1 #include <linux/types.h>
2 #include <linux/errno.h>
3 #include <linux/kmod.h>
4 #include <linux/sched.h>
5 #include <linux/interrupt.h>
6 #include <linux/tty.h>
7 #include <linux/tty_driver.h>
8 #include <linux/file.h>
9 #include <linux/mm.h>
10 #include <linux/string.h>
11 #include <linux/slab.h>
12 #include <linux/poll.h>
13 #include <linux/proc_fs.h>
14 #include <linux/init.h>
15 #include <linux/module.h>
16 #include <linux/device.h>
17 #include <linux/wait.h>
18 #include <linux/bitops.h>
19 #include <linux/seq_file.h>
20 #include <linux/uaccess.h>
21 #include <linux/ratelimit.h>
22 
23 /*
24  *	This guards the refcounted line discipline lists. The lock
25  *	must be taken with irqs off because there are hangup path
26  *	callers who will do ldisc lookups and cannot sleep.
27  */
28 
29 static DEFINE_SPINLOCK(tty_ldisc_lock);
30 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
31 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_idle);
32 /* Line disc dispatch table */
33 static struct tty_ldisc_ops *tty_ldiscs[NR_LDISCS];
34 
get_ldisc(struct tty_ldisc * ld)35 static inline struct tty_ldisc *get_ldisc(struct tty_ldisc *ld)
36 {
37 	if (ld)
38 		atomic_inc(&ld->users);
39 	return ld;
40 }
41 
put_ldisc(struct tty_ldisc * ld)42 static void put_ldisc(struct tty_ldisc *ld)
43 {
44 	unsigned long flags;
45 
46 	if (WARN_ON_ONCE(!ld))
47 		return;
48 
49 	/*
50 	 * If this is the last user, free the ldisc, and
51 	 * release the ldisc ops.
52 	 *
53 	 * We really want an "atomic_dec_and_lock_irqsave()",
54 	 * but we don't have it, so this does it by hand.
55 	 */
56 	local_irq_save(flags);
57 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
58 		struct tty_ldisc_ops *ldo = ld->ops;
59 
60 		ldo->refcount--;
61 		module_put(ldo->owner);
62 		spin_unlock_irqrestore(&tty_ldisc_lock, flags);
63 
64 		kfree(ld);
65 		return;
66 	}
67 	local_irq_restore(flags);
68 	wake_up(&tty_ldisc_idle);
69 }
70 
71 /**
72  *	tty_register_ldisc	-	install a line discipline
73  *	@disc: ldisc number
74  *	@new_ldisc: pointer to the ldisc object
75  *
76  *	Installs a new line discipline into the kernel. The discipline
77  *	is set up as unreferenced and then made available to the kernel
78  *	from this point onwards.
79  *
80  *	Locking:
81  *		takes tty_ldisc_lock to guard against ldisc races
82  */
83 
tty_register_ldisc(int disc,struct tty_ldisc_ops * new_ldisc)84 int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
85 {
86 	unsigned long flags;
87 	int ret = 0;
88 
89 	if (disc < N_TTY || disc >= NR_LDISCS)
90 		return -EINVAL;
91 
92 	spin_lock_irqsave(&tty_ldisc_lock, flags);
93 	tty_ldiscs[disc] = new_ldisc;
94 	new_ldisc->num = disc;
95 	new_ldisc->refcount = 0;
96 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
97 
98 	return ret;
99 }
100 EXPORT_SYMBOL(tty_register_ldisc);
101 
102 /**
103  *	tty_unregister_ldisc	-	unload a line discipline
104  *	@disc: ldisc number
105  *	@new_ldisc: pointer to the ldisc object
106  *
107  *	Remove a line discipline from the kernel providing it is not
108  *	currently in use.
