1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 1991, 1992 Linus Torvalds
4 */
5
6 /*
7 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
8 * or rs-channels. It also implements echoing, cooked mode etc.
9 *
10 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
11 *
12 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
13 * tty_struct and tty_queue structures. Previously there was an array
14 * of 256 tty_struct's which was statically allocated, and the
15 * tty_queue structures were allocated at boot time. Both are now
16 * dynamically allocated only when the tty is open.
17 *
18 * Also restructured routines so that there is more of a separation
19 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
20 * the low-level tty routines (serial.c, pty.c, console.c). This
21 * makes for cleaner and more compact code. -TYT, 9/17/92
22 *
23 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
24 * which can be dynamically activated and de-activated by the line
25 * discipline handling modules (like SLIP).
26 *
27 * NOTE: pay no attention to the line discipline code (yet); its
28 * interface is still subject to change in this version...
29 * -- TYT, 1/31/92
30 *
31 * Added functionality to the OPOST tty handling. No delays, but all
32 * other bits should be there.
33 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
34 *
35 * Rewrote canonical mode and added more termios flags.
36 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
37 *
38 * Reorganized FASYNC support so mouse code can share it.
39 * -- ctm@ardi.com, 9Sep95
40 *
41 * New TIOCLINUX variants added.
42 * -- mj@k332.feld.cvut.cz, 19-Nov-95
43 *
44 * Restrict vt switching via ioctl()
45 * -- grif@cs.ucr.edu, 5-Dec-95
46 *
47 * Move console and virtual terminal code to more appropriate files,
48 * implement CONFIG_VT and generalize console device interface.
49 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
50 *
51 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
52 * -- Bill Hawes <whawes@star.net>, June 97
53 *
54 * Added devfs support.
55 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
56 *
57 * Added support for a Unix98-style ptmx device.
58 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
59 *
60 * Reduced memory usage for older ARM systems
61 * -- Russell King <rmk@arm.linux.org.uk>
62 *
63 * Move do_SAK() into process context. Less stack use in devfs functions.
64 * alloc_tty_struct() always uses kmalloc()
65 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66 */
67
68 #include <linux/types.h>
69 #include <linux/major.h>
70 #include <linux/errno.h>
71 #include <linux/signal.h>
72 #include <linux/fcntl.h>
73 #include <linux/sched/signal.h>
74 #include <linux/sched/task.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/fdtable.h>
82 #include <linux/console.h>
83 #include <linux/timer.h>
84 #include <linux/ctype.h>
85 #include <linux/kd.h>
86 #include <linux/mm.h>
87 #include <linux/string.h>
88 #include <linux/slab.h>
89 #include <linux/poll.h>
90 #include <linux/ppp-ioctl.h>
91 #include <linux/proc_fs.h>
92 #include <linux/init.h>
93 #include <linux/module.h>
94 #include <linux/device.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98 #include <linux/seq_file.h>
99 #include <linux/serial.h>
100 #include <linux/ratelimit.h>
101 #include <linux/compat.h>
102
103 #include <linux/uaccess.h>
104
105 #include <linux/kbd_kern.h>
106 #include <linux/vt_kern.h>
107 #include <linux/selection.h>
108
109 #include <linux/kmod.h>
110 #include <linux/nsproxy.h>
111 #include "tty.h"
112
113 #undef TTY_DEBUG_HANGUP
114 #ifdef TTY_DEBUG_HANGUP
115 # define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
116 #else
117 # define tty_debug_hangup(tty, f, args...) do { } while (0)
118 #endif
119
120 #define TTY_PARANOIA_CHECK 1
121 #define CHECK_TTY_COUNT 1
122
123 struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
124 .c_iflag = ICRNL | IXON,
125 .c_oflag = OPOST | ONLCR,
126 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
127 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
128 ECHOCTL | ECHOKE | IEXTEN,
129 .c_cc = INIT_C_CC,
130 .c_ispeed = 38400,
131 .c_ospeed = 38400,
132 /* .c_line = N_TTY, */
133 };
134
135 EXPORT_SYMBOL(tty_std_termios);
136
137 /* This list gets poked at by procfs and various bits of boot up code. This
138 could do with some rationalisation such as pulling the tty proc function
139 into this file */
140
141 LIST_HEAD(tty_drivers); /* linked list of tty drivers */
142
143 /* Mutex to protect creating and releasing a tty */
144 DEFINE_MUTEX(tty_mutex);
145
146 static ssize_t tty_read(struct kiocb *, struct iov_iter *);
147 static ssize_t tty_write(struct kiocb *, struct iov_iter *);
148 static __poll_t tty_poll(struct file *, poll_table *);
149 static int tty_open(struct inode *, struct file *);
150 #ifdef CONFIG_COMPAT
151 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
152 unsigned long arg);
153 #else
154 #define tty_compat_ioctl NULL
155 #endif
156 static int __tty_fasync(int fd, struct file *filp, int on);
157 static int tty_fasync(int fd, struct file *filp, int on);
158 static void release_tty(struct tty_struct *tty, int idx);
159
160 /**
161 * free_tty_struct - free a disused tty
162 * @tty: tty struct to free
163 *
164 * Free the write buffers, tty queue and tty memory itself.
165 *
166 * Locking: none. Must be called after tty is definitely unused
167 */
168
free_tty_struct(struct tty_struct * tty)169 static void free_tty_struct(struct tty_struct *tty)
170 {
171 tty_ldisc_deinit(tty);
172 put_device(tty->dev);
173 kfree(tty->write_buf);
174 tty->magic = 0xDEADDEAD;
175 kfree(tty);
176 }
177
file_tty(struct file * file)178 static inline struct tty_struct *file_tty(struct file *file)
179 {
180 return ((struct tty_file_private *)file->private_data)->tty;
181 }
182
tty_alloc_file(struct file * file)183 int tty_alloc_file(struct file *file)
184 {
185 struct tty_file_private *priv;
186
187 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
188 if (!priv)
189 return -ENOMEM;
190
191 file->private_data = priv;
192
193 return 0;
194 }
195
196 /* Associate a new file with the tty structure */
tty_add_file(struct tty_struct * tty,struct file * file)197 void tty_add_file(struct tty_struct *tty, struct file *file)
198 {
199 struct tty_file_private *priv = file->private_data;
200
201 priv->tty = tty;
202 priv->file = file;
203
204 spin_lock(&tty->files_lock);
205 list_add(&priv->list, &tty->tty_files);
206 spin_unlock(&tty->files_lock);
207 }
208
209 /*
210 * tty_free_file - free file->private_data
211 *
212 * This shall be used only for fail path handling when tty_add_file was not
213 * called yet.
214 */
tty_free_file(struct file * file)215 void tty_free_file(struct file *file)
216 {
217 struct tty_file_private *priv = file->private_data;
218
219 file->private_data = NULL;
220 kfree(priv);
221 }
222
223 /* Delete file from its tty */
tty_del_file(struct file * file)224 static void tty_del_file(struct file *file)
225 {
226 struct tty_file_private *priv = file->private_data;
227 struct tty_struct *tty = priv->tty;
228
229 spin_lock(&tty->files_lock);
230 list_del(&priv->list);
231 spin_unlock(&tty->files_lock);
232 tty_free_file(file);
233 }
234
235 /**
236 * tty_name - return tty naming
237 * @tty: tty structure
238 *
239 * Convert a tty structure into a name. The name reflects the kernel
240 * naming policy and if udev is in use may not reflect user space
241 *
242 * Locking: none
243 */
244
tty_name(const struct tty_struct * tty)245 const char *tty_name(const struct tty_struct *tty)
246 {
247 if (!tty) /* Hmm. NULL pointer. That's fun. */
248 return "NULL tty";
249 return tty->name;
250 }
251
252 EXPORT_SYMBOL(tty_name);
253
tty_driver_name(const struct tty_struct * tty)254 const char *tty_driver_name(const struct tty_struct *tty)
255 {
256 if (!tty || !tty->driver)
257 return "";
258 return tty->driver->name;
259 }
260
tty_paranoia_check(struct tty_struct * tty,struct inode * inode,const char * routine)261 static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
262 const char *routine)
263 {
264 #ifdef TTY_PARANOIA_CHECK
265 if (!tty) {
266 pr_warn("(%d:%d): %s: NULL tty\n",
267 imajor(inode), iminor(inode), routine);
268 return 1;
269 }
270 if (tty->magic != TTY_MAGIC) {
271 pr_warn("(%d:%d): %s: bad magic number\n",
272 imajor(inode), iminor(inode), routine);
273 return 1;
274 }
275 #endif
276 return 0;
277 }
278
279 /* Caller must hold tty_lock */
check_tty_count(struct tty_struct * tty,const char * routine)280 static int check_tty_count(struct tty_struct *tty, const char *routine)
281 {
282 #ifdef CHECK_TTY_COUNT
283 struct list_head *p;
284 int count = 0, kopen_count = 0;
285
286 spin_lock(&tty->files_lock);
287 list_for_each(p, &tty->tty_files) {
288 count++;
289 }
290 spin_unlock(&tty->files_lock);
291 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
292 tty->driver->subtype == PTY_TYPE_SLAVE &&
293 tty->link && tty->link->count)
294 count++;
295 if (tty_port_kopened(tty->port))
296 kopen_count++;
297 if (tty->count != (count + kopen_count)) {
298 tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
299 routine, tty->count, count, kopen_count);
300 return (count + kopen_count);
301 }
302 #endif
303 return 0;
304 }
305
306 /**
307 * get_tty_driver - find device of a tty
308 * @device: device identifier
309 * @index: returns the index of the tty
310 *
311 * This routine returns a tty driver structure, given a device number
312 * and also passes back the index number.
313 *
314 * Locking: caller must hold tty_mutex
315 */
316
get_tty_driver(dev_t device,int * index)317 static struct tty_driver *get_tty_driver(dev_t device, int *index)
318 {
319 struct tty_driver *p;
320
321 list_for_each_entry(p, &tty_drivers, tty_drivers) {
322 dev_t base = MKDEV(p->major, p->minor_start);
323 if (device < base || device >= base + p->num)
324 continue;
325 *index = device - base;
326 return tty_driver_kref_get(p);
327 }
328 return NULL;
329 }
330
331 /**
332 * tty_dev_name_to_number - return dev_t for device name
333 * @name: user space name of device under /dev
334 * @number: pointer to dev_t that this function will populate
335 *
336 * This function converts device names like ttyS0 or ttyUSB1 into dev_t
337 * like (4, 64) or (188, 1). If no corresponding driver is registered then
338 * the function returns -ENODEV.
339 *
340 * Locking: this acquires tty_mutex to protect the tty_drivers list from
341 * being modified while we are traversing it, and makes sure to
342 * release it before exiting.
343 */
tty_dev_name_to_number(const char * name,dev_t * number)344 int tty_dev_name_to_number(const char *name, dev_t *number)
345 {
346 struct tty_driver *p;
347 int ret;
348 int index, prefix_length = 0;
349 const char *str;
350
351 for (str = name; *str && !isdigit(*str); str++)
352 ;
353
354 if (!*str)
355 return -EINVAL;
356
357 ret = kstrtoint(str, 10, &index);
358 if (ret)
359 return ret;
360
361 prefix_length = str - name;
362 mutex_lock(&tty_mutex);
363
364 list_for_each_entry(p, &tty_drivers, tty_drivers)
365 if (prefix_length == strlen(p->name) && strncmp(name,
366 p->name, prefix_length) == 0) {
367 if (index < p->num) {
368 *number = MKDEV(p->major, p->minor_start + index);
369 goto out;
370 }
371 }
372
373 /* if here then driver wasn't found */
374 ret = -ENODEV;
375 out:
376 mutex_unlock(&tty_mutex);
377 return ret;
378 }
379 EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
380
381 #ifdef CONFIG_CONSOLE_POLL
382
383 /**
384 * tty_find_polling_driver - find device of a polled tty
385 * @name: name string to match
386 * @line: pointer to resulting tty line nr
387 *
388 * This routine returns a tty driver structure, given a name
389 * and the condition that the tty driver is capable of polled
390 * operation.
391 */
tty_find_polling_driver(char * name,int * line)392 struct tty_driver *tty_find_polling_driver(char *name, int *line)
393 {
394 struct tty_driver *p, *res = NULL;
395 int tty_line = 0;
396 int len;
397 char *str, *stp;
398
399 for (str = name; *str; str++)
400 if ((*str >= '0' && *str <= '9') || *str == ',')
401 break;
402 if (!*str)
403 return NULL;
404
405 len = str - name;
406 tty_line = simple_strtoul(str, &str, 10);
407
408 mutex_lock(&tty_mutex);
409 /* Search through the tty devices to look for a match */
410 list_for_each_entry(p, &tty_drivers, tty_drivers) {
411 if (!len || strncmp(name, p->name, len) != 0)
412 continue;
413 stp = str;
414 if (*stp == ',')
415 stp++;
416 if (*stp == '\0')
417 stp = NULL;
418
419 if (tty_line >= 0 && tty_line < p->num && p->ops &&
420 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
421 res = tty_driver_kref_get(p);
422 *line = tty_line;
423 break;
424 }
425 }
426 mutex_unlock(&tty_mutex);
427
428 return res;
429 }
430 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
431 #endif
432
hung_up_tty_read(struct kiocb * iocb,struct iov_iter * to)433 static ssize_t hung_up_tty_read(struct kiocb *iocb, struct iov_iter *to)
434 {
435 return 0;
436 }
437
hung_up_tty_write(struct kiocb * iocb,struct iov_iter * from)438 static ssize_t hung_up_tty_write(struct kiocb *iocb, struct iov_iter *from)
439 {
440 return -EIO;
441 }
442
443 /* No kernel lock held - none needed ;) */
hung_up_tty_poll(struct file * filp,poll_table * wait)444 static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
445 {
446 return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
447 }
448
hung_up_tty_ioctl(struct file * file,unsigned int cmd,unsigned long arg)449 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
450 unsigned long arg)
451 {
452 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
453 }
454
hung_up_tty_compat_ioctl(struct file * file,unsigned int cmd,unsigned long arg)455 static long hung_up_tty_compat_ioctl(struct file *file,
456 unsigned int cmd, unsigned long arg)
457 {
458 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
459 }
460
hung_up_tty_fasync(int fd,struct file * file,int on)461 static int hung_up_tty_fasync(int fd, struct file *file, int on)
462 {
463 return -ENOTTY;
464 }
465
tty_show_fdinfo(struct seq_file * m,struct file * file)466 static void tty_show_fdinfo(struct seq_file *m, struct file *file)
467 {
468 struct tty_struct *tty = file_tty(file);
469
470 if (tty && tty->ops && tty->ops->show_fdinfo)
471 tty->ops->show_fdinfo(tty, m);
472 }
473
474 static const struct file_operations tty_fops = {
475 .llseek = no_llseek,
476 .read_iter = tty_read,
477 .write_iter = tty_write,
478 .splice_read = generic_file_splice_read,
479 .splice_write = iter_file_splice_write,
480 .poll = tty_poll,
481 .unlocked_ioctl = tty_ioctl,
482 .compat_ioctl = tty_compat_ioctl,
483 .open = tty_open,
484 .release = tty_release,
485 .fasync = tty_fasync,
486 .show_fdinfo = tty_show_fdinfo,
487 };
488
489 static const struct file_operations console_fops = {
490 .llseek = no_llseek,
491 .read_iter = tty_read,
492 .write_iter = redirected_tty_write,
493 .splice_read = generic_file_splice_read,
494 .splice_write = iter_file_splice_write,
495 .poll = tty_poll,
496 .unlocked_ioctl = tty_ioctl,
497 .compat_ioctl = tty_compat_ioctl,
498 .open = tty_open,
499 .release = tty_release,
500 .fasync = tty_fasync,
501 };
502
503 static const struct file_operations hung_up_tty_fops = {
504 .llseek = no_llseek,
505 .read_iter = hung_up_tty_read,
506 .write_iter = hung_up_tty_write,
507 .poll = hung_up_tty_poll,
508 .unlocked_ioctl = hung_up_tty_ioctl,
509 .compat_ioctl = hung_up_tty_compat_ioctl,
510 .release = tty_release,
511 .fasync = hung_up_tty_fasync,
512 };
513
514 static DEFINE_SPINLOCK(redirect_lock);
515 static struct file *redirect;
516
517 /**
518 * tty_wakeup - request more data
519 * @tty: terminal
520 *
521 * Internal and external helper for wakeups of tty. This function
522 * informs the line discipline if present that the driver is ready
523 * to receive more output data.
