V4L/DVB (4110): Small bug in saa7127.c
[linux-2.6] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/config.h>
69 #include <linux/types.h>
70 #include <linux/major.h>
71 #include <linux/errno.h>
72 #include <linux/signal.h>
73 #include <linux/fcntl.h>
74 #include <linux/sched.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/console.h>
82 #include <linux/timer.h>
83 #include <linux/ctype.h>
84 #include <linux/kd.h>
85 #include <linux/mm.h>
86 #include <linux/string.h>
87 #include <linux/slab.h>
88 #include <linux/poll.h>
89 #include <linux/proc_fs.h>
90 #include <linux/init.h>
91 #include <linux/module.h>
92 #include <linux/smp_lock.h>
93 #include <linux/device.h>
94 #include <linux/idr.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98
99 #include <asm/uaccess.h>
100 #include <asm/system.h>
101
102 #include <linux/kbd_kern.h>
103 #include <linux/vt_kern.h>
104 #include <linux/selection.h>
105 #include <linux/devfs_fs_kernel.h>
106
107 #include <linux/kmod.h>
108
109 #undef TTY_DEBUG_HANGUP
110
111 #define TTY_PARANOIA_CHECK 1
112 #define CHECK_TTY_COUNT 1
113
114 struct termios tty_std_termios = {      /* for the benefit of tty drivers  */
115         .c_iflag = ICRNL | IXON,
116         .c_oflag = OPOST | ONLCR,
117         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
118         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
119                    ECHOCTL | ECHOKE | IEXTEN,
120         .c_cc = INIT_C_CC
121 };
122
123 EXPORT_SYMBOL(tty_std_termios);
124
125 /* This list gets poked at by procfs and various bits of boot up code. This
126    could do with some rationalisation such as pulling the tty proc function
127    into this file */
128    
129 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
130
131 /* Semaphore to protect creating and releasing a tty. This is shared with
132    vt.c for deeply disgusting hack reasons */
133 DEFINE_MUTEX(tty_mutex);
134
135 #ifdef CONFIG_UNIX98_PTYS
136 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
137 extern int pty_limit;           /* Config limit on Unix98 ptys */
138 static DEFINE_IDR(allocated_ptys);
139 static DECLARE_MUTEX(allocated_ptys_lock);
140 static int ptmx_open(struct inode *, struct file *);
141 #endif
142
143 extern void disable_early_printk(void);
144
145 static void initialize_tty_struct(struct tty_struct *tty);
146
147 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
148 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
149 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
150 static unsigned int tty_poll(struct file *, poll_table *);
151 static int tty_open(struct inode *, struct file *);
152 static int tty_release(struct inode *, struct file *);
153 int tty_ioctl(struct inode * inode, struct file * file,
154               unsigned int cmd, unsigned long arg);
155 static int tty_fasync(int fd, struct file * filp, int on);
156 static void release_mem(struct tty_struct *tty, int idx);
157
158
159 static struct tty_struct *alloc_tty_struct(void)
160 {
161         struct tty_struct *tty;
162
163         tty = kmalloc(sizeof(struct tty_struct), GFP_KERNEL);
164         if (tty)
165                 memset(tty, 0, sizeof(struct tty_struct));
166         return tty;
167 }
168
169 static void tty_buffer_free_all(struct tty_struct *);
170
171 static inline void free_tty_struct(struct tty_struct *tty)
172 {
173         kfree(tty->write_buf);
174         tty_buffer_free_all(tty);
175         kfree(tty);
176 }
177
178 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
179
180 char *tty_name(struct tty_struct *tty, char *buf)
181 {
182         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
183                 strcpy(buf, "NULL tty");
184         else
185                 strcpy(buf, tty->name);
186         return buf;
187 }
188
189 EXPORT_SYMBOL(tty_name);
190
191 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
192                               const char *routine)
193 {
194 #ifdef TTY_PARANOIA_CHECK
195         if (!tty) {
196                 printk(KERN_WARNING
197                         "null TTY for (%d:%d) in %s\n",
198                         imajor(inode), iminor(inode), routine);
199                 return 1;
200         }
201         if (tty->magic != TTY_MAGIC) {
202                 printk(KERN_WARNING
203                         "bad magic number for tty struct (%d:%d) in %s\n",
204                         imajor(inode), iminor(inode), routine);
205                 return 1;
206         }
207 #endif
208         return 0;
209 }
210
211 static int check_tty_count(struct tty_struct *tty, const char *routine)
212 {
213 #ifdef CHECK_TTY_COUNT
214         struct list_head *p;
215         int count = 0;
216         
217         file_list_lock();
218         list_for_each(p, &tty->tty_files) {
219                 count++;
220         }
221         file_list_unlock();
222         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
223             tty->driver->subtype == PTY_TYPE_SLAVE &&
224             tty->link && tty->link->count)
225                 count++;
226         if (tty->count != count) {
227                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
228                                     "!= #fd's(%d) in %s\n",
229                        tty->name, tty->count, count, routine);
230                 return count;
231        }        
232 #endif
233         return 0;
234 }
235
236 /*
237  * Tty buffer allocation management
238  */
239
240 static void tty_buffer_free_all(struct tty_struct *tty)
241 {
242         struct tty_buffer *thead;
243         while((thead = tty->buf.head) != NULL) {
244                 tty->buf.head = thead->next;
245                 kfree(thead);
246         }
247         while((thead = tty->buf.free) != NULL) {
248                 tty->buf.free = thead->next;
249                 kfree(thead);
250         }
251         tty->buf.tail = NULL;
252 }
253
254 static void tty_buffer_init(struct tty_struct *tty)
255 {
256         spin_lock_init(&tty->buf.lock);
257         tty->buf.head = NULL;
258         tty->buf.tail = NULL;
259         tty->buf.free = NULL;
260 }
261
262 static struct tty_buffer *tty_buffer_alloc(size_t size)
263 {
264         struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
265         if(p == NULL)
266                 return NULL;
267         p->used = 0;
268         p->size = size;
269         p->next = NULL;
270         p->active = 0;
271         p->commit = 0;
272         p->read = 0;
273         p->char_buf_ptr = (char *)(p->data);
274         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
275 /*      printk("Flip create %p\n", p); */
276         return p;
277 }
278
279 /* Must be called with the tty_read lock held. This needs to acquire strategy
280    code to decide if we should kfree or relink a given expired buffer */
281
282 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
283 {
284         /* Dumb strategy for now - should keep some stats */
285 /*      printk("Flip dispose %p\n", b); */
286         if(b->size >= 512)
287                 kfree(b);
288         else {
289                 b->next = tty->buf.free;
290                 tty->buf.free = b;
291         }
292 }
293
294 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
295 {
296         struct tty_buffer **tbh = &tty->buf.free;
297         while((*tbh) != NULL) {
298                 struct tty_buffer *t = *tbh;
299                 if(t->size >= size) {
300                         *tbh = t->next;
301                         t->next = NULL;
302                         t->used = 0;
303                         t->commit = 0;
304                         t->read = 0;
305                         /* DEBUG ONLY */
306 /*                      memset(t->data, '*', size); */
307 /*                      printk("Flip recycle %p\n", t); */
308                         return t;
309                 }
310                 tbh = &((*tbh)->next);
311         }
312         /* Round the buffer size out */
313         size = (size + 0xFF) & ~ 0xFF;
314         return tty_buffer_alloc(size);
315         /* Should possibly check if this fails for the largest buffer we
316            have queued and recycle that ? */
317 }
318
319 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
320 {
321         struct tty_buffer *b, *n;
322         int left;
323         unsigned long flags;
324
325         spin_lock_irqsave(&tty->buf.lock, flags);
326
327         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
328            remove this conditional if its worth it. This would be invisible
329            to the callers */
330         if ((b = tty->buf.tail) != NULL) {
331                 left = b->size - b->used;
332                 b->active = 1;
333         } else
334                 left = 0;
335
336         if (left < size) {
337                 /* This is the slow path - looking for new buffers to use */
338                 if ((n = tty_buffer_find(tty, size)) != NULL) {
339                         if (b != NULL) {
340                                 b->next = n;
341                                 b->active = 0;
342                                 b->commit = b->used;
343                         } else
344                                 tty->buf.head = n;
345                         tty->buf.tail = n;
346                         n->active = 1;
347                 } else
348                         size = left;
349         }
350
351         spin_unlock_irqrestore(&tty->buf.lock, flags);
352         return size;
353 }
354 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
355
356 int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
357                                 size_t size)
358 {
359         int copied = 0;
360         do {
361                 int space = tty_buffer_request_room(tty, size - copied);
362                 struct tty_buffer *tb = tty->buf.tail;
363                 /* If there is no space then tb may be NULL */
364                 if(unlikely(space == 0))
365                         break;
366                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
367                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
368                 tb->used += space;
369                 copied += space;
370                 chars += space;
371         }
372         /* There is a small chance that we need to split the data over
373            several buffers. If this is the case we must loop */
374         while (unlikely(size > copied));
375         return copied;
376 }
377 EXPORT_SYMBOL(tty_insert_flip_string);
378
379 int tty_insert_flip_string_flags(struct tty_struct *tty,
380                 const unsigned char *chars, const char *flags, size_t size)
381 {
382         int copied = 0;
383         do {
384                 int space = tty_buffer_request_room(tty, size - copied);
385                 struct tty_buffer *tb = tty->buf.tail;
386                 /* If there is no space then tb may be NULL */
387                 if(unlikely(space == 0))
388                         break;
389                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
390                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
391                 tb->used += space;
392                 copied += space;
393                 chars += space;
394                 flags += space;
395         }
396         /* There is a small chance that we need to split the data over
397            several buffers. If this is the case we must loop */
398         while (unlikely(size > copied));
399         return copied;
400 }
401 EXPORT_SYMBOL(tty_insert_flip_string_flags);
402
403 void tty_schedule_flip(struct tty_struct *tty)
404 {
405         unsigned long flags;
406         spin_lock_irqsave(&tty->buf.lock, flags);
407         if (tty->buf.tail != NULL) {
408                 tty->buf.tail->active = 0;
409                 tty->buf.tail->commit = tty->buf.tail->used;
410         }
411         spin_unlock_irqrestore(&tty->buf.lock, flags);
412         schedule_delayed_work(&tty->buf.work, 1);
413 }
414 EXPORT_SYMBOL(tty_schedule_flip);
415
416 /*
417  *      Prepare a block of space in the buffer for data. Returns the length
418  *      available and buffer pointer to the space which is now allocated and
419  *      accounted for as ready for normal characters. This is used for drivers
420  *      that need their own block copy routines into the buffer. There is no
421  *      guarantee the buffer is a DMA target!
422  */
423
424 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
425 {
426         int space = tty_buffer_request_room(tty, size);
427         if (likely(space)) {
428                 struct tty_buffer *tb = tty->buf.tail;
429                 *chars = tb->char_buf_ptr + tb->used;
430                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
431                 tb->used += space;
432         }
433         return space;
434 }
435
436 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
437
438 /*
439  *      Prepare a block of space in the buffer for data. Returns the length
440  *      available and buffer pointer to the space which is now allocated and
441  *      accounted for as ready for characters. This is used for drivers
442  *      that need their own block copy routines into the buffer. There is no
443  *      guarantee the buffer is a DMA target!
444  */
445
446 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
447 {
448         int space = tty_buffer_request_room(tty, size);
449         if (likely(space)) {
450                 struct tty_buffer *tb = tty->buf.tail;
451                 *chars = tb->char_buf_ptr + tb->used;
452                 *flags = tb->flag_buf_ptr + tb->used;
453                 tb->used += space;
454         }
455         return space;
456 }
457
458 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
459
460
461
462 /*
463  *      This is probably overkill for real world processors but
464  *      they are not on hot paths so a little discipline won't do 
465  *      any harm.
466  */
467  
468 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
469 {
470         down(&tty->termios_sem);
471         tty->termios->c_line = num;
472         up(&tty->termios_sem);
473 }
474
475 /*
476  *      This guards the refcounted line discipline lists. The lock
477  *      must be taken with irqs off because there are hangup path
478  *      callers who will do ldisc lookups and cannot sleep.
