Move tty lookup/reopen to caller
[linux-2.6] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  *
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc()
66  *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
67  */
68
69 #include <linux/types.h>
70 #include <linux/major.h>
71 #include <linux/errno.h>
72 #include <linux/signal.h>
73 #include <linux/fcntl.h>
74 #include <linux/sched.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/fdtable.h>
82 #include <linux/console.h>
83 #include <linux/timer.h>
84 #include <linux/ctype.h>
85 #include <linux/kd.h>
86 #include <linux/mm.h>
87 #include <linux/string.h>
88 #include <linux/slab.h>
89 #include <linux/poll.h>
90 #include <linux/proc_fs.h>
91 #include <linux/init.h>
92 #include <linux/module.h>
93 #include <linux/smp_lock.h>
94 #include <linux/device.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98 #include <linux/seq_file.h>
99
100 #include <linux/uaccess.h>
101 #include <asm/system.h>
102
103 #include <linux/kbd_kern.h>
104 #include <linux/vt_kern.h>
105 #include <linux/selection.h>
106
107 #include <linux/kmod.h>
108 #include <linux/nsproxy.h>
109
110 #undef TTY_DEBUG_HANGUP
111
112 #define TTY_PARANOIA_CHECK 1
113 #define CHECK_TTY_COUNT 1
114
115 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
116         .c_iflag = ICRNL | IXON,
117         .c_oflag = OPOST | ONLCR,
118         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
119         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
120                    ECHOCTL | ECHOKE | IEXTEN,
121         .c_cc = INIT_C_CC,
122         .c_ispeed = 38400,
123         .c_ospeed = 38400
124 };
125
126 EXPORT_SYMBOL(tty_std_termios);
127
128 /* This list gets poked at by procfs and various bits of boot up code. This
129    could do with some rationalisation such as pulling the tty proc function
130    into this file */
131
132 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
133
134 /* Mutex to protect creating and releasing a tty. This is shared with
135    vt.c for deeply disgusting hack reasons */
136 DEFINE_MUTEX(tty_mutex);
137 EXPORT_SYMBOL(tty_mutex);
138
139 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
140 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
141 ssize_t redirected_tty_write(struct file *, const char __user *,
142                                                         size_t, loff_t *);
143 static unsigned int tty_poll(struct file *, poll_table *);
144 static int tty_open(struct inode *, struct file *);
145 static int tty_release(struct inode *, struct file *);
146 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
147 #ifdef CONFIG_COMPAT
148 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
149                                 unsigned long arg);
150 #else
151 #define tty_compat_ioctl NULL
152 #endif
153 static int tty_fasync(int fd, struct file *filp, int on);
154 static void release_tty(struct tty_struct *tty, int idx);
155 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
156 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157
158 /**
159  *      alloc_tty_struct        -       allocate a tty object
160  *
161  *      Return a new empty tty structure. The data fields have not
162  *      been initialized in any way but has been zeroed
163  *
164  *      Locking: none
165  */
166
167 struct tty_struct *alloc_tty_struct(void)
168 {
169         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
170 }
171
172 /**
173  *      free_tty_struct         -       free a disused tty
174  *      @tty: tty struct to free
175  *
176  *      Free the write buffers, tty queue and tty memory itself.
177  *
178  *      Locking: none. Must be called after tty is definitely unused
179  */
180
181 void free_tty_struct(struct tty_struct *tty)
182 {
183         kfree(tty->write_buf);
184         tty_buffer_free_all(tty);
185         kfree(tty);
186 }
187
188 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
189
190 /**
191  *      tty_name        -       return tty naming
192  *      @tty: tty structure
193  *      @buf: buffer for output
194  *
195  *      Convert a tty structure into a name. The name reflects the kernel
196  *      naming policy and if udev is in use may not reflect user space
197  *
198  *      Locking: none
199  */
200
201 char *tty_name(struct tty_struct *tty, char *buf)
202 {
203         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
204                 strcpy(buf, "NULL tty");
205         else
206                 strcpy(buf, tty->name);
207         return buf;
208 }
209
210 EXPORT_SYMBOL(tty_name);
211
212 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
213                               const char *routine)
214 {
215 #ifdef TTY_PARANOIA_CHECK
216         if (!tty) {
217                 printk(KERN_WARNING
218                         "null TTY for (%d:%d) in %s\n",
219                         imajor(inode), iminor(inode), routine);
220                 return 1;
221         }
222         if (tty->magic != TTY_MAGIC) {
223                 printk(KERN_WARNING
224                         "bad magic number for tty struct (%d:%d) in %s\n",
225                         imajor(inode), iminor(inode), routine);
226                 return 1;
227         }
228 #endif
229         return 0;
230 }
231
232 static int check_tty_count(struct tty_struct *tty, const char *routine)
233 {
234 #ifdef CHECK_TTY_COUNT
235         struct list_head *p;
236         int count = 0;
237
238         file_list_lock();
239         list_for_each(p, &tty->tty_files) {
240                 count++;
241         }
242         file_list_unlock();
243         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
244             tty->driver->subtype == PTY_TYPE_SLAVE &&
245             tty->link && tty->link->count)
246                 count++;
247         if (tty->count != count) {
248                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
249                                     "!= #fd's(%d) in %s\n",
250                        tty->name, tty->count, count, routine);
251                 return count;
252         }
253 #endif
254         return 0;
255 }
256
257 /**
258  *      get_tty_driver          -       find device of a tty
259  *      @dev_t: device identifier
260  *      @index: returns the index of the tty
261  *
262  *      This routine returns a tty driver structure, given a device number
263  *      and also passes back the index number.
264  *
265  *      Locking: caller must hold tty_mutex
266  */
267
268 static struct tty_driver *get_tty_driver(dev_t device, int *index)
269 {
270         struct tty_driver *p;
271
272         list_for_each_entry(p, &tty_drivers, tty_drivers) {
273                 dev_t base = MKDEV(p->major, p->minor_start);
274                 if (device < base || device >= base + p->num)
275                         continue;
276                 *index = device - base;
277                 return tty_driver_kref_get(p);
278         }
279         return NULL;
280 }
281
282 #ifdef CONFIG_CONSOLE_POLL
283
284 /**
285  *      tty_find_polling_driver -       find device of a polled tty
286  *      @name: name string to match
287  *      @line: pointer to resulting tty line nr
288  *
289  *      This routine returns a tty driver structure, given a name
290  *      and the condition that the tty driver is capable of polled
291  *      operation.
292  */
293 struct tty_driver *tty_find_polling_driver(char *name, int *line)
294 {
295         struct tty_driver *p, *res = NULL;
296         int tty_line = 0;
297         int len;
298         char *str;
299
300         for (str = name; *str; str++)
301                 if ((*str >= '0' && *str <= '9') || *str == ',')
302                         break;
303         if (!*str)
304                 return NULL;
305
306         len = str - name;
307         tty_line = simple_strtoul(str, &str, 10);
308
309         mutex_lock(&tty_mutex);
310         /* Search through the tty devices to look for a match */
311         list_for_each_entry(p, &tty_drivers, tty_drivers) {
312                 if (strncmp(name, p->name, len) != 0)
313                         continue;
314                 if (*str == ',')
315                         str++;
316                 if (*str == '\0')
317                         str = NULL;
318
319                 if (tty_line >= 0 && tty_line <= p->num && p->ops &&
320                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, str)) {
321                         res = tty_driver_kref_get(p);
322                         *line = tty_line;
323                         break;
324                 }
325         }
326         mutex_unlock(&tty_mutex);
327
328         return res;
329 }
330 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
331 #endif
332
333 /**
334  *      tty_check_change        -       check for POSIX terminal changes
335  *      @tty: tty to check
336  *
337  *      If we try to write to, or set the state of, a terminal and we're
338  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
339  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
340  *
341  *      Locking: ctrl_lock
342  */
343
344 int tty_check_change(struct tty_struct *tty)
345 {
346         unsigned long flags;
347         int ret = 0;
348
349         if (current->signal->tty != tty)
350                 return 0;
351
352         spin_lock_irqsave(&tty->ctrl_lock, flags);
353
354         if (!tty->pgrp) {
355                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
356                 goto out_unlock;
357         }
358         if (task_pgrp(current) == tty->pgrp)
359                 goto out_unlock;
360         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
361         if (is_ignored(SIGTTOU))
362                 goto out;
363         if (is_current_pgrp_orphaned()) {
364                 ret = -EIO;
365                 goto out;
366         }
367         kill_pgrp(task_pgrp(current), SIGTTOU, 1);
368         set_thread_flag(TIF_SIGPENDING);
369         ret = -ERESTARTSYS;
370 out:
371         return ret;
372 out_unlock:
373         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
374         return ret;
375 }
376
377 EXPORT_SYMBOL(tty_check_change);
378
379 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
380                                 size_t count, loff_t *ppos)
381 {
382         return 0;
383 }
384
385 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
386                                  size_t count, loff_t *ppos)
387 {
388         return -EIO;
389 }
390
391 /* No kernel lock held - none needed ;) */
392 static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
393 {
394         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
395 }
396
397 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
398                 unsigned long arg)
399 {
400         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
401 }
402
403 static long hung_up_tty_compat_ioctl(struct file *file,
404                                      unsigned int cmd, unsigned long arg)
405 {
406         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
407 }
408
409 static const struct file_operations tty_fops = {
410         .llseek         = no_llseek,
411         .read           = tty_read,
412         .write          = tty_write,
413         .poll           = tty_poll,
414         .unlocked_ioctl = tty_ioctl,
415         .compat_ioctl   = tty_compat_ioctl,
416         .open           = tty_open,
417         .release        = tty_release,
418         .fasync         = tty_fasync,
419 };
420
421 static const struct file_operations console_fops = {
422         .llseek         = no_llseek,
423         .read           = tty_read,
424         .write          = redirected_tty_write,
425         .poll           = tty_poll,
426         .unlocked_ioctl = tty_ioctl,
427         .compat_ioctl   = tty_compat_ioctl,
428         .open           = tty_open,
429         .release        = tty_release,
430         .fasync         = tty_fasync,
431 };
432
433 static const struct file_operations hung_up_tty_fops = {
434         .llseek         = no_llseek,
435         .read           = hung_up_tty_read,
436         .write          = hung_up_tty_write,
437         .poll           = hung_up_tty_poll,
438         .unlocked_ioctl = hung_up_tty_ioctl,
439         .compat_ioctl   = hung_up_tty_compat_ioctl,
440         .release        = tty_release,
441 };
442
443 static DEFINE_SPINLOCK(redirect_lock);
444 static struct file *redirect;
445
446 /**
447  *      tty_wakeup      -       request more data
448  *      @tty: terminal
449  *
450  *      Internal and external helper for wakeups of tty. This function
451  *      informs the line discipline if present that the driver is ready
452  *      to receive more output data.
453  */
454
455 void tty_wakeup(struct tty_struct *tty)
456 {
457         struct tty_ldisc *ld;
458
459         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
460                 ld = tty_ldisc_ref(tty);
461                 if (ld) {
462                         if (ld->ops->write_wakeup)
463                                 ld->ops->write_wakeup(tty);
464                         tty_ldisc_deref(ld);
465                 }
466         }
467         wake_up_interruptible(&tty->write_wait);
468 }
469
470 EXPORT_SYMBOL_GPL(tty_wakeup);
471
472 /**
473  *      tty_ldisc_flush -       flush line discipline queue
474  *      @tty: tty
475  *
476  *      Flush the line discipline queue (if any) for this tty. If there
477  *      is no line discipline active this is a no-op.
478  */
479
480 void tty_ldisc_flush(struct tty_struct *tty)
481 {
482         struct tty_ldisc *ld = tty_ldisc_ref(tty);
483         if (ld) {
484                 if (ld->ops->flush_buffer)
485                         ld->ops->flush_buffer(tty);
486                 tty_ldisc_deref(ld);
487         }
488         tty_buffer_flush(tty);
489 }
490
491 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
492
493 /**
494  *      tty_reset_termios       -       reset terminal state
495  *      @tty: tty to reset
496  *
497  *      Restore a terminal to the driver default state
498  */
499
500 static void tty_reset_termios(struct tty_struct *tty)
501 {
502         mutex_lock(&tty->termios_mutex);
503         *tty->termios = tty->driver->init_termios;
504         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
505         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
506         mutex_unlock(&tty->termios_mutex);
507 }
508
509 /**
510  *      do_tty_hangup           -       actual handler for hangup events
511  *      @work: tty device
512  *
513  *      This can be called by the "eventd" kernel thread.  That is process
514  *      synchronous but doesn't hold any locks, so we need to make sure we
515  *      have the appropriate locks for what we're doing.
