forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c 
 kernel/drivers/tty/tty_io.c
....@@ -87,6 +87,7 @@
8787 #include <linux/string.h>
8888 #include <linux/slab.h>
8989 #include <linux/poll.h>
90
+#include <linux/ppp-ioctl.h>
9091 #include <linux/proc_fs.h>
9192 #include <linux/init.h>
9293 #include <linux/module.h>
....@@ -97,6 +98,7 @@
9798 #include <linux/seq_file.h>
9899 #include <linux/serial.h>
99100 #include <linux/ratelimit.h>
101
+#include <linux/compat.h>
100102 
101103 #include <linux/uaccess.h>
102104 
....@@ -106,6 +108,7 @@
106108 
107109 #include <linux/kmod.h>
108110 #include <linux/nsproxy.h>
111
+#include "tty.h"
109112 
110113 #undef TTY_DEBUG_HANGUP
111114 #ifdef TTY_DEBUG_HANGUP
....@@ -140,13 +143,10 @@
140143 /* Mutex to protect creating and releasing a tty */
141144 DEFINE_MUTEX(tty_mutex);
142145 
143
-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
144
-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
145
-ssize_t redirected_tty_write(struct file *, const char __user *,
146
-							size_t, loff_t *);
146
+static ssize_t tty_read(struct kiocb *, struct iov_iter *);
147
+static ssize_t tty_write(struct kiocb *, struct iov_iter *);
147148 static __poll_t tty_poll(struct file *, poll_table *);
148149 static int tty_open(struct inode *, struct file *);
149
-long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
150150 #ifdef CONFIG_COMPAT
151151 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
152152 				unsigned long arg);
....@@ -305,7 +305,7 @@
305305 
306306 /**
307307  *	get_tty_driver		-	find device of a tty
308
- *	@dev_t: device identifier
308
+ *	@device: device identifier
309309  *	@index: returns the index of the tty
310310  *
311311  *	This routine returns a tty driver structure, given a device number
....@@ -430,14 +430,12 @@
430430 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
431431 #endif
432432 
433
-static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
434
-				size_t count, loff_t *ppos)
433
+static ssize_t hung_up_tty_read(struct kiocb *iocb, struct iov_iter *to)
435434 {
436435 	return 0;
437436 }
438437 
439
-static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
440
-				 size_t count, loff_t *ppos)
438
+static ssize_t hung_up_tty_write(struct kiocb *iocb, struct iov_iter *from)
441439 {
442440 	return -EIO;
443441 }
....@@ -475,8 +473,10 @@
475473 
476474 static const struct file_operations tty_fops = {
477475 	.llseek		= no_llseek,
478
-	.read		= tty_read,
479
-	.write		= tty_write,
476
+	.read_iter	= tty_read,
477
+	.write_iter	= tty_write,
478
+	.splice_read	= generic_file_splice_read,
479
+	.splice_write	= iter_file_splice_write,
480480 	.poll		= tty_poll,
481481 	.unlocked_ioctl	= tty_ioctl,
482482 	.compat_ioctl	= tty_compat_ioctl,
....@@ -488,8 +488,10 @@
488488 
489489 static const struct file_operations console_fops = {
490490 	.llseek		= no_llseek,
491
-	.read		= tty_read,
492
-	.write		= redirected_tty_write,
491
+	.read_iter	= tty_read,
492
+	.write_iter	= redirected_tty_write,
493
+	.splice_read	= generic_file_splice_read,
494
+	.splice_write	= iter_file_splice_write,
493495 	.poll		= tty_poll,
494496 	.unlocked_ioctl	= tty_ioctl,
495497 	.compat_ioctl	= tty_compat_ioctl,
....@@ -500,8 +502,8 @@
500502 
501503 static const struct file_operations hung_up_tty_fops = {
502504 	.llseek		= no_llseek,
503
-	.read		= hung_up_tty_read,
504
-	.write		= hung_up_tty_write,
505
+	.read_iter	= hung_up_tty_read,
506
+	.write_iter	= hung_up_tty_write,
505507 	.poll		= hung_up_tty_poll,
506508 	.unlocked_ioctl	= hung_up_tty_ioctl,
507509 	.compat_ioctl	= hung_up_tty_compat_ioctl,
....@@ -542,7 +544,7 @@
542544 
543545 /**
544546  *	__tty_hangup		-	actual handler for hangup events
545
- *	@work: tty device
547
+ *	@tty: tty device
546548  *
547549  *	This can be called by a "kworker" kernel thread.  That is process
548550  *	synchronous but doesn't hold any locks, so we need to make sure we
....@@ -605,9 +607,9 @@
605607 	/* This breaks for file handles being sent over AF_UNIX sockets ? */
606608 	list_for_each_entry(priv, &tty->tty_files, list) {
607609 		filp = priv->file;
608
-		if (filp->f_op->write == redirected_tty_write)
610
+		if (filp->f_op->write_iter == redirected_tty_write)
609611 			cons_filp = filp;
610
-		if (filp->f_op->write != tty_write)
612
+		if (filp->f_op->write_iter != tty_write)
611613 			continue;
612614 		closecount++;
613615 		__tty_fasync(-1, filp, 0);	/* can't block */
....@@ -830,6 +832,72 @@
830832 		time->tv_sec = sec;
831833 }
832834 
835
+/*
836
+ * Iterate on the ldisc ->read() function until we've gotten all
837
+ * the data the ldisc has for us.
