Merge remote-tracking branch 'lsk/v3.10/topic/arm64-hugepages' into linux-linaro-lsk
[firefly-linux-kernel-4.4.55.git] / drivers / tty / tty_io.c
1 /*
2  *  Copyright (C) 1991, 1992  Linus Torvalds
3  */
4
5 /*
6  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7  * or rs-channels. It also implements echoing, cooked mode etc.
8  *
9  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10  *
11  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12  * tty_struct and tty_queue structures.  Previously there was an array
13  * of 256 tty_struct's which was statically allocated, and the
14  * tty_queue structures were allocated at boot time.  Both are now
15  * dynamically allocated only when the tty is open.
16  *
17  * Also restructured routines so that there is more of a separation
18  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19  * the low-level tty routines (serial.c, pty.c, console.c).  This
20  * makes for cleaner and more compact code.  -TYT, 9/17/92
21  *
22  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23  * which can be dynamically activated and de-activated by the line
24  * discipline handling modules (like SLIP).
25  *
26  * NOTE: pay no attention to the line discipline code (yet); its
27  * interface is still subject to change in this version...
28  * -- TYT, 1/31/92
29  *
30  * Added functionality to the OPOST tty handling.  No delays, but all
31  * other bits should be there.
32  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33  *
34  * Rewrote canonical mode and added more termios flags.
35  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36  *
37  * Reorganized FASYNC support so mouse code can share it.
38  *      -- ctm@ardi.com, 9Sep95
39  *
40  * New TIOCLINUX variants added.
41  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
42  *
43  * Restrict vt switching via ioctl()
44  *      -- grif@cs.ucr.edu, 5-Dec-95
45  *
46  * Move console and virtual terminal code to more appropriate files,
47  * implement CONFIG_VT and generalize console device interface.
48  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49  *
50  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51  *      -- Bill Hawes <whawes@star.net>, June 97
52  *
53  * Added devfs support.
54  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55  *
56  * Added support for a Unix98-style ptmx device.
57  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58  *
59  * Reduced memory usage for older ARM systems
60  *      -- Russell King <rmk@arm.linux.org.uk>
61  *
62  * Move do_SAK() into process context.  Less stack use in devfs functions.
63  * alloc_tty_struct() always uses kmalloc()
64  *                       -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65  */
66
67 #include <linux/types.h>
68 #include <linux/major.h>
69 #include <linux/errno.h>
70 #include <linux/signal.h>
71 #include <linux/fcntl.h>
72 #include <linux/sched.h>
73 #include <linux/interrupt.h>
74 #include <linux/tty.h>
75 #include <linux/tty_driver.h>
76 #include <linux/tty_flip.h>
77 #include <linux/devpts_fs.h>
78 #include <linux/file.h>
79 #include <linux/fdtable.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/device.h>
92 #include <linux/wait.h>
93 #include <linux/bitops.h>
94 #include <linux/delay.h>
95 #include <linux/seq_file.h>
96 #include <linux/serial.h>
97 #include <linux/ratelimit.h>
98
99 #include <linux/uaccess.h>
100
101 #include <linux/kbd_kern.h>
102 #include <linux/vt_kern.h>
103 #include <linux/selection.h>
104
105 #include <linux/kmod.h>
106 #include <linux/nsproxy.h>
107
108 #undef TTY_DEBUG_HANGUP
109
110 #define TTY_PARANOIA_CHECK 1
111 #define CHECK_TTY_COUNT 1
112
113 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
114         .c_iflag = ICRNL | IXON,
115         .c_oflag = OPOST | ONLCR,
116         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
117         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
118                    ECHOCTL | ECHOKE | IEXTEN,
119         .c_cc = INIT_C_CC,
120         .c_ispeed = 38400,
121         .c_ospeed = 38400
122 };
123
124 EXPORT_SYMBOL(tty_std_termios);
125
126 /* This list gets poked at by procfs and various bits of boot up code. This
127    could do with some rationalisation such as pulling the tty proc function
128    into this file */
129
130 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
131
132 /* Mutex to protect creating and releasing a tty. This is shared with
133    vt.c for deeply disgusting hack reasons */
134 DEFINE_MUTEX(tty_mutex);
135 EXPORT_SYMBOL(tty_mutex);
136
137 /* Spinlock to protect the tty->tty_files list */
138 DEFINE_SPINLOCK(tty_files_lock);
139
140 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
141 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
142 ssize_t redirected_tty_write(struct file *, const char __user *,
143                                                         size_t, loff_t *);
144 static unsigned int tty_poll(struct file *, poll_table *);
145 static int tty_open(struct inode *, struct file *);
146 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
147 #ifdef CONFIG_COMPAT
148 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
149                                 unsigned long arg);
150 #else
151 #define tty_compat_ioctl NULL
152 #endif
153 static int __tty_fasync(int fd, struct file *filp, int on);
154 static int tty_fasync(int fd, struct file *filp, int on);
155 static void release_tty(struct tty_struct *tty, int idx);
156 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158
159 /**
160  *      alloc_tty_struct        -       allocate a tty object
161  *
162  *      Return a new empty tty structure. The data fields have not
163  *      been initialized in any way but has been zeroed
164  *
165  *      Locking: none
166  */
167
168 struct tty_struct *alloc_tty_struct(void)
169 {
170         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
171 }
172
173 /**
174  *      free_tty_struct         -       free a disused tty
175  *      @tty: tty struct to free
176  *
177  *      Free the write buffers, tty queue and tty memory itself.
178  *
179  *      Locking: none. Must be called after tty is definitely unused
180  */
181
182 void free_tty_struct(struct tty_struct *tty)
183 {
184         if (!tty)
185                 return;
186         if (tty->dev)
187                 put_device(tty->dev);
188         kfree(tty->write_buf);
189         tty->magic = 0xDEADDEAD;
190         kfree(tty);
191 }
192
193 static inline struct tty_struct *file_tty(struct file *file)
194 {
195         return ((struct tty_file_private *)file->private_data)->tty;
196 }
197
198 int tty_alloc_file(struct file *file)
199 {
200         struct tty_file_private *priv;
201
202         priv = kmalloc(sizeof(*priv), GFP_KERNEL);
203         if (!priv)
204                 return -ENOMEM;
205
206         file->private_data = priv;
207
208         return 0;
209 }
210
211 /* Associate a new file with the tty structure */
212 void tty_add_file(struct tty_struct *tty, struct file *file)
213 {
214         struct tty_file_private *priv = file->private_data;
215
216         priv->tty = tty;
217         priv->file = file;
218
219         spin_lock(&tty_files_lock);
220         list_add(&priv->list, &tty->tty_files);
221         spin_unlock(&tty_files_lock);
222 }
223
224 /**
225  * tty_free_file - free file->private_data
226  *
227  * This shall be used only for fail path handling when tty_add_file was not
228  * called yet.
229  */
230 void tty_free_file(struct file *file)
231 {
232         struct tty_file_private *priv = file->private_data;
233
234         file->private_data = NULL;
235         kfree(priv);
236 }
237
238 /* Delete file from its tty */
239 static void tty_del_file(struct file *file)
240 {
241         struct tty_file_private *priv = file->private_data;
242
243         spin_lock(&tty_files_lock);
244         list_del(&priv->list);
245         spin_unlock(&tty_files_lock);
246         tty_free_file(file);
247 }
248
249
250 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
251
252 /**
253  *      tty_name        -       return tty naming
254  *      @tty: tty structure
255  *      @buf: buffer for output
256  *
257  *      Convert a tty structure into a name. The name reflects the kernel
258  *      naming policy and if udev is in use may not reflect user space
259  *
260  *      Locking: none
261  */
262
263 char *tty_name(struct tty_struct *tty, char *buf)
264 {
265         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
266                 strcpy(buf, "NULL tty");
267         else
268                 strcpy(buf, tty->name);
269         return buf;
270 }
271
272 EXPORT_SYMBOL(tty_name);
273
274 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
275                               const char *routine)
276 {
277 #ifdef TTY_PARANOIA_CHECK
278         if (!tty) {
279                 printk(KERN_WARNING
280                         "null TTY for (%d:%d) in %s\n",
281                         imajor(inode), iminor(inode), routine);
282                 return 1;
283         }
284         if (tty->magic != TTY_MAGIC) {
285                 printk(KERN_WARNING
286                         "bad magic number for tty struct (%d:%d) in %s\n",
287                         imajor(inode), iminor(inode), routine);
288                 return 1;
289         }
290 #endif
291         return 0;
292 }
293
294 static int check_tty_count(struct tty_struct *tty, const char *routine)
295 {
296 #ifdef CHECK_TTY_COUNT
297         struct list_head *p;
298         int count = 0;
299
300         spin_lock(&tty_files_lock);
301         list_for_each(p, &tty->tty_files) {
302                 count++;
303         }
304         spin_unlock(&tty_files_lock);
305         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
306             tty->driver->subtype == PTY_TYPE_SLAVE &&
307             tty->link && tty->link->count)
308                 count++;
309         if (tty->count != count) {
310                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
311                                     "!= #fd's(%d) in %s\n",
312                        tty->name, tty->count, count, routine);
313                 return count;
314         }
315 #endif
316         return 0;
317 }
318
319 /**
320  *      get_tty_driver          -       find device of a tty
321  *      @dev_t: device identifier
322  *      @index: returns the index of the tty
323  *
324  *      This routine returns a tty driver structure, given a device number
325  *      and also passes back the index number.
326  *
327  *      Locking: caller must hold tty_mutex
328  */
329
330 static struct tty_driver *get_tty_driver(dev_t device, int *index)
331 {
332         struct tty_driver *p;
333
334         list_for_each_entry(p, &tty_drivers, tty_drivers) {
335                 dev_t base = MKDEV(p->major, p->minor_start);
336                 if (device < base || device >= base + p->num)
337                         continue;
338                 *index = device - base;
339                 return tty_driver_kref_get(p);
340         }
341         return NULL;
342 }
343
344 #ifdef CONFIG_CONSOLE_POLL
345
346 /**
347  *      tty_find_polling_driver -       find device of a polled tty
348  *      @name: name string to match
349  *      @line: pointer to resulting tty line nr
350  *
351  *      This routine returns a tty driver structure, given a name
352  *      and the condition that the tty driver is capable of polled
353  *      operation.
354  */
355 struct tty_driver *tty_find_polling_driver(char *name, int *line)
356 {
357         struct tty_driver *p, *res = NULL;
358         int tty_line = 0;
359         int len;
360         char *str, *stp;
361
362         for (str = name; *str; str++)
363                 if ((*str >= '0' && *str <= '9') || *str == ',')
364                         break;
365         if (!*str)
366                 return NULL;
367
368         len = str - name;
369         tty_line = simple_strtoul(str, &str, 10);
370
371         mutex_lock(&tty_mutex);
372         /* Search through the tty devices to look for a match */
373         list_for_each_entry(p, &tty_drivers, tty_drivers) {
374                 if (strncmp(name, p->name, len) != 0)
375                         continue;
376                 stp = str;
377                 if (*stp == ',')
378                         stp++;
379                 if (*stp == '\0')
380                         stp = NULL;
381
382                 if (tty_line >= 0 && tty_line < p->num && p->ops &&
383                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
384                         res = tty_driver_kref_get(p);
385                         *line = tty_line;
386                         break;
387                 }
388         }
389         mutex_unlock(&tty_mutex);
390
391         return res;
392 }
393 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
394 #endif
395
396 /**
397  *      tty_check_change        -       check for POSIX terminal changes
398  *      @tty: tty to check
399  *
400  *      If we try to write to, or set the state of, a terminal and we're
401  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
402  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
403  *
404  *      Locking: ctrl_lock
405  */
406
407 int tty_check_change(struct tty_struct *tty)
408 {
409         unsigned long flags;
410         int ret = 0;
411
412         if (current->signal->tty != tty)
413                 return 0;
414
415         spin_lock_irqsave(&tty->ctrl_lock, flags);
416
417         if (!tty->pgrp) {
418                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
419                 goto out_unlock;
420         }
421         if (task_pgrp(current) == tty->pgrp)
422                 goto out_unlock;
423         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
424         if (is_ignored(SIGTTOU))
425                 goto out;
426         if (is_current_pgrp_orphaned()) {
427                 ret = -EIO;
428                 goto out;
429         }
430         kill_pgrp(task_pgrp(current), SIGTTOU, 1);
431         set_thread_flag(TIF_SIGPENDING);
432         ret = -ERESTARTSYS;
433 out:
434         return ret;
435 out_unlock:
436         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
437         return ret;
438 }
439
440 EXPORT_SYMBOL(tty_check_change);
441
442 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
443                                 size_t count, loff_t *ppos)
444 {
445         return 0;
446 }
447
448 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
449                                  size_t count, loff_t *ppos)
450 {
451         return -EIO;
452 }
453
454 /* No kernel lock held - none needed ;) */
455 static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
456 {
457         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
458 }
459
460 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
461                 unsigned long arg)
462 {
463         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
464 }
465
466 static long hung_up_tty_compat_ioctl(struct file *file,
467                                      unsigned int cmd, unsigned long arg)
468 {
469         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
470 }
471
472 static const struct file_operations tty_fops = {
473         .llseek         = no_llseek,
474         .read           = tty_read,
475         .write          = tty_write,
476         .poll           = tty_poll,
477         .unlocked_ioctl = tty_ioctl,
478         .compat_ioctl   = tty_compat_ioctl,
479         .open           = tty_open,
480         .release        = tty_release,
481         .fasync         = tty_fasync,
482 };
483
484 static const struct file_operations console_fops = {
485         .llseek         = no_llseek,
486         .read           = tty_read,
487         .write          = redirected_tty_write,
488         .poll           = tty_poll,
489         .unlocked_ioctl = tty_ioctl,
490         .compat_ioctl   = tty_compat_ioctl,
491         .open           = tty_open,
492         .release        = tty_release,
493         .fasync         = tty_fasync,
494 };
495
496 static const struct file_operations hung_up_tty_fops = {
497         .llseek         = no_llseek,
498         .read           = hung_up_tty_read,
499         .write          = hung_up_tty_write,
500         .poll           = hung_up_tty_poll,
501         .unlocked_ioctl = hung_up_tty_ioctl,
502         .compat_ioctl   = hung_up_tty_compat_ioctl,
503         .release        = tty_release,
504 };
505
506 static DEFINE_SPINLOCK(redirect_lock);
507 static struct file *redirect;
508
509 /**
510  *      tty_wakeup      -       request more data
511  *      @tty: terminal
512  *
513  *      Internal and external helper for wakeups of tty. This function
514  *      informs the line discipline if present that the driver is ready
515  *      to receive more output data.
