tty: Prevent "read/write wait queue active!" log flooding
[platform/kernel/linux-stable.git] / drivers / tty / tty_io.c
1 /*
2  *  Copyright (C) 1991, 1992  Linus Torvalds
3  */
4
5 /*
6  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7  * or rs-channels. It also implements echoing, cooked mode etc.
8  *
9  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10  *
11  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12  * tty_struct and tty_queue structures.  Previously there was an array
13  * of 256 tty_struct's which was statically allocated, and the
14  * tty_queue structures were allocated at boot time.  Both are now
15  * dynamically allocated only when the tty is open.
16  *
17  * Also restructured routines so that there is more of a separation
18  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19  * the low-level tty routines (serial.c, pty.c, console.c).  This
20  * makes for cleaner and more compact code.  -TYT, 9/17/92
21  *
22  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23  * which can be dynamically activated and de-activated by the line
24  * discipline handling modules (like SLIP).
25  *
26  * NOTE: pay no attention to the line discipline code (yet); its
27  * interface is still subject to change in this version...
28  * -- TYT, 1/31/92
29  *
30  * Added functionality to the OPOST tty handling.  No delays, but all
31  * other bits should be there.
32  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33  *
34  * Rewrote canonical mode and added more termios flags.
35  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36  *
37  * Reorganized FASYNC support so mouse code can share it.
38  *      -- ctm@ardi.com, 9Sep95
39  *
40  * New TIOCLINUX variants added.
41  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
42  *
43  * Restrict vt switching via ioctl()
44  *      -- grif@cs.ucr.edu, 5-Dec-95
45  *
46  * Move console and virtual terminal code to more appropriate files,
47  * implement CONFIG_VT and generalize console device interface.
48  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49  *
50  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51  *      -- Bill Hawes <whawes@star.net>, June 97
52  *
53  * Added devfs support.
54  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55  *
56  * Added support for a Unix98-style ptmx device.
57  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58  *
59  * Reduced memory usage for older ARM systems
60  *      -- Russell King <rmk@arm.linux.org.uk>
61  *
62  * Move do_SAK() into process context.  Less stack use in devfs functions.
63  * alloc_tty_struct() always uses kmalloc()
64  *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65  */
66
67 #include <linux/types.h>
68 #include <linux/major.h>
69 #include <linux/errno.h>
70 #include <linux/signal.h>
71 #include <linux/fcntl.h>
72 #include <linux/sched.h>
73 #include <linux/interrupt.h>
74 #include <linux/tty.h>
75 #include <linux/tty_driver.h>
76 #include <linux/tty_flip.h>
77 #include <linux/devpts_fs.h>
78 #include <linux/file.h>
79 #include <linux/fdtable.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/device.h>
92 #include <linux/wait.h>
93 #include <linux/bitops.h>
94 #include <linux/delay.h>
95 #include <linux/seq_file.h>
96 #include <linux/serial.h>
97 #include <linux/ratelimit.h>
98
99 #include <linux/uaccess.h>
100
101 #include <linux/kbd_kern.h>
102 #include <linux/vt_kern.h>
103 #include <linux/selection.h>
104
105 #include <linux/kmod.h>
106 #include <linux/nsproxy.h>
107
108 #undef TTY_DEBUG_HANGUP
109
110 #define TTY_PARANOIA_CHECK 1
111 #define CHECK_TTY_COUNT 1
112
113 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
114         .c_iflag = ICRNL | IXON,
115         .c_oflag = OPOST | ONLCR,
116         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
117         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
118                    ECHOCTL | ECHOKE | IEXTEN,
119         .c_cc = INIT_C_CC,
120         .c_ispeed = 38400,
121         .c_ospeed = 38400
122 };
123
124 EXPORT_SYMBOL(tty_std_termios);
125
126 /* This list gets poked at by procfs and various bits of boot up code. This
127    could do with some rationalisation such as pulling the tty proc function
128    into this file */
129
130 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
131
132 /* Mutex to protect creating and releasing a tty. This is shared with
133    vt.c for deeply disgusting hack reasons */
134 DEFINE_MUTEX(tty_mutex);
135 EXPORT_SYMBOL(tty_mutex);
136
137 /* Spinlock to protect the tty->tty_files list */
138 DEFINE_SPINLOCK(tty_files_lock);
139
140 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
141 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
142 ssize_t redirected_tty_write(struct file *, const char __user *,
143                                                         size_t, loff_t *);
144 static unsigned int tty_poll(struct file *, poll_table *);
145 static int tty_open(struct inode *, struct file *);
146 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
147 #ifdef CONFIG_COMPAT
148 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
149                                 unsigned long arg);
150 #else
151 #define tty_compat_ioctl NULL
152 #endif
153 static int __tty_fasync(int fd, struct file *filp, int on);
154 static int tty_fasync(int fd, struct file *filp, int on);
155 static void release_tty(struct tty_struct *tty, int idx);
156 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158
159 /**
160  *      alloc_tty_struct        -       allocate a tty object
161  *
162  *      Return a new empty tty structure. The data fields have not
163  *      been initialized in any way but has been zeroed
164  *
165  *      Locking: none
166  */
167
168 struct tty_struct *alloc_tty_struct(void)
169 {
170         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
171 }
172
173 /**
174  *      free_tty_struct         -       free a disused tty
175  *      @tty: tty struct to free
176  *
177  *      Free the write buffers, tty queue and tty memory itself.
178  *
179  *      Locking: none. Must be called after tty is definitely unused
180  */
181
182 void free_tty_struct(struct tty_struct *tty)
183 {
184         if (tty->dev)
185                 put_device(tty->dev);
186         kfree(tty->write_buf);
187         tty_buffer_free_all(tty);
188         kfree(tty);
189 }
190
191 static inline struct tty_struct *file_tty(struct file *file)
192 {
193         return ((struct tty_file_private *)file->private_data)->tty;
194 }
195
196 int tty_alloc_file(struct file *file)
197 {
198         struct tty_file_private *priv;
199
200         priv = kmalloc(sizeof(*priv), GFP_KERNEL);
201         if (!priv)
202                 return -ENOMEM;
203
204         file->private_data = priv;
205
206         return 0;
207 }
208
209 /* Associate a new file with the tty structure */
210 void tty_add_file(struct tty_struct *tty, struct file *file)
211 {
212         struct tty_file_private *priv = file->private_data;
213
214         priv->tty = tty;
215         priv->file = file;
216
217         spin_lock(&tty_files_lock);
218         list_add(&priv->list, &tty->tty_files);
219         spin_unlock(&tty_files_lock);
220 }
221
222 /**
223  * tty_free_file - free file->private_data
224  *
225  * This shall be used only for fail path handling when tty_add_file was not
226  * called yet.
227  */
228 void tty_free_file(struct file *file)
229 {
230         struct tty_file_private *priv = file->private_data;
231
232         file->private_data = NULL;
233         kfree(priv);
234 }
235
236 /* Delete file from its tty */
237 void tty_del_file(struct file *file)
238 {
239         struct tty_file_private *priv = file->private_data;
240
241         spin_lock(&tty_files_lock);
242         list_del(&priv->list);
243         spin_unlock(&tty_files_lock);
244         tty_free_file(file);
245 }
246
247
248 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
249
250 /**
251  *      tty_name        -       return tty naming
252  *      @tty: tty structure
253  *      @buf: buffer for output
254  *
255  *      Convert a tty structure into a name. The name reflects the kernel
256  *      naming policy and if udev is in use may not reflect user space
257  *
258  *      Locking: none
259  */
260
261 char *tty_name(struct tty_struct *tty, char *buf)
262 {
263         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
264                 strcpy(buf, "NULL tty");
265         else
266                 strcpy(buf, tty->name);
267         return buf;
268 }
269
270 EXPORT_SYMBOL(tty_name);
271
272 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
273                               const char *routine)
274 {
275 #ifdef TTY_PARANOIA_CHECK
276         if (!tty) {
277                 printk(KERN_WARNING
278                         "null TTY for (%d:%d) in %s\n",
279                         imajor(inode), iminor(inode), routine);
280                 return 1;
281         }
282         if (tty->magic != TTY_MAGIC) {
283                 printk(KERN_WARNING
284                         "bad magic number for tty struct (%d:%d) in %s\n",
285                         imajor(inode), iminor(inode), routine);
286                 return 1;
287         }
288 #endif
289         return 0;
290 }
291
292 static int check_tty_count(struct tty_struct *tty, const char *routine)
293 {
294 #ifdef CHECK_TTY_COUNT
295         struct list_head *p;
296         int count = 0;
297
298         spin_lock(&tty_files_lock);
299         list_for_each(p, &tty->tty_files) {
300                 count++;
301         }
302         spin_unlock(&tty_files_lock);
303         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
304             tty->driver->subtype == PTY_TYPE_SLAVE &&
305             tty->link && tty->link->count)
306                 count++;
307         if (tty->count != count) {
308                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
309                                     "!= #fd's(%d) in %s\n",
310                        tty->name, tty->count, count, routine);
311                 return count;
312         }
313 #endif
314         return 0;
315 }
316
317 /**
318  *      get_tty_driver          -       find device of a tty
319  *      @dev_t: device identifier
320  *      @index: returns the index of the tty
321  *
322  *      This routine returns a tty driver structure, given a device number
323  *      and also passes back the index number.
324  *
325  *      Locking: caller must hold tty_mutex
326  */
327
328 static struct tty_driver *get_tty_driver(dev_t device, int *index)
329 {
330         struct tty_driver *p;
331
332         list_for_each_entry(p, &tty_drivers, tty_drivers) {
333                 dev_t base = MKDEV(p->major, p->minor_start);
334                 if (device < base || device >= base + p->num)
335                         continue;
336                 *index = device - base;
337                 return tty_driver_kref_get(p);
338         }
339         return NULL;
340 }
341
342 #ifdef CONFIG_CONSOLE_POLL
343
344 /**
345  *      tty_find_polling_driver -       find device of a polled tty
346  *      @name: name string to match
347  *      @line: pointer to resulting tty line nr
348  *
349  *      This routine returns a tty driver structure, given a name
350  *      and the condition that the tty driver is capable of polled
351  *      operation.
352  */
353 struct tty_driver *tty_find_polling_driver(char *name, int *line)
354 {
355         struct tty_driver *p, *res = NULL;
356         int tty_line = 0;
357         int len;
358         char *str, *stp;
359
360         for (str = name; *str; str++)
361                 if ((*str >= '0' && *str <= '9') || *str == ',')
362                         break;
363         if (!*str)
364                 return NULL;
365
366         len = str - name;
367         tty_line = simple_strtoul(str, &str, 10);
368
369         mutex_lock(&tty_mutex);
370         /* Search through the tty devices to look for a match */
371         list_for_each_entry(p, &tty_drivers, tty_drivers) {
372                 if (strncmp(name, p->name, len) != 0)
373                         continue;
374                 stp = str;
375                 if (*stp == ',')
376                         stp++;
377                 if (*stp == '\0')
378                         stp = NULL;
379
380                 if (tty_line >= 0 && tty_line < p->num && p->ops &&
381                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
382                         res = tty_driver_kref_get(p);
383                         *line = tty_line;
384                         break;
385                 }
386         }
387         mutex_unlock(&tty_mutex);
388
389         return res;
390 }
391 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
392 #endif
393
394 /**
395  *      tty_check_change        -       check for POSIX terminal changes
396  *      @tty: tty to check
397  *
398  *      If we try to write to, or set the state of, a terminal and we're
399  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
400  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
401  *
402  *      Locking: ctrl_lock
403  */
404
405 int tty_check_change(struct tty_struct *tty)
406 {
407         unsigned long flags;
408         int ret = 0;
409
410         if (current->signal->tty != tty)
411                 return 0;
412
413         spin_lock_irqsave(&tty->ctrl_lock, flags);
414
415         if (!tty->pgrp) {
416                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
417                 goto out_unlock;
418         }
419         if (task_pgrp(current) == tty->pgrp)
420                 goto out_unlock;
421         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
422         if (is_ignored(SIGTTOU))
423                 goto out;
424         if (is_current_pgrp_orphaned()) {
425                 ret = -EIO;
426                 goto out;
427         }
428         kill_pgrp(task_pgrp(current), SIGTTOU, 1);
429         set_thread_flag(TIF_SIGPENDING);
430         ret = -ERESTARTSYS;
431 out:
432         return ret;
433 out_unlock:
434         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
435         return ret;
436 }
437
438 EXPORT_SYMBOL(tty_check_change);
439
440 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
441                                 size_t count, loff_t *ppos)
442 {
443         return 0;
444 }
445
446 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
447                                  size_t count, loff_t *ppos)
448 {
449         return -EIO;
450 }
451
452 /* No kernel lock held - none needed ;) */
453 static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
454 {
455         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
456 }
457
458 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
459                 unsigned long arg)
460 {
461         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
462 }
463
464 static long hung_up_tty_compat_ioctl(struct file *file,
465                                      unsigned int cmd, unsigned long arg)
466 {
467         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
468 }
469
470 static const struct file_operations tty_fops = {
471         .llseek         = no_llseek,
472         .read           = tty_read,
473         .write          = tty_write,
474         .poll           = tty_poll,
475         .unlocked_ioctl = tty_ioctl,
476         .compat_ioctl   = tty_compat_ioctl,
477         .open           = tty_open,
478         .release        = tty_release,
479         .fasync         = tty_fasync,
480 };
481
482 static const struct file_operations console_fops = {
483         .llseek         = no_llseek,
484         .read           = tty_read,
485         .write          = redirected_tty_write,
486         .poll           = tty_poll,
487         .unlocked_ioctl = tty_ioctl,
488         .compat_ioctl   = tty_compat_ioctl,
489         .open           = tty_open,
490         .release        = tty_release,
491         .fasync         = tty_fasync,
492 };
493
494 static const struct file_operations hung_up_tty_fops = {
495         .llseek         = no_llseek,
496         .read           = hung_up_tty_read,
497         .write          = hung_up_tty_write,
498         .poll           = hung_up_tty_poll,
499         .unlocked_ioctl = hung_up_tty_ioctl,
500         .compat_ioctl   = hung_up_tty_compat_ioctl,
501         .release        = tty_release,
502 };
503
504 static DEFINE_SPINLOCK(redirect_lock);
505 static struct file *redirect;
506
507 /**
508  *      tty_wakeup      -       request more data
509  *      @tty: terminal
510  *
511  *      Internal and external helper for wakeups of tty. This function
512  *      informs the line discipline if present that the driver is ready
513  *      to receive more output data.
