1 /*
2  *  linux/drivers/char/pty.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  *
6  *  Added support for a Unix98-style ptmx device.
7  *    -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
8  *  Added TTY_DO_WRITE_WAKEUP to enable n_tty to send POLL_OUT to
9  *      waiting writers -- Sapan Bhatia <sapan@corewars.org>
10  *
11  *
12  */
13 
14 #include <linux/config.h>
15 #include <linux/module.h>	/* For EXPORT_SYMBOL */
16 
17 #include <linux/errno.h>
18 #include <linux/sched.h>
19 #include <linux/interrupt.h>
20 #include <linux/tty.h>
21 #include <linux/tty_flip.h>
22 #include <linux/fcntl.h>
23 #include <linux/string.h>
24 #include <linux/major.h>
25 #include <linux/mm.h>
26 #include <linux/init.h>
27 #include <linux/devfs_fs_kernel.h>
28 
29 #include <asm/uaccess.h>
30 #include <asm/system.h>
31 #include <asm/bitops.h>
32 
33 #define BUILDING_PTY_C 1
34 #include <linux/devpts_fs.h>
35 
36 struct pty_struct {
37 	int	magic;
38 	wait_queue_head_t open_wait;
39 };
40 
41 #define PTY_MAGIC 0x5001
42 
43 static struct tty_driver pty_driver, pty_slave_driver;
44 static int pty_refcount;
45 
46 /* Note: one set of tables for BSD and one for Unix98 */
47 static struct tty_struct *pty_table[NR_PTYS];
48 static struct termios *pty_termios[NR_PTYS];
49 static struct termios *pty_termios_locked[NR_PTYS];
50 static struct tty_struct *ttyp_table[NR_PTYS];
51 static struct termios *ttyp_termios[NR_PTYS];
52 static struct termios *ttyp_termios_locked[NR_PTYS];
53 static struct pty_struct pty_state[NR_PTYS];
54 
55 #ifdef CONFIG_UNIX98_PTYS
56 /* These are global because they are accessed in tty_io.c */
57 struct tty_driver ptm_driver[UNIX98_NR_MAJORS];
58 struct tty_driver pts_driver[UNIX98_NR_MAJORS];
59 
60 static struct tty_struct *ptm_table[UNIX98_NR_MAJORS][NR_PTYS];
61 static struct termios *ptm_termios[UNIX98_NR_MAJORS][NR_PTYS];
62 static struct termios *ptm_termios_locked[UNIX98_NR_MAJORS][NR_PTYS];
63 static struct tty_struct *pts_table[UNIX98_NR_MAJORS][NR_PTYS];
64 static struct termios *pts_termios[UNIX98_NR_MAJORS][NR_PTYS];
65 static struct termios *pts_termios_locked[UNIX98_NR_MAJORS][NR_PTYS];
66 static struct pty_struct ptm_state[UNIX98_NR_MAJORS][NR_PTYS];
67 #endif
68 
69 #define MIN(a,b)	((a) < (b) ? (a) : (b))
70 
pty_close(struct tty_struct * tty,struct file * filp)71 static void pty_close(struct tty_struct * tty, struct file * filp)
72 {
73 	if (!tty)
74 		return;
75 	if (tty->driver.subtype == PTY_TYPE_MASTER) {
76 		if (tty->count > 1)
77 			printk("master pty_close: count = %d!!\n", tty->count);
78 	} else {
79 		if (tty->count > 2)
80 			return;
81 	}
82 	wake_up_interruptible(&tty->read_wait);
83 	wake_up_interruptible(&tty->write_wait);
84 	tty->packet = 0;
85 	if (!tty->link)
86 		return;
87 	tty->link->packet = 0;
88 	set_bit(TTY_OTHER_CLOSED, &tty->link->flags);
89 	wake_up_interruptible(&tty->link->read_wait);
90 	wake_up_interruptible(&tty->link->write_wait);
91 	if (tty->driver.subtype == PTY_TYPE_MASTER) {
92 		set_bit(TTY_OTHER_CLOSED, &tty->flags);
93 #ifdef CONFIG_UNIX98_PTYS
94 		{
95 			unsigned int major = MAJOR(tty->device) - UNIX98_PTY_MASTER_MAJOR;
96 			if ( major < UNIX98_NR_MAJORS ) {
97 				devpts_pty_kill( MINOR(tty->device)
98 			  - tty->driver.minor_start + tty->driver.name_base );
99 			}
100 		}
101 #endif
102 		tty_unregister_devfs (&tty->link->driver, MINOR (tty->device));
103 		tty_vhangup(tty->link);
104 	}
105 }
106 
107 /*
108  * The unthrottle routine is called by the line discipline to signal
109  * that it can receive more characters.  For PTY's, the TTY_THROTTLED
110  * flag is always set, to force the line discipline to always call the
111  * unthrottle routine when there are fewer than TTY_THRESHOLD_UNTHROTTLE
112  * characters in the queue.  This is necessary since each time this
113  * happens, we need to wake up any sleeping processes that could be
114  * (1) trying to send data to the pty, or (2) waiting in wait_until_sent()
115  * for the pty buffer to be drained.