838
+ *
839
+ * The "cookie" is something that the ldisc read function can fill
840
+ * in to let us know that there is more data to be had.
841
+ *
842
+ * We promise to continue to call the ldisc until it stops returning
843
+ * data or clears the cookie. The cookie may be something that the
844
+ * ldisc maintains state for and needs to free.
845
+ */
846
+static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty,
847
+		struct file *file, struct iov_iter *to)
848
+{
849
+	int retval = 0;
850
+	void *cookie = NULL;
851
+	unsigned long offset = 0;
852
+	char kernel_buf[64];
853
+	size_t count = iov_iter_count(to);
854
+
855
+	do {
856
+		int size, copied;
857
+
858
+		size = count > sizeof(kernel_buf) ? sizeof(kernel_buf) : count;
859
+		size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
860
+		if (!size)
861
+			break;
862
+
863
+		if (size < 0) {
864
+			/* Did we have an earlier error (ie -EFAULT)? */
865
+			if (retval)
866
+				break;
867
+			retval = size;
868
+
869
+			/*
870
+			 * -EOVERFLOW means we didn't have enough space
871
+			 * for a whole packet, and we shouldn't return
872
+			 * a partial result.
873
+			 */
874
+			if (retval == -EOVERFLOW)
875
+				offset = 0;
876
+			break;
877
+		}
878
+
879
+		copied = copy_to_iter(kernel_buf, size, to);
880
+		offset += copied;
881
+		count -= copied;
882
+
883
+		/*
884
+		 * If the user copy failed, we still need to do another ->read()
885
+		 * call if we had a cookie to let the ldisc clear up.
886
+		 *
887
+		 * But make sure size is zeroed.
888
+		 */
889
+		if (unlikely(copied != size)) {
890
+			count = 0;
891
+			retval = -EFAULT;
892
+		}
893
+	} while (cookie);
894
+
895
+	/* We always clear tty buffer in case they contained passwords */
896
+	memzero_explicit(kernel_buf, sizeof(kernel_buf));
897
+	return offset ? offset : retval;
898
+}
899
+
900
+
833901 /**
834902  *	tty_read	-	read method for tty device files
835903  *	@file: pointer to tty file
....@@ -845,10 +913,10 @@
845913  *	read calls may be outstanding in parallel.
846914  */
847915 
848
-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
849
-			loff_t *ppos)
916
+static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
850917 {
851918 	int i;
919
+	struct file *file = iocb->ki_filp;
852920 	struct inode *inode = file_inode(file);
853921 	struct tty_struct *tty = file_tty(file);
854922 	struct tty_ldisc *ld;
....@@ -862,11 +930,10 @@
862930 	   situation */
863931 	ld = tty_ldisc_ref_wait(tty);
864932 	if (!ld)
865
-		return hung_up_tty_read(file, buf, count, ppos);
933
+		return hung_up_tty_read(iocb, to);
934
+	i = -EIO;
866935 	if (ld->ops->read)
867
-		i = ld->ops->read(tty, file, buf, count);
868
-	else
869
-		i = -EIO;
936
+		i = iterate_tty_read(ld, tty, file, to);
870937 	tty_ldisc_deref(ld);
871938 
872939 	if (i > 0)
....@@ -875,13 +942,13 @@
875942 	return i;
876943 }
877944 
878
-static void tty_write_unlock(struct tty_struct *tty)
945
+void tty_write_unlock(struct tty_struct *tty)
879946 {
880947 	mutex_unlock(&tty->atomic_write_lock);
881948 	wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
882949 }
883950 
884
-static int tty_write_lock(struct tty_struct *tty, int ndelay)
951
+int tty_write_lock(struct tty_struct *tty, int ndelay)
885952 {
886953 	if (!mutex_trylock(&tty->atomic_write_lock)) {
887954 		if (ndelay)
....@@ -900,9 +967,9 @@
900967 	ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
901968 	struct tty_struct *tty,
902969 	struct file *file,
903
-	const char __user *buf,
904
-	size_t count)
970
+	struct iov_iter *from)
905971 {
972
+	size_t count = iov_iter_count(from);
906973 	ssize_t ret, written = 0;
907974 	unsigned int chunk;
908975 
....@@ -954,14 +1021,23 @@
9541021 		size_t size = count;
9551022 		if (size > chunk)
9561023 			size = chunk;
1024
+
9571025 		ret = -EFAULT;
958
-		if (copy_from_user(tty->write_buf, buf, size))
1026
+		if (copy_from_iter(tty->write_buf, size, from) != size)
9591027 			break;
1028
+
9601029 		ret = write(tty, file, tty->write_buf, size);
9611030 		if (ret <= 0)
9621031 			break;
1032
+
9631033 		written += ret;
964
-		buf += ret;
1034
+		if (ret > size)
1035
+			break;
1036
+
1037
+		/* FIXME! Have Al check this! */
1038
+		if (ret != size)
1039
+			iov_iter_revert(from, size-ret);
1040
+
9651041 		count -= ret;
9661042 		if (!count)
9671043 			break;
....@@ -1021,8 +1097,7 @@
10211097  *	write method will not be invoked in parallel for each device.
