tty_io.c 90.1 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
/*
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
 * or rs-channels. It also implements echoing, cooked mode etc.
 *
 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
 *
 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
 * tty_struct and tty_queue structures.  Previously there was an array
 * of 256 tty_struct's which was statically allocated, and the
 * tty_queue structures were allocated at boot time.  Both are now
 * dynamically allocated only when the tty is open.
 *
 * Also restructured routines so that there is more of a separation
 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
 * the low-level tty routines (serial.c, pty.c, console.c).  This
20
 * makes for cleaner and more compact code.  -TYT, 9/17/92
L
Linus Torvalds 已提交
21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41
 *
 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
 * which can be dynamically activated and de-activated by the line
 * discipline handling modules (like SLIP).
 *
 * NOTE: pay no attention to the line discipline code (yet); its
 * interface is still subject to change in this version...
 * -- TYT, 1/31/92
 *
 * Added functionality to the OPOST tty handling.  No delays, but all
 * other bits should be there.
 *	-- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
 *
 * Rewrote canonical mode and added more termios flags.
 * 	-- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
 *
 * Reorganized FASYNC support so mouse code can share it.
 *	-- ctm@ardi.com, 9Sep95
 *
 * New TIOCLINUX variants added.
 *	-- mj@k332.feld.cvut.cz, 19-Nov-95
42
 *
L
Linus Torvalds 已提交
43 44 45 46 47 48 49
 * Restrict vt switching via ioctl()
 *      -- grif@cs.ucr.edu, 5-Dec-95
 *
 * Move console and virtual terminal code to more appropriate files,
 * implement CONFIG_VT and generalize console device interface.
 *	-- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
 *
50
 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
L
Linus Torvalds 已提交
51 52 53 54 55 56 57 58 59 60 61 62
 *	-- Bill Hawes <whawes@star.net>, June 97
 *
 * Added devfs support.
 *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
 *
 * Added support for a Unix98-style ptmx device.
 *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
 *
 * Reduced memory usage for older ARM systems
 *      -- Russell King <rmk@arm.linux.org.uk>
 *
 * Move do_SAK() into process context.  Less stack use in devfs functions.
63 64
 * alloc_tty_struct() always uses kmalloc()
 *			 -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
L
Linus Torvalds 已提交
65 66 67 68 69 70 71 72 73 74 75 76 77 78
 */

#include <linux/types.h>
#include <linux/major.h>
#include <linux/errno.h>
#include <linux/signal.h>
#include <linux/fcntl.h>
#include <linux/sched.h>
#include <linux/interrupt.h>
#include <linux/tty.h>
#include <linux/tty_driver.h>
#include <linux/tty_flip.h>
#include <linux/devpts_fs.h>
#include <linux/file.h>
A
Al Viro 已提交
79
#include <linux/fdtable.h>
L
Linus Torvalds 已提交
80 81 82 83 84 85 86 87 88 89 90 91 92 93
#include <linux/console.h>
#include <linux/timer.h>
#include <linux/ctype.h>
#include <linux/kd.h>
#include <linux/mm.h>
#include <linux/string.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/proc_fs.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/device.h>
#include <linux/wait.h>
#include <linux/bitops.h>
94
#include <linux/delay.h>
A
Alan Cox 已提交
95
#include <linux/seq_file.h>
A
Alan Cox 已提交
96
#include <linux/serial.h>
97
#include <linux/ratelimit.h>
L
Linus Torvalds 已提交
98

A
Alan Cox 已提交
99
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
100 101 102 103 104 105

#include <linux/kbd_kern.h>
#include <linux/vt_kern.h>
#include <linux/selection.h>

#include <linux/kmod.h>
106
#include <linux/nsproxy.h>
L
Linus Torvalds 已提交
107 108

#undef TTY_DEBUG_HANGUP
109 110 111 112 113
#ifdef TTY_DEBUG_HANGUP
# define tty_debug_hangup(tty, f, args...)	tty_debug(tty, f, ##args)
#else
# define tty_debug_hangup(tty, f, args...)	do { } while (0)
#endif
L
Linus Torvalds 已提交
114 115 116 117

#define TTY_PARANOIA_CHECK 1
#define CHECK_TTY_COUNT 1

118
struct ktermios tty_std_termios = {	/* for the benefit of tty drivers  */
L
Linus Torvalds 已提交
119 120 121 122 123
	.c_iflag = ICRNL | IXON,
	.c_oflag = OPOST | ONLCR,
	.c_cflag = B38400 | CS8 | CREAD | HUPCL,
	.c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
		   ECHOCTL | ECHOKE | IEXTEN,
124 125
	.c_cc = INIT_C_CC,
	.c_ispeed = 38400,
126 127
	.c_ospeed = 38400,
	/* .c_line = N_TTY, */
L
Linus Torvalds 已提交
128 129 130 131 132 133 134
};

EXPORT_SYMBOL(tty_std_termios);

/* This list gets poked at by procfs and various bits of boot up code. This
   could do with some rationalisation such as pulling the tty proc function
   into this file */
135

L
Linus Torvalds 已提交
136 137
LIST_HEAD(tty_drivers);			/* linked list of tty drivers */

138
/* Mutex to protect creating and releasing a tty */
I
Ingo Molnar 已提交
139
DEFINE_MUTEX(tty_mutex);
L
Linus Torvalds 已提交
140

N
Nick Piggin 已提交
141 142 143
/* Spinlock to protect the tty->tty_files list */
DEFINE_SPINLOCK(tty_files_lock);

L
Linus Torvalds 已提交
144 145
static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
146 147
ssize_t redirected_tty_write(struct file *, const char __user *,
							size_t, loff_t *);
L
Linus Torvalds 已提交
148 149
static unsigned int tty_poll(struct file *, poll_table *);
static int tty_open(struct inode *, struct file *);
A
Alan Cox 已提交
150
long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
P
Paul Fulghum 已提交
151
#ifdef CONFIG_COMPAT
152
static long tty_compat_ioctl(struct file *file, unsigned int cmd,
P
Paul Fulghum 已提交
153 154 155 156
				unsigned long arg);
#else
#define tty_compat_ioctl NULL
#endif
157
static int __tty_fasync(int fd, struct file *filp, int on);
158
static int tty_fasync(int fd, struct file *filp, int on);
159
static void release_tty(struct tty_struct *tty, int idx);
L
Linus Torvalds 已提交
160

161 162 163 164 165 166 167 168 169
/**
 *	free_tty_struct		-	free a disused tty
 *	@tty: tty struct to free
 *
 *	Free the write buffers, tty queue and tty memory itself.
 *
 *	Locking: none. Must be called after tty is definitely unused
 */

170
static void free_tty_struct(struct tty_struct *tty)
L
Linus Torvalds 已提交
171
{
172
	tty_ldisc_deinit(tty);
173
	put_device(tty->dev);
L
Linus Torvalds 已提交
174
	kfree(tty->write_buf);
A
Alan Cox 已提交
175
	tty->magic = 0xDEADDEAD;
L
Linus Torvalds 已提交
176 177 178
	kfree(tty);
}

N
Nick Piggin 已提交
179 180 181 182 183
static inline struct tty_struct *file_tty(struct file *file)
{
	return ((struct tty_file_private *)file->private_data)->tty;
}

J
Jiri Slaby 已提交
184
int tty_alloc_file(struct file *file)
N
Nick Piggin 已提交
185 186 187
{
	struct tty_file_private *priv;

188 189 190
	priv = kmalloc(sizeof(*priv), GFP_KERNEL);
	if (!priv)
		return -ENOMEM;
N
Nick Piggin 已提交
191

J
Jiri Slaby 已提交
192 193 194 195 196 197 198 199 200 201
	file->private_data = priv;

	return 0;
}

/* Associate a new file with the tty structure */
void tty_add_file(struct tty_struct *tty, struct file *file)
{
	struct tty_file_private *priv = file->private_data;

N
Nick Piggin 已提交
202 203 204 205 206 207
	priv->tty = tty;
	priv->file = file;

	spin_lock(&tty_files_lock);
	list_add(&priv->list, &tty->tty_files);
	spin_unlock(&tty_files_lock);
J
Jiri Slaby 已提交
208
}
209

J
Jiri Slaby 已提交
210 211 212 213 214 215 216 217 218 219 220 221
/**
 * tty_free_file - free file->private_data
 *
 * This shall be used only for fail path handling when tty_add_file was not
 * called yet.
 */
void tty_free_file(struct file *file)
{
	struct tty_file_private *priv = file->private_data;

	file->private_data = NULL;
	kfree(priv);
N
Nick Piggin 已提交
222 223 224
}

/* Delete file from its tty */
225
static void tty_del_file(struct file *file)
N
Nick Piggin 已提交
226 227 228 229 230 231
{
	struct tty_file_private *priv = file->private_data;

	spin_lock(&tty_files_lock);
	list_del(&priv->list);
	spin_unlock(&tty_files_lock);
J
Jiri Slaby 已提交
232
	tty_free_file(file);
N
Nick Piggin 已提交
233 234 235
}


L
Linus Torvalds 已提交
236 237
#define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)

238 239 240 241 242 243 244 245 246 247
/**
 *	tty_name	-	return tty naming
 *	@tty: tty structure
 *
 *	Convert a tty structure into a name. The name reflects the kernel
 *	naming policy and if udev is in use may not reflect user space
 *
 *	Locking: none
 */

248
const char *tty_name(const struct tty_struct *tty)
L
Linus Torvalds 已提交
249 250
{
	if (!tty) /* Hmm.  NULL pointer.  That's fun. */
251 252
		return "NULL tty";
	return tty->name;
L
Linus Torvalds 已提交
253 254 255 256
}

EXPORT_SYMBOL(tty_name);

257 258 259 260 261 262 263
const char *tty_driver_name(const struct tty_struct *tty)
{
	if (!tty || !tty->driver)
		return "";
	return tty->driver->name;
}

264
static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
L
Linus Torvalds 已提交
265 266 267 268
			      const char *routine)
{
#ifdef TTY_PARANOIA_CHECK
	if (!tty) {
P
Peter Hurley 已提交
269
		pr_warn("(%d:%d): %s: NULL tty\n",
L
Linus Torvalds 已提交
270 271 272 273
			imajor(inode), iminor(inode), routine);
		return 1;
	}
	if (tty->magic != TTY_MAGIC) {
P
Peter Hurley 已提交
274
		pr_warn("(%d:%d): %s: bad magic number\n",
L
Linus Torvalds 已提交
275 276 277 278 279 280 281
			imajor(inode), iminor(inode), routine);
		return 1;
	}
#endif
	return 0;
}

282
/* Caller must hold tty_lock */
L
Linus Torvalds 已提交
283 284 285 286 287
static int check_tty_count(struct tty_struct *tty, const char *routine)
{
#ifdef CHECK_TTY_COUNT
	struct list_head *p;
	int count = 0;
288

N
Nick Piggin 已提交
289
	spin_lock(&tty_files_lock);
L
Linus Torvalds 已提交
290 291 292
	list_for_each(p, &tty->tty_files) {
		count++;
	}
N
Nick Piggin 已提交
293
	spin_unlock(&tty_files_lock);
L
Linus Torvalds 已提交
294 295 296 297 298
	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
	    tty->driver->subtype == PTY_TYPE_SLAVE &&
	    tty->link && tty->link->count)
		count++;
	if (tty->count != count) {
P
Peter Hurley 已提交
299 300
		tty_warn(tty, "%s: tty->count(%d) != #fd's(%d)\n",
			 routine, tty->count, count);
L
Linus Torvalds 已提交
301
		return count;
302
	}
L
Linus Torvalds 已提交
303 304 305 306
#endif
	return 0;
}

307 308 309 310 311 312 313 314 315
/**
 *	get_tty_driver		-	find device of a tty
 *	@dev_t: device identifier
 *	@index: returns the index of the tty
 *
 *	This routine returns a tty driver structure, given a device number
 *	and also passes back the index number.
 *
 *	Locking: caller must hold tty_mutex
L
Linus Torvalds 已提交
316
 */
317

L
Linus Torvalds 已提交
318 319 320 321 322 323 324 325 326
static struct tty_driver *get_tty_driver(dev_t device, int *index)
{
	struct tty_driver *p;

	list_for_each_entry(p, &tty_drivers, tty_drivers) {
		dev_t base = MKDEV(p->major, p->minor_start);
		if (device < base || device >= base + p->num)
			continue;
		*index = device - base;
A
Alan Cox 已提交
327
		return tty_driver_kref_get(p);
L
Linus Torvalds 已提交
328 329 330 331
	}
	return NULL;
}

J
Jason Wessel 已提交
332 333 334 335 336 337 338 339 340 341 342 343 344 345 346
#ifdef CONFIG_CONSOLE_POLL

/**
 *	tty_find_polling_driver	-	find device of a polled tty
 *	@name: name string to match
 *	@line: pointer to resulting tty line nr
 *
 *	This routine returns a tty driver structure, given a name
 *	and the condition that the tty driver is capable of polled
 *	operation.
 */
struct tty_driver *tty_find_polling_driver(char *name, int *line)
{
	struct tty_driver *p, *res = NULL;
	int tty_line = 0;
347
	int len;
348
	char *str, *stp;
J
Jason Wessel 已提交
349

350 351 352 353 354 355 356 357 358
	for (str = name; *str; str++)
		if ((*str >= '0' && *str <= '9') || *str == ',')
			break;
	if (!*str)
		return NULL;

	len = str - name;
	tty_line = simple_strtoul(str, &str, 10);

J
Jason Wessel 已提交
359 360 361
	mutex_lock(&tty_mutex);
	/* Search through the tty devices to look for a match */
	list_for_each_entry(p, &tty_drivers, tty_drivers) {
362 363
		if (strncmp(name, p->name, len) != 0)
			continue;
364 365 366 367 368
		stp = str;
		if (*stp == ',')
			stp++;
		if (*stp == '\0')
			stp = NULL;
J
Jason Wessel 已提交
369

370
		if (tty_line >= 0 && tty_line < p->num && p->ops &&
371
		    p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
A
Alan Cox 已提交
372
			res = tty_driver_kref_get(p);
J
Jason Wessel 已提交
373 374 375 376 377 378 379 380 381 382 383
			*line = tty_line;
			break;
		}
	}
	mutex_unlock(&tty_mutex);

	return res;
}
EXPORT_SYMBOL_GPL(tty_find_polling_driver);
#endif

384 385 386 387 388 389
static int is_ignored(int sig)
{
	return (sigismember(&current->blocked, sig) ||
		current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
}

390 391 392 393 394 395 396 397
/**
 *	tty_check_change	-	check for POSIX terminal changes
 *	@tty: tty to check
 *
 *	If we try to write to, or set the state of, a terminal and we're
 *	not in the foreground, send a SIGTTOU.  If the signal is blocked or
 *	ignored, go ahead and perform the operation.  (POSIX 7.2)
 *
398
 *	Locking: ctrl_lock
L
Linus Torvalds 已提交
399
 */
400

401
int __tty_check_change(struct tty_struct *tty, int sig)
L
Linus Torvalds 已提交
402
{
A
Alan Cox 已提交
403
	unsigned long flags;
404
	struct pid *pgrp, *tty_pgrp;
A
Alan Cox 已提交
405 406
	int ret = 0;

L
Linus Torvalds 已提交
407 408
	if (current->signal->tty != tty)
		return 0;
A
Alan Cox 已提交
409

410 411 412
	rcu_read_lock();
	pgrp = task_pgrp(current);

A
Alan Cox 已提交
413
	spin_lock_irqsave(&tty->ctrl_lock, flags);
414
	tty_pgrp = tty->pgrp;
415
	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
416

417 418 419 420 421 422 423 424 425 426 427
	if (tty_pgrp && pgrp != tty->pgrp) {
		if (is_ignored(sig)) {
			if (sig == SIGTTIN)
				ret = -EIO;
		} else if (is_current_pgrp_orphaned())
			ret = -EIO;
		else {
			kill_pgrp(pgrp, sig, 1);
			set_thread_flag(TIF_SIGPENDING);
			ret = -ERESTARTSYS;
		}
A
Alan Cox 已提交
428
	}
429
	rcu_read_unlock();
430

P
Peter Hurley 已提交
431 432
	if (!tty_pgrp)
		tty_warn(tty, "sig=%d, tty->pgrp == NULL!\n", sig);
433

A
Alan Cox 已提交
434
	return ret;
L
Linus Torvalds 已提交
435 436
}

437 438 439 440
int tty_check_change(struct tty_struct *tty)
{
	return __tty_check_change(tty, SIGTTOU);
}
L
Linus Torvalds 已提交
441 442
EXPORT_SYMBOL(tty_check_change);

443
static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
L
Linus Torvalds 已提交
444 445 446 447 448
				size_t count, loff_t *ppos)
{
	return 0;
}

449
static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
L
Linus Torvalds 已提交
450 451 452 453 454 455
				 size_t count, loff_t *ppos)
{
	return -EIO;
}

/* No kernel lock held - none needed ;) */
456
static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
L
Linus Torvalds 已提交
457 458 459 460
{
	return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
}

A
Alan Cox 已提交
461 462
static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
		unsigned long arg)
P
Paul Fulghum 已提交
463 464 465 466
{
	return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
}

467
static long hung_up_tty_compat_ioctl(struct file *file,
P
Paul Fulghum 已提交
468
				     unsigned int cmd, unsigned long arg)
L
Linus Torvalds 已提交
469 470 471 472
{
	return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
}

473
static const struct file_operations tty_fops = {
L
Linus Torvalds 已提交
474 475 476 477
	.llseek		= no_llseek,
	.read		= tty_read,
	.write		= tty_write,
	.poll		= tty_poll,
A
Alan Cox 已提交
478
	.unlocked_ioctl	= tty_ioctl,
P
Paul Fulghum 已提交
479
	.compat_ioctl	= tty_compat_ioctl,
L
Linus Torvalds 已提交
480 481 482 483 484
	.open		= tty_open,
	.release	= tty_release,
	.fasync		= tty_fasync,
};

