xref: /openbmc/linux/drivers/tty/tty_io.c (revision 6774def6)
1 /*
2  *  Copyright (C) 1991, 1992  Linus Torvalds
3  */
4 
5 /*
6  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7  * or rs-channels. It also implements echoing, cooked mode etc.
8  *
9  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10  *
11  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12  * tty_struct and tty_queue structures.  Previously there was an array
13  * of 256 tty_struct's which was statically allocated, and the
14  * tty_queue structures were allocated at boot time.  Both are now
15  * dynamically allocated only when the tty is open.
16  *
17  * Also restructured routines so that there is more of a separation
18  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19  * the low-level tty routines (serial.c, pty.c, console.c).  This
20  * makes for cleaner and more compact code.  -TYT, 9/17/92
21  *
22  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23  * which can be dynamically activated and de-activated by the line
24  * discipline handling modules (like SLIP).
25  *
26  * NOTE: pay no attention to the line discipline code (yet); its
27  * interface is still subject to change in this version...
28  * -- TYT, 1/31/92
29  *
30  * Added functionality to the OPOST tty handling.  No delays, but all
31  * other bits should be there.
32  *	-- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33  *
34  * Rewrote canonical mode and added more termios flags.
35  * 	-- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36  *
37  * Reorganized FASYNC support so mouse code can share it.
38  *	-- ctm@ardi.com, 9Sep95
39  *
40  * New TIOCLINUX variants added.
41  *	-- mj@k332.feld.cvut.cz, 19-Nov-95
42  *
43  * Restrict vt switching via ioctl()
44  *      -- grif@cs.ucr.edu, 5-Dec-95
45  *
46  * Move console and virtual terminal code to more appropriate files,
47  * implement CONFIG_VT and generalize console device interface.
48  *	-- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49  *
50  * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51  *	-- Bill Hawes <whawes@star.net>, June 97
52  *
53  * Added devfs support.
54  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55  *
56  * Added support for a Unix98-style ptmx device.
57  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58  *
59  * Reduced memory usage for older ARM systems
60  *      -- Russell King <rmk@arm.linux.org.uk>
61  *
62  * Move do_SAK() into process context.  Less stack use in devfs functions.
63  * alloc_tty_struct() always uses kmalloc()
64  *			 -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65  */
66 
67 #include <linux/types.h>
68 #include <linux/major.h>
69 #include <linux/errno.h>
70 #include <linux/signal.h>
71 #include <linux/fcntl.h>
72 #include <linux/sched.h>
73 #include <linux/interrupt.h>
74 #include <linux/tty.h>
75 #include <linux/tty_driver.h>
76 #include <linux/tty_flip.h>
77 #include <linux/devpts_fs.h>
78 #include <linux/file.h>
79 #include <linux/fdtable.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/device.h>
92 #include <linux/wait.h>
93 #include <linux/bitops.h>
94 #include <linux/delay.h>
95 #include <linux/seq_file.h>
96 #include <linux/serial.h>
97 #include <linux/ratelimit.h>
98 
99 #include <linux/uaccess.h>
100 
101 #include <linux/kbd_kern.h>
102 #include <linux/vt_kern.h>
103 #include <linux/selection.h>
104 
105 #include <linux/kmod.h>
106 #include <linux/nsproxy.h>
107 
108 #undef TTY_DEBUG_HANGUP
109 
110 #define TTY_PARANOIA_CHECK 1
111 #define CHECK_TTY_COUNT 1
112 
113 struct ktermios tty_std_termios = {	/* for the benefit of tty drivers  */
114 	.c_iflag = ICRNL | IXON,
115 	.c_oflag = OPOST | ONLCR,
116 	.c_cflag = B38400 | CS8 | CREAD | HUPCL,
117 	.c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
118 		   ECHOCTL | ECHOKE | IEXTEN,
119 	.c_cc = INIT_C_CC,
120 	.c_ispeed = 38400,
121 	.c_ospeed = 38400
122 };
123 
124 EXPORT_SYMBOL(tty_std_termios);
125 
126 /* This list gets poked at by procfs and various bits of boot up code. This
127    could do with some rationalisation such as pulling the tty proc function
128    into this file */
129 
130 LIST_HEAD(tty_drivers);			/* linked list of tty drivers */
131 
132 /* Mutex to protect creating and releasing a tty. This is shared with
133    vt.c for deeply disgusting hack reasons */
134 DEFINE_MUTEX(tty_mutex);
135 EXPORT_SYMBOL(tty_mutex);
136 
137 /* Spinlock to protect the tty->tty_files list */
138 DEFINE_SPINLOCK(tty_files_lock);
139 
140 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
141 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
142 ssize_t redirected_tty_write(struct file *, const char __user *,
143 							size_t, loff_t *);
144 static unsigned int tty_poll(struct file *, poll_table *);
145 static int tty_open(struct inode *, struct file *);
146 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
147 #ifdef CONFIG_COMPAT
148 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
149 				unsigned long arg);
150 #else
151 #define tty_compat_ioctl NULL
152 #endif
153 static int __tty_fasync(int fd, struct file *filp, int on);
154 static int tty_fasync(int fd, struct file *filp, int on);
155 static void release_tty(struct tty_struct *tty, int idx);
156 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158 
159 /**
160  *	free_tty_struct		-	free a disused tty
161  *	@tty: tty struct to free
162  *
163  *	Free the write buffers, tty queue and tty memory itself.
164  *
165  *	Locking: none. Must be called after tty is definitely unused
166  */
167 
168 void free_tty_struct(struct tty_struct *tty)
169 {
170 	if (!tty)
171 		return;
172 	if (tty->dev)
173 		put_device(tty->dev);
174 	kfree(tty->write_buf);
175 	tty->magic = 0xDEADDEAD;
176 	kfree(tty);
177 }
178 
179 static inline struct tty_struct *file_tty(struct file *file)
180 {
181 	return ((struct tty_file_private *)file->private_data)->tty;
182 }
183 
184 int tty_alloc_file(struct file *file)
185 {
186 	struct tty_file_private *priv;
187 
188 	priv = kmalloc(sizeof(*priv), GFP_KERNEL);
189 	if (!priv)
190 		return -ENOMEM;
191 
192 	file->private_data = priv;
193 
194 	return 0;
195 }
196 
197 /* Associate a new file with the tty structure */
198 void tty_add_file(struct tty_struct *tty, struct file *file)
199 {
200 	struct tty_file_private *priv = file->private_data;
201 
202 	priv->tty = tty;
203 	priv->file = file;
204 
205 	spin_lock(&tty_files_lock);
206 	list_add(&priv->list, &tty->tty_files);
207 	spin_unlock(&tty_files_lock);
208 }
209 
210 /**
211  * tty_free_file - free file->private_data
212  *
213  * This shall be used only for fail path handling when tty_add_file was not
214  * called yet.
215  */
216 void tty_free_file(struct file *file)
217 {
218 	struct tty_file_private *priv = file->private_data;
219 
220 	file->private_data = NULL;
221 	kfree(priv);
222 }
223 
224 /* Delete file from its tty */
225 static void tty_del_file(struct file *file)
226 {
227 	struct tty_file_private *priv = file->private_data;
228 
229 	spin_lock(&tty_files_lock);
230 	list_del(&priv->list);
231 	spin_unlock(&tty_files_lock);
232 	tty_free_file(file);
233 }
234 
235 
236 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
237 
238 /**
239  *	tty_name	-	return tty naming
240  *	@tty: tty structure
241  *	@buf: buffer for output
242  *
243  *	Convert a tty structure into a name. The name reflects the kernel
244  *	naming policy and if udev is in use may not reflect user space
245  *
246  *	Locking: none
247  */
248 
249 char *tty_name(struct tty_struct *tty, char *buf)
250 {
251 	if (!tty) /* Hmm.  NULL pointer.  That's fun. */
252 		strcpy(buf, "NULL tty");
253 	else
254 		strcpy(buf, tty->name);
255 	return buf;
256 }
257 
258 EXPORT_SYMBOL(tty_name);
259 
260 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
261 			      const char *routine)
262 {
263 #ifdef TTY_PARANOIA_CHECK
264 	if (!tty) {
265 		printk(KERN_WARNING
266 			"null TTY for (%d:%d) in %s\n",
267 			imajor(inode), iminor(inode), routine);
268 		return 1;
269 	}
270 	if (tty->magic != TTY_MAGIC) {
271 		printk(KERN_WARNING
272 			"bad magic number for tty struct (%d:%d) in %s\n",
273 			imajor(inode), iminor(inode), routine);
274 		return 1;
275 	}
276 #endif
277 	return 0;
278 }
279 
280 static int check_tty_count(struct tty_struct *tty, const char *routine)
281 {
282 #ifdef CHECK_TTY_COUNT
283 	struct list_head *p;
284 	int count = 0;
285 
286 	spin_lock(&tty_files_lock);
287 	list_for_each(p, &tty->tty_files) {
288 		count++;
289 	}
290 	spin_unlock(&tty_files_lock);
291 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
292 	    tty->driver->subtype == PTY_TYPE_SLAVE &&
293 	    tty->link && tty->link->count)
294 		count++;
295 	if (tty->count != count) {
296 		printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
297 				    "!= #fd's(%d) in %s\n",
298 		       tty->name, tty->count, count, routine);
299 		return count;
300 	}
301 #endif
302 	return 0;
303 }
304 
305 /**
306  *	get_tty_driver		-	find device of a tty
307  *	@dev_t: device identifier
308  *	@index: returns the index of the tty
309  *
310  *	This routine returns a tty driver structure, given a device number
311  *	and also passes back the index number.
312  *
313  *	Locking: caller must hold tty_mutex
314  */
315 
316 static struct tty_driver *get_tty_driver(dev_t device, int *index)
317 {
318 	struct tty_driver *p;
319 
320 	list_for_each_entry(p, &tty_drivers, tty_drivers) {
321 		dev_t base = MKDEV(p->major, p->minor_start);
322 		if (device < base || device >= base + p->num)
323 			continue;
324 		*index = device - base;
325 		return tty_driver_kref_get(p);
326 	}
327 	return NULL;
328 }
329 
330 #ifdef CONFIG_CONSOLE_POLL
331 
332 /**
333  *	tty_find_polling_driver	-	find device of a polled tty
334  *	@name: name string to match
335  *	@line: pointer to resulting tty line nr
336  *
337  *	This routine returns a tty driver structure, given a name
338  *	and the condition that the tty driver is capable of polled
339  *	operation.
340  */
341 struct tty_driver *tty_find_polling_driver(char *name, int *line)
342 {
343 	struct tty_driver *p, *res = NULL;
344 	int tty_line = 0;
345 	int len;
346 	char *str, *stp;
347 
348 	for (str = name; *str; str++)
349 		if ((*str >= '0' && *str <= '9') || *str == ',')
350 			break;
351 	if (!*str)
352 		return NULL;
353 
354 	len = str - name;
355 	tty_line = simple_strtoul(str, &str, 10);
356 
357 	mutex_lock(&tty_mutex);
358 	/* Search through the tty devices to look for a match */
359 	list_for_each_entry(p, &tty_drivers, tty_drivers) {
360 		if (strncmp(name, p->name, len) != 0)
361 			continue;
362 		stp = str;
363 		if (*stp == ',')
364 			stp++;
365 		if (*stp == '\0')
366 			stp = NULL;
367 
368 		if (tty_line >= 0 && tty_line < p->num && p->ops &&
369 		    p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
370 			res = tty_driver_kref_get(p);
371 			*line = tty_line;
372 			break;
373 		}
374 	}
375 	mutex_unlock(&tty_mutex);
376 
377 	return res;
378 }
379 EXPORT_SYMBOL_GPL(tty_find_polling_driver);
380 #endif
381 
382 /**
383  *	tty_check_change	-	check for POSIX terminal changes
384  *	@tty: tty to check
385  *
386  *	If we try to write to, or set the state of, a terminal and we're
387  *	not in the foreground, send a SIGTTOU.  If the signal is blocked or
388  *	ignored, go ahead and perform the operation.  (POSIX 7.2)
389  *
390  *	Locking: ctrl_lock
391  */
392 
393 int tty_check_change(struct tty_struct *tty)
394 {
395 	unsigned long flags;
396 	int ret = 0;
397 
398 	if (current->signal->tty != tty)
399 		return 0;
400 
401 	spin_lock_irqsave(&tty->ctrl_lock, flags);
402 
403 	if (!tty->pgrp) {
404 		printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
405 		goto out_unlock;
406 	}
407 	if (task_pgrp(current) == tty->pgrp)
408 		goto out_unlock;
409 	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
410 	if (is_ignored(SIGTTOU))
411 		goto out;
412 	if (is_current_pgrp_orphaned()) {
413 		ret = -EIO;
414 		goto out;
415 	}
416 	kill_pgrp(task_pgrp(current), SIGTTOU, 1);
417 	set_thread_flag(TIF_SIGPENDING);
418 	ret = -ERESTARTSYS;
419 out:
420 	return ret;
421 out_unlock:
422 	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
423 	return ret;
424 }
425 
426 EXPORT_SYMBOL(tty_check_change);
427 
428 static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
429 				size_t count, loff_t *ppos)
430 {
431 	return 0;
432 }
433 
434 static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
435 				 size_t count, loff_t *ppos)
436 {
437 	return -EIO;
438 }
439 
440 /* No kernel lock held - none needed ;) */
441 static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
442 {
443 	return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
444 }
445 
446 static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
447 		unsigned long arg)
448 {
449 	return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
450 }
451 
452 static long hung_up_tty_compat_ioctl(struct file *file,
453 				     unsigned int cmd, unsigned long arg)
454 {
455 	return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
456 }
457 
458 static const struct file_operations tty_fops = {
459 	.llseek		= no_llseek,
460 	.read		= tty_read,
461 	.write		= tty_write,
462 	.poll		= tty_poll,
463 	.unlocked_ioctl	= tty_ioctl,
464 	.compat_ioctl	= tty_compat_ioctl,
465 	.open		= tty_open,
466 	.release	= tty_release,
467 	.fasync		= tty_fasync,
468 };
469 
470 static const struct file_operations console_fops = {
471 	.llseek		= no_llseek,
472 	.read		= tty_read,
473 	.write		= redirected_tty_write,
474 	.poll		= tty_poll,
475 	.unlocked_ioctl	= tty_ioctl,
476 	.compat_ioctl	= tty_compat_ioctl,
477 	.open		= tty_open,
478 	.release	= tty_release,
479 	.fasync		= tty_fasync,
480 };
481 
482 static const struct file_operations hung_up_tty_fops = {
483 	.llseek		= no_llseek,
484 	.read		= hung_up_tty_read,
485 	.write		= hung_up_tty_write,
486 	.poll		= hung_up_tty_poll,
487 	.unlocked_ioctl	= hung_up_tty_ioctl,
488 	.compat_ioctl	= hung_up_tty_compat_ioctl,
489 	.release	= tty_release,
490 };
491 
492 static DEFINE_SPINLOCK(redirect_lock);
493 static struct file *redirect;
494 
495 /**
496  *	tty_wakeup	-	request more data
497  *	@tty: terminal
498  *
499  *	Internal and external helper for wakeups of tty. This function
500  *	informs the line discipline if present that the driver is ready
501  *	to receive more output data.
