SCSI: fix crashes in sd and sr runtime PM
[pandora-kernel.git] / drivers / tty / tty_io.c
1 /*
2  *  Copyright (C) 1991, 1992  Linus Torvalds
3  */
4
5 /*
6  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7  * or rs-channels. It also implements echoing, cooked mode etc.
8  *
9  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10  *
11  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12  * tty_struct and tty_queue structures.  Previously there was an array
13  * of 256 tty_struct's which was statically allocated, and the
14  * tty_queue structures were allocated at boot time.  Both are now
15  * dynamically allocated only when the tty is open.
16  *
17  * Also restructured routines so that there is more of a separation
18  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19  * the low-level tty routines (serial.c, pty.c, console.c).  This
20  * makes for cleaner and more compact code.  -TYT, 9/17/92
21  *
22  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23  * which can be dynamically activated and de-activated by the line
24  * discipline handling modules (like SLIP).
25  *
26  * NOTE: pay no attention to the line discipline code (yet); its
27  * interface is still subject to change in this version...
28  * -- TYT, 1/31/92
29  *
30  * Added functionality to the OPOST tty handling.  No delays, but all
31  * other bits should be there.
32  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33  *
34  * Rewrote canonical mode and added more termios flags.
35  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36  *
37  * Reorganized FASYNC support so mouse code can share it.
38  *      -- ctm@ardi.com, 9Sep95
39  *
40  * New TIOCLINUX variants added.
41  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
42  *
43  * Restrict vt switching via ioctl()
44  *      -- grif@cs.ucr.edu, 5-Dec-95
45  *
46  * Move console and virtual terminal code to more appropriate files,
47  * implement CONFIG_VT and generalize console device interface.
48  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49  *
50  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51  *      -- Bill Hawes <whawes@star.net>, June 97
52  *
53  * Added devfs support.
54  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55  *
56  * Added support for a Unix98-style ptmx device.
57  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58  *
59  * Reduced memory usage for older ARM systems
60  *      -- Russell King <rmk@arm.linux.org.uk>
61  *
62  * Move do_SAK() into process context.  Less stack use in devfs functions.
63  * alloc_tty_struct() always uses kmalloc()
64  *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65  */
66
67 #include <linux/types.h>
68 #include <linux/major.h>
69 #include <linux/errno.h>
70 #include <linux/signal.h>
71 #include <linux/fcntl.h>
72 #include <linux/sched.h>
73 #include <linux/interrupt.h>
74 #include <linux/tty.h>
75 #include <linux/tty_driver.h>
76 #include <linux/tty_flip.h>
77 #include <linux/devpts_fs.h>
78 #include <linux/file.h>
79 #include <linux/fdtable.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/device.h>
92 #include <linux/wait.h>
93 #include <linux/bitops.h>
94 #include <linux/delay.h>
95 #include <linux/seq_file.h>
96 #include <linux/serial.h>
97 #include <linux/ratelimit.h>
98
99 #include <linux/uaccess.h>
100 #include <asm/system.h>
101
102 #include <linux/kbd_kern.h>
103 #include <linux/vt_kern.h>
104 #include <linux/selection.h>
105
106 #include <linux/kmod.h>
107 #include <linux/nsproxy.h>
108
109 #undef TTY_DEBUG_HANGUP
110
111 #define TTY_PARANOIA_CHECK 1
112 #define CHECK_TTY_COUNT 1
113
114 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
115         .c_iflag = ICRNL | IXON,
116         .c_oflag = OPOST | ONLCR,
117         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
118         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
119                    ECHOCTL | ECHOKE | IEXTEN,
120         .c_cc = INIT_C_CC,
121         .c_ispeed = 38400,
122         .c_ospeed = 38400
123 };
124
125 EXPORT_SYMBOL(tty_std_termios);
126
127 /* This list gets poked at by procfs and various bits of boot up code. This
128    could do with some rationalisation such as pulling the tty proc function
129    into this file */
130
131 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
132
133 /* Mutex to protect creating and releasing a tty. This is shared with
134    vt.c for deeply disgusting hack reasons */
135 DEFINE_MUTEX(tty_mutex);
136 EXPORT_SYMBOL(tty_mutex);
137
138 /* Spinlock to protect the tty->tty_files list */
139 DEFINE_SPINLOCK(tty_files_lock);
140
141 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
142 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
143 ssize_t redirected_tty_write(struct file *, const char __user *,
144                                                         size_t, loff_t *);
145 static unsigned int tty_poll(struct file *, poll_table *);
146 static int tty_open(struct inode *, struct file *);
147 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
148 #ifdef CONFIG_COMPAT
149 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
150                                 unsigned long arg);
151 #else
152 #define tty_compat_ioctl NULL
153 #endif
154 static int __tty_fasync(int fd, struct file *filp, int on);
155 static int tty_fasync(int fd, struct file *filp, int on);
156 static void release_tty(struct tty_struct *tty, int idx);
157 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
159
160 /**
161  *      alloc_tty_struct        -       allocate a tty object
162  *
163  *      Return a new empty tty structure. The data fields have not
164  *      been initialized in any way but has been zeroed
165  *
166  *      Locking: none
167  */
168
169 struct tty_struct *alloc_tty_struct(void)
170 {
171         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
172 }
173
174 /**
175  *      free_tty_struct         -       free a disused tty
176  *      @tty: tty struct to free
177  *
178  *      Free the write buffers, tty queue and tty memory itself.
179  *
180  *      Locking: none. Must be called after tty is definitely unused
181  */
182
183 void free_tty_struct(struct tty_struct *tty)
184 {
185         if (tty->dev)
186                 put_device(tty->dev);
187         kfree(tty->write_buf);
188         tty_buffer_free_all(tty);
189         kfree(tty);
190 }
191
192 static inline struct tty_struct *file_tty(struct file *file)
193 {
194         return ((struct tty_file_private *)file->private_data)->tty;
195 }
196
197 int tty_alloc_file(struct file *file)
198 {
199         struct tty_file_private *priv;
200
201         priv = kmalloc(sizeof(*priv), GFP_KERNEL);
202         if (!priv)
203                 return -ENOMEM;
204
205         file->private_data = priv;
206
207         return 0;
208 }
209
210 /* Associate a new file with the tty structure */
211 void tty_add_file(struct tty_struct *tty, struct file *file)
212 {
213         struct tty_file_private *priv = file->private_data;
214
215         priv->tty = tty;
216         priv->file = file;
217
218         spin_lock(&tty_files_lock);
219         list_add(&priv->list, &tty->tty_files);
220         spin_unlock(&tty_files_lock);
221 }
222
223 /**
224  * tty_free_file - free file->private_data
225  *
226  * This shall be used only for fail path handling when tty_add_file was not
227  * called yet.
228  */
229 void tty_free_file(struct file *file)
230 {
231         struct tty_file_private *priv = file->private_data;
232
233         file->private_data = NULL;
234         kfree(priv);
235 }
236
237 /* Delete file from its tty */
238 void tty_del_file(struct file *file)
239 {
240         struct tty_file_private *priv = file->private_data;
241
242         spin_lock(&tty_files_lock);
243         list_del(&priv->list);
244         spin_unlock(&tty_files_lock);
245         tty_free_file(file);
246 }
247
248
249 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
250
251 /**
252  *      tty_name        -       return tty naming
253  *      @tty: tty structure
254  *      @buf: buffer for output
255  *
256  *      Convert a tty structure into a name. The name reflects the kernel
257  *      naming policy and if udev is in use may not reflect user space
258  *
259  *      Locking: none
260  */
261
262 char *tty_name(struct tty_struct *tty, char *buf)
263 {
264         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
265                 strcpy(buf, "NULL tty");
266         else
267                 strcpy(buf, tty->name);
268         return buf;
269 }
270
271 EXPORT_SYMBOL(tty_name);
272
273 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
274                               const char *routine)
275 {
276 #ifdef TTY_PARANOIA_CHECK
277         if (!tty) {
278                 printk(KERN_WARNING
279                         "null TTY for (%d:%d) in %s\n",
280                         imajor(inode), iminor(inode), routine);
281                 return 1;
282         }
283         if (tty->magic != TTY_MAGIC) {
284                 printk(KERN_WARNING
285                         "bad magic number for tty struct (%d:%d) in %s\n",
286                         imajor(inode), iminor(inode), routine);
287                 return 1;
288         }
289 #endif
290         return 0;
291 }
292
293 static int check_tty_count(struct tty_struct *tty, const char *routine)
294 {
295 #ifdef CHECK_TTY_COUNT
296         struct list_head *p;
297         int count = 0;
298
299         spin_lock(&tty_files_lock);
300         list_for_each(p, &tty->tty_files) {
301                 count++;
302         }
303         spin_unlock(&tty_files_lock);
304         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
305             tty->driver->subtype == PTY_TYPE_SLAVE &&
306             tty->link && tty->link->count)
307                 count++;
308         if (tty->count != count) {
309                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
310                                     "!= #fd's(%d) in %s\n",
311                        tty->name, tty->count, count, routine);
312                 return count;
313         }
314 #endif
315         return 0;
316 }
317
318 /**
319  *      get_tty_driver          -       find device of a tty
320  *      @dev_t: device identifier
321  *      @index: returns the index of the tty
322  *
323  *      This routine returns a tty driver structure, given a device number
324  *      and also passes back the index number.
325  *
326  *      Locking: caller must hold tty_mutex
327  */
328
329 static struct tty_driver *get_tty_driver(dev_t device, int *index)
330 {
331         struct tty_driver *p;
332
333         list_for_each_entry(p, &tty_drivers, tty_drivers) {
334                 dev_t base = MKDEV(p->major, p->minor_start);
335                 if (device < base || device >= base + p->num)
336                         continue;
337                 *index = device - base;
338                 return tty_driver_kref_get(p);
339         }
340         return NULL;
341 }
342
343 #ifdef CONFIG_CONSOLE_POLL
344
345 /**
346  *      tty_find_polling_driver -       find device of a polled tty
347  *      @name: name string to match
348  *      @line: pointer to resulting tty line nr
349  *
350  *      This routine returns a tty driver structure, given a name
351  *      and the condition that the tty driver is capable of polled
352  *      operation.
353  */
354 struct tty_driver *tty_find_polling_driver(char *name, int *line)
355 {
356         struct tty_driver *p, *res = NULL;
357         int tty_line = 0;
358         int len;
359         char *str, *stp;
360
361         for (str = name; *str; str++)
362                 if ((*str >= '0' && *str <= '9') || *str == ',')
363                         break;
364         if (!*str)
365                 return NULL;
366
367         len = str - name;
368         tty_line = simple_strtoul(str, &str, 10);
369
370         mutex_lock(&tty_mutex);
371         /* Search through the tty devices to look for a match */
372         list_for_each_entry(p, &tty_drivers, tty_drivers) {
373                 if (strncmp(name, p->name, len) != 0)
374                         continue;
375                 stp = str;
376                 if (*stp == ',')
377                         stp++;
378                 if (*stp == '\0')
379                         stp = NULL;
380
381                 if (tty_line >= 0 && tty_line < p->num && p->ops &&
382                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
383                         res = tty_driver_kref_get(p);
384                         *line = tty_line;
385                         break;
386                 }
387         }
388         mutex_unlock(&tty_mutex);
389
390         return res;
391 }
392 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
393 #endif
394
395 /**
396  *      tty_check_change        -       check for POSIX terminal changes
397  *      @tty: tty to check
398  *
399  *      If we try to write to, or set the state of, a terminal and we're
400  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
401  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
402  *
403  *      Locking: ctrl_lock
404  */
405
406 int tty_check_change(struct tty_struct *tty)
407 {
408         unsigned long flags;
409         int ret = 0;
410
411         if (current->signal->tty != tty)
412                 return 0;
413
414         spin_lock_irqsave(&tty->ctrl_lock, flags);
415
416         if (!tty->pgrp) {
417                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
418                 goto out_unlock;
419         }
420         if (task_pgrp(current) == tty->pgrp)
421                 goto out_unlock;
422         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
423         if (is_ignored(SIGTTOU))
424                 goto out;
425         if (is_current_pgrp_orphaned()) {
426                 ret = -EIO;
427                 goto out;
428         }
429         kill_pgrp(task_pgrp(current), SIGTTOU, 1);
430         set_thread_flag(TIF_SIGPENDING);
431         ret = -ERESTARTSYS;
432 out:
433         return ret;
434 out_unlock:
435         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
436         return ret;
437 }
438
439 EXPORT_SYMBOL(tty_check_change);
440
441 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
442                                 size_t count, loff_t *ppos)
443 {
444         return 0;
445 }
446
447 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
448                                  size_t count, loff_t *ppos)
449 {
450         return -EIO;
451 }
452
453 /* No kernel lock held - none needed ;) */
454 static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
455 {
456         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
457 }
458
459 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
460                 unsigned long arg)
461 {
462         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
463 }
464
465 static long hung_up_tty_compat_ioctl(struct file *file,
466                                      unsigned int cmd, unsigned long arg)
467 {
468         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
469 }
470
471 static const struct file_operations tty_fops = {
472         .llseek         = no_llseek,
473         .read           = tty_read,
474         .write          = tty_write,
475         .poll           = tty_poll,
476         .unlocked_ioctl = tty_ioctl,
477         .compat_ioctl   = tty_compat_ioctl,
478         .open           = tty_open,
479         .release        = tty_release,
480         .fasync         = tty_fasync,
481 };
482
483 static const struct file_operations console_fops = {
484         .llseek         = no_llseek,
485         .read           = tty_read,
486         .write          = redirected_tty_write,
487         .poll           = tty_poll,
488         .unlocked_ioctl = tty_ioctl,
489         .compat_ioctl   = tty_compat_ioctl,
490         .open           = tty_open,
491         .release        = tty_release,
492         .fasync         = tty_fasync,
493 };
494
495 static const struct file_operations hung_up_tty_fops = {
496         .llseek         = no_llseek,
497         .read           = hung_up_tty_read,
498         .write          = hung_up_tty_write,
499         .poll           = hung_up_tty_poll,
500         .unlocked_ioctl = hung_up_tty_ioctl,
501         .compat_ioctl   = hung_up_tty_compat_ioctl,
502         .release        = tty_release,
503 };
504
505 static DEFINE_SPINLOCK(redirect_lock);
506 static struct file *redirect;
507
508 /**
509  *      tty_wakeup      -       request more data
510  *      @tty: terminal
511  *
512  *      Internal and external helper for wakeups of tty. This function
513  *      informs the line discipline if present that the driver is ready
514  *      to receive more output data.
