b425c79675ad96adc187c601e36d65c2bebc3581
[linux-3.10.git] / drivers / tty / tty_io.c
1 /*
2  *  Copyright (C) 1991, 1992  Linus Torvalds
3  */
4
5 /*
6  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7  * or rs-channels. It also implements echoing, cooked mode etc.
8  *
9  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10  *
11  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12  * tty_struct and tty_queue structures.  Previously there was an array
13  * of 256 tty_struct's which was statically allocated, and the
14  * tty_queue structures were allocated at boot time.  Both are now
15  * dynamically allocated only when the tty is open.
16  *
17  * Also restructured routines so that there is more of a separation
18  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19  * the low-level tty routines (serial.c, pty.c, console.c).  This
20  * makes for cleaner and more compact code.  -TYT, 9/17/92
21  *
22  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23  * which can be dynamically activated and de-activated by the line
24  * discipline handling modules (like SLIP).
25  *
26  * NOTE: pay no attention to the line discipline code (yet); its
27  * interface is still subject to change in this version...
28  * -- TYT, 1/31/92
29  *
30  * Added functionality to the OPOST tty handling.  No delays, but all
31  * other bits should be there.
32  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33  *
34  * Rewrote canonical mode and added more termios flags.
35  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36  *
37  * Reorganized FASYNC support so mouse code can share it.
38  *      -- ctm@ardi.com, 9Sep95
39  *
40  * New TIOCLINUX variants added.
41  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
42  *
43  * Restrict vt switching via ioctl()
44  *      -- grif@cs.ucr.edu, 5-Dec-95
45  *
46  * Move console and virtual terminal code to more appropriate files,
47  * implement CONFIG_VT and generalize console device interface.
48  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49  *
50  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51  *      -- Bill Hawes <whawes@star.net>, June 97
52  *
53  * Added devfs support.
54  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55  *
56  * Added support for a Unix98-style ptmx device.
57  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58  *
59  * Reduced memory usage for older ARM systems
60  *      -- Russell King <rmk@arm.linux.org.uk>
61  *
62  * Move do_SAK() into process context.  Less stack use in devfs functions.
63  * alloc_tty_struct() always uses kmalloc()
64  *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65  */
66
67 #include <linux/types.h>
68 #include <linux/major.h>
69 #include <linux/errno.h>
70 #include <linux/signal.h>
71 #include <linux/fcntl.h>
72 #include <linux/sched.h>
73 #include <linux/interrupt.h>
74 #include <linux/tty.h>
75 #include <linux/tty_driver.h>
76 #include <linux/tty_flip.h>
77 #include <linux/devpts_fs.h>
78 #include <linux/file.h>
79 #include <linux/fdtable.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/device.h>
92 #include <linux/wait.h>
93 #include <linux/bitops.h>
94 #include <linux/delay.h>
95 #include <linux/seq_file.h>
96 #include <linux/serial.h>
97 #include <linux/ratelimit.h>
98
99 #include <linux/uaccess.h>
100
101 #include <linux/kbd_kern.h>
102 #include <linux/vt_kern.h>
103 #include <linux/selection.h>
104
105 #include <linux/kmod.h>
106 #include <linux/nsproxy.h>
107
108 #undef TTY_DEBUG_HANGUP
109
110 #define TTY_PARANOIA_CHECK 1
111 #define CHECK_TTY_COUNT 1
112
113 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
114         .c_iflag = ICRNL | IXON,
115         .c_oflag = OPOST | ONLCR,
116         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
117         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
118                    ECHOCTL | ECHOKE | IEXTEN,
119         .c_cc = INIT_C_CC,
120         .c_ispeed = 38400,
121         .c_ospeed = 38400
122 };
123
124 EXPORT_SYMBOL(tty_std_termios);
125
126 /* This list gets poked at by procfs and various bits of boot up code. This
127    could do with some rationalisation such as pulling the tty proc function
128    into this file */
129
130 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
131
132 /* Mutex to protect creating and releasing a tty. This is shared with
133    vt.c for deeply disgusting hack reasons */
134 DEFINE_MUTEX(tty_mutex);
135 EXPORT_SYMBOL(tty_mutex);
136
137 /* Spinlock to protect the tty->tty_files list */
138 DEFINE_SPINLOCK(tty_files_lock);
139
140 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
141 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
142 ssize_t redirected_tty_write(struct file *, const char __user *,
143                                                         size_t, loff_t *);
144 static unsigned int tty_poll(struct file *, poll_table *);
145 static int tty_open(struct inode *, struct file *);
146 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
147 #ifdef CONFIG_COMPAT
148 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
149                                 unsigned long arg);
150 #else
151 #define tty_compat_ioctl NULL
152 #endif
153 static int __tty_fasync(int fd, struct file *filp, int on);
154 static int tty_fasync(int fd, struct file *filp, int on);
155 static void release_tty(struct tty_struct *tty, int idx);
156 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158
159 /**
160  *      alloc_tty_struct        -       allocate a tty object
161  *
162  *      Return a new empty tty structure. The data fields have not
163  *      been initialized in any way but has been zeroed
164  *
165  *      Locking: none
166  */
167
168 struct tty_struct *alloc_tty_struct(void)
169 {
170         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
171 }
172
173 /**
174  *      free_tty_struct         -       free a disused tty
175  *      @tty: tty struct to free
176  *
177  *      Free the write buffers, tty queue and tty memory itself.
178  *
179  *      Locking: none. Must be called after tty is definitely unused
180  */
181
182 void free_tty_struct(struct tty_struct *tty)
183 {
184         if (tty->dev)
185                 put_device(tty->dev);
186         kfree(tty->write_buf);
187         tty_buffer_free_all(tty);
188         kfree(tty);
189 }
190
191 static inline struct tty_struct *file_tty(struct file *file)
192 {
193         return ((struct tty_file_private *)file->private_data)->tty;
194 }
195
196 int tty_alloc_file(struct file *file)
197 {
198         struct tty_file_private *priv;
199
200         priv = kmalloc(sizeof(*priv), GFP_KERNEL);
201         if (!priv)
202                 return -ENOMEM;
203
204         file->private_data = priv;
205
206         return 0;
207 }
208
209 /* Associate a new file with the tty structure */
210 void tty_add_file(struct tty_struct *tty, struct file *file)
211 {
212         struct tty_file_private *priv = file->private_data;
213
214         priv->tty = tty;
215         priv->file = file;
216
217         spin_lock(&tty_files_lock);
218         list_add(&priv->list, &tty->tty_files);
219         spin_unlock(&tty_files_lock);
220 }
221
222 /**
223  * tty_free_file - free file->private_data
224  *
225  * This shall be used only for fail path handling when tty_add_file was not
226  * called yet.
227  */
228 void tty_free_file(struct file *file)
229 {
230         struct tty_file_private *priv = file->private_data;
231
232         file->private_data = NULL;
233         kfree(priv);
234 }
235
236 /* Delete file from its tty */
237 void tty_del_file(struct file *file)
238 {
239         struct tty_file_private *priv = file->private_data;
240
241         spin_lock(&tty_files_lock);
242         list_del(&priv->list);
243         spin_unlock(&tty_files_lock);
244         tty_free_file(file);
245 }
246
247
248 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
249
250 /**
251  *      tty_name        -       return tty naming
252  *      @tty: tty structure
253  *      @buf: buffer for output
254  *
255  *      Convert a tty structure into a name. The name reflects the kernel
256  *      naming policy and if udev is in use may not reflect user space
257  *
258  *      Locking: none
259  */
260
261 char *tty_name(struct tty_struct *tty, char *buf)
262 {
263         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
264                 strcpy(buf, "NULL tty");
265         else
266                 strcpy(buf, tty->name);
267         return buf;
268 }
269
270 EXPORT_SYMBOL(tty_name);
271
272 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
273                               const char *routine)
274 {
275 #ifdef TTY_PARANOIA_CHECK
276         if (!tty) {
277                 printk(KERN_WARNING
278                         "null TTY for (%d:%d) in %s\n",
279                         imajor(inode), iminor(inode), routine);
280                 return 1;
281         }
282         if (tty->magic != TTY_MAGIC) {
283                 printk(KERN_WARNING
284                         "bad magic number for tty struct (%d:%d) in %s\n",
285                         imajor(inode), iminor(inode), routine);
286                 return 1;
287         }
288 #endif
289         return 0;
290 }
291
292 static int check_tty_count(struct tty_struct *tty, const char *routine)
293 {
294 #ifdef CHECK_TTY_COUNT
295         struct list_head *p;
296         int count = 0;
297
298         spin_lock(&tty_files_lock);
299         list_for_each(p, &tty->tty_files) {
300                 count++;
301         }
302         spin_unlock(&tty_files_lock);
303         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
304             tty->driver->subtype == PTY_TYPE_SLAVE &&
305             tty->link && tty->link->count)
306                 count++;
307         if (tty->count != count) {
308                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
309                                     "!= #fd's(%d) in %s\n",
310                        tty->name, tty->count, count, routine);
311                 return count;
312         }
313 #endif
314         return 0;
315 }
316
317 /**
318  *      get_tty_driver          -       find device of a tty
319  *      @dev_t: device identifier
320  *      @index: returns the index of the tty
321  *
322  *      This routine returns a tty driver structure, given a device number
323  *      and also passes back the index number.
324  *
325  *      Locking: caller must hold tty_mutex
326  */
327
328 static struct tty_driver *get_tty_driver(dev_t device, int *index)
329 {
330         struct tty_driver *p;
331
332         list_for_each_entry(p, &tty_drivers, tty_drivers) {
333                 dev_t base = MKDEV(p->major, p->minor_start);
334                 if (device < base || device >= base + p->num)
335                         continue;
336                 *index = device - base;
337                 return tty_driver_kref_get(p);
338         }
339         return NULL;
340 }
341
342 #ifdef CONFIG_CONSOLE_POLL
343
344 /**
345  *      tty_find_polling_driver -       find device of a polled tty
346  *      @name: name string to match
347  *      @line: pointer to resulting tty line nr
348  *
349  *      This routine returns a tty driver structure, given a name
350  *      and the condition that the tty driver is capable of polled
351  *      operation.
352  */
353 struct tty_driver *tty_find_polling_driver(char *name, int *line)
354 {
355         struct tty_driver *p, *res = NULL;
356         int tty_line = 0;
357         int len;
358         char *str, *stp;
359
360         for (str = name; *str; str++)
361                 if ((*str >= '0' && *str <= '9') || *str == ',')
362                         break;
363         if (!*str)
364                 return NULL;
365
366         len = str - name;
367         tty_line = simple_strtoul(str, &str, 10);
368
369         mutex_lock(&tty_mutex);
370         /* Search through the tty devices to look for a match */
371         list_for_each_entry(p, &tty_drivers, tty_drivers) {
372                 if (strncmp(name, p->name, len) != 0)
373                         continue;
374                 stp = str;
375                 if (*stp == ',')
376                         stp++;
377                 if (*stp == '\0')
378                         stp = NULL;
379
380                 if (tty_line >= 0 && tty_line < p->num && p->ops &&
381                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
382                         res = tty_driver_kref_get(p);
383                         *line = tty_line;
384                         break;
385                 }
386         }
387         mutex_unlock(&tty_mutex);
388
389         return res;
390 }
391 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
392 #endif
393
394 /**
395  *      tty_check_change        -       check for POSIX terminal changes
396  *      @tty: tty to check
397  *
398  *      If we try to write to, or set the state of, a terminal and we're
399  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
400  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
401  *
402  *      Locking: ctrl_lock
403  */
404
405 int tty_check_change(struct tty_struct *tty)
406 {
407         unsigned long flags;
408         int ret = 0;
409
410         if (current->signal->tty != tty)
411                 return 0;
412
413         spin_lock_irqsave(&tty->ctrl_lock, flags);
414
415         if (!tty->pgrp) {
416                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
417                 goto out_unlock;
418         }
419         if (task_pgrp(current) == tty->pgrp)
420                 goto out_unlock;
421         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
422         if (is_ignored(SIGTTOU))
423                 goto out;
424         if (is_current_pgrp_orphaned()) {
425                 ret = -EIO;
426                 goto out;
427         }
428         kill_pgrp(task_pgrp(current), SIGTTOU, 1);
429         set_thread_flag(TIF_SIGPENDING);
430         ret = -ERESTARTSYS;
431 out:
432         return ret;
433 out_unlock:
434         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
435         return ret;
436 }
437
438 EXPORT_SYMBOL(tty_check_change);
439
440 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
441                                 size_t count, loff_t *ppos)
442 {
443         return 0;
444 }
445
446 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
447                                  size_t count, loff_t *ppos)
448 {
449         return -EIO;
450 }
451
452 /* No kernel lock held - none needed ;) */
453 static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
454 {
455         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
456 }
457
458 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
459                 unsigned long arg)
460 {
461         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
462 }
463
464 static long hung_up_tty_compat_ioctl(struct file *file,
465                                      unsigned int cmd, unsigned long arg)
466 {
467         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
468 }
469
470 static const struct file_operations tty_fops = {
471         .llseek         = no_llseek,
472         .read           = tty_read,
473         .write          = tty_write,
474         .poll           = tty_poll,
475         .unlocked_ioctl = tty_ioctl,
476         .compat_ioctl   = tty_compat_ioctl,
477         .open           = tty_open,
478         .release        = tty_release,
479         .fasync         = tty_fasync,
480 };
481
482 static const struct file_operations console_fops = {
483         .llseek         = no_llseek,
484         .read           = tty_read,
485         .write          = redirected_tty_write,
486         .poll           = tty_poll,
487         .unlocked_ioctl = tty_ioctl,
488         .compat_ioctl   = tty_compat_ioctl,
489         .open           = tty_open,
490         .release        = tty_release,
491         .fasync         = tty_fasync,
492 };
493
494 static const struct file_operations hung_up_tty_fops = {
495         .llseek         = no_llseek,
496         .read           = hung_up_tty_read,
497         .write          = hung_up_tty_write,
498         .poll           = hung_up_tty_poll,
499         .unlocked_ioctl = hung_up_tty_ioctl,
500         .compat_ioctl   = hung_up_tty_compat_ioctl,
501         .release        = tty_release,
502 };
503
504 static DEFINE_SPINLOCK(redirect_lock);
505 static struct file *redirect;
506
507 /**
508  *      tty_wakeup      -       request more data
509  *      @tty: terminal
510  *
511  *      Internal and external helper for wakeups of tty. This function
512  *      informs the line discipline if present that the driver is ready
513  *      to receive more output data.