485
static const struct file_operations console_fops = {
L
Linus Torvalds 已提交
486 487 488 489
	.llseek		= no_llseek,
	.read		= tty_read,
	.write		= redirected_tty_write,
	.poll		= tty_poll,
A
Alan Cox 已提交
490
	.unlocked_ioctl	= tty_ioctl,
P
Paul Fulghum 已提交
491
	.compat_ioctl	= tty_compat_ioctl,
L
Linus Torvalds 已提交
492 493 494 495 496
	.open		= tty_open,
	.release	= tty_release,
	.fasync		= tty_fasync,
};

497
static const struct file_operations hung_up_tty_fops = {
L
Linus Torvalds 已提交
498 499 500 501
	.llseek		= no_llseek,
	.read		= hung_up_tty_read,
	.write		= hung_up_tty_write,
	.poll		= hung_up_tty_poll,
A
Alan Cox 已提交
502
	.unlocked_ioctl	= hung_up_tty_ioctl,
P
Paul Fulghum 已提交
503
	.compat_ioctl	= hung_up_tty_compat_ioctl,
L
Linus Torvalds 已提交
504 505 506 507 508 509
	.release	= tty_release,
};

static DEFINE_SPINLOCK(redirect_lock);
static struct file *redirect;

510 511 512 513 514 515 516 517 518 519 520 521

void proc_clear_tty(struct task_struct *p)
{
	unsigned long flags;
	struct tty_struct *tty;
	spin_lock_irqsave(&p->sighand->siglock, flags);
	tty = p->signal->tty;
	p->signal->tty = NULL;
	spin_unlock_irqrestore(&p->sighand->siglock, flags);
	tty_kref_put(tty);
}

522 523 524 525 526 527
/**
 * proc_set_tty -  set the controlling terminal
 *
 * Only callable by the session leader and only if it does not already have
 * a controlling terminal.
 *
528 529
 * Caller must hold:  tty_lock()
 *		      a readlock on tasklist_lock
530 531
 *		      sighand lock
 */
532
static void __proc_set_tty(struct tty_struct *tty)
533
{
534 535 536
	unsigned long flags;

	spin_lock_irqsave(&tty->ctrl_lock, flags);
537 538 539 540
	/*
	 * The session and fg pgrp references will be non-NULL if
	 * tiocsctty() is stealing the controlling tty
	 */
541 542 543 544 545 546
	put_pid(tty->session);
	put_pid(tty->pgrp);
	tty->pgrp = get_pid(task_pgrp(current));
	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
	tty->session = get_pid(task_session(current));
	if (current->signal->tty) {
547 548
		tty_debug(tty, "current tty %s not NULL!!\n",
			  current->signal->tty->name);
549
		tty_kref_put(current->signal->tty);
550
	}
551 552 553
	put_pid(current->signal->tty_old_pgrp);
	current->signal->tty = tty_kref_get(tty);
	current->signal->tty_old_pgrp = NULL;
554 555
}

556
static void proc_set_tty(struct tty_struct *tty)
557
{
558 559 560
	spin_lock_irq(&current->sighand->siglock);
	__proc_set_tty(tty);
	spin_unlock_irq(&current->sighand->siglock);
561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582
}

struct tty_struct *get_current_tty(void)
{
	struct tty_struct *tty;
	unsigned long flags;

	spin_lock_irqsave(&current->sighand->siglock, flags);
	tty = tty_kref_get(current->signal->tty);
	spin_unlock_irqrestore(&current->sighand->siglock, flags);
	return tty;
}
EXPORT_SYMBOL_GPL(get_current_tty);

static void session_clear_tty(struct pid *session)
{
	struct task_struct *p;
	do_each_pid_task(session, PIDTYPE_SID, p) {
		proc_clear_tty(p);
	} while_each_pid_task(session, PIDTYPE_SID, p);
}

L
Linus Torvalds 已提交
583 584 585 586 587 588 589 590
/**
 *	tty_wakeup	-	request more data
 *	@tty: terminal
 *
 *	Internal and external helper for wakeups of tty. This function
 *	informs the line discipline if present that the driver is ready
 *	to receive more output data.
 */
591

L
Linus Torvalds 已提交
592 593 594
void tty_wakeup(struct tty_struct *tty)
{
	struct tty_ldisc *ld;
595

L
Linus Torvalds 已提交
596 597
	if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
		ld = tty_ldisc_ref(tty);
598
		if (ld) {
A
Alan Cox 已提交
599 600
			if (ld->ops->write_wakeup)
				ld->ops->write_wakeup(tty);
L
Linus Torvalds 已提交
601 602 603
			tty_ldisc_deref(ld);
		}
	}
604
	wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
L
Linus Torvalds 已提交
605 606 607 608
}

EXPORT_SYMBOL_GPL(tty_wakeup);

609 610
/**
 *	tty_signal_session_leader	- sends SIGHUP to session leader
611 612
 *	@tty		controlling tty
 *	@exit_session	if non-zero, signal all foreground group processes
613
 *
614 615
 *	Send SIGHUP and SIGCONT to the session leader and its process group.
 *	Optionally, signal all processes in the foreground process group.
616 617 618 619 620
 *
 *	Returns the number of processes in the session with this tty
 *	as their controlling terminal. This value is used to drop
 *	tty references for those processes.
 */
621
static int tty_signal_session_leader(struct tty_struct *tty, int exit_session)
622 623 624
{
	struct task_struct *p;
	int refs = 0;
625
	struct pid *tty_pgrp = NULL;
626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643

	read_lock(&tasklist_lock);
	if (tty->session) {
		do_each_pid_task(tty->session, PIDTYPE_SID, p) {
			spin_lock_irq(&p->sighand->siglock);
			if (p->signal->tty == tty) {
				p->signal->tty = NULL;
				/* We defer the dereferences outside fo
				   the tasklist lock */
				refs++;
			}
			if (!p->signal->leader) {
				spin_unlock_irq(&p->sighand->siglock);
				continue;
			}
			__group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
			__group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
			put_pid(p->signal->tty_old_pgrp);  /* A noop */
644
			spin_lock(&tty->ctrl_lock);
645
			tty_pgrp = get_pid(tty->pgrp);
646 647
			if (tty->pgrp)
				p->signal->tty_old_pgrp = get_pid(tty->pgrp);
648
			spin_unlock(&tty->ctrl_lock);
649 650 651 652 653
			spin_unlock_irq(&p->sighand->siglock);
		} while_each_pid_task(tty->session, PIDTYPE_SID, p);
	}
	read_unlock(&tasklist_lock);

654 655 656 657 658 659
	if (tty_pgrp) {
		if (exit_session)
			kill_pgrp(tty_pgrp, SIGHUP, exit_session);
		put_pid(tty_pgrp);
	}

660 661 662
	return refs;
}

663
/**
664
 *	__tty_hangup		-	actual handler for hangup events
665
 *	@work: tty device
666
 *
667
 *	This can be called by a "kworker" kernel thread.  That is process
668 669 670 671 672 673 674 675 676
 *	synchronous but doesn't hold any locks, so we need to make sure we
 *	have the appropriate locks for what we're doing.
 *
 *	The hangup event clears any pending redirections onto the hung up
 *	device. It ensures future writes will error and it does the needed
 *	line discipline hangup and signal delivery. The tty object itself
 *	remains intact.
 *
 *	Locking:
677
 *		BTM
678 679
 *		  redirect lock for undoing redirection
 *		  file list lock for manipulating list of ttys
680
 *		  tty_ldiscs_lock from called functions
681
 *		  termios_rwsem resetting termios data
682 683
 *		  tasklist_lock to walk task list for hangup event
 *		    ->siglock to protect ->signal/->sighand
L
Linus Torvalds 已提交
684
 */
685
static void __tty_hangup(struct tty_struct *tty, int exit_session)
L
Linus Torvalds 已提交
686
{
687
	struct file *cons_filp = NULL;
L
Linus Torvalds 已提交
688
	struct file *filp, *f = NULL;
N
Nick Piggin 已提交
689
	struct tty_file_private *priv;
L
Linus Torvalds 已提交
690
	int    closecount = 0, n;
691
	int refs;
L
Linus Torvalds 已提交
692 693 694 695 696 697

	if (!tty)
		return;


	spin_lock(&redirect_lock);
N
Nick Piggin 已提交
698
	if (redirect && file_tty(redirect) == tty) {
L
Linus Torvalds 已提交
699 700 701 702
		f = redirect;
		redirect = NULL;
	}
	spin_unlock(&redirect_lock);
703

A
Alan Cox 已提交
704
	tty_lock(tty);
705

P
Peter Hurley 已提交
706 707 708 709 710
	if (test_bit(TTY_HUPPED, &tty->flags)) {
		tty_unlock(tty);
		return;
	}

711 712 713
	/* inuse_filps is protected by the single tty lock,
	   this really needs to change if we want to flush the
	   workqueue with the lock held */
714
	check_tty_count(tty, "tty_hangup");
A
Alan Cox 已提交
715

N
Nick Piggin 已提交
716
	spin_lock(&tty_files_lock);
L
Linus Torvalds 已提交
717
	/* This breaks for file handles being sent over AF_UNIX sockets ? */
N
Nick Piggin 已提交
718 719
	list_for_each_entry(priv, &tty->tty_files, list) {
		filp = priv->file;
L
Linus Torvalds 已提交
720 721 722 723 724
		if (filp->f_op->write == redirected_tty_write)
			cons_filp = filp;
		if (filp->f_op->write != tty_write)
			continue;
		closecount++;
725
		__tty_fasync(-1, filp, 0);	/* can't block */
L
Linus Torvalds 已提交
726 727
		filp->f_op = &hung_up_tty_fops;
	}
N
Nick Piggin 已提交
728
	spin_unlock(&tty_files_lock);
729

730 731 732 733 734
	refs = tty_signal_session_leader(tty, exit_session);
	/* Account for the p->signal references we killed */
	while (refs--)
		tty_kref_put(tty);

735
	tty_ldisc_hangup(tty, cons_filp != NULL);
736

737
	spin_lock_irq(&tty->ctrl_lock);
A
Alan Cox 已提交
738 739
	clear_bit(TTY_THROTTLED, &tty->flags);
	clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
740 741
	put_pid(tty->session);
	put_pid(tty->pgrp);
742 743
	tty->session = NULL;
	tty->pgrp = NULL;
L
Linus Torvalds 已提交
744
	tty->ctrl_status = 0;
745
	spin_unlock_irq(&tty->ctrl_lock);
A
Alan Cox 已提交
746

L
Linus Torvalds 已提交
747
	/*
748 749 750 751
	 * If one of the devices matches a console pointer, we
	 * cannot just call hangup() because that will cause
	 * tty->count and state->count to go out of sync.
	 * So we just call close() the right number of times.
L
Linus Torvalds 已提交
752 753
	 */
	if (cons_filp) {
A
Alan Cox 已提交
754
		if (tty->ops->close)
L
Linus Torvalds 已提交
755
			for (n = 0; n < closecount; n++)
A
Alan Cox 已提交
756 757
				tty->ops->close(tty, cons_filp);
	} else if (tty->ops->hangup)
758
		tty->ops->hangup(tty);
759
	/*
760 761 762
	 * We don't want to have driver/ldisc interactions beyond the ones
	 * we did here. The driver layer expects no calls after ->hangup()
	 * from the ldisc side, which is now guaranteed.
763
	 */
L
Linus Torvalds 已提交
764
	set_bit(TTY_HUPPED, &tty->flags);
A
Alan Cox 已提交
765
	tty_unlock(tty);
766

L
Linus Torvalds 已提交
767 768 769 770
	if (f)
		fput(f);
}

A
Arnd Bergmann 已提交
771 772 773 774 775
static void do_tty_hangup(struct work_struct *work)
{
	struct tty_struct *tty =
		container_of(work, struct tty_struct, hangup_work);

776
	__tty_hangup(tty, 0);
A
Arnd Bergmann 已提交
777 778
}

779 780 781 782 783 784 785 786
/**
 *	tty_hangup		-	trigger a hangup event
 *	@tty: tty to hangup
 *
 *	A carrier loss (virtual or otherwise) has occurred on this like
 *	schedule a hangup sequence to run after this event.
 */

787
void tty_hangup(struct tty_struct *tty)
L
Linus Torvalds 已提交
788
{
789
	tty_debug_hangup(tty, "hangup\n");
L
Linus Torvalds 已提交
790 791 792 793 794
	schedule_work(&tty->hangup_work);
}

EXPORT_SYMBOL(tty_hangup);

795 796 797 798 799 800
/**
 *	tty_vhangup		-	process vhangup
 *	@tty: tty to hangup
 *
 *	The user has asked via system call for the terminal to be hung up.
 *	We do this synchronously so that when the syscall returns the process
801
 *	is complete. That guarantee is necessary for security reasons.
802 803
 */

804
void tty_vhangup(struct tty_struct *tty)
L
Linus Torvalds 已提交
805
{
806
	tty_debug_hangup(tty, "vhangup\n");
807
	__tty_hangup(tty, 0);
L
Linus Torvalds 已提交
808
}
809

L
Linus Torvalds 已提交
810 811
EXPORT_SYMBOL(tty_vhangup);

812

A
Alan Cox 已提交
813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829
/**
 *	tty_vhangup_self	-	process vhangup for own ctty
 *
 *	Perform a vhangup on the current controlling tty
 */

void tty_vhangup_self(void)
{
	struct tty_struct *tty;

	tty = get_current_tty();
	if (tty) {
		tty_vhangup(tty);
		tty_kref_put(tty);
	}
}

830 831 832 833 834 835 836 837 838 839 840
/**
 *	tty_vhangup_session		-	hangup session leader exit
 *	@tty: tty to hangup
 *
 *	The session leader is exiting and hanging up its controlling terminal.
 *	Every process in the foreground process group is signalled SIGHUP.
 *
 *	We do this synchronously so that when the syscall returns the process
 *	is complete. That guarantee is necessary for security reasons.
 */

841
static void tty_vhangup_session(struct tty_struct *tty)
842
{
843
	tty_debug_hangup(tty, "session hangup\n");
844 845 846
	__tty_hangup(tty, 1);
}

847 848 849 850 851 852 853 854
/**
 *	tty_hung_up_p		-	was tty hung up
 *	@filp: file pointer of tty
 *
 *	Return true if the tty has been subject to a vhangup or a carrier
 *	loss
 */

855
int tty_hung_up_p(struct file *filp)
L
Linus Torvalds 已提交
856 857 858 859 860 861
{
	return (filp->f_op == &hung_up_tty_fops);
}

EXPORT_SYMBOL(tty_hung_up_p);

862 863 864
/**
 *	disassociate_ctty	-	disconnect controlling tty
 *	@on_exit: true if exiting so need to "hang up" the session
L
Linus Torvalds 已提交
865
 *
866 867 868 869
 *	This function is typically called only by the session leader, when
 *	it wants to disassociate itself from its controlling tty.
 *
 *	It performs the following functions:
L
Linus Torvalds 已提交
870 871 872 873 874
 * 	(1)  Sends a SIGHUP and SIGCONT to the foreground process group
 * 	(2)  Clears the tty from being controlling the session
 * 	(3)  Clears the controlling tty for all processes in the
 * 		session group.
 *
875 876 877
 *	The argument on_exit is set to 1 if called when a process is
 *	exiting; it is 0 if called by the ioctl TIOCNOTTY.
 *
878
 *	Locking:
879 880
 *		BTM is taken for hysterical raisins, and held when
 *		  called from no_tty().
881 882 883 884
 *		  tty_mutex is taken to protect tty
 *		  ->siglock is taken to protect ->signal/->sighand
 *		  tasklist_lock is taken to walk process list for sessions
 *		    ->siglock is taken to protect ->signal/->sighand
L
Linus Torvalds 已提交
885
 */
886

L
Linus Torvalds 已提交
887 888 889 890
void disassociate_ctty(int on_exit)
{
	struct tty_struct *tty;

891 892
	if (!current->signal->leader)
		return;
L
Linus Torvalds 已提交
893

894
	tty = get_current_tty();
L
Linus Torvalds 已提交
895
	if (tty) {
896 897 898 899 900 901
		if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY) {
			tty_vhangup_session(tty);
		} else {
			struct pid *tty_pgrp = tty_get_pgrp(tty);
			if (tty_pgrp) {
				kill_pgrp(tty_pgrp, SIGHUP, on_exit);
902 903
				if (!on_exit)
					kill_pgrp(tty_pgrp, SIGCONT, on_exit);
904 905
				put_pid(tty_pgrp);
			}
J
Jiri Slaby 已提交
906
		}
907 908
		tty_kref_put(tty);

909
	} else if (on_exit) {
910
		struct pid *old_pgrp;
911 912
		spin_lock_irq(&current->sighand->siglock);
		old_pgrp = current->signal->tty_old_pgrp;
913
		current->signal->tty_old_pgrp = NULL;
914
		spin_unlock_irq(&current->sighand->siglock);
915
		if (old_pgrp) {
916 917 918
			kill_pgrp(old_pgrp, SIGHUP, on_exit);
			kill_pgrp(old_pgrp, SIGCONT, on_exit);
			put_pid(old_pgrp);
L
Linus Torvalds 已提交
919 920 921 922
		}
		return;
	}

923
	spin_lock_irq(&current->sighand->siglock);
924
	put_pid(current->signal->tty_old_pgrp);
R
Randy Dunlap 已提交
925
	current->signal->tty_old_pgrp = NULL;
926

