buf, size))
1171 break;
1172 ret = write(tty, file, tty->write_buf, size);
1173 if (ret <= 0)
1174 break;
1175 written += ret;
1176 buf += ret;
1177 count -= ret;
1178 if (!count)
1179 break;
1180 ret = -ERESTARTSYS;
1181 if (signal_pending(current))
1182 break;
1183 cond_resched();
1184 }
1185 if (written) {
1186 tty_update_time(&file_inode(file)->i_mtime);
1187 ret = written;
1188 }
1189out:
1190 tty_write_unlock(tty);
1191 return ret;
1192}
1193
1194/**
1195 * tty_write_message - write a message to a certain tty, not just the console.
1196 * @tty: the destination tty_struct
1197 * @msg: the message to write
1198 *
1199 * This is used for messages that need to be redirected to a specific tty.
1200 * We don't put it into the syslog queue right now maybe in the future if
1201 * really needed.
1202 *
1203 * We must still hold the BTM and test the CLOSING flag for the moment.
1204 */
1205
1206void tty_write_message(struct tty_struct *tty, char *msg)
1207{
1208 if (tty) {
1209 mutex_lock(&tty->atomic_write_lock);
1210 tty_lock(tty);
1211 if (tty->ops->write && tty->count > 0)
1212 tty->ops->write(tty, msg, strlen(msg));
1213 tty_unlock(tty);
1214 tty_write_unlock(tty);
1215 }
1216 return;
1217}
1218
1219
1220/**
1221 * tty_write - write method for tty device file
1222 * @file: tty file pointer
1223 * @buf: user data to write
1224 * @count: bytes to write
1225 * @ppos: unused
1226 *
1227 * Write data to a tty device via the line discipline.
1228 *
1229 * Locking:
1230 * Locks the line discipline as required
1231 * Writes to the tty driver are serialized by the atomic_write_lock
1232 * and are then processed in chunks to the device. The line discipline
1233 * write method will not be invoked in parallel for each device.
1234 */
1235
1236static ssize_t tty_write(struct file *file, const char __user *buf,
1237 size_t count, loff_t *ppos)
1238{
1239 struct tty_struct *tty = file_tty(file);
1240 struct tty_ldisc *ld;
1241 ssize_t ret;
1242
1243 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1244 return -EIO;
1245 if (!tty || !tty->ops->write || tty_io_error(tty))
1246 return -EIO;
1247 /* Short term debug to catch buggy drivers */
1248 if (tty->ops->write_room == NULL)
1249 tty_err(tty, "missing write_room method\n");
1250 ld = tty_ldisc_ref_wait(tty);
1251 if (!ld)
1252 return hung_up_tty_write(file, buf, count, ppos);
1253 if (!ld->ops->write)
1254 ret = -EIO;
1255 else
1256 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1257 tty_ldisc_deref(ld);
1258 return ret;
1259}
1260
1261ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1262 size_t count, loff_t *ppos)
1263{
1264 struct file *p = NULL;
1265
1266 spin_lock(&redirect_lock);
1267 if (redirect)
1268 p = get_file(redirect);
1269 spin_unlock(&redirect_lock);
1270
1271 if (p) {
1272 ssize_t res;
1273 res = vfs_write(p, buf, count, &p->f_pos);
1274 fput(p);
1275 return res;
1276 }
1277 return tty_write(file, buf, count, ppos);
1278}
1279
1280/**
1281 * tty_send_xchar - send priority character
1282 *
1283 * Send a high priority character to the tty even if stopped
1284 *
1285 * Locking: none for xchar method, write ordering for write method.
1286 */
1287
1288int tty_send_xchar(struct tty_struct *tty, char ch)
1289{
1290 int was_stopped = tty->stopped;
1291
1292 if (tty->ops->send_xchar) {
1293 down_read(&tty->termios_rwsem);
1294 tty->ops->send_xchar(tty, ch);
1295 up_read(&tty->termios_rwsem);
1296 return 0;
1297 }
1298
1299 if (tty_write_lock(tty, 0) < 0)
1300 return -ERESTARTSYS;
1301
1302 down_read(&tty->termios_rwsem);
1303 if (was_stopped)
1304 start_tty(tty);
1305 tty->ops->write(tty, &ch, 1);
1306 if (was_stopped)
1307 stop_tty(tty);
1308 up_read(&tty->termios_rwsem);
1309 tty_write_unlock(tty);
1310 return 0;
1311}
1312
1313static char ptychar[] = "pqrstuvwxyzabcde";
1314
1315/**
1316 * pty_line_name - generate name for a pty
1317 * @driver: the tty driver in use
1318 * @index: the minor number
1319 * @p: output buffer of at least 6 bytes
1320 *
1321 * Generate a name from a driver reference and write it to the output
1322 * buffer.
1323 *
1324 * Locking: None
1325 */
1326static void pty_line_name(struct tty_driver *driver, int index, char *p)
1327{
1328 int i = index + driver->name_base;
1329 /* ->name is initialized to "ttyp", but "tty" is expected */
1330 sprintf(p, "%s%c%x",
1331 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1332 ptychar[i >> 4 & 0xf], i & 0xf);
1333}
1334
1335/**
1336 * tty_line_name - generate name for a tty
1337 * @driver: the tty driver in use
1338 * @index: the minor number
1339 * @p: output buffer of at least 7 bytes
1340 *
1341 * Generate a name from a driver reference and write it to the output
1342 * buffer.
1343 *
1344 * Locking: None
1345 */
1346static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1347{
1348 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1349 return sprintf(p, "%s", driver->name);
1350 else
1351 return sprintf(p, "%s%d", driver->name,
1352 index + driver->name_base);
1353}
1354
1355/**
1356 * tty_driver_lookup_tty() - find an existing tty, if any
1357 * @driver: the driver for the tty
1358 * @idx: the minor number
1359 *
1360 * Return the tty, if found. If not found, return NULL or ERR_PTR() if the
1361 * driver lookup() method returns an error.
1362 *
1363 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1364 */
1365static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1366 struct file *file, int idx)
1367{
1368 struct tty_struct *tty;
1369
1370 if (driver->ops->lookup)
1371 tty = driver->ops->lookup(driver, file, idx);
1372 else
1373 tty = driver->ttys[idx];
1374
1375 if (!IS_ERR(tty))
1376 tty_kref_get(tty);
1377 return tty;
1378}
1379
1380/**
1381 * tty_init_termios - helper for termios setup
1382 * @tty: the tty to set up
1383 *
1384 * Initialise the termios structures for this tty. Thus runs under
1385 * the tty_mutex currently so we can be relaxed about ordering.
1386 */
1387
1388void tty_init_termios(struct tty_struct *tty)
1389{
1390 struct ktermios *tp;
1391 int idx = tty->index;
1392
1393 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1394 tty->termios = tty->driver->init_termios;
1395 else {
1396 /* Check for lazy saved data */
1397 tp = tty->driver->termios[idx];
1398 if (tp != NULL) {
1399 tty->termios = *tp;
1400 tty->termios.c_line = tty->driver->init_termios.c_line;
1401 } else
1402 tty->termios = tty->driver->init_termios;
1403 }
1404 /* Compatibility until drivers always set this */
1405 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1406 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1407}
1408EXPORT_SYMBOL_GPL(tty_init_termios);
1409
1410int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1411{
1412 tty_init_termios(tty);
1413 tty_driver_kref_get(driver);
1414 tty->count++;
1415 driver->ttys[tty->index] = tty;
1416 return 0;
1417}
1418EXPORT_SYMBOL_GPL(tty_standard_install);
1419
1420/**
1421 * tty_driver_install_tty() - install a tty entry in the driver
1422 * @driver: the driver for the tty
1423 * @tty: the tty
1424 *
1425 * Install a tty object into the driver tables. The tty->index field
1426 * will be set by the time this is called. This method is responsible
1427 * for ensuring any need additional structures are allocated and
1428 * configured.
1429 *
1430 * Locking: tty_mutex for now
1431 */
1432static int tty_driver_install_tty(struct tty_driver *driver,
1433 struct tty_struct *tty)
1434{
1435 return driver->ops->install ? driver->ops->install(driver, tty) :
1436 tty_standard_install(driver, tty);
1437}
1438
1439/**
1440 * tty_driver_remove_tty() - remove a tty from the driver tables
1441 * @driver: the driver for the tty
1442 * @idx: the minor number
1443 *
1444 * Remvoe a tty object from the driver tables. The tty->index field
1445 * will be set by the time this is called.
1446 *
1447 * Locking: tty_mutex for now
1448 */
1449static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1450{
1451 if (driver->ops->remove)
1452 driver->ops->remove(driver, tty);
1453 else
1454 driver->ttys[tty->index] = NULL;
1455}
1456
1457/*
1458 * tty_reopen() - fast re-open of an open tty
1459 * @tty - the tty to open
1460 *
1461 * Return 0 on success, -errno on error.
1462 * Re-opens on master ptys are not allowed and return -EIO.
1463 *
1464 * Locking: Caller must hold tty_lock
1465 */
1466static int tty_reopen(struct tty_struct *tty)
1467{
1468 struct tty_driver *driver = tty->driver;
1469
1470 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1471 driver->subtype == PTY_TYPE_MASTER)
1472 return -EIO;
1473
1474 if (!tty->count)
1475 return -EAGAIN;
1476
1477 if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1478 return -EBUSY;
1479
1480 tty->count++;
1481
1482 if (!tty->ldisc)
1483 return tty_ldisc_reinit(tty, tty->termios.c_line);
1484
1485 return 0;
1486}
1487
1488/**
1489 * tty_init_dev - initialise a tty device
1490 * @driver: tty driver we are opening a device on
1491 * @idx: device index
1492 * @ret_tty: returned tty structure
1493 *
1494 * Prepare a tty device. This may not be a "new" clean device but
1495 * could also be an active device. The pty drivers require special
1496 * handling because of this.