516  */
517
518 void tty_wakeup(struct tty_struct *tty)
519 {
520         struct tty_ldisc *ld;
521
522         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
523                 ld = tty_ldisc_ref(tty);
524                 if (ld) {
525                         if (ld->ops->write_wakeup)
526                                 ld->ops->write_wakeup(tty);
527                         tty_ldisc_deref(ld);
528                 }
529         }
530         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
531 }
532
533 EXPORT_SYMBOL_GPL(tty_wakeup);
534
535 /**
536  *      tty_signal_session_leader       - sends SIGHUP to session leader
537  *      @tty            controlling tty
538  *      @exit_session   if non-zero, signal all foreground group processes
539  *
540  *      Send SIGHUP and SIGCONT to the session leader and its process group.
541  *      Optionally, signal all processes in the foreground process group.
542  *
543  *      Returns the number of processes in the session with this tty
544  *      as their controlling terminal. This value is used to drop
545  *      tty references for those processes.
546  */
547 static int tty_signal_session_leader(struct tty_struct *tty, int exit_session)
548 {
549         struct task_struct *p;
550         int refs = 0;
551         struct pid *tty_pgrp = NULL;
552
553         read_lock(&tasklist_lock);
554         if (tty->session) {
555                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
556                         spin_lock_irq(&p->sighand->siglock);
557                         if (p->signal->tty == tty) {
558                                 p->signal->tty = NULL;
559                                 /* We defer the dereferences outside fo
560                                    the tasklist lock */
561                                 refs++;
562                         }
563                         if (!p->signal->leader) {
564                                 spin_unlock_irq(&p->sighand->siglock);
565                                 continue;
566                         }
567                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
568                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
569                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
570                         spin_lock(&tty->ctrl_lock);
571                         tty_pgrp = get_pid(tty->pgrp);
572                         if (tty->pgrp)
573                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
574                         spin_unlock(&tty->ctrl_lock);
575                         spin_unlock_irq(&p->sighand->siglock);
576                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
577         }
578         read_unlock(&tasklist_lock);
579
580         if (tty_pgrp) {
581                 if (exit_session)
582                         kill_pgrp(tty_pgrp, SIGHUP, exit_session);
583                 put_pid(tty_pgrp);
584         }
585
586         return refs;
587 }
588
589 /**
590  *      __tty_hangup            -       actual handler for hangup events
591  *      @work: tty device
592  *
593  *      This can be called by a "kworker" kernel thread.  That is process
594  *      synchronous but doesn't hold any locks, so we need to make sure we
595  *      have the appropriate locks for what we're doing.
596  *
597  *      The hangup event clears any pending redirections onto the hung up
598  *      device. It ensures future writes will error and it does the needed
599  *      line discipline hangup and signal delivery. The tty object itself
600  *      remains intact.
601  *
602  *      Locking:
603  *              BTM
604  *                redirect lock for undoing redirection
605  *                file list lock for manipulating list of ttys
606  *                tty_ldisc_lock from called functions
607  *                termios_mutex resetting termios data
608  *                tasklist_lock to walk task list for hangup event
609  *                  ->siglock to protect ->signal/->sighand
610  */
611 static void __tty_hangup(struct tty_struct *tty, int exit_session)
612 {
613         struct file *cons_filp = NULL;
614         struct file *filp, *f = NULL;
615         struct tty_file_private *priv;
616         int    closecount = 0, n;
617         int refs;
618
619         if (!tty)
620                 return;
621
622
623         spin_lock(&redirect_lock);
624         if (redirect && file_tty(redirect) == tty) {
625                 f = redirect;
626                 redirect = NULL;
627         }
628         spin_unlock(&redirect_lock);
629
630         tty_lock(tty);
631
632         /* some functions below drop BTM, so we need this bit */
633         set_bit(TTY_HUPPING, &tty->flags);
634
635         /* inuse_filps is protected by the single tty lock,
636            this really needs to change if we want to flush the
637            workqueue with the lock held */
638         check_tty_count(tty, "tty_hangup");
639
640         spin_lock(&tty_files_lock);
641         /* This breaks for file handles being sent over AF_UNIX sockets ? */
642         list_for_each_entry(priv, &tty->tty_files, list) {
643                 filp = priv->file;
644                 if (filp->f_op->write == redirected_tty_write)
645                         cons_filp = filp;
646                 if (filp->f_op->write != tty_write)
647                         continue;
648                 closecount++;
649                 __tty_fasync(-1, filp, 0);      /* can't block */
650                 filp->f_op = &hung_up_tty_fops;
651         }
652         spin_unlock(&tty_files_lock);
653
654         refs = tty_signal_session_leader(tty, exit_session);
655         /* Account for the p->signal references we killed */
656         while (refs--)
657                 tty_kref_put(tty);
658
659         /*
660          * it drops BTM and thus races with reopen
661          * we protect the race by TTY_HUPPING
662          */
663         tty_ldisc_hangup(tty);
664
665         spin_lock_irq(&tty->ctrl_lock);
666         clear_bit(TTY_THROTTLED, &tty->flags);
667         clear_bit(TTY_PUSH, &tty->flags);
668         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
669         put_pid(tty->session);
670         put_pid(tty->pgrp);
671         tty->session = NULL;
672         tty->pgrp = NULL;
673         tty->ctrl_status = 0;
674         spin_unlock_irq(&tty->ctrl_lock);
675
676         /*
677          * If one of the devices matches a console pointer, we
678          * cannot just call hangup() because that will cause
679          * tty->count and state->count to go out of sync.
680          * So we just call close() the right number of times.
681          */
682         if (cons_filp) {
683                 if (tty->ops->close)
684                         for (n = 0; n < closecount; n++)
685                                 tty->ops->close(tty, cons_filp);
686         } else if (tty->ops->hangup)
687                 (tty->ops->hangup)(tty);
688         /*
689          * We don't want to have driver/ldisc interactions beyond
690          * the ones we did here. The driver layer expects no
691          * calls after ->hangup() from the ldisc side. However we
692          * can't yet guarantee all that.
693          */
694         set_bit(TTY_HUPPED, &tty->flags);
695         clear_bit(TTY_HUPPING, &tty->flags);
696
697         tty_unlock(tty);
698
699         if (f)
700                 fput(f);
701 }
702
703 static void do_tty_hangup(struct work_struct *work)
704 {
705         struct tty_struct *tty =
706                 container_of(work, struct tty_struct, hangup_work);
707
708         __tty_hangup(tty, 0);
709 }
710
711 /**
712  *      tty_hangup              -       trigger a hangup event
713  *      @tty: tty to hangup
714  *
715  *      A carrier loss (virtual or otherwise) has occurred on this like
716  *      schedule a hangup sequence to run after this event.
717  */
718
719 void tty_hangup(struct tty_struct *tty)
720 {
721 #ifdef TTY_DEBUG_HANGUP
722         char    buf[64];
723         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
724 #endif
725         schedule_work(&tty->hangup_work);
726 }
727
728 EXPORT_SYMBOL(tty_hangup);
729
730 /**
731  *      tty_vhangup             -       process vhangup
732  *      @tty: tty to hangup
733  *
734  *      The user has asked via system call for the terminal to be hung up.
735  *      We do this synchronously so that when the syscall returns the process
736  *      is complete. That guarantee is necessary for security reasons.
737  */
738
739 void tty_vhangup(struct tty_struct *tty)
740 {
741 #ifdef TTY_DEBUG_HANGUP
742         char    buf[64];
743
744         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
745 #endif
746         __tty_hangup(tty, 0);
747 }
748
749 EXPORT_SYMBOL(tty_vhangup);
750
751
752 /**
753  *      tty_vhangup_self        -       process vhangup for own ctty
754  *
755  *      Perform a vhangup on the current controlling tty
756  */
757
758 void tty_vhangup_self(void)
759 {
760         struct tty_struct *tty;
761
762         tty = get_current_tty();
763         if (tty) {
764                 tty_vhangup(tty);
765                 tty_kref_put(tty);
766         }
767 }
768
769 /**
770  *      tty_vhangup_session             -       hangup session leader exit
771  *      @tty: tty to hangup
772  *
773  *      The session leader is exiting and hanging up its controlling terminal.
774  *      Every process in the foreground process group is signalled SIGHUP.
775  *
776  *      We do this synchronously so that when the syscall returns the process
777  *      is complete. That guarantee is necessary for security reasons.
778  */
779
780 static void tty_vhangup_session(struct tty_struct *tty)
781 {
782 #ifdef TTY_DEBUG_HANGUP
783         char    buf[64];
784
785         printk(KERN_DEBUG "%s vhangup session...\n", tty_name(tty, buf));
786 #endif
787         __tty_hangup(tty, 1);
788 }
789
790 /**
791  *      tty_hung_up_p           -       was tty hung up
792  *      @filp: file pointer of tty
793  *
794  *      Return true if the tty has been subject to a vhangup or a carrier
795  *      loss
796  */
797
798 int tty_hung_up_p(struct file *filp)
799 {
800         return (filp->f_op == &hung_up_tty_fops);
801 }
802
803 EXPORT_SYMBOL(tty_hung_up_p);
804
805 static void session_clear_tty(struct pid *session)
806 {
807         struct task_struct *p;
808         do_each_pid_task(session, PIDTYPE_SID, p) {
809                 proc_clear_tty(p);
810         } while_each_pid_task(session, PIDTYPE_SID, p);
811 }
812
813 /**
814  *      disassociate_ctty       -       disconnect controlling tty
815  *      @on_exit: true if exiting so need to "hang up" the session
816  *
817  *      This function is typically called only by the session leader, when
818  *      it wants to disassociate itself from its controlling tty.
819  *
820  *      It performs the following functions:
821  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
822  *      (2)  Clears the tty from being controlling the session
823  *      (3)  Clears the controlling tty for all processes in the
824  *              session group.
825  *
826  *      The argument on_exit is set to 1 if called when a process is
827  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
828  *
829  *      Locking:
830  *              BTM is taken for hysterical raisins, and held when
831  *                called from no_tty().
832  *                tty_mutex is taken to protect tty
833  *                ->siglock is taken to protect ->signal/->sighand
834  *                tasklist_lock is taken to walk process list for sessions
835  *                  ->siglock is taken to protect ->signal/->sighand
836  */
837
838 void disassociate_ctty(int on_exit)
839 {
840         struct tty_struct *tty;
841
842         if (!current->signal->leader)
843                 return;
844
845         tty = get_current_tty();
846         if (tty) {
847                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY) {
848                         tty_vhangup_session(tty);
849                 } else {
850                         struct pid *tty_pgrp = tty_get_pgrp(tty);
851                         if (tty_pgrp) {
852                                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
853                                 if (!on_exit)
854                                         kill_pgrp(tty_pgrp, SIGCONT, on_exit);
855                                 put_pid(tty_pgrp);
856                         }
857                 }
858                 tty_kref_put(tty);
859
860         } else if (on_exit) {
861                 struct pid *old_pgrp;
862                 spin_lock_irq(&current->sighand->siglock);
863                 old_pgrp = current->signal->tty_old_pgrp;
864                 current->signal->tty_old_pgrp = NULL;
865                 spin_unlock_irq(&current->sighand->siglock);
866                 if (old_pgrp) {
867                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
868                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
869                         put_pid(old_pgrp);
870                 }
871                 return;
872         }
873
874         spin_lock_irq(&current->sighand->siglock);
875         put_pid(current->signal->tty_old_pgrp);
876         current->signal->tty_old_pgrp = NULL;
877         spin_unlock_irq(&current->sighand->siglock);
878
879         tty = get_current_tty();
880         if (tty) {
881                 unsigned long flags;
882                 spin_lock_irqsave(&tty->ctrl_lock, flags);
883                 put_pid(tty->session);
884                 put_pid(tty->pgrp);
885                 tty->session = NULL;
886                 tty->pgrp = NULL;
887                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
888                 tty_kref_put(tty);
889         } else {
890 #ifdef TTY_DEBUG_HANGUP
891                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
892                        " = NULL", tty);
893 #endif
894         }
895
896         /* Now clear signal->tty under the lock */
897         read_lock(&tasklist_lock);
898         session_clear_tty(task_session(current));
899         read_unlock(&tasklist_lock);
900 }
901
902 /**
903  *
904  *      no_tty  - Ensure the current process does not have a controlling tty
905  */
906 void no_tty(void)
907 {
908         /* FIXME: Review locking here. The tty_lock never covered any race
909            between a new association and proc_clear_tty but possible we need
910            to protect against this anyway */
911         struct task_struct *tsk = current;
912         disassociate_ctty(0);
913         proc_clear_tty(tsk);
914 }
915
916
917 /**
918  *      stop_tty        -       propagate flow control
919  *      @tty: tty to stop
920  *
921  *      Perform flow control to the driver. For PTY/TTY pairs we
922  *      must also propagate the TIOCKPKT status. May be called
923  *      on an already stopped device and will not re-call the driver
924  *      method.
925  *
926  *      This functionality is used by both the line disciplines for
927  *      halting incoming flow and by the driver. It may therefore be
928  *      called from any context, may be under the tty atomic_write_lock
929  *      but not always.
930  *
931  *      Locking:
932  *              Uses the tty control lock internally
933  */
934
935 void stop_tty(struct tty_struct *tty)
936 {
937         unsigned long flags;
938         spin_lock_irqsave(&tty->ctrl_lock, flags);
939         if (tty->stopped) {
940                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
941                 return;
942         }
943         tty->stopped = 1;
944         if (tty->link && tty->link->packet) {
945                 tty->ctrl_status &= ~TIOCPKT_START;
946                 tty->ctrl_status |= TIOCPKT_STOP;
947                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
948         }
949         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
950         if (tty->ops->stop)
951                 (tty->ops->stop)(tty);
952 }
953
954 EXPORT_SYMBOL(stop_tty);
955
956 /**
957  *      start_tty       -       propagate flow control
958  *      @tty: tty to start
959  *
960  *      Start a tty that has been stopped if at all possible. Perform
961  *      any necessary wakeups and propagate the TIOCPKT status. If this
962  *      is the tty was previous stopped and is being started then the
963  *      driver start method is invoked and the line discipline woken.
