linux/drivers/tty/tty_io.c
<<
>>
Prefs
   1/*
   2 *  Copyright (C) 1991, 1992  Linus Torvalds
   3 */
   4
   5/*
   6 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
   7 * or rs-channels. It also implements echoing, cooked mode etc.
   8 *
   9 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
  10 *
  11 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
  12 * tty_struct and tty_queue structures.  Previously there was an array
  13 * of 256 tty_struct's which was statically allocated, and the
  14 * tty_queue structures were allocated at boot time.  Both are now
  15 * dynamically allocated only when the tty is open.
  16 *
  17 * Also restructured routines so that there is more of a separation
  18 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
  19 * the low-level tty routines (serial.c, pty.c, console.c).  This
  20 * makes for cleaner and more compact code.  -TYT, 9/17/92
  21 *
  22 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
  23 * which can be dynamically activated and de-activated by the line
  24 * discipline handling modules (like SLIP).
  25 *
  26 * NOTE: pay no attention to the line discipline code (yet); its
  27 * interface is still subject to change in this version...
  28 * -- TYT, 1/31/92
  29 *
  30 * Added functionality to the OPOST tty handling.  No delays, but all
  31 * other bits should be there.
  32 *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
  33 *
  34 * Rewrote canonical mode and added more termios flags.
  35 *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
  36 *
  37 * Reorganized FASYNC support so mouse code can share it.
  38 *      -- ctm@ardi.com, 9Sep95
  39 *
  40 * New TIOCLINUX variants added.
  41 *      -- mj@k332.feld.cvut.cz, 19-Nov-95
  42 *
  43 * Restrict vt switching via ioctl()
  44 *      -- grif@cs.ucr.edu, 5-Dec-95
  45 *
  46 * Move console and virtual terminal code to more appropriate files,
  47 * implement CONFIG_VT and generalize console device interface.
  48 *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
  49 *
  50 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
  51 *      -- Bill Hawes <whawes@star.net>, June 97
  52 *
  53 * Added devfs support.
  54 *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
  55 *
  56 * Added support for a Unix98-style ptmx device.
  57 *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
  58 *
  59 * Reduced memory usage for older ARM systems
  60 *      -- Russell King <rmk@arm.linux.org.uk>
  61 *
  62 * Move do_SAK() into process context.  Less stack use in devfs functions.
  63 * alloc_tty_struct() always uses kmalloc()
  64 *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
  65 */
  66
  67#include <linux/types.h>
  68#include <linux/major.h>
  69#include <linux/errno.h>
  70#include <linux/signal.h>
  71#include <linux/fcntl.h>
  72#include <linux/sched.h>
  73#include <linux/interrupt.h>
  74#include <linux/tty.h>
  75#include <linux/tty_driver.h>
  76#include <linux/tty_flip.h>
  77#include <linux/devpts_fs.h>
  78#include <linux/file.h>
  79#include <linux/fdtable.h>
  80#include <linux/console.h>
  81#include <linux/timer.h>
  82#include <linux/ctype.h>
  83#include <linux/kd.h>
  84#include <linux/mm.h>
  85#include <linux/string.h>
  86#include <linux/slab.h>
  87#include <linux/poll.h>
  88#include <linux/proc_fs.h>
  89#include <linux/init.h>
  90#include <linux/module.h>
  91#include <linux/device.h>
  92#include <linux/wait.h>
  93#include <linux/bitops.h>
  94#include <linux/delay.h>
  95#include <linux/seq_file.h>
  96#include <linux/serial.h>
  97#include <linux/ratelimit.h>
  98
  99#include <linux/uaccess.h>
 100
 101#include <linux/kbd_kern.h>
 102#include <linux/vt_kern.h>
 103#include <linux/selection.h>
 104
 105#include <linux/kmod.h>
 106#include <linux/nsproxy.h>
 107
 108#undef TTY_DEBUG_HANGUP
 109
 110#define TTY_PARANOIA_CHECK 1
 111#define CHECK_TTY_COUNT 1
 112
 113struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
 114        .c_iflag = ICRNL | IXON,
 115        .c_oflag = OPOST | ONLCR,
 116        .c_cflag = B38400 | CS8 | CREAD | HUPCL,
 117        .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
 118                   ECHOCTL | ECHOKE | IEXTEN,
 119        .c_cc = INIT_C_CC,
 120        .c_ispeed = 38400,
 121        .c_ospeed = 38400
 122};
 123
 124EXPORT_SYMBOL(tty_std_termios);
 125
 126/* This list gets poked at by procfs and various bits of boot up code. This
 127   could do with some rationalisation such as pulling the tty proc function
 128   into this file */
 129
 130LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
 131
 132/* Mutex to protect creating and releasing a tty. This is shared with
 133   vt.c for deeply disgusting hack reasons */
 134DEFINE_MUTEX(tty_mutex);
 135EXPORT_SYMBOL(tty_mutex);
 136
 137/* Spinlock to protect the tty->tty_files list */
 138DEFINE_SPINLOCK(tty_files_lock);
 139
 140static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
 141static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
 142ssize_t redirected_tty_write(struct file *, const char __user *,
 143                                                        size_t, loff_t *);
 144static unsigned int tty_poll(struct file *, poll_table *);
 145static int tty_open(struct inode *, struct file *);
 146long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 147#ifdef CONFIG_COMPAT
 148static long tty_compat_ioctl(struct file *file, unsigned int cmd,
 149                                unsigned long arg);
 150#else
 151#define tty_compat_ioctl NULL
 152#endif
 153static int __tty_fasync(int fd, struct file *filp, int on);
 154static int tty_fasync(int fd, struct file *filp, int on);
 155static void release_tty(struct tty_struct *tty, int idx);
 156static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
 157static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
 158
 159/**
 160 *      alloc_tty_struct        -       allocate a tty object
 161 *
 162 *      Return a new empty tty structure. The data fields have not
 163 *      been initialized in any way but has been zeroed
 164 *
 165 *      Locking: none
 166 */
 167
 168struct tty_struct *alloc_tty_struct(void)
 169{
 170        return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
 171}
 172
 173/**
 174 *      free_tty_struct         -       free a disused tty
 175 *      @tty: tty struct to free
 176 *
 177 *      Free the write buffers, tty queue and tty memory itself.
 178 *
 179 *      Locking: none. Must be called after tty is definitely unused
 180 */
 181
 182void free_tty_struct(struct tty_struct *tty)
 183{
 184        if (tty->dev)
 185                put_device(tty->dev);
 186        kfree(tty->write_buf);
 187        tty_buffer_free_all(tty);
 188        kfree(tty);
 189}
 190
 191static inline struct tty_struct *file_tty(struct file *file)
 192{
 193        return ((struct tty_file_private *)file->private_data)->tty;
 194}
 195
 196int tty_alloc_file(struct file *file)
 197{
 198        struct tty_file_private *priv;
 199
 200        priv = kmalloc(sizeof(*priv), GFP_KERNEL);
 201        if (!priv)
 202                return -ENOMEM;
 203
 204        file->private_data = priv;
 205
 206        return 0;
 207}
 208
 209/* Associate a new file with the tty structure */
 210void tty_add_file(struct tty_struct *tty, struct file *file)
 211{
 212        struct tty_file_private *priv = file->private_data;
 213
 214        priv->tty = tty;
 215        priv->file = file;
 216
 217        spin_lock(&tty_files_lock);
 218        list_add(&priv->list, &tty->tty_files);
 219        spin_unlock(&tty_files_lock);
 220}
 221
 222/**
 223 * tty_free_file - free file->private_data
 224 *
 225 * This shall be used only for fail path handling when tty_add_file was not
 226 * called yet.
 227 */
 228void tty_free_file(struct file *file)
 229{
 230        struct tty_file_private *priv = file->private_data;
 231
 232        file->private_data = NULL;
 233        kfree(priv);
 234}
 235
 236/* Delete file from its tty */
 237void tty_del_file(struct file *file)
 238{
 239        struct tty_file_private *priv = file->private_data;
 240
 241        spin_lock(&tty_files_lock);
 242        list_del(&priv->list);
 243        spin_unlock(&tty_files_lock);
 244        tty_free_file(file);
 245}
 246
 247
 248#define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
 249
 250/**
 251 *      tty_name        -       return tty naming
 252 *      @tty: tty structure
 253 *      @buf: buffer for output
 254 *
 255 *      Convert a tty structure into a name. The name reflects the kernel
 256 *      naming policy and if udev is in use may not reflect user space
 257 *
 258 *      Locking: none
 259 */
 260
 261char *tty_name(struct tty_struct *tty, char *buf)
 262{
 263        if (!tty) /* Hmm.  NULL pointer.  That's fun. */
 264                strcpy(buf, "NULL tty");
 265        else
 266                strcpy(buf, tty->name);
 267        return buf;
 268}
 269
 270EXPORT_SYMBOL(tty_name);
 271
 272int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
 273                              const char *routine)
 274{
 275#ifdef TTY_PARANOIA_CHECK
 276        if (!tty) {
 277                printk(KERN_WARNING
 278                        "null TTY for (%d:%d) in %s\n",
 279                        imajor(inode), iminor(inode), routine);
 280                return 1;
 281        }
 282        if (tty->magic != TTY_MAGIC) {
 283                printk(KERN_WARNING
 284                        "bad magic number for tty struct (%d:%d) in %s\n",
 285                        imajor(inode), iminor(inode), routine);
 286                return 1;
 287        }
 288#endif
 289        return 0;
 290}
 291
 292static int check_tty_count(struct tty_struct *tty, const char *routine)
 293{
 294#ifdef CHECK_TTY_COUNT
 295        struct list_head *p;
 296        int count = 0;
 297
 298        spin_lock(&tty_files_lock);
 299        list_for_each(p, &tty->tty_files) {
 300                count++;
 301        }
 302        spin_unlock(&tty_files_lock);
 303        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
 304            tty->driver->subtype == PTY_TYPE_SLAVE &&
 305            tty->link && tty->link->count)
 306                count++;
 307        if (tty->count != count) {
 308                printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
 309                                    "!= #fd's(%d) in %s\n",
 310                       tty->name, tty->count, count, routine);
 311                return count;
 312        }
 313#endif
 314        return 0;
 315}
 316
 317/**
 318 *      get_tty_driver          -       find device of a tty
 319 *      @dev_t: device identifier
 320 *      @index: returns the index of the tty
 321 *
 322 *      This routine returns a tty driver structure, given a device number
 323 *      and also passes back the index number.
 324 *
 325 *      Locking: caller must hold tty_mutex
 326 */
 327
 328static struct tty_driver *get_tty_driver(dev_t device, int *index)
 329{
 330        struct tty_driver *p;
 331
 332        list_for_each_entry(p, &tty_drivers, tty_drivers) {
 333                dev_t base = MKDEV(p->major, p->minor_start);
 334                if (device < base || device >= base + p->num)
 335                        continue;
 336                *index = device - base;
 337                return tty_driver_kref_get(p);
 338        }
 339        return NULL;
 340}
 341
 342#ifdef CONFIG_CONSOLE_POLL
 343
 344/**
 345 *      tty_find_polling_driver -       find device of a polled tty
 346 *      @name: name string to match
 347 *      @line: pointer to resulting tty line nr
 348 *
 349 *      This routine returns a tty driver structure, given a name
 350 *      and the condition that the tty driver is capable of polled
 351 *      operation.