514  */
515
516 void tty_wakeup(struct tty_struct *tty)
517 {
518         struct tty_ldisc *ld;
519
520         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
521                 ld = tty_ldisc_ref(tty);
522                 if (ld) {
523                         if (ld->ops->write_wakeup)
524                                 ld->ops->write_wakeup(tty);
525                         tty_ldisc_deref(ld);
526                 }
527         }
528         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
529 }
530
531 EXPORT_SYMBOL_GPL(tty_wakeup);
532
533 /**
534  *      __tty_hangup            -       actual handler for hangup events
535  *      @work: tty device
536  *
537  *      This can be called by the "eventd" kernel thread.  That is process
538  *      synchronous but doesn't hold any locks, so we need to make sure we
539  *      have the appropriate locks for what we're doing.
540  *
541  *      The hangup event clears any pending redirections onto the hung up
542  *      device. It ensures future writes will error and it does the needed
543  *      line discipline hangup and signal delivery. The tty object itself
544  *      remains intact.
545  *
546  *      Locking:
547  *              BTM
548  *                redirect lock for undoing redirection
549  *                file list lock for manipulating list of ttys
550  *                tty_ldisc_lock from called functions
551  *                termios_mutex resetting termios data
552  *                tasklist_lock to walk task list for hangup event
553  *                  ->siglock to protect ->signal/->sighand
554  */
555 void __tty_hangup(struct tty_struct *tty)
556 {
557         struct file *cons_filp = NULL;
558         struct file *filp, *f = NULL;
559         struct task_struct *p;
560         struct tty_file_private *priv;
561         int    closecount = 0, n;
562         unsigned long flags;
563         int refs = 0;
564
565         if (!tty)
566                 return;
567
568
569         spin_lock(&redirect_lock);
570         if (redirect && file_tty(redirect) == tty) {
571                 f = redirect;
572                 redirect = NULL;
573         }
574         spin_unlock(&redirect_lock);
575
576         tty_lock();
577
578         /* some functions below drop BTM, so we need this bit */
579         set_bit(TTY_HUPPING, &tty->flags);
580
581         /* inuse_filps is protected by the single tty lock,
582            this really needs to change if we want to flush the
583            workqueue with the lock held */
584         check_tty_count(tty, "tty_hangup");
585
586         spin_lock(&tty_files_lock);
587         /* This breaks for file handles being sent over AF_UNIX sockets ? */
588         list_for_each_entry(priv, &tty->tty_files, list) {
589                 filp = priv->file;
590                 if (filp->f_op->write == redirected_tty_write)
591                         cons_filp = filp;
592                 if (filp->f_op->write != tty_write)
593                         continue;
594                 closecount++;
595                 __tty_fasync(-1, filp, 0);      /* can't block */
596                 filp->f_op = &hung_up_tty_fops;
597         }
598         spin_unlock(&tty_files_lock);
599
600         /*
601          * it drops BTM and thus races with reopen
602          * we protect the race by TTY_HUPPING
603          */
604         tty_ldisc_hangup(tty);
605
606         read_lock(&tasklist_lock);
607         if (tty->session) {
608                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
609                         spin_lock_irq(&p->sighand->siglock);
610                         if (p->signal->tty == tty) {
611                                 p->signal->tty = NULL;
612                                 /* We defer the dereferences outside fo
613                                    the tasklist lock */
614                                 refs++;
615                         }
616                         if (!p->signal->leader) {
617                                 spin_unlock_irq(&p->sighand->siglock);
618                                 continue;
619                         }
620                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
621                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
622                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
623                         spin_lock_irqsave(&tty->ctrl_lock, flags);
624                         if (tty->pgrp)
625                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
626                         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
627                         spin_unlock_irq(&p->sighand->siglock);
628                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
629         }
630         read_unlock(&tasklist_lock);
631
632         spin_lock_irqsave(&tty->ctrl_lock, flags);
633         clear_bit(TTY_THROTTLED, &tty->flags);
634         clear_bit(TTY_PUSH, &tty->flags);
635         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
636         put_pid(tty->session);
637         put_pid(tty->pgrp);
638         tty->session = NULL;
639         tty->pgrp = NULL;
640         tty->ctrl_status = 0;
641         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
642
643         /* Account for the p->signal references we killed */
644         while (refs--)
645                 tty_kref_put(tty);
646
647         /*
648          * If one of the devices matches a console pointer, we
649          * cannot just call hangup() because that will cause
650          * tty->count and state->count to go out of sync.
651          * So we just call close() the right number of times.
652          */
653         if (cons_filp) {
654                 if (tty->ops->close)
655                         for (n = 0; n < closecount; n++)
656                                 tty->ops->close(tty, cons_filp);
657         } else if (tty->ops->hangup)
658                 (tty->ops->hangup)(tty);
659         /*
660          * We don't want to have driver/ldisc interactions beyond
661          * the ones we did here. The driver layer expects no
662          * calls after ->hangup() from the ldisc side. However we
663          * can't yet guarantee all that.
664          */
665         set_bit(TTY_HUPPED, &tty->flags);
666         clear_bit(TTY_HUPPING, &tty->flags);
667         tty_ldisc_enable(tty);
668
669         tty_unlock();
670
671         if (f)
672                 fput(f);
673 }
674
675 static void do_tty_hangup(struct work_struct *work)
676 {
677         struct tty_struct *tty =
678                 container_of(work, struct tty_struct, hangup_work);
679
680         __tty_hangup(tty);
681 }
682
683 /**
684  *      tty_hangup              -       trigger a hangup event
685  *      @tty: tty to hangup
686  *
687  *      A carrier loss (virtual or otherwise) has occurred on this like
688  *      schedule a hangup sequence to run after this event.
689  */
690
691 void tty_hangup(struct tty_struct *tty)
692 {
693 #ifdef TTY_DEBUG_HANGUP
694         char    buf[64];
695         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
696 #endif
697         schedule_work(&tty->hangup_work);
698 }
699
700 EXPORT_SYMBOL(tty_hangup);
701
702 /**
703  *      tty_vhangup             -       process vhangup
704  *      @tty: tty to hangup
705  *
706  *      The user has asked via system call for the terminal to be hung up.
707  *      We do this synchronously so that when the syscall returns the process
708  *      is complete. That guarantee is necessary for security reasons.
709  */
710
711 void tty_vhangup(struct tty_struct *tty)
712 {
713 #ifdef TTY_DEBUG_HANGUP
714         char    buf[64];
715
716         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
717 #endif
718         __tty_hangup(tty);
719 }
720
721 EXPORT_SYMBOL(tty_vhangup);
722
723
724 /**
725  *      tty_vhangup_self        -       process vhangup for own ctty
726  *
727  *      Perform a vhangup on the current controlling tty
728  */
729
730 void tty_vhangup_self(void)
731 {
732         struct tty_struct *tty;
733
734         tty = get_current_tty();
735         if (tty) {
736                 tty_vhangup(tty);
737                 tty_kref_put(tty);
738         }
739 }
740
741 /**
742  *      tty_hung_up_p           -       was tty hung up
743  *      @filp: file pointer of tty
744  *
745  *      Return true if the tty has been subject to a vhangup or a carrier
746  *      loss
747  */
748
749 int tty_hung_up_p(struct file *filp)
750 {
751         return (filp->f_op == &hung_up_tty_fops);
752 }
753
754 EXPORT_SYMBOL(tty_hung_up_p);
755
756 static void session_clear_tty(struct pid *session)
757 {
758         struct task_struct *p;
759         do_each_pid_task(session, PIDTYPE_SID, p) {
760                 proc_clear_tty(p);
761         } while_each_pid_task(session, PIDTYPE_SID, p);
762 }
763
764 /**
765  *      disassociate_ctty       -       disconnect controlling tty
766  *      @on_exit: true if exiting so need to "hang up" the session
767  *
768  *      This function is typically called only by the session leader, when
769  *      it wants to disassociate itself from its controlling tty.
770  *
771  *      It performs the following functions:
772  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
773  *      (2)  Clears the tty from being controlling the session
774  *      (3)  Clears the controlling tty for all processes in the
775  *              session group.
776  *
777  *      The argument on_exit is set to 1 if called when a process is
778  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
779  *
780  *      Locking:
781  *              BTM is taken for hysterical raisins, and held when
782  *                called from no_tty().
783  *                tty_mutex is taken to protect tty
784  *                ->siglock is taken to protect ->signal/->sighand
785  *                tasklist_lock is taken to walk process list for sessions
786  *                  ->siglock is taken to protect ->signal/->sighand
787  */
788
789 void disassociate_ctty(int on_exit)
790 {
791         struct tty_struct *tty;
792
793         if (!current->signal->leader)
794                 return;
795
796         tty = get_current_tty();
797         if (tty) {
798                 struct pid *tty_pgrp = get_pid(tty->pgrp);
799                 if (on_exit) {
800                         if (tty->driver->type != TTY_DRIVER_TYPE_PTY)
801                                 tty_vhangup(tty);
802                 }
803                 tty_kref_put(tty);
804                 if (tty_pgrp) {
805                         kill_pgrp(tty_pgrp, SIGHUP, on_exit);
806                         if (!on_exit)
807                                 kill_pgrp(tty_pgrp, SIGCONT, on_exit);
808                         put_pid(tty_pgrp);
809                 }
810         } else if (on_exit) {
811                 struct pid *old_pgrp;
812                 spin_lock_irq(&current->sighand->siglock);
813                 old_pgrp = current->signal->tty_old_pgrp;
814                 current->signal->tty_old_pgrp = NULL;
815                 spin_unlock_irq(&current->sighand->siglock);
816                 if (old_pgrp) {
817                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
818                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
819                         put_pid(old_pgrp);
820                 }
821                 return;
822         }
823
824         spin_lock_irq(&current->sighand->siglock);
825         put_pid(current->signal->tty_old_pgrp);
826         current->signal->tty_old_pgrp = NULL;
827         spin_unlock_irq(&current->sighand->siglock);
828
829         tty = get_current_tty();
830         if (tty) {
831                 unsigned long flags;
832                 spin_lock_irqsave(&tty->ctrl_lock, flags);
833                 put_pid(tty->session);
834                 put_pid(tty->pgrp);
835                 tty->session = NULL;
836                 tty->pgrp = NULL;
837                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
838                 tty_kref_put(tty);
839         } else {
840 #ifdef TTY_DEBUG_HANGUP
841                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
842                        " = NULL", tty);
843 #endif
844         }
845
846         /* Now clear signal->tty under the lock */
847         read_lock(&tasklist_lock);
848         session_clear_tty(task_session(current));
849         read_unlock(&tasklist_lock);
850 }
851
852 /**
853  *
854  *      no_tty  - Ensure the current process does not have a controlling tty
855  */
856 void no_tty(void)
857 {
858         /* FIXME: Review locking here. The tty_lock never covered any race
859            between a new association and proc_clear_tty but possible we need
860            to protect against this anyway */
861         struct task_struct *tsk = current;
862         disassociate_ctty(0);
863         proc_clear_tty(tsk);
864 }
865
866
867 /**
868  *      stop_tty        -       propagate flow control
869  *      @tty: tty to stop
870  *
871  *      Perform flow control to the driver. For PTY/TTY pairs we
872  *      must also propagate the TIOCKPKT status. May be called
873  *      on an already stopped device and will not re-call the driver
874  *      method.
875  *
876  *      This functionality is used by both the line disciplines for
877  *      halting incoming flow and by the driver. It may therefore be
878  *      called from any context, may be under the tty atomic_write_lock
879  *      but not always.
880  *
881  *      Locking:
882  *              Uses the tty control lock internally
883  */
884
885 void stop_tty(struct tty_struct *tty)
886 {
887         unsigned long flags;
888         spin_lock_irqsave(&tty->ctrl_lock, flags);
889         if (tty->stopped) {
890                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
891                 return;
892         }
893         tty->stopped = 1;
894         if (tty->link && tty->link->packet) {
895                 tty->ctrl_status &= ~TIOCPKT_START;
896                 tty->ctrl_status |= TIOCPKT_STOP;
897                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
898         }
899         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
900         if (tty->ops->stop)
901                 (tty->ops->stop)(tty);
902 }
903
904 EXPORT_SYMBOL(stop_tty);
905
906 /**
907  *      start_tty       -       propagate flow control
908  *      @tty: tty to start
909  *
910  *      Start a tty that has been stopped if at all possible. Perform
911  *      any necessary wakeups and propagate the TIOCPKT status. If this
912  *      is the tty was previous stopped and is being started then the
913  *      driver start method is invoked and the line discipline woken.