10221098  */
10231099 
1024
-static ssize_t tty_write(struct file *file, const char __user *buf,
1025
-						size_t count, loff_t *ppos)
1100
+static ssize_t file_tty_write(struct file *file, struct kiocb *iocb, struct iov_iter *from)
10261101 {
10271102 	struct tty_struct *tty = file_tty(file);
10281103  	struct tty_ldisc *ld;
....@@ -1037,17 +1112,21 @@
10371112 		tty_err(tty, "missing write_room method\n");
10381113 	ld = tty_ldisc_ref_wait(tty);
10391114 	if (!ld)
1040
-		return hung_up_tty_write(file, buf, count, ppos);
1115
+		return hung_up_tty_write(iocb, from);
10411116 	if (!ld->ops->write)
10421117 		ret = -EIO;
10431118 	else
1044
-		ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1119
+		ret = do_tty_write(ld->ops->write, tty, file, from);
10451120 	tty_ldisc_deref(ld);
10461121 	return ret;
10471122 }
10481123 
1049
-ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1050
-						size_t count, loff_t *ppos)
1124
+static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
1125
+{
1126
+	return file_tty_write(iocb->ki_filp, iocb, from);
1127
+}
1128
+
1129
+ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
10511130 {
10521131 	struct file *p = NULL;
10531132 
....@@ -1056,13 +1135,17 @@
10561135 		p = get_file(redirect);
10571136 	spin_unlock(&redirect_lock);
10581137 
1138
+	/*
1139
+	 * We know the redirected tty is just another tty, we can can
1140
+	 * call file_tty_write() directly with that file pointer.
1141
+	 */
10591142 	if (p) {
10601143 		ssize_t res;
1061
-		res = vfs_write(p, buf, count, &p->f_pos);
1144
+		res = file_tty_write(p, iocb, iter);
10621145 		fput(p);
10631146 		return res;
10641147 	}
1065
-	return tty_write(file, buf, count, ppos);
1148
+	return tty_write(iocb, iter);
10661149 }
10671150 
10681151 /**
....@@ -1155,14 +1238,16 @@
11551238 {
11561239 	struct tty_struct *tty;
11571240 
1158
-	if (driver->ops->lookup)
1241
+	if (driver->ops->lookup) {
11591242 		if (!file)
11601243 			tty = ERR_PTR(-EIO);
11611244 		else
11621245 			tty = driver->ops->lookup(driver, file, idx);
1163
-	else
1246
+	} else {
1247
+		if (idx >= driver->num)
1248
+			return ERR_PTR(-EINVAL);
11641249 		tty = driver->ttys[idx];
1165
-
1250
+	}
11661251 	if (!IS_ERR(tty))
11671252 		tty_kref_get(tty);
11681253 	return tty;
....@@ -1172,7 +1257,7 @@
11721257  *	tty_init_termios	-  helper for termios setup
11731258  *	@tty: the tty to set up
11741259  *
1175
- *	Initialise the termios structures for this tty. Thus runs under
1260
+ *	Initialise the termios structure for this tty. This runs under
11761261  *	the tty_mutex currently so we can be relaxed about ordering.
11771262  */
11781263 
....@@ -1230,7 +1315,7 @@
12301315 /**
12311316  *	tty_driver_remove_tty() - remove a tty from the driver tables
12321317  *	@driver: the driver for the tty
1233
- *	@idx:	 the minor number
1318
+ *	@tty: tty to remove
12341319  *
12351320  *	Remvoe a tty object from the driver tables. The tty->index field
12361321  *	will be set by the time this is called.
....@@ -1245,9 +1330,9 @@
12451330 		driver->ttys[tty->index] = NULL;
12461331 }
12471332 
1248
-/*
1249
- * 	tty_reopen()	- fast re-open of an open tty
1250
- * 	@tty	- the tty to open
1333
+/**
1334
+ *	tty_reopen()	- fast re-open of an open tty
1335
+ *	@tty: the tty to open
12511336  *
12521337  *	Return 0 on success, -errno on error.