1497 *
1498 * Locking:
1499 * The function is called under the tty_mutex, which
1500 * protects us from the tty struct or driver itself going away.
1501 *
1502 * On exit the tty device has the line discipline attached and
1503 * a reference count of 1. If a pair was created for pty/tty use
1504 * and the other was a pty master then it too has a reference count of 1.
1505 *
1506 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1507 * failed open. The new code protects the open with a mutex, so it's
1508 * really quite straightforward. The mutex locking can probably be
1509 * relaxed for the (most common) case of reopening a tty.
1510 */
1511
1512struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1513{
1514 struct tty_struct *tty;
1515 int retval;
1516
1517 /*
1518 * First time open is complex, especially for PTY devices.
1519 * This code guarantees that either everything succeeds and the
1520 * TTY is ready for operation, or else the table slots are vacated
1521 * and the allocated memory released. (Except that the termios
1522 * and locked termios may be retained.)
1523 */
1524
1525 if (!try_module_get(driver->owner))
1526 return ERR_PTR(-ENODEV);
1527
1528 tty = alloc_tty_struct(driver, idx);
1529 if (!tty) {
1530 retval = -ENOMEM;
1531 goto err_module_put;
1532 }
1533
1534 tty_lock(tty);
1535 retval = tty_driver_install_tty(driver, tty);
1536 if (retval < 0)
1537 goto err_free_tty;
1538
1539 if (!tty->port)
1540 tty->port = driver->ports[idx];
1541
1542 WARN_RATELIMIT(!tty->port,
1543 "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1544 __func__, tty->driver->name);
1545
1546 tty->port->itty = tty;
1547
1548 /*
1549 * Structures all installed ... call the ldisc open routines.
1550 * If we fail here just call release_tty to clean up. No need
1551 * to decrement the use counts, as release_tty doesn't care.
1552 */
1553 retval = tty_ldisc_setup(tty, tty->link);
1554 if (retval)
1555 goto err_release_tty;
1556 /* Return the tty locked so that it cannot vanish under the caller */
1557 return tty;
1558
1559err_free_tty:
1560 tty_unlock(tty);
1561 free_tty_struct(tty);
1562err_module_put:
1563 module_put(driver->owner);
1564 return ERR_PTR(retval);
1565
1566 /* call the tty release_tty routine to clean out this slot */
1567err_release_tty:
1568 tty_unlock(tty);
1569 tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1570 retval, idx);
1571 release_tty(tty, idx);
1572 return ERR_PTR(retval);
1573}
1574
1575static void tty_free_termios(struct tty_struct *tty)
1576{
1577 struct ktermios *tp;
1578 int idx = tty->index;
1579
1580 /* If the port is going to reset then it has no termios to save */
1581 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1582 return;
1583
1584 /* Stash the termios data */
1585 tp = tty->driver->termios[idx];
1586 if (tp == NULL) {
1587 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1588 if (tp == NULL)
1589 return;
1590 tty->driver->termios[idx] = tp;
1591 }
1592 *tp = tty->termios;
1593}
1594
1595/**
1596 * tty_flush_works - flush all works of a tty/pty pair
1597 * @tty: tty device to flush works for (or either end of a pty pair)
1598 *
1599 * Sync flush all works belonging to @tty (and the 'other' tty).
1600 */
1601static void tty_flush_works(struct tty_struct *tty)
1602{
1603 flush_work(&tty->SAK_work);
1604 flush_work(&tty->hangup_work);
1605 if (tty->link) {
1606 flush_work(&tty->link->SAK_work);
1607 flush_work(&tty->link->hangup_work);
1608 }
1609}
1610
1611/**
1612 * release_one_tty - release tty structure memory
1613 * @kref: kref of tty we are obliterating
1614 *
1615 * Releases memory associated with a tty structure, and clears out the
1616 * driver table slots. This function is called when a device is no longer
1617 * in use. It also gets called when setup of a device fails.
1618 *
1619 * Locking:
1620 * takes the file list lock internally when working on the list
1621 * of ttys that the driver keeps.
1622 *
1623 * This method gets called from a work queue so that the driver private
1624 * cleanup ops can sleep (needed for USB at least)
1625 */
1626static void release_one_tty(struct work_struct *work)
1627{
1628 struct tty_struct *tty =
1629 container_of(work, struct tty_struct, hangup_work);
1630 struct tty_driver *driver = tty->driver;
1631 struct module *owner = driver->owner;
1632
1633 if (tty->ops->cleanup)
1634 tty->ops->cleanup(tty);
1635
1636 tty->magic = 0;
1637 tty_driver_kref_put(driver);
1638 module_put(owner);
1639
1640 spin_lock(&tty->files_lock);
1641 list_del_init(&tty->tty_files);
1642 spin_unlock(&tty->files_lock);
1643
1644 put_pid(tty->pgrp);
1645 put_pid(tty->session);
1646 free_tty_struct(tty);
1647}
1648
1649static void queue_release_one_tty(struct kref *kref)
1650{
1651 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1652
1653 /* The hangup queue is now free so we can reuse it rather than
1654 waste a chunk of memory for each port */
1655 INIT_WORK(&tty->hangup_work, release_one_tty);
1656 schedule_work(&tty->hangup_work);
1657}
1658
1659/**
1660 * tty_kref_put - release a tty kref
1661 * @tty: tty device
1662 *
1663 * Release a reference to a tty device and if need be let the kref
1664 * layer destruct the object for us
1665 */
1666
1667void tty_kref_put(struct tty_struct *tty)
1668{
1669 if (tty)
1670 kref_put(&tty->kref, queue_release_one_tty);
1671}
1672EXPORT_SYMBOL(tty_kref_put);
1673
1674/**
1675 * release_tty - release tty structure memory
1676 *
1677 * Release both @tty and a possible linked partner (think pty pair),
1678 * and decrement the refcount of the backing module.
1679 *
1680 * Locking:
1681 * tty_mutex
1682 * takes the file list lock internally when working on the list
1683 * of ttys that the driver keeps.
1684 *
1685 */
1686static void release_tty(struct tty_struct *tty, int idx)
1687{
1688 /* This should always be true but check for the moment */
1689 WARN_ON(tty->index != idx);
1690 WARN_ON(!mutex_is_locked(&tty_mutex));
1691 if (tty->ops->shutdown)
1692 tty->ops->shutdown(tty);
1693 tty_free_termios(tty);
1694 tty_driver_remove_tty(tty->driver, tty);
1695 tty->port->itty = NULL;
1696 if (tty->link)
1697 tty->link->port->itty = NULL;
1698 tty_buffer_cancel_work(tty->port);
1699
1700 tty_kref_put(tty->link);
1701 tty_kref_put(tty);
1702}
1703
1704/**
1705 * tty_release_checks - check a tty before real release
1706 * @tty: tty to check
1707 * @o_tty: link of @tty (if any)
1708 * @idx: index of the tty
1709 *
1710 * Performs some paranoid checking before true release of the @tty.
1711 * This is a no-op unless TTY_PARANOIA_CHECK is defined.
1712 */
1713static int tty_release_checks(struct tty_struct *tty, int idx)
1714{
1715#ifdef TTY_PARANOIA_CHECK
1716 if (idx < 0 || idx >= tty->driver->num) {
1717 tty_debug(tty, "bad idx %d\n", idx);
1718 return -1;
1719 }
1720
1721 /* not much to check for devpts */
1722 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1723 return 0;
1724
1725 if (tty != tty->driver->ttys[idx]) {
1726 tty_debug(tty, "bad driver table[%d] = %p\n",
1727 idx, tty->driver->ttys[idx]);
1728 return -1;
1729 }
1730 if (tty->driver->other) {
1731 struct tty_struct *o_tty = tty->link;
1732
1733 if (o_tty != tty->driver->other->ttys[idx]) {
1734 tty_debug(tty, "bad other table[%d] = %p\n",
1735 idx, tty->driver->other->ttys[idx]);
1736 return -1;
1737 }
1738 if (o_tty->link != tty) {
1739 tty_debug(tty, "bad link = %p\n", o_tty->link);
1740 return -1;
1741 }
1742 }
1743#endif
1744 return 0;
1745}
1746
1747/**
1748 * tty_release - vfs callback for close
1749 * @inode: inode of tty
1750 * @filp: file pointer for handle to tty
1751 *
1752 * Called the last time each file handle is closed that references
1753 * this tty. There may however be several such references.
1754 *
1755 * Locking:
1756 * Takes bkl. See tty_release_dev
1757 *
1758 * Even releasing the tty structures is a tricky business.. We have
1759 * to be very careful that the structures are all released at the
1760 * same time, as interrupts might otherwise get the wrong pointers.
1761 *
1762 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1763 * lead to double frees or releasing memory still in use.
1764 */
1765
1766int tty_release(struct inode *inode, struct file *filp)
1767{
1768 struct tty_struct *tty = file_tty(filp);
1769 struct tty_struct *o_tty = NULL;
1770 int do_sleep, final;
1771 int idx;
1772 long timeout = 0;
1773 int once = 1;
1774
1775 if (tty_paranoia_check(tty, inode, __func__))
1776 return 0;
1777
1778 tty_lock(tty);
1779 check_tty_count(tty, __func__);
1780
1781 __tty_fasync(-1, filp, 0);
1782
1783 idx = tty->index;
1784 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1785 tty->driver->subtype == PTY_TYPE_MASTER)
1786 o_tty = tty->link;
1787
1788 if (tty_release_checks(tty, idx)) {
1789 tty_unlock(tty);
1790 return 0;
1791 }
1792
1793 tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1794
1795 if (tty->ops->close)
1796 tty->ops->close(tty, filp);
1797
1798 /* If tty is pty master, lock the slave pty (stable lock order) */
1799 tty_lock_slave(o_tty);
1800
1801 /*
1802 * Sanity check: if tty->count is going to zero, there shouldn't be
1803 * any waiters on tty->read_wait or tty->write_wait. We test the
1804 * wait queues and kick everyone out _before_ actually starting to
1805 * close. This ensures that we won't block while releasing the tty
1806 * structure.