914  *
915  *      Locking:
916  *              ctrl_lock
917  */
918
919 void start_tty(struct tty_struct *tty)
920 {
921         unsigned long flags;
922         spin_lock_irqsave(&tty->ctrl_lock, flags);
923         if (!tty->stopped || tty->flow_stopped) {
924                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
925                 return;
926         }
927         tty->stopped = 0;
928         if (tty->link && tty->link->packet) {
929                 tty->ctrl_status &= ~TIOCPKT_STOP;
930                 tty->ctrl_status |= TIOCPKT_START;
931                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
932         }
933         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
934         if (tty->ops->start)
935                 (tty->ops->start)(tty);
936         /* If we have a running line discipline it may need kicking */
937         tty_wakeup(tty);
938 }
939
940 EXPORT_SYMBOL(start_tty);
941
942 /**
943  *      tty_read        -       read method for tty device files
944  *      @file: pointer to tty file
945  *      @buf: user buffer
946  *      @count: size of user buffer
947  *      @ppos: unused
948  *
949  *      Perform the read system call function on this terminal device. Checks
950  *      for hung up devices before calling the line discipline method.
951  *
952  *      Locking:
953  *              Locks the line discipline internally while needed. Multiple
954  *      read calls may be outstanding in parallel.
955  */
956
957 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
958                         loff_t *ppos)
959 {
960         int i;
961         struct inode *inode = file->f_path.dentry->d_inode;
962         struct tty_struct *tty = file_tty(file);
963         struct tty_ldisc *ld;
964
965         if (tty_paranoia_check(tty, inode, "tty_read"))
966                 return -EIO;
967         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
968                 return -EIO;
969
970         /* We want to wait for the line discipline to sort out in this
971            situation */
972         ld = tty_ldisc_ref_wait(tty);
973         if (ld->ops->read)
974                 i = (ld->ops->read)(tty, file, buf, count);
975         else
976                 i = -EIO;
977         tty_ldisc_deref(ld);
978         if (i > 0)
979                 inode->i_atime = current_fs_time(inode->i_sb);
980         return i;
981 }
982
983 void tty_write_unlock(struct tty_struct *tty)
984         __releases(&tty->atomic_write_lock)
985 {
986         mutex_unlock(&tty->atomic_write_lock);
987         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
988 }
989
990 int tty_write_lock(struct tty_struct *tty, int ndelay)
991         __acquires(&tty->atomic_write_lock)
992 {
993         if (!mutex_trylock(&tty->atomic_write_lock)) {
994                 if (ndelay)
995                         return -EAGAIN;
996                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
997                         return -ERESTARTSYS;
998         }
999         return 0;
1000 }
1001
1002 /*
1003  * Split writes up in sane blocksizes to avoid
1004  * denial-of-service type attacks
1005  */
1006 static inline ssize_t do_tty_write(
1007         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1008         struct tty_struct *tty,
1009         struct file *file,
1010         const char __user *buf,
1011         size_t count)
1012 {
1013         ssize_t ret, written = 0;
1014         unsigned int chunk;
1015
1016         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1017         if (ret < 0)
1018                 return ret;
1019
1020         /*
1021          * We chunk up writes into a temporary buffer. This
1022          * simplifies low-level drivers immensely, since they
1023          * don't have locking issues and user mode accesses.
1024          *
1025          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1026          * big chunk-size..
1027          *
1028          * The default chunk-size is 2kB, because the NTTY
1029          * layer has problems with bigger chunks. It will
1030          * claim to be able to handle more characters than
1031          * it actually does.
1032          *
1033          * FIXME: This can probably go away now except that 64K chunks
1034          * are too likely to fail unless switched to vmalloc...
1035          */
1036         chunk = 2048;
1037         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1038                 chunk = 65536;
1039         if (count < chunk)
1040                 chunk = count;
1041
1042         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1043         if (tty->write_cnt < chunk) {
1044                 unsigned char *buf_chunk;
1045
1046                 if (chunk < 1024)
1047                         chunk = 1024;
1048
1049                 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1050                 if (!buf_chunk) {
1051                         ret = -ENOMEM;
1052                         goto out;
1053                 }
1054                 kfree(tty->write_buf);
1055                 tty->write_cnt = chunk;
1056                 tty->write_buf = buf_chunk;
1057         }
1058
1059         /* Do the write .. */
1060         for (;;) {
1061                 size_t size = count;
1062                 if (size > chunk)
1063                         size = chunk;
1064                 ret = -EFAULT;
1065                 if (copy_from_user(tty->write_buf, buf, size))
1066                         break;
1067                 ret = write(tty, file, tty->write_buf, size);
1068                 if (ret <= 0)
1069                         break;
1070                 written += ret;
1071                 buf += ret;
1072                 count -= ret;
1073                 if (!count)
1074                         break;
1075                 ret = -ERESTARTSYS;
1076                 if (signal_pending(current))
1077                         break;
1078                 cond_resched();
1079         }
1080         if (written) {
1081                 struct inode *inode = file->f_path.dentry->d_inode;
1082                 inode->i_mtime = current_fs_time(inode->i_sb);
1083                 ret = written;
1084         }
1085 out:
1086         tty_write_unlock(tty);
1087         return ret;
1088 }
1089
1090 /**
1091  * tty_write_message - write a message to a certain tty, not just the console.
1092  * @tty: the destination tty_struct
1093  * @msg: the message to write
1094  *
1095  * This is used for messages that need to be redirected to a specific tty.
1096  * We don't put it into the syslog queue right now maybe in the future if
1097  * really needed.
1098  *
1099  * We must still hold the BTM and test the CLOSING flag for the moment.
1100  */
1101
1102 void tty_write_message(struct tty_struct *tty, char *msg)
1103 {
1104         if (tty) {
1105                 mutex_lock(&tty->atomic_write_lock);
1106                 tty_lock();
1107                 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1108                         tty_unlock();
1109                         tty->ops->write(tty, msg, strlen(msg));
1110                 } else
1111                         tty_unlock();
1112                 tty_write_unlock(tty);
1113         }
1114         return;
1115 }
1116
1117
1118 /**
1119  *      tty_write               -       write method for tty device file
1120  *      @file: tty file pointer
1121  *      @buf: user data to write
1122  *      @count: bytes to write
1123  *      @ppos: unused
1124  *
1125  *      Write data to a tty device via the line discipline.
1126  *
1127  *      Locking:
1128  *              Locks the line discipline as required
1129  *              Writes to the tty driver are serialized by the atomic_write_lock
1130  *      and are then processed in chunks to the device. The line discipline
1131  *      write method will not be invoked in parallel for each device.
1132  */
1133
1134 static ssize_t tty_write(struct file *file, const char __user *buf,
1135                                                 size_t count, loff_t *ppos)
1136 {
1137         struct inode *inode = file->f_path.dentry->d_inode;
1138         struct tty_struct *tty = file_tty(file);
1139         struct tty_ldisc *ld;
1140         ssize_t ret;
1141
1142         if (tty_paranoia_check(tty, inode, "tty_write"))
1143                 return -EIO;
1144         if (!tty || !tty->ops->write ||
1145                 (test_bit(TTY_IO_ERROR, &tty->flags)))
1146                         return -EIO;
1147         /* Short term debug to catch buggy drivers */
1148         if (tty->ops->write_room == NULL)
1149                 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1150                         tty->driver->name);
1151         ld = tty_ldisc_ref_wait(tty);
1152         if (!ld->ops->write)
1153                 ret = -EIO;
1154         else
1155                 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1156         tty_ldisc_deref(ld);
1157         return ret;
1158 }
1159
1160 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1161                                                 size_t count, loff_t *ppos)
1162 {
1163         struct file *p = NULL;
1164
1165         spin_lock(&redirect_lock);
1166         if (redirect) {
1167                 get_file(redirect);
1168                 p = redirect;
1169         }
1170         spin_unlock(&redirect_lock);
1171
1172         if (p) {
1173                 ssize_t res;
1174                 res = vfs_write(p, buf, count, &p->f_pos);
1175                 fput(p);
1176                 return res;
1177         }
1178         return tty_write(file, buf, count, ppos);
1179 }
1180
1181 static char ptychar[] = "pqrstuvwxyzabcde";
1182
1183 /**
1184  *      pty_line_name   -       generate name for a pty
1185  *      @driver: the tty driver in use
1186  *      @index: the minor number
1187  *      @p: output buffer of at least 6 bytes
1188  *
1189  *      Generate a name from a driver reference and write it to the output
1190  *      buffer.
1191  *
1192  *      Locking: None
1193  */
1194 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1195 {
1196         int i = index + driver->name_base;
1197         /* ->name is initialized to "ttyp", but "tty" is expected */
1198         sprintf(p, "%s%c%x",
1199                 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1200                 ptychar[i >> 4 & 0xf], i & 0xf);
1201 }
1202
1203 /**
1204  *      tty_line_name   -       generate name for a tty
1205  *      @driver: the tty driver in use
1206  *      @index: the minor number
1207  *      @p: output buffer of at least 7 bytes
1208  *
1209  *      Generate a name from a driver reference and write it to the output
1210  *      buffer.
1211  *
1212  *      Locking: None
1213  */
1214 static void tty_line_name(struct tty_driver *driver, int index, char *p)
1215 {
1216         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1217 }
1218
1219 /**
1220  *      tty_driver_lookup_tty() - find an existing tty, if any
1221  *      @driver: the driver for the tty
1222  *      @idx:    the minor number
1223  *
1224  *      Return the tty, if found or ERR_PTR() otherwise.
1225  *
1226  *      Locking: tty_mutex must be held. If tty is found, the mutex must
1227  *      be held until the 'fast-open' is also done. Will change once we
1228  *      have refcounting in the driver and per driver locking
1229  */
1230 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1231                 struct inode *inode, int idx)
1232 {
1233         if (driver->ops->lookup)
1234                 return driver->ops->lookup(driver, inode, idx);
1235
1236         return driver->ttys[idx];
1237 }
1238
1239 /**
1240  *      tty_init_termios        -  helper for termios setup
1241  *      @tty: the tty to set up
1242  *
1243  *      Initialise the termios structures for this tty. Thus runs under
1244  *      the tty_mutex currently so we can be relaxed about ordering.
1245  */
1246
1247 int tty_init_termios(struct tty_struct *tty)
1248 {
1249         struct ktermios *tp;
1250         int idx = tty->index;
1251
1252         tp = tty->driver->termios[idx];
1253         if (tp == NULL) {
1254                 tp = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
1255                 if (tp == NULL)
1256                         return -ENOMEM;
1257                 memcpy(tp, &tty->driver->init_termios,
1258                                                 sizeof(struct ktermios));
1259                 tty->driver->termios[idx] = tp;
1260         }
1261         tty->termios = tp;
1262         tty->termios_locked = tp + 1;
1263
1264         /* Compatibility until drivers always set this */
1265         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1266         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1267         return 0;
1268 }
1269 EXPORT_SYMBOL_GPL(tty_init_termios);
1270
1271 int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1272 {
1273         int ret = tty_init_termios(tty);
1274         if (ret)
1275                 return ret;
1276
1277         tty_driver_kref_get(driver);
1278         tty->count++;
1279         driver->ttys[tty->index] = tty;
1280         return 0;
1281 }
1282 EXPORT_SYMBOL_GPL(tty_standard_install);
1283
1284 /**
1285  *      tty_driver_install_tty() - install a tty entry in the driver
1286  *      @driver: the driver for the tty
1287  *      @tty: the tty
1288  *
1289  *      Install a tty object into the driver tables. The tty->index field
1290  *      will be set by the time this is called. This method is responsible
1291  *      for ensuring any need additional structures are allocated and
1292  *      configured.
1293  *
1294  *      Locking: tty_mutex for now
1295  */
1296 static int tty_driver_install_tty(struct tty_driver *driver,
1297                                                 struct tty_struct *tty)
1298 {
1299         return driver->ops->install ? driver->ops->install(driver, tty) :
1300                 tty_standard_install(driver, tty);
1301 }
1302
1303 /**
1304  *      tty_driver_remove_tty() - remove a tty from the driver tables
1305  *      @driver: the driver for the tty
1306  *      @idx:    the minor number
1307  *
1308  *      Remvoe a tty object from the driver tables. The tty->index field
1309  *      will be set by the time this is called.
1310  *
1311  *      Locking: tty_mutex for now
1312  */
1313 void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1314 {
1315         if (driver->ops->remove)
1316                 driver->ops->remove(driver, tty);
1317         else
1318                 driver->ttys[tty->index] = NULL;
1319 }
1320
1321 /*
1322  *      tty_reopen()    - fast re-open of an open tty
1323  *      @tty    - the tty to open
1324  *
1325  *      Return 0 on success, -errno on error.
1326  *
1327  *      Locking: tty_mutex must be held from the time the tty was found
1328  *               till this open completes.
1329  */
1330 static int tty_reopen(struct tty_struct *tty)
1331 {
1332         struct tty_driver *driver = tty->driver;
1333
1334         if (test_bit(TTY_CLOSING, &tty->flags) ||
1335                         test_bit(TTY_HUPPING, &tty->flags) ||
1336                         test_bit(TTY_LDISC_CHANGING, &tty->flags))
1337                 return -EIO;
1338
1339         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1340             driver->subtype == PTY_TYPE_MASTER) {
1341                 /*
1342                  * special case for PTY masters: only one open permitted,
1343                  * and the slave side open count is incremented as well.