524 */
525
tty_wakeup(struct tty_struct * tty)526 void tty_wakeup(struct tty_struct *tty)
527 {
528 struct tty_ldisc *ld;
529
530 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
531 ld = tty_ldisc_ref(tty);
532 if (ld) {
533 if (ld->ops->write_wakeup)
534 ld->ops->write_wakeup(tty);
535 tty_ldisc_deref(ld);
536 }
537 }
538 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
539 }
540
541 EXPORT_SYMBOL_GPL(tty_wakeup);
542
543 /**
544 * tty_release_redirect - Release a redirect on a pty if present
545 * @tty: tty device
546 *
547 * This is available to the pty code so if the master closes, if the
548 * slave is a redirect it can release the redirect.
549 */
tty_release_redirect(struct tty_struct * tty)550 static struct file *tty_release_redirect(struct tty_struct *tty)
551 {
552 struct file *f = NULL;
553
554 spin_lock(&redirect_lock);
555 if (redirect && file_tty(redirect) == tty) {
556 f = redirect;
557 redirect = NULL;
558 }
559 spin_unlock(&redirect_lock);
560
561 return f;
562 }
563
564 /**
565 * __tty_hangup - actual handler for hangup events
566 * @tty: tty device
567 * @exit_session: if non-zero, signal all foreground group processes
568 *
569 * This can be called by a "kworker" kernel thread. That is process
570 * synchronous but doesn't hold any locks, so we need to make sure we
571 * have the appropriate locks for what we're doing.
572 *
573 * The hangup event clears any pending redirections onto the hung up
574 * device. It ensures future writes will error and it does the needed
575 * line discipline hangup and signal delivery. The tty object itself
576 * remains intact.
577 *
578 * Locking:
579 * BTM
580 * redirect lock for undoing redirection
581 * file list lock for manipulating list of ttys
582 * tty_ldiscs_lock from called functions
583 * termios_rwsem resetting termios data
584 * tasklist_lock to walk task list for hangup event
585 * ->siglock to protect ->signal/->sighand
586 */
__tty_hangup(struct tty_struct * tty,int exit_session)587 static void __tty_hangup(struct tty_struct *tty, int exit_session)
588 {
589 struct file *cons_filp = NULL;
590 struct file *filp, *f;
591 struct tty_file_private *priv;
592 int closecount = 0, n;
593 int refs;
594
595 if (!tty)
596 return;
597
598 f = tty_release_redirect(tty);
599
600 tty_lock(tty);
601
602 if (test_bit(TTY_HUPPED, &tty->flags)) {
603 tty_unlock(tty);
604 return;
605 }
606
607 /*
608 * Some console devices aren't actually hung up for technical and
609 * historical reasons, which can lead to indefinite interruptible
610 * sleep in n_tty_read(). The following explicitly tells
611 * n_tty_read() to abort readers.
612 */
613 set_bit(TTY_HUPPING, &tty->flags);
614
615 /* inuse_filps is protected by the single tty lock,
616 this really needs to change if we want to flush the
617 workqueue with the lock held */
618 check_tty_count(tty, "tty_hangup");
619
620 spin_lock(&tty->files_lock);
621 /* This breaks for file handles being sent over AF_UNIX sockets ? */
622 list_for_each_entry(priv, &tty->tty_files, list) {
623 filp = priv->file;
624 if (filp->f_op->write_iter == redirected_tty_write)
625 cons_filp = filp;
626 if (filp->f_op->write_iter != tty_write)
627 continue;
628 closecount++;
629 __tty_fasync(-1, filp, 0); /* can't block */
630 filp->f_op = &hung_up_tty_fops;
631 }
632 spin_unlock(&tty->files_lock);
633
634 refs = tty_signal_session_leader(tty, exit_session);
635 /* Account for the p->signal references we killed */
636 while (refs--)
637 tty_kref_put(tty);
638
639 tty_ldisc_hangup(tty, cons_filp != NULL);
640
641 spin_lock_irq(&tty->ctrl_lock);
642 clear_bit(TTY_THROTTLED, &tty->flags);
643 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
644 put_pid(tty->session);
645 put_pid(tty->pgrp);
646 tty->session = NULL;
647 tty->pgrp = NULL;
648 tty->ctrl_status = 0;
649 spin_unlock_irq(&tty->ctrl_lock);
650
651 /*
652 * If one of the devices matches a console pointer, we
653 * cannot just call hangup() because that will cause
654 * tty->count and state->count to go out of sync.
655 * So we just call close() the right number of times.
656 */
657 if (cons_filp) {
658 if (tty->ops->close)
659 for (n = 0; n < closecount; n++)
660 tty->ops->close(tty, cons_filp);
661 } else if (tty->ops->hangup)
662 tty->ops->hangup(tty);
663 /*
664 * We don't want to have driver/ldisc interactions beyond the ones
665 * we did here. The driver layer expects no calls after ->hangup()
666 * from the ldisc side, which is now guaranteed.
667 */
668 set_bit(TTY_HUPPED, &tty->flags);
669 clear_bit(TTY_HUPPING, &tty->flags);
670 tty_unlock(tty);
671
672 if (f)
673 fput(f);
674 }
675
do_tty_hangup(struct work_struct * work)676 static void do_tty_hangup(struct work_struct *work)
677 {
678 struct tty_struct *tty =
679 container_of(work, struct tty_struct, hangup_work);
680
681 __tty_hangup(tty, 0);
682 }
683
684 /**
685 * tty_hangup - trigger a hangup event
686 * @tty: tty to hangup
687 *
688 * A carrier loss (virtual or otherwise) has occurred on this like
689 * schedule a hangup sequence to run after this event.
690 */
691
tty_hangup(struct tty_struct * tty)692 void tty_hangup(struct tty_struct *tty)
693 {
694 tty_debug_hangup(tty, "hangup\n");
695 schedule_work(&tty->hangup_work);
696 }
697
698 EXPORT_SYMBOL(tty_hangup);
699
700 /**
701 * tty_vhangup - process vhangup
702 * @tty: tty to hangup
703 *
704 * The user has asked via system call for the terminal to be hung up.
705 * We do this synchronously so that when the syscall returns the process
706 * is complete. That guarantee is necessary for security reasons.
707 */
708
tty_vhangup(struct tty_struct * tty)709 void tty_vhangup(struct tty_struct *tty)
710 {
711 tty_debug_hangup(tty, "vhangup\n");
712 __tty_hangup(tty, 0);
713 }
714
715 EXPORT_SYMBOL(tty_vhangup);
716
717
718 /**
719 * tty_vhangup_self - process vhangup for own ctty
720 *
721 * Perform a vhangup on the current controlling tty
722 */
723
tty_vhangup_self(void)724 void tty_vhangup_self(void)
725 {
726 struct tty_struct *tty;
727
728 tty = get_current_tty();
729 if (tty) {
730 tty_vhangup(tty);
731 tty_kref_put(tty);
732 }
733 }
734
735 /**
736 * tty_vhangup_session - hangup session leader exit
737 * @tty: tty to hangup
738 *
739 * The session leader is exiting and hanging up its controlling terminal.
740 * Every process in the foreground process group is signalled SIGHUP.
741 *
742 * We do this synchronously so that when the syscall returns the process
743 * is complete. That guarantee is necessary for security reasons.
744 */
745
tty_vhangup_session(struct tty_struct * tty)746 void tty_vhangup_session(struct tty_struct *tty)
747 {
748 tty_debug_hangup(tty, "session hangup\n");
749 __tty_hangup(tty, 1);
750 }
751
752 /**
753 * tty_hung_up_p - was tty hung up
754 * @filp: file pointer of tty
755 *
756 * Return true if the tty has been subject to a vhangup or a carrier
757 * loss
758 */
759
tty_hung_up_p(struct file * filp)760 int tty_hung_up_p(struct file *filp)
761 {
762 return (filp && filp->f_op == &hung_up_tty_fops);
763 }
764
765 EXPORT_SYMBOL(tty_hung_up_p);
766
767 /**
768 * stop_tty - propagate flow control
769 * @tty: tty to stop
770 *
771 * Perform flow control to the driver. May be called
772 * on an already stopped device and will not re-call the driver
773 * method.
774 *
775 * This functionality is used by both the line disciplines for
776 * halting incoming flow and by the driver. It may therefore be
777 * called from any context, may be under the tty atomic_write_lock
778 * but not always.
779 *
780 * Locking:
781 * flow_lock
782 */
783
__stop_tty(struct tty_struct * tty)784 void __stop_tty(struct tty_struct *tty)
785 {
786 if (tty->stopped)
787 return;
788 tty->stopped = 1;
789 if (tty->ops->stop)
790 tty->ops->stop(tty);
791 }
792
stop_tty(struct tty_struct * tty)793 void stop_tty(struct tty_struct *tty)
794 {
795 unsigned long flags;
796
797 spin_lock_irqsave(&tty->flow_lock, flags);
798 __stop_tty(tty);
799 spin_unlock_irqrestore(&tty->flow_lock, flags);
800 }
801 EXPORT_SYMBOL(stop_tty);
802
803 /**
804 * start_tty - propagate flow control
805 * @tty: tty to start
806 *
807 * Start a tty that has been stopped if at all possible. If this
808 * tty was previous stopped and is now being started, the driver
809 * start method is invoked and the line discipline woken.
810 *
811 * Locking:
812 * flow_lock
813 */
814
__start_tty(struct tty_struct * tty)815 void __start_tty(struct tty_struct *tty)
816 {
817 if (!tty->stopped || tty->flow_stopped)
818 return;
819 tty->stopped = 0;
820 if (tty->ops->start)
821 tty->ops->start(tty);
822 tty_wakeup(tty);
823 }
824
start_tty(struct tty_struct * tty)825 void start_tty(struct tty_struct *tty)
826 {
827 unsigned long flags;
828
829 spin_lock_irqsave(&tty->flow_lock, flags);
830 __start_tty(tty);
831 spin_unlock_irqrestore(&tty->flow_lock, flags);
832 }
833 EXPORT_SYMBOL(start_tty);
834
tty_update_time(struct timespec64 * time)835 static void tty_update_time(struct timespec64 *time)
836 {
837 time64_t sec = ktime_get_real_seconds();
838
839 /*
840 * We only care if the two values differ in anything other than the
841 * lower three bits (i.e every 8 seconds). If so, then we can update
842 * the time of the tty device, otherwise it could be construded as a
843 * security leak to let userspace know the exact timing of the tty.
844 */
845 if ((sec ^ time->tv_sec) & ~7)
846 time->tv_sec = sec;
847 }
848
849 /*
850 * Iterate on the ldisc ->read() function until we've gotten all
851 * the data the ldisc has for us.
852 *
853 * The "cookie" is something that the ldisc read function can fill
854 * in to let us know that there is more data to be had.
855 *
856 * We promise to continue to call the ldisc until it stops returning
857 * data or clears the cookie. The cookie may be something that the
858 * ldisc maintains state for and needs to free.
859 */
iterate_tty_read(struct tty_ldisc * ld,struct tty_struct * tty,struct file * file,struct iov_iter * to)860 static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty,
861 struct file *file, struct iov_iter *to)
862 {
863 int retval = 0;
864 void *cookie = NULL;
865 unsigned long offset = 0;
866 char kernel_buf[64];
867 size_t count = iov_iter_count(to);
868
869 do {
870 int size, copied;
871
872 size = count > sizeof(kernel_buf) ? sizeof(kernel_buf) : count;
873 size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
874 if (!size)
875 break;
876
877 if (size < 0) {
878 /* Did we have an earlier error (ie -EFAULT)? */
879 if (retval)
880 break;
881 retval = size;
882
883 /*
884 * -EOVERFLOW means we didn't have enough space
885 * for a whole packet, and we shouldn't return
886 * a partial result.
887 */
888 if (retval == -EOVERFLOW)
889 offset = 0;
890 break;
891 }
892
893 copied = copy_to_iter(kernel_buf, size, to);
894 offset += copied;
895 count -= copied;
896
897 /*
898 * If the user copy failed, we still need to do another ->read()
899 * call if we had a cookie to let the ldisc clear up.
900 *
901 * But make sure size is zeroed.
902 */
903 if (unlikely(copied != size)) {
904 count = 0;
905 retval = -EFAULT;
906 }
907 } while (cookie);
908
909 /* We always clear tty buffer in case they contained passwords */
910 memzero_explicit(kernel_buf, sizeof(kernel_buf));
911 return offset ? offset : retval;
912 }
913
914
915 /**
916 * tty_read - read method for tty device files
917 * @file: pointer to tty file
918 * @buf: user buffer
919 * @count: size of user buffer
920 * @ppos: unused
921 *
922 * Perform the read system call function on this terminal device. Checks
923 * for hung up devices before calling the line discipline method.
924 *
925 * Locking:
926 * Locks the line discipline internally while needed. Multiple
927 * read calls may be outstanding in parallel.
