1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* Copyright (C) 1991, 1992 Linus Torvalds
4	*/
5
6	/*
7	* 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
8	* or rs-channels. It also implements echoing, cooked mode etc.
9	*
10	* Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
11	*
12	* Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
13	* tty_struct and tty_queue structures. Previously there was an array
14	* of 256 tty_struct's which was statically allocated, and the
15	* tty_queue structures were allocated at boot time. Both are now
16	* dynamically allocated only when the tty is open.
17	*
18	* Also restructured routines so that there is more of a separation
19	* between the high-level tty routines (tty_io.c and tty_ioctl.c) and
20	* the low-level tty routines (serial.c, pty.c, console.c). This
21	* makes for cleaner and more compact code. -TYT, 9/17/92
22	*
23	* Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
24	* which can be dynamically activated and de-activated by the line
25	* discipline handling modules (like SLIP).
26	*
27	* NOTE: pay no attention to the line discipline code (yet); its
28	* interface is still subject to change in this version...
29	* -- TYT, 1/31/92
30	*
31	* Added functionality to the OPOST tty handling. No delays, but all
32	* other bits should be there.
33	* -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
34	*
35	* Rewrote canonical mode and added more termios flags.
36	* -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
37	*
38	* Reorganized FASYNC support so mouse code can share it.
39	* -- ctm@ardi.com, 9Sep95
40	*
41	* New TIOCLINUX variants added.
42	* -- mj@k332.feld.cvut.cz, 19-Nov-95
43	*
44	* Restrict vt switching via ioctl()
45	* -- grif@cs.ucr.edu, 5-Dec-95
46	*
47	* Move console and virtual terminal code to more appropriate files,
48	* implement CONFIG_VT and generalize console device interface.
49	* -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
50	*
51	* Rewrote tty_init_dev and tty_release_dev to eliminate races.
52	* -- Bill Hawes <whawes@star.net>, June 97
53	*
54	* Added devfs support.
55	* -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
56	*
57	* Added support for a Unix98-style ptmx device.
58	* -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
59	*
60	* Reduced memory usage for older ARM systems
61	* -- Russell King <rmk@arm.linux.org.uk>
62	*
63	* Move do_SAK() into process context. Less stack use in devfs functions.
64	* alloc_tty_struct() always uses kmalloc()
65	* -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66	*/
67
68	#include <linux/types.h>
69	#include <linux/major.h>
70	#include <linux/errno.h>
71	#include <linux/signal.h>
72	#include <linux/fcntl.h>
73	#include <linux/sched/signal.h>
74	#include <linux/sched/task.h>
75	#include <linux/interrupt.h>
76	#include <linux/tty.h>
77	#include <linux/tty_driver.h>
78	#include <linux/tty_flip.h>
79	#include <linux/devpts_fs.h>
80	#include <linux/file.h>
81	#include <linux/fdtable.h>
82	#include <linux/console.h>
83	#include <linux/timer.h>
84	#include <linux/ctype.h>
85	#include <linux/kd.h>
86	#include <linux/mm.h>
87	#include <linux/string.h>
88	#include <linux/slab.h>
89	#include <linux/poll.h>
90	#include <linux/ppp-ioctl.h>
91	#include <linux/proc_fs.h>
92	#include <linux/init.h>
93	#include <linux/module.h>
94	#include <linux/device.h>
95	#include <linux/wait.h>
96	#include <linux/bitops.h>
97	#include <linux/delay.h>
98	#include <linux/seq_file.h>
99	#include <linux/serial.h>
100	#include <linux/ratelimit.h>
101	#include <linux/compat.h>
102	#include <linux/uaccess.h>
103	#include <linux/termios_internal.h>
104	#include <linux/fs.h>
105
106	#include <linux/kbd_kern.h>
107	#include <linux/vt_kern.h>
108	#include <linux/selection.h>
109
110	#include <linux/kmod.h>
111	#include <linux/nsproxy.h>
112	#include "tty.h"
113
114	#undef TTY_DEBUG_HANGUP
115	#ifdef TTY_DEBUG_HANGUP
116	# define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
117	#else
118	# define tty_debug_hangup(tty, f, args...) do { } while (0)
119	#endif
120
121	#define TTY_PARANOIA_CHECK 1
122	#define CHECK_TTY_COUNT 1
123
124	struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
125	.c_iflag = ICRNL | IXON,
126	.c_oflag = OPOST | ONLCR,
127	.c_cflag = B38400 | CS8 | CREAD | HUPCL,
128	.c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
129	ECHOCTL | ECHOKE | IEXTEN,
130	.c_cc = INIT_C_CC,
131	.c_ispeed = 38400,
132	.c_ospeed = 38400,
133	/* .c_line = N_TTY, */
134	};
135	EXPORT_SYMBOL(tty_std_termios);
136
137	/* This list gets poked at by procfs and various bits of boot up code. This
138	* could do with some rationalisation such as pulling the tty proc function
139	* into this file.
140	*/
141
142	LIST_HEAD(tty_drivers); /* linked list of tty drivers */
143
144	/* Mutex to protect creating and releasing a tty */
145	DEFINE_MUTEX(tty_mutex);
146
147	static ssize_t tty_read(struct kiocb *, struct iov_iter *);
148	static ssize_t tty_write(struct kiocb *, struct iov_iter *);
149	static __poll_t tty_poll(struct file *, poll_table *);
150	static int tty_open(struct inode *, struct file *);
151	#ifdef CONFIG_COMPAT
152	static long tty_compat_ioctl(struct file *file, unsigned int cmd,
153	unsigned long arg);
154	#else
155	#define tty_compat_ioctl NULL
156	#endif
157	static int __tty_fasync(int fd, struct file *filp, int on);
158	static int tty_fasync(int fd, struct file *filp, int on);
159	static void release_tty(struct tty_struct *tty, int idx);
160
161	/**
162	* free_tty_struct - free a disused tty
163	* @tty: tty struct to free
164	*
165	* Free the write buffers, tty queue and tty memory itself.
166	*
167	* Locking: none. Must be called after tty is definitely unused
168	*/
169	static void free_tty_struct(struct tty_struct *tty)
170	{
171	tty_ldisc_deinit(tty);
172	put_device(dev: tty->dev);
173	kvfree(addr: tty->write_buf);
174	kfree(objp: tty);
175	}
176
177	static inline struct tty_struct *file_tty(struct file *file)
178	{
179	return ((struct tty_file_private *)file->private_data)->tty;
180	}
181
182	int tty_alloc_file(struct file *file)
183	{
184	struct tty_file_private *priv;
185
186	priv = kmalloc(size: sizeof(*priv), GFP_KERNEL);
187	if (!priv)
188	return -ENOMEM;
189
190	file->private_data = priv;
191
192	return 0;
193	}
194
195	/* Associate a new file with the tty structure */
196	void tty_add_file(struct tty_struct *tty, struct file *file)
197	{
198	struct tty_file_private *priv = file->private_data;
199
200	priv->tty = tty;
201	priv->file = file;
202
203	spin_lock(lock: &tty->files_lock);
204	list_add(new: &priv->list, head: &tty->tty_files);
205	spin_unlock(lock: &tty->files_lock);
206	}
207
208	/**
209	* tty_free_file - free file->private_data
210	* @file: to free private_data of
211	*
212	* This shall be used only for fail path handling when tty_add_file was not
213	* called yet.
214	*/
215	void tty_free_file(struct file *file)
216	{
217	struct tty_file_private *priv = file->private_data;
218
219	file->private_data = NULL;
220	kfree(objp: priv);
221	}
222
223	/* Delete file from its tty */
224	static void tty_del_file(struct file *file)
225	{
226	struct tty_file_private *priv = file->private_data;
227	struct tty_struct *tty = priv->tty;
228
229	spin_lock(lock: &tty->files_lock);
230	list_del(entry: &priv->list);
231	spin_unlock(lock: &tty->files_lock);
232	tty_free_file(file);
233	}
234
235	/**
236	* tty_name - return tty naming
237	* @tty: tty structure
238	*
239	* Convert a tty structure into a name. The name reflects the kernel naming
240	* policy and if udev is in use may not reflect user space
241	*
242	* Locking: none
243	*/
244	const char *tty_name(const struct tty_struct *tty)
245	{
246	if (!tty) /* Hmm. NULL pointer. That's fun. */
247	return "NULL tty";
248	return tty->name;
249	}
250	EXPORT_SYMBOL(tty_name);
251
252	const char *tty_driver_name(const struct tty_struct *tty)
253	{
254	if (!tty || !tty->driver)
255	return "";
256	return tty->driver->name;
257	}
258
259	static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
260	const char *routine)
261	{
262	#ifdef TTY_PARANOIA_CHECK
263	if (!tty) {
264	pr_warn("(%d:%d): %s: NULL tty\n",
265	imajor(inode), iminor(inode), routine);
266	return 1;
267	}
268	#endif
269	return 0;
270	}
271
272	/* Caller must hold tty_lock */
273	static void check_tty_count(struct tty_struct *tty, const char *routine)
274	{
275	#ifdef CHECK_TTY_COUNT
276	struct list_head *p;
277	int count = 0, kopen_count = 0;
278
279	spin_lock(lock: &tty->files_lock);
280	list_for_each(p, &tty->tty_files) {
281	count++;
282	}
283	spin_unlock(lock: &tty->files_lock);
284	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
285	tty->driver->subtype == PTY_TYPE_SLAVE &&
286	tty->link && tty->link->count)
287	count++;
288	if (tty_port_kopened(port: tty->port))
289	kopen_count++;
290	if (tty->count != (count + kopen_count)) {
291	tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
292	routine, tty->count, count, kopen_count);
293	}
294	#endif
295	}
296
297	/**
298	* get_tty_driver - find device of a tty
299	* @device: device identifier
300	* @index: returns the index of the tty
301	*
302	* This routine returns a tty driver structure, given a device number and also
303	* passes back the index number.
304	*
305	* Locking: caller must hold tty_mutex
306	*/
307	static struct tty_driver *get_tty_driver(dev_t device, int *index)
308	{
309	struct tty_driver *p;
310
311	list_for_each_entry(p, &tty_drivers, tty_drivers) {
312	dev_t base = MKDEV(p->major, p->minor_start);
313
314	if (device < base || device >= base + p->num)
315	continue;
316	*index = device - base;
317	return tty_driver_kref_get(d: p);
318	}
319	return NULL;
320	}
321
322	/**
323	* tty_dev_name_to_number - return dev_t for device name
324	* @name: user space name of device under /dev
325	* @number: pointer to dev_t that this function will populate
326	*
327	* This function converts device names like ttyS0 or ttyUSB1 into dev_t like
328	* (4, 64) or (188, 1). If no corresponding driver is registered then the
329	* function returns -%ENODEV.
330	*
331	* Locking: this acquires tty_mutex to protect the tty_drivers list from
332	* being modified while we are traversing it, and makes sure to
333	* release it before exiting.
334	*/
335	int tty_dev_name_to_number(const char *name, dev_t *number)
336	{
337	struct tty_driver *p;
338	int ret;
339	int index, prefix_length = 0;
340	const char *str;
341
342	for (str = name; *str && !isdigit(c: *str); str++)
343	;
344
345	if (!*str)
346	return -EINVAL;
347
348	ret = kstrtoint(s: str, base: 10, res: &index);
349	if (ret)
350	return ret;
351
352	prefix_length = str - name;
353	mutex_lock(&tty_mutex);
354
355	list_for_each_entry(p, &tty_drivers, tty_drivers)
356	if (prefix_length == strlen(p->name) && strncmp(name,
357	p->name, prefix_length) == 0) {
358	if (index < p->num) {
359	*number = MKDEV(p->major, p->minor_start + index);
360	goto out;
361	}
362	}
363
364	/* if here then driver wasn't found */
365	ret = -ENODEV;
366	out:
367	mutex_unlock(lock: &tty_mutex);
368	return ret;
369	}
370	EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
371
372	#ifdef CONFIG_CONSOLE_POLL
373
374	/**
375	* tty_find_polling_driver - find device of a polled tty
376	* @name: name string to match
377	* @line: pointer to resulting tty line nr
378	*
379	* This routine returns a tty driver structure, given a name and the condition
380	* that the tty driver is capable of polled operation.
381	*/
382	struct tty_driver *tty_find_polling_driver(char *name, int *line)
383	{
384	struct tty_driver *p, *res = NULL;
385	int tty_line = 0;
386	int len;
387	char *str, *stp;
388
389	for (str = name; *str; str++)
390	if ((*str >= '0' && *str <= '9') || *str == ',')
391	break;
392	if (!*str)
393	return NULL;
394
395	len = str - name;
396	tty_line = simple_strtoul(str, &str, 10);
397
398	mutex_lock(&tty_mutex);
399	/* Search through the tty devices to look for a match */
400	list_for_each_entry(p, &tty_drivers, tty_drivers) {
401	if (!len || strncmp(name, p->name, len) != 0)
402	continue;
403	stp = str;
404	if (*stp == ',')
405	stp++;
406	if (*stp == '\0')
407	stp = NULL;
408
409	if (tty_line >= 0 && tty_line < p->num && p->ops &&
410	p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
411	res = tty_driver_kref_get(d: p);
412	*line = tty_line;
413	break;
414	}
415	}
416	mutex_unlock(lock: &tty_mutex);
417
418	return res;
419	}
420	EXPORT_SYMBOL_GPL(tty_find_polling_driver);
421	#endif
422
423	static ssize_t hung_up_tty_read(struct kiocb *iocb, struct iov_iter *to)
424	{
425	return 0;
426	}
427
428	static ssize_t hung_up_tty_write(struct kiocb *iocb, struct iov_iter *from)
429	{
430	return -EIO;
431	}
432
433	/* No kernel lock held - none needed ;) */
434	static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
435	{
436	return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
437	}
438
439	static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
440	unsigned long arg)
441	{
442	return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
443	}
444
445	static long hung_up_tty_compat_ioctl(struct file *file,
446	unsigned int cmd, unsigned long arg)
447	{
448	return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
449	}
450
451	static int hung_up_tty_fasync(int fd, struct file *file, int on)
452	{
453	return -ENOTTY;
454	}
455
456	static void tty_show_fdinfo(struct seq_file *m, struct file *file)
457	{
458	struct tty_struct *tty = file_tty(file);
459
460	if (tty && tty->ops && tty->ops->show_fdinfo)
461	tty->ops->show_fdinfo(tty, m);
462	}
463
464	static const struct file_operations tty_fops = {
465	.llseek = no_llseek,
466	.read_iter = tty_read,
467	.write_iter = tty_write,
468	.splice_read = copy_splice_read,
469	.splice_write = iter_file_splice_write,
470	.poll = tty_poll,
471	.unlocked_ioctl = tty_ioctl,
472	.compat_ioctl = tty_compat_ioctl,
473	.open = tty_open,
474	.release = tty_release,
475	.fasync = tty_fasync,
476	.show_fdinfo = tty_show_fdinfo,
477	};
478
479	static const struct file_operations console_fops = {
480	.llseek = no_llseek,
481	.read_iter = tty_read,
482	.write_iter = redirected_tty_write,
483	.splice_read = copy_splice_read,
484	.splice_write = iter_file_splice_write,
485	.poll = tty_poll,
486	.unlocked_ioctl = tty_ioctl,
487	.compat_ioctl = tty_compat_ioctl,
488	.open = tty_open,
489	.release = tty_release,
490	.fasync = tty_fasync,
491	};
492
493	static const struct file_operations hung_up_tty_fops = {
494	.llseek = no_llseek,
495	.read_iter = hung_up_tty_read,
496	.write_iter = hung_up_tty_write,
497	.poll = hung_up_tty_poll,
498	.unlocked_ioctl = hung_up_tty_ioctl,
499	.compat_ioctl = hung_up_tty_compat_ioctl,
500	.release = tty_release,
501	.fasync = hung_up_tty_fasync,
502	};
503
504	static DEFINE_SPINLOCK(redirect_lock);
505	static struct file *redirect;
506
507	/**
508	* tty_wakeup - request more data
509	* @tty: terminal
510	*
511	* Internal and external helper for wakeups of tty. This function informs the
512	* line discipline if present that the driver is ready to receive more output
513	* data.
