tty: release_one_tty() forgets to put pids
[linux-2.6.git] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  *
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc()
66  *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
67  */
68
69 #include <linux/types.h>
70 #include <linux/major.h>
71 #include <linux/errno.h>
72 #include <linux/signal.h>
73 #include <linux/fcntl.h>
74 #include <linux/sched.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/fdtable.h>
82 #include <linux/console.h>
83 #include <linux/timer.h>
84 #include <linux/ctype.h>
85 #include <linux/kd.h>
86 #include <linux/mm.h>
87 #include <linux/string.h>
88 #include <linux/slab.h>
89 #include <linux/poll.h>
90 #include <linux/proc_fs.h>
91 #include <linux/init.h>
92 #include <linux/module.h>
93 #include <linux/smp_lock.h>
94 #include <linux/device.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98 #include <linux/seq_file.h>
99
100 #include <linux/uaccess.h>
101 #include <asm/system.h>
102
103 #include <linux/kbd_kern.h>
104 #include <linux/vt_kern.h>
105 #include <linux/selection.h>
106
107 #include <linux/kmod.h>
108 #include <linux/nsproxy.h>
109
110 #undef TTY_DEBUG_HANGUP
111
112 #define TTY_PARANOIA_CHECK 1
113 #define CHECK_TTY_COUNT 1
114
115 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
116         .c_iflag = ICRNL | IXON,
117         .c_oflag = OPOST | ONLCR,
118         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
119         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
120                    ECHOCTL | ECHOKE | IEXTEN,
121         .c_cc = INIT_C_CC,
122         .c_ispeed = 38400,
123         .c_ospeed = 38400
124 };
125
126 EXPORT_SYMBOL(tty_std_termios);
127
128 /* This list gets poked at by procfs and various bits of boot up code. This
129    could do with some rationalisation such as pulling the tty proc function
130    into this file */
131
132 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
133
134 /* Mutex to protect creating and releasing a tty. This is shared with
135    vt.c for deeply disgusting hack reasons */
136 DEFINE_MUTEX(tty_mutex);
137 EXPORT_SYMBOL(tty_mutex);
138
139 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
140 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
141 ssize_t redirected_tty_write(struct file *, const char __user *,
142                                                         size_t, loff_t *);
143 static unsigned int tty_poll(struct file *, poll_table *);
144 static int tty_open(struct inode *, struct file *);
145 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
146 #ifdef CONFIG_COMPAT
147 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
148                                 unsigned long arg);
149 #else
150 #define tty_compat_ioctl NULL
151 #endif
152 static int tty_fasync(int fd, struct file *filp, int on);
153 static void release_tty(struct tty_struct *tty, int idx);
154 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
155 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
156
157 /**
158  *      alloc_tty_struct        -       allocate a tty object
159  *
160  *      Return a new empty tty structure. The data fields have not
161  *      been initialized in any way but has been zeroed
162  *
163  *      Locking: none
164  */
165
166 struct tty_struct *alloc_tty_struct(void)
167 {
168         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
169 }
170
171 /**
172  *      free_tty_struct         -       free a disused tty
173  *      @tty: tty struct to free
174  *
175  *      Free the write buffers, tty queue and tty memory itself.
176  *
177  *      Locking: none. Must be called after tty is definitely unused
178  */
179
180 void free_tty_struct(struct tty_struct *tty)
181 {
182         kfree(tty->write_buf);
183         tty_buffer_free_all(tty);
184         kfree(tty);
185 }
186
187 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
188
189 /**
190  *      tty_name        -       return tty naming
191  *      @tty: tty structure
192  *      @buf: buffer for output
193  *
194  *      Convert a tty structure into a name. The name reflects the kernel
195  *      naming policy and if udev is in use may not reflect user space
196  *
197  *      Locking: none
198  */
199
200 char *tty_name(struct tty_struct *tty, char *buf)
201 {
202         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
203                 strcpy(buf, "NULL tty");
204         else
205                 strcpy(buf, tty->name);
206         return buf;
207 }
208
209 EXPORT_SYMBOL(tty_name);
210
211 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
212                               const char *routine)
213 {
214 #ifdef TTY_PARANOIA_CHECK
215         if (!tty) {
216                 printk(KERN_WARNING
217                         "null TTY for (%d:%d) in %s\n",
218                         imajor(inode), iminor(inode), routine);
219                 return 1;
220         }
221         if (tty->magic != TTY_MAGIC) {
222                 printk(KERN_WARNING
223                         "bad magic number for tty struct (%d:%d) in %s\n",
224                         imajor(inode), iminor(inode), routine);
225                 return 1;
226         }
227 #endif
228         return 0;
229 }
230
231 static int check_tty_count(struct tty_struct *tty, const char *routine)
232 {
233 #ifdef CHECK_TTY_COUNT
234         struct list_head *p;
235         int count = 0;
236
237         file_list_lock();
238         list_for_each(p, &tty->tty_files) {
239                 count++;
240         }
241         file_list_unlock();
242         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
243             tty->driver->subtype == PTY_TYPE_SLAVE &&
244             tty->link && tty->link->count)
245                 count++;
246         if (tty->count != count) {
247                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
248                                     "!= #fd's(%d) in %s\n",
249                        tty->name, tty->count, count, routine);
250                 return count;
251         }
252 #endif
253         return 0;
254 }
255
256 /**
257  *      get_tty_driver          -       find device of a tty
258  *      @dev_t: device identifier
259  *      @index: returns the index of the tty
260  *
261  *      This routine returns a tty driver structure, given a device number
262  *      and also passes back the index number.
263  *
264  *      Locking: caller must hold tty_mutex
265  */
266
267 static struct tty_driver *get_tty_driver(dev_t device, int *index)
268 {
269         struct tty_driver *p;
270
271         list_for_each_entry(p, &tty_drivers, tty_drivers) {
272                 dev_t base = MKDEV(p->major, p->minor_start);
273                 if (device < base || device >= base + p->num)
274                         continue;
275                 *index = device - base;
276                 return tty_driver_kref_get(p);
277         }
278         return NULL;
279 }
280
281 #ifdef CONFIG_CONSOLE_POLL
282
283 /**
284  *      tty_find_polling_driver -       find device of a polled tty
285  *      @name: name string to match
286  *      @line: pointer to resulting tty line nr
287  *
288  *      This routine returns a tty driver structure, given a name
289  *      and the condition that the tty driver is capable of polled
290  *      operation.
291  */
292 struct tty_driver *tty_find_polling_driver(char *name, int *line)
293 {
294         struct tty_driver *p, *res = NULL;
295         int tty_line = 0;
296         int len;
297         char *str, *stp;
298
299         for (str = name; *str; str++)
300                 if ((*str >= '0' && *str <= '9') || *str == ',')
301                         break;
302         if (!*str)
303                 return NULL;
304
305         len = str - name;
306         tty_line = simple_strtoul(str, &str, 10);
307
308         mutex_lock(&tty_mutex);
309         /* Search through the tty devices to look for a match */
310         list_for_each_entry(p, &tty_drivers, tty_drivers) {
311                 if (strncmp(name, p->name, len) != 0)
312                         continue;
313                 stp = str;
314                 if (*stp == ',')
315                         stp++;
316                 if (*stp == '\0')
317                         stp = NULL;
318
319                 if (tty_line >= 0 && tty_line <= p->num && p->ops &&
320                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
321                         res = tty_driver_kref_get(p);
322                         *line = tty_line;
323                         break;
324                 }
325         }
326         mutex_unlock(&tty_mutex);
327
328         return res;
329 }
330 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
331 #endif
332
333 /**
334  *      tty_check_change        -       check for POSIX terminal changes
335  *      @tty: tty to check
336  *
337  *      If we try to write to, or set the state of, a terminal and we're
338  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
339  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
340  *
341  *      Locking: ctrl_lock
342  */
343
344 int tty_check_change(struct tty_struct *tty)
345 {
346         unsigned long flags;
347         int ret = 0;
348
349         if (current->signal->tty != tty)
350                 return 0;
351
352         spin_lock_irqsave(&tty->ctrl_lock, flags);
353
354         if (!tty->pgrp) {
355                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
356                 goto out_unlock;
357         }
358         if (task_pgrp(current) == tty->pgrp)
359                 goto out_unlock;
360         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
361         if (is_ignored(SIGTTOU))
362                 goto out;
363         if (is_current_pgrp_orphaned()) {
364                 ret = -EIO;
365                 goto out;
366         }
367         kill_pgrp(task_pgrp(current), SIGTTOU, 1);
368         set_thread_flag(TIF_SIGPENDING);
369         ret = -ERESTARTSYS;
370 out:
371         return ret;
372 out_unlock:
373         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
374         return ret;
375 }
376
377 EXPORT_SYMBOL(tty_check_change);
378
379 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
380                                 size_t count, loff_t *ppos)
381 {
382         return 0;
383 }
384
385 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
386                                  size_t count, loff_t *ppos)
387 {
388         return -EIO;
389 }
390
391 /* No kernel lock held - none needed ;) */
392 static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
393 {
394         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
395 }
396
397 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
398                 unsigned long arg)
399 {
400         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
401 }
402
403 static long hung_up_tty_compat_ioctl(struct file *file,
404                                      unsigned int cmd, unsigned long arg)
405 {
406         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
407 }
408
409 static const struct file_operations tty_fops = {
410         .llseek         = no_llseek,
411         .read           = tty_read,
412         .write          = tty_write,
413         .poll           = tty_poll,
414         .unlocked_ioctl = tty_ioctl,
415         .compat_ioctl   = tty_compat_ioctl,
416         .open           = tty_open,
417         .release        = tty_release,
418         .fasync         = tty_fasync,
419 };
420
421 static const struct file_operations console_fops = {
422         .llseek         = no_llseek,
423         .read           = tty_read,
424         .write          = redirected_tty_write,
425         .poll           = tty_poll,
426         .unlocked_ioctl = tty_ioctl,
427         .compat_ioctl   = tty_compat_ioctl,
428         .open           = tty_open,
429         .release        = tty_release,
430         .fasync         = tty_fasync,
431 };
432
433 static const struct file_operations hung_up_tty_fops = {
434         .llseek         = no_llseek,
435         .read           = hung_up_tty_read,
436         .write          = hung_up_tty_write,
437         .poll           = hung_up_tty_poll,
438         .unlocked_ioctl = hung_up_tty_ioctl,
439         .compat_ioctl   = hung_up_tty_compat_ioctl,
440         .release        = tty_release,
441 };
442
443 static DEFINE_SPINLOCK(redirect_lock);
444 static struct file *redirect;
445
446 /**
447  *      tty_wakeup      -       request more data
448  *      @tty: terminal
449  *
450  *      Internal and external helper for wakeups of tty. This function
451  *      informs the line discipline if present that the driver is ready
452  *      to receive more output data.
453  */
454
455 void tty_wakeup(struct tty_struct *tty)
456 {
457         struct tty_ldisc *ld;
458
459         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
460                 ld = tty_ldisc_ref(tty);
461                 if (ld) {
462                         if (ld->ops->write_wakeup)
463                                 ld->ops->write_wakeup(tty);
464                         tty_ldisc_deref(ld);
465                 }
466         }
467         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
468 }
469
470 EXPORT_SYMBOL_GPL(tty_wakeup);
471
472 /**
473  *      do_tty_hangup           -       actual handler for hangup events
474  *      @work: tty device
475  *
476  *      This can be called by the "eventd" kernel thread.  That is process
477  *      synchronous but doesn't hold any locks, so we need to make sure we
478  *      have the appropriate locks for what we're doing.
479  *
480  *      The hangup event clears any pending redirections onto the hung up
481  *      device. It ensures future writes will error and it does the needed
482  *      line discipline hangup and signal delivery. The tty object itself
483  *      remains intact.
