root/drivers/tty/tty_io.c

DEFINITIONS

1. free_tty_struct
2. file_tty
3. tty_alloc_file
4. tty_add_file
5. tty_free_file
6. tty_del_file
7. tty_name
8. tty_driver_name
9. tty_paranoia_check
10. check_tty_count
11. get_tty_driver
12. tty_dev_name_to_number
13. tty_find_polling_driver
14. hung_up_tty_read
15. hung_up_tty_write
16. hung_up_tty_poll
17. hung_up_tty_ioctl
18. hung_up_tty_compat_ioctl
19. hung_up_tty_fasync
20. tty_show_fdinfo
21. tty_wakeup
22. __tty_hangup
23. do_tty_hangup
24. tty_hangup
25. tty_vhangup
26. tty_vhangup_self
27. tty_vhangup_session
28. tty_hung_up_p
29. __stop_tty
30. stop_tty
31. __start_tty
32. start_tty
33. tty_update_time
34. tty_read
35. tty_write_unlock
36. tty_write_lock
37. do_tty_write
38. tty_write_message
39. tty_write
40. redirected_tty_write
41. tty_send_xchar
42. pty_line_name
43. tty_line_name
44. tty_driver_lookup_tty
45. tty_init_termios
46. tty_standard_install
47. tty_driver_install_tty
48. tty_driver_remove_tty
49. tty_reopen
50. tty_init_dev
51. tty_save_termios
52. tty_flush_works
53. release_one_tty
54. queue_release_one_tty
55. tty_kref_put
56. release_tty
57. tty_release_checks
58. tty_kclose
59. tty_release_struct
60. tty_release
61. tty_open_current_tty
62. tty_lookup_driver
63. tty_kopen
64. tty_open_by_driver
65. tty_open
66. tty_poll
67. __tty_fasync
68. tty_fasync
69. tiocsti
70. tiocgwinsz
71. tty_do_resize
72. tiocswinsz
73. tioccons
74. tiocsetd
75. tiocgetd
76. send_break
77. tty_tiocmget
78. tty_tiocmset
79. tty_tiocgicount
80. tty_tiocsserial
81. tty_tiocgserial
82. tty_pair_get_tty
83. tty_ioctl
84. compat_tty_tiocsserial
85. compat_tty_tiocgserial
86. tty_compat_ioctl
87. this_tty
88. __do_SAK
89. do_SAK_work
90. do_SAK
91. tty_get_device
92. alloc_tty_struct
93. tty_put_char
94. tty_cdev_add
95. tty_register_device
96. tty_device_create_release
97. tty_register_device_attr
98. tty_unregister_device
99. __tty_alloc_driver
100. destruct_tty_driver
101. tty_driver_kref_put
102. tty_set_operations
103. put_tty_driver
104. tty_register_driver
105. tty_unregister_driver
106. tty_devnum
107. tty_default_fops
108. tty_devnode
109. tty_class_init
110. show_cons_active
111. console_sysfs_notify
112. tty_init

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  *  Copyright (C) 1991, 1992  Linus Torvalds
   4  */
   5 
   6 /*
   7  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
   8  * or rs-channels. It also implements echoing, cooked mode etc.
   9  *
  10  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
  11  *
  12  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
  13  * tty_struct and tty_queue structures.  Previously there was an array
  14  * of 256 tty_struct's which was statically allocated, and the
  15  * tty_queue structures were allocated at boot time.  Both are now
  16  * dynamically allocated only when the tty is open.
  17  *
  18  * Also restructured routines so that there is more of a separation
  19  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
  20  * the low-level tty routines (serial.c, pty.c, console.c).  This
  21  * makes for cleaner and more compact code.  -TYT, 9/17/92
  22  *
  23  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
  24  * which can be dynamically activated and de-activated by the line
  25  * discipline handling modules (like SLIP).
  26  *
  27  * NOTE: pay no attention to the line discipline code (yet); its
  28  * interface is still subject to change in this version...
  29  * -- TYT, 1/31/92
  30  *
  31  * Added functionality to the OPOST tty handling.  No delays, but all
  32  * other bits should be there.
  33  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
  34  *
  35  * Rewrote canonical mode and added more termios flags.
  36  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
  37  *
  38  * Reorganized FASYNC support so mouse code can share it.
  39  *      -- ctm@ardi.com, 9Sep95
  40  *
  41  * New TIOCLINUX variants added.
  42  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
  43  *
  44  * Restrict vt switching via ioctl()
  45  *      -- grif@cs.ucr.edu, 5-Dec-95
  46  *
  47  * Move console and virtual terminal code to more appropriate files,
  48  * implement CONFIG_VT and generalize console device interface.
  49  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
  50  *
  51  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
  52  *      -- Bill Hawes <whawes@star.net>, June 97
  53  *
  54  * Added devfs support.
  55  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
  56  *
  57  * Added support for a Unix98-style ptmx device.
  58  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
  59  *
  60  * Reduced memory usage for older ARM systems
  61  *      -- Russell King <rmk@arm.linux.org.uk>
  62  *
  63  * Move do_SAK() into process context.  Less stack use in devfs functions.
  64  * alloc_tty_struct() always uses kmalloc()
  65  *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
  66  */
  67 
  68 #include <linux/types.h>
  69 #include <linux/major.h>
  70 #include <linux/errno.h>
  71 #include <linux/signal.h>
  72 #include <linux/fcntl.h>
  73 #include <linux/sched/signal.h>
  74 #include <linux/sched/task.h>
  75 #include <linux/interrupt.h>
  76 #include <linux/tty.h>
  77 #include <linux/tty_driver.h>
  78 #include <linux/tty_flip.h>
  79 #include <linux/devpts_fs.h>
  80 #include <linux/file.h>
  81 #include <linux/fdtable.h>
  82 #include <linux/console.h>
  83 #include <linux/timer.h>
  84 #include <linux/ctype.h>
  85 #include <linux/kd.h>
  86 #include <linux/mm.h>
  87 #include <linux/string.h>
  88 #include <linux/slab.h>
  89 #include <linux/poll.h>
  90 #include <linux/proc_fs.h>
  91 #include <linux/init.h>
  92 #include <linux/module.h>
  93 #include <linux/device.h>
  94 #include <linux/wait.h>
  95 #include <linux/bitops.h>
  96 #include <linux/delay.h>
  97 #include <linux/seq_file.h>
  98 #include <linux/serial.h>
  99 #include <linux/ratelimit.h>
 100 #include <linux/compat.h>
 101 
 102 #include <linux/uaccess.h>
 103 
 104 #include <linux/kbd_kern.h>
 105 #include <linux/vt_kern.h>
 106 #include <linux/selection.h>
 107 
 108 #include <linux/kmod.h>
 109 #include <linux/nsproxy.h>
 110 
 111 #undef TTY_DEBUG_HANGUP
 112 #ifdef TTY_DEBUG_HANGUP
 113 # define tty_debug_hangup(tty, f, args...)      tty_debug(tty, f, ##args)
 114 #else
 115 # define tty_debug_hangup(tty, f, args...)      do { } while (0)
 116 #endif
 117 
 118 #define TTY_PARANOIA_CHECK 1
 119 #define CHECK_TTY_COUNT 1
 120 
 121 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
 122         .c_iflag = ICRNL | IXON,
 123         .c_oflag = OPOST | ONLCR,
 124         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
 125         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
 126                    ECHOCTL | ECHOKE | IEXTEN,
 127         .c_cc = INIT_C_CC,
 128         .c_ispeed = 38400,
 129         .c_ospeed = 38400,
 130         /* .c_line = N_TTY, */
 131 };
 132 
 133 EXPORT_SYMBOL(tty_std_termios);
 134 
 135 /* This list gets poked at by procfs and various bits of boot up code. This
 136    could do with some rationalisation such as pulling the tty proc function
 137    into this file */
 138 
 139 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
 140 
 141 /* Mutex to protect creating and releasing a tty */
 142 DEFINE_MUTEX(tty_mutex);
 143 
 144 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
 145 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
 146 ssize_t redirected_tty_write(struct file *, const char __user *,
 147                                                         size_t, loff_t *);
 148 static __poll_t tty_poll(struct file *, poll_table *);
 149 static int tty_open(struct inode *, struct file *);
 150 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 151 #ifdef CONFIG_COMPAT
 152 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
 153                                 unsigned long arg);
 154 #else
 155 #define tty_compat_ioctl NULL
 156 #endif
 157 static int __tty_fasync(int fd, struct file *filp, int on);
 158 static int tty_fasync(int fd, struct file *filp, int on);
 159 static void release_tty(struct tty_struct *tty, int idx);
 160 
 161 /**
 162  *      free_tty_struct         -       free a disused tty
 163  *      @tty: tty struct to free
 164  *
 165  *      Free the write buffers, tty queue and tty memory itself.
 166  *
 167  *      Locking: none. Must be called after tty is definitely unused
 168  */
 169 
 170 static void free_tty_struct(struct tty_struct *tty)
 171 {
 172         tty_ldisc_deinit(tty);
 173         put_device(tty->dev);
 174         kfree(tty->write_buf);
 175         tty->magic = 0xDEADDEAD;
 176         kfree(tty);
 177 }
 178 
 179 static inline struct tty_struct *file_tty(struct file *file)
 180 {
 181         return ((struct tty_file_private *)file->private_data)->tty;
 182 }
 183 
 184 int tty_alloc_file(struct file *file)
 185 {
 186         struct tty_file_private *priv;
 187 
 188         priv = kmalloc(sizeof(*priv), GFP_KERNEL);
 189         if (!priv)
 190                 return -ENOMEM;
 191 
 192         file->private_data = priv;
 193 
 194         return 0;
 195 }
 196 
 197 /* Associate a new file with the tty structure */
 198 void tty_add_file(struct tty_struct *tty, struct file *file)
 199 {
 200         struct tty_file_private *priv = file->private_data;
 201 
 202         priv->tty = tty;
 203         priv->file = file;
 204 
 205         spin_lock(&tty->files_lock);
 206         list_add(&priv->list, &tty->tty_files);
 207         spin_unlock(&tty->files_lock);
 208 }
 209 
 210 /**
 211  * tty_free_file - free file->private_data
 212  *
 213  * This shall be used only for fail path handling when tty_add_file was not
 214  * called yet.
 215  */
 216 void tty_free_file(struct file *file)
 217 {
 218         struct tty_file_private *priv = file->private_data;
 219 
 220         file->private_data = NULL;
 221         kfree(priv);
 222 }
 223 
 224 /* Delete file from its tty */
 225 static void tty_del_file(struct file *file)
 226 {
 227         struct tty_file_private *priv = file->private_data;
 228         struct tty_struct *tty = priv->tty;
 229 
 230         spin_lock(&tty->files_lock);
 231         list_del(&priv->list);
 232         spin_unlock(&tty->files_lock);
 233         tty_free_file(file);
 234 }
 235 
 236 /**
 237  *      tty_name        -       return tty naming
 238  *      @tty: tty structure
 239  *
 240  *      Convert a tty structure into a name. The name reflects the kernel
 241  *      naming policy and if udev is in use may not reflect user space
 242  *
 243  *      Locking: none
 244  */
 245 
 246 const char *tty_name(const struct tty_struct *tty)
 247 {
 248         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
 249                 return "NULL tty";
 250         return tty->name;
 251 }
 252 
 253 EXPORT_SYMBOL(tty_name);
 254 
 255 const char *tty_driver_name(const struct tty_struct *tty)
 256 {
 257         if (!tty || !tty->driver)
 258                 return "";
 259         return tty->driver->name;
 260 }
 261 
 262 static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
 263                               const char *routine)
 264 {
 265 #ifdef TTY_PARANOIA_CHECK
 266         if (!tty) {
 267                 pr_warn("(%d:%d): %s: NULL tty\n",
 268                         imajor(inode), iminor(inode), routine);
 269                 return 1;
 270         }
 271         if (tty->magic != TTY_MAGIC) {
 272                 pr_warn("(%d:%d): %s: bad magic number\n",
 273                         imajor(inode), iminor(inode), routine);
 274                 return 1;
 275         }
 276 #endif
 277         return 0;
 278 }
 279 
 280 /* Caller must hold tty_lock */
 281 static int check_tty_count(struct tty_struct *tty, const char *routine)
 282 {
 283 #ifdef CHECK_TTY_COUNT
 284         struct list_head *p;
 285         int count = 0, kopen_count = 0;
 286 
 287         spin_lock(&tty->files_lock);
 288         list_for_each(p, &tty->tty_files) {
 289                 count++;
 290         }
 291         spin_unlock(&tty->files_lock);
 292         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
 293             tty->driver->subtype == PTY_TYPE_SLAVE &&
 294             tty->link && tty->link->count)
 295                 count++;
 296         if (tty_port_kopened(tty->port))
 297                 kopen_count++;
 298         if (tty->count != (count + kopen_count)) {
 299                 tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
 300                          routine, tty->count, count, kopen_count);
 301                 return (count + kopen_count);
 302         }
 303 #endif
 304         return 0;
 305 }
 306 
 307 /**
 308  *      get_tty_driver          -       find device of a tty
 309  *      @dev_t: device identifier
 310  *      @index: returns the index of the tty
 311  *
 312  *      This routine returns a tty driver structure, given a device number
 313  *      and also passes back the index number.
 314  *
 315  *      Locking: caller must hold tty_mutex
 316  */
 317 
 318 static struct tty_driver *get_tty_driver(dev_t device, int *index)
 319 {
 320         struct tty_driver *p;
 321 
 322         list_for_each_entry(p, &tty_drivers, tty_drivers) {
 323                 dev_t base = MKDEV(p->major, p->minor_start);
 324                 if (device < base || device >= base + p->num)
 325                         continue;
 326                 *index = device - base;
 327                 return tty_driver_kref_get(p);
 328         }
 329         return NULL;
 330 }
 331 
 332 /**
 333  *      tty_dev_name_to_number  -       return dev_t for device name
 334  *      @name: user space name of device under /dev
 335  *      @number: pointer to dev_t that this function will populate
 336  *
 337  *      This function converts device names like ttyS0 or ttyUSB1 into dev_t
 338  *      like (4, 64) or (188, 1). If no corresponding driver is registered then
 339  *      the function returns -ENODEV.
 340  *
 341  *      Locking: this acquires tty_mutex to protect the tty_drivers list from
 342  *              being modified while we are traversing it, and makes sure to
 343  *              release it before exiting.