1344                  */
1345                 if (tty->count)
1346                         return -EIO;
1347
1348                 tty->link->count++;
1349         }
1350         tty->count++;
1351
1352         mutex_lock(&tty->ldisc_mutex);
1353         WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1354         mutex_unlock(&tty->ldisc_mutex);
1355
1356         return 0;
1357 }
1358
1359 /**
1360  *      tty_init_dev            -       initialise a tty device
1361  *      @driver: tty driver we are opening a device on
1362  *      @idx: device index
1363  *      @ret_tty: returned tty structure
1364  *
1365  *      Prepare a tty device. This may not be a "new" clean device but
1366  *      could also be an active device. The pty drivers require special
1367  *      handling because of this.
1368  *
1369  *      Locking:
1370  *              The function is called under the tty_mutex, which
1371  *      protects us from the tty struct or driver itself going away.
1372  *
1373  *      On exit the tty device has the line discipline attached and
1374  *      a reference count of 1. If a pair was created for pty/tty use
1375  *      and the other was a pty master then it too has a reference count of 1.
1376  *
1377  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1378  * failed open.  The new code protects the open with a mutex, so it's
1379  * really quite straightforward.  The mutex locking can probably be
1380  * relaxed for the (most common) case of reopening a tty.
1381  */
1382
1383 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1384 {
1385         struct tty_struct *tty;
1386         int retval;
1387
1388         /*
1389          * First time open is complex, especially for PTY devices.
1390          * This code guarantees that either everything succeeds and the
1391          * TTY is ready for operation, or else the table slots are vacated
1392          * and the allocated memory released.  (Except that the termios
1393          * and locked termios may be retained.)
1394          */
1395
1396         if (!try_module_get(driver->owner))
1397                 return ERR_PTR(-ENODEV);
1398
1399         tty = alloc_tty_struct();
1400         if (!tty) {
1401                 retval = -ENOMEM;
1402                 goto err_module_put;
1403         }
1404         initialize_tty_struct(tty, driver, idx);
1405
1406         retval = tty_driver_install_tty(driver, tty);
1407         if (retval < 0)
1408                 goto err_deinit_tty;
1409
1410         /*
1411          * Structures all installed ... call the ldisc open routines.
1412          * If we fail here just call release_tty to clean up.  No need
1413          * to decrement the use counts, as release_tty doesn't care.
1414          */
1415         retval = tty_ldisc_setup(tty, tty->link);
1416         if (retval)
1417                 goto err_release_tty;
1418         return tty;
1419
1420 err_deinit_tty:
1421         deinitialize_tty_struct(tty);
1422         free_tty_struct(tty);
1423 err_module_put:
1424         module_put(driver->owner);
1425         return ERR_PTR(retval);
1426
1427         /* call the tty release_tty routine to clean out this slot */
1428 err_release_tty:
1429         printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1430                                  "clearing slot %d\n", idx);
1431         release_tty(tty, idx);
1432         return ERR_PTR(retval);
1433 }
1434
1435 void tty_free_termios(struct tty_struct *tty)
1436 {
1437         struct ktermios *tp;
1438         int idx = tty->index;
1439         /* Kill this flag and push into drivers for locking etc */
1440         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1441                 /* FIXME: Locking on ->termios array */
1442                 tp = tty->termios;
1443                 tty->driver->termios[idx] = NULL;
1444                 kfree(tp);
1445         }
1446 }
1447 EXPORT_SYMBOL(tty_free_termios);
1448
1449 void tty_shutdown(struct tty_struct *tty)
1450 {
1451         tty_driver_remove_tty(tty->driver, tty);
1452         tty_free_termios(tty);
1453 }
1454 EXPORT_SYMBOL(tty_shutdown);
1455
1456 /**
1457  *      release_one_tty         -       release tty structure memory
1458  *      @kref: kref of tty we are obliterating
1459  *
1460  *      Releases memory associated with a tty structure, and clears out the
1461  *      driver table slots. This function is called when a device is no longer
1462  *      in use. It also gets called when setup of a device fails.
1463  *
1464  *      Locking:
1465  *              tty_mutex - sometimes only
1466  *              takes the file list lock internally when working on the list
1467  *      of ttys that the driver keeps.
1468  *
1469  *      This method gets called from a work queue so that the driver private
1470  *      cleanup ops can sleep (needed for USB at least)
1471  */
1472 static void release_one_tty(struct work_struct *work)
1473 {
1474         struct tty_struct *tty =
1475                 container_of(work, struct tty_struct, hangup_work);
1476         struct tty_driver *driver = tty->driver;
1477
1478         if (tty->ops->cleanup)
1479                 tty->ops->cleanup(tty);
1480
1481         tty->magic = 0;
1482         tty_driver_kref_put(driver);
1483         module_put(driver->owner);
1484
1485         spin_lock(&tty_files_lock);
1486         list_del_init(&tty->tty_files);
1487         spin_unlock(&tty_files_lock);
1488
1489         put_pid(tty->pgrp);
1490         put_pid(tty->session);
1491         free_tty_struct(tty);
1492 }
1493
1494 static void queue_release_one_tty(struct kref *kref)
1495 {
1496         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1497
1498         if (tty->ops->shutdown)
1499                 tty->ops->shutdown(tty);
1500         else
1501                 tty_shutdown(tty);
1502
1503         /* The hangup queue is now free so we can reuse it rather than
1504            waste a chunk of memory for each port */
1505         INIT_WORK(&tty->hangup_work, release_one_tty);
1506         schedule_work(&tty->hangup_work);
1507 }
1508
1509 /**
1510  *      tty_kref_put            -       release a tty kref
1511  *      @tty: tty device
1512  *
1513  *      Release a reference to a tty device and if need be let the kref
1514  *      layer destruct the object for us
1515  */
1516
1517 void tty_kref_put(struct tty_struct *tty)
1518 {
1519         if (tty)
1520                 kref_put(&tty->kref, queue_release_one_tty);
1521 }
1522 EXPORT_SYMBOL(tty_kref_put);
1523
1524 /**
1525  *      release_tty             -       release tty structure memory
1526  *
1527  *      Release both @tty and a possible linked partner (think pty pair),
1528  *      and decrement the refcount of the backing module.
1529  *
1530  *      Locking:
1531  *              tty_mutex - sometimes only
1532  *              takes the file list lock internally when working on the list
1533  *      of ttys that the driver keeps.
1534  *              FIXME: should we require tty_mutex is held here ??
1535  *
1536  */
1537 static void release_tty(struct tty_struct *tty, int idx)
1538 {
1539         /* This should always be true but check for the moment */
1540         WARN_ON(tty->index != idx);
1541
1542         if (tty->link)
1543                 tty_kref_put(tty->link);
1544         tty_kref_put(tty);
1545 }
1546
1547 /**
1548  *      tty_release_checks - check a tty before real release
1549  *      @tty: tty to check
1550  *      @o_tty: link of @tty (if any)
1551  *      @idx: index of the tty
1552  *
1553  *      Performs some paranoid checking before true release of the @tty.
1554  *      This is a no-op unless TTY_PARANOIA_CHECK is defined.
1555  */
1556 static int tty_release_checks(struct tty_struct *tty, struct tty_struct *o_tty,
1557                 int idx)
1558 {
1559 #ifdef TTY_PARANOIA_CHECK
1560         if (idx < 0 || idx >= tty->driver->num) {
1561                 printk(KERN_DEBUG "%s: bad idx when trying to free (%s)\n",
1562                                 __func__, tty->name);
1563                 return -1;
1564         }
1565
1566         /* not much to check for devpts */
1567         if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1568                 return 0;
1569
1570         if (tty != tty->driver->ttys[idx]) {
1571                 printk(KERN_DEBUG "%s: driver.table[%d] not tty for (%s)\n",
1572                                 __func__, idx, tty->name);
1573                 return -1;
1574         }
1575         if (tty->termios != tty->driver->termios[idx]) {
1576                 printk(KERN_DEBUG "%s: driver.termios[%d] not termios for (%s)\n",
1577                                 __func__, idx, tty->name);
1578                 return -1;
1579         }
1580         if (tty->driver->other) {
1581                 if (o_tty != tty->driver->other->ttys[idx]) {
1582                         printk(KERN_DEBUG "%s: other->table[%d] not o_tty for (%s)\n",
1583                                         __func__, idx, tty->name);
1584                         return -1;
1585                 }
1586                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1587                         printk(KERN_DEBUG "%s: other->termios[%d] not o_termios for (%s)\n",
1588                                         __func__, idx, tty->name);
1589                         return -1;
1590                 }
1591                 if (o_tty->link != tty) {
1592                         printk(KERN_DEBUG "%s: bad pty pointers\n", __func__);
1593                         return -1;
1594                 }
1595         }
1596 #endif
1597         return 0;
1598 }
1599
1600 /**
1601  *      tty_release             -       vfs callback for close
1602  *      @inode: inode of tty
1603  *      @filp: file pointer for handle to tty
1604  *
1605  *      Called the last time each file handle is closed that references
1606  *      this tty. There may however be several such references.
1607  *
1608  *      Locking:
1609  *              Takes bkl. See tty_release_dev
1610  *
1611  * Even releasing the tty structures is a tricky business.. We have
1612  * to be very careful that the structures are all released at the
1613  * same time, as interrupts might otherwise get the wrong pointers.
1614  *
1615  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1616  * lead to double frees or releasing memory still in use.
1617  */
1618
1619 int tty_release(struct inode *inode, struct file *filp)
1620 {
1621         struct tty_struct *tty = file_tty(filp);
1622         struct tty_struct *o_tty;
1623         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1624         int     devpts;
1625         int     idx;
1626         char    buf[64];
1627
1628         if (tty_paranoia_check(tty, inode, __func__))
1629                 return 0;
1630
1631         tty_lock();
1632         check_tty_count(tty, __func__);
1633
1634         __tty_fasync(-1, filp, 0);
1635
1636         idx = tty->index;
1637         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1638                       tty->driver->subtype == PTY_TYPE_MASTER);
1639         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1640         o_tty = tty->link;
1641
1642         if (tty_release_checks(tty, o_tty, idx)) {
1643                 tty_unlock();
1644                 return 0;
1645         }
1646
1647 #ifdef TTY_DEBUG_HANGUP
1648         printk(KERN_DEBUG "%s: %s (tty count=%d)...\n", __func__,
1649                         tty_name(tty, buf), tty->count);
1650 #endif
1651
1652         if (tty->ops->close)
1653                 tty->ops->close(tty, filp);
1654
1655         tty_unlock();
1656         /*
1657          * Sanity check: if tty->count is going to zero, there shouldn't be
1658          * any waiters on tty->read_wait or tty->write_wait.  We test the
1659          * wait queues and kick everyone out _before_ actually starting to
1660          * close.  This ensures that we won't block while releasing the tty
1661          * structure.
1662          *
1663          * The test for the o_tty closing is necessary, since the master and
1664          * slave sides may close in any order.  If the slave side closes out
1665          * first, its count will be one, since the master side holds an open.
1666          * Thus this test wouldn't be triggered at the time the slave closes,
1667          * so we do it now.
1668          *
1669          * Note that it's possible for the tty to be opened again while we're
1670          * flushing out waiters.  By recalculating the closing flags before
1671          * each iteration we avoid any problems.
1672          */
1673         while (1) {
1674                 /* Guard against races with tty->count changes elsewhere and
1675                    opens on /dev/tty */
1676
1677                 mutex_lock(&tty_mutex);
1678                 tty_lock();
1679                 tty_closing = tty->count <= 1;
1680                 o_tty_closing = o_tty &&
1681                         (o_tty->count <= (pty_master ? 1 : 0));
1682                 do_sleep = 0;
1683
1684                 if (tty_closing) {
1685                         if (waitqueue_active(&tty->read_wait)) {
1686                                 wake_up_poll(&tty->read_wait, POLLIN);
1687                                 do_sleep++;
1688                         }
1689                         if (waitqueue_active(&tty->write_wait)) {
1690                                 wake_up_poll(&tty->write_wait, POLLOUT);
1691                                 do_sleep++;
1692                         }
1693                 }
1694                 if (o_tty_closing) {
1695                         if (waitqueue_active(&o_tty->read_wait)) {
1696                                 wake_up_poll(&o_tty->read_wait, POLLIN);
1697                                 do_sleep++;
1698                         }
1699                         if (waitqueue_active(&o_tty->write_wait)) {
1700                                 wake_up_poll(&o_tty->write_wait, POLLOUT);
1701                                 do_sleep++;
1702                         }
1703                 }
1704                 if (!do_sleep)
1705                         break;
1706
1707                 printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
1708                                 __func__, tty_name(tty, buf));
1709                 tty_unlock();
1710                 mutex_unlock(&tty_mutex);
1711                 schedule();
1712         }
1713
1714         /*
1715          * The closing flags are now consistent with the open counts on
1716          * both sides, and we've completed the last operation that could
1717          * block, so it's safe to proceed with closing.