928 */
929
tty_read(struct kiocb * iocb,struct iov_iter * to)930 static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
931 {
932 int i;
933 struct file *file = iocb->ki_filp;
934 struct inode *inode = file_inode(file);
935 struct tty_struct *tty = file_tty(file);
936 struct tty_ldisc *ld;
937
938 if (tty_paranoia_check(tty, inode, "tty_read"))
939 return -EIO;
940 if (!tty || tty_io_error(tty))
941 return -EIO;
942
943 /* We want to wait for the line discipline to sort out in this
944 situation */
945 ld = tty_ldisc_ref_wait(tty);
946 if (!ld)
947 return hung_up_tty_read(iocb, to);
948 i = -EIO;
949 if (ld->ops->read)
950 i = iterate_tty_read(ld, tty, file, to);
951 tty_ldisc_deref(ld);
952
953 if (i > 0)
954 tty_update_time(&inode->i_atime);
955
956 return i;
957 }
958
tty_write_unlock(struct tty_struct * tty)959 static void tty_write_unlock(struct tty_struct *tty)
960 {
961 mutex_unlock(&tty->atomic_write_lock);
962 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
963 }
964
tty_write_lock(struct tty_struct * tty,int ndelay)965 static int tty_write_lock(struct tty_struct *tty, int ndelay)
966 {
967 if (!mutex_trylock(&tty->atomic_write_lock)) {
968 if (ndelay)
969 return -EAGAIN;
970 if (mutex_lock_interruptible(&tty->atomic_write_lock))
971 return -ERESTARTSYS;
972 }
973 return 0;
974 }
975
976 /*
977 * Split writes up in sane blocksizes to avoid
978 * denial-of-service type attacks
979 */
do_tty_write(ssize_t (* write)(struct tty_struct *,struct file *,const unsigned char *,size_t),struct tty_struct * tty,struct file * file,struct iov_iter * from)980 static inline ssize_t do_tty_write(
981 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
982 struct tty_struct *tty,
983 struct file *file,
984 struct iov_iter *from)
985 {
986 size_t count = iov_iter_count(from);
987 ssize_t ret, written = 0;
988 unsigned int chunk;
989
990 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
991 if (ret < 0)
992 return ret;
993
994 /*
995 * We chunk up writes into a temporary buffer. This
996 * simplifies low-level drivers immensely, since they
997 * don't have locking issues and user mode accesses.
998 *
999 * But if TTY_NO_WRITE_SPLIT is set, we should use a
1000 * big chunk-size..
1001 *
1002 * The default chunk-size is 2kB, because the NTTY
1003 * layer has problems with bigger chunks. It will
1004 * claim to be able to handle more characters than
1005 * it actually does.
1006 *
1007 * FIXME: This can probably go away now except that 64K chunks
1008 * are too likely to fail unless switched to vmalloc...
1009 */
1010 chunk = 2048;
1011 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1012 chunk = 65536;
1013 if (count < chunk)
1014 chunk = count;
1015
1016 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1017 if (tty->write_cnt < chunk) {
1018 unsigned char *buf_chunk;
1019
1020 if (chunk < 1024)
1021 chunk = 1024;
1022
1023 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1024 if (!buf_chunk) {
1025 ret = -ENOMEM;
1026 goto out;
1027 }
1028 kfree(tty->write_buf);
1029 tty->write_cnt = chunk;
1030 tty->write_buf = buf_chunk;
1031 }
1032
1033 /* Do the write .. */
1034 for (;;) {
1035 size_t size = count;
1036 if (size > chunk)
1037 size = chunk;
1038
1039 ret = -EFAULT;
1040 if (copy_from_iter(tty->write_buf, size, from) != size)
1041 break;
1042
1043 ret = write(tty, file, tty->write_buf, size);
1044 if (ret <= 0)
1045 break;
1046
1047 written += ret;
1048 if (ret > size)
1049 break;
1050
1051 /* FIXME! Have Al check this! */
1052 if (ret != size)
1053 iov_iter_revert(from, size-ret);
1054
1055 count -= ret;
1056 if (!count)
1057 break;
1058 ret = -ERESTARTSYS;
1059 if (signal_pending(current))
1060 break;
1061 cond_resched();
1062 }
1063 if (written) {
1064 tty_update_time(&file_inode(file)->i_mtime);
1065 ret = written;
1066 }
1067 out:
1068 tty_write_unlock(tty);
1069 return ret;
1070 }
1071
1072 /**
1073 * tty_write_message - write a message to a certain tty, not just the console.
1074 * @tty: the destination tty_struct
1075 * @msg: the message to write
1076 *
1077 * This is used for messages that need to be redirected to a specific tty.
1078 * We don't put it into the syslog queue right now maybe in the future if
1079 * really needed.
1080 *
1081 * We must still hold the BTM and test the CLOSING flag for the moment.
1082 */
1083
tty_write_message(struct tty_struct * tty,char * msg)1084 void tty_write_message(struct tty_struct *tty, char *msg)
1085 {
1086 if (tty) {
1087 mutex_lock(&tty->atomic_write_lock);
1088 tty_lock(tty);
1089 if (tty->ops->write && tty->count > 0)
1090 tty->ops->write(tty, msg, strlen(msg));
1091 tty_unlock(tty);
1092 tty_write_unlock(tty);
1093 }
1094 return;
1095 }
1096
1097
1098 /**
1099 * tty_write - write method for tty device file
1100 * @file: tty file pointer
1101 * @buf: user data to write
1102 * @count: bytes to write
1103 * @ppos: unused
1104 *
1105 * Write data to a tty device via the line discipline.
1106 *
1107 * Locking:
1108 * Locks the line discipline as required
1109 * Writes to the tty driver are serialized by the atomic_write_lock
1110 * and are then processed in chunks to the device. The line discipline
1111 * write method will not be invoked in parallel for each device.
1112 */
1113
file_tty_write(struct file * file,struct kiocb * iocb,struct iov_iter * from)1114 static ssize_t file_tty_write(struct file *file, struct kiocb *iocb, struct iov_iter *from)
1115 {
1116 struct tty_struct *tty = file_tty(file);
1117 struct tty_ldisc *ld;
1118 ssize_t ret;
1119
1120 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1121 return -EIO;
1122 if (!tty || !tty->ops->write || tty_io_error(tty))
1123 return -EIO;
1124 /* Short term debug to catch buggy drivers */
1125 if (tty->ops->write_room == NULL)
1126 tty_err(tty, "missing write_room method\n");
1127 ld = tty_ldisc_ref_wait(tty);
1128 if (!ld)
1129 return hung_up_tty_write(iocb, from);
1130 if (!ld->ops->write)
1131 ret = -EIO;
1132 else
1133 ret = do_tty_write(ld->ops->write, tty, file, from);
1134 tty_ldisc_deref(ld);
1135 return ret;
1136 }
1137
tty_write(struct kiocb * iocb,struct iov_iter * from)1138 static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
1139 {
1140 return file_tty_write(iocb->ki_filp, iocb, from);
1141 }
1142
redirected_tty_write(struct kiocb * iocb,struct iov_iter * iter)1143 ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
1144 {
1145 struct file *p = NULL;
1146
1147 spin_lock(&redirect_lock);
1148 if (redirect)
1149 p = get_file(redirect);
1150 spin_unlock(&redirect_lock);
1151
1152 /*
1153 * We know the redirected tty is just another tty, we can can
1154 * call file_tty_write() directly with that file pointer.
1155 */
1156 if (p) {
1157 ssize_t res;
1158 res = file_tty_write(p, iocb, iter);
1159 fput(p);
1160 return res;
1161 }
1162 return tty_write(iocb, iter);
1163 }
1164
1165 /*
1166 * tty_send_xchar - send priority character
1167 *
1168 * Send a high priority character to the tty even if stopped
1169 *
1170 * Locking: none for xchar method, write ordering for write method.
1171 */
1172
tty_send_xchar(struct tty_struct * tty,char ch)1173 int tty_send_xchar(struct tty_struct *tty, char ch)
1174 {
1175 int was_stopped = tty->stopped;
1176
1177 if (tty->ops->send_xchar) {
1178 down_read(&tty->termios_rwsem);
1179 tty->ops->send_xchar(tty, ch);
1180 up_read(&tty->termios_rwsem);
1181 return 0;
1182 }
1183
1184 if (tty_write_lock(tty, 0) < 0)
1185 return -ERESTARTSYS;
1186
1187 down_read(&tty->termios_rwsem);
1188 if (was_stopped)
1189 start_tty(tty);
1190 tty->ops->write(tty, &ch, 1);
1191 if (was_stopped)
1192 stop_tty(tty);
1193 up_read(&tty->termios_rwsem);
1194 tty_write_unlock(tty);
1195 return 0;
1196 }
1197
1198 /**
1199 * pty_line_name - generate name for a pty
1200 * @driver: the tty driver in use
1201 * @index: the minor number
1202 * @p: output buffer of at least 6 bytes
1203 *
1204 * Generate a name from a driver reference and write it to the output
1205 * buffer.
1206 *
1207 * Locking: None
1208 */
pty_line_name(struct tty_driver * driver,int index,char * p)1209 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1210 {
1211 static const char ptychar[] = "pqrstuvwxyzabcde";
1212 int i = index + driver->name_base;
1213 /* ->name is initialized to "ttyp", but "tty" is expected */
1214 sprintf(p, "%s%c%x",
1215 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1216 ptychar[i >> 4 & 0xf], i & 0xf);
1217 }
1218
1219 /**
1220 * tty_line_name - generate name for a tty
1221 * @driver: the tty driver in use
1222 * @index: the minor number
1223 * @p: output buffer of at least 7 bytes
1224 *
1225 * Generate a name from a driver reference and write it to the output
1226 * buffer.
1227 *
1228 * Locking: None
1229 */
tty_line_name(struct tty_driver * driver,int index,char * p)1230 static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1231 {
1232 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1233 return sprintf(p, "%s", driver->name);
1234 else
1235 return sprintf(p, "%s%d", driver->name,
1236 index + driver->name_base);
1237 }
1238
1239 /**
1240 * tty_driver_lookup_tty() - find an existing tty, if any
1241 * @driver: the driver for the tty
1242 * @file: file object
1243 * @idx: the minor number
1244 *
1245 * Return the tty, if found. If not found, return NULL or ERR_PTR() if the
1246 * driver lookup() method returns an error.
1247 *
1248 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1249 */
tty_driver_lookup_tty(struct tty_driver * driver,struct file * file,int idx)1250 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1251 struct file *file, int idx)
1252 {
1253 struct tty_struct *tty;
1254
1255 if (driver->ops->lookup)
1256 if (!file)
1257 tty = ERR_PTR(-EIO);
1258 else
1259 tty = driver->ops->lookup(driver, file, idx);
1260 else
1261 tty = driver->ttys[idx];
1262
1263 if (!IS_ERR(tty))
1264 tty_kref_get(tty);
1265 return tty;
1266 }
1267
1268 /**
1269 * tty_init_termios - helper for termios setup
1270 * @tty: the tty to set up
1271 *
1272 * Initialise the termios structure for this tty. This runs under
1273 * the tty_mutex currently so we can be relaxed about ordering.
1274 */
1275
tty_init_termios(struct tty_struct * tty)1276 void tty_init_termios(struct tty_struct *tty)
1277 {
1278 struct ktermios *tp;
1279 int idx = tty->index;
1280
1281 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1282 tty->termios = tty->driver->init_termios;
1283 else {
1284 /* Check for lazy saved data */
1285 tp = tty->driver->termios[idx];
1286 if (tp != NULL) {
1287 tty->termios = *tp;
1288 tty->termios.c_line = tty->driver->init_termios.c_line;
1289 } else
1290 tty->termios = tty->driver->init_termios;
1291 }
1292 /* Compatibility until drivers always set this */
1293 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1294 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1295 }
1296 EXPORT_SYMBOL_GPL(tty_init_termios);
1297
tty_standard_install(struct tty_driver * driver,struct tty_struct * tty)1298 int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1299 {
1300 tty_init_termios(tty);
1301 tty_driver_kref_get(driver);
1302 tty->count++;
1303 driver->ttys[tty->index] = tty;
1304 return 0;
1305 }
1306 EXPORT_SYMBOL_GPL(tty_standard_install);
1307
1308 /**
1309 * tty_driver_install_tty() - install a tty entry in the driver
1310 * @driver: the driver for the tty
1311 * @tty: the tty
1312 *
1313 * Install a tty object into the driver tables. The tty->index field
1314 * will be set by the time this is called. This method is responsible
1315 * for ensuring any need additional structures are allocated and
1316 * configured.
1317 *
1318 * Locking: tty_mutex for now
1319 */
tty_driver_install_tty(struct tty_driver * driver,struct tty_struct * tty)1320 static int tty_driver_install_tty(struct tty_driver *driver,
1321 struct tty_struct *tty)
1322 {
1323 return driver->ops->install ? driver->ops->install(driver, tty) :
1324 tty_standard_install(driver, tty);
1325 }
1326
1327 /**
1328 * tty_driver_remove_tty() - remove a tty from the driver tables
1329 * @driver: the driver for the tty
1330 * @tty: tty to remove
1331 *
1332 * Remvoe a tty object from the driver tables. The tty->index field
1333 * will be set by the time this is called.
1334 *
1335 * Locking: tty_mutex for now
1336 */
tty_driver_remove_tty(struct tty_driver * driver,struct tty_struct * tty)1337 static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1338 {
1339 if (driver->ops->remove)
1340 driver->ops->remove(driver, tty);
1341 else
1342 driver->ttys[tty->index] = NULL;
1343 }
1344
1345 /**
1346 * tty_reopen() - fast re-open of an open tty
1347 * @tty: the tty to open
1348 *
1349 * Return 0 on success, -errno on error.
1350 * Re-opens on master ptys are not allowed and return -EIO.
1351 *
1352 * Locking: Caller must hold tty_lock
1353 */
tty_reopen(struct tty_struct * tty)1354 static int tty_reopen(struct tty_struct *tty)
1355 {
1356 struct tty_driver *driver = tty->driver;
1357 struct tty_ldisc *ld;
1358 int retval = 0;
1359
1360 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1361 driver->subtype == PTY_TYPE_MASTER)
1362 return -EIO;
1363
1364 if (!tty->count)
1365 return -EAGAIN;
1366
1367 if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1368 return -EBUSY;
1369
1370 ld = tty_ldisc_ref_wait(tty);
1371 if (ld) {
1372 tty_ldisc_deref(ld);
1373 } else {
1374 retval = tty_ldisc_lock(tty, 5 * HZ);
1375 if (retval)
1376 return retval;
1377
1378 if (!tty->ldisc)
1379 retval = tty_ldisc_reinit(tty, tty->termios.c_line);
1380 tty_ldisc_unlock(tty);
1381 }
1382
1383 if (retval == 0)
1384 tty->count++;
1385
1386 return retval;
1387 }
1388
1389 /**
1390 * tty_init_dev - initialise a tty device
1391 * @driver: tty driver we are opening a device on
1392 * @idx: device index
1393 *
1394 * Prepare a tty device. This may not be a "new" clean device but
1395 * could also be an active device. The pty drivers require special
1396 * handling because of this.
1397 *
1398 * Locking:
1399 * The function is called under the tty_mutex, which
1400 * protects us from the tty struct or driver itself going away.
1401 *
1402 * On exit the tty device has the line discipline attached and
1403 * a reference count of 1. If a pair was created for pty/tty use
1404 * and the other was a pty master then it too has a reference count of 1.