109  *
110  *	Locking:
111  *		takes tty_ldisc_lock to guard against ldisc races
112  */
113 
tty_unregister_ldisc(int disc)114 int tty_unregister_ldisc(int disc)
115 {
116 	unsigned long flags;
117 	int ret = 0;
118 
119 	if (disc < N_TTY || disc >= NR_LDISCS)
120 		return -EINVAL;
121 
122 	spin_lock_irqsave(&tty_ldisc_lock, flags);
123 	if (tty_ldiscs[disc]->refcount)
124 		ret = -EBUSY;
125 	else
126 		tty_ldiscs[disc] = NULL;
127 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
128 
129 	return ret;
130 }
131 EXPORT_SYMBOL(tty_unregister_ldisc);
132 
get_ldops(int disc)133 static struct tty_ldisc_ops *get_ldops(int disc)
134 {
135 	unsigned long flags;
136 	struct tty_ldisc_ops *ldops, *ret;
137 
138 	spin_lock_irqsave(&tty_ldisc_lock, flags);
139 	ret = ERR_PTR(-EINVAL);
140 	ldops = tty_ldiscs[disc];
141 	if (ldops) {
142 		ret = ERR_PTR(-EAGAIN);
143 		if (try_module_get(ldops->owner)) {
144 			ldops->refcount++;
145 			ret = ldops;
146 		}
147 	}
148 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
149 	return ret;
150 }
151 
put_ldops(struct tty_ldisc_ops * ldops)152 static void put_ldops(struct tty_ldisc_ops *ldops)
153 {
154 	unsigned long flags;
155 
156 	spin_lock_irqsave(&tty_ldisc_lock, flags);
157 	ldops->refcount--;
158 	module_put(ldops->owner);
159 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
160 }
161 
162 /**
163  *	tty_ldisc_get		-	take a reference to an ldisc
164  *	@disc: ldisc number
165  *
166  *	Takes a reference to a line discipline. Deals with refcounts and
167  *	module locking counts. Returns NULL if the discipline is not available.
168  *	Returns a pointer to the discipline and bumps the ref count if it is
169  *	available
170  *
171  *	Locking:
172  *		takes tty_ldisc_lock to guard against ldisc races
173  */
174 
tty_ldisc_get(int disc)175 static struct tty_ldisc *tty_ldisc_get(int disc)
176 {
177 	struct tty_ldisc *ld;
178 	struct tty_ldisc_ops *ldops;
179 
180 	if (disc < N_TTY || disc >= NR_LDISCS)
181 		return ERR_PTR(-EINVAL);
182 
183 	/*
184 	 * Get the ldisc ops - we may need to request them to be loaded
185 	 * dynamically and try again.
186 	 */
187 	ldops = get_ldops(disc);
188 	if (IS_ERR(ldops)) {
189 		request_module("tty-ldisc-%d", disc);
190 		ldops = get_ldops(disc);
191 		if (IS_ERR(ldops))
192 			return ERR_CAST(ldops);
193 	}
194 
195 	ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL);
196 	if (ld == NULL) {
197 		put_ldops(ldops);
198 		return ERR_PTR(-ENOMEM);
199 	}
200 
201 	ld->ops = ldops;
202 	atomic_set(&ld->users, 1);
203 	return ld;
204 }
205 
tty_ldiscs_seq_start(struct seq_file * m,loff_t * pos)206 static void *tty_ldiscs_seq_start(struct seq_file *m, loff_t *pos)
207 {
208 	return (*pos < NR_LDISCS) ? pos : NULL;
209 }
210 
tty_ldiscs_seq_next(struct seq_file * m,void * v,loff_t * pos)211 static void *tty_ldiscs_seq_next(struct seq_file *m, void *v, loff_t *pos)
212 {
213 	(*pos)++;
214 	return (*pos < NR_LDISCS) ? pos : NULL;
215 }
216 
tty_ldiscs_seq_stop(struct seq_file * m,void * v)217 static void tty_ldiscs_seq_stop(struct seq_file *m, void *v)
218 {
219 }
220 
tty_ldiscs_seq_show(struct seq_file * m,void * v)221 static int tty_ldiscs_seq_show(struct seq_file *m, void *v)
222 {
223 	int i = *(loff_t *)v;
224 	struct tty_ldisc_ops *ldops;
225 
226 	ldops = get_ldops(i);
227 	if (IS_ERR(ldops))
228 		return 0;
229 	seq_printf(m, "%-10s %2d\n", ldops->name ? ldops->name : "???", i);
230 	put_ldops(ldops);
231 	return 0;
232 }
233 
234 static const struct seq_operations tty_ldiscs_seq_ops = {
235 	.start	= tty_ldiscs_seq_start,
236 	.next	= tty_ldiscs_seq_next,
237 	.stop	= tty_ldiscs_seq_stop,
238 	.show	= tty_ldiscs_seq_show,
239 };
240 
proc_tty_ldiscs_open(struct inode * inode,struct file * file)241 static int proc_tty_ldiscs_open(struct inode *inode, struct file *file)
242 {
243 	return seq_open(file, &tty_ldiscs_seq_ops);
244 }
245 
246 const struct file_operations tty_ldiscs_proc_fops = {
247 	.owner		= THIS_MODULE,
248 	.open		= proc_tty_ldiscs_open,
249 	.read		= seq_read,
250 	.llseek		= seq_lseek,
251 	.release	= seq_release,
252 };
253 
254 /**
255  *	tty_ldisc_assign	-	set ldisc on a tty
256  *	@tty: tty to assign
257  *	@ld: line discipline
258  *
259  *	Install an instance of a line discipline into a tty structure. The
260  *	ldisc must have a reference count above zero to ensure it remains.