515  */
516
517 void tty_wakeup(struct tty_struct *tty)
518 {
519         struct tty_ldisc *ld;
520
521         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
522                 ld = tty_ldisc_ref(tty);
523                 if (ld) {
524                         if (ld->ops->write_wakeup)
525                                 ld->ops->write_wakeup(tty);
526                         tty_ldisc_deref(ld);
527                 }
528         }
529         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
530 }
531
532 EXPORT_SYMBOL_GPL(tty_wakeup);
533
534 /**
535  *      __tty_hangup            -       actual handler for hangup events
536  *      @work: tty device
537  *
538  *      This can be called by the "eventd" kernel thread.  That is process
539  *      synchronous but doesn't hold any locks, so we need to make sure we
540  *      have the appropriate locks for what we're doing.
541  *
542  *      The hangup event clears any pending redirections onto the hung up
543  *      device. It ensures future writes will error and it does the needed
544  *      line discipline hangup and signal delivery. The tty object itself
545  *      remains intact.
546  *
547  *      Locking:
548  *              BTM
549  *                redirect lock for undoing redirection
550  *                file list lock for manipulating list of ttys
551  *                tty_ldisc_lock from called functions
552  *                termios_mutex resetting termios data
553  *                tasklist_lock to walk task list for hangup event
554  *                  ->siglock to protect ->signal/->sighand
555  */
556 void __tty_hangup(struct tty_struct *tty)
557 {
558         struct file *cons_filp = NULL;
559         struct file *filp, *f = NULL;
560         struct task_struct *p;
561         struct tty_file_private *priv;
562         int    closecount = 0, n;
563         unsigned long flags;
564         int refs = 0;
565
566         if (!tty)
567                 return;
568
569
570         spin_lock(&redirect_lock);
571         if (redirect && file_tty(redirect) == tty) {
572                 f = redirect;
573                 redirect = NULL;
574         }
575         spin_unlock(&redirect_lock);
576
577         tty_lock();
578
579         /* some functions below drop BTM, so we need this bit */
580         set_bit(TTY_HUPPING, &tty->flags);
581
582         /* inuse_filps is protected by the single tty lock,
583            this really needs to change if we want to flush the
584            workqueue with the lock held */
585         check_tty_count(tty, "tty_hangup");
586
587         spin_lock(&tty_files_lock);
588         /* This breaks for file handles being sent over AF_UNIX sockets ? */
589         list_for_each_entry(priv, &tty->tty_files, list) {
590                 filp = priv->file;
591                 if (filp->f_op->write == redirected_tty_write)
592                         cons_filp = filp;
593                 if (filp->f_op->write != tty_write)
594                         continue;
595                 closecount++;
596                 __tty_fasync(-1, filp, 0);      /* can't block */
597                 filp->f_op = &hung_up_tty_fops;
598         }
599         spin_unlock(&tty_files_lock);
600
601         /*
602          * it drops BTM and thus races with reopen
603          * we protect the race by TTY_HUPPING
604          */
605         tty_ldisc_hangup(tty);
606
607         read_lock(&tasklist_lock);
608         if (tty->session) {
609                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
610                         spin_lock_irq(&p->sighand->siglock);
611                         if (p->signal->tty == tty) {
612                                 p->signal->tty = NULL;
613                                 /* We defer the dereferences outside fo
614                                    the tasklist lock */
615                                 refs++;
616                         }
617                         if (!p->signal->leader) {
618                                 spin_unlock_irq(&p->sighand->siglock);
619                                 continue;
620                         }
621                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
622                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
623                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
624                         spin_lock_irqsave(&tty->ctrl_lock, flags);
625                         if (tty->pgrp)
626                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
627                         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
628                         spin_unlock_irq(&p->sighand->siglock);
629                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
630         }
631         read_unlock(&tasklist_lock);
632
633         spin_lock_irqsave(&tty->ctrl_lock, flags);
634         clear_bit(TTY_THROTTLED, &tty->flags);
635         clear_bit(TTY_PUSH, &tty->flags);
636         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
637         put_pid(tty->session);
638         put_pid(tty->pgrp);
639         tty->session = NULL;
640         tty->pgrp = NULL;
641         tty->ctrl_status = 0;
642         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
643
644         /* Account for the p->signal references we killed */
645         while (refs--)
646                 tty_kref_put(tty);
647
648         /*
649          * If one of the devices matches a console pointer, we
650          * cannot just call hangup() because that will cause
651          * tty->count and state->count to go out of sync.
652          * So we just call close() the right number of times.
653          */
654         if (cons_filp) {
655                 if (tty->ops->close)
656                         for (n = 0; n < closecount; n++)
657                                 tty->ops->close(tty, cons_filp);
658         } else if (tty->ops->hangup)
659                 (tty->ops->hangup)(tty);
660         /*
661          * We don't want to have driver/ldisc interactions beyond
662          * the ones we did here. The driver layer expects no
663          * calls after ->hangup() from the ldisc side. However we
664          * can't yet guarantee all that.
665          */
666         set_bit(TTY_HUPPED, &tty->flags);
667         clear_bit(TTY_HUPPING, &tty->flags);
668         tty_ldisc_enable(tty);
669
670         tty_unlock();
671
672         if (f)
673                 fput(f);
674 }
675
676 static void do_tty_hangup(struct work_struct *work)
677 {
678         struct tty_struct *tty =
679                 container_of(work, struct tty_struct, hangup_work);
680
681         __tty_hangup(tty);
682 }
683
684 /**
685  *      tty_hangup              -       trigger a hangup event
686  *      @tty: tty to hangup
687  *
688  *      A carrier loss (virtual or otherwise) has occurred on this like
689  *      schedule a hangup sequence to run after this event.
690  */
691
692 void tty_hangup(struct tty_struct *tty)
693 {
694 #ifdef TTY_DEBUG_HANGUP
695         char    buf[64];
696         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
697 #endif
698         schedule_work(&tty->hangup_work);
699 }
700
701 EXPORT_SYMBOL(tty_hangup);
702
703 /**
704  *      tty_vhangup             -       process vhangup
705  *      @tty: tty to hangup
706  *
707  *      The user has asked via system call for the terminal to be hung up.
708  *      We do this synchronously so that when the syscall returns the process
709  *      is complete. That guarantee is necessary for security reasons.
710  */
711
712 void tty_vhangup(struct tty_struct *tty)
713 {
714 #ifdef TTY_DEBUG_HANGUP
715         char    buf[64];
716
717         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
718 #endif
719         __tty_hangup(tty);
720 }
721
722 EXPORT_SYMBOL(tty_vhangup);
723
724
725 /**
726  *      tty_vhangup_self        -       process vhangup for own ctty
727  *
728  *      Perform a vhangup on the current controlling tty
729  */
730
731 void tty_vhangup_self(void)
732 {
733         struct tty_struct *tty;
734
735         tty = get_current_tty();
736         if (tty) {
737                 tty_vhangup(tty);
738                 tty_kref_put(tty);
739         }
740 }
741
742 /**
743  *      tty_hung_up_p           -       was tty hung up
744  *      @filp: file pointer of tty
745  *
746  *      Return true if the tty has been subject to a vhangup or a carrier
747  *      loss
748  */
749
750 int tty_hung_up_p(struct file *filp)
751 {
752         return (filp->f_op == &hung_up_tty_fops);
753 }
754
755 EXPORT_SYMBOL(tty_hung_up_p);
756
757 static void session_clear_tty(struct pid *session)
758 {
759         struct task_struct *p;
760         do_each_pid_task(session, PIDTYPE_SID, p) {
761                 proc_clear_tty(p);
762         } while_each_pid_task(session, PIDTYPE_SID, p);
763 }
764
765 /**
766  *      disassociate_ctty       -       disconnect controlling tty
767  *      @on_exit: true if exiting so need to "hang up" the session
768  *
769  *      This function is typically called only by the session leader, when
770  *      it wants to disassociate itself from its controlling tty.
771  *
772  *      It performs the following functions:
773  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
774  *      (2)  Clears the tty from being controlling the session
775  *      (3)  Clears the controlling tty for all processes in the
776  *              session group.
777  *
778  *      The argument on_exit is set to 1 if called when a process is
779  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
780  *
781  *      Locking:
782  *              BTM is taken for hysterical raisins, and held when
783  *                called from no_tty().
784  *                tty_mutex is taken to protect tty
785  *                ->siglock is taken to protect ->signal/->sighand
786  *                tasklist_lock is taken to walk process list for sessions
787  *                  ->siglock is taken to protect ->signal/->sighand
788  */
789
790 void disassociate_ctty(int on_exit)
791 {
792         struct tty_struct *tty;
793         struct pid *tty_pgrp = NULL;
794
795         if (!current->signal->leader)
796                 return;
797
798         tty = get_current_tty();
799         if (tty) {
800                 tty_pgrp = get_pid(tty->pgrp);
801                 if (on_exit) {
802                         if (tty->driver->type != TTY_DRIVER_TYPE_PTY)
803                                 tty_vhangup(tty);
804                 }
805                 tty_kref_put(tty);
806         } else if (on_exit) {
807                 struct pid *old_pgrp;
808                 spin_lock_irq(&current->sighand->siglock);
809                 old_pgrp = current->signal->tty_old_pgrp;
810                 current->signal->tty_old_pgrp = NULL;
811                 spin_unlock_irq(&current->sighand->siglock);
812                 if (old_pgrp) {
813                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
814                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
815                         put_pid(old_pgrp);
816                 }
817                 return;
818         }
819         if (tty_pgrp) {
820                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
821                 if (!on_exit)
822                         kill_pgrp(tty_pgrp, SIGCONT, on_exit);
823                 put_pid(tty_pgrp);
824         }
825
826         spin_lock_irq(&current->sighand->siglock);
827         put_pid(current->signal->tty_old_pgrp);
828         current->signal->tty_old_pgrp = NULL;
829         spin_unlock_irq(&current->sighand->siglock);
830
831         tty = get_current_tty();
832         if (tty) {
833                 unsigned long flags;
834                 spin_lock_irqsave(&tty->ctrl_lock, flags);
835                 put_pid(tty->session);
836                 put_pid(tty->pgrp);
837                 tty->session = NULL;
838                 tty->pgrp = NULL;
839                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
840                 tty_kref_put(tty);
841         } else {
842 #ifdef TTY_DEBUG_HANGUP
843                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
844                        " = NULL", tty);
845 #endif
846         }
847
848         /* Now clear signal->tty under the lock */
849         read_lock(&tasklist_lock);
850         session_clear_tty(task_session(current));
851         read_unlock(&tasklist_lock);
852 }
853
854 /**
855  *
856  *      no_tty  - Ensure the current process does not have a controlling tty
857  */
858 void no_tty(void)
859 {
860         struct task_struct *tsk = current;
861         tty_lock();
862         disassociate_ctty(0);
863         tty_unlock();
864         proc_clear_tty(tsk);
865 }
866
867
868 /**
869  *      stop_tty        -       propagate flow control
870  *      @tty: tty to stop
871  *
872  *      Perform flow control to the driver. For PTY/TTY pairs we
873  *      must also propagate the TIOCKPKT status. May be called
874  *      on an already stopped device and will not re-call the driver
875  *      method.
876  *
877  *      This functionality is used by both the line disciplines for
878  *      halting incoming flow and by the driver. It may therefore be
879  *      called from any context, may be under the tty atomic_write_lock
880  *      but not always.