1405 *
1406 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1407 * failed open. The new code protects the open with a mutex, so it's
1408 * really quite straightforward. The mutex locking can probably be
1409 * relaxed for the (most common) case of reopening a tty.
1410 *
1411 * Return: returned tty structure
1412 */
1413
tty_init_dev(struct tty_driver * driver,int idx)1414 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1415 {
1416 struct tty_struct *tty;
1417 int retval;
1418
1419 /*
1420 * First time open is complex, especially for PTY devices.
1421 * This code guarantees that either everything succeeds and the
1422 * TTY is ready for operation, or else the table slots are vacated
1423 * and the allocated memory released. (Except that the termios
1424 * may be retained.)
1425 */
1426
1427 if (!try_module_get(driver->owner))
1428 return ERR_PTR(-ENODEV);
1429
1430 tty = alloc_tty_struct(driver, idx);
1431 if (!tty) {
1432 retval = -ENOMEM;
1433 goto err_module_put;
1434 }
1435
1436 tty_lock(tty);
1437 retval = tty_driver_install_tty(driver, tty);
1438 if (retval < 0)
1439 goto err_free_tty;
1440
1441 if (!tty->port)
1442 tty->port = driver->ports[idx];
1443
1444 if (WARN_RATELIMIT(!tty->port,
1445 "%s: %s driver does not set tty->port. This would crash the kernel. Fix the driver!\n",
1446 __func__, tty->driver->name)) {
1447 retval = -EINVAL;
1448 goto err_release_lock;
1449 }
1450
1451 retval = tty_ldisc_lock(tty, 5 * HZ);
1452 if (retval)
1453 goto err_release_lock;
1454 tty->port->itty = tty;
1455
1456 /*
1457 * Structures all installed ... call the ldisc open routines.
1458 * If we fail here just call release_tty to clean up. No need
1459 * to decrement the use counts, as release_tty doesn't care.
1460 */
1461 retval = tty_ldisc_setup(tty, tty->link);
1462 if (retval)
1463 goto err_release_tty;
1464 tty_ldisc_unlock(tty);
1465 /* Return the tty locked so that it cannot vanish under the caller */
1466 return tty;
1467
1468 err_free_tty:
1469 tty_unlock(tty);
1470 free_tty_struct(tty);
1471 err_module_put:
1472 module_put(driver->owner);
1473 return ERR_PTR(retval);
1474
1475 /* call the tty release_tty routine to clean out this slot */
1476 err_release_tty:
1477 tty_ldisc_unlock(tty);
1478 tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1479 retval, idx);
1480 err_release_lock:
1481 tty_unlock(tty);
1482 release_tty(tty, idx);
1483 return ERR_PTR(retval);
1484 }
1485
1486 /**
1487 * tty_save_termios() - save tty termios data in driver table
1488 * @tty: tty whose termios data to save
1489 *
1490 * Locking: Caller guarantees serialisation with tty_init_termios().
1491 */
tty_save_termios(struct tty_struct * tty)1492 void tty_save_termios(struct tty_struct *tty)
1493 {
1494 struct ktermios *tp;
1495 int idx = tty->index;
1496
1497 /* If the port is going to reset then it has no termios to save */
1498 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1499 return;
1500
1501 /* Stash the termios data */
1502 tp = tty->driver->termios[idx];
1503 if (tp == NULL) {
1504 tp = kmalloc(sizeof(*tp), GFP_KERNEL);
1505 if (tp == NULL)
1506 return;
1507 tty->driver->termios[idx] = tp;
1508 }
1509 *tp = tty->termios;
1510 }
1511 EXPORT_SYMBOL_GPL(tty_save_termios);
1512
1513 /**
1514 * tty_flush_works - flush all works of a tty/pty pair
1515 * @tty: tty device to flush works for (or either end of a pty pair)
1516 *
1517 * Sync flush all works belonging to @tty (and the 'other' tty).
1518 */
tty_flush_works(struct tty_struct * tty)1519 static void tty_flush_works(struct tty_struct *tty)
1520 {
1521 flush_work(&tty->SAK_work);
1522 flush_work(&tty->hangup_work);
1523 if (tty->link) {
1524 flush_work(&tty->link->SAK_work);
1525 flush_work(&tty->link->hangup_work);
1526 }
1527 }
1528
1529 /**
1530 * release_one_tty - release tty structure memory
1531 * @work: work of tty we are obliterating
1532 *
1533 * Releases memory associated with a tty structure, and clears out the
1534 * driver table slots. This function is called when a device is no longer
1535 * in use. It also gets called when setup of a device fails.
1536 *
1537 * Locking:
1538 * takes the file list lock internally when working on the list
1539 * of ttys that the driver keeps.
1540 *
1541 * This method gets called from a work queue so that the driver private
1542 * cleanup ops can sleep (needed for USB at least)
1543 */
release_one_tty(struct work_struct * work)1544 static void release_one_tty(struct work_struct *work)
1545 {
1546 struct tty_struct *tty =
1547 container_of(work, struct tty_struct, hangup_work);
1548 struct tty_driver *driver = tty->driver;
1549 struct module *owner = driver->owner;
1550
1551 if (tty->ops->cleanup)
1552 tty->ops->cleanup(tty);
1553
1554 tty->magic = 0;
1555 tty_driver_kref_put(driver);
1556 module_put(owner);
1557
1558 spin_lock(&tty->files_lock);
1559 list_del_init(&tty->tty_files);
1560 spin_unlock(&tty->files_lock);
1561
1562 put_pid(tty->pgrp);
1563 put_pid(tty->session);
1564 free_tty_struct(tty);
1565 }
1566
queue_release_one_tty(struct kref * kref)1567 static void queue_release_one_tty(struct kref *kref)
1568 {
1569 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1570
1571 /* The hangup queue is now free so we can reuse it rather than
1572 waste a chunk of memory for each port */
1573 INIT_WORK(&tty->hangup_work, release_one_tty);
1574 schedule_work(&tty->hangup_work);
1575 }
1576
1577 /**
1578 * tty_kref_put - release a tty kref
1579 * @tty: tty device
1580 *
1581 * Release a reference to a tty device and if need be let the kref
1582 * layer destruct the object for us
1583 */
1584
tty_kref_put(struct tty_struct * tty)1585 void tty_kref_put(struct tty_struct *tty)
1586 {
1587 if (tty)
1588 kref_put(&tty->kref, queue_release_one_tty);
1589 }
1590 EXPORT_SYMBOL(tty_kref_put);
1591
1592 /**
1593 * release_tty - release tty structure memory
1594 * @tty: tty device release
1595 * @idx: index of the tty device release
1596 *
1597 * Release both @tty and a possible linked partner (think pty pair),
1598 * and decrement the refcount of the backing module.
1599 *
1600 * Locking:
1601 * tty_mutex
1602 * takes the file list lock internally when working on the list
1603 * of ttys that the driver keeps.
1604 *
1605 */
release_tty(struct tty_struct * tty,int idx)1606 static void release_tty(struct tty_struct *tty, int idx)
1607 {
1608 /* This should always be true but check for the moment */
1609 WARN_ON(tty->index != idx);
1610 WARN_ON(!mutex_is_locked(&tty_mutex));
1611 if (tty->ops->shutdown)
1612 tty->ops->shutdown(tty);
1613 tty_save_termios(tty);
1614 tty_driver_remove_tty(tty->driver, tty);
1615 if (tty->port)
1616 tty->port->itty = NULL;
1617 if (tty->link)
1618 tty->link->port->itty = NULL;
1619 if (tty->port)
1620 tty_buffer_cancel_work(tty->port);
1621 if (tty->link)
1622 tty_buffer_cancel_work(tty->link->port);
1623
1624 tty_kref_put(tty->link);
1625 tty_kref_put(tty);
1626 }
1627
1628 /**
1629 * tty_release_checks - check a tty before real release
1630 * @tty: tty to check
1631 * @idx: index of the tty
1632 *
1633 * Performs some paranoid checking before true release of the @tty.
1634 * This is a no-op unless TTY_PARANOIA_CHECK is defined.
1635 */
tty_release_checks(struct tty_struct * tty,int idx)1636 static int tty_release_checks(struct tty_struct *tty, int idx)
1637 {
1638 #ifdef TTY_PARANOIA_CHECK
1639 if (idx < 0 || idx >= tty->driver->num) {
1640 tty_debug(tty, "bad idx %d\n", idx);
1641 return -1;
1642 }
1643
1644 /* not much to check for devpts */
1645 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1646 return 0;
1647
1648 if (tty != tty->driver->ttys[idx]) {
1649 tty_debug(tty, "bad driver table[%d] = %p\n",
1650 idx, tty->driver->ttys[idx]);
1651 return -1;
1652 }
1653 if (tty->driver->other) {
1654 struct tty_struct *o_tty = tty->link;
1655
1656 if (o_tty != tty->driver->other->ttys[idx]) {
1657 tty_debug(tty, "bad other table[%d] = %p\n",
1658 idx, tty->driver->other->ttys[idx]);
1659 return -1;
1660 }
1661 if (o_tty->link != tty) {
1662 tty_debug(tty, "bad link = %p\n", o_tty->link);
1663 return -1;
1664 }
1665 }
1666 #endif
1667 return 0;
1668 }
1669
1670 /**
1671 * tty_kclose - closes tty opened by tty_kopen
1672 * @tty: tty device
1673 *
1674 * Performs the final steps to release and free a tty device. It is the
1675 * same as tty_release_struct except that it also resets TTY_PORT_KOPENED
1676 * flag on tty->port.
1677 */
tty_kclose(struct tty_struct * tty)1678 void tty_kclose(struct tty_struct *tty)
1679 {
1680 /*
1681 * Ask the line discipline code to release its structures
1682 */
1683 tty_ldisc_release(tty);
1684
1685 /* Wait for pending work before tty destruction commmences */
1686 tty_flush_works(tty);
1687
1688 tty_debug_hangup(tty, "freeing structure\n");
1689 /*
1690 * The release_tty function takes care of the details of clearing
1691 * the slots and preserving the termios structure.
1692 */
1693 mutex_lock(&tty_mutex);
1694 tty_port_set_kopened(tty->port, 0);
1695 release_tty(tty, tty->index);
1696 mutex_unlock(&tty_mutex);
1697 }
1698 EXPORT_SYMBOL_GPL(tty_kclose);
1699
1700 /**
1701 * tty_release_struct - release a tty struct
1702 * @tty: tty device
1703 * @idx: index of the tty
1704 *
1705 * Performs the final steps to release and free a tty device. It is
1706 * roughly the reverse of tty_init_dev.
1707 */
tty_release_struct(struct tty_struct * tty,int idx)1708 void tty_release_struct(struct tty_struct *tty, int idx)
1709 {
1710 /*
1711 * Ask the line discipline code to release its structures
1712 */
1713 tty_ldisc_release(tty);
1714
1715 /* Wait for pending work before tty destruction commmences */
1716 tty_flush_works(tty);
1717
1718 tty_debug_hangup(tty, "freeing structure\n");
1719 /*
1720 * The release_tty function takes care of the details of clearing
1721 * the slots and preserving the termios structure.
1722 */
1723 mutex_lock(&tty_mutex);
1724 release_tty(tty, idx);
1725 mutex_unlock(&tty_mutex);
1726 }
1727 EXPORT_SYMBOL_GPL(tty_release_struct);
1728
1729 /**
1730 * tty_release - vfs callback for close
1731 * @inode: inode of tty
1732 * @filp: file pointer for handle to tty
1733 *
1734 * Called the last time each file handle is closed that references
1735 * this tty. There may however be several such references.
1736 *
1737 * Locking:
1738 * Takes bkl. See tty_release_dev
1739 *
1740 * Even releasing the tty structures is a tricky business.. We have
1741 * to be very careful that the structures are all released at the
1742 * same time, as interrupts might otherwise get the wrong pointers.
1743 *
1744 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1745 * lead to double frees or releasing memory still in use.
1746 */
1747
tty_release(struct inode * inode,struct file * filp)1748 int tty_release(struct inode *inode, struct file *filp)
1749 {
1750 struct tty_struct *tty = file_tty(filp);
1751 struct tty_struct *o_tty = NULL;
1752 int do_sleep, final;
1753 int idx;
1754 long timeout = 0;
1755 int once = 1;
1756
1757 if (tty_paranoia_check(tty, inode, __func__))
1758 return 0;
1759
1760 tty_lock(tty);
1761 check_tty_count(tty, __func__);
1762
1763 __tty_fasync(-1, filp, 0);
1764
1765 idx = tty->index;
1766 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1767 tty->driver->subtype == PTY_TYPE_MASTER)
1768 o_tty = tty->link;
1769
1770 if (tty_release_checks(tty, idx)) {
1771 tty_unlock(tty);
1772 return 0;
1773 }
1774
1775 tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1776
1777 if (tty->ops->close)
1778 tty->ops->close(tty, filp);
1779
1780 /* If tty is pty master, lock the slave pty (stable lock order) */
1781 tty_lock_slave(o_tty);
1782
1783 /*
1784 * Sanity check: if tty->count is going to zero, there shouldn't be
1785 * any waiters on tty->read_wait or tty->write_wait. We test the
1786 * wait queues and kick everyone out _before_ actually starting to
1787 * close. This ensures that we won't block while releasing the tty
1788 * structure.
1789 *
1790 * The test for the o_tty closing is necessary, since the master and
1791 * slave sides may close in any order. If the slave side closes out
1792 * first, its count will be one, since the master side holds an open.
1793 * Thus this test wouldn't be triggered at the time the slave closed,
1794 * so we do it now.
1795 */
1796 while (1) {
1797 do_sleep = 0;
1798
1799 if (tty->count <= 1) {
1800 if (waitqueue_active(&tty->read_wait)) {
1801 wake_up_poll(&tty->read_wait, EPOLLIN);
1802 do_sleep++;
1803 }
1804 if (waitqueue_active(&tty->write_wait)) {
1805 wake_up_poll(&tty->write_wait, EPOLLOUT);
1806 do_sleep++;
1807 }
1808 }
1809 if (o_tty && o_tty->count <= 1) {
1810 if (waitqueue_active(&o_tty->read_wait)) {
1811 wake_up_poll(&o_tty->read_wait, EPOLLIN);
1812 do_sleep++;
1813 }
1814 if (waitqueue_active(&o_tty->write_wait)) {
1815 wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1816 do_sleep++;
1817 }
1818 }
1819 if (!do_sleep)
1820 break;
1821
1822 if (once) {
1823 once = 0;
1824 tty_warn(tty, "read/write wait queue active!\n");
1825 }
1826 schedule_timeout_killable(timeout);
1827 if (timeout < 120 * HZ)
1828 timeout = 2 * timeout + 1;
1829 else
1830 timeout = MAX_SCHEDULE_TIMEOUT;
1831 }
1832
1833 if (o_tty) {
1834 if (--o_tty->count < 0) {
1835 tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1836 o_tty->count = 0;
1837 }
1838 }
1839 if (--tty->count < 0) {
1840 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1841 tty->count = 0;
1842 }
1843
1844 /*
1845 * We've decremented tty->count, so we need to remove this file
1846 * descriptor off the tty->tty_files list; this serves two
1847 * purposes:
1848 * - check_tty_count sees the correct number of file descriptors
1849 * associated with this tty.
