xref: /openbmc/linux/drivers/tty/tty_io.c (revision 0b26ca68)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  Copyright (C) 1991, 1992  Linus Torvalds
4  */
5 
6 /*
7  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
8  * or rs-channels. It also implements echoing, cooked mode etc.
9  *
10  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
11  *
12  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
13  * tty_struct and tty_queue structures.  Previously there was an array
14  * of 256 tty_struct's which was statically allocated, and the
15  * tty_queue structures were allocated at boot time.  Both are now
16  * dynamically allocated only when the tty is open.
17  *
18  * Also restructured routines so that there is more of a separation
19  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
20  * the low-level tty routines (serial.c, pty.c, console.c).  This
21  * makes for cleaner and more compact code.  -TYT, 9/17/92
22  *
23  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
24  * which can be dynamically activated and de-activated by the line
25  * discipline handling modules (like SLIP).
26  *
27  * NOTE: pay no attention to the line discipline code (yet); its
28  * interface is still subject to change in this version...
29  * -- TYT, 1/31/92
30  *
31  * Added functionality to the OPOST tty handling.  No delays, but all
32  * other bits should be there.
33  *	-- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
34  *
35  * Rewrote canonical mode and added more termios flags.
36  * 	-- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
37  *
38  * Reorganized FASYNC support so mouse code can share it.
39  *	-- ctm@ardi.com, 9Sep95
40  *
41  * New TIOCLINUX variants added.
42  *	-- mj@k332.feld.cvut.cz, 19-Nov-95
43  *
44  * Restrict vt switching via ioctl()
45  *      -- grif@cs.ucr.edu, 5-Dec-95
46  *
47  * Move console and virtual terminal code to more appropriate files,
48  * implement CONFIG_VT and generalize console device interface.
49  *	-- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
50  *
51  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
52  *	-- Bill Hawes <whawes@star.net>, June 97
53  *
54  * Added devfs support.
55  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
56  *
57  * Added support for a Unix98-style ptmx device.
58  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
59  *
60  * Reduced memory usage for older ARM systems
61  *      -- Russell King <rmk@arm.linux.org.uk>
62  *
63  * Move do_SAK() into process context.  Less stack use in devfs functions.
64  * alloc_tty_struct() always uses kmalloc()
65  *			 -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67 
68 #include <linux/types.h>
69 #include <linux/major.h>
70 #include <linux/errno.h>
71 #include <linux/signal.h>
72 #include <linux/fcntl.h>
73 #include <linux/sched/signal.h>
74 #include <linux/sched/task.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/fdtable.h>
82 #include <linux/console.h>
83 #include <linux/timer.h>
84 #include <linux/ctype.h>
85 #include <linux/kd.h>
86 #include <linux/mm.h>
87 #include <linux/string.h>
88 #include <linux/slab.h>
89 #include <linux/poll.h>
90 #include <linux/ppp-ioctl.h>
91 #include <linux/proc_fs.h>
92 #include <linux/init.h>
93 #include <linux/module.h>
94 #include <linux/device.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98 #include <linux/seq_file.h>
99 #include <linux/serial.h>
100 #include <linux/ratelimit.h>
101 #include <linux/compat.h>
102 
103 #include <linux/uaccess.h>
104 
105 #include <linux/kbd_kern.h>
106 #include <linux/vt_kern.h>
107 #include <linux/selection.h>
108 
109 #include <linux/kmod.h>
110 #include <linux/nsproxy.h>
111 
112 #undef TTY_DEBUG_HANGUP
113 #ifdef TTY_DEBUG_HANGUP
114 # define tty_debug_hangup(tty, f, args...)	tty_debug(tty, f, ##args)
115 #else
116 # define tty_debug_hangup(tty, f, args...)	do { } while (0)
117 #endif
118 
119 #define TTY_PARANOIA_CHECK 1
120 #define CHECK_TTY_COUNT 1
121 
122 struct ktermios tty_std_termios = {	/* for the benefit of tty drivers  */
123 	.c_iflag = ICRNL | IXON,
124 	.c_oflag = OPOST | ONLCR,
125 	.c_cflag = B38400 | CS8 | CREAD | HUPCL,
126 	.c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
127 		   ECHOCTL | ECHOKE | IEXTEN,
128 	.c_cc = INIT_C_CC,
129 	.c_ispeed = 38400,
130 	.c_ospeed = 38400,
131 	/* .c_line = N_TTY, */
132 };
133 
134 EXPORT_SYMBOL(tty_std_termios);
135 
136 /* This list gets poked at by procfs and various bits of boot up code. This
137    could do with some rationalisation such as pulling the tty proc function
138    into this file */
139 
140 LIST_HEAD(tty_drivers);			/* linked list of tty drivers */
141 
142 /* Mutex to protect creating and releasing a tty */
143 DEFINE_MUTEX(tty_mutex);
144 
145 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
146 static ssize_t tty_write(struct kiocb *, struct iov_iter *);
147 ssize_t redirected_tty_write(struct kiocb *, struct iov_iter *);
148 static __poll_t tty_poll(struct file *, poll_table *);
149 static int tty_open(struct inode *, struct file *);
150 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
151 #ifdef CONFIG_COMPAT
152 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
153 				unsigned long arg);
154 #else
155 #define tty_compat_ioctl NULL
156 #endif
157 static int __tty_fasync(int fd, struct file *filp, int on);
158 static int tty_fasync(int fd, struct file *filp, int on);
159 static void release_tty(struct tty_struct *tty, int idx);
160 
161 /**
162  *	free_tty_struct		-	free a disused tty
163  *	@tty: tty struct to free
164  *
165  *	Free the write buffers, tty queue and tty memory itself.
166  *
167  *	Locking: none. Must be called after tty is definitely unused
168  */
169 
170 static void free_tty_struct(struct tty_struct *tty)
171 {
172 	tty_ldisc_deinit(tty);
173 	put_device(tty->dev);
174 	kfree(tty->write_buf);
175 	tty->magic = 0xDEADDEAD;
176 	kfree(tty);
177 }
178 
179 static inline struct tty_struct *file_tty(struct file *file)
180 {
181 	return ((struct tty_file_private *)file->private_data)->tty;
182 }
183 
184 int tty_alloc_file(struct file *file)
185 {
186 	struct tty_file_private *priv;
187 
188 	priv = kmalloc(sizeof(*priv), GFP_KERNEL);
189 	if (!priv)
190 		return -ENOMEM;
191 
192 	file->private_data = priv;
193 
194 	return 0;
195 }
196 
197 /* Associate a new file with the tty structure */
198 void tty_add_file(struct tty_struct *tty, struct file *file)
199 {
200 	struct tty_file_private *priv = file->private_data;
201 
202 	priv->tty = tty;
203 	priv->file = file;
204 
205 	spin_lock(&tty->files_lock);
206 	list_add(&priv->list, &tty->tty_files);
207 	spin_unlock(&tty->files_lock);
208 }
209 
210 /*
211  * tty_free_file - free file->private_data
212  *
213  * This shall be used only for fail path handling when tty_add_file was not
214  * called yet.
215  */
216 void tty_free_file(struct file *file)
217 {
218 	struct tty_file_private *priv = file->private_data;
219 
220 	file->private_data = NULL;
221 	kfree(priv);
222 }
223 
224 /* Delete file from its tty */
225 static void tty_del_file(struct file *file)
226 {
227 	struct tty_file_private *priv = file->private_data;
228 	struct tty_struct *tty = priv->tty;
229 
230 	spin_lock(&tty->files_lock);
231 	list_del(&priv->list);
232 	spin_unlock(&tty->files_lock);
233 	tty_free_file(file);
234 }
235 
236 /**
237  *	tty_name	-	return tty naming
238  *	@tty: tty structure
239  *
240  *	Convert a tty structure into a name. The name reflects the kernel
241  *	naming policy and if udev is in use may not reflect user space
242  *
243  *	Locking: none
244  */
245 
246 const char *tty_name(const struct tty_struct *tty)
247 {
248 	if (!tty) /* Hmm.  NULL pointer.  That's fun. */
249 		return "NULL tty";
250 	return tty->name;
251 }
252 
253 EXPORT_SYMBOL(tty_name);
254 
255 const char *tty_driver_name(const struct tty_struct *tty)
256 {
257 	if (!tty || !tty->driver)
258 		return "";
259 	return tty->driver->name;
260 }
261 
262 static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
263 			      const char *routine)
264 {
265 #ifdef TTY_PARANOIA_CHECK
266 	if (!tty) {
267 		pr_warn("(%d:%d): %s: NULL tty\n",
268 			imajor(inode), iminor(inode), routine);
269 		return 1;
270 	}
271 	if (tty->magic != TTY_MAGIC) {
272 		pr_warn("(%d:%d): %s: bad magic number\n",
273 			imajor(inode), iminor(inode), routine);
274 		return 1;
275 	}
276 #endif
277 	return 0;
278 }
279 
280 /* Caller must hold tty_lock */
281 static int check_tty_count(struct tty_struct *tty, const char *routine)
282 {
283 #ifdef CHECK_TTY_COUNT
284 	struct list_head *p;
285 	int count = 0, kopen_count = 0;
286 
287 	spin_lock(&tty->files_lock);
288 	list_for_each(p, &tty->tty_files) {
289 		count++;
290 	}
291 	spin_unlock(&tty->files_lock);
292 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
293 	    tty->driver->subtype == PTY_TYPE_SLAVE &&
294 	    tty->link && tty->link->count)
295 		count++;
296 	if (tty_port_kopened(tty->port))
297 		kopen_count++;
298 	if (tty->count != (count + kopen_count)) {
299 		tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
300 			 routine, tty->count, count, kopen_count);
301 		return (count + kopen_count);
302 	}
303 #endif
304 	return 0;
305 }
306 
307 /**
308  *	get_tty_driver		-	find device of a tty
309  *	@device: device identifier
310  *	@index: returns the index of the tty
311  *
312  *	This routine returns a tty driver structure, given a device number
313  *	and also passes back the index number.
314  *
315  *	Locking: caller must hold tty_mutex
316  */
317 
318 static struct tty_driver *get_tty_driver(dev_t device, int *index)
319 {
320 	struct tty_driver *p;
321 
322 	list_for_each_entry(p, &tty_drivers, tty_drivers) {
323 		dev_t base = MKDEV(p->major, p->minor_start);
324 		if (device < base || device >= base + p->num)
325 			continue;
326 		*index = device - base;
327 		return tty_driver_kref_get(p);
328 	}
329 	return NULL;
330 }
331 
332 /**
333  *	tty_dev_name_to_number	-	return dev_t for device name
334  *	@name: user space name of device under /dev
335  *	@number: pointer to dev_t that this function will populate
336  *
337  *	This function converts device names like ttyS0 or ttyUSB1 into dev_t
338  *	like (4, 64) or (188, 1). If no corresponding driver is registered then
339  *	the function returns -ENODEV.
340  *
341  *	Locking: this acquires tty_mutex to protect the tty_drivers list from
342  *		being modified while we are traversing it, and makes sure to
343  *		release it before exiting.
344  */
345 int tty_dev_name_to_number(const char *name, dev_t *number)
346 {
347 	struct tty_driver *p;
348 	int ret;
349 	int index, prefix_length = 0;
350 	const char *str;
351 
352 	for (str = name; *str && !isdigit(*str); str++)
353 		;
354 
355 	if (!*str)
356 		return -EINVAL;
357 
358 	ret = kstrtoint(str, 10, &index);
359 	if (ret)
360 		return ret;
361 
362 	prefix_length = str - name;
363 	mutex_lock(&tty_mutex);
364 
365 	list_for_each_entry(p, &tty_drivers, tty_drivers)
366 		if (prefix_length == strlen(p->name) && strncmp(name,
367 					p->name, prefix_length) == 0) {
368 			if (index < p->num) {
369 				*number = MKDEV(p->major, p->minor_start + index);
370 				goto out;
371 			}
372 		}
373 
374 	/* if here then driver wasn't found */
375 	ret = -ENODEV;
376 out:
377 	mutex_unlock(&tty_mutex);
378 	return ret;
379 }
380 EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
381 
382 #ifdef CONFIG_CONSOLE_POLL
383 
384 /**
385  *	tty_find_polling_driver	-	find device of a polled tty
386  *	@name: name string to match
387  *	@line: pointer to resulting tty line nr
388  *
389  *	This routine returns a tty driver structure, given a name
390  *	and the condition that the tty driver is capable of polled
391  *	operation.
392  */
393 struct tty_driver *tty_find_polling_driver(char *name, int *line)
394 {
395 	struct tty_driver *p, *res = NULL;
396 	int tty_line = 0;
397 	int len;
398 	char *str, *stp;
399 
400 	for (str = name; *str; str++)
401 		if ((*str >= '0' && *str <= '9') || *str == ',')
402 			break;
403 	if (!*str)
404 		return NULL;
405 
406 	len = str - name;
407 	tty_line = simple_strtoul(str, &str, 10);
408 
409 	mutex_lock(&tty_mutex);
410 	/* Search through the tty devices to look for a match */
411 	list_for_each_entry(p, &tty_drivers, tty_drivers) {
412 		if (!len || strncmp(name, p->name, len) != 0)
413 			continue;
414 		stp = str;
415 		if (*stp == ',')
416 			stp++;
417 		if (*stp == '\0')
418 			stp = NULL;
419 
420 		if (tty_line >= 0 && tty_line < p->num && p->ops &&
421 		    p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
422 			res = tty_driver_kref_get(p);
423 			*line = tty_line;
424 			break;
425 		}
426 	}
427 	mutex_unlock(&tty_mutex);
428 
429 	return res;
430 }
431 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
432 #endif
433 
434 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
435 				size_t count, loff_t *ppos)
436 {
437 	return 0;
438 }
439 
440 static ssize_t hung_up_tty_write(struct kiocb *iocb, struct iov_iter *from)
441 {
442 	return -EIO;
443 }
444 
445 /* No kernel lock held - none needed ;) */
446 static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
447 {
448 	return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
449 }
450 
451 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
452 		unsigned long arg)
453 {
454 	return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
455 }
456 
457 static long hung_up_tty_compat_ioctl(struct file *file,
458 				     unsigned int cmd, unsigned long arg)
459 {
460 	return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
461 }
462 
463 static int hung_up_tty_fasync(int fd, struct file *file, int on)
464 {
465 	return -ENOTTY;
466 }
467 
468 static void tty_show_fdinfo(struct seq_file *m, struct file *file)
469 {
470 	struct tty_struct *tty = file_tty(file);
471 
472 	if (tty && tty->ops && tty->ops->show_fdinfo)
473 		tty->ops->show_fdinfo(tty, m);
474 }
475 
476 static const struct file_operations tty_fops = {
477 	.llseek		= no_llseek,
478 	.read		= tty_read,
479 	.write_iter	= tty_write,
480 	.splice_write	= iter_file_splice_write,
481 	.poll		= tty_poll,
482 	.unlocked_ioctl	= tty_ioctl,
483 	.compat_ioctl	= tty_compat_ioctl,
484 	.open		= tty_open,
485 	.release	= tty_release,
486 	.fasync		= tty_fasync,
487 	.show_fdinfo	= tty_show_fdinfo,
488 };
489 
490 static const struct file_operations console_fops = {
491 	.llseek		= no_llseek,
492 	.read		= tty_read,
493 	.write_iter	= redirected_tty_write,
494 	.splice_write	= iter_file_splice_write,
495 	.poll		= tty_poll,
496 	.unlocked_ioctl	= tty_ioctl,
497 	.compat_ioctl	= tty_compat_ioctl,
498 	.open		= tty_open,
499 	.release	= tty_release,
500 	.fasync		= tty_fasync,
501 };
502 
503 static const struct file_operations hung_up_tty_fops = {
504 	.llseek		= no_llseek,
505 	.read		= hung_up_tty_read,
506 	.write_iter	= hung_up_tty_write,
507 	.poll		= hung_up_tty_poll,
508 	.unlocked_ioctl	= hung_up_tty_ioctl,
509 	.compat_ioctl	= hung_up_tty_compat_ioctl,
510 	.release	= tty_release,
511 	.fasync		= hung_up_tty_fasync,
512 };
513 
514 static DEFINE_SPINLOCK(redirect_lock);
515 static struct file *redirect;
516 
517 /**
518  *	tty_wakeup	-	request more data
519  *	@tty: terminal
520  *
521  *	Internal and external helper for wakeups of tty. This function
522  *	informs the line discipline if present that the driver is ready
523  *	to receive more output data.