12531338  *	Re-opens on master ptys are not allowed and return -EIO.
....@@ -1293,7 +1378,6 @@
12931378  *	tty_init_dev		-	initialise a tty device
12941379  *	@driver: tty driver we are opening a device on
12951380  *	@idx: device index
1296
- *	@ret_tty: returned tty structure
12971381  *
12981382  *	Prepare a tty device. This may not be a "new" clean device but
12991383  *	could also be an active device. The pty drivers require special
....@@ -1311,6 +1395,8 @@
13111395  * failed open.  The new code protects the open with a mutex, so it's
13121396  * really quite straightforward.  The mutex locking can probably be
13131397  * relaxed for the (most common) case of reopening a tty.
1398
+ *
1399
+ *	Return: returned tty structure
13141400  */
13151401 
13161402 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
....@@ -1343,9 +1429,12 @@
13431429 	if (!tty->port)
13441430 		tty->port = driver->ports[idx];
13451431 
1346
-	WARN_RATELIMIT(!tty->port,
1347
-			"%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1348
-			__func__, tty->driver->name);
1432
+	if (WARN_RATELIMIT(!tty->port,
1433
+			"%s: %s driver does not set tty->port. This would crash the kernel. Fix the driver!\n",
1434
+			__func__, tty->driver->name)) {
1435
+		retval = -EINVAL;
1436
+		goto err_release_lock;
1437
+	}
13491438 
13501439 	retval = tty_ldisc_lock(tty, 5 * HZ);
13511440 	if (retval)
....@@ -1400,7 +1489,7 @@
14001489 	/* Stash the termios data */
14011490 	tp = tty->driver->termios[idx];
14021491 	if (tp == NULL) {
1403
-		tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1492
+		tp = kmalloc(sizeof(*tp), GFP_KERNEL);
14041493 		if (tp == NULL)
14051494 			return;
14061495 		tty->driver->termios[idx] = tp;
....@@ -1427,7 +1516,7 @@
14271516 
14281517 /**
14291518  *	release_one_tty		-	release tty structure memory
1430
- *	@kref: kref of tty we are obliterating
1519
+ *	@work: work of tty we are obliterating
14311520  *
14321521  *	Releases memory associated with a tty structure, and clears out the
14331522  *	driver table slots. This function is called when a device is no longer
....@@ -1509,10 +1598,12 @@
15091598 		tty->ops->shutdown(tty);
15101599 	tty_save_termios(tty);
15111600 	tty_driver_remove_tty(tty->driver, tty);
1512
-	tty->port->itty = NULL;
1601
+	if (tty->port)
1602
+		tty->port->itty = NULL;
15131603 	if (tty->link)
15141604 		tty->link->port->itty = NULL;
1515
-	tty_buffer_cancel_work(tty->port);
1605
+	if (tty->port)
1606
+		tty_buffer_cancel_work(tty->port);
15161607 	if (tty->link)
15171608 		tty_buffer_cancel_work(tty->link->port);
15181609 
....@@ -1523,7 +1614,6 @@
15231614 /**
15241615  *	tty_release_checks - check a tty before real release
15251616  *	@tty: tty to check
1526
- *	@o_tty: link of @tty (if any)
15271617  *	@idx: index of the tty
15281618  *
15291619  *	Performs some paranoid checking before true release of the @tty.
....@@ -1584,9 +1674,7 @@
15841674 	tty_debug_hangup(tty, "freeing structure\n");
15851675 	/*
15861676 	 * The release_tty function takes care of the details of clearing
1587
-	 * the slots and preserving the termios structure. The tty_unlock_pair
1588
-	 * should be safe as we keep a kref while the tty is locked (so the
1589
-	 * unlock never unlocks a freed tty).
1677
+	 * the slots and preserving the termios structure.
15901678 	 */
15911679 	mutex_lock(&tty_mutex);
15921680 	tty_port_set_kopened(tty->port, 0);
....@@ -1616,9 +1704,7 @@
16161704 	tty_debug_hangup(tty, "freeing structure\n");
16171705 	/*
16181706 	 * The release_tty function takes care of the details of clearing
1619
-	 * the slots and preserving the termios structure. The tty_unlock_pair
1620
-	 * should be safe as we keep a kref while the tty is locked (so the
1621
-	 * unlock never unlocks a freed tty).
1707
+	 * the slots and preserving the termios structure.