261  *	The tty instance refcount starts at zero.
262  *
263  *	Locking:
264  *		Caller must hold references
265  */
266 
tty_ldisc_assign(struct tty_struct * tty,struct tty_ldisc * ld)267 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
268 {
269 	tty->ldisc = ld;
270 }
271 
272 /**
273  *	tty_ldisc_try		-	internal helper
274  *	@tty: the tty
275  *
276  *	Make a single attempt to grab and bump the refcount on
277  *	the tty ldisc. Return 0 on failure or 1 on success. This is
278  *	used to implement both the waiting and non waiting versions
279  *	of tty_ldisc_ref
280  *
281  *	Locking: takes tty_ldisc_lock
282  */
283 
tty_ldisc_try(struct tty_struct * tty)284 static struct tty_ldisc *tty_ldisc_try(struct tty_struct *tty)
285 {
286 	unsigned long flags;
287 	struct tty_ldisc *ld;
288 
289 	spin_lock_irqsave(&tty_ldisc_lock, flags);
290 	ld = NULL;
291 	if (test_bit(TTY_LDISC, &tty->flags))
292 		ld = get_ldisc(tty->ldisc);
293 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
294 	return ld;
295 }
296 
297 /**
298  *	tty_ldisc_ref_wait	-	wait for the tty ldisc
299  *	@tty: tty device
300  *
301  *	Dereference the line discipline for the terminal and take a
302  *	reference to it. If the line discipline is in flux then
303  *	wait patiently until it changes.
304  *
305  *	Note: Must not be called from an IRQ/timer context. The caller
306  *	must also be careful not to hold other locks that will deadlock
307  *	against a discipline change, such as an existing ldisc reference
308  *	(which we check for)
309  *
310  *	Locking: call functions take tty_ldisc_lock
311  */
312 
tty_ldisc_ref_wait(struct tty_struct * tty)313 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
314 {
315 	struct tty_ldisc *ld;
316 
317 	/* wait_event is a macro */
318 	wait_event(tty_ldisc_wait, (ld = tty_ldisc_try(tty)) != NULL);
319 	return ld;
320 }
321 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
322 
323 /**
324  *	tty_ldisc_ref		-	get the tty ldisc
325  *	@tty: tty device
326  *
327  *	Dereference the line discipline for the terminal and take a
328  *	reference to it. If the line discipline is in flux then
329  *	return NULL. Can be called from IRQ and timer functions.
330  *
331  *	Locking: called functions take tty_ldisc_lock
332  */
333 
tty_ldisc_ref(struct tty_struct * tty)334 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
335 {
336 	return tty_ldisc_try(tty);
337 }
338 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
339 
340 /**
341  *	tty_ldisc_deref		-	free a tty ldisc reference
342  *	@ld: reference to free up
343  *
344  *	Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
345  *	be called in IRQ context.
346  *
347  *	Locking: takes tty_ldisc_lock
348  */
349 
tty_ldisc_deref(struct tty_ldisc * ld)350 void tty_ldisc_deref(struct tty_ldisc *ld)
351 {
352 	put_ldisc(ld);
353 }
354 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
355 
tty_ldisc_put(struct tty_ldisc * ld)356 static inline void tty_ldisc_put(struct tty_ldisc *ld)
357 {
358 	put_ldisc(ld);
359 }
360 
361 /**
362  *	tty_ldisc_enable	-	allow ldisc use
363  *	@tty: terminal to activate ldisc on
364  *
365  *	Set the TTY_LDISC flag when the line discipline can be called
366  *	again. Do necessary wakeups for existing sleepers. Clear the LDISC
367  *	changing flag to indicate any ldisc change is now over.
368  *
369  *	Note: nobody should set the TTY_LDISC bit except via this function.
370  *	Clearing directly is allowed.