484  *
485  *      Locking:
486  *              BKL
487  *                redirect lock for undoing redirection
488  *                file list lock for manipulating list of ttys
489  *                tty_ldisc_lock from called functions
490  *                termios_mutex resetting termios data
491  *                tasklist_lock to walk task list for hangup event
492  *                  ->siglock to protect ->signal/->sighand
493  */
494 static void do_tty_hangup(struct work_struct *work)
495 {
496         struct tty_struct *tty =
497                 container_of(work, struct tty_struct, hangup_work);
498         struct file *cons_filp = NULL;
499         struct file *filp, *f = NULL;
500         struct task_struct *p;
501         int    closecount = 0, n;
502         unsigned long flags;
503         int refs = 0;
504
505         if (!tty)
506                 return;
507
508
509         spin_lock(&redirect_lock);
510         if (redirect && redirect->private_data == tty) {
511                 f = redirect;
512                 redirect = NULL;
513         }
514         spin_unlock(&redirect_lock);
515
516         /* inuse_filps is protected by the single kernel lock */
517         lock_kernel();
518         check_tty_count(tty, "do_tty_hangup");
519
520         file_list_lock();
521         /* This breaks for file handles being sent over AF_UNIX sockets ? */
522         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
523                 if (filp->f_op->write == redirected_tty_write)
524                         cons_filp = filp;
525                 if (filp->f_op->write != tty_write)
526                         continue;
527                 closecount++;
528                 tty_fasync(-1, filp, 0);        /* can't block */
529                 filp->f_op = &hung_up_tty_fops;
530         }
531         file_list_unlock();
532
533         tty_ldisc_hangup(tty);
534
535         read_lock(&tasklist_lock);
536         if (tty->session) {
537                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
538                         spin_lock_irq(&p->sighand->siglock);
539                         if (p->signal->tty == tty) {
540                                 p->signal->tty = NULL;
541                                 /* We defer the dereferences outside fo
542                                    the tasklist lock */
543                                 refs++;
544                         }
545                         if (!p->signal->leader) {
546                                 spin_unlock_irq(&p->sighand->siglock);
547                                 continue;
548                         }
549                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
550                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
551                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
552                         spin_lock_irqsave(&tty->ctrl_lock, flags);
553                         if (tty->pgrp)
554                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
555                         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
556                         spin_unlock_irq(&p->sighand->siglock);
557                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
558         }
559         read_unlock(&tasklist_lock);
560
561         spin_lock_irqsave(&tty->ctrl_lock, flags);
562         clear_bit(TTY_THROTTLED, &tty->flags);
563         clear_bit(TTY_PUSH, &tty->flags);
564         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
565         put_pid(tty->session);
566         put_pid(tty->pgrp);
567         tty->session = NULL;
568         tty->pgrp = NULL;
569         tty->ctrl_status = 0;
570         set_bit(TTY_HUPPED, &tty->flags);
571         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
572
573         /* Account for the p->signal references we killed */
574         while (refs--)
575                 tty_kref_put(tty);
576
577         /*
578          * If one of the devices matches a console pointer, we
579          * cannot just call hangup() because that will cause
580          * tty->count and state->count to go out of sync.
581          * So we just call close() the right number of times.
582          */
583         if (cons_filp) {
584                 if (tty->ops->close)
585                         for (n = 0; n < closecount; n++)
586                                 tty->ops->close(tty, cons_filp);
587         } else if (tty->ops->hangup)
588                 (tty->ops->hangup)(tty);
589         /*
590          * We don't want to have driver/ldisc interactions beyond
591          * the ones we did here. The driver layer expects no
592          * calls after ->hangup() from the ldisc side. However we
593          * can't yet guarantee all that.
594          */
595         set_bit(TTY_HUPPED, &tty->flags);
596         tty_ldisc_enable(tty);
597         unlock_kernel();
598         if (f)
599                 fput(f);
600 }
601
602 /**
603  *      tty_hangup              -       trigger a hangup event
604  *      @tty: tty to hangup
605  *
606  *      A carrier loss (virtual or otherwise) has occurred on this like
607  *      schedule a hangup sequence to run after this event.
608  */
609
610 void tty_hangup(struct tty_struct *tty)
611 {
612 #ifdef TTY_DEBUG_HANGUP
613         char    buf[64];
614         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
615 #endif
616         schedule_work(&tty->hangup_work);
617 }
618
619 EXPORT_SYMBOL(tty_hangup);
620
621 /**
622  *      tty_vhangup             -       process vhangup
623  *      @tty: tty to hangup
624  *
625  *      The user has asked via system call for the terminal to be hung up.
626  *      We do this synchronously so that when the syscall returns the process
627  *      is complete. That guarantee is necessary for security reasons.
628  */
629
630 void tty_vhangup(struct tty_struct *tty)
631 {
632 #ifdef TTY_DEBUG_HANGUP
633         char    buf[64];
634
635         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
636 #endif
637         do_tty_hangup(&tty->hangup_work);
638 }
639
640 EXPORT_SYMBOL(tty_vhangup);
641
642 /**
643  *      tty_vhangup_self        -       process vhangup for own ctty
644  *
645  *      Perform a vhangup on the current controlling tty
646  */
647
648 void tty_vhangup_self(void)
649 {
650         struct tty_struct *tty;
651
652         tty = get_current_tty();
653         if (tty) {
654                 tty_vhangup(tty);
655                 tty_kref_put(tty);
656         }
657 }
658
659 /**
660  *      tty_hung_up_p           -       was tty hung up
661  *      @filp: file pointer of tty
662  *
663  *      Return true if the tty has been subject to a vhangup or a carrier
664  *      loss
665  */
666
667 int tty_hung_up_p(struct file *filp)
668 {
669         return (filp->f_op == &hung_up_tty_fops);
670 }
671
672 EXPORT_SYMBOL(tty_hung_up_p);
673
674 static void session_clear_tty(struct pid *session)
675 {
676         struct task_struct *p;
677         do_each_pid_task(session, PIDTYPE_SID, p) {
678                 proc_clear_tty(p);
679         } while_each_pid_task(session, PIDTYPE_SID, p);
680 }
681
682 /**
683  *      disassociate_ctty       -       disconnect controlling tty
684  *      @on_exit: true if exiting so need to "hang up" the session
685  *
686  *      This function is typically called only by the session leader, when
687  *      it wants to disassociate itself from its controlling tty.
688  *
689  *      It performs the following functions:
690  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
691  *      (2)  Clears the tty from being controlling the session
692  *      (3)  Clears the controlling tty for all processes in the
693  *              session group.
694  *
695  *      The argument on_exit is set to 1 if called when a process is
696  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
697  *
698  *      Locking:
699  *              BKL is taken for hysterical raisins
700  *                tty_mutex is taken to protect tty
701  *                ->siglock is taken to protect ->signal/->sighand
702  *                tasklist_lock is taken to walk process list for sessions
703  *                  ->siglock is taken to protect ->signal/->sighand
704  */
705
706 void disassociate_ctty(int on_exit)
707 {
708         struct tty_struct *tty;
709         struct pid *tty_pgrp = NULL;
710
711         if (!current->signal->leader)
712                 return;
713
714         tty = get_current_tty();
715         if (tty) {
716                 tty_pgrp = get_pid(tty->pgrp);
717                 lock_kernel();
718                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
719                         tty_vhangup(tty);
720                 unlock_kernel();
721                 tty_kref_put(tty);
722         } else if (on_exit) {
723                 struct pid *old_pgrp;
724                 spin_lock_irq(&current->sighand->siglock);
725                 old_pgrp = current->signal->tty_old_pgrp;
726                 current->signal->tty_old_pgrp = NULL;
727                 spin_unlock_irq(&current->sighand->siglock);
728                 if (old_pgrp) {
729                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
730                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
731                         put_pid(old_pgrp);
732                 }
733                 return;
734         }
735         if (tty_pgrp) {
736                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
737                 if (!on_exit)
738                         kill_pgrp(tty_pgrp, SIGCONT, on_exit);
739                 put_pid(tty_pgrp);
740         }
741
742         spin_lock_irq(&current->sighand->siglock);
743         put_pid(current->signal->tty_old_pgrp);
744         current->signal->tty_old_pgrp = NULL;
745         spin_unlock_irq(&current->sighand->siglock);
746
747         tty = get_current_tty();
748         if (tty) {
749                 unsigned long flags;
750                 spin_lock_irqsave(&tty->ctrl_lock, flags);
751                 put_pid(tty->session);
752                 put_pid(tty->pgrp);
753                 tty->session = NULL;
754                 tty->pgrp = NULL;
755                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
756                 tty_kref_put(tty);
757         } else {
758 #ifdef TTY_DEBUG_HANGUP
759                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
760                        " = NULL", tty);
761 #endif
762         }
763
764         /* Now clear signal->tty under the lock */
765         read_lock(&tasklist_lock);
766         session_clear_tty(task_session(current));
767         read_unlock(&tasklist_lock);
768 }
769
770 /**
771  *
772  *      no_tty  - Ensure the current process does not have a controlling tty
773  */
774 void no_tty(void)
775 {
776         struct task_struct *tsk = current;
777         lock_kernel();
778         disassociate_ctty(0);
779         unlock_kernel();
780         proc_clear_tty(tsk);
781 }
782
783
784 /**
785  *      stop_tty        -       propagate flow control
786  *      @tty: tty to stop
787  *
788  *      Perform flow control to the driver. For PTY/TTY pairs we
789  *      must also propagate the TIOCKPKT status. May be called
790  *      on an already stopped device and will not re-call the driver
791  *      method.
792  *
793  *      This functionality is used by both the line disciplines for
794  *      halting incoming flow and by the driver. It may therefore be
795  *      called from any context, may be under the tty atomic_write_lock
796  *      but not always.
797  *
798  *      Locking:
799  *              Uses the tty control lock internally
800  */
801
802 void stop_tty(struct tty_struct *tty)
803 {
804         unsigned long flags;
805         spin_lock_irqsave(&tty->ctrl_lock, flags);
806         if (tty->stopped) {
807                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
808                 return;
809         }
810         tty->stopped = 1;
811         if (tty->link && tty->link->packet) {
812                 tty->ctrl_status &= ~TIOCPKT_START;
813                 tty->ctrl_status |= TIOCPKT_STOP;
814                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
815         }
816         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
817         if (tty->ops->stop)
818                 (tty->ops->stop)(tty);
819 }
820
821 EXPORT_SYMBOL(stop_tty);
822
823 /**
824  *      start_tty       -       propagate flow control
825  *      @tty: tty to start
826  *
827  *      Start a tty that has been stopped if at all possible. Perform
828  *      any necessary wakeups and propagate the TIOCPKT status. If this
829  *      is the tty was previous stopped and is being started then the
830  *      driver start method is invoked and the line discipline woken.
831  *
832  *      Locking:
833  *              ctrl_lock
834  */
835
836 void start_tty(struct tty_struct *tty)
837 {
838         unsigned long flags;
839         spin_lock_irqsave(&tty->ctrl_lock, flags);
840         if (!tty->stopped || tty->flow_stopped) {
841                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
842                 return;
843         }
844         tty->stopped = 0;
845         if (tty->link && tty->link->packet) {
846                 tty->ctrl_status &= ~TIOCPKT_STOP;
847                 tty->ctrl_status |= TIOCPKT_START;
848                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
849         }
850         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
851         if (tty->ops->start)
852                 (tty->ops->start)(tty);
853         /* If we have a running line discipline it may need kicking */
854         tty_wakeup(tty);
855 }
856
857 EXPORT_SYMBOL(start_tty);
858
859 /**
860  *      tty_read        -       read method for tty device files
861  *      @file: pointer to tty file
862  *      @buf: user buffer
863  *      @count: size of user buffer
864  *      @ppos: unused
865  *
866  *      Perform the read system call function on this terminal device. Checks
867  *      for hung up devices before calling the line discipline method.
868  *
869  *      Locking:
870  *              Locks the line discipline internally while needed. Multiple
871  *      read calls may be outstanding in parallel.