16221708 	 */
16231709 	mutex_lock(&tty_mutex);
16241710 	release_tty(tty, idx);
....@@ -1836,7 +1922,7 @@
18361922 static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
18371923 		int *index)
18381924 {
1839
-	struct tty_driver *driver;
1925
+	struct tty_driver *driver = NULL;
18401926 
18411927 	switch (device) {
18421928 #ifdef CONFIG_VT
....@@ -1857,6 +1943,8 @@
18571943 				break;
18581944 			}
18591945 		}
1946
+		if (driver)
1947
+			tty_driver_kref_put(driver);
18601948 		return ERR_PTR(-ENODEV);
18611949 	}
18621950 	default:
....@@ -1886,7 +1974,7 @@
18861974 struct tty_struct *tty_kopen(dev_t device)
18871975 {
18881976 	struct tty_struct *tty;
1889
-	struct tty_driver *driver = NULL;
1977
+	struct tty_driver *driver;
18901978 	int index = -1;
18911979 
18921980 	mutex_lock(&tty_mutex);
....@@ -1921,7 +2009,6 @@
19212009 /**
19222010  *	tty_open_by_driver	-	open a tty device
19232011  *	@device: dev_t of device to open
1924
- *	@inode: inode of device file
19252012  *	@filp: file pointer to tty
19262013  *
19272014  *	Performs the driver lookup, checks for a reopen, or otherwise
....@@ -1934,7 +2021,7 @@
19342021  *	  - concurrent tty driver removal w/ lookup
19352022  *	  - concurrent tty removal from driver table
19362023  */
1937
-static struct tty_struct *tty_open_by_driver(dev_t device, struct inode *inode,
2024
+static struct tty_struct *tty_open_by_driver(dev_t device,
19382025 					     struct file *filp)
19392026 {
19402027 	struct tty_struct *tty;
....@@ -2026,7 +2113,7 @@
20262113 
20272114 	tty = tty_open_current_tty(device, filp);
20282115 	if (!tty)
2029
-		tty = tty_open_by_driver(device, inode, filp);
2116
+		tty = tty_open_by_driver(device, filp);
20302117 
20312118 	if (IS_ERR(tty)) {
20322119 		tty_free_file(filp);
....@@ -2198,7 +2285,7 @@
21982285 
21992286 /**
22002287  *	tiocgwinsz		-	implement window query ioctl
2201
- *	@tty; tty
2288
+ *	@tty: tty
22022289  *	@arg: user buffer for result
22032290  *
22042291  *	Copies the kernel idea of the window size into the user buffer.
....@@ -2221,8 +2308,7 @@
22212308 /**
22222309  *	tty_do_resize		-	resize event
22232310  *	@tty: tty being resized
2224
- *	@rows: rows (character)
2225
- *	@cols: cols (character)
2311
+ *	@ws: new dimensions
22262312  *
22272313  *	Update the termios variables and send the necessary signals to
22282314  *	peform a terminal resize correctly
....@@ -2252,7 +2338,7 @@
22522338 
22532339 /**
22542340  *	tiocswinsz		-	implement window size set ioctl
2255
- *	@tty; tty side of tty
2341
+ *	@tty: tty side of tty
22562342  *	@arg: user buffer for result
22572343  *
22582344  *	Copies the user idea of the window size to the kernel. Traditionally
....@@ -2290,7 +2376,7 @@
22902376 {
22912377 	if (!capable(CAP_SYS_ADMIN))
22922378 		return -EPERM;
2293
-	if (file->f_op->write == redirected_tty_write) {
2379
+	if (file->f_op->write_iter == redirected_tty_write) {
22942380 		struct file *f;
22952381 		spin_lock(&redirect_lock);
22962382 		f = redirect;
....@@ -2300,6 +2386,12 @@
23002386 			fput(f);
23012387 		return 0;
23022388 	}
2389
+	if (file->f_op->write_iter != tty_write)
2390
+		return -ENOTTY;
2391
+	if (!(file->f_mode & FMODE_WRITE))
2392
+		return -EBADF;
2393
+	if (!(file->f_mode & FMODE_CAN_WRITE))
2394
+		return -EINVAL;
23032395 	spin_lock(&redirect_lock);
23042396 	if (redirect) {
23052397 		spin_unlock(&redirect_lock);
....@@ -2307,34 +2399,6 @@
23072399 	}
23082400 	redirect = get_file(file);
23092401 	spin_unlock(&redirect_lock);
2310
-	return 0;
2311
-}
2312
-
2313
-/**
2314
- *	fionbio		-	non blocking ioctl
2315
- *	@file: file to set blocking value
2316
- *	@p: user parameter
2317
- *
2318
- *	Historical tty interfaces had a blocking control ioctl before
2319
- *	the generic functionality existed. This piece of history is preserved
2320
- *	in the expected tty API of posix OS's.
2321
- *
2322
- *	Locking: none, the open file handle ensures it won't go away.