502  */
503 
504 void tty_wakeup(struct tty_struct *tty)
505 {
506 	struct tty_ldisc *ld;
507 
508 	if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
509 		ld = tty_ldisc_ref(tty);
510 		if (ld) {
511 			if (ld->ops->write_wakeup)
512 				ld->ops->write_wakeup(tty);
513 			tty_ldisc_deref(ld);
514 		}
515 	}
516 	wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
517 }
518 
519 EXPORT_SYMBOL_GPL(tty_wakeup);
520 
521 /**
522  *	tty_signal_session_leader	- sends SIGHUP to session leader
523  *	@tty		controlling tty
524  *	@exit_session	if non-zero, signal all foreground group processes
525  *
526  *	Send SIGHUP and SIGCONT to the session leader and its process group.
527  *	Optionally, signal all processes in the foreground process group.
528  *
529  *	Returns the number of processes in the session with this tty
530  *	as their controlling terminal. This value is used to drop
531  *	tty references for those processes.
532  */
533 static int tty_signal_session_leader(struct tty_struct *tty, int exit_session)
534 {
535 	struct task_struct *p;
536 	int refs = 0;
537 	struct pid *tty_pgrp = NULL;
538 
539 	read_lock(&tasklist_lock);
540 	if (tty->session) {
541 		do_each_pid_task(tty->session, PIDTYPE_SID, p) {
542 			spin_lock_irq(&p->sighand->siglock);
543 			if (p->signal->tty == tty) {
544 				p->signal->tty = NULL;
545 				/* We defer the dereferences outside fo
546 				   the tasklist lock */
547 				refs++;
548 			}
549 			if (!p->signal->leader) {
550 				spin_unlock_irq(&p->sighand->siglock);
551 				continue;
552 			}
553 			__group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
554 			__group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
555 			put_pid(p->signal->tty_old_pgrp);  /* A noop */
556 			spin_lock(&tty->ctrl_lock);
557 			tty_pgrp = get_pid(tty->pgrp);
558 			if (tty->pgrp)
559 				p->signal->tty_old_pgrp = get_pid(tty->pgrp);
560 			spin_unlock(&tty->ctrl_lock);
561 			spin_unlock_irq(&p->sighand->siglock);
562 		} while_each_pid_task(tty->session, PIDTYPE_SID, p);
563 	}
564 	read_unlock(&tasklist_lock);
565 
566 	if (tty_pgrp) {
567 		if (exit_session)
568 			kill_pgrp(tty_pgrp, SIGHUP, exit_session);
569 		put_pid(tty_pgrp);
570 	}
571 
572 	return refs;
573 }
574 
575 /**
576  *	__tty_hangup		-	actual handler for hangup events
577  *	@work: tty device
578  *
579  *	This can be called by a "kworker" kernel thread.  That is process
580  *	synchronous but doesn't hold any locks, so we need to make sure we
581  *	have the appropriate locks for what we're doing.
582  *
583  *	The hangup event clears any pending redirections onto the hung up
584  *	device. It ensures future writes will error and it does the needed
585  *	line discipline hangup and signal delivery. The tty object itself
586  *	remains intact.
587  *
588  *	Locking:
589  *		BTM
590  *		  redirect lock for undoing redirection
591  *		  file list lock for manipulating list of ttys
592  *		  tty_ldiscs_lock from called functions
593  *		  termios_rwsem resetting termios data
594  *		  tasklist_lock to walk task list for hangup event
595  *		    ->siglock to protect ->signal/->sighand
596  */
597 static void __tty_hangup(struct tty_struct *tty, int exit_session)
598 {
599 	struct file *cons_filp = NULL;
600 	struct file *filp, *f = NULL;
601 	struct tty_file_private *priv;
602 	int    closecount = 0, n;
603 	int refs;
604 
605 	if (!tty)
606 		return;
607 
608 
609 	spin_lock(&redirect_lock);
610 	if (redirect && file_tty(redirect) == tty) {
611 		f = redirect;
612 		redirect = NULL;
613 	}
614 	spin_unlock(&redirect_lock);
615 
616 	tty_lock(tty);
617 
618 	if (test_bit(TTY_HUPPED, &tty->flags)) {
619 		tty_unlock(tty);
620 		return;
621 	}
622 
623 	/* some functions below drop BTM, so we need this bit */
624 	set_bit(TTY_HUPPING, &tty->flags);
625 
626 	/* inuse_filps is protected by the single tty lock,
627 	   this really needs to change if we want to flush the
628 	   workqueue with the lock held */
629 	check_tty_count(tty, "tty_hangup");
630 
631 	spin_lock(&tty_files_lock);
632 	/* This breaks for file handles being sent over AF_UNIX sockets ? */
633 	list_for_each_entry(priv, &tty->tty_files, list) {
634 		filp = priv->file;
635 		if (filp->f_op->write == redirected_tty_write)
636 			cons_filp = filp;
637 		if (filp->f_op->write != tty_write)
638 			continue;
639 		closecount++;
640 		__tty_fasync(-1, filp, 0);	/* can't block */
641 		filp->f_op = &hung_up_tty_fops;
642 	}
643 	spin_unlock(&tty_files_lock);
644 
645 	refs = tty_signal_session_leader(tty, exit_session);
646 	/* Account for the p->signal references we killed */
647 	while (refs--)
648 		tty_kref_put(tty);
649 
650 	/*
651 	 * it drops BTM and thus races with reopen
652 	 * we protect the race by TTY_HUPPING
653 	 */
654 	tty_ldisc_hangup(tty);
655 
656 	spin_lock_irq(&tty->ctrl_lock);
657 	clear_bit(TTY_THROTTLED, &tty->flags);
658 	clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
659 	put_pid(tty->session);
660 	put_pid(tty->pgrp);
661 	tty->session = NULL;
662 	tty->pgrp = NULL;
663 	tty->ctrl_status = 0;
664 	spin_unlock_irq(&tty->ctrl_lock);
665 
666 	/*
667 	 * If one of the devices matches a console pointer, we
668 	 * cannot just call hangup() because that will cause
669 	 * tty->count and state->count to go out of sync.
670 	 * So we just call close() the right number of times.
671 	 */
672 	if (cons_filp) {
673 		if (tty->ops->close)
674 			for (n = 0; n < closecount; n++)
675 				tty->ops->close(tty, cons_filp);
676 	} else if (tty->ops->hangup)
677 		tty->ops->hangup(tty);
678 	/*
679 	 * We don't want to have driver/ldisc interactions beyond
680 	 * the ones we did here. The driver layer expects no
681 	 * calls after ->hangup() from the ldisc side. However we
682 	 * can't yet guarantee all that.
683 	 */
684 	set_bit(TTY_HUPPED, &tty->flags);
685 	clear_bit(TTY_HUPPING, &tty->flags);
686 
687 	tty_unlock(tty);
688 
689 	if (f)
690 		fput(f);
691 }
692 
693 static void do_tty_hangup(struct work_struct *work)
694 {
695 	struct tty_struct *tty =
696 		container_of(work, struct tty_struct, hangup_work);
697 
698 	__tty_hangup(tty, 0);
699 }
700 
701 /**
702  *	tty_hangup		-	trigger a hangup event
703  *	@tty: tty to hangup
704  *
705  *	A carrier loss (virtual or otherwise) has occurred on this like
706  *	schedule a hangup sequence to run after this event.
707  */
708 
709 void tty_hangup(struct tty_struct *tty)
710 {
711 #ifdef TTY_DEBUG_HANGUP
712 	char	buf[64];
713 	printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
714 #endif
715 	schedule_work(&tty->hangup_work);
716 }
717 
718 EXPORT_SYMBOL(tty_hangup);
719 
720 /**
721  *	tty_vhangup		-	process vhangup
722  *	@tty: tty to hangup
723  *
724  *	The user has asked via system call for the terminal to be hung up.
725  *	We do this synchronously so that when the syscall returns the process
726  *	is complete. That guarantee is necessary for security reasons.
727  */
728 
729 void tty_vhangup(struct tty_struct *tty)
730 {
731 #ifdef TTY_DEBUG_HANGUP
732 	char	buf[64];
733 
734 	printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
735 #endif
736 	__tty_hangup(tty, 0);
737 }
738 
739 EXPORT_SYMBOL(tty_vhangup);
740 
741 
742 /**
743  *	tty_vhangup_self	-	process vhangup for own ctty
744  *
745  *	Perform a vhangup on the current controlling tty
746  */
747 
748 void tty_vhangup_self(void)
749 {
750 	struct tty_struct *tty;
751 
752 	tty = get_current_tty();
753 	if (tty) {
754 		tty_vhangup(tty);
755 		tty_kref_put(tty);
756 	}
757 }
758 
759 /**
760  *	tty_vhangup_session		-	hangup session leader exit
761  *	@tty: tty to hangup
762  *
763  *	The session leader is exiting and hanging up its controlling terminal.
764  *	Every process in the foreground process group is signalled SIGHUP.
765  *
766  *	We do this synchronously so that when the syscall returns the process
767  *	is complete. That guarantee is necessary for security reasons.
768  */
769 
770 static void tty_vhangup_session(struct tty_struct *tty)
771 {
772 #ifdef TTY_DEBUG_HANGUP
773 	char	buf[64];
774 
775 	printk(KERN_DEBUG "%s vhangup session...\n", tty_name(tty, buf));
776 #endif
777 	__tty_hangup(tty, 1);
778 }
779 
780 /**
781  *	tty_hung_up_p		-	was tty hung up
782  *	@filp: file pointer of tty
783  *
784  *	Return true if the tty has been subject to a vhangup or a carrier
785  *	loss
786  */
787 
788 int tty_hung_up_p(struct file *filp)
789 {
790 	return (filp->f_op == &hung_up_tty_fops);
791 }
792 
793 EXPORT_SYMBOL(tty_hung_up_p);
794 
795 static void session_clear_tty(struct pid *session)
796 {
797 	struct task_struct *p;
798 	do_each_pid_task(session, PIDTYPE_SID, p) {
799 		proc_clear_tty(p);
800 	} while_each_pid_task(session, PIDTYPE_SID, p);
801 }
802 
803 /**
804  *	disassociate_ctty	-	disconnect controlling tty
805  *	@on_exit: true if exiting so need to "hang up" the session
806  *
807  *	This function is typically called only by the session leader, when
808  *	it wants to disassociate itself from its controlling tty.
809  *
810  *	It performs the following functions:
811  * 	(1)  Sends a SIGHUP and SIGCONT to the foreground process group
812  * 	(2)  Clears the tty from being controlling the session
813  * 	(3)  Clears the controlling tty for all processes in the
814  * 		session group.
815  *
816  *	The argument on_exit is set to 1 if called when a process is
817  *	exiting; it is 0 if called by the ioctl TIOCNOTTY.
818  *
819  *	Locking:
820  *		BTM is taken for hysterical raisins, and held when
821  *		  called from no_tty().
822  *		  tty_mutex is taken to protect tty
823  *		  ->siglock is taken to protect ->signal/->sighand
824  *		  tasklist_lock is taken to walk process list for sessions
825  *		    ->siglock is taken to protect ->signal/->sighand
826  */
827 
828 void disassociate_ctty(int on_exit)
829 {
830 	struct tty_struct *tty;
831 
832 	if (!current->signal->leader)
833 		return;
834 
835 	tty = get_current_tty();
836 	if (tty) {
837 		if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY) {
838 			tty_vhangup_session(tty);
839 		} else {
840 			struct pid *tty_pgrp = tty_get_pgrp(tty);
841 			if (tty_pgrp) {
842 				kill_pgrp(tty_pgrp, SIGHUP, on_exit);
843 				if (!on_exit)
844 					kill_pgrp(tty_pgrp, SIGCONT, on_exit);
845 				put_pid(tty_pgrp);
846 			}
847 		}
848 		tty_kref_put(tty);
849 
850 	} else if (on_exit) {
851 		struct pid *old_pgrp;
852 		spin_lock_irq(&current->sighand->siglock);
853 		old_pgrp = current->signal->tty_old_pgrp;
854 		current->signal->tty_old_pgrp = NULL;
855 		spin_unlock_irq(&current->sighand->siglock);
856 		if (old_pgrp) {
857 			kill_pgrp(old_pgrp, SIGHUP, on_exit);
858 			kill_pgrp(old_pgrp, SIGCONT, on_exit);
859 			put_pid(old_pgrp);
860 		}
861 		return;
862 	}
863 
864 	spin_lock_irq(&current->sighand->siglock);
865 	put_pid(current->signal->tty_old_pgrp);
866 	current->signal->tty_old_pgrp = NULL;
867 
868 	tty = tty_kref_get(current->signal->tty);
869 	if (tty) {
870 		unsigned long flags;
871 		spin_lock_irqsave(&tty->ctrl_lock, flags);
872 		put_pid(tty->session);
873 		put_pid(tty->pgrp);
874 		tty->session = NULL;
875 		tty->pgrp = NULL;
876 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
877 		tty_kref_put(tty);
878 	} else {
879 #ifdef TTY_DEBUG_HANGUP
880 		printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
881 		       " = NULL", tty);
882 #endif
883 	}
884 
885 	spin_unlock_irq(&current->sighand->siglock);
886 	/* Now clear signal->tty under the lock */
887 	read_lock(&tasklist_lock);
888 	session_clear_tty(task_session(current));
889 	read_unlock(&tasklist_lock);
890 }
891 
892 /**
893  *
894  *	no_tty	- Ensure the current process does not have a controlling tty
895  */
896 void no_tty(void)
897 {
898 	/* FIXME: Review locking here. The tty_lock never covered any race
899 	   between a new association and proc_clear_tty but possible we need
900 	   to protect against this anyway */
901 	struct task_struct *tsk = current;
902 	disassociate_ctty(0);
903 	proc_clear_tty(tsk);
904 }
905 
906 
907 /**
908  *	stop_tty	-	propagate flow control
909  *	@tty: tty to stop
910  *
911  *	Perform flow control to the driver. May be called
912  *	on an already stopped device and will not re-call the driver
913  *	method.
914  *
915  *	This functionality is used by both the line disciplines for
916  *	halting incoming flow and by the driver. It may therefore be
917  *	called from any context, may be under the tty atomic_write_lock
918  *	but not always.
919  *
920  *	Locking:
921  *		flow_lock
922  */
923 
924 void __stop_tty(struct tty_struct *tty)
925 {
926 	if (tty->stopped)
927 		return;
928 	tty->stopped = 1;
929 	if (tty->ops->stop)
930 		(tty->ops->stop)(tty);
931 }
932 
933 void stop_tty(struct tty_struct *tty)
934 {
935 	unsigned long flags;
936 
937 	spin_lock_irqsave(&tty->flow_lock, flags);
938 	__stop_tty(tty);
939 	spin_unlock_irqrestore(&tty->flow_lock, flags);
940 }
941 EXPORT_SYMBOL(stop_tty);
942 
943 /**
944  *	start_tty	-	propagate flow control
945  *	@tty: tty to start
946  *
947  *	Start a tty that has been stopped if at all possible. If this
948  *	tty was previous stopped and is now being started, the driver
949  *	start method is invoked and the line discipline woken.