 344  */
 345 int tty_dev_name_to_number(const char *name, dev_t *number)
 346 {
 347         struct tty_driver *p;
 348         int ret;
 349         int index, prefix_length = 0;
 350         const char *str;
 351 
 352         for (str = name; *str && !isdigit(*str); str++)
 353                 ;
 354 
 355         if (!*str)
 356                 return -EINVAL;
 357 
 358         ret = kstrtoint(str, 10, &index);
 359         if (ret)
 360                 return ret;
 361 
 362         prefix_length = str - name;
 363         mutex_lock(&tty_mutex);
 364 
 365         list_for_each_entry(p, &tty_drivers, tty_drivers)
 366                 if (prefix_length == strlen(p->name) && strncmp(name,
 367                                         p->name, prefix_length) == 0) {
 368                         if (index < p->num) {
 369                                 *number = MKDEV(p->major, p->minor_start + index);
 370                                 goto out;
 371                         }
 372                 }
 373 
 374         /* if here then driver wasn't found */
 375         ret = -ENODEV;
 376 out:
 377         mutex_unlock(&tty_mutex);
 378         return ret;
 379 }
 380 EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
 381 
 382 #ifdef CONFIG_CONSOLE_POLL
 383 
 384 /**
 385  *      tty_find_polling_driver -       find device of a polled tty
 386  *      @name: name string to match
 387  *      @line: pointer to resulting tty line nr
 388  *
 389  *      This routine returns a tty driver structure, given a name
 390  *      and the condition that the tty driver is capable of polled
 391  *      operation.
 392  */
 393 struct tty_driver *tty_find_polling_driver(char *name, int *line)
 394 {
 395         struct tty_driver *p, *res = NULL;
 396         int tty_line = 0;
 397         int len;
 398         char *str, *stp;
 399 
 400         for (str = name; *str; str++)
 401                 if ((*str >= '0' && *str <= '9') || *str == ',')
 402                         break;
 403         if (!*str)
 404                 return NULL;
 405 
 406         len = str - name;
 407         tty_line = simple_strtoul(str, &str, 10);
 408 
 409         mutex_lock(&tty_mutex);
 410         /* Search through the tty devices to look for a match */
 411         list_for_each_entry(p, &tty_drivers, tty_drivers) {
 412                 if (!len || strncmp(name, p->name, len) != 0)
 413                         continue;
 414                 stp = str;
 415                 if (*stp == ',')
 416                         stp++;
 417                 if (*stp == '\0')
 418                         stp = NULL;
 419 
 420                 if (tty_line >= 0 && tty_line < p->num && p->ops &&
 421                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
 422                         res = tty_driver_kref_get(p);
 423                         *line = tty_line;
 424                         break;
 425                 }
 426         }
 427         mutex_unlock(&tty_mutex);
 428 
 429         return res;
 430 }
 431 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
 432 #endif
 433 
 434 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
 435                                 size_t count, loff_t *ppos)
 436 {
 437         return 0;
 438 }
 439 
 440 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
 441                                  size_t count, loff_t *ppos)
 442 {
 443         return -EIO;
 444 }
 445 
 446 /* No kernel lock held - none needed ;) */
 447 static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
 448 {
 449         return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
 450 }
 451 
 452 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
 453                 unsigned long arg)
 454 {
 455         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
 456 }
 457 
 458 static long hung_up_tty_compat_ioctl(struct file *file,
 459                                      unsigned int cmd, unsigned long arg)
 460 {
 461         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
 462 }
 463 
 464 static int hung_up_tty_fasync(int fd, struct file *file, int on)
 465 {
 466         return -ENOTTY;
 467 }
 468 
 469 static void tty_show_fdinfo(struct seq_file *m, struct file *file)
 470 {
 471         struct tty_struct *tty = file_tty(file);
 472 
 473         if (tty && tty->ops && tty->ops->show_fdinfo)
 474                 tty->ops->show_fdinfo(tty, m);
 475 }
 476 
 477 static const struct file_operations tty_fops = {
 478         .llseek         = no_llseek,
 479         .read           = tty_read,
 480         .write          = tty_write,
 481         .poll           = tty_poll,
 482         .unlocked_ioctl = tty_ioctl,
 483         .compat_ioctl   = tty_compat_ioctl,
 484         .open           = tty_open,
 485         .release        = tty_release,
 486         .fasync         = tty_fasync,
 487         .show_fdinfo    = tty_show_fdinfo,
 488 };
 489 
 490 static const struct file_operations console_fops = {
 491         .llseek         = no_llseek,
 492         .read           = tty_read,
 493         .write          = redirected_tty_write,
 494         .poll           = tty_poll,
 495         .unlocked_ioctl = tty_ioctl,
 496         .compat_ioctl   = tty_compat_ioctl,
 497         .open           = tty_open,
 498         .release        = tty_release,
 499         .fasync         = tty_fasync,
 500 };
 501 
 502 static const struct file_operations hung_up_tty_fops = {
 503         .llseek         = no_llseek,
 504         .read           = hung_up_tty_read,
 505         .write          = hung_up_tty_write,
 506         .poll           = hung_up_tty_poll,
 507         .unlocked_ioctl = hung_up_tty_ioctl,
 508         .compat_ioctl   = hung_up_tty_compat_ioctl,
 509         .release        = tty_release,
 510         .fasync         = hung_up_tty_fasync,
 511 };
 512 
 513 static DEFINE_SPINLOCK(redirect_lock);
 514 static struct file *redirect;
 515 
 516 extern void tty_sysctl_init(void);
 517 
 518 /**
 519  *      tty_wakeup      -       request more data
 520  *      @tty: terminal
 521  *
 522  *      Internal and external helper for wakeups of tty. This function
 523  *      informs the line discipline if present that the driver is ready
 524  *      to receive more output data.
 525  */
 526 
 527 void tty_wakeup(struct tty_struct *tty)
 528 {
 529         struct tty_ldisc *ld;
 530 
 531         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
 532                 ld = tty_ldisc_ref(tty);
 533                 if (ld) {
 534                         if (ld->ops->write_wakeup)
 535                                 ld->ops->write_wakeup(tty);
 536                         tty_ldisc_deref(ld);
 537                 }
 538         }
 539         wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
 540 }
 541 
 542 EXPORT_SYMBOL_GPL(tty_wakeup);
 543 
 544 /**
 545  *      __tty_hangup            -       actual handler for hangup events
 546  *      @work: tty device
 547  *
 548  *      This can be called by a "kworker" kernel thread.  That is process
 549  *      synchronous but doesn't hold any locks, so we need to make sure we
 550  *      have the appropriate locks for what we're doing.
 551  *
 552  *      The hangup event clears any pending redirections onto the hung up
 553  *      device. It ensures future writes will error and it does the needed
 554  *      line discipline hangup and signal delivery. The tty object itself
 555  *      remains intact.
 556  *
 557  *      Locking:
 558  *              BTM
 559  *                redirect lock for undoing redirection
 560  *                file list lock for manipulating list of ttys
 561  *                tty_ldiscs_lock from called functions
 562  *                termios_rwsem resetting termios data
 563  *                tasklist_lock to walk task list for hangup event
 564  *                  ->siglock to protect ->signal/->sighand
 565  */
 566 static void __tty_hangup(struct tty_struct *tty, int exit_session)
 567 {
 568         struct file *cons_filp = NULL;
 569         struct file *filp, *f = NULL;
 570         struct tty_file_private *priv;
 571         int    closecount = 0, n;
 572         int refs;
 573 
 574         if (!tty)
 575                 return;
 576 
 577 
 578         spin_lock(&redirect_lock);
 579         if (redirect && file_tty(redirect) == tty) {
 580                 f = redirect;
 581                 redirect = NULL;
 582         }
 583         spin_unlock(&redirect_lock);
 584 
 585         tty_lock(tty);
 586 
 587         if (test_bit(TTY_HUPPED, &tty->flags)) {
 588                 tty_unlock(tty);
 589                 return;
 590         }
 591 
 592         /*
 593          * Some console devices aren't actually hung up for technical and
 594          * historical reasons, which can lead to indefinite interruptible
 595          * sleep in n_tty_read().  The following explicitly tells
 596          * n_tty_read() to abort readers.
 597          */
 598         set_bit(TTY_HUPPING, &tty->flags);
 599 
 600         /* inuse_filps is protected by the single tty lock,
 601            this really needs to change if we want to flush the
 602            workqueue with the lock held */
 603         check_tty_count(tty, "tty_hangup");
 604 
 605         spin_lock(&tty->files_lock);
 606         /* This breaks for file handles being sent over AF_UNIX sockets ? */
 607         list_for_each_entry(priv, &tty->tty_files, list) {
 608                 filp = priv->file;
 609                 if (filp->f_op->write == redirected_tty_write)
 610                         cons_filp = filp;
 611                 if (filp->f_op->write != tty_write)
 612                         continue;
 613                 closecount++;
 614                 __tty_fasync(-1, filp, 0);      /* can't block */
 615                 filp->f_op = &hung_up_tty_fops;
 616         }
 617         spin_unlock(&tty->files_lock);
 618 
 619         refs = tty_signal_session_leader(tty, exit_session);
 620         /* Account for the p->signal references we killed */
 621         while (refs--)
 622                 tty_kref_put(tty);
 623 
 624         tty_ldisc_hangup(tty, cons_filp != NULL);
 625 
 626         spin_lock_irq(&tty->ctrl_lock);
 627         clear_bit(TTY_THROTTLED, &tty->flags);
 628         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
 629         put_pid(tty->session);
 630         put_pid(tty->pgrp);
 631         tty->session = NULL;
 632         tty->pgrp = NULL;
 633         tty->ctrl_status = 0;
 634         spin_unlock_irq(&tty->ctrl_lock);
 635 
 636         /*
 637          * If one of the devices matches a console pointer, we
 638          * cannot just call hangup() because that will cause
 639          * tty->count and state->count to go out of sync.
 640          * So we just call close() the right number of times.
 641          */
 642         if (cons_filp) {
 643                 if (tty->ops->close)
 644                         for (n = 0; n < closecount; n++)
 645                                 tty->ops->close(tty, cons_filp);
 646         } else if (tty->ops->hangup)
 647                 tty->ops->hangup(tty);
 648         /*
 649          * We don't want to have driver/ldisc interactions beyond the ones
 650          * we did here. The driver layer expects no calls after ->hangup()
 651          * from the ldisc side, which is now guaranteed.
 652          */
 653         set_bit(TTY_HUPPED, &tty->flags);
 654         clear_bit(TTY_HUPPING, &tty->flags);
 655         tty_unlock(tty);
 656 
 657         if (f)
 658                 fput(f);
 659 }
 660 
 661 static void do_tty_hangup(struct work_struct *work)
 662 {
 663         struct tty_struct *tty =
 664                 container_of(work, struct tty_struct, hangup_work);
 665 
 666         __tty_hangup(tty, 0);
 667 }
 668 
 669 /**
 670  *      tty_hangup              -       trigger a hangup event
 671  *      @tty: tty to hangup
 672  *
 673  *      A carrier loss (virtual or otherwise) has occurred on this like
 674  *      schedule a hangup sequence to run after this event.
 675  */
 676 
 677 void tty_hangup(struct tty_struct *tty)
 678 {
 679         tty_debug_hangup(tty, "hangup\n");
 680         schedule_work(&tty->hangup_work);
 681 }
 682 
 683 EXPORT_SYMBOL(tty_hangup);
 684 
 685 /**
 686  *      tty_vhangup             -       process vhangup
 687  *      @tty: tty to hangup
 688  *
 689  *      The user has asked via system call for the terminal to be hung up.
 690  *      We do this synchronously so that when the syscall returns the process
 691  *      is complete. That guarantee is necessary for security reasons.
 692  */
 693 
 694 void tty_vhangup(struct tty_struct *tty)
 695 {
 696         tty_debug_hangup(tty, "vhangup\n");
 697         __tty_hangup(tty, 0);
 698 }
 699 
 700 EXPORT_SYMBOL(tty_vhangup);
 701 
 702 
 703 /**
 704  *      tty_vhangup_self        -       process vhangup for own ctty
 705  *
 706  *      Perform a vhangup on the current controlling tty
 707  */
 708 
 709 void tty_vhangup_self(void)
 710 {
 711         struct tty_struct *tty;
 712 
 713         tty = get_current_tty();
 714         if (tty) {
 715                 tty_vhangup(tty);
 716                 tty_kref_put(tty);
 717         }
 718 }
 719 
 720 /**
 721  *      tty_vhangup_session             -       hangup session leader exit
 722  *      @tty: tty to hangup
 723  *
 724  *      The session leader is exiting and hanging up its controlling terminal.
 725  *      Every process in the foreground process group is signalled SIGHUP.
 726  *
 727  *      We do this synchronously so that when the syscall returns the process
 728  *      is complete. That guarantee is necessary for security reasons.
 729  */
 730 
 731 void tty_vhangup_session(struct tty_struct *tty)
 732 {
 733         tty_debug_hangup(tty, "session hangup\n");
 734         __tty_hangup(tty, 1);
 735 }
 736 
 737 /**
 738  *      tty_hung_up_p           -       was tty hung up
 739  *      @filp: file pointer of tty
 740  *
 741  *      Return true if the tty has been subject to a vhangup or a carrier
 742  *      loss
 743  */
 744 
 745 int tty_hung_up_p(struct file *filp)
 746 {
 747         return (filp && filp->f_op == &hung_up_tty_fops);
 748 }
 749 
 750 EXPORT_SYMBOL(tty_hung_up_p);
 751 
 752 /**
 753  *      stop_tty        -       propagate flow control
 754  *      @tty: tty to stop
 755  *
 756  *      Perform flow control to the driver. May be called
 757  *      on an already stopped device and will not re-call the driver
 758  *      method.
 759  *
 760  *      This functionality is used by both the line disciplines for
 761  *      halting incoming flow and by the driver. It may therefore be
 762  *      called from any context, may be under the tty atomic_write_lock
 763  *      but not always.
 764  *
 765  *      Locking:
 766  *              flow_lock
 767  */
 768 
 769 void __stop_tty(struct tty_struct *tty)
 770 {
 771         if (tty->stopped)
 772                 return;
 773         tty->stopped = 1;
 774         if (tty->ops->stop)
 775                 tty->ops->stop(tty);
 776 }
 777 
 778 void stop_tty(struct tty_struct *tty)
 779 {
 780         unsigned long flags;
 781 
 782         spin_lock_irqsave(&tty->flow_lock, flags);
 783         __stop_tty(tty);
 784         spin_unlock_irqrestore(&tty->flow_lock, flags);
 785 }
 786 EXPORT_SYMBOL(stop_tty);
 787 
 788 /**
 789  *      start_tty       -       propagate flow control
 790  *      @tty: tty to start
 791  *
 792  *      Start a tty that has been stopped if at all possible. If this
 793  *      tty was previous stopped and is now being started, the driver
 794  *      start method is invoked and the line discipline woken.