514	*/
515	void tty_wakeup(struct tty_struct *tty)
516	{
517	struct tty_ldisc *ld;
518
519	if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
520	ld = tty_ldisc_ref(tty);
521	if (ld) {
522	if (ld->ops->write_wakeup)
523	ld->ops->write_wakeup(tty);
524	tty_ldisc_deref(ld);
525	}
526	}
527	wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
528	}
529	EXPORT_SYMBOL_GPL(tty_wakeup);
530
531	/**
532	* tty_release_redirect - Release a redirect on a pty if present
533	* @tty: tty device
534	*
535	* This is available to the pty code so if the master closes, if the slave is a
536	* redirect it can release the redirect.
537	*/
538	static struct file *tty_release_redirect(struct tty_struct *tty)
539	{
540	struct file *f = NULL;
541
542	spin_lock(lock: &redirect_lock);
543	if (redirect && file_tty(file: redirect) == tty) {
544	f = redirect;
545	redirect = NULL;
546	}
547	spin_unlock(lock: &redirect_lock);
548
549	return f;
550	}
551
552	/**
553	* __tty_hangup - actual handler for hangup events
554	* @tty: tty device
555	* @exit_session: if non-zero, signal all foreground group processes
556	*
557	* This can be called by a "kworker" kernel thread. That is process synchronous
558	* but doesn't hold any locks, so we need to make sure we have the appropriate
559	* locks for what we're doing.
560	*
561	* The hangup event clears any pending redirections onto the hung up device. It
562	* ensures future writes will error and it does the needed line discipline
563	* hangup and signal delivery. The tty object itself remains intact.
564	*
565	* Locking:
566	* * BTM
567	*
568	* * redirect lock for undoing redirection
569	* * file list lock for manipulating list of ttys
570	* * tty_ldiscs_lock from called functions
571	* * termios_rwsem resetting termios data
572	* * tasklist_lock to walk task list for hangup event
573	*
574	* * ->siglock to protect ->signal/->sighand
575	*
576	*/
577	static void __tty_hangup(struct tty_struct *tty, int exit_session)
578	{
579	struct file *cons_filp = NULL;
580	struct file *filp, *f;
581	struct tty_file_private *priv;
582	int closecount = 0, n;
583	int refs;
584
585	if (!tty)
586	return;
587
588	f = tty_release_redirect(tty);
589
590	tty_lock(tty);
591
592	if (test_bit(TTY_HUPPED, &tty->flags)) {
593	tty_unlock(tty);
594	return;
595	}
596
597	/*
598	* Some console devices aren't actually hung up for technical and
599	* historical reasons, which can lead to indefinite interruptible
600	* sleep in n_tty_read(). The following explicitly tells
601	* n_tty_read() to abort readers.
602	*/
603	set_bit(TTY_HUPPING, addr: &tty->flags);
604
605	/* inuse_filps is protected by the single tty lock,
606	* this really needs to change if we want to flush the
607	* workqueue with the lock held.
608	*/
609	check_tty_count(tty, routine: "tty_hangup");
610
611	spin_lock(lock: &tty->files_lock);
612	/* This breaks for file handles being sent over AF_UNIX sockets ? */
613	list_for_each_entry(priv, &tty->tty_files, list) {
614	filp = priv->file;
615	if (filp->f_op->write_iter == redirected_tty_write)
616	cons_filp = filp;
617	if (filp->f_op->write_iter != tty_write)
618	continue;
619	closecount++;
620	__tty_fasync(fd: -1, filp, on: 0); /* can't block */
621	filp->f_op = &hung_up_tty_fops;
622	}
623	spin_unlock(lock: &tty->files_lock);
624
625	refs = tty_signal_session_leader(tty, exit_session);
626	/* Account for the p->signal references we killed */
627	while (refs--)
628	tty_kref_put(tty);
629
630	tty_ldisc_hangup(tty, reset: cons_filp != NULL);
631
632	spin_lock_irq(lock: &tty->ctrl.lock);
633	clear_bit(TTY_THROTTLED, addr: &tty->flags);
634	clear_bit(TTY_DO_WRITE_WAKEUP, addr: &tty->flags);
635	put_pid(pid: tty->ctrl.session);
636	put_pid(pid: tty->ctrl.pgrp);
637	tty->ctrl.session = NULL;
638	tty->ctrl.pgrp = NULL;
639	tty->ctrl.pktstatus = 0;
640	spin_unlock_irq(lock: &tty->ctrl.lock);
641
642	/*
643	* If one of the devices matches a console pointer, we
644	* cannot just call hangup() because that will cause
645	* tty->count and state->count to go out of sync.
646	* So we just call close() the right number of times.
647	*/
648	if (cons_filp) {
649	if (tty->ops->close)
650	for (n = 0; n < closecount; n++)
651	tty->ops->close(tty, cons_filp);
652	} else if (tty->ops->hangup)
653	tty->ops->hangup(tty);
654	/*
655	* We don't want to have driver/ldisc interactions beyond the ones
656	* we did here. The driver layer expects no calls after ->hangup()
657	* from the ldisc side, which is now guaranteed.
658	*/
659	set_bit(TTY_HUPPED, addr: &tty->flags);
660	clear_bit(TTY_HUPPING, addr: &tty->flags);
661	tty_unlock(tty);
662
663	if (f)
664	fput(f);
665	}
666
667	static void do_tty_hangup(struct work_struct *work)
668	{
669	struct tty_struct *tty =
670	container_of(work, struct tty_struct, hangup_work);
671
672	__tty_hangup(tty, exit_session: 0);
673	}
674
675	/**
676	* tty_hangup - trigger a hangup event
677	* @tty: tty to hangup
678	*
679	* A carrier loss (virtual or otherwise) has occurred on @tty. Schedule a
680	* hangup sequence to run after this event.
681	*/
682	void tty_hangup(struct tty_struct *tty)
683	{
684	tty_debug_hangup(tty, "hangup\n");
685	schedule_work(work: &tty->hangup_work);
686	}
687	EXPORT_SYMBOL(tty_hangup);
688
689	/**
690	* tty_vhangup - process vhangup
691	* @tty: tty to hangup
692	*
693	* The user has asked via system call for the terminal to be hung up. We do
694	* this synchronously so that when the syscall returns the process is complete.
695	* That guarantee is necessary for security reasons.
696	*/
697	void tty_vhangup(struct tty_struct *tty)
698	{
699	tty_debug_hangup(tty, "vhangup\n");
700	__tty_hangup(tty, exit_session: 0);
701	}
702	EXPORT_SYMBOL(tty_vhangup);
703
704
705	/**
706	* tty_vhangup_self - process vhangup for own ctty
707	*
708	* Perform a vhangup on the current controlling tty
709	*/
710	void tty_vhangup_self(void)
711	{
712	struct tty_struct *tty;
713
714	tty = get_current_tty();
715	if (tty) {
716	tty_vhangup(tty);
717	tty_kref_put(tty);
718	}
719	}
720
721	/**
722	* tty_vhangup_session - hangup session leader exit
723	* @tty: tty to hangup
724	*
725	* The session leader is exiting and hanging up its controlling terminal.
726	* Every process in the foreground process group is signalled %SIGHUP.
727	*
728	* We do this synchronously so that when the syscall returns the process is
729	* complete. That guarantee is necessary for security reasons.
730	*/
731	void tty_vhangup_session(struct tty_struct *tty)
732	{
733	tty_debug_hangup(tty, "session hangup\n");
734	__tty_hangup(tty, exit_session: 1);
735	}
736
737	/**
738	* tty_hung_up_p - was tty hung up
739	* @filp: file pointer of tty
740	*
741	* Return: true if the tty has been subject to a vhangup or a carrier loss
742	*/
743	int tty_hung_up_p(struct file *filp)
744	{
745	return (filp && filp->f_op == &hung_up_tty_fops);
746	}
747	EXPORT_SYMBOL(tty_hung_up_p);
748
749	void __stop_tty(struct tty_struct *tty)
750	{
751	if (tty->flow.stopped)
752	return;
753	tty->flow.stopped = true;
754	if (tty->ops->stop)
755	tty->ops->stop(tty);
756	}
757
758	/**
759	* stop_tty - propagate flow control
760	* @tty: tty to stop
761	*
762	* Perform flow control to the driver. May be called on an already stopped
763	* device and will not re-call the &tty_driver->stop() method.
764	*
765	* This functionality is used by both the line disciplines for halting incoming
766	* flow and by the driver. It may therefore be called from any context, may be
767	* under the tty %atomic_write_lock but not always.
768	*
769	* Locking:
770	* flow.lock
771	*/
772	void stop_tty(struct tty_struct *tty)
773	{
774	unsigned long flags;
775
776	spin_lock_irqsave(&tty->flow.lock, flags);
777	__stop_tty(tty);
778	spin_unlock_irqrestore(lock: &tty->flow.lock, flags);
779	}
780	EXPORT_SYMBOL(stop_tty);
781
782	void __start_tty(struct tty_struct *tty)
783	{
784	if (!tty->flow.stopped || tty->flow.tco_stopped)
785	return;
786	tty->flow.stopped = false;
787	if (tty->ops->start)
788	tty->ops->start(tty);
789	tty_wakeup(tty);
790	}
791
792	/**
793	* start_tty - propagate flow control
794	* @tty: tty to start
795	*
796	* Start a tty that has been stopped if at all possible. If @tty was previously
797	* stopped and is now being started, the &tty_driver->start() method is invoked
798	* and the line discipline woken.
799	*
800	* Locking:
801	* flow.lock
802	*/
803	void start_tty(struct tty_struct *tty)
804	{
805	unsigned long flags;
806
807	spin_lock_irqsave(&tty->flow.lock, flags);
808	__start_tty(tty);
809	spin_unlock_irqrestore(lock: &tty->flow.lock, flags);
810	}
811	EXPORT_SYMBOL(start_tty);
812
813	static void tty_update_time(struct tty_struct *tty, bool mtime)
814	{
815	time64_t sec = ktime_get_real_seconds();
816	struct tty_file_private *priv;
817
818	spin_lock(lock: &tty->files_lock);
819	list_for_each_entry(priv, &tty->tty_files, list) {
820	struct inode *inode = file_inode(f: priv->file);
821	struct timespec64 time = mtime ? inode_get_mtime(inode) : inode_get_atime(inode);
822
823	/*
824	* We only care if the two values differ in anything other than the
825	* lower three bits (i.e every 8 seconds). If so, then we can update
826	* the time of the tty device, otherwise it could be construded as a
827	* security leak to let userspace know the exact timing of the tty.
828	*/
829	if ((sec ^ time.tv_sec) & ~7) {
830	if (mtime)
831	inode_set_mtime(inode, sec, nsec: 0);
832	else
833	inode_set_atime(inode, sec, nsec: 0);
834	}
835	}
836	spin_unlock(lock: &tty->files_lock);
837	}
838
839	/*
840	* Iterate on the ldisc ->read() function until we've gotten all
841	* the data the ldisc has for us.
842	*
843	* The "cookie" is something that the ldisc read function can fill
844	* in to let us know that there is more data to be had.
845	*
846	* We promise to continue to call the ldisc until it stops returning
847	* data or clears the cookie. The cookie may be something that the
848	* ldisc maintains state for and needs to free.
849	*/
850	static ssize_t iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty,
851	struct file *file, struct iov_iter *to)
852	{
853	void *cookie = NULL;
854	unsigned long offset = 0;
855	char kernel_buf[64];
856	ssize_t retval = 0;
857	size_t copied, count = iov_iter_count(i: to);
858
859	do {
860	ssize_t size = min(count, sizeof(kernel_buf));
861
862	size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
863	if (!size)
864	break;
865
866	if (size < 0) {
867	/* Did we have an earlier error (ie -EFAULT)? */
868	if (retval)
869	break;
870	retval = size;
871
872	/*
873	* -EOVERFLOW means we didn't have enough space
874	* for a whole packet, and we shouldn't return
875	* a partial result.
876	*/
877	if (retval == -EOVERFLOW)
878	offset = 0;
879	break;
880	}
881
882	copied = copy_to_iter(addr: kernel_buf, bytes: size, i: to);
883	offset += copied;
884	count -= copied;
885
886	/*
887	* If the user copy failed, we still need to do another ->read()
888	* call if we had a cookie to let the ldisc clear up.
889	*
890	* But make sure size is zeroed.
891	*/
892	if (unlikely(copied != size)) {
893	count = 0;
894	retval = -EFAULT;
895	}
896	} while (cookie);
897
898	/* We always clear tty buffer in case they contained passwords */
899	memzero_explicit(s: kernel_buf, count: sizeof(kernel_buf));
900	return offset ? offset : retval;
901	}
902
903
904	/**
905	* tty_read - read method for tty device files
906	* @iocb: kernel I/O control block
907	* @to: destination for the data read
908	*
909	* Perform the read system call function on this terminal device. Checks
910	* for hung up devices before calling the line discipline method.
911	*
912	* Locking:
913	* Locks the line discipline internally while needed. Multiple read calls
914	* may be outstanding in parallel.
915	*/
916	static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
917	{
918	struct file *file = iocb->ki_filp;
919	struct inode *inode = file_inode(f: file);
920	struct tty_struct *tty = file_tty(file);
921	struct tty_ldisc *ld;
922	ssize_t ret;
923
924	if (tty_paranoia_check(tty, inode, routine: "tty_read"))
925	return -EIO;
926	if (!tty || tty_io_error(tty))
927	return -EIO;
928
929	/* We want to wait for the line discipline to sort out in this
930	* situation.