950  *
951  *	Locking:
952  *		flow_lock
953  */
954 
955 void __start_tty(struct tty_struct *tty)
956 {
957 	if (!tty->stopped || tty->flow_stopped)
958 		return;
959 	tty->stopped = 0;
960 	if (tty->ops->start)
961 		(tty->ops->start)(tty);
962 	tty_wakeup(tty);
963 }
964 
965 void start_tty(struct tty_struct *tty)
966 {
967 	unsigned long flags;
968 
969 	spin_lock_irqsave(&tty->flow_lock, flags);
970 	__start_tty(tty);
971 	spin_unlock_irqrestore(&tty->flow_lock, flags);
972 }
973 EXPORT_SYMBOL(start_tty);
974 
975 /* We limit tty time update visibility to every 8 seconds or so. */
976 static void tty_update_time(struct timespec *time)
977 {
978 	unsigned long sec = get_seconds() & ~7;
979 	if ((long)(sec - time->tv_sec) > 0)
980 		time->tv_sec = sec;
981 }
982 
983 /**
984  *	tty_read	-	read method for tty device files
985  *	@file: pointer to tty file
986  *	@buf: user buffer
987  *	@count: size of user buffer
988  *	@ppos: unused
989  *
990  *	Perform the read system call function on this terminal device. Checks
991  *	for hung up devices before calling the line discipline method.
992  *
993  *	Locking:
994  *		Locks the line discipline internally while needed. Multiple
995  *	read calls may be outstanding in parallel.
996  */
997 
998 static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
999 			loff_t *ppos)
1000 {
1001 	int i;
1002 	struct inode *inode = file_inode(file);
1003 	struct tty_struct *tty = file_tty(file);
1004 	struct tty_ldisc *ld;
1005 
1006 	if (tty_paranoia_check(tty, inode, "tty_read"))
1007 		return -EIO;
1008 	if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1009 		return -EIO;
1010 
1011 	/* We want to wait for the line discipline to sort out in this
1012 	   situation */
1013 	ld = tty_ldisc_ref_wait(tty);
1014 	if (ld->ops->read)
1015 		i = (ld->ops->read)(tty, file, buf, count);
1016 	else
1017 		i = -EIO;
1018 	tty_ldisc_deref(ld);
1019 
1020 	if (i > 0)
1021 		tty_update_time(&inode->i_atime);
1022 
1023 	return i;
1024 }
1025 
1026 static void tty_write_unlock(struct tty_struct *tty)
1027 	__releases(&tty->atomic_write_lock)
1028 {
1029 	mutex_unlock(&tty->atomic_write_lock);
1030 	wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
1031 }
1032 
1033 static int tty_write_lock(struct tty_struct *tty, int ndelay)
1034 	__acquires(&tty->atomic_write_lock)
1035 {
1036 	if (!mutex_trylock(&tty->atomic_write_lock)) {
1037 		if (ndelay)
1038 			return -EAGAIN;
1039 		if (mutex_lock_interruptible(&tty->atomic_write_lock))
1040 			return -ERESTARTSYS;
1041 	}
1042 	return 0;
1043 }
1044 
1045 /*
1046  * Split writes up in sane blocksizes to avoid
1047  * denial-of-service type attacks
1048  */
1049 static inline ssize_t do_tty_write(
1050 	ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1051 	struct tty_struct *tty,
1052 	struct file *file,
1053 	const char __user *buf,
1054 	size_t count)
1055 {
1056 	ssize_t ret, written = 0;
1057 	unsigned int chunk;
1058 
1059 	ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1060 	if (ret < 0)
1061 		return ret;
1062 
1063 	/*
1064 	 * We chunk up writes into a temporary buffer. This
1065 	 * simplifies low-level drivers immensely, since they
1066 	 * don't have locking issues and user mode accesses.
1067 	 *
1068 	 * But if TTY_NO_WRITE_SPLIT is set, we should use a
1069 	 * big chunk-size..
1070 	 *
1071 	 * The default chunk-size is 2kB, because the NTTY
1072 	 * layer has problems with bigger chunks. It will
1073 	 * claim to be able to handle more characters than
1074 	 * it actually does.
1075 	 *
1076 	 * FIXME: This can probably go away now except that 64K chunks
1077 	 * are too likely to fail unless switched to vmalloc...
1078 	 */
1079 	chunk = 2048;
1080 	if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1081 		chunk = 65536;
1082 	if (count < chunk)
1083 		chunk = count;
1084 
1085 	/* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1086 	if (tty->write_cnt < chunk) {
1087 		unsigned char *buf_chunk;
1088 
1089 		if (chunk < 1024)
1090 			chunk = 1024;
1091 
1092 		buf_chunk = kmalloc(chunk, GFP_KERNEL);
1093 		if (!buf_chunk) {
1094 			ret = -ENOMEM;
1095 			goto out;
1096 		}
1097 		kfree(tty->write_buf);
1098 		tty->write_cnt = chunk;
1099 		tty->write_buf = buf_chunk;
1100 	}
1101 
1102 	/* Do the write .. */
1103 	for (;;) {
1104 		size_t size = count;
1105 		if (size > chunk)
1106 			size = chunk;
1107 		ret = -EFAULT;
1108 		if (copy_from_user(tty->write_buf, buf, size))
1109 			break;
1110 		ret = write(tty, file, tty->write_buf, size);
1111 		if (ret <= 0)
1112 			break;
1113 		written += ret;
1114 		buf += ret;
1115 		count -= ret;
1116 		if (!count)
1117 			break;
1118 		ret = -ERESTARTSYS;
1119 		if (signal_pending(current))
1120 			break;
1121 		cond_resched();
1122 	}
1123 	if (written) {
1124 		tty_update_time(&file_inode(file)->i_mtime);
1125 		ret = written;
1126 	}
1127 out:
1128 	tty_write_unlock(tty);
1129 	return ret;
1130 }
1131 
1132 /**
1133  * tty_write_message - write a message to a certain tty, not just the console.
1134  * @tty: the destination tty_struct
1135  * @msg: the message to write
1136  *
1137  * This is used for messages that need to be redirected to a specific tty.
1138  * We don't put it into the syslog queue right now maybe in the future if
1139  * really needed.
1140  *
1141  * We must still hold the BTM and test the CLOSING flag for the moment.
1142  */
1143 
1144 void tty_write_message(struct tty_struct *tty, char *msg)
1145 {
1146 	if (tty) {
1147 		mutex_lock(&tty->atomic_write_lock);
1148 		tty_lock(tty);
1149 		if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
1150 			tty_unlock(tty);
1151 			tty->ops->write(tty, msg, strlen(msg));
1152 		} else
1153 			tty_unlock(tty);
1154 		tty_write_unlock(tty);
1155 	}
1156 	return;
1157 }
1158 
1159 
1160 /**
1161  *	tty_write		-	write method for tty device file
1162  *	@file: tty file pointer
1163  *	@buf: user data to write
1164  *	@count: bytes to write
1165  *	@ppos: unused
1166  *
1167  *	Write data to a tty device via the line discipline.
1168  *
1169  *	Locking:
1170  *		Locks the line discipline as required
1171  *		Writes to the tty driver are serialized by the atomic_write_lock
1172  *	and are then processed in chunks to the device. The line discipline
1173  *	write method will not be invoked in parallel for each device.
1174  */
1175 
1176 static ssize_t tty_write(struct file *file, const char __user *buf,
1177 						size_t count, loff_t *ppos)
1178 {
1179 	struct tty_struct *tty = file_tty(file);
1180  	struct tty_ldisc *ld;
1181 	ssize_t ret;
1182 
1183 	if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1184 		return -EIO;
1185 	if (!tty || !tty->ops->write ||
1186 		(test_bit(TTY_IO_ERROR, &tty->flags)))
1187 			return -EIO;
1188 	/* Short term debug to catch buggy drivers */
1189 	if (tty->ops->write_room == NULL)
1190 		printk(KERN_ERR "tty driver %s lacks a write_room method.\n",
1191 			tty->driver->name);
1192 	ld = tty_ldisc_ref_wait(tty);
1193 	if (!ld->ops->write)
1194 		ret = -EIO;
1195 	else
1196 		ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1197 	tty_ldisc_deref(ld);
1198 	return ret;
1199 }
1200 
1201 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1202 						size_t count, loff_t *ppos)
1203 {
1204 	struct file *p = NULL;
1205 
1206 	spin_lock(&redirect_lock);
1207 	if (redirect)
1208 		p = get_file(redirect);
1209 	spin_unlock(&redirect_lock);
1210 
1211 	if (p) {
1212 		ssize_t res;
1213 		res = vfs_write(p, buf, count, &p->f_pos);
1214 		fput(p);
1215 		return res;
1216 	}
1217 	return tty_write(file, buf, count, ppos);
1218 }
1219 
1220 /**
1221  *	tty_send_xchar	-	send priority character
1222  *
1223  *	Send a high priority character to the tty even if stopped
1224  *
1225  *	Locking: none for xchar method, write ordering for write method.
1226  */
1227 
1228 int tty_send_xchar(struct tty_struct *tty, char ch)
1229 {
1230 	int	was_stopped = tty->stopped;
1231 
1232 	if (tty->ops->send_xchar) {
1233 		tty->ops->send_xchar(tty, ch);
1234 		return 0;
1235 	}
1236 
1237 	if (tty_write_lock(tty, 0) < 0)
1238 		return -ERESTARTSYS;
1239 
1240 	if (was_stopped)
1241 		start_tty(tty);
1242 	tty->ops->write(tty, &ch, 1);
1243 	if (was_stopped)
1244 		stop_tty(tty);
1245 	tty_write_unlock(tty);
1246 	return 0;
1247 }
1248 
1249 static char ptychar[] = "pqrstuvwxyzabcde";
1250 
1251 /**
1252  *	pty_line_name	-	generate name for a pty
1253  *	@driver: the tty driver in use
1254  *	@index: the minor number
1255  *	@p: output buffer of at least 6 bytes
1256  *
1257  *	Generate a name from a driver reference and write it to the output
1258  *	buffer.
1259  *
1260  *	Locking: None
1261  */
1262 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1263 {
1264 	int i = index + driver->name_base;
1265 	/* ->name is initialized to "ttyp", but "tty" is expected */
1266 	sprintf(p, "%s%c%x",
1267 		driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1268 		ptychar[i >> 4 & 0xf], i & 0xf);
1269 }
1270 
1271 /**
1272  *	tty_line_name	-	generate name for a tty
1273  *	@driver: the tty driver in use
1274  *	@index: the minor number
1275  *	@p: output buffer of at least 7 bytes
1276  *
1277  *	Generate a name from a driver reference and write it to the output
1278  *	buffer.
1279  *
1280  *	Locking: None
1281  */
1282 static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1283 {
1284 	if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1285 		return sprintf(p, "%s", driver->name);
1286 	else
1287 		return sprintf(p, "%s%d", driver->name,
1288 			       index + driver->name_base);
1289 }
1290 
1291 /**
1292  *	tty_driver_lookup_tty() - find an existing tty, if any
1293  *	@driver: the driver for the tty
1294  *	@idx:	 the minor number
1295  *
1296  *	Return the tty, if found or ERR_PTR() otherwise.
1297  *
1298  *	Locking: tty_mutex must be held. If tty is found, the mutex must
1299  *	be held until the 'fast-open' is also done. Will change once we
1300  *	have refcounting in the driver and per driver locking
1301  */
1302 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1303 		struct inode *inode, int idx)
1304 {
1305 	if (driver->ops->lookup)
1306 		return driver->ops->lookup(driver, inode, idx);
1307 
1308 	return driver->ttys[idx];
1309 }
1310 
1311 /**
1312  *	tty_init_termios	-  helper for termios setup
1313  *	@tty: the tty to set up
1314  *
1315  *	Initialise the termios structures for this tty. Thus runs under
1316  *	the tty_mutex currently so we can be relaxed about ordering.
1317  */
1318 
1319 int tty_init_termios(struct tty_struct *tty)
1320 {
1321 	struct ktermios *tp;
1322 	int idx = tty->index;
1323 
1324 	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1325 		tty->termios = tty->driver->init_termios;
1326 	else {
1327 		/* Check for lazy saved data */
1328 		tp = tty->driver->termios[idx];
1329 		if (tp != NULL)
1330 			tty->termios = *tp;
1331 		else
1332 			tty->termios = tty->driver->init_termios;
1333 	}
1334 	/* Compatibility until drivers always set this */
1335 	tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1336 	tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1337 	return 0;
1338 }
1339 EXPORT_SYMBOL_GPL(tty_init_termios);
1340 
1341 int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1342 {
1343 	int ret = tty_init_termios(tty);
1344 	if (ret)
1345 		return ret;
1346 
1347 	tty_driver_kref_get(driver);
1348 	tty->count++;
1349 	driver->ttys[tty->index] = tty;
1350 	return 0;
1351 }
1352 EXPORT_SYMBOL_GPL(tty_standard_install);
1353 
1354 /**
1355  *	tty_driver_install_tty() - install a tty entry in the driver
1356  *	@driver: the driver for the tty
1357  *	@tty: the tty
1358  *
1359  *	Install a tty object into the driver tables. The tty->index field
1360  *	will be set by the time this is called. This method is responsible
1361  *	for ensuring any need additional structures are allocated and
1362  *	configured.
1363  *
1364  *	Locking: tty_mutex for now
1365  */
1366 static int tty_driver_install_tty(struct tty_driver *driver,
1367 						struct tty_struct *tty)
1368 {
1369 	return driver->ops->install ? driver->ops->install(driver, tty) :
1370 		tty_standard_install(driver, tty);
1371 }
1372 
1373 /**
1374  *	tty_driver_remove_tty() - remove a tty from the driver tables
1375  *	@driver: the driver for the tty
1376  *	@idx:	 the minor number
1377  *
1378  *	Remvoe a tty object from the driver tables. The tty->index field
1379  *	will be set by the time this is called.
1380  *
1381  *	Locking: tty_mutex for now
1382  */
1383 void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1384 {
1385 	if (driver->ops->remove)
1386 		driver->ops->remove(driver, tty);
1387 	else
1388 		driver->ttys[tty->index] = NULL;
1389 }
1390 
1391 /*
1392  * 	tty_reopen()	- fast re-open of an open tty
1393  * 	@tty	- the tty to open
1394  *
1395  *	Return 0 on success, -errno on error.
1396  *
1397  *	Locking: tty_mutex must be held from the time the tty was found
1398  *		 till this open completes.
1399  */
1400 static int tty_reopen(struct tty_struct *tty)
1401 {
1402 	struct tty_driver *driver = tty->driver;
1403 
1404 	if (test_bit(TTY_CLOSING, &tty->flags) ||
1405 			test_bit(TTY_HUPPING, &tty->flags))
1406 		return -EIO;
1407 
1408 	if (driver->type == TTY_DRIVER_TYPE_PTY &&
1409 	    driver->subtype == PTY_TYPE_MASTER) {
1410 		/*
1411 		 * special case for PTY masters: only one open permitted,
1412 		 * and the slave side open count is incremented as well.