371  */
372 
tty_ldisc_enable(struct tty_struct * tty)373 void tty_ldisc_enable(struct tty_struct *tty)
374 {
375 	set_bit(TTY_LDISC, &tty->flags);
376 	clear_bit(TTY_LDISC_CHANGING, &tty->flags);
377 	wake_up(&tty_ldisc_wait);
378 }
379 
380 /**
381  *	tty_ldisc_flush	-	flush line discipline queue
382  *	@tty: tty
383  *
384  *	Flush the line discipline queue (if any) for this tty. If there
385  *	is no line discipline active this is a no-op.
386  */
387 
tty_ldisc_flush(struct tty_struct * tty)388 void tty_ldisc_flush(struct tty_struct *tty)
389 {
390 	struct tty_ldisc *ld = tty_ldisc_ref(tty);
391 	if (ld) {
392 		if (ld->ops->flush_buffer)
393 			ld->ops->flush_buffer(tty);
394 		tty_ldisc_deref(ld);
395 	}
396 	tty_buffer_flush(tty);
397 }
398 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
399 
400 /**
401  *	tty_set_termios_ldisc		-	set ldisc field
402  *	@tty: tty structure
403  *	@num: line discipline number
404  *
405  *	This is probably overkill for real world processors but
406  *	they are not on hot paths so a little discipline won't do
407  *	any harm.
408  *
409  *	Locking: takes termios_mutex
410  */
411 
tty_set_termios_ldisc(struct tty_struct * tty,int num)412 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
413 {
414 	mutex_lock(&tty->termios_mutex);
415 	tty->termios->c_line = num;
416 	mutex_unlock(&tty->termios_mutex);
417 }
418 
419 /**
420  *	tty_ldisc_open		-	open a line discipline
421  *	@tty: tty we are opening the ldisc on
422  *	@ld: discipline to open
423  *
424  *	A helper opening method. Also a convenient debugging and check
425  *	point.
426  *
427  *	Locking: always called with BTM already held.
428  */
429 
tty_ldisc_open(struct tty_struct * tty,struct tty_ldisc * ld)430 static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
431 {
432 	WARN_ON(test_and_set_bit(TTY_LDISC_OPEN, &tty->flags));
433 	if (ld->ops->open) {
434 		int ret;
435                 /* BTM here locks versus a hangup event */
436 		ret = ld->ops->open(tty);
437 		if (ret)
438 			clear_bit(TTY_LDISC_OPEN, &tty->flags);
439 		return ret;
440 	}
441 	return 0;
442 }
443 
444 /**
445  *	tty_ldisc_close		-	close a line discipline
446  *	@tty: tty we are opening the ldisc on
447  *	@ld: discipline to close
448  *
449  *	A helper close method. Also a convenient debugging and check
450  *	point.
451  */
452 
tty_ldisc_close(struct tty_struct * tty,struct tty_ldisc * ld)453 static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
454 {
455 	WARN_ON(!test_bit(TTY_LDISC_OPEN, &tty->flags));
456 	clear_bit(TTY_LDISC_OPEN, &tty->flags);
457 	if (ld->ops->close)
458 		ld->ops->close(tty);
459 }
460 
461 /**
462  *	tty_ldisc_restore	-	helper for tty ldisc change
463  *	@tty: tty to recover
464  *	@old: previous ldisc
465  *
466  *	Restore the previous line discipline or N_TTY when a line discipline
467  *	change fails due to an open error
468  */
469 
tty_ldisc_restore(struct tty_struct * tty,struct tty_ldisc * old)470 static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
471 {
472 	char buf[64];
473 	struct tty_ldisc *new_ldisc;
474 	int r;
475 
476 	/* There is an outstanding reference here so this is safe */
477 	old = tty_ldisc_get(old->ops->num);
478 	WARN_ON(IS_ERR(old));
479 	tty_ldisc_assign(tty, old);
480 	tty_set_termios_ldisc(tty, old->ops->num);
481 	if (tty_ldisc_open(tty, old) < 0) {
482 		tty_ldisc_put(old);
483 		/* This driver is always present */
484 		new_ldisc = tty_ldisc_get(N_TTY);
485 		if (IS_ERR(new_ldisc))
486 			panic("n_tty: get");
487 		tty_ldisc_assign(tty, new_ldisc);
488 		tty_set_termios_ldisc(tty, N_TTY);
489 		r = tty_ldisc_open(tty, new_ldisc);
490 		if (r < 0)
491 			panic("Couldn't open N_TTY ldisc for "
492 			      "%s --- error %d.",
493 			      tty_name(tty, buf), r);
494 	}
495 }
496 
497 /**
498  *	tty_ldisc_halt		-	shut down the line discipline
499  *	@tty: tty device
500  *
501  *	Shut down the line discipline and work queue for this tty device.