524  */
525 
526 void tty_wakeup(struct tty_struct *tty)
527 {
528 	struct tty_ldisc *ld;
529 
530 	if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
531 		ld = tty_ldisc_ref(tty);
532 		if (ld) {
533 			if (ld->ops->write_wakeup)
534 				ld->ops->write_wakeup(tty);
535 			tty_ldisc_deref(ld);
536 		}
537 	}
538 	wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
539 }
540 
541 EXPORT_SYMBOL_GPL(tty_wakeup);
542 
543 /**
544  *	__tty_hangup		-	actual handler for hangup events
545  *	@tty: tty device
546  *	@exit_session: if non-zero, signal all foreground group processes
547  *
548  *	This can be called by a "kworker" kernel thread.  That is process
549  *	synchronous but doesn't hold any locks, so we need to make sure we
550  *	have the appropriate locks for what we're doing.
551  *
552  *	The hangup event clears any pending redirections onto the hung up
553  *	device. It ensures future writes will error and it does the needed
554  *	line discipline hangup and signal delivery. The tty object itself
555  *	remains intact.
556  *
557  *	Locking:
558  *		BTM
559  *		  redirect lock for undoing redirection
560  *		  file list lock for manipulating list of ttys
561  *		  tty_ldiscs_lock from called functions
562  *		  termios_rwsem resetting termios data
563  *		  tasklist_lock to walk task list for hangup event
564  *		    ->siglock to protect ->signal/->sighand
565  */
566 static void __tty_hangup(struct tty_struct *tty, int exit_session)
567 {
568 	struct file *cons_filp = NULL;
569 	struct file *filp, *f = NULL;
570 	struct tty_file_private *priv;
571 	int    closecount = 0, n;
572 	int refs;
573 
574 	if (!tty)
575 		return;
576 
577 
578 	spin_lock(&redirect_lock);
579 	if (redirect && file_tty(redirect) == tty) {
580 		f = redirect;
581 		redirect = NULL;
582 	}
583 	spin_unlock(&redirect_lock);
584 
585 	tty_lock(tty);
586 
587 	if (test_bit(TTY_HUPPED, &tty->flags)) {
588 		tty_unlock(tty);
589 		return;
590 	}
591 
592 	/*
593 	 * Some console devices aren't actually hung up for technical and
594 	 * historical reasons, which can lead to indefinite interruptible
595 	 * sleep in n_tty_read().  The following explicitly tells
596 	 * n_tty_read() to abort readers.
597 	 */
598 	set_bit(TTY_HUPPING, &tty->flags);
599 
600 	/* inuse_filps is protected by the single tty lock,
601 	   this really needs to change if we want to flush the
602 	   workqueue with the lock held */
603 	check_tty_count(tty, "tty_hangup");
604 
605 	spin_lock(&tty->files_lock);
606 	/* This breaks for file handles being sent over AF_UNIX sockets ? */
607 	list_for_each_entry(priv, &tty->tty_files, list) {
608 		filp = priv->file;
609 		if (filp->f_op->write_iter == redirected_tty_write)
610 			cons_filp = filp;
611 		if (filp->f_op->write_iter != tty_write)
612 			continue;
613 		closecount++;
614 		__tty_fasync(-1, filp, 0);	/* can't block */
615 		filp->f_op = &hung_up_tty_fops;
616 	}
617 	spin_unlock(&tty->files_lock);
618 
619 	refs = tty_signal_session_leader(tty, exit_session);
620 	/* Account for the p->signal references we killed */
621 	while (refs--)
622 		tty_kref_put(tty);
623 
624 	tty_ldisc_hangup(tty, cons_filp != NULL);
625 
626 	spin_lock_irq(&tty->ctrl_lock);
627 	clear_bit(TTY_THROTTLED, &tty->flags);
628 	clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
629 	put_pid(tty->session);
630 	put_pid(tty->pgrp);
631 	tty->session = NULL;
632 	tty->pgrp = NULL;
633 	tty->ctrl_status = 0;
634 	spin_unlock_irq(&tty->ctrl_lock);
635 
636 	/*
637 	 * If one of the devices matches a console pointer, we
638 	 * cannot just call hangup() because that will cause
639 	 * tty->count and state->count to go out of sync.
640 	 * So we just call close() the right number of times.
641 	 */
642 	if (cons_filp) {
643 		if (tty->ops->close)
644 			for (n = 0; n < closecount; n++)
645 				tty->ops->close(tty, cons_filp);
646 	} else if (tty->ops->hangup)
647 		tty->ops->hangup(tty);
648 	/*
649 	 * We don't want to have driver/ldisc interactions beyond the ones
650 	 * we did here. The driver layer expects no calls after ->hangup()
651 	 * from the ldisc side, which is now guaranteed.
652 	 */
653 	set_bit(TTY_HUPPED, &tty->flags);
654 	clear_bit(TTY_HUPPING, &tty->flags);
655 	tty_unlock(tty);
656 
657 	if (f)
658 		fput(f);
659 }
660 
661 static void do_tty_hangup(struct work_struct *work)
662 {
663 	struct tty_struct *tty =
664 		container_of(work, struct tty_struct, hangup_work);
665 
666 	__tty_hangup(tty, 0);
667 }
668 
669 /**
670  *	tty_hangup		-	trigger a hangup event
671  *	@tty: tty to hangup
672  *
673  *	A carrier loss (virtual or otherwise) has occurred on this like
674  *	schedule a hangup sequence to run after this event.
675  */
676 
677 void tty_hangup(struct tty_struct *tty)
678 {
679 	tty_debug_hangup(tty, "hangup\n");
680 	schedule_work(&tty->hangup_work);
681 }
682 
683 EXPORT_SYMBOL(tty_hangup);
684 
685 /**
686  *	tty_vhangup		-	process vhangup
687  *	@tty: tty to hangup
688  *
689  *	The user has asked via system call for the terminal to be hung up.
690  *	We do this synchronously so that when the syscall returns the process
691  *	is complete. That guarantee is necessary for security reasons.
692  */
693 
694 void tty_vhangup(struct tty_struct *tty)
695 {
696 	tty_debug_hangup(tty, "vhangup\n");
697 	__tty_hangup(tty, 0);
698 }
699 
700 EXPORT_SYMBOL(tty_vhangup);
701 
702 
703 /**
704  *	tty_vhangup_self	-	process vhangup for own ctty
705  *
706  *	Perform a vhangup on the current controlling tty
707  */
708 
709 void tty_vhangup_self(void)
710 {
711 	struct tty_struct *tty;
712 
713 	tty = get_current_tty();
714 	if (tty) {
715 		tty_vhangup(tty);
716 		tty_kref_put(tty);
717 	}
718 }
719 
720 /**
721  *	tty_vhangup_session		-	hangup session leader exit
722  *	@tty: tty to hangup
723  *
724  *	The session leader is exiting and hanging up its controlling terminal.
725  *	Every process in the foreground process group is signalled SIGHUP.
726  *
727  *	We do this synchronously so that when the syscall returns the process
728  *	is complete. That guarantee is necessary for security reasons.
729  */
730 
731 void tty_vhangup_session(struct tty_struct *tty)
732 {
733 	tty_debug_hangup(tty, "session hangup\n");
734 	__tty_hangup(tty, 1);
735 }
736 
737 /**
738  *	tty_hung_up_p		-	was tty hung up
739  *	@filp: file pointer of tty
740  *
741  *	Return true if the tty has been subject to a vhangup or a carrier
742  *	loss
743  */
744 
745 int tty_hung_up_p(struct file *filp)
746 {
747 	return (filp && filp->f_op == &hung_up_tty_fops);
748 }
749 
750 EXPORT_SYMBOL(tty_hung_up_p);
751 
752 /**
753  *	stop_tty	-	propagate flow control
754  *	@tty: tty to stop
755  *
756  *	Perform flow control to the driver. May be called
757  *	on an already stopped device and will not re-call the driver
758  *	method.
759  *
760  *	This functionality is used by both the line disciplines for
761  *	halting incoming flow and by the driver. It may therefore be
762  *	called from any context, may be under the tty atomic_write_lock
763  *	but not always.
764  *
765  *	Locking:
766  *		flow_lock
767  */
768 
769 void __stop_tty(struct tty_struct *tty)
770 {
771 	if (tty->stopped)
772 		return;
773 	tty->stopped = 1;
774 	if (tty->ops->stop)
775 		tty->ops->stop(tty);
776 }
777 
778 void stop_tty(struct tty_struct *tty)
779 {
780 	unsigned long flags;
781 
782 	spin_lock_irqsave(&tty->flow_lock, flags);
783 	__stop_tty(tty);
784 	spin_unlock_irqrestore(&tty->flow_lock, flags);
785 }
786 EXPORT_SYMBOL(stop_tty);
787 
788 /**
789  *	start_tty	-	propagate flow control
790  *	@tty: tty to start
791  *
792  *	Start a tty that has been stopped if at all possible. If this
793  *	tty was previous stopped and is now being started, the driver
794  *	start method is invoked and the line discipline woken.
795  *
796  *	Locking:
797  *		flow_lock
798  */
799 
800 void __start_tty(struct tty_struct *tty)
801 {
802 	if (!tty->stopped || tty->flow_stopped)
803 		return;
804 	tty->stopped = 0;
805 	if (tty->ops->start)
806 		tty->ops->start(tty);
807 	tty_wakeup(tty);
808 }
809 
810 void start_tty(struct tty_struct *tty)
811 {
812 	unsigned long flags;
813 
814 	spin_lock_irqsave(&tty->flow_lock, flags);
815 	__start_tty(tty);
816 	spin_unlock_irqrestore(&tty->flow_lock, flags);
817 }
818 EXPORT_SYMBOL(start_tty);
819 
820 static void tty_update_time(struct timespec64 *time)
821 {
822 	time64_t sec = ktime_get_real_seconds();
823 
824 	/*
825 	 * We only care if the two values differ in anything other than the
826 	 * lower three bits (i.e every 8 seconds).  If so, then we can update
827 	 * the time of the tty device, otherwise it could be construded as a
828 	 * security leak to let userspace know the exact timing of the tty.
829 	 */
830 	if ((sec ^ time->tv_sec) & ~7)
831 		time->tv_sec = sec;
832 }
833 
834 /**
835  *	tty_read	-	read method for tty device files
836  *	@file: pointer to tty file
837  *	@buf: user buffer
838  *	@count: size of user buffer
839  *	@ppos: unused
840  *
841  *	Perform the read system call function on this terminal device. Checks
842  *	for hung up devices before calling the line discipline method.
843  *
844  *	Locking:
845  *		Locks the line discipline internally while needed. Multiple
846  *	read calls may be outstanding in parallel.
847  */
848 
849 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
850 			loff_t *ppos)
851 {
852 	int i;
853 	struct inode *inode = file_inode(file);
854 	struct tty_struct *tty = file_tty(file);
855 	struct tty_ldisc *ld;
856 
857 	if (tty_paranoia_check(tty, inode, "tty_read"))
858 		return -EIO;
859 	if (!tty || tty_io_error(tty))
860 		return -EIO;
861 
862 	/* We want to wait for the line discipline to sort out in this
863 	   situation */
864 	ld = tty_ldisc_ref_wait(tty);
865 	if (!ld)
866 		return hung_up_tty_read(file, buf, count, ppos);
867 	if (ld->ops->read)
868 		i = ld->ops->read(tty, file, buf, count);
869 	else
870 		i = -EIO;
871 	tty_ldisc_deref(ld);
872 
873 	if (i > 0)
874 		tty_update_time(&inode->i_atime);
875 
876 	return i;
877 }
878 
879 static void tty_write_unlock(struct tty_struct *tty)
880 {
881 	mutex_unlock(&tty->atomic_write_lock);
882 	wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
883 }
884 
885 static int tty_write_lock(struct tty_struct *tty, int ndelay)
886 {
887 	if (!mutex_trylock(&tty->atomic_write_lock)) {
888 		if (ndelay)
889 			return -EAGAIN;
890 		if (mutex_lock_interruptible(&tty->atomic_write_lock))
891 			return -ERESTARTSYS;
892 	}
893 	return 0;
894 }
895 
896 /*
897  * Split writes up in sane blocksizes to avoid
898  * denial-of-service type attacks
899  */
900 static inline ssize_t do_tty_write(
901 	ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
902 	struct tty_struct *tty,
903 	struct file *file,
904 	struct iov_iter *from)
905 {
906 	size_t count = iov_iter_count(from);
907 	ssize_t ret, written = 0;
908 	unsigned int chunk;
909 
910 	ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
911 	if (ret < 0)
912 		return ret;
913 
914 	/*
915 	 * We chunk up writes into a temporary buffer. This
916 	 * simplifies low-level drivers immensely, since they
917 	 * don't have locking issues and user mode accesses.
918 	 *
919 	 * But if TTY_NO_WRITE_SPLIT is set, we should use a
920 	 * big chunk-size..
