make get_file() return its argument
[pandora-kernel.git] / drivers / tty / tty_io.c
1 /*
2  *  Copyright (C) 1991, 1992  Linus Torvalds
3  */
4
5 /*
6  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7  * or rs-channels. It also implements echoing, cooked mode etc.
8  *
9  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10  *
11  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12  * tty_struct and tty_queue structures.  Previously there was an array
13  * of 256 tty_struct's which was statically allocated, and the
14  * tty_queue structures were allocated at boot time.  Both are now
15  * dynamically allocated only when the tty is open.
16  *
17  * Also restructured routines so that there is more of a separation
18  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19  * the low-level tty routines (serial.c, pty.c, console.c).  This
20  * makes for cleaner and more compact code.  -TYT, 9/17/92
21  *
22  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23  * which can be dynamically activated and de-activated by the line
24  * discipline handling modules (like SLIP).
25  *
26  * NOTE: pay no attention to the line discipline code (yet); its
27  * interface is still subject to change in this version...
28  * -- TYT, 1/31/92
29  *
30  * Added functionality to the OPOST tty handling.  No delays, but all
31  * other bits should be there.
32  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33  *
34  * Rewrote canonical mode and added more termios flags.
35  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36  *
37  * Reorganized FASYNC support so mouse code can share it.
38  *      -- ctm@ardi.com, 9Sep95
39  *
40  * New TIOCLINUX variants added.
41  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
42  *
43  * Restrict vt switching via ioctl()
44  *      -- grif@cs.ucr.edu, 5-Dec-95
45  *
46  * Move console and virtual terminal code to more appropriate files,
47  * implement CONFIG_VT and generalize console device interface.
48  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49  *
50  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51  *      -- Bill Hawes <whawes@star.net>, June 97
52  *
53  * Added devfs support.
54  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55  *
56  * Added support for a Unix98-style ptmx device.
57  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58  *
59  * Reduced memory usage for older ARM systems
60  *      -- Russell King <rmk@arm.linux.org.uk>
61  *
62  * Move do_SAK() into process context.  Less stack use in devfs functions.
63  * alloc_tty_struct() always uses kmalloc()
64  *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65  */
66
67 #include <linux/types.h>
68 #include <linux/major.h>
69 #include <linux/errno.h>
70 #include <linux/signal.h>
71 #include <linux/fcntl.h>
72 #include <linux/sched.h>
73 #include <linux/interrupt.h>
74 #include <linux/tty.h>
75 #include <linux/tty_driver.h>
76 #include <linux/tty_flip.h>
77 #include <linux/devpts_fs.h>
78 #include <linux/file.h>
79 #include <linux/fdtable.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/device.h>
92 #include <linux/wait.h>
93 #include <linux/bitops.h>
94 #include <linux/delay.h>
95 #include <linux/seq_file.h>
96 #include <linux/serial.h>
97 #include <linux/ratelimit.h>
98
99 #include <linux/uaccess.h>
100 #include <asm/system.h>
101
102 #include <linux/kbd_kern.h>
103 #include <linux/vt_kern.h>
104 #include <linux/selection.h>
105
106 #include <linux/kmod.h>
107 #include <linux/nsproxy.h>
108
109 #undef TTY_DEBUG_HANGUP
110
111 #define TTY_PARANOIA_CHECK 1
112 #define CHECK_TTY_COUNT 1
113
114 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
115         .c_iflag = ICRNL | IXON,
116         .c_oflag = OPOST | ONLCR,
117         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
118         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
119                    ECHOCTL | ECHOKE | IEXTEN,
120         .c_cc = INIT_C_CC,
121         .c_ispeed = 38400,
122         .c_ospeed = 38400
123 };
124
125 EXPORT_SYMBOL(tty_std_termios);
126
127 /* This list gets poked at by procfs and various bits of boot up code. This
128    could do with some rationalisation such as pulling the tty proc function
129    into this file */
130
131 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
132
133 /* Mutex to protect creating and releasing a tty. This is shared with
134    vt.c for deeply disgusting hack reasons */
135 DEFINE_MUTEX(tty_mutex);
136 EXPORT_SYMBOL(tty_mutex);
137
138 /* Spinlock to protect the tty->tty_files list */
139 DEFINE_SPINLOCK(tty_files_lock);
140
141 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
142 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
143 ssize_t redirected_tty_write(struct file *, const char __user *,
144                                                         size_t, loff_t *);
145 static unsigned int tty_poll(struct file *, poll_table *);
146 static int tty_open(struct inode *, struct file *);
147 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
148 #ifdef CONFIG_COMPAT
149 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
150                                 unsigned long arg);
151 #else
152 #define tty_compat_ioctl NULL
153 #endif
154 static int __tty_fasync(int fd, struct file *filp, int on);
155 static int tty_fasync(int fd, struct file *filp, int on);
156 static void release_tty(struct tty_struct *tty, int idx);
157 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
159
160 /**
161  *      alloc_tty_struct        -       allocate a tty object
162  *
163  *      Return a new empty tty structure. The data fields have not
164  *      been initialized in any way but has been zeroed
165  *
166  *      Locking: none
167  */
168
169 struct tty_struct *alloc_tty_struct(void)
170 {
171         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
172 }
173
174 /**
175  *      free_tty_struct         -       free a disused tty
176  *      @tty: tty struct to free
177  *
178  *      Free the write buffers, tty queue and tty memory itself.
179  *
180  *      Locking: none. Must be called after tty is definitely unused
181  */
182
183 void free_tty_struct(struct tty_struct *tty)
184 {
185         if (tty->dev)
186                 put_device(tty->dev);
187         kfree(tty->write_buf);
188         tty_buffer_free_all(tty);
189         kfree(tty);
190 }
191
192 static inline struct tty_struct *file_tty(struct file *file)
193 {
194         return ((struct tty_file_private *)file->private_data)->tty;
195 }
196
197 int tty_alloc_file(struct file *file)
198 {
199         struct tty_file_private *priv;
200
201         priv = kmalloc(sizeof(*priv), GFP_KERNEL);
202         if (!priv)
203                 return -ENOMEM;
204
205         file->private_data = priv;
206
207         return 0;
208 }
209
210 /* Associate a new file with the tty structure */
211 void tty_add_file(struct tty_struct *tty, struct file *file)
212 {
213         struct tty_file_private *priv = file->private_data;
214
215         priv->tty = tty;
216         priv->file = file;
217
218         spin_lock(&tty_files_lock);
219         list_add(&priv->list, &tty->tty_files);
220         spin_unlock(&tty_files_lock);
221 }
222
223 /**
224  * tty_free_file - free file->private_data
225  *
226  * This shall be used only for fail path handling when tty_add_file was not
227  * called yet.
228  */
229 void tty_free_file(struct file *file)
230 {
231         struct tty_file_private *priv = file->private_data;
232
233         file->private_data = NULL;
234         kfree(priv);
235 }
236
237 /* Delete file from its tty */
238 void tty_del_file(struct file *file)
239 {
240         struct tty_file_private *priv = file->private_data;
241
242         spin_lock(&tty_files_lock);
243         list_del(&priv->list);
244         spin_unlock(&tty_files_lock);
245         tty_free_file(file);
246 }
247
248
249 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
250
251 /**
252  *      tty_name        -       return tty naming
253  *      @tty: tty structure
254  *      @buf: buffer for output
255  *
256  *      Convert a tty structure into a name. The name reflects the kernel
257  *      naming policy and if udev is in use may not reflect user space
258  *
259  *      Locking: none
260  */
261
262 char *tty_name(struct tty_struct *tty, char *buf)
263 {
264         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
265                 strcpy(buf, "NULL tty");
266         else
267                 strcpy(buf, tty->name);
268         return buf;
269 }
270
271 EXPORT_SYMBOL(tty_name);
272
273 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
274                               const char *routine)
275 {
276 #ifdef TTY_PARANOIA_CHECK
277         if (!tty) {
278                 printk(KERN_WARNING
279                         "null TTY for (%d:%d) in %s\n",
280                         imajor(inode), iminor(inode), routine);
281                 return 1;
282         }
283         if (tty->magic != TTY_MAGIC) {
284                 printk(KERN_WARNING
285                         "bad magic number for tty struct (%d:%d) in %s\n",
286                         imajor(inode), iminor(inode), routine);
287                 return 1;
288         }
289 #endif
290         return 0;
291 }
292
293 static int check_tty_count(struct tty_struct *tty, const char *routine)
294 {
295 #ifdef CHECK_TTY_COUNT
296         struct list_head *p;
297         int count = 0;
298
299         spin_lock(&tty_files_lock);
300         list_for_each(p, &tty->tty_files) {
301                 count++;
302         }
303         spin_unlock(&tty_files_lock);
304         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
305             tty->driver->subtype == PTY_TYPE_SLAVE &&
306             tty->link && tty->link->count)
307                 count++;
308         if (tty->count != count) {
309                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
310                                     "!= #fd's(%d) in %s\n",
311                        tty->name, tty->count, count, routine);
312                 return count;
313         }
314 #endif
315         return 0;
316 }
317
318 /**
319  *      get_tty_driver          -       find device of a tty
320  *      @dev_t: device identifier
321  *      @index: returns the index of the tty
322  *
323  *      This routine returns a tty driver structure, given a device number
324  *      and also passes back the index number.
325  *
326  *      Locking: caller must hold tty_mutex
327  */
328
329 static struct tty_driver *get_tty_driver(dev_t device, int *index)
330 {
331         struct tty_driver *p;
332
333         list_for_each_entry(p, &tty_drivers, tty_drivers) {
334                 dev_t base = MKDEV(p->major, p->minor_start);
335                 if (device < base || device >= base + p->num)
336                         continue;
337                 *index = device - base;
338                 return tty_driver_kref_get(p);
339         }
340         return NULL;
341 }
342
343 #ifdef CONFIG_CONSOLE_POLL
344
345 /**
346  *      tty_find_polling_driver -       find device of a polled tty
347  *      @name: name string to match
348  *      @line: pointer to resulting tty line nr
349  *
350  *      This routine returns a tty driver structure, given a name
351  *      and the condition that the tty driver is capable of polled
352  *      operation.
353  */
354 struct tty_driver *tty_find_polling_driver(char *name, int *line)
355 {
356         struct tty_driver *p, *res = NULL;
357         int tty_line = 0;
358         int len;
359         char *str, *stp;
360
361         for (str = name; *str; str++)
362                 if ((*str >= '0' && *str <= '9') || *str == ',')
363                         break;
364         if (!*str)
365                 return NULL;
366
367         len = str - name;
368         tty_line = simple_strtoul(str, &str, 10);
369
370         mutex_lock(&tty_mutex);
371         /* Search through the tty devices to look for a match */
372         list_for_each_entry(p, &tty_drivers, tty_drivers) {
373                 if (strncmp(name, p->name, len) != 0)
374                         continue;
375                 stp = str;
376                 if (*stp == ',')
377                         stp++;
378                 if (*stp == '\0')
379                         stp = NULL;
380
381                 if (tty_line >= 0 && tty_line < p->num && p->ops &&
382                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
383                         res = tty_driver_kref_get(p);
384                         *line = tty_line;
385                         break;
386                 }
387         }
388         mutex_unlock(&tty_mutex);
389
390         return res;
391 }
392 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
393 #endif
394
395 /**
396  *      tty_check_change        -       check for POSIX terminal changes
397  *      @tty: tty to check
398  *
399  *      If we try to write to, or set the state of, a terminal and we're
400  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
401  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
402  *
403  *      Locking: ctrl_lock
404  */
405
406 int tty_check_change(struct tty_struct *tty)
407 {
408         unsigned long flags;
409         int ret = 0;
410
411         if (current->signal->tty != tty)
412                 return 0;
413
414         spin_lock_irqsave(&tty->ctrl_lock, flags);
415
416         if (!tty->pgrp) {
417                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
418                 goto out_unlock;
419         }
420         if (task_pgrp(current) == tty->pgrp)
421                 goto out_unlock;
422         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
423         if (is_ignored(SIGTTOU))
424                 goto out;
425         if (is_current_pgrp_orphaned()) {
426                 ret = -EIO;
427                 goto out;
428         }
429         kill_pgrp(task_pgrp(current), SIGTTOU, 1);
430         set_thread_flag(TIF_SIGPENDING);
431         ret = -ERESTARTSYS;
432 out:
433         return ret;
434 out_unlock:
435         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
436         return ret;
437 }
438
439 EXPORT_SYMBOL(tty_check_change);
440
441 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
442                                 size_t count, loff_t *ppos)
443 {
444         return 0;
445 }
446
447 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
448                                  size_t count, loff_t *ppos)
449 {
450         return -EIO;
451 }
452
453 /* No kernel lock held - none needed ;) */
454 static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
455 {
456         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
457 }
458
459 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
460                 unsigned long arg)
461 {
462         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
463 }
464
465 static long hung_up_tty_compat_ioctl(struct file *file,
466                                      unsigned int cmd, unsigned long arg)
467 {
468         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
469 }
470
471 static const struct file_operations tty_fops = {
472         .llseek         = no_llseek,
473         .read           = tty_read,
474         .write          = tty_write,
475         .poll           = tty_poll,
476         .unlocked_ioctl = tty_ioctl,
477         .compat_ioctl   = tty_compat_ioctl,
478         .open           = tty_open,
479         .release        = tty_release,
480         .fasync         = tty_fasync,
481 };
482
483 static const struct file_operations console_fops = {
484         .llseek         = no_llseek,
485         .read           = tty_read,
486         .write          = redirected_tty_write,
487         .poll           = tty_poll,
488         .unlocked_ioctl = tty_ioctl,
489         .compat_ioctl   = tty_compat_ioctl,
490         .open           = tty_open,
491         .release        = tty_release,
492         .fasync         = tty_fasync,
493 };
494
495 static const struct file_operations hung_up_tty_fops = {
496         .llseek         = no_llseek,
497         .read           = hung_up_tty_read,
498         .write          = hung_up_tty_write,
499         .poll           = hung_up_tty_poll,
500         .unlocked_ioctl = hung_up_tty_ioctl,
501         .compat_ioctl   = hung_up_tty_compat_ioctl,
502         .release        = tty_release,
503 };
504
505 static DEFINE_SPINLOCK(redirect_lock);
506 static struct file *redirect;
507
508 /**
509  *      tty_wakeup      -       request more data
510  *      @tty: terminal
511  *
512  *      Internal and external helper for wakeups of tty. This function
513  *      informs the line discipline if present that the driver is ready
514  *      to receive more output data.