116  */
pty_unthrottle(struct tty_struct * tty)117 static void pty_unthrottle(struct tty_struct * tty)
118 {
119 	struct tty_struct *o_tty = tty->link;
120 
121 	if (!o_tty)
122 		return;
123 
124 	tty_wakeup(o_tty);
125 	set_bit(TTY_THROTTLED, &tty->flags);
126 }
127 
128 /*
129  * WSH 05/24/97: modified to
130  *   (1) use space in tty->flip instead of a shared temp buffer
131  *	 The flip buffers aren't being used for a pty, so there's lots
132  *	 of space available.  The buffer is protected by a per-pty
133  *	 semaphore that should almost never come under contention.
134  *   (2) avoid redundant copying for cases where count >> receive_room
135  * N.B. Calls from user space may now return an error code instead of
136  * a count.
137  *
138  * FIXME: Our pty_write method is called with our ldisc lock held but
139  * not our partners. We can't just take the other one blindly without
140  * risking deadlocks.  There is also the small matter of TTY_DONT_FLIP
141  */
pty_write(struct tty_struct * tty,int from_user,const unsigned char * buf,int count)142 static int pty_write(struct tty_struct * tty, int from_user,
143 		       const unsigned char *buf, int count)
144 {
145 	struct tty_struct *to = tty->link;
146 	int	c=0, n, room;
147 	char	*temp_buffer;
148 
149 	if (!to || tty->stopped)
150 		return 0;
151 
152 	if (from_user) {
153 		down(&tty->flip.pty_sem);
154 		temp_buffer = &tty->flip.char_buf[0];
155 		while (count > 0) {
156 			/* check space so we don't copy needlessly */
157 			n = to->ldisc.receive_room(to);
158 			if (n > count)
159 				n = count;
160 			if (!n) break;
161 
162 			n  = MIN(n, PTY_BUF_SIZE);
163 			n -= copy_from_user(temp_buffer, buf, n);
164 			if (!n) {
165 				if (!c)
166 					c = -EFAULT;
167 				break;
168 			}
169 
170 			/* check again in case the buffer filled up */
171 			room = to->ldisc.receive_room(to);
172 			if (n > room)
173 				n = room;
174 			if (!n) break;
175 			buf   += n;
176 			c     += n;
177 			count -= n;
178 			to->ldisc.receive_buf(to, temp_buffer, 0, n);
179 		}
180 		up(&tty->flip.pty_sem);
181 	} else {
182 		c = to->ldisc.receive_room(to);
183 		if (c > count)
184 			c = count;
185 		to->ldisc.receive_buf(to, buf, 0, c);
186 	}
187 
188 	return c;
189 }
190 
pty_write_room(struct tty_struct * tty)191 static int pty_write_room(struct tty_struct *tty)
192 {
193 	struct tty_struct *to = tty->link;
194 
195 	if (!to || tty->stopped)
196 		return 0;
197 
198 	return to->ldisc.receive_room(to);
199 }
200 
201 /*
202  *	WSH 05/24/97:  Modified for asymmetric MASTER/SLAVE behavior
203  *	The chars_in_buffer() value is used by the ldisc select() function
204  *	to hold off writing when chars_in_buffer > WAKEUP_CHARS (== 256).
205  *	The pty driver chars_in_buffer() Master/Slave must behave differently:
206  *
207  *      The Master side needs to allow typed-ahead commands to accumulate
208  *      while being canonicalized, so we report "our buffer" as empty until
209  *	some threshold is reached, and then report the count. (Any count >
210  *	WAKEUP_CHARS is regarded by select() as "full".)  To avoid deadlock
211  *	the count returned must be 0 if no canonical data is available to be
212  *	read. (The N_TTY ldisc.chars_in_buffer now knows this.)