1807 *
1808 * The test for the o_tty closing is necessary, since the master and
1809 * slave sides may close in any order. If the slave side closes out
1810 * first, its count will be one, since the master side holds an open.
1811 * Thus this test wouldn't be triggered at the time the slave closed,
1812 * so we do it now.
1813 */
1814 while (1) {
1815 do_sleep = 0;
1816
1817 if (tty->count <= 1) {
1818 if (waitqueue_active(&tty->read_wait)) {
1819 wake_up_poll(&tty->read_wait, POLLIN);
1820 do_sleep++;
1821 }
1822 if (waitqueue_active(&tty->write_wait)) {
1823 wake_up_poll(&tty->write_wait, POLLOUT);
1824 do_sleep++;
1825 }
1826 }
1827 if (o_tty && o_tty->count <= 1) {
1828 if (waitqueue_active(&o_tty->read_wait)) {
1829 wake_up_poll(&o_tty->read_wait, POLLIN);
1830 do_sleep++;
1831 }
1832 if (waitqueue_active(&o_tty->write_wait)) {
1833 wake_up_poll(&o_tty->write_wait, POLLOUT);
1834 do_sleep++;
1835 }
1836 }
1837 if (!do_sleep)
1838 break;
1839
1840 if (once) {
1841 once = 0;
1842 tty_warn(tty, "read/write wait queue active!\n");
1843 }
1844 schedule_timeout_killable(timeout);
1845 if (timeout < 120 * HZ)
1846 timeout = 2 * timeout + 1;
1847 else
1848 timeout = MAX_SCHEDULE_TIMEOUT;
1849 }
1850
1851 if (o_tty) {
1852 if (--o_tty->count < 0) {
1853 tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1854 o_tty->count = 0;
1855 }
1856 }
1857 if (--tty->count < 0) {
1858 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1859 tty->count = 0;
1860 }
1861
1862 /*
1863 * We've decremented tty->count, so we need to remove this file
1864 * descriptor off the tty->tty_files list; this serves two
1865 * purposes:
1866 * - check_tty_count sees the correct number of file descriptors
1867 * associated with this tty.
1868 * - do_tty_hangup no longer sees this file descriptor as
1869 * something that needs to be handled for hangups.
1870 */
1871 tty_del_file(filp);
1872
1873 /*
1874 * Perform some housekeeping before deciding whether to return.
1875 *
1876 * If _either_ side is closing, make sure there aren't any
1877 * processes that still think tty or o_tty is their controlling
1878 * tty.
1879 */
1880 if (!tty->count) {
1881 read_lock(&tasklist_lock);
1882 session_clear_tty(tty->session);
1883 if (o_tty)
1884 session_clear_tty(o_tty->session);
1885 read_unlock(&tasklist_lock);
1886 }
1887
1888 /* check whether both sides are closing ... */
1889 final = !tty->count && !(o_tty && o_tty->count);
1890
1891 tty_unlock_slave(o_tty);
1892 tty_unlock(tty);
1893
1894 /* At this point, the tty->count == 0 should ensure a dead tty
1895 cannot be re-opened by a racing opener */
1896
1897 if (!final)
1898 return 0;
1899
1900 tty_debug_hangup(tty, "final close\n");
1901 /*
1902 * Ask the line discipline code to release its structures
1903 */
1904 tty_ldisc_release(tty);
1905
1906 /* Wait for pending work before tty destruction commmences */
1907 tty_flush_works(tty);
1908
1909 tty_debug_hangup(tty, "freeing structure\n");
1910 /*
1911 * The release_tty function takes care of the details of clearing
1912 * the slots and preserving the termios structure. The tty_unlock_pair
1913 * should be safe as we keep a kref while the tty is locked (so the
1914 * unlock never unlocks a freed tty).
1915 */
1916 mutex_lock(&tty_mutex);
1917 release_tty(tty, idx);
1918 mutex_unlock(&tty_mutex);
1919
1920 return 0;
1921}
1922
1923/**
1924 * tty_open_current_tty - get locked tty of current task
1925 * @device: device number
1926 * @filp: file pointer to tty
1927 * @return: locked tty of the current task iff @device is /dev/tty
1928 *
1929 * Performs a re-open of the current task's controlling tty.
1930 *
1931 * We cannot return driver and index like for the other nodes because
1932 * devpts will not work then. It expects inodes to be from devpts FS.
1933 */
1934static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1935{
1936 struct tty_struct *tty;
1937 int retval;
1938
1939 if (device != MKDEV(TTYAUX_MAJOR, 0))
1940 return NULL;
1941
1942 tty = get_current_tty();
1943 if (!tty)
1944 return ERR_PTR(-ENXIO);
1945
1946 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1947 /* noctty = 1; */
1948 tty_lock(tty);
1949 tty_kref_put(tty); /* safe to drop the kref now */
1950
1951 retval = tty_reopen(tty);
1952 if (retval < 0) {
1953 tty_unlock(tty);
1954 tty = ERR_PTR(retval);
1955 }
1956 return tty;
1957}
1958
1959/**
1960 * tty_lookup_driver - lookup a tty driver for a given device file
1961 * @device: device number
1962 * @filp: file pointer to tty
1963 * @index: index for the device in the @return driver
1964 * @return: driver for this inode (with increased refcount)
1965 *
1966 * If @return is not erroneous, the caller is responsible to decrement the
1967 * refcount by tty_driver_kref_put.
1968 *
1969 * Locking: tty_mutex protects get_tty_driver
1970 */
1971static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1972 int *index)
1973{
1974 struct tty_driver *driver;
1975
1976 switch (device) {
1977#ifdef CONFIG_VT
1978 case MKDEV(TTY_MAJOR, 0): {
1979 extern struct tty_driver *console_driver;
1980 driver = tty_driver_kref_get(console_driver);
1981 *index = fg_console;
1982 break;
1983 }
1984#endif
1985 case MKDEV(TTYAUX_MAJOR, 1): {
1986 struct tty_driver *console_driver = console_device(index);
1987 if (console_driver) {
1988 driver = tty_driver_kref_get(console_driver);
1989 if (driver) {
1990 /* Don't let /dev/console block */
1991 filp->f_flags |= O_NONBLOCK;
1992 break;
1993 }
1994 }
1995 return ERR_PTR(-ENODEV);
1996 }
1997 default:
1998 driver = get_tty_driver(device, index);
1999 if (!driver)
2000 return ERR_PTR(-ENODEV);
2001 break;
2002 }
2003 return driver;
2004}
2005
2006/**
2007 * tty_open_by_driver - open a tty device
2008 * @device: dev_t of device to open
2009 * @inode: inode of device file
2010 * @filp: file pointer to tty
2011 *
2012 * Performs the driver lookup, checks for a reopen, or otherwise
2013 * performs the first-time tty initialization.
2014 *
2015 * Returns the locked initialized or re-opened &tty_struct
2016 *
2017 * Claims the global tty_mutex to serialize:
2018 * - concurrent first-time tty initialization
2019 * - concurrent tty driver removal w/ lookup
2020 * - concurrent tty removal from driver table
2021 */
2022static struct tty_struct *tty_open_by_driver(dev_t device, struct inode *inode,
2023 struct file *filp)
2024{
2025 struct tty_struct *tty;
2026 struct tty_driver *driver = NULL;
2027 int index = -1;
2028 int retval;
2029
2030 mutex_lock(&tty_mutex);
2031 driver = tty_lookup_driver(device, filp, &index);
2032 if (IS_ERR(driver)) {
2033 mutex_unlock(&tty_mutex);
2034 return ERR_CAST(driver);
2035 }
2036
2037 /* check whether we're reopening an existing tty */
2038 tty = tty_driver_lookup_tty(driver, filp, index);
2039 if (IS_ERR(tty)) {
2040 mutex_unlock(&tty_mutex);
2041 goto out;
2042 }
2043
2044 if (tty) {
2045 mutex_unlock(&tty_mutex);
2046 retval = tty_lock_interruptible(tty);
2047 tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
2048 if (retval) {
2049 if (retval == -EINTR)
2050 retval = -ERESTARTSYS;
2051 tty = ERR_PTR(retval);
2052 goto out;
2053 }
2054 retval = tty_reopen(tty);
2055 if (retval < 0) {
2056 tty_unlock(tty);
2057 tty = ERR_PTR(retval);
2058 }
2059 } else { /* Returns with the tty_lock held for now */
2060 tty = tty_init_dev(driver, index);
2061 mutex_unlock(&tty_mutex);
2062 }
2063out:
2064 tty_driver_kref_put(driver);
2065 return tty;
2066}
2067
2068/**
2069 * tty_open - open a tty device
2070 * @inode: inode of device file
2071 * @filp: file pointer to tty
2072 *
2073 * tty_open and tty_release keep up the tty count that contains the
2074 * number of opens done on a tty. We cannot use the inode-count, as
2075 * different inodes might point to the same tty.
2076 *
2077 * Open-counting is needed for pty masters, as well as for keeping
2078 * track of serial lines: DTR is dropped when the last close happens.
2079 * (This is not done solely through tty->count, now. - Ted 1/27/92)
2080 *
2081 * The termios state of a pty is reset on first open so that
2082 * settings don't persist across reuse.
2083 *
2084 * Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2085 * tty->count should protect the rest.