515  */
516
517 void tty_wakeup(struct tty_struct *tty)
518 {
519         struct tty_ldisc *ld;
520
521         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
522                 ld = tty_ldisc_ref(tty);
523                 if (ld) {
524                         if (ld->ops->write_wakeup)
525                                 ld->ops->write_wakeup(tty);
526                         tty_ldisc_deref(ld);
527                 }
528         }
529         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
530 }
531
532 EXPORT_SYMBOL_GPL(tty_wakeup);
533
534 /**
535  *      __tty_hangup            -       actual handler for hangup events
536  *      @work: tty device
537  *
538  *      This can be called by the "eventd" kernel thread.  That is process
539  *      synchronous but doesn't hold any locks, so we need to make sure we
540  *      have the appropriate locks for what we're doing.
541  *
542  *      The hangup event clears any pending redirections onto the hung up
543  *      device. It ensures future writes will error and it does the needed
544  *      line discipline hangup and signal delivery. The tty object itself
545  *      remains intact.
546  *
547  *      Locking:
548  *              BTM
549  *                redirect lock for undoing redirection
550  *                file list lock for manipulating list of ttys
551  *                tty_ldisc_lock from called functions
552  *                termios_mutex resetting termios data
553  *                tasklist_lock to walk task list for hangup event
554  *                  ->siglock to protect ->signal/->sighand
555  */
556 void __tty_hangup(struct tty_struct *tty)
557 {
558         struct file *cons_filp = NULL;
559         struct file *filp, *f = NULL;
560         struct task_struct *p;
561         struct tty_file_private *priv;
562         int    closecount = 0, n;
563         unsigned long flags;
564         int refs = 0;
565
566         if (!tty)
567                 return;
568
569
570         spin_lock(&redirect_lock);
571         if (redirect && file_tty(redirect) == tty) {
572                 f = redirect;
573                 redirect = NULL;
574         }
575         spin_unlock(&redirect_lock);
576
577         tty_lock();
578
579         /* some functions below drop BTM, so we need this bit */
580         set_bit(TTY_HUPPING, &tty->flags);
581
582         /* inuse_filps is protected by the single tty lock,
583            this really needs to change if we want to flush the
584            workqueue with the lock held */
585         check_tty_count(tty, "tty_hangup");
586
587         spin_lock(&tty_files_lock);
588         /* This breaks for file handles being sent over AF_UNIX sockets ? */
589         list_for_each_entry(priv, &tty->tty_files, list) {
590                 filp = priv->file;
591                 if (filp->f_op->write == redirected_tty_write)
592                         cons_filp = filp;
593                 if (filp->f_op->write != tty_write)
594                         continue;
595                 closecount++;
596                 __tty_fasync(-1, filp, 0);      /* can't block */
597                 filp->f_op = &hung_up_tty_fops;
598         }
599         spin_unlock(&tty_files_lock);
600
601         /*
602          * it drops BTM and thus races with reopen
603          * we protect the race by TTY_HUPPING
604          */
605         tty_ldisc_hangup(tty);
606
607         read_lock(&tasklist_lock);
608         if (tty->session) {
609                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
610                         spin_lock_irq(&p->sighand->siglock);
611                         if (p->signal->tty == tty) {
612                                 p->signal->tty = NULL;
613                                 /* We defer the dereferences outside fo
614                                    the tasklist lock */
615                                 refs++;
616                         }
617                         if (!p->signal->leader) {
618                                 spin_unlock_irq(&p->sighand->siglock);
619                                 continue;
620                         }
621                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
622                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
623                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
624                         spin_lock_irqsave(&tty->ctrl_lock, flags);
625                         if (tty->pgrp)
626                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
627                         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
628                         spin_unlock_irq(&p->sighand->siglock);
629                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
630         }
631         read_unlock(&tasklist_lock);
632
633         spin_lock_irqsave(&tty->ctrl_lock, flags);
634         clear_bit(TTY_THROTTLED, &tty->flags);
635         clear_bit(TTY_PUSH, &tty->flags);
636         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
637         put_pid(tty->session);
638         put_pid(tty->pgrp);
639         tty->session = NULL;
640         tty->pgrp = NULL;
641         tty->ctrl_status = 0;
642         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
643
644         /* Account for the p->signal references we killed */
645         while (refs--)
646                 tty_kref_put(tty);
647
648         /*
649          * If one of the devices matches a console pointer, we
650          * cannot just call hangup() because that will cause
651          * tty->count and state->count to go out of sync.
652          * So we just call close() the right number of times.
653          */
654         if (cons_filp) {
655                 if (tty->ops->close)
656                         for (n = 0; n < closecount; n++)
657                                 tty->ops->close(tty, cons_filp);
658         } else if (tty->ops->hangup)
659                 (tty->ops->hangup)(tty);
660         /*
661          * We don't want to have driver/ldisc interactions beyond
662          * the ones we did here. The driver layer expects no
663          * calls after ->hangup() from the ldisc side. However we
664          * can't yet guarantee all that.
665          */
666         set_bit(TTY_HUPPED, &tty->flags);
667         clear_bit(TTY_HUPPING, &tty->flags);
668         tty_ldisc_enable(tty);
669
670         tty_unlock();
671
672         if (f)
673                 fput(f);
674 }
675
676 static void do_tty_hangup(struct work_struct *work)
677 {
678         struct tty_struct *tty =
679                 container_of(work, struct tty_struct, hangup_work);
680
681         __tty_hangup(tty);
682 }
683
684 /**
685  *      tty_hangup              -       trigger a hangup event
686  *      @tty: tty to hangup
687  *
688  *      A carrier loss (virtual or otherwise) has occurred on this like
689  *      schedule a hangup sequence to run after this event.
690  */
691
692 void tty_hangup(struct tty_struct *tty)
693 {
694 #ifdef TTY_DEBUG_HANGUP
695         char    buf[64];
696         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
697 #endif
698         schedule_work(&tty->hangup_work);
699 }
700
701 EXPORT_SYMBOL(tty_hangup);
702
703 /**
704  *      tty_vhangup             -       process vhangup
705  *      @tty: tty to hangup
706  *
707  *      The user has asked via system call for the terminal to be hung up.
708  *      We do this synchronously so that when the syscall returns the process
709  *      is complete. That guarantee is necessary for security reasons.
710  */
711
712 void tty_vhangup(struct tty_struct *tty)
713 {
714 #ifdef TTY_DEBUG_HANGUP
715         char    buf[64];
716
717         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
718 #endif
719         __tty_hangup(tty);
720 }
721
722 EXPORT_SYMBOL(tty_vhangup);
723
724
725 /**
726  *      tty_vhangup_self        -       process vhangup for own ctty
727  *
728  *      Perform a vhangup on the current controlling tty
729  */
730
731 void tty_vhangup_self(void)
732 {
733         struct tty_struct *tty;
734
735         tty = get_current_tty();
736         if (tty) {
737                 tty_vhangup(tty);
738                 tty_kref_put(tty);
739         }
740 }
741
742 /**
743  *      tty_hung_up_p           -       was tty hung up
744  *      @filp: file pointer of tty
745  *
746  *      Return true if the tty has been subject to a vhangup or a carrier
747  *      loss
748  */
749
750 int tty_hung_up_p(struct file *filp)
751 {
752         return (filp->f_op == &hung_up_tty_fops);
753 }
754
755 EXPORT_SYMBOL(tty_hung_up_p);
756
757 static void session_clear_tty(struct pid *session)
758 {
759         struct task_struct *p;
760         do_each_pid_task(session, PIDTYPE_SID, p) {
761                 proc_clear_tty(p);
762         } while_each_pid_task(session, PIDTYPE_SID, p);
763 }
764
765 /**
766  *      disassociate_ctty       -       disconnect controlling tty
767  *      @on_exit: true if exiting so need to "hang up" the session
768  *
769  *      This function is typically called only by the session leader, when
770  *      it wants to disassociate itself from its controlling tty.
771  *
772  *      It performs the following functions:
773  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
774  *      (2)  Clears the tty from being controlling the session
775  *      (3)  Clears the controlling tty for all processes in the
776  *              session group.
777  *
778  *      The argument on_exit is set to 1 if called when a process is
779  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
780  *
781  *      Locking:
782  *              BTM is taken for hysterical raisins, and held when
783  *                called from no_tty().
784  *                tty_mutex is taken to protect tty
785  *                ->siglock is taken to protect ->signal/->sighand
786  *                tasklist_lock is taken to walk process list for sessions
787  *                  ->siglock is taken to protect ->signal/->sighand
788  */
789
790 void disassociate_ctty(int on_exit)
791 {
792         struct tty_struct *tty;
793         struct pid *tty_pgrp = NULL;
794
795         if (!current->signal->leader)
796                 return;
797
798         tty = get_current_tty();
799         if (tty) {
800                 tty_pgrp = get_pid(tty->pgrp);
801                 if (on_exit) {
802                         if (tty->driver->type != TTY_DRIVER_TYPE_PTY)
803                                 tty_vhangup(tty);
804                 }
805                 tty_kref_put(tty);
806         } else if (on_exit) {
807                 struct pid *old_pgrp;
808                 spin_lock_irq(&current->sighand->siglock);
809                 old_pgrp = current->signal->tty_old_pgrp;
810                 current->signal->tty_old_pgrp = NULL;
811                 spin_unlock_irq(&current->sighand->siglock);
812                 if (old_pgrp) {
813                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
814                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
815                         put_pid(old_pgrp);
816                 }
817                 return;
818         }
819         if (tty_pgrp) {
820                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
821                 if (!on_exit)
822                         kill_pgrp(tty_pgrp, SIGCONT, on_exit);
823                 put_pid(tty_pgrp);
824         }
825
826         spin_lock_irq(&current->sighand->siglock);
827         put_pid(current->signal->tty_old_pgrp);
828         current->signal->tty_old_pgrp = NULL;
829         spin_unlock_irq(&current->sighand->siglock);
830
831         tty = get_current_tty();
832         if (tty) {
833                 unsigned long flags;
834                 spin_lock_irqsave(&tty->ctrl_lock, flags);
835                 put_pid(tty->session);
836                 put_pid(tty->pgrp);
837                 tty->session = NULL;
838                 tty->pgrp = NULL;
839                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
840                 tty_kref_put(tty);
841         } else {
842 #ifdef TTY_DEBUG_HANGUP
843                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
844                        " = NULL", tty);
845 #endif
846         }
847
848         /* Now clear signal->tty under the lock */
849         read_lock(&tasklist_lock);
850         session_clear_tty(task_session(current));
851         read_unlock(&tasklist_lock);
852 }
853
854 /**
855  *
856  *      no_tty  - Ensure the current process does not have a controlling tty
857  */
858 void no_tty(void)
859 {
860         struct task_struct *tsk = current;
861         tty_lock();
862         disassociate_ctty(0);
863         tty_unlock();
864         proc_clear_tty(tsk);
865 }
866
867
868 /**
869  *      stop_tty        -       propagate flow control
870  *      @tty: tty to stop
871  *
872  *      Perform flow control to the driver. For PTY/TTY pairs we
873  *      must also propagate the TIOCKPKT status. May be called
874  *      on an already stopped device and will not re-call the driver
875  *      method.
876  *
877  *      This functionality is used by both the line disciplines for
878  *      halting incoming flow and by the driver. It may therefore be
879  *      called from any context, may be under the tty atomic_write_lock
880  *      but not always.
