1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 1991, 1992 Linus Torvalds
4 */
5
6/*
7 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
8 * or rs-channels. It also implements echoing, cooked mode etc.
9 *
10 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
11 *
12 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
13 * tty_struct and tty_queue structures. Previously there was an array
14 * of 256 tty_struct's which was statically allocated, and the
15 * tty_queue structures were allocated at boot time. Both are now
16 * dynamically allocated only when the tty is open.
17 *
18 * Also restructured routines so that there is more of a separation
19 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
20 * the low-level tty routines (serial.c, pty.c, console.c). This
21 * makes for cleaner and more compact code. -TYT, 9/17/92
22 *
23 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
24 * which can be dynamically activated and de-activated by the line
25 * discipline handling modules (like SLIP).
26 *
27 * NOTE: pay no attention to the line discipline code (yet); its
28 * interface is still subject to change in this version...
29 * -- TYT, 1/31/92
30 *
31 * Added functionality to the OPOST tty handling. No delays, but all
32 * other bits should be there.
33 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
34 *
35 * Rewrote canonical mode and added more termios flags.
36 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
37 *
38 * Reorganized FASYNC support so mouse code can share it.
39 * -- ctm@ardi.com, 9Sep95
40 *
41 * New TIOCLINUX variants added.
42 * -- mj@k332.feld.cvut.cz, 19-Nov-95
43 *
44 * Restrict vt switching via ioctl()
45 * -- grif@cs.ucr.edu, 5-Dec-95
46 *
47 * Move console and virtual terminal code to more appropriate files,
48 * implement CONFIG_VT and generalize console device interface.
49 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
50 *
51 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
52 * -- Bill Hawes <whawes@star.net>, June 97
53 *
54 * Added devfs support.
55 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
56 *
57 * Added support for a Unix98-style ptmx device.
58 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
59 *
60 * Reduced memory usage for older ARM systems
61 * -- Russell King <rmk@arm.linux.org.uk>
62 *
63 * Move do_SAK() into process context. Less stack use in devfs functions.
64 * alloc_tty_struct() always uses kmalloc()
65 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66 */
67
68#include <linux/types.h>
69#include <linux/major.h>
70#include <linux/errno.h>
71#include <linux/signal.h>
72#include <linux/fcntl.h>
73#include <linux/sched/signal.h>
74#include <linux/sched/task.h>
75#include <linux/interrupt.h>
76#include <linux/tty.h>
77#include <linux/tty_driver.h>
78#include <linux/tty_flip.h>
79#include <linux/devpts_fs.h>
80#include <linux/file.h>
81#include <linux/fdtable.h>
82#include <linux/console.h>
83#include <linux/timer.h>
84#include <linux/ctype.h>
85#include <linux/kd.h>
86#include <linux/mm.h>
87#include <linux/string.h>
88#include <linux/slab.h>
89#include <linux/poll.h>
90#include <linux/proc_fs.h>
91#include <linux/init.h>
92#include <linux/module.h>
93#include <linux/device.h>
94#include <linux/wait.h>
95#include <linux/bitops.h>
96#include <linux/delay.h>
97#include <linux/seq_file.h>
98#include <linux/serial.h>
99#include <linux/ratelimit.h>
100#include <linux/compat.h>
101
102#include <linux/uaccess.h>
103
104#include <linux/kbd_kern.h>
105#include <linux/vt_kern.h>
106#include <linux/selection.h>
107
108#include <linux/kmod.h>
109#include <linux/nsproxy.h>
110
111#undef TTY_DEBUG_HANGUP
112#ifdef TTY_DEBUG_HANGUP
113# define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
114#else
115# define tty_debug_hangup(tty, f, args...) do { } while (0)
116#endif
117
118#define TTY_PARANOIA_CHECK 1
119#define CHECK_TTY_COUNT 1
120
121struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
122 .c_iflag = ICRNL | IXON,
123 .c_oflag = OPOST | ONLCR,
124 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
125 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
126 ECHOCTL | ECHOKE | IEXTEN,
127 .c_cc = INIT_C_CC,
128 .c_ispeed = 38400,
129 .c_ospeed = 38400,
130 /* .c_line = N_TTY, */
131};
132
133EXPORT_SYMBOL(tty_std_termios);
134
135/* This list gets poked at by procfs and various bits of boot up code. This
136 could do with some rationalisation such as pulling the tty proc function
137 into this file */
138
139LIST_HEAD(tty_drivers); /* linked list of tty drivers */
140
141/* Mutex to protect creating and releasing a tty */
142DEFINE_MUTEX(tty_mutex);
143
144static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
145static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
146ssize_t redirected_tty_write(struct file *, const char __user *,
147 size_t, loff_t *);
148static __poll_t tty_poll(struct file *, poll_table *);
149static int tty_open(struct inode *, struct file *);
150long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
151#ifdef CONFIG_COMPAT
152static long tty_compat_ioctl(struct file *file, unsigned int cmd,
153 unsigned long arg);
154#else
155#define tty_compat_ioctl NULL
156#endif
157static int __tty_fasync(int fd, struct file *filp, int on);
158static int tty_fasync(int fd, struct file *filp, int on);
159static void release_tty(struct tty_struct *tty, int idx);
160
161/**
162 * free_tty_struct - free a disused tty
163 * @tty: tty struct to free
164 *
165 * Free the write buffers, tty queue and tty memory itself.
166 *
167 * Locking: none. Must be called after tty is definitely unused
168 */
169
170static void free_tty_struct(struct tty_struct *tty)
171{
172 tty_ldisc_deinit(tty);
173 put_device(tty->dev);
174 kfree(tty->write_buf);
175 tty->magic = 0xDEADDEAD;
176 kfree(tty);
177}
178
179static inline struct tty_struct *file_tty(struct file *file)
180{
181 return ((struct tty_file_private *)file->private_data)->tty;
182}
183
184int tty_alloc_file(struct file *file)
185{
186 struct tty_file_private *priv;
187
188 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
189 if (!priv)
190 return -ENOMEM;
191
192 file->private_data = priv;
193
194 return 0;
195}
196
197/* Associate a new file with the tty structure */
198void tty_add_file(struct tty_struct *tty, struct file *file)
199{
200 struct tty_file_private *priv = file->private_data;
201
202 priv->tty = tty;
203 priv->file = file;
204
205 spin_lock(&tty->files_lock);
206 list_add(&priv->list, &tty->tty_files);
207 spin_unlock(&tty->files_lock);
208}
209
210/**
211 * tty_free_file - free file->private_data
212 *
213 * This shall be used only for fail path handling when tty_add_file was not
214 * called yet.
215 */
216void tty_free_file(struct file *file)
217{
218 struct tty_file_private *priv = file->private_data;
219
220 file->private_data = NULL;
221 kfree(priv);
222}
223
224/* Delete file from its tty */
225static void tty_del_file(struct file *file)
226{
227 struct tty_file_private *priv = file->private_data;
228 struct tty_struct *tty = priv->tty;
229
230 spin_lock(&tty->files_lock);
231 list_del(&priv->list);
232 spin_unlock(&tty->files_lock);
233 tty_free_file(file);
234}
235
236/**
237 * tty_name - return tty naming
238 * @tty: tty structure
239 *
240 * Convert a tty structure into a name. The name reflects the kernel
241 * naming policy and if udev is in use may not reflect user space
242 *
243 * Locking: none
244 */
245
246const char *tty_name(const struct tty_struct *tty)
247{
248 if (!tty) /* Hmm. NULL pointer. That's fun. */
249 return "NULL tty";
250 return tty->name;
251}
252
253EXPORT_SYMBOL(tty_name);
254
255const char *tty_driver_name(const struct tty_struct *tty)
256{
257 if (!tty || !tty->driver)
258 return "";
259 return tty->driver->name;
260}
261
262static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
263 const char *routine)
264{
265#ifdef TTY_PARANOIA_CHECK
266 if (!tty) {
267 pr_warn("(%d:%d): %s: NULL tty\n",
268 imajor(inode), iminor(inode), routine);
269 return 1;
270 }
271 if (tty->magic != TTY_MAGIC) {
272 pr_warn("(%d:%d): %s: bad magic number\n",
273 imajor(inode), iminor(inode), routine);
274 return 1;
275 }
276#endif
277 return 0;
278}
279
280/* Caller must hold tty_lock */
281static int check_tty_count(struct tty_struct *tty, const char *routine)
282{
283#ifdef CHECK_TTY_COUNT
284 struct list_head *p;
285 int count = 0, kopen_count = 0;
286
287 spin_lock(&tty->files_lock);
288 list_for_each(p, &tty->tty_files) {
289 count++;
290 }
291 spin_unlock(&tty->files_lock);
292 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
293 tty->driver->subtype == PTY_TYPE_SLAVE &&
294 tty->link && tty->link->count)
295 count++;
296 if (tty_port_kopened(tty->port))
297 kopen_count++;
298 if (tty->count != (count + kopen_count)) {
299 tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
300 routine, tty->count, count, kopen_count);
301 return (count + kopen_count);
302 }
303#endif
304 return 0;
305}
306
307/**
308 * get_tty_driver - find device of a tty
309 * @dev_t: device identifier
310 * @index: returns the index of the tty
311 *
312 * This routine returns a tty driver structure, given a device number
313 * and also passes back the index number.
314 *
315 * Locking: caller must hold tty_mutex
316 */
317
318static struct tty_driver *get_tty_driver(dev_t device, int *index)
319{
320 struct tty_driver *p;
321
322 list_for_each_entry(p, &tty_drivers, tty_drivers) {
323 dev_t base = MKDEV(p->major, p->minor_start);
324 if (device < base || device >= base + p->num)
325 continue;
326 *index = device - base;
327 return tty_driver_kref_get(p);
328 }
329 return NULL;
330}
331
332/**
333 * tty_dev_name_to_number - return dev_t for device name
334 * @name: user space name of device under /dev
335 * @number: pointer to dev_t that this function will populate
336 *
337 * This function converts device names like ttyS0 or ttyUSB1 into dev_t
338 * like (4, 64) or (188, 1). If no corresponding driver is registered then
339 * the function returns -ENODEV.
340 *
341 * Locking: this acquires tty_mutex to protect the tty_drivers list from
342 * being modified while we are traversing it, and makes sure to
343 * release it before exiting.
344 */
345int tty_dev_name_to_number(const char *name, dev_t *number)
346{
347 struct tty_driver *p;
348 int ret;
349 int index, prefix_length = 0;
350 const char *str;
351
352 for (str = name; *str && !isdigit(*str); str++)
353 ;
354
355 if (!*str)
356 return -EINVAL;
357
358 ret = kstrtoint(str, 10, &index);
359 if (ret)
360 return ret;
361
362 prefix_length = str - name;
363 mutex_lock(&tty_mutex);
364
365 list_for_each_entry(p, &tty_drivers, tty_drivers)
366 if (prefix_length == strlen(p->name) && strncmp(name,
367 p->name, prefix_length) == 0) {
368 if (index < p->num) {
369 *number = MKDEV(p->major, p->minor_start + index);
370 goto out;
371 }
372 }
373
374 /* if here then driver wasn't found */
375 ret = -ENODEV;
376out:
377 mutex_unlock(&tty_mutex);
378 return ret;
379}
380EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
381
382#ifdef CONFIG_CONSOLE_POLL
383
384/**
385 * tty_find_polling_driver - find device of a polled tty
386 * @name: name string to match
387 * @line: pointer to resulting tty line nr
388 *
389 * This routine returns a tty driver structure, given a name
390 * and the condition that the tty driver is capable of polled
391 * operation.
392 */
393struct tty_driver *tty_find_polling_driver(char *name, int *line)
394{
395 struct tty_driver *p, *res = NULL;
396 int tty_line = 0;
397 int len;
398 char *str, *stp;
399
400 for (str = name; *str; str++)
401 if ((*str >= '0' && *str <= '9') || *str == ',')
402 break;
403 if (!*str)
404 return NULL;
405
406 len = str - name;
407 tty_line = simple_strtoul(str, &str, 10);
408
409 mutex_lock(&tty_mutex);
410 /* Search through the tty devices to look for a match */
411 list_for_each_entry(p, &tty_drivers, tty_drivers) {
412 if (!len || strncmp(name, p->name, len) != 0)
413 continue;
414 stp = str;
415 if (*stp == ',')
416 stp++;
417 if (*stp == '\0')
418 stp = NULL;
419
420 if (tty_line >= 0 && tty_line < p->num && p->ops &&
421 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
422 res = tty_driver_kref_get(p);
423 *line = tty_line;
424 break;
425 }
426 }
427 mutex_unlock(&tty_mutex);
428
429 return res;
430}
431EXPORT_SYMBOL_GPL(tty_find_polling_driver);
432#endif
433
434static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
435 size_t count, loff_t *ppos)
436{
437 return 0;
438}
439
440static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
441 size_t count, loff_t *ppos)
442{
443 return -EIO;
444}
445
446/* No kernel lock held - none needed ;) */
447static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
448{
449 return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
450}
451
452static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
453 unsigned long arg)
454{
455 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
456}
457
458static long hung_up_tty_compat_ioctl(struct file *file,
459 unsigned int cmd, unsigned long arg)
460{
461 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
462}
463
464static int hung_up_tty_fasync(int fd, struct file *file, int on)
465{
466 return -ENOTTY;
467}
468
469static void tty_show_fdinfo(struct seq_file *m, struct file *file)
470{
471 struct tty_struct *tty = file_tty(file);
472
473 if (tty && tty->ops && tty->ops->show_fdinfo)
474 tty->ops->show_fdinfo(tty, m);
475}
476
477static const struct file_operations tty_fops = {
478 .llseek = no_llseek,
479 .read = tty_read,
480 .write = tty_write,
481 .poll = tty_poll,
482 .unlocked_ioctl = tty_ioctl,
483 .compat_ioctl = tty_compat_ioctl,
484 .open = tty_open,
485 .release = tty_release,
486 .fasync = tty_fasync,
487 .show_fdinfo = tty_show_fdinfo,
488};
489
490static const struct file_operations console_fops = {
491 .llseek = no_llseek,
492 .read = tty_read,
493 .write = redirected_tty_write,
494 .poll = tty_poll,
495 .unlocked_ioctl = tty_ioctl,
496 .compat_ioctl = tty_compat_ioctl,
497 .open = tty_open,
498 .release = tty_release,
499 .fasync = tty_fasync,
500};
501
502static const struct file_operations hung_up_tty_fops = {
503 .llseek = no_llseek,
504 .read = hung_up_tty_read,
505 .write = hung_up_tty_write,
506 .poll = hung_up_tty_poll,
507 .unlocked_ioctl = hung_up_tty_ioctl,
508 .compat_ioctl = hung_up_tty_compat_ioctl,
509 .release = tty_release,
510 .fasync = hung_up_tty_fasync,
511};
512
513static DEFINE_SPINLOCK(redirect_lock);
514static struct file *redirect;
515
516extern void tty_sysctl_init(void);
517
518/**
519 * tty_wakeup - request more data
520 * @tty: terminal
521 *
522 * Internal and external helper for wakeups of tty. This function
523 * informs the line discipline if present that the driver is ready
524 * to receive more output data.