516  *
517  *      The hangup event clears any pending redirections onto the hung up
518  *      device. It ensures future writes will error and it does the needed
519  *      line discipline hangup and signal delivery. The tty object itself
520  *      remains intact.
521  *
522  *      Locking:
523  *              BKL
524  *                redirect lock for undoing redirection
525  *                file list lock for manipulating list of ttys
526  *                tty_ldisc_lock from called functions
527  *                termios_mutex resetting termios data
528  *                tasklist_lock to walk task list for hangup event
529  *                  ->siglock to protect ->signal/->sighand
530  */
531 static void do_tty_hangup(struct work_struct *work)
532 {
533         struct tty_struct *tty =
534                 container_of(work, struct tty_struct, hangup_work);
535         struct file *cons_filp = NULL;
536         struct file *filp, *f = NULL;
537         struct task_struct *p;
538         struct tty_ldisc *ld;
539         int    closecount = 0, n;
540         unsigned long flags;
541         int refs = 0;
542
543         if (!tty)
544                 return;
545
546         /* inuse_filps is protected by the single kernel lock */
547         lock_kernel();
548
549         spin_lock(&redirect_lock);
550         if (redirect && redirect->private_data == tty) {
551                 f = redirect;
552                 redirect = NULL;
553         }
554         spin_unlock(&redirect_lock);
555
556         check_tty_count(tty, "do_tty_hangup");
557         file_list_lock();
558         /* This breaks for file handles being sent over AF_UNIX sockets ? */
559         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
560                 if (filp->f_op->write == redirected_tty_write)
561                         cons_filp = filp;
562                 if (filp->f_op->write != tty_write)
563                         continue;
564                 closecount++;
565                 tty_fasync(-1, filp, 0);        /* can't block */
566                 filp->f_op = &hung_up_tty_fops;
567         }
568         file_list_unlock();
569         /*
570          * FIXME! What are the locking issues here? This may me overdoing
571          * things... This question is especially important now that we've
572          * removed the irqlock.
573          */
574         ld = tty_ldisc_ref(tty);
575         if (ld != NULL) {
576                 /* We may have no line discipline at this point */
577                 if (ld->ops->flush_buffer)
578                         ld->ops->flush_buffer(tty);
579                 tty_driver_flush_buffer(tty);
580                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
581                     ld->ops->write_wakeup)
582                         ld->ops->write_wakeup(tty);
583                 if (ld->ops->hangup)
584                         ld->ops->hangup(tty);
585         }
586         /*
587          * FIXME: Once we trust the LDISC code better we can wait here for
588          * ldisc completion and fix the driver call race
589          */
590         wake_up_interruptible(&tty->write_wait);
591         wake_up_interruptible(&tty->read_wait);
592         /*
593          * Shutdown the current line discipline, and reset it to
594          * N_TTY.
595          */
596         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
597                 tty_reset_termios(tty);
598         /* Defer ldisc switch */
599         /* tty_deferred_ldisc_switch(N_TTY);
600
601           This should get done automatically when the port closes and
602           tty_release is called */
603
604         read_lock(&tasklist_lock);
605         if (tty->session) {
606                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
607                         spin_lock_irq(&p->sighand->siglock);
608                         if (p->signal->tty == tty) {
609                                 p->signal->tty = NULL;
610                                 /* We defer the dereferences outside fo
611                                    the tasklist lock */
612                                 refs++;
613                         }
614                         if (!p->signal->leader) {
615                                 spin_unlock_irq(&p->sighand->siglock);
616                                 continue;
617                         }
618                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
619                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
620                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
621                         spin_lock_irqsave(&tty->ctrl_lock, flags);
622                         if (tty->pgrp)
623                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
624                         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
625                         spin_unlock_irq(&p->sighand->siglock);
626                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
627         }
628         read_unlock(&tasklist_lock);
629
630         spin_lock_irqsave(&tty->ctrl_lock, flags);
631         tty->flags = 0;
632         put_pid(tty->session);
633         put_pid(tty->pgrp);
634         tty->session = NULL;
635         tty->pgrp = NULL;
636         tty->ctrl_status = 0;
637         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
638
639         /* Account for the p->signal references we killed */
640         while (refs--)
641                 tty_kref_put(tty);
642
643         /*
644          * If one of the devices matches a console pointer, we
645          * cannot just call hangup() because that will cause
646          * tty->count and state->count to go out of sync.
647          * So we just call close() the right number of times.
648          */
649         if (cons_filp) {
650                 if (tty->ops->close)
651                         for (n = 0; n < closecount; n++)
652                                 tty->ops->close(tty, cons_filp);
653         } else if (tty->ops->hangup)
654                 (tty->ops->hangup)(tty);
655         /*
656          * We don't want to have driver/ldisc interactions beyond
657          * the ones we did here. The driver layer expects no
658          * calls after ->hangup() from the ldisc side. However we
659          * can't yet guarantee all that.
660          */
661         set_bit(TTY_HUPPED, &tty->flags);
662         if (ld) {
663                 tty_ldisc_enable(tty);
664                 tty_ldisc_deref(ld);
665         }
666         unlock_kernel();
667         if (f)
668                 fput(f);
669 }
670
671 /**
672  *      tty_hangup              -       trigger a hangup event
673  *      @tty: tty to hangup
674  *
675  *      A carrier loss (virtual or otherwise) has occurred on this like
676  *      schedule a hangup sequence to run after this event.
677  */
678
679 void tty_hangup(struct tty_struct *tty)
680 {
681 #ifdef TTY_DEBUG_HANGUP
682         char    buf[64];
683         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
684 #endif
685         schedule_work(&tty->hangup_work);
686 }
687
688 EXPORT_SYMBOL(tty_hangup);
689
690 /**
691  *      tty_vhangup             -       process vhangup
692  *      @tty: tty to hangup
693  *
694  *      The user has asked via system call for the terminal to be hung up.
695  *      We do this synchronously so that when the syscall returns the process
696  *      is complete. That guarantee is necessary for security reasons.
697  */
698
699 void tty_vhangup(struct tty_struct *tty)
700 {
701 #ifdef TTY_DEBUG_HANGUP
702         char    buf[64];
703
704         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
705 #endif
706         do_tty_hangup(&tty->hangup_work);
707 }
708
709 EXPORT_SYMBOL(tty_vhangup);
710
711 /**
712  *      tty_vhangup_self        -       process vhangup for own ctty
713  *
714  *      Perform a vhangup on the current controlling tty
715  */
716
717 void tty_vhangup_self(void)
718 {
719         struct tty_struct *tty;
720
721         tty = get_current_tty();
722         if (tty) {
723                 tty_vhangup(tty);
724                 tty_kref_put(tty);
725         }
726 }
727
728 /**
729  *      tty_hung_up_p           -       was tty hung up
730  *      @filp: file pointer of tty
731  *
732  *      Return true if the tty has been subject to a vhangup or a carrier
733  *      loss
734  */
735
736 int tty_hung_up_p(struct file *filp)
737 {
738         return (filp->f_op == &hung_up_tty_fops);
739 }
740
741 EXPORT_SYMBOL(tty_hung_up_p);
742
743 static void session_clear_tty(struct pid *session)
744 {
745         struct task_struct *p;
746         do_each_pid_task(session, PIDTYPE_SID, p) {
747                 proc_clear_tty(p);
748         } while_each_pid_task(session, PIDTYPE_SID, p);
749 }
750
751 /**
752  *      disassociate_ctty       -       disconnect controlling tty
753  *      @on_exit: true if exiting so need to "hang up" the session
754  *
755  *      This function is typically called only by the session leader, when
756  *      it wants to disassociate itself from its controlling tty.
757  *
758  *      It performs the following functions:
759  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
760  *      (2)  Clears the tty from being controlling the session
761  *      (3)  Clears the controlling tty for all processes in the
762  *              session group.
763  *
764  *      The argument on_exit is set to 1 if called when a process is
765  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
766  *
767  *      Locking:
768  *              BKL is taken for hysterical raisins
769  *                tty_mutex is taken to protect tty
770  *                ->siglock is taken to protect ->signal/->sighand
771  *                tasklist_lock is taken to walk process list for sessions
772  *                  ->siglock is taken to protect ->signal/->sighand
773  */
774
775 void disassociate_ctty(int on_exit)
776 {
777         struct tty_struct *tty;
778         struct pid *tty_pgrp = NULL;
779
780
781         tty = get_current_tty();
782         if (tty) {
783                 tty_pgrp = get_pid(tty->pgrp);
784                 lock_kernel();
785                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
786                         tty_vhangup(tty);
787                 unlock_kernel();
788                 tty_kref_put(tty);
789         } else if (on_exit) {
790                 struct pid *old_pgrp;
791                 spin_lock_irq(&current->sighand->siglock);
792                 old_pgrp = current->signal->tty_old_pgrp;
793                 current->signal->tty_old_pgrp = NULL;
794                 spin_unlock_irq(&current->sighand->siglock);
795                 if (old_pgrp) {
796                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
797                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
798                         put_pid(old_pgrp);
799                 }
800                 return;
801         }
802         if (tty_pgrp) {
803                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
804                 if (!on_exit)
805                         kill_pgrp(tty_pgrp, SIGCONT, on_exit);
806                 put_pid(tty_pgrp);
807         }
808
809         spin_lock_irq(&current->sighand->siglock);
810         put_pid(current->signal->tty_old_pgrp);
811         current->signal->tty_old_pgrp = NULL;
812         spin_unlock_irq(&current->sighand->siglock);
813
814         tty = get_current_tty();
815         if (tty) {
816                 unsigned long flags;
817                 spin_lock_irqsave(&tty->ctrl_lock, flags);
818                 put_pid(tty->session);
819                 put_pid(tty->pgrp);
820                 tty->session = NULL;
821                 tty->pgrp = NULL;
822                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
823                 tty_kref_put(tty);
824         } else {
825 #ifdef TTY_DEBUG_HANGUP
826                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
827                        " = NULL", tty);
828 #endif
829         }
830
831         /* Now clear signal->tty under the lock */
832         read_lock(&tasklist_lock);
833         session_clear_tty(task_session(current));
834         read_unlock(&tasklist_lock);
835 }
836
837 /**
838  *
839  *      no_tty  - Ensure the current process does not have a controlling tty
840  */
841 void no_tty(void)
842 {
843         struct task_struct *tsk = current;
844         lock_kernel();
845         if (tsk->signal->leader)
846                 disassociate_ctty(0);
847         unlock_kernel();
848         proc_clear_tty(tsk);
849 }
850
851
852 /**
853  *      stop_tty        -       propagate flow control
854  *      @tty: tty to stop
855  *
856  *      Perform flow control to the driver. For PTY/TTY pairs we
857  *      must also propagate the TIOCKPKT status. May be called
858  *      on an already stopped device and will not re-call the driver
859  *      method.
860  *
861  *      This functionality is used by both the line disciplines for
862  *      halting incoming flow and by the driver. It may therefore be
863  *      called from any context, may be under the tty atomic_write_lock
864  *      but not always.
865  *
866  *      Locking:
867  *              Uses the tty control lock internally
868  */
869
870 void stop_tty(struct tty_struct *tty)
871 {
872         unsigned long flags;
873         spin_lock_irqsave(&tty->ctrl_lock, flags);
874         if (tty->stopped) {
875                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
876                 return;
877         }
878         tty->stopped = 1;
879         if (tty->link && tty->link->packet) {
880                 tty->ctrl_status &= ~TIOCPKT_START;
881                 tty->ctrl_status |= TIOCPKT_STOP;
882                 wake_up_interruptible(&tty->link->read_wait);
883         }
884         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
885         if (tty->ops->stop)
886                 (tty->ops->stop)(tty);
887 }
888
889 EXPORT_SYMBOL(stop_tty);
890
891 /**
892  *      start_tty       -       propagate flow control
893  *      @tty: tty to start
894  *
895  *      Start a tty that has been stopped if at all possible. Perform
896  *      any necessary wakeups and propagate the TIOCPKT status. If this
897  *      is the tty was previous stopped and is being started then the
898  *      driver start method is invoked and the line discipline woken.