 352 */
 353struct tty_driver *tty_find_polling_driver(char *name, int *line)
 354{
 355        struct tty_driver *p, *res = NULL;
 356        int tty_line = 0;
 357        int len;
 358        char *str, *stp;
 359
 360        for (str = name; *str; str++)
 361                if ((*str >= '0' && *str <= '9') || *str == ',')
 362                        break;
 363        if (!*str)
 364                return NULL;
 365
 366        len = str - name;
 367        tty_line = simple_strtoul(str, &str, 10);
 368
 369        mutex_lock(&tty_mutex);
 370        /* Search through the tty devices to look for a match */
 371        list_for_each_entry(p, &tty_drivers, tty_drivers) {
 372                if (strncmp(name, p->name, len) != 0)
 373                        continue;
 374                stp = str;
 375                if (*stp == ',')
 376                        stp++;
 377                if (*stp == '\0')
 378                        stp = NULL;
 379
 380                if (tty_line >= 0 && tty_line < p->num && p->ops &&
 381                    p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
 382                        res = tty_driver_kref_get(p);
 383                        *line = tty_line;
 384                        break;
 385                }
 386        }
 387        mutex_unlock(&tty_mutex);
 388
 389        return res;
 390}
 391EXPORT_SYMBOL_GPL(tty_find_polling_driver);
 392#endif
 393
 394/**
 395 *      tty_check_change        -       check for POSIX terminal changes
 396 *      @tty: tty to check
 397 *
 398 *      If we try to write to, or set the state of, a terminal and we're
 399 *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
 400 *      ignored, go ahead and perform the operation.  (POSIX 7.2)
 401 *
 402 *      Locking: ctrl_lock
 403 */
 404
 405int tty_check_change(struct tty_struct *tty)
 406{
 407        unsigned long flags;
 408        int ret = 0;
 409
 410        if (current->signal->tty != tty)
 411                return 0;
 412
 413        spin_lock_irqsave(&tty->ctrl_lock, flags);
 414
 415        if (!tty->pgrp) {
 416                printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
 417                goto out_unlock;
 418        }
 419        if (task_pgrp(current) == tty->pgrp)
 420                goto out_unlock;
 421        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 422        if (is_ignored(SIGTTOU))
 423                goto out;
 424        if (is_current_pgrp_orphaned()) {
 425                ret = -EIO;
 426                goto out;
 427        }
 428        kill_pgrp(task_pgrp(current), SIGTTOU, 1);
 429        set_thread_flag(TIF_SIGPENDING);
 430        ret = -ERESTARTSYS;
 431out:
 432        return ret;
 433out_unlock:
 434        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 435        return ret;
 436}
 437
 438EXPORT_SYMBOL(tty_check_change);
 439
 440static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
 441                                size_t count, loff_t *ppos)
 442{
 443        return 0;
 444}
 445
 446static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
 447                                 size_t count, loff_t *ppos)
 448{
 449        return -EIO;
 450}
 451
 452/* No kernel lock held - none needed ;) */
 453static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
 454{
 455        return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
 456}
 457
 458static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
 459                unsigned long arg)
 460{
 461        return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
 462}
 463
 464static long hung_up_tty_compat_ioctl(struct file *file,
 465                                     unsigned int cmd, unsigned long arg)
 466{
 467        return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
 468}
 469
 470static const struct file_operations tty_fops = {
 471        .llseek         = no_llseek,
 472        .read           = tty_read,
 473        .write          = tty_write,
 474        .poll           = tty_poll,
 475        .unlocked_ioctl = tty_ioctl,
 476        .compat_ioctl   = tty_compat_ioctl,
 477        .open           = tty_open,
 478        .release        = tty_release,
 479        .fasync         = tty_fasync,
 480};
 481
 482static const struct file_operations console_fops = {
 483        .llseek         = no_llseek,
 484        .read           = tty_read,
 485        .write          = redirected_tty_write,
 486        .poll           = tty_poll,
 487        .unlocked_ioctl = tty_ioctl,
 488        .compat_ioctl   = tty_compat_ioctl,
 489        .open           = tty_open,
 490        .release        = tty_release,
 491        .fasync         = tty_fasync,
 492};
 493
 494static const struct file_operations hung_up_tty_fops = {
 495        .llseek         = no_llseek,
 496        .read           = hung_up_tty_read,
 497        .write          = hung_up_tty_write,
 498        .poll           = hung_up_tty_poll,
 499        .unlocked_ioctl = hung_up_tty_ioctl,
 500        .compat_ioctl   = hung_up_tty_compat_ioctl,
 501        .release        = tty_release,
 502};
 503
 504static DEFINE_SPINLOCK(redirect_lock);
 505static struct file *redirect;
 506
 507/**
 508 *      tty_wakeup      -       request more data
 509 *      @tty: terminal
 510 *
 511 *      Internal and external helper for wakeups of tty. This function
 512 *      informs the line discipline if present that the driver is ready
 513 *      to receive more output data.
 514 */
 515
 516void tty_wakeup(struct tty_struct *tty)
 517{
 518        struct tty_ldisc *ld;
 519
 520        if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
 521                ld = tty_ldisc_ref(tty);
 522                if (ld) {
 523                        if (ld->ops->write_wakeup)
 524                                ld->ops->write_wakeup(tty);
 525                        tty_ldisc_deref(ld);
 526                }
 527        }
 528        wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
 529}
 530
 531EXPORT_SYMBOL_GPL(tty_wakeup);
 532
 533/**
 534 *      __tty_hangup            -       actual handler for hangup events
 535 *      @work: tty device
 536 *
 537 *      This can be called by the "eventd" kernel thread.  That is process
 538 *      synchronous but doesn't hold any locks, so we need to make sure we
 539 *      have the appropriate locks for what we're doing.
 540 *
 541 *      The hangup event clears any pending redirections onto the hung up
 542 *      device. It ensures future writes will error and it does the needed
 543 *      line discipline hangup and signal delivery. The tty object itself
 544 *      remains intact.
 545 *
 546 *      Locking:
 547 *              BTM
 548 *                redirect lock for undoing redirection
 549 *                file list lock for manipulating list of ttys
 550 *                tty_ldisc_lock from called functions
 551 *                termios_mutex resetting termios data
 552 *                tasklist_lock to walk task list for hangup event
 553 *                  ->siglock to protect ->signal/->sighand
 554 */
 555void __tty_hangup(struct tty_struct *tty)
 556{
 557        struct file *cons_filp = NULL;
 558        struct file *filp, *f = NULL;
 559        struct task_struct *p;
 560        struct tty_file_private *priv;
 561        int    closecount = 0, n;
 562        unsigned long flags;
 563        int refs = 0;
 564
 565        if (!tty)
 566                return;
 567
 568
 569        spin_lock(&redirect_lock);
 570        if (redirect && file_tty(redirect) == tty) {
 571                f = redirect;
 572                redirect = NULL;
 573        }
 574        spin_unlock(&redirect_lock);
 575
 576        tty_lock();
 577
 578        /* some functions below drop BTM, so we need this bit */
 579        set_bit(TTY_HUPPING, &tty->flags);
 580
 581        /* inuse_filps is protected by the single tty lock,
 582           this really needs to change if we want to flush the
 583           workqueue with the lock held */
 584        check_tty_count(tty, "tty_hangup");
 585
 586        spin_lock(&tty_files_lock);
 587        /* This breaks for file handles being sent over AF_UNIX sockets ? */
 588        list_for_each_entry(priv, &tty->tty_files, list) {
 589                filp = priv->file;
 590                if (filp->f_op->write == redirected_tty_write)
 591                        cons_filp = filp;
 592                if (filp->f_op->write != tty_write)
 593                        continue;
 594                closecount++;
 595                __tty_fasync(-1, filp, 0);      /* can't block */
 596                filp->f_op = &hung_up_tty_fops;
 597        }
 598        spin_unlock(&tty_files_lock);
 599
 600        /*
 601         * it drops BTM and thus races with reopen
 602         * we protect the race by TTY_HUPPING
 603         */
 604        tty_ldisc_hangup(tty);
 605
 606        read_lock(&tasklist_lock);
 607        if (tty->session) {
 608                do_each_pid_task(tty->session, PIDTYPE_SID, p) {
 609                        spin_lock_irq(&p->sighand->siglock);
 610                        if (p->signal->tty == tty) {
 611                                p->signal->tty = NULL;
 612                                /* We defer the dereferences outside fo
 613                                   the tasklist lock */
 614                                refs++;
 615                        }
 616                        if (!p->signal->leader) {
 617                                spin_unlock_irq(&p->sighand->siglock);
 618                                continue;
 619                        }
 620                        __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
 621                        __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
 622                        put_pid(p->signal->tty_old_pgrp);  /* A noop */
 623                        spin_lock_irqsave(&tty->ctrl_lock, flags);
 624                        if (tty->pgrp)
 625                                p->signal->tty_old_pgrp = get_pid(tty->pgrp);
 626                        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 627                        spin_unlock_irq(&p->sighand->siglock);
 628                } while_each_pid_task(tty->session, PIDTYPE_SID, p);
 629        }
 630        read_unlock(&tasklist_lock);
 631
 632        spin_lock_irqsave(&tty->ctrl_lock, flags);
 633        clear_bit(TTY_THROTTLED, &tty->flags);
 634        clear_bit(TTY_PUSH, &tty->flags);
 635        clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
 636        put_pid(tty->session);
 637        put_pid(tty->pgrp);
 638        tty->session = NULL;
 639        tty->pgrp = NULL;
 640        tty->ctrl_status = 0;
 641        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 642
 643        /* Account for the p->signal references we killed */
 644        while (refs--)
 645                tty_kref_put(tty);
 646
 647        /*
 648         * If one of the devices matches a console pointer, we
 649         * cannot just call hangup() because that will cause
 650         * tty->count and state->count to go out of sync.
 651         * So we just call close() the right number of times.
 652         */
 653        if (cons_filp) {
 654                if (tty->ops->close)
 655                        for (n = 0; n < closecount; n++)
 656                                tty->ops->close(tty, cons_filp);
 657        } else if (tty->ops->hangup)
 658                (tty->ops->hangup)(tty);
 659        /*
 660         * We don't want to have driver/ldisc interactions beyond
 661         * the ones we did here. The driver layer expects no
 662         * calls after ->hangup() from the ldisc side. However we
 663         * can't yet guarantee all that.
 664         */
 665        set_bit(TTY_HUPPED, &tty->flags);
 666        clear_bit(TTY_HUPPING, &tty->flags);
 667        tty_ldisc_enable(tty);
 668
 669        tty_unlock();
 670
 671        if (f)
 672                fput(f);
 673}
 674
 675static void do_tty_hangup(struct work_struct *work)
 676{
 677        struct tty_struct *tty =
 678                container_of(work, struct tty_struct, hangup_work);
 679
 680        __tty_hangup(tty);
 681}
 682
 683/**
 684 *      tty_hangup              -       trigger a hangup event
 685 *      @tty: tty to hangup
 686 *
 687 *      A carrier loss (virtual or otherwise) has occurred on this like
 688 *      schedule a hangup sequence to run after this event.
 689 */
 690
 691void tty_hangup(struct tty_struct *tty)
 692{
 693#ifdef TTY_DEBUG_HANGUP
 694        char    buf[64];
 695        printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
 696#endif
 697        schedule_work(&tty->hangup_work);
 698}
 699
 700EXPORT_SYMBOL(tty_hangup);
 701
 702/**
 703 *      tty_vhangup             -       process vhangup
 704 *      @tty: tty to hangup
 705 *
 706 *      The user has asked via system call for the terminal to be hung up.
 707 *      We do this synchronously so that when the syscall returns the process
 708 *      is complete. That guarantee is necessary for security reasons.
 709 */
 710
 711void tty_vhangup(struct tty_struct *tty)
 712{
 713#ifdef TTY_DEBUG_HANGUP
 714        char    buf[64];
 715
 716        printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
 717#endif
 718        __tty_hangup(tty);
 719}
 720
 721EXPORT_SYMBOL(tty_vhangup);
 722
 723
 724/**
 725 *      tty_vhangup_self        -       process vhangup for own ctty
 726 *
 727 *      Perform a vhangup on the current controlling tty
 728 */
 729
 730void tty_vhangup_self(void)
 731{
 732        struct tty_struct *tty;
 733
 734        tty = get_current_tty();
 735        if (tty) {
 736                tty_vhangup(tty);
 737                tty_kref_put(tty);
 738        }
 739}
 740
 741/**
 742 *      tty_hung_up_p           -       was tty hung up
 743 *      @filp: file pointer of tty
 744 *
 745 *      Return true if the tty has been subject to a vhangup or a carrier
 746 *      loss
 747 */
 748
 749int tty_hung_up_p(struct file *filp)
 750{
 751        return (filp->f_op == &hung_up_tty_fops);
 752}
 753
 754EXPORT_SYMBOL(tty_hung_up_p);
 755
 756static void session_clear_tty(struct pid *session)
 757{
 758        struct task_struct *p;
 759        do_each_pid_task(session, PIDTYPE_SID, p) {
 760                proc_clear_tty(p);
 761        } while_each_pid_task(session, PIDTYPE_SID, p);
 762}
 763
 764/**
 765 *      disassociate_ctty       -       disconnect controlling tty
 766 *      @on_exit: true if exiting so need to "hang up" the session
 767 *
 768 *      This function is typically called only by the session leader, when
 769 *      it wants to disassociate itself from its controlling tty.
 770 *
 771 *      It performs the following functions:
 772 *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
 773 *      (2)  Clears the tty from being controlling the session
 774 *      (3)  Clears the controlling tty for all processes in the
 775 *              session group.
 776 *
 777 *      The argument on_exit is set to 1 if called when a process is
 778 *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
 779 *
 780 *      Locking:
 781 *              BTM is taken for hysterical raisins, and held when
 782 *                called from no_tty().
 783 *                tty_mutex is taken to protect tty
 784 *                ->siglock is taken to protect ->signal/->sighand
 785 *                tasklist_lock is taken to walk process list for sessions
 786 *                  ->siglock is taken to protect ->signal/->sighand
 787 */
 788
 789void disassociate_ctty(int on_exit)
 790{
 791        struct tty_struct *tty;
 792
 793        if (!current->signal->leader)
 794                return;
 795
 796        tty = get_current_tty();
 797        if (tty) {
 798                struct pid *tty_pgrp = get_pid(tty->pgrp);
 799                if (on_exit) {
 800                        if (tty->driver->type != TTY_DRIVER_TYPE_PTY)
 801                                tty_vhangup(tty);
 802                }
 803                tty_kref_put(tty);
 804                if (tty_pgrp) {
 805                        kill_pgrp(tty_pgrp, SIGHUP, on_exit);
 806                        if (!on_exit)
 807                                kill_pgrp(tty_pgrp, SIGCONT, on_exit);
 808                        put_pid(tty_pgrp);
 809                }
 810        } else if (on_exit) {
 811                struct pid *old_pgrp;
 812                spin_lock_irq(&current->sighand->siglock);
 813                old_pgrp = current->signal->tty_old_pgrp;
 814                current->signal->tty_old_pgrp = NULL;
 815                spin_unlock_irq(&current->sighand->siglock);
 816                if (old_pgrp) {
 817                        kill_pgrp(old_pgrp, SIGHUP, on_exit);
 818                        kill_pgrp(old_pgrp, SIGCONT, on_exit);
 819                        put_pid(old_pgrp);
 820                }
 821                return;
 822        }
 823
 824        spin_lock_irq(&current->sighand->siglock);
 825        put_pid(current->signal->tty_old_pgrp);
 826        current->signal->tty_old_pgrp = NULL;
 827        spin_unlock_irq(&current->sighand->siglock);
 828
 829        tty = get_current_tty();
 830        if (tty) {
 831                unsigned long flags;
 832                spin_lock_irqsave(&tty->ctrl_lock, flags);
 833                put_pid(tty->session);
 834                put_pid(tty->pgrp);
 835                tty->session = NULL;
 836                tty->pgrp = NULL;
 837                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 838                tty_kref_put(tty);
 839        } else {
 840#ifdef TTY_DEBUG_HANGUP
 841                printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
 842                       " = NULL", tty);
 843#endif
 844        }
 845
 846        /* Now clear signal->tty under the lock */
 847        read_lock(&tasklist_lock);
 848        session_clear_tty(task_session(current));
 849        read_unlock(&tasklist_lock);
 850}
 851
 852/**
 853 *
 854 *      no_tty  - Ensure the current process does not have a controlling tty
 855 */
 856void no_tty(void)
 857{
 858        /* FIXME: Review locking here. The tty_lock never covered any race
 859           between a new association and proc_clear_tty but possible we need
 860           to protect against this anyway */
 861        struct task_struct *tsk = current;
 862        disassociate_ctty(0);
 863        proc_clear_tty(tsk);
 864}
 865
 866
 867/**
 868 *      stop_tty        -       propagate flow control
 869 *      @tty: tty to stop
 870 *
 871 *      Perform flow control to the driver. For PTY/TTY pairs we
 872 *      must also propagate the TIOCKPKT status. May be called
 873 *      on an already stopped device and will not re-call the driver
 874 *      method.