C
Chen Tingjie 已提交
927
	tty = tty_kref_get(current->signal->tty);
928
	if (tty) {
A
Alan Cox 已提交
929 930
		unsigned long flags;
		spin_lock_irqsave(&tty->ctrl_lock, flags);
931 932 933 934
		put_pid(tty->session);
		put_pid(tty->pgrp);
		tty->session = NULL;
		tty->pgrp = NULL;
A
Alan Cox 已提交
935
		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
A
Alan Cox 已提交
936
		tty_kref_put(tty);
937 938
	} else
		tty_debug_hangup(tty, "no current tty\n");
L
Linus Torvalds 已提交
939

C
Chen Tingjie 已提交
940
	spin_unlock_irq(&current->sighand->siglock);
L
Linus Torvalds 已提交
941 942
	/* Now clear signal->tty under the lock */
	read_lock(&tasklist_lock);
943
	session_clear_tty(task_session(current));
L
Linus Torvalds 已提交
944 945 946
	read_unlock(&tasklist_lock);
}

947 948 949 950 951 952
/**
 *
 *	no_tty	- Ensure the current process does not have a controlling tty
 */
void no_tty(void)
{
953 954 955
	/* FIXME: Review locking here. The tty_lock never covered any race
	   between a new association and proc_clear_tty but possible we need
	   to protect against this anyway */
956
	struct task_struct *tsk = current;
957
	disassociate_ctty(0);
958 959 960
	proc_clear_tty(tsk);
}

961 962

/**
963
 *	stop_tty	-	propagate flow control
964 965
 *	@tty: tty to stop
 *
966
 *	Perform flow control to the driver. May be called
967 968 969 970 971 972 973 974 975
 *	on an already stopped device and will not re-call the driver
 *	method.
 *
 *	This functionality is used by both the line disciplines for
 *	halting incoming flow and by the driver. It may therefore be
 *	called from any context, may be under the tty atomic_write_lock
 *	but not always.
 *
 *	Locking:
976
 *		flow_lock
977 978
 */

979
void __stop_tty(struct tty_struct *tty)
L
Linus Torvalds 已提交
980
{
981
	if (tty->stopped)
L
Linus Torvalds 已提交
982 983
		return;
	tty->stopped = 1;
A
Alan Cox 已提交
984
	if (tty->ops->stop)
P
Peter Hurley 已提交
985
		tty->ops->stop(tty);
L
Linus Torvalds 已提交
986 987
}

988 989 990 991 992 993 994 995
void stop_tty(struct tty_struct *tty)
{
	unsigned long flags;

	spin_lock_irqsave(&tty->flow_lock, flags);
	__stop_tty(tty);
	spin_unlock_irqrestore(&tty->flow_lock, flags);
}
L
Linus Torvalds 已提交
996 997
EXPORT_SYMBOL(stop_tty);

998
/**
999
 *	start_tty	-	propagate flow control
1000 1001
 *	@tty: tty to start
 *
1002 1003 1004
 *	Start a tty that has been stopped if at all possible. If this
 *	tty was previous stopped and is now being started, the driver
 *	start method is invoked and the line discipline woken.
1005 1006
 *
 *	Locking:
1007
 *		flow_lock
1008 1009
 */

1010
void __start_tty(struct tty_struct *tty)
L
Linus Torvalds 已提交
1011
{
1012
	if (!tty->stopped || tty->flow_stopped)
L
Linus Torvalds 已提交
1013 1014
		return;
	tty->stopped = 0;
A
Alan Cox 已提交
1015
	if (tty->ops->start)
P
Peter Hurley 已提交
1016
		tty->ops->start(tty);
L
Linus Torvalds 已提交
1017 1018 1019
	tty_wakeup(tty);
}

1020 1021 1022 1023 1024 1025 1026 1027
void start_tty(struct tty_struct *tty)
{
	unsigned long flags;

	spin_lock_irqsave(&tty->flow_lock, flags);
	__start_tty(tty);
	spin_unlock_irqrestore(&tty->flow_lock, flags);
}
L
Linus Torvalds 已提交
1028 1029
EXPORT_SYMBOL(start_tty);

J
Jiri Slaby 已提交
1030 1031
static void tty_update_time(struct timespec *time)
{
1032
	unsigned long sec = get_seconds();
1033 1034 1035 1036 1037 1038 1039 1040

	/*
	 * We only care if the two values differ in anything other than the
	 * lower three bits (i.e every 8 seconds).  If so, then we can update
	 * the time of the tty device, otherwise it could be construded as a
	 * security leak to let userspace know the exact timing of the tty.
	 */
	if ((sec ^ time->tv_sec) & ~7)
J
Jiri Slaby 已提交
1041 1042 1043
		time->tv_sec = sec;
}

1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054
/**
 *	tty_read	-	read method for tty device files
 *	@file: pointer to tty file
 *	@buf: user buffer
 *	@count: size of user buffer
 *	@ppos: unused
 *
 *	Perform the read system call function on this terminal device. Checks
 *	for hung up devices before calling the line discipline method.
 *
 *	Locking:
A
Alan Cox 已提交
1055 1056
 *		Locks the line discipline internally while needed. Multiple
 *	read calls may be outstanding in parallel.
1057 1058
 */

1059
static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
L
Linus Torvalds 已提交
1060 1061 1062
			loff_t *ppos)
{
	int i;
J
Jiri Slaby 已提交
1063
	struct inode *inode = file_inode(file);
N
Nick Piggin 已提交
1064
	struct tty_struct *tty = file_tty(file);
L
Linus Torvalds 已提交
1065 1066
	struct tty_ldisc *ld;

J
Jiri Slaby 已提交
1067
	if (tty_paranoia_check(tty, inode, "tty_read"))
L
Linus Torvalds 已提交
1068 1069 1070 1071 1072 1073 1074
		return -EIO;
	if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
		return -EIO;

	/* We want to wait for the line discipline to sort out in this
	   situation */
	ld = tty_ldisc_ref_wait(tty);
1075 1076
	if (!ld)
		return hung_up_tty_read(file, buf, count, ppos);
A
Alan Cox 已提交
1077
	if (ld->ops->read)
P
Peter Hurley 已提交
1078
		i = ld->ops->read(tty, file, buf, count);
L
Linus Torvalds 已提交
1079 1080 1081
	else
		i = -EIO;
	tty_ldisc_deref(ld);
1082

J
Jiri Slaby 已提交
1083 1084 1085
	if (i > 0)
		tty_update_time(&inode->i_atime);

L
Linus Torvalds 已提交
1086 1087 1088
	return i;
}

1089
static void tty_write_unlock(struct tty_struct *tty)
1090 1091
{
	mutex_unlock(&tty->atomic_write_lock);
1092
	wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
1093 1094
}

1095
static int tty_write_lock(struct tty_struct *tty, int ndelay)
1096 1097 1098 1099 1100 1101 1102 1103 1104 1105
{
	if (!mutex_trylock(&tty->atomic_write_lock)) {
		if (ndelay)
			return -EAGAIN;
		if (mutex_lock_interruptible(&tty->atomic_write_lock))
			return -ERESTARTSYS;
	}
	return 0;
}

L
Linus Torvalds 已提交
1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116
/*
 * Split writes up in sane blocksizes to avoid
 * denial-of-service type attacks
 */
static inline ssize_t do_tty_write(
	ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
	struct tty_struct *tty,
	struct file *file,
	const char __user *buf,
	size_t count)
{
1117
	ssize_t ret, written = 0;
L
Linus Torvalds 已提交
1118
	unsigned int chunk;
1119

1120 1121 1122
	ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
	if (ret < 0)
		return ret;
L
Linus Torvalds 已提交
1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135

	/*
	 * We chunk up writes into a temporary buffer. This
	 * simplifies low-level drivers immensely, since they
	 * don't have locking issues and user mode accesses.
	 *
	 * But if TTY_NO_WRITE_SPLIT is set, we should use a
	 * big chunk-size..
	 *
	 * The default chunk-size is 2kB, because the NTTY
	 * layer has problems with bigger chunks. It will
	 * claim to be able to handle more characters than
	 * it actually does.
1136 1137 1138
	 *
	 * FIXME: This can probably go away now except that 64K chunks
	 * are too likely to fail unless switched to vmalloc...
L
Linus Torvalds 已提交
1139 1140 1141 1142 1143 1144 1145
	 */
	chunk = 2048;
	if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
		chunk = 65536;
	if (count < chunk)
		chunk = count;

I
Ingo Molnar 已提交
1146
	/* write_buf/write_cnt is protected by the atomic_write_lock mutex */
L
Linus Torvalds 已提交
1147
	if (tty->write_cnt < chunk) {
J
Jason Wessel 已提交
1148
		unsigned char *buf_chunk;
L
Linus Torvalds 已提交
1149 1150 1151 1152

		if (chunk < 1024)
			chunk = 1024;

J
Jason Wessel 已提交
1153 1154
		buf_chunk = kmalloc(chunk, GFP_KERNEL);
		if (!buf_chunk) {
1155 1156
			ret = -ENOMEM;
			goto out;
L
Linus Torvalds 已提交
1157 1158 1159
		}
		kfree(tty->write_buf);
		tty->write_cnt = chunk;
J
Jason Wessel 已提交
1160
		tty->write_buf = buf_chunk;
L
Linus Torvalds 已提交
1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183
	}

	/* Do the write .. */
	for (;;) {
		size_t size = count;
		if (size > chunk)
			size = chunk;
		ret = -EFAULT;
		if (copy_from_user(tty->write_buf, buf, size))
			break;
		ret = write(tty, file, tty->write_buf, size);
		if (ret <= 0)
			break;
		written += ret;
		buf += ret;
		count -= ret;
		if (!count)
			break;
		ret = -ERESTARTSYS;
		if (signal_pending(current))
			break;
		cond_resched();
	}
J
Jiri Slaby 已提交
1184 1185
	if (written) {
		tty_update_time(&file_inode(file)->i_mtime);
L
Linus Torvalds 已提交
1186
		ret = written;
J
Jiri Slaby 已提交
1187
	}
1188 1189
out:
	tty_write_unlock(tty);
L
Linus Torvalds 已提交
1190 1191 1192
	return ret;
}

1193 1194 1195 1196 1197 1198 1199 1200 1201
/**
 * tty_write_message - write a message to a certain tty, not just the console.
 * @tty: the destination tty_struct
 * @msg: the message to write
 *
 * This is used for messages that need to be redirected to a specific tty.
 * We don't put it into the syslog queue right now maybe in the future if
 * really needed.
 *
1202
 * We must still hold the BTM and test the CLOSING flag for the moment.
1203 1204 1205 1206 1207 1208
 */

void tty_write_message(struct tty_struct *tty, char *msg)
{
	if (tty) {
		mutex_lock(&tty->atomic_write_lock);
A
Alan Cox 已提交
1209
		tty_lock(tty);
1210
		if (tty->ops->write && tty->count > 0)
1211
			tty->ops->write(tty, msg, strlen(msg));
1212
		tty_unlock(tty);
1213 1214 1215 1216 1217
		tty_write_unlock(tty);
	}
	return;
}

L
Linus Torvalds 已提交
1218

1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231
/**
 *	tty_write		-	write method for tty device file
 *	@file: tty file pointer
 *	@buf: user data to write
 *	@count: bytes to write
 *	@ppos: unused
 *
 *	Write data to a tty device via the line discipline.
 *
 *	Locking:
 *		Locks the line discipline as required
 *		Writes to the tty driver are serialized by the atomic_write_lock
 *	and are then processed in chunks to the device. The line discipline
1232
 *	write method will not be invoked in parallel for each device.
1233 1234
 */

1235 1236
static ssize_t tty_write(struct file *file, const char __user *buf,
						size_t count, loff_t *ppos)
L
Linus Torvalds 已提交
1237
{
N
Nick Piggin 已提交
1238 1239
	struct tty_struct *tty = file_tty(file);
 	struct tty_ldisc *ld;
L
Linus Torvalds 已提交
1240
	ssize_t ret;
1241

A
Al Viro 已提交
1242
	if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
L
Linus Torvalds 已提交
1243
		return -EIO;
A
Alan Cox 已提交
1244
	if (!tty || !tty->ops->write ||
1245 1246
		(test_bit(TTY_IO_ERROR, &tty->flags)))
			return -EIO;
A
Alan Cox 已提交
1247 1248
	/* Short term debug to catch buggy drivers */
	if (tty->ops->write_room == NULL)
P
Peter Hurley 已提交
1249
		tty_err(tty, "missing write_room method\n");
1250
	ld = tty_ldisc_ref_wait(tty);
1251 1252
	if (!ld)
		return hung_up_tty_write(file, buf, count, ppos);
A
Alan Cox 已提交
1253
	if (!ld->ops->write)
L
Linus Torvalds 已提交
1254 1255
		ret = -EIO;
	else
A
Alan Cox 已提交
1256
		ret = do_tty_write(ld->ops->write, tty, file, buf, count);
L
Linus Torvalds 已提交
1257 1258 1259 1260
	tty_ldisc_deref(ld);
	return ret;
}

1261 1262
ssize_t redirected_tty_write(struct file *file, const char __user *buf,
						size_t count, loff_t *ppos)
L
Linus Torvalds 已提交
1263 1264 1265 1266
{
	struct file *p = NULL;

	spin_lock(&redirect_lock);
A
Al Viro 已提交
1267 1268
	if (redirect)
		p = get_file(redirect);
L
Linus Torvalds 已提交
1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279
	spin_unlock(&redirect_lock);

	if (p) {
		ssize_t res;
		res = vfs_write(p, buf, count, &p->f_pos);
		fput(p);
		return res;
	}
	return tty_write(file, buf, count, ppos);
}

1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292
/**
 *	tty_send_xchar	-	send priority character
 *
 *	Send a high priority character to the tty even if stopped
 *
 *	Locking: none for xchar method, write ordering for write method.
 */

int tty_send_xchar(struct tty_struct *tty, char ch)
{
	int	was_stopped = tty->stopped;

	if (tty->ops->send_xchar) {
1293
		down_read(&tty->termios_rwsem);
1294
		tty->ops->send_xchar(tty, ch);
1295
		up_read(&tty->termios_rwsem);
1296 1297 1298 1299 1300 1301
		return 0;
	}

	if (tty_write_lock(tty, 0) < 0)
		return -ERESTARTSYS;

1302
	down_read(&tty->termios_rwsem);
1303 1304 1305 1306 1307
	if (was_stopped)
		start_tty(tty);
	tty->ops->write(tty, &ch, 1);
	if (was_stopped)
		stop_tty(tty);
1308
	up_read(&tty->termios_rwsem);
1309 1310 1311 1312
	tty_write_unlock(tty);
	return 0;
}

L
Linus Torvalds 已提交
1313 1314
static char ptychar[] = "pqrstuvwxyzabcde";

1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326
/**
 *	pty_line_name	-	generate name for a pty
 *	@driver: the tty driver in use
 *	@index: the minor number
 *	@p: output buffer of at least 6 bytes
 *
 *	Generate a name from a driver reference and write it to the output
 *	buffer.
 *
 *	Locking: None
 */
static void pty_line_name(struct tty_driver *driver, int index, char *p)
L
Linus Torvalds 已提交
1327 1328 1329 1330
{
	int i = index + driver->name_base;
	/* ->name is initialized to "ttyp", but "tty" is expected */
	sprintf(p, "%s%c%x",
1331 1332
		driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
		ptychar[i >> 4 & 0xf], i & 0xf);
L
Linus Torvalds 已提交
1333 1334
}

1335
/**
A
Alan Cox 已提交
1336
 *	tty_line_name	-	generate name for a tty
1337 1338 1339 1340 1341
 *	@driver: the tty driver in use
 *	@index: the minor number
 *	@p: output buffer of at least 7 bytes
 *
 *	Generate a name from a driver reference and write it to the output
1342
 *	buffer.
1343 1344 1345
 *
 *	Locking: None
 */
1346
static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
L
Linus Torvalds 已提交
1347
{
1348
	if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1349
		return sprintf(p, "%s", driver->name);
1350
	else
1351 1352
		return sprintf(p, "%s%d", driver->name,
			       index + driver->name_base);
L
Linus Torvalds 已提交
1353 1354
}

1355 1356 1357 1358
/**
 *	tty_driver_lookup_tty() - find an existing tty, if any
 *	@driver: the driver for the tty
 *	@idx:	 the minor number
1359
 *
1360 1361
 *	Return the tty, if found. If not found, return NULL or ERR_PTR() if the
 *	driver lookup() method returns an error.
1362
 *
1363
 *	Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1364
 */
1365
static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1366
		struct inode *inode, int idx)
1367
{
1368 1369
	struct tty_struct *tty;

1370
	if (driver->ops->lookup)
1371 1372 1373
		tty = driver->ops->lookup(driver, inode, idx);
	else
		tty = driver->ttys[idx];
1374

1375 1376 1377
	if (!IS_ERR(tty))
		tty_kref_get(tty);
	return tty;
1378 1379
}

1380 1381 1382 1383 1384 1385 1386 1387
/**
 *	tty_init_termios	-  helper for termios setup
 *	@tty: the tty to set up
 *
 *	Initialise the termios structures for this tty. Thus runs under
 *	the tty_mutex currently so we can be relaxed about ordering.
 */

1388
void tty_init_termios(struct tty_struct *tty)
1389
{
A
Alan Cox 已提交
1390
	struct ktermios *tp;
1391 1392
	int idx = tty->index;

1393 1394 1395 1396 1397
	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
		tty->termios = tty->driver->init_termios;
	else {
		/* Check for lazy saved data */
		tp = tty->driver->termios[idx];
1398
		if (tp != NULL) {
1399
			tty->termios = *tp;
1400 1401
			tty->termios.c_line  = tty->driver->init_termios.c_line;
		} else
1402
			tty->termios = tty->driver->init_termios;
1403 1404
	}
	/* Compatibility until drivers always set this */
1405 1406
	tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
	tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1407
}
A
Alan Cox 已提交
1408
EXPORT_SYMBOL_GPL(tty_init_termios);
1409