 795  *
 796  *      Locking:
 797  *              flow_lock
 798  */
 799 
 800 void __start_tty(struct tty_struct *tty)
 801 {
 802         if (!tty->stopped || tty->flow_stopped)
 803                 return;
 804         tty->stopped = 0;
 805         if (tty->ops->start)
 806                 tty->ops->start(tty);
 807         tty_wakeup(tty);
 808 }
 809 
 810 void start_tty(struct tty_struct *tty)
 811 {
 812         unsigned long flags;
 813 
 814         spin_lock_irqsave(&tty->flow_lock, flags);
 815         __start_tty(tty);
 816         spin_unlock_irqrestore(&tty->flow_lock, flags);
 817 }
 818 EXPORT_SYMBOL(start_tty);
 819 
 820 static void tty_update_time(struct timespec64 *time)
 821 {
 822         time64_t sec = ktime_get_real_seconds();
 823 
 824         /*
 825          * We only care if the two values differ in anything other than the
 826          * lower three bits (i.e every 8 seconds).  If so, then we can update
 827          * the time of the tty device, otherwise it could be construded as a
 828          * security leak to let userspace know the exact timing of the tty.
 829          */
 830         if ((sec ^ time->tv_sec) & ~7)
 831                 time->tv_sec = sec;
 832 }
 833 
 834 /**
 835  *      tty_read        -       read method for tty device files
 836  *      @file: pointer to tty file
 837  *      @buf: user buffer
 838  *      @count: size of user buffer
 839  *      @ppos: unused
 840  *
 841  *      Perform the read system call function on this terminal device. Checks
 842  *      for hung up devices before calling the line discipline method.
 843  *
 844  *      Locking:
 845  *              Locks the line discipline internally while needed. Multiple
 846  *      read calls may be outstanding in parallel.
 847  */
 848 
 849 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
 850                         loff_t *ppos)
 851 {
 852         int i;
 853         struct inode *inode = file_inode(file);
 854         struct tty_struct *tty = file_tty(file);
 855         struct tty_ldisc *ld;
 856 
 857         if (tty_paranoia_check(tty, inode, "tty_read"))
 858                 return -EIO;
 859         if (!tty || tty_io_error(tty))
 860                 return -EIO;
 861 
 862         /* We want to wait for the line discipline to sort out in this
 863            situation */
 864         ld = tty_ldisc_ref_wait(tty);
 865         if (!ld)
 866                 return hung_up_tty_read(file, buf, count, ppos);
 867         if (ld->ops->read)
 868                 i = ld->ops->read(tty, file, buf, count);
 869         else
 870                 i = -EIO;
 871         tty_ldisc_deref(ld);
 872 
 873         if (i > 0)
 874                 tty_update_time(&inode->i_atime);
 875 
 876         return i;
 877 }
 878 
 879 static void tty_write_unlock(struct tty_struct *tty)
 880 {
 881         mutex_unlock(&tty->atomic_write_lock);
 882         wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
 883 }
 884 
 885 static int tty_write_lock(struct tty_struct *tty, int ndelay)
 886 {
 887         if (!mutex_trylock(&tty->atomic_write_lock)) {
 888                 if (ndelay)
 889                         return -EAGAIN;
 890                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
 891                         return -ERESTARTSYS;
 892         }
 893         return 0;
 894 }
 895 
 896 /*
 897  * Split writes up in sane blocksizes to avoid
 898  * denial-of-service type attacks
 899  */
 900 static inline ssize_t do_tty_write(
 901         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
 902         struct tty_struct *tty,
 903         struct file *file,
 904         const char __user *buf,
 905         size_t count)
 906 {
 907         ssize_t ret, written = 0;
 908         unsigned int chunk;
 909 
 910         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
 911         if (ret < 0)
 912                 return ret;
 913 
 914         /*
 915          * We chunk up writes into a temporary buffer. This
 916          * simplifies low-level drivers immensely, since they
 917          * don't have locking issues and user mode accesses.
 918          *
 919          * But if TTY_NO_WRITE_SPLIT is set, we should use a
 920          * big chunk-size..
 921          *
 922          * The default chunk-size is 2kB, because the NTTY
 923          * layer has problems with bigger chunks. It will
 924          * claim to be able to handle more characters than
 925          * it actually does.
 926          *
 927          * FIXME: This can probably go away now except that 64K chunks
 928          * are too likely to fail unless switched to vmalloc...
 929          */
 930         chunk = 2048;
 931         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
 932                 chunk = 65536;
 933         if (count < chunk)
 934                 chunk = count;
 935 
 936         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
 937         if (tty->write_cnt < chunk) {
 938                 unsigned char *buf_chunk;
 939 
 940                 if (chunk < 1024)
 941                         chunk = 1024;
 942 
 943                 buf_chunk = kmalloc(chunk, GFP_KERNEL);
 944                 if (!buf_chunk) {
 945                         ret = -ENOMEM;
 946                         goto out;
 947                 }
 948                 kfree(tty->write_buf);
 949                 tty->write_cnt = chunk;
 950                 tty->write_buf = buf_chunk;
 951         }
 952 
 953         /* Do the write .. */
 954         for (;;) {
 955                 size_t size = count;
 956                 if (size > chunk)
 957                         size = chunk;
 958                 ret = -EFAULT;
 959                 if (copy_from_user(tty->write_buf, buf, size))
 960                         break;
 961                 ret = write(tty, file, tty->write_buf, size);
 962                 if (ret <= 0)
 963                         break;
 964                 written += ret;
 965                 buf += ret;
 966                 count -= ret;
 967                 if (!count)
 968                         break;
 969                 ret = -ERESTARTSYS;
 970                 if (signal_pending(current))
 971                         break;
 972                 cond_resched();
 973         }
 974         if (written) {
 975                 tty_update_time(&file_inode(file)->i_mtime);
 976                 ret = written;
 977         }
 978 out:
 979         tty_write_unlock(tty);
 980         return ret;
 981 }
 982 
 983 /**
 984  * tty_write_message - write a message to a certain tty, not just the console.
 985  * @tty: the destination tty_struct
 986  * @msg: the message to write
 987  *
 988  * This is used for messages that need to be redirected to a specific tty.
 989  * We don't put it into the syslog queue right now maybe in the future if
 990  * really needed.
 991  *
 992  * We must still hold the BTM and test the CLOSING flag for the moment.
 993  */
 994 
 995 void tty_write_message(struct tty_struct *tty, char *msg)
 996 {
 997         if (tty) {
 998                 mutex_lock(&tty->atomic_write_lock);
 999                 tty_lock(tty);
1000                 if (tty->ops->write && tty->count > 0)
1001                         tty->ops->write(tty, msg, strlen(msg));
1002                 tty_unlock(tty);
1003                 tty_write_unlock(tty);
1004         }
1005         return;
1006 }
1007 
1008 
1009 /**
1010  *      tty_write               -       write method for tty device file
1011  *      @file: tty file pointer
1012  *      @buf: user data to write
1013  *      @count: bytes to write
1014  *      @ppos: unused
1015  *
1016  *      Write data to a tty device via the line discipline.
1017  *
1018  *      Locking:
1019  *              Locks the line discipline as required
1020  *              Writes to the tty driver are serialized by the atomic_write_lock
1021  *      and are then processed in chunks to the device. The line discipline
1022  *      write method will not be invoked in parallel for each device.
1023  */
1024 
1025 static ssize_t tty_write(struct file *file, const char __user *buf,
1026                                                 size_t count, loff_t *ppos)
1027 {
1028         struct tty_struct *tty = file_tty(file);
1029         struct tty_ldisc *ld;
1030         ssize_t ret;
1031 
1032         if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1033                 return -EIO;
1034         if (!tty || !tty->ops->write || tty_io_error(tty))
1035                         return -EIO;
1036         /* Short term debug to catch buggy drivers */
1037         if (tty->ops->write_room == NULL)
1038                 tty_err(tty, "missing write_room method\n");
1039         ld = tty_ldisc_ref_wait(tty);
1040         if (!ld)
1041                 return hung_up_tty_write(file, buf, count, ppos);
1042         if (!ld->ops->write)
1043                 ret = -EIO;
1044         else
1045                 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1046         tty_ldisc_deref(ld);
1047         return ret;
1048 }
1049 
1050 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1051                                                 size_t count, loff_t *ppos)
1052 {
1053         struct file *p = NULL;
1054 
1055         spin_lock(&redirect_lock);
1056         if (redirect)
1057                 p = get_file(redirect);
1058         spin_unlock(&redirect_lock);
1059 
1060         if (p) {
1061                 ssize_t res;
1062                 res = vfs_write(p, buf, count, &p->f_pos);
1063                 fput(p);
1064                 return res;
1065         }
1066         return tty_write(file, buf, count, ppos);
1067 }
1068 
1069 /**
1070  *      tty_send_xchar  -       send priority character
1071  *
1072  *      Send a high priority character to the tty even if stopped
1073  *
1074  *      Locking: none for xchar method, write ordering for write method.
1075  */
1076 
1077 int tty_send_xchar(struct tty_struct *tty, char ch)
1078 {
1079         int     was_stopped = tty->stopped;
1080 
1081         if (tty->ops->send_xchar) {
1082                 down_read(&tty->termios_rwsem);
1083                 tty->ops->send_xchar(tty, ch);
1084                 up_read(&tty->termios_rwsem);
1085                 return 0;
1086         }
1087 
1088         if (tty_write_lock(tty, 0) < 0)
1089                 return -ERESTARTSYS;
1090 
1091         down_read(&tty->termios_rwsem);
1092         if (was_stopped)
1093                 start_tty(tty);
1094         tty->ops->write(tty, &ch, 1);
1095         if (was_stopped)
1096                 stop_tty(tty);
1097         up_read(&tty->termios_rwsem);
1098         tty_write_unlock(tty);
1099         return 0;
1100 }
1101 
1102 static char ptychar[] = "pqrstuvwxyzabcde";
1103 
1104 /**
1105  *      pty_line_name   -       generate name for a pty
1106  *      @driver: the tty driver in use
1107  *      @index: the minor number
1108  *      @p: output buffer of at least 6 bytes
1109  *
1110  *      Generate a name from a driver reference and write it to the output
1111  *      buffer.
1112  *
1113  *      Locking: None
1114  */
1115 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1116 {
1117         int i = index + driver->name_base;
1118         /* ->name is initialized to "ttyp", but "tty" is expected */
1119         sprintf(p, "%s%c%x",
1120                 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1121                 ptychar[i >> 4 & 0xf], i & 0xf);
1122 }
1123 
1124 /**
1125  *      tty_line_name   -       generate name for a tty
1126  *      @driver: the tty driver in use
1127  *      @index: the minor number
1128  *      @p: output buffer of at least 7 bytes
1129  *
1130  *      Generate a name from a driver reference and write it to the output
1131  *      buffer.
1132  *
1133  *      Locking: None
1134  */
1135 static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1136 {
1137         if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1138                 return sprintf(p, "%s", driver->name);
1139         else
1140                 return sprintf(p, "%s%d", driver->name,
1141                                index + driver->name_base);
1142 }
1143 
1144 /**
1145  *      tty_driver_lookup_tty() - find an existing tty, if any
1146  *      @driver: the driver for the tty
1147  *      @idx:    the minor number
1148  *
1149  *      Return the tty, if found. If not found, return NULL or ERR_PTR() if the
1150  *      driver lookup() method returns an error.
1151  *
1152  *      Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1153  */
1154 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1155                 struct file *file, int idx)
1156 {
1157         struct tty_struct *tty;
1158 
1159         if (driver->ops->lookup)
1160                 if (!file)
1161                         tty = ERR_PTR(-EIO);
1162                 else
1163                         tty = driver->ops->lookup(driver, file, idx);
1164         else
1165                 tty = driver->ttys[idx];
1166 
1167         if (!IS_ERR(tty))
1168                 tty_kref_get(tty);
1169         return tty;
1170 }
1171 
1172 /**
1173  *      tty_init_termios        -  helper for termios setup
1174  *      @tty: the tty to set up
1175  *
1176  *      Initialise the termios structure for this tty. This runs under
1177  *      the tty_mutex currently so we can be relaxed about ordering.
1178  */
1179 
1180 void tty_init_termios(struct tty_struct *tty)
1181 {
1182         struct ktermios *tp;
1183         int idx = tty->index;
1184 
1185         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1186                 tty->termios = tty->driver->init_termios;
1187         else {
1188                 /* Check for lazy saved data */
1189                 tp = tty->driver->termios[idx];
1190                 if (tp != NULL) {
1191                         tty->termios = *tp;
1192                         tty->termios.c_line  = tty->driver->init_termios.c_line;
1193                 } else
1194                         tty->termios = tty->driver->init_termios;
1195         }
1196         /* Compatibility until drivers always set this */
1197         tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1198         tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1199 }
1200 EXPORT_SYMBOL_GPL(tty_init_termios);
1201 
1202 int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1203 {
1204         tty_init_termios(tty);
1205         tty_driver_kref_get(driver);
1206         tty->count++;
1207         driver->ttys[tty->index] = tty;
1208         return 0;
1209 }
1210 EXPORT_SYMBOL_GPL(tty_standard_install);
1211 
1212 /**
1213  *      tty_driver_install_tty() - install a tty entry in the driver
1214  *      @driver: the driver for the tty
1215  *      @tty: the tty
1216  *
1217  *      Install a tty object into the driver tables. The tty->index field
1218  *      will be set by the time this is called. This method is responsible
1219  *      for ensuring any need additional structures are allocated and
1220  *      configured.
1221  *
1222  *      Locking: tty_mutex for now
1223  */
1224 static int tty_driver_install_tty(struct tty_driver *driver,
1225                                                 struct tty_struct *tty)
1226 {
1227         return driver->ops->install ? driver->ops->install(driver, tty) :
1228                 tty_standard_install(driver, tty);
1229 }
1230 
1231 /**
1232  *      tty_driver_remove_tty() - remove a tty from the driver tables
1233  *      @driver: the driver for the tty
1234  *      @idx:    the minor number
1235  *
1236  *      Remvoe a tty object from the driver tables. The tty->index field
1237  *      will be set by the time this is called.
1238  *
1239  *      Locking: tty_mutex for now
1240  */
1241 static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1242 {
1243         if (driver->ops->remove)
1244                 driver->ops->remove(driver, tty);
1245         else
1246                 driver->ttys[tty->index] = NULL;
1247 }
1248 
1249 /*
1250  *      tty_reopen()    - fast re-open of an open tty
1251  *      @tty    - the tty to open
1252  *
1253  *      Return 0 on success, -errno on error.
1254  *      Re-opens on master ptys are not allowed and return -EIO.