2323
- */
2324
-
2325
-static int fionbio(struct file *file, int __user *p)
2326
-{
2327
-	int nonblock;
2328
-
2329
-	if (get_user(nonblock, p))
2330
-		return -EFAULT;
2331
-
2332
-	spin_lock(&file->f_lock);
2333
-	if (nonblock)
2334
-		file->f_flags |= O_NONBLOCK;
2335
-	else
2336
-		file->f_flags &= ~O_NONBLOCK;
2337
-	spin_unlock(&file->f_lock);
23382402 	return 0;
23392403 }
23402404 
....@@ -2428,7 +2492,6 @@
24282492 /**
24292493  *	tty_tiocmget		-	get modem status
24302494  *	@tty: tty device
2431
- *	@file: user file pointer
24322495  *	@p: pointer to result
24332496  *
24342497  *	Obtain the modem status bits from the tty driver if the feature
....@@ -2506,22 +2569,40 @@
25062569 	return 0;
25072570 }
25082571 
2509
-static void tty_warn_deprecated_flags(struct serial_struct __user *ss)
2572
+static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
25102573 {
25112574 	static DEFINE_RATELIMIT_STATE(depr_flags,
25122575 			DEFAULT_RATELIMIT_INTERVAL,
25132576 			DEFAULT_RATELIMIT_BURST);
25142577 	char comm[TASK_COMM_LEN];
2578
+	struct serial_struct v;
25152579 	int flags;
25162580 
2517
-	if (get_user(flags, &ss->flags))
2518
-		return;
2581
+	if (copy_from_user(&v, ss, sizeof(*ss)))
2582
+		return -EFAULT;
25192583 
2520
-	flags &= ASYNC_DEPRECATED;
2584
+	flags = v.flags & ASYNC_DEPRECATED;
25212585 
25222586 	if (flags && __ratelimit(&depr_flags))
25232587 		pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
25242588 			__func__, get_task_comm(comm, current), flags);
2589
+	if (!tty->ops->set_serial)
2590
+		return -ENOTTY;
2591
+	return tty->ops->set_serial(tty, &v);
2592
+}
2593
+
2594
+static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
2595
+{
2596
+	struct serial_struct v;
2597
+	int err;
2598
+
2599
+	memset(&v, 0, sizeof(v));
2600
+	if (!tty->ops->get_serial)
2601
+		return -ENOTTY;
2602
+	err = tty->ops->get_serial(tty, &v);
2603
+	if (!err && copy_to_user(ss, &v, sizeof(v)))
2604
+		err = -EFAULT;
2605
+	return err;
25252606 }
25262607 
25272608 /*
....@@ -2584,8 +2665,6 @@
25842665 		return tiocswinsz(real_tty, p);
25852666 	case TIOCCONS:
25862667 		return real_tty != tty ? -EINVAL : tioccons(file);
2587
-	case FIONBIO:
2588
-		return fionbio(file, p);
25892668 	case TIOCEXCL:
25902669 		set_bit(TTY_EXCLUSIVE, &tty->flags);
25912670 		return 0;
....@@ -2640,11 +2719,7 @@
26402719 	case TIOCMBIS:
26412720 		return tty_tiocmset(tty, cmd, p);
26422721 	case TIOCGICOUNT:
2643
-		retval = tty_tiocgicount(tty, p);
2644
-		/* For the moment allow fall through to the old method */
2645
-        	if (retval != -EINVAL)
2646
-			return retval;
2647
-		break;
2722
+		return tty_tiocgicount(tty, p);
26482723 	case TCFLSH:
26492724 		switch (arg) {
26502725 		case TCIFLUSH:
....@@ -2655,8 +2730,9 @@
26552730 		}
26562731 		break;
26572732 	case TIOCSSERIAL:
2658
-		tty_warn_deprecated_flags(p);
2659
-		break;
2733
+		return tty_tiocsserial(tty, p);
2734
+	case TIOCGSERIAL:
2735
+		return tty_tiocgserial(tty, p);
26602736 	case TIOCGPTPEER:
26612737 		/* Special because the struct file is needed */
26622738 		return ptm_open_peer(file, tty, (int)arg);
....@@ -2684,6 +2760,83 @@
26842760 }
26852761 
26862762 #ifdef CONFIG_COMPAT
2763
+
2764
+struct serial_struct32 {
2765
+	compat_int_t    type;
2766
+	compat_int_t    line;
2767
+	compat_uint_t   port;
2768
+	compat_int_t    irq;
2769
+	compat_int_t    flags;
2770
+	compat_int_t    xmit_fifo_size;
2771
+	compat_int_t    custom_divisor;
2772
+	compat_int_t    baud_base;
2773
+	unsigned short  close_delay;
2774
+	char    io_type;
2775
+	char    reserved_char;
2776
+	compat_int_t    hub6;
2777