502  *	The TTY_LDISC flag being cleared ensures no further references can
503  *	be obtained while the delayed work queue halt ensures that no more
504  *	data is fed to the ldisc.
505  *
506  *	You need to do a 'flush_scheduled_work()' (outside the ldisc_mutex)
507  *	in order to make sure any currently executing ldisc work is also
508  *	flushed.
509  */
510 
tty_ldisc_halt(struct tty_struct * tty)511 static int tty_ldisc_halt(struct tty_struct *tty)
512 {
513 	clear_bit(TTY_LDISC, &tty->flags);
514 	return cancel_work_sync(&tty->buf.work);
515 }
516 
517 /**
518  *	tty_ldisc_flush_works	-	flush all works of a tty
519  *	@tty: tty device to flush works for
520  *
521  *	Sync flush all works belonging to @tty.
522  */
tty_ldisc_flush_works(struct tty_struct * tty)523 static void tty_ldisc_flush_works(struct tty_struct *tty)
524 {
525 	flush_work_sync(&tty->hangup_work);
526 	flush_work_sync(&tty->SAK_work);
527 	flush_work_sync(&tty->buf.work);
528 }
529 
530 /**
531  *	tty_ldisc_wait_idle	-	wait for the ldisc to become idle
532  *	@tty: tty to wait for
533  *	@timeout: for how long to wait at most
534  *
535  *	Wait for the line discipline to become idle. The discipline must
536  *	have been halted for this to guarantee it remains idle.
537  */
tty_ldisc_wait_idle(struct tty_struct * tty,long timeout)538 static int tty_ldisc_wait_idle(struct tty_struct *tty, long timeout)
539 {
540 	long ret;
541 	ret = wait_event_timeout(tty_ldisc_idle,
542 			atomic_read(&tty->ldisc->users) == 1, timeout);
543 	return ret > 0 ? 0 : -EBUSY;
544 }
545 
546 /**
547  *	tty_set_ldisc		-	set line discipline
548  *	@tty: the terminal to set
549  *	@ldisc: the line discipline
550  *
551  *	Set the discipline of a tty line. Must be called from a process
552  *	context. The ldisc change logic has to protect itself against any
553  *	overlapping ldisc change (including on the other end of pty pairs),
554  *	the close of one side of a tty/pty pair, and eventually hangup.
555  *
556  *	Locking: takes tty_ldisc_lock, termios_mutex
557  */
558 
tty_set_ldisc(struct tty_struct * tty,int ldisc)559 int tty_set_ldisc(struct tty_struct *tty, int ldisc)
560 {
561 	int retval;
562 	struct tty_ldisc *o_ldisc, *new_ldisc;
563 	int work, o_work = 0;
564 	struct tty_struct *o_tty;
565 
566 	new_ldisc = tty_ldisc_get(ldisc);
567 	if (IS_ERR(new_ldisc))
568 		return PTR_ERR(new_ldisc);
569 
570 	tty_lock();
571 	/*
572 	 *	We need to look at the tty locking here for pty/tty pairs
573 	 *	when both sides try to change in parallel.
574 	 */
575 
576 	o_tty = tty->link;	/* o_tty is the pty side or NULL */
577 
578 
579 	/*
580 	 *	Check the no-op case
581 	 */
582 
583 	if (tty->ldisc->ops->num == ldisc) {
584 		tty_unlock();
585 		tty_ldisc_put(new_ldisc);
586 		return 0;
587 	}
588 
589 	tty_unlock();
590 	/*
591 	 *	Problem: What do we do if this blocks ?
592 	 *	We could deadlock here
593 	 */
594 
595 	tty_wait_until_sent(tty, 0);
596 
597 	tty_lock();
598 	mutex_lock(&tty->ldisc_mutex);
599 
600 	/*
601 	 *	We could be midstream of another ldisc change which has
602 	 *	dropped the lock during processing. If so we need to wait.