 875 *
 876 *      This functionality is used by both the line disciplines for
 877 *      halting incoming flow and by the driver. It may therefore be
 878 *      called from any context, may be under the tty atomic_write_lock
 879 *      but not always.
 880 *
 881 *      Locking:
 882 *              Uses the tty control lock internally
 883 */
 884
 885void stop_tty(struct tty_struct *tty)
 886{
 887        unsigned long flags;
 888        spin_lock_irqsave(&tty->ctrl_lock, flags);
 889        if (tty->stopped) {
 890                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 891                return;
 892        }
 893        tty->stopped = 1;
 894        if (tty->link && tty->link->packet) {
 895                tty->ctrl_status &= ~TIOCPKT_START;
 896                tty->ctrl_status |= TIOCPKT_STOP;
 897                wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
 898        }
 899        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 900        if (tty->ops->stop)
 901                (tty->ops->stop)(tty);
 902}
 903
 904EXPORT_SYMBOL(stop_tty);
 905
 906/**
 907 *      start_tty       -       propagate flow control
 908 *      @tty: tty to start
 909 *
 910 *      Start a tty that has been stopped if at all possible. Perform
 911 *      any necessary wakeups and propagate the TIOCPKT status. If this
 912 *      is the tty was previous stopped and is being started then the
 913 *      driver start method is invoked and the line discipline woken.
 914 *
 915 *      Locking:
 916 *              ctrl_lock
 917 */
 918
 919void start_tty(struct tty_struct *tty)
 920{
 921        unsigned long flags;
 922        spin_lock_irqsave(&tty->ctrl_lock, flags);
 923        if (!tty->stopped || tty->flow_stopped) {
 924                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 925                return;
 926        }
 927        tty->stopped = 0;
 928        if (tty->link && tty->link->packet) {
 929                tty->ctrl_status &= ~TIOCPKT_STOP;
 930                tty->ctrl_status |= TIOCPKT_START;
 931                wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
 932        }
 933        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 934        if (tty->ops->start)
 935                (tty->ops->start)(tty);
 936        /* If we have a running line discipline it may need kicking */
 937        tty_wakeup(tty);
 938}
 939
 940EXPORT_SYMBOL(start_tty);
 941
 942/**
 943 *      tty_read        -       read method for tty device files
 944 *      @file: pointer to tty file
 945 *      @buf: user buffer
 946 *      @count: size of user buffer
 947 *      @ppos: unused
 948 *
 949 *      Perform the read system call function on this terminal device. Checks
 950 *      for hung up devices before calling the line discipline method.
 951 *
 952 *      Locking:
 953 *              Locks the line discipline internally while needed. Multiple
 954 *      read calls may be outstanding in parallel.
 955 */
 956
 957static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
 958                        loff_t *ppos)
 959{
 960        int i;
 961        struct inode *inode = file->f_path.dentry->d_inode;
 962        struct tty_struct *tty = file_tty(file);
 963        struct tty_ldisc *ld;
 964
 965        if (tty_paranoia_check(tty, inode, "tty_read"))
 966                return -EIO;
 967        if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
 968                return -EIO;
 969
 970        /* We want to wait for the line discipline to sort out in this
 971           situation */
 972        ld = tty_ldisc_ref_wait(tty);
 973        if (ld->ops->read)
 974                i = (ld->ops->read)(tty, file, buf, count);
 975        else
 976                i = -EIO;
 977        tty_ldisc_deref(ld);
 978        if (i > 0)
 979                inode->i_atime = current_fs_time(inode->i_sb);
 980        return i;
 981}
 982
 983void tty_write_unlock(struct tty_struct *tty)
 984        __releases(&tty->atomic_write_lock)
 985{
 986        mutex_unlock(&tty->atomic_write_lock);
 987        wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
 988}
 989
 990int tty_write_lock(struct tty_struct *tty, int ndelay)
 991        __acquires(&tty->atomic_write_lock)
 992{
 993        if (!mutex_trylock(&tty->atomic_write_lock)) {
 994                if (ndelay)
 995                        return -EAGAIN;
 996                if (mutex_lock_interruptible(&tty->atomic_write_lock))
 997                        return -ERESTARTSYS;
 998        }
 999        return 0;
1000}
1001
1002/*
1003 * Split writes up in sane blocksizes to avoid
1004 * denial-of-service type attacks
1005 */
1006static inline ssize_t do_tty_write(
1007        ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1008        struct tty_struct *tty,
1009        struct file *file,
1010        const char __user *buf,
1011        size_t count)
1012{
1013        ssize_t ret, written = 0;
1014        unsigned int chunk;
1015
1016        ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1017        if (ret < 0)
1018                return ret;
1019
1020        /*
1021         * We chunk up writes into a temporary buffer. This
1022         * simplifies low-level drivers immensely, since they
1023         * don't have locking issues and user mode accesses.
1024         *
1025         * But if TTY_NO_WRITE_SPLIT is set, we should use a
1026         * big chunk-size..
1027         *
1028         * The default chunk-size is 2kB, because the NTTY
1029         * layer has problems with bigger chunks. It will
1030         * claim to be able to handle more characters than
1031         * it actually does.
1032         *
1033         * FIXME: This can probably go away now except that 64K chunks
1034         * are too likely to fail unless switched to vmalloc...
1035         */
1036        chunk = 2048;
1037        if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1038                chunk = 65536;
1039        if (count < chunk)
1040                chunk = count;
1041
1042        /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1043        if (tty->write_cnt < chunk) {
1044                unsigned char *buf_chunk;
1045
1046                if (chunk < 1024)
1047                        chunk = 1024;
1048
1049                buf_chunk = kmalloc(chunk, GFP_KERNEL);
1050                if (!buf_chunk) {
1051                        ret = -ENOMEM;
1052                        goto out;
1053                }
1054                kfree(tty->write_buf);
1055                tty->write_cnt = chunk;
1056                tty->write_buf = buf_chunk;
1057        }
1058
1059        /* Do the write .. */
1060        for (;;) {
1061                size_t size = count;
1062                if (size > chunk)
1063                        size = chunk;
1064                ret = -EFAULT;
1065                if (copy_from_user(tty->write_buf, buf, size))
1066                        break;
1067                ret = write(tty, file, tty->write_buf, size);
1068                if (ret <= 0)
1069                        break;
1070                written += ret;
1071                buf += ret;
1072                count -= ret;
1073                if (!count)
1074                        break;
1075                ret = -ERESTARTSYS;
1076                if (signal_pending(current))
1077                        break;
1078                cond_resched();
1079        }
1080        if (written) {
1081                struct inode *inode = file->f_path.dentry->d_inode;
1082                inode->i_mtime = current_fs_time(inode->i_sb);
1083                ret = written;
1084        }
1085out:
1086        tty_write_unlock(tty);
1087        return ret;
1088}
1089
1090/**
1091 * tty_write_message - write a message to a certain tty, not just the console.
1092 * @tty: the destination tty_struct
1093 * @msg: the message to write
1094 *
1095 * This is used for messages that need to be redirected to a specific tty.
1096 * We don't put it into the syslog queue right now maybe in the future if
1097 * really needed.
1098 *
1099 * We must still hold the BTM and test the CLOSING flag for the moment.
1100 */
1101
1102void tty_write_message(struct tty_struct *tty, char *msg)
1103{
1104        if (tty) {
1105                mutex_lock(&tty->atomic_write_lock);
1106                tty_lock();
1107                if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1108                        tty_unlock();
1109                        tty->ops->write(tty, msg, strlen(msg));
1110                } else
1111                        tty_unlock();
1112                tty_write_unlock(tty);
1113        }
1114        return;
1115}
1116
1117
1118/**
1119 *      tty_write               -       write method for tty device file
1120 *      @file: tty file pointer
1121 *      @buf: user data to write
1122 *      @count: bytes to write
1123 *      @ppos: unused
1124 *
1125 *      Write data to a tty device via the line discipline.
1126 *
1127 *      Locking:
1128 *              Locks the line discipline as required
1129 *              Writes to the tty driver are serialized by the atomic_write_lock
1130 *      and are then processed in chunks to the device. The line discipline
1131 *      write method will not be invoked in parallel for each device.
1132 */
1133
1134static ssize_t tty_write(struct file *file, const char __user *buf,
1135                                                size_t count, loff_t *ppos)
1136{
1137        struct inode *inode = file->f_path.dentry->d_inode;
1138        struct tty_struct *tty = file_tty(file);
1139        struct tty_ldisc *ld;
1140        ssize_t ret;
1141
1142        if (tty_paranoia_check(tty, inode, "tty_write"))
1143                return -EIO;
1144        if (!tty || !tty->ops->write ||
1145                (test_bit(TTY_IO_ERROR, &tty->flags)))
1146                        return -EIO;
1147        /* Short term debug to catch buggy drivers */
1148        if (tty->ops->write_room == NULL)
1149                printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1150                        tty->driver->name);
1151        ld = tty_ldisc_ref_wait(tty);
1152        if (!ld->ops->write)
1153                ret = -EIO;
1154        else
1155                ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1156        tty_ldisc_deref(ld);
1157        return ret;
1158}
1159
1160ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1161                                                size_t count, loff_t *ppos)
1162{
1163        struct file *p = NULL;
1164
1165        spin_lock(&redirect_lock);
1166        if (redirect) {
1167                get_file(redirect);
1168                p = redirect;
1169        }
1170        spin_unlock(&redirect_lock);
1171
1172        if (p) {
1173                ssize_t res;
1174                res = vfs_write(p, buf, count, &p->f_pos);
1175                fput(p);
1176                return res;
1177        }
1178        return tty_write(file, buf, count, ppos);
1179}
1180
1181static char ptychar[] = "pqrstuvwxyzabcde";
1182
1183/**
1184 *      pty_line_name   -       generate name for a pty
1185 *      @driver: the tty driver in use
1186 *      @index: the minor number
1187 *      @p: output buffer of at least 6 bytes
1188 *
1189 *      Generate a name from a driver reference and write it to the output
1190 *      buffer.
1191 *
1192 *      Locking: None
1193 */
1194static void pty_line_name(struct tty_driver *driver, int index, char *p)
1195{
1196        int i = index + driver->name_base;
1197        /* ->name is initialized to "ttyp", but "tty" is expected */
1198        sprintf(p, "%s%c%x",
1199                driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1200                ptychar[i >> 4 & 0xf], i & 0xf);
1201}
1202
1203/**
1204 *      tty_line_name   -       generate name for a tty
1205 *      @driver: the tty driver in use
1206 *      @index: the minor number
1207 *      @p: output buffer of at least 7 bytes
1208 *
1209 *      Generate a name from a driver reference and write it to the output
1210 *      buffer.
1211 *
1212 *      Locking: None
1213 */
1214static void tty_line_name(struct tty_driver *driver, int index, char *p)
1215{
1216        sprintf(p, "%s%d", driver->name, index + driver->name_base);
1217}
1218
1219/**
1220 *      tty_driver_lookup_tty() - find an existing tty, if any
1221 *      @driver: the driver for the tty
1222 *      @idx:    the minor number
1223 *
1224 *      Return the tty, if found or ERR_PTR() otherwise.
1225 *
1226 *      Locking: tty_mutex must be held. If tty is found, the mutex must
1227 *      be held until the 'fast-open' is also done. Will change once we
1228 *      have refcounting in the driver and per driver locking
1229 */
1230static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1231                struct inode *inode, int idx)
1232{
1233        if (driver->ops->lookup)
1234                return driver->ops->lookup(driver, inode, idx);
1235
1236        return driver->ttys[idx];
1237}
1238
1239/**
1240 *      tty_init_termios        -  helper for termios setup
1241 *      @tty: the tty to set up
1242 *
1243 *      Initialise the termios structures for this tty. Thus runs under
1244 *      the tty_mutex currently so we can be relaxed about ordering.
1245 */
1246
1247int tty_init_termios(struct tty_struct *tty)
1248{
1249        struct ktermios *tp;
1250        int idx = tty->index;
1251
1252        tp = tty->driver->termios[idx];
1253        if (tp == NULL) {
1254                tp = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
1255                if (tp == NULL)
1256                        return -ENOMEM;
1257                memcpy(tp, &tty->driver->init_termios,
1258                                                sizeof(struct ktermios));
1259                tty->driver->termios[idx] = tp;
1260        }
1261        tty->termios = tp;
1262        tty->termios_locked = tp + 1;
1263
1264        /* Compatibility until drivers always set this */
1265        tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1266        tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1267        return 0;
1268}
1269EXPORT_SYMBOL_GPL(tty_init_termios);
1270
1271int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1272{
1273        int ret = tty_init_termios(tty);
1274        if (ret)
1275                return ret;
1276
1277        tty_driver_kref_get(driver);
1278        tty->count++;
1279        driver->ttys[tty->index] = tty;
1280        return 0;
1281}
1282EXPORT_SYMBOL_GPL(tty_standard_install);
1283
1284/**
1285 *      tty_driver_install_tty() - install a tty entry in the driver
1286 *      @driver: the driver for the tty
1287 *      @tty: the tty
1288 *
1289 *      Install a tty object into the driver tables. The tty->index field
1290 *      will be set by the time this is called. This method is responsible
1291 *      for ensuring any need additional structures are allocated and
1292 *      configured.