2086 * ->siglock protects ->signal/->sighand
2087 *
2088 * Note: the tty_unlock/lock cases without a ref are only safe due to
2089 * tty_mutex
2090 */
2091
2092static int tty_open(struct inode *inode, struct file *filp)
2093{
2094 struct tty_struct *tty;
2095 int noctty, retval;
2096 dev_t device = inode->i_rdev;
2097 unsigned saved_flags = filp->f_flags;
2098
2099 nonseekable_open(inode, filp);
2100
2101retry_open:
2102 retval = tty_alloc_file(filp);
2103 if (retval)
2104 return -ENOMEM;
2105
2106 tty = tty_open_current_tty(device, filp);
2107 if (!tty)
2108 tty = tty_open_by_driver(device, inode, filp);
2109
2110 if (IS_ERR(tty)) {
2111 tty_free_file(filp);
2112 retval = PTR_ERR(tty);
2113 if (retval != -EAGAIN || signal_pending(current))
2114 return retval;
2115 schedule();
2116 goto retry_open;
2117 }
2118
2119 tty_add_file(tty, filp);
2120
2121 check_tty_count(tty, __func__);
2122 tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2123
2124 if (tty->ops->open)
2125 retval = tty->ops->open(tty, filp);
2126 else
2127 retval = -ENODEV;
2128 filp->f_flags = saved_flags;
2129
2130 if (retval) {
2131 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2132
2133 tty_unlock(tty); /* need to call tty_release without BTM */
2134 tty_release(inode, filp);
2135 if (retval != -ERESTARTSYS)
2136 return retval;
2137
2138 if (signal_pending(current))
2139 return retval;
2140
2141 schedule();
2142 /*
2143 * Need to reset f_op in case a hangup happened.
2144 */
2145 if (tty_hung_up_p(filp))
2146 filp->f_op = &tty_fops;
2147 goto retry_open;
2148 }
2149 clear_bit(TTY_HUPPED, &tty->flags);
2150
2151
2152 read_lock(&tasklist_lock);
2153 spin_lock_irq(¤t->sighand->siglock);
2154 noctty = (filp->f_flags & O_NOCTTY) ||
2155 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2156 device == MKDEV(TTYAUX_MAJOR, 1) ||
2157 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2158 tty->driver->subtype == PTY_TYPE_MASTER);
2159
2160 if (!noctty &&
2161 current->signal->leader &&
2162 !current->signal->tty &&
2163 tty->session == NULL) {
2164 /*
2165 * Don't let a process that only has write access to the tty
2166 * obtain the privileges associated with having a tty as
2167 * controlling terminal (being able to reopen it with full
2168 * access through /dev/tty, being able to perform pushback).
2169 * Many distributions set the group of all ttys to "tty" and
2170 * grant write-only access to all terminals for setgid tty
2171 * binaries, which should not imply full privileges on all ttys.
2172 *
2173 * This could theoretically break old code that performs open()
2174 * on a write-only file descriptor. In that case, it might be
2175 * necessary to also permit this if
2176 * inode_permission(inode, MAY_READ) == 0.
2177 */
2178 if (filp->f_mode & FMODE_READ)
2179 __proc_set_tty(tty);
2180 }
2181 spin_unlock_irq(¤t->sighand->siglock);
2182 read_unlock(&tasklist_lock);
2183 tty_unlock(tty);
2184 return 0;
2185}
2186
2187
2188
2189/**
2190 * tty_poll - check tty status
2191 * @filp: file being polled
2192 * @wait: poll wait structures to update
2193 *
2194 * Call the line discipline polling method to obtain the poll
2195 * status of the device.
2196 *
2197 * Locking: locks called line discipline but ldisc poll method
2198 * may be re-entered freely by other callers.
2199 */
2200
2201static unsigned int tty_poll(struct file *filp, poll_table *wait)
2202{
2203 struct tty_struct *tty = file_tty(filp);
2204 struct tty_ldisc *ld;
2205 int ret = 0;
2206
2207 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2208 return 0;
2209
2210 ld = tty_ldisc_ref_wait(tty);
2211 if (!ld)
2212 return hung_up_tty_poll(filp, wait);
2213 if (ld->ops->poll)
2214 ret = ld->ops->poll(tty, filp, wait);
2215 tty_ldisc_deref(ld);
2216 return ret;
2217}
2218
2219static int __tty_fasync(int fd, struct file *filp, int on)
2220{
2221 struct tty_struct *tty = file_tty(filp);
2222 unsigned long flags;
2223 int retval = 0;
2224
2225 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2226 goto out;
2227
2228 retval = fasync_helper(fd, filp, on, &tty->fasync);
2229 if (retval <= 0)
2230 goto out;
2231
2232 if (on) {
2233 enum pid_type type;
2234 struct pid *pid;
2235
2236 spin_lock_irqsave(&tty->ctrl_lock, flags);
2237 if (tty->pgrp) {
2238 pid = tty->pgrp;
2239 type = PIDTYPE_PGID;
2240 } else {
2241 pid = task_pid(current);
2242 type = PIDTYPE_PID;
2243 }
2244 get_pid(pid);
2245 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2246 __f_setown(filp, pid, type, 0);
2247 put_pid(pid);
2248 retval = 0;
2249 }
2250out:
2251 return retval;
2252}
2253
2254static int tty_fasync(int fd, struct file *filp, int on)
2255{
2256 struct tty_struct *tty = file_tty(filp);
2257 int retval = -ENOTTY;
2258
2259 tty_lock(tty);
2260 if (!tty_hung_up_p(filp))
2261 retval = __tty_fasync(fd, filp, on);
2262 tty_unlock(tty);
2263
2264 return retval;
2265}
2266
2267/**
2268 * tiocsti - fake input character
2269 * @tty: tty to fake input into
2270 * @p: pointer to character
2271 *
2272 * Fake input to a tty device. Does the necessary locking and
2273 * input management.
2274 *
2275 * FIXME: does not honour flow control ??
2276 *
2277 * Locking:
2278 * Called functions take tty_ldiscs_lock
2279 * current->signal->tty check is safe without locks
2280 *
2281 * FIXME: may race normal receive processing
2282 */
2283
2284static int tiocsti(struct tty_struct *tty, char __user *p)
2285{
2286 char ch, mbz = 0;
2287 struct tty_ldisc *ld;
2288
2289 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2290 return -EPERM;
2291 if (get_user(ch, p))
2292 return -EFAULT;
2293 tty_audit_tiocsti(tty, ch);
2294 ld = tty_ldisc_ref_wait(tty);
2295 if (!ld)
2296 return -EIO;
2297 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2298 tty_ldisc_deref(ld);
2299 return 0;
2300}
2301
2302/**
2303 * tiocgwinsz - implement window query ioctl
2304 * @tty; tty
2305 * @arg: user buffer for result
2306 *
2307 * Copies the kernel idea of the window size into the user buffer.
2308 *
2309 * Locking: tty->winsize_mutex is taken to ensure the winsize data
2310 * is consistent.
2311 */
2312
2313static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2314{
2315 int err;
2316
2317 mutex_lock(&tty->winsize_mutex);
2318 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2319 mutex_unlock(&tty->winsize_mutex);
2320
2321 return err ? -EFAULT: 0;
2322}
2323
2324/**
2325 * tty_do_resize - resize event
2326 * @tty: tty being resized
2327 * @rows: rows (character)
2328 * @cols: cols (character)
2329 *
2330 * Update the termios variables and send the necessary signals to
2331 * peform a terminal resize correctly
2332 */
2333
2334int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2335{
2336 struct pid *pgrp;
2337
2338 /* Lock the tty */
2339 mutex_lock(&tty->winsize_mutex);
2340 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2341 goto done;
2342
2343 /* Signal the foreground process group */
2344 pgrp = tty_get_pgrp(tty);
2345 if (pgrp)
2346 kill_pgrp(pgrp, SIGWINCH, 1);
2347 put_pid(pgrp);
2348
2349 tty->winsize = *ws;
2350done:
2351 mutex_unlock(&tty->winsize_mutex);
2352 return 0;
2353}
2354EXPORT_SYMBOL(tty_do_resize);
2355
2356/**
2357 * tiocswinsz - implement window size set ioctl
2358 * @tty; tty side of tty
2359 * @arg: user buffer for result
2360 *
2361 * Copies the user idea of the window size to the kernel. Traditionally
2362 * this is just advisory information but for the Linux console it
2363 * actually has driver level meaning and triggers a VC resize.
2364 *
2365 * Locking:
2366 * Driver dependent. The default do_resize method takes the
2367 * tty termios mutex and ctrl_lock. The console takes its own lock
2368 * then calls into the default method.
2369 */
2370
2371static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2372{
2373 struct winsize tmp_ws;
2374 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2375 return -EFAULT;
2376
2377 if (tty->ops->resize)
2378 return tty->ops->resize(tty, &tmp_ws);
2379 else
2380 return tty_do_resize(tty, &tmp_ws);
2381}
2382
2383/**
2384 * tioccons - allow admin to move logical console
2385 * @file: the file to become console
2386 *
2387 * Allow the administrator to move the redirected console device
2388 *
2389 * Locking: uses redirect_lock to guard the redirect information
2390 */
2391
2392static int tioccons(struct file *file)
2393{
2394 if (!capable(CAP_SYS_ADMIN))
2395 return -EPERM;
2396 if (file->f_op->write == redirected_tty_write) {
2397 struct file *f;
2398 spin_lock(&redirect_lock);
2399 f = redirect;
2400 redirect = NULL;
2401 spin_unlock(&redirect_lock);
2402 if (f)
2403 fput(f);
2404 return 0;
2405 }
2406 spin_lock(&redirect_lock);
2407 if (redirect) {
2408 spin_unlock(&redirect_lock);
2409 return -EBUSY;
2410 }
2411 redirect = get_file(file);
2412 spin_unlock(&redirect_lock);
2413 return 0;
2414}
2415
2416/**
2417 * fionbio - non blocking ioctl
2418 * @file: file to set blocking value
2419 * @p: user parameter
2420 *
2421 * Historical tty interfaces had a blocking control ioctl before
2422 * the generic functionality existed. This piece of history is preserved
2423 * in the expected tty API of posix OS's.