525 */
526
527void tty_wakeup(struct tty_struct *tty)
528{
529 struct tty_ldisc *ld;
530
531 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
532 ld = tty_ldisc_ref(tty);
533 if (ld) {
534 if (ld->ops->write_wakeup)
535 ld->ops->write_wakeup(tty);
536 tty_ldisc_deref(ld);
537 }
538 }
539 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
540}
541
542EXPORT_SYMBOL_GPL(tty_wakeup);
543
544/**
545 * __tty_hangup - actual handler for hangup events
546 * @work: tty device
547 *
548 * This can be called by a "kworker" kernel thread. That is process
549 * synchronous but doesn't hold any locks, so we need to make sure we
550 * have the appropriate locks for what we're doing.
551 *
552 * The hangup event clears any pending redirections onto the hung up
553 * device. It ensures future writes will error and it does the needed
554 * line discipline hangup and signal delivery. The tty object itself
555 * remains intact.
556 *
557 * Locking:
558 * BTM
559 * redirect lock for undoing redirection
560 * file list lock for manipulating list of ttys
561 * tty_ldiscs_lock from called functions
562 * termios_rwsem resetting termios data
563 * tasklist_lock to walk task list for hangup event
564 * ->siglock to protect ->signal/->sighand
565 */
566static void __tty_hangup(struct tty_struct *tty, int exit_session)
567{
568 struct file *cons_filp = NULL;
569 struct file *filp, *f = NULL;
570 struct tty_file_private *priv;
571 int closecount = 0, n;
572 int refs;
573
574 if (!tty)
575 return;
576
577
578 spin_lock(&redirect_lock);
579 if (redirect && file_tty(redirect) == tty) {
580 f = redirect;
581 redirect = NULL;
582 }
583 spin_unlock(&redirect_lock);
584
585 tty_lock(tty);
586
587 if (test_bit(TTY_HUPPED, &tty->flags)) {
588 tty_unlock(tty);
589 return;
590 }
591
592 /*
593 * Some console devices aren't actually hung up for technical and
594 * historical reasons, which can lead to indefinite interruptible
595 * sleep in n_tty_read(). The following explicitly tells
596 * n_tty_read() to abort readers.
597 */
598 set_bit(TTY_HUPPING, &tty->flags);
599
600 /* inuse_filps is protected by the single tty lock,
601 this really needs to change if we want to flush the
602 workqueue with the lock held */
603 check_tty_count(tty, "tty_hangup");
604
605 spin_lock(&tty->files_lock);
606 /* This breaks for file handles being sent over AF_UNIX sockets ? */
607 list_for_each_entry(priv, &tty->tty_files, list) {
608 filp = priv->file;
609 if (filp->f_op->write == redirected_tty_write)
610 cons_filp = filp;
611 if (filp->f_op->write != tty_write)
612 continue;
613 closecount++;
614 __tty_fasync(-1, filp, 0); /* can't block */
615 filp->f_op = &hung_up_tty_fops;
616 }
617 spin_unlock(&tty->files_lock);
618
619 refs = tty_signal_session_leader(tty, exit_session);
620 /* Account for the p->signal references we killed */
621 while (refs--)
622 tty_kref_put(tty);
623
624 tty_ldisc_hangup(tty, cons_filp != NULL);
625
626 spin_lock_irq(&tty->ctrl_lock);
627 clear_bit(TTY_THROTTLED, &tty->flags);
628 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
629 put_pid(tty->session);
630 put_pid(tty->pgrp);
631 tty->session = NULL;
632 tty->pgrp = NULL;
633 tty->ctrl_status = 0;
634 spin_unlock_irq(&tty->ctrl_lock);
635
636 /*
637 * If one of the devices matches a console pointer, we
638 * cannot just call hangup() because that will cause
639 * tty->count and state->count to go out of sync.
640 * So we just call close() the right number of times.
641 */
642 if (cons_filp) {
643 if (tty->ops->close)
644 for (n = 0; n < closecount; n++)
645 tty->ops->close(tty, cons_filp);
646 } else if (tty->ops->hangup)
647 tty->ops->hangup(tty);
648 /*
649 * We don't want to have driver/ldisc interactions beyond the ones
650 * we did here. The driver layer expects no calls after ->hangup()
651 * from the ldisc side, which is now guaranteed.
652 */
653 set_bit(TTY_HUPPED, &tty->flags);
654 clear_bit(TTY_HUPPING, &tty->flags);
655 tty_unlock(tty);
656
657 if (f)
658 fput(f);
659}
660
661static void do_tty_hangup(struct work_struct *work)
662{
663 struct tty_struct *tty =
664 container_of(work, struct tty_struct, hangup_work);
665
666 __tty_hangup(tty, 0);
667}
668
669/**
670 * tty_hangup - trigger a hangup event
671 * @tty: tty to hangup
672 *
673 * A carrier loss (virtual or otherwise) has occurred on this like
674 * schedule a hangup sequence to run after this event.
675 */
676
677void tty_hangup(struct tty_struct *tty)
678{
679 tty_debug_hangup(tty, "hangup\n");
680 schedule_work(&tty->hangup_work);
681}
682
683EXPORT_SYMBOL(tty_hangup);
684
685/**
686 * tty_vhangup - process vhangup
687 * @tty: tty to hangup
688 *
689 * The user has asked via system call for the terminal to be hung up.
690 * We do this synchronously so that when the syscall returns the process
691 * is complete. That guarantee is necessary for security reasons.
692 */
693
694void tty_vhangup(struct tty_struct *tty)
695{
696 tty_debug_hangup(tty, "vhangup\n");
697 __tty_hangup(tty, 0);
698}
699
700EXPORT_SYMBOL(tty_vhangup);
701
702
703/**
704 * tty_vhangup_self - process vhangup for own ctty
705 *
706 * Perform a vhangup on the current controlling tty
707 */
708
709void tty_vhangup_self(void)
710{
711 struct tty_struct *tty;
712
713 tty = get_current_tty();
714 if (tty) {
715 tty_vhangup(tty);
716 tty_kref_put(tty);
717 }
718}
719
720/**
721 * tty_vhangup_session - hangup session leader exit
722 * @tty: tty to hangup
723 *
724 * The session leader is exiting and hanging up its controlling terminal.
725 * Every process in the foreground process group is signalled SIGHUP.
726 *
727 * We do this synchronously so that when the syscall returns the process
728 * is complete. That guarantee is necessary for security reasons.
729 */
730
731void tty_vhangup_session(struct tty_struct *tty)
732{
733 tty_debug_hangup(tty, "session hangup\n");
734 __tty_hangup(tty, 1);
735}
736
737/**
738 * tty_hung_up_p - was tty hung up
739 * @filp: file pointer of tty
740 *
741 * Return true if the tty has been subject to a vhangup or a carrier
742 * loss
743 */
744
745int tty_hung_up_p(struct file *filp)
746{
747 return (filp && filp->f_op == &hung_up_tty_fops);
748}
749
750EXPORT_SYMBOL(tty_hung_up_p);
751
752/**
753 * stop_tty - propagate flow control
754 * @tty: tty to stop
755 *
756 * Perform flow control to the driver. May be called
757 * on an already stopped device and will not re-call the driver
758 * method.
759 *
760 * This functionality is used by both the line disciplines for
761 * halting incoming flow and by the driver. It may therefore be
762 * called from any context, may be under the tty atomic_write_lock
763 * but not always.
764 *
765 * Locking:
766 * flow_lock
767 */
768
769void __stop_tty(struct tty_struct *tty)
770{
771 if (tty->stopped)
772 return;
773 tty->stopped = 1;
774 if (tty->ops->stop)
775 tty->ops->stop(tty);
776}
777
778void stop_tty(struct tty_struct *tty)
779{
780 unsigned long flags;
781
782 spin_lock_irqsave(&tty->flow_lock, flags);
783 __stop_tty(tty);
784 spin_unlock_irqrestore(&tty->flow_lock, flags);
785}
786EXPORT_SYMBOL(stop_tty);
787
788/**
789 * start_tty - propagate flow control
790 * @tty: tty to start
791 *
792 * Start a tty that has been stopped if at all possible. If this
793 * tty was previous stopped and is now being started, the driver
794 * start method is invoked and the line discipline woken.
795 *
796 * Locking:
797 * flow_lock
798 */
799
800void __start_tty(struct tty_struct *tty)
801{
802 if (!tty->stopped || tty->flow_stopped)
803 return;
804 tty->stopped = 0;
805 if (tty->ops->start)
806 tty->ops->start(tty);
807 tty_wakeup(tty);
808}
809
810void start_tty(struct tty_struct *tty)
811{
812 unsigned long flags;
813
814 spin_lock_irqsave(&tty->flow_lock, flags);
815 __start_tty(tty);
816 spin_unlock_irqrestore(&tty->flow_lock, flags);
817}
818EXPORT_SYMBOL(start_tty);
819
820static void tty_update_time(struct timespec64 *time)
821{
822 time64_t sec = ktime_get_real_seconds();
823
824 /*
825 * We only care if the two values differ in anything other than the
826 * lower three bits (i.e every 8 seconds). If so, then we can update
827 * the time of the tty device, otherwise it could be construded as a
828 * security leak to let userspace know the exact timing of the tty.
829 */
830 if ((sec ^ time->tv_sec) & ~7)
831 time->tv_sec = sec;
832}
833
834/**
835 * tty_read - read method for tty device files
836 * @file: pointer to tty file
837 * @buf: user buffer
838 * @count: size of user buffer
839 * @ppos: unused
840 *
841 * Perform the read system call function on this terminal device. Checks
842 * for hung up devices before calling the line discipline method.
843 *
844 * Locking:
845 * Locks the line discipline internally while needed. Multiple
846 * read calls may be outstanding in parallel.
847 */
848
849static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
850 loff_t *ppos)
851{
852 int i;
853 struct inode *inode = file_inode(file);
854 struct tty_struct *tty = file_tty(file);
855 struct tty_ldisc *ld;
856
857 if (tty_paranoia_check(tty, inode, "tty_read"))
858 return -EIO;
859 if (!tty || tty_io_error(tty))
860 return -EIO;
861
862 /* We want to wait for the line discipline to sort out in this
863 situation */
864 ld = tty_ldisc_ref_wait(tty);
865 if (!ld)
866 return hung_up_tty_read(file, buf, count, ppos);
867 if (ld->ops->read)
868 i = ld->ops->read(tty, file, buf, count);
869 else
870 i = -EIO;
871 tty_ldisc_deref(ld);
872
873 if (i > 0)
874 tty_update_time(&inode->i_atime);
875
876 return i;
877}
878
879static void tty_write_unlock(struct tty_struct *tty)
880{
881 mutex_unlock(&tty->atomic_write_lock);
882 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
883}
884
885static int tty_write_lock(struct tty_struct *tty, int ndelay)
886{
887 if (!mutex_trylock(&tty->atomic_write_lock)) {
888 if (ndelay)
889 return -EAGAIN;
890 if (mutex_lock_interruptible(&tty->atomic_write_lock))
891 return -ERESTARTSYS;
892 }
893 return 0;
894}
895
896/*
897 * Split writes up in sane blocksizes to avoid
898 * denial-of-service type attacks
899 */
900static inline ssize_t do_tty_write(
901 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
902 struct tty_struct *tty,
903 struct file *file,
904 const char __user *buf,
905 size_t count)
906{
907 ssize_t ret, written = 0;
908 unsigned int chunk;
909
910 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
911 if (ret < 0)
912 return ret;
913
914 /*
915 * We chunk up writes into a temporary buffer. This
916 * simplifies low-level drivers immensely, since they
917 * don't have locking issues and user mode accesses.
918 *
919 * But if TTY_NO_WRITE_SPLIT is set, we should use a
920 * big chunk-size..