514  */
515
516 void tty_wakeup(struct tty_struct *tty)
517 {
518         struct tty_ldisc *ld;
519
520         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
521                 ld = tty_ldisc_ref(tty);
522                 if (ld) {
523                         if (ld->ops->write_wakeup)
524                                 ld->ops->write_wakeup(tty);
525                         tty_ldisc_deref(ld);
526                 }
527         }
528         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
529 }
530
531 EXPORT_SYMBOL_GPL(tty_wakeup);
532
533 /**
534  *      __tty_hangup            -       actual handler for hangup events
535  *      @work: tty device
536  *
537  *      This can be called by the "eventd" kernel thread.  That is process
538  *      synchronous but doesn't hold any locks, so we need to make sure we
539  *      have the appropriate locks for what we're doing.
540  *
541  *      The hangup event clears any pending redirections onto the hung up
542  *      device. It ensures future writes will error and it does the needed
543  *      line discipline hangup and signal delivery. The tty object itself
544  *      remains intact.
545  *
546  *      Locking:
547  *              BTM
548  *                redirect lock for undoing redirection
549  *                file list lock for manipulating list of ttys
550  *                tty_ldisc_lock from called functions
551  *                termios_mutex resetting termios data
552  *                tasklist_lock to walk task list for hangup event
553  *                  ->siglock to protect ->signal/->sighand
554  */
555 void __tty_hangup(struct tty_struct *tty)
556 {
557         struct file *cons_filp = NULL;
558         struct file *filp, *f = NULL;
559         struct task_struct *p;
560         struct tty_file_private *priv;
561         int    closecount = 0, n;
562         unsigned long flags;
563         int refs = 0;
564
565         if (!tty)
566                 return;
567
568
569         spin_lock(&redirect_lock);
570         if (redirect && file_tty(redirect) == tty) {
571                 f = redirect;
572                 redirect = NULL;
573         }
574         spin_unlock(&redirect_lock);
575
576         tty_lock();
577
578         /* some functions below drop BTM, so we need this bit */
579         set_bit(TTY_HUPPING, &tty->flags);
580
581         /* inuse_filps is protected by the single tty lock,
582            this really needs to change if we want to flush the
583            workqueue with the lock held */
584         check_tty_count(tty, "tty_hangup");
585
586         spin_lock(&tty_files_lock);
587         /* This breaks for file handles being sent over AF_UNIX sockets ? */
588         list_for_each_entry(priv, &tty->tty_files, list) {
589                 filp = priv->file;
590                 if (filp->f_op->write == redirected_tty_write)
591                         cons_filp = filp;
592                 if (filp->f_op->write != tty_write)
593                         continue;
594                 closecount++;
595                 __tty_fasync(-1, filp, 0);      /* can't block */
596                 filp->f_op = &hung_up_tty_fops;
597         }
598         spin_unlock(&tty_files_lock);
599
600         /*
601          * it drops BTM and thus races with reopen
602          * we protect the race by TTY_HUPPING
603          */
604         tty_ldisc_hangup(tty);
605
606         read_lock(&tasklist_lock);
607         if (tty->session) {
608                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
609                         spin_lock_irq(&p->sighand->siglock);
610                         if (p->signal->tty == tty) {
611                                 p->signal->tty = NULL;
612                                 /* We defer the dereferences outside fo
613                                    the tasklist lock */
614                                 refs++;
615                         }
616                         if (!p->signal->leader) {
617                                 spin_unlock_irq(&p->sighand->siglock);
618                                 continue;
619                         }
620                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
621                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
622                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
623                         spin_lock_irqsave(&tty->ctrl_lock, flags);
624                         if (tty->pgrp)
625                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
626                         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
627                         spin_unlock_irq(&p->sighand->siglock);
628                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
629         }
630         read_unlock(&tasklist_lock);
631
632         spin_lock_irqsave(&tty->ctrl_lock, flags);
633         clear_bit(TTY_THROTTLED, &tty->flags);
634         clear_bit(TTY_PUSH, &tty->flags);
635         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
636         put_pid(tty->session);
637         put_pid(tty->pgrp);
638         tty->session = NULL;
639         tty->pgrp = NULL;
640         tty->ctrl_status = 0;
641         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
642
643         /* Account for the p->signal references we killed */
644         while (refs--)
645                 tty_kref_put(tty);
646
647         /*
648          * If one of the devices matches a console pointer, we
649          * cannot just call hangup() because that will cause
650          * tty->count and state->count to go out of sync.
651          * So we just call close() the right number of times.
652          */
653         if (cons_filp) {
654                 if (tty->ops->close)
655                         for (n = 0; n < closecount; n++)
656                                 tty->ops->close(tty, cons_filp);
657         } else if (tty->ops->hangup)
658                 (tty->ops->hangup)(tty);
659         /*
660          * We don't want to have driver/ldisc interactions beyond
661          * the ones we did here. The driver layer expects no
662          * calls after ->hangup() from the ldisc side. However we
663          * can't yet guarantee all that.
664          */
665         set_bit(TTY_HUPPED, &tty->flags);
666         clear_bit(TTY_HUPPING, &tty->flags);
667         tty_ldisc_enable(tty);
668
669         tty_unlock();
670
671         if (f)
672                 fput(f);
673 }
674
675 static void do_tty_hangup(struct work_struct *work)
676 {
677         struct tty_struct *tty =
678                 container_of(work, struct tty_struct, hangup_work);
679
680         __tty_hangup(tty);
681 }
682
683 /**
684  *      tty_hangup              -       trigger a hangup event
685  *      @tty: tty to hangup
686  *
687  *      A carrier loss (virtual or otherwise) has occurred on this like
688  *      schedule a hangup sequence to run after this event.
689  */
690
691 void tty_hangup(struct tty_struct *tty)
692 {
693 #ifdef TTY_DEBUG_HANGUP
694         char    buf[64];
695         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
696 #endif
697         schedule_work(&tty->hangup_work);
698 }
699
700 EXPORT_SYMBOL(tty_hangup);
701
702 /**
703  *      tty_vhangup             -       process vhangup
704  *      @tty: tty to hangup
705  *
706  *      The user has asked via system call for the terminal to be hung up.
707  *      We do this synchronously so that when the syscall returns the process
708  *      is complete. That guarantee is necessary for security reasons.
709  */
710
711 void tty_vhangup(struct tty_struct *tty)
712 {
713 #ifdef TTY_DEBUG_HANGUP
714         char    buf[64];
715
716         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
717 #endif
718         __tty_hangup(tty);
719 }
720
721 EXPORT_SYMBOL(tty_vhangup);
722
723
724 /**
725  *      tty_vhangup_self        -       process vhangup for own ctty
726  *
727  *      Perform a vhangup on the current controlling tty
728  */
729
730 void tty_vhangup_self(void)
731 {
732         struct tty_struct *tty;
733
734         tty = get_current_tty();
735         if (tty) {
736                 tty_vhangup(tty);
737                 tty_kref_put(tty);
738         }
739 }
740
741 /**
742  *      tty_hung_up_p           -       was tty hung up
743  *      @filp: file pointer of tty
744  *
745  *      Return true if the tty has been subject to a vhangup or a carrier
746  *      loss
747  */
748
749 int tty_hung_up_p(struct file *filp)
750 {
751         return (filp->f_op == &hung_up_tty_fops);
752 }
753
754 EXPORT_SYMBOL(tty_hung_up_p);
755
756 static void session_clear_tty(struct pid *session)
757 {
758         struct task_struct *p;
759         do_each_pid_task(session, PIDTYPE_SID, p) {
760                 proc_clear_tty(p);
761         } while_each_pid_task(session, PIDTYPE_SID, p);
762 }
763
764 /**
765  *      disassociate_ctty       -       disconnect controlling tty
766  *      @on_exit: true if exiting so need to "hang up" the session
767  *
768  *      This function is typically called only by the session leader, when
769  *      it wants to disassociate itself from its controlling tty.
770  *
771  *      It performs the following functions:
772  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
773  *      (2)  Clears the tty from being controlling the session
774  *      (3)  Clears the controlling tty for all processes in the
775  *              session group.
776  *
777  *      The argument on_exit is set to 1 if called when a process is
778  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
779  *
780  *      Locking:
781  *              BTM is taken for hysterical raisins, and held when
782  *                called from no_tty().
783  *                tty_mutex is taken to protect tty
784  *                ->siglock is taken to protect ->signal/->sighand
785  *                tasklist_lock is taken to walk process list for sessions
786  *                  ->siglock is taken to protect ->signal/->sighand
787  */
788
789 void disassociate_ctty(int on_exit)
790 {
791         struct tty_struct *tty;
792
793         if (!current->signal->leader)
794                 return;
795
796         tty = get_current_tty();
797         if (tty) {
798                 struct pid *tty_pgrp = get_pid(tty->pgrp);
799                 if (on_exit) {
800                         if (tty->driver->type != TTY_DRIVER_TYPE_PTY)
801                                 tty_vhangup(tty);
802                 }
803                 tty_kref_put(tty);
804                 if (tty_pgrp) {
805                         kill_pgrp(tty_pgrp, SIGHUP, on_exit);
806                         if (!on_exit)
807                                 kill_pgrp(tty_pgrp, SIGCONT, on_exit);
808                         put_pid(tty_pgrp);
809                 }
810         } else if (on_exit) {
811                 struct pid *old_pgrp;
812                 spin_lock_irq(&current->sighand->siglock);
813                 old_pgrp = current->signal->tty_old_pgrp;
814                 current->signal->tty_old_pgrp = NULL;
815                 spin_unlock_irq(&current->sighand->siglock);
816                 if (old_pgrp) {
817                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
818                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
819                         put_pid(old_pgrp);
820                 }
821                 return;
822         }
823
824         spin_lock_irq(&current->sighand->siglock);
825         put_pid(current->signal->tty_old_pgrp);
826         current->signal->tty_old_pgrp = NULL;
827         spin_unlock_irq(&current->sighand->siglock);
828
829         tty = get_current_tty();
830         if (tty) {
831                 unsigned long flags;
832                 spin_lock_irqsave(&tty->ctrl_lock, flags);
833                 put_pid(tty->session);
834                 put_pid(tty->pgrp);
835                 tty->session = NULL;
836                 tty->pgrp = NULL;
837                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
838                 tty_kref_put(tty);
839         } else {
840 #ifdef TTY_DEBUG_HANGUP
841                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
842                        " = NULL", tty);
843 #endif
844         }
845
846         /* Now clear signal->tty under the lock */
847         read_lock(&tasklist_lock);
848         session_clear_tty(task_session(current));
849         read_unlock(&tasklist_lock);
850 }
851
852 /**
853  *
854  *      no_tty  - Ensure the current process does not have a controlling tty
855  */
856 void no_tty(void)
857 {
858         struct task_struct *tsk = current;
859         tty_lock();
860         disassociate_ctty(0);
861         tty_unlock();
862         proc_clear_tty(tsk);
863 }
864
865
866 /**
867  *      stop_tty        -       propagate flow control
868  *      @tty: tty to stop
869  *
870  *      Perform flow control to the driver. For PTY/TTY pairs we
871  *      must also propagate the TIOCKPKT status. May be called
872  *      on an already stopped device and will not re-call the driver
873  *      method.
874  *
875  *      This functionality is used by both the line disciplines for
876  *      halting incoming flow and by the driver. It may therefore be
877  *      called from any context, may be under the tty atomic_write_lock
878  *      but not always.
879  *
880  *      Locking:
881  *              Uses the tty control lock internally
882  */
883
884 void stop_tty(struct tty_struct *tty)
885 {
886         unsigned long flags;
887         spin_lock_irqsave(&tty->ctrl_lock, flags);
888         if (tty->stopped) {
889                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
890                 return;
891         }
892         tty->stopped = 1;
893         if (tty->link && tty->link->packet) {
894                 tty->ctrl_status &= ~TIOCPKT_START;
895                 tty->ctrl_status |= TIOCPKT_STOP;
896                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
897         }
898         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
899         if (tty->ops->stop)
900                 (tty->ops->stop)(tty);
901 }
902
903 EXPORT_SYMBOL(stop_tty);
904
905 /**
906  *      start_tty       -       propagate flow control
907  *      @tty: tty to start
908  *
909  *      Start a tty that has been stopped if at all possible. Perform
910  *      any necessary wakeups and propagate the TIOCPKT status. If this
911  *      is the tty was previous stopped and is being started then the
912  *      driver start method is invoked and the line discipline woken.