2424 *
2425 * Locking: none, the open file handle ensures it won't go away.
2426 */
2427
2428static int fionbio(struct file *file, int __user *p)
2429{
2430 int nonblock;
2431
2432 if (get_user(nonblock, p))
2433 return -EFAULT;
2434
2435 spin_lock(&file->f_lock);
2436 if (nonblock)
2437 file->f_flags |= O_NONBLOCK;
2438 else
2439 file->f_flags &= ~O_NONBLOCK;
2440 spin_unlock(&file->f_lock);
2441 return 0;
2442}
2443
2444/**
2445 * tiocsctty - set controlling tty
2446 * @tty: tty structure
2447 * @arg: user argument
2448 *
2449 * This ioctl is used to manage job control. It permits a session
2450 * leader to set this tty as the controlling tty for the session.
2451 *
2452 * Locking:
2453 * Takes tty_lock() to serialize proc_set_tty() for this tty
2454 * Takes tasklist_lock internally to walk sessions
2455 * Takes ->siglock() when updating signal->tty
2456 */
2457
2458static int tiocsctty(struct tty_struct *tty, struct file *file, int arg)
2459{
2460 int ret = 0;
2461
2462 tty_lock(tty);
2463 read_lock(&tasklist_lock);
2464
2465 if (current->signal->leader && (task_session(current) == tty->session))
2466 goto unlock;
2467
2468 /*
2469 * The process must be a session leader and
2470 * not have a controlling tty already.
2471 */
2472 if (!current->signal->leader || current->signal->tty) {
2473 ret = -EPERM;
2474 goto unlock;
2475 }
2476
2477 if (tty->session) {
2478 /*
2479 * This tty is already the controlling
2480 * tty for another session group!
2481 */
2482 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2483 /*
2484 * Steal it away
2485 */
2486 session_clear_tty(tty->session);
2487 } else {
2488 ret = -EPERM;
2489 goto unlock;
2490 }
2491 }
2492
2493 /* See the comment in tty_open(). */
2494 if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) {
2495 ret = -EPERM;
2496 goto unlock;
2497 }
2498
2499 proc_set_tty(tty);
2500unlock:
2501 read_unlock(&tasklist_lock);
2502 tty_unlock(tty);
2503 return ret;
2504}
2505
2506/**
2507 * tty_get_pgrp - return a ref counted pgrp pid
2508 * @tty: tty to read
2509 *
2510 * Returns a refcounted instance of the pid struct for the process
2511 * group controlling the tty.
2512 */
2513
2514struct pid *tty_get_pgrp(struct tty_struct *tty)
2515{
2516 unsigned long flags;
2517 struct pid *pgrp;
2518
2519 spin_lock_irqsave(&tty->ctrl_lock, flags);
2520 pgrp = get_pid(tty->pgrp);
2521 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2522
2523 return pgrp;
2524}
2525EXPORT_SYMBOL_GPL(tty_get_pgrp);
2526
2527/*
2528 * This checks not only the pgrp, but falls back on the pid if no
2529 * satisfactory pgrp is found. I dunno - gdb doesn't work correctly
2530 * without this...
2531 *
2532 * The caller must hold rcu lock or the tasklist lock.
2533 */
2534static struct pid *session_of_pgrp(struct pid *pgrp)
2535{
2536 struct task_struct *p;
2537 struct pid *sid = NULL;
2538
2539 p = pid_task(pgrp, PIDTYPE_PGID);
2540 if (p == NULL)
2541 p = pid_task(pgrp, PIDTYPE_PID);
2542 if (p != NULL)
2543 sid = task_session(p);
2544
2545 return sid;
2546}
2547
2548/**
2549 * tiocgpgrp - get process group
2550 * @tty: tty passed by user
2551 * @real_tty: tty side of the tty passed by the user if a pty else the tty
2552 * @p: returned pid
2553 *
2554 * Obtain the process group of the tty. If there is no process group
2555 * return an error.
2556 *
2557 * Locking: none. Reference to current->signal->tty is safe.
2558 */
2559
2560static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2561{
2562 struct pid *pid;
2563 int ret;
2564 /*
2565 * (tty == real_tty) is a cheap way of
2566 * testing if the tty is NOT a master pty.
2567 */
2568 if (tty == real_tty && current->signal->tty != real_tty)
2569 return -ENOTTY;
2570 pid = tty_get_pgrp(real_tty);
2571 ret = put_user(pid_vnr(pid), p);
2572 put_pid(pid);
2573 return ret;
2574}
2575
2576/**
2577 * tiocspgrp - attempt to set process group
2578 * @tty: tty passed by user
2579 * @real_tty: tty side device matching tty passed by user
2580 * @p: pid pointer
2581 *
2582 * Set the process group of the tty to the session passed. Only
2583 * permitted where the tty session is our session.
2584 *
2585 * Locking: RCU, ctrl lock
2586 */
2587
2588static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2589{
2590 struct pid *pgrp;
2591 pid_t pgrp_nr;
2592 int retval = tty_check_change(real_tty);
2593
2594 if (retval == -EIO)
2595 return -ENOTTY;
2596 if (retval)
2597 return retval;
2598 if (!current->signal->tty ||
2599 (current->signal->tty != real_tty) ||
2600 (real_tty->session != task_session(current)))
2601 return -ENOTTY;
2602 if (get_user(pgrp_nr, p))
2603 return -EFAULT;
2604 if (pgrp_nr < 0)
2605 return -EINVAL;
2606 rcu_read_lock();
2607 pgrp = find_vpid(pgrp_nr);
2608 retval = -ESRCH;
2609 if (!pgrp)
2610 goto out_unlock;
2611 retval = -EPERM;
2612 if (session_of_pgrp(pgrp) != task_session(current))
2613 goto out_unlock;
2614 retval = 0;
2615 spin_lock_irq(&tty->ctrl_lock);
2616 put_pid(real_tty->pgrp);
2617 real_tty->pgrp = get_pid(pgrp);
2618 spin_unlock_irq(&tty->ctrl_lock);
2619out_unlock:
2620 rcu_read_unlock();
2621 return retval;
2622}
2623
2624/**
2625 * tiocgsid - get session id
2626 * @tty: tty passed by user
2627 * @real_tty: tty side of the tty passed by the user if a pty else the tty
2628 * @p: pointer to returned session id
2629 *
2630 * Obtain the session id of the tty. If there is no session
2631 * return an error.
2632 *
2633 * Locking: none. Reference to current->signal->tty is safe.
2634 */
2635
2636static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2637{
2638 /*
2639 * (tty == real_tty) is a cheap way of
2640 * testing if the tty is NOT a master pty.
2641 */
2642 if (tty == real_tty && current->signal->tty != real_tty)
2643 return -ENOTTY;
2644 if (!real_tty->session)
2645 return -ENOTTY;
2646 return put_user(pid_vnr(real_tty->session), p);
2647}
2648
2649/**
2650 * tiocsetd - set line discipline
2651 * @tty: tty device
2652 * @p: pointer to user data
2653 *
2654 * Set the line discipline according to user request.
2655 *
2656 * Locking: see tty_set_ldisc, this function is just a helper
2657 */
2658
2659static int tiocsetd(struct tty_struct *tty, int __user *p)
2660{
2661 int disc;
2662 int ret;
2663
2664 if (get_user(disc, p))
2665 return -EFAULT;
2666
2667 ret = tty_set_ldisc(tty, disc);
2668
2669 return ret;
2670}
2671
2672/**
2673 * tiocgetd - get line discipline
2674 * @tty: tty device
2675 * @p: pointer to user data
2676 *
2677 * Retrieves the line discipline id directly from the ldisc.
2678 *
2679 * Locking: waits for ldisc reference (in case the line discipline
2680 * is changing or the tty is being hungup)
2681 */
2682
2683static int tiocgetd(struct tty_struct *tty, int __user *p)
2684{
2685 struct tty_ldisc *ld;
2686 int ret;
2687
2688 ld = tty_ldisc_ref_wait(tty);
2689 if (!ld)
2690 return -EIO;
2691 ret = put_user(ld->ops->num, p);
2692 tty_ldisc_deref(ld);
2693 return ret;
2694}
2695
2696/**
2697 * send_break - performed time break
2698 * @tty: device to break on
2699 * @duration: timeout in mS
2700 *
2701 * Perform a timed break on hardware that lacks its own driver level
2702 * timed break functionality.
2703 *
2704 * Locking:
2705 * atomic_write_lock serializes
2706 *
2707 */
2708
2709static int send_break(struct tty_struct *tty, unsigned int duration)
2710{
2711 int retval;
2712
2713 if (tty->ops->break_ctl == NULL)
2714 return 0;
2715
2716 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2717 retval = tty->ops->break_ctl(tty, duration);
2718 else {
2719 /* Do the work ourselves */
2720 if (tty_write_lock(tty, 0) < 0)
2721 return -EINTR;
2722 retval = tty->ops->break_ctl(tty, -1);
2723 if (retval)
2724 goto out;
2725 if (!signal_pending(current))
2726 msleep_interruptible(duration);
2727 retval = tty->ops->break_ctl(tty, 0);
2728out:
2729 tty_write_unlock(tty);
2730 if (signal_pending(current))
2731 retval = -EINTR;
2732 }
2733 return retval;
2734}
2735
2736/**
2737 * tty_tiocmget - get modem status
2738 * @tty: tty device
2739 * @file: user file pointer
2740 * @p: pointer to result
2741 *
2742 * Obtain the modem status bits from the tty driver if the feature
2743 * is supported. Return -EINVAL if it is not available.