1850 * - do_tty_hangup no longer sees this file descriptor as
1851 * something that needs to be handled for hangups.
1852 */
1853 tty_del_file(filp);
1854
1855 /*
1856 * Perform some housekeeping before deciding whether to return.
1857 *
1858 * If _either_ side is closing, make sure there aren't any
1859 * processes that still think tty or o_tty is their controlling
1860 * tty.
1861 */
1862 if (!tty->count) {
1863 read_lock(&tasklist_lock);
1864 session_clear_tty(tty->session);
1865 if (o_tty)
1866 session_clear_tty(o_tty->session);
1867 read_unlock(&tasklist_lock);
1868 }
1869
1870 /* check whether both sides are closing ... */
1871 final = !tty->count && !(o_tty && o_tty->count);
1872
1873 tty_unlock_slave(o_tty);
1874 tty_unlock(tty);
1875
1876 /* At this point, the tty->count == 0 should ensure a dead tty
1877 cannot be re-opened by a racing opener */
1878
1879 if (!final)
1880 return 0;
1881
1882 tty_debug_hangup(tty, "final close\n");
1883
1884 tty_release_struct(tty, idx);
1885 return 0;
1886 }
1887
1888 /**
1889 * tty_open_current_tty - get locked tty of current task
1890 * @device: device number
1891 * @filp: file pointer to tty
1892 * @return: locked tty of the current task iff @device is /dev/tty
1893 *
1894 * Performs a re-open of the current task's controlling tty.
1895 *
1896 * We cannot return driver and index like for the other nodes because
1897 * devpts will not work then. It expects inodes to be from devpts FS.
1898 */
tty_open_current_tty(dev_t device,struct file * filp)1899 static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1900 {
1901 struct tty_struct *tty;
1902 int retval;
1903
1904 if (device != MKDEV(TTYAUX_MAJOR, 0))
1905 return NULL;
1906
1907 tty = get_current_tty();
1908 if (!tty)
1909 return ERR_PTR(-ENXIO);
1910
1911 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1912 /* noctty = 1; */
1913 tty_lock(tty);
1914 tty_kref_put(tty); /* safe to drop the kref now */
1915
1916 retval = tty_reopen(tty);
1917 if (retval < 0) {
1918 tty_unlock(tty);
1919 tty = ERR_PTR(retval);
1920 }
1921 return tty;
1922 }
1923
1924 /**
1925 * tty_lookup_driver - lookup a tty driver for a given device file
1926 * @device: device number
1927 * @filp: file pointer to tty
1928 * @index: index for the device in the @return driver
1929 * @return: driver for this inode (with increased refcount)
1930 *
1931 * If @return is not erroneous, the caller is responsible to decrement the
1932 * refcount by tty_driver_kref_put.
1933 *
1934 * Locking: tty_mutex protects get_tty_driver
1935 */
tty_lookup_driver(dev_t device,struct file * filp,int * index)1936 static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1937 int *index)
1938 {
1939 struct tty_driver *driver = NULL;
1940
1941 switch (device) {
1942 #ifdef CONFIG_VT
1943 case MKDEV(TTY_MAJOR, 0): {
1944 extern struct tty_driver *console_driver;
1945 driver = tty_driver_kref_get(console_driver);
1946 *index = fg_console;
1947 break;
1948 }
1949 #endif
1950 case MKDEV(TTYAUX_MAJOR, 1): {
1951 struct tty_driver *console_driver = console_device(index);
1952 if (console_driver) {
1953 driver = tty_driver_kref_get(console_driver);
1954 if (driver && filp) {
1955 /* Don't let /dev/console block */
1956 filp->f_flags |= O_NONBLOCK;
1957 break;
1958 }
1959 }
1960 if (driver)
1961 tty_driver_kref_put(driver);
1962 return ERR_PTR(-ENODEV);
1963 }
1964 default:
1965 driver = get_tty_driver(device, index);
1966 if (!driver)
1967 return ERR_PTR(-ENODEV);
1968 break;
1969 }
1970 return driver;
1971 }
1972
tty_kopen(dev_t device,int shared)1973 static struct tty_struct *tty_kopen(dev_t device, int shared)
1974 {
1975 struct tty_struct *tty;
1976 struct tty_driver *driver;
1977 int index = -1;
1978
1979 mutex_lock(&tty_mutex);
1980 driver = tty_lookup_driver(device, NULL, &index);
1981 if (IS_ERR(driver)) {
1982 mutex_unlock(&tty_mutex);
1983 return ERR_CAST(driver);
1984 }
1985
1986 /* check whether we're reopening an existing tty */
1987 tty = tty_driver_lookup_tty(driver, NULL, index);
1988 if (IS_ERR(tty) || shared)
1989 goto out;
1990
1991 if (tty) {
1992 /* drop kref from tty_driver_lookup_tty() */
1993 tty_kref_put(tty);
1994 tty = ERR_PTR(-EBUSY);
1995 } else { /* tty_init_dev returns tty with the tty_lock held */
1996 tty = tty_init_dev(driver, index);
1997 if (IS_ERR(tty))
1998 goto out;
1999 tty_port_set_kopened(tty->port, 1);
2000 }
2001 out:
2002 mutex_unlock(&tty_mutex);
2003 tty_driver_kref_put(driver);
2004 return tty;
2005 }
2006
2007 /**
2008 * tty_kopen_exclusive - open a tty device for kernel
2009 * @device: dev_t of device to open
2010 *
2011 * Opens tty exclusively for kernel. Performs the driver lookup,
2012 * makes sure it's not already opened and performs the first-time
2013 * tty initialization.
2014 *
2015 * Returns the locked initialized &tty_struct
2016 *
2017 * Claims the global tty_mutex to serialize:
2018 * - concurrent first-time tty initialization
2019 * - concurrent tty driver removal w/ lookup
2020 * - concurrent tty removal from driver table
2021 */
tty_kopen_exclusive(dev_t device)2022 struct tty_struct *tty_kopen_exclusive(dev_t device)
2023 {
2024 return tty_kopen(device, 0);
2025 }
2026 EXPORT_SYMBOL_GPL(tty_kopen_exclusive);
2027
2028 /**
2029 * tty_kopen_shared - open a tty device for shared in-kernel use
2030 * @device: dev_t of device to open
2031 *
2032 * Opens an already existing tty for in-kernel use. Compared to
2033 * tty_kopen_exclusive() above it doesn't ensure to be the only user.
2034 *
2035 * Locking is identical to tty_kopen() above.
2036 */
tty_kopen_shared(dev_t device)2037 struct tty_struct *tty_kopen_shared(dev_t device)
2038 {
2039 return tty_kopen(device, 1);
2040 }
2041 EXPORT_SYMBOL_GPL(tty_kopen_shared);
2042
2043 /**
2044 * tty_open_by_driver - open a tty device
2045 * @device: dev_t of device to open
2046 * @filp: file pointer to tty
2047 *
2048 * Performs the driver lookup, checks for a reopen, or otherwise
2049 * performs the first-time tty initialization.
2050 *
2051 * Returns the locked initialized or re-opened &tty_struct
2052 *
2053 * Claims the global tty_mutex to serialize:
2054 * - concurrent first-time tty initialization
2055 * - concurrent tty driver removal w/ lookup
2056 * - concurrent tty removal from driver table
2057 */
tty_open_by_driver(dev_t device,struct file * filp)2058 static struct tty_struct *tty_open_by_driver(dev_t device,
2059 struct file *filp)
2060 {
2061 struct tty_struct *tty;
2062 struct tty_driver *driver = NULL;
2063 int index = -1;
2064 int retval;
2065
2066 mutex_lock(&tty_mutex);
2067 driver = tty_lookup_driver(device, filp, &index);
2068 if (IS_ERR(driver)) {
2069 mutex_unlock(&tty_mutex);
2070 return ERR_CAST(driver);
2071 }
2072
2073 /* check whether we're reopening an existing tty */
2074 tty = tty_driver_lookup_tty(driver, filp, index);
2075 if (IS_ERR(tty)) {
2076 mutex_unlock(&tty_mutex);
2077 goto out;
2078 }
2079
2080 if (tty) {
2081 if (tty_port_kopened(tty->port)) {
2082 tty_kref_put(tty);
2083 mutex_unlock(&tty_mutex);
2084 tty = ERR_PTR(-EBUSY);
2085 goto out;
2086 }
2087 mutex_unlock(&tty_mutex);
2088 retval = tty_lock_interruptible(tty);
2089 tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
2090 if (retval) {
2091 if (retval == -EINTR)
2092 retval = -ERESTARTSYS;
2093 tty = ERR_PTR(retval);
2094 goto out;
2095 }
2096 retval = tty_reopen(tty);
2097 if (retval < 0) {
2098 tty_unlock(tty);
2099 tty = ERR_PTR(retval);
2100 }
2101 } else { /* Returns with the tty_lock held for now */
2102 tty = tty_init_dev(driver, index);
2103 mutex_unlock(&tty_mutex);
2104 }
2105 out:
2106 tty_driver_kref_put(driver);
2107 return tty;
2108 }
2109
2110 /**
2111 * tty_open - open a tty device
2112 * @inode: inode of device file
2113 * @filp: file pointer to tty
2114 *
2115 * tty_open and tty_release keep up the tty count that contains the
2116 * number of opens done on a tty. We cannot use the inode-count, as
2117 * different inodes might point to the same tty.
2118 *
2119 * Open-counting is needed for pty masters, as well as for keeping
2120 * track of serial lines: DTR is dropped when the last close happens.
2121 * (This is not done solely through tty->count, now. - Ted 1/27/92)
2122 *
2123 * The termios state of a pty is reset on first open so that
2124 * settings don't persist across reuse.
2125 *
2126 * Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2127 * tty->count should protect the rest.
2128 * ->siglock protects ->signal/->sighand
2129 *
2130 * Note: the tty_unlock/lock cases without a ref are only safe due to
2131 * tty_mutex
2132 */
2133
tty_open(struct inode * inode,struct file * filp)2134 static int tty_open(struct inode *inode, struct file *filp)
2135 {
2136 struct tty_struct *tty;
2137 int noctty, retval;
2138 dev_t device = inode->i_rdev;
2139 unsigned saved_flags = filp->f_flags;
2140
2141 nonseekable_open(inode, filp);
2142
2143 retry_open:
2144 retval = tty_alloc_file(filp);
2145 if (retval)
2146 return -ENOMEM;
2147
2148 tty = tty_open_current_tty(device, filp);
2149 if (!tty)
2150 tty = tty_open_by_driver(device, filp);
2151
2152 if (IS_ERR(tty)) {
2153 tty_free_file(filp);
2154 retval = PTR_ERR(tty);
2155 if (retval != -EAGAIN || signal_pending(current))
2156 return retval;
2157 schedule();
2158 goto retry_open;
2159 }
2160
2161 tty_add_file(tty, filp);
2162
2163 check_tty_count(tty, __func__);
2164 tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2165
2166 if (tty->ops->open)
2167 retval = tty->ops->open(tty, filp);
2168 else
2169 retval = -ENODEV;
2170 filp->f_flags = saved_flags;
2171
2172 if (retval) {
2173 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2174
2175 tty_unlock(tty); /* need to call tty_release without BTM */
2176 tty_release(inode, filp);
2177 if (retval != -ERESTARTSYS)
2178 return retval;
2179
2180 if (signal_pending(current))
2181 return retval;
2182
2183 schedule();
2184 /*
2185 * Need to reset f_op in case a hangup happened.
2186 */
2187 if (tty_hung_up_p(filp))
2188 filp->f_op = &tty_fops;
2189 goto retry_open;
2190 }
2191 clear_bit(TTY_HUPPED, &tty->flags);
2192
2193 noctty = (filp->f_flags & O_NOCTTY) ||
2194 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2195 device == MKDEV(TTYAUX_MAJOR, 1) ||
2196 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2197 tty->driver->subtype == PTY_TYPE_MASTER);
2198 if (!noctty)
2199 tty_open_proc_set_tty(filp, tty);
2200 tty_unlock(tty);
2201 return 0;
2202 }
2203
2204
2205
2206 /**
2207 * tty_poll - check tty status
2208 * @filp: file being polled
2209 * @wait: poll wait structures to update
2210 *
2211 * Call the line discipline polling method to obtain the poll
2212 * status of the device.
2213 *
2214 * Locking: locks called line discipline but ldisc poll method
2215 * may be re-entered freely by other callers.
2216 */
2217
tty_poll(struct file * filp,poll_table * wait)2218 static __poll_t tty_poll(struct file *filp, poll_table *wait)
2219 {
2220 struct tty_struct *tty = file_tty(filp);
2221 struct tty_ldisc *ld;
2222 __poll_t ret = 0;
2223
2224 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2225 return 0;
2226
2227 ld = tty_ldisc_ref_wait(tty);
2228 if (!ld)
2229 return hung_up_tty_poll(filp, wait);
2230 if (ld->ops->poll)
2231 ret = ld->ops->poll(tty, filp, wait);
2232 tty_ldisc_deref(ld);
2233 return ret;
2234 }
2235
__tty_fasync(int fd,struct file * filp,int on)2236 static int __tty_fasync(int fd, struct file *filp, int on)
2237 {
2238 struct tty_struct *tty = file_tty(filp);
2239 unsigned long flags;
2240 int retval = 0;
2241
2242 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2243 goto out;
2244
2245 retval = fasync_helper(fd, filp, on, &tty->fasync);
2246 if (retval <= 0)
2247 goto out;
2248
2249 if (on) {
2250 enum pid_type type;
2251 struct pid *pid;
2252
2253 spin_lock_irqsave(&tty->ctrl_lock, flags);
2254 if (tty->pgrp) {
2255 pid = tty->pgrp;
2256 type = PIDTYPE_PGID;
2257 } else {
2258 pid = task_pid(current);
2259 type = PIDTYPE_TGID;
2260 }
2261 get_pid(pid);
2262 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2263 __f_setown(filp, pid, type, 0);
2264 put_pid(pid);
2265 retval = 0;
2266 }
2267 out:
2268 return retval;
2269 }
2270
tty_fasync(int fd,struct file * filp,int on)2271 static int tty_fasync(int fd, struct file *filp, int on)
2272 {
2273 struct tty_struct *tty = file_tty(filp);
2274 int retval = -ENOTTY;
2275
2276 tty_lock(tty);
2277 if (!tty_hung_up_p(filp))
2278 retval = __tty_fasync(fd, filp, on);
2279 tty_unlock(tty);
2280
2281 return retval;
2282 }
2283
2284 /**
2285 * tiocsti - fake input character
2286 * @tty: tty to fake input into
2287 * @p: pointer to character
2288 *
2289 * Fake input to a tty device. Does the necessary locking and
2290 * input management.