1293 *
1294 *      Locking: tty_mutex for now
1295 */
1296static int tty_driver_install_tty(struct tty_driver *driver,
1297                                                struct tty_struct *tty)
1298{
1299        return driver->ops->install ? driver->ops->install(driver, tty) :
1300                tty_standard_install(driver, tty);
1301}
1302
1303/**
1304 *      tty_driver_remove_tty() - remove a tty from the driver tables
1305 *      @driver: the driver for the tty
1306 *      @idx:    the minor number
1307 *
1308 *      Remvoe a tty object from the driver tables. The tty->index field
1309 *      will be set by the time this is called.
1310 *
1311 *      Locking: tty_mutex for now
1312 */
1313void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1314{
1315        if (driver->ops->remove)
1316                driver->ops->remove(driver, tty);
1317        else
1318                driver->ttys[tty->index] = NULL;
1319}
1320
1321/*
1322 *      tty_reopen()    - fast re-open of an open tty
1323 *      @tty    - the tty to open
1324 *
1325 *      Return 0 on success, -errno on error.
1326 *
1327 *      Locking: tty_mutex must be held from the time the tty was found
1328 *               till this open completes.
1329 */
1330static int tty_reopen(struct tty_struct *tty)
1331{
1332        struct tty_driver *driver = tty->driver;
1333
1334        if (test_bit(TTY_CLOSING, &tty->flags) ||
1335                        test_bit(TTY_HUPPING, &tty->flags) ||
1336                        test_bit(TTY_LDISC_CHANGING, &tty->flags))
1337                return -EIO;
1338
1339        if (driver->type == TTY_DRIVER_TYPE_PTY &&
1340            driver->subtype == PTY_TYPE_MASTER) {
1341                /*
1342                 * special case for PTY masters: only one open permitted,
1343                 * and the slave side open count is incremented as well.
1344                 */
1345                if (tty->count)
1346                        return -EIO;
1347
1348                tty->link->count++;
1349        }
1350        tty->count++;
1351
1352        mutex_lock(&tty->ldisc_mutex);
1353        WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1354        mutex_unlock(&tty->ldisc_mutex);
1355
1356        return 0;
1357}
1358
1359/**
1360 *      tty_init_dev            -       initialise a tty device
1361 *      @driver: tty driver we are opening a device on
1362 *      @idx: device index
1363 *      @ret_tty: returned tty structure
1364 *
1365 *      Prepare a tty device. This may not be a "new" clean device but
1366 *      could also be an active device. The pty drivers require special
1367 *      handling because of this.
1368 *
1369 *      Locking:
1370 *              The function is called under the tty_mutex, which
1371 *      protects us from the tty struct or driver itself going away.
1372 *
1373 *      On exit the tty device has the line discipline attached and
1374 *      a reference count of 1. If a pair was created for pty/tty use
1375 *      and the other was a pty master then it too has a reference count of 1.
1376 *
1377 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1378 * failed open.  The new code protects the open with a mutex, so it's
1379 * really quite straightforward.  The mutex locking can probably be
1380 * relaxed for the (most common) case of reopening a tty.
1381 */
1382
1383struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1384{
1385        struct tty_struct *tty;
1386        int retval;
1387
1388        /*
1389         * First time open is complex, especially for PTY devices.
1390         * This code guarantees that either everything succeeds and the
1391         * TTY is ready for operation, or else the table slots are vacated
1392         * and the allocated memory released.  (Except that the termios
1393         * and locked termios may be retained.)
1394         */
1395
1396        if (!try_module_get(driver->owner))
1397                return ERR_PTR(-ENODEV);
1398
1399        tty = alloc_tty_struct();
1400        if (!tty) {
1401                retval = -ENOMEM;
1402                goto err_module_put;
1403        }
1404        initialize_tty_struct(tty, driver, idx);
1405
1406        retval = tty_driver_install_tty(driver, tty);
1407        if (retval < 0)
1408                goto err_deinit_tty;
1409
1410        /*
1411         * Structures all installed ... call the ldisc open routines.
1412         * If we fail here just call release_tty to clean up.  No need
1413         * to decrement the use counts, as release_tty doesn't care.
1414         */
1415        retval = tty_ldisc_setup(tty, tty->link);
1416        if (retval)
1417                goto err_release_tty;
1418        return tty;
1419
1420err_deinit_tty:
1421        deinitialize_tty_struct(tty);
1422        free_tty_struct(tty);
1423err_module_put:
1424        module_put(driver->owner);
1425        return ERR_PTR(retval);
1426
1427        /* call the tty release_tty routine to clean out this slot */
1428err_release_tty:
1429        printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1430                                 "clearing slot %d\n", idx);
1431        release_tty(tty, idx);
1432        return ERR_PTR(retval);
1433}
1434
1435void tty_free_termios(struct tty_struct *tty)
1436{
1437        struct ktermios *tp;
1438        int idx = tty->index;
1439        /* Kill this flag and push into drivers for locking etc */
1440        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1441                /* FIXME: Locking on ->termios array */
1442                tp = tty->termios;
1443                tty->driver->termios[idx] = NULL;
1444                kfree(tp);
1445        }
1446}
1447EXPORT_SYMBOL(tty_free_termios);
1448
1449void tty_shutdown(struct tty_struct *tty)
1450{
1451        tty_driver_remove_tty(tty->driver, tty);
1452        tty_free_termios(tty);
1453}
1454EXPORT_SYMBOL(tty_shutdown);
1455
1456/**
1457 *      release_one_tty         -       release tty structure memory
1458 *      @kref: kref of tty we are obliterating
1459 *
1460 *      Releases memory associated with a tty structure, and clears out the
1461 *      driver table slots. This function is called when a device is no longer
1462 *      in use. It also gets called when setup of a device fails.
1463 *
1464 *      Locking:
1465 *              tty_mutex - sometimes only
1466 *              takes the file list lock internally when working on the list
1467 *      of ttys that the driver keeps.
1468 *
1469 *      This method gets called from a work queue so that the driver private
1470 *      cleanup ops can sleep (needed for USB at least)
1471 */
1472static void release_one_tty(struct work_struct *work)
1473{
1474        struct tty_struct *tty =
1475                container_of(work, struct tty_struct, hangup_work);
1476        struct tty_driver *driver = tty->driver;
1477
1478        if (tty->ops->cleanup)
1479                tty->ops->cleanup(tty);
1480
1481        tty->magic = 0;
1482        tty_driver_kref_put(driver);
1483        module_put(driver->owner);
1484
1485        spin_lock(&tty_files_lock);
1486        list_del_init(&tty->tty_files);
1487        spin_unlock(&tty_files_lock);
1488
1489        put_pid(tty->pgrp);
1490        put_pid(tty->session);
1491        free_tty_struct(tty);
1492}
1493
1494static void queue_release_one_tty(struct kref *kref)
1495{
1496        struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1497
1498        if (tty->ops->shutdown)
1499                tty->ops->shutdown(tty);
1500        else
1501                tty_shutdown(tty);
1502
1503        /* The hangup queue is now free so we can reuse it rather than
1504           waste a chunk of memory for each port */
1505        INIT_WORK(&tty->hangup_work, release_one_tty);
1506        schedule_work(&tty->hangup_work);
1507}
1508
1509/**
1510 *      tty_kref_put            -       release a tty kref
1511 *      @tty: tty device
1512 *
1513 *      Release a reference to a tty device and if need be let the kref
1514 *      layer destruct the object for us
1515 */
1516
1517void tty_kref_put(struct tty_struct *tty)
1518{
1519        if (tty)
1520                kref_put(&tty->kref, queue_release_one_tty);
1521}
1522EXPORT_SYMBOL(tty_kref_put);
1523
1524/**
1525 *      release_tty             -       release tty structure memory
1526 *
1527 *      Release both @tty and a possible linked partner (think pty pair),
1528 *      and decrement the refcount of the backing module.
1529 *
1530 *      Locking:
1531 *              tty_mutex - sometimes only
1532 *              takes the file list lock internally when working on the list
1533 *      of ttys that the driver keeps.
1534 *              FIXME: should we require tty_mutex is held here ??
1535 *
1536 */
1537static void release_tty(struct tty_struct *tty, int idx)
1538{
1539        /* This should always be true but check for the moment */
1540        WARN_ON(tty->index != idx);
1541
1542        if (tty->link)
1543                tty_kref_put(tty->link);
1544        tty_kref_put(tty);
1545}
1546
1547/**
1548 *      tty_release_checks - check a tty before real release
1549 *      @tty: tty to check
1550 *      @o_tty: link of @tty (if any)
1551 *      @idx: index of the tty
1552 *
1553 *      Performs some paranoid checking before true release of the @tty.
1554 *      This is a no-op unless TTY_PARANOIA_CHECK is defined.
1555 */
1556static int tty_release_checks(struct tty_struct *tty, struct tty_struct *o_tty,
1557                int idx)
1558{
1559#ifdef TTY_PARANOIA_CHECK
1560        if (idx < 0 || idx >= tty->driver->num) {
1561                printk(KERN_DEBUG "%s: bad idx when trying to free (%s)\n",
1562                                __func__, tty->name);
1563                return -1;
1564        }
1565
1566        /* not much to check for devpts */
1567        if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1568                return 0;
1569
1570        if (tty != tty->driver->ttys[idx]) {
1571                printk(KERN_DEBUG "%s: driver.table[%d] not tty for (%s)\n",
1572                                __func__, idx, tty->name);
1573                return -1;
1574        }
1575        if (tty->termios != tty->driver->termios[idx]) {
1576                printk(KERN_DEBUG "%s: driver.termios[%d] not termios for (%s)\n",
1577                                __func__, idx, tty->name);
1578                return -1;
1579        }
1580        if (tty->driver->other) {
1581                if (o_tty != tty->driver->other->ttys[idx]) {
1582                        printk(KERN_DEBUG "%s: other->table[%d] not o_tty for (%s)\n",
1583                                        __func__, idx, tty->name);
1584                        return -1;
1585                }
1586                if (o_tty->termios != tty->driver->other->termios[idx]) {
1587                        printk(KERN_DEBUG "%s: other->termios[%d] not o_termios for (%s)\n",
1588                                        __func__, idx, tty->name);
1589                        return -1;
1590                }
1591                if (o_tty->link != tty) {
1592                        printk(KERN_DEBUG "%s: bad pty pointers\n", __func__);
1593                        return -1;
1594                }
1595        }
1596#endif
1597        return 0;
1598}
1599
1600/**
1601 *      tty_release             -       vfs callback for close
1602 *      @inode: inode of tty
1603 *      @filp: file pointer for handle to tty
1604 *
1605 *      Called the last time each file handle is closed that references
1606 *      this tty. There may however be several such references.
1607 *
1608 *      Locking:
1609 *              Takes bkl. See tty_release_dev
1610 *
1611 * Even releasing the tty structures is a tricky business.. We have
1612 * to be very careful that the structures are all released at the
1613 * same time, as interrupts might otherwise get the wrong pointers.
1614 *
1615 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1616 * lead to double frees or releasing memory still in use.
1617 */
1618
1619int tty_release(struct inode *inode, struct file *filp)
1620{
1621        struct tty_struct *tty = file_tty(filp);
1622        struct tty_struct *o_tty;
1623        int     pty_master, tty_closing, o_tty_closing, do_sleep;
1624        int     devpts;
1625        int     idx;
1626        char    buf[64];
1627
1628        if (tty_paranoia_check(tty, inode, __func__))
1629                return 0;
1630
1631        tty_lock();
1632        check_tty_count(tty, __func__);
1633
1634        __tty_fasync(-1, filp, 0);
1635
1636        idx = tty->index;
1637        pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1638                      tty->driver->subtype == PTY_TYPE_MASTER);
1639        devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1640        o_tty = tty->link;
1641
1642        if (tty_release_checks(tty, o_tty, idx)) {
1643                tty_unlock();
1644                return 0;
1645        }
1646
1647#ifdef TTY_DEBUG_HANGUP
1648        printk(KERN_DEBUG "%s: %s (tty count=%d)...\n", __func__,
1649                        tty_name(tty, buf), tty->count);
1650#endif
1651
1652        if (tty->ops->close)
1653                tty->ops->close(tty, filp);
1654
1655        tty_unlock();
1656        /*
1657         * Sanity check: if tty->count is going to zero, there shouldn't be
1658         * any waiters on tty->read_wait or tty->write_wait.  We test the
1659         * wait queues and kick everyone out _before_ actually starting to
1660         * close.  This ensures that we won't block while releasing the tty
1661         * structure.
1662         *
1663         * The test for the o_tty closing is necessary, since the master and
1664         * slave sides may close in any order.  If the slave side closes out
1665         * first, its count will be one, since the master side holds an open.
1666         * Thus this test wouldn't be triggered at the time the slave closes,
1667         * so we do it now.
1668         *
1669         * Note that it's possible for the tty to be opened again while we're
1670         * flushing out waiters.  By recalculating the closing flags before
1671         * each iteration we avoid any problems.