1413 		 */
1414 		if (tty->count)
1415 			return -EIO;
1416 
1417 		tty->link->count++;
1418 	}
1419 	tty->count++;
1420 
1421 	WARN_ON(!tty->ldisc);
1422 
1423 	return 0;
1424 }
1425 
1426 /**
1427  *	tty_init_dev		-	initialise a tty device
1428  *	@driver: tty driver we are opening a device on
1429  *	@idx: device index
1430  *	@ret_tty: returned tty structure
1431  *
1432  *	Prepare a tty device. This may not be a "new" clean device but
1433  *	could also be an active device. The pty drivers require special
1434  *	handling because of this.
1435  *
1436  *	Locking:
1437  *		The function is called under the tty_mutex, which
1438  *	protects us from the tty struct or driver itself going away.
1439  *
1440  *	On exit the tty device has the line discipline attached and
1441  *	a reference count of 1. If a pair was created for pty/tty use
1442  *	and the other was a pty master then it too has a reference count of 1.
1443  *
1444  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1445  * failed open.  The new code protects the open with a mutex, so it's
1446  * really quite straightforward.  The mutex locking can probably be
1447  * relaxed for the (most common) case of reopening a tty.
1448  */
1449 
1450 struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1451 {
1452 	struct tty_struct *tty;
1453 	int retval;
1454 
1455 	/*
1456 	 * First time open is complex, especially for PTY devices.
1457 	 * This code guarantees that either everything succeeds and the
1458 	 * TTY is ready for operation, or else the table slots are vacated
1459 	 * and the allocated memory released.  (Except that the termios
1460 	 * and locked termios may be retained.)
1461 	 */
1462 
1463 	if (!try_module_get(driver->owner))
1464 		return ERR_PTR(-ENODEV);
1465 
1466 	tty = alloc_tty_struct(driver, idx);
1467 	if (!tty) {
1468 		retval = -ENOMEM;
1469 		goto err_module_put;
1470 	}
1471 
1472 	tty_lock(tty);
1473 	retval = tty_driver_install_tty(driver, tty);
1474 	if (retval < 0)
1475 		goto err_deinit_tty;
1476 
1477 	if (!tty->port)
1478 		tty->port = driver->ports[idx];
1479 
1480 	WARN_RATELIMIT(!tty->port,
1481 			"%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1482 			__func__, tty->driver->name);
1483 
1484 	tty->port->itty = tty;
1485 
1486 	/*
1487 	 * Structures all installed ... call the ldisc open routines.
1488 	 * If we fail here just call release_tty to clean up.  No need
1489 	 * to decrement the use counts, as release_tty doesn't care.
1490 	 */
1491 	retval = tty_ldisc_setup(tty, tty->link);
1492 	if (retval)
1493 		goto err_release_tty;
1494 	/* Return the tty locked so that it cannot vanish under the caller */
1495 	return tty;
1496 
1497 err_deinit_tty:
1498 	tty_unlock(tty);
1499 	deinitialize_tty_struct(tty);
1500 	free_tty_struct(tty);
1501 err_module_put:
1502 	module_put(driver->owner);
1503 	return ERR_PTR(retval);
1504 
1505 	/* call the tty release_tty routine to clean out this slot */
1506 err_release_tty:
1507 	tty_unlock(tty);
1508 	printk_ratelimited(KERN_INFO "tty_init_dev: ldisc open failed, "
1509 				 "clearing slot %d\n", idx);
1510 	release_tty(tty, idx);
1511 	return ERR_PTR(retval);
1512 }
1513 
1514 void tty_free_termios(struct tty_struct *tty)
1515 {
1516 	struct ktermios *tp;
1517 	int idx = tty->index;
1518 
1519 	/* If the port is going to reset then it has no termios to save */
1520 	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1521 		return;
1522 
1523 	/* Stash the termios data */
1524 	tp = tty->driver->termios[idx];
1525 	if (tp == NULL) {
1526 		tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1527 		if (tp == NULL) {
1528 			pr_warn("tty: no memory to save termios state.\n");
1529 			return;
1530 		}
1531 		tty->driver->termios[idx] = tp;
1532 	}
1533 	*tp = tty->termios;
1534 }
1535 EXPORT_SYMBOL(tty_free_termios);
1536 
1537 /**
1538  *	tty_flush_works		-	flush all works of a tty
1539  *	@tty: tty device to flush works for
1540  *
1541  *	Sync flush all works belonging to @tty.
1542  */
1543 static void tty_flush_works(struct tty_struct *tty)
1544 {
1545 	flush_work(&tty->SAK_work);
1546 	flush_work(&tty->hangup_work);
1547 }
1548 
1549 /**
1550  *	release_one_tty		-	release tty structure memory
1551  *	@kref: kref of tty we are obliterating
1552  *
1553  *	Releases memory associated with a tty structure, and clears out the
1554  *	driver table slots. This function is called when a device is no longer
1555  *	in use. It also gets called when setup of a device fails.
1556  *
1557  *	Locking:
1558  *		takes the file list lock internally when working on the list
1559  *	of ttys that the driver keeps.
1560  *
1561  *	This method gets called from a work queue so that the driver private
1562  *	cleanup ops can sleep (needed for USB at least)
1563  */
1564 static void release_one_tty(struct work_struct *work)
1565 {
1566 	struct tty_struct *tty =
1567 		container_of(work, struct tty_struct, hangup_work);
1568 	struct tty_driver *driver = tty->driver;
1569 	struct module *owner = driver->owner;
1570 
1571 	if (tty->ops->cleanup)
1572 		tty->ops->cleanup(tty);
1573 
1574 	tty->magic = 0;
1575 	tty_driver_kref_put(driver);
1576 	module_put(owner);
1577 
1578 	spin_lock(&tty_files_lock);
1579 	list_del_init(&tty->tty_files);
1580 	spin_unlock(&tty_files_lock);
1581 
1582 	put_pid(tty->pgrp);
1583 	put_pid(tty->session);
1584 	free_tty_struct(tty);
1585 }
1586 
1587 static void queue_release_one_tty(struct kref *kref)
1588 {
1589 	struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1590 
1591 	/* The hangup queue is now free so we can reuse it rather than
1592 	   waste a chunk of memory for each port */
1593 	INIT_WORK(&tty->hangup_work, release_one_tty);
1594 	schedule_work(&tty->hangup_work);
1595 }
1596 
1597 /**
1598  *	tty_kref_put		-	release a tty kref
1599  *	@tty: tty device
1600  *
1601  *	Release a reference to a tty device and if need be let the kref
1602  *	layer destruct the object for us
1603  */
1604 
1605 void tty_kref_put(struct tty_struct *tty)
1606 {
1607 	if (tty)
1608 		kref_put(&tty->kref, queue_release_one_tty);
1609 }
1610 EXPORT_SYMBOL(tty_kref_put);
1611 
1612 /**
1613  *	release_tty		-	release tty structure memory
1614  *
1615  *	Release both @tty and a possible linked partner (think pty pair),
1616  *	and decrement the refcount of the backing module.
1617  *
1618  *	Locking:
1619  *		tty_mutex
1620  *		takes the file list lock internally when working on the list
1621  *	of ttys that the driver keeps.
1622  *
1623  */
1624 static void release_tty(struct tty_struct *tty, int idx)
1625 {
1626 	/* This should always be true but check for the moment */
1627 	WARN_ON(tty->index != idx);
1628 	WARN_ON(!mutex_is_locked(&tty_mutex));
1629 	if (tty->ops->shutdown)
1630 		tty->ops->shutdown(tty);
1631 	tty_free_termios(tty);
1632 	tty_driver_remove_tty(tty->driver, tty);
1633 	tty->port->itty = NULL;
1634 	if (tty->link)
1635 		tty->link->port->itty = NULL;
1636 	cancel_work_sync(&tty->port->buf.work);
1637 
1638 	if (tty->link)
1639 		tty_kref_put(tty->link);
1640 	tty_kref_put(tty);
1641 }
1642 
1643 /**
1644  *	tty_release_checks - check a tty before real release
1645  *	@tty: tty to check
1646  *	@o_tty: link of @tty (if any)
1647  *	@idx: index of the tty
1648  *
1649  *	Performs some paranoid checking before true release of the @tty.
1650  *	This is a no-op unless TTY_PARANOIA_CHECK is defined.
1651  */
1652 static int tty_release_checks(struct tty_struct *tty, struct tty_struct *o_tty,
1653 		int idx)
1654 {
1655 #ifdef TTY_PARANOIA_CHECK
1656 	if (idx < 0 || idx >= tty->driver->num) {
1657 		printk(KERN_DEBUG "%s: bad idx when trying to free (%s)\n",
1658 				__func__, tty->name);
1659 		return -1;
1660 	}
1661 
1662 	/* not much to check for devpts */
1663 	if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1664 		return 0;
1665 
1666 	if (tty != tty->driver->ttys[idx]) {
1667 		printk(KERN_DEBUG "%s: driver.table[%d] not tty for (%s)\n",
1668 				__func__, idx, tty->name);
1669 		return -1;
1670 	}
1671 	if (tty->driver->other) {
1672 		if (o_tty != tty->driver->other->ttys[idx]) {
1673 			printk(KERN_DEBUG "%s: other->table[%d] not o_tty for (%s)\n",
1674 					__func__, idx, tty->name);
1675 			return -1;
1676 		}
1677 		if (o_tty->link != tty) {
1678 			printk(KERN_DEBUG "%s: bad pty pointers\n", __func__);
1679 			return -1;
1680 		}
1681 	}
1682 #endif
1683 	return 0;
1684 }
1685 
1686 /**
1687  *	tty_release		-	vfs callback for close
1688  *	@inode: inode of tty
1689  *	@filp: file pointer for handle to tty
1690  *
1691  *	Called the last time each file handle is closed that references
1692  *	this tty. There may however be several such references.
1693  *
1694  *	Locking:
1695  *		Takes bkl. See tty_release_dev
1696  *
1697  * Even releasing the tty structures is a tricky business.. We have
1698  * to be very careful that the structures are all released at the
1699  * same time, as interrupts might otherwise get the wrong pointers.
1700  *
1701  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1702  * lead to double frees or releasing memory still in use.
1703  */
1704 
1705 int tty_release(struct inode *inode, struct file *filp)
1706 {
1707 	struct tty_struct *tty = file_tty(filp);
1708 	struct tty_struct *o_tty;
1709 	int	pty_master, tty_closing, o_tty_closing, do_sleep;
1710 	int	idx;
1711 	char	buf[64];
1712 	long	timeout = 0;
1713 	int	once = 1;
1714 
1715 	if (tty_paranoia_check(tty, inode, __func__))
1716 		return 0;
1717 
1718 	tty_lock(tty);
1719 	check_tty_count(tty, __func__);
1720 
1721 	__tty_fasync(-1, filp, 0);
1722 
1723 	idx = tty->index;
1724 	pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1725 		      tty->driver->subtype == PTY_TYPE_MASTER);
1726 	/* Review: parallel close */
1727 	o_tty = tty->link;
1728 
1729 	if (tty_release_checks(tty, o_tty, idx)) {
1730 		tty_unlock(tty);
1731 		return 0;
1732 	}
1733 
1734 #ifdef TTY_DEBUG_HANGUP
1735 	printk(KERN_DEBUG "%s: %s (tty count=%d)...\n", __func__,
1736 			tty_name(tty, buf), tty->count);
1737 #endif
1738 
1739 	if (tty->ops->close)
1740 		tty->ops->close(tty, filp);
1741 
1742 	tty_unlock(tty);
1743 	/*
1744 	 * Sanity check: if tty->count is going to zero, there shouldn't be
1745 	 * any waiters on tty->read_wait or tty->write_wait.  We test the
1746 	 * wait queues and kick everyone out _before_ actually starting to
1747 	 * close.  This ensures that we won't block while releasing the tty
1748 	 * structure.
1749 	 *
1750 	 * The test for the o_tty closing is necessary, since the master and
1751 	 * slave sides may close in any order.  If the slave side closes out
1752 	 * first, its count will be one, since the master side holds an open.
1753 	 * Thus this test wouldn't be triggered at the time the slave closes,
1754 	 * so we do it now.
1755 	 *
1756 	 * Note that it's possible for the tty to be opened again while we're
1757 	 * flushing out waiters.  By recalculating the closing flags before
1758 	 * each iteration we avoid any problems.
1759 	 */
1760 	while (1) {
1761 		/* Guard against races with tty->count changes elsewhere and
1762 		   opens on /dev/tty */
1763 
1764 		mutex_lock(&tty_mutex);
1765 		tty_lock_pair(tty, o_tty);
1766 		tty_closing = tty->count <= 1;
1767 		o_tty_closing = o_tty &&
1768 			(o_tty->count <= (pty_master ? 1 : 0));
1769 		do_sleep = 0;
1770 
1771 		if (tty_closing) {
1772 			if (waitqueue_active(&tty->read_wait)) {
1773 				wake_up_poll(&tty->read_wait, POLLIN);
1774 				do_sleep++;
1775 			}
1776 			if (waitqueue_active(&tty->write_wait)) {
1777 				wake_up_poll(&tty->write_wait, POLLOUT);
1778 				do_sleep++;
1779 			}
1780 		}
1781 		if (o_tty_closing) {
1782 			if (waitqueue_active(&o_tty->read_wait)) {
1783 				wake_up_poll(&o_tty->read_wait, POLLIN);
1784 				do_sleep++;
1785 			}
1786 			if (waitqueue_active(&o_tty->write_wait)) {
1787 				wake_up_poll(&o_tty->write_wait, POLLOUT);
1788 				do_sleep++;
1789 			}
1790 		}
1791 		if (!do_sleep)
1792 			break;
1793 
1794 		if (once) {
1795 			once = 0;
1796 			printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
1797 			       __func__, tty_name(tty, buf));
1798 		}
1799 		tty_unlock_pair(tty, o_tty);
1800 		mutex_unlock(&tty_mutex);
1801 		schedule_timeout_killable(timeout);
1802 		if (timeout < 120 * HZ)
1803 			timeout = 2 * timeout + 1;
1804 		else
1805 			timeout = MAX_SCHEDULE_TIMEOUT;
1806 	}
1807 
1808 	/*
1809 	 * The closing flags are now consistent with the open counts on
1810 	 * both sides, and we've completed the last operation that could
1811 	 * block, so it's safe to proceed with closing.
1812 	 *
1813 	 * We must *not* drop the tty_mutex until we ensure that a further
1814 	 * entry into tty_open can not pick up this tty.
1815 	 */
1816 	if (pty_master) {
1817 		if (--o_tty->count < 0) {
1818 			printk(KERN_WARNING "%s: bad pty slave count (%d) for %s\n",
1819 				__func__, o_tty->count, tty_name(o_tty, buf));
1820 			o_tty->count = 0;
1821 		}
1822 	}
1823 	if (--tty->count < 0) {
1824 		printk(KERN_WARNING "%s: bad tty->count (%d) for %s\n",
1825 				__func__, tty->count, tty_name(tty, buf));
1826 		tty->count = 0;
1827 	}
1828 
1829 	/*
1830 	 * We've decremented tty->count, so we need to remove this file
1831 	 * descriptor off the tty->tty_files list; this serves two
1832 	 * purposes:
1833 	 *  - check_tty_count sees the correct number of file descriptors
1834 	 *    associated with this tty.