479  */
480  
481 static DEFINE_SPINLOCK(tty_ldisc_lock);
482 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
483 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
484
485 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
486 {
487         unsigned long flags;
488         int ret = 0;
489         
490         if (disc < N_TTY || disc >= NR_LDISCS)
491                 return -EINVAL;
492         
493         spin_lock_irqsave(&tty_ldisc_lock, flags);
494         tty_ldiscs[disc] = *new_ldisc;
495         tty_ldiscs[disc].num = disc;
496         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
497         tty_ldiscs[disc].refcount = 0;
498         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
499         
500         return ret;
501 }
502 EXPORT_SYMBOL(tty_register_ldisc);
503
504 int tty_unregister_ldisc(int disc)
505 {
506         unsigned long flags;
507         int ret = 0;
508
509         if (disc < N_TTY || disc >= NR_LDISCS)
510                 return -EINVAL;
511
512         spin_lock_irqsave(&tty_ldisc_lock, flags);
513         if (tty_ldiscs[disc].refcount)
514                 ret = -EBUSY;
515         else
516                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
517         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
518
519         return ret;
520 }
521 EXPORT_SYMBOL(tty_unregister_ldisc);
522
523 struct tty_ldisc *tty_ldisc_get(int disc)
524 {
525         unsigned long flags;
526         struct tty_ldisc *ld;
527
528         if (disc < N_TTY || disc >= NR_LDISCS)
529                 return NULL;
530         
531         spin_lock_irqsave(&tty_ldisc_lock, flags);
532
533         ld = &tty_ldiscs[disc];
534         /* Check the entry is defined */
535         if(ld->flags & LDISC_FLAG_DEFINED)
536         {
537                 /* If the module is being unloaded we can't use it */
538                 if (!try_module_get(ld->owner))
539                         ld = NULL;
540                 else /* lock it */
541                         ld->refcount++;
542         }
543         else
544                 ld = NULL;
545         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
546         return ld;
547 }
548
549 EXPORT_SYMBOL_GPL(tty_ldisc_get);
550
551 void tty_ldisc_put(int disc)
552 {
553         struct tty_ldisc *ld;
554         unsigned long flags;
555         
556         BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
557                 
558         spin_lock_irqsave(&tty_ldisc_lock, flags);
559         ld = &tty_ldiscs[disc];
560         BUG_ON(ld->refcount == 0);
561         ld->refcount--;
562         module_put(ld->owner);
563         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
564 }
565         
566 EXPORT_SYMBOL_GPL(tty_ldisc_put);
567
568 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
569 {
570         tty->ldisc = *ld;
571         tty->ldisc.refcount = 0;
572 }
573
574 /**
575  *      tty_ldisc_try           -       internal helper
576  *      @tty: the tty
577  *
578  *      Make a single attempt to grab and bump the refcount on
579  *      the tty ldisc. Return 0 on failure or 1 on success. This is
580  *      used to implement both the waiting and non waiting versions
581  *      of tty_ldisc_ref
582  */
583
584 static int tty_ldisc_try(struct tty_struct *tty)
585 {
586         unsigned long flags;
587         struct tty_ldisc *ld;
588         int ret = 0;
589         
590         spin_lock_irqsave(&tty_ldisc_lock, flags);
591         ld = &tty->ldisc;
592         if(test_bit(TTY_LDISC, &tty->flags))
593         {
594                 ld->refcount++;
595                 ret = 1;
596         }
597         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
598         return ret;
599 }
600
601 /**
602  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
603  *      @tty: tty device
604  *
605  *      Dereference the line discipline for the terminal and take a 
606  *      reference to it. If the line discipline is in flux then 
607  *      wait patiently until it changes.
608  *
609  *      Note: Must not be called from an IRQ/timer context. The caller
610  *      must also be careful not to hold other locks that will deadlock
611  *      against a discipline change, such as an existing ldisc reference
612  *      (which we check for)
613  */
614  
615 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
616 {
617         /* wait_event is a macro */
618         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
619         if(tty->ldisc.refcount == 0)
620                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
621         return &tty->ldisc;
622 }
623
624 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
625
626 /**
627  *      tty_ldisc_ref           -       get the tty ldisc
628  *      @tty: tty device
629  *
630  *      Dereference the line discipline for the terminal and take a 
631  *      reference to it. If the line discipline is in flux then 
632  *      return NULL. Can be called from IRQ and timer functions.
633  */
634  
635 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
636 {
637         if(tty_ldisc_try(tty))
638                 return &tty->ldisc;
639         return NULL;
640 }
641
642 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
643
644 /**
645  *      tty_ldisc_deref         -       free a tty ldisc reference
646  *      @ld: reference to free up
647  *
648  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
649  *      be called in IRQ context.
650  */
651  
652 void tty_ldisc_deref(struct tty_ldisc *ld)
653 {
654         unsigned long flags;
655
656         BUG_ON(ld == NULL);
657                 
658         spin_lock_irqsave(&tty_ldisc_lock, flags);
659         if(ld->refcount == 0)
660                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
661         else
662                 ld->refcount--;
663         if(ld->refcount == 0)
664                 wake_up(&tty_ldisc_wait);
665         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
666 }
667
668 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
669
670 /**
671  *      tty_ldisc_enable        -       allow ldisc use
672  *      @tty: terminal to activate ldisc on
673  *
674  *      Set the TTY_LDISC flag when the line discipline can be called
675  *      again. Do neccessary wakeups for existing sleepers.
676  *
677  *      Note: nobody should set this bit except via this function. Clearing
678  *      directly is allowed.
679  */
680
681 static void tty_ldisc_enable(struct tty_struct *tty)
682 {
683         set_bit(TTY_LDISC, &tty->flags);
684         wake_up(&tty_ldisc_wait);
685 }
686         
687 /**
688  *      tty_set_ldisc           -       set line discipline
689  *      @tty: the terminal to set
690  *      @ldisc: the line discipline
691  *
692  *      Set the discipline of a tty line. Must be called from a process
693  *      context.
694  */
695  
696 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
697 {
698         int retval = 0;
699         struct tty_ldisc o_ldisc;
700         char buf[64];
701         int work;
702         unsigned long flags;
703         struct tty_ldisc *ld;
704         struct tty_struct *o_tty;
705
706         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
707                 return -EINVAL;
708
709 restart:
710
711         ld = tty_ldisc_get(ldisc);
712         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
713         /* Cyrus Durgin <cider@speakeasy.org> */
714         if (ld == NULL) {
715                 request_module("tty-ldisc-%d", ldisc);
716                 ld = tty_ldisc_get(ldisc);
717         }
718         if (ld == NULL)
719                 return -EINVAL;
720
721         /*
722          *      No more input please, we are switching. The new ldisc
723          *      will update this value in the ldisc open function
724          */
725
726         tty->receive_room = 0;
727
728         /*
729          *      Problem: What do we do if this blocks ?
730          */
731
732         tty_wait_until_sent(tty, 0);
733
734         if (tty->ldisc.num == ldisc) {
735                 tty_ldisc_put(ldisc);
736                 return 0;
737         }
738
739         o_ldisc = tty->ldisc;
740         o_tty = tty->link;
741
742         /*
743          *      Make sure we don't change while someone holds a
744          *      reference to the line discipline. The TTY_LDISC bit
745          *      prevents anyone taking a reference once it is clear.
746          *      We need the lock to avoid racing reference takers.
747          */
748
749         spin_lock_irqsave(&tty_ldisc_lock, flags);
750         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
751                 if(tty->ldisc.refcount) {
752                         /* Free the new ldisc we grabbed. Must drop the lock
753                            first. */
754                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
755                         tty_ldisc_put(ldisc);
756                         /*
757                          * There are several reasons we may be busy, including
758                          * random momentary I/O traffic. We must therefore
759                          * retry. We could distinguish between blocking ops
760                          * and retries if we made tty_ldisc_wait() smarter. That
761                          * is up for discussion.
762                          */
763                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
764                                 return -ERESTARTSYS;
765                         goto restart;
766                 }
767                 if(o_tty && o_tty->ldisc.refcount) {
768                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
769                         tty_ldisc_put(ldisc);
770                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
771                                 return -ERESTARTSYS;
772                         goto restart;
773                 }
774         }
775
776         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
777
778         if (!test_bit(TTY_LDISC, &tty->flags)) {
779                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
780                 tty_ldisc_put(ldisc);
781                 ld = tty_ldisc_ref_wait(tty);
782                 tty_ldisc_deref(ld);
783                 goto restart;
784         }
785
786         clear_bit(TTY_LDISC, &tty->flags);
787         clear_bit(TTY_DONT_FLIP, &tty->flags);
788         if (o_tty) {
789                 clear_bit(TTY_LDISC, &o_tty->flags);
790                 clear_bit(TTY_DONT_FLIP, &o_tty->flags);
791         }
792         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
793
794         /*
795          *      From this point on we know nobody has an ldisc
796          *      usage reference, nor can they obtain one until
797          *      we say so later on.
798          */
799
800         work = cancel_delayed_work(&tty->buf.work);
801         /*
802          * Wait for ->hangup_work and ->buf.work handlers to terminate
803          */
804          
805         flush_scheduled_work();
806         /* Shutdown the current discipline. */
807         if (tty->ldisc.close)
808                 (tty->ldisc.close)(tty);
809
810         /* Now set up the new line discipline. */
811         tty_ldisc_assign(tty, ld);
812         tty_set_termios_ldisc(tty, ldisc);
813         if (tty->ldisc.open)
814                 retval = (tty->ldisc.open)(tty);
815         if (retval < 0) {
816                 tty_ldisc_put(ldisc);
817                 /* There is an outstanding reference here so this is safe */
818                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
819                 tty_set_termios_ldisc(tty, tty->ldisc.num);
820                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
821                         tty_ldisc_put(o_ldisc.num);
822                         /* This driver is always present */
823                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
824                         tty_set_termios_ldisc(tty, N_TTY);
825                         if (tty->ldisc.open) {
826                                 int r = tty->ldisc.open(tty);
827
828                                 if (r < 0)
829                                         panic("Couldn't open N_TTY ldisc for "
830                                               "%s --- error %d.",
831                                               tty_name(tty, buf), r);
832                         }
833                 }
834         }
835         /* At this point we hold a reference to the new ldisc and a
836            a reference to the old ldisc. If we ended up flipping back
837            to the existing ldisc we have two references to it */
838         
839         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
840                 tty->driver->set_ldisc(tty);
841                 
842         tty_ldisc_put(o_ldisc.num);
843         
844         /*
845          *      Allow ldisc referencing to occur as soon as the driver
846          *      ldisc callback completes.
847          */
848          
849         tty_ldisc_enable(tty);
850         if (o_tty)
851                 tty_ldisc_enable(o_tty);
852         
853         /* Restart it in case no characters kick it off. Safe if
854            already running */
855         if (work)
856                 schedule_delayed_work(&tty->buf.work, 1);
857         return retval;
858 }
859
860 /*
861  * This routine returns a tty driver structure, given a device number
862  */
863 static struct tty_driver *get_tty_driver(dev_t device, int *index)
864 {
865         struct tty_driver *p;
866
867         list_for_each_entry(p, &tty_drivers, tty_drivers) {
868                 dev_t base = MKDEV(p->major, p->minor_start);
869                 if (device < base || device >= base + p->num)
870                         continue;
871                 *index = device - base;
872                 return p;
873         }
874         return NULL;
875 }
876
877 /*
878  * If we try to write to, or set the state of, a terminal and we're
879  * not in the foreground, send a SIGTTOU.  If the signal is blocked or
880  * ignored, go ahead and perform the operation.  (POSIX 7.2)
881  */
882 int tty_check_change(struct tty_struct * tty)
883 {
884         if (current->signal->tty != tty)
885                 return 0;
886         if (tty->pgrp <= 0) {
887                 printk(KERN_WARNING "tty_check_change: tty->pgrp <= 0!\n");
888                 return 0;
889         }
890         if (process_group(current) == tty->pgrp)
891                 return 0;
892         if (is_ignored(SIGTTOU))
893                 return 0;
894         if (is_orphaned_pgrp(process_group(current)))
895                 return -EIO;
896         (void) kill_pg(process_group(current), SIGTTOU, 1);
897         return -ERESTARTSYS;
898 }
899
900 EXPORT_SYMBOL(tty_check_change);
901
902 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
903                                 size_t count, loff_t *ppos)
904 {
905         return 0;
906 }
907
908 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
909                                  size_t count, loff_t *ppos)
910 {
911         return -EIO;
912 }
913
914 /* No kernel lock held - none needed ;) */
915 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
916 {
917         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
918 }
919
920 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
921                              unsigned int cmd, unsigned long arg)
922 {
923         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
924 }
925
926 static struct file_operations tty_fops = {
927         .llseek         = no_llseek,
928         .read           = tty_read,
929         .write          = tty_write,
930         .poll           = tty_poll,
931         .ioctl          = tty_ioctl,
932         .open           = tty_open,
933         .release        = tty_release,
934         .fasync         = tty_fasync,
935 };
936
937 #ifdef CONFIG_UNIX98_PTYS
938 static struct file_operations ptmx_fops = {
939         .llseek         = no_llseek,
940         .read           = tty_read,
941         .write          = tty_write,
942         .poll           = tty_poll,
943         .ioctl          = tty_ioctl,
944         .open           = ptmx_open,
945         .release        = tty_release,
946         .fasync         = tty_fasync,
947 };
948 #endif
949
950 static struct file_operations console_fops = {
951         .llseek         = no_llseek,
952         .read           = tty_read,
953         .write          = redirected_tty_write,
954         .poll           = tty_poll,
955         .ioctl          = tty_ioctl,
956         .open           = tty_open,
957         .release        = tty_release,
958         .fasync         = tty_fasync,
959 };
960
961 static struct file_operations hung_up_tty_fops = {
962         .llseek         = no_llseek,
963         .read           = hung_up_tty_read,
964         .write          = hung_up_tty_write,
965         .poll           = hung_up_tty_poll,
966         .ioctl          = hung_up_tty_ioctl,
967         .release        = tty_release,
968 };
969
970 static DEFINE_SPINLOCK(redirect_lock);
971 static struct file *redirect;
972
973 /**
974  *      tty_wakeup      -       request more data
975  *      @tty: terminal
976  *
977  *      Internal and external helper for wakeups of tty. This function
978  *      informs the line discipline if present that the driver is ready
979  *      to receive more output data.