872  */
873
874 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
875                         loff_t *ppos)
876 {
877         int i;
878         struct tty_struct *tty;
879         struct inode *inode;
880         struct tty_ldisc *ld;
881
882         tty = (struct tty_struct *)file->private_data;
883         inode = file->f_path.dentry->d_inode;
884         if (tty_paranoia_check(tty, inode, "tty_read"))
885                 return -EIO;
886         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
887                 return -EIO;
888
889         /* We want to wait for the line discipline to sort out in this
890            situation */
891         ld = tty_ldisc_ref_wait(tty);
892         if (ld->ops->read)
893                 i = (ld->ops->read)(tty, file, buf, count);
894         else
895                 i = -EIO;
896         tty_ldisc_deref(ld);
897         if (i > 0)
898                 inode->i_atime = current_fs_time(inode->i_sb);
899         return i;
900 }
901
902 void tty_write_unlock(struct tty_struct *tty)
903 {
904         mutex_unlock(&tty->atomic_write_lock);
905         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
906 }
907
908 int tty_write_lock(struct tty_struct *tty, int ndelay)
909 {
910         if (!mutex_trylock(&tty->atomic_write_lock)) {
911                 if (ndelay)
912                         return -EAGAIN;
913                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
914                         return -ERESTARTSYS;
915         }
916         return 0;
917 }
918
919 /*
920  * Split writes up in sane blocksizes to avoid
921  * denial-of-service type attacks
922  */
923 static inline ssize_t do_tty_write(
924         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
925         struct tty_struct *tty,
926         struct file *file,
927         const char __user *buf,
928         size_t count)
929 {
930         ssize_t ret, written = 0;
931         unsigned int chunk;
932
933         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
934         if (ret < 0)
935                 return ret;
936
937         /*
938          * We chunk up writes into a temporary buffer. This
939          * simplifies low-level drivers immensely, since they
940          * don't have locking issues and user mode accesses.
941          *
942          * But if TTY_NO_WRITE_SPLIT is set, we should use a
943          * big chunk-size..
944          *
945          * The default chunk-size is 2kB, because the NTTY
946          * layer has problems with bigger chunks. It will
947          * claim to be able to handle more characters than
948          * it actually does.
949          *
950          * FIXME: This can probably go away now except that 64K chunks
951          * are too likely to fail unless switched to vmalloc...
952          */
953         chunk = 2048;
954         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
955                 chunk = 65536;
956         if (count < chunk)
957                 chunk = count;
958
959         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
960         if (tty->write_cnt < chunk) {
961                 unsigned char *buf_chunk;
962
963                 if (chunk < 1024)
964                         chunk = 1024;
965
966                 buf_chunk = kmalloc(chunk, GFP_KERNEL);
967                 if (!buf_chunk) {
968                         ret = -ENOMEM;
969                         goto out;
970                 }
971                 kfree(tty->write_buf);
972                 tty->write_cnt = chunk;
973                 tty->write_buf = buf_chunk;
974         }
975
976         /* Do the write .. */
977         for (;;) {
978                 size_t size = count;
979                 if (size > chunk)
980                         size = chunk;
981                 ret = -EFAULT;
982                 if (copy_from_user(tty->write_buf, buf, size))
983                         break;
984                 ret = write(tty, file, tty->write_buf, size);
985                 if (ret <= 0)
986                         break;
987                 written += ret;
988                 buf += ret;
989                 count -= ret;
990                 if (!count)
991                         break;
992                 ret = -ERESTARTSYS;
993                 if (signal_pending(current))
994                         break;
995                 cond_resched();
996         }
997         if (written) {
998                 struct inode *inode = file->f_path.dentry->d_inode;
999                 inode->i_mtime = current_fs_time(inode->i_sb);
1000                 ret = written;
1001         }
1002 out:
1003         tty_write_unlock(tty);
1004         return ret;
1005 }
1006
1007 /**
1008  * tty_write_message - write a message to a certain tty, not just the console.
1009  * @tty: the destination tty_struct
1010  * @msg: the message to write
1011  *
1012  * This is used for messages that need to be redirected to a specific tty.
1013  * We don't put it into the syslog queue right now maybe in the future if
1014  * really needed.
1015  *
1016  * We must still hold the BKL and test the CLOSING flag for the moment.
1017  */
1018
1019 void tty_write_message(struct tty_struct *tty, char *msg)
1020 {
1021         if (tty) {
1022                 mutex_lock(&tty->atomic_write_lock);
1023                 lock_kernel();
1024                 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1025                         unlock_kernel();
1026                         tty->ops->write(tty, msg, strlen(msg));
1027                 } else
1028                         unlock_kernel();
1029                 tty_write_unlock(tty);
1030         }
1031         return;
1032 }
1033
1034
1035 /**
1036  *      tty_write               -       write method for tty device file
1037  *      @file: tty file pointer
1038  *      @buf: user data to write
1039  *      @count: bytes to write
1040  *      @ppos: unused
1041  *
1042  *      Write data to a tty device via the line discipline.
1043  *
1044  *      Locking:
1045  *              Locks the line discipline as required
1046  *              Writes to the tty driver are serialized by the atomic_write_lock
1047  *      and are then processed in chunks to the device. The line discipline
1048  *      write method will not be invoked in parallel for each device.
1049  */
1050
1051 static ssize_t tty_write(struct file *file, const char __user *buf,
1052                                                 size_t count, loff_t *ppos)
1053 {
1054         struct tty_struct *tty;
1055         struct inode *inode = file->f_path.dentry->d_inode;
1056         ssize_t ret;
1057         struct tty_ldisc *ld;
1058
1059         tty = (struct tty_struct *)file->private_data;
1060         if (tty_paranoia_check(tty, inode, "tty_write"))
1061                 return -EIO;
1062         if (!tty || !tty->ops->write ||
1063                 (test_bit(TTY_IO_ERROR, &tty->flags)))
1064                         return -EIO;
1065         /* Short term debug to catch buggy drivers */
1066         if (tty->ops->write_room == NULL)
1067                 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1068                         tty->driver->name);
1069         ld = tty_ldisc_ref_wait(tty);
1070         if (!ld->ops->write)
1071                 ret = -EIO;
1072         else
1073                 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1074         tty_ldisc_deref(ld);
1075         return ret;
1076 }
1077
1078 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1079                                                 size_t count, loff_t *ppos)
1080 {
1081         struct file *p = NULL;
1082
1083         spin_lock(&redirect_lock);
1084         if (redirect) {
1085                 get_file(redirect);
1086                 p = redirect;
1087         }
1088         spin_unlock(&redirect_lock);
1089
1090         if (p) {
1091                 ssize_t res;
1092                 res = vfs_write(p, buf, count, &p->f_pos);
1093                 fput(p);
1094                 return res;
1095         }
1096         return tty_write(file, buf, count, ppos);
1097 }
1098
1099 static char ptychar[] = "pqrstuvwxyzabcde";
1100
1101 /**
1102  *      pty_line_name   -       generate name for a pty
1103  *      @driver: the tty driver in use
1104  *      @index: the minor number
1105  *      @p: output buffer of at least 6 bytes
1106  *
1107  *      Generate a name from a driver reference and write it to the output
1108  *      buffer.
1109  *
1110  *      Locking: None
1111  */
1112 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1113 {
1114         int i = index + driver->name_base;
1115         /* ->name is initialized to "ttyp", but "tty" is expected */
1116         sprintf(p, "%s%c%x",
1117                 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1118                 ptychar[i >> 4 & 0xf], i & 0xf);
1119 }
1120
1121 /**
1122  *      tty_line_name   -       generate name for a tty
1123  *      @driver: the tty driver in use
1124  *      @index: the minor number
1125  *      @p: output buffer of at least 7 bytes
1126  *
1127  *      Generate a name from a driver reference and write it to the output
1128  *      buffer.
1129  *
1130  *      Locking: None
1131  */
1132 static void tty_line_name(struct tty_driver *driver, int index, char *p)
1133 {
1134         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1135 }
1136
1137 /**
1138  *      tty_driver_lookup_tty() - find an existing tty, if any
1139  *      @driver: the driver for the tty
1140  *      @idx:    the minor number
1141  *
1142  *      Return the tty, if found or ERR_PTR() otherwise.
1143  *
1144  *      Locking: tty_mutex must be held. If tty is found, the mutex must
1145  *      be held until the 'fast-open' is also done. Will change once we
1146  *      have refcounting in the driver and per driver locking
1147  */
1148 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1149                 struct inode *inode, int idx)
1150 {
1151         struct tty_struct *tty;
1152
1153         if (driver->ops->lookup)
1154                 return driver->ops->lookup(driver, inode, idx);
1155
1156         tty = driver->ttys[idx];
1157         return tty;
1158 }
1159
1160 /**
1161  *      tty_init_termios        -  helper for termios setup
1162  *      @tty: the tty to set up
1163  *
1164  *      Initialise the termios structures for this tty. Thus runs under
1165  *      the tty_mutex currently so we can be relaxed about ordering.
1166  */
1167
1168 int tty_init_termios(struct tty_struct *tty)
1169 {
1170         struct ktermios *tp;
1171         int idx = tty->index;
1172
1173         tp = tty->driver->termios[idx];
1174         if (tp == NULL) {
1175                 tp = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
1176                 if (tp == NULL)
1177                         return -ENOMEM;
1178                 memcpy(tp, &tty->driver->init_termios,
1179                                                 sizeof(struct ktermios));
1180                 tty->driver->termios[idx] = tp;
1181         }
1182         tty->termios = tp;
1183         tty->termios_locked = tp + 1;
1184
1185         /* Compatibility until drivers always set this */
1186         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1187         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1188         return 0;
1189 }
1190 EXPORT_SYMBOL_GPL(tty_init_termios);
1191
1192 /**
1193  *      tty_driver_install_tty() - install a tty entry in the driver
1194  *      @driver: the driver for the tty
1195  *      @tty: the tty
1196  *
1197  *      Install a tty object into the driver tables. The tty->index field
1198  *      will be set by the time this is called. This method is responsible
1199  *      for ensuring any need additional structures are allocated and
1200  *      configured.
1201  *
1202  *      Locking: tty_mutex for now
1203  */
1204 static int tty_driver_install_tty(struct tty_driver *driver,
1205                                                 struct tty_struct *tty)
1206 {
1207         int idx = tty->index;
1208         int ret;
1209
1210         if (driver->ops->install) {
1211                 lock_kernel();
1212                 ret = driver->ops->install(driver, tty);
1213                 unlock_kernel();
1214                 return ret;
1215         }
1216
1217         if (tty_init_termios(tty) == 0) {
1218                 lock_kernel();
1219                 tty_driver_kref_get(driver);
1220                 tty->count++;
1221                 driver->ttys[idx] = tty;
1222                 unlock_kernel();
1223                 return 0;
1224         }
1225         return -ENOMEM;
1226 }
1227
1228 /**
1229  *      tty_driver_remove_tty() - remove a tty from the driver tables
1230  *      @driver: the driver for the tty
1231  *      @idx:    the minor number
1232  *
1233  *      Remvoe a tty object from the driver tables. The tty->index field
1234  *      will be set by the time this is called.
1235  *
1236  *      Locking: tty_mutex for now
1237  */
1238 static void tty_driver_remove_tty(struct tty_driver *driver,
1239                                                 struct tty_struct *tty)
1240 {
1241         if (driver->ops->remove)
1242                 driver->ops->remove(driver, tty);
1243         else
1244                 driver->ttys[tty->index] = NULL;
1245 }
1246
1247 /*
1248  *      tty_reopen()    - fast re-open of an open tty
1249  *      @tty    - the tty to open
1250  *
1251  *      Return 0 on success, -errno on error.
1252  *
1253  *      Locking: tty_mutex must be held from the time the tty was found
1254  *               till this open completes.
1255  */
1256 static int tty_reopen(struct tty_struct *tty)
1257 {
1258         struct tty_driver *driver = tty->driver;
1259
1260         if (test_bit(TTY_CLOSING, &tty->flags))
1261                 return -EIO;
1262
1263         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1264             driver->subtype == PTY_TYPE_MASTER) {
1265                 /*
1266                  * special case for PTY masters: only one open permitted,
1267                  * and the slave side open count is incremented as well.
1268                  */
1269                 if (tty->count)
1270                         return -EIO;
1271
1272                 tty->link->count++;
1273         }
1274         tty->count++;
1275         tty->driver = driver; /* N.B. why do this every time?? */
1276
1277         mutex_lock(&tty->ldisc_mutex);
1278         WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1279         mutex_unlock(&tty->ldisc_mutex);
1280
1281         return 0;
1282 }
1283
1284 /**
1285  *      tty_init_dev            -       initialise a tty device
1286  *      @driver: tty driver we are opening a device on
1287  *      @idx: device index
1288  *      @ret_tty: returned tty structure
1289  *      @first_ok: ok to open a new device (used by ptmx)
1290  *
1291  *      Prepare a tty device. This may not be a "new" clean device but
1292  *      could also be an active device. The pty drivers require special
1293  *      handling because of this.
1294  *
1295  *      Locking:
1296  *              The function is called under the tty_mutex, which
1297  *      protects us from the tty struct or driver itself going away.