931	*/
932	ld = tty_ldisc_ref_wait(tty);
933	if (!ld)
934	return hung_up_tty_read(iocb, to);
935	ret = -EIO;
936	if (ld->ops->read)
937	ret = iterate_tty_read(ld, tty, file, to);
938	tty_ldisc_deref(ld);
939
940	if (ret > 0)
941	tty_update_time(tty, mtime: false);
942
943	return ret;
944	}
945
946	void tty_write_unlock(struct tty_struct *tty)
947	{
948	mutex_unlock(lock: &tty->atomic_write_lock);
949	wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
950	}
951
952	int tty_write_lock(struct tty_struct *tty, bool ndelay)
953	{
954	if (!mutex_trylock(lock: &tty->atomic_write_lock)) {
955	if (ndelay)
956	return -EAGAIN;
957	if (mutex_lock_interruptible(&tty->atomic_write_lock))
958	return -ERESTARTSYS;
959	}
960	return 0;
961	}
962
963	/*
964	* Split writes up in sane blocksizes to avoid
965	* denial-of-service type attacks
966	*/
967	static ssize_t iterate_tty_write(struct tty_ldisc *ld, struct tty_struct *tty,
968	struct file *file, struct iov_iter *from)
969	{
970	size_t chunk, count = iov_iter_count(i: from);
971	ssize_t ret, written = 0;
972
973	ret = tty_write_lock(tty, ndelay: file->f_flags & O_NDELAY);
974	if (ret < 0)
975	return ret;
976
977	/*
978	* We chunk up writes into a temporary buffer. This
979	* simplifies low-level drivers immensely, since they
980	* don't have locking issues and user mode accesses.
981	*
982	* But if TTY_NO_WRITE_SPLIT is set, we should use a
983	* big chunk-size..
984	*
985	* The default chunk-size is 2kB, because the NTTY
986	* layer has problems with bigger chunks. It will
987	* claim to be able to handle more characters than
988	* it actually does.
989	*/
990	chunk = 2048;
991	if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
992	chunk = 65536;
993	if (count < chunk)
994	chunk = count;
995
996	/* write_buf/write_cnt is protected by the atomic_write_lock mutex */
997	if (tty->write_cnt < chunk) {
998	unsigned char *buf_chunk;
999
1000	if (chunk < 1024)
1001	chunk = 1024;
1002
1003	buf_chunk = kvmalloc(size: chunk, GFP_KERNEL | __GFP_RETRY_MAYFAIL);
1004	if (!buf_chunk) {
1005	ret = -ENOMEM;
1006	goto out;
1007	}
1008	kvfree(addr: tty->write_buf);
1009	tty->write_cnt = chunk;
1010	tty->write_buf = buf_chunk;
1011	}
1012
1013	/* Do the write .. */
1014	for (;;) {
1015	size_t size = min(chunk, count);
1016
1017	ret = -EFAULT;
1018	if (copy_from_iter(addr: tty->write_buf, bytes: size, i: from) != size)
1019	break;
1020
1021	ret = ld->ops->write(tty, file, tty->write_buf, size);
1022	if (ret <= 0)
1023	break;
1024
1025	written += ret;
1026	if (ret > size)
1027	break;
1028
1029	/* FIXME! Have Al check this! */
1030	if (ret != size)
1031	iov_iter_revert(i: from, bytes: size-ret);
1032
1033	count -= ret;
1034	if (!count)
1035	break;
1036	ret = -ERESTARTSYS;
1037	if (signal_pending(current))
1038	break;
1039	cond_resched();
1040	}
1041	if (written) {
1042	tty_update_time(tty, mtime: true);
1043	ret = written;
1044	}
1045	out:
1046	tty_write_unlock(tty);
1047	return ret;
1048	}
1049
1050	/**
1051	* tty_write_message - write a message to a certain tty, not just the console.
1052	* @tty: the destination tty_struct
1053	* @msg: the message to write
1054	*
1055	* This is used for messages that need to be redirected to a specific tty. We
1056	* don't put it into the syslog queue right now maybe in the future if really
1057	* needed.
1058	*
1059	* We must still hold the BTM and test the CLOSING flag for the moment.
1060	*/
1061	void tty_write_message(struct tty_struct *tty, char *msg)
1062	{
1063	if (tty) {
1064	mutex_lock(&tty->atomic_write_lock);
1065	tty_lock(tty);
1066	if (tty->ops->write && tty->count > 0)
1067	tty->ops->write(tty, msg, strlen(msg));
1068	tty_unlock(tty);
1069	tty_write_unlock(tty);
1070	}
1071	}
1072
1073	static ssize_t file_tty_write(struct file *file, struct kiocb *iocb, struct iov_iter *from)
1074	{
1075	struct tty_struct *tty = file_tty(file);
1076	struct tty_ldisc *ld;
1077	ssize_t ret;
1078
1079	if (tty_paranoia_check(tty, inode: file_inode(f: file), routine: "tty_write"))
1080	return -EIO;
1081	if (!tty || !tty->ops->write || tty_io_error(tty))
1082	return -EIO;
1083	/* Short term debug to catch buggy drivers */
1084	if (tty->ops->write_room == NULL)
1085	tty_err(tty, "missing write_room method\n");
1086	ld = tty_ldisc_ref_wait(tty);
1087	if (!ld)
1088	return hung_up_tty_write(iocb, from);
1089	if (!ld->ops->write)
1090	ret = -EIO;
1091	else
1092	ret = iterate_tty_write(ld, tty, file, from);
1093	tty_ldisc_deref(ld);
1094	return ret;
1095	}
1096
1097	/**
1098	* tty_write - write method for tty device file
1099	* @iocb: kernel I/O control block
1100	* @from: iov_iter with data to write
1101	*
1102	* Write data to a tty device via the line discipline.
1103	*
1104	* Locking:
1105	* Locks the line discipline as required
1106	* Writes to the tty driver are serialized by the atomic_write_lock
1107	* and are then processed in chunks to the device. The line
1108	* discipline write method will not be invoked in parallel for
1109	* each device.
1110	*/
1111	static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
1112	{
1113	return file_tty_write(file: iocb->ki_filp, iocb, from);
1114	}
1115
1116	ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
1117	{
1118	struct file *p = NULL;
1119
1120	spin_lock(lock: &redirect_lock);
1121	if (redirect)
1122	p = get_file(f: redirect);
1123	spin_unlock(lock: &redirect_lock);
1124
1125	/*
1126	* We know the redirected tty is just another tty, we can
1127	* call file_tty_write() directly with that file pointer.
1128	*/
1129	if (p) {
1130	ssize_t res;
1131
1132	res = file_tty_write(file: p, iocb, from: iter);
1133	fput(p);
1134	return res;
1135	}
1136	return tty_write(iocb, from: iter);
1137	}
1138
1139	/**
1140	* tty_send_xchar - send priority character
1141	* @tty: the tty to send to
1142	* @ch: xchar to send
1143	*
1144	* Send a high priority character to the tty even if stopped.
1145	*
1146	* Locking: none for xchar method, write ordering for write method.
1147	*/
1148	int tty_send_xchar(struct tty_struct *tty, char ch)
1149	{
1150	bool was_stopped = tty->flow.stopped;
1151
1152	if (tty->ops->send_xchar) {
1153	down_read(sem: &tty->termios_rwsem);
1154	tty->ops->send_xchar(tty, ch);
1155	up_read(sem: &tty->termios_rwsem);
1156	return 0;
1157	}
1158
1159	if (tty_write_lock(tty, ndelay: false) < 0)
1160	return -ERESTARTSYS;
1161
1162	down_read(sem: &tty->termios_rwsem);
1163	if (was_stopped)
1164	start_tty(tty);
1165	tty->ops->write(tty, &ch, 1);
1166	if (was_stopped)
1167	stop_tty(tty);
1168	up_read(sem: &tty->termios_rwsem);
1169	tty_write_unlock(tty);
1170	return 0;
1171	}
1172
1173	/**
1174	* pty_line_name - generate name for a pty
1175	* @driver: the tty driver in use
1176	* @index: the minor number
1177	* @p: output buffer of at least 6 bytes
1178	*
1179	* Generate a name from a @driver reference and write it to the output buffer
1180	* @p.
1181	*
1182	* Locking: None
1183	*/
1184	static void pty_line_name(struct tty_driver *driver, int index, char *p)
1185	{
1186	static const char ptychar[] = "pqrstuvwxyzabcde";
1187	int i = index + driver->name_base;
1188	/* ->name is initialized to "ttyp", but "tty" is expected */
1189	sprintf(buf: p, fmt: "%s%c%x",
1190	driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1191	ptychar[i >> 4 & 0xf], i & 0xf);
1192	}
1193
1194	/**
1195	* tty_line_name - generate name for a tty
1196	* @driver: the tty driver in use
1197	* @index: the minor number
1198	* @p: output buffer of at least 7 bytes
1199	*
1200	* Generate a name from a @driver reference and write it to the output buffer
1201	* @p.
1202	*
1203	* Locking: None
1204	*/
1205	static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1206	{
1207	if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1208	return sprintf(buf: p, fmt: "%s", driver->name);
1209	else
1210	return sprintf(buf: p, fmt: "%s%d", driver->name,
1211	index + driver->name_base);
1212	}
1213
1214	/**
1215	* tty_driver_lookup_tty() - find an existing tty, if any
1216	* @driver: the driver for the tty
1217	* @file: file object
1218	* @idx: the minor number
1219	*
1220	* Return: the tty, if found. If not found, return %NULL or ERR_PTR() if the
1221	* driver lookup() method returns an error.
1222	*
1223	* Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1224	*/
1225	static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1226	struct file *file, int idx)
1227	{
1228	struct tty_struct *tty;
1229
1230	if (driver->ops->lookup) {
1231	if (!file)
1232	tty = ERR_PTR(error: -EIO);
1233	else
1234	tty = driver->ops->lookup(driver, file, idx);
1235	} else {
1236	if (idx >= driver->num)
1237	return ERR_PTR(error: -EINVAL);
1238	tty = driver->ttys[idx];
1239	}
1240	if (!IS_ERR(ptr: tty))
1241	tty_kref_get(tty);
1242	return tty;
1243	}
1244
1245	/**
1246	* tty_init_termios - helper for termios setup
1247	* @tty: the tty to set up
1248	*
1249	* Initialise the termios structure for this tty. This runs under the
1250	* %tty_mutex currently so we can be relaxed about ordering.
1251	*/
1252	void tty_init_termios(struct tty_struct *tty)
1253	{
1254	struct ktermios *tp;
1255	int idx = tty->index;
1256
1257	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1258	tty->termios = tty->driver->init_termios;
1259	else {
1260	/* Check for lazy saved data */
1261	tp = tty->driver->termios[idx];
1262	if (tp != NULL) {
1263	tty->termios = *tp;
1264	tty->termios.c_line = tty->driver->init_termios.c_line;
1265	} else
1266	tty->termios = tty->driver->init_termios;
1267	}
1268	/* Compatibility until drivers always set this */
1269	tty->termios.c_ispeed = tty_termios_input_baud_rate(termios: &tty->termios);
1270	tty->termios.c_ospeed = tty_termios_baud_rate(termios: &tty->termios);
1271	}
1272	EXPORT_SYMBOL_GPL(tty_init_termios);
1273
1274	/**
1275	* tty_standard_install - usual tty->ops->install
1276	* @driver: the driver for the tty
1277	* @tty: the tty
1278	*
1279	* If the @driver overrides @tty->ops->install, it still can call this function
1280	* to perform the standard install operations.
1281	*/
1282	int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1283	{
1284	tty_init_termios(tty);
1285	tty_driver_kref_get(d: driver);
1286	tty->count++;
1287	driver->ttys[tty->index] = tty;
1288	return 0;
1289	}
1290	EXPORT_SYMBOL_GPL(tty_standard_install);
1291
1292	/**
1293	* tty_driver_install_tty() - install a tty entry in the driver
1294	* @driver: the driver for the tty
1295	* @tty: the tty
1296	*
1297	* Install a tty object into the driver tables. The @tty->index field will be
1298	* set by the time this is called. This method is responsible for ensuring any
1299	* need additional structures are allocated and configured.
1300	*
1301	* Locking: tty_mutex for now
1302	*/
1303	static int tty_driver_install_tty(struct tty_driver *driver,
1304	struct tty_struct *tty)
1305	{
1306	return driver->ops->install ? driver->ops->install(driver, tty) :
1307	tty_standard_install(driver, tty);
1308	}
1309
1310	/**
1311	* tty_driver_remove_tty() - remove a tty from the driver tables
1312	* @driver: the driver for the tty
1313	* @tty: tty to remove
1314	*
1315	* Remove a tty object from the driver tables. The tty->index field will be set
1316	* by the time this is called.
1317	*
1318	* Locking: tty_mutex for now
1319	*/
1320	static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1321	{
1322	if (driver->ops->remove)
1323	driver->ops->remove(driver, tty);
1324	else
1325	driver->ttys[tty->index] = NULL;
1326	}
1327
1328	/**
1329	* tty_reopen() - fast re-open of an open tty
1330	* @tty: the tty to open
1331	*
1332	* Re-opens on master ptys are not allowed and return -%EIO.
1333	*
1334	* Locking: Caller must hold tty_lock
1335	* Return: 0 on success, -errno on error.
1336	*/
1337	static int tty_reopen(struct tty_struct *tty)
1338	{
1339	struct tty_driver *driver = tty->driver;
1340	struct tty_ldisc *ld;
1341	int retval = 0;
1342
1343	if (driver->type == TTY_DRIVER_TYPE_PTY &&
1344	driver->subtype == PTY_TYPE_MASTER)
1345	return -EIO;
1346
1347	if (!tty->count)
1348	return -EAGAIN;
1349
1350	if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1351	return -EBUSY;
1352
1353	ld = tty_ldisc_ref_wait(tty);
1354	if (ld) {
1355	tty_ldisc_deref(ld);
1356	} else {
1357	retval = tty_ldisc_lock(tty, timeout: 5 * HZ);
1358	if (retval)
1359	return retval;
1360
1361	if (!tty->ldisc)
1362	retval = tty_ldisc_reinit(tty, disc: tty->termios.c_line);
1363	tty_ldisc_unlock(tty);
1364	}
1365
1366	if (retval == 0)
1367	tty->count++;
1368
1369	return retval;
1370	}
1371
1372	/**
1373	* tty_init_dev - initialise a tty device
1374	* @driver: tty driver we are opening a device on
1375	* @idx: device index
1376	*
1377	* Prepare a tty device. This may not be a "new" clean device but could also be
1378	* an active device. The pty drivers require special handling because of this.
1379	*
1380	* Locking:
1381	* The function is called under the tty_mutex, which protects us from the
1382	* tty struct or driver itself going away.
1383	*
1384	* On exit the tty device has the line discipline attached and a reference
1385	* count of 1. If a pair was created for pty/tty use and the other was a pty
1386	* master then it too has a reference count of 1.
1387	*
1388	* WSH 06/09/97: Rewritten to remove races and properly clean up after a failed
1389	* open. The new code protects the open with a mutex, so it's really quite
1390	* straightforward. The mutex locking can probably be relaxed for the (most
1391	* common) case of reopening a tty.
1392	*
1393	* Return: new tty structure
1394	*/
1395	struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1396	{
1397	struct tty_struct *tty;
1398	int retval;
1399
1400	/*
1401	* First time open is complex, especially for PTY devices.
1402	* This code guarantees that either everything succeeds and the
1403	* TTY is ready for operation, or else the table slots are vacated
1404	* and the allocated memory released. (Except that the termios
1405	* may be retained.)