2291 *
2292 * FIXME: does not honour flow control ??
2293 *
2294 * Locking:
2295 * Called functions take tty_ldiscs_lock
2296 * current->signal->tty check is safe without locks
2297 *
2298 * FIXME: may race normal receive processing
2299 */
2300
tiocsti(struct tty_struct * tty,char __user * p)2301 static int tiocsti(struct tty_struct *tty, char __user *p)
2302 {
2303 char ch, mbz = 0;
2304 struct tty_ldisc *ld;
2305
2306 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2307 return -EPERM;
2308 if (get_user(ch, p))
2309 return -EFAULT;
2310 tty_audit_tiocsti(tty, ch);
2311 ld = tty_ldisc_ref_wait(tty);
2312 if (!ld)
2313 return -EIO;
2314 if (ld->ops->receive_buf)
2315 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2316 tty_ldisc_deref(ld);
2317 return 0;
2318 }
2319
2320 /**
2321 * tiocgwinsz - implement window query ioctl
2322 * @tty: tty
2323 * @arg: user buffer for result
2324 *
2325 * Copies the kernel idea of the window size into the user buffer.
2326 *
2327 * Locking: tty->winsize_mutex is taken to ensure the winsize data
2328 * is consistent.
2329 */
2330
tiocgwinsz(struct tty_struct * tty,struct winsize __user * arg)2331 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2332 {
2333 int err;
2334
2335 mutex_lock(&tty->winsize_mutex);
2336 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2337 mutex_unlock(&tty->winsize_mutex);
2338
2339 return err ? -EFAULT: 0;
2340 }
2341
2342 /**
2343 * tty_do_resize - resize event
2344 * @tty: tty being resized
2345 * @ws: new dimensions
2346 *
2347 * Update the termios variables and send the necessary signals to
2348 * peform a terminal resize correctly
2349 */
2350
tty_do_resize(struct tty_struct * tty,struct winsize * ws)2351 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2352 {
2353 struct pid *pgrp;
2354
2355 /* Lock the tty */
2356 mutex_lock(&tty->winsize_mutex);
2357 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2358 goto done;
2359
2360 /* Signal the foreground process group */
2361 pgrp = tty_get_pgrp(tty);
2362 if (pgrp)
2363 kill_pgrp(pgrp, SIGWINCH, 1);
2364 put_pid(pgrp);
2365
2366 tty->winsize = *ws;
2367 done:
2368 mutex_unlock(&tty->winsize_mutex);
2369 return 0;
2370 }
2371 EXPORT_SYMBOL(tty_do_resize);
2372
2373 /**
2374 * tiocswinsz - implement window size set ioctl
2375 * @tty: tty side of tty
2376 * @arg: user buffer for result
2377 *
2378 * Copies the user idea of the window size to the kernel. Traditionally
2379 * this is just advisory information but for the Linux console it
2380 * actually has driver level meaning and triggers a VC resize.
2381 *
2382 * Locking:
2383 * Driver dependent. The default do_resize method takes the
2384 * tty termios mutex and ctrl_lock. The console takes its own lock
2385 * then calls into the default method.
2386 */
2387
tiocswinsz(struct tty_struct * tty,struct winsize __user * arg)2388 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2389 {
2390 struct winsize tmp_ws;
2391 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2392 return -EFAULT;
2393
2394 if (tty->ops->resize)
2395 return tty->ops->resize(tty, &tmp_ws);
2396 else
2397 return tty_do_resize(tty, &tmp_ws);
2398 }
2399
2400 /**
2401 * tioccons - allow admin to move logical console
2402 * @file: the file to become console
2403 *
2404 * Allow the administrator to move the redirected console device
2405 *
2406 * Locking: uses redirect_lock to guard the redirect information
2407 */
2408
tioccons(struct file * file)2409 static int tioccons(struct file *file)
2410 {
2411 if (!capable(CAP_SYS_ADMIN))
2412 return -EPERM;
2413 if (file->f_op->write_iter == redirected_tty_write) {
2414 struct file *f;
2415 spin_lock(&redirect_lock);
2416 f = redirect;
2417 redirect = NULL;
2418 spin_unlock(&redirect_lock);
2419 if (f)
2420 fput(f);
2421 return 0;
2422 }
2423 if (file->f_op->write_iter != tty_write)
2424 return -ENOTTY;
2425 if (!(file->f_mode & FMODE_WRITE))
2426 return -EBADF;
2427 if (!(file->f_mode & FMODE_CAN_WRITE))
2428 return -EINVAL;
2429 spin_lock(&redirect_lock);
2430 if (redirect) {
2431 spin_unlock(&redirect_lock);
2432 return -EBUSY;
2433 }
2434 redirect = get_file(file);
2435 spin_unlock(&redirect_lock);
2436 return 0;
2437 }
2438
2439 /**
2440 * tiocsetd - set line discipline
2441 * @tty: tty device
2442 * @p: pointer to user data
2443 *
2444 * Set the line discipline according to user request.
2445 *
2446 * Locking: see tty_set_ldisc, this function is just a helper
2447 */
2448
tiocsetd(struct tty_struct * tty,int __user * p)2449 static int tiocsetd(struct tty_struct *tty, int __user *p)
2450 {
2451 int disc;
2452 int ret;
2453
2454 if (get_user(disc, p))
2455 return -EFAULT;
2456
2457 ret = tty_set_ldisc(tty, disc);
2458
2459 return ret;
2460 }
2461
2462 /**
2463 * tiocgetd - get line discipline
2464 * @tty: tty device
2465 * @p: pointer to user data
2466 *
2467 * Retrieves the line discipline id directly from the ldisc.
2468 *
2469 * Locking: waits for ldisc reference (in case the line discipline
2470 * is changing or the tty is being hungup)
2471 */
2472
tiocgetd(struct tty_struct * tty,int __user * p)2473 static int tiocgetd(struct tty_struct *tty, int __user *p)
2474 {
2475 struct tty_ldisc *ld;
2476 int ret;
2477
2478 ld = tty_ldisc_ref_wait(tty);
2479 if (!ld)
2480 return -EIO;
2481 ret = put_user(ld->ops->num, p);
2482 tty_ldisc_deref(ld);
2483 return ret;
2484 }
2485
2486 /**
2487 * send_break - performed time break
2488 * @tty: device to break on
2489 * @duration: timeout in mS
2490 *
2491 * Perform a timed break on hardware that lacks its own driver level
2492 * timed break functionality.
2493 *
2494 * Locking:
2495 * atomic_write_lock serializes
2496 *
2497 */
2498
send_break(struct tty_struct * tty,unsigned int duration)2499 static int send_break(struct tty_struct *tty, unsigned int duration)
2500 {
2501 int retval;
2502
2503 if (tty->ops->break_ctl == NULL)
2504 return 0;
2505
2506 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2507 retval = tty->ops->break_ctl(tty, duration);
2508 else {
2509 /* Do the work ourselves */
2510 if (tty_write_lock(tty, 0) < 0)
2511 return -EINTR;
2512 retval = tty->ops->break_ctl(tty, -1);
2513 if (retval)
2514 goto out;
2515 if (!signal_pending(current))
2516 msleep_interruptible(duration);
2517 retval = tty->ops->break_ctl(tty, 0);
2518 out:
2519 tty_write_unlock(tty);
2520 if (signal_pending(current))
2521 retval = -EINTR;
2522 }
2523 return retval;
2524 }
2525
2526 /**
2527 * tty_tiocmget - get modem status
2528 * @tty: tty device
2529 * @p: pointer to result
2530 *
2531 * Obtain the modem status bits from the tty driver if the feature
2532 * is supported. Return -ENOTTY if it is not available.
2533 *
2534 * Locking: none (up to the driver)
2535 */
2536
tty_tiocmget(struct tty_struct * tty,int __user * p)2537 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2538 {
2539 int retval = -ENOTTY;
2540
2541 if (tty->ops->tiocmget) {
2542 retval = tty->ops->tiocmget(tty);
2543
2544 if (retval >= 0)
2545 retval = put_user(retval, p);
2546 }
2547 return retval;
2548 }
2549
2550 /**
2551 * tty_tiocmset - set modem status
2552 * @tty: tty device
2553 * @cmd: command - clear bits, set bits or set all
2554 * @p: pointer to desired bits
2555 *
2556 * Set the modem status bits from the tty driver if the feature
2557 * is supported. Return -ENOTTY if it is not available.
2558 *
2559 * Locking: none (up to the driver)
2560 */
2561
tty_tiocmset(struct tty_struct * tty,unsigned int cmd,unsigned __user * p)2562 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2563 unsigned __user *p)
2564 {
2565 int retval;
2566 unsigned int set, clear, val;
2567
2568 if (tty->ops->tiocmset == NULL)
2569 return -ENOTTY;
2570
2571 retval = get_user(val, p);
2572 if (retval)
2573 return retval;
2574 set = clear = 0;
2575 switch (cmd) {
2576 case TIOCMBIS:
2577 set = val;
2578 break;
2579 case TIOCMBIC:
2580 clear = val;
2581 break;
2582 case TIOCMSET:
2583 set = val;
2584 clear = ~val;
2585 break;
2586 }
2587 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2588 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2589 return tty->ops->tiocmset(tty, set, clear);
2590 }
2591
2592 /**
2593 * tty_get_icount - get tty statistics
2594 * @tty: tty device
2595 * @icount: output parameter
2596 *
2597 * Gets a copy of the tty's icount statistics.
2598 *
2599 * Locking: none (up to the driver)
2600 */
tty_get_icount(struct tty_struct * tty,struct serial_icounter_struct * icount)2601 int tty_get_icount(struct tty_struct *tty,
2602 struct serial_icounter_struct *icount)
2603 {
2604 memset(icount, 0, sizeof(*icount));
2605
2606 if (tty->ops->get_icount)
2607 return tty->ops->get_icount(tty, icount);
2608 else
2609 return -ENOTTY;
2610 }
2611 EXPORT_SYMBOL_GPL(tty_get_icount);
2612
tty_tiocgicount(struct tty_struct * tty,void __user * arg)2613 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2614 {
2615 struct serial_icounter_struct icount;
2616 int retval;
2617
2618 retval = tty_get_icount(tty, &icount);
2619 if (retval != 0)
2620 return retval;
2621
2622 if (copy_to_user(arg, &icount, sizeof(icount)))
2623 return -EFAULT;
2624 return 0;
2625 }
2626
tty_set_serial(struct tty_struct * tty,struct serial_struct * ss)2627 static int tty_set_serial(struct tty_struct *tty, struct serial_struct *ss)
2628 {
2629 char comm[TASK_COMM_LEN];
2630 int flags;
2631
2632 flags = ss->flags & ASYNC_DEPRECATED;
2633
2634 if (flags)
2635 pr_warn_ratelimited("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2636 __func__, get_task_comm(comm, current), flags);
2637
2638 if (!tty->ops->set_serial)
2639 return -ENOTTY;
2640
2641 return tty->ops->set_serial(tty, ss);
2642 }
2643
tty_tiocsserial(struct tty_struct * tty,struct serial_struct __user * ss)2644 static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
2645 {
2646 struct serial_struct v;
2647
2648 if (copy_from_user(&v, ss, sizeof(*ss)))
2649 return -EFAULT;
2650
2651 return tty_set_serial(tty, &v);
2652 }
2653
tty_tiocgserial(struct tty_struct * tty,struct serial_struct __user * ss)2654 static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2655 {
2656 struct serial_struct v;
2657 int err;
2658
2659 memset(&v, 0, sizeof(v));
2660 if (!tty->ops->get_serial)
2661 return -ENOTTY;
2662 err = tty->ops->get_serial(tty, &v);
2663 if (!err && copy_to_user(ss, &v, sizeof(v)))
2664 err = -EFAULT;
2665 return err;
2666 }
2667
2668 /*
2669 * if pty, return the slave side (real_tty)
2670 * otherwise, return self
2671 */
tty_pair_get_tty(struct tty_struct * tty)2672 static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2673 {
2674 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2675 tty->driver->subtype == PTY_TYPE_MASTER)
2676 tty = tty->link;
2677 return tty;
2678 }
2679
2680 /*
2681 * Split this up, as gcc can choke on it otherwise..
2682 */
tty_ioctl(struct file * file,unsigned int cmd,unsigned long arg)2683 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2684 {
2685 struct tty_struct *tty = file_tty(file);
2686 struct tty_struct *real_tty;
2687 void __user *p = (void __user *)arg;
2688 int retval;
2689 struct tty_ldisc *ld;
2690
2691 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2692 return -EINVAL;
2693
2694 real_tty = tty_pair_get_tty(tty);
2695
2696 /*
2697 * Factor out some common prep work
2698 */
2699 switch (cmd) {
2700 case TIOCSETD:
2701 case TIOCSBRK:
2702 case TIOCCBRK:
2703 case TCSBRK:
2704 case TCSBRKP:
2705 retval = tty_check_change(tty);
2706 if (retval)
2707 return retval;
2708 if (cmd != TIOCCBRK) {
2709 tty_wait_until_sent(tty, 0);
2710 if (signal_pending(current))
2711 return -EINTR;
2712 }
2713 break;
2714 }
2715
2716 /*
2717 * Now do the stuff.
2718 */
2719 switch (cmd) {
2720 case TIOCSTI:
2721 return tiocsti(tty, p);
2722 case TIOCGWINSZ:
2723 return tiocgwinsz(real_tty, p);
2724 case TIOCSWINSZ:
2725 return tiocswinsz(real_tty, p);
2726 case TIOCCONS:
2727 return real_tty != tty ? -EINVAL : tioccons(file);
2728 case TIOCEXCL:
2729 set_bit(TTY_EXCLUSIVE, &tty->flags);
2730 return 0;
2731 case TIOCNXCL:
2732 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2733 return 0;
2734 case TIOCGEXCL:
2735 {
2736 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2737 return put_user(excl, (int __user *)p);
2738 }
2739 case TIOCGETD:
2740 return tiocgetd(tty, p);
2741 case TIOCSETD:
2742 return tiocsetd(tty, p);
2743 case TIOCVHANGUP:
2744 if (!capable(CAP_SYS_ADMIN))
2745 return -EPERM;
2746 tty_vhangup(tty);
2747 return 0;
2748 case TIOCGDEV:
2749 {
2750 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2751 return put_user(ret, (unsigned int __user *)p);
2752 }
2753 /*
2754 * Break handling
2755 */
2756 case TIOCSBRK: /* Turn break on, unconditionally */
2757 if (tty->ops->break_ctl)
2758 return tty->ops->break_ctl(tty, -1);
2759 return 0;
2760 case TIOCCBRK: /* Turn break off, unconditionally */
2761 if (tty->ops->break_ctl)
2762 return tty->ops->break_ctl(tty, 0);
2763 return 0;
2764 case TCSBRK: /* SVID version: non-zero arg --> no break */
2765 /* non-zero arg means wait for all output data
2766 * to be sent (performed above) but don't send break.