913  *
914  *      Locking:
915  *              ctrl_lock
916  */
917
918 void start_tty(struct tty_struct *tty)
919 {
920         unsigned long flags;
921         spin_lock_irqsave(&tty->ctrl_lock, flags);
922         if (!tty->stopped || tty->flow_stopped) {
923                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
924                 return;
925         }
926         tty->stopped = 0;
927         if (tty->link && tty->link->packet) {
928                 tty->ctrl_status &= ~TIOCPKT_STOP;
929                 tty->ctrl_status |= TIOCPKT_START;
930                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
931         }
932         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
933         if (tty->ops->start)
934                 (tty->ops->start)(tty);
935         /* If we have a running line discipline it may need kicking */
936         tty_wakeup(tty);
937 }
938
939 EXPORT_SYMBOL(start_tty);
940
941 /* We limit tty time update visibility to every 8 seconds or so. */
942 static void tty_update_time(struct timespec *time)
943 {
944         unsigned long sec = get_seconds() & ~7;
945         if ((long)(sec - time->tv_sec) > 0)
946                 time->tv_sec = sec;
947 }
948
949 /**
950  *      tty_read        -       read method for tty device files
951  *      @file: pointer to tty file
952  *      @buf: user buffer
953  *      @count: size of user buffer
954  *      @ppos: unused
955  *
956  *      Perform the read system call function on this terminal device. Checks
957  *      for hung up devices before calling the line discipline method.
958  *
959  *      Locking:
960  *              Locks the line discipline internally while needed. Multiple
961  *      read calls may be outstanding in parallel.
962  */
963
964 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
965                         loff_t *ppos)
966 {
967         int i;
968         struct inode *inode = file->f_path.dentry->d_inode;
969         struct tty_struct *tty = file_tty(file);
970         struct tty_ldisc *ld;
971
972         if (tty_paranoia_check(tty, inode, "tty_read"))
973                 return -EIO;
974         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
975                 return -EIO;
976
977         /* We want to wait for the line discipline to sort out in this
978            situation */
979         ld = tty_ldisc_ref_wait(tty);
980         if (ld->ops->read)
981                 i = (ld->ops->read)(tty, file, buf, count);
982         else
983                 i = -EIO;
984         tty_ldisc_deref(ld);
985
986         if (i > 0)
987                 tty_update_time(&inode->i_atime);
988
989         return i;
990 }
991
992 void tty_write_unlock(struct tty_struct *tty)
993         __releases(&tty->atomic_write_lock)
994 {
995         mutex_unlock(&tty->atomic_write_lock);
996         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
997 }
998
999 int tty_write_lock(struct tty_struct *tty, int ndelay)
1000         __acquires(&tty->atomic_write_lock)
1001 {
1002         if (!mutex_trylock(&tty->atomic_write_lock)) {
1003                 if (ndelay)
1004                         return -EAGAIN;
1005                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
1006                         return -ERESTARTSYS;
1007         }
1008         return 0;
1009 }
1010
1011 /*
1012  * Split writes up in sane blocksizes to avoid
1013  * denial-of-service type attacks
1014  */
1015 static inline ssize_t do_tty_write(
1016         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1017         struct tty_struct *tty,
1018         struct file *file,
1019         const char __user *buf,
1020         size_t count)
1021 {
1022         ssize_t ret, written = 0;
1023         unsigned int chunk;
1024
1025         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1026         if (ret < 0)
1027                 return ret;
1028
1029         /*
1030          * We chunk up writes into a temporary buffer. This
1031          * simplifies low-level drivers immensely, since they
1032          * don't have locking issues and user mode accesses.
1033          *
1034          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1035          * big chunk-size..
1036          *
1037          * The default chunk-size is 2kB, because the NTTY
1038          * layer has problems with bigger chunks. It will
1039          * claim to be able to handle more characters than
1040          * it actually does.
1041          *
1042          * FIXME: This can probably go away now except that 64K chunks
1043          * are too likely to fail unless switched to vmalloc...
1044          */
1045         chunk = 2048;
1046         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1047                 chunk = 65536;
1048         if (count < chunk)
1049                 chunk = count;
1050
1051         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1052         if (tty->write_cnt < chunk) {
1053                 unsigned char *buf_chunk;
1054
1055                 if (chunk < 1024)
1056                         chunk = 1024;
1057
1058                 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1059                 if (!buf_chunk) {
1060                         ret = -ENOMEM;
1061                         goto out;
1062                 }
1063                 kfree(tty->write_buf);
1064                 tty->write_cnt = chunk;
1065                 tty->write_buf = buf_chunk;
1066         }
1067
1068         /* Do the write .. */
1069         for (;;) {
1070                 size_t size = count;
1071                 if (size > chunk)
1072                         size = chunk;
1073                 ret = -EFAULT;
1074                 if (copy_from_user(tty->write_buf, buf, size))
1075                         break;
1076                 ret = write(tty, file, tty->write_buf, size);
1077                 if (ret <= 0)
1078                         break;
1079                 written += ret;
1080                 buf += ret;
1081                 count -= ret;
1082                 if (!count)
1083                         break;
1084                 ret = -ERESTARTSYS;
1085                 if (signal_pending(current))
1086                         break;
1087                 cond_resched();
1088         }
1089         if (written) {
1090                 struct inode *inode = file->f_path.dentry->d_inode;
1091                 tty_update_time(&inode->i_mtime);
1092                 ret = written;
1093         }
1094 out:
1095         tty_write_unlock(tty);
1096         return ret;
1097 }
1098
1099 /**
1100  * tty_write_message - write a message to a certain tty, not just the console.
1101  * @tty: the destination tty_struct
1102  * @msg: the message to write
1103  *
1104  * This is used for messages that need to be redirected to a specific tty.
1105  * We don't put it into the syslog queue right now maybe in the future if
1106  * really needed.
1107  *
1108  * We must still hold the BTM and test the CLOSING flag for the moment.
1109  */
1110
1111 void tty_write_message(struct tty_struct *tty, char *msg)
1112 {
1113         if (tty) {
1114                 mutex_lock(&tty->atomic_write_lock);
1115                 tty_lock();
1116                 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1117                         tty_unlock();
1118                         tty->ops->write(tty, msg, strlen(msg));
1119                 } else
1120                         tty_unlock();
1121                 tty_write_unlock(tty);
1122         }
1123         return;
1124 }
1125
1126
1127 /**
1128  *      tty_write               -       write method for tty device file
1129  *      @file: tty file pointer
1130  *      @buf: user data to write
1131  *      @count: bytes to write
1132  *      @ppos: unused
1133  *
1134  *      Write data to a tty device via the line discipline.
1135  *
1136  *      Locking:
1137  *              Locks the line discipline as required
1138  *              Writes to the tty driver are serialized by the atomic_write_lock
1139  *      and are then processed in chunks to the device. The line discipline
1140  *      write method will not be invoked in parallel for each device.
1141  */
1142
1143 static ssize_t tty_write(struct file *file, const char __user *buf,
1144                                                 size_t count, loff_t *ppos)
1145 {
1146         struct inode *inode = file->f_path.dentry->d_inode;
1147         struct tty_struct *tty = file_tty(file);
1148         struct tty_ldisc *ld;
1149         ssize_t ret;
1150
1151         if (tty_paranoia_check(tty, inode, "tty_write"))
1152                 return -EIO;
1153         if (!tty || !tty->ops->write ||
1154                 (test_bit(TTY_IO_ERROR, &tty->flags)))
1155                         return -EIO;
1156         /* Short term debug to catch buggy drivers */
1157         if (tty->ops->write_room == NULL)
1158                 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1159                         tty->driver->name);
1160         ld = tty_ldisc_ref_wait(tty);
1161         if (!ld->ops->write)
1162                 ret = -EIO;
1163         else
1164                 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1165         tty_ldisc_deref(ld);
1166         return ret;
1167 }
1168
1169 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1170                                                 size_t count, loff_t *ppos)
1171 {
1172         struct file *p = NULL;
1173
1174         spin_lock(&redirect_lock);
1175         if (redirect) {
1176                 get_file(redirect);
1177                 p = redirect;
1178         }
1179         spin_unlock(&redirect_lock);
1180
1181         if (p) {
1182                 ssize_t res;
1183                 res = vfs_write(p, buf, count, &p->f_pos);
1184                 fput(p);
1185                 return res;
1186         }
1187         return tty_write(file, buf, count, ppos);
1188 }
1189
1190 static char ptychar[] = "pqrstuvwxyzabcde";
1191
1192 /**
1193  *      pty_line_name   -       generate name for a pty
1194  *      @driver: the tty driver in use
1195  *      @index: the minor number
1196  *      @p: output buffer of at least 6 bytes
1197  *
1198  *      Generate a name from a driver reference and write it to the output
1199  *      buffer.
1200  *
1201  *      Locking: None
1202  */
1203 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1204 {
1205         int i = index + driver->name_base;
1206         /* ->name is initialized to "ttyp", but "tty" is expected */
1207         sprintf(p, "%s%c%x",
1208                 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1209                 ptychar[i >> 4 & 0xf], i & 0xf);
1210 }
1211
1212 /**
1213  *      tty_line_name   -       generate name for a tty
1214  *      @driver: the tty driver in use
1215  *      @index: the minor number
1216  *      @p: output buffer of at least 7 bytes
1217  *
1218  *      Generate a name from a driver reference and write it to the output
1219  *      buffer.
1220  *
1221  *      Locking: None
1222  */
1223 static void tty_line_name(struct tty_driver *driver, int index, char *p)
1224 {
1225         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1226 }
1227
1228 /**
1229  *      tty_driver_lookup_tty() - find an existing tty, if any
1230  *      @driver: the driver for the tty
1231  *      @idx:    the minor number
1232  *
1233  *      Return the tty, if found or ERR_PTR() otherwise.
1234  *
1235  *      Locking: tty_mutex must be held. If tty is found, the mutex must
1236  *      be held until the 'fast-open' is also done. Will change once we
1237  *      have refcounting in the driver and per driver locking
1238  */
1239 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1240                 struct inode *inode, int idx)
1241 {
1242         if (driver->ops->lookup)
1243                 return driver->ops->lookup(driver, inode, idx);
1244
1245         return driver->ttys[idx];
1246 }
1247
1248 /**
1249  *      tty_init_termios        -  helper for termios setup
1250  *      @tty: the tty to set up
1251  *
1252  *      Initialise the termios structures for this tty. Thus runs under
1253  *      the tty_mutex currently so we can be relaxed about ordering.
1254  */
1255
1256 int tty_init_termios(struct tty_struct *tty)
1257 {
1258         struct ktermios *tp;
1259         int idx = tty->index;
1260
1261         tp = tty->driver->termios[idx];
1262         if (tp == NULL) {
1263                 tp = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
1264                 if (tp == NULL)
1265                         return -ENOMEM;
1266                 memcpy(tp, &tty->driver->init_termios,
1267                                                 sizeof(struct ktermios));
1268                 tty->driver->termios[idx] = tp;
1269         }
1270         tty->termios = tp;
1271         tty->termios_locked = tp + 1;
1272
1273         /* Compatibility until drivers always set this */
1274         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1275         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1276         return 0;
1277 }
1278 EXPORT_SYMBOL_GPL(tty_init_termios);
1279
1280 int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1281 {
1282         int ret = tty_init_termios(tty);
1283         if (ret)
1284                 return ret;
1285
1286         tty_driver_kref_get(driver);
1287         tty->count++;
1288         driver->ttys[tty->index] = tty;
1289         return 0;
1290 }
1291 EXPORT_SYMBOL_GPL(tty_standard_install);
1292
1293 /**
1294  *      tty_driver_install_tty() - install a tty entry in the driver
1295  *      @driver: the driver for the tty
1296  *      @tty: the tty
1297  *
1298  *      Install a tty object into the driver tables. The tty->index field
1299  *      will be set by the time this is called. This method is responsible
1300  *      for ensuring any need additional structures are allocated and
1301  *      configured.
1302  *
1303  *      Locking: tty_mutex for now
1304  */
1305 static int tty_driver_install_tty(struct tty_driver *driver,
1306                                                 struct tty_struct *tty)
1307 {
1308         return driver->ops->install ? driver->ops->install(driver, tty) :
1309                 tty_standard_install(driver, tty);
1310 }
1311
1312 /**
1313  *      tty_driver_remove_tty() - remove a tty from the driver tables
1314  *      @driver: the driver for the tty
1315  *      @idx:    the minor number
1316  *
1317  *      Remvoe a tty object from the driver tables. The tty->index field
1318  *      will be set by the time this is called.
1319  *
1320  *      Locking: tty_mutex for now
1321  */
1322 void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1323 {
1324         if (driver->ops->remove)
1325                 driver->ops->remove(driver, tty);
1326         else
1327                 driver->ttys[tty->index] = NULL;
1328 }
1329
1330 /*
1331  *      tty_reopen()    - fast re-open of an open tty
1332  *      @tty    - the tty to open
1333  *
1334  *      Return 0 on success, -errno on error.
1335  *
1336  *      Locking: tty_mutex must be held from the time the tty was found
1337  *               till this open completes.
1338  */
1339 static int tty_reopen(struct tty_struct *tty)
1340 {
1341         struct tty_driver *driver = tty->driver;
1342
1343         if (test_bit(TTY_CLOSING, &tty->flags) ||
1344                         test_bit(TTY_HUPPING, &tty->flags) ||
1345                         test_bit(TTY_LDISC_CHANGING, &tty->flags))
1346                 return -EIO;
1347
1348         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1349             driver->subtype == PTY_TYPE_MASTER) {
1350                 /*
1351                  * special case for PTY masters: only one open permitted,
1352                  * and the slave side open count is incremented as well.