881  *
882  *      Locking:
883  *              Uses the tty control lock internally
884  */
885
886 void stop_tty(struct tty_struct *tty)
887 {
888         unsigned long flags;
889         spin_lock_irqsave(&tty->ctrl_lock, flags);
890         if (tty->stopped) {
891                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
892                 return;
893         }
894         tty->stopped = 1;
895         if (tty->link && tty->link->packet) {
896                 tty->ctrl_status &= ~TIOCPKT_START;
897                 tty->ctrl_status |= TIOCPKT_STOP;
898                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
899         }
900         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
901         if (tty->ops->stop)
902                 (tty->ops->stop)(tty);
903 }
904
905 EXPORT_SYMBOL(stop_tty);
906
907 /**
908  *      start_tty       -       propagate flow control
909  *      @tty: tty to start
910  *
911  *      Start a tty that has been stopped if at all possible. Perform
912  *      any necessary wakeups and propagate the TIOCPKT status. If this
913  *      is the tty was previous stopped and is being started then the
914  *      driver start method is invoked and the line discipline woken.
915  *
916  *      Locking:
917  *              ctrl_lock
918  */
919
920 void start_tty(struct tty_struct *tty)
921 {
922         unsigned long flags;
923         spin_lock_irqsave(&tty->ctrl_lock, flags);
924         if (!tty->stopped || tty->flow_stopped) {
925                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
926                 return;
927         }
928         tty->stopped = 0;
929         if (tty->link && tty->link->packet) {
930                 tty->ctrl_status &= ~TIOCPKT_STOP;
931                 tty->ctrl_status |= TIOCPKT_START;
932                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
933         }
934         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
935         if (tty->ops->start)
936                 (tty->ops->start)(tty);
937         /* If we have a running line discipline it may need kicking */
938         tty_wakeup(tty);
939 }
940
941 EXPORT_SYMBOL(start_tty);
942
943 /* We limit tty time update visibility to every 8 seconds or so. */
944 static void tty_update_time(struct timespec *time)
945 {
946         unsigned long sec = get_seconds();
947         if (abs(sec - time->tv_sec) & ~7)
948                 time->tv_sec = sec;
949 }
950
951 /**
952  *      tty_read        -       read method for tty device files
953  *      @file: pointer to tty file
954  *      @buf: user buffer
955  *      @count: size of user buffer
956  *      @ppos: unused
957  *
958  *      Perform the read system call function on this terminal device. Checks
959  *      for hung up devices before calling the line discipline method.
960  *
961  *      Locking:
962  *              Locks the line discipline internally while needed. Multiple
963  *      read calls may be outstanding in parallel.
964  */
965
966 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
967                         loff_t *ppos)
968 {
969         int i;
970         struct inode *inode = file->f_path.dentry->d_inode;
971         struct tty_struct *tty = file_tty(file);
972         struct tty_ldisc *ld;
973
974         if (tty_paranoia_check(tty, inode, "tty_read"))
975                 return -EIO;
976         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
977                 return -EIO;
978
979         /* We want to wait for the line discipline to sort out in this
980            situation */
981         ld = tty_ldisc_ref_wait(tty);
982         if (ld->ops->read)
983                 i = (ld->ops->read)(tty, file, buf, count);
984         else
985                 i = -EIO;
986         tty_ldisc_deref(ld);
987
988         if (i > 0)
989                 tty_update_time(&inode->i_atime);
990
991         return i;
992 }
993
994 void tty_write_unlock(struct tty_struct *tty)
995         __releases(&tty->atomic_write_lock)
996 {
997         mutex_unlock(&tty->atomic_write_lock);
998         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
999 }
1000
1001 int tty_write_lock(struct tty_struct *tty, int ndelay)
1002         __acquires(&tty->atomic_write_lock)
1003 {
1004         if (!mutex_trylock(&tty->atomic_write_lock)) {
1005                 if (ndelay)
1006                         return -EAGAIN;
1007                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
1008                         return -ERESTARTSYS;
1009         }
1010         return 0;
1011 }
1012
1013 /*
1014  * Split writes up in sane blocksizes to avoid
1015  * denial-of-service type attacks
1016  */
1017 static inline ssize_t do_tty_write(
1018         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1019         struct tty_struct *tty,
1020         struct file *file,
1021         const char __user *buf,
1022         size_t count)
1023 {
1024         ssize_t ret, written = 0;
1025         unsigned int chunk;
1026
1027         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1028         if (ret < 0)
1029                 return ret;
1030
1031         /*
1032          * We chunk up writes into a temporary buffer. This
1033          * simplifies low-level drivers immensely, since they
1034          * don't have locking issues and user mode accesses.
1035          *
1036          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1037          * big chunk-size..
1038          *
1039          * The default chunk-size is 2kB, because the NTTY
1040          * layer has problems with bigger chunks. It will
1041          * claim to be able to handle more characters than
1042          * it actually does.
1043          *
1044          * FIXME: This can probably go away now except that 64K chunks
1045          * are too likely to fail unless switched to vmalloc...
1046          */
1047         chunk = 2048;
1048         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1049                 chunk = 65536;
1050         if (count < chunk)
1051                 chunk = count;
1052
1053         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1054         if (tty->write_cnt < chunk) {
1055                 unsigned char *buf_chunk;
1056
1057                 if (chunk < 1024)
1058                         chunk = 1024;
1059
1060                 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1061                 if (!buf_chunk) {
1062                         ret = -ENOMEM;
1063                         goto out;
1064                 }
1065                 kfree(tty->write_buf);
1066                 tty->write_cnt = chunk;
1067                 tty->write_buf = buf_chunk;
1068         }
1069
1070         /* Do the write .. */
1071         for (;;) {
1072                 size_t size = count;
1073                 if (size > chunk)
1074                         size = chunk;
1075                 ret = -EFAULT;
1076                 if (copy_from_user(tty->write_buf, buf, size))
1077                         break;
1078                 ret = write(tty, file, tty->write_buf, size);
1079                 if (ret <= 0)
1080                         break;
1081                 written += ret;
1082                 buf += ret;
1083                 count -= ret;
1084                 if (!count)
1085                         break;
1086                 ret = -ERESTARTSYS;
1087                 if (signal_pending(current))
1088                         break;
1089                 cond_resched();
1090         }
1091         if (written) {
1092                struct inode *inode = file->f_path.dentry->d_inode;
1093                 tty_update_time(&inode->i_mtime);
1094                 ret = written;
1095         }
1096 out:
1097         tty_write_unlock(tty);
1098         return ret;
1099 }
1100
1101 /**
1102  * tty_write_message - write a message to a certain tty, not just the console.
1103  * @tty: the destination tty_struct
1104  * @msg: the message to write
1105  *
1106  * This is used for messages that need to be redirected to a specific tty.
1107  * We don't put it into the syslog queue right now maybe in the future if
1108  * really needed.
1109  *
1110  * We must still hold the BTM and test the CLOSING flag for the moment.
1111  */
1112
1113 void tty_write_message(struct tty_struct *tty, char *msg)
1114 {
1115         if (tty) {
1116                 mutex_lock(&tty->atomic_write_lock);
1117                 tty_lock();
1118                 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1119                         tty_unlock();
1120                         tty->ops->write(tty, msg, strlen(msg));
1121                 } else
1122                         tty_unlock();
1123                 tty_write_unlock(tty);
1124         }
1125         return;
1126 }
1127
1128
1129 /**
1130  *      tty_write               -       write method for tty device file
1131  *      @file: tty file pointer
1132  *      @buf: user data to write
1133  *      @count: bytes to write
1134  *      @ppos: unused
1135  *
1136  *      Write data to a tty device via the line discipline.
1137  *
1138  *      Locking:
1139  *              Locks the line discipline as required
1140  *              Writes to the tty driver are serialized by the atomic_write_lock
1141  *      and are then processed in chunks to the device. The line discipline
1142  *      write method will not be invoked in parallel for each device.
1143  */
1144
1145 static ssize_t tty_write(struct file *file, const char __user *buf,
1146                                                 size_t count, loff_t *ppos)
1147 {
1148         struct inode *inode = file->f_path.dentry->d_inode;
1149         struct tty_struct *tty = file_tty(file);
1150         struct tty_ldisc *ld;
1151         ssize_t ret;
1152
1153         if (tty_paranoia_check(tty, inode, "tty_write"))
1154                 return -EIO;
1155         if (!tty || !tty->ops->write ||
1156                 (test_bit(TTY_IO_ERROR, &tty->flags)))
1157                         return -EIO;
1158         /* Short term debug to catch buggy drivers */
1159         if (tty->ops->write_room == NULL)
1160                 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1161                         tty->driver->name);
1162         ld = tty_ldisc_ref_wait(tty);
1163         if (!ld->ops->write)
1164                 ret = -EIO;
1165         else
1166                 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1167         tty_ldisc_deref(ld);
1168         return ret;
1169 }
1170
1171 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1172                                                 size_t count, loff_t *ppos)
1173 {
1174         struct file *p = NULL;
1175
1176         spin_lock(&redirect_lock);
1177         if (redirect)
1178                 p = get_file(redirect);
1179         spin_unlock(&redirect_lock);
1180
1181         if (p) {
1182                 ssize_t res;
1183                 res = vfs_write(p, buf, count, &p->f_pos);
1184                 fput(p);
1185                 return res;
1186         }
1187         return tty_write(file, buf, count, ppos);
1188 }
1189
1190 static char ptychar[] = "pqrstuvwxyzabcde";
1191
1192 /**
1193  *      pty_line_name   -       generate name for a pty
1194  *      @driver: the tty driver in use
1195  *      @index: the minor number
1196  *      @p: output buffer of at least 6 bytes
1197  *
1198  *      Generate a name from a driver reference and write it to the output
1199  *      buffer.
1200  *
1201  *      Locking: None
1202  */
1203 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1204 {
1205         int i = index + driver->name_base;
1206         /* ->name is initialized to "ttyp", but "tty" is expected */
1207         sprintf(p, "%s%c%x",
1208                 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1209                 ptychar[i >> 4 & 0xf], i & 0xf);
1210 }
1211
1212 /**
1213  *      tty_line_name   -       generate name for a tty
1214  *      @driver: the tty driver in use
1215  *      @index: the minor number
1216  *      @p: output buffer of at least 7 bytes
1217  *
1218  *      Generate a name from a driver reference and write it to the output
1219  *      buffer.
1220  *
1221  *      Locking: None
1222  */
1223 static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1224 {
1225         return sprintf(p, "%s%d", driver->name, index + driver->name_base);
1226 }
1227
1228 /**
1229  *      tty_driver_lookup_tty() - find an existing tty, if any
1230  *      @driver: the driver for the tty
1231  *      @idx:    the minor number
1232  *
1233  *      Return the tty, if found or ERR_PTR() otherwise.
1234  *
1235  *      Locking: tty_mutex must be held. If tty is found, the mutex must
1236  *      be held until the 'fast-open' is also done. Will change once we
1237  *      have refcounting in the driver and per driver locking
1238  */
1239 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1240                 struct inode *inode, int idx)
1241 {
1242         struct tty_struct *tty;
1243
1244         if (driver->ops->lookup)
1245                 return driver->ops->lookup(driver, inode, idx);
1246
1247         tty = driver->ttys[idx];
1248         return tty;
1249 }
1250
1251 /**
1252  *      tty_init_termios        -  helper for termios setup
1253  *      @tty: the tty to set up
1254  *
1255  *      Initialise the termios structures for this tty. Thus runs under
1256  *      the tty_mutex currently so we can be relaxed about ordering.
1257  */
1258
1259 int tty_init_termios(struct tty_struct *tty)
1260 {
1261         struct ktermios *tp;
1262         int idx = tty->index;
1263
1264         tp = tty->driver->termios[idx];
1265         if (tp == NULL) {
1266                 tp = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
1267                 if (tp == NULL)
1268                         return -ENOMEM;
1269                 memcpy(tp, &tty->driver->init_termios,
1270                                                 sizeof(struct ktermios));
1271                 tty->driver->termios[idx] = tp;
1272         }
1273         tty->termios = tp;
1274         tty->termios_locked = tp + 1;
1275
1276         /* Compatibility until drivers always set this */
1277         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1278         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1279         return 0;
1280 }
1281 EXPORT_SYMBOL_GPL(tty_init_termios);
1282
1283 /**
1284  *      tty_driver_install_tty() - install a tty entry in the driver
1285  *      @driver: the driver for the tty
1286  *      @tty: the tty
1287  *
1288  *      Install a tty object into the driver tables. The tty->index field
1289  *      will be set by the time this is called. This method is responsible
1290  *      for ensuring any need additional structures are allocated and
1291  *      configured.
1292  *
1293  *      Locking: tty_mutex for now
1294  */
1295 static int tty_driver_install_tty(struct tty_driver *driver,
1296                                                 struct tty_struct *tty)
1297 {
1298         int idx = tty->index;
1299         int ret;
1300
1301         if (driver->ops->install) {
1302                 ret = driver->ops->install(driver, tty);
1303                 return ret;
1304         }
1305
1306         if (tty_init_termios(tty) == 0) {
1307                 tty_driver_kref_get(driver);
1308                 tty->count++;
1309                 driver->ttys[idx] = tty;
1310                 return 0;
1311         }
1312         return -ENOMEM;
1313 }
1314
1315 /**
1316  *      tty_driver_remove_tty() - remove a tty from the driver tables
1317  *      @driver: the driver for the tty
1318  *      @idx:    the minor number
1319  *
1320  *      Remvoe a tty object from the driver tables. The tty->index field
1321  *      will be set by the time this is called.