2744 *
2745 * Locking: none (up to the driver)
2746 */
2747
2748static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2749{
2750 int retval = -EINVAL;
2751
2752 if (tty->ops->tiocmget) {
2753 retval = tty->ops->tiocmget(tty);
2754
2755 if (retval >= 0)
2756 retval = put_user(retval, p);
2757 }
2758 return retval;
2759}
2760
2761/**
2762 * tty_tiocmset - set modem status
2763 * @tty: tty device
2764 * @cmd: command - clear bits, set bits or set all
2765 * @p: pointer to desired bits
2766 *
2767 * Set the modem status bits from the tty driver if the feature
2768 * is supported. Return -EINVAL if it is not available.
2769 *
2770 * Locking: none (up to the driver)
2771 */
2772
2773static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2774 unsigned __user *p)
2775{
2776 int retval;
2777 unsigned int set, clear, val;
2778
2779 if (tty->ops->tiocmset == NULL)
2780 return -EINVAL;
2781
2782 retval = get_user(val, p);
2783 if (retval)
2784 return retval;
2785 set = clear = 0;
2786 switch (cmd) {
2787 case TIOCMBIS:
2788 set = val;
2789 break;
2790 case TIOCMBIC:
2791 clear = val;
2792 break;
2793 case TIOCMSET:
2794 set = val;
2795 clear = ~val;
2796 break;
2797 }
2798 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2799 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2800 return tty->ops->tiocmset(tty, set, clear);
2801}
2802
2803static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2804{
2805 int retval = -EINVAL;
2806 struct serial_icounter_struct icount;
2807 memset(&icount, 0, sizeof(icount));
2808 if (tty->ops->get_icount)
2809 retval = tty->ops->get_icount(tty, &icount);
2810 if (retval != 0)
2811 return retval;
2812 if (copy_to_user(arg, &icount, sizeof(icount)))
2813 return -EFAULT;
2814 return 0;
2815}
2816
2817static void tty_warn_deprecated_flags(struct serial_struct __user *ss)
2818{
2819 static DEFINE_RATELIMIT_STATE(depr_flags,
2820 DEFAULT_RATELIMIT_INTERVAL,
2821 DEFAULT_RATELIMIT_BURST);
2822 char comm[TASK_COMM_LEN];
2823 int flags;
2824
2825 if (get_user(flags, &ss->flags))
2826 return;
2827
2828 flags &= ASYNC_DEPRECATED;
2829
2830 if (flags && __ratelimit(&depr_flags))
2831 pr_warning("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2832 __func__, get_task_comm(comm, current), flags);
2833}
2834
2835/*
2836 * if pty, return the slave side (real_tty)
2837 * otherwise, return self
2838 */
2839static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2840{
2841 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2842 tty->driver->subtype == PTY_TYPE_MASTER)
2843 tty = tty->link;
2844 return tty;
2845}
2846
2847/*
2848 * Split this up, as gcc can choke on it otherwise..
2849 */
2850long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2851{
2852 struct tty_struct *tty = file_tty(file);
2853 struct tty_struct *real_tty;
2854 void __user *p = (void __user *)arg;
2855 int retval;
2856 struct tty_ldisc *ld;
2857
2858 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2859 return -EINVAL;
2860
2861 real_tty = tty_pair_get_tty(tty);
2862
2863 /*
2864 * Factor out some common prep work
2865 */
2866 switch (cmd) {
2867 case TIOCSETD:
2868 case TIOCSBRK:
2869 case TIOCCBRK:
2870 case TCSBRK:
2871 case TCSBRKP:
2872 retval = tty_check_change(tty);
2873 if (retval)
2874 return retval;
2875 if (cmd != TIOCCBRK) {
2876 tty_wait_until_sent(tty, 0);
2877 if (signal_pending(current))
2878 return -EINTR;
2879 }
2880 break;
2881 }
2882
2883 /*
2884 * Now do the stuff.
2885 */
2886 switch (cmd) {
2887 case TIOCSTI:
2888 return tiocsti(tty, p);
2889 case TIOCGWINSZ:
2890 return tiocgwinsz(real_tty, p);
2891 case TIOCSWINSZ:
2892 return tiocswinsz(real_tty, p);
2893 case TIOCCONS:
2894 return real_tty != tty ? -EINVAL : tioccons(file);
2895 case FIONBIO:
2896 return fionbio(file, p);
2897 case TIOCEXCL:
2898 set_bit(TTY_EXCLUSIVE, &tty->flags);
2899 return 0;
2900 case TIOCNXCL:
2901 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2902 return 0;
2903 case TIOCGEXCL:
2904 {
2905 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2906 return put_user(excl, (int __user *)p);
2907 }
2908 case TIOCNOTTY:
2909 if (current->signal->tty != tty)
2910 return -ENOTTY;
2911 no_tty();
2912 return 0;
2913 case TIOCSCTTY:
2914 return tiocsctty(real_tty, file, arg);
2915 case TIOCGPGRP:
2916 return tiocgpgrp(tty, real_tty, p);
2917 case TIOCSPGRP:
2918 return tiocspgrp(tty, real_tty, p);
2919 case TIOCGSID:
2920 return tiocgsid(tty, real_tty, p);
2921 case TIOCGETD:
2922 return tiocgetd(tty, p);
2923 case TIOCSETD:
2924 return tiocsetd(tty, p);
2925 case TIOCVHANGUP:
2926 if (!capable(CAP_SYS_ADMIN))
2927 return -EPERM;
2928 tty_vhangup(tty);
2929 return 0;
2930 case TIOCGDEV:
2931 {
2932 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2933 return put_user(ret, (unsigned int __user *)p);
2934 }
2935 /*
2936 * Break handling
2937 */
2938 case TIOCSBRK: /* Turn break on, unconditionally */
2939 if (tty->ops->break_ctl)
2940 return tty->ops->break_ctl(tty, -1);
2941 return 0;
2942 case TIOCCBRK: /* Turn break off, unconditionally */
2943 if (tty->ops->break_ctl)
2944 return tty->ops->break_ctl(tty, 0);
2945 return 0;
2946 case TCSBRK: /* SVID version: non-zero arg --> no break */
2947 /* non-zero arg means wait for all output data
2948 * to be sent (performed above) but don't send break.
2949 * This is used by the tcdrain() termios function.
2950 */
2951 if (!arg)
2952 return send_break(tty, 250);
2953 return 0;
2954 case TCSBRKP: /* support for POSIX tcsendbreak() */
2955 return send_break(tty, arg ? arg*100 : 250);
2956
2957 case TIOCMGET:
2958 return tty_tiocmget(tty, p);
2959 case TIOCMSET:
2960 case TIOCMBIC:
2961 case TIOCMBIS:
2962 return tty_tiocmset(tty, cmd, p);
2963 case TIOCGICOUNT:
2964 retval = tty_tiocgicount(tty, p);
2965 /* For the moment allow fall through to the old method */
2966 if (retval != -EINVAL)
2967 return retval;
2968 break;
2969 case TCFLSH:
2970 switch (arg) {
2971 case TCIFLUSH:
2972 case TCIOFLUSH:
2973 /* flush tty buffer and allow ldisc to process ioctl */
2974 tty_buffer_flush(tty, NULL);
2975 break;
2976 }
2977 break;
2978 case TIOCSSERIAL:
2979 tty_warn_deprecated_flags(p);
2980 break;
2981 }
2982 if (tty->ops->ioctl) {
2983 retval = tty->ops->ioctl(tty, cmd, arg);
2984 if (retval != -ENOIOCTLCMD)
2985 return retval;
2986 }
2987 ld = tty_ldisc_ref_wait(tty);
2988 if (!ld)
2989 return hung_up_tty_ioctl(file, cmd, arg);
2990 retval = -EINVAL;
2991 if (ld->ops->ioctl) {
2992 retval = ld->ops->ioctl(tty, file, cmd, arg);
2993 if (retval == -ENOIOCTLCMD)
2994 retval = -ENOTTY;
2995 }
2996 tty_ldisc_deref(ld);
2997 return retval;
2998}
2999
3000#ifdef CONFIG_COMPAT
3001static long tty_compat_ioctl(struct file *file, unsigned int cmd,
3002 unsigned long arg)
3003{
3004 struct tty_struct *tty = file_tty(file);
3005 struct tty_ldisc *ld;
3006 int retval = -ENOIOCTLCMD;
3007
3008 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
3009 return -EINVAL;
3010
3011 if (tty->ops->compat_ioctl) {
3012 retval = tty->ops->compat_ioctl(tty, cmd, arg);
3013 if (retval != -ENOIOCTLCMD)
3014 return retval;
3015 }
3016
3017 ld = tty_ldisc_ref_wait(tty);
3018 if (!ld)
3019 return hung_up_tty_compat_ioctl(file, cmd, arg);
3020 if (ld->ops->compat_ioctl)
3021 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
3022 else
3023 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
3024 tty_ldisc_deref(ld);
3025
3026 return retval;
3027}
3028#endif
3029
3030static int this_tty(const void *t, struct file *file, unsigned fd)
3031{
3032 if (likely(file->f_op->read != tty_read))
3033 return 0;
3034 return file_tty(file) != t ? 0 : fd + 1;
3035}
3036
3037/*
3038 * This implements the "Secure Attention Key" --- the idea is to
3039 * prevent trojan horses by killing all processes associated with this
3040 * tty when the user hits the "Secure Attention Key". Required for
3041 * super-paranoid applications --- see the Orange Book for more details.
3042 *
3043 * This code could be nicer; ideally it should send a HUP, wait a few
3044 * seconds, then send a INT, and then a KILL signal. But you then
3045 * have to coordinate with the init process, since all processes associated
3046 * with the current tty must be dead before the new getty is allowed
3047 * to spawn.