1406	*/
1407
1408	if (!try_module_get(module: driver->owner))
1409	return ERR_PTR(error: -ENODEV);
1410
1411	tty = alloc_tty_struct(driver, idx);
1412	if (!tty) {
1413	retval = -ENOMEM;
1414	goto err_module_put;
1415	}
1416
1417	tty_lock(tty);
1418	retval = tty_driver_install_tty(driver, tty);
1419	if (retval < 0)
1420	goto err_free_tty;
1421
1422	if (!tty->port)
1423	tty->port = driver->ports[idx];
1424
1425	if (WARN_RATELIMIT(!tty->port,
1426	"%s: %s driver does not set tty->port. This would crash the kernel. Fix the driver!\n",
1427	__func__, tty->driver->name)) {
1428	retval = -EINVAL;
1429	goto err_release_lock;
1430	}
1431
1432	retval = tty_ldisc_lock(tty, timeout: 5 * HZ);
1433	if (retval)
1434	goto err_release_lock;
1435	tty->port->itty = tty;
1436
1437	/*
1438	* Structures all installed ... call the ldisc open routines.
1439	* If we fail here just call release_tty to clean up. No need
1440	* to decrement the use counts, as release_tty doesn't care.
1441	*/
1442	retval = tty_ldisc_setup(tty, o_tty: tty->link);
1443	if (retval)
1444	goto err_release_tty;
1445	tty_ldisc_unlock(tty);
1446	/* Return the tty locked so that it cannot vanish under the caller */
1447	return tty;
1448
1449	err_free_tty:
1450	tty_unlock(tty);
1451	free_tty_struct(tty);
1452	err_module_put:
1453	module_put(module: driver->owner);
1454	return ERR_PTR(error: retval);
1455
1456	/* call the tty release_tty routine to clean out this slot */
1457	err_release_tty:
1458	tty_ldisc_unlock(tty);
1459	tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1460	retval, idx);
1461	err_release_lock:
1462	tty_unlock(tty);
1463	release_tty(tty, idx);
1464	return ERR_PTR(error: retval);
1465	}
1466
1467	/**
1468	* tty_save_termios() - save tty termios data in driver table
1469	* @tty: tty whose termios data to save
1470	*
1471	* Locking: Caller guarantees serialisation with tty_init_termios().
1472	*/
1473	void tty_save_termios(struct tty_struct *tty)
1474	{
1475	struct ktermios *tp;
1476	int idx = tty->index;
1477
1478	/* If the port is going to reset then it has no termios to save */
1479	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1480	return;
1481
1482	/* Stash the termios data */
1483	tp = tty->driver->termios[idx];
1484	if (tp == NULL) {
1485	tp = kmalloc(size: sizeof(*tp), GFP_KERNEL);
1486	if (tp == NULL)
1487	return;
1488	tty->driver->termios[idx] = tp;
1489	}
1490	*tp = tty->termios;
1491	}
1492	EXPORT_SYMBOL_GPL(tty_save_termios);
1493
1494	/**
1495	* tty_flush_works - flush all works of a tty/pty pair
1496	* @tty: tty device to flush works for (or either end of a pty pair)
1497	*
1498	* Sync flush all works belonging to @tty (and the 'other' tty).
1499	*/
1500	static void tty_flush_works(struct tty_struct *tty)
1501	{
1502	flush_work(work: &tty->SAK_work);
1503	flush_work(work: &tty->hangup_work);
1504	if (tty->link) {
1505	flush_work(work: &tty->link->SAK_work);
1506	flush_work(work: &tty->link->hangup_work);
1507	}
1508	}
1509
1510	/**
1511	* release_one_tty - release tty structure memory
1512	* @work: work of tty we are obliterating
1513	*
1514	* Releases memory associated with a tty structure, and clears out the
1515	* driver table slots. This function is called when a device is no longer
1516	* in use. It also gets called when setup of a device fails.
1517	*
1518	* Locking:
1519	* takes the file list lock internally when working on the list of ttys
1520	* that the driver keeps.
1521	*
1522	* This method gets called from a work queue so that the driver private
1523	* cleanup ops can sleep (needed for USB at least)
1524	*/
1525	static void release_one_tty(struct work_struct *work)
1526	{
1527	struct tty_struct *tty =
1528	container_of(work, struct tty_struct, hangup_work);
1529	struct tty_driver *driver = tty->driver;
1530	struct module *owner = driver->owner;
1531
1532	if (tty->ops->cleanup)
1533	tty->ops->cleanup(tty);
1534
1535	tty_driver_kref_put(driver);
1536	module_put(module: owner);
1537
1538	spin_lock(lock: &tty->files_lock);
1539	list_del_init(entry: &tty->tty_files);
1540	spin_unlock(lock: &tty->files_lock);
1541
1542	put_pid(pid: tty->ctrl.pgrp);
1543	put_pid(pid: tty->ctrl.session);
1544	free_tty_struct(tty);
1545	}
1546
1547	static void queue_release_one_tty(struct kref *kref)
1548	{
1549	struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1550
1551	/* The hangup queue is now free so we can reuse it rather than
1552	* waste a chunk of memory for each port.
1553	*/
1554	INIT_WORK(&tty->hangup_work, release_one_tty);
1555	schedule_work(work: &tty->hangup_work);
1556	}
1557
1558	/**
1559	* tty_kref_put - release a tty kref
1560	* @tty: tty device
1561	*
1562	* Release a reference to the @tty device and if need be let the kref layer
1563	* destruct the object for us.
1564	*/
1565	void tty_kref_put(struct tty_struct *tty)
1566	{
1567	if (tty)
1568	kref_put(kref: &tty->kref, release: queue_release_one_tty);
1569	}
1570	EXPORT_SYMBOL(tty_kref_put);
1571
1572	/**
1573	* release_tty - release tty structure memory
1574	* @tty: tty device release
1575	* @idx: index of the tty device release
1576	*
1577	* Release both @tty and a possible linked partner (think pty pair),
1578	* and decrement the refcount of the backing module.
1579	*
1580	* Locking:
1581	* tty_mutex
1582	* takes the file list lock internally when working on the list of ttys
1583	* that the driver keeps.
1584	*/
1585	static void release_tty(struct tty_struct *tty, int idx)
1586	{
1587	/* This should always be true but check for the moment */
1588	WARN_ON(tty->index != idx);
1589	WARN_ON(!mutex_is_locked(&tty_mutex));
1590	if (tty->ops->shutdown)
1591	tty->ops->shutdown(tty);
1592	tty_save_termios(tty);
1593	tty_driver_remove_tty(driver: tty->driver, tty);
1594	if (tty->port)
1595	tty->port->itty = NULL;
1596	if (tty->link)
1597	tty->link->port->itty = NULL;
1598	if (tty->port)
1599	tty_buffer_cancel_work(port: tty->port);
1600	if (tty->link)
1601	tty_buffer_cancel_work(port: tty->link->port);
1602
1603	tty_kref_put(tty->link);
1604	tty_kref_put(tty);
1605	}
1606
1607	/**
1608	* tty_release_checks - check a tty before real release
1609	* @tty: tty to check
1610	* @idx: index of the tty
1611	*
1612	* Performs some paranoid checking before true release of the @tty. This is a
1613	* no-op unless %TTY_PARANOIA_CHECK is defined.
1614	*/
1615	static int tty_release_checks(struct tty_struct *tty, int idx)
1616	{
1617	#ifdef TTY_PARANOIA_CHECK
1618	if (idx < 0 || idx >= tty->driver->num) {
1619	tty_debug(tty, "bad idx %d\n", idx);
1620	return -1;
1621	}
1622
1623	/* not much to check for devpts */
1624	if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1625	return 0;
1626
1627	if (tty != tty->driver->ttys[idx]) {
1628	tty_debug(tty, "bad driver table[%d] = %p\n",
1629	idx, tty->driver->ttys[idx]);
1630	return -1;
1631	}
1632	if (tty->driver->other) {
1633	struct tty_struct *o_tty = tty->link;
1634
1635	if (o_tty != tty->driver->other->ttys[idx]) {
1636	tty_debug(tty, "bad other table[%d] = %p\n",
1637	idx, tty->driver->other->ttys[idx]);
1638	return -1;
1639	}
1640	if (o_tty->link != tty) {
1641	tty_debug(tty, "bad link = %p\n", o_tty->link);
1642	return -1;
1643	}
1644	}
1645	#endif
1646	return 0;
1647	}
1648
1649	/**
1650	* tty_kclose - closes tty opened by tty_kopen
1651	* @tty: tty device
1652	*
1653	* Performs the final steps to release and free a tty device. It is the same as
1654	* tty_release_struct() except that it also resets %TTY_PORT_KOPENED flag on
1655	* @tty->port.
1656	*/
1657	void tty_kclose(struct tty_struct *tty)
1658	{
1659	/*
1660	* Ask the line discipline code to release its structures
1661	*/
1662	tty_ldisc_release(tty);
1663
1664	/* Wait for pending work before tty destruction commences */
1665	tty_flush_works(tty);
1666
1667	tty_debug_hangup(tty, "freeing structure\n");
1668	/*
1669	* The release_tty function takes care of the details of clearing
1670	* the slots and preserving the termios structure.
1671	*/
1672	mutex_lock(&tty_mutex);
1673	tty_port_set_kopened(port: tty->port, val: 0);
1674	release_tty(tty, idx: tty->index);
1675	mutex_unlock(lock: &tty_mutex);
1676	}
1677	EXPORT_SYMBOL_GPL(tty_kclose);
1678
1679	/**
1680	* tty_release_struct - release a tty struct
1681	* @tty: tty device
1682	* @idx: index of the tty
1683	*
1684	* Performs the final steps to release and free a tty device. It is roughly the
1685	* reverse of tty_init_dev().
1686	*/
1687	void tty_release_struct(struct tty_struct *tty, int idx)
1688	{
1689	/*
1690	* Ask the line discipline code to release its structures
1691	*/
1692	tty_ldisc_release(tty);
1693
1694	/* Wait for pending work before tty destruction commmences */
1695	tty_flush_works(tty);
1696
1697	tty_debug_hangup(tty, "freeing structure\n");
1698	/*
1699	* The release_tty function takes care of the details of clearing
1700	* the slots and preserving the termios structure.
1701	*/
1702	mutex_lock(&tty_mutex);
1703	release_tty(tty, idx);
1704	mutex_unlock(lock: &tty_mutex);
1705	}
1706	EXPORT_SYMBOL_GPL(tty_release_struct);
1707
1708	/**
1709	* tty_release - vfs callback for close
1710	* @inode: inode of tty
1711	* @filp: file pointer for handle to tty
1712	*
1713	* Called the last time each file handle is closed that references this tty.
1714	* There may however be several such references.
1715	*
1716	* Locking:
1717	* Takes BKL. See tty_release_dev().
1718	*
1719	* Even releasing the tty structures is a tricky business. We have to be very
1720	* careful that the structures are all released at the same time, as interrupts
1721	* might otherwise get the wrong pointers.
1722	*
1723	* WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1724	* lead to double frees or releasing memory still in use.
1725	*/
1726	int tty_release(struct inode *inode, struct file *filp)
1727	{
1728	struct tty_struct *tty = file_tty(file: filp);
1729	struct tty_struct *o_tty = NULL;
1730	int do_sleep, final;
1731	int idx;
1732	long timeout = 0;
1733	int once = 1;
1734
1735	if (tty_paranoia_check(tty, inode, routine: __func__))
1736	return 0;
1737
1738	tty_lock(tty);
1739	check_tty_count(tty, routine: __func__);
1740
1741	__tty_fasync(fd: -1, filp, on: 0);
1742
1743	idx = tty->index;
1744	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1745	tty->driver->subtype == PTY_TYPE_MASTER)
1746	o_tty = tty->link;
1747
1748	if (tty_release_checks(tty, idx)) {
1749	tty_unlock(tty);
1750	return 0;
1751	}
1752
1753	tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1754
1755	if (tty->ops->close)
1756	tty->ops->close(tty, filp);
1757
1758	/* If tty is pty master, lock the slave pty (stable lock order) */
1759	tty_lock_slave(tty: o_tty);
1760
1761	/*
1762	* Sanity check: if tty->count is going to zero, there shouldn't be
1763	* any waiters on tty->read_wait or tty->write_wait. We test the
1764	* wait queues and kick everyone out _before_ actually starting to
1765	* close. This ensures that we won't block while releasing the tty
1766	* structure.
1767	*
1768	* The test for the o_tty closing is necessary, since the master and
1769	* slave sides may close in any order. If the slave side closes out
1770	* first, its count will be one, since the master side holds an open.
1771	* Thus this test wouldn't be triggered at the time the slave closed,
1772	* so we do it now.
1773	*/
1774	while (1) {
1775	do_sleep = 0;
1776
1777	if (tty->count <= 1) {
1778	if (waitqueue_active(wq_head: &tty->read_wait)) {
1779	wake_up_poll(&tty->read_wait, EPOLLIN);
1780	do_sleep++;
1781	}
1782	if (waitqueue_active(wq_head: &tty->write_wait)) {
1783	wake_up_poll(&tty->write_wait, EPOLLOUT);
1784	do_sleep++;
1785	}
1786	}
1787	if (o_tty && o_tty->count <= 1) {
1788	if (waitqueue_active(wq_head: &o_tty->read_wait)) {
1789	wake_up_poll(&o_tty->read_wait, EPOLLIN);
1790	do_sleep++;
1791	}
1792	if (waitqueue_active(wq_head: &o_tty->write_wait)) {
1793	wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1794	do_sleep++;
1795	}
1796	}
1797	if (!do_sleep)
1798	break;
1799
1800	if (once) {
1801	once = 0;
1802	tty_warn(tty, "read/write wait queue active!\n");
1803	}
1804	schedule_timeout_killable(timeout);
1805	if (timeout < 120 * HZ)
1806	timeout = 2 * timeout + 1;
1807	else
1808	timeout = MAX_SCHEDULE_TIMEOUT;
1809	}
1810
1811	if (o_tty) {
1812	if (--o_tty->count < 0) {
1813	tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1814	o_tty->count = 0;
1815	}
1816	}
1817	if (--tty->count < 0) {
1818	tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1819	tty->count = 0;
1820	}
1821
1822	/*
1823	* We've decremented tty->count, so we need to remove this file
1824	* descriptor off the tty->tty_files list; this serves two
1825	* purposes:
1826	* - check_tty_count sees the correct number of file descriptors
1827	* associated with this tty.
1828	* - do_tty_hangup no longer sees this file descriptor as
1829	* something that needs to be handled for hangups.
1830	*/
1831	tty_del_file(file: filp);
1832
1833	/*
1834	* Perform some housekeeping before deciding whether to return.
1835	*
1836	* If _either_ side is closing, make sure there aren't any
1837	* processes that still think tty or o_tty is their controlling
1838	* tty.
1839	*/
1840	if (!tty->count) {
1841	read_lock(&tasklist_lock);
1842	session_clear_tty(session: tty->ctrl.session);
1843	if (o_tty)
1844	session_clear_tty(session: o_tty->ctrl.session);
1845	read_unlock(&tasklist_lock);
1846	}
1847
1848	/* check whether both sides are closing ... */
1849	final = !tty->count && !(o_tty && o_tty->count);
1850
1851	tty_unlock_slave(tty: o_tty);
1852	tty_unlock(tty);
1853
1854	/* At this point, the tty->count == 0 should ensure a dead tty
1855	* cannot be re-opened by a racing opener.