1672         */
1673        while (1) {
1674                /* Guard against races with tty->count changes elsewhere and
1675                   opens on /dev/tty */
1676
1677                mutex_lock(&tty_mutex);
1678                tty_lock();
1679                tty_closing = tty->count <= 1;
1680                o_tty_closing = o_tty &&
1681                        (o_tty->count <= (pty_master ? 1 : 0));
1682                do_sleep = 0;
1683
1684                if (tty_closing) {
1685                        if (waitqueue_active(&tty->read_wait)) {
1686                                wake_up_poll(&tty->read_wait, POLLIN);
1687                                do_sleep++;
1688                        }
1689                        if (waitqueue_active(&tty->write_wait)) {
1690                                wake_up_poll(&tty->write_wait, POLLOUT);
1691                                do_sleep++;
1692                        }
1693                }
1694                if (o_tty_closing) {
1695                        if (waitqueue_active(&o_tty->read_wait)) {
1696                                wake_up_poll(&o_tty->read_wait, POLLIN);
1697                                do_sleep++;
1698                        }
1699                        if (waitqueue_active(&o_tty->write_wait)) {
1700                                wake_up_poll(&o_tty->write_wait, POLLOUT);
1701                                do_sleep++;
1702                        }
1703                }
1704                if (!do_sleep)
1705                        break;
1706
1707                printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
1708                                __func__, tty_name(tty, buf));
1709                tty_unlock();
1710                mutex_unlock(&tty_mutex);
1711                schedule();
1712        }
1713
1714        /*
1715         * The closing flags are now consistent with the open counts on
1716         * both sides, and we've completed the last operation that could
1717         * block, so it's safe to proceed with closing.
1718         */
1719        if (pty_master) {
1720                if (--o_tty->count < 0) {
1721                        printk(KERN_WARNING "%s: bad pty slave count (%d) for %s\n",
1722                                __func__, o_tty->count, tty_name(o_tty, buf));
1723                        o_tty->count = 0;
1724                }
1725        }
1726        if (--tty->count < 0) {
1727                printk(KERN_WARNING "%s: bad tty->count (%d) for %s\n",
1728                                __func__, tty->count, tty_name(tty, buf));
1729                tty->count = 0;
1730        }
1731
1732        /*
1733         * We've decremented tty->count, so we need to remove this file
1734         * descriptor off the tty->tty_files list; this serves two
1735         * purposes:
1736         *  - check_tty_count sees the correct number of file descriptors
1737         *    associated with this tty.
1738         *  - do_tty_hangup no longer sees this file descriptor as
1739         *    something that needs to be handled for hangups.
1740         */
1741        tty_del_file(filp);
1742
1743        /*
1744         * Perform some housekeeping before deciding whether to return.
1745         *
1746         * Set the TTY_CLOSING flag if this was the last open.  In the
1747         * case of a pty we may have to wait around for the other side
1748         * to close, and TTY_CLOSING makes sure we can't be reopened.
1749         */
1750        if (tty_closing)
1751                set_bit(TTY_CLOSING, &tty->flags);
1752        if (o_tty_closing)
1753                set_bit(TTY_CLOSING, &o_tty->flags);
1754
1755        /*
1756         * If _either_ side is closing, make sure there aren't any
1757         * processes that still think tty or o_tty is their controlling
1758         * tty.
1759         */
1760        if (tty_closing || o_tty_closing) {
1761                read_lock(&tasklist_lock);
1762                session_clear_tty(tty->session);
1763                if (o_tty)
1764                        session_clear_tty(o_tty->session);
1765                read_unlock(&tasklist_lock);
1766        }
1767
1768        mutex_unlock(&tty_mutex);
1769
1770        /* check whether both sides are closing ... */
1771        if (!tty_closing || (o_tty && !o_tty_closing)) {
1772                tty_unlock();
1773                return 0;
1774        }
1775
1776#ifdef TTY_DEBUG_HANGUP
1777        printk(KERN_DEBUG "%s: freeing tty structure...\n", __func__);
1778#endif
1779        /*
1780         * Ask the line discipline code to release its structures
1781         */
1782        tty_ldisc_release(tty, o_tty);
1783        /*
1784         * The release_tty function takes care of the details of clearing
1785         * the slots and preserving the termios structure.
1786         */
1787        release_tty(tty, idx);
1788
1789        /* Make this pty number available for reallocation */
1790        if (devpts)
1791                devpts_kill_index(inode, idx);
1792        tty_unlock();
1793        return 0;
1794}
1795
1796/**
1797 *      tty_open_current_tty - get tty of current task for open
1798 *      @device: device number
1799 *      @filp: file pointer to tty
1800 *      @return: tty of the current task iff @device is /dev/tty
1801 *
1802 *      We cannot return driver and index like for the other nodes because
1803 *      devpts will not work then. It expects inodes to be from devpts FS.
1804 *
1805 *      We need to move to returning a refcounted object from all the lookup
1806 *      paths including this one.
1807 */
1808static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1809{
1810        struct tty_struct *tty;
1811
1812        if (device != MKDEV(TTYAUX_MAJOR, 0))
1813                return NULL;
1814
1815        tty = get_current_tty();
1816        if (!tty)
1817                return ERR_PTR(-ENXIO);
1818
1819        filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1820        /* noctty = 1; */
1821        tty_kref_put(tty);
1822        /* FIXME: we put a reference and return a TTY! */
1823        /* This is only safe because the caller holds tty_mutex */
1824        return tty;
1825}
1826
1827/**
1828 *      tty_lookup_driver - lookup a tty driver for a given device file
1829 *      @device: device number
1830 *      @filp: file pointer to tty
1831 *      @noctty: set if the device should not become a controlling tty
1832 *      @index: index for the device in the @return driver
1833 *      @return: driver for this inode (with increased refcount)
1834 *
1835 *      If @return is not erroneous, the caller is responsible to decrement the
1836 *      refcount by tty_driver_kref_put.
1837 *
1838 *      Locking: tty_mutex protects get_tty_driver
1839 */
1840static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1841                int *noctty, int *index)
1842{
1843        struct tty_driver *driver;
1844
1845        switch (device) {
1846#ifdef CONFIG_VT
1847        case MKDEV(TTY_MAJOR, 0): {
1848                extern struct tty_driver *console_driver;
1849                driver = tty_driver_kref_get(console_driver);
1850                *index = fg_console;
1851                *noctty = 1;
1852                break;
1853        }
1854#endif
1855        case MKDEV(TTYAUX_MAJOR, 1): {
1856                struct tty_driver *console_driver = console_device(index);
1857                if (console_driver) {
1858                        driver = tty_driver_kref_get(console_driver);
1859                        if (driver) {
1860                                /* Don't let /dev/console block */
1861                                filp->f_flags |= O_NONBLOCK;
1862                                *noctty = 1;
1863                                break;
1864                        }
1865                }
1866                return ERR_PTR(-ENODEV);
1867        }
1868        default:
1869                driver = get_tty_driver(device, index);
1870                if (!driver)
1871                        return ERR_PTR(-ENODEV);
1872                break;
1873        }
1874        return driver;
1875}
1876
1877/**
1878 *      tty_open                -       open a tty device
1879 *      @inode: inode of device file
1880 *      @filp: file pointer to tty
1881 *
1882 *      tty_open and tty_release keep up the tty count that contains the
1883 *      number of opens done on a tty. We cannot use the inode-count, as
1884 *      different inodes might point to the same tty.
1885 *
1886 *      Open-counting is needed for pty masters, as well as for keeping
1887 *      track of serial lines: DTR is dropped when the last close happens.
1888 *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
1889 *
1890 *      The termios state of a pty is reset on first open so that
1891 *      settings don't persist across reuse.
1892 *
1893 *      Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
1894 *               tty->count should protect the rest.
1895 *               ->siglock protects ->signal/->sighand
1896 */
1897
1898static int tty_open(struct inode *inode, struct file *filp)
1899{
1900        struct tty_struct *tty;
1901        int noctty, retval;
1902        struct tty_driver *driver = NULL;
1903        int index;
1904        dev_t device = inode->i_rdev;
1905        unsigned saved_flags = filp->f_flags;
1906
1907        nonseekable_open(inode, filp);
1908
1909retry_open:
1910        retval = tty_alloc_file(filp);
1911        if (retval)
1912                return -ENOMEM;
1913
1914        noctty = filp->f_flags & O_NOCTTY;
1915        index  = -1;
1916        retval = 0;
1917
1918        mutex_lock(&tty_mutex);
1919        tty_lock();
1920
1921        tty = tty_open_current_tty(device, filp);
1922        if (IS_ERR(tty)) {
1923                retval = PTR_ERR(tty);
1924                goto err_unlock;
1925        } else if (!tty) {
1926                driver = tty_lookup_driver(device, filp, &noctty, &index);
1927                if (IS_ERR(driver)) {
1928                        retval = PTR_ERR(driver);
1929                        goto err_unlock;
1930                }
1931
1932                /* check whether we're reopening an existing tty */
1933                tty = tty_driver_lookup_tty(driver, inode, index);
1934                if (IS_ERR(tty)) {
1935                        retval = PTR_ERR(tty);
1936                        goto err_unlock;
1937                }
1938        }
1939
1940        if (tty) {
1941                retval = tty_reopen(tty);
1942                if (retval)
1943                        tty = ERR_PTR(retval);
1944        } else
1945                tty = tty_init_dev(driver, index);
1946
1947        mutex_unlock(&tty_mutex);
1948        if (driver)
1949                tty_driver_kref_put(driver);
1950        if (IS_ERR(tty)) {
1951                tty_unlock();
1952                retval = PTR_ERR(tty);
1953                goto err_file;
1954        }
1955
1956        tty_add_file(tty, filp);
1957
1958        check_tty_count(tty, __func__);
1959        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1960            tty->driver->subtype == PTY_TYPE_MASTER)
1961                noctty = 1;
1962#ifdef TTY_DEBUG_HANGUP
1963        printk(KERN_DEBUG "%s: opening %s...\n", __func__, tty->name);
1964#endif
1965        if (tty->ops->open)
1966                retval = tty->ops->open(tty, filp);
1967        else
1968                retval = -ENODEV;
1969        filp->f_flags = saved_flags;
1970
1971        if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
1972                                                !capable(CAP_SYS_ADMIN))
1973                retval = -EBUSY;
1974
1975        if (retval) {
1976#ifdef TTY_DEBUG_HANGUP
1977                printk(KERN_DEBUG "%s: error %d in opening %s...\n", __func__,
1978                                retval, tty->name);
1979#endif
1980                tty_unlock(); /* need to call tty_release without BTM */
1981                tty_release(inode, filp);
1982                if (retval != -ERESTARTSYS)
1983                        return retval;
1984
1985                if (signal_pending(current))
1986                        return retval;
1987
1988                schedule();
1989                /*
1990                 * Need to reset f_op in case a hangup happened.
1991                 */
1992                tty_lock();
1993                if (filp->f_op == &hung_up_tty_fops)
1994                        filp->f_op = &tty_fops;
1995                tty_unlock();
1996                goto retry_open;
1997        }
1998        tty_unlock();
1999
2000
2001        mutex_lock(&tty_mutex);
2002        tty_lock();
2003        spin_lock_irq(&current->sighand->siglock);
2004        if (!noctty &&
2005            current->signal->leader &&
2006            !current->signal->tty &&
2007            tty->session == NULL)
2008                __proc_set_tty(current, tty);
2009        spin_unlock_irq(&current->sighand->siglock);
2010        tty_unlock();
2011        mutex_unlock(&tty_mutex);
2012        return 0;
2013err_unlock:
2014        tty_unlock();
2015        mutex_unlock(&tty_mutex);
2016        /* after locks to avoid deadlock */
2017        if (!IS_ERR_OR_NULL(driver))
2018                tty_driver_kref_put(driver);
2019err_file:
2020        tty_free_file(filp);
2021        return retval;
2022}
2023
2024
2025
2026/**
2027 *      tty_poll        -       check tty status
2028 *      @filp: file being polled
2029 *      @wait: poll wait structures to update
2030 *
2031 *      Call the line discipline polling method to obtain the poll
2032 *      status of the device.
2033 *
2034 *      Locking: locks called line discipline but ldisc poll method
2035 *      may be re-entered freely by other callers.
2036 */
2037
2038static unsigned int tty_poll(struct file *filp, poll_table *wait)
2039{
2040        struct tty_struct *tty = file_tty(filp);
2041        struct tty_ldisc *ld;
2042        int ret = 0;
2043
2044        if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2045                return 0;
2046
2047        ld = tty_ldisc_ref_wait(tty);
2048        if (ld->ops->poll)
2049                ret = (ld->ops->poll)(tty, filp, wait);
2050        tty_ldisc_deref(ld);
2051        return ret;
2052}
2053
2054static int __tty_fasync(int fd, struct file *filp, int on)
2055{
2056        struct tty_struct *tty = file_tty(filp);
2057        unsigned long flags;
2058        int retval = 0;
2059
2060        if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2061                goto out;
2062
2063        retval = fasync_helper(fd, filp, on, &tty->fasync);
2064        if (retval <= 0)
2065                goto out;
2066
2067        if (on) {
2068                enum pid_type type;
2069                struct pid *pid;
2070                if (!waitqueue_active(&tty->read_wait))
2071                        tty->minimum_to_wake = 1;
2072                spin_lock_irqsave(&tty->ctrl_lock, flags);
2073                if (tty->pgrp) {
2074                        pid = tty->pgrp;
2075                        type = PIDTYPE_PGID;
2076                } else {
2077                        pid = task_pid(current);
2078                        type = PIDTYPE_PID;
2079                }
2080                get_pid(pid);
2081                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2082                retval = __f_setown(filp, pid, type, 0);
2083                put_pid(pid);
2084                if (retval)
2085                        goto out;
2086        } else {
2087                if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2088                        tty->minimum_to_wake = N_TTY_BUF_SIZE;
2089        }
2090        retval = 0;
2091out:
2092        return retval;
2093}
2094
2095static int tty_fasync(int fd, struct file *filp, int on)
2096{
2097        int retval;
2098        tty_lock();
2099        retval = __tty_fasync(fd, filp, on);
2100        tty_unlock();
2101        return retval;
2102}
2103
2104/**
2105 *      tiocsti                 -       fake input character
2106 *      @tty: tty to fake input into
2107 *      @p: pointer to character
2108 *
2109 *      Fake input to a tty device. Does the necessary locking and
2110 *      input management.