881  *
882  *      Locking:
883  *              Uses the tty control lock internally
884  */
885
886 void stop_tty(struct tty_struct *tty)
887 {
888         unsigned long flags;
889         spin_lock_irqsave(&tty->ctrl_lock, flags);
890         if (tty->stopped) {
891                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
892                 return;
893         }
894         tty->stopped = 1;
895         if (tty->link && tty->link->packet) {
896                 tty->ctrl_status &= ~TIOCPKT_START;
897                 tty->ctrl_status |= TIOCPKT_STOP;
898                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
899         }
900         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
901         if (tty->ops->stop)
902                 (tty->ops->stop)(tty);
903 }
904
905 EXPORT_SYMBOL(stop_tty);
906
907 /**
908  *      start_tty       -       propagate flow control
909  *      @tty: tty to start
910  *
911  *      Start a tty that has been stopped if at all possible. Perform
912  *      any necessary wakeups and propagate the TIOCPKT status. If this
913  *      is the tty was previous stopped and is being started then the
914  *      driver start method is invoked and the line discipline woken.
915  *
916  *      Locking:
917  *              ctrl_lock
918  */
919
920 void start_tty(struct tty_struct *tty)
921 {
922         unsigned long flags;
923         spin_lock_irqsave(&tty->ctrl_lock, flags);
924         if (!tty->stopped || tty->flow_stopped) {
925                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
926                 return;
927         }
928         tty->stopped = 0;
929         if (tty->link && tty->link->packet) {
930                 tty->ctrl_status &= ~TIOCPKT_STOP;
931                 tty->ctrl_status |= TIOCPKT_START;
932                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
933         }
934         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
935         if (tty->ops->start)
936                 (tty->ops->start)(tty);
937         /* If we have a running line discipline it may need kicking */
938         tty_wakeup(tty);
939 }
940
941 EXPORT_SYMBOL(start_tty);
942
943 /* We limit tty time update visibility to every 8 seconds or so. */
944 static void tty_update_time(struct timespec *time)
945 {
946         unsigned long sec = get_seconds();
947         if (abs(sec - time->tv_sec) & ~7)
948                 time->tv_sec = sec;
949 }
950
951 /**
952  *      tty_read        -       read method for tty device files
953  *      @file: pointer to tty file
954  *      @buf: user buffer
955  *      @count: size of user buffer
956  *      @ppos: unused
957  *
958  *      Perform the read system call function on this terminal device. Checks
959  *      for hung up devices before calling the line discipline method.
960  *
961  *      Locking:
962  *              Locks the line discipline internally while needed. Multiple
963  *      read calls may be outstanding in parallel.
964  */
965
966 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
967                         loff_t *ppos)
968 {
969         int i;
970         struct inode *inode = file->f_path.dentry->d_inode;
971         struct tty_struct *tty = file_tty(file);
972         struct tty_ldisc *ld;
973
974         if (tty_paranoia_check(tty, inode, "tty_read"))
975                 return -EIO;
976         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
977                 return -EIO;
978
979         /* We want to wait for the line discipline to sort out in this
980            situation */
981         ld = tty_ldisc_ref_wait(tty);
982         if (ld->ops->read)
983                 i = (ld->ops->read)(tty, file, buf, count);
984         else
985                 i = -EIO;
986         tty_ldisc_deref(ld);
987
988         if (i > 0)
989                 tty_update_time(&inode->i_atime);
990
991         return i;
992 }
993
994 void tty_write_unlock(struct tty_struct *tty)
995         __releases(&tty->atomic_write_lock)
996 {
997         mutex_unlock(&tty->atomic_write_lock);
998         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
999 }
1000
1001 int tty_write_lock(struct tty_struct *tty, int ndelay)
1002         __acquires(&tty->atomic_write_lock)
1003 {
1004         if (!mutex_trylock(&tty->atomic_write_lock)) {
1005                 if (ndelay)
1006                         return -EAGAIN;
1007                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
1008                         return -ERESTARTSYS;
1009         }
1010         return 0;
1011 }
1012
1013 /*
1014  * Split writes up in sane blocksizes to avoid
1015  * denial-of-service type attacks
1016  */
1017 static inline ssize_t do_tty_write(
1018         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1019         struct tty_struct *tty,
1020         struct file *file,
1021         const char __user *buf,
1022         size_t count)
1023 {
1024         ssize_t ret, written = 0;
1025         unsigned int chunk;
1026
1027         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1028         if (ret < 0)
1029                 return ret;
1030
1031         /*
1032          * We chunk up writes into a temporary buffer. This
1033          * simplifies low-level drivers immensely, since they
1034          * don't have locking issues and user mode accesses.
1035          *
1036          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1037          * big chunk-size..
1038          *
1039          * The default chunk-size is 2kB, because the NTTY
1040          * layer has problems with bigger chunks. It will
1041          * claim to be able to handle more characters than
1042          * it actually does.
1043          *
1044          * FIXME: This can probably go away now except that 64K chunks
1045          * are too likely to fail unless switched to vmalloc...
1046          */
1047         chunk = 2048;
1048         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1049                 chunk = 65536;
1050         if (count < chunk)
1051                 chunk = count;
1052
1053         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1054         if (tty->write_cnt < chunk) {
1055                 unsigned char *buf_chunk;
1056
1057                 if (chunk < 1024)
1058                         chunk = 1024;
1059
1060                 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1061                 if (!buf_chunk) {
1062                         ret = -ENOMEM;
1063                         goto out;
1064                 }
1065                 kfree(tty->write_buf);
1066                 tty->write_cnt = chunk;
1067                 tty->write_buf = buf_chunk;
1068         }
1069
1070         /* Do the write .. */
1071         for (;;) {
1072                 size_t size = count;
1073                 if (size > chunk)
1074                         size = chunk;
1075                 ret = -EFAULT;
1076                 if (copy_from_user(tty->write_buf, buf, size))
1077                         break;
1078                 ret = write(tty, file, tty->write_buf, size);
1079                 if (ret <= 0)
1080                         break;
1081                 written += ret;
1082                 buf += ret;
1083                 count -= ret;
1084                 if (!count)
1085                         break;
1086                 ret = -ERESTARTSYS;
1087                 if (signal_pending(current))
1088                         break;
1089                 cond_resched();
1090         }
1091         if (written) {
1092                struct inode *inode = file->f_path.dentry->d_inode;
1093                 tty_update_time(&inode->i_mtime);
1094                 ret = written;
1095         }
1096 out:
1097         tty_write_unlock(tty);
1098         return ret;
1099 }
1100
1101 /**
1102  * tty_write_message - write a message to a certain tty, not just the console.
1103  * @tty: the destination tty_struct
1104  * @msg: the message to write
1105  *
1106  * This is used for messages that need to be redirected to a specific tty.
1107  * We don't put it into the syslog queue right now maybe in the future if
1108  * really needed.
1109  *
1110  * We must still hold the BTM and test the CLOSING flag for the moment.
1111  */
1112
1113 void tty_write_message(struct tty_struct *tty, char *msg)
1114 {
1115         if (tty) {
1116                 mutex_lock(&tty->atomic_write_lock);
1117                 tty_lock();
1118                 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1119                         tty_unlock();
1120                         tty->ops->write(tty, msg, strlen(msg));
1121                 } else
1122                         tty_unlock();
1123                 tty_write_unlock(tty);
1124         }
1125         return;
1126 }
1127
1128
1129 /**
1130  *      tty_write               -       write method for tty device file
1131  *      @file: tty file pointer
1132  *      @buf: user data to write
1133  *      @count: bytes to write
1134  *      @ppos: unused
1135  *
1136  *      Write data to a tty device via the line discipline.
1137  *
1138  *      Locking:
1139  *              Locks the line discipline as required
1140  *              Writes to the tty driver are serialized by the atomic_write_lock
1141  *      and are then processed in chunks to the device. The line discipline
1142  *      write method will not be invoked in parallel for each device.
1143  */
1144
1145 static ssize_t tty_write(struct file *file, const char __user *buf,
1146                                                 size_t count, loff_t *ppos)
1147 {
1148         struct inode *inode = file->f_path.dentry->d_inode;
1149         struct tty_struct *tty = file_tty(file);
1150         struct tty_ldisc *ld;
1151         ssize_t ret;
1152
1153         if (tty_paranoia_check(tty, inode, "tty_write"))
1154                 return -EIO;
1155         if (!tty || !tty->ops->write ||
1156                 (test_bit(TTY_IO_ERROR, &tty->flags)))
1157                         return -EIO;
1158         /* Short term debug to catch buggy drivers */
1159         if (tty->ops->write_room == NULL)
1160                 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1161                         tty->driver->name);
1162         ld = tty_ldisc_ref_wait(tty);
1163         if (!ld->ops->write)
1164                 ret = -EIO;
1165         else
1166                 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1167         tty_ldisc_deref(ld);
1168         return ret;
1169 }
1170
1171 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1172                                                 size_t count, loff_t *ppos)
1173 {
1174         struct file *p = NULL;
1175
1176         spin_lock(&redirect_lock);
1177         if (redirect) {
1178                 get_file(redirect);
1179                 p = redirect;
1180         }
1181         spin_unlock(&redirect_lock);
1182
1183         if (p) {
1184                 ssize_t res;
1185                 res = vfs_write(p, buf, count, &p->f_pos);
1186                 fput(p);
1187                 return res;
1188         }
1189         return tty_write(file, buf, count, ppos);
1190 }
1191
1192 static char ptychar[] = "pqrstuvwxyzabcde";
1193
1194 /**
1195  *      pty_line_name   -       generate name for a pty
1196  *      @driver: the tty driver in use
1197  *      @index: the minor number
1198  *      @p: output buffer of at least 6 bytes
1199  *
1200  *      Generate a name from a driver reference and write it to the output
1201  *      buffer.
1202  *
1203  *      Locking: None
1204  */
1205 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1206 {
1207         int i = index + driver->name_base;
1208         /* ->name is initialized to "ttyp", but "tty" is expected */
1209         sprintf(p, "%s%c%x",
1210                 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1211                 ptychar[i >> 4 & 0xf], i & 0xf);
1212 }
1213
1214 /**
1215  *      tty_line_name   -       generate name for a tty
1216  *      @driver: the tty driver in use
1217  *      @index: the minor number
1218  *      @p: output buffer of at least 7 bytes
1219  *
1220  *      Generate a name from a driver reference and write it to the output
1221  *      buffer.
1222  *
1223  *      Locking: None
1224  */
1225 static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1226 {
1227         return sprintf(p, "%s%d", driver->name, index + driver->name_base);
1228 }
1229
1230 /**
1231  *      tty_driver_lookup_tty() - find an existing tty, if any
1232  *      @driver: the driver for the tty
1233  *      @idx:    the minor number
1234  *
1235  *      Return the tty, if found or ERR_PTR() otherwise.
1236  *
1237  *      Locking: tty_mutex must be held. If tty is found, the mutex must
1238  *      be held until the 'fast-open' is also done. Will change once we
1239  *      have refcounting in the driver and per driver locking
1240  */
1241 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1242                 struct inode *inode, int idx)
1243 {
1244         struct tty_struct *tty;
1245
1246         if (driver->ops->lookup)
1247                 return driver->ops->lookup(driver, inode, idx);
1248
1249         tty = driver->ttys[idx];
1250         return tty;
1251 }
1252
1253 /**
1254  *      tty_init_termios        -  helper for termios setup
1255  *      @tty: the tty to set up
1256  *
1257  *      Initialise the termios structures for this tty. Thus runs under
1258  *      the tty_mutex currently so we can be relaxed about ordering.
1259  */
1260
1261 int tty_init_termios(struct tty_struct *tty)
1262 {
1263         struct ktermios *tp;
1264         int idx = tty->index;
1265
1266         tp = tty->driver->termios[idx];
1267         if (tp == NULL) {
1268                 tp = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
1269                 if (tp == NULL)
1270                         return -ENOMEM;
1271                 memcpy(tp, &tty->driver->init_termios,
1272                                                 sizeof(struct ktermios));
1273                 tty->driver->termios[idx] = tp;
1274         }
1275         tty->termios = tp;
1276         tty->termios_locked = tp + 1;
1277
1278         /* Compatibility until drivers always set this */
1279         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1280         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1281         return 0;
1282 }
1283 EXPORT_SYMBOL_GPL(tty_init_termios);
1284
1285 /**
1286  *      tty_driver_install_tty() - install a tty entry in the driver
1287  *      @driver: the driver for the tty
1288  *      @tty: the tty
1289  *
1290  *      Install a tty object into the driver tables. The tty->index field
1291  *      will be set by the time this is called. This method is responsible
1292  *      for ensuring any need additional structures are allocated and
1293  *      configured.
1294  *
1295  *      Locking: tty_mutex for now
1296  */
1297 static int tty_driver_install_tty(struct tty_driver *driver,
1298                                                 struct tty_struct *tty)
1299 {
1300         int idx = tty->index;
1301         int ret;
1302
1303         if (driver->ops->install) {
1304                 ret = driver->ops->install(driver, tty);
1305                 return ret;
1306         }
1307
1308         if (tty_init_termios(tty) == 0) {
1309                 tty_driver_kref_get(driver);
1310                 tty->count++;
1311                 driver->ttys[idx] = tty;
1312                 return 0;
1313         }
1314         return -ENOMEM;
1315 }
1316
1317 /**
1318  *      tty_driver_remove_tty() - remove a tty from the driver tables
1319  *      @driver: the driver for the tty
1320  *      @idx:    the minor number
1321  *
1322  *      Remvoe a tty object from the driver tables. The tty->index field
1323  *      will be set by the time this is called.