1856	*/
1857
1858	if (!final)
1859	return 0;
1860
1861	tty_debug_hangup(tty, "final close\n");
1862
1863	tty_release_struct(tty, idx);
1864	return 0;
1865	}
1866
1867	/**
1868	* tty_open_current_tty - get locked tty of current task
1869	* @device: device number
1870	* @filp: file pointer to tty
1871	* @return: locked tty of the current task iff @device is /dev/tty
1872	*
1873	* Performs a re-open of the current task's controlling tty.
1874	*
1875	* We cannot return driver and index like for the other nodes because devpts
1876	* will not work then. It expects inodes to be from devpts FS.
1877	*/
1878	static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1879	{
1880	struct tty_struct *tty;
1881	int retval;
1882
1883	if (device != MKDEV(TTYAUX_MAJOR, 0))
1884	return NULL;
1885
1886	tty = get_current_tty();
1887	if (!tty)
1888	return ERR_PTR(error: -ENXIO);
1889
1890	filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1891	/* noctty = 1; */
1892	tty_lock(tty);
1893	tty_kref_put(tty); /* safe to drop the kref now */
1894
1895	retval = tty_reopen(tty);
1896	if (retval < 0) {
1897	tty_unlock(tty);
1898	tty = ERR_PTR(error: retval);
1899	}
1900	return tty;
1901	}
1902
1903	/**
1904	* tty_lookup_driver - lookup a tty driver for a given device file
1905	* @device: device number
1906	* @filp: file pointer to tty
1907	* @index: index for the device in the @return driver
1908	*
1909	* If returned value is not erroneous, the caller is responsible to decrement
1910	* the refcount by tty_driver_kref_put().
1911	*
1912	* Locking: %tty_mutex protects get_tty_driver()
1913	*
1914	* Return: driver for this inode (with increased refcount)
1915	*/
1916	static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1917	int *index)
1918	{
1919	struct tty_driver *driver = NULL;
1920
1921	switch (device) {
1922	#ifdef CONFIG_VT
1923	case MKDEV(TTY_MAJOR, 0): {
1924	extern struct tty_driver *console_driver;
1925
1926	driver = tty_driver_kref_get(d: console_driver);
1927	*index = fg_console;
1928	break;
1929	}
1930	#endif
1931	case MKDEV(TTYAUX_MAJOR, 1): {
1932	struct tty_driver *console_driver = console_device(index);
1933
1934	if (console_driver) {
1935	driver = tty_driver_kref_get(d: console_driver);
1936	if (driver && filp) {
1937	/* Don't let /dev/console block */
1938	filp->f_flags |= O_NONBLOCK;
1939	break;
1940	}
1941	}
1942	if (driver)
1943	tty_driver_kref_put(driver);
1944	return ERR_PTR(error: -ENODEV);
1945	}
1946	default:
1947	driver = get_tty_driver(device, index);
1948	if (!driver)
1949	return ERR_PTR(error: -ENODEV);
1950	break;
1951	}
1952	return driver;
1953	}
1954
1955	static struct tty_struct *tty_kopen(dev_t device, int shared)
1956	{
1957	struct tty_struct *tty;
1958	struct tty_driver *driver;
1959	int index = -1;
1960
1961	mutex_lock(&tty_mutex);
1962	driver = tty_lookup_driver(device, NULL, index: &index);
1963	if (IS_ERR(ptr: driver)) {
1964	mutex_unlock(lock: &tty_mutex);
1965	return ERR_CAST(ptr: driver);
1966	}
1967
1968	/* check whether we're reopening an existing tty */
1969	tty = tty_driver_lookup_tty(driver, NULL, idx: index);
1970	if (IS_ERR(ptr: tty) || shared)
1971	goto out;
1972
1973	if (tty) {
1974	/* drop kref from tty_driver_lookup_tty() */
1975	tty_kref_put(tty);
1976	tty = ERR_PTR(error: -EBUSY);
1977	} else { /* tty_init_dev returns tty with the tty_lock held */
1978	tty = tty_init_dev(driver, idx: index);
1979	if (IS_ERR(ptr: tty))
1980	goto out;
1981	tty_port_set_kopened(port: tty->port, val: 1);
1982	}
1983	out:
1984	mutex_unlock(lock: &tty_mutex);
1985	tty_driver_kref_put(driver);
1986	return tty;
1987	}
1988
1989	/**
1990	* tty_kopen_exclusive - open a tty device for kernel
1991	* @device: dev_t of device to open
1992	*
1993	* Opens tty exclusively for kernel. Performs the driver lookup, makes sure
1994	* it's not already opened and performs the first-time tty initialization.
1995	*
1996	* Claims the global %tty_mutex to serialize:
1997	* * concurrent first-time tty initialization
1998	* * concurrent tty driver removal w/ lookup
1999	* * concurrent tty removal from driver table
2000	*
2001	* Return: the locked initialized &tty_struct
2002	*/
2003	struct tty_struct *tty_kopen_exclusive(dev_t device)
2004	{
2005	return tty_kopen(device, shared: 0);
2006	}
2007	EXPORT_SYMBOL_GPL(tty_kopen_exclusive);
2008
2009	/**
2010	* tty_kopen_shared - open a tty device for shared in-kernel use
2011	* @device: dev_t of device to open
2012	*
2013	* Opens an already existing tty for in-kernel use. Compared to
2014	* tty_kopen_exclusive() above it doesn't ensure to be the only user.
2015	*
2016	* Locking: identical to tty_kopen() above.
2017	*/
2018	struct tty_struct *tty_kopen_shared(dev_t device)
2019	{
2020	return tty_kopen(device, shared: 1);
2021	}
2022	EXPORT_SYMBOL_GPL(tty_kopen_shared);
2023
2024	/**
2025	* tty_open_by_driver - open a tty device
2026	* @device: dev_t of device to open
2027	* @filp: file pointer to tty
2028	*
2029	* Performs the driver lookup, checks for a reopen, or otherwise performs the
2030	* first-time tty initialization.
2031	*
2032	*
2033	* Claims the global tty_mutex to serialize:
2034	* * concurrent first-time tty initialization
2035	* * concurrent tty driver removal w/ lookup
2036	* * concurrent tty removal from driver table
2037	*
2038	* Return: the locked initialized or re-opened &tty_struct
2039	*/
2040	static struct tty_struct *tty_open_by_driver(dev_t device,
2041	struct file *filp)
2042	{
2043	struct tty_struct *tty;
2044	struct tty_driver *driver = NULL;
2045	int index = -1;
2046	int retval;
2047
2048	mutex_lock(&tty_mutex);
2049	driver = tty_lookup_driver(device, filp, index: &index);
2050	if (IS_ERR(ptr: driver)) {
2051	mutex_unlock(lock: &tty_mutex);
2052	return ERR_CAST(ptr: driver);
2053	}
2054
2055	/* check whether we're reopening an existing tty */
2056	tty = tty_driver_lookup_tty(driver, file: filp, idx: index);
2057	if (IS_ERR(ptr: tty)) {
2058	mutex_unlock(lock: &tty_mutex);
2059	goto out;
2060	}
2061
2062	if (tty) {
2063	if (tty_port_kopened(port: tty->port)) {
2064	tty_kref_put(tty);
2065	mutex_unlock(lock: &tty_mutex);
2066	tty = ERR_PTR(error: -EBUSY);
2067	goto out;
2068	}
2069	mutex_unlock(lock: &tty_mutex);
2070	retval = tty_lock_interruptible(tty);
2071	tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
2072	if (retval) {
2073	if (retval == -EINTR)
2074	retval = -ERESTARTSYS;
2075	tty = ERR_PTR(error: retval);
2076	goto out;
2077	}
2078	retval = tty_reopen(tty);
2079	if (retval < 0) {
2080	tty_unlock(tty);
2081	tty = ERR_PTR(error: retval);
2082	}
2083	} else { /* Returns with the tty_lock held for now */
2084	tty = tty_init_dev(driver, idx: index);
2085	mutex_unlock(lock: &tty_mutex);
2086	}
2087	out:
2088	tty_driver_kref_put(driver);
2089	return tty;
2090	}
2091
2092	/**
2093	* tty_open - open a tty device
2094	* @inode: inode of device file
2095	* @filp: file pointer to tty
2096	*
2097	* tty_open() and tty_release() keep up the tty count that contains the number
2098	* of opens done on a tty. We cannot use the inode-count, as different inodes
2099	* might point to the same tty.
2100	*
2101	* Open-counting is needed for pty masters, as well as for keeping track of
2102	* serial lines: DTR is dropped when the last close happens.
2103	* (This is not done solely through tty->count, now. - Ted 1/27/92)
2104	*
2105	* The termios state of a pty is reset on the first open so that settings don't
2106	* persist across reuse.
2107	*
2108	* Locking:
2109	* * %tty_mutex protects tty, tty_lookup_driver() and tty_init_dev().
2110	* * @tty->count should protect the rest.
2111	* * ->siglock protects ->signal/->sighand
2112	*
2113	* Note: the tty_unlock/lock cases without a ref are only safe due to %tty_mutex
2114	*/
2115	static int tty_open(struct inode *inode, struct file *filp)
2116	{
2117	struct tty_struct *tty;
2118	int noctty, retval;
2119	dev_t device = inode->i_rdev;
2120	unsigned saved_flags = filp->f_flags;
2121
2122	nonseekable_open(inode, filp);
2123
2124	retry_open:
2125	retval = tty_alloc_file(file: filp);
2126	if (retval)
2127	return -ENOMEM;
2128
2129	tty = tty_open_current_tty(device, filp);
2130	if (!tty)
2131	tty = tty_open_by_driver(device, filp);
2132
2133	if (IS_ERR(ptr: tty)) {
2134	tty_free_file(file: filp);
2135	retval = PTR_ERR(ptr: tty);
2136	if (retval != -EAGAIN || signal_pending(current))
2137	return retval;
2138	schedule();
2139	goto retry_open;
2140	}
2141
2142	tty_add_file(tty, file: filp);
2143
2144	check_tty_count(tty, routine: __func__);
2145	tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2146
2147	if (tty->ops->open)
2148	retval = tty->ops->open(tty, filp);
2149	else
2150	retval = -ENODEV;
2151	filp->f_flags = saved_flags;
2152
2153	if (retval) {
2154	tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2155
2156	tty_unlock(tty); /* need to call tty_release without BTM */
2157	tty_release(inode, filp);
2158	if (retval != -ERESTARTSYS)
2159	return retval;
2160
2161	if (signal_pending(current))
2162	return retval;
2163
2164	schedule();
2165	/*
2166	* Need to reset f_op in case a hangup happened.
2167	*/
2168	if (tty_hung_up_p(filp))
2169	filp->f_op = &tty_fops;
2170	goto retry_open;
2171	}
2172	clear_bit(TTY_HUPPED, addr: &tty->flags);
2173
2174	noctty = (filp->f_flags & O_NOCTTY) ||
2175	(IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2176	device == MKDEV(TTYAUX_MAJOR, 1) ||
2177	(tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2178	tty->driver->subtype == PTY_TYPE_MASTER);
2179	if (!noctty)
2180	tty_open_proc_set_tty(filp, tty);
2181	tty_unlock(tty);
2182	return 0;
2183	}
2184
2185
2186	/**
2187	* tty_poll - check tty status
2188	* @filp: file being polled
2189	* @wait: poll wait structures to update
2190	*
2191	* Call the line discipline polling method to obtain the poll status of the
2192	* device.
2193	*
2194	* Locking: locks called line discipline but ldisc poll method may be
2195	* re-entered freely by other callers.
2196	*/
2197	static __poll_t tty_poll(struct file *filp, poll_table *wait)
2198	{
2199	struct tty_struct *tty = file_tty(file: filp);
2200	struct tty_ldisc *ld;
2201	__poll_t ret = 0;
2202
2203	if (tty_paranoia_check(tty, inode: file_inode(f: filp), routine: "tty_poll"))
2204	return 0;
2205
2206	ld = tty_ldisc_ref_wait(tty);
2207	if (!ld)
2208	return hung_up_tty_poll(filp, wait);
2209	if (ld->ops->poll)
2210	ret = ld->ops->poll(tty, filp, wait);
2211	tty_ldisc_deref(ld);
2212	return ret;
2213	}
2214
2215	static int __tty_fasync(int fd, struct file *filp, int on)
2216	{
2217	struct tty_struct *tty = file_tty(file: filp);
2218	unsigned long flags;
2219	int retval = 0;
2220
2221	if (tty_paranoia_check(tty, inode: file_inode(f: filp), routine: "tty_fasync"))
2222	goto out;
2223
2224	retval = fasync_helper(fd, filp, on, &tty->fasync);
2225	if (retval <= 0)
2226	goto out;
2227
2228	if (on) {
2229	enum pid_type type;
2230	struct pid *pid;
2231
2232	spin_lock_irqsave(&tty->ctrl.lock, flags);
2233	if (tty->ctrl.pgrp) {
2234	pid = tty->ctrl.pgrp;
2235	type = PIDTYPE_PGID;
2236	} else {
2237	pid = task_pid(current);
2238	type = PIDTYPE_TGID;
2239	}
2240	get_pid(pid);
2241	spin_unlock_irqrestore(lock: &tty->ctrl.lock, flags);
2242	__f_setown(filp, pid, type, force: 0);
2243	put_pid(pid);
2244	retval = 0;
2245	}
2246	out:
2247	return retval;
2248	}
2249
2250	static int tty_fasync(int fd, struct file *filp, int on)
2251	{
2252	struct tty_struct *tty = file_tty(file: filp);
2253	int retval = -ENOTTY;
2254
2255	tty_lock(tty);
2256	if (!tty_hung_up_p(filp))
2257	retval = __tty_fasync(fd, filp, on);
2258	tty_unlock(tty);
2259
2260	return retval;
2261	}
2262
2263	static bool tty_legacy_tiocsti __read_mostly = IS_ENABLED(CONFIG_LEGACY_TIOCSTI);
2264	/**
2265	* tiocsti - fake input character
2266	* @tty: tty to fake input into
2267	* @p: pointer to character
2268	*
2269	* Fake input to a tty device. Does the necessary locking and input management.
2270	*
2271	* FIXME: does not honour flow control ??
2272	*
2273	* Locking:
2274	* * Called functions take tty_ldiscs_lock
2275	* * current->signal->tty check is safe without locks
2276	*/
2277	static int tiocsti(struct tty_struct *tty, char __user *p)
2278	{
2279	char ch, mbz = 0;
2280	struct tty_ldisc *ld;
2281
2282	if (!tty_legacy_tiocsti && !capable(CAP_SYS_ADMIN))
2283	return -EIO;
2284
2285	if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2286	return -EPERM;
2287	if (get_user(ch, p))
2288	return -EFAULT;
2289	tty_audit_tiocsti(tty, ch);
2290	ld = tty_ldisc_ref_wait(tty);
2291	if (!ld)
2292	return -EIO;
2293	tty_buffer_lock_exclusive(port: tty->port);
2294	if (ld->ops->receive_buf)
2295	ld->ops->receive_buf(tty, &ch, &mbz, 1);
2296	tty_buffer_unlock_exclusive(port: tty->port);
2297	tty_ldisc_deref(ld);
2298	return 0;
2299	}
2300
2301	/**
2302	* tiocgwinsz - implement window query ioctl
2303	* @tty: tty
2304	* @arg: user buffer for result
2305	*
2306	* Copies the kernel idea of the window size into the user buffer.