213  *
214  *	The Slave side passes all characters in raw mode to the Master side's
215  *	buffer where they can be read immediately, so in this case we can
216  *	return the true count in the buffer.
217  */
pty_chars_in_buffer(struct tty_struct * tty)218 static int pty_chars_in_buffer(struct tty_struct *tty)
219 {
220 	struct tty_struct *to = tty->link;
221 	ssize_t (*chars_in_buffer)(struct tty_struct *);
222 	int count;
223 
224 	/* We should get the line discipline lock for "tty->link" */
225 	if (!to || !(chars_in_buffer = to->ldisc.chars_in_buffer))
226 		return 0;
227 
228 	/* The ldisc must report 0 if no characters available to be read */
229 	count = chars_in_buffer(to);
230 
231 	if (tty->driver.subtype == PTY_TYPE_SLAVE) return count;
232 
233 	/* Master side driver ... if the other side's read buffer is less than
234 	 * half full, return 0 to allow writers to proceed; otherwise return
235 	 * the count.  This leaves a comfortable margin to avoid overflow,
236 	 * and still allows half a buffer's worth of typed-ahead commands.
237 	 */
238 	return ((count < N_TTY_BUF_SIZE/2) ? 0 : count);
239 }
240 
241 /*
242  * Return the device number of a Unix98 PTY (only!).  This lets us open a
243  * master pty with the multi-headed ptmx device, then find out which
244  * one we got after it is open, with an ioctl.
245  */
246 #ifdef CONFIG_UNIX98_PTYS
pty_get_device_number(struct tty_struct * tty,unsigned int * value)247 static int pty_get_device_number(struct tty_struct *tty, unsigned int *value)
248 {
249 	unsigned int result = MINOR(tty->device)
250 		- tty->driver.minor_start + tty->driver.name_base;
251 	return put_user(result, value);
252 }
253 #endif
254 
255 /* Set the lock flag on a pty */
pty_set_lock(struct tty_struct * tty,int * arg)256 static int pty_set_lock(struct tty_struct *tty, int * arg)
257 {
258 	int val;
259 	if (get_user(val,arg))
260 		return -EFAULT;
261 	if (val)
262 		set_bit(TTY_PTY_LOCK, &tty->flags);
263 	else
264 		clear_bit(TTY_PTY_LOCK, &tty->flags);
265 	return 0;
266 }
267 
pty_bsd_ioctl(struct tty_struct * tty,struct file * file,unsigned int cmd,unsigned long arg)268 static int pty_bsd_ioctl(struct tty_struct *tty, struct file *file,
269 			unsigned int cmd, unsigned long arg)
270 {
271 	if (!tty) {
272 		printk("pty_ioctl called with NULL tty!\n");
273 		return -EIO;
274 	}
275 	switch(cmd) {
276 	case TIOCSPTLCK: /* Set PT Lock (disallow slave open) */
277 		return pty_set_lock(tty, (int *) arg);
278 	}
279 	return -ENOIOCTLCMD;
280 }
281 
282 #ifdef CONFIG_UNIX98_PTYS
pty_unix98_ioctl(struct tty_struct * tty,struct file * file,unsigned int cmd,unsigned long arg)283 static int pty_unix98_ioctl(struct tty_struct *tty, struct file *file,
284 			    unsigned int cmd, unsigned long arg)
285 {
286 	if (!tty) {
287 		printk("pty_unix98_ioctl called with NULL tty!\n");
288 		return -EIO;
289 	}
290 	switch(cmd) {
291 	case TIOCGPTN: /* Get PT Number */
292 		return pty_get_device_number(tty, (unsigned int *)arg);
293 	}
294 
295 	return pty_bsd_ioctl(tty,file,cmd,arg);
296 }
297 #endif
298 
pty_flush_buffer(struct tty_struct * tty)299 static void pty_flush_buffer(struct tty_struct *tty)
300 {
301 	struct tty_struct *to = tty->link;
302 
303 	if (!to)
304 		return;
305 
306 	tty_ldisc_flush(to);
307 
308 	if (to->packet) {
309 		tty->ctrl_status |= TIOCPKT_FLUSHWRITE;
310 		wake_up_interruptible(&to->read_wait);
311 	}
312 }
313 
pty_open(struct tty_struct * tty,struct file * filp)314 static int pty_open(struct tty_struct *tty, struct file * filp)
315 {
316 	int	retval;
317 	int	line;