899  *
900  *      Locking:
901  *              ctrl_lock
902  */
903
904 void start_tty(struct tty_struct *tty)
905 {
906         unsigned long flags;
907         spin_lock_irqsave(&tty->ctrl_lock, flags);
908         if (!tty->stopped || tty->flow_stopped) {
909                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
910                 return;
911         }
912         tty->stopped = 0;
913         if (tty->link && tty->link->packet) {
914                 tty->ctrl_status &= ~TIOCPKT_STOP;
915                 tty->ctrl_status |= TIOCPKT_START;
916                 wake_up_interruptible(&tty->link->read_wait);
917         }
918         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
919         if (tty->ops->start)
920                 (tty->ops->start)(tty);
921         /* If we have a running line discipline it may need kicking */
922         tty_wakeup(tty);
923 }
924
925 EXPORT_SYMBOL(start_tty);
926
927 /**
928  *      tty_read        -       read method for tty device files
929  *      @file: pointer to tty file
930  *      @buf: user buffer
931  *      @count: size of user buffer
932  *      @ppos: unused
933  *
934  *      Perform the read system call function on this terminal device. Checks
935  *      for hung up devices before calling the line discipline method.
936  *
937  *      Locking:
938  *              Locks the line discipline internally while needed. Multiple
939  *      read calls may be outstanding in parallel.
940  */
941
942 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
943                         loff_t *ppos)
944 {
945         int i;
946         struct tty_struct *tty;
947         struct inode *inode;
948         struct tty_ldisc *ld;
949
950         tty = (struct tty_struct *)file->private_data;
951         inode = file->f_path.dentry->d_inode;
952         if (tty_paranoia_check(tty, inode, "tty_read"))
953                 return -EIO;
954         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
955                 return -EIO;
956
957         /* We want to wait for the line discipline to sort out in this
958            situation */
959         ld = tty_ldisc_ref_wait(tty);
960         if (ld->ops->read)
961                 i = (ld->ops->read)(tty, file, buf, count);
962         else
963                 i = -EIO;
964         tty_ldisc_deref(ld);
965         if (i > 0)
966                 inode->i_atime = current_fs_time(inode->i_sb);
967         return i;
968 }
969
970 void tty_write_unlock(struct tty_struct *tty)
971 {
972         mutex_unlock(&tty->atomic_write_lock);
973         wake_up_interruptible(&tty->write_wait);
974 }
975
976 int tty_write_lock(struct tty_struct *tty, int ndelay)
977 {
978         if (!mutex_trylock(&tty->atomic_write_lock)) {
979                 if (ndelay)
980                         return -EAGAIN;
981                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
982                         return -ERESTARTSYS;
983         }
984         return 0;
985 }
986
987 /*
988  * Split writes up in sane blocksizes to avoid
989  * denial-of-service type attacks
990  */
991 static inline ssize_t do_tty_write(
992         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
993         struct tty_struct *tty,
994         struct file *file,
995         const char __user *buf,
996         size_t count)
997 {
998         ssize_t ret, written = 0;
999         unsigned int chunk;
1000
1001         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1002         if (ret < 0)
1003                 return ret;
1004
1005         /*
1006          * We chunk up writes into a temporary buffer. This
1007          * simplifies low-level drivers immensely, since they
1008          * don't have locking issues and user mode accesses.
1009          *
1010          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1011          * big chunk-size..
1012          *
1013          * The default chunk-size is 2kB, because the NTTY
1014          * layer has problems with bigger chunks. It will
1015          * claim to be able to handle more characters than
1016          * it actually does.
1017          *
1018          * FIXME: This can probably go away now except that 64K chunks
1019          * are too likely to fail unless switched to vmalloc...
1020          */
1021         chunk = 2048;
1022         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1023                 chunk = 65536;
1024         if (count < chunk)
1025                 chunk = count;
1026
1027         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1028         if (tty->write_cnt < chunk) {
1029                 unsigned char *buf;
1030
1031                 if (chunk < 1024)
1032                         chunk = 1024;
1033
1034                 buf = kmalloc(chunk, GFP_KERNEL);
1035                 if (!buf) {
1036                         ret = -ENOMEM;
1037                         goto out;
1038                 }
1039                 kfree(tty->write_buf);
1040                 tty->write_cnt = chunk;
1041                 tty->write_buf = buf;
1042         }
1043
1044         /* Do the write .. */
1045         for (;;) {
1046                 size_t size = count;
1047                 if (size > chunk)
1048                         size = chunk;
1049                 ret = -EFAULT;
1050                 if (copy_from_user(tty->write_buf, buf, size))
1051                         break;
1052                 ret = write(tty, file, tty->write_buf, size);
1053                 if (ret <= 0)
1054                         break;
1055                 written += ret;
1056                 buf += ret;
1057                 count -= ret;
1058                 if (!count)
1059                         break;
1060                 ret = -ERESTARTSYS;
1061                 if (signal_pending(current))
1062                         break;
1063                 cond_resched();
1064         }
1065         if (written) {
1066                 struct inode *inode = file->f_path.dentry->d_inode;
1067                 inode->i_mtime = current_fs_time(inode->i_sb);
1068                 ret = written;
1069         }
1070 out:
1071         tty_write_unlock(tty);
1072         return ret;
1073 }
1074
1075 /**
1076  * tty_write_message - write a message to a certain tty, not just the console.
1077  * @tty: the destination tty_struct
1078  * @msg: the message to write
1079  *
1080  * This is used for messages that need to be redirected to a specific tty.
1081  * We don't put it into the syslog queue right now maybe in the future if
1082  * really needed.
1083  *
1084  * We must still hold the BKL and test the CLOSING flag for the moment.
1085  */
1086
1087 void tty_write_message(struct tty_struct *tty, char *msg)
1088 {
1089         lock_kernel();
1090         if (tty) {
1091                 mutex_lock(&tty->atomic_write_lock);
1092                 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags))
1093                         tty->ops->write(tty, msg, strlen(msg));
1094                 tty_write_unlock(tty);
1095         }
1096         unlock_kernel();
1097         return;
1098 }
1099
1100
1101 /**
1102  *      tty_write               -       write method for tty device file
1103  *      @file: tty file pointer
1104  *      @buf: user data to write
1105  *      @count: bytes to write
1106  *      @ppos: unused
1107  *
1108  *      Write data to a tty device via the line discipline.
1109  *
1110  *      Locking:
1111  *              Locks the line discipline as required
1112  *              Writes to the tty driver are serialized by the atomic_write_lock
1113  *      and are then processed in chunks to the device. The line discipline
1114  *      write method will not be involked in parallel for each device
1115  *              The line discipline write method is called under the big
1116  *      kernel lock for historical reasons. New code should not rely on this.
1117  */
1118
1119 static ssize_t tty_write(struct file *file, const char __user *buf,
1120                                                 size_t count, loff_t *ppos)
1121 {
1122         struct tty_struct *tty;
1123         struct inode *inode = file->f_path.dentry->d_inode;
1124         ssize_t ret;
1125         struct tty_ldisc *ld;
1126
1127         tty = (struct tty_struct *)file->private_data;
1128         if (tty_paranoia_check(tty, inode, "tty_write"))
1129                 return -EIO;
1130         if (!tty || !tty->ops->write ||
1131                 (test_bit(TTY_IO_ERROR, &tty->flags)))
1132                         return -EIO;
1133         /* Short term debug to catch buggy drivers */
1134         if (tty->ops->write_room == NULL)
1135                 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1136                         tty->driver->name);
1137         ld = tty_ldisc_ref_wait(tty);
1138         if (!ld->ops->write)
1139                 ret = -EIO;
1140         else
1141                 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1142         tty_ldisc_deref(ld);
1143         return ret;
1144 }
1145
1146 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1147                                                 size_t count, loff_t *ppos)
1148 {
1149         struct file *p = NULL;
1150
1151         spin_lock(&redirect_lock);
1152         if (redirect) {
1153                 get_file(redirect);
1154                 p = redirect;
1155         }
1156         spin_unlock(&redirect_lock);
1157
1158         if (p) {
1159                 ssize_t res;
1160                 res = vfs_write(p, buf, count, &p->f_pos);
1161                 fput(p);
1162                 return res;
1163         }
1164         return tty_write(file, buf, count, ppos);
1165 }
1166
1167 static char ptychar[] = "pqrstuvwxyzabcde";
1168
1169 /**
1170  *      pty_line_name   -       generate name for a pty
1171  *      @driver: the tty driver in use
1172  *      @index: the minor number
1173  *      @p: output buffer of at least 6 bytes
1174  *
1175  *      Generate a name from a driver reference and write it to the output
1176  *      buffer.
1177  *
1178  *      Locking: None
1179  */
1180 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1181 {
1182         int i = index + driver->name_base;
1183         /* ->name is initialized to "ttyp", but "tty" is expected */
1184         sprintf(p, "%s%c%x",
1185                 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1186                 ptychar[i >> 4 & 0xf], i & 0xf);
1187 }
1188
1189 /**
1190  *      tty_line_name   -       generate name for a tty
1191  *      @driver: the tty driver in use
1192  *      @index: the minor number
1193  *      @p: output buffer of at least 7 bytes
1194  *
1195  *      Generate a name from a driver reference and write it to the output
1196  *      buffer.
1197  *
1198  *      Locking: None
1199  */
1200 static void tty_line_name(struct tty_driver *driver, int index, char *p)
1201 {
1202         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1203 }
1204
1205 /**
1206  *      tty_driver_lookup_tty() - find an existing tty, if any
1207  *      @driver: the driver for the tty
1208  *      @idx:    the minor number
1209  *
1210  *      Return the tty, if found or ERR_PTR() otherwise.
1211  *
1212  *      Locking: tty_mutex must be held. If tty is found, the mutex must
1213  *      be held until the 'fast-open' is also done. Will change once we
1214  *      have refcounting in the driver and per driver locking
1215  */
1216 struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver, int idx)
1217 {
1218         struct tty_struct *tty;
1219
1220         if (driver->ops->lookup)
1221                 return driver->ops->lookup(driver, idx);
1222
1223         tty = driver->ttys[idx];
1224         return tty;
1225 }
1226
1227 /**
1228  *      tty_init_termios        -  helper for termios setup
1229  *      @tty: the tty to set up
1230  *
1231  *      Initialise the termios structures for this tty. Thus runs under
1232  *      the tty_mutex currently so we can be relaxed about ordering.
1233  */
1234
1235 int tty_init_termios(struct tty_struct *tty)
1236 {
1237         struct ktermios *tp, *ltp;
1238         int idx = tty->index;
1239
1240         tp = tty->driver->termios[idx];
1241         ltp = tty->driver->termios_locked[idx];
1242         if (tp == NULL) {
1243                 WARN_ON(ltp != NULL);
1244                 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1245                 ltp = kzalloc(sizeof(struct ktermios), GFP_KERNEL);
1246                 if (tp == NULL || ltp == NULL) {
1247                         kfree(tp);
1248                         kfree(ltp);
1249                         return -ENOMEM;
1250                 }
1251                 memcpy(tp, &tty->driver->init_termios,
1252                                                 sizeof(struct ktermios));
1253                 tty->driver->termios[idx] = tp;
1254                 tty->driver->termios_locked[idx] = ltp;
1255         }
1256         tty->termios = tp;
1257         tty->termios_locked = ltp;
1258
1259         /* Compatibility until drivers always set this */
1260         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1261         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1262         return 0;
1263 }
1264
1265 /**
1266  *      tty_driver_install_tty() - install a tty entry in the driver
1267  *      @driver: the driver for the tty
1268  *      @tty: the tty
1269  *
1270  *      Install a tty object into the driver tables. The tty->index field
1271  *      will be set by the time this is called. This method is responsible
1272  *      for ensuring any need additional structures are allocated and
1273  *      configured.
1274  *
1275  *      Locking: tty_mutex for now
1276  */
1277 static int tty_driver_install_tty(struct tty_driver *driver,
1278                                                 struct tty_struct *tty)
1279 {
1280         int idx = tty->index;
1281
1282         if (driver->ops->install)
1283                 return driver->ops->install(driver, tty);
1284
1285         if (tty_init_termios(tty) == 0) {
1286                 tty_driver_kref_get(driver);
1287                 tty->count++;
1288                 driver->ttys[idx] = tty;
1289                 return 0;
1290         }
1291         return -ENOMEM;
1292 }
1293
1294 /**
1295  *      tty_driver_remove_tty() - remove a tty from the driver tables
1296  *      @driver: the driver for the tty
1297  *      @idx:    the minor number
1298  *
1299  *      Remvoe a tty object from the driver tables. The tty->index field
1300  *      will be set by the time this is called.