1324  *
1325  *      Locking: tty_mutex for now
1326  */
1327 void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1328 {
1329         if (driver->ops->remove)
1330                 driver->ops->remove(driver, tty);
1331         else
1332                 driver->ttys[tty->index] = NULL;
1333 }
1334
1335 /*
1336  *      tty_reopen()    - fast re-open of an open tty
1337  *      @tty    - the tty to open
1338  *
1339  *      Return 0 on success, -errno on error.
1340  *
1341  *      Locking: tty_mutex must be held from the time the tty was found
1342  *               till this open completes.
1343  */
1344 static int tty_reopen(struct tty_struct *tty)
1345 {
1346         struct tty_driver *driver = tty->driver;
1347
1348         if (test_bit(TTY_CLOSING, &tty->flags) ||
1349                         test_bit(TTY_HUPPING, &tty->flags) ||
1350                         test_bit(TTY_LDISC_CHANGING, &tty->flags))
1351                 return -EIO;
1352
1353         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1354             driver->subtype == PTY_TYPE_MASTER) {
1355                 /*
1356                  * special case for PTY masters: only one open permitted,
1357                  * and the slave side open count is incremented as well.
1358                  */
1359                 if (tty->count)
1360                         return -EIO;
1361
1362                 tty->link->count++;
1363         }
1364         tty->count++;
1365         tty->driver = driver; /* N.B. why do this every time?? */
1366
1367         mutex_lock(&tty->ldisc_mutex);
1368         WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1369         mutex_unlock(&tty->ldisc_mutex);
1370
1371         return 0;
1372 }
1373
1374 /**
1375  *      tty_init_dev            -       initialise a tty device
1376  *      @driver: tty driver we are opening a device on
1377  *      @idx: device index
1378  *      @ret_tty: returned tty structure
1379  *      @first_ok: ok to open a new device (used by ptmx)
1380  *
1381  *      Prepare a tty device. This may not be a "new" clean device but
1382  *      could also be an active device. The pty drivers require special
1383  *      handling because of this.
1384  *
1385  *      Locking:
1386  *              The function is called under the tty_mutex, which
1387  *      protects us from the tty struct or driver itself going away.
1388  *
1389  *      On exit the tty device has the line discipline attached and
1390  *      a reference count of 1. If a pair was created for pty/tty use
1391  *      and the other was a pty master then it too has a reference count of 1.
1392  *
1393  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1394  * failed open.  The new code protects the open with a mutex, so it's
1395  * really quite straightforward.  The mutex locking can probably be
1396  * relaxed for the (most common) case of reopening a tty.
1397  */
1398
1399 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
1400                                                                 int first_ok)
1401 {
1402         struct tty_struct *tty;
1403         int retval;
1404
1405         /* Check if pty master is being opened multiple times */
1406         if (driver->subtype == PTY_TYPE_MASTER &&
1407                 (driver->flags & TTY_DRIVER_DEVPTS_MEM) && !first_ok) {
1408                 return ERR_PTR(-EIO);
1409         }
1410
1411         /*
1412          * First time open is complex, especially for PTY devices.
1413          * This code guarantees that either everything succeeds and the
1414          * TTY is ready for operation, or else the table slots are vacated
1415          * and the allocated memory released.  (Except that the termios
1416          * and locked termios may be retained.)
1417          */
1418
1419         if (!try_module_get(driver->owner))
1420                 return ERR_PTR(-ENODEV);
1421
1422         tty = alloc_tty_struct();
1423         if (!tty) {
1424                 retval = -ENOMEM;
1425                 goto err_module_put;
1426         }
1427         initialize_tty_struct(tty, driver, idx);
1428
1429         retval = tty_driver_install_tty(driver, tty);
1430         if (retval < 0)
1431                 goto err_deinit_tty;
1432
1433         /*
1434          * Structures all installed ... call the ldisc open routines.
1435          * If we fail here just call release_tty to clean up.  No need
1436          * to decrement the use counts, as release_tty doesn't care.
1437          */
1438         retval = tty_ldisc_setup(tty, tty->link);
1439         if (retval)
1440                 goto err_release_tty;
1441         return tty;
1442
1443 err_deinit_tty:
1444         deinitialize_tty_struct(tty);
1445         free_tty_struct(tty);
1446 err_module_put:
1447         module_put(driver->owner);
1448         return ERR_PTR(retval);
1449
1450         /* call the tty release_tty routine to clean out this slot */
1451 err_release_tty:
1452         printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1453                                  "clearing slot %d\n", idx);
1454         release_tty(tty, idx);
1455         return ERR_PTR(retval);
1456 }
1457
1458 void tty_free_termios(struct tty_struct *tty)
1459 {
1460         struct ktermios *tp;
1461         int idx = tty->index;
1462         /* Kill this flag and push into drivers for locking etc */
1463         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1464                 /* FIXME: Locking on ->termios array */
1465                 tp = tty->termios;
1466                 tty->driver->termios[idx] = NULL;
1467                 kfree(tp);
1468         }
1469 }
1470 EXPORT_SYMBOL(tty_free_termios);
1471
1472 void tty_shutdown(struct tty_struct *tty)
1473 {
1474         tty_driver_remove_tty(tty->driver, tty);
1475         tty_free_termios(tty);
1476 }
1477 EXPORT_SYMBOL(tty_shutdown);
1478
1479 /**
1480  *      release_one_tty         -       release tty structure memory
1481  *      @kref: kref of tty we are obliterating
1482  *
1483  *      Releases memory associated with a tty structure, and clears out the
1484  *      driver table slots. This function is called when a device is no longer
1485  *      in use. It also gets called when setup of a device fails.
1486  *
1487  *      Locking:
1488  *              tty_mutex - sometimes only
1489  *              takes the file list lock internally when working on the list
1490  *      of ttys that the driver keeps.
1491  *
1492  *      This method gets called from a work queue so that the driver private
1493  *      cleanup ops can sleep (needed for USB at least)
1494  */
1495 static void release_one_tty(struct work_struct *work)
1496 {
1497         struct tty_struct *tty =
1498                 container_of(work, struct tty_struct, hangup_work);
1499         struct tty_driver *driver = tty->driver;
1500
1501         if (tty->ops->cleanup)
1502                 tty->ops->cleanup(tty);
1503
1504         tty->magic = 0;
1505         tty_driver_kref_put(driver);
1506         module_put(driver->owner);
1507
1508         spin_lock(&tty_files_lock);
1509         list_del_init(&tty->tty_files);
1510         spin_unlock(&tty_files_lock);
1511
1512         put_pid(tty->pgrp);
1513         put_pid(tty->session);
1514         free_tty_struct(tty);
1515 }
1516
1517 static void queue_release_one_tty(struct kref *kref)
1518 {
1519         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1520
1521         if (tty->ops->shutdown)
1522                 tty->ops->shutdown(tty);
1523         else
1524                 tty_shutdown(tty);
1525
1526         /* The hangup queue is now free so we can reuse it rather than
1527            waste a chunk of memory for each port */
1528         INIT_WORK(&tty->hangup_work, release_one_tty);
1529         schedule_work(&tty->hangup_work);
1530 }
1531
1532 /**
1533  *      tty_kref_put            -       release a tty kref
1534  *      @tty: tty device
1535  *
1536  *      Release a reference to a tty device and if need be let the kref
1537  *      layer destruct the object for us
1538  */
1539
1540 void tty_kref_put(struct tty_struct *tty)
1541 {
1542         if (tty)
1543                 kref_put(&tty->kref, queue_release_one_tty);
1544 }
1545 EXPORT_SYMBOL(tty_kref_put);
1546
1547 /**
1548  *      release_tty             -       release tty structure memory
1549  *
1550  *      Release both @tty and a possible linked partner (think pty pair),
1551  *      and decrement the refcount of the backing module.
1552  *
1553  *      Locking:
1554  *              tty_mutex - sometimes only
1555  *              takes the file list lock internally when working on the list
1556  *      of ttys that the driver keeps.
1557  *              FIXME: should we require tty_mutex is held here ??
1558  *
1559  */
1560 static void release_tty(struct tty_struct *tty, int idx)
1561 {
1562         /* This should always be true but check for the moment */
1563         WARN_ON(tty->index != idx);
1564
1565         if (tty->link)
1566                 tty_kref_put(tty->link);
1567         tty_kref_put(tty);
1568 }
1569
1570 /**
1571  *      tty_release             -       vfs callback for close
1572  *      @inode: inode of tty
1573  *      @filp: file pointer for handle to tty
1574  *
1575  *      Called the last time each file handle is closed that references
1576  *      this tty. There may however be several such references.
1577  *
1578  *      Locking:
1579  *              Takes bkl. See tty_release_dev
1580  *
1581  * Even releasing the tty structures is a tricky business.. We have
1582  * to be very careful that the structures are all released at the
1583  * same time, as interrupts might otherwise get the wrong pointers.
1584  *
1585  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1586  * lead to double frees or releasing memory still in use.
1587  */
1588
1589 int tty_release(struct inode *inode, struct file *filp)
1590 {
1591         struct tty_struct *tty = file_tty(filp);
1592         struct tty_struct *o_tty;
1593         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1594         int     devpts;
1595         int     idx;
1596         char    buf[64];
1597         long    timeout = 0;
1598
1599         if (tty_paranoia_check(tty, inode, "tty_release_dev"))
1600                 return 0;
1601
1602         tty_lock();
1603         check_tty_count(tty, "tty_release_dev");
1604
1605         __tty_fasync(-1, filp, 0);
1606
1607         idx = tty->index;
1608         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1609                       tty->driver->subtype == PTY_TYPE_MASTER);
1610         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1611         o_tty = tty->link;
1612
1613 #ifdef TTY_PARANOIA_CHECK
1614         if (idx < 0 || idx >= tty->driver->num) {
1615                 printk(KERN_DEBUG "tty_release_dev: bad idx when trying to "
1616                                   "free (%s)\n", tty->name);
1617                 tty_unlock();
1618                 return 0;
1619         }
1620         if (!devpts) {
1621                 if (tty != tty->driver->ttys[idx]) {
1622                         tty_unlock();
1623                         printk(KERN_DEBUG "tty_release_dev: driver.table[%d] not tty "
1624                                "for (%s)\n", idx, tty->name);
1625                         return 0;
1626                 }
1627                 if (tty->termios != tty->driver->termios[idx]) {
1628                         tty_unlock();
1629                         printk(KERN_DEBUG "tty_release_dev: driver.termios[%d] not termios "
1630                                "for (%s)\n",
1631                                idx, tty->name);
1632                         return 0;
1633                 }
1634         }
1635 #endif
1636
1637 #ifdef TTY_DEBUG_HANGUP
1638         printk(KERN_DEBUG "tty_release_dev of %s (tty count=%d)...",
1639                tty_name(tty, buf), tty->count);
1640 #endif
1641
1642 #ifdef TTY_PARANOIA_CHECK
1643         if (tty->driver->other &&
1644              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1645                 if (o_tty != tty->driver->other->ttys[idx]) {
1646                         tty_unlock();
1647                         printk(KERN_DEBUG "tty_release_dev: other->table[%d] "
1648                                           "not o_tty for (%s)\n",
1649                                idx, tty->name);
1650                         return 0 ;
1651                 }
1652                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1653                         tty_unlock();
1654                         printk(KERN_DEBUG "tty_release_dev: other->termios[%d] "
1655                                           "not o_termios for (%s)\n",
1656                                idx, tty->name);
1657                         return 0;
1658                 }
1659                 if (o_tty->link != tty) {
1660                         tty_unlock();
1661                         printk(KERN_DEBUG "tty_release_dev: bad pty pointers\n");
1662                         return 0;
1663                 }
1664         }
1665 #endif
1666         if (tty->ops->close)
1667                 tty->ops->close(tty, filp);
1668
1669         tty_unlock();
1670         /*
1671          * Sanity check: if tty->count is going to zero, there shouldn't be
1672          * any waiters on tty->read_wait or tty->write_wait.  We test the
1673          * wait queues and kick everyone out _before_ actually starting to
1674          * close.  This ensures that we won't block while releasing the tty
1675          * structure.
1676          *
1677          * The test for the o_tty closing is necessary, since the master and
1678          * slave sides may close in any order.  If the slave side closes out
1679          * first, its count will be one, since the master side holds an open.
1680          * Thus this test wouldn't be triggered at the time the slave closes,
1681          * so we do it now.
1682          *
1683          * Note that it's possible for the tty to be opened again while we're
1684          * flushing out waiters.  By recalculating the closing flags before
1685          * each iteration we avoid any problems.