2307	*
2308	* Locking: @tty->winsize_mutex is taken to ensure the winsize data is
2309	* consistent.
2310	*/
2311	static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2312	{
2313	int err;
2314
2315	mutex_lock(&tty->winsize_mutex);
2316	err = copy_to_user(to: arg, from: &tty->winsize, n: sizeof(*arg));
2317	mutex_unlock(lock: &tty->winsize_mutex);
2318
2319	return err ? -EFAULT : 0;
2320	}
2321
2322	/**
2323	* tty_do_resize - resize event
2324	* @tty: tty being resized
2325	* @ws: new dimensions
2326	*
2327	* Update the termios variables and send the necessary signals to peform a
2328	* terminal resize correctly.
2329	*/
2330	int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2331	{
2332	struct pid *pgrp;
2333
2334	/* Lock the tty */
2335	mutex_lock(&tty->winsize_mutex);
2336	if (!memcmp(p: ws, q: &tty->winsize, size: sizeof(*ws)))
2337	goto done;
2338
2339	/* Signal the foreground process group */
2340	pgrp = tty_get_pgrp(tty);
2341	if (pgrp)
2342	kill_pgrp(pid: pgrp, SIGWINCH, priv: 1);
2343	put_pid(pid: pgrp);
2344
2345	tty->winsize = *ws;
2346	done:
2347	mutex_unlock(lock: &tty->winsize_mutex);
2348	return 0;
2349	}
2350	EXPORT_SYMBOL(tty_do_resize);
2351
2352	/**
2353	* tiocswinsz - implement window size set ioctl
2354	* @tty: tty side of tty
2355	* @arg: user buffer for result
2356	*
2357	* Copies the user idea of the window size to the kernel. Traditionally this is
2358	* just advisory information but for the Linux console it actually has driver
2359	* level meaning and triggers a VC resize.
2360	*
2361	* Locking:
2362	* Driver dependent. The default do_resize method takes the tty termios
2363	* mutex and ctrl.lock. The console takes its own lock then calls into the
2364	* default method.
2365	*/
2366	static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2367	{
2368	struct winsize tmp_ws;
2369
2370	if (copy_from_user(to: &tmp_ws, from: arg, n: sizeof(*arg)))
2371	return -EFAULT;
2372
2373	if (tty->ops->resize)
2374	return tty->ops->resize(tty, &tmp_ws);
2375	else
2376	return tty_do_resize(tty, &tmp_ws);
2377	}
2378
2379	/**
2380	* tioccons - allow admin to move logical console
2381	* @file: the file to become console
2382	*
2383	* Allow the administrator to move the redirected console device.
2384	*
2385	* Locking: uses redirect_lock to guard the redirect information
2386	*/
2387	static int tioccons(struct file *file)
2388	{
2389	if (!capable(CAP_SYS_ADMIN))
2390	return -EPERM;
2391	if (file->f_op->write_iter == redirected_tty_write) {
2392	struct file *f;
2393
2394	spin_lock(lock: &redirect_lock);
2395	f = redirect;
2396	redirect = NULL;
2397	spin_unlock(lock: &redirect_lock);
2398	if (f)
2399	fput(f);
2400	return 0;
2401	}
2402	if (file->f_op->write_iter != tty_write)
2403	return -ENOTTY;
2404	if (!(file->f_mode & FMODE_WRITE))
2405	return -EBADF;
2406	if (!(file->f_mode & FMODE_CAN_WRITE))
2407	return -EINVAL;
2408	spin_lock(lock: &redirect_lock);
2409	if (redirect) {
2410	spin_unlock(lock: &redirect_lock);
2411	return -EBUSY;
2412	}
2413	redirect = get_file(f: file);
2414	spin_unlock(lock: &redirect_lock);
2415	return 0;
2416	}
2417
2418	/**
2419	* tiocsetd - set line discipline
2420	* @tty: tty device
2421	* @p: pointer to user data
2422	*
2423	* Set the line discipline according to user request.
2424	*
2425	* Locking: see tty_set_ldisc(), this function is just a helper
2426	*/
2427	static int tiocsetd(struct tty_struct *tty, int __user *p)
2428	{
2429	int disc;
2430	int ret;
2431
2432	if (get_user(disc, p))
2433	return -EFAULT;
2434
2435	ret = tty_set_ldisc(tty, disc);
2436
2437	return ret;
2438	}
2439
2440	/**
2441	* tiocgetd - get line discipline
2442	* @tty: tty device
2443	* @p: pointer to user data
2444	*
2445	* Retrieves the line discipline id directly from the ldisc.
2446	*
2447	* Locking: waits for ldisc reference (in case the line discipline is changing
2448	* or the @tty is being hungup)
2449	*/
2450	static int tiocgetd(struct tty_struct *tty, int __user *p)
2451	{
2452	struct tty_ldisc *ld;
2453	int ret;
2454
2455	ld = tty_ldisc_ref_wait(tty);
2456	if (!ld)
2457	return -EIO;
2458	ret = put_user(ld->ops->num, p);
2459	tty_ldisc_deref(ld);
2460	return ret;
2461	}
2462
2463	/**
2464	* send_break - performed time break
2465	* @tty: device to break on
2466	* @duration: timeout in mS
2467	*
2468	* Perform a timed break on hardware that lacks its own driver level timed
2469	* break functionality.
2470	*
2471	* Locking:
2472	* @tty->atomic_write_lock serializes
2473	*/
2474	static int send_break(struct tty_struct *tty, unsigned int duration)
2475	{
2476	int retval;
2477
2478	if (tty->ops->break_ctl == NULL)
2479	return 0;
2480
2481	if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2482	return tty->ops->break_ctl(tty, duration);
2483
2484	/* Do the work ourselves */
2485	if (tty_write_lock(tty, ndelay: false) < 0)
2486	return -EINTR;
2487
2488	retval = tty->ops->break_ctl(tty, -1);
2489	if (!retval) {
2490	msleep_interruptible(msecs: duration);
2491	retval = tty->ops->break_ctl(tty, 0);
2492	}
2493	tty_write_unlock(tty);
2494
2495	if (signal_pending(current))
2496	retval = -EINTR;
2497
2498	return retval;
2499	}
2500
2501	/**
2502	* tty_tiocmget - get modem status
2503	* @tty: tty device
2504	* @p: pointer to result
2505	*
2506	* Obtain the modem status bits from the tty driver if the feature is
2507	* supported. Return -%ENOTTY if it is not available.
2508	*
2509	* Locking: none (up to the driver)
2510	*/
2511	static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2512	{
2513	int retval = -ENOTTY;
2514
2515	if (tty->ops->tiocmget) {
2516	retval = tty->ops->tiocmget(tty);
2517
2518	if (retval >= 0)
2519	retval = put_user(retval, p);
2520	}
2521	return retval;
2522	}
2523
2524	/**
2525	* tty_tiocmset - set modem status
2526	* @tty: tty device
2527	* @cmd: command - clear bits, set bits or set all
2528	* @p: pointer to desired bits
2529	*
2530	* Set the modem status bits from the tty driver if the feature
2531	* is supported. Return -%ENOTTY if it is not available.
2532	*
2533	* Locking: none (up to the driver)
2534	*/
2535	static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2536	unsigned __user *p)
2537	{
2538	int retval;
2539	unsigned int set, clear, val;
2540
2541	if (tty->ops->tiocmset == NULL)
2542	return -ENOTTY;
2543
2544	retval = get_user(val, p);
2545	if (retval)
2546	return retval;
2547	set = clear = 0;
2548	switch (cmd) {
2549	case TIOCMBIS:
2550	set = val;
2551	break;
2552	case TIOCMBIC:
2553	clear = val;
2554	break;
2555	case TIOCMSET:
2556	set = val;
2557	clear = ~val;
2558	break;
2559	}
2560	set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2561	clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2562	return tty->ops->tiocmset(tty, set, clear);
2563	}
2564
2565	/**
2566	* tty_get_icount - get tty statistics
2567	* @tty: tty device
2568	* @icount: output parameter
2569	*
2570	* Gets a copy of the @tty's icount statistics.
2571	*
2572	* Locking: none (up to the driver)
2573	*/
2574	int tty_get_icount(struct tty_struct *tty,
2575	struct serial_icounter_struct *icount)
2576	{
2577	memset(icount, 0, sizeof(*icount));
2578
2579	if (tty->ops->get_icount)
2580	return tty->ops->get_icount(tty, icount);
2581	else
2582	return -ENOTTY;
2583	}
2584	EXPORT_SYMBOL_GPL(tty_get_icount);
2585
2586	static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2587	{
2588	struct serial_icounter_struct icount;
2589	int retval;
2590
2591	retval = tty_get_icount(tty, &icount);
2592	if (retval != 0)
2593	return retval;
2594
2595	if (copy_to_user(to: arg, from: &icount, n: sizeof(icount)))
2596	return -EFAULT;
2597	return 0;
2598	}
2599
2600	static int tty_set_serial(struct tty_struct *tty, struct serial_struct *ss)
2601	{
2602	char comm[TASK_COMM_LEN];
2603	int flags;
2604
2605	flags = ss->flags & ASYNC_DEPRECATED;
2606
2607	if (flags)
2608	pr_warn_ratelimited("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2609	__func__, get_task_comm(comm, current), flags);
2610
2611	if (!tty->ops->set_serial)
2612	return -ENOTTY;
2613
2614	return tty->ops->set_serial(tty, ss);
2615	}
2616
2617	static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
2618	{
2619	struct serial_struct v;
2620
2621	if (copy_from_user(to: &v, from: ss, n: sizeof(*ss)))
2622	return -EFAULT;
2623
2624	return tty_set_serial(tty, ss: &v);
2625	}
2626
2627	static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2628	{
2629	struct serial_struct v;
2630	int err;
2631
2632	memset(&v, 0, sizeof(v));
2633	if (!tty->ops->get_serial)
2634	return -ENOTTY;
2635	err = tty->ops->get_serial(tty, &v);
2636	if (!err && copy_to_user(to: ss, from: &v, n: sizeof(v)))
2637	err = -EFAULT;
2638	return err;
2639	}
2640
2641	/*
2642	* if pty, return the slave side (real_tty)
2643	* otherwise, return self
2644	*/
2645	static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2646	{
2647	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2648	tty->driver->subtype == PTY_TYPE_MASTER)
2649	tty = tty->link;
2650	return tty;
2651	}
2652
2653	/*
2654	* Split this up, as gcc can choke on it otherwise..
2655	*/
2656	long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2657	{
2658	struct tty_struct *tty = file_tty(file);
2659	struct tty_struct *real_tty;
2660	void __user *p = (void __user *)arg;
2661	int retval;
2662	struct tty_ldisc *ld;
2663
2664	if (tty_paranoia_check(tty, inode: file_inode(f: file), routine: "tty_ioctl"))
2665	return -EINVAL;
2666
2667	real_tty = tty_pair_get_tty(tty);
2668
2669	/*
2670	* Factor out some common prep work
2671	*/
2672	switch (cmd) {
2673	case TIOCSETD:
2674	case TIOCSBRK:
2675	case TIOCCBRK:
2676	case TCSBRK:
2677	case TCSBRKP:
2678	retval = tty_check_change(tty);
2679	if (retval)
2680	return retval;
2681	if (cmd != TIOCCBRK) {
2682	tty_wait_until_sent(tty, timeout: 0);
2683	if (signal_pending(current))
2684	return -EINTR;
2685	}
2686	break;
2687	}
2688
2689	/*
2690	* Now do the stuff.
2691	*/
2692	switch (cmd) {
2693	case TIOCSTI:
2694	return tiocsti(tty, p);
2695	case TIOCGWINSZ:
2696	return tiocgwinsz(tty: real_tty, arg: p);
2697	case TIOCSWINSZ:
2698	return tiocswinsz(tty: real_tty, arg: p);
2699	case TIOCCONS:
2700	return real_tty != tty ? -EINVAL : tioccons(file);
2701	case TIOCEXCL:
2702	set_bit(TTY_EXCLUSIVE, addr: &tty->flags);
2703	return 0;
2704	case TIOCNXCL:
2705	clear_bit(TTY_EXCLUSIVE, addr: &tty->flags);
2706	return 0;
2707	case TIOCGEXCL:
2708	{
2709	int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2710
2711	return put_user(excl, (int __user *)p);
2712	}
2713	case TIOCGETD:
2714	return tiocgetd(tty, p);
2715	case TIOCSETD:
2716	return tiocsetd(tty, p);
2717	case TIOCVHANGUP:
2718	if (!capable(CAP_SYS_ADMIN))
2719	return -EPERM;
2720	tty_vhangup(tty);
2721	return 0;
2722	case TIOCGDEV:
2723	{
2724	unsigned int ret = new_encode_dev(dev: tty_devnum(tty: real_tty));
2725
2726	return put_user(ret, (unsigned int __user *)p);
2727	}
2728	/*
2729	* Break handling
2730	*/
2731	case TIOCSBRK: /* Turn break on, unconditionally */
2732	if (tty->ops->break_ctl)
2733	return tty->ops->break_ctl(tty, -1);
2734	return 0;
2735	case TIOCCBRK: /* Turn break off, unconditionally */
2736	if (tty->ops->break_ctl)
2737	return tty->ops->break_ctl(tty, 0);
2738	return 0;
2739	case TCSBRK: /* SVID version: non-zero arg --> no break */
2740	/* non-zero arg means wait for all output data
2741	* to be sent (performed above) but don't send break.
2742	* This is used by the tcdrain() termios function.