921 *
922 * The default chunk-size is 2kB, because the NTTY
923 * layer has problems with bigger chunks. It will
924 * claim to be able to handle more characters than
925 * it actually does.
926 *
927 * FIXME: This can probably go away now except that 64K chunks
928 * are too likely to fail unless switched to vmalloc...
929 */
930 chunk = 2048;
931 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
932 chunk = 65536;
933 if (count < chunk)
934 chunk = count;
935
936 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
937 if (tty->write_cnt < chunk) {
938 unsigned char *buf_chunk;
939
940 if (chunk < 1024)
941 chunk = 1024;
942
943 buf_chunk = kmalloc(chunk, GFP_KERNEL);
944 if (!buf_chunk) {
945 ret = -ENOMEM;
946 goto out;
947 }
948 kfree(tty->write_buf);
949 tty->write_cnt = chunk;
950 tty->write_buf = buf_chunk;
951 }
952
953 /* Do the write .. */
954 for (;;) {
955 size_t size = count;
956 if (size > chunk)
957 size = chunk;
958 ret = -EFAULT;
959 if (copy_from_user(tty->write_buf, buf, size))
960 break;
961 ret = write(tty, file, tty->write_buf, size);
962 if (ret <= 0)
963 break;
964 written += ret;
965 buf += ret;
966 count -= ret;
967 if (!count)
968 break;
969 ret = -ERESTARTSYS;
970 if (signal_pending(current))
971 break;
972 cond_resched();
973 }
974 if (written) {
975 tty_update_time(&file_inode(file)->i_mtime);
976 ret = written;
977 }
978out:
979 tty_write_unlock(tty);
980 return ret;
981}
982
983/**
984 * tty_write_message - write a message to a certain tty, not just the console.
985 * @tty: the destination tty_struct
986 * @msg: the message to write
987 *
988 * This is used for messages that need to be redirected to a specific tty.
989 * We don't put it into the syslog queue right now maybe in the future if
990 * really needed.
991 *
992 * We must still hold the BTM and test the CLOSING flag for the moment.
993 */
994
995void tty_write_message(struct tty_struct *tty, char *msg)
996{
997 if (tty) {
998 mutex_lock(&tty->atomic_write_lock);
999 tty_lock(tty);
1000 if (tty->ops->write && tty->count > 0)
1001 tty->ops->write(tty, msg, strlen(msg));
1002 tty_unlock(tty);
1003 tty_write_unlock(tty);
1004 }
1005 return;
1006}
1007
1008
1009/**
1010 * tty_write - write method for tty device file
1011 * @file: tty file pointer
1012 * @buf: user data to write
1013 * @count: bytes to write
1014 * @ppos: unused
1015 *
1016 * Write data to a tty device via the line discipline.
1017 *
1018 * Locking:
1019 * Locks the line discipline as required
1020 * Writes to the tty driver are serialized by the atomic_write_lock
1021 * and are then processed in chunks to the device. The line discipline
1022 * write method will not be invoked in parallel for each device.
1023 */
1024
1025static ssize_t tty_write(struct file *file, const char __user *buf,
1026 size_t count, loff_t *ppos)
1027{
1028 struct tty_struct *tty = file_tty(file);
1029 struct tty_ldisc *ld;
1030 ssize_t ret;
1031
1032 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1033 return -EIO;
1034 if (!tty || !tty->ops->write || tty_io_error(tty))
1035 return -EIO;
1036 /* Short term debug to catch buggy drivers */
1037 if (tty->ops->write_room == NULL)
1038 tty_err(tty, "missing write_room method\n");
1039 ld = tty_ldisc_ref_wait(tty);
1040 if (!ld)
1041 return hung_up_tty_write(file, buf, count, ppos);
1042 if (!ld->ops->write)
1043 ret = -EIO;
1044 else
1045 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1046 tty_ldisc_deref(ld);
1047 return ret;
1048}
1049
1050ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1051 size_t count, loff_t *ppos)
1052{
1053 struct file *p = NULL;
1054
1055 spin_lock(&redirect_lock);
1056 if (redirect)
1057 p = get_file(redirect);
1058 spin_unlock(&redirect_lock);
1059
1060 if (p) {
1061 ssize_t res;
1062 res = vfs_write(p, buf, count, &p->f_pos);
1063 fput(p);
1064 return res;
1065 }
1066 return tty_write(file, buf, count, ppos);
1067}
1068
1069/**
1070 * tty_send_xchar - send priority character
1071 *
1072 * Send a high priority character to the tty even if stopped
1073 *
1074 * Locking: none for xchar method, write ordering for write method.
1075 */
1076
1077int tty_send_xchar(struct tty_struct *tty, char ch)
1078{
1079 int was_stopped = tty->stopped;
1080
1081 if (tty->ops->send_xchar) {
1082 down_read(&tty->termios_rwsem);
1083 tty->ops->send_xchar(tty, ch);
1084 up_read(&tty->termios_rwsem);
1085 return 0;
1086 }
1087
1088 if (tty_write_lock(tty, 0) < 0)
1089 return -ERESTARTSYS;
1090
1091 down_read(&tty->termios_rwsem);
1092 if (was_stopped)
1093 start_tty(tty);
1094 tty->ops->write(tty, &ch, 1);
1095 if (was_stopped)
1096 stop_tty(tty);
1097 up_read(&tty->termios_rwsem);
1098 tty_write_unlock(tty);
1099 return 0;
1100}
1101
1102static char ptychar[] = "pqrstuvwxyzabcde";
1103
1104/**
1105 * pty_line_name - generate name for a pty
1106 * @driver: the tty driver in use
1107 * @index: the minor number
1108 * @p: output buffer of at least 6 bytes
1109 *
1110 * Generate a name from a driver reference and write it to the output
1111 * buffer.
1112 *
1113 * Locking: None
1114 */
1115static void pty_line_name(struct tty_driver *driver, int index, char *p)
1116{
1117 int i = index + driver->name_base;
1118 /* ->name is initialized to "ttyp", but "tty" is expected */
1119 sprintf(p, "%s%c%x",
1120 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1121 ptychar[i >> 4 & 0xf], i & 0xf);
1122}
1123
1124/**
1125 * tty_line_name - generate name for a tty
1126 * @driver: the tty driver in use
1127 * @index: the minor number
1128 * @p: output buffer of at least 7 bytes
1129 *
1130 * Generate a name from a driver reference and write it to the output
1131 * buffer.
1132 *
1133 * Locking: None
1134 */
1135static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1136{
1137 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1138 return sprintf(p, "%s", driver->name);
1139 else
1140 return sprintf(p, "%s%d", driver->name,
1141 index + driver->name_base);
1142}
1143
1144/**
1145 * tty_driver_lookup_tty() - find an existing tty, if any
1146 * @driver: the driver for the tty
1147 * @idx: the minor number
1148 *
1149 * Return the tty, if found. If not found, return NULL or ERR_PTR() if the
1150 * driver lookup() method returns an error.
1151 *
1152 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1153 */
1154static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1155 struct file *file, int idx)
1156{
1157 struct tty_struct *tty;
1158
1159 if (driver->ops->lookup)
1160 if (!file)
1161 tty = ERR_PTR(-EIO);
1162 else
1163 tty = driver->ops->lookup(driver, file, idx);
1164 else
1165 tty = driver->ttys[idx];
1166
1167 if (!IS_ERR(tty))
1168 tty_kref_get(tty);
1169 return tty;
1170}
1171
1172/**
1173 * tty_init_termios - helper for termios setup
1174 * @tty: the tty to set up
1175 *
1176 * Initialise the termios structures for this tty. Thus runs under
1177 * the tty_mutex currently so we can be relaxed about ordering.
1178 */
1179
1180void tty_init_termios(struct tty_struct *tty)
1181{
1182 struct ktermios *tp;
1183 int idx = tty->index;
1184
1185 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1186 tty->termios = tty->driver->init_termios;
1187 else {
1188 /* Check for lazy saved data */
1189 tp = tty->driver->termios[idx];
1190 if (tp != NULL) {
1191 tty->termios = *tp;
1192 tty->termios.c_line = tty->driver->init_termios.c_line;
1193 } else
1194 tty->termios = tty->driver->init_termios;
1195 }
1196 /* Compatibility until drivers always set this */
1197 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1198 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1199}
1200EXPORT_SYMBOL_GPL(tty_init_termios);
1201
1202int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1203{
1204 tty_init_termios(tty);
1205 tty_driver_kref_get(driver);
1206 tty->count++;
1207 driver->ttys[tty->index] = tty;
1208 return 0;
1209}
1210EXPORT_SYMBOL_GPL(tty_standard_install);
1211
1212/**
1213 * tty_driver_install_tty() - install a tty entry in the driver
1214 * @driver: the driver for the tty
1215 * @tty: the tty
1216 *
1217 * Install a tty object into the driver tables. The tty->index field
1218 * will be set by the time this is called. This method is responsible
1219 * for ensuring any need additional structures are allocated and
1220 * configured.
1221 *
1222 * Locking: tty_mutex for now
1223 */
1224static int tty_driver_install_tty(struct tty_driver *driver,
1225 struct tty_struct *tty)
1226{
1227 return driver->ops->install ? driver->ops->install(driver, tty) :
1228 tty_standard_install(driver, tty);
1229}
1230
1231/**
1232 * tty_driver_remove_tty() - remove a tty from the driver tables
1233 * @driver: the driver for the tty
1234 * @idx: the minor number
1235 *
1236 * Remvoe a tty object from the driver tables. The tty->index field
1237 * will be set by the time this is called.
1238 *
1239 * Locking: tty_mutex for now
1240 */
1241static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1242{
1243 if (driver->ops->remove)
1244 driver->ops->remove(driver, tty);
1245 else
1246 driver->ttys[tty->index] = NULL;
1247}
1248
1249/*
1250 * tty_reopen() - fast re-open of an open tty
1251 * @tty - the tty to open
1252 *
1253 * Return 0 on success, -errno on error.
1254 * Re-opens on master ptys are not allowed and return -EIO.
1255 *
1256 * Locking: Caller must hold tty_lock
1257 */
1258static int tty_reopen(struct tty_struct *tty)
1259{
1260 struct tty_driver *driver = tty->driver;
1261 struct tty_ldisc *ld;
1262 int retval = 0;
1263
1264 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1265 driver->subtype == PTY_TYPE_MASTER)
1266 return -EIO;
1267
1268 if (!tty->count)
1269 return -EAGAIN;
1270
1271 if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1272 return -EBUSY;
1273
1274 ld = tty_ldisc_ref_wait(tty);
1275 if (ld) {
1276 tty_ldisc_deref(ld);
1277 } else {
1278 retval = tty_ldisc_lock(tty, 5 * HZ);
1279 if (retval)
1280 return retval;
1281
1282 if (!tty->ldisc)
1283 retval = tty_ldisc_reinit(tty, tty->termios.c_line);
1284 tty_ldisc_unlock(tty);
1285 }
1286
1287 if (retval == 0)
1288 tty->count++;
1289
1290 return retval;
1291}
1292
1293/**
1294 * tty_init_dev - initialise a tty device
1295 * @driver: tty driver we are opening a device on
1296 * @idx: device index
1297 * @ret_tty: returned tty structure
1298 *
1299 * Prepare a tty device. This may not be a "new" clean device but
1300 * could also be an active device. The pty drivers require special
1301 * handling because of this.
1302 *
1303 * Locking:
1304 * The function is called under the tty_mutex, which
1305 * protects us from the tty struct or driver itself going away.
1306 *
1307 * On exit the tty device has the line discipline attached and
1308 * a reference count of 1. If a pair was created for pty/tty use
1309 * and the other was a pty master then it too has a reference count of 1.
1310 *
1311 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1312 * failed open. The new code protects the open with a mutex, so it's
1313 * really quite straightforward. The mutex locking can probably be
1314 * relaxed for the (most common) case of reopening a tty.
1315 */
1316
1317struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1318{
1319 struct tty_struct *tty;
1320 int retval;
1321
1322 /*
1323 * First time open is complex, especially for PTY devices.
1324 * This code guarantees that either everything succeeds and the
1325 * TTY is ready for operation, or else the table slots are vacated
1326 * and the allocated memory released. (Except that the termios
1327 * may be retained.)
1328 */
1329
1330 if (!try_module_get(driver->owner))
1331 return ERR_PTR(-ENODEV);
1332
1333 tty = alloc_tty_struct(driver, idx);
1334 if (!tty) {
1335 retval = -ENOMEM;
1336 goto err_module_put;
1337 }
1338
1339 tty_lock(tty);
1340 retval = tty_driver_install_tty(driver, tty);
1341 if (retval < 0)
1342 goto err_free_tty;
1343
1344 if (!tty->port)
1345 tty->port = driver->ports[idx];
1346
1347 WARN_RATELIMIT(!tty->port,
1348 "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1349 __func__, tty->driver->name);
1350
1351 retval = tty_ldisc_lock(tty, 5 * HZ);
1352 if (retval)
1353 goto err_release_lock;
1354 tty->port->itty = tty;
1355
1356 /*
1357 * Structures all installed ... call the ldisc open routines.
1358 * If we fail here just call release_tty to clean up. No need
1359 * to decrement the use counts, as release_tty doesn't care.