1410 1411
int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
{
1412
	tty_init_termios(tty);
1413 1414 1415 1416 1417 1418 1419
	tty_driver_kref_get(driver);
	tty->count++;
	driver->ttys[tty->index] = tty;
	return 0;
}
EXPORT_SYMBOL_GPL(tty_standard_install);

1420
/**
A
Alan Cox 已提交
1421 1422 1423 1424 1425
 *	tty_driver_install_tty() - install a tty entry in the driver
 *	@driver: the driver for the tty
 *	@tty: the tty
 *
 *	Install a tty object into the driver tables. The tty->index field
1426 1427 1428
 *	will be set by the time this is called. This method is responsible
 *	for ensuring any need additional structures are allocated and
 *	configured.
A
Alan Cox 已提交
1429 1430 1431 1432 1433 1434
 *
 *	Locking: tty_mutex for now
 */
static int tty_driver_install_tty(struct tty_driver *driver,
						struct tty_struct *tty)
{
1435 1436
	return driver->ops->install ? driver->ops->install(driver, tty) :
		tty_standard_install(driver, tty);
A
Alan Cox 已提交
1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448
}

/**
 *	tty_driver_remove_tty() - remove a tty from the driver tables
 *	@driver: the driver for the tty
 *	@idx:	 the minor number
 *
 *	Remvoe a tty object from the driver tables. The tty->index field
 *	will be set by the time this is called.
 *
 *	Locking: tty_mutex for now
 */
1449
static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
A
Alan Cox 已提交
1450 1451 1452 1453 1454 1455 1456 1457 1458 1459
{
	if (driver->ops->remove)
		driver->ops->remove(driver, tty);
	else
		driver->ttys[tty->index] = NULL;
}

/*
 * 	tty_reopen()	- fast re-open of an open tty
 * 	@tty	- the tty to open
1460
 *
1461
 *	Return 0 on success, -errno on error.
1462
 *	Re-opens on master ptys are not allowed and return -EIO.
1463
 *
1464
 *	Locking: Caller must hold tty_lock
1465
 */
1466
static int tty_reopen(struct tty_struct *tty)
1467 1468 1469 1470
{
	struct tty_driver *driver = tty->driver;

	if (driver->type == TTY_DRIVER_TYPE_PTY &&
1471 1472
	    driver->subtype == PTY_TYPE_MASTER)
		return -EIO;
1473

1474 1475 1476
	if (!tty->count)
		return -EAGAIN;

1477 1478 1479
	if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
		return -EBUSY;

1480 1481
	tty->count++;

1482 1483
	if (!tty->ldisc)
		return tty_ldisc_reinit(tty, tty->termios.c_line);
1484 1485 1486 1487

	return 0;
}

1488
/**
1489
 *	tty_init_dev		-	initialise a tty device
1490 1491
 *	@driver: tty driver we are opening a device on
 *	@idx: device index
1492
 *	@ret_tty: returned tty structure
1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505
 *
 *	Prepare a tty device. This may not be a "new" clean device but
 *	could also be an active device. The pty drivers require special
 *	handling because of this.
 *
 *	Locking:
 *		The function is called under the tty_mutex, which
 *	protects us from the tty struct or driver itself going away.
 *
 *	On exit the tty device has the line discipline attached and
 *	a reference count of 1. If a pair was created for pty/tty use
 *	and the other was a pty master then it too has a reference count of 1.
 *
L
Linus Torvalds 已提交
1506
 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
I
Ingo Molnar 已提交
1507 1508
 * failed open.  The new code protects the open with a mutex, so it's
 * really quite straightforward.  The mutex locking can probably be
L
Linus Torvalds 已提交
1509 1510
 * relaxed for the (most common) case of reopening a tty.
 */
1511

1512
struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
L
Linus Torvalds 已提交
1513
{
1514
	struct tty_struct *tty;
1515
	int retval;
L
Linus Torvalds 已提交
1516 1517 1518 1519 1520

	/*
	 * First time open is complex, especially for PTY devices.
	 * This code guarantees that either everything succeeds and the
	 * TTY is ready for operation, or else the table slots are vacated
1521
	 * and the allocated memory released.  (Except that the termios
L
Linus Torvalds 已提交
1522 1523 1524
	 * and locked termios may be retained.)
	 */

1525 1526
	if (!try_module_get(driver->owner))
		return ERR_PTR(-ENODEV);
L
Linus Torvalds 已提交
1527

1528
	tty = alloc_tty_struct(driver, idx);
1529 1530 1531 1532
	if (!tty) {
		retval = -ENOMEM;
		goto err_module_put;
	}
L
Linus Torvalds 已提交
1533

A
Alan Cox 已提交
1534
	tty_lock(tty);
1535
	retval = tty_driver_install_tty(driver, tty);
1536
	if (retval < 0)
1537
		goto err_free_tty;
A
Alan Cox 已提交
1538

J
Jiri Slaby 已提交
1539 1540 1541
	if (!tty->port)
		tty->port = driver->ports[idx];

J
Jiri Slaby 已提交
1542 1543 1544 1545
	WARN_RATELIMIT(!tty->port,
			"%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
			__func__, tty->driver->name);

J
Jiri Slaby 已提交
1546 1547
	tty->port->itty = tty;

1548
	/*
L
Linus Torvalds 已提交
1549
	 * Structures all installed ... call the ldisc open routines.
1550 1551
	 * If we fail here just call release_tty to clean up.  No need
	 * to decrement the use counts, as release_tty doesn't care.
L
Linus Torvalds 已提交
1552
	 */
1553
	retval = tty_ldisc_setup(tty, tty->link);
1554
	if (retval)
1555
		goto err_release_tty;
A
Alan Cox 已提交
1556
	/* Return the tty locked so that it cannot vanish under the caller */
1557
	return tty;
L
Linus Torvalds 已提交
1558

1559
err_free_tty:
A
Alan Cox 已提交
1560
	tty_unlock(tty);
1561 1562
	free_tty_struct(tty);
err_module_put:
L
Linus Torvalds 已提交
1563
	module_put(driver->owner);
1564
	return ERR_PTR(retval);
L
Linus Torvalds 已提交
1565

1566
	/* call the tty release_tty routine to clean out this slot */
1567
err_release_tty:
A
Alan Cox 已提交
1568
	tty_unlock(tty);
P
Peter Hurley 已提交
1569 1570
	tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
			     retval, idx);
1571
	release_tty(tty, idx);
1572
	return ERR_PTR(retval);
L
Linus Torvalds 已提交
1573 1574
}

1575
static void tty_free_termios(struct tty_struct *tty)
A
Alan Cox 已提交
1576 1577 1578
{
	struct ktermios *tp;
	int idx = tty->index;
1579 1580 1581 1582 1583 1584 1585 1586 1587

	/* If the port is going to reset then it has no termios to save */
	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
		return;

	/* Stash the termios data */
	tp = tty->driver->termios[idx];
	if (tp == NULL) {
		tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1588
		if (tp == NULL)
1589
			return;
D
Dan Carpenter 已提交
1590
		tty->driver->termios[idx] = tp;
A
Alan Cox 已提交
1591
	}
1592
	*tp = tty->termios;
A
Alan Cox 已提交
1593 1594
}

1595
/**
1596 1597
 *	tty_flush_works		-	flush all works of a tty/pty pair
 *	@tty: tty device to flush works for (or either end of a pty pair)
1598
 *
1599
 *	Sync flush all works belonging to @tty (and the 'other' tty).
1600 1601 1602 1603 1604
 */
static void tty_flush_works(struct tty_struct *tty)
{
	flush_work(&tty->SAK_work);
	flush_work(&tty->hangup_work);
1605 1606 1607 1608
	if (tty->link) {
		flush_work(&tty->link->SAK_work);
		flush_work(&tty->link->hangup_work);
	}
1609
}
A
Alan Cox 已提交
1610

1611
/**
1612
 *	release_one_tty		-	release tty structure memory
A
Alan Cox 已提交
1613
 *	@kref: kref of tty we are obliterating
1614 1615 1616 1617 1618 1619 1620 1621
 *
 *	Releases memory associated with a tty structure, and clears out the
 *	driver table slots. This function is called when a device is no longer
 *	in use. It also gets called when setup of a device fails.
 *
 *	Locking:
 *		takes the file list lock internally when working on the list
 *	of ttys that the driver keeps.
1622 1623
 *
 *	This method gets called from a work queue so that the driver private
1624
 *	cleanup ops can sleep (needed for USB at least)
L
Linus Torvalds 已提交
1625
 */
1626
static void release_one_tty(struct work_struct *work)
L
Linus Torvalds 已提交
1627
{
1628 1629
	struct tty_struct *tty =
		container_of(work, struct tty_struct, hangup_work);
1630
	struct tty_driver *driver = tty->driver;
1631
	struct module *owner = driver->owner;
1632

1633 1634 1635
	if (tty->ops->cleanup)
		tty->ops->cleanup(tty);

L
Linus Torvalds 已提交
1636
	tty->magic = 0;
A
Alan Cox 已提交
1637
	tty_driver_kref_put(driver);
1638
	module_put(owner);
1639

N
Nick Piggin 已提交
1640
	spin_lock(&tty_files_lock);
L
Linus Torvalds 已提交
1641
	list_del_init(&tty->tty_files);
N
Nick Piggin 已提交
1642
	spin_unlock(&tty_files_lock);
1643

1644 1645
	put_pid(tty->pgrp);
	put_pid(tty->session);
L
Linus Torvalds 已提交
1646 1647 1648
	free_tty_struct(tty);
}

1649 1650 1651
static void queue_release_one_tty(struct kref *kref)
{
	struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1652

1653 1654 1655 1656 1657 1658
	/* The hangup queue is now free so we can reuse it rather than
	   waste a chunk of memory for each port */
	INIT_WORK(&tty->hangup_work, release_one_tty);
	schedule_work(&tty->hangup_work);
}

A
Alan Cox 已提交
1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669
/**
 *	tty_kref_put		-	release a tty kref
 *	@tty: tty device
 *
 *	Release a reference to a tty device and if need be let the kref
 *	layer destruct the object for us
 */

void tty_kref_put(struct tty_struct *tty)
{
	if (tty)
1670
		kref_put(&tty->kref, queue_release_one_tty);
A
Alan Cox 已提交
1671 1672 1673
}
EXPORT_SYMBOL(tty_kref_put);

1674 1675 1676 1677 1678 1679 1680
/**
 *	release_tty		-	release tty structure memory
 *
 *	Release both @tty and a possible linked partner (think pty pair),
 *	and decrement the refcount of the backing module.
 *
 *	Locking:
A
Alan Cox 已提交
1681
 *		tty_mutex
1682 1683
 *		takes the file list lock internally when working on the list
 *	of ttys that the driver keeps.
A
Alan Cox 已提交
1684
 *
1685 1686 1687
 */
static void release_tty(struct tty_struct *tty, int idx)
{
A
Alan Cox 已提交
1688 1689
	/* This should always be true but check for the moment */
	WARN_ON(tty->index != idx);
A
Alan Cox 已提交
1690
	WARN_ON(!mutex_is_locked(&tty_mutex));
1691 1692 1693 1694
	if (tty->ops->shutdown)
		tty->ops->shutdown(tty);
	tty_free_termios(tty);
	tty_driver_remove_tty(tty->driver, tty);
J
Jiri Slaby 已提交
1695
	tty->port->itty = NULL;
P
Peter Hurley 已提交
1696 1697
	if (tty->link)
		tty->link->port->itty = NULL;
P
Peter Hurley 已提交
1698
	tty_buffer_cancel_work(tty->port);
1699

1700
	tty_kref_put(tty->link);
A
Alan Cox 已提交
1701
	tty_kref_put(tty);
1702 1703
}

1704 1705 1706 1707 1708 1709 1710 1711 1712
/**
 *	tty_release_checks - check a tty before real release
 *	@tty: tty to check
 *	@o_tty: link of @tty (if any)
 *	@idx: index of the tty
 *
 *	Performs some paranoid checking before true release of the @tty.
 *	This is a no-op unless TTY_PARANOIA_CHECK is defined.
 */
1713
static int tty_release_checks(struct tty_struct *tty, int idx)
1714 1715 1716
{
#ifdef TTY_PARANOIA_CHECK
	if (idx < 0 || idx >= tty->driver->num) {
1717
		tty_debug(tty, "bad idx %d\n", idx);
1718 1719 1720 1721 1722 1723 1724 1725
		return -1;
	}

	/* not much to check for devpts */
	if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
		return 0;

	if (tty != tty->driver->ttys[idx]) {
1726 1727
		tty_debug(tty, "bad driver table[%d] = %p\n",
			  idx, tty->driver->ttys[idx]);
1728 1729 1730
		return -1;
	}
	if (tty->driver->other) {
1731 1732
		struct tty_struct *o_tty = tty->link;

1733
		if (o_tty != tty->driver->other->ttys[idx]) {
1734 1735
			tty_debug(tty, "bad other table[%d] = %p\n",
				  idx, tty->driver->other->ttys[idx]);
1736 1737 1738
			return -1;
		}
		if (o_tty->link != tty) {
1739
			tty_debug(tty, "bad link = %p\n", o_tty->link);
1740 1741 1742 1743 1744 1745 1746
			return -1;
		}
	}
#endif
	return 0;
}

1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757
/**
 *	tty_release		-	vfs callback for close
 *	@inode: inode of tty
 *	@filp: file pointer for handle to tty
 *
 *	Called the last time each file handle is closed that references
 *	this tty. There may however be several such references.
 *
 *	Locking:
 *		Takes bkl. See tty_release_dev
 *
L
Linus Torvalds 已提交
1758 1759 1760 1761 1762 1763 1764
 * Even releasing the tty structures is a tricky business.. We have
 * to be very careful that the structures are all released at the
 * same time, as interrupts might otherwise get the wrong pointers.
 *
 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
 * lead to double frees or releasing memory still in use.
 */
1765 1766

int tty_release(struct inode *inode, struct file *filp)
L
Linus Torvalds 已提交
1767
{
N
Nick Piggin 已提交
1768
	struct tty_struct *tty = file_tty(filp);
1769 1770
	struct tty_struct *o_tty = NULL;
	int	do_sleep, final;
L
Linus Torvalds 已提交
1771
	int	idx;
1772
	long	timeout = 0;
1773
	int	once = 1;
1774

J
Jiri Slaby 已提交
1775
	if (tty_paranoia_check(tty, inode, __func__))
1776
		return 0;
L
Linus Torvalds 已提交
1777

A
Alan Cox 已提交
1778
	tty_lock(tty);
J
Jiri Slaby 已提交
1779
	check_tty_count(tty, __func__);
L
Linus Torvalds 已提交
1780

1781
	__tty_fasync(-1, filp, 0);
L
Linus Torvalds 已提交
1782 1783

	idx = tty->index;
1784 1785 1786
	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
	    tty->driver->subtype == PTY_TYPE_MASTER)
		o_tty = tty->link;
L
Linus Torvalds 已提交
1787

1788
	if (tty_release_checks(tty, idx)) {
A
Alan Cox 已提交
1789
		tty_unlock(tty);
1790
		return 0;
L
Linus Torvalds 已提交
1791 1792
	}

1793
	tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
L
Linus Torvalds 已提交
1794

A
Alan Cox 已提交
1795 1796
	if (tty->ops->close)
		tty->ops->close(tty, filp);
L
Linus Torvalds 已提交
1797

1798 1799 1800
	/* If tty is pty master, lock the slave pty (stable lock order) */
	tty_lock_slave(o_tty);

L
Linus Torvalds 已提交
1801 1802 1803 1804 1805 1806 1807 1808 1809 1810
	/*
	 * Sanity check: if tty->count is going to zero, there shouldn't be
	 * any waiters on tty->read_wait or tty->write_wait.  We test the
	 * wait queues and kick everyone out _before_ actually starting to
	 * close.  This ensures that we won't block while releasing the tty
	 * structure.
	 *
	 * The test for the o_tty closing is necessary, since the master and
	 * slave sides may close in any order.  If the slave side closes out
	 * first, its count will be one, since the master side holds an open.
1811
	 * Thus this test wouldn't be triggered at the time the slave closed,
L
Linus Torvalds 已提交
1812 1813 1814 1815 1816
	 * so we do it now.
	 */
	while (1) {
		do_sleep = 0;

1817
		if (tty->count <= 1) {
L
Linus Torvalds 已提交
1818
			if (waitqueue_active(&tty->read_wait)) {
1819
				wake_up_poll(&tty->read_wait, POLLIN);
L
Linus Torvalds 已提交
1820 1821 1822
				do_sleep++;
			}
			if (waitqueue_active(&tty->write_wait)) {
1823
				wake_up_poll(&tty->write_wait, POLLOUT);
L
Linus Torvalds 已提交
1824 1825 1826
				do_sleep++;
			}
		}
1827
		if (o_tty && o_tty->count <= 1) {
L
Linus Torvalds 已提交
1828
			if (waitqueue_active(&o_tty->read_wait)) {
1829
				wake_up_poll(&o_tty->read_wait, POLLIN);
L
Linus Torvalds 已提交
1830 1831 1832
				do_sleep++;
			}
			if (waitqueue_active(&o_tty->write_wait)) {
1833
				wake_up_poll(&o_tty->write_wait, POLLOUT);
L
Linus Torvalds 已提交
1834 1835 1836 1837 1838 1839
				do_sleep++;
			}
		}
		if (!do_sleep)
			break;

1840 1841
		if (once) {
			once = 0;
P
Peter Hurley 已提交
1842
			tty_warn(tty, "read/write wait queue active!\n");
1843
		}
1844 1845 1846 1847 1848
		schedule_timeout_killable(timeout);
		if (timeout < 120 * HZ)
			timeout = 2 * timeout + 1;
		else
			timeout = MAX_SCHEDULE_TIMEOUT;
1849
	}
L
Linus Torvalds 已提交
1850