2743	*/
2744	if (!arg)
2745	return send_break(tty, duration: 250);
2746	return 0;
2747	case TCSBRKP: /* support for POSIX tcsendbreak() */
2748	return send_break(tty, duration: arg ? arg*100 : 250);
2749
2750	case TIOCMGET:
2751	return tty_tiocmget(tty, p);
2752	case TIOCMSET:
2753	case TIOCMBIC:
2754	case TIOCMBIS:
2755	return tty_tiocmset(tty, cmd, p);
2756	case TIOCGICOUNT:
2757	return tty_tiocgicount(tty, arg: p);
2758	case TCFLSH:
2759	switch (arg) {
2760	case TCIFLUSH:
2761	case TCIOFLUSH:
2762	/* flush tty buffer and allow ldisc to process ioctl */
2763	tty_buffer_flush(tty, NULL);
2764	break;
2765	}
2766	break;
2767	case TIOCSSERIAL:
2768	return tty_tiocsserial(tty, ss: p);
2769	case TIOCGSERIAL:
2770	return tty_tiocgserial(tty, ss: p);
2771	case TIOCGPTPEER:
2772	/* Special because the struct file is needed */
2773	return ptm_open_peer(master: file, tty, flags: (int)arg);
2774	default:
2775	retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2776	if (retval != -ENOIOCTLCMD)
2777	return retval;
2778	}
2779	if (tty->ops->ioctl) {
2780	retval = tty->ops->ioctl(tty, cmd, arg);
2781	if (retval != -ENOIOCTLCMD)
2782	return retval;
2783	}
2784	ld = tty_ldisc_ref_wait(tty);
2785	if (!ld)
2786	return hung_up_tty_ioctl(file, cmd, arg);
2787	retval = -EINVAL;
2788	if (ld->ops->ioctl) {
2789	retval = ld->ops->ioctl(tty, cmd, arg);
2790	if (retval == -ENOIOCTLCMD)
2791	retval = -ENOTTY;
2792	}
2793	tty_ldisc_deref(ld);
2794	return retval;
2795	}
2796
2797	#ifdef CONFIG_COMPAT
2798
2799	struct serial_struct32 {
2800	compat_int_t type;
2801	compat_int_t line;
2802	compat_uint_t port;
2803	compat_int_t irq;
2804	compat_int_t flags;
2805	compat_int_t xmit_fifo_size;
2806	compat_int_t custom_divisor;
2807	compat_int_t baud_base;
2808	unsigned short close_delay;
2809	char io_type;
2810	char reserved_char;
2811	compat_int_t hub6;
2812	unsigned short closing_wait; /* time to wait before closing */
2813	unsigned short closing_wait2; /* no longer used... */
2814	compat_uint_t iomem_base;
2815	unsigned short iomem_reg_shift;
2816	unsigned int port_high;
2817	/* compat_ulong_t iomap_base FIXME */
2818	compat_int_t reserved;
2819	};
2820
2821	static int compat_tty_tiocsserial(struct tty_struct *tty,
2822	struct serial_struct32 __user *ss)
2823	{
2824	struct serial_struct32 v32;
2825	struct serial_struct v;
2826
2827	if (copy_from_user(to: &v32, from: ss, n: sizeof(*ss)))
2828	return -EFAULT;
2829
2830	memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2831	v.iomem_base = compat_ptr(uptr: v32.iomem_base);
2832	v.iomem_reg_shift = v32.iomem_reg_shift;
2833	v.port_high = v32.port_high;
2834	v.iomap_base = 0;
2835
2836	return tty_set_serial(tty, ss: &v);
2837	}
2838
2839	static int compat_tty_tiocgserial(struct tty_struct *tty,
2840	struct serial_struct32 __user *ss)
2841	{
2842	struct serial_struct32 v32;
2843	struct serial_struct v;
2844	int err;
2845
2846	memset(&v, 0, sizeof(v));
2847	memset(&v32, 0, sizeof(v32));
2848
2849	if (!tty->ops->get_serial)
2850	return -ENOTTY;
2851	err = tty->ops->get_serial(tty, &v);
2852	if (!err) {
2853	memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2854	v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2855	0xfffffff : ptr_to_compat(uptr: v.iomem_base);
2856	v32.iomem_reg_shift = v.iomem_reg_shift;
2857	v32.port_high = v.port_high;
2858	if (copy_to_user(to: ss, from: &v32, n: sizeof(v32)))
2859	err = -EFAULT;
2860	}
2861	return err;
2862	}
2863	static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2864	unsigned long arg)
2865	{
2866	struct tty_struct *tty = file_tty(file);
2867	struct tty_ldisc *ld;
2868	int retval = -ENOIOCTLCMD;
2869
2870	switch (cmd) {
2871	case TIOCOUTQ:
2872	case TIOCSTI:
2873	case TIOCGWINSZ:
2874	case TIOCSWINSZ:
2875	case TIOCGEXCL:
2876	case TIOCGETD:
2877	case TIOCSETD:
2878	case TIOCGDEV:
2879	case TIOCMGET:
2880	case TIOCMSET:
2881	case TIOCMBIC:
2882	case TIOCMBIS:
2883	case TIOCGICOUNT:
2884	case TIOCGPGRP:
2885	case TIOCSPGRP:
2886	case TIOCGSID:
2887	case TIOCSERGETLSR:
2888	case TIOCGRS485:
2889	case TIOCSRS485:
2890	#ifdef TIOCGETP
2891	case TIOCGETP:
2892	case TIOCSETP:
2893	case TIOCSETN:
2894	#endif
2895	#ifdef TIOCGETC
2896	case TIOCGETC:
2897	case TIOCSETC:
2898	#endif
2899	#ifdef TIOCGLTC
2900	case TIOCGLTC:
2901	case TIOCSLTC:
2902	#endif
2903	case TCSETSF:
2904	case TCSETSW:
2905	case TCSETS:
2906	case TCGETS:
2907	#ifdef TCGETS2
2908	case TCGETS2:
2909	case TCSETSF2:
2910	case TCSETSW2:
2911	case TCSETS2:
2912	#endif
2913	case TCGETA:
2914	case TCSETAF:
2915	case TCSETAW:
2916	case TCSETA:
2917	case TIOCGLCKTRMIOS:
2918	case TIOCSLCKTRMIOS:
2919	#ifdef TCGETX
2920	case TCGETX:
2921	case TCSETX:
2922	case TCSETXW:
2923	case TCSETXF:
2924	#endif
2925	case TIOCGSOFTCAR:
2926	case TIOCSSOFTCAR:
2927
2928	case PPPIOCGCHAN:
2929	case PPPIOCGUNIT:
2930	return tty_ioctl(file, cmd, arg: (unsigned long)compat_ptr(uptr: arg));
2931	case TIOCCONS:
2932	case TIOCEXCL:
2933	case TIOCNXCL:
2934	case TIOCVHANGUP:
2935	case TIOCSBRK:
2936	case TIOCCBRK:
2937	case TCSBRK:
2938	case TCSBRKP:
2939	case TCFLSH:
2940	case TIOCGPTPEER:
2941	case TIOCNOTTY:
2942	case TIOCSCTTY:
2943	case TCXONC:
2944	case TIOCMIWAIT:
2945	case TIOCSERCONFIG:
2946	return tty_ioctl(file, cmd, arg);
2947	}
2948
2949	if (tty_paranoia_check(tty, inode: file_inode(f: file), routine: "tty_ioctl"))
2950	return -EINVAL;
2951
2952	switch (cmd) {
2953	case TIOCSSERIAL:
2954	return compat_tty_tiocsserial(tty, ss: compat_ptr(uptr: arg));
2955	case TIOCGSERIAL:
2956	return compat_tty_tiocgserial(tty, ss: compat_ptr(uptr: arg));
2957	}
2958	if (tty->ops->compat_ioctl) {
2959	retval = tty->ops->compat_ioctl(tty, cmd, arg);
2960	if (retval != -ENOIOCTLCMD)
2961	return retval;
2962	}
2963
2964	ld = tty_ldisc_ref_wait(tty);
2965	if (!ld)
2966	return hung_up_tty_compat_ioctl(file, cmd, arg);
2967	if (ld->ops->compat_ioctl)
2968	retval = ld->ops->compat_ioctl(tty, cmd, arg);
2969	if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2970	retval = ld->ops->ioctl(tty, (unsigned long)compat_ptr(uptr: cmd),
2971	arg);
2972	tty_ldisc_deref(ld);
2973
2974	return retval;
2975	}
2976	#endif
2977
2978	static int this_tty(const void *t, struct file *file, unsigned fd)
2979	{
2980	if (likely(file->f_op->read_iter != tty_read))
2981	return 0;
2982	return file_tty(file) != t ? 0 : fd + 1;
2983	}
2984
2985	/*
2986	* This implements the "Secure Attention Key" --- the idea is to
2987	* prevent trojan horses by killing all processes associated with this
2988	* tty when the user hits the "Secure Attention Key". Required for
2989	* super-paranoid applications --- see the Orange Book for more details.
2990	*
2991	* This code could be nicer; ideally it should send a HUP, wait a few
2992	* seconds, then send a INT, and then a KILL signal. But you then
2993	* have to coordinate with the init process, since all processes associated
2994	* with the current tty must be dead before the new getty is allowed
2995	* to spawn.
2996	*
2997	* Now, if it would be correct ;-/ The current code has a nasty hole -
2998	* it doesn't catch files in flight. We may send the descriptor to ourselves
2999	* via AF_UNIX socket, close it and later fetch from socket. FIXME.
3000	*
3001	* Nasty bug: do_SAK is being called in interrupt context. This can
3002	* deadlock. We punt it up to process context. AKPM - 16Mar2001
3003	*/
3004	void __do_SAK(struct tty_struct *tty)
3005	{
3006	struct task_struct *g, *p;
3007	struct pid *session;
3008	int i;
3009	unsigned long flags;
3010
3011	spin_lock_irqsave(&tty->ctrl.lock, flags);
3012	session = get_pid(pid: tty->ctrl.session);
3013	spin_unlock_irqrestore(lock: &tty->ctrl.lock, flags);
3014
3015	tty_ldisc_flush(tty);
3016
3017	tty_driver_flush_buffer(tty);
3018
3019	read_lock(&tasklist_lock);
3020	/* Kill the entire session */
3021	do_each_pid_task(session, PIDTYPE_SID, p) {
3022	tty_notice(tty, "SAK: killed process %d (%s): by session\n",
3023	task_pid_nr(p), p->comm);
3024	group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, type: PIDTYPE_SID);
3025	} while_each_pid_task(session, PIDTYPE_SID, p);
3026
3027	/* Now kill any processes that happen to have the tty open */
3028	for_each_process_thread(g, p) {
3029	if (p->signal->tty == tty) {
3030	tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
3031	task_pid_nr(p), p->comm);
3032	group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p,
3033	type: PIDTYPE_SID);
3034	continue;
3035	}
3036	task_lock(p);
3037	i = iterate_fd(p->files, 0, this_tty, tty);
3038	if (i != 0) {
3039	tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
3040	task_pid_nr(p), p->comm, i - 1);
3041	group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p,
3042	type: PIDTYPE_SID);
3043	}
3044	task_unlock(p);
3045	}
3046	read_unlock(&tasklist_lock);
3047	put_pid(pid: session);
3048	}
3049
3050	static void do_SAK_work(struct work_struct *work)
3051	{
3052	struct tty_struct *tty =
3053	container_of(work, struct tty_struct, SAK_work);
3054	__do_SAK(tty);
3055	}
3056
3057	/*
3058	* The tq handling here is a little racy - tty->SAK_work may already be queued.
3059	* Fortunately we don't need to worry, because if ->SAK_work is already queued,
3060	* the values which we write to it will be identical to the values which it
3061	* already has. --akpm
3062	*/
3063	void do_SAK(struct tty_struct *tty)
3064	{
3065	if (!tty)
3066	return;
3067	schedule_work(work: &tty->SAK_work);
3068	}
3069	EXPORT_SYMBOL(do_SAK);
3070
3071	/* Must put_device() after it's unused! */
3072	static struct device *tty_get_device(struct tty_struct *tty)
3073	{
3074	dev_t devt = tty_devnum(tty);
3075
3076	return class_find_device_by_devt(class: &tty_class, devt);
3077	}
3078
3079
3080	/**
3081	* alloc_tty_struct - allocate a new tty
3082	* @driver: driver which will handle the returned tty
3083	* @idx: minor of the tty
3084	*
3085	* This subroutine allocates and initializes a tty structure.
3086	*
3087	* Locking: none - @tty in question is not exposed at this point
3088	*/
3089	struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
3090	{
3091	struct tty_struct *tty;
3092
3093	tty = kzalloc(size: sizeof(*tty), GFP_KERNEL_ACCOUNT);
3094	if (!tty)
3095	return NULL;
3096
3097	kref_init(kref: &tty->kref);
3098	if (tty_ldisc_init(tty)) {
3099	kfree(objp: tty);
3100	return NULL;
3101	}
3102	tty->ctrl.session = NULL;
3103	tty->ctrl.pgrp = NULL;
3104	mutex_init(&tty->legacy_mutex);
3105	mutex_init(&tty->throttle_mutex);
3106	init_rwsem(&tty->termios_rwsem);
3107	mutex_init(&tty->winsize_mutex);
3108	init_ldsem(&tty->ldisc_sem);
3109	init_waitqueue_head(&tty->write_wait);
3110	init_waitqueue_head(&tty->read_wait);
3111	INIT_WORK(&tty->hangup_work, do_tty_hangup);
3112	mutex_init(&tty->atomic_write_lock);
3113	spin_lock_init(&tty->ctrl.lock);
3114	spin_lock_init(&tty->flow.lock);
3115	spin_lock_init(&tty->files_lock);
3116	INIT_LIST_HEAD(list: &tty->tty_files);
3117	INIT_WORK(&tty->SAK_work, do_SAK_work);
3118
3119	tty->driver = driver;
3120	tty->ops = driver->ops;
3121	tty->index = idx;
3122	tty_line_name(driver, index: idx, p: tty->name);
3123	tty->dev = tty_get_device(tty);
3124
3125	return tty;
3126	}
3127
3128	/**
3129	* tty_put_char - write one character to a tty
3130	* @tty: tty
3131	* @ch: character to write
3132	*
3133	* Write one byte to the @tty using the provided @tty->ops->put_char() method
3134	* if present.
3135	*
3136	* Note: the specific put_char operation in the driver layer may go
3137	* away soon. Don't call it directly, use this method
3138	*
3139	* Return: the number of characters successfully output.
3140	*/
3141	int tty_put_char(struct tty_struct *tty, unsigned char ch)
3142	{
3143	if (tty->ops->put_char)
3144	return tty->ops->put_char(tty, ch);
3145	return tty->ops->write(tty, &ch, 1);
3146	}
3147	EXPORT_SYMBOL_GPL(tty_put_char);
3148
3149	static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3150	unsigned int index, unsigned int count)
3151	{
3152	int err;
3153
3154	/* init here, since reused cdevs cause crashes */
3155	driver->cdevs[index] = cdev_alloc();
3156	if (!driver->cdevs[index])
3157	return -ENOMEM;
3158	driver->cdevs[index]->ops = &tty_fops;
3159	driver->cdevs[index]->owner = driver->owner;
3160	err = cdev_add(driver->cdevs[index], dev, count);
3161	if (err)
3162	kobject_put(kobj: &driver->cdevs[index]->kobj);
3163	return err;
3164	}
3165
3166	/**
3167	* tty_register_device - register a tty device
3168	* @driver: the tty driver that describes the tty device
3169	* @index: the index in the tty driver for this tty device
3170	* @device: a struct device that is associated with this tty device.
3171	* This field is optional, if there is no known struct device
3172	* for this tty device it can be set to NULL safely.
3173	*
3174	* This call is required to be made to register an individual tty device
3175	* if the tty driver's flags have the %TTY_DRIVER_DYNAMIC_DEV bit set. If
3176	* that bit is not set, this function should not be called by a tty
3177	* driver.
3178	*
3179	* Locking: ??
3180	*
3181	* Return: A pointer to the struct device for this tty device (or
3182	* ERR_PTR(-EFOO) on error).