1255  *
1256  *      Locking: Caller must hold tty_lock
1257  */
1258 static int tty_reopen(struct tty_struct *tty)
1259 {
1260         struct tty_driver *driver = tty->driver;
1261         struct tty_ldisc *ld;
1262         int retval = 0;
1263 
1264         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1265             driver->subtype == PTY_TYPE_MASTER)
1266                 return -EIO;
1267 
1268         if (!tty->count)
1269                 return -EAGAIN;
1270 
1271         if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1272                 return -EBUSY;
1273 
1274         ld = tty_ldisc_ref_wait(tty);
1275         if (ld) {
1276                 tty_ldisc_deref(ld);
1277         } else {
1278                 retval = tty_ldisc_lock(tty, 5 * HZ);
1279                 if (retval)
1280                         return retval;
1281 
1282                 if (!tty->ldisc)
1283                         retval = tty_ldisc_reinit(tty, tty->termios.c_line);
1284                 tty_ldisc_unlock(tty);
1285         }
1286 
1287         if (retval == 0)
1288                 tty->count++;
1289 
1290         return retval;
1291 }
1292 
1293 /**
1294  *      tty_init_dev            -       initialise a tty device
1295  *      @driver: tty driver we are opening a device on
1296  *      @idx: device index
1297  *      @ret_tty: returned tty structure
1298  *
1299  *      Prepare a tty device. This may not be a "new" clean device but
1300  *      could also be an active device. The pty drivers require special
1301  *      handling because of this.
1302  *
1303  *      Locking:
1304  *              The function is called under the tty_mutex, which
1305  *      protects us from the tty struct or driver itself going away.
1306  *
1307  *      On exit the tty device has the line discipline attached and
1308  *      a reference count of 1. If a pair was created for pty/tty use
1309  *      and the other was a pty master then it too has a reference count of 1.
1310  *
1311  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1312  * failed open.  The new code protects the open with a mutex, so it's
1313  * really quite straightforward.  The mutex locking can probably be
1314  * relaxed for the (most common) case of reopening a tty.
1315  */
1316 
1317 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1318 {
1319         struct tty_struct *tty;
1320         int retval;
1321 
1322         /*
1323          * First time open is complex, especially for PTY devices.
1324          * This code guarantees that either everything succeeds and the
1325          * TTY is ready for operation, or else the table slots are vacated
1326          * and the allocated memory released.  (Except that the termios
1327          * may be retained.)
1328          */
1329 
1330         if (!try_module_get(driver->owner))
1331                 return ERR_PTR(-ENODEV);
1332 
1333         tty = alloc_tty_struct(driver, idx);
1334         if (!tty) {
1335                 retval = -ENOMEM;
1336                 goto err_module_put;
1337         }
1338 
1339         tty_lock(tty);
1340         retval = tty_driver_install_tty(driver, tty);
1341         if (retval < 0)
1342                 goto err_free_tty;
1343 
1344         if (!tty->port)
1345                 tty->port = driver->ports[idx];
1346 
1347         WARN_RATELIMIT(!tty->port,
1348                         "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1349                         __func__, tty->driver->name);
1350 
1351         retval = tty_ldisc_lock(tty, 5 * HZ);
1352         if (retval)
1353                 goto err_release_lock;
1354         tty->port->itty = tty;
1355 
1356         /*
1357          * Structures all installed ... call the ldisc open routines.
1358          * If we fail here just call release_tty to clean up.  No need
1359          * to decrement the use counts, as release_tty doesn't care.
1360          */
1361         retval = tty_ldisc_setup(tty, tty->link);
1362         if (retval)
1363                 goto err_release_tty;
1364         tty_ldisc_unlock(tty);
1365         /* Return the tty locked so that it cannot vanish under the caller */
1366         return tty;
1367 
1368 err_free_tty:
1369         tty_unlock(tty);
1370         free_tty_struct(tty);
1371 err_module_put:
1372         module_put(driver->owner);
1373         return ERR_PTR(retval);
1374 
1375         /* call the tty release_tty routine to clean out this slot */
1376 err_release_tty:
1377         tty_ldisc_unlock(tty);
1378         tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1379                              retval, idx);
1380 err_release_lock:
1381         tty_unlock(tty);
1382         release_tty(tty, idx);
1383         return ERR_PTR(retval);
1384 }
1385 
1386 /**
1387  * tty_save_termios() - save tty termios data in driver table
1388  * @tty: tty whose termios data to save
1389  *
1390  * Locking: Caller guarantees serialisation with tty_init_termios().
1391  */
1392 void tty_save_termios(struct tty_struct *tty)
1393 {
1394         struct ktermios *tp;
1395         int idx = tty->index;
1396 
1397         /* If the port is going to reset then it has no termios to save */
1398         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1399                 return;
1400 
1401         /* Stash the termios data */
1402         tp = tty->driver->termios[idx];
1403         if (tp == NULL) {
1404                 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1405                 if (tp == NULL)
1406                         return;
1407                 tty->driver->termios[idx] = tp;
1408         }
1409         *tp = tty->termios;
1410 }
1411 EXPORT_SYMBOL_GPL(tty_save_termios);
1412 
1413 /**
1414  *      tty_flush_works         -       flush all works of a tty/pty pair
1415  *      @tty: tty device to flush works for (or either end of a pty pair)
1416  *
1417  *      Sync flush all works belonging to @tty (and the 'other' tty).
1418  */
1419 static void tty_flush_works(struct tty_struct *tty)
1420 {
1421         flush_work(&tty->SAK_work);
1422         flush_work(&tty->hangup_work);
1423         if (tty->link) {
1424                 flush_work(&tty->link->SAK_work);
1425                 flush_work(&tty->link->hangup_work);
1426         }
1427 }
1428 
1429 /**
1430  *      release_one_tty         -       release tty structure memory
1431  *      @kref: kref of tty we are obliterating
1432  *
1433  *      Releases memory associated with a tty structure, and clears out the
1434  *      driver table slots. This function is called when a device is no longer
1435  *      in use. It also gets called when setup of a device fails.
1436  *
1437  *      Locking:
1438  *              takes the file list lock internally when working on the list
1439  *      of ttys that the driver keeps.
1440  *
1441  *      This method gets called from a work queue so that the driver private
1442  *      cleanup ops can sleep (needed for USB at least)
1443  */
1444 static void release_one_tty(struct work_struct *work)
1445 {
1446         struct tty_struct *tty =
1447                 container_of(work, struct tty_struct, hangup_work);
1448         struct tty_driver *driver = tty->driver;
1449         struct module *owner = driver->owner;
1450 
1451         if (tty->ops->cleanup)
1452                 tty->ops->cleanup(tty);
1453 
1454         tty->magic = 0;
1455         tty_driver_kref_put(driver);
1456         module_put(owner);
1457 
1458         spin_lock(&tty->files_lock);
1459         list_del_init(&tty->tty_files);
1460         spin_unlock(&tty->files_lock);
1461 
1462         put_pid(tty->pgrp);
1463         put_pid(tty->session);
1464         free_tty_struct(tty);
1465 }
1466 
1467 static void queue_release_one_tty(struct kref *kref)
1468 {
1469         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1470 
1471         /* The hangup queue is now free so we can reuse it rather than
1472            waste a chunk of memory for each port */
1473         INIT_WORK(&tty->hangup_work, release_one_tty);
1474         schedule_work(&tty->hangup_work);
1475 }
1476 
1477 /**
1478  *      tty_kref_put            -       release a tty kref
1479  *      @tty: tty device
1480  *
1481  *      Release a reference to a tty device and if need be let the kref
1482  *      layer destruct the object for us
1483  */
1484 
1485 void tty_kref_put(struct tty_struct *tty)
1486 {
1487         if (tty)
1488                 kref_put(&tty->kref, queue_release_one_tty);
1489 }
1490 EXPORT_SYMBOL(tty_kref_put);
1491 
1492 /**
1493  *      release_tty             -       release tty structure memory
1494  *
1495  *      Release both @tty and a possible linked partner (think pty pair),
1496  *      and decrement the refcount of the backing module.
1497  *
1498  *      Locking:
1499  *              tty_mutex
1500  *              takes the file list lock internally when working on the list
1501  *      of ttys that the driver keeps.
1502  *
1503  */
1504 static void release_tty(struct tty_struct *tty, int idx)
1505 {
1506         /* This should always be true but check for the moment */
1507         WARN_ON(tty->index != idx);
1508         WARN_ON(!mutex_is_locked(&tty_mutex));
1509         if (tty->ops->shutdown)
1510                 tty->ops->shutdown(tty);
1511         tty_save_termios(tty);
1512         tty_driver_remove_tty(tty->driver, tty);
1513         tty->port->itty = NULL;
1514         if (tty->link)
1515                 tty->link->port->itty = NULL;
1516         tty_buffer_cancel_work(tty->port);
1517         if (tty->link)
1518                 tty_buffer_cancel_work(tty->link->port);
1519 
1520         tty_kref_put(tty->link);
1521         tty_kref_put(tty);
1522 }
1523 
1524 /**
1525  *      tty_release_checks - check a tty before real release
1526  *      @tty: tty to check
1527  *      @o_tty: link of @tty (if any)
1528  *      @idx: index of the tty
1529  *
1530  *      Performs some paranoid checking before true release of the @tty.
1531  *      This is a no-op unless TTY_PARANOIA_CHECK is defined.
1532  */
1533 static int tty_release_checks(struct tty_struct *tty, int idx)
1534 {
1535 #ifdef TTY_PARANOIA_CHECK
1536         if (idx < 0 || idx >= tty->driver->num) {
1537                 tty_debug(tty, "bad idx %d\n", idx);
1538                 return -1;
1539         }
1540 
1541         /* not much to check for devpts */
1542         if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1543                 return 0;
1544 
1545         if (tty != tty->driver->ttys[idx]) {
1546                 tty_debug(tty, "bad driver table[%d] = %p\n",
1547                           idx, tty->driver->ttys[idx]);
1548                 return -1;
1549         }
1550         if (tty->driver->other) {
1551                 struct tty_struct *o_tty = tty->link;
1552 
1553                 if (o_tty != tty->driver->other->ttys[idx]) {
1554                         tty_debug(tty, "bad other table[%d] = %p\n",
1555                                   idx, tty->driver->other->ttys[idx]);
1556                         return -1;
1557                 }
1558                 if (o_tty->link != tty) {
1559                         tty_debug(tty, "bad link = %p\n", o_tty->link);
1560                         return -1;
1561                 }
1562         }
1563 #endif
1564         return 0;
1565 }
1566 
1567 /**
1568  *      tty_kclose      -       closes tty opened by tty_kopen
1569  *      @tty: tty device
1570  *
1571  *      Performs the final steps to release and free a tty device. It is the
1572  *      same as tty_release_struct except that it also resets TTY_PORT_KOPENED
1573  *      flag on tty->port.
1574  */
1575 void tty_kclose(struct tty_struct *tty)
1576 {
1577         /*
1578          * Ask the line discipline code to release its structures
1579          */
1580         tty_ldisc_release(tty);
1581 
1582         /* Wait for pending work before tty destruction commmences */
1583         tty_flush_works(tty);
1584 
1585         tty_debug_hangup(tty, "freeing structure\n");
1586         /*
1587          * The release_tty function takes care of the details of clearing
1588          * the slots and preserving the termios structure. The tty_unlock_pair
1589          * should be safe as we keep a kref while the tty is locked (so the
1590          * unlock never unlocks a freed tty).
1591          */
1592         mutex_lock(&tty_mutex);
1593         tty_port_set_kopened(tty->port, 0);
1594         release_tty(tty, tty->index);
1595         mutex_unlock(&tty_mutex);
1596 }
1597 EXPORT_SYMBOL_GPL(tty_kclose);
1598 
1599 /**
1600  *      tty_release_struct      -       release a tty struct
1601  *      @tty: tty device
1602  *      @idx: index of the tty
1603  *
1604  *      Performs the final steps to release and free a tty device. It is
1605  *      roughly the reverse of tty_init_dev.
1606  */
1607 void tty_release_struct(struct tty_struct *tty, int idx)
1608 {
1609         /*
1610          * Ask the line discipline code to release its structures
1611          */
1612         tty_ldisc_release(tty);
1613 
1614         /* Wait for pending work before tty destruction commmences */
1615         tty_flush_works(tty);
1616 
1617         tty_debug_hangup(tty, "freeing structure\n");
1618         /*
1619          * The release_tty function takes care of the details of clearing
1620          * the slots and preserving the termios structure. The tty_unlock_pair
1621          * should be safe as we keep a kref while the tty is locked (so the
1622          * unlock never unlocks a freed tty).
1623          */
1624         mutex_lock(&tty_mutex);
1625         release_tty(tty, idx);
1626         mutex_unlock(&tty_mutex);
1627 }
1628 EXPORT_SYMBOL_GPL(tty_release_struct);
1629 
1630 /**
1631  *      tty_release             -       vfs callback for close
1632  *      @inode: inode of tty
1633  *      @filp: file pointer for handle to tty
1634  *
1635  *      Called the last time each file handle is closed that references
1636  *      this tty. There may however be several such references.
1637  *
1638  *      Locking:
1639  *              Takes bkl. See tty_release_dev
1640  *
1641  * Even releasing the tty structures is a tricky business.. We have
1642  * to be very careful that the structures are all released at the
1643  * same time, as interrupts might otherwise get the wrong pointers.
1644  *
1645  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1646  * lead to double frees or releasing memory still in use.
1647  */
1648 
1649 int tty_release(struct inode *inode, struct file *filp)
1650 {
1651         struct tty_struct *tty = file_tty(filp);
1652         struct tty_struct *o_tty = NULL;
1653         int     do_sleep, final;
1654         int     idx;
1655         long    timeout = 0;
1656         int     once = 1;
1657 
1658         if (tty_paranoia_check(tty, inode, __func__))
1659                 return 0;
1660 
1661         tty_lock(tty);
1662         check_tty_count(tty, __func__);
1663 
1664         __tty_fasync(-1, filp, 0);
1665 
1666         idx = tty->index;
1667         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1668             tty->driver->subtype == PTY_TYPE_MASTER)
1669                 o_tty = tty->link;
1670 
1671         if (tty_release_checks(tty, idx)) {
1672                 tty_unlock(tty);
1673                 return 0;
1674         }
1675 
1676         tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1677 
1678         if (tty->ops->close)
1679                 tty->ops->close(tty, filp);
1680 
1681         /* If tty is pty master, lock the slave pty (stable lock order) */
1682         tty_lock_slave(o_tty);
1683 
1684         /*
1685          * Sanity check: if tty->count is going to zero, there shouldn't be
1686          * any waiters on tty->read_wait or tty->write_wait.  We test the
1687          * wait queues and kick everyone out _before_ actually starting to
1688          * close.  This ensures that we won't block while releasing the tty
1689          * structure.
1690          *
1691          * The test for the o_tty closing is necessary, since the master and
1692          * slave sides may close in any order.  If the slave side closes out
1693          * first, its count will be one, since the master side holds an open.