1851
	if (o_tty) {
L
Linus Torvalds 已提交
1852
		if (--o_tty->count < 0) {
P
Peter Hurley 已提交
1853
			tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
L
Linus Torvalds 已提交
1854 1855 1856 1857
			o_tty->count = 0;
		}
	}
	if (--tty->count < 0) {
P
Peter Hurley 已提交
1858
		tty_warn(tty, "bad tty->count (%d)\n", tty->count);
L
Linus Torvalds 已提交
1859 1860
		tty->count = 0;
	}
1861

L
Linus Torvalds 已提交
1862 1863 1864 1865 1866 1867 1868 1869 1870
	/*
	 * We've decremented tty->count, so we need to remove this file
	 * descriptor off the tty->tty_files list; this serves two
	 * purposes:
	 *  - check_tty_count sees the correct number of file descriptors
	 *    associated with this tty.
	 *  - do_tty_hangup no longer sees this file descriptor as
	 *    something that needs to be handled for hangups.
	 */
N
Nick Piggin 已提交
1871
	tty_del_file(filp);
L
Linus Torvalds 已提交
1872 1873 1874 1875 1876 1877 1878 1879

	/*
	 * Perform some housekeeping before deciding whether to return.
	 *
	 * If _either_ side is closing, make sure there aren't any
	 * processes that still think tty or o_tty is their controlling
	 * tty.
	 */
1880
	if (!tty->count) {
L
Linus Torvalds 已提交
1881
		read_lock(&tasklist_lock);
1882
		session_clear_tty(tty->session);
1883
		if (o_tty)
1884
			session_clear_tty(o_tty->session);
L
Linus Torvalds 已提交
1885 1886 1887
		read_unlock(&tasklist_lock);
	}

1888
	/* check whether both sides are closing ... */
1889
	final = !tty->count && !(o_tty && o_tty->count);
1890

1891 1892 1893
	tty_unlock_slave(o_tty);
	tty_unlock(tty);

P
Peter Hurley 已提交
1894
	/* At this point, the tty->count == 0 should ensure a dead tty
A
Alan Cox 已提交
1895
	   cannot be re-opened by a racing opener */
P
Paul Fulghum 已提交
1896

1897
	if (!final)
1898
		return 0;
1899

1900
	tty_debug_hangup(tty, "final close\n");
L
Linus Torvalds 已提交
1901
	/*
1902
	 * Ask the line discipline code to release its structures
L
Linus Torvalds 已提交
1903
	 */
1904
	tty_ldisc_release(tty);
1905 1906 1907 1908

	/* Wait for pending work before tty destruction commmences */
	tty_flush_works(tty);

1909
	tty_debug_hangup(tty, "freeing structure\n");
L
Linus Torvalds 已提交
1910
	/*
1911
	 * The release_tty function takes care of the details of clearing
A
Alan Cox 已提交
1912 1913 1914
	 * the slots and preserving the termios structure. The tty_unlock_pair
	 * should be safe as we keep a kref while the tty is locked (so the
	 * unlock never unlocks a freed tty).
L
Linus Torvalds 已提交
1915
	 */
A
Alan Cox 已提交
1916
	mutex_lock(&tty_mutex);
1917
	release_tty(tty, idx);
A
Alan Cox 已提交
1918
	mutex_unlock(&tty_mutex);
L
Linus Torvalds 已提交
1919

1920
	return 0;
L
Linus Torvalds 已提交
1921 1922
}

1923
/**
1924
 *	tty_open_current_tty - get locked tty of current task
1925 1926
 *	@device: device number
 *	@filp: file pointer to tty
1927 1928 1929
 *	@return: locked tty of the current task iff @device is /dev/tty
 *
 *	Performs a re-open of the current task's controlling tty.
1930 1931 1932 1933 1934 1935 1936
 *
 *	We cannot return driver and index like for the other nodes because
 *	devpts will not work then. It expects inodes to be from devpts FS.
 */
static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
{
	struct tty_struct *tty;
1937
	int retval;
1938 1939 1940 1941 1942 1943 1944 1945 1946 1947

	if (device != MKDEV(TTYAUX_MAJOR, 0))
		return NULL;

	tty = get_current_tty();
	if (!tty)
		return ERR_PTR(-ENXIO);

	filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
	/* noctty = 1; */
1948 1949 1950 1951 1952 1953 1954 1955
	tty_lock(tty);
	tty_kref_put(tty);	/* safe to drop the kref now */

	retval = tty_reopen(tty);
	if (retval < 0) {
		tty_unlock(tty);
		tty = ERR_PTR(retval);
	}
1956 1957 1958
	return tty;
}

1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972
/**
 *	tty_lookup_driver - lookup a tty driver for a given device file
 *	@device: device number
 *	@filp: file pointer to tty
 *	@noctty: set if the device should not become a controlling tty
 *	@index: index for the device in the @return driver
 *	@return: driver for this inode (with increased refcount)
 *
 * 	If @return is not erroneous, the caller is responsible to decrement the
 * 	refcount by tty_driver_kref_put.
 *
 *	Locking: tty_mutex protects get_tty_driver
 */
static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1973
		int *index)
1974 1975 1976
{
	struct tty_driver *driver;

1977
	switch (device) {
1978
#ifdef CONFIG_VT
1979
	case MKDEV(TTY_MAJOR, 0): {
1980 1981 1982
		extern struct tty_driver *console_driver;
		driver = tty_driver_kref_get(console_driver);
		*index = fg_console;
1983
		break;
1984 1985
	}
#endif
1986
	case MKDEV(TTYAUX_MAJOR, 1): {
1987 1988 1989 1990 1991 1992
		struct tty_driver *console_driver = console_device(index);
		if (console_driver) {
			driver = tty_driver_kref_get(console_driver);
			if (driver) {
				/* Don't let /dev/console block */
				filp->f_flags |= O_NONBLOCK;
1993
				break;
1994 1995 1996 1997
			}
		}
		return ERR_PTR(-ENODEV);
	}
1998 1999 2000 2001 2002 2003
	default:
		driver = get_tty_driver(device, index);
		if (!driver)
			return ERR_PTR(-ENODEV);
		break;
	}
2004 2005 2006
	return driver;
}

P
Peter Hurley 已提交
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069
/**
 *	tty_open_by_driver	-	open a tty device
 *	@device: dev_t of device to open
 *	@inode: inode of device file
 *	@filp: file pointer to tty
 *
 *	Performs the driver lookup, checks for a reopen, or otherwise
 *	performs the first-time tty initialization.
 *
 *	Returns the locked initialized or re-opened &tty_struct
 *
 *	Claims the global tty_mutex to serialize:
 *	  - concurrent first-time tty initialization
 *	  - concurrent tty driver removal w/ lookup
 *	  - concurrent tty removal from driver table
 */
static struct tty_struct *tty_open_by_driver(dev_t device, struct inode *inode,
					     struct file *filp)
{
	struct tty_struct *tty;
	struct tty_driver *driver = NULL;
	int index = -1;
	int retval;

	mutex_lock(&tty_mutex);
	driver = tty_lookup_driver(device, filp, &index);
	if (IS_ERR(driver)) {
		mutex_unlock(&tty_mutex);
		return ERR_CAST(driver);
	}

	/* check whether we're reopening an existing tty */
	tty = tty_driver_lookup_tty(driver, inode, index);
	if (IS_ERR(tty)) {
		mutex_unlock(&tty_mutex);
		goto out;
	}

	if (tty) {
		mutex_unlock(&tty_mutex);
		retval = tty_lock_interruptible(tty);
		if (retval) {
			if (retval == -EINTR)
				retval = -ERESTARTSYS;
			tty = ERR_PTR(retval);
			goto out;
		}
		/* safe to drop the kref from tty_driver_lookup_tty() */
		tty_kref_put(tty);
		retval = tty_reopen(tty);
		if (retval < 0) {
			tty_unlock(tty);
			tty = ERR_PTR(retval);
		}
	} else { /* Returns with the tty_lock held for now */
		tty = tty_init_dev(driver, index);
		mutex_unlock(&tty_mutex);
	}
out:
	tty_driver_kref_put(driver);
	return tty;
}

2070
/**
2071
 *	tty_open		-	open a tty device
2072 2073
 *	@inode: inode of device file
 *	@filp: file pointer to tty
L
Linus Torvalds 已提交
2074
 *
2075 2076 2077
 *	tty_open and tty_release keep up the tty count that contains the
 *	number of opens done on a tty. We cannot use the inode-count, as
 *	different inodes might point to the same tty.
L
Linus Torvalds 已提交
2078
 *
2079 2080 2081 2082 2083 2084 2085
 *	Open-counting is needed for pty masters, as well as for keeping
 *	track of serial lines: DTR is dropped when the last close happens.
 *	(This is not done solely through tty->count, now.  - Ted 1/27/92)
 *
 *	The termios state of a pty is reset on first open so that
 *	settings don't persist across reuse.
 *
2086
 *	Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2087 2088
 *		 tty->count should protect the rest.
 *		 ->siglock protects ->signal/->sighand
A
Alan Cox 已提交
2089 2090 2091
 *
 *	Note: the tty_unlock/lock cases without a ref are only safe due to
 *	tty_mutex
L
Linus Torvalds 已提交
2092
 */
2093

2094
static int tty_open(struct inode *inode, struct file *filp)
L
Linus Torvalds 已提交
2095
{
2096
	struct tty_struct *tty;
L
Linus Torvalds 已提交
2097 2098
	int noctty, retval;
	dev_t device = inode->i_rdev;
2099
	unsigned saved_flags = filp->f_flags;
L
Linus Torvalds 已提交
2100 2101

	nonseekable_open(inode, filp);
2102

L
Linus Torvalds 已提交
2103
retry_open:
J
Jiri Slaby 已提交
2104 2105 2106 2107
	retval = tty_alloc_file(filp);
	if (retval)
		return -ENOMEM;

2108
	tty = tty_open_current_tty(device, filp);
P
Peter Hurley 已提交
2109 2110
	if (!tty)
		tty = tty_open_by_driver(device, inode, filp);
2111

2112
	if (IS_ERR(tty)) {
P
Peter Hurley 已提交
2113
		tty_free_file(filp);
J
Jiri Slaby 已提交
2114
		retval = PTR_ERR(tty);
2115
		if (retval != -EAGAIN || signal_pending(current))
P
Peter Hurley 已提交
2116
			return retval;
2117 2118
		schedule();
		goto retry_open;
2119
	}
L
Linus Torvalds 已提交
2120

J
Jiri Slaby 已提交
2121
	tty_add_file(tty, filp);
N
Nick Piggin 已提交
2122

J
Jiri Slaby 已提交
2123
	check_tty_count(tty, __func__);
2124
	tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2125

2126 2127 2128 2129
	if (tty->ops->open)
		retval = tty->ops->open(tty, filp);
	else
		retval = -ENODEV;
L
Linus Torvalds 已提交
2130 2131 2132
	filp->f_flags = saved_flags;

	if (retval) {
2133
		tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2134

A
Alan Cox 已提交
2135
		tty_unlock(tty); /* need to call tty_release without BTM */
2136
		tty_release(inode, filp);
2137
		if (retval != -ERESTARTSYS)
L
Linus Torvalds 已提交
2138
			return retval;
2139 2140

		if (signal_pending(current))
L
Linus Torvalds 已提交
2141
			return retval;
2142

L
Linus Torvalds 已提交
2143 2144 2145 2146
		schedule();
		/*
		 * Need to reset f_op in case a hangup happened.
		 */
2147
		if (tty_hung_up_p(filp))
L
Linus Torvalds 已提交
2148 2149 2150
			filp->f_op = &tty_fops;
		goto retry_open;
	}
P
Peter Hurley 已提交
2151
	clear_bit(TTY_HUPPED, &tty->flags);
2152

2153

2154
	read_lock(&tasklist_lock);
2155
	spin_lock_irq(&current->sighand->siglock);
2156 2157 2158 2159 2160 2161
	noctty = (filp->f_flags & O_NOCTTY) ||
			device == MKDEV(TTY_MAJOR, 0) ||
			device == MKDEV(TTYAUX_MAJOR, 1) ||
			(tty->driver->type == TTY_DRIVER_TYPE_PTY &&
			 tty->driver->subtype == PTY_TYPE_MASTER);

L
Linus Torvalds 已提交
2162 2163 2164
	if (!noctty &&
	    current->signal->leader &&
	    !current->signal->tty &&
2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182
	    tty->session == NULL) {
		/*
		 * Don't let a process that only has write access to the tty
		 * obtain the privileges associated with having a tty as
		 * controlling terminal (being able to reopen it with full
		 * access through /dev/tty, being able to perform pushback).
		 * Many distributions set the group of all ttys to "tty" and
		 * grant write-only access to all terminals for setgid tty
		 * binaries, which should not imply full privileges on all ttys.
		 *
		 * This could theoretically break old code that performs open()
		 * on a write-only file descriptor. In that case, it might be
		 * necessary to also permit this if
		 * inode_permission(inode, MAY_READ) == 0.
		 */
		if (filp->f_mode & FMODE_READ)
			__proc_set_tty(tty);
	}
2183
	spin_unlock_irq(&current->sighand->siglock);
2184
	read_unlock(&tasklist_lock);
A
Alan Cox 已提交
2185
	tty_unlock(tty);
L
Linus Torvalds 已提交
2186 2187 2188
	return 0;
}

2189 2190


2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202
/**
 *	tty_poll	-	check tty status
 *	@filp: file being polled
 *	@wait: poll wait structures to update
 *
 *	Call the line discipline polling method to obtain the poll
 *	status of the device.
 *
 *	Locking: locks called line discipline but ldisc poll method
 *	may be re-entered freely by other callers.
 */

2203
static unsigned int tty_poll(struct file *filp, poll_table *wait)
L
Linus Torvalds 已提交
2204
{
N
Nick Piggin 已提交
2205
	struct tty_struct *tty = file_tty(filp);
L
Linus Torvalds 已提交
2206 2207 2208
	struct tty_ldisc *ld;
	int ret = 0;

A
Al Viro 已提交
2209
	if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
L
Linus Torvalds 已提交
2210
		return 0;
2211

L
Linus Torvalds 已提交
2212
	ld = tty_ldisc_ref_wait(tty);
2213 2214
	if (!ld)
		return hung_up_tty_poll(filp, wait);
A
Alan Cox 已提交
2215
	if (ld->ops->poll)
P
Peter Hurley 已提交
2216
		ret = ld->ops->poll(tty, filp, wait);
L
Linus Torvalds 已提交
2217 2218 2219 2220
	tty_ldisc_deref(ld);
	return ret;
}

2221
static int __tty_fasync(int fd, struct file *filp, int on)
L
Linus Torvalds 已提交
2222
{
N
Nick Piggin 已提交
2223
	struct tty_struct *tty = file_tty(filp);
2224
	struct tty_ldisc *ldisc;
A
Alan Cox 已提交
2225
	unsigned long flags;
J
Jonathan Corbet 已提交
2226
	int retval = 0;
L
Linus Torvalds 已提交
2227

A
Al Viro 已提交
2228
	if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
J
Jonathan Corbet 已提交
2229
		goto out;
2230

L
Linus Torvalds 已提交
2231 2232
	retval = fasync_helper(fd, filp, on, &tty->fasync);
	if (retval <= 0)
J
Jonathan Corbet 已提交
2233
		goto out;
L
Linus Torvalds 已提交
2234

2235 2236 2237 2238 2239 2240 2241
	ldisc = tty_ldisc_ref(tty);
	if (ldisc) {
		if (ldisc->ops->fasync)
			ldisc->ops->fasync(tty, on);
		tty_ldisc_deref(ldisc);
	}

L
Linus Torvalds 已提交
2242
	if (on) {
2243 2244
		enum pid_type type;
		struct pid *pid;
2245

A
Alan Cox 已提交
2246
		spin_lock_irqsave(&tty->ctrl_lock, flags);
2247 2248 2249 2250 2251 2252 2253
		if (tty->pgrp) {
			pid = tty->pgrp;
			type = PIDTYPE_PGID;
		} else {
			pid = task_pid(current);
			type = PIDTYPE_PID;
		}
2254
		get_pid(pid);
G
Greg Kroah-Hartman 已提交
2255
		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2256
		__f_setown(filp, pid, type, 0);
2257
		put_pid(pid);
2258
		retval = 0;
L
Linus Torvalds 已提交
2259
	}
J
Jonathan Corbet 已提交
2260
out:
2261 2262 2263 2264 2265
	return retval;
}

static int tty_fasync(int fd, struct file *filp, int on)
{
A
Alan Cox 已提交
2266
	struct tty_struct *tty = file_tty(filp);
2267
	int retval;
A
Alan Cox 已提交
2268 2269

	tty_lock(tty);
2270
	retval = __tty_fasync(fd, filp, on);
A
Alan Cox 已提交
2271 2272
	tty_unlock(tty);

J
Jonathan Corbet 已提交
2273
	return retval;
L
Linus Torvalds 已提交
2274 2275
}

2276 2277 2278 2279 2280
/**
 *	tiocsti			-	fake input character
 *	@tty: tty to fake input into
 *	@p: pointer to character
 *
2281
 *	Fake input to a tty device. Does the necessary locking and
2282 2283 2284 2285 2286
 *	input management.
 *
 *	FIXME: does not honour flow control ??
 *
 *	Locking:
2287
 *		Called functions take tty_ldiscs_lock
2288
 *		current->signal->tty check is safe without locks
2289 2290
 *
 *	FIXME: may race normal receive processing
2291 2292
 */

L
Linus Torvalds 已提交
2293 2294 2295 2296
static int tiocsti(struct tty_struct *tty, char __user *p)
{
	char ch, mbz = 0;
	struct tty_ldisc *ld;
2297