1322  *
1323  *      Locking: tty_mutex for now
1324  */
1325 void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1326 {
1327         if (driver->ops->remove)
1328                 driver->ops->remove(driver, tty);
1329         else
1330                 driver->ttys[tty->index] = NULL;
1331 }
1332
1333 /*
1334  *      tty_reopen()    - fast re-open of an open tty
1335  *      @tty    - the tty to open
1336  *
1337  *      Return 0 on success, -errno on error.
1338  *
1339  *      Locking: tty_mutex must be held from the time the tty was found
1340  *               till this open completes.
1341  */
1342 static int tty_reopen(struct tty_struct *tty)
1343 {
1344         struct tty_driver *driver = tty->driver;
1345
1346         if (test_bit(TTY_CLOSING, &tty->flags) ||
1347                         test_bit(TTY_HUPPING, &tty->flags) ||
1348                         test_bit(TTY_LDISC_CHANGING, &tty->flags))
1349                 return -EIO;
1350
1351         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1352             driver->subtype == PTY_TYPE_MASTER) {
1353                 /*
1354                  * special case for PTY masters: only one open permitted,
1355                  * and the slave side open count is incremented as well.
1356                  */
1357                 if (tty->count)
1358                         return -EIO;
1359
1360                 tty->link->count++;
1361         }
1362         tty->count++;
1363         tty->driver = driver; /* N.B. why do this every time?? */
1364
1365         mutex_lock(&tty->ldisc_mutex);
1366         WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1367         mutex_unlock(&tty->ldisc_mutex);
1368
1369         return 0;
1370 }
1371
1372 /**
1373  *      tty_init_dev            -       initialise a tty device
1374  *      @driver: tty driver we are opening a device on
1375  *      @idx: device index
1376  *      @ret_tty: returned tty structure
1377  *      @first_ok: ok to open a new device (used by ptmx)
1378  *
1379  *      Prepare a tty device. This may not be a "new" clean device but
1380  *      could also be an active device. The pty drivers require special
1381  *      handling because of this.
1382  *
1383  *      Locking:
1384  *              The function is called under the tty_mutex, which
1385  *      protects us from the tty struct or driver itself going away.
1386  *
1387  *      On exit the tty device has the line discipline attached and
1388  *      a reference count of 1. If a pair was created for pty/tty use
1389  *      and the other was a pty master then it too has a reference count of 1.
1390  *
1391  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1392  * failed open.  The new code protects the open with a mutex, so it's
1393  * really quite straightforward.  The mutex locking can probably be
1394  * relaxed for the (most common) case of reopening a tty.
1395  */
1396
1397 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
1398                                                                 int first_ok)
1399 {
1400         struct tty_struct *tty;
1401         int retval;
1402
1403         /* Check if pty master is being opened multiple times */
1404         if (driver->subtype == PTY_TYPE_MASTER &&
1405                 (driver->flags & TTY_DRIVER_DEVPTS_MEM) && !first_ok) {
1406                 return ERR_PTR(-EIO);
1407         }
1408
1409         /*
1410          * First time open is complex, especially for PTY devices.
1411          * This code guarantees that either everything succeeds and the
1412          * TTY is ready for operation, or else the table slots are vacated
1413          * and the allocated memory released.  (Except that the termios
1414          * and locked termios may be retained.)
1415          */
1416
1417         if (!try_module_get(driver->owner))
1418                 return ERR_PTR(-ENODEV);
1419
1420         tty = alloc_tty_struct();
1421         if (!tty) {
1422                 retval = -ENOMEM;
1423                 goto err_module_put;
1424         }
1425         initialize_tty_struct(tty, driver, idx);
1426
1427         retval = tty_driver_install_tty(driver, tty);
1428         if (retval < 0)
1429                 goto err_deinit_tty;
1430
1431         /*
1432          * Structures all installed ... call the ldisc open routines.
1433          * If we fail here just call release_tty to clean up.  No need
1434          * to decrement the use counts, as release_tty doesn't care.
1435          */
1436         retval = tty_ldisc_setup(tty, tty->link);
1437         if (retval)
1438                 goto err_release_tty;
1439         return tty;
1440
1441 err_deinit_tty:
1442         deinitialize_tty_struct(tty);
1443         free_tty_struct(tty);
1444 err_module_put:
1445         module_put(driver->owner);
1446         return ERR_PTR(retval);
1447
1448         /* call the tty release_tty routine to clean out this slot */
1449 err_release_tty:
1450         printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1451                                  "clearing slot %d\n", idx);
1452         release_tty(tty, idx);
1453         return ERR_PTR(retval);
1454 }
1455
1456 void tty_free_termios(struct tty_struct *tty)
1457 {
1458         struct ktermios *tp;
1459         int idx = tty->index;
1460         /* Kill this flag and push into drivers for locking etc */
1461         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1462                 /* FIXME: Locking on ->termios array */
1463                 tp = tty->termios;
1464                 tty->driver->termios[idx] = NULL;
1465                 kfree(tp);
1466         }
1467 }
1468 EXPORT_SYMBOL(tty_free_termios);
1469
1470 void tty_shutdown(struct tty_struct *tty)
1471 {
1472         tty_driver_remove_tty(tty->driver, tty);
1473         tty_free_termios(tty);
1474 }
1475 EXPORT_SYMBOL(tty_shutdown);
1476
1477 /**
1478  *      release_one_tty         -       release tty structure memory
1479  *      @kref: kref of tty we are obliterating
1480  *
1481  *      Releases memory associated with a tty structure, and clears out the
1482  *      driver table slots. This function is called when a device is no longer
1483  *      in use. It also gets called when setup of a device fails.
1484  *
1485  *      Locking:
1486  *              tty_mutex - sometimes only
1487  *              takes the file list lock internally when working on the list
1488  *      of ttys that the driver keeps.
1489  *
1490  *      This method gets called from a work queue so that the driver private
1491  *      cleanup ops can sleep (needed for USB at least)
1492  */
1493 static void release_one_tty(struct work_struct *work)
1494 {
1495         struct tty_struct *tty =
1496                 container_of(work, struct tty_struct, hangup_work);
1497         struct tty_driver *driver = tty->driver;
1498
1499         if (tty->ops->cleanup)
1500                 tty->ops->cleanup(tty);
1501
1502         tty->magic = 0;
1503         tty_driver_kref_put(driver);
1504         module_put(driver->owner);
1505
1506         spin_lock(&tty_files_lock);
1507         list_del_init(&tty->tty_files);
1508         spin_unlock(&tty_files_lock);
1509
1510         put_pid(tty->pgrp);
1511         put_pid(tty->session);
1512         free_tty_struct(tty);
1513 }
1514
1515 static void queue_release_one_tty(struct kref *kref)
1516 {
1517         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1518
1519         if (tty->ops->shutdown)
1520                 tty->ops->shutdown(tty);
1521         else
1522                 tty_shutdown(tty);
1523
1524         /* The hangup queue is now free so we can reuse it rather than
1525            waste a chunk of memory for each port */
1526         INIT_WORK(&tty->hangup_work, release_one_tty);
1527         schedule_work(&tty->hangup_work);
1528 }
1529
1530 /**
1531  *      tty_kref_put            -       release a tty kref
1532  *      @tty: tty device
1533  *
1534  *      Release a reference to a tty device and if need be let the kref
1535  *      layer destruct the object for us
1536  */
1537
1538 void tty_kref_put(struct tty_struct *tty)
1539 {
1540         if (tty)
1541                 kref_put(&tty->kref, queue_release_one_tty);
1542 }
1543 EXPORT_SYMBOL(tty_kref_put);
1544
1545 /**
1546  *      release_tty             -       release tty structure memory
1547  *
1548  *      Release both @tty and a possible linked partner (think pty pair),
1549  *      and decrement the refcount of the backing module.
1550  *
1551  *      Locking:
1552  *              tty_mutex - sometimes only
1553  *              takes the file list lock internally when working on the list
1554  *      of ttys that the driver keeps.
1555  *              FIXME: should we require tty_mutex is held here ??
1556  *
1557  */
1558 static void release_tty(struct tty_struct *tty, int idx)
1559 {
1560         /* This should always be true but check for the moment */
1561         WARN_ON(tty->index != idx);
1562
1563         if (tty->link)
1564                 tty_kref_put(tty->link);
1565         tty_kref_put(tty);
1566 }
1567
1568 /**
1569  *      tty_release             -       vfs callback for close
1570  *      @inode: inode of tty
1571  *      @filp: file pointer for handle to tty
1572  *
1573  *      Called the last time each file handle is closed that references
1574  *      this tty. There may however be several such references.
1575  *
1576  *      Locking:
1577  *              Takes bkl. See tty_release_dev
1578  *
1579  * Even releasing the tty structures is a tricky business.. We have
1580  * to be very careful that the structures are all released at the
1581  * same time, as interrupts might otherwise get the wrong pointers.
1582  *
1583  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1584  * lead to double frees or releasing memory still in use.
1585  */
1586
1587 int tty_release(struct inode *inode, struct file *filp)
1588 {
1589         struct tty_struct *tty = file_tty(filp);
1590         struct tty_struct *o_tty;
1591         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1592         int     devpts;
1593         int     idx;
1594         char    buf[64];
1595         long    timeout = 0;
1596
1597         if (tty_paranoia_check(tty, inode, "tty_release_dev"))
1598                 return 0;
1599
1600         tty_lock();
1601         check_tty_count(tty, "tty_release_dev");
1602
1603         __tty_fasync(-1, filp, 0);
1604
1605         idx = tty->index;
1606         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1607                       tty->driver->subtype == PTY_TYPE_MASTER);
1608         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1609         o_tty = tty->link;
1610
1611 #ifdef TTY_PARANOIA_CHECK
1612         if (idx < 0 || idx >= tty->driver->num) {
1613                 printk(KERN_DEBUG "tty_release_dev: bad idx when trying to "
1614                                   "free (%s)\n", tty->name);
1615                 tty_unlock();
1616                 return 0;
1617         }
1618         if (!devpts) {
1619                 if (tty != tty->driver->ttys[idx]) {
1620                         tty_unlock();
1621                         printk(KERN_DEBUG "tty_release_dev: driver.table[%d] not tty "
1622                                "for (%s)\n", idx, tty->name);
1623                         return 0;
1624                 }
1625                 if (tty->termios != tty->driver->termios[idx]) {
1626                         tty_unlock();
1627                         printk(KERN_DEBUG "tty_release_dev: driver.termios[%d] not termios "
1628                                "for (%s)\n",
1629                                idx, tty->name);
1630                         return 0;
1631                 }
1632         }
1633 #endif
1634
1635 #ifdef TTY_DEBUG_HANGUP
1636         printk(KERN_DEBUG "tty_release_dev of %s (tty count=%d)...",
1637                tty_name(tty, buf), tty->count);
1638 #endif
1639
1640 #ifdef TTY_PARANOIA_CHECK
1641         if (tty->driver->other &&
1642              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1643                 if (o_tty != tty->driver->other->ttys[idx]) {
1644                         tty_unlock();
1645                         printk(KERN_DEBUG "tty_release_dev: other->table[%d] "
1646                                           "not o_tty for (%s)\n",
1647                                idx, tty->name);
1648                         return 0 ;
1649                 }
1650                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1651                         tty_unlock();
1652                         printk(KERN_DEBUG "tty_release_dev: other->termios[%d] "
1653                                           "not o_termios for (%s)\n",
1654                                idx, tty->name);
1655                         return 0;
1656                 }
1657                 if (o_tty->link != tty) {
1658                         tty_unlock();
1659                         printk(KERN_DEBUG "tty_release_dev: bad pty pointers\n");
1660                         return 0;
1661                 }
1662         }
1663 #endif
1664         if (tty->ops->close)
1665                 tty->ops->close(tty, filp);
1666
1667         tty_unlock();
1668         /*
1669          * Sanity check: if tty->count is going to zero, there shouldn't be
1670          * any waiters on tty->read_wait or tty->write_wait.  We test the
1671          * wait queues and kick everyone out _before_ actually starting to
1672          * close.  This ensures that we won't block while releasing the tty
1673          * structure.
1674          *
1675          * The test for the o_tty closing is necessary, since the master and
1676          * slave sides may close in any order.  If the slave side closes out
1677          * first, its count will be one, since the master side holds an open.
1678          * Thus this test wouldn't be triggered at the time the slave closes,
1679          * so we do it now.
1680          *
1681          * Note that it's possible for the tty to be opened again while we're
1682          * flushing out waiters.  By recalculating the closing flags before
1683          * each iteration we avoid any problems.