1694          * Thus this test wouldn't be triggered at the time the slave closed,
1695          * so we do it now.
1696          */
1697         while (1) {
1698                 do_sleep = 0;
1699 
1700                 if (tty->count <= 1) {
1701                         if (waitqueue_active(&tty->read_wait)) {
1702                                 wake_up_poll(&tty->read_wait, EPOLLIN);
1703                                 do_sleep++;
1704                         }
1705                         if (waitqueue_active(&tty->write_wait)) {
1706                                 wake_up_poll(&tty->write_wait, EPOLLOUT);
1707                                 do_sleep++;
1708                         }
1709                 }
1710                 if (o_tty && o_tty->count <= 1) {
1711                         if (waitqueue_active(&o_tty->read_wait)) {
1712                                 wake_up_poll(&o_tty->read_wait, EPOLLIN);
1713                                 do_sleep++;
1714                         }
1715                         if (waitqueue_active(&o_tty->write_wait)) {
1716                                 wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1717                                 do_sleep++;
1718                         }
1719                 }
1720                 if (!do_sleep)
1721                         break;
1722 
1723                 if (once) {
1724                         once = 0;
1725                         tty_warn(tty, "read/write wait queue active!\n");
1726                 }
1727                 schedule_timeout_killable(timeout);
1728                 if (timeout < 120 * HZ)
1729                         timeout = 2 * timeout + 1;
1730                 else
1731                         timeout = MAX_SCHEDULE_TIMEOUT;
1732         }
1733 
1734         if (o_tty) {
1735                 if (--o_tty->count < 0) {
1736                         tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1737                         o_tty->count = 0;
1738                 }
1739         }
1740         if (--tty->count < 0) {
1741                 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1742                 tty->count = 0;
1743         }
1744 
1745         /*
1746          * We've decremented tty->count, so we need to remove this file
1747          * descriptor off the tty->tty_files list; this serves two
1748          * purposes:
1749          *  - check_tty_count sees the correct number of file descriptors
1750          *    associated with this tty.
1751          *  - do_tty_hangup no longer sees this file descriptor as
1752          *    something that needs to be handled for hangups.
1753          */
1754         tty_del_file(filp);
1755 
1756         /*
1757          * Perform some housekeeping before deciding whether to return.
1758          *
1759          * If _either_ side is closing, make sure there aren't any
1760          * processes that still think tty or o_tty is their controlling
1761          * tty.
1762          */
1763         if (!tty->count) {
1764                 read_lock(&tasklist_lock);
1765                 session_clear_tty(tty->session);
1766                 if (o_tty)
1767                         session_clear_tty(o_tty->session);
1768                 read_unlock(&tasklist_lock);
1769         }
1770 
1771         /* check whether both sides are closing ... */
1772         final = !tty->count && !(o_tty && o_tty->count);
1773 
1774         tty_unlock_slave(o_tty);
1775         tty_unlock(tty);
1776 
1777         /* At this point, the tty->count == 0 should ensure a dead tty
1778            cannot be re-opened by a racing opener */
1779 
1780         if (!final)
1781                 return 0;
1782 
1783         tty_debug_hangup(tty, "final close\n");
1784 
1785         tty_release_struct(tty, idx);
1786         return 0;
1787 }
1788 
1789 /**
1790  *      tty_open_current_tty - get locked tty of current task
1791  *      @device: device number
1792  *      @filp: file pointer to tty
1793  *      @return: locked tty of the current task iff @device is /dev/tty
1794  *
1795  *      Performs a re-open of the current task's controlling tty.
1796  *
1797  *      We cannot return driver and index like for the other nodes because
1798  *      devpts will not work then. It expects inodes to be from devpts FS.
1799  */
1800 static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1801 {
1802         struct tty_struct *tty;
1803         int retval;
1804 
1805         if (device != MKDEV(TTYAUX_MAJOR, 0))
1806                 return NULL;
1807 
1808         tty = get_current_tty();
1809         if (!tty)
1810                 return ERR_PTR(-ENXIO);
1811 
1812         filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1813         /* noctty = 1; */
1814         tty_lock(tty);
1815         tty_kref_put(tty);      /* safe to drop the kref now */
1816 
1817         retval = tty_reopen(tty);
1818         if (retval < 0) {
1819                 tty_unlock(tty);
1820                 tty = ERR_PTR(retval);
1821         }
1822         return tty;
1823 }
1824 
1825 /**
1826  *      tty_lookup_driver - lookup a tty driver for a given device file
1827  *      @device: device number
1828  *      @filp: file pointer to tty
1829  *      @index: index for the device in the @return driver
1830  *      @return: driver for this inode (with increased refcount)
1831  *
1832  *      If @return is not erroneous, the caller is responsible to decrement the
1833  *      refcount by tty_driver_kref_put.
1834  *
1835  *      Locking: tty_mutex protects get_tty_driver
1836  */
1837 static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1838                 int *index)
1839 {
1840         struct tty_driver *driver = NULL;
1841 
1842         switch (device) {
1843 #ifdef CONFIG_VT
1844         case MKDEV(TTY_MAJOR, 0): {
1845                 extern struct tty_driver *console_driver;
1846                 driver = tty_driver_kref_get(console_driver);
1847                 *index = fg_console;
1848                 break;
1849         }
1850 #endif
1851         case MKDEV(TTYAUX_MAJOR, 1): {
1852                 struct tty_driver *console_driver = console_device(index);
1853                 if (console_driver) {
1854                         driver = tty_driver_kref_get(console_driver);
1855                         if (driver && filp) {
1856                                 /* Don't let /dev/console block */
1857                                 filp->f_flags |= O_NONBLOCK;
1858                                 break;
1859                         }
1860                 }
1861                 if (driver)
1862                         tty_driver_kref_put(driver);
1863                 return ERR_PTR(-ENODEV);
1864         }
1865         default:
1866                 driver = get_tty_driver(device, index);
1867                 if (!driver)
1868                         return ERR_PTR(-ENODEV);
1869                 break;
1870         }
1871         return driver;
1872 }
1873 
1874 /**
1875  *      tty_kopen       -       open a tty device for kernel
1876  *      @device: dev_t of device to open
1877  *
1878  *      Opens tty exclusively for kernel. Performs the driver lookup,
1879  *      makes sure it's not already opened and performs the first-time
1880  *      tty initialization.
1881  *
1882  *      Returns the locked initialized &tty_struct
1883  *
1884  *      Claims the global tty_mutex to serialize:
1885  *        - concurrent first-time tty initialization
1886  *        - concurrent tty driver removal w/ lookup
1887  *        - concurrent tty removal from driver table
1888  */
1889 struct tty_struct *tty_kopen(dev_t device)
1890 {
1891         struct tty_struct *tty;
1892         struct tty_driver *driver = NULL;
1893         int index = -1;
1894 
1895         mutex_lock(&tty_mutex);
1896         driver = tty_lookup_driver(device, NULL, &index);
1897         if (IS_ERR(driver)) {
1898                 mutex_unlock(&tty_mutex);
1899                 return ERR_CAST(driver);
1900         }
1901 
1902         /* check whether we're reopening an existing tty */
1903         tty = tty_driver_lookup_tty(driver, NULL, index);
1904         if (IS_ERR(tty))
1905                 goto out;
1906 
1907         if (tty) {
1908                 /* drop kref from tty_driver_lookup_tty() */
1909                 tty_kref_put(tty);
1910                 tty = ERR_PTR(-EBUSY);
1911         } else { /* tty_init_dev returns tty with the tty_lock held */
1912                 tty = tty_init_dev(driver, index);
1913                 if (IS_ERR(tty))
1914                         goto out;
1915                 tty_port_set_kopened(tty->port, 1);
1916         }
1917 out:
1918         mutex_unlock(&tty_mutex);
1919         tty_driver_kref_put(driver);
1920         return tty;
1921 }
1922 EXPORT_SYMBOL_GPL(tty_kopen);
1923 
1924 /**
1925  *      tty_open_by_driver      -       open a tty device
1926  *      @device: dev_t of device to open
1927  *      @inode: inode of device file
1928  *      @filp: file pointer to tty
1929  *
1930  *      Performs the driver lookup, checks for a reopen, or otherwise
1931  *      performs the first-time tty initialization.
1932  *
1933  *      Returns the locked initialized or re-opened &tty_struct
1934  *
1935  *      Claims the global tty_mutex to serialize:
1936  *        - concurrent first-time tty initialization
1937  *        - concurrent tty driver removal w/ lookup
1938  *        - concurrent tty removal from driver table
1939  */
1940 static struct tty_struct *tty_open_by_driver(dev_t device, struct inode *inode,
1941                                              struct file *filp)
1942 {
1943         struct tty_struct *tty;
1944         struct tty_driver *driver = NULL;
1945         int index = -1;
1946         int retval;
1947 
1948         mutex_lock(&tty_mutex);
1949         driver = tty_lookup_driver(device, filp, &index);
1950         if (IS_ERR(driver)) {
1951                 mutex_unlock(&tty_mutex);
1952                 return ERR_CAST(driver);
1953         }
1954 
1955         /* check whether we're reopening an existing tty */
1956         tty = tty_driver_lookup_tty(driver, filp, index);
1957         if (IS_ERR(tty)) {
1958                 mutex_unlock(&tty_mutex);
1959                 goto out;
1960         }
1961 
1962         if (tty) {
1963                 if (tty_port_kopened(tty->port)) {
1964                         tty_kref_put(tty);
1965                         mutex_unlock(&tty_mutex);
1966                         tty = ERR_PTR(-EBUSY);
1967                         goto out;
1968                 }
1969                 mutex_unlock(&tty_mutex);
1970                 retval = tty_lock_interruptible(tty);
1971                 tty_kref_put(tty);  /* drop kref from tty_driver_lookup_tty() */
1972                 if (retval) {
1973                         if (retval == -EINTR)
1974                                 retval = -ERESTARTSYS;
1975                         tty = ERR_PTR(retval);
1976                         goto out;
1977                 }
1978                 retval = tty_reopen(tty);
1979                 if (retval < 0) {
1980                         tty_unlock(tty);
1981                         tty = ERR_PTR(retval);
1982                 }
1983         } else { /* Returns with the tty_lock held for now */
1984                 tty = tty_init_dev(driver, index);
1985                 mutex_unlock(&tty_mutex);
1986         }
1987 out:
1988         tty_driver_kref_put(driver);
1989         return tty;
1990 }
1991 
1992 /**
1993  *      tty_open                -       open a tty device
1994  *      @inode: inode of device file
1995  *      @filp: file pointer to tty
1996  *
1997  *      tty_open and tty_release keep up the tty count that contains the
1998  *      number of opens done on a tty. We cannot use the inode-count, as
1999  *      different inodes might point to the same tty.
2000  *
2001  *      Open-counting is needed for pty masters, as well as for keeping
2002  *      track of serial lines: DTR is dropped when the last close happens.
2003  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
2004  *
2005  *      The termios state of a pty is reset on first open so that
2006  *      settings don't persist across reuse.
2007  *
2008  *      Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2009  *               tty->count should protect the rest.
2010  *               ->siglock protects ->signal/->sighand
2011  *
2012  *      Note: the tty_unlock/lock cases without a ref are only safe due to
2013  *      tty_mutex
2014  */
2015 
2016 static int tty_open(struct inode *inode, struct file *filp)
2017 {
2018         struct tty_struct *tty;
2019         int noctty, retval;
2020         dev_t device = inode->i_rdev;
2021         unsigned saved_flags = filp->f_flags;
2022 
2023         nonseekable_open(inode, filp);
2024 
2025 retry_open:
2026         retval = tty_alloc_file(filp);
2027         if (retval)
2028                 return -ENOMEM;
2029 
2030         tty = tty_open_current_tty(device, filp);
2031         if (!tty)
2032                 tty = tty_open_by_driver(device, inode, filp);
2033 
2034         if (IS_ERR(tty)) {
2035                 tty_free_file(filp);
2036                 retval = PTR_ERR(tty);
2037                 if (retval != -EAGAIN || signal_pending(current))
2038                         return retval;
2039                 schedule();
2040                 goto retry_open;
2041         }
2042 
2043         tty_add_file(tty, filp);
2044 
2045         check_tty_count(tty, __func__);
2046         tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2047 
2048         if (tty->ops->open)
2049                 retval = tty->ops->open(tty, filp);
2050         else
2051                 retval = -ENODEV;
2052         filp->f_flags = saved_flags;
2053 
2054         if (retval) {
2055                 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2056 
2057                 tty_unlock(tty); /* need to call tty_release without BTM */
2058                 tty_release(inode, filp);
2059                 if (retval != -ERESTARTSYS)
2060                         return retval;
2061 
2062                 if (signal_pending(current))
2063                         return retval;
2064 
2065                 schedule();
2066                 /*
2067                  * Need to reset f_op in case a hangup happened.
2068                  */
2069                 if (tty_hung_up_p(filp))
2070                         filp->f_op = &tty_fops;
2071                 goto retry_open;
2072         }
2073         clear_bit(TTY_HUPPED, &tty->flags);
2074 
2075         noctty = (filp->f_flags & O_NOCTTY) ||
2076                  (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2077                  device == MKDEV(TTYAUX_MAJOR, 1) ||
2078                  (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2079                   tty->driver->subtype == PTY_TYPE_MASTER);
2080         if (!noctty)
2081                 tty_open_proc_set_tty(filp, tty);
2082         tty_unlock(tty);
2083         return 0;
2084 }
2085 
2086 
2087 
2088 /**
2089  *      tty_poll        -       check tty status
2090  *      @filp: file being polled
2091  *      @wait: poll wait structures to update
2092  *
2093  *      Call the line discipline polling method to obtain the poll
2094  *      status of the device.
2095  *
2096  *      Locking: locks called line discipline but ldisc poll method
2097  *      may be re-entered freely by other callers.