L
Linus Torvalds 已提交
2298 2299 2300 2301
	if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
		return -EPERM;
	if (get_user(ch, p))
		return -EFAULT;
A
Al Viro 已提交
2302
	tty_audit_tiocsti(tty, ch);
L
Linus Torvalds 已提交
2303
	ld = tty_ldisc_ref_wait(tty);
2304 2305
	if (!ld)
		return -EIO;
A
Alan Cox 已提交
2306
	ld->ops->receive_buf(tty, &ch, &mbz, 1);
L
Linus Torvalds 已提交
2307 2308 2309 2310
	tty_ldisc_deref(ld);
	return 0;
}

2311 2312 2313 2314 2315
/**
 *	tiocgwinsz		-	implement window query ioctl
 *	@tty; tty
 *	@arg: user buffer for result
 *
A
Alan Cox 已提交
2316
 *	Copies the kernel idea of the window size into the user buffer.
2317
 *
2318
 *	Locking: tty->winsize_mutex is taken to ensure the winsize data
A
Alan Cox 已提交
2319
 *		is consistent.
2320 2321
 */

2322
static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
L
Linus Torvalds 已提交
2323
{
A
Alan Cox 已提交
2324 2325
	int err;

2326
	mutex_lock(&tty->winsize_mutex);
A
Alan Cox 已提交
2327
	err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2328
	mutex_unlock(&tty->winsize_mutex);
A
Alan Cox 已提交
2329 2330

	return err ? -EFAULT: 0;
L
Linus Torvalds 已提交
2331 2332
}

2333
/**
2334 2335 2336 2337 2338
 *	tty_do_resize		-	resize event
 *	@tty: tty being resized
 *	@rows: rows (character)
 *	@cols: cols (character)
 *
D
Daniel Mack 已提交
2339
 *	Update the termios variables and send the necessary signals to
2340
 *	peform a terminal resize correctly
2341 2342
 */

A
Alan Cox 已提交
2343
int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
L
Linus Torvalds 已提交
2344
{
A
Alan Cox 已提交
2345
	struct pid *pgrp;
L
Linus Torvalds 已提交
2346

A
Alan Cox 已提交
2347
	/* Lock the tty */
2348
	mutex_lock(&tty->winsize_mutex);
A
Alan Cox 已提交
2349
	if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
A
Alan Cox 已提交
2350
		goto done;
A
Alan Cox 已提交
2351

2352 2353
	/* Signal the foreground process group */
	pgrp = tty_get_pgrp(tty);
A
Alan Cox 已提交
2354 2355 2356 2357
	if (pgrp)
		kill_pgrp(pgrp, SIGWINCH, 1);
	put_pid(pgrp);

2358
	tty->winsize = *ws;
A
Alan Cox 已提交
2359
done:
2360
	mutex_unlock(&tty->winsize_mutex);
L
Linus Torvalds 已提交
2361 2362
	return 0;
}
2363
EXPORT_SYMBOL(tty_do_resize);
L
Linus Torvalds 已提交
2364

2365 2366
/**
 *	tiocswinsz		-	implement window size set ioctl
A
Alan Cox 已提交
2367
 *	@tty; tty side of tty
2368 2369 2370 2371 2372 2373 2374
 *	@arg: user buffer for result
 *
 *	Copies the user idea of the window size to the kernel. Traditionally
 *	this is just advisory information but for the Linux console it
 *	actually has driver level meaning and triggers a VC resize.
 *
 *	Locking:
L
Lucas De Marchi 已提交
2375
 *		Driver dependent. The default do_resize method takes the
2376 2377 2378 2379
 *	tty termios mutex and ctrl_lock. The console takes its own lock
 *	then calls into the default method.
 */

A
Alan Cox 已提交
2380
static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2381 2382 2383 2384 2385 2386
{
	struct winsize tmp_ws;
	if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
		return -EFAULT;

	if (tty->ops->resize)
A
Alan Cox 已提交
2387
		return tty->ops->resize(tty, &tmp_ws);
2388
	else
A
Alan Cox 已提交
2389
		return tty_do_resize(tty, &tmp_ws);
2390 2391
}

2392 2393 2394 2395
/**
 *	tioccons	-	allow admin to move logical console
 *	@file: the file to become console
 *
L
Lucas De Marchi 已提交
2396
 *	Allow the administrator to move the redirected console device
2397 2398 2399 2400
 *
 *	Locking: uses redirect_lock to guard the redirect information
 */

L
Linus Torvalds 已提交
2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419
static int tioccons(struct file *file)
{
	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;
	if (file->f_op->write == redirected_tty_write) {
		struct file *f;
		spin_lock(&redirect_lock);
		f = redirect;
		redirect = NULL;
		spin_unlock(&redirect_lock);
		if (f)
			fput(f);
		return 0;
	}
	spin_lock(&redirect_lock);
	if (redirect) {
		spin_unlock(&redirect_lock);
		return -EBUSY;
	}
A
Al Viro 已提交
2420
	redirect = get_file(file);
L
Linus Torvalds 已提交
2421 2422 2423 2424
	spin_unlock(&redirect_lock);
	return 0;
}

2425 2426 2427 2428 2429 2430 2431 2432 2433
/**
 *	fionbio		-	non blocking ioctl
 *	@file: file to set blocking value
 *	@p: user parameter
 *
 *	Historical tty interfaces had a blocking control ioctl before
 *	the generic functionality existed. This piece of history is preserved
 *	in the expected tty API of posix OS's.
 *
A
Alan Cox 已提交
2434
 *	Locking: none, the open file handle ensures it won't go away.
2435
 */
L
Linus Torvalds 已提交
2436 2437 2438 2439 2440 2441 2442 2443

static int fionbio(struct file *file, int __user *p)
{
	int nonblock;

	if (get_user(nonblock, p))
		return -EFAULT;

J
Jonathan Corbet 已提交
2444
	spin_lock(&file->f_lock);
L
Linus Torvalds 已提交
2445 2446 2447 2448
	if (nonblock)
		file->f_flags |= O_NONBLOCK;
	else
		file->f_flags &= ~O_NONBLOCK;
J
Jonathan Corbet 已提交
2449
	spin_unlock(&file->f_lock);
L
Linus Torvalds 已提交
2450 2451 2452
	return 0;
}

2453 2454 2455 2456 2457 2458 2459 2460 2461
/**
 *	tiocsctty	-	set controlling tty
 *	@tty: tty structure
 *	@arg: user argument
 *
 *	This ioctl is used to manage job control. It permits a session
 *	leader to set this tty as the controlling tty for the session.
 *
 *	Locking:
2462
 *		Takes tty_lock() to serialize proc_set_tty() for this tty
2463 2464
 *		Takes tasklist_lock internally to walk sessions
 *		Takes ->siglock() when updating signal->tty
2465 2466
 */

2467
static int tiocsctty(struct tty_struct *tty, struct file *file, int arg)
L
Linus Torvalds 已提交
2468
{
2469 2470
	int ret = 0;

2471
	tty_lock(tty);
2472 2473 2474 2475 2476
	read_lock(&tasklist_lock);

	if (current->signal->leader && (task_session(current) == tty->session))
		goto unlock;

L
Linus Torvalds 已提交
2477 2478 2479 2480
	/*
	 * The process must be a session leader and
	 * not have a controlling tty already.
	 */
2481 2482 2483 2484 2485
	if (!current->signal->leader || current->signal->tty) {
		ret = -EPERM;
		goto unlock;
	}

2486
	if (tty->session) {
L
Linus Torvalds 已提交
2487 2488 2489 2490
		/*
		 * This tty is already the controlling
		 * tty for another session group!
		 */
2491
		if (arg == 1 && capable(CAP_SYS_ADMIN)) {
L
Linus Torvalds 已提交
2492 2493 2494
			/*
			 * Steal it away
			 */
2495 2496 2497 2498 2499
			session_clear_tty(tty->session);
		} else {
			ret = -EPERM;
			goto unlock;
		}
L
Linus Torvalds 已提交
2500
	}
2501 2502 2503 2504 2505 2506 2507

	/* See the comment in tty_open(). */
	if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) {
		ret = -EPERM;
		goto unlock;
	}

2508
	proc_set_tty(tty);
2509
unlock:
2510
	read_unlock(&tasklist_lock);
2511
	tty_unlock(tty);
2512
	return ret;
L
Linus Torvalds 已提交
2513 2514
}

2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535
/**
 *	tty_get_pgrp	-	return a ref counted pgrp pid
 *	@tty: tty to read
 *
 *	Returns a refcounted instance of the pid struct for the process
 *	group controlling the tty.
 */

struct pid *tty_get_pgrp(struct tty_struct *tty)
{
	unsigned long flags;
	struct pid *pgrp;

	spin_lock_irqsave(&tty->ctrl_lock, flags);
	pgrp = get_pid(tty->pgrp);
	spin_unlock_irqrestore(&tty->ctrl_lock, flags);

	return pgrp;
}
EXPORT_SYMBOL_GPL(tty_get_pgrp);

2536 2537 2538 2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554 2555 2556
/*
 * This checks not only the pgrp, but falls back on the pid if no
 * satisfactory pgrp is found. I dunno - gdb doesn't work correctly
 * without this...
 *
 * The caller must hold rcu lock or the tasklist lock.
 */
static struct pid *session_of_pgrp(struct pid *pgrp)
{
	struct task_struct *p;
	struct pid *sid = NULL;

	p = pid_task(pgrp, PIDTYPE_PGID);
	if (p == NULL)
		p = pid_task(pgrp, PIDTYPE_PID);
	if (p != NULL)
		sid = task_session(p);

	return sid;
}

2557 2558 2559
/**
 *	tiocgpgrp		-	get process group
 *	@tty: tty passed by user
L
Lucas De Marchi 已提交
2560
 *	@real_tty: tty side of the tty passed by the user if a pty else the tty
2561 2562 2563 2564 2565
 *	@p: returned pid
 *
 *	Obtain the process group of the tty. If there is no process group
 *	return an error.
 *
2566
 *	Locking: none. Reference to current->signal->tty is safe.
2567 2568
 */

L
Linus Torvalds 已提交
2569 2570
static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
{
2571 2572
	struct pid *pid;
	int ret;
L
Linus Torvalds 已提交
2573 2574 2575 2576 2577 2578
	/*
	 * (tty == real_tty) is a cheap way of
	 * testing if the tty is NOT a master pty.
	 */
	if (tty == real_tty && current->signal->tty != real_tty)
		return -ENOTTY;
2579 2580 2581 2582
	pid = tty_get_pgrp(real_tty);
	ret =  put_user(pid_vnr(pid), p);
	put_pid(pid);
	return ret;
L
Linus Torvalds 已提交
2583 2584
}

2585 2586 2587 2588 2589 2590 2591 2592 2593
/**
 *	tiocspgrp		-	attempt to set process group
 *	@tty: tty passed by user
 *	@real_tty: tty side device matching tty passed by user
 *	@p: pid pointer
 *
 *	Set the process group of the tty to the session passed. Only
 *	permitted where the tty session is our session.
 *
A
Alan Cox 已提交
2594
 *	Locking: RCU, ctrl lock
2595 2596
 */

L
Linus Torvalds 已提交
2597 2598
static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
{
2599 2600
	struct pid *pgrp;
	pid_t pgrp_nr;
L
Linus Torvalds 已提交
2601 2602 2603 2604 2605 2606 2607 2608
	int retval = tty_check_change(real_tty);

	if (retval == -EIO)
		return -ENOTTY;
	if (retval)
		return retval;
	if (!current->signal->tty ||
	    (current->signal->tty != real_tty) ||
2609
	    (real_tty->session != task_session(current)))
L
Linus Torvalds 已提交
2610
		return -ENOTTY;
2611
	if (get_user(pgrp_nr, p))
L
Linus Torvalds 已提交
2612
		return -EFAULT;
2613
	if (pgrp_nr < 0)
L
Linus Torvalds 已提交
2614
		return -EINVAL;
2615
	rcu_read_lock();
2616
	pgrp = find_vpid(pgrp_nr);
2617 2618 2619 2620 2621 2622 2623
	retval = -ESRCH;
	if (!pgrp)
		goto out_unlock;
	retval = -EPERM;
	if (session_of_pgrp(pgrp) != task_session(current))
		goto out_unlock;
	retval = 0;
2624
	spin_lock_irq(&tty->ctrl_lock);
2625 2626
	put_pid(real_tty->pgrp);
	real_tty->pgrp = get_pid(pgrp);
2627
	spin_unlock_irq(&tty->ctrl_lock);
2628 2629 2630
out_unlock:
	rcu_read_unlock();
	return retval;
L
Linus Torvalds 已提交
2631 2632
}

2633 2634 2635
/**
 *	tiocgsid		-	get session id
 *	@tty: tty passed by user
L
Lucas De Marchi 已提交
2636
 *	@real_tty: tty side of the tty passed by the user if a pty else the tty
2637 2638 2639 2640 2641
 *	@p: pointer to returned session id
 *
 *	Obtain the session id of the tty. If there is no session
 *	return an error.
 *
2642
 *	Locking: none. Reference to current->signal->tty is safe.
2643 2644
 */

L
Linus Torvalds 已提交
2645 2646 2647 2648 2649 2650 2651 2652
static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
{
	/*
	 * (tty == real_tty) is a cheap way of
	 * testing if the tty is NOT a master pty.
	*/
	if (tty == real_tty && current->signal->tty != real_tty)
		return -ENOTTY;
2653
	if (!real_tty->session)
L
Linus Torvalds 已提交
2654
		return -ENOTTY;
2655
	return put_user(pid_vnr(real_tty->session), p);
L
Linus Torvalds 已提交
2656 2657
}

2658 2659 2660 2661 2662 2663 2664 2665 2666 2667
/**
 *	tiocsetd	-	set line discipline
 *	@tty: tty device
 *	@p: pointer to user data
 *
 *	Set the line discipline according to user request.
 *
 *	Locking: see tty_set_ldisc, this function is just a helper
 */

L
Linus Torvalds 已提交
2668 2669
static int tiocsetd(struct tty_struct *tty, int __user *p)
{
2670
	int disc;
A
Alan Cox 已提交
2671
	int ret;
L
Linus Torvalds 已提交
2672

2673
	if (get_user(disc, p))
L
Linus Torvalds 已提交
2674
		return -EFAULT;
A
Alan Cox 已提交
2675

2676
	ret = tty_set_ldisc(tty, disc);
A
Alan Cox 已提交
2677 2678

	return ret;
L
Linus Torvalds 已提交
2679 2680
}

2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697
/**
 *	tiocgetd	-	get line discipline
 *	@tty: tty device
 *	@p: pointer to user data
 *
 *	Retrieves the line discipline id directly from the ldisc.
 *
 *	Locking: waits for ldisc reference (in case the line discipline
 *		is changing or the tty is being hungup)
 */

static int tiocgetd(struct tty_struct *tty, int __user *p)
{
	struct tty_ldisc *ld;
	int ret;

	ld = tty_ldisc_ref_wait(tty);
2698 2699
	if (!ld)
		return -EIO;
2700 2701 2702 2703 2704
	ret = put_user(ld->ops->num, p);
	tty_ldisc_deref(ld);
	return ret;
}

2705 2706 2707 2708 2709 2710 2711 2712 2713
/**
 *	send_break	-	performed time break
 *	@tty: device to break on
 *	@duration: timeout in mS
 *
 *	Perform a timed break on hardware that lacks its own driver level
 *	timed break functionality.
 *
 *	Locking:
2714
 *		atomic_write_lock serializes
2715 2716 2717
 *
 */

2718
static int send_break(struct tty_struct *tty, unsigned int duration)
L
Linus Torvalds 已提交
2719
{
A
Alan Cox 已提交
2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742
	int retval;

	if (tty->ops->break_ctl == NULL)
		return 0;

	if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
		retval = tty->ops->break_ctl(tty, duration);
	else {
		/* Do the work ourselves */
		if (tty_write_lock(tty, 0) < 0)
			return -EINTR;
		retval = tty->ops->break_ctl(tty, -1);
		if (retval)
			goto out;
		if (!signal_pending(current))
			msleep_interruptible(duration);
		retval = tty->ops->break_ctl(tty, 0);
out:
		tty_write_unlock(tty);
		if (signal_pending(current))
			retval = -EINTR;
	}
	return retval;
L
Linus Torvalds 已提交
2743 2744
}

2745
/**
A
Alan Cox 已提交
2746
 *	tty_tiocmget		-	get modem status
2747 2748 2749 2750 2751 2752 2753 2754 2755 2756
 *	@tty: tty device
 *	@file: user file pointer
 *	@p: pointer to result
 *
 *	Obtain the modem status bits from the tty driver if the feature
 *	is supported. Return -EINVAL if it is not available.
 *
 *	Locking: none (up to the driver)
 */

2757
static int tty_tiocmget(struct tty_struct *tty, int __user *p)
L
Linus Torvalds 已提交
2758 2759 2760
{
	int retval = -EINVAL;

A
Alan Cox 已提交
2761
	if (tty->ops->tiocmget) {
2762
		retval = tty->ops->tiocmget(tty);
L
Linus Torvalds 已提交
2763 2764 2765 2766 2767 2768 2769

		if (retval >= 0)
			retval = put_user(retval, p);
	}
	return retval;
}

2770
/**
A
Alan Cox 已提交
2771
 *	tty_tiocmset		-	set modem status
2772 2773 2774 2775 2776 2777 2778 2779 2780 2781
 *	@tty: tty device
 *	@cmd: command - clear bits, set bits or set all
 *	@p: pointer to desired bits
 *
 *	Set the modem status bits from the tty driver if the feature
 *	is supported. Return -EINVAL if it is not available.
 *
 *	Locking: none (up to the driver)
 */

2782
static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
L
Linus Torvalds 已提交
2783 2784
	     unsigned __user *p)
{
A
Alan Cox 已提交
2785 2786
	int retval;
	unsigned int set, clear, val;
L
Linus Torvalds 已提交
2787