964  *
965  *      Locking:
966  *              ctrl_lock
967  */
968
969 void start_tty(struct tty_struct *tty)
970 {
971         unsigned long flags;
972         spin_lock_irqsave(&tty->ctrl_lock, flags);
973         if (!tty->stopped || tty->flow_stopped) {
974                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
975                 return;
976         }
977         tty->stopped = 0;
978         if (tty->link && tty->link->packet) {
979                 tty->ctrl_status &= ~TIOCPKT_STOP;
980                 tty->ctrl_status |= TIOCPKT_START;
981                 wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
982         }
983         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
984         if (tty->ops->start)
985                 (tty->ops->start)(tty);
986         /* If we have a running line discipline it may need kicking */
987         tty_wakeup(tty);
988 }
989
990 EXPORT_SYMBOL(start_tty);
991
992 /* We limit tty time update visibility to every 8 seconds or so. */
993 static void tty_update_time(struct timespec *time)
994 {
995         unsigned long sec = get_seconds() & ~7;
996         if ((long)(sec - time->tv_sec) > 0)
997                 time->tv_sec = sec;
998 }
999
1000 /**
1001  *      tty_read        -       read method for tty device files
1002  *      @file: pointer to tty file
1003  *      @buf: user buffer
1004  *      @count: size of user buffer
1005  *      @ppos: unused
1006  *
1007  *      Perform the read system call function on this terminal device. Checks
1008  *      for hung up devices before calling the line discipline method.
1009  *
1010  *      Locking:
1011  *              Locks the line discipline internally while needed. Multiple
1012  *      read calls may be outstanding in parallel.
1013  */
1014
1015 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
1016                         loff_t *ppos)
1017 {
1018         int i;
1019         struct inode *inode = file_inode(file);
1020         struct tty_struct *tty = file_tty(file);
1021         struct tty_ldisc *ld;
1022
1023         if (tty_paranoia_check(tty, inode, "tty_read"))
1024                 return -EIO;
1025         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1026                 return -EIO;
1027
1028         /* We want to wait for the line discipline to sort out in this
1029            situation */
1030         ld = tty_ldisc_ref_wait(tty);
1031         if (ld->ops->read)
1032                 i = (ld->ops->read)(tty, file, buf, count);
1033         else
1034                 i = -EIO;
1035         tty_ldisc_deref(ld);
1036
1037         if (i > 0)
1038                 tty_update_time(&inode->i_atime);
1039
1040         return i;
1041 }
1042
1043 void tty_write_unlock(struct tty_struct *tty)
1044         __releases(&tty->atomic_write_lock)
1045 {
1046         mutex_unlock(&tty->atomic_write_lock);
1047         wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
1048 }
1049
1050 int tty_write_lock(struct tty_struct *tty, int ndelay)
1051         __acquires(&tty->atomic_write_lock)
1052 {
1053         if (!mutex_trylock(&tty->atomic_write_lock)) {
1054                 if (ndelay)
1055                         return -EAGAIN;
1056                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
1057                         return -ERESTARTSYS;
1058         }
1059         return 0;
1060 }
1061
1062 /*
1063  * Split writes up in sane blocksizes to avoid
1064  * denial-of-service type attacks
1065  */
1066 static inline ssize_t do_tty_write(
1067         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1068         struct tty_struct *tty,
1069         struct file *file,
1070         const char __user *buf,
1071         size_t count)
1072 {
1073         ssize_t ret, written = 0;
1074         unsigned int chunk;
1075
1076         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1077         if (ret < 0)
1078                 return ret;
1079
1080         /*
1081          * We chunk up writes into a temporary buffer. This
1082          * simplifies low-level drivers immensely, since they
1083          * don't have locking issues and user mode accesses.
1084          *
1085          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1086          * big chunk-size..
1087          *
1088          * The default chunk-size is 2kB, because the NTTY
1089          * layer has problems with bigger chunks. It will
1090          * claim to be able to handle more characters than
1091          * it actually does.
1092          *
1093          * FIXME: This can probably go away now except that 64K chunks
1094          * are too likely to fail unless switched to vmalloc...
1095          */
1096         chunk = 2048;
1097         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1098                 chunk = 65536;
1099         if (count < chunk)
1100                 chunk = count;
1101
1102         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1103         if (tty->write_cnt < chunk) {
1104                 unsigned char *buf_chunk;
1105
1106                 if (chunk < 1024)
1107                         chunk = 1024;
1108
1109                 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1110                 if (!buf_chunk) {
1111                         ret = -ENOMEM;
1112                         goto out;
1113                 }
1114                 kfree(tty->write_buf);
1115                 tty->write_cnt = chunk;
1116                 tty->write_buf = buf_chunk;
1117         }
1118
1119         /* Do the write .. */
1120         for (;;) {
1121                 size_t size = count;
1122                 if (size > chunk)
1123                         size = chunk;
1124                 ret = -EFAULT;
1125                 if (copy_from_user(tty->write_buf, buf, size))
1126                         break;
1127                 ret = write(tty, file, tty->write_buf, size);
1128                 if (ret <= 0)
1129                         break;
1130                 written += ret;
1131                 buf += ret;
1132                 count -= ret;
1133                 if (!count)
1134                         break;
1135                 ret = -ERESTARTSYS;
1136                 if (signal_pending(current))
1137                         break;
1138                 cond_resched();
1139         }
1140         if (written) {
1141                 tty_update_time(&file_inode(file)->i_mtime);
1142                 ret = written;
1143         }
1144 out:
1145         tty_write_unlock(tty);
1146         return ret;
1147 }
1148
1149 /**
1150  * tty_write_message - write a message to a certain tty, not just the console.
1151  * @tty: the destination tty_struct
1152  * @msg: the message to write
1153  *
1154  * This is used for messages that need to be redirected to a specific tty.
1155  * We don't put it into the syslog queue right now maybe in the future if
1156  * really needed.
1157  *
1158  * We must still hold the BTM and test the CLOSING flag for the moment.
1159  */
1160
1161 void tty_write_message(struct tty_struct *tty, char *msg)
1162 {
1163         if (tty) {
1164                 mutex_lock(&tty->atomic_write_lock);
1165                 tty_lock(tty);
1166                 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1167                         tty_unlock(tty);
1168                         tty->ops->write(tty, msg, strlen(msg));
1169                 } else
1170                         tty_unlock(tty);
1171                 tty_write_unlock(tty);
1172         }
1173         return;
1174 }
1175
1176
1177 /**
1178  *      tty_write               -       write method for tty device file
1179  *      @file: tty file pointer
1180  *      @buf: user data to write
1181  *      @count: bytes to write
1182  *      @ppos: unused
1183  *
1184  *      Write data to a tty device via the line discipline.
1185  *
1186  *      Locking:
1187  *              Locks the line discipline as required
1188  *              Writes to the tty driver are serialized by the atomic_write_lock
1189  *      and are then processed in chunks to the device. The line discipline
1190  *      write method will not be invoked in parallel for each device.
1191  */
1192
1193 static ssize_t tty_write(struct file *file, const char __user *buf,
1194                                                 size_t count, loff_t *ppos)
1195 {
1196         struct tty_struct *tty = file_tty(file);
1197         struct tty_ldisc *ld;
1198         ssize_t ret;
1199
1200         if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1201                 return -EIO;
1202         if (!tty || !tty->ops->write ||
1203                 (test_bit(TTY_IO_ERROR, &tty->flags)))
1204                         return -EIO;
1205         /* Short term debug to catch buggy drivers */
1206         if (tty->ops->write_room == NULL)
1207                 printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1208                         tty->driver->name);
1209         ld = tty_ldisc_ref_wait(tty);
1210         if (!ld->ops->write)
1211                 ret = -EIO;
1212         else
1213                 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1214         tty_ldisc_deref(ld);
1215         return ret;
1216 }
1217
1218 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1219                                                 size_t count, loff_t *ppos)
1220 {
1221         struct file *p = NULL;
1222
1223         spin_lock(&redirect_lock);
1224         if (redirect)
1225                 p = get_file(redirect);
1226         spin_unlock(&redirect_lock);
1227
1228         if (p) {
1229                 ssize_t res;
1230                 res = vfs_write(p, buf, count, &p->f_pos);
1231                 fput(p);
1232                 return res;
1233         }
1234         return tty_write(file, buf, count, ppos);
1235 }
1236
1237 static char ptychar[] = "pqrstuvwxyzabcde";
1238
1239 /**
1240  *      pty_line_name   -       generate name for a pty
1241  *      @driver: the tty driver in use
1242  *      @index: the minor number
1243  *      @p: output buffer of at least 6 bytes
1244  *
1245  *      Generate a name from a driver reference and write it to the output
1246  *      buffer.
1247  *
1248  *      Locking: None
1249  */
1250 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1251 {
1252         int i = index + driver->name_base;
1253         /* ->name is initialized to "ttyp", but "tty" is expected */
1254         sprintf(p, "%s%c%x",
1255                 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1256                 ptychar[i >> 4 & 0xf], i & 0xf);
1257 }
1258
1259 /**
1260  *      tty_line_name   -       generate name for a tty
1261  *      @driver: the tty driver in use
1262  *      @index: the minor number
1263  *      @p: output buffer of at least 7 bytes
1264  *
1265  *      Generate a name from a driver reference and write it to the output
1266  *      buffer.
1267  *
1268  *      Locking: None
1269  */
1270 static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1271 {
1272         if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1273                 return sprintf(p, "%s", driver->name);
1274         else
1275                 return sprintf(p, "%s%d", driver->name,
1276                                index + driver->name_base);
1277 }
1278
1279 /**
1280  *      tty_driver_lookup_tty() - find an existing tty, if any
1281  *      @driver: the driver for the tty
1282  *      @idx:    the minor number
1283  *
1284  *      Return the tty, if found or ERR_PTR() otherwise.
1285  *
1286  *      Locking: tty_mutex must be held. If tty is found, the mutex must
1287  *      be held until the 'fast-open' is also done. Will change once we
1288  *      have refcounting in the driver and per driver locking
1289  */
1290 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1291                 struct inode *inode, int idx)
1292 {
1293         if (driver->ops->lookup)
1294                 return driver->ops->lookup(driver, inode, idx);
1295
1296         return driver->ttys[idx];
1297 }
1298
1299 /**
1300  *      tty_init_termios        -  helper for termios setup
1301  *      @tty: the tty to set up
1302  *
1303  *      Initialise the termios structures for this tty. Thus runs under
1304  *      the tty_mutex currently so we can be relaxed about ordering.
1305  */
1306
1307 int tty_init_termios(struct tty_struct *tty)
1308 {
1309         struct ktermios *tp;
1310         int idx = tty->index;
1311
1312         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1313                 tty->termios = tty->driver->init_termios;
1314         else {
1315                 /* Check for lazy saved data */
1316                 tp = tty->driver->termios[idx];
1317                 if (tp != NULL)
1318                         tty->termios = *tp;
1319                 else
1320                         tty->termios = tty->driver->init_termios;
1321         }
1322         /* Compatibility until drivers always set this */
1323         tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1324         tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1325         return 0;
1326 }
1327 EXPORT_SYMBOL_GPL(tty_init_termios);
1328
1329 int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1330 {
1331         int ret = tty_init_termios(tty);
1332         if (ret)
1333                 return ret;
1334
1335         tty_driver_kref_get(driver);
1336         tty->count++;
1337         driver->ttys[tty->index] = tty;
1338         return 0;
1339 }
1340 EXPORT_SYMBOL_GPL(tty_standard_install);
1341
1342 /**
1343  *      tty_driver_install_tty() - install a tty entry in the driver
1344  *      @driver: the driver for the tty
1345  *      @tty: the tty
1346  *
1347  *      Install a tty object into the driver tables. The tty->index field
1348  *      will be set by the time this is called. This method is responsible
1349  *      for ensuring any need additional structures are allocated and
1350  *      configured.
1351  *
1352  *      Locking: tty_mutex for now
1353  */
1354 static int tty_driver_install_tty(struct tty_driver *driver,
1355                                                 struct tty_struct *tty)
1356 {
1357         return driver->ops->install ? driver->ops->install(driver, tty) :
1358                 tty_standard_install(driver, tty);
1359 }
1360
1361 /**
1362  *      tty_driver_remove_tty() - remove a tty from the driver tables
1363  *      @driver: the driver for the tty
1364  *      @idx:    the minor number
1365  *
1366  *      Remvoe a tty object from the driver tables. The tty->index field
1367  *      will be set by the time this is called.
1368  *
1369  *      Locking: tty_mutex for now
1370  */
1371 void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1372 {
1373         if (driver->ops->remove)
1374                 driver->ops->remove(driver, tty);
1375         else
1376                 driver->ttys[tty->index] = NULL;
1377 }
1378
1379 /*
1380  *      tty_reopen()    - fast re-open of an open tty
1381  *      @tty    - the tty to open
1382  *
1383  *      Return 0 on success, -errno on error.
1384  *
1385  *      Locking: tty_mutex must be held from the time the tty was found
1386  *               till this open completes.
1387  */
1388 static int tty_reopen(struct tty_struct *tty)
1389 {
1390         struct tty_driver *driver = tty->driver;
1391
1392         if (test_bit(TTY_CLOSING, &tty->flags) ||
1393                         test_bit(TTY_HUPPING, &tty->flags) ||
1394                         test_bit(TTY_LDISC_CHANGING, &tty->flags))
1395                 return -EIO;
1396
1397         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1398             driver->subtype == PTY_TYPE_MASTER) {
1399                 /*
1400                  * special case for PTY masters: only one open permitted,
1401                  * and the slave side open count is incremented as well.
1402                  */
1403                 if (tty->count)
1404                         return -EIO;
1405
1406                 tty->link->count++;
1407         }
1408         tty->count++;
1409
1410         WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
1411
1412         return 0;
1413 }
1414
1415 /**
1416  *      tty_init_dev            -       initialise a tty device
1417  *      @driver: tty driver we are opening a device on
1418  *      @idx: device index
1419  *      @ret_tty: returned tty structure
1420  *
1421  *      Prepare a tty device. This may not be a "new" clean device but
1422  *      could also be an active device. The pty drivers require special
1423  *      handling because of this.