1301  *
1302  *      Locking: tty_mutex for now
1303  */
1304 static void tty_driver_remove_tty(struct tty_driver *driver,
1305                                                 struct tty_struct *tty)
1306 {
1307         if (driver->ops->remove)
1308                 driver->ops->remove(driver, tty);
1309         else
1310                 driver->ttys[tty->index] = NULL;
1311 }
1312
1313 /*
1314  *      tty_reopen()    - fast re-open of an open tty
1315  *      @tty    - the tty to open
1316  *
1317  *      Return 0 on success, -errno on error.
1318  *
1319  *      Locking: tty_mutex must be held from the time the tty was found
1320  *               till this open completes.
1321  */
1322 static int tty_reopen(struct tty_struct *tty)
1323 {
1324         struct tty_driver *driver = tty->driver;
1325
1326         if (test_bit(TTY_CLOSING, &tty->flags))
1327                 return -EIO;
1328
1329         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1330             driver->subtype == PTY_TYPE_MASTER) {
1331                 /*
1332                  * special case for PTY masters: only one open permitted,
1333                  * and the slave side open count is incremented as well.
1334                  */
1335                 if (tty->count)
1336                         return -EIO;
1337
1338                 tty->link->count++;
1339         }
1340         tty->count++;
1341         tty->driver = driver; /* N.B. why do this every time?? */
1342
1343         WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1344
1345         return 0;
1346 }
1347
1348 /**
1349  *      tty_init_dev            -       initialise a tty device
1350  *      @driver: tty driver we are opening a device on
1351  *      @idx: device index
1352  *      @ret_tty: returned tty structure
1353  *      @first_ok: ok to open a new device (used by ptmx)
1354  *
1355  *      Prepare a tty device. This may not be a "new" clean device but
1356  *      could also be an active device. The pty drivers require special
1357  *      handling because of this.
1358  *
1359  *      Locking:
1360  *              The function is called under the tty_mutex, which
1361  *      protects us from the tty struct or driver itself going away.
1362  *
1363  *      On exit the tty device has the line discipline attached and
1364  *      a reference count of 1. If a pair was created for pty/tty use
1365  *      and the other was a pty master then it too has a reference count of 1.
1366  *
1367  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1368  * failed open.  The new code protects the open with a mutex, so it's
1369  * really quite straightforward.  The mutex locking can probably be
1370  * relaxed for the (most common) case of reopening a tty.
1371  */
1372
1373 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
1374                                                                 int first_ok)
1375 {
1376         struct tty_struct *tty;
1377         int retval;
1378
1379         /* Check if pty master is being opened multiple times */
1380         if (driver->subtype == PTY_TYPE_MASTER &&
1381                 (driver->flags & TTY_DRIVER_DEVPTS_MEM) && !first_ok)
1382                 return ERR_PTR(-EIO);
1383
1384         /*
1385          * First time open is complex, especially for PTY devices.
1386          * This code guarantees that either everything succeeds and the
1387          * TTY is ready for operation, or else the table slots are vacated
1388          * and the allocated memory released.  (Except that the termios
1389          * and locked termios may be retained.)
1390          */
1391
1392         if (!try_module_get(driver->owner))
1393                 return ERR_PTR(-ENODEV);
1394
1395         tty = alloc_tty_struct();
1396         if (!tty)
1397                 goto fail_no_mem;
1398         initialize_tty_struct(tty, driver, idx);
1399
1400         retval = tty_driver_install_tty(driver, tty);
1401         if (retval < 0) {
1402                 free_tty_struct(tty);
1403                 module_put(driver->owner);
1404                 return ERR_PTR(retval);
1405         }
1406
1407         /*
1408          * Structures all installed ... call the ldisc open routines.
1409          * If we fail here just call release_tty to clean up.  No need
1410          * to decrement the use counts, as release_tty doesn't care.
1411          */
1412
1413         retval = tty_ldisc_setup(tty, tty->link);
1414         if (retval)
1415                 goto release_mem_out;
1416         return tty;
1417
1418 fail_no_mem:
1419         module_put(driver->owner);
1420         return ERR_PTR(-ENOMEM);
1421
1422         /* call the tty release_tty routine to clean out this slot */
1423 release_mem_out:
1424         if (printk_ratelimit())
1425                 printk(KERN_INFO "tty_init_dev: ldisc open failed, "
1426                                  "clearing slot %d\n", idx);
1427         release_tty(tty, idx);
1428         return ERR_PTR(retval);
1429 }
1430
1431 void tty_free_termios(struct tty_struct *tty)
1432 {
1433         struct ktermios *tp;
1434         int idx = tty->index;
1435         /* Kill this flag and push into drivers for locking etc */
1436         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1437                 /* FIXME: Locking on ->termios array */
1438                 tp = tty->termios;
1439                 tty->driver->termios[idx] = NULL;
1440                 kfree(tp);
1441
1442                 tp = tty->termios_locked;
1443                 tty->driver->termios_locked[idx] = NULL;
1444                 kfree(tp);
1445         }
1446 }
1447 EXPORT_SYMBOL(tty_free_termios);
1448
1449 void tty_shutdown(struct tty_struct *tty)
1450 {
1451         tty_driver_remove_tty(tty->driver, tty);
1452         tty_free_termios(tty);
1453 }
1454 EXPORT_SYMBOL(tty_shutdown);
1455
1456 /**
1457  *      release_one_tty         -       release tty structure memory
1458  *      @kref: kref of tty we are obliterating
1459  *
1460  *      Releases memory associated with a tty structure, and clears out the
1461  *      driver table slots. This function is called when a device is no longer
1462  *      in use. It also gets called when setup of a device fails.
1463  *
1464  *      Locking:
1465  *              tty_mutex - sometimes only
1466  *              takes the file list lock internally when working on the list
1467  *      of ttys that the driver keeps.
1468  */
1469 static void release_one_tty(struct kref *kref)
1470 {
1471         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1472         struct tty_driver *driver = tty->driver;
1473
1474         if (tty->ops->shutdown)
1475                 tty->ops->shutdown(tty);
1476         else
1477                 tty_shutdown(tty);
1478         tty->magic = 0;
1479         tty_driver_kref_put(driver);
1480         module_put(driver->owner);
1481
1482         file_list_lock();
1483         list_del_init(&tty->tty_files);
1484         file_list_unlock();
1485
1486         free_tty_struct(tty);
1487 }
1488
1489 /**
1490  *      tty_kref_put            -       release a tty kref
1491  *      @tty: tty device
1492  *
1493  *      Release a reference to a tty device and if need be let the kref
1494  *      layer destruct the object for us
1495  */
1496
1497 void tty_kref_put(struct tty_struct *tty)
1498 {
1499         if (tty)
1500                 kref_put(&tty->kref, release_one_tty);
1501 }
1502 EXPORT_SYMBOL(tty_kref_put);
1503
1504 /**
1505  *      release_tty             -       release tty structure memory
1506  *
1507  *      Release both @tty and a possible linked partner (think pty pair),
1508  *      and decrement the refcount of the backing module.
1509  *
1510  *      Locking:
1511  *              tty_mutex - sometimes only
1512  *              takes the file list lock internally when working on the list
1513  *      of ttys that the driver keeps.
1514  *              FIXME: should we require tty_mutex is held here ??
1515  *
1516  */
1517 static void release_tty(struct tty_struct *tty, int idx)
1518 {
1519         /* This should always be true but check for the moment */
1520         WARN_ON(tty->index != idx);
1521
1522         if (tty->link)
1523                 tty_kref_put(tty->link);
1524         tty_kref_put(tty);
1525 }
1526
1527 /*
1528  * Even releasing the tty structures is a tricky business.. We have
1529  * to be very careful that the structures are all released at the
1530  * same time, as interrupts might otherwise get the wrong pointers.
1531  *
1532  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1533  * lead to double frees or releasing memory still in use.
1534  */
1535 void tty_release_dev(struct file *filp)
1536 {
1537         struct tty_struct *tty, *o_tty;
1538         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1539         int     devpts;
1540         int     idx;
1541         char    buf[64];
1542
1543         tty = (struct tty_struct *)filp->private_data;
1544         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode,
1545                                                         "tty_release_dev"))
1546                 return;
1547
1548         check_tty_count(tty, "tty_release_dev");
1549
1550         tty_fasync(-1, filp, 0);
1551
1552         idx = tty->index;
1553         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1554                       tty->driver->subtype == PTY_TYPE_MASTER);
1555         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1556         o_tty = tty->link;
1557
1558 #ifdef TTY_PARANOIA_CHECK
1559         if (idx < 0 || idx >= tty->driver->num) {
1560                 printk(KERN_DEBUG "tty_release_dev: bad idx when trying to "
1561                                   "free (%s)\n", tty->name);
1562                 return;
1563         }
1564         if (!devpts) {
1565                 if (tty != tty->driver->ttys[idx]) {
1566                         printk(KERN_DEBUG "tty_release_dev: driver.table[%d] not tty "
1567                                "for (%s)\n", idx, tty->name);
1568                         return;
1569                 }
1570                 if (tty->termios != tty->driver->termios[idx]) {
1571                         printk(KERN_DEBUG "tty_release_dev: driver.termios[%d] not termios "
1572                                "for (%s)\n",
1573                                idx, tty->name);
1574                         return;
1575                 }
1576                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
1577                         printk(KERN_DEBUG "tty_release_dev: driver.termios_locked[%d] not "
1578                                "termios_locked for (%s)\n",
1579                                idx, tty->name);
1580                         return;
1581                 }
1582         }
1583 #endif
1584
1585 #ifdef TTY_DEBUG_HANGUP
1586         printk(KERN_DEBUG "tty_release_dev of %s (tty count=%d)...",
1587                tty_name(tty, buf), tty->count);
1588 #endif
1589
1590 #ifdef TTY_PARANOIA_CHECK
1591         if (tty->driver->other &&
1592              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1593                 if (o_tty != tty->driver->other->ttys[idx]) {
1594                         printk(KERN_DEBUG "tty_release_dev: other->table[%d] "
1595                                           "not o_tty for (%s)\n",
1596                                idx, tty->name);
1597                         return;
1598                 }
1599                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1600                         printk(KERN_DEBUG "tty_release_dev: other->termios[%d] "
1601                                           "not o_termios for (%s)\n",
1602                                idx, tty->name);
1603                         return;
1604                 }
1605                 if (o_tty->termios_locked !=
1606                       tty->driver->other->termios_locked[idx]) {
1607                         printk(KERN_DEBUG "tty_release_dev: other->termios_locked["
1608                                           "%d] not o_termios_locked for (%s)\n",
1609                                idx, tty->name);
1610                         return;
1611                 }
1612                 if (o_tty->link != tty) {
1613                         printk(KERN_DEBUG "tty_release_dev: bad pty pointers\n");
1614                         return;
1615                 }
1616         }
1617 #endif
1618         if (tty->ops->close)
1619                 tty->ops->close(tty, filp);
1620
1621         /*
1622          * Sanity check: if tty->count is going to zero, there shouldn't be
1623          * any waiters on tty->read_wait or tty->write_wait.  We test the
1624          * wait queues and kick everyone out _before_ actually starting to
1625          * close.  This ensures that we won't block while releasing the tty
1626          * structure.
1627          *
1628          * The test for the o_tty closing is necessary, since the master and
1629          * slave sides may close in any order.  If the slave side closes out
1630          * first, its count will be one, since the master side holds an open.
1631          * Thus this test wouldn't be triggered at the time the slave closes,
1632          * so we do it now.
1633          *
1634          * Note that it's possible for the tty to be opened again while we're
1635          * flushing out waiters.  By recalculating the closing flags before
1636          * each iteration we avoid any problems.
1637          */
1638         while (1) {
1639                 /* Guard against races with tty->count changes elsewhere and
1640                    opens on /dev/tty */
1641
1642                 mutex_lock(&tty_mutex);
1643                 tty_closing = tty->count <= 1;
1644                 o_tty_closing = o_tty &&
1645                         (o_tty->count <= (pty_master ? 1 : 0));
1646                 do_sleep = 0;
1647
1648                 if (tty_closing) {
1649                         if (waitqueue_active(&tty->read_wait)) {
1650                                 wake_up(&tty->read_wait);
1651                                 do_sleep++;
1652                         }
1653                         if (waitqueue_active(&tty->write_wait)) {
1654                                 wake_up(&tty->write_wait);
1655                                 do_sleep++;
1656                         }
1657                 }
1658                 if (o_tty_closing) {
1659                         if (waitqueue_active(&o_tty->read_wait)) {
1660                                 wake_up(&o_tty->read_wait);
1661                                 do_sleep++;
1662                         }
1663                         if (waitqueue_active(&o_tty->write_wait)) {
1664                                 wake_up(&o_tty->write_wait);
1665                                 do_sleep++;
1666                         }
1667                 }
1668                 if (!do_sleep)
1669                         break;
1670
1671                 printk(KERN_WARNING "tty_release_dev: %s: read/write wait queue "
1672                                     "active!\n", tty_name(tty, buf));
1673                 mutex_unlock(&tty_mutex);
1674                 schedule();
1675         }
1676
1677         /*
1678          * The closing flags are now consistent with the open counts on
1679          * both sides, and we've completed the last operation that could
1680          * block, so it's safe to proceed with closing.