980  */
981  
982 void tty_wakeup(struct tty_struct *tty)
983 {
984         struct tty_ldisc *ld;
985         
986         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
987                 ld = tty_ldisc_ref(tty);
988                 if(ld) {
989                         if(ld->write_wakeup)
990                                 ld->write_wakeup(tty);
991                         tty_ldisc_deref(ld);
992                 }
993         }
994         wake_up_interruptible(&tty->write_wait);
995 }
996
997 EXPORT_SYMBOL_GPL(tty_wakeup);
998
999 /**
1000  *      tty_ldisc_flush -       flush line discipline queue
1001  *      @tty: tty
1002  *
1003  *      Flush the line discipline queue (if any) for this tty. If there
1004  *      is no line discipline active this is a no-op.
1005  */
1006  
1007 void tty_ldisc_flush(struct tty_struct *tty)
1008 {
1009         struct tty_ldisc *ld = tty_ldisc_ref(tty);
1010         if(ld) {
1011                 if(ld->flush_buffer)
1012                         ld->flush_buffer(tty);
1013                 tty_ldisc_deref(ld);
1014         }
1015 }
1016
1017 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
1018         
1019 /*
1020  * This can be called by the "eventd" kernel thread.  That is process synchronous,
1021  * but doesn't hold any locks, so we need to make sure we have the appropriate
1022  * locks for what we're doing..
1023  */
1024 static void do_tty_hangup(void *data)
1025 {
1026         struct tty_struct *tty = (struct tty_struct *) data;
1027         struct file * cons_filp = NULL;
1028         struct file *filp, *f = NULL;
1029         struct task_struct *p;
1030         struct tty_ldisc *ld;
1031         int    closecount = 0, n;
1032
1033         if (!tty)
1034                 return;
1035
1036         /* inuse_filps is protected by the single kernel lock */
1037         lock_kernel();
1038
1039         spin_lock(&redirect_lock);
1040         if (redirect && redirect->private_data == tty) {
1041                 f = redirect;
1042                 redirect = NULL;
1043         }
1044         spin_unlock(&redirect_lock);
1045         
1046         check_tty_count(tty, "do_tty_hangup");
1047         file_list_lock();
1048         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1049         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1050                 if (filp->f_op->write == redirected_tty_write)
1051                         cons_filp = filp;
1052                 if (filp->f_op->write != tty_write)
1053                         continue;
1054                 closecount++;
1055                 tty_fasync(-1, filp, 0);        /* can't block */
1056                 filp->f_op = &hung_up_tty_fops;
1057         }
1058         file_list_unlock();
1059         
1060         /* FIXME! What are the locking issues here? This may me overdoing things..
1061          * this question is especially important now that we've removed the irqlock. */
1062
1063         ld = tty_ldisc_ref(tty);
1064         if(ld != NULL)  /* We may have no line discipline at this point */
1065         {
1066                 if (ld->flush_buffer)
1067                         ld->flush_buffer(tty);
1068                 if (tty->driver->flush_buffer)
1069                         tty->driver->flush_buffer(tty);
1070                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1071                     ld->write_wakeup)
1072                         ld->write_wakeup(tty);
1073                 if (ld->hangup)
1074                         ld->hangup(tty);
1075         }
1076
1077         /* FIXME: Once we trust the LDISC code better we can wait here for
1078            ldisc completion and fix the driver call race */
1079            
1080         wake_up_interruptible(&tty->write_wait);
1081         wake_up_interruptible(&tty->read_wait);
1082
1083         /*
1084          * Shutdown the current line discipline, and reset it to
1085          * N_TTY.
1086          */
1087         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1088         {
1089                 down(&tty->termios_sem);
1090                 *tty->termios = tty->driver->init_termios;
1091                 up(&tty->termios_sem);
1092         }
1093         
1094         /* Defer ldisc switch */
1095         /* tty_deferred_ldisc_switch(N_TTY);
1096         
1097           This should get done automatically when the port closes and
1098           tty_release is called */
1099         
1100         read_lock(&tasklist_lock);
1101         if (tty->session > 0) {
1102                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1103                         if (p->signal->tty == tty)
1104                                 p->signal->tty = NULL;
1105                         if (!p->signal->leader)
1106                                 continue;
1107                         group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1108                         group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1109                         if (tty->pgrp > 0)
1110                                 p->signal->tty_old_pgrp = tty->pgrp;
1111                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1112         }
1113         read_unlock(&tasklist_lock);
1114
1115         tty->flags = 0;
1116         tty->session = 0;
1117         tty->pgrp = -1;
1118         tty->ctrl_status = 0;
1119         /*
1120          *      If one of the devices matches a console pointer, we
1121          *      cannot just call hangup() because that will cause
1122          *      tty->count and state->count to go out of sync.
1123          *      So we just call close() the right number of times.
1124          */
1125         if (cons_filp) {
1126                 if (tty->driver->close)
1127                         for (n = 0; n < closecount; n++)
1128                                 tty->driver->close(tty, cons_filp);
1129         } else if (tty->driver->hangup)
1130                 (tty->driver->hangup)(tty);
1131                 
1132         /* We don't want to have driver/ldisc interactions beyond
1133            the ones we did here. The driver layer expects no
1134            calls after ->hangup() from the ldisc side. However we
1135            can't yet guarantee all that */
1136
1137         set_bit(TTY_HUPPED, &tty->flags);
1138         if (ld) {
1139                 tty_ldisc_enable(tty);
1140                 tty_ldisc_deref(ld);
1141         }
1142         unlock_kernel();
1143         if (f)
1144                 fput(f);
1145 }
1146
1147 void tty_hangup(struct tty_struct * tty)
1148 {
1149 #ifdef TTY_DEBUG_HANGUP
1150         char    buf[64];
1151         
1152         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1153 #endif
1154         schedule_work(&tty->hangup_work);
1155 }
1156
1157 EXPORT_SYMBOL(tty_hangup);
1158
1159 void tty_vhangup(struct tty_struct * tty)
1160 {
1161 #ifdef TTY_DEBUG_HANGUP
1162         char    buf[64];
1163
1164         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1165 #endif
1166         do_tty_hangup((void *) tty);
1167 }
1168 EXPORT_SYMBOL(tty_vhangup);
1169
1170 int tty_hung_up_p(struct file * filp)
1171 {
1172         return (filp->f_op == &hung_up_tty_fops);
1173 }
1174
1175 EXPORT_SYMBOL(tty_hung_up_p);
1176
1177 /*
1178  * This function is typically called only by the session leader, when
1179  * it wants to disassociate itself from its controlling tty.
1180  *
1181  * It performs the following functions:
1182  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1183  *      (2)  Clears the tty from being controlling the session
1184  *      (3)  Clears the controlling tty for all processes in the
1185  *              session group.
1186  *
1187  * The argument on_exit is set to 1 if called when a process is
1188  * exiting; it is 0 if called by the ioctl TIOCNOTTY.
1189  */
1190 void disassociate_ctty(int on_exit)
1191 {
1192         struct tty_struct *tty;
1193         struct task_struct *p;
1194         int tty_pgrp = -1;
1195
1196         lock_kernel();
1197
1198         mutex_lock(&tty_mutex);
1199         tty = current->signal->tty;
1200         if (tty) {
1201                 tty_pgrp = tty->pgrp;
1202                 mutex_unlock(&tty_mutex);
1203                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1204                         tty_vhangup(tty);
1205         } else {
1206                 if (current->signal->tty_old_pgrp) {
1207                         kill_pg(current->signal->tty_old_pgrp, SIGHUP, on_exit);
1208                         kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit);
1209                 }
1210                 mutex_unlock(&tty_mutex);
1211                 unlock_kernel();        
1212                 return;
1213         }
1214         if (tty_pgrp > 0) {
1215                 kill_pg(tty_pgrp, SIGHUP, on_exit);
1216                 if (!on_exit)
1217                         kill_pg(tty_pgrp, SIGCONT, on_exit);
1218         }
1219
1220         /* Must lock changes to tty_old_pgrp */
1221         mutex_lock(&tty_mutex);
1222         current->signal->tty_old_pgrp = 0;
1223         tty->session = 0;
1224         tty->pgrp = -1;
1225
1226         /* Now clear signal->tty under the lock */
1227         read_lock(&tasklist_lock);
1228         do_each_task_pid(current->signal->session, PIDTYPE_SID, p) {
1229                 p->signal->tty = NULL;
1230         } while_each_task_pid(current->signal->session, PIDTYPE_SID, p);
1231         read_unlock(&tasklist_lock);
1232         mutex_unlock(&tty_mutex);
1233         unlock_kernel();
1234 }
1235
1236 void stop_tty(struct tty_struct *tty)
1237 {
1238         if (tty->stopped)
1239                 return;
1240         tty->stopped = 1;
1241         if (tty->link && tty->link->packet) {
1242                 tty->ctrl_status &= ~TIOCPKT_START;
1243                 tty->ctrl_status |= TIOCPKT_STOP;
1244                 wake_up_interruptible(&tty->link->read_wait);
1245         }
1246         if (tty->driver->stop)
1247                 (tty->driver->stop)(tty);
1248 }
1249
1250 EXPORT_SYMBOL(stop_tty);
1251
1252 void start_tty(struct tty_struct *tty)
1253 {
1254         if (!tty->stopped || tty->flow_stopped)
1255                 return;
1256         tty->stopped = 0;
1257         if (tty->link && tty->link->packet) {
1258                 tty->ctrl_status &= ~TIOCPKT_STOP;
1259                 tty->ctrl_status |= TIOCPKT_START;
1260                 wake_up_interruptible(&tty->link->read_wait);
1261         }
1262         if (tty->driver->start)
1263                 (tty->driver->start)(tty);
1264
1265         /* If we have a running line discipline it may need kicking */
1266         tty_wakeup(tty);
1267         wake_up_interruptible(&tty->write_wait);
1268 }
1269
1270 EXPORT_SYMBOL(start_tty);
1271
1272 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1273                         loff_t *ppos)
1274 {
1275         int i;
1276         struct tty_struct * tty;
1277         struct inode *inode;
1278         struct tty_ldisc *ld;
1279
1280         tty = (struct tty_struct *)file->private_data;
1281         inode = file->f_dentry->d_inode;
1282         if (tty_paranoia_check(tty, inode, "tty_read"))
1283                 return -EIO;
1284         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1285                 return -EIO;
1286
1287         /* We want to wait for the line discipline to sort out in this
1288            situation */
1289         ld = tty_ldisc_ref_wait(tty);
1290         lock_kernel();
1291         if (ld->read)
1292                 i = (ld->read)(tty,file,buf,count);
1293         else
1294                 i = -EIO;
1295         tty_ldisc_deref(ld);
1296         unlock_kernel();
1297         if (i > 0)
1298                 inode->i_atime = current_fs_time(inode->i_sb);
1299         return i;
1300 }
1301
1302 /*
1303  * Split writes up in sane blocksizes to avoid
1304  * denial-of-service type attacks
1305  */
1306 static inline ssize_t do_tty_write(
1307         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1308         struct tty_struct *tty,
1309         struct file *file,
1310         const char __user *buf,
1311         size_t count)
1312 {
1313         ssize_t ret = 0, written = 0;
1314         unsigned int chunk;
1315         
1316         if (mutex_lock_interruptible(&tty->atomic_write_lock)) {
1317                 return -ERESTARTSYS;
1318         }
1319
1320         /*
1321          * We chunk up writes into a temporary buffer. This
1322          * simplifies low-level drivers immensely, since they
1323          * don't have locking issues and user mode accesses.
1324          *
1325          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1326          * big chunk-size..
1327          *
1328          * The default chunk-size is 2kB, because the NTTY
1329          * layer has problems with bigger chunks. It will
1330          * claim to be able to handle more characters than
1331          * it actually does.