318 	struct	pty_struct *pty;
319 
320 	retval = -ENODEV;
321 	if (!tty || !tty->link)
322 		goto out;
323 	line = MINOR(tty->device) - tty->driver.minor_start;
324 	if ((line < 0) || (line >= NR_PTYS))
325 		goto out;
326 	pty = (struct pty_struct *)(tty->driver.driver_state) + line;
327 	tty->driver_data = pty;
328 
329 	retval = -EIO;
330 	if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
331 		goto out;
332 	if (test_bit(TTY_PTY_LOCK, &tty->link->flags))
333 		goto out;
334 	if (tty->link->count != 1)
335 		goto out;
336 
337 	clear_bit(TTY_OTHER_CLOSED, &tty->link->flags);
338 	wake_up_interruptible(&pty->open_wait);
339 	set_bit(TTY_THROTTLED, &tty->flags);
340 	set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
341 
342 	/*  Register a slave for the master  */
343 	if (tty->driver.major == PTY_MASTER_MAJOR)
344 		tty_register_devfs(&tty->link->driver,
345 				   DEVFS_FL_CURRENT_OWNER | DEVFS_FL_WAIT,
346 				   tty->link->driver.minor_start +
347 				   MINOR(tty->device)-tty->driver.minor_start);
348 	retval = 0;
349 out:
350 	return retval;
351 }
352 
pty_set_termios(struct tty_struct * tty,struct termios * old_termios)353 static void pty_set_termios(struct tty_struct *tty, struct termios *old_termios)
354 {
355         tty->termios->c_cflag &= ~(CSIZE | PARENB);
356         tty->termios->c_cflag |= (CS8 | CREAD);
357 }
358 
pty_init(void)359 int __init pty_init(void)
360 {
361 	int i;
362 
363 	/* Traditional BSD devices */
364 
365 	memset(&pty_state, 0, sizeof(pty_state));
366 	for (i = 0; i < NR_PTYS; i++)
367 		init_waitqueue_head(&pty_state[i].open_wait);
368 	memset(&pty_driver, 0, sizeof(struct tty_driver));
369 	pty_driver.magic = TTY_DRIVER_MAGIC;
370 	pty_driver.driver_name = "pty_master";
371 #ifdef CONFIG_DEVFS_FS
372 	pty_driver.name = "pty/m%d";
373 #else
374 	pty_driver.name = "pty";
375 #endif
376 	pty_driver.major = PTY_MASTER_MAJOR;
377 	pty_driver.minor_start = 0;
378 	pty_driver.num = NR_PTYS;
379 	pty_driver.type = TTY_DRIVER_TYPE_PTY;
380 	pty_driver.subtype = PTY_TYPE_MASTER;
381 	pty_driver.init_termios = tty_std_termios;
382 	pty_driver.init_termios.c_iflag = 0;
383 	pty_driver.init_termios.c_oflag = 0;
384 	pty_driver.init_termios.c_cflag = B38400 | CS8 | CREAD;
385 	pty_driver.init_termios.c_lflag = 0;
386 	pty_driver.flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW;
387 	pty_driver.refcount = &pty_refcount;
388 	pty_driver.table = pty_table;
389 	pty_driver.termios = pty_termios;
390 	pty_driver.termios_locked = pty_termios_locked;
391 	pty_driver.driver_state = pty_state;
392 	pty_driver.other = &pty_slave_driver;
393 
394 	pty_driver.open = pty_open;
395 	pty_driver.close = pty_close;
396 	pty_driver.write = pty_write;
397 	pty_driver.write_room = pty_write_room;
398 	pty_driver.flush_buffer = pty_flush_buffer;
399 	pty_driver.chars_in_buffer = pty_chars_in_buffer;
400 	pty_driver.unthrottle = pty_unthrottle;
401 	pty_driver.set_termios = pty_set_termios;
402 
403 	pty_slave_driver = pty_driver;
404 	pty_slave_driver.driver_name = "pty_slave";
405 	pty_slave_driver.proc_entry = 0;
406 #ifdef CONFIG_DEVFS_FS
407 	pty_slave_driver.name = "pty/s%d";
408 #else
409 	pty_slave_driver.name = "ttyp";
410 #endif
411 	pty_slave_driver.subtype = PTY_TYPE_SLAVE;
412 	pty_slave_driver.major = PTY_SLAVE_MAJOR;
413 	pty_slave_driver.minor_start = 0;
414 	pty_slave_driver.init_termios = tty_std_termios;
415 	pty_slave_driver.init_termios.c_cflag = B38400 | CS8 | CREAD;
416 	/* Slave ptys are registered when their corresponding master pty
417 	 * is opened, and unregistered when the pair is closed.