1681          */
1682         if (pty_master) {
1683                 if (--o_tty->count < 0) {
1684                         printk(KERN_WARNING "tty_release_dev: bad pty slave count "
1685                                             "(%d) for %s\n",
1686                                o_tty->count, tty_name(o_tty, buf));
1687                         o_tty->count = 0;
1688                 }
1689         }
1690         if (--tty->count < 0) {
1691                 printk(KERN_WARNING "tty_release_dev: bad tty->count (%d) for %s\n",
1692                        tty->count, tty_name(tty, buf));
1693                 tty->count = 0;
1694         }
1695
1696         /*
1697          * We've decremented tty->count, so we need to remove this file
1698          * descriptor off the tty->tty_files list; this serves two
1699          * purposes:
1700          *  - check_tty_count sees the correct number of file descriptors
1701          *    associated with this tty.
1702          *  - do_tty_hangup no longer sees this file descriptor as
1703          *    something that needs to be handled for hangups.
1704          */
1705         file_kill(filp);
1706         filp->private_data = NULL;
1707
1708         /*
1709          * Perform some housekeeping before deciding whether to return.
1710          *
1711          * Set the TTY_CLOSING flag if this was the last open.  In the
1712          * case of a pty we may have to wait around for the other side
1713          * to close, and TTY_CLOSING makes sure we can't be reopened.
1714          */
1715         if (tty_closing)
1716                 set_bit(TTY_CLOSING, &tty->flags);
1717         if (o_tty_closing)
1718                 set_bit(TTY_CLOSING, &o_tty->flags);
1719
1720         /*
1721          * If _either_ side is closing, make sure there aren't any
1722          * processes that still think tty or o_tty is their controlling
1723          * tty.
1724          */
1725         if (tty_closing || o_tty_closing) {
1726                 read_lock(&tasklist_lock);
1727                 session_clear_tty(tty->session);
1728                 if (o_tty)
1729                         session_clear_tty(o_tty->session);
1730                 read_unlock(&tasklist_lock);
1731         }
1732
1733         mutex_unlock(&tty_mutex);
1734
1735         /* check whether both sides are closing ... */
1736         if (!tty_closing || (o_tty && !o_tty_closing))
1737                 return;
1738
1739 #ifdef TTY_DEBUG_HANGUP
1740         printk(KERN_DEBUG "freeing tty structure...");
1741 #endif
1742         /*
1743          * Ask the line discipline code to release its structures
1744          */
1745         tty_ldisc_release(tty, o_tty);
1746         /*
1747          * The release_tty function takes care of the details of clearing
1748          * the slots and preserving the termios structure.
1749          */
1750         release_tty(tty, idx);
1751
1752         /* Make this pty number available for reallocation */
1753         if (devpts)
1754                 devpts_kill_index(idx);
1755 }
1756
1757 /**
1758  *      __tty_open              -       open a tty device
1759  *      @inode: inode of device file
1760  *      @filp: file pointer to tty
1761  *
1762  *      tty_open and tty_release keep up the tty count that contains the
1763  *      number of opens done on a tty. We cannot use the inode-count, as
1764  *      different inodes might point to the same tty.
1765  *
1766  *      Open-counting is needed for pty masters, as well as for keeping
1767  *      track of serial lines: DTR is dropped when the last close happens.
1768  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
1769  *
1770  *      The termios state of a pty is reset on first open so that
1771  *      settings don't persist across reuse.
1772  *
1773  *      Locking: tty_mutex protects tty, get_tty_driver and tty_init_dev work.
1774  *               tty->count should protect the rest.
1775  *               ->siglock protects ->signal/->sighand
1776  */
1777
1778 static int __tty_open(struct inode *inode, struct file *filp)
1779 {
1780         struct tty_struct *tty = NULL;
1781         int noctty, retval;
1782         struct tty_driver *driver;
1783         int index;
1784         dev_t device = inode->i_rdev;
1785         unsigned short saved_flags = filp->f_flags;
1786
1787         nonseekable_open(inode, filp);
1788
1789 retry_open:
1790         noctty = filp->f_flags & O_NOCTTY;
1791         index  = -1;
1792         retval = 0;
1793
1794         mutex_lock(&tty_mutex);
1795
1796         if (device == MKDEV(TTYAUX_MAJOR, 0)) {
1797                 tty = get_current_tty();
1798                 if (!tty) {
1799                         mutex_unlock(&tty_mutex);
1800                         return -ENXIO;
1801                 }
1802                 driver = tty_driver_kref_get(tty->driver);
1803                 index = tty->index;
1804                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1805                 /* noctty = 1; */
1806                 /* FIXME: Should we take a driver reference ? */
1807                 tty_kref_put(tty);
1808                 goto got_driver;
1809         }
1810 #ifdef CONFIG_VT
1811         if (device == MKDEV(TTY_MAJOR, 0)) {
1812                 extern struct tty_driver *console_driver;
1813                 driver = tty_driver_kref_get(console_driver);
1814                 index = fg_console;
1815                 noctty = 1;
1816                 goto got_driver;
1817         }
1818 #endif
1819         if (device == MKDEV(TTYAUX_MAJOR, 1)) {
1820                 driver = tty_driver_kref_get(console_device(&index));
1821                 if (driver) {
1822                         /* Don't let /dev/console block */
1823                         filp->f_flags |= O_NONBLOCK;
1824                         noctty = 1;
1825                         goto got_driver;
1826                 }
1827                 mutex_unlock(&tty_mutex);
1828                 return -ENODEV;
1829         }
1830
1831         driver = get_tty_driver(device, &index);
1832         if (!driver) {
1833                 mutex_unlock(&tty_mutex);
1834                 return -ENODEV;
1835         }
1836 got_driver:
1837         if (!tty) {
1838                 /* check whether we're reopening an existing tty */
1839                 tty = tty_driver_lookup_tty(driver, index);
1840
1841                 if (IS_ERR(tty))
1842                         return PTR_ERR(tty);
1843         }
1844
1845         if (tty) {
1846                 retval = tty_reopen(tty);
1847                 if (retval)
1848                         tty = ERR_PTR(retval);
1849         } else
1850                 tty = tty_init_dev(driver, index, 0);
1851
1852         mutex_unlock(&tty_mutex);
1853         tty_driver_kref_put(driver);
1854         if (IS_ERR(tty))
1855                 return PTR_ERR(tty);
1856
1857         filp->private_data = tty;
1858         file_move(filp, &tty->tty_files);
1859         check_tty_count(tty, "tty_open");
1860         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1861             tty->driver->subtype == PTY_TYPE_MASTER)
1862                 noctty = 1;
1863 #ifdef TTY_DEBUG_HANGUP
1864         printk(KERN_DEBUG "opening %s...", tty->name);
1865 #endif
1866         if (!retval) {
1867                 if (tty->ops->open)
1868                         retval = tty->ops->open(tty, filp);
1869                 else
1870                         retval = -ENODEV;
1871         }
1872         filp->f_flags = saved_flags;
1873
1874         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
1875                                                 !capable(CAP_SYS_ADMIN))
1876                 retval = -EBUSY;
1877
1878         if (retval) {
1879 #ifdef TTY_DEBUG_HANGUP
1880                 printk(KERN_DEBUG "error %d in opening %s...", retval,
1881                        tty->name);
1882 #endif
1883                 tty_release_dev(filp);
1884                 if (retval != -ERESTARTSYS)
1885                         return retval;
1886                 if (signal_pending(current))
1887                         return retval;
1888                 schedule();
1889                 /*
1890                  * Need to reset f_op in case a hangup happened.
1891                  */
1892                 if (filp->f_op == &hung_up_tty_fops)
1893                         filp->f_op = &tty_fops;
1894                 goto retry_open;
1895         }
1896
1897         mutex_lock(&tty_mutex);
1898         spin_lock_irq(&current->sighand->siglock);
1899         if (!noctty &&
1900             current->signal->leader &&
1901             !current->signal->tty &&
1902             tty->session == NULL)
1903                 __proc_set_tty(current, tty);
1904         spin_unlock_irq(&current->sighand->siglock);
1905         mutex_unlock(&tty_mutex);
1906         return 0;
1907 }
1908
1909 /* BKL pushdown: scary code avoidance wrapper */
1910 static int tty_open(struct inode *inode, struct file *filp)
1911 {
1912         int ret;
1913
1914         lock_kernel();
1915         ret = __tty_open(inode, filp);
1916         unlock_kernel();
1917         return ret;
1918 }
1919
1920
1921
1922
1923 /**
1924  *      tty_release             -       vfs callback for close
1925  *      @inode: inode of tty
1926  *      @filp: file pointer for handle to tty
1927  *
1928  *      Called the last time each file handle is closed that references
1929  *      this tty. There may however be several such references.
1930  *
1931  *      Locking:
1932  *              Takes bkl. See tty_release_dev
1933  */
1934
1935 static int tty_release(struct inode *inode, struct file *filp)
1936 {
1937         lock_kernel();
1938         tty_release_dev(filp);
1939         unlock_kernel();
1940         return 0;
1941 }
1942
1943 /**
1944  *      tty_poll        -       check tty status
1945  *      @filp: file being polled
1946  *      @wait: poll wait structures to update
1947  *
1948  *      Call the line discipline polling method to obtain the poll
1949  *      status of the device.
1950  *
1951  *      Locking: locks called line discipline but ldisc poll method
1952  *      may be re-entered freely by other callers.
1953  */
1954
1955 static unsigned int tty_poll(struct file *filp, poll_table *wait)
1956 {
1957         struct tty_struct *tty;
1958         struct tty_ldisc *ld;
1959         int ret = 0;
1960
1961         tty = (struct tty_struct *)filp->private_data;
1962         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
1963                 return 0;
1964
1965         ld = tty_ldisc_ref_wait(tty);
1966         if (ld->ops->poll)
1967                 ret = (ld->ops->poll)(tty, filp, wait);
1968         tty_ldisc_deref(ld);
1969         return ret;
1970 }
1971
1972 static int tty_fasync(int fd, struct file *filp, int on)
1973 {
1974         struct tty_struct *tty;
1975         unsigned long flags;
1976         int retval = 0;
1977
1978         lock_kernel();
1979         tty = (struct tty_struct *)filp->private_data;
1980         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
1981                 goto out;
1982
1983         retval = fasync_helper(fd, filp, on, &tty->fasync);
1984         if (retval <= 0)
1985                 goto out;
1986
1987         if (on) {
1988                 enum pid_type type;
1989                 struct pid *pid;
1990                 if (!waitqueue_active(&tty->read_wait))
1991                         tty->minimum_to_wake = 1;
1992                 spin_lock_irqsave(&tty->ctrl_lock, flags);
1993                 if (tty->pgrp) {
1994                         pid = tty->pgrp;
1995                         type = PIDTYPE_PGID;
1996                 } else {
1997                         pid = task_pid(current);
1998                         type = PIDTYPE_PID;
1999                 }
2000                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2001                 retval = __f_setown(filp, pid, type, 0);
2002                 if (retval)
2003                         goto out;
2004         } else {
2005                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2006                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2007         }
2008         retval = 0;
2009 out:
2010         unlock_kernel();
2011         return retval;
2012 }
2013
2014 /**
2015  *      tiocsti                 -       fake input character
2016  *      @tty: tty to fake input into
2017  *      @p: pointer to character
2018  *
2019  *      Fake input to a tty device. Does the necessary locking and
2020  *      input management.
2021  *
2022  *      FIXME: does not honour flow control ??