1718          */
1719         if (pty_master) {
1720                 if (--o_tty->count < 0) {
1721                         printk(KERN_WARNING "%s: bad pty slave count (%d) for %s\n",
1722                                 __func__, o_tty->count, tty_name(o_tty, buf));
1723                         o_tty->count = 0;
1724                 }
1725         }
1726         if (--tty->count < 0) {
1727                 printk(KERN_WARNING "%s: bad tty->count (%d) for %s\n",
1728                                 __func__, tty->count, tty_name(tty, buf));
1729                 tty->count = 0;
1730         }
1731
1732         /*
1733          * We've decremented tty->count, so we need to remove this file
1734          * descriptor off the tty->tty_files list; this serves two
1735          * purposes:
1736          *  - check_tty_count sees the correct number of file descriptors
1737          *    associated with this tty.
1738          *  - do_tty_hangup no longer sees this file descriptor as
1739          *    something that needs to be handled for hangups.
1740          */
1741         tty_del_file(filp);
1742
1743         /*
1744          * Perform some housekeeping before deciding whether to return.
1745          *
1746          * Set the TTY_CLOSING flag if this was the last open.  In the
1747          * case of a pty we may have to wait around for the other side
1748          * to close, and TTY_CLOSING makes sure we can't be reopened.
1749          */
1750         if (tty_closing)
1751                 set_bit(TTY_CLOSING, &tty->flags);
1752         if (o_tty_closing)
1753                 set_bit(TTY_CLOSING, &o_tty->flags);
1754
1755         /*
1756          * If _either_ side is closing, make sure there aren't any
1757          * processes that still think tty or o_tty is their controlling
1758          * tty.
1759          */
1760         if (tty_closing || o_tty_closing) {
1761                 read_lock(&tasklist_lock);
1762                 session_clear_tty(tty->session);
1763                 if (o_tty)
1764                         session_clear_tty(o_tty->session);
1765                 read_unlock(&tasklist_lock);
1766         }
1767
1768         mutex_unlock(&tty_mutex);
1769
1770         /* check whether both sides are closing ... */
1771         if (!tty_closing || (o_tty && !o_tty_closing)) {
1772                 tty_unlock();
1773                 return 0;
1774         }
1775
1776 #ifdef TTY_DEBUG_HANGUP
1777         printk(KERN_DEBUG "%s: freeing tty structure...\n", __func__);
1778 #endif
1779         /*
1780          * Ask the line discipline code to release its structures
1781          */
1782         tty_ldisc_release(tty, o_tty);
1783         /*
1784          * The release_tty function takes care of the details of clearing
1785          * the slots and preserving the termios structure.
1786          */
1787         release_tty(tty, idx);
1788
1789         /* Make this pty number available for reallocation */
1790         if (devpts)
1791                 devpts_kill_index(inode, idx);
1792         tty_unlock();
1793         return 0;
1794 }
1795
1796 /**
1797  *      tty_open_current_tty - get tty of current task for open
1798  *      @device: device number
1799  *      @filp: file pointer to tty
1800  *      @return: tty of the current task iff @device is /dev/tty
1801  *
1802  *      We cannot return driver and index like for the other nodes because
1803  *      devpts will not work then. It expects inodes to be from devpts FS.
1804  *
1805  *      We need to move to returning a refcounted object from all the lookup
1806  *      paths including this one.
1807  */
1808 static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1809 {
1810         struct tty_struct *tty;
1811
1812         if (device != MKDEV(TTYAUX_MAJOR, 0))
1813                 return NULL;
1814
1815         tty = get_current_tty();
1816         if (!tty)
1817                 return ERR_PTR(-ENXIO);
1818
1819         filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1820         /* noctty = 1; */
1821         tty_kref_put(tty);
1822         /* FIXME: we put a reference and return a TTY! */
1823         /* This is only safe because the caller holds tty_mutex */
1824         return tty;
1825 }
1826
1827 /**
1828  *      tty_lookup_driver - lookup a tty driver for a given device file
1829  *      @device: device number
1830  *      @filp: file pointer to tty
1831  *      @noctty: set if the device should not become a controlling tty
1832  *      @index: index for the device in the @return driver
1833  *      @return: driver for this inode (with increased refcount)
1834  *
1835  *      If @return is not erroneous, the caller is responsible to decrement the
1836  *      refcount by tty_driver_kref_put.
1837  *
1838  *      Locking: tty_mutex protects get_tty_driver
1839  */
1840 static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1841                 int *noctty, int *index)
1842 {
1843         struct tty_driver *driver;
1844
1845         switch (device) {
1846 #ifdef CONFIG_VT
1847         case MKDEV(TTY_MAJOR, 0): {
1848                 extern struct tty_driver *console_driver;
1849                 driver = tty_driver_kref_get(console_driver);
1850                 *index = fg_console;
1851                 *noctty = 1;
1852                 break;
1853         }
1854 #endif
1855         case MKDEV(TTYAUX_MAJOR, 1): {
1856                 struct tty_driver *console_driver = console_device(index);
1857                 if (console_driver) {
1858                         driver = tty_driver_kref_get(console_driver);
1859                         if (driver) {
1860                                 /* Don't let /dev/console block */
1861                                 filp->f_flags |= O_NONBLOCK;
1862                                 *noctty = 1;
1863                                 break;
1864                         }
1865                 }
1866                 return ERR_PTR(-ENODEV);
1867         }
1868         default:
1869                 driver = get_tty_driver(device, index);
1870                 if (!driver)
1871                         return ERR_PTR(-ENODEV);
1872                 break;
1873         }
1874         return driver;
1875 }
1876
1877 /**
1878  *      tty_open                -       open a tty device
1879  *      @inode: inode of device file
1880  *      @filp: file pointer to tty
1881  *
1882  *      tty_open and tty_release keep up the tty count that contains the
1883  *      number of opens done on a tty. We cannot use the inode-count, as
1884  *      different inodes might point to the same tty.
1885  *
1886  *      Open-counting is needed for pty masters, as well as for keeping
1887  *      track of serial lines: DTR is dropped when the last close happens.
1888  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
1889  *
1890  *      The termios state of a pty is reset on first open so that
1891  *      settings don't persist across reuse.
1892  *
1893  *      Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
1894  *               tty->count should protect the rest.
1895  *               ->siglock protects ->signal/->sighand
1896  */
1897
1898 static int tty_open(struct inode *inode, struct file *filp)
1899 {
1900         struct tty_struct *tty;
1901         int noctty, retval;
1902         struct tty_driver *driver = NULL;
1903         int index;
1904         dev_t device = inode->i_rdev;
1905         unsigned saved_flags = filp->f_flags;
1906
1907         nonseekable_open(inode, filp);
1908
1909 retry_open:
1910         retval = tty_alloc_file(filp);
1911         if (retval)
1912                 return -ENOMEM;
1913
1914         noctty = filp->f_flags & O_NOCTTY;
1915         index  = -1;
1916         retval = 0;
1917
1918         mutex_lock(&tty_mutex);
1919         tty_lock();
1920
1921         tty = tty_open_current_tty(device, filp);
1922         if (IS_ERR(tty)) {
1923                 retval = PTR_ERR(tty);
1924                 goto err_unlock;
1925         } else if (!tty) {
1926                 driver = tty_lookup_driver(device, filp, &noctty, &index);
1927                 if (IS_ERR(driver)) {
1928                         retval = PTR_ERR(driver);
1929                         goto err_unlock;
1930                 }
1931
1932                 /* check whether we're reopening an existing tty */
1933                 tty = tty_driver_lookup_tty(driver, inode, index);
1934                 if (IS_ERR(tty)) {
1935                         retval = PTR_ERR(tty);
1936                         goto err_unlock;
1937                 }
1938         }
1939
1940         if (tty) {
1941                 retval = tty_reopen(tty);
1942                 if (retval)
1943                         tty = ERR_PTR(retval);
1944         } else
1945                 tty = tty_init_dev(driver, index);
1946
1947         mutex_unlock(&tty_mutex);
1948         if (driver)
1949                 tty_driver_kref_put(driver);
1950         if (IS_ERR(tty)) {
1951                 tty_unlock();
1952                 retval = PTR_ERR(tty);
1953                 goto err_file;
1954         }
1955
1956         tty_add_file(tty, filp);
1957
1958         check_tty_count(tty, __func__);
1959         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1960             tty->driver->subtype == PTY_TYPE_MASTER)
1961                 noctty = 1;
1962 #ifdef TTY_DEBUG_HANGUP
1963         printk(KERN_DEBUG "%s: opening %s...\n", __func__, tty->name);
1964 #endif
1965         if (tty->ops->open)
1966                 retval = tty->ops->open(tty, filp);
1967         else
1968                 retval = -ENODEV;
1969         filp->f_flags = saved_flags;
1970
1971         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
1972                                                 !capable(CAP_SYS_ADMIN))
1973                 retval = -EBUSY;
1974
1975         if (retval) {
1976 #ifdef TTY_DEBUG_HANGUP
1977                 printk(KERN_DEBUG "%s: error %d in opening %s...\n", __func__,
1978                                 retval, tty->name);
1979 #endif
1980                 tty_unlock(); /* need to call tty_release without BTM */
1981                 tty_release(inode, filp);
1982                 if (retval != -ERESTARTSYS)
1983                         return retval;
1984
1985                 if (signal_pending(current))
1986                         return retval;
1987
1988                 schedule();
1989                 /*
1990                  * Need to reset f_op in case a hangup happened.
1991                  */
1992                 tty_lock();
1993                 if (filp->f_op == &hung_up_tty_fops)
1994                         filp->f_op = &tty_fops;
1995                 tty_unlock();
1996                 goto retry_open;
1997         }
1998         tty_unlock();
1999
2000
2001         mutex_lock(&tty_mutex);
2002         tty_lock();
2003         spin_lock_irq(&current->sighand->siglock);
2004         if (!noctty &&
2005             current->signal->leader &&
2006             !current->signal->tty &&
2007             tty->session == NULL)
2008                 __proc_set_tty(current, tty);
2009         spin_unlock_irq(&current->sighand->siglock);
2010         tty_unlock();
2011         mutex_unlock(&tty_mutex);
2012         return 0;
2013 err_unlock:
2014         tty_unlock();
2015         mutex_unlock(&tty_mutex);
2016         /* after locks to avoid deadlock */
2017         if (!IS_ERR_OR_NULL(driver))
2018                 tty_driver_kref_put(driver);
2019 err_file:
2020         tty_free_file(filp);
2021         return retval;
2022 }
2023
2024
2025
2026 /**
2027  *      tty_poll        -       check tty status
2028  *      @filp: file being polled
2029  *      @wait: poll wait structures to update
2030  *
2031  *      Call the line discipline polling method to obtain the poll
2032  *      status of the device.
2033  *
2034  *      Locking: locks called line discipline but ldisc poll method
2035  *      may be re-entered freely by other callers.
2036  */
2037
2038 static unsigned int tty_poll(struct file *filp, poll_table *wait)
2039 {
2040         struct tty_struct *tty = file_tty(filp);
2041         struct tty_ldisc *ld;
2042         int ret = 0;
2043
2044         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2045                 return 0;
2046
2047         ld = tty_ldisc_ref_wait(tty);
2048         if (ld->ops->poll)
2049                 ret = (ld->ops->poll)(tty, filp, wait);
2050         tty_ldisc_deref(ld);
2051         return ret;
2052 }
2053
2054 static int __tty_fasync(int fd, struct file *filp, int on)
2055 {
2056         struct tty_struct *tty = file_tty(filp);
2057         unsigned long flags;
2058         int retval = 0;
2059
2060         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2061                 goto out;
2062
2063         retval = fasync_helper(fd, filp, on, &tty->fasync);
2064         if (retval <= 0)
2065                 goto out;
2066
2067         if (on) {
2068                 enum pid_type type;
2069                 struct pid *pid;
2070                 if (!waitqueue_active(&tty->read_wait))
2071                         tty->minimum_to_wake = 1;
2072                 spin_lock_irqsave(&tty->ctrl_lock, flags);
2073                 if (tty->pgrp) {
2074                         pid = tty->pgrp;
2075                         type = PIDTYPE_PGID;
2076                 } else {
2077                         pid = task_pid(current);
2078                         type = PIDTYPE_PID;
2079                 }
2080                 get_pid(pid);
2081                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2082                 retval = __f_setown(filp, pid, type, 0);
2083                 put_pid(pid);
2084                 if (retval)
2085                         goto out;
2086         } else {
2087                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2088                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2089         }
2090         retval = 0;
2091 out:
2092         return retval;
2093 }
2094
2095 static int tty_fasync(int fd, struct file *filp, int on)
2096 {
2097         int retval;
2098         tty_lock();
2099         retval = __tty_fasync(fd, filp, on);
2100         tty_unlock();
2101         return retval;
2102 }
2103
2104 /**
2105  *      tiocsti                 -       fake input character
2106  *      @tty: tty to fake input into
2107  *      @p: pointer to character
2108  *
2109  *      Fake input to a tty device. Does the necessary locking and
2110  *      input management.
2111  *
2112  *      FIXME: does not honour flow control ??
2113  *
2114  *      Locking:
2115  *              Called functions take tty_ldisc_lock
2116  *              current->signal->tty check is safe without locks
2117  *
2118  *      FIXME: may race normal receive processing
2119  */
2120
2121 static int tiocsti(struct tty_struct *tty, char __user *p)
2122 {
2123         char ch, mbz = 0;
2124         struct tty_ldisc *ld;
2125
2126         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2127                 return -EPERM;
2128         if (get_user(ch, p))
2129                 return -EFAULT;
2130         tty_audit_tiocsti(tty, ch);
2131         ld = tty_ldisc_ref_wait(tty);
2132         ld->ops->receive_buf(tty, &ch, &mbz, 1);
2133         tty_ldisc_deref(ld);
2134         return 0;
2135 }
2136
2137 /**
2138  *      tiocgwinsz              -       implement window query ioctl
2139  *      @tty; tty
2140  *      @arg: user buffer for result
2141  *
2142  *      Copies the kernel idea of the window size into the user buffer.