1332          */
1333         chunk = 2048;
1334         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1335                 chunk = 65536;
1336         if (count < chunk)
1337                 chunk = count;
1338
1339         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1340         if (tty->write_cnt < chunk) {
1341                 unsigned char *buf;
1342
1343                 if (chunk < 1024)
1344                         chunk = 1024;
1345
1346                 buf = kmalloc(chunk, GFP_KERNEL);
1347                 if (!buf) {
1348                         mutex_unlock(&tty->atomic_write_lock);
1349                         return -ENOMEM;
1350                 }
1351                 kfree(tty->write_buf);
1352                 tty->write_cnt = chunk;
1353                 tty->write_buf = buf;
1354         }
1355
1356         /* Do the write .. */
1357         for (;;) {
1358                 size_t size = count;
1359                 if (size > chunk)
1360                         size = chunk;
1361                 ret = -EFAULT;
1362                 if (copy_from_user(tty->write_buf, buf, size))
1363                         break;
1364                 lock_kernel();
1365                 ret = write(tty, file, tty->write_buf, size);
1366                 unlock_kernel();
1367                 if (ret <= 0)
1368                         break;
1369                 written += ret;
1370                 buf += ret;
1371                 count -= ret;
1372                 if (!count)
1373                         break;
1374                 ret = -ERESTARTSYS;
1375                 if (signal_pending(current))
1376                         break;
1377                 cond_resched();
1378         }
1379         if (written) {
1380                 struct inode *inode = file->f_dentry->d_inode;
1381                 inode->i_mtime = current_fs_time(inode->i_sb);
1382                 ret = written;
1383         }
1384         mutex_unlock(&tty->atomic_write_lock);
1385         return ret;
1386 }
1387
1388
1389 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1390                          loff_t *ppos)
1391 {
1392         struct tty_struct * tty;
1393         struct inode *inode = file->f_dentry->d_inode;
1394         ssize_t ret;
1395         struct tty_ldisc *ld;
1396         
1397         tty = (struct tty_struct *)file->private_data;
1398         if (tty_paranoia_check(tty, inode, "tty_write"))
1399                 return -EIO;
1400         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1401                 return -EIO;
1402
1403         ld = tty_ldisc_ref_wait(tty);           
1404         if (!ld->write)
1405                 ret = -EIO;
1406         else
1407                 ret = do_tty_write(ld->write, tty, file, buf, count);
1408         tty_ldisc_deref(ld);
1409         return ret;
1410 }
1411
1412 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1413                          loff_t *ppos)
1414 {
1415         struct file *p = NULL;
1416
1417         spin_lock(&redirect_lock);
1418         if (redirect) {
1419                 get_file(redirect);
1420                 p = redirect;
1421         }
1422         spin_unlock(&redirect_lock);
1423
1424         if (p) {
1425                 ssize_t res;
1426                 res = vfs_write(p, buf, count, &p->f_pos);
1427                 fput(p);
1428                 return res;
1429         }
1430
1431         return tty_write(file, buf, count, ppos);
1432 }
1433
1434 static char ptychar[] = "pqrstuvwxyzabcde";
1435
1436 static inline void pty_line_name(struct tty_driver *driver, int index, char *p)
1437 {
1438         int i = index + driver->name_base;
1439         /* ->name is initialized to "ttyp", but "tty" is expected */
1440         sprintf(p, "%s%c%x",
1441                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1442                         ptychar[i >> 4 & 0xf], i & 0xf);
1443 }
1444
1445 static inline void tty_line_name(struct tty_driver *driver, int index, char *p)
1446 {
1447         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1448 }
1449
1450 /*
1451  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1452  * failed open.  The new code protects the open with a mutex, so it's
1453  * really quite straightforward.  The mutex locking can probably be
1454  * relaxed for the (most common) case of reopening a tty.
1455  */
1456 static int init_dev(struct tty_driver *driver, int idx,
1457         struct tty_struct **ret_tty)
1458 {
1459         struct tty_struct *tty, *o_tty;
1460         struct termios *tp, **tp_loc, *o_tp, **o_tp_loc;
1461         struct termios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
1462         int retval=0;
1463
1464         /* check whether we're reopening an existing tty */
1465         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1466                 tty = devpts_get_tty(idx);
1467                 if (tty && driver->subtype == PTY_TYPE_MASTER)
1468                         tty = tty->link;
1469         } else {
1470                 tty = driver->ttys[idx];
1471         }
1472         if (tty) goto fast_track;
1473
1474         /*
1475          * First time open is complex, especially for PTY devices.
1476          * This code guarantees that either everything succeeds and the
1477          * TTY is ready for operation, or else the table slots are vacated
1478          * and the allocated memory released.  (Except that the termios 
1479          * and locked termios may be retained.)
1480          */
1481
1482         if (!try_module_get(driver->owner)) {
1483                 retval = -ENODEV;
1484                 goto end_init;
1485         }
1486
1487         o_tty = NULL;
1488         tp = o_tp = NULL;
1489         ltp = o_ltp = NULL;
1490
1491         tty = alloc_tty_struct();
1492         if(!tty)
1493                 goto fail_no_mem;
1494         initialize_tty_struct(tty);
1495         tty->driver = driver;
1496         tty->index = idx;
1497         tty_line_name(driver, idx, tty->name);
1498
1499         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1500                 tp_loc = &tty->termios;
1501                 ltp_loc = &tty->termios_locked;
1502         } else {
1503                 tp_loc = &driver->termios[idx];
1504                 ltp_loc = &driver->termios_locked[idx];
1505         }
1506
1507         if (!*tp_loc) {
1508                 tp = (struct termios *) kmalloc(sizeof(struct termios),
1509                                                 GFP_KERNEL);
1510                 if (!tp)
1511                         goto free_mem_out;
1512                 *tp = driver->init_termios;
1513         }
1514
1515         if (!*ltp_loc) {
1516                 ltp = (struct termios *) kmalloc(sizeof(struct termios),
1517                                                  GFP_KERNEL);
1518                 if (!ltp)
1519                         goto free_mem_out;
1520                 memset(ltp, 0, sizeof(struct termios));
1521         }
1522
1523         if (driver->type == TTY_DRIVER_TYPE_PTY) {
1524                 o_tty = alloc_tty_struct();
1525                 if (!o_tty)
1526                         goto free_mem_out;
1527                 initialize_tty_struct(o_tty);
1528                 o_tty->driver = driver->other;
1529                 o_tty->index = idx;
1530                 tty_line_name(driver->other, idx, o_tty->name);
1531
1532                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1533                         o_tp_loc = &o_tty->termios;
1534                         o_ltp_loc = &o_tty->termios_locked;
1535                 } else {
1536                         o_tp_loc = &driver->other->termios[idx];
1537                         o_ltp_loc = &driver->other->termios_locked[idx];
1538                 }
1539
1540                 if (!*o_tp_loc) {
1541                         o_tp = (struct termios *)
1542                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1543                         if (!o_tp)
1544                                 goto free_mem_out;
1545                         *o_tp = driver->other->init_termios;
1546                 }
1547
1548                 if (!*o_ltp_loc) {
1549                         o_ltp = (struct termios *)
1550                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1551                         if (!o_ltp)
1552                                 goto free_mem_out;
1553                         memset(o_ltp, 0, sizeof(struct termios));
1554                 }
1555
1556                 /*
1557                  * Everything allocated ... set up the o_tty structure.
1558                  */
1559                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
1560                         driver->other->ttys[idx] = o_tty;
1561                 }
1562                 if (!*o_tp_loc)
1563                         *o_tp_loc = o_tp;
1564                 if (!*o_ltp_loc)
1565                         *o_ltp_loc = o_ltp;
1566                 o_tty->termios = *o_tp_loc;
1567                 o_tty->termios_locked = *o_ltp_loc;
1568                 driver->other->refcount++;
1569                 if (driver->subtype == PTY_TYPE_MASTER)
1570                         o_tty->count++;
1571
1572                 /* Establish the links in both directions */
1573                 tty->link   = o_tty;
1574                 o_tty->link = tty;
1575         }
1576
1577         /* 
1578          * All structures have been allocated, so now we install them.
1579          * Failures after this point use release_mem to clean up, so 
1580          * there's no need to null out the local pointers.
1581          */
1582         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1583                 driver->ttys[idx] = tty;
1584         }
1585         
1586         if (!*tp_loc)
1587                 *tp_loc = tp;
1588         if (!*ltp_loc)
1589                 *ltp_loc = ltp;
1590         tty->termios = *tp_loc;
1591         tty->termios_locked = *ltp_loc;
1592         driver->refcount++;
1593         tty->count++;
1594
1595         /* 
1596          * Structures all installed ... call the ldisc open routines.
1597          * If we fail here just call release_mem to clean up.  No need
1598          * to decrement the use counts, as release_mem doesn't care.
1599          */
1600
1601         if (tty->ldisc.open) {
1602                 retval = (tty->ldisc.open)(tty);
1603                 if (retval)
1604                         goto release_mem_out;
1605         }
1606         if (o_tty && o_tty->ldisc.open) {
1607                 retval = (o_tty->ldisc.open)(o_tty);
1608                 if (retval) {
1609                         if (tty->ldisc.close)
1610                                 (tty->ldisc.close)(tty);
1611                         goto release_mem_out;
1612                 }
1613                 tty_ldisc_enable(o_tty);
1614         }
1615         tty_ldisc_enable(tty);
1616         goto success;
1617
1618         /*
1619          * This fast open can be used if the tty is already open.
1620          * No memory is allocated, and the only failures are from
1621          * attempting to open a closing tty or attempting multiple
1622          * opens on a pty master.
1623          */
1624 fast_track:
1625         if (test_bit(TTY_CLOSING, &tty->flags)) {
1626                 retval = -EIO;
1627                 goto end_init;
1628         }
1629         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1630             driver->subtype == PTY_TYPE_MASTER) {
1631                 /*
1632                  * special case for PTY masters: only one open permitted, 
1633                  * and the slave side open count is incremented as well.
1634                  */
1635                 if (tty->count) {
1636                         retval = -EIO;
1637                         goto end_init;
1638                 }
1639                 tty->link->count++;
1640         }
1641         tty->count++;
1642         tty->driver = driver; /* N.B. why do this every time?? */
1643
1644         /* FIXME */
1645         if(!test_bit(TTY_LDISC, &tty->flags))
1646                 printk(KERN_ERR "init_dev but no ldisc\n");
1647 success:
1648         *ret_tty = tty;
1649         
1650         /* All paths come through here to release the mutex */
1651 end_init:
1652         return retval;
1653
1654         /* Release locally allocated memory ... nothing placed in slots */
1655 free_mem_out:
1656         kfree(o_tp);
1657         if (o_tty)
1658                 free_tty_struct(o_tty);
1659         kfree(ltp);
1660         kfree(tp);
1661         free_tty_struct(tty);
1662
1663 fail_no_mem:
1664         module_put(driver->owner);
1665         retval = -ENOMEM;
1666         goto end_init;
1667
1668         /* call the tty release_mem routine to clean out this slot */
1669 release_mem_out:
1670         printk(KERN_INFO "init_dev: ldisc open failed, "
1671                          "clearing slot %d\n", idx);
1672         release_mem(tty, idx);
1673         goto end_init;
1674 }
1675
1676 /*
1677  * Releases memory associated with a tty structure, and clears out the
1678  * driver table slots.
1679  */
1680 static void release_mem(struct tty_struct *tty, int idx)
1681 {
1682         struct tty_struct *o_tty;
1683         struct termios *tp;
1684         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
1685
1686         if ((o_tty = tty->link) != NULL) {
1687                 if (!devpts)
1688                         o_tty->driver->ttys[idx] = NULL;
1689                 if (o_tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1690                         tp = o_tty->termios;
1691                         if (!devpts)
1692                                 o_tty->driver->termios[idx] = NULL;
1693                         kfree(tp);
1694
1695                         tp = o_tty->termios_locked;
1696                         if (!devpts)
1697                                 o_tty->driver->termios_locked[idx] = NULL;
1698                         kfree(tp);
1699                 }
1700                 o_tty->magic = 0;
1701                 o_tty->driver->refcount--;
1702                 file_list_lock();
1703                 list_del_init(&o_tty->tty_files);
1704                 file_list_unlock();
1705                 free_tty_struct(o_tty);
1706         }
1707
1708         if (!devpts)
1709                 tty->driver->ttys[idx] = NULL;
1710         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1711                 tp = tty->termios;
1712                 if (!devpts)
1713                         tty->driver->termios[idx] = NULL;
1714                 kfree(tp);
1715
1716                 tp = tty->termios_locked;
1717                 if (!devpts)
1718                         tty->driver->termios_locked[idx] = NULL;
1719                 kfree(tp);
1720         }
1721
1722         tty->magic = 0;
1723         tty->driver->refcount--;
1724         file_list_lock();
1725         list_del_init(&tty->tty_files);
1726         file_list_unlock();
1727         module_put(tty->driver->owner);
1728         free_tty_struct(tty);
1729 }
1730
1731 /*
1732  * Even releasing the tty structures is a tricky business.. We have
1733  * to be very careful that the structures are all released at the
1734  * same time, as interrupts might otherwise get the wrong pointers.