1298  *
1299  *      On exit the tty device has the line discipline attached and
1300  *      a reference count of 1. If a pair was created for pty/tty use
1301  *      and the other was a pty master then it too has a reference count of 1.
1302  *
1303  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1304  * failed open.  The new code protects the open with a mutex, so it's
1305  * really quite straightforward.  The mutex locking can probably be
1306  * relaxed for the (most common) case of reopening a tty.
1307  */
1308
1309 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
1310                                                                 int first_ok)
1311 {
1312         struct tty_struct *tty;
1313         int retval;
1314
1315         lock_kernel();
1316         /* Check if pty master is being opened multiple times */
1317         if (driver->subtype == PTY_TYPE_MASTER &&
1318                 (driver->flags & TTY_DRIVER_DEVPTS_MEM) && !first_ok) {
1319                 unlock_kernel();
1320                 return ERR_PTR(-EIO);
1321         }
1322         unlock_kernel();
1323
1324         /*
1325          * First time open is complex, especially for PTY devices.
1326          * This code guarantees that either everything succeeds and the
1327          * TTY is ready for operation, or else the table slots are vacated
1328          * and the allocated memory released.  (Except that the termios
1329          * and locked termios may be retained.)
1330          */
1331
1332         if (!try_module_get(driver->owner))
1333                 return ERR_PTR(-ENODEV);
1334
1335         tty = alloc_tty_struct();
1336         if (!tty)
1337                 goto fail_no_mem;
1338         initialize_tty_struct(tty, driver, idx);
1339
1340         retval = tty_driver_install_tty(driver, tty);
1341         if (retval < 0) {
1342                 free_tty_struct(tty);
1343                 module_put(driver->owner);
1344                 return ERR_PTR(retval);
1345         }
1346
1347         /*
1348          * Structures all installed ... call the ldisc open routines.
1349          * If we fail here just call release_tty to clean up.  No need
1350          * to decrement the use counts, as release_tty doesn't care.
1351          */
1352         retval = tty_ldisc_setup(tty, tty->link);
1353         if (retval)
1354                 goto release_mem_out;
1355         return tty;
1356
1357 fail_no_mem:
1358         module_put(driver->owner);
1359         return ERR_PTR(-ENOMEM);
1360
1361         /* call the tty release_tty routine to clean out this slot */
1362 release_mem_out:
1363         if (printk_ratelimit())
1364                 printk(KERN_INFO "tty_init_dev: ldisc open failed, "
1365                                  "clearing slot %d\n", idx);
1366         lock_kernel();
1367         release_tty(tty, idx);
1368         unlock_kernel();
1369         return ERR_PTR(retval);
1370 }
1371
1372 void tty_free_termios(struct tty_struct *tty)
1373 {
1374         struct ktermios *tp;
1375         int idx = tty->index;
1376         /* Kill this flag and push into drivers for locking etc */
1377         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1378                 /* FIXME: Locking on ->termios array */
1379                 tp = tty->termios;
1380                 tty->driver->termios[idx] = NULL;
1381                 kfree(tp);
1382         }
1383 }
1384 EXPORT_SYMBOL(tty_free_termios);
1385
1386 void tty_shutdown(struct tty_struct *tty)
1387 {
1388         tty_driver_remove_tty(tty->driver, tty);
1389         tty_free_termios(tty);
1390 }
1391 EXPORT_SYMBOL(tty_shutdown);
1392
1393 /**
1394  *      release_one_tty         -       release tty structure memory
1395  *      @kref: kref of tty we are obliterating
1396  *
1397  *      Releases memory associated with a tty structure, and clears out the
1398  *      driver table slots. This function is called when a device is no longer
1399  *      in use. It also gets called when setup of a device fails.
1400  *
1401  *      Locking:
1402  *              tty_mutex - sometimes only
1403  *              takes the file list lock internally when working on the list
1404  *      of ttys that the driver keeps.
1405  *
1406  *      This method gets called from a work queue so that the driver private
1407  *      cleanup ops can sleep (needed for USB at least)
1408  */
1409 static void release_one_tty(struct work_struct *work)
1410 {
1411         struct tty_struct *tty =
1412                 container_of(work, struct tty_struct, hangup_work);
1413         struct tty_driver *driver = tty->driver;
1414
1415         if (tty->ops->cleanup)
1416                 tty->ops->cleanup(tty);
1417
1418         tty->magic = 0;
1419         tty_driver_kref_put(driver);
1420         module_put(driver->owner);
1421
1422         file_list_lock();
1423         list_del_init(&tty->tty_files);
1424         file_list_unlock();
1425
1426         put_pid(tty->pgrp);
1427         put_pid(tty->session);
1428         free_tty_struct(tty);
1429 }
1430
1431 static void queue_release_one_tty(struct kref *kref)
1432 {
1433         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1434
1435         if (tty->ops->shutdown)
1436                 tty->ops->shutdown(tty);
1437         else
1438                 tty_shutdown(tty);
1439
1440         /* The hangup queue is now free so we can reuse it rather than
1441            waste a chunk of memory for each port */
1442         INIT_WORK(&tty->hangup_work, release_one_tty);
1443         schedule_work(&tty->hangup_work);
1444 }
1445
1446 /**
1447  *      tty_kref_put            -       release a tty kref
1448  *      @tty: tty device
1449  *
1450  *      Release a reference to a tty device and if need be let the kref
1451  *      layer destruct the object for us
1452  */
1453
1454 void tty_kref_put(struct tty_struct *tty)
1455 {
1456         if (tty)
1457                 kref_put(&tty->kref, queue_release_one_tty);
1458 }
1459 EXPORT_SYMBOL(tty_kref_put);
1460
1461 /**
1462  *      release_tty             -       release tty structure memory
1463  *
1464  *      Release both @tty and a possible linked partner (think pty pair),
1465  *      and decrement the refcount of the backing module.
1466  *
1467  *      Locking:
1468  *              tty_mutex - sometimes only
1469  *              takes the file list lock internally when working on the list
1470  *      of ttys that the driver keeps.
1471  *              FIXME: should we require tty_mutex is held here ??
1472  *
1473  */
1474 static void release_tty(struct tty_struct *tty, int idx)
1475 {
1476         /* This should always be true but check for the moment */
1477         WARN_ON(tty->index != idx);
1478
1479         if (tty->link)
1480                 tty_kref_put(tty->link);
1481         tty_kref_put(tty);
1482 }
1483
1484 /**
1485  *      tty_release             -       vfs callback for close
1486  *      @inode: inode of tty
1487  *      @filp: file pointer for handle to tty
1488  *
1489  *      Called the last time each file handle is closed that references
1490  *      this tty. There may however be several such references.
1491  *
1492  *      Locking:
1493  *              Takes bkl. See tty_release_dev
1494  *
1495  * Even releasing the tty structures is a tricky business.. We have
1496  * to be very careful that the structures are all released at the
1497  * same time, as interrupts might otherwise get the wrong pointers.
1498  *
1499  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1500  * lead to double frees or releasing memory still in use.
1501  */
1502
1503 int tty_release(struct inode *inode, struct file *filp)
1504 {
1505         struct tty_struct *tty, *o_tty;
1506         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1507         int     devpts;
1508         int     idx;
1509         char    buf[64];
1510
1511         tty = (struct tty_struct *)filp->private_data;
1512         if (tty_paranoia_check(tty, inode, "tty_release_dev"))
1513                 return 0;
1514
1515         lock_kernel();
1516         check_tty_count(tty, "tty_release_dev");
1517
1518         tty_fasync(-1, filp, 0);
1519
1520         idx = tty->index;
1521         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1522                       tty->driver->subtype == PTY_TYPE_MASTER);
1523         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1524         o_tty = tty->link;
1525
1526 #ifdef TTY_PARANOIA_CHECK
1527         if (idx < 0 || idx >= tty->driver->num) {
1528                 printk(KERN_DEBUG "tty_release_dev: bad idx when trying to "
1529                                   "free (%s)\n", tty->name);
1530                 unlock_kernel();
1531                 return 0;
1532         }
1533         if (!devpts) {
1534                 if (tty != tty->driver->ttys[idx]) {
1535                         unlock_kernel();
1536                         printk(KERN_DEBUG "tty_release_dev: driver.table[%d] not tty "
1537                                "for (%s)\n", idx, tty->name);
1538                         return 0;
1539                 }
1540                 if (tty->termios != tty->driver->termios[idx]) {
1541                         unlock_kernel();
1542                         printk(KERN_DEBUG "tty_release_dev: driver.termios[%d] not termios "
1543                                "for (%s)\n",
1544                                idx, tty->name);
1545                         return 0;
1546                 }
1547         }
1548 #endif
1549
1550 #ifdef TTY_DEBUG_HANGUP
1551         printk(KERN_DEBUG "tty_release_dev of %s (tty count=%d)...",
1552                tty_name(tty, buf), tty->count);
1553 #endif
1554
1555 #ifdef TTY_PARANOIA_CHECK
1556         if (tty->driver->other &&
1557              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1558                 if (o_tty != tty->driver->other->ttys[idx]) {
1559                         unlock_kernel();
1560                         printk(KERN_DEBUG "tty_release_dev: other->table[%d] "
1561                                           "not o_tty for (%s)\n",
1562                                idx, tty->name);
1563                         return 0 ;
1564                 }
1565                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1566                         unlock_kernel();
1567                         printk(KERN_DEBUG "tty_release_dev: other->termios[%d] "
1568                                           "not o_termios for (%s)\n",
1569                                idx, tty->name);
1570                         return 0;
1571                 }
1572                 if (o_tty->link != tty) {
1573                         unlock_kernel();
1574                         printk(KERN_DEBUG "tty_release_dev: bad pty pointers\n");
1575                         return 0;
1576                 }
1577         }
1578 #endif
1579         if (tty->ops->close)
1580                 tty->ops->close(tty, filp);
1581
1582         unlock_kernel();
1583         /*
1584          * Sanity check: if tty->count is going to zero, there shouldn't be
1585          * any waiters on tty->read_wait or tty->write_wait.  We test the
1586          * wait queues and kick everyone out _before_ actually starting to
1587          * close.  This ensures that we won't block while releasing the tty
1588          * structure.
1589          *
1590          * The test for the o_tty closing is necessary, since the master and
1591          * slave sides may close in any order.  If the slave side closes out
1592          * first, its count will be one, since the master side holds an open.
1593          * Thus this test wouldn't be triggered at the time the slave closes,
1594          * so we do it now.
1595          *
1596          * Note that it's possible for the tty to be opened again while we're
1597          * flushing out waiters.  By recalculating the closing flags before
1598          * each iteration we avoid any problems.
1599          */
1600         while (1) {
1601                 /* Guard against races with tty->count changes elsewhere and
1602                    opens on /dev/tty */
1603
1604                 mutex_lock(&tty_mutex);
1605                 lock_kernel();
1606                 tty_closing = tty->count <= 1;
1607                 o_tty_closing = o_tty &&
1608                         (o_tty->count <= (pty_master ? 1 : 0));
1609                 do_sleep = 0;
1610
1611                 if (tty_closing) {
1612                         if (waitqueue_active(&tty->read_wait)) {
1613                                 wake_up_poll(&tty->read_wait, POLLIN);
1614                                 do_sleep++;
1615                         }
1616                         if (waitqueue_active(&tty->write_wait)) {
1617                                 wake_up_poll(&tty->write_wait, POLLOUT);
1618                                 do_sleep++;
1619                         }
1620                 }
1621                 if (o_tty_closing) {
1622                         if (waitqueue_active(&o_tty->read_wait)) {
1623                                 wake_up_poll(&o_tty->read_wait, POLLIN);
1624                                 do_sleep++;
1625                         }
1626                         if (waitqueue_active(&o_tty->write_wait)) {
1627                                 wake_up_poll(&o_tty->write_wait, POLLOUT);
1628                                 do_sleep++;
1629                         }
1630                 }
1631                 if (!do_sleep)
1632                         break;
1633
1634                 printk(KERN_WARNING "tty_release_dev: %s: read/write wait queue "
1635                                     "active!\n", tty_name(tty, buf));
1636                 unlock_kernel();
1637                 mutex_unlock(&tty_mutex);
1638                 schedule();
1639         }
1640
1641         /*
1642          * The closing flags are now consistent with the open counts on
1643          * both sides, and we've completed the last operation that could
1644          * block, so it's safe to proceed with closing.