1360 */
1361 retval = tty_ldisc_setup(tty, tty->link);
1362 if (retval)
1363 goto err_release_tty;
1364 tty_ldisc_unlock(tty);
1365 /* Return the tty locked so that it cannot vanish under the caller */
1366 return tty;
1367
1368err_free_tty:
1369 tty_unlock(tty);
1370 free_tty_struct(tty);
1371err_module_put:
1372 module_put(driver->owner);
1373 return ERR_PTR(retval);
1374
1375 /* call the tty release_tty routine to clean out this slot */
1376err_release_tty:
1377 tty_ldisc_unlock(tty);
1378 tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1379 retval, idx);
1380err_release_lock:
1381 tty_unlock(tty);
1382 release_tty(tty, idx);
1383 return ERR_PTR(retval);
1384}
1385
1386/**
1387 * tty_save_termios() - save tty termios data in driver table
1388 * @tty: tty whose termios data to save
1389 *
1390 * Locking: Caller guarantees serialisation with tty_init_termios().
1391 */
1392void tty_save_termios(struct tty_struct *tty)
1393{
1394 struct ktermios *tp;
1395 int idx = tty->index;
1396
1397 /* If the port is going to reset then it has no termios to save */
1398 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1399 return;
1400
1401 /* Stash the termios data */
1402 tp = tty->driver->termios[idx];
1403 if (tp == NULL) {
1404 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1405 if (tp == NULL)
1406 return;
1407 tty->driver->termios[idx] = tp;
1408 }
1409 *tp = tty->termios;
1410}
1411EXPORT_SYMBOL_GPL(tty_save_termios);
1412
1413/**
1414 * tty_flush_works - flush all works of a tty/pty pair
1415 * @tty: tty device to flush works for (or either end of a pty pair)
1416 *
1417 * Sync flush all works belonging to @tty (and the 'other' tty).
1418 */
1419static void tty_flush_works(struct tty_struct *tty)
1420{
1421 flush_work(&tty->SAK_work);
1422 flush_work(&tty->hangup_work);
1423 if (tty->link) {
1424 flush_work(&tty->link->SAK_work);
1425 flush_work(&tty->link->hangup_work);
1426 }
1427}
1428
1429/**
1430 * release_one_tty - release tty structure memory
1431 * @kref: kref of tty we are obliterating
1432 *
1433 * Releases memory associated with a tty structure, and clears out the
1434 * driver table slots. This function is called when a device is no longer
1435 * in use. It also gets called when setup of a device fails.
1436 *
1437 * Locking:
1438 * takes the file list lock internally when working on the list
1439 * of ttys that the driver keeps.
1440 *
1441 * This method gets called from a work queue so that the driver private
1442 * cleanup ops can sleep (needed for USB at least)
1443 */
1444static void release_one_tty(struct work_struct *work)
1445{
1446 struct tty_struct *tty =
1447 container_of(work, struct tty_struct, hangup_work);
1448 struct tty_driver *driver = tty->driver;
1449 struct module *owner = driver->owner;
1450
1451 if (tty->ops->cleanup)
1452 tty->ops->cleanup(tty);
1453
1454 tty->magic = 0;
1455 tty_driver_kref_put(driver);
1456 module_put(owner);
1457
1458 spin_lock(&tty->files_lock);
1459 list_del_init(&tty->tty_files);
1460 spin_unlock(&tty->files_lock);
1461
1462 put_pid(tty->pgrp);
1463 put_pid(tty->session);
1464 free_tty_struct(tty);
1465}
1466
1467static void queue_release_one_tty(struct kref *kref)
1468{
1469 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1470
1471 /* The hangup queue is now free so we can reuse it rather than
1472 waste a chunk of memory for each port */
1473 INIT_WORK(&tty->hangup_work, release_one_tty);
1474 schedule_work(&tty->hangup_work);
1475}
1476
1477/**
1478 * tty_kref_put - release a tty kref
1479 * @tty: tty device
1480 *
1481 * Release a reference to a tty device and if need be let the kref
1482 * layer destruct the object for us
1483 */
1484
1485void tty_kref_put(struct tty_struct *tty)
1486{
1487 if (tty)
1488 kref_put(&tty->kref, queue_release_one_tty);
1489}
1490EXPORT_SYMBOL(tty_kref_put);
1491
1492/**
1493 * release_tty - release tty structure memory
1494 *
1495 * Release both @tty and a possible linked partner (think pty pair),
1496 * and decrement the refcount of the backing module.
1497 *
1498 * Locking:
1499 * tty_mutex
1500 * takes the file list lock internally when working on the list
1501 * of ttys that the driver keeps.
1502 *
1503 */
1504static void release_tty(struct tty_struct *tty, int idx)
1505{
1506 /* This should always be true but check for the moment */
1507 WARN_ON(tty->index != idx);
1508 WARN_ON(!mutex_is_locked(&tty_mutex));
1509 if (tty->ops->shutdown)
1510 tty->ops->shutdown(tty);
1511 tty_save_termios(tty);
1512 tty_driver_remove_tty(tty->driver, tty);
1513 tty->port->itty = NULL;
1514 if (tty->link)
1515 tty->link->port->itty = NULL;
1516 tty_buffer_cancel_work(tty->port);
1517 if (tty->link)
1518 tty_buffer_cancel_work(tty->link->port);
1519
1520 tty_kref_put(tty->link);
1521 tty_kref_put(tty);
1522}
1523
1524/**
1525 * tty_release_checks - check a tty before real release
1526 * @tty: tty to check
1527 * @o_tty: link of @tty (if any)
1528 * @idx: index of the tty
1529 *
1530 * Performs some paranoid checking before true release of the @tty.
1531 * This is a no-op unless TTY_PARANOIA_CHECK is defined.
1532 */
1533static int tty_release_checks(struct tty_struct *tty, int idx)
1534{
1535#ifdef TTY_PARANOIA_CHECK
1536 if (idx < 0 || idx >= tty->driver->num) {
1537 tty_debug(tty, "bad idx %d\n", idx);
1538 return -1;
1539 }
1540
1541 /* not much to check for devpts */
1542 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1543 return 0;
1544
1545 if (tty != tty->driver->ttys[idx]) {
1546 tty_debug(tty, "bad driver table[%d] = %p\n",
1547 idx, tty->driver->ttys[idx]);
1548 return -1;
1549 }
1550 if (tty->driver->other) {
1551 struct tty_struct *o_tty = tty->link;
1552
1553 if (o_tty != tty->driver->other->ttys[idx]) {
1554 tty_debug(tty, "bad other table[%d] = %p\n",
1555 idx, tty->driver->other->ttys[idx]);
1556 return -1;
1557 }
1558 if (o_tty->link != tty) {
1559 tty_debug(tty, "bad link = %p\n", o_tty->link);
1560 return -1;
1561 }
1562 }
1563#endif
1564 return 0;
1565}
1566
1567/**
1568 * tty_kclose - closes tty opened by tty_kopen
1569 * @tty: tty device
1570 *
1571 * Performs the final steps to release and free a tty device. It is the
1572 * same as tty_release_struct except that it also resets TTY_PORT_KOPENED
1573 * flag on tty->port.
1574 */
1575void tty_kclose(struct tty_struct *tty)
1576{
1577 /*
1578 * Ask the line discipline code to release its structures
1579 */
1580 tty_ldisc_release(tty);
1581
1582 /* Wait for pending work before tty destruction commmences */
1583 tty_flush_works(tty);
1584
1585 tty_debug_hangup(tty, "freeing structure\n");
1586 /*
1587 * The release_tty function takes care of the details of clearing
1588 * the slots and preserving the termios structure. The tty_unlock_pair
1589 * should be safe as we keep a kref while the tty is locked (so the
1590 * unlock never unlocks a freed tty).
1591 */
1592 mutex_lock(&tty_mutex);
1593 tty_port_set_kopened(tty->port, 0);
1594 release_tty(tty, tty->index);
1595 mutex_unlock(&tty_mutex);
1596}
1597EXPORT_SYMBOL_GPL(tty_kclose);
1598
1599/**
1600 * tty_release_struct - release a tty struct
1601 * @tty: tty device
1602 * @idx: index of the tty
1603 *
1604 * Performs the final steps to release and free a tty device. It is
1605 * roughly the reverse of tty_init_dev.
1606 */
1607void tty_release_struct(struct tty_struct *tty, int idx)
1608{
1609 /*
1610 * Ask the line discipline code to release its structures
1611 */
1612 tty_ldisc_release(tty);
1613
1614 /* Wait for pending work before tty destruction commmences */
1615 tty_flush_works(tty);
1616
1617 tty_debug_hangup(tty, "freeing structure\n");
1618 /*
1619 * The release_tty function takes care of the details of clearing
1620 * the slots and preserving the termios structure. The tty_unlock_pair
1621 * should be safe as we keep a kref while the tty is locked (so the
1622 * unlock never unlocks a freed tty).
1623 */
1624 mutex_lock(&tty_mutex);
1625 release_tty(tty, idx);
1626 mutex_unlock(&tty_mutex);
1627}
1628EXPORT_SYMBOL_GPL(tty_release_struct);
1629
1630/**
1631 * tty_release - vfs callback for close
1632 * @inode: inode of tty
1633 * @filp: file pointer for handle to tty
1634 *
1635 * Called the last time each file handle is closed that references
1636 * this tty. There may however be several such references.
1637 *
1638 * Locking:
1639 * Takes bkl. See tty_release_dev
1640 *
1641 * Even releasing the tty structures is a tricky business.. We have
1642 * to be very careful that the structures are all released at the
1643 * same time, as interrupts might otherwise get the wrong pointers.
1644 *
1645 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1646 * lead to double frees or releasing memory still in use.
1647 */
1648
1649int tty_release(struct inode *inode, struct file *filp)
1650{
1651 struct tty_struct *tty = file_tty(filp);
1652 struct tty_struct *o_tty = NULL;
1653 int do_sleep, final;
1654 int idx;
1655 long timeout = 0;
1656 int once = 1;
1657
1658 if (tty_paranoia_check(tty, inode, __func__))
1659 return 0;
1660
1661 tty_lock(tty);
1662 check_tty_count(tty, __func__);
1663
1664 __tty_fasync(-1, filp, 0);
1665
1666 idx = tty->index;
1667 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1668 tty->driver->subtype == PTY_TYPE_MASTER)
1669 o_tty = tty->link;
1670
1671 if (tty_release_checks(tty, idx)) {
1672 tty_unlock(tty);
1673 return 0;
1674 }
1675
1676 tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1677
1678 if (tty->ops->close)
1679 tty->ops->close(tty, filp);
1680
1681 /* If tty is pty master, lock the slave pty (stable lock order) */
1682 tty_lock_slave(o_tty);
1683
1684 /*
1685 * Sanity check: if tty->count is going to zero, there shouldn't be
1686 * any waiters on tty->read_wait or tty->write_wait. We test the
1687 * wait queues and kick everyone out _before_ actually starting to
1688 * close. This ensures that we won't block while releasing the tty
1689 * structure.
1690 *
1691 * The test for the o_tty closing is necessary, since the master and
1692 * slave sides may close in any order. If the slave side closes out
1693 * first, its count will be one, since the master side holds an open.
1694 * Thus this test wouldn't be triggered at the time the slave closed,
1695 * so we do it now.
1696 */
1697 while (1) {
1698 do_sleep = 0;
1699
1700 if (tty->count <= 1) {
1701 if (waitqueue_active(&tty->read_wait)) {
1702 wake_up_poll(&tty->read_wait, EPOLLIN);
1703 do_sleep++;
1704 }
1705 if (waitqueue_active(&tty->write_wait)) {
1706 wake_up_poll(&tty->write_wait, EPOLLOUT);
1707 do_sleep++;
1708 }
1709 }
1710 if (o_tty && o_tty->count <= 1) {
1711 if (waitqueue_active(&o_tty->read_wait)) {
1712 wake_up_poll(&o_tty->read_wait, EPOLLIN);
1713 do_sleep++;
1714 }
1715 if (waitqueue_active(&o_tty->write_wait)) {
1716 wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1717 do_sleep++;
1718 }
1719 }
1720 if (!do_sleep)
1721 break;
1722
1723 if (once) {
1724 once = 0;
1725 tty_warn(tty, "read/write wait queue active!\n");
1726 }
1727 schedule_timeout_killable(timeout);
1728 if (timeout < 120 * HZ)
1729 timeout = 2 * timeout + 1;
1730 else
1731 timeout = MAX_SCHEDULE_TIMEOUT;
1732 }
1733
1734 if (o_tty) {
1735 if (--o_tty->count < 0) {
1736 tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1737 o_tty->count = 0;
1738 }
1739 }
1740 if (--tty->count < 0) {
1741 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1742 tty->count = 0;
1743 }
1744
1745 /*
1746 * We've decremented tty->count, so we need to remove this file
1747 * descriptor off the tty->tty_files list; this serves two
1748 * purposes:
1749 * - check_tty_count sees the correct number of file descriptors
1750 * associated with this tty.
1751 * - do_tty_hangup no longer sees this file descriptor as
1752 * something that needs to be handled for hangups.
1753 */
1754 tty_del_file(filp);
1755
1756 /*
1757 * Perform some housekeeping before deciding whether to return.
1758 *
1759 * If _either_ side is closing, make sure there aren't any
1760 * processes that still think tty or o_tty is their controlling
1761 * tty.