2111 *
2112 *      FIXME: does not honour flow control ??
2113 *
2114 *      Locking:
2115 *              Called functions take tty_ldisc_lock
2116 *              current->signal->tty check is safe without locks
2117 *
2118 *      FIXME: may race normal receive processing
2119 */
2120
2121static int tiocsti(struct tty_struct *tty, char __user *p)
2122{
2123        char ch, mbz = 0;
2124        struct tty_ldisc *ld;
2125
2126        if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2127                return -EPERM;
2128        if (get_user(ch, p))
2129                return -EFAULT;
2130        tty_audit_tiocsti(tty, ch);
2131        ld = tty_ldisc_ref_wait(tty);
2132        ld->ops->receive_buf(tty, &ch, &mbz, 1);
2133        tty_ldisc_deref(ld);
2134        return 0;
2135}
2136
2137/**
2138 *      tiocgwinsz              -       implement window query ioctl
2139 *      @tty; tty
2140 *      @arg: user buffer for result
2141 *
2142 *      Copies the kernel idea of the window size into the user buffer.
2143 *
2144 *      Locking: tty->termios_mutex is taken to ensure the winsize data
2145 *              is consistent.
2146 */
2147
2148static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2149{
2150        int err;
2151
2152        mutex_lock(&tty->termios_mutex);
2153        err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2154        mutex_unlock(&tty->termios_mutex);
2155
2156        return err ? -EFAULT: 0;
2157}
2158
2159/**
2160 *      tty_do_resize           -       resize event
2161 *      @tty: tty being resized
2162 *      @rows: rows (character)
2163 *      @cols: cols (character)
2164 *
2165 *      Update the termios variables and send the necessary signals to
2166 *      peform a terminal resize correctly
2167 */
2168
2169int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2170{
2171        struct pid *pgrp;
2172        unsigned long flags;
2173
2174        /* Lock the tty */
2175        mutex_lock(&tty->termios_mutex);
2176        if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2177                goto done;
2178        /* Get the PID values and reference them so we can
2179           avoid holding the tty ctrl lock while sending signals */
2180        spin_lock_irqsave(&tty->ctrl_lock, flags);
2181        pgrp = get_pid(tty->pgrp);
2182        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2183
2184        if (pgrp)
2185                kill_pgrp(pgrp, SIGWINCH, 1);
2186        put_pid(pgrp);
2187
2188        tty->winsize = *ws;
2189done:
2190        mutex_unlock(&tty->termios_mutex);
2191        return 0;
2192}
2193
2194/**
2195 *      tiocswinsz              -       implement window size set ioctl
2196 *      @tty; tty side of tty
2197 *      @arg: user buffer for result
2198 *
2199 *      Copies the user idea of the window size to the kernel. Traditionally
2200 *      this is just advisory information but for the Linux console it
2201 *      actually has driver level meaning and triggers a VC resize.
2202 *
2203 *      Locking:
2204 *              Driver dependent. The default do_resize method takes the
2205 *      tty termios mutex and ctrl_lock. The console takes its own lock
2206 *      then calls into the default method.
2207 */
2208
2209static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2210{
2211        struct winsize tmp_ws;
2212        if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2213                return -EFAULT;
2214
2215        if (tty->ops->resize)
2216                return tty->ops->resize(tty, &tmp_ws);
2217        else
2218                return tty_do_resize(tty, &tmp_ws);
2219}
2220
2221/**
2222 *      tioccons        -       allow admin to move logical console
2223 *      @file: the file to become console
2224 *
2225 *      Allow the administrator to move the redirected console device
2226 *
2227 *      Locking: uses redirect_lock to guard the redirect information
2228 */
2229
2230static int tioccons(struct file *file)
2231{
2232        if (!capable(CAP_SYS_ADMIN))
2233                return -EPERM;
2234        if (file->f_op->write == redirected_tty_write) {
2235                struct file *f;
2236                spin_lock(&redirect_lock);
2237                f = redirect;
2238                redirect = NULL;
2239                spin_unlock(&redirect_lock);
2240                if (f)
2241                        fput(f);
2242                return 0;
2243        }
2244        spin_lock(&redirect_lock);
2245        if (redirect) {
2246                spin_unlock(&redirect_lock);
2247                return -EBUSY;
2248        }
2249        get_file(file);
2250        redirect = file;
2251        spin_unlock(&redirect_lock);
2252        return 0;
2253}
2254
2255/**
2256 *      fionbio         -       non blocking ioctl
2257 *      @file: file to set blocking value
2258 *      @p: user parameter
2259 *
2260 *      Historical tty interfaces had a blocking control ioctl before
2261 *      the generic functionality existed. This piece of history is preserved
2262 *      in the expected tty API of posix OS's.
2263 *
2264 *      Locking: none, the open file handle ensures it won't go away.
2265 */
2266
2267static int fionbio(struct file *file, int __user *p)
2268{
2269        int nonblock;
2270
2271        if (get_user(nonblock, p))
2272                return -EFAULT;
2273
2274        spin_lock(&file->f_lock);
2275        if (nonblock)
2276                file->f_flags |= O_NONBLOCK;
2277        else
2278                file->f_flags &= ~O_NONBLOCK;
2279        spin_unlock(&file->f_lock);
2280        return 0;
2281}
2282
2283/**
2284 *      tiocsctty       -       set controlling tty
2285 *      @tty: tty structure
2286 *      @arg: user argument
2287 *
2288 *      This ioctl is used to manage job control. It permits a session
2289 *      leader to set this tty as the controlling tty for the session.
2290 *
2291 *      Locking:
2292 *              Takes tty_mutex() to protect tty instance
2293 *              Takes tasklist_lock internally to walk sessions
2294 *              Takes ->siglock() when updating signal->tty
2295 */
2296
2297static int tiocsctty(struct tty_struct *tty, int arg)
2298{
2299        int ret = 0;
2300        if (current->signal->leader && (task_session(current) == tty->session))
2301                return ret;
2302
2303        mutex_lock(&tty_mutex);
2304        /*
2305         * The process must be a session leader and
2306         * not have a controlling tty already.
2307         */
2308        if (!current->signal->leader || current->signal->tty) {
2309                ret = -EPERM;
2310                goto unlock;
2311        }
2312
2313        if (tty->session) {
2314                /*
2315                 * This tty is already the controlling
2316                 * tty for another session group!
2317                 */
2318                if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2319                        /*
2320                         * Steal it away
2321                         */
2322                        read_lock(&tasklist_lock);
2323                        session_clear_tty(tty->session);
2324                        read_unlock(&tasklist_lock);
2325                } else {
2326                        ret = -EPERM;
2327                        goto unlock;
2328                }
2329        }
2330        proc_set_tty(current, tty);
2331unlock:
2332        mutex_unlock(&tty_mutex);
2333        return ret;
2334}
2335
2336/**
2337 *      tty_get_pgrp    -       return a ref counted pgrp pid
2338 *      @tty: tty to read
2339 *
2340 *      Returns a refcounted instance of the pid struct for the process
2341 *      group controlling the tty.
2342 */
2343
2344struct pid *tty_get_pgrp(struct tty_struct *tty)
2345{
2346        unsigned long flags;
2347        struct pid *pgrp;
2348
2349        spin_lock_irqsave(&tty->ctrl_lock, flags);
2350        pgrp = get_pid(tty->pgrp);
2351        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2352
2353        return pgrp;
2354}
2355EXPORT_SYMBOL_GPL(tty_get_pgrp);
2356
2357/**
2358 *      tiocgpgrp               -       get process group
2359 *      @tty: tty passed by user
2360 *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2361 *      @p: returned pid
2362 *
2363 *      Obtain the process group of the tty. If there is no process group
2364 *      return an error.
2365 *
2366 *      Locking: none. Reference to current->signal->tty is safe.
2367 */
2368
2369static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2370{
2371        struct pid *pid;
2372        int ret;
2373        /*
2374         * (tty == real_tty) is a cheap way of
2375         * testing if the tty is NOT a master pty.
2376         */
2377        if (tty == real_tty && current->signal->tty != real_tty)
2378                return -ENOTTY;
2379        pid = tty_get_pgrp(real_tty);
2380        ret =  put_user(pid_vnr(pid), p);
2381        put_pid(pid);
2382        return ret;
2383}
2384
2385/**
2386 *      tiocspgrp               -       attempt to set process group
2387 *      @tty: tty passed by user
2388 *      @real_tty: tty side device matching tty passed by user
2389 *      @p: pid pointer
2390 *
2391 *      Set the process group of the tty to the session passed. Only
2392 *      permitted where the tty session is our session.
2393 *
2394 *      Locking: RCU, ctrl lock
2395 */
2396
2397static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2398{
2399        struct pid *pgrp;
2400        pid_t pgrp_nr;
2401        int retval = tty_check_change(real_tty);
2402        unsigned long flags;
2403
2404        if (retval == -EIO)
2405                return -ENOTTY;
2406        if (retval)
2407                return retval;
2408        if (!current->signal->tty ||
2409            (current->signal->tty != real_tty) ||
2410            (real_tty->session != task_session(current)))
2411                return -ENOTTY;
2412        if (get_user(pgrp_nr, p))
2413                return -EFAULT;
2414        if (pgrp_nr < 0)
2415                return -EINVAL;
2416        rcu_read_lock();
2417        pgrp = find_vpid(pgrp_nr);
2418        retval = -ESRCH;
2419        if (!pgrp)
2420                goto out_unlock;
2421        retval = -EPERM;
2422        if (session_of_pgrp(pgrp) != task_session(current))
2423                goto out_unlock;
2424        retval = 0;
2425        spin_lock_irqsave(&tty->ctrl_lock, flags);
2426        put_pid(real_tty->pgrp);
2427        real_tty->pgrp = get_pid(pgrp);
2428        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2429out_unlock:
2430        rcu_read_unlock();
2431        return retval;
2432}
2433
2434/**
2435 *      tiocgsid                -       get session id
2436 *      @tty: tty passed by user
2437 *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2438 *      @p: pointer to returned session id
2439 *
2440 *      Obtain the session id of the tty. If there is no session
2441 *      return an error.
2442 *
2443 *      Locking: none. Reference to current->signal->tty is safe.
2444 */
2445
2446static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2447{
2448        /*
2449         * (tty == real_tty) is a cheap way of
2450         * testing if the tty is NOT a master pty.
2451        */
2452        if (tty == real_tty && current->signal->tty != real_tty)
2453                return -ENOTTY;
2454        if (!real_tty->session)
2455                return -ENOTTY;
2456        return put_user(pid_vnr(real_tty->session), p);
2457}
2458
2459/**
2460 *      tiocsetd        -       set line discipline
2461 *      @tty: tty device
2462 *      @p: pointer to user data
2463 *
2464 *      Set the line discipline according to user request.
2465 *
2466 *      Locking: see tty_set_ldisc, this function is just a helper
2467 */
2468
2469static int tiocsetd(struct tty_struct *tty, int __user *p)
2470{
2471        int ldisc;
2472        int ret;
2473
2474        if (get_user(ldisc, p))
2475                return -EFAULT;
2476
2477        ret = tty_set_ldisc(tty, ldisc);
2478
2479        return ret;
2480}
2481
2482/**
2483 *      send_break      -       performed time break
2484 *      @tty: device to break on
2485 *      @duration: timeout in mS
2486 *
2487 *      Perform a timed break on hardware that lacks its own driver level
2488 *      timed break functionality.
2489 *
2490 *      Locking:
2491 *              atomic_write_lock serializes
2492 *
2493 */
2494
2495static int send_break(struct tty_struct *tty, unsigned int duration)
2496{
2497        int retval;
2498
2499        if (tty->ops->break_ctl == NULL)
2500                return 0;
2501
2502        if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2503                retval = tty->ops->break_ctl(tty, duration);
2504        else {
2505                /* Do the work ourselves */
2506                if (tty_write_lock(tty, 0) < 0)
2507                        return -EINTR;
2508                retval = tty->ops->break_ctl(tty, -1);
2509                if (retval)
2510                        goto out;
2511                if (!signal_pending(current))
2512                        msleep_interruptible(duration);
2513                retval = tty->ops->break_ctl(tty, 0);
2514out:
2515                tty_write_unlock(tty);
2516                if (signal_pending(current))
2517                        retval = -EINTR;
2518        }
2519        return retval;
2520}
2521
2522/**
2523 *      tty_tiocmget            -       get modem status
2524 *      @tty: tty device
2525 *      @file: user file pointer
2526 *      @p: pointer to result
2527 *
2528 *      Obtain the modem status bits from the tty driver if the feature
2529 *      is supported. Return -EINVAL if it is not available.
2530 *
2531 *      Locking: none (up to the driver)
2532 */
2533
2534static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2535{
2536        int retval = -EINVAL;
2537
2538        if (tty->ops->tiocmget) {
2539                retval = tty->ops->tiocmget(tty);
2540
2541                if (retval >= 0)
2542                        retval = put_user(retval, p);
2543        }
2544        return retval;
2545}
2546
2547/**
2548 *      tty_tiocmset            -       set modem status
2549 *      @tty: tty device
2550 *      @cmd: command - clear bits, set bits or set all
2551 *      @p: pointer to desired bits
2552 *
2553 *      Set the modem status bits from the tty driver if the feature
2554 *      is supported. Return -EINVAL if it is not available.