2767 * This is used by the tcdrain() termios function.
2768 */
2769 if (!arg)
2770 return send_break(tty, 250);
2771 return 0;
2772 case TCSBRKP: /* support for POSIX tcsendbreak() */
2773 return send_break(tty, arg ? arg*100 : 250);
2774
2775 case TIOCMGET:
2776 return tty_tiocmget(tty, p);
2777 case TIOCMSET:
2778 case TIOCMBIC:
2779 case TIOCMBIS:
2780 return tty_tiocmset(tty, cmd, p);
2781 case TIOCGICOUNT:
2782 return tty_tiocgicount(tty, p);
2783 case TCFLSH:
2784 switch (arg) {
2785 case TCIFLUSH:
2786 case TCIOFLUSH:
2787 /* flush tty buffer and allow ldisc to process ioctl */
2788 tty_buffer_flush(tty, NULL);
2789 break;
2790 }
2791 break;
2792 case TIOCSSERIAL:
2793 return tty_tiocsserial(tty, p);
2794 case TIOCGSERIAL:
2795 return tty_tiocgserial(tty, p);
2796 case TIOCGPTPEER:
2797 /* Special because the struct file is needed */
2798 return ptm_open_peer(file, tty, (int)arg);
2799 default:
2800 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2801 if (retval != -ENOIOCTLCMD)
2802 return retval;
2803 }
2804 if (tty->ops->ioctl) {
2805 retval = tty->ops->ioctl(tty, cmd, arg);
2806 if (retval != -ENOIOCTLCMD)
2807 return retval;
2808 }
2809 ld = tty_ldisc_ref_wait(tty);
2810 if (!ld)
2811 return hung_up_tty_ioctl(file, cmd, arg);
2812 retval = -EINVAL;
2813 if (ld->ops->ioctl) {
2814 retval = ld->ops->ioctl(tty, file, cmd, arg);
2815 if (retval == -ENOIOCTLCMD)
2816 retval = -ENOTTY;
2817 }
2818 tty_ldisc_deref(ld);
2819 return retval;
2820 }
2821
2822 #ifdef CONFIG_COMPAT
2823
2824 struct serial_struct32 {
2825 compat_int_t type;
2826 compat_int_t line;
2827 compat_uint_t port;
2828 compat_int_t irq;
2829 compat_int_t flags;
2830 compat_int_t xmit_fifo_size;
2831 compat_int_t custom_divisor;
2832 compat_int_t baud_base;
2833 unsigned short close_delay;
2834 char io_type;
2835 char reserved_char;
2836 compat_int_t hub6;
2837 unsigned short closing_wait; /* time to wait before closing */
2838 unsigned short closing_wait2; /* no longer used... */
2839 compat_uint_t iomem_base;
2840 unsigned short iomem_reg_shift;
2841 unsigned int port_high;
2842 /* compat_ulong_t iomap_base FIXME */
2843 compat_int_t reserved;
2844 };
2845
compat_tty_tiocsserial(struct tty_struct * tty,struct serial_struct32 __user * ss)2846 static int compat_tty_tiocsserial(struct tty_struct *tty,
2847 struct serial_struct32 __user *ss)
2848 {
2849 struct serial_struct32 v32;
2850 struct serial_struct v;
2851
2852 if (copy_from_user(&v32, ss, sizeof(*ss)))
2853 return -EFAULT;
2854
2855 memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2856 v.iomem_base = compat_ptr(v32.iomem_base);
2857 v.iomem_reg_shift = v32.iomem_reg_shift;
2858 v.port_high = v32.port_high;
2859 v.iomap_base = 0;
2860
2861 return tty_set_serial(tty, &v);
2862 }
2863
compat_tty_tiocgserial(struct tty_struct * tty,struct serial_struct32 __user * ss)2864 static int compat_tty_tiocgserial(struct tty_struct *tty,
2865 struct serial_struct32 __user *ss)
2866 {
2867 struct serial_struct32 v32;
2868 struct serial_struct v;
2869 int err;
2870
2871 memset(&v, 0, sizeof(v));
2872 memset(&v32, 0, sizeof(v32));
2873
2874 if (!tty->ops->get_serial)
2875 return -ENOTTY;
2876 err = tty->ops->get_serial(tty, &v);
2877 if (!err) {
2878 memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2879 v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2880 0xfffffff : ptr_to_compat(v.iomem_base);
2881 v32.iomem_reg_shift = v.iomem_reg_shift;
2882 v32.port_high = v.port_high;
2883 if (copy_to_user(ss, &v32, sizeof(v32)))
2884 err = -EFAULT;
2885 }
2886 return err;
2887 }
tty_compat_ioctl(struct file * file,unsigned int cmd,unsigned long arg)2888 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2889 unsigned long arg)
2890 {
2891 struct tty_struct *tty = file_tty(file);
2892 struct tty_ldisc *ld;
2893 int retval = -ENOIOCTLCMD;
2894
2895 switch (cmd) {
2896 case TIOCOUTQ:
2897 case TIOCSTI:
2898 case TIOCGWINSZ:
2899 case TIOCSWINSZ:
2900 case TIOCGEXCL:
2901 case TIOCGETD:
2902 case TIOCSETD:
2903 case TIOCGDEV:
2904 case TIOCMGET:
2905 case TIOCMSET:
2906 case TIOCMBIC:
2907 case TIOCMBIS:
2908 case TIOCGICOUNT:
2909 case TIOCGPGRP:
2910 case TIOCSPGRP:
2911 case TIOCGSID:
2912 case TIOCSERGETLSR:
2913 case TIOCGRS485:
2914 case TIOCSRS485:
2915 #ifdef TIOCGETP
2916 case TIOCGETP:
2917 case TIOCSETP:
2918 case TIOCSETN:
2919 #endif
2920 #ifdef TIOCGETC
2921 case TIOCGETC:
2922 case TIOCSETC:
2923 #endif
2924 #ifdef TIOCGLTC
2925 case TIOCGLTC:
2926 case TIOCSLTC:
2927 #endif
2928 case TCSETSF:
2929 case TCSETSW:
2930 case TCSETS:
2931 case TCGETS:
2932 #ifdef TCGETS2
2933 case TCGETS2:
2934 case TCSETSF2:
2935 case TCSETSW2:
2936 case TCSETS2:
2937 #endif
2938 case TCGETA:
2939 case TCSETAF:
2940 case TCSETAW:
2941 case TCSETA:
2942 case TIOCGLCKTRMIOS:
2943 case TIOCSLCKTRMIOS:
2944 #ifdef TCGETX
2945 case TCGETX:
2946 case TCSETX:
2947 case TCSETXW:
2948 case TCSETXF:
2949 #endif
2950 case TIOCGSOFTCAR:
2951 case TIOCSSOFTCAR:
2952
2953 case PPPIOCGCHAN:
2954 case PPPIOCGUNIT:
2955 return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
2956 case TIOCCONS:
2957 case TIOCEXCL:
2958 case TIOCNXCL:
2959 case TIOCVHANGUP:
2960 case TIOCSBRK:
2961 case TIOCCBRK:
2962 case TCSBRK:
2963 case TCSBRKP:
2964 case TCFLSH:
2965 case TIOCGPTPEER:
2966 case TIOCNOTTY:
2967 case TIOCSCTTY:
2968 case TCXONC:
2969 case TIOCMIWAIT:
2970 case TIOCSERCONFIG:
2971 return tty_ioctl(file, cmd, arg);
2972 }
2973
2974 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2975 return -EINVAL;
2976
2977 switch (cmd) {
2978 case TIOCSSERIAL:
2979 return compat_tty_tiocsserial(tty, compat_ptr(arg));
2980 case TIOCGSERIAL:
2981 return compat_tty_tiocgserial(tty, compat_ptr(arg));
2982 }
2983 if (tty->ops->compat_ioctl) {
2984 retval = tty->ops->compat_ioctl(tty, cmd, arg);
2985 if (retval != -ENOIOCTLCMD)
2986 return retval;
2987 }
2988
2989 ld = tty_ldisc_ref_wait(tty);
2990 if (!ld)
2991 return hung_up_tty_compat_ioctl(file, cmd, arg);
2992 if (ld->ops->compat_ioctl)
2993 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2994 if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2995 retval = ld->ops->ioctl(tty, file,
2996 (unsigned long)compat_ptr(cmd), arg);
2997 tty_ldisc_deref(ld);
2998
2999 return retval;
3000 }
3001 #endif
3002
this_tty(const void * t,struct file * file,unsigned fd)3003 static int this_tty(const void *t, struct file *file, unsigned fd)
3004 {
3005 if (likely(file->f_op->read_iter != tty_read))
3006 return 0;
3007 return file_tty(file) != t ? 0 : fd + 1;
3008 }
3009
3010 /*
3011 * This implements the "Secure Attention Key" --- the idea is to
3012 * prevent trojan horses by killing all processes associated with this
3013 * tty when the user hits the "Secure Attention Key". Required for
3014 * super-paranoid applications --- see the Orange Book for more details.
3015 *
3016 * This code could be nicer; ideally it should send a HUP, wait a few
3017 * seconds, then send a INT, and then a KILL signal. But you then
3018 * have to coordinate with the init process, since all processes associated
3019 * with the current tty must be dead before the new getty is allowed
3020 * to spawn.
3021 *
3022 * Now, if it would be correct ;-/ The current code has a nasty hole -
3023 * it doesn't catch files in flight. We may send the descriptor to ourselves
3024 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
3025 *
3026 * Nasty bug: do_SAK is being called in interrupt context. This can
3027 * deadlock. We punt it up to process context. AKPM - 16Mar2001
3028 */
__do_SAK(struct tty_struct * tty)3029 void __do_SAK(struct tty_struct *tty)
3030 {
3031 #ifdef TTY_SOFT_SAK
3032 tty_hangup(tty);
3033 #else
3034 struct task_struct *g, *p;
3035 struct pid *session;
3036 int i;
3037 unsigned long flags;
3038
3039 if (!tty)
3040 return;
3041
3042 spin_lock_irqsave(&tty->ctrl_lock, flags);
3043 session = get_pid(tty->session);
3044 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3045
3046 tty_ldisc_flush(tty);
3047
3048 tty_driver_flush_buffer(tty);
3049
3050 read_lock(&tasklist_lock);
3051 /* Kill the entire session */
3052 do_each_pid_task(session, PIDTYPE_SID, p) {
3053 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
3054 task_pid_nr(p), p->comm);
3055 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
3056 } while_each_pid_task(session, PIDTYPE_SID, p);
3057
3058 /* Now kill any processes that happen to have the tty open */
3059 do_each_thread(g, p) {
3060 if (p->signal->tty == tty) {
3061 tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
3062 task_pid_nr(p), p->comm);
3063 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
3064 continue;
3065 }
3066 task_lock(p);
3067 i = iterate_fd(p->files, 0, this_tty, tty);
3068 if (i != 0) {
3069 tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
3070 task_pid_nr(p), p->comm, i - 1);
3071 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
3072 }
3073 task_unlock(p);
3074 } while_each_thread(g, p);
3075 read_unlock(&tasklist_lock);
3076 put_pid(session);
3077 #endif
3078 }
3079
do_SAK_work(struct work_struct * work)3080 static void do_SAK_work(struct work_struct *work)
3081 {
3082 struct tty_struct *tty =
3083 container_of(work, struct tty_struct, SAK_work);
3084 __do_SAK(tty);
3085 }
3086
3087 /*
3088 * The tq handling here is a little racy - tty->SAK_work may already be queued.
3089 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3090 * the values which we write to it will be identical to the values which it
3091 * already has. --akpm
3092 */
do_SAK(struct tty_struct * tty)3093 void do_SAK(struct tty_struct *tty)
3094 {
3095 if (!tty)
3096 return;
3097 schedule_work(&tty->SAK_work);
3098 }
3099
3100 EXPORT_SYMBOL(do_SAK);
3101
3102 /* Must put_device() after it's unused! */
tty_get_device(struct tty_struct * tty)3103 static struct device *tty_get_device(struct tty_struct *tty)
3104 {
3105 dev_t devt = tty_devnum(tty);
3106 return class_find_device_by_devt(tty_class, devt);
3107 }
3108
3109
3110 /*
3111 * alloc_tty_struct
3112 *
3113 * This subroutine allocates and initializes a tty structure.
3114 *
3115 * Locking: none - tty in question is not exposed at this point
3116 */
3117
alloc_tty_struct(struct tty_driver * driver,int idx)3118 struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
3119 {
3120 struct tty_struct *tty;
3121
3122 tty = kzalloc(sizeof(*tty), GFP_KERNEL);
3123 if (!tty)
3124 return NULL;
3125
3126 kref_init(&tty->kref);
3127 tty->magic = TTY_MAGIC;
3128 if (tty_ldisc_init(tty)) {
3129 kfree(tty);
3130 return NULL;
3131 }
3132 tty->session = NULL;
3133 tty->pgrp = NULL;
3134 mutex_init(&tty->legacy_mutex);
3135 mutex_init(&tty->throttle_mutex);
3136 init_rwsem(&tty->termios_rwsem);
3137 mutex_init(&tty->winsize_mutex);
3138 init_ldsem(&tty->ldisc_sem);
3139 init_waitqueue_head(&tty->write_wait);
3140 init_waitqueue_head(&tty->read_wait);
3141 INIT_WORK(&tty->hangup_work, do_tty_hangup);
3142 mutex_init(&tty->atomic_write_lock);
3143 spin_lock_init(&tty->ctrl_lock);
3144 spin_lock_init(&tty->flow_lock);
3145 spin_lock_init(&tty->files_lock);
3146 INIT_LIST_HEAD(&tty->tty_files);
3147 INIT_WORK(&tty->SAK_work, do_SAK_work);
3148
3149 tty->driver = driver;
3150 tty->ops = driver->ops;
3151 tty->index = idx;
3152 tty_line_name(driver, idx, tty->name);
3153 tty->dev = tty_get_device(tty);
3154
3155 return tty;
3156 }
3157
3158 /**
3159 * tty_put_char - write one character to a tty
3160 * @tty: tty
3161 * @ch: character
3162 *
3163 * Write one byte to the tty using the provided put_char method
3164 * if present. Returns the number of characters successfully output.