1762 */
1763 if (!tty->count) {
1764 read_lock(&tasklist_lock);
1765 session_clear_tty(tty->session);
1766 if (o_tty)
1767 session_clear_tty(o_tty->session);
1768 read_unlock(&tasklist_lock);
1769 }
1770
1771 /* check whether both sides are closing ... */
1772 final = !tty->count && !(o_tty && o_tty->count);
1773
1774 tty_unlock_slave(o_tty);
1775 tty_unlock(tty);
1776
1777 /* At this point, the tty->count == 0 should ensure a dead tty
1778 cannot be re-opened by a racing opener */
1779
1780 if (!final)
1781 return 0;
1782
1783 tty_debug_hangup(tty, "final close\n");
1784
1785 tty_release_struct(tty, idx);
1786 return 0;
1787}
1788
1789/**
1790 * tty_open_current_tty - get locked tty of current task
1791 * @device: device number
1792 * @filp: file pointer to tty
1793 * @return: locked tty of the current task iff @device is /dev/tty
1794 *
1795 * Performs a re-open of the current task's controlling tty.
1796 *
1797 * We cannot return driver and index like for the other nodes because
1798 * devpts will not work then. It expects inodes to be from devpts FS.
1799 */
1800static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1801{
1802 struct tty_struct *tty;
1803 int retval;
1804
1805 if (device != MKDEV(TTYAUX_MAJOR, 0))
1806 return NULL;
1807
1808 tty = get_current_tty();
1809 if (!tty)
1810 return ERR_PTR(-ENXIO);
1811
1812 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1813 /* noctty = 1; */
1814 tty_lock(tty);
1815 tty_kref_put(tty); /* safe to drop the kref now */
1816
1817 retval = tty_reopen(tty);
1818 if (retval < 0) {
1819 tty_unlock(tty);
1820 tty = ERR_PTR(retval);
1821 }
1822 return tty;
1823}
1824
1825/**
1826 * tty_lookup_driver - lookup a tty driver for a given device file
1827 * @device: device number
1828 * @filp: file pointer to tty
1829 * @index: index for the device in the @return driver
1830 * @return: driver for this inode (with increased refcount)
1831 *
1832 * If @return is not erroneous, the caller is responsible to decrement the
1833 * refcount by tty_driver_kref_put.
1834 *
1835 * Locking: tty_mutex protects get_tty_driver
1836 */
1837static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1838 int *index)
1839{
1840 struct tty_driver *driver;
1841
1842 switch (device) {
1843#ifdef CONFIG_VT
1844 case MKDEV(TTY_MAJOR, 0): {
1845 extern struct tty_driver *console_driver;
1846 driver = tty_driver_kref_get(console_driver);
1847 *index = fg_console;
1848 break;
1849 }
1850#endif
1851 case MKDEV(TTYAUX_MAJOR, 1): {
1852 struct tty_driver *console_driver = console_device(index);
1853 if (console_driver) {
1854 driver = tty_driver_kref_get(console_driver);
1855 if (driver && filp) {
1856 /* Don't let /dev/console block */
1857 filp->f_flags |= O_NONBLOCK;
1858 break;
1859 }
1860 }
1861 return ERR_PTR(-ENODEV);
1862 }
1863 default:
1864 driver = get_tty_driver(device, index);
1865 if (!driver)
1866 return ERR_PTR(-ENODEV);
1867 break;
1868 }
1869 return driver;
1870}
1871
1872/**
1873 * tty_kopen - open a tty device for kernel
1874 * @device: dev_t of device to open
1875 *
1876 * Opens tty exclusively for kernel. Performs the driver lookup,
1877 * makes sure it's not already opened and performs the first-time
1878 * tty initialization.
1879 *
1880 * Returns the locked initialized &tty_struct
1881 *
1882 * Claims the global tty_mutex to serialize:
1883 * - concurrent first-time tty initialization
1884 * - concurrent tty driver removal w/ lookup
1885 * - concurrent tty removal from driver table
1886 */
1887struct tty_struct *tty_kopen(dev_t device)
1888{
1889 struct tty_struct *tty;
1890 struct tty_driver *driver = NULL;
1891 int index = -1;
1892
1893 mutex_lock(&tty_mutex);
1894 driver = tty_lookup_driver(device, NULL, &index);
1895 if (IS_ERR(driver)) {
1896 mutex_unlock(&tty_mutex);
1897 return ERR_CAST(driver);
1898 }
1899
1900 /* check whether we're reopening an existing tty */
1901 tty = tty_driver_lookup_tty(driver, NULL, index);
1902 if (IS_ERR(tty))
1903 goto out;
1904
1905 if (tty) {
1906 /* drop kref from tty_driver_lookup_tty() */
1907 tty_kref_put(tty);
1908 tty = ERR_PTR(-EBUSY);
1909 } else { /* tty_init_dev returns tty with the tty_lock held */
1910 tty = tty_init_dev(driver, index);
1911 if (IS_ERR(tty))
1912 goto out;
1913 tty_port_set_kopened(tty->port, 1);
1914 }
1915out:
1916 mutex_unlock(&tty_mutex);
1917 tty_driver_kref_put(driver);
1918 return tty;
1919}
1920EXPORT_SYMBOL_GPL(tty_kopen);
1921
1922/**
1923 * tty_open_by_driver - open a tty device
1924 * @device: dev_t of device to open
1925 * @inode: inode of device file
1926 * @filp: file pointer to tty
1927 *
1928 * Performs the driver lookup, checks for a reopen, or otherwise
1929 * performs the first-time tty initialization.
1930 *
1931 * Returns the locked initialized or re-opened &tty_struct
1932 *
1933 * Claims the global tty_mutex to serialize:
1934 * - concurrent first-time tty initialization
1935 * - concurrent tty driver removal w/ lookup
1936 * - concurrent tty removal from driver table
1937 */
1938static struct tty_struct *tty_open_by_driver(dev_t device, struct inode *inode,
1939 struct file *filp)
1940{
1941 struct tty_struct *tty;
1942 struct tty_driver *driver = NULL;
1943 int index = -1;
1944 int retval;
1945
1946 mutex_lock(&tty_mutex);
1947 driver = tty_lookup_driver(device, filp, &index);
1948 if (IS_ERR(driver)) {
1949 mutex_unlock(&tty_mutex);
1950 return ERR_CAST(driver);
1951 }
1952
1953 /* check whether we're reopening an existing tty */
1954 tty = tty_driver_lookup_tty(driver, filp, index);
1955 if (IS_ERR(tty)) {
1956 mutex_unlock(&tty_mutex);
1957 goto out;
1958 }
1959
1960 if (tty) {
1961 if (tty_port_kopened(tty->port)) {
1962 tty_kref_put(tty);
1963 mutex_unlock(&tty_mutex);
1964 tty = ERR_PTR(-EBUSY);
1965 goto out;
1966 }
1967 mutex_unlock(&tty_mutex);
1968 retval = tty_lock_interruptible(tty);
1969 tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
1970 if (retval) {
1971 if (retval == -EINTR)
1972 retval = -ERESTARTSYS;
1973 tty = ERR_PTR(retval);
1974 goto out;
1975 }
1976 retval = tty_reopen(tty);
1977 if (retval < 0) {
1978 tty_unlock(tty);
1979 tty = ERR_PTR(retval);
1980 }
1981 } else { /* Returns with the tty_lock held for now */
1982 tty = tty_init_dev(driver, index);
1983 mutex_unlock(&tty_mutex);
1984 }
1985out:
1986 tty_driver_kref_put(driver);
1987 return tty;
1988}
1989
1990/**
1991 * tty_open - open a tty device
1992 * @inode: inode of device file
1993 * @filp: file pointer to tty
1994 *
1995 * tty_open and tty_release keep up the tty count that contains the
1996 * number of opens done on a tty. We cannot use the inode-count, as
1997 * different inodes might point to the same tty.
1998 *
1999 * Open-counting is needed for pty masters, as well as for keeping
2000 * track of serial lines: DTR is dropped when the last close happens.
2001 * (This is not done solely through tty->count, now. - Ted 1/27/92)
2002 *
2003 * The termios state of a pty is reset on first open so that
2004 * settings don't persist across reuse.
2005 *
2006 * Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2007 * tty->count should protect the rest.
2008 * ->siglock protects ->signal/->sighand
2009 *
2010 * Note: the tty_unlock/lock cases without a ref are only safe due to
2011 * tty_mutex
2012 */
2013
2014static int tty_open(struct inode *inode, struct file *filp)
2015{
2016 struct tty_struct *tty;
2017 int noctty, retval;
2018 dev_t device = inode->i_rdev;
2019 unsigned saved_flags = filp->f_flags;
2020
2021 nonseekable_open(inode, filp);
2022
2023retry_open:
2024 retval = tty_alloc_file(filp);
2025 if (retval)
2026 return -ENOMEM;
2027
2028 tty = tty_open_current_tty(device, filp);
2029 if (!tty)
2030 tty = tty_open_by_driver(device, inode, filp);
2031
2032 if (IS_ERR(tty)) {
2033 tty_free_file(filp);
2034 retval = PTR_ERR(tty);
2035 if (retval != -EAGAIN || signal_pending(current))
2036 return retval;
2037 schedule();
2038 goto retry_open;
2039 }
2040
2041 tty_add_file(tty, filp);
2042
2043 check_tty_count(tty, __func__);
2044 tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2045
2046 if (tty->ops->open)
2047 retval = tty->ops->open(tty, filp);
2048 else
2049 retval = -ENODEV;
2050 filp->f_flags = saved_flags;
2051
2052 if (retval) {
2053 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2054
2055 tty_unlock(tty); /* need to call tty_release without BTM */
2056 tty_release(inode, filp);
2057 if (retval != -ERESTARTSYS)
2058 return retval;
2059
2060 if (signal_pending(current))
2061 return retval;
2062
2063 schedule();
2064 /*
2065 * Need to reset f_op in case a hangup happened.
2066 */
2067 if (tty_hung_up_p(filp))
2068 filp->f_op = &tty_fops;
2069 goto retry_open;
2070 }
2071 clear_bit(TTY_HUPPED, &tty->flags);
2072
2073 noctty = (filp->f_flags & O_NOCTTY) ||
2074 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2075 device == MKDEV(TTYAUX_MAJOR, 1) ||
2076 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2077 tty->driver->subtype == PTY_TYPE_MASTER);
2078 if (!noctty)
2079 tty_open_proc_set_tty(filp, tty);
2080 tty_unlock(tty);
2081 return 0;
2082}
2083
2084
2085
2086/**
2087 * tty_poll - check tty status
2088 * @filp: file being polled
2089 * @wait: poll wait structures to update
2090 *
2091 * Call the line discipline polling method to obtain the poll
2092 * status of the device.
2093 *
2094 * Locking: locks called line discipline but ldisc poll method
2095 * may be re-entered freely by other callers.
2096 */
2097
2098static __poll_t tty_poll(struct file *filp, poll_table *wait)
2099{
2100 struct tty_struct *tty = file_tty(filp);
2101 struct tty_ldisc *ld;
2102 __poll_t ret = 0;
2103
2104 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2105 return 0;
2106
2107 ld = tty_ldisc_ref_wait(tty);
2108 if (!ld)
2109 return hung_up_tty_poll(filp, wait);
2110 if (ld->ops->poll)
2111 ret = ld->ops->poll(tty, filp, wait);
2112 tty_ldisc_deref(ld);
2113 return ret;
2114}
2115
2116static int __tty_fasync(int fd, struct file *filp, int on)
2117{
2118 struct tty_struct *tty = file_tty(filp);
2119 unsigned long flags;
2120 int retval = 0;
2121
2122 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2123 goto out;
2124
2125 retval = fasync_helper(fd, filp, on, &tty->fasync);
2126 if (retval <= 0)
2127 goto out;
2128
2129 if (on) {
2130 enum pid_type type;
2131 struct pid *pid;
2132
2133 spin_lock_irqsave(&tty->ctrl_lock, flags);
2134 if (tty->pgrp) {
2135 pid = tty->pgrp;
2136 type = PIDTYPE_PGID;
2137 } else {
2138 pid = task_pid(current);
2139 type = PIDTYPE_TGID;
2140 }
2141 get_pid(pid);
2142 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2143 __f_setown(filp, pid, type, 0);
2144 put_pid(pid);
2145 retval = 0;
2146 }
2147out:
2148 return retval;
2149}
2150
2151static int tty_fasync(int fd, struct file *filp, int on)
2152{
2153 struct tty_struct *tty = file_tty(filp);
2154 int retval = -ENOTTY;
2155
2156 tty_lock(tty);
2157 if (!tty_hung_up_p(filp))
2158 retval = __tty_fasync(fd, filp, on);
2159 tty_unlock(tty);
2160
2161 return retval;
2162}
2163
2164/**
2165 * tiocsti - fake input character
2166 * @tty: tty to fake input into
2167 * @p: pointer to character
2168 *
2169 * Fake input to a tty device. Does the necessary locking and
2170 * input management.
2171 *
2172 * FIXME: does not honour flow control ??
2173 *
2174 * Locking:
2175 * Called functions take tty_ldiscs_lock
2176 * current->signal->tty check is safe without locks
2177 *
2178 * FIXME: may race normal receive processing
2179 */
2180
2181static int tiocsti(struct tty_struct *tty, char __user *p)
2182{
2183 char ch, mbz = 0;
2184 struct tty_ldisc *ld;
2185
2186 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2187 return -EPERM;
2188 if (get_user(ch, p))
2189 return -EFAULT;
2190 tty_audit_tiocsti(tty, ch);
2191 ld = tty_ldisc_ref_wait(tty);
2192 if (!ld)
2193 return -EIO;
2194 if (ld->ops->receive_buf)
2195 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2196 tty_ldisc_deref(ld);
2197 return 0;
2198}
2199
2200/**
2201 * tiocgwinsz - implement window query ioctl
2202 * @tty; tty
2203 * @arg: user buffer for result
2204 *
2205 * Copies the kernel idea of the window size into the user buffer.