2023  *
2024  *      Locking:
2025  *              Called functions take tty_ldisc_lock
2026  *              current->signal->tty check is safe without locks
2027  *
2028  *      FIXME: may race normal receive processing
2029  */
2030
2031 static int tiocsti(struct tty_struct *tty, char __user *p)
2032 {
2033         char ch, mbz = 0;
2034         struct tty_ldisc *ld;
2035
2036         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2037                 return -EPERM;
2038         if (get_user(ch, p))
2039                 return -EFAULT;
2040         ld = tty_ldisc_ref_wait(tty);
2041         ld->ops->receive_buf(tty, &ch, &mbz, 1);
2042         tty_ldisc_deref(ld);
2043         return 0;
2044 }
2045
2046 /**
2047  *      tiocgwinsz              -       implement window query ioctl
2048  *      @tty; tty
2049  *      @arg: user buffer for result
2050  *
2051  *      Copies the kernel idea of the window size into the user buffer.
2052  *
2053  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2054  *              is consistent.
2055  */
2056
2057 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2058 {
2059         int err;
2060
2061         mutex_lock(&tty->termios_mutex);
2062         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2063         mutex_unlock(&tty->termios_mutex);
2064
2065         return err ? -EFAULT: 0;
2066 }
2067
2068 /**
2069  *      tty_do_resize           -       resize event
2070  *      @tty: tty being resized
2071  *      @real_tty: real tty (not the same as tty if using a pty/tty pair)
2072  *      @rows: rows (character)
2073  *      @cols: cols (character)
2074  *
2075  *      Update the termios variables and send the neccessary signals to
2076  *      peform a terminal resize correctly
2077  */
2078
2079 int tty_do_resize(struct tty_struct *tty, struct tty_struct *real_tty,
2080                                         struct winsize *ws)
2081 {
2082         struct pid *pgrp, *rpgrp;
2083         unsigned long flags;
2084
2085         /* For a PTY we need to lock the tty side */
2086         mutex_lock(&real_tty->termios_mutex);
2087         if (!memcmp(ws, &real_tty->winsize, sizeof(*ws)))
2088                 goto done;
2089         /* Get the PID values and reference them so we can
2090            avoid holding the tty ctrl lock while sending signals */
2091         spin_lock_irqsave(&tty->ctrl_lock, flags);
2092         pgrp = get_pid(tty->pgrp);
2093         rpgrp = get_pid(real_tty->pgrp);
2094         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2095
2096         if (pgrp)
2097                 kill_pgrp(pgrp, SIGWINCH, 1);
2098         if (rpgrp != pgrp && rpgrp)
2099                 kill_pgrp(rpgrp, SIGWINCH, 1);
2100
2101         put_pid(pgrp);
2102         put_pid(rpgrp);
2103
2104         tty->winsize = *ws;
2105         real_tty->winsize = *ws;
2106 done:
2107         mutex_unlock(&real_tty->termios_mutex);
2108         return 0;
2109 }
2110
2111 /**
2112  *      tiocswinsz              -       implement window size set ioctl
2113  *      @tty; tty
2114  *      @arg: user buffer for result
2115  *
2116  *      Copies the user idea of the window size to the kernel. Traditionally
2117  *      this is just advisory information but for the Linux console it
2118  *      actually has driver level meaning and triggers a VC resize.
2119  *
2120  *      Locking:
2121  *              Driver dependant. The default do_resize method takes the
2122  *      tty termios mutex and ctrl_lock. The console takes its own lock
2123  *      then calls into the default method.
2124  */
2125
2126 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2127         struct winsize __user *arg)
2128 {
2129         struct winsize tmp_ws;
2130         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2131                 return -EFAULT;
2132
2133         if (tty->ops->resize)
2134                 return tty->ops->resize(tty, real_tty, &tmp_ws);
2135         else
2136                 return tty_do_resize(tty, real_tty, &tmp_ws);
2137 }
2138
2139 /**
2140  *      tioccons        -       allow admin to move logical console
2141  *      @file: the file to become console
2142  *
2143  *      Allow the adminstrator to move the redirected console device
2144  *
2145  *      Locking: uses redirect_lock to guard the redirect information
2146  */
2147
2148 static int tioccons(struct file *file)
2149 {
2150         if (!capable(CAP_SYS_ADMIN))
2151                 return -EPERM;
2152         if (file->f_op->write == redirected_tty_write) {
2153                 struct file *f;
2154                 spin_lock(&redirect_lock);
2155                 f = redirect;
2156                 redirect = NULL;
2157                 spin_unlock(&redirect_lock);
2158                 if (f)
2159                         fput(f);
2160                 return 0;
2161         }
2162         spin_lock(&redirect_lock);
2163         if (redirect) {
2164                 spin_unlock(&redirect_lock);
2165                 return -EBUSY;
2166         }
2167         get_file(file);
2168         redirect = file;
2169         spin_unlock(&redirect_lock);
2170         return 0;
2171 }
2172
2173 /**
2174  *      fionbio         -       non blocking ioctl
2175  *      @file: file to set blocking value
2176  *      @p: user parameter
2177  *
2178  *      Historical tty interfaces had a blocking control ioctl before
2179  *      the generic functionality existed. This piece of history is preserved
2180  *      in the expected tty API of posix OS's.
2181  *
2182  *      Locking: none, the open fle handle ensures it won't go away.
2183  */
2184
2185 static int fionbio(struct file *file, int __user *p)
2186 {
2187         int nonblock;
2188
2189         if (get_user(nonblock, p))
2190                 return -EFAULT;
2191
2192         /* file->f_flags is still BKL protected in the fs layer - vomit */
2193         lock_kernel();
2194         if (nonblock)
2195                 file->f_flags |= O_NONBLOCK;
2196         else
2197                 file->f_flags &= ~O_NONBLOCK;
2198         unlock_kernel();
2199         return 0;
2200 }
2201
2202 /**
2203  *      tiocsctty       -       set controlling tty
2204  *      @tty: tty structure
2205  *      @arg: user argument
2206  *
2207  *      This ioctl is used to manage job control. It permits a session
2208  *      leader to set this tty as the controlling tty for the session.
2209  *
2210  *      Locking:
2211  *              Takes tty_mutex() to protect tty instance
2212  *              Takes tasklist_lock internally to walk sessions
2213  *              Takes ->siglock() when updating signal->tty
2214  */
2215
2216 static int tiocsctty(struct tty_struct *tty, int arg)
2217 {
2218         int ret = 0;
2219         if (current->signal->leader && (task_session(current) == tty->session))
2220                 return ret;
2221
2222         mutex_lock(&tty_mutex);
2223         /*
2224          * The process must be a session leader and
2225          * not have a controlling tty already.
2226          */
2227         if (!current->signal->leader || current->signal->tty) {
2228                 ret = -EPERM;
2229                 goto unlock;
2230         }
2231
2232         if (tty->session) {
2233                 /*
2234                  * This tty is already the controlling
2235                  * tty for another session group!
2236                  */
2237                 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2238                         /*
2239                          * Steal it away
2240                          */
2241                         read_lock(&tasklist_lock);
2242                         session_clear_tty(tty->session);
2243                         read_unlock(&tasklist_lock);
2244                 } else {
2245                         ret = -EPERM;
2246                         goto unlock;
2247                 }
2248         }
2249         proc_set_tty(current, tty);
2250 unlock:
2251         mutex_unlock(&tty_mutex);
2252         return ret;
2253 }
2254
2255 /**
2256  *      tty_get_pgrp    -       return a ref counted pgrp pid
2257  *      @tty: tty to read
2258  *
2259  *      Returns a refcounted instance of the pid struct for the process
2260  *      group controlling the tty.
2261  */
2262
2263 struct pid *tty_get_pgrp(struct tty_struct *tty)
2264 {
2265         unsigned long flags;
2266         struct pid *pgrp;
2267
2268         spin_lock_irqsave(&tty->ctrl_lock, flags);
2269         pgrp = get_pid(tty->pgrp);
2270         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2271
2272         return pgrp;
2273 }
2274 EXPORT_SYMBOL_GPL(tty_get_pgrp);
2275
2276 /**
2277  *      tiocgpgrp               -       get process group
2278  *      @tty: tty passed by user
2279  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
2280  *      @p: returned pid
2281  *
2282  *      Obtain the process group of the tty. If there is no process group
2283  *      return an error.
2284  *
2285  *      Locking: none. Reference to current->signal->tty is safe.
2286  */
2287
2288 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2289 {
2290         struct pid *pid;
2291         int ret;
2292         /*
2293          * (tty == real_tty) is a cheap way of
2294          * testing if the tty is NOT a master pty.
2295          */
2296         if (tty == real_tty && current->signal->tty != real_tty)
2297                 return -ENOTTY;
2298         pid = tty_get_pgrp(real_tty);
2299         ret =  put_user(pid_vnr(pid), p);
2300         put_pid(pid);
2301         return ret;
2302 }
2303
2304 /**
2305  *      tiocspgrp               -       attempt to set process group
2306  *      @tty: tty passed by user
2307  *      @real_tty: tty side device matching tty passed by user
2308  *      @p: pid pointer
2309  *
2310  *      Set the process group of the tty to the session passed. Only
2311  *      permitted where the tty session is our session.
2312  *
2313  *      Locking: RCU, ctrl lock
2314  */
2315
2316 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2317 {
2318         struct pid *pgrp;
2319         pid_t pgrp_nr;
2320         int retval = tty_check_change(real_tty);
2321         unsigned long flags;
2322
2323         if (retval == -EIO)
2324                 return -ENOTTY;
2325         if (retval)
2326                 return retval;
2327         if (!current->signal->tty ||
2328             (current->signal->tty != real_tty) ||
2329             (real_tty->session != task_session(current)))
2330                 return -ENOTTY;
2331         if (get_user(pgrp_nr, p))
2332                 return -EFAULT;
2333         if (pgrp_nr < 0)
2334                 return -EINVAL;
2335         rcu_read_lock();
2336         pgrp = find_vpid(pgrp_nr);
2337         retval = -ESRCH;
2338         if (!pgrp)
2339                 goto out_unlock;
2340         retval = -EPERM;
2341         if (session_of_pgrp(pgrp) != task_session(current))
2342                 goto out_unlock;
2343         retval = 0;
2344         spin_lock_irqsave(&tty->ctrl_lock, flags);
2345         put_pid(real_tty->pgrp);
2346         real_tty->pgrp = get_pid(pgrp);
2347         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2348 out_unlock:
2349         rcu_read_unlock();
2350         return retval;
2351 }
2352
2353 /**
2354  *      tiocgsid                -       get session id
2355  *      @tty: tty passed by user
2356  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
2357  *      @p: pointer to returned session id
2358  *
2359  *      Obtain the session id of the tty. If there is no session
2360  *      return an error.
2361  *
2362  *      Locking: none. Reference to current->signal->tty is safe.
2363  */
2364
2365 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2366 {
2367         /*
2368          * (tty == real_tty) is a cheap way of
2369          * testing if the tty is NOT a master pty.
2370         */
2371         if (tty == real_tty && current->signal->tty != real_tty)
2372                 return -ENOTTY;
2373         if (!real_tty->session)
2374                 return -ENOTTY;
2375         return put_user(pid_vnr(real_tty->session), p);
2376 }
2377
2378 /**
2379  *      tiocsetd        -       set line discipline
2380  *      @tty: tty device
2381  *      @p: pointer to user data
2382  *
2383  *      Set the line discipline according to user request.
2384  *
2385  *      Locking: see tty_set_ldisc, this function is just a helper
2386  */
2387
2388 static int tiocsetd(struct tty_struct *tty, int __user *p)
2389 {
2390         int ldisc;
2391         int ret;
2392
2393         if (get_user(ldisc, p))
2394                 return -EFAULT;
2395
2396         lock_kernel();
2397         ret = tty_set_ldisc(tty, ldisc);
2398         unlock_kernel();
2399
2400         return ret;
2401 }
2402
2403 /**
2404  *      send_break      -       performed time break
2405  *      @tty: device to break on
2406  *      @duration: timeout in mS
2407  *
2408  *      Perform a timed break on hardware that lacks its own driver level
2409  *      timed break functionality.
2410  *
2411  *      Locking:
2412  *              atomic_write_lock serializes
2413  *
2414  */
2415
2416 static int send_break(struct tty_struct *tty, unsigned int duration)
2417 {
2418         int retval;
2419
2420         if (tty->ops->break_ctl == NULL)
2421                 return 0;
2422
2423         if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2424                 retval = tty->ops->break_ctl(tty, duration);
2425         else {
2426                 /* Do the work ourselves */
2427                 if (tty_write_lock(tty, 0) < 0)
2428                         return -EINTR;
2429                 retval = tty->ops->break_ctl(tty, -1);
2430                 if (retval)
2431                         goto out;
2432                 if (!signal_pending(current))
2433                         msleep_interruptible(duration);
2434                 retval = tty->ops->break_ctl(tty, 0);
2435 out:
2436                 tty_write_unlock(tty);
2437                 if (signal_pending(current))
2438                         retval = -EINTR;
2439         }
2440         return retval;
2441 }
2442
2443 /**
2444  *      tty_tiocmget            -       get modem status
2445  *      @tty: tty device
2446  *      @file: user file pointer
2447  *      @p: pointer to result
2448  *
2449  *      Obtain the modem status bits from the tty driver if the feature
2450  *      is supported. Return -EINVAL if it is not available.