2098  */
2099 
2100 static __poll_t tty_poll(struct file *filp, poll_table *wait)
2101 {
2102         struct tty_struct *tty = file_tty(filp);
2103         struct tty_ldisc *ld;
2104         __poll_t ret = 0;
2105 
2106         if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2107                 return 0;
2108 
2109         ld = tty_ldisc_ref_wait(tty);
2110         if (!ld)
2111                 return hung_up_tty_poll(filp, wait);
2112         if (ld->ops->poll)
2113                 ret = ld->ops->poll(tty, filp, wait);
2114         tty_ldisc_deref(ld);
2115         return ret;
2116 }
2117 
2118 static int __tty_fasync(int fd, struct file *filp, int on)
2119 {
2120         struct tty_struct *tty = file_tty(filp);
2121         unsigned long flags;
2122         int retval = 0;
2123 
2124         if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2125                 goto out;
2126 
2127         retval = fasync_helper(fd, filp, on, &tty->fasync);
2128         if (retval <= 0)
2129                 goto out;
2130 
2131         if (on) {
2132                 enum pid_type type;
2133                 struct pid *pid;
2134 
2135                 spin_lock_irqsave(&tty->ctrl_lock, flags);
2136                 if (tty->pgrp) {
2137                         pid = tty->pgrp;
2138                         type = PIDTYPE_PGID;
2139                 } else {
2140                         pid = task_pid(current);
2141                         type = PIDTYPE_TGID;
2142                 }
2143                 get_pid(pid);
2144                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2145                 __f_setown(filp, pid, type, 0);
2146                 put_pid(pid);
2147                 retval = 0;
2148         }
2149 out:
2150         return retval;
2151 }
2152 
2153 static int tty_fasync(int fd, struct file *filp, int on)
2154 {
2155         struct tty_struct *tty = file_tty(filp);
2156         int retval = -ENOTTY;
2157 
2158         tty_lock(tty);
2159         if (!tty_hung_up_p(filp))
2160                 retval = __tty_fasync(fd, filp, on);
2161         tty_unlock(tty);
2162 
2163         return retval;
2164 }
2165 
2166 /**
2167  *      tiocsti                 -       fake input character
2168  *      @tty: tty to fake input into
2169  *      @p: pointer to character
2170  *
2171  *      Fake input to a tty device. Does the necessary locking and
2172  *      input management.
2173  *
2174  *      FIXME: does not honour flow control ??
2175  *
2176  *      Locking:
2177  *              Called functions take tty_ldiscs_lock
2178  *              current->signal->tty check is safe without locks
2179  *
2180  *      FIXME: may race normal receive processing
2181  */
2182 
2183 static int tiocsti(struct tty_struct *tty, char __user *p)
2184 {
2185         char ch, mbz = 0;
2186         struct tty_ldisc *ld;
2187 
2188         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2189                 return -EPERM;
2190         if (get_user(ch, p))
2191                 return -EFAULT;
2192         tty_audit_tiocsti(tty, ch);
2193         ld = tty_ldisc_ref_wait(tty);
2194         if (!ld)
2195                 return -EIO;
2196         if (ld->ops->receive_buf)
2197                 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2198         tty_ldisc_deref(ld);
2199         return 0;
2200 }
2201 
2202 /**
2203  *      tiocgwinsz              -       implement window query ioctl
2204  *      @tty; tty
2205  *      @arg: user buffer for result
2206  *
2207  *      Copies the kernel idea of the window size into the user buffer.
2208  *
2209  *      Locking: tty->winsize_mutex is taken to ensure the winsize data
2210  *              is consistent.
2211  */
2212 
2213 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2214 {
2215         int err;
2216 
2217         mutex_lock(&tty->winsize_mutex);
2218         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2219         mutex_unlock(&tty->winsize_mutex);
2220 
2221         return err ? -EFAULT: 0;
2222 }
2223 
2224 /**
2225  *      tty_do_resize           -       resize event
2226  *      @tty: tty being resized
2227  *      @rows: rows (character)
2228  *      @cols: cols (character)
2229  *
2230  *      Update the termios variables and send the necessary signals to
2231  *      peform a terminal resize correctly
2232  */
2233 
2234 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2235 {
2236         struct pid *pgrp;
2237 
2238         /* Lock the tty */
2239         mutex_lock(&tty->winsize_mutex);
2240         if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2241                 goto done;
2242 
2243         /* Signal the foreground process group */
2244         pgrp = tty_get_pgrp(tty);
2245         if (pgrp)
2246                 kill_pgrp(pgrp, SIGWINCH, 1);
2247         put_pid(pgrp);
2248 
2249         tty->winsize = *ws;
2250 done:
2251         mutex_unlock(&tty->winsize_mutex);
2252         return 0;
2253 }
2254 EXPORT_SYMBOL(tty_do_resize);
2255 
2256 /**
2257  *      tiocswinsz              -       implement window size set ioctl
2258  *      @tty; tty side of tty
2259  *      @arg: user buffer for result
2260  *
2261  *      Copies the user idea of the window size to the kernel. Traditionally
2262  *      this is just advisory information but for the Linux console it
2263  *      actually has driver level meaning and triggers a VC resize.
2264  *
2265  *      Locking:
2266  *              Driver dependent. The default do_resize method takes the
2267  *      tty termios mutex and ctrl_lock. The console takes its own lock
2268  *      then calls into the default method.
2269  */
2270 
2271 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2272 {
2273         struct winsize tmp_ws;
2274         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2275                 return -EFAULT;
2276 
2277         if (tty->ops->resize)
2278                 return tty->ops->resize(tty, &tmp_ws);
2279         else
2280                 return tty_do_resize(tty, &tmp_ws);
2281 }
2282 
2283 /**
2284  *      tioccons        -       allow admin to move logical console
2285  *      @file: the file to become console
2286  *
2287  *      Allow the administrator to move the redirected console device
2288  *
2289  *      Locking: uses redirect_lock to guard the redirect information
2290  */
2291 
2292 static int tioccons(struct file *file)
2293 {
2294         if (!capable(CAP_SYS_ADMIN))
2295                 return -EPERM;
2296         if (file->f_op->write == redirected_tty_write) {
2297                 struct file *f;
2298                 spin_lock(&redirect_lock);
2299                 f = redirect;
2300                 redirect = NULL;
2301                 spin_unlock(&redirect_lock);
2302                 if (f)
2303                         fput(f);
2304                 return 0;
2305         }
2306         spin_lock(&redirect_lock);
2307         if (redirect) {
2308                 spin_unlock(&redirect_lock);
2309                 return -EBUSY;
2310         }
2311         redirect = get_file(file);
2312         spin_unlock(&redirect_lock);
2313         return 0;
2314 }
2315 
2316 /**
2317  *      tiocsetd        -       set line discipline
2318  *      @tty: tty device
2319  *      @p: pointer to user data
2320  *
2321  *      Set the line discipline according to user request.
2322  *
2323  *      Locking: see tty_set_ldisc, this function is just a helper
2324  */
2325 
2326 static int tiocsetd(struct tty_struct *tty, int __user *p)
2327 {
2328         int disc;
2329         int ret;
2330 
2331         if (get_user(disc, p))
2332                 return -EFAULT;
2333 
2334         ret = tty_set_ldisc(tty, disc);
2335 
2336         return ret;
2337 }
2338 
2339 /**
2340  *      tiocgetd        -       get line discipline
2341  *      @tty: tty device
2342  *      @p: pointer to user data
2343  *
2344  *      Retrieves the line discipline id directly from the ldisc.
2345  *
2346  *      Locking: waits for ldisc reference (in case the line discipline
2347  *              is changing or the tty is being hungup)
2348  */
2349 
2350 static int tiocgetd(struct tty_struct *tty, int __user *p)
2351 {
2352         struct tty_ldisc *ld;
2353         int ret;
2354 
2355         ld = tty_ldisc_ref_wait(tty);
2356         if (!ld)
2357                 return -EIO;
2358         ret = put_user(ld->ops->num, p);
2359         tty_ldisc_deref(ld);
2360         return ret;
2361 }
2362 
2363 /**
2364  *      send_break      -       performed time break
2365  *      @tty: device to break on
2366  *      @duration: timeout in mS
2367  *
2368  *      Perform a timed break on hardware that lacks its own driver level
2369  *      timed break functionality.
2370  *
2371  *      Locking:
2372  *              atomic_write_lock serializes
2373  *
2374  */
2375 
2376 static int send_break(struct tty_struct *tty, unsigned int duration)
2377 {
2378         int retval;
2379 
2380         if (tty->ops->break_ctl == NULL)
2381                 return 0;
2382 
2383         if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2384                 retval = tty->ops->break_ctl(tty, duration);
2385         else {
2386                 /* Do the work ourselves */
2387                 if (tty_write_lock(tty, 0) < 0)
2388                         return -EINTR;
2389                 retval = tty->ops->break_ctl(tty, -1);
2390                 if (retval)
2391                         goto out;
2392                 if (!signal_pending(current))
2393                         msleep_interruptible(duration);
2394                 retval = tty->ops->break_ctl(tty, 0);
2395 out:
2396                 tty_write_unlock(tty);
2397                 if (signal_pending(current))
2398                         retval = -EINTR;
2399         }
2400         return retval;
2401 }
2402 
2403 /**
2404  *      tty_tiocmget            -       get modem status
2405  *      @tty: tty device
2406  *      @file: user file pointer
2407  *      @p: pointer to result
2408  *
2409  *      Obtain the modem status bits from the tty driver if the feature
2410  *      is supported. Return -EINVAL if it is not available.
2411  *
2412  *      Locking: none (up to the driver)
2413  */
2414 
2415 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2416 {
2417         int retval = -EINVAL;
2418 
2419         if (tty->ops->tiocmget) {
2420                 retval = tty->ops->tiocmget(tty);
2421 
2422                 if (retval >= 0)
2423                         retval = put_user(retval, p);
2424         }
2425         return retval;
2426 }
2427 
2428 /**
2429  *      tty_tiocmset            -       set modem status
2430  *      @tty: tty device
2431  *      @cmd: command - clear bits, set bits or set all
2432  *      @p: pointer to desired bits
2433  *
2434  *      Set the modem status bits from the tty driver if the feature
2435  *      is supported. Return -EINVAL if it is not available.
2436  *
2437  *      Locking: none (up to the driver)
2438  */
2439 
2440 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2441              unsigned __user *p)
2442 {
2443         int retval;
2444         unsigned int set, clear, val;
2445 
2446         if (tty->ops->tiocmset == NULL)
2447                 return -EINVAL;
2448 
2449         retval = get_user(val, p);
2450         if (retval)
2451                 return retval;
2452         set = clear = 0;
2453         switch (cmd) {
2454         case TIOCMBIS:
2455                 set = val;
2456                 break;
2457         case TIOCMBIC:
2458                 clear = val;
2459                 break;
2460         case TIOCMSET:
2461                 set = val;
2462                 clear = ~val;
2463                 break;
2464         }
2465         set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2466         clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2467         return tty->ops->tiocmset(tty, set, clear);
2468 }
2469 
2470 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2471 {
2472         int retval = -EINVAL;
2473         struct serial_icounter_struct icount;
2474         memset(&icount, 0, sizeof(icount));
2475         if (tty->ops->get_icount)
2476                 retval = tty->ops->get_icount(tty, &icount);
2477         if (retval != 0)
2478                 return retval;
2479         if (copy_to_user(arg, &icount, sizeof(icount)))
2480                 return -EFAULT;
2481         return 0;
2482 }
2483 
2484 static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
2485 {
2486         static DEFINE_RATELIMIT_STATE(depr_flags,
2487                         DEFAULT_RATELIMIT_INTERVAL,
2488                         DEFAULT_RATELIMIT_BURST);
2489         char comm[TASK_COMM_LEN];
2490         struct serial_struct v;
2491         int flags;
2492 
2493         if (copy_from_user(&v, ss, sizeof(struct serial_struct)))
2494                 return -EFAULT;
2495 
2496         flags = v.flags & ASYNC_DEPRECATED;
2497 
2498         if (flags && __ratelimit(&depr_flags))
2499                 pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2500                         __func__, get_task_comm(comm, current), flags);
2501         if (!tty->ops->set_serial)
2502                 return -ENOTTY;
2503         return tty->ops->set_serial(tty, &v);
2504 }
2505 
2506 static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2507 {
2508         struct serial_struct v;
2509         int err;
2510 
2511         memset(&v, 0, sizeof(struct serial_struct));
2512         if (!tty->ops->get_serial)
2513                 return -ENOTTY;
2514         err = tty->ops->get_serial(tty, &v);
2515         if (!err && copy_to_user(ss, &v, sizeof(struct serial_struct)))
2516                 err = -EFAULT;
2517         return err;
2518 }
2519 
2520 /*
2521  * if pty, return the slave side (real_tty)
2522  * otherwise, return self
2523  */
2524 static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2525 {
2526         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2527             tty->driver->subtype == PTY_TYPE_MASTER)
2528                 tty = tty->link;
2529         return tty;
2530 }
2531 
2532 /*
2533  * Split this up, as gcc can choke on it otherwise..
2534  */
2535 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2536 {
2537         struct tty_struct *tty = file_tty(file);
2538         struct tty_struct *real_tty;
2539         void __user *p = (void __user *)arg;
2540         int retval;
2541         struct tty_ldisc *ld;
2542 
2543         if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2544                 return -EINVAL;
2545 
2546         real_tty = tty_pair_get_tty(tty);
2547 
2548         /*
2549          * Factor out some common prep work
2550          */
2551         switch (cmd) {
2552         case TIOCSETD:
2553         case TIOCSBRK:
2554         case TIOCCBRK:
2555         case TCSBRK:
2556         case TCSBRKP:
2557                 retval = tty_check_change(tty);
2558                 if (retval)
2559                         return retval;
2560                 if (cmd != TIOCCBRK) {
2561                         tty_wait_until_sent(tty, 0);
2562                         if (signal_pending(current))
2563                                 return -EINTR;
2564                 }
2565                 break;
2566         }
2567 
2568         /*
2569          *      Now do the stuff.
2570          */
2571         switch (cmd) {
2572         case TIOCSTI:
2573                 return tiocsti(tty, p);
2574         case TIOCGWINSZ:
2575                 return tiocgwinsz(real_tty, p);
2576         case TIOCSWINSZ:
2577                 return tiocswinsz(real_tty, p);
2578         case TIOCCONS:
2579                 return real_tty != tty ? -EINVAL : tioccons(file);
2580         case TIOCEXCL:
2581                 set_bit(TTY_EXCLUSIVE, &tty->flags);
2582                 return 0;
2583         case TIOCNXCL:
2584                 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2585                 return 0;
2586         case TIOCGEXCL:
2587         {
2588                 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2589                 return put_user(excl, (int __user *)p);
2590         }
2591         case TIOCGETD:
2592                 return tiocgetd(tty, p);
2593         case TIOCSETD:
2594                 return tiocsetd(tty, p);
2595         case TIOCVHANGUP:
2596                 if (!capable(CAP_SYS_ADMIN))
2597                         return -EPERM;
2598                 tty_vhangup(tty);
2599                 return 0;
2600         case TIOCGDEV:
2601         {
2602                 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2603                 return put_user(ret, (unsigned int __user *)p);
2604         }
2605         /*
2606          * Break handling
2607          */
2608         case TIOCSBRK:  /* Turn break on, unconditionally */
2609                 if (tty->ops->break_ctl)
2610                         return tty->ops->break_ctl(tty, -1);
2611                 return 0;
2612         case TIOCCBRK:  /* Turn break off, unconditionally */
2613                 if (tty->ops->break_ctl)
2614                         return tty->ops->break_ctl(tty, 0);
2615                 return 0;
2616         case TCSBRK:   /* SVID version: non-zero arg --> no break */
2617                 /* non-zero arg means wait for all output data
2618                  * to be sent (performed above) but don't send break.