1424  *
1425  *      Locking:
1426  *              The function is called under the tty_mutex, which
1427  *      protects us from the tty struct or driver itself going away.
1428  *
1429  *      On exit the tty device has the line discipline attached and
1430  *      a reference count of 1. If a pair was created for pty/tty use
1431  *      and the other was a pty master then it too has a reference count of 1.
1432  *
1433  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1434  * failed open.  The new code protects the open with a mutex, so it's
1435  * really quite straightforward.  The mutex locking can probably be
1436  * relaxed for the (most common) case of reopening a tty.
1437  */
1438
1439 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1440 {
1441         struct tty_struct *tty;
1442         int retval;
1443
1444         /*
1445          * First time open is complex, especially for PTY devices.
1446          * This code guarantees that either everything succeeds and the
1447          * TTY is ready for operation, or else the table slots are vacated
1448          * and the allocated memory released.  (Except that the termios
1449          * and locked termios may be retained.)
1450          */
1451
1452         if (!try_module_get(driver->owner))
1453                 return ERR_PTR(-ENODEV);
1454
1455         tty = alloc_tty_struct();
1456         if (!tty) {
1457                 retval = -ENOMEM;
1458                 goto err_module_put;
1459         }
1460         initialize_tty_struct(tty, driver, idx);
1461
1462         tty_lock(tty);
1463         retval = tty_driver_install_tty(driver, tty);
1464         if (retval < 0)
1465                 goto err_deinit_tty;
1466
1467         if (!tty->port)
1468                 tty->port = driver->ports[idx];
1469
1470         WARN_RATELIMIT(!tty->port,
1471                         "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1472                         __func__, tty->driver->name);
1473
1474         tty->port->itty = tty;
1475
1476         /*
1477          * Structures all installed ... call the ldisc open routines.
1478          * If we fail here just call release_tty to clean up.  No need
1479          * to decrement the use counts, as release_tty doesn't care.
1480          */
1481         retval = tty_ldisc_setup(tty, tty->link);
1482         if (retval)
1483                 goto err_release_tty;
1484         /* Return the tty locked so that it cannot vanish under the caller */
1485         return tty;
1486
1487 err_deinit_tty:
1488         tty_unlock(tty);
1489         deinitialize_tty_struct(tty);
1490         free_tty_struct(tty);
1491 err_module_put:
1492         module_put(driver->owner);
1493         return ERR_PTR(retval);
1494
1495         /* call the tty release_tty routine to clean out this slot */
1496 err_release_tty:
1497         tty_unlock(tty);
1498         printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1499                                  "clearing slot %d\n", idx);
1500         release_tty(tty, idx);
1501         return ERR_PTR(retval);
1502 }
1503
1504 void tty_free_termios(struct tty_struct *tty)
1505 {
1506         struct ktermios *tp;
1507         int idx = tty->index;
1508
1509         /* If the port is going to reset then it has no termios to save */
1510         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1511                 return;
1512
1513         /* Stash the termios data */
1514         tp = tty->driver->termios[idx];
1515         if (tp == NULL) {
1516                 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1517                 if (tp == NULL) {
1518                         pr_warn("tty: no memory to save termios state.\n");
1519                         return;
1520                 }
1521                 tty->driver->termios[idx] = tp;
1522         }
1523         *tp = tty->termios;
1524 }
1525 EXPORT_SYMBOL(tty_free_termios);
1526
1527 /**
1528  *      tty_flush_works         -       flush all works of a tty
1529  *      @tty: tty device to flush works for
1530  *
1531  *      Sync flush all works belonging to @tty.
1532  */
1533 static void tty_flush_works(struct tty_struct *tty)
1534 {
1535         flush_work(&tty->SAK_work);
1536         flush_work(&tty->hangup_work);
1537 }
1538
1539 /**
1540  *      release_one_tty         -       release tty structure memory
1541  *      @kref: kref of tty we are obliterating
1542  *
1543  *      Releases memory associated with a tty structure, and clears out the
1544  *      driver table slots. This function is called when a device is no longer
1545  *      in use. It also gets called when setup of a device fails.
1546  *
1547  *      Locking:
1548  *              takes the file list lock internally when working on the list
1549  *      of ttys that the driver keeps.
1550  *
1551  *      This method gets called from a work queue so that the driver private
1552  *      cleanup ops can sleep (needed for USB at least)
1553  */
1554 static void release_one_tty(struct work_struct *work)
1555 {
1556         struct tty_struct *tty =
1557                 container_of(work, struct tty_struct, hangup_work);
1558         struct tty_driver *driver = tty->driver;
1559
1560         if (tty->ops->cleanup)
1561                 tty->ops->cleanup(tty);
1562
1563         tty->magic = 0;
1564         tty_driver_kref_put(driver);
1565         module_put(driver->owner);
1566
1567         spin_lock(&tty_files_lock);
1568         list_del_init(&tty->tty_files);
1569         spin_unlock(&tty_files_lock);
1570
1571         put_pid(tty->pgrp);
1572         put_pid(tty->session);
1573         free_tty_struct(tty);
1574 }
1575
1576 static void queue_release_one_tty(struct kref *kref)
1577 {
1578         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1579
1580         /* The hangup queue is now free so we can reuse it rather than
1581            waste a chunk of memory for each port */
1582         INIT_WORK(&tty->hangup_work, release_one_tty);
1583         schedule_work(&tty->hangup_work);
1584 }
1585
1586 /**
1587  *      tty_kref_put            -       release a tty kref
1588  *      @tty: tty device
1589  *
1590  *      Release a reference to a tty device and if need be let the kref
1591  *      layer destruct the object for us
1592  */
1593
1594 void tty_kref_put(struct tty_struct *tty)
1595 {
1596         if (tty)
1597                 kref_put(&tty->kref, queue_release_one_tty);
1598 }
1599 EXPORT_SYMBOL(tty_kref_put);
1600
1601 /**
1602  *      release_tty             -       release tty structure memory
1603  *
1604  *      Release both @tty and a possible linked partner (think pty pair),
1605  *      and decrement the refcount of the backing module.
1606  *
1607  *      Locking:
1608  *              tty_mutex
1609  *              takes the file list lock internally when working on the list
1610  *      of ttys that the driver keeps.
1611  *
1612  */
1613 static void release_tty(struct tty_struct *tty, int idx)
1614 {
1615         /* This should always be true but check for the moment */
1616         WARN_ON(tty->index != idx);
1617         WARN_ON(!mutex_is_locked(&tty_mutex));
1618         if (tty->ops->shutdown)
1619                 tty->ops->shutdown(tty);
1620         tty_free_termios(tty);
1621         tty_driver_remove_tty(tty->driver, tty);
1622         tty->port->itty = NULL;
1623         if (tty->link)
1624                 tty->link->port->itty = NULL;
1625         cancel_work_sync(&tty->port->buf.work);
1626
1627         if (tty->link)
1628                 tty_kref_put(tty->link);
1629         tty_kref_put(tty);
1630 }
1631
1632 /**
1633  *      tty_release_checks - check a tty before real release
1634  *      @tty: tty to check
1635  *      @o_tty: link of @tty (if any)
1636  *      @idx: index of the tty
1637  *
1638  *      Performs some paranoid checking before true release of the @tty.
1639  *      This is a no-op unless TTY_PARANOIA_CHECK is defined.
1640  */
1641 static int tty_release_checks(struct tty_struct *tty, struct tty_struct *o_tty,
1642                 int idx)
1643 {
1644 #ifdef TTY_PARANOIA_CHECK
1645         if (idx < 0 || idx >= tty->driver->num) {
1646                 printk(KERN_DEBUG "%s: bad idx when trying to free (%s)\n",
1647                                 __func__, tty->name);
1648                 return -1;
1649         }
1650
1651         /* not much to check for devpts */
1652         if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1653                 return 0;
1654
1655         if (tty != tty->driver->ttys[idx]) {
1656                 printk(KERN_DEBUG "%s: driver.table[%d] not tty for (%s)\n",
1657                                 __func__, idx, tty->name);
1658                 return -1;
1659         }
1660         if (tty->driver->other) {
1661                 if (o_tty != tty->driver->other->ttys[idx]) {
1662                         printk(KERN_DEBUG "%s: other->table[%d] not o_tty for (%s)\n",
1663                                         __func__, idx, tty->name);
1664                         return -1;
1665                 }
1666                 if (o_tty->link != tty) {
1667                         printk(KERN_DEBUG "%s: bad pty pointers\n", __func__);
1668                         return -1;
1669                 }
1670         }
1671 #endif
1672         return 0;
1673 }
1674
1675 /**
1676  *      tty_release             -       vfs callback for close
1677  *      @inode: inode of tty
1678  *      @filp: file pointer for handle to tty
1679  *
1680  *      Called the last time each file handle is closed that references
1681  *      this tty. There may however be several such references.
1682  *
1683  *      Locking:
1684  *              Takes bkl. See tty_release_dev
1685  *
1686  * Even releasing the tty structures is a tricky business.. We have
1687  * to be very careful that the structures are all released at the
1688  * same time, as interrupts might otherwise get the wrong pointers.
1689  *
1690  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1691  * lead to double frees or releasing memory still in use.
1692  */
1693
1694 int tty_release(struct inode *inode, struct file *filp)
1695 {
1696         struct tty_struct *tty = file_tty(filp);
1697         struct tty_struct *o_tty;
1698         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1699         int     idx;
1700         char    buf[64];
1701
1702         if (tty_paranoia_check(tty, inode, __func__))
1703                 return 0;
1704
1705         tty_lock(tty);
1706         check_tty_count(tty, __func__);
1707
1708         __tty_fasync(-1, filp, 0);
1709
1710         idx = tty->index;
1711         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1712                       tty->driver->subtype == PTY_TYPE_MASTER);
1713         /* Review: parallel close */
1714         o_tty = tty->link;
1715
1716         if (tty_release_checks(tty, o_tty, idx)) {
1717                 tty_unlock(tty);
1718                 return 0;
1719         }
1720
1721 #ifdef TTY_DEBUG_HANGUP
1722         printk(KERN_DEBUG "%s: %s (tty count=%d)...\n", __func__,
1723                         tty_name(tty, buf), tty->count);
1724 #endif
1725
1726         if (tty->ops->close)
1727                 tty->ops->close(tty, filp);
1728
1729         tty_unlock(tty);
1730         /*
1731          * Sanity check: if tty->count is going to zero, there shouldn't be
1732          * any waiters on tty->read_wait or tty->write_wait.  We test the
1733          * wait queues and kick everyone out _before_ actually starting to
1734          * close.  This ensures that we won't block while releasing the tty
1735          * structure.
1736          *
1737          * The test for the o_tty closing is necessary, since the master and
1738          * slave sides may close in any order.  If the slave side closes out
1739          * first, its count will be one, since the master side holds an open.
1740          * Thus this test wouldn't be triggered at the time the slave closes,
1741          * so we do it now.
1742          *
1743          * Note that it's possible for the tty to be opened again while we're
1744          * flushing out waiters.  By recalculating the closing flags before
1745          * each iteration we avoid any problems.
1746          */
1747         while (1) {
1748                 /* Guard against races with tty->count changes elsewhere and
1749                    opens on /dev/tty */
1750
1751                 mutex_lock(&tty_mutex);
1752                 tty_lock_pair(tty, o_tty);
1753                 tty_closing = tty->count <= 1;
1754                 o_tty_closing = o_tty &&
1755                         (o_tty->count <= (pty_master ? 1 : 0));
1756                 do_sleep = 0;
1757
1758                 if (tty_closing) {
1759                         if (waitqueue_active(&tty->read_wait)) {
1760                                 wake_up_poll(&tty->read_wait, POLLIN);
1761                                 do_sleep++;
1762                         }
1763                         if (waitqueue_active(&tty->write_wait)) {
1764                                 wake_up_poll(&tty->write_wait, POLLOUT);
1765                                 do_sleep++;
1766                         }
1767                 }
1768                 if (o_tty_closing) {
1769                         if (waitqueue_active(&o_tty->read_wait)) {
1770                                 wake_up_poll(&o_tty->read_wait, POLLIN);
1771                                 do_sleep++;
1772                         }
1773                         if (waitqueue_active(&o_tty->write_wait)) {
1774                                 wake_up_poll(&o_tty->write_wait, POLLOUT);
1775                                 do_sleep++;
1776                         }
1777                 }
1778                 if (!do_sleep)
1779                         break;
1780
1781                 printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
1782                                 __func__, tty_name(tty, buf));
1783                 tty_unlock_pair(tty, o_tty);
1784                 mutex_unlock(&tty_mutex);
1785                 schedule();
1786         }
1787
1788         /*
1789          * The closing flags are now consistent with the open counts on
1790          * both sides, and we've completed the last operation that could
1791          * block, so it's safe to proceed with closing.
1792          *
1793          * We must *not* drop the tty_mutex until we ensure that a further
1794          * entry into tty_open can not pick up this tty.
1795          */
1796         if (pty_master) {
1797                 if (--o_tty->count < 0) {
1798                         printk(KERN_WARNING "%s: bad pty slave count (%d) for %s\n",
1799                                 __func__, o_tty->count, tty_name(o_tty, buf));
1800                         o_tty->count = 0;
1801                 }
1802         }
1803         if (--tty->count < 0) {
1804                 printk(KERN_WARNING "%s: bad tty->count (%d) for %s\n",
1805                                 __func__, tty->count, tty_name(tty, buf));
1806                 tty->count = 0;
1807         }
1808
1809         /*
1810          * We've decremented tty->count, so we need to remove this file
1811          * descriptor off the tty->tty_files list; this serves two
1812          * purposes:
1813          *  - check_tty_count sees the correct number of file descriptors
1814          *    associated with this tty.
1815          *  - do_tty_hangup no longer sees this file descriptor as
1816          *    something that needs to be handled for hangups.
1817          */
1818         tty_del_file(filp);
1819
1820         /*
1821          * Perform some housekeeping before deciding whether to return.