1353                  */
1354                 if (tty->count)
1355                         return -EIO;
1356
1357                 tty->link->count++;
1358         }
1359         tty->count++;
1360
1361         mutex_lock(&tty->ldisc_mutex);
1362         WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1363         mutex_unlock(&tty->ldisc_mutex);
1364
1365         return 0;
1366 }
1367
1368 /**
1369  *      tty_init_dev            -       initialise a tty device
1370  *      @driver: tty driver we are opening a device on
1371  *      @idx: device index
1372  *      @ret_tty: returned tty structure
1373  *
1374  *      Prepare a tty device. This may not be a "new" clean device but
1375  *      could also be an active device. The pty drivers require special
1376  *      handling because of this.
1377  *
1378  *      Locking:
1379  *              The function is called under the tty_mutex, which
1380  *      protects us from the tty struct or driver itself going away.
1381  *
1382  *      On exit the tty device has the line discipline attached and
1383  *      a reference count of 1. If a pair was created for pty/tty use
1384  *      and the other was a pty master then it too has a reference count of 1.
1385  *
1386  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1387  * failed open.  The new code protects the open with a mutex, so it's
1388  * really quite straightforward.  The mutex locking can probably be
1389  * relaxed for the (most common) case of reopening a tty.
1390  */
1391
1392 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1393 {
1394         struct tty_struct *tty;
1395         int retval;
1396
1397         /*
1398          * First time open is complex, especially for PTY devices.
1399          * This code guarantees that either everything succeeds and the
1400          * TTY is ready for operation, or else the table slots are vacated
1401          * and the allocated memory released.  (Except that the termios
1402          * and locked termios may be retained.)
1403          */
1404
1405         if (!try_module_get(driver->owner))
1406                 return ERR_PTR(-ENODEV);
1407
1408         tty = alloc_tty_struct();
1409         if (!tty) {
1410                 retval = -ENOMEM;
1411                 goto err_module_put;
1412         }
1413         initialize_tty_struct(tty, driver, idx);
1414
1415         retval = tty_driver_install_tty(driver, tty);
1416         if (retval < 0)
1417                 goto err_deinit_tty;
1418
1419         /*
1420          * Structures all installed ... call the ldisc open routines.
1421          * If we fail here just call release_tty to clean up.  No need
1422          * to decrement the use counts, as release_tty doesn't care.
1423          */
1424         retval = tty_ldisc_setup(tty, tty->link);
1425         if (retval)
1426                 goto err_release_tty;
1427         return tty;
1428
1429 err_deinit_tty:
1430         deinitialize_tty_struct(tty);
1431         free_tty_struct(tty);
1432 err_module_put:
1433         module_put(driver->owner);
1434         return ERR_PTR(retval);
1435
1436         /* call the tty release_tty routine to clean out this slot */
1437 err_release_tty:
1438         printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1439                                  "clearing slot %d\n", idx);
1440         release_tty(tty, idx);
1441         return ERR_PTR(retval);
1442 }
1443
1444 void tty_free_termios(struct tty_struct *tty)
1445 {
1446         struct ktermios *tp;
1447         int idx = tty->index;
1448         /* Kill this flag and push into drivers for locking etc */
1449         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1450                 /* FIXME: Locking on ->termios array */
1451                 tp = tty->termios;
1452                 tty->driver->termios[idx] = NULL;
1453                 kfree(tp);
1454         }
1455 }
1456 EXPORT_SYMBOL(tty_free_termios);
1457
1458 void tty_shutdown(struct tty_struct *tty)
1459 {
1460         tty_driver_remove_tty(tty->driver, tty);
1461         tty_free_termios(tty);
1462 }
1463 EXPORT_SYMBOL(tty_shutdown);
1464
1465 /**
1466  *      release_one_tty         -       release tty structure memory
1467  *      @kref: kref of tty we are obliterating
1468  *
1469  *      Releases memory associated with a tty structure, and clears out the
1470  *      driver table slots. This function is called when a device is no longer
1471  *      in use. It also gets called when setup of a device fails.
1472  *
1473  *      Locking:
1474  *              tty_mutex - sometimes only
1475  *              takes the file list lock internally when working on the list
1476  *      of ttys that the driver keeps.
1477  *
1478  *      This method gets called from a work queue so that the driver private
1479  *      cleanup ops can sleep (needed for USB at least)
1480  */
1481 static void release_one_tty(struct work_struct *work)
1482 {
1483         struct tty_struct *tty =
1484                 container_of(work, struct tty_struct, hangup_work);
1485         struct tty_driver *driver = tty->driver;
1486
1487         if (tty->ops->cleanup)
1488                 tty->ops->cleanup(tty);
1489
1490         tty->magic = 0;
1491         tty_driver_kref_put(driver);
1492         module_put(driver->owner);
1493
1494         spin_lock(&tty_files_lock);
1495         list_del_init(&tty->tty_files);
1496         spin_unlock(&tty_files_lock);
1497
1498         put_pid(tty->pgrp);
1499         put_pid(tty->session);
1500         free_tty_struct(tty);
1501 }
1502
1503 static void queue_release_one_tty(struct kref *kref)
1504 {
1505         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1506
1507         if (tty->ops->shutdown)
1508                 tty->ops->shutdown(tty);
1509         else
1510                 tty_shutdown(tty);
1511
1512         /* The hangup queue is now free so we can reuse it rather than
1513            waste a chunk of memory for each port */
1514         INIT_WORK(&tty->hangup_work, release_one_tty);
1515         schedule_work(&tty->hangup_work);
1516 }
1517
1518 /**
1519  *      tty_kref_put            -       release a tty kref
1520  *      @tty: tty device
1521  *
1522  *      Release a reference to a tty device and if need be let the kref
1523  *      layer destruct the object for us
1524  */
1525
1526 void tty_kref_put(struct tty_struct *tty)
1527 {
1528         if (tty)
1529                 kref_put(&tty->kref, queue_release_one_tty);
1530 }
1531 EXPORT_SYMBOL(tty_kref_put);
1532
1533 /**
1534  *      release_tty             -       release tty structure memory
1535  *
1536  *      Release both @tty and a possible linked partner (think pty pair),
1537  *      and decrement the refcount of the backing module.
1538  *
1539  *      Locking:
1540  *              tty_mutex - sometimes only
1541  *              takes the file list lock internally when working on the list
1542  *      of ttys that the driver keeps.
1543  *              FIXME: should we require tty_mutex is held here ??
1544  *
1545  */
1546 static void release_tty(struct tty_struct *tty, int idx)
1547 {
1548         /* This should always be true but check for the moment */
1549         WARN_ON(tty->index != idx);
1550
1551         if (tty->link)
1552                 tty_kref_put(tty->link);
1553         tty_kref_put(tty);
1554 }
1555
1556 /**
1557  *      tty_release_checks - check a tty before real release
1558  *      @tty: tty to check
1559  *      @o_tty: link of @tty (if any)
1560  *      @idx: index of the tty
1561  *
1562  *      Performs some paranoid checking before true release of the @tty.
1563  *      This is a no-op unless TTY_PARANOIA_CHECK is defined.
1564  */
1565 static int tty_release_checks(struct tty_struct *tty, struct tty_struct *o_tty,
1566                 int idx)
1567 {
1568 #ifdef TTY_PARANOIA_CHECK
1569         if (idx < 0 || idx >= tty->driver->num) {
1570                 printk(KERN_DEBUG "%s: bad idx when trying to free (%s)\n",
1571                                 __func__, tty->name);
1572                 return -1;
1573         }
1574
1575         /* not much to check for devpts */
1576         if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1577                 return 0;
1578
1579         if (tty != tty->driver->ttys[idx]) {
1580                 printk(KERN_DEBUG "%s: driver.table[%d] not tty for (%s)\n",
1581                                 __func__, idx, tty->name);
1582                 return -1;
1583         }
1584         if (tty->termios != tty->driver->termios[idx]) {
1585                 printk(KERN_DEBUG "%s: driver.termios[%d] not termios for (%s)\n",
1586                                 __func__, idx, tty->name);
1587                 return -1;
1588         }
1589         if (tty->driver->other) {
1590                 if (o_tty != tty->driver->other->ttys[idx]) {
1591                         printk(KERN_DEBUG "%s: other->table[%d] not o_tty for (%s)\n",
1592                                         __func__, idx, tty->name);
1593                         return -1;
1594                 }
1595                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1596                         printk(KERN_DEBUG "%s: other->termios[%d] not o_termios for (%s)\n",
1597                                         __func__, idx, tty->name);
1598                         return -1;
1599                 }
1600                 if (o_tty->link != tty) {
1601                         printk(KERN_DEBUG "%s: bad pty pointers\n", __func__);
1602                         return -1;
1603                 }
1604         }
1605 #endif
1606         return 0;
1607 }
1608
1609 /**
1610  *      tty_release             -       vfs callback for close
1611  *      @inode: inode of tty
1612  *      @filp: file pointer for handle to tty
1613  *
1614  *      Called the last time each file handle is closed that references
1615  *      this tty. There may however be several such references.
1616  *
1617  *      Locking:
1618  *              Takes bkl. See tty_release_dev
1619  *
1620  * Even releasing the tty structures is a tricky business.. We have
1621  * to be very careful that the structures are all released at the
1622  * same time, as interrupts might otherwise get the wrong pointers.
1623  *
1624  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1625  * lead to double frees or releasing memory still in use.
1626  */
1627
1628 int tty_release(struct inode *inode, struct file *filp)
1629 {
1630         struct tty_struct *tty = file_tty(filp);
1631         struct tty_struct *o_tty;
1632         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1633         int     devpts;
1634         int     idx;
1635         char    buf[64];
1636         long    timeout = 0;
1637         int     once = 1;
1638
1639         if (tty_paranoia_check(tty, inode, __func__))
1640                 return 0;
1641
1642         tty_lock();
1643         check_tty_count(tty, __func__);
1644
1645         __tty_fasync(-1, filp, 0);
1646
1647         idx = tty->index;
1648         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1649                       tty->driver->subtype == PTY_TYPE_MASTER);
1650         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1651         o_tty = tty->link;
1652
1653         if (tty_release_checks(tty, o_tty, idx)) {
1654                 tty_unlock();
1655                 return 0;
1656         }
1657
1658 #ifdef TTY_DEBUG_HANGUP
1659         printk(KERN_DEBUG "%s: %s (tty count=%d)...\n", __func__,
1660                         tty_name(tty, buf), tty->count);
1661 #endif
1662
1663         if (tty->ops->close)
1664                 tty->ops->close(tty, filp);
1665
1666         tty_unlock();
1667         /*
1668          * Sanity check: if tty->count is going to zero, there shouldn't be
1669          * any waiters on tty->read_wait or tty->write_wait.  We test the
1670          * wait queues and kick everyone out _before_ actually starting to
1671          * close.  This ensures that we won't block while releasing the tty
1672          * structure.
1673          *
1674          * The test for the o_tty closing is necessary, since the master and
1675          * slave sides may close in any order.  If the slave side closes out
1676          * first, its count will be one, since the master side holds an open.
1677          * Thus this test wouldn't be triggered at the time the slave closes,
1678          * so we do it now.
1679          *
1680          * Note that it's possible for the tty to be opened again while we're
1681          * flushing out waiters.  By recalculating the closing flags before
1682          * each iteration we avoid any problems.
1683          */
1684         while (1) {
1685                 /* Guard against races with tty->count changes elsewhere and
1686                    opens on /dev/tty */
1687
1688                 mutex_lock(&tty_mutex);
1689                 tty_lock();
1690                 tty_closing = tty->count <= 1;
1691                 o_tty_closing = o_tty &&
1692                         (o_tty->count <= (pty_master ? 1 : 0));
1693                 do_sleep = 0;
1694
1695                 if (tty_closing) {
1696                         if (waitqueue_active(&tty->read_wait)) {
1697                                 wake_up_poll(&tty->read_wait, POLLIN);
1698                                 do_sleep++;
1699                         }
1700                         if (waitqueue_active(&tty->write_wait)) {
1701                                 wake_up_poll(&tty->write_wait, POLLOUT);
1702                                 do_sleep++;
1703                         }
1704                 }
1705                 if (o_tty_closing) {
1706                         if (waitqueue_active(&o_tty->read_wait)) {
1707                                 wake_up_poll(&o_tty->read_wait, POLLIN);
1708                                 do_sleep++;
1709                         }
1710                         if (waitqueue_active(&o_tty->write_wait)) {
1711                                 wake_up_poll(&o_tty->write_wait, POLLOUT);
1712                                 do_sleep++;
1713                         }
1714                 }
1715                 if (!do_sleep)
1716                         break;
1717
1718                 if (once) {
1719                         once = 0;
1720                         printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
1721                                 __func__, tty_name(tty, buf));
1722                 }
1723                 tty_unlock();
1724                 mutex_unlock(&tty_mutex);
1725                 schedule_timeout_killable(timeout);
1726                 if (timeout < 120 * HZ)
1727                         timeout = 2 * timeout + 1;
1728                 else
1729                         timeout = MAX_SCHEDULE_TIMEOUT;
1730         }
1731
1732         /*
1733          * The closing flags are now consistent with the open counts on
1734          * both sides, and we've completed the last operation that could
1735          * block, so it's safe to proceed with closing.