1835 	 *  - do_tty_hangup no longer sees this file descriptor as
1836 	 *    something that needs to be handled for hangups.
1837 	 */
1838 	tty_del_file(filp);
1839 
1840 	/*
1841 	 * Perform some housekeeping before deciding whether to return.
1842 	 *
1843 	 * Set the TTY_CLOSING flag if this was the last open.  In the
1844 	 * case of a pty we may have to wait around for the other side
1845 	 * to close, and TTY_CLOSING makes sure we can't be reopened.
1846 	 */
1847 	if (tty_closing)
1848 		set_bit(TTY_CLOSING, &tty->flags);
1849 	if (o_tty_closing)
1850 		set_bit(TTY_CLOSING, &o_tty->flags);
1851 
1852 	/*
1853 	 * If _either_ side is closing, make sure there aren't any
1854 	 * processes that still think tty or o_tty is their controlling
1855 	 * tty.
1856 	 */
1857 	if (tty_closing || o_tty_closing) {
1858 		read_lock(&tasklist_lock);
1859 		session_clear_tty(tty->session);
1860 		if (o_tty)
1861 			session_clear_tty(o_tty->session);
1862 		read_unlock(&tasklist_lock);
1863 	}
1864 
1865 	mutex_unlock(&tty_mutex);
1866 	tty_unlock_pair(tty, o_tty);
1867 	/* At this point the TTY_CLOSING flag should ensure a dead tty
1868 	   cannot be re-opened by a racing opener */
1869 
1870 	/* check whether both sides are closing ... */
1871 	if (!tty_closing || (o_tty && !o_tty_closing))
1872 		return 0;
1873 
1874 #ifdef TTY_DEBUG_HANGUP
1875 	printk(KERN_DEBUG "%s: %s: final close\n", __func__, tty_name(tty, buf));
1876 #endif
1877 	/*
1878 	 * Ask the line discipline code to release its structures
1879 	 */
1880 	tty_ldisc_release(tty, o_tty);
1881 
1882 	/* Wait for pending work before tty destruction commmences */
1883 	tty_flush_works(tty);
1884 	if (o_tty)
1885 		tty_flush_works(o_tty);
1886 
1887 #ifdef TTY_DEBUG_HANGUP
1888 	printk(KERN_DEBUG "%s: %s: freeing structure...\n", __func__, tty_name(tty, buf));
1889 #endif
1890 	/*
1891 	 * The release_tty function takes care of the details of clearing
1892 	 * the slots and preserving the termios structure. The tty_unlock_pair
1893 	 * should be safe as we keep a kref while the tty is locked (so the
1894 	 * unlock never unlocks a freed tty).
1895 	 */
1896 	mutex_lock(&tty_mutex);
1897 	release_tty(tty, idx);
1898 	mutex_unlock(&tty_mutex);
1899 
1900 	return 0;
1901 }
1902 
1903 /**
1904  *	tty_open_current_tty - get tty of current task for open
1905  *	@device: device number
1906  *	@filp: file pointer to tty
1907  *	@return: tty of the current task iff @device is /dev/tty
1908  *
1909  *	We cannot return driver and index like for the other nodes because
1910  *	devpts will not work then. It expects inodes to be from devpts FS.
1911  *
1912  *	We need to move to returning a refcounted object from all the lookup
1913  *	paths including this one.
1914  */
1915 static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1916 {
1917 	struct tty_struct *tty;
1918 
1919 	if (device != MKDEV(TTYAUX_MAJOR, 0))
1920 		return NULL;
1921 
1922 	tty = get_current_tty();
1923 	if (!tty)
1924 		return ERR_PTR(-ENXIO);
1925 
1926 	filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1927 	/* noctty = 1; */
1928 	tty_kref_put(tty);
1929 	/* FIXME: we put a reference and return a TTY! */
1930 	/* This is only safe because the caller holds tty_mutex */
1931 	return tty;
1932 }
1933 
1934 /**
1935  *	tty_lookup_driver - lookup a tty driver for a given device file
1936  *	@device: device number
1937  *	@filp: file pointer to tty
1938  *	@noctty: set if the device should not become a controlling tty
1939  *	@index: index for the device in the @return driver
1940  *	@return: driver for this inode (with increased refcount)
1941  *
1942  * 	If @return is not erroneous, the caller is responsible to decrement the
1943  * 	refcount by tty_driver_kref_put.
1944  *
1945  *	Locking: tty_mutex protects get_tty_driver
1946  */
1947 static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1948 		int *noctty, int *index)
1949 {
1950 	struct tty_driver *driver;
1951 
1952 	switch (device) {
1953 #ifdef CONFIG_VT
1954 	case MKDEV(TTY_MAJOR, 0): {
1955 		extern struct tty_driver *console_driver;
1956 		driver = tty_driver_kref_get(console_driver);
1957 		*index = fg_console;
1958 		*noctty = 1;
1959 		break;
1960 	}
1961 #endif
1962 	case MKDEV(TTYAUX_MAJOR, 1): {
1963 		struct tty_driver *console_driver = console_device(index);
1964 		if (console_driver) {
1965 			driver = tty_driver_kref_get(console_driver);
1966 			if (driver) {
1967 				/* Don't let /dev/console block */
1968 				filp->f_flags |= O_NONBLOCK;
1969 				*noctty = 1;
1970 				break;
1971 			}
1972 		}
1973 		return ERR_PTR(-ENODEV);
1974 	}
1975 	default:
1976 		driver = get_tty_driver(device, index);
1977 		if (!driver)
1978 			return ERR_PTR(-ENODEV);
1979 		break;
1980 	}
1981 	return driver;
1982 }
1983 
1984 /**
1985  *	tty_open		-	open a tty device
1986  *	@inode: inode of device file
1987  *	@filp: file pointer to tty
1988  *
1989  *	tty_open and tty_release keep up the tty count that contains the
1990  *	number of opens done on a tty. We cannot use the inode-count, as
1991  *	different inodes might point to the same tty.
1992  *
1993  *	Open-counting is needed for pty masters, as well as for keeping
1994  *	track of serial lines: DTR is dropped when the last close happens.
1995  *	(This is not done solely through tty->count, now.  - Ted 1/27/92)
1996  *
1997  *	The termios state of a pty is reset on first open so that
1998  *	settings don't persist across reuse.
1999  *
2000  *	Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2001  *		 tty->count should protect the rest.
2002  *		 ->siglock protects ->signal/->sighand
2003  *
2004  *	Note: the tty_unlock/lock cases without a ref are only safe due to
2005  *	tty_mutex
2006  */
2007 
2008 static int tty_open(struct inode *inode, struct file *filp)
2009 {
2010 	struct tty_struct *tty;
2011 	int noctty, retval;
2012 	struct tty_driver *driver = NULL;
2013 	int index;
2014 	dev_t device = inode->i_rdev;
2015 	unsigned saved_flags = filp->f_flags;
2016 
2017 	nonseekable_open(inode, filp);
2018 
2019 retry_open:
2020 	retval = tty_alloc_file(filp);
2021 	if (retval)
2022 		return -ENOMEM;
2023 
2024 	noctty = filp->f_flags & O_NOCTTY;
2025 	index  = -1;
2026 	retval = 0;
2027 
2028 	mutex_lock(&tty_mutex);
2029 	/* This is protected by the tty_mutex */
2030 	tty = tty_open_current_tty(device, filp);
2031 	if (IS_ERR(tty)) {
2032 		retval = PTR_ERR(tty);
2033 		goto err_unlock;
2034 	} else if (!tty) {
2035 		driver = tty_lookup_driver(device, filp, &noctty, &index);
2036 		if (IS_ERR(driver)) {
2037 			retval = PTR_ERR(driver);
2038 			goto err_unlock;
2039 		}
2040 
2041 		/* check whether we're reopening an existing tty */
2042 		tty = tty_driver_lookup_tty(driver, inode, index);
2043 		if (IS_ERR(tty)) {
2044 			retval = PTR_ERR(tty);
2045 			goto err_unlock;
2046 		}
2047 	}
2048 
2049 	if (tty) {
2050 		tty_lock(tty);
2051 		retval = tty_reopen(tty);
2052 		if (retval < 0) {
2053 			tty_unlock(tty);
2054 			tty = ERR_PTR(retval);
2055 		}
2056 	} else	/* Returns with the tty_lock held for now */
2057 		tty = tty_init_dev(driver, index);
2058 
2059 	mutex_unlock(&tty_mutex);
2060 	if (driver)
2061 		tty_driver_kref_put(driver);
2062 	if (IS_ERR(tty)) {
2063 		retval = PTR_ERR(tty);
2064 		goto err_file;
2065 	}
2066 
2067 	tty_add_file(tty, filp);
2068 
2069 	check_tty_count(tty, __func__);
2070 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2071 	    tty->driver->subtype == PTY_TYPE_MASTER)
2072 		noctty = 1;
2073 #ifdef TTY_DEBUG_HANGUP
2074 	printk(KERN_DEBUG "%s: opening %s...\n", __func__, tty->name);
2075 #endif
2076 	if (tty->ops->open)
2077 		retval = tty->ops->open(tty, filp);
2078 	else
2079 		retval = -ENODEV;
2080 	filp->f_flags = saved_flags;
2081 
2082 	if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
2083 						!capable(CAP_SYS_ADMIN))
2084 		retval = -EBUSY;
2085 
2086 	if (retval) {
2087 #ifdef TTY_DEBUG_HANGUP
2088 		printk(KERN_DEBUG "%s: error %d in opening %s...\n", __func__,
2089 				retval, tty->name);
2090 #endif
2091 		tty_unlock(tty); /* need to call tty_release without BTM */
2092 		tty_release(inode, filp);
2093 		if (retval != -ERESTARTSYS)
2094 			return retval;
2095 
2096 		if (signal_pending(current))
2097 			return retval;
2098 
2099 		schedule();
2100 		/*
2101 		 * Need to reset f_op in case a hangup happened.
2102 		 */
2103 		if (filp->f_op == &hung_up_tty_fops)
2104 			filp->f_op = &tty_fops;
2105 		goto retry_open;
2106 	}
2107 	clear_bit(TTY_HUPPED, &tty->flags);
2108 	tty_unlock(tty);
2109 
2110 
2111 	mutex_lock(&tty_mutex);
2112 	tty_lock(tty);
2113 	spin_lock_irq(&current->sighand->siglock);
2114 	if (!noctty &&
2115 	    current->signal->leader &&
2116 	    !current->signal->tty &&
2117 	    tty->session == NULL)
2118 		__proc_set_tty(current, tty);
2119 	spin_unlock_irq(&current->sighand->siglock);
2120 	tty_unlock(tty);
2121 	mutex_unlock(&tty_mutex);
2122 	return 0;
2123 err_unlock:
2124 	mutex_unlock(&tty_mutex);
2125 	/* after locks to avoid deadlock */
2126 	if (!IS_ERR_OR_NULL(driver))
2127 		tty_driver_kref_put(driver);
2128 err_file:
2129 	tty_free_file(filp);
2130 	return retval;
2131 }
2132 
2133 
2134 
2135 /**
2136  *	tty_poll	-	check tty status
2137  *	@filp: file being polled
2138  *	@wait: poll wait structures to update
2139  *
2140  *	Call the line discipline polling method to obtain the poll
2141  *	status of the device.
2142  *
2143  *	Locking: locks called line discipline but ldisc poll method
2144  *	may be re-entered freely by other callers.
2145  */
2146 
2147 static unsigned int tty_poll(struct file *filp, poll_table *wait)
2148 {
2149 	struct tty_struct *tty = file_tty(filp);
2150 	struct tty_ldisc *ld;
2151 	int ret = 0;
2152 
2153 	if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2154 		return 0;
2155 
2156 	ld = tty_ldisc_ref_wait(tty);
2157 	if (ld->ops->poll)
2158 		ret = (ld->ops->poll)(tty, filp, wait);
2159 	tty_ldisc_deref(ld);
2160 	return ret;
2161 }
2162 
2163 static int __tty_fasync(int fd, struct file *filp, int on)
2164 {
2165 	struct tty_struct *tty = file_tty(filp);
2166 	struct tty_ldisc *ldisc;
2167 	unsigned long flags;
2168 	int retval = 0;
2169 
2170 	if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2171 		goto out;
2172 
2173 	retval = fasync_helper(fd, filp, on, &tty->fasync);
2174 	if (retval <= 0)
2175 		goto out;
2176 
2177 	ldisc = tty_ldisc_ref(tty);
2178 	if (ldisc) {
2179 		if (ldisc->ops->fasync)
2180 			ldisc->ops->fasync(tty, on);
2181 		tty_ldisc_deref(ldisc);
2182 	}
2183 
2184 	if (on) {
2185 		enum pid_type type;
2186 		struct pid *pid;
2187 
2188 		spin_lock_irqsave(&tty->ctrl_lock, flags);
2189 		if (tty->pgrp) {
2190 			pid = tty->pgrp;
2191 			type = PIDTYPE_PGID;
2192 		} else {
2193 			pid = task_pid(current);
2194 			type = PIDTYPE_PID;
2195 		}
2196 		get_pid(pid);
2197 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2198 		__f_setown(filp, pid, type, 0);
2199 		put_pid(pid);
2200 		retval = 0;
2201 	}
2202 out:
2203 	return retval;
2204 }
2205 
2206 static int tty_fasync(int fd, struct file *filp, int on)
2207 {
2208 	struct tty_struct *tty = file_tty(filp);
2209 	int retval;
2210 
2211 	tty_lock(tty);
2212 	retval = __tty_fasync(fd, filp, on);
2213 	tty_unlock(tty);
2214 
2215 	return retval;
2216 }
2217 
2218 /**
2219  *	tiocsti			-	fake input character
2220  *	@tty: tty to fake input into
2221  *	@p: pointer to character
2222  *
2223  *	Fake input to a tty device. Does the necessary locking and
2224  *	input management.
2225  *
2226  *	FIXME: does not honour flow control ??
2227  *
2228  *	Locking:
2229  *		Called functions take tty_ldiscs_lock
2230  *		current->signal->tty check is safe without locks
2231  *
2232  *	FIXME: may race normal receive processing
2233  */
2234 
2235 static int tiocsti(struct tty_struct *tty, char __user *p)
2236 {
2237 	char ch, mbz = 0;
2238 	struct tty_ldisc *ld;
2239 
2240 	if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2241 		return -EPERM;
2242 	if (get_user(ch, p))
2243 		return -EFAULT;
2244 	tty_audit_tiocsti(tty, ch);
2245 	ld = tty_ldisc_ref_wait(tty);
2246 	ld->ops->receive_buf(tty, &ch, &mbz, 1);
2247 	tty_ldisc_deref(ld);
2248 	return 0;
2249 }
2250 
2251 /**
2252  *	tiocgwinsz		-	implement window query ioctl
2253  *	@tty; tty
2254  *	@arg: user buffer for result
2255  *
2256  *	Copies the kernel idea of the window size into the user buffer.