1684          */
1685         while (1) {
1686                 /* Guard against races with tty->count changes elsewhere and
1687                    opens on /dev/tty */
1688
1689                 mutex_lock(&tty_mutex);
1690                 tty_lock();
1691                 tty_closing = tty->count <= 1;
1692                 o_tty_closing = o_tty &&
1693                         (o_tty->count <= (pty_master ? 1 : 0));
1694                 do_sleep = 0;
1695
1696                 if (tty_closing) {
1697                         if (waitqueue_active(&tty->read_wait)) {
1698                                 wake_up_poll(&tty->read_wait, POLLIN);
1699                                 do_sleep++;
1700                         }
1701                         if (waitqueue_active(&tty->write_wait)) {
1702                                 wake_up_poll(&tty->write_wait, POLLOUT);
1703                                 do_sleep++;
1704                         }
1705                 }
1706                 if (o_tty_closing) {
1707                         if (waitqueue_active(&o_tty->read_wait)) {
1708                                 wake_up_poll(&o_tty->read_wait, POLLIN);
1709                                 do_sleep++;
1710                         }
1711                         if (waitqueue_active(&o_tty->write_wait)) {
1712                                 wake_up_poll(&o_tty->write_wait, POLLOUT);
1713                                 do_sleep++;
1714                         }
1715                 }
1716                 if (!do_sleep)
1717                         break;
1718
1719                 printk(KERN_WARNING "tty_release_dev: %s: read/write wait queue "
1720                                     "active!\n", tty_name(tty, buf));
1721                 tty_unlock();
1722                 mutex_unlock(&tty_mutex);
1723                 schedule_timeout_killable(timeout);
1724                 if (timeout < 120 * HZ)
1725                         timeout = 2 * timeout + 1;
1726                 else
1727                         timeout = MAX_SCHEDULE_TIMEOUT;
1728         }
1729
1730         /*
1731          * The closing flags are now consistent with the open counts on
1732          * both sides, and we've completed the last operation that could
1733          * block, so it's safe to proceed with closing.
1734          */
1735         if (pty_master) {
1736                 if (--o_tty->count < 0) {
1737                         printk(KERN_WARNING "tty_release_dev: bad pty slave count "
1738                                             "(%d) for %s\n",
1739                                o_tty->count, tty_name(o_tty, buf));
1740                         o_tty->count = 0;
1741                 }
1742         }
1743         if (--tty->count < 0) {
1744                 printk(KERN_WARNING "tty_release_dev: bad tty->count (%d) for %s\n",
1745                        tty->count, tty_name(tty, buf));
1746                 tty->count = 0;
1747         }
1748
1749         /*
1750          * We've decremented tty->count, so we need to remove this file
1751          * descriptor off the tty->tty_files list; this serves two
1752          * purposes:
1753          *  - check_tty_count sees the correct number of file descriptors
1754          *    associated with this tty.
1755          *  - do_tty_hangup no longer sees this file descriptor as
1756          *    something that needs to be handled for hangups.
1757          */
1758         tty_del_file(filp);
1759
1760         /*
1761          * Perform some housekeeping before deciding whether to return.
1762          *
1763          * Set the TTY_CLOSING flag if this was the last open.  In the
1764          * case of a pty we may have to wait around for the other side
1765          * to close, and TTY_CLOSING makes sure we can't be reopened.
1766          */
1767         if (tty_closing)
1768                 set_bit(TTY_CLOSING, &tty->flags);
1769         if (o_tty_closing)
1770                 set_bit(TTY_CLOSING, &o_tty->flags);
1771
1772         /*
1773          * If _either_ side is closing, make sure there aren't any
1774          * processes that still think tty or o_tty is their controlling
1775          * tty.
1776          */
1777         if (tty_closing || o_tty_closing) {
1778                 read_lock(&tasklist_lock);
1779                 session_clear_tty(tty->session);
1780                 if (o_tty)
1781                         session_clear_tty(o_tty->session);
1782                 read_unlock(&tasklist_lock);
1783         }
1784
1785         mutex_unlock(&tty_mutex);
1786
1787         /* check whether both sides are closing ... */
1788         if (!tty_closing || (o_tty && !o_tty_closing)) {
1789                 tty_unlock();
1790                 return 0;
1791         }
1792
1793 #ifdef TTY_DEBUG_HANGUP
1794         printk(KERN_DEBUG "freeing tty structure...");
1795 #endif
1796         /*
1797          * Ask the line discipline code to release its structures
1798          */
1799         tty_ldisc_release(tty, o_tty);
1800         /*
1801          * The release_tty function takes care of the details of clearing
1802          * the slots and preserving the termios structure.
1803          */
1804         release_tty(tty, idx);
1805
1806         /* Make this pty number available for reallocation */
1807         if (devpts)
1808                 devpts_kill_index(inode, idx);
1809         tty_unlock();
1810         return 0;
1811 }
1812
1813 /**
1814  *      tty_open                -       open a tty device
1815  *      @inode: inode of device file
1816  *      @filp: file pointer to tty
1817  *
1818  *      tty_open and tty_release keep up the tty count that contains the
1819  *      number of opens done on a tty. We cannot use the inode-count, as
1820  *      different inodes might point to the same tty.
1821  *
1822  *      Open-counting is needed for pty masters, as well as for keeping
1823  *      track of serial lines: DTR is dropped when the last close happens.
1824  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
1825  *
1826  *      The termios state of a pty is reset on first open so that
1827  *      settings don't persist across reuse.
1828  *
1829  *      Locking: tty_mutex protects tty, get_tty_driver and tty_init_dev work.
1830  *               tty->count should protect the rest.
1831  *               ->siglock protects ->signal/->sighand
1832  */
1833
1834 static int tty_open(struct inode *inode, struct file *filp)
1835 {
1836         struct tty_struct *tty = NULL;
1837         int noctty, retval;
1838         struct tty_driver *driver;
1839         int index;
1840         dev_t device = inode->i_rdev;
1841         unsigned saved_flags = filp->f_flags;
1842
1843         nonseekable_open(inode, filp);
1844
1845 retry_open:
1846         retval = tty_alloc_file(filp);
1847         if (retval)
1848                 return -ENOMEM;
1849
1850         noctty = filp->f_flags & O_NOCTTY;
1851         index  = -1;
1852         retval = 0;
1853
1854         mutex_lock(&tty_mutex);
1855         tty_lock();
1856
1857         if (device == MKDEV(TTYAUX_MAJOR, 0)) {
1858                 tty = get_current_tty();
1859                 if (!tty) {
1860                         tty_unlock();
1861                         mutex_unlock(&tty_mutex);
1862                         tty_free_file(filp);
1863                         return -ENXIO;
1864                 }
1865                 driver = tty_driver_kref_get(tty->driver);
1866                 index = tty->index;
1867                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1868                 /* noctty = 1; */
1869                 /* FIXME: Should we take a driver reference ? */
1870                 tty_kref_put(tty);
1871                 goto got_driver;
1872         }
1873 #ifdef CONFIG_VT
1874         if (device == MKDEV(TTY_MAJOR, 0)) {
1875                 extern struct tty_driver *console_driver;
1876                 driver = tty_driver_kref_get(console_driver);
1877                 index = fg_console;
1878                 noctty = 1;
1879                 goto got_driver;
1880         }
1881 #endif
1882         if (device == MKDEV(TTYAUX_MAJOR, 1)) {
1883                 struct tty_driver *console_driver = console_device(&index);
1884                 if (console_driver) {
1885                         driver = tty_driver_kref_get(console_driver);
1886                         if (driver) {
1887                                 /* Don't let /dev/console block */
1888                                 filp->f_flags |= O_NONBLOCK;
1889                                 noctty = 1;
1890                                 goto got_driver;
1891                         }
1892                 }
1893                 tty_unlock();
1894                 mutex_unlock(&tty_mutex);
1895                 tty_free_file(filp);
1896                 return -ENODEV;
1897         }
1898
1899         driver = get_tty_driver(device, &index);
1900         if (!driver) {
1901                 tty_unlock();
1902                 mutex_unlock(&tty_mutex);
1903                 tty_free_file(filp);
1904                 return -ENODEV;
1905         }
1906 got_driver:
1907         if (!tty) {
1908                 /* check whether we're reopening an existing tty */
1909                 tty = tty_driver_lookup_tty(driver, inode, index);
1910
1911                 if (IS_ERR(tty)) {
1912                         tty_unlock();
1913                         mutex_unlock(&tty_mutex);
1914                         tty_driver_kref_put(driver);
1915                         tty_free_file(filp);
1916                         return PTR_ERR(tty);
1917                 }
1918         }
1919
1920         if (tty) {
1921                 retval = tty_reopen(tty);
1922                 if (retval)
1923                         tty = ERR_PTR(retval);
1924         } else
1925                 tty = tty_init_dev(driver, index, 0);
1926
1927         mutex_unlock(&tty_mutex);
1928         tty_driver_kref_put(driver);
1929         if (IS_ERR(tty)) {
1930                 tty_unlock();
1931                 tty_free_file(filp);
1932                 return PTR_ERR(tty);
1933         }
1934
1935         tty_add_file(tty, filp);
1936
1937         check_tty_count(tty, "tty_open");
1938         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1939             tty->driver->subtype == PTY_TYPE_MASTER)
1940                 noctty = 1;
1941 #ifdef TTY_DEBUG_HANGUP
1942         printk(KERN_DEBUG "opening %s...", tty->name);
1943 #endif
1944         if (tty->ops->open)
1945                 retval = tty->ops->open(tty, filp);
1946         else
1947                 retval = -ENODEV;
1948         filp->f_flags = saved_flags;
1949
1950         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
1951                                                 !capable(CAP_SYS_ADMIN))
1952                 retval = -EBUSY;
1953
1954         if (retval) {
1955 #ifdef TTY_DEBUG_HANGUP
1956                 printk(KERN_DEBUG "error %d in opening %s...", retval,
1957                        tty->name);
1958 #endif
1959                 tty_unlock(); /* need to call tty_release without BTM */
1960                 tty_release(inode, filp);
1961                 if (retval != -ERESTARTSYS)
1962                         return retval;
1963
1964                 if (signal_pending(current))
1965                         return retval;
1966
1967                 schedule();
1968                 /*
1969                  * Need to reset f_op in case a hangup happened.
1970                  */
1971                 tty_lock();
1972                 if (filp->f_op == &hung_up_tty_fops)
1973                         filp->f_op = &tty_fops;
1974                 tty_unlock();
1975                 goto retry_open;
1976         }
1977         tty_unlock();
1978
1979
1980         mutex_lock(&tty_mutex);
1981         tty_lock();
1982         spin_lock_irq(&current->sighand->siglock);
1983         if (!noctty &&
1984             current->signal->leader &&
1985             !current->signal->tty &&
1986             tty->session == NULL) {
1987                 /*
1988                  * Don't let a process that only has write access to the tty
1989                  * obtain the privileges associated with having a tty as
1990                  * controlling terminal (being able to reopen it with full
1991                  * access through /dev/tty, being able to perform pushback).
1992                  * Many distributions set the group of all ttys to "tty" and
1993                  * grant write-only access to all terminals for setgid tty
1994                  * binaries, which should not imply full privileges on all ttys.
1995                  *
1996                  * This could theoretically break old code that performs open()
1997                  * on a write-only file descriptor. In that case, it might be
1998                  * necessary to also permit this if
1999                  * inode_permission(inode, MAY_READ) == 0.
2000                  */
2001                 if (filp->f_mode & FMODE_READ)
2002                         __proc_set_tty(current, tty);
2003         }
2004         spin_unlock_irq(&current->sighand->siglock);
2005         tty_unlock();
2006         mutex_unlock(&tty_mutex);
2007         return 0;
2008 }
2009
2010
2011
2012 /**
2013  *      tty_poll        -       check tty status
2014  *      @filp: file being polled
2015  *      @wait: poll wait structures to update
2016  *
2017  *      Call the line discipline polling method to obtain the poll
2018  *      status of the device.
2019  *
2020  *      Locking: locks called line discipline but ldisc poll method
2021  *      may be re-entered freely by other callers.
2022  */
2023
2024 static unsigned int tty_poll(struct file *filp, poll_table *wait)
2025 {
2026         struct tty_struct *tty = file_tty(filp);
2027         struct tty_ldisc *ld;
2028         int ret = 0;
2029
2030         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2031                 return 0;
2032
2033         ld = tty_ldisc_ref_wait(tty);
2034         if (ld->ops->poll)
2035                 ret = (ld->ops->poll)(tty, filp, wait);
2036         tty_ldisc_deref(ld);
2037         return ret;
2038 }
2039
2040 static int __tty_fasync(int fd, struct file *filp, int on)
2041 {
2042         struct tty_struct *tty = file_tty(filp);
2043         unsigned long flags;
2044         int retval = 0;
2045
2046         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2047                 goto out;
2048
2049         retval = fasync_helper(fd, filp, on, &tty->fasync);
2050         if (retval <= 0)
2051                 goto out;
2052
2053         if (on) {
2054                 enum pid_type type;
2055                 struct pid *pid;
2056                 if (!waitqueue_active(&tty->read_wait))
2057                         tty->minimum_to_wake = 1;
2058                 spin_lock_irqsave(&tty->ctrl_lock, flags);
2059                 if (tty->pgrp) {
2060                         pid = tty->pgrp;
2061                         type = PIDTYPE_PGID;
2062                 } else {
2063                         pid = task_pid(current);
2064                         type = PIDTYPE_PID;
2065                 }
2066                 get_pid(pid);
2067                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2068                 retval = __f_setown(filp, pid, type, 0);
2069                 put_pid(pid);
2070                 if (retval)
2071                         goto out;
2072         } else {
2073                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2074                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2075         }
2076         retval = 0;
2077 out:
2078         return retval;
2079 }
2080
2081 static int tty_fasync(int fd, struct file *filp, int on)
2082 {
2083         int retval;
2084         tty_lock();
2085         retval = __tty_fasync(fd, filp, on);
2086         tty_unlock();
2087         return retval;
2088 }
2089
2090 /**
2091  *      tiocsti                 -       fake input character
2092  *      @tty: tty to fake input into
2093  *      @p: pointer to character
2094  *
2095  *      Fake input to a tty device. Does the necessary locking and
2096  *      input management.