1736          */
1737         if (pty_master) {
1738                 if (--o_tty->count < 0) {
1739                         printk(KERN_WARNING "%s: bad pty slave count (%d) for %s\n",
1740                                 __func__, o_tty->count, tty_name(o_tty, buf));
1741                         o_tty->count = 0;
1742                 }
1743         }
1744         if (--tty->count < 0) {
1745                 printk(KERN_WARNING "%s: bad tty->count (%d) for %s\n",
1746                                 __func__, tty->count, tty_name(tty, buf));
1747                 tty->count = 0;
1748         }
1749
1750         /*
1751          * We've decremented tty->count, so we need to remove this file
1752          * descriptor off the tty->tty_files list; this serves two
1753          * purposes:
1754          *  - check_tty_count sees the correct number of file descriptors
1755          *    associated with this tty.
1756          *  - do_tty_hangup no longer sees this file descriptor as
1757          *    something that needs to be handled for hangups.
1758          */
1759         tty_del_file(filp);
1760
1761         /*
1762          * Perform some housekeeping before deciding whether to return.
1763          *
1764          * Set the TTY_CLOSING flag if this was the last open.  In the
1765          * case of a pty we may have to wait around for the other side
1766          * to close, and TTY_CLOSING makes sure we can't be reopened.
1767          */
1768         if (tty_closing)
1769                 set_bit(TTY_CLOSING, &tty->flags);
1770         if (o_tty_closing)
1771                 set_bit(TTY_CLOSING, &o_tty->flags);
1772
1773         /*
1774          * If _either_ side is closing, make sure there aren't any
1775          * processes that still think tty or o_tty is their controlling
1776          * tty.
1777          */
1778         if (tty_closing || o_tty_closing) {
1779                 read_lock(&tasklist_lock);
1780                 session_clear_tty(tty->session);
1781                 if (o_tty)
1782                         session_clear_tty(o_tty->session);
1783                 read_unlock(&tasklist_lock);
1784         }
1785
1786         mutex_unlock(&tty_mutex);
1787
1788         /* check whether both sides are closing ... */
1789         if (!tty_closing || (o_tty && !o_tty_closing)) {
1790                 tty_unlock();
1791                 return 0;
1792         }
1793
1794 #ifdef TTY_DEBUG_HANGUP
1795         printk(KERN_DEBUG "%s: freeing tty structure...\n", __func__);
1796 #endif
1797         /*
1798          * Ask the line discipline code to release its structures
1799          */
1800         tty_ldisc_release(tty, o_tty);
1801         /*
1802          * The release_tty function takes care of the details of clearing
1803          * the slots and preserving the termios structure.
1804          */
1805         release_tty(tty, idx);
1806
1807         /* Make this pty number available for reallocation */
1808         if (devpts)
1809                 devpts_kill_index(inode, idx);
1810         tty_unlock();
1811         return 0;
1812 }
1813
1814 /**
1815  *      tty_open_current_tty - get tty of current task for open
1816  *      @device: device number
1817  *      @filp: file pointer to tty
1818  *      @return: tty of the current task iff @device is /dev/tty
1819  *
1820  *      We cannot return driver and index like for the other nodes because
1821  *      devpts will not work then. It expects inodes to be from devpts FS.
1822  */
1823 static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1824 {
1825         struct tty_struct *tty;
1826
1827         if (device != MKDEV(TTYAUX_MAJOR, 0))
1828                 return NULL;
1829
1830         tty = get_current_tty();
1831         if (!tty)
1832                 return ERR_PTR(-ENXIO);
1833
1834         filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1835         /* noctty = 1; */
1836         tty_kref_put(tty);
1837         /* FIXME: we put a reference and return a TTY! */
1838         return tty;
1839 }
1840
1841 /**
1842  *      tty_lookup_driver - lookup a tty driver for a given device file
1843  *      @device: device number
1844  *      @filp: file pointer to tty
1845  *      @noctty: set if the device should not become a controlling tty
1846  *      @index: index for the device in the @return driver
1847  *      @return: driver for this inode (with increased refcount)
1848  *
1849  *      If @return is not erroneous, the caller is responsible to decrement the
1850  *      refcount by tty_driver_kref_put.
1851  *
1852  *      Locking: tty_mutex protects get_tty_driver
1853  */
1854 static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1855                 int *noctty, int *index)
1856 {
1857         struct tty_driver *driver;
1858
1859         switch (device) {
1860 #ifdef CONFIG_VT
1861         case MKDEV(TTY_MAJOR, 0): {
1862                 extern struct tty_driver *console_driver;
1863                 driver = tty_driver_kref_get(console_driver);
1864                 *index = fg_console;
1865                 *noctty = 1;
1866                 break;
1867         }
1868 #endif
1869         case MKDEV(TTYAUX_MAJOR, 1): {
1870                 struct tty_driver *console_driver = console_device(index);
1871                 if (console_driver) {
1872                         driver = tty_driver_kref_get(console_driver);
1873                         if (driver) {
1874                                 /* Don't let /dev/console block */
1875                                 filp->f_flags |= O_NONBLOCK;
1876                                 *noctty = 1;
1877                                 break;
1878                         }
1879                 }
1880                 return ERR_PTR(-ENODEV);
1881         }
1882         default:
1883                 driver = get_tty_driver(device, index);
1884                 if (!driver)
1885                         return ERR_PTR(-ENODEV);
1886                 break;
1887         }
1888         return driver;
1889 }
1890
1891 /**
1892  *      tty_open                -       open a tty device
1893  *      @inode: inode of device file
1894  *      @filp: file pointer to tty
1895  *
1896  *      tty_open and tty_release keep up the tty count that contains the
1897  *      number of opens done on a tty. We cannot use the inode-count, as
1898  *      different inodes might point to the same tty.
1899  *
1900  *      Open-counting is needed for pty masters, as well as for keeping
1901  *      track of serial lines: DTR is dropped when the last close happens.
1902  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
1903  *
1904  *      The termios state of a pty is reset on first open so that
1905  *      settings don't persist across reuse.
1906  *
1907  *      Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
1908  *               tty->count should protect the rest.
1909  *               ->siglock protects ->signal/->sighand
1910  */
1911
1912 static int tty_open(struct inode *inode, struct file *filp)
1913 {
1914         struct tty_struct *tty;
1915         int noctty, retval;
1916         struct tty_driver *driver = NULL;
1917         int index;
1918         dev_t device = inode->i_rdev;
1919         unsigned saved_flags = filp->f_flags;
1920
1921         nonseekable_open(inode, filp);
1922
1923 retry_open:
1924         retval = tty_alloc_file(filp);
1925         if (retval)
1926                 return -ENOMEM;
1927
1928         noctty = filp->f_flags & O_NOCTTY;
1929         index  = -1;
1930         retval = 0;
1931
1932         mutex_lock(&tty_mutex);
1933         tty_lock();
1934
1935         tty = tty_open_current_tty(device, filp);
1936         if (IS_ERR(tty)) {
1937                 retval = PTR_ERR(tty);
1938                 goto err_unlock;
1939         } else if (!tty) {
1940                 driver = tty_lookup_driver(device, filp, &noctty, &index);
1941                 if (IS_ERR(driver)) {
1942                         retval = PTR_ERR(driver);
1943                         goto err_unlock;
1944                 }
1945
1946                 /* check whether we're reopening an existing tty */
1947                 tty = tty_driver_lookup_tty(driver, inode, index);
1948                 if (IS_ERR(tty)) {
1949                         retval = PTR_ERR(tty);
1950                         goto err_unlock;
1951                 }
1952         }
1953
1954         if (tty) {
1955                 retval = tty_reopen(tty);
1956                 if (retval)
1957                         tty = ERR_PTR(retval);
1958         } else
1959                 tty = tty_init_dev(driver, index);
1960
1961         mutex_unlock(&tty_mutex);
1962         if (driver)
1963                 tty_driver_kref_put(driver);
1964         if (IS_ERR(tty)) {
1965                 tty_unlock();
1966                 retval = PTR_ERR(tty);
1967                 goto err_file;
1968         }
1969
1970         tty_add_file(tty, filp);
1971
1972         check_tty_count(tty, __func__);
1973         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1974             tty->driver->subtype == PTY_TYPE_MASTER)
1975                 noctty = 1;
1976 #ifdef TTY_DEBUG_HANGUP
1977         printk(KERN_DEBUG "%s: opening %s...\n", __func__, tty->name);
1978 #endif
1979         if (tty->ops->open)
1980                 retval = tty->ops->open(tty, filp);
1981         else
1982                 retval = -ENODEV;
1983         filp->f_flags = saved_flags;
1984
1985         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
1986                                                 !capable(CAP_SYS_ADMIN))
1987                 retval = -EBUSY;
1988
1989         if (retval) {
1990 #ifdef TTY_DEBUG_HANGUP
1991                 printk(KERN_DEBUG "%s: error %d in opening %s...\n", __func__,
1992                                 retval, tty->name);
1993 #endif
1994                 tty_unlock(); /* need to call tty_release without BTM */
1995                 tty_release(inode, filp);
1996                 if (retval != -ERESTARTSYS)
1997                         return retval;
1998
1999                 if (signal_pending(current))
2000                         return retval;
2001
2002                 schedule();
2003                 /*
2004                  * Need to reset f_op in case a hangup happened.
2005                  */
2006                 tty_lock();
2007                 if (filp->f_op == &hung_up_tty_fops)
2008                         filp->f_op = &tty_fops;
2009                 tty_unlock();
2010                 goto retry_open;
2011         }
2012         tty_unlock();
2013
2014
2015         mutex_lock(&tty_mutex);
2016         tty_lock();
2017         spin_lock_irq(&current->sighand->siglock);
2018         if (!noctty &&
2019             current->signal->leader &&
2020             !current->signal->tty &&
2021             tty->session == NULL)
2022                 __proc_set_tty(current, tty);
2023         spin_unlock_irq(&current->sighand->siglock);
2024         tty_unlock();
2025         mutex_unlock(&tty_mutex);
2026         return 0;
2027 err_unlock:
2028         tty_unlock();
2029         mutex_unlock(&tty_mutex);
2030         /* after locks to avoid deadlock */
2031         if (!IS_ERR_OR_NULL(driver))
2032                 tty_driver_kref_put(driver);
2033 err_file:
2034         tty_free_file(filp);
2035         return retval;
2036 }
2037
2038
2039
2040 /**
2041  *      tty_poll        -       check tty status
2042  *      @filp: file being polled
2043  *      @wait: poll wait structures to update
2044  *
2045  *      Call the line discipline polling method to obtain the poll
2046  *      status of the device.
2047  *
2048  *      Locking: locks called line discipline but ldisc poll method
2049  *      may be re-entered freely by other callers.
2050  */
2051
2052 static unsigned int tty_poll(struct file *filp, poll_table *wait)
2053 {
2054         struct tty_struct *tty = file_tty(filp);
2055         struct tty_ldisc *ld;
2056         int ret = 0;
2057
2058         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2059                 return 0;
2060
2061         ld = tty_ldisc_ref_wait(tty);
2062         if (ld->ops->poll)
2063                 ret = (ld->ops->poll)(tty, filp, wait);
2064         tty_ldisc_deref(ld);
2065         return ret;
2066 }
2067
2068 static int __tty_fasync(int fd, struct file *filp, int on)
2069 {
2070         struct tty_struct *tty = file_tty(filp);
2071         unsigned long flags;
2072         int retval = 0;
2073
2074         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2075                 goto out;
2076
2077         retval = fasync_helper(fd, filp, on, &tty->fasync);
2078         if (retval <= 0)
2079                 goto out;
2080
2081         if (on) {
2082                 enum pid_type type;
2083                 struct pid *pid;
2084                 if (!waitqueue_active(&tty->read_wait))
2085                         tty->minimum_to_wake = 1;
2086                 spin_lock_irqsave(&tty->ctrl_lock, flags);
2087                 if (tty->pgrp) {
2088                         pid = tty->pgrp;
2089                         type = PIDTYPE_PGID;
2090                 } else {
2091                         pid = task_pid(current);
2092                         type = PIDTYPE_PID;
2093                 }
2094                 get_pid(pid);
2095                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2096                 retval = __f_setown(filp, pid, type, 0);
2097                 put_pid(pid);
2098                 if (retval)
2099                         goto out;
2100         } else {
2101                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2102                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2103         }
2104         retval = 0;
2105 out:
2106         return retval;
2107 }
2108
2109 static int tty_fasync(int fd, struct file *filp, int on)
2110 {
2111         int retval;
2112         tty_lock();
2113         retval = __tty_fasync(fd, filp, on);
2114         tty_unlock();
2115         return retval;
2116 }
2117
2118 /**
2119  *      tiocsti                 -       fake input character
2120  *      @tty: tty to fake input into
2121  *      @p: pointer to character
2122  *
2123  *      Fake input to a tty device. Does the necessary locking and
2124  *      input management.
2125  *
2126  *      FIXME: does not honour flow control ??
2127  *
2128  *      Locking:
2129  *              Called functions take tty_ldisc_lock
2130  *              current->signal->tty check is safe without locks
2131  *
2132  *      FIXME: may race normal receive processing
2133  */
2134
2135 static int tiocsti(struct tty_struct *tty, char __user *p)
2136 {
2137         char ch, mbz = 0;
2138         struct tty_ldisc *ld;
2139
2140         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2141                 return -EPERM;
2142         if (get_user(ch, p))
2143                 return -EFAULT;
2144         tty_audit_tiocsti(tty, ch);
2145         ld = tty_ldisc_ref_wait(tty);
2146         ld->ops->receive_buf(tty, &ch, &mbz, 1);
2147         tty_ldisc_deref(ld);
2148         return 0;
2149 }
2150
2151 /**
2152  *      tiocgwinsz              -       implement window query ioctl
2153  *      @tty; tty
2154  *      @arg: user buffer for result
2155  *
2156  *      Copies the kernel idea of the window size into the user buffer.