+	unsigned short  closing_wait; /* time to wait before closing */
2778
+	unsigned short  closing_wait2; /* no longer used... */
2779
+	compat_uint_t   iomem_base;
2780
+	unsigned short  iomem_reg_shift;
2781
+	unsigned int    port_high;
2782
+	/* compat_ulong_t  iomap_base FIXME */
2783
+	compat_int_t    reserved;
2784
+};
2785
+
2786
+static int compat_tty_tiocsserial(struct tty_struct *tty,
2787
+		struct serial_struct32 __user *ss)
2788
+{
2789
+	static DEFINE_RATELIMIT_STATE(depr_flags,
2790
+			DEFAULT_RATELIMIT_INTERVAL,
2791
+			DEFAULT_RATELIMIT_BURST);
2792
+	char comm[TASK_COMM_LEN];
2793
+	struct serial_struct32 v32;
2794
+	struct serial_struct v;
2795
+	int flags;
2796
+
2797
+	if (copy_from_user(&v32, ss, sizeof(*ss)))
2798
+		return -EFAULT;
2799
+
2800
+	memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
2801
+	v.iomem_base = compat_ptr(v32.iomem_base);
2802
+	v.iomem_reg_shift = v32.iomem_reg_shift;
2803
+	v.port_high = v32.port_high;
2804
+	v.iomap_base = 0;
2805
+
2806
+	flags = v.flags & ASYNC_DEPRECATED;
2807
+
2808
+	if (flags && __ratelimit(&depr_flags))
2809
+		pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2810
+			__func__, get_task_comm(comm, current), flags);
2811
+	if (!tty->ops->set_serial)
2812
+		return -ENOTTY;
2813
+	return tty->ops->set_serial(tty, &v);
2814
+}
2815
+
2816
+static int compat_tty_tiocgserial(struct tty_struct *tty,
2817
+			struct serial_struct32 __user *ss)
2818
+{
2819
+	struct serial_struct32 v32;
2820
+	struct serial_struct v;
2821
+	int err;
2822
+
2823
+	memset(&v, 0, sizeof(v));
2824
+	memset(&v32, 0, sizeof(v32));
2825
+
2826
+	if (!tty->ops->get_serial)
2827
+		return -ENOTTY;
2828
+	err = tty->ops->get_serial(tty, &v);
2829
+	if (!err) {
2830
+		memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
2831
+		v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
2832
+			0xfffffff : ptr_to_compat(v.iomem_base);
2833
+		v32.iomem_reg_shift = v.iomem_reg_shift;
2834
+		v32.port_high = v.port_high;
2835
+		if (copy_to_user(ss, &v32, sizeof(v32)))
2836
+			err = -EFAULT;
2837
+	}
2838
+	return err;
2839
+}
26872840 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
26882841 				unsigned long arg)
26892842 {
....@@ -2691,9 +2844,94 @@
26912844 	struct tty_ldisc *ld;
26922845 	int retval = -ENOIOCTLCMD;
26932846 
2847
+	switch (cmd) {
2848
+	case TIOCOUTQ:
2849
+	case TIOCSTI:
2850
+	case TIOCGWINSZ:
2851
+	case TIOCSWINSZ:
2852
+	case TIOCGEXCL:
2853
+	case TIOCGETD:
2854
+	case TIOCSETD:
2855
+	case TIOCGDEV:
2856
+	case TIOCMGET:
2857
+	case TIOCMSET:
2858
+	case TIOCMBIC:
2859
+	case TIOCMBIS:
2860
+	case TIOCGICOUNT:
2861
+	case TIOCGPGRP:
2862
+	case TIOCSPGRP:
2863
+	case TIOCGSID:
2864
+	case TIOCSERGETLSR:
2865
+	case TIOCGRS485:
2866
+	case TIOCSRS485:
2867
+#ifdef TIOCGETP
2868
+	case TIOCGETP:
2869
+	case TIOCSETP:
2870
+	case TIOCSETN:
2871
+#endif
2872
+#ifdef TIOCGETC
2873
+	case TIOCGETC:
2874
+	case TIOCSETC:
2875
+#endif
2876
+#ifdef TIOCGLTC
2877
+	case TIOCGLTC:
2878
+	case TIOCSLTC:
2879
+#endif
2880
+	case TCSETSF:
2881
+	case TCSETSW:
2882
+	case TCSETS:
2883
+	case TCGETS:
2884
+#ifdef TCGETS2
2885
+	case TCGETS2:
2886
+	case TCSETSF2:
2887
+	case TCSETSW2:
2888
+	case TCSETS2:
2889
+#endif
2890
+	case TCGETA:
2891
+	case TCSETAF:
2892
+	case TCSETAW:
2893
+	case TCSETA:
2894
+	case TIOCGLCKTRMIOS:
2895
+	case TIOCSLCKTRMIOS:
2896
+#ifdef TCGETX
2897
+	case TCGETX:
2898
+	case TCSETX:
2899
+	case TCSETXW:
2900
+	case TCSETXF:
2901
+#endif
2902
+	case TIOCGSOFTCAR:
2903
+	case TIOCSSOFTCAR:
2904
+
2905
+	case PPPIOCGCHAN:
2906
+	case PPPIOCGUNIT:
2907
+		return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