3048 *
3049 * Now, if it would be correct ;-/ The current code has a nasty hole -
3050 * it doesn't catch files in flight. We may send the descriptor to ourselves
3051 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
3052 *
3053 * Nasty bug: do_SAK is being called in interrupt context. This can
3054 * deadlock. We punt it up to process context. AKPM - 16Mar2001
3055 */
3056void __do_SAK(struct tty_struct *tty)
3057{
3058#ifdef TTY_SOFT_SAK
3059 tty_hangup(tty);
3060#else
3061 struct task_struct *g, *p;
3062 struct pid *session;
3063 int i;
3064
3065 if (!tty)
3066 return;
3067 session = tty->session;
3068
3069 tty_ldisc_flush(tty);
3070
3071 tty_driver_flush_buffer(tty);
3072
3073 read_lock(&tasklist_lock);
3074 /* Kill the entire session */
3075 do_each_pid_task(session, PIDTYPE_SID, p) {
3076 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
3077 task_pid_nr(p), p->comm);
3078 send_sig(SIGKILL, p, 1);
3079 } while_each_pid_task(session, PIDTYPE_SID, p);
3080
3081 /* Now kill any processes that happen to have the tty open */
3082 do_each_thread(g, p) {
3083 if (p->signal->tty == tty) {
3084 tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
3085 task_pid_nr(p), p->comm);
3086 send_sig(SIGKILL, p, 1);
3087 continue;
3088 }
3089 task_lock(p);
3090 i = iterate_fd(p->files, 0, this_tty, tty);
3091 if (i != 0) {
3092 tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
3093 task_pid_nr(p), p->comm, i - 1);
3094 force_sig(SIGKILL, p);
3095 }
3096 task_unlock(p);
3097 } while_each_thread(g, p);
3098 read_unlock(&tasklist_lock);
3099#endif
3100}
3101
3102static void do_SAK_work(struct work_struct *work)
3103{
3104 struct tty_struct *tty =
3105 container_of(work, struct tty_struct, SAK_work);
3106 __do_SAK(tty);
3107}
3108
3109/*
3110 * The tq handling here is a little racy - tty->SAK_work may already be queued.
3111 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3112 * the values which we write to it will be identical to the values which it
3113 * already has. --akpm
3114 */
3115void do_SAK(struct tty_struct *tty)
3116{
3117 if (!tty)
3118 return;
3119 schedule_work(&tty->SAK_work);
3120}
3121
3122EXPORT_SYMBOL(do_SAK);
3123
3124static int dev_match_devt(struct device *dev, const void *data)
3125{
3126 const dev_t *devt = data;
3127 return dev->devt == *devt;
3128}
3129
3130/* Must put_device() after it's unused! */
3131static struct device *tty_get_device(struct tty_struct *tty)
3132{
3133 dev_t devt = tty_devnum(tty);
3134 return class_find_device(tty_class, NULL, &devt, dev_match_devt);
3135}
3136
3137
3138/**
3139 * alloc_tty_struct
3140 *
3141 * This subroutine allocates and initializes a tty structure.
3142 *
3143 * Locking: none - tty in question is not exposed at this point
3144 */
3145
3146struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
3147{
3148 struct tty_struct *tty;
3149
3150 tty = kzalloc(sizeof(*tty), GFP_KERNEL);
3151 if (!tty)
3152 return NULL;
3153
3154 kref_init(&tty->kref);
3155 tty->magic = TTY_MAGIC;
3156 tty_ldisc_init(tty);
3157 tty->session = NULL;
3158 tty->pgrp = NULL;
3159 mutex_init(&tty->legacy_mutex);
3160 mutex_init(&tty->throttle_mutex);
3161 init_rwsem(&tty->termios_rwsem);
3162 mutex_init(&tty->winsize_mutex);
3163 init_ldsem(&tty->ldisc_sem);
3164 init_waitqueue_head(&tty->write_wait);
3165 init_waitqueue_head(&tty->read_wait);
3166 INIT_WORK(&tty->hangup_work, do_tty_hangup);
3167 mutex_init(&tty->atomic_write_lock);
3168 spin_lock_init(&tty->ctrl_lock);
3169 spin_lock_init(&tty->flow_lock);
3170 spin_lock_init(&tty->files_lock);
3171 INIT_LIST_HEAD(&tty->tty_files);
3172 INIT_WORK(&tty->SAK_work, do_SAK_work);
3173
3174 tty->driver = driver;
3175 tty->ops = driver->ops;
3176 tty->index = idx;
3177 tty_line_name(driver, idx, tty->name);
3178 tty->dev = tty_get_device(tty);
3179
3180 return tty;
3181}
3182
3183/**
3184 * tty_put_char - write one character to a tty
3185 * @tty: tty
3186 * @ch: character
3187 *
3188 * Write one byte to the tty using the provided put_char method
3189 * if present. Returns the number of characters successfully output.
3190 *
3191 * Note: the specific put_char operation in the driver layer may go
3192 * away soon. Don't call it directly, use this method
3193 */
3194
3195int tty_put_char(struct tty_struct *tty, unsigned char ch)
3196{
3197 if (tty->ops->put_char)
3198 return tty->ops->put_char(tty, ch);
3199 return tty->ops->write(tty, &ch, 1);
3200}
3201EXPORT_SYMBOL_GPL(tty_put_char);
3202
3203struct class *tty_class;
3204
3205static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3206 unsigned int index, unsigned int count)
3207{
3208 int err;
3209
3210 /* init here, since reused cdevs cause crashes */
3211 driver->cdevs[index] = cdev_alloc();
3212 if (!driver->cdevs[index])
3213 return -ENOMEM;
3214 driver->cdevs[index]->ops = &tty_fops;
3215 driver->cdevs[index]->owner = driver->owner;
3216 err = cdev_add(driver->cdevs[index], dev, count);
3217 if (err)
3218 kobject_put(&driver->cdevs[index]->kobj);
3219 return err;
3220}
3221
3222/**
3223 * tty_register_device - register a tty device
3224 * @driver: the tty driver that describes the tty device
3225 * @index: the index in the tty driver for this tty device
3226 * @device: a struct device that is associated with this tty device.
3227 * This field is optional, if there is no known struct device
3228 * for this tty device it can be set to NULL safely.
3229 *
3230 * Returns a pointer to the struct device for this tty device
3231 * (or ERR_PTR(-EFOO) on error).
3232 *
3233 * This call is required to be made to register an individual tty device
3234 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3235 * that bit is not set, this function should not be called by a tty
3236 * driver.
3237 *
3238 * Locking: ??
3239 */
3240
3241struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3242 struct device *device)
3243{
3244 return tty_register_device_attr(driver, index, device, NULL, NULL);
3245}
3246EXPORT_SYMBOL(tty_register_device);
3247
3248static void tty_device_create_release(struct device *dev)
3249{
3250 dev_dbg(dev, "releasing...\n");
3251 kfree(dev);
3252}
3253
3254/**
3255 * tty_register_device_attr - register a tty device
3256 * @driver: the tty driver that describes the tty device
3257 * @index: the index in the tty driver for this tty device
3258 * @device: a struct device that is associated with this tty device.
3259 * This field is optional, if there is no known struct device
3260 * for this tty device it can be set to NULL safely.
3261 * @drvdata: Driver data to be set to device.
3262 * @attr_grp: Attribute group to be set on device.
3263 *
3264 * Returns a pointer to the struct device for this tty device
3265 * (or ERR_PTR(-EFOO) on error).
3266 *
3267 * This call is required to be made to register an individual tty device
3268 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3269 * that bit is not set, this function should not be called by a tty
3270 * driver.
3271 *
3272 * Locking: ??
3273 */
3274struct device *tty_register_device_attr(struct tty_driver *driver,
3275 unsigned index, struct device *device,
3276 void *drvdata,
3277 const struct attribute_group **attr_grp)
3278{
3279 char name[64];
3280 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3281 struct device *dev = NULL;
3282 int retval = -ENODEV;
3283 bool cdev = false;
3284
3285 if (index >= driver->num) {
3286 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3287 driver->name, index);
3288 return ERR_PTR(-EINVAL);
3289 }
3290
3291 if (driver->type == TTY_DRIVER_TYPE_PTY)
3292 pty_line_name(driver, index, name);
3293 else
3294 tty_line_name(driver, index, name);
3295
3296 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3297 retval = tty_cdev_add(driver, devt, index, 1);
3298 if (retval)
3299 goto error;
3300 cdev = true;
3301 }
3302
3303 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3304 if (!dev) {
3305 retval = -ENOMEM;
3306 goto error;
3307 }
3308
3309 dev->devt = devt;
3310 dev->class = tty_class;
3311 dev->parent = device;
3312 dev->release = tty_device_create_release;
3313 dev_set_name(dev, "%s", name);
3314 dev->groups = attr_grp;
3315 dev_set_drvdata(dev, drvdata);
3316
3317 retval = device_register(dev);
3318 if (retval)
3319 goto error;
3320
3321 return dev;
3322
3323error:
3324 put_device(dev);
3325 if (cdev) {
3326 cdev_del(driver->cdevs[index]);
3327 driver->cdevs[index] = NULL;
3328 }
3329 return ERR_PTR(retval);
3330}
3331EXPORT_SYMBOL_GPL(tty_register_device_attr);
3332
3333/**
3334 * tty_unregister_device - unregister a tty device
3335 * @driver: the tty driver that describes the tty device
3336 * @index: the index in the tty driver for this tty device
3337 *
3338 * If a tty device is registered with a call to tty_register_device() then
3339 * this function must be called when the tty device is gone.
3340 *
3341 * Locking: ??