1686          */
1687         while (1) {
1688                 /* Guard against races with tty->count changes elsewhere and
1689                    opens on /dev/tty */
1690
1691                 mutex_lock(&tty_mutex);
1692                 tty_lock();
1693                 tty_closing = tty->count <= 1;
1694                 o_tty_closing = o_tty &&
1695                         (o_tty->count <= (pty_master ? 1 : 0));
1696                 do_sleep = 0;
1697
1698                 if (tty_closing) {
1699                         if (waitqueue_active(&tty->read_wait)) {
1700                                 wake_up_poll(&tty->read_wait, POLLIN);
1701                                 do_sleep++;
1702                         }
1703                         if (waitqueue_active(&tty->write_wait)) {
1704                                 wake_up_poll(&tty->write_wait, POLLOUT);
1705                                 do_sleep++;
1706                         }
1707                 }
1708                 if (o_tty_closing) {
1709                         if (waitqueue_active(&o_tty->read_wait)) {
1710                                 wake_up_poll(&o_tty->read_wait, POLLIN);
1711                                 do_sleep++;
1712                         }
1713                         if (waitqueue_active(&o_tty->write_wait)) {
1714                                 wake_up_poll(&o_tty->write_wait, POLLOUT);
1715                                 do_sleep++;
1716                         }
1717                 }
1718                 if (!do_sleep)
1719                         break;
1720
1721                 printk(KERN_WARNING "tty_release_dev: %s: read/write wait queue "
1722                                     "active!\n", tty_name(tty, buf));
1723                 tty_unlock();
1724                 mutex_unlock(&tty_mutex);
1725                 schedule_timeout_killable(timeout);
1726                 if (timeout < 120 * HZ)
1727                         timeout = 2 * timeout + 1;
1728                 else
1729                         timeout = MAX_SCHEDULE_TIMEOUT;
1730         }
1731
1732         /*
1733          * The closing flags are now consistent with the open counts on
1734          * both sides, and we've completed the last operation that could
1735          * block, so it's safe to proceed with closing.
1736          */
1737         if (pty_master) {
1738                 if (--o_tty->count < 0) {
1739                         printk(KERN_WARNING "tty_release_dev: bad pty slave count "
1740                                             "(%d) for %s\n",
1741                                o_tty->count, tty_name(o_tty, buf));
1742                         o_tty->count = 0;
1743                 }
1744         }
1745         if (--tty->count < 0) {
1746                 printk(KERN_WARNING "tty_release_dev: bad tty->count (%d) for %s\n",
1747                        tty->count, tty_name(tty, buf));
1748                 tty->count = 0;
1749         }
1750
1751         /*
1752          * We've decremented tty->count, so we need to remove this file
1753          * descriptor off the tty->tty_files list; this serves two
1754          * purposes:
1755          *  - check_tty_count sees the correct number of file descriptors
1756          *    associated with this tty.
1757          *  - do_tty_hangup no longer sees this file descriptor as
1758          *    something that needs to be handled for hangups.
1759          */
1760         tty_del_file(filp);
1761
1762         /*
1763          * Perform some housekeeping before deciding whether to return.
1764          *
1765          * Set the TTY_CLOSING flag if this was the last open.  In the
1766          * case of a pty we may have to wait around for the other side
1767          * to close, and TTY_CLOSING makes sure we can't be reopened.
1768          */
1769         if (tty_closing)
1770                 set_bit(TTY_CLOSING, &tty->flags);
1771         if (o_tty_closing)
1772                 set_bit(TTY_CLOSING, &o_tty->flags);
1773
1774         /*
1775          * If _either_ side is closing, make sure there aren't any
1776          * processes that still think tty or o_tty is their controlling
1777          * tty.
1778          */
1779         if (tty_closing || o_tty_closing) {
1780                 read_lock(&tasklist_lock);
1781                 session_clear_tty(tty->session);
1782                 if (o_tty)
1783                         session_clear_tty(o_tty->session);
1784                 read_unlock(&tasklist_lock);
1785         }
1786
1787         mutex_unlock(&tty_mutex);
1788
1789         /* check whether both sides are closing ... */
1790         if (!tty_closing || (o_tty && !o_tty_closing)) {
1791                 tty_unlock();
1792                 return 0;
1793         }
1794
1795 #ifdef TTY_DEBUG_HANGUP
1796         printk(KERN_DEBUG "freeing tty structure...");
1797 #endif
1798         /*
1799          * Ask the line discipline code to release its structures
1800          */
1801         tty_ldisc_release(tty, o_tty);
1802         /*
1803          * The release_tty function takes care of the details of clearing
1804          * the slots and preserving the termios structure.
1805          */
1806         release_tty(tty, idx);
1807
1808         /* Make this pty number available for reallocation */
1809         if (devpts)
1810                 devpts_kill_index(inode, idx);
1811         tty_unlock();
1812         return 0;
1813 }
1814
1815 /**
1816  *      tty_open                -       open a tty device
1817  *      @inode: inode of device file
1818  *      @filp: file pointer to tty
1819  *
1820  *      tty_open and tty_release keep up the tty count that contains the
1821  *      number of opens done on a tty. We cannot use the inode-count, as
1822  *      different inodes might point to the same tty.
1823  *
1824  *      Open-counting is needed for pty masters, as well as for keeping
1825  *      track of serial lines: DTR is dropped when the last close happens.
1826  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
1827  *
1828  *      The termios state of a pty is reset on first open so that
1829  *      settings don't persist across reuse.
1830  *
1831  *      Locking: tty_mutex protects tty, get_tty_driver and tty_init_dev work.
1832  *               tty->count should protect the rest.
1833  *               ->siglock protects ->signal/->sighand
1834  */
1835
1836 static int tty_open(struct inode *inode, struct file *filp)
1837 {
1838         struct tty_struct *tty = NULL;
1839         int noctty, retval;
1840         struct tty_driver *driver;
1841         int index;
1842         dev_t device = inode->i_rdev;
1843         unsigned saved_flags = filp->f_flags;
1844
1845         nonseekable_open(inode, filp);
1846
1847 retry_open:
1848         retval = tty_alloc_file(filp);
1849         if (retval)
1850                 return -ENOMEM;
1851
1852         noctty = filp->f_flags & O_NOCTTY;
1853         index  = -1;
1854         retval = 0;
1855
1856         mutex_lock(&tty_mutex);
1857         tty_lock();
1858
1859         if (device == MKDEV(TTYAUX_MAJOR, 0)) {
1860                 tty = get_current_tty();
1861                 if (!tty) {
1862                         tty_unlock();
1863                         mutex_unlock(&tty_mutex);
1864                         tty_free_file(filp);
1865                         return -ENXIO;
1866                 }
1867                 driver = tty_driver_kref_get(tty->driver);
1868                 index = tty->index;
1869                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1870                 /* noctty = 1; */
1871                 /* FIXME: Should we take a driver reference ? */
1872                 tty_kref_put(tty);
1873                 goto got_driver;
1874         }
1875 #ifdef CONFIG_VT
1876         if (device == MKDEV(TTY_MAJOR, 0)) {
1877                 extern struct tty_driver *console_driver;
1878                 driver = tty_driver_kref_get(console_driver);
1879                 index = fg_console;
1880                 noctty = 1;
1881                 goto got_driver;
1882         }
1883 #endif
1884         if (device == MKDEV(TTYAUX_MAJOR, 1)) {
1885                 struct tty_driver *console_driver = console_device(&index);
1886                 if (console_driver) {
1887                         driver = tty_driver_kref_get(console_driver);
1888                         if (driver) {
1889                                 /* Don't let /dev/console block */
1890                                 filp->f_flags |= O_NONBLOCK;
1891                                 noctty = 1;
1892                                 goto got_driver;
1893                         }
1894                 }
1895                 tty_unlock();
1896                 mutex_unlock(&tty_mutex);
1897                 tty_free_file(filp);
1898                 return -ENODEV;
1899         }
1900
1901         driver = get_tty_driver(device, &index);
1902         if (!driver) {
1903                 tty_unlock();
1904                 mutex_unlock(&tty_mutex);
1905                 tty_free_file(filp);
1906                 return -ENODEV;
1907         }
1908 got_driver:
1909         if (!tty) {
1910                 /* check whether we're reopening an existing tty */
1911                 tty = tty_driver_lookup_tty(driver, inode, index);
1912
1913                 if (IS_ERR(tty)) {
1914                         tty_unlock();
1915                         mutex_unlock(&tty_mutex);
1916                         tty_driver_kref_put(driver);
1917                         tty_free_file(filp);
1918                         return PTR_ERR(tty);
1919                 }
1920         }
1921
1922         if (tty) {
1923                 retval = tty_reopen(tty);
1924                 if (retval)
1925                         tty = ERR_PTR(retval);
1926         } else
1927                 tty = tty_init_dev(driver, index, 0);
1928
1929         mutex_unlock(&tty_mutex);
1930         tty_driver_kref_put(driver);
1931         if (IS_ERR(tty)) {
1932                 tty_unlock();
1933                 tty_free_file(filp);
1934                 return PTR_ERR(tty);
1935         }
1936
1937         tty_add_file(tty, filp);
1938
1939         check_tty_count(tty, "tty_open");
1940         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1941             tty->driver->subtype == PTY_TYPE_MASTER)
1942                 noctty = 1;
1943 #ifdef TTY_DEBUG_HANGUP
1944         printk(KERN_DEBUG "opening %s...", tty->name);
1945 #endif
1946         if (tty->ops->open)
1947                 retval = tty->ops->open(tty, filp);
1948         else
1949                 retval = -ENODEV;
1950         filp->f_flags = saved_flags;
1951
1952         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
1953                                                 !capable(CAP_SYS_ADMIN))
1954                 retval = -EBUSY;
1955
1956         if (retval) {
1957 #ifdef TTY_DEBUG_HANGUP
1958                 printk(KERN_DEBUG "error %d in opening %s...", retval,
1959                        tty->name);
1960 #endif
1961                 tty_unlock(); /* need to call tty_release without BTM */
1962                 tty_release(inode, filp);
1963                 if (retval != -ERESTARTSYS)
1964                         return retval;
1965
1966                 if (signal_pending(current))
1967                         return retval;
1968
1969                 schedule();
1970                 /*
1971                  * Need to reset f_op in case a hangup happened.
1972                  */
1973                 tty_lock();
1974                 if (filp->f_op == &hung_up_tty_fops)
1975                         filp->f_op = &tty_fops;
1976                 tty_unlock();
1977                 goto retry_open;
1978         }
1979         tty_unlock();
1980
1981
1982         mutex_lock(&tty_mutex);
1983         tty_lock();
1984         spin_lock_irq(&current->sighand->siglock);
1985         if (!noctty &&
1986             current->signal->leader &&
1987             !current->signal->tty &&
1988             tty->session == NULL) {
1989                 /*
1990                  * Don't let a process that only has write access to the tty
1991                  * obtain the privileges associated with having a tty as
1992                  * controlling terminal (being able to reopen it with full
1993                  * access through /dev/tty, being able to perform pushback).
1994                  * Many distributions set the group of all ttys to "tty" and
1995                  * grant write-only access to all terminals for setgid tty
1996                  * binaries, which should not imply full privileges on all ttys.
1997                  *
1998                  * This could theoretically break old code that performs open()
1999                  * on a write-only file descriptor. In that case, it might be
2000                  * necessary to also permit this if
2001                  * inode_permission(inode, MAY_READ) == 0.
2002                  */
2003                 if (filp->f_mode & FMODE_READ)
2004                         __proc_set_tty(current, tty);
2005         }
2006         spin_unlock_irq(&current->sighand->siglock);
2007         tty_unlock();
2008         mutex_unlock(&tty_mutex);
2009         return 0;
2010 }
2011
2012
2013
2014 /**
2015  *      tty_poll        -       check tty status
2016  *      @filp: file being polled
2017  *      @wait: poll wait structures to update
2018  *
2019  *      Call the line discipline polling method to obtain the poll
2020  *      status of the device.
2021  *
2022  *      Locking: locks called line discipline but ldisc poll method
2023  *      may be re-entered freely by other callers.
2024  */
2025
2026 static unsigned int tty_poll(struct file *filp, poll_table *wait)
2027 {
2028         struct tty_struct *tty = file_tty(filp);
2029         struct tty_ldisc *ld;
2030         int ret = 0;
2031
2032         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2033                 return 0;
2034
2035         ld = tty_ldisc_ref_wait(tty);
2036         if (ld->ops->poll)
2037                 ret = (ld->ops->poll)(tty, filp, wait);
2038         tty_ldisc_deref(ld);
2039         return ret;
2040 }
2041
2042 static int __tty_fasync(int fd, struct file *filp, int on)
2043 {
2044         struct tty_struct *tty = file_tty(filp);
2045         unsigned long flags;
2046         int retval = 0;
2047
2048         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2049                 goto out;
2050
2051         retval = fasync_helper(fd, filp, on, &tty->fasync);
2052         if (retval <= 0)
2053                 goto out;
2054
2055         if (on) {
2056                 enum pid_type type;
2057                 struct pid *pid;
2058                 if (!waitqueue_active(&tty->read_wait))
2059                         tty->minimum_to_wake = 1;
2060                 spin_lock_irqsave(&tty->ctrl_lock, flags);
2061                 if (tty->pgrp) {
2062                         pid = tty->pgrp;
2063                         type = PIDTYPE_PGID;
2064                 } else {
2065                         pid = task_pid(current);
2066                         type = PIDTYPE_PID;
2067                 }
2068                 get_pid(pid);
2069                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2070                 retval = __f_setown(filp, pid, type, 0);
2071                 put_pid(pid);
2072                 if (retval)
2073                         goto out;
2074         } else {
2075                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2076                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2077         }
2078         retval = 0;
2079 out:
2080         return retval;
2081 }
2082
2083 static int tty_fasync(int fd, struct file *filp, int on)
2084 {
2085         int retval;
2086         tty_lock();
2087         retval = __tty_fasync(fd, filp, on);
2088         tty_unlock();
2089         return retval;
2090 }
2091
2092 /**
2093  *      tiocsti                 -       fake input character
2094  *      @tty: tty to fake input into
2095  *      @p: pointer to character
2096  *
2097  *      Fake input to a tty device. Does the necessary locking and
2098  *      input management.