2555 *
2556 *      Locking: none (up to the driver)
2557 */
2558
2559static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2560             unsigned __user *p)
2561{
2562        int retval;
2563        unsigned int set, clear, val;
2564
2565        if (tty->ops->tiocmset == NULL)
2566                return -EINVAL;
2567
2568        retval = get_user(val, p);
2569        if (retval)
2570                return retval;
2571        set = clear = 0;
2572        switch (cmd) {
2573        case TIOCMBIS:
2574                set = val;
2575                break;
2576        case TIOCMBIC:
2577                clear = val;
2578                break;
2579        case TIOCMSET:
2580                set = val;
2581                clear = ~val;
2582                break;
2583        }
2584        set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2585        clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2586        return tty->ops->tiocmset(tty, set, clear);
2587}
2588
2589static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2590{
2591        int retval = -EINVAL;
2592        struct serial_icounter_struct icount;
2593        memset(&icount, 0, sizeof(icount));
2594        if (tty->ops->get_icount)
2595                retval = tty->ops->get_icount(tty, &icount);
2596        if (retval != 0)
2597                return retval;
2598        if (copy_to_user(arg, &icount, sizeof(icount)))
2599                return -EFAULT;
2600        return 0;
2601}
2602
2603struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2604{
2605        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2606            tty->driver->subtype == PTY_TYPE_MASTER)
2607                tty = tty->link;
2608        return tty;
2609}
2610EXPORT_SYMBOL(tty_pair_get_tty);
2611
2612struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2613{
2614        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2615            tty->driver->subtype == PTY_TYPE_MASTER)
2616            return tty;
2617        return tty->link;
2618}
2619EXPORT_SYMBOL(tty_pair_get_pty);
2620
2621/*
2622 * Split this up, as gcc can choke on it otherwise..
2623 */
2624long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2625{
2626        struct tty_struct *tty = file_tty(file);
2627        struct tty_struct *real_tty;
2628        void __user *p = (void __user *)arg;
2629        int retval;
2630        struct tty_ldisc *ld;
2631        struct inode *inode = file->f_dentry->d_inode;
2632
2633        if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2634                return -EINVAL;
2635
2636        real_tty = tty_pair_get_tty(tty);
2637
2638        /*
2639         * Factor out some common prep work
2640         */
2641        switch (cmd) {
2642        case TIOCSETD:
2643        case TIOCSBRK:
2644        case TIOCCBRK:
2645        case TCSBRK:
2646        case TCSBRKP:
2647                retval = tty_check_change(tty);
2648                if (retval)
2649                        return retval;
2650                if (cmd != TIOCCBRK) {
2651                        tty_wait_until_sent(tty, 0);
2652                        if (signal_pending(current))
2653                                return -EINTR;
2654                }
2655                break;
2656        }
2657
2658        /*
2659         *      Now do the stuff.
2660         */
2661        switch (cmd) {
2662        case TIOCSTI:
2663                return tiocsti(tty, p);
2664        case TIOCGWINSZ:
2665                return tiocgwinsz(real_tty, p);
2666        case TIOCSWINSZ:
2667                return tiocswinsz(real_tty, p);
2668        case TIOCCONS:
2669                return real_tty != tty ? -EINVAL : tioccons(file);
2670        case FIONBIO:
2671                return fionbio(file, p);
2672        case TIOCEXCL:
2673                set_bit(TTY_EXCLUSIVE, &tty->flags);
2674                return 0;
2675        case TIOCNXCL:
2676                clear_bit(TTY_EXCLUSIVE, &tty->flags);
2677                return 0;
2678        case TIOCNOTTY:
2679                if (current->signal->tty != tty)
2680                        return -ENOTTY;
2681                no_tty();
2682                return 0;
2683        case TIOCSCTTY:
2684                return tiocsctty(tty, arg);
2685        case TIOCGPGRP:
2686                return tiocgpgrp(tty, real_tty, p);
2687        case TIOCSPGRP:
2688                return tiocspgrp(tty, real_tty, p);
2689        case TIOCGSID:
2690                return tiocgsid(tty, real_tty, p);
2691        case TIOCGETD:
2692                return put_user(tty->ldisc->ops->num, (int __user *)p);
2693        case TIOCSETD:
2694                return tiocsetd(tty, p);
2695        case TIOCVHANGUP:
2696                if (!capable(CAP_SYS_ADMIN))
2697                        return -EPERM;
2698                tty_vhangup(tty);
2699                return 0;
2700        case TIOCGDEV:
2701        {
2702                unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2703                return put_user(ret, (unsigned int __user *)p);
2704        }
2705        /*
2706         * Break handling
2707         */
2708        case TIOCSBRK:  /* Turn break on, unconditionally */
2709                if (tty->ops->break_ctl)
2710                        return tty->ops->break_ctl(tty, -1);
2711                return 0;
2712        case TIOCCBRK:  /* Turn break off, unconditionally */
2713                if (tty->ops->break_ctl)
2714                        return tty->ops->break_ctl(tty, 0);
2715                return 0;
2716        case TCSBRK:   /* SVID version: non-zero arg --> no break */
2717                /* non-zero arg means wait for all output data
2718                 * to be sent (performed above) but don't send break.
2719                 * This is used by the tcdrain() termios function.
2720                 */
2721                if (!arg)
2722                        return send_break(tty, 250);
2723                return 0;
2724        case TCSBRKP:   /* support for POSIX tcsendbreak() */
2725                return send_break(tty, arg ? arg*100 : 250);
2726
2727        case TIOCMGET:
2728                return tty_tiocmget(tty, p);
2729        case TIOCMSET:
2730        case TIOCMBIC:
2731        case TIOCMBIS:
2732                return tty_tiocmset(tty, cmd, p);
2733        case TIOCGICOUNT:
2734                retval = tty_tiocgicount(tty, p);
2735                /* For the moment allow fall through to the old method */
2736                if (retval != -EINVAL)
2737                        return retval;
2738                break;
2739        case TCFLSH:
2740                switch (arg) {
2741                case TCIFLUSH:
2742                case TCIOFLUSH:
2743                /* flush tty buffer and allow ldisc to process ioctl */
2744                        tty_buffer_flush(tty);
2745                        break;
2746                }
2747                break;
2748        }
2749        if (tty->ops->ioctl) {
2750                retval = (tty->ops->ioctl)(tty, cmd, arg);
2751                if (retval != -ENOIOCTLCMD)
2752                        return retval;
2753        }
2754        ld = tty_ldisc_ref_wait(tty);
2755        retval = -EINVAL;
2756        if (ld->ops->ioctl) {
2757                retval = ld->ops->ioctl(tty, file, cmd, arg);
2758                if (retval == -ENOIOCTLCMD)
2759                        retval = -EINVAL;
2760        }
2761        tty_ldisc_deref(ld);
2762        return retval;
2763}
2764
2765#ifdef CONFIG_COMPAT
2766static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2767                                unsigned long arg)
2768{
2769        struct inode *inode = file->f_dentry->d_inode;
2770        struct tty_struct *tty = file_tty(file);
2771        struct tty_ldisc *ld;
2772        int retval = -ENOIOCTLCMD;
2773
2774        if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2775                return -EINVAL;
2776
2777        if (tty->ops->compat_ioctl) {
2778                retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2779                if (retval != -ENOIOCTLCMD)
2780                        return retval;
2781        }
2782
2783        ld = tty_ldisc_ref_wait(tty);
2784        if (ld->ops->compat_ioctl)
2785                retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2786        else
2787                retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2788        tty_ldisc_deref(ld);
2789
2790        return retval;
2791}
2792#endif
2793
2794/*
2795 * This implements the "Secure Attention Key" ---  the idea is to
2796 * prevent trojan horses by killing all processes associated with this
2797 * tty when the user hits the "Secure Attention Key".  Required for
2798 * super-paranoid applications --- see the Orange Book for more details.
2799 *
2800 * This code could be nicer; ideally it should send a HUP, wait a few
2801 * seconds, then send a INT, and then a KILL signal.  But you then
2802 * have to coordinate with the init process, since all processes associated
2803 * with the current tty must be dead before the new getty is allowed
2804 * to spawn.
2805 *
2806 * Now, if it would be correct ;-/ The current code has a nasty hole -
2807 * it doesn't catch files in flight. We may send the descriptor to ourselves
2808 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2809 *
2810 * Nasty bug: do_SAK is being called in interrupt context.  This can
2811 * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2812 */
2813void __do_SAK(struct tty_struct *tty)
2814{
2815#ifdef TTY_SOFT_SAK
2816        tty_hangup(tty);
2817#else
2818        struct task_struct *g, *p;
2819        struct pid *session;
2820        int             i;
2821        struct file     *filp;
2822        struct fdtable *fdt;
2823
2824        if (!tty)
2825                return;
2826        session = tty->session;
2827
2828        tty_ldisc_flush(tty);
2829
2830        tty_driver_flush_buffer(tty);
2831
2832        read_lock(&tasklist_lock);
2833        /* Kill the entire session */
2834        do_each_pid_task(session, PIDTYPE_SID, p) {
2835                printk(KERN_NOTICE "SAK: killed process %d"
2836                        " (%s): task_session(p)==tty->session\n",
2837                        task_pid_nr(p), p->comm);
2838                send_sig(SIGKILL, p, 1);
2839        } while_each_pid_task(session, PIDTYPE_SID, p);
2840        /* Now kill any processes that happen to have the
2841         * tty open.
2842         */
2843        do_each_thread(g, p) {
2844                if (p->signal->tty == tty) {
2845                        printk(KERN_NOTICE "SAK: killed process %d"
2846                            " (%s): task_session(p)==tty->session\n",
2847                            task_pid_nr(p), p->comm);
2848                        send_sig(SIGKILL, p, 1);
2849                        continue;
2850                }
2851                task_lock(p);
2852                if (p->files) {
2853                        /*
2854                         * We don't take a ref to the file, so we must
2855                         * hold ->file_lock instead.
2856                         */
2857                        spin_lock(&p->files->file_lock);
2858                        fdt = files_fdtable(p->files);
2859                        for (i = 0; i < fdt->max_fds; i++) {
2860                                filp = fcheck_files(p->files, i);
2861                                if (!filp)
2862                                        continue;
2863                                if (filp->f_op->read == tty_read &&
2864                                    file_tty(filp) == tty) {
2865                                        printk(KERN_NOTICE "SAK: killed process %d"
2866                                            " (%s): fd#%d opened to the tty\n",
2867                                            task_pid_nr(p), p->comm, i);
2868                                        force_sig(SIGKILL, p);
2869                                        break;
2870                                }
2871                        }
2872                        spin_unlock(&p->files->file_lock);
2873                }
2874                task_unlock(p);
2875        } while_each_thread(g, p);
2876        read_unlock(&tasklist_lock);
2877#endif
2878}
2879
2880static void do_SAK_work(struct work_struct *work)
2881{
2882        struct tty_struct *tty =
2883                container_of(work, struct tty_struct, SAK_work);
2884        __do_SAK(tty);
2885}
2886
2887/*
2888 * The tq handling here is a little racy - tty->SAK_work may already be queued.
2889 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2890 * the values which we write to it will be identical to the values which it
2891 * already has. --akpm
2892 */
2893void do_SAK(struct tty_struct *tty)
2894{
2895        if (!tty)
2896                return;
2897        schedule_work(&tty->SAK_work);
2898}
2899
2900EXPORT_SYMBOL(do_SAK);
2901
2902static int dev_match_devt(struct device *dev, void *data)
2903{
2904        dev_t *devt = data;
2905        return dev->devt == *devt;
2906}
2907
2908/* Must put_device() after it's unused! */
2909static struct device *tty_get_device(struct tty_struct *tty)
2910{
2911        dev_t devt = tty_devnum(tty);
2912        return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2913}
2914
2915
2916/**
2917 *      initialize_tty_struct
2918 *      @tty: tty to initialize
2919 *
2920 *      This subroutine initializes a tty structure that has been newly
2921 *      allocated.
2922 *
2923 *      Locking: none - tty in question must not be exposed at this point
2924 */
2925
2926void initialize_tty_struct(struct tty_struct *tty,
2927                struct tty_driver *driver, int idx)
2928{
2929        memset(tty, 0, sizeof(struct tty_struct));
2930        kref_init(&tty->kref);
2931        tty->magic = TTY_MAGIC;
2932        tty_ldisc_init(tty);
2933        tty->session = NULL;
2934        tty->pgrp = NULL;
2935        tty->overrun_time = jiffies;
2936        tty_buffer_init(tty);
2937        mutex_init(&tty->termios_mutex);
2938        mutex_init(&tty->ldisc_mutex);
2939        init_waitqueue_head(&tty->write_wait);
2940        init_waitqueue_head(&tty->read_wait);
2941        INIT_WORK(&tty->hangup_work, do_tty_hangup);
2942        mutex_init(&tty->atomic_read_lock);
2943        mutex_init(&tty->atomic_write_lock);
2944        mutex_init(&tty->output_lock);
2945        mutex_init(&tty->echo_lock);
2946        spin_lock_init(&tty->read_lock);
2947        spin_lock_init(&tty->ctrl_lock);
2948        INIT_LIST_HEAD(&tty->tty_files);
2949        INIT_WORK(&tty->SAK_work, do_SAK_work);
2950
2951        tty->driver = driver;
2952        tty->ops = driver->ops;
2953        tty->index = idx;
2954        tty_line_name(driver, idx, tty->name);
2955        tty->dev = tty_get_device(tty);
2956}
2957
2958/**
2959 *      deinitialize_tty_struct
2960 *      @tty: tty to deinitialize
2961 *
2962 *      This subroutine deinitializes a tty structure that has been newly
2963 *      allocated but tty_release cannot be called on that yet.