1645          */
1646         if (pty_master) {
1647                 if (--o_tty->count < 0) {
1648                         printk(KERN_WARNING "tty_release_dev: bad pty slave count "
1649                                             "(%d) for %s\n",
1650                                o_tty->count, tty_name(o_tty, buf));
1651                         o_tty->count = 0;
1652                 }
1653         }
1654         if (--tty->count < 0) {
1655                 printk(KERN_WARNING "tty_release_dev: bad tty->count (%d) for %s\n",
1656                        tty->count, tty_name(tty, buf));
1657                 tty->count = 0;
1658         }
1659
1660         /*
1661          * We've decremented tty->count, so we need to remove this file
1662          * descriptor off the tty->tty_files list; this serves two
1663          * purposes:
1664          *  - check_tty_count sees the correct number of file descriptors
1665          *    associated with this tty.
1666          *  - do_tty_hangup no longer sees this file descriptor as
1667          *    something that needs to be handled for hangups.
1668          */
1669         file_kill(filp);
1670         filp->private_data = NULL;
1671
1672         /*
1673          * Perform some housekeeping before deciding whether to return.
1674          *
1675          * Set the TTY_CLOSING flag if this was the last open.  In the
1676          * case of a pty we may have to wait around for the other side
1677          * to close, and TTY_CLOSING makes sure we can't be reopened.
1678          */
1679         if (tty_closing)
1680                 set_bit(TTY_CLOSING, &tty->flags);
1681         if (o_tty_closing)
1682                 set_bit(TTY_CLOSING, &o_tty->flags);
1683
1684         /*
1685          * If _either_ side is closing, make sure there aren't any
1686          * processes that still think tty or o_tty is their controlling
1687          * tty.
1688          */
1689         if (tty_closing || o_tty_closing) {
1690                 read_lock(&tasklist_lock);
1691                 session_clear_tty(tty->session);
1692                 if (o_tty)
1693                         session_clear_tty(o_tty->session);
1694                 read_unlock(&tasklist_lock);
1695         }
1696
1697         mutex_unlock(&tty_mutex);
1698
1699         /* check whether both sides are closing ... */
1700         if (!tty_closing || (o_tty && !o_tty_closing)) {
1701                 unlock_kernel();
1702                 return 0;
1703         }
1704
1705 #ifdef TTY_DEBUG_HANGUP
1706         printk(KERN_DEBUG "freeing tty structure...");
1707 #endif
1708         /*
1709          * Ask the line discipline code to release its structures
1710          */
1711         tty_ldisc_release(tty, o_tty);
1712         /*
1713          * The release_tty function takes care of the details of clearing
1714          * the slots and preserving the termios structure.
1715          */
1716         release_tty(tty, idx);
1717
1718         /* Make this pty number available for reallocation */
1719         if (devpts)
1720                 devpts_kill_index(inode, idx);
1721         unlock_kernel();
1722         return 0;
1723 }
1724
1725 /**
1726  *      tty_open                -       open a tty device
1727  *      @inode: inode of device file
1728  *      @filp: file pointer to tty
1729  *
1730  *      tty_open and tty_release keep up the tty count that contains the
1731  *      number of opens done on a tty. We cannot use the inode-count, as
1732  *      different inodes might point to the same tty.
1733  *
1734  *      Open-counting is needed for pty masters, as well as for keeping
1735  *      track of serial lines: DTR is dropped when the last close happens.
1736  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
1737  *
1738  *      The termios state of a pty is reset on first open so that
1739  *      settings don't persist across reuse.
1740  *
1741  *      Locking: tty_mutex protects tty, get_tty_driver and tty_init_dev work.
1742  *               tty->count should protect the rest.
1743  *               ->siglock protects ->signal/->sighand
1744  */
1745
1746 static int tty_open(struct inode *inode, struct file *filp)
1747 {
1748         struct tty_struct *tty = NULL;
1749         int noctty, retval;
1750         struct tty_driver *driver;
1751         int index;
1752         dev_t device = inode->i_rdev;
1753         unsigned saved_flags = filp->f_flags;
1754
1755         nonseekable_open(inode, filp);
1756
1757 retry_open:
1758         noctty = filp->f_flags & O_NOCTTY;
1759         index  = -1;
1760         retval = 0;
1761
1762         mutex_lock(&tty_mutex);
1763         lock_kernel();
1764
1765         if (device == MKDEV(TTYAUX_MAJOR, 0)) {
1766                 tty = get_current_tty();
1767                 if (!tty) {
1768                         unlock_kernel();
1769                         mutex_unlock(&tty_mutex);
1770                         return -ENXIO;
1771                 }
1772                 driver = tty_driver_kref_get(tty->driver);
1773                 index = tty->index;
1774                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1775                 /* noctty = 1; */
1776                 /* FIXME: Should we take a driver reference ? */
1777                 tty_kref_put(tty);
1778                 goto got_driver;
1779         }
1780 #ifdef CONFIG_VT
1781         if (device == MKDEV(TTY_MAJOR, 0)) {
1782                 extern struct tty_driver *console_driver;
1783                 driver = tty_driver_kref_get(console_driver);
1784                 index = fg_console;
1785                 noctty = 1;
1786                 goto got_driver;
1787         }
1788 #endif
1789         if (device == MKDEV(TTYAUX_MAJOR, 1)) {
1790                 struct tty_driver *console_driver = console_device(&index);
1791                 if (console_driver) {
1792                         driver = tty_driver_kref_get(console_driver);
1793                         if (driver) {
1794                                 /* Don't let /dev/console block */
1795                                 filp->f_flags |= O_NONBLOCK;
1796                                 noctty = 1;
1797                                 goto got_driver;
1798                         }
1799                 }
1800                 unlock_kernel();
1801                 mutex_unlock(&tty_mutex);
1802                 return -ENODEV;
1803         }
1804
1805         driver = get_tty_driver(device, &index);
1806         if (!driver) {
1807                 unlock_kernel();
1808                 mutex_unlock(&tty_mutex);
1809                 return -ENODEV;
1810         }
1811 got_driver:
1812         if (!tty) {
1813                 /* check whether we're reopening an existing tty */
1814                 tty = tty_driver_lookup_tty(driver, inode, index);
1815
1816                 if (IS_ERR(tty)) {
1817                         unlock_kernel();
1818                         mutex_unlock(&tty_mutex);
1819                         return PTR_ERR(tty);
1820                 }
1821         }
1822
1823         if (tty) {
1824                 retval = tty_reopen(tty);
1825                 if (retval)
1826                         tty = ERR_PTR(retval);
1827         } else
1828                 tty = tty_init_dev(driver, index, 0);
1829
1830         mutex_unlock(&tty_mutex);
1831         tty_driver_kref_put(driver);
1832         if (IS_ERR(tty)) {
1833                 unlock_kernel();
1834                 return PTR_ERR(tty);
1835         }
1836
1837         filp->private_data = tty;
1838         file_move(filp, &tty->tty_files);
1839         check_tty_count(tty, "tty_open");
1840         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1841             tty->driver->subtype == PTY_TYPE_MASTER)
1842                 noctty = 1;
1843 #ifdef TTY_DEBUG_HANGUP
1844         printk(KERN_DEBUG "opening %s...", tty->name);
1845 #endif
1846         if (!retval) {
1847                 if (tty->ops->open)
1848                         retval = tty->ops->open(tty, filp);
1849                 else
1850                         retval = -ENODEV;
1851         }
1852         filp->f_flags = saved_flags;
1853
1854         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
1855                                                 !capable(CAP_SYS_ADMIN))
1856                 retval = -EBUSY;
1857
1858         if (retval) {
1859 #ifdef TTY_DEBUG_HANGUP
1860                 printk(KERN_DEBUG "error %d in opening %s...", retval,
1861                        tty->name);
1862 #endif
1863                 tty_release(inode, filp);
1864                 if (retval != -ERESTARTSYS) {
1865                         unlock_kernel();
1866                         return retval;
1867                 }
1868                 if (signal_pending(current)) {
1869                         unlock_kernel();
1870                         return retval;
1871                 }
1872                 schedule();
1873                 /*
1874                  * Need to reset f_op in case a hangup happened.
1875                  */
1876                 if (filp->f_op == &hung_up_tty_fops)
1877                         filp->f_op = &tty_fops;
1878                 goto retry_open;
1879         }
1880         unlock_kernel();
1881
1882
1883         mutex_lock(&tty_mutex);
1884         lock_kernel();
1885         spin_lock_irq(&current->sighand->siglock);
1886         if (!noctty &&
1887             current->signal->leader &&
1888             !current->signal->tty &&
1889             tty->session == NULL)
1890                 __proc_set_tty(current, tty);
1891         spin_unlock_irq(&current->sighand->siglock);
1892         unlock_kernel();
1893         mutex_unlock(&tty_mutex);
1894         return 0;
1895 }
1896
1897
1898
1899 /**
1900  *      tty_poll        -       check tty status
1901  *      @filp: file being polled
1902  *      @wait: poll wait structures to update
1903  *
1904  *      Call the line discipline polling method to obtain the poll
1905  *      status of the device.
1906  *
1907  *      Locking: locks called line discipline but ldisc poll method
1908  *      may be re-entered freely by other callers.
1909  */
1910
1911 static unsigned int tty_poll(struct file *filp, poll_table *wait)
1912 {
1913         struct tty_struct *tty;
1914         struct tty_ldisc *ld;
1915         int ret = 0;
1916
1917         tty = (struct tty_struct *)filp->private_data;
1918         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
1919                 return 0;
1920
1921         ld = tty_ldisc_ref_wait(tty);
1922         if (ld->ops->poll)
1923                 ret = (ld->ops->poll)(tty, filp, wait);
1924         tty_ldisc_deref(ld);
1925         return ret;
1926 }
1927
1928 static int tty_fasync(int fd, struct file *filp, int on)
1929 {
1930         struct tty_struct *tty;
1931         unsigned long flags;
1932         int retval = 0;
1933
1934         lock_kernel();
1935         tty = (struct tty_struct *)filp->private_data;
1936         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
1937                 goto out;
1938
1939         retval = fasync_helper(fd, filp, on, &tty->fasync);
1940         if (retval <= 0)
1941                 goto out;
1942
1943         if (on) {
1944                 enum pid_type type;
1945                 struct pid *pid;
1946                 if (!waitqueue_active(&tty->read_wait))
1947                         tty->minimum_to_wake = 1;
1948                 spin_lock_irqsave(&tty->ctrl_lock, flags);
1949                 if (tty->pgrp) {
1950                         pid = tty->pgrp;
1951                         type = PIDTYPE_PGID;
1952                 } else {
1953                         pid = task_pid(current);
1954                         type = PIDTYPE_PID;
1955                 }
1956                 get_pid(pid);
1957                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
1958                 retval = __f_setown(filp, pid, type, 0);
1959                 put_pid(pid);
1960                 if (retval)
1961                         goto out;
1962         } else {
1963                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
1964                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
1965         }
1966         retval = 0;
1967 out:
1968         unlock_kernel();
1969         return retval;
1970 }
1971
1972 /**
1973  *      tiocsti                 -       fake input character
1974  *      @tty: tty to fake input into
1975  *      @p: pointer to character
1976  *
1977  *      Fake input to a tty device. Does the necessary locking and
1978  *      input management.
1979  *
1980  *      FIXME: does not honour flow control ??
1981  *
1982  *      Locking:
1983  *              Called functions take tty_ldisc_lock
1984  *              current->signal->tty check is safe without locks
1985  *
1986  *      FIXME: may race normal receive processing
1987  */
1988
1989 static int tiocsti(struct tty_struct *tty, char __user *p)
1990 {
1991         char ch, mbz = 0;
1992         struct tty_ldisc *ld;
1993
1994         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
1995                 return -EPERM;
1996         if (get_user(ch, p))
1997                 return -EFAULT;
1998         tty_audit_tiocsti(tty, ch);
1999         ld = tty_ldisc_ref_wait(tty);
2000         ld->ops->receive_buf(tty, &ch, &mbz, 1);
2001         tty_ldisc_deref(ld);
2002         return 0;
2003 }
2004
2005 /**
2006  *      tiocgwinsz              -       implement window query ioctl
2007  *      @tty; tty
2008  *      @arg: user buffer for result
2009  *
2010  *      Copies the kernel idea of the window size into the user buffer.