921 	 *
922 	 * The default chunk-size is 2kB, because the NTTY
923 	 * layer has problems with bigger chunks. It will
924 	 * claim to be able to handle more characters than
925 	 * it actually does.
926 	 *
927 	 * FIXME: This can probably go away now except that 64K chunks
928 	 * are too likely to fail unless switched to vmalloc...
929 	 */
930 	chunk = 2048;
931 	if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
932 		chunk = 65536;
933 	if (count < chunk)
934 		chunk = count;
935 
936 	/* write_buf/write_cnt is protected by the atomic_write_lock mutex */
937 	if (tty->write_cnt < chunk) {
938 		unsigned char *buf_chunk;
939 
940 		if (chunk < 1024)
941 			chunk = 1024;
942 
943 		buf_chunk = kmalloc(chunk, GFP_KERNEL);
944 		if (!buf_chunk) {
945 			ret = -ENOMEM;
946 			goto out;
947 		}
948 		kfree(tty->write_buf);
949 		tty->write_cnt = chunk;
950 		tty->write_buf = buf_chunk;
951 	}
952 
953 	/* Do the write .. */
954 	for (;;) {
955 		size_t size = count;
956 		if (size > chunk)
957 			size = chunk;
958 
959 		ret = -EFAULT;
960 		if (copy_from_iter(tty->write_buf, size, from) != size)
961 			break;
962 
963 		ret = write(tty, file, tty->write_buf, size);
964 		if (ret <= 0)
965 			break;
966 
967 		/* FIXME! Have Al check this! */
968 		if (ret != size)
969 			iov_iter_revert(from, size-ret);
970 
971 		written += ret;
972 		count -= ret;
973 		if (!count)
974 			break;
975 		ret = -ERESTARTSYS;
976 		if (signal_pending(current))
977 			break;
978 		cond_resched();
979 	}
980 	if (written) {
981 		tty_update_time(&file_inode(file)->i_mtime);
982 		ret = written;
983 	}
984 out:
985 	tty_write_unlock(tty);
986 	return ret;
987 }
988 
989 /**
990  * tty_write_message - write a message to a certain tty, not just the console.
991  * @tty: the destination tty_struct
992  * @msg: the message to write
993  *
994  * This is used for messages that need to be redirected to a specific tty.
995  * We don't put it into the syslog queue right now maybe in the future if
996  * really needed.
997  *
998  * We must still hold the BTM and test the CLOSING flag for the moment.
999  */
1000 
1001 void tty_write_message(struct tty_struct *tty, char *msg)
1002 {
1003 	if (tty) {
1004 		mutex_lock(&tty->atomic_write_lock);
1005 		tty_lock(tty);
1006 		if (tty->ops->write && tty->count > 0)
1007 			tty->ops->write(tty, msg, strlen(msg));
1008 		tty_unlock(tty);
1009 		tty_write_unlock(tty);
1010 	}
1011 	return;
1012 }
1013 
1014 
1015 /**
1016  *	tty_write		-	write method for tty device file
1017  *	@file: tty file pointer
1018  *	@buf: user data to write
1019  *	@count: bytes to write
1020  *	@ppos: unused
1021  *
1022  *	Write data to a tty device via the line discipline.
1023  *
1024  *	Locking:
1025  *		Locks the line discipline as required
1026  *		Writes to the tty driver are serialized by the atomic_write_lock
1027  *	and are then processed in chunks to the device. The line discipline
1028  *	write method will not be invoked in parallel for each device.
1029  */
1030 
1031 static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
1032 {
1033 	struct file *file = iocb->ki_filp;
1034 	struct tty_struct *tty = file_tty(file);
1035  	struct tty_ldisc *ld;
1036 	ssize_t ret;
1037 
1038 	if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1039 		return -EIO;
1040 	if (!tty || !tty->ops->write ||	tty_io_error(tty))
1041 			return -EIO;
1042 	/* Short term debug to catch buggy drivers */
1043 	if (tty->ops->write_room == NULL)
1044 		tty_err(tty, "missing write_room method\n");
1045 	ld = tty_ldisc_ref_wait(tty);
1046 	if (!ld)
1047 		return hung_up_tty_write(iocb, from);
1048 	if (!ld->ops->write)
1049 		ret = -EIO;
1050 	else
1051 		ret = do_tty_write(ld->ops->write, tty, file, from);
1052 	tty_ldisc_deref(ld);
1053 	return ret;
1054 }
1055 
1056 ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
1057 {
1058 	struct file *p = NULL;
1059 
1060 	spin_lock(&redirect_lock);
1061 	if (redirect)
1062 		p = get_file(redirect);
1063 	spin_unlock(&redirect_lock);
1064 
1065 	if (p) {
1066 		ssize_t res;
1067 		res = vfs_iocb_iter_write(p, iocb, iter);
1068 		fput(p);
1069 		return res;
1070 	}
1071 	return tty_write(iocb, iter);
1072 }
1073 
1074 /*
1075  *	tty_send_xchar	-	send priority character
1076  *
1077  *	Send a high priority character to the tty even if stopped
1078  *
1079  *	Locking: none for xchar method, write ordering for write method.
1080  */
1081 
1082 int tty_send_xchar(struct tty_struct *tty, char ch)
1083 {
1084 	int	was_stopped = tty->stopped;
1085 
1086 	if (tty->ops->send_xchar) {
1087 		down_read(&tty->termios_rwsem);
1088 		tty->ops->send_xchar(tty, ch);
1089 		up_read(&tty->termios_rwsem);
1090 		return 0;
1091 	}
1092 
1093 	if (tty_write_lock(tty, 0) < 0)
1094 		return -ERESTARTSYS;
1095 
1096 	down_read(&tty->termios_rwsem);
1097 	if (was_stopped)
1098 		start_tty(tty);
1099 	tty->ops->write(tty, &ch, 1);
1100 	if (was_stopped)
1101 		stop_tty(tty);
1102 	up_read(&tty->termios_rwsem);
1103 	tty_write_unlock(tty);
1104 	return 0;
1105 }
1106 
1107 static char ptychar[] = "pqrstuvwxyzabcde";
1108 
1109 /**
1110  *	pty_line_name	-	generate name for a pty
1111  *	@driver: the tty driver in use
1112  *	@index: the minor number
1113  *	@p: output buffer of at least 6 bytes
1114  *
1115  *	Generate a name from a driver reference and write it to the output
1116  *	buffer.
1117  *
1118  *	Locking: None
1119  */
1120 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1121 {
1122 	int i = index + driver->name_base;
1123 	/* ->name is initialized to "ttyp", but "tty" is expected */
1124 	sprintf(p, "%s%c%x",
1125 		driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1126 		ptychar[i >> 4 & 0xf], i & 0xf);
1127 }
1128 
1129 /**
1130  *	tty_line_name	-	generate name for a tty
1131  *	@driver: the tty driver in use
1132  *	@index: the minor number
1133  *	@p: output buffer of at least 7 bytes
1134  *
1135  *	Generate a name from a driver reference and write it to the output
1136  *	buffer.
1137  *
1138  *	Locking: None
1139  */
1140 static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1141 {
1142 	if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1143 		return sprintf(p, "%s", driver->name);
1144 	else
1145 		return sprintf(p, "%s%d", driver->name,
1146 			       index + driver->name_base);
1147 }
1148 
1149 /**
1150  *	tty_driver_lookup_tty() - find an existing tty, if any
1151  *	@driver: the driver for the tty
1152  *	@file:   file object
1153  *	@idx:	 the minor number
1154  *
1155  *	Return the tty, if found. If not found, return NULL or ERR_PTR() if the
1156  *	driver lookup() method returns an error.
1157  *
1158  *	Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1159  */
1160 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1161 		struct file *file, int idx)
1162 {
1163 	struct tty_struct *tty;
1164 
1165 	if (driver->ops->lookup)
1166 		if (!file)
1167 			tty = ERR_PTR(-EIO);
1168 		else
1169 			tty = driver->ops->lookup(driver, file, idx);
1170 	else
1171 		tty = driver->ttys[idx];
1172 
1173 	if (!IS_ERR(tty))
1174 		tty_kref_get(tty);
1175 	return tty;
1176 }
1177 
1178 /**
1179  *	tty_init_termios	-  helper for termios setup
1180  *	@tty: the tty to set up
1181  *
1182  *	Initialise the termios structure for this tty. This runs under
1183  *	the tty_mutex currently so we can be relaxed about ordering.
1184  */
1185 
1186 void tty_init_termios(struct tty_struct *tty)
1187 {
1188 	struct ktermios *tp;
1189 	int idx = tty->index;
1190 
1191 	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1192 		tty->termios = tty->driver->init_termios;
1193 	else {
1194 		/* Check for lazy saved data */
1195 		tp = tty->driver->termios[idx];
1196 		if (tp != NULL) {
1197 			tty->termios = *tp;
1198 			tty->termios.c_line  = tty->driver->init_termios.c_line;
1199 		} else
1200 			tty->termios = tty->driver->init_termios;
1201 	}
1202 	/* Compatibility until drivers always set this */
1203 	tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1204 	tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1205 }
1206 EXPORT_SYMBOL_GPL(tty_init_termios);
1207 
1208 int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1209 {
1210 	tty_init_termios(tty);
1211 	tty_driver_kref_get(driver);
1212 	tty->count++;
1213 	driver->ttys[tty->index] = tty;
1214 	return 0;
1215 }
1216 EXPORT_SYMBOL_GPL(tty_standard_install);
1217 
1218 /**
1219  *	tty_driver_install_tty() - install a tty entry in the driver
1220  *	@driver: the driver for the tty
1221  *	@tty: the tty
1222  *
1223  *	Install a tty object into the driver tables. The tty->index field
1224  *	will be set by the time this is called. This method is responsible
1225  *	for ensuring any need additional structures are allocated and
1226  *	configured.
1227  *
1228  *	Locking: tty_mutex for now
1229  */
1230 static int tty_driver_install_tty(struct tty_driver *driver,
1231 						struct tty_struct *tty)
1232 {
1233 	return driver->ops->install ? driver->ops->install(driver, tty) :
1234 		tty_standard_install(driver, tty);
1235 }
1236 
1237 /**
1238  *	tty_driver_remove_tty() - remove a tty from the driver tables
1239  *	@driver: the driver for the tty
1240  *	@tty: tty to remove
1241  *
1242  *	Remvoe a tty object from the driver tables. The tty->index field
1243  *	will be set by the time this is called.
1244  *
1245  *	Locking: tty_mutex for now
1246  */
1247 static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1248 {
1249 	if (driver->ops->remove)
1250 		driver->ops->remove(driver, tty);
1251 	else
1252 		driver->ttys[tty->index] = NULL;
1253 }
1254 
1255 /**
1256  *	tty_reopen()	- fast re-open of an open tty
1257  *	@tty: the tty to open
1258  *
1259  *	Return 0 on success, -errno on error.
1260  *	Re-opens on master ptys are not allowed and return -EIO.
1261  *
1262  *	Locking: Caller must hold tty_lock
1263  */
1264 static int tty_reopen(struct tty_struct *tty)
1265 {
1266 	struct tty_driver *driver = tty->driver;
1267 	struct tty_ldisc *ld;
1268 	int retval = 0;
1269 
1270 	if (driver->type == TTY_DRIVER_TYPE_PTY &&
1271 	    driver->subtype == PTY_TYPE_MASTER)
1272 		return -EIO;
1273 
1274 	if (!tty->count)
1275 		return -EAGAIN;
1276 
1277 	if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1278 		return -EBUSY;
1279 
1280 	ld = tty_ldisc_ref_wait(tty);
1281 	if (ld) {
1282 		tty_ldisc_deref(ld);
1283 	} else {
1284 		retval = tty_ldisc_lock(tty, 5 * HZ);
1285 		if (retval)
1286 			return retval;
1287 
1288 		if (!tty->ldisc)
1289 			retval = tty_ldisc_reinit(tty, tty->termios.c_line);
1290 		tty_ldisc_unlock(tty);
1291 	}
1292 
1293 	if (retval == 0)
1294 		tty->count++;
1295 
1296 	return retval;
1297 }
1298 
1299 /**
1300  *	tty_init_dev		-	initialise a tty device
1301  *	@driver: tty driver we are opening a device on
1302  *	@idx: device index
1303  *
1304  *	Prepare a tty device. This may not be a "new" clean device but
1305  *	could also be an active device. The pty drivers require special
1306  *	handling because of this.
1307  *
1308  *	Locking:
1309  *		The function is called under the tty_mutex, which
1310  *	protects us from the tty struct or driver itself going away.
1311  *
1312  *	On exit the tty device has the line discipline attached and
1313  *	a reference count of 1. If a pair was created for pty/tty use
1314  *	and the other was a pty master then it too has a reference count of 1.
1315  *
1316  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1317  * failed open.  The new code protects the open with a mutex, so it's
1318  * really quite straightforward.  The mutex locking can probably be
1319  * relaxed for the (most common) case of reopening a tty.
1320  *
1321  *	Return: returned tty structure
1322  */
1323 
1324 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1325 {
1326 	struct tty_struct *tty;
1327 	int retval;
1328 
1329 	/*
1330 	 * First time open is complex, especially for PTY devices.
1331 	 * This code guarantees that either everything succeeds and the
1332 	 * TTY is ready for operation, or else the table slots are vacated
1333 	 * and the allocated memory released.  (Except that the termios
1334 	 * may be retained.)
1335 	 */
1336 
1337 	if (!try_module_get(driver->owner))
1338 		return ERR_PTR(-ENODEV);
1339 
1340 	tty = alloc_tty_struct(driver, idx);
1341 	if (!tty) {
1342 		retval = -ENOMEM;
1343 		goto err_module_put;
1344 	}
1345 
1346 	tty_lock(tty);
1347 	retval = tty_driver_install_tty(driver, tty);
1348 	if (retval < 0)
1349 		goto err_free_tty;
1350 
1351 	if (!tty->port)
1352 		tty->port = driver->ports[idx];
1353 
1354 	if (WARN_RATELIMIT(!tty->port,
1355 			"%s: %s driver does not set tty->port. This would crash the kernel. Fix the driver!\n",
1356 			__func__, tty->driver->name)) {
1357 		retval = -EINVAL;
1358 		goto err_release_lock;
1359 	}
1360 
1361 	retval = tty_ldisc_lock(tty, 5 * HZ);
1362 	if (retval)
1363 		goto err_release_lock;
1364 	tty->port->itty = tty;
1365 
1366 	/*
1367 	 * Structures all installed ... call the ldisc open routines.
1368 	 * If we fail here just call release_tty to clean up.  No need
1369 	 * to decrement the use counts, as release_tty doesn't care.