2206 *
2207 * Locking: tty->winsize_mutex is taken to ensure the winsize data
2208 * is consistent.
2209 */
2210
2211static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2212{
2213 int err;
2214
2215 mutex_lock(&tty->winsize_mutex);
2216 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2217 mutex_unlock(&tty->winsize_mutex);
2218
2219 return err ? -EFAULT: 0;
2220}
2221
2222/**
2223 * tty_do_resize - resize event
2224 * @tty: tty being resized
2225 * @rows: rows (character)
2226 * @cols: cols (character)
2227 *
2228 * Update the termios variables and send the necessary signals to
2229 * peform a terminal resize correctly
2230 */
2231
2232int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2233{
2234 struct pid *pgrp;
2235
2236 /* Lock the tty */
2237 mutex_lock(&tty->winsize_mutex);
2238 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2239 goto done;
2240
2241 /* Signal the foreground process group */
2242 pgrp = tty_get_pgrp(tty);
2243 if (pgrp)
2244 kill_pgrp(pgrp, SIGWINCH, 1);
2245 put_pid(pgrp);
2246
2247 tty->winsize = *ws;
2248done:
2249 mutex_unlock(&tty->winsize_mutex);
2250 return 0;
2251}
2252EXPORT_SYMBOL(tty_do_resize);
2253
2254/**
2255 * tiocswinsz - implement window size set ioctl
2256 * @tty; tty side of tty
2257 * @arg: user buffer for result
2258 *
2259 * Copies the user idea of the window size to the kernel. Traditionally
2260 * this is just advisory information but for the Linux console it
2261 * actually has driver level meaning and triggers a VC resize.
2262 *
2263 * Locking:
2264 * Driver dependent. The default do_resize method takes the
2265 * tty termios mutex and ctrl_lock. The console takes its own lock
2266 * then calls into the default method.
2267 */
2268
2269static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2270{
2271 struct winsize tmp_ws;
2272 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2273 return -EFAULT;
2274
2275 if (tty->ops->resize)
2276 return tty->ops->resize(tty, &tmp_ws);
2277 else
2278 return tty_do_resize(tty, &tmp_ws);
2279}
2280
2281/**
2282 * tioccons - allow admin to move logical console
2283 * @file: the file to become console
2284 *
2285 * Allow the administrator to move the redirected console device
2286 *
2287 * Locking: uses redirect_lock to guard the redirect information
2288 */
2289
2290static int tioccons(struct file *file)
2291{
2292 if (!capable(CAP_SYS_ADMIN))
2293 return -EPERM;
2294 if (file->f_op->write == redirected_tty_write) {
2295 struct file *f;
2296 spin_lock(&redirect_lock);
2297 f = redirect;
2298 redirect = NULL;
2299 spin_unlock(&redirect_lock);
2300 if (f)
2301 fput(f);
2302 return 0;
2303 }
2304 spin_lock(&redirect_lock);
2305 if (redirect) {
2306 spin_unlock(&redirect_lock);
2307 return -EBUSY;
2308 }
2309 redirect = get_file(file);
2310 spin_unlock(&redirect_lock);
2311 return 0;
2312}
2313
2314/**
2315 * tiocsetd - set line discipline
2316 * @tty: tty device
2317 * @p: pointer to user data
2318 *
2319 * Set the line discipline according to user request.
2320 *
2321 * Locking: see tty_set_ldisc, this function is just a helper
2322 */
2323
2324static int tiocsetd(struct tty_struct *tty, int __user *p)
2325{
2326 int disc;
2327 int ret;
2328
2329 if (get_user(disc, p))
2330 return -EFAULT;
2331
2332 ret = tty_set_ldisc(tty, disc);
2333
2334 return ret;
2335}
2336
2337/**
2338 * tiocgetd - get line discipline
2339 * @tty: tty device
2340 * @p: pointer to user data
2341 *
2342 * Retrieves the line discipline id directly from the ldisc.
2343 *
2344 * Locking: waits for ldisc reference (in case the line discipline
2345 * is changing or the tty is being hungup)
2346 */
2347
2348static int tiocgetd(struct tty_struct *tty, int __user *p)
2349{
2350 struct tty_ldisc *ld;
2351 int ret;
2352
2353 ld = tty_ldisc_ref_wait(tty);
2354 if (!ld)
2355 return -EIO;
2356 ret = put_user(ld->ops->num, p);
2357 tty_ldisc_deref(ld);
2358 return ret;
2359}
2360
2361/**
2362 * send_break - performed time break
2363 * @tty: device to break on
2364 * @duration: timeout in mS
2365 *
2366 * Perform a timed break on hardware that lacks its own driver level
2367 * timed break functionality.
2368 *
2369 * Locking:
2370 * atomic_write_lock serializes
2371 *
2372 */
2373
2374static int send_break(struct tty_struct *tty, unsigned int duration)
2375{
2376 int retval;
2377
2378 if (tty->ops->break_ctl == NULL)
2379 return 0;
2380
2381 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2382 retval = tty->ops->break_ctl(tty, duration);
2383 else {
2384 /* Do the work ourselves */
2385 if (tty_write_lock(tty, 0) < 0)
2386 return -EINTR;
2387 retval = tty->ops->break_ctl(tty, -1);
2388 if (retval)
2389 goto out;
2390 if (!signal_pending(current))
2391 msleep_interruptible(duration);
2392 retval = tty->ops->break_ctl(tty, 0);
2393out:
2394 tty_write_unlock(tty);
2395 if (signal_pending(current))
2396 retval = -EINTR;
2397 }
2398 return retval;
2399}
2400
2401/**
2402 * tty_tiocmget - get modem status
2403 * @tty: tty device
2404 * @file: user file pointer
2405 * @p: pointer to result
2406 *
2407 * Obtain the modem status bits from the tty driver if the feature
2408 * is supported. Return -EINVAL if it is not available.
2409 *
2410 * Locking: none (up to the driver)
2411 */
2412
2413static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2414{
2415 int retval = -EINVAL;
2416
2417 if (tty->ops->tiocmget) {
2418 retval = tty->ops->tiocmget(tty);
2419
2420 if (retval >= 0)
2421 retval = put_user(retval, p);
2422 }
2423 return retval;
2424}
2425
2426/**
2427 * tty_tiocmset - set modem status
2428 * @tty: tty device
2429 * @cmd: command - clear bits, set bits or set all
2430 * @p: pointer to desired bits
2431 *
2432 * Set the modem status bits from the tty driver if the feature
2433 * is supported. Return -EINVAL if it is not available.
2434 *
2435 * Locking: none (up to the driver)
2436 */
2437
2438static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2439 unsigned __user *p)
2440{
2441 int retval;
2442 unsigned int set, clear, val;
2443
2444 if (tty->ops->tiocmset == NULL)
2445 return -EINVAL;
2446
2447 retval = get_user(val, p);
2448 if (retval)
2449 return retval;
2450 set = clear = 0;
2451 switch (cmd) {
2452 case TIOCMBIS:
2453 set = val;
2454 break;
2455 case TIOCMBIC:
2456 clear = val;
2457 break;
2458 case TIOCMSET:
2459 set = val;
2460 clear = ~val;
2461 break;
2462 }
2463 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2464 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2465 return tty->ops->tiocmset(tty, set, clear);
2466}
2467
2468static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2469{
2470 int retval = -EINVAL;
2471 struct serial_icounter_struct icount;
2472 memset(&icount, 0, sizeof(icount));
2473 if (tty->ops->get_icount)
2474 retval = tty->ops->get_icount(tty, &icount);
2475 if (retval != 0)
2476 return retval;
2477 if (copy_to_user(arg, &icount, sizeof(icount)))
2478 return -EFAULT;
2479 return 0;
2480}
2481
2482static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
2483{
2484 static DEFINE_RATELIMIT_STATE(depr_flags,
2485 DEFAULT_RATELIMIT_INTERVAL,
2486 DEFAULT_RATELIMIT_BURST);
2487 char comm[TASK_COMM_LEN];
2488 struct serial_struct v;
2489 int flags;
2490
2491 if (copy_from_user(&v, ss, sizeof(struct serial_struct)))
2492 return -EFAULT;
2493
2494 flags = v.flags & ASYNC_DEPRECATED;
2495
2496 if (flags && __ratelimit(&depr_flags))
2497 pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2498 __func__, get_task_comm(comm, current), flags);
2499 if (!tty->ops->set_serial)
2500 return -ENOTTY;
2501 return tty->ops->set_serial(tty, &v);
2502}
2503
2504static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2505{
2506 struct serial_struct v;
2507 int err;
2508
2509 memset(&v, 0, sizeof(struct serial_struct));
2510 if (!tty->ops->get_serial)
2511 return -ENOTTY;
2512 err = tty->ops->get_serial(tty, &v);
2513 if (!err && copy_to_user(ss, &v, sizeof(struct serial_struct)))
2514 err = -EFAULT;
2515 return err;
2516}
2517
2518/*
2519 * if pty, return the slave side (real_tty)
2520 * otherwise, return self
2521 */
2522static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2523{
2524 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2525 tty->driver->subtype == PTY_TYPE_MASTER)
2526 tty = tty->link;
2527 return tty;
2528}
2529
2530/*
2531 * Split this up, as gcc can choke on it otherwise..
2532 */
2533long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2534{
2535 struct tty_struct *tty = file_tty(file);
2536 struct tty_struct *real_tty;
2537 void __user *p = (void __user *)arg;
2538 int retval;
2539 struct tty_ldisc *ld;
2540
2541 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2542 return -EINVAL;
2543
2544 real_tty = tty_pair_get_tty(tty);
2545
2546 /*
2547 * Factor out some common prep work
2548 */
2549 switch (cmd) {
2550 case TIOCSETD:
2551 case TIOCSBRK:
2552 case TIOCCBRK:
2553 case TCSBRK:
2554 case TCSBRKP:
2555 retval = tty_check_change(tty);
2556 if (retval)
2557 return retval;
2558 if (cmd != TIOCCBRK) {
2559 tty_wait_until_sent(tty, 0);
2560 if (signal_pending(current))
2561 return -EINTR;
2562 }
2563 break;
2564 }
2565
2566 /*
2567 * Now do the stuff.
2568 */
2569 switch (cmd) {
2570 case TIOCSTI:
2571 return tiocsti(tty, p);
2572 case TIOCGWINSZ:
2573 return tiocgwinsz(real_tty, p);
2574 case TIOCSWINSZ:
2575 return tiocswinsz(real_tty, p);
2576 case TIOCCONS:
2577 return real_tty != tty ? -EINVAL : tioccons(file);
2578 case TIOCEXCL:
2579 set_bit(TTY_EXCLUSIVE, &tty->flags);
2580 return 0;
2581 case TIOCNXCL:
2582 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2583 return 0;
2584 case TIOCGEXCL:
2585 {
2586 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2587 return put_user(excl, (int __user *)p);
2588 }
2589 case TIOCGETD:
2590 return tiocgetd(tty, p);
2591 case TIOCSETD:
2592 return tiocsetd(tty, p);
2593 case TIOCVHANGUP:
2594 if (!capable(CAP_SYS_ADMIN))
2595 return -EPERM;
2596 tty_vhangup(tty);
2597 return 0;
2598 case TIOCGDEV:
2599 {
2600 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2601 return put_user(ret, (unsigned int __user *)p);
2602 }
2603 /*
2604 * Break handling
2605 */
2606 case TIOCSBRK: /* Turn break on, unconditionally */
2607 if (tty->ops->break_ctl)
2608 return tty->ops->break_ctl(tty, -1);
2609 return 0;
2610 case TIOCCBRK: /* Turn break off, unconditionally */
2611 if (tty->ops->break_ctl)
2612 return tty->ops->break_ctl(tty, 0);
2613 return 0;
2614 case TCSBRK: /* SVID version: non-zero arg --> no break */
2615 /* non-zero arg means wait for all output data
2616 * to be sent (performed above) but don't send break.
2617 * This is used by the tcdrain() termios function.