2451  *
2452  *      Locking: none (up to the driver)
2453  */
2454
2455 static int tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
2456 {
2457         int retval = -EINVAL;
2458
2459         if (tty->ops->tiocmget) {
2460                 retval = tty->ops->tiocmget(tty, file);
2461
2462                 if (retval >= 0)
2463                         retval = put_user(retval, p);
2464         }
2465         return retval;
2466 }
2467
2468 /**
2469  *      tty_tiocmset            -       set modem status
2470  *      @tty: tty device
2471  *      @file: user file pointer
2472  *      @cmd: command - clear bits, set bits or set all
2473  *      @p: pointer to desired bits
2474  *
2475  *      Set the modem status bits from the tty driver if the feature
2476  *      is supported. Return -EINVAL if it is not available.
2477  *
2478  *      Locking: none (up to the driver)
2479  */
2480
2481 static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
2482              unsigned __user *p)
2483 {
2484         int retval;
2485         unsigned int set, clear, val;
2486
2487         if (tty->ops->tiocmset == NULL)
2488                 return -EINVAL;
2489
2490         retval = get_user(val, p);
2491         if (retval)
2492                 return retval;
2493         set = clear = 0;
2494         switch (cmd) {
2495         case TIOCMBIS:
2496                 set = val;
2497                 break;
2498         case TIOCMBIC:
2499                 clear = val;
2500                 break;
2501         case TIOCMSET:
2502                 set = val;
2503                 clear = ~val;
2504                 break;
2505         }
2506         set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2507         clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2508         return tty->ops->tiocmset(tty, file, set, clear);
2509 }
2510
2511 /*
2512  * Split this up, as gcc can choke on it otherwise..
2513  */
2514 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2515 {
2516         struct tty_struct *tty, *real_tty;
2517         void __user *p = (void __user *)arg;
2518         int retval;
2519         struct tty_ldisc *ld;
2520         struct inode *inode = file->f_dentry->d_inode;
2521
2522         tty = (struct tty_struct *)file->private_data;
2523         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2524                 return -EINVAL;
2525
2526         real_tty = tty;
2527         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2528             tty->driver->subtype == PTY_TYPE_MASTER)
2529                 real_tty = tty->link;
2530
2531
2532         /*
2533          * Factor out some common prep work
2534          */
2535         switch (cmd) {
2536         case TIOCSETD:
2537         case TIOCSBRK:
2538         case TIOCCBRK:
2539         case TCSBRK:
2540         case TCSBRKP:
2541                 retval = tty_check_change(tty);
2542                 if (retval)
2543                         return retval;
2544                 if (cmd != TIOCCBRK) {
2545                         tty_wait_until_sent(tty, 0);
2546                         if (signal_pending(current))
2547                                 return -EINTR;
2548                 }
2549                 break;
2550         }
2551
2552         /*
2553          *      Now do the stuff.
2554          */
2555         switch (cmd) {
2556         case TIOCSTI:
2557                 return tiocsti(tty, p);
2558         case TIOCGWINSZ:
2559                 return tiocgwinsz(real_tty, p);
2560         case TIOCSWINSZ:
2561                 return tiocswinsz(tty, real_tty, p);
2562         case TIOCCONS:
2563                 return real_tty != tty ? -EINVAL : tioccons(file);
2564         case FIONBIO:
2565                 return fionbio(file, p);
2566         case TIOCEXCL:
2567                 set_bit(TTY_EXCLUSIVE, &tty->flags);
2568                 return 0;
2569         case TIOCNXCL:
2570                 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2571                 return 0;
2572         case TIOCNOTTY:
2573                 if (current->signal->tty != tty)
2574                         return -ENOTTY;
2575                 no_tty();
2576                 return 0;
2577         case TIOCSCTTY:
2578                 return tiocsctty(tty, arg);
2579         case TIOCGPGRP:
2580                 return tiocgpgrp(tty, real_tty, p);
2581         case TIOCSPGRP:
2582                 return tiocspgrp(tty, real_tty, p);
2583         case TIOCGSID:
2584                 return tiocgsid(tty, real_tty, p);
2585         case TIOCGETD:
2586                 return put_user(tty->ldisc.ops->num, (int __user *)p);
2587         case TIOCSETD:
2588                 return tiocsetd(tty, p);
2589         /*
2590          * Break handling
2591          */
2592         case TIOCSBRK:  /* Turn break on, unconditionally */
2593                 if (tty->ops->break_ctl)
2594                         return tty->ops->break_ctl(tty, -1);
2595                 return 0;
2596         case TIOCCBRK:  /* Turn break off, unconditionally */
2597                 if (tty->ops->break_ctl)
2598                         return tty->ops->break_ctl(tty, 0);
2599                 return 0;
2600         case TCSBRK:   /* SVID version: non-zero arg --> no break */
2601                 /* non-zero arg means wait for all output data
2602                  * to be sent (performed above) but don't send break.
2603                  * This is used by the tcdrain() termios function.
2604                  */
2605                 if (!arg)
2606                         return send_break(tty, 250);
2607                 return 0;
2608         case TCSBRKP:   /* support for POSIX tcsendbreak() */
2609                 return send_break(tty, arg ? arg*100 : 250);
2610
2611         case TIOCMGET:
2612                 return tty_tiocmget(tty, file, p);
2613         case TIOCMSET:
2614         case TIOCMBIC:
2615         case TIOCMBIS:
2616                 return tty_tiocmset(tty, file, cmd, p);
2617         case TCFLSH:
2618                 switch (arg) {
2619                 case TCIFLUSH:
2620                 case TCIOFLUSH:
2621                 /* flush tty buffer and allow ldisc to process ioctl */
2622                         tty_buffer_flush(tty);
2623                         break;
2624                 }
2625                 break;
2626         }
2627         if (tty->ops->ioctl) {
2628                 retval = (tty->ops->ioctl)(tty, file, cmd, arg);
2629                 if (retval != -ENOIOCTLCMD)
2630                         return retval;
2631         }
2632         ld = tty_ldisc_ref_wait(tty);
2633         retval = -EINVAL;
2634         if (ld->ops->ioctl) {
2635                 retval = ld->ops->ioctl(tty, file, cmd, arg);
2636                 if (retval == -ENOIOCTLCMD)
2637                         retval = -EINVAL;
2638         }
2639         tty_ldisc_deref(ld);
2640         return retval;
2641 }
2642
2643 #ifdef CONFIG_COMPAT
2644 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2645                                 unsigned long arg)
2646 {
2647         struct inode *inode = file->f_dentry->d_inode;
2648         struct tty_struct *tty = file->private_data;
2649         struct tty_ldisc *ld;
2650         int retval = -ENOIOCTLCMD;
2651
2652         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2653                 return -EINVAL;
2654
2655         if (tty->ops->compat_ioctl) {
2656                 retval = (tty->ops->compat_ioctl)(tty, file, cmd, arg);
2657                 if (retval != -ENOIOCTLCMD)
2658                         return retval;
2659         }
2660
2661         ld = tty_ldisc_ref_wait(tty);
2662         if (ld->ops->compat_ioctl)
2663                 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2664         tty_ldisc_deref(ld);
2665
2666         return retval;
2667 }
2668 #endif
2669
2670 /*
2671  * This implements the "Secure Attention Key" ---  the idea is to
2672  * prevent trojan horses by killing all processes associated with this
2673  * tty when the user hits the "Secure Attention Key".  Required for
2674  * super-paranoid applications --- see the Orange Book for more details.
2675  *
2676  * This code could be nicer; ideally it should send a HUP, wait a few
2677  * seconds, then send a INT, and then a KILL signal.  But you then
2678  * have to coordinate with the init process, since all processes associated
2679  * with the current tty must be dead before the new getty is allowed
2680  * to spawn.
2681  *
2682  * Now, if it would be correct ;-/ The current code has a nasty hole -
2683  * it doesn't catch files in flight. We may send the descriptor to ourselves
2684  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2685  *
2686  * Nasty bug: do_SAK is being called in interrupt context.  This can
2687  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2688  */
2689 void __do_SAK(struct tty_struct *tty)
2690 {
2691 #ifdef TTY_SOFT_SAK
2692         tty_hangup(tty);
2693 #else
2694         struct task_struct *g, *p;
2695         struct pid *session;
2696         int             i;
2697         struct file     *filp;
2698         struct fdtable *fdt;
2699
2700         if (!tty)
2701                 return;
2702         session = tty->session;
2703
2704         tty_ldisc_flush(tty);
2705
2706         tty_driver_flush_buffer(tty);
2707
2708         read_lock(&tasklist_lock);
2709         /* Kill the entire session */
2710         do_each_pid_task(session, PIDTYPE_SID, p) {
2711                 printk(KERN_NOTICE "SAK: killed process %d"
2712                         " (%s): task_session_nr(p)==tty->session\n",
2713                         task_pid_nr(p), p->comm);
2714                 send_sig(SIGKILL, p, 1);
2715         } while_each_pid_task(session, PIDTYPE_SID, p);
2716         /* Now kill any processes that happen to have the
2717          * tty open.
2718          */
2719         do_each_thread(g, p) {
2720                 if (p->signal->tty == tty) {
2721                         printk(KERN_NOTICE "SAK: killed process %d"
2722                             " (%s): task_session_nr(p)==tty->session\n",
2723                             task_pid_nr(p), p->comm);
2724                         send_sig(SIGKILL, p, 1);
2725                         continue;
2726                 }
2727                 task_lock(p);
2728                 if (p->files) {
2729                         /*
2730                          * We don't take a ref to the file, so we must
2731                          * hold ->file_lock instead.
2732                          */
2733                         spin_lock(&p->files->file_lock);
2734                         fdt = files_fdtable(p->files);
2735                         for (i = 0; i < fdt->max_fds; i++) {
2736                                 filp = fcheck_files(p->files, i);
2737                                 if (!filp)
2738                                         continue;
2739                                 if (filp->f_op->read == tty_read &&
2740                                     filp->private_data == tty) {
2741                                         printk(KERN_NOTICE "SAK: killed process %d"
2742                                             " (%s): fd#%d opened to the tty\n",
2743                                             task_pid_nr(p), p->comm, i);
2744                                         force_sig(SIGKILL, p);
2745                                         break;
2746                                 }
2747                         }
2748                         spin_unlock(&p->files->file_lock);
2749                 }
2750                 task_unlock(p);
2751         } while_each_thread(g, p);
2752         read_unlock(&tasklist_lock);
2753 #endif
2754 }
2755
2756 static void do_SAK_work(struct work_struct *work)
2757 {
2758         struct tty_struct *tty =
2759                 container_of(work, struct tty_struct, SAK_work);
2760         __do_SAK(tty);
2761 }
2762
2763 /*
2764  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2765  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2766  * the values which we write to it will be identical to the values which it
2767  * already has. --akpm
2768  */
2769 void do_SAK(struct tty_struct *tty)
2770 {
2771         if (!tty)
2772                 return;
2773         schedule_work(&tty->SAK_work);
2774 }
2775
2776 EXPORT_SYMBOL(do_SAK);
2777
2778 /**
2779  *      initialize_tty_struct
2780  *      @tty: tty to initialize
2781  *
2782  *      This subroutine initializes a tty structure that has been newly
2783  *      allocated.