1370 	 */
1371 	retval = tty_ldisc_setup(tty, tty->link);
1372 	if (retval)
1373 		goto err_release_tty;
1374 	tty_ldisc_unlock(tty);
1375 	/* Return the tty locked so that it cannot vanish under the caller */
1376 	return tty;
1377 
1378 err_free_tty:
1379 	tty_unlock(tty);
1380 	free_tty_struct(tty);
1381 err_module_put:
1382 	module_put(driver->owner);
1383 	return ERR_PTR(retval);
1384 
1385 	/* call the tty release_tty routine to clean out this slot */
1386 err_release_tty:
1387 	tty_ldisc_unlock(tty);
1388 	tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1389 			     retval, idx);
1390 err_release_lock:
1391 	tty_unlock(tty);
1392 	release_tty(tty, idx);
1393 	return ERR_PTR(retval);
1394 }
1395 
1396 /**
1397  * tty_save_termios() - save tty termios data in driver table
1398  * @tty: tty whose termios data to save
1399  *
1400  * Locking: Caller guarantees serialisation with tty_init_termios().
1401  */
1402 void tty_save_termios(struct tty_struct *tty)
1403 {
1404 	struct ktermios *tp;
1405 	int idx = tty->index;
1406 
1407 	/* If the port is going to reset then it has no termios to save */
1408 	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1409 		return;
1410 
1411 	/* Stash the termios data */
1412 	tp = tty->driver->termios[idx];
1413 	if (tp == NULL) {
1414 		tp = kmalloc(sizeof(*tp), GFP_KERNEL);
1415 		if (tp == NULL)
1416 			return;
1417 		tty->driver->termios[idx] = tp;
1418 	}
1419 	*tp = tty->termios;
1420 }
1421 EXPORT_SYMBOL_GPL(tty_save_termios);
1422 
1423 /**
1424  *	tty_flush_works		-	flush all works of a tty/pty pair
1425  *	@tty: tty device to flush works for (or either end of a pty pair)
1426  *
1427  *	Sync flush all works belonging to @tty (and the 'other' tty).
1428  */
1429 static void tty_flush_works(struct tty_struct *tty)
1430 {
1431 	flush_work(&tty->SAK_work);
1432 	flush_work(&tty->hangup_work);
1433 	if (tty->link) {
1434 		flush_work(&tty->link->SAK_work);
1435 		flush_work(&tty->link->hangup_work);
1436 	}
1437 }
1438 
1439 /**
1440  *	release_one_tty		-	release tty structure memory
1441  *	@work: work of tty we are obliterating
1442  *
1443  *	Releases memory associated with a tty structure, and clears out the
1444  *	driver table slots. This function is called when a device is no longer
1445  *	in use. It also gets called when setup of a device fails.
1446  *
1447  *	Locking:
1448  *		takes the file list lock internally when working on the list
1449  *	of ttys that the driver keeps.
1450  *
1451  *	This method gets called from a work queue so that the driver private
1452  *	cleanup ops can sleep (needed for USB at least)
1453  */
1454 static void release_one_tty(struct work_struct *work)
1455 {
1456 	struct tty_struct *tty =
1457 		container_of(work, struct tty_struct, hangup_work);
1458 	struct tty_driver *driver = tty->driver;
1459 	struct module *owner = driver->owner;
1460 
1461 	if (tty->ops->cleanup)
1462 		tty->ops->cleanup(tty);
1463 
1464 	tty->magic = 0;
1465 	tty_driver_kref_put(driver);
1466 	module_put(owner);
1467 
1468 	spin_lock(&tty->files_lock);
1469 	list_del_init(&tty->tty_files);
1470 	spin_unlock(&tty->files_lock);
1471 
1472 	put_pid(tty->pgrp);
1473 	put_pid(tty->session);
1474 	free_tty_struct(tty);
1475 }
1476 
1477 static void queue_release_one_tty(struct kref *kref)
1478 {
1479 	struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1480 
1481 	/* The hangup queue is now free so we can reuse it rather than
1482 	   waste a chunk of memory for each port */
1483 	INIT_WORK(&tty->hangup_work, release_one_tty);
1484 	schedule_work(&tty->hangup_work);
1485 }
1486 
1487 /**
1488  *	tty_kref_put		-	release a tty kref
1489  *	@tty: tty device
1490  *
1491  *	Release a reference to a tty device and if need be let the kref
1492  *	layer destruct the object for us
1493  */
1494 
1495 void tty_kref_put(struct tty_struct *tty)
1496 {
1497 	if (tty)
1498 		kref_put(&tty->kref, queue_release_one_tty);
1499 }
1500 EXPORT_SYMBOL(tty_kref_put);
1501 
1502 /**
1503  *	release_tty		-	release tty structure memory
1504  *	@tty: tty device release
1505  *	@idx: index of the tty device release
1506  *
1507  *	Release both @tty and a possible linked partner (think pty pair),
1508  *	and decrement the refcount of the backing module.
1509  *
1510  *	Locking:
1511  *		tty_mutex
1512  *		takes the file list lock internally when working on the list
1513  *	of ttys that the driver keeps.
1514  *
1515  */
1516 static void release_tty(struct tty_struct *tty, int idx)
1517 {
1518 	/* This should always be true but check for the moment */
1519 	WARN_ON(tty->index != idx);
1520 	WARN_ON(!mutex_is_locked(&tty_mutex));
1521 	if (tty->ops->shutdown)
1522 		tty->ops->shutdown(tty);
1523 	tty_save_termios(tty);
1524 	tty_driver_remove_tty(tty->driver, tty);
1525 	if (tty->port)
1526 		tty->port->itty = NULL;
1527 	if (tty->link)
1528 		tty->link->port->itty = NULL;
1529 	if (tty->port)
1530 		tty_buffer_cancel_work(tty->port);
1531 	if (tty->link)
1532 		tty_buffer_cancel_work(tty->link->port);
1533 
1534 	tty_kref_put(tty->link);
1535 	tty_kref_put(tty);
1536 }
1537 
1538 /**
1539  *	tty_release_checks - check a tty before real release
1540  *	@tty: tty to check
1541  *	@idx: index of the tty
1542  *
1543  *	Performs some paranoid checking before true release of the @tty.
1544  *	This is a no-op unless TTY_PARANOIA_CHECK is defined.
1545  */
1546 static int tty_release_checks(struct tty_struct *tty, int idx)
1547 {
1548 #ifdef TTY_PARANOIA_CHECK
1549 	if (idx < 0 || idx >= tty->driver->num) {
1550 		tty_debug(tty, "bad idx %d\n", idx);
1551 		return -1;
1552 	}
1553 
1554 	/* not much to check for devpts */
1555 	if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1556 		return 0;
1557 
1558 	if (tty != tty->driver->ttys[idx]) {
1559 		tty_debug(tty, "bad driver table[%d] = %p\n",
1560 			  idx, tty->driver->ttys[idx]);
1561 		return -1;
1562 	}
1563 	if (tty->driver->other) {
1564 		struct tty_struct *o_tty = tty->link;
1565 
1566 		if (o_tty != tty->driver->other->ttys[idx]) {
1567 			tty_debug(tty, "bad other table[%d] = %p\n",
1568 				  idx, tty->driver->other->ttys[idx]);
1569 			return -1;
1570 		}
1571 		if (o_tty->link != tty) {
1572 			tty_debug(tty, "bad link = %p\n", o_tty->link);
1573 			return -1;
1574 		}
1575 	}
1576 #endif
1577 	return 0;
1578 }
1579 
1580 /**
1581  *      tty_kclose      -       closes tty opened by tty_kopen
1582  *      @tty: tty device
1583  *
1584  *      Performs the final steps to release and free a tty device. It is the
1585  *      same as tty_release_struct except that it also resets TTY_PORT_KOPENED
1586  *      flag on tty->port.
1587  */
1588 void tty_kclose(struct tty_struct *tty)
1589 {
1590 	/*
1591 	 * Ask the line discipline code to release its structures
1592 	 */
1593 	tty_ldisc_release(tty);
1594 
1595 	/* Wait for pending work before tty destruction commmences */
1596 	tty_flush_works(tty);
1597 
1598 	tty_debug_hangup(tty, "freeing structure\n");
1599 	/*
1600 	 * The release_tty function takes care of the details of clearing
1601 	 * the slots and preserving the termios structure.
1602 	 */
1603 	mutex_lock(&tty_mutex);
1604 	tty_port_set_kopened(tty->port, 0);
1605 	release_tty(tty, tty->index);
1606 	mutex_unlock(&tty_mutex);
1607 }
1608 EXPORT_SYMBOL_GPL(tty_kclose);
1609 
1610 /**
1611  *	tty_release_struct	-	release a tty struct
1612  *	@tty: tty device
1613  *	@idx: index of the tty
1614  *
1615  *	Performs the final steps to release and free a tty device. It is
1616  *	roughly the reverse of tty_init_dev.
1617  */
1618 void tty_release_struct(struct tty_struct *tty, int idx)
1619 {
1620 	/*
1621 	 * Ask the line discipline code to release its structures
1622 	 */
1623 	tty_ldisc_release(tty);
1624 
1625 	/* Wait for pending work before tty destruction commmences */
1626 	tty_flush_works(tty);
1627 
1628 	tty_debug_hangup(tty, "freeing structure\n");
1629 	/*
1630 	 * The release_tty function takes care of the details of clearing
1631 	 * the slots and preserving the termios structure.
1632 	 */
1633 	mutex_lock(&tty_mutex);
1634 	release_tty(tty, idx);
1635 	mutex_unlock(&tty_mutex);
1636 }
1637 EXPORT_SYMBOL_GPL(tty_release_struct);
1638 
1639 /**
1640  *	tty_release		-	vfs callback for close
1641  *	@inode: inode of tty
1642  *	@filp: file pointer for handle to tty
1643  *
1644  *	Called the last time each file handle is closed that references
1645  *	this tty. There may however be several such references.
1646  *
1647  *	Locking:
1648  *		Takes bkl. See tty_release_dev
1649  *
1650  * Even releasing the tty structures is a tricky business.. We have
1651  * to be very careful that the structures are all released at the
1652  * same time, as interrupts might otherwise get the wrong pointers.
1653  *
1654  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1655  * lead to double frees or releasing memory still in use.
1656  */
1657 
1658 int tty_release(struct inode *inode, struct file *filp)
1659 {
1660 	struct tty_struct *tty = file_tty(filp);
1661 	struct tty_struct *o_tty = NULL;
1662 	int	do_sleep, final;
1663 	int	idx;
1664 	long	timeout = 0;
1665 	int	once = 1;
1666 
1667 	if (tty_paranoia_check(tty, inode, __func__))
1668 		return 0;
1669 
1670 	tty_lock(tty);
1671 	check_tty_count(tty, __func__);
1672 
1673 	__tty_fasync(-1, filp, 0);
1674 
1675 	idx = tty->index;
1676 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1677 	    tty->driver->subtype == PTY_TYPE_MASTER)
1678 		o_tty = tty->link;
1679 
1680 	if (tty_release_checks(tty, idx)) {
1681 		tty_unlock(tty);
1682 		return 0;
1683 	}
1684 
1685 	tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1686 
1687 	if (tty->ops->close)
1688 		tty->ops->close(tty, filp);
1689 
1690 	/* If tty is pty master, lock the slave pty (stable lock order) */
1691 	tty_lock_slave(o_tty);
1692 
1693 	/*
1694 	 * Sanity check: if tty->count is going to zero, there shouldn't be
1695 	 * any waiters on tty->read_wait or tty->write_wait.  We test the
1696 	 * wait queues and kick everyone out _before_ actually starting to
1697 	 * close.  This ensures that we won't block while releasing the tty
1698 	 * structure.
1699 	 *
1700 	 * The test for the o_tty closing is necessary, since the master and
1701 	 * slave sides may close in any order.  If the slave side closes out
1702 	 * first, its count will be one, since the master side holds an open.
1703 	 * Thus this test wouldn't be triggered at the time the slave closed,
1704 	 * so we do it now.
1705 	 */
1706 	while (1) {
1707 		do_sleep = 0;
1708 
1709 		if (tty->count <= 1) {
1710 			if (waitqueue_active(&tty->read_wait)) {
1711 				wake_up_poll(&tty->read_wait, EPOLLIN);
1712 				do_sleep++;
1713 			}
1714 			if (waitqueue_active(&tty->write_wait)) {
1715 				wake_up_poll(&tty->write_wait, EPOLLOUT);
1716 				do_sleep++;
1717 			}
1718 		}
1719 		if (o_tty && o_tty->count <= 1) {
1720 			if (waitqueue_active(&o_tty->read_wait)) {
1721 				wake_up_poll(&o_tty->read_wait, EPOLLIN);
1722 				do_sleep++;
1723 			}
1724 			if (waitqueue_active(&o_tty->write_wait)) {
1725 				wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1726 				do_sleep++;
1727 			}
1728 		}
1729 		if (!do_sleep)
1730 			break;
1731 
1732 		if (once) {
1733 			once = 0;
1734 			tty_warn(tty, "read/write wait queue active!\n");
1735 		}
1736 		schedule_timeout_killable(timeout);
1737 		if (timeout < 120 * HZ)
1738 			timeout = 2 * timeout + 1;
1739 		else
1740 			timeout = MAX_SCHEDULE_TIMEOUT;
1741 	}
1742 
1743 	if (o_tty) {
1744 		if (--o_tty->count < 0) {
1745 			tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1746 			o_tty->count = 0;
1747 		}
1748 	}
1749 	if (--tty->count < 0) {
1750 		tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1751 		tty->count = 0;
1752 	}
1753 
1754 	/*
1755 	 * We've decremented tty->count, so we need to remove this file
1756 	 * descriptor off the tty->tty_files list; this serves two
1757 	 * purposes:
1758 	 *  - check_tty_count sees the correct number of file descriptors
1759 	 *    associated with this tty.
1760 	 *  - do_tty_hangup no longer sees this file descriptor as
1761 	 *    something that needs to be handled for hangups.
1762 	 */
1763 	tty_del_file(filp);
1764 
1765 	/*
1766 	 * Perform some housekeeping before deciding whether to return.
1767 	 *
1768 	 * If _either_ side is closing, make sure there aren't any
1769 	 * processes that still think tty or o_tty is their controlling
1770 	 * tty.