603 	 */
604 
605 	while (test_bit(TTY_LDISC_CHANGING, &tty->flags)) {
606 		mutex_unlock(&tty->ldisc_mutex);
607 		tty_unlock();
608 		wait_event(tty_ldisc_wait,
609 			test_bit(TTY_LDISC_CHANGING, &tty->flags) == 0);
610 		tty_lock();
611 		mutex_lock(&tty->ldisc_mutex);
612 	}
613 
614 	set_bit(TTY_LDISC_CHANGING, &tty->flags);
615 
616 	/*
617 	 *	No more input please, we are switching. The new ldisc
618 	 *	will update this value in the ldisc open function
619 	 */
620 
621 	tty->receive_room = 0;
622 
623 	o_ldisc = tty->ldisc;
624 
625 	tty_unlock();
626 	/*
627 	 *	Make sure we don't change while someone holds a
628 	 *	reference to the line discipline. The TTY_LDISC bit
629 	 *	prevents anyone taking a reference once it is clear.
630 	 *	We need the lock to avoid racing reference takers.
631 	 *
632 	 *	We must clear the TTY_LDISC bit here to avoid a livelock
633 	 *	with a userspace app continually trying to use the tty in
634 	 *	parallel to the change and re-referencing the tty.
635 	 */
636 
637 	work = tty_ldisc_halt(tty);
638 	if (o_tty)
639 		o_work = tty_ldisc_halt(o_tty);
640 
641 	/*
642 	 * Wait for ->hangup_work and ->buf.work handlers to terminate.
643 	 * We must drop the mutex here in case a hangup is also in process.
644 	 */
645 
646 	mutex_unlock(&tty->ldisc_mutex);
647 
648 	tty_ldisc_flush_works(tty);
649 
650 	retval = tty_ldisc_wait_idle(tty, 5 * HZ);
651 
652 	tty_lock();
653 	mutex_lock(&tty->ldisc_mutex);
654 
655 	/* handle wait idle failure locked */
656 	if (retval) {
657 		tty_ldisc_put(new_ldisc);
658 		goto enable;
659 	}
660 
661 	if (test_bit(TTY_HUPPED, &tty->flags)) {
662 		/* We were raced by the hangup method. It will have stomped
663 		   the ldisc data and closed the ldisc down */
664 		clear_bit(TTY_LDISC_CHANGING, &tty->flags);
665 		mutex_unlock(&tty->ldisc_mutex);
666 		tty_ldisc_put(new_ldisc);
667 		tty_unlock();
668 		return -EIO;
669 	}
670 
671 	/* Shutdown the current discipline. */
672 	tty_ldisc_close(tty, o_ldisc);
673 
674 	/* Now set up the new line discipline. */
675 	tty_ldisc_assign(tty, new_ldisc);
676 	tty_set_termios_ldisc(tty, ldisc);
677 
678 	retval = tty_ldisc_open(tty, new_ldisc);
679 	if (retval < 0) {
680 		/* Back to the old one or N_TTY if we can't */
681 		tty_ldisc_put(new_ldisc);
682 		tty_ldisc_restore(tty, o_ldisc);
683 	}
684 
685 	/* At this point we hold a reference to the new ldisc and a
686 	   a reference to the old ldisc. If we ended up flipping back
687 	   to the existing ldisc we have two references to it */
688 
689 	if (tty->ldisc->ops->num != o_ldisc->ops->num && tty->ops->set_ldisc)
690 		tty->ops->set_ldisc(tty);
691 
692 	tty_ldisc_put(o_ldisc);
693 
694 enable:
695 	/*
696 	 *	Allow ldisc referencing to occur again
697 	 */
698 
699 	tty_ldisc_enable(tty);
700 	if (o_tty)
701 		tty_ldisc_enable(o_tty);
702 
703 	/* Restart the work queue in case no characters kick it off. Safe if
704 	   already running */
705 	if (work)
706 		schedule_work(&tty->buf.work);
707 	if (o_work)
708 		schedule_work(&o_tty->buf.work);
709 	mutex_unlock(&tty->ldisc_mutex);
710 	tty_unlock();
711 	return retval;
712 }
713 
714 /**
715  *	tty_reset_termios	-	reset terminal state
716  *	@tty: tty to reset
717  *
718  *	Restore a terminal to the driver default state.