1822          *
1823          * Set the TTY_CLOSING flag if this was the last open.  In the
1824          * case of a pty we may have to wait around for the other side
1825          * to close, and TTY_CLOSING makes sure we can't be reopened.
1826          */
1827         if (tty_closing)
1828                 set_bit(TTY_CLOSING, &tty->flags);
1829         if (o_tty_closing)
1830                 set_bit(TTY_CLOSING, &o_tty->flags);
1831
1832         /*
1833          * If _either_ side is closing, make sure there aren't any
1834          * processes that still think tty or o_tty is their controlling
1835          * tty.
1836          */
1837         if (tty_closing || o_tty_closing) {
1838                 read_lock(&tasklist_lock);
1839                 session_clear_tty(tty->session);
1840                 if (o_tty)
1841                         session_clear_tty(o_tty->session);
1842                 read_unlock(&tasklist_lock);
1843         }
1844
1845         mutex_unlock(&tty_mutex);
1846         tty_unlock_pair(tty, o_tty);
1847         /* At this point the TTY_CLOSING flag should ensure a dead tty
1848            cannot be re-opened by a racing opener */
1849
1850         /* check whether both sides are closing ... */
1851         if (!tty_closing || (o_tty && !o_tty_closing))
1852                 return 0;
1853
1854 #ifdef TTY_DEBUG_HANGUP
1855         printk(KERN_DEBUG "%s: %s: final close\n", __func__, tty_name(tty, buf));
1856 #endif
1857         /*
1858          * Ask the line discipline code to release its structures
1859          */
1860         tty_ldisc_release(tty, o_tty);
1861
1862         /* Wait for pending work before tty destruction commmences */
1863         tty_flush_works(tty);
1864         if (o_tty)
1865                 tty_flush_works(o_tty);
1866
1867 #ifdef TTY_DEBUG_HANGUP
1868         printk(KERN_DEBUG "%s: %s: freeing structure...\n", __func__, tty_name(tty, buf));
1869 #endif
1870         /*
1871          * The release_tty function takes care of the details of clearing
1872          * the slots and preserving the termios structure. The tty_unlock_pair
1873          * should be safe as we keep a kref while the tty is locked (so the
1874          * unlock never unlocks a freed tty).
1875          */
1876         mutex_lock(&tty_mutex);
1877         release_tty(tty, idx);
1878         mutex_unlock(&tty_mutex);
1879
1880         return 0;
1881 }
1882
1883 /**
1884  *      tty_open_current_tty - get tty of current task for open
1885  *      @device: device number
1886  *      @filp: file pointer to tty
1887  *      @return: tty of the current task iff @device is /dev/tty
1888  *
1889  *      We cannot return driver and index like for the other nodes because
1890  *      devpts will not work then. It expects inodes to be from devpts FS.
1891  *
1892  *      We need to move to returning a refcounted object from all the lookup
1893  *      paths including this one.
1894  */
1895 static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1896 {
1897         struct tty_struct *tty;
1898
1899         if (device != MKDEV(TTYAUX_MAJOR, 0))
1900                 return NULL;
1901
1902         tty = get_current_tty();
1903         if (!tty)
1904                 return ERR_PTR(-ENXIO);
1905
1906         filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1907         /* noctty = 1; */
1908         tty_kref_put(tty);
1909         /* FIXME: we put a reference and return a TTY! */
1910         /* This is only safe because the caller holds tty_mutex */
1911         return tty;
1912 }
1913
1914 /**
1915  *      tty_lookup_driver - lookup a tty driver for a given device file
1916  *      @device: device number
1917  *      @filp: file pointer to tty
1918  *      @noctty: set if the device should not become a controlling tty
1919  *      @index: index for the device in the @return driver
1920  *      @return: driver for this inode (with increased refcount)
1921  *
1922  *      If @return is not erroneous, the caller is responsible to decrement the
1923  *      refcount by tty_driver_kref_put.
1924  *
1925  *      Locking: tty_mutex protects get_tty_driver
1926  */
1927 static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1928                 int *noctty, int *index)
1929 {
1930         struct tty_driver *driver;
1931
1932         switch (device) {
1933 #ifdef CONFIG_VT
1934         case MKDEV(TTY_MAJOR, 0): {
1935                 extern struct tty_driver *console_driver;
1936                 driver = tty_driver_kref_get(console_driver);
1937                 *index = fg_console;
1938                 *noctty = 1;
1939                 break;
1940         }
1941 #endif
1942         case MKDEV(TTYAUX_MAJOR, 1): {
1943                 struct tty_driver *console_driver = console_device(index);
1944                 if (console_driver) {
1945                         driver = tty_driver_kref_get(console_driver);
1946                         if (driver) {
1947                                 /* Don't let /dev/console block */
1948                                 filp->f_flags |= O_NONBLOCK;
1949                                 *noctty = 1;
1950                                 break;
1951                         }
1952                 }
1953                 return ERR_PTR(-ENODEV);
1954         }
1955         default:
1956                 driver = get_tty_driver(device, index);
1957                 if (!driver)
1958                         return ERR_PTR(-ENODEV);
1959                 break;
1960         }
1961         return driver;
1962 }
1963
1964 /**
1965  *      tty_open                -       open a tty device
1966  *      @inode: inode of device file
1967  *      @filp: file pointer to tty
1968  *
1969  *      tty_open and tty_release keep up the tty count that contains the
1970  *      number of opens done on a tty. We cannot use the inode-count, as
1971  *      different inodes might point to the same tty.
1972  *
1973  *      Open-counting is needed for pty masters, as well as for keeping
1974  *      track of serial lines: DTR is dropped when the last close happens.
1975  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
1976  *
1977  *      The termios state of a pty is reset on first open so that
1978  *      settings don't persist across reuse.
1979  *
1980  *      Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
1981  *               tty->count should protect the rest.
1982  *               ->siglock protects ->signal/->sighand
1983  *
1984  *      Note: the tty_unlock/lock cases without a ref are only safe due to
1985  *      tty_mutex
1986  */
1987
1988 static int tty_open(struct inode *inode, struct file *filp)
1989 {
1990         struct tty_struct *tty;
1991         int noctty, retval;
1992         struct tty_driver *driver = NULL;
1993         int index;
1994         dev_t device = inode->i_rdev;
1995         unsigned saved_flags = filp->f_flags;
1996
1997         nonseekable_open(inode, filp);
1998
1999 retry_open:
2000         retval = tty_alloc_file(filp);
2001         if (retval)
2002                 return -ENOMEM;
2003
2004         noctty = filp->f_flags & O_NOCTTY;
2005         index  = -1;
2006         retval = 0;
2007
2008         mutex_lock(&tty_mutex);
2009         /* This is protected by the tty_mutex */
2010         tty = tty_open_current_tty(device, filp);
2011         if (IS_ERR(tty)) {
2012                 retval = PTR_ERR(tty);
2013                 goto err_unlock;
2014         } else if (!tty) {
2015                 driver = tty_lookup_driver(device, filp, &noctty, &index);
2016                 if (IS_ERR(driver)) {
2017                         retval = PTR_ERR(driver);
2018                         goto err_unlock;
2019                 }
2020
2021                 /* check whether we're reopening an existing tty */
2022                 tty = tty_driver_lookup_tty(driver, inode, index);
2023                 if (IS_ERR(tty)) {
2024                         retval = PTR_ERR(tty);
2025                         goto err_unlock;
2026                 }
2027         }
2028
2029         if (tty) {
2030                 tty_lock(tty);
2031                 retval = tty_reopen(tty);
2032                 if (retval < 0) {
2033                         tty_unlock(tty);
2034                         tty = ERR_PTR(retval);
2035                 }
2036         } else  /* Returns with the tty_lock held for now */
2037                 tty = tty_init_dev(driver, index);
2038
2039         mutex_unlock(&tty_mutex);
2040         if (driver)
2041                 tty_driver_kref_put(driver);
2042         if (IS_ERR(tty)) {
2043                 retval = PTR_ERR(tty);
2044                 goto err_file;
2045         }
2046
2047         tty_add_file(tty, filp);
2048
2049         check_tty_count(tty, __func__);
2050         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2051             tty->driver->subtype == PTY_TYPE_MASTER)
2052                 noctty = 1;
2053 #ifdef TTY_DEBUG_HANGUP
2054         printk(KERN_DEBUG "%s: opening %s...\n", __func__, tty->name);
2055 #endif
2056         if (tty->ops->open)
2057                 retval = tty->ops->open(tty, filp);
2058         else
2059                 retval = -ENODEV;
2060         filp->f_flags = saved_flags;
2061
2062         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
2063                                                 !capable(CAP_SYS_ADMIN))
2064                 retval = -EBUSY;
2065
2066         if (retval) {
2067 #ifdef TTY_DEBUG_HANGUP
2068                 printk(KERN_DEBUG "%s: error %d in opening %s...\n", __func__,
2069                                 retval, tty->name);
2070 #endif
2071                 tty_unlock(tty); /* need to call tty_release without BTM */
2072                 tty_release(inode, filp);
2073                 if (retval != -ERESTARTSYS)
2074                         return retval;
2075
2076                 if (signal_pending(current))
2077                         return retval;
2078
2079                 schedule();
2080                 /*
2081                  * Need to reset f_op in case a hangup happened.
2082                  */
2083                 if (filp->f_op == &hung_up_tty_fops)
2084                         filp->f_op = &tty_fops;
2085                 goto retry_open;
2086         }
2087         tty_unlock(tty);
2088
2089
2090         mutex_lock(&tty_mutex);
2091         tty_lock(tty);
2092         spin_lock_irq(&current->sighand->siglock);
2093         if (!noctty &&
2094             current->signal->leader &&
2095             !current->signal->tty &&
2096             tty->session == NULL)
2097                 __proc_set_tty(current, tty);
2098         spin_unlock_irq(&current->sighand->siglock);
2099         tty_unlock(tty);
2100         mutex_unlock(&tty_mutex);
2101         return 0;
2102 err_unlock:
2103         mutex_unlock(&tty_mutex);
2104         /* after locks to avoid deadlock */
2105         if (!IS_ERR_OR_NULL(driver))
2106                 tty_driver_kref_put(driver);
2107 err_file:
2108         tty_free_file(filp);
2109         return retval;
2110 }
2111
2112
2113
2114 /**
2115  *      tty_poll        -       check tty status
2116  *      @filp: file being polled
2117  *      @wait: poll wait structures to update
2118  *
2119  *      Call the line discipline polling method to obtain the poll
2120  *      status of the device.
2121  *
2122  *      Locking: locks called line discipline but ldisc poll method
2123  *      may be re-entered freely by other callers.
2124  */
2125
2126 static unsigned int tty_poll(struct file *filp, poll_table *wait)
2127 {
2128         struct tty_struct *tty = file_tty(filp);
2129         struct tty_ldisc *ld;
2130         int ret = 0;
2131
2132         if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2133                 return 0;
2134
2135         ld = tty_ldisc_ref_wait(tty);
2136         if (ld->ops->poll)
2137                 ret = (ld->ops->poll)(tty, filp, wait);
2138         tty_ldisc_deref(ld);
2139         return ret;
2140 }
2141
2142 static int __tty_fasync(int fd, struct file *filp, int on)
2143 {
2144         struct tty_struct *tty = file_tty(filp);
2145         unsigned long flags;
2146         int retval = 0;
2147
2148         if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2149                 goto out;
2150
2151         retval = fasync_helper(fd, filp, on, &tty->fasync);
2152         if (retval <= 0)
2153                 goto out;
2154
2155         if (on) {
2156                 enum pid_type type;
2157                 struct pid *pid;
2158                 if (!waitqueue_active(&tty->read_wait))
2159                         tty->minimum_to_wake = 1;
2160                 spin_lock_irqsave(&tty->ctrl_lock, flags);
2161                 if (tty->pgrp) {
2162                         pid = tty->pgrp;
2163                         type = PIDTYPE_PGID;
2164                 } else {
2165                         pid = task_pid(current);
2166                         type = PIDTYPE_PID;
2167                 }
2168                 get_pid(pid);
2169                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2170                 retval = __f_setown(filp, pid, type, 0);
2171                 put_pid(pid);
2172                 if (retval)
2173                         goto out;
2174         } else {
2175                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2176                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2177         }
2178         retval = 0;
2179 out:
2180         return retval;
2181 }
2182
2183 static int tty_fasync(int fd, struct file *filp, int on)
2184 {
2185         struct tty_struct *tty = file_tty(filp);
2186         int retval;
2187
2188         tty_lock(tty);
2189         retval = __tty_fasync(fd, filp, on);
2190         tty_unlock(tty);
2191
2192         return retval;
2193 }
2194
2195 /**
2196  *      tiocsti                 -       fake input character
2197  *      @tty: tty to fake input into
2198  *      @p: pointer to character
2199  *
2200  *      Fake input to a tty device. Does the necessary locking and
2201  *      input management.
2202  *
2203  *      FIXME: does not honour flow control ??
2204  *
2205  *      Locking:
2206  *              Called functions take tty_ldisc_lock
2207  *              current->signal->tty check is safe without locks
2208  *
2209  *      FIXME: may race normal receive processing
2210  */
2211
2212 static int tiocsti(struct tty_struct *tty, char __user *p)
2213 {
2214         char ch, mbz = 0;
2215         struct tty_ldisc *ld;
2216
2217         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2218                 return -EPERM;
2219         if (get_user(ch, p))
2220                 return -EFAULT;
2221         tty_audit_tiocsti(tty, ch);
2222         ld = tty_ldisc_ref_wait(tty);
2223         ld->ops->receive_buf(tty, &ch, &mbz, 1);
2224         tty_ldisc_deref(ld);
2225         return 0;
2226 }
2227
2228 /**
2229  *      tiocgwinsz              -       implement window query ioctl
2230  *      @tty; tty
2231  *      @arg: user buffer for result
2232  *
2233  *      Copies the kernel idea of the window size into the user buffer.
2234  *
2235  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2236  *              is consistent.