2619                  * This is used by the tcdrain() termios function.
2620                  */
2621                 if (!arg)
2622                         return send_break(tty, 250);
2623                 return 0;
2624         case TCSBRKP:   /* support for POSIX tcsendbreak() */
2625                 return send_break(tty, arg ? arg*100 : 250);
2626 
2627         case TIOCMGET:
2628                 return tty_tiocmget(tty, p);
2629         case TIOCMSET:
2630         case TIOCMBIC:
2631         case TIOCMBIS:
2632                 return tty_tiocmset(tty, cmd, p);
2633         case TIOCGICOUNT:
2634                 return tty_tiocgicount(tty, p);
2635         case TCFLSH:
2636                 switch (arg) {
2637                 case TCIFLUSH:
2638                 case TCIOFLUSH:
2639                 /* flush tty buffer and allow ldisc to process ioctl */
2640                         tty_buffer_flush(tty, NULL);
2641                         break;
2642                 }
2643                 break;
2644         case TIOCSSERIAL:
2645                 return tty_tiocsserial(tty, p);
2646         case TIOCGSERIAL:
2647                 return tty_tiocgserial(tty, p);
2648         case TIOCGPTPEER:
2649                 /* Special because the struct file is needed */
2650                 return ptm_open_peer(file, tty, (int)arg);
2651         default:
2652                 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2653                 if (retval != -ENOIOCTLCMD)
2654                         return retval;
2655         }
2656         if (tty->ops->ioctl) {
2657                 retval = tty->ops->ioctl(tty, cmd, arg);
2658                 if (retval != -ENOIOCTLCMD)
2659                         return retval;
2660         }
2661         ld = tty_ldisc_ref_wait(tty);
2662         if (!ld)
2663                 return hung_up_tty_ioctl(file, cmd, arg);
2664         retval = -EINVAL;
2665         if (ld->ops->ioctl) {
2666                 retval = ld->ops->ioctl(tty, file, cmd, arg);
2667                 if (retval == -ENOIOCTLCMD)
2668                         retval = -ENOTTY;
2669         }
2670         tty_ldisc_deref(ld);
2671         return retval;
2672 }
2673 
2674 #ifdef CONFIG_COMPAT
2675 
2676 struct serial_struct32 {
2677         compat_int_t    type;
2678         compat_int_t    line;
2679         compat_uint_t   port;
2680         compat_int_t    irq;
2681         compat_int_t    flags;
2682         compat_int_t    xmit_fifo_size;
2683         compat_int_t    custom_divisor;
2684         compat_int_t    baud_base;
2685         unsigned short  close_delay;
2686         char    io_type;
2687         char    reserved_char[1];
2688         compat_int_t    hub6;
2689         unsigned short  closing_wait; /* time to wait before closing */
2690         unsigned short  closing_wait2; /* no longer used... */
2691         compat_uint_t   iomem_base;
2692         unsigned short  iomem_reg_shift;
2693         unsigned int    port_high;
2694      /* compat_ulong_t  iomap_base FIXME */
2695         compat_int_t    reserved[1];
2696 };
2697 
2698 static int compat_tty_tiocsserial(struct tty_struct *tty,
2699                 struct serial_struct32 __user *ss)
2700 {
2701         static DEFINE_RATELIMIT_STATE(depr_flags,
2702                         DEFAULT_RATELIMIT_INTERVAL,
2703                         DEFAULT_RATELIMIT_BURST);
2704         char comm[TASK_COMM_LEN];
2705         struct serial_struct32 v32;
2706         struct serial_struct v;
2707         int flags;
2708 
2709         if (copy_from_user(&v32, ss, sizeof(struct serial_struct32)))
2710                 return -EFAULT;
2711 
2712         memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2713         v.iomem_base = compat_ptr(v32.iomem_base);
2714         v.iomem_reg_shift = v32.iomem_reg_shift;
2715         v.port_high = v32.port_high;
2716         v.iomap_base = 0;
2717 
2718         flags = v.flags & ASYNC_DEPRECATED;
2719 
2720         if (flags && __ratelimit(&depr_flags))
2721                 pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2722                         __func__, get_task_comm(comm, current), flags);
2723         if (!tty->ops->set_serial)
2724                 return -ENOTTY;
2725         return tty->ops->set_serial(tty, &v);
2726 }
2727 
2728 static int compat_tty_tiocgserial(struct tty_struct *tty,
2729                         struct serial_struct32 __user *ss)
2730 {
2731         struct serial_struct32 v32;
2732         struct serial_struct v;
2733         int err;
2734 
2735         memset(&v, 0, sizeof(v));
2736         memset(&v32, 0, sizeof(v32));
2737 
2738         if (!tty->ops->get_serial)
2739                 return -ENOTTY;
2740         err = tty->ops->get_serial(tty, &v);
2741         if (!err) {
2742                 memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2743                 v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2744                         0xfffffff : ptr_to_compat(v.iomem_base);
2745                 v32.iomem_reg_shift = v.iomem_reg_shift;
2746                 v32.port_high = v.port_high;
2747                 if (copy_to_user(ss, &v32, sizeof(struct serial_struct32)))
2748                         err = -EFAULT;
2749         }
2750         return err;
2751 }
2752 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2753                                 unsigned long arg)
2754 {
2755         struct tty_struct *tty = file_tty(file);
2756         struct tty_ldisc *ld;
2757         int retval = -ENOIOCTLCMD;
2758 
2759         switch (cmd) {
2760         case TIOCSTI:
2761         case TIOCGWINSZ:
2762         case TIOCSWINSZ:
2763         case TIOCGEXCL:
2764         case TIOCGETD:
2765         case TIOCSETD:
2766         case TIOCGDEV:
2767         case TIOCMGET:
2768         case TIOCMSET:
2769         case TIOCMBIC:
2770         case TIOCMBIS:
2771         case TIOCGICOUNT:
2772         case TIOCGPGRP:
2773         case TIOCSPGRP:
2774         case TIOCGSID:
2775         case TIOCSERGETLSR:
2776         case TIOCGRS485:
2777         case TIOCSRS485:
2778 #ifdef TIOCGETP
2779         case TIOCGETP:
2780         case TIOCSETP:
2781         case TIOCSETN:
2782 #endif
2783 #ifdef TIOCGETC
2784         case TIOCGETC:
2785         case TIOCSETC:
2786 #endif
2787 #ifdef TIOCGLTC
2788         case TIOCGLTC:
2789         case TIOCSLTC:
2790 #endif
2791         case TCSETSF:
2792         case TCSETSW:
2793         case TCSETS:
2794         case TCGETS:
2795 #ifdef TCGETS2
2796         case TCGETS2:
2797         case TCSETSF2:
2798         case TCSETSW2:
2799         case TCSETS2:
2800 #endif
2801         case TCGETA:
2802         case TCSETAF:
2803         case TCSETAW:
2804         case TCSETA:
2805         case TIOCGLCKTRMIOS:
2806         case TIOCSLCKTRMIOS:
2807 #ifdef TCGETX
2808         case TCGETX:
2809         case TCSETX:
2810         case TCSETXW:
2811         case TCSETXF:
2812 #endif
2813         case TIOCGSOFTCAR:
2814         case TIOCSSOFTCAR:
2815                 return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
2816         case TIOCCONS:
2817         case TIOCEXCL:
2818         case TIOCNXCL:
2819         case TIOCVHANGUP:
2820         case TIOCSBRK:
2821         case TIOCCBRK:
2822         case TCSBRK:
2823         case TCSBRKP:
2824         case TCFLSH:
2825         case TIOCGPTPEER:
2826         case TIOCNOTTY:
2827         case TIOCSCTTY:
2828         case TCXONC:
2829         case TIOCMIWAIT:
2830         case TIOCSERCONFIG:
2831                 return tty_ioctl(file, cmd, arg);
2832         }
2833 
2834         if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2835                 return -EINVAL;
2836 
2837         switch (cmd) {
2838         case TIOCSSERIAL:
2839                 return compat_tty_tiocsserial(tty, compat_ptr(arg));
2840         case TIOCGSERIAL:
2841                 return compat_tty_tiocgserial(tty, compat_ptr(arg));
2842         }
2843         if (tty->ops->compat_ioctl) {
2844                 retval = tty->ops->compat_ioctl(tty, cmd, arg);
2845                 if (retval != -ENOIOCTLCMD)
2846                         return retval;
2847         }
2848 
2849         ld = tty_ldisc_ref_wait(tty);
2850         if (!ld)
2851                 return hung_up_tty_compat_ioctl(file, cmd, arg);
2852         if (ld->ops->compat_ioctl)
2853                 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2854         if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2855                 retval = ld->ops->ioctl(tty, file,
2856                                 (unsigned long)compat_ptr(cmd), arg);
2857         tty_ldisc_deref(ld);
2858 
2859         return retval;
2860 }
2861 #endif
2862 
2863 static int this_tty(const void *t, struct file *file, unsigned fd)
2864 {
2865         if (likely(file->f_op->read != tty_read))
2866                 return 0;
2867         return file_tty(file) != t ? 0 : fd + 1;
2868 }
2869         
2870 /*
2871  * This implements the "Secure Attention Key" ---  the idea is to
2872  * prevent trojan horses by killing all processes associated with this
2873  * tty when the user hits the "Secure Attention Key".  Required for
2874  * super-paranoid applications --- see the Orange Book for more details.
2875  *
2876  * This code could be nicer; ideally it should send a HUP, wait a few
2877  * seconds, then send a INT, and then a KILL signal.  But you then
2878  * have to coordinate with the init process, since all processes associated
2879  * with the current tty must be dead before the new getty is allowed
2880  * to spawn.
2881  *
2882  * Now, if it would be correct ;-/ The current code has a nasty hole -
2883  * it doesn't catch files in flight. We may send the descriptor to ourselves
2884  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2885  *
2886  * Nasty bug: do_SAK is being called in interrupt context.  This can
2887  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2888  */
2889 void __do_SAK(struct tty_struct *tty)
2890 {
2891 #ifdef TTY_SOFT_SAK
2892         tty_hangup(tty);
2893 #else
2894         struct task_struct *g, *p;
2895         struct pid *session;
2896         int             i;
2897 
2898         if (!tty)
2899                 return;
2900         session = tty->session;
2901 
2902         tty_ldisc_flush(tty);
2903 
2904         tty_driver_flush_buffer(tty);
2905 
2906         read_lock(&tasklist_lock);
2907         /* Kill the entire session */
2908         do_each_pid_task(session, PIDTYPE_SID, p) {
2909                 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
2910                            task_pid_nr(p), p->comm);
2911                 group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2912         } while_each_pid_task(session, PIDTYPE_SID, p);
2913 
2914         /* Now kill any processes that happen to have the tty open */
2915         do_each_thread(g, p) {
2916                 if (p->signal->tty == tty) {
2917                         tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
2918                                    task_pid_nr(p), p->comm);
2919                         group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2920                         continue;
2921                 }
2922                 task_lock(p);
2923                 i = iterate_fd(p->files, 0, this_tty, tty);
2924                 if (i != 0) {
2925                         tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
2926                                    task_pid_nr(p), p->comm, i - 1);
2927                         group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2928                 }
2929                 task_unlock(p);
2930         } while_each_thread(g, p);
2931         read_unlock(&tasklist_lock);
2932 #endif
2933 }
2934 
2935 static void do_SAK_work(struct work_struct *work)
2936 {
2937         struct tty_struct *tty =
2938                 container_of(work, struct tty_struct, SAK_work);
2939         __do_SAK(tty);
2940 }
2941 
2942 /*
2943  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2944  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2945  * the values which we write to it will be identical to the values which it
2946  * already has. --akpm
2947  */
2948 void do_SAK(struct tty_struct *tty)
2949 {
2950         if (!tty)
2951                 return;
2952         schedule_work(&tty->SAK_work);
2953 }
2954 
2955 EXPORT_SYMBOL(do_SAK);
2956 
2957 /* Must put_device() after it's unused! */
2958 static struct device *tty_get_device(struct tty_struct *tty)
2959 {
2960         dev_t devt = tty_devnum(tty);
2961         return class_find_device_by_devt(tty_class, devt);
2962 }
2963 
2964 
2965 /**
2966  *      alloc_tty_struct
2967  *
2968  *      This subroutine allocates and initializes a tty structure.
2969  *
2970  *      Locking: none - tty in question is not exposed at this point
2971  */
2972 
2973 struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
2974 {
2975         struct tty_struct *tty;
2976 
2977         tty = kzalloc(sizeof(*tty), GFP_KERNEL);
2978         if (!tty)
2979                 return NULL;
2980 
2981         kref_init(&tty->kref);
2982         tty->magic = TTY_MAGIC;
2983         if (tty_ldisc_init(tty)) {
2984                 kfree(tty);
2985                 return NULL;
2986         }
2987         tty->session = NULL;
2988         tty->pgrp = NULL;
2989         mutex_init(&tty->legacy_mutex);
2990         mutex_init(&tty->throttle_mutex);
2991         init_rwsem(&tty->termios_rwsem);
2992         mutex_init(&tty->winsize_mutex);
2993         init_ldsem(&tty->ldisc_sem);
2994         init_waitqueue_head(&tty->write_wait);
2995         init_waitqueue_head(&tty->read_wait);
2996         INIT_WORK(&tty->hangup_work, do_tty_hangup);
2997         mutex_init(&tty->atomic_write_lock);
2998         spin_lock_init(&tty->ctrl_lock);
2999         spin_lock_init(&tty->flow_lock);
3000         spin_lock_init(&tty->files_lock);
3001         INIT_LIST_HEAD(&tty->tty_files);
3002         INIT_WORK(&tty->SAK_work, do_SAK_work);
3003 
3004         tty->driver = driver;
3005         tty->ops = driver->ops;
3006         tty->index = idx;
3007         tty_line_name(driver, idx, tty->name);
3008         tty->dev = tty_get_device(tty);
3009 
3010         return tty;
3011 }
3012 
3013 /**
3014  *      tty_put_char    -       write one character to a tty
3015  *      @tty: tty
3016  *      @ch: character
3017  *
3018  *      Write one byte to the tty using the provided put_char method
3019  *      if present. Returns the number of characters successfully output.