2011  *
2012  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2013  *              is consistent.
2014  */
2015
2016 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2017 {
2018         int err;
2019
2020         mutex_lock(&tty->termios_mutex);
2021         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2022         mutex_unlock(&tty->termios_mutex);
2023
2024         return err ? -EFAULT: 0;
2025 }
2026
2027 /**
2028  *      tty_do_resize           -       resize event
2029  *      @tty: tty being resized
2030  *      @rows: rows (character)
2031  *      @cols: cols (character)
2032  *
2033  *      Update the termios variables and send the necessary signals to
2034  *      peform a terminal resize correctly
2035  */
2036
2037 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2038 {
2039         struct pid *pgrp;
2040         unsigned long flags;
2041
2042         /* Lock the tty */
2043         mutex_lock(&tty->termios_mutex);
2044         if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2045                 goto done;
2046         /* Get the PID values and reference them so we can
2047            avoid holding the tty ctrl lock while sending signals */
2048         spin_lock_irqsave(&tty->ctrl_lock, flags);
2049         pgrp = get_pid(tty->pgrp);
2050         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2051
2052         if (pgrp)
2053                 kill_pgrp(pgrp, SIGWINCH, 1);
2054         put_pid(pgrp);
2055
2056         tty->winsize = *ws;
2057 done:
2058         mutex_unlock(&tty->termios_mutex);
2059         return 0;
2060 }
2061
2062 /**
2063  *      tiocswinsz              -       implement window size set ioctl
2064  *      @tty; tty side of tty
2065  *      @arg: user buffer for result
2066  *
2067  *      Copies the user idea of the window size to the kernel. Traditionally
2068  *      this is just advisory information but for the Linux console it
2069  *      actually has driver level meaning and triggers a VC resize.
2070  *
2071  *      Locking:
2072  *              Driver dependant. The default do_resize method takes the
2073  *      tty termios mutex and ctrl_lock. The console takes its own lock
2074  *      then calls into the default method.
2075  */
2076
2077 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2078 {
2079         struct winsize tmp_ws;
2080         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2081                 return -EFAULT;
2082
2083         if (tty->ops->resize)
2084                 return tty->ops->resize(tty, &tmp_ws);
2085         else
2086                 return tty_do_resize(tty, &tmp_ws);
2087 }
2088
2089 /**
2090  *      tioccons        -       allow admin to move logical console
2091  *      @file: the file to become console
2092  *
2093  *      Allow the adminstrator to move the redirected console device
2094  *
2095  *      Locking: uses redirect_lock to guard the redirect information
2096  */
2097
2098 static int tioccons(struct file *file)
2099 {
2100         if (!capable(CAP_SYS_ADMIN))
2101                 return -EPERM;
2102         if (file->f_op->write == redirected_tty_write) {
2103                 struct file *f;
2104                 spin_lock(&redirect_lock);
2105                 f = redirect;
2106                 redirect = NULL;
2107                 spin_unlock(&redirect_lock);
2108                 if (f)
2109                         fput(f);
2110                 return 0;
2111         }
2112         spin_lock(&redirect_lock);
2113         if (redirect) {
2114                 spin_unlock(&redirect_lock);
2115                 return -EBUSY;
2116         }
2117         get_file(file);
2118         redirect = file;
2119         spin_unlock(&redirect_lock);
2120         return 0;
2121 }
2122
2123 /**
2124  *      fionbio         -       non blocking ioctl
2125  *      @file: file to set blocking value
2126  *      @p: user parameter
2127  *
2128  *      Historical tty interfaces had a blocking control ioctl before
2129  *      the generic functionality existed. This piece of history is preserved
2130  *      in the expected tty API of posix OS's.
2131  *
2132  *      Locking: none, the open file handle ensures it won't go away.
2133  */
2134
2135 static int fionbio(struct file *file, int __user *p)
2136 {
2137         int nonblock;
2138
2139         if (get_user(nonblock, p))
2140                 return -EFAULT;
2141
2142         spin_lock(&file->f_lock);
2143         if (nonblock)
2144                 file->f_flags |= O_NONBLOCK;
2145         else
2146                 file->f_flags &= ~O_NONBLOCK;
2147         spin_unlock(&file->f_lock);
2148         return 0;
2149 }
2150
2151 /**
2152  *      tiocsctty       -       set controlling tty
2153  *      @tty: tty structure
2154  *      @arg: user argument
2155  *
2156  *      This ioctl is used to manage job control. It permits a session
2157  *      leader to set this tty as the controlling tty for the session.
2158  *
2159  *      Locking:
2160  *              Takes tty_mutex() to protect tty instance
2161  *              Takes tasklist_lock internally to walk sessions
2162  *              Takes ->siglock() when updating signal->tty
2163  */
2164
2165 static int tiocsctty(struct tty_struct *tty, int arg)
2166 {
2167         int ret = 0;
2168         if (current->signal->leader && (task_session(current) == tty->session))
2169                 return ret;
2170
2171         mutex_lock(&tty_mutex);
2172         /*
2173          * The process must be a session leader and
2174          * not have a controlling tty already.
2175          */
2176         if (!current->signal->leader || current->signal->tty) {
2177                 ret = -EPERM;
2178                 goto unlock;
2179         }
2180
2181         if (tty->session) {
2182                 /*
2183                  * This tty is already the controlling
2184                  * tty for another session group!
2185                  */
2186                 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2187                         /*
2188                          * Steal it away
2189                          */
2190                         read_lock(&tasklist_lock);
2191                         session_clear_tty(tty->session);
2192                         read_unlock(&tasklist_lock);
2193                 } else {
2194                         ret = -EPERM;
2195                         goto unlock;
2196                 }
2197         }
2198         proc_set_tty(current, tty);
2199 unlock:
2200         mutex_unlock(&tty_mutex);
2201         return ret;
2202 }
2203
2204 /**
2205  *      tty_get_pgrp    -       return a ref counted pgrp pid
2206  *      @tty: tty to read
2207  *
2208  *      Returns a refcounted instance of the pid struct for the process
2209  *      group controlling the tty.
2210  */
2211
2212 struct pid *tty_get_pgrp(struct tty_struct *tty)
2213 {
2214         unsigned long flags;
2215         struct pid *pgrp;
2216
2217         spin_lock_irqsave(&tty->ctrl_lock, flags);
2218         pgrp = get_pid(tty->pgrp);
2219         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2220
2221         return pgrp;
2222 }
2223 EXPORT_SYMBOL_GPL(tty_get_pgrp);
2224
2225 /**
2226  *      tiocgpgrp               -       get process group
2227  *      @tty: tty passed by user
2228  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
2229  *      @p: returned pid
2230  *
2231  *      Obtain the process group of the tty. If there is no process group
2232  *      return an error.
2233  *
2234  *      Locking: none. Reference to current->signal->tty is safe.
2235  */
2236
2237 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2238 {
2239         struct pid *pid;
2240         int ret;
2241         /*
2242          * (tty == real_tty) is a cheap way of
2243          * testing if the tty is NOT a master pty.
2244          */
2245         if (tty == real_tty && current->signal->tty != real_tty)
2246                 return -ENOTTY;
2247         pid = tty_get_pgrp(real_tty);
2248         ret =  put_user(pid_vnr(pid), p);
2249         put_pid(pid);
2250         return ret;
2251 }
2252
2253 /**
2254  *      tiocspgrp               -       attempt to set process group
2255  *      @tty: tty passed by user
2256  *      @real_tty: tty side device matching tty passed by user
2257  *      @p: pid pointer
2258  *
2259  *      Set the process group of the tty to the session passed. Only
2260  *      permitted where the tty session is our session.
2261  *
2262  *      Locking: RCU, ctrl lock
2263  */
2264
2265 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2266 {
2267         struct pid *pgrp;
2268         pid_t pgrp_nr;
2269         int retval = tty_check_change(real_tty);
2270         unsigned long flags;
2271
2272         if (retval == -EIO)
2273                 return -ENOTTY;
2274         if (retval)
2275                 return retval;
2276         if (!current->signal->tty ||
2277             (current->signal->tty != real_tty) ||
2278             (real_tty->session != task_session(current)))
2279                 return -ENOTTY;
2280         if (get_user(pgrp_nr, p))
2281                 return -EFAULT;
2282         if (pgrp_nr < 0)
2283                 return -EINVAL;
2284         rcu_read_lock();
2285         pgrp = find_vpid(pgrp_nr);
2286         retval = -ESRCH;
2287         if (!pgrp)
2288                 goto out_unlock;
2289         retval = -EPERM;
2290         if (session_of_pgrp(pgrp) != task_session(current))
2291                 goto out_unlock;
2292         retval = 0;
2293         spin_lock_irqsave(&tty->ctrl_lock, flags);
2294         put_pid(real_tty->pgrp);
2295         real_tty->pgrp = get_pid(pgrp);
2296         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2297 out_unlock:
2298         rcu_read_unlock();
2299         return retval;
2300 }
2301
2302 /**
2303  *      tiocgsid                -       get session id
2304  *      @tty: tty passed by user
2305  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
2306  *      @p: pointer to returned session id
2307  *
2308  *      Obtain the session id of the tty. If there is no session
2309  *      return an error.
2310  *
2311  *      Locking: none. Reference to current->signal->tty is safe.
2312  */
2313
2314 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2315 {
2316         /*
2317          * (tty == real_tty) is a cheap way of
2318          * testing if the tty is NOT a master pty.
2319         */
2320         if (tty == real_tty && current->signal->tty != real_tty)
2321                 return -ENOTTY;
2322         if (!real_tty->session)
2323                 return -ENOTTY;
2324         return put_user(pid_vnr(real_tty->session), p);
2325 }
2326
2327 /**
2328  *      tiocsetd        -       set line discipline
2329  *      @tty: tty device
2330  *      @p: pointer to user data
2331  *
2332  *      Set the line discipline according to user request.
2333  *
2334  *      Locking: see tty_set_ldisc, this function is just a helper
2335  */
2336
2337 static int tiocsetd(struct tty_struct *tty, int __user *p)
2338 {
2339         int ldisc;
2340         int ret;
2341
2342         if (get_user(ldisc, p))
2343                 return -EFAULT;
2344
2345         ret = tty_set_ldisc(tty, ldisc);
2346
2347         return ret;
2348 }
2349
2350 /**
2351  *      send_break      -       performed time break
2352  *      @tty: device to break on
2353  *      @duration: timeout in mS
2354  *
2355  *      Perform a timed break on hardware that lacks its own driver level
2356  *      timed break functionality.
2357  *
2358  *      Locking:
2359  *              atomic_write_lock serializes
2360  *
2361  */
2362
2363 static int send_break(struct tty_struct *tty, unsigned int duration)
2364 {
2365         int retval;
2366
2367         if (tty->ops->break_ctl == NULL)
2368                 return 0;
2369
2370         if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2371                 retval = tty->ops->break_ctl(tty, duration);
2372         else {
2373                 /* Do the work ourselves */
2374                 if (tty_write_lock(tty, 0) < 0)
2375                         return -EINTR;
2376                 retval = tty->ops->break_ctl(tty, -1);
2377                 if (retval)
2378                         goto out;
2379                 if (!signal_pending(current))
2380                         msleep_interruptible(duration);
2381                 retval = tty->ops->break_ctl(tty, 0);
2382 out:
2383                 tty_write_unlock(tty);
2384                 if (signal_pending(current))
2385                         retval = -EINTR;
2386         }
2387         return retval;
2388 }
2389
2390 /**
2391  *      tty_tiocmget            -       get modem status
2392  *      @tty: tty device
2393  *      @file: user file pointer
2394  *      @p: pointer to result
2395  *
2396  *      Obtain the modem status bits from the tty driver if the feature
2397  *      is supported. Return -EINVAL if it is not available.
2398  *
2399  *      Locking: none (up to the driver)
2400  */
2401
2402 static int tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
2403 {
2404         int retval = -EINVAL;
2405
2406         if (tty->ops->tiocmget) {
2407                 retval = tty->ops->tiocmget(tty, file);
2408
2409                 if (retval >= 0)
2410                         retval = put_user(retval, p);
2411         }
2412         return retval;
2413 }
2414
2415 /**
2416  *      tty_tiocmset            -       set modem status
2417  *      @tty: tty device
2418  *      @file: user file pointer
2419  *      @cmd: command - clear bits, set bits or set all
2420  *      @p: pointer to desired bits
2421  *
2422  *      Set the modem status bits from the tty driver if the feature
2423  *      is supported. Return -EINVAL if it is not available.