2157  *
2158  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2159  *              is consistent.
2160  */
2161
2162 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2163 {
2164         int err;
2165
2166         mutex_lock(&tty->termios_mutex);
2167         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2168         mutex_unlock(&tty->termios_mutex);
2169
2170         return err ? -EFAULT: 0;
2171 }
2172
2173 /**
2174  *      tty_do_resize           -       resize event
2175  *      @tty: tty being resized
2176  *      @rows: rows (character)
2177  *      @cols: cols (character)
2178  *
2179  *      Update the termios variables and send the necessary signals to
2180  *      peform a terminal resize correctly
2181  */
2182
2183 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2184 {
2185         struct pid *pgrp;
2186         unsigned long flags;
2187
2188         /* Lock the tty */
2189         mutex_lock(&tty->termios_mutex);
2190         if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2191                 goto done;
2192         /* Get the PID values and reference them so we can
2193            avoid holding the tty ctrl lock while sending signals */
2194         spin_lock_irqsave(&tty->ctrl_lock, flags);
2195         pgrp = get_pid(tty->pgrp);
2196         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2197
2198         if (pgrp)
2199                 kill_pgrp(pgrp, SIGWINCH, 1);
2200         put_pid(pgrp);
2201
2202         tty->winsize = *ws;
2203 done:
2204         mutex_unlock(&tty->termios_mutex);
2205         return 0;
2206 }
2207
2208 /**
2209  *      tiocswinsz              -       implement window size set ioctl
2210  *      @tty; tty side of tty
2211  *      @arg: user buffer for result
2212  *
2213  *      Copies the user idea of the window size to the kernel. Traditionally
2214  *      this is just advisory information but for the Linux console it
2215  *      actually has driver level meaning and triggers a VC resize.
2216  *
2217  *      Locking:
2218  *              Driver dependent. The default do_resize method takes the
2219  *      tty termios mutex and ctrl_lock. The console takes its own lock
2220  *      then calls into the default method.
2221  */
2222
2223 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2224 {
2225         struct winsize tmp_ws;
2226         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2227                 return -EFAULT;
2228
2229         if (tty->ops->resize)
2230                 return tty->ops->resize(tty, &tmp_ws);
2231         else
2232                 return tty_do_resize(tty, &tmp_ws);
2233 }
2234
2235 /**
2236  *      tioccons        -       allow admin to move logical console
2237  *      @file: the file to become console
2238  *
2239  *      Allow the administrator to move the redirected console device
2240  *
2241  *      Locking: uses redirect_lock to guard the redirect information
2242  */
2243
2244 static int tioccons(struct file *file)
2245 {
2246         if (!capable(CAP_SYS_ADMIN))
2247                 return -EPERM;
2248         if (file->f_op->write == redirected_tty_write) {
2249                 struct file *f;
2250                 spin_lock(&redirect_lock);
2251                 f = redirect;
2252                 redirect = NULL;
2253                 spin_unlock(&redirect_lock);
2254                 if (f)
2255                         fput(f);
2256                 return 0;
2257         }
2258         spin_lock(&redirect_lock);
2259         if (redirect) {
2260                 spin_unlock(&redirect_lock);
2261                 return -EBUSY;
2262         }
2263         get_file(file);
2264         redirect = file;
2265         spin_unlock(&redirect_lock);
2266         return 0;
2267 }
2268
2269 /**
2270  *      fionbio         -       non blocking ioctl
2271  *      @file: file to set blocking value
2272  *      @p: user parameter
2273  *
2274  *      Historical tty interfaces had a blocking control ioctl before
2275  *      the generic functionality existed. This piece of history is preserved
2276  *      in the expected tty API of posix OS's.
2277  *
2278  *      Locking: none, the open file handle ensures it won't go away.
2279  */
2280
2281 static int fionbio(struct file *file, int __user *p)
2282 {
2283         int nonblock;
2284
2285         if (get_user(nonblock, p))
2286                 return -EFAULT;
2287
2288         spin_lock(&file->f_lock);
2289         if (nonblock)
2290                 file->f_flags |= O_NONBLOCK;
2291         else
2292                 file->f_flags &= ~O_NONBLOCK;
2293         spin_unlock(&file->f_lock);
2294         return 0;
2295 }
2296
2297 /**
2298  *      tiocsctty       -       set controlling tty
2299  *      @tty: tty structure
2300  *      @arg: user argument
2301  *
2302  *      This ioctl is used to manage job control. It permits a session
2303  *      leader to set this tty as the controlling tty for the session.
2304  *
2305  *      Locking:
2306  *              Takes tty_mutex() to protect tty instance
2307  *              Takes tasklist_lock internally to walk sessions
2308  *              Takes ->siglock() when updating signal->tty
2309  */
2310
2311 static int tiocsctty(struct tty_struct *tty, int arg)
2312 {
2313         int ret = 0;
2314         if (current->signal->leader && (task_session(current) == tty->session))
2315                 return ret;
2316
2317         mutex_lock(&tty_mutex);
2318         /*
2319          * The process must be a session leader and
2320          * not have a controlling tty already.
2321          */
2322         if (!current->signal->leader || current->signal->tty) {
2323                 ret = -EPERM;
2324                 goto unlock;
2325         }
2326
2327         if (tty->session) {
2328                 /*
2329                  * This tty is already the controlling
2330                  * tty for another session group!
2331                  */
2332                 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2333                         /*
2334                          * Steal it away
2335                          */
2336                         read_lock(&tasklist_lock);
2337                         session_clear_tty(tty->session);
2338                         read_unlock(&tasklist_lock);
2339                 } else {
2340                         ret = -EPERM;
2341                         goto unlock;
2342                 }
2343         }
2344         proc_set_tty(current, tty);
2345 unlock:
2346         mutex_unlock(&tty_mutex);
2347         return ret;
2348 }
2349
2350 /**
2351  *      tty_get_pgrp    -       return a ref counted pgrp pid
2352  *      @tty: tty to read
2353  *
2354  *      Returns a refcounted instance of the pid struct for the process
2355  *      group controlling the tty.
2356  */
2357
2358 struct pid *tty_get_pgrp(struct tty_struct *tty)
2359 {
2360         unsigned long flags;
2361         struct pid *pgrp;
2362
2363         spin_lock_irqsave(&tty->ctrl_lock, flags);
2364         pgrp = get_pid(tty->pgrp);
2365         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2366
2367         return pgrp;
2368 }
2369 EXPORT_SYMBOL_GPL(tty_get_pgrp);
2370
2371 /**
2372  *      tiocgpgrp               -       get process group
2373  *      @tty: tty passed by user
2374  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2375  *      @p: returned pid
2376  *
2377  *      Obtain the process group of the tty. If there is no process group
2378  *      return an error.
2379  *
2380  *      Locking: none. Reference to current->signal->tty is safe.
2381  */
2382
2383 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2384 {
2385         struct pid *pid;
2386         int ret;
2387         /*
2388          * (tty == real_tty) is a cheap way of
2389          * testing if the tty is NOT a master pty.
2390          */
2391         if (tty == real_tty && current->signal->tty != real_tty)
2392                 return -ENOTTY;
2393         pid = tty_get_pgrp(real_tty);
2394         ret =  put_user(pid_vnr(pid), p);
2395         put_pid(pid);
2396         return ret;
2397 }
2398
2399 /**
2400  *      tiocspgrp               -       attempt to set process group
2401  *      @tty: tty passed by user
2402  *      @real_tty: tty side device matching tty passed by user
2403  *      @p: pid pointer
2404  *
2405  *      Set the process group of the tty to the session passed. Only
2406  *      permitted where the tty session is our session.
2407  *
2408  *      Locking: RCU, ctrl lock
2409  */
2410
2411 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2412 {
2413         struct pid *pgrp;
2414         pid_t pgrp_nr;
2415         int retval = tty_check_change(real_tty);
2416         unsigned long flags;
2417
2418         if (retval == -EIO)
2419                 return -ENOTTY;
2420         if (retval)
2421                 return retval;
2422         if (!current->signal->tty ||
2423             (current->signal->tty != real_tty) ||
2424             (real_tty->session != task_session(current)))
2425                 return -ENOTTY;
2426         if (get_user(pgrp_nr, p))
2427                 return -EFAULT;
2428         if (pgrp_nr < 0)
2429                 return -EINVAL;
2430         rcu_read_lock();
2431         pgrp = find_vpid(pgrp_nr);
2432         retval = -ESRCH;
2433         if (!pgrp)
2434                 goto out_unlock;
2435         retval = -EPERM;
2436         if (session_of_pgrp(pgrp) != task_session(current))
2437                 goto out_unlock;
2438         retval = 0;
2439         spin_lock_irqsave(&tty->ctrl_lock, flags);
2440         put_pid(real_tty->pgrp);
2441         real_tty->pgrp = get_pid(pgrp);
2442         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2443 out_unlock:
2444         rcu_read_unlock();
2445         return retval;
2446 }
2447
2448 /**
2449  *      tiocgsid                -       get session id
2450  *      @tty: tty passed by user
2451  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2452  *      @p: pointer to returned session id
2453  *
2454  *      Obtain the session id of the tty. If there is no session
2455  *      return an error.
2456  *
2457  *      Locking: none. Reference to current->signal->tty is safe.
2458  */
2459
2460 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2461 {
2462         /*
2463          * (tty == real_tty) is a cheap way of
2464          * testing if the tty is NOT a master pty.
2465         */
2466         if (tty == real_tty && current->signal->tty != real_tty)
2467                 return -ENOTTY;
2468         if (!real_tty->session)
2469                 return -ENOTTY;
2470         return put_user(pid_vnr(real_tty->session), p);
2471 }
2472
2473 /**
2474  *      tiocsetd        -       set line discipline
2475  *      @tty: tty device
2476  *      @p: pointer to user data
2477  *
2478  *      Set the line discipline according to user request.
2479  *
2480  *      Locking: see tty_set_ldisc, this function is just a helper
2481  */
2482
2483 static int tiocsetd(struct tty_struct *tty, int __user *p)
2484 {
2485         int ldisc;
2486         int ret;
2487
2488         if (get_user(ldisc, p))
2489                 return -EFAULT;
2490
2491         ret = tty_set_ldisc(tty, ldisc);
2492
2493         return ret;
2494 }
2495
2496 /**
2497  *      send_break      -       performed time break
2498  *      @tty: device to break on
2499  *      @duration: timeout in mS
2500  *
2501  *      Perform a timed break on hardware that lacks its own driver level
2502  *      timed break functionality.
2503  *
2504  *      Locking:
2505  *              atomic_write_lock serializes
2506  *
2507  */
2508
2509 static int send_break(struct tty_struct *tty, unsigned int duration)
2510 {
2511         int retval;
2512
2513         if (tty->ops->break_ctl == NULL)
2514                 return 0;
2515
2516         if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2517                 retval = tty->ops->break_ctl(tty, duration);
2518         else {
2519                 /* Do the work ourselves */
2520                 if (tty_write_lock(tty, 0) < 0)
2521                         return -EINTR;
2522                 retval = tty->ops->break_ctl(tty, -1);
2523                 if (retval)
2524                         goto out;
2525                 if (!signal_pending(current))
2526                         msleep_interruptible(duration);
2527                 retval = tty->ops->break_ctl(tty, 0);
2528 out:
2529                 tty_write_unlock(tty);
2530                 if (signal_pending(current))
2531                         retval = -EINTR;
2532         }
2533         return retval;
2534 }
2535
2536 /**
2537  *      tty_tiocmget            -       get modem status
2538  *      @tty: tty device
2539  *      @file: user file pointer
2540  *      @p: pointer to result
2541  *
2542  *      Obtain the modem status bits from the tty driver if the feature
2543  *      is supported. Return -EINVAL if it is not available.
2544  *
2545  *      Locking: none (up to the driver)
2546  */
2547
2548 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2549 {
2550         int retval = -EINVAL;
2551
2552         if (tty->ops->tiocmget) {
2553                 retval = tty->ops->tiocmget(tty);
2554
2555                 if (retval >= 0)
2556                         retval = put_user(retval, p);
2557         }
2558         return retval;
2559 }
2560
2561 /**
2562  *      tty_tiocmset            -       set modem status
2563  *      @tty: tty device
2564  *      @cmd: command - clear bits, set bits or set all
2565  *      @p: pointer to desired bits
2566  *
2567  *      Set the modem status bits from the tty driver if the feature
2568  *      is supported. Return -EINVAL if it is not available.