2784  *
2785  *      Locking: none - tty in question must not be exposed at this point
2786  */
2787
2788 void initialize_tty_struct(struct tty_struct *tty,
2789                 struct tty_driver *driver, int idx)
2790 {
2791         memset(tty, 0, sizeof(struct tty_struct));
2792         kref_init(&tty->kref);
2793         tty->magic = TTY_MAGIC;
2794         tty_ldisc_init(tty);
2795         tty->session = NULL;
2796         tty->pgrp = NULL;
2797         tty->overrun_time = jiffies;
2798         tty->buf.head = tty->buf.tail = NULL;
2799         tty_buffer_init(tty);
2800         mutex_init(&tty->termios_mutex);
2801         init_waitqueue_head(&tty->write_wait);
2802         init_waitqueue_head(&tty->read_wait);
2803         INIT_WORK(&tty->hangup_work, do_tty_hangup);
2804         mutex_init(&tty->atomic_read_lock);
2805         mutex_init(&tty->atomic_write_lock);
2806         spin_lock_init(&tty->read_lock);
2807         spin_lock_init(&tty->ctrl_lock);
2808         INIT_LIST_HEAD(&tty->tty_files);
2809         INIT_WORK(&tty->SAK_work, do_SAK_work);
2810
2811         tty->driver = driver;
2812         tty->ops = driver->ops;
2813         tty->index = idx;
2814         tty_line_name(driver, idx, tty->name);
2815 }
2816
2817 /**
2818  *      tty_put_char    -       write one character to a tty
2819  *      @tty: tty
2820  *      @ch: character
2821  *
2822  *      Write one byte to the tty using the provided put_char method
2823  *      if present. Returns the number of characters successfully output.
2824  *
2825  *      Note: the specific put_char operation in the driver layer may go
2826  *      away soon. Don't call it directly, use this method
2827  */
2828
2829 int tty_put_char(struct tty_struct *tty, unsigned char ch)
2830 {
2831         if (tty->ops->put_char)
2832                 return tty->ops->put_char(tty, ch);
2833         return tty->ops->write(tty, &ch, 1);
2834 }
2835 EXPORT_SYMBOL_GPL(tty_put_char);
2836
2837 struct class *tty_class;
2838
2839 /**
2840  *      tty_register_device - register a tty device
2841  *      @driver: the tty driver that describes the tty device
2842  *      @index: the index in the tty driver for this tty device
2843  *      @device: a struct device that is associated with this tty device.
2844  *              This field is optional, if there is no known struct device
2845  *              for this tty device it can be set to NULL safely.
2846  *
2847  *      Returns a pointer to the struct device for this tty device
2848  *      (or ERR_PTR(-EFOO) on error).
2849  *
2850  *      This call is required to be made to register an individual tty device
2851  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
2852  *      that bit is not set, this function should not be called by a tty
2853  *      driver.
2854  *
2855  *      Locking: ??
2856  */
2857
2858 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
2859                                    struct device *device)
2860 {
2861         char name[64];
2862         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
2863
2864         if (index >= driver->num) {
2865                 printk(KERN_ERR "Attempt to register invalid tty line number "
2866                        " (%d).\n", index);
2867                 return ERR_PTR(-EINVAL);
2868         }
2869
2870         if (driver->type == TTY_DRIVER_TYPE_PTY)
2871                 pty_line_name(driver, index, name);
2872         else
2873                 tty_line_name(driver, index, name);
2874
2875         return device_create_drvdata(tty_class, device, dev, NULL, name);
2876 }
2877 EXPORT_SYMBOL(tty_register_device);
2878
2879 /**
2880  *      tty_unregister_device - unregister a tty device
2881  *      @driver: the tty driver that describes the tty device
2882  *      @index: the index in the tty driver for this tty device
2883  *
2884  *      If a tty device is registered with a call to tty_register_device() then
2885  *      this function must be called when the tty device is gone.
2886  *
2887  *      Locking: ??
2888  */
2889
2890 void tty_unregister_device(struct tty_driver *driver, unsigned index)
2891 {
2892         device_destroy(tty_class,
2893                 MKDEV(driver->major, driver->minor_start) + index);
2894 }
2895 EXPORT_SYMBOL(tty_unregister_device);
2896
2897 struct tty_driver *alloc_tty_driver(int lines)
2898 {
2899         struct tty_driver *driver;
2900
2901         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
2902         if (driver) {
2903                 kref_init(&driver->kref);
2904                 driver->magic = TTY_DRIVER_MAGIC;
2905                 driver->num = lines;
2906                 /* later we'll move allocation of tables here */
2907         }
2908         return driver;
2909 }
2910 EXPORT_SYMBOL(alloc_tty_driver);
2911
2912 static void destruct_tty_driver(struct kref *kref)
2913 {
2914         struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
2915         int i;
2916         struct ktermios *tp;
2917         void *p;
2918
2919         if (driver->flags & TTY_DRIVER_INSTALLED) {
2920                 /*
2921                  * Free the termios and termios_locked structures because
2922                  * we don't want to get memory leaks when modular tty
2923                  * drivers are removed from the kernel.
2924                  */
2925                 for (i = 0; i < driver->num; i++) {
2926                         tp = driver->termios[i];
2927                         if (tp) {
2928                                 driver->termios[i] = NULL;
2929                                 kfree(tp);
2930                         }
2931                         tp = driver->termios_locked[i];
2932                         if (tp) {
2933                                 driver->termios_locked[i] = NULL;
2934                                 kfree(tp);
2935                         }
2936                         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
2937                                 tty_unregister_device(driver, i);
2938                 }
2939                 p = driver->ttys;
2940                 proc_tty_unregister_driver(driver);
2941                 driver->ttys = NULL;
2942                 driver->termios = driver->termios_locked = NULL;
2943                 kfree(p);
2944                 cdev_del(&driver->cdev);
2945         }
2946         kfree(driver);
2947 }
2948
2949 void tty_driver_kref_put(struct tty_driver *driver)
2950 {
2951         kref_put(&driver->kref, destruct_tty_driver);
2952 }
2953 EXPORT_SYMBOL(tty_driver_kref_put);
2954
2955 void tty_set_operations(struct tty_driver *driver,
2956                         const struct tty_operations *op)
2957 {
2958         driver->ops = op;
2959 };
2960 EXPORT_SYMBOL(tty_set_operations);
2961
2962 void put_tty_driver(struct tty_driver *d)
2963 {
2964         tty_driver_kref_put(d);
2965 }
2966 EXPORT_SYMBOL(put_tty_driver);
2967
2968 /*
2969  * Called by a tty driver to register itself.
2970  */
2971 int tty_register_driver(struct tty_driver *driver)
2972 {
2973         int error;
2974         int i;
2975         dev_t dev;
2976         void **p = NULL;
2977
2978         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
2979                 p = kzalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
2980                 if (!p)
2981                         return -ENOMEM;
2982         }
2983
2984         if (!driver->major) {
2985                 error = alloc_chrdev_region(&dev, driver->minor_start,
2986                                                 driver->num, driver->name);
2987                 if (!error) {
2988                         driver->major = MAJOR(dev);
2989                         driver->minor_start = MINOR(dev);
2990                 }
2991         } else {
2992                 dev = MKDEV(driver->major, driver->minor_start);
2993                 error = register_chrdev_region(dev, driver->num, driver->name);
2994         }
2995         if (error < 0) {
2996                 kfree(p);
2997                 return error;
2998         }
2999
3000         if (p) {
3001                 driver->ttys = (struct tty_struct **)p;
3002                 driver->termios = (struct ktermios **)(p + driver->num);
3003                 driver->termios_locked = (struct ktermios **)
3004                                                         (p + driver->num * 2);
3005         } else {
3006                 driver->ttys = NULL;
3007                 driver->termios = NULL;
3008                 driver->termios_locked = NULL;
3009         }
3010
3011         cdev_init(&driver->cdev, &tty_fops);
3012         driver->cdev.owner = driver->owner;
3013         error = cdev_add(&driver->cdev, dev, driver->num);
3014         if (error) {
3015                 unregister_chrdev_region(dev, driver->num);
3016                 driver->ttys = NULL;
3017                 driver->termios = driver->termios_locked = NULL;
3018                 kfree(p);
3019                 return error;
3020         }
3021
3022         mutex_lock(&tty_mutex);
3023         list_add(&driver->tty_drivers, &tty_drivers);
3024         mutex_unlock(&tty_mutex);
3025
3026         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3027                 for (i = 0; i < driver->num; i++)
3028                     tty_register_device(driver, i, NULL);
3029         }
3030         proc_tty_register_driver(driver);
3031         driver->flags |= TTY_DRIVER_INSTALLED;
3032         return 0;
3033 }
3034
3035 EXPORT_SYMBOL(tty_register_driver);
3036
3037 /*
3038  * Called by a tty driver to unregister itself.
3039  */
3040 int tty_unregister_driver(struct tty_driver *driver)
3041 {
3042 #if 0
3043         /* FIXME */
3044         if (driver->refcount)
3045                 return -EBUSY;
3046 #endif
3047         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3048                                 driver->num);
3049         mutex_lock(&tty_mutex);
3050         list_del(&driver->tty_drivers);
3051         mutex_unlock(&tty_mutex);
3052         return 0;
3053 }
3054
3055 EXPORT_SYMBOL(tty_unregister_driver);
3056
3057 dev_t tty_devnum(struct tty_struct *tty)
3058 {
3059         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3060 }
3061 EXPORT_SYMBOL(tty_devnum);
3062
3063 void proc_clear_tty(struct task_struct *p)
3064 {
3065         struct tty_struct *tty;
3066         spin_lock_irq(&p->sighand->siglock);
3067         tty = p->signal->tty;
3068         p->signal->tty = NULL;
3069         spin_unlock_irq(&p->sighand->siglock);
3070         tty_kref_put(tty);
3071 }
3072
3073 /* Called under the sighand lock */
3074
3075 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3076 {
3077         if (tty) {
3078                 unsigned long flags;
3079                 /* We should not have a session or pgrp to put here but.... */
3080                 spin_lock_irqsave(&tty->ctrl_lock, flags);
3081                 put_pid(tty->session);
3082                 put_pid(tty->pgrp);
3083                 tty->pgrp = get_pid(task_pgrp(tsk));
3084                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3085                 tty->session = get_pid(task_session(tsk));
3086                 if (tsk->signal->tty) {
3087                         printk(KERN_DEBUG "tty not NULL!!\n");
3088                         tty_kref_put(tsk->signal->tty);
3089                 }
3090         }
3091         put_pid(tsk->signal->tty_old_pgrp);
3092         tsk->signal->tty = tty_kref_get(tty);
3093         tsk->signal->tty_old_pgrp = NULL;
3094 }
3095
3096 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3097 {
3098         spin_lock_irq(&tsk->sighand->siglock);
3099         __proc_set_tty(tsk, tty);
3100         spin_unlock_irq(&tsk->sighand->siglock);
3101 }
3102
3103 struct tty_struct *get_current_tty(void)
3104 {
3105         struct tty_struct *tty;
3106         unsigned long flags;
3107
3108         spin_lock_irqsave(&current->sighand->siglock, flags);
3109         tty = tty_kref_get(current->signal->tty);
3110         spin_unlock_irqrestore(&current->sighand->siglock, flags);
3111         return tty;
3112 }
3113 EXPORT_SYMBOL_GPL(get_current_tty);
3114
3115 void tty_default_fops(struct file_operations *fops)
3116 {
3117         *fops = tty_fops;
3118 }
3119
3120 /*
3121  * Initialize the console device. This is called *early*, so
3122  * we can't necessarily depend on lots of kernel help here.
3123  * Just do some early initializations, and do the complex setup
3124  * later.
3125  */
3126 void __init console_init(void)
3127 {
3128         initcall_t *call;
3129
3130         /* Setup the default TTY line discipline. */
3131         tty_ldisc_begin();
3132
3133         /*
3134          * set up the console device so that later boot sequences can
3135          * inform about problems etc..
3136          */
3137         call = __con_initcall_start;
3138         while (call < __con_initcall_end) {
3139                 (*call)();
3140                 call++;
3141         }
3142 }
3143
3144 static int __init tty_class_init(void)
3145 {
3146         tty_class = class_create(THIS_MODULE, "tty");
3147         if (IS_ERR(tty_class))
3148                 return PTR_ERR(tty_class);
3149         return 0;
3150 }
3151
3152 postcore_initcall(tty_class_init);
3153
3154 /* 3/2004 jmc: why do these devices exist? */
3155
3156 static struct cdev tty_cdev, console_cdev;
3157
3158 /*
3159  * Ok, now we can initialize the rest of the tty devices and can count
3160  * on memory allocations, interrupts etc..
3161  */
3162 static int __init tty_init(void)
3163 {
3164         cdev_init(&tty_cdev, &tty_fops);
3165         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3166             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3167                 panic("Couldn't register /dev/tty driver\n");
3168         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL,
3169                               "tty");
3170
3171         cdev_init(&console_cdev, &console_fops);
3172         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3173             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3174                 panic("Couldn't register /dev/console driver\n");
3175         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3176                               "console");
3177
3178 #ifdef CONFIG_VT
3179         vty_init(&console_fops);
3180 #endif
3181         return 0;
3182 }
3183 module_init(tty_init);