2257  *
2258  *	Locking: tty->winsize_mutex is taken to ensure the winsize data
2259  *		is consistent.
2260  */
2261 
2262 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2263 {
2264 	int err;
2265 
2266 	mutex_lock(&tty->winsize_mutex);
2267 	err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2268 	mutex_unlock(&tty->winsize_mutex);
2269 
2270 	return err ? -EFAULT: 0;
2271 }
2272 
2273 /**
2274  *	tty_do_resize		-	resize event
2275  *	@tty: tty being resized
2276  *	@rows: rows (character)
2277  *	@cols: cols (character)
2278  *
2279  *	Update the termios variables and send the necessary signals to
2280  *	peform a terminal resize correctly
2281  */
2282 
2283 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2284 {
2285 	struct pid *pgrp;
2286 	unsigned long flags;
2287 
2288 	/* Lock the tty */
2289 	mutex_lock(&tty->winsize_mutex);
2290 	if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2291 		goto done;
2292 	/* Get the PID values and reference them so we can
2293 	   avoid holding the tty ctrl lock while sending signals */
2294 	spin_lock_irqsave(&tty->ctrl_lock, flags);
2295 	pgrp = get_pid(tty->pgrp);
2296 	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2297 
2298 	if (pgrp)
2299 		kill_pgrp(pgrp, SIGWINCH, 1);
2300 	put_pid(pgrp);
2301 
2302 	tty->winsize = *ws;
2303 done:
2304 	mutex_unlock(&tty->winsize_mutex);
2305 	return 0;
2306 }
2307 EXPORT_SYMBOL(tty_do_resize);
2308 
2309 /**
2310  *	tiocswinsz		-	implement window size set ioctl
2311  *	@tty; tty side of tty
2312  *	@arg: user buffer for result
2313  *
2314  *	Copies the user idea of the window size to the kernel. Traditionally
2315  *	this is just advisory information but for the Linux console it
2316  *	actually has driver level meaning and triggers a VC resize.
2317  *
2318  *	Locking:
2319  *		Driver dependent. The default do_resize method takes the
2320  *	tty termios mutex and ctrl_lock. The console takes its own lock
2321  *	then calls into the default method.
2322  */
2323 
2324 static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2325 {
2326 	struct winsize tmp_ws;
2327 	if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2328 		return -EFAULT;
2329 
2330 	if (tty->ops->resize)
2331 		return tty->ops->resize(tty, &tmp_ws);
2332 	else
2333 		return tty_do_resize(tty, &tmp_ws);
2334 }
2335 
2336 /**
2337  *	tioccons	-	allow admin to move logical console
2338  *	@file: the file to become console
2339  *
2340  *	Allow the administrator to move the redirected console device
2341  *
2342  *	Locking: uses redirect_lock to guard the redirect information
2343  */
2344 
2345 static int tioccons(struct file *file)
2346 {
2347 	if (!capable(CAP_SYS_ADMIN))
2348 		return -EPERM;
2349 	if (file->f_op->write == redirected_tty_write) {
2350 		struct file *f;
2351 		spin_lock(&redirect_lock);
2352 		f = redirect;
2353 		redirect = NULL;
2354 		spin_unlock(&redirect_lock);
2355 		if (f)
2356 			fput(f);
2357 		return 0;
2358 	}
2359 	spin_lock(&redirect_lock);
2360 	if (redirect) {
2361 		spin_unlock(&redirect_lock);
2362 		return -EBUSY;
2363 	}
2364 	redirect = get_file(file);
2365 	spin_unlock(&redirect_lock);
2366 	return 0;
2367 }
2368 
2369 /**
2370  *	fionbio		-	non blocking ioctl
2371  *	@file: file to set blocking value
2372  *	@p: user parameter
2373  *
2374  *	Historical tty interfaces had a blocking control ioctl before
2375  *	the generic functionality existed. This piece of history is preserved
2376  *	in the expected tty API of posix OS's.
2377  *
2378  *	Locking: none, the open file handle ensures it won't go away.
2379  */
2380 
2381 static int fionbio(struct file *file, int __user *p)
2382 {
2383 	int nonblock;
2384 
2385 	if (get_user(nonblock, p))
2386 		return -EFAULT;
2387 
2388 	spin_lock(&file->f_lock);
2389 	if (nonblock)
2390 		file->f_flags |= O_NONBLOCK;
2391 	else
2392 		file->f_flags &= ~O_NONBLOCK;
2393 	spin_unlock(&file->f_lock);
2394 	return 0;
2395 }
2396 
2397 /**
2398  *	tiocsctty	-	set controlling tty
2399  *	@tty: tty structure
2400  *	@arg: user argument
2401  *
2402  *	This ioctl is used to manage job control. It permits a session
2403  *	leader to set this tty as the controlling tty for the session.
2404  *
2405  *	Locking:
2406  *		Takes tty_mutex() to protect tty instance
2407  *		Takes tasklist_lock internally to walk sessions
2408  *		Takes ->siglock() when updating signal->tty
2409  */
2410 
2411 static int tiocsctty(struct tty_struct *tty, int arg)
2412 {
2413 	int ret = 0;
2414 	if (current->signal->leader && (task_session(current) == tty->session))
2415 		return ret;
2416 
2417 	mutex_lock(&tty_mutex);
2418 	/*
2419 	 * The process must be a session leader and
2420 	 * not have a controlling tty already.
2421 	 */
2422 	if (!current->signal->leader || current->signal->tty) {
2423 		ret = -EPERM;
2424 		goto unlock;
2425 	}
2426 
2427 	if (tty->session) {
2428 		/*
2429 		 * This tty is already the controlling
2430 		 * tty for another session group!
2431 		 */
2432 		if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2433 			/*
2434 			 * Steal it away
2435 			 */
2436 			read_lock(&tasklist_lock);
2437 			session_clear_tty(tty->session);
2438 			read_unlock(&tasklist_lock);
2439 		} else {
2440 			ret = -EPERM;
2441 			goto unlock;
2442 		}
2443 	}
2444 	proc_set_tty(current, tty);
2445 unlock:
2446 	mutex_unlock(&tty_mutex);
2447 	return ret;
2448 }
2449 
2450 /**
2451  *	tty_get_pgrp	-	return a ref counted pgrp pid
2452  *	@tty: tty to read
2453  *
2454  *	Returns a refcounted instance of the pid struct for the process
2455  *	group controlling the tty.
2456  */
2457 
2458 struct pid *tty_get_pgrp(struct tty_struct *tty)
2459 {
2460 	unsigned long flags;
2461 	struct pid *pgrp;
2462 
2463 	spin_lock_irqsave(&tty->ctrl_lock, flags);
2464 	pgrp = get_pid(tty->pgrp);
2465 	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2466 
2467 	return pgrp;
2468 }
2469 EXPORT_SYMBOL_GPL(tty_get_pgrp);
2470 
2471 /**
2472  *	tiocgpgrp		-	get process group
2473  *	@tty: tty passed by user
2474  *	@real_tty: tty side of the tty passed by the user if a pty else the tty
2475  *	@p: returned pid
2476  *
2477  *	Obtain the process group of the tty. If there is no process group
2478  *	return an error.
2479  *
2480  *	Locking: none. Reference to current->signal->tty is safe.
2481  */
2482 
2483 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2484 {
2485 	struct pid *pid;
2486 	int ret;
2487 	/*
2488 	 * (tty == real_tty) is a cheap way of
2489 	 * testing if the tty is NOT a master pty.
2490 	 */
2491 	if (tty == real_tty && current->signal->tty != real_tty)
2492 		return -ENOTTY;
2493 	pid = tty_get_pgrp(real_tty);
2494 	ret =  put_user(pid_vnr(pid), p);
2495 	put_pid(pid);
2496 	return ret;
2497 }
2498 
2499 /**
2500  *	tiocspgrp		-	attempt to set process group
2501  *	@tty: tty passed by user
2502  *	@real_tty: tty side device matching tty passed by user
2503  *	@p: pid pointer
2504  *
2505  *	Set the process group of the tty to the session passed. Only
2506  *	permitted where the tty session is our session.
2507  *
2508  *	Locking: RCU, ctrl lock
2509  */
2510 
2511 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2512 {
2513 	struct pid *pgrp;
2514 	pid_t pgrp_nr;
2515 	int retval = tty_check_change(real_tty);
2516 	unsigned long flags;
2517 
2518 	if (retval == -EIO)
2519 		return -ENOTTY;
2520 	if (retval)
2521 		return retval;
2522 	if (!current->signal->tty ||
2523 	    (current->signal->tty != real_tty) ||
2524 	    (real_tty->session != task_session(current)))
2525 		return -ENOTTY;
2526 	if (get_user(pgrp_nr, p))
2527 		return -EFAULT;
2528 	if (pgrp_nr < 0)
2529 		return -EINVAL;
2530 	rcu_read_lock();
2531 	pgrp = find_vpid(pgrp_nr);
2532 	retval = -ESRCH;
2533 	if (!pgrp)
2534 		goto out_unlock;
2535 	retval = -EPERM;
2536 	if (session_of_pgrp(pgrp) != task_session(current))
2537 		goto out_unlock;
2538 	retval = 0;
2539 	spin_lock_irqsave(&tty->ctrl_lock, flags);
2540 	put_pid(real_tty->pgrp);
2541 	real_tty->pgrp = get_pid(pgrp);
2542 	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2543 out_unlock:
2544 	rcu_read_unlock();
2545 	return retval;
2546 }
2547 
2548 /**
2549  *	tiocgsid		-	get session id
2550  *	@tty: tty passed by user
2551  *	@real_tty: tty side of the tty passed by the user if a pty else the tty
2552  *	@p: pointer to returned session id
2553  *
2554  *	Obtain the session id of the tty. If there is no session
2555  *	return an error.
2556  *
2557  *	Locking: none. Reference to current->signal->tty is safe.
2558  */
2559 
2560 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2561 {
2562 	/*
2563 	 * (tty == real_tty) is a cheap way of
2564 	 * testing if the tty is NOT a master pty.
2565 	*/
2566 	if (tty == real_tty && current->signal->tty != real_tty)
2567 		return -ENOTTY;
2568 	if (!real_tty->session)
2569 		return -ENOTTY;
2570 	return put_user(pid_vnr(real_tty->session), p);
2571 }
2572 
2573 /**
2574  *	tiocsetd	-	set line discipline
2575  *	@tty: tty device
2576  *	@p: pointer to user data
2577  *
2578  *	Set the line discipline according to user request.
2579  *
2580  *	Locking: see tty_set_ldisc, this function is just a helper
2581  */
2582 
2583 static int tiocsetd(struct tty_struct *tty, int __user *p)
2584 {
2585 	int ldisc;
2586 	int ret;
2587 
2588 	if (get_user(ldisc, p))
2589 		return -EFAULT;
2590 
2591 	ret = tty_set_ldisc(tty, ldisc);
2592 
2593 	return ret;
2594 }
2595 
2596 /**
2597  *	send_break	-	performed time break
2598  *	@tty: device to break on
2599  *	@duration: timeout in mS
2600  *
2601  *	Perform a timed break on hardware that lacks its own driver level
2602  *	timed break functionality.
2603  *
2604  *	Locking:
2605  *		atomic_write_lock serializes
2606  *
2607  */
2608 
2609 static int send_break(struct tty_struct *tty, unsigned int duration)
2610 {
2611 	int retval;
2612 
2613 	if (tty->ops->break_ctl == NULL)
2614 		return 0;
2615 
2616 	if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2617 		retval = tty->ops->break_ctl(tty, duration);
2618 	else {
2619 		/* Do the work ourselves */
2620 		if (tty_write_lock(tty, 0) < 0)
2621 			return -EINTR;
2622 		retval = tty->ops->break_ctl(tty, -1);
2623 		if (retval)
2624 			goto out;
2625 		if (!signal_pending(current))
2626 			msleep_interruptible(duration);
2627 		retval = tty->ops->break_ctl(tty, 0);
2628 out:
2629 		tty_write_unlock(tty);
2630 		if (signal_pending(current))
2631 			retval = -EINTR;
2632 	}
2633 	return retval;
2634 }
2635 
2636 /**
2637  *	tty_tiocmget		-	get modem status
2638  *	@tty: tty device
2639  *	@file: user file pointer
2640  *	@p: pointer to result
2641  *
2642  *	Obtain the modem status bits from the tty driver if the feature
2643  *	is supported. Return -EINVAL if it is not available.
2644  *
2645  *	Locking: none (up to the driver)
2646  */
2647 
2648 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2649 {
2650 	int retval = -EINVAL;
2651 
2652 	if (tty->ops->tiocmget) {
2653 		retval = tty->ops->tiocmget(tty);
2654 
2655 		if (retval >= 0)
2656 			retval = put_user(retval, p);
2657 	}
2658 	return retval;
2659 }
2660 
2661 /**
2662  *	tty_tiocmset		-	set modem status
2663  *	@tty: tty device
2664  *	@cmd: command - clear bits, set bits or set all
2665  *	@p: pointer to desired bits
2666  *
2667  *	Set the modem status bits from the tty driver if the feature
2668  *	is supported. Return -EINVAL if it is not available.
2669  *
2670  *	Locking: none (up to the driver)
2671  */
2672 
2673 static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2674 	     unsigned __user *p)
2675 {
2676 	int retval;
2677 	unsigned int set, clear, val;
2678 
2679 	if (tty->ops->tiocmset == NULL)
2680 		return -EINVAL;
2681 
2682 	retval = get_user(val, p);
2683 	if (retval)
2684 		return retval;
2685 	set = clear = 0;
2686 	switch (cmd) {
2687 	case TIOCMBIS:
2688 		set = val;
2689 		break;
2690 	case TIOCMBIC:
2691 		clear = val;
2692 		break;
2693 	case TIOCMSET:
2694 		set = val;
2695 		clear = ~val;
2696 		break;
2697 	}
2698 	set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2699 	clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2700 	return tty->ops->tiocmset(tty, set, clear);
2701 }
2702 
2703 static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2704 {
2705 	int retval = -EINVAL;
2706 	struct serial_icounter_struct icount;
2707 	memset(&icount, 0, sizeof(icount));
2708 	if (tty->ops->get_icount)
2709 		retval = tty->ops->get_icount(tty, &icount);
2710 	if (retval != 0)
2711 		return retval;
2712 	if (copy_to_user(arg, &icount, sizeof(icount)))
2713 		return -EFAULT;
2714 	return 0;
2715 }
2716 
2717 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2718 {
2719 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2720 	    tty->driver->subtype == PTY_TYPE_MASTER)
2721 		tty = tty->link;
2722 	return tty;
2723 }
2724 EXPORT_SYMBOL(tty_pair_get_tty);
2725 
2726 struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
2727 {
2728 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2729 	    tty->driver->subtype == PTY_TYPE_MASTER)
2730 	    return tty;
2731 	return tty->link;
2732 }
2733 EXPORT_SYMBOL(tty_pair_get_pty);
2734 
2735 /*
2736  * Split this up, as gcc can choke on it otherwise..