2424  *
2425  *      Locking: none (up to the driver)
2426  */
2427
2428 static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
2429              unsigned __user *p)
2430 {
2431         int retval;
2432         unsigned int set, clear, val;
2433
2434         if (tty->ops->tiocmset == NULL)
2435                 return -EINVAL;
2436
2437         retval = get_user(val, p);
2438         if (retval)
2439                 return retval;
2440         set = clear = 0;
2441         switch (cmd) {
2442         case TIOCMBIS:
2443                 set = val;
2444                 break;
2445         case TIOCMBIC:
2446                 clear = val;
2447                 break;
2448         case TIOCMSET:
2449                 set = val;
2450                 clear = ~val;
2451                 break;
2452         }
2453         set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2454         clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2455         return tty->ops->tiocmset(tty, file, set, clear);
2456 }
2457
2458 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2459 {
2460         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2461             tty->driver->subtype == PTY_TYPE_MASTER)
2462                 tty = tty->link;
2463         return tty;
2464 }
2465 EXPORT_SYMBOL(tty_pair_get_tty);
2466
2467 struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2468 {
2469         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2470             tty->driver->subtype == PTY_TYPE_MASTER)
2471             return tty;
2472         return tty->link;
2473 }
2474 EXPORT_SYMBOL(tty_pair_get_pty);
2475
2476 /*
2477  * Split this up, as gcc can choke on it otherwise..
2478  */
2479 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2480 {
2481         struct tty_struct *tty, *real_tty;
2482         void __user *p = (void __user *)arg;
2483         int retval;
2484         struct tty_ldisc *ld;
2485         struct inode *inode = file->f_dentry->d_inode;
2486
2487         tty = (struct tty_struct *)file->private_data;
2488         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2489                 return -EINVAL;
2490
2491         real_tty = tty_pair_get_tty(tty);
2492
2493         /*
2494          * Factor out some common prep work
2495          */
2496         switch (cmd) {
2497         case TIOCSETD:
2498         case TIOCSBRK:
2499         case TIOCCBRK:
2500         case TCSBRK:
2501         case TCSBRKP:
2502                 retval = tty_check_change(tty);
2503                 if (retval)
2504                         return retval;
2505                 if (cmd != TIOCCBRK) {
2506                         tty_wait_until_sent(tty, 0);
2507                         if (signal_pending(current))
2508                                 return -EINTR;
2509                 }
2510                 break;
2511         }
2512
2513         /*
2514          *      Now do the stuff.
2515          */
2516         switch (cmd) {
2517         case TIOCSTI:
2518                 return tiocsti(tty, p);
2519         case TIOCGWINSZ:
2520                 return tiocgwinsz(real_tty, p);
2521         case TIOCSWINSZ:
2522                 return tiocswinsz(real_tty, p);
2523         case TIOCCONS:
2524                 return real_tty != tty ? -EINVAL : tioccons(file);
2525         case FIONBIO:
2526                 return fionbio(file, p);
2527         case TIOCEXCL:
2528                 set_bit(TTY_EXCLUSIVE, &tty->flags);
2529                 return 0;
2530         case TIOCNXCL:
2531                 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2532                 return 0;
2533         case TIOCNOTTY:
2534                 if (current->signal->tty != tty)
2535                         return -ENOTTY;
2536                 no_tty();
2537                 return 0;
2538         case TIOCSCTTY:
2539                 return tiocsctty(tty, arg);
2540         case TIOCGPGRP:
2541                 return tiocgpgrp(tty, real_tty, p);
2542         case TIOCSPGRP:
2543                 return tiocspgrp(tty, real_tty, p);
2544         case TIOCGSID:
2545                 return tiocgsid(tty, real_tty, p);
2546         case TIOCGETD:
2547                 return put_user(tty->ldisc->ops->num, (int __user *)p);
2548         case TIOCSETD:
2549                 return tiocsetd(tty, p);
2550         /*
2551          * Break handling
2552          */
2553         case TIOCSBRK:  /* Turn break on, unconditionally */
2554                 if (tty->ops->break_ctl)
2555                         return tty->ops->break_ctl(tty, -1);
2556                 return 0;
2557         case TIOCCBRK:  /* Turn break off, unconditionally */
2558                 if (tty->ops->break_ctl)
2559                         return tty->ops->break_ctl(tty, 0);
2560                 return 0;
2561         case TCSBRK:   /* SVID version: non-zero arg --> no break */
2562                 /* non-zero arg means wait for all output data
2563                  * to be sent (performed above) but don't send break.
2564                  * This is used by the tcdrain() termios function.
2565                  */
2566                 if (!arg)
2567                         return send_break(tty, 250);
2568                 return 0;
2569         case TCSBRKP:   /* support for POSIX tcsendbreak() */
2570                 return send_break(tty, arg ? arg*100 : 250);
2571
2572         case TIOCMGET:
2573                 return tty_tiocmget(tty, file, p);
2574         case TIOCMSET:
2575         case TIOCMBIC:
2576         case TIOCMBIS:
2577                 return tty_tiocmset(tty, file, cmd, p);
2578         case TCFLSH:
2579                 switch (arg) {
2580                 case TCIFLUSH:
2581                 case TCIOFLUSH:
2582                 /* flush tty buffer and allow ldisc to process ioctl */
2583                         tty_buffer_flush(tty);
2584                         break;
2585                 }
2586                 break;
2587         }
2588         if (tty->ops->ioctl) {
2589                 retval = (tty->ops->ioctl)(tty, file, cmd, arg);
2590                 if (retval != -ENOIOCTLCMD)
2591                         return retval;
2592         }
2593         ld = tty_ldisc_ref_wait(tty);
2594         retval = -EINVAL;
2595         if (ld->ops->ioctl) {
2596                 retval = ld->ops->ioctl(tty, file, cmd, arg);
2597                 if (retval == -ENOIOCTLCMD)
2598                         retval = -EINVAL;
2599         }
2600         tty_ldisc_deref(ld);
2601         return retval;
2602 }
2603
2604 #ifdef CONFIG_COMPAT
2605 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2606                                 unsigned long arg)
2607 {
2608         struct inode *inode = file->f_dentry->d_inode;
2609         struct tty_struct *tty = file->private_data;
2610         struct tty_ldisc *ld;
2611         int retval = -ENOIOCTLCMD;
2612
2613         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2614                 return -EINVAL;
2615
2616         if (tty->ops->compat_ioctl) {
2617                 retval = (tty->ops->compat_ioctl)(tty, file, cmd, arg);
2618                 if (retval != -ENOIOCTLCMD)
2619                         return retval;
2620         }
2621
2622         ld = tty_ldisc_ref_wait(tty);
2623         if (ld->ops->compat_ioctl)
2624                 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2625         tty_ldisc_deref(ld);
2626
2627         return retval;
2628 }
2629 #endif
2630
2631 /*
2632  * This implements the "Secure Attention Key" ---  the idea is to
2633  * prevent trojan horses by killing all processes associated with this
2634  * tty when the user hits the "Secure Attention Key".  Required for
2635  * super-paranoid applications --- see the Orange Book for more details.
2636  *
2637  * This code could be nicer; ideally it should send a HUP, wait a few
2638  * seconds, then send a INT, and then a KILL signal.  But you then
2639  * have to coordinate with the init process, since all processes associated
2640  * with the current tty must be dead before the new getty is allowed
2641  * to spawn.
2642  *
2643  * Now, if it would be correct ;-/ The current code has a nasty hole -
2644  * it doesn't catch files in flight. We may send the descriptor to ourselves
2645  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2646  *
2647  * Nasty bug: do_SAK is being called in interrupt context.  This can
2648  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2649  */
2650 void __do_SAK(struct tty_struct *tty)
2651 {
2652 #ifdef TTY_SOFT_SAK
2653         tty_hangup(tty);
2654 #else
2655         struct task_struct *g, *p;
2656         struct pid *session;
2657         int             i;
2658         struct file     *filp;
2659         struct fdtable *fdt;
2660
2661         if (!tty)
2662                 return;
2663         session = tty->session;
2664
2665         tty_ldisc_flush(tty);
2666
2667         tty_driver_flush_buffer(tty);
2668
2669         read_lock(&tasklist_lock);
2670         /* Kill the entire session */
2671         do_each_pid_task(session, PIDTYPE_SID, p) {
2672                 printk(KERN_NOTICE "SAK: killed process %d"
2673                         " (%s): task_session(p)==tty->session\n",
2674                         task_pid_nr(p), p->comm);
2675                 send_sig(SIGKILL, p, 1);
2676         } while_each_pid_task(session, PIDTYPE_SID, p);
2677         /* Now kill any processes that happen to have the
2678          * tty open.
2679          */
2680         do_each_thread(g, p) {
2681                 if (p->signal->tty == tty) {
2682                         printk(KERN_NOTICE "SAK: killed process %d"
2683                             " (%s): task_session(p)==tty->session\n",
2684                             task_pid_nr(p), p->comm);
2685                         send_sig(SIGKILL, p, 1);
2686                         continue;
2687                 }
2688                 task_lock(p);
2689                 if (p->files) {
2690                         /*
2691                          * We don't take a ref to the file, so we must
2692                          * hold ->file_lock instead.
2693                          */
2694                         spin_lock(&p->files->file_lock);
2695                         fdt = files_fdtable(p->files);
2696                         for (i = 0; i < fdt->max_fds; i++) {
2697                                 filp = fcheck_files(p->files, i);
2698                                 if (!filp)
2699                                         continue;
2700                                 if (filp->f_op->read == tty_read &&
2701                                     filp->private_data == tty) {
2702                                         printk(KERN_NOTICE "SAK: killed process %d"
2703                                             " (%s): fd#%d opened to the tty\n",
2704                                             task_pid_nr(p), p->comm, i);
2705                                         force_sig(SIGKILL, p);
2706                                         break;
2707                                 }
2708                         }
2709                         spin_unlock(&p->files->file_lock);
2710                 }
2711                 task_unlock(p);
2712         } while_each_thread(g, p);
2713         read_unlock(&tasklist_lock);
2714 #endif
2715 }
2716
2717 static void do_SAK_work(struct work_struct *work)
2718 {
2719         struct tty_struct *tty =
2720                 container_of(work, struct tty_struct, SAK_work);
2721         __do_SAK(tty);
2722 }
2723
2724 /*
2725  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2726  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2727  * the values which we write to it will be identical to the values which it
2728  * already has. --akpm
2729  */
2730 void do_SAK(struct tty_struct *tty)
2731 {
2732         if (!tty)
2733                 return;
2734         schedule_work(&tty->SAK_work);
2735 }
2736
2737 EXPORT_SYMBOL(do_SAK);
2738
2739 /**
2740  *      initialize_tty_struct
2741  *      @tty: tty to initialize
2742  *
2743  *      This subroutine initializes a tty structure that has been newly
2744  *      allocated.
2745  *
2746  *      Locking: none - tty in question must not be exposed at this point
2747  */
2748
2749 void initialize_tty_struct(struct tty_struct *tty,
2750                 struct tty_driver *driver, int idx)
2751 {
2752         memset(tty, 0, sizeof(struct tty_struct));
2753         kref_init(&tty->kref);
2754         tty->magic = TTY_MAGIC;
2755         tty_ldisc_init(tty);
2756         tty->session = NULL;
2757         tty->pgrp = NULL;
2758         tty->overrun_time = jiffies;
2759         tty->buf.head = tty->buf.tail = NULL;
2760         tty_buffer_init(tty);
2761         mutex_init(&tty->termios_mutex);
2762         mutex_init(&tty->ldisc_mutex);
2763         init_waitqueue_head(&tty->write_wait);
2764         init_waitqueue_head(&tty->read_wait);
2765         INIT_WORK(&tty->hangup_work, do_tty_hangup);
2766         mutex_init(&tty->atomic_read_lock);
2767         mutex_init(&tty->atomic_write_lock);
2768         mutex_init(&tty->output_lock);
2769         mutex_init(&tty->echo_lock);
2770         spin_lock_init(&tty->read_lock);
2771         spin_lock_init(&tty->ctrl_lock);
2772         INIT_LIST_HEAD(&tty->tty_files);
2773         INIT_WORK(&tty->SAK_work, do_SAK_work);
2774
2775         tty->driver = driver;
2776         tty->ops = driver->ops;
2777         tty->index = idx;
2778         tty_line_name(driver, idx, tty->name);
2779 }
2780
2781 /**
2782  *      tty_put_char    -       write one character to a tty
2783  *      @tty: tty
2784  *      @ch: character
2785  *
2786  *      Write one byte to the tty using the provided put_char method
2787  *      if present. Returns the number of characters successfully output.