1771 	 */
1772 	if (!tty->count) {
1773 		read_lock(&tasklist_lock);
1774 		session_clear_tty(tty->session);
1775 		if (o_tty)
1776 			session_clear_tty(o_tty->session);
1777 		read_unlock(&tasklist_lock);
1778 	}
1779 
1780 	/* check whether both sides are closing ... */
1781 	final = !tty->count && !(o_tty && o_tty->count);
1782 
1783 	tty_unlock_slave(o_tty);
1784 	tty_unlock(tty);
1785 
1786 	/* At this point, the tty->count == 0 should ensure a dead tty
1787 	   cannot be re-opened by a racing opener */
1788 
1789 	if (!final)
1790 		return 0;
1791 
1792 	tty_debug_hangup(tty, "final close\n");
1793 
1794 	tty_release_struct(tty, idx);
1795 	return 0;
1796 }
1797 
1798 /**
1799  *	tty_open_current_tty - get locked tty of current task
1800  *	@device: device number
1801  *	@filp: file pointer to tty
1802  *	@return: locked tty of the current task iff @device is /dev/tty
1803  *
1804  *	Performs a re-open of the current task's controlling tty.
1805  *
1806  *	We cannot return driver and index like for the other nodes because
1807  *	devpts will not work then. It expects inodes to be from devpts FS.
1808  */
1809 static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1810 {
1811 	struct tty_struct *tty;
1812 	int retval;
1813 
1814 	if (device != MKDEV(TTYAUX_MAJOR, 0))
1815 		return NULL;
1816 
1817 	tty = get_current_tty();
1818 	if (!tty)
1819 		return ERR_PTR(-ENXIO);
1820 
1821 	filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1822 	/* noctty = 1; */
1823 	tty_lock(tty);
1824 	tty_kref_put(tty);	/* safe to drop the kref now */
1825 
1826 	retval = tty_reopen(tty);
1827 	if (retval < 0) {
1828 		tty_unlock(tty);
1829 		tty = ERR_PTR(retval);
1830 	}
1831 	return tty;
1832 }
1833 
1834 /**
1835  *	tty_lookup_driver - lookup a tty driver for a given device file
1836  *	@device: device number
1837  *	@filp: file pointer to tty
1838  *	@index: index for the device in the @return driver
1839  *	@return: driver for this inode (with increased refcount)
1840  *
1841  * 	If @return is not erroneous, the caller is responsible to decrement the
1842  * 	refcount by tty_driver_kref_put.
1843  *
1844  *	Locking: tty_mutex protects get_tty_driver
1845  */
1846 static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1847 		int *index)
1848 {
1849 	struct tty_driver *driver = NULL;
1850 
1851 	switch (device) {
1852 #ifdef CONFIG_VT
1853 	case MKDEV(TTY_MAJOR, 0): {
1854 		extern struct tty_driver *console_driver;
1855 		driver = tty_driver_kref_get(console_driver);
1856 		*index = fg_console;
1857 		break;
1858 	}
1859 #endif
1860 	case MKDEV(TTYAUX_MAJOR, 1): {
1861 		struct tty_driver *console_driver = console_device(index);
1862 		if (console_driver) {
1863 			driver = tty_driver_kref_get(console_driver);
1864 			if (driver && filp) {
1865 				/* Don't let /dev/console block */
1866 				filp->f_flags |= O_NONBLOCK;
1867 				break;
1868 			}
1869 		}
1870 		if (driver)
1871 			tty_driver_kref_put(driver);
1872 		return ERR_PTR(-ENODEV);
1873 	}
1874 	default:
1875 		driver = get_tty_driver(device, index);
1876 		if (!driver)
1877 			return ERR_PTR(-ENODEV);
1878 		break;
1879 	}
1880 	return driver;
1881 }
1882 
1883 /**
1884  *	tty_kopen	-	open a tty device for kernel
1885  *	@device: dev_t of device to open
1886  *
1887  *	Opens tty exclusively for kernel. Performs the driver lookup,
1888  *	makes sure it's not already opened and performs the first-time
1889  *	tty initialization.
1890  *
1891  *	Returns the locked initialized &tty_struct
1892  *
1893  *	Claims the global tty_mutex to serialize:
1894  *	  - concurrent first-time tty initialization
1895  *	  - concurrent tty driver removal w/ lookup
1896  *	  - concurrent tty removal from driver table
1897  */
1898 struct tty_struct *tty_kopen(dev_t device)
1899 {
1900 	struct tty_struct *tty;
1901 	struct tty_driver *driver;
1902 	int index = -1;
1903 
1904 	mutex_lock(&tty_mutex);
1905 	driver = tty_lookup_driver(device, NULL, &index);
1906 	if (IS_ERR(driver)) {
1907 		mutex_unlock(&tty_mutex);
1908 		return ERR_CAST(driver);
1909 	}
1910 
1911 	/* check whether we're reopening an existing tty */
1912 	tty = tty_driver_lookup_tty(driver, NULL, index);
1913 	if (IS_ERR(tty))
1914 		goto out;
1915 
1916 	if (tty) {
1917 		/* drop kref from tty_driver_lookup_tty() */
1918 		tty_kref_put(tty);
1919 		tty = ERR_PTR(-EBUSY);
1920 	} else { /* tty_init_dev returns tty with the tty_lock held */
1921 		tty = tty_init_dev(driver, index);
1922 		if (IS_ERR(tty))
1923 			goto out;
1924 		tty_port_set_kopened(tty->port, 1);
1925 	}
1926 out:
1927 	mutex_unlock(&tty_mutex);
1928 	tty_driver_kref_put(driver);
1929 	return tty;
1930 }
1931 EXPORT_SYMBOL_GPL(tty_kopen);
1932 
1933 /**
1934  *	tty_open_by_driver	-	open a tty device
1935  *	@device: dev_t of device to open
1936  *	@filp: file pointer to tty
1937  *
1938  *	Performs the driver lookup, checks for a reopen, or otherwise
1939  *	performs the first-time tty initialization.
1940  *
1941  *	Returns the locked initialized or re-opened &tty_struct
1942  *
1943  *	Claims the global tty_mutex to serialize:
1944  *	  - concurrent first-time tty initialization
1945  *	  - concurrent tty driver removal w/ lookup
1946  *	  - concurrent tty removal from driver table
1947  */
1948 static struct tty_struct *tty_open_by_driver(dev_t device,
1949 					     struct file *filp)
1950 {
1951 	struct tty_struct *tty;
1952 	struct tty_driver *driver = NULL;
1953 	int index = -1;
1954 	int retval;
1955 
1956 	mutex_lock(&tty_mutex);
1957 	driver = tty_lookup_driver(device, filp, &index);
1958 	if (IS_ERR(driver)) {
1959 		mutex_unlock(&tty_mutex);
1960 		return ERR_CAST(driver);
1961 	}
1962 
1963 	/* check whether we're reopening an existing tty */
1964 	tty = tty_driver_lookup_tty(driver, filp, index);
1965 	if (IS_ERR(tty)) {
1966 		mutex_unlock(&tty_mutex);
1967 		goto out;
1968 	}
1969 
1970 	if (tty) {
1971 		if (tty_port_kopened(tty->port)) {
1972 			tty_kref_put(tty);
1973 			mutex_unlock(&tty_mutex);
1974 			tty = ERR_PTR(-EBUSY);
1975 			goto out;
1976 		}
1977 		mutex_unlock(&tty_mutex);
1978 		retval = tty_lock_interruptible(tty);
1979 		tty_kref_put(tty);  /* drop kref from tty_driver_lookup_tty() */
1980 		if (retval) {
1981 			if (retval == -EINTR)
1982 				retval = -ERESTARTSYS;
1983 			tty = ERR_PTR(retval);
1984 			goto out;
1985 		}
1986 		retval = tty_reopen(tty);
1987 		if (retval < 0) {
1988 			tty_unlock(tty);
1989 			tty = ERR_PTR(retval);
1990 		}
1991 	} else { /* Returns with the tty_lock held for now */
1992 		tty = tty_init_dev(driver, index);
1993 		mutex_unlock(&tty_mutex);
1994 	}
1995 out:
1996 	tty_driver_kref_put(driver);
1997 	return tty;
1998 }
1999 
2000 /**
2001  *	tty_open		-	open a tty device
2002  *	@inode: inode of device file
2003  *	@filp: file pointer to tty
2004  *
2005  *	tty_open and tty_release keep up the tty count that contains the
2006  *	number of opens done on a tty. We cannot use the inode-count, as
2007  *	different inodes might point to the same tty.
2008  *
2009  *	Open-counting is needed for pty masters, as well as for keeping
2010  *	track of serial lines: DTR is dropped when the last close happens.
2011  *	(This is not done solely through tty->count, now.  - Ted 1/27/92)
2012  *
2013  *	The termios state of a pty is reset on first open so that
2014  *	settings don't persist across reuse.
2015  *
2016  *	Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2017  *		 tty->count should protect the rest.
2018  *		 ->siglock protects ->signal/->sighand
2019  *
2020  *	Note: the tty_unlock/lock cases without a ref are only safe due to
2021  *	tty_mutex
2022  */
2023 
2024 static int tty_open(struct inode *inode, struct file *filp)
2025 {
2026 	struct tty_struct *tty;
2027 	int noctty, retval;
2028 	dev_t device = inode->i_rdev;
2029 	unsigned saved_flags = filp->f_flags;
2030 
2031 	nonseekable_open(inode, filp);
2032 
2033 retry_open:
2034 	retval = tty_alloc_file(filp);
2035 	if (retval)
2036 		return -ENOMEM;
2037 
2038 	tty = tty_open_current_tty(device, filp);
2039 	if (!tty)
2040 		tty = tty_open_by_driver(device, filp);
2041 
2042 	if (IS_ERR(tty)) {
2043 		tty_free_file(filp);
2044 		retval = PTR_ERR(tty);
2045 		if (retval != -EAGAIN || signal_pending(current))
2046 			return retval;
2047 		schedule();
2048 		goto retry_open;
2049 	}
2050 
2051 	tty_add_file(tty, filp);
2052 
2053 	check_tty_count(tty, __func__);
2054 	tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2055 
2056 	if (tty->ops->open)
2057 		retval = tty->ops->open(tty, filp);
2058 	else
2059 		retval = -ENODEV;
2060 	filp->f_flags = saved_flags;
2061 
2062 	if (retval) {
2063 		tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2064 
2065 		tty_unlock(tty); /* need to call tty_release without BTM */
2066 		tty_release(inode, filp);
2067 		if (retval != -ERESTARTSYS)
2068 			return retval;
2069 
2070 		if (signal_pending(current))
2071 			return retval;
2072 
2073 		schedule();
2074 		/*
2075 		 * Need to reset f_op in case a hangup happened.
2076 		 */
2077 		if (tty_hung_up_p(filp))
2078 			filp->f_op = &tty_fops;
2079 		goto retry_open;
2080 	}
2081 	clear_bit(TTY_HUPPED, &tty->flags);
2082 
2083 	noctty = (filp->f_flags & O_NOCTTY) ||
2084 		 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2085 		 device == MKDEV(TTYAUX_MAJOR, 1) ||
2086 		 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2087 		  tty->driver->subtype == PTY_TYPE_MASTER);
2088 	if (!noctty)
2089 		tty_open_proc_set_tty(filp, tty);
2090 	tty_unlock(tty);
2091 	return 0;
2092 }
2093 
2094 
2095 
2096 /**
2097  *	tty_poll	-	check tty status
2098  *	@filp: file being polled
2099  *	@wait: poll wait structures to update
2100  *
2101  *	Call the line discipline polling method to obtain the poll
2102  *	status of the device.
2103  *
2104  *	Locking: locks called line discipline but ldisc poll method
2105  *	may be re-entered freely by other callers.
2106  */
2107 
2108 static __poll_t tty_poll(struct file *filp, poll_table *wait)
2109 {
2110 	struct tty_struct *tty = file_tty(filp);
2111 	struct tty_ldisc *ld;
2112 	__poll_t ret = 0;
2113 
2114 	if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2115 		return 0;
2116 
2117 	ld = tty_ldisc_ref_wait(tty);
2118 	if (!ld)
2119 		return hung_up_tty_poll(filp, wait);
2120 	if (ld->ops->poll)
2121 		ret = ld->ops->poll(tty, filp, wait);
2122 	tty_ldisc_deref(ld);
2123 	return ret;
2124 }
2125 
2126 static int __tty_fasync(int fd, struct file *filp, int on)
2127 {
2128 	struct tty_struct *tty = file_tty(filp);
2129 	unsigned long flags;
2130 	int retval = 0;
2131 
2132 	if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2133 		goto out;
2134 
2135 	retval = fasync_helper(fd, filp, on, &tty->fasync);
2136 	if (retval <= 0)
2137 		goto out;
2138 
2139 	if (on) {
2140 		enum pid_type type;
2141 		struct pid *pid;
2142 
2143 		spin_lock_irqsave(&tty->ctrl_lock, flags);
2144 		if (tty->pgrp) {
2145 			pid = tty->pgrp;
2146 			type = PIDTYPE_PGID;
2147 		} else {
2148 			pid = task_pid(current);
2149 			type = PIDTYPE_TGID;
2150 		}
2151 		get_pid(pid);
2152 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2153 		__f_setown(filp, pid, type, 0);
2154 		put_pid(pid);
2155 		retval = 0;
2156 	}
2157 out:
2158 	return retval;
2159 }
2160 
2161 static int tty_fasync(int fd, struct file *filp, int on)
2162 {
2163 	struct tty_struct *tty = file_tty(filp);
2164 	int retval = -ENOTTY;
2165 
2166 	tty_lock(tty);
2167 	if (!tty_hung_up_p(filp))
2168 		retval = __tty_fasync(fd, filp, on);
2169 	tty_unlock(tty);
2170 
2171 	return retval;
2172 }
2173 
2174 /**
2175  *	tiocsti			-	fake input character
2176  *	@tty: tty to fake input into
2177  *	@p: pointer to character
2178  *
2179  *	Fake input to a tty device. Does the necessary locking and
2180  *	input management.
2181  *
2182  *	FIXME: does not honour flow control ??
2183  *
2184  *	Locking:
2185  *		Called functions take tty_ldiscs_lock
2186  *		current->signal->tty check is safe without locks
2187  *
2188  *	FIXME: may race normal receive processing
2189  */
2190 
2191 static int tiocsti(struct tty_struct *tty, char __user *p)
2192 {
2193 	char ch, mbz = 0;
2194 	struct tty_ldisc *ld;
2195 
2196 	if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2197 		return -EPERM;
2198 	if (get_user(ch, p))
2199 		return -EFAULT;
2200 	tty_audit_tiocsti(tty, ch);
2201 	ld = tty_ldisc_ref_wait(tty);
2202 	if (!ld)
2203 		return -EIO;
2204 	if (ld->ops->receive_buf)
2205 		ld->ops->receive_buf(tty, &ch, &mbz, 1);
2206 	tty_ldisc_deref(ld);
2207 	return 0;
2208 }
2209 
2210 /**
2211  *	tiocgwinsz		-	implement window query ioctl
2212  *	@tty: tty
2213  *	@arg: user buffer for result
2214  *
2215  *	Copies the kernel idea of the window size into the user buffer.