3020  *
3021  *      Note: the specific put_char operation in the driver layer may go
3022  *      away soon. Don't call it directly, use this method
3023  */
3024 
3025 int tty_put_char(struct tty_struct *tty, unsigned char ch)
3026 {
3027         if (tty->ops->put_char)
3028                 return tty->ops->put_char(tty, ch);
3029         return tty->ops->write(tty, &ch, 1);
3030 }
3031 EXPORT_SYMBOL_GPL(tty_put_char);
3032 
3033 struct class *tty_class;
3034 
3035 static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3036                 unsigned int index, unsigned int count)
3037 {
3038         int err;
3039 
3040         /* init here, since reused cdevs cause crashes */
3041         driver->cdevs[index] = cdev_alloc();
3042         if (!driver->cdevs[index])
3043                 return -ENOMEM;
3044         driver->cdevs[index]->ops = &tty_fops;
3045         driver->cdevs[index]->owner = driver->owner;
3046         err = cdev_add(driver->cdevs[index], dev, count);
3047         if (err)
3048                 kobject_put(&driver->cdevs[index]->kobj);
3049         return err;
3050 }
3051 
3052 /**
3053  *      tty_register_device - register a tty device
3054  *      @driver: the tty driver that describes the tty device
3055  *      @index: the index in the tty driver for this tty device
3056  *      @device: a struct device that is associated with this tty device.
3057  *              This field is optional, if there is no known struct device
3058  *              for this tty device it can be set to NULL safely.
3059  *
3060  *      Returns a pointer to the struct device for this tty device
3061  *      (or ERR_PTR(-EFOO) on error).
3062  *
3063  *      This call is required to be made to register an individual tty device
3064  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3065  *      that bit is not set, this function should not be called by a tty
3066  *      driver.
3067  *
3068  *      Locking: ??
3069  */
3070 
3071 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3072                                    struct device *device)
3073 {
3074         return tty_register_device_attr(driver, index, device, NULL, NULL);
3075 }
3076 EXPORT_SYMBOL(tty_register_device);
3077 
3078 static void tty_device_create_release(struct device *dev)
3079 {
3080         dev_dbg(dev, "releasing...\n");
3081         kfree(dev);
3082 }
3083 
3084 /**
3085  *      tty_register_device_attr - register a tty device
3086  *      @driver: the tty driver that describes the tty device
3087  *      @index: the index in the tty driver for this tty device
3088  *      @device: a struct device that is associated with this tty device.
3089  *              This field is optional, if there is no known struct device
3090  *              for this tty device it can be set to NULL safely.
3091  *      @drvdata: Driver data to be set to device.
3092  *      @attr_grp: Attribute group to be set on device.
3093  *
3094  *      Returns a pointer to the struct device for this tty device
3095  *      (or ERR_PTR(-EFOO) on error).
3096  *
3097  *      This call is required to be made to register an individual tty device
3098  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3099  *      that bit is not set, this function should not be called by a tty
3100  *      driver.
3101  *
3102  *      Locking: ??
3103  */
3104 struct device *tty_register_device_attr(struct tty_driver *driver,
3105                                    unsigned index, struct device *device,
3106                                    void *drvdata,
3107                                    const struct attribute_group **attr_grp)
3108 {
3109         char name[64];
3110         dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3111         struct ktermios *tp;
3112         struct device *dev;
3113         int retval;
3114 
3115         if (index >= driver->num) {
3116                 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3117                        driver->name, index);
3118                 return ERR_PTR(-EINVAL);
3119         }
3120 
3121         if (driver->type == TTY_DRIVER_TYPE_PTY)
3122                 pty_line_name(driver, index, name);
3123         else
3124                 tty_line_name(driver, index, name);
3125 
3126         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3127         if (!dev)
3128                 return ERR_PTR(-ENOMEM);
3129 
3130         dev->devt = devt;
3131         dev->class = tty_class;
3132         dev->parent = device;
3133         dev->release = tty_device_create_release;
3134         dev_set_name(dev, "%s", name);
3135         dev->groups = attr_grp;
3136         dev_set_drvdata(dev, drvdata);
3137 
3138         dev_set_uevent_suppress(dev, 1);
3139 
3140         retval = device_register(dev);
3141         if (retval)
3142                 goto err_put;
3143 
3144         if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3145                 /*
3146                  * Free any saved termios data so that the termios state is
3147                  * reset when reusing a minor number.
3148                  */
3149                 tp = driver->termios[index];
3150                 if (tp) {
3151                         driver->termios[index] = NULL;
3152                         kfree(tp);
3153                 }
3154 
3155                 retval = tty_cdev_add(driver, devt, index, 1);
3156                 if (retval)
3157                         goto err_del;
3158         }
3159 
3160         dev_set_uevent_suppress(dev, 0);
3161         kobject_uevent(&dev->kobj, KOBJ_ADD);
3162 
3163         return dev;
3164 
3165 err_del:
3166         device_del(dev);
3167 err_put:
3168         put_device(dev);
3169 
3170         return ERR_PTR(retval);
3171 }
3172 EXPORT_SYMBOL_GPL(tty_register_device_attr);
3173 
3174 /**
3175  *      tty_unregister_device - unregister a tty device
3176  *      @driver: the tty driver that describes the tty device
3177  *      @index: the index in the tty driver for this tty device
3178  *
3179  *      If a tty device is registered with a call to tty_register_device() then
3180  *      this function must be called when the tty device is gone.
3181  *
3182  *      Locking: ??
3183  */
3184 
3185 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3186 {
3187         device_destroy(tty_class,
3188                 MKDEV(driver->major, driver->minor_start) + index);
3189         if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3190                 cdev_del(driver->cdevs[index]);
3191                 driver->cdevs[index] = NULL;
3192         }
3193 }
3194 EXPORT_SYMBOL(tty_unregister_device);
3195 
3196 /**
3197  * __tty_alloc_driver -- allocate tty driver
3198  * @lines: count of lines this driver can handle at most
3199  * @owner: module which is responsible for this driver
3200  * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3201  *
3202  * This should not be called directly, some of the provided macros should be
3203  * used instead. Use IS_ERR and friends on @retval.
3204  */
3205 struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3206                 unsigned long flags)
3207 {
3208         struct tty_driver *driver;
3209         unsigned int cdevs = 1;
3210         int err;
3211 
3212         if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3213                 return ERR_PTR(-EINVAL);
3214 
3215         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3216         if (!driver)
3217                 return ERR_PTR(-ENOMEM);
3218 
3219         kref_init(&driver->kref);
3220         driver->magic = TTY_DRIVER_MAGIC;
3221         driver->num = lines;
3222         driver->owner = owner;
3223         driver->flags = flags;
3224 
3225         if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3226                 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3227                                 GFP_KERNEL);
3228                 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3229                                 GFP_KERNEL);
3230                 if (!driver->ttys || !driver->termios) {
3231                         err = -ENOMEM;
3232                         goto err_free_all;
3233                 }
3234         }
3235 
3236         if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3237                 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3238                                 GFP_KERNEL);
3239                 if (!driver->ports) {
3240                         err = -ENOMEM;
3241                         goto err_free_all;
3242                 }
3243                 cdevs = lines;
3244         }
3245 
3246         driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3247         if (!driver->cdevs) {
3248                 err = -ENOMEM;
3249                 goto err_free_all;
3250         }
3251 
3252         return driver;
3253 err_free_all:
3254         kfree(driver->ports);
3255         kfree(driver->ttys);
3256         kfree(driver->termios);
3257         kfree(driver->cdevs);
3258         kfree(driver);
3259         return ERR_PTR(err);
3260 }
3261 EXPORT_SYMBOL(__tty_alloc_driver);
3262 
3263 static void destruct_tty_driver(struct kref *kref)
3264 {
3265         struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3266         int i;
3267         struct ktermios *tp;
3268 
3269         if (driver->flags & TTY_DRIVER_INSTALLED) {
3270                 for (i = 0; i < driver->num; i++) {
3271                         tp = driver->termios[i];
3272                         if (tp) {
3273                                 driver->termios[i] = NULL;
3274                                 kfree(tp);
3275                         }
3276                         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3277                                 tty_unregister_device(driver, i);
3278                 }
3279                 proc_tty_unregister_driver(driver);
3280                 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3281                         cdev_del(driver->cdevs[0]);
3282         }
3283         kfree(driver->cdevs);
3284         kfree(driver->ports);
3285         kfree(driver->termios);
3286         kfree(driver->ttys);
3287         kfree(driver);
3288 }
3289 
3290 void tty_driver_kref_put(struct tty_driver *driver)
3291 {
3292         kref_put(&driver->kref, destruct_tty_driver);
3293 }
3294 EXPORT_SYMBOL(tty_driver_kref_put);
3295 
3296 void tty_set_operations(struct tty_driver *driver,
3297                         const struct tty_operations *op)
3298 {
3299         driver->ops = op;
3300 };
3301 EXPORT_SYMBOL(tty_set_operations);
3302 
3303 void put_tty_driver(struct tty_driver *d)
3304 {
3305         tty_driver_kref_put(d);
3306 }
3307 EXPORT_SYMBOL(put_tty_driver);
3308 
3309 /*
3310  * Called by a tty driver to register itself.
3311  */
3312 int tty_register_driver(struct tty_driver *driver)
3313 {
3314         int error;
3315         int i;
3316         dev_t dev;
3317         struct device *d;
3318 
3319         if (!driver->major) {
3320                 error = alloc_chrdev_region(&dev, driver->minor_start,
3321                                                 driver->num, driver->name);
3322                 if (!error) {
3323                         driver->major = MAJOR(dev);
3324                         driver->minor_start = MINOR(dev);
3325                 }
3326         } else {
3327                 dev = MKDEV(driver->major, driver->minor_start);
3328                 error = register_chrdev_region(dev, driver->num, driver->name);
3329         }
3330         if (error < 0)
3331                 goto err;
3332 
3333         if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3334                 error = tty_cdev_add(driver, dev, 0, driver->num);
3335                 if (error)
3336                         goto err_unreg_char;
3337         }
3338 
3339         mutex_lock(&tty_mutex);
3340         list_add(&driver->tty_drivers, &tty_drivers);
3341         mutex_unlock(&tty_mutex);
3342 
3343         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3344                 for (i = 0; i < driver->num; i++) {
3345                         d = tty_register_device(driver, i, NULL);
3346                         if (IS_ERR(d)) {
3347                                 error = PTR_ERR(d);
3348                                 goto err_unreg_devs;
3349                         }
3350                 }
3351         }
3352         proc_tty_register_driver(driver);
3353         driver->flags |= TTY_DRIVER_INSTALLED;
3354         return 0;
3355 
3356 err_unreg_devs:
3357         for (i--; i >= 0; i--)
3358                 tty_unregister_device(driver, i);
3359 
3360         mutex_lock(&tty_mutex);
3361         list_del(&driver->tty_drivers);
3362         mutex_unlock(&tty_mutex);
3363 
3364 err_unreg_char:
3365         unregister_chrdev_region(dev, driver->num);
3366 err:
3367         return error;
3368 }
3369 EXPORT_SYMBOL(tty_register_driver);
3370 
3371 /*
3372  * Called by a tty driver to unregister itself.
3373  */
3374 int tty_unregister_driver(struct tty_driver *driver)
3375 {
3376 #if 0
3377         /* FIXME */
3378         if (driver->refcount)
3379                 return -EBUSY;
3380 #endif
3381         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3382                                 driver->num);
3383         mutex_lock(&tty_mutex);
3384         list_del(&driver->tty_drivers);
3385         mutex_unlock(&tty_mutex);
3386         return 0;
3387 }
3388 
3389 EXPORT_SYMBOL(tty_unregister_driver);
3390 
3391 dev_t tty_devnum(struct tty_struct *tty)
3392 {
3393         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3394 }
3395 EXPORT_SYMBOL(tty_devnum);
3396 
3397 void tty_default_fops(struct file_operations *fops)
3398 {
3399         *fops = tty_fops;
3400 }
3401 
3402 static char *tty_devnode(struct device *dev, umode_t *mode)
3403 {
3404         if (!mode)
3405                 return NULL;
3406         if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3407             dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3408                 *mode = 0666;
3409         return NULL;
3410 }
3411 
3412 static int __init tty_class_init(void)
3413 {
3414         tty_class = class_create(THIS_MODULE, "tty");
3415         if (IS_ERR(tty_class))
3416                 return PTR_ERR(tty_class);
3417         tty_class->devnode = tty_devnode;
3418         return 0;
3419 }
3420 
3421 postcore_initcall(tty_class_init);
3422 
3423 /* 3/2004 jmc: why do these devices exist? */
3424 static struct cdev tty_cdev, console_cdev;
3425 
3426 static ssize_t show_cons_active(struct device *dev,
3427                                 struct device_attribute *attr, char *buf)
3428 {
3429         struct console *cs[16];
3430         int i = 0;
3431         struct console *c;
3432         ssize_t count = 0;
3433 
3434         console_lock();
3435         for_each_console(c) {
3436                 if (!c->device)
3437                         continue;
3438                 if (!c->write)
3439                         continue;
3440                 if ((c->flags & CON_ENABLED) == 0)
3441                         continue;
3442                 cs[i++] = c;
3443                 if (i >= ARRAY_SIZE(cs))
3444                         break;
3445         }
3446         while (i--) {
3447                 int index = cs[i]->index;
3448                 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3449 
3450                 /* don't resolve tty0 as some programs depend on it */
3451                 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3452                         count += tty_line_name(drv, index, buf + count);
3453                 else
3454                         count += sprintf(buf + count, "%s%d",
3455                                          cs[i]->name, cs[i]->index);
3456 
3457                 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3458         }
3459         console_unlock();
3460 
3461         return count;
3462 }
3463 static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3464 
3465 static struct attribute *cons_dev_attrs[] = {
3466         &dev_attr_active.attr,
3467         NULL
3468 };
3469 
3470 ATTRIBUTE_GROUPS(cons_dev);
3471 
3472 static struct device *consdev;
3473 
3474 void console_sysfs_notify(void)
3475 {
3476         if (consdev)
3477                 sysfs_notify(&consdev->kobj, NULL, "active");
3478 }
3479 
3480 /*
3481  * Ok, now we can initialize the rest of the tty devices and can count
3482  * on memory allocations, interrupts etc..
3483  */
3484 int __init tty_init(void)
3485 {
3486         tty_sysctl_init();
3487         cdev_init(&tty_cdev, &tty_fops);
3488         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3489             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3490                 panic("Couldn't register /dev/tty driver\n");
3491         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3492 
3493         cdev_init(&console_cdev, &console_fops);
3494         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3495             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3496                 panic("Couldn't register /dev/console driver\n");
3497         consdev = device_create_with_groups(tty_class, NULL,
3498                                             MKDEV(TTYAUX_MAJOR, 1), NULL,
3499                                             cons_dev_groups, "console");
3500         if (IS_ERR(consdev))
3501                 consdev = NULL;
3502 
3503 #ifdef CONFIG_VT
3504         vty_init(&console_fops);
3505 #endif
3506         return 0;
3507 }
3508