2099  *
2100  *      FIXME: does not honour flow control ??
2101  *
2102  *      Locking:
2103  *              Called functions take tty_ldisc_lock
2104  *              current->signal->tty check is safe without locks
2105  *
2106  *      FIXME: may race normal receive processing
2107  */
2108
2109 static int tiocsti(struct tty_struct *tty, char __user *p)
2110 {
2111         char ch, mbz = 0;
2112         struct tty_ldisc *ld;
2113
2114         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2115                 return -EPERM;
2116         if (get_user(ch, p))
2117                 return -EFAULT;
2118         tty_audit_tiocsti(tty, ch);
2119         ld = tty_ldisc_ref_wait(tty);
2120         ld->ops->receive_buf(tty, &ch, &mbz, 1);
2121         tty_ldisc_deref(ld);
2122         return 0;
2123 }
2124
2125 /**
2126  *      tiocgwinsz              -       implement window query ioctl
2127  *      @tty; tty
2128  *      @arg: user buffer for result
2129  *
2130  *      Copies the kernel idea of the window size into the user buffer.
2131  *
2132  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2133  *              is consistent.
2134  */
2135
2136 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2137 {
2138         int err;
2139
2140         mutex_lock(&tty->termios_mutex);
2141         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2142         mutex_unlock(&tty->termios_mutex);
2143
2144         return err ? -EFAULT: 0;
2145 }
2146
2147 /**
2148  *      tty_do_resize           -       resize event
2149  *      @tty: tty being resized
2150  *      @rows: rows (character)
2151  *      @cols: cols (character)
2152  *
2153  *      Update the termios variables and send the necessary signals to
2154  *      peform a terminal resize correctly
2155  */
2156
2157 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2158 {
2159         struct pid *pgrp;
2160         unsigned long flags;
2161
2162         /* Lock the tty */
2163         mutex_lock(&tty->termios_mutex);
2164         if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2165                 goto done;
2166         /* Get the PID values and reference them so we can
2167            avoid holding the tty ctrl lock while sending signals */
2168         spin_lock_irqsave(&tty->ctrl_lock, flags);
2169         pgrp = get_pid(tty->pgrp);
2170         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2171
2172         if (pgrp)
2173                 kill_pgrp(pgrp, SIGWINCH, 1);
2174         put_pid(pgrp);
2175
2176         tty->winsize = *ws;
2177 done:
2178         mutex_unlock(&tty->termios_mutex);
2179         return 0;
2180 }
2181
2182 /**
2183  *      tiocswinsz              -       implement window size set ioctl
2184  *      @tty; tty side of tty
2185  *      @arg: user buffer for result
2186  *
2187  *      Copies the user idea of the window size to the kernel. Traditionally
2188  *      this is just advisory information but for the Linux console it
2189  *      actually has driver level meaning and triggers a VC resize.
2190  *
2191  *      Locking:
2192  *              Driver dependent. The default do_resize method takes the
2193  *      tty termios mutex and ctrl_lock. The console takes its own lock
2194  *      then calls into the default method.
2195  */
2196
2197 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2198 {
2199         struct winsize tmp_ws;
2200         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2201                 return -EFAULT;
2202
2203         if (tty->ops->resize)
2204                 return tty->ops->resize(tty, &tmp_ws);
2205         else
2206                 return tty_do_resize(tty, &tmp_ws);
2207 }
2208
2209 /**
2210  *      tioccons        -       allow admin to move logical console
2211  *      @file: the file to become console
2212  *
2213  *      Allow the administrator to move the redirected console device
2214  *
2215  *      Locking: uses redirect_lock to guard the redirect information
2216  */
2217
2218 static int tioccons(struct file *file)
2219 {
2220         if (!capable(CAP_SYS_ADMIN))
2221                 return -EPERM;
2222         if (file->f_op->write == redirected_tty_write) {
2223                 struct file *f;
2224                 spin_lock(&redirect_lock);
2225                 f = redirect;
2226                 redirect = NULL;
2227                 spin_unlock(&redirect_lock);
2228                 if (f)
2229                         fput(f);
2230                 return 0;
2231         }
2232         spin_lock(&redirect_lock);
2233         if (redirect) {
2234                 spin_unlock(&redirect_lock);
2235                 return -EBUSY;
2236         }
2237         get_file(file);
2238         redirect = file;
2239         spin_unlock(&redirect_lock);
2240         return 0;
2241 }
2242
2243 /**
2244  *      fionbio         -       non blocking ioctl
2245  *      @file: file to set blocking value
2246  *      @p: user parameter
2247  *
2248  *      Historical tty interfaces had a blocking control ioctl before
2249  *      the generic functionality existed. This piece of history is preserved
2250  *      in the expected tty API of posix OS's.
2251  *
2252  *      Locking: none, the open file handle ensures it won't go away.
2253  */
2254
2255 static int fionbio(struct file *file, int __user *p)
2256 {
2257         int nonblock;
2258
2259         if (get_user(nonblock, p))
2260                 return -EFAULT;
2261
2262         spin_lock(&file->f_lock);
2263         if (nonblock)
2264                 file->f_flags |= O_NONBLOCK;
2265         else
2266                 file->f_flags &= ~O_NONBLOCK;
2267         spin_unlock(&file->f_lock);
2268         return 0;
2269 }
2270
2271 /**
2272  *      tiocsctty       -       set controlling tty
2273  *      @tty: tty structure
2274  *      @arg: user argument
2275  *
2276  *      This ioctl is used to manage job control. It permits a session
2277  *      leader to set this tty as the controlling tty for the session.
2278  *
2279  *      Locking:
2280  *              Takes tty_mutex() to protect tty instance
2281  *              Takes tasklist_lock internally to walk sessions
2282  *              Takes ->siglock() when updating signal->tty
2283  */
2284
2285 static int tiocsctty(struct tty_struct *tty, struct file *file, int arg)
2286 {
2287         int ret = 0;
2288         if (current->signal->leader && (task_session(current) == tty->session))
2289                 return ret;
2290
2291         mutex_lock(&tty_mutex);
2292         /*
2293          * The process must be a session leader and
2294          * not have a controlling tty already.
2295          */
2296         if (!current->signal->leader || current->signal->tty) {
2297                 ret = -EPERM;
2298                 goto unlock;
2299         }
2300
2301         if (tty->session) {
2302                 /*
2303                  * This tty is already the controlling
2304                  * tty for another session group!
2305                  */
2306                 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2307                         /*
2308                          * Steal it away
2309                          */
2310                         read_lock(&tasklist_lock);
2311                         session_clear_tty(tty->session);
2312                         read_unlock(&tasklist_lock);
2313                 } else {
2314                         ret = -EPERM;
2315                         goto unlock;
2316                 }
2317         }
2318
2319         /* See the comment in tty_open(). */
2320         if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) {
2321                 ret = -EPERM;
2322                 goto unlock;
2323         }
2324
2325         proc_set_tty(current, tty);
2326 unlock:
2327         mutex_unlock(&tty_mutex);
2328         return ret;
2329 }
2330
2331 /**
2332  *      tty_get_pgrp    -       return a ref counted pgrp pid
2333  *      @tty: tty to read
2334  *
2335  *      Returns a refcounted instance of the pid struct for the process
2336  *      group controlling the tty.
2337  */
2338
2339 struct pid *tty_get_pgrp(struct tty_struct *tty)
2340 {
2341         unsigned long flags;
2342         struct pid *pgrp;
2343
2344         spin_lock_irqsave(&tty->ctrl_lock, flags);
2345         pgrp = get_pid(tty->pgrp);
2346         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2347
2348         return pgrp;
2349 }
2350 EXPORT_SYMBOL_GPL(tty_get_pgrp);
2351
2352 /**
2353  *      tiocgpgrp               -       get process group
2354  *      @tty: tty passed by user
2355  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2356  *      @p: returned pid
2357  *
2358  *      Obtain the process group of the tty. If there is no process group
2359  *      return an error.
2360  *
2361  *      Locking: none. Reference to current->signal->tty is safe.
2362  */
2363
2364 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2365 {
2366         struct pid *pid;
2367         int ret;
2368         /*
2369          * (tty == real_tty) is a cheap way of
2370          * testing if the tty is NOT a master pty.
2371          */
2372         if (tty == real_tty && current->signal->tty != real_tty)
2373                 return -ENOTTY;
2374         pid = tty_get_pgrp(real_tty);
2375         ret =  put_user(pid_vnr(pid), p);
2376         put_pid(pid);
2377         return ret;
2378 }
2379
2380 /**
2381  *      tiocspgrp               -       attempt to set process group
2382  *      @tty: tty passed by user
2383  *      @real_tty: tty side device matching tty passed by user
2384  *      @p: pid pointer
2385  *
2386  *      Set the process group of the tty to the session passed. Only
2387  *      permitted where the tty session is our session.
2388  *
2389  *      Locking: RCU, ctrl lock
2390  */
2391
2392 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2393 {
2394         struct pid *pgrp;
2395         pid_t pgrp_nr;
2396         int retval = tty_check_change(real_tty);
2397         unsigned long flags;
2398
2399         if (retval == -EIO)
2400                 return -ENOTTY;
2401         if (retval)
2402                 return retval;
2403         if (!current->signal->tty ||
2404             (current->signal->tty != real_tty) ||
2405             (real_tty->session != task_session(current)))
2406                 return -ENOTTY;
2407         if (get_user(pgrp_nr, p))
2408                 return -EFAULT;
2409         if (pgrp_nr < 0)
2410                 return -EINVAL;
2411         rcu_read_lock();
2412         pgrp = find_vpid(pgrp_nr);
2413         retval = -ESRCH;
2414         if (!pgrp)
2415                 goto out_unlock;
2416         retval = -EPERM;
2417         if (session_of_pgrp(pgrp) != task_session(current))
2418                 goto out_unlock;
2419         retval = 0;
2420         spin_lock_irqsave(&tty->ctrl_lock, flags);
2421         put_pid(real_tty->pgrp);
2422         real_tty->pgrp = get_pid(pgrp);
2423         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2424 out_unlock:
2425         rcu_read_unlock();
2426         return retval;
2427 }
2428
2429 /**
2430  *      tiocgsid                -       get session id
2431  *      @tty: tty passed by user
2432  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2433  *      @p: pointer to returned session id
2434  *
2435  *      Obtain the session id of the tty. If there is no session
2436  *      return an error.
2437  *
2438  *      Locking: none. Reference to current->signal->tty is safe.
2439  */
2440
2441 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2442 {
2443         /*
2444          * (tty == real_tty) is a cheap way of
2445          * testing if the tty is NOT a master pty.
2446         */
2447         if (tty == real_tty && current->signal->tty != real_tty)
2448                 return -ENOTTY;
2449         if (!real_tty->session)
2450                 return -ENOTTY;
2451         return put_user(pid_vnr(real_tty->session), p);
2452 }
2453
2454 /**
2455  *      tiocsetd        -       set line discipline
2456  *      @tty: tty device
2457  *      @p: pointer to user data
2458  *
2459  *      Set the line discipline according to user request.
2460  *
2461  *      Locking: see tty_set_ldisc, this function is just a helper
2462  */
2463
2464 static int tiocsetd(struct tty_struct *tty, int __user *p)
2465 {
2466         int ldisc;
2467         int ret;
2468
2469         if (get_user(ldisc, p))
2470                 return -EFAULT;
2471
2472         ret = tty_set_ldisc(tty, ldisc);
2473
2474         return ret;
2475 }
2476
2477 /**
2478  *      send_break      -       performed time break
2479  *      @tty: device to break on
2480  *      @duration: timeout in mS
2481  *
2482  *      Perform a timed break on hardware that lacks its own driver level
2483  *      timed break functionality.