2216  *
2217  *	Locking: tty->winsize_mutex is taken to ensure the winsize data
2218  *		is consistent.
2219  */
2220 
2221 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2222 {
2223 	int err;
2224 
2225 	mutex_lock(&tty->winsize_mutex);
2226 	err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2227 	mutex_unlock(&tty->winsize_mutex);
2228 
2229 	return err ? -EFAULT: 0;
2230 }
2231 
2232 /**
2233  *	tty_do_resize		-	resize event
2234  *	@tty: tty being resized
2235  *	@ws: new dimensions
2236  *
2237  *	Update the termios variables and send the necessary signals to
2238  *	peform a terminal resize correctly
2239  */
2240 
2241 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2242 {
2243 	struct pid *pgrp;
2244 
2245 	/* Lock the tty */
2246 	mutex_lock(&tty->winsize_mutex);
2247 	if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2248 		goto done;
2249 
2250 	/* Signal the foreground process group */
2251 	pgrp = tty_get_pgrp(tty);
2252 	if (pgrp)
2253 		kill_pgrp(pgrp, SIGWINCH, 1);
2254 	put_pid(pgrp);
2255 
2256 	tty->winsize = *ws;
2257 done:
2258 	mutex_unlock(&tty->winsize_mutex);
2259 	return 0;
2260 }
2261 EXPORT_SYMBOL(tty_do_resize);
2262 
2263 /**
2264  *	tiocswinsz		-	implement window size set ioctl
2265  *	@tty: tty side of tty
2266  *	@arg: user buffer for result
2267  *
2268  *	Copies the user idea of the window size to the kernel. Traditionally
2269  *	this is just advisory information but for the Linux console it
2270  *	actually has driver level meaning and triggers a VC resize.
2271  *
2272  *	Locking:
2273  *		Driver dependent. The default do_resize method takes the
2274  *	tty termios mutex and ctrl_lock. The console takes its own lock
2275  *	then calls into the default method.
2276  */
2277 
2278 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2279 {
2280 	struct winsize tmp_ws;
2281 	if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2282 		return -EFAULT;
2283 
2284 	if (tty->ops->resize)
2285 		return tty->ops->resize(tty, &tmp_ws);
2286 	else
2287 		return tty_do_resize(tty, &tmp_ws);
2288 }
2289 
2290 /**
2291  *	tioccons	-	allow admin to move logical console
2292  *	@file: the file to become console
2293  *
2294  *	Allow the administrator to move the redirected console device
2295  *
2296  *	Locking: uses redirect_lock to guard the redirect information
2297  */
2298 
2299 static int tioccons(struct file *file)
2300 {
2301 	if (!capable(CAP_SYS_ADMIN))
2302 		return -EPERM;
2303 	if (file->f_op->write_iter == redirected_tty_write) {
2304 		struct file *f;
2305 		spin_lock(&redirect_lock);
2306 		f = redirect;
2307 		redirect = NULL;
2308 		spin_unlock(&redirect_lock);
2309 		if (f)
2310 			fput(f);
2311 		return 0;
2312 	}
2313 	spin_lock(&redirect_lock);
2314 	if (redirect) {
2315 		spin_unlock(&redirect_lock);
2316 		return -EBUSY;
2317 	}
2318 	redirect = get_file(file);
2319 	spin_unlock(&redirect_lock);
2320 	return 0;
2321 }
2322 
2323 /**
2324  *	tiocsetd	-	set line discipline
2325  *	@tty: tty device
2326  *	@p: pointer to user data
2327  *
2328  *	Set the line discipline according to user request.
2329  *
2330  *	Locking: see tty_set_ldisc, this function is just a helper
2331  */
2332 
2333 static int tiocsetd(struct tty_struct *tty, int __user *p)
2334 {
2335 	int disc;
2336 	int ret;
2337 
2338 	if (get_user(disc, p))
2339 		return -EFAULT;
2340 
2341 	ret = tty_set_ldisc(tty, disc);
2342 
2343 	return ret;
2344 }
2345 
2346 /**
2347  *	tiocgetd	-	get line discipline
2348  *	@tty: tty device
2349  *	@p: pointer to user data
2350  *
2351  *	Retrieves the line discipline id directly from the ldisc.
2352  *
2353  *	Locking: waits for ldisc reference (in case the line discipline
2354  *		is changing or the tty is being hungup)
2355  */
2356 
2357 static int tiocgetd(struct tty_struct *tty, int __user *p)
2358 {
2359 	struct tty_ldisc *ld;
2360 	int ret;
2361 
2362 	ld = tty_ldisc_ref_wait(tty);
2363 	if (!ld)
2364 		return -EIO;
2365 	ret = put_user(ld->ops->num, p);
2366 	tty_ldisc_deref(ld);
2367 	return ret;
2368 }
2369 
2370 /**
2371  *	send_break	-	performed time break
2372  *	@tty: device to break on
2373  *	@duration: timeout in mS
2374  *
2375  *	Perform a timed break on hardware that lacks its own driver level
2376  *	timed break functionality.
2377  *
2378  *	Locking:
2379  *		atomic_write_lock serializes
2380  *
2381  */
2382 
2383 static int send_break(struct tty_struct *tty, unsigned int duration)
2384 {
2385 	int retval;
2386 
2387 	if (tty->ops->break_ctl == NULL)
2388 		return 0;
2389 
2390 	if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2391 		retval = tty->ops->break_ctl(tty, duration);
2392 	else {
2393 		/* Do the work ourselves */
2394 		if (tty_write_lock(tty, 0) < 0)
2395 			return -EINTR;
2396 		retval = tty->ops->break_ctl(tty, -1);
2397 		if (retval)
2398 			goto out;
2399 		if (!signal_pending(current))
2400 			msleep_interruptible(duration);
2401 		retval = tty->ops->break_ctl(tty, 0);
2402 out:
2403 		tty_write_unlock(tty);
2404 		if (signal_pending(current))
2405 			retval = -EINTR;
2406 	}
2407 	return retval;
2408 }
2409 
2410 /**
2411  *	tty_tiocmget		-	get modem status
2412  *	@tty: tty device
2413  *	@p: pointer to result
2414  *
2415  *	Obtain the modem status bits from the tty driver if the feature
2416  *	is supported. Return -EINVAL if it is not available.
2417  *
2418  *	Locking: none (up to the driver)
2419  */
2420 
2421 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2422 {
2423 	int retval = -EINVAL;
2424 
2425 	if (tty->ops->tiocmget) {
2426 		retval = tty->ops->tiocmget(tty);
2427 
2428 		if (retval >= 0)
2429 			retval = put_user(retval, p);
2430 	}
2431 	return retval;
2432 }
2433 
2434 /**
2435  *	tty_tiocmset		-	set modem status
2436  *	@tty: tty device
2437  *	@cmd: command - clear bits, set bits or set all
2438  *	@p: pointer to desired bits
2439  *
2440  *	Set the modem status bits from the tty driver if the feature
2441  *	is supported. Return -EINVAL if it is not available.
2442  *
2443  *	Locking: none (up to the driver)
2444  */
2445 
2446 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2447 	     unsigned __user *p)
2448 {
2449 	int retval;
2450 	unsigned int set, clear, val;
2451 
2452 	if (tty->ops->tiocmset == NULL)
2453 		return -EINVAL;
2454 
2455 	retval = get_user(val, p);
2456 	if (retval)
2457 		return retval;
2458 	set = clear = 0;
2459 	switch (cmd) {
2460 	case TIOCMBIS:
2461 		set = val;
2462 		break;
2463 	case TIOCMBIC:
2464 		clear = val;
2465 		break;
2466 	case TIOCMSET:
2467 		set = val;
2468 		clear = ~val;
2469 		break;
2470 	}
2471 	set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2472 	clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2473 	return tty->ops->tiocmset(tty, set, clear);
2474 }
2475 
2476 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2477 {
2478 	int retval = -EINVAL;
2479 	struct serial_icounter_struct icount;
2480 	memset(&icount, 0, sizeof(icount));
2481 	if (tty->ops->get_icount)
2482 		retval = tty->ops->get_icount(tty, &icount);
2483 	if (retval != 0)
2484 		return retval;
2485 	if (copy_to_user(arg, &icount, sizeof(icount)))
2486 		return -EFAULT;
2487 	return 0;
2488 }
2489 
2490 static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
2491 {
2492 	static DEFINE_RATELIMIT_STATE(depr_flags,
2493 			DEFAULT_RATELIMIT_INTERVAL,
2494 			DEFAULT_RATELIMIT_BURST);
2495 	char comm[TASK_COMM_LEN];
2496 	struct serial_struct v;
2497 	int flags;
2498 
2499 	if (copy_from_user(&v, ss, sizeof(*ss)))
2500 		return -EFAULT;
2501 
2502 	flags = v.flags & ASYNC_DEPRECATED;
2503 
2504 	if (flags && __ratelimit(&depr_flags))
2505 		pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2506 			__func__, get_task_comm(comm, current), flags);
2507 	if (!tty->ops->set_serial)
2508 		return -ENOTTY;
2509 	return tty->ops->set_serial(tty, &v);
2510 }
2511 
2512 static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2513 {
2514 	struct serial_struct v;
2515 	int err;
2516 
2517 	memset(&v, 0, sizeof(v));
2518 	if (!tty->ops->get_serial)
2519 		return -ENOTTY;
2520 	err = tty->ops->get_serial(tty, &v);
2521 	if (!err && copy_to_user(ss, &v, sizeof(v)))
2522 		err = -EFAULT;
2523 	return err;
2524 }
2525 
2526 /*
2527  * if pty, return the slave side (real_tty)
2528  * otherwise, return self
2529  */
2530 static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2531 {
2532 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2533 	    tty->driver->subtype == PTY_TYPE_MASTER)
2534 		tty = tty->link;
2535 	return tty;
2536 }
2537 
2538 /*
2539  * Split this up, as gcc can choke on it otherwise..
2540  */
2541 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2542 {
2543 	struct tty_struct *tty = file_tty(file);
2544 	struct tty_struct *real_tty;
2545 	void __user *p = (void __user *)arg;
2546 	int retval;
2547 	struct tty_ldisc *ld;
2548 
2549 	if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2550 		return -EINVAL;
2551 
2552 	real_tty = tty_pair_get_tty(tty);
2553 
2554 	/*
2555 	 * Factor out some common prep work
2556 	 */
2557 	switch (cmd) {
2558 	case TIOCSETD:
2559 	case TIOCSBRK:
2560 	case TIOCCBRK:
2561 	case TCSBRK:
2562 	case TCSBRKP:
2563 		retval = tty_check_change(tty);
2564 		if (retval)
2565 			return retval;
2566 		if (cmd != TIOCCBRK) {
2567 			tty_wait_until_sent(tty, 0);
2568 			if (signal_pending(current))
2569 				return -EINTR;
2570 		}
2571 		break;
2572 	}
2573 
2574 	/*
2575 	 *	Now do the stuff.
2576 	 */
2577 	switch (cmd) {
2578 	case TIOCSTI:
2579 		return tiocsti(tty, p);
2580 	case TIOCGWINSZ:
2581 		return tiocgwinsz(real_tty, p);
2582 	case TIOCSWINSZ:
2583 		return tiocswinsz(real_tty, p);
2584 	case TIOCCONS:
2585 		return real_tty != tty ? -EINVAL : tioccons(file);
2586 	case TIOCEXCL:
2587 		set_bit(TTY_EXCLUSIVE, &tty->flags);
2588 		return 0;
2589 	case TIOCNXCL:
2590 		clear_bit(TTY_EXCLUSIVE, &tty->flags);
2591 		return 0;
2592 	case TIOCGEXCL:
2593 	{
2594 		int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2595 		return put_user(excl, (int __user *)p);
2596 	}
2597 	case TIOCGETD:
2598 		return tiocgetd(tty, p);
2599 	case TIOCSETD:
2600 		return tiocsetd(tty, p);
2601 	case TIOCVHANGUP:
2602 		if (!capable(CAP_SYS_ADMIN))
2603 			return -EPERM;
2604 		tty_vhangup(tty);
2605 		return 0;
2606 	case TIOCGDEV:
2607 	{
2608 		unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2609 		return put_user(ret, (unsigned int __user *)p);
2610 	}
2611 	/*
2612 	 * Break handling
2613 	 */
2614 	case TIOCSBRK:	/* Turn break on, unconditionally */
2615 		if (tty->ops->break_ctl)
2616 			return tty->ops->break_ctl(tty, -1);
2617 		return 0;
2618 	case TIOCCBRK:	/* Turn break off, unconditionally */
2619 		if (tty->ops->break_ctl)
2620 			return tty->ops->break_ctl(tty, 0);
2621 		return 0;
2622 	case TCSBRK:   /* SVID version: non-zero arg --> no break */
2623 		/* non-zero arg means wait for all output data
2624 		 * to be sent (performed above) but don't send break.
2625 		 * This is used by the tcdrain() termios function.