2569  *
2570  *      Locking: none (up to the driver)
2571  */
2572
2573 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2574              unsigned __user *p)
2575 {
2576         int retval;
2577         unsigned int set, clear, val;
2578
2579         if (tty->ops->tiocmset == NULL)
2580                 return -EINVAL;
2581
2582         retval = get_user(val, p);
2583         if (retval)
2584                 return retval;
2585         set = clear = 0;
2586         switch (cmd) {
2587         case TIOCMBIS:
2588                 set = val;
2589                 break;
2590         case TIOCMBIC:
2591                 clear = val;
2592                 break;
2593         case TIOCMSET:
2594                 set = val;
2595                 clear = ~val;
2596                 break;
2597         }
2598         set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2599         clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2600         return tty->ops->tiocmset(tty, set, clear);
2601 }
2602
2603 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2604 {
2605         int retval = -EINVAL;
2606         struct serial_icounter_struct icount;
2607         memset(&icount, 0, sizeof(icount));
2608         if (tty->ops->get_icount)
2609                 retval = tty->ops->get_icount(tty, &icount);
2610         if (retval != 0)
2611                 return retval;
2612         if (copy_to_user(arg, &icount, sizeof(icount)))
2613                 return -EFAULT;
2614         return 0;
2615 }
2616
2617 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2618 {
2619         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2620             tty->driver->subtype == PTY_TYPE_MASTER)
2621                 tty = tty->link;
2622         return tty;
2623 }
2624 EXPORT_SYMBOL(tty_pair_get_tty);
2625
2626 struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2627 {
2628         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2629             tty->driver->subtype == PTY_TYPE_MASTER)
2630             return tty;
2631         return tty->link;
2632 }
2633 EXPORT_SYMBOL(tty_pair_get_pty);
2634
2635 /*
2636  * Split this up, as gcc can choke on it otherwise..
2637  */
2638 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2639 {
2640         struct tty_struct *tty = file_tty(file);
2641         struct tty_struct *real_tty;
2642         void __user *p = (void __user *)arg;
2643         int retval;
2644         struct tty_ldisc *ld;
2645         struct inode *inode = file->f_dentry->d_inode;
2646
2647         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2648                 return -EINVAL;
2649
2650         real_tty = tty_pair_get_tty(tty);
2651
2652         /*
2653          * Factor out some common prep work
2654          */
2655         switch (cmd) {
2656         case TIOCSETD:
2657         case TIOCSBRK:
2658         case TIOCCBRK:
2659         case TCSBRK:
2660         case TCSBRKP:
2661                 retval = tty_check_change(tty);
2662                 if (retval)
2663                         return retval;
2664                 if (cmd != TIOCCBRK) {
2665                         tty_wait_until_sent(tty, 0);
2666                         if (signal_pending(current))
2667                                 return -EINTR;
2668                 }
2669                 break;
2670         }
2671
2672         /*
2673          *      Now do the stuff.
2674          */
2675         switch (cmd) {
2676         case TIOCSTI:
2677                 return tiocsti(tty, p);
2678         case TIOCGWINSZ:
2679                 return tiocgwinsz(real_tty, p);
2680         case TIOCSWINSZ:
2681                 return tiocswinsz(real_tty, p);
2682         case TIOCCONS:
2683                 return real_tty != tty ? -EINVAL : tioccons(file);
2684         case FIONBIO:
2685                 return fionbio(file, p);
2686         case TIOCEXCL:
2687                 set_bit(TTY_EXCLUSIVE, &tty->flags);
2688                 return 0;
2689         case TIOCNXCL:
2690                 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2691                 return 0;
2692         case TIOCNOTTY:
2693                 if (current->signal->tty != tty)
2694                         return -ENOTTY;
2695                 no_tty();
2696                 return 0;
2697         case TIOCSCTTY:
2698                 return tiocsctty(tty, arg);
2699         case TIOCGPGRP:
2700                 return tiocgpgrp(tty, real_tty, p);
2701         case TIOCSPGRP:
2702                 return tiocspgrp(tty, real_tty, p);
2703         case TIOCGSID:
2704                 return tiocgsid(tty, real_tty, p);
2705         case TIOCGETD:
2706                 return put_user(tty->ldisc->ops->num, (int __user *)p);
2707         case TIOCSETD:
2708                 return tiocsetd(tty, p);
2709         case TIOCVHANGUP:
2710                 if (!capable(CAP_SYS_ADMIN))
2711                         return -EPERM;
2712                 tty_vhangup(tty);
2713                 return 0;
2714         case TIOCGDEV:
2715         {
2716                 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2717                 return put_user(ret, (unsigned int __user *)p);
2718         }
2719         /*
2720          * Break handling
2721          */
2722         case TIOCSBRK:  /* Turn break on, unconditionally */
2723                 if (tty->ops->break_ctl)
2724                         return tty->ops->break_ctl(tty, -1);
2725                 return 0;
2726         case TIOCCBRK:  /* Turn break off, unconditionally */
2727                 if (tty->ops->break_ctl)
2728                         return tty->ops->break_ctl(tty, 0);
2729                 return 0;
2730         case TCSBRK:   /* SVID version: non-zero arg --> no break */
2731                 /* non-zero arg means wait for all output data
2732                  * to be sent (performed above) but don't send break.
2733                  * This is used by the tcdrain() termios function.
2734                  */
2735                 if (!arg)
2736                         return send_break(tty, 250);
2737                 return 0;
2738         case TCSBRKP:   /* support for POSIX tcsendbreak() */
2739                 return send_break(tty, arg ? arg*100 : 250);
2740
2741         case TIOCMGET:
2742                 return tty_tiocmget(tty, p);
2743         case TIOCMSET:
2744         case TIOCMBIC:
2745         case TIOCMBIS:
2746                 return tty_tiocmset(tty, cmd, p);
2747         case TIOCGICOUNT:
2748                 retval = tty_tiocgicount(tty, p);
2749                 /* For the moment allow fall through to the old method */
2750                 if (retval != -EINVAL)
2751                         return retval;
2752                 break;
2753         case TCFLSH:
2754                 switch (arg) {
2755                 case TCIFLUSH:
2756                 case TCIOFLUSH:
2757                 /* flush tty buffer and allow ldisc to process ioctl */
2758                         tty_buffer_flush(tty);
2759                         break;
2760                 }
2761                 break;
2762         }
2763         if (tty->ops->ioctl) {
2764                 retval = (tty->ops->ioctl)(tty, cmd, arg);
2765                 if (retval != -ENOIOCTLCMD)
2766                         return retval;
2767         }
2768         ld = tty_ldisc_ref_wait(tty);
2769         retval = -EINVAL;
2770         if (ld->ops->ioctl) {
2771                 retval = ld->ops->ioctl(tty, file, cmd, arg);
2772                 if (retval == -ENOIOCTLCMD)
2773                         retval = -EINVAL;
2774         }
2775         tty_ldisc_deref(ld);
2776         return retval;
2777 }
2778
2779 #ifdef CONFIG_COMPAT
2780 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2781                                 unsigned long arg)
2782 {
2783         struct inode *inode = file->f_dentry->d_inode;
2784         struct tty_struct *tty = file_tty(file);
2785         struct tty_ldisc *ld;
2786         int retval = -ENOIOCTLCMD;
2787
2788         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2789                 return -EINVAL;
2790
2791         if (tty->ops->compat_ioctl) {
2792                 retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2793                 if (retval != -ENOIOCTLCMD)
2794                         return retval;
2795         }
2796
2797         ld = tty_ldisc_ref_wait(tty);
2798         if (ld->ops->compat_ioctl)
2799                 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2800         else
2801                 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2802         tty_ldisc_deref(ld);
2803
2804         return retval;
2805 }
2806 #endif
2807
2808 /*
2809  * This implements the "Secure Attention Key" ---  the idea is to
2810  * prevent trojan horses by killing all processes associated with this
2811  * tty when the user hits the "Secure Attention Key".  Required for
2812  * super-paranoid applications --- see the Orange Book for more details.
2813  *
2814  * This code could be nicer; ideally it should send a HUP, wait a few
2815  * seconds, then send a INT, and then a KILL signal.  But you then
2816  * have to coordinate with the init process, since all processes associated
2817  * with the current tty must be dead before the new getty is allowed
2818  * to spawn.
2819  *
2820  * Now, if it would be correct ;-/ The current code has a nasty hole -
2821  * it doesn't catch files in flight. We may send the descriptor to ourselves
2822  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2823  *
2824  * Nasty bug: do_SAK is being called in interrupt context.  This can
2825  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2826  */
2827 void __do_SAK(struct tty_struct *tty)
2828 {
2829 #ifdef TTY_SOFT_SAK
2830         tty_hangup(tty);
2831 #else
2832         struct task_struct *g, *p;
2833         struct pid *session;
2834         int             i;
2835         struct file     *filp;
2836         struct fdtable *fdt;
2837
2838         if (!tty)
2839                 return;
2840         session = tty->session;
2841
2842         tty_ldisc_flush(tty);
2843
2844         tty_driver_flush_buffer(tty);
2845
2846         read_lock(&tasklist_lock);
2847         /* Kill the entire session */
2848         do_each_pid_task(session, PIDTYPE_SID, p) {
2849                 printk(KERN_NOTICE "SAK: killed process %d"
2850                         " (%s): task_session(p)==tty->session\n",
2851                         task_pid_nr(p), p->comm);
2852                 send_sig(SIGKILL, p, 1);
2853         } while_each_pid_task(session, PIDTYPE_SID, p);
2854         /* Now kill any processes that happen to have the
2855          * tty open.
2856          */
2857         do_each_thread(g, p) {
2858                 if (p->signal->tty == tty) {
2859                         printk(KERN_NOTICE "SAK: killed process %d"
2860                             " (%s): task_session(p)==tty->session\n",
2861                             task_pid_nr(p), p->comm);
2862                         send_sig(SIGKILL, p, 1);
2863                         continue;
2864                 }
2865                 task_lock(p);
2866                 if (p->files) {
2867                         /*
2868                          * We don't take a ref to the file, so we must
2869                          * hold ->file_lock instead.
2870                          */
2871                         spin_lock(&p->files->file_lock);
2872                         fdt = files_fdtable(p->files);
2873                         for (i = 0; i < fdt->max_fds; i++) {
2874                                 filp = fcheck_files(p->files, i);
2875                                 if (!filp)
2876                                         continue;
2877                                 if (filp->f_op->read == tty_read &&
2878                                     file_tty(filp) == tty) {
2879                                         printk(KERN_NOTICE "SAK: killed process %d"
2880                                             " (%s): fd#%d opened to the tty\n",
2881                                             task_pid_nr(p), p->comm, i);
2882                                         force_sig(SIGKILL, p);
2883                                         break;
2884                                 }
2885                         }
2886                         spin_unlock(&p->files->file_lock);
2887                 }
2888                 task_unlock(p);
2889         } while_each_thread(g, p);
2890         read_unlock(&tasklist_lock);
2891 #endif
2892 }
2893
2894 static void do_SAK_work(struct work_struct *work)
2895 {
2896         struct tty_struct *tty =
2897                 container_of(work, struct tty_struct, SAK_work);
2898         __do_SAK(tty);
2899 }
2900
2901 /*
2902  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2903  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2904  * the values which we write to it will be identical to the values which it
2905  * already has. --akpm
2906  */
2907 void do_SAK(struct tty_struct *tty)
2908 {
2909         if (!tty)
2910                 return;
2911         schedule_work(&tty->SAK_work);
2912 }
2913
2914 EXPORT_SYMBOL(do_SAK);
2915
2916 static int dev_match_devt(struct device *dev, void *data)
2917 {
2918         dev_t *devt = data;
2919         return dev->devt == *devt;
2920 }
2921
2922 /* Must put_device() after it's unused! */
2923 static struct device *tty_get_device(struct tty_struct *tty)
2924 {
2925         dev_t devt = tty_devnum(tty);
2926         return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2927 }
2928
2929
2930 /**
2931  *      initialize_tty_struct
2932  *      @tty: tty to initialize
2933  *
2934  *      This subroutine initializes a tty structure that has been newly
2935  *      allocated.
2936  *
2937  *      Locking: none - tty in question must not be exposed at this point
2938  */
2939
2940 void initialize_tty_struct(struct tty_struct *tty,
2941                 struct tty_driver *driver, int idx)
2942 {
2943         memset(tty, 0, sizeof(struct tty_struct));
2944         kref_init(&tty->kref);
2945         tty->magic = TTY_MAGIC;
2946         tty_ldisc_init(tty);
2947         tty->session = NULL;
2948         tty->pgrp = NULL;
2949         tty->overrun_time = jiffies;
2950         tty_buffer_init(tty);
2951         mutex_init(&tty->termios_mutex);
2952         mutex_init(&tty->ldisc_mutex);
2953         init_waitqueue_head(&tty->write_wait);
2954         init_waitqueue_head(&tty->read_wait);
2955         INIT_WORK(&tty->hangup_work, do_tty_hangup);
2956         mutex_init(&tty->atomic_read_lock);
2957         mutex_init(&tty->atomic_write_lock);
2958         mutex_init(&tty->output_lock);
2959         mutex_init(&tty->echo_lock);
2960         spin_lock_init(&tty->read_lock);
2961         spin_lock_init(&tty->ctrl_lock);
2962         INIT_LIST_HEAD(&tty->tty_files);
2963         INIT_WORK(&tty->SAK_work, do_SAK_work);
2964
2965         tty->driver = driver;
2966         tty->ops = driver->ops;
2967         tty->index = idx;
2968         tty_line_name(driver, idx, tty->name);
2969         tty->dev = tty_get_device(tty);
2970 }
2971
2972 /**
2973  *      deinitialize_tty_struct
2974  *      @tty: tty to deinitialize
2975  *
2976  *      This subroutine deinitializes a tty structure that has been newly
2977  *      allocated but tty_release cannot be called on that yet.
2978  *
2979  *      Locking: none - tty in question must not be exposed at this point
2980  */
2981 void deinitialize_tty_struct(struct tty_struct *tty)
2982 {
2983         tty_ldisc_deinit(tty);
2984 }
2985
2986 /**
2987  *      tty_put_char    -       write one character to a tty
2988  *      @tty: tty
2989  *      @ch: character
2990  *
2991  *      Write one byte to the tty using the provided put_char method
2992  *      if present. Returns the number of characters successfully output.