2484  *
2485  *      Locking:
2486  *              atomic_write_lock serializes
2487  *
2488  */
2489
2490 static int send_break(struct tty_struct *tty, unsigned int duration)
2491 {
2492         int retval;
2493
2494         if (tty->ops->break_ctl == NULL)
2495                 return 0;
2496
2497         if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2498                 retval = tty->ops->break_ctl(tty, duration);
2499         else {
2500                 /* Do the work ourselves */
2501                 if (tty_write_lock(tty, 0) < 0)
2502                         return -EINTR;
2503                 retval = tty->ops->break_ctl(tty, -1);
2504                 if (retval)
2505                         goto out;
2506                 if (!signal_pending(current))
2507                         msleep_interruptible(duration);
2508                 retval = tty->ops->break_ctl(tty, 0);
2509 out:
2510                 tty_write_unlock(tty);
2511                 if (signal_pending(current))
2512                         retval = -EINTR;
2513         }
2514         return retval;
2515 }
2516
2517 /**
2518  *      tty_tiocmget            -       get modem status
2519  *      @tty: tty device
2520  *      @file: user file pointer
2521  *      @p: pointer to result
2522  *
2523  *      Obtain the modem status bits from the tty driver if the feature
2524  *      is supported. Return -EINVAL if it is not available.
2525  *
2526  *      Locking: none (up to the driver)
2527  */
2528
2529 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2530 {
2531         int retval = -EINVAL;
2532
2533         if (tty->ops->tiocmget) {
2534                 retval = tty->ops->tiocmget(tty);
2535
2536                 if (retval >= 0)
2537                         retval = put_user(retval, p);
2538         }
2539         return retval;
2540 }
2541
2542 /**
2543  *      tty_tiocmset            -       set modem status
2544  *      @tty: tty device
2545  *      @cmd: command - clear bits, set bits or set all
2546  *      @p: pointer to desired bits
2547  *
2548  *      Set the modem status bits from the tty driver if the feature
2549  *      is supported. Return -EINVAL if it is not available.
2550  *
2551  *      Locking: none (up to the driver)
2552  */
2553
2554 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2555              unsigned __user *p)
2556 {
2557         int retval;
2558         unsigned int set, clear, val;
2559
2560         if (tty->ops->tiocmset == NULL)
2561                 return -EINVAL;
2562
2563         retval = get_user(val, p);
2564         if (retval)
2565                 return retval;
2566         set = clear = 0;
2567         switch (cmd) {
2568         case TIOCMBIS:
2569                 set = val;
2570                 break;
2571         case TIOCMBIC:
2572                 clear = val;
2573                 break;
2574         case TIOCMSET:
2575                 set = val;
2576                 clear = ~val;
2577                 break;
2578         }
2579         set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2580         clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2581         return tty->ops->tiocmset(tty, set, clear);
2582 }
2583
2584 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2585 {
2586         int retval = -EINVAL;
2587         struct serial_icounter_struct icount;
2588         memset(&icount, 0, sizeof(icount));
2589         if (tty->ops->get_icount)
2590                 retval = tty->ops->get_icount(tty, &icount);
2591         if (retval != 0)
2592                 return retval;
2593         if (copy_to_user(arg, &icount, sizeof(icount)))
2594                 return -EFAULT;
2595         return 0;
2596 }
2597
2598 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2599 {
2600         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2601             tty->driver->subtype == PTY_TYPE_MASTER)
2602                 tty = tty->link;
2603         return tty;
2604 }
2605 EXPORT_SYMBOL(tty_pair_get_tty);
2606
2607 struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2608 {
2609         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2610             tty->driver->subtype == PTY_TYPE_MASTER)
2611             return tty;
2612         return tty->link;
2613 }
2614 EXPORT_SYMBOL(tty_pair_get_pty);
2615
2616 /*
2617  * Split this up, as gcc can choke on it otherwise..
2618  */
2619 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2620 {
2621         struct tty_struct *tty = file_tty(file);
2622         struct tty_struct *real_tty;
2623         void __user *p = (void __user *)arg;
2624         int retval;
2625         struct tty_ldisc *ld;
2626         struct inode *inode = file->f_dentry->d_inode;
2627
2628         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2629                 return -EINVAL;
2630
2631         real_tty = tty_pair_get_tty(tty);
2632
2633         /*
2634          * Factor out some common prep work
2635          */
2636         switch (cmd) {
2637         case TIOCSETD:
2638         case TIOCSBRK:
2639         case TIOCCBRK:
2640         case TCSBRK:
2641         case TCSBRKP:
2642                 retval = tty_check_change(tty);
2643                 if (retval)
2644                         return retval;
2645                 if (cmd != TIOCCBRK) {
2646                         tty_wait_until_sent(tty, 0);
2647                         if (signal_pending(current))
2648                                 return -EINTR;
2649                 }
2650                 break;
2651         }
2652
2653         /*
2654          *      Now do the stuff.
2655          */
2656         switch (cmd) {
2657         case TIOCSTI:
2658                 return tiocsti(tty, p);
2659         case TIOCGWINSZ:
2660                 return tiocgwinsz(real_tty, p);
2661         case TIOCSWINSZ:
2662                 return tiocswinsz(real_tty, p);
2663         case TIOCCONS:
2664                 return real_tty != tty ? -EINVAL : tioccons(file);
2665         case FIONBIO:
2666                 return fionbio(file, p);
2667         case TIOCEXCL:
2668                 set_bit(TTY_EXCLUSIVE, &tty->flags);
2669                 return 0;
2670         case TIOCNXCL:
2671                 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2672                 return 0;
2673         case TIOCNOTTY:
2674                 if (current->signal->tty != tty)
2675                         return -ENOTTY;
2676                 no_tty();
2677                 return 0;
2678         case TIOCSCTTY:
2679                 return tiocsctty(tty, file, arg);
2680         case TIOCGPGRP:
2681                 return tiocgpgrp(tty, real_tty, p);
2682         case TIOCSPGRP:
2683                 return tiocspgrp(tty, real_tty, p);
2684         case TIOCGSID:
2685                 return tiocgsid(tty, real_tty, p);
2686         case TIOCGETD:
2687                 return put_user(tty->ldisc->ops->num, (int __user *)p);
2688         case TIOCSETD:
2689                 return tiocsetd(tty, p);
2690         case TIOCVHANGUP:
2691                 if (!capable(CAP_SYS_ADMIN))
2692                         return -EPERM;
2693                 tty_vhangup(tty);
2694                 return 0;
2695         case TIOCGDEV:
2696         {
2697                 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2698                 return put_user(ret, (unsigned int __user *)p);
2699         }
2700         /*
2701          * Break handling
2702          */
2703         case TIOCSBRK:  /* Turn break on, unconditionally */
2704                 if (tty->ops->break_ctl)
2705                         return tty->ops->break_ctl(tty, -1);
2706                 return 0;
2707         case TIOCCBRK:  /* Turn break off, unconditionally */
2708                 if (tty->ops->break_ctl)
2709                         return tty->ops->break_ctl(tty, 0);
2710                 return 0;
2711         case TCSBRK:   /* SVID version: non-zero arg --> no break */
2712                 /* non-zero arg means wait for all output data
2713                  * to be sent (performed above) but don't send break.
2714                  * This is used by the tcdrain() termios function.
2715                  */
2716                 if (!arg)
2717                         return send_break(tty, 250);
2718                 return 0;
2719         case TCSBRKP:   /* support for POSIX tcsendbreak() */
2720                 return send_break(tty, arg ? arg*100 : 250);
2721
2722         case TIOCMGET:
2723                 return tty_tiocmget(tty, p);
2724         case TIOCMSET:
2725         case TIOCMBIC:
2726         case TIOCMBIS:
2727                 return tty_tiocmset(tty, cmd, p);
2728         case TIOCGICOUNT:
2729                 retval = tty_tiocgicount(tty, p);
2730                 /* For the moment allow fall through to the old method */
2731                 if (retval != -EINVAL)
2732                         return retval;
2733                 break;
2734         case TCFLSH:
2735                 switch (arg) {
2736                 case TCIFLUSH:
2737                 case TCIOFLUSH:
2738                 /* flush tty buffer and allow ldisc to process ioctl */
2739                         tty_buffer_flush(tty);
2740                         break;
2741                 }
2742                 break;
2743         }
2744         if (tty->ops->ioctl) {
2745                 retval = (tty->ops->ioctl)(tty, cmd, arg);
2746                 if (retval != -ENOIOCTLCMD)
2747                         return retval;
2748         }
2749         ld = tty_ldisc_ref_wait(tty);
2750         retval = -EINVAL;
2751         if (ld->ops->ioctl) {
2752                 retval = ld->ops->ioctl(tty, file, cmd, arg);
2753                 if (retval == -ENOIOCTLCMD)
2754                         retval = -EINVAL;
2755         }
2756         tty_ldisc_deref(ld);
2757         return retval;
2758 }
2759
2760 #ifdef CONFIG_COMPAT
2761 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2762                                 unsigned long arg)
2763 {
2764         struct inode *inode = file->f_dentry->d_inode;
2765         struct tty_struct *tty = file_tty(file);
2766         struct tty_ldisc *ld;
2767         int retval = -ENOIOCTLCMD;
2768
2769         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2770                 return -EINVAL;
2771
2772         if (tty->ops->compat_ioctl) {
2773                 retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2774                 if (retval != -ENOIOCTLCMD)
2775                         return retval;
2776         }
2777
2778         ld = tty_ldisc_ref_wait(tty);
2779         if (ld->ops->compat_ioctl)
2780                 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2781         else
2782                 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2783         tty_ldisc_deref(ld);
2784
2785         return retval;
2786 }
2787 #endif
2788
2789 /*
2790  * This implements the "Secure Attention Key" ---  the idea is to
2791  * prevent trojan horses by killing all processes associated with this
2792  * tty when the user hits the "Secure Attention Key".  Required for
2793  * super-paranoid applications --- see the Orange Book for more details.
2794  *
2795  * This code could be nicer; ideally it should send a HUP, wait a few
2796  * seconds, then send a INT, and then a KILL signal.  But you then
2797  * have to coordinate with the init process, since all processes associated
2798  * with the current tty must be dead before the new getty is allowed
2799  * to spawn.
2800  *
2801  * Now, if it would be correct ;-/ The current code has a nasty hole -
2802  * it doesn't catch files in flight. We may send the descriptor to ourselves
2803  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2804  *
2805  * Nasty bug: do_SAK is being called in interrupt context.  This can
2806  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2807  */
2808 void __do_SAK(struct tty_struct *tty)
2809 {
2810 #ifdef TTY_SOFT_SAK
2811         tty_hangup(tty);
2812 #else
2813         struct task_struct *g, *p;
2814         struct pid *session;
2815         int             i;
2816         struct file     *filp;
2817         struct fdtable *fdt;
2818
2819         if (!tty)
2820                 return;
2821         session = tty->session;
2822
2823         tty_ldisc_flush(tty);
2824
2825         tty_driver_flush_buffer(tty);
2826
2827         read_lock(&tasklist_lock);
2828         /* Kill the entire session */
2829         do_each_pid_task(session, PIDTYPE_SID, p) {
2830                 printk(KERN_NOTICE "SAK: killed process %d"
2831                         " (%s): task_session(p)==tty->session\n",
2832                         task_pid_nr(p), p->comm);
2833                 send_sig(SIGKILL, p, 1);
2834         } while_each_pid_task(session, PIDTYPE_SID, p);
2835         /* Now kill any processes that happen to have the
2836          * tty open.
2837          */
2838         do_each_thread(g, p) {
2839                 if (p->signal->tty == tty) {
2840                         printk(KERN_NOTICE "SAK: killed process %d"
2841                             " (%s): task_session(p)==tty->session\n",
2842                             task_pid_nr(p), p->comm);
2843                         send_sig(SIGKILL, p, 1);
2844                         continue;
2845                 }
2846                 task_lock(p);
2847                 if (p->files) {
2848                         /*
2849                          * We don't take a ref to the file, so we must
2850                          * hold ->file_lock instead.
2851                          */
2852                         spin_lock(&p->files->file_lock);
2853                         fdt = files_fdtable(p->files);
2854                         for (i = 0; i < fdt->max_fds; i++) {
2855                                 filp = fcheck_files(p->files, i);
2856                                 if (!filp)
2857                                         continue;
2858                                 if (filp->f_op->read == tty_read &&
2859                                     file_tty(filp) == tty) {
2860                                         printk(KERN_NOTICE "SAK: killed process %d"
2861                                             " (%s): fd#%d opened to the tty\n",
2862                                             task_pid_nr(p), p->comm, i);
2863                                         force_sig(SIGKILL, p);
2864                                         break;
2865                                 }
2866                         }
2867                         spin_unlock(&p->files->file_lock);
2868                 }
2869                 task_unlock(p);
2870         } while_each_thread(g, p);
2871         read_unlock(&tasklist_lock);
2872 #endif
2873 }
2874
2875 static void do_SAK_work(struct work_struct *work)
2876 {
2877         struct tty_struct *tty =
2878                 container_of(work, struct tty_struct, SAK_work);
2879         __do_SAK(tty);
2880 }
2881
2882 /*
2883  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2884  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2885  * the values which we write to it will be identical to the values which it
2886  * already has. --akpm
2887  */
2888 void do_SAK(struct tty_struct *tty)
2889 {
2890         if (!tty)
2891                 return;
2892         schedule_work(&tty->SAK_work);
2893 }
2894
2895 EXPORT_SYMBOL(do_SAK);
2896
2897 static int dev_match_devt(struct device *dev, void *data)
2898 {
2899         dev_t *devt = data;
2900         return dev->devt == *devt;
2901 }
2902
2903 /* Must put_device() after it's unused! */
2904 static struct device *tty_get_device(struct tty_struct *tty)
2905 {
2906         dev_t devt = tty_devnum(tty);
2907         return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2908 }
2909
2910
2911 /**
2912  *      initialize_tty_struct
2913  *      @tty: tty to initialize
2914  *
2915  *      This subroutine initializes a tty structure that has been newly
2916  *      allocated.