2143  *
2144  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2145  *              is consistent.
2146  */
2147
2148 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2149 {
2150         int err;
2151
2152         mutex_lock(&tty->termios_mutex);
2153         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2154         mutex_unlock(&tty->termios_mutex);
2155
2156         return err ? -EFAULT: 0;
2157 }
2158
2159 /**
2160  *      tty_do_resize           -       resize event
2161  *      @tty: tty being resized
2162  *      @rows: rows (character)
2163  *      @cols: cols (character)
2164  *
2165  *      Update the termios variables and send the necessary signals to
2166  *      peform a terminal resize correctly
2167  */
2168
2169 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2170 {
2171         struct pid *pgrp;
2172         unsigned long flags;
2173
2174         /* Lock the tty */
2175         mutex_lock(&tty->termios_mutex);
2176         if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2177                 goto done;
2178         /* Get the PID values and reference them so we can
2179            avoid holding the tty ctrl lock while sending signals */
2180         spin_lock_irqsave(&tty->ctrl_lock, flags);
2181         pgrp = get_pid(tty->pgrp);
2182         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2183
2184         if (pgrp)
2185                 kill_pgrp(pgrp, SIGWINCH, 1);
2186         put_pid(pgrp);
2187
2188         tty->winsize = *ws;
2189 done:
2190         mutex_unlock(&tty->termios_mutex);
2191         return 0;
2192 }
2193
2194 /**
2195  *      tiocswinsz              -       implement window size set ioctl
2196  *      @tty; tty side of tty
2197  *      @arg: user buffer for result
2198  *
2199  *      Copies the user idea of the window size to the kernel. Traditionally
2200  *      this is just advisory information but for the Linux console it
2201  *      actually has driver level meaning and triggers a VC resize.
2202  *
2203  *      Locking:
2204  *              Driver dependent. The default do_resize method takes the
2205  *      tty termios mutex and ctrl_lock. The console takes its own lock
2206  *      then calls into the default method.
2207  */
2208
2209 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2210 {
2211         struct winsize tmp_ws;
2212         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2213                 return -EFAULT;
2214
2215         if (tty->ops->resize)
2216                 return tty->ops->resize(tty, &tmp_ws);
2217         else
2218                 return tty_do_resize(tty, &tmp_ws);
2219 }
2220
2221 /**
2222  *      tioccons        -       allow admin to move logical console
2223  *      @file: the file to become console
2224  *
2225  *      Allow the administrator to move the redirected console device
2226  *
2227  *      Locking: uses redirect_lock to guard the redirect information
2228  */
2229
2230 static int tioccons(struct file *file)
2231 {
2232         if (!capable(CAP_SYS_ADMIN))
2233                 return -EPERM;
2234         if (file->f_op->write == redirected_tty_write) {
2235                 struct file *f;
2236                 spin_lock(&redirect_lock);
2237                 f = redirect;
2238                 redirect = NULL;
2239                 spin_unlock(&redirect_lock);
2240                 if (f)
2241                         fput(f);
2242                 return 0;
2243         }
2244         spin_lock(&redirect_lock);
2245         if (redirect) {
2246                 spin_unlock(&redirect_lock);
2247                 return -EBUSY;
2248         }
2249         get_file(file);
2250         redirect = file;
2251         spin_unlock(&redirect_lock);
2252         return 0;
2253 }
2254
2255 /**
2256  *      fionbio         -       non blocking ioctl
2257  *      @file: file to set blocking value
2258  *      @p: user parameter
2259  *
2260  *      Historical tty interfaces had a blocking control ioctl before
2261  *      the generic functionality existed. This piece of history is preserved
2262  *      in the expected tty API of posix OS's.
2263  *
2264  *      Locking: none, the open file handle ensures it won't go away.
2265  */
2266
2267 static int fionbio(struct file *file, int __user *p)
2268 {
2269         int nonblock;
2270
2271         if (get_user(nonblock, p))
2272                 return -EFAULT;
2273
2274         spin_lock(&file->f_lock);
2275         if (nonblock)
2276                 file->f_flags |= O_NONBLOCK;
2277         else
2278                 file->f_flags &= ~O_NONBLOCK;
2279         spin_unlock(&file->f_lock);
2280         return 0;
2281 }
2282
2283 /**
2284  *      tiocsctty       -       set controlling tty
2285  *      @tty: tty structure
2286  *      @arg: user argument
2287  *
2288  *      This ioctl is used to manage job control. It permits a session
2289  *      leader to set this tty as the controlling tty for the session.
2290  *
2291  *      Locking:
2292  *              Takes tty_mutex() to protect tty instance
2293  *              Takes tasklist_lock internally to walk sessions
2294  *              Takes ->siglock() when updating signal->tty
2295  */
2296
2297 static int tiocsctty(struct tty_struct *tty, int arg)
2298 {
2299         int ret = 0;
2300         if (current->signal->leader && (task_session(current) == tty->session))
2301                 return ret;
2302
2303         mutex_lock(&tty_mutex);
2304         /*
2305          * The process must be a session leader and
2306          * not have a controlling tty already.
2307          */
2308         if (!current->signal->leader || current->signal->tty) {
2309                 ret = -EPERM;
2310                 goto unlock;
2311         }
2312
2313         if (tty->session) {
2314                 /*
2315                  * This tty is already the controlling
2316                  * tty for another session group!
2317                  */
2318                 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2319                         /*
2320                          * Steal it away
2321                          */
2322                         read_lock(&tasklist_lock);
2323                         session_clear_tty(tty->session);
2324                         read_unlock(&tasklist_lock);
2325                 } else {
2326                         ret = -EPERM;
2327                         goto unlock;
2328                 }
2329         }
2330         proc_set_tty(current, tty);
2331 unlock:
2332         mutex_unlock(&tty_mutex);
2333         return ret;
2334 }
2335
2336 /**
2337  *      tty_get_pgrp    -       return a ref counted pgrp pid
2338  *      @tty: tty to read
2339  *
2340  *      Returns a refcounted instance of the pid struct for the process
2341  *      group controlling the tty.
2342  */
2343
2344 struct pid *tty_get_pgrp(struct tty_struct *tty)
2345 {
2346         unsigned long flags;
2347         struct pid *pgrp;
2348
2349         spin_lock_irqsave(&tty->ctrl_lock, flags);
2350         pgrp = get_pid(tty->pgrp);
2351         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2352
2353         return pgrp;
2354 }
2355 EXPORT_SYMBOL_GPL(tty_get_pgrp);
2356
2357 /**
2358  *      tiocgpgrp               -       get process group
2359  *      @tty: tty passed by user
2360  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2361  *      @p: returned pid
2362  *
2363  *      Obtain the process group of the tty. If there is no process group
2364  *      return an error.
2365  *
2366  *      Locking: none. Reference to current->signal->tty is safe.
2367  */
2368
2369 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2370 {
2371         struct pid *pid;
2372         int ret;
2373         /*
2374          * (tty == real_tty) is a cheap way of
2375          * testing if the tty is NOT a master pty.
2376          */
2377         if (tty == real_tty && current->signal->tty != real_tty)
2378                 return -ENOTTY;
2379         pid = tty_get_pgrp(real_tty);
2380         ret =  put_user(pid_vnr(pid), p);
2381         put_pid(pid);
2382         return ret;
2383 }
2384
2385 /**
2386  *      tiocspgrp               -       attempt to set process group
2387  *      @tty: tty passed by user
2388  *      @real_tty: tty side device matching tty passed by user
2389  *      @p: pid pointer
2390  *
2391  *      Set the process group of the tty to the session passed. Only
2392  *      permitted where the tty session is our session.
2393  *
2394  *      Locking: RCU, ctrl lock
2395  */
2396
2397 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2398 {
2399         struct pid *pgrp;
2400         pid_t pgrp_nr;
2401         int retval = tty_check_change(real_tty);
2402         unsigned long flags;
2403
2404         if (retval == -EIO)
2405                 return -ENOTTY;
2406         if (retval)
2407                 return retval;
2408         if (!current->signal->tty ||
2409             (current->signal->tty != real_tty) ||
2410             (real_tty->session != task_session(current)))
2411                 return -ENOTTY;
2412         if (get_user(pgrp_nr, p))
2413                 return -EFAULT;
2414         if (pgrp_nr < 0)
2415                 return -EINVAL;
2416         rcu_read_lock();
2417         pgrp = find_vpid(pgrp_nr);
2418         retval = -ESRCH;
2419         if (!pgrp)
2420                 goto out_unlock;
2421         retval = -EPERM;
2422         if (session_of_pgrp(pgrp) != task_session(current))
2423                 goto out_unlock;
2424         retval = 0;
2425         spin_lock_irqsave(&tty->ctrl_lock, flags);
2426         put_pid(real_tty->pgrp);
2427         real_tty->pgrp = get_pid(pgrp);
2428         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2429 out_unlock:
2430         rcu_read_unlock();
2431         return retval;
2432 }
2433
2434 /**
2435  *      tiocgsid                -       get session id
2436  *      @tty: tty passed by user
2437  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2438  *      @p: pointer to returned session id
2439  *
2440  *      Obtain the session id of the tty. If there is no session
2441  *      return an error.
2442  *
2443  *      Locking: none. Reference to current->signal->tty is safe.
2444  */
2445
2446 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2447 {
2448         /*
2449          * (tty == real_tty) is a cheap way of
2450          * testing if the tty is NOT a master pty.
2451         */
2452         if (tty == real_tty && current->signal->tty != real_tty)
2453                 return -ENOTTY;
2454         if (!real_tty->session)
2455                 return -ENOTTY;
2456         return put_user(pid_vnr(real_tty->session), p);
2457 }
2458
2459 /**
2460  *      tiocsetd        -       set line discipline
2461  *      @tty: tty device
2462  *      @p: pointer to user data
2463  *
2464  *      Set the line discipline according to user request.
2465  *
2466  *      Locking: see tty_set_ldisc, this function is just a helper
2467  */
2468
2469 static int tiocsetd(struct tty_struct *tty, int __user *p)
2470 {
2471         int ldisc;
2472         int ret;
2473
2474         if (get_user(ldisc, p))
2475                 return -EFAULT;
2476
2477         ret = tty_set_ldisc(tty, ldisc);
2478
2479         return ret;
2480 }
2481
2482 /**
2483  *      send_break      -       performed time break
2484  *      @tty: device to break on
2485  *      @duration: timeout in mS
2486  *
2487  *      Perform a timed break on hardware that lacks its own driver level
2488  *      timed break functionality.
2489  *
2490  *      Locking:
2491  *              atomic_write_lock serializes
2492  *
2493  */
2494
2495 static int send_break(struct tty_struct *tty, unsigned int duration)
2496 {
2497         int retval;
2498
2499         if (tty->ops->break_ctl == NULL)
2500                 return 0;
2501
2502         if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2503                 retval = tty->ops->break_ctl(tty, duration);
2504         else {
2505                 /* Do the work ourselves */
2506                 if (tty_write_lock(tty, 0) < 0)
2507                         return -EINTR;
2508                 retval = tty->ops->break_ctl(tty, -1);
2509                 if (retval)
2510                         goto out;
2511                 if (!signal_pending(current))
2512                         msleep_interruptible(duration);
2513                 retval = tty->ops->break_ctl(tty, 0);
2514 out:
2515                 tty_write_unlock(tty);
2516                 if (signal_pending(current))
2517                         retval = -EINTR;
2518         }
2519         return retval;
2520 }
2521
2522 /**
2523  *      tty_tiocmget            -       get modem status
2524  *      @tty: tty device
2525  *      @file: user file pointer
2526  *      @p: pointer to result
2527  *
2528  *      Obtain the modem status bits from the tty driver if the feature
2529  *      is supported. Return -EINVAL if it is not available.
2530  *
2531  *      Locking: none (up to the driver)
2532  */
2533
2534 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2535 {
2536         int retval = -EINVAL;
2537
2538         if (tty->ops->tiocmget) {
2539                 retval = tty->ops->tiocmget(tty);
2540
2541                 if (retval >= 0)
2542                         retval = put_user(retval, p);
2543         }
2544         return retval;
2545 }
2546
2547 /**
2548  *      tty_tiocmset            -       set modem status
2549  *      @tty: tty device
2550  *      @cmd: command - clear bits, set bits or set all
2551  *      @p: pointer to desired bits
2552  *
2553  *      Set the modem status bits from the tty driver if the feature
2554  *      is supported. Return -EINVAL if it is not available.