2788  *
2789  *      Note: the specific put_char operation in the driver layer may go
2790  *      away soon. Don't call it directly, use this method
2791  */
2792
2793 int tty_put_char(struct tty_struct *tty, unsigned char ch)
2794 {
2795         if (tty->ops->put_char)
2796                 return tty->ops->put_char(tty, ch);
2797         return tty->ops->write(tty, &ch, 1);
2798 }
2799 EXPORT_SYMBOL_GPL(tty_put_char);
2800
2801 struct class *tty_class;
2802
2803 /**
2804  *      tty_register_device - register a tty device
2805  *      @driver: the tty driver that describes the tty device
2806  *      @index: the index in the tty driver for this tty device
2807  *      @device: a struct device that is associated with this tty device.
2808  *              This field is optional, if there is no known struct device
2809  *              for this tty device it can be set to NULL safely.
2810  *
2811  *      Returns a pointer to the struct device for this tty device
2812  *      (or ERR_PTR(-EFOO) on error).
2813  *
2814  *      This call is required to be made to register an individual tty device
2815  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
2816  *      that bit is not set, this function should not be called by a tty
2817  *      driver.
2818  *
2819  *      Locking: ??
2820  */
2821
2822 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
2823                                    struct device *device)
2824 {
2825         char name[64];
2826         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
2827
2828         if (index >= driver->num) {
2829                 printk(KERN_ERR "Attempt to register invalid tty line number "
2830                        " (%d).\n", index);
2831                 return ERR_PTR(-EINVAL);
2832         }
2833
2834         if (driver->type == TTY_DRIVER_TYPE_PTY)
2835                 pty_line_name(driver, index, name);
2836         else
2837                 tty_line_name(driver, index, name);
2838
2839         return device_create(tty_class, device, dev, NULL, name);
2840 }
2841 EXPORT_SYMBOL(tty_register_device);
2842
2843 /**
2844  *      tty_unregister_device - unregister a tty device
2845  *      @driver: the tty driver that describes the tty device
2846  *      @index: the index in the tty driver for this tty device
2847  *
2848  *      If a tty device is registered with a call to tty_register_device() then
2849  *      this function must be called when the tty device is gone.
2850  *
2851  *      Locking: ??
2852  */
2853
2854 void tty_unregister_device(struct tty_driver *driver, unsigned index)
2855 {
2856         device_destroy(tty_class,
2857                 MKDEV(driver->major, driver->minor_start) + index);
2858 }
2859 EXPORT_SYMBOL(tty_unregister_device);
2860
2861 struct tty_driver *alloc_tty_driver(int lines)
2862 {
2863         struct tty_driver *driver;
2864
2865         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
2866         if (driver) {
2867                 kref_init(&driver->kref);
2868                 driver->magic = TTY_DRIVER_MAGIC;
2869                 driver->num = lines;
2870                 /* later we'll move allocation of tables here */
2871         }
2872         return driver;
2873 }
2874 EXPORT_SYMBOL(alloc_tty_driver);
2875
2876 static void destruct_tty_driver(struct kref *kref)
2877 {
2878         struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
2879         int i;
2880         struct ktermios *tp;
2881         void *p;
2882
2883         if (driver->flags & TTY_DRIVER_INSTALLED) {
2884                 /*
2885                  * Free the termios and termios_locked structures because
2886                  * we don't want to get memory leaks when modular tty
2887                  * drivers are removed from the kernel.
2888                  */
2889                 for (i = 0; i < driver->num; i++) {
2890                         tp = driver->termios[i];
2891                         if (tp) {
2892                                 driver->termios[i] = NULL;
2893                                 kfree(tp);
2894                         }
2895                         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
2896                                 tty_unregister_device(driver, i);
2897                 }
2898                 p = driver->ttys;
2899                 proc_tty_unregister_driver(driver);
2900                 driver->ttys = NULL;
2901                 driver->termios = NULL;
2902                 kfree(p);
2903                 cdev_del(&driver->cdev);
2904         }
2905         kfree(driver);
2906 }
2907
2908 void tty_driver_kref_put(struct tty_driver *driver)
2909 {
2910         kref_put(&driver->kref, destruct_tty_driver);
2911 }
2912 EXPORT_SYMBOL(tty_driver_kref_put);
2913
2914 void tty_set_operations(struct tty_driver *driver,
2915                         const struct tty_operations *op)
2916 {
2917         driver->ops = op;
2918 };
2919 EXPORT_SYMBOL(tty_set_operations);
2920
2921 void put_tty_driver(struct tty_driver *d)
2922 {
2923         tty_driver_kref_put(d);
2924 }
2925 EXPORT_SYMBOL(put_tty_driver);
2926
2927 /*
2928  * Called by a tty driver to register itself.
2929  */
2930 int tty_register_driver(struct tty_driver *driver)
2931 {
2932         int error;
2933         int i;
2934         dev_t dev;
2935         void **p = NULL;
2936
2937         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
2938                 p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
2939                 if (!p)
2940                         return -ENOMEM;
2941         }
2942
2943         if (!driver->major) {
2944                 error = alloc_chrdev_region(&dev, driver->minor_start,
2945                                                 driver->num, driver->name);
2946                 if (!error) {
2947                         driver->major = MAJOR(dev);
2948                         driver->minor_start = MINOR(dev);
2949                 }
2950         } else {
2951                 dev = MKDEV(driver->major, driver->minor_start);
2952                 error = register_chrdev_region(dev, driver->num, driver->name);
2953         }
2954         if (error < 0) {
2955                 kfree(p);
2956                 return error;
2957         }
2958
2959         if (p) {
2960                 driver->ttys = (struct tty_struct **)p;
2961                 driver->termios = (struct ktermios **)(p + driver->num);
2962         } else {
2963                 driver->ttys = NULL;
2964                 driver->termios = NULL;
2965         }
2966
2967         cdev_init(&driver->cdev, &tty_fops);
2968         driver->cdev.owner = driver->owner;
2969         error = cdev_add(&driver->cdev, dev, driver->num);
2970         if (error) {
2971                 unregister_chrdev_region(dev, driver->num);
2972                 driver->ttys = NULL;
2973                 driver->termios = NULL;
2974                 kfree(p);
2975                 return error;
2976         }
2977
2978         mutex_lock(&tty_mutex);
2979         list_add(&driver->tty_drivers, &tty_drivers);
2980         mutex_unlock(&tty_mutex);
2981
2982         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
2983                 for (i = 0; i < driver->num; i++)
2984                     tty_register_device(driver, i, NULL);
2985         }
2986         proc_tty_register_driver(driver);
2987         driver->flags |= TTY_DRIVER_INSTALLED;
2988         return 0;
2989 }
2990
2991 EXPORT_SYMBOL(tty_register_driver);
2992
2993 /*
2994  * Called by a tty driver to unregister itself.
2995  */
2996 int tty_unregister_driver(struct tty_driver *driver)
2997 {
2998 #if 0
2999         /* FIXME */
3000         if (driver->refcount)
3001                 return -EBUSY;
3002 #endif
3003         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3004                                 driver->num);
3005         mutex_lock(&tty_mutex);
3006         list_del(&driver->tty_drivers);
3007         mutex_unlock(&tty_mutex);
3008         return 0;
3009 }
3010
3011 EXPORT_SYMBOL(tty_unregister_driver);
3012
3013 dev_t tty_devnum(struct tty_struct *tty)
3014 {
3015         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3016 }
3017 EXPORT_SYMBOL(tty_devnum);
3018
3019 void proc_clear_tty(struct task_struct *p)
3020 {
3021         unsigned long flags;
3022         struct tty_struct *tty;
3023         spin_lock_irqsave(&p->sighand->siglock, flags);
3024         tty = p->signal->tty;
3025         p->signal->tty = NULL;
3026         spin_unlock_irqrestore(&p->sighand->siglock, flags);
3027         tty_kref_put(tty);
3028 }
3029
3030 /* Called under the sighand lock */
3031
3032 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3033 {
3034         if (tty) {
3035                 unsigned long flags;
3036                 /* We should not have a session or pgrp to put here but.... */
3037                 spin_lock_irqsave(&tty->ctrl_lock, flags);
3038                 put_pid(tty->session);
3039                 put_pid(tty->pgrp);
3040                 tty->pgrp = get_pid(task_pgrp(tsk));
3041                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3042                 tty->session = get_pid(task_session(tsk));
3043                 if (tsk->signal->tty) {
3044                         printk(KERN_DEBUG "tty not NULL!!\n");
3045                         tty_kref_put(tsk->signal->tty);
3046                 }
3047         }
3048         put_pid(tsk->signal->tty_old_pgrp);
3049         tsk->signal->tty = tty_kref_get(tty);
3050         tsk->signal->tty_old_pgrp = NULL;
3051 }
3052
3053 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3054 {
3055         spin_lock_irq(&tsk->sighand->siglock);
3056         __proc_set_tty(tsk, tty);
3057         spin_unlock_irq(&tsk->sighand->siglock);
3058 }
3059
3060 struct tty_struct *get_current_tty(void)
3061 {
3062         struct tty_struct *tty;
3063         unsigned long flags;
3064
3065         spin_lock_irqsave(&current->sighand->siglock, flags);
3066         tty = tty_kref_get(current->signal->tty);
3067         spin_unlock_irqrestore(&current->sighand->siglock, flags);
3068         return tty;
3069 }
3070 EXPORT_SYMBOL_GPL(get_current_tty);
3071
3072 void tty_default_fops(struct file_operations *fops)
3073 {
3074         *fops = tty_fops;
3075 }
3076
3077 /*
3078  * Initialize the console device. This is called *early*, so
3079  * we can't necessarily depend on lots of kernel help here.
3080  * Just do some early initializations, and do the complex setup
3081  * later.
3082  */
3083 void __init console_init(void)
3084 {
3085         initcall_t *call;
3086
3087         /* Setup the default TTY line discipline. */
3088         tty_ldisc_begin();
3089
3090         /*
3091          * set up the console device so that later boot sequences can
3092          * inform about problems etc..
3093          */
3094         call = __con_initcall_start;
3095         while (call < __con_initcall_end) {
3096                 (*call)();
3097                 call++;
3098         }
3099 }
3100
3101 static char *tty_devnode(struct device *dev, mode_t *mode)
3102 {
3103         if (!mode)
3104                 return NULL;
3105         if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3106             dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3107                 *mode = 0666;
3108         return NULL;
3109 }
3110
3111 static int __init tty_class_init(void)
3112 {
3113         tty_class = class_create(THIS_MODULE, "tty");
3114         if (IS_ERR(tty_class))
3115                 return PTR_ERR(tty_class);
3116         tty_class->devnode = tty_devnode;
3117         return 0;
3118 }
3119
3120 postcore_initcall(tty_class_init);
3121
3122 /* 3/2004 jmc: why do these devices exist? */
3123
3124 static struct cdev tty_cdev, console_cdev;
3125
3126 /*
3127  * Ok, now we can initialize the rest of the tty devices and can count
3128  * on memory allocations, interrupts etc..
3129  */
3130 static int __init tty_init(void)
3131 {
3132         cdev_init(&tty_cdev, &tty_fops);
3133         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3134             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3135                 panic("Couldn't register /dev/tty driver\n");
3136         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL,
3137                               "tty");
3138
3139         cdev_init(&console_cdev, &console_fops);
3140         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3141             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3142                 panic("Couldn't register /dev/console driver\n");
3143         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3144                               "console");
3145
3146 #ifdef CONFIG_VT
3147         vty_init(&console_fops);
3148 #endif
3149         return 0;
3150 }
3151 module_init(tty_init);