1735  *
1736  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1737  * lead to double frees or releasing memory still in use.
1738  */
1739 static void release_dev(struct file * filp)
1740 {
1741         struct tty_struct *tty, *o_tty;
1742         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1743         int     devpts;
1744         int     idx;
1745         char    buf[64];
1746         unsigned long flags;
1747         
1748         tty = (struct tty_struct *)filp->private_data;
1749         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "release_dev"))
1750                 return;
1751
1752         check_tty_count(tty, "release_dev");
1753
1754         tty_fasync(-1, filp, 0);
1755
1756         idx = tty->index;
1757         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1758                       tty->driver->subtype == PTY_TYPE_MASTER);
1759         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1760         o_tty = tty->link;
1761
1762 #ifdef TTY_PARANOIA_CHECK
1763         if (idx < 0 || idx >= tty->driver->num) {
1764                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
1765                                   "free (%s)\n", tty->name);
1766                 return;
1767         }
1768         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1769                 if (tty != tty->driver->ttys[idx]) {
1770                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
1771                                "for (%s)\n", idx, tty->name);
1772                         return;
1773                 }
1774                 if (tty->termios != tty->driver->termios[idx]) {
1775                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
1776                                "for (%s)\n",
1777                                idx, tty->name);
1778                         return;
1779                 }
1780                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
1781                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
1782                                "termios_locked for (%s)\n",
1783                                idx, tty->name);
1784                         return;
1785                 }
1786         }
1787 #endif
1788
1789 #ifdef TTY_DEBUG_HANGUP
1790         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
1791                tty_name(tty, buf), tty->count);
1792 #endif
1793
1794 #ifdef TTY_PARANOIA_CHECK
1795         if (tty->driver->other &&
1796              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1797                 if (o_tty != tty->driver->other->ttys[idx]) {
1798                         printk(KERN_DEBUG "release_dev: other->table[%d] "
1799                                           "not o_tty for (%s)\n",
1800                                idx, tty->name);
1801                         return;
1802                 }
1803                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1804                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
1805                                           "not o_termios for (%s)\n",
1806                                idx, tty->name);
1807                         return;
1808                 }
1809                 if (o_tty->termios_locked != 
1810                       tty->driver->other->termios_locked[idx]) {
1811                         printk(KERN_DEBUG "release_dev: other->termios_locked["
1812                                           "%d] not o_termios_locked for (%s)\n",
1813                                idx, tty->name);
1814                         return;
1815                 }
1816                 if (o_tty->link != tty) {
1817                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
1818                         return;
1819                 }
1820         }
1821 #endif
1822         if (tty->driver->close)
1823                 tty->driver->close(tty, filp);
1824
1825         /*
1826          * Sanity check: if tty->count is going to zero, there shouldn't be
1827          * any waiters on tty->read_wait or tty->write_wait.  We test the
1828          * wait queues and kick everyone out _before_ actually starting to
1829          * close.  This ensures that we won't block while releasing the tty
1830          * structure.
1831          *
1832          * The test for the o_tty closing is necessary, since the master and
1833          * slave sides may close in any order.  If the slave side closes out
1834          * first, its count will be one, since the master side holds an open.
1835          * Thus this test wouldn't be triggered at the time the slave closes,
1836          * so we do it now.
1837          *
1838          * Note that it's possible for the tty to be opened again while we're
1839          * flushing out waiters.  By recalculating the closing flags before
1840          * each iteration we avoid any problems.
1841          */
1842         while (1) {
1843                 /* Guard against races with tty->count changes elsewhere and
1844                    opens on /dev/tty */
1845                    
1846                 mutex_lock(&tty_mutex);
1847                 tty_closing = tty->count <= 1;
1848                 o_tty_closing = o_tty &&
1849                         (o_tty->count <= (pty_master ? 1 : 0));
1850                 do_sleep = 0;
1851
1852                 if (tty_closing) {
1853                         if (waitqueue_active(&tty->read_wait)) {
1854                                 wake_up(&tty->read_wait);
1855                                 do_sleep++;
1856                         }
1857                         if (waitqueue_active(&tty->write_wait)) {
1858                                 wake_up(&tty->write_wait);
1859                                 do_sleep++;
1860                         }
1861                 }
1862                 if (o_tty_closing) {
1863                         if (waitqueue_active(&o_tty->read_wait)) {
1864                                 wake_up(&o_tty->read_wait);
1865                                 do_sleep++;
1866                         }
1867                         if (waitqueue_active(&o_tty->write_wait)) {
1868                                 wake_up(&o_tty->write_wait);
1869                                 do_sleep++;
1870                         }
1871                 }
1872                 if (!do_sleep)
1873                         break;
1874
1875                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
1876                                     "active!\n", tty_name(tty, buf));
1877                 mutex_unlock(&tty_mutex);
1878                 schedule();
1879         }       
1880
1881         /*
1882          * The closing flags are now consistent with the open counts on 
1883          * both sides, and we've completed the last operation that could 
1884          * block, so it's safe to proceed with closing.
1885          */
1886         if (pty_master) {
1887                 if (--o_tty->count < 0) {
1888                         printk(KERN_WARNING "release_dev: bad pty slave count "
1889                                             "(%d) for %s\n",
1890                                o_tty->count, tty_name(o_tty, buf));
1891                         o_tty->count = 0;
1892                 }
1893         }
1894         if (--tty->count < 0) {
1895                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
1896                        tty->count, tty_name(tty, buf));
1897                 tty->count = 0;
1898         }
1899         
1900         /*
1901          * We've decremented tty->count, so we need to remove this file
1902          * descriptor off the tty->tty_files list; this serves two
1903          * purposes:
1904          *  - check_tty_count sees the correct number of file descriptors
1905          *    associated with this tty.
1906          *  - do_tty_hangup no longer sees this file descriptor as
1907          *    something that needs to be handled for hangups.
1908          */
1909         file_kill(filp);
1910         filp->private_data = NULL;
1911
1912         /*
1913          * Perform some housekeeping before deciding whether to return.
1914          *
1915          * Set the TTY_CLOSING flag if this was the last open.  In the
1916          * case of a pty we may have to wait around for the other side
1917          * to close, and TTY_CLOSING makes sure we can't be reopened.
1918          */
1919         if(tty_closing)
1920                 set_bit(TTY_CLOSING, &tty->flags);
1921         if(o_tty_closing)
1922                 set_bit(TTY_CLOSING, &o_tty->flags);
1923
1924         /*
1925          * If _either_ side is closing, make sure there aren't any
1926          * processes that still think tty or o_tty is their controlling
1927          * tty.
1928          */
1929         if (tty_closing || o_tty_closing) {
1930                 struct task_struct *p;
1931
1932                 read_lock(&tasklist_lock);
1933                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1934                         p->signal->tty = NULL;
1935                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1936                 if (o_tty)
1937                         do_each_task_pid(o_tty->session, PIDTYPE_SID, p) {
1938                                 p->signal->tty = NULL;
1939                         } while_each_task_pid(o_tty->session, PIDTYPE_SID, p);
1940                 read_unlock(&tasklist_lock);
1941         }
1942
1943         mutex_unlock(&tty_mutex);
1944
1945         /* check whether both sides are closing ... */
1946         if (!tty_closing || (o_tty && !o_tty_closing))
1947                 return;
1948         
1949 #ifdef TTY_DEBUG_HANGUP
1950         printk(KERN_DEBUG "freeing tty structure...");
1951 #endif
1952         /*
1953          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
1954          * kill any delayed work. As this is the final close it does not
1955          * race with the set_ldisc code path.
1956          */
1957         clear_bit(TTY_LDISC, &tty->flags);
1958         clear_bit(TTY_DONT_FLIP, &tty->flags);
1959         cancel_delayed_work(&tty->buf.work);
1960
1961         /*
1962          * Wait for ->hangup_work and ->buf.work handlers to terminate
1963          */
1964          
1965         flush_scheduled_work();
1966         
1967         /*
1968          * Wait for any short term users (we know they are just driver
1969          * side waiters as the file is closing so user count on the file
1970          * side is zero.
1971          */
1972         spin_lock_irqsave(&tty_ldisc_lock, flags);
1973         while(tty->ldisc.refcount)
1974         {
1975                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1976                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
1977                 spin_lock_irqsave(&tty_ldisc_lock, flags);
1978         }
1979         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1980         /*
1981          * Shutdown the current line discipline, and reset it to N_TTY.
1982          * N.B. why reset ldisc when we're releasing the memory??
1983          *
1984          * FIXME: this MUST get fixed for the new reflocking
1985          */
1986         if (tty->ldisc.close)
1987                 (tty->ldisc.close)(tty);
1988         tty_ldisc_put(tty->ldisc.num);
1989         
1990         /*
1991          *      Switch the line discipline back
1992          */
1993         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1994         tty_set_termios_ldisc(tty,N_TTY); 
1995         if (o_tty) {
1996                 /* FIXME: could o_tty be in setldisc here ? */
1997                 clear_bit(TTY_LDISC, &o_tty->flags);
1998                 if (o_tty->ldisc.close)
1999                         (o_tty->ldisc.close)(o_tty);
2000                 tty_ldisc_put(o_tty->ldisc.num);
2001                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
2002                 tty_set_termios_ldisc(o_tty,N_TTY); 
2003         }
2004         /*
2005          * The release_mem function takes care of the details of clearing
2006          * the slots and preserving the termios structure.
2007          */
2008         release_mem(tty, idx);
2009
2010 #ifdef CONFIG_UNIX98_PTYS
2011         /* Make this pty number available for reallocation */
2012         if (devpts) {
2013                 down(&allocated_ptys_lock);
2014                 idr_remove(&allocated_ptys, idx);
2015                 up(&allocated_ptys_lock);
2016         }
2017 #endif
2018
2019 }
2020
2021 /*
2022  * tty_open and tty_release keep up the tty count that contains the
2023  * number of opens done on a tty. We cannot use the inode-count, as
2024  * different inodes might point to the same tty.
2025  *
2026  * Open-counting is needed for pty masters, as well as for keeping
2027  * track of serial lines: DTR is dropped when the last close happens.
2028  * (This is not done solely through tty->count, now.  - Ted 1/27/92)
2029  *
2030  * The termios state of a pty is reset on first open so that
2031  * settings don't persist across reuse.
2032  */
2033 static int tty_open(struct inode * inode, struct file * filp)
2034 {
2035         struct tty_struct *tty;
2036         int noctty, retval;
2037         struct tty_driver *driver;
2038         int index;
2039         dev_t device = inode->i_rdev;
2040         unsigned short saved_flags = filp->f_flags;
2041
2042         nonseekable_open(inode, filp);
2043         
2044 retry_open:
2045         noctty = filp->f_flags & O_NOCTTY;
2046         index  = -1;
2047         retval = 0;
2048         
2049         mutex_lock(&tty_mutex);
2050
2051         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2052                 if (!current->signal->tty) {
2053                         mutex_unlock(&tty_mutex);
2054                         return -ENXIO;
2055                 }
2056                 driver = current->signal->tty->driver;
2057                 index = current->signal->tty->index;
2058                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2059                 /* noctty = 1; */
2060                 goto got_driver;
2061         }
2062 #ifdef CONFIG_VT
2063         if (device == MKDEV(TTY_MAJOR,0)) {
2064                 extern struct tty_driver *console_driver;
2065                 driver = console_driver;
2066                 index = fg_console;
2067                 noctty = 1;
2068                 goto got_driver;
2069         }
2070 #endif
2071         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2072                 driver = console_device(&index);
2073                 if (driver) {
2074                         /* Don't let /dev/console block */
2075                         filp->f_flags |= O_NONBLOCK;
2076                         noctty = 1;
2077                         goto got_driver;
2078                 }
2079                 mutex_unlock(&tty_mutex);
2080                 return -ENODEV;
2081         }
2082
2083         driver = get_tty_driver(device, &index);
2084         if (!driver) {
2085                 mutex_unlock(&tty_mutex);
2086                 return -ENODEV;
2087         }
2088 got_driver:
2089         retval = init_dev(driver, index, &tty);
2090         mutex_unlock(&tty_mutex);
2091         if (retval)
2092                 return retval;
2093
2094         filp->private_data = tty;
2095         file_move(filp, &tty->tty_files);
2096         check_tty_count(tty, "tty_open");
2097         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2098             tty->driver->subtype == PTY_TYPE_MASTER)
2099                 noctty = 1;
2100 #ifdef TTY_DEBUG_HANGUP
2101         printk(KERN_DEBUG "opening %s...", tty->name);
2102 #endif
2103         if (!retval) {
2104                 if (tty->driver->open)
2105                         retval = tty->driver->open(tty, filp);
2106                 else
2107                         retval = -ENODEV;
2108         }
2109         filp->f_flags = saved_flags;
2110
2111         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2112                 retval = -EBUSY;
2113
2114         if (retval) {
2115 #ifdef TTY_DEBUG_HANGUP
2116                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2117                        tty->name);
2118 #endif
2119                 release_dev(filp);
2120                 if (retval != -ERESTARTSYS)
2121                         return retval;
2122                 if (signal_pending(current))
2123                         return retval;
2124                 schedule();
2125                 /*
2126                  * Need to reset f_op in case a hangup happened.