2618 */
2619 if (!arg)
2620 return send_break(tty, 250);
2621 return 0;
2622 case TCSBRKP: /* support for POSIX tcsendbreak() */
2623 return send_break(tty, arg ? arg*100 : 250);
2624
2625 case TIOCMGET:
2626 return tty_tiocmget(tty, p);
2627 case TIOCMSET:
2628 case TIOCMBIC:
2629 case TIOCMBIS:
2630 return tty_tiocmset(tty, cmd, p);
2631 case TIOCGICOUNT:
2632 return tty_tiocgicount(tty, p);
2633 case TCFLSH:
2634 switch (arg) {
2635 case TCIFLUSH:
2636 case TCIOFLUSH:
2637 /* flush tty buffer and allow ldisc to process ioctl */
2638 tty_buffer_flush(tty, NULL);
2639 break;
2640 }
2641 break;
2642 case TIOCSSERIAL:
2643 return tty_tiocsserial(tty, p);
2644 case TIOCGSERIAL:
2645 return tty_tiocgserial(tty, p);
2646 case TIOCGPTPEER:
2647 /* Special because the struct file is needed */
2648 return ptm_open_peer(file, tty, (int)arg);
2649 default:
2650 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2651 if (retval != -ENOIOCTLCMD)
2652 return retval;
2653 }
2654 if (tty->ops->ioctl) {
2655 retval = tty->ops->ioctl(tty, cmd, arg);
2656 if (retval != -ENOIOCTLCMD)
2657 return retval;
2658 }
2659 ld = tty_ldisc_ref_wait(tty);
2660 if (!ld)
2661 return hung_up_tty_ioctl(file, cmd, arg);
2662 retval = -EINVAL;
2663 if (ld->ops->ioctl) {
2664 retval = ld->ops->ioctl(tty, file, cmd, arg);
2665 if (retval == -ENOIOCTLCMD)
2666 retval = -ENOTTY;
2667 }
2668 tty_ldisc_deref(ld);
2669 return retval;
2670}
2671
2672#ifdef CONFIG_COMPAT
2673
2674struct serial_struct32 {
2675 compat_int_t type;
2676 compat_int_t line;
2677 compat_uint_t port;
2678 compat_int_t irq;
2679 compat_int_t flags;
2680 compat_int_t xmit_fifo_size;
2681 compat_int_t custom_divisor;
2682 compat_int_t baud_base;
2683 unsigned short close_delay;
2684 char io_type;
2685 char reserved_char[1];
2686 compat_int_t hub6;
2687 unsigned short closing_wait; /* time to wait before closing */
2688 unsigned short closing_wait2; /* no longer used... */
2689 compat_uint_t iomem_base;
2690 unsigned short iomem_reg_shift;
2691 unsigned int port_high;
2692 /* compat_ulong_t iomap_base FIXME */
2693 compat_int_t reserved[1];
2694};
2695
2696static int compat_tty_tiocsserial(struct tty_struct *tty,
2697 struct serial_struct32 __user *ss)
2698{
2699 static DEFINE_RATELIMIT_STATE(depr_flags,
2700 DEFAULT_RATELIMIT_INTERVAL,
2701 DEFAULT_RATELIMIT_BURST);
2702 char comm[TASK_COMM_LEN];
2703 struct serial_struct32 v32;
2704 struct serial_struct v;
2705 int flags;
2706
2707 if (copy_from_user(&v32, ss, sizeof(struct serial_struct32)))
2708 return -EFAULT;
2709
2710 memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2711 v.iomem_base = compat_ptr(v32.iomem_base);
2712 v.iomem_reg_shift = v32.iomem_reg_shift;
2713 v.port_high = v32.port_high;
2714 v.iomap_base = 0;
2715
2716 flags = v.flags & ASYNC_DEPRECATED;
2717
2718 if (flags && __ratelimit(&depr_flags))
2719 pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2720 __func__, get_task_comm(comm, current), flags);
2721 if (!tty->ops->set_serial)
2722 return -ENOTTY;
2723 return tty->ops->set_serial(tty, &v);
2724}
2725
2726static int compat_tty_tiocgserial(struct tty_struct *tty,
2727 struct serial_struct32 __user *ss)
2728{
2729 struct serial_struct32 v32;
2730 struct serial_struct v;
2731 int err;
2732 memset(&v, 0, sizeof(struct serial_struct));
2733
2734 if (!tty->ops->set_serial)
2735 return -ENOTTY;
2736 err = tty->ops->get_serial(tty, &v);
2737 if (!err) {
2738 memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2739 v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2740 0xfffffff : ptr_to_compat(v.iomem_base);
2741 v32.iomem_reg_shift = v.iomem_reg_shift;
2742 v32.port_high = v.port_high;
2743 if (copy_to_user(ss, &v32, sizeof(struct serial_struct32)))
2744 err = -EFAULT;
2745 }
2746 return err;
2747}
2748static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2749 unsigned long arg)
2750{
2751 struct tty_struct *tty = file_tty(file);
2752 struct tty_ldisc *ld;
2753 int retval = -ENOIOCTLCMD;
2754
2755 switch (cmd) {
2756 case TIOCSTI:
2757 case TIOCGWINSZ:
2758 case TIOCSWINSZ:
2759 case TIOCGEXCL:
2760 case TIOCGETD:
2761 case TIOCSETD:
2762 case TIOCGDEV:
2763 case TIOCMGET:
2764 case TIOCMSET:
2765 case TIOCMBIC:
2766 case TIOCMBIS:
2767 case TIOCGICOUNT:
2768 case TIOCGPGRP:
2769 case TIOCSPGRP:
2770 case TIOCGSID:
2771 case TIOCSERGETLSR:
2772 case TIOCGRS485:
2773 case TIOCSRS485:
2774#ifdef TIOCGETP
2775 case TIOCGETP:
2776 case TIOCSETP:
2777 case TIOCSETN:
2778#endif
2779#ifdef TIOCGETC
2780 case TIOCGETC:
2781 case TIOCSETC:
2782#endif
2783#ifdef TIOCGLTC
2784 case TIOCGLTC:
2785 case TIOCSLTC:
2786#endif
2787 case TCSETSF:
2788 case TCSETSW:
2789 case TCSETS:
2790 case TCGETS:
2791#ifdef TCGETS2
2792 case TCGETS2:
2793 case TCSETSF2:
2794 case TCSETSW2:
2795 case TCSETS2:
2796#endif
2797 case TCGETA:
2798 case TCSETAF:
2799 case TCSETAW:
2800 case TCSETA:
2801 case TIOCGLCKTRMIOS:
2802 case TIOCSLCKTRMIOS:
2803#ifdef TCGETX
2804 case TCGETX:
2805 case TCSETX:
2806 case TCSETXW:
2807 case TCSETXF:
2808#endif
2809 case TIOCGSOFTCAR:
2810 case TIOCSSOFTCAR:
2811 return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
2812 case TIOCCONS:
2813 case TIOCEXCL:
2814 case TIOCNXCL:
2815 case TIOCVHANGUP:
2816 case TIOCSBRK:
2817 case TIOCCBRK:
2818 case TCSBRK:
2819 case TCSBRKP:
2820 case TCFLSH:
2821 case TIOCGPTPEER:
2822 case TIOCNOTTY:
2823 case TIOCSCTTY:
2824 case TCXONC:
2825 case TIOCMIWAIT:
2826 case TIOCSERCONFIG:
2827 return tty_ioctl(file, cmd, arg);
2828 }
2829
2830 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2831 return -EINVAL;
2832
2833 switch (cmd) {
2834 case TIOCSSERIAL:
2835 return compat_tty_tiocsserial(tty, compat_ptr(arg));
2836 case TIOCGSERIAL:
2837 return compat_tty_tiocgserial(tty, compat_ptr(arg));
2838 }
2839 if (tty->ops->compat_ioctl) {
2840 retval = tty->ops->compat_ioctl(tty, cmd, arg);
2841 if (retval != -ENOIOCTLCMD)
2842 return retval;
2843 }
2844
2845 ld = tty_ldisc_ref_wait(tty);
2846 if (!ld)
2847 return hung_up_tty_compat_ioctl(file, cmd, arg);
2848 if (ld->ops->compat_ioctl)
2849 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2850 if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2851 retval = ld->ops->ioctl(tty, file,
2852 (unsigned long)compat_ptr(cmd), arg);
2853 tty_ldisc_deref(ld);
2854
2855 return retval;
2856}
2857#endif
2858
2859static int this_tty(const void *t, struct file *file, unsigned fd)
2860{
2861 if (likely(file->f_op->read != tty_read))
2862 return 0;
2863 return file_tty(file) != t ? 0 : fd + 1;
2864}
2865
2866/*
2867 * This implements the "Secure Attention Key" --- the idea is to
2868 * prevent trojan horses by killing all processes associated with this
2869 * tty when the user hits the "Secure Attention Key". Required for
2870 * super-paranoid applications --- see the Orange Book for more details.
2871 *
2872 * This code could be nicer; ideally it should send a HUP, wait a few
2873 * seconds, then send a INT, and then a KILL signal. But you then
2874 * have to coordinate with the init process, since all processes associated
2875 * with the current tty must be dead before the new getty is allowed
2876 * to spawn.
2877 *
2878 * Now, if it would be correct ;-/ The current code has a nasty hole -
2879 * it doesn't catch files in flight. We may send the descriptor to ourselves
2880 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2881 *
2882 * Nasty bug: do_SAK is being called in interrupt context. This can
2883 * deadlock. We punt it up to process context. AKPM - 16Mar2001
2884 */
2885void __do_SAK(struct tty_struct *tty)
2886{
2887#ifdef TTY_SOFT_SAK
2888 tty_hangup(tty);
2889#else
2890 struct task_struct *g, *p;
2891 struct pid *session;
2892 int i;
2893
2894 if (!tty)
2895 return;
2896 session = tty->session;
2897
2898 tty_ldisc_flush(tty);
2899
2900 tty_driver_flush_buffer(tty);
2901
2902 read_lock(&tasklist_lock);
2903 /* Kill the entire session */
2904 do_each_pid_task(session, PIDTYPE_SID, p) {
2905 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
2906 task_pid_nr(p), p->comm);
2907 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2908 } while_each_pid_task(session, PIDTYPE_SID, p);
2909
2910 /* Now kill any processes that happen to have the tty open */
2911 do_each_thread(g, p) {
2912 if (p->signal->tty == tty) {
2913 tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
2914 task_pid_nr(p), p->comm);
2915 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2916 continue;
2917 }
2918 task_lock(p);
2919 i = iterate_fd(p->files, 0, this_tty, tty);
2920 if (i != 0) {
2921 tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
2922 task_pid_nr(p), p->comm, i - 1);
2923 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2924 }
2925 task_unlock(p);
2926 } while_each_thread(g, p);
2927 read_unlock(&tasklist_lock);
2928#endif
2929}
2930
2931static void do_SAK_work(struct work_struct *work)
2932{
2933 struct tty_struct *tty =
2934 container_of(work, struct tty_struct, SAK_work);
2935 __do_SAK(tty);
2936}
2937
2938/*
2939 * The tq handling here is a little racy - tty->SAK_work may already be queued.
2940 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2941 * the values which we write to it will be identical to the values which it
2942 * already has. --akpm
2943 */
2944void do_SAK(struct tty_struct *tty)
2945{
2946 if (!tty)
2947 return;
2948 schedule_work(&tty->SAK_work);
2949}
2950
2951EXPORT_SYMBOL(do_SAK);
2952
2953static int dev_match_devt(struct device *dev, const void *data)
2954{
2955 const dev_t *devt = data;
2956 return dev->devt == *devt;
2957}
2958
2959/* Must put_device() after it's unused! */
2960static struct device *tty_get_device(struct tty_struct *tty)
2961{
2962 dev_t devt = tty_devnum(tty);
2963 return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2964}
2965
2966
2967/**
2968 * alloc_tty_struct
2969 *
2970 * This subroutine allocates and initializes a tty structure.
2971 *
2972 * Locking: none - tty in question is not exposed at this point
2973 */
2974
2975struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
2976{
2977 struct tty_struct *tty;
2978
2979 tty = kzalloc(sizeof(*tty), GFP_KERNEL);
2980 if (!tty)
2981 return NULL;
2982
2983 kref_init(&tty->kref);
2984 tty->magic = TTY_MAGIC;
2985 if (tty_ldisc_init(tty)) {
2986 kfree(tty);
2987 return NULL;
2988 }
2989 tty->session = NULL;
2990 tty->pgrp = NULL;
2991 mutex_init(&tty->legacy_mutex);
2992 mutex_init(&tty->throttle_mutex);
2993 init_rwsem(&tty->termios_rwsem);
2994 mutex_init(&tty->winsize_mutex);
2995 init_ldsem(&tty->ldisc_sem);
2996 init_waitqueue_head(&tty->write_wait);
2997 init_waitqueue_head(&tty->read_wait);
2998 INIT_WORK(&tty->hangup_work, do_tty_hangup);
2999 mutex_init(&tty->atomic_write_lock);
3000 spin_lock_init(&tty->ctrl_lock);
3001 spin_lock_init(&tty->flow_lock);
3002 spin_lock_init(&tty->files_lock);
3003 INIT_LIST_HEAD(&tty->tty_files);
3004 INIT_WORK(&tty->SAK_work, do_SAK_work);
3005
3006 tty->driver = driver;
3007 tty->ops = driver->ops;
3008 tty->index = idx;
3009 tty_line_name(driver, idx, tty->name);
3010 tty->dev = tty_get_device(tty);
3011
3012 return tty;
3013}
3014
3015/**
3016 * tty_put_char - write one character to a tty
3017 * @tty: tty
3018 * @ch: character
3019 *
3020 * Write one byte to the tty using the provided put_char method
3021 * if present. Returns the number of characters successfully output.
3022 *
3023 * Note: the specific put_char operation in the driver layer may go
3024 * away soon. Don't call it directly, use this method
3025 */
3026
3027int tty_put_char(struct tty_struct *tty, unsigned char ch)
3028{
3029 if (tty->ops->put_char)
3030 return tty->ops->put_char(tty, ch);
3031 return tty->ops->write(tty, &ch, 1);
3032}
3033EXPORT_SYMBOL_GPL(tty_put_char);
3034
3035struct class *tty_class;
3036
3037static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3038 unsigned int index, unsigned int count)
3039{
3040 int err;
3041
3042 /* init here, since reused cdevs cause crashes */
3043 driver->cdevs[index] = cdev_alloc();
3044 if (!driver->cdevs[index])
3045 return -ENOMEM;
3046 driver->cdevs[index]->ops = &tty_fops;
3047 driver->cdevs[index]->owner = driver->owner;
3048 err = cdev_add(driver->cdevs[index], dev, count);
3049 if (err)
3050 kobject_put(&driver->cdevs[index]->kobj);
3051 return err;
3052}
3053
3054/**
3055 * tty_register_device - register a tty device
3056 * @driver: the tty driver that describes the tty device
3057 * @index: the index in the tty driver for this tty device
3058 * @device: a struct device that is associated with this tty device.