A
Alan Cox 已提交
2788 2789
	if (tty->ops->tiocmset == NULL)
		return -EINVAL;
L
Linus Torvalds 已提交
2790

A
Alan Cox 已提交
2791 2792 2793 2794 2795 2796 2797 2798 2799 2800 2801 2802 2803 2804 2805 2806 2807 2808
	retval = get_user(val, p);
	if (retval)
		return retval;
	set = clear = 0;
	switch (cmd) {
	case TIOCMBIS:
		set = val;
		break;
	case TIOCMBIC:
		clear = val;
		break;
	case TIOCMSET:
		set = val;
		clear = ~val;
		break;
	}
	set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
	clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2809
	return tty->ops->tiocmset(tty, set, clear);
L
Linus Torvalds 已提交
2810 2811
}

A
Alan Cox 已提交
2812 2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825
static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
{
	int retval = -EINVAL;
	struct serial_icounter_struct icount;
	memset(&icount, 0, sizeof(icount));
	if (tty->ops->get_icount)
		retval = tty->ops->get_icount(tty, &icount);
	if (retval != 0)
		return retval;
	if (copy_to_user(arg, &icount, sizeof(icount)))
		return -EFAULT;
	return 0;
}

J
Jiri Slaby 已提交
2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843
static void tty_warn_deprecated_flags(struct serial_struct __user *ss)
{
	static DEFINE_RATELIMIT_STATE(depr_flags,
			DEFAULT_RATELIMIT_INTERVAL,
			DEFAULT_RATELIMIT_BURST);
	char comm[TASK_COMM_LEN];
	int flags;

	if (get_user(flags, &ss->flags))
		return;

	flags &= ASYNC_DEPRECATED;

	if (flags && __ratelimit(&depr_flags))
		pr_warning("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
				__func__, get_task_comm(comm, current), flags);
}

2844 2845 2846 2847 2848
/*
 * if pty, return the slave side (real_tty)
 * otherwise, return self
 */
static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2849 2850 2851 2852 2853 2854 2855
{
	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
	    tty->driver->subtype == PTY_TYPE_MASTER)
		tty = tty->link;
	return tty;
}

L
Linus Torvalds 已提交
2856 2857 2858
/*
 * Split this up, as gcc can choke on it otherwise..
 */
A
Alan Cox 已提交
2859
long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
L
Linus Torvalds 已提交
2860
{
N
Nick Piggin 已提交
2861 2862
	struct tty_struct *tty = file_tty(file);
	struct tty_struct *real_tty;
L
Linus Torvalds 已提交
2863 2864 2865
	void __user *p = (void __user *)arg;
	int retval;
	struct tty_ldisc *ld;
2866

A
Al Viro 已提交
2867
	if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
L
Linus Torvalds 已提交
2868 2869
		return -EINVAL;

2870
	real_tty = tty_pair_get_tty(tty);
L
Linus Torvalds 已提交
2871 2872 2873 2874 2875 2876 2877 2878 2879

	/*
	 * Factor out some common prep work
	 */
	switch (cmd) {
	case TIOCSETD:
	case TIOCSBRK:
	case TIOCCBRK:
	case TCSBRK:
2880
	case TCSBRKP:
L
Linus Torvalds 已提交
2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891
		retval = tty_check_change(tty);
		if (retval)
			return retval;
		if (cmd != TIOCCBRK) {
			tty_wait_until_sent(tty, 0);
			if (signal_pending(current))
				return -EINTR;
		}
		break;
	}

A
Alan Cox 已提交
2892 2893 2894
	/*
	 *	Now do the stuff.
	 */
L
Linus Torvalds 已提交
2895
	switch (cmd) {
2896 2897 2898
	case TIOCSTI:
		return tiocsti(tty, p);
	case TIOCGWINSZ:
2899
		return tiocgwinsz(real_tty, p);
2900
	case TIOCSWINSZ:
A
Alan Cox 已提交
2901
		return tiocswinsz(real_tty, p);
2902 2903 2904 2905 2906 2907 2908 2909 2910 2911
	case TIOCCONS:
		return real_tty != tty ? -EINVAL : tioccons(file);
	case FIONBIO:
		return fionbio(file, p);
	case TIOCEXCL:
		set_bit(TTY_EXCLUSIVE, &tty->flags);
		return 0;
	case TIOCNXCL:
		clear_bit(TTY_EXCLUSIVE, &tty->flags);
		return 0;
2912 2913 2914 2915 2916
	case TIOCGEXCL:
	{
		int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
		return put_user(excl, (int __user *)p);
	}
2917 2918 2919 2920 2921 2922
	case TIOCNOTTY:
		if (current->signal->tty != tty)
			return -ENOTTY;
		no_tty();
		return 0;
	case TIOCSCTTY:
2923
		return tiocsctty(real_tty, file, arg);
2924 2925 2926 2927 2928 2929 2930
	case TIOCGPGRP:
		return tiocgpgrp(tty, real_tty, p);
	case TIOCSPGRP:
		return tiocspgrp(tty, real_tty, p);
	case TIOCGSID:
		return tiocgsid(tty, real_tty, p);
	case TIOCGETD:
2931
		return tiocgetd(tty, p);
2932 2933
	case TIOCSETD:
		return tiocsetd(tty, p);
2934 2935 2936 2937 2938
	case TIOCVHANGUP:
		if (!capable(CAP_SYS_ADMIN))
			return -EPERM;
		tty_vhangup(tty);
		return 0;
2939 2940 2941 2942 2943
	case TIOCGDEV:
	{
		unsigned int ret = new_encode_dev(tty_devnum(real_tty));
		return put_user(ret, (unsigned int __user *)p);
	}
2944 2945 2946 2947
	/*
	 * Break handling
	 */
	case TIOCSBRK:	/* Turn break on, unconditionally */
A
Alan Cox 已提交
2948
		if (tty->ops->break_ctl)
A
Alan Cox 已提交
2949
			return tty->ops->break_ctl(tty, -1);
2950 2951
		return 0;
	case TIOCCBRK:	/* Turn break off, unconditionally */
A
Alan Cox 已提交
2952
		if (tty->ops->break_ctl)
A
Alan Cox 已提交
2953
			return tty->ops->break_ctl(tty, 0);
2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966
		return 0;
	case TCSBRK:   /* SVID version: non-zero arg --> no break */
		/* non-zero arg means wait for all output data
		 * to be sent (performed above) but don't send break.
		 * This is used by the tcdrain() termios function.
		 */
		if (!arg)
			return send_break(tty, 250);
		return 0;
	case TCSBRKP:	/* support for POSIX tcsendbreak() */
		return send_break(tty, arg ? arg*100 : 250);

	case TIOCMGET:
2967
		return tty_tiocmget(tty, p);
2968 2969 2970
	case TIOCMSET:
	case TIOCMBIC:
	case TIOCMBIS:
2971
		return tty_tiocmset(tty, cmd, p);
A
Alan Cox 已提交
2972 2973 2974 2975 2976 2977
	case TIOCGICOUNT:
		retval = tty_tiocgicount(tty, p);
		/* For the moment allow fall through to the old method */
        	if (retval != -EINVAL)
			return retval;
		break;
2978 2979 2980 2981 2982
	case TCFLSH:
		switch (arg) {
		case TCIFLUSH:
		case TCIOFLUSH:
		/* flush tty buffer and allow ldisc to process ioctl */
2983
			tty_buffer_flush(tty, NULL);
2984
			break;
2985 2986
		}
		break;
J
Jiri Slaby 已提交
2987 2988 2989
	case TIOCSSERIAL:
		tty_warn_deprecated_flags(p);
		break;
L
Linus Torvalds 已提交
2990
	}
A
Alan Cox 已提交
2991
	if (tty->ops->ioctl) {
P
Peter Hurley 已提交
2992
		retval = tty->ops->ioctl(tty, cmd, arg);
L
Linus Torvalds 已提交
2993 2994 2995 2996
		if (retval != -ENOIOCTLCMD)
			return retval;
	}
	ld = tty_ldisc_ref_wait(tty);
2997 2998
	if (!ld)
		return hung_up_tty_ioctl(file, cmd, arg);
L
Linus Torvalds 已提交
2999
	retval = -EINVAL;
A
Alan Cox 已提交
3000 3001
	if (ld->ops->ioctl) {
		retval = ld->ops->ioctl(tty, file, cmd, arg);
L
Linus Torvalds 已提交
3002
		if (retval == -ENOIOCTLCMD)
3003
			retval = -ENOTTY;
L
Linus Torvalds 已提交
3004 3005 3006 3007 3008
	}
	tty_ldisc_deref(ld);
	return retval;
}

P
Paul Fulghum 已提交
3009
#ifdef CONFIG_COMPAT
3010
static long tty_compat_ioctl(struct file *file, unsigned int cmd,
P
Paul Fulghum 已提交
3011 3012
				unsigned long arg)
{
N
Nick Piggin 已提交
3013
	struct tty_struct *tty = file_tty(file);
P
Paul Fulghum 已提交
3014 3015 3016
	struct tty_ldisc *ld;
	int retval = -ENOIOCTLCMD;

A
Al Viro 已提交
3017
	if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
P
Paul Fulghum 已提交
3018 3019
		return -EINVAL;

A
Alan Cox 已提交
3020
	if (tty->ops->compat_ioctl) {
P
Peter Hurley 已提交
3021
		retval = tty->ops->compat_ioctl(tty, cmd, arg);
P
Paul Fulghum 已提交
3022 3023 3024 3025 3026
		if (retval != -ENOIOCTLCMD)
			return retval;
	}

	ld = tty_ldisc_ref_wait(tty);
3027 3028
	if (!ld)
		return hung_up_tty_compat_ioctl(file, cmd, arg);
A
Alan Cox 已提交
3029 3030
	if (ld->ops->compat_ioctl)
		retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
3031 3032
	else
		retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
P
Paul Fulghum 已提交
3033 3034 3035 3036 3037
	tty_ldisc_deref(ld);

	return retval;
}
#endif
L
Linus Torvalds 已提交
3038

A
Al Viro 已提交
3039 3040 3041 3042 3043 3044 3045
static int this_tty(const void *t, struct file *file, unsigned fd)
{
	if (likely(file->f_op->read != tty_read))
		return 0;
	return file_tty(file) != t ? 0 : fd + 1;
}
	
L
Linus Torvalds 已提交
3046 3047 3048 3049 3050
/*
 * This implements the "Secure Attention Key" ---  the idea is to
 * prevent trojan horses by killing all processes associated with this
 * tty when the user hits the "Secure Attention Key".  Required for
 * super-paranoid applications --- see the Orange Book for more details.
3051
 *
L
Linus Torvalds 已提交
3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064
 * This code could be nicer; ideally it should send a HUP, wait a few
 * seconds, then send a INT, and then a KILL signal.  But you then
 * have to coordinate with the init process, since all processes associated
 * with the current tty must be dead before the new getty is allowed
 * to spawn.
 *
 * Now, if it would be correct ;-/ The current code has a nasty hole -
 * it doesn't catch files in flight. We may send the descriptor to ourselves
 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
 *
 * Nasty bug: do_SAK is being called in interrupt context.  This can
 * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
 */
3065
void __do_SAK(struct tty_struct *tty)
L
Linus Torvalds 已提交
3066 3067 3068 3069
{
#ifdef TTY_SOFT_SAK
	tty_hangup(tty);
#else
3070
	struct task_struct *g, *p;
3071
	struct pid *session;
L
Linus Torvalds 已提交
3072
	int		i;
3073

L
Linus Torvalds 已提交
3074 3075
	if (!tty)
		return;
3076
	session = tty->session;
3077

3078
	tty_ldisc_flush(tty);
L
Linus Torvalds 已提交
3079

A
Alan Cox 已提交
3080
	tty_driver_flush_buffer(tty);
3081

L
Linus Torvalds 已提交
3082
	read_lock(&tasklist_lock);
3083
	/* Kill the entire session */
3084
	do_each_pid_task(session, PIDTYPE_SID, p) {
3085 3086
		tty_notice(tty, "SAK: killed process %d (%s): by session\n",
			   task_pid_nr(p), p->comm);
3087
		send_sig(SIGKILL, p, 1);
3088
	} while_each_pid_task(session, PIDTYPE_SID, p);
3089 3090

	/* Now kill any processes that happen to have the tty open */
3091 3092
	do_each_thread(g, p) {
		if (p->signal->tty == tty) {
3093 3094
			tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
				   task_pid_nr(p), p->comm);
L
Linus Torvalds 已提交
3095 3096 3097 3098
			send_sig(SIGKILL, p, 1);
			continue;
		}
		task_lock(p);
A
Al Viro 已提交
3099 3100
		i = iterate_fd(p->files, 0, this_tty, tty);
		if (i != 0) {
3101 3102
			tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
				   task_pid_nr(p), p->comm, i - 1);
A
Al Viro 已提交
3103
			force_sig(SIGKILL, p);
L
Linus Torvalds 已提交
3104 3105
		}
		task_unlock(p);
3106
	} while_each_thread(g, p);
L
Linus Torvalds 已提交
3107 3108 3109 3110
	read_unlock(&tasklist_lock);
#endif
}

3111 3112 3113 3114 3115 3116 3117
static void do_SAK_work(struct work_struct *work)
{
	struct tty_struct *tty =
		container_of(work, struct tty_struct, SAK_work);
	__do_SAK(tty);
}

L
Linus Torvalds 已提交
3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132
/*
 * The tq handling here is a little racy - tty->SAK_work may already be queued.
 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
 * the values which we write to it will be identical to the values which it
 * already has. --akpm
 */
void do_SAK(struct tty_struct *tty)
{
	if (!tty)
		return;
	schedule_work(&tty->SAK_work);
}

EXPORT_SYMBOL(do_SAK);

3133
static int dev_match_devt(struct device *dev, const void *data)
3134
{
3135
	const dev_t *devt = data;
3136 3137 3138 3139 3140 3141 3142 3143 3144 3145 3146
	return dev->devt == *devt;
}

/* Must put_device() after it's unused! */
static struct device *tty_get_device(struct tty_struct *tty)
{
	dev_t devt = tty_devnum(tty);
	return class_find_device(tty_class, NULL, &devt, dev_match_devt);
}


3147
/**
3148
 *	alloc_tty_struct
3149
 *
3150
 *	This subroutine allocates and initializes a tty structure.
3151
 *
3152
 *	Locking: none - tty in question is not exposed at this point
L
Linus Torvalds 已提交
3153
 */
3154

3155
struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
L
Linus Torvalds 已提交
3156
{
3157 3158 3159 3160 3161 3162
	struct tty_struct *tty;

	tty = kzalloc(sizeof(*tty), GFP_KERNEL);
	if (!tty)
		return NULL;

A
Alan Cox 已提交
3163
	kref_init(&tty->kref);
L
Linus Torvalds 已提交
3164
	tty->magic = TTY_MAGIC;
3165
	tty_ldisc_init(tty);
3166 3167
	tty->session = NULL;
	tty->pgrp = NULL;
A
Alan Cox 已提交
3168
	mutex_init(&tty->legacy_mutex);
3169
	mutex_init(&tty->throttle_mutex);
3170
	init_rwsem(&tty->termios_rwsem);
3171
	mutex_init(&tty->winsize_mutex);
3172
	init_ldsem(&tty->ldisc_sem);
L
Linus Torvalds 已提交
3173 3174
	init_waitqueue_head(&tty->write_wait);
	init_waitqueue_head(&tty->read_wait);
3175
	INIT_WORK(&tty->hangup_work, do_tty_hangup);
I
Ingo Molnar 已提交
3176
	mutex_init(&tty->atomic_write_lock);
A
Alan Cox 已提交
3177
	spin_lock_init(&tty->ctrl_lock);
3178
	spin_lock_init(&tty->flow_lock);
L
Linus Torvalds 已提交
3179
	INIT_LIST_HEAD(&tty->tty_files);
3180
	INIT_WORK(&tty->SAK_work, do_SAK_work);
3181 3182 3183 3184 3185

	tty->driver = driver;
	tty->ops = driver->ops;
	tty->index = idx;
	tty_line_name(driver, idx, tty->name);
3186
	tty->dev = tty_get_device(tty);
3187 3188

	return tty;
L
Linus Torvalds 已提交
3189 3190
}

A
Alan Cox 已提交
3191 3192 3193 3194 3195 3196 3197 3198 3199 3200
/**
 *	tty_put_char	-	write one character to a tty
 *	@tty: tty
 *	@ch: character
 *
 *	Write one byte to the tty using the provided put_char method
 *	if present. Returns the number of characters successfully output.
 *
 *	Note: the specific put_char operation in the driver layer may go
 *	away soon. Don't call it directly, use this method
L
Linus Torvalds 已提交
3201
 */
3202

A
Alan Cox 已提交
3203
int tty_put_char(struct tty_struct *tty, unsigned char ch)
L
Linus Torvalds 已提交
3204
{
A
Alan Cox 已提交
3205 3206 3207
	if (tty->ops->put_char)
		return tty->ops->put_char(tty, ch);
	return tty->ops->write(tty, &ch, 1);
L
Linus Torvalds 已提交
3208
}
A
Alan Cox 已提交
3209 3210
EXPORT_SYMBOL_GPL(tty_put_char);

3211
struct class *tty_class;
L
Linus Torvalds 已提交
3212

3213 3214 3215
static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
		unsigned int index, unsigned int count)
{
L
Leon Yu 已提交
3216 3217
	int err;

3218
	/* init here, since reused cdevs cause crashes */
3219 3220 3221
	driver->cdevs[index] = cdev_alloc();
	if (!driver->cdevs[index])
		return -ENOMEM;
L
Leon Yu 已提交
3222
	driver->cdevs[index]->ops = &tty_fops;
3223
	driver->cdevs[index]->owner = driver->owner;
L
Leon Yu 已提交
3224 3225 3226 3227
	err = cdev_add(driver->cdevs[index], dev, count);
	if (err)
		kobject_put(&driver->cdevs[index]->kobj);
	return err;
3228 3229
}