2127                  */
2128                 if (filp->f_op == &hung_up_tty_fops)
2129                         filp->f_op = &tty_fops;
2130                 goto retry_open;
2131         }
2132         if (!noctty &&
2133             current->signal->leader &&
2134             !current->signal->tty &&
2135             tty->session == 0) {
2136                 task_lock(current);
2137                 current->signal->tty = tty;
2138                 task_unlock(current);
2139                 current->signal->tty_old_pgrp = 0;
2140                 tty->session = current->signal->session;
2141                 tty->pgrp = process_group(current);
2142         }
2143         return 0;
2144 }
2145
2146 #ifdef CONFIG_UNIX98_PTYS
2147 static int ptmx_open(struct inode * inode, struct file * filp)
2148 {
2149         struct tty_struct *tty;
2150         int retval;
2151         int index;
2152         int idr_ret;
2153
2154         nonseekable_open(inode, filp);
2155
2156         /* find a device that is not in use. */
2157         down(&allocated_ptys_lock);
2158         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2159                 up(&allocated_ptys_lock);
2160                 return -ENOMEM;
2161         }
2162         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2163         if (idr_ret < 0) {
2164                 up(&allocated_ptys_lock);
2165                 if (idr_ret == -EAGAIN)
2166                         return -ENOMEM;
2167                 return -EIO;
2168         }
2169         if (index >= pty_limit) {
2170                 idr_remove(&allocated_ptys, index);
2171                 up(&allocated_ptys_lock);
2172                 return -EIO;
2173         }
2174         up(&allocated_ptys_lock);
2175
2176         mutex_lock(&tty_mutex);
2177         retval = init_dev(ptm_driver, index, &tty);
2178         mutex_unlock(&tty_mutex);
2179         
2180         if (retval)
2181                 goto out;
2182
2183         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2184         filp->private_data = tty;
2185         file_move(filp, &tty->tty_files);
2186
2187         retval = -ENOMEM;
2188         if (devpts_pty_new(tty->link))
2189                 goto out1;
2190
2191         check_tty_count(tty, "tty_open");
2192         retval = ptm_driver->open(tty, filp);
2193         if (!retval)
2194                 return 0;
2195 out1:
2196         release_dev(filp);
2197         return retval;
2198 out:
2199         down(&allocated_ptys_lock);
2200         idr_remove(&allocated_ptys, index);
2201         up(&allocated_ptys_lock);
2202         return retval;
2203 }
2204 #endif
2205
2206 static int tty_release(struct inode * inode, struct file * filp)
2207 {
2208         lock_kernel();
2209         release_dev(filp);
2210         unlock_kernel();
2211         return 0;
2212 }
2213
2214 /* No kernel lock held - fine */
2215 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2216 {
2217         struct tty_struct * tty;
2218         struct tty_ldisc *ld;
2219         int ret = 0;
2220
2221         tty = (struct tty_struct *)filp->private_data;
2222         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_poll"))
2223                 return 0;
2224                 
2225         ld = tty_ldisc_ref_wait(tty);
2226         if (ld->poll)
2227                 ret = (ld->poll)(tty, filp, wait);
2228         tty_ldisc_deref(ld);
2229         return ret;
2230 }
2231
2232 static int tty_fasync(int fd, struct file * filp, int on)
2233 {
2234         struct tty_struct * tty;
2235         int retval;
2236
2237         tty = (struct tty_struct *)filp->private_data;
2238         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_fasync"))
2239                 return 0;
2240         
2241         retval = fasync_helper(fd, filp, on, &tty->fasync);
2242         if (retval <= 0)
2243                 return retval;
2244
2245         if (on) {
2246                 if (!waitqueue_active(&tty->read_wait))
2247                         tty->minimum_to_wake = 1;
2248                 retval = f_setown(filp, (-tty->pgrp) ? : current->pid, 0);
2249                 if (retval)
2250                         return retval;
2251         } else {
2252                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2253                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2254         }
2255         return 0;
2256 }
2257
2258 static int tiocsti(struct tty_struct *tty, char __user *p)
2259 {
2260         char ch, mbz = 0;
2261         struct tty_ldisc *ld;
2262         
2263         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2264                 return -EPERM;
2265         if (get_user(ch, p))
2266                 return -EFAULT;
2267         ld = tty_ldisc_ref_wait(tty);
2268         ld->receive_buf(tty, &ch, &mbz, 1);
2269         tty_ldisc_deref(ld);
2270         return 0;
2271 }
2272
2273 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2274 {
2275         if (copy_to_user(arg, &tty->winsize, sizeof(*arg)))
2276                 return -EFAULT;
2277         return 0;
2278 }
2279
2280 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2281         struct winsize __user * arg)
2282 {
2283         struct winsize tmp_ws;
2284
2285         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2286                 return -EFAULT;
2287         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2288                 return 0;
2289 #ifdef CONFIG_VT
2290         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2291                 int rc;
2292
2293                 acquire_console_sem();
2294                 rc = vc_resize(tty->driver_data, tmp_ws.ws_col, tmp_ws.ws_row);
2295                 release_console_sem();
2296                 if (rc)
2297                         return -ENXIO;
2298         }
2299 #endif
2300         if (tty->pgrp > 0)
2301                 kill_pg(tty->pgrp, SIGWINCH, 1);
2302         if ((real_tty->pgrp != tty->pgrp) && (real_tty->pgrp > 0))
2303                 kill_pg(real_tty->pgrp, SIGWINCH, 1);
2304         tty->winsize = tmp_ws;
2305         real_tty->winsize = tmp_ws;
2306         return 0;
2307 }
2308
2309 static int tioccons(struct file *file)
2310 {
2311         if (!capable(CAP_SYS_ADMIN))
2312                 return -EPERM;
2313         if (file->f_op->write == redirected_tty_write) {
2314                 struct file *f;
2315                 spin_lock(&redirect_lock);
2316                 f = redirect;
2317                 redirect = NULL;
2318                 spin_unlock(&redirect_lock);
2319                 if (f)
2320                         fput(f);
2321                 return 0;
2322         }
2323         spin_lock(&redirect_lock);
2324         if (redirect) {
2325                 spin_unlock(&redirect_lock);
2326                 return -EBUSY;
2327         }
2328         get_file(file);
2329         redirect = file;
2330         spin_unlock(&redirect_lock);
2331         return 0;
2332 }
2333
2334
2335 static int fionbio(struct file *file, int __user *p)
2336 {
2337         int nonblock;
2338
2339         if (get_user(nonblock, p))
2340                 return -EFAULT;
2341
2342         if (nonblock)
2343                 file->f_flags |= O_NONBLOCK;
2344         else
2345                 file->f_flags &= ~O_NONBLOCK;
2346         return 0;
2347 }
2348
2349 static int tiocsctty(struct tty_struct *tty, int arg)
2350 {
2351         task_t *p;
2352
2353         if (current->signal->leader &&
2354             (current->signal->session == tty->session))
2355                 return 0;
2356         /*
2357          * The process must be a session leader and
2358          * not have a controlling tty already.
2359          */
2360         if (!current->signal->leader || current->signal->tty)
2361                 return -EPERM;
2362         if (tty->session > 0) {
2363                 /*
2364                  * This tty is already the controlling
2365                  * tty for another session group!
2366                  */
2367                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
2368                         /*
2369                          * Steal it away
2370                          */
2371
2372                         read_lock(&tasklist_lock);
2373                         do_each_task_pid(tty->session, PIDTYPE_SID, p) {
2374                                 p->signal->tty = NULL;
2375                         } while_each_task_pid(tty->session, PIDTYPE_SID, p);
2376                         read_unlock(&tasklist_lock);
2377                 } else
2378                         return -EPERM;
2379         }
2380         task_lock(current);
2381         current->signal->tty = tty;
2382         task_unlock(current);
2383         current->signal->tty_old_pgrp = 0;
2384         tty->session = current->signal->session;
2385         tty->pgrp = process_group(current);
2386         return 0;
2387 }
2388
2389 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2390 {
2391         /*
2392          * (tty == real_tty) is a cheap way of
2393          * testing if the tty is NOT a master pty.
2394          */
2395         if (tty == real_tty && current->signal->tty != real_tty)
2396                 return -ENOTTY;
2397         return put_user(real_tty->pgrp, p);
2398 }
2399
2400 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2401 {
2402         pid_t pgrp;
2403         int retval = tty_check_change(real_tty);
2404
2405         if (retval == -EIO)
2406                 return -ENOTTY;
2407         if (retval)
2408                 return retval;
2409         if (!current->signal->tty ||
2410             (current->signal->tty != real_tty) ||
2411             (real_tty->session != current->signal->session))
2412                 return -ENOTTY;
2413         if (get_user(pgrp, p))
2414                 return -EFAULT;
2415         if (pgrp < 0)
2416                 return -EINVAL;
2417         if (session_of_pgrp(pgrp) != current->signal->session)
2418                 return -EPERM;
2419         real_tty->pgrp = pgrp;
2420         return 0;
2421 }
2422
2423 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2424 {
2425         /*
2426          * (tty == real_tty) is a cheap way of
2427          * testing if the tty is NOT a master pty.
2428         */
2429         if (tty == real_tty && current->signal->tty != real_tty)
2430                 return -ENOTTY;
2431         if (real_tty->session <= 0)
2432                 return -ENOTTY;
2433         return put_user(real_tty->session, p);
2434 }
2435
2436 static int tiocsetd(struct tty_struct *tty, int __user *p)
2437 {
2438         int ldisc;
2439
2440         if (get_user(ldisc, p))
2441                 return -EFAULT;
2442         return tty_set_ldisc(tty, ldisc);
2443 }
2444
2445 static int send_break(struct tty_struct *tty, unsigned int duration)
2446 {
2447         tty->driver->break_ctl(tty, -1);
2448         if (!signal_pending(current)) {
2449                 msleep_interruptible(duration);
2450         }
2451         tty->driver->break_ctl(tty, 0);
2452         if (signal_pending(current))
2453                 return -EINTR;
2454         return 0;
2455 }
2456
2457 static int
2458 tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
2459 {
2460         int retval = -EINVAL;
2461
2462         if (tty->driver->tiocmget) {
2463                 retval = tty->driver->tiocmget(tty, file);
2464
2465                 if (retval >= 0)
2466                         retval = put_user(retval, p);
2467         }
2468         return retval;
2469 }
2470
2471 static int
2472 tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
2473              unsigned __user *p)
2474 {
2475         int retval = -EINVAL;
2476
2477         if (tty->driver->tiocmset) {
2478                 unsigned int set, clear, val;
2479
2480                 retval = get_user(val, p);
2481                 if (retval)
2482                         return retval;
2483
2484                 set = clear = 0;
2485                 switch (cmd) {
2486                 case TIOCMBIS:
2487                         set = val;
2488                         break;
2489                 case TIOCMBIC:
2490                         clear = val;
2491                         break;
2492                 case TIOCMSET:
2493                         set = val;
2494                         clear = ~val;
2495                         break;
2496                 }
2497
2498                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2499                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2500
2501                 retval = tty->driver->tiocmset(tty, file, set, clear);
2502         }
2503         return retval;
2504 }
2505
2506 /*
2507  * Split this up, as gcc can choke on it otherwise..