2555  *
2556  *      Locking: none (up to the driver)
2557  */
2558
2559 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2560              unsigned __user *p)
2561 {
2562         int retval;
2563         unsigned int set, clear, val;
2564
2565         if (tty->ops->tiocmset == NULL)
2566                 return -EINVAL;
2567
2568         retval = get_user(val, p);
2569         if (retval)
2570                 return retval;
2571         set = clear = 0;
2572         switch (cmd) {
2573         case TIOCMBIS:
2574                 set = val;
2575                 break;
2576         case TIOCMBIC:
2577                 clear = val;
2578                 break;
2579         case TIOCMSET:
2580                 set = val;
2581                 clear = ~val;
2582                 break;
2583         }
2584         set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2585         clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2586         return tty->ops->tiocmset(tty, set, clear);
2587 }
2588
2589 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2590 {
2591         int retval = -EINVAL;
2592         struct serial_icounter_struct icount;
2593         memset(&icount, 0, sizeof(icount));
2594         if (tty->ops->get_icount)
2595                 retval = tty->ops->get_icount(tty, &icount);
2596         if (retval != 0)
2597                 return retval;
2598         if (copy_to_user(arg, &icount, sizeof(icount)))
2599                 return -EFAULT;
2600         return 0;
2601 }
2602
2603 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2604 {
2605         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2606             tty->driver->subtype == PTY_TYPE_MASTER)
2607                 tty = tty->link;
2608         return tty;
2609 }
2610 EXPORT_SYMBOL(tty_pair_get_tty);
2611
2612 struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2613 {
2614         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2615             tty->driver->subtype == PTY_TYPE_MASTER)
2616             return tty;
2617         return tty->link;
2618 }
2619 EXPORT_SYMBOL(tty_pair_get_pty);
2620
2621 /*
2622  * Split this up, as gcc can choke on it otherwise..
2623  */
2624 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2625 {
2626         struct tty_struct *tty = file_tty(file);
2627         struct tty_struct *real_tty;
2628         void __user *p = (void __user *)arg;
2629         int retval;
2630         struct tty_ldisc *ld;
2631         struct inode *inode = file->f_dentry->d_inode;
2632
2633         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2634                 return -EINVAL;
2635
2636         real_tty = tty_pair_get_tty(tty);
2637
2638         /*
2639          * Factor out some common prep work
2640          */
2641         switch (cmd) {
2642         case TIOCSETD:
2643         case TIOCSBRK:
2644         case TIOCCBRK:
2645         case TCSBRK:
2646         case TCSBRKP:
2647                 retval = tty_check_change(tty);
2648                 if (retval)
2649                         return retval;
2650                 if (cmd != TIOCCBRK) {
2651                         tty_wait_until_sent(tty, 0);
2652                         if (signal_pending(current))
2653                                 return -EINTR;
2654                 }
2655                 break;
2656         }
2657
2658         /*
2659          *      Now do the stuff.
2660          */
2661         switch (cmd) {
2662         case TIOCSTI:
2663                 return tiocsti(tty, p);
2664         case TIOCGWINSZ:
2665                 return tiocgwinsz(real_tty, p);
2666         case TIOCSWINSZ:
2667                 return tiocswinsz(real_tty, p);
2668         case TIOCCONS:
2669                 return real_tty != tty ? -EINVAL : tioccons(file);
2670         case FIONBIO:
2671                 return fionbio(file, p);
2672         case TIOCEXCL:
2673                 set_bit(TTY_EXCLUSIVE, &tty->flags);
2674                 return 0;
2675         case TIOCNXCL:
2676                 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2677                 return 0;
2678         case TIOCNOTTY:
2679                 if (current->signal->tty != tty)
2680                         return -ENOTTY;
2681                 no_tty();
2682                 return 0;
2683         case TIOCSCTTY:
2684                 return tiocsctty(tty, arg);
2685         case TIOCGPGRP:
2686                 return tiocgpgrp(tty, real_tty, p);
2687         case TIOCSPGRP:
2688                 return tiocspgrp(tty, real_tty, p);
2689         case TIOCGSID:
2690                 return tiocgsid(tty, real_tty, p);
2691         case TIOCGETD:
2692                 return put_user(tty->ldisc->ops->num, (int __user *)p);
2693         case TIOCSETD:
2694                 return tiocsetd(tty, p);
2695         case TIOCVHANGUP:
2696                 if (!capable(CAP_SYS_ADMIN))
2697                         return -EPERM;
2698                 tty_vhangup(tty);
2699                 return 0;
2700         case TIOCGDEV:
2701         {
2702                 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2703                 return put_user(ret, (unsigned int __user *)p);
2704         }
2705         /*
2706          * Break handling
2707          */
2708         case TIOCSBRK:  /* Turn break on, unconditionally */
2709                 if (tty->ops->break_ctl)
2710                         return tty->ops->break_ctl(tty, -1);
2711                 return 0;
2712         case TIOCCBRK:  /* Turn break off, unconditionally */
2713                 if (tty->ops->break_ctl)
2714                         return tty->ops->break_ctl(tty, 0);
2715                 return 0;
2716         case TCSBRK:   /* SVID version: non-zero arg --> no break */
2717                 /* non-zero arg means wait for all output data
2718                  * to be sent (performed above) but don't send break.
2719                  * This is used by the tcdrain() termios function.
2720                  */
2721                 if (!arg)
2722                         return send_break(tty, 250);
2723                 return 0;
2724         case TCSBRKP:   /* support for POSIX tcsendbreak() */
2725                 return send_break(tty, arg ? arg*100 : 250);
2726
2727         case TIOCMGET:
2728                 return tty_tiocmget(tty, p);
2729         case TIOCMSET:
2730         case TIOCMBIC:
2731         case TIOCMBIS:
2732                 return tty_tiocmset(tty, cmd, p);
2733         case TIOCGICOUNT:
2734                 retval = tty_tiocgicount(tty, p);
2735                 /* For the moment allow fall through to the old method */
2736                 if (retval != -EINVAL)
2737                         return retval;
2738                 break;
2739         case TCFLSH:
2740                 switch (arg) {
2741                 case TCIFLUSH:
2742                 case TCIOFLUSH:
2743                 /* flush tty buffer and allow ldisc to process ioctl */
2744                         tty_buffer_flush(tty);
2745                         break;
2746                 }
2747                 break;
2748         }
2749         if (tty->ops->ioctl) {
2750                 retval = (tty->ops->ioctl)(tty, cmd, arg);
2751                 if (retval != -ENOIOCTLCMD)
2752                         return retval;
2753         }
2754         ld = tty_ldisc_ref_wait(tty);
2755         retval = -EINVAL;
2756         if (ld->ops->ioctl) {
2757                 retval = ld->ops->ioctl(tty, file, cmd, arg);
2758                 if (retval == -ENOIOCTLCMD)
2759                         retval = -EINVAL;
2760         }
2761         tty_ldisc_deref(ld);
2762         return retval;
2763 }
2764
2765 #ifdef CONFIG_COMPAT
2766 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2767                                 unsigned long arg)
2768 {
2769         struct inode *inode = file->f_dentry->d_inode;
2770         struct tty_struct *tty = file_tty(file);
2771         struct tty_ldisc *ld;
2772         int retval = -ENOIOCTLCMD;
2773
2774         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2775                 return -EINVAL;
2776
2777         if (tty->ops->compat_ioctl) {
2778                 retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2779                 if (retval != -ENOIOCTLCMD)
2780                         return retval;
2781         }
2782
2783         ld = tty_ldisc_ref_wait(tty);
2784         if (ld->ops->compat_ioctl)
2785                 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2786         else
2787                 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2788         tty_ldisc_deref(ld);
2789
2790         return retval;
2791 }
2792 #endif
2793
2794 /*
2795  * This implements the "Secure Attention Key" ---  the idea is to
2796  * prevent trojan horses by killing all processes associated with this
2797  * tty when the user hits the "Secure Attention Key".  Required for
2798  * super-paranoid applications --- see the Orange Book for more details.
2799  *
2800  * This code could be nicer; ideally it should send a HUP, wait a few
2801  * seconds, then send a INT, and then a KILL signal.  But you then
2802  * have to coordinate with the init process, since all processes associated
2803  * with the current tty must be dead before the new getty is allowed
2804  * to spawn.
2805  *
2806  * Now, if it would be correct ;-/ The current code has a nasty hole -
2807  * it doesn't catch files in flight. We may send the descriptor to ourselves
2808  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2809  *
2810  * Nasty bug: do_SAK is being called in interrupt context.  This can
2811  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2812  */
2813 void __do_SAK(struct tty_struct *tty)
2814 {
2815 #ifdef TTY_SOFT_SAK
2816         tty_hangup(tty);
2817 #else
2818         struct task_struct *g, *p;
2819         struct pid *session;
2820         int             i;
2821         struct file     *filp;
2822         struct fdtable *fdt;
2823
2824         if (!tty)
2825                 return;
2826         session = tty->session;
2827
2828         tty_ldisc_flush(tty);
2829
2830         tty_driver_flush_buffer(tty);
2831
2832         read_lock(&tasklist_lock);
2833         /* Kill the entire session */
2834         do_each_pid_task(session, PIDTYPE_SID, p) {
2835                 printk(KERN_NOTICE "SAK: killed process %d"
2836                         " (%s): task_session(p)==tty->session\n",
2837                         task_pid_nr(p), p->comm);
2838                 send_sig(SIGKILL, p, 1);
2839         } while_each_pid_task(session, PIDTYPE_SID, p);
2840         /* Now kill any processes that happen to have the
2841          * tty open.
2842          */
2843         do_each_thread(g, p) {
2844                 if (p->signal->tty == tty) {
2845                         printk(KERN_NOTICE "SAK: killed process %d"
2846                             " (%s): task_session(p)==tty->session\n",
2847                             task_pid_nr(p), p->comm);
2848                         send_sig(SIGKILL, p, 1);
2849                         continue;
2850                 }
2851                 task_lock(p);
2852                 if (p->files) {
2853                         /*
2854                          * We don't take a ref to the file, so we must
2855                          * hold ->file_lock instead.
2856                          */
2857                         spin_lock(&p->files->file_lock);
2858                         fdt = files_fdtable(p->files);
2859                         for (i = 0; i < fdt->max_fds; i++) {
2860                                 filp = fcheck_files(p->files, i);
2861                                 if (!filp)
2862                                         continue;
2863                                 if (filp->f_op->read == tty_read &&
2864                                     file_tty(filp) == tty) {
2865                                         printk(KERN_NOTICE "SAK: killed process %d"
2866                                             " (%s): fd#%d opened to the tty\n",
2867                                             task_pid_nr(p), p->comm, i);
2868                                         force_sig(SIGKILL, p);
2869                                         break;
2870                                 }
2871                         }
2872                         spin_unlock(&p->files->file_lock);
2873                 }
2874                 task_unlock(p);
2875         } while_each_thread(g, p);
2876         read_unlock(&tasklist_lock);
2877 #endif
2878 }
2879
2880 static void do_SAK_work(struct work_struct *work)
2881 {
2882         struct tty_struct *tty =
2883                 container_of(work, struct tty_struct, SAK_work);
2884         __do_SAK(tty);
2885 }
2886
2887 /*
2888  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2889  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2890  * the values which we write to it will be identical to the values which it
2891  * already has. --akpm
2892  */
2893 void do_SAK(struct tty_struct *tty)
2894 {
2895         if (!tty)
2896                 return;
2897         schedule_work(&tty->SAK_work);
2898 }
2899
2900 EXPORT_SYMBOL(do_SAK);
2901
2902 static int dev_match_devt(struct device *dev, void *data)
2903 {
2904         dev_t *devt = data;
2905         return dev->devt == *devt;
2906 }
2907
2908 /* Must put_device() after it's unused! */
2909 static struct device *tty_get_device(struct tty_struct *tty)
2910 {
2911         dev_t devt = tty_devnum(tty);
2912         return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2913 }
2914
2915
2916 /**
2917  *      initialize_tty_struct
2918  *      @tty: tty to initialize
2919  *
2920  *      This subroutine initializes a tty structure that has been newly
2921  *      allocated.
2922  *
2923  *      Locking: none - tty in question must not be exposed at this point
2924  */
2925
2926 void initialize_tty_struct(struct tty_struct *tty,
2927                 struct tty_driver *driver, int idx)
2928 {
2929         memset(tty, 0, sizeof(struct tty_struct));
2930         kref_init(&tty->kref);
2931         tty->magic = TTY_MAGIC;
2932         tty_ldisc_init(tty);
2933         tty->session = NULL;
2934         tty->pgrp = NULL;
2935         tty->overrun_time = jiffies;
2936         tty_buffer_init(tty);
2937         mutex_init(&tty->termios_mutex);
2938         mutex_init(&tty->ldisc_mutex);
2939         init_waitqueue_head(&tty->write_wait);
2940         init_waitqueue_head(&tty->read_wait);
2941         INIT_WORK(&tty->hangup_work, do_tty_hangup);
2942         mutex_init(&tty->atomic_read_lock);
2943         mutex_init(&tty->atomic_write_lock);
2944         mutex_init(&tty->output_lock);
2945         mutex_init(&tty->echo_lock);
2946         spin_lock_init(&tty->read_lock);
2947         spin_lock_init(&tty->ctrl_lock);
2948         INIT_LIST_HEAD(&tty->tty_files);
2949         INIT_WORK(&tty->SAK_work, do_SAK_work);
2950
2951         tty->driver = driver;
2952         tty->ops = driver->ops;
2953         tty->index = idx;
2954         tty_line_name(driver, idx, tty->name);
2955         tty->dev = tty_get_device(tty);
2956 }
2957
2958 /**
2959  *      deinitialize_tty_struct
2960  *      @tty: tty to deinitialize
2961  *
2962  *      This subroutine deinitializes a tty structure that has been newly
2963  *      allocated but tty_release cannot be called on that yet.
2964  *
2965  *      Locking: none - tty in question must not be exposed at this point
2966  */
2967 void deinitialize_tty_struct(struct tty_struct *tty)
2968 {
2969         tty_ldisc_deinit(tty);
2970 }
2971
2972 /**
2973  *      tty_put_char    -       write one character to a tty
2974  *      @tty: tty
2975  *      @ch: character
2976  *
2977  *      Write one byte to the tty using the provided put_char method
2978  *      if present. Returns the number of characters successfully output.