3059 * This field is optional, if there is no known struct device
3060 * for this tty device it can be set to NULL safely.
3061 *
3062 * Returns a pointer to the struct device for this tty device
3063 * (or ERR_PTR(-EFOO) on error).
3064 *
3065 * This call is required to be made to register an individual tty device
3066 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3067 * that bit is not set, this function should not be called by a tty
3068 * driver.
3069 *
3070 * Locking: ??
3071 */
3072
3073struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3074 struct device *device)
3075{
3076 return tty_register_device_attr(driver, index, device, NULL, NULL);
3077}
3078EXPORT_SYMBOL(tty_register_device);
3079
3080static void tty_device_create_release(struct device *dev)
3081{
3082 dev_dbg(dev, "releasing...\n");
3083 kfree(dev);
3084}
3085
3086/**
3087 * tty_register_device_attr - register a tty device
3088 * @driver: the tty driver that describes the tty device
3089 * @index: the index in the tty driver for this tty device
3090 * @device: a struct device that is associated with this tty device.
3091 * This field is optional, if there is no known struct device
3092 * for this tty device it can be set to NULL safely.
3093 * @drvdata: Driver data to be set to device.
3094 * @attr_grp: Attribute group to be set on device.
3095 *
3096 * Returns a pointer to the struct device for this tty device
3097 * (or ERR_PTR(-EFOO) on error).
3098 *
3099 * This call is required to be made to register an individual tty device
3100 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3101 * that bit is not set, this function should not be called by a tty
3102 * driver.
3103 *
3104 * Locking: ??
3105 */
3106struct device *tty_register_device_attr(struct tty_driver *driver,
3107 unsigned index, struct device *device,
3108 void *drvdata,
3109 const struct attribute_group **attr_grp)
3110{
3111 char name[64];
3112 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3113 struct ktermios *tp;
3114 struct device *dev;
3115 int retval;
3116
3117 if (index >= driver->num) {
3118 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3119 driver->name, index);
3120 return ERR_PTR(-EINVAL);
3121 }
3122
3123 if (driver->type == TTY_DRIVER_TYPE_PTY)
3124 pty_line_name(driver, index, name);
3125 else
3126 tty_line_name(driver, index, name);
3127
3128 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3129 if (!dev)
3130 return ERR_PTR(-ENOMEM);
3131
3132 dev->devt = devt;
3133 dev->class = tty_class;
3134 dev->parent = device;
3135 dev->release = tty_device_create_release;
3136 dev_set_name(dev, "%s", name);
3137 dev->groups = attr_grp;
3138 dev_set_drvdata(dev, drvdata);
3139
3140 dev_set_uevent_suppress(dev, 1);
3141
3142 retval = device_register(dev);
3143 if (retval)
3144 goto err_put;
3145
3146 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3147 /*
3148 * Free any saved termios data so that the termios state is
3149 * reset when reusing a minor number.
3150 */
3151 tp = driver->termios[index];
3152 if (tp) {
3153 driver->termios[index] = NULL;
3154 kfree(tp);
3155 }
3156
3157 retval = tty_cdev_add(driver, devt, index, 1);
3158 if (retval)
3159 goto err_del;
3160 }
3161
3162 dev_set_uevent_suppress(dev, 0);
3163 kobject_uevent(&dev->kobj, KOBJ_ADD);
3164
3165 return dev;
3166
3167err_del:
3168 device_del(dev);
3169err_put:
3170 put_device(dev);
3171
3172 return ERR_PTR(retval);
3173}
3174EXPORT_SYMBOL_GPL(tty_register_device_attr);
3175
3176/**
3177 * tty_unregister_device - unregister a tty device
3178 * @driver: the tty driver that describes the tty device
3179 * @index: the index in the tty driver for this tty device
3180 *
3181 * If a tty device is registered with a call to tty_register_device() then
3182 * this function must be called when the tty device is gone.
3183 *
3184 * Locking: ??
3185 */
3186
3187void tty_unregister_device(struct tty_driver *driver, unsigned index)
3188{
3189 device_destroy(tty_class,
3190 MKDEV(driver->major, driver->minor_start) + index);
3191 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3192 cdev_del(driver->cdevs[index]);
3193 driver->cdevs[index] = NULL;
3194 }
3195}
3196EXPORT_SYMBOL(tty_unregister_device);
3197
3198/**
3199 * __tty_alloc_driver -- allocate tty driver
3200 * @lines: count of lines this driver can handle at most
3201 * @owner: module which is responsible for this driver
3202 * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3203 *
3204 * This should not be called directly, some of the provided macros should be
3205 * used instead. Use IS_ERR and friends on @retval.
3206 */
3207struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3208 unsigned long flags)
3209{
3210 struct tty_driver *driver;
3211 unsigned int cdevs = 1;
3212 int err;
3213
3214 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3215 return ERR_PTR(-EINVAL);
3216
3217 driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3218 if (!driver)
3219 return ERR_PTR(-ENOMEM);
3220
3221 kref_init(&driver->kref);
3222 driver->magic = TTY_DRIVER_MAGIC;
3223 driver->num = lines;
3224 driver->owner = owner;
3225 driver->flags = flags;
3226
3227 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3228 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3229 GFP_KERNEL);
3230 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3231 GFP_KERNEL);
3232 if (!driver->ttys || !driver->termios) {
3233 err = -ENOMEM;
3234 goto err_free_all;
3235 }
3236 }
3237
3238 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3239 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3240 GFP_KERNEL);
3241 if (!driver->ports) {
3242 err = -ENOMEM;
3243 goto err_free_all;
3244 }
3245 cdevs = lines;
3246 }
3247
3248 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3249 if (!driver->cdevs) {
3250 err = -ENOMEM;
3251 goto err_free_all;
3252 }
3253
3254 return driver;
3255err_free_all:
3256 kfree(driver->ports);
3257 kfree(driver->ttys);
3258 kfree(driver->termios);
3259 kfree(driver->cdevs);
3260 kfree(driver);
3261 return ERR_PTR(err);
3262}
3263EXPORT_SYMBOL(__tty_alloc_driver);
3264
3265static void destruct_tty_driver(struct kref *kref)
3266{
3267 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3268 int i;
3269 struct ktermios *tp;
3270
3271 if (driver->flags & TTY_DRIVER_INSTALLED) {
3272 for (i = 0; i < driver->num; i++) {
3273 tp = driver->termios[i];
3274 if (tp) {
3275 driver->termios[i] = NULL;
3276 kfree(tp);
3277 }
3278 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3279 tty_unregister_device(driver, i);
3280 }
3281 proc_tty_unregister_driver(driver);
3282 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3283 cdev_del(driver->cdevs[0]);
3284 }
3285 kfree(driver->cdevs);
3286 kfree(driver->ports);
3287 kfree(driver->termios);
3288 kfree(driver->ttys);
3289 kfree(driver);
3290}
3291
3292void tty_driver_kref_put(struct tty_driver *driver)
3293{
3294 kref_put(&driver->kref, destruct_tty_driver);
3295}
3296EXPORT_SYMBOL(tty_driver_kref_put);
3297
3298void tty_set_operations(struct tty_driver *driver,
3299 const struct tty_operations *op)
3300{
3301 driver->ops = op;
3302};
3303EXPORT_SYMBOL(tty_set_operations);
3304
3305void put_tty_driver(struct tty_driver *d)
3306{
3307 tty_driver_kref_put(d);
3308}
3309EXPORT_SYMBOL(put_tty_driver);
3310
3311/*
3312 * Called by a tty driver to register itself.
3313 */
3314int tty_register_driver(struct tty_driver *driver)
3315{
3316 int error;
3317 int i;
3318 dev_t dev;
3319 struct device *d;
3320
3321 if (!driver->major) {
3322 error = alloc_chrdev_region(&dev, driver->minor_start,
3323 driver->num, driver->name);
3324 if (!error) {
3325 driver->major = MAJOR(dev);
3326 driver->minor_start = MINOR(dev);
3327 }
3328 } else {
3329 dev = MKDEV(driver->major, driver->minor_start);
3330 error = register_chrdev_region(dev, driver->num, driver->name);
3331 }
3332 if (error < 0)
3333 goto err;
3334
3335 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3336 error = tty_cdev_add(driver, dev, 0, driver->num);
3337 if (error)
3338 goto err_unreg_char;
3339 }
3340
3341 mutex_lock(&tty_mutex);
3342 list_add(&driver->tty_drivers, &tty_drivers);
3343 mutex_unlock(&tty_mutex);
3344
3345 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3346 for (i = 0; i < driver->num; i++) {
3347 d = tty_register_device(driver, i, NULL);
3348 if (IS_ERR(d)) {
3349 error = PTR_ERR(d);
3350 goto err_unreg_devs;
3351 }
3352 }
3353 }
3354 proc_tty_register_driver(driver);
3355 driver->flags |= TTY_DRIVER_INSTALLED;
3356 return 0;
3357
3358err_unreg_devs:
3359 for (i--; i >= 0; i--)
3360 tty_unregister_device(driver, i);
3361
3362 mutex_lock(&tty_mutex);
3363 list_del(&driver->tty_drivers);
3364 mutex_unlock(&tty_mutex);
3365
3366err_unreg_char:
3367 unregister_chrdev_region(dev, driver->num);
3368err:
3369 return error;
3370}
3371EXPORT_SYMBOL(tty_register_driver);
3372
3373/*
3374 * Called by a tty driver to unregister itself.
3375 */
3376int tty_unregister_driver(struct tty_driver *driver)
3377{
3378#if 0
3379 /* FIXME */
3380 if (driver->refcount)
3381 return -EBUSY;
3382#endif
3383 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3384 driver->num);
3385 mutex_lock(&tty_mutex);
3386 list_del(&driver->tty_drivers);
3387 mutex_unlock(&tty_mutex);
3388 return 0;
3389}
3390
3391EXPORT_SYMBOL(tty_unregister_driver);
3392
3393dev_t tty_devnum(struct tty_struct *tty)
3394{
3395 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3396}
3397EXPORT_SYMBOL(tty_devnum);
3398
3399void tty_default_fops(struct file_operations *fops)
3400{
3401 *fops = tty_fops;
3402}
3403
3404static char *tty_devnode(struct device *dev, umode_t *mode)
3405{
3406 if (!mode)
3407 return NULL;
3408 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3409 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3410 *mode = 0666;
3411 return NULL;
3412}
3413
3414static int __init tty_class_init(void)
3415{
3416 tty_class = class_create(THIS_MODULE, "tty");
3417 if (IS_ERR(tty_class))
3418 return PTR_ERR(tty_class);
3419 tty_class->devnode = tty_devnode;
3420 return 0;
3421}
3422
3423postcore_initcall(tty_class_init);
3424
3425/* 3/2004 jmc: why do these devices exist? */
3426static struct cdev tty_cdev, console_cdev;
3427
3428static ssize_t show_cons_active(struct device *dev,
3429 struct device_attribute *attr, char *buf)
3430{
3431 struct console *cs[16];
3432 int i = 0;
3433 struct console *c;
3434 ssize_t count = 0;
3435
3436 console_lock();
3437 for_each_console(c) {
3438 if (!c->device)
3439 continue;
3440 if (!c->write)
3441 continue;
3442 if ((c->flags & CON_ENABLED) == 0)
3443 continue;
3444 cs[i++] = c;
3445 if (i >= ARRAY_SIZE(cs))
3446 break;
3447 }
3448 while (i--) {
3449 int index = cs[i]->index;
3450 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3451
3452 /* don't resolve tty0 as some programs depend on it */
3453 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3454 count += tty_line_name(drv, index, buf + count);
3455 else
3456 count += sprintf(buf + count, "%s%d",
3457 cs[i]->name, cs[i]->index);
3458
3459 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3460 }
3461 console_unlock();
3462
3463 return count;
3464}
3465static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3466
3467static struct attribute *cons_dev_attrs[] = {
3468 &dev_attr_active.attr,
3469 NULL
3470};
3471
3472ATTRIBUTE_GROUPS(cons_dev);
3473
3474static struct device *consdev;
3475
3476void console_sysfs_notify(void)
3477{
3478 if (consdev)
3479 sysfs_notify(&consdev->kobj, NULL, "active");
3480}
3481
3482/*
3483 * Ok, now we can initialize the rest of the tty devices and can count
3484 * on memory allocations, interrupts etc..
3485 */
3486int __init tty_init(void)
3487{
3488 tty_sysctl_init();
3489 cdev_init(&tty_cdev, &tty_fops);
3490 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3491 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3492 panic("Couldn't register /dev/tty driver\n");
3493 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3494
3495 cdev_init(&console_cdev, &console_fops);
3496 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3497 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3498 panic("Couldn't register /dev/console driver\n");
3499 consdev = device_create_with_groups(tty_class, NULL,
3500 MKDEV(TTYAUX_MAJOR, 1), NULL,
3501 cons_dev_groups, "console");
3502 if (IS_ERR(consdev))
3503 consdev = NULL;
3504
3505#ifdef CONFIG_VT
3506 vty_init(&console_fops);
3507#endif
3508 return 0;
3509}
3510
3511