2626 		 */
2627 		if (!arg)
2628 			return send_break(tty, 250);
2629 		return 0;
2630 	case TCSBRKP:	/* support for POSIX tcsendbreak() */
2631 		return send_break(tty, arg ? arg*100 : 250);
2632 
2633 	case TIOCMGET:
2634 		return tty_tiocmget(tty, p);
2635 	case TIOCMSET:
2636 	case TIOCMBIC:
2637 	case TIOCMBIS:
2638 		return tty_tiocmset(tty, cmd, p);
2639 	case TIOCGICOUNT:
2640 		return tty_tiocgicount(tty, p);
2641 	case TCFLSH:
2642 		switch (arg) {
2643 		case TCIFLUSH:
2644 		case TCIOFLUSH:
2645 		/* flush tty buffer and allow ldisc to process ioctl */
2646 			tty_buffer_flush(tty, NULL);
2647 			break;
2648 		}
2649 		break;
2650 	case TIOCSSERIAL:
2651 		return tty_tiocsserial(tty, p);
2652 	case TIOCGSERIAL:
2653 		return tty_tiocgserial(tty, p);
2654 	case TIOCGPTPEER:
2655 		/* Special because the struct file is needed */
2656 		return ptm_open_peer(file, tty, (int)arg);
2657 	default:
2658 		retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2659 		if (retval != -ENOIOCTLCMD)
2660 			return retval;
2661 	}
2662 	if (tty->ops->ioctl) {
2663 		retval = tty->ops->ioctl(tty, cmd, arg);
2664 		if (retval != -ENOIOCTLCMD)
2665 			return retval;
2666 	}
2667 	ld = tty_ldisc_ref_wait(tty);
2668 	if (!ld)
2669 		return hung_up_tty_ioctl(file, cmd, arg);
2670 	retval = -EINVAL;
2671 	if (ld->ops->ioctl) {
2672 		retval = ld->ops->ioctl(tty, file, cmd, arg);
2673 		if (retval == -ENOIOCTLCMD)
2674 			retval = -ENOTTY;
2675 	}
2676 	tty_ldisc_deref(ld);
2677 	return retval;
2678 }
2679 
2680 #ifdef CONFIG_COMPAT
2681 
2682 struct serial_struct32 {
2683 	compat_int_t    type;
2684 	compat_int_t    line;
2685 	compat_uint_t   port;
2686 	compat_int_t    irq;
2687 	compat_int_t    flags;
2688 	compat_int_t    xmit_fifo_size;
2689 	compat_int_t    custom_divisor;
2690 	compat_int_t    baud_base;
2691 	unsigned short  close_delay;
2692 	char    io_type;
2693 	char    reserved_char;
2694 	compat_int_t    hub6;
2695 	unsigned short  closing_wait; /* time to wait before closing */
2696 	unsigned short  closing_wait2; /* no longer used... */
2697 	compat_uint_t   iomem_base;
2698 	unsigned short  iomem_reg_shift;
2699 	unsigned int    port_high;
2700 	/* compat_ulong_t  iomap_base FIXME */
2701 	compat_int_t    reserved;
2702 };
2703 
2704 static int compat_tty_tiocsserial(struct tty_struct *tty,
2705 		struct serial_struct32 __user *ss)
2706 {
2707 	static DEFINE_RATELIMIT_STATE(depr_flags,
2708 			DEFAULT_RATELIMIT_INTERVAL,
2709 			DEFAULT_RATELIMIT_BURST);
2710 	char comm[TASK_COMM_LEN];
2711 	struct serial_struct32 v32;
2712 	struct serial_struct v;
2713 	int flags;
2714 
2715 	if (copy_from_user(&v32, ss, sizeof(*ss)))
2716 		return -EFAULT;
2717 
2718 	memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2719 	v.iomem_base = compat_ptr(v32.iomem_base);
2720 	v.iomem_reg_shift = v32.iomem_reg_shift;
2721 	v.port_high = v32.port_high;
2722 	v.iomap_base = 0;
2723 
2724 	flags = v.flags & ASYNC_DEPRECATED;
2725 
2726 	if (flags && __ratelimit(&depr_flags))
2727 		pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2728 			__func__, get_task_comm(comm, current), flags);
2729 	if (!tty->ops->set_serial)
2730 		return -ENOTTY;
2731 	return tty->ops->set_serial(tty, &v);
2732 }
2733 
2734 static int compat_tty_tiocgserial(struct tty_struct *tty,
2735 			struct serial_struct32 __user *ss)
2736 {
2737 	struct serial_struct32 v32;
2738 	struct serial_struct v;
2739 	int err;
2740 
2741 	memset(&v, 0, sizeof(v));
2742 	memset(&v32, 0, sizeof(v32));
2743 
2744 	if (!tty->ops->get_serial)
2745 		return -ENOTTY;
2746 	err = tty->ops->get_serial(tty, &v);
2747 	if (!err) {
2748 		memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2749 		v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2750 			0xfffffff : ptr_to_compat(v.iomem_base);
2751 		v32.iomem_reg_shift = v.iomem_reg_shift;
2752 		v32.port_high = v.port_high;
2753 		if (copy_to_user(ss, &v32, sizeof(v32)))
2754 			err = -EFAULT;
2755 	}
2756 	return err;
2757 }
2758 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2759 				unsigned long arg)
2760 {
2761 	struct tty_struct *tty = file_tty(file);
2762 	struct tty_ldisc *ld;
2763 	int retval = -ENOIOCTLCMD;
2764 
2765 	switch (cmd) {
2766 	case TIOCOUTQ:
2767 	case TIOCSTI:
2768 	case TIOCGWINSZ:
2769 	case TIOCSWINSZ:
2770 	case TIOCGEXCL:
2771 	case TIOCGETD:
2772 	case TIOCSETD:
2773 	case TIOCGDEV:
2774 	case TIOCMGET:
2775 	case TIOCMSET:
2776 	case TIOCMBIC:
2777 	case TIOCMBIS:
2778 	case TIOCGICOUNT:
2779 	case TIOCGPGRP:
2780 	case TIOCSPGRP:
2781 	case TIOCGSID:
2782 	case TIOCSERGETLSR:
2783 	case TIOCGRS485:
2784 	case TIOCSRS485:
2785 #ifdef TIOCGETP
2786 	case TIOCGETP:
2787 	case TIOCSETP:
2788 	case TIOCSETN:
2789 #endif
2790 #ifdef TIOCGETC
2791 	case TIOCGETC:
2792 	case TIOCSETC:
2793 #endif
2794 #ifdef TIOCGLTC
2795 	case TIOCGLTC:
2796 	case TIOCSLTC:
2797 #endif
2798 	case TCSETSF:
2799 	case TCSETSW:
2800 	case TCSETS:
2801 	case TCGETS:
2802 #ifdef TCGETS2
2803 	case TCGETS2:
2804 	case TCSETSF2:
2805 	case TCSETSW2:
2806 	case TCSETS2:
2807 #endif
2808 	case TCGETA:
2809 	case TCSETAF:
2810 	case TCSETAW:
2811 	case TCSETA:
2812 	case TIOCGLCKTRMIOS:
2813 	case TIOCSLCKTRMIOS:
2814 #ifdef TCGETX
2815 	case TCGETX:
2816 	case TCSETX:
2817 	case TCSETXW:
2818 	case TCSETXF:
2819 #endif
2820 	case TIOCGSOFTCAR:
2821 	case TIOCSSOFTCAR:
2822 
2823 	case PPPIOCGCHAN:
2824 	case PPPIOCGUNIT:
2825 		return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
2826 	case TIOCCONS:
2827 	case TIOCEXCL:
2828 	case TIOCNXCL:
2829 	case TIOCVHANGUP:
2830 	case TIOCSBRK:
2831 	case TIOCCBRK:
2832 	case TCSBRK:
2833 	case TCSBRKP:
2834 	case TCFLSH:
2835 	case TIOCGPTPEER:
2836 	case TIOCNOTTY:
2837 	case TIOCSCTTY:
2838 	case TCXONC:
2839 	case TIOCMIWAIT:
2840 	case TIOCSERCONFIG:
2841 		return tty_ioctl(file, cmd, arg);
2842 	}
2843 
2844 	if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2845 		return -EINVAL;
2846 
2847 	switch (cmd) {
2848 	case TIOCSSERIAL:
2849 		return compat_tty_tiocsserial(tty, compat_ptr(arg));
2850 	case TIOCGSERIAL:
2851 		return compat_tty_tiocgserial(tty, compat_ptr(arg));
2852 	}
2853 	if (tty->ops->compat_ioctl) {
2854 		retval = tty->ops->compat_ioctl(tty, cmd, arg);
2855 		if (retval != -ENOIOCTLCMD)
2856 			return retval;
2857 	}
2858 
2859 	ld = tty_ldisc_ref_wait(tty);
2860 	if (!ld)
2861 		return hung_up_tty_compat_ioctl(file, cmd, arg);
2862 	if (ld->ops->compat_ioctl)
2863 		retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2864 	if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2865 		retval = ld->ops->ioctl(tty, file,
2866 				(unsigned long)compat_ptr(cmd), arg);
2867 	tty_ldisc_deref(ld);
2868 
2869 	return retval;
2870 }
2871 #endif
2872 
2873 static int this_tty(const void *t, struct file *file, unsigned fd)
2874 {
2875 	if (likely(file->f_op->read != tty_read))
2876 		return 0;
2877 	return file_tty(file) != t ? 0 : fd + 1;
2878 }
2879 
2880 /*
2881  * This implements the "Secure Attention Key" ---  the idea is to
2882  * prevent trojan horses by killing all processes associated with this
2883  * tty when the user hits the "Secure Attention Key".  Required for
2884  * super-paranoid applications --- see the Orange Book for more details.
2885  *
2886  * This code could be nicer; ideally it should send a HUP, wait a few
2887  * seconds, then send a INT, and then a KILL signal.  But you then
2888  * have to coordinate with the init process, since all processes associated
2889  * with the current tty must be dead before the new getty is allowed
2890  * to spawn.
2891  *
2892  * Now, if it would be correct ;-/ The current code has a nasty hole -
2893  * it doesn't catch files in flight. We may send the descriptor to ourselves
2894  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2895  *
2896  * Nasty bug: do_SAK is being called in interrupt context.  This can
2897  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2898  */
2899 void __do_SAK(struct tty_struct *tty)
2900 {
2901 #ifdef TTY_SOFT_SAK
2902 	tty_hangup(tty);
2903 #else
2904 	struct task_struct *g, *p;
2905 	struct pid *session;
2906 	int		i;
2907 	unsigned long flags;
2908 
2909 	if (!tty)
2910 		return;
2911 
2912 	spin_lock_irqsave(&tty->ctrl_lock, flags);
2913 	session = get_pid(tty->session);
2914 	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2915 
2916 	tty_ldisc_flush(tty);
2917 
2918 	tty_driver_flush_buffer(tty);
2919 
2920 	read_lock(&tasklist_lock);
2921 	/* Kill the entire session */
2922 	do_each_pid_task(session, PIDTYPE_SID, p) {
2923 		tty_notice(tty, "SAK: killed process %d (%s): by session\n",
2924 			   task_pid_nr(p), p->comm);
2925 		group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2926 	} while_each_pid_task(session, PIDTYPE_SID, p);
2927 
2928 	/* Now kill any processes that happen to have the tty open */
2929 	do_each_thread(g, p) {
2930 		if (p->signal->tty == tty) {
2931 			tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
2932 				   task_pid_nr(p), p->comm);
2933 			group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2934 			continue;
2935 		}
2936 		task_lock(p);
2937 		i = iterate_fd(p->files, 0, this_tty, tty);
2938 		if (i != 0) {
2939 			tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
2940 				   task_pid_nr(p), p->comm, i - 1);
2941 			group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
2942 		}
2943 		task_unlock(p);
2944 	} while_each_thread(g, p);
2945 	read_unlock(&tasklist_lock);
2946 	put_pid(session);
2947 #endif
2948 }
2949 
2950 static void do_SAK_work(struct work_struct *work)
2951 {
2952 	struct tty_struct *tty =
2953 		container_of(work, struct tty_struct, SAK_work);
2954 	__do_SAK(tty);
2955 }
2956 
2957 /*
2958  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2959  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2960  * the values which we write to it will be identical to the values which it
2961  * already has. --akpm
2962  */
2963 void do_SAK(struct tty_struct *tty)
2964 {
2965 	if (!tty)
2966 		return;
2967 	schedule_work(&tty->SAK_work);
2968 }
2969 
2970 EXPORT_SYMBOL(do_SAK);
2971 
2972 /* Must put_device() after it's unused! */
2973 static struct device *tty_get_device(struct tty_struct *tty)
2974 {
2975 	dev_t devt = tty_devnum(tty);
2976 	return class_find_device_by_devt(tty_class, devt);
2977 }
2978 
2979 
2980 /*
2981  *	alloc_tty_struct
2982  *
2983  *	This subroutine allocates and initializes a tty structure.
2984  *
2985  *	Locking: none - tty in question is not exposed at this point
2986  */
2987 
2988 struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
2989 {
2990 	struct tty_struct *tty;
2991 
2992 	tty = kzalloc(sizeof(*tty), GFP_KERNEL);
2993 	if (!tty)
2994 		return NULL;
2995 
2996 	kref_init(&tty->kref);
2997 	tty->magic = TTY_MAGIC;
2998 	if (tty_ldisc_init(tty)) {
2999 		kfree(tty);
3000 		return NULL;
3001 	}
3002 	tty->session = NULL;
3003 	tty->pgrp = NULL;
3004 	mutex_init(&tty->legacy_mutex);
3005 	mutex_init(&tty->throttle_mutex);
3006 	init_rwsem(&tty->termios_rwsem);
3007 	mutex_init(&tty->winsize_mutex);
3008 	init_ldsem(&tty->ldisc_sem);
3009 	init_waitqueue_head(&tty->write_wait);
3010 	init_waitqueue_head(&tty->read_wait);
3011 	INIT_WORK(&tty->hangup_work, do_tty_hangup);
3012 	mutex_init(&tty->atomic_write_lock);
3013 	spin_lock_init(&tty->ctrl_lock);
3014 	spin_lock_init(&tty->flow_lock);
3015 	spin_lock_init(&tty->files_lock);
3016 	INIT_LIST_HEAD(&tty->tty_files);
3017 	INIT_WORK(&tty->SAK_work, do_SAK_work);
3018 
3019 	tty->driver = driver;
3020 	tty->ops = driver->ops;
3021 	tty->index = idx;
3022 	tty_line_name(driver, idx, tty->name);
3023 	tty->dev = tty_get_device(tty);
3024 
3025 	return tty;
3026 }
3027 
3028 /**
3029  *	tty_put_char	-	write one character to a tty
3030  *	@tty: tty
3031  *	@ch: character
3032  *
3033  *	Write one byte to the tty using the provided put_char method
3034  *	if present. Returns the number of characters successfully output.
3035  *
3036  *	Note: the specific put_char operation in the driver layer may go
3037  *	away soon. Don't call it directly, use this method
3038  */
3039 
3040 int tty_put_char(struct tty_struct *tty, unsigned char ch)
3041 {
3042 	if (tty->ops->put_char)
3043 		return tty->ops->put_char(tty, ch);
3044 	return tty->ops->write(tty, &ch, 1);
3045 }
3046 EXPORT_SYMBOL_GPL(tty_put_char);
3047 
3048 struct class *tty_class;
3049 
3050 static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3051 		unsigned int index, unsigned int count)
3052 {
3053 	int err;
3054 
3055 	/* init here, since reused cdevs cause crashes */
3056 	driver->cdevs[index] = cdev_alloc();
3057 	if (!driver->cdevs[index])
3058 		return -ENOMEM;
3059 	driver->cdevs[index]->ops = &tty_fops;
3060 	driver->cdevs[index]->owner = driver->owner;
3061 	err = cdev_add(driver->cdevs[index], dev, count);
3062 	if (err)
3063 		kobject_put(&driver->cdevs[index]->kobj);
3064 	return err;
3065 }
3066 
3067 /**
3068  *	tty_register_device - register a tty device
3069  *	@driver: the tty driver that describes the tty device
3070  *	@index: the index in the tty driver for this tty device
3071  *	@device: a struct device that is associated with this tty device.