3165 *
3166 * Note: the specific put_char operation in the driver layer may go
3167 * away soon. Don't call it directly, use this method
3168 */
3169
tty_put_char(struct tty_struct * tty,unsigned char ch)3170 int tty_put_char(struct tty_struct *tty, unsigned char ch)
3171 {
3172 if (tty->ops->put_char)
3173 return tty->ops->put_char(tty, ch);
3174 return tty->ops->write(tty, &ch, 1);
3175 }
3176 EXPORT_SYMBOL_GPL(tty_put_char);
3177
3178 struct class *tty_class;
3179
tty_cdev_add(struct tty_driver * driver,dev_t dev,unsigned int index,unsigned int count)3180 static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3181 unsigned int index, unsigned int count)
3182 {
3183 int err;
3184
3185 /* init here, since reused cdevs cause crashes */
3186 driver->cdevs[index] = cdev_alloc();
3187 if (!driver->cdevs[index])
3188 return -ENOMEM;
3189 driver->cdevs[index]->ops = &tty_fops;
3190 driver->cdevs[index]->owner = driver->owner;
3191 err = cdev_add(driver->cdevs[index], dev, count);
3192 if (err)
3193 kobject_put(&driver->cdevs[index]->kobj);
3194 return err;
3195 }
3196
3197 /**
3198 * tty_register_device - register a tty device
3199 * @driver: the tty driver that describes the tty device
3200 * @index: the index in the tty driver for this tty device
3201 * @device: a struct device that is associated with this tty device.
3202 * This field is optional, if there is no known struct device
3203 * for this tty device it can be set to NULL safely.
3204 *
3205 * Returns a pointer to the struct device for this tty device
3206 * (or ERR_PTR(-EFOO) on error).
3207 *
3208 * This call is required to be made to register an individual tty device
3209 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3210 * that bit is not set, this function should not be called by a tty
3211 * driver.
3212 *
3213 * Locking: ??
3214 */
3215
tty_register_device(struct tty_driver * driver,unsigned index,struct device * device)3216 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3217 struct device *device)
3218 {
3219 return tty_register_device_attr(driver, index, device, NULL, NULL);
3220 }
3221 EXPORT_SYMBOL(tty_register_device);
3222
tty_device_create_release(struct device * dev)3223 static void tty_device_create_release(struct device *dev)
3224 {
3225 dev_dbg(dev, "releasing...\n");
3226 kfree(dev);
3227 }
3228
3229 /**
3230 * tty_register_device_attr - register a tty device
3231 * @driver: the tty driver that describes the tty device
3232 * @index: the index in the tty driver for this tty device
3233 * @device: a struct device that is associated with this tty device.
3234 * This field is optional, if there is no known struct device
3235 * for this tty device it can be set to NULL safely.
3236 * @drvdata: Driver data to be set to device.
3237 * @attr_grp: Attribute group to be set on device.
3238 *
3239 * Returns a pointer to the struct device for this tty device
3240 * (or ERR_PTR(-EFOO) on error).
3241 *
3242 * This call is required to be made to register an individual tty device
3243 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3244 * that bit is not set, this function should not be called by a tty
3245 * driver.
3246 *
3247 * Locking: ??
3248 */
tty_register_device_attr(struct tty_driver * driver,unsigned index,struct device * device,void * drvdata,const struct attribute_group ** attr_grp)3249 struct device *tty_register_device_attr(struct tty_driver *driver,
3250 unsigned index, struct device *device,
3251 void *drvdata,
3252 const struct attribute_group **attr_grp)
3253 {
3254 char name[64];
3255 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3256 struct ktermios *tp;
3257 struct device *dev;
3258 int retval;
3259
3260 if (index >= driver->num) {
3261 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3262 driver->name, index);
3263 return ERR_PTR(-EINVAL);
3264 }
3265
3266 if (driver->type == TTY_DRIVER_TYPE_PTY)
3267 pty_line_name(driver, index, name);
3268 else
3269 tty_line_name(driver, index, name);
3270
3271 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3272 if (!dev)
3273 return ERR_PTR(-ENOMEM);
3274
3275 dev->devt = devt;
3276 dev->class = tty_class;
3277 dev->parent = device;
3278 dev->release = tty_device_create_release;
3279 dev_set_name(dev, "%s", name);
3280 dev->groups = attr_grp;
3281 dev_set_drvdata(dev, drvdata);
3282
3283 dev_set_uevent_suppress(dev, 1);
3284
3285 retval = device_register(dev);
3286 if (retval)
3287 goto err_put;
3288
3289 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3290 /*
3291 * Free any saved termios data so that the termios state is
3292 * reset when reusing a minor number.
3293 */
3294 tp = driver->termios[index];
3295 if (tp) {
3296 driver->termios[index] = NULL;
3297 kfree(tp);
3298 }
3299
3300 retval = tty_cdev_add(driver, devt, index, 1);
3301 if (retval)
3302 goto err_del;
3303 }
3304
3305 dev_set_uevent_suppress(dev, 0);
3306 kobject_uevent(&dev->kobj, KOBJ_ADD);
3307
3308 return dev;
3309
3310 err_del:
3311 device_del(dev);
3312 err_put:
3313 put_device(dev);
3314
3315 return ERR_PTR(retval);
3316 }
3317 EXPORT_SYMBOL_GPL(tty_register_device_attr);
3318
3319 /**
3320 * tty_unregister_device - unregister a tty device
3321 * @driver: the tty driver that describes the tty device
3322 * @index: the index in the tty driver for this tty device
3323 *
3324 * If a tty device is registered with a call to tty_register_device() then
3325 * this function must be called when the tty device is gone.
3326 *
3327 * Locking: ??
3328 */
3329
tty_unregister_device(struct tty_driver * driver,unsigned index)3330 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3331 {
3332 device_destroy(tty_class,
3333 MKDEV(driver->major, driver->minor_start) + index);
3334 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3335 cdev_del(driver->cdevs[index]);
3336 driver->cdevs[index] = NULL;
3337 }
3338 }
3339 EXPORT_SYMBOL(tty_unregister_device);
3340
3341 /**
3342 * __tty_alloc_driver -- allocate tty driver
3343 * @lines: count of lines this driver can handle at most
3344 * @owner: module which is responsible for this driver
3345 * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3346 *
3347 * This should not be called directly, some of the provided macros should be
3348 * used instead. Use IS_ERR and friends on @retval.
3349 */
__tty_alloc_driver(unsigned int lines,struct module * owner,unsigned long flags)3350 struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3351 unsigned long flags)
3352 {
3353 struct tty_driver *driver;
3354 unsigned int cdevs = 1;
3355 int err;
3356
3357 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3358 return ERR_PTR(-EINVAL);
3359
3360 driver = kzalloc(sizeof(*driver), GFP_KERNEL);
3361 if (!driver)
3362 return ERR_PTR(-ENOMEM);
3363
3364 kref_init(&driver->kref);
3365 driver->magic = TTY_DRIVER_MAGIC;
3366 driver->num = lines;
3367 driver->owner = owner;
3368 driver->flags = flags;
3369
3370 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3371 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3372 GFP_KERNEL);
3373 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3374 GFP_KERNEL);
3375 if (!driver->ttys || !driver->termios) {
3376 err = -ENOMEM;
3377 goto err_free_all;
3378 }
3379 }
3380
3381 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3382 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3383 GFP_KERNEL);
3384 if (!driver->ports) {
3385 err = -ENOMEM;
3386 goto err_free_all;
3387 }
3388 cdevs = lines;
3389 }
3390
3391 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3392 if (!driver->cdevs) {
3393 err = -ENOMEM;
3394 goto err_free_all;
3395 }
3396
3397 return driver;
3398 err_free_all:
3399 kfree(driver->ports);
3400 kfree(driver->ttys);
3401 kfree(driver->termios);
3402 kfree(driver->cdevs);
3403 kfree(driver);
3404 return ERR_PTR(err);
3405 }
3406 EXPORT_SYMBOL(__tty_alloc_driver);
3407
destruct_tty_driver(struct kref * kref)3408 static void destruct_tty_driver(struct kref *kref)
3409 {
3410 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3411 int i;
3412 struct ktermios *tp;
3413
3414 if (driver->flags & TTY_DRIVER_INSTALLED) {
3415 for (i = 0; i < driver->num; i++) {
3416 tp = driver->termios[i];
3417 if (tp) {
3418 driver->termios[i] = NULL;
3419 kfree(tp);
3420 }
3421 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3422 tty_unregister_device(driver, i);
3423 }
3424 proc_tty_unregister_driver(driver);
3425 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3426 cdev_del(driver->cdevs[0]);
3427 }
3428 kfree(driver->cdevs);
3429 kfree(driver->ports);
3430 kfree(driver->termios);
3431 kfree(driver->ttys);
3432 kfree(driver);
3433 }
3434
tty_driver_kref_put(struct tty_driver * driver)3435 void tty_driver_kref_put(struct tty_driver *driver)
3436 {
3437 kref_put(&driver->kref, destruct_tty_driver);
3438 }
3439 EXPORT_SYMBOL(tty_driver_kref_put);
3440
tty_set_operations(struct tty_driver * driver,const struct tty_operations * op)3441 void tty_set_operations(struct tty_driver *driver,
3442 const struct tty_operations *op)
3443 {
3444 driver->ops = op;
3445 };
3446 EXPORT_SYMBOL(tty_set_operations);
3447
put_tty_driver(struct tty_driver * d)3448 void put_tty_driver(struct tty_driver *d)
3449 {
3450 tty_driver_kref_put(d);
3451 }
3452 EXPORT_SYMBOL(put_tty_driver);
3453
3454 /*
3455 * Called by a tty driver to register itself.
3456 */
tty_register_driver(struct tty_driver * driver)3457 int tty_register_driver(struct tty_driver *driver)
3458 {
3459 int error;
3460 int i;
3461 dev_t dev;
3462 struct device *d;
3463
3464 if (!driver->major) {
3465 error = alloc_chrdev_region(&dev, driver->minor_start,
3466 driver->num, driver->name);
3467 if (!error) {
3468 driver->major = MAJOR(dev);
3469 driver->minor_start = MINOR(dev);
3470 }
3471 } else {
3472 dev = MKDEV(driver->major, driver->minor_start);
3473 error = register_chrdev_region(dev, driver->num, driver->name);
3474 }
3475 if (error < 0)
3476 goto err;
3477
3478 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3479 error = tty_cdev_add(driver, dev, 0, driver->num);
3480 if (error)
3481 goto err_unreg_char;
3482 }
3483
3484 mutex_lock(&tty_mutex);
3485 list_add(&driver->tty_drivers, &tty_drivers);
3486 mutex_unlock(&tty_mutex);
3487
3488 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3489 for (i = 0; i < driver->num; i++) {
3490 d = tty_register_device(driver, i, NULL);
3491 if (IS_ERR(d)) {
3492 error = PTR_ERR(d);
3493 goto err_unreg_devs;
3494 }
3495 }
3496 }
3497 proc_tty_register_driver(driver);
3498 driver->flags |= TTY_DRIVER_INSTALLED;
3499 return 0;
3500
3501 err_unreg_devs:
3502 for (i--; i >= 0; i--)
3503 tty_unregister_device(driver, i);
3504
3505 mutex_lock(&tty_mutex);
3506 list_del(&driver->tty_drivers);
3507 mutex_unlock(&tty_mutex);
3508
3509 err_unreg_char:
3510 unregister_chrdev_region(dev, driver->num);
3511 err:
3512 return error;
3513 }
3514 EXPORT_SYMBOL(tty_register_driver);
3515
3516 /*
3517 * Called by a tty driver to unregister itself.
3518 */
tty_unregister_driver(struct tty_driver * driver)3519 void tty_unregister_driver(struct tty_driver *driver)
3520 {
3521 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3522 driver->num);
3523 mutex_lock(&tty_mutex);
3524 list_del(&driver->tty_drivers);
3525 mutex_unlock(&tty_mutex);
3526 }
3527 EXPORT_SYMBOL(tty_unregister_driver);
3528
tty_devnum(struct tty_struct * tty)3529 dev_t tty_devnum(struct tty_struct *tty)
3530 {
3531 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3532 }
3533 EXPORT_SYMBOL(tty_devnum);
3534
tty_default_fops(struct file_operations * fops)3535 void tty_default_fops(struct file_operations *fops)
3536 {
3537 *fops = tty_fops;
3538 }
3539
tty_devnode(struct device * dev,umode_t * mode)3540 static char *tty_devnode(struct device *dev, umode_t *mode)
3541 {
3542 if (!mode)
3543 return NULL;
3544 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3545 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3546 *mode = 0666;
3547 return NULL;
3548 }
3549
tty_class_init(void)3550 static int __init tty_class_init(void)
3551 {
3552 tty_class = class_create(THIS_MODULE, "tty");
3553 if (IS_ERR(tty_class))
3554 return PTR_ERR(tty_class);
3555 tty_class->devnode = tty_devnode;
3556 return 0;
3557 }
3558
3559 postcore_initcall(tty_class_init);
3560
3561 /* 3/2004 jmc: why do these devices exist? */
3562 static struct cdev tty_cdev, console_cdev;
3563
show_cons_active(struct device * dev,struct device_attribute * attr,char * buf)3564 static ssize_t show_cons_active(struct device *dev,
3565 struct device_attribute *attr, char *buf)
3566 {
3567 struct console *cs[16];
3568 int i = 0;
3569 struct console *c;
3570 ssize_t count = 0;
3571
3572 console_lock();
3573 for_each_console(c) {
3574 if (!c->device)
3575 continue;
3576 if (!c->write)
3577 continue;
3578 if ((c->flags & CON_ENABLED) == 0)
3579 continue;
3580 cs[i++] = c;
3581 if (i >= ARRAY_SIZE(cs))
3582 break;
3583 }
3584 while (i--) {
3585 int index = cs[i]->index;
3586 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3587
3588 /* don't resolve tty0 as some programs depend on it */
3589 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3590 count += tty_line_name(drv, index, buf + count);
3591 else
3592 count += sprintf(buf + count, "%s%d",
3593 cs[i]->name, cs[i]->index);
3594
3595 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3596 }
3597 console_unlock();
3598
3599 return count;
3600 }
3601 static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3602
3603 static struct attribute *cons_dev_attrs[] = {
3604 &dev_attr_active.attr,
3605 NULL
3606 };
3607
3608 ATTRIBUTE_GROUPS(cons_dev);
3609
3610 static struct device *consdev;
3611
console_sysfs_notify(void)3612 void console_sysfs_notify(void)
3613 {
3614 if (consdev)
3615 sysfs_notify(&consdev->kobj, NULL, "active");
3616 }
3617
3618 /*
3619 * Ok, now we can initialize the rest of the tty devices and can count
3620 * on memory allocations, interrupts etc..
3621 */
tty_init(void)3622 int __init tty_init(void)
3623 {
3624 tty_sysctl_init();
3625 cdev_init(&tty_cdev, &tty_fops);
3626 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3627 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3628 panic("Couldn't register /dev/tty driver\n");
3629 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3630
3631 cdev_init(&console_cdev, &console_fops);
3632 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3633 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3634 panic("Couldn't register /dev/console driver\n");
3635 consdev = device_create_with_groups(tty_class, NULL,
3636 MKDEV(TTYAUX_MAJOR, 1), NULL,
3637 cons_dev_groups, "console");
3638 if (IS_ERR(consdev))
3639 consdev = NULL;
3640
3641 #ifdef CONFIG_VT
3642 vty_init(&console_fops);
3643 #endif
3644 return 0;
3645 }
3646
3647