3342 */
3343
3344void tty_unregister_device(struct tty_driver *driver, unsigned index)
3345{
3346 device_destroy(tty_class,
3347 MKDEV(driver->major, driver->minor_start) + index);
3348 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3349 cdev_del(driver->cdevs[index]);
3350 driver->cdevs[index] = NULL;
3351 }
3352}
3353EXPORT_SYMBOL(tty_unregister_device);
3354
3355/**
3356 * __tty_alloc_driver -- allocate tty driver
3357 * @lines: count of lines this driver can handle at most
3358 * @owner: module which is repsonsible for this driver
3359 * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3360 *
3361 * This should not be called directly, some of the provided macros should be
3362 * used instead. Use IS_ERR and friends on @retval.
3363 */
3364struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3365 unsigned long flags)
3366{
3367 struct tty_driver *driver;
3368 unsigned int cdevs = 1;
3369 int err;
3370
3371 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3372 return ERR_PTR(-EINVAL);
3373
3374 driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3375 if (!driver)
3376 return ERR_PTR(-ENOMEM);
3377
3378 kref_init(&driver->kref);
3379 driver->magic = TTY_DRIVER_MAGIC;
3380 driver->num = lines;
3381 driver->owner = owner;
3382 driver->flags = flags;
3383
3384 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3385 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3386 GFP_KERNEL);
3387 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3388 GFP_KERNEL);
3389 if (!driver->ttys || !driver->termios) {
3390 err = -ENOMEM;
3391 goto err_free_all;
3392 }
3393 }
3394
3395 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3396 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3397 GFP_KERNEL);
3398 if (!driver->ports) {
3399 err = -ENOMEM;
3400 goto err_free_all;
3401 }
3402 cdevs = lines;
3403 }
3404
3405 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3406 if (!driver->cdevs) {
3407 err = -ENOMEM;
3408 goto err_free_all;
3409 }
3410
3411 return driver;
3412err_free_all:
3413 kfree(driver->ports);
3414 kfree(driver->ttys);
3415 kfree(driver->termios);
3416 kfree(driver->cdevs);
3417 kfree(driver);
3418 return ERR_PTR(err);
3419}
3420EXPORT_SYMBOL(__tty_alloc_driver);
3421
3422static void destruct_tty_driver(struct kref *kref)
3423{
3424 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3425 int i;
3426 struct ktermios *tp;
3427
3428 if (driver->flags & TTY_DRIVER_INSTALLED) {
3429 /*
3430 * Free the termios and termios_locked structures because
3431 * we don't want to get memory leaks when modular tty
3432 * drivers are removed from the kernel.
3433 */
3434 for (i = 0; i < driver->num; i++) {
3435 tp = driver->termios[i];
3436 if (tp) {
3437 driver->termios[i] = NULL;
3438 kfree(tp);
3439 }
3440 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3441 tty_unregister_device(driver, i);
3442 }
3443 proc_tty_unregister_driver(driver);
3444 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3445 cdev_del(driver->cdevs[0]);
3446 }
3447 kfree(driver->cdevs);
3448 kfree(driver->ports);
3449 kfree(driver->termios);
3450 kfree(driver->ttys);
3451 kfree(driver);
3452}
3453
3454void tty_driver_kref_put(struct tty_driver *driver)
3455{
3456 kref_put(&driver->kref, destruct_tty_driver);
3457}
3458EXPORT_SYMBOL(tty_driver_kref_put);
3459
3460void tty_set_operations(struct tty_driver *driver,
3461 const struct tty_operations *op)
3462{
3463 driver->ops = op;
3464};
3465EXPORT_SYMBOL(tty_set_operations);
3466
3467void put_tty_driver(struct tty_driver *d)
3468{
3469 tty_driver_kref_put(d);
3470}
3471EXPORT_SYMBOL(put_tty_driver);
3472
3473/*
3474 * Called by a tty driver to register itself.
3475 */
3476int tty_register_driver(struct tty_driver *driver)
3477{
3478 int error;
3479 int i;
3480 dev_t dev;
3481 struct device *d;
3482
3483 if (!driver->major) {
3484 error = alloc_chrdev_region(&dev, driver->minor_start,
3485 driver->num, driver->name);
3486 if (!error) {
3487 driver->major = MAJOR(dev);
3488 driver->minor_start = MINOR(dev);
3489 }
3490 } else {
3491 dev = MKDEV(driver->major, driver->minor_start);
3492 error = register_chrdev_region(dev, driver->num, driver->name);
3493 }
3494 if (error < 0)
3495 goto err;
3496
3497 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3498 error = tty_cdev_add(driver, dev, 0, driver->num);
3499 if (error)
3500 goto err_unreg_char;
3501 }
3502
3503 mutex_lock(&tty_mutex);
3504 list_add(&driver->tty_drivers, &tty_drivers);
3505 mutex_unlock(&tty_mutex);
3506
3507 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3508 for (i = 0; i < driver->num; i++) {
3509 d = tty_register_device(driver, i, NULL);
3510 if (IS_ERR(d)) {
3511 error = PTR_ERR(d);
3512 goto err_unreg_devs;
3513 }
3514 }
3515 }
3516 proc_tty_register_driver(driver);
3517 driver->flags |= TTY_DRIVER_INSTALLED;
3518 return 0;
3519
3520err_unreg_devs:
3521 for (i--; i >= 0; i--)
3522 tty_unregister_device(driver, i);
3523
3524 mutex_lock(&tty_mutex);
3525 list_del(&driver->tty_drivers);
3526 mutex_unlock(&tty_mutex);
3527
3528err_unreg_char:
3529 unregister_chrdev_region(dev, driver->num);
3530err:
3531 return error;
3532}
3533EXPORT_SYMBOL(tty_register_driver);
3534
3535/*
3536 * Called by a tty driver to unregister itself.
3537 */
3538int tty_unregister_driver(struct tty_driver *driver)
3539{
3540#if 0
3541 /* FIXME */
3542 if (driver->refcount)
3543 return -EBUSY;
3544#endif
3545 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3546 driver->num);
3547 mutex_lock(&tty_mutex);
3548 list_del(&driver->tty_drivers);
3549 mutex_unlock(&tty_mutex);
3550 return 0;
3551}
3552
3553EXPORT_SYMBOL(tty_unregister_driver);
3554
3555dev_t tty_devnum(struct tty_struct *tty)
3556{
3557 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3558}
3559EXPORT_SYMBOL(tty_devnum);
3560
3561void tty_default_fops(struct file_operations *fops)
3562{
3563 *fops = tty_fops;
3564}
3565
3566/*
3567 * Initialize the console device. This is called *early*, so
3568 * we can't necessarily depend on lots of kernel help here.
3569 * Just do some early initializations, and do the complex setup
3570 * later.
3571 */
3572void __init console_init(void)
3573{
3574 initcall_t *call;
3575
3576 /* Setup the default TTY line discipline. */
3577 n_tty_init();
3578
3579 /*
3580 * set up the console device so that later boot sequences can
3581 * inform about problems etc..
3582 */
3583 call = __con_initcall_start;
3584 while (call < __con_initcall_end) {
3585 (*call)();
3586 call++;
3587 }
3588}
3589
3590static char *tty_devnode(struct device *dev, umode_t *mode)
3591{
3592 if (!mode)
3593 return NULL;
3594 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3595 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3596 *mode = 0666;
3597 return NULL;
3598}
3599
3600static int __init tty_class_init(void)
3601{
3602 tty_class = class_create(THIS_MODULE, "tty");
3603 if (IS_ERR(tty_class))
3604 return PTR_ERR(tty_class);
3605 tty_class->devnode = tty_devnode;
3606 return 0;
3607}
3608
3609postcore_initcall(tty_class_init);
3610
3611/* 3/2004 jmc: why do these devices exist? */
3612static struct cdev tty_cdev, console_cdev;
3613
3614static ssize_t show_cons_active(struct device *dev,
3615 struct device_attribute *attr, char *buf)
3616{
3617 struct console *cs[16];
3618 int i = 0;
3619 struct console *c;
3620 ssize_t count = 0;
3621
3622 console_lock();
3623 for_each_console(c) {
3624 if (!c->device)
3625 continue;
3626 if (!c->write)
3627 continue;
3628 if ((c->flags & CON_ENABLED) == 0)
3629 continue;
3630 cs[i++] = c;
3631 if (i >= ARRAY_SIZE(cs))
3632 break;
3633 }
3634 while (i--) {
3635 int index = cs[i]->index;
3636 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3637
3638 /* don't resolve tty0 as some programs depend on it */
3639 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3640 count += tty_line_name(drv, index, buf + count);
3641 else
3642 count += sprintf(buf + count, "%s%d",
3643 cs[i]->name, cs[i]->index);
3644
3645 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3646 }
3647 console_unlock();
3648
3649 return count;
3650}
3651static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3652
3653static struct attribute *cons_dev_attrs[] = {
3654 &dev_attr_active.attr,
3655 NULL
3656};
3657
3658ATTRIBUTE_GROUPS(cons_dev);
3659
3660static struct device *consdev;
3661
3662void console_sysfs_notify(void)
3663{
3664 if (consdev)
3665 sysfs_notify(&consdev->kobj, NULL, "active");
3666}
3667
3668/*
3669 * Ok, now we can initialize the rest of the tty devices and can count
3670 * on memory allocations, interrupts etc..
3671 */
3672int __init tty_init(void)
3673{
3674 cdev_init(&tty_cdev, &tty_fops);
3675 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3676 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3677 panic("Couldn't register /dev/tty driver\n");
3678 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3679
3680 cdev_init(&console_cdev, &console_fops);
3681 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3682 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3683 panic("Couldn't register /dev/console driver\n");
3684 consdev = device_create_with_groups(tty_class, NULL,
3685 MKDEV(TTYAUX_MAJOR, 1), NULL,
3686 cons_dev_groups, "console");
3687 if (IS_ERR(consdev))
3688 consdev = NULL;
3689
3690#ifdef CONFIG_VT
3691 vty_init(&console_fops);
3692#endif
3693 return 0;
3694}
3695