3072  *		This field is optional, if there is no known struct device
3073  *		for this tty device it can be set to NULL safely.
3074  *
3075  *	Returns a pointer to the struct device for this tty device
3076  *	(or ERR_PTR(-EFOO) on error).
3077  *
3078  *	This call is required to be made to register an individual tty device
3079  *	if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3080  *	that bit is not set, this function should not be called by a tty
3081  *	driver.
3082  *
3083  *	Locking: ??
3084  */
3085 
3086 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3087 				   struct device *device)
3088 {
3089 	return tty_register_device_attr(driver, index, device, NULL, NULL);
3090 }
3091 EXPORT_SYMBOL(tty_register_device);
3092 
3093 static void tty_device_create_release(struct device *dev)
3094 {
3095 	dev_dbg(dev, "releasing...\n");
3096 	kfree(dev);
3097 }
3098 
3099 /**
3100  *	tty_register_device_attr - register a tty device
3101  *	@driver: the tty driver that describes the tty device
3102  *	@index: the index in the tty driver for this tty device
3103  *	@device: a struct device that is associated with this tty device.
3104  *		This field is optional, if there is no known struct device
3105  *		for this tty device it can be set to NULL safely.
3106  *	@drvdata: Driver data to be set to device.
3107  *	@attr_grp: Attribute group to be set on device.
3108  *
3109  *	Returns a pointer to the struct device for this tty device
3110  *	(or ERR_PTR(-EFOO) on error).
3111  *
3112  *	This call is required to be made to register an individual tty device
3113  *	if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3114  *	that bit is not set, this function should not be called by a tty
3115  *	driver.
3116  *
3117  *	Locking: ??
3118  */
3119 struct device *tty_register_device_attr(struct tty_driver *driver,
3120 				   unsigned index, struct device *device,
3121 				   void *drvdata,
3122 				   const struct attribute_group **attr_grp)
3123 {
3124 	char name[64];
3125 	dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3126 	struct ktermios *tp;
3127 	struct device *dev;
3128 	int retval;
3129 
3130 	if (index >= driver->num) {
3131 		pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3132 		       driver->name, index);
3133 		return ERR_PTR(-EINVAL);
3134 	}
3135 
3136 	if (driver->type == TTY_DRIVER_TYPE_PTY)
3137 		pty_line_name(driver, index, name);
3138 	else
3139 		tty_line_name(driver, index, name);
3140 
3141 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3142 	if (!dev)
3143 		return ERR_PTR(-ENOMEM);
3144 
3145 	dev->devt = devt;
3146 	dev->class = tty_class;
3147 	dev->parent = device;
3148 	dev->release = tty_device_create_release;
3149 	dev_set_name(dev, "%s", name);
3150 	dev->groups = attr_grp;
3151 	dev_set_drvdata(dev, drvdata);
3152 
3153 	dev_set_uevent_suppress(dev, 1);
3154 
3155 	retval = device_register(dev);
3156 	if (retval)
3157 		goto err_put;
3158 
3159 	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3160 		/*
3161 		 * Free any saved termios data so that the termios state is
3162 		 * reset when reusing a minor number.
3163 		 */
3164 		tp = driver->termios[index];
3165 		if (tp) {
3166 			driver->termios[index] = NULL;
3167 			kfree(tp);
3168 		}
3169 
3170 		retval = tty_cdev_add(driver, devt, index, 1);
3171 		if (retval)
3172 			goto err_del;
3173 	}
3174 
3175 	dev_set_uevent_suppress(dev, 0);
3176 	kobject_uevent(&dev->kobj, KOBJ_ADD);
3177 
3178 	return dev;
3179 
3180 err_del:
3181 	device_del(dev);
3182 err_put:
3183 	put_device(dev);
3184 
3185 	return ERR_PTR(retval);
3186 }
3187 EXPORT_SYMBOL_GPL(tty_register_device_attr);
3188 
3189 /**
3190  * 	tty_unregister_device - unregister a tty device
3191  * 	@driver: the tty driver that describes the tty device
3192  * 	@index: the index in the tty driver for this tty device
3193  *
3194  * 	If a tty device is registered with a call to tty_register_device() then
3195  *	this function must be called when the tty device is gone.
3196  *
3197  *	Locking: ??
3198  */
3199 
3200 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3201 {
3202 	device_destroy(tty_class,
3203 		MKDEV(driver->major, driver->minor_start) + index);
3204 	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3205 		cdev_del(driver->cdevs[index]);
3206 		driver->cdevs[index] = NULL;
3207 	}
3208 }
3209 EXPORT_SYMBOL(tty_unregister_device);
3210 
3211 /**
3212  * __tty_alloc_driver -- allocate tty driver
3213  * @lines: count of lines this driver can handle at most
3214  * @owner: module which is responsible for this driver
3215  * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3216  *
3217  * This should not be called directly, some of the provided macros should be
3218  * used instead. Use IS_ERR and friends on @retval.
3219  */
3220 struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3221 		unsigned long flags)
3222 {
3223 	struct tty_driver *driver;
3224 	unsigned int cdevs = 1;
3225 	int err;
3226 
3227 	if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3228 		return ERR_PTR(-EINVAL);
3229 
3230 	driver = kzalloc(sizeof(*driver), GFP_KERNEL);
3231 	if (!driver)
3232 		return ERR_PTR(-ENOMEM);
3233 
3234 	kref_init(&driver->kref);
3235 	driver->magic = TTY_DRIVER_MAGIC;
3236 	driver->num = lines;
3237 	driver->owner = owner;
3238 	driver->flags = flags;
3239 
3240 	if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3241 		driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3242 				GFP_KERNEL);
3243 		driver->termios = kcalloc(lines, sizeof(*driver->termios),
3244 				GFP_KERNEL);
3245 		if (!driver->ttys || !driver->termios) {
3246 			err = -ENOMEM;
3247 			goto err_free_all;
3248 		}
3249 	}
3250 
3251 	if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3252 		driver->ports = kcalloc(lines, sizeof(*driver->ports),
3253 				GFP_KERNEL);
3254 		if (!driver->ports) {
3255 			err = -ENOMEM;
3256 			goto err_free_all;
3257 		}
3258 		cdevs = lines;
3259 	}
3260 
3261 	driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3262 	if (!driver->cdevs) {
3263 		err = -ENOMEM;
3264 		goto err_free_all;
3265 	}
3266 
3267 	return driver;
3268 err_free_all:
3269 	kfree(driver->ports);
3270 	kfree(driver->ttys);
3271 	kfree(driver->termios);
3272 	kfree(driver->cdevs);
3273 	kfree(driver);
3274 	return ERR_PTR(err);
3275 }
3276 EXPORT_SYMBOL(__tty_alloc_driver);
3277 
3278 static void destruct_tty_driver(struct kref *kref)
3279 {
3280 	struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3281 	int i;
3282 	struct ktermios *tp;
3283 
3284 	if (driver->flags & TTY_DRIVER_INSTALLED) {
3285 		for (i = 0; i < driver->num; i++) {
3286 			tp = driver->termios[i];
3287 			if (tp) {
3288 				driver->termios[i] = NULL;
3289 				kfree(tp);
3290 			}
3291 			if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3292 				tty_unregister_device(driver, i);
3293 		}
3294 		proc_tty_unregister_driver(driver);
3295 		if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3296 			cdev_del(driver->cdevs[0]);
3297 	}
3298 	kfree(driver->cdevs);
3299 	kfree(driver->ports);
3300 	kfree(driver->termios);
3301 	kfree(driver->ttys);
3302 	kfree(driver);
3303 }
3304 
3305 void tty_driver_kref_put(struct tty_driver *driver)
3306 {
3307 	kref_put(&driver->kref, destruct_tty_driver);
3308 }
3309 EXPORT_SYMBOL(tty_driver_kref_put);
3310 
3311 void tty_set_operations(struct tty_driver *driver,
3312 			const struct tty_operations *op)
3313 {
3314 	driver->ops = op;
3315 };
3316 EXPORT_SYMBOL(tty_set_operations);
3317 
3318 void put_tty_driver(struct tty_driver *d)
3319 {
3320 	tty_driver_kref_put(d);
3321 }
3322 EXPORT_SYMBOL(put_tty_driver);
3323 
3324 /*
3325  * Called by a tty driver to register itself.
3326  */
3327 int tty_register_driver(struct tty_driver *driver)
3328 {
3329 	int error;
3330 	int i;
3331 	dev_t dev;
3332 	struct device *d;
3333 
3334 	if (!driver->major) {
3335 		error = alloc_chrdev_region(&dev, driver->minor_start,
3336 						driver->num, driver->name);
3337 		if (!error) {
3338 			driver->major = MAJOR(dev);
3339 			driver->minor_start = MINOR(dev);
3340 		}
3341 	} else {
3342 		dev = MKDEV(driver->major, driver->minor_start);
3343 		error = register_chrdev_region(dev, driver->num, driver->name);
3344 	}
3345 	if (error < 0)
3346 		goto err;
3347 
3348 	if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3349 		error = tty_cdev_add(driver, dev, 0, driver->num);
3350 		if (error)
3351 			goto err_unreg_char;
3352 	}
3353 
3354 	mutex_lock(&tty_mutex);
3355 	list_add(&driver->tty_drivers, &tty_drivers);
3356 	mutex_unlock(&tty_mutex);
3357 
3358 	if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3359 		for (i = 0; i < driver->num; i++) {
3360 			d = tty_register_device(driver, i, NULL);
3361 			if (IS_ERR(d)) {
3362 				error = PTR_ERR(d);
3363 				goto err_unreg_devs;
3364 			}
3365 		}
3366 	}
3367 	proc_tty_register_driver(driver);
3368 	driver->flags |= TTY_DRIVER_INSTALLED;
3369 	return 0;
3370 
3371 err_unreg_devs:
3372 	for (i--; i >= 0; i--)
3373 		tty_unregister_device(driver, i);
3374 
3375 	mutex_lock(&tty_mutex);
3376 	list_del(&driver->tty_drivers);
3377 	mutex_unlock(&tty_mutex);
3378 
3379 err_unreg_char:
3380 	unregister_chrdev_region(dev, driver->num);
3381 err:
3382 	return error;
3383 }
3384 EXPORT_SYMBOL(tty_register_driver);
3385 
3386 /*
3387  * Called by a tty driver to unregister itself.
3388  */
3389 int tty_unregister_driver(struct tty_driver *driver)
3390 {
3391 #if 0
3392 	/* FIXME */
3393 	if (driver->refcount)
3394 		return -EBUSY;
3395 #endif
3396 	unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3397 				driver->num);
3398 	mutex_lock(&tty_mutex);
3399 	list_del(&driver->tty_drivers);
3400 	mutex_unlock(&tty_mutex);
3401 	return 0;
3402 }
3403 
3404 EXPORT_SYMBOL(tty_unregister_driver);
3405 
3406 dev_t tty_devnum(struct tty_struct *tty)
3407 {
3408 	return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3409 }
3410 EXPORT_SYMBOL(tty_devnum);
3411 
3412 void tty_default_fops(struct file_operations *fops)
3413 {
3414 	*fops = tty_fops;
3415 }
3416 
3417 static char *tty_devnode(struct device *dev, umode_t *mode)
3418 {
3419 	if (!mode)
3420 		return NULL;
3421 	if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3422 	    dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3423 		*mode = 0666;
3424 	return NULL;
3425 }
3426 
3427 static int __init tty_class_init(void)
3428 {
3429 	tty_class = class_create(THIS_MODULE, "tty");
3430 	if (IS_ERR(tty_class))
3431 		return PTR_ERR(tty_class);
3432 	tty_class->devnode = tty_devnode;
3433 	return 0;
3434 }
3435 
3436 postcore_initcall(tty_class_init);
3437 
3438 /* 3/2004 jmc: why do these devices exist? */
3439 static struct cdev tty_cdev, console_cdev;
3440 
3441 static ssize_t show_cons_active(struct device *dev,
3442 				struct device_attribute *attr, char *buf)
3443 {
3444 	struct console *cs[16];
3445 	int i = 0;
3446 	struct console *c;
3447 	ssize_t count = 0;
3448 
3449 	console_lock();
3450 	for_each_console(c) {
3451 		if (!c->device)
3452 			continue;
3453 		if (!c->write)
3454 			continue;
3455 		if ((c->flags & CON_ENABLED) == 0)
3456 			continue;
3457 		cs[i++] = c;
3458 		if (i >= ARRAY_SIZE(cs))
3459 			break;
3460 	}
3461 	while (i--) {
3462 		int index = cs[i]->index;
3463 		struct tty_driver *drv = cs[i]->device(cs[i], &index);
3464 
3465 		/* don't resolve tty0 as some programs depend on it */
3466 		if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3467 			count += tty_line_name(drv, index, buf + count);
3468 		else
3469 			count += sprintf(buf + count, "%s%d",
3470 					 cs[i]->name, cs[i]->index);
3471 
3472 		count += sprintf(buf + count, "%c", i ? ' ':'\n');
3473 	}
3474 	console_unlock();
3475 
3476 	return count;
3477 }
3478 static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3479 
3480 static struct attribute *cons_dev_attrs[] = {
3481 	&dev_attr_active.attr,
3482 	NULL
3483 };
3484 
3485 ATTRIBUTE_GROUPS(cons_dev);
3486 
3487 static struct device *consdev;
3488 
3489 void console_sysfs_notify(void)
3490 {
3491 	if (consdev)
3492 		sysfs_notify(&consdev->kobj, NULL, "active");
3493 }
3494 
3495 /*
3496  * Ok, now we can initialize the rest of the tty devices and can count
3497  * on memory allocations, interrupts etc..
3498  */
3499 int __init tty_init(void)
3500 {
3501 	tty_sysctl_init();
3502 	cdev_init(&tty_cdev, &tty_fops);
3503 	if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3504 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3505 		panic("Couldn't register /dev/tty driver\n");
3506 	device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3507 
3508 	cdev_init(&console_cdev, &console_fops);
3509 	if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3510 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3511 		panic("Couldn't register /dev/console driver\n");
3512 	consdev = device_create_with_groups(tty_class, NULL,
3513 					    MKDEV(TTYAUX_MAJOR, 1), NULL,
3514 					    cons_dev_groups, "console");
3515 	if (IS_ERR(consdev))
3516 		consdev = NULL;
3517 
3518 #ifdef CONFIG_VT
3519 	vty_init(&console_fops);
3520 #endif
3521 	return 0;
3522 }
3523 
3524