2993  *
2994  *      Note: the specific put_char operation in the driver layer may go
2995  *      away soon. Don't call it directly, use this method
2996  */
2997
2998 int tty_put_char(struct tty_struct *tty, unsigned char ch)
2999 {
3000         if (tty->ops->put_char)
3001                 return tty->ops->put_char(tty, ch);
3002         return tty->ops->write(tty, &ch, 1);
3003 }
3004 EXPORT_SYMBOL_GPL(tty_put_char);
3005
3006 struct class *tty_class;
3007
3008 /**
3009  *      tty_register_device - register a tty device
3010  *      @driver: the tty driver that describes the tty device
3011  *      @index: the index in the tty driver for this tty device
3012  *      @device: a struct device that is associated with this tty device.
3013  *              This field is optional, if there is no known struct device
3014  *              for this tty device it can be set to NULL safely.
3015  *
3016  *      Returns a pointer to the struct device for this tty device
3017  *      (or ERR_PTR(-EFOO) on error).
3018  *
3019  *      This call is required to be made to register an individual tty device
3020  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3021  *      that bit is not set, this function should not be called by a tty
3022  *      driver.
3023  *
3024  *      Locking: ??
3025  */
3026
3027 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3028                                    struct device *device)
3029 {
3030         char name[64];
3031         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3032
3033         if (index >= driver->num) {
3034                 printk(KERN_ERR "Attempt to register invalid tty line number "
3035                        " (%d).\n", index);
3036                 return ERR_PTR(-EINVAL);
3037         }
3038
3039         if (driver->type == TTY_DRIVER_TYPE_PTY)
3040                 pty_line_name(driver, index, name);
3041         else
3042                 tty_line_name(driver, index, name);
3043
3044         return device_create(tty_class, device, dev, NULL, name);
3045 }
3046 EXPORT_SYMBOL(tty_register_device);
3047
3048 /**
3049  *      tty_unregister_device - unregister a tty device
3050  *      @driver: the tty driver that describes the tty device
3051  *      @index: the index in the tty driver for this tty device
3052  *
3053  *      If a tty device is registered with a call to tty_register_device() then
3054  *      this function must be called when the tty device is gone.
3055  *
3056  *      Locking: ??
3057  */
3058
3059 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3060 {
3061         device_destroy(tty_class,
3062                 MKDEV(driver->major, driver->minor_start) + index);
3063 }
3064 EXPORT_SYMBOL(tty_unregister_device);
3065
3066 struct tty_driver *__alloc_tty_driver(int lines, struct module *owner)
3067 {
3068         struct tty_driver *driver;
3069
3070         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3071         if (driver) {
3072                 kref_init(&driver->kref);
3073                 driver->magic = TTY_DRIVER_MAGIC;
3074                 driver->num = lines;
3075                 driver->owner = owner;
3076                 /* later we'll move allocation of tables here */
3077         }
3078         return driver;
3079 }
3080 EXPORT_SYMBOL(__alloc_tty_driver);
3081
3082 static void destruct_tty_driver(struct kref *kref)
3083 {
3084         struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3085         int i;
3086         struct ktermios *tp;
3087         void *p;
3088
3089         if (driver->flags & TTY_DRIVER_INSTALLED) {
3090                 /*
3091                  * Free the termios and termios_locked structures because
3092                  * we don't want to get memory leaks when modular tty
3093                  * drivers are removed from the kernel.
3094                  */
3095                 for (i = 0; i < driver->num; i++) {
3096                         tp = driver->termios[i];
3097                         if (tp) {
3098                                 driver->termios[i] = NULL;
3099                                 kfree(tp);
3100                         }
3101                         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3102                                 tty_unregister_device(driver, i);
3103                 }
3104                 p = driver->ttys;
3105                 proc_tty_unregister_driver(driver);
3106                 driver->ttys = NULL;
3107                 driver->termios = NULL;
3108                 kfree(p);
3109                 cdev_del(&driver->cdev);
3110         }
3111         kfree(driver);
3112 }
3113
3114 void tty_driver_kref_put(struct tty_driver *driver)
3115 {
3116         kref_put(&driver->kref, destruct_tty_driver);
3117 }
3118 EXPORT_SYMBOL(tty_driver_kref_put);
3119
3120 void tty_set_operations(struct tty_driver *driver,
3121                         const struct tty_operations *op)
3122 {
3123         driver->ops = op;
3124 };
3125 EXPORT_SYMBOL(tty_set_operations);
3126
3127 void put_tty_driver(struct tty_driver *d)
3128 {
3129         tty_driver_kref_put(d);
3130 }
3131 EXPORT_SYMBOL(put_tty_driver);
3132
3133 /*
3134  * Called by a tty driver to register itself.
3135  */
3136 int tty_register_driver(struct tty_driver *driver)
3137 {
3138         int error;
3139         int i;
3140         dev_t dev;
3141         void **p = NULL;
3142         struct device *d;
3143
3144         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3145                 p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
3146                 if (!p)
3147                         return -ENOMEM;
3148         }
3149
3150         if (!driver->major) {
3151                 error = alloc_chrdev_region(&dev, driver->minor_start,
3152                                                 driver->num, driver->name);
3153                 if (!error) {
3154                         driver->major = MAJOR(dev);
3155                         driver->minor_start = MINOR(dev);
3156                 }
3157         } else {
3158                 dev = MKDEV(driver->major, driver->minor_start);
3159                 error = register_chrdev_region(dev, driver->num, driver->name);
3160         }
3161         if (error < 0) {
3162                 kfree(p);
3163                 return error;
3164         }
3165
3166         if (p) {
3167                 driver->ttys = (struct tty_struct **)p;
3168                 driver->termios = (struct ktermios **)(p + driver->num);
3169         } else {
3170                 driver->ttys = NULL;
3171                 driver->termios = NULL;
3172         }
3173
3174         cdev_init(&driver->cdev, &tty_fops);
3175         driver->cdev.owner = driver->owner;
3176         error = cdev_add(&driver->cdev, dev, driver->num);
3177         if (error) {
3178                 unregister_chrdev_region(dev, driver->num);
3179                 driver->ttys = NULL;
3180                 driver->termios = NULL;
3181                 kfree(p);
3182                 return error;
3183         }
3184
3185         mutex_lock(&tty_mutex);
3186         list_add(&driver->tty_drivers, &tty_drivers);
3187         mutex_unlock(&tty_mutex);
3188
3189         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3190                 for (i = 0; i < driver->num; i++) {
3191                         d = tty_register_device(driver, i, NULL);
3192                         if (IS_ERR(d)) {
3193                                 error = PTR_ERR(d);
3194                                 goto err;
3195                         }
3196                 }
3197         }
3198         proc_tty_register_driver(driver);
3199         driver->flags |= TTY_DRIVER_INSTALLED;
3200         return 0;
3201
3202 err:
3203         for (i--; i >= 0; i--)
3204                 tty_unregister_device(driver, i);
3205
3206         mutex_lock(&tty_mutex);
3207         list_del(&driver->tty_drivers);
3208         mutex_unlock(&tty_mutex);
3209
3210         unregister_chrdev_region(dev, driver->num);
3211         driver->ttys = NULL;
3212         driver->termios = NULL;
3213         kfree(p);
3214         return error;
3215 }
3216
3217 EXPORT_SYMBOL(tty_register_driver);
3218
3219 /*
3220  * Called by a tty driver to unregister itself.
3221  */
3222 int tty_unregister_driver(struct tty_driver *driver)
3223 {
3224 #if 0
3225         /* FIXME */
3226         if (driver->refcount)
3227                 return -EBUSY;
3228 #endif
3229         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3230                                 driver->num);
3231         mutex_lock(&tty_mutex);
3232         list_del(&driver->tty_drivers);
3233         mutex_unlock(&tty_mutex);
3234         return 0;
3235 }
3236
3237 EXPORT_SYMBOL(tty_unregister_driver);
3238
3239 dev_t tty_devnum(struct tty_struct *tty)
3240 {
3241         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3242 }
3243 EXPORT_SYMBOL(tty_devnum);
3244
3245 void proc_clear_tty(struct task_struct *p)
3246 {
3247         unsigned long flags;
3248         struct tty_struct *tty;
3249         spin_lock_irqsave(&p->sighand->siglock, flags);
3250         tty = p->signal->tty;
3251         p->signal->tty = NULL;
3252         spin_unlock_irqrestore(&p->sighand->siglock, flags);
3253         tty_kref_put(tty);
3254 }
3255
3256 /* Called under the sighand lock */
3257
3258 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3259 {
3260         if (tty) {
3261                 unsigned long flags;
3262                 /* We should not have a session or pgrp to put here but.... */
3263                 spin_lock_irqsave(&tty->ctrl_lock, flags);
3264                 put_pid(tty->session);
3265                 put_pid(tty->pgrp);
3266                 tty->pgrp = get_pid(task_pgrp(tsk));
3267                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3268                 tty->session = get_pid(task_session(tsk));
3269                 if (tsk->signal->tty) {
3270                         printk(KERN_DEBUG "tty not NULL!!\n");
3271                         tty_kref_put(tsk->signal->tty);
3272                 }
3273         }
3274         put_pid(tsk->signal->tty_old_pgrp);
3275         tsk->signal->tty = tty_kref_get(tty);
3276         tsk->signal->tty_old_pgrp = NULL;
3277 }
3278
3279 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3280 {
3281         spin_lock_irq(&tsk->sighand->siglock);
3282         __proc_set_tty(tsk, tty);
3283         spin_unlock_irq(&tsk->sighand->siglock);
3284 }
3285
3286 struct tty_struct *get_current_tty(void)
3287 {
3288         struct tty_struct *tty;
3289         unsigned long flags;
3290
3291         spin_lock_irqsave(&current->sighand->siglock, flags);
3292         tty = tty_kref_get(current->signal->tty);
3293         spin_unlock_irqrestore(&current->sighand->siglock, flags);
3294         return tty;
3295 }
3296 EXPORT_SYMBOL_GPL(get_current_tty);
3297
3298 void tty_default_fops(struct file_operations *fops)
3299 {
3300         *fops = tty_fops;
3301 }
3302
3303 /*
3304  * Initialize the console device. This is called *early*, so
3305  * we can't necessarily depend on lots of kernel help here.
3306  * Just do some early initializations, and do the complex setup
3307  * later.
3308  */
3309 void __init console_init(void)
3310 {
3311         initcall_t *call;
3312
3313         /* Setup the default TTY line discipline. */
3314         tty_ldisc_begin();
3315
3316         /*
3317          * set up the console device so that later boot sequences can
3318          * inform about problems etc..
3319          */
3320         call = __con_initcall_start;
3321         while (call < __con_initcall_end) {
3322                 (*call)();
3323                 call++;
3324         }
3325 }
3326
3327 static char *tty_devnode(struct device *dev, umode_t *mode)
3328 {
3329         if (!mode)
3330                 return NULL;
3331         if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3332             dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3333                 *mode = 0666;
3334         return NULL;
3335 }
3336
3337 static int __init tty_class_init(void)
3338 {
3339         tty_class = class_create(THIS_MODULE, "tty");
3340         if (IS_ERR(tty_class))
3341                 return PTR_ERR(tty_class);
3342         tty_class->devnode = tty_devnode;
3343         return 0;
3344 }
3345
3346 postcore_initcall(tty_class_init);
3347
3348 /* 3/2004 jmc: why do these devices exist? */
3349 static struct cdev tty_cdev, console_cdev;
3350
3351 static ssize_t show_cons_active(struct device *dev,
3352                                 struct device_attribute *attr, char *buf)
3353 {
3354         struct console *cs[16];
3355         int i = 0;
3356         struct console *c;
3357         ssize_t count = 0;
3358
3359         console_lock();
3360         for_each_console(c) {
3361                 if (!c->device)
3362                         continue;
3363                 if (!c->write)
3364                         continue;
3365                 if ((c->flags & CON_ENABLED) == 0)
3366                         continue;
3367                 cs[i++] = c;
3368                 if (i >= ARRAY_SIZE(cs))
3369                         break;
3370         }
3371         while (i--)
3372                 count += sprintf(buf + count, "%s%d%c",
3373                                  cs[i]->name, cs[i]->index, i ? ' ':'\n');
3374         console_unlock();
3375
3376         return count;
3377 }
3378 static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3379
3380 static struct device *consdev;
3381
3382 void console_sysfs_notify(void)
3383 {
3384         if (consdev)
3385                 sysfs_notify(&consdev->kobj, NULL, "active");
3386 }
3387
3388 /*
3389  * Ok, now we can initialize the rest of the tty devices and can count
3390  * on memory allocations, interrupts etc..
3391  */
3392 int __init tty_init(void)
3393 {
3394         cdev_init(&tty_cdev, &tty_fops);
3395         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3396             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3397                 panic("Couldn't register /dev/tty driver\n");
3398         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3399
3400         cdev_init(&console_cdev, &console_fops);
3401         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3402             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3403                 panic("Couldn't register /dev/console driver\n");
3404         consdev = device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3405                               "console");
3406         if (IS_ERR(consdev))
3407                 consdev = NULL;
3408         else
3409                 WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
3410
3411 #ifdef CONFIG_VT
3412         vty_init(&console_fops);
3413 #endif
3414         return 0;
3415 }
3416