2237  */
2238
2239 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2240 {
2241         int err;
2242
2243         mutex_lock(&tty->termios_mutex);
2244         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2245         mutex_unlock(&tty->termios_mutex);
2246
2247         return err ? -EFAULT: 0;
2248 }
2249
2250 /**
2251  *      tty_do_resize           -       resize event
2252  *      @tty: tty being resized
2253  *      @rows: rows (character)
2254  *      @cols: cols (character)
2255  *
2256  *      Update the termios variables and send the necessary signals to
2257  *      peform a terminal resize correctly
2258  */
2259
2260 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2261 {
2262         struct pid *pgrp;
2263         unsigned long flags;
2264
2265         /* Lock the tty */
2266         mutex_lock(&tty->termios_mutex);
2267         if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2268                 goto done;
2269         /* Get the PID values and reference them so we can
2270            avoid holding the tty ctrl lock while sending signals */
2271         spin_lock_irqsave(&tty->ctrl_lock, flags);
2272         pgrp = get_pid(tty->pgrp);
2273         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2274
2275         if (pgrp)
2276                 kill_pgrp(pgrp, SIGWINCH, 1);
2277         put_pid(pgrp);
2278
2279         tty->winsize = *ws;
2280 done:
2281         mutex_unlock(&tty->termios_mutex);
2282         return 0;
2283 }
2284 EXPORT_SYMBOL(tty_do_resize);
2285
2286 /**
2287  *      tiocswinsz              -       implement window size set ioctl
2288  *      @tty; tty side of tty
2289  *      @arg: user buffer for result
2290  *
2291  *      Copies the user idea of the window size to the kernel. Traditionally
2292  *      this is just advisory information but for the Linux console it
2293  *      actually has driver level meaning and triggers a VC resize.
2294  *
2295  *      Locking:
2296  *              Driver dependent. The default do_resize method takes the
2297  *      tty termios mutex and ctrl_lock. The console takes its own lock
2298  *      then calls into the default method.
2299  */
2300
2301 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2302 {
2303         struct winsize tmp_ws;
2304         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2305                 return -EFAULT;
2306
2307         if (tty->ops->resize)
2308                 return tty->ops->resize(tty, &tmp_ws);
2309         else
2310                 return tty_do_resize(tty, &tmp_ws);
2311 }
2312
2313 /**
2314  *      tioccons        -       allow admin to move logical console
2315  *      @file: the file to become console
2316  *
2317  *      Allow the administrator to move the redirected console device
2318  *
2319  *      Locking: uses redirect_lock to guard the redirect information
2320  */
2321
2322 static int tioccons(struct file *file)
2323 {
2324         if (!capable(CAP_SYS_ADMIN))
2325                 return -EPERM;
2326         if (file->f_op->write == redirected_tty_write) {
2327                 struct file *f;
2328                 spin_lock(&redirect_lock);
2329                 f = redirect;
2330                 redirect = NULL;
2331                 spin_unlock(&redirect_lock);
2332                 if (f)
2333                         fput(f);
2334                 return 0;
2335         }
2336         spin_lock(&redirect_lock);
2337         if (redirect) {
2338                 spin_unlock(&redirect_lock);
2339                 return -EBUSY;
2340         }
2341         redirect = get_file(file);
2342         spin_unlock(&redirect_lock);
2343         return 0;
2344 }
2345
2346 /**
2347  *      fionbio         -       non blocking ioctl
2348  *      @file: file to set blocking value
2349  *      @p: user parameter
2350  *
2351  *      Historical tty interfaces had a blocking control ioctl before
2352  *      the generic functionality existed. This piece of history is preserved
2353  *      in the expected tty API of posix OS's.
2354  *
2355  *      Locking: none, the open file handle ensures it won't go away.
2356  */
2357
2358 static int fionbio(struct file *file, int __user *p)
2359 {
2360         int nonblock;
2361
2362         if (get_user(nonblock, p))
2363                 return -EFAULT;
2364
2365         spin_lock(&file->f_lock);
2366         if (nonblock)
2367                 file->f_flags |= O_NONBLOCK;
2368         else
2369                 file->f_flags &= ~O_NONBLOCK;
2370         spin_unlock(&file->f_lock);
2371         return 0;
2372 }
2373
2374 /**
2375  *      tiocsctty       -       set controlling tty
2376  *      @tty: tty structure
2377  *      @arg: user argument
2378  *
2379  *      This ioctl is used to manage job control. It permits a session
2380  *      leader to set this tty as the controlling tty for the session.
2381  *
2382  *      Locking:
2383  *              Takes tty_mutex() to protect tty instance
2384  *              Takes tasklist_lock internally to walk sessions
2385  *              Takes ->siglock() when updating signal->tty
2386  */
2387
2388 static int tiocsctty(struct tty_struct *tty, int arg)
2389 {
2390         int ret = 0;
2391         if (current->signal->leader && (task_session(current) == tty->session))
2392                 return ret;
2393
2394         mutex_lock(&tty_mutex);
2395         /*
2396          * The process must be a session leader and
2397          * not have a controlling tty already.
2398          */
2399         if (!current->signal->leader || current->signal->tty) {
2400                 ret = -EPERM;
2401                 goto unlock;
2402         }
2403
2404         if (tty->session) {
2405                 /*
2406                  * This tty is already the controlling
2407                  * tty for another session group!
2408                  */
2409                 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2410                         /*
2411                          * Steal it away
2412                          */
2413                         read_lock(&tasklist_lock);
2414                         session_clear_tty(tty->session);
2415                         read_unlock(&tasklist_lock);
2416                 } else {
2417                         ret = -EPERM;
2418                         goto unlock;
2419                 }
2420         }
2421         proc_set_tty(current, tty);
2422 unlock:
2423         mutex_unlock(&tty_mutex);
2424         return ret;
2425 }
2426
2427 /**
2428  *      tty_get_pgrp    -       return a ref counted pgrp pid
2429  *      @tty: tty to read
2430  *
2431  *      Returns a refcounted instance of the pid struct for the process
2432  *      group controlling the tty.
2433  */
2434
2435 struct pid *tty_get_pgrp(struct tty_struct *tty)
2436 {
2437         unsigned long flags;
2438         struct pid *pgrp;
2439
2440         spin_lock_irqsave(&tty->ctrl_lock, flags);
2441         pgrp = get_pid(tty->pgrp);
2442         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2443
2444         return pgrp;
2445 }
2446 EXPORT_SYMBOL_GPL(tty_get_pgrp);
2447
2448 /**
2449  *      tiocgpgrp               -       get process group
2450  *      @tty: tty passed by user
2451  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2452  *      @p: returned pid
2453  *
2454  *      Obtain the process group of the tty. If there is no process group
2455  *      return an error.
2456  *
2457  *      Locking: none. Reference to current->signal->tty is safe.
2458  */
2459
2460 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2461 {
2462         struct pid *pid;
2463         int ret;
2464         /*
2465          * (tty == real_tty) is a cheap way of
2466          * testing if the tty is NOT a master pty.
2467          */
2468         if (tty == real_tty && current->signal->tty != real_tty)
2469                 return -ENOTTY;
2470         pid = tty_get_pgrp(real_tty);
2471         ret =  put_user(pid_vnr(pid), p);
2472         put_pid(pid);
2473         return ret;
2474 }
2475
2476 /**
2477  *      tiocspgrp               -       attempt to set process group
2478  *      @tty: tty passed by user
2479  *      @real_tty: tty side device matching tty passed by user
2480  *      @p: pid pointer
2481  *
2482  *      Set the process group of the tty to the session passed. Only
2483  *      permitted where the tty session is our session.
2484  *
2485  *      Locking: RCU, ctrl lock
2486  */
2487
2488 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2489 {
2490         struct pid *pgrp;
2491         pid_t pgrp_nr;
2492         int retval = tty_check_change(real_tty);
2493         unsigned long flags;
2494
2495         if (retval == -EIO)
2496                 return -ENOTTY;
2497         if (retval)
2498                 return retval;
2499         if (!current->signal->tty ||
2500             (current->signal->tty != real_tty) ||
2501             (real_tty->session != task_session(current)))
2502                 return -ENOTTY;
2503         if (get_user(pgrp_nr, p))
2504                 return -EFAULT;
2505         if (pgrp_nr < 0)
2506                 return -EINVAL;
2507         rcu_read_lock();
2508         pgrp = find_vpid(pgrp_nr);
2509         retval = -ESRCH;
2510         if (!pgrp)
2511                 goto out_unlock;
2512         retval = -EPERM;
2513         if (session_of_pgrp(pgrp) != task_session(current))
2514                 goto out_unlock;
2515         retval = 0;
2516         spin_lock_irqsave(&tty->ctrl_lock, flags);
2517         put_pid(real_tty->pgrp);
2518         real_tty->pgrp = get_pid(pgrp);
2519         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2520 out_unlock:
2521         rcu_read_unlock();
2522         return retval;
2523 }
2524
2525 /**
2526  *      tiocgsid                -       get session id
2527  *      @tty: tty passed by user
2528  *      @real_tty: tty side of the tty passed by the user if a pty else the tty
2529  *      @p: pointer to returned session id
2530  *
2531  *      Obtain the session id of the tty. If there is no session
2532  *      return an error.
2533  *
2534  *      Locking: none. Reference to current->signal->tty is safe.
2535  */
2536
2537 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2538 {
2539         /*
2540          * (tty == real_tty) is a cheap way of
2541          * testing if the tty is NOT a master pty.
2542         */
2543         if (tty == real_tty && current->signal->tty != real_tty)
2544                 return -ENOTTY;
2545         if (!real_tty->session)
2546                 return -ENOTTY;
2547         return put_user(pid_vnr(real_tty->session), p);
2548 }
2549
2550 /**
2551  *      tiocsetd        -       set line discipline
2552  *      @tty: tty device
2553  *      @p: pointer to user data
2554  *
2555  *      Set the line discipline according to user request.
2556  *
2557  *      Locking: see tty_set_ldisc, this function is just a helper
2558  */
2559
2560 static int tiocsetd(struct tty_struct *tty, int __user *p)
2561 {
2562         int ldisc;
2563         int ret;
2564
2565         if (get_user(ldisc, p))
2566                 return -EFAULT;
2567
2568         ret = tty_set_ldisc(tty, ldisc);
2569
2570         return ret;
2571 }
2572
2573 /**
2574  *      send_break      -       performed time break
2575  *      @tty: device to break on
2576  *      @duration: timeout in mS
2577  *
2578  *      Perform a timed break on hardware that lacks its own driver level
2579  *      timed break functionality.
2580  *
2581  *      Locking:
2582  *              atomic_write_lock serializes
2583  *
2584  */
2585
2586 static int send_break(struct tty_struct *tty, unsigned int duration)
2587 {
2588         int retval;
2589
2590         if (tty->ops->break_ctl == NULL)
2591                 return 0;
2592
2593         if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2594                 retval = tty->ops->break_ctl(tty, duration);
2595         else {
2596                 /* Do the work ourselves */
2597                 if (tty_write_lock(tty, 0) < 0)
2598                         return -EINTR;
2599                 retval = tty->ops->break_ctl(tty, -1);
2600                 if (retval)
2601                         goto out;
2602                 if (!signal_pending(current))
2603                         msleep_interruptible(duration);
2604                 retval = tty->ops->break_ctl(tty, 0);
2605 out:
2606                 tty_write_unlock(tty);
2607                 if (signal_pending(current))
2608                         retval = -EINTR;
2609         }
2610         return retval;
2611 }
2612
2613 /**
2614  *      tty_tiocmget            -       get modem status
2615  *      @tty: tty device
2616  *      @file: user file pointer
2617  *      @p: pointer to result
2618  *
2619  *      Obtain the modem status bits from the tty driver if the feature
2620  *      is supported. Return -EINVAL if it is not available.
2621  *
2622  *      Locking: none (up to the driver)
2623  */
2624
2625 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2626 {
2627         int retval = -EINVAL;
2628
2629         if (tty->ops->tiocmget) {
2630                 retval = tty->ops->tiocmget(tty);
2631
2632                 if (retval >= 0)
2633                         retval = put_user(retval, p);
2634         }
2635         return retval;
2636 }
2637
2638 /**
2639  *      tty_tiocmset            -       set modem status
2640  *      @tty: tty device
2641  *      @cmd: command - clear bits, set bits or set all
2642  *      @p: pointer to desired bits
2643  *
2644  *      Set the modem status bits from the tty driver if the feature
2645  *      is supported. Return -EINVAL if it is not available.
2646  *
2647  *      Locking: none (up to the driver)
2648  */
2649
2650 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2651              unsigned __user *p)
2652 {
2653         int retval;
2654         unsigned int set, clear, val;
2655
2656         if (tty->ops->tiocmset == NULL)
2657                 return -EINVAL;
2658
2659         retval = get_user(val, p);
2660         if (retval)
2661                 return retval;
2662         set = clear = 0;
2663         switch (cmd) {
2664         case TIOCMBIS:
2665                 set = val;
2666                 break;
2667         case TIOCMBIC:
2668                 clear = val;
2669                 break;
2670         case TIOCMSET:
2671                 set = val;
2672                 clear = ~val;
2673                 break;
2674         }
2675         set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2676         clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2677         return tty->ops->tiocmset(tty, set, clear);
2678 }
2679
2680 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2681 {
2682         int retval = -EINVAL;
2683         struct serial_icounter_struct icount;
2684         memset(&icount, 0, sizeof(icount));
2685         if (tty->ops->get_icount)
2686                 retval = tty->ops->get_icount(tty, &icount);
2687         if (retval != 0)
2688                 return retval;
2689         if (copy_to_user(arg, &icount, sizeof(icount)))
2690                 return -EFAULT;
2691         return 0;
2692 }
2693
2694 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2695 {
2696         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2697             tty->driver->subtype == PTY_TYPE_MASTER)
2698                 tty = tty->link;
2699         return tty;
2700 }
2701 EXPORT_SYMBOL(tty_pair_get_tty);
2702
2703 struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2704 {
2705         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2706             tty->driver->subtype == PTY_TYPE_MASTER)
2707             return tty;
2708         return tty->link;
2709 }
2710 EXPORT_SYMBOL(tty_pair_get_pty);
2711
2712 /*
2713  * Split this up, as gcc can choke on it otherwise..