2508  */
2509 int tty_ioctl(struct inode * inode, struct file * file,
2510               unsigned int cmd, unsigned long arg)
2511 {
2512         struct tty_struct *tty, *real_tty;
2513         void __user *p = (void __user *)arg;
2514         int retval;
2515         struct tty_ldisc *ld;
2516         
2517         tty = (struct tty_struct *)file->private_data;
2518         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2519                 return -EINVAL;
2520
2521         real_tty = tty;
2522         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2523             tty->driver->subtype == PTY_TYPE_MASTER)
2524                 real_tty = tty->link;
2525
2526         /*
2527          * Break handling by driver
2528          */
2529         if (!tty->driver->break_ctl) {
2530                 switch(cmd) {
2531                 case TIOCSBRK:
2532                 case TIOCCBRK:
2533                         if (tty->driver->ioctl)
2534                                 return tty->driver->ioctl(tty, file, cmd, arg);
2535                         return -EINVAL;
2536                         
2537                 /* These two ioctl's always return success; even if */
2538                 /* the driver doesn't support them. */
2539                 case TCSBRK:
2540                 case TCSBRKP:
2541                         if (!tty->driver->ioctl)
2542                                 return 0;
2543                         retval = tty->driver->ioctl(tty, file, cmd, arg);
2544                         if (retval == -ENOIOCTLCMD)
2545                                 retval = 0;
2546                         return retval;
2547                 }
2548         }
2549
2550         /*
2551          * Factor out some common prep work
2552          */
2553         switch (cmd) {
2554         case TIOCSETD:
2555         case TIOCSBRK:
2556         case TIOCCBRK:
2557         case TCSBRK:
2558         case TCSBRKP:                   
2559                 retval = tty_check_change(tty);
2560                 if (retval)
2561                         return retval;
2562                 if (cmd != TIOCCBRK) {
2563                         tty_wait_until_sent(tty, 0);
2564                         if (signal_pending(current))
2565                                 return -EINTR;
2566                 }
2567                 break;
2568         }
2569
2570         switch (cmd) {
2571                 case TIOCSTI:
2572                         return tiocsti(tty, p);
2573                 case TIOCGWINSZ:
2574                         return tiocgwinsz(tty, p);
2575                 case TIOCSWINSZ:
2576                         return tiocswinsz(tty, real_tty, p);
2577                 case TIOCCONS:
2578                         return real_tty!=tty ? -EINVAL : tioccons(file);
2579                 case FIONBIO:
2580                         return fionbio(file, p);
2581                 case TIOCEXCL:
2582                         set_bit(TTY_EXCLUSIVE, &tty->flags);
2583                         return 0;
2584                 case TIOCNXCL:
2585                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
2586                         return 0;
2587                 case TIOCNOTTY:
2588                         if (current->signal->tty != tty)
2589                                 return -ENOTTY;
2590                         if (current->signal->leader)
2591                                 disassociate_ctty(0);
2592                         task_lock(current);
2593                         current->signal->tty = NULL;
2594                         task_unlock(current);
2595                         return 0;
2596                 case TIOCSCTTY:
2597                         return tiocsctty(tty, arg);
2598                 case TIOCGPGRP:
2599                         return tiocgpgrp(tty, real_tty, p);
2600                 case TIOCSPGRP:
2601                         return tiocspgrp(tty, real_tty, p);
2602                 case TIOCGSID:
2603                         return tiocgsid(tty, real_tty, p);
2604                 case TIOCGETD:
2605                         /* FIXME: check this is ok */
2606                         return put_user(tty->ldisc.num, (int __user *)p);
2607                 case TIOCSETD:
2608                         return tiocsetd(tty, p);
2609 #ifdef CONFIG_VT
2610                 case TIOCLINUX:
2611                         return tioclinux(tty, arg);
2612 #endif
2613                 /*
2614                  * Break handling
2615                  */
2616                 case TIOCSBRK:  /* Turn break on, unconditionally */
2617                         tty->driver->break_ctl(tty, -1);
2618                         return 0;
2619                         
2620                 case TIOCCBRK:  /* Turn break off, unconditionally */
2621                         tty->driver->break_ctl(tty, 0);
2622                         return 0;
2623                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
2624                         /*
2625                          * XXX is the above comment correct, or the
2626                          * code below correct?  Is this ioctl used at
2627                          * all by anyone?
2628                          */
2629                         if (!arg)
2630                                 return send_break(tty, 250);
2631                         return 0;
2632                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
2633                         return send_break(tty, arg ? arg*100 : 250);
2634
2635                 case TIOCMGET:
2636                         return tty_tiocmget(tty, file, p);
2637
2638                 case TIOCMSET:
2639                 case TIOCMBIC:
2640                 case TIOCMBIS:
2641                         return tty_tiocmset(tty, file, cmd, p);
2642         }
2643         if (tty->driver->ioctl) {
2644                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
2645                 if (retval != -ENOIOCTLCMD)
2646                         return retval;
2647         }
2648         ld = tty_ldisc_ref_wait(tty);
2649         retval = -EINVAL;
2650         if (ld->ioctl) {
2651                 retval = ld->ioctl(tty, file, cmd, arg);
2652                 if (retval == -ENOIOCTLCMD)
2653                         retval = -EINVAL;
2654         }
2655         tty_ldisc_deref(ld);
2656         return retval;
2657 }
2658
2659
2660 /*
2661  * This implements the "Secure Attention Key" ---  the idea is to
2662  * prevent trojan horses by killing all processes associated with this
2663  * tty when the user hits the "Secure Attention Key".  Required for
2664  * super-paranoid applications --- see the Orange Book for more details.
2665  * 
2666  * This code could be nicer; ideally it should send a HUP, wait a few
2667  * seconds, then send a INT, and then a KILL signal.  But you then
2668  * have to coordinate with the init process, since all processes associated
2669  * with the current tty must be dead before the new getty is allowed
2670  * to spawn.
2671  *
2672  * Now, if it would be correct ;-/ The current code has a nasty hole -
2673  * it doesn't catch files in flight. We may send the descriptor to ourselves
2674  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2675  *
2676  * Nasty bug: do_SAK is being called in interrupt context.  This can
2677  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2678  */
2679 static void __do_SAK(void *arg)
2680 {
2681 #ifdef TTY_SOFT_SAK
2682         tty_hangup(tty);
2683 #else
2684         struct tty_struct *tty = arg;
2685         struct task_struct *g, *p;
2686         int session;
2687         int             i;
2688         struct file     *filp;
2689         struct tty_ldisc *disc;
2690         struct fdtable *fdt;
2691         
2692         if (!tty)
2693                 return;
2694         session  = tty->session;
2695         
2696         /* We don't want an ldisc switch during this */
2697         disc = tty_ldisc_ref(tty);
2698         if (disc && disc->flush_buffer)
2699                 disc->flush_buffer(tty);
2700         tty_ldisc_deref(disc);
2701
2702         if (tty->driver->flush_buffer)
2703                 tty->driver->flush_buffer(tty);
2704         
2705         read_lock(&tasklist_lock);
2706         /* Kill the entire session */
2707         do_each_task_pid(session, PIDTYPE_SID, p) {
2708                 printk(KERN_NOTICE "SAK: killed process %d"
2709                         " (%s): p->signal->session==tty->session\n",
2710                         p->pid, p->comm);
2711                 send_sig(SIGKILL, p, 1);
2712         } while_each_task_pid(session, PIDTYPE_SID, p);
2713         /* Now kill any processes that happen to have the
2714          * tty open.
2715          */
2716         do_each_thread(g, p) {
2717                 if (p->signal->tty == tty) {
2718                         printk(KERN_NOTICE "SAK: killed process %d"
2719                             " (%s): p->signal->session==tty->session\n",
2720                             p->pid, p->comm);
2721                         send_sig(SIGKILL, p, 1);
2722                         continue;
2723                 }
2724                 task_lock(p);
2725                 if (p->files) {
2726                         /*
2727                          * We don't take a ref to the file, so we must
2728                          * hold ->file_lock instead.
2729                          */
2730                         spin_lock(&p->files->file_lock);
2731                         fdt = files_fdtable(p->files);
2732                         for (i=0; i < fdt->max_fds; i++) {
2733                                 filp = fcheck_files(p->files, i);
2734                                 if (!filp)
2735                                         continue;
2736                                 if (filp->f_op->read == tty_read &&
2737                                     filp->private_data == tty) {
2738                                         printk(KERN_NOTICE "SAK: killed process %d"
2739                                             " (%s): fd#%d opened to the tty\n",
2740                                             p->pid, p->comm, i);
2741                                         force_sig(SIGKILL, p);
2742                                         break;
2743                                 }
2744                         }
2745                         spin_unlock(&p->files->file_lock);
2746                 }
2747                 task_unlock(p);
2748         } while_each_thread(g, p);
2749         read_unlock(&tasklist_lock);
2750 #endif
2751 }
2752
2753 /*
2754  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2755  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2756  * the values which we write to it will be identical to the values which it
2757  * already has. --akpm
2758  */
2759 void do_SAK(struct tty_struct *tty)
2760 {
2761         if (!tty)
2762                 return;
2763         PREPARE_WORK(&tty->SAK_work, __do_SAK, tty);
2764         schedule_work(&tty->SAK_work);
2765 }
2766
2767 EXPORT_SYMBOL(do_SAK);
2768
2769 /*
2770  * This routine is called out of the software interrupt to flush data
2771  * from the buffer chain to the line discipline.
2772  */
2773  
2774 static void flush_to_ldisc(void *private_)
2775 {
2776         struct tty_struct *tty = (struct tty_struct *) private_;
2777         unsigned long   flags;
2778         struct tty_ldisc *disc;
2779         struct tty_buffer *tbuf;
2780         int count;
2781         char *char_buf;
2782         unsigned char *flag_buf;
2783
2784         disc = tty_ldisc_ref(tty);
2785         if (disc == NULL)       /*  !TTY_LDISC */
2786                 return;
2787
2788         if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
2789                 /*
2790                  * Do it after the next timer tick:
2791                  */
2792                 schedule_delayed_work(&tty->buf.work, 1);
2793                 goto out;
2794         }
2795         spin_lock_irqsave(&tty->buf.lock, flags);
2796         while((tbuf = tty->buf.head) != NULL) {
2797                 while ((count = tbuf->commit - tbuf->read) != 0) {
2798                         char_buf = tbuf->char_buf_ptr + tbuf->read;
2799                         flag_buf = tbuf->flag_buf_ptr + tbuf->read;
2800                         tbuf->read += count;
2801                         spin_unlock_irqrestore(&tty->buf.lock, flags);
2802                         disc->receive_buf(tty, char_buf, flag_buf, count);
2803                         spin_lock_irqsave(&tty->buf.lock, flags);
2804                 }
2805                 if (tbuf->active)
2806                         break;
2807                 tty->buf.head = tbuf->next;
2808                 if (tty->buf.head == NULL)
2809                         tty->buf.tail = NULL;
2810                 tty_buffer_free(tty, tbuf);
2811         }
2812         spin_unlock_irqrestore(&tty->buf.lock, flags);
2813 out:
2814         tty_ldisc_deref(disc);
2815 }
2816
2817 /*
2818  * Routine which returns the baud rate of the tty
2819  *
2820  * Note that the baud_table needs to be kept in sync with the
2821  * include/asm/termbits.h file.
2822  */
2823 static int baud_table[] = {
2824         0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
2825         9600, 19200, 38400, 57600, 115200, 230400, 460800,
2826 #ifdef __sparc__
2827         76800, 153600, 307200, 614400, 921600
2828 #else
2829         500000, 576000, 921600, 1000000, 1152000, 1500000, 2000000,
2830         2500000, 3000000, 3500000, 4000000
2831 #endif
2832 };
2833
2834 static int n_baud_table = ARRAY_SIZE(baud_table);
2835
2836 /**
2837  *      tty_termios_baud_rate
2838  *      @termios: termios structure
2839  *
2840  *      Convert termios baud rate data into a speed. This should be called
2841  *      with the termios lock held if this termios is a terminal termios
2842  *      structure. May change the termios data.
2843  */
2844  
2845 int tty_termios_baud_rate(struct termios *termios)
2846 {
2847         unsigned int cbaud;
2848         
2849         cbaud = termios->c_cflag & CBAUD;
2850
2851         if (cbaud & CBAUDEX) {
2852                 cbaud &= ~CBAUDEX;
2853
2854                 if (cbaud < 1 || cbaud + 15 > n_baud_table)
2855                         termios->c_cflag &= ~CBAUDEX;
2856                 else
2857                         cbaud += 15;
2858         }
2859         return baud_table[cbaud];
2860 }
2861
2862 EXPORT_SYMBOL(tty_termios_baud_rate);
2863
2864 /**
2865  *      tty_get_baud_rate       -       get tty bit rates
2866  *      @tty: tty to query
2867  *
2868  *      Returns the baud rate as an integer for this terminal. The
2869  *      termios lock must be held by the caller and the terminal bit
2870  *      flags may be updated.
2871  */
2872  
2873 int tty_get_baud_rate(struct tty_struct *tty)
2874 {
2875         int baud = tty_termios_baud_rate(tty->termios);
2876
2877         if (baud == 38400 && tty->alt_speed) {
2878                 if (!tty->warned) {
2879                         printk(KERN_WARNING "Use of setserial/setrocket to "
2880                                             "set SPD_* flags is deprecated\n");
2881                         tty->warned = 1;
2882                 }
2883                 baud = tty->alt_speed;
2884         }
2885         
2886         return baud;
2887 }
2888
2889 EXPORT_SYMBOL(tty_get_baud_rate);
2890
2891 /**
2892  *      tty_flip_buffer_push    -       terminal
2893  *      @tty: tty to push
2894  *
2895  *      Queue a push of the terminal flip buffers to the line discipline. This
2896  *      function must not be called from IRQ context if tty->low_latency is set.
2897  *
2898  *      In the event of the queue being busy for flipping the work will be
2899  *      held off and retried later.