3183	*/
3184	struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3185	struct device *device)
3186	{
3187	return tty_register_device_attr(driver, index, device, NULL, NULL);
3188	}
3189	EXPORT_SYMBOL(tty_register_device);
3190
3191	static void tty_device_create_release(struct device *dev)
3192	{
3193	dev_dbg(dev, "releasing...\n");
3194	kfree(objp: dev);
3195	}
3196
3197	/**
3198	* tty_register_device_attr - register a tty device
3199	* @driver: the tty driver that describes the tty device
3200	* @index: the index in the tty driver for this tty device
3201	* @device: a struct device that is associated with this tty device.
3202	* This field is optional, if there is no known struct device
3203	* for this tty device it can be set to %NULL safely.
3204	* @drvdata: Driver data to be set to device.
3205	* @attr_grp: Attribute group to be set on device.
3206	*
3207	* This call is required to be made to register an individual tty device if the
3208	* tty driver's flags have the %TTY_DRIVER_DYNAMIC_DEV bit set. If that bit is
3209	* not set, this function should not be called by a tty driver.
3210	*
3211	* Locking: ??
3212	*
3213	* Return: A pointer to the struct device for this tty device (or
3214	* ERR_PTR(-EFOO) on error).
3215	*/
3216	struct device *tty_register_device_attr(struct tty_driver *driver,
3217	unsigned index, struct device *device,
3218	void *drvdata,
3219	const struct attribute_group **attr_grp)
3220	{
3221	char name[64];
3222	dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3223	struct ktermios *tp;
3224	struct device *dev;
3225	int retval;
3226
3227	if (index >= driver->num) {
3228	pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3229	driver->name, index);
3230	return ERR_PTR(error: -EINVAL);
3231	}
3232
3233	if (driver->type == TTY_DRIVER_TYPE_PTY)
3234	pty_line_name(driver, index, p: name);
3235	else
3236	tty_line_name(driver, index, p: name);
3237
3238	dev = kzalloc(size: sizeof(*dev), GFP_KERNEL);
3239	if (!dev)
3240	return ERR_PTR(error: -ENOMEM);
3241
3242	dev->devt = devt;
3243	dev->class = &tty_class;
3244	dev->parent = device;
3245	dev->release = tty_device_create_release;
3246	dev_set_name(dev, name: "%s", name);
3247	dev->groups = attr_grp;
3248	dev_set_drvdata(dev, data: drvdata);
3249
3250	dev_set_uevent_suppress(dev, val: 1);
3251
3252	retval = device_register(dev);
3253	if (retval)
3254	goto err_put;
3255
3256	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3257	/*
3258	* Free any saved termios data so that the termios state is
3259	* reset when reusing a minor number.
3260	*/
3261	tp = driver->termios[index];
3262	if (tp) {
3263	driver->termios[index] = NULL;
3264	kfree(objp: tp);
3265	}
3266
3267	retval = tty_cdev_add(driver, dev: devt, index, count: 1);
3268	if (retval)
3269	goto err_del;
3270	}
3271
3272	dev_set_uevent_suppress(dev, val: 0);
3273	kobject_uevent(kobj: &dev->kobj, action: KOBJ_ADD);
3274
3275	return dev;
3276
3277	err_del:
3278	device_del(dev);
3279	err_put:
3280	put_device(dev);
3281
3282	return ERR_PTR(error: retval);
3283	}
3284	EXPORT_SYMBOL_GPL(tty_register_device_attr);
3285
3286	/**
3287	* tty_unregister_device - unregister a tty device
3288	* @driver: the tty driver that describes the tty device
3289	* @index: the index in the tty driver for this tty device
3290	*
3291	* If a tty device is registered with a call to tty_register_device() then
3292	* this function must be called when the tty device is gone.
3293	*
3294	* Locking: ??
3295	*/
3296	void tty_unregister_device(struct tty_driver *driver, unsigned index)
3297	{
3298	device_destroy(cls: &tty_class, MKDEV(driver->major, driver->minor_start) + index);
3299	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3300	cdev_del(driver->cdevs[index]);
3301	driver->cdevs[index] = NULL;
3302	}
3303	}
3304	EXPORT_SYMBOL(tty_unregister_device);
3305
3306	/**
3307	* __tty_alloc_driver - allocate tty driver
3308	* @lines: count of lines this driver can handle at most
3309	* @owner: module which is responsible for this driver
3310	* @flags: some of %TTY_DRIVER_ flags, will be set in driver->flags
3311	*
3312	* This should not be called directly, some of the provided macros should be
3313	* used instead. Use IS_ERR() and friends on @retval.
3314	*/
3315	struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3316	unsigned long flags)
3317	{
3318	struct tty_driver *driver;
3319	unsigned int cdevs = 1;
3320	int err;
3321
3322	if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3323	return ERR_PTR(error: -EINVAL);
3324
3325	driver = kzalloc(size: sizeof(*driver), GFP_KERNEL);
3326	if (!driver)
3327	return ERR_PTR(error: -ENOMEM);
3328
3329	kref_init(kref: &driver->kref);
3330	driver->num = lines;
3331	driver->owner = owner;
3332	driver->flags = flags;
3333
3334	if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3335	driver->ttys = kcalloc(n: lines, size: sizeof(*driver->ttys),
3336	GFP_KERNEL);
3337	driver->termios = kcalloc(n: lines, size: sizeof(*driver->termios),
3338	GFP_KERNEL);
3339	if (!driver->ttys || !driver->termios) {
3340	err = -ENOMEM;
3341	goto err_free_all;
3342	}
3343	}
3344
3345	if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3346	driver->ports = kcalloc(n: lines, size: sizeof(*driver->ports),
3347	GFP_KERNEL);
3348	if (!driver->ports) {
3349	err = -ENOMEM;
3350	goto err_free_all;
3351	}
3352	cdevs = lines;
3353	}
3354
3355	driver->cdevs = kcalloc(n: cdevs, size: sizeof(*driver->cdevs), GFP_KERNEL);
3356	if (!driver->cdevs) {
3357	err = -ENOMEM;
3358	goto err_free_all;
3359	}
3360
3361	return driver;
3362	err_free_all:
3363	kfree(objp: driver->ports);
3364	kfree(objp: driver->ttys);
3365	kfree(objp: driver->termios);
3366	kfree(objp: driver->cdevs);
3367	kfree(objp: driver);
3368	return ERR_PTR(error: err);
3369	}
3370	EXPORT_SYMBOL(__tty_alloc_driver);
3371
3372	static void destruct_tty_driver(struct kref *kref)
3373	{
3374	struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3375	int i;
3376	struct ktermios *tp;
3377
3378	if (driver->flags & TTY_DRIVER_INSTALLED) {
3379	for (i = 0; i < driver->num; i++) {
3380	tp = driver->termios[i];
3381	if (tp) {
3382	driver->termios[i] = NULL;
3383	kfree(objp: tp);
3384	}
3385	if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3386	tty_unregister_device(driver, i);
3387	}
3388	proc_tty_unregister_driver(driver);
3389	if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3390	cdev_del(driver->cdevs[0]);
3391	}
3392	kfree(objp: driver->cdevs);
3393	kfree(objp: driver->ports);
3394	kfree(objp: driver->termios);
3395	kfree(objp: driver->ttys);
3396	kfree(objp: driver);
3397	}
3398
3399	/**
3400	* tty_driver_kref_put - drop a reference to a tty driver
3401	* @driver: driver of which to drop the reference
3402	*
3403	* The final put will destroy and free up the driver.
3404	*/
3405	void tty_driver_kref_put(struct tty_driver *driver)
3406	{
3407	kref_put(kref: &driver->kref, release: destruct_tty_driver);
3408	}
3409	EXPORT_SYMBOL(tty_driver_kref_put);
3410
3411	/**
3412	* tty_register_driver - register a tty driver
3413	* @driver: driver to register
3414	*
3415	* Called by a tty driver to register itself.
3416	*/
3417	int tty_register_driver(struct tty_driver *driver)
3418	{
3419	int error;
3420	int i;
3421	dev_t dev;
3422	struct device *d;
3423
3424	if (!driver->major) {
3425	error = alloc_chrdev_region(&dev, driver->minor_start,
3426	driver->num, driver->name);
3427	if (!error) {
3428	driver->major = MAJOR(dev);
3429	driver->minor_start = MINOR(dev);
3430	}
3431	} else {
3432	dev = MKDEV(driver->major, driver->minor_start);
3433	error = register_chrdev_region(dev, driver->num, driver->name);
3434	}
3435	if (error < 0)
3436	goto err;
3437
3438	if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3439	error = tty_cdev_add(driver, dev, index: 0, count: driver->num);
3440	if (error)
3441	goto err_unreg_char;
3442	}
3443
3444	mutex_lock(&tty_mutex);
3445	list_add(new: &driver->tty_drivers, head: &tty_drivers);
3446	mutex_unlock(lock: &tty_mutex);
3447
3448	if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3449	for (i = 0; i < driver->num; i++) {
3450	d = tty_register_device(driver, i, NULL);
3451	if (IS_ERR(ptr: d)) {
3452	error = PTR_ERR(ptr: d);
3453	goto err_unreg_devs;
3454	}
3455	}
3456	}
3457	proc_tty_register_driver(driver);
3458	driver->flags |= TTY_DRIVER_INSTALLED;
3459	return 0;
3460
3461	err_unreg_devs:
3462	for (i--; i >= 0; i--)
3463	tty_unregister_device(driver, i);
3464
3465	mutex_lock(&tty_mutex);
3466	list_del(entry: &driver->tty_drivers);
3467	mutex_unlock(lock: &tty_mutex);
3468
3469	err_unreg_char:
3470	unregister_chrdev_region(dev, driver->num);
3471	err:
3472	return error;
3473	}
3474	EXPORT_SYMBOL(tty_register_driver);
3475
3476	/**
3477	* tty_unregister_driver - unregister a tty driver
3478	* @driver: driver to unregister
3479	*
3480	* Called by a tty driver to unregister itself.
3481	*/
3482	void tty_unregister_driver(struct tty_driver *driver)
3483	{
3484	unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3485	driver->num);
3486	mutex_lock(&tty_mutex);
3487	list_del(entry: &driver->tty_drivers);
3488	mutex_unlock(lock: &tty_mutex);
3489	}
3490	EXPORT_SYMBOL(tty_unregister_driver);
3491
3492	dev_t tty_devnum(struct tty_struct *tty)
3493	{
3494	return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3495	}
3496	EXPORT_SYMBOL(tty_devnum);
3497
3498	void tty_default_fops(struct file_operations *fops)
3499	{
3500	*fops = tty_fops;
3501	}
3502
3503	static char *tty_devnode(const struct device *dev, umode_t *mode)
3504	{
3505	if (!mode)
3506	return NULL;
3507	if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3508	dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3509	*mode = 0666;
3510	return NULL;
3511	}
3512
3513	const struct class tty_class = {
3514	.name = "tty",
3515	.devnode = tty_devnode,
3516	};
3517
3518	static int __init tty_class_init(void)
3519	{
3520	return class_register(class: &tty_class);
3521	}
3522
3523	postcore_initcall(tty_class_init);
3524
3525	/* 3/2004 jmc: why do these devices exist? */
3526	static struct cdev tty_cdev, console_cdev;
3527
3528	static ssize_t show_cons_active(struct device *dev,
3529	struct device_attribute *attr, char *buf)
3530	{
3531	struct console *cs[16];
3532	int i = 0;
3533	struct console *c;
3534	ssize_t count = 0;
3535
3536	/*
3537	* Hold the console_list_lock to guarantee that no consoles are
3538	* unregistered until all console processing is complete.
3539	* This also allows safe traversal of the console list and
3540	* race-free reading of @flags.
3541	*/
3542	console_list_lock();
3543
3544	for_each_console(c) {
3545	if (!c->device)
3546	continue;
3547	if (!c->write)
3548	continue;
3549	if ((c->flags & CON_ENABLED) == 0)
3550	continue;
3551	cs[i++] = c;
3552	if (i >= ARRAY_SIZE(cs))
3553	break;
3554	}
3555
3556	/*
3557	* Take console_lock to serialize device() callback with
3558	* other console operations. For example, fg_console is
3559	* modified under console_lock when switching vt.
3560	*/
3561	console_lock();
3562	while (i--) {
3563	int index = cs[i]->index;
3564	struct tty_driver *drv = cs[i]->device(cs[i], &index);
3565
3566	/* don't resolve tty0 as some programs depend on it */
3567	if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3568	count += tty_line_name(driver: drv, index, p: buf + count);
3569	else
3570	count += sprintf(buf: buf + count, fmt: "%s%d",
3571	cs[i]->name, cs[i]->index);
3572
3573	count += sprintf(buf: buf + count, fmt: "%c", i ? ' ':'\n');
3574	}
3575	console_unlock();
3576
3577	console_list_unlock();
3578
3579	return count;
3580	}
3581	static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3582
3583	static struct attribute *cons_dev_attrs[] = {
3584	&dev_attr_active.attr,
3585	NULL
3586	};
3587
3588	ATTRIBUTE_GROUPS(cons_dev);
3589
3590	static struct device *consdev;
3591
3592	void console_sysfs_notify(void)
3593	{
3594	if (consdev)
3595	sysfs_notify(kobj: &consdev->kobj, NULL, attr: "active");
3596	}
3597
3598	static struct ctl_table tty_table[] = {
3599	{
3600	.procname = "legacy_tiocsti",
3601	.data = &tty_legacy_tiocsti,
3602	.maxlen = sizeof(tty_legacy_tiocsti),
3603	.mode = 0644,
3604	.proc_handler = proc_dobool,
3605	},
3606	{
3607	.procname = "ldisc_autoload",
3608	.data = &tty_ldisc_autoload,
3609	.maxlen = sizeof(tty_ldisc_autoload),
3610	.mode = 0644,
3611	.proc_handler = proc_dointvec,
3612	.extra1 = SYSCTL_ZERO,
3613	.extra2 = SYSCTL_ONE,
3614	},
3615	};
3616
3617	/*
3618	* Ok, now we can initialize the rest of the tty devices and can count
3619	* on memory allocations, interrupts etc..
3620	*/
3621	int __init tty_init(void)
3622	{
3623	register_sysctl_init("dev/tty", tty_table);
3624	cdev_init(&tty_cdev, &tty_fops);
3625	if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3626	register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3627	panic(fmt: "Couldn't register /dev/tty driver\n");
3628	device_create(cls: &tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, fmt: "tty");
3629
3630	cdev_init(&console_cdev, &console_fops);
3631	if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3632	register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3633	panic(fmt: "Couldn't register /dev/console driver\n");
3634	consdev = device_create_with_groups(cls: &tty_class, NULL,
3635	MKDEV(TTYAUX_MAJOR, 1), NULL,
3636	groups: cons_dev_groups, fmt: "console");
3637	if (IS_ERR(ptr: consdev))
3638	consdev = NULL;
3639
3640	#ifdef CONFIG_VT
3641	vty_init(console_fops: &console_fops);
3642	#endif
3643	return 0;
3644	}
3645