2714  */
2715 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2716 {
2717         struct tty_struct *tty = file_tty(file);
2718         struct tty_struct *real_tty;
2719         void __user *p = (void __user *)arg;
2720         int retval;
2721         struct tty_ldisc *ld;
2722
2723         if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2724                 return -EINVAL;
2725
2726         real_tty = tty_pair_get_tty(tty);
2727
2728         /*
2729          * Factor out some common prep work
2730          */
2731         switch (cmd) {
2732         case TIOCSETD:
2733         case TIOCSBRK:
2734         case TIOCCBRK:
2735         case TCSBRK:
2736         case TCSBRKP:
2737                 retval = tty_check_change(tty);
2738                 if (retval)
2739                         return retval;
2740                 if (cmd != TIOCCBRK) {
2741                         tty_wait_until_sent(tty, 0);
2742                         if (signal_pending(current))
2743                                 return -EINTR;
2744                 }
2745                 break;
2746         }
2747
2748         /*
2749          *      Now do the stuff.
2750          */
2751         switch (cmd) {
2752         case TIOCSTI:
2753                 return tiocsti(tty, p);
2754         case TIOCGWINSZ:
2755                 return tiocgwinsz(real_tty, p);
2756         case TIOCSWINSZ:
2757                 return tiocswinsz(real_tty, p);
2758         case TIOCCONS:
2759                 return real_tty != tty ? -EINVAL : tioccons(file);
2760         case FIONBIO:
2761                 return fionbio(file, p);
2762         case TIOCEXCL:
2763                 set_bit(TTY_EXCLUSIVE, &tty->flags);
2764                 return 0;
2765         case TIOCNXCL:
2766                 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2767                 return 0;
2768         case TIOCGEXCL:
2769         {
2770                 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2771                 return put_user(excl, (int __user *)p);
2772         }
2773         case TIOCNOTTY:
2774                 if (current->signal->tty != tty)
2775                         return -ENOTTY;
2776                 no_tty();
2777                 return 0;
2778         case TIOCSCTTY:
2779                 return tiocsctty(tty, arg);
2780         case TIOCGPGRP:
2781                 return tiocgpgrp(tty, real_tty, p);
2782         case TIOCSPGRP:
2783                 return tiocspgrp(tty, real_tty, p);
2784         case TIOCGSID:
2785                 return tiocgsid(tty, real_tty, p);
2786         case TIOCGETD:
2787                 return put_user(tty->ldisc->ops->num, (int __user *)p);
2788         case TIOCSETD:
2789                 return tiocsetd(tty, p);
2790         case TIOCVHANGUP:
2791                 if (!capable(CAP_SYS_ADMIN))
2792                         return -EPERM;
2793                 tty_vhangup(tty);
2794                 return 0;
2795         case TIOCGDEV:
2796         {
2797                 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2798                 return put_user(ret, (unsigned int __user *)p);
2799         }
2800         /*
2801          * Break handling
2802          */
2803         case TIOCSBRK:  /* Turn break on, unconditionally */
2804                 if (tty->ops->break_ctl)
2805                         return tty->ops->break_ctl(tty, -1);
2806                 return 0;
2807         case TIOCCBRK:  /* Turn break off, unconditionally */
2808                 if (tty->ops->break_ctl)
2809                         return tty->ops->break_ctl(tty, 0);
2810                 return 0;
2811         case TCSBRK:   /* SVID version: non-zero arg --> no break */
2812                 /* non-zero arg means wait for all output data
2813                  * to be sent (performed above) but don't send break.
2814                  * This is used by the tcdrain() termios function.
2815                  */
2816                 if (!arg)
2817                         return send_break(tty, 250);
2818                 return 0;
2819         case TCSBRKP:   /* support for POSIX tcsendbreak() */
2820                 return send_break(tty, arg ? arg*100 : 250);
2821
2822         case TIOCMGET:
2823                 return tty_tiocmget(tty, p);
2824         case TIOCMSET:
2825         case TIOCMBIC:
2826         case TIOCMBIS:
2827                 return tty_tiocmset(tty, cmd, p);
2828         case TIOCGICOUNT:
2829                 retval = tty_tiocgicount(tty, p);
2830                 /* For the moment allow fall through to the old method */
2831                 if (retval != -EINVAL)
2832                         return retval;
2833                 break;
2834         case TCFLSH:
2835                 switch (arg) {
2836                 case TCIFLUSH:
2837                 case TCIOFLUSH:
2838                 /* flush tty buffer and allow ldisc to process ioctl */
2839                         tty_buffer_flush(tty);
2840                         break;
2841                 }
2842                 break;
2843         }
2844         if (tty->ops->ioctl) {
2845                 retval = (tty->ops->ioctl)(tty, cmd, arg);
2846                 if (retval != -ENOIOCTLCMD)
2847                         return retval;
2848         }
2849         ld = tty_ldisc_ref_wait(tty);
2850         retval = -EINVAL;
2851         if (ld->ops->ioctl) {
2852                 retval = ld->ops->ioctl(tty, file, cmd, arg);
2853                 if (retval == -ENOIOCTLCMD)
2854                         retval = -ENOTTY;
2855         }
2856         tty_ldisc_deref(ld);
2857         return retval;
2858 }
2859
2860 #ifdef CONFIG_COMPAT
2861 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2862                                 unsigned long arg)
2863 {
2864         struct tty_struct *tty = file_tty(file);
2865         struct tty_ldisc *ld;
2866         int retval = -ENOIOCTLCMD;
2867
2868         if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2869                 return -EINVAL;
2870
2871         if (tty->ops->compat_ioctl) {
2872                 retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2873                 if (retval != -ENOIOCTLCMD)
2874                         return retval;
2875         }
2876
2877         ld = tty_ldisc_ref_wait(tty);
2878         if (ld->ops->compat_ioctl)
2879                 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2880         else
2881                 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2882         tty_ldisc_deref(ld);
2883
2884         return retval;
2885 }
2886 #endif
2887
2888 static int this_tty(const void *t, struct file *file, unsigned fd)
2889 {
2890         if (likely(file->f_op->read != tty_read))
2891                 return 0;
2892         return file_tty(file) != t ? 0 : fd + 1;
2893 }
2894         
2895 /*
2896  * This implements the "Secure Attention Key" ---  the idea is to
2897  * prevent trojan horses by killing all processes associated with this
2898  * tty when the user hits the "Secure Attention Key".  Required for
2899  * super-paranoid applications --- see the Orange Book for more details.
2900  *
2901  * This code could be nicer; ideally it should send a HUP, wait a few
2902  * seconds, then send a INT, and then a KILL signal.  But you then
2903  * have to coordinate with the init process, since all processes associated
2904  * with the current tty must be dead before the new getty is allowed
2905  * to spawn.
2906  *
2907  * Now, if it would be correct ;-/ The current code has a nasty hole -
2908  * it doesn't catch files in flight. We may send the descriptor to ourselves
2909  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2910  *
2911  * Nasty bug: do_SAK is being called in interrupt context.  This can
2912  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2913  */
2914 void __do_SAK(struct tty_struct *tty)
2915 {
2916 #ifdef TTY_SOFT_SAK
2917         tty_hangup(tty);
2918 #else
2919         struct task_struct *g, *p;
2920         struct pid *session;
2921         int             i;
2922
2923         if (!tty)
2924                 return;
2925         session = tty->session;
2926
2927         tty_ldisc_flush(tty);
2928
2929         tty_driver_flush_buffer(tty);
2930
2931         read_lock(&tasklist_lock);
2932         /* Kill the entire session */
2933         do_each_pid_task(session, PIDTYPE_SID, p) {
2934                 printk(KERN_NOTICE "SAK: killed process %d"
2935                         " (%s): task_session(p)==tty->session\n",
2936                         task_pid_nr(p), p->comm);
2937                 send_sig(SIGKILL, p, 1);
2938         } while_each_pid_task(session, PIDTYPE_SID, p);
2939         /* Now kill any processes that happen to have the
2940          * tty open.
2941          */
2942         do_each_thread(g, p) {
2943                 if (p->signal->tty == tty) {
2944                         printk(KERN_NOTICE "SAK: killed process %d"
2945                             " (%s): task_session(p)==tty->session\n",
2946                             task_pid_nr(p), p->comm);
2947                         send_sig(SIGKILL, p, 1);
2948                         continue;
2949                 }
2950                 task_lock(p);
2951                 i = iterate_fd(p->files, 0, this_tty, tty);
2952                 if (i != 0) {
2953                         printk(KERN_NOTICE "SAK: killed process %d"
2954                             " (%s): fd#%d opened to the tty\n",
2955                                     task_pid_nr(p), p->comm, i - 1);
2956                         force_sig(SIGKILL, p);
2957                 }
2958                 task_unlock(p);
2959         } while_each_thread(g, p);
2960         read_unlock(&tasklist_lock);
2961 #endif
2962 }
2963
2964 static void do_SAK_work(struct work_struct *work)
2965 {
2966         struct tty_struct *tty =
2967                 container_of(work, struct tty_struct, SAK_work);
2968         __do_SAK(tty);
2969 }
2970
2971 /*
2972  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2973  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2974  * the values which we write to it will be identical to the values which it
2975  * already has. --akpm
2976  */
2977 void do_SAK(struct tty_struct *tty)
2978 {
2979         if (!tty)
2980                 return;
2981         schedule_work(&tty->SAK_work);
2982 }
2983
2984 EXPORT_SYMBOL(do_SAK);
2985
2986 static int dev_match_devt(struct device *dev, const void *data)
2987 {
2988         const dev_t *devt = data;
2989         return dev->devt == *devt;
2990 }
2991
2992 /* Must put_device() after it's unused! */
2993 static struct device *tty_get_device(struct tty_struct *tty)
2994 {
2995         dev_t devt = tty_devnum(tty);
2996         return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2997 }
2998
2999
3000 /**
3001  *      initialize_tty_struct
3002  *      @tty: tty to initialize
3003  *
3004  *      This subroutine initializes a tty structure that has been newly
3005  *      allocated.
3006  *
3007  *      Locking: none - tty in question must not be exposed at this point
3008  */
3009
3010 void initialize_tty_struct(struct tty_struct *tty,
3011                 struct tty_driver *driver, int idx)
3012 {
3013         memset(tty, 0, sizeof(struct tty_struct));
3014         kref_init(&tty->kref);
3015         tty->magic = TTY_MAGIC;
3016         tty_ldisc_init(tty);
3017         tty->session = NULL;
3018         tty->pgrp = NULL;
3019         mutex_init(&tty->legacy_mutex);
3020         mutex_init(&tty->termios_mutex);
3021         mutex_init(&tty->ldisc_mutex);
3022         init_waitqueue_head(&tty->write_wait);
3023         init_waitqueue_head(&tty->read_wait);
3024         INIT_WORK(&tty->hangup_work, do_tty_hangup);
3025         mutex_init(&tty->atomic_write_lock);
3026         spin_lock_init(&tty->ctrl_lock);
3027         INIT_LIST_HEAD(&tty->tty_files);
3028         INIT_WORK(&tty->SAK_work, do_SAK_work);
3029
3030         tty->driver = driver;
3031         tty->ops = driver->ops;
3032         tty->index = idx;
3033         tty_line_name(driver, idx, tty->name);
3034         tty->dev = tty_get_device(tty);
3035 }
3036
3037 /**
3038  *      deinitialize_tty_struct
3039  *      @tty: tty to deinitialize
3040  *
3041  *      This subroutine deinitializes a tty structure that has been newly
3042  *      allocated but tty_release cannot be called on that yet.
3043  *
3044  *      Locking: none - tty in question must not be exposed at this point
3045  */
3046 void deinitialize_tty_struct(struct tty_struct *tty)
3047 {
3048         tty_ldisc_deinit(tty);
3049 }
3050
3051 /**
3052  *      tty_put_char    -       write one character to a tty
3053  *      @tty: tty
3054  *      @ch: character
3055  *
3056  *      Write one byte to the tty using the provided put_char method
3057  *      if present. Returns the number of characters successfully output.
3058  *
3059  *      Note: the specific put_char operation in the driver layer may go
3060  *      away soon. Don't call it directly, use this method
3061  */
3062
3063 int tty_put_char(struct tty_struct *tty, unsigned char ch)
3064 {
3065         if (tty->ops->put_char)
3066                 return tty->ops->put_char(tty, ch);
3067         return tty->ops->write(tty, &ch, 1);
3068 }
3069 EXPORT_SYMBOL_GPL(tty_put_char);
3070
3071 struct class *tty_class;
3072
3073 static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3074                 unsigned int index, unsigned int count)
3075 {
3076         /* init here, since reused cdevs cause crashes */
3077         cdev_init(&driver->cdevs[index], &tty_fops);
3078         driver->cdevs[index].owner = driver->owner;
3079         return cdev_add(&driver->cdevs[index], dev, count);
3080 }
3081
3082 /**
3083  *      tty_register_device - register a tty device
3084  *      @driver: the tty driver that describes the tty device
3085  *      @index: the index in the tty driver for this tty device
3086  *      @device: a struct device that is associated with this tty device.
3087  *              This field is optional, if there is no known struct device
3088  *              for this tty device it can be set to NULL safely.
3089  *
3090  *      Returns a pointer to the struct device for this tty device
3091  *      (or ERR_PTR(-EFOO) on error).
3092  *
3093  *      This call is required to be made to register an individual tty device
3094  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3095  *      that bit is not set, this function should not be called by a tty
3096  *      driver.
3097  *
3098  *      Locking: ??
3099  */
3100
3101 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3102                                    struct device *device)
3103 {
3104         return tty_register_device_attr(driver, index, device, NULL, NULL);
3105 }
3106 EXPORT_SYMBOL(tty_register_device);
3107
3108 static void tty_device_create_release(struct device *dev)
3109 {
3110         pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
3111         kfree(dev);
3112 }
3113
3114 /**
3115  *      tty_register_device_attr - register a tty device
3116  *      @driver: the tty driver that describes the tty device
3117  *      @index: the index in the tty driver for this tty device
3118  *      @device: a struct device that is associated with this tty device.
3119  *              This field is optional, if there is no known struct device
3120  *              for this tty device it can be set to NULL safely.
3121  *      @drvdata: Driver data to be set to device.
3122  *      @attr_grp: Attribute group to be set on device.
3123  *
3124  *      Returns a pointer to the struct device for this tty device
3125  *      (or ERR_PTR(-EFOO) on error).