2097  *
2098  *      FIXME: does not honour flow control ??
2099  *
2100  *      Locking:
2101  *              Called functions take tty_ldisc_lock
2102  *              current->signal->tty check is safe without locks
2103  *
2104  *      FIXME: may race normal receive processing
2105  */
2106
2107 static int tiocsti(struct tty_struct *tty, char __user *p)
2108 {
2109         char ch, mbz = 0;
2110         struct tty_ldisc *ld;
2111
2112         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2113                 return -EPERM;
2114         if (get_user(ch, p))
2115                 return -EFAULT;
2116         tty_audit_tiocsti(tty, ch);
2117         ld = tty_ldisc_ref_wait(tty);
2118         ld->ops->receive_buf(tty, &ch, &mbz, 1);
2119         tty_ldisc_deref(ld);
2120         return 0;
2121 }
2122
2123 /**
2124  *      tiocgwinsz              -       implement window query ioctl
2125  *      @tty; tty
2126  *      @arg: user buffer for result
2127  *
2128  *      Copies the kernel idea of the window size into the user buffer.
2129  *
2130  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2131  *              is consistent.
2132  */
2133
2134 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2135 {
2136         int err;
2137
2138         mutex_lock(&tty->termios_mutex);
2139         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2140         mutex_unlock(&tty->termios_mutex);
2141
2142         return err ? -EFAULT: 0;
2143 }
2144
2145 /**
2146  *      tty_do_resize           -       resize event
2147  *      @tty: tty being resized
2148  *      @rows: rows (character)
2149  *      @cols: cols (character)
2150  *
2151  *      Update the termios variables and send the necessary signals to
2152  *      peform a terminal resize correctly
2153  */
2154
2155 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2156 {
2157         struct pid *pgrp;
2158         unsigned long flags;
2159
2160         /* Lock the tty */
2161         mutex_lock(&tty->termios_mutex);
2162         if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2163                 goto done;
2164         /* Get the PID values and reference them so we can
2165            avoid holding the tty ctrl lock while sending signals */
2166         spin_lock_irqsave(&tty->ctrl_lock, flags);
2167         pgrp = get_pid(tty->pgrp);
2168         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2169
2170         if (pgrp)
2171                 kill_pgrp(pgrp, SIGWINCH, 1);
2172         put_pid(pgrp);
2173
2174         tty->winsize = *ws;
2175 done:
2176         mutex_unlock(&tty->termios_mutex);
2177         return 0;
2178 }
2179
2180 /**
2181  *      tiocswinsz              -       implement window size set ioctl
2182  *      @tty; tty side of tty
2183  *      @arg: user buffer for result
2184  *
2185  *      Copies the user idea of the window size to the kernel. Traditionally
2186  *      this is just advisory information but for the Linux console it
2187  *      actually has driver level meaning and triggers a VC resize.
2188  *
2189  *      Locking:
2190  *              Driver dependent. The default do_resize method takes the
2191  *      tty termios mutex and ctrl_lock. The console takes its own lock
2192  *      then calls into the default method.
2193  */
2194
2195 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2196 {
2197         struct winsize tmp_ws;
2198         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2199                 return -EFAULT;
2200
2201         if (tty->ops->resize)
2202                 return tty->ops->resize(tty, &tmp_ws);
2203         else
2204                 return tty_do_resize(tty, &tmp_ws);
2205 }
2206
2207 /**
2208  *      tioccons        -       allow admin to move logical console
2209  *      @file: the file to become console
2210  *
2211  *      Allow the administrator to move the redirected console device
2212  *
2213  *      Locking: uses redirect_lock to guard the redirect information
2214  */
2215
2216 static int tioccons(struct file *file)
2217 {
2218         if (!capable(CAP_SYS_ADMIN))
2219                 return -EPERM;
2220         if (file->f_op->write == redirected_tty_write) {
2221                 struct file *f;
2222                 spin_lock(&redirect_lock);
2223                 f = redirect;
2224                 redirect = NULL;
2225                 spin_unlock(&redirect_lock);
2226                 if (f)
2227                         fput(f);
2228                 return 0;
2229         }
2230         spin_lock(&redirect_lock);
2231         if (redirect) {
2232                 spin_unlock(&redirect_lock);
2233                 return -EBUSY;
2234         }
2235         redirect = get_file(file);
2236         spin_unlock(&redirect_lock);
2237         return 0;
2238 }
2239
2240 /**
2241  *      fionbio         -       non blocking ioctl
2242  *      @file: file to set blocking value
2243  *      @p: user parameter
2244  *
2245  *      Historical tty interfaces had a blocking control ioctl before
2246  *      the generic functionality existed. This piece of history is preserved
2247  *      in the expected tty API of posix OS's.
2248  *
2249  *      Locking: none, the open file handle ensures it won't go away.
2250  */
2251
2252 static int fionbio(struct file *file, int __user *p)
2253 {
2254         int nonblock;
2255
2256         if (get_user(nonblock, p))
2257                 return -EFAULT;
2258
2259         spin_lock(&file->f_lock);
2260         if (nonblock)
2261                 file->f_flags |= O_NONBLOCK;
2262         else
2263                 file->f_flags &= ~O_NONBLOCK;
2264         spin_unlock(&file->f_lock);
2265         return 0;
2266 }
2267
2268 /**
2269  *      tiocsctty       -       set controlling tty
2270  *      @tty: tty structure
2271  *      @arg: user argument
2272  *
2273  *      This ioctl is used to manage job control. It permits a session
2274  *      leader to set this tty as the controlling tty for the session.
2275  *
2276  *      Locking:
2277  *              Takes tty_mutex() to protect tty instance
2278  *              Takes tasklist_lock internally to walk sessions
2279  *              Takes ->siglock() when updating signal->tty
2280  */
2281
2282 static int tiocsctty(struct tty_struct *tty, struct file *file, int arg)
2283 {
2284         int ret = 0;
2285         if (current->signal->leader && (task_session(current) == tty->session))
2286                 return ret;
2287
2288         mutex_lock(&tty_mutex);
2289         /*
2290          * The process must be a session leader and
2291          * not have a controlling tty already.
2292          */
2293         if (!current->signal->leader || current->signal->tty) {
2294                 ret = -EPERM;
2295                 goto unlock;
2296         }
2297
2298         if (tty->session) {
2299                 /*
2300                  * This tty is already the controlling
2301                  * tty for another session group!
2302                  */
2303                 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2304                         /*
2305                          * Steal it away
2306                          */
2307                         read_lock(&tasklist_lock);
2308                         session_clear_tty(tty->session);
2309                         read_unlock(&tasklist_lock);
2310                 } else {
2311                         ret = -EPERM;
2312                         goto unlock;
2313                 }
2314         }
2315
2316         /* See the comment in tty_open(). */
2317         if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) {
2318                 ret = -EPERM;
2319                 goto unlock;
2320         }
2321
2322         proc_set_tty(current, tty);
2323 unlock:
2324         mutex_unlock(&tty_mutex);
2325         return ret;
2326 }
2327
2328 /**
2329  *      tty_get_pgrp    -       return a ref counted pgrp pid
2330  *      @tty: tty to read
2331  *
2332  *      Returns a refcounted instance of the pid struct for the process
2333  *      group controlling the tty.
2334  */
2335
2336 struct pid *tty_get_pgrp(struct tty_struct *tty)
2337 {
2338         unsigned long flags;
2339         struct pid *pgrp;
2340
2341         spin_lock_irqsave(&tty->ctrl_lock, flags);
2342         pgrp = get_pid(tty->pgrp);
2343         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2344
2345         return pgrp;
2346 }
2347 EXPORT_SYMBOL_GPL(tty_get_pgrp);
2348
2349 /**
2350  *      tiocgpgrp               -       get process group
2351  *      @tty: tty passed by user
2352  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2353  *      @p: returned pid
2354  *
2355  *      Obtain the process group of the tty. If there is no process group
2356  *      return an error.
2357  *
2358  *      Locking: none. Reference to current->signal->tty is safe.
2359  */
2360
2361 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2362 {
2363         struct pid *pid;
2364         int ret;
2365         /*
2366          * (tty == real_tty) is a cheap way of
2367          * testing if the tty is NOT a master pty.
2368          */
2369         if (tty == real_tty && current->signal->tty != real_tty)
2370                 return -ENOTTY;
2371         pid = tty_get_pgrp(real_tty);
2372         ret =  put_user(pid_vnr(pid), p);
2373         put_pid(pid);
2374         return ret;
2375 }
2376
2377 /**
2378  *      tiocspgrp               -       attempt to set process group
2379  *      @tty: tty passed by user
2380  *      @real_tty: tty side device matching tty passed by user
2381  *      @p: pid pointer
2382  *
2383  *      Set the process group of the tty to the session passed. Only
2384  *      permitted where the tty session is our session.
2385  *
2386  *      Locking: RCU, ctrl lock
2387  */
2388
2389 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2390 {
2391         struct pid *pgrp;
2392         pid_t pgrp_nr;
2393         int retval = tty_check_change(real_tty);
2394         unsigned long flags;
2395
2396         if (retval == -EIO)
2397                 return -ENOTTY;
2398         if (retval)
2399                 return retval;
2400         if (!current->signal->tty ||
2401             (current->signal->tty != real_tty) ||
2402             (real_tty->session != task_session(current)))
2403                 return -ENOTTY;
2404         if (get_user(pgrp_nr, p))
2405                 return -EFAULT;
2406         if (pgrp_nr < 0)
2407                 return -EINVAL;
2408         rcu_read_lock();
2409         pgrp = find_vpid(pgrp_nr);
2410         retval = -ESRCH;
2411         if (!pgrp)
2412                 goto out_unlock;
2413         retval = -EPERM;
2414         if (session_of_pgrp(pgrp) != task_session(current))
2415                 goto out_unlock;
2416         retval = 0;
2417         spin_lock_irqsave(&tty->ctrl_lock, flags);
2418         put_pid(real_tty->pgrp);
2419         real_tty->pgrp = get_pid(pgrp);
2420         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2421 out_unlock:
2422         rcu_read_unlock();
2423         return retval;
2424 }
2425
2426 /**
2427  *      tiocgsid                -       get session id
2428  *      @tty: tty passed by user
2429  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2430  *      @p: pointer to returned session id
2431  *
2432  *      Obtain the session id of the tty. If there is no session
2433  *      return an error.
2434  *
2435  *      Locking: none. Reference to current->signal->tty is safe.
2436  */
2437
2438 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2439 {
2440         /*
2441          * (tty == real_tty) is a cheap way of
2442          * testing if the tty is NOT a master pty.
2443         */
2444         if (tty == real_tty && current->signal->tty != real_tty)
2445                 return -ENOTTY;
2446         if (!real_tty->session)
2447                 return -ENOTTY;
2448         return put_user(pid_vnr(real_tty->session), p);
2449 }
2450
2451 /**
2452  *      tiocsetd        -       set line discipline
2453  *      @tty: tty device
2454  *      @p: pointer to user data
2455  *
2456  *      Set the line discipline according to user request.
2457  *
2458  *      Locking: see tty_set_ldisc, this function is just a helper
2459  */
2460
2461 static int tiocsetd(struct tty_struct *tty, int __user *p)
2462 {
2463         int ldisc;
2464         int ret;
2465
2466         if (get_user(ldisc, p))
2467                 return -EFAULT;
2468
2469         ret = tty_set_ldisc(tty, ldisc);
2470
2471         return ret;
2472 }
2473
2474 /**
2475  *      tiocgetd        -       get line discipline
2476  *      @tty: tty device
2477  *      @p: pointer to user data
2478  *
2479  *      Retrieves the line discipline id directly from the ldisc.
2480  *
2481  *      Locking: waits for ldisc reference (in case the line discipline
2482  *              is changing or the tty is being hungup)
2483  */
2484
2485 static int tiocgetd(struct tty_struct *tty, int __user *p)
2486 {
2487         struct tty_ldisc *ld;
2488         int ret;
2489
2490         ld = tty_ldisc_ref_wait(tty);
2491         ret = put_user(ld->ops->num, p);
2492         tty_ldisc_deref(ld);
2493         return ret;
2494 }
2495
2496 /**
2497  *      send_break      -       performed time break
2498  *      @tty: device to break on
2499  *      @duration: timeout in mS
2500  *
2501  *      Perform a timed break on hardware that lacks its own driver level
2502  *      timed break functionality.