L
Linus Torvalds 已提交
3230
/**
3231 3232 3233 3234 3235 3236
 *	tty_register_device - register a tty device
 *	@driver: the tty driver that describes the tty device
 *	@index: the index in the tty driver for this tty device
 *	@device: a struct device that is associated with this tty device.
 *		This field is optional, if there is no known struct device
 *		for this tty device it can be set to NULL safely.
L
Linus Torvalds 已提交
3237
 *
3238 3239
 *	Returns a pointer to the struct device for this tty device
 *	(or ERR_PTR(-EFOO) on error).
3240
 *
3241 3242 3243 3244 3245 3246
 *	This call is required to be made to register an individual tty device
 *	if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
 *	that bit is not set, this function should not be called by a tty
 *	driver.
 *
 *	Locking: ??
L
Linus Torvalds 已提交
3247
 */
3248

3249 3250
struct device *tty_register_device(struct tty_driver *driver, unsigned index,
				   struct device *device)
L
Linus Torvalds 已提交
3251
{
3252 3253 3254 3255
	return tty_register_device_attr(driver, index, device, NULL, NULL);
}
EXPORT_SYMBOL(tty_register_device);

3256 3257
static void tty_device_create_release(struct device *dev)
{
3258
	dev_dbg(dev, "releasing...\n");
3259 3260 3261
	kfree(dev);
}

3262 3263 3264 3265 3266 3267 3268 3269 3270 3271 3272 3273 3274 3275 3276 3277 3278 3279 3280 3281 3282 3283 3284 3285 3286
/**
 *	tty_register_device_attr - register a tty device
 *	@driver: the tty driver that describes the tty device
 *	@index: the index in the tty driver for this tty device
 *	@device: a struct device that is associated with this tty device.
 *		This field is optional, if there is no known struct device
 *		for this tty device it can be set to NULL safely.
 *	@drvdata: Driver data to be set to device.
 *	@attr_grp: Attribute group to be set on device.
 *
 *	Returns a pointer to the struct device for this tty device
 *	(or ERR_PTR(-EFOO) on error).
 *
 *	This call is required to be made to register an individual tty device
 *	if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
 *	that bit is not set, this function should not be called by a tty
 *	driver.
 *
 *	Locking: ??
 */
struct device *tty_register_device_attr(struct tty_driver *driver,
				   unsigned index, struct device *device,
				   void *drvdata,
				   const struct attribute_group **attr_grp)
{
L
Linus Torvalds 已提交
3287
	char name[64];
3288 3289 3290
	dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
	struct device *dev = NULL;
	int retval = -ENODEV;
3291
	bool cdev = false;
L
Linus Torvalds 已提交
3292 3293

	if (index >= driver->num) {
3294 3295
		pr_err("%s: Attempt to register invalid tty line number (%d)\n",
		       driver->name, index);
3296
		return ERR_PTR(-EINVAL);
L
Linus Torvalds 已提交
3297 3298 3299 3300 3301 3302
	}

	if (driver->type == TTY_DRIVER_TYPE_PTY)
		pty_line_name(driver, index, name);
	else
		tty_line_name(driver, index, name);
3303

3304
	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3305 3306 3307
		retval = tty_cdev_add(driver, devt, index, 1);
		if (retval)
			goto error;
3308 3309 3310
		cdev = true;
	}

3311 3312 3313 3314 3315
	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
	if (!dev) {
		retval = -ENOMEM;
		goto error;
	}
3316

3317 3318 3319
	dev->devt = devt;
	dev->class = tty_class;
	dev->parent = device;
3320
	dev->release = tty_device_create_release;
3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331 3332
	dev_set_name(dev, "%s", name);
	dev->groups = attr_grp;
	dev_set_drvdata(dev, drvdata);

	retval = device_register(dev);
	if (retval)
		goto error;

	return dev;

error:
	put_device(dev);
3333 3334 3335 3336
	if (cdev) {
		cdev_del(driver->cdevs[index]);
		driver->cdevs[index] = NULL;
	}
3337
	return ERR_PTR(retval);
L
Linus Torvalds 已提交
3338
}
3339
EXPORT_SYMBOL_GPL(tty_register_device_attr);
L
Linus Torvalds 已提交
3340 3341

/**
3342 3343 3344
 * 	tty_unregister_device - unregister a tty device
 * 	@driver: the tty driver that describes the tty device
 * 	@index: the index in the tty driver for this tty device
L
Linus Torvalds 已提交
3345
 *
3346 3347 3348 3349
 * 	If a tty device is registered with a call to tty_register_device() then
 *	this function must be called when the tty device is gone.
 *
 *	Locking: ??
L
Linus Torvalds 已提交
3350
 */
3351

L
Linus Torvalds 已提交
3352 3353
void tty_unregister_device(struct tty_driver *driver, unsigned index)
{
3354 3355
	device_destroy(tty_class,
		MKDEV(driver->major, driver->minor_start) + index);
3356 3357 3358 3359
	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
		cdev_del(driver->cdevs[index]);
		driver->cdevs[index] = NULL;
	}
L
Linus Torvalds 已提交
3360 3361 3362
}
EXPORT_SYMBOL(tty_unregister_device);

J
Jiri Slaby 已提交
3363 3364 3365 3366 3367 3368 3369 3370 3371 3372 3373
/**
 * __tty_alloc_driver -- allocate tty driver
 * @lines: count of lines this driver can handle at most
 * @owner: module which is repsonsible for this driver
 * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
 *
 * This should not be called directly, some of the provided macros should be
 * used instead. Use IS_ERR and friends on @retval.
 */
struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
		unsigned long flags)
L
Linus Torvalds 已提交
3374 3375
{
	struct tty_driver *driver;
3376
	unsigned int cdevs = 1;
3377
	int err;
L
Linus Torvalds 已提交
3378

3379
	if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
J
Jiri Slaby 已提交
3380 3381
		return ERR_PTR(-EINVAL);

J
Jean Delvare 已提交
3382
	driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
J
Jiri Slaby 已提交
3383 3384 3385 3386 3387 3388 3389 3390
	if (!driver)
		return ERR_PTR(-ENOMEM);

	kref_init(&driver->kref);
	driver->magic = TTY_DRIVER_MAGIC;
	driver->num = lines;
	driver->owner = owner;
	driver->flags = flags;
3391 3392 3393 3394 3395 3396 3397 3398 3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409

	if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
		driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
				GFP_KERNEL);
		driver->termios = kcalloc(lines, sizeof(*driver->termios),
				GFP_KERNEL);
		if (!driver->ttys || !driver->termios) {
			err = -ENOMEM;
			goto err_free_all;
		}
	}

	if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
		driver->ports = kcalloc(lines, sizeof(*driver->ports),
				GFP_KERNEL);
		if (!driver->ports) {
			err = -ENOMEM;
			goto err_free_all;
		}
3410 3411 3412 3413 3414 3415 3416
		cdevs = lines;
	}

	driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
	if (!driver->cdevs) {
		err = -ENOMEM;
		goto err_free_all;
3417
	}
J
Jiri Slaby 已提交
3418

L
Linus Torvalds 已提交
3419
	return driver;
3420 3421 3422 3423
err_free_all:
	kfree(driver->ports);
	kfree(driver->ttys);
	kfree(driver->termios);
3424
	kfree(driver->cdevs);
3425 3426
	kfree(driver);
	return ERR_PTR(err);
L
Linus Torvalds 已提交
3427
}
J
Jiri Slaby 已提交
3428
EXPORT_SYMBOL(__tty_alloc_driver);
L
Linus Torvalds 已提交
3429

A
Alan Cox 已提交
3430
static void destruct_tty_driver(struct kref *kref)
L
Linus Torvalds 已提交
3431
{
A
Alan Cox 已提交
3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448 3449 3450 3451
	struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
	int i;
	struct ktermios *tp;

	if (driver->flags & TTY_DRIVER_INSTALLED) {
		/*
		 * Free the termios and termios_locked structures because
		 * we don't want to get memory leaks when modular tty
		 * drivers are removed from the kernel.
		 */
		for (i = 0; i < driver->num; i++) {
			tp = driver->termios[i];
			if (tp) {
				driver->termios[i] = NULL;
				kfree(tp);
			}
			if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
				tty_unregister_device(driver, i);
		}
		proc_tty_unregister_driver(driver);
3452
		if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3453
			cdev_del(driver->cdevs[0]);
A
Alan Cox 已提交
3454
	}
3455
	kfree(driver->cdevs);
J
Jiri Slaby 已提交
3456
	kfree(driver->ports);
3457 3458
	kfree(driver->termios);
	kfree(driver->ttys);
L
Linus Torvalds 已提交
3459 3460 3461
	kfree(driver);
}

A
Alan Cox 已提交
3462 3463 3464 3465 3466 3467
void tty_driver_kref_put(struct tty_driver *driver)
{
	kref_put(&driver->kref, destruct_tty_driver);
}
EXPORT_SYMBOL(tty_driver_kref_put);

J
Jeff Dike 已提交
3468 3469
void tty_set_operations(struct tty_driver *driver,
			const struct tty_operations *op)
L
Linus Torvalds 已提交
3470
{
A
Alan Cox 已提交
3471 3472
	driver->ops = op;
};
A
Alan Cox 已提交
3473
EXPORT_SYMBOL(tty_set_operations);
L
Linus Torvalds 已提交
3474

A
Alan Cox 已提交
3475 3476 3477 3478
void put_tty_driver(struct tty_driver *d)
{
	tty_driver_kref_put(d);
}
L
Linus Torvalds 已提交
3479 3480 3481 3482 3483 3484 3485 3486
EXPORT_SYMBOL(put_tty_driver);

/*
 * Called by a tty driver to register itself.
 */
int tty_register_driver(struct tty_driver *driver)
{
	int error;
3487
	int i;
L
Linus Torvalds 已提交
3488
	dev_t dev;
3489
	struct device *d;
L
Linus Torvalds 已提交
3490 3491

	if (!driver->major) {
3492 3493
		error = alloc_chrdev_region(&dev, driver->minor_start,
						driver->num, driver->name);
L
Linus Torvalds 已提交
3494 3495 3496 3497 3498 3499
		if (!error) {
			driver->major = MAJOR(dev);
			driver->minor_start = MINOR(dev);
		}
	} else {
		dev = MKDEV(driver->major, driver->minor_start);
3500
		error = register_chrdev_region(dev, driver->num, driver->name);
L
Linus Torvalds 已提交
3501
	}
3502
	if (error < 0)
3503
		goto err;
L
Linus Torvalds 已提交
3504

3505 3506 3507 3508 3509
	if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
		error = tty_cdev_add(driver, dev, 0, driver->num);
		if (error)
			goto err_unreg_char;
	}
L
Linus Torvalds 已提交
3510

3511
	mutex_lock(&tty_mutex);
L
Linus Torvalds 已提交
3512
	list_add(&driver->tty_drivers, &tty_drivers);
3513
	mutex_unlock(&tty_mutex);
3514 3515

	if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3516 3517 3518 3519
		for (i = 0; i < driver->num; i++) {
			d = tty_register_device(driver, i, NULL);
			if (IS_ERR(d)) {
				error = PTR_ERR(d);
3520
				goto err_unreg_devs;
3521 3522
			}
		}
L
Linus Torvalds 已提交
3523 3524
	}
	proc_tty_register_driver(driver);
A
Alan Cox 已提交
3525
	driver->flags |= TTY_DRIVER_INSTALLED;
L
Linus Torvalds 已提交
3526
	return 0;
3527

3528
err_unreg_devs:
3529 3530 3531 3532 3533 3534 3535
	for (i--; i >= 0; i--)
		tty_unregister_device(driver, i);

	mutex_lock(&tty_mutex);
	list_del(&driver->tty_drivers);
	mutex_unlock(&tty_mutex);

3536
err_unreg_char:
3537
	unregister_chrdev_region(dev, driver->num);
3538
err:
3539
	return error;
L
Linus Torvalds 已提交
3540 3541 3542 3543 3544 3545 3546 3547
}
EXPORT_SYMBOL(tty_register_driver);

/*
 * Called by a tty driver to unregister itself.
 */
int tty_unregister_driver(struct tty_driver *driver)
{
A
Alan Cox 已提交
3548 3549
#if 0
	/* FIXME */
L
Linus Torvalds 已提交
3550 3551
	if (driver->refcount)
		return -EBUSY;
A
Alan Cox 已提交
3552
#endif
L
Linus Torvalds 已提交
3553 3554
	unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
				driver->num);
3555
	mutex_lock(&tty_mutex);
L
Linus Torvalds 已提交
3556
	list_del(&driver->tty_drivers);
3557
	mutex_unlock(&tty_mutex);
L
Linus Torvalds 已提交
3558 3559
	return 0;
}
A
Alan Cox 已提交
3560

L
Linus Torvalds 已提交
3561 3562
EXPORT_SYMBOL(tty_unregister_driver);

3563 3564 3565 3566 3567
dev_t tty_devnum(struct tty_struct *tty)
{
	return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
}
EXPORT_SYMBOL(tty_devnum);
L
Linus Torvalds 已提交
3568

3569 3570 3571 3572 3573
void tty_default_fops(struct file_operations *fops)
{
	*fops = tty_fops;
}

L
Linus Torvalds 已提交
3574 3575 3576 3577 3578 3579 3580 3581 3582 3583 3584
/*
 * Initialize the console device. This is called *early*, so
 * we can't necessarily depend on lots of kernel help here.
 * Just do some early initializations, and do the complex setup
 * later.
 */
void __init console_init(void)
{
	initcall_t *call;

	/* Setup the default TTY line discipline. */
3585
	n_tty_init();
L
Linus Torvalds 已提交
3586 3587

	/*
3588
	 * set up the console device so that later boot sequences can
L
Linus Torvalds 已提交
3589 3590 3591 3592 3593 3594 3595 3596 3597
	 * inform about problems etc..
	 */
	call = __con_initcall_start;
	while (call < __con_initcall_end) {
		(*call)();
		call++;
	}
}

3598
static char *tty_devnode(struct device *dev, umode_t *mode)
3599 3600 3601 3602 3603 3604 3605 3606 3607
{
	if (!mode)
		return NULL;
	if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
	    dev->devt == MKDEV(TTYAUX_MAJOR, 2))
		*mode = 0666;
	return NULL;
}

L
Linus Torvalds 已提交
3608 3609
static int __init tty_class_init(void)
{
3610
	tty_class = class_create(THIS_MODULE, "tty");
L
Linus Torvalds 已提交
3611 3612
	if (IS_ERR(tty_class))
		return PTR_ERR(tty_class);
3613
	tty_class->devnode = tty_devnode;
L
Linus Torvalds 已提交
3614 3615 3616 3617 3618 3619 3620 3621
	return 0;
}

postcore_initcall(tty_class_init);

/* 3/2004 jmc: why do these devices exist? */
static struct cdev tty_cdev, console_cdev;

3622 3623 3624 3625 3626 3627 3628 3629
static ssize_t show_cons_active(struct device *dev,
				struct device_attribute *attr, char *buf)
{
	struct console *cs[16];
	int i = 0;
	struct console *c;
	ssize_t count = 0;

3630
	console_lock();
3631
	for_each_console(c) {
3632 3633 3634 3635 3636 3637 3638 3639 3640 3641
		if (!c->device)
			continue;
		if (!c->write)
			continue;
		if ((c->flags & CON_ENABLED) == 0)
			continue;
		cs[i++] = c;
		if (i >= ARRAY_SIZE(cs))
			break;
	}
3642 3643 3644 3645 3646 3647 3648 3649 3650 3651 3652 3653 3654
	while (i--) {
		int index = cs[i]->index;
		struct tty_driver *drv = cs[i]->device(cs[i], &index);

		/* don't resolve tty0 as some programs depend on it */
		if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
			count += tty_line_name(drv, index, buf + count);
		else
			count += sprintf(buf + count, "%s%d",
					 cs[i]->name, cs[i]->index);

		count += sprintf(buf + count, "%c", i ? ' ':'\n');
	}
3655
	console_unlock();
3656 3657 3658 3659 3660

	return count;
}
static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);

3661 3662 3663 3664 3665 3666 3667
static struct attribute *cons_dev_attrs[] = {
	&dev_attr_active.attr,
	NULL
};

ATTRIBUTE_GROUPS(cons_dev);

3668 3669 3670 3671 3672 3673 3674 3675
static struct device *consdev;

void console_sysfs_notify(void)
{
	if (consdev)
		sysfs_notify(&consdev->kobj, NULL, "active");
}

L
Linus Torvalds 已提交
3676 3677 3678 3679
/*
 * Ok, now we can initialize the rest of the tty devices and can count
 * on memory allocations, interrupts etc..
 */
3680
int __init tty_init(void)
L
Linus Torvalds 已提交
3681 3682 3683 3684 3685
{
	cdev_init(&tty_cdev, &tty_fops);
	if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
		panic("Couldn't register /dev/tty driver\n");
3686
	device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
L
Linus Torvalds 已提交
3687 3688 3689 3690 3691

	cdev_init(&console_cdev, &console_fops);
	if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
		panic("Couldn't register /dev/console driver\n");
3692 3693 3694
	consdev = device_create_with_groups(tty_class, NULL,
					    MKDEV(TTYAUX_MAJOR, 1), NULL,
					    cons_dev_groups, "console");
3695 3696
	if (IS_ERR(consdev))
		consdev = NULL;
L
Linus Torvalds 已提交
3697 3698

#ifdef CONFIG_VT
3699
	vty_init(&console_fops);
L
Linus Torvalds 已提交
3700 3701 3702
#endif
	return 0;
}
3703