3126  *
3127  *      This call is required to be made to register an individual tty device
3128  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3129  *      that bit is not set, this function should not be called by a tty
3130  *      driver.
3131  *
3132  *      Locking: ??
3133  */
3134 struct device *tty_register_device_attr(struct tty_driver *driver,
3135                                    unsigned index, struct device *device,
3136                                    void *drvdata,
3137                                    const struct attribute_group **attr_grp)
3138 {
3139         char name[64];
3140         dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3141         struct device *dev = NULL;
3142         int retval = -ENODEV;
3143         bool cdev = false;
3144
3145         if (index >= driver->num) {
3146                 printk(KERN_ERR "Attempt to register invalid tty line number "
3147                        " (%d).\n", index);
3148                 return ERR_PTR(-EINVAL);
3149         }
3150
3151         if (driver->type == TTY_DRIVER_TYPE_PTY)
3152                 pty_line_name(driver, index, name);
3153         else
3154                 tty_line_name(driver, index, name);
3155
3156         if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3157                 retval = tty_cdev_add(driver, devt, index, 1);
3158                 if (retval)
3159                         goto error;
3160                 cdev = true;
3161         }
3162
3163         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3164         if (!dev) {
3165                 retval = -ENOMEM;
3166                 goto error;
3167         }
3168
3169         dev->devt = devt;
3170         dev->class = tty_class;
3171         dev->parent = device;
3172         dev->release = tty_device_create_release;
3173         dev_set_name(dev, "%s", name);
3174         dev->groups = attr_grp;
3175         dev_set_drvdata(dev, drvdata);
3176
3177         retval = device_register(dev);
3178         if (retval)
3179                 goto error;
3180
3181         return dev;
3182
3183 error:
3184         put_device(dev);
3185         if (cdev)
3186                 cdev_del(&driver->cdevs[index]);
3187         return ERR_PTR(retval);
3188 }
3189 EXPORT_SYMBOL_GPL(tty_register_device_attr);
3190
3191 /**
3192  *      tty_unregister_device - unregister a tty device
3193  *      @driver: the tty driver that describes the tty device
3194  *      @index: the index in the tty driver for this tty device
3195  *
3196  *      If a tty device is registered with a call to tty_register_device() then
3197  *      this function must be called when the tty device is gone.
3198  *
3199  *      Locking: ??
3200  */
3201
3202 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3203 {
3204         device_destroy(tty_class,
3205                 MKDEV(driver->major, driver->minor_start) + index);
3206         if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC))
3207                 cdev_del(&driver->cdevs[index]);
3208 }
3209 EXPORT_SYMBOL(tty_unregister_device);
3210
3211 /**
3212  * __tty_alloc_driver -- allocate tty driver
3213  * @lines: count of lines this driver can handle at most
3214  * @owner: module which is repsonsible for this driver
3215  * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3216  *
3217  * This should not be called directly, some of the provided macros should be
3218  * used instead. Use IS_ERR and friends on @retval.
3219  */
3220 struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3221                 unsigned long flags)
3222 {
3223         struct tty_driver *driver;
3224         unsigned int cdevs = 1;
3225         int err;
3226
3227         if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3228                 return ERR_PTR(-EINVAL);
3229
3230         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3231         if (!driver)
3232                 return ERR_PTR(-ENOMEM);
3233
3234         kref_init(&driver->kref);
3235         driver->magic = TTY_DRIVER_MAGIC;
3236         driver->num = lines;
3237         driver->owner = owner;
3238         driver->flags = flags;
3239
3240         if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3241                 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3242                                 GFP_KERNEL);
3243                 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3244                                 GFP_KERNEL);
3245                 if (!driver->ttys || !driver->termios) {
3246                         err = -ENOMEM;
3247                         goto err_free_all;
3248                 }
3249         }
3250
3251         if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3252                 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3253                                 GFP_KERNEL);
3254                 if (!driver->ports) {
3255                         err = -ENOMEM;
3256                         goto err_free_all;
3257                 }
3258                 cdevs = lines;
3259         }
3260
3261         driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3262         if (!driver->cdevs) {
3263                 err = -ENOMEM;
3264                 goto err_free_all;
3265         }
3266
3267         return driver;
3268 err_free_all:
3269         kfree(driver->ports);
3270         kfree(driver->ttys);
3271         kfree(driver->termios);
3272         kfree(driver);
3273         return ERR_PTR(err);
3274 }
3275 EXPORT_SYMBOL(__tty_alloc_driver);
3276
3277 static void destruct_tty_driver(struct kref *kref)
3278 {
3279         struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3280         int i;
3281         struct ktermios *tp;
3282
3283         if (driver->flags & TTY_DRIVER_INSTALLED) {
3284                 /*
3285                  * Free the termios and termios_locked structures because
3286                  * we don't want to get memory leaks when modular tty
3287                  * drivers are removed from the kernel.
3288                  */
3289                 for (i = 0; i < driver->num; i++) {
3290                         tp = driver->termios[i];
3291                         if (tp) {
3292                                 driver->termios[i] = NULL;
3293                                 kfree(tp);
3294                         }
3295                         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3296                                 tty_unregister_device(driver, i);
3297                 }
3298                 proc_tty_unregister_driver(driver);
3299                 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3300                         cdev_del(&driver->cdevs[0]);
3301         }
3302         kfree(driver->cdevs);
3303         kfree(driver->ports);
3304         kfree(driver->termios);
3305         kfree(driver->ttys);
3306         kfree(driver);
3307 }
3308
3309 void tty_driver_kref_put(struct tty_driver *driver)
3310 {
3311         kref_put(&driver->kref, destruct_tty_driver);
3312 }
3313 EXPORT_SYMBOL(tty_driver_kref_put);
3314
3315 void tty_set_operations(struct tty_driver *driver,
3316                         const struct tty_operations *op)
3317 {
3318         driver->ops = op;
3319 };
3320 EXPORT_SYMBOL(tty_set_operations);
3321
3322 void put_tty_driver(struct tty_driver *d)
3323 {
3324         tty_driver_kref_put(d);
3325 }
3326 EXPORT_SYMBOL(put_tty_driver);
3327
3328 /*
3329  * Called by a tty driver to register itself.
3330  */
3331 int tty_register_driver(struct tty_driver *driver)
3332 {
3333         int error;
3334         int i;
3335         dev_t dev;
3336         struct device *d;
3337
3338         if (!driver->major) {
3339                 error = alloc_chrdev_region(&dev, driver->minor_start,
3340                                                 driver->num, driver->name);
3341                 if (!error) {
3342                         driver->major = MAJOR(dev);
3343                         driver->minor_start = MINOR(dev);
3344                 }
3345         } else {
3346                 dev = MKDEV(driver->major, driver->minor_start);
3347                 error = register_chrdev_region(dev, driver->num, driver->name);
3348         }
3349         if (error < 0)
3350                 goto err;
3351
3352         if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3353                 error = tty_cdev_add(driver, dev, 0, driver->num);
3354                 if (error)
3355                         goto err_unreg_char;
3356         }
3357
3358         mutex_lock(&tty_mutex);
3359         list_add(&driver->tty_drivers, &tty_drivers);
3360         mutex_unlock(&tty_mutex);
3361
3362         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3363                 for (i = 0; i < driver->num; i++) {
3364                         d = tty_register_device(driver, i, NULL);
3365                         if (IS_ERR(d)) {
3366                                 error = PTR_ERR(d);
3367                                 goto err_unreg_devs;
3368                         }
3369                 }
3370         }
3371         proc_tty_register_driver(driver);
3372         driver->flags |= TTY_DRIVER_INSTALLED;
3373         return 0;
3374
3375 err_unreg_devs:
3376         for (i--; i >= 0; i--)
3377                 tty_unregister_device(driver, i);
3378
3379         mutex_lock(&tty_mutex);
3380         list_del(&driver->tty_drivers);
3381         mutex_unlock(&tty_mutex);
3382
3383 err_unreg_char:
3384         unregister_chrdev_region(dev, driver->num);
3385 err:
3386         return error;
3387 }
3388 EXPORT_SYMBOL(tty_register_driver);
3389
3390 /*
3391  * Called by a tty driver to unregister itself.
3392  */
3393 int tty_unregister_driver(struct tty_driver *driver)
3394 {
3395 #if 0
3396         /* FIXME */
3397         if (driver->refcount)
3398                 return -EBUSY;
3399 #endif
3400         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3401                                 driver->num);
3402         mutex_lock(&tty_mutex);
3403         list_del(&driver->tty_drivers);
3404         mutex_unlock(&tty_mutex);
3405         return 0;
3406 }
3407
3408 EXPORT_SYMBOL(tty_unregister_driver);
3409
3410 dev_t tty_devnum(struct tty_struct *tty)
3411 {
3412         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3413 }
3414 EXPORT_SYMBOL(tty_devnum);
3415
3416 void proc_clear_tty(struct task_struct *p)
3417 {
3418         unsigned long flags;
3419         struct tty_struct *tty;
3420         spin_lock_irqsave(&p->sighand->siglock, flags);
3421         tty = p->signal->tty;
3422         p->signal->tty = NULL;
3423         spin_unlock_irqrestore(&p->sighand->siglock, flags);
3424         tty_kref_put(tty);
3425 }
3426
3427 /* Called under the sighand lock */
3428
3429 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3430 {
3431         if (tty) {
3432                 unsigned long flags;
3433                 /* We should not have a session or pgrp to put here but.... */
3434                 spin_lock_irqsave(&tty->ctrl_lock, flags);
3435                 put_pid(tty->session);
3436                 put_pid(tty->pgrp);
3437                 tty->pgrp = get_pid(task_pgrp(tsk));
3438                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3439                 tty->session = get_pid(task_session(tsk));
3440                 if (tsk->signal->tty) {
3441                         printk(KERN_DEBUG "tty not NULL!!\n");
3442                         tty_kref_put(tsk->signal->tty);
3443                 }
3444         }
3445         put_pid(tsk->signal->tty_old_pgrp);
3446         tsk->signal->tty = tty_kref_get(tty);
3447         tsk->signal->tty_old_pgrp = NULL;
3448 }
3449
3450 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3451 {
3452         spin_lock_irq(&tsk->sighand->siglock);
3453         __proc_set_tty(tsk, tty);
3454         spin_unlock_irq(&tsk->sighand->siglock);
3455 }
3456
3457 struct tty_struct *get_current_tty(void)
3458 {
3459         struct tty_struct *tty;
3460         unsigned long flags;
3461
3462         spin_lock_irqsave(&current->sighand->siglock, flags);
3463         tty = tty_kref_get(current->signal->tty);
3464         spin_unlock_irqrestore(&current->sighand->siglock, flags);
3465         return tty;
3466 }
3467 EXPORT_SYMBOL_GPL(get_current_tty);
3468
3469 void tty_default_fops(struct file_operations *fops)
3470 {
3471         *fops = tty_fops;
3472 }
3473
3474 /*
3475  * Initialize the console device. This is called *early*, so
3476  * we can't necessarily depend on lots of kernel help here.
3477  * Just do some early initializations, and do the complex setup
3478  * later.
3479  */
3480 void __init console_init(void)
3481 {
3482         initcall_t *call;
3483
3484         /* Setup the default TTY line discipline. */
3485         tty_ldisc_begin();
3486
3487         /*
3488          * set up the console device so that later boot sequences can
3489          * inform about problems etc..
3490          */
3491         call = __con_initcall_start;
3492         while (call < __con_initcall_end) {
3493                 (*call)();
3494                 call++;
3495         }
3496 }
3497
3498 static char *tty_devnode(struct device *dev, umode_t *mode)
3499 {
3500         if (!mode)
3501                 return NULL;
3502         if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3503             dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3504                 *mode = 0666;
3505         return NULL;
3506 }
3507
3508 static int __init tty_class_init(void)
3509 {
3510         tty_class = class_create(THIS_MODULE, "tty");
3511         if (IS_ERR(tty_class))
3512                 return PTR_ERR(tty_class);
3513         tty_class->devnode = tty_devnode;
3514         return 0;
3515 }
3516
3517 postcore_initcall(tty_class_init);
3518
3519 /* 3/2004 jmc: why do these devices exist? */
3520 static struct cdev tty_cdev, console_cdev;
3521
3522 static ssize_t show_cons_active(struct device *dev,
3523                                 struct device_attribute *attr, char *buf)
3524 {
3525         struct console *cs[16];
3526         int i = 0;
3527         struct console *c;
3528         ssize_t count = 0;
3529
3530         console_lock();
3531         for_each_console(c) {
3532                 if (!c->device)
3533                         continue;
3534                 if (!c->write)
3535                         continue;
3536                 if ((c->flags & CON_ENABLED) == 0)
3537                         continue;
3538                 cs[i++] = c;
3539                 if (i >= ARRAY_SIZE(cs))
3540                         break;
3541         }
3542         while (i--) {
3543                 int index = cs[i]->index;
3544                 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3545
3546                 /* don't resolve tty0 as some programs depend on it */
3547                 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3548                         count += tty_line_name(drv, index, buf + count);
3549                 else
3550                         count += sprintf(buf + count, "%s%d",
3551                                          cs[i]->name, cs[i]->index);
3552
3553                 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3554         }
3555         console_unlock();
3556
3557         return count;
3558 }
3559 static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3560
3561 static struct device *consdev;
3562
3563 void console_sysfs_notify(void)
3564 {
3565         if (consdev)
3566                 sysfs_notify(&consdev->kobj, NULL, "active");
3567 }
3568
3569 /*
3570  * Ok, now we can initialize the rest of the tty devices and can count
3571  * on memory allocations, interrupts etc..
3572  */
3573 int __init tty_init(void)
3574 {
3575         cdev_init(&tty_cdev, &tty_fops);
3576         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3577             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3578                 panic("Couldn't register /dev/tty driver\n");
3579         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3580
3581         cdev_init(&console_cdev, &console_fops);
3582         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3583             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3584                 panic("Couldn't register /dev/console driver\n");
3585         consdev = device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3586                               "console");
3587         if (IS_ERR(consdev))
3588                 consdev = NULL;
3589         else
3590                 WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
3591
3592 #ifdef CONFIG_VT
3593         vty_init(&console_fops);
3594 #endif
3595         return 0;
3596 }
3597