2503  *
2504  *      Locking:
2505  *              atomic_write_lock serializes
2506  *
2507  */
2508
2509 static int send_break(struct tty_struct *tty, unsigned int duration)
2510 {
2511         int retval;
2512
2513         if (tty->ops->break_ctl == NULL)
2514                 return 0;
2515
2516         if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2517                 retval = tty->ops->break_ctl(tty, duration);
2518         else {
2519                 /* Do the work ourselves */
2520                 if (tty_write_lock(tty, 0) < 0)
2521                         return -EINTR;
2522                 retval = tty->ops->break_ctl(tty, -1);
2523                 if (retval)
2524                         goto out;
2525                 if (!signal_pending(current))
2526                         msleep_interruptible(duration);
2527                 retval = tty->ops->break_ctl(tty, 0);
2528 out:
2529                 tty_write_unlock(tty);
2530                 if (signal_pending(current))
2531                         retval = -EINTR;
2532         }
2533         return retval;
2534 }
2535
2536 /**
2537  *      tty_tiocmget            -       get modem status
2538  *      @tty: tty device
2539  *      @file: user file pointer
2540  *      @p: pointer to result
2541  *
2542  *      Obtain the modem status bits from the tty driver if the feature
2543  *      is supported. Return -EINVAL if it is not available.
2544  *
2545  *      Locking: none (up to the driver)
2546  */
2547
2548 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2549 {
2550         int retval = -EINVAL;
2551
2552         if (tty->ops->tiocmget) {
2553                 retval = tty->ops->tiocmget(tty);
2554
2555                 if (retval >= 0)
2556                         retval = put_user(retval, p);
2557         }
2558         return retval;
2559 }
2560
2561 /**
2562  *      tty_tiocmset            -       set modem status
2563  *      @tty: tty device
2564  *      @cmd: command - clear bits, set bits or set all
2565  *      @p: pointer to desired bits
2566  *
2567  *      Set the modem status bits from the tty driver if the feature
2568  *      is supported. Return -EINVAL if it is not available.
2569  *
2570  *      Locking: none (up to the driver)
2571  */
2572
2573 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2574              unsigned __user *p)
2575 {
2576         int retval;
2577         unsigned int set, clear, val;
2578
2579         if (tty->ops->tiocmset == NULL)
2580                 return -EINVAL;
2581
2582         retval = get_user(val, p);
2583         if (retval)
2584                 return retval;
2585         set = clear = 0;
2586         switch (cmd) {
2587         case TIOCMBIS:
2588                 set = val;
2589                 break;
2590         case TIOCMBIC:
2591                 clear = val;
2592                 break;
2593         case TIOCMSET:
2594                 set = val;
2595                 clear = ~val;
2596                 break;
2597         }
2598         set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2599         clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2600         return tty->ops->tiocmset(tty, set, clear);
2601 }
2602
2603 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2604 {
2605         int retval = -EINVAL;
2606         struct serial_icounter_struct icount;
2607         memset(&icount, 0, sizeof(icount));
2608         if (tty->ops->get_icount)
2609                 retval = tty->ops->get_icount(tty, &icount);
2610         if (retval != 0)
2611                 return retval;
2612         if (copy_to_user(arg, &icount, sizeof(icount)))
2613                 return -EFAULT;
2614         return 0;
2615 }
2616
2617 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2618 {
2619         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2620             tty->driver->subtype == PTY_TYPE_MASTER)
2621                 tty = tty->link;
2622         return tty;
2623 }
2624 EXPORT_SYMBOL(tty_pair_get_tty);
2625
2626 struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2627 {
2628         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2629             tty->driver->subtype == PTY_TYPE_MASTER)
2630             return tty;
2631         return tty->link;
2632 }
2633 EXPORT_SYMBOL(tty_pair_get_pty);
2634
2635 /*
2636  * Split this up, as gcc can choke on it otherwise..
2637  */
2638 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2639 {
2640         struct tty_struct *tty = file_tty(file);
2641         struct tty_struct *real_tty;
2642         void __user *p = (void __user *)arg;
2643         int retval;
2644         struct tty_ldisc *ld;
2645         struct inode *inode = file->f_dentry->d_inode;
2646
2647         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2648                 return -EINVAL;
2649
2650         real_tty = tty_pair_get_tty(tty);
2651
2652         /*
2653          * Factor out some common prep work
2654          */
2655         switch (cmd) {
2656         case TIOCSETD:
2657         case TIOCSBRK:
2658         case TIOCCBRK:
2659         case TCSBRK:
2660         case TCSBRKP:
2661                 retval = tty_check_change(tty);
2662                 if (retval)
2663                         return retval;
2664                 if (cmd != TIOCCBRK) {
2665                         tty_wait_until_sent(tty, 0);
2666                         if (signal_pending(current))
2667                                 return -EINTR;
2668                 }
2669                 break;
2670         }
2671
2672         /*
2673          *      Now do the stuff.
2674          */
2675         switch (cmd) {
2676         case TIOCSTI:
2677                 return tiocsti(tty, p);
2678         case TIOCGWINSZ:
2679                 return tiocgwinsz(real_tty, p);
2680         case TIOCSWINSZ:
2681                 return tiocswinsz(real_tty, p);
2682         case TIOCCONS:
2683                 return real_tty != tty ? -EINVAL : tioccons(file);
2684         case FIONBIO:
2685                 return fionbio(file, p);
2686         case TIOCEXCL:
2687                 set_bit(TTY_EXCLUSIVE, &tty->flags);
2688                 return 0;
2689         case TIOCNXCL:
2690                 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2691                 return 0;
2692         case TIOCNOTTY:
2693                 if (current->signal->tty != tty)
2694                         return -ENOTTY;
2695                 no_tty();
2696                 return 0;
2697         case TIOCSCTTY:
2698                 return tiocsctty(tty, file, arg);
2699         case TIOCGPGRP:
2700                 return tiocgpgrp(tty, real_tty, p);
2701         case TIOCSPGRP:
2702                 return tiocspgrp(tty, real_tty, p);
2703         case TIOCGSID:
2704                 return tiocgsid(tty, real_tty, p);
2705         case TIOCGETD:
2706                 return tiocgetd(tty, p);
2707         case TIOCSETD:
2708                 return tiocsetd(tty, p);
2709         case TIOCVHANGUP:
2710                 if (!capable(CAP_SYS_ADMIN))
2711                         return -EPERM;
2712                 tty_vhangup(tty);
2713                 return 0;
2714         case TIOCGDEV:
2715         {
2716                 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2717                 return put_user(ret, (unsigned int __user *)p);
2718         }
2719         /*
2720          * Break handling
2721          */
2722         case TIOCSBRK:  /* Turn break on, unconditionally */
2723                 if (tty->ops->break_ctl)
2724                         return tty->ops->break_ctl(tty, -1);
2725                 return 0;
2726         case TIOCCBRK:  /* Turn break off, unconditionally */
2727                 if (tty->ops->break_ctl)
2728                         return tty->ops->break_ctl(tty, 0);
2729                 return 0;
2730         case TCSBRK:   /* SVID version: non-zero arg --> no break */
2731                 /* non-zero arg means wait for all output data
2732                  * to be sent (performed above) but don't send break.
2733                  * This is used by the tcdrain() termios function.
2734                  */
2735                 if (!arg)
2736                         return send_break(tty, 250);
2737                 return 0;
2738         case TCSBRKP:   /* support for POSIX tcsendbreak() */
2739                 return send_break(tty, arg ? arg*100 : 250);
2740
2741         case TIOCMGET:
2742                 return tty_tiocmget(tty, p);
2743         case TIOCMSET:
2744         case TIOCMBIC:
2745         case TIOCMBIS:
2746                 return tty_tiocmset(tty, cmd, p);
2747         case TIOCGICOUNT:
2748                 retval = tty_tiocgicount(tty, p);
2749                 /* For the moment allow fall through to the old method */
2750                 if (retval != -EINVAL)
2751                         return retval;
2752                 break;
2753         case TCFLSH:
2754                 switch (arg) {
2755                 case TCIFLUSH:
2756                 case TCIOFLUSH:
2757                 /* flush tty buffer and allow ldisc to process ioctl */
2758                         tty_buffer_flush(tty);
2759                         break;
2760                 }
2761                 break;
2762         }
2763         if (tty->ops->ioctl) {
2764                 retval = (tty->ops->ioctl)(tty, cmd, arg);
2765                 if (retval != -ENOIOCTLCMD)
2766                         return retval;
2767         }
2768         ld = tty_ldisc_ref_wait(tty);
2769         retval = -EINVAL;
2770         if (ld->ops->ioctl) {
2771                 retval = ld->ops->ioctl(tty, file, cmd, arg);
2772                 if (retval == -ENOIOCTLCMD)
2773                         retval = -EINVAL;
2774         }
2775         tty_ldisc_deref(ld);
2776         return retval;
2777 }
2778
2779 #ifdef CONFIG_COMPAT
2780 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2781                                 unsigned long arg)
2782 {
2783         struct inode *inode = file->f_dentry->d_inode;
2784         struct tty_struct *tty = file_tty(file);
2785         struct tty_ldisc *ld;
2786         int retval = -ENOIOCTLCMD;
2787
2788         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2789                 return -EINVAL;
2790
2791         if (tty->ops->compat_ioctl) {
2792                 retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2793                 if (retval != -ENOIOCTLCMD)
2794                         return retval;
2795         }
2796
2797         ld = tty_ldisc_ref_wait(tty);
2798         if (ld->ops->compat_ioctl)
2799                 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2800         else
2801                 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2802         tty_ldisc_deref(ld);
2803
2804         return retval;
2805 }
2806 #endif
2807
2808 /*
2809  * This implements the "Secure Attention Key" ---  the idea is to
2810  * prevent trojan horses by killing all processes associated with this
2811  * tty when the user hits the "Secure Attention Key".  Required for
2812  * super-paranoid applications --- see the Orange Book for more details.
2813  *
2814  * This code could be nicer; ideally it should send a HUP, wait a few
2815  * seconds, then send a INT, and then a KILL signal.  But you then
2816  * have to coordinate with the init process, since all processes associated
2817  * with the current tty must be dead before the new getty is allowed
2818  * to spawn.
2819  *
2820  * Now, if it would be correct ;-/ The current code has a nasty hole -
2821  * it doesn't catch files in flight. We may send the descriptor to ourselves
2822  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2823  *
2824  * Nasty bug: do_SAK is being called in interrupt context.  This can
2825  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2826  */
2827 void __do_SAK(struct tty_struct *tty)
2828 {
2829 #ifdef TTY_SOFT_SAK
2830         tty_hangup(tty);
2831 #else
2832         struct task_struct *g, *p;
2833         struct pid *session;
2834         int             i;
2835         struct file     *filp;
2836         struct fdtable *fdt;
2837
2838         if (!tty)
2839                 return;
2840         session = tty->session;
2841
2842         tty_ldisc_flush(tty);
2843
2844         tty_driver_flush_buffer(tty);
2845
2846         read_lock(&tasklist_lock);
2847         /* Kill the entire session */
2848         do_each_pid_task(session, PIDTYPE_SID, p) {
2849                 printk(KERN_NOTICE "SAK: killed process %d"
2850                         " (%s): task_session(p)==tty->session\n",
2851                         task_pid_nr(p), p->comm);
2852                 send_sig(SIGKILL, p, 1);
2853         } while_each_pid_task(session, PIDTYPE_SID, p);
2854         /* Now kill any processes that happen to have the
2855          * tty open.
2856          */
2857         do_each_thread(g, p) {
2858                 if (p->signal->tty == tty) {
2859                         printk(KERN_NOTICE "SAK: killed process %d"
2860                             " (%s): task_session(p)==tty->session\n",
2861                             task_pid_nr(p), p->comm);
2862                         send_sig(SIGKILL, p, 1);
2863                         continue;
2864                 }
2865                 task_lock(p);
2866                 if (p->files) {
2867                         /*
2868                          * We don't take a ref to the file, so we must
2869                          * hold ->file_lock instead.