2737  */
2738 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2739 {
2740 	struct tty_struct *tty = file_tty(file);
2741 	struct tty_struct *real_tty;
2742 	void __user *p = (void __user *)arg;
2743 	int retval;
2744 	struct tty_ldisc *ld;
2745 
2746 	if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2747 		return -EINVAL;
2748 
2749 	real_tty = tty_pair_get_tty(tty);
2750 
2751 	/*
2752 	 * Factor out some common prep work
2753 	 */
2754 	switch (cmd) {
2755 	case TIOCSETD:
2756 	case TIOCSBRK:
2757 	case TIOCCBRK:
2758 	case TCSBRK:
2759 	case TCSBRKP:
2760 		retval = tty_check_change(tty);
2761 		if (retval)
2762 			return retval;
2763 		if (cmd != TIOCCBRK) {
2764 			tty_wait_until_sent(tty, 0);
2765 			if (signal_pending(current))
2766 				return -EINTR;
2767 		}
2768 		break;
2769 	}
2770 
2771 	/*
2772 	 *	Now do the stuff.
2773 	 */
2774 	switch (cmd) {
2775 	case TIOCSTI:
2776 		return tiocsti(tty, p);
2777 	case TIOCGWINSZ:
2778 		return tiocgwinsz(real_tty, p);
2779 	case TIOCSWINSZ:
2780 		return tiocswinsz(real_tty, p);
2781 	case TIOCCONS:
2782 		return real_tty != tty ? -EINVAL : tioccons(file);
2783 	case FIONBIO:
2784 		return fionbio(file, p);
2785 	case TIOCEXCL:
2786 		set_bit(TTY_EXCLUSIVE, &tty->flags);
2787 		return 0;
2788 	case TIOCNXCL:
2789 		clear_bit(TTY_EXCLUSIVE, &tty->flags);
2790 		return 0;
2791 	case TIOCGEXCL:
2792 	{
2793 		int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2794 		return put_user(excl, (int __user *)p);
2795 	}
2796 	case TIOCNOTTY:
2797 		if (current->signal->tty != tty)
2798 			return -ENOTTY;
2799 		no_tty();
2800 		return 0;
2801 	case TIOCSCTTY:
2802 		return tiocsctty(tty, arg);
2803 	case TIOCGPGRP:
2804 		return tiocgpgrp(tty, real_tty, p);
2805 	case TIOCSPGRP:
2806 		return tiocspgrp(tty, real_tty, p);
2807 	case TIOCGSID:
2808 		return tiocgsid(tty, real_tty, p);
2809 	case TIOCGETD:
2810 		return put_user(tty->ldisc->ops->num, (int __user *)p);
2811 	case TIOCSETD:
2812 		return tiocsetd(tty, p);
2813 	case TIOCVHANGUP:
2814 		if (!capable(CAP_SYS_ADMIN))
2815 			return -EPERM;
2816 		tty_vhangup(tty);
2817 		return 0;
2818 	case TIOCGDEV:
2819 	{
2820 		unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2821 		return put_user(ret, (unsigned int __user *)p);
2822 	}
2823 	/*
2824 	 * Break handling
2825 	 */
2826 	case TIOCSBRK:	/* Turn break on, unconditionally */
2827 		if (tty->ops->break_ctl)
2828 			return tty->ops->break_ctl(tty, -1);
2829 		return 0;
2830 	case TIOCCBRK:	/* Turn break off, unconditionally */
2831 		if (tty->ops->break_ctl)
2832 			return tty->ops->break_ctl(tty, 0);
2833 		return 0;
2834 	case TCSBRK:   /* SVID version: non-zero arg --> no break */
2835 		/* non-zero arg means wait for all output data
2836 		 * to be sent (performed above) but don't send break.
2837 		 * This is used by the tcdrain() termios function.
2838 		 */
2839 		if (!arg)
2840 			return send_break(tty, 250);
2841 		return 0;
2842 	case TCSBRKP:	/* support for POSIX tcsendbreak() */
2843 		return send_break(tty, arg ? arg*100 : 250);
2844 
2845 	case TIOCMGET:
2846 		return tty_tiocmget(tty, p);
2847 	case TIOCMSET:
2848 	case TIOCMBIC:
2849 	case TIOCMBIS:
2850 		return tty_tiocmset(tty, cmd, p);
2851 	case TIOCGICOUNT:
2852 		retval = tty_tiocgicount(tty, p);
2853 		/* For the moment allow fall through to the old method */
2854         	if (retval != -EINVAL)
2855 			return retval;
2856 		break;
2857 	case TCFLSH:
2858 		switch (arg) {
2859 		case TCIFLUSH:
2860 		case TCIOFLUSH:
2861 		/* flush tty buffer and allow ldisc to process ioctl */
2862 			tty_buffer_flush(tty);
2863 			break;
2864 		}
2865 		break;
2866 	}
2867 	if (tty->ops->ioctl) {
2868 		retval = (tty->ops->ioctl)(tty, cmd, arg);
2869 		if (retval != -ENOIOCTLCMD)
2870 			return retval;
2871 	}
2872 	ld = tty_ldisc_ref_wait(tty);
2873 	retval = -EINVAL;
2874 	if (ld->ops->ioctl) {
2875 		retval = ld->ops->ioctl(tty, file, cmd, arg);
2876 		if (retval == -ENOIOCTLCMD)
2877 			retval = -ENOTTY;
2878 	}
2879 	tty_ldisc_deref(ld);
2880 	return retval;
2881 }
2882 
2883 #ifdef CONFIG_COMPAT
2884 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2885 				unsigned long arg)
2886 {
2887 	struct tty_struct *tty = file_tty(file);
2888 	struct tty_ldisc *ld;
2889 	int retval = -ENOIOCTLCMD;
2890 
2891 	if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2892 		return -EINVAL;
2893 
2894 	if (tty->ops->compat_ioctl) {
2895 		retval = (tty->ops->compat_ioctl)(tty, cmd, arg);
2896 		if (retval != -ENOIOCTLCMD)
2897 			return retval;
2898 	}
2899 
2900 	ld = tty_ldisc_ref_wait(tty);
2901 	if (ld->ops->compat_ioctl)
2902 		retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2903 	else
2904 		retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2905 	tty_ldisc_deref(ld);
2906 
2907 	return retval;
2908 }
2909 #endif
2910 
2911 static int this_tty(const void *t, struct file *file, unsigned fd)
2912 {
2913 	if (likely(file->f_op->read != tty_read))
2914 		return 0;
2915 	return file_tty(file) != t ? 0 : fd + 1;
2916 }
2917 
2918 /*
2919  * This implements the "Secure Attention Key" ---  the idea is to
2920  * prevent trojan horses by killing all processes associated with this
2921  * tty when the user hits the "Secure Attention Key".  Required for
2922  * super-paranoid applications --- see the Orange Book for more details.
2923  *
2924  * This code could be nicer; ideally it should send a HUP, wait a few
2925  * seconds, then send a INT, and then a KILL signal.  But you then
2926  * have to coordinate with the init process, since all processes associated
2927  * with the current tty must be dead before the new getty is allowed
2928  * to spawn.
2929  *
2930  * Now, if it would be correct ;-/ The current code has a nasty hole -
2931  * it doesn't catch files in flight. We may send the descriptor to ourselves
2932  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2933  *
2934  * Nasty bug: do_SAK is being called in interrupt context.  This can
2935  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2936  */
2937 void __do_SAK(struct tty_struct *tty)
2938 {
2939 #ifdef TTY_SOFT_SAK
2940 	tty_hangup(tty);
2941 #else
2942 	struct task_struct *g, *p;
2943 	struct pid *session;
2944 	int		i;
2945 
2946 	if (!tty)
2947 		return;
2948 	session = tty->session;
2949 
2950 	tty_ldisc_flush(tty);
2951 
2952 	tty_driver_flush_buffer(tty);
2953 
2954 	read_lock(&tasklist_lock);
2955 	/* Kill the entire session */
2956 	do_each_pid_task(session, PIDTYPE_SID, p) {
2957 		printk(KERN_NOTICE "SAK: killed process %d"
2958 			" (%s): task_session(p)==tty->session\n",
2959 			task_pid_nr(p), p->comm);
2960 		send_sig(SIGKILL, p, 1);
2961 	} while_each_pid_task(session, PIDTYPE_SID, p);
2962 	/* Now kill any processes that happen to have the
2963 	 * tty open.
2964 	 */
2965 	do_each_thread(g, p) {
2966 		if (p->signal->tty == tty) {
2967 			printk(KERN_NOTICE "SAK: killed process %d"
2968 			    " (%s): task_session(p)==tty->session\n",
2969 			    task_pid_nr(p), p->comm);
2970 			send_sig(SIGKILL, p, 1);
2971 			continue;
2972 		}
2973 		task_lock(p);
2974 		i = iterate_fd(p->files, 0, this_tty, tty);
2975 		if (i != 0) {
2976 			printk(KERN_NOTICE "SAK: killed process %d"
2977 			    " (%s): fd#%d opened to the tty\n",
2978 				    task_pid_nr(p), p->comm, i - 1);
2979 			force_sig(SIGKILL, p);
2980 		}
2981 		task_unlock(p);
2982 	} while_each_thread(g, p);
2983 	read_unlock(&tasklist_lock);
2984 #endif
2985 }
2986 
2987 static void do_SAK_work(struct work_struct *work)
2988 {
2989 	struct tty_struct *tty =
2990 		container_of(work, struct tty_struct, SAK_work);
2991 	__do_SAK(tty);
2992 }
2993 
2994 /*
2995  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2996  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2997  * the values which we write to it will be identical to the values which it
2998  * already has. --akpm
2999  */
3000 void do_SAK(struct tty_struct *tty)
3001 {
3002 	if (!tty)
3003 		return;
3004 	schedule_work(&tty->SAK_work);
3005 }
3006 
3007 EXPORT_SYMBOL(do_SAK);
3008 
3009 static int dev_match_devt(struct device *dev, const void *data)
3010 {
3011 	const dev_t *devt = data;
3012 	return dev->devt == *devt;
3013 }
3014 
3015 /* Must put_device() after it's unused! */
3016 static struct device *tty_get_device(struct tty_struct *tty)
3017 {
3018 	dev_t devt = tty_devnum(tty);
3019 	return class_find_device(tty_class, NULL, &devt, dev_match_devt);
3020 }
3021 
3022 
3023 /**
3024  *	alloc_tty_struct
3025  *
3026  *	This subroutine allocates and initializes a tty structure.
3027  *
3028  *	Locking: none - tty in question is not exposed at this point
3029  */
3030 
3031 struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
3032 {
3033 	struct tty_struct *tty;
3034 
3035 	tty = kzalloc(sizeof(*tty), GFP_KERNEL);
3036 	if (!tty)
3037 		return NULL;
3038 
3039 	kref_init(&tty->kref);
3040 	tty->magic = TTY_MAGIC;
3041 	tty_ldisc_init(tty);
3042 	tty->session = NULL;
3043 	tty->pgrp = NULL;
3044 	mutex_init(&tty->legacy_mutex);
3045 	mutex_init(&tty->throttle_mutex);
3046 	init_rwsem(&tty->termios_rwsem);
3047 	mutex_init(&tty->winsize_mutex);
3048 	init_ldsem(&tty->ldisc_sem);
3049 	init_waitqueue_head(&tty->write_wait);
3050 	init_waitqueue_head(&tty->read_wait);
3051 	INIT_WORK(&tty->hangup_work, do_tty_hangup);
3052 	mutex_init(&tty->atomic_write_lock);
3053 	spin_lock_init(&tty->ctrl_lock);
3054 	spin_lock_init(&tty->flow_lock);
3055 	INIT_LIST_HEAD(&tty->tty_files);
3056 	INIT_WORK(&tty->SAK_work, do_SAK_work);
3057 
3058 	tty->driver = driver;
3059 	tty->ops = driver->ops;
3060 	tty->index = idx;
3061 	tty_line_name(driver, idx, tty->name);
3062 	tty->dev = tty_get_device(tty);
3063 
3064 	return tty;
3065 }
3066 
3067 /**
3068  *	deinitialize_tty_struct
3069  *	@tty: tty to deinitialize
3070  *
3071  *	This subroutine deinitializes a tty structure that has been newly
3072  *	allocated but tty_release cannot be called on that yet.
3073  *
3074  *	Locking: none - tty in question must not be exposed at this point
3075  */
3076 void deinitialize_tty_struct(struct tty_struct *tty)
3077 {
3078 	tty_ldisc_deinit(tty);
3079 }
3080 
3081 /**
3082  *	tty_put_char	-	write one character to a tty
3083  *	@tty: tty
3084  *	@ch: character
3085  *
3086  *	Write one byte to the tty using the provided put_char method
3087  *	if present. Returns the number of characters successfully output.
3088  *
3089  *	Note: the specific put_char operation in the driver layer may go
3090  *	away soon. Don't call it directly, use this method
3091  */
3092 
3093 int tty_put_char(struct tty_struct *tty, unsigned char ch)
3094 {
3095 	if (tty->ops->put_char)
3096 		return tty->ops->put_char(tty, ch);
3097 	return tty->ops->write(tty, &ch, 1);
3098 }
3099 EXPORT_SYMBOL_GPL(tty_put_char);
3100 
3101 struct class *tty_class;
3102 
3103 static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3104 		unsigned int index, unsigned int count)
3105 {
3106 	/* init here, since reused cdevs cause crashes */
3107 	cdev_init(&driver->cdevs[index], &tty_fops);
3108 	driver->cdevs[index].owner = driver->owner;
3109 	return cdev_add(&driver->cdevs[index], dev, count);
3110 }
3111 
3112 /**
3113  *	tty_register_device - register a tty device
3114  *	@driver: the tty driver that describes the tty device
3115  *	@index: the index in the tty driver for this tty device
3116  *	@device: a struct device that is associated with this tty device.
3117  *		This field is optional, if there is no known struct device
3118  *		for this tty device it can be set to NULL safely.
3119  *
3120  *	Returns a pointer to the struct device for this tty device
3121  *	(or ERR_PTR(-EFOO) on error).
3122  *
3123  *	This call is required to be made to register an individual tty device
3124  *	if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3125  *	that bit is not set, this function should not be called by a tty
3126  *	driver.
3127  *
3128  *	Locking: ??
3129  */
3130 
3131 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3132 				   struct device *device)
3133 {
3134 	return tty_register_device_attr(driver, index, device, NULL, NULL);
3135 }
3136 EXPORT_SYMBOL(tty_register_device);
3137 
3138 static void tty_device_create_release(struct device *dev)
3139 {
3140 	pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
3141 	kfree(dev);
3142 }
3143 
3144 /**
3145  *	tty_register_device_attr - register a tty device
3146  *	@driver: the tty driver that describes the tty device
3147  *	@index: the index in the tty driver for this tty device
3148  *	@device: a struct device that is associated with this tty device.
3149  *		This field is optional, if there is no known struct device
3150  *		for this tty device it can be set to NULL safely.
3151  *	@drvdata: Driver data to be set to device.
3152  *	@attr_grp: Attribute group to be set on device.
3153  *
3154  *	Returns a pointer to the struct device for this tty device
3155  *	(or ERR_PTR(-EFOO) on error).