418 	 */
419 	pty_slave_driver.flags |= TTY_DRIVER_NO_DEVFS;
420 	pty_slave_driver.table = ttyp_table;
421 	pty_slave_driver.termios = ttyp_termios;
422 	pty_slave_driver.termios_locked = ttyp_termios_locked;
423 	pty_slave_driver.driver_state = pty_state;
424 	pty_slave_driver.other = &pty_driver;
425 
426 	if (tty_register_driver(&pty_driver))
427 		panic("Couldn't register pty driver");
428 	if (tty_register_driver(&pty_slave_driver))
429 		panic("Couldn't register pty slave driver");
430 
431 	/*
432 	 * only the master pty gets this ioctl (which is why we
433 	 * assign it here, instead of up with the rest of the
434 	 * pty_driver initialization. <cananian@alumni.princeton.edu>
435 	 */
436 	pty_driver.ioctl = pty_bsd_ioctl;
437 
438 	/* Unix98 devices */
439 #ifdef CONFIG_UNIX98_PTYS
440 	devfs_mk_dir (NULL, "pts", NULL);
441 	printk("pty: %d Unix98 ptys configured\n", UNIX98_NR_MAJORS*NR_PTYS);
442 	for ( i = 0 ; i < UNIX98_NR_MAJORS ; i++ ) {
443 		int j;
444 
445 		ptm_driver[i] = pty_driver;
446 		ptm_driver[i].name = "ptm";
447 		ptm_driver[i].proc_entry = 0;
448 		ptm_driver[i].major = UNIX98_PTY_MASTER_MAJOR+i;
449 		ptm_driver[i].minor_start = 0;
450 		ptm_driver[i].name_base = i*NR_PTYS;
451 		ptm_driver[i].num = NR_PTYS;
452 		ptm_driver[i].other = &pts_driver[i];
453 		ptm_driver[i].flags |= TTY_DRIVER_NO_DEVFS;
454 		ptm_driver[i].table = ptm_table[i];
455 		ptm_driver[i].termios = ptm_termios[i];
456 		ptm_driver[i].termios_locked = ptm_termios_locked[i];
457 		ptm_driver[i].driver_state = ptm_state[i];
458 
459 		for (j = 0; j < NR_PTYS; j++)
460 			init_waitqueue_head(&ptm_state[i][j].open_wait);
461 
462 		pts_driver[i] = pty_slave_driver;
463 #ifdef CONFIG_DEVFS_FS
464 		pts_driver[i].name = "pts/%d";
465 #else
466 		pts_driver[i].name = "pts";
467 #endif
468 		pts_driver[i].proc_entry = 0;
469 		pts_driver[i].major = UNIX98_PTY_SLAVE_MAJOR+i;
470 		pts_driver[i].minor_start = 0;
471 		pts_driver[i].name_base = i*NR_PTYS;
472 		pts_driver[i].num = ptm_driver[i].num;
473 		pts_driver[i].other = &ptm_driver[i];
474 		pts_driver[i].table = pts_table[i];
475 		pts_driver[i].termios = pts_termios[i];
476 		pts_driver[i].termios_locked = pts_termios_locked[i];
477 		pts_driver[i].driver_state = ptm_state[i];
478 
479 		ptm_driver[i].ioctl = pty_unix98_ioctl;
480 
481 		if (tty_register_driver(&ptm_driver[i]))
482 			panic("Couldn't register Unix98 ptm driver major %d",
483 			      ptm_driver[i].major);
484 		if (tty_register_driver(&pts_driver[i]))
485 			panic("Couldn't register Unix98 pts driver major %d",
486 			      pts_driver[i].major);
487 	}
488 #endif
489 	return 0;
490 }
491