719  */
720 
tty_reset_termios(struct tty_struct * tty)721 static void tty_reset_termios(struct tty_struct *tty)
722 {
723 	mutex_lock(&tty->termios_mutex);
724 	*tty->termios = tty->driver->init_termios;
725 	tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
726 	tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
727 	mutex_unlock(&tty->termios_mutex);
728 }
729 
730 
731 /**
732  *	tty_ldisc_reinit	-	reinitialise the tty ldisc
733  *	@tty: tty to reinit
734  *	@ldisc: line discipline to reinitialize
735  *
736  *	Switch the tty to a line discipline and leave the ldisc
737  *	state closed
738  */
739 
tty_ldisc_reinit(struct tty_struct * tty,int ldisc)740 static int tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
741 {
742 	struct tty_ldisc *ld = tty_ldisc_get(ldisc);
743 
744 	if (IS_ERR(ld))
745 		return -1;
746 
747 	tty_ldisc_close(tty, tty->ldisc);
748 	tty_ldisc_put(tty->ldisc);
749 	tty->ldisc = NULL;
750 	/*
751 	 *	Switch the line discipline back
752 	 */
753 	tty_ldisc_assign(tty, ld);
754 	tty_set_termios_ldisc(tty, ldisc);
755 
756 	return 0;
757 }
758 
759 /**
760  *	tty_ldisc_hangup		-	hangup ldisc reset
761  *	@tty: tty being hung up
762  *
763  *	Some tty devices reset their termios when they receive a hangup
764  *	event. In that situation we must also switch back to N_TTY properly
765  *	before we reset the termios data.
766  *
767  *	Locking: We can take the ldisc mutex as the rest of the code is
768  *	careful to allow for this.
769  *
770  *	In the pty pair case this occurs in the close() path of the
771  *	tty itself so we must be careful about locking rules.
772  */
773 
tty_ldisc_hangup(struct tty_struct * tty)774 void tty_ldisc_hangup(struct tty_struct *tty)
775 {
776 	struct tty_ldisc *ld;
777 	int reset = tty->driver->flags & TTY_DRIVER_RESET_TERMIOS;
778 	int err = 0;
779 
780 	/*
781 	 * FIXME! What are the locking issues here? This may me overdoing
782 	 * things... This question is especially important now that we've
783 	 * removed the irqlock.
784 	 */
785 	ld = tty_ldisc_ref(tty);
786 	if (ld != NULL) {
787 		/* We may have no line discipline at this point */
788 		if (ld->ops->flush_buffer)
789 			ld->ops->flush_buffer(tty);
790 		tty_driver_flush_buffer(tty);
791 		if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
792 		    ld->ops->write_wakeup)
793 			ld->ops->write_wakeup(tty);
794 		if (ld->ops->hangup)
795 			ld->ops->hangup(tty);
796 		tty_ldisc_deref(ld);
797 	}
798 	/*
799 	 * FIXME: Once we trust the LDISC code better we can wait here for
800 	 * ldisc completion and fix the driver call race
801 	 */
802 	wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
803 	wake_up_interruptible_poll(&tty->read_wait, POLLIN);
804 	/*
805 	 * Shutdown the current line discipline, and reset it to
806 	 * N_TTY if need be.
807 	 *
808 	 * Avoid racing set_ldisc or tty_ldisc_release
809 	 */
810 	mutex_lock(&tty->ldisc_mutex);
811 
812 	/*
813 	 * this is like tty_ldisc_halt, but we need to give up
814 	 * the BTM before calling cancel_work_sync, which may
815 	 * need to wait for another function taking the BTM
816 	 */
817 	clear_bit(TTY_LDISC, &tty->flags);
818 	tty_unlock();
819 	cancel_work_sync(&tty->buf.work);
820 	mutex_unlock(&tty->ldisc_mutex);
821 retry:
822 	tty_lock();
823 	mutex_lock(&tty->ldisc_mutex);
824 
825 	/* At this point we have a closed ldisc and we want to
826 	   reopen it. We could defer this to the next open but
827 	   it means auditing a lot of other paths so this is
828 	   a FIXME */
829 	if (tty->ldisc) {	/* Not yet closed */
830 		if (atomic_read(&tty->ldisc->users) != 1) {
831 			char cur_n[TASK_COMM_LEN], tty_n[64];
832 			long timeout = 3 * HZ;
833 			tty_unlock();
834 
835 			while (tty_ldisc_wait_idle(tty, timeout) == -EBUSY) {
836 				timeout = MAX_SCHEDULE_TIMEOUT;
837 				printk_ratelimited(KERN_WARNING
838 					"%s: waiting (%s) for %s took too long, but we keep waiting...\n",
839 					__func__, get_task_comm(cur_n, current),
840 					tty_name(tty, tty_n));
841 			}
842 			mutex_unlock(&tty->ldisc_mutex);
843 			goto retry;
844 		}
845 
846 		if (reset == 0) {
847 
848 			if (!tty_ldisc_reinit(tty, tty->termios->c_line))
849 				err = tty_ldisc_open(tty, tty->ldisc);
850 			else
851 				err = 1;
852 		}
853 		/* If the re-open fails or we reset then go to N_TTY. The
854 		   N_TTY open cannot fail */
855 		if (reset || err) {
856 			BUG_ON(tty_ldisc_reinit(tty, N_TTY));
857 			WARN_ON(tty_ldisc_open(tty, tty->ldisc));
858 		}
859 		tty_ldisc_enable(tty);
860 	}
861 	mutex_unlock(&tty->ldisc_mutex);
862 	if (reset)
863 		tty_reset_termios(tty);
864 }
865 
866 /**
867  *	tty_ldisc_setup			-	open line discipline
868  *	@tty: tty being shut down
869  *	@o_tty: pair tty for pty/tty pairs
870  *
871  *	Called during the initial open of a tty/pty pair in order to set up the
872  *	line disciplines and bind them to the tty. This has no locking issues
873  *	as the device isn't yet active.