3156  *
3157  *	This call is required to be made to register an individual tty device
3158  *	if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3159  *	that bit is not set, this function should not be called by a tty
3160  *	driver.
3161  *
3162  *	Locking: ??
3163  */
3164 struct device *tty_register_device_attr(struct tty_driver *driver,
3165 				   unsigned index, struct device *device,
3166 				   void *drvdata,
3167 				   const struct attribute_group **attr_grp)
3168 {
3169 	char name[64];
3170 	dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3171 	struct device *dev = NULL;
3172 	int retval = -ENODEV;
3173 	bool cdev = false;
3174 
3175 	if (index >= driver->num) {
3176 		printk(KERN_ERR "Attempt to register invalid tty line number "
3177 		       " (%d).\n", index);
3178 		return ERR_PTR(-EINVAL);
3179 	}
3180 
3181 	if (driver->type == TTY_DRIVER_TYPE_PTY)
3182 		pty_line_name(driver, index, name);
3183 	else
3184 		tty_line_name(driver, index, name);
3185 
3186 	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3187 		retval = tty_cdev_add(driver, devt, index, 1);
3188 		if (retval)
3189 			goto error;
3190 		cdev = true;
3191 	}
3192 
3193 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3194 	if (!dev) {
3195 		retval = -ENOMEM;
3196 		goto error;
3197 	}
3198 
3199 	dev->devt = devt;
3200 	dev->class = tty_class;
3201 	dev->parent = device;
3202 	dev->release = tty_device_create_release;
3203 	dev_set_name(dev, "%s", name);
3204 	dev->groups = attr_grp;
3205 	dev_set_drvdata(dev, drvdata);
3206 
3207 	retval = device_register(dev);
3208 	if (retval)
3209 		goto error;
3210 
3211 	return dev;
3212 
3213 error:
3214 	put_device(dev);
3215 	if (cdev)
3216 		cdev_del(&driver->cdevs[index]);
3217 	return ERR_PTR(retval);
3218 }
3219 EXPORT_SYMBOL_GPL(tty_register_device_attr);
3220 
3221 /**
3222  * 	tty_unregister_device - unregister a tty device
3223  * 	@driver: the tty driver that describes the tty device
3224  * 	@index: the index in the tty driver for this tty device
3225  *
3226  * 	If a tty device is registered with a call to tty_register_device() then
3227  *	this function must be called when the tty device is gone.
3228  *
3229  *	Locking: ??
3230  */
3231 
3232 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3233 {
3234 	device_destroy(tty_class,
3235 		MKDEV(driver->major, driver->minor_start) + index);
3236 	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC))
3237 		cdev_del(&driver->cdevs[index]);
3238 }
3239 EXPORT_SYMBOL(tty_unregister_device);
3240 
3241 /**
3242  * __tty_alloc_driver -- allocate tty driver
3243  * @lines: count of lines this driver can handle at most
3244  * @owner: module which is repsonsible for this driver
3245  * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3246  *
3247  * This should not be called directly, some of the provided macros should be
3248  * used instead. Use IS_ERR and friends on @retval.
3249  */
3250 struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3251 		unsigned long flags)
3252 {
3253 	struct tty_driver *driver;
3254 	unsigned int cdevs = 1;
3255 	int err;
3256 
3257 	if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3258 		return ERR_PTR(-EINVAL);
3259 
3260 	driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3261 	if (!driver)
3262 		return ERR_PTR(-ENOMEM);
3263 
3264 	kref_init(&driver->kref);
3265 	driver->magic = TTY_DRIVER_MAGIC;
3266 	driver->num = lines;
3267 	driver->owner = owner;
3268 	driver->flags = flags;
3269 
3270 	if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3271 		driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3272 				GFP_KERNEL);
3273 		driver->termios = kcalloc(lines, sizeof(*driver->termios),
3274 				GFP_KERNEL);
3275 		if (!driver->ttys || !driver->termios) {
3276 			err = -ENOMEM;
3277 			goto err_free_all;
3278 		}
3279 	}
3280 
3281 	if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3282 		driver->ports = kcalloc(lines, sizeof(*driver->ports),
3283 				GFP_KERNEL);
3284 		if (!driver->ports) {
3285 			err = -ENOMEM;
3286 			goto err_free_all;
3287 		}
3288 		cdevs = lines;
3289 	}
3290 
3291 	driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3292 	if (!driver->cdevs) {
3293 		err = -ENOMEM;
3294 		goto err_free_all;
3295 	}
3296 
3297 	return driver;
3298 err_free_all:
3299 	kfree(driver->ports);
3300 	kfree(driver->ttys);
3301 	kfree(driver->termios);
3302 	kfree(driver);
3303 	return ERR_PTR(err);
3304 }
3305 EXPORT_SYMBOL(__tty_alloc_driver);
3306 
3307 static void destruct_tty_driver(struct kref *kref)
3308 {
3309 	struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3310 	int i;
3311 	struct ktermios *tp;
3312 
3313 	if (driver->flags & TTY_DRIVER_INSTALLED) {
3314 		/*
3315 		 * Free the termios and termios_locked structures because
3316 		 * we don't want to get memory leaks when modular tty
3317 		 * drivers are removed from the kernel.
3318 		 */
3319 		for (i = 0; i < driver->num; i++) {
3320 			tp = driver->termios[i];
3321 			if (tp) {
3322 				driver->termios[i] = NULL;
3323 				kfree(tp);
3324 			}
3325 			if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3326 				tty_unregister_device(driver, i);
3327 		}
3328 		proc_tty_unregister_driver(driver);
3329 		if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3330 			cdev_del(&driver->cdevs[0]);
3331 	}
3332 	kfree(driver->cdevs);
3333 	kfree(driver->ports);
3334 	kfree(driver->termios);
3335 	kfree(driver->ttys);
3336 	kfree(driver);
3337 }
3338 
3339 void tty_driver_kref_put(struct tty_driver *driver)
3340 {
3341 	kref_put(&driver->kref, destruct_tty_driver);
3342 }
3343 EXPORT_SYMBOL(tty_driver_kref_put);
3344 
3345 void tty_set_operations(struct tty_driver *driver,
3346 			const struct tty_operations *op)
3347 {
3348 	driver->ops = op;
3349 };
3350 EXPORT_SYMBOL(tty_set_operations);
3351 
3352 void put_tty_driver(struct tty_driver *d)
3353 {
3354 	tty_driver_kref_put(d);
3355 }
3356 EXPORT_SYMBOL(put_tty_driver);
3357 
3358 /*
3359  * Called by a tty driver to register itself.
3360  */
3361 int tty_register_driver(struct tty_driver *driver)
3362 {
3363 	int error;
3364 	int i;
3365 	dev_t dev;
3366 	struct device *d;
3367 
3368 	if (!driver->major) {
3369 		error = alloc_chrdev_region(&dev, driver->minor_start,
3370 						driver->num, driver->name);
3371 		if (!error) {
3372 			driver->major = MAJOR(dev);
3373 			driver->minor_start = MINOR(dev);
3374 		}
3375 	} else {
3376 		dev = MKDEV(driver->major, driver->minor_start);
3377 		error = register_chrdev_region(dev, driver->num, driver->name);
3378 	}
3379 	if (error < 0)
3380 		goto err;
3381 
3382 	if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3383 		error = tty_cdev_add(driver, dev, 0, driver->num);
3384 		if (error)
3385 			goto err_unreg_char;
3386 	}
3387 
3388 	mutex_lock(&tty_mutex);
3389 	list_add(&driver->tty_drivers, &tty_drivers);
3390 	mutex_unlock(&tty_mutex);
3391 
3392 	if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3393 		for (i = 0; i < driver->num; i++) {
3394 			d = tty_register_device(driver, i, NULL);
3395 			if (IS_ERR(d)) {
3396 				error = PTR_ERR(d);
3397 				goto err_unreg_devs;
3398 			}
3399 		}
3400 	}
3401 	proc_tty_register_driver(driver);
3402 	driver->flags |= TTY_DRIVER_INSTALLED;
3403 	return 0;
3404 
3405 err_unreg_devs:
3406 	for (i--; i >= 0; i--)
3407 		tty_unregister_device(driver, i);
3408 
3409 	mutex_lock(&tty_mutex);
3410 	list_del(&driver->tty_drivers);
3411 	mutex_unlock(&tty_mutex);
3412 
3413 err_unreg_char:
3414 	unregister_chrdev_region(dev, driver->num);
3415 err:
3416 	return error;
3417 }
3418 EXPORT_SYMBOL(tty_register_driver);
3419 
3420 /*
3421  * Called by a tty driver to unregister itself.
3422  */
3423 int tty_unregister_driver(struct tty_driver *driver)
3424 {
3425 #if 0
3426 	/* FIXME */
3427 	if (driver->refcount)
3428 		return -EBUSY;
3429 #endif
3430 	unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3431 				driver->num);
3432 	mutex_lock(&tty_mutex);
3433 	list_del(&driver->tty_drivers);
3434 	mutex_unlock(&tty_mutex);
3435 	return 0;
3436 }
3437 
3438 EXPORT_SYMBOL(tty_unregister_driver);
3439 
3440 dev_t tty_devnum(struct tty_struct *tty)
3441 {
3442 	return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3443 }
3444 EXPORT_SYMBOL(tty_devnum);
3445 
3446 void proc_clear_tty(struct task_struct *p)
3447 {
3448 	unsigned long flags;
3449 	struct tty_struct *tty;
3450 	spin_lock_irqsave(&p->sighand->siglock, flags);
3451 	tty = p->signal->tty;
3452 	p->signal->tty = NULL;
3453 	spin_unlock_irqrestore(&p->sighand->siglock, flags);
3454 	tty_kref_put(tty);
3455 }
3456 
3457 /* Called under the sighand lock */
3458 
3459 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3460 {
3461 	if (tty) {
3462 		unsigned long flags;
3463 		/* We should not have a session or pgrp to put here but.... */
3464 		spin_lock_irqsave(&tty->ctrl_lock, flags);
3465 		put_pid(tty->session);
3466 		put_pid(tty->pgrp);
3467 		tty->pgrp = get_pid(task_pgrp(tsk));
3468 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
3469 		tty->session = get_pid(task_session(tsk));
3470 		if (tsk->signal->tty) {
3471 			printk(KERN_DEBUG "tty not NULL!!\n");
3472 			tty_kref_put(tsk->signal->tty);
3473 		}
3474 	}
3475 	put_pid(tsk->signal->tty_old_pgrp);
3476 	tsk->signal->tty = tty_kref_get(tty);
3477 	tsk->signal->tty_old_pgrp = NULL;
3478 }
3479 
3480 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3481 {
3482 	spin_lock_irq(&tsk->sighand->siglock);
3483 	__proc_set_tty(tsk, tty);
3484 	spin_unlock_irq(&tsk->sighand->siglock);
3485 }
3486 
3487 struct tty_struct *get_current_tty(void)
3488 {
3489 	struct tty_struct *tty;
3490 	unsigned long flags;
3491 
3492 	spin_lock_irqsave(&current->sighand->siglock, flags);
3493 	tty = tty_kref_get(current->signal->tty);
3494 	spin_unlock_irqrestore(&current->sighand->siglock, flags);
3495 	return tty;
3496 }
3497 EXPORT_SYMBOL_GPL(get_current_tty);
3498 
3499 void tty_default_fops(struct file_operations *fops)
3500 {
3501 	*fops = tty_fops;
3502 }
3503 
3504 /*
3505  * Initialize the console device. This is called *early*, so
3506  * we can't necessarily depend on lots of kernel help here.
3507  * Just do some early initializations, and do the complex setup
3508  * later.
3509  */
3510 void __init console_init(void)
3511 {
3512 	initcall_t *call;
3513 
3514 	/* Setup the default TTY line discipline. */
3515 	tty_ldisc_begin();
3516 
3517 	/*
3518 	 * set up the console device so that later boot sequences can
3519 	 * inform about problems etc..
3520 	 */
3521 	call = __con_initcall_start;
3522 	while (call < __con_initcall_end) {
3523 		(*call)();
3524 		call++;
3525 	}
3526 }
3527 
3528 static char *tty_devnode(struct device *dev, umode_t *mode)
3529 {
3530 	if (!mode)
3531 		return NULL;
3532 	if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3533 	    dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3534 		*mode = 0666;
3535 	return NULL;
3536 }
3537 
3538 static int __init tty_class_init(void)
3539 {
3540 	tty_class = class_create(THIS_MODULE, "tty");
3541 	if (IS_ERR(tty_class))
3542 		return PTR_ERR(tty_class);
3543 	tty_class->devnode = tty_devnode;
3544 	return 0;
3545 }
3546 
3547 postcore_initcall(tty_class_init);
3548 
3549 /* 3/2004 jmc: why do these devices exist? */
3550 static struct cdev tty_cdev, console_cdev;
3551 
3552 static ssize_t show_cons_active(struct device *dev,
3553 				struct device_attribute *attr, char *buf)
3554 {
3555 	struct console *cs[16];
3556 	int i = 0;
3557 	struct console *c;
3558 	ssize_t count = 0;
3559 
3560 	console_lock();
3561 	for_each_console(c) {
3562 		if (!c->device)
3563 			continue;
3564 		if (!c->write)
3565 			continue;
3566 		if ((c->flags & CON_ENABLED) == 0)
3567 			continue;
3568 		cs[i++] = c;
3569 		if (i >= ARRAY_SIZE(cs))
3570 			break;
3571 	}
3572 	while (i--) {
3573 		int index = cs[i]->index;
3574 		struct tty_driver *drv = cs[i]->device(cs[i], &index);
3575 
3576 		/* don't resolve tty0 as some programs depend on it */
3577 		if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3578 			count += tty_line_name(drv, index, buf + count);
3579 		else
3580 			count += sprintf(buf + count, "%s%d",
3581 					 cs[i]->name, cs[i]->index);
3582 
3583 		count += sprintf(buf + count, "%c", i ? ' ':'\n');
3584 	}
3585 	console_unlock();
3586 
3587 	return count;
3588 }
3589 static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3590 
3591 static struct device *consdev;
3592 
3593 void console_sysfs_notify(void)
3594 {
3595 	if (consdev)
3596 		sysfs_notify(&consdev->kobj, NULL, "active");
3597 }
3598 
3599 /*
3600  * Ok, now we can initialize the rest of the tty devices and can count
3601  * on memory allocations, interrupts etc..
3602  */
3603 int __init tty_init(void)
3604 {
3605 	cdev_init(&tty_cdev, &tty_fops);
3606 	if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3607 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3608 		panic("Couldn't register /dev/tty driver\n");
3609 	device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3610 
3611 	cdev_init(&console_cdev, &console_fops);
3612 	if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3613 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3614 		panic("Couldn't register /dev/console driver\n");
3615 	consdev = device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
3616 			      "console");
3617 	if (IS_ERR(consdev))
3618 		consdev = NULL;
3619 	else
3620 		WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
3621 
3622 #ifdef CONFIG_VT
3623 	vty_init(&console_fops);
3624 #endif
3625 	return 0;
3626 }
3627 
3628