2900  */
2901
2902 void tty_flip_buffer_push(struct tty_struct *tty)
2903 {
2904         unsigned long flags;
2905         spin_lock_irqsave(&tty->buf.lock, flags);
2906         if (tty->buf.tail != NULL) {
2907                 tty->buf.tail->active = 0;
2908                 tty->buf.tail->commit = tty->buf.tail->used;
2909         }
2910         spin_unlock_irqrestore(&tty->buf.lock, flags);
2911
2912         if (tty->low_latency)
2913                 flush_to_ldisc((void *) tty);
2914         else
2915                 schedule_delayed_work(&tty->buf.work, 1);
2916 }
2917
2918 EXPORT_SYMBOL(tty_flip_buffer_push);
2919
2920
2921 /*
2922  * This subroutine initializes a tty structure.
2923  */
2924 static void initialize_tty_struct(struct tty_struct *tty)
2925 {
2926         memset(tty, 0, sizeof(struct tty_struct));
2927         tty->magic = TTY_MAGIC;
2928         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2929         tty->pgrp = -1;
2930         tty->overrun_time = jiffies;
2931         tty->buf.head = tty->buf.tail = NULL;
2932         tty_buffer_init(tty);
2933         INIT_WORK(&tty->buf.work, flush_to_ldisc, tty);
2934         init_MUTEX(&tty->buf.pty_sem);
2935         init_MUTEX(&tty->termios_sem);
2936         init_waitqueue_head(&tty->write_wait);
2937         init_waitqueue_head(&tty->read_wait);
2938         INIT_WORK(&tty->hangup_work, do_tty_hangup, tty);
2939         mutex_init(&tty->atomic_read_lock);
2940         mutex_init(&tty->atomic_write_lock);
2941         spin_lock_init(&tty->read_lock);
2942         INIT_LIST_HEAD(&tty->tty_files);
2943         INIT_WORK(&tty->SAK_work, NULL, NULL);
2944 }
2945
2946 /*
2947  * The default put_char routine if the driver did not define one.
2948  */
2949 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
2950 {
2951         tty->driver->write(tty, &ch, 1);
2952 }
2953
2954 static struct class *tty_class;
2955
2956 /**
2957  * tty_register_device - register a tty device
2958  * @driver: the tty driver that describes the tty device
2959  * @index: the index in the tty driver for this tty device
2960  * @device: a struct device that is associated with this tty device.
2961  *      This field is optional, if there is no known struct device for this
2962  *      tty device it can be set to NULL safely.
2963  *
2964  * Returns a pointer to the class device (or ERR_PTR(-EFOO) on error).
2965  *
2966  * This call is required to be made to register an individual tty device if
2967  * the tty driver's flags have the TTY_DRIVER_NO_DEVFS bit set.  If that
2968  * bit is not set, this function should not be called.
2969  */
2970 struct class_device *tty_register_device(struct tty_driver *driver,
2971                                          unsigned index, struct device *device)
2972 {
2973         char name[64];
2974         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
2975
2976         if (index >= driver->num) {
2977                 printk(KERN_ERR "Attempt to register invalid tty line number "
2978                        " (%d).\n", index);
2979                 return ERR_PTR(-EINVAL);
2980         }
2981
2982         devfs_mk_cdev(dev, S_IFCHR | S_IRUSR | S_IWUSR,
2983                         "%s%d", driver->devfs_name, index + driver->name_base);
2984
2985         if (driver->type == TTY_DRIVER_TYPE_PTY)
2986                 pty_line_name(driver, index, name);
2987         else
2988                 tty_line_name(driver, index, name);
2989
2990         return class_device_create(tty_class, NULL, dev, device, "%s", name);
2991 }
2992
2993 /**
2994  * tty_unregister_device - unregister a tty device
2995  * @driver: the tty driver that describes the tty device
2996  * @index: the index in the tty driver for this tty device
2997  *
2998  * If a tty device is registered with a call to tty_register_device() then
2999  * this function must be made when the tty device is gone.
3000  */
3001 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3002 {
3003         devfs_remove("%s%d", driver->devfs_name, index + driver->name_base);
3004         class_device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
3005 }
3006
3007 EXPORT_SYMBOL(tty_register_device);
3008 EXPORT_SYMBOL(tty_unregister_device);
3009
3010 struct tty_driver *alloc_tty_driver(int lines)
3011 {
3012         struct tty_driver *driver;
3013
3014         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
3015         if (driver) {
3016                 memset(driver, 0, sizeof(struct tty_driver));
3017                 driver->magic = TTY_DRIVER_MAGIC;
3018                 driver->num = lines;
3019                 /* later we'll move allocation of tables here */
3020         }
3021         return driver;
3022 }
3023
3024 void put_tty_driver(struct tty_driver *driver)
3025 {
3026         kfree(driver);
3027 }
3028
3029 void tty_set_operations(struct tty_driver *driver, struct tty_operations *op)
3030 {
3031         driver->open = op->open;
3032         driver->close = op->close;
3033         driver->write = op->write;
3034         driver->put_char = op->put_char;
3035         driver->flush_chars = op->flush_chars;
3036         driver->write_room = op->write_room;
3037         driver->chars_in_buffer = op->chars_in_buffer;
3038         driver->ioctl = op->ioctl;
3039         driver->set_termios = op->set_termios;
3040         driver->throttle = op->throttle;
3041         driver->unthrottle = op->unthrottle;
3042         driver->stop = op->stop;
3043         driver->start = op->start;
3044         driver->hangup = op->hangup;
3045         driver->break_ctl = op->break_ctl;
3046         driver->flush_buffer = op->flush_buffer;
3047         driver->set_ldisc = op->set_ldisc;
3048         driver->wait_until_sent = op->wait_until_sent;
3049         driver->send_xchar = op->send_xchar;
3050         driver->read_proc = op->read_proc;
3051         driver->write_proc = op->write_proc;
3052         driver->tiocmget = op->tiocmget;
3053         driver->tiocmset = op->tiocmset;
3054 }
3055
3056
3057 EXPORT_SYMBOL(alloc_tty_driver);
3058 EXPORT_SYMBOL(put_tty_driver);
3059 EXPORT_SYMBOL(tty_set_operations);
3060
3061 /*
3062  * Called by a tty driver to register itself.
3063  */
3064 int tty_register_driver(struct tty_driver *driver)
3065 {
3066         int error;
3067         int i;
3068         dev_t dev;
3069         void **p = NULL;
3070
3071         if (driver->flags & TTY_DRIVER_INSTALLED)
3072                 return 0;
3073
3074         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
3075                 p = kmalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3076                 if (!p)
3077                         return -ENOMEM;
3078                 memset(p, 0, driver->num * 3 * sizeof(void *));
3079         }
3080
3081         if (!driver->major) {
3082                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3083                                                 (char*)driver->name);
3084                 if (!error) {
3085                         driver->major = MAJOR(dev);
3086                         driver->minor_start = MINOR(dev);
3087                 }
3088         } else {
3089                 dev = MKDEV(driver->major, driver->minor_start);
3090                 error = register_chrdev_region(dev, driver->num,
3091                                                 (char*)driver->name);
3092         }
3093         if (error < 0) {
3094                 kfree(p);
3095                 return error;
3096         }
3097
3098         if (p) {
3099                 driver->ttys = (struct tty_struct **)p;
3100                 driver->termios = (struct termios **)(p + driver->num);
3101                 driver->termios_locked = (struct termios **)(p + driver->num * 2);
3102         } else {
3103                 driver->ttys = NULL;
3104                 driver->termios = NULL;
3105                 driver->termios_locked = NULL;
3106         }
3107
3108         cdev_init(&driver->cdev, &tty_fops);
3109         driver->cdev.owner = driver->owner;
3110         error = cdev_add(&driver->cdev, dev, driver->num);
3111         if (error) {
3112                 cdev_del(&driver->cdev);
3113                 unregister_chrdev_region(dev, driver->num);
3114                 driver->ttys = NULL;
3115                 driver->termios = driver->termios_locked = NULL;
3116                 kfree(p);
3117                 return error;
3118         }
3119
3120         if (!driver->put_char)
3121                 driver->put_char = tty_default_put_char;
3122         
3123         list_add(&driver->tty_drivers, &tty_drivers);
3124         
3125         if ( !(driver->flags & TTY_DRIVER_NO_DEVFS) ) {
3126                 for(i = 0; i < driver->num; i++)
3127                     tty_register_device(driver, i, NULL);
3128         }
3129         proc_tty_register_driver(driver);
3130         return 0;
3131 }
3132
3133 EXPORT_SYMBOL(tty_register_driver);
3134
3135 /*
3136  * Called by a tty driver to unregister itself.
3137  */
3138 int tty_unregister_driver(struct tty_driver *driver)
3139 {
3140         int i;
3141         struct termios *tp;
3142         void *p;
3143
3144         if (driver->refcount)
3145                 return -EBUSY;
3146
3147         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3148                                 driver->num);
3149
3150         list_del(&driver->tty_drivers);
3151
3152         /*
3153          * Free the termios and termios_locked structures because
3154          * we don't want to get memory leaks when modular tty
3155          * drivers are removed from the kernel.
3156          */
3157         for (i = 0; i < driver->num; i++) {
3158                 tp = driver->termios[i];
3159                 if (tp) {
3160                         driver->termios[i] = NULL;
3161                         kfree(tp);
3162                 }
3163                 tp = driver->termios_locked[i];
3164                 if (tp) {
3165                         driver->termios_locked[i] = NULL;
3166                         kfree(tp);
3167                 }
3168                 if (!(driver->flags & TTY_DRIVER_NO_DEVFS))
3169                         tty_unregister_device(driver, i);
3170         }
3171         p = driver->ttys;
3172         proc_tty_unregister_driver(driver);
3173         driver->ttys = NULL;
3174         driver->termios = driver->termios_locked = NULL;
3175         kfree(p);
3176         cdev_del(&driver->cdev);
3177         return 0;
3178 }
3179
3180 EXPORT_SYMBOL(tty_unregister_driver);
3181
3182
3183 /*
3184  * Initialize the console device. This is called *early*, so
3185  * we can't necessarily depend on lots of kernel help here.
3186  * Just do some early initializations, and do the complex setup
3187  * later.
3188  */
3189 void __init console_init(void)
3190 {
3191         initcall_t *call;
3192
3193         /* Setup the default TTY line discipline. */
3194         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
3195
3196         /*
3197          * set up the console device so that later boot sequences can 
3198          * inform about problems etc..
3199          */
3200 #ifdef CONFIG_EARLY_PRINTK
3201         disable_early_printk();
3202 #endif
3203         call = __con_initcall_start;
3204         while (call < __con_initcall_end) {
3205                 (*call)();
3206                 call++;
3207         }
3208 }
3209
3210 #ifdef CONFIG_VT
3211 extern int vty_init(void);
3212 #endif
3213
3214 static int __init tty_class_init(void)
3215 {
3216         tty_class = class_create(THIS_MODULE, "tty");
3217         if (IS_ERR(tty_class))
3218                 return PTR_ERR(tty_class);
3219         return 0;
3220 }
3221
3222 postcore_initcall(tty_class_init);
3223
3224 /* 3/2004 jmc: why do these devices exist? */
3225
3226 static struct cdev tty_cdev, console_cdev;
3227 #ifdef CONFIG_UNIX98_PTYS
3228 static struct cdev ptmx_cdev;
3229 #endif
3230 #ifdef CONFIG_VT
3231 static struct cdev vc0_cdev;
3232 #endif
3233
3234 /*
3235  * Ok, now we can initialize the rest of the tty devices and can count
3236  * on memory allocations, interrupts etc..
3237  */
3238 static int __init tty_init(void)
3239 {
3240         cdev_init(&tty_cdev, &tty_fops);
3241         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3242             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3243                 panic("Couldn't register /dev/tty driver\n");
3244         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 0), S_IFCHR|S_IRUGO|S_IWUGO, "tty");
3245         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3246
3247         cdev_init(&console_cdev, &console_fops);
3248         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3249             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3250                 panic("Couldn't register /dev/console driver\n");
3251         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 1), S_IFCHR|S_IRUSR|S_IWUSR, "console");
3252         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL, "console");
3253
3254 #ifdef CONFIG_UNIX98_PTYS
3255         cdev_init(&ptmx_cdev, &ptmx_fops);
3256         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
3257             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
3258                 panic("Couldn't register /dev/ptmx driver\n");
3259         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 2), S_IFCHR|S_IRUGO|S_IWUGO, "ptmx");
3260         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), NULL, "ptmx");
3261 #endif
3262
3263 #ifdef CONFIG_VT
3264         cdev_init(&vc0_cdev, &console_fops);
3265         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
3266             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
3267                 panic("Couldn't register /dev/tty0 driver\n");
3268         devfs_mk_cdev(MKDEV(TTY_MAJOR, 0), S_IFCHR|S_IRUSR|S_IWUSR, "vc/0");
3269         class_device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), NULL, "tty0");
3270
3271         vty_init();
3272 #endif
3273         return 0;
3274 }
3275 module_init(tty_init);