874  */
875 
tty_ldisc_setup(struct tty_struct * tty,struct tty_struct * o_tty)876 int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty)
877 {
878 	struct tty_ldisc *ld = tty->ldisc;
879 	int retval;
880 
881 	retval = tty_ldisc_open(tty, ld);
882 	if (retval)
883 		return retval;
884 
885 	if (o_tty) {
886 		retval = tty_ldisc_open(o_tty, o_tty->ldisc);
887 		if (retval) {
888 			tty_ldisc_close(tty, ld);
889 			return retval;
890 		}
891 		tty_ldisc_enable(o_tty);
892 	}
893 	tty_ldisc_enable(tty);
894 	return 0;
895 }
896 /**
897  *	tty_ldisc_release		-	release line discipline
898  *	@tty: tty being shut down
899  *	@o_tty: pair tty for pty/tty pairs
900  *
901  *	Called during the final close of a tty/pty pair in order to shut down
902  *	the line discpline layer. On exit the ldisc assigned is N_TTY and the
903  *	ldisc has not been opened.
904  */
905 
tty_ldisc_release(struct tty_struct * tty,struct tty_struct * o_tty)906 void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
907 {
908 	/*
909 	 * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
910 	 * kill any delayed work. As this is the final close it does not
911 	 * race with the set_ldisc code path.
912 	 */
913 
914 	tty_unlock();
915 	tty_ldisc_halt(tty);
916 	tty_ldisc_flush_works(tty);
917 	tty_lock();
918 
919 	mutex_lock(&tty->ldisc_mutex);
920 	/*
921 	 * Now kill off the ldisc
922 	 */
923 	tty_ldisc_close(tty, tty->ldisc);
924 	tty_ldisc_put(tty->ldisc);
925 	/* Force an oops if we mess this up */
926 	tty->ldisc = NULL;
927 
928 	/* Ensure the next open requests the N_TTY ldisc */
929 	tty_set_termios_ldisc(tty, N_TTY);
930 	mutex_unlock(&tty->ldisc_mutex);
931 
932 	/* This will need doing differently if we need to lock */
933 	if (o_tty)
934 		tty_ldisc_release(o_tty, NULL);
935 
936 	/* And the memory resources remaining (buffers, termios) will be
937 	   disposed of when the kref hits zero */
938 }
939 
940 /**
941  *	tty_ldisc_init		-	ldisc setup for new tty
942  *	@tty: tty being allocated
943  *
944  *	Set up the line discipline objects for a newly allocated tty. Note that
945  *	the tty structure is not completely set up when this call is made.
946  */
947 
tty_ldisc_init(struct tty_struct * tty)948 void tty_ldisc_init(struct tty_struct *tty)
949 {
950 	struct tty_ldisc *ld = tty_ldisc_get(N_TTY);
951 	if (IS_ERR(ld))
952 		panic("n_tty: init_tty");
953 	tty_ldisc_assign(tty, ld);
954 }
955 
956 /**
957  *	tty_ldisc_init		-	ldisc cleanup for new tty
958  *	@tty: tty that was allocated recently
959  *
960  *	The tty structure must not becompletely set up (tty_ldisc_setup) when
961  *      this call is made.
962  */
tty_ldisc_deinit(struct tty_struct * tty)963 void tty_ldisc_deinit(struct tty_struct *tty)
964 {
965 	put_ldisc(tty->ldisc);
966 	tty_ldisc_assign(tty, NULL);
967 }
968 
tty_ldisc_begin(void)969 void tty_ldisc_begin(void)
970 {
971 	/* Setup the default TTY line discipline. */
972 	(void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
973 }
974