2908
+	case TIOCCONS:
2909
+	case TIOCEXCL:
2910
+	case TIOCNXCL:
2911
+	case TIOCVHANGUP:
2912
+	case TIOCSBRK:
2913
+	case TIOCCBRK:
2914
+	case TCSBRK:
2915
+	case TCSBRKP:
2916
+	case TCFLSH:
2917
+	case TIOCGPTPEER:
2918
+	case TIOCNOTTY:
2919
+	case TIOCSCTTY:
2920
+	case TCXONC:
2921
+	case TIOCMIWAIT:
2922
+	case TIOCSERCONFIG:
2923
+		return tty_ioctl(file, cmd, arg);
2924
+	}
2925
+
26942926 	if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
26952927 		return -EINVAL;
26962928 
2929
+	switch (cmd) {
2930
+	case TIOCSSERIAL:
2931
+		return compat_tty_tiocsserial(tty, compat_ptr(arg));
2932
+	case TIOCGSERIAL:
2933
+		return compat_tty_tiocgserial(tty, compat_ptr(arg));
2934
+	}
26972935 	if (tty->ops->compat_ioctl) {
26982936 		retval = tty->ops->compat_ioctl(tty, cmd, arg);
26992937 		if (retval != -ENOIOCTLCMD)
....@@ -2705,8 +2943,9 @@
27052943 		return hung_up_tty_compat_ioctl(file, cmd, arg);
27062944 	if (ld->ops->compat_ioctl)
27072945 		retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2708
-	else
2709
-		retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2946
+	if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
2947
+		retval = ld->ops->ioctl(tty, file,
2948
+				(unsigned long)compat_ptr(cmd), arg);
27102949 	tty_ldisc_deref(ld);
27112950 
27122951 	return retval;
....@@ -2715,7 +2954,7 @@
27152954 
27162955 static int this_tty(const void *t, struct file *file, unsigned fd)
27172956 {
2718
-	if (likely(file->f_op->read != tty_read))
2957
+	if (likely(file->f_op->read_iter != tty_read))
27192958 		return 0;
27202959 	return file_tty(file) != t ? 0 : fd + 1;
27212960 }
....@@ -2765,7 +3004,7 @@
27653004 	do_each_pid_task(session, PIDTYPE_SID, p) {
27663005 		tty_notice(tty, "SAK: killed process %d (%s): by session\n",
27673006 			   task_pid_nr(p), p->comm);
2768
-		send_sig(SIGKILL, p, 1);
3007
+		group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
27693008 	} while_each_pid_task(session, PIDTYPE_SID, p);
27703009 
27713010 	/* Now kill any processes that happen to have the tty open */
....@@ -2773,7 +3012,7 @@
27733012 		if (p->signal->tty == tty) {
27743013 			tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
27753014 				   task_pid_nr(p), p->comm);
2776
-			send_sig(SIGKILL, p, 1);
3015
+			group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
27773016 			continue;
27783017 		}
27793018 		task_lock(p);
....@@ -2781,7 +3020,7 @@
27813020 		if (i != 0) {
27823021 			tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
27833022 				   task_pid_nr(p), p->comm, i - 1);
2784
-			force_sig(SIGKILL, p);
3023
+			group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
27853024 		}
27863025 		task_unlock(p);
27873026 	} while_each_thread(g, p);
....@@ -2812,17 +3051,11 @@
28123051 
28133052 EXPORT_SYMBOL(do_SAK);
28143053 
2815
-static int dev_match_devt(struct device *dev, const void *data)
2816
-{
2817
-	const dev_t *devt = data;
2818
-	return dev->devt == *devt;
2819
-}
2820
-
28213054 /* Must put_device() after it's unused! */
28223055 static struct device *tty_get_device(struct tty_struct *tty)
28233056 {
28243057 	dev_t devt = tty_devnum(tty);
2825
-	return class_find_device(tty_class, NULL, &devt, dev_match_devt);
3058
+	return class_find_device_by_devt(tty_class, devt);
28263059 }
28273060 
28283061 
....@@ -3076,7 +3309,7 @@
30763309 	if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
30773310 		return ERR_PTR(-EINVAL);
30783311 
3079
-	driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3312
+	driver = kzalloc(sizeof(*driver), GFP_KERNEL);
30803313 	if (!driver)
30813314 		return ERR_PTR(-ENOMEM);
30823315