2979  *
2980  *      Note: the specific put_char operation in the driver layer may go
2981  *      away soon. Don't call it directly, use this method
2982  */
2983
2984 int tty_put_char(struct tty_struct *tty, unsigned char ch)
2985 {
2986         if (tty->ops->put_char)
2987                 return tty->ops->put_char(tty, ch);
2988         return tty->ops->write(tty, &ch, 1);
2989 }
2990 EXPORT_SYMBOL_GPL(tty_put_char);
2991
2992 struct class *tty_class;
2993
2994 /**
2995  *      tty_register_device - register a tty device
2996  *      @driver: the tty driver that describes the tty device
2997  *      @index: the index in the tty driver for this tty device
2998  *      @device: a struct device that is associated with this tty device.
2999  *              This field is optional, if there is no known struct device
3000  *              for this tty device it can be set to NULL safely.
3001  *
3002  *      Returns a pointer to the struct device for this tty device
3003  *      (or ERR_PTR(-EFOO) on error).
3004  *
3005  *      This call is required to be made to register an individual tty device
3006  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3007  *      that bit is not set, this function should not be called by a tty
3008  *      driver.
3009  *
3010  *      Locking: ??
3011  */
3012
3013 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3014                                    struct device *device)
3015 {
3016         char name[64];
3017         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3018
3019         if (index >= driver->num) {
3020                 printk(KERN_ERR "Attempt to register invalid tty line number "
3021                        " (%d).\n", index);
3022                 return ERR_PTR(-EINVAL);
3023         }
3024
3025         if (driver->type == TTY_DRIVER_TYPE_PTY)
3026                 pty_line_name(driver, index, name);
3027         else
3028                 tty_line_name(driver, index, name);
3029
3030         return device_create(tty_class, device, dev, NULL, name);
3031 }
3032 EXPORT_SYMBOL(tty_register_device);
3033
3034 /**
3035  *      tty_unregister_device - unregister a tty device
3036  *      @driver: the tty driver that describes the tty device
3037  *      @index: the index in the tty driver for this tty device
3038  *
3039  *      If a tty device is registered with a call to tty_register_device() then
3040  *      this function must be called when the tty device is gone.
3041  *
3042  *      Locking: ??
3043  */
3044
3045 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3046 {
3047         device_destroy(tty_class,
3048                 MKDEV(driver->major, driver->minor_start) + index);
3049 }
3050 EXPORT_SYMBOL(tty_unregister_device);
3051
3052 struct tty_driver *__alloc_tty_driver(int lines, struct module *owner)
3053 {
3054         struct tty_driver *driver;
3055
3056         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3057         if (driver) {
3058                 kref_init(&driver->kref);
3059                 driver->magic = TTY_DRIVER_MAGIC;
3060                 driver->num = lines;
3061                 driver->owner = owner;
3062                 /* later we'll move allocation of tables here */
3063         }
3064         return driver;
3065 }
3066 EXPORT_SYMBOL(__alloc_tty_driver);
3067
3068 static void destruct_tty_driver(struct kref *kref)
3069 {
3070         struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3071         int i;
3072         struct ktermios *tp;
3073         void *p;
3074
3075         if (driver->flags & TTY_DRIVER_INSTALLED) {
3076                 /*
3077                  * Free the termios and termios_locked structures because
3078                  * we don't want to get memory leaks when modular tty
3079                  * drivers are removed from the kernel.
3080                  */
3081                 for (i = 0; i < driver->num; i++) {
3082                         tp = driver->termios[i];
3083                         if (tp) {
3084                                 driver->termios[i] = NULL;
3085                                 kfree(tp);
3086                         }
3087                         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3088                                 tty_unregister_device(driver, i);
3089                 }
3090                 p = driver->ttys;
3091                 proc_tty_unregister_driver(driver);
3092                 driver->ttys = NULL;
3093                 driver->termios = NULL;
3094                 kfree(p);
3095                 cdev_del(&driver->cdev);
3096         }
3097         kfree(driver);
3098 }
3099
3100 void tty_driver_kref_put(struct tty_driver *driver)
3101 {
3102         kref_put(&driver->kref, destruct_tty_driver);
3103 }
3104 EXPORT_SYMBOL(tty_driver_kref_put);
3105
3106 void tty_set_operations(struct tty_driver *driver,
3107                         const struct tty_operations *op)
3108 {
3109         driver->ops = op;
3110 };
3111 EXPORT_SYMBOL(tty_set_operations);
3112
3113 void put_tty_driver(struct tty_driver *d)
3114 {
3115         tty_driver_kref_put(d);
3116 }
3117 EXPORT_SYMBOL(put_tty_driver);
3118
3119 /*
3120  * Called by a tty driver to register itself.
3121  */
3122 int tty_register_driver(struct tty_driver *driver)
3123 {
3124         int error;
3125         int i;
3126         dev_t dev;
3127         void **p = NULL;
3128         struct device *d;
3129
3130         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3131                 p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
3132                 if (!p)
3133                         return -ENOMEM;
3134         }
3135
3136         if (!driver->major) {
3137                 error = alloc_chrdev_region(&dev, driver->minor_start,
3138                                                 driver->num, driver->name);
3139                 if (!error) {
3140                         driver->major = MAJOR(dev);
3141                         driver->minor_start = MINOR(dev);
3142                 }
3143         } else {
3144                 dev = MKDEV(driver->major, driver->minor_start);
3145                 error = register_chrdev_region(dev, driver->num, driver->name);
3146         }
3147         if (error < 0) {
3148                 kfree(p);
3149                 return error;
3150         }
3151
3152         if (p) {
3153                 driver->ttys = (struct tty_struct **)p;
3154                 driver->termios = (struct ktermios **)(p + driver->num);
3155         } else {
3156                 driver->ttys = NULL;
3157                 driver->termios = NULL;
3158         }
3159
3160         cdev_init(&driver->cdev, &tty_fops);
3161         driver->cdev.owner = driver->owner;
3162         error = cdev_add(&driver->cdev, dev, driver->num);
3163         if (error) {
3164                 unregister_chrdev_region(dev, driver->num);
3165                 driver->ttys = NULL;
3166                 driver->termios = NULL;
3167                 kfree(p);
3168                 return error;
3169         }
3170
3171         mutex_lock(&tty_mutex);
3172         list_add(&driver->tty_drivers, &tty_drivers);
3173         mutex_unlock(&tty_mutex);
3174
3175         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3176                 for (i = 0; i < driver->num; i++) {
3177                         d = tty_register_device(driver, i, NULL);
3178                         if (IS_ERR(d)) {
3179                                 error = PTR_ERR(d);
3180                                 goto err;
3181                         }
3182                 }
3183         }
3184         proc_tty_register_driver(driver);
3185         driver->flags |= TTY_DRIVER_INSTALLED;
3186         return 0;
3187
3188 err:
3189         for (i--; i >= 0; i--)
3190                 tty_unregister_device(driver, i);
3191
3192         mutex_lock(&tty_mutex);
3193         list_del(&driver->tty_drivers);
3194         mutex_unlock(&tty_mutex);
3195
3196         unregister_chrdev_region(dev, driver->num);
3197         driver->ttys = NULL;
3198         driver->termios = NULL;
3199         kfree(p);
3200         return error;
3201 }
3202
3203 EXPORT_SYMBOL(tty_register_driver);
3204
3205 /*
3206  * Called by a tty driver to unregister itself.
3207  */
3208 int tty_unregister_driver(struct tty_driver *driver)
3209 {
3210 #if 0
3211         /* FIXME */
3212         if (driver->refcount)
3213                 return -EBUSY;
3214 #endif
3215         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3216                                 driver->num);
3217         mutex_lock(&tty_mutex);
3218         list_del(&driver->tty_drivers);
3219         mutex_unlock(&tty_mutex);
3220         return 0;
3221 }
3222
3223 EXPORT_SYMBOL(tty_unregister_driver);
3224
3225 dev_t tty_devnum(struct tty_struct *tty)
3226 {
3227         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3228 }
3229 EXPORT_SYMBOL(tty_devnum);
3230
3231 void proc_clear_tty(struct task_struct *p)
3232 {
3233         unsigned long flags;
3234         struct tty_struct *tty;
3235         spin_lock_irqsave(&p->sighand->siglock, flags);
3236         tty = p->signal->tty;
3237         p->signal->tty = NULL;
3238         spin_unlock_irqrestore(&p->sighand->siglock, flags);
3239         tty_kref_put(tty);
3240 }
3241
3242 /* Called under the sighand lock */
3243
3244 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3245 {
3246         if (tty) {
3247                 unsigned long flags;
3248                 /* We should not have a session or pgrp to put here but.... */
3249                 spin_lock_irqsave(&tty->ctrl_lock, flags);
3250                 put_pid(tty->session);
3251                 put_pid(tty->pgrp);
3252                 tty->pgrp = get_pid(task_pgrp(tsk));
3253                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3254                 tty->session = get_pid(task_session(tsk));
3255                 if (tsk->signal->tty) {
3256                         printk(KERN_DEBUG "tty not NULL!!\n");
3257                         tty_kref_put(tsk->signal->tty);
3258                 }
3259         }
3260         put_pid(tsk->signal->tty_old_pgrp);
3261         tsk->signal->tty = tty_kref_get(tty);
3262         tsk->signal->tty_old_pgrp = NULL;
3263 }
3264
3265 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3266 {
3267         spin_lock_irq(&tsk->sighand->siglock);
3268         __proc_set_tty(tsk, tty);
3269         spin_unlock_irq(&tsk->sighand->siglock);
3270 }
3271
3272 struct tty_struct *get_current_tty(void)
3273 {
3274         struct tty_struct *tty;
3275         unsigned long flags;
3276
3277         spin_lock_irqsave(&current->sighand->siglock, flags);
3278         tty = tty_kref_get(current->signal->tty);
3279         spin_unlock_irqrestore(&current->sighand->siglock, flags);
3280         return tty;
3281 }
3282 EXPORT_SYMBOL_GPL(get_current_tty);
3283
3284 void tty_default_fops(struct file_operations *fops)
3285 {
3286         *fops = tty_fops;
3287 }
3288
3289 /*
3290  * Initialize the console device. This is called *early*, so
3291  * we can't necessarily depend on lots of kernel help here.
3292  * Just do some early initializations, and do the complex setup
3293  * later.
3294  */
3295 void __init console_init(void)
3296 {
3297         initcall_t *call;
3298
3299         /* Setup the default TTY line discipline. */
3300         tty_ldisc_begin();
3301
3302         /*
3303          * set up the console device so that later boot sequences can
3304          * inform about problems etc..
3305          */
3306         call = __con_initcall_start;
3307         while (call < __con_initcall_end) {
3308                 (*call)();
3309                 call++;
3310         }
3311 }
3312
3313 static char *tty_devnode(struct device *dev, umode_t *mode)
3314 {
3315         if (!mode)
3316                 return NULL;
3317         if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3318             dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3319                 *mode = 0666;
3320         return NULL;
3321 }
3322
3323 static int __init tty_class_init(void)
3324 {
3325         tty_class = class_create(THIS_MODULE, "tty");
3326         if (IS_ERR(tty_class))
3327                 return PTR_ERR(tty_class);
3328         tty_class->devnode = tty_devnode;
3329         return 0;
3330 }
3331
3332 postcore_initcall(tty_class_init);
3333
3334 /* 3/2004 jmc: why do these devices exist? */
3335 static struct cdev tty_cdev, console_cdev;
3336
3337 static ssize_t show_cons_active(struct device *dev,
3338                                 struct device_attribute *attr, char *buf)
3339 {
3340         struct console *cs[16];
3341         int i = 0;
3342         struct console *c;
3343         ssize_t count = 0;
3344
3345         console_lock();
3346         for_each_console(c) {
3347                 if (!c->device)
3348                         continue;
3349                 if (!c->write)
3350                         continue;
3351                 if ((c->flags & CON_ENABLED) == 0)
3352                         continue;
3353                 cs[i++] = c;
3354                 if (i >= ARRAY_SIZE(cs))
3355                         break;
3356         }
3357         while (i--)
3358                 count += sprintf(buf + count, "%s%d%c",
3359                                  cs[i]->name, cs[i]->index, i ? ' ':'\n');
3360         console_unlock();
3361
3362         return count;
3363 }
3364 static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3365
3366 static struct device *consdev;
3367
3368 void console_sysfs_notify(void)
3369 {
3370         if (consdev)
3371                 sysfs_notify(&consdev->kobj, NULL, "active");
3372 }
3373
3374 /*
3375  * Ok, now we can initialize the rest of the tty devices and can count
3376  * on memory allocations, interrupts etc..
3377  */
3378 int __init tty_init(void)
3379 {
3380         cdev_init(&tty_cdev, &tty_fops);
3381         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3382             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3383                 panic("Couldn't register /dev/tty driver\n");
3384         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3385
3386         cdev_init(&console_cdev, &console_fops);
3387         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3388             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3389                 panic("Couldn't register /dev/console driver\n");
3390         consdev = device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3391                               "console");
3392         if (IS_ERR(consdev))
3393                 consdev = NULL;
3394         else
3395                 WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
3396
3397 #ifdef CONFIG_VT
3398         vty_init(&console_fops);
3399 #endif
3400         return 0;
3401 }
3402