2964 *
2965 *      Locking: none - tty in question must not be exposed at this point
2966 */
2967void deinitialize_tty_struct(struct tty_struct *tty)
2968{
2969        tty_ldisc_deinit(tty);
2970}
2971
2972/**
2973 *      tty_put_char    -       write one character to a tty
2974 *      @tty: tty
2975 *      @ch: character
2976 *
2977 *      Write one byte to the tty using the provided put_char method
2978 *      if present. Returns the number of characters successfully output.
2979 *
2980 *      Note: the specific put_char operation in the driver layer may go
2981 *      away soon. Don't call it directly, use this method
2982 */
2983
2984int tty_put_char(struct tty_struct *tty, unsigned char ch)
2985{
2986        if (tty->ops->put_char)
2987                return tty->ops->put_char(tty, ch);
2988        return tty->ops->write(tty, &ch, 1);
2989}
2990EXPORT_SYMBOL_GPL(tty_put_char);
2991
2992struct class *tty_class;
2993
2994/**
2995 *      tty_register_device - register a tty device
2996 *      @driver: the tty driver that describes the tty device
2997 *      @index: the index in the tty driver for this tty device
2998 *      @device: a struct device that is associated with this tty device.
2999 *              This field is optional, if there is no known struct device
3000 *              for this tty device it can be set to NULL safely.
3001 *
3002 *      Returns a pointer to the struct device for this tty device
3003 *      (or ERR_PTR(-EFOO) on error).
3004 *
3005 *      This call is required to be made to register an individual tty device
3006 *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3007 *      that bit is not set, this function should not be called by a tty
3008 *      driver.
3009 *
3010 *      Locking: ??
3011 */
3012
3013struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3014                                   struct device *device)
3015{
3016        char name[64];
3017        dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3018
3019        if (index >= driver->num) {
3020                printk(KERN_ERR "Attempt to register invalid tty line number "
3021                       " (%d).\n", index);
3022                return ERR_PTR(-EINVAL);
3023        }
3024
3025        if (driver->type == TTY_DRIVER_TYPE_PTY)
3026                pty_line_name(driver, index, name);
3027        else
3028                tty_line_name(driver, index, name);
3029
3030        return device_create(tty_class, device, dev, NULL, name);
3031}
3032EXPORT_SYMBOL(tty_register_device);
3033
3034/**
3035 *      tty_unregister_device - unregister a tty device
3036 *      @driver: the tty driver that describes the tty device
3037 *      @index: the index in the tty driver for this tty device
3038 *
3039 *      If a tty device is registered with a call to tty_register_device() then
3040 *      this function must be called when the tty device is gone.
3041 *
3042 *      Locking: ??
3043 */
3044
3045void tty_unregister_device(struct tty_driver *driver, unsigned index)
3046{
3047        device_destroy(tty_class,
3048                MKDEV(driver->major, driver->minor_start) + index);
3049}
3050EXPORT_SYMBOL(tty_unregister_device);
3051
3052struct tty_driver *__alloc_tty_driver(int lines, struct module *owner)
3053{
3054        struct tty_driver *driver;
3055
3056        driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3057        if (driver) {
3058                kref_init(&driver->kref);
3059                driver->magic = TTY_DRIVER_MAGIC;
3060                driver->num = lines;
3061                driver->owner = owner;
3062                /* later we'll move allocation of tables here */
3063        }
3064        return driver;
3065}
3066EXPORT_SYMBOL(__alloc_tty_driver);
3067
3068static void destruct_tty_driver(struct kref *kref)
3069{
3070        struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3071        int i;
3072        struct ktermios *tp;
3073        void *p;
3074
3075        if (driver->flags & TTY_DRIVER_INSTALLED) {
3076                /*
3077                 * Free the termios and termios_locked structures because
3078                 * we don't want to get memory leaks when modular tty
3079                 * drivers are removed from the kernel.
3080                 */
3081                for (i = 0; i < driver->num; i++) {
3082                        tp = driver->termios[i];
3083                        if (tp) {
3084                                driver->termios[i] = NULL;
3085                                kfree(tp);
3086                        }
3087                        if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3088                                tty_unregister_device(driver, i);
3089                }
3090                p = driver->ttys;
3091                proc_tty_unregister_driver(driver);
3092                driver->ttys = NULL;
3093                driver->termios = NULL;
3094                kfree(p);
3095                cdev_del(&driver->cdev);
3096        }
3097        kfree(driver);
3098}
3099
3100void tty_driver_kref_put(struct tty_driver *driver)
3101{
3102        kref_put(&driver->kref, destruct_tty_driver);
3103}
3104EXPORT_SYMBOL(tty_driver_kref_put);
3105
3106void tty_set_operations(struct tty_driver *driver,
3107                        const struct tty_operations *op)
3108{
3109        driver->ops = op;
3110};
3111EXPORT_SYMBOL(tty_set_operations);
3112
3113void put_tty_driver(struct tty_driver *d)
3114{
3115        tty_driver_kref_put(d);
3116}
3117EXPORT_SYMBOL(put_tty_driver);
3118
3119/*
3120 * Called by a tty driver to register itself.
3121 */
3122int tty_register_driver(struct tty_driver *driver)
3123{
3124        int error;
3125        int i;
3126        dev_t dev;
3127        void **p = NULL;
3128        struct device *d;
3129
3130        if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3131                p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
3132                if (!p)
3133                        return -ENOMEM;
3134        }
3135
3136        if (!driver->major) {
3137                error = alloc_chrdev_region(&dev, driver->minor_start,
3138                                                driver->num, driver->name);
3139                if (!error) {
3140                        driver->major = MAJOR(dev);
3141                        driver->minor_start = MINOR(dev);
3142                }
3143        } else {
3144                dev = MKDEV(driver->major, driver->minor_start);
3145                error = register_chrdev_region(dev, driver->num, driver->name);
3146        }
3147        if (error < 0) {
3148                kfree(p);
3149                return error;
3150        }
3151
3152        if (p) {
3153                driver->ttys = (struct tty_struct **)p;
3154                driver->termios = (struct ktermios **)(p + driver->num);
3155        } else {
3156                driver->ttys = NULL;
3157                driver->termios = NULL;
3158        }
3159
3160        cdev_init(&driver->cdev, &tty_fops);
3161        driver->cdev.owner = driver->owner;
3162        error = cdev_add(&driver->cdev, dev, driver->num);
3163        if (error) {
3164                unregister_chrdev_region(dev, driver->num);
3165                driver->ttys = NULL;
3166                driver->termios = NULL;
3167                kfree(p);
3168                return error;
3169        }
3170
3171        mutex_lock(&tty_mutex);
3172        list_add(&driver->tty_drivers, &tty_drivers);
3173        mutex_unlock(&tty_mutex);
3174
3175        if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3176                for (i = 0; i < driver->num; i++) {
3177                        d = tty_register_device(driver, i, NULL);
3178                        if (IS_ERR(d)) {
3179                                error = PTR_ERR(d);
3180                                goto err;
3181                        }
3182                }
3183        }
3184        proc_tty_register_driver(driver);
3185        driver->flags |= TTY_DRIVER_INSTALLED;
3186        return 0;
3187
3188err:
3189        for (i--; i >= 0; i--)
3190                tty_unregister_device(driver, i);
3191
3192        mutex_lock(&tty_mutex);
3193        list_del(&driver->tty_drivers);
3194        mutex_unlock(&tty_mutex);
3195
3196        unregister_chrdev_region(dev, driver->num);
3197        driver->ttys = NULL;
3198        driver->termios = NULL;
3199        kfree(p);
3200        return error;
3201}
3202
3203EXPORT_SYMBOL(tty_register_driver);
3204
3205/*
3206 * Called by a tty driver to unregister itself.
3207 */
3208int tty_unregister_driver(struct tty_driver *driver)
3209{
3210#if 0
3211        /* FIXME */
3212        if (driver->refcount)
3213                return -EBUSY;
3214#endif
3215        unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3216                                driver->num);
3217        mutex_lock(&tty_mutex);
3218        list_del(&driver->tty_drivers);
3219        mutex_unlock(&tty_mutex);
3220        return 0;
3221}
3222
3223EXPORT_SYMBOL(tty_unregister_driver);
3224
3225dev_t tty_devnum(struct tty_struct *tty)
3226{
3227        return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3228}
3229EXPORT_SYMBOL(tty_devnum);
3230
3231void proc_clear_tty(struct task_struct *p)
3232{
3233        unsigned long flags;
3234        struct tty_struct *tty;
3235        spin_lock_irqsave(&p->sighand->siglock, flags);
3236        tty = p->signal->tty;
3237        p->signal->tty = NULL;
3238        spin_unlock_irqrestore(&p->sighand->siglock, flags);
3239        tty_kref_put(tty);
3240}
3241
3242/* Called under the sighand lock */
3243
3244static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3245{
3246        if (tty) {
3247                unsigned long flags;
3248                /* We should not have a session or pgrp to put here but.... */
3249                spin_lock_irqsave(&tty->ctrl_lock, flags);
3250                put_pid(tty->session);
3251                put_pid(tty->pgrp);
3252                tty->pgrp = get_pid(task_pgrp(tsk));
3253                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3254                tty->session = get_pid(task_session(tsk));
3255                if (tsk->signal->tty) {
3256                        printk(KERN_DEBUG "tty not NULL!!\n");
3257                        tty_kref_put(tsk->signal->tty);
3258                }
3259        }
3260        put_pid(tsk->signal->tty_old_pgrp);
3261        tsk->signal->tty = tty_kref_get(tty);
3262        tsk->signal->tty_old_pgrp = NULL;
3263}
3264
3265static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3266{
3267        spin_lock_irq(&tsk->sighand->siglock);
3268        __proc_set_tty(tsk, tty);
3269        spin_unlock_irq(&tsk->sighand->siglock);
3270}
3271
3272struct tty_struct *get_current_tty(void)
3273{
3274        struct tty_struct *tty;
3275        unsigned long flags;
3276
3277        spin_lock_irqsave(&current->sighand->siglock, flags);
3278        tty = tty_kref_get(current->signal->tty);
3279        spin_unlock_irqrestore(&current->sighand->siglock, flags);
3280        return tty;
3281}
3282EXPORT_SYMBOL_GPL(get_current_tty);
3283
3284void tty_default_fops(struct file_operations *fops)
3285{
3286        *fops = tty_fops;
3287}
3288
3289/*
3290 * Initialize the console device. This is called *early*, so
3291 * we can't necessarily depend on lots of kernel help here.
3292 * Just do some early initializations, and do the complex setup
3293 * later.
3294 */
3295void __init console_init(void)
3296{
3297        initcall_t *call;
3298
3299        /* Setup the default TTY line discipline. */
3300        tty_ldisc_begin();
3301
3302        /*
3303         * set up the console device so that later boot sequences can
3304         * inform about problems etc..
3305         */
3306        call = __con_initcall_start;
3307        while (call < __con_initcall_end) {
3308                (*call)();
3309                call++;
3310        }
3311}
3312
3313static char *tty_devnode(struct device *dev, umode_t *mode)
3314{
3315        if (!mode)
3316                return NULL;
3317        if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3318            dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3319                *mode = 0666;
3320        return NULL;
3321}
3322
3323static int __init tty_class_init(void)
3324{
3325        tty_class = class_create(THIS_MODULE, "tty");
3326        if (IS_ERR(tty_class))
3327                return PTR_ERR(tty_class);
3328        tty_class->devnode = tty_devnode;
3329        return 0;
3330}
3331
3332postcore_initcall(tty_class_init);
3333
3334/* 3/2004 jmc: why do these devices exist? */
3335static struct cdev tty_cdev, console_cdev;
3336
3337static ssize_t show_cons_active(struct device *dev,
3338                                struct device_attribute *attr, char *buf)
3339{
3340        struct console *cs[16];
3341        int i = 0;
3342        struct console *c;
3343        ssize_t count = 0;
3344
3345        console_lock();
3346        for_each_console(c) {
3347                if (!c->device)
3348                        continue;
3349                if (!c->write)
3350                        continue;
3351                if ((c->flags & CON_ENABLED) == 0)
3352                        continue;
3353                cs[i++] = c;
3354                if (i >= ARRAY_SIZE(cs))
3355                        break;
3356        }
3357        while (i--)
3358                count += sprintf(buf + count, "%s%d%c",
3359                                 cs[i]->name, cs[i]->index, i ? ' ':'\n');
3360        console_unlock();
3361
3362        return count;
3363}
3364static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3365
3366static struct device *consdev;
3367
3368void console_sysfs_notify(void)
3369{
3370        if (consdev)
3371                sysfs_notify(&consdev->kobj, NULL, "active");
3372}
3373
3374/*
3375 * Ok, now we can initialize the rest of the tty devices and can count
3376 * on memory allocations, interrupts etc..
3377 */
3378int __init tty_init(void)
3379{
3380        cdev_init(&tty_cdev, &tty_fops);
3381        if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3382            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3383                panic("Couldn't register /dev/tty driver\n");
3384        device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3385
3386        cdev_init(&console_cdev, &console_fops);
3387        if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3388            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3389                panic("Couldn't register /dev/console driver\n");
3390        consdev = device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3391                              "console");
3392        if (IS_ERR(consdev))
3393                consdev = NULL;
3394        else
3395                WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
3396
3397#ifdef CONFIG_VT
3398        vty_init(&console_fops);
3399#endif
3400        return 0;
3401}
3402
3403
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.