2917  *
2918  *      Locking: none - tty in question must not be exposed at this point
2919  */
2920
2921 void initialize_tty_struct(struct tty_struct *tty,
2922                 struct tty_driver *driver, int idx)
2923 {
2924         memset(tty, 0, sizeof(struct tty_struct));
2925         kref_init(&tty->kref);
2926         tty->magic = TTY_MAGIC;
2927         tty_ldisc_init(tty);
2928         tty->session = NULL;
2929         tty->pgrp = NULL;
2930         tty->overrun_time = jiffies;
2931         tty->buf.head = tty->buf.tail = NULL;
2932         tty_buffer_init(tty);
2933         mutex_init(&tty->termios_mutex);
2934         mutex_init(&tty->ldisc_mutex);
2935         init_waitqueue_head(&tty->write_wait);
2936         init_waitqueue_head(&tty->read_wait);
2937         INIT_WORK(&tty->hangup_work, do_tty_hangup);
2938         mutex_init(&tty->atomic_read_lock);
2939         mutex_init(&tty->atomic_write_lock);
2940         mutex_init(&tty->output_lock);
2941         mutex_init(&tty->echo_lock);
2942         spin_lock_init(&tty->read_lock);
2943         spin_lock_init(&tty->ctrl_lock);
2944         INIT_LIST_HEAD(&tty->tty_files);
2945         INIT_WORK(&tty->SAK_work, do_SAK_work);
2946
2947         tty->driver = driver;
2948         tty->ops = driver->ops;
2949         tty->index = idx;
2950         tty_line_name(driver, idx, tty->name);
2951         tty->dev = tty_get_device(tty);
2952 }
2953
2954 /**
2955  *      deinitialize_tty_struct
2956  *      @tty: tty to deinitialize
2957  *
2958  *      This subroutine deinitializes a tty structure that has been newly
2959  *      allocated but tty_release cannot be called on that yet.
2960  *
2961  *      Locking: none - tty in question must not be exposed at this point
2962  */
2963 void deinitialize_tty_struct(struct tty_struct *tty)
2964 {
2965         tty_ldisc_deinit(tty);
2966 }
2967
2968 /**
2969  *      tty_put_char    -       write one character to a tty
2970  *      @tty: tty
2971  *      @ch: character
2972  *
2973  *      Write one byte to the tty using the provided put_char method
2974  *      if present. Returns the number of characters successfully output.
2975  *
2976  *      Note: the specific put_char operation in the driver layer may go
2977  *      away soon. Don't call it directly, use this method
2978  */
2979
2980 int tty_put_char(struct tty_struct *tty, unsigned char ch)
2981 {
2982         if (tty->ops->put_char)
2983                 return tty->ops->put_char(tty, ch);
2984         return tty->ops->write(tty, &ch, 1);
2985 }
2986 EXPORT_SYMBOL_GPL(tty_put_char);
2987
2988 struct class *tty_class;
2989
2990 /**
2991  *      tty_register_device - register a tty device
2992  *      @driver: the tty driver that describes the tty device
2993  *      @index: the index in the tty driver for this tty device
2994  *      @device: a struct device that is associated with this tty device.
2995  *              This field is optional, if there is no known struct device
2996  *              for this tty device it can be set to NULL safely.
2997  *
2998  *      Returns a pointer to the struct device for this tty device
2999  *      (or ERR_PTR(-EFOO) on error).
3000  *
3001  *      This call is required to be made to register an individual tty device
3002  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3003  *      that bit is not set, this function should not be called by a tty
3004  *      driver.
3005  *
3006  *      Locking: ??
3007  */
3008
3009 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3010                                    struct device *device)
3011 {
3012         char name[64];
3013         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3014
3015         if (index >= driver->num) {
3016                 printk(KERN_ERR "Attempt to register invalid tty line number "
3017                        " (%d).\n", index);
3018                 return ERR_PTR(-EINVAL);
3019         }
3020
3021         if (driver->type == TTY_DRIVER_TYPE_PTY)
3022                 pty_line_name(driver, index, name);
3023         else
3024                 tty_line_name(driver, index, name);
3025
3026         return device_create(tty_class, device, dev, NULL, name);
3027 }
3028 EXPORT_SYMBOL(tty_register_device);
3029
3030 /**
3031  *      tty_unregister_device - unregister a tty device
3032  *      @driver: the tty driver that describes the tty device
3033  *      @index: the index in the tty driver for this tty device
3034  *
3035  *      If a tty device is registered with a call to tty_register_device() then
3036  *      this function must be called when the tty device is gone.
3037  *
3038  *      Locking: ??
3039  */
3040
3041 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3042 {
3043         device_destroy(tty_class,
3044                 MKDEV(driver->major, driver->minor_start) + index);
3045 }
3046 EXPORT_SYMBOL(tty_unregister_device);
3047
3048 struct tty_driver *alloc_tty_driver(int lines)
3049 {
3050         struct tty_driver *driver;
3051
3052         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3053         if (driver) {
3054                 kref_init(&driver->kref);
3055                 driver->magic = TTY_DRIVER_MAGIC;
3056                 driver->num = lines;
3057                 /* later we'll move allocation of tables here */
3058         }
3059         return driver;
3060 }
3061 EXPORT_SYMBOL(alloc_tty_driver);
3062
3063 static void destruct_tty_driver(struct kref *kref)
3064 {
3065         struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3066         int i;
3067         struct ktermios *tp;
3068         void *p;
3069
3070         if (driver->flags & TTY_DRIVER_INSTALLED) {
3071                 /*
3072                  * Free the termios and termios_locked structures because
3073                  * we don't want to get memory leaks when modular tty
3074                  * drivers are removed from the kernel.
3075                  */
3076                 for (i = 0; i < driver->num; i++) {
3077                         tp = driver->termios[i];
3078                         if (tp) {
3079                                 driver->termios[i] = NULL;
3080                                 kfree(tp);
3081                         }
3082                         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3083                                 tty_unregister_device(driver, i);
3084                 }
3085                 p = driver->ttys;
3086                 proc_tty_unregister_driver(driver);
3087                 driver->ttys = NULL;
3088                 driver->termios = NULL;
3089                 kfree(p);
3090                 cdev_del(&driver->cdev);
3091         }
3092         kfree(driver);
3093 }
3094
3095 void tty_driver_kref_put(struct tty_driver *driver)
3096 {
3097         kref_put(&driver->kref, destruct_tty_driver);
3098 }
3099 EXPORT_SYMBOL(tty_driver_kref_put);
3100
3101 void tty_set_operations(struct tty_driver *driver,
3102                         const struct tty_operations *op)
3103 {
3104         driver->ops = op;
3105 };
3106 EXPORT_SYMBOL(tty_set_operations);
3107
3108 void put_tty_driver(struct tty_driver *d)
3109 {
3110         tty_driver_kref_put(d);
3111 }
3112 EXPORT_SYMBOL(put_tty_driver);
3113
3114 /*
3115  * Called by a tty driver to register itself.
3116  */
3117 int tty_register_driver(struct tty_driver *driver)
3118 {
3119         int error;
3120         int i;
3121         dev_t dev;
3122         void **p = NULL;
3123         struct device *d;
3124
3125         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3126                 p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
3127                 if (!p)
3128                         return -ENOMEM;
3129         }
3130
3131         if (!driver->major) {
3132                 error = alloc_chrdev_region(&dev, driver->minor_start,
3133                                                 driver->num, driver->name);
3134                 if (!error) {
3135                         driver->major = MAJOR(dev);
3136                         driver->minor_start = MINOR(dev);
3137                 }
3138         } else {
3139                 dev = MKDEV(driver->major, driver->minor_start);
3140                 error = register_chrdev_region(dev, driver->num, driver->name);
3141         }
3142         if (error < 0) {
3143                 kfree(p);
3144                 return error;
3145         }
3146
3147         if (p) {
3148                 driver->ttys = (struct tty_struct **)p;
3149                 driver->termios = (struct ktermios **)(p + driver->num);
3150         } else {
3151                 driver->ttys = NULL;
3152                 driver->termios = NULL;
3153         }
3154
3155         cdev_init(&driver->cdev, &tty_fops);
3156         driver->cdev.owner = driver->owner;
3157         error = cdev_add(&driver->cdev, dev, driver->num);
3158         if (error) {
3159                 unregister_chrdev_region(dev, driver->num);
3160                 driver->ttys = NULL;
3161                 driver->termios = NULL;
3162                 kfree(p);
3163                 return error;
3164         }
3165
3166         mutex_lock(&tty_mutex);
3167         list_add(&driver->tty_drivers, &tty_drivers);
3168         mutex_unlock(&tty_mutex);
3169
3170         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3171                 for (i = 0; i < driver->num; i++) {
3172                         d = tty_register_device(driver, i, NULL);
3173                         if (IS_ERR(d)) {
3174                                 error = PTR_ERR(d);
3175                                 goto err;
3176                         }
3177                 }
3178         }
3179         proc_tty_register_driver(driver);
3180         driver->flags |= TTY_DRIVER_INSTALLED;
3181         return 0;
3182
3183 err:
3184         for (i--; i >= 0; i--)
3185                 tty_unregister_device(driver, i);
3186
3187         mutex_lock(&tty_mutex);
3188         list_del(&driver->tty_drivers);
3189         mutex_unlock(&tty_mutex);
3190
3191         unregister_chrdev_region(dev, driver->num);
3192         driver->ttys = NULL;
3193         driver->termios = NULL;
3194         kfree(p);
3195         return error;
3196 }
3197
3198 EXPORT_SYMBOL(tty_register_driver);
3199
3200 /*
3201  * Called by a tty driver to unregister itself.
3202  */
3203 int tty_unregister_driver(struct tty_driver *driver)
3204 {
3205 #if 0
3206         /* FIXME */
3207         if (driver->refcount)
3208                 return -EBUSY;
3209 #endif
3210         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3211                                 driver->num);
3212         mutex_lock(&tty_mutex);
3213         list_del(&driver->tty_drivers);
3214         mutex_unlock(&tty_mutex);
3215         return 0;
3216 }
3217
3218 EXPORT_SYMBOL(tty_unregister_driver);
3219
3220 dev_t tty_devnum(struct tty_struct *tty)
3221 {
3222         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3223 }
3224 EXPORT_SYMBOL(tty_devnum);
3225
3226 void proc_clear_tty(struct task_struct *p)
3227 {
3228         unsigned long flags;
3229         struct tty_struct *tty;
3230         spin_lock_irqsave(&p->sighand->siglock, flags);
3231         tty = p->signal->tty;
3232         p->signal->tty = NULL;
3233         spin_unlock_irqrestore(&p->sighand->siglock, flags);
3234         tty_kref_put(tty);
3235 }
3236
3237 /* Called under the sighand lock */
3238
3239 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3240 {
3241         if (tty) {
3242                 unsigned long flags;
3243                 /* We should not have a session or pgrp to put here but.... */
3244                 spin_lock_irqsave(&tty->ctrl_lock, flags);
3245                 put_pid(tty->session);
3246                 put_pid(tty->pgrp);
3247                 tty->pgrp = get_pid(task_pgrp(tsk));
3248                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3249                 tty->session = get_pid(task_session(tsk));
3250                 if (tsk->signal->tty) {
3251                         printk(KERN_DEBUG "tty not NULL!!\n");
3252                         tty_kref_put(tsk->signal->tty);
3253                 }
3254         }
3255         put_pid(tsk->signal->tty_old_pgrp);
3256         tsk->signal->tty = tty_kref_get(tty);
3257         tsk->signal->tty_old_pgrp = NULL;
3258 }
3259
3260 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3261 {
3262         spin_lock_irq(&tsk->sighand->siglock);
3263         __proc_set_tty(tsk, tty);
3264         spin_unlock_irq(&tsk->sighand->siglock);
3265 }
3266
3267 struct tty_struct *get_current_tty(void)
3268 {
3269         struct tty_struct *tty;
3270         unsigned long flags;
3271
3272         spin_lock_irqsave(&current->sighand->siglock, flags);
3273         tty = tty_kref_get(current->signal->tty);
3274         spin_unlock_irqrestore(&current->sighand->siglock, flags);
3275         return tty;
3276 }
3277 EXPORT_SYMBOL_GPL(get_current_tty);
3278
3279 void tty_default_fops(struct file_operations *fops)
3280 {
3281         *fops = tty_fops;
3282 }
3283
3284 /*