2870                          */
2871                         spin_lock(&p->files->file_lock);
2872                         fdt = files_fdtable(p->files);
2873                         for (i = 0; i < fdt->max_fds; i++) {
2874                                 filp = fcheck_files(p->files, i);
2875                                 if (!filp)
2876                                         continue;
2877                                 if (filp->f_op->read == tty_read &&
2878                                     file_tty(filp) == tty) {
2879                                         printk(KERN_NOTICE "SAK: killed process %d"
2880                                             " (%s): fd#%d opened to the tty\n",
2881                                             task_pid_nr(p), p->comm, i);
2882                                         force_sig(SIGKILL, p);
2883                                         break;
2884                                 }
2885                         }
2886                         spin_unlock(&p->files->file_lock);
2887                 }
2888                 task_unlock(p);
2889         } while_each_thread(g, p);
2890         read_unlock(&tasklist_lock);
2891 #endif
2892 }
2893
2894 static void do_SAK_work(struct work_struct *work)
2895 {
2896         struct tty_struct *tty =
2897                 container_of(work, struct tty_struct, SAK_work);
2898         __do_SAK(tty);
2899 }
2900
2901 /*
2902  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2903  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2904  * the values which we write to it will be identical to the values which it
2905  * already has. --akpm
2906  */
2907 void do_SAK(struct tty_struct *tty)
2908 {
2909         if (!tty)
2910                 return;
2911         schedule_work(&tty->SAK_work);
2912 }
2913
2914 EXPORT_SYMBOL(do_SAK);
2915
2916 static int dev_match_devt(struct device *dev, void *data)
2917 {
2918         dev_t *devt = data;
2919         return dev->devt == *devt;
2920 }
2921
2922 /* Must put_device() after it's unused! */
2923 static struct device *tty_get_device(struct tty_struct *tty)
2924 {
2925         dev_t devt = tty_devnum(tty);
2926         return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2927 }
2928
2929
2930 /**
2931  *      initialize_tty_struct
2932  *      @tty: tty to initialize
2933  *
2934  *      This subroutine initializes a tty structure that has been newly
2935  *      allocated.
2936  *
2937  *      Locking: none - tty in question must not be exposed at this point
2938  */
2939
2940 void initialize_tty_struct(struct tty_struct *tty,
2941                 struct tty_driver *driver, int idx)
2942 {
2943         memset(tty, 0, sizeof(struct tty_struct));
2944         kref_init(&tty->kref);
2945         tty->magic = TTY_MAGIC;
2946         tty_ldisc_init(tty);
2947         tty->session = NULL;
2948         tty->pgrp = NULL;
2949         tty->overrun_time = jiffies;
2950         tty->buf.head = tty->buf.tail = NULL;
2951         tty_buffer_init(tty);
2952         mutex_init(&tty->termios_mutex);
2953         mutex_init(&tty->ldisc_mutex);
2954         init_waitqueue_head(&tty->write_wait);
2955         init_waitqueue_head(&tty->read_wait);
2956         INIT_WORK(&tty->hangup_work, do_tty_hangup);
2957         mutex_init(&tty->atomic_read_lock);
2958         mutex_init(&tty->atomic_write_lock);
2959         mutex_init(&tty->output_lock);
2960         mutex_init(&tty->echo_lock);
2961         spin_lock_init(&tty->read_lock);
2962         spin_lock_init(&tty->ctrl_lock);
2963         INIT_LIST_HEAD(&tty->tty_files);
2964         INIT_WORK(&tty->SAK_work, do_SAK_work);
2965
2966         tty->driver = driver;
2967         tty->ops = driver->ops;
2968         tty->index = idx;
2969         tty_line_name(driver, idx, tty->name);
2970         tty->dev = tty_get_device(tty);
2971 }
2972
2973 /**
2974  *      deinitialize_tty_struct
2975  *      @tty: tty to deinitialize
2976  *
2977  *      This subroutine deinitializes a tty structure that has been newly
2978  *      allocated but tty_release cannot be called on that yet.
2979  *
2980  *      Locking: none - tty in question must not be exposed at this point
2981  */
2982 void deinitialize_tty_struct(struct tty_struct *tty)
2983 {
2984         tty_ldisc_deinit(tty);
2985 }
2986
2987 /**
2988  *      tty_put_char    -       write one character to a tty
2989  *      @tty: tty
2990  *      @ch: character
2991  *
2992  *      Write one byte to the tty using the provided put_char method
2993  *      if present. Returns the number of characters successfully output.
2994  *
2995  *      Note: the specific put_char operation in the driver layer may go
2996  *      away soon. Don't call it directly, use this method
2997  */
2998
2999 int tty_put_char(struct tty_struct *tty, unsigned char ch)
3000 {
3001         if (tty->ops->put_char)
3002                 return tty->ops->put_char(tty, ch);
3003         return tty->ops->write(tty, &ch, 1);
3004 }
3005 EXPORT_SYMBOL_GPL(tty_put_char);
3006
3007 struct class *tty_class;
3008
3009 /**
3010  *      tty_register_device - register a tty device
3011  *      @driver: the tty driver that describes the tty device
3012  *      @index: the index in the tty driver for this tty device
3013  *      @device: a struct device that is associated with this tty device.
3014  *              This field is optional, if there is no known struct device
3015  *              for this tty device it can be set to NULL safely.
3016  *
3017  *      Returns a pointer to the struct device for this tty device
3018  *      (or ERR_PTR(-EFOO) on error).
3019  *
3020  *      This call is required to be made to register an individual tty device
3021  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3022  *      that bit is not set, this function should not be called by a tty
3023  *      driver.
3024  *
3025  *      Locking: ??
3026  */
3027
3028 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3029                                    struct device *device)
3030 {
3031         char name[64];
3032         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3033
3034         if (index >= driver->num) {
3035                 printk(KERN_ERR "Attempt to register invalid tty line number "
3036                        " (%d).\n", index);
3037                 return ERR_PTR(-EINVAL);
3038         }
3039
3040         if (driver->type == TTY_DRIVER_TYPE_PTY)
3041                 pty_line_name(driver, index, name);
3042         else
3043                 tty_line_name(driver, index, name);
3044
3045         return device_create(tty_class, device, dev, NULL, name);
3046 }
3047 EXPORT_SYMBOL(tty_register_device);
3048
3049 /**
3050  *      tty_unregister_device - unregister a tty device
3051  *      @driver: the tty driver that describes the tty device
3052  *      @index: the index in the tty driver for this tty device
3053  *
3054  *      If a tty device is registered with a call to tty_register_device() then
3055  *      this function must be called when the tty device is gone.
3056  *
3057  *      Locking: ??
3058  */
3059
3060 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3061 {
3062         device_destroy(tty_class,
3063                 MKDEV(driver->major, driver->minor_start) + index);
3064 }
3065 EXPORT_SYMBOL(tty_unregister_device);
3066
3067 struct tty_driver *alloc_tty_driver(int lines)
3068 {
3069         struct tty_driver *driver;
3070
3071         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3072         if (driver) {
3073                 kref_init(&driver->kref);
3074                 driver->magic = TTY_DRIVER_MAGIC;
3075                 driver->num = lines;
3076                 /* later we'll move allocation of tables here */
3077         }
3078         return driver;
3079 }
3080 EXPORT_SYMBOL(alloc_tty_driver);
3081
3082 static void destruct_tty_driver(struct kref *kref)
3083 {
3084         struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3085         int i;
3086         struct ktermios *tp;
3087         void *p;
3088
3089         if (driver->flags & TTY_DRIVER_INSTALLED) {
3090                 /*
3091                  * Free the termios and termios_locked structures because
3092                  * we don't want to get memory leaks when modular tty
3093                  * drivers are removed from the kernel.
3094                  */
3095                 for (i = 0; i < driver->num; i++) {
3096                         tp = driver->termios[i];
3097                         if (tp) {
3098                                 driver->termios[i] = NULL;
3099                                 kfree(tp);
3100                         }
3101                         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3102                                 tty_unregister_device(driver, i);
3103                 }
3104                 p = driver->ttys;
3105                 proc_tty_unregister_driver(driver);
3106                 driver->ttys = NULL;
3107                 driver->termios = NULL;
3108                 kfree(p);
3109                 cdev_del(&driver->cdev);
3110         }
3111         kfree(driver);
3112 }
3113
3114 void tty_driver_kref_put(struct tty_driver *driver)
3115 {
3116         kref_put(&driver->kref, destruct_tty_driver);
3117 }
3118 EXPORT_SYMBOL(tty_driver_kref_put);
3119
3120 void tty_set_operations(struct tty_driver *driver,
3121                         const struct tty_operations *op)
3122 {
3123         driver->ops = op;
3124 };
3125 EXPORT_SYMBOL(tty_set_operations);
3126
3127 void put_tty_driver(struct tty_driver *d)
3128 {
3129         tty_driver_kref_put(d);
3130 }
3131 EXPORT_SYMBOL(put_tty_driver);
3132
3133 /*
3134  * Called by a tty driver to register itself.
3135  */
3136 int tty_register_driver(struct tty_driver *driver)
3137 {
3138         int error;
3139         int i;
3140         dev_t dev;
3141         void **p = NULL;
3142         struct device *d;
3143
3144         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3145                 p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
3146                 if (!p)
3147                         return -ENOMEM;
3148         }
3149
3150         if (!driver->major) {
3151                 error = alloc_chrdev_region(&dev, driver->minor_start,
3152                                                 driver->num, driver->name);
3153                 if (!error) {
3154                         driver->major = MAJOR(dev);
3155                         driver->minor_start = MINOR(dev);
3156                 }
3157         } else {
3158                 dev = MKDEV(driver->major, driver->minor_start);
3159                 error = register_chrdev_region(dev, driver->num, driver->name);
3160         }
3161         if (error < 0) {
3162                 kfree(p);
3163                 return error;
3164         }
3165
3166         if (p) {
3167                 driver->ttys = (struct tty_struct **)p;
3168                 driver->termios = (struct ktermios **)(p + driver->num);
3169         } else {
3170                 driver->ttys = NULL;
3171                 driver->termios = NULL;
3172         }
3173
3174         cdev_init(&driver->cdev, &tty_fops);
3175         driver->cdev.owner = driver->owner;
3176         error = cdev_add(&driver->cdev, dev, driver->num);
3177         if (error) {
3178                 unregister_chrdev_region(dev, driver->num);
3179                 driver->ttys = NULL;
3180                 driver->termios = NULL;
3181                 kfree(p);
3182                 return error;
3183         }
3184
3185         mutex_lock(&tty_mutex);
3186         list_add(&driver->tty_drivers, &tty_drivers);
3187         mutex_unlock(&tty_mutex);
3188
3189         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3190                 for (i = 0; i < driver->num; i++) {
3191                         d = tty_register_device(driver, i, NULL);
3192                         if (IS_ERR(d)) {
3193                                 error = PTR_ERR(d);
3194                                 goto err;
3195                         }
3196                 }
3197         }
3198         proc_tty_register_driver(driver);
3199         driver->flags |= TTY_DRIVER_INSTALLED;
3200         return 0;
3201
3202 err:
3203         for (i--; i >= 0; i--)
3204                 tty_unregister_device(driver, i);
3205
3206         mutex_lock(&tty_mutex);
3207         list_del(&driver->tty_drivers);
3208         mutex_unlock(&tty_mutex);
3209
3210         unregister_chrdev_region(dev, driver->num);
3211         driver->ttys = NULL;
3212         driver->termios = NULL;
3213         kfree(p);
3214         return error;
3215 }
3216
3217 EXPORT_SYMBOL(tty_register_driver);
3218
3219 /*
3220  * Called by a tty driver to unregister itself.
3221  */
3222 int tty_unregister_driver(struct tty_driver *driver)
3223 {
3224 #if 0
3225         /* FIXME */
3226         if (driver->refcount)
3227                 return -EBUSY;
3228 #endif
3229         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3230                                 driver->num);
3231         mutex_lock(&tty_mutex);
3232         list_del(&driver->tty_drivers);
3233         mutex_unlock(&tty_mutex);
3234         return 0;
3235 }
3236
3237 EXPORT_SYMBOL(tty_unregister_driver);
3238
3239 dev_t tty_devnum(struct tty_struct *tty)
3240 {
3241         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3242 }
3243 EXPORT_SYMBOL(tty_devnum);
3244
3245 void proc_clear_tty(struct task_struct *p)
3246 {
3247         unsigned long flags;
3248         struct tty_struct *tty;
3249         spin_lock_irqsave(&p->sighand->siglock, flags);
3250         tty = p->signal->tty;
3251         p->signal->tty = NULL;
3252         spin_unlock_irqrestore(&p->sighand->siglock, flags);
3253         tty_kref_put(tty);
3254 }
3255
3256 /* Called under the sighand lock */
3257
3258 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3259 {
3260         if (tty) {
3261                 unsigned long flags;
3262                 /* We should not have a session or pgrp to put here but.... */
3263                 spin_lock_irqsave(&tty->ctrl_lock, flags);
3264                 put_pid(tty->session);
3265                 put_pid(tty->pgrp);
3266                 tty->pgrp = get_pid(task_pgrp(tsk));
3267                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3268                 tty->session = get_pid(task_session(tsk));
3269                 if (tsk->signal->tty) {
3270                         printk(KERN_DEBUG "tty not NULL!!\n");
3271                         tty_kref_put(tsk->signal->tty);
3272                 }
3273         }
3274         put_pid(tsk->signal->tty_old_pgrp);
3275         tsk->signal->tty = tty_kref_get(tty);
3276         tsk->signal->tty_old_pgrp = NULL;
3277 }
3278
3279 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3280 {
3281         spin_lock_irq(&tsk->sighand->siglock);
3282         __proc_set_tty(tsk, tty);
3283        &